[ { "path": ".gitignore", "content": "#\r\n# This file needs to exist to work-around a bug in Visual Studio 2013's Git.\r\n#\r\n# Without this file, VS doesn't read any .gitignore files in any subdirectories\r\n# of this directory, with the end result being that some should-be-ignored files\r\n# show up as \"Untracked Files\" in the \"Team Explorer - Changes\" panel.\r\n#\r\n" }, { "path": "LICENSE", "content": "Ironclad 1.0\r\n\r\nCopyright (c) Microsoft Corporation\r\nAll rights reserved. \r\n\r\nMIT License\r\n\r\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"\"Software\"\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\r\n\r\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\r\n\r\nTHE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\r\n\r\n\r\n" }, { "path": "README.md", "content": "# About\r\n\r\nTo learn more about the Ironclad Apps project, please see the related [README](./ironclad-apps/README.md) file.\r\n\r\nTo learn more about the IronFleet project, please see the related [README](./ironfleet/README.md) file.\r\n\r\n" }, { "path": "SECURITY.md", "content": "\n\n## Security\n\nMicrosoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet), [Xamarin](https://github.com/xamarin), and [our GitHub organizations](https://opensource.microsoft.com/).\n\nIf you believe you have found a security vulnerability in any Microsoft-owned repository that meets [Microsoft's definition of a security vulnerability](https://aka.ms/opensource/security/definition), please report it to us as described below.\n\n## Reporting Security Issues\n\n**Please do not report security vulnerabilities through public GitHub issues.**\n\nInstead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://aka.ms/opensource/security/create-report).\n\nIf you prefer to submit without logging in, send email to [secure@microsoft.com](mailto:secure@microsoft.com). If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://aka.ms/opensource/security/pgpkey).\n\nYou should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://aka.ms/opensource/security/msrc). \n\nPlease include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:\n\n * Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)\n * Full paths of source file(s) related to the manifestation of the issue\n * The location of the affected source code (tag/branch/commit or direct URL)\n * Any special configuration required to reproduce the issue\n * Step-by-step instructions to reproduce the issue\n * Proof-of-concept or exploit code (if possible)\n * Impact of the issue, including how an attacker might exploit the issue\n\nThis information will help us triage your report more quickly.\n\nIf you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://aka.ms/opensource/security/bounty) page for more details about our active programs.\n\n## Preferred Languages\n\nWe prefer all communications to be in English.\n\n## Policy\n\nMicrosoft follows the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/opensource/security/cvd).\n\n\n" }, { "path": "ironclad-apps/.gitignore", "content": "codeplex\r\nobj/\r\nobj-*/\r\nbin-*/\r\nbin/\r\nbin_tools/\r\nobj_tools/\r\nsrc/Clients/*/bin/\r\n*-disabled\r\nnucache/\r\nnuobj/\r\nnutemp/\r\nnubuild.config\r\nnubuild.cloud-credentials\r\nnubuild.log\r\nnubuild.progress\r\nExperiments/\r\n*.csproj.user\r\nStyleCop.Cache\r\ntmp/\r\n" }, { "path": "ironclad-apps/IRONROOT.sentinel", "content": "This file marks the top of the Ironclad source repository.\r\nIts presence is used by the NuBuild system to orient itself\r\nto the src/, nuobj/, and nucache/ directories.\r\n" }, { "path": "ironclad-apps/README.md", "content": "# About\r\n\r\nThis directory contains experimental verified Ironclad Apps code,\r\nas described in:\r\n\r\n> [_Ironclad Apps: End-to-End Security via Automated Full-System Verification_](http://research.microsoft.com/apps/pubs/default.aspx?id=230123)\r\n> Chris Hawblitzel, Jon Howell, Jacob R. Lorch, Arjun Narayan, Bryan Parno, Danfeng Zhang, and Brian Zill.\r\n> In Proceedings of the USENIX Symposium on Operating Systems Design and Implementation (OSDI)\r\n> October 6, 2014.\r\n\r\nAs a brief summary, an Ironclad App lets a user securely transmit her data to a remote\r\nmachine with the guarantee that every instruction executed on that machine adheres to a\r\nformal abstract specification of the app’s behavior. This does more than eliminate\r\nimplementation vulnerabilities such as buffer overflows, parsing errors, or data leaks; it\r\ntells the user exactly how the app will behave at all times. We provide these guarantees\r\nvia complete, low-level software verification. We then use cryptography and secure\r\nhardware to enable secure channels from the verified software to remote users. To achieve\r\nsuch complete verification, we developed a set of new and modified tools, a collection of\r\ntechniques and engineering disciplines, and a methodology focused on rapid development of\r\nverified systems software. We describe our methodology, formal results, and lessons we\r\nlearned from building a full stack of verified software. That software includes a verified\r\nkernel; verified drivers; verified system and crypto libraries including SHA, HMAC, and\r\nRSA; and four Ironclad Apps\r\n\r\nSee http://research.microsoft.com/ironclad for more details.\r\n\r\n# License\r\n\r\nThe Ironclad Apps code is licensed under the MIT license included in the [LICENSE](../ironfleet/LICENSE) file.\r\n\r\n# Setup\r\n\r\nThe build process currently requires Windows PowerShell, though this should be relatively\r\nsimple to replace. Since the build process uses PowerShell scripts, script execution must\r\nbe enabled. (For example, launch \"powershell.exe -ExecutionPolicy RemoteSigned\".)\r\n\r\nTo build the tools from a PowerShell prompt, simply run: `.\\build-tools`. \r\nThis will build all of the basic tools, including NuBuild (aka IronBuild),\r\nour distributed verification and build tool.\r\n\r\nTo use Dafny interactively, you'll need Visual Studio 2012 or newer, Vim, or Emacs.\r\nEach has a plugin:\r\n - For Vim, we suggest the vim-loves-dafny plugin:\r\n https://github.com/mlr-msft/vim-loves-dafny\r\n - For Emacs, we suggest the Emacs packages boogie-mode and dafny-mode:\r\n https://github.com/boogie-org/boogie-friends\r\n - For Visual Studio, open:\r\n `./tools/Dafny/DafnyLanguageService.vsix`\r\n to install the Dafny plugin with our default settings.\r\n If you're running on Windows Server, and you see an error message that says Z3 has crashed,\r\n then you may need to install the \r\n [Microsoft Visual C++ runtime](http://www.microsoft.com/en-us/download/details.aspx?id=5555).\r\n \r\nThese instructions assume you're running on Windows. However, Dafny, and all of its\r\ndependencies, also run on Linux. You can obtain Dafny sources from:\r\n\r\n https://github.com/Microsoft/Dafny/\r\n\r\nDafny's INSTALL file contains instructions for building on Linux with Mono. Note that we have\r\nnot yet tested building our build tool, NuBuild, on Linux, so your mileage may vary.\r\n\r\n# Verification\r\n\r\nTo perform our definitive verifications, we use our NuBuild tool, which handles dependency\r\ntracking, caches intermediate verification results locally and in the cloud, and can\r\nutilize a cluster of cloud VMs to parallelize verification. To enable cloud features,\r\nyou'll need an Azure account and an Azure storage account. Once you have an Azure storage\r\naccount, put your storage account's connection string into the\r\n`bin_tools/NuBuild/Nubuild.exe.config` file. This will let you make use of the cloud\r\ncache capabilities. To use the cloud build functionality, you'll need to add your\r\nsubscription Id and Certificate (base64 encoded) to\r\n`bin_tools/NuBuild/AzureManage.exe.config`, which will then let you manage a cluster of\r\nVMs to serve as workers.\r\nYou can still use NuBuild without cloud support, however, by passing the `--no-cloudcache` option.\r\n\r\nIn the examples below, we'll assume you're using Cygwin, but other shells (e.g.,\r\nPowershell) should work as well. \r\n\r\nTo verify an individual Dafny file (and all of its dependencies), run:\r\n\r\n `./bin_tools/NuBuild/NuBuild.exe --no-cloudcache -j 3 DafnyVerifyTree src/Dafny/Libraries/Math/power2.i.dfy`\r\n\r\nwhich uses the `-j` flag to add 3-way local parallelism.\r\n\r\nTo verify a forest of Dafny files (e.g., all of the IronFleet files), run:\r\n\r\n `./bin_tools/NuBuild/NuBuild.exe --no-cloudcache -j 3 BatchDafny src/Dafny/Apps/apps.dfy.batch`\r\n\r\nto do a high-level Dafny verification. This is a useful\r\nsanity check, but it is not the definitive verification for the system.\r\n\r\nThe definitive verification, which includes all of the assembly code that will be\r\nexecuted, is run via:\r\n\r\n `./bin_tools/NuBuild/NuBuild.exe --no-cloudcache -j 3 IroncladApp src/Dafny/Apps/DafnyCCTest/Main.i.dfy`\r\n\r\nto verify and build a very simple Ironclad App. Try pointing it at other files in:\r\n `./src/Dafny/Apps/*/Main.i.dfy`\r\nto build the other apps.\r\n\r\nTo build a version that actually boots, use `BootableApp` in place of `IroncladApp`.\r\n\r\nTo build a debug version that runs on Windows, use the `--windows flag` to NuBuild. \r\nThis is most useful when accompanied by the `--useFramePointer` which enables more detailed profiling.\r\n\r\n# Running\r\n\r\nTo run an Ironclad App, you'll need an AMD machine with SVM support and a TPM. Adjust\r\n`boot/boot-cp.cmd` to point at the executable output by the `BootableApp` verb above,\r\nand run `boot/boot-cp.cmd`, which will start a PXE boot server that your AMD machine\r\nshould be configured to connect to.\r\n\r\n# Contributing\r\n\r\nSee the [CONTRIBUTING](../ironfleet/CONTRIBUTING.md) file for more details.\r\n\r\n# Version History\r\n- v0.1: Initial code release on GitHub.\r\n" }, { "path": "ironclad-apps/boot/boot-cp.cmd", "content": "@rem //////////////////////////////////////////////////////////////////////\r\n@rem \r\n@rem Microsoft Research Singularity\r\n@rem \r\n@rem Copyright (c) Microsoft Corporation. All rights reserved.\r\n@rem \r\n@rem This script launches bootd with paths set up for the current build\r\n@rem environment. It replies to hosts specified in the file\r\n@rem %SINGULARITY_ROOT%\\boothosts.txt. MAC addresses should appear one per\r\n@rem line.\r\n@rem\r\n@echo off\r\n\r\nsetlocal enabledelayedexpansion enableextensions\r\n\r\n:parse\r\n\r\nif /I .%1==./1394 (\r\n set ConnectArgs=/dhcp /c:DBG=1\r\n shift\r\n goto :parse\r\n)\r\n\r\nif not defined BOOT_HOSTS (\r\n set BOOT_HOSTS=%~dp0\\boothosts.txt\r\n)\r\n\r\nif not exist \"%BOOT_HOSTS%\" (\r\n echo.Could not find boot hosts file:\r\n echo.\r\n echo. %BOOT_HOSTS%\r\n echo.\r\n echo.The boot hosts file should specify a list of MAC addresses one per\r\n echo.line for bootd to respond to. If IP addresses are to be associated\r\n echo.with a MAC address then they should be comma-separated from their MAC\r\n echo.addresses, e.g. 00-01-02-03-04-05,10.0.0.1\r\n exit /b 1\r\n)\r\n\r\n@rem NB using type here because of need to quote protect path to support\r\n@rem paths with spaces in.\r\nset MacArgs=\r\nfor /F %%m in ('type \"%BOOT_HOSTS%\"') do (\r\n set MacArgs=!MacArgs! /m:%%m\r\n)\r\n\r\nstart %~dp0\\bootd.exe /dhcp %ConnectArgs% /b:pxe-loader !MacArgs! /tftp /v ..\\nuobj\\src\\Dafny\\Apps\\BenchmarkService\\bootable-NoVerify %*\r\n" }, { "path": "ironclad-apps/boot/boothosts.txt", "content": "90-e2-ba-4f-0c-5b\r\nd4-85-64-c3-19-f6\r\n" }, { "path": "ironclad-apps/build-tools.ps1", "content": ". .\\env.ps1\r\n\r\n$ROOT=\".\"\r\n\r\n. $ROOT\\def.ps1 $args\r\n\r\n$NMAKE = \"$(ls $BUILD\\nmake.exe)\"\r\n$MSBUILD=\"C:/Windows/Microsoft.NET/Framework/v4.0.30319/MSBuild.exe\"\r\n$VSVERSION=\"/property:VisualStudioVersion=12.0\"\r\n\r\nensureDir(\"$OBJROOT\")\r\nensureDir(\"$BINROOT\")\r\n\r\n# Cygwin make helpfully passes along an argument that NMAKE doesn't understand\r\n$Env:MAKEFLAGS = \"\"\r\n\r\necho \"Building NuBuild\"\r\nrunShell \"cd tools\\NuBuild; & `\"$MSBUILD`\" $VSVERSION NuBuild.sln\"\r\n\r\nensureDir(\"$OBJROOT\\Checked\\BootLoader\\SingLdrPc\")\r\nensureDir(\"$OBJROOT\\Checked\\BootLoader\\x86\")\r\nensureDir(\"$OBJROOT\\Checked\\BootLoader\\tpm\")\r\n\r\necho \"Building Bootloader\"\r\nrunShell \"cd src\\Checked\\BootLoader\\SingLdrPc; & `\"$NMAKE`\" /nologo OBJ=..\\..\\..\\..\\obj$BUILD_SUFFIX\\Checked\\BootLoader\" pxe-loader\r\n" }, { "path": "ironclad-apps/def.ps1", "content": "$build_args = $args[0]\r\n$BUILD_SUFFIX = \"$($build_args | %{\"-$_\"})\".Replace(\" \", \"\")\r\n$BUILD_DEFS = $($build_args | %{\"-def\"; $_})\r\n\r\n$BUILD = \"$ROOT\\tools\\build\"\r\n$OBJROOT = \"$ROOT\\obj$BUILD_SUFFIX\"\r\n$BINROOT = \"$ROOT\\bin$BUILD_SUFFIX\"\r\n$BINTOOLS = \"$ROOT\\bin_tools\"\r\n$SPEC = \"$ROOT\\src\\Trusted\\Spec\"\r\n\r\n# By default, all the following should be true:\r\n$SYMDIFF_ENABLED = $false\r\n$BOOGIE_ENABLED = $true\r\n$DAFNYCC_INCREMENTAL_BUILD = $true\r\n\r\n# The AppLoader doesn't know any secrets, so we don't need to run SymDiff on it.\r\nif ($build_args -contains \"AppLoader\")\r\n{\r\n $SYMDIFF_ENABLED = $false\r\n}\r\n\r\nfunction list\r\n{\r\n @($args)\r\n}\r\n\r\n$boogieasm_x64_flag = \"\"\r\nif ($build_args.Contains(\"x64\"))\r\n{\r\n $boogieasm_x64_flag = \"-x64\"\r\n}\r\n\r\n# recursively flatten all arrays into a single array\r\nfunction flatten($arr)\r\n{\r\n do\r\n {\r\n $c = $arr.count\r\n $arr = @($arr | %{$_})\r\n } while ($c -ne $arr.count)\r\n ,($arr)\r\n}\r\n\r\nfunction run([Parameter(Mandatory=$true)]$cmd, [Parameter(ValueFromRemainingArguments=$true)]$arr)\r\n{\r\n & $cmd $(flatten $arr)\r\n if($LastExitCode)\r\n {\r\n throw \"error running $cmd $(flatten $arr)\"\r\n }\r\n}\r\n\r\nfunction runShell\r\n{\r\n powershell -command \"$(flatten $args)\"\r\n if($LastExitCode)\r\n {\r\n throw \"error running $(flatten $args)\"\r\n }\r\n}\r\n\r\nfunction needToBuild($out, $ins)\r\n{\r\n #Write-Host \"Do I need to build $out ?\"\r\n if (-not (test-path $out)) { return $true }\r\n $t = (get-item $out).LastWriteTimeUtc\r\n foreach ($f in $ins)\r\n {\r\n if (-not (test-path $f)) { throw \"cannot find input file $f\" }\r\n if ($t -lt (get-item $f).LastWriteTimeUtc) { return $true }\r\n #Write-Host \"Checking need to build based on: $f\"\r\n }\r\n return $false\r\n}\r\n\r\nfunction ensureDir($dir)\r\n{\r\n if (-not (test-path $dir)) { mkdir $dir }\r\n}\r\n\r\nfunction ensureDirForFile($path)\r\n{\r\n $dir = [System.IO.Path]::GetDirectoryName($path)\r\n if (-not (test-path $dir)) { mkdir $dir }\r\n}\r\n\r\nfunction _boogie_dbg([Parameter(Mandatory=$true)]$out, [Parameter(ValueFromRemainingArguments=$true)]$arr)\r\n{\r\n $arr = flatten $arr\r\n $boogieasm = \"$BINTOOLS\\boogieasm\\boogieasm.exe\"\r\n $ins = @($arr | ?{-not $_.StartsWith(\"/\")}) + @($boogieasm)\r\n if (needToBuild $out $ins)\r\n {\r\n ensureDirForFile($out)\r\n \"boogie $arr\"\r\n $bpls = $arr | ?{$_.EndsWith(\".bpl\")}\r\n $flags = $arr | ?{-not $_.EndsWith(\".bpl\")}\r\n run $boogieasm $BUILD_DEFS $boogieasm_x64_flag \"-verify\" \"-out\" \"$out.bpl\" $bpls\r\n $time1 = Get-Date\r\n & \"$ROOT\\..\\iron\\build\\boogie-new\\boogie.exe\" /printModel:4 /noinfer /typeEncoding:m $flags \"$out.bpl\" | out-file -encoding ascii \"$out.err\"\r\n #& \"$ROOT\\..\\iron\\build\\boogie-new\\boogie.exe\" /mv:model.bvd /noinfer /typeEncoding:m $flags \"$out.bpl\" | out-file -encoding ascii \"$out.err\"\r\n $time2 = Get-Date\r\n cat \"$out.err\"\r\n if(-not (findstr /c:\"verified, 0 errors\" \"$out.err\")) {throw \"error building $out\"}\r\n if( (findstr /c:\"inconclusive\" \"$out.err\")) {throw \"error building $out\"}\r\n if( (findstr /c:\"time out\" \"$out.err\")) {throw \"error building $out\"}\r\n mv -force \"$out.err\" $out\r\n \"Time: $($time2 - $time1)\"\r\n \"\"\r\n }\r\n}\r\n\r\nfunction __boogie_exe($out, $flags, $arr)\r\n{\r\n $time1 = Get-Date\r\n \"$ROOT\\tools\\Dafny\\boogie.exe /noinfer /typeEncoding:m /z3opt:ARITH_RANDOM_SEED=1 $flags $out.bpl\"\r\n & \"$ROOT\\tools\\Dafny\\boogie.exe\" /noinfer /typeEncoding:m /z3opt:ARITH_RANDOM_SEED=1 $flags \"$out.bpl\" | out-file -encoding ascii \"$out.err\"\r\n $time2 = Get-Date\r\n cat \"$out.err\"\r\n if(-not (findstr /c:\"verified, 0 errors\" \"$out.err\")) {throw \"error building $out\"}\r\n if( (findstr /c:\"inconclusive\" \"$out.err\")) {throw \"error building $out\"}\r\n if( (findstr /c:\"time out\" \"$out.err\")) {throw \"error building $out\"}\r\n mv -force \"$out.err\" $out\r\n \"Time: $(($time2 - $time1).TotalSeconds) $out\"\r\n \"\"\r\n}\r\n\r\nfunction __boogie_sd_optional($out, $sdiff, $arr)\r\n{\r\n $arr = flatten $arr\r\n $boogieasm = \"$BINTOOLS\\boogieasm\\boogieasm.exe\"\r\n $ins = @($arr | ?{-not $_.StartsWith(\"/\")}) + @($boogieasm)\r\n $outname = $out\r\n\r\n\r\n # Assume the file to be verified is the last in line\r\n $src = $arr[-1]\r\n $src_i = $src.replace(\".bpl\", \"_i.bpl\") # Create the potential interface file name \r\n\r\n # Check whether the Boogie files use relational logic\r\n $rel_i = $false\r\n $pub_i = $false\r\n if (Test-Path ($src_i)) { # If this is the module implementation, check the interface too\r\n $rel_i = (Select-String -CaseSensitive \"[^a-zA-Z0-9_]relation\\(.*\\)\" $src_i).Count -gt 0\r\n $pub_i = (Select-String -CaseSensitive \"[^a-zA-Z0-9_]public\\(.*\\)\" $src_i).Count -gt 0\r\n }\r\n $rel = (Select-String -CaseSensitive \"[^a-zA-Z0-9_]relation\\(.*\\)\" $src).Count -gt 0 \r\n $pub = (Select-String -CaseSensitive \"[^a-zA-Z0-9_]public\\(.*\\)\" $src).Count -gt 0 \r\n\r\n if ($src.EndsWith(\"EntryCP.bpl\")) { # Special-case entry, since its interface lives in spec land\r\n $rel_i = $true\r\n }\r\n\r\n # Apply SymDiff if we find relation or public in the implementation or the interface\r\n $deduced_symdiff = $rel -or $pub -or $rel_i -or $pub_i\r\n\r\n #echo \"For $src, sdiff is $sdiff and I deduced $deduced_symdiff\" | out-file -append -encoding ascii sdiff.txt\r\n $sdiff = $deduced_symdiff\r\n\r\n if ($sdiff -and $SYMDIFF_ENABLED)\r\n {\r\n $outname = \"$out.merged\"\r\n }\r\n if (((needToBuild $outname $ins) -and $BOOGIE_ENABLED) -or ((-not $BOOGIE_ENABLED) -and (needToBuild \"$outname.assume\" $ins)))\r\n {\r\n ensureDirForFile($out)\r\n \"boogie $arr\"\r\n $bpls = $arr | ?{$_.EndsWith(\".bpl\")}\r\n $ba_flagnames = @(\"\")\r\n $ba_flags = $arr | ?{$ba_flagnames -contains $_} | %{$_.Replace(\"/\", \"-\")}\r\n $flags = $arr | ?{-not $_.EndsWith(\".bpl\")} | ?{-not ($ba_flagnames -contains $_)}\r\n $fulltime1 = Get-Date\r\n if ($sdiff)\r\n {\r\n run $boogieasm $BUILD_DEFS $boogieasm_x64_flag $ba_flags \"-verify\" \"-symdiffok\" \"-out\" \"$out.bpl\" $bpls\r\n run $boogieasm $BUILD_DEFS $boogieasm_x64_flag $ba_flags \"-verify\" \"-symdiffms\" \"$out.ms.bpl\" \"-out\" \"$out.symdiff.bpl\" $bpls\r\n }\r\n else\r\n {\r\n run $boogieasm $BUILD_DEFS $boogieasm_x64_flag $ba_flags \"-verify\" \"-out\" \"$out.bpl\" $bpls\r\n }\r\n $fulltime2 = Get-Date\r\n if ($BOOGIE_ENABLED) {\r\n __boogie_exe $out $flags $arr\r\n } else {\r\n echo $null > \"$out.assume\"\r\n }\r\n $fulltime3 = Get-Date\r\n if ($sdiff -and $SYMDIFF_ENABLED)\r\n {\r\n $save_dir = pwd\r\n try\r\n {\r\n $outfile = [System.IO.Path]::GetFileName($out)\r\n cd $([System.IO.Path]::GetDirectoryName($out))\r\n cp $($outfile + \".symdiff.bpl\") v1.bpl\r\n cp $($outfile + \".symdiff.bpl\") v2.bpl\r\n echo \"\" | out-file -encoding ascii ms_symdiff_file.bpl\r\n echo \"LOOPS\"\r\n run \"$SYMDIFF\\symdiff.exe\" -extractLoops v1.bpl v1_u.bpl\r\n run \"$SYMDIFF\\symdiff.exe\" -extractLoops v2.bpl v2_u.bpl\r\n echo \"INFER\"\r\n run \"$SYMDIFF\\symdiff.exe\" -inferConfig v1_u.bpl v2_u.bpl | out-file -encoding ascii v1_uv2_u.config\r\n echo \"CONFIGURE\"\r\n run $BINTOOLS\\boogieasm\\symdiffmerge.exe -config \"$outfile.ms.bpl\" v1_uv2_u.config | out-file -encoding ascii \"$outfile.config\"\r\n echo \"RUN SYMDIFF\"\r\n run \"$SYMDIFF\\symdiff.exe\" -allInOne v1_u.bpl v2_u.bpl \"$outfile.config\" -asserts -freeContracts -usemutual -sound -dontUseHoudiniForMS -checkMutualPrecondNonTerminating\r\n echo \"MERGE\"\r\n run $BINTOOLS\\boogieasm\\symdiffmerge.exe -merge \"$outfile.ms.bpl\" mergedProgSingle.bpl | out-file -encoding ascii \"$outfile.merged.bpl\"\r\n cd $save_dir\r\n echo \"RUN BOOGIE\"\r\n __boogie_exe $outname $flags $arr\r\n }\r\n finally\r\n {\r\n cd $save_dir\r\n }\r\n }\r\n $fulltime4 = Get-Date\r\n $t = $(($fulltime2 - $fulltime1).TotalSeconds); $t | out-file -encoding ascii \"$out.____$($t)____.time_bgasm\"\r\n $t = $(($fulltime3 - $fulltime2).TotalSeconds); $t | out-file -encoding ascii \"$out.____$($t)____.time_boogie\"\r\n $t = $(($fulltime4 - $fulltime3).TotalSeconds); $t | out-file -encoding ascii \"$out.____$($t)____.time_symdiff\"\r\n }\r\n}\r\n\r\nfunction _boogie_sd_optional([Parameter(Mandatory=$true)]$out, [Parameter(Mandatory=$true)]$relational, [Parameter(ValueFromRemainingArguments=$true)]$arr)\r\n{\r\n __boogie_sd_optional $out $relational $arr\r\n}\r\n\r\nfunction _boogie([Parameter(Mandatory=$true)]$out, [Parameter(ValueFromRemainingArguments=$true)]$arr)\r\n{\r\n __boogie_sd_optional $out $false $arr\r\n}\r\n\r\nfunction _boogie_symdiff([Parameter(Mandatory=$true)]$out, [Parameter(ValueFromRemainingArguments=$true)]$arr)\r\n{\r\n __boogie_sd_optional $out $true $arr\r\n}\r\n\r\nfunction _copy([Parameter(Mandatory=$true)]$out, [Parameter(Mandatory=$true)]$in)\r\n{\r\n $ins = list $in\r\n if (needToBuild $out $ins)\r\n {\r\n ensureDirForFile($out);\r\n \"copy -out $out -in $in\"\r\n cat $in | out-file -encoding ascii $out\r\n }\r\n}\r\n\r\nfunction _copy_if_different([Parameter(Mandatory=$true)]$out, [Parameter(Mandatory=$true)]$in)\r\n{\r\n if (-not $DAFNYCC_INCREMENTAL_BUILD)\r\n {\r\n cp $in $out\r\n }\r\n elseif (-not (test-path $out))\r\n {\r\n cp $in $out\r\n }\r\n else\r\n {\r\n $bytes_out = [System.IO.File]::ReadAllBytes((ls $out).FullName)\r\n $bytes_in = [System.IO.File]::ReadAllBytes((ls $in).FullName)\r\n if (-not ([System.Collections.StructuralComparisons]::StructuralEqualityComparer.Equals($bytes_out, $bytes_in)))\r\n {\r\n cp $in $out\r\n }\r\n }\r\n}\r\n\r\nfunction _cat([Parameter(Mandatory=$true)]$out, [Parameter(Mandatory=$true)][string[]]$in)\r\n{\r\n $ins = $in\r\n if (needToBuild $out $ins)\r\n {\r\n ensureDirForFile($out);\r\n \"cat -out $out -in $in\"\r\n cat $in | out-file -encoding ascii $out\r\n }\r\n}\r\n\r\nfunction _beat([Parameter(Mandatory=$true)]$out, [Parameter(Mandatory=$true)]$in, [string[]]$includes)\r\n{\r\n if ($includes -eq $null) { $includes = @() }\r\n $beat = \"$BINTOOLS\\beat\\beat.exe\"\r\n $ins = flatten (list $in $beat $includes)\r\n if (needToBuild $out $ins)\r\n {\r\n ensureDirForFile($out)\r\n $incls = @($includes | %{\"-i\"; $_})\r\n \"beat $BUILD_DEFS -out $out.tmp -in $in $incls\"\r\n # & $beat -printAndExit $BUILD_DEFS -in $in $incls | out-file -encoding ascii \"$out.ppall\"\r\n # if($LastExitCode) { cat \"$out.ppall\"; throw \"error building $out\" }\r\n # & $beat -printNonghostAndExit $BUILD_DEFS -in $in $incls | out-file -encoding ascii \"$out.ppwog\"\r\n # if($LastExitCode) { cat \"$out.ppwog\"; throw \"error building $out\" }\r\n & $beat $BUILD_DEFS -in $in $incls | out-file -encoding ascii \"$out.tmp\"\r\n if($LastExitCode)\r\n {\r\n cat \"$out.tmp\"\r\n throw \"error building $out\"\r\n }\r\n mv -force \"$out.tmp\" $out\r\n \"\"\r\n }\r\n}\r\n\r\nfunction _dafnyspec([Parameter(Mandatory=$true)]$outdir, [Parameter(Mandatory=$true)]$outlist, [Parameter(Mandatory=$true)]$deps, [Parameter(Mandatory=$true)]$in)\r\n{\r\n $dafnyspec = \"$BINTOOLS\\dafnyspec\\dafnyspec.exe\"\r\n $ins = flatten ((list $in $dafnyspec) + @($deps))\r\n if (needToBuild $outlist $ins)\r\n {\r\n ensureDirForFile(\"$outdir\\dummy\")\r\n \"dafnyspec $in /outdir:$outdir /outlist:$outlist\"\r\n & $dafnyspec $in /outdir:$outdir /outlist:$outlist\r\n if($LastExitCode)\r\n {\r\n throw \"error building $out\"\r\n }\r\n \"\"\r\n }\r\n}\r\n\r\nfunction _dafnycc([Parameter(Mandatory=$true)]$outdir, [Parameter(Mandatory=$true)]$outlist, [Parameter(Mandatory=$true)]$heap, [Parameter(Mandatory=$true)]$heapi, [Parameter(Mandatory=$true)]$deps, [Parameter(Mandatory=$true)]$in)\r\n{\r\n $dafnycc = \"$BINTOOLS\\dafnycc\\dafnycc.exe\"\r\n $ins = flatten ((list $in $dafnycc) + @($deps))\r\n if ($build_args.Contains(\"x64\"))\r\n {\r\n $x64_flag = \"/x64\"\r\n }\r\n if (needToBuild $heap $ins)\r\n {\r\n ensureDirForFile($heap)\r\n ensureDirForFile($heapi)\r\n ensureDirForFile(\"$outdir\\dummy\")\r\n \"dafnycc $in /useFramePointer /heapfile:$heap /heapifile:$heapi /outdir:$outdir /relational /outlist:$outlist $x64_flag\"\r\n & $dafnycc $in /useFramePointer /heapfile:$heap /heapifile:$heapi /outdir:$outdir /relational /outlist:$outlist $x64_flag\r\n if($LastExitCode)\r\n {\r\n throw \"error building $out\"\r\n }\r\n \"\"\r\n }\r\n}\r\n\r\nfunction _boogieasm([Parameter(Mandatory=$true)]$out, [Parameter(ValueFromRemainingArguments=$true)]$arr)\r\n{\r\n $boogieasm = \"$BINTOOLS\\boogieasm\\boogieasm.exe\"\r\n $arr = flatten $arr\r\n $ins = @($arr | %{\"$_.bpl\"}) + @($arr | %{\"$($_)_i.bpl\"}) + @($boogieasm)\r\n if (needToBuild $out $ins)\r\n {\r\n ensureDirForFile($out)\r\n \"$boogieasm $BUILD_DEFS $boogieasm_x64_flag -link $arr | out-file -encoding ascii $out.tmp \"\r\n & $boogieasm $BUILD_DEFS $boogieasm_x64_flag -link $arr | out-file -encoding ascii \"$out.tmp\"\r\n if($LastExitCode)\r\n {\r\n #cat \"$out.tmp\" | out-file -encoding ascii \"$OBJROOT\\$out.tmp\"\r\n throw \"error building $out. Check the end of $out.tmp for more details.\"\r\n }\r\n mv -force \"$out.tmp\" $out\r\n \"\"\r\n }\r\n}\r\n\r\nfunction _cdimage([Parameter(Mandatory=$true)]$inDir, [Parameter(Mandatory=$true)]$bootSector, [Parameter(Mandatory=$true)]$out, [Parameter(ValueFromRemainingArguments=$true)]$arr)\r\n{\r\n $arr = flatten $arr\r\n $ins = @(ls -r $inDir | %{$_.FullName}) + @($bootsector)\r\n if (needToBuild $out $ins)\r\n {\r\n ensureDirForFile($out)\r\n \"cdimage $arr -b$bootSector $inDir $out\"\r\n run $BUILD\\cdimage.exe $arr \"-b$bootSector\" $inDir $out\r\n \"\"\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/env.ps1", "content": "if ($env:SAFEOS_ROOT -eq $null)\r\n{\r\n $env:SAFEOS_ROOT = $PWD\r\n $env:PATH = $env:PATH + \";$env:SAFEOS_ROOT\\tools\\build\"\r\n}\r\n" }, { "path": "ironclad-apps/makefile", "content": "NUBUILD=bin_tools/NuBuild/NuBuild.exe -j $(j)\r\n\r\nall: $(NUBUILD)\r\n\t$(NUBUILD) DafnyVerifyTree src/Dafny/apps/apps.batch\r\n#\t$(NUBUILD) --html nuobj/summary.html DafnyVerifyTree src/Dafny/apps/apps.batch\r\n\r\n$(NUBUILD):\r\n\tmake -C tools/NuBuild\r\n\r\nnuobj/test.tgz: all\r\n\tfind nuobj -name \\*.vdfy | tar --files-from=- -czf $@\r\n\r\n#all:\r\n#\ttools/scripts/ironmake.py\r\n#\t+make -C obj\r\n\r\n#test.tgz:\r\n#\ttools/scripts/ironmake.py\r\n#\t+DAFNYTIMELIMIT=120 make -C obj test.tgz\r\n\r\nclean-dafny:\r\n\tfind obj -name \\*.res\\* | xargs rm\r\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/.gitignore", "content": "tags\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/bl.h", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// bl.h\n//\n// Abstract:\n//\n// This module contains definitions for the boot loader.\n//\n// Environment:\n//\n// Boot loader.\n//\n//--\n\n#pragma once\n\n#pragma warning(disable:4127) // conditional expression is constant\n#pragma warning(disable:4152) // function/data pointer conversion in expression\n#pragma warning(disable:4200) // zero-sized array in struct/union\n#pragma warning(disable:4201) // nameless struct/union\n#pragma warning(disable:4214) // bit field types other than int\n\n//\n// Constants for selectively enabling verbose debug output.\n//\n\n#define ACPI_VERBOSE 0\n#define APM_VERBOSE 0\n#define CDROM_VERBOSE 0\n#define COM_VERBOSE 0\n#define DISTRO_VERBOSE 1\n#define FAT_VERBOSE 0\n#define KD_VERBOSE 0\n#define MM_VERBOSE 0\n#define MPS_VERBOSE 0\n#define PCI_VERBOSE 0\n#define PECOFF_VERBOSE 1\n#define PNP_VERBOSE 0\n#define POOL_VERBOSE 0\n#define PXE_VERBOSE 0\n#define SINGULARITY_VERBOSE 0\n#define SMAP_VERBOSE 0\n\n#define DEBUG_MSG(msg) \\\n{ \\\n UINT32 my_debug_cntr = 0; \\\n while (my_debug_cntr < 1<<31) { \\\n if (my_debug_cntr == 0) { \\\n BlRtlPrintf(msg); \\\n } \\\n my_debug_cntr += 1; \\\n } \\\n}\n\n\n//\n// Basic platform constants.\n//\n\n#define PAGE_SIZE 4096\n#define LEGACY_MEMORY_LIMIT 0x100000\n\n//\n// Compile-time assertion support.\n//\n\n#define C_ASSERT(e) typedef char __C_ASSERT__[(e)?1:-1]\n\n//\n// Basic integer types.\n//\n\ntypedef char CHAR;\ntypedef unsigned char UCHAR;\n\ntypedef char INT8;\ntypedef unsigned char UINT8;\ntypedef short INT16;\ntypedef unsigned short UINT16;\ntypedef long INT32;\ntypedef unsigned long UINT32;\ntypedef __int64 INT64;\ntypedef unsigned __int64 UINT64;\n\n#if defined(BOOT_X86)\n\ntypedef INT32 LONG_PTR;\ntypedef UINT32 ULONG_PTR;\n\n#elif defined (BOOT_X64)\n\ntypedef INT64 LONG_PTR;\ntypedef UINT64 ULONG_PTR;\n\n#endif\n\n\n//\n// Basic boolean type.\n//\n\ntypedef unsigned char BOOLEAN;\n\n//\n// Basic pointer types.\n//\n\ntypedef void VOID;\ntypedef VOID * PVOID;\ntypedef const VOID * PCVOID;\ntypedef CHAR * PCHAR;\ntypedef INT8 * PINT8;\ntypedef UINT8 * PUINT8;\ntypedef INT16 * PINT16;\ntypedef UINT16 * PUINT16;\ntypedef INT32 * PINT32;\ntypedef UINT32 * PUINT32;\ntypedef INT64 * PINT64;\ntypedef UINT64 * PUINT64;\ntypedef LONG_PTR * PLONG_PTR;\ntypedef ULONG_PTR * PULONG_PTR;\ntypedef BOOLEAN PBOOLEAN;\n\n//\n// Wide character types.\n//\n\ntypedef wchar_t WCHAR;\ntypedef WCHAR * PWCHAR;\ntypedef const WCHAR * PCWSTR;\ntypedef const CHAR * PCSTR;\n\n//\n// Structure macros.\n//\n\n#define FIELD_OFFSET(Type, Field) ((UINT32) (ULONG_PTR) &(((Type *) 0)->Field))\n#define CONTAINING_RECORD(Address, Type, Field) ((Type *) ((ULONG_PTR) (Address) - FIELD_OFFSET(Type, Field)))\n#define ARRAY_SIZE(Array) (sizeof(Array) / sizeof(Array[0]))\n\n//\n// Macros for rounding up.\n//\n\n#define ROUND_UP_TO_POWER2(X, P) (((X) + ((P) - 1)) & (~((P) - 1)))\n#define ROUND_UP_TO_PAGES(X) ROUND_UP_TO_POWER2(X, PAGE_SIZE)\n\n//\n// The following macro is used to satisfy the compiler. Note that the\n// expressions/statements passed to this macro are not necessary for\n// correctness, but without them the compiler cannot compile with W4.\n//\n\n#define SATISFY_OVERZEALOUS_COMPILER(X) X\n\n//\n// Function modifiers.\n//\n\n#define FORCEINLINE __forceinline\n\n//\n// Basic constants.\n//\n\n#define FALSE 0\n#define TRUE 1\n#define NULL 0\n\n//\n// va support (from vadefs.h).\n//\n\ntypedef char *va_list;\n\n#if defined(BOOT_X86)\n\n#define _ADDRESSOF(v) ( &(v) )\n#define _INTSIZEOF(n) ( (sizeof(n) + sizeof(int) - 1) & ~(sizeof(int) - 1) )\n\n#define _crt_va_start(ap,v) ( ap = (va_list)_ADDRESSOF(v) + _INTSIZEOF(v) )\n#define _crt_va_arg(ap,t) ( *(t *)((ap += _INTSIZEOF(t)) - _INTSIZEOF(t)) )\n#define _crt_va_end(ap) ( ap = (va_list)0 )\n\n#elif defined(BOOT_X64)\n\nextern \"C\" void __cdecl __va_start(va_list *, ...);\n\n#define _crt_va_start(ap, x) ( __va_start(&ap, x) )\n#define _crt_va_arg(ap, t) \\\n ( ( sizeof(t) > sizeof(__int64) || ( sizeof(t) & (sizeof(t) - 1) ) != 0 ) \\\n ? **(t **)( ( ap += sizeof(__int64) ) - sizeof(__int64) ) \\\n : *(t *)( ( ap += sizeof(__int64) ) - sizeof(__int64) ) )\n#define _crt_va_end(ap) ( ap = (va_list)0 )\n\n#endif\n\n#define va_start _crt_va_start\n#define va_arg _crt_va_arg\n#define va_end _crt_va_end\n\nUINT32\nDisablePaging(\n UINT32 arg\n );\n\n//\n// Runtime assertion support.\n//\n\nBOOLEAN\nBlRtlPrintf(\n PCSTR Format,\n ...\n );\n\nVOID\nBlRtlHaltInternal(\n PCSTR FileName,\n UINT32 LineNumber\n );\n\nVOID\nBlRtlAssertFailed(\n PCSTR FileName,\n UINT32 LineNumber\n );\n\nVOID\nBlRtlAssertFailedPtr(\n PCSTR FileName,\n UINT32 LineNumber,\n ULONG_PTR Param\n );\n\n#define BlRtlHalt() BlRtlHaltInternal(__FILE__, __LINE__)\n\n#define BLASSERT(X) \\\n if (!(X)) { \\\n BlRtlAssertFailed(__FILE__, __LINE__); \\\n }\n\n#define BLASSERT_PTR(X, P) \\\n if (!(X)) { \\\n BlRtlAssertFailedPtr(__FILE__, __LINE__, (ULONG_PTR) (P)); \\\n }\n\n//\n// Linked list support.\n//\n\ntypedef struct _LIST_ENTRY {\n struct _LIST_ENTRY *Flink;\n struct _LIST_ENTRY *Blink;\n} LIST_ENTRY, *PLIST_ENTRY;\n\nVOID\nBlRtlInitializeListHead(\n PLIST_ENTRY Head\n );\n\nBOOLEAN\nBlRtlIsListEmpty(\n PLIST_ENTRY Head\n );\n\nBOOLEAN\nBlRtlRemoveEntryList(\n PLIST_ENTRY Entry\n );\n\nPLIST_ENTRY\nBlRtlRemoveHeadList(\n PLIST_ENTRY Head\n );\n\nPLIST_ENTRY\nBlRtlRemoveTailList(\n PLIST_ENTRY Head\n );\n\nVOID\nBlRtlInsertTailList(\n PLIST_ENTRY Head,\n PLIST_ENTRY Entry\n );\n\nVOID\nBlRtlInsertHeadList(\n PLIST_ENTRY Head,\n PLIST_ENTRY Entry\n );\n\n//\n// Legacy far pointer support.\n//\n\ntypedef struct _FAR_POINTER {\n UINT16 Offset;\n UINT16 Segment;\n} FAR_POINTER, *PFAR_POINTER;\n\nC_ASSERT(sizeof(FAR_POINTER) == sizeof(UINT32));\n\nVOID\nBlRtlConvertLinearPointerToFarPointer(\n PVOID LinearPointer,\n PFAR_POINTER FarPointer\n );\n\nPVOID\nBlRtlConvertFarPointerToLinearPointer(\n PFAR_POINTER FarPointer\n );\n\n//\n// Boot environment block.\n//\n\ntypedef struct _BEB {\n UINT32 BootType;\n UINT32 BootDriveNumber;\n UINT32 FlashImage;\n UINT32 SmapAddr;\n UINT32 SmapSize;\n UINT32 LegacyCallAddress;\n UINT32 LegacyReturnAddress;\n UINT32 LegacyReturnCr3;\n UINT32 LegacyCall_OpCode;\n UINT32 LegacyCall_Vector;\n UINT32 LegacyCall_ax;\n UINT32 LegacyCall_bx;\n UINT32 LegacyCall_cx;\n UINT32 LegacyCall_dx;\n UINT32 LegacyCall_si;\n UINT32 LegacyCall_di;\n UINT32 LegacyCall_ds;\n UINT32 LegacyCall_es;\n UINT32 LegacyCall_flags;\n FAR_POINTER LegacyCall_FramePtr;\n UINT32 LegacyCall_FrameSize;\n FAR_POINTER LegacyCall_FuncPtr;\n FAR_POINTER ApEntry16;\n UINT32 ApEntry;\n FAR_POINTER ApStartupLock;\n} BEB, *PBEB;\n\n#define BEB_BASE ((ULONG_PTR) 0x2F000)\n\nFORCEINLINE\nPBEB\nBlGetBeb(\n VOID\n )\n\n//++\n//\n//Routine Description:\n//\n// This function returns a pointer to the boot environment block.\n//\n//Return Value:\n//\n// Pointer to the boot environment block.\n//\n//--\n\n{\n return ((PBEB) BEB_BASE);\n}\n\n//\n// Boot sources.\n//\n\n#define BL_CD_BOOT 1\n#define BL_FAT16_BOOT 2\n#define BL_FAT32_BOOT 3\n#define BL_PXE_BOOT 4\n#define BL_FLASH_BOOT 5\n\n//\n// Legacy call context.\n//\n\ntypedef struct _BL_LEGACY_CALL_CONTEXT {\n UINT32 eax;\n UINT32 ebx;\n UINT32 ecx;\n UINT32 edx;\n UINT32 esi;\n UINT32 edi;\n UINT32 ds;\n UINT32 es;\n UINT32 eflags;\n} BL_LEGACY_CALL_CONTEXT, *PBL_LEGACY_CALL_CONTEXT;\n\n//\n// Legacy call opcodes.\n//\n\n#define LC_NOP 0x0000\n#define LC_INTXX 0x0001\n#define LC_FARCALL 0x0002\n\n//\n// RFLAGS.\n//\n\n#define RFLAGS_CF 0x0001\n\n//\n// Utility functions.\n//\n\nVOID\nBlRtlZeroMemory(\n PVOID Buffer,\n ULONG_PTR Length\n );\n\nVOID\nBlRtlCopyMemory(\n PVOID Destination,\n PCVOID Source,\n ULONG_PTR Length\n );\n\nBOOLEAN\nBlRtlCompareMemory(\n PCVOID Buffer1,\n PCVOID Buffer2,\n ULONG_PTR Length\n );\n\nVOID\nBlRtlCallLegacyInterruptService(\n UINT8 Vector,\n PBL_LEGACY_CALL_CONTEXT Input,\n PBL_LEGACY_CALL_CONTEXT Output\n );\n\nVOID\nBlRtlCallLegacyFunction(\n UINT16 CodeSegment16,\n UINT16 CodeOffset16,\n PVOID CallFrame,\n UINT32 CallFrameSize,\n PBL_LEGACY_CALL_CONTEXT Input,\n PBL_LEGACY_CALL_CONTEXT Output\n );\n\nUINT8\nBlRtlComputeChecksum8(\n PCVOID Buffer,\n UINT32 Size\n );\n\nUINT32\nBlGetCpuidEax(\n UINT32 reg\n );\n\nUINT32\nBlGetCpuidEbx(\n UINT32 reg\n );\n\nUINT32\nBlGetCpuidEcx(\n UINT32 reg\n );\n\nUINT32\nBlGetCpuidEdx(\n UINT32 reg\n );\n\n//\n// Constants and macros for accessing the keyboard controller.\n//\n\n#define BL_KEYBOARD_STATUS_PORT 0x0064\n#define BL_KEYBOARD_COMMAND_PORT 0x0064\n#define BL_KEYBOARD_DATA_PORT 0x0060\n\n#define BL_KEYBOARD_STATUS_INPUT_BUFFER_FULL 0x02\n\n#define BL_KEYBOARD_COMMAND_WRITE_OUTPUT_PORT 0xD1\n#define BL_KEYBOARD_COMMAND_PULSE_RESET_BIT 0xFE\n#define BL_KEYBOARD_COMMAND_PULSE_OUTPUT_PORT 0xFF\n\n#define BL_KEYBOARD_A20_ENABLE 0xDF\n\n#define BL_KEYBOARD_WAIT_FOR_IDLE() \\\n while ((BlRtlReadPort8(BL_KEYBOARD_STATUS_PORT) & BL_KEYBOARD_STATUS_INPUT_BUFFER_FULL) != 0) { \\\n }\n\n#define BL_KEYBOARD_WRITE_COMMAND(X) \\\n { \\\n BL_KEYBOARD_WAIT_FOR_IDLE(); \\\n BlRtlWritePort8(BL_KEYBOARD_COMMAND_PORT, (X)); \\\n BL_KEYBOARD_WAIT_FOR_IDLE(); \\\n }\n\n#define BL_KEYBOARD_WRITE_OUTPUT_PORT(X) \\\n { \\\n BL_KEYBOARD_WAIT_FOR_IDLE(); \\\n BlRtlWritePort8(BL_KEYBOARD_COMMAND_PORT, BL_KEYBOARD_COMMAND_WRITE_OUTPUT_PORT); \\\n BL_KEYBOARD_WAIT_FOR_IDLE(); \\\n BlRtlWritePort8(BL_KEYBOARD_DATA_PORT, (X)); \\\n BL_KEYBOARD_WAIT_FOR_IDLE(); \\\n }\n\nVOID\nBlRtlResetSystem(\n VOID\n );\n\nVOID\nBlRtlShutdownSystem(\n VOID\n );\n\n//\n// Drive access routines.\n//\n\n#pragma pack(1)\n\ntypedef struct _INT13_DRIVE_PARAMETERS {\n UINT16 StructureSize;\n UINT16 InformationFlags;\n UINT32 NumberOfCylinders;\n UINT32 NumberOfHeads;\n UINT32 SectorsPerTrack;\n UINT64 TotalNumberOfSectors;\n UINT16 BytesPerSector;\n} INT13_DRIVE_PARAMETERS, *PINT13_DRIVE_PARAMETERS;\n\nC_ASSERT(sizeof(INT13_DRIVE_PARAMETERS) == 0x1A);\n\n#pragma pack()\n\nBOOLEAN\nBlRtlGetDriveParameters(\n UINT8 DriveId,\n PINT13_DRIVE_PARAMETERS DriveParameters\n );\n\nBOOLEAN\nBlRtlReadDrive(\n UINT8 DriveId,\n UINT64 FirstBlock,\n UINT16 NumberOfBlocks,\n PVOID Buffer\n );\n\n//\n// I/O port access routines.\n//\n\nUINT8\nBlRtlReadPort8(\n UINT16 Port\n );\n\nUINT32\nBlRtlReadPort32(\n UINT16 Port\n );\n\nVOID\nBlRtlWritePort8(\n UINT16 Port,\n UINT8 Value\n );\n\nVOID\nBlRtlWritePort32(\n UINT16 Port,\n UINT32 Value\n );\n\n//\n// String support.\n//\n\nCHAR\nBlRtlConvertCharacterToUpperCase(\n CHAR C\n );\n\nPCSTR\nBlRtlFindSubstring(\n PCSTR String,\n PCSTR Substring\n );\n\nBOOLEAN\nBlRtlParsePositiveDecimal(\n PCSTR String,\n PUINT32 Number,\n PUINT32 CharactersConsumed\n );\n\nBOOLEAN\nBlRtlFormatString(\n PCHAR Output,\n UINT32 OutputSize,\n PCSTR Format,\n va_list ArgumentList\n );\n\nUINT32\nBlRtlStringLength(\n PCSTR String\n );\n\nUINT32\nBlRtlStringLengthW(\n PCWSTR String\n );\n\nBOOLEAN\nBlRtlEqualStringN(\n PCSTR String1,\n PCSTR String2,\n UINT32 Count\n );\n\nBOOLEAN\nBlRtlEqualStringI(\n PCSTR String1,\n PCSTR String2\n );\n\n//\n// Video support.\n//\n\nVOID\nBlVideoPrintString(\n PCSTR String\n );\n\nBOOLEAN\nBlVideoPrintf(\n PCSTR Format,\n ...\n );\n\nVOID\nBlVideoInitialize(\n VOID\n );\n\n//\n// COM port support.\n//\n\n#define COM_MAX_PORT 4\n\nextern const UINT16 BlComBasePort[COM_MAX_PORT + 1];\n\nBOOLEAN\nBlComInitialize(\n UINT8 PortNumber,\n UINT32 BaudRate\n );\n\nBOOLEAN\nBlComSendByte(\n UINT8 PortNumber,\n UINT8 Byte\n );\n\nBOOLEAN\nBlComDataAvailable(\n UINT8 PortNumber\n );\n\nUINT8\nBlComReceiveByte(\n UINT8 PortNumber\n );\n\n//\n// KD support.\n//\n\n#define KD_RETRY_COUNT 16\n\n#define KD_PACKET_LEADER 0x30303030\n#define KD_CONTROL_PACKET_LEADER 0x69696969\n\n#define KD_PACKET_TYPE_KD_DEBUG_IO 3\n#define KD_PACKET_TYPE_KD_RESEND 5 // Packet-control type\n#define KD_PACKET_TYPE_KD_RESET 6 // Packet-control type\n\n#define KD_API_PRINT_STRING 0x00003230\n\ntypedef struct _KD_PACKET {\n UINT32 PacketLeader;\n UINT16 PacketType;\n UINT16 ByteCount;\n UINT32 PacketId;\n UINT32 Checksum;\n} KD_PACKET, *PKD_PACKET;\n\ntypedef struct _KD_PRINT_STRING {\n UINT32 LengthOfString;\n} KD_PRINT_STRING, *PKD_PRINT_STRING;\n\ntypedef struct _KD_GET_STRING {\n UINT32 LengthOfPromptString;\n UINT32 LengthOfStringRead;\n} KD_GET_STRING, *PKD_GET_STRING;\n\ntypedef struct _KD_DEBUG_IO {\n UINT32 ApiNumber;\n UINT16 ProcessorLevel;\n UINT16 Processor;\n union {\n KD_PRINT_STRING PrintString;\n KD_GET_STRING GetString;\n } u1;\n} KD_DEBUG_IO, *PKD_DEBUG_IO;\n\nextern UINT8 BlSingularityOhci1394Buffer[3 * PAGE_SIZE];\n\nextern UINT8 BlKdComPort;\n\nextern UINT32 BlKdNextPacketId;\n\nVOID\nBlKdInitialize(\n VOID\n );\n\nVOID\nBlKdSpin(\n VOID\n );\n\nBOOLEAN\nBlKdPrintString(\n PCSTR String\n );\n\nBOOLEAN\nBlKdPrintf(\n PCSTR Format,\n ...\n );\n\nUINT32\nBlKdComputeChecksum(\n PCVOID Buffer,\n UINT32 Length\n );\n\nBOOLEAN\nBlKd1394Connect(\n VOID\n );\n\nBOOLEAN\nBlKd1394SendPacket(\n UINT16 PacketType,\n PCVOID Header,\n UINT16 HeaderSize,\n PCVOID Data,\n UINT16 DataSize\n );\n\nBOOLEAN\nBlKdComConnect(\n VOID\n );\n\nBOOLEAN\nBlKdComSendPacket(\n UINT16 PacketType,\n PCVOID Header,\n UINT16 HeaderSize,\n PCVOID Data,\n UINT16 DataSize\n );\n\n//\n// System memory map (SMAP) support.\n//\n\n#define BL_SMAP_AVAILABLE 1\n#define BL_SMAP_RESERVED 2\n#define BL_SMAP_ACPI_RECLAIM 3\n#define BL_SMAP_ACPI_NVS 4\n#define BL_SMAP_UNUSABLE 5\n#define BL_SMAP_KERNEL_NONGC 6\n#define BL_SMAP_KERNEL_STACK 7\n\ntypedef struct _BL_SMAP_ENTRY {\n UINT64 Base;\n UINT64 Size;\n UINT32 Type;\n UINT32 ExtendedAttributes;\n} BL_SMAP_ENTRY, *PBL_SMAP_ENTRY;\n\n#define BL_MAX_SMAP_ENTRIES 128\n\ntypedef struct _BL_SMAP {\n BL_SMAP_ENTRY Entry[BL_MAX_SMAP_ENTRIES];\n UINT32 EntryCount;\n} BL_SMAP, *PBL_SMAP;\n\nextern BL_SMAP BlSystemMemoryMap;\n\nVOID\nBlSmapInitialize(\n VOID\n );\n\n//\n// Pool support.\n//\n\nVOID\nBlPoolInitialize(\n VOID\n );\n\nPVOID\nBlPoolAllocateBlock(\n UINT32 Size\n );\n\nVOID\nBlPoolFreeBlock(\n PVOID P\n );\n\n//\n// PNP BIOS support.\n//\n\n#pragma pack(1)\n\ntypedef struct _PNP_INSTALLATION_CHECK {\n CHAR Signature[4];\n UINT8 Version;\n UINT8 Length;\n UINT16 ControlField;\n UINT8 Checksum;\n UINT32 EventNotificationFlagAddress;\n UINT16 RealModeCodeOffset16;\n UINT16 RealModeCodeSegment16;\n UINT16 ProtectedModeCodeOffset16;\n UINT32 ProtectedModeCodeSegmentBase32;\n UINT32 OEMDeviceId;\n UINT16 RealModeDataSegment16;\n UINT32 ProtectedModeDataSegmentBase32;\n} PNP_INSTALLATION_CHECK, *PPNP_INSTALLATION_CHECK;\n\nC_ASSERT(sizeof(PNP_INSTALLATION_CHECK) == 0x21);\n\ntypedef struct _PNP_SYSTEM_DEVICE_NODE {\n UINT16 Size;\n UINT8 Handle;\n UINT32 ProductId;\n UINT8 DeviceTypeCode[3];\n UINT16 DeviceNodeAttributes;\n} PNP_SYSTEM_DEVICE_NODE, *PPNP_SYSTEM_DEVICE_NODE;\n\ntypedef struct _PNP_ISA_CONFIGURATION {\n UINT8 Revision;\n UINT8 NumberOfCardSelectNumbers;\n UINT16 DataReadPort;\n UINT16 Reserved;\n} PNP_ISA_CONFIGURATION, *PPNP_ISA_CONFIGURATION;\n\n#pragma pack()\n\nextern PPNP_SYSTEM_DEVICE_NODE BlPnpSystemDeviceNodeList;\nextern UINT32 BlPnpSystemDeviceNodeListSize;\nextern PNP_ISA_CONFIGURATION BlPnpIsaConfiguration;\n\nVOID\nBlPnpInitialize(\n VOID\n );\n\n//\n// PCI support.\n//\n\ntypedef struct _PCI_INSTALLATION_CHECK {\n UINT32 Eax;\n UINT32 Ebx;\n UINT32 Ecx;\n UINT32 Edx;\n UINT8 HardwareCharacteristics;\n UINT8 MajorVersion;\n UINT8 MinorVersion;\n UINT8 LastBusNumber;\n UINT32 ProtectedModeEntryPoint;\n} PCI_INSTALLATION_CHECK, *PPCI_INSTALLATION_CHECK;\n\nextern PCI_INSTALLATION_CHECK BlPciInstallationCheck;\nextern UINT32 BlPciOhci1394BaseAddress;\n\nVOID\nBlPciInitialize(\n VOID\n );\n\n//\n// ACPI support.\n//\n\nextern UINT32 BlAcpiNumberOfProcessors;\nextern PVOID BlAcpiRsdpAddress;\n\nVOID\nBlAcpiInitialize(\n VOID\n );\n\nVOID\nBlAcpiResetSystem(\n VOID\n );\n\n//\n// Segment management.\n//\n\n#define NULL_SELECTOR 0x0000\n#define RM_VIDEO_SELECTOR 0x0008\n#define RM_CODE_SELECTOR 0x0010\n#define RM_DATA_SELECTOR 0x0018\n#define PM_CODE_SELECTOR 0x0020\n#define PM_DATA_SELECTOR 0x0028\n#define LM_CODE_SELECTOR 0x0030\n#define LM_DATA_SELECTOR 0x0038\n#define UM_CODE_SELECTOR 0x0040\n#define UM_DATA_SELECTOR 0x0048\n#define PROCESSOR_SELECTOR 0x0050\n#define UNUSED_SELECTOR 0x0058\n#define TSS_SELECTOR 0x0060\n\ntypedef struct _CODE_SEGMENT {\n UINT64 Limit_15_0:16;\n UINT64 Base_23_0:24;\n UINT64 Accessed:1;\n UINT64 Readable:1;\n UINT64 Conforming:1;\n UINT64 Code:1;\n UINT64 S:1;\n UINT64 Dpl:2;\n UINT64 Present:1;\n UINT64 Limit_19_16:4;\n UINT64 Unused:1;\n UINT64 Long:1;\n UINT64 Default:1;\n UINT64 Granularity:1;\n UINT64 Base_31_24:8;\n} CODE_SEGMENT, *PCODE_SEGMENT;\n\ntypedef struct _DATA_SEGMENT {\n UINT64 Limit_15_0:16;\n UINT64 Base_23_0:24;\n UINT64 Accessed:1;\n UINT64 Writable:1;\n UINT64 Expansion:1;\n UINT64 Code:1;\n UINT64 S:1;\n UINT64 Dpl:2;\n UINT64 Present:1;\n UINT64 Limit_19_16:4;\n UINT64 Unused:1;\n UINT64 Reserved:1;\n UINT64 Big:1;\n UINT64 Granularity:1;\n UINT64 Base_31_24:8;\n} DATA_SEGMENT, *PDATA_SEGMENT;\n\n#define SSDT_AVAILABLE_TSS 0x09\n#define SSDT_BUSY_TSS 0x0B\n\ntypedef struct _SYSTEM_SEGMENT {\n UINT64 Limit_15_0:16;\n UINT64 Base_23_0:24;\n UINT64 Type:4;\n UINT64 S:1;\n UINT64 Dpl:2;\n UINT64 Present:1;\n UINT64 Limit_19_16:4;\n UINT64 Unused:1;\n UINT64 Reserved1:2;\n UINT64 Granularity:1;\n UINT64 Base_31_24:8;\n#if defined(BOOT_X64)\n UINT64 Base_63_32:32;\n UINT64 Reserved2:32;\n#endif\n} SYSTEM_SEGMENT, *PSYSTEM_SEGMENT;\n\n#pragma pack(1)\n\ntypedef struct _GDTR {\n UINT16 Limit;\n UINT64 Base;\n} GDTR, *PGDTR;\n\nC_ASSERT(sizeof(GDTR) == 10);\n\ntypedef struct _IDTR {\n UINT16 Limit;\n UINT64 Base;\n} IDTR, *PIDTR;\n\nC_ASSERT(sizeof(IDTR) == 10);\n\n#pragma pack()\n\nextern GDTR BlMmInitialGdtr;\n\nULONG_PTR\nBlMmGetCr3(\n VOID\n );\n\nVOID\nBlMmSetCr3(\n ULONG_PTR Value\n );\n\nVOID\nBlFakeSKINIT(\n ULONG_PTR Value\n );\n\nVOID\nBlRealSKINIT(\n ULONG_PTR Value\n );\n\n#if defined(BOOT_X86)\n\nUINT16\nBlMmGetFs(\n VOID\n );\n\nVOID\nBlMmSetFs(\n UINT16 Value\n );\n\n#elif defined(BOOT_X64)\n\nUINT16\nBlMmGetGs(\n VOID\n );\n\nVOID\nBlMmSetGs(\n UINT16 Value\n );\n\n#endif\n\nVOID\nBlMmSwitchStack(\n PVOID Stack,\n PVOID Function\n );\n\nVOID\nBlMmGetGdtr(\n PGDTR Gdtr\n );\n\nVOID\nBlMmSetGdtr(\n PGDTR Gdtr\n );\n\nVOID\nBlMmInitializeCodeSegment(\n PCODE_SEGMENT CodeSegment\n );\n\nVOID\nBlMmInitializeDataSegment(\n PDATA_SEGMENT DataSegment,\n UINT32 Base,\n UINT32 Limit\n );\n\nVOID\nBlMmInitializeSystemSegment(\n PSYSTEM_SEGMENT SystemSegment,\n UINT32 Type,\n ULONG_PTR Base,\n UINT32 Limit\n );\n\n//\n// Memory management.\n//\n\n#define PAGE_PRESENT ((UINT64) 0x01)\n#define PAGE_WRITEABLE ((UINT64) 0x02)\n#define PAGE_WRITETHROUGH ((UINT64) 0x08)\n#define PAGE_CACHEDISABLE ((UINT64) 0x10)\n#define PAGE_ACCESSED ((UINT64) 0x20)\n#define PAGE_2MB ((UINT64) 0x80)\n\n#define BL_MM_PHYSICAL_REGION_MIN_TYPE 0x00000001\n#define BL_MM_PHYSICAL_REGION_FREE 0x00000001\n#define BL_MM_PHYSICAL_REGION_BIOS 0x00000002\n#define BL_MM_PHYSICAL_REGION_BOOT_LOADER 0x00000003\n#define BL_MM_PHYSICAL_REGION_SMAP_RESERVED 0x00000004\n#define BL_MM_PHYSICAL_REGION_DISTRO 0x00000005\n#define BL_MM_PHYSICAL_REGION_KERNEL_IMAGE 0x00000006\n#define BL_MM_PHYSICAL_REGION_NATIVE_PLATFORM 0x00000007\n#define BL_MM_PHYSICAL_REGION_NATIVE_PROCESSOR 0x00000008\n#define BL_MM_PHYSICAL_REGION_LOG_RECORD 0x00000009\n#define BL_MM_PHYSICAL_REGION_LOG_TEXT 0x0000000A\n#define BL_MM_PHYSICAL_REGION_KERNEL_STACK 0x0000000B\n#define BL_MM_PHYSICAL_REGION_CONTEXT 0x0000000C\n#define BL_MM_PHYSICAL_REGION_TASK 0x0000000D\n#define BL_MM_PHYSICAL_REGION_SINGULARITY 0x0000000E\n#define BL_MM_PHYSICAL_REGION_BOOT_STACK 0x0000000F\n#define BL_MM_PHYSICAL_REGION_SINGULARITY_SMAP 0x00000010\n#define BL_MM_PHYSICAL_REGION_MAX_TYPE 0x00000010\n\n#define BL_MM_BIOS_SIZE (1024 * 1024)\n\ntypedef struct _BL_MM_PHYSICAL_REGION {\n LIST_ENTRY Entry;\n UINT64 Start;\n UINT64 Size;\n UINT64 Limit;\n UINT32 Type;\n} BL_MM_PHYSICAL_REGION, *PBL_MM_PHYSICAL_REGION;\n\nextern ULONG_PTR BlMmBootCr3;\n\nVOID\nBlMmEnableA20Gate(\n VOID\n );\n\nVOID\nBlMmInitializeSystem(\n VOID\n );\n\nPCHAR\nBlMmPhysicalRegionTypeString(\n UINT32 Type\n );\n\nUINT64\nBlMmAllocatePhysicalRegion(\n UINT32 Size,\n UINT32 Type\n );\n\nBOOLEAN\nBlMmAllocateSpecificPhysicalRegion(\n UINT64 Base,\n UINT64 Size,\n UINT32 Type\n );\n\nBOOLEAN\nBlMmFindFreePhysicalRegion(\n PUINT64 Base,\n PUINT64 Size\n );\n\nBOOLEAN\nBlMmGetNextPhysicalRegion(\n PVOID *Handle,\n PUINT64 Base,\n PUINT64 Size,\n PUINT32 Type\n );\n\nVOID\nBlMmDumpPhysicalRegionList(\n VOID\n );\n\nVOID\nBlMmMapVirtualPage(\n PVOID VirtualAddress,\n PVOID PhysicalAddress,\n BOOLEAN Writeable,\n BOOLEAN Cacheable,\n BOOLEAN WriteThrough\n );\n\nVOID\nBlMmMapVirtualRange(\n PVOID VirtualAddress,\n PVOID PhysicalAddress,\n ULONG_PTR Size,\n BOOLEAN Writeable,\n BOOLEAN Cacheable,\n BOOLEAN WriteThrough\n );\n\nextern PVOID BlMmExtendedBiosDataArea;\n\n//\n// File system support.\n//\n\nextern\nBOOLEAN\n(*BlFsGetFileSize)(\n PCSTR Path,\n PUINT32 FileSize\n );\n\nextern\nBOOLEAN\n(*BlFsReadFile)(\n PCSTR Path,\n PVOID Buffer,\n UINT32 NumberOfBytes\n );\n\n//\n// CDROM support.\n//\n\nVOID\nBlCdInitialize(\n UINT8 DriveId\n );\n\n//\n// FAT support.\n//\n\n#define MBR_FAT32LBA 0x0C\n#define MBR_FAT16LBA 0x0E\n\nVOID\nBlFatInitialize(\n UINT8 DriveId,\n UINT8 FatType\n );\n\n//\n// Flash support.\n//\n\nVOID\nBlFlashInitialize(\n PVOID SearchBegin,\n PVOID SearchLimit\n );\n\n//\n// PXE support.\n//\n\nVOID\nBlPxeInitialize(\n VOID\n );\n\n//\n// PE/COFF support.\n//\n\nVOID\nBlPeGetVirtualRange(\n PVOID Image,\n PVOID *VirtualBase,\n ULONG_PTR *VirtualSize\n );\n\nVOID\nBlPeLoadImage(\n PVOID LoadBase,\n UINT32 ImageSize,\n PVOID Image,\n PVOID *EntryPoint,\n BOOLEAN isSLB\n );\n\n//\n// RTC support.\n//\n\ntypedef struct _BL_TIME {\n UINT32 Year;\n UINT8 Month;\n UINT8 Day;\n UINT8 Hour;\n UINT8 Minute;\n UINT8 Second;\n} BL_TIME, *PBL_TIME;\n\nVOID\nBlRtlGetCurrentTime(\n PBL_TIME Time\n );\n\nextern BL_TIME BlStartTime;\n\n//\n// MPS support.\n//\n\nVOID\nBlMpsInitialize(\n VOID\n );\n\nextern PVOID BlMpsFps;\n\n//\n// VESA Support.\n//\n\nBOOLEAN\nBlVesaInitialize(\n VOID\n );\n\nextern ULONG_PTR BlVesaVideoBuffer;\n\n//\n// Call stack support.\n//\n\n#if defined(BOOT_X86)\n\nPVOID\nBlRtlGetEbp(\n VOID\n );\n\n#elif defined(BOOT_X64)\n\nPVOID\nBlRtlGetRbp(\n VOID\n );\n\n#endif\n\nVOID\nBlRtlCaptureCallStack(\n PVOID *FrameArray,\n UINT32 FrameCount\n );\n\n//\n// Trap Support.\n//\n\ntypedef struct _BL_TRAP_CONTEXT {\n\n#if defined(BOOT_X86)\n\n UINT32 Cr2;\n UINT32 Esp;\n UINT32 Ebp;\n UINT32 Edi;\n UINT32 Esi;\n UINT32 Edx;\n UINT32 Ecx;\n UINT32 Ebx;\n UINT32 Eax;\n UINT32 Num;\n UINT32 Err;\n UINT32 Eip;\n UINT32 Cs0;\n UINT32 Efl;\n\n#elif defined (BOOT_X64)\n\n UINT64 Cr2;\n UINT64 Rsp;\n UINT64 R15;\n UINT64 R14;\n UINT64 R13;\n UINT64 R12;\n UINT64 R11;\n UINT64 R10;\n UINT64 R9;\n UINT64 R8;\n UINT64 Rbp;\n UINT64 Rdi;\n UINT64 Rsi;\n UINT64 Rdx;\n UINT64 Rcx;\n UINT64 Rbx;\n UINT64 Rax;\n UINT64 Num;\n UINT64 Err;\n UINT64 Rip;\n UINT64 Cs0;\n UINT64 Rfl;\n\n#endif\n\n} BL_TRAP_CONTEXT, *PBL_TRAP_CONTEXT;\n\ntypedef struct _IDTE {\n\n UINT16 Offset0To15;\n UINT16 Selector;\n UINT8 Flags;\n UINT8 Access;\n UINT16 Offset16To31;\n\n#if defined(BOOT_X64)\n\n UINT32 Offset32To63;\n UINT32 Reserved;\n\n#endif\n\n} IDTE, *PIDTE;\n\n\nVOID\nBlTrapEnable(\n VOID\n );\n\nVOID\nBlTrapEnter(\n VOID\n );\n\nVOID\nBlTrapFatal(\n UINT32 Trap,\n PBL_TRAP_CONTEXT Context\n );\n\nVOID\nBlTrapSetIdtr(\n PIDTR Idtr\n );\n\n\n//\n// Singularity bridge.\n//\n\nextern PWCHAR BlCommandLine;\n\nVOID\nBlSingularityInitialize(\n UINT32 NumberOfProcessors,\n PFAR_POINTER ApEntry16,\n PFAR_POINTER ApStartupLock\n );\n\nVOID\nBlSingularityApEntry(\n VOID\n );\n\nextern \"C\" void * _ReturnAddress(void);\n\n#pragma intrinsic(_ReturnAddress)\n\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/bl.inc", "content": ";++\n;\n; Copyright (c) Microsoft Corporation\n;\n; Module Name:\n;\n; bl.inc\n;\n; Abstract:\n;\n; This module contains definitions for the boot loader.\n;\n; Environment:\n;\n; Boot loader.\n;\n;--\n\n;\n; Boot sources.\n;\n\nCD_BOOT equ 00001h\nFAT16_BOOT equ 00002h\nFAT32_BOOT equ 00003h\nPXE_BOOT equ 00004h\nFLASH_BOOT equ 00005h\n\n;\n; Segment selectors.\n;\n\nNULL_SELECTOR equ 000h\nRM_VIDEO_SELECTOR equ 008h\nRM_CODE_SELECTOR equ 010h\nRM_DATA_SELECTOR equ 018h\nPM_CODE_SELECTOR equ 020h\nPM_DATA_SELECTOR equ 028h \nLM_CODE_SELECTOR equ 030h\nLM_DATA_SELECTOR equ 038h\nUM_CODE_SELECTOR equ 040h\nUM_DATA_SELECTOR equ 048h\nPROCESSOR_SELECTOR equ 050h\nUNUSED_SELECTOR equ 058h\nTSS_SELECTOR equ 060h\n \n;\n; CR0 flags.\n;\n\nCR0_PE equ 000000001h\nCR0_NE equ 000000020h\nCR0_PG equ 080000000h\n\n;\n; CR4 flags.\n;\n\nCR4_PSE equ 000000010h\nCR4_PAE equ 000000020h\nCR4_PCE equ 000000100h\nCR4_OSFXSR equ 000000200h\n\n;\n; Initial stack pointer values.\n;\n\nRM_INITIAL_SS equ 01000h\nRM_INITIAL_SP equ 0FFF8h\nPM_INITIAL_ESP equ 000020000h\nBL_ENTRY_SP equ 000080000h\n\n;\n; Page table addresses.\n;\n\nLM_PML4T_ADDRESS equ 000021000h\nPM_PDPT_ADDRESS equ 000022000h\nPM_PDT_ADDRESS equ 000023000h\n\n;\n; Page table entry flags.\n;\n\nPTE_PRESENT equ 000000001h\nPTE_WRITEABLE equ 000000002h\nPTE_ACCESSED equ 000000020h\nPTE_2MB equ 000000080h\n\n;\n; EFER MSR index. (Long Mode)\n;\n\nEFER_MSR_INDEX equ 0C0000080h\n\n;\n; EFER flags. (Long Mode)\n;\n\nEFER_LME equ 000000100h\nEFER_NXE equ 000000800h\n\n;\n; Image target address.\n;\n\nIMAGE_ADDRESS equ 000040000h\n\n;\n; Boot environment block (BEB).\n;\n\nBEB_BASE equ 00002F000h\nBEB_SEG16 equ 02F00h\nBEB_OFF16 equ 00000h\n\nBEB struct\n\n BootType dd ?\n BootDriveNumber dd ?\n FlashImage dd ?\n SmapAddr dd ?\n SmapSize dd ?\n LegacyCallAddress dd ?\n LegacyReturnAddress dd ?\n LegacyReturnCr3 dd ?\n LegacyCall_OpCode dd ?\n LegacyCall_Vector dd ?\n LegacyCall_eax dd ?\n LegacyCall_ebx dd ?\n LegacyCall_ecx dd ?\n LegacyCall_edx dd ?\n LegacyCall_esi dd ?\n LegacyCall_edi dd ?\n LegacyCall_ds dd ?\n LegacyCall_es dd ?\n LegacyCall_eflags dd ?\n LegacyCall_FramePtr dd ?\n LegacyCall_FrameSize dd ?\n LegacyCall_FuncPtr dd ?\n ApEntry16 dd ?\n ApEntry dd ?\n ApStartupLock dd ?\n\nBEB ends\n\n;\n; Trap Context\n;\n\nBL_TRAP_CONTEXT struct\n\nifdef BOOT_X86\n \n TrapCr2 dd ?\n TrapEsp dd ?\n TrapEbp dd ?\n TrapEdi dd ?\n TrapEsi dd ?\n TrapEdx dd ?\n TrapEcx dd ?\n TrapEbx dd ?\n TrapEax dd ?\n TrapNum dd ?\n TrapErr dd ?\n TrapEip dd ?\n TrapCs0 dd ?\n TrapEfl dd ?\n \nendif\n \nifdef BOOT_X64\n \n TrapCr2 dq ?\n TrapRsp dq ?\n TrapR15 dq ?\n TrapR14 dq ?\n TrapR13 dq ?\n TrapR12 dq ?\n TrapR11 dq ?\n TrapR10 dq ?\n TrapR09 dq ?\n TrapR08 dq ?\n TrapRbp dq ?\n TrapRdi dq ?\n TrapRsi dq ?\n TrapRdx dq ?\n TrapRcx dq ?\n TrapRbx dq ?\n TrapRax dq ?\n TrapNum dq ?\n TrapErr dq ?\n TrapRip dq ?\n TrapCs0 dq ?\n TrapRfl dq ?\n \nendif \n\nBL_TRAP_CONTEXT ends\n\n;\n; Legacy call opcodes.\n;\n\nLC_NOP equ 00000h\nLC_INTXX equ 00001h\nLC_FARCALL equ 00002h\n\n;\n; PE/COFF structures.\n;\n\n;\n; typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header\n; WORD e_magic; // Magic number\n; WORD e_cblp; // Bytes on last page of file\n; WORD e_cp; // Pages in file\n; WORD e_crlc; // Relocations\n; WORD e_cparhdr; // Size of header in paragraphs\n; WORD e_minalloc; // Minimum extra paragraphs needed\n; WORD e_maxalloc; // Maximum extra paragraphs needed\n; WORD e_ss; // Initial (relative) SS value\n; WORD e_sp; // Initial SP value\n; WORD e_csum; // Checksum\n; WORD e_ip; // Initial IP value\n; WORD e_cs; // Initial (relative) CS value\n; WORD e_lfarlc; // File address of relocation table\n; WORD e_ovno; // Overlay number\n; WORD e_res[4]; // Reserved words\n; WORD e_oemid; // OEM identifier (for e_oeminfo)\n; WORD e_oeminfo; // OEM information; e_oemid specific\n; WORD e_res2[10]; // Reserved words\n; LONG e_lfanew; // File address of new exe header\n; } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;\n;\n\nIDH_NT_HEADER_OFFSET equ 00000003Ch\n\n;\n; typedef struct _IMAGE_FILE_HEADER {\n; WORD Machine;\n; WORD NumberOfSections;\n; DWORD TimeDateStamp;\n; DWORD PointerToSymbolTable;\n; DWORD NumberOfSymbols;\n; WORD SizeOfOptionalHeader;\n; WORD Characteristics;\n; } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;\n;\n\nIFH_NUMBER_OF_SECTIONS equ 000000002h\nIFH_SIZE_OF_OPTIONAL_HEADER equ 000000010h\n\nifdef BOOT_X86\n\n;\n; typedef struct _IMAGE_OPTIONAL_HEADER32 {\n; WORD Magic;\n; BYTE MajorLinkerVersion;\n; BYTE MinorLinkerVersion;\n; DWORD SizeOfCode;\n; DWORD SizeOfInitializedData;\n; DWORD SizeOfUninitializedData;\n; DWORD AddressOfEntryPoint;\n; DWORD BaseOfCode;\n; DWORD BaseOfData;\n; DWORD ImageBase;\n; DWORD SectionAlignment;\n; DWORD FileAlignment;\n; WORD MajorOperatingSystemVersion;\n; WORD MinorOperatingSystemVersion;\n; WORD MajorImageVersion;\n; WORD MinorImageVersion;\n; WORD MajorSubsystemVersion;\n; WORD MinorSubsystemVersion;\n; DWORD Win32VersionValue;\n; DWORD SizeOfImage;\n; DWORD SizeOfHeaders;\n; DWORD CheckSum;\n; WORD Subsystem;\n; WORD DllCharacteristics;\n; DWORD SizeOfStackReserve;\n; DWORD SizeOfStackCommit;\n; DWORD SizeOfHeapReserve;\n; DWORD SizeOfHeapCommit;\n; DWORD LoaderFlags;\n; DWORD NumberOfRvaAndSizes;\n; IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];\n; } IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;\n;\n\nIOH32_IMAGE_BASE equ 00000001Ch\n\nendif\n\nifdef BOOT_X64\n\n;\n; typedef struct _IMAGE_OPTIONAL_HEADER64 {\n; WORD Magic;\n; BYTE MajorLinkerVersion;\n; BYTE MinorLinkerVersion;\n; DWORD SizeOfCode;\n; DWORD SizeOfInitializedData;\n; DWORD SizeOfUninitializedData;\n; DWORD AddressOfEntryPoint;\n; DWORD BaseOfCode;\n; ULONGLONG ImageBase;\n; DWORD SectionAlignment;\n; DWORD FileAlignment;\n; WORD MajorOperatingSystemVersion;\n; WORD MinorOperatingSystemVersion;\n; WORD MajorImageVersion;\n; WORD MinorImageVersion;\n; WORD MajorSubsystemVersion;\n; WORD MinorSubsystemVersion;\n; DWORD Win32VersionValue;\n; DWORD SizeOfImage;\n; DWORD SizeOfHeaders;\n; DWORD CheckSum;\n; WORD Subsystem;\n; WORD DllCharacteristics;\n; ULONGLONG SizeOfStackReserve;\n; ULONGLONG SizeOfStackCommit;\n; ULONGLONG SizeOfHeapReserve;\n; ULONGLONG SizeOfHeapCommit;\n; DWORD LoaderFlags;\n; DWORD NumberOfRvaAndSizes;\n; IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];\n; } IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;\n;\n\nIOH64_IMAGE_BASE equ 000000018h\n\nendif\n \nIOH_ADDRESS_OF_ENTRY_POINT equ 000000010h\nIOH_SIZE_OF_HEADERS equ 00000003Ch\n\n;\n; typedef struct _IMAGE_NT_HEADERS32/64 {\n; DWORD Signature;\n; IMAGE_FILE_HEADER FileHeader;\n; IMAGE_OPTIONAL_HEADER32/64 OptionalHeader;\n; } IMAGE_NT_HEADERS32/64, *PIMAGE_NT_HEADERS32/64;\n;\n\nINH_SIGNATURE equ 000000000h\nINH_FILE_HEADER equ 000000004h\nINH_OPTIONAL_HEADER equ 000000018h\n\n;\n; Signatures.\n;\n\nIMAGE_DOS_SIGNATURE equ 05A4Dh ; MZ\nIMAGE_NT_SIGNATURE equ 000004550h ; PE00\n\n;\n; typedef struct _IMAGE_SECTION_HEADER {\n; BYTE Name[IMAGE_SIZEOF_SHORT_NAME];\n; union {\n; DWORD PhysicalAddress;\n; DWORD VirtualSize;\n; } Misc;\n; DWORD VirtualAddress;\n; DWORD SizeOfRawData;\n; DWORD PointerToRawData;\n; DWORD PointerToRelocations;\n; DWORD PointerToLinenumbers;\n; WORD NumberOfRelocations;\n; WORD NumberOfLinenumbers;\n; DWORD Characteristics;\n; } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;\n;\n\nISH_VIRTUAL_SIZE equ 000000008h\nISH_VIRTUAL_ADDRESS equ 00000000Ch\nISH_SIZE_OF_RAW_DATA equ 000000010h\nISH_POINTER_TO_RAW_DATA equ 000000014h\n\nIMAGE_SECTION_HEADER_SIZE equ 000000028h\n\n\n\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blacpi.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blacpi.cpp\n//\n// Abstract:\n//\n// This module implements ACPI support for the boot loader environment.\n//\n// Environment:\n//\n// Boot loader.\n//\n//--\n\n#include \"bl.h\"\n\n#pragma pack(1)\n\n//\n// Generic Address Structure (GAS)\n//\n\n#define ACPI_GAS_MEMORY 0\n#define ACPI_GAS_IO 1\n#define ACPI_GAS_PCI 2\n\n#define ACPI_GAS_ACCESS_SIZE_UNDEFINED 0\n#define ACPI_GAS_ACCESS_SIZE_BYTE 1\n#define ACPI_GAS_ACCESS_SIZE_WORD 2\n#define ACPI_GAS_ACCESS_SIZE_DWORD 3\n#define ACPI_GAS_ACCESS_SIZE_QWORD 4\n\ntypedef struct _ACPI_GAS {\n UINT8 AddressSpaceId;\n UINT8 RegisterBitWidth;\n UINT8 RegisterBitOffset;\n UINT8 AccessSize;\n UINT64 Address;\n} ACPI_GAS, *PACPI_GAS;\n\nC_ASSERT(sizeof(ACPI_GAS) == 12);\n\n//\n// Root System Description Pointer (RSDP)\n//\n\ntypedef struct _ACPI_RSDP {\n CHAR Signature[8];\n UINT8 Checksum;\n CHAR OemId[6];\n UINT8 Revision;\n UINT32 RsdtAddress;\n UINT32 Length;\n UINT64 XsdtAddress;\n UINT8 ExtendedChecksum;\n UINT8 Reserved[3];\n} ACPI_RSDP, *PACPI_RSDP;\n\nC_ASSERT(sizeof(ACPI_RSDP) == 36);\n\n//\n// Root System Description Table (RSDT)\n//\n\ntypedef struct _ACPI_RSDT {\n UINT8 Signature[4];\n UINT32 Length;\n UINT8 Revision;\n UINT8 Checksum;\n UINT8 OemId[6];\n UINT8 OemTableId[8];\n UINT32 OemRevision;\n UINT32 CreatorId;\n UINT32 CreatorRevision;\n UINT32 Entry[];\n} ACPI_RSDT, *PACPI_RSDT;\n\nC_ASSERT(sizeof(ACPI_RSDT) == 36);\n\n//\n// Multiple APIC Description Table (MADT)\n//\n\ntypedef struct _ACPI_MADT {\n UINT8 Signature[4];\n UINT32 Length;\n UINT8 Revision;\n UINT8 Checksum;\n UINT8 OemId[6];\n UINT8 OemTableId[8];\n UINT32 OemRevision;\n UINT32 CreatorId;\n UINT32 CreatorRevision;\n UINT32 LocalApicAddress;\n UINT32 Flags;\n UINT8 ApicStructures[];\n} ACPI_MADT, *PACPI_MADT;\n\nC_ASSERT(sizeof(ACPI_MADT) == 44);\n\n#define ACPI_APIC_TYPE_PROCESSOR_LOCAL 0\n\ntypedef struct _ACPI_MADT_ENTRY {\n UINT8 Type;\n UINT8 Length;\n} ACPI_MADT_ENTRY, *PACPI_MADT_ENTRY;\n\ntypedef struct _ACPI_PROCESSOR_LOCAL_APIC {\n UINT8 Type;\n UINT8 Length;\n UINT8 AcpiProcessorId;\n UINT8 ApicId;\n union {\n struct {\n UINT32 Enabled:1;\n UINT32 Reserved:31;\n } s1;\n UINT32 Flags;\n } u1;\n} ACPI_PROCESSOR_LOCAL_APIC, *PACPI_PROCESSOR_LOCAL_APIC;\n\nC_ASSERT(sizeof(ACPI_PROCESSOR_LOCAL_APIC) == 8);\n\n//\n//System Resource Affinity Table (SRAT)\n//\n\ntypedef struct _ACPI_SRAT {\n UINT8 Signature[4];\n UINT32 Length;\n UINT8 Revision;\n UINT8 Checksum;\n UINT8 OemId[6];\n UINT8 OemTableId[8];\n UINT32 OemRevision;\n UINT32 CreatorId;\n UINT32 CreatorRevision;\n UINT8 Reserved[12];\n UINT8 SratStructures[];\n} ACPI_SRAT, *PACPI_SRAT;\n\nC_ASSERT(sizeof(ACPI_SRAT) == 48);\n\n#define ACPI_SRAT_TYPE_PROC_AFFINITY_ENTRY 0\n#define ACPI_SRAT_TYPE_MEM_AFFINITY_ENTRY 1\n\ntypedef ACPI_MADT_ENTRY ACPI_SRAT_ENTRY;\ntypedef PACPI_MADT_ENTRY PACPI_SRAT_ENTRY;\n\ntypedef struct _ACPI_SRAT_PROC_AFFINITY_ENTRY {\n UINT8 Type;\n UINT8 Length;\n UINT8 ProximityDomainLowEightBits;\n UINT8 ApicID;\n UINT32 Flags;\n UINT8 LocalApicEid;\n UINT8 ProximityDomainHighTwentyFourBits[3];\n UINT32 Reserved;\n} ACPI_SRAT_PROC_AFFINITY_ENTRY, *PACPI_SRAT_PROC_AFFINITY_ENTRY;\n\ntypedef struct _ACPI_SRAT_MEM_AFFINITY_ENTRY {\n UINT8 Type;\n UINT8 Length;\n UINT32 ProximityDomain;\n UINT8 Reserved[2];\n UINT32 BaseAddressLow;\n UINT32 BaseAddressHigh;\n UINT32 LengthLow;\n UINT32 LengthHigh;\n UINT32 Reserved2;\n UINT32 Flags;\n UINT8 Reserved3[8];\n} ACPI_SRAT_MEM_AFFINITY_ENTRY, *PACPI_SRAT_MEM_AFFINITY_ENTRY;\n\n//\n// Fixed ACPI Description Table (FADT)\n//\n\n#define ACPI_FADT_FLAGS_RESET_SUPPORTED 0x400\n\ntypedef struct _ACPI_FADT {\n UINT8 Signature[4];\n UINT32 Length;\n UINT8 Revision;\n UINT8 Checksum;\n UINT8 OemId[6];\n UINT8 OemTableId[8];\n UINT32 OemRevision;\n UINT32 CreatorId;\n UINT32 CreatorRevision;\n UINT8 Data1[112-36];\n UINT32 Flags;\n ACPI_GAS ResetRegister;\n UINT8 ResetValue;\n UINT8 Data2[244-129];\n} ACPI_FADT, *PACPI_FADT;\n\nC_ASSERT(FIELD_OFFSET(ACPI_FADT, Flags) == 112);\nC_ASSERT(FIELD_OFFSET(ACPI_FADT, ResetRegister) == 116);\nC_ASSERT(FIELD_OFFSET(ACPI_FADT, ResetValue) == 128);\nC_ASSERT(sizeof(ACPI_FADT) == 244);\n\n#pragma pack()\n\nPACPI_FADT BlAcpiFadt;\nPACPI_MADT BlAcpiMadt;\nUINT32 BlAcpiNumberOfProcessors;\nPACPI_RSDP BlAcpiRsdp;\nPVOID BlAcpiRsdpAddress;\nPACPI_RSDT BlAcpiRsdt;\nPACPI_SRAT BlAcpiSrat;\n\nPACPI_RSDP\nBlAcpiLocateRsdp(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function locates the ACPI RSDP structure.\n//\n// Return Value:\n//\n// ACPI RSDP structure, if located.\n// NULL, otherwise.\n//\n//--\n\n{\n ULONG_PTR End;\n PACPI_RSDP Rsdp;\n ULONG_PTR Start;\n\n Start = 0xE0000;\n End = 0x100000;\n\n while (Start < End) {\n\n Rsdp = (PACPI_RSDP) Start;\n\n if ((Rsdp->Signature[0] == 'R') &&\n (Rsdp->Signature[1] == 'S') &&\n (Rsdp->Signature[2] == 'D') &&\n (Rsdp->Signature[3] == ' ') &&\n (Rsdp->Signature[4] == 'P') &&\n (Rsdp->Signature[5] == 'T') &&\n (Rsdp->Signature[6] == 'R') &&\n (Rsdp->Signature[7] == ' ') &&\n (BlRtlComputeChecksum8(Rsdp, 20) == 0)\n ) {\n\n return Rsdp;\n }\n\n Start += 0x10;\n }\n\n Start = (ULONG_PTR) BlMmExtendedBiosDataArea;\n End = Start + 0x10000;\n\n while (Start < End) {\n\n Rsdp = (PACPI_RSDP) Start;\n\n if ((Rsdp->Signature[0] == 'R') &&\n (Rsdp->Signature[1] == 'S') &&\n (Rsdp->Signature[2] == 'D') &&\n (Rsdp->Signature[3] == ' ') &&\n (Rsdp->Signature[4] == 'P') &&\n (Rsdp->Signature[5] == 'T') &&\n (Rsdp->Signature[6] == 'R') &&\n (Rsdp->Signature[7] == ' ') &&\n (BlRtlComputeChecksum8(Rsdp, 20) == 0)\n ) {\n\n return Rsdp;\n }\n\n Start += 0x10;\n }\n\n return NULL;\n}\n\nPACPI_RSDT\nBlAcpiLocateRsdt(\n PACPI_RSDP Rsdp\n )\n\n//++\n//\n// Routine Description:\n//\n// This function locates the ACPI RSDT structure.\n//\n// Arguments:\n//\n// Rsdp - Supplies a pointer to the ACPI RSDP structure.\n//\n// Return Value:\n//\n// ACPI RSDT structure, if located.\n// NULL, otherwise.\n//\n//--\n\n{\n PACPI_RSDT Rsdt;\n\n Rsdt = (PACPI_RSDT) (ULONG_PTR) Rsdp->RsdtAddress;\n\n if (Rsdt == NULL) {\n\n return NULL;\n }\n\n if ((Rsdt->Signature[0] == 'R') &&\n (Rsdt->Signature[1] == 'S') &&\n (Rsdt->Signature[2] == 'D') &&\n (Rsdt->Signature[3] == 'T') &&\n (Rsdt->Length >= sizeof(ACPI_RSDT)) &&\n (BlRtlComputeChecksum8(Rsdt, Rsdt->Length) == 0)) {\n\n return Rsdt;\n }\n\n return NULL;\n}\n\nPACPI_MADT\nBlAcpiLocateMadt(\n PACPI_RSDT Rsdt\n )\n\n//++\n//\n// Routine Description:\n//\n// This function locates the ACPI MADT structure.\n//\n// Arguments:\n//\n// Rsdt - Supplies a pointer to the ACPI RSDT structure.\n//\n// Return Value:\n//\n// ACPI MADT structure, if located.\n// NULL, otherwise.\n//\n//--\n\n{\n UINT32 Index;\n PACPI_MADT Madt;\n UINT32 NumberOfTables;\n\n NumberOfTables = (Rsdt->Length - FIELD_OFFSET(ACPI_RSDT, Entry)) / sizeof(Rsdt->Entry[0]);\n\n for (Index = 0; Index < NumberOfTables; Index += 1) {\n\n Madt = (PACPI_MADT) (ULONG_PTR) Rsdt->Entry[Index];\n\n if ((Madt->Signature[0] == 'A') &&\n (Madt->Signature[1] == 'P') &&\n (Madt->Signature[2] == 'I') &&\n (Madt->Signature[3] == 'C') &&\n (Madt->Length >= sizeof(ACPI_MADT)) &&\n (BlRtlComputeChecksum8(Madt, Madt->Length) == 0)) {\n\n return Madt;\n }\n }\n\n return NULL;\n}\n\nPACPI_SRAT\nBlAcpiLocateSrat(\n PACPI_RSDT Rsdt\n )\n\n//++\n//\n// Routine Description:\n//\n// This function locates the ACPI SRAT structure.\n//\n// Arguments:\n//\n// Rsdt - Supplies a pointer to the ACPI RSDT structure.\n//\n// Return Value:\n//\n// ACPI SRAT structure, if located.\n// NULL, otherwise.\n//\n//--\n\n{\n UINT32 Index;\n PACPI_SRAT Srat;\n UINT32 NumberOfTables;\n\n NumberOfTables = (Rsdt->Length - FIELD_OFFSET(ACPI_RSDT, Entry)) / sizeof(Rsdt->Entry[0]);\n\n for (Index = 0; Index < NumberOfTables; Index += 1) {\n\n Srat = (PACPI_SRAT) (ULONG_PTR) Rsdt->Entry[Index];\n\n if ((Srat->Signature[0] == 'S') &&\n (Srat->Signature[1] == 'R') &&\n (Srat->Signature[2] == 'A') &&\n (Srat->Signature[3] == 'T') &&\n (Srat->Length >= sizeof(ACPI_SRAT)) &&\n (BlRtlComputeChecksum8(Srat, Srat->Length) == 0)) {\n#if ACPI_VERBOSE\n BlRtlPrintf(\"ACPI: Found SRAT Table\\n\");\n#endif\n\n return Srat;\n }\n }\n\n return NULL;\n}\n\nVOID\nBlAcpiDumpSratEntries(\n VOID\n )\n//++\n//\n// Routine Description:\n//\n// This function prints out the SRAT table.\n//--\n{\n PACPI_SRAT_ENTRY Entry;\n PCHAR Limit;\n PACPI_SRAT_PROC_AFFINITY_ENTRY ProcAffinityEntry;\n PACPI_SRAT_MEM_AFFINITY_ENTRY MemAffinityEntry;\n PCHAR Next;\n UINT32 hbits;\n UINT32 totalbits;\n\n if (BlAcpiSrat == NULL) {\n BlRtlPrintf(\"ACPI: No Srat??\\n\");\n return;\n }\n#if ACPI_VERBOSE\n BlRtlPrintf(\"SRAT:\\n\");\n#endif\n\n Next = (PCHAR) &BlAcpiSrat->SratStructures[0];\n Limit = ((PCHAR) BlAcpiSrat) + BlAcpiSrat->Length;\n\n while (Next < Limit) {\n\n Entry = (PACPI_SRAT_ENTRY) Next;\n\n if ((Entry->Type == ACPI_SRAT_TYPE_PROC_AFFINITY_ENTRY) &&\n (Entry->Length >= sizeof(ACPI_SRAT_PROC_AFFINITY_ENTRY))) {\n\n ProcAffinityEntry = (PACPI_SRAT_PROC_AFFINITY_ENTRY) Next;\n#if ACPI_VERBOSE\n BlRtlPrintf(\" Processor:\\n\");\n#endif\n hbits = 0;\n hbits += ProcAffinityEntry->ProximityDomainHighTwentyFourBits[0] << 24;\n hbits += ProcAffinityEntry->ProximityDomainHighTwentyFourBits[1] << 16;\n hbits += ProcAffinityEntry->ProximityDomainHighTwentyFourBits[2] << 8;\n totalbits = hbits | ProcAffinityEntry->ProximityDomainLowEightBits;\n#if ACPI_VERBOSE\n BlRtlPrintf(\" HighDomain 0x%06x LowDomain 0x%02x totalbits 0x%08x\\n\",\n hbits, ProcAffinityEntry->ProximityDomainLowEightBits,\n totalbits);\n BlRtlPrintf(\" ApicID: %d flags 0x%08x\\n\", ProcAffinityEntry->ApicID,\n ProcAffinityEntry->Flags);\n#endif\n }\n else if ((Entry->Type == ACPI_SRAT_TYPE_MEM_AFFINITY_ENTRY) &&\n (Entry->Length >= sizeof(ACPI_SRAT_MEM_AFFINITY_ENTRY))) {\n\n MemAffinityEntry = (PACPI_SRAT_MEM_AFFINITY_ENTRY) Next;\n#if ACPI_VERBOSE\n BlRtlPrintf(\" Memory:\\n\");\n BlRtlPrintf(\" BaseAddress 0x%08x.%08x .. 0x%08x.%08x\",\n MemAffinityEntry->BaseAddressHigh, MemAffinityEntry->BaseAddressLow,\n MemAffinityEntry->LengthHigh, MemAffinityEntry->LengthLow);\n BlRtlPrintf(\" Domain %d Flags 0x%08x\\n\",\n MemAffinityEntry->ProximityDomain,\n MemAffinityEntry->Flags);\n#endif\n }\n\n Next += Entry->Length;\n }\n}\n\nUINT32\nBlAcpiGetNumberOfProcessors(\n VOID\n )\n//++\n//\n// Routine Description:\n//\n// This function returns the number of processors.\n//\n// Return Value:\n//\n// Number of processors.\n//\n//--\n\n{\n PACPI_MADT_ENTRY Entry;\n PCHAR Limit;\n PACPI_PROCESSOR_LOCAL_APIC LocalApic;\n PCHAR Next;\n UINT32 NumberOfProcessors;\n\n if (BlAcpiMadt == NULL) {\n\n return 1;\n }\n\n Next = (PCHAR) &BlAcpiMadt->ApicStructures[0];\n Limit = ((PCHAR) BlAcpiMadt) + BlAcpiMadt->Length;\n NumberOfProcessors = 0;\n\n while (Next < Limit) {\n\n Entry = (PACPI_MADT_ENTRY) Next;\n\n if ((Entry->Type == ACPI_APIC_TYPE_PROCESSOR_LOCAL) &&\n (Entry->Length >= sizeof(ACPI_PROCESSOR_LOCAL_APIC))) {\n\n LocalApic = (PACPI_PROCESSOR_LOCAL_APIC) Next;\n\n if (LocalApic->u1.s1.Enabled != FALSE) {\n\n#if ACPI_VERBOSE\n\n BlRtlPrintf(\"ACPI: AcpiProcessorId=%u , LocalApicId=%u\\n\",\n LocalApic->AcpiProcessorId,\n LocalApic->ApicId);\n\n#endif\n\n NumberOfProcessors += 1;\n }\n }\n\n Next += Entry->Length;\n }\n\n return NumberOfProcessors;\n}\n\nPACPI_FADT\nBlAcpiLocateFadt(\n PACPI_RSDT Rsdt\n )\n\n//++\n//\n// Routine Description:\n//\n// This function locates the ACPI FADT structure.\n//\n// Arguments:\n//\n// Rsdt - Supplies a pointer to the ACPI RSDT structure.\n//\n// Return Value:\n//\n// ACPI FADT structure, if located.\n// NULL, otherwise.\n//\n//--\n\n{\n PACPI_FADT Fadt;\n UINT32 Index;\n UINT32 NumberOfTables;\n\n NumberOfTables = (Rsdt->Length - FIELD_OFFSET(ACPI_RSDT, Entry)) / sizeof(Rsdt->Entry[0]);\n\n for (Index = 0; Index < NumberOfTables; Index += 1) {\n\n Fadt = (PACPI_FADT) (ULONG_PTR) Rsdt->Entry[Index];\n\n if ((Fadt->Signature[0] == 'F') &&\n (Fadt->Signature[1] == 'A') &&\n (Fadt->Signature[2] == 'C') &&\n (Fadt->Signature[3] == 'P') &&\n (BlRtlComputeChecksum8(Fadt, Fadt->Length) == 0)) {\n\n return Fadt;\n }\n }\n\n return NULL;\n}\n\nVOID\nBlAcpiResetSystem(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function resets the system through the ACPI reset register.\n//\n//--\n\n{\n if ((BlAcpiFadt->Revision < 2) ||\n (BlAcpiFadt->Length < (FIELD_OFFSET(ACPI_FADT, ResetValue) + sizeof(UINT8))) ||\n ((BlAcpiFadt->Flags & ACPI_FADT_FLAGS_RESET_SUPPORTED) == 0)\n ) {\n\n#if ACPI_VERBOSE\n\n BlRtlPrintf(\"ACPI: Reset register is not supported! [FADT v%u]\\n\", BlAcpiFadt->Revision);\n\n#endif\n\n return;\n }\n\n#if ACPI_VERBOSE\n\n BlRtlPrintf(\"ACPI: Reset register type is %u.\\n\", BlAcpiFadt->ResetRegister.AddressSpaceId);\n\n#endif\n\n switch (BlAcpiFadt->ResetRegister.AddressSpaceId) {\n\n case ACPI_GAS_IO: {\n\n BlRtlWritePort8((UINT16) BlAcpiFadt->ResetRegister.Address, BlAcpiFadt->ResetValue);\n\n break;\n }\n }\n}\n\nVOID\nBlAcpiInitialize(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes ACPI support for the boot loader.\n//\n//--\n\n{\n BlAcpiRsdp = BlAcpiLocateRsdp();\n\n if (BlAcpiRsdp == NULL) {\n\n BlRtlPrintf(\"ACPI: No RSDP!\\n\");\n BlRtlHalt();\n }\n\n BlAcpiRsdpAddress = (PVOID) BlAcpiRsdp;\n\n BlAcpiRsdt = BlAcpiLocateRsdt(BlAcpiRsdp);\n\n if (BlAcpiRsdt == NULL) {\n\n BlRtlPrintf(\"ACPI: No RSDT!\\n\");\n BlRtlHalt();\n }\n\n BlAcpiFadt = BlAcpiLocateFadt(BlAcpiRsdt);\n\n if (BlAcpiFadt == NULL) {\n\n BlRtlPrintf(\"ACPI: No FADT!\\n\");\n //BlRtlHalt();\n }\n\n BlAcpiMadt = BlAcpiLocateMadt(BlAcpiRsdt);\n\n if (BlAcpiMadt == NULL) {\n\n BlAcpiNumberOfProcessors = 1;\n\n } else {\n\n BlAcpiNumberOfProcessors = BlAcpiGetNumberOfProcessors();\n }\n\n if (BlAcpiNumberOfProcessors == 0) {\n\n BlRtlPrintf(\"ACPI: No local APIC!\\n\");\n BlRtlHalt();\n }\n\n BlAcpiSrat = BlAcpiLocateSrat(BlAcpiRsdt);\n if (BlAcpiSrat != NULL) {\n BlAcpiDumpSratEntries();\n }\n\n\n#if ACPI_VERBOSE\n\n BlRtlPrintf(\"ACPI: RSDP @ %p\\n\"\n \"ACPI: RSDT @ %p\\n\"\n \"ACPI: FADT @ %p [Revision=%u , Length=%u]\\n\"\n \"ACPI: MADT @ %p\\n\"\n \"ACPI: %u processor(s)\\n\",\n BlAcpiRsdp,\n BlAcpiRsdt,\n BlAcpiFadt,\n BlAcpiFadt->Revision,\n BlAcpiFadt->Length,\n BlAcpiMadt,\n BlAcpiNumberOfProcessors);\n\n#endif\n\n //\n // Map APIC page uncached.\n //\n\n if ((BlAcpiMadt != NULL) && (BlAcpiMadt->LocalApicAddress != 0)) {\n\n#if ACPI_VERBOSE\n\n BlRtlPrintf(\"ACPI: APIC mapped @ %p.\\n\", BlAcpiMadt->LocalApicAddress);\n\n#endif\n\n BlMmMapVirtualRange((PVOID) (ULONG_PTR) BlAcpiMadt->LocalApicAddress,\n (PVOID) (ULONG_PTR) BlAcpiMadt->LocalApicAddress,\n PAGE_SIZE,\n TRUE,\n FALSE,\n FALSE);\n }\n}\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blcdrom.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blcdrom.cpp\n//\n// Abstract:\n//\n// This module implements CDROM support for the boot loader.\n//\n//--\n\n#include \"bl.h\"\n\n#define ISO9660_LOGICAL_BLOCK_SIZE 2048\n#define ISO9660_ROUND_UP_TO_LOGICAL_BLOCKS(X) (((X) + ISO9660_LOGICAL_BLOCK_SIZE - 1) & (~(ISO9660_LOGICAL_BLOCK_SIZE - 1)))\n\n#define ISO9660_VOLUME_SPACE_DATA_AREA_LBN 16\n\n#define ISO9660_VOLUME_DESCRIPTOR_TYPE_BOOT 0x00\n#define ISO9660_VOLUME_DESCRIPTOR_TYPE_PRIMARY 0x01\n#define ISO9660_VOLUME_DESCRIPTOR_TYPE_SUPPLEMENTARY 0x02\n#define ISO9660_VOLUME_DESCRIPTOR_TYPE_TERMINATOR 0xFF\n\n#define ISO9660_MAX_PATH 255\n\n#pragma pack(1)\n\ntypedef struct _ISO9660_LOGICAL_BLOCK {\n UINT8 Data[ISO9660_LOGICAL_BLOCK_SIZE];\n} ISO9660_LOGICAL_BLOCK, *PISO9660_LOGICAL_BLOCK;\n\nC_ASSERT(sizeof(ISO9660_LOGICAL_BLOCK) == ISO9660_LOGICAL_BLOCK_SIZE);\n\ntypedef struct _ISO9660_DIRECTORY_RECORD {\n UINT8 DirectoryRecordLength;\n UINT8 ExtendedAttributeRecordLength;\n UINT32 ExtentLocation;\n UINT32 ExtentLocation_BigEndian;\n UINT32 DataLength;\n UINT32 DataLength_BigEndian;\n UINT8 RecordingDateTime[7];\n union {\n struct {\n UINT8 Present:1;\n UINT8 Directory:1;\n UINT8 AssociatedFile:1;\n UINT8 Record:1;\n UINT8 Protection:1;\n UINT8 Reserved:2;\n UINT8 MultiExtent:1;\n } s1;\n UINT8 FileFlags;\n } u1;\n UINT8 FileUnitSize;\n UINT8 InterleaveGapSize;\n UINT16 VolumeSequenceNumber;\n UINT16 VolumeSequenceNumber_BigEndian;\n UINT8 FileIdentifierLength;\n UINT8 FileIdentifier[1];\n} ISO9660_DIRECTORY_RECORD, *PISO9660_DIRECTORY_RECORD;\n\nC_ASSERT(sizeof(ISO9660_DIRECTORY_RECORD) == 34);\n\ntypedef struct _ISO9660_PRIMARY_VOLUME_DESCRIPTOR {\n UINT8 VolumeDescriptorType;\n UINT8 StandardIdentifier[5];\n UINT8 VolumeDescriptorVersion;\n UINT8 Reserved1;\n UINT8 SystemIdentifier[32];\n UINT8 VolumeIdentifier[32];\n UINT8 Reserved2[8];\n UINT32 VolumeSpaceSize;\n UINT32 VolumeSpaceSize_BigEndian;\n UINT8 Reserved3[32];\n UINT16 VolumeSetSize;\n UINT16 VolumeSetSize_BigEndian;\n UINT16 VolumeSequenceNumber;\n UINT16 VolumeSequenceNumber_BigEndian;\n UINT16 LogicalBlockSize;\n UINT16 LogicalBlockSize_BigEndian;\n UINT32 PathTableSize;\n UINT32 PathTableSize_BigEndian;\n UINT32 PathTableLocation[2];\n UINT32 PathTableLocation_BigEndian[2];\n ISO9660_DIRECTORY_RECORD RootDirectory;\n UINT8 VolumeSetIdentifier[128];\n UINT8 PublisherIdentifier[128];\n UINT8 DataPreparerIdentifier[128];\n UINT8 ApplicationIdentifier[128];\n UINT8 CopyrightFileIdentifier[37];\n UINT8 AbstractFileIdentifier[37];\n UINT8 BibliographicFileIdentifier[37];\n UINT8 VolumeCreationDateTime[17];\n UINT8 VolumeModificationDateTime[17];\n UINT8 VolumeExpirationDateTime[17];\n UINT8 VolumeEffectiveDateTime[17];\n UINT8 FileStructureVersion;\n UINT8 Reserved4;\n UINT8 ReservedForApplication[512];\n UINT8 Reserved5[653];\n} ISO9660_PRIMARY_VOLUME_DESCRIPTOR, *PISO9660_PRIMARY_VOLUME_DESCRIPTOR;\n\nC_ASSERT(sizeof(ISO9660_PRIMARY_VOLUME_DESCRIPTOR) == ISO9660_LOGICAL_BLOCK_SIZE);\n\ntypedef struct _ISO9660_SUPPLEMENTARY_VOLUME_DESCRIPTOR {\n UINT8 VolumeDescriptorType;\n UINT8 StandardIdentifier[5];\n UINT8 VolumeDescriptorVersion;\n UINT8 VolumeFlags;\n UINT8 SystemIdentifier[32];\n UINT8 VolumeIdentifier[32];\n UINT8 Reserved2[8];\n UINT32 VolumeSpaceSize;\n UINT32 VolumeSpaceSize_BigEndian;\n UINT8 EscapeSequences[32];\n UINT16 VolumeSetSize;\n UINT16 VolumeSetSize_BigEndian;\n UINT16 VolumeSequenceNumber;\n UINT16 VolumeSequenceNumber_BigEndian;\n UINT16 LogicalBlockSize;\n UINT16 LogicalBlockSize_BigEndian;\n UINT32 PathTableSize;\n UINT32 PathTableSize_BigEndian;\n UINT32 PathTableLocation[2];\n UINT32 PathTableLocation_BigEndian[2];\n ISO9660_DIRECTORY_RECORD RootDirectory;\n UINT8 VolumeSetIdentifier[128];\n UINT8 PublisherIdentifier[128];\n UINT8 DataPreparerIdentifier[128];\n UINT8 ApplicationIdentifier[128];\n UINT8 CopyrightFileIdentifier[37];\n UINT8 AbstractFileIdentifier[37];\n UINT8 BibliographicFileIdentifier[37];\n UINT8 VolumeCreationDateTime[17];\n UINT8 VolumeModificationDateTime[17];\n UINT8 VolumeExpirationDateTime[17];\n UINT8 VolumeEffectiveDateTime[17];\n UINT8 FileStructureVersion;\n UINT8 Reserved4;\n UINT8 ReservedForApplication[512];\n UINT8 Reserved5[653];\n} ISO9660_SUPPLEMENTARY_VOLUME_DESCRIPTOR, *PISO9660_SUPPLEMENTARY_VOLUME_DESCRIPTOR;\n\nC_ASSERT(sizeof(ISO9660_SUPPLEMENTARY_VOLUME_DESCRIPTOR) == ISO9660_LOGICAL_BLOCK_SIZE);\n\ntypedef struct _ISO9660_VOLUME_DESCRIPTOR {\n union {\n UINT8 VolumeDescriptorType;\n ISO9660_PRIMARY_VOLUME_DESCRIPTOR Primary;\n ISO9660_SUPPLEMENTARY_VOLUME_DESCRIPTOR Supplementary;\n } u1;\n} ISO9660_VOLUME_DESCRIPTOR, *PISO9660_VOLUME_DESCRIPTOR;\n\nC_ASSERT(sizeof(ISO9660_VOLUME_DESCRIPTOR) == ISO9660_LOGICAL_BLOCK_SIZE);\n\n#pragma pack()\n\nUINT8 BlCdDriveId;\nINT13_DRIVE_PARAMETERS BlCdDriveParameters;\nISO9660_VOLUME_DESCRIPTOR BlCdVolumeDescriptor;\n\nISO9660_LOGICAL_BLOCK BlCdTemporaryBlock[32];\nUINT16 BlCdTemporaryBlockCount = sizeof(BlCdTemporaryBlock) / sizeof(BlCdTemporaryBlock[0]);\n\nVOID\nBlCdReadLogicalBlock(\n UINT32 LogicalBlockNumber,\n UINT32 NumberOfBlocks,\n PISO9660_LOGICAL_BLOCK LogicalBlock\n )\n\n//++\n//\n// Routine Description:\n//\n// This function reads the specified logical block.\n//\n// Arguments:\n//\n// LogicalBlockNumber - Supplies the number of the logical block to read.\n//\n// NumberOfBlocks - Supplies the number of blocks to read.\n//\n// LogicalBlock - Receives logical block data.\n//\n//--\n\n{\n UINT16 ChunkSize;\n BOOLEAN Result;\n\n while (NumberOfBlocks > 0) {\n\n if (NumberOfBlocks < BlCdTemporaryBlockCount) {\n\n ChunkSize = (UINT16) NumberOfBlocks;\n\n } else {\n\n ChunkSize = BlCdTemporaryBlockCount;\n }\n\n Result = BlRtlReadDrive(BlCdDriveId,\n LogicalBlockNumber,\n ChunkSize,\n BlCdTemporaryBlock);\n\n if (Result == FALSE) {\n\n BlRtlPrintf(\"CDROM: I/O Error: DriveID=0x%02x LBN=%u Count=%u\\n\",\n BlCdDriveId,\n LogicalBlockNumber,\n ChunkSize);\n\n BlRtlHalt();\n }\n\n BlRtlCopyMemory(LogicalBlock,\n BlCdTemporaryBlock,\n ChunkSize * sizeof(ISO9660_LOGICAL_BLOCK));\n\n LogicalBlockNumber += ChunkSize;\n LogicalBlock += ChunkSize;\n NumberOfBlocks -= ChunkSize;\n }\n\n return;\n}\n\nBOOLEAN\nBlCdFindDirectoryRecord(\n PCSTR Path,\n PISO9660_DIRECTORY_RECORD DirectoryRecord\n )\n\n//++\n//\n// Routine Description:\n//\n// This function finds the directory record for the specified path.\n//\n// Arguments:\n//\n// Path - Supplies the path to look up.\n//\n// DirectoryRecord - Receives directory record.\n//\n// Return Value:\n//\n// TRUE, if directory record was found.\n// FALSE, otherwise.\n//\n//--\n\n{\n PISO9660_LOGICAL_BLOCK DirectoryData;\n UINT32 DirectoryDataIndex;\n ULONG_PTR DirectoryDataLimit;\n UINT32 DirectoryDataExtentStart;\n UINT32 DirectoryDataExtentSize;\n PISO9660_DIRECTORY_RECORD Entry;\n UINT32 Index;\n PCSTR NextToken;\n PCSTR Separator;\n CHAR Temp[ISO9660_MAX_PATH];\n CHAR Token[ISO9660_MAX_PATH];\n UINT32 TokenSize;\n\n DirectoryDataExtentStart = BlCdVolumeDescriptor.u1.Supplementary.RootDirectory.ExtentLocation;\n DirectoryDataExtentSize = ROUND_UP_TO_POWER2(BlCdVolumeDescriptor.u1.Supplementary.RootDirectory.DataLength, ISO9660_LOGICAL_BLOCK_SIZE) / ISO9660_LOGICAL_BLOCK_SIZE;\n\n NextToken = Path;\n\n for (;;) {\n\n BLASSERT(DirectoryDataExtentStart > ISO9660_VOLUME_SPACE_DATA_AREA_LBN);\n\n BLASSERT(DirectoryDataExtentSize > 0);\n\n BLASSERT((*NextToken != 0) && (*NextToken != '/'));\n\n Separator = NextToken;\n\n while ((*Separator != '/') && (*Separator != 0)) {\n\n Separator += 1;\n }\n\n TokenSize = (UINT32) (Separator - NextToken);\n\n for (Index = 0; Index < TokenSize; Index += 1) {\n\n Token[Index] = BlRtlConvertCharacterToUpperCase(NextToken[Index]);\n }\n\n Token[TokenSize] = 0;\n\n DirectoryData = (PISO9660_LOGICAL_BLOCK) BlPoolAllocateBlock(DirectoryDataExtentSize * ISO9660_LOGICAL_BLOCK_SIZE);\n DirectoryDataLimit = (ULONG_PTR) DirectoryData + (DirectoryDataExtentSize * ISO9660_LOGICAL_BLOCK_SIZE);\n\n BlCdReadLogicalBlock(DirectoryDataExtentStart,\n DirectoryDataExtentSize,\n DirectoryData);\n\n Entry = NULL;\n\n for (DirectoryDataIndex = 0; (Entry == NULL) && (DirectoryDataIndex < DirectoryDataExtentSize); DirectoryDataIndex += 1) {\n\n Entry = (PISO9660_DIRECTORY_RECORD) &DirectoryData[DirectoryDataIndex];\n\n for (;;) {\n\n if (Entry->DirectoryRecordLength == 0) {\n\n Entry = NULL;\n break;\n }\n\n if (Entry->FileIdentifierLength == (TokenSize * 2)) {\n\n for (Index = 0; Index < TokenSize; Index += 1) {\n\n Temp[Index] = BlRtlConvertCharacterToUpperCase(Entry->FileIdentifier[(Index * 2) + 1]);\n }\n\n if (BlRtlCompareMemory(Temp, Token, TokenSize) != FALSE) {\n\n break;\n }\n }\n\n Entry = (PISO9660_DIRECTORY_RECORD) ROUND_UP_TO_POWER2((((ULONG_PTR) Entry) + Entry->DirectoryRecordLength), 2);\n\n if ((ULONG_PTR) Entry >= DirectoryDataLimit) {\n\n Entry = NULL;\n break;\n }\n }\n }\n\n if (Entry == NULL) {\n\n BlPoolFreeBlock(DirectoryData);\n\n return FALSE;\n }\n\n if (*Separator == 0) {\n\n BlRtlCopyMemory(DirectoryRecord,\n Entry,\n sizeof(ISO9660_DIRECTORY_RECORD));\n\n BlPoolFreeBlock(DirectoryData);\n\n return TRUE;\n }\n\n if (Entry->u1.s1.Directory == FALSE) {\n\n BlPoolFreeBlock(DirectoryData);\n\n return FALSE;\n }\n\n DirectoryDataExtentStart = Entry->ExtentLocation;\n DirectoryDataExtentSize = ROUND_UP_TO_POWER2(Entry->DataLength, ISO9660_LOGICAL_BLOCK_SIZE) / ISO9660_LOGICAL_BLOCK_SIZE;\n NextToken = Separator + 1;\n\n BlPoolFreeBlock(DirectoryData);\n }\n}\n\nBOOLEAN\nBlCdGetFileSize(\n PCSTR Path,\n PUINT32 FileSize\n )\n\n//++\n//\n// Routine Description:\n//\n// This function queries the size of the specified file.\n//\n// Arguments:\n//\n// Path - Supplies the path to the file to query.\n//\n// FileSize - Receives the size of the file.\n//\n// Return Value:\n//\n// TRUE, if the query operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n ISO9660_DIRECTORY_RECORD DirectoryRecord;\n\n if (BlCdFindDirectoryRecord(Path, &DirectoryRecord) == FALSE) {\n\n BlRtlPrintf(\"CdGetFileSize: [%s] FAILED 1\\n\", Path);\n\n return FALSE;\n }\n\n if (DirectoryRecord.u1.s1.Directory != FALSE) {\n\n BlRtlPrintf(\"CdGetFileSize: [%s] FAILED 2\\n\", Path);\n\n return FALSE;\n }\n\n *FileSize = DirectoryRecord.DataLength;\n return TRUE;\n}\n\nBOOLEAN\nBlCdReadFile(\n PCSTR Path,\n PVOID Buffer,\n UINT32 NumberOfBytes\n )\n\n//++\n//\n// Routine Description:\n//\n// This function reads from the specified file.\n//\n// Arguments:\n//\n// Path - Supplies the path to the file to read.\n//\n// Buffer - Receives data.\n//\n// NumberOfBytes - Supplies the number of bytes to read.\n//\n// Return Value:\n//\n// TRUE, if the read operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n ISO9660_LOGICAL_BLOCK Block;\n UINT32 ChunkOffset;\n UINT32 ChunkSize;\n ISO9660_DIRECTORY_RECORD DirectoryRecord;\n PUINT8 Next;\n UINT32 Offset = 0;\n\n if (BlCdFindDirectoryRecord(Path, &DirectoryRecord) == FALSE) {\n\n return FALSE;\n }\n\n if (DirectoryRecord.u1.s1.Directory != FALSE) {\n\n return FALSE;\n }\n\n if (NumberOfBytes > DirectoryRecord.DataLength) {\n\n return FALSE;\n }\n\n if (NumberOfBytes == 0) {\n\n return TRUE;\n }\n\n Next = (PUINT8) Buffer;\n\n //\n // Handle full-read blocks in a single step.\n //\n\n if (NumberOfBytes >= ISO9660_LOGICAL_BLOCK_SIZE) {\n\n ChunkSize = NumberOfBytes - (NumberOfBytes % ISO9660_LOGICAL_BLOCK_SIZE);\n\n BlCdReadLogicalBlock(DirectoryRecord.ExtentLocation,\n ChunkSize / ISO9660_LOGICAL_BLOCK_SIZE,\n (PISO9660_LOGICAL_BLOCK) Next);\n\n Next += ChunkSize;\n Offset += ChunkSize;\n NumberOfBytes -= ChunkSize;\n }\n\n //\n // Check if the ending block is a partial read.\n //\n\n BLASSERT(NumberOfBytes < ISO9660_LOGICAL_BLOCK_SIZE);\n\n if (NumberOfBytes > 0) {\n\n BlCdReadLogicalBlock(DirectoryRecord.ExtentLocation + (Offset / ISO9660_LOGICAL_BLOCK_SIZE),\n 1,\n &Block);\n\n BlRtlCopyMemory(Next,\n Block.Data,\n NumberOfBytes);\n }\n\n return TRUE;\n}\n\nVOID\nBlCdInitialize(\n UINT8 DriveId\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes CDROM support.\n//\n// Arguments:\n//\n// DriveId - Supplies CDROM drive ID.\n//\n// --\n\n{\n UINT32 LogicalBlockNumber;\n\n BlCdDriveId = DriveId;\n\n if (BlRtlGetDriveParameters(BlCdDriveId, &BlCdDriveParameters) == FALSE) {\n\n BlRtlPrintf(\"CDROM: Unable to get drive parameters!\\n\");\n BlRtlHalt();\n }\n\n if (BlCdDriveParameters.BytesPerSector != ISO9660_LOGICAL_BLOCK_SIZE) {\n\n BlRtlPrintf(\"CDROM: Unexpected sector size!\\n\");\n BlRtlHalt();\n }\n\n //\n // Locate Joliet volume descriptor.\n //\n\n LogicalBlockNumber = ISO9660_VOLUME_SPACE_DATA_AREA_LBN;\n\n for (;;) {\n\n BlCdReadLogicalBlock(LogicalBlockNumber,\n 1,\n (PISO9660_LOGICAL_BLOCK) &BlCdVolumeDescriptor);\n\n if ((BlCdVolumeDescriptor.u1.VolumeDescriptorType == ISO9660_VOLUME_DESCRIPTOR_TYPE_SUPPLEMENTARY) &&\n (BlCdVolumeDescriptor.u1.Supplementary.EscapeSequences[0] == 0x25) &&\n (BlCdVolumeDescriptor.u1.Supplementary.EscapeSequences[1] == 0x2F) &&\n (BlCdVolumeDescriptor.u1.Supplementary.EscapeSequences[2] == 0x45)){\n\n break;\n }\n\n if (BlCdVolumeDescriptor.u1.VolumeDescriptorType == ISO9660_VOLUME_DESCRIPTOR_TYPE_TERMINATOR) {\n\n BlRtlPrintf(\"CDROM: Unable to find Joliet volume descriptor.\\n\");\n BlRtlHalt();\n }\n\n LogicalBlockNumber += 1;\n }\n\n BlFsGetFileSize = BlCdGetFileSize;\n BlFsReadFile = BlCdReadFile;\n\n return;\n}\n\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blcom.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blcom.cpp\n//\n// Abstract:\n//\n// This module implements COM port support for the boot loader.\n//\n//--\n\n#include \"bl.h\"\n\n#define COM1_ADDRESS 0x3F8\n#define COM2_ADDRESS 0x2F8\n#define COM3_ADDRESS 0x3E8\n#define COM4_ADDRESS 0x2E8\n\nconst UINT16 BlComBasePort[COM_MAX_PORT + 1] = {\n 0,\n COM1_ADDRESS,\n COM2_ADDRESS,\n COM3_ADDRESS,\n COM4_ADDRESS\n};\n\n#define COM_DATA_REGISTER 0x0000\n#define COM_INTERRUPT_ENABLE_REGISTER 0x0001\n#define COM_INTERRUPT_IDENTIFICATION_REGISTER 0x0002\n#define COM_FIFO_CONTROL_REGISTER 0x0002\n#define COM_LINE_CONTROL_REGISTER 0x0003\n#define COM_MODEM_CONTROL_REGISTER 0x0004\n#define COM_LINE_STATUS_REGISTER 0x0005\n#define COM_MODEM_STATUS_REGISTER 0x0006\n#define COM_SCRATCH_REGISTER 0x0007\n\n#define COM_DIVISOR_LATCH_REGISTER_LOW 0x0000\n#define COM_DIVISOR_LATCH_REGISTER_HIGH 0x0001\n\n#define COM_CLOCK_RATE 0x1C200\n\n#define COM_LINE_CONTROL_8BITS_1STOP 0x03\n#define COM_LINE_CONTROL_DIVISOR_ACCESS 0x80\n\n#define COM_MODEM_CONTROL_DATA_TERMINAL_READY 0x01\n#define COM_MODEM_CONTROL_REQUEST_TO_SEND 0x02\n\n#define COM_LINE_STATUS_DATA_READY 0x01\n#define COM_LINE_STATUS_OVERRUN_ERROR 0x02\n#define COM_LINE_STATUS_PARITY_ERROR 0x04\n#define COM_LINE_STATUS_FRAMING_ERROR 0x08\n#define COM_LINE_STATUS_SEND_BUFFER_EMPTY 0x20\n\nBOOLEAN\nBlComInitialize(\n UINT8 PortNumber,\n UINT32 BaudRate\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes the specified COM port.\n//\n// Arguments:\n//\n// PortNumber - Supplies the number of the port to initialize.\n//\n// BaudRate - Supplies the baud rate.\n//\n// Return Value:\n//\n// TRUE, if initialization was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT16 Base;\n UINT16 Divisor;\n UINT8 Index;\n UINT8 Status;\n\n BLASSERT((PortNumber >= 1) && (PortNumber <= COM_MAX_PORT));\n\n BLASSERT(BaudRate != 0);\n\n BLASSERT(BaudRate <= COM_CLOCK_RATE);\n\n BLASSERT((COM_CLOCK_RATE % BaudRate) == 0);\n\n BLASSERT((COM_CLOCK_RATE / BaudRate) <= 0x10000);\n\n Base = BlComBasePort[PortNumber];\n\n BlRtlWritePort8(Base + COM_LINE_CONTROL_REGISTER, 0);\n BlRtlWritePort8(Base + COM_INTERRUPT_ENABLE_REGISTER, 0);\n BlRtlWritePort8(Base + COM_MODEM_CONTROL_REGISTER, COM_MODEM_CONTROL_DATA_TERMINAL_READY | COM_MODEM_CONTROL_REQUEST_TO_SEND);\n\n Divisor = (UINT16) (COM_CLOCK_RATE / BaudRate);\n\n BlRtlWritePort8(Base + COM_LINE_CONTROL_REGISTER, COM_LINE_CONTROL_DIVISOR_ACCESS);\n BlRtlWritePort8(Base + COM_DIVISOR_LATCH_REGISTER_LOW, (UINT8) (Divisor & 0xFF));\n BlRtlWritePort8(Base + COM_DIVISOR_LATCH_REGISTER_HIGH, (UINT8) (Divisor >> 8));\n\n BlRtlWritePort8(Base + COM_LINE_CONTROL_REGISTER, COM_LINE_CONTROL_8BITS_1STOP);\n\n Index = 0;\n\n do {\n\n BlRtlWritePort8(Base + COM_SCRATCH_REGISTER, Index);\n\n if (BlRtlReadPort8(Base + COM_SCRATCH_REGISTER) != Index) {\n\n return FALSE;\n }\n\n Index += 1;\n\n } while (Index != 0);\n\n Status = BlRtlReadPort8(Base + COM_LINE_STATUS_REGISTER);\n\n if (Status == 0xFF) {\n\n return FALSE;\n }\n\n#if COM_VERBOSE\n\n if ((Status & COM_LINE_STATUS_OVERRUN_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Overrun error!\\n\", PortNumber);\n }\n\n if ((Status & COM_LINE_STATUS_PARITY_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Parity error!\\n\", PortNumber);\n }\n\n if ((Status & COM_LINE_STATUS_FRAMING_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Framing error!\\n\", PortNumber);\n }\n\n#endif\n\n return TRUE;\n}\n\nBOOLEAN\nBlComSendByte(\n UINT8 PortNumber,\n UINT8 Byte\n )\n\n//++\n//\n// Routine Description:\n//\n// This function sends a byte to the specified COM port.\n//\n// Arguments:\n//\n// PortNumber - Supplies the number of the port to send to.\n//\n// Byte - Supplies the byte to send.\n//\n// Return Value:\n//\n// TRUE, if data was sent.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT16 Base;\n UINT8 Status;\n\n BLASSERT((PortNumber >= 1) && (PortNumber <= COM_MAX_PORT));\n\n Base = BlComBasePort[PortNumber];\n\n do {\n\n Status = BlRtlReadPort8(Base + COM_LINE_STATUS_REGISTER);\n\n#if COM_VERBOSE\n\n if ((Status & COM_LINE_STATUS_OVERRUN_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Overrun error!\\n\", PortNumber);\n }\n\n if ((Status & COM_LINE_STATUS_PARITY_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Parity error!\\n\", PortNumber);\n }\n\n if ((Status & COM_LINE_STATUS_FRAMING_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Framing error!\\n\", PortNumber);\n }\n\n#endif\n\n } while ((Status & COM_LINE_STATUS_SEND_BUFFER_EMPTY) == 0);\n\n BlRtlWritePort8(Base + COM_DATA_REGISTER, Byte);\n\n Status = BlRtlReadPort8(Base + COM_LINE_STATUS_REGISTER);\n\n#if COM_VERBOSE\n\n if ((Status & COM_LINE_STATUS_OVERRUN_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Overrun error!\\n\", PortNumber);\n }\n\n if ((Status & COM_LINE_STATUS_PARITY_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Parity error!\\n\", PortNumber);\n }\n\n if ((Status & COM_LINE_STATUS_FRAMING_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Framing error!\\n\", PortNumber);\n }\n\n#endif\n\n return TRUE;\n}\n\nBOOLEAN\nBlComDataAvailable(\n UINT8 PortNumber\n )\n\n//++\n//\n// Routine Description:\n//\n// This function checks if data is available at the specified COM port.\n//\n// Arguments:\n//\n// PortNumber - Supplies the number of the port to check.\n//\n// Return Value:\n//\n// TRUE, if data is available.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT16 Base;\n UINT8 Status;\n\n BLASSERT((PortNumber >= 1) && (PortNumber <= COM_MAX_PORT));\n\n Base = BlComBasePort[PortNumber];\n\n Status = BlRtlReadPort8(Base + COM_LINE_STATUS_REGISTER);\n\n#if COM_VERBOSE\n\n if ((Status & COM_LINE_STATUS_OVERRUN_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Overrun error!\\n\", PortNumber);\n }\n\n if ((Status & COM_LINE_STATUS_PARITY_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Parity error!\\n\", PortNumber);\n }\n\n if ((Status & COM_LINE_STATUS_FRAMING_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Framing error!\\n\", PortNumber);\n }\n\n#endif\n\n return ((Status & COM_LINE_STATUS_DATA_READY) != 0);\n}\n\nUINT8\nBlComReceiveByte(\n UINT8 PortNumber\n )\n\n//++\n//\n// Routine Description:\n//\n// This function receives a byte from the specified COM port.\n//\n// Arguments:\n//\n// PortNumber - Supplies the number of the port to receive from.\n//\n// Return Value:\n//\n// Byte received from the specified COM port.\n//\n//--\n\n{\n UINT16 Base;\n UINT8 Byte;\n UINT8 Status;\n\n BLASSERT((PortNumber >= 1) && (PortNumber <= COM_MAX_PORT));\n\n Base = BlComBasePort[PortNumber];\n\n BlRtlReadPort8(Base + COM_MODEM_STATUS_REGISTER);\n\n do {\n\n Status = BlRtlReadPort8(Base + COM_LINE_STATUS_REGISTER);\n\n#if COM_VERBOSE\n\n if ((Status & COM_LINE_STATUS_OVERRUN_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Overrun error!\\n\", PortNumber);\n }\n\n if ((Status & COM_LINE_STATUS_PARITY_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Parity error!\\n\", PortNumber);\n }\n\n if ((Status & COM_LINE_STATUS_FRAMING_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Framing error!\\n\", PortNumber);\n }\n\n#endif\n\n } while ((Status & COM_LINE_STATUS_DATA_READY) == 0);\n\n Byte = BlRtlReadPort8(Base + COM_DATA_REGISTER);\n\n Status = BlRtlReadPort8(Base + COM_LINE_STATUS_REGISTER);\n\n#if COM_VERBOSE\n\n if ((Status & COM_LINE_STATUS_OVERRUN_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Overrun error!\\n\", PortNumber);\n }\n\n if ((Status & COM_LINE_STATUS_PARITY_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Parity error!\\n\", PortNumber);\n }\n\n if ((Status & COM_LINE_STATUS_FRAMING_ERROR) != 0) {\n\n BlVideoPrintf(\"COM%u: Framing error!\\n\", PortNumber);\n }\n\n#endif\n\n return Byte;\n}\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blentry.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blentry.cpp\n//\n// Abstract:\n//\n// This module implements the entry point for the boot loader.\n//\n//--\n\n#include \"bl.h\"\n\n//#define VESA_ENABLED 1\n\n#define BL_BOOT_STACK_SIZE 0x10000\n\nPVOID BlBootStackLimit;\nPVOID BlBootStackBase;\n\nVOID\nBlApEntry(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function implements the non-legacy entry point for application processors.\n//\n//--\n\n{\n BlSingularityApEntry();\n\n BlRtlHalt();\n}\n\nVOID\nBlInitialize(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes the boot loader.\n//\n//--\n\n{\n PBEB Beb;\n\n Beb = BlGetBeb();\n\n //\n // Check boot type and perform any necessary source specific initialization.\n //\n\n BlRtlPrintf(\"Booting from \");\n\n switch (Beb->BootType) {\n\n case BL_CD_BOOT: {\n\n BlRtlPrintf(\"CD in drive 0x%02x.\\n\\n\", Beb->BootDriveNumber);\n\n BlCdInitialize((UINT8) Beb->BootDriveNumber);\n\n break;\n }\n\n case BL_FAT16_BOOT: {\n\n BlRtlPrintf(\"FAT16 on drive 0x%02x.\\n\\n\", Beb->BootDriveNumber);\n\n BlFatInitialize((UINT8) Beb->BootDriveNumber, MBR_FAT16LBA);\n\n break;\n }\n\n case BL_FAT32_BOOT: {\n\n BlRtlPrintf(\"FAT32 on drive 0x%02x.\\n\\n\", Beb->BootDriveNumber);\n\n BlFatInitialize((UINT8) Beb->BootDriveNumber, MBR_FAT32LBA);\n\n break;\n }\n\n case BL_PXE_BOOT: {\n\n BlRtlPrintf(\"network.\\n\");\n\n BlPxeInitialize();\n\n break;\n }\n\n case BL_FLASH_BOOT: {\n\n BlRtlPrintf(\"Flash.\\n\");\n\n BlFlashInitialize((PVOID)Beb->FlashImage, (PVOID)Beb->FlashImage);\n\n break;\n }\n\n default: {\n\n BlRtlPrintf(\"unknown source!\\n\");\n\n BlRtlHalt();\n }\n }\n\n //\n // Initialize PNP BIOS support.\n //\n\n if (Beb->BootType != BL_FLASH_BOOT) {\n\n BlPnpInitialize();\n\n }\n\n //\n // Initialize MPS support.\n //\n\n BlMpsInitialize();\n\n //\n // Initialize ACPI support.\n //\n\n if (Beb->BootType != BL_FLASH_BOOT) {\n\n BlAcpiInitialize();\n\n }\n else {\n\n BlAcpiNumberOfProcessors = 1;\n\n }\n\n //\n // Set AP entry address.\n //\n\n Beb->ApEntry = (UINT32) (ULONG_PTR) BlApEntry;\n\n //\n // Initialize Singularity.\n //\n\n if (BlCommandLine == NULL) {\n\n BlCommandLine = L\"\";\n }\n\n BlSingularityInitialize(BlAcpiNumberOfProcessors,\n &Beb->ApEntry16,\n &Beb->ApStartupLock);\n}\n\n#if defined(BOOT_X86)\n\n#define PLATFORM_STRING \"x86\"\n\n#elif defined(BOOT_X64)\n\n#define PLATFORM_STRING \"x64\"\n\n#endif\n\nBL_TIME BlStartTime;\n\nVOID\nBlEntry(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function implements the non-legacy entry point for the boot loader.\n//\n//--\n\n{\n PBEB Beb;\n\n Beb = BlGetBeb();\n\n //\n // Initialize the trap table.\n //\n BlTrapEnable();\n\n //\n // Initialize video.\n //\n\n BlVideoInitialize();\n\n //\n // Print the welcome banner.\n //\n\n BlRtlPrintf(\"Singularity %s Boot Loader [%s %s]\\n\"\n \"\\n\",\n PLATFORM_STRING,\n __DATE__,\n __TIME__);\n\n //\n // Capture boot start time.\n //\n\n if (Beb->BootType != BL_FLASH_BOOT) {\n\n BlRtlGetCurrentTime(&BlStartTime);\n\n }\n\n //\n // Initialize memory management (ring transitions must follow this call).\n //\n\n BlMmInitializeSystem();\n\n //\n // Initialize PCI support (probe for 1394 interfaces for KD).\n //\n\n if (Beb->BootType != BL_FLASH_BOOT) {\n\n BlPciInitialize();\n\n }\n\n //\n // Initialize KD.\n //\n\n BlRtlPrintf(\"Looking for debugger.\\n\");\n// BlKdInitialize();\n\n //\n // Print the welcome banner.\n //\n\n BlRtlPrintf(\"Boot Time: %02u/%02u/%02u %02u:%02u:%02u\\n\",\n BlStartTime.Month,\n BlStartTime.Day,\n BlStartTime.Year,\n BlStartTime.Hour,\n BlStartTime.Minute,\n BlStartTime.Second);\n\n //\n // Initialize VESA support.\n //\n\n#if VESA_ENABLED\n\n BlVesaInitialize();\n\n#endif\n\n //\n // Allocate and switch to the boot stack.\n //\n\n BlBootStackLimit = (PVOID) (ULONG_PTR) BlMmAllocatePhysicalRegion(BL_BOOT_STACK_SIZE, BL_MM_PHYSICAL_REGION_BOOT_STACK);\n BlBootStackBase = (PVOID) ((ULONG_PTR) BlBootStackLimit + BL_BOOT_STACK_SIZE);\n\n BlMmSwitchStack(BlBootStackBase, BlInitialize);\n}\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blentry16.asm", "content": ";++\n;\n; Copyright (c) Microsoft Corporation\n;\n; Module Name:\n;\n; blentry16.asm (x64)\n;\n; Abstract:\n;\n; This module implements the 16-bit entry point for the boot loader.\n;\n; Environment:\n;\n; Boot loader.\n;\n;--\n\n\n.model tiny, c\n\nOPTION SCOPED\n\ninclude bl.inc\n\nREAL_MODE_BASE equ 07b00h\nVIDEO_BASE equ 0b8000h\nBLUE equ 01f00h\nRED equ 02f00h \nGREEN equ 04f00h\n \n.code\n.686p\n\nJMPF16 MACRO SEG:REQ,OFF:REQ\n db 0eah\n dw OFF\n dw SEG\nENDM \n\nJMPF32 MACRO SEG:REQ,OFF:REQ\n db 0eah\n dd OFF\n dw SEG\nENDM\n\n_TEXT16 segment page public use16 'CODE'\n\n org 100h\n\n;++\n;\n; VOID\n; BlEntry16(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function is the 16-bit entry point for the boot loader and it detects\n; the type of boot to perform and calls the appropriate function.\n;\n;--\n\nBlEntry16 proc\n\n;\n; Disable interrupts.\n;\n\n cli\n\n mov bp, sp\n\n ;; Write a character to the screen.\n ;; Configure GS to point to the text-mode video console.\n mov ax, 0b800h\n mov gs, ax\n\n mov ax, GREEN + 'A'\n mov gs:[0], ax\n\n mov ax, GREEN + '-'\n mov gs:[2], ax\n \n;\n; If CS is 0x5000, then it indicates a CD or HD boot.\n;\n\n mov bx, PXE_BOOT\n mov dx, 0\n mov ax, cs\n cmp ax, 05000h\n jne boot_ready\n\n;\n; Check for CD signature on the stack.\n;\n\n mov dx, word ptr [bp + 8]\n mov bx, CD_BOOT\n cmp word ptr [bp + 4], 04344h\n je boot_needs_fixup\n\n;\n; Check for FAT16 signature on the stack.\n;\n\n mov bx, FAT16_BOOT\n cmp word ptr [bp + 4], 04806h\n je boot_needs_fixup\n\n;\n; Check for FAT32 signature on the stack.\n;\n\n mov bx, FAT32_BOOT\n cmp word ptr [bp + 4], 04803h\n je boot_needs_fixup\n\n;\n; Unknown boot device\n;\n\n mov ax, GREEN + 'B'\n mov gs:[2], ax\n@@:\n jmp @b\n\n;\n; Copy 64K from 57C0:0000 to 07C0:0000.\n;\n\nboot_needs_fixup:\n mov ax, GREEN + 'C'\n mov gs:[4], ax\n \n mov ax, 057C0h\n mov ds, ax\n mov si, 0\n mov ax, 007C0h\n mov es, ax\n mov di, 0\n mov cx, 04000h\n\n rep movsd\n\n;\n; Continue execution at the relocated block with known segment selector.\n;\n\nboot_ready:\n\n mov ax, GREEN + 'D'\n mov gs:[6], ax\n \n;\n; Jump to relocated code.\n;\n \n JMPF16 07b0h, @f\n@@: \n\n ; bx = BootType\n ; dx = BootDriveNumber\n\n;\n; Initialize DS, ES, SS, and SP for real mode.\n;\n\n mov ax, cs\n mov ds, ax\n mov es, ax\n mov ax, RM_INITIAL_SS\n mov ss, ax\n mov sp, RM_INITIAL_SP\n\n mov ax, GREEN + 'E'\n mov gs:[8], ax\n \n;\n; Initialize boot environment block (pass bx & dx).\n;\n\n call BlInitializeBeb\n\n;\n; Initialize video.\n;\n\n call BlInitializeVideo\n\n;\n; Load GDT.\n;\n\n mov ax, GREEN + 'F'\n mov gs:[10], ax\n \n mov di, OFFSET BlGDTS_Limit\n lgdt fword ptr ds:[di]\n\n mov ax, RM_VIDEO_SELECTOR\n mov gs, ax\n\n mov ax, GREEN + 'G'\n mov gs:[12], ax\n \n;\n; Clear the real-mode segment registers.\n;\n \n xor ax, ax\n mov ds, ax\n mov es, ax\n mov ss, ax\n mov fs, ax\n mov gs, ax\n \n;\n; Enable protected mode.\n;\n\n mov eax, cr0\n or eax, CR0_PE OR CR0_NE\n mov cr0, eax\n\n;\n; Jump far to 32-bit protected-mode code.\n;\n\n JMPF16 PM_CODE_SELECTOR, LOWWORD ( REAL_MODE_BASE + OFFSET BlEntry32 )\n \nBlEntry16 endp\n\n;++\n;\n; VOID\n; BlInitializeVideo(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function initializes video support for the boot loader.\n;\n;--\n\nBlInitializeVideo proc\n\n mov ax, 1202h ; LINES_400_CONFIGURATION\n mov bx, 0301h ; SELECT_SCAN_LINE\n int 10h\n\n mov ax, 3h ; SET_80X25_16_COLOR_MODE\n mov bx, 0h ; PAGE0\n int 10h\n\n mov ax, 1112h ; LOAD_8X8_CHARACTER_SET\n mov bx, 0h\n int 10h\n\n mov ax, 1003h ; Disable BLINK mode, enable background intensity.\n mov bx, 0h\n int 10h\n\n mov ax, 0200h ; Set Cursor position to 0, 0\n mov bx, 0h\n mov dx, 0h\n int 10h\n\n ret\n\nBlInitializeVideo endp\n\n;++\n;\n; VOID\n; BlInitializeBeb(\n; bx = BootType\n; dx = BootDriveNumber\n; )\n;\n; Routine Description:\n;\n; This function initializes the boot environment block.\n;\n;--\n\nBlInitializeBeb proc\n\n push es\n push di\n\n mov di, BEB_SEG16\n mov es, di\n mov di, BEB_OFF16\n\n xor al, al\n mov cx, 4096\n rep stosb\n\n mov di, BEB_OFF16\n\n ;; See if we are booting from Flash\n \n mov si, BlFlashImage\n mov eax, [si]\n cmp eax, 0\n je @f\n \n mov dword ptr es:[di].BEB.FlashImage, eax\n mov si, BlSmapAddr\n mov eax, [si]\n mov dword ptr es:[di].BEB.SmapAddr, eax\n mov si, BlSmapSize\n mov eax, [si]\n mov dword ptr es:[di].BEB.SmapSize, eax\n mov bx, FLASH_BOOT\n@@: \n \n mov word ptr es:[di].BEB.BootType, bx\n mov word ptr es:[di].BEB.BootDriveNumber, dx\nifdef BOOT_X64 \n mov dword ptr es:[di].BEB.LegacyReturnCr3, LM_PML4T_ADDRESS\nelse\n mov dword ptr es:[di].BEB.LegacyReturnCr3, PM_PDPT_ADDRESS\nendif\n lea ax, BlApEntry16\n mov word ptr es:[di].BEB.ApEntry16, ax\n mov ax, cs\n mov word ptr es:[di].BEB.ApEntry16 + 2, ax\n\n lea ax, BlApStartupLock\n mov word ptr es:[di].BEB.ApStartupLock, ax\n mov ax, cs\n mov word ptr es:[di].BEB.ApStartupLock + 2, ax\n\n pop di\n pop es\n ret\n\nBlInitializeBeb endp\n\n;++\n;\n; Hardware Protection Configuration Data \n;\n;--\n\n;\n; TSS.\n;\n\nALIGN 16\n\nBlTSS:\n\n db 066h dup (0)\n dw 068h\n\n;\n; Global Descriptor Table (GDT).\n;\n\nALIGN 16\n\nBlGDTStart:\n\n dq 00000000000000000h ; 00: NULL segment [NULL_SELECTOR].\n dq 00000930B8000FFFFh ; 08: 000B8000[0000FFFF] Data [PM_VIDEO_SELECTOR].\n dq 000009B007B00FFFFh ; 10: 00007800[0000FFFF] COde [RM_CODE_SELECTOR].\n dq 0000093007B00FFFFh ; 18: 00007B00[0000FFFF] Data [RM_DATA_SELECTOR].\n dq 000CF9B000000FFFFh ; 20: PM code segment [PM_CODE_SELECTOR].\n dq 000CF93000000FFFFh ; 28: PM data segment [PM_DATA_SELECTOR].\n dq 000209B0000000000h ; 30: LM code segment [LM_CODE_SELECTOR].\n dq 00000930000000000h ; 38: LM data segment [LM_DATA_SELECTOR].\n dq 00000000000000000h ; 40: PM user code segment [UM_CODE_SELECTOR].\n dq 00000000000000000h ; 48: PM user data segment [UM_DATA_SELECTOR].\n dq 00000000000000000h ; 50: FS/GS segment [PROCESSOR_SELECTOR].\n dq 00000000000000000h ; 58: [UNUSED_SELECTOR]\n\n;\n; TSS segment.\n;\n\n dw 00067h\n dw REAL_MODE_BASE + OFFSET BlTSS\n db 000h\n db 089h\n dw 00000h\nifdef BOOT_X64 \n dq 00000000000000000h\nendif \n\nBlGDTLimit:\n\n;\n; Global Descriptor Table Selector (GDTS).\n;\n\nALIGN 16\n\n;; Padding to align address (and limit to -2)\n dw 00000h\n dw 00000h\n dw 00000h\nBlGDTS_Limit:\n dw offset BlGDTLimit - offset BlGDTStart\nBlGDTS_Address:\n dw REAL_MODE_BASE + OFFSET BlGDTStart\n dw 0\n dd 0\n\n;++\n;\n; VOID\n; BlReturnToRealMode(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function switches the processor back to real mode to execute a real\n; mode request.\n;\n;--\n\nALIGN 16\nBlReturnToRealMode proc\n\n;\n; Zero all registers.\n;\n\n xor ebx, ebx\n xor ecx, ecx\n xor edx, edx\n xor esi, esi\n xor edi, edi\n xor esp, esp\n xor ebp, ebp\n\n mov ax, RM_DATA_SELECTOR\n mov ds, ax\n mov es, ax\n mov ss, ax\n mov fs, ax\n mov gs, ax\n;\n; Disable protected mode.\n;\n\n mov eax, cr0\n and eax, NOT (CR0_PE OR CR0_NE)\n mov cr0, eax\n\n;\n; Return to real mode.\n;\n JMPF16 07b0h, OFFSET BlProcessRealModeRequest\n\nBlReturnToRealMode endp\n\n;++\n;\n; VOID\n; BlLeaveLrbPmToBoot(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function switches the processor back to real mode for boot.\n;\n;--\n\nALIGN 16\nBlLeaveLrbPmToBoot PROC\n\n mov ax, RM_VIDEO_SELECTOR\n mov gs, ax\n ;; Write to position 0.\n mov ax, RED + 'T'\n mov gs:[12], ax\n \n; Zero all registers.\n;\n\n xor ebx, ebx\n xor ecx, ecx\n xor edx, edx\n xor esi, esi\n xor edi, edi\n xor esp, esp\n xor ebp, ebp\n\n;\n; Disable paging.\n;\n\n mov eax, cr0\n and eax, NOT (CR0_PG)\n mov cr0, eax\n \n xor eax, eax\n mov cr3, eax\n mov cr4, eax\n\n;\n; Disable long mode and return to legacy protected-mode.\n;\n\n mov ecx, EFER_MSR_INDEX\n rdmsr\n and eax, NOT (EFER_LME OR EFER_NXE)\n wrmsr\n\n;\n; Disable protected mode.\n;\n\n mov eax, cr0\n and eax, NOT (CR0_PE OR CR0_NE)\n mov cr0, eax\n \n;\n; Return to real mode.\n;\n JMPF16 07b0h, OFFSET @f\n@@: \n mov ax, 0b800h\n mov gs, ax\n \n ;; Write to position 0.\n mov ax, RED + 'U'\n mov gs:[14], ax\n\n mov ax, cs\n mov ds, ax\n mov es, ax\n mov ax, RM_INITIAL_SS\n mov ss, ax\n mov sp, RM_INITIAL_SP\n \n ;; Write to position 0.\n mov ax, RED + 'V'\n mov gs:[16], ax\n\n;\n; Return to real mode boot entry.\n;\n JMPF16 07b0h, OFFSET BlEntry16\n\nBlLeaveLrbPmToBoot endp\n\n;++\n;\n; VOID\n; BlProcessRealModeRequest(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function performs the requested real mode operation and returns back to\n; protected mode as necessary.\n;\n;--\n\n;\n; Real-mode IDTR.\n;\n\nBlRealModeIdtr:\n\n dw 01000h\n dq 0\n\n;\n; Protected-mode IDTR.\n;\n\nBlProtModeIdtr:\n\n dw 01000h\n dq 0\n\nBlProcessRealModeRequest proc\n\n;\n; Set DS, ES, SS, SP, and SI for real-mode legacy call.\n;\n\n xor eax,eax\n mov ax, cs\n mov ds, ax\n mov ax, BEB_SEG16\n mov es, ax\n mov ax, RM_INITIAL_SS\n mov ss, ax\n mov sp, RM_INITIAL_SP\n mov si, BEB_OFF16\n\n;\n; Switch back to real-mode IDT.\n;\n\n lea eax, BlRealModeIdtr\n lidt fword ptr ds:[eax]\n \n cmp word ptr es:[si].BEB.LegacyCall_OpCode, LC_INTXX\n jne @f\n\n mov cl, byte ptr es:[si].BEB.LegacyCall_Vector\n call BlProcessIntXx\n jmp BlProcessRealModeRequest_Exit\n\n@@:\n\n cmp word ptr es:[si].BEB.LegacyCall_OpCode, LC_FARCALL\n jne @f\n\n call BlProcessFarCall\n jmp BlProcessRealModeRequest_Exit\n\n@@:\n\nBlProcessRealModeRequest_Exit:\n\n;\n; Restore DS, ES, SS, and SP to their initial real-mode values.\n;\n\n mov ax, cs\n mov ds, ax\n mov es, ax\n mov ax, RM_INITIAL_SS\n mov ss, ax\n mov sp, RM_INITIAL_SP\n\n;\n; Load GDT.\n;\n\n mov di, OFFSET BlGDTS_Limit\n lgdt fword ptr ds:[di]\n\n;\n; Clear the real-mode segment registers.\n;\n \n xor ax, ax\n mov ds, ax\n mov es, ax\n mov ss, ax\n mov fs, ax\n mov gs, ax\n \n;\n; Enable protected mode.\n;\n\n mov eax, cr0\n or eax, CR0_PE OR CR0_NE\n mov cr0, eax\n\n;\n; Jump far to 32-bit protected-mode code.\n;\n \n JMPF16 PM_CODE_SELECTOR, LOWWORD ( REAL_MODE_BASE + OFFSET BlEnter32AfterRealModeRequest )\n \nBlProcessRealModeRequest endp\n\n;++\n;\n; Lock to protect shared access to real-mode boot stack.\n;\n;--\n \nBlApStartupLock:\n\n dd 0\n\nBl16End db 0deh, 0adh, 0beh, 0efh\n\n \n org 500h\n\n;++\n;\n; VOID\n; BlApEntry16(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function implements the entry point for application processors\n; on a multi-processor system.\n;\n;--\n\nBlApEntry16 proc\n\n;\n; Disable interrupts.\n;\n\n cli\n\n;\n; Set DS to access AP startup lock.\n;\n\n mov ax, 07b0h\n mov ds, ax\n\n;\n; Acquire AP startup lock before touching any other memory or stack.\n;\n\n@@:\n cmp word ptr ds:[BlApStartupLock], 0\n jne @b\n\n mov ax, 1\n xchg word ptr ds:[BlApStartupLock], ax\n\n cmp ax, 0\n jne @b\n\n;\n; Set SS & SP and switch to 16-bit entry CS.\n;\n\n mov ax, RM_INITIAL_SS\n mov ss, ax\n mov sp, RM_INITIAL_SP\n\n JMPF16 07b0h, OFFSET @f\n@@:\n\n;\n; Initialize DS, ES, SS, and SP for real mode.\n;\n\n mov ax, cs\n mov ds, ax\n mov es, ax\n mov ax, RM_INITIAL_SS\n mov ss, ax\n mov sp, RM_INITIAL_SP\n\n;\n; Load GDT.\n;\n\n mov di, OFFSET BlGDTS_Limit\n lgdt fword ptr ds:[di]\n\n;\n; Clear the real-mode segment registers.\n;\n \n xor ax, ax\n mov ds, ax\n mov es, ax\n mov ss, ax\n mov fs, ax\n mov gs, ax\n \n;\n; Enable protected mode.\n;\n\n mov eax, cr0\n or eax, CR0_PE OR CR0_NE\n mov cr0, eax\n\n;\n; Jump far to 32-bit protected-mode code.\n;\n \n JMPF16 PM_CODE_SELECTOR, LOWWORD ( REAL_MODE_BASE + OFFSET BlApEntry32 )\n \nBlApEntry16 endp\n\n;\n;\n;\n \nSAVE_CONTEXT_TO_STACK macro\n\n push eax\n push ebx\n push ecx\n push edx\n push esi\n push edi\n push ds\n push es\n pushfd\n\nendm\n\nRESTORE_CONTEXT_FROM_STACK macro\n\n popfd\n pop es\n pop ds\n pop edi\n pop esi\n pop edx\n pop ecx\n pop ebx\n pop eax\n\nendm\n\nSAVE_CALL_CONTEXT_TO_STACK macro\n\n mov ax, BEB_SEG16\n mov es, ax\n mov si, BEB_OFF16\n\n push dword ptr es:[si].BEB.LegacyCall_eax\n push dword ptr es:[si].BEB.LegacyCall_ebx\n push dword ptr es:[si].BEB.LegacyCall_ecx\n push dword ptr es:[si].BEB.LegacyCall_edx\n push dword ptr es:[si].BEB.LegacyCall_esi\n push dword ptr es:[si].BEB.LegacyCall_edi\n push word ptr es:[si].BEB.LegacyCall_ds\n push word ptr es:[si].BEB.LegacyCall_es\n pushfd\n\nendm\n\nRESTORE_CALL_CONTEXT_FROM_STACK macro\n\n mov ax, BEB_SEG16\n mov es, ax\n mov si, BEB_OFF16\n\n pop dword ptr es:[si].BEB.LegacyCall_eflags\n pop word ptr es:[si].BEB.LegacyCall_es\n pop word ptr es:[si].BEB.LegacyCall_ds\n pop dword ptr es:[si].BEB.LegacyCall_edi\n pop dword ptr es:[si].BEB.LegacyCall_esi\n pop dword ptr es:[si].BEB.LegacyCall_edx\n pop dword ptr es:[si].BEB.LegacyCall_ecx\n pop dword ptr es:[si].BEB.LegacyCall_ebx\n pop dword ptr es:[si].BEB.LegacyCall_eax\n\nendm\n\n;++\n;\n; VOID\n; BlProcessIntXx(\n; UCHAR InterruptVector\n; )\n;\n; Routine Description:\n;\n; This function processes INT XX requests.\n;\n; Arguments:\n;\n; InterruptVector (cl) - Supplies the interrupt vector to invoke.\n;\n;--\n\nBlProcessIntXx proc\n\n mov byte ptr @f, cl\n\n SAVE_CONTEXT_TO_STACK\n\n SAVE_CALL_CONTEXT_TO_STACK\n\n RESTORE_CONTEXT_FROM_STACK\n\n;\n; INT XX instruction.\n;\n\n db 0CDh\n\n@@:\n\n db 000h\n\n SAVE_CONTEXT_TO_STACK\n\n RESTORE_CALL_CONTEXT_FROM_STACK\n\n RESTORE_CONTEXT_FROM_STACK\n\n ret\n\nBlProcessIntXx endp\n\n;++\n;\n; VOID\n; BlProcessFarCall(\n; UCHAR InterruptVector\n; )\n;\n; Routine Description:\n;\n; This function processes far call requests.\n;\n;--\n\nBlProcessFarCall proc\n\n SAVE_CONTEXT_TO_STACK\n\n push bp\n mov bp, sp\n\n;\n; Copy the call frame to the stack.\n;\n\n mov ax, BEB_SEG16\n mov es, ax\n mov si, BEB_OFF16\n\n mov ax, word ptr es:[si].BEB.LegacyCall_FramePtr + 2\n mov ds, ax\n mov bx, word ptr es:[si].BEB.LegacyCall_FramePtr\n\n mov cx, word ptr es:[si].BEB.LegacyCall_FrameSize\n add bx, cx\n mov ax, cx\n\n@@:\n\n cmp ax, 0\n je @f\n\n sub bx, 2\n push word ptr ds:[bx]\n\n sub ax, 2\n jmp @b\n\n@@:\n\n;\n; Set return address.\n;\n\n push cs\n push @f\n\n;\n; Set call address.\n;\n\n push dword ptr es:[si].BEB.LegacyCall_FuncPtr\n\n;\n; Set caller provided context.\n;\n\n SAVE_CALL_CONTEXT_TO_STACK\n\n RESTORE_CONTEXT_FROM_STACK\n\n;\n; Call the specified function with a far return.\n;\n\n retf\n\n@@:\n\n;\n; Copy the output context to BEB.\n;\n\n SAVE_CONTEXT_TO_STACK\n\n RESTORE_CALL_CONTEXT_FROM_STACK\n\n mov sp, bp\n pop bp\n\n RESTORE_CONTEXT_FROM_STACK\n\n ret\n\nBlProcessFarCall endp\n \n_TEXT16 ends\n\n_TEXT32 segment page public use32 'CODE'\n\n;++\n;\n; VOID\n; BlEntry32(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function implements the 32-bit entry point for the boot loader.\n;\n;--\n\nBlEntry32 proc\n\n;\n; Load the protected-mode segment registers.\n;\n mov ax, PM_DATA_SELECTOR\n mov ds, ax\n mov es, ax\n mov ss, ax\n mov esp, PM_INITIAL_ESP\n\n mov ax, NULL_SELECTOR\n mov fs, ax\n mov gs, ax\n\n mov esi, VIDEO_BASE + 14\n mov [esi], ax\n \nifdef BOOT_X64 \n;\n; Check for long mode.\n;\n\n call BlCheckLongMode\n cmp eax, 0\n jne @f\n\n;\n; Long mode is not supported -- halt execution.\n;\n\n call BlHalt\n\n@@:\nendif\n \n;\n; Initialize boot environment block.\n;\n\n call BlRegisterExitAddress\n\n;\n; Prepare page tables.\n;\n\n call BlPreparePageTables\n\n mov ax, GREEN + 'I'\n mov esi, VIDEO_BASE + 14\n mov [esi], ax\n \n \n;\n; Enable PSE, PAE, performance counters, and floating point support.\n;\n\n mov eax, cr4\n ;or eax, CR4_PCE OR CR4_OSFXSR\n or eax, CR4_PSE OR CR4_PAE OR CR4_PCE OR CR4_OSFXSR\n mov cr4, eax\n\n;\n; Set root page table.\n;\n\nifdef BOOT_X64\n mov eax, LM_PML4T_ADDRESS\nelse\n mov eax, PM_PDPT_ADDRESS\nendif\n mov cr3, eax\n\nifdef BOOT_X64 \n;\n; Enable long-mode and no-execute.\n;\n\n mov ecx, EFER_MSR_INDEX\n rdmsr\n or eax, EFER_LME OR EFER_NXE\n wrmsr\nendif \n\n;\n; Enable paging.\n;\n ;hlt\n mov eax, cr0\n or eax, CR0_PG\n mov cr0, eax\n; mov eax, cr0\n;myInfLoop: \n; and eax, 080000000h;\n; cmp eax, 0\n; jne myInfLoop\n\n\n;\n; Load PE image.\n;\n\n call BlLoadImage\n\n mov bx, GREEN + 'J'\n mov esi, VIDEO_BASE + 16\n mov [esi], bx\n \nifdef BOOT_X64 \n;\n; Enter long mode.\n;\n\n JMPF32 LM_CODE_SELECTOR, REAL_MODE_BASE + OFFSET @f\n@@:\n\n mov dx, LM_DATA_SELECTOR\n mov ds, dx\n mov es, dx\n mov ss, dx\n\n mov bx, GREEN + 'K'\n mov esi, VIDEO_BASE + 18\n mov [esi], bx\nendif\n \n;\n; Switch to entry stack and call entry point.\n;\n \n mov esp, BL_ENTRY_SP\n call eax\n\nBlEntry32 endp\n\n;++\n;\n; VOID\n; BlEnter32AfterRealModeRequest(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function returns to normal mode after a legacy mode request was handled.\n;\n;--\n\nBlEnter32AfterRealModeRequest proc\n\n;\n; Load the protected-mode segment registers.\n;\n mov ax, PM_DATA_SELECTOR\n mov ds, ax\n mov es, ax\n mov ss, ax\n mov esp, PM_INITIAL_ESP\n\n mov ax, NULL_SELECTOR\n mov fs, ax\n mov gs, ax\n\n;\n; Enable PSE, PAE, performance counters, and floating point support.\n;\n\n mov eax, cr4\n ;or eax, CR4_PCE OR CR4_OSFXSR\n or eax, CR4_PSE OR CR4_PAE OR CR4_PCE OR CR4_OSFXSR\n mov cr4, eax\n\n;\n; Set root page table.\n;\n\n mov eax, BEB_BASE\n mov eax, dword ptr [eax].BEB.LegacyReturnCr3\n mov cr3, eax\n\nifdef BOOT_X64\n;\n; Enable long-mode and no-execute.\n;\n\n mov ecx, EFER_MSR_INDEX\n rdmsr\n or eax, EFER_LME OR EFER_NXE\n wrmsr\nendif\n\n;\n; Restore the IDT\n;\n\n mov eax, OFFSET BlProtModeIdtr\n add eax, REAL_MODE_BASE\n lidt fword ptr ds:[eax]\n \n;\n; Enable paging.\n;\n\n mov eax, cr0\n or eax, CR0_PG\n mov cr0, eax\n\n;\n; Get return address from BEB.\n;\n\n mov eax, BEB_BASE\n mov eax, dword ptr [eax].BEB.LegacyReturnAddress\n\nifdef BOOT_X64\n;\n; Enter long mode.\n;\n\n JMPF32 LM_CODE_SELECTOR, REAL_MODE_BASE + OFFSET @f\n@@:\n\n mov edx, LM_DATA_SELECTOR\n mov ds, edx\n mov es, edx\n mov ss, edx\n\nendif\n \n;\n; Return to normal code.\n;\n \n call eax\n\nBlEnter32AfterRealModeRequest endp\n\n;++\n;\n; VOID\n; BlPreparePageTables(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function prepares page tables for long mode execution.\n;\n;--\n\nBlPreparePageTables proc\n\nifdef BOOT_X64\n;\n; Clear all entries for 4th level table.\n;\n\n xor eax, eax\n mov edi, LM_PML4T_ADDRESS\n mov ecx, 0400h\n rep stosd\n\n;\n; Create a single 4th level entry.\n;\n\n mov eax, LM_PML4T_ADDRESS\n mov dword ptr [eax], PM_PDPT_ADDRESS OR PTE_PRESENT OR PTE_WRITEABLE OR PTE_ACCESSED\n\nendif\n \n;\n; Clear all entries for 2nd and 3rd level tables.\n;\n\n xor eax, eax\n mov edi, PM_PDPT_ADDRESS\n mov ecx, 0400h\n rep stosd\n\n xor eax, eax\n mov edi, PM_PDT_ADDRESS\n mov ecx, 0400h\n rep stosd\n\n;\n; Create a single 3rd level entry.\n;\n\n mov eax, PM_PDPT_ADDRESS\nifdef BOOT_X64 \n mov dword ptr [eax], PM_PDT_ADDRESS OR PTE_PRESENT OR PTE_WRITEABLE OR PTE_ACCESSED\nelse\n;;; See if these can't be the same.\n mov dword ptr [eax], PM_PDT_ADDRESS OR PTE_PRESENT\nendif\n\n;\n; Create a single 2nd level entry to identity-map the first 2MB of memory.\n;\n\n mov eax, PM_PDT_ADDRESS\n mov dword ptr [eax], 0 OR PTE_PRESENT OR PTE_WRITEABLE OR PTE_ACCESSED OR PTE_2MB\n\n ret\n\nBlPreparePageTables endp\n\nifdef BOOT_X64\n \n;++\n;\n; VOID\n; BlCheckLongMode(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function checks if the processor supports long mode execution.\n;\n; Return Value:\n;\n; TRUE, if long mode execution is supported.\n; FALSE, otherwise.\n;\n;--\n\nBlCheckLongMode proc\n\n;\n; Get the largest extended function supported.\n;\n\n mov eax, 080000000h\n cpuid\n\n;\n; If 0x80000000 is the limit, then long mode is not supported.\n;\n\n cmp eax, 080000000h\n jbe NoLongMode\n\n;\n; Execute extended function 1 and check for long mode bit.\n;\n\n mov eax, 080000001h\n cpuid\n\n bt edx, 29\n jnc NoLongMode\n\n;\n; Return 1 to indicate presence of long mode.\n;\n\n mov eax, 1\n ret\n\nNoLongMode:\n\n;\n; Return 0 to indicate absense of long mode.\n;\n\n mov eax, 0\n ret\n\nBlCheckLongMode endp\n\nendif\n\n;++\n;\n; VOID\n; BlHalt(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function halts execution.\n;\n;--\n\nBlHalt proc\n\n@@:\n\n jmp @b\n\nBlHalt endp\n\n;++\n;\n; VOID\n; BlLeaveProtectedMode(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function leaves protected mode to perform a real mode operation.\n;\n;--\n\nALIGN 16 \nBlLeaveProtectedMode proc\n\n;\n; Disable paging, reset root page table, and flush TLB.\n;\n\n mov eax, cr0\n and eax, NOT CR0_PG\n mov cr0, eax\n\n xor eax, eax\n mov cr3, eax\n mov cr4, eax\n\n jmp @f\nALIGN 16\n@@:\n\n;\n; Save the IDT.\n;\n \n mov eax, OFFSET BlProtModeIdtr\n add eax, REAL_MODE_BASE\n sidt fword ptr ds:[eax]\n \nifdef BOOT_X64 \n\n;\n; Disable long mode and return to legacy protected-mode.\n;\n\n mov ecx, EFER_MSR_INDEX\n rdmsr\n and eax, NOT (EFER_LME OR EFER_NXE)\n wrmsr\nendif\n \n;\n; Return to real-mode code.\n;\n\n JMPF32 RM_CODE_SELECTOR, OFFSET BlReturnToRealMode\n\nBlLeaveProtectedMode endp\n\n;++\n;\n; PVOID\n; BlLoadImage(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function loads the higher-level boot loader image.\n;\n; Return Value:\n;\n; Entry point address for the loaded image.\n;\n;--\n\nBlLoadImage proc\n\n lea ebp, OFFSET BlImageStart\n add ebp, REAL_MODE_BASE\n\n;\n; Check DOS signature.\n;\n\n cmp word ptr [ebp], IMAGE_DOS_SIGNATURE\n jne BlInvalidImage\n\n;\n; Calculate NT header address.\n;\n\n mov ebx, dword ptr [ebp + IDH_NT_HEADER_OFFSET]\n add ebx, ebp\n\n;\n; Check NT signature.\n;\n\n cmp dword ptr [ebx + INH_SIGNATURE], IMAGE_NT_SIGNATURE\n jne BlInvalidImage\n\n;\n; Check image base.\n;\n\nifdef BOOT_X64 \n cmp dword ptr [ebx + INH_OPTIONAL_HEADER + IOH64_IMAGE_BASE + 4], 0\n jne BlInvalidImage\n\n cmp dword ptr [ebx + INH_OPTIONAL_HEADER + IOH64_IMAGE_BASE], IMAGE_ADDRESS\nelse\n cmp dword ptr [ebx + INH_OPTIONAL_HEADER + IOH32_IMAGE_BASE], IMAGE_ADDRESS\nendif\n jne BlInvalidImage\n\n;\n; Copy headers.\n;\n\n mov esi, ebp\n mov edi, IMAGE_ADDRESS\n mov ecx, dword ptr [ebx + INH_OPTIONAL_HEADER + IOH_SIZE_OF_HEADERS]\n rep movsb\n\n;\n; Calculate the address of first section header.\n;\n; SectionHeader = (PIMAGE_SECTION_HEADER) (((ULONG_PTR) &NtHeaders->OptionalHeader) + NtHeaders->FileHeader.SizeOfOptionalHeader)\n;\n\n xor esi, esi\n mov si, word ptr [ebx + INH_FILE_HEADER + IFH_SIZE_OF_OPTIONAL_HEADER]\n add esi, INH_OPTIONAL_HEADER\n add esi, ebx\n\n xor ecx, ecx\n mov cx, word ptr [ebx + INH_FILE_HEADER + IFH_NUMBER_OF_SECTIONS]\n cmp cx, 0\n jne @f\n\n call BlInvalidImage\n\n;\n; for (Index = 0; Index < NtHeaders->FileHeader.NumberOfSections; Index += 1) {\n;\n; BlCopySection(DosHeader, &SectionHeader[Index]);\n; }\n;\n\n@@:\n\n push ecx\n\n mov ecx, ebp\n mov edx, esi\n\n call BlCopySection\n\n pop ecx\n\n add esi, IMAGE_SECTION_HEADER_SIZE\n\n dec ecx\n jnz @b\n\n mov eax, dword ptr [ebx + INH_OPTIONAL_HEADER + IOH_ADDRESS_OF_ENTRY_POINT]\n add eax, IMAGE_ADDRESS\n ret\n\nBlLoadImage endp\n\n;++\n;\n; VOID\n; FASTCALL\n; BlCopySection(\n; PIMAGE_DOS_HEADER DosHeader,\n; PIMAGE_SECTION_HEADER SectionHeader\n; )\n;\n; Routine Description:\n;\n; This function copies the specified image section.\n;\n; Arguments:\n;\n; DosHeader (ecx) - Supplies a pointer to the source image to copy from.\n;\n; SectionHeader (edx) - Supplies a pointer to the section header describing\n; the section to copy.\n;\n;--\n\nBlCopySection proc\n\n;\n; Create call frame and save non-volatile registers that will be used.\n;\n\n push ebp\n mov ebp, esp\n\n push esi\n push edi\n\n;\n; Calculate source and destination address for the copy operation.\n;\n\n mov esi, dword ptr [edx + ISH_POINTER_TO_RAW_DATA]\n add esi, ecx\n\n mov edi, dword ptr [edx + ISH_VIRTUAL_ADDRESS]\n add edi, IMAGE_ADDRESS\n\n;\n; Save source and destination addresses -- rep stosb below will use them.\n;\n\n push esi\n push edi\n\n;\n; Zero the entire target virtual range.\n;\n\n mov eax, 0\n mov ecx, dword ptr [edx + ISH_VIRTUAL_SIZE]\n rep stosb\n\n;\n; Restore source and destination addresses.\n;\n\n pop edi\n pop esi\n\n;\n; BytesToCopy = min(SectionHeader->VirtualSize, SectionHeader->SizeOfRawData)\n;\n mov ecx, dword ptr [edx + ISH_VIRTUAL_SIZE]\n cmp ecx, dword ptr [edx + ISH_SIZE_OF_RAW_DATA]\n jl @f\n\n mov ecx, dword ptr [edx + ISH_SIZE_OF_RAW_DATA]\n\n@@:\n\n;\n; Perform copy.\n;\n\n rep movsb\n\n;\n; Restore used non-volatile registers, base pointer, and return.\n;\n\n pop edi\n pop esi\n mov esp, ebp\n pop ebp\n ret\n\nBlCopySection endp\n\n;++\n;\n; VOID\n; BlInvalidImage(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function is called to halt execution if the embedded image is corrupted.\n;\n;--\n\nBlInvalidImage proc\n\n call BlHalt\n\nBlInvalidImage endp\n\n;++\n;\n; VOID\n; BlRegisterExitAddress(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function registers the exit address in the boot environment block.\n;\n;--\n\nBlRegisterExitAddress proc\n\n mov ecx, BEB_BASE\n\n lea eax, BlLeaveProtectedMode\n add eax, REAL_MODE_BASE\n\n mov dword ptr [ecx].BEB.LegacyCallAddress, eax\n\n ret\n\nBlRegisterExitAddress endp\n\n;++\n;\n; VOID\n; BlApEntry32(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function implements 32-bit entry point for application processors.\n;\n;--\n\nBlApEntry32 proc\n\n;\n; Load the protected-mode segment registers.\n;\n mov ax, PM_DATA_SELECTOR\n mov ds, ax\n mov es, ax\n mov ss, ax\n mov esp, PM_INITIAL_ESP\n\n mov ax, NULL_SELECTOR\n mov fs, ax\n mov gs, ax\n\n;\n; Enable PSE, PAE, performance counters, and floating point support.\n;\n\n mov eax, cr4\n or eax, CR4_PSE OR CR4_PAE OR CR4_PCE OR CR4_OSFXSR\n mov cr4, eax\n\n;\n; Set root page table.\n;\n\n mov eax, BEB_BASE\n mov eax, dword ptr [eax].BEB.LegacyReturnCr3\n mov cr3, eax\n\nifdef BOOT_X64 \n;\n; Enable long-mode and no-execute.\n;\n\n mov ecx, EFER_MSR_INDEX\n rdmsr\n or eax, EFER_LME OR EFER_NXE\n wrmsr\nendif\n \n;\n; Enable paging.\n;\n\n mov eax, cr0\n or eax, CR0_PG\n mov cr0, eax\n\n;\n; Get entry address from BEB.\n;\n\n mov eax, BEB_BASE\n mov eax, dword ptr [eax].BEB.ApEntry\n\nifdef BOOT_X64\n;\n; Enter long mode.\n;\n\n JMPF32 LM_CODE_SELECTOR, REAL_MODE_BASE + OFFSET @f\n@@:\n\n mov edx, LM_DATA_SELECTOR\n mov ds, edx\n mov es, edx\n mov ss, edx\nendif\n\n;\n; Switch to entry stack and call entry point.\n;\n\n mov esp, BL_ENTRY_SP\n call eax\n\nBlApEntry32 endp\n\n \n;++\n;\n; VOID\n; BlLeaveLrb64ToBoot(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function leaves paging and protected mode to boot.\n;\n;--\n\nALIGN 16\n\n db 'S','I','N','G'\n db 'L','R','B',0\n db 0f8h, 0f9h, 0fah, 0fbh\n db 0fch, 0fdh, 0feh, 0ffh\nBlFlashImage: \n dd 0\nBlSmapAddr: \n dd 0\nBlSmapSize: \n dd 0\n dd 0\n \nBlLeaveLrb64ToBoot proc\n mov eax, BLUE + 'P'\n mov esi, VIDEO_BASE + 0\n mov [esi], ax\n \n mov eax, BLUE + 'O'\n mov esi, VIDEO_BASE + 2\n mov [esi], ax\n\n mov eax, BLUE + 'N'\n mov esi, VIDEO_BASE + 4\n mov [esi], ax\n\n mov eax, BLUE + 'M'\n mov esi, VIDEO_BASE + 6\n mov [esi], ax\n\n mov eax, BLUE + 'L'\n mov esi, VIDEO_BASE + 8\n mov [esi], ax\n\n;\n; Prepare a known GDT.\n;\n mov eax, BLUE + 'K'\n mov esi, VIDEO_BASE + 10\n mov [esi], ax\n\n mov eax, BLUE + 'J'\n mov esi, VIDEO_BASE + 12\n mov [esi], ax\n\n;\n; Load the known GDT.\n;\n \n mov edi, BlGDTS_Limit\n add edi, REAL_MODE_BASE\n lgdt fword ptr ds:[edi]\n \n mov eax, RED + 'R'\n mov esi, VIDEO_BASE + 8\n mov [esi], ax\n\n mov eax, RED + 'S'\n mov esi, VIDEO_BASE + 10\n mov [esi], ax\n\n mov edi, REAL_MODE_BASE + offset target\n jmp fword ptr [edi]\ntarget: \n dd OFFSET BlLeaveLrbPmToBoot\n dw RM_CODE_SELECTOR\n \nBlLeaveLrb64ToBoot endp\n\n;\n; Align to 16-bytes before PE image is concatenated.\n;\n \nALIGN 16\n\nBlImageStart:\n\n_TEXT32 ends\n\nend BlEntry16\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blfat.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blfat.cpp\n//\n// Abstract:\n//\n// This module implements FAT support for the boot loader.\n//\n//--\n\n#include \"bl.h\"\n\n//\n// MBR definitions.\n//\n\n#pragma pack(1)\n\n#define MBR_BOOTABLE 0x80\n\ntypedef struct _MBR_PARTITION {\n UINT8 Status;\n UINT8 FirstSectorCHS[3];\n UINT8 Type;\n UINT8 LastSectorCHS[3];\n UINT32 FirstSector;\n UINT32 NumberOfSectors;\n} MBR_PARTITION, *PMBR_PARTITION;\n\nC_ASSERT(sizeof(MBR_PARTITION) == 16);\n\n#define MBR_SIGNATURE 0xAA55\n\ntypedef struct _MBR {\n UINT8 BootCode[446];\n MBR_PARTITION Partition[4];\n UINT16 Signature;\n} MBR, *PMBR;\n\nC_ASSERT(sizeof(MBR) == 512);\n\n#pragma pack()\n\n//\n// FAT definitions.\n//\n\n#define FAT_SECTOR_SIZE 512\n#define FAT_FIRST_DATA_CLUSTER 2\n\n#define FAT16_CLUSTER_MASK 0xFFFF\n#define FAT16_LINK_TERMINATOR 0xFFFF\n\n#define FAT32_CLUSTER_MASK 0x0FFFFFFF\n#define FAT32_LINK_TERMINATOR 0x0FFFFFFF\n\n\n#pragma pack(1)\n\ntypedef struct __declspec(align(FAT_SECTOR_SIZE)) _FAT_SECTOR {\n UINT8 Data[FAT_SECTOR_SIZE];\n} FAT_SECTOR, *PFAT_SECTOR;\n\ntypedef struct _FAT16_BOOT_SECTOR {\n UINT8 JumpInstruction[3];\n UINT8 OemName[8];\n UINT16 BytesPerSector;\n UINT8 SectorsPerCluster;\n UINT16 NumberOfReservedSectors;\n UINT8 NumberOfFATs;\n UINT16 NumberOfRootDirectoryEntries;\n UINT16 TotalSectorCount16;\n UINT8 Media;\n UINT16 SectorsPerFAT;\n UINT16 SectorsPerTrack;\n UINT16 NumberOfHeads;\n UINT32 NumberOfHiddenSectors;\n UINT32 TotalSectorCount32;\n UINT8 DriveNumber;\n UINT8 Reserved1;\n UINT8 ExtendedBootSignature;\n UINT32 VolumeSerialNumber;\n UINT8 VolumeLabel[11];\n UINT8 FileSystemType[8];\n UINT8 BootCode[448];\n UINT16 Signature;\n} FAT16_BOOT_SECTOR, *PFAT16_BOOT_SECTOR;\n\nC_ASSERT(sizeof(FAT16_BOOT_SECTOR) == FAT_SECTOR_SIZE);\n\ntypedef struct _FAT32_BOOT_SECTOR {\n UINT8 JumpInstruction[3];\n UINT8 OemName[8];\n UINT16 BytesPerSector;\n UINT8 SectorsPerCluster;\n UINT16 NumberOfReservedSectors;\n UINT8 NumberOfFATs;\n UINT16 NumberOfRootDirectoryEntries;\n UINT16 TotalSectorCount16;\n UINT8 Media;\n UINT16 SectorsPerFAT16;\n UINT16 SectorsPerTrack;\n UINT16 NumberOfHeads;\n UINT32 NumberOfHiddenSectors;\n UINT32 TotalSectorCount32;\n UINT32 SectorsPerFAT32;\n UINT16 Flags;\n UINT16 FileSystemVersion;\n UINT32 RootDirectoryFirstCluster;\n UINT16 FileSystemInfoSector;\n UINT16 BackupBootSector;\n UINT8 Reserved[12];\n UINT8 DriveNumber;\n UINT8 Reserved1;\n UINT8 ExtendedBootSignature;\n UINT32 VolumeSerialNumber;\n UINT8 VolumeLabel[11];\n UINT8 FileSystemType[8];\n UINT8 BootCode[420];\n UINT16 Signature;\n} FAT32_BOOT_SECTOR, *PFAT32_BOOT_SECTOR;\n\nC_ASSERT(sizeof(FAT32_BOOT_SECTOR) == FAT_SECTOR_SIZE);\n\ntypedef struct _FAT_BOOT_SECTOR {\n union {\n FAT16_BOOT_SECTOR Fat16;\n FAT32_BOOT_SECTOR Fat32;\n } u1;\n} FAT_BOOT_SECTOR, *PFAT_BOOT_SECTOR;\n\nC_ASSERT(sizeof(FAT_BOOT_SECTOR) == FAT_SECTOR_SIZE);\n\n#define FAT_DIRECTORY_ENTRY_FREE 0xE5\n#define FAT_DIRECTORY_ENTRY_LAST 0x00\n\n#define FAT_ATTRIBUTE_READ_ONLY 0x01\n#define FAT_ATTRIBUTE_HIDDEN 0x02\n#define FAT_ATTRIBUTE_SYSTEM 0x04\n#define FAT_ATTRIBUTE_VOLUME_ID 0x08\n#define FAT_ATTRIBUTE_DIRECTORY 0x10\n#define FAT_ATTRIBUTE_ARCHIVE 0x20\n#define FAT_ATTRIBUTE_LONG_NAME (FAT_ATTRIBUTE_READ_ONLY | FAT_ATTRIBUTE_HIDDEN | FAT_ATTRIBUTE_SYSTEM | FAT_ATTRIBUTE_VOLUME_ID)\n#define FAT_ATTRIBUTE_MASK 0x3F\n\n#define FAT_LONG_NAME_TERMINATOR 0x40\n#define FAT_LONG_NAME_ORDER_MASK 0x3F\n\ntypedef struct _FAT_DIRECTORY_ENTRY {\n union {\n struct {\n UINT8 Name[11];\n UINT8 Attribute;\n UINT8 ReservedForNT;\n UINT8 CreationTime[3];\n UINT8 CreationDate[2];\n UINT8 LastAccessDate[2];\n UINT16 FirstClusterHigh;\n UINT8 ModificationTime[2];\n UINT8 ModificationDate[2];\n UINT16 FirstClusterLow;\n UINT32 Size;\n } Short;\n struct {\n UINT8 Order;\n WCHAR NameW1_5[5];\n UINT8 Attribute;\n UINT8 Type;\n UINT8 Checksum;\n WCHAR NameW6_11[6];\n UINT16 Zero;\n WCHAR NameW12_13[2];\n } Long;\n } u1;\n} FAT_DIRECTORY_ENTRY, *PFAT_DIRECTORY_ENTRY;\n\nC_ASSERT(sizeof(FAT_DIRECTORY_ENTRY) == 32);\n\n#define FAT_MAX_PATH 255\n\ntypedef struct _FAT_NAME {\n UINT8 ShortName[13];\n UINT8 LongName[FAT_MAX_PATH + 1];\n} FAT_NAME, *PFAT_NAME;\n\n#pragma pack()\n\n\nFAT_BOOT_SECTOR BlFatBootSector;\nUINT32 BlFatBytesPerCluster;\nUINT32 BlFatDataStart;\nUINT8 BlFatDriveId;\nINT13_DRIVE_PARAMETERS BlFatDriveParameters;\nUINT32 BlFatLinkTerminator;\nMBR BlFatMbr;\nUINT32 BlFatNumberOfDataClusters;\nUINT32 BlFatNumberOfRootDirectoryEntries;\nUINT32 BlFatPartitionId;\nUINT32 BlFatPartitionStart;\nUINT32 BlFatPartitionSize;\nPFAT_DIRECTORY_ENTRY BlFatRootDirectory;\nUINT32 BlFatRootStart;\nUINT32 BlFatSectorsPerCluster;\nUINT32 BlFatTableStart;\nFAT_SECTOR BlFatTemporaryBlock[64];\nUINT16 BlFatTemporaryBlockCount = sizeof(BlFatTemporaryBlock) / sizeof(BlFatTemporaryBlock[0]);\nUINT32 BlFatTotalSectorCount;\n\n#define FAT_IS_DATA_CLUSTER(X) (((X) >= FAT_FIRST_DATA_CLUSTER) && (((X) - FAT_FIRST_DATA_CLUSTER) < BlFatNumberOfDataClusters))\n#define FAT_DATA_CLUSTER_TO_SECTOR(X) (BlFatDataStart + (((X) - 2) * BlFatSectorsPerCluster))\n#define FAT_IS_TERMINATOR(X) (((UINT32) (X)) == BlFatLinkTerminator)\n#define BlFatHalt() BlFatHaltInternal(__LINE__)\n\nBOOLEAN\n(*BlFatGetNextCluster)(\n UINT32 Cluster,\n PUINT32 NextCluster\n );\n\nVOID\nBlFatHaltInternal(\n UINT32 Line\n )\n\n//++\n//\n// Routine Description:\n//\n// Prints an error message and halts.\n//\n//--\n\n{\n BlRtlPrintf(\"FAT: Error reading disk image!\\n\");\n BlRtlHaltInternal(__FILE__, Line);\n}\n\nBOOLEAN\nBlFatReadSector(\n UINT32 FirstSector,\n UINT32 NumberOfSectors,\n PFAT_SECTOR Buffer\n )\n\n//++\n//\n// Routine Description:\n//\n// This function reads the specified range of sectors.\n//\n// Arguments:\n//\n// FirstSector - Supplies the first sector to read.\n//\n// NumberOfSectors - Supplies the number of sectors to read.\n//\n// Buffer - Receives data.\n//\n// Return Value:\n//\n// TRUE, if read operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT16 StepSize;\n\n BLASSERT_PTR(FirstSector < BlFatTotalSectorCount, FirstSector);\n\n BLASSERT(NumberOfSectors > 0);\n\n BLASSERT(FirstSector + NumberOfSectors > FirstSector);\n\n BLASSERT((FirstSector + NumberOfSectors) < BlFatTotalSectorCount);\n\n while (NumberOfSectors > 0) {\n\n if (NumberOfSectors < BlFatTemporaryBlockCount) {\n\n StepSize = (UINT16) NumberOfSectors;\n\n } else {\n\n StepSize = BlFatTemporaryBlockCount;\n }\n\n if (BlRtlReadDrive(BlFatDriveId,\n BlFatPartitionStart + FirstSector,\n StepSize,\n BlFatTemporaryBlock) == FALSE) {\n\n#if FAT_VERBOSE\n\n BlRtlPrintf(\"FAT: I/O error reading sector %u on drive 0x%02x!\\n\",\n BlFatPartitionStart + FirstSector,\n BlFatDriveId);\n\n#endif\n\n return FALSE;\n }\n\n BlRtlCopyMemory(Buffer,\n BlFatTemporaryBlock,\n StepSize * FAT_SECTOR_SIZE);\n\n FirstSector += StepSize;\n NumberOfSectors -= StepSize;\n Buffer += StepSize;\n }\n\n return TRUE;\n}\n\nBOOLEAN\nBlFatDirectoryEntryToName(\n PFAT_DIRECTORY_ENTRY ShortEntry,\n PFAT_NAME Name,\n PFAT_DIRECTORY_ENTRY TableStart\n )\n\n//++\n//\n// Routine Description:\n//\n// This function extracts FAT short and long names from the specified directory entry.\n//\n// Arguments:\n//\n// ShortEntry - Supplies a pointer to the short name entry.\n//\n// Name - Receives short and long names.\n//\n// TableStart - Supplies the start address for the directory table.\n//\n// Return Value:\n//\n// TRUE, if names were extracted successfully.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT8 Character;\n PFAT_DIRECTORY_ENTRY Entry;\n UINT8 LongNameComponentIndex;\n UINT32 SourceIndex;\n UINT32 TargetIndex;\n\n if ((ShortEntry->u1.Short.Attribute & FAT_ATTRIBUTE_MASK) == FAT_ATTRIBUTE_LONG_NAME) {\n\n return FALSE;\n }\n\n //\n // Extract short name.\n //\n\n TargetIndex = 0;\n\n for (SourceIndex = 0; SourceIndex < 8; SourceIndex += 1) {\n\n Character = ShortEntry->u1.Short.Name[SourceIndex];\n\n if (Character == ' ') {\n\n if (SourceIndex == 0) {\n\n return FALSE;\n }\n\n break;\n }\n\n if (Character == '.') {\n\n return FALSE;\n }\n\n Name->ShortName[TargetIndex] = Character;\n TargetIndex += 1;\n }\n\n if (ShortEntry->u1.Short.Name[8] != ' ') {\n\n Name->ShortName[TargetIndex] = '.';\n TargetIndex += 1;\n\n for (SourceIndex = 8; SourceIndex < 11; SourceIndex += 1) {\n\n Character = ShortEntry->u1.Short.Name[SourceIndex];\n\n if (Character == ' ') {\n\n break;\n }\n\n if (Character == '.') {\n\n return FALSE;\n }\n\n Name->ShortName[TargetIndex] = Character;\n TargetIndex += 1;\n }\n }\n\n Name->ShortName[TargetIndex] = 0;\n\n //\n // If there is a long name, extract it by walking backwards from the short entry.\n // Otherwise, set long name to empty string.\n //\n\n Name->LongName[0] = 0;\n\n Entry = ShortEntry - 1;\n\n if (Entry < TableStart) {\n\n return TRUE;\n }\n\n if ((Entry->u1.Short.Attribute & FAT_ATTRIBUTE_MASK) != FAT_ATTRIBUTE_LONG_NAME) {\n\n return TRUE;\n }\n\n LongNameComponentIndex = 1;\n TargetIndex = 0;\n\n for (;;) {\n\n if (TargetIndex == FAT_MAX_PATH) {\n\n return FALSE;\n }\n\n if (Entry < TableStart) {\n\n return FALSE;\n }\n\n if ((Entry->u1.Long.Order & FAT_LONG_NAME_ORDER_MASK) != LongNameComponentIndex) {\n\n return FALSE;\n }\n\n#define ADD_CHARACTER(C) \\\n \\\n if (TargetIndex == FAT_MAX_PATH) { \\\n \\\n return FALSE; \\\n } \\\n \\\n if (((C) != 0) && ((C) != 0xFFFF)) { \\\n \\\n Name->LongName[TargetIndex] = (UINT8) (C); \\\n TargetIndex += 1; \\\n }\n\n ADD_CHARACTER(Entry->u1.Long.NameW1_5[0]);\n ADD_CHARACTER(Entry->u1.Long.NameW1_5[1]);\n ADD_CHARACTER(Entry->u1.Long.NameW1_5[2]);\n ADD_CHARACTER(Entry->u1.Long.NameW1_5[3]);\n ADD_CHARACTER(Entry->u1.Long.NameW1_5[4]);\n ADD_CHARACTER(Entry->u1.Long.NameW6_11[0]);\n ADD_CHARACTER(Entry->u1.Long.NameW6_11[1]);\n ADD_CHARACTER(Entry->u1.Long.NameW6_11[2]);\n ADD_CHARACTER(Entry->u1.Long.NameW6_11[3]);\n ADD_CHARACTER(Entry->u1.Long.NameW6_11[4]);\n ADD_CHARACTER(Entry->u1.Long.NameW6_11[5]);\n ADD_CHARACTER(Entry->u1.Long.NameW12_13[0]);\n ADD_CHARACTER(Entry->u1.Long.NameW12_13[1]);\n\n#undef ADD_CHARACTER\n\n if ((Entry->u1.Long.Order & FAT_LONG_NAME_TERMINATOR)) {\n\n break;\n }\n\n Entry -= 1;\n LongNameComponentIndex += 1;\n }\n\n Name->LongName[TargetIndex] = 0;\n\n return TRUE;\n}\n\nPFAT_DIRECTORY_ENTRY\nBlFatFindDirectoryTableEntry(\n PFAT_DIRECTORY_ENTRY Table,\n UINT32 NumberOfEntries,\n PCSTR Name\n )\n\n//++\n//\n// Routine Description:\n//\n// This function finds the directory table entry matching the specified name.\n//\n// Arguments:\n//\n// Table - Supplies a pointer to the table to find in.\n//\n// NumberOfEntries - Supplies the number of entries in the table.\n//\n// Name - Supplies the name to look for.\n//\n// Return Value:\n//\n// TRUE, if a matching entry was located.\n// FALSE, otherwise.\n//\n//--\n\n{\n PFAT_DIRECTORY_ENTRY Entry;\n FAT_NAME EntryName;\n PFAT_DIRECTORY_ENTRY Limit;\n\n BLASSERT(Name[0] != 0);\n\n Limit = Table + NumberOfEntries;\n\n for (Entry = Table; Entry != Limit; Entry += 1) {\n\n if (Entry->u1.Short.Name[0] == FAT_DIRECTORY_ENTRY_FREE) {\n\n continue;\n }\n\n if (Entry->u1.Short.Name[0] == FAT_DIRECTORY_ENTRY_LAST) {\n\n break;\n }\n\n if (Entry->u1.Short.Name[0] == '.') {\n\n continue;\n }\n\n if ((Entry->u1.Short.Attribute & FAT_ATTRIBUTE_MASK) == FAT_ATTRIBUTE_VOLUME_ID) {\n\n continue;\n }\n\n if (BlFatDirectoryEntryToName(Entry,\n &EntryName,\n Table) != FALSE) {\n\n if ((BlRtlEqualStringI(Name, (PCSTR) EntryName.ShortName) != FALSE) ||\n (BlRtlEqualStringI(Name, (PCSTR) EntryName.LongName) != FALSE)) {\n\n return Entry;\n }\n }\n }\n\n return NULL;\n}\n\nBOOLEAN\nBlFatGetLengthClusterChain(\n UINT32 Cluster,\n PUINT32 Length\n )\n\n//++\n//\n// Routine Description:\n//\n// This function queries the length of the specified cluster chain.\n//\n// Arguments:\n//\n// Cluster - Supplies the index of the first cluster in the chain.\n//\n// Length - Receives the length of the chain.\n//\n// Return Value:\n//\n// TRUE, if query operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n *Length = 0;\n\n do {\n\n if (FAT_IS_DATA_CLUSTER(Cluster) == FALSE) {\n\n return FALSE;\n }\n\n if (BlFatGetNextCluster(Cluster, &Cluster) == FALSE) {\n\n return FALSE;\n }\n\n *Length += 1;\n\n } while (Cluster != BlFatLinkTerminator);\n\n return TRUE;\n}\n\nBOOLEAN\nBlFatReadClusterChain(\n UINT32 Cluster,\n UINT32 BytesToRead,\n PVOID Buffer\n )\n\n//++\n//\n// Routine Description:\n//\n// This function reads from the specified FAT data cluster chain.\n//\n// Arguments:\n//\n// Cluster - Supplies the index of the first cluster in the chain.\n//\n// BytesToRead - Supplies number of bytes to read.\n//\n// Buffer - Receives data.\n//\n// Return Value:\n//\n// TRUE, if read operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n PVOID ClusterData;\n PUINT8 Next;\n UINT32 Sector;\n\n BLASSERT_PTR(FAT_IS_DATA_CLUSTER(Cluster) != FALSE, Cluster);\n\n BLASSERT(BytesToRead > 0);\n\n Next = (PUINT8) Buffer;\n\n for (;;) {\n\n //\n // If the cluster number is not within the valid data range, then fail the read operation.\n //\n\n if (FAT_IS_DATA_CLUSTER(Cluster) == FALSE) {\n\n#if FAT_VERBOSE\n\n BlRtlPrintf(\"FAT: ReadClusterChain: Cluster %u is out of range!\\n\", Cluster);\n\n#endif\n\n return FALSE;\n }\n\n //\n // Calculate the first sector in the cluster.\n //\n\n Sector = FAT_DATA_CLUSTER_TO_SECTOR(Cluster);\n\n //\n // If remaining bytes to read is less than the cluster size, then read it using a\n // temporary buffer, since the caller provided buffer is not necessarily a multiple\n // of cluster size.\n //\n\n if (BytesToRead < BlFatBytesPerCluster) {\n\n ClusterData = BlPoolAllocateBlock(BlFatBytesPerCluster);\n\n if (BlFatReadSector(Sector,\n ROUND_UP_TO_POWER2(BytesToRead, FAT_SECTOR_SIZE) / FAT_SECTOR_SIZE,\n (PFAT_SECTOR) ClusterData) == FALSE) {\n\n BlPoolFreeBlock(ClusterData);\n\n return FALSE;\n }\n\n BlRtlCopyMemory(Next,\n ClusterData,\n BytesToRead);\n\n BlPoolFreeBlock(ClusterData);\n\n return TRUE;\n }\n\n //\n // Otherwise, read the entire cluster and advance by full cluster size.\n //\n\n if (BlFatReadSector(Sector,\n BlFatSectorsPerCluster,\n (PFAT_SECTOR) Next) == FALSE) {\n\n return FALSE;\n }\n\n BytesToRead -= BlFatBytesPerCluster;\n Next += BlFatBytesPerCluster;\n\n if (BytesToRead == 0) {\n\n return TRUE;\n }\n\n //\n // Get the next cluster index.\n //\n\n if (BlFatGetNextCluster(Cluster, &Cluster) == FALSE) {\n\n return FALSE;\n }\n }\n}\n\nBOOLEAN\nBlFatFindFileEntry(\n PCSTR Path,\n PFAT_DIRECTORY_ENTRY FileEntry\n )\n\n//++\n//\n// Routine Description:\n//\n// This function finds the entry matching the specified file path.\n//\n// Arguments:\n//\n// Path - Supplies a pointer to the path to look up.\n//\n// FileEntry - Receives the contents of the entry matching the specified path.\n//\n// Return Value:\n//\n// TRUE, if a match was found.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT32 DirectoryCluster;\n UINT32 DirectoryClusterCount;\n UINT32 Depth;\n FAT_DIRECTORY_ENTRY Entry;\n PFAT_DIRECTORY_ENTRY Match;\n PCSTR Next;\n PFAT_DIRECTORY_ENTRY Table;\n UINT32 TableSize;\n UINT8 Token[FAT_MAX_PATH];\n UINT32 TokenIndex;\n\n if ((Path[0] == 0) ||\n (Path[0] == '/') ||\n (BlRtlStringLength(Path) >= FAT_MAX_PATH)) {\n\n return FALSE;\n }\n\n Next = Path;\n Depth = 0;\n\n SATISFY_OVERZEALOUS_COMPILER(BlRtlZeroMemory(&Entry, sizeof(Entry)));\n\n for (;;) {\n\n if (*Next == 0) {\n\n if ((Entry.u1.Short.Attribute & FAT_ATTRIBUTE_DIRECTORY) != 0) {\n\n#if FAT_VERBOSE\n\n BlRtlPrintf(\"FAT: FindFileEntry: %s is a directory!\\n\", Path);\n\n#endif\n\n return FALSE;\n }\n\n *FileEntry = Entry;\n\n return TRUE;\n }\n\n //\n // If the next token is empty (i.e. back to back separators), then this is a malformed path.\n //\n\n if (*Next == '/') {\n\n#if FAT_VERBOSE\n\n BlRtlPrintf(\"FAT: FindFileEntry: %s is a malformed path!\\n\", Path);\n\n#endif\n\n return FALSE;\n }\n\n //\n // Extract the next token.\n //\n\n TokenIndex = 0;\n\n for (;;) {\n\n if (*Next == 0) {\n\n break;\n }\n\n if (*Next == '/') {\n\n Next += 1;\n\n break;\n }\n\n Token[TokenIndex] = *Next;\n TokenIndex += 1;\n Next += 1;\n }\n\n BLASSERT(TokenIndex > 0);\n\n Token[TokenIndex] = 0;\n\n if (Depth == 0) {\n\n Table = BlFatRootDirectory;\n TableSize = BlFatNumberOfRootDirectoryEntries;\n\n } else {\n\n DirectoryCluster = Entry.u1.Short.FirstClusterLow;\n\n if (BlFatGetLengthClusterChain(DirectoryCluster, &DirectoryClusterCount) == FALSE) {\n\n return FALSE;\n }\n\n Table = (PFAT_DIRECTORY_ENTRY)\n BlPoolAllocateBlock(DirectoryClusterCount * BlFatBytesPerCluster);\n\n if (BlFatReadClusterChain(DirectoryCluster,\n DirectoryClusterCount * BlFatBytesPerCluster,\n Table) == FALSE) {\n\n BlPoolFreeBlock(Table);\n\n return FALSE;\n }\n\n TableSize = (DirectoryClusterCount * BlFatBytesPerCluster) / sizeof(FAT_DIRECTORY_ENTRY);\n }\n\n //\n // Walk the directory table matching the previous token for an entry matching the next token.\n //\n\n Match = BlFatFindDirectoryTableEntry(Table,\n TableSize,\n (PCSTR) Token);\n\n if (Match == NULL) {\n\n#if FAT_VERBOSE\n\n BlRtlPrintf(\"FAT: FindFileEntry: Unable to find directory entry for token %s.\\n\", Token);\n\n#endif\n\n if (Table != BlFatRootDirectory) {\n\n BlPoolFreeBlock(Table);\n }\n\n return FALSE;\n }\n\n Entry = *Match;\n\n if (Table != BlFatRootDirectory) {\n\n BlPoolFreeBlock(Table);\n }\n\n Depth += 1;\n }\n}\n\nBOOLEAN\nBlFatGetFileSize(\n PCSTR Path,\n PUINT32 FileSize\n )\n\n//++\n//\n// Routine Description:\n//\n// This function queries the size of the specified file.\n//\n// Arguments:\n//\n// Path - Supplies the path to the file to query.\n//\n// FileSize - Receives the size of the file.\n//\n// Return Value:\n//\n// TRUE, if the query operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n FAT_DIRECTORY_ENTRY Entry;\n\n if (BlFatFindFileEntry(Path, &Entry) == FALSE) {\n\n return FALSE;\n }\n\n *FileSize = Entry.u1.Short.Size;\n\n return TRUE;\n}\n\nBOOLEAN\nBlFatReadFile(\n PCSTR Path,\n PVOID Buffer,\n UINT32 NumberOfBytes\n )\n\n//++\n//\n// Routine Description:\n//\n// This function reads from the specified file.\n//\n// Arguments:\n//\n// Path - Supplies the path to the file to read.\n//\n// Buffer - Receives data.\n//\n// NumberOfBytes - Supplies the number of bytes to read.\n//\n// Return Value:\n//\n// TRUE, if the read operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n FAT_DIRECTORY_ENTRY Entry;\n BOOLEAN Result;\n\n if (BlFatFindFileEntry(Path, &Entry) == FALSE) {\n\n return FALSE;\n }\n\n if (NumberOfBytes > Entry.u1.Short.Size) {\n\n return FALSE;\n }\n\n Result = BlFatReadClusterChain(Entry.u1.Short.FirstClusterLow,\n NumberOfBytes,\n Buffer);\n\n return Result;\n}\n\nBOOLEAN\nBlFat16GetNextCluster(\n UINT32 Cluster,\n PUINT32 NextCluster\n )\n\n//++\n//\n// Routine Description:\n//\n// This function gets the index of the cluster following the specified cluster.\n//\n// Arguments:\n//\n// Cluster - Supplies the index of the cluster.\n//\n// NextCluster - Receives the index of the next cluster.\n//\n// Return Value:\n//\n// TRUE, if query operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT32 Offset;\n UINT32 Sector;\n FAT_SECTOR TablePage;\n\n if (FAT_IS_DATA_CLUSTER(Cluster) == FALSE) {\n\n#if FAT_VERBOSE\n\n BlRtlPrintf(\"FAT: Fat16GetNextCluster: Cluster %u is out of range!\\n\", Cluster);\n\n#endif\n\n return FALSE;\n }\n\n Sector = BlFatTableStart + (Cluster / 256);\n Offset = Cluster % 256;\n\n if (BlFatReadSector(Sector, 1, &TablePage) == FALSE) {\n\n return FALSE;\n }\n\n *NextCluster = (UINT32) (((PUINT16) &TablePage)[Offset]);\n\n return TRUE;\n}\n\nVOID\nBlFat16Initialize(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes FAT16 support.\n//\n//--\n\n{\n PFAT16_BOOT_SECTOR BootSector;\n\n BootSector = &BlFatBootSector.u1.Fat16;\n\n BLASSERT(BlFatMbr.Partition[BlFatPartitionId].Type == MBR_FAT16LBA);\n\n //\n // Read FAT16 boot sector.\n //\n\n if (BlRtlReadDrive(BlFatDriveId,\n BlFatPartitionStart,\n 1,\n BootSector) == FALSE) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: Error reading boot sector!\\n\");\n#endif\n BlFatHalt();\n }\n\n //\n // Extract volume geometry.\n //\n\n if (BootSector->BytesPerSector != FAT_SECTOR_SIZE) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: Unsupported sector size (%u)!\\n\", BootSector->BytesPerSector);\n#endif\n BlFatHalt();\n }\n\n BlFatSectorsPerCluster = BootSector->SectorsPerCluster;\n\n if (BlFatSectorsPerCluster == 0) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: SectorsPerCluster == 0!\\n\");\n#endif\n BlFatHalt();\n }\n\n BlFatBytesPerCluster = BlFatSectorsPerCluster * FAT_SECTOR_SIZE;\n\n if (BootSector->TotalSectorCount32 > 0) {\n\n BlFatTotalSectorCount = BootSector->TotalSectorCount32;\n\n } else {\n\n BlFatTotalSectorCount = BootSector->TotalSectorCount16;\n }\n\n if (BlFatTotalSectorCount > BlFatPartitionSize) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: Boot sector claims more sectors than MBR!\\n\");\n#endif\n BlFatHalt();\n }\n\n if (BootSector->NumberOfFATs == 0) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: NumberOfFATs == 0!\\n\");\n#endif\n BlFatHalt();\n }\n\n if (BootSector->SectorsPerFAT == 0) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: SectorsPerFAT == 0!\\n\");\n#endif\n BlFatHalt();\n }\n\n BlFatNumberOfRootDirectoryEntries = BootSector->NumberOfRootDirectoryEntries;\n\n if ((BlFatNumberOfRootDirectoryEntries == 0) ||\n ((BlFatNumberOfRootDirectoryEntries % 64) != 0)) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: Invalid number of root directory entries (%u)!\\n\", BlFatNumberOfRootDirectoryEntries);\n#endif\n BlFatHalt();\n }\n\n BlFatTableStart = BootSector->NumberOfReservedSectors;\n\n if (BlFatTotalSectorCount < BlFatTableStart) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: TotalSectorCount < TableStart!\\n\");\n#endif\n BlFatHalt();\n }\n\n BlFatRootStart = BlFatTableStart + (BootSector->NumberOfFATs * BootSector->SectorsPerFAT);\n\n if (BlFatTotalSectorCount < BlFatRootStart) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: TotalSectorCount < RootStart!\\n\");\n#endif\n BlFatHalt();\n }\n\n BlFatDataStart = BlFatRootStart + (ROUND_UP_TO_POWER2(BlFatNumberOfRootDirectoryEntries * sizeof(FAT_DIRECTORY_ENTRY), FAT_SECTOR_SIZE) / FAT_SECTOR_SIZE);\n\n if (BlFatTotalSectorCount < BlFatDataStart) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: TotalSectorCount < DataStart!\\n\");\n#endif\n BlFatHalt();\n }\n\n BlFatNumberOfDataClusters = (BlFatTotalSectorCount - BlFatDataStart) / BlFatSectorsPerCluster;\n\n if (BlFatNumberOfDataClusters == 0) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: NumberOfDataClusters == 0!\\n\");\n#endif\n BlFatHalt();\n }\n\n BlFatLinkTerminator = FAT16_LINK_TERMINATOR;\n BlFatGetNextCluster = BlFat16GetNextCluster;\n\n //\n // Read root directory.\n //\n\n BlFatRootDirectory = (PFAT_DIRECTORY_ENTRY) BlPoolAllocateBlock((BlFatDataStart - BlFatRootStart) * FAT_SECTOR_SIZE);\n\n if (BlFatReadSector(BlFatRootStart,\n BlFatDataStart - BlFatRootStart,\n (PFAT_SECTOR) BlFatRootDirectory) == FALSE) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: Error reading root directory!\\n\");\n#endif\n BlFatHalt();\n }\n\n BLASSERT(FAT_IS_DATA_CLUSTER(FAT16_LINK_TERMINATOR) == FALSE);\n\n return;\n}\n\nBOOLEAN\nBlFat32GetNextCluster(\n UINT32 Cluster,\n PUINT32 NextCluster\n )\n\n//++\n//\n// Routine Description:\n//\n// This function gets the index of the cluster following the specified cluster.\n//\n// Arguments:\n//\n// Cluster - Supplies the index of the cluster.\n//\n// NextCluster - Receives the index of the next cluster.\n//\n// Return Value:\n//\n// TRUE, if query operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT32 Offset;\n UINT32 Sector;\n FAT_SECTOR TablePage;\n\n if (FAT_IS_DATA_CLUSTER(Cluster) == FALSE) {\n\n#if FAT_VERBOSE\n\n BlRtlPrintf(\"FAT: Fat32GetNextCluster: Cluster %u is out of range!\\n\", Cluster);\n\n#endif\n\n return FALSE;\n }\n\n Sector = BlFatTableStart + (Cluster / 128);\n Offset = Cluster % 128;\n\n if (BlFatReadSector(Sector, 1, &TablePage) == FALSE) {\n\n return FALSE;\n }\n\n *NextCluster = ((PUINT32) &TablePage)[Offset];\n\n return TRUE;\n}\n\nVOID\nBlFat32Initialize(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes FAT32 support.\n//\n//--\n\n{\n PFAT32_BOOT_SECTOR BootSector;\n UINT32 RootDirectoryChainLength;\n\n BootSector = &BlFatBootSector.u1.Fat32;\n\n BLASSERT(BlFatMbr.Partition[BlFatPartitionId].Type == MBR_FAT32LBA);\n\n //\n // Read FAT32 boot sector.\n //\n\n if (BlRtlReadDrive(BlFatDriveId,\n BlFatPartitionStart,\n 1,\n BootSector) == FALSE) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: Error reading boot sector!\\n\");\n#endif\n BlFatHalt();\n }\n\n //\n // Extract volume geometry.\n //\n\n if (BootSector->BytesPerSector != FAT_SECTOR_SIZE) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: Unsupported sector size (%u)!\\n\", BootSector->BytesPerSector);\n#endif\n BlFatHalt();\n }\n\n BlFatSectorsPerCluster = BootSector->SectorsPerCluster;\n\n if (BlFatSectorsPerCluster == 0) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: SectorsPerCluster == 0!\\n\");\n#endif\n BlFatHalt();\n }\n\n BlFatBytesPerCluster = BlFatSectorsPerCluster * FAT_SECTOR_SIZE;\n\n if (BootSector->TotalSectorCount32 > 0) {\n\n BlFatTotalSectorCount = BootSector->TotalSectorCount32;\n\n } else {\n\n BlFatTotalSectorCount = BootSector->TotalSectorCount16;\n }\n\n if (BlFatTotalSectorCount > BlFatPartitionSize) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: Boot sector claims more sectors than MBR!\\n\");\n#endif\n BlFatHalt();\n }\n\n if (BootSector->NumberOfFATs == 0) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: NumberOfFATs == 0!\\n\");\n#endif\n BlFatHalt();\n }\n\n if (BootSector->SectorsPerFAT32 == 0) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: SectorsPerFAT == 0!\\n\");\n#endif\n BlFatHalt();\n }\n\n if (BootSector->NumberOfRootDirectoryEntries != 0) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: BootSector->NumberOfRootDirectoryEntries != 0!\\n\");\n#endif\n BlFatHalt();\n }\n\n BlFatTableStart = BootSector->NumberOfReservedSectors;\n\n if (BlFatTotalSectorCount < BlFatTableStart) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: TotalSectorCount < TableStart!\\n\");\n#endif\n BlFatHalt();\n }\n\n BlFatDataStart = BlFatTableStart + (BootSector->NumberOfFATs * BootSector->SectorsPerFAT32);\n\n if (BlFatTotalSectorCount < BlFatDataStart) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: TotalSectorCount < DataStart!\\n\");\n#endif\n BlFatHalt();\n }\n\n BlFatNumberOfDataClusters = (BlFatTotalSectorCount - BlFatDataStart) / BlFatSectorsPerCluster;\n\n if (BlFatNumberOfDataClusters == 0) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: NumberOfDataClusters == 0!\\n\");\n#endif\n BlFatHalt();\n }\n\n BlFatLinkTerminator = FAT32_LINK_TERMINATOR;\n BlFatGetNextCluster = BlFat32GetNextCluster;\n\n //\n // Read root directory.\n //\n\n if (BlFatGetLengthClusterChain(BootSector->RootDirectoryFirstCluster, &RootDirectoryChainLength) == FALSE) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: Error querying chain length of root directory!\\n\");\n#endif\n BlFatHalt();\n }\n\n BlFatRootDirectory = (PFAT_DIRECTORY_ENTRY) BlPoolAllocateBlock(RootDirectoryChainLength * BlFatBytesPerCluster);\n\n if (BlFatReadClusterChain(BootSector->RootDirectoryFirstCluster,\n RootDirectoryChainLength * BlFatBytesPerCluster,\n BlFatRootDirectory) == FALSE) {\n\n#if FAT_VERBOSE\n BlRtlPrintf(\"FAT: Error reading root directory!\\n\");\n#endif\n BlFatHalt();\n }\n\n BlFatNumberOfRootDirectoryEntries = (RootDirectoryChainLength * BlFatBytesPerCluster) / sizeof(FAT_DIRECTORY_ENTRY);\n\n\n BLASSERT(FAT_IS_DATA_CLUSTER(FAT32_LINK_TERMINATOR) == FALSE);\n\n return;\n}\n\nVOID\nBlFatInitialize(\n UINT8 DriveId,\n UINT8 FatType\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes FAT support.\n//\n// Arguments:\n//\n// DriveId - Supplies boot drive ID.\n//\n// FatType - Supplies the FAT type to look for.\n//\n//--\n\n{\n UINT32 Index;\n\n BLASSERT((FatType == MBR_FAT16LBA) || (FatType == MBR_FAT32LBA));\n\n if (BlRtlGetDriveParameters(DriveId, &BlFatDriveParameters) == FALSE) {\n\n BlRtlPrintf(\"FAT: Can't get drive info 0x%02x!\\n\", DriveId);\n BlRtlHalt();\n }\n\n if (BlFatDriveParameters.BytesPerSector != FAT_SECTOR_SIZE) {\n\n BlRtlPrintf(\"FAT: Unexpected bytes per sector (%u)!\\n\", BlFatDriveParameters.BytesPerSector);\n BlRtlHalt();\n }\n\n if (BlRtlReadDrive(DriveId, 0, 1, &BlFatMbr) == FALSE) {\n\n BlRtlPrintf(\"FAT: Error reading MBR!\\n\");\n BlRtlHalt();\n }\n\n if (BlFatMbr.Signature != MBR_SIGNATURE) {\n\n BlRtlPrintf(\"FAT: No MBR signature!\\n\");\n }\n\n BlFatPartitionId = (UINT32) -1;\n\n for (Index = 0; Index <= 4; Index += 1) {\n\n if (FatType == BlFatMbr.Partition[Index].Type) {\n\n switch (BlFatMbr.Partition[Index].Type) {\n\n case MBR_FAT16LBA: {\n\n BlFatDriveId = DriveId;\n BlFatPartitionId = Index;\n BlFatPartitionStart = BlFatMbr.Partition[Index].FirstSector;\n BlFatPartitionSize = BlFatMbr.Partition[Index].NumberOfSectors;\n\n BlFat16Initialize();\n\n break;\n }\n\n case MBR_FAT32LBA: {\n\n BlFatDriveId = DriveId;\n BlFatPartitionId = Index;\n BlFatPartitionStart = BlFatMbr.Partition[Index].FirstSector;\n BlFatPartitionSize = BlFatMbr.Partition[Index].NumberOfSectors;\n\n BlFat32Initialize();\n\n break;\n }\n }\n }\n }\n\n if (BlFatPartitionId == (UINT32) -1) {\n\n BlRtlPrintf(\"FAT: No %s partitions!\\n\", FatType == MBR_FAT16LBA ? \"FAT16\" : \"FAT32\");\n\n BlRtlHalt();\n }\n\n BlFsGetFileSize = BlFatGetFileSize;\n BlFsReadFile = BlFatReadFile;\n\n return;\n}\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blflash.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blflash.cpp\n//\n// Abstract:\n//\n// This module implements flash support for the boot loader.\n//\n//--\n\n#include \"bl.h\"\n\nstruct FLASH_HEADER\n{\n UINT8 Label[18];\n UINT8 HeadSize;\n UINT8 SpecSize;\n UINT32 PageSize;\n UINT32 MajorVersion;\n UINT32 MinorVersion;\n};\n\nstruct FLASH_FILE\n{\n UINT32 PathOffset;\n UINT32 DataOffset;\n UINT32 Size;\n};\n\nstatic PUINT8 BlFlashBase = NULL;\nstatic FLASH_FILE * BlFlashImages = NULL;\n\nFLASH_FILE *\nBlFlashRecordIsValid(\n FLASH_FILE *Current\n )\n\n//++\n//\n// Routine Description:\n//\n// Find the next valid flash file record.\n//\n// Return Value:\n//\n// Pointer to the next valid flash file record, if the query operation was successful.\n// NULL, if there are no remaining valid record.\n//\n//--\n\n{\n for (;; Current++) {\n if ((Current->DataOffset == 0xffffffff && Current->Size == 0xffffffff) ||\n (Current->DataOffset == 0 && Current->Size == 0)) {\n continue;\n }\n else if (Current->DataOffset == 0xffffffff && Current->Size == 0) {\n return NULL;\n }\n return Current;\n }\n}\n\nFLASH_FILE *\nBlFlashFindFile(\n PCSTR Path\n )\n\n//++\n//\n// Routine Description:\n//\n// Find the flash file record matching this path name.\n//\n// Arguments:\n//\n// Path - Supplies the path to the file to query.\n//\n// Return Value:\n//\n// Pointer to the flash file record, if the query operation was successful.\n// NULL, otherwise.\n//\n//--\n\n{\n for (FLASH_FILE *File = BlFlashImages; File != NULL; File = BlFlashRecordIsValid(File + 1)) {\n if (BlRtlEqualStringI(Path, (PCSTR)(BlFlashBase + File->PathOffset))) {\n return File;\n }\n }\n return NULL;\n}\n\n\nBOOLEAN\nBlFlashGetFileSize(\n PCSTR Path,\n PUINT32 FileSize\n )\n\n//++\n//\n// Routine Description:\n//\n// This function queries the size of the specified file.\n//\n// Arguments:\n//\n// Path - Supplies the path to the file to query.\n//\n// FileSize - Receives the size of the file.\n//\n// Return Value:\n//\n// TRUE, if the query operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n FLASH_FILE * File = BlFlashFindFile(Path);\n\n if (File != NULL) {\n\n *FileSize = File->Size;\n\n return TRUE;\n\n }\n\n return FALSE;\n}\n\n//++\n//\n// Routine Description:\n//\n// This function reads from the specified file.\n//\n// Arguments:\n//\n// Path - Supplies the path to the file to read.\n//\n// Buffer - Receives data.\n//\n// NumberOfBytes - Supplies the number of bytes to read.\n//\n// Return Value:\n//\n// TRUE, if the read operation was successful.\n// FALSE, otherwise.\n//\n//--\n\nBOOLEAN\nBlFlashReadFile(\n PCSTR Path,\n PVOID Buffer,\n UINT32 NumberOfBytes\n )\n{\n (void)Path;\n (void)NumberOfBytes;\n (void)Buffer;\n\n FLASH_FILE * File = BlFlashFindFile(Path);\n\n if (File != NULL) {\n\n BlRtlCopyMemory(Buffer, BlFlashBase + File->DataOffset, NumberOfBytes);\n\n return TRUE;\n }\n\n return FALSE;\n}\n\nVOID\nBlFlashInitialize(\n PVOID SearchBegin,\n PVOID SearchLimit\n )\n{\n // walk through at 64KB boundaries looking for flash image.\n for (FLASH_HEADER * Search = (FLASH_HEADER *)SearchBegin;\n Search <= (FLASH_HEADER *)SearchLimit;\n Search = (FLASH_HEADER *)(((PUINT8)Search) + 0x10000)) {\n\n if (!BlRtlEqualStringI((PCSTR)Search->Label, \"SingularityFlash!\")) {\n continue;\n }\n if (Search->HeadSize != sizeof(FLASH_HEADER)) {\n continue;\n }\n if (Search->SpecSize != sizeof(FLASH_FILE)) {\n continue;\n }\n if (Search->MajorVersion != ~0u || Search->MinorVersion != ~0u) {\n BlRtlPrintf(\"--- Version %x.%x didn't match\\n\",\n Search->MajorVersion, Search->MinorVersion);\n continue;\n }\n if (Search->PageSize != 0x1000) {\n continue;\n }\n\n BlFlashBase = (PUINT8)Search;\n BlFlashImages = BlFlashRecordIsValid((FLASH_FILE *)(Search + 1));\n break;\n }\n\n BlFsGetFileSize = BlFlashGetFileSize;\n BlFsReadFile = BlFlashReadFile;\n}\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blkd.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blkd.cpp\n//\n// Abstract:\n//\n// This module implements KD support for the boot loader.\n//\n//--\n\n#include \"bl.h\"\n\nUINT32 BlKdNextPacketId;\n\nVOID\nBlKdSpin(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// Provide user feedback that we are waiting on the kernel debugger.\n//\n//--\n\n{\n static UINT8 state = 0;\n\n //\n // Write the spinner character to the top left corner of the screen.\n //\n\n *((UINT16 *)(ULONG_PTR)0xb809e) = 0x2f00 + (\"+-|*\" [state++ & 0x3]);\n}\n\nUINT32\nBlKdComputeChecksum(\n PCVOID Buffer,\n UINT32 Length\n )\n\n//++\n//\n// Routine Description:\n//\n// This function computes the checksum of a KD buffer.\n//\n// Arguments:\n//\n// Buffer - Supplies a pointer to the buffer.\n//\n// Length - Supplies the length of the buffer.\n//\n// Return Value:\n//\n// Checksum value for the specified buffer.\n//\n//--\n\n{\n UINT32 Checksum;\n UINT32 Index;\n\n Checksum = 0;\n\n for (Index = 0; Index < Length; Index += 1) {\n\n Checksum += ((PCHAR)Buffer)[Index];\n }\n\n return Checksum;\n}\n\nBOOLEAN\nBlKdPrintString(\n PCSTR String\n )\n\n//++\n//\n// Routine Description:\n//\n// This function prints the specified string to the KD.\n//\n// Arguments:\n//\n// String - Supplies a pointer to the string to print.\n//\n// Return Value:\n//\n// TRUE, if operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n KD_DEBUG_IO Packet;\n UINT32 StringLength;\n\n StringLength = BlRtlStringLength(String);\n\n if (StringLength >= 0xFFFF) {\n\n return FALSE;\n }\n\n BlRtlZeroMemory(&Packet, sizeof(Packet));\n\n Packet.ApiNumber = KD_API_PRINT_STRING;\n Packet.u1.PrintString.LengthOfString = StringLength;\n\n if (BlKdComPort != 0) {\n\n return BlKdComSendPacket(KD_PACKET_TYPE_KD_DEBUG_IO,\n &Packet,\n sizeof(Packet),\n String,\n (UINT16) StringLength + 1);\n\n }\n else if (BlPciOhci1394BaseAddress != 0) {\n\n return BlKd1394SendPacket(KD_PACKET_TYPE_KD_DEBUG_IO,\n &Packet,\n sizeof(Packet),\n String,\n (UINT16) StringLength + 1);\n\n }\n\n return FALSE;\n}\n\nBOOLEAN\nBlKdPrintf(\n PCSTR Format,\n ...\n )\n\n//++\n//\n// Routine Description:\n//\n// This function prints out a string to KD.\n//\n// Arguments:\n//\n// Format - Supplies the format string.\n//\n// ... - Supplies the input parameters.\n//\n// Return Value:\n//\n// TRUE, if operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n va_list ArgumentList;\n CHAR Buffer[4096];\n\n va_start(ArgumentList, Format);\n\n if (BlRtlFormatString(Buffer,\n sizeof(Buffer),\n Format,\n ArgumentList) == FALSE) {\n\n return FALSE;\n }\n\n BlKdPrintString(Buffer);\n\n return TRUE;\n}\n\nVOID\nBlKdInitialize(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes KD support for the boot loader.\n//\n//--\n\n{\n //\n // Try serial first.\n //\n\n if (BlKdComConnect() != FALSE) {\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"KD: Connected to COM%u\\n\", BlKdComPort);\n\n#endif\n\n return;\n }\n\n //\n // Try the 1394 transport next.\n //\n\n if (BlKd1394Connect() != FALSE) {\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"KD: Connected to 1394:%u\\n\", 0);\n\n#endif\n\n return;\n }\n\n return;\n}\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blkd1394.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blkd1394.cpp\n//\n// Abstract:\n//\n// This module implements the 1394 transport for KD.\n//\n//--\n\n#include \"bl.h\"\n#include \"blkd1394.h\"\n\n#if defined(BOOT_X64)\n\nBOOLEAN\nBlKd1394InitHardware(\n UINT16 Channel,\n PVOID IoRegion\n )\n{\n return FALSE;\n}\n\nBOOLEAN\nBlKd1394Connect(\n VOID\n )\n{\n return FALSE;\n}\n\nBOOLEAN\nBlKd1394SendPacket(\n UINT16 PacketType,\n PCVOID Header,\n UINT16 HeaderSize,\n PCVOID Data,\n UINT16 DataSize)\n{\n return FALSE;\n}\n\n#else // !defined(BOOT_X64)\n\n#define PACKET_READY 0x00000000 // Aka STATUS_SUCCESS\n#define PACKET_PENDING 0x00000103 // Aka STATUS_PENDING\n\n//\n// Change these macros to debug the debugger transport.\n//\n\n#define KDDBG if (0) BlVideoPrintf\n#define KDDBG2 if (0) BlVideoPrintf\n\n//\n// These structures are accessed directly by the host using RDMA.\n//\n\n#define DEBUG_BUS1394_MAX_PACKET_SIZE 4000\n\n#define DEBUG_1394_MAJOR_VERSION 0x1\n#define DEBUG_1394_MINOR_VERSION 0x0\n#define DEBUG_1394_CONFIG_TAG 0xBABABABA\n\ntypedef struct _DEBUG_1394_SEND_PACKET {\n UINT32 TransferStatus;\n UINT32 PacketHeader[4];\n UINT32 Length;\n UINT8 Packet[DEBUG_BUS1394_MAX_PACKET_SIZE];\n UINT8 Padding[72];\n} DEBUG_1394_SEND_PACKET;\n\nC_ASSERT(sizeof(DEBUG_1394_SEND_PACKET) == 4096);\n\ntypedef struct _DEBUG_1394_RECEIVE_PACKET {\n UINT32 TransferStatus;\n UINT32 Length;\n UINT8 Packet[DEBUG_BUS1394_MAX_PACKET_SIZE];\n UINT8 Padding[88];\n} DEBUG_1394_RECEIVE_PACKET;\n\nC_ASSERT(sizeof(DEBUG_1394_RECEIVE_PACKET) == 4096);\n\ntypedef struct _DEBUG_1394_CONFIG {\n UINT32 Tag;\n UINT16 MajorVersion;\n UINT16 MinorVersion;\n UINT32 Id;\n UINT32 BusPresent;\n UINT64 SendPacket;\n UINT64 ReceivePacket;\n} DEBUG_1394_CONFIG;\n\nC_ASSERT(sizeof(DEBUG_1394_CONFIG) == 32);\n\ntypedef struct _DEBUG_1394_DATA {\n UINT32 CromBuffer[248]; // our config ROM - must be 1k aligned\n DEBUG_1394_CONFIG Config; // our config for this session\n DEBUG_1394_SEND_PACKET SendPacket; // our send packet (isoch packet)\n DEBUG_1394_RECEIVE_PACKET ReceivePacket; // our receive packet\n} DEBUG_1394_DATA;\n\nC_ASSERT(sizeof(DEBUG_1394_DATA) == 1024 + 4096 + 4096);\n\n//\n// Timing constants.\n//\n\n#define TIMEOUT_COUNT 100000\n#define MAX_REGISTER_READS 400000\n\n//\n// Static Data Structures\n//\n\nstatic DEBUG_1394_DATA * Kd1394Data = NULL;\nstatic volatile OHCI_REGISTER_MAP * KdRegisters = NULL;\n\nUINT32\nBlKd1394StallExecution(\n UINT32 LoopCount\n )\n\n//++\n//\n// Routine Description:\n//\n// Stall for a finite time to allow hardware to respond.\n//\n// Arguments:\n//\n// LoopCount - Number of times to run the outer loop.\n//\n// Return Value:\n//\n// Ignored.\n//\n//--\n\n{\n volatile UINT32 b;\n volatile UINT32 k;\n volatile UINT32 i;\n\n b = 1;\n\n for (k = 0; k < LoopCount; k++) {\n\n BlKdSpin();\n\n for (i = 1; i < 10000; i++) {\n\n b = b * (i>>k);\n }\n }\n return b;\n}\n\nUINT32\nBlKd1394ByteSwap(\n UINT32 Source\n )\n\n//++\n//\n// Routine Description:\n//\n// Reverse the order of byte in the UINT32.\n//\n// Arguments:\n//\n// Source - 32-bit UINT32 value.\n//\n// Return Value:\n//\n// The input value with byte pairs 0:3 and 1:2 swapped.\n//\n//--\n\n{\n return (((Source) << (8 * 3)) |\n ((Source & 0x0000FF00) << (8 * 1)) |\n ((Source & 0x00FF0000) >> (8 * 1)) |\n ((Source) >> (8 * 3)));\n}\n\nUINT32\nBlKd1394Crc16(\n UINT32 Data,\n UINT32 Check\n )\n\n//++\n//\n// Routine Description:\n//\n// Derive the 16-bit CRC as defined by IEEE 1212 clause 8.1.5. (ISO/IEC 13213)\n// First edition 1994-10-05.\n//\n// Arguments:\n//\n// Data - UINT32 data to derive CRC from.\n//\n// Check - check value.\n//\n// Return Value:\n//\n// The 16-bit CRC.\n//\n//--\n\n{\n UINT32 Next = Check;\n INT32 Shift;\n\n for (Shift = 28; Shift >= 0; Shift -= 4) {\n UINT32 Sum;\n\n Sum = ((Next >> 12) ^ (Data >> Shift)) & 0xf;\n Next = (Next << 4) ^ (Sum << 12) ^ (Sum << 5) ^ (Sum);\n }\n return (Next & 0xFFFF);\n}\n\nUINT16\nBlKd1394CalculateCrc(\n UINT32 *Quadlet,\n UINT32 Length\n )\n\n//++\n//\n// Routine Description:\n//\n// Calculate a CRC for the pointer to the Quadlet data.\n//\n// Arguments:\n//\n// Quadlet - Pointer to data to CRC.\n//\n// Length - Length of data to CRC.\n//\n// Return Value:\n//\n// The 16-bit CRC.\n//\n//--\n\n{\n UINT32 Temp = 0;\n UINT32 Index;\n\n Temp = 0;\n\n for (Index = 0; Index < Length; Index++) {\n\n Temp = BlKd1394Crc16(Quadlet[Index], Temp);\n }\n\n return (UINT16)Temp;\n}\n\nBOOLEAN\nBlKd1394InitHardware(\n UINT16 Channel,\n PVOID IoRegion\n )\n\n//++\n//\n// Routine Description:\n//\n// Initialize the 1394 hardware and connect it to KD.\n//\n// Arguments:\n//\n// Channel - KD 1394 Channel. Default is channel 0, but can be changed if 1394 is shared.\n//\n// IoRegion - Pointer to the 1394 registers mapped into our address space.\n//\n// Return Value:\n//\n// The 16-bit CRC.\n//\n//--\n\n{\n UINT32 ulVersion;\n UINT8 MajorVersion;\n HC_CONTROL_REGISTER HCControl;\n UINT32 retry;\n LINK_CONTROL_REGISTER LinkControl;\n NODE_ID_REGISTER NodeId;\n BUS_OPTIONS_REGISTER BusOptions;\n CONFIG_ROM_INFO ConfigRomHeader;\n IMMEDIATE_ENTRY CromEntry;\n DIRECTORY_INFO DirInfo;\n PHY_CONTROL_REGISTER PhyControl;\n UINT8 Data;\n volatile OHCI_REGISTER_MAP * Registers;\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"1394: IoRegion: %p\\n\", IoRegion);\n\n#endif\n\n //\n // Note: Kd1394Data must be in the low 32-bits of address space due to\n // limits on valid 1394 DMA addresses. It must also be contiguous.\n // It must be in the low 24-bits of address space to statisfy KD.\n //\n\n Kd1394Data = (DEBUG_1394_DATA *) BlSingularityOhci1394Buffer;\n BlRtlZeroMemory(Kd1394Data, sizeof(*Kd1394Data));\n\n //\n // Get our base address.\n //\n\n Registers = (volatile OHCI_REGISTER_MAP *)IoRegion;\n\n //\n // Initialize our config info for host debugger to read.\n //\n\n Kd1394Data->Config.Tag = DEBUG_1394_CONFIG_TAG;\n Kd1394Data->Config.MajorVersion = DEBUG_1394_MAJOR_VERSION;\n Kd1394Data->Config.MinorVersion = DEBUG_1394_MINOR_VERSION;\n Kd1394Data->Config.Id = Channel;\n Kd1394Data->Config.BusPresent = FALSE;\n Kd1394Data->Config.SendPacket = (UINT64) &Kd1394Data->SendPacket;\n Kd1394Data->Config.ReceivePacket = (UINT64) &Kd1394Data->ReceivePacket;\n\n //\n // Get the transport version.\n //\n\n ulVersion = Registers->Version.all;\n MajorVersion = (UINT8)(ulVersion >> 16);\n\n //\n // Make sure we have a valid version.\n //\n\n if (MajorVersion != 1) { // INVESTIGATE\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"1394: MajorVersion != 1\\n\");\n\n#endif\n\n return FALSE;\n }\n\n //\n // Soft reset to initialize the controller.\n //\n\n HCControl.all = 0;\n HCControl.SoftReset = TRUE;\n Registers->HCControlSet.all = HCControl.all;\n\n //\n // wait until reset completes.\n //\n\n retry = 1000; // ??\n\n do {\n\n HCControl.all = Registers->HCControlSet.all;\n\n BlKd1394StallExecution(1);\n\n } while ((HCControl.SoftReset) && (--retry));\n\n if (retry == 0) {\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"1394: Reset failed\\n\");\n\n#endif\n\n return FALSE;\n }\n\n //\n // Enable link to phy communication.\n //\n\n HCControl.all = 0;\n HCControl.Lps = TRUE;\n Registers->HCControlSet.all = HCControl.all;\n\n BlKd1394StallExecution(20);\n\n //\n // Initialize HCControl register\n // Send data in little-endian order (i.e. do byte swap).\n //\n\n HCControl.all = 0;\n HCControl.NoByteSwapData = TRUE;\n Registers->HCControlClear.all = HCControl.all;\n\n //\n // Enable posted writes.\n //\n\n HCControl.all = 0;\n HCControl.PostedWriteEnable = TRUE;\n Registers->HCControlSet.all = HCControl.all;\n\n //\n // Setup the link control.\n //\n\n LinkControl.all = 0;\n LinkControl.CycleTimerEnable = TRUE;\n LinkControl.CycleMaster = TRUE;\n LinkControl.RcvPhyPkt = TRUE;\n LinkControl.RcvSelfId = TRUE;\n Registers->LinkControlClear.all = LinkControl.all;\n\n LinkControl.all = 0;\n LinkControl.CycleTimerEnable = TRUE;\n LinkControl.CycleMaster = TRUE;\n Registers->LinkControlSet.all = LinkControl.all;\n\n //\n // Set the bus number (hardcoded to 0x3FF) - ??? what about node id??\n //\n\n NodeId.all = 0;\n NodeId.BusId = (UINT16)0x3FF;\n Registers->NodeId.all = NodeId.all;\n\n //\n // Do something with the crom...\n //\n\n //\n // 0xf0000404 - bus id register\n //\n Kd1394Data->CromBuffer[1] = 0x31333934;\n\n //\n // 0xf0000408 - bus options register\n //\n\n BusOptions.all = BlKd1394ByteSwap(Registers->BusOptions.all);\n BusOptions.Pmc = FALSE;\n BusOptions.Bmc = FALSE;\n BusOptions.Isc = FALSE;\n BusOptions.Cmc = FALSE;\n BusOptions.Irmc = FALSE;\n BusOptions.g = 1;\n Kd1394Data->CromBuffer[2] = BlKd1394ByteSwap(BusOptions.all);\n\n //\n // 0xf000040c - global unique id hi\n //\n\n Kd1394Data->CromBuffer[3] = Registers->GuidHi;\n\n //\n // 0xf0000410 - global unique id lo\n //\n\n Kd1394Data->CromBuffer[4] = Registers->GuidLo;\n\n //\n // 0xf0000400 - config ROM header - set last to calculate CRC!\n //\n\n ConfigRomHeader.all = 0;\n ConfigRomHeader.CRI_Info_Length = 4;\n ConfigRomHeader.CRI_CRC_Length = 4;\n ConfigRomHeader.CRI_CRC_Value = BlKd1394CalculateCrc(&Kd1394Data->CromBuffer[1],\n ConfigRomHeader.CRI_CRC_Length);\n Kd1394Data->CromBuffer[0] = ConfigRomHeader.all;\n\n Kd1394Data->CromBuffer[6] = 0xC083000C; // 0xf0000418 - node capabilities\n Kd1394Data->CromBuffer[7] = 0xF2500003; // 0xf000041C - module vendor id\n\n //\n // KD's state machine looks for 1c w/ 50f2, 1d w/ 02, then 1e w/ address.\n //\n\n Kd1394Data->CromBuffer[8] = 0xF250001C; // 0xf0000420 - extended key (for KD)\n Kd1394Data->CromBuffer[9] = 0x0200001D; // 0xf0000424 - debug key (for KD)\n\n //\n // 0xf0000428 - debug value (for KD)\n //\n\n CromEntry.all = (UINT32)(ULONG_PTR) &Kd1394Data->Config;\n CromEntry.IE_Key = 0x1E;\n Kd1394Data->CromBuffer[10] = BlKd1394ByteSwap(CromEntry.all);\n\n //\n // 0xf0000414 - root directory header - set last to calculate CRC!\n //\n\n DirInfo.all = 0;\n DirInfo.DI_Length = 5;\n DirInfo.DI_CRC = BlKd1394CalculateCrc(&Kd1394Data->CromBuffer[6], DirInfo.DI_Length);\n Kd1394Data->CromBuffer[5] = BlKd1394ByteSwap(DirInfo.all);\n\n //\n // Write the first few registers.\n //\n\n Registers->ConfigRomHeader.all = Kd1394Data->CromBuffer[0];\n Registers->BusId = Kd1394Data->CromBuffer[1];\n Registers->BusOptions.all = Kd1394Data->CromBuffer[2];\n Registers->GuidHi = Kd1394Data->CromBuffer[3];\n Registers->GuidLo = Kd1394Data->CromBuffer[4];\n\n //\n // Set our crom.\n //\n\n Registers->ConfigRomMap = (UINT32)(ULONG_PTR) &Kd1394Data->CromBuffer;\n\n //\n // Disable all interrupts, we use polling for the debugger transport.\n //\n\n Registers->IntMaskClear.all = 0xFFFFFFFF;\n\n //\n // Enable the link.\n //\n\n HCControl.all = 0;\n HCControl.LinkEnable = TRUE;\n Registers->HCControlSet.all = HCControl.all;\n\n BlKd1394StallExecution(1000);\n\n //\n // Enable access filters to all nodes.\n //\n\n Registers->AsynchReqFilterLoSet = 0xFFFFFFFF;\n Registers->AsynchReqFilterHiSet = 0xFFFFFFFF;\n Registers->PhyReqFilterHiSet = 0xFFFFFFFF;\n Registers->PhyReqFilterLoSet = 0xFFFFFFFF;\n\n //\n // Hard reset on the bus (so KD will look for us).\n //\n\n PhyControl.all = 0;\n PhyControl.RdReg = TRUE;\n PhyControl.RegAddr = 1;\n Registers->PhyControl.all = PhyControl.all;\n\n retry = MAX_REGISTER_READS;\n\n do {\n\n PhyControl.all = Registers->PhyControl.all;\n\n } while ((!PhyControl.RdDone) && --retry);\n\n if (retry == 0) {\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"1394: Bus read failed.\\n\");\n\n#endif\n\n return FALSE;\n }\n\n Data = ((UINT8)PhyControl.RdData | PHY_INITIATE_BUS_RESET);\n\n PhyControl.all = 0;\n PhyControl.WrReg = TRUE;\n PhyControl.RegAddr = 1;\n PhyControl.WrData = Data;\n Registers->PhyControl.all = PhyControl.all;\n\n retry = MAX_REGISTER_READS;\n\n do {\n\n PhyControl.all = Registers->PhyControl.all;\n\n } while (PhyControl.WrReg && --retry);\n\n if (retry == 0) {\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"1394: Hard reset of bus failed\\n\");\n\n#endif\n\n return FALSE;\n }\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"1394: Hardware init succeeded.\\n\");\n\n#endif\n\n KdRegisters = Registers;\n\n return TRUE;\n}\n\nVOID\nBlKd1394EnablePhysicalAccess(\n VOID\n )\n{\n HC_CONTROL_REGISTER HCControl;\n INT_EVENT_MASK_REGISTER IntEvent;\n\n //\n // See if ohci1394 is being loaded...\n //\n\n HCControl.all = KdRegisters->HCControlSet.all;\n if (!HCControl.LinkEnable || !HCControl.Lps || HCControl.SoftReset) {\n\n KDDBG(\"1394: EnablePhysicalAccess HCControl=%08x!\\n\", HCControl.all);\n\n return;\n }\n\n //\n // If the bus reset interrupt is not cleared, we have to clear it...\n //\n\n IntEvent.all = KdRegisters->IntEventSet.all;\n if (IntEvent.BusReset) {\n\n KDDBG(\"1394: EnablePhysicalAccess IntEvent =%08x!\\n\", IntEvent.all);\n\n IntEvent.all = 0;\n IntEvent.BusReset = 1;\n KdRegisters->IntEventClear.all = IntEvent.all;\n }\n\n //\n // Re-enable physical access as it may be necessary.\n //\n\n KdRegisters->AsynchReqFilterHiSet = 0xFFFFFFFF;\n KdRegisters->AsynchReqFilterLoSet = 0xFFFFFFFF;\n KdRegisters->PhyReqFilterHiSet = 0xFFFFFFFF;\n KdRegisters->PhyReqFilterLoSet = 0xFFFFFFFF;\n\n return;\n}\n\nBOOLEAN\nBlKd1394SendPacket(\n UINT16 PacketType,\n PCVOID Header,\n UINT16 HeaderSize,\n PCVOID Data,\n UINT16 DataSize)\n\n//++\n//\n// Routine Description:\n//\n// This routine sends a packet to the host machine that is running the kernel debugger and\n// waits for an ACK.\n//\n// Arguments:\n//\n// PacketType - Supplies the type of the packet to send.\n//\n// Header - Supplies a pointer to the header.\n//\n// HeaderSize - Supplies the size of the header.\n//\n// Data - Supplies a pointer to the data.\n//\n// DataSize - Supplies the size of the data.\n//\n// Return Value:\n//\n// TRUE, if send operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n KD_PACKET PacketHeader;\n UINT32 Retries;\n UINT32 count;\n volatile UINT32 *pStatus;\n\n KDDBG2(\"BlKd1394SendPacket\\n\");\n\n //\n // Abort if the hardware hasn't been initialized.\n //\n\n if (KdRegisters == NULL) {\n\n return FALSE;\n }\n\n //\n // Initialize the packet header.\n //\n\n PacketHeader.PacketLeader = KD_PACKET_LEADER;\n PacketHeader.ByteCount = HeaderSize + DataSize;\n PacketHeader.PacketType = PacketType;\n PacketHeader.PacketId = BlKdNextPacketId++;\n PacketHeader.Checksum = (BlKdComputeChecksum(Header, HeaderSize) +\n BlKdComputeChecksum(Data, DataSize));\n\n //\n // Setup our send packet.\n //\n\n BlRtlZeroMemory(&Kd1394Data->SendPacket, sizeof(DEBUG_1394_SEND_PACKET));\n Kd1394Data->SendPacket.Length = 0; // Redundant.\n\n //\n // Copy our packet header into the transmit region.\n //\n\n BlRtlCopyMemory(&Kd1394Data->SendPacket.PacketHeader[0], &PacketHeader, sizeof(KD_PACKET));\n\n //\n // Setup our message header.\n //\n\n if (HeaderSize > 0) {\n\n BlRtlCopyMemory(&Kd1394Data->SendPacket.Packet[0], Header, HeaderSize);\n Kd1394Data->SendPacket.Length = HeaderSize;\n }\n\n //\n // Setup our message data.\n //\n\n if (DataSize > 0) {\n\n BlRtlCopyMemory(&Kd1394Data->SendPacket.Packet[Kd1394Data->SendPacket.Length], Data, DataSize);\n Kd1394Data->SendPacket.Length += DataSize;\n }\n\n //\n // Mark the packet as ready for processing by host.\n //\n\n Kd1394Data->SendPacket.TransferStatus = PACKET_PENDING;\n\n //\n // Wait for our packet to be acknowledged by the host.\n //\n\n for (Retries = KD_RETRY_COUNT; Retries > 0; Retries--) {\n\n KDDBG2(\"LOOP %d [SendPacket=%p %08x %08x %08x %02x %02x %02x %02x]\\n\",\n Retries,\n &Kd1394Data->SendPacket,\n Kd1394Data->SendPacket.TransferStatus,\n * (UINT32*) &Kd1394Data->SendPacket.PacketHeader,\n Kd1394Data->SendPacket.Length,\n Kd1394Data->SendPacket.Packet[0],\n Kd1394Data->SendPacket.Packet[1],\n Kd1394Data->SendPacket.Packet[2],\n Kd1394Data->SendPacket.Packet[3]);\n\n //\n // make sure our link is enabled..\n //\n\n BlKd1394EnablePhysicalAccess();\n\n pStatus = &Kd1394Data->ReceivePacket.TransferStatus;\n\n //\n // now sit here and poll for a response from the host machine\n //\n\n for (count = 0; count < TIMEOUT_COUNT; count++) {\n\n //\n // make sure our link is enabled..\n //\n\n BlKd1394EnablePhysicalAccess();\n BlKdSpin();\n\n //\n // Check to see if the host has ACK'd our packet.\n //\n\n if (Kd1394Data->SendPacket.TransferStatus != PACKET_PENDING) {\n return TRUE;\n }\n\n //\n // While in this loop check if the host has submitted a new request.\n // If they did, ACK it, and retry.\n //\n\n if (*pStatus == PACKET_PENDING) {\n\n //\n // ACK the packet from the debugger so it will accept our packet.\n //\n\n *pStatus = PACKET_READY;\n }\n }\n }\n\n return FALSE;\n}\n\nBOOLEAN\nBlKd1394Connect(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function tries to connect to the KD through a COM port.\n//\n// Return Value:\n//\n// TRUE, if connection was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n //\n // Abort if there is no 1394 hardware.\n //\n\n if (BlPciOhci1394BaseAddress == 0) {\n\n return FALSE;\n }\n\n //\n // Initialize the underlying hardware.\n //\n\n if (BlKd1394InitHardware(0, (PVOID)(ULONG_PTR) BlPciOhci1394BaseAddress)) {\n\n KD_DEBUG_IO Packet;\n\n //\n // Send a test packet to verify the debugger is attached.\n //\n\n BlRtlZeroMemory(&Packet, sizeof(Packet));\n\n Packet.ApiNumber = KD_API_PRINT_STRING;\n Packet.u1.PrintString.LengthOfString = 0;\n\n if (BlKd1394SendPacket(KD_PACKET_TYPE_KD_DEBUG_IO, &Packet, sizeof(Packet), L\"1394!\\n\", 7)) {\n\n return TRUE;\n }\n }\n\n BlPciOhci1394BaseAddress = 0;\n\n return FALSE;\n}\n\n#endif // !defined(BOOT_X64)\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blkd1394.h", "content": "//++\n//\n//Copyright (c) Microsoft Corporation\n//\n//Module Name:\n//\n// blkd1394.h\n//\n//Abstract:\n//\n// This module defines 1394 structures.\n//\n//Environment:\n//\n// Boot loader.\n//\n//-- \n\n//\n// Various OHCI definitions\n//\n#define PHY_INITIATE_BUS_RESET 0x40 // IBR @ Address 1\n\n///////////////////////////////////////////////////////// Register Structures.\n//\ntypedef union _VERSION_REGISTER {\n struct {\n UINT32 Revision:8; // bits 0-7\n UINT32 Reserved:8; // bits 8-15\n UINT32 Version:8; // bits 16-23\n UINT32 GUID_ROM:1; // bit 24\n UINT32 Reserved1:7; // bits 25-31\n };\n UINT32 all;\n} VERSION_REGISTER;\nC_ASSERT(sizeof(VERSION_REGISTER) == 4);\n\ntypedef union _VENDOR_ID_REGISTER {\n struct {\n UINT32 VendorCompanyId:24; // bits 0-23\n UINT32 VendorUnique:8; // bits 24-31\n };\n UINT32 all;\n} VENDOR_ID_REGISTER;\nC_ASSERT(sizeof(VENDOR_ID_REGISTER) == 4);\n\ntypedef union _GUID_ROM_REGISTER {\n struct {\n UINT32 Reserved0:16; // bits 0-15\n UINT32 RdData:8; // bits 16-23\n UINT32 Reserved1:1; // bit 24\n UINT32 RdStart:1; // bit 25\n UINT32 Reserved2:5; // bits 26-30\n UINT32 AddrReset:1; // bits 31\n };\n UINT32 all;\n} GUID_ROM_REGISTER;\nC_ASSERT(sizeof(GUID_ROM_REGISTER) == 4);\n\ntypedef union _AT_RETRIES_REGISTER {\n struct {\n UINT32 MaxATReqRetries:4; // bits 0-3\n UINT32 MaxATRespRetries:4; // bits 4-7\n UINT32 MaxPhysRespRetries:4; // bits 8-11\n UINT32 Reserved:4; // bits 12-15\n UINT32 CycleLimit:13; // bits 16-28\n UINT32 SecondLimit:3; // bits 29-31\n };\n UINT32 all;\n} AT_RETRIES_REGISTER;\nC_ASSERT(sizeof(AT_RETRIES_REGISTER) == 4);\n\ntypedef union _CSR_CONTROL_REGISTER {\n struct {\n UINT32 CsrSel:2; // bits 0-1\n UINT32 Reserved:29; // bits 2-30\n UINT32 CsrDone:1; // bit 31\n };\n UINT32 all;\n} CSR_CONTROL_REGISTER;\nC_ASSERT(sizeof(CSR_CONTROL_REGISTER) == 4);\n\ntypedef union _CONFIG_ROM_HEADER_REGISTER {\n struct {\n UINT32 Rom_crc_value:16; // bits 0-15\n UINT32 Crc_length:8; // bits 16-23\n UINT32 Info_length:8; // bits 24-31\n };\n UINT32 all;\n} CONFIG_ROM_HEADER_REGISTER;\nC_ASSERT(sizeof(CONFIG_ROM_HEADER_REGISTER) == 4);\n\ntypedef union _BUS_OPTIONS_REGISTER {\n struct {\n UINT32 Link_spd:3; // bits 0-2\n UINT32 Reserved0:3; // bits 3-5\n UINT32 g:2; // bits 6-7\n UINT32 Reserved1:4; // bits 8-11\n UINT32 Max_rec:4; // bits 12-15\n UINT32 Cyc_clk_acc:8; // bits 16-23\n UINT32 Reserved2:3; // bits 24-26\n UINT32 Pmc:1; // bit 27\n UINT32 Bmc:1; // bit 28\n UINT32 Isc:1; // bit 29\n UINT32 Cmc:1; // bit 30\n UINT32 Irmc:1; // bit 31\n };\n UINT32 all;\n} BUS_OPTIONS_REGISTER;\nC_ASSERT(sizeof(BUS_OPTIONS_REGISTER) == 4);\n\ntypedef union _HC_CONTROL_REGISTER {\n struct {\n UINT32 Reserved:16; // bits 0-15\n UINT32 SoftReset:1; // bit 16\n UINT32 LinkEnable:1; // bit 17\n UINT32 PostedWriteEnable:1; // bit 18\n UINT32 Lps:1; // bit 19\n UINT32 Reserved2:2; // bits 20-21\n UINT32 APhyEnhanceEnable:1; // bit 22\n UINT32 ProgramPhyEnable:1; // bit 23\n UINT32 Reserved3:6; // bits 24-29\n UINT32 NoByteSwapData:1; // bit 30\n UINT32 Reserved4:1; // bit 31\n };\n UINT32 all;\n} HC_CONTROL_REGISTER;\nC_ASSERT(sizeof(HC_CONTROL_REGISTER) == 4);\n\ntypedef union _FAIRNESS_CONTROL_REGISTER {\n struct {\n UINT32 Pri_req:8; // bits 0-7\n UINT32 Reserved0:24; // bits 8-31\n };\n UINT32 all;\n} FAIRNESS_CONTROL_REGISTER;\nC_ASSERT(sizeof(FAIRNESS_CONTROL_REGISTER) == 4);\n\ntypedef union _LINK_CONTROL_REGISTER {\n struct {\n UINT32 Reserved0:4; // bits 0-3\n UINT32 CycleSyncLReqEnable:1; // bit 4\n UINT32 Reserved1:4; // bits 5-8\n UINT32 RcvSelfId:1; // bit 9\n UINT32 RcvPhyPkt:1; // bit 10\n UINT32 Reserved2:9; // bits 11-19\n UINT32 CycleTimerEnable:1; // bit 20\n UINT32 CycleMaster:1; // bit 21\n UINT32 CycleSource:1; // bit 22\n UINT32 Reserved3:9; // bits 23-31\n };\n UINT32 all;\n} LINK_CONTROL_REGISTER;\nC_ASSERT(sizeof(LINK_CONTROL_REGISTER) == 4);\n\ntypedef union _NODE_ID_REGISTER {\n struct {\n UINT32 NodeId:6; // bits 0-5\n UINT32 BusId:10; // bits 6-15\n UINT32 Reserved1:11; // bits 16-26\n UINT32 Cps:1; // bit 27\n UINT32 Reserved2:2; // bits 28-29\n UINT32 Root:1; // bit 30\n UINT32 IdValid:1; // bit 31\n };\n UINT32 all;\n} NODE_ID_REGISTER;\nC_ASSERT(sizeof(NODE_ID_REGISTER) == 4);\n\ntypedef union _SELF_ID_BUFFER_REGISTER {\n UINT32 SelfIdBufferPointer;\n struct {\n UINT32 Reserved0:11; // bits 0-10\n UINT32 SelfIdBuffer:21; // bits 11-32\n };\n UINT32 all;\n} SELF_ID_BUFFER_REGISTER;\nC_ASSERT(sizeof(SELF_ID_BUFFER_REGISTER) == 4);\n\ntypedef union _SELF_ID_COUNT_REGISTER {\n struct {\n UINT32 Reserved0:2; // bits 0-1\n UINT32 SelfIdSize:11; // bits 2-12\n UINT32 Reserved1:3; // bits 13-15\n UINT32 SelfIdGeneration:8; // bits 16-23\n UINT32 Reserved2:7; // bits 24-30\n UINT32 SelfIdError:1; // bit 31\n };\n UINT32 all;\n} SELF_ID_COUNT_REGISTER;\nC_ASSERT(sizeof(SELF_ID_COUNT_REGISTER) == 4);\n\ntypedef union _PHY_CONTROL_REGISTER {\n struct {\n UINT32 WrData:8; // bits 0-7\n UINT32 RegAddr:4; // bits 8-11\n UINT32 Reserved0:2; // bits 12-13\n UINT32 WrReg:1; // bit 14\n UINT32 RdReg:1; // bit 15\n UINT32 RdData:8; // bits 16-23\n UINT32 RdAddr:4; // bits 24-27\n UINT32 Reserved1:3; // bits 28-30\n UINT32 RdDone:1; // bit 31\n };\n UINT32 all;\n} PHY_CONTROL_REGISTER;\nC_ASSERT(sizeof(PHY_CONTROL_REGISTER) == 4);\n\ntypedef union _ISOCH_CYCLE_TIMER_REGISTER {\n struct {\n UINT32 CycleOffset:12; // bits 0-11\n UINT32 CycleCount:13; // bits 12-24\n UINT32 CycleSeconds:7; // bits 25-31\n };\n UINT32 all;\n} ISOCH_CYCLE_TIMER_REGISTER;\nC_ASSERT(sizeof(ISOCH_CYCLE_TIMER_REGISTER) == 4);\n\ntypedef union _INT_EVENT_MASK_REGISTER {\n struct {\n UINT32 ReqTxComplete:1; // bit 0\n UINT32 RspTxComplete:1; // bit 1\n UINT32 ARRQ:1; // bit 2\n UINT32 ARRS:1; // bit 3\n UINT32 RQPkt:1; // bit 4\n UINT32 RSPPkt:1; // bit 5\n UINT32 IsochTx:1; // bit 6\n UINT32 IsochRx:1; // bit 7\n UINT32 PostedWriteErr:1; // bit 8\n UINT32 LockRespErr:1; // bit 9\n UINT32 Reserved0:6; // bits 10-15\n UINT32 SelfIdComplete:1; // bit 16\n UINT32 BusReset:1; // bit 17\n UINT32 Reserved1:1; // bit 18\n UINT32 Phy:1; // bit 19\n UINT32 CycleSynch:1; // bit 20\n UINT32 Cycle64Secs:1; // bit 21\n UINT32 CycleLost:1; // bit 22\n UINT32 CycleInconsistent:1; // bit 23\n UINT32 UnrecoverableError:1; // bit 24\n UINT32 CycleTooLong:1; // bit 25\n UINT32 PhyRegRcvd:1; // bit 26\n UINT32 Reserved2:3; // bits 27-29\n UINT32 VendorSpecific:1; // bit 30\n UINT32 MasterIntEnable:1; // bit 31\n };\n UINT32 all;\n} INT_EVENT_MASK_REGISTER;\nC_ASSERT(sizeof(INT_EVENT_MASK_REGISTER) == 4);\n\ntypedef union _COMMAND_POINTER_REGISTER {\n struct {\n UINT32 Z:4; // bits 0-3\n UINT32 DescriptorAddr:28; // bits 4-31\n };\n UINT32 all;\n} COMMAND_POINTER_REGISTER;\nC_ASSERT(sizeof(COMMAND_POINTER_REGISTER) == 4);\n\ntypedef union _CONTEXT_CONTROL_REGISTER {\n struct {\n UINT32 EventCode:5; // bits 0-4\n UINT32 Spd:3; // bits 5-7\n UINT32 Reserved0:2; // bits 8-9\n UINT32 Active:1; // bit 10\n UINT32 Dead:1; // bit 11\n UINT32 Wake:1; // bit 12\n UINT32 Reserved1:2; // bits 13-14\n UINT32 Run:1; // bit 15\n UINT32 Reserved2:16; // bits 16-31\n };\n UINT32 all;\n} CONTEXT_CONTROL_REGISTER;\nC_ASSERT(sizeof(CONTEXT_CONTROL_REGISTER) == 4);\n\ntypedef union _IT_CONTEXT_CONTROL_REGISTER {\n struct {\n UINT32 EventCode:5; // bits 0-4\n UINT32 Spd:3; // bits 5-7\n UINT32 Reserved0:2; // bits 8-9\n UINT32 Active:1; // bit 10\n UINT32 Dead:1; // bit 11\n UINT32 Wake:1; // bit 12\n UINT32 Reserved1:2; // bits 13-14\n UINT32 Run:1; // bit 15\n UINT32 CycleMatch:15; // bits 16-30\n UINT32 CycleMatchEnable:1; // bit 31\n };\n UINT32 all;\n} IT_CONTEXT_CONTROL_REGISTER;\nC_ASSERT(sizeof(IT_CONTEXT_CONTROL_REGISTER) == 4);\n\ntypedef union _IR_CONTEXT_CONTROL_REGISTER {\n struct {\n UINT32 EventCode:5; // bits 0-4\n UINT32 Spd:3; // bits 5-7\n UINT32 Reserved0:2; // bits 8-9\n UINT32 Active:1; // bit 10\n UINT32 Dead:1; // bit 11\n UINT32 Wake:1; // bit 12\n UINT32 Reserved1:2; // bits 13-14\n UINT32 Run:1; // bit 15\n UINT32 CycleMatch:12; // bits 16-27\n UINT32 MultiChanMode:1; // bit 28\n UINT32 CycleMatchEnable:1; // bit 29\n UINT32 IsochHeader:1; // bit 30\n UINT32 BufferFill:1; // bit 31\n };\n UINT32 all;\n} IR_CONTEXT_CONTROL_REGISTER;\nC_ASSERT(sizeof(IR_CONTEXT_CONTROL_REGISTER) == 4);\n\ntypedef union _CONTEXT_MATCH_REGISTER {\n struct {\n UINT32 ChannelNumber:6; // bits 0-5\n UINT32 Reserved:1; // bit 6\n UINT32 Tag1SyncFilter:1; // bit 7\n UINT32 Sync:4; // bits 8-11\n UINT32 CycleMatch:13; // bits 12-24\n UINT32 Reserved1:3; // bits 25-27\n UINT32 Tag:4; // bit 28-31\n };\n UINT32 all;\n} CONTEXT_MATCH_REGISTER;\nC_ASSERT(sizeof(CONTEXT_MATCH_REGISTER) == 4);\n\n/////////////////////////////////////////////////////////////// Register Sets.\n//\ntypedef struct _DMA_CONTEXT_REGISTERS {\n CONTEXT_CONTROL_REGISTER ContextControlSet;\n CONTEXT_CONTROL_REGISTER ContextControlClear;\n UINT32 Reserved0[1];\n COMMAND_POINTER_REGISTER CommandPtr;\n UINT32 Reserved1[4];\n} DMA_CONTEXT_REGISTERS;\n\ntypedef struct _DMA_ISOCH_RCV_CONTEXT_REGISTERS {\n IR_CONTEXT_CONTROL_REGISTER ContextControlSet;\n IR_CONTEXT_CONTROL_REGISTER ContextControlClear;\n UINT32 Reserved0[1];\n COMMAND_POINTER_REGISTER CommandPtr;\n CONTEXT_MATCH_REGISTER ContextMatch;\n UINT32 Reserved1[3];\n} DMA_ISOCH_RCV_CONTEXT_REGISTERS;\n\ntypedef struct _DMA_ISOCH_XMIT_CONTEXT_REGISTERS {\n IT_CONTEXT_CONTROL_REGISTER ContextControlSet;\n IT_CONTEXT_CONTROL_REGISTER ContextControlClear;\n UINT32 Reserved0[1];\n COMMAND_POINTER_REGISTER CommandPtr;\n} DMA_ISOCH_XMIT_CONTEXT_REGISTERS;\n\ntypedef struct _OHCI_REGISTER_MAP {\n VERSION_REGISTER Version; // @ 0\n GUID_ROM_REGISTER GUID_ROM; // @ 4\n AT_RETRIES_REGISTER ATRetries; // @ 8\n UINT32 CsrData; // @ C\n UINT32 CsrCompare; // @ 10\n CSR_CONTROL_REGISTER CsrControl; // @ 14\n CONFIG_ROM_HEADER_REGISTER ConfigRomHeader; // @ 18\n UINT32 BusId; // @ 1C\n BUS_OPTIONS_REGISTER BusOptions; // @ 20\n UINT32 GuidHi; // @ 24\n UINT32 GuidLo; // @ 28\n UINT32 Reserved0[2]; // @ 2C\n UINT32 ConfigRomMap; // @ 34\n\n UINT32 PostedWriteAddressLo; // @ 38\n UINT32 PostedWriteAddressHi; // @ 3C\n\n VENDOR_ID_REGISTER VendorId; // @ 40\n UINT32 Reserved1[3]; // @ 44\n\n HC_CONTROL_REGISTER HCControlSet; // @ 50\n HC_CONTROL_REGISTER HCControlClear; // @ 54\n\n UINT32 Reserved2[3]; // @ 58\n\n SELF_ID_BUFFER_REGISTER SelfIdBufferPtr; // @ 64\n SELF_ID_COUNT_REGISTER SelfIdCount; // @ 68\n\n UINT32 Reserved3[1]; // @ 6C\n\n UINT32 IRChannelMaskHiSet; // @ 70\n UINT32 IRChannelMaskHiClear; // @ 74\n UINT32 IRChannelMaskLoSet; // @ 78\n UINT32 IRChannelMaskLoClear; // @ 7C\n\n INT_EVENT_MASK_REGISTER IntEventSet; // @ 80\n INT_EVENT_MASK_REGISTER IntEventClear; // @ 84\n\n INT_EVENT_MASK_REGISTER IntMaskSet; // @ 88\n INT_EVENT_MASK_REGISTER IntMaskClear; // @ 8C\n\n UINT32 IsoXmitIntEventSet; // @ 90\n UINT32 IsoXmitIntEventClear; // @ 94\n\n UINT32 IsoXmitIntMaskSet; // @ 98\n UINT32 IsoXmitIntMaskClear; // @ 9C\n\n UINT32 IsoRecvIntEventSet; // @ A0\n UINT32 IsoRecvIntEventClear; // @ A4\n\n UINT32 IsoRecvIntMaskSet; // @ A8\n UINT32 IsoRecvIntMaskClear; // @ AC\n\n UINT32 Reserved4[11]; // @ B0\n\n FAIRNESS_CONTROL_REGISTER FairnessControl; // @ DC\n\n LINK_CONTROL_REGISTER LinkControlSet; // @ E0\n LINK_CONTROL_REGISTER LinkControlClear; // @ E4\n\n NODE_ID_REGISTER NodeId; // @ E8\n PHY_CONTROL_REGISTER PhyControl; // @ EC\n\n ISOCH_CYCLE_TIMER_REGISTER IsochCycleTimer; // @ F0\n\n UINT32 Reserved5[3]; // @ F4\n\n UINT32 AsynchReqFilterHiSet; // @ 100\n UINT32 AsynchReqFilterHiClear; // @ 104\n\n UINT32 AsynchReqFilterLoSet; // @ 108\n UINT32 AsynchReqFilterLoClear; // @ 10C\n\n UINT32 PhyReqFilterHiSet; // @ 110\n UINT32 PhyReqFilterHiClear; // @ 114\n\n UINT32 PhyReqFilterLoSet; // @ 118\n UINT32 PhyReqFilterLoClear; // @ 11C\n\n UINT32 PhysicalUpperBound; // @ 120\n UINT32 Reserved6[23]; // @ 124\n\n DMA_CONTEXT_REGISTERS AsynchContext[4]; // @ 180\n // ATRsp_Context; // @ 1A0\n // ARReq_Context; // @ 1C0\n // ARRsp_Context; // @ 1E0\n\n DMA_ISOCH_XMIT_CONTEXT_REGISTERS IT_Context[32]; // @ 200\n\n DMA_ISOCH_RCV_CONTEXT_REGISTERS IR_Context[32]; // @ 400\n} OHCI_REGISTER_MAP;\nC_ASSERT(sizeof(OHCI_REGISTER_MAP) == 2048);\n\n//\n// IEEE 1212 Configuration Rom header definition\n//\ntypedef union _CONFIG_ROM_INFO {\n struct {\n union {\n UINT16 CRI_CRC_Value:16;\n struct {\n UINT8 CRI_Saved_Info_Length;\n UINT8 CRI_Saved_CRC_Length;\n } Saved;\n };\n UINT8 CRI_CRC_Length;\n UINT8 CRI_Info_Length;\n };\n UINT32 all;\n} CONFIG_ROM_INFO;\nC_ASSERT(sizeof(CONFIG_ROM_INFO) == 4);\n\n//\n// IEEE 1212 Immediate entry definition\n//\ntypedef union _IMMEDIATE_ENTRY {\n struct {\n UINT32 IE_Value:24;\n UINT32 IE_Key:8;\n };\n UINT32 all;\n} IMMEDIATE_ENTRY;\nC_ASSERT(sizeof(IMMEDIATE_ENTRY) == 4);\n\n//\n// IEEE 1212 Directory definition\n//\ntypedef union _DIRECTORY_INFO {\n struct {\n union {\n UINT16 DI_CRC;\n UINT16 DI_Saved_Length;\n };\n UINT16 DI_Length;\n };\n UINT32 all;\n} DIRECTORY_INFO;\nC_ASSERT(sizeof(DIRECTORY_INFO) == 4);\n\n//\n///////////////////////////////////////////////////////////////// End of File.\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blkdcom.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blkdcom.cpp\n//\n// Abstract:\n//\n// This module implements the com port transport for KD.\n//\n//--\n\n#include \"bl.h\"\n\n#define KD_DELAY_LOOP 0x00010000\n\n#define KD_INITIAL_PACKET_ID 0x80800000\n#define KD_SYNC_PACKET_ID 0x00000800\n\n#define KD_PACKET_TRAILING_BYTE 0xAA\n\nstruct {\n KD_PACKET Header;\n UINT8 Data[PAGE_SIZE - sizeof(KD_PACKET)];\n} BlKdStaticPacket;\n\nUINT8 BlKdComPort;\n\nBOOLEAN\nBlKdComReceiveByte(\n PUINT8 Byte\n )\n\n//++\n//\n// Routine Description:\n//\n// This function receives a byte from the KD.\n//\n// Arguments:\n//\n// Byte - Receives the byte from KD.\n//\n// Return Value:\n//\n// TRUE, if receive operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n volatile UINT32 Count;\n\n if (BlKdComPort != 0) {\n\n Count = KD_DELAY_LOOP;\n\n while (Count > 0) {\n\n if (BlComDataAvailable(BlKdComPort) != FALSE) {\n\n *Byte = BlComReceiveByte(BlKdComPort);\n\n return TRUE;\n }\n\n Count -= 1;\n }\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"KD: Receive timeout!\\n\");\n\n#endif\n\n return FALSE;\n }\n\n return FALSE;\n}\n\nBOOLEAN\nBlKdComSendData(\n PCVOID Buffer,\n UINT32 Length\n )\n\n//++\n//\n// Routine Description:\n//\n// This function sends data to the KD.\n//\n// Arguments:\n//\n// Buffer - Supplies a pointer to the buffer to send.\n//\n// Length - Supplies the length of the buffer to send.\n//\n// Return Value:\n//\n// TRUE, if send operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT32 Index;\n\n for (Index = 0; Index < Length; Index += 1) {\n\n if (BlComSendByte(BlKdComPort, ((PUINT8) Buffer)[Index]) == FALSE) {\n\n return FALSE;\n }\n }\n\n return TRUE;\n}\n\nBOOLEAN\nBlKdComReceiveData(\n PVOID Buffer,\n UINT32 Length\n )\n\n//++\n//\n// Routine Description:\n//\n// This function receives data from the KD.\n//\n// Arguments:\n//\n// Buffer - Receives data.\n//\n// Length - Supplies the length of the buffer to receive.\n//\n// Return Value:\n//\n// TRUE, if receive operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT32 Index;\n\n for (Index = 0; Index < Length; Index += 1) {\n\n if (BlKdComReceiveByte(&(((PUINT8) Buffer)[Index])) == FALSE) {\n\n return FALSE;\n }\n }\n\n return TRUE;\n}\n\nBOOLEAN\nBlKdComSendControlPacket(\n UINT16 PacketType,\n UINT32 PacketId\n )\n\n//++\n//\n// Routine Description:\n//\n// This function sends a control packet to the KD.\n//\n// Arguments:\n//\n// PacketType - Supplies the packet type.\n//\n// PacketId - Supplies the packet ID.\n//\n// Return Value:\n//\n// TRUE, if send operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n KD_PACKET Header;\n\n BlRtlZeroMemory(&Header, sizeof(Header));\n\n Header.PacketLeader = KD_CONTROL_PACKET_LEADER;\n Header.PacketType = PacketType;\n Header.PacketId = PacketId;\n\n if (BlKdComSendData(&Header, sizeof(Header)) == FALSE) {\n\n return FALSE;\n }\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"KD: Sent type %u control packet.\\n\", PacketType);\n\n#endif\n\n return TRUE;\n}\n\nBOOLEAN\nBlKdComReceivePacket(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function receives the next packet from the KD.\n//\n// Return Value:\n//\n// TRUE, if receive operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n PKD_PACKET Header;\n UINT8 TrailingByte;\n\n Header = &BlKdStaticPacket.Header;\n\nRetry:\n\n for (;;) {\n\n if (BlKdComReceiveData(&Header->PacketLeader, sizeof(Header->PacketLeader)) == FALSE) {\n\n return FALSE;\n }\n\n if (Header->PacketLeader == KD_PACKET_LEADER) {\n\n break;\n }\n\n if (Header->PacketLeader == KD_CONTROL_PACKET_LEADER) {\n\n break;\n }\n }\n\n if (BlKdComReceiveData(&Header->PacketType, sizeof(Header->PacketType)) == FALSE) {\n\n return FALSE;\n }\n\n if (BlKdComReceiveData(&Header->ByteCount, sizeof(Header->ByteCount)) == FALSE) {\n\n return FALSE;\n }\n\n if (BlKdComReceiveData(&Header->PacketId, sizeof(Header->PacketId)) == FALSE) {\n\n return FALSE;\n }\n\n if (BlKdComReceiveData(&Header->Checksum, sizeof(Header->Checksum)) == FALSE) {\n\n return FALSE;\n }\n\n if (Header->ByteCount > sizeof(BlKdStaticPacket.Data)) {\n\n goto Retry;\n }\n\n if (Header->ByteCount > 0) {\n\n if (BlKdComReceiveData(BlKdStaticPacket.Data, Header->ByteCount) == FALSE) {\n\n return FALSE;\n }\n\n if (BlKdComReceiveByte(&TrailingByte) == FALSE) {\n\n return FALSE;\n }\n\n if (TrailingByte != KD_PACKET_TRAILING_BYTE) {\n\n goto Retry;\n }\n }\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"KD: Received type %u packet.\\n\", Header->PacketType);\n\n#endif\n\n return TRUE;\n}\n\nBOOLEAN\nBlKdComSendPacket(\n UINT16 PacketType,\n PCVOID Header,\n UINT16 HeaderSize,\n PCVOID Data,\n UINT16 DataSize\n )\n\n//++\n//\n// Routine Description:\n//\n// This function sends a packet to the KD.\n//\n// Arguments:\n//\n// PacketType - Supplies the type of the packet to send.\n//\n// Header - Supplies a pointer to the header.\n//\n// HeaderSize - Supplies the size of the header.\n//\n// Data - Supplies a pointer to the data.\n//\n// DataSize - Supplies the size of the data.\n//\n// Return Value:\n//\n// TRUE, if send operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT16 ByteCount;\n UINT32 Checksum;\n KD_PACKET Packet;\n\n BLASSERT(HeaderSize > 0);\n\nResend:\n\n //\n // Calculate byte count and checksum.\n //\n\n ByteCount = HeaderSize;\n Checksum = BlKdComputeChecksum(Header, HeaderSize);\n\n if (Data != NULL) {\n\n BLASSERT(DataSize > 0);\n\n ByteCount = ByteCount + DataSize;\n Checksum += BlKdComputeChecksum(Data, DataSize);\n }\n\n //\n // Send packet.\n //\n\n Packet.PacketLeader = KD_PACKET_LEADER;\n Packet.PacketId = BlKdNextPacketId;\n Packet.PacketType = PacketType;\n Packet.ByteCount = ByteCount;\n Packet.Checksum = Checksum;\n\n if (BlKdComSendData(&Packet, sizeof(Packet)) == FALSE) {\n\n return FALSE;\n }\n\n if (BlKdComSendData(Header, HeaderSize) == FALSE) {\n\n return FALSE;\n }\n\n if (Data != NULL) {\n\n if (BlKdComSendData(Data, DataSize) == FALSE) {\n\n return FALSE;\n }\n }\n\n if (BlComSendByte(BlKdComPort, KD_PACKET_TRAILING_BYTE) == FALSE) {\n\n return FALSE;\n }\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"KD: Sent type %u packet.\\n\", Packet.PacketType);\n\n#endif\n\n //\n // Update packet ID.\n //\n\n BlKdNextPacketId &= (~KD_SYNC_PACKET_ID);\n BlKdNextPacketId ^= 1;\n\n if (BlKdComReceivePacket() != FALSE) {\n\n switch (BlKdStaticPacket.Header.PacketType) {\n\n case KD_PACKET_TYPE_KD_RESET: {\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"KD: Received RESET after send.\\n\");\n\n#endif\n\n BlKdComSendControlPacket(KD_PACKET_TYPE_KD_RESET, 0);\n\n goto Resend;\n }\n\n case KD_PACKET_TYPE_KD_RESEND: {\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"KD: Received RESEND after send.\\n\");\n\n#endif\n\n goto Resend;\n }\n }\n }\n\n return TRUE;\n}\n\nBOOLEAN\nBlKdComConnect(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function tries to connect to the KD through a COM port.\n//\n// Return Value:\n//\n// TRUE, if connection was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT8 Index;\n BOOLEAN Present[COM_MAX_PORT + 1];\n UINT32 Retry;\n\n\n //\n // Find all COM ports on the system.\n //\n\n for (Index = 1; Index <= COM_MAX_PORT; Index += 1) {\n\n Present[Index] = BlComInitialize(Index, 115200);\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"KD: COM%u %s\\n\",\n Index,\n Present[Index] ? \"found.\" : \"not found.\");\n\n#endif\n\n }\n\n //\n // Set initial packet ID.\n //\n\n BlKdNextPacketId = KD_INITIAL_PACKET_ID | KD_SYNC_PACKET_ID;\n\n for (Retry = 0; Retry < KD_RETRY_COUNT; Retry += 1) {\n\n for (Index = 1; Index <= COM_MAX_PORT; Index += 1) {\n\n if (Present[Index] != FALSE) {\n\n#if KD_VERBOSE\n\n BlVideoPrintf(\"KD: Trying COM%u ...\\n\", Index);\n\n#endif\n\n BlKdComPort = Index;\n\n BlKdComSendControlPacket(KD_PACKET_TYPE_KD_RESET, 0);\n\n if (BlKdComReceivePacket() != FALSE) {\n\n return TRUE;\n }\n }\n }\n }\n\n BlKdComPort = 0;\n\n return FALSE;\n}\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blmm.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blmm.cpp\n//\n// Abstract:\n//\n// This module implements memory management for the boot loader.\n//\n//--\n\n#include \"bl.h\"\n\nLIST_ENTRY BlMmPhysicalRegionList;\n\nstruct {\n BL_MM_PHYSICAL_REGION StaticArray[16];\n LIST_ENTRY FreeList;\n} BlMmPhysicalRegionLookaside;\n\nGDTR BlMmInitialGdtr;\n\nULONG_PTR BlMmLegacyCr3;\nULONG_PTR BlMmBootCr3;\n\ntypedef struct _BL_MM_PAGE_TABLE {\n UINT64 Entry[512];\n} BL_MM_PAGE_TABLE, *PBL_MM_PAGE_TABLE;\n\n#if defined(BOOT_X64)\n\n__declspec(align(PAGE_SIZE)) BL_MM_PAGE_TABLE BlMmPml4Table[1];\n\n#endif\n\n__declspec(align(PAGE_SIZE)) BL_MM_PAGE_TABLE BlMmPdpTable[1];\n__declspec(align(PAGE_SIZE)) BL_MM_PAGE_TABLE BlMmPdTable[4];\n__declspec(align(PAGE_SIZE)) BL_MM_PAGE_TABLE BlMmPgTable[1];\n\nPVOID BlMmExtendedBiosDataArea;\n\nVOID\nBlMmCompactPhysicalRegionList(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function compacts the physical region list by coalescing adjacent\n// regions of the same type.\n//\n//--\n\n{\n PBL_MM_PHYSICAL_REGION Current;\n PLIST_ENTRY Head;\n PBL_MM_PHYSICAL_REGION Next;\n\n Head = &BlMmPhysicalRegionList;\n\n if (BlRtlIsListEmpty(Head) != FALSE) {\n\n return;\n }\n\n Current = CONTAINING_RECORD(Head->Flink,\n BL_MM_PHYSICAL_REGION,\n Entry);\n\n for (;;) {\n\n BLASSERT(Current->Size > 0);\n\n BLASSERT(Current->Start + Current->Size == Current->Limit);\n\n BLASSERT((Current->Type >= BL_MM_PHYSICAL_REGION_MIN_TYPE) && (Current->Type <= BL_MM_PHYSICAL_REGION_MAX_TYPE));\n\n if (Current->Entry.Flink == Head) {\n\n break;\n }\n\n Next = CONTAINING_RECORD(Current->Entry.Flink,\n BL_MM_PHYSICAL_REGION,\n Entry);\n\n BLASSERT(Next->Start >= Current->Limit);\n\n if ((Next->Start == Current->Limit) &&\n (Next->Type == Current->Type)) {\n\n Current->Limit = Next->Limit;\n Current->Size = Current->Limit - Current->Start;\n\n BlRtlRemoveEntryList(&Next->Entry);\n\n BlRtlInsertTailList(&BlMmPhysicalRegionLookaside.FreeList, &Next->Entry);\n\n continue;\n }\n\n Current = Next;\n }\n}\n\nVOID\nBlMmInsertPhysicalRegion(\n PBL_MM_PHYSICAL_REGION Region\n )\n\n//++\n//\n// Routine Description:\n//\n// This function inserts a new physical region to the physical region list.\n//\n// Arguments:\n//\n// Region - Supplies a pointer to the region to insert.\n//\n//--\n\n{\n PLIST_ENTRY Entry;\n PLIST_ENTRY Head;\n PBL_MM_PHYSICAL_REGION Next;\n\n Head = &BlMmPhysicalRegionList;\n Entry = Head->Flink;\n\n while (Entry != Head) {\n\n Next = CONTAINING_RECORD(Entry,\n BL_MM_PHYSICAL_REGION,\n Entry);\n\n if (Next->Start > Region->Start) {\n\n break;\n }\n\n Entry = Entry->Flink;\n }\n\n BlRtlInsertTailList(Entry, &Region->Entry);\n\n BlMmCompactPhysicalRegionList();\n\n return;\n}\n\nVOID\nBlMmCreatePhysicalRegion(\n UINT64 Start,\n UINT64 Size,\n UINT32 Type\n )\n\n//++\n//\n// Routine Description:\n//\n// This function creates a physical region descriptor.\n//\n// Arguments:\n//\n// Start - Supplies the start address of the region.\n//\n// Size - Supplies the size of the region.\n//\n// Type - Supplies the type of the region.\n//\n//--\n\n{\n PLIST_ENTRY Entry;\n PLIST_ENTRY Head;\n UINT64 Limit;\n PBL_MM_PHYSICAL_REGION Region;\n\n BLASSERT((Start % PAGE_SIZE) == 0);\n BLASSERT(Size > 0);\n BLASSERT((Size % PAGE_SIZE) == 0);\n BLASSERT(Type >= BL_MM_PHYSICAL_REGION_MIN_TYPE);\n BLASSERT(Type <= BL_MM_PHYSICAL_REGION_MAX_TYPE);\n\n Limit = Start + Size;\n\n BLASSERT(Limit > Start);\n\n Head = &BlMmPhysicalRegionList;\n Entry = Head->Flink;\n\n while (Entry != Head) {\n\n Region = CONTAINING_RECORD(Entry,\n BL_MM_PHYSICAL_REGION,\n Entry);\n\n if ((Start < Region->Limit) && (Limit > Region->Start)) {\n\n BlRtlPrintf(\"MM: Physical region collision!\\n\");\n BlRtlHalt();\n }\n\n Entry = Entry->Flink;\n }\n\n Entry = Head->Flink;\n\n while (Entry != Head) {\n\n Region = CONTAINING_RECORD(Entry,\n BL_MM_PHYSICAL_REGION,\n Entry);\n\n if (Start < Region->Start) {\n\n break;\n }\n\n Entry = Entry->Flink;\n }\n\n BLASSERT(BlRtlIsListEmpty(&BlMmPhysicalRegionLookaside.FreeList) == FALSE);\n\n Region = CONTAINING_RECORD(BlRtlRemoveHeadList(&BlMmPhysicalRegionLookaside.FreeList),\n BL_MM_PHYSICAL_REGION,\n Entry);\n\n Region->Start = Start;\n Region->Size = Size;\n Region->Limit = Limit;\n Region->Type = Type;\n\n BlMmInsertPhysicalRegion(Region);\n\n return;\n}\n\nUINT64\nBlMmAllocatePhysicalRegion(\n UINT32 Size,\n UINT32 Type\n )\n\n//++\n//\n// Routine Description:\n//\n// This function allocates a physical region from the lowest available and\n// sufficient free region.\n//\n// Arguments:\n//\n// Size - Supplies the size of the region to allocate.\n//\n// Type - Supplies the type of the region to allocate.\n//\n// Return Value:\n//\n// The physical address of the allocated region.\n//\n//--\n\n{\n PLIST_ENTRY Entry;\n PBL_MM_PHYSICAL_REGION FreeRegion;\n PLIST_ENTRY Head;\n PBL_MM_PHYSICAL_REGION Region;\n\n BLASSERT(Size > 0);\n BLASSERT(Type != BL_MM_PHYSICAL_REGION_FREE);\n\n SATISFY_OVERZEALOUS_COMPILER(Region = NULL);\n\n Size = ROUND_UP_TO_PAGES(Size);\n\n Head = &BlMmPhysicalRegionList;\n Entry = Head->Blink;\n\n while (Entry != Head) {\n\n Region = CONTAINING_RECORD(Entry,\n BL_MM_PHYSICAL_REGION,\n Entry);\n\n if ((Region->Type == BL_MM_PHYSICAL_REGION_FREE) &&\n (Region->Size >= Size) &&\n (Region->Limit < 0x100000000UI64)) {\n\n break;\n }\n\n Entry = Entry->Blink;\n }\n\n if (Entry == Head) {\n\n BlRtlPrintf(\"MM: Unable to allocate %x bytes!\\n\", Size);\n BlRtlHalt();\n }\n\n if (Region->Size == Size) {\n\n Region->Type = Type;\n return Region->Start;\n }\n\n FreeRegion = Region;\n\n BLASSERT(BlRtlIsListEmpty(&BlMmPhysicalRegionLookaside.FreeList) == FALSE);\n\n Region = CONTAINING_RECORD(BlRtlRemoveHeadList(&BlMmPhysicalRegionLookaside.FreeList),\n BL_MM_PHYSICAL_REGION,\n Entry);\n\n Region->Start = FreeRegion->Limit - Size;\n FreeRegion->Limit -= Size;\n FreeRegion->Size -= Size;\n\n Region->Size = Size;\n Region->Limit = Region->Start + Region->Size;\n Region->Type = Type;\n\n BlRtlZeroMemory((PVOID) (ULONG_PTR) Region->Start, (ULONG_PTR) (UINT32) Region->Size);\n\n BlMmInsertPhysicalRegion(Region);\n\n return Region->Start;\n}\n\nBOOLEAN\nBlMmAllocateSpecificPhysicalRegion(\n UINT64 Base,\n UINT64 Size,\n UINT32 Type\n )\n\n//++\n//\n// Routine Description:\n//\n// This function allocates a specific physical region.\n//\n// Arguments:\n//\n// Base - Supplies the base physical address of the region to allocate.\n//\n// Size - Supplies the size of the region to allocate.\n//\n// Type - Supplies the type of the region to allocate.\n//\n// Return Value:\n//\n// TRUE, if allocation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT64 End;\n PLIST_ENTRY Entry;\n PLIST_ENTRY Head;\n PBL_MM_PHYSICAL_REGION NextRegion;\n PBL_MM_PHYSICAL_REGION PreviousRegion;\n PBL_MM_PHYSICAL_REGION Region;\n UINT64 Start;\n\n BLASSERT((Base % PAGE_SIZE) == 0);\n\n BLASSERT(Size > 0);\n\n BLASSERT((Size % PAGE_SIZE) == 0);\n\n BLASSERT(Type != BL_MM_PHYSICAL_REGION_FREE);\n\n SATISFY_OVERZEALOUS_COMPILER(Region = NULL);\n\n Start = Base;\n End = Start + Size;\n\n Head = &BlMmPhysicalRegionList;\n\n for (Entry = Head->Flink; Entry != Head; Entry = Entry->Flink) {\n\n Region = CONTAINING_RECORD(Entry,\n BL_MM_PHYSICAL_REGION,\n Entry);\n\n if ((Start >= Region->Start) && (End <= Region->Limit)) {\n\n break;\n }\n }\n\n if (Entry == Head) {\n\n return FALSE;\n }\n\n if (Region->Type != BL_MM_PHYSICAL_REGION_FREE) {\n\n return FALSE;\n }\n\n PreviousRegion = NULL;\n NextRegion = NULL;\n\n if (Region->Start < Start) {\n\n BLASSERT(BlRtlIsListEmpty(&BlMmPhysicalRegionLookaside.FreeList) == FALSE);\n\n PreviousRegion = CONTAINING_RECORD(BlRtlRemoveHeadList(&BlMmPhysicalRegionLookaside.FreeList),\n BL_MM_PHYSICAL_REGION,\n Entry);\n\n PreviousRegion->Start = Region->Start;\n PreviousRegion->Size = Start - Region->Start;\n PreviousRegion->Limit = Start;\n PreviousRegion->Type = BL_MM_PHYSICAL_REGION_FREE;\n }\n\n if (Region->Limit > End) {\n\n BLASSERT(BlRtlIsListEmpty(&BlMmPhysicalRegionLookaside.FreeList) == FALSE);\n\n NextRegion = CONTAINING_RECORD(BlRtlRemoveHeadList(&BlMmPhysicalRegionLookaside.FreeList),\n BL_MM_PHYSICAL_REGION,\n Entry);\n\n NextRegion->Start = End;\n NextRegion->Size = Region->Limit - End;\n NextRegion->Limit = Region->Limit;\n NextRegion->Type = BL_MM_PHYSICAL_REGION_FREE;\n }\n\n Region->Start = Start;\n Region->Size = Size;\n Region->Limit = End;\n Region->Type = Type;\n\n if (PreviousRegion != NULL) {\n\n BlMmInsertPhysicalRegion(PreviousRegion);\n }\n\n if (NextRegion != NULL) {\n\n BlMmInsertPhysicalRegion(NextRegion);\n }\n\n return TRUE;\n}\n\nBOOLEAN\nBlMmFindFreePhysicalRegion(\n PUINT64 Base,\n PUINT64 Size\n )\n\n//++\n//\n// Routine Description:\n//\n// This function finds a free physical region.\n//\n// Arguments:\n//\n// Base - Receives the base address of the free region.\n//\n// Size - Receives the size of the free region.\n//\n// Return Value:\n//\n// TRUE, if a free region was found.\n// FALSE, otherwise.\n//\n//--\n\n{\n PLIST_ENTRY Entry;\n PLIST_ENTRY Head;\n PBL_MM_PHYSICAL_REGION Region;\n\n Head = &BlMmPhysicalRegionList;\n\n for (Entry = Head->Flink; Entry != Head; Entry = Entry->Flink) {\n\n Region = CONTAINING_RECORD(Entry,\n BL_MM_PHYSICAL_REGION,\n Entry);\n\n if (Region->Type == BL_MM_PHYSICAL_REGION_FREE) {\n\n *Base = Region->Start;\n *Size = Region->Size;\n return TRUE;\n }\n }\n\n return FALSE;\n}\n\nBOOLEAN\nBlMmGetNextPhysicalRegion(\n PVOID *Handle,\n PUINT64 Base,\n PUINT64 Size,\n PUINT32 Type\n )\n\n//++\n//\n// Routine Description:\n//\n// This function is used to enumerate physical regions.\n//\n// Arguments:\n//\n// Handle - Supplies a pointer to the last handle (or NULL to start\n// enumeration) on entry.\n// Receives the next handle (if any) on exit.\n//\n// Base - Receives the base address of the next region.\n//\n// Size - Receives the size of the next region.\n//\n// Type - Receives the type of the next region.\n//\n// Return Value:\n//\n// TRUE, if there is a next region.\n// FALSE, otherwise.\n//\n//--\n\n{\n PLIST_ENTRY Entry;\n PLIST_ENTRY Head;\n PBL_MM_PHYSICAL_REGION Region;\n\n Head = &BlMmPhysicalRegionList;\n\n if (*Handle == NULL) {\n\n Entry = Head;\n\n } else {\n\n Entry = (PLIST_ENTRY) *Handle;\n }\n\n Entry = Entry->Flink;\n\n if (Entry == Head) {\n\n return FALSE;\n }\n\n Region = CONTAINING_RECORD(Entry,\n BL_MM_PHYSICAL_REGION,\n Entry);\n\n *Handle = &Region->Entry;\n *Base = Region->Start;\n *Size = Region->Size;\n *Type = Region->Type;\n\n return TRUE;\n}\n\nPCHAR\nBlMmPhysicalRegionTypeString(\n UINT32 Type\n )\n\n//++\n//\n// Routine Description:\n//\n// This function returns the specified physical region type string.\n//\n// Arguments:\n//\n// Type - Supplies the physical region type.\n//\n// Return Value:\n//\n// String representation for the specified type.\n//\n//--\n\n{\n\n#define CASE(X) case BL_MM_PHYSICAL_REGION_##X: return #X;\n\n switch (Type) {\n\n CASE(FREE)\n CASE(BIOS)\n CASE(BOOT_LOADER)\n CASE(SMAP_RESERVED)\n CASE(DISTRO)\n CASE(KERNEL_IMAGE)\n CASE(NATIVE_PLATFORM)\n CASE(NATIVE_PROCESSOR)\n CASE(LOG_RECORD)\n CASE(LOG_TEXT)\n CASE(KERNEL_STACK)\n CASE(CONTEXT)\n CASE(TASK)\n CASE(SINGULARITY)\n CASE(BOOT_STACK)\n CASE(SINGULARITY_SMAP)\n }\n\n#undef CASE\n\n BLASSERT(FALSE);\n return NULL;\n}\n\nVOID\nBlMmDumpPhysicalRegionList(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function dumps the list of physical regions.\n//\n//--\n\n{\n PLIST_ENTRY Entry;\n PLIST_ENTRY Head;\n PBL_MM_PHYSICAL_REGION Region;\n\n BlRtlPrintf(\"MM: Physical Region:\\n\");\n\n Head = &BlMmPhysicalRegionList;\n\n for (Entry = Head->Flink; Entry != Head; Entry = Entry->Flink) {\n\n Region = CONTAINING_RECORD(Entry, BL_MM_PHYSICAL_REGION, Entry);\n\n BlRtlPrintf(\"MM: %016I64x...%016I64x %s\\n\",\n Region->Start,\n Region->Limit,\n BlMmPhysicalRegionTypeString(Region->Type));\n }\n\n BlRtlPrintf(\"\\n\");\n\n return;\n}\n\n//\n// AIFIX: Switch from identity mapping to dynamic mapping.\n//\n\nVOID\nBlMmInitializePageTables(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes boot loader page tables that identity map the first 4GB of memory.\n//\n//--\n\n{\n UINT64 Index;\n UINT64 *Pde;\n UINT64 PdtBase;\n UINT64 *Pdpe;\n UINT64 PdptBase;\n\n#if defined(BOOT_X64)\n\n UINT64 *Pml4e;\n UINT64 Pml4tBase;\n\n#endif\n\n UINT64 *Pte;\n UINT64 PtBase;\n\n#if defined(BOOT_X64)\n\n Pml4tBase = (UINT64) (ULONG_PTR) BlMmPml4Table;\n\n#endif\n\n PdptBase = (UINT64) (ULONG_PTR) BlMmPdpTable;\n PdtBase = (UINT64) (ULONG_PTR) BlMmPdTable;\n PtBase = (UINT64) (ULONG_PTR) BlMmPgTable;\n\n#if defined(BOOT_X64)\n\n Pml4e = (UINT64 *) (PVOID) Pml4tBase;\n\n#endif\n\n Pdpe = (UINT64 *) (PVOID) (ULONG_PTR) PdptBase;\n Pde = (UINT64 *) (PVOID) (ULONG_PTR) PdtBase;\n Pte = (UINT64 *) (PVOID) (ULONG_PTR) PtBase;\n\n#if defined(BOOT_X64)\n\n Pml4e[0] = PdptBase | PAGE_PRESENT | PAGE_WRITEABLE | PAGE_ACCESSED;\n\n#endif\n\n for (Index = 0; Index < 4; Index += 1) {\n\n Pdpe[Index] = (PdtBase + (Index * PAGE_SIZE)) | PAGE_PRESENT;\n\n#if defined(BOOT_X64)\n\n Pdpe[Index] |= PAGE_WRITEABLE | PAGE_ACCESSED;\n\n#endif\n\n }\n\n Pde[0] = PtBase | PAGE_PRESENT | PAGE_WRITEABLE | PAGE_ACCESSED;\n\n for (Index = 1; Index < 512; Index += 1) {\n\n Pte[Index] = (Index << 12) | PAGE_PRESENT | PAGE_WRITEABLE | PAGE_ACCESSED;\n }\n\n for (Index = 1; Index < 2048; Index += 1) {\n\n Pde[Index] = (Index << 21) | PAGE_PRESENT | PAGE_WRITEABLE | PAGE_ACCESSED | PAGE_2MB;\n }\n\n#if defined(BOOT_X86)\n\n BlMmBootCr3 = (ULONG_PTR) PdptBase;\n\n#elif defined(BOOT_X64)\n\n BlMmBootCr3 = Pml4tBase;\n\n#endif\n\n BlMmSetCr3(BlMmBootCr3);\n\n BlGetBeb()->LegacyReturnCr3 = (UINT32) BlMmBootCr3;\n\n#if MM_VERBOSE\n\n BlRtlPrintf(\"MM: 4GB identity map [CR3=%p]\\n\", BlMmBootCr3);\n\n#endif\n\n return;\n}\n\nVOID\nBlMmMapVirtualPage(\n PVOID VirtualAddress,\n PVOID PhysicalAddress,\n BOOLEAN Writeable,\n BOOLEAN Cacheable,\n BOOLEAN WriteThrough\n )\n\n//++\n//\n// Routine Description:\n//\n// This function maps the specified virtual page.\n//\n// Arguments:\n//\n// VirtualAddress - Supplies the virtual address to map.\n//\n// PhysicalAddress - Supplies the physical address to map to.\n//\n// Writeable - Supplies whether the page is writeable.\n//\n// Cacheable - Supplies whether the page is cacheable.\n//\n// WriteThrough - Supplies whether the page is write-through.\n//\n//--\n\n{\n UINT64 Entry;\n UINT32 Index;\n UINT64 LargePageAddress;\n PUINT64 PdBase;\n UINT32 PdIndex;\n PUINT64 PdpBase;\n UINT32 PdpIndex;\n UINT64 PhysicalPageNumber;\n PUINT64 PtBase;\n UINT32 PtIndex;\n ULONG_PTR VirtualPageNumber;\n\n BLASSERT((((ULONG_PTR) VirtualAddress) & 0xFFF) == 0);\n\n BLASSERT((((ULONG_PTR) PhysicalAddress) & 0xFFF) == 0);\n\n#if defined(BOOT_X64)\n\n BLASSERT((ULONG_PTR) VirtualAddress < 0x100000000UI64);\n\n#endif\n\n //\n // Compute virtual page number, page directory pointer, page directory, and page table indices.\n //\n\n VirtualPageNumber = ((ULONG_PTR) VirtualAddress) / PAGE_SIZE;\n\n PdpIndex = (UINT32) ((VirtualPageNumber >> 18) & 0x1FF);\n PdIndex = (UINT32) ((VirtualPageNumber >> 9) & 0x1FF);\n PtIndex = (UINT32) (VirtualPageNumber & 0x1FF);\n\n //\n // Look up page directory base address.\n //\n\n PdpBase = &BlMmPdpTable[0].Entry[0];\n\n PdBase = (PUINT64) (ULONG_PTR) (PdpBase[PdpIndex] & (~(0xFFFUI64)));\n\n //\n // If the specified page is currently being mapped with large pages, then split it into 4K mappings.\n //\n\n if ((PdBase[PdIndex] & PAGE_2MB) != 0) {\n\n PtBase = (PUINT64) (ULONG_PTR) BlMmAllocatePhysicalRegion(PAGE_SIZE, BL_MM_PHYSICAL_REGION_BOOT_LOADER);\n\n LargePageAddress = (PdBase[PdIndex] & (~(0xFFFUI64)));\n\n BLASSERT(((LargePageAddress >> 12) & 0x1FF) == 0);\n\n //\n // Create page table entries to map the region in 4K pages.\n //\n\n for (Index = 0; Index < 512; Index += 1) {\n\n PtBase[Index] = (LargePageAddress + (Index * PAGE_SIZE)) | PAGE_PRESENT | PAGE_WRITEABLE | PAGE_ACCESSED;\n }\n\n //\n // Update page directory entry.\n //\n\n PdBase[PdIndex] = ((UINT64) (ULONG_PTR) PtBase) | PAGE_PRESENT | PAGE_WRITEABLE | PAGE_ACCESSED;\n\n //\n // Flush TLB.\n //\n\n BlMmSetCr3(BlMmBootCr3);\n }\n\n //\n // Update page mapping.\n //\n\n PtBase = (PUINT64) (ULONG_PTR) (PdBase[PdIndex] & (~(0xFFFUI64)));\n\n PhysicalPageNumber = ((ULONG_PTR) PhysicalAddress) >> 12;\n\n Entry = (PhysicalPageNumber << 12) | PAGE_PRESENT;\n\n if (Writeable != FALSE) {\n\n Entry |= PAGE_WRITEABLE;\n }\n\n if (Cacheable == FALSE) {\n\n Entry |= PAGE_CACHEDISABLE;\n\n } else if (WriteThrough != FALSE) {\n\n Entry |= PAGE_WRITETHROUGH;\n }\n\n PtBase[PtIndex] = Entry;\n\n //\n // Flush TLB.\n //\n\n BlMmSetCr3(BlMmBootCr3);\n\n return;\n}\n\nVOID\nBlMmMapVirtualRange(\n PVOID VirtualAddress,\n PVOID PhysicalAddress,\n ULONG_PTR Size,\n BOOLEAN Writeable,\n BOOLEAN Cacheable,\n BOOLEAN WriteThrough\n )\n\n//++\n//\n// Routine Description:\n//\n// This function maps the specified virtual range.\n//\n// Arguments:\n//\n// VirtualAddress - Supplies the virtual address to map.\n//\n// PhysicalAddress - Supplies the physical address to map to.\n//\n// Size - Supplies the size of the mapping.\n//\n// Writeable - Supplies whether the page is writeable.\n//\n// Cacheable - Supplies whether the page is cacheable.\n//\n// WriteThrough - Supplies whether the page is write-through.\n//\n//--\n\n{\n ULONG_PTR PhysicalNext;\n ULONG_PTR VirtualLimit;\n ULONG_PTR VirtualNext;\n\n VirtualNext = (ULONG_PTR) VirtualAddress;\n VirtualLimit = VirtualNext + Size;\n\n VirtualNext &= (~((ULONG_PTR) 0xFFF));\n VirtualLimit = ROUND_UP_TO_PAGES(VirtualLimit);\n\n PhysicalNext = (ULONG_PTR) PhysicalAddress;\n PhysicalNext &= (~((ULONG_PTR) 0xFFF));\n\n while (VirtualNext < VirtualLimit) {\n\n BlMmMapVirtualPage((PVOID) VirtualNext,\n (PVOID) PhysicalNext,\n Writeable,\n Cacheable,\n WriteThrough);\n\n VirtualNext += PAGE_SIZE;\n PhysicalNext += PAGE_SIZE;\n }\n\n return;\n}\n\nVOID\nBlMmInitializeCodeSegment(\n PCODE_SEGMENT CodeSegment\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes the specified code segment.\n//\n// Arguments:\n//\n// CodeSegment - Supplies a pointer to the code segment to initialize.\n//\n//--\n\n{\n BlRtlZeroMemory(CodeSegment, sizeof(CODE_SEGMENT));\n\n CodeSegment->Accessed = 1;\n CodeSegment->Readable = 1;\n CodeSegment->Code = 1;\n CodeSegment->S = 1;\n CodeSegment->Present = 1;\n CodeSegment->Long = 1;\n\n return;\n}\n\nVOID\nBlMmInitializeDataSegment(\n PDATA_SEGMENT DataSegment,\n UINT32 Base,\n UINT32 Limit\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes the specified data segment.\n//\n// Arguments:\n//\n// DataSegment - Supplies a pointer to the data segment to initialize.\n//\n// Base - Supplies the base address of the data segment.\n//\n// Limit - Supplies the limit of the data segment.\n//\n//--\n\n{\n BlRtlZeroMemory(DataSegment, sizeof(DATA_SEGMENT));\n\n DataSegment->Accessed = 1;\n DataSegment->Writable = 1;\n DataSegment->S = 1;\n DataSegment->Present = 1;\n DataSegment->Big = 1;\n\n DataSegment->Base_23_0 = Base & 0xFFFFFF;\n DataSegment->Base_31_24 = Base >> 24;\n\n if (Limit <= 0xFFFFF) {\n\n DataSegment->Limit_15_0 = Limit & 0xFFFF;\n DataSegment->Limit_19_16 = (Limit >> 16) & 0xF;\n\n } else {\n\n DataSegment->Granularity = 1;\n DataSegment->Limit_15_0 = (Limit >> 12) & 0xFFFF;\n DataSegment->Limit_19_16 = (Limit >> 28) & 0xF;\n }\n\n return;\n}\n\nVOID\nBlMmInitializeSystemSegment(\n PSYSTEM_SEGMENT SystemSegment,\n UINT32 Type,\n ULONG_PTR Base,\n UINT32 Limit\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes the specified system segment.\n//\n// Arguments:\n//\n// SystemSegment - Supplies a pointer to the system segment to initialize.\n//\n// Type - Supplies the type of the system segment.\n//\n// Base - Supplies the base address of the system segment.\n//\n// Limit - Supplies the limit of the system segment.\n//\n//--\n\n{\n BlRtlZeroMemory(SystemSegment, sizeof(SYSTEM_SEGMENT));\n\n SystemSegment->Type = (Type & 0xF);\n SystemSegment->Present = 1;\n\n SystemSegment->Base_23_0 = Base & 0xFFFFFF;\n SystemSegment->Base_31_24 = (Base >> 24) & 0xFF;\n\n#if defined(BOOT_X64)\n\n SystemSegment->Base_63_32 = Base >> 32;\n\n#endif\n\n if (Limit <= 0xFFFFF) {\n\n SystemSegment->Limit_15_0 = Limit & 0xFFFF;\n SystemSegment->Limit_19_16 = (Limit >> 16) & 0xF;\n\n } else {\n\n SystemSegment->Granularity = 1;\n SystemSegment->Limit_15_0 = (Limit >> 12) & 0xFFFF;\n SystemSegment->Limit_19_16 = (Limit >> 28) & 0xF;\n }\n\n return;\n}\n\n#if !defined(BOOT_PXE)\nVOID\nBlMmEnableA20Gate(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function enables A20 gate.\n//\n//--\n\n{\n BL_KEYBOARD_WRITE_OUTPUT_PORT(BL_KEYBOARD_A20_ENABLE);\n\n BL_KEYBOARD_WRITE_COMMAND(BL_KEYBOARD_COMMAND_PULSE_OUTPUT_PORT);\n\n return;\n}\n#endif\n\nPVOID\nBlMmGetExtendedBiosDataArea(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function gets the address of the extended BIOS data area.\n//\n// Return Value:\n//\n// Address of the extended BIOS data area.\n//\n//--\n\n{\n UINT16 Segment;\n\n Segment = *((PUINT16) (ULONG_PTR) 0x40E);\n\n return (PVOID) (((ULONG_PTR) Segment) << 4);\n}\n\nVOID\nBlMmInitializeSystem(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes boot loader memory management.\n//\n//--\n\n{\n UINT64 Delta;\n UINT32 Index;\n PBL_MM_PHYSICAL_REGION PhysicalRegion;\n PBL_SMAP_ENTRY SmapEntry;\n\n#if !defined(BOOT_PXE)\n //\n // Enable A20 gate.\n //\n\n BlMmEnableA20Gate();\n#endif\n\n //\n // Get extended BIOS data area.\n //\n\n BlMmExtendedBiosDataArea = BlMmGetExtendedBiosDataArea();\n\n //\n // Get legacy CR3 value;\n //\n\n BlMmLegacyCr3 = BlMmGetCr3();\n\n //\n // Get initial GDTR.\n //\n\n BlMmGetGdtr(&BlMmInitialGdtr);\n\n //\n // Initialize memory map.\n //\n\n BlSmapInitialize();\n\n //\n // Create physical region lookaside.\n //\n\n BlRtlInitializeListHead(&BlMmPhysicalRegionList);\n\n BlRtlInitializeListHead(&BlMmPhysicalRegionLookaside.FreeList);\n\n for (Index = 0; Index < (sizeof(BlMmPhysicalRegionLookaside.StaticArray) / sizeof(BlMmPhysicalRegionLookaside.StaticArray[0])); Index += 1) {\n\n BlRtlInsertTailList(&BlMmPhysicalRegionLookaside.FreeList, &BlMmPhysicalRegionLookaside.StaticArray[Index].Entry);\n }\n\n //\n // Initialize page tables.\n //\n\n BlMmInitializePageTables();\n\n //\n // Create reserved BIOS region.\n //\n\n BlMmCreatePhysicalRegion(0,\n BL_MM_BIOS_SIZE,\n BL_MM_PHYSICAL_REGION_BIOS);\n\n //\n // Create free regions based on SMAP.\n //\n\n for (Index = 0; Index < BlSystemMemoryMap.EntryCount; Index += 1) {\n\n SmapEntry = &BlSystemMemoryMap.Entry[Index];\n\n //\n // Don't use any memory below 1MB (BIOS area) and above 2GB (Singularity uses MSB for marking and such).\n //\n\n if ((SmapEntry->Type == BL_SMAP_AVAILABLE) &&\n (SmapEntry->Base >= BL_MM_BIOS_SIZE) &&\n (SmapEntry->Base < 0x80000000UI64)\n ) {\n\n if ((SmapEntry->Base % PAGE_SIZE) != 0) {\n\n Delta = PAGE_SIZE - (SmapEntry->Base % PAGE_SIZE);\n SmapEntry->Base += Delta;\n SmapEntry->Size -= Delta;\n }\n\n SmapEntry->Size &= (~(0xFFFUI64));\n\n if ((SmapEntry->Base + SmapEntry->Size) > 0x80000000UI64) {\n\n SmapEntry->Size = 0x80000000UI64 - SmapEntry->Base;\n }\n\n if (SmapEntry->Size > 0) {\n\n BlMmCreatePhysicalRegion(SmapEntry->Base,\n SmapEntry->Size,\n BL_MM_PHYSICAL_REGION_FREE);\n }\n }\n }\n\n //\n // Initialize pool.\n //\n\n BlPoolInitialize();\n\n //\n // Add more entries to the physical region lookaside.\n //\n\n for (Index = 0; Index < 256; Index += 1) {\n\n PhysicalRegion = (PBL_MM_PHYSICAL_REGION)\n BlPoolAllocateBlock(sizeof(BL_MM_PHYSICAL_REGION));\n\n BlRtlInsertTailList(&BlMmPhysicalRegionLookaside.FreeList, &PhysicalRegion->Entry);\n }\n\n return;\n}\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blmps.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blmps.cpp\n//\n// Abstract:\n//\n// This module implements MPS support for the boot loader environment.\n//\n//--\n\n\n#include \"bl.h\"\n\n//\n// MPS Floating Pointer Structure (FPS)\n//\n\ntypedef struct _MPS_FPS {\n CHAR Signature[4];\n UINT32 ConfigurationTableAddress;\n UINT8 Length;\n UINT8 Revision;\n UINT8 Checksum;\n UINT8 FeatureByte[5];\n} MPS_FPS, *PMPS_FPS;\n\nC_ASSERT(sizeof(MPS_FPS) == 16);\n\nPVOID BlMpsFps;\n\nPMPS_FPS\nBlMpsLocateFpsInRange(\n ULONG_PTR Start,\n ULONG_PTR End\n )\n\n//++\n//\n// Routine Description:\n//\n// This function locates the MPS FPS structure in the specified range.\n//\n// Arguments:\n//\n// Start - Supplies the start address of the range to locate in.\n//\n// End - Supplies the end address of the range to locate in.\n//\n// Return Value:\n//\n// MPS FPS structure, if located.\n// NULL, otherwise.\n//\n//--\n\n{\n PMPS_FPS Fps;\n\n Start = ROUND_UP_TO_POWER2(Start, 16);\n End &= ~((ULONG_PTR) 15);\n\n while (Start < End) {\n\n Fps = (PMPS_FPS) Start;\n\n if ((Fps->Signature[0] == '_') &&\n (Fps->Signature[1] == 'M') &&\n (Fps->Signature[2] == 'P') &&\n (Fps->Signature[3] == '_') &&\n (BlRtlComputeChecksum8(Fps, Fps->Length * 16) == 0)) {\n\n return Fps;\n }\n\n Start += 16;\n }\n\n return NULL;\n}\n\nPMPS_FPS\nBlMpsLocateFps(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function locates the MPS FPS structure.\n//\n// Return Value:\n//\n// MPS FPS structure, if located.\n// NULL, otherwise.\n//\n//--\n\n{\n PMPS_FPS Fps;\n\n //\n // Look for FPS in the first KB of the EBDA first.\n //\n\n Fps = BlMpsLocateFpsInRange((ULONG_PTR) BlMmExtendedBiosDataArea, (ULONG_PTR) BlMmExtendedBiosDataArea + 1024);\n\n if (Fps != NULL) {\n\n return Fps;\n }\n\n //\n // Look for FPS in the 639KB - 640KB range.\n //\n\n Fps = BlMpsLocateFpsInRange(639 * 1024, 640 * 1024);\n\n if (Fps != NULL) {\n\n return Fps;\n }\n\n //\n // Look for FPS in the BIOS ROM range (0xF0000 - 0xFFFFF).\n //\n\n Fps = BlMpsLocateFpsInRange(0xF0000, 0x100000);\n\n if (Fps != NULL) {\n\n return Fps;\n }\n\n //\n // If FPS is not located, then return NULL.\n //\n\n return NULL;\n}\n\nVOID\nBlMpsInitialize(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes MPS support for the boot loader.\n//\n//--\n\n{\n PMPS_FPS Fps;\n\n Fps = BlMpsLocateFps();\n\n if (Fps == NULL) {\n\n#if MPS_VERBOSE\n\n BlRtlPrintf(\"MPS: MPS not supported!\\n\");\n\n#endif\n\n return;\n }\n\n#if MPS_VERBOSE\n\n BlRtlPrintf(\"MPS: Found version 1.%u.\\n\", Fps->Revision);\n\n#endif\n\n BlMpsFps = Fps;\n\n return;\n}\n\n\n\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blpci.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blpci.cpp\n//\n// Abstract:\n//\n// This module implements PCI support for the boot loader environment.\n//\n//--\n\n\n#include \"bl.h\"\n\n#define PCI_MAX_BUSES 128\n#define PCI_MAX_DEVICES 32\n#define PCI_MAX_FUNCTIONS 8\n\n#define PCI_ADDRESS_PORT 0x0CF8\n#define PCI_DATA_PORT 0x0CFC\n\n#define PCI_INVALID_VENDORID 0xFFFF\n\n#define PCI_MULTI_FUNCTION 0x80\n#define PCI_TYPE_MASK 0x7F\n#define PCI_DEVICE 0x00\n#define PCI_BRIDGE 0x01\n\n#define PCI_DEVICE_BASE_ADDRESS_COUNT 6\n\n#define PCI_BASE_ADDRESS_MEMORY 0\n#define PCI_BASE_ADDRESS_IO 1\n\n#define PCI_BASE_ADDRESS_MEMORY_32 0\n#define PCI_BASE_ADDRESS_MEMORY_32_1MB 1\n#define PCI_BASE_ADDRESS_MEMORY_64 2\n\n#define PCI_BASE_ADDRESS_SHIFT 4\n#define PCI_BASE_ADDRESS_FLAGS_MASK 0xF\n\n#pragma pack(1)\n\ntypedef struct _PCI_CONFIGURATION_SPACE_HEADER {\n UINT16 VendorId;\n UINT16 DeviceId;\n UINT16 Command;\n UINT16 Status;\n UINT8 RevisionId;\n UINT8 ProgrammingInterface;\n UINT8 SubClass;\n UINT8 BaseClass;\n UINT8 CacheLineSize;\n UINT8 LatencyTimer;\n UINT8 HeaderType;\n UINT8 BIST;\n\n union {\n\n struct {\n UINT32 BaseAddressRegister[PCI_DEVICE_BASE_ADDRESS_COUNT];\n UINT32 CardBusCISPointer;\n UINT16 SubsystemVendorId;\n UINT16 SubsystemId;\n UINT32 ExpansionRomBaseAddress;\n UINT32 Reserved[2];\n UINT8 InterruptLine;\n UINT8 InterruptPin;\n UINT8 MinimumGrant;\n UINT8 MaximumLatency;\n UINT8 __End;\n } Device;\n\n UINT8 DynamicStart;\n } u1;\n\n} PCI_CONFIGURATION_SPACE_HEADER, *PPCI_CONFIGURATION_SPACE_HEADER;\n\nC_ASSERT(FIELD_OFFSET(PCI_CONFIGURATION_SPACE_HEADER, u1.DynamicStart) == 0x10);\nC_ASSERT(FIELD_OFFSET(PCI_CONFIGURATION_SPACE_HEADER, u1.Device.__End) == 0x40);\n\ntypedef struct _PCI_CONFIG_ADDRESS {\n\n union {\n\n struct {\n UINT32 Zero:2;\n UINT32 RegisterNumber:6;\n UINT32 FunctionNumber:3;\n UINT32 DeviceNumber:5;\n UINT32 BusNumber:8;\n UINT32 Reserved:7;\n UINT32 Enable:1;\n } s1;\n\n UINT32 Value;\n } u1;\n} PCI_CONFIG_ADDRESS, *PPCI_CONFIG_ADDRESS;\n\nC_ASSERT(sizeof(PCI_CONFIG_ADDRESS) == sizeof(UINT32));\n\ntypedef struct _PCI_BASE_ADDRESS {\n\n union {\n\n struct {\n UINT32 Type:1;\n } Common;\n\n struct {\n UINT32 Zero:1;\n UINT32 Type:2;\n UINT32 Prefetch:1;\n UINT32 Base:28;\n } Memory;\n\n struct {\n UINT64 Zero:1;\n UINT64 Type:2;\n UINT64 Prefetch:1;\n UINT64 Base:60;\n } Memory64;\n\n struct {\n UINT32 One:1;\n UINT32 Reserved:1;\n UINT32 Base:30;\n } Io;\n } u1;\n} PCI_BASE_ADDRESS, *PPCI_BASE_ADDRESS;\n\nC_ASSERT(sizeof(((PPCI_BASE_ADDRESS) 0)->u1.Memory) == sizeof(UINT32));\nC_ASSERT(sizeof(((PPCI_BASE_ADDRESS) 0)->u1.Memory64) == sizeof(UINT64));\nC_ASSERT(sizeof(((PPCI_BASE_ADDRESS) 0)->u1.Io) == sizeof(UINT32));\n\n#pragma pack()\n\nPCI_INSTALLATION_CHECK BlPciInstallationCheck;\nUINT32 BlPciOhci1394BaseAddress;\n\nBOOLEAN\nBlPciCheckBios(\n PPCI_INSTALLATION_CHECK PciInstallationCheck\n )\n\n//++\n//\n// Routine Description:\n//\n// This function checks for the presence of PCI BIOS.\n//\n// Arguments:\n//\n// PciInstallationCheck - Receives PCI BIOS information.\n//\n// Return Value:\n//\n// TRUE, if PCI BIOS is present.\n// FALSE, otherwise.\n//\n//--\n\n{\n BL_LEGACY_CALL_CONTEXT Context;\n\n //\n // Call PCI detection service.\n //\n\n BlRtlZeroMemory(&Context, sizeof(Context));\n\n Context.eax = 0xB101;\n\n BlRtlCallLegacyInterruptService(0x1A,\n &Context,\n &Context);\n\n //\n // If CF is set, AH is not zero, or if the signature is not ' ICP', then\n // there is no PCI BIOS.\n //\n\n if (((Context.eflags & RFLAGS_CF) != 0) ||\n (((Context.eax >> 8) & 0xFF) != 0) ||\n (Context.edx != 0x20494350)) {\n\n return FALSE;\n }\n\n //\n // Populate the provided installation check structure and return success.\n //\n\n PciInstallationCheck->Eax = Context.eax;\n PciInstallationCheck->Ebx = Context.ebx;\n PciInstallationCheck->Ecx = Context.ecx;\n PciInstallationCheck->Edx = Context.edx;\n PciInstallationCheck->HardwareCharacteristics = (UINT8) (Context.eax & 0xFF);\n PciInstallationCheck->LastBusNumber = (UINT8) (Context.ecx & 0xFF);\n PciInstallationCheck->MajorVersion = (UINT8) ((Context.ebx >> 8) & 0xFF);\n PciInstallationCheck->MinorVersion = (UINT8) (Context.ebx & 0xFF);\n PciInstallationCheck->ProtectedModeEntryPoint = Context.edi;\n\n return TRUE;\n}\n\nUINT32\nBlPciReadConfigurationRegister(\n UINT8 BusNumber,\n UINT8 DeviceNumber,\n UINT8 FunctionNumber,\n UINT8 RegisterNumber\n )\n\n//++\n//\n// Routine Description:\n//\n// This function reads from the specified PCI configuration register.\n//\n// Arguments:\n//\n// BusNumber - Supplies the PCI bus number.\n//\n// DeviceNumber - Supplies the PCI device number.\n//\n// FunctionNumber - Supplies the PCI function number.\n//\n// RegisterNumber - Supplies the PCI configuration register number.\n//\n// Return Value:\n//\n// The value of the configuration register.\n//\n//--\n\n{\n PCI_CONFIG_ADDRESS ConfigAddress;\n UINT32 Value;\n\n BLASSERT(DeviceNumber < PCI_MAX_DEVICES);\n BLASSERT(FunctionNumber < PCI_MAX_FUNCTIONS);\n BLASSERT((RegisterNumber % sizeof(UINT32)) == 0);\n\n BlRtlZeroMemory(&ConfigAddress, sizeof(ConfigAddress));\n\n ConfigAddress.u1.s1.BusNumber = BusNumber;\n ConfigAddress.u1.s1.DeviceNumber = DeviceNumber;\n ConfigAddress.u1.s1.FunctionNumber = FunctionNumber;\n ConfigAddress.u1.s1.RegisterNumber = RegisterNumber >> 2;\n ConfigAddress.u1.s1.Enable = 1;\n\n BlRtlWritePort32(PCI_ADDRESS_PORT, ConfigAddress.u1.Value);\n\n Value = BlRtlReadPort32(PCI_DATA_PORT);\n\n return Value;\n}\n\nVOID\nBlPciWriteConfigurationRegister(\n UINT8 BusNumber,\n UINT8 DeviceNumber,\n UINT8 FunctionNumber,\n UINT8 RegisterNumber,\n UINT32 Value\n )\n\n//++\n//\n// Routine Description:\n//\n// This function writes to the specified PCI configuration register.\n//\n// Arguments:\n//\n// BusNumber - Supplies the PCI bus number.\n//\n// DeviceNumber - Supplies the PCI device number.\n//\n// FunctionNumber - Supplies the PCI function number.\n//\n// RegisterNumber - Supplies the PCI configuration register number.\n//\n// Value - Supplies the value to write.\n//\n//--\n\n{\n PCI_CONFIG_ADDRESS ConfigAddress;\n\n BLASSERT(DeviceNumber < PCI_MAX_DEVICES);\n BLASSERT(FunctionNumber < PCI_MAX_FUNCTIONS);\n BLASSERT((RegisterNumber % sizeof(UINT32)) == 0);\n\n BlRtlZeroMemory(&ConfigAddress, sizeof(ConfigAddress));\n\n ConfigAddress.u1.s1.BusNumber = BusNumber;\n ConfigAddress.u1.s1.DeviceNumber = DeviceNumber;\n ConfigAddress.u1.s1.FunctionNumber = FunctionNumber;\n ConfigAddress.u1.s1.RegisterNumber = RegisterNumber >> 2;\n ConfigAddress.u1.s1.Enable = 1;\n\n BlRtlWritePort32(PCI_ADDRESS_PORT, ConfigAddress.u1.Value);\n\n BlRtlWritePort32(PCI_DATA_PORT, Value);\n\n return;\n}\n\nVOID\nBlPciReadConfigurationSpace(\n UINT8 BusNumber,\n UINT8 DeviceNumber,\n UINT8 FunctionNumber,\n UINT8 RegisterNumber,\n PVOID Buffer,\n UINT16 BufferSize\n )\n\n//++\n//\n// Routine Description:\n//\n// This function reads the specified PCI configuration space range.\n//\n// Arguments:\n//\n// BusNumber - Supplies the PCI bus number.\n//\n// DeviceNumber - Supplies the PCI device number.\n//\n// FunctionNumber - Supplies the PCI function number.\n//\n// RegisterNumber - Supplies the PCI configuration register number.\n//\n// Buffer - Receives configuration data.\n//\n// BufferSize - Supplies the number of bytes to read.\n//\n//--\n\n{\n UINT16 Count;\n UINT16 Index;\n\n BLASSERT((RegisterNumber % sizeof(UINT32)) == 0);\n BLASSERT((BufferSize % sizeof(UINT32)) == 0);\n\n Count = BufferSize / sizeof(UINT32);\n\n for (Index = 0; Index < Count; Index += 1) {\n\n ((PUINT32) Buffer)[Index] = BlPciReadConfigurationRegister(BusNumber,\n DeviceNumber,\n FunctionNumber,\n (UINT8) (RegisterNumber + (Index * sizeof(UINT32))));\n }\n\n return;\n}\n\nVOID\nBlPciScanDevices(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function scans all PCI buses on the system.\n//\n//--\n\n{\n UINT64 Address;\n PPCI_BASE_ADDRESS BaseAddress;\n UINT8 BaseAddressRegister;\n UINT8 BusNumber;\n PCI_CONFIGURATION_SPACE_HEADER Config;\n UINT8 DeviceNumber;\n UINT8 FunctionNumber;\n UINT8 Index;\n UINT8 NodeType;\n UINT32 OldValue;\n UINT32 Size;\n\n for (BusNumber = 0; BusNumber <= BlPciInstallationCheck.LastBusNumber; BusNumber += 1) {\n\n for (DeviceNumber = 0; DeviceNumber < PCI_MAX_DEVICES; DeviceNumber += 1) {\n\n for (FunctionNumber = 0; FunctionNumber < PCI_MAX_FUNCTIONS; FunctionNumber += 1) {\n\n BlRtlZeroMemory(&Config, sizeof(Config));\n\n Config.VendorId = PCI_INVALID_VENDORID;\n\n BlPciReadConfigurationSpace(BusNumber,\n DeviceNumber,\n FunctionNumber,\n 0,\n &Config,\n FIELD_OFFSET(PCI_CONFIGURATION_SPACE_HEADER, u1.DynamicStart));\n\n if ((Config.VendorId == PCI_INVALID_VENDORID) || (Config.VendorId == 0)) {\n\n continue;\n }\n\n NodeType = Config.HeaderType & PCI_TYPE_MASK;\n\n switch (NodeType) {\n\n case PCI_DEVICE: {\n\n#if PCI_VERBOSE\n\n BlRtlPrintf(\"PCI: %02x:%02x:%02x: Device %04x:%04x [BC=%02x SC=%02x PI=%02x]\\n\",\n BusNumber,\n DeviceNumber,\n FunctionNumber,\n Config.VendorId,\n Config.DeviceId,\n Config.BaseClass,\n Config.SubClass,\n Config.ProgrammingInterface\n );\n\n#endif\n\n BlPciReadConfigurationSpace(BusNumber,\n DeviceNumber,\n FunctionNumber,\n FIELD_OFFSET(PCI_CONFIGURATION_SPACE_HEADER, u1.DynamicStart),\n &Config.u1.DynamicStart,\n FIELD_OFFSET(PCI_CONFIGURATION_SPACE_HEADER, u1.Device.__End) - FIELD_OFFSET(PCI_CONFIGURATION_SPACE_HEADER, u1.DynamicStart));\n\n for (Index = 0; Index < PCI_DEVICE_BASE_ADDRESS_COUNT; Index += 1) {\n\n BaseAddress = (PPCI_BASE_ADDRESS) &Config.u1.Device.BaseAddressRegister[Index];\n BaseAddressRegister = (UINT8) FIELD_OFFSET(PCI_CONFIGURATION_SPACE_HEADER, u1.Device.BaseAddressRegister[Index]);\n Address = 0;\n\n switch (BaseAddress->u1.Common.Type) {\n\n case PCI_BASE_ADDRESS_MEMORY: {\n\n SATISFY_OVERZEALOUS_COMPILER(Size = 0);\n\n switch (BaseAddress->u1.Memory.Type) {\n\n case PCI_BASE_ADDRESS_MEMORY_32:\n case PCI_BASE_ADDRESS_MEMORY_32_1MB: {\n\n Address = BaseAddress->u1.Memory.Base << PCI_BASE_ADDRESS_SHIFT;\n\n OldValue = Config.u1.Device.BaseAddressRegister[Index];\n\n BlPciWriteConfigurationRegister(BusNumber,\n DeviceNumber,\n FunctionNumber,\n BaseAddressRegister,\n (UINT32) -1);\n\n Size = BlPciReadConfigurationRegister(BusNumber,\n DeviceNumber,\n FunctionNumber,\n BaseAddressRegister);\n\n BlPciWriteConfigurationRegister(BusNumber,\n DeviceNumber,\n FunctionNumber,\n BaseAddressRegister,\n OldValue);\n\n Size &= ~(PCI_BASE_ADDRESS_FLAGS_MASK);\n\n Size = (~Size) + 1;\n\n break;\n }\n\n case PCI_BASE_ADDRESS_MEMORY_64: {\n\n Address = BaseAddress->u1.Memory64.Base << PCI_BASE_ADDRESS_SHIFT;\n\n OldValue = Config.u1.Device.BaseAddressRegister[Index];\n\n BlPciWriteConfigurationRegister(BusNumber,\n DeviceNumber,\n FunctionNumber,\n BaseAddressRegister,\n (UINT32) -1);\n\n Size = BlPciReadConfigurationRegister(BusNumber,\n DeviceNumber,\n FunctionNumber,\n BaseAddressRegister);\n\n BlPciWriteConfigurationRegister(BusNumber,\n DeviceNumber,\n FunctionNumber,\n BaseAddressRegister,\n OldValue);\n\n Size &= ~(PCI_BASE_ADDRESS_FLAGS_MASK);\n\n Size = (~Size) + 1;\n\n Index += 1;\n\n break;\n }\n }\n\n if (Address != 0) {\n\n BLASSERT(Size > 0);\n\n#if PCI_VERBOSE\n\n BlRtlPrintf(\"PCI: %02x:%02x:%02x: IO Memory [%016I64x ... %016I64x]\\n\",\n BusNumber,\n DeviceNumber,\n FunctionNumber,\n Address,\n Address + Size - 1);\n\n#endif\n\n if ((Address >= LEGACY_MEMORY_LIMIT) &&\n ((Address + Size) > Address) &&\n ((Address + Size) <= 0x100000000UI64)\n ) {\n\n BlMmMapVirtualRange((PVOID) (ULONG_PTR) Address,\n (PVOID) (ULONG_PTR) Address,\n Size,\n TRUE,\n (BOOLEAN) BaseAddress->u1.Memory.Prefetch,\n FALSE);\n }\n\n //\n // Check if this memory range maps OHCI 1394 registers.\n //\n\n if ((Config.BaseClass == 0x0C) &&\n (Config.SubClass == 0x00) &&\n (Config.ProgrammingInterface == 0x10) &&\n (BlPciOhci1394BaseAddress == 0)) {\n\n BlPciOhci1394BaseAddress = (UINT32) Address;\n }\n }\n\n break;\n }\n }\n }\n\n break;\n }\n\n case PCI_BRIDGE: {\n\n#if PCI_VERBOSE\n\n BlRtlPrintf(\"PCI: %02x:%02x:%02x: Bridge %04x:%04x\\n\",\n BusNumber,\n DeviceNumber,\n FunctionNumber,\n Config.VendorId,\n Config.DeviceId);\n\n#endif\n\n break;\n }\n }\n\n if ((Config.HeaderType & PCI_MULTI_FUNCTION) == 0) {\n\n break;\n }\n }\n }\n }\n}\nVOID\nBlPciInitialize(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes PCI support.\n//\n//--\n\n{\n if (BlPciCheckBios(&BlPciInstallationCheck) == FALSE) {\n\n BlRtlPrintf(\"pci: PCI BIOS not detected!\\n\");\n BlRtlHalt();\n }\n\n#if PCI_VERBOSE\n\n BlRtlPrintf(\"PCI: PCI BIOS detected.\\n\"\n \"PCI: Version : %u.%u\\n\"\n \"PCI: Last Bus Number : %u\\n\",\n BlPciInstallationCheck.MajorVersion,\n BlPciInstallationCheck.MinorVersion,\n BlPciInstallationCheck.LastBusNumber);\n\n#endif\n\n BlPciScanDevices();\n\n return;\n}\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blpecoff.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blpecoff.cpp\n//\n// Abstract:\n//\n// This module implements PE / COFF support for the boot loader.\n//\n//--\n\n#include \"bl.h\"\n\n#define IMAGE_DOS_SIGNATURE 0x05A4D // MZ\n#define IMAGE_NT_SIGNATURE 0x000004550 // PE00\n\ntypedef struct _IMAGE_DOS_HEADER { //- DOS .EXE header\n UINT16 e_magic; //- Magic number\n UINT16 e_cblp; //- Bytes on last page of file\n UINT16 e_cp; //- Pages in file\n UINT16 e_crlc; //- Relocations\n UINT16 e_cparhdr; //- Size of header in paragraphs\n UINT16 e_minalloc; //- Minimum extra paragraphs needed\n UINT16 e_maxalloc; //- Maximum extra paragraphs needed\n UINT16 e_ss; //- Initial (relative) SS value\n UINT16 e_sp; //- Initial SP value\n UINT16 e_csum; //- Checksum\n UINT16 e_ip; //- Initial IP value\n UINT16 e_cs; //- Initial (relative) CS value\n UINT16 e_lfarlc; //- File address of relocation table\n UINT16 e_ovno; //- Overlay number\n UINT16 e_res[4]; //- Reserved words\n UINT16 e_oemid; //- OEM identifier (for e_oeminfo)\n UINT16 e_oeminfo; //- OEM information; e_oemid specific\n UINT16 e_res2[10]; //- Reserved words\n INT32 e_lfanew; //- File address of new exe header\n} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;\n\n\ntypedef struct _IMAGE_FILE_HEADER {\n UINT16 Machine;\n UINT16 NumberOfSections;\n UINT32 TimeDateStamp;\n UINT32 PointerToSymbolTable;\n UINT32 NumberOfSymbols;\n UINT16 SizeOfOptionalHeader;\n UINT16 Characteristics;\n} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;\n\ntypedef struct _IMAGE_DATA_DIRECTORY {\n UINT32 VirtualAddress;\n UINT32 Size;\n} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;\n\n#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16\n\n#define IMAGE_DIRECTORY_ENTRY_BASERELOC 5\n\n#if defined(BOOT_X86)\n\ntypedef struct _IMAGE_OPTIONAL_HEADER_32 {\n UINT16 Magic;\n UINT8 MajorLinkerVersion;\n UINT8 MinorLinkerVersion;\n UINT32 SizeOfCode;\n UINT32 SizeOfInitializedData;\n UINT32 SizeOfUninitializedData;\n UINT32 AddressOfEntryPoint;\n UINT32 BaseOfCode;\n UINT32 BaseOfData;\n UINT32 ImageBase;\n UINT32 SectionAlignment;\n UINT32 FileAlignment;\n UINT16 MajorOperatingSystemVersion;\n UINT16 MinorOperatingSystemVersion;\n UINT16 MajorImageVersion;\n UINT16 MinorImageVersion;\n UINT16 MajorSubsystemVersion;\n UINT16 MinorSubsystemVersion;\n UINT32 Win32VersionValue;\n UINT32 SizeOfImage;\n UINT32 SizeOfHeaders;\n UINT32 CheckSum;\n UINT16 Subsystem;\n UINT16 DllCharacteristics;\n UINT32 SizeOfStackReserve;\n UINT32 SizeOfStackCommit;\n UINT32 SizeOfHeapReserve;\n UINT32 SizeOfHeapCommit;\n UINT32 LoaderFlags;\n UINT32 NumberOfRvaAndSizes;\n IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];\n} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;\n\ntypedef struct _IMAGE_NT_HEADERS32 {\n UINT32 Signature;\n IMAGE_FILE_HEADER FileHeader;\n IMAGE_OPTIONAL_HEADER32 OptionalHeader;\n} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;\n\ntypedef IMAGE_NT_HEADERS32 IMAGE_NT_HEADERS, *PIMAGE_NT_HEADERS;\n\n#elif defined(BOOT_X64)\n\ntypedef struct _IMAGE_OPTIONAL_HEADER64 {\n UINT16 Magic;\n UINT8 MajorLinkerVersion;\n UINT8 MinorLinkerVersion;\n UINT32 SizeOfCode;\n UINT32 SizeOfInitializedData;\n UINT32 SizeOfUninitializedData;\n UINT32 AddressOfEntryPoint;\n UINT32 BaseOfCode;\n UINT64 ImageBase;\n UINT32 SectionAlignment;\n UINT32 FileAlignment;\n UINT16 MajorOperatingSystemVersion;\n UINT16 MinorOperatingSystemVersion;\n UINT16 MajorImageVersion;\n UINT16 MinorImageVersion;\n UINT16 MajorSubsystemVersion;\n UINT16 MinorSubsystemVersion;\n UINT32 Win32VersionValue;\n UINT32 SizeOfImage;\n UINT32 SizeOfHeaders;\n UINT32 CheckSum;\n UINT16 Subsystem;\n UINT16 DllCharacteristics;\n UINT64 SizeOfStackReserve;\n UINT64 SizeOfStackCommit;\n UINT64 SizeOfHeapReserve;\n UINT64 SizeOfHeapCommit;\n UINT32 LoaderFlags;\n UINT32 NumberOfRvaAndSizes;\n IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];\n} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;\n\ntypedef struct _IMAGE_NT_HEADERS64 {\n UINT32 Signature;\n IMAGE_FILE_HEADER FileHeader;\n IMAGE_OPTIONAL_HEADER64 OptionalHeader;\n} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;\n\ntypedef IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS, *PIMAGE_NT_HEADERS;\n\n#endif\n\n#define IMAGE_SIZEOF_SHORT_NAME 8\n\ntypedef struct _IMAGE_SECTION_HEADER {\n UINT8 Name[IMAGE_SIZEOF_SHORT_NAME];\n union {\n UINT32 PhysicalAddress;\n UINT32 VirtualSize;\n } Misc;\n UINT32 VirtualAddress;\n UINT32 SizeOfRawData;\n UINT32 PointerToRawData;\n UINT32 PointerToRelocations;\n UINT32 PointerToLinenumbers;\n UINT16 NumberOfRelocations;\n UINT16 NumberOfLinenumbers;\n UINT32 Characteristics;\n} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;\n\ntypedef struct _IMAGE_BASE_RELOCATION {\n UINT32 VirtualAddress;\n UINT32 SizeOfBlock;\n UINT16 TypeOffset[0];\n} IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION;\n\n#define IMAGE_REL_BASED_ABSOLUTE 0\n#define IMAGE_REL_BASED_HIGHLOW 3\n#define IMAGE_REL_BASED_DIR64 10\n\nVOID\nBlPeGetVirtualRange(\n PVOID Image,\n PVOID *VirtualBase,\n ULONG_PTR *VirtualSize\n )\n\n//-++\n//-\n//- Routine Description:\n//-\n//- This function queries the virtual range for the specified image.\n//-\n//- Arguments:\n//-\n//- Image - Supplies a pointer to the image.\n//-\n//- VirtualBase - Receives the virtual base address of the image.\n//-\n//- VirtualSize - Receives the virtual size of the image.\n//-\n//---\n\n{\n PIMAGE_DOS_HEADER DosHeader;\n UINT32 Index;\n PIMAGE_NT_HEADERS NtHeader;\n PIMAGE_SECTION_HEADER Section;\n UINT32 SectionEnd;\n\n DosHeader = (PIMAGE_DOS_HEADER) Image;\n\n if (DosHeader->e_magic != IMAGE_DOS_SIGNATURE) {\n\n BlRtlPrintf(\"PECOFF: Invalid image!\\n\");\n BlRtlHalt();\n }\n\n NtHeader = (PIMAGE_NT_HEADERS) ((ULONG_PTR) Image + DosHeader->e_lfanew);\n\n if (NtHeader->Signature != IMAGE_NT_SIGNATURE) {\n\n BlRtlPrintf(\"PECOFF: Invalid image!\\n\");\n BlRtlHalt();\n }\n\n if (NtHeader->FileHeader.NumberOfSections == 0) {\n\n BlRtlPrintf(\"PECOFF: Invalid image!\\n\");\n BlRtlHalt();\n }\n\n if ((NtHeader->OptionalHeader.ImageBase % PAGE_SIZE) != 0) {\n\n BlRtlPrintf(\"PECOFF: Invalid image!\\n\");\n BlRtlHalt();\n }\n\n *VirtualBase = (PVOID) NtHeader->OptionalHeader.ImageBase;\n *VirtualSize = 0;\n\n Section = (PIMAGE_SECTION_HEADER) (((ULONG_PTR) &NtHeader->OptionalHeader) + NtHeader->FileHeader.SizeOfOptionalHeader);\n\n for (Index = 0; Index < NtHeader->FileHeader.NumberOfSections; Index += 1) {\n\n SectionEnd = Section[Index].VirtualAddress + Section[Index].Misc.VirtualSize;\n\n if (SectionEnd > *VirtualSize) {\n\n *VirtualSize = SectionEnd;\n }\n }\n\n *VirtualSize = ROUND_UP_TO_PAGES(*VirtualSize);\n\n return;\n}\n\nVOID\nBlPeApplyFixupBlock(\n PIMAGE_BASE_RELOCATION Block,\n ULONG_PTR VirtualBase,\n ULONG_PTR RelocDiff\n )\n\n//-++\n//-\n//- Routine Description:\n//-\n//- This function applies all of the base fixups in the specified block to the image.\n//-\n//- Arguments:\n//-\n//- Block - Supplies a pointer to the base relocation fixup block.\n//-\n//- VirtualBase - Supplies the target address of the image.\n//-\n//- RelocDiff - Supplies the offset of the image target address from the base address.\n//-\n//---\n\n{\n PUINT16 Reloc;\n PUINT16 BlockEnd;\n ULONG_PTR BlockBase;\n ULONG_PTR Target;\n\n Reloc = Block->TypeOffset;\n BlockEnd = (PUINT16) ( ((PUINT8) Block) + Block->SizeOfBlock);\n BlockBase = VirtualBase + Block->VirtualAddress;\n\n#if PECOFF_VERBOSE\n\n BlRtlPrintf(\"PECOFF: Reloc Block %p:\\n\", Block->VirtualAddress);\n\n#endif\n\n for (; Reloc < BlockEnd; Reloc++) {\n\n Target = BlockBase + (*Reloc & 0xfff);\n\n#if PECOFF_VERBOSE\n\n switch (*Reloc >> 12) {\n\n case IMAGE_REL_BASED_ABSOLUTE: {\n\n BlRtlPrintf(\"PECOFF: %p: abs:%x \\r\", (PUINT32) Target, * (PUINT32) Target);\n break;\n }\n\n case IMAGE_REL_BASED_HIGHLOW: {\n\n BlRtlPrintf(\"PECOFF: %p: r32:%x->%x \\r\", (PUINT32) Target, * (PUINT32) Target, * (PUINT32) Target + (UINT32) RelocDiff);\n break;\n }\n\n case IMAGE_REL_BASED_DIR64: {\n\n BlRtlPrintf(\"PECOFF: %p: r64:%lx->%lx \\r\", (PUINT64) Target, * (PUINT64) Target, * (PUINT64) Target + (UINT64) RelocDiff);\n break;\n }\n\n default: {\n\n BlRtlPrintf(\"PECOFF: %p: %x ??? \\r\", (PUINT32) Target, Reloc[0] >> 12);\n break;\n }\n }\n\n#endif\n\n switch (*Reloc >> 12) {\n case IMAGE_REL_BASED_ABSOLUTE: {\n\n break;\n }\n\n case IMAGE_REL_BASED_HIGHLOW: {\n\n * (PUINT32) Target += (UINT32) RelocDiff;\n break;\n }\n\n case IMAGE_REL_BASED_DIR64: {\n\n * (PUINT64 *) Target += (UINT64) RelocDiff;\n break;\n }\n\n default: {\n\n BlRtlPrintf(\"PECOFF: Illegal relocation.\\n\");\n BlRtlHalt();\n }\n }\n }\n}\n\nVOID\nBlPeLoadImage(\n PVOID LoadBase,\n UINT32 ImageSize,\n PVOID Image,\n PVOID *EntryPoint,\n BOOLEAN isSLB\n )\n\n//-++\n//-\n//- Routine Description:\n//-\n//- This function loads the specified image.\n//-\n//- Arguments:\n//-\n//- Image - Supplies a pointer to the image to load.\n//-\n//- EntryPoint - Receives a pointer to the entry point of the image.\n//-\n//---\n\n{\n ULONG_PTR BytesToCopy;\n PIMAGE_DOS_HEADER DosHeader;\n UINT32 Index;\n PIMAGE_NT_HEADERS NtHeader;\n PIMAGE_SECTION_HEADER Section;\n ULONG_PTR VirtualBase;\n ULONG_PTR RelocDiff;\n\n VirtualBase = (ULONG_PTR) LoadBase;\n DosHeader = (PIMAGE_DOS_HEADER) Image;\n\n if (DosHeader->e_magic != IMAGE_DOS_SIGNATURE) {\n\n BlRtlPrintf(\"PECOFF: Missing MZ!\\n\");\n BlRtlHalt();\n }\n\n NtHeader = (PIMAGE_NT_HEADERS) ((ULONG_PTR) Image + DosHeader->e_lfanew);\n\n if (NtHeader->Signature != IMAGE_NT_SIGNATURE) {\n\n BlRtlPrintf(\"PECOFF: Missing PE!\\n\");\n BlRtlHalt();\n }\n\n if (NtHeader->FileHeader.NumberOfSections == 0) {\n\n BlRtlPrintf(\"PECOFF: No sections!\\n\");\n BlRtlHalt();\n }\n\n if ((NtHeader->OptionalHeader.ImageBase % PAGE_SIZE) != 0) {\n\n BlRtlPrintf(\"PECOFF: Not page aligned.\\n\");\n BlRtlHalt();\n }\n\n if (isSLB && ImageSize > 64*1024) {\n BlRtlPrintf(\"PECOFF: Image is too large for late launch!\\n\");\n BlRtlHalt();\n }\n\n //- Zero out the entire range of memory used by the kernel,\n //- to ensure a consistent measurement during late launch via SKINIT\n BlRtlZeroMemory((PVOID) VirtualBase, ImageSize);\n\n BlRtlCopyMemory((PVOID) VirtualBase,\n Image,\n NtHeader->OptionalHeader.SizeOfHeaders);\n\n Section = (PIMAGE_SECTION_HEADER) (((ULONG_PTR) &NtHeader->OptionalHeader) + NtHeader->FileHeader.SizeOfOptionalHeader);\n\n for (Index = 0; Index < NtHeader->FileHeader.NumberOfSections; Index += 1) {\n\n BlRtlZeroMemory((PVOID) (VirtualBase + Section[Index].VirtualAddress), Section[Index].Misc.VirtualSize);\n\n if (Section[Index].SizeOfRawData < Section[Index].Misc.VirtualSize) {\n\n BytesToCopy = Section[Index].SizeOfRawData;\n\n } else {\n\n BytesToCopy = Section[Index].Misc.VirtualSize;\n }\n\n BlRtlCopyMemory((PVOID) (VirtualBase + Section[Index].VirtualAddress),\n (PVOID) (((ULONG_PTR) Image) + Section[Index].PointerToRawData),\n BytesToCopy);\n\n#if PECOFF_VERBOSE\n\n {\n CHAR Temp[IMAGE_SIZEOF_SHORT_NAME + 1];\n\n BlRtlCopyMemory(Temp,\n Section[Index].Name,\n IMAGE_SIZEOF_SHORT_NAME);\n\n Temp[IMAGE_SIZEOF_SHORT_NAME] = 0;\n\n BlRtlPrintf(\"PECOFF: %p ... %p (%p ... %p) %s\\n\",\n VirtualBase + Section[Index].VirtualAddress,\n VirtualBase + Section[Index].VirtualAddress + Section[Index].Misc.VirtualSize - 1,\n (((ULONG_PTR) Image) + Section[Index].PointerToRawData),\n (((ULONG_PTR) Image) + Section[Index].PointerToRawData) + BytesToCopy,\n Temp);\n }\n\n#endif\n\n }\n\n RelocDiff = VirtualBase - (ULONG_PTR)NtHeader->OptionalHeader.ImageBase;\n\n if (RelocDiff != 0) {\n\n PUINT8 RelocList;\n PUINT8 RelocListEnd;\n PIMAGE_BASE_RELOCATION Block;\n\n RelocList = (PUINT8) (VirtualBase + NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);\n RelocListEnd = RelocList + NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size;\n\n#if PECOFF_VERBOSE\n\n BlRtlPrintf(\"PECOFF: Relocs: %p ... %p\\n\", RelocList, RelocListEnd);\n\n#endif\n\n while (RelocList < RelocListEnd) {\n\n Block = (PIMAGE_BASE_RELOCATION) RelocList;\n\n BlPeApplyFixupBlock(Block, VirtualBase, RelocDiff);\n\n RelocList += Block->SizeOfBlock;\n }\n }\n\n *EntryPoint = (PVOID) (VirtualBase + NtHeader->OptionalHeader.AddressOfEntryPoint);\n\n if (isSLB) {\n //- Prepare the secure loader image with the necessary header\n //- Make sure the first 32 bits of the image are [31..16] == length and [15..0] == entry point\n *((UINT32*)VirtualBase) = (ImageSize << 16) | (NtHeader->OptionalHeader.AddressOfEntryPoint & 0x0000FFFF);\n\n BlRtlPrintf(\"PECOFF: Base: %p AddressOfEntryPoint: %p ImageSize: %p\\n\", VirtualBase, NtHeader->OptionalHeader.AddressOfEntryPoint, ImageSize);\n }\n return;\n}\n\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blpnp.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blpnp.cpp\n//\n// Abstract:\n//\n// This module implements PNP BIOS support for the boot loader environment.\n//\n//--\n\n\n#include \"bl.h\"\n\n//\n// PNP status codes.\n//\n\n#define PNP_STATUS_SUCCESS 0x0000\n\ntypedef UINT16 PNP_STATUS;\n\n//\n// PNP enumeration terminator value.\n//\n\n#define PNP_NO_MORE_NODES 0xFF\n\n//\n// PNP BIOS state.\n//\n\nPPNP_INSTALLATION_CHECK BlPnpBiosInformation;\nPPNP_SYSTEM_DEVICE_NODE BlPnpSystemDeviceNodeList;\nUINT32 BlPnpSystemDeviceNodeListSize;\nPNP_ISA_CONFIGURATION BlPnpIsaConfiguration;\n\n//\n// The following variables are in the global data segment to ensure that\n// they are located in legacy memory (i.e. in the 1st MB of memory) so\n// that BIOS calls can access them.\n//\n\nUINT16 BlPnpCallFrame[16];\nUINT8 BlPnpHandle;\nUINT8 BlPnpNodeData[PAGE_SIZE];\nUINT32 BlPnpNodeSize;\nUINT8 BlPnpNumberOfNodes;\n\nPNP_STATUS\nBlPnpGetNumberOfSystemDeviceNodes(\n PUINT8 NumberOfNodes,\n PUINT32 NodeSize,\n UINT16 BiosSelector\n )\n\n//++\n//\n// Routine Description:\n//\n// This function queries the number of PNP system device nodes.\n//\n// Arguments:\n//\n// NumberOfNodes - Receives the number of nodes.\n//\n// NodeSize - Receives the size of the largest node.\n//\n// BiosSelector - Supplies the selector for the PNP BIOS.\n//\n// Return Value:\n//\n// PNP BIOS status code.\n//\n//--\n\n{\n BL_LEGACY_CALL_CONTEXT Context;\n\n BlPnpNumberOfNodes = 0;\n BlPnpNodeSize = 0;\n\n BlPnpCallFrame[0] = 0;\n BlRtlConvertLinearPointerToFarPointer(&BlPnpNumberOfNodes, (PFAR_POINTER) &BlPnpCallFrame[1]);\n BlRtlConvertLinearPointerToFarPointer(&BlPnpNodeSize, (PFAR_POINTER) &BlPnpCallFrame[3]);\n BlPnpCallFrame[5] = BiosSelector;\n\n BlRtlZeroMemory(&Context, sizeof(BL_LEGACY_CALL_CONTEXT));\n\n BlRtlCallLegacyFunction(BlPnpBiosInformation->RealModeCodeSegment16,\n BlPnpBiosInformation->RealModeCodeOffset16,\n BlPnpCallFrame,\n 6 * sizeof(UINT16),\n &Context,\n &Context);\n\n if ((PNP_STATUS) Context.eax == PNP_STATUS_SUCCESS) {\n\n *NumberOfNodes = BlPnpNumberOfNodes;\n *NodeSize = BlPnpNodeSize;\n }\n\n return (PNP_STATUS) Context.eax;\n}\n\nPNP_STATUS\nBlPnpGetSystemDeviceNode(\n PUINT8 Handle,\n PPNP_SYSTEM_DEVICE_NODE Node,\n UINT32 NodeSize,\n UINT16 Control,\n UINT16 BiosSelector\n )\n\n//++\n//\n// Routine Description:\n//\n// This function queries the specified PNP system device nodes.\n//\n// Arguments:\n//\n// Handle - Supplies a pointer to the variable containing\n// the handle to query at entry and the next available\n// handle at exit.\n//\n// Node - Receives node information.\n//\n// NodeSize - Supplies the size of the node structure.\n//\n// Control - Supplies query control flags.\n//\n// BiosSelector - Supplies the selector for the PNP BIOS.\n//\n// Return Value:\n//\n// PNP BIOS status code.\n//\n//--\n\n{\n BL_LEGACY_CALL_CONTEXT Context;\n\n BLASSERT(NodeSize > 0);\n\n BLASSERT(NodeSize <= sizeof(BlPnpNodeData));\n\n BlPnpHandle = *Handle;\n\n BlPnpCallFrame[0] = 1;\n BlRtlConvertLinearPointerToFarPointer(&BlPnpHandle, (PFAR_POINTER) &BlPnpCallFrame[1]);\n BlRtlConvertLinearPointerToFarPointer(BlPnpNodeData, (PFAR_POINTER) &BlPnpCallFrame[3]);\n BlPnpCallFrame[5] = Control;\n BlPnpCallFrame[6] = BiosSelector;\n\n BlRtlZeroMemory(&Context, sizeof(BL_LEGACY_CALL_CONTEXT));\n\n BlRtlCallLegacyFunction(BlPnpBiosInformation->RealModeCodeSegment16,\n BlPnpBiosInformation->RealModeCodeOffset16,\n BlPnpCallFrame,\n 7 * sizeof(UINT16),\n &Context,\n &Context);\n\n if ((PNP_STATUS) Context.eax == PNP_STATUS_SUCCESS) {\n\n *Handle = BlPnpHandle;\n\n BLASSERT(((PPNP_SYSTEM_DEVICE_NODE) BlPnpNodeData)->Size <= NodeSize);\n\n BlRtlCopyMemory(Node,\n BlPnpNodeData,\n ((PPNP_SYSTEM_DEVICE_NODE) BlPnpNodeData)->Size);\n }\n\n return (PNP_STATUS) Context.eax;\n}\n\nPNP_STATUS\nBlPnpGetIsaConfiguration(\n PPNP_ISA_CONFIGURATION IsaConfiguration,\n UINT16 BiosSelector\n )\n\n//++\n//\n// Routine Description:\n//\n// This function queries PNP ISA configuration.\n//\n// Arguments:\n//\n// IsaConfiguration - Receive PNP ISA configuration.\n//\n// BiosSelector - Supplies the selector for the PNP BIOS.\n//\n// Return Value:\n//\n// PNP BIOS status code.\n//\n//--\n\n{\n BL_LEGACY_CALL_CONTEXT Context;\n\n BlRtlZeroMemory(IsaConfiguration, sizeof(PNP_ISA_CONFIGURATION));\n\n IsaConfiguration->Revision = 1;\n\n BlPnpCallFrame[0] = 0x40;\n BlRtlConvertLinearPointerToFarPointer(IsaConfiguration, (PFAR_POINTER) &BlPnpCallFrame[1]);\n BlPnpCallFrame[3] = BiosSelector;\n\n BlRtlZeroMemory(&Context, sizeof(BL_LEGACY_CALL_CONTEXT));\n\n BlRtlCallLegacyFunction(BlPnpBiosInformation->RealModeCodeSegment16,\n BlPnpBiosInformation->RealModeCodeOffset16,\n BlPnpCallFrame,\n 4 * sizeof(UINT16),\n &Context,\n &Context);\n\n return (PNP_STATUS) Context.eax;\n}\n\nPPNP_INSTALLATION_CHECK\nBlPnpLocateBios(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function locates the PNP BIOS by searching the ROM area.\n//\n// Return Value:\n//\n// PNP BIOS installation check structure, if located.\n// NULL, otherwise.\n//\n//--\n\n{\n ULONG_PTR End;\n PPNP_INSTALLATION_CHECK Pnp;\n ULONG_PTR Start;\n\n Start = 0xF0000;\n End = 0x100000;\n\n while (Start != End) {\n\n Pnp = (PPNP_INSTALLATION_CHECK) Start;\n\n if ((Pnp->Signature[0] == '$') &&\n (Pnp->Signature[1] == 'P') &&\n (Pnp->Signature[2] == 'n') &&\n (Pnp->Signature[3] == 'P') &&\n (Pnp->Version == 0x10) &&\n (Pnp->Length == 0x21) &&\n (BlRtlComputeChecksum8(Pnp, Pnp->Length) == 0)\n ) {\n\n return Pnp;\n }\n\n Start += 16;\n }\n\n return NULL;\n}\n\nVOID\nBlPnpInitialize(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes PNP BIOS support.\n//\n//--\n\n{\n UINT8 Handle;\n PPNP_SYSTEM_DEVICE_NODE Node;\n UINT32 NodeListSize;\n UINT32 NodeSize;\n UINT8 NumberOfNodes;\n PPNP_INSTALLATION_CHECK Pnp;\n PNP_STATUS Result;\n\n //\n // Initialize empty node list.\n //\n\n BlPnpSystemDeviceNodeList = NULL;\n BlPnpSystemDeviceNodeListSize = 0;\n\n //\n // Locate PNP BIOS.\n //\n\n Pnp = BlPnpLocateBios();\n\n if (Pnp == NULL) {\n\n#if PNP_VERBOSE\n\n BlRtlPrintf(\"PNP: PNP BIOS not found!\\n\");\n\n#endif\n\n return;\n }\n\n#if PNP_VERBOSE\n\n BlRtlPrintf(\"PNP: PNP BIOS detected @ %p\\n\", Pnp);\n\n#endif\n\n BlPnpBiosInformation = Pnp;\n\n#if PNP_VERBOSE\n\n BlRtlPrintf(\"PNP: Real-Mode Code: %04x:%04x\\n\",\n Pnp->RealModeCodeSegment16,\n Pnp->RealModeCodeOffset16);\n\n BlRtlPrintf(\"PNP: Real-Mode Data: %04x:\\n\", Pnp->RealModeDataSegment16);\n\n#endif\n\n //\n // Build PNP system device node list.\n //\n\n Result = BlPnpGetNumberOfSystemDeviceNodes(&NumberOfNodes,\n &NodeSize,\n Pnp->RealModeDataSegment16);\n\n if (Result != PNP_STATUS_SUCCESS) {\n\n#if PNP_VERBOSE\n\n BlRtlPrintf(\"PNP: BlPnpGetNumberOfSystemDeviceNodes failed with error %04x.\\n\", Result);\n\n#endif\n\n return;\n }\n\n#if PNP_VERBOSE\n\n BlRtlPrintf(\"PNP: %u node(s), %u bytes in largest node.\\n\",\n NumberOfNodes,\n NodeSize);\n\n#endif\n\n if (NumberOfNodes == 0) {\n return;\n }\n\n Node = (PPNP_SYSTEM_DEVICE_NODE) BlPoolAllocateBlock(NodeSize);\n\n NodeListSize = 0;\n\n Handle = 0;\n\n for (;;) {\n\n BlRtlZeroMemory(Node, sizeof(*Node));\n\n Result = BlPnpGetSystemDeviceNode(&Handle,\n Node,\n NodeSize,\n 1,\n Pnp->RealModeDataSegment16);\n\n if (Result != PNP_STATUS_SUCCESS) {\n\n#if PNP_VERBOSE\n\n BlRtlPrintf(\"PNP: BlPnpGetSystemDeviceNode failed with error %04x.\\n\", Result);\n\n#endif\n\n BlPoolFreeBlock(Node);\n\n return;\n }\n\n NodeListSize += Node->Size;\n\n if (Handle == PNP_NO_MORE_NODES) {\n\n break;\n }\n }\n\n BlPnpSystemDeviceNodeList = (PPNP_SYSTEM_DEVICE_NODE)BlPoolAllocateBlock(NodeListSize);\n BlPnpSystemDeviceNodeListSize = NodeListSize;\n\n Node = BlPnpSystemDeviceNodeList;\n\n Handle = 0;\n\n for (;;) {\n\n BlRtlZeroMemory(Node, sizeof(*Node));\n\n Result = BlPnpGetSystemDeviceNode(&Handle,\n Node,\n NodeSize,\n 1,\n Pnp->RealModeDataSegment16);\n\n if (Result != PNP_STATUS_SUCCESS) {\n\n BlRtlPrintf(\"PNP: BlPnpGetSystemDeviceNode failed with error %04x.\\n\", Result);\n BlRtlHalt();\n }\n\n if (Handle == PNP_NO_MORE_NODES) {\n\n break;\n }\n\n Node = (PPNP_SYSTEM_DEVICE_NODE) (((ULONG_PTR) Node) + Node->Size);\n NodeSize -= Node->Size;\n }\n\n#if PNP_VERBOSE\n\n BlRtlPrintf(\"PNP: DeviceNodeList: %p ... %p\\n\",\n BlPnpSystemDeviceNodeList,\n (ULONG_PTR) BlPnpSystemDeviceNodeList + BlPnpSystemDeviceNodeListSize - 1);\n\n#endif\n\n //\n // Query PNP ISA configuration.\n //\n\n BlPnpGetIsaConfiguration(&BlPnpIsaConfiguration, Pnp->RealModeDataSegment16);\n\n#if PNP_VERBOSE\n\n BlRtlPrintf(\"PNP: ISA Configuration:\\n\"\n \"PNP: Revision : %u\\n\"\n \"PNP: # of Card Select Numbers : %u\\n\"\n \"PNP: Data read port : %04x\\n\",\n BlPnpIsaConfiguration.Revision,\n BlPnpIsaConfiguration.NumberOfCardSelectNumbers,\n BlPnpIsaConfiguration.DataReadPort);\n\n#endif\n\n return;\n}\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blpool.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blpool.cpp\n//\n// Abstract:\n//\n// This module implements pool support for the boot loader environment.\n//\n//--\n\n#include \"bl.h\"\n\n#define BL_POOL_FREE 1\n#define BL_POOL_BUSY 2\n\n#define BL_POOL_GRANULARITY 256\n\nC_ASSERT((BL_POOL_GRANULARITY & (BL_POOL_GRANULARITY - 1)) == 0);\n\n#define BL_POOL_ROUND_UP(X) ROUND_UP_TO_POWER2(X, BL_POOL_GRANULARITY)\n\n#define BL_POOL_SEGMENT_SIZE (8 * PAGE_SIZE)\n\nC_ASSERT((BL_POOL_SEGMENT_SIZE & (BL_POOL_SEGMENT_SIZE - 1)) == 0);\n\n#define BL_POOL_SEGMENT_ROUND_UP(X) ((X + (BL_POOL_SEGMENT_SIZE - 1)) & (~(BL_POOL_SEGMENT_SIZE - 1)))\n\n#if defined(BOOT_X86)\n\n#define BL_POOL_BLOCK_MAGIC1 0x01020304\n#define BL_POOL_BLOCK_MAGIC2 0x05060708\n\n#elif defined(BOOT_X64)\n\n#define BL_POOL_BLOCK_MAGIC1 0x0102030405060708UI64\n#define BL_POOL_BLOCK_MAGIC2 0x090A0B0C0D0E0F10UI64\n\n#endif\n\ntypedef struct _BL_POOL_BLOCK {\n ULONG_PTR Magic1;\n LIST_ENTRY Entry;\n ULONG_PTR Size;\n ULONG_PTR State;\n PVOID Allocator;\n ULONG_PTR Pad;\n ULONG_PTR Magic2;\n} BL_POOL_BLOCK, *PBL_POOL_BLOCK;\n\nC_ASSERT((sizeof(BL_POOL_BLOCK) % 16) == 0);\n\n#if defined(BOOT_X86)\n\n#define BL_POOL_SEGMENT_MAGIC1 0xFFFEFDFC\n#define BL_POOL_SEGMENT_MAGIC2 0xFBFAF9F8\n\n#elif defined(BOOT_X64)\n\n#define BL_POOL_SEGMENT_MAGIC1 0xFFFEFDFCFBFAF9F8UI64\n#define BL_POOL_SEGMENT_MAGIC2 0xF7F6F5F4F3F2F1F0UI64\n\n#endif\n\ntypedef struct _BL_POOL_SEGMENT {\n ULONG_PTR Magic1;\n LIST_ENTRY Entry;\n ULONG_PTR Size;\n ULONG_PTR Start;\n ULONG_PTR Limit;\n LIST_ENTRY BlockList;\n ULONG_PTR Magic2;\n} BL_POOL_SEGMENT, *PBL_POOL_SEGMENT;\n\nLIST_ENTRY BlPoolSegmentList;\n\nVOID\nBlPoolInitialize(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes boot loader pool.\n//\n//--\n\n{\n BlRtlInitializeListHead(&BlPoolSegmentList);\n\n#if POOL_VERBOSE\n\n BlRtlPrintf(\"POOL: Segment list @ %p.\\n\", &BlPoolSegmentList);\n\n#endif\n\n return;\n}\n\n#if DEBUG\n\nVOID\nBlPoolDump(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function dumps boot loader pool.\n//\n//--\n\n{\n PBL_POOL_BLOCK Block;\n PLIST_ENTRY BlockEntry;\n PLIST_ENTRY BlockHead;\n PBL_POOL_SEGMENT Segment;\n PLIST_ENTRY SegmentEntry;\n PLIST_ENTRY SegmentHead;\n\n BlRtlPrintf(\"POOL: BlDumpPool: \\n\");\n\n SegmentHead = &BlPoolSegmentList;\n\n for (SegmentEntry = SegmentHead->Flink; SegmentEntry != SegmentHead; SegmentEntry = SegmentEntry->Flink) {\n\n Segment = CONTAINING_RECORD(SegmentEntry,\n BL_POOL_SEGMENT,\n Entry);\n\n BlRtlPrintf(\"POOL: BlDumpPool: Segment @ %p\\n\", Segment);\n\n BlockHead = &Segment->BlockList;\n\n for (BlockEntry = BlockHead->Flink; BlockEntry != BlockHead; BlockEntry = BlockEntry->Flink) {\n\n Block = CONTAINING_RECORD(BlockEntry,\n BL_POOL_BLOCK,\n Entry);\n\n BlRtlPrintf(\"POOL: BlDumpPool: Entry %p ... %p [%u]\\n\",\n Block,\n (ULONG_PTR) Block + Block->Size,\n Block->State);\n }\n }\n\n BlRtlPrintf(\"pool: BlDumpPool: \\n\");\n\n return;\n}\n\n#endif\n\nVOID\nBlPoolVerify(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function verifies boot loader pool.\n//\n//--\n\n{\n PBL_POOL_BLOCK Block;\n PLIST_ENTRY BlockEntry;\n PLIST_ENTRY BlockHead;\n PBL_POOL_BLOCK NextBlock;\n PBL_POOL_SEGMENT Segment;\n PLIST_ENTRY SegmentEntry;\n PLIST_ENTRY SegmentHead;\n\n SegmentHead = &BlPoolSegmentList;\n\n BLASSERT(SegmentHead->Flink->Blink == SegmentHead);\n BLASSERT(SegmentHead->Blink->Flink == SegmentHead);\n\n for (SegmentEntry = SegmentHead->Flink; SegmentEntry != SegmentHead; SegmentEntry = SegmentEntry->Flink) {\n\n Segment = CONTAINING_RECORD(SegmentEntry,\n BL_POOL_SEGMENT,\n Entry);\n\n BLASSERT_PTR(Segment->Magic1 == BL_POOL_SEGMENT_MAGIC1, Segment);\n BLASSERT_PTR(Segment->Magic2 == BL_POOL_SEGMENT_MAGIC2, Segment);\n\n BLASSERT_PTR(Segment->Entry.Flink->Blink == &Segment->Entry, Segment);\n BLASSERT_PTR(Segment->Entry.Blink->Flink == &Segment->Entry, Segment);\n\n\n BlockHead = &Segment->BlockList;\n\n for (BlockEntry = BlockHead->Flink; BlockEntry != BlockHead; BlockEntry = BlockEntry->Flink) {\n\n Block = CONTAINING_RECORD(BlockEntry,\n BL_POOL_BLOCK,\n Entry);\n\n BLASSERT_PTR(Block->Magic1 == BL_POOL_BLOCK_MAGIC1, Block);\n BLASSERT_PTR(Block->Magic2 == BL_POOL_BLOCK_MAGIC2, Block);\n\n BLASSERT_PTR((Block->State == BL_POOL_FREE) || ((Block->State == BL_POOL_BUSY)), Block);\n\n BLASSERT_PTR(((ULONG_PTR) Block % BL_POOL_GRANULARITY) == 0, Block);\n\n BLASSERT_PTR(Block->Size > sizeof(BL_POOL_BLOCK), Block);\n BLASSERT_PTR((Block->Size % BL_POOL_GRANULARITY) == 0, Block);\n\n if (Block->Entry.Flink != BlockHead) {\n\n NextBlock = CONTAINING_RECORD(Block->Entry.Flink,\n BL_POOL_BLOCK,\n Entry);\n\n BLASSERT_PTR(((ULONG_PTR) Block + Block->Size) == ((ULONG_PTR) NextBlock), Block);\n }\n\n BLASSERT_PTR(Block->Entry.Flink->Blink == &Block->Entry, Block);\n BLASSERT_PTR(Block->Entry.Blink->Flink == &Block->Entry, Block);\n }\n }\n\n return;\n}\n\nVOID\nBlPoolGrow(\n UINT32 Size\n )\n\n//++\n//\n// Routine Description:\n//\n// This function grows the pool.\n//\n// Arguments:\n//\n// Size - Supplies the growth size.\n//\n//--\n\n{\n PBL_POOL_BLOCK Block;\n PBL_POOL_SEGMENT Segment;\n\n BlPoolVerify();\n\n BLASSERT(Size > 0);\n\n Size = ROUND_UP_TO_PAGES(Size);\n\n Segment = (PBL_POOL_SEGMENT) (ULONG_PTR) BlMmAllocatePhysicalRegion(Size, BL_MM_PHYSICAL_REGION_BOOT_LOADER);\n\n BlRtlZeroMemory(Segment, Size);\n\n Segment->Magic1 = BL_POOL_SEGMENT_MAGIC1;\n Segment->Magic2 = BL_POOL_SEGMENT_MAGIC2;\n Segment->Start = (ULONG_PTR) Segment;\n Segment->Size = Size;\n Segment->Limit = Segment->Start + Segment->Size;\n BlRtlInitializeListHead(&Segment->BlockList);\n\n Block = (PBL_POOL_BLOCK) (BL_POOL_ROUND_UP(((ULONG_PTR) (Segment + 1))));\n Block->Magic1 = BL_POOL_BLOCK_MAGIC1;\n Block->Magic2 = BL_POOL_BLOCK_MAGIC2;\n Block->Size = Segment->Limit - (ULONG_PTR) Block;\n Block->State = BL_POOL_FREE;\n Block->Allocator = NULL;\n\n BlRtlInsertTailList(&Segment->BlockList, &Block->Entry);\n\n BlRtlInsertTailList(&BlPoolSegmentList, &Segment->Entry);\n\n BlPoolVerify();\n\n return;\n}\n\nPVOID\nBlPoolAllocateBlock(\n UINT32 Size\n )\n\n//++\n//\n// Routine Description:\n//\n// This function allocates from the boot loader pool.\n//\n// Arguments:\n//\n// Size - Supplies the number of bytes to allocate.\n//\n// Return Value:\n//\n// A pointer to the allocated buffer.\n//\n//--\n\n{\n PBL_POOL_BLOCK Block;\n PLIST_ENTRY BlockEntry;\n PLIST_ENTRY BlockHead;\n UINT32 GrowthSize;\n PBL_POOL_BLOCK NewBlock;\n PBL_POOL_SEGMENT Segment;\n PLIST_ENTRY SegmentEntry;\n PLIST_ENTRY SegmentHead;\n\n BlPoolVerify();\n\n BLASSERT(Size > 0);\n\n Size += sizeof(BL_POOL_BLOCK);\n Size = BL_POOL_ROUND_UP(Size);\n\n SegmentHead = &BlPoolSegmentList;\n\n for (;;) {\n\n for (SegmentEntry = SegmentHead->Flink; SegmentEntry != SegmentHead; SegmentEntry = SegmentEntry->Flink) {\n\n Segment = CONTAINING_RECORD(SegmentEntry,\n BL_POOL_SEGMENT,\n Entry);\n\n BlockHead = &Segment->BlockList;\n\n for (BlockEntry = BlockHead->Flink; BlockEntry != BlockHead; BlockEntry = BlockEntry->Flink) {\n\n Block = CONTAINING_RECORD(BlockEntry,\n BL_POOL_BLOCK,\n Entry);\n\n if ((Block->State == BL_POOL_FREE) && (Block->Size >= Size)) {\n\n if (Block->Size > Size) {\n\n NewBlock = (PBL_POOL_BLOCK) ((ULONG_PTR) Block + Size);\n\n BlRtlZeroMemory(NewBlock, sizeof(BL_POOL_BLOCK));\n\n NewBlock->Magic1 = BL_POOL_BLOCK_MAGIC1;\n NewBlock->Magic2 = BL_POOL_BLOCK_MAGIC2;\n NewBlock->Size = Block->Size - Size;\n NewBlock->State = BL_POOL_FREE;\n NewBlock->Allocator = NULL;\n\n BlRtlInsertHeadList(&Block->Entry, &NewBlock->Entry);\n\n Block->Size = Size;\n }\n\n Block->State = BL_POOL_BUSY;\n Block->Allocator = _ReturnAddress();\n\n BlRtlZeroMemory(Block + 1, Block->Size - sizeof(BL_POOL_BLOCK));\n\n BlPoolVerify();\n\n return (Block + 1);\n }\n }\n }\n\n GrowthSize = BL_POOL_SEGMENT_ROUND_UP(Size);\n\n BlPoolGrow(GrowthSize);\n }\n}\n\nVOID\nBlPoolFreeBlock(\n PVOID P\n )\n\n//++\n//\n// Routine Description:\n//\n// This function frees the specified pool block.\n//\n// Arguments:\n//\n// P - Supplies a pointer to the block to free.\n//\n//--\n\n{\n PBL_POOL_BLOCK Block;\n\n BlPoolVerify();\n\n BLASSERT(((ULONG_PTR) P % __alignof(BL_POOL_BLOCK)) == 0);\n\n Block = ((PBL_POOL_BLOCK) P) - 1;\n\n BLASSERT(((ULONG_PTR) Block % BL_POOL_GRANULARITY) == 0);\n\n BLASSERT(Block->State == BL_POOL_BUSY);\n\n Block->State = BL_POOL_FREE;\n Block->Allocator = NULL;\n\n //\n // AIFIX: Check for adjacent free blocks and coalesce.\n //\n\n BlPoolVerify();\n\n return;\n}\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blpxe.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blpxe.cpp\n//\n// Abstract:\n//\n// This module implements PXE support for the boot loader.\n//\n//--\n\n#include \"bl.h\"\n\n#pragma pack(1)\n\ntypedef struct _IP_ADDRESS {\n union {\n UINT32 Value;\n UINT8 Array[4];\n };\n} IP_ADDRESS, *PIP_ADDRESS;\n\n#define DHCP_OPTION_CODE_PAD 0\n#define DHCP_OPTION_CODE_COMMAND_LINE 8\n\ntypedef struct _DHCP_OPTION_HEADER {\n UINT8 Code;\n UINT8 Length;\n} DHCP_OPTION_HEADER, *PDHCP_OPTION_HEADER;\n\n#define BOOTP_REPLY_OPCODE_REPLY 2\n\ntypedef struct _BOOTP_REPLY {\n UINT8 OpCode;\n UINT8 HardwareAddressType;\n UINT8 HardwareAddressLength;\n UINT8 Hops;\n UINT32 TransactionId;\n UINT16 SecondsSinceAddressAcquisition;\n UINT16 Flags;\n IP_ADDRESS ClientIP;\n IP_ADDRESS YourIP;\n IP_ADDRESS ServerIP;\n IP_ADDRESS GatewayIP;\n UINT8 ClientMAC[16];\n UINT8 ServerHostName[64];\n UINT8 BootFileName[128];\n UINT8 Magic[4];\n UINT8 Data[1500];\n} BOOTP_REPLY, *PBOOTP_REPLY;\n\ntypedef struct _PXE_INSTALLATION_CHECK {\n UINT8 Signature[6];\n UINT16 Version;\n UINT8 Length;\n UINT8 Checksum;\n FAR_POINTER RealModeEntry;\n UINT32 ProtectedModeEntry;\n UINT16 ProtectedModeSelector;\n UINT16 StackSegment;\n UINT16 StackSize;\n UINT16 BCCodeSegment;\n UINT16 BCCodeSize;\n UINT16 BCDataSegment;\n UINT16 BCDataSize;\n UINT16 UNDIDataSegment;\n UINT16 UNDIDataSize;\n UINT16 UNDICodeSegment;\n UINT16 UNDICOdeSize;\n FAR_POINTER ExtendedInformation;\n} PXE_INSTALLATION_CHECK, *PPXE_INSTALLATION_CHECK;\n\nC_ASSERT(sizeof(PXE_INSTALLATION_CHECK) == 0x2C);\n\ntypedef struct _PXE_SEGMENT_DESCRIPTOR {\n UINT16 Selector;\n UINT32 Base;\n UINT16 Size;\n} PXE_SEGMENT_DESCRIPTOR, *PPXE_SEGMENT_DESCRIPTOR;\n\nC_ASSERT(sizeof(PXE_SEGMENT_DESCRIPTOR) == 8);\n\ntypedef struct _PXE_EXTENDED_INFORMATION {\n UINT8 Signature[4];\n UINT8 Length;\n UINT8 Checksum;\n UINT8 Version;\n UINT8 Reserved1;\n FAR_POINTER UNDIROMID;\n FAR_POINTER BaseROMID;\n FAR_POINTER Entry16;\n FAR_POINTER Entry32;\n FAR_POINTER StatusCallout;\n UINT8 Reserved2;\n UINT8 SegmentDescriptorCount;\n UINT16 FirstSelector;\n PXE_SEGMENT_DESCRIPTOR Stack;\n PXE_SEGMENT_DESCRIPTOR UNDIData;\n PXE_SEGMENT_DESCRIPTOR UNDICode;\n PXE_SEGMENT_DESCRIPTOR UNDICodeWrite;\n PXE_SEGMENT_DESCRIPTOR BCData;\n PXE_SEGMENT_DESCRIPTOR BCCode;\n PXE_SEGMENT_DESCRIPTOR BCCOdeWrite;\n} PXE_EXTENDED_INFORMATION, *PPXE_EXTENDED_INFORMATION;\n\nC_ASSERT(sizeof(PXE_EXTENDED_INFORMATION) == 0x58);\n\n#define PXE_STATUS_SUCCESS 0\n\ntypedef UINT16 PXE_STATUS;\n\n#define PXE_OPCODE_TFTP_READ_FILE 0x0023\n#define PXE_OPCODE_TFTP_GET_FILE_SIZE 0x0025\n#define PXE_OPCODE_GET_CACHED_INFO 0x0071\n\n#define PXE_PACKET_TYPE_DHCP_ACK 2\n#define PXE_PACKET_TYPE_CACHED_REPLY 3\n\ntypedef struct _PXE_GET_CACHED_INFO {\n PXE_STATUS Status;\n UINT16 PacketType;\n UINT16 BufferSize;\n FAR_POINTER Buffer;\n UINT16 BufferLimit;\n} PXE_GET_CACHED_INFO, *PPXE_GET_CACHED_INFO;\n\ntypedef struct _PXE_TFTP_GET_FILE_SIZE {\n PXE_STATUS Status;\n IP_ADDRESS ServerIP;\n IP_ADDRESS GatewayIP;\n UINT8 FileName[128];\n UINT32 FileSize;\n} PXE_TFTP_GET_FILE_SIZE, *PPXE_TFTP_GET_FILE_SIZE;\n\n#define PXE_TFTP_READ_FILE_RETRY_COUNT 5\n\ntypedef struct _PXE_TFTP_READ_FILE {\n PXE_STATUS Status;\n UINT8 FileName[128];\n UINT32 BufferSize;\n UINT32 Buffer;\n IP_ADDRESS ServerIP;\n IP_ADDRESS GatewayIP;\n IP_ADDRESS MulticastIP;\n UINT16 ClientMulticastPort;\n UINT16 ServerMulticastPort;\n UINT16 OpenTimeout;\n UINT16 ReopenDelay;\n} PXE_TFTP_READ_FILE, *PPXE_TFTP_READ_FILE;\n\ntypedef struct _PXE_API_PACKET {\n union {\n PXE_GET_CACHED_INFO GetCachedInfo;\n PXE_TFTP_GET_FILE_SIZE TFTPGetFileSize;\n PXE_TFTP_READ_FILE TFTPReadFile;\n } u1;\n} PXE_API_PACKET, *PPXE_API_PACKET;\n\n#pragma pack()\n\nPXE_API_PACKET BlPxeApiPacket;\nBOOTP_REPLY BlPxeBootpReply;\nUINT16 BlPxeCallFrame[16];\nFAR_POINTER BlPxeEntry16;\nPPXE_EXTENDED_INFORMATION BlPxeExtendedInformation;\nPPXE_INSTALLATION_CHECK BlPxeInstallationCheck;\n\nVOID\nBlPxeCallPxeApi(\n UINT16 OpCode,\n PVOID Packet\n )\n\n//++\n//\n// Routine Description:\n//\n// This function calls the PXE API.\n//\n// Arguments:\n//\n// OpCode - Supplies the operation to perform.\n//\n// Packet - Supplies a pointer to te packet describing the operation details.\n//\n//--\n\n{\n BL_LEGACY_CALL_CONTEXT Context;\n FAR_POINTER FarPointer;\n\n BlRtlZeroMemory(&Context, sizeof(BL_LEGACY_CALL_CONTEXT));\n\n if (BlPxeExtendedInformation != NULL) {\n\n BlPxeCallFrame[0] = OpCode;\n BlRtlConvertLinearPointerToFarPointer(Packet, (PFAR_POINTER) &BlPxeCallFrame[1]);\n\n BlRtlCallLegacyFunction(BlPxeExtendedInformation->Entry16.Segment,\n BlPxeExtendedInformation->Entry16.Offset,\n BlPxeCallFrame,\n 3 * sizeof(UINT16),\n &Context,\n &Context);\n\n } else {\n\n BlRtlConvertLinearPointerToFarPointer(Packet, &FarPointer);\n\n Context.ebx = OpCode;\n Context.es = FarPointer.Segment;\n Context.edi = FarPointer.Offset;\n\n BlRtlCallLegacyFunction(BlPxeInstallationCheck->RealModeEntry.Segment,\n BlPxeInstallationCheck->RealModeEntry.Offset,\n NULL,\n 0,\n &Context,\n &Context);\n }\n\n return;\n}\n\nVOID\nBlPxeGetBootpReply(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function gets the BOOTP reply received by PXE.\n//\n//--\n\n{\n PPXE_GET_CACHED_INFO GetCachedInfo;\n UINT32 Index;\n ULONG_PTR Limit;\n ULONG_PTR Next;\n PDHCP_OPTION_HEADER Option;\n\n GetCachedInfo = &BlPxeApiPacket.u1.GetCachedInfo;\n\n //\n // Get the discover reply packet received from the boot server.\n //\n\n BlRtlZeroMemory(GetCachedInfo, sizeof(PXE_GET_CACHED_INFO));\n GetCachedInfo->PacketType = PXE_PACKET_TYPE_CACHED_REPLY;\n BlRtlConvertLinearPointerToFarPointer(&BlPxeBootpReply, &GetCachedInfo->Buffer);\n GetCachedInfo->BufferSize = sizeof(BlPxeBootpReply);\n\n BlPxeCallPxeApi(PXE_OPCODE_GET_CACHED_INFO, GetCachedInfo);\n\n if (GetCachedInfo->Status != PXE_STATUS_SUCCESS) {\n\n BlRtlPrintf(\"PXE: Get PXE_REPLY failed: 0x%04x!\\n\", GetCachedInfo->Status);\n BlRtlHalt();\n }\n\n //\n // If the discover reply packet does not have the BOOTP reply opcode, then get the DHCP ACK packet.\n //\n\n if (BlPxeBootpReply.OpCode != BOOTP_REPLY_OPCODE_REPLY) {\n\n BlRtlZeroMemory(GetCachedInfo, sizeof(PXE_GET_CACHED_INFO));\n GetCachedInfo->PacketType = PXE_PACKET_TYPE_DHCP_ACK;\n BlRtlConvertLinearPointerToFarPointer(&BlPxeBootpReply, &GetCachedInfo->Buffer);\n GetCachedInfo->BufferSize = sizeof(BlPxeBootpReply);\n\n BlPxeCallPxeApi(PXE_OPCODE_GET_CACHED_INFO, GetCachedInfo);\n\n if (GetCachedInfo->Status != PXE_STATUS_SUCCESS) {\n\n BlRtlPrintf(\"PXE: Get DHCP_ACK failed 0x%04x!\\n\", GetCachedInfo->Status);\n BlRtlHalt();\n }\n }\n\n //\n // If neither discover reply packet nor the DHCP ACK packet contains the BOOTP reply opcode, then PXE boot is not possible.\n //\n\n if (BlPxeBootpReply.OpCode != BOOTP_REPLY_OPCODE_REPLY) {\n\n BlRtlPrintf(\"PXE: Invalid BOOTP_REPLY packet!\\n\");\n BlRtlHalt();\n }\n\n#if PXE_VERBOSE\n\n BlRtlPrintf(\"PXE: IP=%u.%u.%u.%u DHCP=%u.%u.%u.%u GATEWAY=%u.%u.%u.%u\\n\",\n BlPxeBootpReply.ClientIP.Array[0],\n BlPxeBootpReply.ClientIP.Array[1],\n BlPxeBootpReply.ClientIP.Array[2],\n BlPxeBootpReply.ClientIP.Array[3],\n BlPxeBootpReply.ServerIP.Array[0],\n BlPxeBootpReply.ServerIP.Array[1],\n BlPxeBootpReply.ServerIP.Array[2],\n BlPxeBootpReply.ServerIP.Array[3],\n BlPxeBootpReply.GatewayIP.Array[0],\n BlPxeBootpReply.GatewayIP.Array[1],\n BlPxeBootpReply.GatewayIP.Array[2],\n BlPxeBootpReply.GatewayIP.Array[3]\n );\n\n#endif\n\n Limit = ((ULONG_PTR) &BlPxeBootpReply) + GetCachedInfo->BufferSize;\n Next = (ULONG_PTR) (&BlPxeBootpReply.Data);\n\n while (Next < Limit) {\n\n Option = (PDHCP_OPTION_HEADER) Next;\n\n switch (Option->Code) {\n\n case DHCP_OPTION_CODE_PAD: {\n\n Next += 1;\n\n break;\n }\n\n case DHCP_OPTION_CODE_COMMAND_LINE: {\n\n if (((Next + sizeof(DHCP_OPTION_HEADER)) < Limit) &&\n ((Next + sizeof(DHCP_OPTION_HEADER) + Option->Length) < Limit)) {\n\n BlCommandLine = (PWCHAR)BlPoolAllocateBlock((Option->Length + 1) * sizeof(WCHAR));\n\n for (Index = 0; Index < Option->Length; Index += 1) {\n\n BlCommandLine[Index] = (WCHAR) (((PCHAR) (Option + 1))[Index]);\n }\n\n BlCommandLine[Option->Length] = 0;\n\n#if PXE_VERBOSE\n\n BlRtlPrintf(\"PXE: CMD=[%s]\\n\", BlCommandLine);\n\n#endif\n }\n\n Next = Limit;\n\n break;\n }\n\n default: {\n\n Next += (sizeof(DHCP_OPTION_HEADER) + Option->Length);\n }\n }\n }\n\n return;\n}\n\nBOOLEAN\nBlPxeGetFileSize(\n PCSTR Path,\n PUINT32 FileSize\n )\n\n//++\n//\n// Routine Description:\n//\n// This function queries the size of the specified file.\n//\n// Arguments:\n//\n// Path - Supplies the path to the file to query.\n//\n// FileSize - Receives the size of the file.\n//\n// Return Value:\n//\n// TRUE, if the query operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n PPXE_TFTP_GET_FILE_SIZE GetFileSize;\n UINT32 PathLength;\n\n GetFileSize = &BlPxeApiPacket.u1.TFTPGetFileSize;\n\n BlRtlZeroMemory(GetFileSize, sizeof(PXE_TFTP_GET_FILE_SIZE));\n\n PathLength = BlRtlStringLength(Path);\n\n if (PathLength >= sizeof(GetFileSize->FileName)) {\n\n return FALSE;\n\n }\n\n GetFileSize->ServerIP = BlPxeBootpReply.ServerIP;\n GetFileSize->GatewayIP = BlPxeBootpReply.GatewayIP;\n\n BlRtlCopyMemory(GetFileSize->FileName, Path, PathLength);\n\n GetFileSize->FileName[PathLength] = 0;\n\n BlPxeCallPxeApi(PXE_OPCODE_TFTP_GET_FILE_SIZE, GetFileSize);\n\n if (GetFileSize->Status != PXE_STATUS_SUCCESS) {\n\n return FALSE;\n }\n\n *FileSize = GetFileSize->FileSize;\n\n return TRUE;\n}\n\nBOOLEAN\nBlPxeReadFile(\n PCSTR Path,\n PVOID Buffer,\n UINT32 NumberOfBytes\n )\n\n//++\n//\n// Routine Description:\n//\n// This function reads from the specified file.\n//\n// Arguments:\n//\n// Path - Supplies the path to the file to read.\n//\n// Buffer - Receives data.\n//\n// NumberOfBytes - Supplies the number of bytes to read.\n//\n// Return Value:\n//\n// TRUE, if the read operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT32 Index;\n UINT32 PathLength;\n PPXE_TFTP_READ_FILE ReadFile;\n\n BLASSERT((((ULONG_PTR) Buffer) + NumberOfBytes) > ((ULONG_PTR) Buffer));\n\n BLASSERT((((ULONG_PTR) Buffer) + NumberOfBytes) <= 0xFFFFFFFF);\n\n ReadFile = &BlPxeApiPacket.u1.TFTPReadFile;\n\n PathLength = BlRtlStringLength(Path);\n\n if (PathLength >= sizeof(ReadFile->FileName)) {\n\n#if PXE_VERBOSE\n\n BlRtlPrintf(\"PXE: Path is too long [%s]\\n\", Path);\n\n#endif\n\n return FALSE;\n }\n\n for (Index = 0; Index < PXE_TFTP_READ_FILE_RETRY_COUNT; Index += 1) {\n\n BlRtlZeroMemory(ReadFile, sizeof(PXE_TFTP_READ_FILE));\n\n BlRtlCopyMemory(ReadFile->FileName,\n Path,\n PathLength);\n\n ReadFile->FileName[PathLength] = 0;\n\n ReadFile->BufferSize = NumberOfBytes;\n ReadFile->Buffer = (UINT32) (ULONG_PTR) Buffer;\n ReadFile->ServerIP = BlPxeBootpReply.ServerIP;\n ReadFile->GatewayIP = BlPxeBootpReply.GatewayIP;\n\n BlPxeCallPxeApi(PXE_OPCODE_TFTP_READ_FILE, ReadFile);\n\n if (ReadFile->Status == PXE_STATUS_SUCCESS) {\n\n break;\n }\n\n#if PXE_VERBOSE\n\n BlRtlPrintf(\"PXE: TFTP_READ failed: 0x%04x! [%u / %u]\\n\",\n ReadFile->Status,\n Index + 1,\n PXE_TFTP_READ_FILE_RETRY_COUNT);\n\n#endif\n\n }\n\n return TRUE;\n}\n\nVOID\nBlPxeInitialize(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes PXE support.\n//\n//--\n\n{\n BL_LEGACY_CALL_CONTEXT Context;\n FAR_POINTER FarPointer;\n PPXE_INSTALLATION_CHECK InstallationCheck;\n ULONG_PTR Limit;\n ULONG_PTR Next;\n\n BlRtlZeroMemory(&Context, sizeof(Context));\n\n Context.eax = 0x5650;\n\n BlRtlCallLegacyInterruptService(0x1A,\n &Context,\n &Context);\n\n if (((Context.eflags & RFLAGS_CF) == 0) && ((Context.eax & 0xFFFF) == 0x564E)) {\n\n FarPointer.Segment = (UINT16) Context.es;\n FarPointer.Offset = (UINT16) (Context.ebx & 0xFFFF);\n\n#if PXE_VERBOSE\n\n BlRtlPrintf(\"PXE: INT1A/5650h => [ES:BX = %04x:%04x]\\n\",\n FarPointer.Segment,\n FarPointer.Offset);\n\n#endif\n\n BlPxeInstallationCheck = (PPXE_INSTALLATION_CHECK)\n BlRtlConvertFarPointerToLinearPointer(&FarPointer);\n\n } else {\n\n Next = 0xA0000;\n Limit = 0x10000;\n\n BlPxeInstallationCheck = NULL;\n\n do {\n\n Next -= 16;\n\n InstallationCheck = (PPXE_INSTALLATION_CHECK) Next;\n\n if ((InstallationCheck->Length >= sizeof(PXE_INSTALLATION_CHECK)) &&\n (InstallationCheck->Signature[0] == 'P') &&\n (InstallationCheck->Signature[1] == 'X') &&\n (InstallationCheck->Signature[2] == 'E') &&\n (InstallationCheck->Signature[3] == 'N') &&\n (InstallationCheck->Signature[4] == 'V') &&\n (InstallationCheck->Signature[5] == '+') &&\n (BlRtlComputeChecksum8(InstallationCheck, InstallationCheck->Length) == 0)) {\n\n BlPxeInstallationCheck = InstallationCheck;\n\n break;\n }\n\n } while (Next > Limit);\n }\n\n if (BlPxeInstallationCheck == NULL) {\n\n BlRtlPrintf(\"PXE: Unable to find PXE!\\n\");\n BlRtlHalt();\n }\n\n if (BlPxeInstallationCheck->Version < 0x201) {\n\n#if PXE_VERBOSE\n\n BlRtlPrintf(\"PXE: Using PXENV+.\\n\");\n\n#endif\n\n BlPxeEntry16 = BlPxeInstallationCheck->RealModeEntry;\n\n } else {\n\n#if PXE_VERBOSE\n\n BlRtlPrintf(\"PXE: Using !PXE.\\n\");\n\n#endif\n\n BlPxeExtendedInformation = (PPXE_EXTENDED_INFORMATION)\n BlRtlConvertFarPointerToLinearPointer(&BlPxeInstallationCheck->ExtendedInformation);\n\n if (!((BlPxeExtendedInformation->Length >= sizeof(PXE_EXTENDED_INFORMATION)) &&\n (BlPxeExtendedInformation->Signature[0] == '!') &&\n (BlPxeExtendedInformation->Signature[1] == 'P') &&\n (BlPxeExtendedInformation->Signature[2] == 'X') &&\n (BlPxeExtendedInformation->Signature[3] == 'E') &&\n (BlRtlComputeChecksum8(BlPxeExtendedInformation, BlPxeExtendedInformation->Length) == 0))) {\n\n BlRtlPrintf(\"PXE: !PXE is invalid!\\n\");\n BlRtlHalt();\n }\n\n BlPxeEntry16 = BlPxeExtendedInformation->Entry16;\n }\n\n#if PXE_VERBOSE\n\n BlRtlPrintf(\"PXE: PXENV+ @ %p\\n\"\n \"PXE: !PXE @ %p\\n\"\n \"PXE: Entry16 @ %04x:%04x\\n\",\n BlPxeInstallationCheck,\n BlPxeExtendedInformation,\n BlPxeEntry16.Segment,\n BlPxeEntry16.Offset);\n\n#endif\n\n BlPxeGetBootpReply();\n\n BlFsGetFileSize = BlPxeGetFileSize;\n BlFsReadFile = BlPxeReadFile;\n\n return;\n}\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blsingularity.cpp", "content": "//-++\n//-\n//- Copyright (c) Microsoft Corporation\n//-\n//- Module Name:\n//-\n//- blsingularity.cpp\n//-\n//- Abstract:\n//-\n//- This module initializes and boots Singularity.\n//-\n//--\n\n\n#include \"bl.h\"\n#include \"tpm/aik.h\"\n\n#define SINGULARITY_DISTRO_INI_PATH \"safeos/boot.ini\"\n#define SINGULARITY_LOG_RECORD_SIZE 0x20000\n#define SINGULARITY_LOG_TEXT_SIZE 0x20000\n#define SINGULARITY_KERNEL_STACK_SIZE 0xC0000\n\n//-\n//- Define halclass style basic definitions and macros.\n//-\n\ntypedef ULONG_PTR PTR_TYPE;\n\ntypedef LONG_PTR SPTR_TYPE;\ntypedef ULONG_PTR UPTR_TYPE;\n\n#define OFFSETOF FIELD_OFFSET\n\n#define STATIC_ASSERT C_ASSERT\n\n//-\n//- Include halclasswin.h for Singularity definitions.\n//-\n\n#define SINGULARITY_LOADER 1\n\n#pragma pack(1)\n#include \"platform.h\"\n#pragma pack()\n\nC_ASSERT(FIELD_OFFSET(Struct_Microsoft_Singularity_Isal_IX_DescriptorTable_Gdt, rc) == RM_CODE_SELECTOR);\nC_ASSERT(FIELD_OFFSET(Struct_Microsoft_Singularity_Isal_IX_DescriptorTable_Gdt, rd) == RM_DATA_SELECTOR);\nC_ASSERT(FIELD_OFFSET(Struct_Microsoft_Singularity_Isal_IX_DescriptorTable_Gdt, pc) == PM_CODE_SELECTOR);\nC_ASSERT(FIELD_OFFSET(Struct_Microsoft_Singularity_Isal_IX_DescriptorTable_Gdt, pd) == PM_DATA_SELECTOR);\nC_ASSERT(FIELD_OFFSET(Struct_Microsoft_Singularity_Isal_IX_DescriptorTable_Gdt, lc) == LM_CODE_SELECTOR);\nC_ASSERT(FIELD_OFFSET(Struct_Microsoft_Singularity_Isal_IX_DescriptorTable_Gdt, ld) == LM_DATA_SELECTOR);\nC_ASSERT(FIELD_OFFSET(Struct_Microsoft_Singularity_Isal_IX_DescriptorTable_Gdt, pp) == PROCESSOR_SELECTOR);\nC_ASSERT(FIELD_OFFSET(Struct_Microsoft_Singularity_Isal_IX_DescriptorTable_Gdt, tss) == TSS_SELECTOR);\n\nClass_Microsoft_Singularity_Hal_Platform *BlPlatform;\nClass_Microsoft_Singularity_Hal_Cpu *BlCpuArray;\n\ntypedef struct _BL_DISTRO_FILE {\n LIST_ENTRY Entry;\n UINT32 Size;\n CHAR Path[1024];\n PVOID Data;\n} BL_DISTRO_FILE, *PBL_DISTRO_FILE;\n\ntypedef struct _BL_DISTRO {\n UINT32 NumberOfFiles;\n UINT32 TotalSize;\n LIST_ENTRY FileList;\n PVOID Data;\n} BL_DISTRO, PBL_DISTRO;\n\nBL_DISTRO BlDistro;\nPBL_DISTRO_FILE BlKernelFile;\n\nPVOID BlKernelBase;\nULONG_PTR BlKernelSize;\n\nUINT32\n(*BlKernelEntryPoint)(\n Class_Microsoft_Singularity_Hal_Platform *Platform,\n Class_Microsoft_Singularity_Hal_Cpu *Cpu\n );\n\n\n\nPBL_SMAP BlSingularitySmap;\nPWCHAR BlCommandLine;\nStruct_Microsoft_Singularity_Io_FileImage *BlSingularityFileImageTable;\nUINT32 BlSingularityFileImageTableSize;\n\n//\n// OHCI 1394 buffer for Singularity KD.\n//\n// AIFIX: Currently, this buffer needs to be allocated in low memory, because\n// Singularity KD does not connect if it is allocated in high memory.\n//\n\n__declspec(align(PAGE_SIZE)) UINT8 BlSingularityOhci1394Buffer[3 * PAGE_SIZE];\n\nVOID\nBlSingularityLoadDistro(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function loads the distro.\n//\n//--\n\n{\n UINT32 BytesRead;\n UINT32 CharactersConsumed;\n PBL_DISTRO_FILE DistroFile;\n UINT32 DummySize;\n PLIST_ENTRY Entry;\n UINT32 FilesRead;\n PLIST_ENTRY Head;\n PCHAR NewLine;\n PCHAR Next;\n UINT32 Size;\n PCHAR Temp;\n PVOID BlIniFileData;\n UINT32 BlIniFileSize;\n\n BlDistro.NumberOfFiles = 0;\n BlRtlInitializeListHead(&BlDistro.FileList);\n\n //-\n //- Read the distro INI file.\n //-\n\n if (BlFsGetFileSize(SINGULARITY_DISTRO_INI_PATH, &BlIniFileSize) == FALSE) {\n\n BlRtlPrintf(\"BL: Unable to get INI file!\\n\");\n BlRtlHalt();\n }\n\n BlIniFileData = BlPoolAllocateBlock(BlIniFileSize + 1);\n\n if (BlFsReadFile(SINGULARITY_DISTRO_INI_PATH, BlIniFileData, BlIniFileSize) == FALSE) {\n\n BlRtlPrintf(\"BL: Unable to read INI file!\\n\");\n BlRtlHalt();\n }\n\n //-\n //- Parse INI file and build distro file list.\n //-\n\n NewLine = (PCHAR) BlIniFileData;\n\n for (;;) {\n\n Next = NewLine;\n NewLine = Next + 1;\n\n while ((*NewLine != 0) && (*NewLine != '\\r') && (*NewLine != '\\n')) {\n\n NewLine += 1;\n }\n\n if (*NewLine == 0) {\n\n break;\n }\n\n while ((*NewLine == '\\r') || (*NewLine == '\\n')) {\n\n *NewLine = 0;\n NewLine += 1;\n }\n\n Next = (PCHAR)BlRtlFindSubstring(Next, \"Size=\");\n\n if (Next == NULL) {\n\n continue;\n }\n\n Next += 5;\n\n if (BlRtlParsePositiveDecimal(Next,\n &Size,\n &CharactersConsumed) == FALSE) {\n\n ParseFailure:\n BlRtlPrintf(\"BL: Error parsing distro INI file!\\n\");\n BlRtlHalt();\n }\n\n Next = (PCHAR)BlRtlFindSubstring(Next, \"Path=\");\n\n if (Next == NULL) {\n\n goto ParseFailure;\n }\n\n Next += 5;\n\n if (*Next == 0) {\n\n goto ParseFailure;\n }\n\n DistroFile = (PBL_DISTRO_FILE) BlPoolAllocateBlock(sizeof(BL_DISTRO_FILE));\n\n BLASSERT((NewLine - Next) < sizeof(DistroFile->Path));\n\n Temp = (PCHAR)Next;\n\n while (Temp != NewLine) {\n\n if (*Temp == '\\\\') {\n\n *Temp = '/';\n }\n\n Temp += 1;\n }\n\n BlRtlCopyMemory(DistroFile->Path, Next, NewLine - Next);\n\n //-\n //- By convention with DistroBuiderl, the first file with a size of zero is\n //- really the INI file, so we need to set its size.\n //-\n if (Size == 0) {\n Size = BlIniFileSize;\n }\n\n DistroFile->Size = Size;\n\n BlDistro.NumberOfFiles += 1;\n BlDistro.TotalSize += Size;\n\n BlRtlInsertTailList(&BlDistro.FileList, &DistroFile->Entry);\n }\n\n //-\n //- Read distro files.\n //-\n\n BlDistro.Data = (PVOID) BlMmAllocatePhysicalRegion(ROUND_UP_TO_PAGES(BlDistro.TotalSize), BL_MM_PHYSICAL_REGION_DISTRO);\n\n#if DISTRO_VERBOSE\n\n BlKdPrintf(\"DISTRO: Reading distro (%u files , %u bytes).\\n\",\n BlDistro.NumberOfFiles,\n BlDistro.TotalSize);\n\n#endif\n\n FilesRead = 0;\n BytesRead = 0;\n\n Next = (PCHAR) BlDistro.Data;\n Head = &BlDistro.FileList;\n\n for (Entry = Head->Flink; Entry != Head; Entry = Entry->Flink) {\n\n DistroFile = CONTAINING_RECORD(Entry, BL_DISTRO_FILE, Entry);\n\n DistroFile->Data = Next;\n\n BLASSERT(DistroFile->Path[0] == '/');\n\n#if DISTRO_VERBOSE\n\n BlKdPrintf(\"DISTRO: %s [%u bytes]\\n\",\n DistroFile->Path,\n DistroFile->Size);\n\n#endif\n\n if (BlFsReadFile(&DistroFile->Path[1], DistroFile->Data, DistroFile->Size) == FALSE) {\n\n BlRtlPrintf(\"\\n\"\n \"BL: Error reading %s!\\n\",\n DistroFile->Path);\n\n BlRtlHalt();\n }\n\n Next += DistroFile->Size;\n\n FilesRead += 1;\n BytesRead += DistroFile->Size;\n\n BlVideoPrintf(\"\\rReading distro files ... %u / %u [%u / %u]\",\n FilesRead,\n BlDistro.NumberOfFiles,\n BytesRead,\n BlDistro.TotalSize);\n\n }\n\n BlVideoPrintf(\"\\n\");\n\n //-\n //- If this is a network boot, then signal the PXE server to exit.\n //- This is the only mechanism to notify the server that the boot succeeded.\n //-\n\n if (BlGetBeb()->BootType == BL_PXE_BOOT) {\n\n BlFsGetFileSize(\"end.:\", &DummySize);\n }\n\n //-\n //- Switch distro range to read-only.\n //-\n\n BlMmMapVirtualRange(BlDistro.Data,\n BlDistro.Data,\n BlDistro.TotalSize,\n FALSE,\n TRUE,\n FALSE);\n\n //-\n //- Build file image table.\n //-\n\n BlSingularityFileImageTable = (Struct_Microsoft_Singularity_Io_FileImage *) BlPoolAllocateBlock(BlDistro.NumberOfFiles * sizeof(Struct_Microsoft_Singularity_Io_FileImage));\n\n for (Entry = Head->Flink; Entry != Head; Entry = Entry->Flink) {\n\n DistroFile = CONTAINING_RECORD(Entry, BL_DISTRO_FILE, Entry);\n\n BlSingularityFileImageTable[BlSingularityFileImageTableSize].Address = (ULONG_PTR) DistroFile->Data;\n BlSingularityFileImageTable[BlSingularityFileImageTableSize].Size = DistroFile->Size;\n BlSingularityFileImageTableSize += 1;\n }\n\n return;\n}\n\nVOID\nBlSingularityLoadKernelImage(\n VOID\n )\n\n//-++\n//-\n//- Routine Description:\n//-\n//- This function loads the kernel image.\n//-\n//---\n\n{\n BLASSERT(BlRtlIsListEmpty(&BlDistro.FileList) == FALSE);\n\n //-\n //- Kernel is the first entry in the distro file list.\n //-\n\n BlKernelFile = CONTAINING_RECORD(BlDistro.FileList.Flink,\n BL_DISTRO_FILE,\n Entry);\n\n //-\n //- Get the virtual range for the kernel image.\n //-\n\n BlPeGetVirtualRange(BlKernelFile->Data, &BlKernelBase, &BlKernelSize);\n\n BLASSERT(((UINT64) BlKernelBase % PAGE_SIZE) == 0);\n\n BLASSERT((BlKernelSize % PAGE_SIZE) == 0);\n\n //-\n //- Allocate a physical region for the kernel image, since pages are identity mapped at boot.\n //-\n // AIFIX: This needs to be be made dynamic!\n //\n\n if (BlMmAllocateSpecificPhysicalRegion((UINT64) BlKernelBase,\n BlKernelSize,\n BL_MM_PHYSICAL_REGION_KERNEL_IMAGE) == FALSE) {\n\n BlMmDumpPhysicalRegionList();\n\n BlRtlHalt();\n }\n\n#if SINGULARITY_VERBOSE\n\n BlRtlPrintf(\"BL: Loading kernel ... [%p ... %p]\\n\",\n BlKernelBase,\n (ULONG_PTR) BlKernelBase + BlKernelSize - 1);\n\n#endif\n\n BlPeLoadImage(BlKernelBase, BlKernelSize, BlKernelFile->Data, (PVOID *) &BlKernelEntryPoint, TRUE);\n\n}\n\n\nULONG_PTR\nBlSingularityLoadAppImage(\n VOID\n )\n\n//-++\n//-\n//- Routine Description:\n//-\n//- This function loads the kernel image.\n//-\n//---\n\n{\n PBL_DISTRO_FILE BlAppFile;\n\n PVOID BlAppBase;\n ULONG_PTR BlAppSize;\n ULONG_PTR BlAppEntryPoint;\n\n\n BLASSERT(BlRtlIsListEmpty(&BlDistro.FileList) == FALSE);\n\n //-\n //- App is the second entry in the distro file list.\n //-\n\n BlAppFile = CONTAINING_RECORD(BlDistro.FileList.Flink->Flink,\n BL_DISTRO_FILE,\n Entry);\n\n //-\n //- Get the virtual range for the kernel image.\n //-\n\n BlPeGetVirtualRange(BlAppFile->Data, &BlAppBase, &BlAppSize);\n\n BLASSERT(((UINT64) BlAppBase % PAGE_SIZE) == 0);\n\n BLASSERT((BlAppSize % PAGE_SIZE) == 0);\n\n //-\n //- Allocate a physical region for the app image, since pages are identity mapped at boot.\n //-\n // AIFIX: This needs to be be made dynamic!\n //\n BlRtlPrintf(\"BL: Loading app... [%p ... %p]\\n\",\n BlAppBase,\n (ULONG_PTR) BlAppBase + BlAppSize - 1);\n\n if (BlMmAllocateSpecificPhysicalRegion((UINT64) BlAppBase,\n BlAppSize,\n BL_MM_PHYSICAL_REGION_SINGULARITY) == FALSE) {\n \n BlRtlPrintf(\"BL: Loading app... failed\\n\"); \n BlMmDumpPhysicalRegionList();\n\n BlRtlHalt();\n }\n\n#if SINGULARITY_VERBOSE\n\n BlRtlPrintf(\"BL: Loading app... [%p ... %p]\\n\",\n BlAppBase,\n (ULONG_PTR) BlAppBase + BlAppSize - 1);\n\n#endif\n\n BlPeLoadImage(BlAppBase, BlAppSize, BlAppFile->Data, (PVOID *) &BlAppEntryPoint, FALSE);\n\n return BlAppEntryPoint;\n}\n\n\n\n//\n// AIFIX: Fix task page definition.\n//\n\n#if defined(BOOT_X86)\n\ntypedef Struct_Microsoft_Singularity_Isal_IX_TSS BL_TASK_SEGMENT;\n\n#elif defined(BOOT_X64)\n\ntypedef Struct_Microsoft_Singularity_Isal_IX_TSS64 BL_TASK_SEGMENT;\n\n#endif\n\ntypedef struct _BL_PROCESSOR {\n UINT32 Index;\n Class_Microsoft_Singularity_Hal_Cpu *Cpu;\n PVOID KernelStack;\n ULONG_PTR KernelStackSize;\n PVOID ContextPage;\n PVOID BasePage;\n BL_TASK_SEGMENT *TaskPage;\n} BL_PROCESSOR, *PBL_PROCESSOR;\n\nPBL_PROCESSOR BlProcessor;\nUINT32 BlProcessorCount;\n\nVOID\nBlSingularityInitializeProcessor(\n UINT32 Index\n )\n\n//-++\n//-\n//- Routine Description:\n//-\n//- This function initializes the specified processor.\n//-\n//- Arguments:\n//-\n//- Index - Supplies the index of the processor to initialize.\n//-\n//---\n\n{\n Class_Microsoft_Singularity_Hal_Cpu *Processor;\n\n //-\n //- Initialize native processor structure.\n //-\n\n Processor = BlProcessor[Index].Cpu;\n Processor->Size = sizeof(Class_Microsoft_Singularity_Hal_Cpu);\n Processor->Id = Index;\n#if 0\n Processor->ApicId = Index;\n#endif\n Processor->KernelStackLimit = (ULONG_PTR) BlProcessor[Index].KernelStack;\n // Processor->KernelStackBegin = Processor->KernelStackLimit + SINGULARITY_KERNEL_STACK_SIZE;\n Processor->KernelStackBegin = Processor->KernelStackLimit + BlProcessor[Index].KernelStackSize;\n Processor->CpuRecordPage = (ULONG_PTR) BlProcessor[Index].BasePage;\n\n //-\n //- Initialize task structure.\n //-\n\n BlProcessor[Index].TaskPage->io_bitmap_offset = sizeof(BL_TASK_SEGMENT);\n\n //-\n //- Initialize segments.\n //-\n\n BlRtlZeroMemory(&Processor->segments, sizeof(Processor->segments));\n\n Processor->segments.gdtPtr.addr = (ULONG_PTR) &Processor->segments.gdt;\n Processor->segments.gdtPtr.limit = sizeof(Processor->segments.gdt) - 1;\n\n BlRtlCopyMemory(&Processor->segments.gdt.pc,\n (PVOID) (BlMmInitialGdtr.Base + PM_CODE_SELECTOR),\n sizeof(CODE_SEGMENT));\n\n BlRtlCopyMemory(&Processor->segments.gdt.pd,\n (PVOID) (BlMmInitialGdtr.Base + PM_DATA_SELECTOR),\n sizeof(CODE_SEGMENT));\n\n#if defined(BOOT_X64)\n BlRtlCopyMemory(&Processor->segments.gdt.lc,\n (PVOID) (BlMmInitialGdtr.Base + LM_CODE_SELECTOR),\n sizeof(CODE_SEGMENT));\n\n BlRtlCopyMemory(&Processor->segments.gdt.ld,\n (PVOID) (BlMmInitialGdtr.Base + LM_DATA_SELECTOR),\n sizeof(CODE_SEGMENT));\n#endif\n\n BlMmInitializeDataSegment((PDATA_SEGMENT) &Processor->segments.gdt.pp,\n (UINT32) (ULONG_PTR) BlProcessor[Index].ContextPage,\n PAGE_SIZE - 1);\n\n BlMmInitializeSystemSegment((PSYSTEM_SEGMENT) &Processor->segments.gdt.tss,\n SSDT_AVAILABLE_TSS,\n (ULONG_PTR) BlProcessor[Index].TaskPage,\n sizeof(BL_TASK_SEGMENT) - 1);\n\n return;\n}\n\nUINT32 BlSingularityProcessorToStart;\n\n//- Test whether SKINIT is possible on this machine\nUINT8\nTestForSKINIT()\n{\n //- First check for max extended capabilities we're allowed to query\n UINT32 result = BlGetCpuidEax(0x80000000);\n\n if (result >= 0x80000001) {\n result = BlGetCpuidEcx(0x80000001); //- Query the SVM-related capabilities\n if (result & 0x00001000) { //- Check for SKINIT in the 12th bit\n return 1;\n } else {\n BlRtlPrintf(\"CPUID returned: %p\\n\", result);\n }\n } else {\n BlRtlPrintf(\"Result of extended query too small.\\n\");\n }\n return 0;\n}\n\n#ifdef SMALL_LOADER\nUINT8\nPrepTPM(ULONG_PTR SKINIT_base)\n{\n return 0;\n}\n#else // !SMALL_LOADER\nUINT8\nPrepTPM(ULONG_PTR SKINIT_base)\n{\n UINT32 locality = 3;\n UINT32 SKINIT_args = 0;\n \n //- Deposit the TPM's AIK at app's base+size+0x1F000+sSize+dSize\n //-SKINIT_args = (UINT32)330000 + 1024*1024 + 0x1F000 + 1024 + 1024;\n //- Deposit the TPM's AIK at loader's base+?CodeSpace+0x1F000(for DEV)+sSize+dSize\n SKINIT_args = (UINT32)SKINIT_base + 193 * 1024 + 4; // +4 since app entry point is at 0 \n UINT32* SKINIT_args_words = (UINT32*)SKINIT_args;\n SKINIT_args_words[0] = sizeof(aik);\n\n BlRtlPrintf(\"AIK of size: %p \\n\", SKINIT_args_words[0]);\n\n unsigned char* arg_ptr = (unsigned char*)(SKINIT_args + 4);\n for (int i = 0; i < sizeof(aik); i++) {\n arg_ptr[i] = aik[i];\n//\t BlRtlPrintf(\"%02x \", ((unsigned int)aik[i]) & 0xff);\n//\t if (((i+1)%24)==0)\n//\t {\n//\t\t BlRtlPrintf(\"\\n\");\n//\t }\n }\n//\tBlRtlPrintf(\"\\n\");\n arg_ptr += sizeof(aik);\n\n return 0;\n}\n#endif // SMALL_LOADER\n\nUINT32\nBlSingularityCallKernel(\n UINT32 Index\n )\n\n//-++\n//-\n//- Routine Description:\n//-\n//- This function calls the kernel.\n//-\n//- Arguments:\n//-\n//- Index - Supplies the index of the current processor.\n//-\n//- Return Value:\n//-\n//- Kernel exit code.\n//-\n//---\n\n{\n UINT32 ExitCode;\n ULONG_PTR SKINIT_base;\n\n#if SINGULARITY_VERBOSE\n\n\n BlRtlPrintf(\"\\fBL: Processor[%d]: Starting Singularity ...\\n\",\n Index\n );\n\n BlRtlPrintf(\"BL: Cpu = %p\\n\",\n BlProcessor[Index].Cpu\n );\n\n\n BlRtlPrintf(\"BL: GDT =[%p...%p]\\n\",\n BlProcessor[Index].Cpu->segments.gdtPtr.addr,\n BlProcessor[Index].Cpu->segments.gdtPtr.addr + BlProcessor[Index].Cpu->segments.gdtPtr.limit\n );\n\n\n BlRtlPrintf(\"BL: stack=[%p...%p]\\n\",\n BlProcessor[Index].Cpu->KernelStackLimit,\n BlProcessor[Index].Cpu->KernelStackBegin\n );\n\n#endif\n\n BlMmSetGdtr((PGDTR) &BlProcessor[Index].Cpu->segments.gdtPtr.limit);\n\n#if defined(BOOT_X86)\n\n BlMmSetFs(PROCESSOR_SELECTOR);\n\n#elif defined(BOOT_X64)\n\n BlMmSetGs(PROCESSOR_SELECTOR);\n\n#endif\n\n BlMmSetCr3(BlMmBootCr3);\n\n BlRtlPrintf(\"BL: kernel=[%p ... %p]\\n\",\n BlKernelBase, (ULONG_PTR) BlKernelBase + BlKernelSize - 1);\n BlRtlPrintf(\"BL: entry= %p\\n\", BlKernelEntryPoint);\n\n //- Compute the 64K aligned address\n SKINIT_base = (ULONG_PTR)((UINT32)BlKernelEntryPoint) & ~(0x00010000 - 1);\n BlRtlPrintf(\"SL Base: entry= %p\\n\", SKINIT_base);\n BlRtlPrintf(\"SL Header: entry= %p\\n\", *(UINT32*)SKINIT_base);\n\n//- BlRtlPrintf(\"Stopping here\\n\");\n//- while (1) {}\n\n //- Load the app too\n ULONG_PTR AppEntry = BlSingularityLoadAppImage();\n\n //- Deposit the app's entry point at base+190k\n UINT32 app_args = (UINT32)SKINIT_base + 193 * 1024;\n UINT32* app_args_words = (UINT32*)app_args;\n app_args_words[0] = (UINT32)AppEntry;\n\n DisablePaging(42);\n\n //- Invoke SKINIT instead of calling into the kernel directly\n if (TestForSKINIT()) {\n if (PrepTPM(SKINIT_base)) { \n BlRtlPrintf(\"Prepping the TPM failed. Halting...\\n\");\n BlRtlHalt();\n }\n DEBUG_MSG(\"Executing SKINIT for real. See you on the other side!\\n\");\n BlRealSKINIT(SKINIT_base); \n } else {\n //- Assume we're in a VM, so don't bother with the TPM\n DEBUG_MSG(\"Faking SKINIT for testing purposes.\\n\");\n BlFakeSKINIT(SKINIT_base); \n }\n\n //- Should never reach here!\n BlRtlPrintf(\"Wasn't expecting to see this...\\n\");\n\n ExitCode = BlKernelEntryPoint(BlPlatform, BlProcessor[Index].Cpu);\n\n BlMmSetGdtr(&BlMmInitialGdtr);\n\n BlVideoInitialize();\n\n return ExitCode;\n}\n\nVOID\nBlSingularityEnterKernel(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function enters Singularity.\n//\n//--\n\n{\n UINT32 ExitCode;\n PVOID LocalVariable;\n UINT32 Index;\n\n Index = BlSingularityProcessorToStart;\n\n BLASSERT(((ULONG_PTR) &LocalVariable) >= BlProcessor[Index].Cpu->KernelStackLimit);\n\n BLASSERT(((ULONG_PTR) &LocalVariable) < BlProcessor[Index].Cpu->KernelStackBegin);\n\n //\n // The bootstrap processor runs in a loop calling kernel entry point and performing warm boot\n // when the kernel returns. The application processors do not return from the kernel call and are\n // reinitialized with SIPIs by the kernel after a warm boot.\n //\n\n if (Index == 0) {\n\n for (;;) {\n BlMmDumpPhysicalRegionList();\n ExitCode = BlSingularityCallKernel(Index);\n\n#if SINGULARITY_VERBOSE\n\n BlRtlPrintf(\"BL: Processor[%02x]: Kernel exited with 0x%08x.\\n\",\n Index,\n ExitCode);\n\n#endif\n\n BlPlatform->BootCount += 1;\n\n BlRtlZeroMemory(BlKernelBase, BlKernelSize);\n\n BlPeLoadImage(BlKernelBase, BlKernelSize, BlKernelFile->Data, (PVOID *) &BlKernelEntryPoint, FALSE);\n }\n\n }\n else {\n\n ExitCode = BlSingularityCallKernel(Index);\n\n BlRtlPrintf(\"BL: AP returned from kernel call!\\n\");\n\n BlRtlHalt();\n }\n\n return;\n}\n\nVOID\nBlSingularityExit(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function exits Singularity and performs the \"kill action\" requested by the kernel.\n//\n//--\n\n{\n BlMmSetGdtr(&BlMmInitialGdtr);\n\n BlVideoInitialize();\n\n switch (BlPlatform->KillAction) {\n\n case Class_Microsoft_Singularity_Hal_Platform_EXIT_AND_SHUTDOWN: {\n\n BlRtlPrintf(\"BL: Kernel requested shutdown.\\n\");\n\n BlRtlShutdownSystem();\n\n break;\n }\n\n case Class_Microsoft_Singularity_Hal_Platform_EXIT_AND_RESTART: {\n\n BlRtlPrintf(\"BL: Kernel requested restart.\\n\");\n\n BlRtlResetSystem();\n\n break;\n }\n\n case Class_Microsoft_Singularity_Hal_Platform_EXIT_AND_HALT: {\n\n BlRtlPrintf(\"BL: Kernel requested halt.\\n\");\n\n BlRtlHalt();\n\n break;\n }\n\n case Class_Microsoft_Singularity_Hal_Platform_EXIT_AND_WARMBOOT: {\n\n BlRtlPrintf(\"BL: Kernel requested warmboot.\\n\");\n\n BlPlatform->BootCount += 1;\n\n BlRtlZeroMemory(BlKernelBase, BlKernelSize);\n\n BlPeLoadImage(BlKernelBase, BlKernelSize, BlKernelFile->Data, (PVOID *) &BlKernelEntryPoint, FALSE);\n\n BlSingularityProcessorToStart = 0;\n\n BlMmSwitchStack((PVOID) BlProcessor[0].Cpu->KernelStackBegin, BlSingularityEnterKernel);\n\n break;\n }\n\n default: {\n\n BlRtlPrintf(\"BL: Unrecognized kill action 0x%08x!\\n\", BlPlatform->KillAction);\n\n BlRtlHalt();\n }\n }\n}\n\n\nunsigned int IsApicPresent (void)\n{\n unsigned int reg_edx = BlGetCpuidEdx(1);\n\n return ((reg_edx >> 9) & 0x1);\n}\n\n#define INITIAL_APIC_ID_BITS 0xFF000000 // EBX[31:24] unique APIC ID\n// Returns the 8-bit unique Initial APIC ID for the processor this\n// code is actually running on. The default value returned is 0xFF if\n// Hyper-Threading Technology is not supported.\n// Taken from intel application note Ap-485 \"Intel Processor Identification and the CPUID instruction\"\nunsigned char GetAPIC_ID (void)\n{\n unsigned int reg_ebx = BlGetCpuidEbx(1);\n\n return (unsigned char) ((reg_ebx & INITIAL_APIC_ID_BITS) >> 24);\n}\n\nVOID\nBlSingularityInitialize(\n UINT32 NumberOfProcessors,\n PFAR_POINTER ApEntry16,\n PFAR_POINTER ApStartupLock\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes Singularity.\n//\n// Arguments:\n//\n// NumberOfProcessors - Supplies the number of processors on the system.\n//\n// ApEntry6 - Supplies a pointer to the 16-bit entry point for\n// application processors on a multi-processor system.\n//\n// ApStartupLock - Supplies a pointer to the lock used for AP startup\n// synchronization.\n//\n//--\n\n{\n UINT64 Base;\n UINT32 Index;\n PVOID PhysicalRegionHandle;\n UINT64 Size;\n UINT32 Type;\n UINT8 id;\n UINT64 HighAddress;\n UINT64 TempAddress;\n UINT64 StackStart;\n UINT64 PlayStart;\n int i;\n char* p;\n\n //\n // Allocate processor array and set processor count.\n //\n\n BlProcessor = (PBL_PROCESSOR) BlPoolAllocateBlock(sizeof(BL_PROCESSOR) * NumberOfProcessors);\n BlProcessorCount = NumberOfProcessors;\n\n //\n // Load distro.\n //\n\n BlSingularityLoadDistro();\n\n //\n // Load kernel image.\n //\n\n BlSingularityLoadKernelImage();\n\n //\n // Allocate native platform structure.\n //\n\n BlPlatform = (Class_Microsoft_Singularity_Hal_Platform *) BlMmAllocatePhysicalRegion(ROUND_UP_TO_PAGES(sizeof(Class_Microsoft_Singularity_Hal_Platform)), BL_MM_PHYSICAL_REGION_NATIVE_PLATFORM);\n\n BlPlatform->Size = sizeof(Class_Microsoft_Singularity_Hal_Platform);\n\n if (IsApicPresent()) {\n BlPlatform->hasApic = 1;\n }\n else {\n BlPlatform->hasApic = 0;\n }\n\n //\n // Set offsets for per-cpu and per-thread pointers.\n //\n\n BlPlatform->CpuRecordPointerOffset = 0;\n BlPlatform->ThreadRecordPointerOffset = sizeof(PTR_TYPE);\n\n //\n // Set boot time.\n //\n\n if (BlStartTime.Year != 0) {\n BlPlatform->BootYear = 2000 + BlStartTime.Year;\n BlPlatform->BootMonth = BlStartTime.Month;\n BlPlatform->BootDay = BlStartTime.Day;\n BlPlatform->BootHour = BlStartTime.Hour;\n BlPlatform->BootMinute = BlStartTime.Minute;\n BlPlatform->BootSecond = BlStartTime.Second;\n }\n\n //\n // Set processor count.\n //\n\n BlPlatform->CpuRealCount = NumberOfProcessors;\n BlPlatform->CpuMaxCount = NumberOfProcessors;\n\n //\n // Set MPS floating pointer structure address.\n //\n\n BlPlatform->MpFloat32 = (UINT32) (ULONG_PTR) BlMpsFps;\n\n //\n // Set kernel range.\n //\n\n BlPlatform->KernelDllBase = (ULONG_PTR) BlKernelBase;\n BlPlatform->KernelDllFirstPage = (ULONG_PTR) BlKernelBase;\n BlPlatform->KernelDllSize = BlKernelSize;\n\n //\n // Set command line.\n //\n\n BlPlatform->CommandLine32 = (ULONG_PTR) BlCommandLine;\n BlPlatform->CommandLineCount = BlRtlStringLengthW(BlCommandLine);\n\n //\n // Set PNP node list address.\n //\n\n BlPlatform->PnpNodesAddr32 = (ULONG_PTR) BlPnpSystemDeviceNodeList;\n BlPlatform->PnpNodesSize32 = BlPnpSystemDeviceNodeListSize;\n\n //\n // Set ISA information.\n //\n\n BlPlatform->IsaCsns = BlPnpIsaConfiguration.NumberOfCardSelectNumbers;\n BlPlatform->IsaReadPort = BlPnpIsaConfiguration.DataReadPort;\n\n //\n // Set PCI BIOS information.\n //\n\n BlPlatform->PciBiosAX = BlPciInstallationCheck.Eax;\n BlPlatform->PciBiosBX = BlPciInstallationCheck.Ebx;\n BlPlatform->PciBiosCX = BlPciInstallationCheck.Ecx;\n BlPlatform->PciBiosEDX = BlPciInstallationCheck.Edx;\n\n //\n // Set VESA information.\n //\n\n BlPlatform->VesaBuffer = BlVesaVideoBuffer;\n\n //\n // Set ACPI information.\n //\n\n BlPlatform->AcpiRoot32 = (ULONG_PTR) BlAcpiRsdpAddress;\n\n //\n // Set file image table.\n //\n\n BlPlatform->FileImageTableBase32 = (ULONG_PTR) BlSingularityFileImageTable;\n BlPlatform->FileImageTableEntries = BlSingularityFileImageTableSize;\n\n //\n // Allocate log record and text buffers.\n //\n\n BlPlatform->LogRecordBuffer = (ULONG_PTR) BlMmAllocatePhysicalRegion(SINGULARITY_LOG_RECORD_SIZE, BL_MM_PHYSICAL_REGION_LOG_RECORD);\n BlPlatform->LogRecordSize = SINGULARITY_LOG_RECORD_SIZE;\n\n BlPlatform->LogTextBuffer = (ULONG_PTR) BlMmAllocatePhysicalRegion(SINGULARITY_LOG_TEXT_SIZE, BL_MM_PHYSICAL_REGION_LOG_TEXT);\n BlPlatform->LogTextSize = SINGULARITY_LOG_TEXT_SIZE;\n\n //\n // Set debugger settings.\n //\n\n if (BlKdComPort != 0) {\n\n BlPlatform->DebuggerType = Class_Microsoft_Singularity_Hal_Platform_DEBUGGER_SERIAL;\n BlPlatform->DebugBasePort = BlComBasePort[BlKdComPort];\n\n }\n else if (BlPciOhci1394BaseAddress != 0) {\n\n BlRtlPrintf(\"Got 1394 debugger base address!\\n\");\n BlPlatform->DebuggerType = Class_Microsoft_Singularity_Hal_Platform_DEBUGGER_1394;\n BlPlatform->Ohci1394Base = BlPciOhci1394BaseAddress;\n BlPlatform->Ohci1394BufferAddr32 = (ULONG_PTR) BlSingularityOhci1394Buffer;\n BlPlatform->Ohci1394BufferSize32 = sizeof(BlSingularityOhci1394Buffer);\n\n }\n else {\n\n BlRtlPrintf(\"Debugger OFF\\n\");\n BlPlatform->DebuggerType = Class_Microsoft_Singularity_Hal_Platform_DEBUGGER_NONE;\n\n }\n\n BlPlatform->TwiddleSpinBase = 0xb8000;\n\n //\n // Set exit routine.\n //\n\n BlPlatform->Kill32 = (ULONG_PTR) BlSingularityExit;\n\n //\n // Set entry routine and startup lock address for application processors.\n //\n\n BlPlatform->MpEnter32 = (ULONG_PTR) BlRtlConvertFarPointerToLinearPointer(ApEntry16);\n BlPlatform->MpStartupLock32 = (ULONG_PTR) BlRtlConvertFarPointerToLinearPointer(ApStartupLock);\n\n //\n // Allocate native processor structures.\n //\n\n BlCpuArray =\n (Class_Microsoft_Singularity_Hal_Cpu *) BlMmAllocatePhysicalRegion(ROUND_UP_TO_PAGES(sizeof(Class_Microsoft_Singularity_Hal_Cpu) * NumberOfProcessors), BL_MM_PHYSICAL_REGION_NATIVE_PROCESSOR);\n\n BlPlatform->Cpus = (ULONG_PTR) BlCpuArray;\n\n //\n // Allocate per-processor resources upfront.\n //\n\n for (Index = 0; Index < NumberOfProcessors; Index += 1) {\n\n BlProcessor[Index].Index = Index;\n BlProcessor[Index].Cpu = &BlCpuArray[Index];\n BlProcessor[Index].ContextPage = (PVOID) BlMmAllocatePhysicalRegion(2 * PAGE_SIZE, BL_MM_PHYSICAL_REGION_CONTEXT);\n BlProcessor[Index].BasePage = (PVOID) ((ULONG_PTR) BlProcessor[Index].ContextPage + PAGE_SIZE);\n BlProcessor[Index].TaskPage = (BL_TASK_SEGMENT *) BlMmAllocatePhysicalRegion(PAGE_SIZE, BL_MM_PHYSICAL_REGION_TASK);\n }\n\n //\n // Allocate kernel stack for the bootstrap processor.\n //\n\n StackStart = BlMmAllocatePhysicalRegion(SINGULARITY_KERNEL_STACK_SIZE,\n BL_MM_PHYSICAL_REGION_KERNEL_STACK);\n if (0 == StackStart) {\n BlRtlPrintf(\"Failed to allocate kernel stack.\\n\", StackStart);\n BlRtlHalt();\n }\n\n BlRtlPrintf(\"Allocated kernel stack at 0x%016I64x\\n\", StackStart);\n\n BlProcessor[0].KernelStack = (PVOID) (StackStart);\n BlProcessor[0].Cpu->DomainBsp = TRUE;\n\n BlPlatform->OutgoingMessage = 0;\n BlPlatform->OutgoingCount = 0;\n BlPlatform->IncomingFree = 0;\n BlPlatform->IncomingFreeCount = 0;\n BlPlatform->IncomingMessage = 0;\n BlPlatform->IncomingCount = 0;\n BlPlatform->OutgoingFree = 0;\n BlPlatform->OutgoingFreeCount = 0;\n BlPlatform->MaxBufferLength = 0;\n\n BlProcessor[0].KernelStackSize = SINGULARITY_KERNEL_STACK_SIZE;\n\n //\n // Initialize the first processor structure.\n //\n\n BlSingularityInitializeProcessor(0);\n\n //\n // Allocate memory map for Singularity.\n //\n\n BlSingularitySmap = (PBL_SMAP) BlMmAllocatePhysicalRegion(sizeof(BL_SMAP), BL_MM_PHYSICAL_REGION_SINGULARITY_SMAP);\n\n //\n // Claim all remaining physical memory for Singularity.\n //\n\n// while (BlMmFindFreePhysicalRegion(&Base, &Size) != FALSE) {\n//\n// BlMmAllocateSpecificPhysicalRegion(Base, Size, BL_MM_PHYSICAL_REGION_SINGULARITY);\n// }\n\n //\n // Generate memory map for Singularity.\n //\n\n BlRtlZeroMemory(BlSingularitySmap, sizeof(BL_SMAP));\n\n BlPlatform->PhysicalBase = (ULONG_PTR) -1;\n\n PhysicalRegionHandle = NULL;\n\n while (BlMmGetNextPhysicalRegion(&PhysicalRegionHandle,\n &Base,\n &Size,\n &Type) != FALSE) {\n\n if ((Type == BL_MM_PHYSICAL_REGION_SINGULARITY) ||\n (Type == BL_MM_PHYSICAL_REGION_KERNEL_IMAGE) ||\n (Type == BL_MM_PHYSICAL_REGION_NATIVE_PLATFORM) ||\n (Type == BL_MM_PHYSICAL_REGION_NATIVE_PROCESSOR) ||\n (Type == BL_MM_PHYSICAL_REGION_KERNEL_STACK)\n ) {\n\n if (Type == BL_MM_PHYSICAL_REGION_SINGULARITY) {\n BlSingularitySmap->Entry[BlSingularitySmap->EntryCount].Base = Base;\n BlSingularitySmap->Entry[BlSingularitySmap->EntryCount].Size = Size;\n BlSingularitySmap->Entry[BlSingularitySmap->EntryCount].Type = BL_SMAP_AVAILABLE;\n }\n else if (Type == BL_MM_PHYSICAL_REGION_KERNEL_IMAGE ||\n (Type == BL_MM_PHYSICAL_REGION_NATIVE_PLATFORM) ||\n (Type == BL_MM_PHYSICAL_REGION_NATIVE_PROCESSOR)) {\n BlSingularitySmap->Entry[BlSingularitySmap->EntryCount].Base = Base;\n BlSingularitySmap->Entry[BlSingularitySmap->EntryCount].Size = Size;\n BlSingularitySmap->Entry[BlSingularitySmap->EntryCount].Type = BL_SMAP_KERNEL_NONGC;\n }\n else if (Type == BL_MM_PHYSICAL_REGION_KERNEL_STACK) {\n BlSingularitySmap->Entry[BlSingularitySmap->EntryCount].Base = Base;\n BlSingularitySmap->Entry[BlSingularitySmap->EntryCount].Size = Size;\n BlSingularitySmap->Entry[BlSingularitySmap->EntryCount].Type = BL_SMAP_KERNEL_STACK;\n }\n else {\n BlRtlPrintf(\"UNKNOWN TYPE MEMORY??? %d\\n\", Type);\n }\n if (Base < BlPlatform->PhysicalBase) {\n BlPlatform->PhysicalBase = (ULONG_PTR) Base;\n }\n BlSingularitySmap->EntryCount += 1;\n }\n else {\n#if MM_VERBOSE\n BlRtlPrintf(\"Building SMAP marking type %s nongc\\n\", BlMmPhysicalRegionTypeString(Type));\n#endif\n BlSingularitySmap->Entry[BlSingularitySmap->EntryCount].Base = Base;\n BlSingularitySmap->Entry[BlSingularitySmap->EntryCount].Size = Size;\n BlSingularitySmap->Entry[BlSingularitySmap->EntryCount].Type = BL_SMAP_KERNEL_NONGC;\n BlSingularitySmap->EntryCount += 1;\n }\n }\n\n BlPlatform->Smap32 = (ULONG_PTR) (PVOID) BlSingularitySmap->Entry;\n BlPlatform->SmapCount = BlSingularitySmap->EntryCount;\n\n#if MM_VERBOSE\n\n BlMmDumpPhysicalRegionList();\n\n#endif\n\n //\n // Start processor 0.\n //\n\n BlSingularityProcessorToStart = 0;\n\n BlMmSwitchStack((PVOID) BlProcessor[0].Cpu->KernelStackBegin, BlSingularityEnterKernel);\n\n return;\n}\n\nVOID\nBlSingularityApEntry(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function implements the entry point for application processors.\n//\n//--\n\n{\n UINT32 Index;\n\n UINT8 MyIdChar;\n UINT32 MyId;\n UINT32 MyStack;\n Class_Microsoft_Singularity_Hal_Cpu *Processor;\n // BlRtlPrintf(\"In Ap Entry\\n\");\n\n // BlRtlPrintf(\"Non AP processor booting\\n\");\n Index = BlPlatform->MpBootInfo.TargetCpu;\n\n if (Index == 0) {\n\n // BlRtlPrintf(\"BL: BSP entered AP code!\\n\");\n BlRtlHalt();\n }\n\n#if SINGULARITY_VERBOSE\n\n BlRtlPrintf(\"BL: Initializing processor %u of %u. [Max=%u]\\n\",\n Index + 1,\n BlPlatform->CpuRealCount,\n BlPlatform->CpuMaxCount);\n\n#endif\n\n BlProcessor[Index].KernelStack = (PVOID) BlPlatform->MpBootInfo.KernelStackLimit;\n BlProcessor[Index].Cpu->DomainBsp = FALSE;\n BlProcessor[Index].KernelStackSize = BlPlatform->MpBootInfo.KernelStackBegin - BlPlatform->MpBootInfo.KernelStackLimit;\n\n BlSingularityInitializeProcessor(Index);\n\n BlSingularityProcessorToStart = Index;\n\n BlMmSwitchStack((PVOID) BlProcessor[Index].Cpu->KernelStackBegin, BlSingularityEnterKernel);\n\n return;\n}\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blsmap.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blsmap.cpp\n//\n// Abstract:\n//\n// This module implements system memory map (SMAP) support for the boot loader.\n//\n//--\n\n\n#include \"bl.h\"\n\nBL_SMAP BlSystemMemoryMap;\n\n#if SMAP_VERBOSE\n\nPCHAR\nBlSmapTypeString(\n UINT32 Type\n )\n\n//++\n//\n// Routine Description:\n//\n// This function returns the specified memory type string.\n//\n// Arguments:\n//\n// Type - Supplies the memory type.\n//\n// Return Value:\n//\n// Memory type string.\n//\n//--\n\n{\n switch (Type) {\n\n case BL_SMAP_AVAILABLE: {\n\n return \"Available\";\n }\n\n case BL_SMAP_RESERVED: {\n\n return \"Reserved\";\n }\n\n case BL_SMAP_ACPI_RECLAIM: {\n\n return \"ACPI Reclaim\";\n }\n\n case BL_SMAP_ACPI_NVS: {\n\n return \"ACPI NVS\";\n }\n\n default: {\n\n return \"*UNKNOWN*\";\n }\n }\n}\n\n#endif\n\nVOID\nBlSmapInitialize(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes the system memory map.\n//\n//--\n\n{\n UINT32 Index;\n PBEB Beb;\n\n Beb = BlGetBeb();\n\n if (Beb->SmapAddr != 0) {\n PUINT8 pb = (PUINT8)Beb->SmapAddr;\n UINT32 cb = Beb->SmapSize;\n\n for (Index = 0; Index < cb / 20; Index++) {\n PUINT8 pn = pb + Index * 20;\n BlRtlCopyMemory((PVOID)&BlSystemMemoryMap.Entry[Index],\n (PVOID)(pb + Index * 20), 20);\n#if 0\n BlVideoPrintf(\"%4d: %p %p %8x\\n\",\n Index,\n ((UINT64 *)(pn + 0))[0],\n ((UINT64 *)(pn + 8))[0],\n ((UINT32 *)(pn + 16))[0]);\n#endif\n }\n BlSystemMemoryMap.EntryCount = Index;\n }\n else {\n ULONG_PTR Address;\n BL_LEGACY_CALL_CONTEXT Context;\n UINT32 ContinuationValue;\n\n Index = 0;\n ContinuationValue = 0;\n\n for (;;) {\n\n BLASSERT(Index < (sizeof(BlSystemMemoryMap.Entry) / sizeof(BlSystemMemoryMap.Entry[0])));\n\n BlRtlZeroMemory(&Context, sizeof(Context));\n\n Context.eax = 0xE820;\n Context.edx = 0x534D4150; // 'SMAP'\n Context.ebx = ContinuationValue;\n Context.ecx = 20;\n\n Address = (ULONG_PTR) &BlSystemMemoryMap.Entry[Index];\n Context.es = (UINT32) (Address >> 4);\n Context.edi = (UINT32) (Address & 0xF);\n\n BlRtlCallLegacyInterruptService(0x15,\n &Context,\n &Context);\n\n if (((Context.eflags & RFLAGS_CF) != 0) || (Context.eax != 0x534D4150)) {\n\n BlRtlPrintf(\"SMAP: INT 15/E820 failed!\\n\");\n BlRtlHalt();\n }\n\n Index += 1;\n\n ContinuationValue = Context.ebx;\n\n if (ContinuationValue == 0) {\n\n break;\n }\n }\n\n BlSystemMemoryMap.EntryCount = Index;\n }\n\n#if SMAP_VERBOSE\n\n BlRtlPrintf(\"SMAP: %u entries\\n\", BlSystemMemoryMap.EntryCount);\n\n for (Index = 0; Index < BlSystemMemoryMap.EntryCount; Index += 1) {\n\n BlRtlPrintf(\"SMAP: %016I64x ... %016I64x %s\\n\",\n BlSystemMemoryMap.Entry[Index].Base,\n BlSystemMemoryMap.Entry[Index].Base + BlSystemMemoryMap.Entry[Index].Size - 1,\n BlSmapTypeString(BlSystemMemoryMap.Entry[Index].Type));\n }\n\n#endif\n\n return;\n}\n\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blstring.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blstring.cpp\n//\n// Abstract:\n//\n// This module implements string functions for the boot loader environment.\n//\n//--\n\n#include \"bl.h\"\n\n#define ABS(X) (((X) < 0) ? (-(X)) : (X))\n\n#define STRING_TOKEN_LONG 1\n#define STRING_TOKEN_ULONG 2\n#define STRING_TOKEN_ULONG_HEX 3\n#define STRING_TOKEN_LONGLONG 4\n#define STRING_TOKEN_ULONGLONG 5\n#define STRING_TOKEN_ULONGLONG_HEX 6\n#define STRING_TOKEN_PVOID 7\n#define STRING_TOKEN_PCHAR 8\n#define STRING_TOKEN_CHAR 9\n\nCHAR\nBlRtlConvertCharacterToUpperCase(\n CHAR C\n )\n\n//++\n//\n// Routine Description:\n//\n// This function converts the specified character to upper case.\n//\n// Arguments:\n//\n// C - Supplies the character to convert.\n//\n// Return Value:\n//\n// Upper case character matching the specified character.\n//\n//--\n\n{\n if ((C >= 'a') && (C <= 'z')) {\n\n return C + 'A' - 'a';\n }\n\n return C;\n}\n\nBOOLEAN\nBlRtlParsePositiveDecimal(\n PCSTR String,\n PUINT32 Number,\n PUINT32 CharactersConsumed\n )\n\n//++\n//\n// Routine Description:\n//\n// This function parses a positive decimal value.\n//\n// Arguments:\n//\n// String - Supplies a pointer to the string to parse.\n//\n// Number - Receives the number.\n//\n// CharactersConsumed - Receives the number of characters consumed.\n//\n//\n// Return Value:\n//\n// TRUE, if parse was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT32 Digit;\n UINT32 Index;\n UINT32 Temp;\n\n if ((String[0] < '0') || (String[0] > '9')) {\n\n return FALSE;\n }\n\n Index = 0;\n Temp = 0;\n\n for (;;) {\n\n if ((String[Index] < '0') || (String[Index] > '9')) {\n\n *Number = Temp;\n *CharactersConsumed = Index;\n return TRUE;\n }\n\n Digit = String[Index] - '0';\n\n if (((Temp * 10) + Digit) < Temp) {\n\n return FALSE;\n }\n\n Temp = (Temp * 10) + Digit;\n Index += 1;\n }\n}\n\nBOOLEAN\nBlRtlParseTypeSpecifier(\n PCSTR String,\n PINT32 Width,\n PCHAR PadCharacter,\n PUINT8 TokenType,\n PUINT32 CharactersConsumed\n )\n\n//++\n//\n// Routine Description:\n//\n// This function parses a type specifier.\n//\n// Arguments:\n//\n// String - Supplies a pointer to the string to parse.\n//\n// Width - Receives the width.\n//\n// PadCharacter - Receives the pad character.\n//\n// TokenType - Receives the token type.\n//\n// CharactersConsumed - Receives the number of characters consumed.\n//\n//\n// Return Value:\n//\n// TRUE, if parse was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT32 Advance;\n BOOLEAN WidthPresent;\n UINT32 Index;\n BOOLEAN Minus;\n UINT32 WidthPositiveValue;\n BOOLEAN Zero;\n\n SATISFY_OVERZEALOUS_COMPILER(WidthPositiveValue = 0);\n\n //\n // Check if type specifier character is present.\n //\n\n if (String[0] != '%') {\n\n return FALSE;\n }\n\n Index = 1;\n\n //\n // Check for pad modifiers.\n //\n\n Minus = FALSE;\n Zero = FALSE;\n\n for (;;) {\n\n if (String[Index] == '-') {\n\n if (Minus != FALSE) {\n\n return FALSE;\n }\n\n Minus = TRUE;\n Index += 1;\n\n } else if (String[Index] == '0') {\n\n if (Zero != FALSE) {\n\n return FALSE;\n }\n\n Zero = TRUE;\n Index += 1;\n\n } else {\n\n break;\n }\n }\n\n //\n // - and 0 pad modifiers are mutually exclusive.\n //\n\n if ((Minus != FALSE) && (Zero != FALSE)) {\n\n return FALSE;\n }\n\n //\n // If there is a width value, then parse it.\n //\n\n WidthPresent = ((String[Index] >= '1') && (String[Index] <= '9'));\n\n if (WidthPresent != FALSE) {\n\n if (BlRtlParsePositiveDecimal(&String[Index],\n &WidthPositiveValue,\n &Advance) == FALSE) {\n\n return FALSE;\n }\n\n Index += Advance;\n }\n\n //\n // Pad modifiers require width value.\n //\n\n if (((Minus != FALSE) || (Zero != FALSE)) && (WidthPresent == FALSE)) {\n\n return FALSE;\n }\n\n //\n // Set pad character.\n //\n\n if (Zero != FALSE) {\n\n *PadCharacter = '0';\n\n } else {\n\n *PadCharacter = ' ';\n }\n\n //\n // Compute signed width value.\n //\n\n if (WidthPresent == FALSE) {\n\n *Width = 0;\n\n } else if (Minus == FALSE) {\n\n *Width = (INT32) WidthPositiveValue;\n\n } else {\n\n *Width = -((INT32) WidthPositiveValue);\n }\n\n //\n // Set type character.\n //\n\n if (BlRtlEqualStringN(&String[Index], \"d\", 1) != FALSE) {\n\n *TokenType = STRING_TOKEN_LONG;\n Index += 1;\n\n } else if (BlRtlEqualStringN(&String[Index], \"u\", 1) != FALSE) {\n\n *TokenType = STRING_TOKEN_ULONG;\n Index += 1;\n\n } else if (BlRtlEqualStringN(&String[Index], \"x\", 1) != FALSE) {\n\n *TokenType = STRING_TOKEN_ULONG_HEX;\n Index += 1;\n\n } else if (BlRtlEqualStringN(&String[Index], \"I64d\", 4) != FALSE) {\n\n *TokenType = STRING_TOKEN_LONGLONG;\n Index += 4;\n\n } else if (BlRtlEqualStringN(&String[Index], \"I64u\", 4) != FALSE) {\n\n *TokenType = STRING_TOKEN_ULONGLONG;\n Index += 4;\n\n } else if (BlRtlEqualStringN(&String[Index], \"I64x\", 4) != FALSE) {\n\n *TokenType = STRING_TOKEN_ULONGLONG_HEX;\n Index += 4;\n\n } else if (BlRtlEqualStringN(&String[Index], \"p\", 1) != FALSE) {\n\n *TokenType = STRING_TOKEN_PVOID;\n Index += 1;\n\n } else if (BlRtlEqualStringN(&String[Index], \"s\", 1) != FALSE) {\n\n *TokenType = STRING_TOKEN_PCHAR;\n Index += 1;\n\n } else if (BlRtlEqualStringN(&String[Index], \"c\", 1) != FALSE) {\n\n *TokenType = STRING_TOKEN_CHAR;\n Index += 1;\n\n } else {\n\n return FALSE;\n }\n\n //\n // Set number of characters consumed.\n //\n\n *CharactersConsumed = Index;\n\n return TRUE;\n}\n\nBOOLEAN\nBlRtlFormatSignedDecimalLong(\n PCHAR Output,\n UINT32 OutputSize,\n INT32 Value,\n INT32 Width,\n PUINT32 CharactersConsumed\n )\n\n//++\n//\n// Routine Description:\n//\n// This function formats a signed decimal long.\n//\n// Arguments:\n//\n// Output - Supplies a pointer to the output buffer.\n//\n// OutputSize - Supplies the size of the output buffer.\n//\n// Value - Supplies the value to format.\n//\n// Width - Supplies the width.\n//\n// CharactersConsumed - Receives the number of characters consumed.\n//\n//\n// Return Value:\n//\n// TRUE, if format was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT32 Index;\n UINT32 MinimumWidth;\n BOOLEAN Minus;\n UINT32 NumberWidth;\n UINT32 PadWidth;\n UINT32 Temp;\n\n //\n // Check if this is a negative value.\n //\n\n Minus = (BOOLEAN) (Value < 0);\n\n //\n // Compute the number of characters necessary.\n //\n\n Temp = ABS(Value);\n NumberWidth = 0;\n\n do {\n\n NumberWidth += 1;\n Temp = Temp / 10;\n\n } while (Temp > 0);\n\n if (Minus != FALSE) {\n\n NumberWidth += 1;\n }\n\n PadWidth = 0;\n MinimumWidth = ABS(Width);\n\n if (MinimumWidth > NumberWidth) {\n\n PadWidth = MinimumWidth - NumberWidth;\n }\n\n //\n // Check if there is sufficient space in the output buffer.\n //\n\n if ((NumberWidth + PadWidth) > OutputSize) {\n\n return FALSE;\n }\n\n Index = 0;\n\n //\n // If right alignment is specified, then insert any necessary pads before the number.\n //\n\n if (Width > 0) {\n\n while (PadWidth > 0) {\n\n Output[Index] = ' ';\n Index += 1;\n PadWidth -= 1;\n }\n }\n\n //\n // Insert absolute number starting with the least significant digit, going right to left.\n //\n\n Temp = ABS(Value);\n Index += NumberWidth;\n\n do {\n\n Index -= 1;\n Output[Index] = (CHAR) ('0' + (Temp % 10));\n Temp = Temp / 10;\n\n } while (Temp > 0);\n\n //\n // If the number is negative, then insert the negative sign.\n //\n\n if (Minus != FALSE) {\n\n Index -= 1;\n Output[Index] = '-';\n }\n\n //\n // If left alignment was specified, then insert any necessary pads after the number.\n //\n\n Index += NumberWidth;\n\n while (PadWidth > 0) {\n\n Output[Index] = ' ';\n Index += 1;\n PadWidth -= 1;\n }\n\n //\n // Set number of characters consumed in the buffer.\n //\n\n *CharactersConsumed = Index;\n\n return TRUE;\n}\n\nBOOLEAN\nBlRtlFormatUnsignedLong(\n PCHAR Output,\n UINT32 OutputSize,\n UINT32 Value,\n UINT8 PadCharacter,\n INT32 Width,\n UINT32 Base,\n PUINT32 CharactersConsumed\n )\n\n//++\n//\n// Routine Description:\n//\n// This function formats an unsigned long.\n//\n// Arguments:\n//\n// Output - Supplies a pointer to the output buffer.\n//\n// OutputSize - Supplies the size of the output buffer.\n//\n// Value - Supplies the value to format.\n//\n// PadCharacter - Supplies the pad character.\n//\n// Width - Supplies the width.\n//\n// Base - Supplies the base.\n//\n// CharactersConsumed - Receives the number of characters consumed.\n//\n//\n// Return Value:\n//\n// TRUE, if format was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT32 Index;\n UINT32 MinimumWidth;\n UINT32 NumberWidth;\n UINT32 PadWidth;\n UINT32 Temp;\n\n if (Base == 0) {\n\n return FALSE;\n }\n\n //\n // Compute the number of characters necessary.\n //\n\n Temp = Value;\n NumberWidth = 0;\n\n do {\n\n NumberWidth += 1;\n Temp = Temp / Base;\n\n } while (Temp > 0);\n\n PadWidth = 0;\n MinimumWidth = ABS(Width);\n\n if (MinimumWidth > NumberWidth) {\n\n PadWidth = MinimumWidth - NumberWidth;\n }\n\n //\n // Check if there is sufficient space in the output buffer.\n //\n\n if ((NumberWidth + PadWidth) > OutputSize) {\n\n return FALSE;\n }\n\n Index = 0;\n\n //\n // If right alignment is specified, then insert any necessary pads before the number.\n //\n\n if (Width > 0) {\n\n while (PadWidth > 0) {\n\n Output[Index] = PadCharacter;\n Index += 1;\n PadWidth -= 1;\n }\n }\n\n //\n // Insert absolute number starting with the least significant digit, going right to left.\n //\n\n Temp = Value;\n Index += NumberWidth;\n\n do {\n\n Index -= 1;\n\n switch (Base) {\n\n case 10: {\n\n Output[Index] = (CHAR) ('0' + (Temp % Base));\n break;\n }\n\n case 16: {\n\n if ((Temp % Base) < 10) {\n\n Output[Index] = (CHAR) ('0' + (Temp % Base));\n\n } else {\n\n Output[Index] = (CHAR) ('A' + (Temp % Base) - 10);\n }\n\n break;\n }\n\n default: {\n\n return FALSE;\n }\n }\n\n Temp = Temp / Base;\n\n } while (Temp > 0);\n\n //\n // If left alignment was specified, then insert any necessary pads after the number.\n //\n\n Index += NumberWidth;\n\n while (PadWidth > 0) {\n\n Output[Index] = PadCharacter;\n Index += 1;\n PadWidth -= 1;\n }\n\n //\n // Set number of characters consumed in the buffer.\n //\n\n *CharactersConsumed = Index;\n\n return TRUE;\n}\n\nBOOLEAN\nBlRtlFormatUnsignedLongLong(\n PCHAR Output,\n UINT32 OutputSize,\n UINT64 Value,\n UINT8 PadCharacter,\n INT32 Width,\n UINT32 Base,\n PUINT32 CharactersConsumed\n )\n\n//++\n//\n// Routine Description:\n//\n// This function formats an unsigned long long.\n//\n// Arguments:\n//\n// Output - Supplies a pointer to the output buffer.\n//\n// OutputSize - Supplies the size of the output buffer.\n//\n// Value - Supplies the value to format.\n//\n// PadCharacter - Supplies the pad character.\n//\n// Width - Supplies the width.\n//\n// Base - Supplies the base.\n//\n// CharactersConsumed - Receives the number of characters consumed.\n//\n//\n// Return Value:\n//\n// TRUE, if format was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT32 Index;\n UINT32 MinimumWidth;\n UINT32 NumberWidth;\n UINT32 PadWidth;\n UINT64 Temp;\n\n if (Base == 0) {\n\n return FALSE;\n }\n\n //\n // Compute the number of characters necessary.\n //\n\n Temp = Value;\n NumberWidth = 0;\n\n do {\n\n NumberWidth += 1;\n Temp = Temp / Base;\n\n } while (Temp > 0);\n\n PadWidth = 0;\n MinimumWidth = ABS(Width);\n\n if (MinimumWidth > NumberWidth) {\n\n PadWidth = MinimumWidth - NumberWidth;\n }\n\n //\n // Check if there is sufficient space in the output buffer.\n //\n\n if ((NumberWidth + PadWidth) > OutputSize) {\n\n return FALSE;\n }\n\n Index = 0;\n\n //\n // If right alignment is specified, then insert any necessary pads before the number.\n //\n\n if (Width > 0) {\n\n while (PadWidth > 0) {\n\n Output[Index] = PadCharacter;\n Index += 1;\n PadWidth -= 1;\n }\n }\n\n //\n // Insert absolute number starting with the least significant digit, going right to left.\n //\n\n Temp = Value;\n Index += NumberWidth;\n\n do {\n\n Index -= 1;\n\n switch (Base) {\n\n case 10: {\n\n Output[Index] = (CHAR) ('0' + (Temp % Base));\n break;\n }\n\n case 16: {\n\n if ((Temp % Base) < 10) {\n\n Output[Index] = (CHAR) ('0' + (Temp % Base));\n\n } else {\n\n Output[Index] = (CHAR) ('A' + (Temp % Base) - 10);\n }\n\n break;\n }\n\n default: {\n\n return FALSE;\n }\n }\n\n Temp = Temp / Base;\n\n } while (Temp > 0);\n\n //\n // If left alignment was specified, then insert any necessary pads after the number.\n //\n\n Index += NumberWidth;\n\n while (PadWidth > 0) {\n\n Output[Index] = PadCharacter;\n Index += 1;\n PadWidth -= 1;\n }\n\n //\n // Set number of characters consumed in the buffer.\n //\n\n *CharactersConsumed = Index;\n\n return TRUE;\n}\n\nUINT32\nBlRtlStringLength(\n PCSTR String\n )\n\n//++\n//\n// Routine Description:\n//\n// This function returns the length of the specified string.\n//\n// Arguments:\n//\n// String - Supplies a pointer to the string.\n//\n// Return Value:\n//\n// Length of the string.\n//\n//--\n\n{\n UINT32 Index;\n\n Index = 0;\n\n while (String[Index] != 0) {\n\n Index += 1;\n }\n\n return Index;\n}\n\nUINT32\nBlRtlStringLengthW(\n PCWSTR String\n )\n\n//++\n//\n// Routine Description:\n//\n// This function returns the length of the specified wide string.\n//\n// Arguments:\n//\n// String - Supplies a pointer to the string.\n//\n// Return Value:\n//\n// Length of the string.\n//\n//--\n\n{\n UINT32 Index;\n\n Index = 0;\n\n while (String[Index] != 0) {\n\n Index += 1;\n }\n\n return Index;\n}\n\nBOOLEAN\nBlRtlFormatStringToken(\n PCHAR Output,\n UINT32 OutputSize,\n PCSTR String,\n INT32 Width,\n PUINT32 CharactersConsumed\n )\n\n//++\n//\n// Routine Description:\n//\n// This function formats a string token.\n//\n// Arguments:\n//\n// Output - Supplies a pointer to the output buffer.\n//\n// OutputSize - Supplies the size of the output buffer.\n//\n// String - Supplies the string token.\n//\n// Width - Supplies the width.\n//\n// CharactersConsumed - Receives the number of characters consumed.\n//\n//\n// Return Value:\n//\n// TRUE, if format was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT32 Index;\n UINT32 MinimumWidth;\n UINT32 PadWidth;\n UINT32 StringIndex;\n UINT32 StringLength;\n\n //\n // Compute string length, minimum width, and pad width.\n //\n\n StringLength = BlRtlStringLength(String);\n\n MinimumWidth = ABS(Width);\n\n PadWidth = 0;\n\n if (MinimumWidth > StringLength) {\n\n PadWidth = MinimumWidth - StringLength;\n }\n\n //\n // Check if there is sufficient space in the output buffer.\n //\n\n if ((StringLength + PadWidth) > OutputSize) {\n\n return FALSE;\n }\n\n Index = 0;\n\n //\n // If right alignment is specified, then insert any necessary pads before the string.\n //\n\n if (Width > 0) {\n\n while (PadWidth > 0) {\n\n Output[Index] = ' ';\n Index += 1;\n PadWidth -= 1;\n }\n }\n\n //\n // Copy the string.\n //\n\n for (StringIndex = 0; StringIndex < StringLength; StringIndex += 1) {\n\n Output[Index] = String[StringIndex];\n Index += 1;\n }\n\n //\n // If left alignment was specified, then insert any necessary pads after the string.\n //\n\n while (PadWidth > 0) {\n\n Output[Index] = ' ';\n Index += 1;\n PadWidth -= 1;\n }\n\n //\n // Set number of characters consumed in the buffer.\n //\n\n *CharactersConsumed = Index;\n\n return TRUE;\n}\n\nBOOLEAN\nBlRtlFormatChar(\n PCHAR Output,\n UINT32 OutputSize,\n CHAR Value,\n PUINT32 CharactersConsumed\n )\n\n//++\n//\n// Routine Description:\n//\n// This function formats a character.\n//\n// Arguments:\n//\n// Output - Supplies a pointer to the output buffer.\n//\n// OutputSize - Supplies the size of the output buffer.\n//\n// Value - Supplies the value to format.\n//\n// CharactersConsumed - Receives the number of characters consumed.\n//\n//\n// Return Value:\n//\n// TRUE, if format was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n //\n // Check if there is sufficient space in the output buffer.\n //\n\n if (1 > OutputSize) {\n\n return FALSE;\n }\n\n Output[0] = Value;\n\n //\n // Set number of characters consumed in the buffer.\n //\n\n *CharactersConsumed = 1;\n\n return TRUE;\n}\n\nBOOLEAN\nBlRtlFormatString(\n PCHAR Output,\n UINT32 OutputSize,\n PCSTR Format,\n va_list ArgumentList\n )\n\n//++\n//\n// Routine Description:\n//\n// This function formats a string.\n//\n// Arguments:\n//\n// Output - Supplies a pointer to the output buffer.\n//\n// OutputSize - Supplies the size of the output buffer.\n//\n// Format - Supplies the format string.\n//\n// ArgumentList - Supplies the input parameters.\n//\n// Return Value:\n//\n// TRUE, if format was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n UINT32 CharactersConsumed;\n UINT32 InputIndex;\n UINT32 OutputIndex;\n CHAR PadCharacter;\n UINT8 TokenType;\n INT32 Width;\n\n InputIndex = 0;\n OutputIndex = 0;\n\n for (;;) {\n\n if (OutputIndex == OutputSize) {\n\n return FALSE;\n }\n\n if (Format[InputIndex] == 0) {\n\n Output[OutputIndex] = 0;\n return TRUE;\n }\n\n if (Format[InputIndex] == '\\\\') {\n\n switch (Format[InputIndex + 1]) {\n\n case '\\\\': {\n\n Output[OutputIndex] = '\\\\';\n OutputIndex += 1;\n break;\n }\n\n case 'r': {\n\n Output[OutputIndex] = '\\r';\n OutputIndex += 1;\n break;\n }\n\n case 'n': {\n\n Output[OutputIndex] = '\\r';\n OutputIndex += 1;\n break;\n }\n\n default: {\n\n return FALSE;\n }\n }\n\n InputIndex += 2;\n continue;\n }\n\n if (BlRtlParseTypeSpecifier(&Format[InputIndex],\n &Width,\n &PadCharacter,\n &TokenType,\n &CharactersConsumed) != FALSE) {\n\n InputIndex += CharactersConsumed;\n\n switch (TokenType) {\n\n case STRING_TOKEN_LONG: {\n\n if (BlRtlFormatSignedDecimalLong(&Output[OutputIndex],\n OutputSize - OutputIndex,\n va_arg(ArgumentList, INT32),\n Width,\n &CharactersConsumed) == FALSE) {\n\n return FALSE;\n }\n\n OutputIndex += CharactersConsumed;\n break;\n }\n\n case STRING_TOKEN_ULONG: {\n\n if (BlRtlFormatUnsignedLong(&Output[OutputIndex],\n OutputSize - OutputIndex,\n va_arg(ArgumentList, UINT32),\n PadCharacter,\n Width,\n 10,\n &CharactersConsumed) == FALSE) {\n\n return FALSE;\n }\n\n OutputIndex += CharactersConsumed;\n break;\n }\n\n case STRING_TOKEN_ULONG_HEX: {\n\n if (BlRtlFormatUnsignedLong(&Output[OutputIndex],\n OutputSize - OutputIndex,\n va_arg(ArgumentList, UINT32),\n PadCharacter,\n Width,\n 16,\n &CharactersConsumed) == FALSE) {\n\n return FALSE;\n }\n\n OutputIndex += CharactersConsumed;\n break;\n }\n\n case STRING_TOKEN_ULONGLONG: {\n\n if (BlRtlFormatUnsignedLongLong(&Output[OutputIndex],\n OutputSize - OutputIndex,\n va_arg(ArgumentList, UINT64),\n PadCharacter,\n Width,\n 10,\n &CharactersConsumed) == FALSE) {\n\n return FALSE;\n }\n\n OutputIndex += CharactersConsumed;\n break;\n }\n\n case STRING_TOKEN_ULONGLONG_HEX: {\n\n if (BlRtlFormatUnsignedLongLong(&Output[OutputIndex],\n OutputSize - OutputIndex,\n va_arg(ArgumentList, UINT64),\n PadCharacter,\n Width,\n 16,\n &CharactersConsumed) == FALSE) {\n\n return FALSE;\n }\n\n OutputIndex += CharactersConsumed;\n break;\n }\n\n case STRING_TOKEN_PVOID: {\n\n#if defined(BOOT_X86)\n\n if (BlRtlFormatUnsignedLong(&Output[OutputIndex],\n OutputSize - OutputIndex,\n va_arg(ArgumentList, UINT32),\n '0',\n 8,\n 16,\n &CharactersConsumed) == FALSE) {\n\n return FALSE;\n }\n\n#elif defined(BOOT_X64)\n\n if (BlRtlFormatUnsignedLongLong(&Output[OutputIndex],\n OutputSize - OutputIndex,\n va_arg(ArgumentList, UINT64),\n '0',\n 16,\n 16,\n &CharactersConsumed) == FALSE) {\n\n return FALSE;\n }\n\n#endif\n\n OutputIndex += CharactersConsumed;\n break;\n }\n\n case STRING_TOKEN_PCHAR: {\n\n if (BlRtlFormatStringToken(&Output[OutputIndex],\n OutputSize - OutputIndex,\n va_arg(ArgumentList, PCHAR),\n Width,\n &CharactersConsumed) == FALSE) {\n\n return FALSE;\n }\n\n OutputIndex += CharactersConsumed;\n break;\n }\n\n case STRING_TOKEN_CHAR: {\n\n if (BlRtlFormatChar(&Output[OutputIndex],\n OutputSize - OutputIndex,\n va_arg(ArgumentList, CHAR),\n &CharactersConsumed) == FALSE) {\n\n return FALSE;\n }\n\n OutputIndex += CharactersConsumed;\n break;\n }\n }\n\n continue;\n }\n\n Output[OutputIndex] = Format[InputIndex];\n InputIndex += 1;\n OutputIndex += 1;\n }\n}\n\nBOOLEAN\nBlRtlPrintf(\n PCSTR Format,\n ...\n )\n\n//++\n//\n// Routine Description:\n//\n// This function implements C-style printf for the boot loader environment.\n//\n// Arguments:\n//\n// Format - Supplies the format string.\n//\n// ... - Supplies the input parameters.\n//\n// Return Value:\n//\n// TRUE, if operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n va_list ArgumentList;\n CHAR Buffer[4096];\n\n va_start(ArgumentList, Format);\n\n if (BlRtlFormatString(Buffer, sizeof(Buffer), Format, ArgumentList) == FALSE) {\n\n return FALSE;\n }\n\n BlVideoPrintString(Buffer);\n\n BlKdPrintString(Buffer);\n\n return TRUE;\n}\n\nBOOLEAN\nBlRtlEqualStringN(\n PCSTR String1,\n PCSTR String2,\n UINT32 Count\n )\n\n//++\n//\n// Routine Description:\n//\n// This function compares two strings.\n//\n// Arguments:\n//\n// String1 - Supplies a pointer to the first string.\n//\n// String2 - Supplies a pointer to the second string.\n//\n// Count - Number of characters to compare.\n//\n// Return Value:\n//\n// TRUE, if strings are equal.\n// FALSE, otherwise.\n//\n//--\n\n{\n while (Count > 0) {\n\n if ((*String1 == 0) || (*String2 == 0)) {\n\n return FALSE;\n }\n\n if (*String1 != *String2) {\n\n return FALSE;\n }\n\n String1 += 1;\n String2 += 1;\n Count -= 1;\n }\n\n return TRUE;\n}\n\nBOOLEAN\nBlRtlEqualStringI(\n PCSTR String1,\n PCSTR String2\n )\n\n//++\n//\n// Routine Description:\n//\n// This function compares two strings ignoring case differences.\n//\n// Arguments:\n//\n// String1 - Supplies a pointer to the first string.\n//\n// String2 - Supplies a pointer to the second string.\n//\n// Return Value:\n//\n// TRUE, if strings are equal.\n// FALSE, otherwise.\n//\n//--\n\n{\n for (;;) {\n\n if (BlRtlConvertCharacterToUpperCase(*String1) != BlRtlConvertCharacterToUpperCase(*String2)) {\n\n return FALSE;\n }\n\n if (*String1 == 0) {\n\n return TRUE;\n }\n\n String1 += 1;\n String2 += 1;\n }\n}\n\nPCSTR\nBlRtlFindSubstring(\n PCSTR String,\n PCSTR Substring\n )\n\n//++\n//\n// Routine Description:\n//\n// This function searches for a substring.\n//\n// Arguments:\n//\n// String - Supplies a pointer to the string to search in.\n//\n// Substring - Supplies a pointer to the substring to search for.\n//\n// Return Value:\n//\n// A pointer to the first instance of the substring, if search was successful.\n// NULL, otherwise.\n//\n//--\n\n{\n UINT32 SubstringLength;\n\n SubstringLength = BlRtlStringLength(Substring);\n\n while (*String != 0) {\n\n if (BlRtlEqualStringN(String, Substring, SubstringLength) != FALSE) {\n\n return String;\n }\n\n String += 1;\n }\n\n return NULL;\n}\n\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/bltrap.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// bltrap.cpp\n//\n// Abstract:\n//\n// This module implements trap capture.\n//\n//--\n\n\n#include \"bl.h\"\n\nIDTR BlIdtr;\nIDTE BlIdt[32];\n\nVOID\nBlTrapEnable(\n VOID\n )\n\n//++\n//\n\n{\n for (UINT32 i = 0; i < ARRAY_SIZE(BlIdt); i++) {\n\n UINT64 Enter = ((UINT64)BlTrapEnter) + i * 8;\n\n BlIdt[i].Offset0To15 =(UINT16)((Enter >> 0) & 0xffff);\n BlIdt[i].Offset16To31 = (UINT16)((Enter >> 16) & 0xffff);\n#if defined(BOOT_X64)\n BlIdt[i].Selector = LM_CODE_SELECTOR;\n#else\n BlIdt[i].Selector = PM_CODE_SELECTOR;\n#endif\n BlIdt[i].Flags = 0;\n BlIdt[i].Access = 0x8e;\n\n#if defined(BOOT_X64)\n BlIdt[i].Offset32To63 = (UINT32)((Enter >> 32) & 0xffffffff);\n#endif\n\n }\n BlIdtr.Limit = 32 * 8;\n BlIdtr.Base = (UINT64)BlIdt;\n\n BlTrapSetIdtr(&BlIdtr);\n}\n\nVOID\nBlTrapFatal(\n ULONG_PTR Trap,\n PBL_TRAP_CONTEXT Context\n )\n\n//++\n//\n// Routine Description:\n//\n// This function returns the specified memory type string.\n//\n// Arguments:\n//\n// Type - Supplies the memory type.\n//\n//--\n\n{\n BlVideoPrintf(\"\\n*** Fatal Trap: 0x%2x:%p [err=%p]\\n\",\n Trap, Context, Context->Err);\n\n#if defined(BOOT_X86)\n\n BlVideoPrintf(\" eip=%p efl=%p cr2=%p cs=%2x num=%02x\\n\",\n Context->Eip, Context->Efl, Context->Cr2,\n (UINT32)Context->Cs0, (UINT32)Context->Num);\n BlVideoPrintf(\" eax=%p ebx=%p ecx=%p edx=%p\\n\",\n Context->Eax, Context->Ebx, Context->Ecx, Context->Edx);\n BlVideoPrintf(\" esp=%p ebp=%p esi=%p edi=%p\\n\",\n Context->Esp, Context->Ebp, Context->Esi, Context->Edi);\n\n ULONG_PTR * ebp = (ULONG_PTR *)Context->Ebp;\n BlVideoPrintf(\"\\n\");\n BlVideoPrintf(\" Frame: next return arg0 arg1 arg2 arg3\\n\");\n for (int i = 0; i < 10; i++) {\n if (ebp < (ULONG_PTR*)0x10000 || ebp > (ULONG_PTR*)0x7fffffff) {\n BlVideoPrintf(\" %8x:\\n\", (ULONG_PTR)ebp);\n break;\n }\n ULONG_PTR *end = (ULONG_PTR *)ebp[0];\n if (end < ebp) {\n end = ebp + 6;\n }\n\n BlVideoPrintf(\" %p: %p %p\",\n (ULONG_PTR)ebp, ebp[0], ebp[1]);\n for (int i = 2; i < 6 && ebp + i < end; i++) {\n BlVideoPrintf(\" %p\", ebp[i]);\n }\n BlVideoPrintf(\"\\n\");\n\n ebp = (ULONG_PTR *)ebp[0];\n }\n\n BlVideoPrintf(\"\\n\");\n ULONG_PTR * esp = (ULONG_PTR *)(Context->Esp);\n for (int i = 0; i < 6; i++) {\n BlVideoPrintf(\" %p: %p %p %p %p\\n\", esp, esp[0], esp[1], esp[2], esp[3]);\n esp += 4;\n }\n BlVideoPrintf(\"\\n\");\n\n esp = (ULONG_PTR *)(Context);\n for (int i = 0; i < 6; i++) {\n BlVideoPrintf(\" %p: %p %p %p\\n\", esp, esp[0], esp[1], esp[2], esp[3]);\n esp += 4;\n }\n\n BlVideoPrintf(\"\\n\");\n UINT8 * eip = (UINT8 *)Context->Eip;\n BlVideoPrintf(\" %p:\", eip);\n for (int i = 0; i < 12; i++) {\n BlVideoPrintf(\" %02x\", eip[i]);\n }\n\n BlVideoPrintf(\"\\n\");\n\n#elif defined(BOOT_X64)\n\n BlVideoPrintf(\" rip=%p rfl=%p cs=%2x num=%02x\\n\",\n Context->Rip, Context->Rfl, (UINT32)Context->Cs0, (UINT32)Context->Num);\n BlVideoPrintf(\" rsp=%p rbp=%p cr2=%p\\n\",\n Context->Rsp, Context->Rbp, Context->Cr2);\n BlVideoPrintf(\" rax=%p rbx=%p rcx=%p\\n\",\n Context->Rax, Context->Rbx, Context->Rcx);\n BlVideoPrintf(\" rdx=%p rsi=%p rdi=%p\\n\",\n Context->Rdx, Context->Rsi, Context->Rdi);\n BlVideoPrintf(\" r08=%p r09=%p r10=%p\\n\",\n Context->R8, Context->R9, Context->R10);\n BlVideoPrintf(\" r11=%p r12=%p r13=%p\\n\",\n Context->R11, Context->R12, Context->R13);\n BlVideoPrintf(\" r14=%p r15=%p\\n\",\n Context->R14, Context->R15);\n\n ULONG_PTR * rbp = (ULONG_PTR *)Context->Rbp;\n BlVideoPrintf(\"\\n\");\n BlVideoPrintf(\" Frame: next return arg0\\n\");\n for (int i = 0; i < 10; i++) {\n if (rbp < (ULONG_PTR*)0x10000 || rbp > (ULONG_PTR*)0x7fffffff) {\n BlVideoPrintf(\" %p:\\n\", (ULONG_PTR)rbp);\n break;\n }\n ULONG_PTR *end = (ULONG_PTR *)rbp[0];\n if (end < rbp) {\n end = rbp + 3;\n }\n\n BlVideoPrintf(\" %p: %p %p\",\n (ULONG_PTR)rbp, rbp[0], rbp[1]);\n for (int i = 2; i < 3 && rbp + i < end; i++) {\n BlVideoPrintf(\" %p\", rbp[i]);\n }\n BlVideoPrintf(\"\\n\");\n\n rbp = (ULONG_PTR *)rbp[0];\n }\n\n BlVideoPrintf(\"\\n\");\n ULONG_PTR * rsp = (ULONG_PTR *)(Context->Rsp);\n for (int i = 0; i < 6; i++) {\n BlVideoPrintf(\" %p: %p %p %p\\n\", rsp, rsp[0], rsp[1], rsp[2]);\n rsp += 3;\n }\n BlVideoPrintf(\"\\n\");\n\n rsp = (ULONG_PTR *)(Context);\n for (int i = 0; i < 6; i++) {\n BlVideoPrintf(\" %p: %p %p %p\\n\", rsp, rsp[0], rsp[1], rsp[2]);\n rsp += 3;\n }\n\n BlVideoPrintf(\"\\n\");\n UINT8 * rip = (UINT8 *)Context->Rip;\n BlVideoPrintf(\" %p:\", rip);\n for (int i = 0; i < 12; i++) {\n BlVideoPrintf(\" %02x\", rip[i]);\n }\n\n BlVideoPrintf(\"\\n\");\n\n#endif\n\n for (;;);\n}\n\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blutil.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blutil.cpp\n//\n// Abstract:\n//\n// This module implements utility functions for the boot loader environment.\n//\n//--\n\n#include \"bl.h\"\n\nVOID\nBlReturnToLegacyMode(\n VOID\n );\n\nVOID\nBlRtlInitializeListHead(\n PLIST_ENTRY Head\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes the specified list head.\n//\n// Arguments:\n//\n// Head - Supplies a pointer to the list head to initialize.\n//\n//--\n\n{\n Head->Flink = Head->Blink = Head;\n}\n\nBOOLEAN\nBlRtlIsListEmpty(\n PLIST_ENTRY Head\n )\n\n//++\n//\n// Routine Description:\n//\n// This function checks if the specified list is empty.\n//\n// Arguments:\n//\n// Head - Supplies a pointer to the list head.\n//\n// Return Value:\n//\n// TRUE, if the list is empty.\n// FALSE, otherwise.\n//\n//--\n\n{\n return (BOOLEAN) (Head->Flink == Head);\n}\n\nBOOLEAN\nBlRtlRemoveEntryList(\n PLIST_ENTRY Entry\n )\n\n//++\n//\n// Routine Description:\n//\n// This function removes the specified entry from the list.\n//\n// Arguments:\n//\n// Entry - Supplies a pointer to the entry to remove.\n//\n// Return Value:\n//\n// TRUE, if this was the last entry in the list.\n// FALSE, otherwise.\n//\n//--\n\n{\n PLIST_ENTRY Blink;\n PLIST_ENTRY Flink;\n\n Blink = Entry->Blink;\n Flink = Entry->Flink;\n\n BLASSERT(Blink != Entry);\n BLASSERT(Flink != Entry);\n\n Blink->Flink = Flink;\n Flink->Blink = Blink;\n\n return (BOOLEAN) (Flink == Blink);\n}\n\nPLIST_ENTRY\nBlRtlRemoveHeadList(\n PLIST_ENTRY Head\n )\n\n//++\n//\n// Routine Description:\n//\n// This function removes an entry from the head of the specified list.\n//\n// Arguments:\n//\n// Head - Supplies a pointer to the list to remove from.\n//\n// Return Value:\n//\n// A pointer to the removed entry.\n//\n//--\n\n{\n PLIST_ENTRY Entry;\n PLIST_ENTRY Flink;\n\n BLASSERT(BlRtlIsListEmpty(Head) == FALSE);\n\n Entry = Head->Flink;\n Flink = Entry->Flink;\n\n Head->Flink = Flink;\n Flink->Blink = Head;\n\n return Entry;\n}\n\nPLIST_ENTRY\nBlRtlRemoveTailList(\n PLIST_ENTRY Head\n )\n\n//++\n//\n// Routine Description:\n//\n// This function removes an entry from the tail of the specified list.\n//\n// Arguments:\n//\n// Head - Supplies a pointer to the list to remove from.\n//\n// Return Value:\n//\n// A pointer to the removed entry.\n//\n//--\n\n{\n PLIST_ENTRY Blink;\n PLIST_ENTRY Entry;\n\n BLASSERT(BlRtlIsListEmpty(Head) == FALSE);\n\n Entry = Head->Blink;\n Blink = Entry->Blink;\n\n Head->Blink = Blink;\n Blink->Flink = Head;\n\n return Entry;\n}\n\nVOID\nBlRtlInsertTailList(\n PLIST_ENTRY Head,\n PLIST_ENTRY Entry\n )\n\n//++\n//\n// Routine Description:\n//\n// This function inserts the specified entry to the tail of the specified list.\n//\n// Arguments:\n//\n// Head - Supplies a pointer to the list to insert to.\n//\n// Entry - Supplies a pointer to the entry to insert.\n//\n//--\n\n{\n PLIST_ENTRY Blink;\n\n Blink = Head->Blink;\n\n Entry->Flink = Head;\n Entry->Blink = Blink;\n\n Head->Blink = Entry;\n Blink->Flink = Entry;\n}\n\nVOID\nBlRtlInsertHeadList(\n PLIST_ENTRY Head,\n PLIST_ENTRY Entry\n )\n\n//++\n//\n// Routine Description:\n//\n// This function inserts the specified entry to the head of the specified list.\n//\n// Arguments:\n//\n// Head - Supplies a pointer to the list to insert to.\n//\n// Entry - Supplies a pointer to the entry to insert.\n//\n//--\n\n{\n PLIST_ENTRY Flink;\n\n Flink = Head->Flink;\n\n Entry->Flink = Flink;\n Entry->Blink = Head;\n\n Head->Flink = Entry;\n Flink->Blink = Entry;\n}\n\nVOID\nBlRtlConvertLinearPointerToFarPointer(\n PVOID LinearPointer,\n PFAR_POINTER FarPointer\n )\n\n//++\n//\n// Routine Description:\n//\n// This function converts the specified linear pointer to a legacy far pointer.\n//\n// Arguments:\n//\n// LinearPointer - Supplies the linear pointer to convert.\n//\n// FarPointer - Receives the legacy far pointer.\n//\n//--\n\n{\n BLASSERT((ULONG_PTR) LinearPointer < LEGACY_MEMORY_LIMIT);\n\n FarPointer->Segment = (UINT16) (((ULONG_PTR) LinearPointer) >> 4);\n FarPointer->Offset = (((UINT16) (ULONG_PTR) LinearPointer) & 0xF);\n}\n\nPVOID\nBlRtlConvertFarPointerToLinearPointer(\n PFAR_POINTER FarPointer\n )\n\n//++\n//\n// Routine Description:\n//\n// This function converts the specified legacy far pointer to a linear pointer.\n//\n// Arguments:\n//\n// FarPointer - Supplies the legacy far pointer to convert.\n//\n// Return Value:\n//\n// Linear pointer matching the specified legacy far pointer.\n//\n//--\n\n{\n\n return (PVOID) (((ULONG_PTR) FarPointer->Segment << 4) + ((ULONG_PTR) FarPointer->Offset));\n}\n\nVOID\nBlRtlZeroMemory(\n PVOID Buffer,\n ULONG_PTR Length\n )\n\n//++\n//\n// Routine Description:\n//\n// This function zeroes the specified buffer.\n//\n// Arguments:\n//\n// Buffer - Supplies a pointer to the buffer to zero.\n//\n// Length - Supplies the length of the buffer.\n//\n//--\n\n{\n PUINT8 Limit;\n PUINT8 Next;\n\n Next = (PUINT8) Buffer;\n Limit = Next + Length;\n\n while (Next < Limit) {\n\n *Next = 0;\n Next += 1;\n }\n}\n\nVOID\nBlRtlCopyMemory(\n PVOID Destination,\n PCVOID Source,\n ULONG_PTR Length\n )\n\n//++\n//\n// Routine Description:\n//\n// This function copies data from the source buffer to the destination buffer.\n//\n// Arguments:\n//\n// Destination - Receives copied data.\n//\n// Source - Supplies data to copy.\n//\n// Length - Supplies the length of the data to copy.\n//\n//--\n\n{\n ULONG_PTR DestinationEnd;\n ULONG_PTR DestinationStart;\n ULONG_PTR Index;\n ULONG_PTR SourceEnd;\n ULONG_PTR SourceStart;\n\n if (Length == 0) {\n\n return;\n }\n\n SourceStart = (ULONG_PTR) Source;\n SourceEnd = SourceStart + Length;\n DestinationStart = (ULONG_PTR) Destination;\n DestinationEnd = DestinationStart + Length;\n\n //\n // If the higher part of the source buffer intersects with the destination\n // buffer, then perform a reverse copy. Otherwise, perform a regular copy.\n //\n\n if ((SourceStart < DestinationStart) && (SourceEnd > DestinationStart)) {\n\n Index = Length;\n\n do {\n\n Index -= 1;\n\n ((PUINT8) Destination)[Index] = ((PUINT8) Source)[Index];\n\n } while (Index > 0);\n\n } else {\n\n for (Index = 0; Index < Length; Index += 1) {\n\n ((PUINT8) Destination)[Index] = ((PUINT8) Source)[Index];\n }\n }\n}\n\nBOOLEAN\nBlRtlCompareMemory(\n PCVOID Buffer1,\n PCVOID Buffer2,\n ULONG_PTR Length\n )\n\n//++\n//\n// Routine Description:\n//\n// This function compares the data in the supplied buffers.\n//\n// Arguments:\n//\n// Buffer1 - Supplies the first buffer.\n//\n// Buffer2 - Supplies the second buffer.\n//\n// Length - Supplies the number of bytes to compare.\n//\n// Return Value:\n//\n// TRUE, if buffers contain identical data.\n// FALSE, otherwise.\n//\n//--\n\n{\n ULONG_PTR Index;\n\n for (Index = 0; Index < Length; Index += 1) {\n\n if (((PUINT8) Buffer1)[Index] != ((PUINT8) Buffer2)[Index]) {\n\n return FALSE;\n }\n }\n\n return TRUE;\n}\n\nVOID\nBlRtlMakeLegacyCall(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function switches back to legacy mode, makes the call\n// specified in the BEB, and returns back to normal mode.\n//\n//--\n\n{\n //\n // Return to legacy mode.\n //\n\n BlReturnToLegacyMode();\n\n //\n // Re-enable A20 gate -- this is absolutely necessary, because some\n // legacy calls (such as some PXE implementations) modify A20 state.\n //\n\n BlMmEnableA20Gate();\n}\n\nVOID\nBlRtlCallLegacyInterruptService(\n UINT8 Vector,\n PBL_LEGACY_CALL_CONTEXT Input,\n PBL_LEGACY_CALL_CONTEXT Output\n )\n\n//++\n//\n// Routine Description:\n//\n// This function calls the specified legacy interrupt service.\n//\n// Arguments:\n//\n// Vector - Supplies the legacy interrupt service vector to call.\n//\n// Input - Supplies a pointer to the input context for the call.\n//\n// Output - Supplies a pointer to the output context to fill after the call.\n//\n//--\n\n{\n PBEB Beb;\n\n Beb = BlGetBeb();\n\n Beb->LegacyCall_OpCode = LC_INTXX;\n Beb->LegacyCall_Vector = Vector;\n Beb->LegacyCall_ax = Input->eax;\n Beb->LegacyCall_bx = Input->ebx;\n Beb->LegacyCall_cx = Input->ecx;\n Beb->LegacyCall_dx = Input->edx;\n Beb->LegacyCall_si = Input->esi;\n Beb->LegacyCall_di = Input->edi;\n Beb->LegacyCall_ds = Input->ds;\n Beb->LegacyCall_es = Input->es;\n\n BlRtlMakeLegacyCall();\n\n Output->eax = Beb->LegacyCall_ax;\n Output->ebx = Beb->LegacyCall_bx;\n Output->ecx = Beb->LegacyCall_cx;\n Output->edx = Beb->LegacyCall_dx;\n Output->esi = Beb->LegacyCall_si;\n Output->edi = Beb->LegacyCall_di;\n Output->ds = Beb->LegacyCall_ds;\n Output->es = Beb->LegacyCall_es;\n Output->eflags = Beb->LegacyCall_flags;\n}\n\nVOID\nBlRtlCallLegacyFunction(\n UINT16 CodeSegment16,\n UINT16 CodeOffset16,\n PVOID CallFrame,\n UINT32 CallFrameSize,\n PBL_LEGACY_CALL_CONTEXT Input,\n PBL_LEGACY_CALL_CONTEXT Output\n )\n\n//++\n//\n// Routine Description:\n//\n// This function calls the specified legacy function.\n//\n// Arguments:\n//\n// CodeSegment16 - Supplies the 16-bit segment value for the function to call.\n//\n// CodeOffset16 - Supplies the 16-bit offset value for the function to call.\n//\n// CallFrame - Supplies a pointer to the call frame.\n//\n// CallFrameSize - Supplies the size of the call frame.\n//\n// Input - Supplies the input context for the call.\n//\n// Output - Receives the output context after the call.\n//\n//--\n\n{\n PBEB Beb;\n\n BLASSERT((ULONG_PTR) CallFrame < LEGACY_MEMORY_LIMIT);\n\n BLASSERT(((ULONG_PTR) CallFrame + CallFrameSize) < LEGACY_MEMORY_LIMIT);\n\n Beb = BlGetBeb();\n\n Beb->LegacyCall_OpCode = LC_FARCALL;\n Beb->LegacyCall_FuncPtr.Segment = CodeSegment16;\n Beb->LegacyCall_FuncPtr.Offset = CodeOffset16;\n BlRtlConvertLinearPointerToFarPointer(CallFrame, &Beb->LegacyCall_FramePtr);\n Beb->LegacyCall_FrameSize = CallFrameSize;\n Beb->LegacyCall_ax = Input->eax;\n Beb->LegacyCall_bx = Input->ebx;\n Beb->LegacyCall_cx = Input->ecx;\n Beb->LegacyCall_dx = Input->edx;\n Beb->LegacyCall_si = Input->esi;\n Beb->LegacyCall_di = Input->edi;\n Beb->LegacyCall_ds = Input->ds;\n Beb->LegacyCall_es = Input->es;\n\n BlRtlMakeLegacyCall();\n\n Output->eax = Beb->LegacyCall_ax;\n Output->ebx = Beb->LegacyCall_bx;\n Output->ecx = Beb->LegacyCall_cx;\n Output->edx = Beb->LegacyCall_dx;\n Output->esi = Beb->LegacyCall_si;\n Output->edi = Beb->LegacyCall_di;\n Output->ds = Beb->LegacyCall_ds;\n Output->es = Beb->LegacyCall_es;\n Output->eflags = Beb->LegacyCall_flags;\n}\n\nVOID\nBlRtlHaltInternal(\n PCSTR FileName,\n UINT32 LineNumber\n )\n\n//++\n//\n// Routine Description:\n//\n// This function halts execution.\n//\n// Arguments:\n//\n// FileName - file associated with call site.\n//\n// LineNumber - line associated with call site.\n//\n//--\n\n{\n BlRtlPrintf(\"BL: Halt! %s(%d)\\n\", FileName, LineNumber);\n\n for (;;) {\n ;\n }\n}\n\nVOID\nBlRtlAssertFailedPtr(\n PCSTR FileName,\n UINT32 LineNumber,\n ULONG_PTR Param\n )\n\n//++\n//\n// Routine Description:\n//\n// This function halts execution.\n//\n// Arguments:\n//\n// FileName - file associated with call site.\n//\n// LineNumber - line associated with call site.\n//\n//--\n\n{\n BlRtlPrintf(\"BL: Assert failed! %s(%d) (%p)\\n\", FileName, LineNumber, Param);\n\n for (;;) {\n ;\n }\n}\n\nVOID\nBlRtlAssertFailed(\n PCSTR FileName,\n UINT32 LineNumber\n )\n\n//++\n//\n// Routine Description:\n//\n// This function halts execution.\n//\n// Arguments:\n//\n// FileName - file associated with call site.\n//\n// LineNumber - line associated with call site.\n//\n//--\n\n{\n BlRtlAssertFailedPtr(FileName, LineNumber, 0);\n}\n\nUINT8\nBlRtlComputeChecksum8(\n PCVOID Buffer,\n UINT32 Size\n )\n\n//++\n//\n// Routine Description:\n//\n// This function computes the 8-bit checksum of the specified buffer.\n//\n// Arguments:\n//\n// Buffer - Supplies a pointer to the buffer.\n//\n// Size - Supplies the size of the buffer.\n//\n// Return Value:\n//\n// 8-bit check sum of the specified buffer.\n//\n//--\n\n{\n UINT8 Checksum;\n UINT32 Index;\n\n Checksum = 0;\n\n for (Index = 0; Index < Size; Index += 1) {\n\n Checksum = Checksum + ((PUINT8) Buffer)[Index];\n }\n\n return Checksum;\n}\n\nBOOLEAN\nBlRtlGetDriveParameters(\n UINT8 DriveId,\n PINT13_DRIVE_PARAMETERS DriveParameters\n )\n\n//++\n//\n// Routine Description:\n//\n// This function gets the parameters for the specified drive.\n//\n// Arguments:\n//\n// DriveId - Supplies the ID of the drive to query.\n//\n// DriveParameters - Receives drive parameters.\n//\n// Return Value:\n//\n// TRUE, if query operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n BL_LEGACY_CALL_CONTEXT Context;\n FAR_POINTER FarPointer;\n\n BlRtlZeroMemory(DriveParameters, sizeof(INT13_DRIVE_PARAMETERS));\n\n DriveParameters->StructureSize = sizeof(INT13_DRIVE_PARAMETERS);\n\n BlRtlConvertLinearPointerToFarPointer(DriveParameters, &FarPointer);\n\n BlRtlZeroMemory(&Context, sizeof(Context));\n\n Context.eax = 0x4800;\n Context.edx = DriveId;\n Context.ds = FarPointer.Segment;\n Context.esi = FarPointer.Offset;\n\n BlRtlCallLegacyInterruptService(0x13,\n &Context,\n &Context);\n\n if (((Context.eflags & RFLAGS_CF) != 0) || ((Context.eax & 0xFF00) != 0)) {\n\n return FALSE;\n }\n\n return TRUE;\n}\n\n#pragma pack(1)\n\ntypedef struct _INT13_DISK_ADDRESS_PACKET {\n UINT8 PacketSize;\n UINT8 Reserved;\n UINT16 NumberOfBlocks;\n FAR_POINTER Buffer;\n UINT64 FirstBlock;\n} INT13_DISK_ADDRESS_PACKET, *PINT13_DISK_ADDRESS_PACKET;\n\nC_ASSERT(sizeof(INT13_DISK_ADDRESS_PACKET) == 0x10);\n\n#pragma pack()\n\nINT13_DISK_ADDRESS_PACKET BlInt13AddressPacket;\n\nBOOLEAN\nBlRtlReadDrive(\n UINT8 DriveId,\n UINT64 FirstBlock,\n UINT16 NumberOfBlocks,\n PVOID Buffer\n )\n\n//++\n//\n// Routine Description:\n//\n// This function reads from the specified drive region.\n//\n// Arguments:\n//\n// DriveId - Supplies the ID of the drive to read from.\n//\n// FirstBlock - Supplies the first block to read.\n//\n// NumberOfBlocks - Supplies the number of blocks to read.\n//\n// Buffer - Receives data.\n//\n// Return Value:\n//\n// TRUE, if read operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n FAR_POINTER AddressPacketPointer;\n BL_LEGACY_CALL_CONTEXT Context;\n\n BlRtlZeroMemory(&BlInt13AddressPacket, sizeof(BlInt13AddressPacket));\n BlRtlZeroMemory(&Context, sizeof(Context));\n\n BLASSERT(((ULONG_PTR) &BlInt13AddressPacket) < LEGACY_MEMORY_LIMIT);\n BLASSERT((ULONG_PTR) Buffer < LEGACY_MEMORY_LIMIT);\n\n BlInt13AddressPacket.PacketSize = sizeof(BlInt13AddressPacket);\n BlInt13AddressPacket.FirstBlock = FirstBlock;\n BlInt13AddressPacket.NumberOfBlocks = NumberOfBlocks;\n BlRtlConvertLinearPointerToFarPointer(Buffer, &BlInt13AddressPacket.Buffer);\n\n BlRtlConvertLinearPointerToFarPointer(&BlInt13AddressPacket, &AddressPacketPointer);\n\n Context.eax = 0x4200;\n Context.edx = DriveId;\n Context.ds = AddressPacketPointer.Segment;\n Context.esi = AddressPacketPointer.Offset;\n\n BlRtlCallLegacyInterruptService(0x13,\n &Context,\n &Context);\n\n if (((Context.eflags & RFLAGS_CF) != 0) || ((Context.eax & 0xFF00) != 0)) {\n\n return FALSE;\n }\n\n return TRUE;\n}\n\nBOOLEAN\n(*BlFsGetFileSize)(\n PCSTR Path,\n PUINT32 FileSize\n );\n\nBOOLEAN\n(*BlFsReadFile)(\n PCSTR Path,\n PVOID Buffer,\n UINT32 NumberOfBytes\n );\n\n#define CMOS_CONTROL_REGISTER 0x0070\n#define CMOS_DATA_REGISTER 0x0071\n\n#define CMOS_SECONDS_REGISTER 0x00\n#define CMOS_MINUTES_REGISTER 0x02\n#define CMOS_HOURS_REGISTER 0x04\n#define CMOS_DAYS_REGISTER 0x07\n#define CMOS_MONTHS_REGISTER 0x08\n#define CMOS_YEARS_REGISTER 0x09\n#define CMOS_STATUS_REGISTER_A 0x0A\n#define CMOS_STATUS_REGISTER_B 0x0B\n#define CMOS_SHUTDOWN_REGISTER 0x0F\n\n#define CMOS_CLOCK_IN_BINARY 0x04\n#define CMOS_ENABLE_PERIODIC_TIMER 0x40\n#define CMOS_RATE_MASK 0x0F\n#define CMOS_DEFAULT_RATE 0x06\n\nUINT8\nBlCmosReadRegister(\n UINT8 Register\n )\n\n//++\n//\n// Routine Description:\n//\n// This function reads from the specified CMOS register.\n//\n// Arguments:\n//\n// Register - Supplies the CMOS register to read from.\n//\n// Return Value:\n//\n// Value read from the specified CMOS register.\n//\n//--\n\n{\n BlRtlWritePort8(CMOS_CONTROL_REGISTER, Register);\n\n return BlRtlReadPort8(CMOS_DATA_REGISTER);\n}\n\nVOID\nBlCmosWriteRegister(\n UINT8 Register,\n UINT8 Value\n )\n\n//++\n//\n// Routine Description:\n//\n// This function writes to the specified CMOS register.\n//\n// Arguments:\n//\n// Register - Supplies the CMOS register to write to.\n//\n// Value - Supplies the value to write.\n//\n//--\n\n{\n BlRtlWritePort8(CMOS_CONTROL_REGISTER, Register);\n\n BlRtlWritePort8(CMOS_DATA_REGISTER, Value);\n}\n\nVOID\nBlRtlResetSystem(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function resets the system.\n//\n//--\n\n{\n BL_LEGACY_CALL_CONTEXT Context;\n UINT8 Value;\n\n //\n // Issue a no-op legacy operation to restore legacy context.\n //\n\n BlGetBeb()->LegacyCall_OpCode = LC_NOP;\n BlRtlMakeLegacyCall();\n\n //\n // Disable periodic interrupt.\n //\n\n Value = BlCmosReadRegister(CMOS_STATUS_REGISTER_B);\n Value &= ~CMOS_ENABLE_PERIODIC_TIMER;\n BlCmosWriteRegister(CMOS_STATUS_REGISTER_B, Value);\n\n //\n // Set default rate.\n //\n\n Value = BlCmosReadRegister(CMOS_STATUS_REGISTER_A);\n Value &= ~CMOS_RATE_MASK;\n Value |= CMOS_DEFAULT_RATE;\n BlCmosWriteRegister(CMOS_STATUS_REGISTER_A, Value);\n\n //\n // Set reset reason.\n //\n\n BlCmosWriteRegister(CMOS_SHUTDOWN_REGISTER, 0);\n\n //\n // Try to reset using ACPI.\n //\n\n BlRtlPrintf(\"BL: Attempting reset with ACPI.\\n\");\n\n BlAcpiResetSystem();\n\n //\n // If the ACPI call returned, then it indicates that ACPI reset is\n // not supported, so try to reset with the keyboard controller.\n //\n\n BlRtlPrintf(\"BL: Attempting reset with keyboard controller.\\n\");\n\n BL_KEYBOARD_WRITE_COMMAND(BL_KEYBOARD_COMMAND_PULSE_RESET_BIT);\n\n //\n // Issue INT19 as last resort.\n //\n\n BlRtlZeroMemory(&Context, sizeof(Context));\n\n BlRtlCallLegacyInterruptService(0x19,\n &Context,\n &Context);\n\n for (;;) {\n\n }\n}\n\nVOID\nBlRtlShutdownSystem(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function shuts down the system.\n//\n//--\n\n{\n BL_LEGACY_CALL_CONTEXT Context;\n UINT32 Index;\n\n //\n // AIFIX: Add ACPI shutdown logic here.\n //\n\n BlRtlPrintf(\"BL: Attempting system shutdown through APM.\\n\");\n\n //\n // APM installation check.\n //\n\n#if APM_VERBOSE\n\n BlRtlPrintf(\"APM: INT15/5300h [Installation Check]\\n\");\n\n#endif\n\n BlRtlZeroMemory(&Context, sizeof(Context));\n\n Context.eax = 0x5300;\n\n BlRtlCallLegacyInterruptService(0x15,\n &Context,\n &Context);\n\n if (((Context.eflags & RFLAGS_CF) != 0) || (Context.ebx != 0x504D)) {\n\n BlRtlPrintf(\"APM: Not available!\\n\");\n BlRtlHalt();\n }\n\n#if APM_VERBOSE\n\n BlRtlPrintf(\"APM: Found APM v%u.%u.\\n\",\n (Context.eax >> 8) & 0xFF,\n Context.eax && 0xFF);\n\n#endif\n\n //\n // Connect real-mode interface.\n //\n\n#if APM_VERBOSE\n\n BlRtlPrintf(\"APM: INT15/5301h [Connect Real-Mode Interface]\\n\");\n\n#endif\n\n BlRtlZeroMemory(&Context, sizeof(Context));\n\n Context.eax = 0x5301;\n\n BlRtlCallLegacyInterruptService(0x15,\n &Context,\n &Context);\n\n if ((Context.eflags & RFLAGS_CF) != 0) {\n\n BlRtlPrintf(\"APM: INT15/5301h failed!\\n\");\n BlRtlHalt();\n }\n\n //\n // Set APM driver version.\n //\n\n#if APM_VERBOSE\n\n BlRtlPrintf(\"APM: INT15/530Eh [Set APM Driver Version]\\n\");\n\n#endif\n\n BlRtlZeroMemory(&Context, sizeof(Context));\n\n Context.eax = 0x530E;\n Context.ecx = 0x0102;\n\n BlRtlCallLegacyInterruptService(0x15,\n &Context,\n &Context);\n\n if ((Context.eflags & RFLAGS_CF) != 0) {\n\n BlRtlPrintf(\"APM: INT15/530Eh failed!\\n\");\n BlRtlHalt();\n }\n\n#if APM_VERBOSE\n\n BlRtlPrintf(\"APM: INT15/5307h [Shutdown]\\n\");\n\n#endif\n\n //\n // Announce shutdown.\n //\n // Note that the lab infrastructure searches for this string\n // when attempting to determine if the host successfully\n // reached shutdown.\n //\n\n BlRtlPrintf(\"APM: Power-off via APM.\\n\");\n\n //\n // Issue APM shutdown command.\n //\n\n Context.eax = 0x5307;\n Context.ebx = 1;\n Context.ecx = 3;\n\n BlRtlCallLegacyInterruptService(0x15,\n &Context,\n &Context);\n\n for (;;) {\n\n }\n}\n\nUINT8\nBlRtlConvertBcdToBinary8(\n UINT8 BcdValue\n )\n\n//++\n//\n// Routine Description:\n//\n// This function converts the specified 8-bit BCD value to binary.\n//\n// Arguments:\n//\n// BcdValue - Supplies the BCD value to convert.\n//\n// Return Value:\n//\n// Binary value matching the specified BCD value.\n//\n//--\n\n{\n return (((BcdValue >> 4) & 0xF) * 10) + (BcdValue & 0xF);\n}\n\nVOID\nBlRtlGetCurrentTime(\n PBL_TIME Time\n )\n\n//++\n//\n// Routine Description:\n//\n// This function queries the current time.\n//\n// Arguments:\n//\n// Time - Receives current time.\n//\n//--\n\n{\n //\n // Query CMOS RTC.\n //\n\n Time->Year = BlCmosReadRegister(CMOS_YEARS_REGISTER);\n Time->Month = BlCmosReadRegister(CMOS_MONTHS_REGISTER);\n Time->Day = BlCmosReadRegister(CMOS_DAYS_REGISTER);\n Time->Hour = BlCmosReadRegister(CMOS_HOURS_REGISTER);\n Time->Minute = BlCmosReadRegister(CMOS_MINUTES_REGISTER);\n Time->Second = BlCmosReadRegister(CMOS_SECONDS_REGISTER);\n\n //\n // If the clock is in BCD format, then convert it to binary.\n //\n\n if ((BlCmosReadRegister(CMOS_STATUS_REGISTER_B) & CMOS_CLOCK_IN_BINARY) == 0) {\n\n Time->Year = BlRtlConvertBcdToBinary8((UINT8) Time->Year);\n Time->Month = BlRtlConvertBcdToBinary8(Time->Month);\n Time->Day = BlRtlConvertBcdToBinary8(Time->Day);\n Time->Hour = BlRtlConvertBcdToBinary8(Time->Hour);\n Time->Minute = BlRtlConvertBcdToBinary8(Time->Minute);\n Time->Second = BlRtlConvertBcdToBinary8(Time->Second);\n }\n}\n\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blvesa.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blvesa.cpp\n//\n// Abstract:\n//\n// This module implements VESA grahics support for the boot loader.\n//\n//--\n\n#include \"bl.h\"\n\n#pragma pack(1)\n\ntypedef union __declspec(align(16)) _BL_VESA_INFO {\n struct {\n UINT8 Signature[4];\n UINT16 Version;\n FAR_POINTER Oem; // LPCHAR\n UINT8 Capabilities[4];\n FAR_POINTER Modes; // LPUSHORT\n UINT16 Memory;\n };\n UINT8 Raw[1024];\n} BL_VESA_INFO, *PBL_VESA_INFO;\n\ntypedef union __declspec(align(16)) _BL_VESA_MODE {\n struct {\n UINT16 Attributes;\n UINT8 WindowA;\n UINT8 WindowB;\n UINT16 Granularity;\n UINT16 Size;\n UINT16 WindowASegment;\n UINT16 WindowBSegment;\n FAR_POINTER WindowFuncPtr; // LPUCHAR\n UINT16 BytesPerLine;\n UINT16 XRes;\n UINT16 YRes;\n UINT8 XCharSize;\n UINT8 YCharSize;\n UINT8 Planes;\n UINT8 BitsPerPixel;\n UINT8 Banks;\n UINT8 MemoryModel;\n UINT8 BankSize;\n UINT8 ImagePages;\n UINT8 Reserved;\n UINT8 RedMaskSize;\n UINT8 RedFieldPos;\n UINT8 GreenMaskSize;\n UINT8 GreenFieldPos;\n UINT8 BlueMaskSize;\n UINT8 BlueFieldPos;\n UINT8 ReservedMaskSize;\n UINT8 ReservedFieldPos;\n UINT8 DirectColorInfo;\n\n // VBE 2.0\n UINT32 PhysBasePtr;\n UINT32 Reserved1;\n UINT16 Reserved2;\n };\n UINT8 Raw[1024];\n} BL_VESA_MODE, *PBL_VESA_MODE;\n\n#pragma pack()\n\nBL_VESA_INFO BlVesaInfo;\nBL_VESA_MODE BlVesaMode;\nULONG_PTR BlVesaVideoBuffer;\n\nUINT32\nBlVesaInvoke(\n UINT32 Ax,\n UINT32 Bx,\n UINT32 Cx,\n PVOID Buffer\n )\n{\n ULONG_PTR Address;\n BL_LEGACY_CALL_CONTEXT Context;\n\n BlRtlZeroMemory(&Context, sizeof(Context));\n\n Context.eax = Ax;\n Context.ebx = Bx;\n Context.ecx = Cx;\n\n Address = (ULONG_PTR)Buffer;\n Context.es = (UINT32)(Address >> 4);\n Context.edi = (UINT32)(Address & 0xF);\n\n BlRtlCallLegacyInterruptService(0x10, &Context, &Context);\n\n return Context.eax;\n}\n\nBOOLEAN\nBlVesaInitialize(\n VOID\n )\n{\n UINT32 Returned;\n PUINT16 ModeList;\n UINT16 Mode;\n ULONG_PTR Video;\n\n //\n // Determine if a VESA video card is enabled.\n //\n\n BlRtlZeroMemory(&BlVesaInfo, sizeof(BlVesaInfo));\n\n Returned = BlVesaInvoke(0x4f00, 0, 0, &BlVesaInfo);\n\n if (Returned != 0x4f ||\n BlVesaInfo.Signature[0] != 'V' ||\n BlVesaInfo.Signature[1] != 'E' ||\n BlVesaInfo.Signature[2] != 'S' ||\n BlVesaInfo.Signature[3] != 'A' ||\n BlVesaInfo.Version < 0x200) {\n\n BlRtlPrintf(\"VESA: No VESA found.\\n\");\n return FALSE;\n }\n\n //\n // Print the VESA identification information.\n //\n\n BlRtlPrintf(\"VESA: %c%c%c%c V%x %s (%d MB)\\n\",\n BlVesaInfo.Signature[0],\n BlVesaInfo.Signature[1],\n BlVesaInfo.Signature[2],\n BlVesaInfo.Signature[3],\n BlVesaInfo.Version,\n (PCHAR) BlRtlConvertFarPointerToLinearPointer(&BlVesaInfo.Oem),\n BlVesaInfo.Memory / 16);\n\n //\n // Search list of modes for 1024 x 768 x 16.\n //\n\n ModeList = (PUINT16) BlRtlConvertFarPointerToLinearPointer((PFAR_POINTER) &BlVesaInfo.Modes);\n\n for (; *ModeList != 0xffff; ModeList++) {\n\n Mode = *ModeList;\n\n //\n // Query for the mode information.\n //\n\n BlRtlZeroMemory(&BlVesaMode, sizeof(BlVesaMode));\n\n Returned = BlVesaInvoke(0x4f01, 0, Mode, &BlVesaMode);\n\n if (Returned != 0x4f || BlVesaMode.BitsPerPixel > 8) {\n\n BlRtlPrintf(\"VESA: Mode %03x: Attr=%04x, Addr=%p Res=%dx%dx%d\\n\",\n Mode,\n BlVesaMode.Attributes,\n (ULONG_PTR)BlVesaMode.PhysBasePtr,\n BlVesaMode.XRes,\n BlVesaMode.YRes,\n BlVesaMode.BitsPerPixel);\n\n //\n // See if one of the modes suport 1024 x 768 x 16 bits.\n //\n\n if (BlVesaMode.XRes == 1024 &&\n BlVesaMode.YRes == 768 &&\n BlVesaMode.BitsPerPixel == 16) {\n\n Video = (ULONG_PTR)BlVesaMode.PhysBasePtr;\n BlRtlZeroMemory(&BlVesaMode, sizeof(BlVesaMode));\n\n if (Mode >= 0x100) {\n\n Returned = BlVesaInvoke(0x4f02, 0x4000 | Mode, 0, &BlVesaMode);\n }\n else {\n\n Returned = BlVesaInvoke(0x4f02, Mode, 0, &BlVesaMode);\n }\n\n if (Returned != 0x4f) {\n\n BlRtlPrintf(\" Couldn't enable Linear Frame Buffer.\\n\");\n continue;\n }\n\n BlRtlPrintf(\"VESA: Select 1024 x 768 x 16 @ %p\\n\", Video);\n BlVesaVideoBuffer = Video;\n }\n }\n }\n\n if (BlVesaVideoBuffer != 0) {\n\n PUINT16 Buffer = (PUINT16)BlVesaVideoBuffer;\n INT32 i = 0;\n\n for (; i < 1 * 1024; i++) {\n\n Buffer[i] = 0xf800;\n }\n\n for (; i < 2 * 1024; i++) {\n\n Buffer[i] = 0x07e0;\n }\n\n for (; i < 3 * 1024; i++) {\n\n Buffer[i] = 0x001f;\n }\n\n for (; i < 4 * 1024; i++) {\n\n Buffer[i] = 0xffff;\n }\n }\n\n return FALSE;\n}\n\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/blvideo.cpp", "content": "//++\n//\n// Copyright (c) Microsoft Corporation\n//\n// Module Name:\n//\n// blvideo.cpp\n//\n// Abstract:\n//\n// This module implements basic video support for the boot loader.\n//\n//--\n\n#include \"bl.h\"\n\n#define BL_VIDEO_ROW_COUNT 50\n#define BL_VIDEO_COL_COUNT 80\n#define BL_VIDEO_DEFAULT_ATTRIBUTE 0x1F00\n\n#define BL_VIDEO_REGISTER_INDEX_PORT 0x3D4\n#define BL_VIDEO_REGISTER_DATA_PORT 0x3D5\n\n#define BL_VIDEO_REGISTER_CURSOR_LOW 0x0F\n#define BL_VIDEO_REGISTER_CURSOR_HIGH 0x0E\n\n#define BL_VIDEO_BASE_ADDRESS ((ULONG_PTR) 0x000B8000)\n\nPUINT16 BlVideoBuffer = (PUINT16) BL_VIDEO_BASE_ADDRESS;\nUINT16 BlVideoCursorPosition;\nUINT16 BlVideoDefaultAttribute = BL_VIDEO_DEFAULT_ATTRIBUTE;\n\nVOID\nBlVideoSetCursorPosition(\n UINT16 X,\n UINT16 Y\n )\n\n//++\n//\n// Routine Description:\n//\n// This function sets the cursor position.\n//\n// Arguments:\n//\n// X - Supplies the X coordinate for the cursor.\n//\n// Y - Supplies the Y coordinate for the cursor.\n//\n//--\n\n{\n BlVideoCursorPosition = (Y * BL_VIDEO_COL_COUNT) + X;\n\n BlRtlWritePort8(BL_VIDEO_REGISTER_INDEX_PORT, BL_VIDEO_REGISTER_CURSOR_HIGH);\n BlRtlWritePort8(BL_VIDEO_REGISTER_DATA_PORT, (UINT8) (BlVideoCursorPosition >> 8));\n\n BlRtlWritePort8(BL_VIDEO_REGISTER_INDEX_PORT, BL_VIDEO_REGISTER_CURSOR_LOW);\n BlRtlWritePort8(BL_VIDEO_REGISTER_DATA_PORT, (UINT8) (BlVideoCursorPosition & 0xFF));\n}\n\nVOID\nBlVideoGetCursorPosition(\n PUINT16 X,\n PUINT16 Y\n )\n\n//++\n//\n// Routine Description:\n//\n// This function gets the cursor position.\n//\n// Arguments:\n//\n// X - Supplies a pointer to the variable that will receive the X coordinate.\n//\n// Y - Supplies a pointer to the variable that will receive the Y coordinate.\n//\n//--\n\n{\n *X = BlVideoCursorPosition % BL_VIDEO_COL_COUNT;\n *Y = BlVideoCursorPosition / BL_VIDEO_COL_COUNT;\n}\n\nVOID\nBlVideoWriteCurrentCharacter(\n UINT8 Character\n )\n\n//++\n//\n// Routine Description:\n//\n// This function writes the current character (i.e. the character under the cursor).\n//\n// Arguments:\n//\n// Character - Supplies the character to write.\n//\n//--\n\n{\n UINT16 X;\n UINT16 Y;\n\n BlVideoGetCursorPosition(&X, &Y);\n\n BlVideoBuffer[(Y * BL_VIDEO_COL_COUNT) + X] = BlVideoDefaultAttribute | Character;\n}\n\nVOID\nBlVideoScrollUpWindow(\n UINT8 NumberOfLines\n )\n\n//++\n//\n// Routine Description:\n//\n// This function scrolls up the specified window.\n//\n// Arguments:\n//\n// NumberOfLines - Supplies the number of lines to scroll.\n//\n//--\n\n{\n UINT16 Delta;\n UINT16 Index;\n UINT16 Limit;\n\n Limit = BL_VIDEO_COL_COUNT * BL_VIDEO_ROW_COUNT;\n\n Delta = NumberOfLines * BL_VIDEO_COL_COUNT;\n\n if (Delta > Limit) {\n\n Delta = Limit;\n }\n\n for (Index = Delta; Index < Limit; Index += 1) {\n\n BlVideoBuffer[Index - Delta] = BlVideoBuffer[Index];\n }\n\n for (Index = Limit - Delta; Index < Limit; Index += 1) {\n\n BlVideoBuffer[Index] = BlVideoDefaultAttribute | ' ';\n }\n}\n\nVOID\nBlVideoPrintCharacter(\n UINT8 Character\n )\n\n//++\n//\n// Routine Description:\n//\n// This function prints the specified character and advances the cursor.\n//\n// Arguments:\n//\n// Character - Supplies the character to print.\n//\n//--\n\n{\n UINT16 X;\n UINT16 Y;\n\n BlVideoGetCursorPosition(&X, &Y);\n\n switch (Character) {\n\n case '\\f': {\n\n X = 0;\n Y = 0;\n BlVideoInitialize();\n break;\n }\n\n case '\\r': {\n\n X = 0;\n break;\n }\n\n case '\\n': {\n\n X = BL_VIDEO_COL_COUNT;\n break;\n }\n\n default: {\n\n BlVideoWriteCurrentCharacter(Character);\n X += 1;\n }\n }\n\n\n\n if (X == BL_VIDEO_COL_COUNT) {\n\n X = 0;\n Y += 1;\n }\n\n if (Y == BL_VIDEO_ROW_COUNT) {\n\n BlVideoScrollUpWindow(1);\n\n Y = BL_VIDEO_ROW_COUNT - 1;\n }\n\n BlVideoSetCursorPosition(X, Y);\n}\n\nVOID\nBlVideoPrintString(\n PCSTR String\n )\n\n//++\n//\n// Routine Description:\n//\n// This function prints the specified string and advances the cursor.\n//\n// Arguments:\n//\n// String - Supplies a pointer to the string to print.\n//\n//--\n\n{\n PCSTR Next;\n\n Next = String;\n\n while (*Next != 0) {\n\n BlVideoPrintCharacter(*Next);\n Next += 1;\n }\n}\n\nBOOLEAN\nBlVideoPrintf(\n PCSTR Format,\n ...\n )\n\n//++\n//\n// Routine Description:\n//\n// This function prints out a string.\n//\n// Arguments:\n//\n// Format - Supplies the format string.\n//\n// ... - Supplies the input parameters.\n//\n// Return Value:\n//\n// TRUE, if operation was successful.\n// FALSE, otherwise.\n//\n//--\n\n{\n va_list ArgumentList;\n CHAR Buffer[4096];\n\n va_start(ArgumentList, Format);\n\n if (BlRtlFormatString(Buffer,\n sizeof(Buffer),\n Format,\n ArgumentList) == FALSE) {\n\n return FALSE;\n }\n\n BlVideoPrintString(Buffer);\n\n return TRUE;\n}\n\nVOID\nBlVideoInitialize(\n VOID\n )\n\n//++\n//\n// Routine Description:\n//\n// This function initializes video support for the boot loader.\n//\n//--\n\n{\n UINT16 Index;\n UINT16 Limit;\n\n Limit = BL_VIDEO_COL_COUNT * BL_VIDEO_ROW_COUNT;\n\n for (Index = 0; Index < Limit; Index += 1) {\n\n BlVideoBuffer[Index] = BlVideoDefaultAttribute | ' ';\n }\n\n BlVideoSetCursorPosition(0, 0);\n}\n\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/makefile", "content": "BUILD = ..\\..\\..\\..\\tools\\build\n\nAS = $(BUILD)\\x86_x86\\ml.exe\nCC = $(BUILD)\\x86_x86\\cl.exe\nLINK = $(BUILD)\\x86_x86\\link.exe\nAS16 = $(BUILD)\\x86_x86\\ml.exe\nLINK16 = $(BUILD)\\x86_x86\\link16.exe\nBLGEN = $(BUILD)\\x86_x86\\blgen.exe\n\n# To generate a small version, use: nmake CCFLAGS=/DSMALL_LOADER\nCCFLAGS =\n\nMIN_OBJS = \\\n\t$(OBJ)\\x86\\blcrtasm.obj \\\n\t$(OBJ)\\x86\\blidt.obj \\\n\t$(OBJ)\\x86\\blioport.obj \\\n\t$(OBJ)\\x86\\bllegacy.obj \\\n\t$(OBJ)\\x86\\blutilasm.obj \\\n\t$(OBJ)\\blacpi.obj \\\n\t$(OBJ)\\blcdrom.obj \\\n\t$(OBJ)\\blcom.obj \\\n\t$(OBJ)\\blentry.obj \\\n\t$(OBJ)\\blfat.obj \\\n\t$(OBJ)\\blflash.obj \\\n\t$(OBJ)\\blkd.obj \\\n\t$(OBJ)\\blkd1394.obj \\\n\t$(OBJ)\\blkdcom.obj \\\n\t$(OBJ)\\blmm.obj \\\n\t$(OBJ)\\blmps.obj \\\n\t$(OBJ)\\blpci.obj \\\n\t$(OBJ)\\blpecoff.obj \\\n\t$(OBJ)\\blpnp.obj \\\n\t$(OBJ)\\blpool.obj \\\n\t$(OBJ)\\blpxe.obj \\\n\t$(OBJ)\\blsingularity.obj \\\n\t$(OBJ)\\blsmap.obj \\\n\t$(OBJ)\\blstring.obj \\\n\t$(OBJ)\\bltrap.obj \\\n\t$(OBJ)\\blutil.obj \\\n\t$(OBJ)\\blvesa.obj \\\n\t$(OBJ)\\blvideo.obj \\\n\nTPM_OBJS = \\\n\t$(OBJ)\\tpm\\aik.obj \\\n\nOBJS = $(MIN_OBJS) $(TPM_OBJS)\n\nall: $(OBJ)\\x86 $(OBJ)\\tpm $(OBJ)\\pxe-loader\n\ndirs: $(OBJ)\\x86 $(OBJ)\\tpm\n\npxe-loader: dirs $(OBJ)\\pxe-loader\n\n$(OBJ)\\x86:\n md $(OBJ)\\x86\n\n$(OBJ)\\tpm:\n md $(OBJ)\\tpm\n\n{x86}.asm{$(OBJ)\\x86}.obj:\n\t$(AS) /nologo /c /DBOOT_X86 /I. /Fl$*.lst /Fo$*.obj $<\n\n{tpm}.cpp{$(OBJ)\\tpm}.obj:\n\t$(CC) $(CCFLAGS) /nologo /c /DBOOT_X86 /GF /Gy /Gr /Zi /Od /Oy- /GS- /Gs65536 /FAsc /Fa$*.cod /Fo$*.obj /Fd$*.pdb $<\n\t\n.cpp{$(OBJ)}.obj:\n\t$(CC) $(CCFLAGS) /nologo /c /DBOOT_X86 /GF /Gy /Gr /Zi /Od /Oy- /GS- /Gs65536 /FAsc /Fa$*.cod /Fo$*.obj /Fd$*.pdb $<\n\t\n$(OBJ)\\blentry16.obj: blentry16.asm bl.inc\n\t$(AS16) /nologo /DBOOT_X86 /AT /omf /c /I. /Fl$(OBJ)\\blentry16.lst /Fo$(OBJ)\\blentry16.obj blentry16.asm\n\n$(OBJ)\\blentry16.com: $(OBJ)\\blentry16.obj\n\t$(LINK16) /nologo /TINY $(OBJ)\\blentry16.obj,$(OBJ)\\blentry16.com,$(OBJ)\\blentry16.map,,,/ONERROR:NOEXE /NOLOGO\n\n$(OBJ)\\pxe-bl.exe: $(OBJS)\n\t$(LINK) /nologo /debug /out:$(OBJ)\\pxe-bl.exe /pdb:$(OBJ)\\pxe-bl.pdb $(OBJS) /nodefaultlib /entry:BlEntry /subsystem:native /base:0x40000 /fixed /ignore:4078 /ignore:4254 /merge:.rdata=.data /merge:.data=.text\n\n$(OBJ)\\pxe-blentry16.com: $(OBJ)\\blentry16.obj\n\t$(LINK16) /nologo /TINY $(OBJ)\\blentry16.obj,$(OBJ)\\pxe-blentry16.com,$(OBJ)\\pxe-blentry16.map,,,/ONERROR:NOEXE /NOLOGO\n\n$(OBJ)\\pxe-loader: $(OBJ)\\pxe-bl.exe $(OBJ)\\pxe-blentry16.com\n\t$(BLGEN) $(OBJ)\\pxe-blentry16.com $(OBJ)\\pxe-bl.exe $(OBJ)\\pxe-loader\n\nclean-obj:\n\tcd $(OBJ)\n\tdel *.com *.map *.lst *.obj *.cod *.pdb *.exe \n\tcd x86\n\tdel *.lst *.obj\n\nclean:\n\tcd $(OBJ)\n\tdel *.com *.map *.lst *.obj *.cod *.pdb *.exe loader pxe-loader\n\tcd x86\n\tdel *.lst *.obj\n\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/platform.h", "content": "typedef __int64 Gdte;\ntypedef unsigned char byte;\ntypedef unsigned short ushort;\ntypedef unsigned uint;\ntypedef unsigned __int64 ulong;\ntypedef ULONG_PTR UIntPtr;\n\nconst int Class_Microsoft_Singularity_Hal_Platform_EXIT_AND_RESTART = 0x1fff;\nconst int Class_Microsoft_Singularity_Hal_Platform_EXIT_AND_SHUTDOWN = 0x1ffe;\nconst int Class_Microsoft_Singularity_Hal_Platform_EXIT_AND_WARMBOOT = 0x1ffd;\nconst int Class_Microsoft_Singularity_Hal_Platform_EXIT_AND_HALT = 0x1ffc;\nconst int Class_Microsoft_Singularity_Hal_Platform_DEBUGGER_NONE = 0;\nconst int Class_Microsoft_Singularity_Hal_Platform_DEBUGGER_SERIAL = 1;\nconst int Class_Microsoft_Singularity_Hal_Platform_DEBUGGER_1394 = 2;\n\nstruct Class_Microsoft_Singularity_MpBootInfo\n{\n uint signature;\n UIntPtr KernelStackBegin;\n UIntPtr KernelStack;\n UIntPtr KernelStackLimit;\n volatile int TargetCpu;\n};\n\nstruct Struct_Microsoft_Singularity_Isal_IX_DescriptorTable_Gdt\n{\n Gdte nul; // Null segment\n Gdte pv; // 16-bit video, used in boot loader only\n Gdte rc; // 16-bit code, used to align with RM code in boot loader\n Gdte rd; // 16-bit data, used to align with RM data in boot loader\n Gdte pc; // 32-bit code\n Gdte pd; // 32-bit data\n Gdte lc; // 64-bit code\n Gdte ld; // 64-bit data\n Gdte uc; // User mode code - used in paging mode only\n Gdte ud; // User mode data - used in paging mode only\n Gdte pp; // Kernel mode per-processor data\n Gdte nn; // Unused\n Gdte tss; // Currently executing task segment\n};\n\nstruct Struct_Microsoft_Singularity_Isal_IX_Gdtp\n{\n ushort pad;\n ushort limit;\n uint addr;\n};\n\nstruct Struct_Microsoft_Singularity_Isal_IX_DescriptorTable\n{\n Struct_Microsoft_Singularity_Isal_IX_DescriptorTable_Gdt gdt;\n Struct_Microsoft_Singularity_Isal_IX_Gdtp gdtPtr;\n};\n\nstruct Class_Microsoft_Singularity_Hal_Cpu\n{\n int Size;\n int Id;\n UIntPtr CpuRecordPage;\n UIntPtr KernelStackLimit; // lower bounds of stack\n UIntPtr KernelStackBegin; // upper bounds of stack\n int DomainBsp;\n Struct_Microsoft_Singularity_Isal_IX_DescriptorTable segments;\n bool halted;\n};\n\nstruct Class_Microsoft_Singularity_Hal_Platform\n{\n // Size of instance; this is a versioning/consistency check\n int Size;\n uint BootYear;\n uint BootMonth;\n uint BootDay;\n uint BootHour;\n uint BootMinute;\n uint BootSecond;\n int CpuMaxCount;\n int CpuRealCount;\n int BootCount;\n UIntPtr Smap32;\n int SmapCount;\n UIntPtr PhysicalBase;\n uint*OutgoingMessage;\n int* OutgoingCount;\n uint*IncomingFree; //previously sent messages that cane be safely freed\n int* IncomingFreeCount;\n uint*IncomingMessage; //messages bound for this kernel\n int* IncomingCount;\n uint*OutgoingFree; // messages that this kernel has processed\n int* OutgoingFreeCount;\n uint MaxBufferLength;\n uint thisDestinationId;\n uint hasApic;\n UIntPtr BootAllocatedMemory;\n UIntPtr BootAllocatedMemorySize;\n UIntPtr CommandLine32;\n int CommandLineCount;\n int CpuRecordPointerOffset;\n int ThreadRecordPointerOffset;\n UIntPtr LogRecordBuffer;\n UIntPtr LogRecordSize;\n UIntPtr LogTextBuffer;\n UIntPtr LogTextSize;\n UIntPtr KernelDllBase;\n UIntPtr KernelDllSize;\n UIntPtr KernelDllFirstPage; // first page may be disjoint on CE\n UIntPtr MiniDumpBase;\n UIntPtr MiniDumpLimit;\n int DebuggerType;\n// protected Cpu bootCpu;\n uint RecSize;\n ushort DebugBasePort;\n ushort DebugSpinBase;\n uint TwiddleSpinBase;\n ulong Info32;\n ulong Kill32;\n uint KillAction;\n ulong DumpAddr32;\n ulong FileImageTableBase32;\n uint FileImageTableEntries;\n uint DumpSize32;\n ulong DumpRemainder;\n ulong DumpLimit;\n ulong NativeContext;\n ulong Cpus;\n ushort BiosPicMask;\n byte BiosWarmResetCmos;\n uint BiosWarmResetVector;\n uint Info16;\n ulong IdtEnter0;\n ulong IdtEnter1;\n ulong IdtEnterN;\n ulong IdtTarget;\n ulong Pdpt32;\n ulong KernelPdpt64;\n ulong Undump;\n uint PciBiosAX;\n uint PciBiosBX;\n uint PciBiosCX;\n uint PciBiosEDX;\n ulong AcpiRoot32;\n ulong PnpNodesAddr32;\n uint PnpNodesSize32;\n ulong SmbiosRoot32;\n ulong DmiRoot32;\n uint IsaCsns;\n ushort IsaReadPort;\n uint Ebda32;\n uint MpFloat32;\n ulong Ohci1394Base;\n ulong Ohci1394BufferAddr32;\n uint Ohci1394BufferSize32;\n ulong VesaBuffer;\n ulong MpEnter32; // Entry point\n uint MpCpuCount; // No of AP's booted\n uint MpStatus32; // Error indicator\n ulong MpStartupLock32; // Pointer to MP init lock var\n Class_Microsoft_Singularity_MpBootInfo MpBootInfo;\n// private Cpu[] processors;\n// private HalDevices devices;\n};\n\nstruct Struct_Microsoft_Singularity_Io_FileImage\n{\n UIntPtr Address;\n uint Size;\n};\n\nstruct Struct_Microsoft_Singularity_Isal_IX_TSS\n{\n ushort previous_tss;\n ushort pad0;\n\n uint esp0;\n ushort ss0;\n ushort pad1;\n\n uint esp1;\n ushort ss1;\n ushort pad2;\n\n uint esp2;\n ushort ss2;\n ushort pad3;\n\n uint cr3;\n uint eip;\n uint eflags;\n\n uint eax;\n uint ecx;\n uint edx;\n uint ebx;\n uint esp;\n uint ebp;\n uint esi;\n uint edi;\n\n ushort es;\n ushort pades;\n ushort cs;\n ushort padcs;\n ushort ss;\n ushort padss;\n ushort ds;\n ushort padds;\n ushort fs;\n ushort padfs;\n ushort gs;\n ushort padgs;\n\n ushort ldt;\n ushort padldt;\n ushort trap_bit;\n ushort io_bitmap_offset;\n};\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/tpm/aik.cpp", "content": "char aik[559] = {\n0x00, \n0x28, \n0x00, \n0x00, \n0x00, \n0x12, \n0x00, \n0x00, \n0x00, \n0x04, \n0x01, \n0x00, \n0x00, \n0x00, \n0x01, \n0x00, \n0x01, \n0x00, \n0x02, \n0x00, \n0x00, \n0x00, \n0x0c, \n0x00, \n0x00, \n0x08, \n0x00, \n0x00, \n0x00, \n0x00, \n0x02, \n0x00, \n0x00, \n0x00, \n0x00, \n0x00, \n0x00, \n0x00, \n0x00, \n0x00, \n0x00, \n0x01, \n0x00, \n0x86, \n0x4e, \n0x0d, \n0x6b, \n0x86, \n0xf5, \n0x4f, \n0xbf, \n0xb0, \n0x78, \n0x74, \n0x51, \n0x7a, \n0x44, \n0x31, \n0xab, \n0xe1, \n0xb6, \n0x01, \n0x01, \n0x9b, \n0x26, \n0x5f, \n0x31, \n0x24, \n0x87, \n0x2e, \n0xb1, \n0xf0, \n0xff, \n0x02, \n0xc0, \n0x11, \n0x14, \n0xc4, \n0x7f, \n0xd8, \n0x9c, \n0xbe, \n0xae, \n0xa4, \n0x6d, \n0x28, \n0x29, \n0x9c, \n0xfa, \n0x6b, \n0x50, \n0xce, \n0x03, \n0x67, \n0x12, \n0x6a, \n0xc7, \n0xc2, \n0x77, \n0xaa, \n0x8d, \n0x54, \n0x90, \n0x21, \n0x99, \n0x58, \n0xd8, \n0xbc, \n0x74, \n0x16, \n0x82, \n0x30, \n0x57, \n0xca, \n0xa5, \n0xe0, \n0xcc, \n0x51, \n0xe9, \n0xc6, \n0xf3, \n0x9b, \n0xef, \n0xe1, \n0xa6, \n0xe6, \n0x5c, \n0x37, \n0x4d, \n0x35, \n0xb4, \n0x03, \n0x1d, \n0x25, \n0x46, \n0x61, \n0x64, \n0xe6, \n0x1f, \n0x00, \n0x41, \n0xf5, \n0xd9, \n0xf8, \n0x4e, \n0xb1, \n0x3f, \n0x8f, \n0xfc, \n0xe2, \n0x2f, \n0xf3, \n0x08, \n0xac, \n0x52, \n0x1f, \n0xcd, \n0x76, \n0xa5, \n0xeb, \n0xcc, \n0x24, \n0x9f, \n0xb7, \n0x8e, \n0xa2, \n0x97, \n0x56, \n0x24, \n0xf4, \n0x98, \n0x76, \n0x45, \n0x90, \n0x97, \n0xc6, \n0xf4, \n0x56, \n0xf9, \n0xa0, \n0xf4, \n0x8e, \n0x24, \n0x95, \n0x92, \n0x0a, \n0x1a, \n0xdc, \n0x58, \n0x6c, \n0x3c, \n0x18, \n0xd1, \n0x30, \n0xe2, \n0x1d, \n0xa4, \n0xaa, \n0xa5, \n0x72, \n0x92, \n0xd0, \n0xf6, \n0x31, \n0xa9, \n0xa3, \n0x7b, \n0xdf, \n0x9c, \n0x97, \n0x59, \n0xfe, \n0x48, \n0x0e, \n0x03, \n0xde, \n0xa1, \n0xee, \n0xc5, \n0xfe, \n0xfa, \n0xf0, \n0xda, \n0x54, \n0x17, \n0x39, \n0x0c, \n0xce, \n0x34, \n0x17, \n0xb2, \n0x9f, \n0x20, \n0xcc, \n0x32, \n0x98, \n0xb2, \n0x18, \n0xb0, \n0x34, \n0x66, \n0x9e, \n0x3f, \n0x24, \n0x3f, \n0xdf, \n0x8b, \n0x97, \n0xeb, \n0x33, \n0xe3, \n0x23, \n0x49, \n0x8d, \n0xdf, \n0x25, \n0x59, \n0xe7, \n0xff, \n0xc2, \n0xd3, \n0x79, \n0x05, \n0xa0, \n0xf8, \n0x76, \n0x42, \n0x15, \n0x00, \n0xa0, \n0xa8, \n0x3b, \n0x7d, \n0x08, \n0x44, \n0xca, \n0xb8, \n0x19, \n0xf6, \n0xb8, \n0x18, \n0x96, \n0xb5, \n0x62, \n0x8c, \n0x5a, \n0xc7, \n0xdb, \n0x75, \n0x6c, \n0x1f, \n0x9f, \n0x1c, \n0xaf, \n0xaf, \n0x19, \n0xce, \n0x7e, \n0xe1, \n0x00, \n0x00, \n0x01, \n0x00, \n0x7e, \n0xb1, \n0x4e, \n0xfe, \n0x73, \n0xb8, \n0xe1, \n0x92, \n0xda, \n0x68, \n0xae, \n0x71, \n0xb7, \n0xd1, \n0x45, \n0x68, \n0x29, \n0x38, \n0xc0, \n0xbc, \n0x21, \n0xd5, \n0xbb, \n0xb7, \n0xb7, \n0x23, \n0x35, \n0xce, \n0xf5, \n0xc3, \n0x79, \n0xf8, \n0x5e, \n0x63, \n0x20, \n0x73, \n0x30, \n0x72, \n0xd5, \n0xf0, \n0x66, \n0xd4, \n0x24, \n0x8c, \n0x73, \n0xef, \n0xcf, \n0xa7, \n0xb1, \n0xc2, \n0x54, \n0xd5, \n0x8c, \n0xb8, \n0x0f, \n0xa2, \n0xf6, \n0xb3, \n0xbc, \n0x88, \n0xb4, \n0x58, \n0x75, \n0xaf, \n0x50, \n0x0f, \n0xc4, \n0x2b, \n0x96, \n0x9a, \n0x0e, \n0xee, \n0xe1, \n0xa8, \n0x43, \n0xa3, \n0x47, \n0x89, \n0x4a, \n0xc6, \n0x52, \n0x11, \n0xc2, \n0x63, \n0x7d, \n0xb4, \n0xf3, \n0x91, \n0xe3, \n0x62, \n0x6e, \n0x35, \n0xfc, \n0x1f, \n0x7e, \n0xc7, \n0x7c, \n0xfd, \n0x13, \n0x20, \n0xc5, \n0x44, \n0xf4, \n0x1e, \n0x07, \n0x28, \n0xa9, \n0xd4, \n0x7f, \n0x49, \n0x34, \n0xf6, \n0x41, \n0x9c, \n0xa8, \n0xf8, \n0x0f, \n0xd8, \n0x07, \n0x5b, \n0x52, \n0x85, \n0x22, \n0xc3, \n0x42, \n0x18, \n0x1d, \n0x6a, \n0xf0, \n0x23, \n0x05, \n0xf0, \n0x0d, \n0x3f, \n0x38, \n0xa4, \n0x96, \n0x50, \n0xac, \n0xd5, \n0x40, \n0xb3, \n0x49, \n0x8d, \n0x61, \n0x2c, \n0xe1, \n0xd9, \n0xf2, \n0xca, \n0x99, \n0x28, \n0x93, \n0xca, \n0x87, \n0xc5, \n0xdd, \n0x79, \n0x91, \n0xbb, \n0xac, \n0xf0, \n0x2e, \n0x2a, \n0x01, \n0x61, \n0x41, \n0x40, \n0x1f, \n0x4f, \n0x1a, \n0xf7, \n0x32, \n0x96, \n0x83, \n0x08, \n0x2a, \n0x64, \n0xf1, \n0x7e, \n0x72, \n0x5c, \n0xfb, \n0xa0, \n0xfa, \n0x84, \n0x40, \n0x90, \n0x59, \n0xd9, \n0xeb, \n0x00, \n0x21, \n0xf9, \n0xa3, \n0xc7, \n0x12, \n0x87, \n0xc5, \n0xa4, \n0xbf, \n0xb3, \n0x0f, \n0x4c, \n0xde, \n0xc1, \n0x87, \n0xe6, \n0xff, \n0x28, \n0xff, \n0xa4, \n0xea, \n0x9b, \n0x86, \n0x4d, \n0x31, \n0x16, \n0xab, \n0x34, \n0x5c, \n0x3b, \n0x05, \n0x45, \n0xf7, \n0x06, \n0x60, \n0xc9, \n0xaa, \n0x38, \n0x66, \n0xb1, \n0x81, \n0x76, \n0x3f, \n0xe4, \n0x22, \n0x45, \n0x3a, \n0x9e, \n0x45, \n0xf0, \n0xbc, \n0xa6, \n0x8a, \n0xf8, \n0x58, \n0xbe, \n0xc3, \n0xa5, \n0x9b, \n0x1f, \n0x2b, \n0x68, \n0xe2, \n0xfe, \n};\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/tpm/aik.h", "content": "#pragma once\n extern char aik[559];\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/x86/blcrtasm.asm", "content": ";++\n;\n; Copyright (c) Microsoft Corporation\n;\n; Module Name:\n;\n; blcrt.asm\n;\n; Abstract:\n;\n; This module implements utility functions for boot loader C runtime.\n;\n; Environment:\n;\n; Boot loader.\n;\n;--\n\ninclude bl.inc\n\n.686p\n.model flat\n.code\n\nassume ds:flat\nassume es:flat\nassume ss:flat\nassume fs:flat\n\nLOWORD equ [0]\nHIWORD equ [4]\n\n;***\n;lldiv.asm - signed long divide routine\n;\n; Copyright (c) Microsoft Corporation. All rights reserved.\n;\n;Purpose:\n; defines the signed long divide routine\n; __alldiv\n;\n;Revision History:\n; 11-29-83 DFW initial version\n; 06-01-84 RN modified to use cmacros\n; 10-24-87 SKS fixed off-by-1 error for dividend close to 2**32.\n; 05-18-89 SKS Remove redundant \"MOV SP,BP\" from epilog\n; 11-28-89 GJF Fixed copyright\n; 11-19-93 SMK Modified to work on 64 bit integers\n; 01-17-94 GJF Minor changes to build with NT's masm386.\n; 07-22-94 GJF Use esp-relative addressing for args. Shortened\n; conditional jumps. Also, don't use xchg to do a\n; simple move between regs.\n;\n;*******************************************************************************\n\n\n;***\n;lldiv - signed long divide\n;\n;Purpose:\n; Does a signed long divide of the arguments. Arguments are\n; not changed.\n;\n;Entry:\n; Arguments are passed on the stack:\n; 1st pushed: divisor (QWORD)\n; 2nd pushed: dividend (QWORD)\n;\n;Exit:\n; EDX:EAX contains the quotient (dividend/divisor)\n; NOTE: this routine removes the parameters from the stack.\n;\n;Uses:\n; ECX\n;\n;Exceptions:\n;\n;*******************************************************************************\n\n__alldiv PROC NEAR\n\n push edi\n push esi\n push ebx\n\n; Set up the local stack and save the index registers. When this is done\n; the stack frame will look as follows (assuming that the expression a/b will\n; generate a call to lldiv(a, b)):\n;\n; -----------------\n; | |\n; |---------------|\n; | |\n; |--divisor (b)--|\n; | |\n; |---------------|\n; | |\n; |--dividend (a)-|\n; | |\n; |---------------|\n; | return addr** |\n; |---------------|\n; | EDI |\n; |---------------|\n; | ESI |\n; |---------------|\n; ESP---->| EBX |\n; -----------------\n;\n\nDVND equ [esp + 16] ; stack address of dividend (a)\nDVSR equ [esp + 24] ; stack address of divisor (b)\n\n\n; Determine sign of the result (edi = 0 if result is positive, non-zero\n; otherwise) and make operands positive.\n\n xor edi,edi ; result sign assumed positive\n\n mov eax,HIWORD(DVND) ; hi word of a\n or eax,eax ; test to see if signed\n jge short L1 ; skip rest if a is already positive\n inc edi ; complement result sign flag\n mov edx,LOWORD(DVND) ; lo word of a\n neg eax ; make a positive\n neg edx\n sbb eax,0\n mov HIWORD(DVND),eax ; save positive value\n mov LOWORD(DVND),edx\nL1:\n mov eax,HIWORD(DVSR) ; hi word of b\n or eax,eax ; test to see if signed\n jge short L2 ; skip rest if b is already positive\n inc edi ; complement the result sign flag\n mov edx,LOWORD(DVSR) ; lo word of a\n neg eax ; make b positive\n neg edx\n sbb eax,0\n mov HIWORD(DVSR),eax ; save positive value\n mov LOWORD(DVSR),edx\nL2:\n\n;\n; Now do the divide. First look to see if the divisor is less than 4194304K.\n; If so, then we can use a simple algorithm with word divides, otherwise\n; things get a little more complex.\n;\n; NOTE - eax currently contains the high order word of DVSR\n;\n\n or eax,eax ; check to see if divisor < 4194304K\n jnz short L3 ; nope, gotta do this the hard way\n mov ecx,LOWORD(DVSR) ; load divisor\n mov eax,HIWORD(DVND) ; load high word of dividend\n xor edx,edx\n div ecx ; eax <- high order bits of quotient\n mov ebx,eax ; save high bits of quotient\n mov eax,LOWORD(DVND) ; edx:eax <- remainder:lo word of dividend\n div ecx ; eax <- low order bits of quotient\n mov edx,ebx ; edx:eax <- quotient\n jmp short L4 ; set sign, restore stack and return\n\n;\n; Here we do it the hard way. Remember, eax contains the high word of DVSR\n;\n\nL3:\n mov ebx,eax ; ebx:ecx <- divisor\n mov ecx,LOWORD(DVSR)\n mov edx,HIWORD(DVND) ; edx:eax <- dividend\n mov eax,LOWORD(DVND)\nL5:\n shr ebx,1 ; shift divisor right one bit\n rcr ecx,1\n shr edx,1 ; shift dividend right one bit\n rcr eax,1\n or ebx,ebx\n jnz short L5 ; loop until divisor < 4194304K\n div ecx ; now divide, ignore remainder\n mov esi,eax ; save quotient\n\n;\n; We may be off by one, so to check, we will multiply the quotient\n; by the divisor and check the result against the orignal dividend\n; Note that we must also check for overflow, which can occur if the\n; dividend is close to 2**64 and the quotient is off by 1.\n;\n\n mul dword ptr HIWORD(DVSR) ; QUOT * HIWORD(DVSR)\n mov ecx,eax\n mov eax,LOWORD(DVSR)\n mul esi ; QUOT * LOWORD(DVSR)\n add edx,ecx ; EDX:EAX = QUOT * DVSR\n jc short L6 ; carry means Quotient is off by 1\n\n;\n; do long compare here between original dividend and the result of the\n; multiply in edx:eax. If original is larger or equal, we are ok, otherwise\n; subtract one (1) from the quotient.\n;\n\n cmp edx,HIWORD(DVND) ; compare hi words of result and original\n ja short L6 ; if result > original, do subtract\n jb short L7 ; if result < original, we are ok\n cmp eax,LOWORD(DVND) ; hi words are equal, compare lo words\n jbe short L7 ; if less or equal we are ok, else subtract\nL6:\n dec esi ; subtract 1 from quotient\nL7:\n xor edx,edx ; edx:eax <- quotient\n mov eax,esi\n\n;\n; Just the cleanup left to do. edx:eax contains the quotient. Set the sign\n; according to the save value, cleanup the stack, and return.\n;\n\nL4:\n dec edi ; check to see if result is negative\n jnz short L8 ; if EDI == 0, result should be negative\n neg edx ; otherwise, negate the result\n neg eax\n sbb edx,0\n\n;\n; Restore the saved registers and return.\n;\n\nL8:\n pop ebx\n pop esi\n pop edi\n\n ret 16\n\n__alldiv ENDP\n\n;***\n;lldvrm.asm - signed long divide and remainder routine\n;\n; Copyright (c) Microsoft Corporation. All rights reserved.\n;\n;Purpose:\n; defines the signed long divide and remainder routine\n; __alldvrm\n;\n;Revision History:\n; 10-06-98 SMK Initial version.\n;\n;*******************************************************************************\n\n\n;***\n;lldvrm - signed long divide and remainder\n;\n;Purpose:\n; Does a signed long divide and remainder of the arguments. Arguments are\n; not changed.\n;\n;Entry:\n; Arguments are passed on the stack:\n; 1st pushed: divisor (QWORD)\n; 2nd pushed: dividend (QWORD)\n;\n;Exit:\n; EDX:EAX contains the quotient (dividend/divisor)\n; EBX:ECX contains the remainder (divided % divisor)\n; NOTE: this routine removes the parameters from the stack.\n;\n;Uses:\n; ECX\n;\n;Exceptions:\n;\n;*******************************************************************************\n\n__alldvrm PROC NEAR\n\n push edi\n push esi\n push ebp\n\n; Set up the local stack and save the index registers. When this is done\n; the stack frame will look as follows (assuming that the expression a/b will\n; generate a call to alldvrm(a, b)):\n;\n; -----------------\n; | |\n; |---------------|\n; | |\n; |--divisor (b)--|\n; | |\n; |---------------|\n; | |\n; |--dividend (a)-|\n; | |\n; |---------------|\n; | return addr** |\n; |---------------|\n; | EDI |\n; |---------------|\n; | ESI |\n; |---------------|\n; ESP---->| EBP |\n; -----------------\n;\n\nDVND equ [esp + 16] ; stack address of dividend (a)\nDVSR equ [esp + 24] ; stack address of divisor (b)\n\n\n; Determine sign of the quotient (edi = 0 if result is positive, non-zero\n; otherwise) and make operands positive.\n; Sign of the remainder is kept in ebp.\n\n xor edi,edi ; result sign assumed positive\n xor ebp,ebp ; result sign assumed positive\n\n mov eax,HIWORD(DVND) ; hi word of a\n or eax,eax ; test to see if signed\n jge short L1 ; skip rest if a is already positive\n inc edi ; complement result sign flag\n inc ebp ; complement result sign flag\n mov edx,LOWORD(DVND) ; lo word of a\n neg eax ; make a positive\n neg edx\n sbb eax,0\n mov HIWORD(DVND),eax ; save positive value\n mov LOWORD(DVND),edx\nL1:\n mov eax,HIWORD(DVSR) ; hi word of b\n or eax,eax ; test to see if signed\n jge short L2 ; skip rest if b is already positive\n inc edi ; complement the result sign flag\n mov edx,LOWORD(DVSR) ; lo word of a\n neg eax ; make b positive\n neg edx\n sbb eax,0\n mov HIWORD(DVSR),eax ; save positive value\n mov LOWORD(DVSR),edx\nL2:\n\n;\n; Now do the divide. First look to see if the divisor is less than 4194304K.\n; If so, then we can use a simple algorithm with word divides, otherwise\n; things get a little more complex.\n;\n; NOTE - eax currently contains the high order word of DVSR\n;\n\n or eax,eax ; check to see if divisor < 4194304K\n jnz short L3 ; nope, gotta do this the hard way\n mov ecx,LOWORD(DVSR) ; load divisor\n mov eax,HIWORD(DVND) ; load high word of dividend\n xor edx,edx\n div ecx ; eax <- high order bits of quotient\n mov ebx,eax ; save high bits of quotient\n mov eax,LOWORD(DVND) ; edx:eax <- remainder:lo word of dividend\n div ecx ; eax <- low order bits of quotient\n mov esi,eax ; ebx:esi <- quotient\n;\n; Now we need to do a multiply so that we can compute the remainder.\n;\n mov eax,ebx ; set up high word of quotient\n mul dword ptr LOWORD(DVSR) ; HIWORD(QUOT) * DVSR\n mov ecx,eax ; save the result in ecx\n mov eax,esi ; set up low word of quotient\n mul dword ptr LOWORD(DVSR) ; LOWORD(QUOT) * DVSR\n add edx,ecx ; EDX:EAX = QUOT * DVSR\n jmp short L4 ; complete remainder calculation\n\n;\n; Here we do it the hard way. Remember, eax contains the high word of DVSR\n;\n\nL3:\n mov ebx,eax ; ebx:ecx <- divisor\n mov ecx,LOWORD(DVSR)\n mov edx,HIWORD(DVND) ; edx:eax <- dividend\n mov eax,LOWORD(DVND)\nL5:\n shr ebx,1 ; shift divisor right one bit\n rcr ecx,1\n shr edx,1 ; shift dividend right one bit\n rcr eax,1\n or ebx,ebx\n jnz short L5 ; loop until divisor < 4194304K\n div ecx ; now divide, ignore remainder\n mov esi,eax ; save quotient\n\n;\n; We may be off by one, so to check, we will multiply the quotient\n; by the divisor and check the result against the orignal dividend\n; Note that we must also check for overflow, which can occur if the\n; dividend is close to 2**64 and the quotient is off by 1.\n;\n\n mul dword ptr HIWORD(DVSR) ; QUOT * HIWORD(DVSR)\n mov ecx,eax\n mov eax,LOWORD(DVSR)\n mul esi ; QUOT * LOWORD(DVSR)\n add edx,ecx ; EDX:EAX = QUOT * DVSR\n jc short L6 ; carry means Quotient is off by 1\n\n;\n; do long compare here between original dividend and the result of the\n; multiply in edx:eax. If original is larger or equal, we are ok, otherwise\n; subtract one (1) from the quotient.\n;\n\n cmp edx,HIWORD(DVND) ; compare hi words of result and original\n ja short L6 ; if result > original, do subtract\n jb short L7 ; if result < original, we are ok\n cmp eax,LOWORD(DVND) ; hi words are equal, compare lo words\n jbe short L7 ; if less or equal we are ok, else subtract\nL6:\n dec esi ; subtract 1 from quotient\n sub eax,LOWORD(DVSR) ; subtract divisor from result\n sbb edx,HIWORD(DVSR)\nL7:\n xor ebx,ebx ; ebx:esi <- quotient\n\nL4:\n;\n; Calculate remainder by subtracting the result from the original dividend.\n; Since the result is already in a register, we will do the subtract in the\n; opposite direction and negate the result if necessary.\n;\n\n sub eax,LOWORD(DVND) ; subtract dividend from result\n sbb edx,HIWORD(DVND)\n\n;\n; Now check the result sign flag to see if the result is supposed to be positive\n; or negative. It is currently negated (because we subtracted in the 'wrong'\n; direction), so if the sign flag is set we are done, otherwise we must negate\n; the result to make it positive again.\n;\n\n dec ebp ; check result sign flag\n jns short L9 ; result is ok, set up the quotient\n neg edx ; otherwise, negate the result\n neg eax\n sbb edx,0\n\n;\n; Now we need to get the quotient into edx:eax and the remainder into ebx:ecx.\n;\nL9:\n mov ecx,edx\n mov edx,ebx\n mov ebx,ecx\n mov ecx,eax\n mov eax,esi\n\n;\n; Just the cleanup left to do. edx:eax contains the quotient. Set the sign\n; according to the save value, cleanup the stack, and return.\n;\n\n dec edi ; check to see if result is negative\n jnz short L8 ; if EDI == 0, result should be negative\n neg edx ; otherwise, negate the result\n neg eax\n sbb edx,0\n\n;\n; Restore the saved registers and return.\n;\n\nL8:\n pop ebp\n pop esi\n pop edi\n\n ret 16\n\n__alldvrm ENDP\n\n;***\n;llmul.asm - long multiply routine\n;\n; Copyright (c) Microsoft Corporation. All rights reserved.\n;\n;Purpose:\n; Defines long multiply routine\n; Both signed and unsigned routines are the same, since multiply's\n; work out the same in 2's complement\n; creates the following routine:\n; __allmul\n;\n;Revision History:\n; 11-29-83 DFW initial version\n; 06-01-84 RN modified to use cmacros\n; 04-17-85 TC ignore signs since they take care of themselves\n; do a fast multiply if both hiwords of arguments are 0\n; 10-10-86 MH slightly faster implementation, for 0 in upper words\n; 03-20-89 SKS Remove redundant \"MOV SP,BP\" from epilogs\n; 05-18-89 SKS Preserve BX\n; 11-28-89 GJF Fixed copyright\n; 11-19-93 SMK Modified to work on 64 bit integers\n; 01-17-94 GJF Minor changes to build with NT's masm386.\n; 07-22-94 GJF Use esp-relative addressing for args. Shortened\n; conditional jump.\n;\n;*******************************************************************************\n\n\n;***\n;llmul - long multiply routine\n;\n;Purpose:\n; Does a long multiply (same for signed/unsigned)\n; Parameters are not changed.\n;\n;Entry:\n; Parameters are passed on the stack:\n; 1st pushed: multiplier (QWORD)\n; 2nd pushed: multiplicand (QWORD)\n;\n;Exit:\n; EDX:EAX - product of multiplier and multiplicand\n; NOTE: parameters are removed from the stack\n;\n;Uses:\n; ECX\n;\n;Exceptions:\n;\n;*******************************************************************************\n\n__allmul PROC NEAR\n\nA EQU [esp + 4] ; stack address of a\nB EQU [esp + 12] ; stack address of b\n\n;\n; AHI, BHI : upper 32 bits of A and B\n; ALO, BLO : lower 32 bits of A and B\n;\n; ALO * BLO\n; ALO * BHI\n; + BLO * AHI\n; ---------------------\n;\n\n mov eax,HIWORD(A)\n mov ecx,HIWORD(B)\n or ecx,eax ;test for both hiwords zero.\n mov ecx,LOWORD(B)\n jnz short hard ;both are zero, just mult ALO and BLO\n\n mov eax,LOWORD(A)\n mul ecx\n\n ret 16 ; callee restores the stack\n\nhard:\n push ebx\n\n; must redefine A and B since esp has been altered\n\nA2 EQU [esp + 8] ; stack address of a\nB2 EQU [esp + 16] ; stack address of b\n\n mul ecx ;eax has AHI, ecx has BLO, so AHI * BLO\n mov ebx,eax ;save result\n\n mov eax,LOWORD(A2)\n mul dword ptr HIWORD(B2) ;ALO * BHI\n add ebx,eax ;ebx = ((ALO * BHI) + (AHI * BLO))\n\n mov eax,LOWORD(A2) ;ecx = BLO\n mul ecx ;so edx:eax = ALO*BLO\n add edx,ebx ;now edx has all the LO*HI stuff\n\n pop ebx\n\n ret 16 ; callee restores the stack\n\n__allmul ENDP\n\n;***\n;llrem.asm - signed long remainder routine\n;\n; Copyright (c) Microsoft Corporation. All rights reserved.\n;\n;Purpose:\n; defines the signed long remainder routine\n; __allrem\n;\n;Revision History:\n; 11-29-83 DFW initial version\n; 06-01-84 RN modified to use cmacros\n; 10-23-87 SKS fixed off-by-1 error for dividend close to 2**32.\n; 05-18-89 SKS Remove redundant \"MOV SP,BP\" from epilog\n; 11-28-89 GJF Fixed copyright\n; 11-19-93 SMK Modified to work on 64 bit integers\n; 01-17-94 GJF Minor changes to build with NT's masm386.\n; 07-22-94 GJF Use esp-relative addressing for args. Shortened\n; conditional jumps.\n;\n;*******************************************************************************\n\n\n;***\n;llrem - signed long remainder\n;\n;Purpose:\n; Does a signed long remainder of the arguments. Arguments are\n; not changed.\n;\n;Entry:\n; Arguments are passed on the stack:\n; 1st pushed: divisor (QWORD)\n; 2nd pushed: dividend (QWORD)\n;\n;Exit:\n; EDX:EAX contains the remainder (dividend%divisor)\n; NOTE: this routine removes the parameters from the stack.\n;\n;Uses:\n; ECX\n;\n;Exceptions:\n;\n;*******************************************************************************\n\n__allrem PROC NEAR\n\n push ebx\n push edi\n\n; Set up the local stack and save the index registers. When this is done\n; the stack frame will look as follows (assuming that the expression a%b will\n; generate a call to lrem(a, b)):\n;\n; -----------------\n; | |\n; |---------------|\n; | |\n; |--divisor (b)--|\n; | |\n; |---------------|\n; | |\n; |--dividend (a)-|\n; | |\n; |---------------|\n; | return addr** |\n; |---------------|\n; | EBX |\n; |---------------|\n; ESP---->| EDI |\n; -----------------\n;\n\nDVND equ [esp + 12] ; stack address of dividend (a)\nDVSR equ [esp + 20] ; stack address of divisor (b)\n\n\n; Determine sign of the result (edi = 0 if result is positive, non-zero\n; otherwise) and make operands positive.\n\n xor edi,edi ; result sign assumed positive\n\n mov eax,HIWORD(DVND) ; hi word of a\n or eax,eax ; test to see if signed\n jge short L1 ; skip rest if a is already positive\n inc edi ; complement result sign flag bit\n mov edx,LOWORD(DVND) ; lo word of a\n neg eax ; make a positive\n neg edx\n sbb eax,0\n mov HIWORD(DVND),eax ; save positive value\n mov LOWORD(DVND),edx\nL1:\n mov eax,HIWORD(DVSR) ; hi word of b\n or eax,eax ; test to see if signed\n jge short L2 ; skip rest if b is already positive\n mov edx,LOWORD(DVSR) ; lo word of b\n neg eax ; make b positive\n neg edx\n sbb eax,0\n mov HIWORD(DVSR),eax ; save positive value\n mov LOWORD(DVSR),edx\nL2:\n\n;\n; Now do the divide. First look to see if the divisor is less than 4194304K.\n; If so, then we can use a simple algorithm with word divides, otherwise\n; things get a little more complex.\n;\n; NOTE - eax currently contains the high order word of DVSR\n;\n\n or eax,eax ; check to see if divisor < 4194304K\n jnz short L3 ; nope, gotta do this the hard way\n mov ecx,LOWORD(DVSR) ; load divisor\n mov eax,HIWORD(DVND) ; load high word of dividend\n xor edx,edx\n div ecx ; edx <- remainder\n mov eax,LOWORD(DVND) ; edx:eax <- remainder:lo word of dividend\n div ecx ; edx <- final remainder\n mov eax,edx ; edx:eax <- remainder\n xor edx,edx\n dec edi ; check result sign flag\n jns short L4 ; negate result, restore stack and return\n jmp short L8 ; result sign ok, restore stack and return\n\n;\n; Here we do it the hard way. Remember, eax contains the high word of DVSR\n;\n\nL3:\n mov ebx,eax ; ebx:ecx <- divisor\n mov ecx,LOWORD(DVSR)\n mov edx,HIWORD(DVND) ; edx:eax <- dividend\n mov eax,LOWORD(DVND)\nL5:\n shr ebx,1 ; shift divisor right one bit\n rcr ecx,1\n shr edx,1 ; shift dividend right one bit\n rcr eax,1\n or ebx,ebx\n jnz short L5 ; loop until divisor < 4194304K\n div ecx ; now divide, ignore remainder\n\n;\n; We may be off by one, so to check, we will multiply the quotient\n; by the divisor and check the result against the orignal dividend\n; Note that we must also check for overflow, which can occur if the\n; dividend is close to 2**64 and the quotient is off by 1.\n;\n\n mov ecx,eax ; save a copy of quotient in ECX\n mul dword ptr HIWORD(DVSR)\n xchg ecx,eax ; save product, get quotient in EAX\n mul dword ptr LOWORD(DVSR)\n add edx,ecx ; EDX:EAX = QUOT * DVSR\n jc short L6 ; carry means Quotient is off by 1\n\n;\n; do long compare here between original dividend and the result of the\n; multiply in edx:eax. If original is larger or equal, we are ok, otherwise\n; subtract the original divisor from the result.\n;\n\n cmp edx,HIWORD(DVND) ; compare hi words of result and original\n ja short L6 ; if result > original, do subtract\n jb short L7 ; if result < original, we are ok\n cmp eax,LOWORD(DVND) ; hi words are equal, compare lo words\n jbe short L7 ; if less or equal we are ok, else subtract\nL6:\n sub eax,LOWORD(DVSR) ; subtract divisor from result\n sbb edx,HIWORD(DVSR)\nL7:\n\n;\n; Calculate remainder by subtracting the result from the original dividend.\n; Since the result is already in a register, we will do the subtract in the\n; opposite direction and negate the result if necessary.\n;\n\n sub eax,LOWORD(DVND) ; subtract dividend from result\n sbb edx,HIWORD(DVND)\n\n;\n; Now check the result sign flag to see if the result is supposed to be positive\n; or negative. It is currently negated (because we subtracted in the 'wrong'\n; direction), so if the sign flag is set we are done, otherwise we must negate\n; the result to make it positive again.\n;\n\n dec edi ; check result sign flag\n jns short L8 ; result is ok, restore stack and return\nL4:\n neg edx ; otherwise, negate the result\n neg eax\n sbb edx,0\n\n;\n; Just the cleanup left to do. edx:eax contains the quotient.\n; Restore the saved registers and return.\n;\n\nL8:\n pop edi\n pop ebx\n\n ret 16\n\n__allrem ENDP\n\n;***\n;llshl.asm - long shift left\n;\n; Copyright (c) Microsoft Corporation. All rights reserved.\n;\n;Purpose:\n; define long shift left routine (signed and unsigned are same)\n; __allshl\n;\n;Revision History:\n; 11-??-83 HS initial version\n; 11-30-83 DFW added medium model support\n; 03-12-84 DFW broke apart; added long model support\n; 06-01-84 RN modified to use cmacros\n; 11-28-89 GJF Fixed copyright\n; 11-19-93 SMK Modified to work on 64 bit integers\n; 01-17-94 GJF Minor changes to build with NT's masm386.\n; 07-08-94 GJF Faster, fatter version for NT.\n; 07-13-94 GJF Further improvements from JonM.\n;\n;*******************************************************************************\n\n\n;***\n;llshl - long shift left\n;\n;Purpose:\n; Does a Long Shift Left (signed and unsigned are identical)\n; Shifts a long left any number of bits.\n;\n;Entry:\n; EDX:EAX - long value to be shifted\n; CL - number of bits to shift by\n;\n;Exit:\n; EDX:EAX - shifted value\n;\n;Uses:\n; CL is destroyed.\n;\n;Exceptions:\n;\n;*******************************************************************************\n\n__allshl PROC NEAR\n\n;\n; Handle shifts of 64 or more bits (all get 0)\n;\n cmp cl, 64\n jae short RETZERO\n\n;\n; Handle shifts of between 0 and 31 bits\n;\n cmp cl, 32\n jae short MORE32\n shld edx,eax,cl\n shl eax,cl\n ret\n\n;\n; Handle shifts of between 32 and 63 bits\n;\nMORE32:\n mov edx,eax\n xor eax,eax\n and cl,31\n shl edx,cl\n ret\n\n;\n; return 0 in edx:eax\n;\nRETZERO:\n xor eax,eax\n xor edx,edx\n ret\n\n__allshl ENDP\n\n;***\n;llshr.asm - long shift right\n;\n; Copyright (c) Microsoft Corporation. All rights reserved.\n;\n;Purpose:\n; define signed long shift right routine\n; __allshr\n;\n;Revision History:\n; 11-??-83 HS initial version\n; 11-30-83 DFW added medium model support\n; 03-12-84 DFW broke apart; added long model support\n; 06-01-84 RN modified to use cmacros\n; 11-28-89 GJF Fixed copyright\n; 11-19-93 SMK Modified to work on 64 bit integers\n; 01-17-94 GJF Minor changes to build with NT's masm386.\n; 07-08-94 GJF Faster, fatter version for NT.\n; 07-13-94 GJF Further improvements from JonM.\n;\n;*******************************************************************************\n\n\n;***\n;llshr - long shift right\n;\n;Purpose:\n; Does a signed Long Shift Right\n; Shifts a long right any number of bits.\n;\n;Entry:\n; EDX:EAX - long value to be shifted\n; CL - number of bits to shift by\n;\n;Exit:\n; EDX:EAX - shifted value\n;\n;Uses:\n; CL is destroyed.\n;\n;Exceptions:\n;\n;*******************************************************************************\n\n__allshr PROC NEAR\n\n;\n; Handle shifts of 64 bits or more (if shifting 64 bits or more, the result\n; depends only on the high order bit of edx).\n;\n cmp cl,64\n jae short RETSIGN\n\n;\n; Handle shifts of between 0 and 31 bits\n;\n cmp cl, 32\n jae short MORE32\n shrd eax,edx,cl\n sar edx,cl\n ret\n\n;\n; Handle shifts of between 32 and 63 bits\n;\nMORE32:\n mov eax,edx\n sar edx,31\n and cl,31\n sar eax,cl\n ret\n\n;\n; Return double precision 0 or -1, depending on the sign of edx\n;\nRETSIGN:\n sar edx,31\n mov eax,edx\n ret\n\n__allshr ENDP\n\n;***\n;ulldiv.asm - unsigned long divide routine\n;\n; Copyright (c) Microsoft Corporation. All rights reserved.\n;\n;Purpose:\n; defines the unsigned long divide routine\n; __aulldiv\n;\n;Revision History:\n; 11-29-83 DFW initial version\n; 06-01-84 RN modified to use cmacros\n; 10-23-87 SKS fixed off-by-1 error for dividend close to 2**32.\n; 05-18-89 SKS Remove redundant \"MOV SP,BP\" from epilog\n; 11-28-89 GJF Fixed copyright\n; 11-19-93 SMK Modified to work on 64 bit integers\n; 01-17-94 GJF Minor changes to build with NT's masm386.\n; 07-22-94 GJF Use esp-relative addressing for args. Shortened\n; conditional jumps. Also, don't use xchg to do a\n; simple move between regs.\n;\n;*******************************************************************************\n\n\n;***\n;ulldiv - unsigned long divide\n;\n;Purpose:\n; Does a unsigned long divide of the arguments. Arguments are\n; not changed.\n;\n;Entry:\n; Arguments are passed on the stack:\n; 1st pushed: divisor (QWORD)\n; 2nd pushed: dividend (QWORD)\n;\n;Exit:\n; EDX:EAX contains the quotient (dividend/divisor)\n; NOTE: this routine removes the parameters from the stack.\n;\n;Uses:\n; ECX\n;\n;Exceptions:\n;\n;*******************************************************************************\n\n__aulldiv PROC NEAR\n\n push ebx\n push esi\n\n; Set up the local stack and save the index registers. When this is done\n; the stack frame will look as follows (assuming that the expression a/b will\n; generate a call to uldiv(a, b)):\n;\n; -----------------\n; | |\n; |---------------|\n; | |\n; |--divisor (b)--|\n; | |\n; |---------------|\n; | |\n; |--dividend (a)-|\n; | |\n; |---------------|\n; | return addr** |\n; |---------------|\n; | EBX |\n; |---------------|\n; ESP---->| ESI |\n; -----------------\n;\n\nDVND equ [esp + 12] ; stack address of dividend (a)\nDVSR equ [esp + 20] ; stack address of divisor (b)\n\n;\n; Now do the divide. First look to see if the divisor is less than 4194304K.\n; If so, then we can use a simple algorithm with word divides, otherwise\n; things get a little more complex.\n;\n\n mov eax,HIWORD(DVSR) ; check to see if divisor < 4194304K\n or eax,eax\n jnz short L1 ; nope, gotta do this the hard way\n mov ecx,LOWORD(DVSR) ; load divisor\n mov eax,HIWORD(DVND) ; load high word of dividend\n xor edx,edx\n div ecx ; get high order bits of quotient\n mov ebx,eax ; save high bits of quotient\n mov eax,LOWORD(DVND) ; edx:eax <- remainder:lo word of dividend\n div ecx ; get low order bits of quotient\n mov edx,ebx ; edx:eax <- quotient hi:quotient lo\n jmp short L2 ; restore stack and return\n\n;\n; Here we do it the hard way. Remember, eax contains DVSRHI\n;\n\nL1:\n mov ecx,eax ; ecx:ebx <- divisor\n mov ebx,LOWORD(DVSR)\n mov edx,HIWORD(DVND) ; edx:eax <- dividend\n mov eax,LOWORD(DVND)\nL3:\n shr ecx,1 ; shift divisor right one bit; hi bit <- 0\n rcr ebx,1\n shr edx,1 ; shift dividend right one bit; hi bit <- 0\n rcr eax,1\n or ecx,ecx\n jnz short L3 ; loop until divisor < 4194304K\n div ebx ; now divide, ignore remainder\n mov esi,eax ; save quotient\n\n;\n; We may be off by one, so to check, we will multiply the quotient\n; by the divisor and check the result against the orignal dividend\n; Note that we must also check for overflow, which can occur if the\n; dividend is close to 2**64 and the quotient is off by 1.\n;\n\n mul dword ptr HIWORD(DVSR) ; QUOT * HIWORD(DVSR)\n mov ecx,eax\n mov eax,LOWORD(DVSR)\n mul esi ; QUOT * LOWORD(DVSR)\n add edx,ecx ; EDX:EAX = QUOT * DVSR\n jc short L4 ; carry means Quotient is off by 1\n\n;\n; do long compare here between original dividend and the result of the\n; multiply in edx:eax. If original is larger or equal, we are ok, otherwise\n; subtract one (1) from the quotient.\n;\n\n cmp edx,HIWORD(DVND) ; compare hi words of result and original\n ja short L4 ; if result > original, do subtract\n jb short L5 ; if result < original, we are ok\n cmp eax,LOWORD(DVND) ; hi words are equal, compare lo words\n jbe short L5 ; if less or equal we are ok, else subtract\nL4:\n dec esi ; subtract 1 from quotient\nL5:\n xor edx,edx ; edx:eax <- quotient\n mov eax,esi\n\n;\n; Just the cleanup left to do. edx:eax contains the quotient.\n; Restore the saved registers and return.\n;\n\nL2:\n\n pop esi\n pop ebx\n\n ret 16\n\n__aulldiv ENDP\n\n;***\n;ulldvrm.asm - unsigned long divide and remainder routine\n;\n; Copyright (c) Microsoft Corporation. All rights reserved.\n;\n;Purpose:\n; defines the unsigned long divide and remainder routine\n; __aulldvrm\n;\n;Revision History:\n; 10-06-98 SMK Initial version.\n;\n;*******************************************************************************\n\n\n;***\n;ulldvrm - unsigned long divide and remainder\n;\n;Purpose:\n; Does a unsigned long divide and remainder of the arguments. Arguments\n; are not changed.\n;\n;Entry:\n; Arguments are passed on the stack:\n; 1st pushed: divisor (QWORD)\n; 2nd pushed: dividend (QWORD)\n;\n;Exit:\n; EDX:EAX contains the quotient (dividend/divisor)\n; EBX:ECX contains the remainder (divided % divisor)\n; NOTE: this routine removes the parameters from the stack.\n;\n;Uses:\n; ECX\n;\n;Exceptions:\n;\n;*******************************************************************************\n\n__aulldvrm PROC NEAR\n\n push esi\n\n; Set up the local stack and save the index registers. When this is done\n; the stack frame will look as follows (assuming that the expression a/b will\n; generate a call to aulldvrm(a, b)):\n;\n; -----------------\n; | |\n; |---------------|\n; | |\n; |--divisor (b)--|\n; | |\n; |---------------|\n; | |\n; |--dividend (a)-|\n; | |\n; |---------------|\n; | return addr** |\n; |---------------|\n; ESP---->| ESI |\n; -----------------\n;\n\nDVND equ [esp + 8] ; stack address of dividend (a)\nDVSR equ [esp + 16] ; stack address of divisor (b)\n\n;\n; Now do the divide. First look to see if the divisor is less than 4194304K.\n; If so, then we can use a simple algorithm with word divides, otherwise\n; things get a little more complex.\n;\n\n mov eax,HIWORD(DVSR) ; check to see if divisor < 4194304K\n or eax,eax\n jnz short L1 ; nope, gotta do this the hard way\n mov ecx,LOWORD(DVSR) ; load divisor\n mov eax,HIWORD(DVND) ; load high word of dividend\n xor edx,edx\n div ecx ; get high order bits of quotient\n mov ebx,eax ; save high bits of quotient\n mov eax,LOWORD(DVND) ; edx:eax <- remainder:lo word of dividend\n div ecx ; get low order bits of quotient\n mov esi,eax ; ebx:esi <- quotient\n\n;\n; Now we need to do a multiply so that we can compute the remainder.\n;\n mov eax,ebx ; set up high word of quotient\n mul dword ptr LOWORD(DVSR) ; HIWORD(QUOT) * DVSR\n mov ecx,eax ; save the result in ecx\n mov eax,esi ; set up low word of quotient\n mul dword ptr LOWORD(DVSR) ; LOWORD(QUOT) * DVSR\n add edx,ecx ; EDX:EAX = QUOT * DVSR\n jmp short L2 ; complete remainder calculation\n\n;\n; Here we do it the hard way. Remember, eax contains DVSRHI\n;\n\nL1:\n mov ecx,eax ; ecx:ebx <- divisor\n mov ebx,LOWORD(DVSR)\n mov edx,HIWORD(DVND) ; edx:eax <- dividend\n mov eax,LOWORD(DVND)\nL3:\n shr ecx,1 ; shift divisor right one bit; hi bit <- 0\n rcr ebx,1\n shr edx,1 ; shift dividend right one bit; hi bit <- 0\n rcr eax,1\n or ecx,ecx\n jnz short L3 ; loop until divisor < 4194304K\n div ebx ; now divide, ignore remainder\n mov esi,eax ; save quotient\n\n;\n; We may be off by one, so to check, we will multiply the quotient\n; by the divisor and check the result against the orignal dividend\n; Note that we must also check for overflow, which can occur if the\n; dividend is close to 2**64 and the quotient is off by 1.\n;\n\n mul dword ptr HIWORD(DVSR) ; QUOT * HIWORD(DVSR)\n mov ecx,eax\n mov eax,LOWORD(DVSR)\n mul esi ; QUOT * LOWORD(DVSR)\n add edx,ecx ; EDX:EAX = QUOT * DVSR\n jc short L4 ; carry means Quotient is off by 1\n\n;\n; do long compare here between original dividend and the result of the\n; multiply in edx:eax. If original is larger or equal, we are ok, otherwise\n; subtract one (1) from the quotient.\n;\n\n cmp edx,HIWORD(DVND) ; compare hi words of result and original\n ja short L4 ; if result > original, do subtract\n jb short L5 ; if result < original, we are ok\n cmp eax,LOWORD(DVND) ; hi words are equal, compare lo words\n jbe short L5 ; if less or equal we are ok, else subtract\nL4:\n dec esi ; subtract 1 from quotient\n sub eax,LOWORD(DVSR) ; subtract divisor from result\n sbb edx,HIWORD(DVSR)\nL5:\n xor ebx,ebx ; ebx:esi <- quotient\n\nL2:\n;\n; Calculate remainder by subtracting the result from the original dividend.\n; Since the result is already in a register, we will do the subtract in the\n; opposite direction and negate the result.\n;\n\n sub eax,LOWORD(DVND) ; subtract dividend from result\n sbb edx,HIWORD(DVND)\n neg edx ; otherwise, negate the result\n neg eax\n sbb edx,0\n\n;\n; Now we need to get the quotient into edx:eax and the remainder into ebx:ecx.\n;\n mov ecx,edx\n mov edx,ebx\n mov ebx,ecx\n mov ecx,eax\n mov eax,esi\n;\n; Just the cleanup left to do. edx:eax contains the quotient.\n; Restore the saved registers and return.\n;\n\n pop esi\n\n ret 16\n\n__aulldvrm ENDP\n\n;***\n;ullrem.asm - unsigned long remainder routine\n;\n; Copyright (c) Microsoft Corporation. All rights reserved.\n;\n;Purpose:\n; defines the unsigned long remainder routine\n; __aullrem\n;\n;Revision History:\n; 11-29-83 DFW initial version\n; 06-01-84 RN modified to use cmacros\n; 10-23-87 SKS fixed off-by-1 error for dividend close to 2**32.\n; 05-18-89 SKS Remove redundant \"MOV SP,BP\" from epilog\n; 11-28-89 GJF Fixed copyright\n; 11-19-93 SMK Modified to work on 64 bit integers\n; 01-17-94 GJF Minor changes to build with NT's masm386.\n; 07-22-94 GJF Use esp-relative addressing for args. Shortened\n; conditional jumps.\n;\n;*******************************************************************************\n\n\n;***\n;ullrem - unsigned long remainder\n;\n;Purpose:\n; Does a unsigned long remainder of the arguments. Arguments are\n; not changed.\n;\n;Entry:\n; Arguments are passed on the stack:\n; 1st pushed: divisor (QWORD)\n; 2nd pushed: dividend (QWORD)\n;\n;Exit:\n; EDX:EAX contains the remainder (dividend%divisor)\n; NOTE: this routine removes the parameters from the stack.\n;\n;Uses:\n; ECX\n;\n;Exceptions:\n;\n;*******************************************************************************\n\n__aullrem PROC NEAR\n\n push ebx\n\n; Set up the local stack and save the index registers. When this is done\n; the stack frame will look as follows (assuming that the expression a%b will\n; generate a call to ullrem(a, b)):\n;\n; -----------------\n; | |\n; |---------------|\n; | |\n; |--divisor (b)--|\n; | |\n; |---------------|\n; | |\n; |--dividend (a)-|\n; | |\n; |---------------|\n; | return addr** |\n; |---------------|\n; ESP---->| EBX |\n; -----------------\n;\n\nDVND equ [esp + 8] ; stack address of dividend (a)\nDVSR equ [esp + 16] ; stack address of divisor (b)\n\n; Now do the divide. First look to see if the divisor is less than 4194304K.\n; If so, then we can use a simple algorithm with word divides, otherwise\n; things get a little more complex.\n;\n\n mov eax,HIWORD(DVSR) ; check to see if divisor < 4194304K\n or eax,eax\n jnz short L1 ; nope, gotta do this the hard way\n mov ecx,LOWORD(DVSR) ; load divisor\n mov eax,HIWORD(DVND) ; load high word of dividend\n xor edx,edx\n div ecx ; edx <- remainder, eax <- quotient\n mov eax,LOWORD(DVND) ; edx:eax <- remainder:lo word of dividend\n div ecx ; edx <- final remainder\n mov eax,edx ; edx:eax <- remainder\n xor edx,edx\n jmp short L2 ; restore stack and return\n\n;\n; Here we do it the hard way. Remember, eax contains DVSRHI\n;\n\nL1:\n mov ecx,eax ; ecx:ebx <- divisor\n mov ebx,LOWORD(DVSR)\n mov edx,HIWORD(DVND) ; edx:eax <- dividend\n mov eax,LOWORD(DVND)\nL3:\n shr ecx,1 ; shift divisor right one bit; hi bit <- 0\n rcr ebx,1\n shr edx,1 ; shift dividend right one bit; hi bit <- 0\n rcr eax,1\n or ecx,ecx\n jnz short L3 ; loop until divisor < 4194304K\n div ebx ; now divide, ignore remainder\n\n;\n; We may be off by one, so to check, we will multiply the quotient\n; by the divisor and check the result against the orignal dividend\n; Note that we must also check for overflow, which can occur if the\n; dividend is close to 2**64 and the quotient is off by 1.\n;\n\n mov ecx,eax ; save a copy of quotient in ECX\n mul dword ptr HIWORD(DVSR)\n xchg ecx,eax ; put partial product in ECX, get quotient in EAX\n mul dword ptr LOWORD(DVSR)\n add edx,ecx ; EDX:EAX = QUOT * DVSR\n jc short L4 ; carry means Quotient is off by 1\n\n;\n; do long compare here between original dividend and the result of the\n; multiply in edx:eax. If original is larger or equal, we're ok, otherwise\n; subtract the original divisor from the result.\n;\n\n cmp edx,HIWORD(DVND) ; compare hi words of result and original\n ja short L4 ; if result > original, do subtract\n jb short L5 ; if result < original, we're ok\n cmp eax,LOWORD(DVND) ; hi words are equal, compare lo words\n jbe short L5 ; if less or equal we're ok, else subtract\nL4:\n sub eax,LOWORD(DVSR) ; subtract divisor from result\n sbb edx,HIWORD(DVSR)\nL5:\n\n;\n; Calculate remainder by subtracting the result from the original dividend.\n; Since the result is already in a register, we will perform the subtract in\n; the opposite direction and negate the result to make it positive.\n;\n\n sub eax,LOWORD(DVND) ; subtract original dividend from result\n sbb edx,HIWORD(DVND)\n neg edx ; and negate it\n neg eax\n sbb edx,0\n\n;\n; Just the cleanup left to do. dx:ax contains the remainder.\n; Restore the saved registers and return.\n;\n\nL2:\n\n pop ebx\n\n ret 16\n\n__aullrem ENDP\n\n;***\n;ullshr.asm - long shift right\n;\n; Copyright (c) Microsoft Corporation. All rights reserved.\n;\n;Purpose:\n; define unsigned long shift right routine\n; __aullshr\n;\n;Revision History:\n; 11-??-83 HS initial version\n; 11-30-83 DFW added medium model support\n; 03-12-84 DFW broke apart; added long model support\n; 06-01-84 RN modified to use cmacros\n; 11-28-89 GJF Fixed copyright\n; 11-19-93 SMK Modified to work on 64 bit integers\n; 01-17-94 GJF Minor changes to build with NT's masm386.\n; 07-08-94 GJF Faster, fatter version for NT.\n; 07-13-94 GJF Further improvements from JonM.\n;\n;*******************************************************************************\n\n\n;***\n;ullshr - long shift right\n;\n;Purpose:\n; Does a unsigned Long Shift Right\n; Shifts a long right any number of bits.\n;\n;Entry:\n; EDX:EAX - long value to be shifted\n; CL - number of bits to shift by\n;\n;Exit:\n; EDX:EAX - shifted value\n;\n;Uses:\n; CL is destroyed.\n;\n;Exceptions:\n;\n;*******************************************************************************\n\n__aullshr PROC NEAR\n\n;\n; Handle shifts of 64 bits or more (if shifting 64 bits or more, the result\n; depends only on the high order bit of edx).\n;\n cmp cl,64\n jae short RETZERO\n\n;\n; Handle shifts of between 0 and 31 bits\n;\n cmp cl, 32\n jae short MORE32\n shrd eax,edx,cl\n shr edx,cl\n ret\n\n;\n; Handle shifts of between 32 and 63 bits\n;\nMORE32:\n mov eax,edx\n xor edx,edx\n and cl,31\n shr eax,cl\n ret\n\n;\n; return 0 in edx:eax\n;\nRETZERO:\n xor eax,eax\n xor edx,edx\n ret\n\n__aullshr ENDP\n\nend\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/x86/blidt.asm", "content": ";++\n;\n; Copyright (c) Microsoft Corporation\n;\n; Module Name:\n;\n; blidt.asm\n;\n; Abstract:\n;\n; This module implements IDT functions for the boot loader.\n;\n; Environment:\n;\n; Boot loader.\n;\n;--\n\ninclude bl.inc\n\n.686p\n.model flat\n.code\n\nassume ds:flat\nassume es:flat\nassume ss:flat\nassume fs:flat\n\nextrn ?BlTrapFatal@@YIXKPAU_BL_TRAP_CONTEXT@@@Z:near\n \n;++\n;\n; VOID\n; BlTrapEnter(\n; VOID\n; )\n;\n; Routine Description:\n;\n; Entry point for incoming exceptions.\n;\n;--\n\n align 16\n \n;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n;;;\n;;; The IDT_ENTER building macros insure that each IDT target has\n;;; an offset of form BlTrapEnter + 0x10 * interrupt_number.\n;;;\n\nIDT_ENTER_NOERR MACRO num:req\n push 77h ; No error\n call @f\n align 8\nENDM\n\nIDT_ENTER_ERR MACRO num:req\n call @f\n align 8\nENDM\n\n align 16\n?BlTrapEnter@@YIXXZ proc\n IDT_ENTER_NOERR 000h ; #DE Divide-by-Zero\n IDT_ENTER_NOERR 001h ; #DB Debug Exception\n IDT_ENTER_NOERR 002h ; NMI Non-Maskable-Interrupt\n IDT_ENTER_NOERR 003h ; #BP Breakpoint\n IDT_ENTER_NOERR 004h ; #OF OVerflow\n IDT_ENTER_NOERR 005h ; #BR Bound-Range\n IDT_ENTER_NOERR 006h ; #UD Invalid Opcode\n IDT_ENTER_NOERR 007h ; #NM Device Not Available\n IDT_ENTER_ERR 008h ; #DF Double Fault\n IDT_ENTER_NOERR 009h ; Unused (was x87 segment except)\n IDT_ENTER_ERR 00ah ; #TS Invalid TSS\n IDT_ENTER_ERR 00bh ; #NP Sgement Not Present\n IDT_ENTER_ERR 00ch ; #SS Stack Exception\n IDT_ENTER_ERR 00dh ; #GP General Protection\n IDT_ENTER_ERR 00eh ; #PF Page Fault\n IDT_ENTER_NOERR 00fh ; Reserved\n IDT_ENTER_NOERR 010h ; #MF x87 Math Error\n IDT_ENTER_ERR 011h ; #AC Alignment Check\n IDT_ENTER_NOERR 012h ; #MC Machine Check\n IDT_ENTER_NOERR 013h ; #XF SIMD Exception\n\n inum = 014h ; 014h to 020h\n WHILE inum LE 020h\n IDT_ENTER_NOERR inum\n inum = inum + 1\n ENDM\n@@:\n push eax\n push ebx\n push ecx\n push edx\n push esi\n push edi\n push ebp\n mov eax, esp\n add eax, 48\n push eax\n mov eax, cr2\n push eax\n\n mov edx, esp\n mov ecx, [edx].BL_TRAP_CONTEXT.TrapNum\n sub ecx, ?BlTrapEnter@@YIXXZ\n shr ecx, 3\n mov [edx].BL_TRAP_CONTEXT.TrapNum, ecx\n call ?BlTrapFatal@@YIXKPAU_BL_TRAP_CONTEXT@@@Z\n@@:\n jmp @b\n\n?BlTrapEnter@@YIXXZ endp\n\n;++\n;\n; VOID\n; FASTCALL\n; BlTrapSetIdtr(\n; PIDTR Idtr\n; )\n;\n; Routine Description:\n;\n; This function sets the IDTR register.\n;\n; Arguments:\n;\n; Idtr - Supplies the data to write to the IDTR register.\n;\n;--\n\n?BlTrapSetIdtr@@YIXPAU_IDTR@@@Z proc\n\n lidt fword ptr [ecx]\n ret\n\n?BlTrapSetIdtr@@YIXPAU_IDTR@@@Z endp\n \nend\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/x86/blioport.asm", "content": ";++\n;\n; Copyright (c) Microsoft Corporation\n;\n; Module Name:\n;\n; blioport.asm\n;\n; Abstract:\n;\n; This module implements IO port access routines for the boot loader.\n;\n; Environment:\n;\n; Boot loader.\n;\n;--\n\ninclude bl.inc\n\n.686p\n.model flat\n.code\n\nassume ds:flat\nassume es:flat\nassume ss:flat\nassume fs:flat\n\n;++\n;\n; UCHAR\n; FASTCALL\n; BlRtlReadPort8(\n; USHORT Port\n; )\n;\n; Routine Description:\n;\n; This function reads from the specified 8-bit port.\n;\n; Arguments:\n;\n; Port - Supplies the port to read from.\n;\n; Return Value:\n;\n; Value read from the port.\n;\n;--\n\n?BlRtlReadPort8@@YIEG@Z proc\n\n mov dx, cx\n in al, dx\n ret\n\n?BlRtlReadPort8@@YIEG@Z endp\n\n;++\n;\n; ULONG\n; FASTCALL\n; BlRtlReadPort32(\n; USHORT Port\n; )\n;\n; Routine Description:\n;\n; This function reads from the specified 32-bit port.\n;\n; Arguments:\n;\n; Port - Supplies the port to read from.\n;\n; Return Value:\n;\n; Value read from the port.\n;\n;--\n\n?BlRtlReadPort32@@YIKG@Z proc\n\n mov dx, cx\n in eax, dx\n ret\n\n?BlRtlReadPort32@@YIKG@Z endp\n\n;++\n;\n; VOID\n; FASTCALL\n; BlRtlWritePort8(\n; USHORT Port,\n; UCHAR Value\n; )\n;\n; Routine Description:\n;\n; This function writes to the specified 8-bit port.\n;\n; Arguments:\n;\n; Port - Supplies the port to write to.\n;\n; Value - Supplies the value to write.\n;\n;--\n\n?BlRtlWritePort8@@YIXGE@Z proc\n\n mov al, dl\n mov dx, cx\n out dx, al\n ret\n\n?BlRtlWritePort8@@YIXGE@Z endp\n\n;++\n;\n; VOID\n; FASTCALL\n; BlRtlWritePort32(\n; USHORT Port,\n; ULONG Value\n; )\n;\n; Routine Description:\n;\n; This function writes to the specified 32-bit port.\n;\n; Arguments:\n;\n; Port - Supplies the port to write to.\n;\n; Value - Supplies the value to write.\n;\n;--\n\n?BlRtlWritePort32@@YIXGK@Z proc\n\n mov eax, edx\n mov dx, cx\n out dx, eax\n ret\n\n?BlRtlWritePort32@@YIXGK@Z endp\n\nend\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/x86/bllegacy.asm", "content": ";++\n;\n; Copyright (c) Microsoft Corporation\n;\n; Module Name:\n;\n; bllegacy.asm\n;\n; Abstract:\n;\n; This module implements legacy call support.\n;\n; Environment:\n;\n; Boot loader.\n;\n;--\n\ninclude bl.inc\n\n.686p\n.model flat\n.code\n\nassume ds:flat\nassume es:flat\nassume ss:flat\nassume fs:flat\n\n.code\n\n;\n; Legacy call frame.\n;\n\nLegacyCallFrame struct\n\n _eax dq ?\n _ebx dq ?\n _ecx dq ?\n _edx dq ?\n _ebp dq ?\n _esi dq ?\n _edi dq ?\n _idtr df ?\n\nLegacyCallFrame ends\n\nBlLegacyReturnStackPointer dd 0\n\n;++\n;\n; VOID\n; FASTCALL\n; BlReturnToLegacyMode(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function returns to legacy mode to process a legacy request.\n;\n;--\n\n?BlReturnToLegacyMode@@YIXXZ proc\n\n;\n; Save all registers.\n;\n\n sub esp, (sizeof LegacyCallFrame)\n\n mov dword ptr [esp].LegacyCallFrame._eax, eax\n mov dword ptr [esp].LegacyCallFrame._ebx, ebx\n mov dword ptr [esp].LegacyCallFrame._ecx, ecx\n mov dword ptr [esp].LegacyCallFrame._edx, edx\n mov dword ptr [esp].LegacyCallFrame._ebp, ebp\n mov dword ptr [esp].LegacyCallFrame._esi, esi\n mov dword ptr [esp].LegacyCallFrame._edi, edi\n\n;\n; Save IDTR\n;\n sidt fword ptr [esp].LegacyCallFrame._idtr\n\n;\n; Save stack pointer.\n;\n\n mov BlLegacyReturnStackPointer, esp\n\n;\n; Set return address in BEB.\n;\n\n mov eax, BEB_BASE\n lea ecx, @f\n mov dword ptr [eax].BEB.LegacyReturnAddress, ecx\n\n;\n; Get legacy call stub address from BEB.\n;\n\n mov ecx, dword ptr [eax].BEB.LegacyCallAddress\n\n;\n; Return to legacy mode.\n;\n\n call ecx\n\n@@:\n\n;\n; Restore stack pointer.\n;\n\n mov esp, BlLegacyReturnStackPointer\n\n;\n; Restore all registers.\n;\n\n mov eax, dword ptr [esp].LegacyCallFrame._eax\n mov ebx, dword ptr [esp].LegacyCallFrame._ebx\n mov ecx, dword ptr [esp].LegacyCallFrame._ecx\n mov edx, dword ptr [esp].LegacyCallFrame._edx\n mov ebp, dword ptr [esp].LegacyCallFrame._ebp\n mov esi, dword ptr [esp].LegacyCallFrame._esi\n mov edi, dword ptr [esp].LegacyCallFrame._edi\n\n;\n; Restore IDT\n;\n\n lidt fword ptr [esp].LegacyCallFrame._idtr\n\n add esp, (sizeof LegacyCallFrame)\n ret\n\n?BlReturnToLegacyMode@@YIXXZ endp\n\npublic ?BlReturnToLegacyMode@@YIXXZ\n\nend\n" }, { "path": "ironclad-apps/src/Checked/BootLoader/SingLdrPc/x86/blutilasm.asm", "content": ";++\n;\n; Copyright (c) Microsoft Corporation\n;\n; Module Name:\n;\n; blutilasm.asm\n;\n; Abstract:\n;\n; This module implements utility functions for the boot loader.\n;\n; Environment:\n;\n; Boot loader.\n;\n;--\n\ninclude bl.inc\n\n.686p\n.model flat\n.code\n\nassume ds:flat\nassume es:flat\nassume ss:flat\nassume fs:flat\n\n;++\n;\n; UINT\n; DisablePaging(\n; UINT reg\n; )\n;\n; Routine Description:\n; This function takes one value as an argument and returns another\n; that have no meaning. It was simpler to copy an existing function\n; than deduce the calling/name-mangling conventions for MS C++.\n; Return Value:\n;\n; None of interest\n;\n;--\n\n?DisablePaging@@YIKK@Z proc\n\n ; Disable paging\n mov eax, cr0\n and eax, NOT CR0_PG\n mov cr0, eax\n ; Make sure PAE is off, in case Verve turns paging back on\n mov eax, cr4\n and eax, NOT CR4_PAE \n and eax, NOT CR4_PSE\n mov cr4, eax\n ; Make sure long mode (EFER.LME) and no-execute (EFER_NXE) is off\n mov ecx, EFER_MSR_INDEX\n rdmsr\n and eax, NOT (EFER_LME OR EFER_NXE)\n wrmsr\n ret\n\n?DisablePaging@@YIKK@Z endp\n\n;++\n;\n; ULONG_PTR\n; FASTCALL\n; BlMmGetCr3(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function queries the CR3 register.\n;\n; Return Value:\n;\n; Value of the CR3 register.\n;\n;--\n\n?BlMmGetCr3@@YIKXZ proc\n\n mov eax, cr3\n ret\n\n?BlMmGetCr3@@YIKXZ endp\n\n;++\n;\n; VOID\n; FASTCALL\n; BlMmSetCr3(\n; ULONG_PTR Value\n; )\n;\n; Routine Description:\n;\n; This function sets the CR3 register.\n;\n; Arguments:\n;\n; Value - Supplies the value to write to the CR3 register.\n;\n;--\n\n?BlMmSetCr3@@YIXK@Z proc\n\n mov cr3, ecx\n ret\n\n?BlMmSetCr3@@YIXK@Z endp\n\n;++\n;\n; VOID\n; FASTCALL\n; BlFakeSKINIT(\n; ULONG_PTR Value\n; )\n;\n; Routine Description:\n;\n; This function launches Verve as though we had invoked SKINIT \n;\n; Arguments:\n;\n; Value - Supplies the base address of the Verve image\n;\n;--\n\n?BlFakeSKINIT@@YIXK@Z proc\n\n mov esp, ecx\n add esp, 00010000h ; esp == base + 64K\n mov eax, ecx ; eax == base\n; Now calculate the actual entry point, based on the SL header\n mov edx, [ecx] ; edx contains the SL header\n and edx, 0000FFFFh ; edx contains the entry point offset\n add ecx, edx ; ecx contains the absolute entry point addr\n jmp ecx\n\n?BlFakeSKINIT@@YIXK@Z endp\n\n;++\n;\n; VOID\n; FASTCALL\n; BlRealSKINIT(\n; ULONG_PTR Value\n; )\n;\n; Routine Description:\n;\n; This function launches Verve as via a real SKINIT \n;\n; Arguments:\n;\n; Value - Supplies the base address of the Verve image\n;\n;--\n\n?BlRealSKINIT@@YIXK@Z proc\n\n mov ebx, ecx ; ebx == base\n\n ; Enable SVM\n mov ecx, 0C0000080h ; Specify EFER\n rdmsr ; Puts value in EAX (and EDX in 64-bit mode)\n or eax, 000001000h ; Bit 12, SVME, is now set\n wrmsr ; Enable SVME\n\n ; Do it!\n mov eax, ebx ; Move the base addr back into EAX\n ; Windows doesn't know that the SKINIT opcode is 0x0f01de\n db 00fh\n db 001h\n db 0deh\n ;__emit 00fh\n ;__emit 001h\n ;__emit 0deh\n\n?BlRealSKINIT@@YIXK@Z endp\n\n\n;++\n;\n; VOID\n; FASTCALL\n; BlMmGetGdtr(\n; PGDTR Gdtr\n; )\n;\n; Routine Description:\n;\n; This function queries the GDTR register.\n;\n; Arguments:\n;\n; Gdtr - Receives the contents of the GDTR register.\n;\n;--\n\n?BlMmGetGdtr@@YIXPAU_GDTR@@@Z proc\n\n sgdt fword ptr [ecx]\n ret\n\n?BlMmGetGdtr@@YIXPAU_GDTR@@@Z endp\n\n;++\n;\n; VOID\n; FASTCALL\n; BlMmSetGdtr(\n; PGDTR Gdtr\n; )\n;\n; Routine Description:\n;\n; This function sets the GDTR register.\n;\n; Arguments:\n;\n; Gdtr - Supplies the data to write to the GDTR register.\n;\n;--\n\n?BlMmSetGdtr@@YIXPAU_GDTR@@@Z proc\n\n lgdt fword ptr [ecx]\n ret\n\n?BlMmSetGdtr@@YIXPAU_GDTR@@@Z endp\n\n;++\n;\n; USHORT\n; FASTCALL\n; BlMmGetFs(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function queries the FS register.\n;\n; Return Value:\n;\n; Value of the FS register.\n;\n;--\n\n@BlMmGetFs@0 proc\n\n mov ax, fs\n ret\n\n@BlMmGetFs@0 endp\n\n;++\n;\n; VOID\n; FASTCALL\n; BlMmSetFs(\n; USHORT Value\n; )\n;\n; Routine Description:\n;\n; This function sets the FS register.\n;\n; Arguments:\n;\n; Value - Supplies the value to write to the FS register.\n;\n;--\n\n?BlMmSetFs@@YIXG@Z proc\n\n mov fs, cx\n ret\n\n?BlMmSetFs@@YIXG@Z endp\n\n;++\n;\n; VOID\n; FASTCALL\n; BlMmSwitchStack(\n; PVOID Stack,\n; PVOID Function\n; )\n;\n; Routine Description:\n;\n; This function switches the stack and calls the specified function.\n;\n; Arguments:\n;\n; Stack - Supplies the stack to switch to.\n;\n; Function - Supplies the function to call.\n;\n;--\n\n?BlMmSwitchStack@@YIXPAX0@Z proc\n\n mov esp, ecx\n call edx\n\n@@:\n jmp @b\n\n?BlMmSwitchStack@@YIXPAX0@Z endp\n\n;++\n;\n; PVOID\n; FASTCALL\n; BlRtlGetEbp(\n; VOID\n; )\n;\n; Routine Description:\n;\n; This function queries the value of the EBP register.\n;\n; Return Value:\n;\n; Value of the EBP register.\n;\n;--\n\n?BlRtlGetEbp@@YIPAXXZ proc\n\n mov eax, ebp\n ret\n\n?BlRtlGetEbp@@YIPAXXZ endp\n \n;++\n;\n; UINT\n; BlGetCpuidEax(\n; UINT reg\n; )\n;\n; Routine Description:\n;\n; This function queries the CPUID.\n;\n; Return Value:\n;\n; Value of the EAX register.\n;\n;--\n\n?BlGetCpuidEax@@YIKK@Z proc\n\n mov eax, ecx\n cpuid\n ret\n\n?BlGetCpuidEax@@YIKK@Z endp\n\n;++\n;\n; UINT\n; BlGetCpuidEbx(\n; UINT reg\n; )\n;\n; Routine Description:\n;\n; This function queries the CPUID.\n;\n; Return Value:\n;\n; Value of the EBX register.\n;\n;--\n\n?BlGetCpuidEbx@@YIKK@Z proc\n\n mov eax, ecx\n cpuid\n mov ebx, eax\n ret\n\n?BlGetCpuidEbx@@YIKK@Z endp\n\n;++\n;\n; UINT\n; BlGetCpuidEcx(\n; UINT reg\n; )\n;\n; Routine Description:\n;\n; This function queries the CPUID.\n;\n; Return Value:\n;\n; Value of the ECX register.\n;\n;--\n\n?BlGetCpuidEcx@@YIKK@Z proc\n\n mov eax, ecx\n cpuid\n mov eax, ecx\n ret\n \n?BlGetCpuidEcx@@YIKK@Z endp\n\n;++\n;\n; UINT\n; BlGetCpuidEdx(\n; UINT reg\n; )\n;\n; Routine Description:\n;\n; This function queries the CPUID.\n;\n; Return Value:\n;\n; Value of the EDX register.\n;\n;--\n\n?BlGetCpuidEdx@@YIKK@Z proc\n\n mov eax, ecx\n cpuid\n mov eax, edx\n ret\n\n?BlGetCpuidEdx@@YIKK@Z endp\n\n \nend\n" }, { "path": "ironclad-apps/src/Checked/Libraries/DafnyCC/Base.dfy", "content": "include \"../../../Dafny/Libraries/base.s.dfy\"\r\nstatic function{:imported} unroll_all(i:int):bool { true }\r\nstatic function{:imported} INTERNAL_add_raw(x:int, y:int):int { x + y }\r\nstatic function{:imported} INTERNAL_sub_raw(x:int, y:int):int { x + y }\r\ntype INTERNAL_AbsMem;\r\ntype INTERNAL_ArrayElems;\r\nstatic function{:imported} INTERNAL_array_elems(a:array):INTERNAL_ArrayElems\r\nstatic function{:imported} INTERNAL_array_elems_index(a:INTERNAL_ArrayElems, k:int):int\r\nstatic function{:imported} INTERNAL_array_elems_update(a:INTERNAL_ArrayElems, k:int, v:int):INTERNAL_ArrayElems\r\nstatic function{:imported} INTERNAL_array_update(a:array, k:int, v:int):INTERNAL_AbsMem\r\n\r\n\r\n" }, { "path": "ironclad-apps/src/Checked/Libraries/DafnyCC/Seq.dfy", "content": "include \"Base.dfy\"\r\ninclude \"../../../Trusted/DafnySpec/Seq.s.dfy\"\r\n\r\n//- Untrusted sequence definitions\r\n\r\nghost method Seq_Empty_ToZero()\r\n ensures Seq_Length(Seq_Empty()) == 0;\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n}\r\n\r\nghost method Seq_Empty_FromZero()\r\n ensures (forall s:Seq {:trigger Seq_Length(s)}::Seq_Length(s) == 0 ==> s == Seq_Empty());\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n assert unroll_all(1);\r\n Seq_Cons_All();\r\n}\r\n\r\nghost method Seq_Singleton_Length()\r\n ensures (forall a:A {:trigger Seq_Length(Seq_Singleton(a))}::Seq_Length(Seq_Singleton(a)) == 1);\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Singleton(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n}\r\n\r\nghost method Seq_Index_Negative(s:Seq, k:int)\r\n ensures k < 0 ==> Seq_Index(s, k) == Seq_Dummy();\r\n{\r\n reveal_Seq_Index(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s.Seq_Cons?)\r\n {\r\n Seq_Seq(s);\r\n Seq_Index_Negative(s.tl, k - 1);\r\n }\r\n}\r\n\r\nghost method Seq_Build_LengthRec(s:Seq, a:A)\r\n ensures Seq_Length(Seq_Build(s, a)) == 1 + Seq_Length(s);\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Singleton(){:typearg \"A\"};\r\n reveal_Seq_Build(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s.Seq_Cons?)\r\n {\r\n Seq_Seq(s);\r\n Seq_Build_LengthRec(s.tl, a);\r\n }\r\n}\r\n\r\nghost method Seq_Build_Length()\r\n ensures (forall s:Seq, a:A {:trigger Seq_Length(Seq_Build(s, a))}::Seq_Length(Seq_Build(s, a)) == INTERNAL_add_raw(1, Seq_Length(s)));\r\n{\r\n forall s:Seq, a:A\r\n ensures Seq_Length(Seq_Build(s, a)) == 1 + Seq_Length(s);\r\n {\r\n Seq_Build_LengthRec(s, a);\r\n }\r\n}\r\n\r\nghost method Seq_Build_IndexRec(s:Seq, k:int, a:A)\r\n ensures k == Seq_Length(s) ==> Seq_Index(Seq_Build(s, a), k) == a;\r\n ensures k != Seq_Length(s) ==> Seq_Index(Seq_Build(s, a), k) == Seq_Index(s, k);\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Singleton(){:typearg \"A\"};\r\n reveal_Seq_Build(){:typearg \"A\"};\r\n reveal_Seq_Index(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s.Seq_Cons?)\r\n {\r\n Seq_Seq(s);\r\n Seq_Build_IndexRec(s.tl, k - 1, a);\r\n }\r\n}\r\n\r\nghost method Seq_Build_Index()\r\n ensures forall s:Seq, k:int, a:A {:trigger Seq_Index(Seq_Build(s, a), k)}::\r\n (k == Seq_Length(s) ==> Seq_Index(Seq_Build(s, a), k) == a)\r\n && (k != Seq_Length(s) ==> Seq_Index(Seq_Build(s, a), k) == Seq_Index(s, k));\r\n{\r\n forall s:Seq, k:int, a:A\r\n ensures (k == Seq_Length(s) ==> Seq_Index(Seq_Build(s, a), k) == a)\r\n && (k != Seq_Length(s) ==> Seq_Index(Seq_Build(s, a), k) == Seq_Index(s, k));\r\n {\r\n Seq_Build_IndexRec(s, k, a);\r\n }\r\n}\r\n\r\nghost method Seq_Append_LengthRec(s0:Seq, s1:Seq)\r\n ensures Seq_Length(Seq_Append(s0, s1)) == Seq_Length(s0) + Seq_Length(s1);\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Append(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s0.Seq_Cons?)\r\n {\r\n Seq_Seq(s0);\r\n Seq_Append_LengthRec(s0.tl, s1);\r\n }\r\n}\r\n\r\nghost method Seq_Append_Length()\r\n ensures forall s0:Seq, s1:Seq {:trigger Seq_Length(Seq_Append(s0, s1))}::\r\n Seq_Length(Seq_Append(s0, s1)) == INTERNAL_add_raw(Seq_Length(s0), Seq_Length(s1));\r\n{\r\n forall s0:Seq, s1:Seq\r\n ensures Seq_Length(Seq_Append(s0, s1)) == Seq_Length(s0) + Seq_Length(s1);\r\n {\r\n Seq_Append_LengthRec(s0, s1);\r\n }\r\n}\r\n\r\nghost method Seq_Index_Singleton()\r\n ensures forall a:A {:trigger Seq_Index(Seq_Singleton(a), 0)}::Seq_Index(Seq_Singleton(a), 0) == a;\r\n{\r\n reveal_Seq_Singleton(){:typearg \"A\"};\r\n reveal_Seq_Index(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n}\r\n\r\nghost method Seq_Append_IndexRec(s0:Seq, s1:Seq, n:int)\r\n ensures n < Seq_Length(s0) ==> Seq_Index(Seq_Append(s0, s1), n) == Seq_Index(s0, n);\r\n ensures Seq_Length(s0) <= n ==> Seq_Index(Seq_Append(s0, s1), n) == Seq_Index(s1, n - Seq_Length(s0));\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Index(){:typearg \"A\"};\r\n reveal_Seq_Append(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s0.Seq_Cons?)\r\n {\r\n Seq_Seq(s0);\r\n Seq_Append_IndexRec(s0.tl, s1, n - 1);\r\n }\r\n if (n < 0)\r\n {\r\n Seq_Index_Negative(Seq_Append(s0, s1), n);\r\n }\r\n}\r\n\r\nghost method Seq_Append_Index()\r\n ensures forall s0:Seq, s1:Seq, n:int {:trigger Seq_Index(Seq_Append(s0, s1), n)}::\r\n (n < Seq_Length(s0) ==> Seq_Index(Seq_Append(s0, s1), n) == Seq_Index(s0, n))\r\n && (Seq_Length(s0) <= n ==> Seq_Index(Seq_Append(s0, s1), n) == Seq_Index(s1, INTERNAL_sub_raw(n, Seq_Length(s0))));\r\n{\r\n forall s0:Seq, s1:Seq, n:int\r\n ensures (n < Seq_Length(s0) ==> Seq_Index(Seq_Append(s0, s1), n) == Seq_Index(s0, n))\r\n && (Seq_Length(s0) <= n ==> Seq_Index(Seq_Append(s0, s1), n) == Seq_Index(s1, n - Seq_Length(s0)));\r\n {\r\n Seq_Append_IndexRec(s0, s1, n);\r\n }\r\n}\r\n\r\nghost method Seq_Update_LengthRec(s:Seq, k:int, a:A)\r\n ensures 0 <= k && k < Seq_Length(s) ==> Seq_Length(Seq_Update(s, k, a)) == Seq_Length(s);\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Update(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s.Seq_Cons?)\r\n {\r\n Seq_Seq(s);\r\n Seq_Update_LengthRec(s.tl, k - 1, a);\r\n }\r\n}\r\n\r\nghost method Seq_Update_Length()\r\n ensures forall s:Seq, k:int, a:A {:trigger Seq_Length(Seq_Update(s, k, a))}::\r\n 0 <= k && k < Seq_Length(s) ==> Seq_Length(Seq_Update(s, k, a)) == Seq_Length(s);\r\n{\r\n forall s:Seq, k:int, a:A\r\n ensures 0 <= k && k < Seq_Length(s) ==> Seq_Length(Seq_Update(s, k, a)) == Seq_Length(s);\r\n {\r\n Seq_Update_LengthRec(s, k, a);\r\n }\r\n}\r\n\r\nghost method Seq_Index_UpdateRec(s:Seq, k:int, a:A, n:int)\r\n ensures 0 <= n && n < Seq_Length(s) ==>\r\n (k == n ==> Seq_Index(Seq_Update(s, k, a), n) == a)\r\n && (k != n ==> Seq_Index(Seq_Update(s, k, a), n) == Seq_Index(s, n));\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Singleton(){:typearg \"A\"};\r\n reveal_Seq_Build(){:typearg \"A\"};\r\n reveal_Seq_Index(){:typearg \"A\"};\r\n reveal_Seq_Update(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s.Seq_Cons?)\r\n {\r\n Seq_Seq(s);\r\n Seq_Index_UpdateRec(s.tl, k - 1, a, n - 1);\r\n }\r\n}\r\n\r\nghost method Seq_Index_Update()\r\n ensures (forall s:Seq, k:int, a:A, n:int {:trigger Seq_Index(Seq_Update(s, k, a), n)}::\r\n 0 <= n && n < Seq_Length(s) ==>\r\n (k == n ==> Seq_Index(Seq_Update(s, k, a), n) == a)\r\n && (k != n ==> Seq_Index(Seq_Update(s, k, a), n) == Seq_Index(s, n)));\r\n{\r\n forall s:Seq, k:int, a:A, n:int\r\n ensures 0 <= n && n < Seq_Length(s) ==>\r\n (k == n ==> Seq_Index(Seq_Update(s, k, a), n) == a)\r\n && (k != n ==> Seq_Index(Seq_Update(s, k, a), n) == Seq_Index(s, n));\r\n {\r\n Seq_Index_UpdateRec(s, k, a, n);\r\n }\r\n}\r\n\r\nfunction{:private} Seq_Equal_Trigger(i:int):bool { true }\r\n\r\nghost method Seq_Equal_EquivRec(s0:Seq, s1:Seq, n:int)\r\n requires Seq_Length(s0) == Seq_Length(s1);\r\n requires (forall i:int::Seq_Equal_Trigger(i) && n <= i < n + Seq_Length(s0) ==> Seq_Index(s0, i - n) == Seq_Index(s1, i - n));\r\n ensures s0 == s1;\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Index(){:typearg \"A\"};\r\n Seq_Empty_FromZero();\r\n Seq_Cons_All();\r\n if (s0.Seq_Cons? && s1.Seq_Cons?)\r\n {\r\n Seq_Seq(s0);\r\n Seq_Seq(s1);\r\n Seq_Equal_EquivRec(s0.tl, s1.tl, n + 1);\r\n assert Seq_Equal_Trigger(n);\r\n }\r\n}\r\n\r\nghost method{:loop_lemma} Seq_Equal_Equiv()\r\n ensures (forall s0:Seq, s1:Seq {:trigger Seq_Equal(s0, s1)}::Seq_Equal(s0, s1) ==> s0 == s1);\r\n ensures (forall s0:Seq, s1:Seq {:trigger Seq_Equal(s0, s1)}::\r\n Seq_Equal(s0, s1) <==>\r\n Seq_Length(s0) == Seq_Length(s1)\r\n && (forall i:int {:trigger Seq_Index(s0, i)}{:trigger Seq_Index(s1, i)}::\r\n 0 <= i && i < Seq_Length(s0) ==> Seq_Index(s0, i) == Seq_Index(s1, i)));\r\n{\r\n forall s0:Seq, s1:Seq\r\n ensures Seq_Equal(s0, s1) <==>\r\n Seq_Length(s0) == Seq_Length(s1)\r\n && (forall i:int::0 <= i && i < Seq_Length(s0) ==> Seq_Index(s0, i) == Seq_Index(s1, i));\r\n {\r\n if ( Seq_Length(s0) == Seq_Length(s1)\r\n && (forall i:int::0 <= i && i < Seq_Length(s0) ==> Seq_Index(s0, i) == Seq_Index(s1, i)))\r\n {\r\n Seq_Equal_EquivRec(s0, s1, 0);\r\n }\r\n }\r\n}\r\n\r\nghost method Seq_Take_LengthRec(s:Seq, n:int)\r\n ensures 0 <= n ==>\r\n (n <= Seq_Length(s) ==> Seq_Length(Seq_Take(s, n)) == n)\r\n && (Seq_Length(s) < n ==> Seq_Length(Seq_Take(s, n)) == Seq_Length(s));\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Take(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s.Seq_Cons?)\r\n {\r\n Seq_Seq(s);\r\n Seq_Take_LengthRec(s.tl, n - 1);\r\n }\r\n}\r\n\r\nghost method Seq_Take_Length()\r\n ensures forall s:Seq, n:int {:trigger Seq_Length(Seq_Take(s, n))}::0 <= n ==>\r\n (n <= Seq_Length(s) ==> Seq_Length(Seq_Take(s, n)) == n)\r\n && (Seq_Length(s) < n ==> Seq_Length(Seq_Take(s, n)) == Seq_Length(s));\r\n{\r\n forall s:Seq, n:int\r\n ensures 0 <= n ==>\r\n (n <= Seq_Length(s) ==> Seq_Length(Seq_Take(s, n)) == n)\r\n && (Seq_Length(s) < n ==> Seq_Length(Seq_Take(s, n)) == Seq_Length(s));\r\n {\r\n Seq_Take_LengthRec(s, n);\r\n }\r\n}\r\n\r\nghost method Seq_Take_IndexRec(s:Seq, n:int, i:int)\r\n ensures 0 <= i < n && i < Seq_Length(s) ==> Seq_Index(Seq_Take(s, n), i) == Seq_Index(s, i);\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Index(){:typearg \"A\"};\r\n reveal_Seq_Take(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s.Seq_Cons?)\r\n {\r\n Seq_Seq(s);\r\n Seq_Take_IndexRec(s.tl, n - 1, i - 1);\r\n }\r\n}\r\n\r\nghost method Seq_Take_Index()\r\n ensures forall s:Seq, n:int, i:int {:trigger Seq_Index(Seq_Take(s, n), i)}::\r\n 0 <= i < n && i < Seq_Length(s) ==> Seq_Index(Seq_Take(s, n), i) == Seq_Index(s, i);\r\n{\r\n forall s:Seq, n:int, i:int\r\n ensures 0 <= i < n && i < Seq_Length(s) ==> Seq_Index(Seq_Take(s, n), i) == Seq_Index(s, i);\r\n {\r\n Seq_Take_IndexRec(s, n, i);\r\n }\r\n}\r\n\r\nghost method Seq_Drop_LengthRec(s:Seq, n:int)\r\n ensures 0 <= n ==>\r\n (n <= Seq_Length(s) ==> Seq_Length(Seq_Drop(s, n)) == Seq_Length(s) - n)\r\n && (Seq_Length(s) < n ==> Seq_Length(Seq_Drop(s, n)) == 0);\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Drop(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s.Seq_Cons?)\r\n {\r\n Seq_Seq(s);\r\n Seq_Drop_LengthRec(s.tl, n - 1);\r\n }\r\n}\r\n\r\nghost method Seq_Drop_Length()\r\n ensures (forall s:Seq, n:int {:trigger Seq_Length(Seq_Drop(s, n))}::0 <= n ==>\r\n (n <= Seq_Length(s) ==> Seq_Length(Seq_Drop(s, n)) == INTERNAL_sub_raw(Seq_Length(s), n))\r\n && (Seq_Length(s) < n ==> Seq_Length(Seq_Drop(s, n)) == 0));\r\n{\r\n forall s:Seq, n:int\r\n ensures 0 <= n ==>\r\n (n <= Seq_Length(s) ==> Seq_Length(Seq_Drop(s, n)) == Seq_Length(s) - n)\r\n && (Seq_Length(s) < n ==> Seq_Length(Seq_Drop(s, n)) == 0);\r\n {\r\n Seq_Drop_LengthRec(s, n);\r\n }\r\n}\r\n\r\nghost method Seq_Drop_IndexRec(s:Seq, n:int, i:int)\r\n ensures 0 <= n && 0 <= i ==> Seq_Index(Seq_Drop(s, n), i) == Seq_Index(s, i + n);\r\n{\r\n reveal_Seq_Index(){:typearg \"A\"};\r\n reveal_Seq_Drop(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s.Seq_Cons?)\r\n {\r\n Seq_Seq(s);\r\n Seq_Drop_IndexRec(s.tl, n - 1, i);\r\n }\r\n}\r\n\r\nghost method Seq_Drop_Index()\r\n ensures forall s:Seq, n:int, i:int {:trigger Seq_Index(Seq_Drop(s, n), i)}::\r\n 0 <= n && 0 <= i && i < Seq_Length(s) - n ==> Seq_Index(Seq_Drop(s, n), i) == Seq_Index(s, INTERNAL_add_raw(i, n));\r\n{\r\n forall s:Seq, n:int, i:int\r\n ensures 0 <= n && 0 <= i && i < Seq_Length(s) - n ==> Seq_Index(Seq_Drop(s, n), i) == Seq_Index(s, i + n);\r\n {\r\n Seq_Drop_IndexRec(s, n, i);\r\n }\r\n}\r\n\r\nfunction{:private} Seq_FromArrayRange(a:INTERNAL_ArrayElems, j:int, k:int):Seq\r\n decreases k - j;\r\n{\r\n if j < k then Seq_Cons(INTERNAL_array_elems_index(a, j), Seq_FromArrayRange(a, j + 1, k)) else Seq_Nil()\r\n}\r\n\r\nfunction{:private}{:opaque} Seq_FromArrayElems(a:INTERNAL_ArrayElems, len:int):Seq\r\n{\r\n Seq_FromArrayRange(a, 0, len)\r\n}\r\n\r\n//- declared public so that old(a[..]) == a[..] is more evident across calls that don't modify a\r\nfunction Seq_FromArray(a:array):Seq\r\n{\r\n Seq_FromArrayElems(INTERNAL_array_elems(a), a.Length)\r\n}\r\n\r\nfunction{:private} Seq_FromArrayRange_INTERNAL_HEAP(heap:INTERNAL_AbsMem, a:array, j:int, k:int):Seq\r\nfunction{:private} Seq_FromArray_INTERNAL_HEAP(heap:INTERNAL_AbsMem, a:array):Seq\r\n\r\nghost method Seq_FromArray_LengthRec(a:INTERNAL_ArrayElems, j:int, k:int)\r\n ensures Seq_Length(Seq_FromArrayRange(a, j, k)) == if j <= k then k - j else 0;\r\n decreases k - j;\r\n{\r\n reveal_Seq_Length(){:typearg \"int\"};\r\n Seq_Cons_All();\r\n if (j < k)\r\n {\r\n Seq_FromArray_LengthRec(a, j + 1, k);\r\n }\r\n}\r\n\r\n\r\nghost method Seq_FromArray_Length()\r\n ensures forall INTERNAL_absMem:INTERNAL_AbsMem, a:array {:trigger Seq_Length(Seq_FromArray(a))}::\r\n a.Length >= 0 ==> Seq_Length(Seq_FromArray(a)) == a.Length;\r\n ensures forall INTERNAL_absMem:INTERNAL_AbsMem, a:array {:trigger Seq_Length(Seq_FromArray(a))}::\r\n Seq_Length(Seq_FromArray(a)) > 0 ==> Seq_Length(Seq_FromArray(a)) == a.Length;\r\n{\r\n reveal_Seq_FromArrayElems();\r\n forall INTERNAL_absMem:INTERNAL_AbsMem, a:array\r\n ensures a.Length >= 0 ==> Seq_Length(Seq_FromArray(a)) == a.Length;\r\n ensures Seq_Length(Seq_FromArray(a)) > 0 ==> Seq_Length(Seq_FromArray(a)) == a.Length;\r\n {\r\n Seq_FromArray_LengthRec(INTERNAL_array_elems(a), 0, a.Length);\r\n }\r\n}\r\n\r\nghost method Seq_FromArray_IndexRec(a:INTERNAL_ArrayElems, i:int, j:int, k:int)\r\n ensures 0 <= j <= i < k ==> Seq_Index(Seq_FromArrayRange(a, j, k), i - j)\r\n == INTERNAL_array_elems_index(a, i);\r\n decreases i - j;\r\n{\r\n reveal_Seq_Length(){:typearg \"int\"};\r\n reveal_Seq_Index(){:typearg \"int\"};\r\n Seq_Cons_All();\r\n if (j < i)\r\n {\r\n Seq_FromArray_IndexRec(a, i, j + 1, k);\r\n }\r\n}\r\n\r\nghost method Seq_FromArray_Index()\r\n ensures forall INTERNAL_absMem:INTERNAL_AbsMem, a:array, i:int\r\n {:trigger Seq_Index(Seq_FromArray(a), i)}\r\n {:trigger Seq_FromArray(a), a[i]}::\r\n 0 <= i < Seq_Length(Seq_FromArray(a)) ==> Seq_Index(Seq_FromArray(a), i) == a[i];\r\n{\r\n reveal_Seq_FromArrayElems();\r\n forall INTERNAL_absMem:INTERNAL_AbsMem, a:array, i:int\r\n ensures 0 <= i < Seq_Length(Seq_FromArray(a)) ==> Seq_Index(Seq_FromArray(a), i) == a[i];\r\n {\r\n if (0 <= i < Seq_Length(Seq_FromArray(a)))\r\n {\r\n Seq_FromArray_LengthRec(INTERNAL_array_elems(a), 0, a.Length);\r\n Seq_FromArray_IndexRec(INTERNAL_array_elems(a), i, 0, a.Length);\r\n }\r\n }\r\n}\r\n\r\nghost method Seq_FromArray_UpdateRec(a:INTERNAL_ArrayElems, i:int, v:int, j:int, k:int)\r\n ensures 0 <= j <= i < k ==>\r\n Seq_FromArrayRange(INTERNAL_array_elems_update(a, i, v), j, k)\r\n == Seq_Update(Seq_FromArrayRange(a, j, k), i - j, v);\r\n ensures i < j <= k ==>\r\n Seq_FromArrayRange(INTERNAL_array_elems_update(a, i, v), j, k)\r\n == Seq_FromArrayRange(a, j, k);\r\n decreases k - j;\r\n{\r\n reveal_Seq_Update(){:typearg \"int\"};\r\n if (j < k)\r\n {\r\n Seq_FromArray_UpdateRec(a, i, v, j + 1, k);\r\n Seq_Cons_All();\r\n }\r\n}\r\n\r\nghost method Seq_FromArray_Update()\r\n ensures forall INTERNAL_absMem:INTERNAL_AbsMem, a:array, i:int, v:int\r\n {:trigger Seq_FromArray_INTERNAL_HEAP(INTERNAL_array_update(a, i, v), a)}::\r\n 0 <= i < a.Length ==>\r\n Seq_FromArray_INTERNAL_HEAP(INTERNAL_array_update(a, i, v), a)\r\n == Seq_Update(Seq_FromArray(a), i, v);\r\n{\r\n reveal_Seq_FromArrayElems();\r\n forall INTERNAL_absMem:INTERNAL_AbsMem, a:array, i:int, v:int\r\n ensures 0 <= i < a.Length ==>\r\n Seq_FromArray_INTERNAL_HEAP(INTERNAL_array_update(a, i, v), a)\r\n == Seq_Update(Seq_FromArray(a), i, v);\r\n {\r\n if (0 <= i < a.Length)\r\n {\r\n Seq_FromArray_UpdateRec(INTERNAL_array_elems(a), i, v, 0, a.Length);\r\n }\r\n }\r\n}\r\n\r\n/*\r\naxiom (forall h: HeapType, o: ref, f: Field alpha, v: alpha, a: ref ::\r\n { Seq#FromArray(update(h, o, f, v), a) }\r\n o != a ==> Seq#FromArray(update(h, o, f, v), a) == Seq#FromArray(h, a) );\r\n*/\r\n\r\n\r\nghost method Seq_Append_TakeDropRec(s0:Seq, s1:Seq)\r\n ensures Seq_Take(Seq_Append(s0, s1), Seq_Length(s0)) == s0;\r\n ensures Seq_Drop(Seq_Append(s0, s1), Seq_Length(s0)) == s1;\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Append(){:typearg \"A\"};\r\n reveal_Seq_Take(){:typearg \"A\"};\r\n reveal_Seq_Drop(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s0.Seq_Cons?)\r\n {\r\n Seq_Seq(s0);\r\n Seq_Append_TakeDropRec(s0.tl, s1);\r\n }\r\n}\r\n\r\nghost method Seq_Append_TakeDrop()\r\n ensures forall s0:Seq, s1:Seq\r\n {:trigger Seq_Append(s0, s1)}:: //- default Dafny trigger\r\n//\r\n\r\n\r\n\r\n Seq_Take(Seq_Append(s0, s1), Seq_Length(s0)) == s0\r\n && Seq_Drop(Seq_Append(s0, s1), Seq_Length(s0)) == s1;\r\n{\r\n forall s0:Seq, s1:Seq\r\n ensures Seq_Take(Seq_Append(s0, s1), Seq_Length(s0)) == s0\r\n && Seq_Drop(Seq_Append(s0, s1), Seq_Length(s0)) == s1;\r\n {\r\n Seq_Append_TakeDropRec(s0, s1);\r\n }\r\n}\r\n\r\nghost method Seq_Append_TakeDrop_Restricted()\r\n ensures forall s0:Seq, s1:Seq\r\n\r\n//- [ckh] The default Dafny trigger is very liberal here, but I've seen some slow performance and timeouts, so I made it more restrictive\r\n {:trigger Seq_Take(Seq_Append(s0, s1), Seq_Length(s0))}\r\n {:trigger Seq_Drop(Seq_Append(s0, s1), Seq_Length(s0))}\r\n ::\r\n Seq_Take(Seq_Append(s0, s1), Seq_Length(s0)) == s0\r\n && Seq_Drop(Seq_Append(s0, s1), Seq_Length(s0)) == s1;\r\n{\r\n forall s0:Seq, s1:Seq\r\n ensures Seq_Take(Seq_Append(s0, s1), Seq_Length(s0)) == s0\r\n && Seq_Drop(Seq_Append(s0, s1), Seq_Length(s0)) == s1;\r\n {\r\n Seq_Append_TakeDropRec(s0, s1);\r\n }\r\n}\r\n\r\nghost method Seq_Update_CommuteTake1Rec(s:Seq, i:int, a:A, n:int)\r\n ensures 0 <= i && i < n && n <= Seq_Length(s) ==> Seq_Take(Seq_Update(s, i, a), n) == Seq_Update(Seq_Take(s, n), i, a);\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Update(){:typearg \"A\"};\r\n reveal_Seq_Take(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s.Seq_Cons?)\r\n {\r\n Seq_Seq(s);\r\n Seq_Update_CommuteTake1Rec(s.tl, i - 1, a, n - 1);\r\n }\r\n}\r\n\r\nghost method Seq_Update_CommuteTake1()\r\n ensures forall s:Seq, i:int, a:A, n:int {:trigger Seq_Take(Seq_Update(s, i, a), n)}::\r\n 0 <= i && i < n && n <= Seq_Length(s) ==> Seq_Take(Seq_Update(s, i, a), n) == Seq_Update(Seq_Take(s, n), i, a);\r\n{\r\n forall s:Seq, i:int, a:A, n:int\r\n ensures 0 <= i && i < n && n <= Seq_Length(s) ==> Seq_Take(Seq_Update(s, i, a), n) == Seq_Update(Seq_Take(s, n), i, a);\r\n {\r\n Seq_Update_CommuteTake1Rec(s, i, a, n);\r\n }\r\n}\r\n\r\nghost method Seq_Update_CommuteTake2Rec(s:Seq, i:int, a:A, n:int)\r\n ensures n <= i && i < Seq_Length(s) ==> Seq_Take(Seq_Update(s, i, a), n) == Seq_Take(s, n);\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Update(){:typearg \"A\"};\r\n reveal_Seq_Take(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s.Seq_Cons?)\r\n {\r\n Seq_Seq(s);\r\n Seq_Update_CommuteTake2Rec(s.tl, i - 1, a, n - 1);\r\n }\r\n}\r\n\r\nghost method Seq_Update_CommuteTake2()\r\n ensures forall s:Seq, i:int, a:A, n:int {:trigger Seq_Take(Seq_Update(s, i, a), n)}::\r\n n <= i && i < Seq_Length(s) ==> Seq_Take(Seq_Update(s, i, a), n) == Seq_Take(s, n);\r\n{\r\n forall s:Seq, i:int, a:A, n:int\r\n ensures n <= i && i < Seq_Length(s) ==> Seq_Take(Seq_Update(s, i, a), n) == Seq_Take(s, n);\r\n {\r\n Seq_Update_CommuteTake2Rec(s, i, a, n);\r\n }\r\n}\r\n\r\nghost method Seq_Update_CommuteDrop1Rec(s:Seq, i:int, a:A, n:int)\r\n ensures 0 <= n && n < i && i <= Seq_Length(s) ==> Seq_Drop(Seq_Update(s, i, a), n) == Seq_Update(Seq_Drop(s, n), i - n, a);\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Update(){:typearg \"A\"};\r\n reveal_Seq_Drop(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s.Seq_Cons?)\r\n {\r\n Seq_Seq(s);\r\n Seq_Update_CommuteDrop1Rec(s.tl, i - 1, a, n - 1);\r\n }\r\n}\r\n\r\nghost method Seq_Update_CommuteDrop1()\r\n ensures forall s:Seq, i:int, a:A, n:int {:trigger Seq_Drop(Seq_Update(s, i, a), n)}::\r\n 0 <= n && n < i && i <= Seq_Length(s) ==> Seq_Drop(Seq_Update(s, i, a), n) == Seq_Update(Seq_Drop(s, n), i - n, a);\r\n{\r\n forall s:Seq, i:int, a:A, n:int\r\n ensures 0 <= n && n < i && i <= Seq_Length(s) ==> Seq_Drop(Seq_Update(s, i, a), n) == Seq_Update(Seq_Drop(s, n), i - n, a);\r\n {\r\n Seq_Update_CommuteDrop1Rec(s, i, a, n);\r\n }\r\n}\r\n\r\nghost method Seq_Update_CommuteDrop2Rec(s:Seq, i:int, a:A, n:int)\r\n ensures 0 <= i && i < n && n < Seq_Length(s) ==> Seq_Drop(Seq_Update(s, i, a), n) == Seq_Drop(s, n);\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Update(){:typearg \"A\"};\r\n reveal_Seq_Drop(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s.Seq_Cons?)\r\n {\r\n Seq_Seq(s);\r\n Seq_Update_CommuteDrop2Rec(s.tl, i - 1, a, n - 1);\r\n }\r\n}\r\n\r\nghost method Seq_Update_CommuteDrop2()\r\n ensures forall s:Seq, i:int, a:A, n:int {:trigger Seq_Drop(Seq_Update(s, i, a), n)}::\r\n 0 <= i && i < n && n < Seq_Length(s) ==> Seq_Drop(Seq_Update(s, i, a), n) == Seq_Drop(s, n);\r\n{\r\n forall s:Seq, i:int, a:A, n:int\r\n ensures 0 <= i && i < n && n < Seq_Length(s) ==> Seq_Drop(Seq_Update(s, i, a), n) == Seq_Drop(s, n);\r\n {\r\n Seq_Update_CommuteDrop2Rec(s, i, a, n);\r\n }\r\n}\r\n\r\nghost method Seq_Build_CommuteDropRec(s:Seq, a:A, n:int)\r\n ensures 0 <= n && n <= Seq_Length(s) ==> Seq_Drop(Seq_Build(s, a), n) == Seq_Build(Seq_Drop(s, n), a);\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Singleton(){:typearg \"A\"};\r\n reveal_Seq_Build(){:typearg \"A\"};\r\n reveal_Seq_Drop(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n if (s.Seq_Cons?)\r\n {\r\n Seq_Seq(s);\r\n Seq_Build_CommuteDropRec(s.tl, a, n - 1);\r\n }\r\n}\r\n\r\nghost method Seq_Build_CommuteDrop()\r\n ensures forall s:Seq, a:A, n:int {:trigger Seq_Drop(Seq_Build(s, a), n)}::\r\n 0 <= n && n <= Seq_Length(s) ==> Seq_Drop(Seq_Build(s, a), n) == Seq_Build(Seq_Drop(s, n), a);\r\n{\r\n forall s:Seq, a:A, n:int\r\n ensures 0 <= n && n <= Seq_Length(s) ==> Seq_Drop(Seq_Build(s, a), n) == Seq_Build(Seq_Drop(s, n), a);\r\n {\r\n Seq_Build_CommuteDropRec(s, a, n);\r\n }\r\n}\r\n\r\nghost method Seq_Take_Empty()\r\n ensures Seq_Take(Seq_Empty(), 0) == Seq_Empty();\r\n{\r\n reveal_Seq_Take(){:typearg \"A\"};\r\n}\r\n\r\nghost method Seq_Drop_Empty()\r\n ensures Seq_Drop(Seq_Empty(), 0) == Seq_Empty();\r\n{\r\n reveal_Seq_Drop(){:typearg \"A\"};\r\n}\r\n\r\nghost method lemma_Seq_Case(s:Seq)\r\n ensures s.Seq_Cons? <==> Seq_Length(s) > 0;\r\n ensures s.Seq_Cons? <==> !s.Seq_Nil?;\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n Seq_Seq(s);\r\n}\r\n\r\nghost method lemma_Seq_Cons(a:A, s:Seq)\r\n ensures Seq_Equal(Seq_Cons(a, s), Seq_Append(Seq_Build(Seq_Empty(), a), s));\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Build(){:typearg \"A\"};\r\n reveal_Seq_Singleton(){:typearg \"A\"};\r\n reveal_Seq_Append(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n Seq_Seq(Seq_Nil());\r\n Seq_Seq(s);\r\n}\r\n\r\nghost method lemma_Seq_Head(s:Seq)\r\n ensures Seq_Length(s) > 0 ==> s.hd == Seq_Index(s, 0);\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Index(){:typearg \"A\"};\r\n}\r\n\r\nghost method lemma_Seq_Tail(s:Seq)\r\n ensures Seq_Length(s) > 0 ==> Seq_Equal(s.tl, Seq_Drop(s, 1));\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n reveal_Seq_Drop(){:typearg \"A\"};\r\n lemma_Seq_Case(s);\r\n Seq_Seq(s);\r\n}\r\n\r\nmethod seq_Length(s:Seq) returns(n:int)\r\n ensures n == Seq_Length(s);\r\n{\r\n reveal_Seq_Length(){:typearg \"A\"};\r\n Seq_Cons_All();\r\n n := 0;\r\n var iter := s;\r\n while (iter.Seq_Cons?)\r\n decreases Seq_Length(iter);\r\n invariant n + Seq_Length(iter) == Seq_Length(s);\r\n {\r\n Seq_Seq(iter);\r\n iter := iter.tl;\r\n n := n + 1;\r\n }\r\n}\r\n\r\nmethod seq_Empty() returns(s:Seq)\r\n ensures s == Seq_Empty();\r\n{\r\n Seq_Cons_All();\r\n s := Seq_Nil();\r\n}\r\n\r\nmethod seq_Build(s:Seq, a:A) returns(r:Seq)\r\n ensures Seq_Equal(r, Seq_Build(s, a));\r\n{\r\n lemma_Seq_Cons(a, Seq_Nil());\r\n r := seq_Append(s, Seq_Cons(a, Seq_Nil()));\r\n}\r\n\r\nmethod seq_Index(s:Seq, k:int) returns(a:A)\r\n requires 0 <= k < Seq_Length(s);\r\n ensures a == Seq_Index(s, k);\r\n{\r\n Seq_Cons_All();\r\n var iter := s;\r\n var j := k;\r\n while (j != 0)\r\n decreases j;\r\n invariant 0 <= j < Seq_Length(iter);\r\n invariant Seq_Index(iter, j) == Seq_Index(s, k);\r\n {\r\n j := j - 1;\r\n lemma_Seq_Tail(iter);\r\n iter := iter.tl;\r\n }\r\n lemma_Seq_Head(iter);\r\n a := iter.hd;\r\n}\r\n\r\nmethod seq_Append0(s0:Seq) returns(rev0:Seq)\r\n ensures Seq_Length(rev0) == Seq_Length(s0);\r\n ensures forall i {:trigger Seq_Index(rev0, i)}::0 <= i < Seq_Length(rev0) ==> Seq_Index(rev0, i) == Seq_Index(s0, Seq_Length(rev0) - i - 1);\r\n{\r\n rev0 := Seq_Nil();\r\n var iter := s0;\r\n reveal_Seq_Drop(){:typearg \"A\"};\r\n while (iter.Seq_Cons?)\r\n decreases Seq_Length(iter);\r\n invariant Seq_Length(rev0) + Seq_Length(iter) == Seq_Length(s0);\r\n invariant forall i::0 <= i < Seq_Length(rev0) ==> Seq_Index(rev0, i) == Seq_Index(s0, Seq_Length(rev0) - i - 1);\r\n invariant Seq_Equal(iter, Seq_Drop(s0, Seq_Length(s0) - Seq_Length(iter)));\r\n {\r\n lemma_Seq_Case(iter);\r\n lemma_Seq_Head(iter);\r\n lemma_Seq_Tail(iter);\r\n lemma_Seq_Cons(iter.hd, rev0);\r\n rev0 := Seq_Cons(iter.hd, rev0);\r\n iter := iter.tl;\r\n }\r\n lemma_Seq_Case(iter);\r\n}\r\n\r\nghost method lemma_Seq_Length(s:Seq)\r\n ensures Seq_Length(s) >= 0;\r\n{\r\n}\r\n\r\nmethod{:dafnycc_no_lemmas} seq_Append(s0:Seq, s1:Seq) returns(s:Seq)\r\n ensures Seq_Equal(s, Seq_Append(s0, s1));\r\n{\r\n assert unroll(0);\r\n assert unroll(1);\r\n lemma_Seq_Length(s0);\r\n lemma_Seq_Length(s1);\r\n\r\n var rev0 := seq_Append0(s0);\r\n s := s1;\r\n var iter := rev0;\r\n calc\r\n {\r\n Seq_Equal(s, Seq_Append(Seq_Drop(s0, Seq_Length(iter)), s1));\r\n { Seq_Drop_LengthRec(s0, Seq_Length(iter)); }\r\n { Seq_Empty_FromZero(); }\r\n Seq_Equal(s, Seq_Append(Seq_Empty(), s1));\r\n Seq_Equal(s, Seq_Append(Seq_Nil(), s1));\r\n { Seq_Seq(Seq_Nil()); }\r\n { reveal_Seq_Append(){:typearg \"A\"}; }\r\n Seq_Equal(s, s1);\r\n { Seq_Equal_Equiv(); }\r\n true;\r\n }\r\n while (iter.Seq_Cons?)\r\n decreases Seq_Length(iter);\r\n invariant Seq_Length(s) + Seq_Length(iter) == Seq_Length(s0) + Seq_Length(s1);\r\n invariant forall i::0 <= i < Seq_Length(iter) ==> Seq_Index(iter, i) == Seq_Index(s0, Seq_Length(iter) - i - 1);\r\n invariant Seq_Equal(s, Seq_Append(Seq_Drop(s0, Seq_Length(iter)), s1));\r\n {\r\n lemma_Seq_Case(iter);\r\n lemma_Seq_Head(iter);\r\n lemma_Seq_Tail(iter);\r\n lemma_Seq_Cons(iter.hd, s);\r\n s := Seq_Cons(iter.hd, s);\r\n iter := iter.tl;\r\n Seq_Empty_ToZero();\r\n Seq_Empty_FromZero();\r\n Seq_Build_Length();\r\n Seq_Build_Index();\r\n Seq_Append_Length();\r\n Seq_Append_Index();\r\n Seq_Equal_Equiv();\r\n Seq_Drop_Length();\r\n Seq_Drop_Index();\r\n }\r\n calc\r\n {\r\n Seq_Equal(s, Seq_Append(Seq_Drop(s0, Seq_Length(iter)), s1));\r\n { lemma_Seq_Length(iter); }\r\n { lemma_Seq_Case(iter); }\r\n Seq_Equal(s, Seq_Append(Seq_Drop(s0, 0), s1));\r\n { Seq_Drop_LengthRec(s0, 0); }\r\n { Seq_Drop_Index(); }\r\n { Seq_Equal_EquivRec(s0, Seq_Drop(s0, 0), 0); }\r\n Seq_Equal(s, Seq_Append(s0, s1));\r\n }\r\n}\r\n\r\nmethod seq_Update(s:Seq, k:int, a:A) returns(r:Seq)\r\n requires 0 <= k < Seq_Length(s);\r\n ensures Seq_Equal(r, Seq_Update(s, k, a));\r\n{\r\n Seq_Cons_All();\r\n var iter := s;\r\n var j := k;\r\n var rev0 := Seq_Nil();\r\n while (j != 0)\r\n decreases j;\r\n invariant 0 <= j;\r\n invariant k == j + Seq_Length(rev0);\r\n invariant Seq_Length(rev0) + Seq_Length(iter) == Seq_Length(s);\r\n invariant forall i {:trigger Seq_Index(rev0, i)}::0 <= i < Seq_Length(rev0) ==> Seq_Index(rev0, i) == Seq_Index(s, Seq_Length(rev0) - i - 1);\r\n invariant Seq_Equal(iter, Seq_Drop(s, Seq_Length(s) - Seq_Length(iter)));\r\n {\r\n lemma_Seq_Head(iter);\r\n lemma_Seq_Tail(iter);\r\n lemma_Seq_Cons(iter.hd, rev0);\r\n j := j - 1;\r\n rev0 := Seq_Cons(iter.hd, rev0);\r\n iter := iter.tl;\r\n }\r\n lemma_Seq_Tail(iter);\r\n r := iter.tl;\r\n lemma_Seq_Cons(a, r);\r\n r := Seq_Cons(a, r);\r\n iter := rev0;\r\n while (iter.Seq_Cons?)\r\n decreases Seq_Length(iter);\r\n invariant Seq_Length(r) + Seq_Length(iter) == Seq_Length(s);\r\n invariant forall i {:trigger Seq_Index(iter, i)}::0 <= i < Seq_Length(iter) ==> Seq_Index(iter, i) == Seq_Index(s, Seq_Length(iter) - i - 1);\r\n \r\n invariant Seq_Equal(r,\r\n Seq_Append(Seq_Drop(Seq_Take(s, k), Seq_Length(iter)),\r\n Seq_Append(Seq_Build(Seq_Empty(), a),\r\n Seq_Drop(s, k + 1))));\r\n {\r\n Seq_Seq(iter);\r\n lemma_Seq_Case(iter);\r\n lemma_Seq_Head(iter);\r\n lemma_Seq_Tail(iter);\r\n lemma_Seq_Cons(iter.hd, r);\r\n r := Seq_Cons(iter.hd, r);\r\n iter := iter.tl;\r\n }\r\n lemma_Seq_Case(iter);\r\n}\r\n\r\nmethod seq_Take(s:Seq, k:int) returns(r:Seq)\r\n requires 0 <= k <= Seq_Length(s);\r\n ensures Seq_Equal(r, Seq_Take(s, k));\r\n{\r\n Seq_Cons_All();\r\n var iter := s;\r\n var j := k;\r\n var rev0 := Seq_Nil();\r\n while (j != 0)\r\n decreases j;\r\n invariant 0 <= j;\r\n invariant k == j + Seq_Length(rev0);\r\n invariant Seq_Length(rev0) + Seq_Length(iter) == Seq_Length(s);\r\n invariant forall i {:trigger Seq_Index(rev0, i)}::0 <= i < Seq_Length(rev0) ==> Seq_Index(rev0, i) == Seq_Index(s, Seq_Length(rev0) - i - 1);\r\n invariant Seq_Equal(iter, Seq_Drop(s, Seq_Length(s) - Seq_Length(iter)));\r\n {\r\n lemma_Seq_Head(iter);\r\n lemma_Seq_Tail(iter);\r\n lemma_Seq_Cons(iter.hd, rev0);\r\n j := j - 1;\r\n rev0 := Seq_Cons(iter.hd, rev0);\r\n iter := iter.tl;\r\n }\r\n iter := rev0;\r\n r := Seq_Nil();\r\n while (iter.Seq_Cons?)\r\n decreases Seq_Length(iter);\r\n invariant Seq_Length(r) + Seq_Length(iter) == k;\r\n invariant forall i {:trigger Seq_Index(iter, i)}::0 <= i < Seq_Length(iter) ==> Seq_Index(iter, i) == Seq_Index(s, Seq_Length(iter) - i - 1);\r\n \r\n invariant Seq_Equal(r, Seq_Drop(Seq_Take(s, k), Seq_Length(iter)));\r\n {\r\n Seq_Seq(iter);\r\n lemma_Seq_Case(iter);\r\n lemma_Seq_Head(iter);\r\n lemma_Seq_Tail(iter);\r\n lemma_Seq_Cons(iter.hd, r);\r\n r := Seq_Cons(iter.hd, r);\r\n iter := iter.tl;\r\n }\r\n lemma_Seq_Case(iter);\r\n}\r\n\r\nmethod seq_Drop(s:Seq, k:int) returns(r:Seq)\r\n requires 0 <= k <= Seq_Length(s);\r\n ensures Seq_Equal(r, Seq_Drop(s, k));\r\n{\r\n Seq_Cons_All();\r\n var iter := s;\r\n var j := k;\r\n var rev0 := Seq_Nil();\r\n while (j != 0)\r\n decreases j;\r\n invariant 0 <= j;\r\n invariant k == j + Seq_Length(rev0);\r\n invariant Seq_Length(rev0) + Seq_Length(iter) == Seq_Length(s);\r\n invariant forall i {:trigger Seq_Index(rev0, i)}::0 <= i < Seq_Length(rev0) ==> Seq_Index(rev0, i) == Seq_Index(s, Seq_Length(rev0) - i - 1);\r\n invariant Seq_Equal(iter, Seq_Drop(s, Seq_Length(s) - Seq_Length(iter)));\r\n {\r\n lemma_Seq_Head(iter);\r\n lemma_Seq_Tail(iter);\r\n lemma_Seq_Cons(iter.hd, rev0);\r\n j := j - 1;\r\n rev0 := Seq_Cons(iter.hd, rev0);\r\n iter := iter.tl;\r\n }\r\n r := iter;\r\n}\r\n\r\nmethod seq_TakeDrop(s:Seq, k1:int, k2:int) returns(r:Seq)\r\n requires 0 <= k1 <= k2 <= Seq_Length(s);\r\n ensures Seq_Equal(r, Seq_Drop(Seq_Take(s, k2), k1));\r\n{\r\n r := seq_Drop(s, k1);\r\n r := seq_Take(r, k2 - k1);\r\n}\r\n\r\nmethod seq_Equal(s1:Seq, s2:Seq) returns(b:bool)\r\n ensures b == Seq_Equal(s1, s2);\r\n{\r\n Seq_Cons_All();\r\n var iter1 := s1;\r\n var iter2 := s2;\r\n while (iter1.Seq_Cons? && iter2.Seq_Cons?)\r\n decreases Seq_Length(iter1);\r\n invariant Seq_Length(iter1) <= Seq_Length(s1);\r\n invariant Seq_Length(iter2) <= Seq_Length(s2);\r\n invariant Seq_Equal(Seq_Take(s1, Seq_Length(s1) - Seq_Length(iter1)), Seq_Take(s2, Seq_Length(s2) - Seq_Length(iter2)));\r\n invariant Seq_Equal(iter1, Seq_Drop(s1, Seq_Length(s1) - Seq_Length(iter1)));\r\n invariant Seq_Equal(iter2, Seq_Drop(s2, Seq_Length(s2) - Seq_Length(iter2)));\r\n {\r\n Seq_Seq(iter1);\r\n lemma_Seq_Head(iter1);\r\n lemma_Seq_Tail(iter1);\r\n lemma_Seq_Head(iter2);\r\n lemma_Seq_Tail(iter2);\r\n if (iter1.hd != iter2.hd)\r\n {\r\n b := false;\r\n return;\r\n }\r\n ghost var n1 := Seq_Length(s1) - Seq_Length(iter1);\r\n assert Seq_Equal(\r\n Seq_Append(Seq_Take(s1, n1), Seq_Singleton(Seq_Index(s1, n1))),\r\n Seq_Take(s1, n1 + 1));\r\n ghost var n2 := Seq_Length(s2) - Seq_Length(iter2);\r\n assert Seq_Equal(\r\n Seq_Append(Seq_Take(s2, n2), Seq_Singleton(Seq_Index(s2, n2))),\r\n Seq_Take(s2, n2 + 1));\r\n iter1 := iter1.tl;\r\n iter2 := iter2.tl;\r\n }\r\n if (iter1.Seq_Nil? && iter2.Seq_Nil?)\r\n {\r\n b := true;\r\n assert Seq_Equal(s1, Seq_Take(s1, Seq_Length(s1)));\r\n assert Seq_Equal(s2, Seq_Take(s2, Seq_Length(s2)));\r\n return;\r\n }\r\n b := false;\r\n return;\r\n}\r\n\r\nmethod seq_FromArray(a:array) returns (r:Seq)\r\n ensures Seq_Equal(r, Seq_FromArray(a));\r\n{\r\n Seq_Cons_All();\r\n r := Seq_Nil();\r\n var j := a.Length;\r\n while (j != 0)\r\n invariant 0 <= j <= a.Length;\r\n invariant r == Seq_FromArrayRange(INTERNAL_array_elems(a), j, a.Length);\r\n {\r\n j := j - 1;\r\n r := Seq_Cons(a[j], r);\r\n }\r\n reveal_Seq_FromArrayElems();\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/BitVectorLemmasBase.ifc.beat", "content": "//--private-import BaseSpec;\r\n//--private-import MemorySpec;\r\n//--\r\n//--\r\n//--\r\n//--\r\n//--\r\n//-- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//--\r\n\r\nmodule interface BitVectorLemmasBase\r\n{\r\n\r\nfunction $_Aligned(b:bv32) returns(bool) { $and(b, 3bv32) == 0bv32 }\r\nfunction $_Aligned4k(b:bv32) returns (bool) { $clear_LSBs(12bv32, b) == b }\r\nfunction _bit_index($i:bv32) returns (bool) { $le(0bv32, $i) && $le($i, 31bv32) }\r\nfunction $between(lb:bv32, ub:bv32, val:bv32):bool { $le(lb, val) && $lt(val, ub) }\r\n\r\nfunction $get_bit ($i:bv32, $val:bv32) returns (bool) { $and($val, $shl(1bv32, $i)) != 0bv32 }\r\nfunction $set_bit ($i:bv32, $val:bv32) returns (bv32) { $or($val, $shl(1bv32, $i)) }\r\nfunction $clear_bit($i:bv32, $val:bv32) returns (bv32) { $and($val, $neg($shl(1bv32, $i))) }\r\nfunction $clear_LSBs ($i:bv32, $val:bv32) returns (bv32) { $and($val, $neg($sub($shl(1bv32, $i), 1bv32))) }\r\nfunction $select_LSBs ($i:bv32, $val:bv32) returns (bv32) { $and($val, $sub($shl(1bv32, $i), 1bv32)) }\r\n\r\nfunction $eq ($x:bv32, $y:bv32) returns (bool) { $le($x, $y) && $le($y, $x) }\r\n\r\natomic ghost procedure _const_base();\r\n ensures $sub(1bv32, 1bv32) == 0bv32;\r\n ensures $add(1bv32, 1bv32) == 2bv32;\r\n ensures $add(2bv32, 1bv32) == 3bv32;\r\n ensures $add(2bv32, 2bv32) == 4bv32;\r\n ensures $add(4bv32, 1bv32) == 5bv32;\r\n ensures $add(5bv32, 1bv32) == 6bv32;\r\n ensures $add(5bv32, 2bv32) == 7bv32;\r\n ensures $add(5bv32, 3bv32) == 8bv32;\r\n ensures $add(5bv32, 4bv32) == 9bv32;\r\n ensures $add(5bv32, 5bv32) == 10bv32;\r\n ensures $add(5bv32, 6bv32) == 11bv32;\r\n ensures $add(5bv32, 7bv32) == 12bv32;\r\n ensures $add(5bv32, 8bv32) == 13bv32;\r\n ensures $add(7bv32, 8bv32) == 15bv32;\r\n ensures $mul(4bv32, 4bv32) == 16bv32;\r\n ensures $add(10bv32, 12bv32) == 22bv32;\r\n ensures $add(16bv32, 16bv32) == 32bv32;\r\n ensures $sub(32bv32, 1bv32) == 31bv32;\r\n ensures $add(32bv32, 32bv32) == 64bv32;\r\n ensures $sub(64bv32, 1bv32) == 63bv32;\r\n ensures $mul(32bv32, 4bv32) == 128bv32;\r\n ensures $sub(128bv32, 1bv32) == 127bv32;\r\n ensures $mul(16bv32, 16bv32) == 256bv32;\r\n ensures $sub(256bv32, 1bv32) == 255bv32;\r\n ensures $add(256bv32, 256bv32) == 512bv32;\r\n ensures $sub(1024bv32, 1bv32) == 1023bv32;\r\n ensures $add(512bv32, 512bv32) == 1024bv32;\r\n ensures $mul(64bv32, 64bv32) == 4096bv32;\r\n ensures $sub(4096bv32, 1bv32) == 4095bv32;\r\n ensures $mul(1024bv32, 1024bv32) == 1048576bv32;\r\n ensures $sub(1048576bv32, 1bv32) == 1048575bv32;\r\n ensures $mul(1048575bv32, 4096bv32) == 4294963200bv32;\r\n ensures $mul(1048576bv32, 4bv32) == 4194304bv32;\r\n ensures $mul(256bv32, 256bv32) == 65536bv32;\r\n ensures $sub(65536bv32, 1bv32) == 65535bv32;\r\n ensures $mul(65536bv32, 32bv32) == 2097152bv32;\r\n ensures $sub(2097152bv32, 1bv32) == 2097151bv32;\r\n ensures $mul(65536bv32, 256bv32) == 16777216bv32;\r\n ensures $sub(16777216bv32, 1bv32) == 16777215bv32;\r\n ensures $mul(65536bv32, 512bv32) == 33554432bv32;\r\n ensures $sub(33554432bv32, 1bv32) == 33554431bv32;\r\n ensures $add(33554432bv32, 33554432bv32) == 67108864bv32;\r\n ensures $sub(67108864bv32, 1bv32) == 67108863bv32;\r\n ensures $mul(65536bv32, 65535bv32) == 4294901760bv32;\r\n ensures $add(4294901760bv32, 65535bv32) == 4294967295bv32;\r\n ensures $sub(4294967295bv32, 3bv32) == 4294967292bv32;\r\n ensures $mul(33554432bv32, 64bv32) == 2147483648bv32;\r\n\r\natomic ghost procedure _shl_1_ge_1();\r\n ensures (forall $x:bv32 :: $le($x, 31bv32) ==> $ge($shl(1bv32, $x), 1bv32) );\r\n\r\natomic ghost procedure _alignment_is_mod4_lemma();\r\n ensures (forall $x:bv32 :: $_Aligned($x) == ($mod($x, 4bv32) == 0bv32));\r\n\r\natomic ghost procedure _alignment_4k_is_mod4096_lemma();\r\n ensures (forall $x:bv32 :: $_Aligned4k($x) == ($mod($x, 4096bv32) == 0bv32));\r\n\r\natomic ghost procedure _alignment_dominance_lemma($ptr:bv32);\r\n ensures $ge($shl(1bv32, 12bv32), 1bv32);\r\n ensures $_Aligned4k($ptr) ==> $_Aligned($ptr);\r\n\r\natomic ghost procedure _lower_bits_dont_matter_lemma($ptr:bv32, $orVal:bv32);\r\n requires $le(0bv32, $orVal) && $lt($orVal, 4096bv32);\r\n ensures $_Aligned4k($ptr) ==> $clear_LSBs(12bv32, $or($ptr, $orVal)) == $ptr;\r\n\r\natomic ghost procedure _get_set_lemma();\r\n ensures (forall $ptr:bv32, $index:bv32 :: { $get_bit($index, $set_bit($index, $ptr)) } \r\n _bit_index($index) ==> $get_bit($index, $set_bit($index, $ptr)) == true);\r\n\r\natomic ghost procedure _clear_LSBs_lemma();\r\n ensures (forall $ptr:bv32, $amount:bv32, $i:bv32 :: { $get_bit($i, $clear_LSBs($amount, $ptr)) }\r\n (_bit_index($amount) && _bit_index($i)) ==> \r\n if $lt($i, $amount) then\r\n $get_bit($i, $clear_LSBs($amount, $ptr)) == false\r\n else\r\n $get_bit($i, $clear_LSBs($amount, $ptr)) == $get_bit($i, $ptr) );\r\n\r\natomic ghost procedure _upper_bits_clear_ubound_lemma();\r\n ensures (forall $ptr:bv32, $y:bv32 :: { $select_LSBs($y, $ptr) }\r\n ($ge(10bv32, $y) && $ge($y, 0bv32)) ==> $le($select_LSBs($y, $ptr), 1023bv32) );\r\n\r\natomic ghost procedure _upper_bits_clear_lbound_lemma();\r\n ensures (forall $ptr:bv32, $y:bv32 :: { $le(0bv32, $select_LSBs($y, $ptr)) }\r\n ($ge(10bv32, $y) && $ge($y, 0bv32)) ==> $le(0bv32, $select_LSBs($y, $ptr)));\r\n\r\natomic ghost procedure _clear_less_than_equal_lemma();\r\n ensures (forall $ptr:bv32, $amt:bv32 :: { $le($clear_LSBs($amt, $ptr), $ptr) }\r\n _bit_index($amt) ==> $le($clear_LSBs($amt, $ptr), $ptr) );\r\n\r\natomic ghost procedure _clear_12_lemma();\r\n ensures (forall $ptr:bv32 :: { $and($ptr, 4294963200bv32) }\r\n $clear_LSBs(12bv32, $ptr) == $and($ptr, 4294963200bv32) );\r\n ensures (forall $ptr:bv32 :: { $add($clear_LSBs(12bv32, $ptr), 4096bv32) }\r\n $lt($ptr, 4294963200bv32) ==> $ge($add($clear_LSBs(12bv32, $ptr), 4096bv32), $ptr) );\r\n ensures (forall ptr:bv32, lb:bv32, ub:bv32 :: \r\n { $between(lb, ub, $clear_LSBs(12bv32, ptr)) }\r\n $_Aligned4k(lb) && $_Aligned4k(ub) && $between(lb, ub, ptr) ==>\r\n $between(lb, ub, $clear_LSBs(12bv32, ptr)) );\r\n ensures (forall ptr:bv32, lb:bv32, ub:bv32 :: \r\n { $between(lb, ub, $clear_LSBs(12bv32, ptr)) }\r\n $_Aligned4k(lb) && $_Aligned4k(ub) && !$between(lb, ub, ptr) ==>\r\n !$between(lb, ub, $clear_LSBs(12bv32, ptr)) );\r\n\r\natomic ghost procedure _clear_select_consistent_lemma();\r\n ensures (forall $ptr:bv32, $val:bv32 :: \r\n { $clear_LSBs($val, $clear_LSBs($val, $ptr)) } { $select_LSBs($val, $select_LSBs($val, $ptr))}\r\n _bit_index($val) ==> ( $clear_LSBs($val, $clear_LSBs($val, $ptr)) == $clear_LSBs($val, $ptr)) &&\r\n ($select_LSBs($val, $select_LSBs($val, $ptr)) == $select_LSBs($val, $ptr)));\r\n\r\natomic ghost procedure _select_non_negative_lemma();\r\n ensures (forall $ptr:bv32, $amt:bv32 :: { $le(0bv32, $select_LSBs($amt, $ptr)) }\r\n (_bit_index($amt)) ==>\r\n $le(0bv32, $select_LSBs($amt, $ptr)) );\r\n\r\natomic ghost procedure _select_preserves_word_lemma();\r\n ensures (forall $ptr:bv32, $x:bv32 :: { $select_LSBs($x, $ptr) }\r\n (_bit_index($x)) ==> $le($select_LSBs($x, $ptr),$ptr));\r\n\r\natomic ghost procedure _and_bounds();\r\n ensures (forall $val:bv32 :: { $and($val, 255bv32) } \r\n $le(0bv32, $and($val, 255bv32)) && $lt($and($val, 255bv32), 256bv32));\r\n ensures (forall $val:bv32 :: { $and($val, 15bv32) } \r\n $le(0bv32, $and($val, 15bv32)) && $lt($and($val, 15bv32), 16bv32));\r\n\r\natomic ghost procedure _shr_decreases();\r\n ensures (forall $ptr:bv32, $x:bv32 :: { $shr($ptr, $x) }\r\n $le($shr($ptr, $x), $ptr));\r\n\r\natomic ghost procedure _shr_preserves_word_lemma();\r\n ensures (forall $ptr:bv32, $x:bv32 :: { $shr($ptr, $x) }\r\n ($ge($x, 0bv32)) ==> $le($shr($ptr, $x), $ptr));\r\n\r\natomic ghost procedure _or_with_3_lemma();\r\n ensures (forall $ptr:bv32, $i:bv32:: { $get_bit($i, $or($ptr, 3bv32)) }\r\n _bit_index($i) ==>\r\n if ($eq($i, 0bv32) || $eq($i, 1bv32)) then\r\n $get_bit($i, $or($ptr, 3bv32)) == true\r\n else\r\n $get_bit($i, $or($ptr, 3bv32)) == $get_bit($i, $ptr));\r\n\r\natomic ghost procedure _or_with_7_lemma();\r\n ensures (forall $ptr:bv32, $i:bv32:: { $get_bit($i, $or($ptr, 7bv32)) }\r\n _bit_index($i) ==>\r\n if ($eq($i, 0bv32) || $eq($i, 1bv32) || $eq($i, 2bv32)) then\r\n $get_bit($i, $or($ptr, 7bv32)) == true\r\n else\r\n $get_bit($i, $or($ptr, 7bv32)) == $get_bit($i, $ptr));\r\n\r\natomic ghost procedure _or_with_pow2_31_lemma();\r\n ensures (forall $ptr:bv32, $i:bv32:: { $get_bit($i, $or($ptr, 2147483648bv32)) }\r\n _bit_index($i) ==>\r\n if ($eq($i, 31bv32)) then\r\n $get_bit($i, $or($ptr, 2147483648bv32)) == true\r\n else\r\n $get_bit($i, $or($ptr, 2147483648bv32)) == $get_bit($i, $ptr));\r\n ensures (forall $ptr:bv32 :: { $or($ptr, 2147483648bv32) }\r\n $set_bit(31bv32, $ptr) == $or($ptr, 2147483648bv32));\r\n\r\natomic ghost procedure _pointer_pieces_lemma();\r\n ensures (forall $ptr:bv32 :: \r\n { $mul(4096bv32, $add($mul($select_LSBs(10bv32, $shr($ptr, 22bv32)), 1024bv32), $select_LSBs(10bv32, $shr($ptr, 12bv32)))) }\r\n { $clear_LSBs(12bv32, $ptr) } \r\n $mul(4096bv32, $add($mul($select_LSBs(10bv32, $shr($ptr, 22bv32)), 1024bv32), $select_LSBs(10bv32, $shr($ptr, 12bv32)))) \r\n == $clear_LSBs(12bv32, $ptr) );\r\n \r\natomic ghost procedure _ptr_offsets_lemma();\r\n ensures (forall $ptr:bv32 :: { $select_LSBs(10bv32, $shr($ptr,12bv32)) } \r\n $lt($ptr, 4096bv32) ==> $select_LSBs(10bv32, $shr($ptr, 12bv32)) == 0bv32 );\r\n ensures (forall $ptr:bv32 :: { $select_LSBs(10bv32, $shr($ptr,22bv32)) }\r\n $lt($ptr, 4194304bv32) <==> $select_LSBs(10bv32, $shr($ptr,22bv32)) == 0bv32 );\r\n ensures (forall $ptr:bv32 :: { $select_LSBs(10bv32, $shr($ptr,12bv32)) }\r\n $select_LSBs(10bv32, $shr($ptr, 12bv32)) != 0bv32 ==> $gt($ptr, 0bv32));\r\n ensures (forall $ptr:bv32 :: { $select_LSBs(10bv32, $shr($ptr,12bv32)) }\r\n $ge($ptr, 4096bv32) ==> $select_LSBs(10bv32, $shr($ptr, 12bv32)) != 0bv32 || $select_LSBs(10bv32, $shr($ptr,22bv32)) != 0bv32 ); \r\n\r\natomic ghost procedure _ptr_reconstruction_lemma();\r\n ensures (forall ptr:bv32 :: { $or($clear_LSBs(12bv32, ptr), $select_LSBs(12bv32, ptr)) }\r\n ptr == $or($clear_LSBs(12bv32, ptr), $select_LSBs(12bv32, ptr)) );\r\n ensures (forall ptr:bv32 :: { $or($select_LSBs(12bv32, ptr), $clear_LSBs(12bv32, ptr)) }\r\n ptr == $or($select_LSBs(12bv32, ptr), $clear_LSBs(12bv32, ptr)) );\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/BitVectorLemmasBase.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation BitVectorLemmasBase\r\n{\r\n\r\nimplementation _const_base() {} \r\n\r\nimplementation _shl_1_ge_1() {}\r\n\r\nimplementation _alignment_is_mod4_lemma() {}\r\n\r\nimplementation _alignment_4k_is_mod4096_lemma() {}\r\n\r\nimplementation _alignment_dominance_lemma($ptr:bv32) {}\r\n\r\nimplementation _lower_bits_dont_matter_lemma($ptr:bv32, $bitPos:bv32) {}\r\n\r\nimplementation _get_set_lemma() {}\r\n\r\nimplementation _clear_LSBs_lemma() {}\r\n\r\nimplementation _upper_bits_clear_ubound_lemma() {}\r\n\r\nimplementation _upper_bits_clear_lbound_lemma() {}\r\n\r\nimplementation _clear_less_than_equal_lemma() {}\r\n\r\nimplementation _clear_12_lemma() {}\r\n\r\nimplementation _clear_select_consistent_lemma() {}\r\n\r\nimplementation _select_non_negative_lemma() {}\r\n\r\nimplementation _select_preserves_word_lemma() {}\r\n\r\nimplementation _and_bounds() {}\r\n\r\nimplementation _shr_decreases() {}\r\n\r\nimplementation _shr_preserves_word_lemma() {}\r\n\r\nimplementation _or_with_3_lemma() {}\r\n\r\nimplementation _or_with_7_lemma() {}\r\n\r\nimplementation _or_with_pow2_31_lemma() {}\r\n\r\nimplementation _pointer_pieces_lemma() {}\r\n\r\nimplementation _ptr_offsets_lemma() {}\r\n\r\nimplementation _ptr_reconstruction_lemma() {}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/Core.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-private-import Partition;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface Core\r\n modifies init;\r\n{\r\n\r\natomic ghost procedure setInit();\r\n requires me == 0;\r\n modifies init;\r\n ensures init;\r\n\r\nfunction LogicalToPhysical(c:core_state, logicalAddr:int):int\r\n{\r\n LogicalToPhysicalViaSegment(c, DS, logicalAddr)\r\n}\r\n\r\nfunction LogicalToPhysicalSS(c:core_state, logicalAddr:int):int\r\n{\r\n LogicalToPhysicalViaSegment(c, SS, logicalAddr)\r\n}\r\n\r\nfunction LogicalToPhysicalViaSegment(c:core_state, segment_index:int, logicalAddr:int):int\r\n{\r\n let linearAddr:int := SegmentMap(c.seg_regs[segment_index], logicalAddr) in\r\n if paging_enabled(c) then\r\n PageMap(linearAddr, ?System, ?Write, c.caches.TLB, c.caches.TLB_activeLabel).<>\r\n else linearAddr\r\n}\r\n\r\nfunction DstPhysicalAddr(r:regs, c:core_state, dst:opn_mem):int\r\n{\r\n LogicalToPhysical(c, EvalPtr(r, dst))\r\n}\r\n\r\nfunction DstPhysicalAddrSS(r:regs, c:core_state, dst:opn_mem):int\r\n{\r\n LogicalToPhysicalSS(c, EvalPtr(r, dst))\r\n}\r\n\r\nfunction PartDstOk(r:regs, c:core_state, m:mem, dst:opn_mem):bool\r\n{\r\n MemDstOk(r, c, m, dst) && (dst is OMem ==> m.dom[DstPhysicalAddr(r, c, dst)])\r\n}\r\n\r\nfunction PartDstOkSS(r:regs, c:core_state, m:mem, dst:opn_mem):bool\r\n{\r\n DstOkViaSegment(r, c, m, SS, dst) && (dst is OMem ==> m.dom[DstPhysicalAddrSS(r, c, dst)])\r\n}\r\n\r\natomic procedure core_Load(my r:regs, const my c:core_state, const linear m:mem, x:int, y:opn_mem) returns(my _r:regs);\r\n requires MemSrcOk(r, c, m, y);\r\n ensures _r.regs == r.regs[x := EvalMem(r, c, m, y)];\r\n ensures _r.efl == r.efl;\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure core_Store(const my r:regs, const my c:core_state, linear m:mem, x:opn_mem, y:opn) returns(linear _m:mem);\r\n requires PartDstOk(r, c, m, x);\r\n requires SrcOk(y);\r\n ensures _m == MemUpdate1(r, c, m, x, Eval(r, y));\r\n ensures word(EvalMem(r, c, _m, x));\r\n\r\natomic procedure core_LoadStack(my r:regs, const my c:core_state, const linear m:mem, x:int, y:opn_mem) returns(my _r:regs);\r\n requires SrcOkViaSegment(r, c, m, SS, y);\r\n ensures _r.regs == r.regs[x := EvalViaSegment(r, c, m, SS, y)];\r\n ensures _r.efl == r.efl;\r\n\r\natomic procedure core_StoreStack(const my r:regs, const my c:core_state, linear m:mem, x:opn_mem, y:opn)\r\n returns(linear _m:mem);\r\n requires PartDstOkSS(r, c, m, x);\r\n ensures _m == StackUpdate1(r, c, m, x, Eval(r, y));\r\n\r\natomic procedure core_Push(my r:regs, const my c:core_state, linear m:mem, v:opn)\r\n returns(my _r:regs, linear _m:mem);\r\n requires v is OReg && v != OReg(ESP);\r\n requires SrcOk(v);\r\n requires PartDstOkSS(r, c, m, OMem(MConst(sub(r.regs[ESP], 4))));\r\n requires word(r.regs[ESP]) && r.regs[ESP] >= 4;\r\n ensures _r.regs == r.regs[ESP := sub(r.regs[ESP], 4)];\r\n ensures _r.efl == r.efl;\r\n ensures _m == StackUpdate1(r, c, m, OMem(MConst(sub(r.regs[ESP], 4))), Eval(r, v));\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/Core.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-private-import Partition;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation Core\r\n{\r\n\r\nimplementation setInit()\r\n{\r\n init := true;\r\n}\r\n\r\nimplementation core_Load(my r:regs, const my c:core_state, const linear m:mem, x:int, y:opn_mem) returns(my _r:regs)\r\n{\r\n call _r := instr_Load(r, c, m, x, y);\r\n}\r\n\r\nimplementation core_Store(const my r:regs, const my c:core_state, linear m:mem, x:opn_mem, y:opn) returns(linear _m:mem)\r\n{\r\n call _m := instr_Store(r, c, m, x, y);\r\n}\r\n\r\nimplementation core_LoadStack(my r:regs, const my c:core_state, linear m:mem, x:int, y:opn_mem)\r\n returns(my _r:regs)\r\n{\r\n call _r := instr_LoadStack(r, c, m, x, y);\r\n}\r\n\r\nimplementation core_StoreStack(const my r:regs, const my c:core_state, const linear m:mem, x:opn_mem, y:opn) returns(linear _m:mem)\r\n{\r\n call _m := instr_StoreStack(r, c, m, x, y);\r\n}\r\n\r\nimplementation core_Push(my r:regs, const my c:core_state, linear m:mem, v:opn)\r\n returns(my _r:regs, linear _m:mem)\r\n{\r\n var dst:opn_mem := OMem(MConst(sub(r.regs[ESP], 4)));\r\n call reveal_wrap32(sub(r.regs[ESP], 4));\r\n call reveal_WORD_HI();\r\n {:\r\n call _r := instr_SubNoFlags(r, ESP, OConst(4));\r\n call _m := instr_StoreStack(_r, c, m, OMem(MReg(ESP, 0)), v);\r\n :}\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/Instructions.ifc.beat", "content": "\r\nmodule interface Instructions\r\n{\r\n\r\ninstruction Mov(y:opn) returns(x:reg) { call r := instr_Mov(r, x, y); }\r\ninstruction Add(x:reg, y:opn) returns(x:reg) ensures InputOutput(r, x, r.regs[x] + Eval(r, y)); { call logical_Add(inout r, x, y); }\r\ninstruction AddCarry(x:reg, y:opn) returns(x:reg) ensures InputOutput(r, x, let carry:int := if Cf(r.efl) then 1 else 0 in\r\n wrap32(r.regs[x] + Eval(r, y) + carry)); { call r := instr_AddCarry(r, x, y); }\r\ninstruction AddWrap(x:reg, y:opn) returns(x:reg) ensures InputOutput(r, x, wrap32(r.regs[x] + Eval(r, y))); { call r := instr_Add(r, x, y); }\r\ninstruction Sub(x:reg, y:opn) returns(x:reg) ensures InputOutput(r, x, r.regs[x] - Eval(r, y)); { call logical_Sub(inout r, x, y); }\r\ninstruction SubWrap(x:reg, y:opn) returns(x:reg) ensures InputOutput(r, x, wrap32(r.regs[x] - Eval(r, y))); { call r := instr_Sub(r, x, y); }\r\ninstruction Mul(xLo:opn, y:opn) returns(xLo:opn, xHi:opn) { call r := instr_Mul(r, y); }\r\ninstruction Mul64(xLo:opn, y:opn) returns(xLo:opn, xHi:opn) { call r := instr_Mul64(r, y); }\r\ninstruction MulWrap(xLo:opn, y:opn) returns(xLo:opn, xHi:opn) { call r := instr_Mul(r, y); }\r\ninstruction Div(xLo:opn, xHi:opn, y:opn) returns(xLo:opn, xHi:opn) { call r := instr_Div(r, y); }\r\ninstruction Not(x:reg) returns(x:reg) { call r := instr_Not(r, x); }\r\ninstruction And(x:reg, y:opn) returns(x:reg) { call r := instr_And(r, x, y); }\r\ninstruction Or(x:reg, y:opn) returns(x:reg) { call r := instr_Or(r, x, y); }\r\ninstruction Xor(x:reg, y:opn) returns(x:reg) { call r := instr_Xor(r, x, y); }\r\ninstruction Shl(x:reg, y:opn) returns(x:reg) { call r := instr_Shl(r, x, y); }\r\ninstruction Shr(x:reg, y:opn) returns(x:reg) { call r := instr_Shr(r, x, y); }\r\ninstruction Rol(x:reg, y:opn) returns(x:reg) { call r := instr_Rol(r, x, y); }\r\ninstruction Ror(x:reg, y:opn) returns(x:reg) { call r := instr_Ror(r, x, y); }\r\ninstruction AddChecked(x:opn, y:opn) returns(x:reg) ensures InputOutput(r, x, r.regs[x] + Eval(r, y)); { call r := instr_AddChecked(r, x, y); }\r\ninstruction SubChecked(x:opn, y:opn) returns(x:reg) ensures InputOutput(r, x, r.regs[x] - Eval(r, y)); { call r := instr_SubChecked(r, x, y); }\r\ninstruction MulChecked(xLo:opn, y:opn) returns(xLo:opn, xHi:opn) { call r := instr_MulChecked(r, y); }\r\ninstruction Cmp(x:reg, y:opn) { call r := instr_Cmp(r, x, y); }\r\ninstruction Lea(y:opn_mem_of_int) returns(x:reg) { call r := instr_Lea(r, x, y); }\r\ninstruction LeaUnchecked(y:opn_mem_of_int) returns(x:reg) { call r := instr_LeaUnchecked(r, x, y); }\r\ninstruction LeaSignedIndex(base:reg, scale:int, index:reg, offset:opn) returns(x:reg) { call r := instr_LeaSignedIndex(r, x, base, scale, index, offset); }\r\ninstruction Rdtsc() { call r := instr_Rdtsc(r); }\r\n\r\ninstruction SubLoad(const linear m:mem, x:reg, y:opn_mem_of_int) returns(x:reg) ensures InputOutput(x, r.regs[x] - LogicalEval(m, r, y)); { call logical_SubLoad(inout r, core_state, m, x, y); }\r\ninstruction CmpLoad(x:opn_mem_of_int, y:opn) { call logical_CmpLoad(inout r, core_state, statics, x, y); } // TODO: don't hardwire for statics\r\ninstruction Load(const linear m:mem, ptr:opn_mem_of_int) returns (y:reg) { call logical_Load(inout r, core_state, m, y, ptr); }\r\ninstruction Store(inout linear m:mem, ptr:opn_mem_of_int, val:opn) ensures Output(ptr, Eval(r, val)); { call logical_Store(r, core_state, inout m, ptr, val); }\r\ninstruction SLoad (ptr:opn_mem_of_int) returns (y:reg) { call logical_Load(inout r, core_state, stk, y, ptr); }\r\ninstruction SStore (ptr:opn_mem_of_int, val:opn) { call logical_Store(r, core_state, inout stk, ptr, val); }\r\ninstruction SCmpLoad(x:opn_mem_of_int, y:opn) { call logical_CmpLoad(inout r, core_state, stk, x, y); }\r\n\r\ninstruction Call() { call alignCall(r.regs[ESP]); call logical_Call(inout r, core_state, inout stk); }\r\ninstruction Ret() { call logical_Ret(inout r, core_state, stk); }\r\n//instruction IRet() { call r, mem := logical_IRet(r, mem); }\r\n\r\n//instruction RoLoadU8(y:opn_mem_of_int) returns(x:opn) { call r, mem := logical_RoLoadU8(r, mem, x, y); }\r\n//instruction RoLoadS8(y:opn_mem_of_int) returns(x:opn) { call r, mem := logical_RoLoadS8(r, mem, x, y); }\r\n//instruction RoLoadU16(y:opn_mem_of_int) returns(x:opn) { call r, mem := logical_RoLoadU16(r, mem, x, y); }\r\n//instruction RoLoadS16(y:opn_mem_of_int) returns(x:opn) { call r, mem := logical_RoLoadS16(r, mem, x, y); }\r\n//instruction RoLoad32(y:opn_mem_of_int) returns(x:opn) { call r, mem := logical_RoLoad32(r, mem, x, y); }\r\n\r\ninstruction ReadCR0() returns (x:opn) { call r := instr_ReadCR0(r, core_state, x); }\r\ninstruction WriteCR0(x:opn) { call r, core_state := instr_WriteCR0(r, core_state, x); }\r\n//instruction WriteCR3(x:opn) { call r, mem := instr_WriteCR3(r, mem, x); }\r\n\r\ninstruction VgaDebugStore16(ptr:opn_mem_of_int, val:opn) { call instr_VgaDebugStore16(r, ptr, val); }\r\n\r\ninstruction VgaTextStore16(ptr:opn_mem_of_int, val:opn) { call io := instr_VgaTextStore16(r, io, ptr, val); }\r\ninstruction KeyboardStatusIn8() { call r, io := instr_KeyboardStatusIn8(r, io); }\r\ninstruction KeyboardDataIn8() { call r, io := instr_KeyboardDataIn8(r, io); }\r\ninstruction SerialDbgConfigOut() { call instr_SerialDbgConfigOut(r); }\r\ninstruction SerialDbgDataOut8() { call instr_SerialDbgDataOut8(r); }\r\ninstruction SerialDbgStatusOut8() { call r := instr_SerialDbgStatusOut8(r); }\r\n//instruction SerialDbgDataIn8() { call r, io := instr_SerialDbgDataIn8(r, io, $serialState); }\r\n//instruction SerialDbgStatusIn8() { call r, io := instr_SerialDbgStatusIn8(r, io, $serialState); }\r\n//instruction SampleIn32(M:[int]int) { call r, io := instr_SampleIn32(r, io, M); }\r\n//instruction IomStore(ptr:opn_mem_of_int, val:opn) { call r, io := instr_IomStore(r, io, ptr, val); }\r\n//instruction IomRegLoad(entry:int, ptr:opn_mem_of_int) returns(val:opn) { call r, io := instr_IomRegLoad(r, io, entry, val, ptr); }\r\n//instruction IomRegStore(entry:int, ptr:opn_mem_of_int, val:opn) { call r, io := instr_IomRegStore(r, io, entry, ptr, val); }\r\n//instruction IomEnable() { call r, io := /*core :=*/ core_IomEnable(r, io); }\r\ninstruction PciConfigAddrOut32(id:int, offset:int) { call io := instr_PciConfigAddrOut32(r, io, id, offset); }\r\ninstruction PciConfigDataIn32(id:int, offset:int) { call r, io := instr_PciConfigDataIn32(r, io, id, offset); }\r\ninstruction PciConfigDataOut32(id:int, offset:int, config0:int, config4:int, config12:int, config16:int) { call io := instr_PciConfigDataOut32(r, io, id, offset, config0, config4, config12, config16); }\r\ninstruction PciMemLoad32(id:int, ptr:opn_mem_of_int) returns(val:reg) { call r, io := instr_PciMemLoad32(r, io, id, val, ptr); }\r\ninstruction PciMemStore32(id:int, ptr:opn_mem_of_int, val:opn) { call io := instr_PciMemStore32(r, io, id, ptr, val); }\r\n\r\ninstruction DeviceLoad(ptr:opn_mem_of_int) returns(val:reg) { call r, io := instr_DeviceLoad(r, io, val, ptr); }\r\ninstruction DeviceStore(ptr:opn_mem_of_int, val:opn) { call io := instr_DeviceStore(r, io, ptr, val); }\r\n\r\ninstruction DEV_PciConfigDataIn32 (linear DEV_states:DEV_StateMachines, id:int, dev_offset:int, offset:int) returns (linear _DEV_states:DEV_StateMachines) { call r, io, _DEV_states := instr_DEV_PciConfigDataIn32 (r, io, DEV_states, id, dev_offset, offset); }\r\ninstruction DEV_PciConfigDataOut32(linear DEV_states:DEV_StateMachines, id:int, dev_offset:int, offset:int) returns (linear _DEV_states:DEV_StateMachines) { call io, _DEV_states := instr_DEV_PciConfigDataOut32(r, io, DEV_states, id, dev_offset, offset); }\r\n\r\ninstruction IoMemAddrRead(ptr:opn_mem_of_int) returns(val:reg) { call r := instr_IoMemAddrRead(r, val, ptr); }\r\ninstruction IoMemAddrWrite(ptr:opn_mem_of_int, val:opn) { call instr_IoMemAddrWrite(r, ptr, val); }\r\n//instruction IdtStore(entry:int, offset:int, handler:int, ptr:opn_mem_of_int, val:opn) { call r, state := logical_IdtStore(r, state, entry, offset, handler, ptr, val); }\r\n//instruction Lidt(ptr:opn_mem_of_int) { call r, state := logical_Lidt(r, state, ptr); }\r\n//instruction PicOut8(pic:int, offset:int, seq:int) { call r, state := logical_PicOut8(r, state, pic, offset, seq); }\r\n//instruction PitModeOut8(freq:int) { call r, state := logical_PitModeOut8(r, state, freq); }\r\n//instruction PitFreqOut8() { call r, state := logical_PitFreqOut8(r, state); }\r\n//\r\n//instruction SectionLoad(y:opn_mem_of_int) returns(x:opn) { call r := logical_SectionLoad(r, state, x, y); }\r\n//instruction SectionStore(x:opn_mem_of_int, y:opn) { call r := logical_SectionStore(r, state, x, y); }\r\n//\r\n//instruction StoreShared(linear owner:int, ptr:opn_mem_of_int, val:opn) returns(linear _owner:int) ensures Output(ptr, _Eval(regs, val)); { call r := core, _owner := logical_StoreShared(r, state, owner, ptr, val); }\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/Instructions.imp.beat", "content": "\r\nmodule implementation Instructions\r\n{\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/IntLemmasBase.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-\r\n//-private-import IntSpec;\r\n//-private-import BitVectorLemmasBase;\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface IntLemmasBase\r\n{\r\n\r\nfunction bit_index($i:int) returns (bool) { le(0, $i) && le($i, 31) }\r\nfunction eq($x:int, $y:int) returns (bool) { le($x, $y) && le($y, $x) }\r\nfunction aligned4k($ptr:int) returns (bool) { ClearLSBs(12, $ptr) == $ptr }\r\n\r\natomic ghost procedure alignment_is_mod4_lemma();\r\n ensures (forall $x:int :: {Aligned($x)} word($x) ==> Aligned($x) == (_mod($x, 4) == 0));\r\n\r\natomic ghost procedure alignment_4k_is_mod4096_lemma();\r\n ensures (forall $x:int :: {aligned4k($x)} word($x) ==> aligned4k($x) == (_mod($x, 4096) == 0));\r\n\r\natomic ghost procedure alignment_dominance_lemma($ptr:int);\r\n requires word($ptr);\r\n ensures aligned4k($ptr) ==> Aligned($ptr);\r\n\r\natomic ghost procedure lower_bits_dont_matter_lemma($ptr:int, $orVal:int);\r\n requires word($ptr);\r\n requires le(0, $orVal) && lt($orVal, 4096);\r\n ensures aligned4k($ptr) ==> ClearLSBs(12, or($ptr, $orVal)) == $ptr;\r\n\r\natomic ghost procedure get_set_lemma();\r\n ensures (forall $ptr:int, $index:int :: { GetBit($index, SetBit($index, $ptr)) } \r\n (word($ptr) && bit_index($index)) ==> GetBit($index, SetBit($index, $ptr)) == true);\r\n\r\n//- Explain the effect clearing the LSBs has on the bits that constitute $ptr\r\natomic ghost procedure clear_LSBs_lemma();\r\n ensures (forall $ptr:int, $amount:int, $i:int :: { GetBit($i, ClearLSBs($amount, $ptr)) }\r\n (bit_index($amount) && word($ptr) && bit_index($i)) ==> \r\n if lt($i, $amount) then\r\n GetBit($i, ClearLSBs($amount, $ptr)) == false\r\n else\r\n GetBit($i, ClearLSBs($amount, $ptr)) == GetBit($i, $ptr) );\r\n\r\natomic ghost procedure upper_bits_clear_ubound_lemma();\r\n ensures (forall $ptr:int, $y:int :: { SelectLSBs($y, $ptr) }\r\n (word($ptr) && ge(10, $y) && ge($y, 0)) ==> le(SelectLSBs($y, $ptr), 1023) );\r\n\r\natomic ghost procedure upper_bits_clear_lbound_lemma();\r\n ensures (forall $ptr:int, $y:int :: { SelectLSBs($y, $ptr) }\r\n (word($ptr) && ge(10, $y) && ge($y, 0)) ==> le(0, SelectLSBs($y, $ptr)));\r\n\r\natomic ghost procedure clear_less_than_equal_lemma();\r\n ensures (forall $ptr:int, $amt:int :: { le(ClearLSBs($amt, $ptr), $ptr) }\r\n (word($ptr) && bit_index($amt)) ==> le(ClearLSBs($amt, $ptr), $ptr) );\r\n\r\natomic ghost procedure clear_12_lemma();\r\n ensures (forall $ptr:int :: { and($ptr, 0xFFFFF000) }\r\n word($ptr) ==> ClearLSBs(12, $ptr) == and($ptr, 0xFFFFF000));\r\n ensures (forall $ptr:int :: { add(ClearLSBs(12, $ptr), 0x1000) }\r\n word($ptr) && lt($ptr, 0xFFFFF000) ==> ge(add(ClearLSBs(12, $ptr), 0x1000), $ptr) ); \r\n ensures (forall ptr:int, lb:int, ub:int :: { between(lb, ub, ClearLSBs(12, ptr)) }\r\n word(ptr) && word(lb) && word(ub) && \r\n aligned4k(lb) && aligned4k(ub) && \r\n between(lb, ub, ptr) ==> between(lb, ub, ClearLSBs(12, ptr)) );\r\n ensures (forall ptr:int, lb:int, ub:int :: { between(lb, ub, ClearLSBs(12, ptr)) }\r\n word(ptr) && word(lb) && word(ub) && \r\n aligned4k(lb) && aligned4k(ub) && \r\n !between(lb, ub, ptr) ==> !between(lb, ub, ClearLSBs(12, ptr)) );\r\n\r\natomic ghost procedure clear_select_consistent_lemma();\r\n ensures (forall $ptr:int, $val:int :: \r\n { ClearLSBs($val, ClearLSBs($val, $ptr)) } { SelectLSBs($val, SelectLSBs($val, $ptr))}\r\n (word($ptr) && bit_index($val)) ==> ClearLSBs($val, ClearLSBs($val, $ptr)) == ClearLSBs($val, $ptr) &&\r\n SelectLSBs($val, SelectLSBs($val, $ptr)) == SelectLSBs($val, $ptr));\r\n\r\natomic ghost procedure select_non_negative_lemma();\r\n ensures (forall $ptr:int, $amt:int :: { le(0, SelectLSBs($amt, $ptr)) }\r\n (word($ptr) && bit_index($amt)) ==>\r\n le(0, SelectLSBs($amt, $ptr)) );\r\n \r\natomic ghost procedure select_preserves_word_lemma();\r\n ensures (forall $ptr:int, $x:int :: { word(SelectLSBs($x, $ptr)) }\r\n (word($ptr) && bit_index($x)) ==> word(SelectLSBs($x, $ptr)));\r\n\r\natomic ghost procedure and_bounds();\r\n ensures (forall $val:int :: { and($val, 0xff) } \r\n word($val) ==> le(0, and($val, 0xff)) && lt(and($val, 0xff), 256));\r\n ensures (forall $val:int :: { and($val, 0xf) } \r\n word($val) ==> le(0, and($val, 0xf)) && lt(and($val, 0xf), 16));\r\n\r\natomic ghost procedure shr_decreases();\r\n ensures (forall $ptr:int, $x:int :: { shr($ptr, $x) }\r\n (word($ptr) && ge($x, 0)) ==> le(shr($ptr, $x), $ptr));\r\n\r\natomic ghost procedure shr_preserves_word_lemma();\r\n ensures (forall $ptr:int, $x:int :: { word(shr($ptr, $x)) }\r\n (word($ptr) && ge($x, 0)) ==> word(shr($ptr, $x)));\r\n\r\natomic ghost procedure set_bit_preserves_word_lemma();\r\n ensures (forall $ptr:int, $x:int :: { word(SetBit($x, $ptr)) }\r\n (word($ptr) && bit_index($x)) ==> word(SetBit($x, $ptr)));\r\n\r\natomic ghost procedure or_with_3_lemma(); \r\n ensures (forall $ptr:int, $i:int :: { GetBit($i, or($ptr, 3)) }\r\n (word($ptr) && bit_index($i)) ==>\r\n if (eq($i, 0) || eq($i, 1)) then\r\n GetBit($i, or($ptr, 3)) == true\r\n else\r\n GetBit($i, or($ptr, 3)) == GetBit($i, $ptr));\r\n\r\natomic ghost procedure or_with_7_lemma(); \r\n ensures (forall $ptr:int, $i:int :: { GetBit($i, or($ptr, 7)) }\r\n (word($ptr) && bit_index($i)) ==>\r\n if (eq($i, 0) || eq($i, 1) || eq($i, 2)) then\r\n GetBit($i, or($ptr, 7)) == true\r\n else\r\n GetBit($i, or($ptr, 7)) == GetBit($i, $ptr));\r\n\r\natomic ghost procedure or_with_pow2_31_lemma(); \r\n ensures (forall $ptr:int, $i:int :: { GetBit($i, or($ptr, 0x80000000)) }\r\n (word($ptr) && bit_index($i)) ==>\r\n if (eq($i, 31)) then\r\n GetBit($i, or($ptr, 0x80000000)) == true\r\n else\r\n GetBit($i, or($ptr, 0x80000000)) == GetBit($i, $ptr));\r\n ensures (forall $ptr:int :: { or($ptr, 0x80000000) }\r\n word($ptr) ==> SetBit(31, $ptr) == or($ptr, 0x80000000) );\r\n\r\natomic ghost procedure pointer_pieces_lemma();\r\n ensures (forall $ptr:int :: \r\n { mul(4096, add(mul(SelectLSBs(10, shr($ptr, 22)), 1024), SelectLSBs(10, shr($ptr, 12)))) } \r\n word($ptr) ==>\r\n mul(4096, add(mul(SelectLSBs(10, shr($ptr, 22)), 1024), SelectLSBs(10, shr($ptr, 12)))) \r\n == ClearLSBs(12, $ptr) );\r\n\r\natomic ghost procedure ptr_offsets_lemma();\r\n ensures (forall $ptr:int :: { PageTableOffset($ptr) }\r\n (word($ptr) && lt($ptr, 4096)) ==> PageTableOffset($ptr) == 0 );\r\n ensures (forall $ptr:int :: { PageDirectoryOffset($ptr) }\r\n word($ptr) ==> (lt($ptr, 4194304) <==> PageDirectoryOffset($ptr) == 0) );\r\n ensures (forall $ptr:int :: { PageTableOffset($ptr) }\r\n (word($ptr) && PageTableOffset($ptr) != 0) ==> gt($ptr, 0) );\r\n ensures (forall $ptr:int :: { PageTableOffset($ptr) }\r\n (word($ptr) && ge($ptr, 4096)) ==> \r\n gt(PageTableOffset($ptr), 0) || gt(PageDirectoryOffset($ptr), 0) );\r\n\r\natomic ghost procedure ptr_reconstruction_lemma();\r\n ensures (forall ptr:int :: { or(ClearLSBs(12, ptr), SelectLSBs(12, ptr)) }\r\n word(ptr) ==> ptr == or(ClearLSBs(12, ptr), SelectLSBs(12, ptr)) );\r\n ensures (forall ptr:int :: { or(SelectLSBs(12, ptr), ClearLSBs(12, ptr)) }\r\n word(ptr) ==> ptr == or(SelectLSBs(12, ptr), ClearLSBs(12, ptr)) );\r\n\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/IntLemmasBase.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-\r\n//-private-import IntSpec;\r\n//-private-import BitVectorLemmasBase;\r\n//-\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation IntLemmasBase\r\n{\r\n\r\natomic ghost procedure helper()\r\n ensures (forall b1:bv32, b2:bv32::{$add(b1, b2)} word(add(I(b1), I(b2))) ==> add(I(b1), I(b2)) == I($add(b1, b2)));\r\n ensures (forall b1:bv32, b2:bv32::{$sub(b1, b2)} word(sub(I(b1), I(b2))) ==> sub(I(b1), I(b2)) == I($sub(b1, b2)));\r\n ensures (forall b1:bv32, b2:bv32::{$mul(b1, b2)} word(mul(I(b1), I(b2))) ==> mul(I(b1), I(b2)) == I($mul(b1, b2)));\r\n ensures (forall b1:bv32, b2:bv32::{$div(b1, b2)} word(_mod(I(b1), I(b2))) ==> _mod(I(b1), I(b2)) == I($mod(b1, b2)));\r\n ensures (forall b1:bv32, b2:bv32::{$mod(b1, b2)} word(_div(I(b1), I(b2))) ==> _div(I(b1), I(b2)) == I($div(b1, b2)));\r\n ensures (forall b1:bv32, b2:bv32::{$le(b1, b2)} le(I(b1), I(b2)) <==> $le(b1, b2));\r\n ensures (forall b1:bv32, b2:bv32::{$lt(b1, b2)} lt(I(b1), I(b2)) <==> $lt(b1, b2));\r\n ensures (forall b1:bv32, b2:bv32::{$ge(b1, b2)} ge(I(b1), I(b2)) <==> $ge(b1, b2));\r\n ensures (forall b1:bv32, b2:bv32::{$gt(b1, b2)} gt(I(b1), I(b2)) <==> $gt(b1, b2));\r\n ensures (forall b1:bv32, b2:bv32::{$eq(b1, b2)} eq(I(b1), I(b2)) <==> $eq(b1, b2));\r\n ensures (forall b1:bv32, b2:bv32, b3:bv32::{$between(b1, b2, b3)} between(I(b1), I(b2), I(b3)) <==> $between(b1, b2, b3));\r\n ensures (forall i1:int, i2:int, i3:int ::{between(i1, i2, i3)} word(i1) && word(i2) && word(i3) ==> (between(i1, i2, i3) <==> $between(B(i1), B(i2), B(i3))) );\r\n{\r\n}\r\n\r\n//- Add\r\natomic ghost procedure _a($b1:bv32, $b2:bv32)\r\n requires word(add(I($b1), I($b2)));\r\n ensures add(I($b1), I($b2)) == I($add($b1, $b2));\r\n{\r\n}\r\n\r\n//- Sub\r\natomic ghost procedure _s($b1:bv32, $b2:bv32)\r\n requires word(sub(I($b1), I($b2)));\r\n ensures sub(I($b1), I($b2)) == I($sub($b1, $b2));\r\n{\r\n}\r\n\r\n//- Multiply\r\natomic ghost procedure _m($b1:bv32, $b2:bv32)\r\n requires word(mul(I($b1), I($b2)));\r\n ensures mul(I($b1), I($b2)) == I($mul($b1, $b2));\r\n{\r\n}\r\n\r\n//- Useful relations between const ints and const bitvectors\r\natomic ghost procedure __const()\r\n ensures 0 == I(0bv32);\r\n ensures 1 == I(1bv32);\r\n ensures 2 == I(2bv32);\r\n ensures 3 == I(3bv32);\r\n ensures 4 == I(4bv32);\r\n ensures 5 == I(5bv32);\r\n ensures 6 == I(6bv32);\r\n ensures 7 == I(7bv32);\r\n ensures 8 == I(8bv32);\r\n ensures 9 == I(9bv32);\r\n ensures 10 == I(10bv32);\r\n ensures 11 == I(11bv32);\r\n ensures 12 == I(12bv32);\r\n ensures 13 == I(13bv32);\r\n ensures 15 == I(15bv32);\r\n ensures 16 == I(16bv32);\r\n ensures 22 == I(22bv32);\r\n ensures 32 == I(32bv32);\r\n ensures 31 == I(31bv32);\r\n ensures 64 == I(64bv32);\r\n ensures 63 == I(63bv32);\r\n ensures 128 == I(128bv32);\r\n ensures 127 == I(127bv32);\r\n ensures 255 == I(255bv32);\r\n ensures 256 == I(256bv32);\r\n ensures 1023 == I(1023bv32);\r\n ensures 1024 == I(1024bv32);\r\n ensures 4096 == I(4096bv32);\r\n ensures 4095 == I(4095bv32);\r\n ensures 1048576 == I(1048576bv32); // 2^20\r\n ensures 16777215 == I(16777215bv32);\r\n ensures 33554431 == I(33554431bv32);\r\n ensures 67108863 == I(67108863bv32);\r\n ensures 2147483648 == I(2147483648bv32);\r\n ensures 0xFFFFF000 == I(4294963200bv32);\r\n ensures 4194304 == I(4194304bv32); // 2^22 = 0x0040000\r\n{\r\n call _const_base();\r\n call _s(1bv32, 1bv32);\r\n call _a(1bv32, 0bv32);\r\n call _a(1bv32, 1bv32);\r\n call _a(2bv32, 1bv32);\r\n call _a(2bv32, 2bv32);\r\n call _a(4bv32, 1bv32);\r\n call _a(5bv32, 1bv32);\r\n call _a(5bv32, 2bv32);\r\n call _a(5bv32, 3bv32);\r\n call _a(5bv32, 4bv32);\r\n call _a(5bv32, 5bv32);\r\n call _a(5bv32, 6bv32);\r\n call _a(5bv32, 7bv32);\r\n call _a(5bv32, 8bv32);\r\n call _a(7bv32, 8bv32);\r\n call _m(4bv32, 4bv32);\r\n call _a(10bv32, 12bv32);\r\n call _a(16bv32, 16bv32);\r\n call _s(32bv32, 1bv32);\r\n call _a(32bv32, 32bv32);\r\n call _s(64bv32, 1bv32);\r\n call _m(32bv32, 4bv32);\r\n call _s(128bv32, 1bv32);\r\n call _m(16bv32, 16bv32);\r\n call _s(256bv32, 1bv32);\r\n call _a(256bv32, 256bv32);\r\n call _a(512bv32, 512bv32);\r\n call _s(1024bv32, 1bv32);\r\n call _m(64bv32, 64bv32);\r\n call _s(4096bv32, 1bv32);\r\n call _m(256bv32, 256bv32);\r\n call _s(65536bv32, 1bv32);\r\n call _m(65536bv32, 256bv32);\r\n call _s(16777216bv32, 1bv32);\r\n call _m(65536bv32, 65535bv32);\r\n call _m(65536bv32, 512bv32);\r\n call _s(33554432bv32, 1bv32);\r\n call _a(33554432bv32, 33554432bv32);\r\n call _s(67108864bv32, 1bv32);\r\n call _m(33554432bv32, 64bv32);\r\n call _m(1024bv32, 1024bv32); \r\n call _s(1048576bv32, 1bv32); //- 0x000F FFFF\r\n call _m(1048575bv32, 4096bv32); //- 0xFFFF F000\r\n call _m(1048576bv32, 4bv32);\r\n}\r\n\r\natomic ghost procedure bit_helper()\r\n //- BV to Int\r\n ensures (forall i:bv32, val:bv32 :: {$get_bit(i, val)} (bit_index(I(i)) && word(I(val))) ==> GetBit(I(i), I(val)) == $get_bit(i, val));\r\n ensures (forall i:bv32, val:bv32 :: {$set_bit(i, val)} (bit_index(I(i)) && word(I(val))) ==> SetBit(I(i), I(val)) == I($set_bit(i, val)));\r\n ensures (forall i:bv32, val:bv32 :: {$clear_bit(i, val)} (bit_index(I(i)) && word(I(val))) ==> ClearBit(I(i), I(val)) == I($clear_bit(i, val)));\r\n ensures (forall i:bv32, val:bv32 :: {$clear_LSBs(i, val)} (bit_index(I(i)) && word(I(val))) ==> ClearLSBs(I(i), I(val)) == I($clear_LSBs(i, val)));\r\n ensures (forall i:bv32, val:bv32 :: {$select_LSBs(i, val)} (bit_index(I(i)) && word(I(val))) ==> SelectLSBs(I(i), I(val)) == I($select_LSBs(i, val)));\r\n //- Int to BV\r\n ensures (forall i:int, val:int :: {GetBit(i,val)} (bit_index(i) && word(val)) ==> GetBit(i, val) == $get_bit(B(i), B(val)));\r\n ensures (forall i:int, val:int :: {SetBit(i,val)} (bit_index(i) && word(val)) ==> SetBit(i, val) == I($set_bit(B(i), B(val))));\r\n ensures (forall i:int, val:int :: {ClearBit(i,val)} (bit_index(i) && word(val)) ==> ClearBit(i, val) == I($clear_bit(B(i), B(val))));\r\n ensures (forall i:int, val:int :: {ClearLSBs(i,val)} (bit_index(i) && word(val)) ==> ClearLSBs(i, val) == I($clear_LSBs(B(i), B(val))));\r\n ensures (forall i:int, val:int :: {SelectLSBs(i,val)} (bit_index(i) && word(val)) ==> SelectLSBs(i, val) == I($select_LSBs(B(i), B(val))));\r\n ensures (forall i:bv32, val1:bv32, val2:bv32 :: { $get_bit(i, $or(val1, val2)) }\r\n (bit_index(I(i)) && word(I(val1)) && word(I(val2))) ==> GetBit(I(i), or(I(val1), I(val2))) == $get_bit(i, $or(val1, val2)));\r\n ensures (forall i:bv32, j:bv32, val:bv32 :: { $get_bit(j, $clear_LSBs(i, val)) }\r\n (bit_index(I(i)) && bit_index(I(j)) && word(I(val))) ==> GetBit(I(j), ClearLSBs(I(i), I(val))) == $get_bit(j, $clear_LSBs(i, val)));\r\n ensures (forall i:bv32, j:bv32, val:bv32 :: { $get_bit(j, $select_LSBs(i, val)) }\r\n (bit_index(I(i)) && bit_index(I(j)) && word(I(val))) ==> GetBit(I(j), SelectLSBs(I(i), I(val))) == $get_bit(j, $select_LSBs(i, val)));\r\n{\r\n call helper();\r\n call __const();\r\n call _shl_1_ge_1();\r\n}\r\n\r\n\r\nimplementation alignment_is_mod4_lemma()\r\n{\r\n call __const();\r\n call _alignment_is_mod4_lemma();\r\n}\r\n\r\nimplementation alignment_4k_is_mod4096_lemma()\r\n{\r\n call __const();\r\n call _shl_1_ge_1();\r\n call bit_helper();\r\n call _clear_LSBs_lemma();\r\n call _alignment_4k_is_mod4096_lemma();\r\n}\r\n\r\nimplementation alignment_dominance_lemma($ptr:int) \r\n{ \r\n call helper();\r\n call __const();\r\n call _alignment_dominance_lemma(B($ptr));\r\n}\r\n\r\n// Note: Including a semicolon at the end of an implementation line (before the braces) causes BoogieAsm to freak out\r\nimplementation lower_bits_dont_matter_lemma($ptr:int, $bitPos:int)\r\n{\r\n call helper();\r\n call __const();\r\n call _shl_1_ge_1();\r\n call bit_helper();\r\n call _lower_bits_dont_matter_lemma(B($ptr), B($bitPos));\r\n}\r\n\r\n\r\nimplementation get_set_lemma()\r\n{\r\n call helper();\r\n call __const();\r\n call bit_helper();\r\n call _get_set_lemma();\r\n}\r\n\r\n\r\nimplementation clear_LSBs_lemma()\r\n{\r\n call helper();\r\n call __const();\r\n call _shl_1_ge_1();\r\n call bit_helper();\r\n call _clear_LSBs_lemma();\r\n}\r\n\r\nimplementation upper_bits_clear_ubound_lemma() \r\n{\r\n call __const();\r\n call _shl_1_ge_1();\r\n call bit_helper();\r\n call _upper_bits_clear_ubound_lemma();\r\n}\r\n\r\nimplementation upper_bits_clear_lbound_lemma() \r\n{\r\n call __const();\r\n call _upper_bits_clear_lbound_lemma();\r\n}\r\n\r\nimplementation clear_less_than_equal_lemma ()\r\n{ \r\n call __const();\r\n call _shl_1_ge_1();\r\n call bit_helper();\r\n call _clear_less_than_equal_lemma();\r\n}\r\n\r\nimplementation clear_12_lemma ()\r\n{\r\n call __const();\r\n call _shl_1_ge_1();\r\n call bit_helper();\r\n call helper();\r\n call _clear_12_lemma();\r\n\r\n// assert (forall ptr:int, lb:int, ub:int :: { between(lb, ub, ClearLSBs(12, ptr)) }\r\n// word(ptr) && word(lb) && word(ub) && aligned4k(lb) && aligned4k(ub) && \r\n// le(lb, ptr) && lt(ptr, ub) ==>\r\n// le(lb, ClearLSBs(12, ptr)) );\r\n}\r\n\r\n\r\nimplementation clear_select_consistent_lemma()\r\n{\r\n call __const();\r\n call _shl_1_ge_1();\r\n call bit_helper();\r\n call _clear_select_consistent_lemma();\r\n}\r\n\r\nimplementation select_non_negative_lemma() \r\n{\r\n call __const();\r\n call _shl_1_ge_1();\r\n call bit_helper();\r\n call _select_non_negative_lemma();\r\n}\r\n\r\n\r\nimplementation select_preserves_word_lemma()\r\n{\r\n call __const();\r\n call _select_preserves_word_lemma();\r\n}\r\n\r\nimplementation shr_decreases()\r\n{\r\n call helper();\r\n call __const();\r\n call bit_helper();\r\n call _shr_decreases();\r\n}\r\n\r\nimplementation and_bounds()\r\n{\r\n call helper();\r\n call __const();\r\n call bit_helper();\r\n call _and_bounds();\r\n}\r\n\r\nimplementation shr_preserves_word_lemma()\r\n{\r\n call __const();\r\n call _shr_preserves_word_lemma();\r\n}\r\n\r\nimplementation set_bit_preserves_word_lemma()\r\n{\r\n call __const();\r\n call __const();\r\n call bit_helper();\r\n //call _set_bit_preserves_word_lemma();\r\n}\r\n\r\nimplementation or_with_3_lemma() \r\n{\r\n call helper();\r\n call __const();\r\n call bit_helper();\r\n call _or_with_3_lemma();\r\n}\r\n\r\nimplementation or_with_7_lemma() \r\n{\r\n call helper();\r\n call __const();\r\n call bit_helper();\r\n call _or_with_7_lemma();\r\n}\r\n\r\nimplementation or_with_pow2_31_lemma() \r\n{\r\n call helper();\r\n call __const();\r\n call bit_helper();\r\n call _or_with_pow2_31_lemma();\r\n}\r\n\r\nimplementation pointer_pieces_lemma()\r\n{\r\n call helper();\r\n call __const();\r\n call _shl_1_ge_1();\r\n call bit_helper();\r\n call _upper_bits_clear_ubound_lemma();\r\n call _upper_bits_clear_lbound_lemma();\r\n call _pointer_pieces_lemma();\r\n}\r\n\r\nimplementation ptr_offsets_lemma() \r\n{\r\n call helper();\r\n call __const();\r\n call bit_helper();\r\n call _ptr_offsets_lemma();\r\n}\r\n\r\nimplementation ptr_reconstruction_lemma()\r\n{\r\n call helper();\r\n call __const();\r\n call bit_helper();\r\n call _ptr_reconstruction_lemma();\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/LogicalAddressing.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-private-import IntLemmasBase;\r\n//-private-import Partition;\r\n//-private-import Core;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n#ifdef x64\r\n #define IPSize 8\r\n#else\r\n #define IPSize 4\r\n#endif\r\n\r\nmodule interface LogicalAddressing\r\n{\r\n\r\nlinear var ptMem:mem;\r\n\r\nconst ?ptLo:int := ?memLo;\r\nconst ?ptHi:int := ?ptLo + 0x402000; //- 0x402000 = ?pageDirSize + ?numPDEs * ?pageTableSize + 4096 (padding to ensure 4k aligned)\r\n\r\nconst ?numPDEs:int := 1024;\r\nconst ?numPTEsPerTable:int := 1024;\r\n \r\nconst ?pageDirSize:int := 4096; //-?numPDEs * ?sizeofPDE; \r\nconst ?pageTableSize:int := 4096; //-?numPTEsPerTable * ?sizeofPTE; \r\nconst ?pageFrameSize:int := 4096; //- 4K \r\n\r\nfunction Aligned4k(ptr:int):bool { ClearLSBs(12, ptr) == ptr }\r\n\r\nfunction FlatSegmentationInv(seg_reg:SegmentRegister):bool\r\n{\r\n seg_reg.descriptor.segBase == 0\r\n && seg_reg.descriptor.segType == ?SegmentDescriptorTypeData\r\n}\r\n\r\nfunction in_guard_region(ptr:int):bool\r\n{\r\n le(0, ptr) && lt(ptr, 4096)\r\n}\r\n\r\n//function PciUninitialized(io:IOState):bool\r\n//{\r\n// (forall i:int :: {io._pci.PciConfigState[i]} io._pci.PciConfigState[i] == 0)\r\n//}\r\n\r\nfunction flat_page_mapping(mem:mem, base:int):bool;\r\nfunction only_user_accessible_pages(mem:mem, base:int, low:int, high:int):bool;\r\n\r\nprocedure fixupDS()\r\n inout my r:regs, my core_state:core_state, linear mem:mem;\r\n requires !init;\r\n requires !paging_enabled(core_state);\r\n requires (forall i:int::{memAddr(i)} ?memLo <= i && i < ?memHi ==> memAddr(i));\r\n requires ?memLo <= esp - 6*?SegmentDescriptorSize && esp <= ?memHi;\r\n requires Aligned(esp);\r\n requires (forall i:int :: { mem.dom[i] } \r\n esp - 24 <= i && i <= esp - 4 && Aligned(i) ==> mem.dom[i]);\r\n requires FlatSegmentationInv(core_state.seg_regs[SS]);\r\n// requires PciUninitialized(io);\r\n modifies mem, efl, ecx, edx, esp, core_state._gdt_regs, core_state._seg_regs;\r\n ensures FlatSegmentationInv(core_state.seg_regs[DS]);\r\n ensures FlatSegmentationInv(core_state.seg_regs[SS]);\r\n ensures !paging_enabled(core_state);\r\n ensures !init;\r\n ensures mem.dom == old(mem).dom;\r\n// ensures PciUninitialized(io);\r\n\r\natomic ghost procedure enableLogicalAddressing();\r\n inout my core_state:core_state, linear mem:mem;\r\n requires me == 0;\r\n requires !init;\r\n requires FlatSegmentationInv(core_state.seg_regs[DS]);\r\n requires FlatSegmentationInv(core_state.seg_regs[SS]);\r\n requires !paging_enabled(core_state);\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n\r\natomic ghost procedure logical_inv_is_flat();\r\n inout my core_state:core_state;\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n ensures FlatSegmentationInv(core_state.seg_regs[DS]);\r\n ensures FlatSegmentationInv(core_state.seg_regs[SS]);\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n\r\nfunction ptAddr(ptr:int):bool { between(?ptLo, ?ptHi, ptr) }\r\n\r\nfunction ptAddrOwned(ptMem:mem):bool \r\n{\r\n (forall addr:int :: { ptMem.dom[addr] } ptAddr(addr) ==> ptMem.dom[addr])\r\n}\r\n\r\nconst ptRoot:int := and(?memLo, 0xfffff000) + 0x1000;\r\n\r\nprocedure initPageTablePartition();\r\n inout my r:regs, my core_state:core_state, linear mem:mem;\r\n requires me == 0;\r\n requires !init;\r\n requires !paging_enabled(core_state);\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n // ensures (forall addr:int :: { $part.vars[ptOwner__id].dom[addr] } $part.vars[if ptAddr(addr) then ptOwner__id else me].dom[addr]);\r\n// ensures ptAddrOwned(ptMem);\r\n// ensures (forall i:int::{$part.vars[me].dom[i]} !ptAddr(i) ==> $part.vars[me].dom[i]);\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n\r\n//procedure enablePaging($base:int);\r\n// inout my r:regs, my core_state:core_state, linear mem:mem;\r\n// requires me == 0;\r\n// requires !init;\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// requires ptAddrOwned(ptMem);\r\n// requires $base == eax;\r\n// requires $base == ptRoot;\r\n// requires word($base) && ptAddr($base) && Aligned4k($base);\r\n// // Must be enough room for all the structures\r\n// requires ptAddr($base + ?pageDirSize + ?numPDEs * ?pageTableSize-1) && \r\n// word($base + ?pageDirSize + ?numPDEs * ?pageTableSize); \r\n// requires ValidPrePagingState(core_state.cregs[CR0]);\r\n// requires FlatSegmentationInv(core_state.seg_regs[DS]);\r\n// requires FlatSegmentationInv(core_state.seg_regs[SS]);\r\n// requires (forall i:int::{memAddr(i)} ?memLo <= i && i < ?memHi ==> memAddr(i));\r\n// requires lt(?ptHi, ?memHi);\r\n// modifies eax, ebx, ecx, edx, edi, esi, ptMem, mem;\r\n// ensures PageDirectoryBase(core_state.cregs[CR3]) == $base;\r\n// ensures flat_page_mapping(mem, core_state.cregs[CR3]);\r\n// ensures paging_enabled(core_state);\r\n// ensures logical_addressing_inv(true, ptMem, core_state);\r\n\r\nfunction logical_addressing_inv_priv(init:bool, core_state:core_state, ptMem:mem):bool;\r\n\r\nfunction logical_addressing_inv_base(init:bool, core_state:core_state, ptMem:mem):bool\r\n{\r\n logical_addressing_inv_priv(init, core_state, ptMem)\r\n}\r\n\r\nfunction logical_addressing_inv(init:bool, ptMem:mem, core_state:core_state):bool\r\n{\r\n logical_addressing_inv_base(init, core_state, ptMem)\r\n}\r\n\r\nfunction LogicalSrcOk(r:regs, core:core_state, m:mem, o:opn_mem):bool\r\n{\r\n EvalPtrOk(o)\r\n && PhysPtrOk(m, EvalPtr(r, o))\r\n && word(EvalPtr(r, o))\r\n && (paging_enabled(core) ==> !in_guard_region(EvalPtr(r, o)))\r\n}\r\n\r\nfunction LogicalDstOk(init:bool, r:regs, core:core_state, m:mem, o:opn_mem):bool\r\n{ \r\n EvalPtrOk(o)\r\n && PhysPtrOk(m, EvalPtr(r, o))\r\n && word(EvalPtr(r, o))\r\n && (init ==>\r\n !in_guard_region(EvalPtr(r, o))\r\n && !between(?ptLo, ?ptHi, EvalPtr(r, o))) //- Once paging is enabled, no more writing to the page tables\r\n}\r\n\r\nfunction LogicalEval(m:mem, r:regs, o:opn_mem):int\r\n{\r\n m.map[EvalPtr(r, o)]\r\n}\r\n\r\nfunction LogicalInOutUpdate(io:IOState):IOState\r\n{\r\n IOState(\r\n io._vga,\r\n io._keyboard,\r\n io._iom,\r\n io._pci,\r\n io._inCtr + 1,\r\n io._outCtr + 1\r\n )\r\n}\r\n\r\n//- Entirely ghost update\r\nfunction LogicalOutUpdate(io:IOState):IOState\r\n{\r\n IOState(\r\n io._vga,\r\n io._keyboard,\r\n io._iom,\r\n io._pci,\r\n io._inCtr,\r\n io._outCtr+1\r\n )\r\n}\r\n\r\n//-//////////////// Wrappers to hide paging complexity ///////////////////\r\n\r\natomic procedure logical_Add(inout my r:regs, x:int, y:opn);\r\n requires word(r.regs[x] + Eval(r, y));\r\n ensures r.regs == old(r.regs[x := r.regs[x] + Eval(r, y)]);\r\n ensures word(r.regs[x]);\r\n\r\natomic procedure logical_Sub(inout my r:regs, x:int, y:opn);\r\n requires word(r.regs[x] - Eval(r, y));\r\n ensures r.regs == old(r.regs[x := r.regs[x] - Eval(r, y)]);\r\n ensures word(r.regs[x]);\r\n\r\natomic procedure logical_Load(inout my r:regs, const my c:core_state, const linear m:mem, x:int, y:opn_mem);\r\n requires logical_addressing_inv(init, ptMem, c);\r\n requires LogicalSrcOk(r, c, m, y);\r\n ensures r.regs == old(r.regs[x := LogicalEval(m, r, y)]);\r\n ensures r.efl == old(r).efl;\r\n ensures word(r.regs[x]);\r\n ensures logical_addressing_inv(init, ptMem, c);\r\n\r\natomic procedure logical_Store(const my r:regs, const my c:core_state, inout linear m:mem, x:opn_mem, y:opn);\r\n requires logical_addressing_inv(init, ptMem, c);\r\n requires LogicalDstOk(init, r, c, m, x);\r\n requires SrcOk(y);\r\n ensures word(LogicalEval(m, r, x));\r\n ensures m == old(mem_update(m, EvalPtr(r, x), Eval(r, y)));\r\n\r\natomic procedure logical_SubLoad(inout my r:regs, const my c:core_state, const linear m:mem, x:int, y:opn_mem);\r\n requires logical_addressing_inv(init, ptMem, c);\r\n requires RegOk(x);\r\n requires LogicalSrcOk(r, c, m, y);\r\n requires word(r.regs[x] - LogicalEval(m, r, y));\r\n ensures r.regs == old(r.regs[x := r.regs[x] - LogicalEval(m, r, y)]);\r\n\r\natomic procedure logical_CmpLoad(inout my r:regs, const my c:core_state, const linear m:mem, x:opn_mem, y:opn);\r\n requires logical_addressing_inv(init, ptMem, c);\r\n requires LogicalSrcOk(r, c, m, x);\r\n requires SrcOk(y);\r\n ensures r.regs == old(r.regs);\r\n ensures r.efl == old(Efl_Cmp(r.efl, LogicalEval(m, r, x), Eval(r, y)));\r\n\r\n//atomic procedure logical_Cmpxchg(m:mem, core:core_state, ptr:opn_mem, val:opn) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// requires m == $State; modifies state;\r\n// requires LogicalDstOk(init, $part, me, core, ptr);\r\n// requires SrcOk(val);\r\n// ensures word(regs[EAX]);\r\n// ensures $State == let _efl:int := Efl_Cmp(core._efl, old(regs)[EAX], LogicalEval(m, core, ptr)) in\r\n// if old(regs)[EAX] == LogicalEval(m, core, ptr)\r\n// then LogicalInsUpdate1(m, ptr, Eval(r, val), _efl)\r\n// else LogicalInsUpdate1(m, OReg(EAX), LogicalEval(m, core, ptr), _efl);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n\r\n//atomic procedure logical_RoLoadU8(m:mem, core:core_state, x:opn, y:opn_mem) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// requires m == $State; modifies state;\r\n// requires DstOk(x);\r\n// requires inRo(EvalPtr(core, y), 1);\r\n// ensures word(_Eval(regs, x));\r\n// ensures _core == LogicalCoreUpdate1(core, x, roU8(EvalPtr(core, y)), core._efl);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_RoLoadS8(m:mem, core:core_state, x:opn, y:opn_mem) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// requires m == $State; modifies state;\r\n// requires DstOk(x);\r\n// requires inRo(EvalPtr(core, y), 1);\r\n// ensures word(_Eval(regs, x));\r\n// ensures (exists v:int:: asSigned(v) == roS8(EvalPtr(core, y))\r\n// && _core == LogicalCoreUpdate1(core, x, v, core._efl));\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_RoLoadU16(m:mem, core:core_state, x:opn, y:opn_mem) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// requires m == $State; modifies state;\r\n// requires DstOk(x);\r\n// requires inRo(EvalPtr(core, y), 2);\r\n// ensures word(_Eval(regs, x));\r\n// ensures _core == LogicalCoreUpdate1(core, x, roU16(EvalPtr(core, y)), core._efl);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_RoLoadS16(m:mem, core:core_state, x:opn, y:opn_mem) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// requires m == $State; modifies state;\r\n// requires DstOk(x);\r\n// requires inRo(EvalPtr(core, y), 2);\r\n// ensures word(_Eval(regs, x));\r\n// ensures (exists v:int:: asSigned(v) == roS16(EvalPtr(core, y))\r\n// && _core == LogicalCoreUpdate1(core, x, v, core._efl));\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_RoLoad32(m:mem, core:core_state, x:opn, y:opn_mem) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// requires m == $State; modifies state;\r\n// requires DstOk(x);\r\n// requires inRo(EvalPtr(core, y), 4);\r\n// ensures word(_Eval(regs, x));\r\n// ensures _core == LogicalCoreUpdate1(core, x, ro32(EvalPtr(core, y)), core._efl);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n\r\natomic procedure logical_Call(inout my r:regs, const my c:core_state, inout linear m:mem);\r\n requires logical_addressing_inv(init, ptMem, c);\r\n requires LogicalDstOk(init, r, c, m, OMem(MConst(esp - 4)));\r\n#ifdef x64\r\n requires LogicalDstOk(init, r, c, m, OMem(MConst(esp - 8)));\r\n#endif\r\n#ifdef x64\r\n ensures r.regs == old(r.regs[ESP := sub(r.regs[ESP], 8)])[TMP1 := m.map[esp]][TMP2 := m.map[esp + 4]];\r\n#else\r\n ensures r.regs == old(r.regs[ESP := sub(r.regs[ESP], 4)])[TMP1 := m.map[esp]];\r\n#endif\r\n#ifdef x64\r\n ensures m == mem_update(mem_update(old(m), esp, m.map[esp]), \r\n esp + 4, m.map[esp + 4]);\r\n#else\r\n ensures m == mem_update(old(m), r.regs[ESP], m.map[esp]);\r\n#endif\r\n\r\natomic procedure logical_Ret(inout my r:regs, const my c:core_state, const linear m:mem);\r\n requires logical_addressing_inv(init, ptMem, c);\r\n#ifdef x64\r\n requires RET == ReturnToAddr64(LogicalEval(m, r, OMem(MReg(ESP, 0))), LogicalEval(m, r, OMem(MReg(ESP, 4))));\r\n#else\r\n requires RET == ReturnToAddr32(LogicalEval(m, r, OMem(MReg(ESP, 0))));\r\n#endif\r\n requires LogicalSrcOk(r, c, m, OMem(MReg(ESP, 0)));\r\n#ifdef x64\r\n requires LogicalSrcOk(r, c, m, OMem(MReg(ESP, 4)));\r\n#endif\r\n ensures r.regs == old(r.regs[ESP := r.regs[ESP] + IPSize]);\r\n\r\n//atomic procedure logical_IRet(m:mem, core:core_state) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// requires m == $State; modifies state;\r\n// requires LogicalSrcOk(core, OMem(MReg(ESP, 0)));\r\n// requires LogicalSrcOk(core, OMem(MReg(ESP, 4)));\r\n// requires LogicalSrcOk(core, OMem(MReg(ESP, 8)));\r\n// requires RET == ReturnToInterrupted(\r\n// LogicalEval(m, core, OMem(MReg(ESP, 0))),\r\n// LogicalEval(m, core, OMem(MReg(ESP, 4))),\r\n// LogicalEval(m, core, OMem(MReg(ESP, 8))));\r\n// ensures _core == LogicalCoreUpdate1(\r\n// core,\r\n// OReg(ESP),\r\n// old(regs)[ESP]+12,\r\n// core._efl);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n\r\n//atomic procedure logical_ActivateDataSelector(s:state, core:core_state, index:int, descriptor:SegmentDescriptor, srcRegister:opn, dstRegister:int) returns (_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires ValidSegmentSelector(Eval(r, srcRegister), index);\r\n// requires ValidGdtDescriptor(core._ext._gdt_regs, index, descriptor, s._mem);\r\n// requires descriptor.segType == ?SegmentDescriptorTypeData;\r\n// requires SegRegOk(dstRegister) && dstRegister != CS;\r\n// //ensures _core == LogicalCoreUpdate0(core, core._efl);\r\n// ensures core_state == (let c:core_state := old(core_state) in\r\n// core_state(c._cregs, c._gdt_regs, c._seg_regs[dstRegister := SegmentRegister(index, descriptor)], c._caches));\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_LoadGDT(s:state, core:core_state, base:int, len:int, addr:opn_mem) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires 0 <= len && len < 8192;\r\n// requires word(base);\r\n// requires base >= ?memLo && base + len * ?SegmentDescriptorSize <= ?memHi;\r\n// requires PhysPtrOk(EvalPtr(r, addr)) && PhysPtrOk(EvalPtr(r, addr) + 4);\r\n// requires GdtParamsWord0(base, len) == s._mem[EvalPtr(r, addr)];\r\n// requires GdtParamsWord1(base, len) == s._mem[EvalPtr(r, addr) + 4];\r\n// ensures core_state == (let c:core_state := old(core_state) in\r\n// core_state(c._cregs, GDT_regs(base, len), c._seg_regs, c._caches));\r\n// //ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_ReadCR0(s:state, core:core_state, $dstReg:opn) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires DstOk($dstReg);\r\n// requires $dstReg is OReg;\r\n// ensures fresh_CR0_val(_Eval(regs, $dstReg));\r\n// ensures _core == LogicalCoreUpdate1(core, $dstReg, core._ext._cregs[CR0], core._efl);\r\n// ensures word(_Eval(regs, $dstReg));\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_WriteCR0(s:state, core:core_state, newCR0:opn) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires word(Eval(r, newCR0)); \r\n// requires SrcOk(newCR0);\r\n// requires ValidPrePagingState(core._ext._cregs[CR0]);\r\n// requires (exists $x:int :: { fresh_CR0_val($x) } \r\n// (Eval(r, newCR0) == SetBit(?CR0_paging_enabled, $x)) && fresh_CR0_val($x));\r\n// ensures core_state == (let c:core_state := old(core_state) in\r\n// core_state(c._cregs[CR0 := SetBit(?CR0_paging_enabled, c._cregs[CR0])],\r\n// c._gdt_regs, c._seg_regs, c._caches));\r\n// ensures _core == $State._cores[me];\r\n// //ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_HavocPagingCaches(s:state, core:core_state, c:core_state) returns(_s:state, _core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires c == core_state;\r\n// requires s == $State; modifies state;\r\n// requires paging_enabled(core) ==>\r\n// (forall $ptr:int, $dlabel:DTLB_label :: \r\n// word($ptr) ==> DTLBIsFreshWrtMemOneEntry(c._cregs[CR3], c._caches.DTLB, $dlabel, s._mem, $ptr) != <>());\r\n// requires paging_enabled(core) ==>\r\n// (forall $ptr:int, $dlabel:DTLB_label, $label:TLB_label :: \r\n// word($ptr) ==> TLBIsFreshWrtDTLBOneEntry(c._cregs[CR3], c._caches.DTLB, $dlabel, c._caches.TLB, $label, s._mem, $ptr) != <>());\r\n// ensures paging_enabled(core) ==>\r\n// core_state == core_state(c._cregs, c._gdt_regs, c._seg_regs,\r\n// paging_caches(_s._cores[me]._ext._caches.TLB, _s._cores[me]._ext._caches.DTLB,\r\n// c._caches.TLB_activeLabel, c._caches.DTLB_activeLabel));\r\n// ensures paging_enabled(core) ==>\r\n// (forall $ptr:int, $dlabel:DTLB_label ::\r\n// $State._cores[me]._ext._caches.DTLB[PteNumber($ptr)][$dlabel] == c._caches.DTLB[PteNumber($ptr)][$dlabel] ||\r\n// (word($ptr) ==> DTLBIsFreshWrtMemOneEntry(c._cregs[CR3], $State._cores[me]._ext._caches.DTLB, $dlabel, s._mem, $ptr).<>));\r\n// ensures paging_enabled(core) ==>\r\n// (forall $ptr:int, $label:TLB_label, $dlabel:DTLB_label :: \r\n// $State._cores[me]._ext._caches.TLB[PageNumber($ptr)][$label] == c._caches.TLB[PageNumber($ptr)][$label] ||\r\n// (word($ptr) ==> TLBIsFreshWrtDTLBOneEntry(c._cregs[CR3], c._caches.DTLB, $dlabel,\r\n// $State._cores[me]._ext._caches.TLB, $label, s._mem, $ptr).<>));\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_WriteCR3(s:state, core:core_state, newCR3:opn) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires SrcOk(newCR3);\r\n// requires ValidCR3(Eval(r, newCR3));\r\n// requires DTLBsAreFreshWrtMem(Eval(r, newCR3), core._ext._caches.DTLB, s._mem) != <>();\r\n// requires TLBsAreFreshWrtMem(Eval(r, newCR3), core._ext._caches.TLB, s._mem) != <>();\r\n// ensures core_state == (let c:core_state := old(core_state) in // Everything is the same, except CR3 and the TLB and DTLB\r\n// core_state(c._cregs[CR3 := Eval(r, newCR3)], c._gdt_regs, c._seg_regs,\r\n// paging_caches(_s._cores[me]._ext._caches.TLB, _s._cores[me]._ext._caches.DTLB,\r\n// c._caches.TLB_activeLabel, c._caches.DTLB_activeLabel)));\r\n// ensures _core == $State._cores[me];\r\n// ensures DTLBsAreFreshWrtMem(Eval(r, newCR3), $State._cores[me]._ext._caches.DTLB, s._mem) == <>(true);\r\n// ensures TLBsAreFreshWrtMem(Eval(r, newCR3), $State._cores[me]._ext._caches.TLB, s._mem) == <>(true);\r\n// //ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//// Specifies the INVLPG instruction\r\n//atomic procedure logical_InvalidatePagingCaches(s:state, core:core_state, ptr:opn_mem) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires word(EvalPtr(r, ptr));\r\n// requires DTLBsAreFreshWrtMem(core._ext._cregs[CR3], core._ext._caches.DTLB, s._mem) != <>();\r\n// requires TLBsAreFreshWrtMemOneEntry(core._ext._cregs[CR3], core._ext._caches.TLB, s._mem, EvalPtr(r, ptr)) != <>();\r\n// ensures core_state == (let c:core_state := old(core_state) in // Everything is the same, except the TLB and DTLB\r\n// core_state(c._cregs, c._gdt_regs, c._seg_regs,\r\n// paging_caches(_s._cores[me]._ext._caches.TLB, _s._cores[me]._ext._caches.DTLB,\r\n// c._caches.TLB_activeLabel, c._caches.DTLB_activeLabel)));\r\n// ensures DTLBsAreFreshWrtMem(core._ext._cregs[CR3], $State._cores[me]._ext._caches.DTLB, s._mem) == <>(true);\r\n// ensures TLBsAreFreshWrtMemOneEntry(core._ext._cregs[CR3], $State._cores[me]._ext._caches.TLB, s._mem, EvalPtr(r, ptr)) == <>(true);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_IdtStore(s:state, core:core_state, entry:int, offset:int, handler:int, ptr:opn_mem, val:opn) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires 0 <= entry && entry < ?NIdt;\r\n// requires SrcOk(val);\r\n// requires LogicalDstOk(init, $part, me, core, ptr);\r\n// requires (offset == 0 && Eval(r, val) == IdtWord0(handler)) || (offset == 4 && Eval(r, val) == IdtWord4(handler));\r\n// requires IsHandlerForEntry(entry, handler);\r\n// requires EvalPtr(r, ptr) == ?idtLo + 8 * entry + offset;\r\n// modifies $IdtMem, $IdtMemOk;\r\n// ensures $IdtMem == old($IdtMem)[EvalPtr(r, ptr) := Eval(r, val)];\r\n// ensures $IdtMemOk == old($IdtMemOk)[EvalPtr(r, ptr) := true];\r\n// ensures _core == LogicalCoreUpdate0(core, core._efl);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_Lidt(s:state, core:core_state, ptr:opn_mem) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires memAddr(EvalPtr(r, ptr)) && memAddr(EvalPtr(r, ptr) + 4);\r\n// requires Aligned(EvalPtr(r, ptr));\r\n// requires s._mem[EvalPtr(r, ptr)] == or(shl(?idtLo, 16), ?idtHi - ?idtLo - 1);\r\n// requires s._mem[EvalPtr(r, ptr) + 4] == shr(?idtLo, 16);\r\n// requires IdtMemOk($IdtMemOk);\r\n// modifies $IdtOk;\r\n// ensures $IdtOk;\r\n// ensures _core == LogicalCoreUpdate0(core, core._efl);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_VgaTextStore16(s:state, core:core_state, ptr:opn_mem, val:opn) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires SrcOk(val);\r\n// requires vgaAddr2(EvalPtr(r, ptr));\r\n// requires left_opn_mem(ptr) == right_opn_mem(ptr);\r\n// requires left_opn(val) == right_opn(val);\r\n// requires left(s._io._inCtr) == right(s._io._inCtr);\r\n// requires left(s._io._outCtr) == right(s._io._outCtr);\r\n// ensures $State == OutUpdate(VgaUpdate(s,\r\n// VgaState(\r\n// s._io._vga.VgaEvents[s._io._vga.VgaNextEvent := VgaTextStore(EvalPtr(r, ptr), Eval(r, val))],\r\n// s._io._vga.VgaNextEvent + 1\r\n// )));\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_VgaDebugStore16(s:state, core:core_state, ptr:opn_mem, val:opn) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires SrcOk(val);\r\n// requires vgaAddr2(EvalPtr(r, ptr));\r\n// requires ?VgaTextLo <= EvalPtr(r, ptr) && EvalPtr(r, ptr) <= ?VgaTextLo + 158;\r\n// ensures _core == LogicalCoreUpdate0(core, core._efl);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_IomStore(s:state, core:core_state, ptr:opn_mem, val:opn) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires iomAddr(EvalPtr(r, ptr));\r\n// requires Aligned(EvalPtr(r, ptr));\r\n// requires word(Eval(r, val));\r\n// requires SrcOk(val);\r\n// //requires LogicalDstOk(init, $part, me, core, ptr);\r\n// requires !s._io._iom.IomFrozen;\r\n// ensures $State == IomUpdate(s,\r\n// IomState(\r\n// s._io._iom.IomMem[EvalPtr(r, ptr) := Eval(r, val)],\r\n// s._io._iom.IomFrozen,\r\n// s._io._iom.IoMmuState,\r\n// s._io._iom.IoMmuEnabled,\r\n// s._io._iom.DevEnabled\r\n// ));\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_IomRegLoad(s:state, core:core_state, entry:int, val:opn, ptr:opn_mem) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires EvalPtr(r, ptr) == ?DrhdRegs[entry] + 28\r\n// || EvalPtr(r, ptr) == ?DrhdRegs[entry] + 0\r\n// || EvalPtr(r, ptr) == ?DrhdRegs[entry] + 8\r\n// || EvalPtr(r, ptr) == ?DrhdRegs[entry] + 12;\r\n// requires DstOk(val);\r\n// ensures word(_Eval(regs, val));\r\n// ensures (exists v:int::{InsUpdate1(me, s, val, v, core._efl)} _core == LogicalCoreUpdate1(core, val, v, core._efl));\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_IomRegStore(s:state, core:core_state, entry:int, ptr:opn_mem, val:opn) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires SrcOk(val);\r\n// requires (s._io._iom.IoMmuState[entry] == 0 && EvalPtr(r, ptr) == ?DrhdRegs[entry] + 32 && IoRootTable(s._io._iom.IomMem, Eval(r, val)))\r\n// || (s._io._iom.IoMmuState[entry] == 1 && EvalPtr(r, ptr) == ?DrhdRegs[entry] + 36 && Eval(r, val) == 0)\r\n// || (s._io._iom.IoMmuState[entry] == 2 && EvalPtr(r, ptr) == ?DrhdRegs[entry] + 24 && Eval(r, val) == shl(1, 30))\r\n// || (s._io._iom.IoMmuState[entry] == 3 && EvalPtr(r, ptr) == ?DrhdRegs[entry] + 24 && Eval(r, val) == shl(1, 31));\r\n// ensures $State == IomUpdate(s,\r\n// IomState(\r\n// s._io._iom.IomMem,\r\n// true,\r\n// s._io._iom.IoMmuState[entry := 1 + s._io._iom.IoMmuState[entry]],\r\n// s._io._iom.IoMmuEnabled,\r\n// s._io._iom.DevEnabled\r\n// ));\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_PciMemLoad32(s:state, core:core_state, id:int, val:opn, ptr:opn_mem) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires s._io._pci.PciConfigState[id] == 4;\r\n// requires PciMemAddr(id) <= EvalPtr(r, ptr) && EvalPtr(r, ptr) + 4 <= PciMemAddr(id) + PciMemSize(id);\r\n// requires DstOk(val);\r\n// requires left(s._io._inCtr) == right(s._io._inCtr);\r\n// requires left(s._io._outCtr) == right(s._io._outCtr);\r\n// requires EvalPtr(left_array(old(regs)), left_opn_mem(ptr)) == EvalPtr(right_array(old(regs)), right_opn_mem(ptr)); // Secret vals shouldn't affect addr we read on bus\r\n// ensures PciMemLoaded(id, EvalPtr(r, ptr), _Eval(regs, val));\r\n// ensures word(_Eval(regs, val));\r\n// ensures (exists v:int:: {InsUpdate1(me, s, val, v, core._efl)} \r\n// _core == LogicalCoreUpdate1(core, val, v, core._efl)\r\n// && word(v)\r\n// && left(v) == right(v));\r\n// ensures state._io == LogicalInOutUpdate(s._io);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_PciMemStore32(s:state, core:core_state, id:int, ptr:opn_mem, src:opn) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// requires s._io._pci.PciConfigState[id] == 4;\r\n// requires PciMemAddr(id) <= EvalPtr(r, ptr) && EvalPtr(r, ptr) + 4 <= PciMemAddr(id) + PciMemSize(id);\r\n// requires word(Eval(r, src));\r\n// requires left(s._io._inCtr) == right(s._io._inCtr);\r\n// requires left(s._io._outCtr) == right(s._io._outCtr);\r\n// requires EvalPtr(left_array(old(regs)), left_opn_mem(ptr)) == EvalPtr(right_array(old(regs)), right_opn_mem(ptr)); // Secret vals shouldn't affect addr we write on bus\r\n// requires _Eval(left_array(old(regs)), left_opn(src)) == _Eval(right_array(old(regs)), right_opn(src)); // nor the value itself\r\n// requires SrcOk(src);\r\n// ensures PciMemStored(id, EvalPtr(r, ptr), Eval(r, src));\r\n// ensures _core == LogicalCoreUpdate0(core, core._efl);\r\n// ensures state._io == LogicalOutUpdate(s._io);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_DeviceLoad(s:state, core:core_state, dst:opn, ptr:opn_mem) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// //requires s._io._iom.DevEnabled;\r\n// requires ?devMemLo <= EvalPtr(r, ptr) && EvalPtr(r, ptr) + 4 <= ?devMemHi;\r\n// requires DstOk(dst);\r\n// requires left(s._io._inCtr) == right(s._io._inCtr);\r\n// requires left(s._io._outCtr) == right(s._io._outCtr);\r\n// requires EvalPtr(left_array(old(regs)), left_opn_mem(ptr)) == EvalPtr(right_array(old(regs)), right_opn_mem(ptr)); // Secret vals shouldn't affect addr we read on bus\r\n// requires dst is OReg;\r\n// ensures (exists v:int:: // Since addr we read is publicly visible, this is both an In and Out event\r\n// _core == LogicalCoreUpdate1(core, dst, v, s._cores[me]._efl)\r\n// && word(v)\r\n// && left(v) == right(v));\r\n// ensures state._io == LogicalInOutUpdate(s._io);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_DeviceStore(s:state, core:core_state, ptr:opn_mem, src:opn, send_auth_word:bool, auth_word_index:int, \r\n// packet:[int]int) returns(_core:core_state);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State; modifies state;\r\n// //requires s._io._iom.DevEnabled;\r\n// requires src is OReg || src is OConst;\r\n// requires ?devMemLo <= EvalPtr(r, ptr) && EvalPtr(r, ptr) + 4 <= ?devMemHi;\r\n// requires SrcOk(src);\r\n// requires left(s._io._inCtr) == right(s._io._inCtr);\r\n// requires left(s._io._outCtr) == right(s._io._outCtr);\r\n// requires left_b(send_auth_word) == right_b(send_auth_word);\r\n// requires left(auth_word_index) == right(auth_word_index);\r\n// requires EvalPtr(left_array(old(regs)), left_opn_mem(ptr)) == EvalPtr(right_array(old(regs)), right_opn_mem(ptr)); // Secret vals shouldn't affect addr we write on bus\r\n// requires !send_auth_word ==> _Eval(left_array(old(regs)), left_opn(src)) == _Eval(right_array(old(regs)), right_opn(src)); // nor the value itself\r\n// requires send_auth_word ==> \r\n// 0 <= auth_word_index && auth_word_index < ?wordsPerPacket \r\n// && app_approves_disclosure(left_array(packet), right_array(packet), ?wordsPerPacket)\r\n// && left_array (packet)[left (auth_word_index)] == _Eval( left_array(old(regs)), left_opn (src))\r\n// && right_array(packet)[right(auth_word_index)] == _Eval(right_array(old(regs)), right_opn(src));\r\n// ensures _core == LogicalCoreUpdate0(core, core._efl);\r\n// ensures state._io == LogicalOutUpdate(s._io);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n//\r\n//atomic procedure logical_StoreShared(s:state, core:core_state, linear owner:int, x:opn_mem, y:opn) returns(_core:core_state, linear _owner:int);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State;\r\n// requires LogicalDstOk(init, $part, owner, core, x);\r\n// requires SrcOk(y);\r\n// modifies state, efl, $part;\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n// ensures _owner == owner;\r\n// ensures _core == core;\r\n// ensures $part == LogicalPartUpdate1(old($part), owner, core, x, Eval(r, y));\r\n// ensures word(LogicalEval($State, _core, x));\r\n//\r\n//atomic procedure logical_CmpxchgShared(s:state, core:core_state, linear owner:int, ptr:opn_mem, val:opn) returns(_core:core_state, linear _owner:int);\r\n// requires logical_addressing_inv(init, s, ptMem, core_state);\r\n// requires s == $State;\r\n// requires LogicalDstOk(init, $part, owner, core, ptr);\r\n// requires SrcOk(val);\r\n// modifies state, efl, $part;\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n// ensures word(regs[EAX]);\r\n// ensures let _efl:int := Efl_Cmp(core._efl, old(regs)[EAX], LogicalEval(s, core, ptr)) in\r\n// if old(regs)[EAX] == LogicalEval(s, core, ptr)\r\n// then _core == LogicalCoreUpdate1(core, ptr, Eval(r, val), _efl)\r\n// && $part == LogicalPartUpdate1(old($part), owner, core, ptr, Eval(r, val))\r\n// else _core == LogicalCoreUpdate1(core, OReg(EAX), LogicalEval(s, core, ptr), _efl)\r\n// && $part == LogicalPartUpdate1(old($part), owner, core, OReg(EAX), LogicalEval(s, core, ptr));\r\n\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/LogicalAddressing.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import IntLemmasBase;\r\n//-private-import Partition;\r\n//-private-import Core;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation LogicalAddressing\r\n{\r\n\r\n//-//////////////// Basic function definitions ///////////////////\r\n\r\nfunction implementation flat_page_mapping(mem:mem, base:int):bool\r\n{\r\n (forall ptr:int :: {PDEaddr(base, ptr)} {LoadPhysical(mem, PDEaddr(base, ptr))}\r\n word(ptr) ==>\r\n LoadPhysical(mem, PDEaddr(base, ptr)) != <>()\r\n && WordToPageEntry(LoadPhysical(mem, PDEaddr(base, ptr)).<>) != <>())\r\n && (forall ptr:int :: {WordToPageEntry(LoadPhysical(mem, PDEaddr(base, ptr)).<>).<>}\r\n (word(ptr) && !in_guard_region(ptr)) ==>\r\n let pde:PageEntry := WordToPageEntry(LoadPhysical(mem, PDEaddr(base, ptr)).<>).<> in\r\n pde.present == ?Present && pde.write == ?Write)\r\n && (forall ptr:int :: {WordToPageEntry(LoadPhysical(mem, PDEaddr(base, ptr)).<>).<>}\r\n word(ptr) ==>\r\n let pde:PageEntry := WordToPageEntry(LoadPhysical(mem,PDEaddr(base, ptr)).<>).<> in\r\n LoadPhysical(mem, PTEaddr(pde, ptr)) != <>()\r\n && WordToPageEntry(LoadPhysical(mem, PTEaddr(pde, ptr)).<>) != <>())\r\n && (forall ptr:int :: {WordToPageEntry(LoadPhysical(mem, PDEaddr(base, ptr)).<>).<>}\r\n (word(ptr) && !in_guard_region(ptr) ==>\r\n let pde:PageEntry := WordToPageEntry(LoadPhysical(mem, PDEaddr(base, ptr)).<>).<> in\r\n let pte:PageEntry := WordToPageEntry(LoadPhysical(mem, PTEaddr(pde, ptr)).<>).<> in\r\n pte.base == ClearLSBs(12, ptr) && pte.present == ?Present && pte.write == ?Write ))\r\n && (forall ptr:int :: {WordToPageEntry(LoadPhysical(mem, PDEaddr(base, ptr)).<>).<>}\r\n (word(ptr) && in_guard_region(ptr)) ==>\r\n let pde:PageEntry := WordToPageEntry(LoadPhysical(mem, PDEaddr(base, ptr)).<>).<> in\r\n let pte:PageEntry := WordToPageEntry(LoadPhysical(mem,PTEaddr(pde, ptr)).<>).<> in\r\n pte.present == ?Absent)\r\n && (forall ptr:int, TLB:[int][TLB_label]PageEntry, cacheLabel:TLB_label ::\r\n {PageMap(ptr, ?System, ?Write, TLB, cacheLabel).<>}\r\n (TLBsAreFreshWrtMem(base, TLB, mem) == <>(true)\r\n && PageMap(ptr, ?System, ?Write, TLB, cacheLabel) != <>()\r\n && word(ptr))\r\n ==> PageMap(ptr, ?System, ?Write, TLB, cacheLabel).<> == ptr)\r\n && (forall ptr:int, TLB:[int][TLB_label]PageEntry, cacheLabel:TLB_label ::\r\n {PageMap(ptr, ?System, ?Read, TLB, cacheLabel).<>}\r\n (TLBsAreFreshWrtMem(base, TLB, mem) == <>(true)\r\n && PageMap(ptr, ?System, ?Read, TLB, cacheLabel) != <>()\r\n && word(ptr))\r\n ==> PageMap(ptr, ?System, ?Read, TLB, cacheLabel).<> == ptr)\r\n}\r\n\r\nfunction in_user_region(ptr:int, low:int, high:int):bool\r\n{\r\n between(low, high, ptr)\r\n}\r\n\r\nfunction implementation only_user_accessible_pages(mem:mem, base:int, low:int, high:int):bool\r\n{\r\n (forall ptr:int :: {WordToPageEntry(mem[PDEaddr(base, ptr)]).<>}\r\n let pde:PageEntry := WordToPageEntry(mem[PDEaddr(base, ptr)]).<> in\r\n let pte:PageEntry := WordToPageEntry(mem[PTEaddr(pde, ptr)]).<> in\r\n word(ptr) && in_user_region(ptr, low, high) ==> pte.user == ?User)\r\n && (forall ptr:int :: {WordToPageEntry(mem[PDEaddr(base, ptr)]).<>}\r\n let pde:PageEntry := WordToPageEntry(mem[PDEaddr(base, ptr)]).<> in\r\n let pte:PageEntry := WordToPageEntry(mem[PTEaddr(pde, ptr)]).<> in\r\n word(ptr) && !in_user_region(ptr, low, high) && !in_guard_region(ptr) ==> pte.user == ?System)\r\n}\r\n\r\n//- Ensures all page table structures lie in the [?ptLo, ?ptHi) region, where they'll be safe\r\nfunction page_tables_correctly_situated(mem:mem, cr3:int):bool\r\n{\r\n (forall ptr:int :: { PDEaddr(cr3, ptr) }\r\n word(ptr) ==> between(?ptLo, ?ptHi, PDEaddr(cr3, ptr)))\r\n && (forall ptr:int :: { WordToPageEntry(LoadPhysical(mem,PDEaddr(cr3, ptr)).<>).<> }\r\n word(ptr) ==>\r\n let pde:PageEntry := WordToPageEntry(LoadPhysical(mem,PDEaddr(cr3, ptr)).<>).<> in\r\n between(?ptLo, ?ptHi, PTEaddr(pde, ptr)))\r\n}\r\n\r\nfunction LA(init:bool, core_state:core_state, ptMem:mem):bool { LA_priv(init, core_state, ptMem) }\r\nfunction LA_priv(init:bool, core_state:core_state, ptMem:mem):bool { true }\r\n\r\n//- Per-core invariant\r\nfunction logical_addressing_inv_core(init:bool, core_state:core_state, ptMem:mem):bool\r\n{\r\n FlatSegmentationInv(core_state.seg_regs[SS])\r\n && FlatSegmentationInv(core_state.seg_regs[DS])\r\n && (paging_enabled(core_state) ==>\r\n init\r\n && core_state.cregs[CR3] == ptRoot\r\n && DTLBsAreFreshWrtMem(core_state.cregs[CR3], core_state.caches.DTLB, ptMem) == <>(true)\r\n && TLBsAreFreshWrtMem(core_state.cregs[CR3], core_state.caches.TLB, ptMem) == <>(true) \r\n )\r\n}\r\n\r\n//- Invariant across all cores\r\nfunction logical_addressing_inv_shared(init:bool, cr3:int, ptMem:mem):bool\r\n{\r\n init ==>\r\n ptAddrOwned(ptMem)\r\n && flat_page_mapping(ptMem, cr3)\r\n && page_tables_correctly_situated(ptMem, cr3)\r\n && (forall dtlb:[int][DTLB_label]PageEntry:: DTLBsAreFreshWrtMem(cr3, dtlb, ptMem) != <>())\r\n && (forall tlb:[int][ TLB_label]PageEntry:: TLBsAreFreshWrtMem(cr3, tlb, ptMem) != <>())\r\n}\r\n\r\nfunction implementation { LA_priv(init, core_state, ptMem) } logical_addressing_inv_priv(init:bool, core_state:core_state, ptMem:mem): bool\r\n{\r\n logical_addressing_inv_core(init, core_state, ptMem)\r\n && logical_addressing_inv_shared(init, ptRoot, ptMem)\r\n}\r\n\r\nimplementation enableLogicalAddressing() { assert(LA(init, core_state, ptMem)); }\r\n\r\nimplementation logical_inv_is_flat() { assert(LA(init, core_state, ptMem)); } \r\n\r\n\r\nfunction flat_PTE_index($ptr:int) returns (int)\r\n{\r\n add(mul(PageDirectoryOffset($ptr), 1024), PageTableOffset($ptr))\r\n}\r\n\r\n// REVIEW: Merge PDE_index_to_addr with PTE_index_to_addr?\r\nfunction PDE_index_to_addr($base:int, $page_dir_index:int) returns (int)\r\n{\r\n add($base, mul(?sizeofPDE, $page_dir_index))\r\n}\r\n\r\nfunction PTE_index_to_addr($base:int, $pte_index:int) returns (int)\r\n{\r\n add($base, mul(?sizeofPTE, $pte_index))\r\n}\r\n\r\nfunction page_table_index_to_addr($page_tables_base:int, $page_table_index:int) returns (int)\r\n{\r\n add($page_tables_base, mul(?pageTableSize, $page_table_index))\r\n}\r\n\r\nconst ?totalPTEs:int := 0x100000; //-?numPTEsPerTable * ?numPDEs;\r\n\r\nfunction constants_correct() returns (bool)\r\n{\r\n ?totalPTEs == ?numPTEsPerTable * ?numPDEs &&\r\n ?pageDirSize == ?numPDEs * ?sizeofPDE &&\r\n ?pageTableSize == ?numPTEsPerTable * ?sizeofPTE\r\n}\r\n\r\n\r\n//-//////////////// Wrappers to hide paging complexity ///////////////////\r\n\r\natomic ghost procedure logical_abstraction_lemma()\r\n// ensures (forall p:partition, owner:int, dst:opn_mem, s:state, core:core_state :: { logical_addressing_inv_base(init, s, ptMem), LogicalDstOk(p, owner, regs, core, dst) } \r\n// LA(me, init, s, ptMem) && core == s._cores[me] && logical_addressing_inv_base(init, s, ptMem) && LogicalDstOk(p, owner, regs, core, dst) ==> PartDstOk(regs, core, p, owner, s, dst));\r\n// ensures (forall src:opn_mem, s:state :: { _MemSrcOk(regs, core_state, s, src) }\r\n// LA(me, init, s, ptMem) && logical_addressing_inv_base(init, s, ptMem) && LogicalSrcOk(regs, core_state, src) ==> _MemSrcOk(regs, core_state, s, src));\r\n// ensures (forall o:opn_mem, s:state, core:core_state :: { LogicalEval(s, regs, o), LogicalSrcOk(regs, core, o) } \r\n// LA(me, init, s, ptMem) && core == s._cores[me] && logical_addressing_inv_base(init, s, ptMem) && LogicalSrcOk(regs, core, o) ==> LogicalEval(s, regs, o) == _EvalMem(regs, core_state, s, o));\r\n// ensures (forall p:partition, owner:int, o:opn_mem, s:state, core:core_state :: { LogicalEval(s, regs, o), LogicalDstOk(p, owner, regs, core, o) } \r\n// LA(me, init, s, ptMem) && core == s._cores[me] && logical_addressing_inv_base(init, s, ptMem) && LogicalDstOk(p, owner, regs, core, o) ==> LogicalEval(s, regs, o) == _EvalMem(regs, core_state, s, o));\r\n// ensures (forall s:state, _efl:int :: { logical_addressing_inv_base(init, s, ptMem) }\r\n// LA(me, init, s, ptMem) && LA(me, init, s, ptMem) && logical_addressing_inv_base(init, s, ptMem) ==> \r\n// logical_addressing_inv_base(init, s, ptMem) );\r\n// ensures (forall dst:opn_mem, val:int, s:state, _efl:int :: \r\n// { MemUpdate1(regs, core_state, s, dst, val) }\r\n// LA(me, init, s, ptMem)\r\n// && logical_addressing_inv_base(init, s, ptMem)\r\n// && LogicalDstOk(init, $part, me, regs, core_state, dst)\r\n// // && LA(me, init, LogicalInsUpdate1(s, dst, val, _efl))\r\n// && LA(me, init, MemUpdate1(regs, core_state, s, dst, val), ptMem) ==>\r\n// logical_addressing_inv_base(init, MemUpdate1(regs, core_state, s, dst, val), ptMem)\r\n// //&& s._cores[me] == MemUpdate1(regs, core_state, s, dst, val)._cores[me]\r\n// && LogicalPartUpdate1($part, me, regs, dst, val) == PartUpdate1($part, me, regs, core_state, dst, val)\r\n// && (word(_EvalMem(regs, core_state, MemUpdate1(regs, core_state, s, dst, val), dst)) ==>\r\n// word(LogicalEval(MemUpdate1(regs, core_state, s, dst, val), MemUpdate1(regs, core_state, s, dst, val)._cores[me], dst))));\r\n{\r\n}\r\n\r\nimplementation logical_Add(inout my r:regs, x:int, y:opn)\r\n{\r\n call r := instr_Add(r, x, y);\r\n call reveal_WORD_HI();\r\n call reveal_wrap32(old(r.regs[x] + Eval(r, y)));\r\nvar dummy:regs := old(r);\r\n}\r\n\r\nimplementation logical_Sub(inout my r:regs, x:int, y:opn)\r\n{\r\n call r := instr_Sub(r, x, y);\r\n call reveal_WORD_HI();\r\n call reveal_wrap32(old(r.regs[x] - Eval(r, y)));\r\n}\r\n\r\n////implementation logical_Cmpxchg(m:mem, core:core_state, ptr:opn_mem, val:opn) returns(_core:core_state) { call logical_abstraction_lemma(); call core_Cmpxchg(m, ptr, val); _core := $State._cores[me]; }\r\n//implementation logical_RoLoadU8(m:mem, core:core_state, x:opn, y:opn_mem) returns(_core:core_state) { call logical_abstraction_lemma(); call core_RoLoadU8(m, x, y); _core := $State._cores[me]; }\r\n//implementation logical_RoLoadS8(m:mem, core:core_state, x:opn, y:opn_mem) returns(_core:core_state) { call logical_abstraction_lemma(); call core_RoLoadS8(m, x, y); _core := $State._cores[me]; }\r\n//implementation logical_RoLoadU16(m:mem, core:core_state, x:opn, y:opn_mem) returns(_core:core_state) { call logical_abstraction_lemma(); call core_RoLoadU16(m, x, y); _core := $State._cores[me]; }\r\n//implementation logical_RoLoadS16(m:mem, core:core_state, x:opn, y:opn_mem) returns(_core:core_state) { call logical_abstraction_lemma(); call core_RoLoadS16(m, x, y); _core := $State._cores[me]; }\r\n//implementation logical_RoLoad32(m:mem, core:core_state, x:opn, y:opn_mem) returns(_core:core_state) { call logical_abstraction_lemma(); call core_RoLoad32(m, x, y); _core := $State._cores[me]; }\r\n\r\nimplementation logical_Load(inout my r:regs, const my c:core_state, const linear m:mem, x:int, y:opn_mem)\r\n{\r\n assert LA(init, c, ptMem);\r\n call r := instr_Load(r, c, m, x, y);\r\n}\r\n\r\nimplementation logical_Store(const my r:regs, const my c:core_state, inout linear m:mem, x:opn_mem, y:opn)\r\n{\r\n assert LA(init, c, ptMem);\r\n call m := instr_Store(r, c, m, x, y);\r\n assert LA(init, c, ptMem);\r\n}\r\n\r\nimplementation logical_SubLoad(inout my r:regs, const my c:core_state, const linear m:mem, x:int, y:opn_mem)\r\n{\r\n assert LA(init, c, ptMem);\r\n {:\r\n call r := instr_Load(r, c, m, TMP1, y);\r\n call r := instr_Sub(r, x, OReg(TMP1));\r\n :}\r\n call reveal_WORD_HI();\r\n call reveal_wrap32(old(r.regs[x] - LogicalEval(m, r, y)));\r\n call r := instr_DropTempRegs(r, old(r).regs[x := r.regs[x]]);\r\n}\r\n\r\nimplementation logical_CmpLoad(inout my r:regs, const my c:core_state, const linear m:mem, x:opn_mem, y:opn)\r\n{\r\n assert LA(init, c, ptMem);\r\n {:\r\n call r := instr_Load(r, c, m, TMP1, x);\r\n call r := instr_Cmp(r, TMP1, y);\r\n :}\r\n call r := instr_DropTempRegs(r, old(r.regs));\r\n}\r\n\r\nimplementation logical_Call(inout my r:regs, const my c:core_state, inout linear m:mem)\r\n{\r\n assert LA(init, c, ptMem);\r\n call reveal_wrap32(esp - 4);\r\n call reveal_WORD_HI();\r\n call memAddrBounds(esp - 4);\r\n\r\n#ifdef x64\r\n call reveal_wrap32(esp - 8);\r\n call memAddrBounds(esp - 8);\r\n#endif\r\n\r\n assert LA(init, c, ptMem);\r\n {:\r\n call r := instr_SubNoFlags(r, ESP, OConst(IPSize));\r\n#ifdef x64\r\n call r := instr_MovNextEip64(r, TMP1, TMP2);\r\n#else\r\n call r := instr_MovNextEip32(r, TMP1);\r\n#endif\r\n call m := instr_StoreStack(r, c, m, OMem(MReg(ESP, 0)), OReg(TMP1));\r\n#ifdef x64\r\n call m := instr_StoreStack(r, c, m, OMem(MReg(ESP, 4)), OReg(TMP2));\r\n#endif\r\n :}\r\n assert LA(init, c, ptMem);\r\n// call _r := instr_DropTempRegs(_r, r.regs[ESP := _r.regs[ESP]]);\r\n}\r\n\r\n\r\nimplementation logical_Ret(inout my r:regs, const my c:core_state, const linear m:mem)\r\n{\r\n assert LA(init, c, ptMem);\r\n call reveal_wrap32(esp + 4);\r\n#ifdef x64\r\n call reveal_wrap32(esp + 8);\r\n#endif\r\n call reveal_WORD_HI();\r\n call memDomIsMemAddr(m, esp);\r\n#ifdef x64\r\n call memDomIsMemAddr(m, esp + 4);\r\n#endif\r\n call memAddrBounds(esp);\r\n#ifdef x64\r\n call memAddrBounds(esp + 4);\r\n#endif\r\n assert LA(init, c, ptMem);\r\n {:\r\n call r := instr_LoadStack(r, c, m, TMP1, OMem(MReg(ESP, 0)));\r\n#ifdef x64\r\n call r := instr_LoadStack(r, c, m, TMP2, OMem(MReg(ESP, 4)));\r\n#endif\r\n call r := instr_AddNoFlags(r, ESP, OConst(IPSize));\r\n call instr_Ret(r);\r\n call r := instr_DropTempRegs(r, old(r).regs[ESP := r.regs[ESP]]);\r\n :}\r\n assert LA(init, c, ptMem);\r\n}\r\n\r\n//implementation logical_IRet(m:mem, core:core_state) returns(_core:core_state) { call logical_abstraction_lemma(); call core_IRet(m); _core := $State._cores[me]; }\r\n//implementation logical_LoadGDT(s:state, core:core_state, base:int, len:int, addr:opn_mem) returns(_core:core_state) { call logical_abstraction_lemma(); call core_LoadGDT(s, base, len, addr); _core := $State._cores[me]; }\r\n//implementation logical_ReadCR0(s:state, core:core_state, $dstReg:opn) returns(_core:core_state) { call logical_abstraction_lemma(); call core_ReadCR0(s, $dstReg); _core := $State._cores[me]; }\r\n//implementation logical_WriteCR0(s:state, core:core_state, newCR0:opn) returns(_core:core_state) { call logical_abstraction_lemma(); call core_WriteCR0(s, newCR0); _core := $State._cores[me]; }\r\n//implementation logical_WriteCR3(s:state, core:core_state, newCR3:opn) returns(_core:core_state) { call logical_abstraction_lemma(); call core_WriteCR3(s, newCR3); _core := $State._cores[me]; }\r\n//implementation logical_InvalidatePagingCaches(s:state, core:core_state, ptr:opn_mem) returns(_core:core_state) { \r\n// assert(LA(me, init, s));\r\n//// assert(forall $ptr:int :: { WordToPageEntry(LoadPhysical(s._mem,PDEaddr(core_state._cregs[CR3], $ptr)).<>) }\r\n//// paging_enabled(s._cores[me]) && word($ptr) ==> \r\n//// WordToPageEntry(LoadPhysical(s._mem,PDEaddr(core_state._cregs[CR3], $ptr)).<>) != <>() );\r\n////\r\n//\r\n// call logical_abstraction_lemma(); call core_InvalidatePagingCaches(s, ptr); \r\n//\r\n// assert (forall ptr:int :: word(ptr) ==> mem.map[ptr] == s._mem[ptr]);\r\n//\r\n// assert(LA(me, init, s));\r\n// assert(LA(me, init, $State));\r\n//\r\n// assert(forall $ptr:int :: { LoadPhysical(mem.map,PDEaddr($State._cores[me]._ext._cregs[CR3], $ptr)) }\r\n// word($ptr) ==> LoadPhysical(s._mem,PDEaddr(core_state._cregs[CR3], $ptr)) == \r\n// LoadPhysical(mem.map,PDEaddr($State._cores[me]._ext._cregs[CR3], $ptr)) );\r\n//\r\n// assert(forall $ptr:int :: { WordToPageEntry(LoadPhysical(mem.map,PDEaddr($State._cores[me]._ext._cregs[CR3], $ptr)).<>) }\r\n// word($ptr) ==> WordToPageEntry(LoadPhysical(s._mem,PDEaddr(core_state._cregs[CR3], $ptr)).<>) == \r\n// WordToPageEntry(LoadPhysical(mem.map,PDEaddr($State._cores[me]._ext._cregs[CR3], $ptr)).<>) );\r\n//\r\n// assert(forall $ptr:int :: { LoadPhysical(mem.map,PDEaddr($State._cores[me]._ext._cregs[CR3], $ptr)) }\r\n// paging_enabled(core_state) && word($ptr) ==> \r\n// LoadPhysical(mem.map,PDEaddr($State._cores[me]._ext._cregs[CR3], $ptr)) != <>() );\r\n//\r\n// assert(forall $ptr:int :: { WordToPageEntry(LoadPhysical(s._mem,PDEaddr(core_state._cregs[CR3], $ptr)).<>) }\r\n// paging_enabled(s._cores[me]) && word($ptr) ==> \r\n// WordToPageEntry(LoadPhysical(s._mem,PDEaddr(core_state._cregs[CR3], $ptr)).<>) != <>() );\r\n//\r\n// assert(forall $ptr:int :: { WordToPageEntry(LoadPhysical(mem.map,PDEaddr($State._cores[me]._ext._cregs[CR3], $ptr)).<>) }\r\n// paging_enabled(core_state) && word($ptr) ==> \r\n// WordToPageEntry(LoadPhysical(mem.map,PDEaddr($State._cores[me]._ext._cregs[CR3], $ptr)).<>) != <>() );\r\n//\r\n// assert(forall $ptr:int :: \r\n// { WordToPageEntry(LoadPhysical(s._mem, PDEaddr(core_state._cregs[CR3], $ptr)).<>).<> }\r\n// (word($ptr) && paging_enabled(s._cores[me]) && !in_guard_region($ptr)) ==>\r\n// let $pde:PageEntry := WordToPageEntry(LoadPhysical(s._mem,PDEaddr(core_state._cregs[CR3], $ptr)).<>).<> in\r\n// $pde.present == ?Present && $pde.write == ?Write);\r\n//\r\n// assert(forall $ptr:int :: \r\n// { WordToPageEntry(LoadPhysical(mem.map, PDEaddr($State._cores[me]._ext._cregs[CR3], $ptr)).<>).<> }\r\n// (word($ptr) && paging_enabled(core_state) && !in_guard_region($ptr)) ==>\r\n// let $pde:PageEntry := WordToPageEntry(LoadPhysical(mem.map,PDEaddr($State._cores[me]._ext._cregs[CR3], $ptr)).<>).<> in\r\n// $pde.present == ?Present && $pde.write == ?Write);\r\n//\r\n// assert(forall $ptr:int :: \r\n// { WordToPageEntry(LoadPhysical(mem.map,PDEaddr($State._cores[me]._ext._cregs[CR3], $ptr)).<>).<> }\r\n// word($ptr)&& paging_enabled(core_state) ==>\r\n// let $pde:PageEntry := WordToPageEntry(LoadPhysical(mem.map,PDEaddr($State._cores[me]._ext._cregs[CR3], $ptr)).<>).<> in\r\n// LoadPhysical(mem.map, PTEaddr($pde, $ptr)) != <>());\r\n// \r\n// assert (paging_enabled(core_state) ==> flat_page_mapping(mem.map, $State._cores[me]._ext._cregs[CR3]));\r\n// assert (paging_enabled(core_state) ==> page_tables_correctly_situated(mem.map, $State._cores[me]._ext._cregs[CR3])); \r\n// assert (paging_enabled(core_state) ==> DTLBsAreFreshWrtMem($State._cores[me]._ext._cregs[CR3], $State._cores[me]._ext._caches.DTLB, mem.map) == <>(true));\r\n// assert (paging_enabled(core_state) ==> TLBsAreFreshWrtMem($State._cores[me]._ext._cregs[CR3], $State._cores[me]._ext._caches.TLB, mem.map) == <>(true)); \r\n//// assert (logical_addressing_inv(init) );\r\n//}\r\n//\r\n//implementation logical_IdtStore(s:state, core:core_state, entry:int, offset:int, handler:int, ptr:opn_mem, val:opn) returns(_core:core_state) { call logical_abstraction_lemma(); call core_IdtStore(s, entry, offset, handler, ptr, val); _core := $State._cores[me]; }\r\n//implementation logical_Lidt(s:state, core:core_state, ptr:opn_mem) returns(_core:core_state) { call logical_abstraction_lemma(); call core_Lidt(s, ptr); _core := $State._cores[me]; }\r\n//implementation logical_VgaTextStore16(s:state, core:core_state, ptr:opn_mem, val:opn) returns(_core:core_state) { call logical_abstraction_lemma(); call core_VgaTextStore16(s, ptr, val); _core := $State._cores[me]; }\r\n//implementation logical_VgaDebugStore16(s:state, core:core_state, ptr:opn_mem, val:opn) returns(_core:core_state) { call logical_abstraction_lemma(); call core_VgaDebugStore16(s, ptr, val); _core := $State._cores[me]; }\r\n//implementation logical_IomStore(s:state, core:core_state, ptr:opn_mem, val:opn) returns(_core:core_state) { call logical_abstraction_lemma(); call core_IomStore(s, ptr, val); _core := $State._cores[me]; }\r\n//implementation logical_IomRegLoad(s:state, core:core_state, entry:int, val:opn, ptr:opn_mem) returns(_core:core_state) { call logical_abstraction_lemma(); call core_IomRegLoad(s, entry, val, ptr); _core := $State._cores[me]; }\r\n//implementation logical_IomRegStore(s:state, core:core_state, entry:int, ptr:opn_mem, val:opn) returns(_core:core_state) { call logical_abstraction_lemma(); call core_IomRegStore(s, entry, ptr, val); _core := $State._cores[me]; }\r\n//implementation logical_PciMemLoad32(s:state, core:core_state, id:int, val:opn, ptr:opn_mem) returns(_core:core_state) { call logical_abstraction_lemma(); call core_PciMemLoad32(s, id, val, ptr); _core := $State._cores[me]; }\r\n//implementation logical_PciMemStore32(s:state, core:core_state, id:int, ptr:opn_mem, val:opn) returns(_core:core_state) { call logical_abstraction_lemma(); call core_PciMemStore32(s, id, ptr, val); _core := $State._cores[me]; }\r\n//implementation logical_DeviceLoad(s:state, core:core_state, dst:opn, ptr:opn_mem) returns(_core:core_state) { call logical_abstraction_lemma(); call core_DeviceLoad(s, dst, ptr); _core := $State._cores[me]; }\r\n//implementation logical_DeviceStore(s:state, core:core_state, ptr:opn_mem, src:opn, send_auth_word:bool, auth_word_index:int, packet:[int]int) returns(_core:core_state) { call logical_abstraction_lemma(); call core_DeviceStore(s, ptr, src, send_auth_word, auth_word_index, packet); _core := $State._cores[me]; }\r\n//\r\n//implementation logical_StoreShared(s:state, core:core_state, linear owner:int, x:opn_mem, y:opn) returns(_core:core_state, linear _owner:int)\r\n//{\r\n// call logical_abstraction_lemma();\r\n// call _owner := core_StoreShared($State, owner, x, y);\r\n// _core := $State._cores[me];\r\n//}\r\n//\r\n//implementation logical_CmpxchgShared(s:state, core:core_state, linear owner:int, ptr:opn_mem, val:opn) returns(_core:core_state, linear _owner:int)\r\n//{\r\n// call logical_abstraction_lemma();\r\n// assert LA(init, core_state, ptMem);\r\n// call _owner := core_CmpxchgShared($State, owner, ptr, val);\r\n// _core := $State._cores[me];\r\n// assert LA(init, core_state, ptMem);\r\n//}\r\n\r\n//-//////////////// Actual paging-related work ///////////////////\r\n\r\nimplementation initPageTablePartition()\r\n{\r\n}\r\n\r\natomic ghost procedure espAligned(sp:int)\r\n requires Aligned(sp);\r\n ensures Aligned(sp - 4) && Aligned(sp - 8) && Aligned(sp - 12) && Aligned(sp - 16);\r\n ensures Aligned(sp - 20) && Aligned(sp - 24);\r\n{\r\n assert TV(sp) && TO(0-1) && TO(0-2) && TO(0-3) && TO(0-4) && TO(0-5) && TO(0-6) && TO(0-7);\r\n}\r\n\r\nimplementation fixupDS()\r\n{\r\n call espAligned(esp);\r\n\r\n //- Save a copy of the base address for later\r\n call r := instr_Mov(r, EDX, OReg(EAX));\r\n\r\n //-///////////////////////////////////////////////////\r\n //- Build up a small GDT in reverse order via PUSH\r\n //-//////////////////////////////////////////////////\r\n \r\n //- \"topmost\" entry is a flat descriptor starting at 0.\r\n var goalSeg:SegmentDescriptor := SegmentDescriptor(0, ?SegmentDescriptorTypeData);\r\n\r\n //- The following implements SegmentDescriptorWord1()\r\n call r := instr_Mov(r, EAX, OConst(0));\r\n assert r.regs[EAX] == 0;\r\n call r := instr_And(r, EAX, OConst(0x00ff0000));\r\n call r := instr_Shr(r, EAX, OConst(16));\r\n\r\n call r := instr_Mov(r, ECX, OConst(0xCF90));\r\n call r := instr_Or (r, ECX, OConst(2));\r\n call r := instr_Shl(r, ECX, OConst(8));\r\n\r\n call r := instr_Or (r, EAX, OReg(ECX));\r\n call r := instr_Mov(r, ECX, OReg(EAX));\r\n\r\n call r := instr_Mov(r, EAX, OConst(0));\r\n call r := instr_And(r, EAX, OConst(0xff000000));\r\n\r\n call r := instr_Or (r, EAX, OReg(ECX));\r\n\r\n assert r.regs[EAX] == SegmentDescriptorWord1(goalSeg);\r\n call r, mem := core_Push(r, core_state, mem, OReg(EAX));\r\n\r\n //- Now do SegmentDescriptorWord0()\r\n call r := instr_Mov(r, EAX, OConst(0));\r\n call r := instr_Shl(r, EAX, OConst(16));\r\n call r := instr_Or (r, EAX, OConst(0xffff));\r\n assert r.regs[EAX] == SegmentDescriptorWord0(goalSeg);\r\n call r, mem := core_Push(r, core_state, mem, OReg(EAX));\r\n\r\n //- We don't care about the next two entries in the GDT, so set them to all 0\r\n call r := instr_Mov(r, EAX, OConst(0));\r\n call r, mem := core_Push(r, core_state, mem, OReg(EAX));\r\n call r, mem := core_Push(r, core_state, mem, OReg(EAX));\r\n\r\n //- Save the value in ESP, so we can build the GDT descriptor pointing to it\r\n var $base:int := r.regs[ESP];\r\n call r := instr_Mov(r, EAX, OReg(ESP));\r\n call r := instr_Mov(r, ECX, OReg(ESP));\r\n\r\n //- GdtParamsWord1\r\n call r := instr_Shr(r, EAX, OConst(16));\r\n assert r.regs[EAX] == GdtParamsWord1($base, 2);\r\n call r, mem := core_Push(r, core_state, mem, OReg(EAX));\r\n \r\n //- GdtParamsWord0\r\n call r := instr_Shl(r, ECX, OConst(16));\r\n call r := instr_Mov(r, EAX, OConst(16));\r\n call r := instr_Or (r, ECX, OReg(EAX));\r\n call r := instr_Mov(r, EAX, OReg(ECX));\r\n assert r.regs[EAX] == GdtParamsWord0($base, 2);\r\n call r, mem := core_Push(r, core_state, mem, OReg(EAX));\r\n\r\n //- Load it up!\r\n call core_state := instr_LoadGDT(r, core_state, mem, $base, 2, OMem(MReg(ESP, 0)));\r\n\r\n //- Fix up DS\r\n call r := instr_Mov(r, EAX, OConst(1));\r\n call r := instr_Shl(r, EAX, OConst(3));\r\n call core_state := instr_ActivateDataSelector(r, core_state, mem, 1, goalSeg, EAX, DS);\r\n\r\n //- Restore the original value of the base address\r\n call r := instr_Mov(r, EAX, OReg(EDX));\r\n}\r\n\r\nprocedure logicalAddressingInvNotEnabledLemma(p1:mem, p2:mem)\r\n inout my core_state:core_state;\r\n requires !paging_enabled(core_state);\r\n requires !init;\r\n requires logical_addressing_inv_base(init, core_state, p1);\r\n ensures logical_addressing_inv_base(init, core_state, p2);\r\n{\r\n assert LA(init, core_state, p1);\r\n assert LA(init, core_state, p2);\r\n}\r\n\r\n/*\r\n// Build a set of PDEs and PTEs describing a linear address space. \r\n// Uses memory starting at $base (in eax) for the paging structures.\r\n// Sets memory addresses in [ebx, esi) as user accessible. All others are system only\r\n// Returns (via eax) the appropriate value for CR3\r\nprocedure buildLinearPageTables($requested_base@eax, $user_low@ebx, $user_high@esi)\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem;\r\n requires !paging_enabled(core_state);\r\n requires !init;\r\n requires ptAddrOwned(ptMem);\r\n requires word($requested_base) && ptAddr($requested_base) && aligned4k($requested_base);\r\n requires word($user_low) && aligned4k($user_low) && !in_guard_region($user_low);\r\n requires word($user_high) && aligned4k($user_high) && !in_guard_region($user_high); \r\n requires le($user_low, $user_high);\r\n // Must be enough room for all the structures\r\n requires ptAddr($requested_base + ?pageDirSize + ?numPDEs * ?pageTableSize - 1) && \r\n word($requested_base + ?pageDirSize + ?numPDEs * ?pageTableSize); \r\n requires lt(?ptHi, ?memHi); \r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n requires (forall i:int::{memAddr(i)} ?memLo <= i && i < ?memHi ==> memAddr(i));\r\n modifies mem, efl, eax, ecx, edx, edi, ptOwner__id, $part;\r\n ensures ValidCR3(eax) && PageDirectoryBase(eax) == old(eax);\r\n ensures only_user_accessible_pages($part.vars[ptOwner__id].map, eax, old(ebx), old(esi));\r\n ensures logical_addressing_inv(init, ptMem, core);\r\n ensures logical_addressing_inv_shared(true, $requested_base, $part.vars[ptOwner__id]);\r\n ensures $part.vars[me].dom == old($part).vars[me].dom;\r\n ensures eax == old(eax);\r\n{ \r\n var $base:int := $requested_base; // Save the base value as a ghost, to free up eax\r\n var PartMem:[int]int := $part.vars[ptOwner__id].map;\r\n var $cur_addr @ eax;\r\n var $cur_base @ ecx; \r\n var $page_entry @ edi;\r\n\r\n assert(constants_correct());\r\n\r\n call $cur_base := Lea(eax + ?pageDirSize); // First page table starts after all of the PDEs we build\r\n assert ($cur_base == $base + ?pageDirSize);\r\n call alignment_4k_is_mod4096_lemma();\r\n assert (aligned4k($cur_base));\r\n call clear_LSBs_lemma();\r\n assert(WordToPageEntry($cur_base) != <>());\r\n\r\n assert($cur_base != 0);\r\n \r\n call alignment_dominance_lemma($cur_addr);\r\n assert(Aligned($cur_addr));\r\n call or_with_7_lemma();\r\n\r\n // Create the PDEs\r\n var $iter @ edx := 0; \r\n var $pte_start:int := $base + ?pageDirSize;\r\n while ($iter < ?numPDEs) \r\n invariant LogicalDstOk(init, ptMem, regs, core_state, mem, OMem(MConst($cur_addr)));\r\n //invariant memAddrMain($cur_addr) && Aligned($cur_addr); \r\n invariant $cur_addr == $base + ?sizeofPDE*$iter;\r\n invariant $cur_base == $base + ?pageDirSize + ?pageTableSize*$iter;\r\n invariant aligned4k($cur_base);\r\n invariant !init;\r\n invariant !paging_enabled(core_state);\r\n invariant (forall $i:int :: {WordToPageEntry(PartMem[PDE_index_to_addr($base, $i)])} \r\n (le(0, $i) && lt($i, $iter)) ==> WordToPageEntry(PartMem[PDE_index_to_addr($base, $i)]) != <>());\r\n invariant (forall $i:int :: { PartMem[PDE_index_to_addr($base, $i)] } \r\n (le(0, $i) && lt($i, $iter)) ==> word(PartMem[PDE_index_to_addr($base, $i)]) );\r\n invariant (forall $ptr:int :: { WordToPageEntry(PartMem[PDEaddr($base, $ptr)]) }\r\n (le(0, PageDirectoryOffset($ptr)) && lt(PageDirectoryOffset($ptr), $iter)) ==> WordToPageEntry(PartMem[PDEaddr($base, $ptr)]) != <>() );\r\n invariant (forall $ptr:int :: { WordToPageEntry(PartMem[PDEaddr($base, $ptr)]) }\r\n (le(0, PageDirectoryOffset($ptr)) && lt(PageDirectoryOffset($ptr), $iter)) ==> \r\n WordToPageEntry(PartMem[PDEaddr($base, $ptr)]).<>.base == page_table_index_to_addr($pte_start, PageDirectoryOffset($ptr)) );\r\n// invariant (forall $ptr:int :: { WordToPageEntry(PartMem[PDEaddr($base, $ptr)]) }\r\n// (le(0, PageDirectoryOffset($ptr)) && lt(PageDirectoryOffset($ptr), $iter)) ==> \r\n// WordToPageEntry(PartMem[PDEaddr($base, $ptr)]).<>.base == page_table_index_to_addr($pte_start, PageDirectoryOffset($ptr)) );\r\n invariant (forall $ptr:int :: { WordToPageEntry(PartMem[PDEaddr($base, $ptr)]).<> }\r\n le(0, PageDirectoryOffset($ptr)) && lt(PageDirectoryOffset($ptr), $iter) ==> \r\n let $pde:PageEntry := WordToPageEntry(PartMem[PDEaddr($base, $ptr)]).<> in\r\n $pde.present == ?Present && $pde.write == ?Write &&\r\n $pde.base == page_table_index_to_addr($pte_start, PageDirectoryOffset($ptr)) );\r\n invariant word($iter);\r\n invariant ($iter <= ?numPDEs);\r\n invariant logical_addressing_inv(init, ptMem, core_state);\r\n invariant (forall addr:int :: { $part.vars[ptOwner__id].dom[addr] } ptAddr(addr) ==> $part.vars[ptOwner__id].dom[addr]);\r\n invariant $part.vars[me].dom == old($part).vars[me].dom;\r\n invariant ebx == $user_low;\r\n invariant esi == $user_high;\r\n invariant PartMem == $part.vars[ptOwner__id].map;\r\n invariant ptAddrOwned(ptMem);\r\n {\r\n //var oldPartMem:[int]int := PartMem;\r\n $page_entry := $cur_base; \r\n //assert(DsInvFlatSegmentation($State._cores[me]._seg_regs[DS]));\r\n call $page_entry := Or($page_entry, 7); // Set User, Write, and Present flags\r\n //assert(logical_addressing_inv_priv($State, $part.vars[ptOwner__id]));\r\n linear var tmp:int;\r\n call tmp := new_linear_int();\r\n linear var tmpPtOwner__id:int := ptOwner__id;\r\n ptOwner__id := tmp;\r\n call logicalAddressingInvNotEnabledLemma($part, tmpPtOwner__id, ptMem);\r\n call tmpPtOwner__id := StoreShared(tmpPtOwner__id, $cur_addr, $page_entry);\r\n call logicalAddressingInvNotEnabledLemma($part, ptOwner__id, $part, tmpPtOwner__id);\r\n ptOwner__id := tmpPtOwner__id;\r\n PartMem := $part.vars[ptOwner__id].map;\r\n //assert(PartMem == oldPartMem[$cur_addr := $page_entry]);\r\n call lower_bits_dont_matter_lemma($cur_base, 7); // Helps prove invariant about <>.base\r\n\r\n $cur_addr := $cur_addr + ?sizeofPDE;\r\n $cur_base := $cur_base + ?pageTableSize;\r\n assert(aligned4k($cur_base));\r\n $iter := $iter + 1;\r\n\r\n call alignment_is_mod4_lemma();\r\n assert(Aligned($cur_addr));\r\n assert($iter <= ?numPDEs);\r\n }\r\n\r\n var $pde_mem:[int]int := PartMem;\r\n\r\n call select_non_negative_lemma();\r\n call shr_preserves_word_lemma();\r\n call select_preserves_word_lemma();\r\n\r\n call upper_bits_clear_ubound_lemma();\r\n call upper_bits_clear_lbound_lemma();\r\n\r\n call pointer_pieces_lemma();\r\n\r\n call ptr_offsets_lemma();\r\n call or_with_3_lemma();\r\n\r\n call clear_12_lemma();\r\n\r\n // Create the PTEs\r\n assert($cur_addr == $base + ?pageDirSize);\r\n $cur_base := 0; // First page frame is the bottom of memory\r\n $iter := 0;\r\n call alignment_is_mod4_lemma();\r\n while ($iter < ?totalPTEs) \r\n invariant !init;\r\n invariant logical_addressing_inv(init, ptMem, core_state);\r\n invariant (forall addr:int :: { $part.vars[ptOwner__id].dom[addr] } ptAddr(addr) ==> $part.vars[ptOwner__id].dom[addr]);\r\n invariant memAddrMain($cur_addr) && Aligned($cur_addr); \r\n invariant $cur_addr == $base + ?pageDirSize + ?sizeofPTE*$iter;\r\n invariant $iter == ?totalPTEs || $cur_base == ?pageFrameSize*$iter;\r\n invariant aligned4k($cur_base);\r\n // Insist that this while loop doesn't destroy memory-related properties of the PDEs' while loop\r\n invariant (forall $ptr:int :: { lt($ptr, add($base, ?pageDirSize)) }\r\n (word($ptr) && lt($ptr, add($base, ?pageDirSize))) ==>\r\n PartMem[$ptr] == $pde_mem[$ptr] );\r\n // Now, establish some properties of the PTEs\r\n invariant (forall $i:int :: { WordToPageEntry(PartMem[PTE_index_to_addr($pte_start, $i)]) }\r\n (le(0, $i) && lt($i, $iter)) ==> WordToPageEntry(PartMem[PTE_index_to_addr($pte_start, $i)]) != <>());\r\n invariant (forall $ptr:int :: { le(0, flat_PTE_index($ptr)) } { lt(flat_PTE_index($ptr), $iter) }\r\n (word($ptr) && le(0, flat_PTE_index($ptr)) && lt(flat_PTE_index($ptr), $iter)) ==> \r\n le(0, PageDirectoryOffset($ptr)) && lt(PageDirectoryOffset($ptr), $iter) );\r\n invariant (forall $ptr:int, $pde:PageEntry :: { WordToPageEntry(PartMem[PTEaddr($pde, $ptr)]) }\r\n (word($ptr) && le(0, flat_PTE_index($ptr)) && lt(flat_PTE_index($ptr), $iter) && \r\n $pde == WordToPageEntry(PartMem[PDEaddr($base, $ptr)]).<> &&\r\n $pde.base == page_table_index_to_addr($pte_start, PageDirectoryOffset($ptr)) ) ==>\r\n WordToPageEntry(PartMem[PTEaddr($pde, $ptr)]) != <>() );\r\n // Next two invariants help us prove some properties of the page tables we create\r\n invariant (forall $i:int :: { WordToPageEntry(PartMem[add($pte_start, mul(?sizeofPTE,$i))]).<>.base} \r\n (le(0, $i) && lt($i, $iter)) ==> WordToPageEntry(PartMem[add($pte_start, mul(?sizeofPTE,$i))]).<>.base == mul(?pageFrameSize,$i));\r\n invariant (forall $ptr:int :: \r\n { WordToPageEntry(PartMem[PDEaddr($base, $ptr)]).<>.base } \r\n { page_table_index_to_addr($pte_start, PageDirectoryOffset($ptr))}\r\n word($ptr) ==>\r\n WordToPageEntry(PartMem[PDEaddr($base, $ptr)]).<>.base == page_table_index_to_addr($pte_start, PageDirectoryOffset($ptr)) );\r\n invariant (forall $ptr:int, $pde:PageEntry :: { WordToPageEntry(PartMem[PTEaddr($pde, $ptr)]).<>.base }\r\n (word($ptr) && le(0, flat_PTE_index($ptr)) && lt(flat_PTE_index($ptr), $iter) && \r\n $pde == WordToPageEntry(PartMem[PDEaddr($base, $ptr)]).<> ) ==>\r\n $pde.base == page_table_index_to_addr($pte_start, PageDirectoryOffset($ptr)) );\r\n invariant (forall $ptr:int, $pde:PageEntry :: { WordToPageEntry(PartMem[PTEaddr($pde, $ptr)]) }\r\n (word($ptr) && le(0, flat_PTE_index($ptr)) && lt(flat_PTE_index($ptr), $iter) && \r\n $pde == WordToPageEntry(PartMem[PDEaddr($base, $ptr)]).<> ) ==>\r\n WordToPageEntry(PartMem[PTEaddr($pde, $ptr)]).<>.base == mul(?pageFrameSize, flat_PTE_index($ptr)) );\r\n invariant (forall $ptr:int, $pde:PageEntry :: { WordToPageEntry(PartMem[PTEaddr($pde, $ptr)]).<>.base }\r\n (word($ptr) && le(0, flat_PTE_index($ptr)) && lt(flat_PTE_index($ptr), $iter) && \r\n $pde == WordToPageEntry(PartMem[PDEaddr($base, $ptr)]).<> ) ==>\r\n WordToPageEntry(PartMem[PTEaddr($pde, $ptr)]).<>.base == ClearLSBs(12, $ptr) );\r\n invariant (forall $ptr:int, $pde:PageEntry :: { WordToPageEntry(PartMem[PTEaddr($pde, $ptr)]).<> }\r\n (word($ptr) && !in_guard_region($ptr) && le(0, flat_PTE_index($ptr)) && lt(flat_PTE_index($ptr), $iter) && \r\n $pde == WordToPageEntry(PartMem[PDEaddr($base, $ptr)]).<> ) ==>\r\n WordToPageEntry(PartMem[PTEaddr($pde, $ptr)]).<>.present == ?Present &&\r\n ((in_user_region($ptr, $user_low, $user_high) ==> \r\n WordToPageEntry(PartMem[PTEaddr($pde, $ptr)]).<>.user == ?User) &&\r\n (!in_user_region($ptr, $user_low, $user_high) ==> \r\n WordToPageEntry(PartMem[PTEaddr($pde, $ptr)]).<>.user == ?System)) &&\r\n WordToPageEntry(PartMem[PTEaddr($pde, $ptr)]).<>.write == ?Write );\r\n invariant (forall $ptr:int, $pde:PageEntry :: { WordToPageEntry(PartMem[PTEaddr($pde, $ptr)]).<> }\r\n (word($ptr) && in_guard_region($ptr) && le(0, flat_PTE_index($ptr)) && lt(flat_PTE_index($ptr), $iter) && \r\n $pde == WordToPageEntry(PartMem[PDEaddr($base, $ptr)]).<> ) ==>\r\n WordToPageEntry(PartMem[PTEaddr($pde, $ptr)]).<>.present == ?Absent );\r\n invariant word($iter);\r\n invariant $iter <= ?totalPTEs;\r\n invariant ebx == $user_low;\r\n invariant esi == $user_high;\r\n invariant PartMem == $part.vars[ptOwner__id].map;\r\n invariant ptAddrOwned(ptMem);\r\n invariant $part.vars[me].dom == old($part).vars[me].dom;\r\n {\r\n //var oldPartMem:[int]int := PartMem;\r\n //assert(PartMem == $part.vars[ptOwner__id].map);\r\n $page_entry := $cur_base;\r\n if ($iter != 0) {\r\n if ($user_low <= $cur_base) {\r\n if ($cur_base < $user_high) {\r\n assert(in_user_region($cur_base, $user_low, $user_high));\r\n call $page_entry := Or($page_entry, 7); // Set User, Write, Present flags\r\n assert(WordToPageEntry($page_entry).<>.user == ?User);\r\n } else {\r\n assert(!in_user_region($cur_base, $user_low, $user_high));\r\n call $page_entry := Or($page_entry, 3); // Set Write, Present flags\r\n assert(WordToPageEntry($page_entry).<>.user == ?System);\r\n }\r\n } else {\r\n assert(!in_user_region($cur_base, $user_low, $user_high));\r\n call $page_entry := Or($page_entry, 3); // Set User, Write, Present flags\r\n assert(WordToPageEntry($page_entry).<>.user == ?System);\r\n }\r\n }\r\n linear var tmp:int;\r\n call tmp := new_linear_int();\r\n linear var tmpPtOwner__id:int := ptOwner__id;\r\n ptOwner__id := tmp;\r\n call logicalAddressingInvNotEnabledLemma($part, tmpPtOwner__id, ptMem);\r\n call tmpPtOwner__id := StoreShared(tmpPtOwner__id, $cur_addr, $page_entry);\r\n call logicalAddressingInvNotEnabledLemma($part, ptOwner__id, $part, tmpPtOwner__id);\r\n ptOwner__id := tmpPtOwner__id;\r\n PartMem := $part.vars[ptOwner__id].map;\r\n //assert(PartMem == oldPartMem[$cur_addr := $page_entry]);\r\n call lower_bits_dont_matter_lemma($cur_base, 3); // Helps prove invariant about <>.base\r\n call lower_bits_dont_matter_lemma($cur_base, 7); // Helps prove invariant about <>.base\r\n $cur_addr := $cur_addr + ?sizeofPTE;\r\n assert(word($cur_base));\r\n\r\n $iter := $iter + 1;\r\n if ($cur_base != 0xFFFFF000) { \r\n $cur_base := $cur_base + ?pageFrameSize; \r\n }\r\n }\r\n\r\n assert($cur_addr == $base + ?pageDirSize + ?sizeofPTE*?totalPTEs);\r\n call $cur_addr := Sub($cur_addr, 0x401000);\r\n assert($cur_addr == $base);\r\n\r\n // Prove that CR3 is correct\r\n\r\n // Prove that DTLBsAreFreshWrtMem(eax, $DTLB, PartMem) != <>()\r\n call shr_preserves_word_lemma();\r\n call upper_bits_clear_ubound_lemma();\r\n call upper_bits_clear_lbound_lemma();\r\n call alignment_is_mod4_lemma();\r\n\r\n // Prove that TLBsAreFreshWrtMem(eax, $TLB, PartMem) != <>();\r\n // Step 1: Prove the PDE addrs are sane\r\n assert( (forall $ptr:int :: { LoadPhysical(PartMem, PDEaddr(eax, $ptr)) } \r\n word($ptr) ==> LoadPhysical(PartMem, PDEaddr(eax, $ptr)) != <>() ) );\r\n\r\n // Step 2: Prove that PDEs in memory are sane (this gets us past the prereqs for TLBIsFreshWrtMemOneEntry)\r\n assert( (forall $ptr:int :: { PDE_index_to_addr(PageDirectoryBase(eax), PageDirectoryOffset($ptr)) }\r\n word($ptr) ==> lt(PDE_index_to_addr(PageDirectoryBase(eax), PageDirectoryOffset($ptr)), add($base, ?pageDirSize)) ) );\r\n\r\n assert( (forall $ptr:int, $p2:int :: { lt($p2, add($base, ?pageDirSize)), add(PageDirectoryBase(eax), mul(?sizeofPDE, PageDirectoryOffset($ptr))) }\r\n (word($ptr) && word($p2) && $p2 == PDE_index_to_addr(PageDirectoryBase(eax), PageDirectoryOffset($ptr))) ==>\r\n lt($p2, add($base, ?pageDirSize)) ) );\r\n\r\n assert( (forall $ptr:int,$p2:int :: { PDE_index_to_addr(PageDirectoryBase(eax), PageDirectoryOffset($ptr)), WordToPageEntry(PartMem[$p2]) }\r\n (word($ptr) && word($p2) && $p2 == PDE_index_to_addr(PageDirectoryBase(eax), PageDirectoryOffset($ptr))) ==> \r\n lt($p2, add($base, ?pageDirSize)) && \r\n WordToPageEntry(PartMem[$p2]) != <>() ) ); \r\n\r\n assert( (forall $ptr:int :: { PDE_index_to_addr(PageDirectoryBase(eax), PageDirectoryOffset($ptr)) } { PDEaddr(eax, $ptr) }\r\n word($ptr) ==> (PDEaddr(eax, $ptr) == PDE_index_to_addr(PageDirectoryBase(eax), PageDirectoryOffset($ptr))) ) );\r\n\r\n assert( (forall $ptr:int :: { WordToPageEntry(LoadPhysical(PartMem, PDEaddr(eax, $ptr)).<>) } \r\n word($ptr) ==> WordToPageEntry(LoadPhysical(PartMem, PDEaddr(eax, $ptr)).<>) != <>() ) );\r\n\r\n // Step 3: Prove that the PTEaddrs formed via the PDEs are sane\r\n call clear_select_consistent_lemma();\r\n\r\n assert( (forall $ptr:int, $pde:PageEntry :: { LoadPhysical(PartMem, PTEaddr($pde, $ptr)) }\r\n (word($ptr) &&\r\n $pde == WordToPageEntry(LoadPhysical(PartMem, PDEaddr(eax, $ptr)).<>).<>) ==>\r\n LoadPhysical(PartMem, PTEaddr($pde, $ptr)) != <>() ));\r\n\r\n // Step 4: Prove that the PTEs are all sane\r\n assert( (forall $ptr:int, $pde:PageEntry :: \r\n { WordToPageEntry(PartMem[PDE_index_to_addr($base, PageDirectoryOffset($ptr))]).<>, le($pte_start, $pde.base) }\r\n (word($ptr) &&\r\n $pde == WordToPageEntry(PartMem[PDE_index_to_addr($base, PageDirectoryOffset($ptr))]).<> ) ==>\r\n le($pte_start, $pde.base) && lt($pde.base, PTE_index_to_addr($pte_start, ?totalPTEs)) ) ); \r\n\r\n // Prove that we build a flat page table\r\n assert( forall $ptr:int :: { lt(flat_PTE_index($ptr), ?totalPTEs) } \r\n word($ptr) ==> le(0, flat_PTE_index($ptr)) && lt(flat_PTE_index($ptr), ?totalPTEs) );\r\n call ptr_reconstruction_lemma();\r\n}\r\n\r\nimplementation enablePaging($base:int) \r\n{\r\n ebx := eax;\r\n esi := eax;\r\n call esi := Add(esi, 4096); // Create a 1-page user region here. REVIEW: We don't actually want the user to write data here!\r\n\r\n call alignment_4k_is_mod4096_lemma();\r\n\r\n call buildLinearPageTables(); // Expects base in eax. Returns the new value for CR3 in eax\r\n var $newCR3 @ eax;\r\n\r\n assert(page_tables_correctly_situated($part.vars[ptOwner__id].map, eax));\r\n\r\n call WriteCR3($newCR3);\r\n assert(LA(init, core_state, ptMem));\r\n call ecx := ReadCR0();\r\n assert(word(ecx));\r\n call ecx := Or(ecx, 0x80000000);\r\n call or_with_pow2_31_lemma();\r\n call WriteCR0(ecx);\r\n call get_set_lemma();\r\n call set_bit_preserves_word_lemma();\r\n assert(LA(me, true, $State, ptMem));\r\n}\r\n*/\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/Overflow.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-private-import Partition;\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Stacks;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import Util;\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation Overflow\r\n{\r\n\r\n#ifdef UNVERIFIED_PRINTSTACKTRACE\r\nprocedure PrintStackTrace(my r_in:regs) returns (r_out:regs)\r\n{\r\n my var r:regs := r_in;\r\n var m:mem;\r\n var core_state:core_state;\r\n\r\n call serialDbgNewlineOut();\r\n call serialDbgMarkOut();\r\n //edi := esp;\r\n\r\n call r:= instr_Mov(r, ECX, OConst(0x45));\r\n call serialDbgDataOut8();\r\n call r:= instr_Mov(r, ECX, OConst(0x44));\r\n call serialDbgDataOut8();\r\n call r:= instr_Mov(r, ECX, OConst(0x49));\r\n call serialDbgDataOut8();\r\n call r:= instr_Mov(r, ECX, OConst(0x20));\r\n call serialDbgDataOut8();\r\n call r:= instr_Mov(r, ESI, OReg(EDI));\r\n call serialDbgWordOut();\r\n\r\n call r:= instr_Mov(r, EDI, OReg(ESP));\r\n call r:= instr_Mov(r, EBP, OConst(0));\r\n while (ebp <= 400) \r\n {\r\n //- print address\r\n call r:= instr_Mov(r, ESI, OReg(EDI));\r\n call serialDbgWordOut();\r\n\r\n call r:= instr_Mov(r, ECX, OConst(32));\r\n call serialDbgDataOut8();\r\n //- print value\r\n call r:= instr_Load(r, core_state, m, ESI, OMem(MReg(EDI,0)));\r\n call serialDbgWordOut();\r\n call serialDbgNewlineOut();\r\n\r\n call r:= instr_Add(r, EDI, OConst(4));\r\n call r:= instr_Add(r, EBP, OConst(1));\r\n }\r\nprint_stack_trace_loop:\r\n goto print_stack_trace_loop;\r\n}\r\n#endif //- UNVERIFIED_PRINTSTACKTRACE\r\n\r\nimplementation Overflow(my r:regs, my c:core_state)\r\n{\r\n my var _r:regs;\r\n my var m:mem;\r\n\r\n call _r := instr_Mov(r, EAX, OConst(0x41526374));\r\n call _r := instr_Mov(_r, EDX, OConst(0xb8000));\r\n call instr_VgaDebugStore16(_r, OMem(MReg(EDX, 0)), OReg(EAX));\r\n\r\n#ifdef UNVERIFIED_PRINTSTACKTRACE\r\n call _r:=PrintStackTrace(_r);\r\n#endif //- UNVERIFIED_PRINTSTACKTRACE\r\n\r\n// TODO:\r\n// call instr_Mov(EAX, OConst(0x55551001));\r\n// call debugBreak();\r\noverflow_loop:\r\n goto overflow_loop;\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/Partition.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface Partition\r\n{\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/Partition.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation Partition\r\n{\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/Separation.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-private-import Partition;\r\n//-private-import Core;\r\n//-private-import Util;\r\n//-private-import LogicalAddressing;\r\n//-private-import Stacks;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface Separation\r\n{\r\n\r\n//- Memory layout:\r\n//- sMem: Nucleus private stack\r\n//- dMem: Nucleus private data\r\n//- argsMem: (Untrusted) Arguments from the bootloader\r\n//- pciMem: Memory-mapped PCI device info\r\n//- tMem[]: Thread control blocks\r\n//- fMem[]: Managed code stacks\r\n//- gcMem: GC memory (heap + auxiliary data)\r\n\r\n#define $DECL__MemVars me:int, init:bool, statics:mem, mems:mems\r\n#define $DECL_Mem_Vars me:int, init:bool, stk:mem, statics:mem, core_state:core_state, ptMem:mem, mems:mems\r\n#define $__MemVars init, statics, mems\r\n#define $_MemVars init, stk, statics, core_state, ptMem, mems\r\n#define $Mem_Vars me, $_MemVars\r\n#define DECL_IoVars io:IOState\r\n#define $IoVars io\r\n\r\n#ifdef AppLoader\r\nconst ?CodeSpace:int := 0x10000; // 64 KB\r\n#else\r\nconst ?CodeSpace:int := 0x100000; // 1 MB\r\n#endif\r\n\r\n//-///////////////////////////////////////////////\r\n//- If you change any of the consts below,\r\n//- be sure to update stackGcOffset in:\r\n//- GC\\SimpleCollector_i.beat\r\n//- DafnyCC/RegAlloc.cs\r\n//- If your change affects argLo, you also need\r\n//- to change the offset SKINIT_args in the bootloader\r\n//- in Trusted\\Bootloader\\blsingularity.cpp.\r\n//-///////////////////////////////////////////////\r\n\r\n//- Reserve fixed amount of space for all but gcMem:\r\nconst ?SSize:int := 4096; //- Must be the same as ?FSize!\r\nconst ?DSize:int := 1024;\r\nconst ?ArgSize:int := 1024;\r\nconst ?PciSize:int := 1024; //- 8 * 65536;\r\nconst ?ExtraSize:int := 0xF400; //- Extra buffer space we can distribute if needed\r\nconst ?AppCodeOffset:int := 0x30000;\r\nconst ?AppCodeSpace:int := 0x100000; //-1024*1024;\r\nconst ?TSize:int := 0; //- 256;\r\nconst ?FSize:int := 4096; //- Must be the same as ?SSize! \r\n//- Rest of memory devoted to gcMem\r\n\r\n//const ?sLo:int := 0x32F000; // ?memLo // ?ptHi;\r\nconst ?sLo:int := ?CodeBase + ?CodeSpace + 0x1F000; //- Allow 124KB for DEV \r\nconst ?sHi:int := ?sLo + ?SSize;\r\nconst ?dLo:int := ?sHi;\r\nconst ?dHi:int := ?dLo + ?DSize;\r\nconst ?argLo:int := ?dHi;\r\nconst ?argHi:int := ?argLo + ?ArgSize;\r\nconst ?pciLo:int := ?argHi;\r\nconst ?pciHi:int := ?pciLo + ?PciSize;\r\nconst ?extraLo:int := ?pciHi;\r\nconst ?extraHi:int := ?extraLo + ?ExtraSize;\r\nconst ?appCodeLo:int := ?extraHi;\r\nconst ?appCodeHi:int := ?appCodeLo + ?AppCodeSpace;\r\nconst ?tLo:int := ?appCodeHi;\r\nconst ?tHi:int := ?tLo + ?NumStacks * ?TSize;\r\nconst ?fLo:int := ?tHi;\r\nconst ?fHi:int := ?fLo + ?NumStacks * ?FSize;\r\n\r\n//- valid gc-controlled addresses (must be disjoint from null values)\r\n//- warning: because of interior pointers, ?gcHi must be a 32-bit word\r\n//- (it can equal 2^32 - 1, but not 2^32)\r\nconst ?gcLo:int := ?fHi;\r\nconst ?gcHi:int := ?memHi;\r\nfunction gcAddr(i:int):bool {?gcLo <= i && i < ?gcHi}\r\nfunction gcAddrEx(i:int):bool {?gcLo <= i && i <= ?gcHi}\r\n\r\nfunction isStack(s:int):bool {0 <= s && s < ?NumStacks}\r\n\r\n//function ptAddr(i:int):bool { ?ptLo <= i && i < ?ptHi }\r\nfunction ptAddrEx(i:int):bool { ?ptLo <= i && i <= ?ptHi }\r\n\r\nfunction sAddr(i:int):bool {?sLo <= i && i < ?sHi}\r\nfunction sAddrEx(i:int):bool {?sLo <= i && i <= ?sHi}\r\n\r\nfunction dAddr(i:int):bool {?dLo <= i && i < ?dHi}\r\nfunction dAddrEx(i:int):bool {?dLo <= i && i <= ?dHi}\r\n\r\nfunction argAddr(i:int):bool {?argLo <= i && i < ?argHi}\r\nfunction argAddrEx(i:int):bool {?argLo <= i && i <= ?argHi}\r\n\r\nfunction appCodeAddr(i:int):bool {?appCodeLo <= i && i < ?appCodeHi}\r\nfunction appCodeAddrEx(i:int):bool {?appCodeLo <= i && i <= ?appCodeHi}\r\n\r\nfunction pciAddr(i:int):bool {?pciLo <= i && i < ?pciHi}\r\nfunction pciAddrEx(i:int):bool {?pciLo <= i && i <= ?pciHi}\r\n\r\nfunction extraAddr(i:int):bool {?extraLo <= i && i < ?extraHi}\r\nfunction extraAddrEx(i:int):bool {?extraLo <= i && i <= ?extraHi}\r\n\r\nfunction fAddr(s:int, i:int):bool {isStack(s) && ?fLo + s * ?FSize <= i && i < ?fLo + s * ?FSize + ?FSize}\r\nfunction fAddrEx(s:int, i:int):bool {isStack(s) && ?fLo + s * ?FSize <= i && i <= ?fLo + s * ?FSize + ?FSize}\r\n\r\nfunction tAddr(s:int, i:int):bool {isStack(s) && ?tLo + s * ?TSize <= i && i < ?tLo + s * ?TSize + ?TSize}\r\nfunction tAddrEx(s:int, i:int):bool {isStack(s) && ?tLo + s * ?TSize <= i && i <= ?tLo + s * ?TSize + ?TSize}\r\n\r\n#ifdef AppLoader\r\nfunction DEVAddr(i:int):bool {?DEVLo <= i && i < ?CodeBase + 64*1024 + 124*1024}\r\n#else\r\nfunction DEVAddr(i:int):bool { ?memLo <= i && i < ?CodeBase + 0x101000 }\r\n//function DEVAddr(i:int):bool { false }\r\n#endif\r\n\r\ntype mems = linear mems(\r\n linear dat:mem, //- nucleus private data\r\n linear arg:mem, //- bootloader-supplied arguments\r\n //linear appCode:mem, // code for the real application\r\n linear pci:mem, //- PCI-related data\r\n linear gc:mem, //- garbage-collected heap\r\n linear frm:mem, //- garbage-collected stack frames\r\n frms:[int][int]int,\r\n linear tcb:mem, //- thread control blocks\r\n tcbs:[int][int]int);\r\nfunction memsInv(this:mems):bool\r\n{\r\n (forall i:int::{memAddr(i)} memAddrMain(i) ==> memAddr(i))\r\n && (forall i:int::{dat.dom[i]} dat.dom[i] <==> dAddr(i))\r\n && (forall i:int::{arg.dom[i]} arg.dom[i] <==> argAddr(i))\r\n //&& (forall i:int::{appCode.dom[i]} appCode.dom[i] <==> appCodeAddr(i))\r\n && (forall i:int::{pci.dom[i]} pci.dom[i] <==> pciAddr(i))\r\n && (forall i:int::{gc.dom[i]} gc.dom[i] <==> gcAddr(i))\r\n && (forall i:int::{frm.dom[i]} frm.dom[i] <==> ?fLo <= i && i < ?fHi)\r\n && (forall i:int::{tcb.dom[i]} tcb.dom[i] <==> ?tLo <= i && i < ?tHi)\r\n && (forall s:int, i:int::{frms[s][i]} fAddr(s, i) ==> frms[s][i] == frm[i])\r\n && (forall s:int, i:int::{tcbs[s][i]} tAddr(s, i) ==> tcbs[s][i] == tcb[i])\r\n}\r\n#define $dMem mems.dat\r\n#define $argMem mems.arg\r\n//#define $appCodeMem mems.appCode\r\n#define $pciMem mems.pci\r\n#define $gcMem mems.gc\r\n#define $fMems mems.frms\r\n#define $tMems mems.tcbs\r\n\r\nvar CodeBase @ statics;\r\nvar CodeSpace @ statics;\r\nvar StackCheck @ statics;\r\nvar SLo @ statics;\r\nvar DLo @ statics;\r\nvar ArgLo @ statics;\r\nvar AppCodeLo @ statics;\r\nvar PciLo @ statics;\r\nvar TLo @ statics;\r\nvar FLo @ statics;\r\nvar GcLo @ statics;\r\nvar GcHi @ statics;\r\nvar DmaAddr @ statics;\r\n\r\nfunction MemSepInv(dummy:bool):bool;\r\n\r\nfunction{:opaque} MemInvDetails(statics:mem, mems:mems):bool\r\n{\r\n MemSepInv(true)\r\n && (forall i:int::{memAddr(i)}{statics.dom[i]}\r\n (memAddr(i) ==> statics.dom[i] || sAddr(i) || mems.dat.dom[i] || mems.arg.dom[i] || appCodeAddr(i) || mems.pci.dom[i] || mems.gc.dom[i] || mems.frm.dom[i] || mems.tcb.dom[i] || DEVAddr(i) || extraAddr(i)))\r\n// (memAddr(i) ==> statics.dom[i] || sAddr(i) || mems.dat.dom[i] || mems.arg.dom[i] || mems.appCode.dom[i] || mems.pci.dom[i] || mems.gc.dom[i] || mems.frm.dom[i] || mems.tcb.dom[i] || DEVAddr(i)))\r\n && memsInv(mems)\r\n && statics.dom[&CodeBase]\r\n && statics.dom[&CodeSpace]\r\n && statics.dom[&StackCheck]\r\n && statics.dom[&SLo]\r\n && statics.dom[&DLo]\r\n && statics.dom[&ArgLo]\r\n && statics.dom[&AppCodeLo]\r\n && statics.dom[&PciLo]\r\n && statics.dom[&TLo]\r\n && statics.dom[&FLo]\r\n && statics.dom[&GcLo]\r\n && statics.dom[&GcHi]\r\n && statics.dom[&DmaAddr]\r\n && ?gcLo <= ?gcHi\r\n && Aligned(?sLo)\r\n && Aligned(?dLo)\r\n && Aligned(?argLo)\r\n && Aligned(?appCodeLo)\r\n && Aligned(?pciLo)\r\n && Aligned(?tLo)\r\n && Aligned(?fLo)\r\n && Aligned(?gcLo)\r\n && Aligned(?gcHi)\r\n && CodeBase == ?CodeBase\r\n && CodeSpace == ?CodeSpace\r\n && SLo == ?sLo\r\n && DLo == ?dLo\r\n && ArgLo == ?argLo\r\n && AppCodeLo == ?appCodeLo\r\n && PciLo == ?pciLo\r\n && TLo == ?tLo\r\n && FLo == ?fLo\r\n && GcLo == ?gcLo\r\n && GcHi == ?gcHi\r\n}\r\n\r\nfunction MemInvLocal($DECL_Mem_Vars):bool\r\n{\r\n MemInvDetails(statics, mems)\r\n && (forall i:int::{memAddr(i)}{stk.dom[i]} stk.dom[i] == sAddr(i))\r\n// && (forall i:int::{memAddr(i)}{mems.appCode.dom[i]} mems.appCode.dom[i] == appCodeAddr(i))\r\n}\r\n\r\nfunction MemInv($DECL_Mem_Vars):bool\r\n{\r\n MemInvLocal($Mem_Vars)\r\n && logical_addressing_inv(init, ptMem, core_state)\r\n && !paging_enabled(core_state) // until we have enough memory to enable paging\r\n && !init // TODO: remove this restriction\r\n#ifdef AppLoader\r\n && ?CodeBase == 0x300000\r\n#else\r\n && ?CodeBase == 0x340000\r\n#endif\r\n}\r\n\r\n// TODO: get Beat to generate these when importing Boogie files:\r\nfunction IOState_update___pci(io:IOState, x:PciState):IOState { IOState(io._vga, io._keyboard, io._iom, x, io._inCtr, io._outCtr) }\r\nfunction PciState_update__PciConfigState(pci:PciState, x:[int]int):PciState { PciState(pci.PciConfigId, pci.PciConfigOffset, x) }\r\n\r\n//function FDom(s:int):[int]bool { (lambda i:int::fAddr(s, i)) }\r\n//function TDom(s:int):[int]bool { (lambda i:int::tAddr(s, i)) }\r\n\r\nprocedure initSeparation(linear mem:mem) returns(linear stk:mem, linear statics:mem, linear mems:mems, linear appCode:mem);\r\n inout my r:regs, my core_state:core_state;\r\n requires !init;\r\n requires Aligned(?sLo);\r\n requires Aligned(?memHi);\r\n requires ?memLo <= ?sLo;\r\n requires ?sLo <= ?memHi;\r\n requires ebp == ?CodeBase;\r\n requires ebx == ?CodeSpace;\r\n requires ecx == ?sLo;\r\n requires edx == ?memHi;\r\n#ifdef AppLoader\r\n requires ?CodeBase == 0x300000;\r\n#else\r\n requires ?CodeBase == 0x340000;\r\n#endif\r\n requires (forall ptr:int :: !memAddrMain(ptr) ==> !DEVAddr(ptr));\r\n requires (forall i:int::{memAddr(i)} ?memLo <= i && i < ?memHi ==> memAddr(i));\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n requires (forall i:int::{memAddr(i)}{mem.dom[i]} TV(i) ==> (memAddr(i) && !DEVAddr(i) ==> mem.dom[i]));\r\n requires !paging_enabled(core_state);\r\n requires !init;\r\n modifies efl, eax, ecx, edx, esp;\r\n ensures MemInv($Mem_Vars);\r\n ensures (forall i:int::{appCodeAddr(i)}{appCode.dom[i]} appCode.dom[i] == appCodeAddr(i));\r\n ensures esp == old(esp);\r\n\r\n//- Reserve n bytes of stack space\r\n//- make sure both words in RIP are aligned for x64\r\nfunction SMemRequire(n:int, sMem:mem, $esp:int) returns(bool)\r\n{\r\n Aligned($esp)\r\n#ifdef x64\r\n && Aligned($esp + 4)\r\n#endif\r\n && ?sLo + n <= $esp && $esp <= ?sHi\r\n}\r\n\r\n//- Reserve n bytes of stack space, require m bytes for locals\r\nfunction SMemRequireInline(n:int, m:int, sMem:mem, $esp:int) returns(bool)\r\n{\r\n Aligned($esp)\r\n#ifdef x64\r\n && Aligned($esp + 4)\r\n#endif\r\n && Aligned($esp + m)\r\n && ?sLo + n <= $esp && $esp + m <= ?sHi\r\n}\r\n\r\n//- Reserve n bytes of stack space, and require return address on stack\r\n//- Make sure both words in RIP are mapped in memory for x64\r\nfunction SMemRequireRA(n:int, sMem:mem, $esp:int, $RET:ReturnTo) returns(bool)\r\n{\r\n SMemRequire(n, sMem, $esp)\r\n#ifdef x64\r\n && ?sLo + n <= $esp && $esp <= ?sHi - 8 && ReturnToAddr64(sMem[$esp], sMem[$esp + 4]) == $RET\r\n#else\r\n && ?sLo + n <= $esp && $esp <= ?sHi - 4 && ReturnToAddr32(sMem[$esp]) == $RET\r\n#endif\r\n}\r\n\r\n//- Stack contents not altered\r\nfunction SMemInv(sMem:mem, oldSMem:mem, $esp:int, oldEsp:int) returns(bool)\r\n{\r\n $esp == oldEsp\r\n && (forall i:int::{sMem[i]} $esp <= i ==> sMem[i] == oldSMem[i])\r\n}\r\n\r\n//- Stack contents not altered\r\nfunction SMemEnsure(sMem:mem, oldSMem:mem, $esp:int, oldEsp:int) returns(bool)\r\n{\r\n $esp == oldEsp + IPSize\r\n && (forall i:int::{sMem[i]} $esp <= i ==> sMem[i] == oldSMem[i])\r\n}\r\n\r\natomic ghost procedure alignCall(sp:int)\r\n requires Aligned(sp);\r\n ensures Aligned(sp - 4);\r\n #ifdef x64\r\n ensures Aligned(sp - 8);\r\n #endif\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/Separation.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-private-import Partition;\r\n//-private-import Core;\r\n//-private-import Util;\r\n//-private-import LogicalAddressing;\r\n//-private-import Stacks;\r\n//-private-import Instructions;\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation Separation\r\n{\r\n\r\nfunction implementation MemSepInv(dummy:bool):bool\r\n{\r\n true\r\n && (forall i:int::{memAddr(i)} memAddrMain(i) ==> memAddr(i))\r\n}\r\n\r\nfunction idiv(x:int, y:int):int { x div y }\r\n\r\nimplementation initSeparation(linear mem_in:mem) returns(linear stk:mem, linear statics:mem, linear mems:mems, linear appCode:mem)\r\n{\r\n linear var mem:mem := mem_in;\r\n call reveal_MemInvDetails();\r\n\r\n// call eax := AddChecked(eax, 0x190000);\r\n //call eax := AddChecked(eax, 8192);\r\n eax := edx;\r\n assert eax >= ecx;\r\n call eax := Sub(eax, ecx);\r\n if (eax <= 0x132000)\r\n {\r\n eax := 0x55550011;\r\n call debugBreak();\r\n }\r\n\r\n linear var dat:mem;\r\n linear var arg:mem;\r\n //linear var appCode:mem;\r\n linear var pci:mem;\r\n linear var gc:mem;\r\n linear var frm:mem;\r\n linear var tcb:mem;\r\n call stk := memEmpty();\r\n call dat := memEmpty();\r\n call arg := memEmpty();\r\n call appCode := memEmpty();\r\n call pci := memEmpty();\r\n call gc := memEmpty();\r\n call frm := memEmpty();\r\n call tcb := memEmpty();\r\n call mem, stk := memTransfer(mem, stk, (lambda i:int::sAddr(i)));\r\n call mem, dat := memTransfer(mem, dat, (lambda i:int::dAddr(i)));\r\n call mem, arg := memTransfer(mem, arg, (lambda i:int::argAddr(i)));\r\n call mem, pci := memTransfer(mem, pci, (lambda i:int::pciAddr(i)));\r\n call mem, appCode := memTransfer(mem, appCode, (lambda i:int::appCodeAddr(i)));\r\n call mem, gc := memTransfer(mem, gc, (lambda i:int::gcAddr(i)));\r\n call mem, frm := memTransfer(mem, frm, (lambda i:int::?fLo <= i && i < ?fHi));\r\n call mem, tcb := memTransfer(mem, tcb, (lambda i:int::?tLo <= i && i < ?tHi));\r\n var frms:[int][int]int := (lambda s:int::(lambda i:int::frm[i]));\r\n var tcbs:[int][int]int := (lambda s:int::(lambda i:int::tcb[i]));\r\n //let mems := mems(dat, arg, appCode, pci, gc, frm, frms, tcb, tcbs);\r\n let mems := mems(dat, arg, pci, gc, frm, frms, tcb, tcbs);\r\n\r\n statics := mem;\r\n\r\n CodeBase := ebp;\r\n CodeSpace := ebx;\r\n\r\n SLo := ecx;\r\n assert TV(ecx) && TO(1024);\r\n call ecx := Add(ecx, 4096);\r\n DLo := ecx;\r\n assert TV(ecx) && TO(256);\r\n call ecx := Add(ecx, 1024);\r\n ArgLo := ecx;\r\n assert TV(ecx) && TO(256);\r\n call ecx := Add(ecx, 1024);\r\n PciLo := ecx;\r\n assert TV(ecx) && TO(256);\r\n call ecx := Add(ecx, 1024);\r\n assert ?extraLo == ecx;\r\n assert TV(ecx) && TO(0x3D00);\r\n call ecx := Add(ecx, 0xF400);\r\n assert ?extraHi == ecx;\r\n AppCodeLo := ecx;\r\n assert TV(ecx) && TO(0x40000);\r\n call ecx := Add(ecx, 0x100000);\r\n TLo := ecx;\r\n assert TV(ecx) && TO(4096);\r\n FLo := ecx;\r\n assert TV(ecx) && TO(273920);\r\n call ecx := Add(ecx, 4096);\r\n GcLo := ecx;\r\n GcHi := edx;\r\n\r\n assert SLo == ?sLo;\r\n assert DLo == ?dLo;\r\n assert ArgLo == ?argLo;\r\n assert AppCodeLo == ?appCodeLo;\r\n assert PciLo == ?pciLo;\r\n assert TLo == ?tLo;\r\n assert FLo == ?fLo;\r\n assert GcLo == ?gcLo;\r\n assert GcHi == ?gcHi;\r\n\r\n assert ?fLo - ?sLo == 0x111000; //-stackGcOffset;\r\n}\r\n\r\nimplementation alignCall(sp:int)\r\n requires Aligned(sp);\r\n ensures Aligned(sp - 4);\r\n ensures Aligned(sp - 8);\r\n{\r\n #ifdef x64\r\n assert TV(sp) && TV(sp-4) && TO(0 - 1);\r\n #else\r\n assert TV(sp) && TO(0 - 1);\r\n #endif\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/Stacks.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-private-import Partition;\r\n//-private-import Core;\r\n//-private-import Util;\r\n//-private-import LogicalAddressing;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface Stacks\r\n//import Util;\r\n{\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- STACKS\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//- Stack identifiers are numbered 0, 1, 2, ..., ?NumStacks - 1\r\nconst ?NumStacks:int := 1; //- 64;\r\nconst ?InitialStack:int := 0;\r\nconst ?InterruptStack:int := 0;\r\n\r\n//var $S:int; // current stack id\r\nconst $S:int := 0;\r\n\r\n// Each managed stack $s grows from StackHi($s) down to StackLo($s)\r\n// (see Gc_i.beat)\r\n\r\n// Managed code can only write to the stack from an address StackLo($s) <= i < StackHi($s).\r\n// --> This includes writes caused by calls and interrupts!\r\n// A call consumes 4 bytes of stack space.\r\n// An interrupt can consume as much as ?InterruptReserve bytes of stack space.\r\n// Thus, the managed code should never allow esp < StackLo($s) + ?InterruptReserve\r\n// when interrupts are enabled or when traps (e.g. null pointer or divide-by-zero traps)\r\n// are possible.\r\n\r\n// The managed code can enforce this with run-time checks against StackCheck:\r\n// If StackCheck <= esp, then there at least ?StackReserve + ?InterruptReserve\r\n// bytes are available below esp.\r\n// When managed code calls the Nucleus, it must guarantee that\r\n// StackLo($s) <= esp\r\n// holds after the call instruction.\r\n// (So before the call, StackLo($s) + 4 <= esp.)\r\n// When the Nucleus returns to native code, it restores the esp before the call.\r\n\r\nconst ?InterruptReserve:int := 16;\r\nconst ?StackReserve:int := 4096;\r\n// var StackCheck:int; // in Separation module\r\n\r\n//- Each stack can be in one of four states:\r\n//- - empty\r\n//- - running\r\n//- - yielded(ebp, esp, eip)\r\n//- - interrupted(eax, ebx, ecx, edx, esi, edi, ebp, esp, eip, cs, eflags)\r\n//- The arguments to yielded and interrupted are the registers that must\r\n//- be restored to resume the thread. (For example, to restore yielded(b, s, i),\r\n//- one might set ebp == b, esp == s - 4, $Mem[esp] == i, and then invoke \"ret\").\r\ntype StackState;\r\nreadonly var $StackState:[int]StackState;\r\nconst StackEmpty:StackState;\r\nconst StackRunning:StackState;\r\nfunction StackYielded($ebp:int, $esp:int, $eip:int) returns(StackState);\r\nfunction StackInterrupted($eax:int, $ebx:int, $ecx:int, $edx:int, $esi:int, $edi:int, $ebp:int, $esp:int, $eip:int, $cs:int, $efl:int) returns(StackState);\r\n\r\n//- The four stack states are distinct:\r\nconst ?STACK_EMPTY:int := 0;\r\nconst ?STACK_RUNNING:int := 1;\r\nconst ?STACK_YIELDED:int := 2;\r\nconst ?STACK_INTERRUPTED:int := 3;\r\nfunction StackStateTag(state:StackState) returns(int);\r\nfunction IsStackStateTag(tag:int) returns(bool) { 0 <= tag && tag <= 3 }\r\nfunction IsStackStateTagFor(tag:int, state:StackState) returns(bool) { IsStackStateTag(tag) && tag == StackStateTag(state) }\r\n\r\n//- To switch to an StackEmpty stack $s, the stack memory must contain one word:\r\n//- StackHi($s) - 8: managedEntryPoint\r\n//- Execution begins by returning to the managedEntryPoint. This entry point\r\n//- should never return. (This is enforced by the TAL checker.)\r\nconst ?KernelEntryPoint:int := 0xdeadbeef;\r\n\r\n/*TODO: atomic ghost*/ procedure stacksProofs();\r\ninout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n ensures (StackStateTag(StackEmpty) == ?STACK_EMPTY);\r\n ensures (StackStateTag(StackRunning) == ?STACK_RUNNING);\r\n ensures (forall $ebp:int, $esp:int, $eip:int::{StackYielded($ebp, $esp, $eip)} StackStateTag(StackYielded($ebp, $esp, $eip)) == ?STACK_YIELDED);\r\n ensures (forall $eax:int, $ebx:int, $ecx:int, $edx:int, $esi:int, $edi:int, $ebp:int, $esp:int, $eip:int, $cs:int, $efl:int::\r\n {StackInterrupted($eax, $ebx, $ecx, $edx, $esi, $edi, $ebp, $esp, $eip, $cs, $efl)}\r\n StackStateTag(StackInterrupted($eax, $ebx, $ecx, $edx, $esi, $edi, $ebp, $esp, $eip, $cs, $efl)) == ?STACK_INTERRUPTED);\r\n ensures (forall $ebp1:int, $esp1:int, $eip1:int,\r\n $ebp2:int, $esp2:int, $eip2:int\r\n ::{StackYielded($ebp1, $esp1, $eip1),\r\n StackYielded($ebp2, $esp2, $eip2)}\r\n StackYielded($ebp1, $esp1, $eip1)\r\n == StackYielded($ebp2, $esp2, $eip2) ==>\r\n $ebp1 == $ebp2 && $esp1 == $esp2 && $eip1 == $eip2);\r\n ensures (forall $eax1:int, $ebx1:int, $ecx1:int, $edx1:int, $esi1:int, $edi1:int, $ebp1:int, $esp1:int, $eip1:int, $cs1:int, $efl1:int,\r\n $eax2:int, $ebx2:int, $ecx2:int, $edx2:int, $esi2:int, $edi2:int, $ebp2:int, $esp2:int, $eip2:int, $cs2:int, $efl2:int\r\n ::{StackInterrupted($eax1, $ebx1, $ecx1, $edx1, $esi1, $edi1, $ebp1, $esp1, $eip1, $cs1, $efl1),\r\n StackInterrupted($eax2, $ebx2, $ecx2, $edx2, $esi2, $edi2, $ebp2, $esp2, $eip2, $cs2, $efl2)}\r\n StackInterrupted($eax1, $ebx1, $ecx1, $edx1, $esi1, $edi1, $ebp1, $esp1, $eip1, $cs1, $efl1)\r\n == StackInterrupted($eax2, $ebx2, $ecx2, $edx2, $esi2, $edi2, $ebp2, $esp2, $eip2, $cs2, $efl2) ==>\r\n $eax1 == $eax2 && $ebx1 == $ebx2 && $ecx1 == $ecx2 && $edx1 == $edx2 && $esi1 == $esi2 && $edi1 == $edi2 &&\r\n $ebp1 == $ebp2 && $esp1 == $esp2 && $eip1 == $eip2 && $cs1 == $cs2 && $efl1 == $efl2);\r\n ensures word(?KernelEntryPoint);\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/Stacks.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-private-import Partition;\r\n//-private-import Core;\r\n//-private-import Util;\r\n//-private-import LogicalAddressing;\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation Stacks\r\n{\r\n\r\nimplementation stacksProofs()\r\n{\r\n // TODO\r\n infloop:\r\n invariant logical_addressing_inv(init, ptMem, core_state);\r\n goto infloop;\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/Util.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-private-import Partition;\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\nmodule interface Util\r\n{\r\n\r\n//- Write hex digit (ecx & 15) to screen offset edx\r\nprocedure writeHexDigit();\r\n inout my r:regs, my core_state:core_state;\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n requires 0 <= edx && edx <= 160 - 2;\r\n modifies efl, ecx;\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n\r\n//- Write value eax to screen offset edx\r\nprocedure writeHex();\r\n inout my r:regs, my core_state:core_state;\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n requires 0 <= edx && edx <= 160 - 16;\r\n modifies efl, eax, ecx, edx;\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n\r\n//- Write hex digit (ecx & 15) to screen offset edx\r\nprocedure writeHexDigitIllogical();\r\n inout my r:regs, my core_state:core_state;\r\n requires 0 <= edx && edx <= 160 - 2;\r\n modifies efl, ecx;\r\n\r\n//- Write value eax to screen offset edx\r\nprocedure writeHexIllogical();\r\n inout my r:regs, my core_state:core_state;\r\n requires 0 <= edx && edx <= 160 - 16;\r\n modifies efl, eax, ecx, edx;\r\n\r\nprocedure debugBreak();\r\n inout my r:regs, my core_state:core_state;\r\n modifies efl, eax, ecx, edx;\r\n ensures false;\r\n\r\nprocedure DebugBreak();\r\n inout my r:regs, my core_state:core_state, linear stk:mem;\r\n modifies efl, eax, ecx, edx, esp;\r\n ensures false;\r\n\r\nprocedure initializeSerialPort();\r\n inout my r:regs, my core_state:core_state;\r\n modifies efl, eax, edx;\r\n ensures serialPortConfigged();\r\n\r\n//- Pass in a word via esi\r\nprocedure serialDbgWordOut();\r\n inout my r:regs, my core_state:core_state;\r\n requires serialPortConfigged();\r\n modifies efl, eax, ebx, ecx, edx;\r\n\r\nprocedure serialDbgNewlineOut();\r\n inout my r:regs, my core_state:core_state;\r\n requires serialPortConfigged();\r\n modifies efl, eax, ecx, edx;\r\n\r\n//- Print ^ followed by a newline, for situations where you don't want to touch ebx\r\nprocedure serialDbgMarkOut();\r\n inout my r:regs, my core_state:core_state;\r\n requires serialPortConfigged();\r\n modifies efl, eax, ecx, edx;\r\n\r\n//- Pass in a byte via ebx\r\nprocedure serialDbgByteOut();\r\n inout my r:regs, my core_state:core_state;\r\n requires serialPortConfigged();\r\n modifies efl, eax, ecx, edx;\r\n\r\n//- Pass in a raw byte via ecx\r\nprocedure serialDbgDataOut8();\r\n inout my r:regs, my core_state:core_state;\r\n requires serialPortConfigged();\r\n modifies efl, eax, edx;\r\n\r\n//procedure serialDbgDataIn8();\r\n// inout core:state_core;\r\n// requires serialPortConfigged();\r\n// requires logical_addressing_inv(me, init, $State, $part, ptOwner__id, core);\r\n// requires $serialState.Mode.DLAB == false;\r\n// modifies $State, $serialState.In, $Eip, $Efl, eax, edx;\r\n// modifies $part;\r\n//// ensures $part.vars[me] == old($part).vars[me];\r\n// ensures logical_addressing_inv(me, init, $State, $part, ptOwner__id, core);\r\n// ensures $serialState.In.Events[$serialState.In.Done] == and (eax, 255);\r\n// ensures $serialState.In.Done == old($serialState).In.Done + 1;\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Base/Util.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Partition;\r\n//-private-import Core;\r\n//-private-import IntLemmasBase;\r\n//-private-import LogicalAddressing;\r\n//-private-import Instructions;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation Util\r\n{\r\n\r\n//- Write hex digit (ecx & 15) to screen offset edx\r\nimplementation writeHexDigit()\r\n{\r\n ecx := eax;\r\n call ecx := And(ecx, 15);\r\n if (ecx < 10)\r\n {\r\n ecx := ecx + 0x0c30;\r\n }\r\n else { call ecx := AddChecked(ecx, 0x0c37); }\r\n call VgaDebugStore16(edx + 0xb8000, ecx);\r\n}\r\n\r\n//- Write value eax to screen offset edx\r\nimplementation writeHex()\r\n{\r\n edx := edx + 14;\r\n call writeHexDigit();\r\n edx := edx - 2;\r\n call eax := Shr(eax, 4);\r\n call writeHexDigit();\r\n edx := edx - 2;\r\n call eax := Shr(eax, 4);\r\n call writeHexDigit();\r\n edx := edx - 2;\r\n call eax := Shr(eax, 4);\r\n call writeHexDigit();\r\n edx := edx - 2;\r\n call eax := Shr(eax, 4);\r\n call writeHexDigit();\r\n edx := edx - 2;\r\n call eax := Shr(eax, 4);\r\n call writeHexDigit();\r\n edx := edx - 2;\r\n call eax := Shr(eax, 4);\r\n call writeHexDigit();\r\n edx := edx - 2;\r\n call eax := Shr(eax, 4);\r\n call writeHexDigit();\r\n}\r\n\r\nimplementation debugBreak()\r\n{\r\n edx := 2;\r\n call writeHexIllogical();\r\n\r\n edx := 0xb8000;\r\n eax := 0;\r\n loop:\r\n invariant edx == 0xb8000;\r\n //invariant logical_addressing_inv(init, ptMem, core_state);\r\n\r\n //- Loop so we don't write to the screen too quickly (overwhelms card on phys machine?)\r\n ecx := 0;\r\n while (ecx <= 0x100000) \r\n invariant edx == 0xb8000;\r\n //invariant logical_addressing_inv(init, ptMem, core_state);\r\n invariant 0 <= ecx && ecx <= 0x100001;\r\n {\r\n ecx := ecx + 1;\r\n }\r\n\r\n //- Write to the screen to show we're still live\r\n call eax := LeaUnchecked(eax + 1);\r\n call VgaDebugStore16(edx, eax);\r\n goto loop;\r\n}\r\n\r\nimplementation DebugBreak()\r\n{\r\n call debugBreak();\r\n return;\r\n}\r\n\r\n//- Write hex digit (ecx & 15) to screen offset edx\r\nimplementation writeHexDigitIllogical()\r\n{\r\n ecx := eax;\r\n call ecx := And(ecx, 15);\r\n if (ecx < 10)\r\n {\r\n ecx := ecx + 0x0c30;\r\n }\r\n else { call ecx := AddChecked(ecx, 0x0c37); }\r\n call VgaDebugStore16(edx + 0xb8000, ecx);\r\n}\r\n\r\n//- Write value eax to screen offset edx\r\nimplementation writeHexIllogical()\r\n{\r\n edx := edx + 14;\r\n call writeHexDigitIllogical();\r\n edx := edx - 2;\r\n call eax := Shr(eax, 4);\r\n call writeHexDigitIllogical();\r\n edx := edx - 2;\r\n call eax := Shr(eax, 4);\r\n call writeHexDigitIllogical();\r\n edx := edx - 2;\r\n call eax := Shr(eax, 4);\r\n call writeHexDigitIllogical();\r\n edx := edx - 2;\r\n call eax := Shr(eax, 4);\r\n call writeHexDigitIllogical();\r\n edx := edx - 2;\r\n call eax := Shr(eax, 4);\r\n call writeHexDigitIllogical();\r\n edx := edx - 2;\r\n call eax := Shr(eax, 4);\r\n call writeHexDigitIllogical();\r\n edx := edx - 2;\r\n call eax := Shr(eax, 4);\r\n call writeHexDigitIllogical();\r\n}\r\n\r\n\r\nimplementation initializeSerialPort() returns ( )\r\n{\r\n //- enable DLAB and set baudrate 115200\r\n edx := 0x3fb;\r\n eax := 0x80;\r\n call SerialDbgConfigOut();\r\n edx := 0x3f8;\r\n eax := 0x01;\r\n call SerialDbgConfigOut();\r\n edx := 0x3f9;\r\n eax := 0x00;\r\n call SerialDbgConfigOut();\r\n //- disable DLAB and set 8N1\r\n edx := 0x3fb;\r\n eax := 0x03;\r\n call SerialDbgConfigOut();\r\n //- reset IRQ register\r\n edx := 0x3f9;\r\n eax := 0x00;\r\n call SerialDbgConfigOut();\r\n //- enable fifo, flush buffer, enable fifo\r\n edx := 0x3fa;\r\n eax := 0x01;\r\n call SerialDbgConfigOut();\r\n edx := 0x3fa;\r\n eax := 0x07;\r\n call SerialDbgConfigOut();\r\n edx := 0x3fa;\r\n eax := 0x01;\r\n call SerialDbgConfigOut();\r\n //- set RTS,DTR\r\n edx := 0x3fc;\r\n eax := 0x03;\r\n call SerialDbgConfigOut();\r\n}\r\n\r\nimplementation serialDbgWordOut()\r\n{ \r\n //- Writes out esi, 8 bits at a time\r\n ebx := esi;\r\n call ebx := Shr(ebx, 24);\r\n call serialDbgByteOut();\r\n ebx := esi;\r\n call ebx := Shr(ebx, 16);\r\n call serialDbgByteOut();\r\n ebx := esi;\r\n call ebx := Shr(ebx, 8);\r\n call serialDbgByteOut();\r\n ebx := esi;\r\n call serialDbgByteOut();\r\n}\r\n\r\nimplementation serialDbgNewlineOut()\r\n{\r\n //- Write a carriage return\r\n ecx := 13;\r\n call serialDbgDataOut8();\r\n //- Write out a newline\r\n ecx := 10;\r\n call serialDbgDataOut8();\r\n}\r\n\r\nimplementation serialDbgMarkOut()\r\n{\r\n //- Write a caret with a carriage return\r\n ecx := 94;\r\n call serialDbgDataOut8();\r\n call serialDbgNewlineOut();\r\n}\r\n\r\nimplementation serialDbgByteOut()\r\n{\r\n //- Truncate to byte size\r\n ecx := ebx;\r\n call ecx := And(ecx, 0xff);\r\n \r\n //- Convert top nibble to hex\r\n call ecx := Shr(ecx, 4);\r\n call and_bounds();\r\n call shr_decreases();\r\n if (ecx <= 9) {\r\n ecx := ecx + 48; //- ecx += '0'\r\n } else {\r\n ecx := ecx - 0xa;\r\n ecx := ecx + 97; //- ecx += 'a'\r\n }\r\n call serialDbgDataOut8();\r\n \r\n //- Convert lower nibble to hex\r\n ecx := ebx;\r\n call ecx := And(ecx, 0xf);\r\n if (ecx <= 9) {\r\n ecx := ecx + 48; //- ecx += '0'\r\n } else {\r\n ecx := ecx - 0xa;\r\n ecx := ecx + 97; //- ecx += 'a'\r\n }\r\n call serialDbgDataOut8();\r\n}\r\n\r\nimplementation serialDbgDataOut8() \r\n{\r\n //- Loop until serial port is ready\r\nwaitForSerialPort:\r\n invariant ecx == old(ecx);\r\n \r\n edx := 0x3fd;\r\n call SerialDbgStatusOut8();\r\n call eax := And(eax, 0x20);\r\n if (eax == 0) \r\n {\r\n goto waitForSerialPort;\r\n }\r\n\r\n //- Write out the value in ecx \r\n edx := 0x3f8;\r\n eax := ecx;\r\n call SerialDbgDataOut8();\r\n}\r\n\r\n\r\n//implementation serialDbgDataIn8() \r\n//{\r\n// // Loop until serial port is ready\r\n//waitForSerialPort:\r\n// invariant logical_addressing_inv(me, init, $State, $part, ptOwner__id, core);\r\n// //invariant $part.vars[me] == old($part).vars[me];\r\n// invariant $serialState.Mode.DLAB == false;\r\n// invariant $serialState.In.Done == old($serialState).In.Done;\r\n//\r\n// edx := 0x3fd;\r\n// call SerialDbgStatusIn8();\r\n// call eax := And(eax, 0x1);\r\n// if (eax == 0) \r\n// {\r\n// goto waitForSerialPort;\r\n// }\r\n// // Read in the value in eax \r\n// edx := 0x3f8;\r\n// call SerialDbgDataIn8();\r\n//}\r\n\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Devices/BitVectorLemmasDevices.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface BitVectorLemmasDevices\r\n{\r\n\r\natomic ghost procedure _constDevices();\r\n ensures $sub(1bv32, 1bv32) == 0bv32;\r\n ensures $sub(1bv32, 0bv32) == 1bv32;\r\n ensures $add(1bv32, 1bv32) == 2bv32;\r\n ensures $add(2bv32, 1bv32) == 3bv32;\r\n ensures $add(2bv32, 2bv32) == 4bv32;\r\n ensures $add(3bv32, 4bv32) == 7bv32;\r\n ensures $add(4bv32, 4bv32) == 8bv32;\r\n ensures $add(8bv32, 8bv32) == 16bv32;\r\n ensures $add(16bv32,16bv32) == 32bv32;\r\n\r\natomic ghost procedure _lemma_and7_implies_mod_4();\r\n ensures (forall x:bv32 :: $and(x, 7bv32) == 0bv32 ==> $mod(x, 4bv32) == 0bv32);\r\n\r\natomic ghost procedure _lemma_shl_1();\r\n ensures (forall amt:bv32 :: $le(0bv32, amt) && $lt(amt, 32bv32) ==> $gt($shl(1bv32, amt), 0bv32));\r\n\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Devices/BitVectorLemmasDevices.imp.beat", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-\r\n//-private-import BitVectorLemmasGc;\r\n//-\r\n//-\r\n//-\r\n//-\r\n\r\n\r\nmodule implementation BitVectorLemmasDevices\r\n{\r\n\r\nimplementation _constDevices() {}\r\nimplementation _lemma_and7_implies_mod_4() {}\r\nimplementation _lemma_shl_1() {}\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Devices/IntLemmasDevices.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IntSpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import BitVectorLemmasDevices;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface IntLemmasDevices\r\n{\r\n\r\natomic ghost procedure lemma_and7_implies_mod_4();\r\n ensures (forall x:int :: word(x) ==> and(x, 7) == 0 ==> _mod(x, 4) == 0);\r\n\r\natomic ghost procedure lemma_shl_1();\r\n ensures (forall amt:int :: le(0, amt) && lt(amt, 32) ==> gt(shl(1, amt), 0));\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Devices/IntLemmasDevices.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IntSpec;\r\n//-private-import BitVectorLemmasDevices;\r\n//-\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation IntLemmasDevices\r\n{\r\n\r\natomic ghost procedure _a($b1:bv32, $b2:bv32)\r\n requires word(add(I($b1), I($b2)));\r\n ensures add(I($b1), I($b2)) == I($add($b1, $b2));\r\n{\r\n}\r\n\r\natomic ghost procedure _s($b1:bv32, $b2:bv32)\r\n requires word(sub(I($b1), I($b2)));\r\n ensures sub(I($b1), I($b2)) == I($sub($b1, $b2));\r\n{\r\n}\r\n\r\natomic ghost procedure __constDevices()\r\n ensures 0 == I(0bv32);\r\n ensures 1 == I(1bv32);\r\n ensures 4 == I(4bv32);\r\n ensures 7 == I(7bv32);\r\n ensures 32 == I(32bv32);\r\n{\r\n call _constDevices();\r\n call _s(1bv32, 1bv32);\r\n call _s(1bv32, 0bv32);\r\n call _a(1bv32, 1bv32);\r\n call _a(2bv32, 2bv32);\r\n call _a(2bv32, 1bv32);\r\n call _a(3bv32, 4bv32);\r\n call _a(4bv32, 4bv32);\r\n call _a(8bv32, 8bv32);\r\n call _a(16bv32, 16bv32);\r\n}\r\n\r\nimplementation lemma_and7_implies_mod_4() \r\n{\r\n call __constDevices();\r\n call _lemma_and7_implies_mod_4();\r\n}\r\n\r\nimplementation lemma_shl_1()\r\n{\r\n call __constDevices();\r\n call _lemma_shl_1();\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Devices/IntelNIC.ifc.beat", "content": "//- Untrusted spec for interacting with the network card\r\n//- Implementation of the verified network driver\r\n\r\n//-\r\n//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-private-import IntLemmasDevices;\r\n//-private-import PCI;\r\n\r\n\r\nmodule interface IntelNIC\r\n{\r\n\r\nconst ?intel_NIC_device_vendor_id:int := 0x107c8086;\r\n\r\nprocedure map_network_card();\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n modifies io, efl, eax, ebx, ecx, edx, esi, edi, ebp, $pciMem;\r\n ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n ensures PciConfigReadResult(ecx, 0, ?intel_NIC_device_vendor_id);\r\n ensures IsValidPciId(ecx);\r\n ensures eax == PciMemSize(ecx);\r\n ensures ebx == PciMemAddr(ecx);\r\n ensures word(PciMemAddr(ecx) + PciMemSize(ecx));\r\n ensures io._pci.PciConfigState[ecx] == 4;\r\n ensures public(eax);\r\n ensures public(ebx);\r\n ensures public(ecx);\r\n ensures public(io._inCtr);\r\n ensures public(io._outCtr);\r\n\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Devices/IntelNIC.imp.beat", "content": "//- Implementation of the verified network driver\r\n//-\r\n//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-private-import IntLemmasDevices;\r\n//-private-import PCI;\r\n//-\r\n//-\r\n//-\r\n\r\nmodule implementation IntelNIC\r\n{\r\n\r\nimplementation map_network_card()\r\n{\r\n call reveal_MemInvDetails();\r\n ebp := 0x107c8086; \r\n call /* eax := */ pciFindDeviceVendor(?intel_NIC_device_vendor_id);\r\n ecx := eax;\r\n call eax := And(eax, 7);\r\n if (eax > 0) {\r\n eax := 0x55550070;\r\n call debugBreak();\r\n }\r\n\r\n edi := PciLo;\r\n edx := PciLo;\r\n call edx := Add(edx, 1024); //- == ?pciHi\r\n call lemma_and7_implies_mod_4();\r\n call pciMemMap(?pciLo, ?pciHi, ecx);\r\n\r\n //- Make sure the mapping fits into memory\r\n edx := ebx;\r\n call edx := AddWrap(edx, eax);\r\n\r\n if (edx <= ebx) { //- We wrapped around, so addr+size is off the end of memory\r\n eax := 0x55550071;\r\n call debugBreak();\r\n }\r\n\r\n call reveal_WORD_HI();\r\n assert ebx == PciMemAddr(ecx);\r\n assert eax == PciMemSize(ecx);\r\n call reveal_wrap32(ebx + eax);\r\n\r\n assert word(PciMemAddr(ecx) + PciMemSize(ecx));\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Devices/IoMain.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface IoMain\r\n{\r\n\r\nconst ?BYTE_VECTOR_VTABLE:int := 0;\r\n\r\natomic ghost procedure espAligned();\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n requires Aligned(esp);\r\n ensures Aligned(esp - 4) && Aligned(esp - 8) && Aligned(esp - 12) && Aligned(esp - 16);\r\n ensures Aligned(esp - 20) && Aligned(esp - 24) && Aligned(esp - 28) && Aligned(esp - 32);\r\n ensures Aligned(esp - 36) && Aligned(esp - 40) && Aligned(esp - 44) && Aligned(esp - 48);\r\n ensures Aligned(esp - 52) && Aligned(esp - 56) && Aligned(esp - 60) && Aligned(esp - 64);\r\n\r\natomic ghost procedure espAlignedInline();\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n requires Aligned(esp);\r\n ensures Aligned(esp + 4) && Aligned(esp + 8) && Aligned(esp + 12) && Aligned(esp + 16);\r\n ensures Aligned(esp + 20) && Aligned(esp + 24) && Aligned(esp + 28) && Aligned(esp + 32);\r\n ensures Aligned(esp + 36) && Aligned(esp + 40) && Aligned(esp + 44) && Aligned(esp + 48);\r\n ensures Aligned(esp + 52) && Aligned(esp + 56) && Aligned(esp + 60) && Aligned(esp + 64);\r\n\r\n//procedure startTimer();\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n// requires word(ecx);\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// modifies state, efl, eax, $TimerSeq, $TimerFreq;\r\n// ensures TimerOk($TimerSeq) && $TimerFreq == old(ecx);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n\r\nfunction PciUninitialized(io:IOState) returns (bool)\r\n{\r\n (forall i:int :: {io._pci.PciConfigState[i]} 0 <= i && i < 65536 ==> (io._pci.PciConfigState[i] == 0))\r\n}\r\n\r\nprocedure initIoInv();\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n// inout iovars:ioVars;\r\n requires ?devMemHi - ?devMemLo > 0x204004; \r\n// requires ?memHi == ?devMemLo;\r\n// requires ?memHi == ?memLo + 0x7400;\r\n requires ?devMemLo mod 0x10000 == 0; // 64K aligned\r\n requires ecx == ?pciLo;\r\n requires edx == ?pciHi;\r\n requires (?pciHi - ?pciLo) mod 16 == 0;\r\n requires Aligned(?pciLo);\r\n requires serialPortConfigged();\r\n requires PciUninitialized(io);\r\n// requires (forall i:int :: {io._pci.PciConfigState[i]} \r\n// 0 <= i && i < 65536 ==> (io._pci.PciConfigState[i] == 0));\r\n //requires MemInv($Mem_Vars);\r\n requires MemInv($Mem_Vars) && commonVarsInv($commonVars, statics);\r\n //requires logical_addressing_inv(init, ptMem, core_state); // Included in MemInv\r\n modifies efl, eax, ecx, $pciMem; \r\n ensures IoInv($IoVars, $pciMem);\r\n //ensures MemInv($Mem_Vars);\r\n ensures MemInv($Mem_Vars) && commonVarsInv($commonVars, statics);\r\n //ensures logical_addressing_inv(init, ptMem, core); // Included in MemInv\r\n\r\nprocedure checkIoFresh();\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires ecx == ?pciLo;\r\n requires edx == ?pciHi;\r\n requires (?pciHi - ?pciLo) mod 16 == 0;\r\n requires Aligned(?pciLo);\r\n requires IoInv($IoVars, $pciMem);\r\n requires MemInv($Mem_Vars) && commonVarsInv($commonVars, statics);\r\n modifies efl, eax, ecx, $pciMem; \r\n ensures IoInv($IoVars, $pciMem);\r\n ensures MemInv($Mem_Vars) && commonVarsInv($commonVars, statics);\r\n ensures (forall i:int :: {io._pci.PciConfigState[i]} \r\n 0 <= i && i < 65536 ==> (io._pci.PciConfigState[i] == 0));\r\n\r\nprocedure initDEV(linear dev_states:DEV_StateMachines, linear dev_mem:mem) returns (linear new_mem:mem)\r\n inout my r:regs, my core_state:core_state, linear io:IOState;\r\n requires !init;\r\n requires ?CodeBase == 0x300000;\r\n requires (forall i:int :: {dev_states.states[i]} dev_states.states[i] is Init); \r\n requires (forall i:int :: {dev_mem.dom[i]} dev_mem.dom[i] <==> (?DEVLo <= i && i < ?DEVHi));\r\n requires PciUninitialized(io);\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n modifies io, efl, eax, ebx, ecx, edx, esi, edi, ebp;\r\n ensures (forall i:int ::{ new_mem.dom[i] }{TV(i)} TV(i) ==> (new_mem.dom[i] <==> ?CodeBase + 64*1024 + 124*1024 <= i && i < 128*1024*1024));\r\n ensures PciUninitialized(io);\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n ensures public(io._inCtr);\r\n ensures public(io._outCtr);\r\n\r\n//procedure SetupIoTables();\r\n// requires word(?iomLo) && word(?iomHi) && word(?dmaHi);\r\n// requires ecx == ?iomLo;\r\n// requires ?dmaLo == ?iomHi;\r\n// requires Aligned(?dmaLo);\r\n// requires !$IomFrozen;\r\n// requires MemInv($Mem_Vars);\r\n// requires SMemRequireRA(132, stk, esp, RET);\r\n// modifies eax, ebx, ecx, edx, esi, edi, ebp, esp, $Mem, stk;\r\n// modifies $IomMem;\r\n// ensures IoRootTable($IomMem, eax);\r\n// ensures $IomMem[?dmaLo - 8] == ?BYTE_VECTOR_VTABLE;\r\n// ensures $IomMem[?dmaLo - 4] == ?dmaHi - ?dmaLo;\r\n// ensures MemInv($Mem_Vars);\r\n// ensures SMemEnsure(stk, old(stk), esp, old(esp));\r\n\r\nfunction CleanIoMmuState(io:IOState):bool\r\n{\r\n (forall i:int::{io._iom.IoMmuState[i]}\r\n io._iom.IoMmuState[i] == 0)\r\n}\r\n\r\n//procedure StartIoMmu();\r\n// inout mems:mems;\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n// requires IoRootTable(io._iom.IomMem, ebx);\r\n// requires !io._iom.IoMmuEnabled;\r\n// requires ebp == ?dmaLo && word(ebp);\r\n// requires io._iom.IomMem[?dmaLo - 8] == ?BYTE_VECTOR_VTABLE;\r\n// requires io._iom.IomMem[?dmaLo - 4] == ?dmaHi - ?dmaLo;\r\n// requires CleanIoMmuState(state);\r\n// requires MemInv($Mem_Vars);\r\n// requires SMemRequireRA(132, stk, esp, RET);\r\n// modifies eax, ebx, ecx, edx, esi, edi, ebp, esp, $Mem, stk;\r\n// modifies io._iom.IoMmuState, io._iom.IomFrozen, io._iom.IoMmuEnabled;\r\n// modifies DmaAddr;\r\n// ensures ((DmaAddr == 0 && !io._iom.IoMmuEnabled)\r\n// || (DmaAddr == ?dmaLo && io._iom.IoMmuEnabled));\r\n// ensures MemInv($Mem_Vars);\r\n// ensures SMemEnsure(stk, old(stk), esp, old(esp));\r\n//\r\n//// Pass in a word via esi\r\n//procedure Proc_SerialDbgWordOut();\r\n// inout core:state_core, my_part:partition, $mem:mems;\r\n// requires MemInv(me,init,$State,core,ptOwner__id,($State._mem),$part,my_part,$mem__id,$sepVars__id,$mem,$sepVars);\r\n// requires SMemRequireRA(0, mems__stk($mem), (core._regs)[ESP], RET);\r\n// //requires logical_addressing_inv(me, init, $State, $part, ptOwner__id, core);\r\n// requires $serialState.Mode.DLAB == false;\r\n// modifies $State, $serialState.Out, $Eip, $Efl, eax, ebx, ecx, edx;\r\n// modifies $part;\r\n// ensures (core._regs)[ESP] == old((core._regs)[ESP])+4;\r\n// ensures $part.vars[me] == old($part).vars[me];\r\n// ensures logical_addressing_inv(me, init, $State, $part, ptOwner__id, core);\r\n// ensures $serialState.Mode.DLAB == false;\r\n// ensures MemInv(me,init,$State,core,ptOwner__id,($State._mem),$part,my_part,$mem__id,$sepVars__id,$mem,$sepVars);\r\n// ensures SMemEnsure(mems__stk($mem), old(mems__stk($mem)), (core._regs)[ESP], old((core._regs)[ESP]));\r\n//\r\n//procedure Proc_SerialDbgNewlineOut();\r\n// inout core:state_core, my_part:partition, $mem:mems;\r\n// requires MemInv(me,init,$State,core,ptOwner__id,($State._mem),$part,my_part,$mem__id,$sepVars__id,$mem,$sepVars);\r\n// requires SMemRequireRA(0, mems__stk($mem), (core._regs)[ESP], RET);\r\n// //requires logical_addressing_inv(me, init, $State, $part, ptOwner__id, core);\r\n// requires $serialState.Mode.DLAB == false;\r\n// modifies $State, $serialState.Out, $Eip, $Efl, eax, ecx, edx;\r\n// modifies $part;\r\n// ensures (core._regs)[ESP] == old((core._regs)[ESP])+4;\r\n// ensures $part.vars[me] == old($part).vars[me];\r\n// ensures logical_addressing_inv(me, init, $State, $part, ptOwner__id, core);\r\n// ensures $serialState.Mode.DLAB == false;\r\n// ensures MemInv(me,init,$State,core,ptOwner__id,($State._mem),$part,my_part,$mem__id,$sepVars__id,$mem,$sepVars);\r\n// ensures SMemEnsure(mems__stk($mem), old(mems__stk($mem)), (core._regs)[ESP], old((core._regs)[ESP]));\r\n//\r\n//// Dafny interface\r\n//const stack_size__DafnyCC__Proc_serialPortIn:int := 0;\r\n//procedure Proc_serialPortIn() returns ($ghost_out:int);\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems;\r\n// requires MemInv(me,init,state,core_state,(mem.map),mems);\r\n// requires SMemRequireRA(stack_size__DafnyCC__Proc_serialPortIn, mems__stk(mems), esp, RET);\r\n// requires $serialState.Mode.DLAB == false;\r\n// modifies state, efl, $serialState.In, mems;\r\n// ensures esp == old(esp)+4;\r\n// ensures $serialState.In.Events[$serialState.In.Done] == and ($ghost_out, 255);\r\n// ensures $serialState.In.Done == old($serialState).In.Done + 1;\r\n// ensures MemInv(me,init,state,core_state,(mem.map),mems);\r\n// ensures SMemEnsure(mems__stk(mems), old(mems__stk(mems)), esp, old(esp));\r\n// ensures eax == $ghost_out;\r\n//\r\n//// Dafny interface\r\n//const stack_size__DafnyCC__Proc_serialPortOut:int := 0;\r\n//procedure Proc_serialPortOut($ghost_in:int);\r\n// inout core:state_core, my_part:partition, $mem:mems;\r\n// requires MemInv(me,init,$State,core,ptOwner__id,($State._mem),$part,my_part,$mem__id,$sepVars__id,$mem,$sepVars);\r\n// requires SMemRequireRA(stack_size__DafnyCC__Proc_serialPortOut, mems__stk($mem), (core._regs)[ESP], RET);\r\n// requires $serialState.Mode.DLAB == false;\r\n// modifies $State, $part, core, my_part, $mem, $serialState.Out;\r\n// requires $ghost_in == core._regs[ECX];\r\n// ensures (core._regs)[ESP] == old((core._regs)[ESP])+4;\r\n// ensures $serialState.Out.Events[$serialState.Out.Done] == and ($ghost_in, 255);\r\n// ensures $serialState.Out.Done == old($serialState).Out.Done + 1;\r\n// ensures MemInv(me,init,$State,core,ptOwner__id,($State._mem),$part,my_part,$mem__id,$sepVars__id,$mem,$sepVars);\r\n// ensures SMemEnsure(mems__stk($mem), old(mems__stk($mem)), (core._regs)[ESP], old((core._regs)[ESP]));\r\n//\r\n//\r\n//function ONE_ONE_MAP (M:[int]int) : bool\r\n//{\r\n// (forall x:int, y:int :: (word(x) && word(y)) ==> M[x] == M[y] ==> x == y)\r\n//}\r\n//\r\n//const stack_size__DafnyCC__Proc_Hash:int := 0;\r\n//\r\n//procedure Proc_Hash(pwd:int, salt:int, key:int) returns (r:int);\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems;\r\n// requires MemInv(me,init,state,core_state,(mem.map),mems);\r\n// requires SMemRequireRA(stack_size__DafnyCC__Proc_sample, mems__stk(mems), esp, RET);\r\n// requires ecx == pwd;\r\n// requires edx == salt;\r\n// requires ebx == key;\r\n// modifies state, efl, mems, $global_sample_index, $ghost_Hashed;\r\n// ensures RdmOracle(Triple(pwd, salt, key), r, old($ghost_Hashed), $ghost_Hashed, old($global_sample_index), $randomSource);\r\n// ensures $global_sample_index == old($global_sample_index)+1;\r\n// ensures esp == old(esp)+4;\r\n// ensures MemInv(me,init,state,core_state,(mem.map),mems);\r\n// ensures SMemEnsure(mems__stk(mems), old(mems__stk(mems)), esp, old(esp));\r\n// ensures eax == r;\r\n//\r\n//procedure proc_SampleLemma(p:int, M:[int]int);\r\n// ensures (forall x:int :: M[x] == xor(x,p));\r\n//\r\n//procedure proc_SampleLemmaID(M:[int]int);\r\n// ensures (forall x:int :: M[x] == x);\r\n//\r\n//function RdmOracle (tri:Tri, ret:int, MOld:Map, M:Map, index:int, randomSource:[int]int) : bool\r\n//{\r\n// (MOld.Domain[tri] == true ==> M == MOld && M.Range[tri] == ret)\r\n// && (MOld.Domain[tri] == false ==> randomSource[index] == ret && M.Range == MOld.Range[tri := ret] && M.Domain == MOld.Domain[tri := true])\r\n//}\r\n//\r\n//\r\n//const stack_size__DafnyCC__Proc_sample:int := 0;\r\n//\r\n//procedure Proc_sample(M:[int]int) returns ($ghost_out:int);\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems;\r\n// requires MemInv(me,init,state,core_state,(mem.map),mems);\r\n// requires SMemRequireRA(stack_size__DafnyCC__Proc_sample, mems__stk(mems), esp, RET);\r\n// requires OneOneMap(M);\r\n// modifies state, efl, mems, $global_sample_index;\r\n// ensures esp == old(esp)+4;\r\n// ensures MemInv(me,init,state,core_state,(mem.map),mems);\r\n// ensures SMemEnsure(mems__stk(mems), old(mems__stk(mems)), esp, old(esp));\r\n// //ensures (exists eax:int ::\r\n// // $State == InsUpdate1(me, s, OReg(EAX), eax, s._cores[me]._efl)\r\n// // && SampleCall ($randomSource, old($global_sample_index), $global_sample_index, and(eax, 255)));\r\n// ensures $randomSource[old($global_sample_index)] == $ghost_out;\r\n// ensures old($global_sample_index) + 1 == $global_sample_index;\r\n// ensures eax == $ghost_out;\r\n\r\nfunction max(x:int, y:int):int\r\n{\r\n if (x<=y) then y else x\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Devices/IoMain.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-private-import IntLemmasDevices;\r\n//-private-import PCI;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\n//-\r\n\r\nmodule implementation IoMain\r\n{\r\n\r\nimplementation espAligned()\r\n{\r\n assert TV(esp) && TO(0-1) && TO(0-2) && TO(0-3) && TO(0-4) && TO(0-5) && TO(0-6) && TO(0-7) && TO(0-8) && TO(0-9) && TO(0-10) && TO(0-11) && TO(0-12) && TO(0-13) && TO(0-14) && TO(0-15) && TO(0-16);\r\n}\r\n\r\nimplementation espAlignedInline()\r\n{\r\n assert TV(esp) && TO(1) && TO(2) && TO(3) && TO(4) && TO(5) && TO(6) && TO(7) && TO(8) && TO(9) && TO(10) && TO(11) && TO(12) && TO(13) && TO(14) && TO(15) && TO(16);\r\n}\r\n\r\n//implementation startTimer()\r\n//{\r\n// eax := 48;\r\n// call PitModeOut8(ecx);\r\n// eax := ecx;\r\n// call PitFreqOut8();\r\n// call eax := Shr(eax, 8);\r\n// call PitFreqOut8();\r\n//}\r\n\r\nimplementation initIoInv()\r\n{\r\n call reveal_MemInvDetails();\r\n ecx := ecx;\r\n var i:int := 0;\r\n while(ecx < edx) \r\n invariant 0 <= i && i <= (?pciHi - ?pciLo) div 16;\r\n invariant ecx == ?pciLo + 16*i;\r\n invariant ?pciLo <= ecx && ecx <= ?pciHi;\r\n invariant (forall addr:int, j:int::{mems.pci[addr],TV(j)} TV(j) \r\n && 0 <= j && j < i && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 ==>\r\n mems.pci[addr] == 0xffffffff);\r\n invariant (forall j:int :: {TV(j)} TV(j) && \r\n 0 <= j && j < i ==> mems.pci[?pciLo + 16*j] == 0xffffffff);\r\n invariant (forall i:int :: {io._pci.PciConfigState[i]} \r\n 0 <= i && i < 65536 ==> (io._pci.PciConfigState[i] == 0));\r\n //invariant MemInv($Mem_Vars);\r\n invariant MemInv($Mem_Vars) && commonVarsInv($commonVars, statics);\r\n {\r\n assert Aligned(?pciLo) && TV(?pciLo) && TO(4*i);\r\n call Store(inout mems.pci, ecx, 0xffffffff);\r\n assert mems.pci[ecx] == 0xffffffff;\r\n assert mems.pci[?pciLo + 16*i] == 0xffffffff;\r\n ecx := ecx + 16;\r\n i := i + 1;\r\n }\r\n\r\n call reveal_IoInv();\r\n}\r\n\r\nimplementation checkIoFresh()\r\n{ \r\n call reveal_MemInvDetails();\r\n var i:int := 0;\r\n while(ecx < edx) \r\n invariant 0 <= i && i <= (?pciHi - ?pciLo) div 16;\r\n invariant ecx == ?pciLo + 16*i;\r\n invariant ?pciLo <= ecx && ecx <= ?pciHi;\r\n invariant (forall addr:int, j:int::{mems.pci[addr],TV(j)}\r\n TV(j) ==> (0 <= j && j < i && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 ==> mems.pci[addr] == 0xffffffff));\r\n// invariant (forall j:int :: {io._pci.PciConfigState[j]} \r\n// 0 <= j && j < i ==> (io._pci.PciConfigState[j] == 0));\r\n invariant MemInv($Mem_Vars) && commonVarsInv($commonVars, statics);\r\n invariant IoInv($IoVars, mems.pci);\r\n {\r\n assert Aligned(?pciLo) && TV(?pciLo) && TO(4*i);\r\n call eax := Load(mems.pci, ecx);\r\n if (eax != 0xffffffff) {\r\n eax := 0x555500b1;\r\n call debugBreak();\r\n }\r\n call reveal_IoInv();\r\n ecx := ecx + 16;\r\n i := i + 1;\r\n }\r\n\r\n call reveal_IoInv();\r\n\r\n\r\n}\r\n\r\n//procedure setupIoTablesHelper1(tableBase@esi, dmaAlignedLo@ebx)\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// requires word(?iomLo) && word(?iomHi) && word(?dmaHi);\r\n// requires ?dmaLo == ?iomHi;\r\n// requires and(dmaAlignedLo, 4095) == 0;\r\n// requires ?dmaLo <= dmaAlignedLo && dmaAlignedLo + 0x200000 + 4096 <= ?dmaHi;\r\n// requires Aligned(tableBase);\r\n// requires ?iomLo <= tableBase && tableBase + 32768 <= ?iomHi;\r\n// requires and(tableBase + 0x0000, 4095) == 0;\r\n// requires and(tableBase + 0x1000, 4095) == 0;\r\n// requires and(tableBase + 0x2000, 4095) == 0;\r\n// requires and(tableBase + 0x3000, 4095) == 0;\r\n// requires !$IomFrozen;\r\n// modifies eax, ebx, ecx, edx, edi, ebp;\r\n// modifies $IomMem;\r\n// ensures IoPageTable($IomMem, tableBase);\r\n// ensures (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 512 ==>\r\n// ($IomMem[tableBase + 0x1000 + 8 * i] == 0 || $IomMem[tableBase + 0x1000 + 8 * i] == tableBase + 3)\r\n// && $IomMem[tableBase + 0x1000 + 8 * i + 4] == 0);\r\n// ensures (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 512 ==>\r\n// $IomMem[tableBase + 0x2000 + 8 * i] == 0\r\n// && $IomMem[tableBase + 0x2000 + 8 * i + 4] == 0);\r\n// ensures (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 512 ==>\r\n// $IomMem[tableBase + 0x3000 + 8 * i] == 0\r\n// && $IomMem[tableBase + 0x3000 + 8 * i + 4] == 0);\r\n//{\r\n// var ptr@edi := tableBase;\r\n// var end@ebp := ptr; end := end + 4096;\r\n// var pagePtr@edx := dmaAlignedLo;\r\n// var $entry:int := 0;\r\n// while (ptr < end)\r\n// invariant Aligned(ptr) && TV(ptr) && TO(1) && TO(2);\r\n// invariant dmaAlignedLo == old(dmaAlignedLo);\r\n// invariant end == old(tableBase) + 4096;\r\n// invariant tableBase == old(tableBase);\r\n// invariant pagePtr == dmaAlignedLo + $entry * 4096;\r\n// invariant and(pagePtr, 4095) == 0;\r\n// invariant ptr == tableBase + 8 * $entry;\r\n// invariant 0 <= $entry && $entry <= 512;\r\n// invariant (forall i:int::{TV(i)} TV(i) && 0 <= i && i < $entry ==>\r\n// IoPageTableEntry($IomMem[tableBase + 8 * i], $IomMem[tableBase + 8 * i + 4]));\r\n// invariant (forall i:int::{TV(i)} TV(i) && 0 <= i && i < $entry ==>\r\n// $IomMem[tableBase + 0x1000 + 8 * i] == 0 && $IomMem[tableBase + 0x1000 + 8 * i + 4] == 0);\r\n// invariant (forall i:int::{TV(i)} TV(i) && 0 <= i && i < $entry ==>\r\n// $IomMem[tableBase + 0x2000 + 8 * i] == 0 && $IomMem[tableBase + 0x2000 + 8 * i + 4] == 0);\r\n// invariant (forall i:int::{TV(i)} TV(i) && 0 <= i && i < $entry ==>\r\n// $IomMem[tableBase + 0x3000 + 8 * i] == 0 && $IomMem[tableBase + 0x3000 + 8 * i + 4] == 0);\r\n// invariant logical_addressing_inv(init, ptMem, core_state);\r\n// {\r\n// assert TO(1024) && TO(1025) && TO(2048) && TO(2049) && TO(3072) && TO(3073);\r\n// ecx := pagePtr; ecx := ecx + 3;\r\n// assert (memAddr(ptr));\r\n// assert(Aligned(ptr));\r\n// //assert (LogicalDstOk($State, OMem(MReg(EDI,0))));\r\n// call IomStore(ptr + 0, ecx);\r\n// call IomStore(ptr + 4, 0);\r\n// call IomStore(ptr + 0x1000, 0);\r\n// call IomStore(ptr + 0x1004, 0);\r\n// call IomStore(ptr + 0x2000, 0);\r\n// call IomStore(ptr + 0x2004, 0);\r\n// call IomStore(ptr + 0x3000, 0);\r\n// call IomStore(ptr + 0x3004, 0);\r\n// $entry := $entry + 1;\r\n// ptr := ptr + 8;\r\n// call __add4kAligned(pagePtr);\r\n// pagePtr := pagePtr + 4096;\r\n// }\r\n//\r\n// ecx := dmaAlignedLo;\r\n// call ecx := Shr(ecx, 21);\r\n// if (ecx >= 512)\r\n// {\r\n// eax := 0x5555006e; // dma zone is beyond first 1GB\r\n// call debugBreak();\r\n// }\r\n// assert TV(ecx) && TO(2 * ecx + 1024);\r\n// edx := tableBase; edx := edx + 3;\r\n// call IomStore(tableBase + 8 * ecx + 0x1000, edx);\r\n//\r\n//}\r\n//procedure setupIoTablesHelper2(tableBase@esi)\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// requires word(?iomLo) && word(?iomHi);\r\n// requires Aligned(?dmaLo);\r\n// requires ?dmaLo == ?iomHi;\r\n// requires ecx == ?dmaLo;\r\n// requires IoPageTable($IomMem, tableBase);\r\n// requires (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 512 ==>\r\n// ($IomMem[tableBase + 0x1000 + 8 * i] == 0 || $IomMem[tableBase + 0x1000 + 8 * i] == tableBase + 3)\r\n// && $IomMem[tableBase + 0x1000 + 8 * i + 4] == 0);\r\n// requires (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 512 ==>\r\n// $IomMem[tableBase + 0x2000 + 8 * i] == 0\r\n// && $IomMem[tableBase + 0x2000 + 8 * i + 4] == 0);\r\n// requires (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 512 ==>\r\n// $IomMem[tableBase + 0x3000 + 8 * i] == 0\r\n// && $IomMem[tableBase + 0x3000 + 8 * i + 4] == 0);\r\n// requires Aligned(tableBase);\r\n// requires Aligned(tableBase + 0x4000);\r\n// requires ?iomLo <= tableBase && tableBase + 32768 <= ?iomHi;\r\n// requires and(tableBase + 0x1000, 4095) == 0;\r\n// requires and(tableBase + 0x2000, 4095) == 0;\r\n// requires and(tableBase + 0x3000, 4095) == 0;\r\n// requires and(tableBase + 0x4000, 4095) == 0;\r\n// requires and(tableBase + 0x5000, 4095) == 0;\r\n// requires !$IomFrozen;\r\n// modifies eax, ebx, ecx, edx, edi, ebp;\r\n// modifies $IomMem;\r\n// ensures IoPageTable($IomMem, tableBase);\r\n// ensures $IomMem[tableBase + 0x2000] == tableBase + 0x1000 + 3;\r\n// ensures $IomMem[tableBase + 0x2004] == 0;\r\n// ensures $IomMem[tableBase + 0x3000] == tableBase + 0x2000 + 3;\r\n// ensures $IomMem[tableBase + 0x3004] == 0;\r\n// ensures (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 512 ==>\r\n// ($IomMem[tableBase + 0x1000 + 8 * i] == 0 || $IomMem[tableBase + 0x1000 + 8 * i] == tableBase + 3)\r\n// && $IomMem[tableBase + 0x1000 + 8 * i + 4] == 0);\r\n// ensures (forall i:int::{TV(i)} TV(i) && 1 <= i && i < 512 ==>\r\n// $IomMem[tableBase + 0x2000 + 8 * i] == 0\r\n// && $IomMem[tableBase + 0x2000 + 8 * i + 4] == 0);\r\n// ensures (forall i:int::{TV(i)} TV(i) && 1 <= i && i < 512 ==>\r\n// $IomMem[tableBase + 0x3000 + 8 * i] == 0\r\n// && $IomMem[tableBase + 0x3000 + 8 * i + 4] == 0);\r\n// ensures (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 256 ==>\r\n// $IomMem[tableBase + 0x4000 + 16 * i + 0] == tableBase + 0x3000 + 3\r\n// && $IomMem[tableBase + 0x4000 + 16 * i + 4] == 0\r\n// && $IomMem[tableBase + 0x4000 + 16 * i + 8] == 258\r\n// && $IomMem[tableBase + 0x4000 + 16 * i + 12] == 0);\r\n// ensures (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 256 ==>\r\n// $IomMem[tableBase + 0x5000 + 16 * i + 0] == tableBase + 0x4000 + 1\r\n// && $IomMem[tableBase + 0x5000 + 16 * i + 4] == 0\r\n// && $IomMem[tableBase + 0x5000 + 16 * i + 8] == 0\r\n// && $IomMem[tableBase + 0x5000 + 16 * i + 12] == 0);\r\n// ensures $IomMem[?dmaLo - 8] == ?BYTE_VECTOR_VTABLE;\r\n// ensures $IomMem[?dmaLo - 4] == ?dmaHi - ?dmaLo;\r\n//{\r\n// var dmaLo@ebx := ecx;\r\n//\r\n// var $entry:int := 0;\r\n// var ptr@edi := tableBase; ptr := ptr + 0x4000;\r\n// var end@ebp := ptr; end := end + 4096;\r\n// ecx := tableBase; ecx := ecx + 0x3003;\r\n// edx := tableBase; edx := edx + 0x4001;\r\n// while (ptr < end)\r\n// invariant Aligned(ptr) && TV(ptr) && TO(1) && TO(2) && TO(3) && TO(4);\r\n// invariant tableBase == old(tableBase);\r\n// invariant dmaLo == ?dmaLo;\r\n// invariant ecx == tableBase + 0x3003;\r\n// invariant edx == tableBase + 0x4001;\r\n// invariant ptr == tableBase + 0x4000 + 16 * $entry;\r\n// invariant end == tableBase + 0x4000 + 4096;\r\n// invariant 0 <= $entry && $entry <= 256;\r\n// invariant IoPageTable($IomMem, tableBase);\r\n// invariant (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 512 ==>\r\n// ($IomMem[tableBase + 0x1000 + 8 * i] == 0 || $IomMem[tableBase + 4096 + 8 * i] == tableBase + 3)\r\n// && $IomMem[tableBase + 0x1000 + 8 * i + 4] == 0);\r\n// invariant (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 512 ==>\r\n// $IomMem[tableBase + 0x2000 + 8 * i] == 0\r\n// && $IomMem[tableBase + 0x2000 + 8 * i + 4] == 0);\r\n// invariant (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 512 ==>\r\n// $IomMem[tableBase + 0x3000 + 8 * i] == 0\r\n// && $IomMem[tableBase + 0x3000 + 8 * i + 4] == 0);\r\n// invariant (forall i:int::{TV(i)} TV(i) && 0 <= i && i < $entry ==>\r\n// $IomMem[tableBase + 0x4000 + 16 * i + 0] == tableBase + 0x3000 + 3\r\n// && $IomMem[tableBase + 0x4000 + 16 * i + 4] == 0\r\n// && $IomMem[tableBase + 0x4000 + 16 * i + 8] == 258\r\n// && $IomMem[tableBase + 0x4000 + 16 * i + 12] == 0);\r\n// invariant (forall i:int::{TV(i)} TV(i) && 0 <= i && i < $entry ==>\r\n// $IomMem[tableBase + 0x5000 + 16 * i + 0] == tableBase + 0x4000 + 1\r\n// && $IomMem[tableBase + 0x5000 + 16 * i + 4] == 0\r\n// && $IomMem[tableBase + 0x5000 + 16 * i + 8] == 0\r\n// && $IomMem[tableBase + 0x5000 + 16 * i + 12] == 0);\r\n// {\r\n// call IomStore(ptr + 0, ecx);\r\n// call IomStore(ptr + 4, 0);\r\n// call IomStore(ptr + 8, 258);\r\n// call IomStore(ptr + 0xc, 0);\r\n// assert TO(1024) && TO(1025) && TO(1026) && TO(1027);\r\n// call IomStore(ptr + 0x1000, edx);\r\n// call IomStore(ptr + 0x1004, 0);\r\n// call IomStore(ptr + 0x1008, 0);\r\n// call IomStore(ptr + 0x100c, 0);\r\n// $entry := $entry + 1;\r\n// ptr := ptr + 16;\r\n// }\r\n//\r\n// assert TV(tableBase);\r\n// assert TV(0) && TO(2048) && TO(3072);\r\n// edx := tableBase; edx := edx + 0x1003;\r\n// call IomStore(tableBase + 0x2000, edx);\r\n// edx := tableBase; edx := edx + 0x2003;\r\n// call IomStore(tableBase + 0x3000, edx);\r\n//\r\n// edx := dmaLo;\r\n// call edx := AddChecked(edx, 0x1200000);\r\n// var dmaHi@ebp := edx;\r\n//\r\n// assert TV(?dmaLo) && TO(0 - 1) && TO(0 - 2);\r\n// ecx := dmaLo; ecx := ecx - 8;\r\n// edx := ?BYTE_VECTOR_VTABLE;\r\n// call IomStore(ecx, edx);\r\n// edx := dmaHi; edx := edx - dmaLo;\r\n// call IomStore(ecx + 4, edx);\r\n//}\r\n//\r\n//procedure setupIoTablesHelper3(tableBase@esi)\r\n// requires and(tableBase + 0x5000, 4095) == 0;\r\n// requires IoContextTable($IomMem, tableBase + 0x4000);\r\n// requires (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 256 ==>\r\n// $IomMem[tableBase + 0x5000 + 16 * i + 0] == tableBase + 0x4000 + 1\r\n// && $IomMem[tableBase + 0x5000 + 16 * i + 4] == 0\r\n// && $IomMem[tableBase + 0x5000 + 16 * i + 8] == 0\r\n// && $IomMem[tableBase + 0x5000 + 16 * i + 12] == 0);\r\n// ensures IoRootTable($IomMem, tableBase + 0x5000);\r\n//{\r\n//}\r\n//\r\n//implementation SetupIoTables()\r\n//{\r\n// call espAligned();\r\n// call esp := Sub(esp, 4);\r\n// eax := ecx; eax := eax + 65536;\r\n// var dmaLo @ stk[esp + 0] := eax;\r\n//\r\n// ecx := ecx + 4096;\r\n// var tableBase@esi := ecx; tableBase := tableBase + 4096;\r\n// call __is4kAligned(ecx);\r\n// call __add4kAligned(ecx - and(ecx, 4095) + 0x0000);\r\n// call __add4kAligned(ecx - and(ecx, 4095) + 0x1000);\r\n// call __add4kAligned(ecx - and(ecx, 4095) + 0x2000);\r\n// call __add4kAligned(ecx - and(ecx, 4095) + 0x3000);\r\n// call __add4kAligned(ecx - and(ecx, 4095) + 0x4000);\r\n// call __add4kAligned(ecx - and(ecx, 4095) + 0x5000);\r\n// call ecx := And(ecx, 4095);\r\n// tableBase := tableBase - ecx;\r\n// assert TV(tableBase);\r\n//\r\n// ecx := dmaLo; ecx := ecx + 0x200000;\r\n// var dmaAlignedLo@ebx := ecx; dmaAlignedLo := dmaAlignedLo + 0x200000;\r\n// call __is2m4kAligned(ecx);\r\n// call ecx := And(ecx, 0x1fffff);\r\n// dmaAlignedLo := dmaAlignedLo - ecx;\r\n//\r\n// call setupIoTablesHelper1();\r\n//\r\n// ecx := dmaLo;\r\n// call setupIoTablesHelper2();\r\n//\r\n// call setupIoTablesHelper3();\r\n//\r\n// eax := tableBase; eax := eax + 0x5000;\r\n// call esp := Add(esp, 4);\r\n// Return;\r\n//}\r\n\r\n//procedure setIoMmuRegs($entry:int, _regs@esi)\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n// inout mems:mems;\r\n// requires MemInv($Mem_Vars);\r\n// requires _regs == ?DrhdRegs[$entry];\r\n// requires IoRootTable(io._iom.IomMem, ebx);\r\n// requires io._iom.IoMmuState[$entry] == 0;\r\n// modifies eax, ecx, edx, esi, ebp;\r\n// modifies io._iom.IoMmuState;\r\n// modifies io._iom.IoFrozen;\r\n// modifies io._iom.IomFrozen;\r\n// modifies mem;\r\n// ensures io._iom.IoMmuState[$entry] == 4;\r\n// ensures (forall i:int::{io._iom.IoMmuState[i]} i != $entry ==> io._iom.IoMmuState[i] == old($State)._io._iom.IoMmuState[i]);\r\n// ensures MemInv($Mem_Vars);\r\n//{\r\n// call IomRegStore($entry, _regs + 32, ebx);\r\n// call IomRegStore($entry, _regs + 36, 0);\r\n//\r\n// eax := 1;\r\n// call eax := Shl(eax, 30);\r\n// call IomRegStore($entry, _regs + 24, eax);\r\n//\r\n// eax := 1;\r\n// call eax := Shl(eax, 31);\r\n// call IomRegStore($entry, _regs + 24, eax);\r\n//\r\n//// edx := 0;\r\n//// call eax := IomRegLoad($entry, _regs + 28);\r\n//// call writeHex();\r\n//}\r\n//\r\n//procedure ReadDmar(ptr@edi)\r\n// inout mems:mems;\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n// requires ?DmarExists;\r\n// requires ptr == ?DmarPtr;\r\n// requires IoRootTable(io._iom.IomMem, ebx);\r\n// requires io._iom.IomMem[?dmaLo - 8] == ?BYTE_VECTOR_VTABLE;\r\n// requires io._iom.IomMem[?dmaLo - 4] == ?dmaHi - ?dmaLo;\r\n// requires CleanIoMmuState($State);\r\n// requires MemInv($Mem_Vars);\r\n// requires SMemRequireRA(116, stk, esp, RET);\r\n// modifies eax, ebx, ecx, edx, esi, edi, ebp, esp, $Mem, stk;\r\n// modifies io._iom.IoMmuState, io._iom.IomFrozen, io._iom.IoMmuEnabled;\r\n// ensures io._iom.IoMmuEnabled;\r\n// ensures MemInv($Mem_Vars);\r\n// ensures SMemEnsure(stk, old(stk), esp, old(esp));\r\n//{\r\n// call espAligned();\r\n// call esp := Sub(esp, 8);\r\n// assert(((state._io)._vga)==((old($State)._io)._vga));\r\n// call ecx := RoLoad32(ptr + 4);\r\n// assert(((state._io)._vga)==((old($State)._io)._vga));\r\n// eax := ptr; eax := eax + ecx;\r\n// var end @ stk[esp + 0] := eax;\r\n//\r\n// var $entry:int := 0;\r\n// ptr := ptr + 48;\r\n// while (ptr < end)\r\n// invariant TV($entry);\r\n// invariant IoRootTable(io._iom.IomMem, ebx);\r\n// invariant ?DmarPtr + 48 <= ptr && ptr <= ?DmarPtr + ?DmarLen;\r\n// invariant MaybeDrhd(ptr, $entry);\r\n// invariant (forall i:int::{io._iom.IoMmuState[i]} i >= $entry ==> io._iom.IoMmuState[i] == 0);\r\n// invariant (forall i:int::{io._iom.IoMmuState[i]} 0 <= i && i < $entry ==> io._iom.IoMmuState[i] == 4);\r\n// invariant MemInv($Mem_Vars);\r\n// invariant SMemInv(stk, old(stk), esp + 8, old(esp));\r\n// {\r\n// var typ@edx;\r\n// var len@ecx;\r\n// call typ := RoLoadU16(ptr + 0);\r\n// call len := RoLoadU16(ptr + 2);\r\n// if (typ != 0)\r\n// {\r\n// call drhdEnd(ptr, $entry);\r\n// goto done;\r\n// }\r\n// call drhdExists(ptr, $entry);\r\n// call eax := RoLoad32(ptr + 12);\r\n// if (eax != 0)\r\n// {\r\n// eax := 0x55550066;\r\n// call debugBreak();\r\n// }\r\n// call esi := RoLoad32(ptr + 8);\r\n//\r\n// var saveEcx @ stk[esp + 4] := ecx;\r\n// assert(MemInv($Mem_Vars));\r\n// call setIoMmuRegs($entry);\r\n// ecx := saveEcx;\r\n//\r\n// $entry := $entry + 1;\r\n// ptr := ptr + len;\r\n// }\r\n// call drhdEnd(ptr, $entry);\r\n//\r\n// done:\r\n// // TODO\r\n// infloop:\r\n// invariant logical_addressing_inv(init, ptMem, core_state);\r\n// goto infloop;\r\n// call IomEnable();\r\n// call esp := Add(esp, 8);\r\n// Return;\r\n//}\r\n//\r\n//procedure ReadRsdt(ptr@esi)\r\n// inout mems:mems;\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n// requires ?RsdpExists;\r\n// requires !io._iom.IoMmuEnabled;\r\n// requires ptr == ?RsdtPtr;\r\n// requires ebp == ?dmaLo && word(ebp);\r\n// requires IoRootTable(io._iom.IomMem, ebx);\r\n// requires io._iom.IomMem[?dmaLo - 8] == ?BYTE_VECTOR_VTABLE;\r\n// requires io._iom.IomMem[?dmaLo - 4] == ?dmaHi - ?dmaLo;\r\n// requires CleanIoMmuState($State);\r\n// requires MemInv($Mem_Vars);\r\n// requires SMemRequireRA(124, stk, esp, RET);\r\n// modifies eax, ebx, ecx, edx, esi, edi, ebp, esp, $Mem, stk;\r\n// modifies io._iom.IoMmuState, io._iom.IomFrozen, io._iom.IoMmuEnabled;\r\n// modifies DmaAddr;\r\n// ensures ((DmaAddr == 0 && !io._iom.IoMmuEnabled)\r\n// || (DmaAddr == ?dmaLo && io._iom.IoMmuEnabled));\r\n// ensures MemInv($Mem_Vars);\r\n// ensures SMemEnsure(stk, old(stk), esp, old(esp));\r\n//{\r\n// call espAligned();\r\n// call esp := Sub(esp, 4);\r\n// var dmaLo @ stk[esp + 0] := ebp;\r\n//\r\n// call ecx := RoLoad32(ptr + 4);\r\n// var end@ebp := ptr; end := end + ecx;\r\n//\r\n// var $entry:int := 0;\r\n// ptr := ptr + 36;\r\n// while (ptr < end)\r\n// invariant IoRootTable(io._iom.IomMem, ebx);\r\n// invariant end == ?RsdtPtr + ro32(?RsdtPtr + 4);\r\n// invariant TV($entry);\r\n// invariant ptr == ?RsdtPtr + 36 + 4 * $entry;\r\n// invariant 0 <= $entry && $entry <= ?RsdtCount;\r\n// invariant (forall j:int::{TV(j)} TV(j) && 0 <= j && j < $entry\r\n// ==> !MatchesDmar(ro32(?RsdtPtr + 36 + 4 * j)));\r\n// invariant MemInv($Mem_Vars);\r\n// invariant SMemInv(stk, old(stk), esp + 4, old(esp));\r\n// invariant CleanIoMmuState($State);\r\n// invariant !io._iom.IoMmuEnabled;\r\n// {\r\n// call ecx := RoLoad32(ptr + 0);\r\n// call edx := RoLoad32(ecx + 0);\r\n// if (edx == 0x52414d44)\r\n// {\r\n// // Found a DMAR entry. Good.\r\n// var $dmarEntry:int := $entry;\r\n// var dmarPtr@edi := ecx;\r\n// var $dmarPtr:int := dmarPtr;\r\n// assert MatchesDmar(dmarPtr);\r\n// $entry := $entry + 1;\r\n// ptr := ptr + 4;\r\n// while (ptr < end)\r\n// invariant IoRootTable(io._iom.IomMem, ebx);\r\n// invariant end == ?RsdtPtr + ro32(?RsdtPtr + 4);\r\n// invariant dmarPtr == $dmarPtr;\r\n// invariant TV($entry);\r\n// invariant ptr == ?RsdtPtr + 36 + 4 * $entry;\r\n// invariant 0 <= $entry && $entry <= ?RsdtCount;\r\n// invariant (forall j:int::{TV(j)} TV(j) && 0 <= j && j < $entry && j != $dmarEntry\r\n// ==> !MatchesDmar(ro32(?RsdtPtr + 36 + 4 * j)));\r\n// invariant MemInv($Mem_Vars);\r\n// invariant SMemInv(stk, old(stk), esp + 4, old(esp));\r\n// invariant CleanIoMmuState($State);\r\n// invariant !io._iom.IoMmuEnabled;\r\n// {\r\n// call ecx := RoLoad32(ptr + 0);\r\n// call edx := RoLoad32(ecx + 0);\r\n// if (edx == 0x52414d44)\r\n// {\r\n// // Found another DMAR entry. Bad.\r\n// DmaAddr := 0;\r\n// assert(!io._iom.IoMmuEnabled);\r\n// goto done;\r\n// }\r\n// $entry := $entry + 1;\r\n// ptr := ptr + 4;\r\n// }\r\n// call dmarExists(dmarPtr, $dmarEntry);\r\n// call ReadDmar();\r\n// eax := dmaLo;\r\n// DmaAddr := eax;\r\n// goto done;\r\n// }\r\n// $entry := $entry + 1;\r\n// ptr := ptr + 4;\r\n// }\r\n// DmaAddr := 0;\r\n//\r\n// done:\r\n// call esp := Add(esp, 4);\r\n// Return;\r\n//}\r\n//\r\n//implementation StartIoMmu()\r\n//{\r\n// call espAligned();\r\n// call esp := Sub(esp, 4);\r\n// var dmaLo @ stk[esp + 0] := ebp;\r\n// var $entry:int := 0;\r\n// var ptr@esi := ?RoBiosLo;\r\n// while (ptr < 0xffff0) // ?RoBiosHi - 16\r\n// invariant IoRootTable(io._iom.IomMem, ebx);\r\n// invariant TV($entry);\r\n// invariant ptr == ?RoBiosLo + 16 * $entry;\r\n// invariant ?RoBiosLo <= ptr && ptr <= ?RoBiosHi - 16;\r\n// invariant (forall j:int::{TV(j)} TV(j) && j < $entry && inBiosRo(?RoBiosLo + 16 * j)\r\n// ==> !MatchesRsdp(?RoBiosLo + 16 * j));\r\n// invariant MemInv($Mem_Vars);\r\n// invariant SMemInv(stk, old(stk), esp + 4, old(esp));\r\n// invariant CleanIoMmuState($State);\r\n// invariant !io._iom.IoMmuEnabled;\r\n// {\r\n// call ecx := RoLoad32(ptr + 0);\r\n// call edx := RoLoad32(ptr + 4);\r\n//\r\n// if (ecx == 0x20445352)\r\n// {\r\n// if (edx == 0x20525450)\r\n// {\r\n// var ptr2@edi := ptr;\r\n// var sum@ebp := 0;\r\n// var ptr_20@edx := ptr; ptr_20 := ptr_20 + 20;\r\n// while (ptr2 < ptr_20)\r\n// invariant IoRootTable(io._iom.IomMem, ebx);\r\n// invariant TV(ptr) && TV(ptr2);\r\n// invariant ptr == ?RoBiosLo + 16 * $entry;\r\n// invariant ptr_20 == ptr + 20;\r\n// invariant ptr <= ptr2 && ptr2 <= ptr + 20;\r\n// invariant sum == ByteSum(ptr, ptr2);\r\n// invariant MemInv($Mem_Vars);\r\n// invariant SMemInv(stk, old(stk), esp + 4, old(esp));\r\n// invariant CleanIoMmuState($State);\r\n// invariant !io._iom.IoMmuEnabled;\r\n// {\r\n// call eax := RoLoadU8(ptr2);\r\n// call sum := AddChecked(sum, eax);\r\n// ptr2 := ptr2 + 1;\r\n// }\r\n//\r\n// call sum := And(sum, 0xff);\r\n// if (sum == 0)\r\n// {\r\n// call rsdpExists(ptr, $entry);\r\n// call ptr := RoLoad32(ptr + 16);\r\n// ebp := dmaLo;\r\n// call ReadRsdt();\r\n// goto done;\r\n// }\r\n// }\r\n// }\r\n//\r\n// $entry := $entry + 1;\r\n// ptr := ptr + 16;\r\n// }\r\n// DmaAddr := 0;\r\n//\r\n// done:\r\n// call esp := Add(esp, 4);\r\n// Return;\r\n//}\r\n//\r\n//\r\n//implementation Proc_SerialDbgWordOut()\r\n//{\r\n// assert TV((core._regs)[ESP]);\r\n// call core := logical_Sub($State, core, OReg(ESP), OConst(0));\r\n// call serialDbgWordOut();\r\n// call core := logical_Add($State, core, OReg(ESP), OConst(0));\r\n// Return;\r\n//}\r\n//\r\n//implementation Proc_SerialDbgNewlineOut()\r\n//{\r\n// assert TV((core._regs)[ESP]);\r\n//// call core := logical_Sub($State, core, OReg(ESP), OConst(0));\r\n// call serialDbgNewlineOut();\r\n//// call core := logical_Add($State, core, OReg(ESP), OConst(0));\r\n// Return;\r\n//}\r\n//\r\n//implementation Proc_serialPortOut($ghost_in:int)\r\n//{\r\n// assert TV(esp);\r\n//// call core := logical_Sub($State, core, OReg(ESP), OConst(0));\r\n// call serialDbgDataOut8( );\r\n//// call core := logical_Add($State, core, OReg(ESP), OConst(0));\r\n// Return;\r\n//}\r\n//\r\n//implementation Proc_serialPortIn() returns ($ghost_out:int)\r\n//{\r\n// assert TV(esp);\r\n//// call core := logical_Sub($State, core, OReg(ESP), OConst(0));\r\n// call serialDbgDataIn8();\r\n// $ghost_out := eax;\r\n//// call core := logical_Add($State, core, OReg(ESP), OConst(0));\r\n// Return;\r\n//}\r\n//\r\n//implementation Proc_sample(M:[int]int) returns ($ghost_out:int)\r\n//{\r\n// assert TV(esp);\r\n//// call core := logical_Sub($State, core, OReg(ESP), OConst(0));\r\n// call SampleIn32(M);\r\n// $ghost_out := eax;\r\n//// call core := logical_Add($State, core, OReg(ESP), OConst(0));\r\n// Return;\r\n//}\r\n\r\nprocedure prepDEVmemOnes(inout linear dev_mem:mem)\r\n inout my r:regs, my core_state:core_state;\r\n requires !init;\r\n requires ?CodeBase == 0x300000;\r\n requires (forall i:int :: {dev_mem.dom[i]} dev_mem.dom[i] <==> (?DEVLo <= i && i < ?DEVHi));\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n modifies efl, eax, ebx, ecx, edx, esi, edi;\r\n ensures (forall i:int :: PhysPtrOk(dev_mem, i) && ?DEVLo + 96 <= i ==> dev_mem.map[i] == 0xFFFFFFFF);\r\n ensures (forall i:int :: {dev_mem.dom[i]} dev_mem.dom[i] <==> (?DEVLo <= i && i < ?DEVHi));\r\n ensures (forall i:int :: i < ?DEVLo + 96 ==> dev_mem.map[i] == old(dev_mem.map[i]));\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n{\r\n ebx := 0x30F060; \r\n call reveal_Aligned(ebx);\r\n assert Aligned(ebx);\r\n\r\n assert ?DEVLo == 0x300000+60*1024;\r\n\r\n var i:int := 0; \r\n while (ebx < 0x310000) \r\n invariant 0 <= i;\r\n invariant ebx == ?DEVLo + 96 + 4*i;\r\n invariant (forall j:int :: {dev_mem.dom[j]} dev_mem.dom[j] <==> (?DEVLo <= j && j < ?DEVHi));\r\n invariant ebx < ?DEVHi ==> PhysPtrOk(dev_mem, ebx);\r\n invariant (forall j:int :: ?DEVLo + 96 <= j && j < ebx && Aligned(j) ==> dev_mem.map[j] == 0xFFFFFFFF);\r\n invariant (forall j:int :: j < ?DEVLo + 96 ==> dev_mem.map[j] == old(dev_mem.map[j]));\r\n {\r\n assert EvalPtrOk(OMem(MReg(EBX, 0)));\r\n assert PhysPtrOk(dev_mem, EvalPtr(r, OMem(MReg(EBX, 0))));\r\n assert word(EvalPtr(r, OMem(MReg(EBX, 0))));\r\n\r\n call Store(inout dev_mem, ebx, 0xFFFFFFFF);\r\n call __notAligned(ebx);\r\n ebx := ebx + 4;\r\n i := i + 1;\r\n assert TV(0x30F060) && TO(i);\r\n }\r\n}\r\n\r\nprocedure prepDEVmemZeroes(inout linear dev_mem:mem)\r\n inout my r:regs, my core_state:core_state;\r\n requires !init;\r\n requires ?CodeBase == 0x300000;\r\n requires (forall i:int :: {dev_mem.dom[i]} dev_mem.dom[i] <==> (?DEVLo <= i && i < ?DEVHi));\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n modifies efl, eax, ebx, ecx, edx, esi, edi;\r\n ensures (forall i:int :: PhysPtrOk(dev_mem, i) && ?DEVLo <= i && i < ?DEVLo + 96 ==> dev_mem.map[i] == 0);\r\n ensures (forall i:int :: {dev_mem.dom[i]} dev_mem.dom[i] <==> (?DEVLo <= i && i < ?DEVHi));\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n{\r\n ebx := 0x30F000; \r\n call reveal_Aligned(ebx);\r\n assert Aligned(ebx);\r\n\r\n var i:int := 0; \r\n while (ebx < 0x30F060) \r\n invariant 0 <= i;\r\n invariant ebx == ?DEVLo + 4*i;\r\n invariant (forall j:int :: {dev_mem.dom[j]} dev_mem.dom[j] <==> (?DEVLo <= j && j < ?DEVHi));\r\n invariant ebx < ?DEVLo + 96 ==> PhysPtrOk(dev_mem, ebx);\r\n invariant (forall j:int :: ?DEVLo <= j && j < ebx && Aligned(j) ==> dev_mem.map[j] == 0);\r\n {\r\n call Store(inout dev_mem, ebx, 0);\r\n call __notAligned(ebx);\r\n ebx := ebx + 4;\r\n i := i + 1;\r\n assert TV(0x30F000) && TO(i);\r\n }\r\n}\r\n\r\nprocedure prepDEVmem(inout linear dev_mem:mem)\r\n inout my r:regs, my core_state:core_state;\r\n requires !init;\r\n requires ?CodeBase == 0x300000;\r\n requires (forall i:int :: {dev_mem.dom[i]} dev_mem.dom[i] <==> (?DEVLo <= i && i < ?DEVHi));\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n modifies efl, eax, ebx, ecx, edx, esi, edi;\r\n ensures ValidDEV(dev_mem);\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n{\r\n call prepDEVmemZeroes(inout dev_mem);\r\n call prepDEVmemOnes(inout dev_mem);\r\n}\r\n\r\nprocedure pciConfigAddr($id:int, $offset:int)\r\n inout my r:regs, my core_state:core_state, linear io:IOState;\r\n requires ecx == $id;\r\n requires edx == $offset;\r\n requires IsValidPciId($id);\r\n requires IsValidPciOffset($offset);\r\n requires PciUninitialized(io);\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n requires public($id);\r\n requires public($offset);\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n modifies io, efl, eax, edx;\r\n ensures io._pci.PciConfigId == $id;\r\n ensures io._pci.PciConfigOffset == $offset;\r\n ensures edx == 0xcfc;\r\n ensures PciUninitialized(io);\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n ensures public(io._inCtr);\r\n ensures public(io._outCtr);\r\n{\r\n call reveal_IoInv();\r\n eax := ecx;\r\n call eax := Shl(eax, 8);\r\n call eax := Or(eax, edx);\r\n edx := 0x7fffffff;\r\n call edx := AddChecked(edx, 1);\r\n call eax := Or(eax, edx);\r\n edx := 0xcf8;\r\n call PciConfigAddrOut32($id, $offset);\r\n edx := 0xcfc;\r\n call reveal_IoInv();\r\n}\r\n\r\nprocedure findDEVCapability(id:int)\r\n inout my r:regs, my core_state:core_state, linear io:IOState;\r\n requires ecx == id;\r\n requires IsValidPciId(id);\r\n requires PciUninitialized(io);\r\n requires PciDeviceAtId(id);\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n requires public(id);\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n modifies io, efl, eax, ebx, ecx, edx, ebp, edi, esi;\r\n ensures esi == 1 ==> !Is_DEV_PCI_config(id);\r\n ensures esi == 2 ==> DEV_PciCapabilityAt(id, edx) && IsValidPciOffset(edx);\r\n ensures esi == 1 || esi == 2;\r\n ensures ecx == id;\r\n ensures PciUninitialized(io);\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n ensures public(esi);\r\n ensures public(ecx);\r\n ensures public(edx);\r\n ensures public(io._inCtr);\r\n ensures public(io._outCtr);\r\n{\r\n //- Does this device support capability lists?\r\n //- Check bit 4 in the device status register (which is bit 20 in the combined device control and status registers).\r\n //- The combined device control/status registers take up 32 bits starting at 0x04 into the device configuration space.\r\n edx := 0x4;\r\n var offset:int := 0x4;\r\n call pciConfigAddr(id, offset);\r\n call /* eax := */ PciConfigDataIn32(id, offset);\r\n call reveal_IoInv();\r\n var tmp:int := eax;\r\n\r\n ebx := 1;\r\n call ebx := Shl(ebx, 20);\r\n call eax := And(eax, ebx);\r\n assert (eax != 0) == GetBit(20, tmp);\r\n\r\n if (eax == 0) {\r\n assert !PciSupportsCapabilityList(id);\r\n esi := 1;\r\n } else {\r\n assert PciSupportsCapabilityList(id);\r\n\r\n //- Obtain the initial capabilities pointer\r\n edx := 0x34;\r\n offset := 0x34;\r\n call pciConfigAddr(id, offset);\r\n call /* eax := */ PciConfigDataIn32(id, offset);\r\n call reveal_IoInv();\r\n assert PciConfigReadResult(id, offset, eax);\r\n var tmp:int := eax;\r\n\r\n call lemma_shl_1();\r\n ebx := 1;\r\n call ebx := Shl(ebx, 8);\r\n call ebx := Sub(ebx, 1);\r\n call eax := And(eax, ebx); \r\n ebp := eax; //- cap ptr\r\n assert ebp == SelectLSBs(8, tmp);\r\n var cap_index:int := 0;\r\n assert PciCapabilityPtr(id, cap_index) == ebp;\r\n\r\n var done @ esi := 0;\r\n\r\n while (done == 0) \r\n invariant cap_index >= 0;\r\n invariant done == 0 ==> ebp == PciCapabilityPtr(id, cap_index);\r\n invariant (forall other_cap_index:int :: 0 <= other_cap_index && other_cap_index < cap_index \r\n ==> PciCapabilityID(id, other_cap_index) != 0x0f);\r\n invariant IsValidPciOffset(offset);\r\n invariant done == 0 ==> IsValidPciOffset(ebp);\r\n invariant done == 1 ==> !Is_DEV_PCI_config(id);\r\n invariant done == 2 ==> DEV_PciCapabilityAt(id, offset) && edx == offset && IsValidPciOffset(edx);\r\n invariant done == 0 || done == 1 || done == 2;\r\n //- Boilerplate\r\n invariant ecx == id;\r\n invariant IsValidPciId(id);\r\n invariant PciSupportsCapabilityList(id);\r\n invariant PciUninitialized(io);\r\n invariant logical_addressing_inv(init, ptMem, core_state);\r\n invariant public(done);\r\n invariant public(cap_index);\r\n invariant public(ebp);\r\n invariant public(id);\r\n invariant public(edx);\r\n invariant public(io._inCtr);\r\n invariant public(io._outCtr);\r\n {\r\n if (ebp == 0) {\r\n call cap_list_termination(id, cap_index);\r\n assert (forall other_cap_index:int :: 0 <= other_cap_index ==> PciCapabilityID(id, other_cap_index) != 0x0f);\r\n assert !Is_DEV_PCI_config(id);\r\n done := 1;\r\n } else {\r\n //- Read at the offset in the cap ptr\r\n edx := ebp;\r\n offset := ebp;\r\n call pciConfigAddr(id, offset);\r\n call /* eax := */ PciConfigDataIn32(id, offset);\r\n call reveal_IoInv();\r\n assert PciConfigReadResult(id, offset, eax);\r\n edx := ebp;\r\n assert edx == offset;\r\n\r\n //- Check whether it's a DEV capability ID\r\n ebp := eax;\r\n ebx := 1;\r\n call ebx := Shl(ebx, 8);\r\n call ebx := Sub(ebx, 1);\r\n call ebp := And(ebp, ebx); //- Cap ID\r\n assert PciCapabilityID(id, cap_index) == ebp;\r\n\r\n if (ebp == 0x0f) {\r\n //- Found the DEV\r\n assert TV(cap_index);\r\n assert DEV_PciCapabilityAt(id, offset);\r\n done := 2;\r\n } else {\r\n //- Extract the next pointer\r\n ebp := eax;\r\n ebx := 1;\r\n call ebx := Shl(ebx, 16);\r\n call ebx := Sub(ebx, 1);\r\n call ebp := And(ebp, ebx); \r\n assert ebp == SelectLSBs(16, eax);\r\n call ebp := Shr(ebp, 8); //- Next ptr\r\n assert PciCapabilityPtr(id, cap_index+1) == ebp;\r\n cap_index := cap_index+1;\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\nprocedure prep_DEV_Op(id:int, dev_offset:int)\r\n inout my r:regs, my core_state:core_state, linear io:IOState;\r\n requires ecx == id;\r\n requires edx == dev_offset;\r\n requires IsValidPciId(id);\r\n requires DEV_PciCapabilityAt(id, dev_offset);\r\n requires IsValidPciOffset(dev_offset+4);\r\n requires PciUninitialized(io);\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n requires public(id);\r\n requires public(dev_offset);\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n modifies io, efl, eax, edx;\r\n ensures DEV_Op(id, dev_offset, dev_offset+4);\r\n ensures io._pci.PciConfigId == id;\r\n ensures io._pci.PciConfigOffset == dev_offset + 4;\r\n ensures PciUninitialized(io);\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n ensures public(io._inCtr);\r\n ensures public(io._outCtr);\r\n{\r\n call edx := Add(edx, 4);\r\n call pciConfigAddr(id, edx);\r\n}\r\n\r\nprocedure prep_DEV_Data(id:int, dev_offset:int)\r\n inout my r:regs, my core_state:core_state, linear io:IOState;\r\n requires ecx == id;\r\n requires edx == dev_offset;\r\n requires IsValidPciId(id);\r\n requires DEV_PciCapabilityAt(id, dev_offset);\r\n requires IsValidPciOffset(dev_offset+8);\r\n requires PciUninitialized(io);\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n requires public(id);\r\n requires public(dev_offset);\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n modifies io, efl, eax, edx;\r\n ensures DEV_Data(id, dev_offset, dev_offset+8);\r\n ensures io._pci.PciConfigId == id;\r\n ensures io._pci.PciConfigOffset == dev_offset + 8;\r\n ensures PciUninitialized(io);\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n ensures public(io._inCtr);\r\n ensures public(io._outCtr);\r\n{\r\n call edx := Add(edx, 8);\r\n call pciConfigAddr(id, edx);\r\n}\r\n\r\nprocedure walkThroughDevStateMachine(inout linear dev_states:DEV_StateMachines, id:int, dev_offset:int)\r\n inout my r:regs, my core_state:core_state, linear io:IOState;\r\n requires ecx == id;\r\n requires edx == dev_offset;\r\n requires ?CodeBase == 0x300000;\r\n requires dev_states.states[id] is MemApproved;\r\n requires IsValidPciId(id);\r\n requires IsValidPciOffset(dev_offset);\r\n requires DEV_PciCapabilityAt(id, edx);\r\n requires PciUninitialized(io);\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n requires public(id);\r\n requires public(dev_offset);\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n modifies io, efl, eax, ebx, edx, ebp, edi, esi;\r\n// ensures dev_states == States(old(dev_states).states[id := Complete()]);\r\n ensures (forall other_id:int :: other_id != id ==> dev_states.states[other_id] == old(dev_states).states[other_id]); \r\n ensures dev_states.states[id] is Complete;\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n ensures PciUninitialized(io);\r\n ensures public(io._inCtr);\r\n ensures public(io._outCtr);\r\n{\r\n ebp := edx;\r\n\r\n //- Make sure there's enough room for the DEV registers\r\n edx := edx + 8;\r\n if (edx >= 256) {\r\n eax := 0x5555006f; //- Badly placed DEV offset\r\n call debugBreak();\r\n }\r\n assert IsValidPciOffset(dev_offset + 4);\r\n assert IsValidPciOffset(dev_offset + 8);\r\n\r\n edx := ebp;\r\n call prep_DEV_Op(id, dev_offset);\r\n eax := 0;\r\n edx := 0xcfc;\r\n call dev_states := DEV_PciConfigDataOut32(dev_states, id, dev_offset, dev_offset+4); \r\n assert dev_states.states[id] is SetOpBaseLo;\r\n call reveal_IoInv();\r\n edx := ebp;\r\n call prep_DEV_Data(id, dev_offset);\r\n eax := 0x30F001;\r\n edx := 0xcfc;\r\n call dev_states := DEV_PciConfigDataOut32(dev_states, id, dev_offset, dev_offset+8); \r\n assert dev_states.states[id] is SetDataBaseLo;\r\n\r\n edx := ebp;\r\n call prep_DEV_Op(id, dev_offset);\r\n eax := 0x100;\r\n edx := 0xcfc;\r\n call dev_states := DEV_PciConfigDataOut32(dev_states, id, dev_offset, dev_offset+4); \r\n assert dev_states.states[id] is SetOpBaseHi;\r\n\r\n edx := ebp;\r\n call prep_DEV_Data(id, dev_offset);\r\n eax := 0;\r\n edx := 0xcfc;\r\n call dev_states := DEV_PciConfigDataOut32(dev_states, id, dev_offset, dev_offset+8); \r\n assert dev_states.states[id] is SetDataBaseHi;\r\n\r\n edx := ebp;\r\n call prep_DEV_Op(id, dev_offset);\r\n eax := 0x300;\r\n edx := 0xcfc;\r\n call dev_states := DEV_PciConfigDataOut32(dev_states, id, dev_offset, dev_offset+4); \r\n assert dev_states.states[id] is SetOpCap;\r\n\r\n edx := ebp;\r\n call prep_DEV_Data(id, dev_offset);\r\n edx := 0xcfc;\r\n call dev_states := DEV_PciConfigDataIn32(dev_states, id, dev_offset, dev_offset+8); \r\n assert dev_states.states[id] is GotDataCap;\r\n call eax := Shr(eax, 16);\r\n ebx := 1;\r\n call ebx := Shl(ebx, 8);\r\n call lemma_shl_1();\r\n ebx := ebx - 1;\r\n call eax := And(eax, ebx);\r\n assert eax == num_DEV_map_regs(id);\r\n call upper_bits_clear_ubound_lemma();\r\n assert eax <= 1023;\r\n\r\n\r\n ebx := 0;\r\n esi := eax;\r\n assert esi == num_DEV_map_regs(id);\r\n\r\n while (ebx < esi) \r\n invariant esi == num_DEV_map_regs(id) && 0 <= num_DEV_map_regs(id) && num_DEV_map_regs(id) <= 1023;\r\n invariant 0 <= ebx && ebx <= num_DEV_map_regs(id);\r\n invariant ebx == 0 ==> dev_states.states[id] is GotDataCap;\r\n invariant ebx > 0 ==> dev_states.states[id] is SetDataMap && dev_states.states[id].d_map_index == ebx - 1;\r\n invariant ebp == dev_offset;\r\n invariant (forall other_id:int :: other_id != id ==> dev_states.states[other_id] == old(dev_states.states[other_id])); \r\n invariant PciUninitialized(io);\r\n invariant logical_addressing_inv(init, ptMem, core_state);\r\n invariant public(id);\r\n invariant public(dev_offset);\r\n invariant public(ebx);\r\n invariant public(esi);\r\n invariant public(io._inCtr);\r\n invariant public(io._outCtr);\r\n {\r\n edx := ebp;\r\n call prep_DEV_Op(id, dev_offset);\r\n eax := 0x200;\r\n eax := eax + ebx;\r\n edx := 0xcfc;\r\n call dev_states := DEV_PciConfigDataOut32(dev_states, id, dev_offset, dev_offset+4); \r\n assert dev_states.states[id] is SetOpMap;\r\n call reveal_IoInv();\r\n\r\n edx := ebp;\r\n call prep_DEV_Data(id, dev_offset);\r\n eax := 0;\r\n edx := 0xcfc;\r\n call dev_states := DEV_PciConfigDataOut32(dev_states, id, dev_offset, dev_offset+8); \r\n assert dev_states.states[id] is SetDataMap && dev_states.states[id].d_map_index == ebx;\r\n\r\n\r\n ebx := ebx + 1;\r\n }\r\n\r\n edx := ebp;\r\n call prep_DEV_Op(id, dev_offset);\r\n eax := 0x400;\r\n edx := 0xcfc;\r\n call dev_states := DEV_PciConfigDataOut32(dev_states, id, dev_offset, dev_offset+4); \r\n assert dev_states.states[id] is SetOpCtrl;\r\n\r\n edx := ebp;\r\n call prep_DEV_Data(id, dev_offset);\r\n eax := 0x31;\r\n edx := 0xcfc;\r\n call dev_states := DEV_PciConfigDataOut32(dev_states, id, dev_offset, dev_offset+8); \r\n assert dev_states.states[id] is SetDataCtrl;\r\n\r\n //- Loop until the cache invalidation completes\r\n ebx := 0;\r\n while (ebx == 0) \r\n invariant ebx == 0 ==> dev_states.states[id] is SetDataCtrl;\r\n invariant ebx == 1 ==> dev_states.states[id] is Complete;\r\n invariant ebx == 0 || ebx == 1;\r\n invariant ebp == dev_offset;\r\n invariant (forall other_id:int :: other_id != id ==> dev_states.states[other_id] == old(dev_states.states[other_id])); \r\n invariant PciUninitialized(io);\r\n invariant logical_addressing_inv(init, ptMem, core_state);\r\n invariant public(id);\r\n invariant public(dev_offset);\r\n invariant public(ebx);\r\n invariant public(io._inCtr);\r\n invariant public(io._outCtr);\r\n {\r\n edx := ebp;\r\n call prep_DEV_Data(id, dev_offset);\r\n edx := 0xcfc;\r\n call dev_states := DEV_PciConfigDataIn32(dev_states, id, dev_offset, dev_offset+8); \r\n call reveal_IoInv();\r\n var eax_val:int := eax;\r\n ebx := 1;\r\n call ebx := Shl(ebx, 4);\r\n call eax := And(eax, ebx);\r\n assert (eax != 0) == GetBit(4, eax_val);\r\n if (eax == 0) {\r\n ebx := 1;\r\n } else {\r\n ebx := 0;\r\n }\r\n }\r\n}\r\n\r\n\r\nprocedure pciEnumeration(inout linear dev_states:DEV_StateMachines)\r\n inout my r:regs, my core_state:core_state, linear io:IOState;\r\n requires (forall i:int :: dev_states.states[i] is MemApproved); \r\n requires ?CodeBase == 0x300000;\r\n requires PciUninitialized(io);\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n modifies io, efl, eax, ebx, ecx, edx, ebp, edi, esi;\r\n ensures (forall i:int ::{ dev_states.states[i] } IsValidPciId(i) ==> (Is_DEV_PCI_config(i) ==> dev_states.states[i] is Complete));\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n ensures PciUninitialized(io);\r\n ensures public(io._inCtr);\r\n ensures public(io._outCtr);\r\n{\r\n var pci_id @ ecx := 0;\r\n while (pci_id < 65536)\r\n invariant 0 <= pci_id && pci_id <= 65536;\r\n invariant (forall id:int :: pci_id <= id ==> dev_states.states[id] is MemApproved);\r\n invariant (forall id:int :: 0 <= id && id < pci_id ==> \r\n (Is_DEV_PCI_config(id) && dev_states.states[id] is Complete)\r\n || !Is_DEV_PCI_config(id));\r\n invariant PciUninitialized(io);\r\n invariant logical_addressing_inv(init, ptMem, core_state);\r\n invariant public(pci_id);\r\n invariant public(io._inCtr);\r\n invariant public(io._outCtr);\r\n {\r\n //- Check whether there is a device present at all\r\n edx := 0;\r\n call pciConfigAddr(pci_id, 0);\r\n call /* eax := */ PciConfigDataIn32(pci_id, 0);\r\n if (eax == 0xFFFFFFFF) {\r\n call non_existent_devices(pci_id);\r\n assert !Is_DEV_PCI_config(pci_id);\r\n } else {\r\n call findDEVCapability(ecx);\r\n\r\n if (esi == 2) {\r\n assert DEV_PciCapabilityAt(pci_id, edx);\r\n assert TV(edx) ==> Is_DEV_PCI_config(pci_id);\r\n var offset:int := edx;\r\n call walkThroughDevStateMachine(inout dev_states, pci_id, offset);\r\n assert TV(offset) && Is_DEV_PCI_config(pci_id);\r\n assert dev_states.states[pci_id] == Complete();\r\n } else {\r\n assert !Is_DEV_PCI_config(pci_id);\r\n }\r\n }\r\n pci_id := pci_id + 1;\r\n }\r\n}\r\n\r\nimplementation initDEV(linear dev_states:DEV_StateMachines, linear dev_mem:mem) returns (linear new_mem:mem)\r\n// inout my r:regs, my core_state:core_state, linear io:IOState;\r\n// requires !init;\r\n// requires ?CodeBase == 0x300000;\r\n// requires (forall i:int :: {dev_states.states[i]} dev_states.states[i] is Init); \r\n// requires (forall i:int :: {dev_mem.dom[i]} dev_mem.dom[i] <==> (Aligned(i) && ?DEVLo <= i && i < ?DEVHi));\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// modifies io, efl, eax, ebx, ecx, edx, esi, edi, ebp;\r\n// ensures (forall i:int ::{ new_mem.dom[i] } new_mem.dom[i] <==> Aligned(i) && ?CodeBase + 64*1024 + 124*1024 <= i && i < 128*1024*1024);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n{\r\n linear var dmem:mem := dev_mem;\r\n call prepDEVmem(inout dmem);\r\n\r\n linear var dstates:DEV_StateMachines := dev_states;\r\n call dstates := begin_DEV_enablement(dstates, dmem);\r\n \r\n assert (forall i:int :: {dstates.states[i]} dstates.states[i] is MemApproved); \r\n\r\n call pciEnumeration(inout dstates);\r\n\r\n call new_mem := complete_DEV_enablement(dstates);\r\n assert (forall i:int ::{ new_mem.dom[i] }{TV(i)} TV(i) ==> (new_mem.dom[i] <==> ?CodeBase + 64*1024 <= i && i < 128*1024*1024)); //- Top=base+64K DEV covers 128MB total\r\n\r\n\r\n //- Set the rest of the DEV, covering the rest of memory, to 0 to enable device accesses\r\n ebx := 0x310000; //- codeBase + 64K\r\n call reveal_Aligned(ebx);\r\n assert Aligned(ebx);\r\n var i:int := 0;\r\n while (ebx < 0x32F000) //- codeBase + 64K + 124K\r\n invariant 0 <= i && i <= 0x7c00;\r\n invariant ebx == 0x310000 + 4*i;\r\n invariant Aligned(ebx);\r\n invariant (forall j:int :: {new_mem.dom[j]}{TV(j)} TV(j) ==> (new_mem.dom[j] <==> (?CodeBase + 64*1024 <= j && j < 128*1024*1024)));\r\n invariant !init;\r\n invariant logical_addressing_inv(init, ptMem, core_state);\r\n {\r\n assert Aligned(ebx);\r\n assert EvalPtrOk(OMem(MReg(EBX, 0)));\r\n assert PhysPtrOk(new_mem, EvalPtr(r, OMem(MReg(EBX, 0))));\r\n assert word(EvalPtr(r, OMem(MReg(EBX, 0))));\r\n\r\n call Store(inout new_mem, ebx, 0);\r\n call __notAligned(ebx);\r\n ebx := ebx + 4;\r\n i := i + 1;\r\n assert TV(0x310000) && TO(i);\r\n }\r\n\r\n// assert (forall j:int :: {new_mem.dom[j]}{TV(j)} TV(j) ==> (new_mem.dom[j] <==> (Aligned(j) && ?CodeBase + 64*1024 <= j && j < 128*1024*1024)));\r\n// call reveal_Aligned(0x32F000);\r\n// assert Aligned(0x32F000);\r\n// assert TV(0x32F000) ==> new_mem.dom[0x32F000];\r\n\r\n //- Drop the DEV from new mem, so the rest of the implementation doesn't trample on it\r\n linear var extra_dev_mem:mem;\r\n call extra_dev_mem := memEmpty();\r\n call new_mem, extra_dev_mem := memTransfer(new_mem, extra_dev_mem, (lambda j:int:: 0x310000 <= j && j < 0x32F000));\r\n//\r\n// assert !(lambda j:int:: Aligned(j) && 0x310000 <= j && j < 0x32F000)[0x32F000];\r\n//\r\n// call reveal_Aligned(0x32F000);\r\n// assert Aligned(0x32F000);\r\n// //assert TV(0x32F000) ==> extra_dev_mem.dom[0x32F000];\r\n// assert TV(0x32F000) ==> new_mem.dom[0x32F000];\r\n\r\n\r\n// assert ?CodeBase + 64*1024 + 124*1024 == 0x32F000;\r\n// assert (forall i:int ::{ new_mem.dom[i] }{TV(i)} TV(i) ==> (new_mem.dom[i] ==> Aligned(i) && ?CodeBase + 64*1024 + 124*1024 <= i && i < 128*1024*1024));\r\n// assert (forall i:int ::{ new_mem.dom[i] }{TV(i)} TV(i) ==> (Aligned(i) && ?CodeBase + 64*1024 + 124*1024 <= i && i < 128*1024*1024 ==> new_mem.dom[i]));\r\n// assert (forall j:int ::{ new_mem.dom[j] }{TV(j)} TV(j) ==> (new_mem.dom[j] <==> Aligned(j) && ?CodeBase + 64*1024 + 124*1024 <= j && j < 128*1024*1024));\r\n\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Devices/PCI.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-\r\nmodule interface PCI\r\n{\r\n\r\n//procedure pciConfigRead32($id:int, $offset:int)\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n// inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n// requires ecx == $id;\r\n// requires edx == $offset;\r\n// requires 0 <= $id && $id < 65536;\r\n// requires 0 <= $offset && $offset < 256;\r\n// requires $id mod 4 == 0 && $offset mod 4 == 0;\r\n//// requires SMemRequireRA(4, stk, esp, RET);\r\n//// requires RET == ReturnToAddr($Mem[esp]);\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars); \r\n// modifies state, efl, eax, ecx, edx;\r\n//// ensures SMemEnsure(stk, old(stk), esp, old(esp));\r\n// ensures PciConfigReadResult(old(ecx), old(edx), eax);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n// ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n\r\n//- Does PCI enumeration to find a device with the specified Device & Vendor ID or dies trying \r\n//- if no such device is present\r\nprocedure pciFindDeviceVendor(device_vendor_id:int); \r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires ebp == device_vendor_id;\r\n requires word(device_vendor_id);\r\n requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars); \r\n requires public(device_vendor_id); \r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n modifies io, efl, eax, ebx, ecx, edx, esi, edi;\r\n ensures IsValidPciId(eax);\r\n ensures PciConfigReadResult(eax, 0, device_vendor_id);\r\n ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n ensures public(eax);\r\n ensures public(io._inCtr);\r\n ensures public(io._outCtr);\r\n\r\n//- Maps a PCI device into memory space or dies trying (if you've allocated too many PCI devices)\r\nprocedure pciMemMap(pLo:int, pHi:int, $id:int); \r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires ecx == $id;\r\n requires IsValidPciId($id); \r\n requires $id mod 4 == 0;\r\n requires and($id, 7) == 0;\r\n requires (exists ret:int :: PciConfigReadResult($id, 0, ret) && ret != 0xffff);\r\n requires edi == pLo && pLo == ?pciLo;\r\n requires edx == pHi && pHi == ?pciHi;\r\n requires (?pciHi - ?pciLo) mod 16 == 0;\r\n //requires SMemRequireInline(28, 0, stk, esp);\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars); \r\n requires public($id);\r\n requires public(pLo);\r\n requires public(pHi);\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n modifies io, efl, eax, ebx, ecx, edx, esi, edi, ebp, $pciMem;\r\n ensures eax == PciMemSize($id);\r\n ensures ebx == PciMemAddr($id);\r\n ensures ecx == $id;\r\n ensures word(PciMemAddr($id));\r\n ensures word(PciMemSize($id));\r\n ensures io._pci.PciConfigState[$id] == 4;\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n ensures public(eax);\r\n ensures public(ebx);\r\n ensures public(ecx);\r\n ensures public(io._inCtr);\r\n ensures public(io._outCtr);\r\n\r\n//- Searches our table of existing PCI mappings for the ID provided\r\n//- Returns the mapping's address (ebx) and size (eax), if found.\r\n//- Else sets ecx to 0 and returns a suggested slot (eax) for the new mapping\r\nprocedure lookupMapping(id:int, pLo:int, pHi:int)\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n //inout iovars:ioVars;\r\n requires IsValidPciId(id);\r\n requires esi == id;\r\n requires edi == pLo && pLo == ?pciLo;\r\n requires edx == pHi && pHi == ?pciHi;\r\n requires (?pciHi - ?pciLo) mod 16 == 0;\r\n requires Aligned(?pciLo);\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n requires public(id);\r\n requires public(pLo);\r\n requires public(pHi);\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n modifies efl, eax, ebx, ecx, edi, ebp;\r\n modifies mems.pci;\r\n ensures mems == old(mems);\r\n ensures ecx == 1 ==>\r\n eax == PciMemSize(id) && ebx == PciMemAddr(id) \r\n && word(PciMemSize(id)) \r\n && word(PciMemAddr(id))\r\n && io._pci.PciConfigState[id] == 4;\r\n ensures ecx == 0 ==> io._pci.PciConfigState[id] == 0;\r\n ensures ecx == 0 ==> ?pciLo <= ebx && ebx < ?pciHi && Aligned(ebx) && !IsValidPciId($pciMem[ebx])\r\n && (exists j:int :: TV(j) && 0 <= j && ebx == ?pciLo + 16*j);\r\n// ensures ecx == 0 ==> ?pciLo <= ebx && ebx < ?pciHi && Aligned(ebx) && !IsValidPciId($pciMem[ebx]) &&\r\n// (exists j:int :: TV(j) && 0 <= j && ebx == ?pciLo + 16*j);\r\n ensures ecx == 0 || ecx == 1;\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars); \r\n //ensures public(eax);\r\n //ensures public(ebx);\r\n //ensures public(ecx);\r\n ensures public(io._inCtr);\r\n ensures public(io._outCtr);\r\n\r\n\r\n//// internal extern static byte[] PciDmaBuffer();\r\n//procedure PciDmaBuffer();\r\n// requires RET == ReturnToAddr($Mem[esp]);\r\n// requires isStack($S) && SpRequire($S, esp, 4);\r\n// requires NucleusInv($S, $StackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars);\r\n// modifies state, efl, eax, edx, esp;\r\n// ensures esp == old(esp) + 4;\r\n// ensures $IoMmuEnabled ==> eax == ?dmaLo - 8;\r\n// ensures !$IoMmuEnabled ==> eax == 0;\r\n//\r\n//// internal extern static uint PciDmaPhysicalAddr();\r\n//procedure PciDmaPhysicalAddr();\r\n// requires RET == ReturnToAddr($Mem[esp]);\r\n// requires isStack($S) && SpRequire($S, esp, 4);\r\n// requires NucleusInv($S, $StackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars);\r\n// modifies state, efl, eax, edx, esp;\r\n// ensures esp == old(esp) + 4;\r\n// ensures $IoMmuEnabled ==> eax == ?dmaLo;\r\n// ensures !$IoMmuEnabled ==> eax == 0;\r\n//\r\n//// internal extern static uint PciMemRead32(uint id, uint offset);\r\n//procedure PciMemRead32($id:int, $offset:int);\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n// inout mems:mems;\r\n// requires word(eax) && word(ebx) && word(ecx) && word(edx) && word(esi) && word(edi) && word(ebp);\r\n// requires ecx == $id;\r\n// requires edx == $offset;\r\n// requires RET == ReturnToAddr($Mem[esp]);\r\n// requires isStack($S) && SpRequire($S, esp, 4);\r\n// requires NucleusInv($S, $StackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars);\r\n// modifies state, efl, eax, ebx, ecx, edx, esi, edi, esp; // not ebp\r\n// ensures esp == old(esp) + 4;\r\n// ensures PciMemLoaded($id, PciMemAddr($id) + $offset, eax);\r\n//\r\n//// internal extern static void PciMemWrite32(uint id, uint offset, uint val);\r\n//procedure PciMemWrite32($id:int, $offset:int, $val:int);\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n// inout mems:mems;\r\n// requires word(eax) && word(ebx) && word(ecx) && word(edx) && word(esi) && word(edi) && word(ebp);\r\n// requires ecx == $id;\r\n// requires edx == $offset;\r\n// requires $StacksFrames[$S].Slices[esp + 4] == $StacksFrames[$S].Count && $fMems[$S][esp + 4] == $val;\r\n// requires RET == ReturnToAddr($Mem[esp]);\r\n// requires isStack($S) && SpRequire($S, esp, 8);\r\n// requires NucleusInv($S, $StackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars);\r\n// modifies state, efl, eax, ebx, ecx, edx, esi, edi, esp; // not ebp\r\n// ensures esp == old(esp) + 4;\r\n// ensures PciMemStored($id, PciMemAddr($id) + $offset, $val);\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Devices/PCI.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\n//- Functions to interact with the PCI bus and its devices\r\n\r\n//-\r\nmodule implementation PCI\r\n{\r\n\r\nprocedure pciConfigAddr($id:int, $offset:int)\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires IsValidPciId($id);\r\n requires IsValidPciOffset($offset);\r\n requires ecx == $id;\r\n requires edx == $offset;\r\n requires logical_addressing_inv(init, ptMem, core_state);\r\n requires MemInv($Mem_Vars);\r\n requires public($id);\r\n requires public($offset);\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n// requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars); \r\n modifies io, efl, eax, edx;\r\n ensures io._pci.PciConfigId == $id;\r\n ensures io._pci.PciConfigOffset == $offset;\r\n ensures edx == 0xcfc;\r\n //- The following is the strongest we can say (can't say IoInv), because we use pciConfigAddr when IoInv isn't true\r\n //- Hence we can't require it, and thus can't ensure it\r\n ensures (forall i:int::{io._pci.PciConfigState[i]}\r\n 0 <= i && i < 65536 ==> (io._pci.PciConfigState[i] == old(io)._pci.PciConfigState[i])); \r\n ensures (forall addr:int :: ?pciLo <= addr && addr < ?pciHi ==> $pciMem[addr] == old($pciMem[addr]));\r\n ensures logical_addressing_inv(init, ptMem, core_state);\r\n ensures MemInv($Mem_Vars);\r\n ensures public(io._inCtr);\r\n ensures public(io._outCtr);\r\n// ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars); \r\n{\r\n call reveal_IoInv();\r\n eax := ecx;\r\n call eax := Shl(eax, 8);\r\n call eax := Or(eax, edx);\r\n edx := 0x7fffffff;\r\n call edx := AddChecked(edx, 1);\r\n call eax := Or(eax, edx);\r\n edx := 0xcf8;\r\n //assert IoInv_Transparent($IoVars, $pciMem);\r\n call PciConfigAddrOut32($id, $offset);\r\n //assert IoInv_Transparent($IoVars, $pciMem);\r\n edx := 0xcfc;\r\n //assert IoInv_Transparent($IoVars, $pciMem);\r\n call reveal_IoInv();\r\n //assert IoInv($IoVars, $pciMem);\r\n}\r\n\r\n// Searches our table of existing PCI mappings for the ID provided\r\n// Returns the mapping's address (ebx) and size (eax), if found.\r\n// Else sets ecx to 0 and returns a suggested slot (eax) for the new mapping\r\n//procedure lookupMapping(id:int, pLo:int, pHi:int)\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n// inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n// //inout iovars:ioVars;\r\n// requires IsValidPciId(id);\r\n// requires esi == id;\r\n// requires edi == pLo && pLo == ?pciLo;\r\n// requires edx == pHi && pHi == ?pciHi;\r\n// requires (?pciHi - ?pciLo) mod 16 == 0;\r\n// requires Aligned(?pciLo);\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n// modifies state, efl, eax, ebx, ecx, edi, ebp;\r\n// ensures ecx == 1 ==> eax == PciMemSize(id) && ebx == PciMemAddr(id) \r\n// && io._pci.PciConfigState[id] == 4;\r\n// ensures ecx == 0 ==> io._pci.PciConfigState[id] == 0;\r\n// ensures ecx == 0 ==> ?pciLo <= ebx && ebx < ?pciHi && Aligned(ebx) && !IsValidPciId($pciMem[ebx]) &&\r\n// (exists j:int :: TV(j) && 0 <= j && ebx == ?pciLo + 16*j);\r\n//// ensures ecx == 0 ==> ?pciLo <= ebx && ebx < ?pciHi && Aligned(ebx) && !IsValidPciId($pciMem[ebx]) &&\r\n//// (exists j:int :: TV(j) && 0 <= j && ebx == ?pciLo + 16*j);\r\n// ensures ecx == 0 || ecx == 1;\r\n// ensures logical_addressing_inv(init, ptMem, core);\r\n// ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars); \r\nimplementation lookupMapping(id:int, pLo:int, pHi:int)\r\n{\r\n call reveal_MemInvDetails();\r\n var i:int := 0;\r\n ecx := 0;\r\n ebx := PciLo; //- If we don't find an empty slot, default to overwriting the first one\r\n assert TV(0);\r\n call reveal_IoInv();\r\n assert TV(0);\r\n assert (exists j:int :: {TV(j)} ebx == ?pciLo + 16*j);\r\n while(edi < edx) \r\n invariant mems == old(mems);\r\n invariant edi == ?pciLo + 16*i;\r\n invariant ?pciLo <= edi && edi <= ?pciHi;\r\n invariant esi == id;\r\n invariant IsValidPciId(id);\r\n invariant ecx == 1 || ecx == 0;\r\n invariant ecx == 1 ==> eax == PciMemSize(id) && ebx == PciMemAddr(id)\r\n && word(PciMemSize(id)) && word(PciMemAddr(id))\r\n && io._pci.PciConfigState[id] == 4;\r\n invariant ecx == 0 ==> ?pciLo <= ebx && ebx < ?pciHi && Aligned(ebx) &&\r\n (exists j:int :: TV(j) && 0 <= j && ebx == ?pciLo + 16*j);\r\n invariant ecx == 0 ==> (forall j:int :: {TV(j)} TV(j) && 0 <= j && j < i ==> \r\n mems.pci[?pciLo + 16*j] != id);\r\n invariant ecx == 0 ==> (forall addr:int, j:int::{$pciMem[addr],TV(j)} TV(j) && 0 <= j\r\n && addr == ?pciLo + 16*j && ?pciLo <= addr && addr < edi \r\n ==> $pciMem[addr] != id);\r\n invariant logical_addressing_inv(init, ptMem, core_state);\r\n invariant NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars); \r\n //invariant public(eax);\r\n //invariant public(ebx);\r\n //invariant public(ecx);\r\n invariant public(edx);\r\n invariant public(edi);\r\n invariant public(esi);\r\n invariant public(io._inCtr);\r\n invariant public(io._outCtr);\r\n {\r\n call reveal_IoInv();\r\n assert Aligned(?pciLo) && TV(?pciLo) && TO(4*i);\r\n call ebp := Load($pciMem, edi);\r\n if (ebp == esi) {\r\n ecx := 1;\r\n assert TV(edi) && TO(1) && TO(2);\r\n call ebx := Load($pciMem, edi + 4);\r\n call eax := Load($pciMem, edi + 8);\r\n assert TV(i);\r\n assert ebx == PciMemAddr(id);\r\n assert eax == PciMemSize(id);\r\n }\r\n\r\n if (ebp == 0xffffffff) {\r\n if (ecx != 1) { //- Only save a slot if we haven't already found it\r\n //- Save an empty slot we can use if we don't find the mapping\r\n ebx := edi;\r\n assert ebx == ?pciLo + 16*i;\r\n assert TV(i) && (exists j:int :: ebx == ?pciLo + 16*j);\r\n assert Aligned(?pciLo) && TV(?pciLo) && TO(4*i);\r\n assert ?pciLo <= ebx && ebx < ?pciHi;\r\n }\r\n }\r\n \r\n edi := edi + 16;\r\n i := i + 1;\r\n }\r\n\r\n if (ecx == 0) {\r\n call ebp := Load($pciMem, ebx);\r\n // TODO: Turn this into a static check based on ghost counter of # of mapped PCI devices\r\n if (ebp < 65536) { //- ebx is pointed at a valid PCI id -- die instead of clobbering it\r\n eax := 0x5555002f;\r\n call debugBreak();\r\n }\r\n }\r\n\r\n// assert ecx == 0 ==> $pciMem[ebx] >= 65536;\r\n// assert ecx == 0 ==> !IsValidPciId($pciMem[ebx]); \r\n// assert ecx == 0 ==> ?pciLo <= ebx && ebx < ?pciHi && Aligned(ebx) && !IsValidPciId($pciMem[ebx]);\r\n// assert ecx == 0 ==> (exists j:int :: {TV(j)} TV(j) && 0 <= j && ebx == ?pciLo + 16*j);\r\n// assert ecx == 0 ==> ?pciLo <= ebx && ebx < ?pciHi && Aligned(ebx) && !IsValidPciId($pciMem[ebx]) &&\r\n// (exists j:int :: TV(j) && 0 <= j && ebx == ?pciLo + 16*j);\r\n\r\n// assert ecx == 0 ==> ?pciLo <= ebx && ebx < ?pciHi && \r\n// (exists j:int :: ebx == ?pciLo + 16*j && TV(?pciLo) && TO(4*j) && Aligned(ebx));\r\n// assert ecx == 0 ==> (exists j:int :: ebx == ?pciLo + 16*j);\r\n// assert Aligned(?pciLo) && TV(?pciLo); // && TO(4*j);\r\n// assert Aligned(ebx);\r\n call reveal_IoInv();\r\n}\r\n\r\n\r\n\r\n//procedure stack_test($id:int)\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n// inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n// requires ecx == $id;\r\n// requires 0 <= $id && $id < 65536;\r\n// requires $id mod 4 == 0;\r\n// requires (exists ret:int :: PciConfigReadResult($id, 0, ret) && ret != 0xffff);\r\n// //requires SMemRequire(28, stk, esp);\r\n// requires SMemRequireInline(28, 8, stk, esp);\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars); \r\n// modifies state, efl, eax, ebx, ecx, edx, esi, edi;\r\n// modifies mems;\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n// ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n//{\r\n// var temp @ stk[esp + 0] := ecx;\r\n// assert TV(esp) && TO(1);\r\n// var temp2 @ stk[esp + 4] := ecx;\r\n//\r\n//}\r\n\r\n\r\n// ecx = id\r\n// edx = offset\r\n//implementation pciConfigRead32($id:int, $offset:int)\r\n//{\r\n// eax := edx;\r\n// call eax := And(eax, 3);\r\n// if (eax != 0)\r\n// {\r\n// eax := 0x55550026;\r\n// call debugBreak();\r\n// }\r\n// assert (0 <= $id && $id < 65536);\r\n// call pciConfigAddr($id, $offset);\r\n// call /*eax :=*/ PciConfigDataIn32($id, $offset);\r\n//}\r\n\r\n//procedure pciConfigDataIn32(id:int, offset:int)\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n// inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n// requires IsValidPciId(id);\r\n// requires IsValidPciOffset(offset);\r\n// requires id == io._pci.PciConfigId;\r\n// requires offset == io._pci.PciConfigOffset;\r\n// requires old(regs)[EDX] == 0xcfc;\r\n// requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars); \r\n// //requires IoInv($IoVars, $pciMem);\r\n// requires logical_addressing_inv(init, ptMem, core_state);\r\n// modifies state, efl, eax, edx;\r\n// ensures (exists eax_val:int ::\r\n// $State._cores[me] == LogicalCoreUpdate1(old($State._cores[me]), OReg(EAX), eax, core._efl)\r\n// && PciConfigReadResult(id, offset, eax_val)\r\n// && (old($State)._io._pci.PciConfigState[id] == 0 && offset == 16 && and(eax_val, 15) == 0 ==> PciMemAddr(id) == eax_val)\r\n// && (old($State)._io._pci.PciConfigState[id] == 2 && offset == 16 ==> PciMemSize(id) == 1 + neg(eax_val))\r\n// && word(eax_val));\r\n// //ensures IoInv($IoVars, $pciMem);\r\n// ensures logical_addressing_inv(init, ptMem, core_state);\r\n// ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n//{\r\n// call reveal_IoInv();\r\n// assert (forall i:int::{io._pci.PciConfigState[i]} 0 <= i && i < 65536 ==> (io._pci.PciConfigState[i] == 0));\r\n// call /*eax :=*/ PciConfigDataIn32(id, offset);\r\n// assert state._io == old(state._io);\r\n// assert (forall i:int::{io._pci.PciConfigState[i]} 0 <= i && i < 65536 ==> (io._pci.PciConfigState[i] == 0));\r\n// call reveal_IoInv();\r\n// assert &&& &&& IoInv_Transparent($IoVars, $pciMem);\r\n//}\r\n\r\n\r\n\r\nimplementation pciFindDeviceVendor(device_vendor_id:int)\r\n{\r\n //var found @ edi;\r\n var pci_id @ esi;\r\n\r\n //- Walk through the PCI device space looking for a match\r\n var matching_id @ ebx := 65536;\r\n pci_id := 0;\r\n while (pci_id < 65536)\r\n invariant device_vendor_id == ebp;\r\n invariant 0 <= pci_id && pci_id <= 65536;\r\n invariant matching_id != 65536 ==> IsValidPciId(matching_id);\r\n invariant matching_id != 65536 ==> PciConfigReadResult(matching_id, 0, device_vendor_id);\r\n invariant NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars); \r\n invariant public(pci_id); \r\n invariant public(matching_id);\r\n invariant public(ebp);\r\n invariant public(io._inCtr);\r\n invariant public(io._outCtr);\r\n {\r\n call reveal_IoInv();\r\n ecx := pci_id;\r\n edx := 0;\r\n call pciConfigAddr(pci_id, 0);\r\n call /* eax := */ PciConfigDataIn32(pci_id, 0);\r\n call reveal_IoInv();\r\n\r\n if (eax == ebp) {\r\n matching_id := pci_id;\r\n }\r\n\r\n pci_id := pci_id + 1;\r\n }\r\n\r\n if (matching_id == 65536) {\r\n //- We didn't actually find it :(\r\n eax := 0x55550020;\r\n call debugBreak();\r\n }\r\n\r\n eax := matching_id;\r\n}\r\n\r\nimplementation pciMemMap(pLo:int, pHi:int, $id:int)\r\n{\r\n call reveal_MemInvDetails();\r\n call reveal_IoInv();\r\n eax := ecx;\r\n\r\n //- Check whether we've already mapped this device\r\n esi := ecx;\r\n call lookupMapping($id, pLo, pHi);\r\n if (ecx == 1) {\r\n //- Found a previous mapping -- panic!\r\n eax := 0x55550051;\r\n call debugBreak();\r\n// // Found a previous mapping! Our work here is done\r\n// ecx := esi;\r\n } else { \r\n var emptySlot@ebx; // Save the slot that lookupMapping found for us\r\n assert ecx == 0;\r\n assert ?pciLo <= ebx && ebx < ?pciHi && Aligned(ebx) && \r\n (exists j:int :: 0 <= j && ebx == ?pciLo + 16*j);\r\n// assert ?pciLo <= ebx && ebx < ?pciHi && Aligned(ebx) && !IsValidPciId($pciMem[ebx]) &&\r\n// (exists j:int :: 0 <= j && ebx == ?pciLo + 16*j);\r\n assert (exists j:int :: {TV(j)} TV(j) && 0 <= j && ebx == ?pciLo + 16*j);\r\n assert (exists j:int :: 0 <= j && ebx == ?pciLo + 16*j);\r\n\r\n //- Device and Vendor ID\r\n edx := 0;\r\n ecx := esi;\r\n call reveal_IoInv();\r\n assert IoInv_Transparent($IoVars, $pciMem);\r\n call pciConfigAddr($id, 0);\r\n assert IoInv_Transparent($IoVars, $pciMem);\r\n call /*eax :=*/ PciConfigDataIn32($id, 0);\r\n var dev_vendor_id:int := eax;\r\n call eax := And(eax, 65535);\r\n if (eax == 65535)\r\n {\r\n eax := 0x55550021;\r\n call debugBreak();\r\n }\r\n\r\n //- Status and Command registers\r\n edx := 4;\r\n call pciConfigAddr($id, 4);\r\n call /*eax :=*/ PciConfigDataIn32($id, 4);\r\n var status_cmd @ ebp := eax;\r\n assert IoInv_Transparent($IoVars, $pciMem);\r\n\r\n //- BIST || Header Type || LatencyTimer || CacheLineSize\r\n edx := 12;\r\n call pciConfigAddr($id, 12);\r\n call /*eax :=*/ PciConfigDataIn32($id, 12);\r\n var header @ esi := eax;\r\n\r\n //- Grab the first base address register (BAR)\r\n edx := 16;\r\n call pciConfigAddr($id, 16);\r\n call /*eax :=*/ PciConfigDataIn32($id, 16);\r\n var bar @ edi := eax;\r\n\r\n //- Check HeaderType is Type 0 (normal PCI, not a bridge or a CardBus)\r\n eax := header;\r\n var ghost_header:int := header; //- Save a ghost copy, so we can reuse esi\r\n call eax := Shr(eax, 16);\r\n call eax := And(eax, 0xff);\r\n if (eax != 0)\r\n {\r\n eax := 0x55550022;\r\n call debugBreak();\r\n }\r\n assert IoInv_Transparent($IoVars, $pciMem);\r\n\r\n //- Check MemoryAddress type (lower three bits must be 0 for memory-mapped BAR)\r\n eax := bar;\r\n call eax := And(eax, 15);\r\n if (eax != 0)\r\n {\r\n eax := 0x55550023;\r\n call debugBreak();\r\n }\r\n\r\n //- Make sure the address is in a sane location\r\n if (bar < 0xC0000000) \r\n {\r\n eax := 0x55550024;\r\n call debugBreak();\r\n }\r\n\r\n //- Walkthrough PCI memory mapping state machine\r\n\r\n call reveal_IoInv();\r\n assert IoInv_Transparent($IoVars, $pciMem);\r\n\r\n //- State 0 - Disable memory mapping\r\n edx := 4;\r\n call pciConfigAddr($id, 4);\r\n esi := 0xfffffffd;\r\n eax := status_cmd;\r\n call reveal_IoInv();\r\n call eax := And(eax, esi);\r\n call PciConfigDataOut32($id, 4, dev_vendor_id, status_cmd, ghost_header, bar);\r\n\r\n //- State 1 - Ask the device what size it wants\r\n edx := 16;\r\n call pciConfigAddr($id, 16);\r\n eax := 0xffffffff;\r\n call PciConfigDataOut32($id, 16, dev_vendor_id, status_cmd, ghost_header, bar);\r\n\r\n edx := 16;\r\n call pciConfigAddr($id, 16);\r\n call /*eax :=*/ PciConfigDataIn32($id, 16);\r\n\r\n //- Calculate the size requested as (~eax)+1\r\n call eax := Not(eax);\r\n call eax := AddChecked(eax, 1);\r\n assert (eax == PciMemSize($id));\r\n var sizeBits @ esi := eax; \r\n\r\n //- Make sure we're not going to clobber the TPM\r\n call eax := AddChecked(eax, bar);\r\n if (eax >= 0xFED40000)\r\n {\r\n eax := bar;\r\n if (eax < 0xFED45000) \r\n {\r\n eax := 0x55550025;\r\n call debugBreak();\r\n }\r\n }\r\n\r\n //- State 2 - Restore the previous address\r\n edx := 16;\r\n call pciConfigAddr($id, 16);\r\n eax := bar;\r\n call PciConfigDataOut32($id, 16, dev_vendor_id, status_cmd, ghost_header, bar);\r\n\r\n //- State 3 - Turn memory mapping back on\r\n edx := 4;\r\n call pciConfigAddr($id, 4);\r\n eax := status_cmd;\r\n call eax := Or(eax, 2);\r\n call PciConfigDataOut32($id, 4, dev_vendor_id, status_cmd, ghost_header, bar);\r\n\r\n //- State 4 - Store and return the results\r\n assert Aligned(emptySlot) && TV(emptySlot) && TO(1) && TO(2);\r\n call Store(inout mems.pci, emptySlot, ecx);\r\n call Store(inout mems.pci, emptySlot + 4, bar);\r\n call Store(inout mems.pci, emptySlot + 8, sizeBits);\r\n\r\n call reveal_IoInv();\r\n// assert PciMemAddr($id) == bar;\r\n// assert PciMemSize($id) == sizeBits;\r\n// assert SafePciMemRegion(bar, sizeBits);\r\n// assert io._pci.PciConfigState[$id] == 4;\r\n// assert $pciMem[emptySlot] == $id;\r\n// assert $pciMem[emptySlot+4] == PciMemAddr($pciMem[emptySlot]);\r\n// assert $pciMem[emptySlot+8] == PciMemSize($pciMem[emptySlot]);\r\n\r\n// assert (forall addr:int, j:int::{$pciMem[addr],TV(j)} TV(j) && 0 <= j &&\r\n// addr == ?pciLo + 16*j && addr <= ?pciHi - 16 ==>\r\n// (IsValidPciId($pciMem[addr]) ==> \r\n// $pciMem[addr + 4] == PciMemAddr($pciMem[addr]) \r\n// && $pciMem[addr + 8] == PciMemSize($pciMem[addr])\r\n// && SafePciMemRegion(PciMemAddr($pciMem[addr]), PciMemSize($pciMem[addr]))\r\n// && io._pci.PciConfigState[$pciMem[addr]] == 4 )) ;\r\n\r\n// assert ?pciLo <= ebx && ebx <= ?pciHi - 16;\r\n// assert (exists j:int :: {TV(j)} TV(j) && 0 <= j && ebx == ?pciLo + 16*j);\r\n// assert (exists j:int :: {TV(j)} TV(j) && 0 <= j && ebx == ?pciLo + 16*j && ebx <= ?pciHi - 16);\r\n// assert (exists j:int :: {TV(j)} TV(j) && 0 <= j && ebx == ?pciLo + 16*j && ebx <= ?pciHi - 16 && $pciMem[ebx]==$id && true);\r\n assert (exists j:int :: {TV(j)} TV(j) && 0 <= j && ebx == ?pciLo + 16*j && ebx <= ?pciHi - 16 && $pciMem[ebx]==$id && TV(j));\r\n// assert $pciMem[ebx] == $id;\r\n// assert (forall addr:int, j:int::{$pciMem[addr],TV(j)} TV(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 \r\n// ==> $pciMem[addr] != $id);\r\n// assert (exists j:int:: {TV(j)} (0 <= j\r\n// && ebx == ?pciLo + 16*j && ebx <= ?pciHi - 16 \r\n// && $pciMem[ebx] == $id && TV(j)));\r\n// assert (exists j:int::{TV(j)} (0 <= j\r\n// && ebx == ?pciLo + 16*j && ebx <= ?pciHi - 16 \r\n// && $pciMem[ebx] == $id));\r\n// assert (exists addr:int, j:int::{$pciMem[addr],TV(j)} (TV(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 \r\n// && $pciMem[addr] == $id));\r\n// assert (exists addr:int, j:int::{$pciMem[addr],TV(j)} !(TV(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 \r\n// ==> $pciMem[addr] != $id));\r\n// assert !(forall addr:int, j:int::{$pciMem[addr],TV(j)} TV(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 \r\n// ==> $pciMem[addr] != $id);\r\n//\r\n// assert(forall i:int::{io._pci.PciConfigState[i]}\r\n// 0 <= i && i < 65536 && i == $id &&\r\n// (forall addr:int, j:int::{$pciMem[addr],TV(j)} TV(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 \r\n// ==> $pciMem[addr] != i)\r\n// ==> io._pci.PciConfigState[i] == 0);\r\n//\r\n// assert (forall addr:int, j:int::{$pciMem[addr],TV(j)} TV(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 && addr != ebx\r\n// ==> $pciMem[addr] == old($pciMem[addr]));\r\n//\r\n// assert(forall i:int::{io._pci.PciConfigState[i]}\r\n// 0 <= i && i < 65536 && i != $id \r\n// ==> io._pci.PciConfigState[i] == old(io._pci.PciConfigState[i]));\r\n//\r\n// assert old(IoInv_Transparent($IoVars, $pciMem));\r\n//\r\n// assert(forall i:int::{old(io._pci.PciConfigState[i])}\r\n// 0 <= i && i < 65536 && i != $id &&\r\n// (forall addr:int, j:int::{old($pciMem[addr]),TV(j)} TV(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 \r\n// ==> old($pciMem[addr]) != i)\r\n// ==> old(io._pci.PciConfigState[i]) == 0);\r\n//\r\n// assert(forall i:int::{io._pci.PciConfigState[i]}\r\n// 0 <= i && i < 65536 && i != $id &&\r\n// (forall addr:int, j:int::{old($pciMem[addr]),TV(j)} TV(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 \r\n// ==> old($pciMem[addr]) != i)\r\n// ==> io._pci.PciConfigState[i] == 0);\r\n// \r\n// assert(forall i:int, addr:int, j:int::{io._pci.PciConfigState[i],TV(j),$pciMem[addr]}\r\n// TV(j) && 0 <= j &&\r\n// 0 <= i && i < 65536 && i != $id \r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 && addr != ebx\r\n// ==>\r\n// (old($pciMem[addr]) == i ==> $pciMem[addr] == i) \r\n// );\r\n\r\n// assert(forall i:int, addr:int, j:int::{TV(i),TV(j),$pciMem[addr]}\r\n// IsValidOtherId(i, $id) &&\r\n// InTableAt(i, j, old($pciMem), ebx) ==> InTableAt(i, j, $pciMem, ebx)\r\n//\r\n// && TV(j) && 0 <= j \r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 && addr != ebx\r\n// ==>\r\n// (old($pciMem[addr]) == i ==> $pciMem[addr] == i) \r\n// );\r\n\r\n// assert(forall i:int, addr:int, j:int::{TV(i),TV(j),$pciMem[addr]}\r\n// 0 <= i && i < 65536 && i != $id \r\n// && TV(j) && 0 <= j \r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 && addr != ebx\r\n// ==>\r\n// (old($pciMem[addr]) == i ==> $pciMem[addr] == i) \r\n// );\r\n//\r\n// assert(forall i:int::\r\n// 0 <= i && i < 65536 && i != $id && TV(i) ==> \r\n// (forall addr:int, j:int:: TV(i) && TV(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 && addr != ebx\r\n// ==>\r\n// (old($pciMem[addr]) == i ==> $pciMem[addr] == i) \r\n// ));\r\n//\r\n assert(forall i:int::{io._pci.PciConfigState[i]}\r\n 0 <= i && i < 65536 && i != $id ==>\r\n (forall addr:int, j:int::TV(j) && 0 <= j\r\n && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 && addr != ebx\r\n ==>\r\n (old($pciMem[addr]) == i ==> $pciMem[addr] == i) \r\n ));\r\n\r\n// assert(forall i:int::{io._pci.PciConfigState[i]}\r\n// 0 <= i && i < 65536 && i != $id ==>\r\n// (exists addr:int, j:int::TV(j) && TO(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 && addr != ebx\r\n// ==> (old($pciMem[addr]) == i) ==> $pciMem[addr] == i));\r\n//\r\n// assert(forall i:int::{io._pci.PciConfigState[i]}\r\n// 0 <= i && i < 65536 && i != $id &&\r\n// (exists addr:int, j:int::TV(j) && TO(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 && addr != ebx\r\n// && old($pciMem[addr]) == i)\r\n// ==>\r\n// (exists addr:int, j:int::{TO(j),$pciMem[addr]} TV(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 && addr != ebx\r\n// && $pciMem[addr] == i) );\r\n//\r\n// assert(forall i:int::{io._pci.PciConfigState[i]}\r\n// 0 <= i && i < 65536 && i != $id &&\r\n// (exists addr:int, j:int::TV(j) && TO(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16\r\n// && old($pciMem[addr]) == i)\r\n// ==>\r\n// (exists addr:int, j:int::{TO(j),$pciMem[addr]} TV(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16\r\n// && $pciMem[addr] == i) );\r\n\r\n// assert(forall i:int::{io._pci.PciConfigState[i]}\r\n// 0 <= i && i < 65536 && i != $id &&\r\n// (forall addr:int, j:int::{$pciMem[addr],TV(j)} TV(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 \r\n// ==> $pciMem[addr] != i)\r\n// ==> io._pci.PciConfigState[i] == 0);\r\n//\r\n// assert(forall i:int::{io._pci.PciConfigState[i]}\r\n// 0 <= i && i < 65536 && \r\n// (forall addr:int, j:int::{$pciMem[addr],TV(j)} TV(j) && 0 <= j\r\n// && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 \r\n// ==> $pciMem[addr] != i)\r\n// ==> io._pci.PciConfigState[i] == 0);\r\n//\r\n//\r\n// assert IoInv_Transparent($IoVars, $pciMem);\r\n// assert &&& &&& &&& NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n eax := sizeBits;\r\n ebx := bar;\r\n }\r\n}\r\n\r\n//implementation PciDmaBuffer()\r\n//{\r\n// call revealInv1($S, $StackState);\r\n// call reveal_IoInv();\r\n// eax := DmaAddr;\r\n// if (eax != 0)\r\n// {\r\n// eax := eax - 8;\r\n// }\r\n// return;\r\n//}\r\n//\r\n//implementation PciDmaPhysicalAddr()\r\n//{\r\n// call revealInv1($S, $StackState);\r\n// call reveal_IoInv();\r\n// eax := DmaAddr;\r\n// return;\r\n//}\r\n//\r\n//implementation PciMemRead32($id:int, $offset:int)\r\n//{\r\n// call revealInv1($S, $StackState);\r\n// call reveal_IoInv();\r\n// call fLoad($S, esp); // tie mem into fmem\r\n// assert TV($id) && TV(?pciLo) && TO(2 * ecx) && TO(2 * ecx + 1);\r\n//\r\n// eax := DmaAddr;\r\n// if (eax == 0)\r\n// {\r\n// // IO-MMU not enabled\r\n// eax := 0x5555002a;\r\n// call debugBreak();\r\n// }\r\n//\r\n// if (ecx >= 65536)\r\n// {\r\n// eax := 0x55550027;\r\n// call debugBreak();\r\n// }\r\n//\r\n// ebx := PciLo;\r\n// call esi := Load(mems.pci, ebx + 8 * ecx);\r\n// if (esi == 0)\r\n// {\r\n// // $id not yet set up by PciMemSetup\r\n// eax := 0x55550028;\r\n// call debugBreak();\r\n// }\r\n//\r\n// call edi := Load(mems.pci, ebx + 8 * ecx + 4);\r\n//\r\n// eax := edx;\r\n// call eax := AddChecked(eax, 4);\r\n// if (eax > edi)\r\n// {\r\n// // $offset out of bounds\r\n// eax := 0x55550029;\r\n// call debugBreak();\r\n// }\r\n//\r\n// call eax := PciMemLoad32($id, esi + 1 * edx);\r\n//\r\n// call fLoad($S, esp); // tie fmem back to mem\r\n// return;\r\n//}\r\n//\r\n//implementation PciMemWrite32($id:int, $offset:int, $val:int)\r\n//{\r\n// call revealInv1($S, $StackState);\r\n// call reveal_IoInv();\r\n// call fLoad($S, esp); // tie mem to fmem\r\n// assert TV($id) && TV(?pciLo) && TO(2 * ecx) && TO(2 * ecx + 1);\r\n//\r\n// assert TO(1) && TV(esp);\r\n// call eax := Load(mems.frm/*[$S]*/, esp + 4);\r\n//\r\n// eax := DmaAddr;\r\n// if (eax == 0)\r\n// {\r\n// // IO-MMU not enabled\r\n// eax := 0x5555002b;\r\n// call debugBreak();\r\n// }\r\n//\r\n// if (ecx >= 65536)\r\n// {\r\n// eax := 0x5555002c;\r\n// call debugBreak();\r\n// }\r\n//\r\n// ebx := PciLo;\r\n// call esi := Load(mems.pci, ebx + 8 * ecx);\r\n// if (esi == 0)\r\n// {\r\n// // $id not yet set up by PciMemSetup\r\n// eax := 0x5555002d;\r\n// call debugBreak();\r\n// }\r\n//\r\n// call edi := Load(mems.pci, ebx + 8 * ecx + 4);\r\n//\r\n// eax := edx;\r\n// call eax := AddChecked(eax, 4);\r\n// if (eax > edi)\r\n// {\r\n// // $offset out of bounds\r\n// eax := 0x5555002e;\r\n// call debugBreak();\r\n// }\r\n//\r\n// call eax := Load(mems.frm/*[$S]*/, esp + 4);\r\n// call PciMemStore32($id, esi + 1 * edx, eax);\r\n//\r\n// call fLoad($S, esp); // tie fmem back to mem\r\n// return;\r\n//}\r\n\r\n\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/GC/BitVectorLemmasGc.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface BitVectorLemmasGc\r\n{\r\n\r\nfunction $Aligned(b:bv32) returns(bool)\r\n{\r\n $and(b, 3bv32) == 0bv32\r\n}\r\n\r\nfunction $bbvec4(a:[int]int, off:int, aBase:int, bb:[int]int, i0:int, i1:int, i2:int, g1:int, g2:int) returns(bool)\r\n{\r\n (forall i:int::{TV(i)} TV(i) && word(i - i0) && i1 <= i && i < i2 && $Aligned(B(i - i0)) ==>\r\n between(g1, g2, g1 + 4 * I($shr(B(i - i0), 7bv32)))\r\n && (a[aBase + (i - i0)] == off <==>\r\n 0bv32 == $and(B(bb[g1 + 4 * I($shr(B(i - i0), 7bv32))]),\r\n $shl(1bv32, $and($shr(B(i - i0), 2bv32), 31bv32)))))\r\n}\r\n\r\nfunction $bb2vec4(a:[int]int, aBase:int, bb:[int]int, i0:int, i1:int, i2:int, g1:int, g2:int) returns(bool)\r\n{\r\n (forall i:int::{TV(i)} TV(i) && word(i - i0) && i1 <= i && i < i2 && $Aligned(B(i - i0)) ==>\r\n between(g1, g2, g1 + 4 * I($shr(B(i - i0), 6bv32)))\r\n && (B(a[aBase + (i - i0)]) == $and(\r\n $shr(B(bb[g1 + 4 * I($shr(B(i - i0), 6bv32))]), $and($shr(B(i - i0), 1bv32), 31bv32)),\r\n 3bv32\r\n )))\r\n}\r\n\r\natomic ghost procedure _aligned($x:bv32);\r\n ensures $Aligned($mul(4bv32, $x));\r\n\r\natomic ghost procedure _zeroAligned();\r\n ensures $Aligned(0bv32);\r\n\r\natomic ghost procedure _andAligned($x:bv32);\r\n ensures $and($x, 3bv32) == 0bv32 <==> $Aligned($x);\r\n\r\natomic ghost procedure _addAligned($x:bv32, $y:bv32);\r\n ensures $Aligned($x) ==>\r\n ($Aligned($y) <==> $Aligned($add($x, $y)));\r\n\r\natomic ghost procedure _subAligned($x:bv32, $y:bv32);\r\n ensures $Aligned($x) ==>\r\n ($Aligned($y) <==> $Aligned($sub($x, $y)));\r\n\r\natomic ghost procedure _notAligned($b:bv32);\r\n requires $Aligned($b);\r\n ensures !$Aligned($add($b, 1bv32));\r\n ensures !$Aligned($add($b, 2bv32));\r\n ensures !$Aligned($add($b, 3bv32));\r\n ensures $le($b, 4294967292bv32);\r\n\r\natomic ghost procedure _is4kAligned($x:bv32);\r\n ensures $and($sub($x, $and($x, 4095bv32)), 4095bv32) == 0bv32;\r\n ensures $le(0bv32, $and($x, 4095bv32)) && $le($and($x, 4095bv32), 4095bv32);\r\n\r\natomic ghost procedure _add4kAligned($x:bv32);\r\n requires $and($x, 4095bv32) == 0bv32;\r\n ensures $and($add($x, 4096bv32), 4095bv32) == 0bv32;\r\n ensures $Aligned($x);\r\n\r\natomic ghost procedure _is2m4kAligned($x:bv32);\r\n ensures $and($sub($add($x, 2097152bv32), $and($x, 2097151bv32)), 4095bv32) == 0bv32;\r\n ensures $le(0bv32, $and($x, 2097151bv32)) && $le($and($x, 2097151bv32), 2097151bv32);\r\n\r\natomic ghost procedure _initialize($unitSize:bv32);\r\n requires $le($unitSize, 16777215bv32);\r\n ensures $shr(0bv32, 7bv32) == 0bv32;\r\n ensures $shr($mul(128bv32, $unitSize), 7bv32) == $unitSize;\r\n ensures $shr($mul(256bv32, $unitSize), 7bv32) == $add($unitSize, $unitSize);\r\n\r\natomic ghost procedure _bb4Zero($a:[int]int, $off:int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $g1:int, $g2:int, $idx:int);\r\n requires (forall i:int::{TV(i)} TV(i) && $i1 <= i && i < $i2 + 128 ==> $a[$aBase + (i - $i0)] == $off);\r\n requires $bbvec4($a, $off, $aBase, $bb, $i0, $i1, $i2, $g1, $g2);\r\n requires $Aligned(B($idx)) && $Aligned(B($g1));\r\n requires B($i2 - $i0) == $mul(32bv32, $sub(B($idx), B($g1)));\r\n requires $i1 == $i0;\r\n requires $le($shr(B($i2 - $i0), 7bv32), 33554431bv32) && $mul(128bv32, $shr(B($i2 - $i0), 7bv32)) == B($i2 - $i0) ==>\r\n $idx - $g1 == 4 * I($shr(B($i2 - $i0), 7bv32));\r\n requires (forall i:int::{TV(i)} TV(i) && $i2 <= i && i < $i2 + 128 ==>\r\n $le(B($i2 - $i0), B(i - $i0)) && $le(B(i - $i0), $add(B($i2 - $i0), 127bv32)));\r\n requires between($g1, $g2, $idx);\r\n requires B(0) == 0bv32;\r\n ensures $bbvec4($a, $off, $aBase, $bb[$idx := 0], $i0, $i1, $i2 + 128, $g1, $g2);\r\n\r\natomic ghost procedure _bb4GetBit($i0:int, $k:int);\r\n ensures $le($and($shr(B($k - $i0), 2bv32), 31bv32), 31bv32);\r\n\r\natomic ghost procedure _bb4SetBit($a:[int]int, $on:int, $off:int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $k:int, $idx:int, $bbb:int, $ret:[int]int, $g1:int, $g2:int);\r\n requires $bbvec4($a, $off, $aBase, $bb, $i0, $i1, $i2, $g1, $g2);\r\n requires TV($k) && word($k - $i0) && $i1 <= $k && $k < $i2 && $Aligned(B($k - $i0));\r\n requires $on != $off;\r\n requires $idx == $g1 + 4 * I($shr(B($k - $i0), 7bv32));\r\n requires B($bbb) == $or(B($bb[$idx]), $shl(1bv32, $and($shr(B($k - $i0), 2bv32), 31bv32)));\r\n requires $ret == $bb[$idx := $bbb];\r\n ensures $bbvec4($a[$aBase + ($k - $i0) := $on], $off, $aBase, $ret, $i0, $i1, $i2, $g1, $g2);\r\n ensures between($g1, $g2, $idx);\r\n ensures $le($and($shr(B($k - $i0), 2bv32), 31bv32), 31bv32);\r\n\r\natomic ghost procedure _bb4Zero2($a:[int]int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $g1:int, $g2:int, $idx:int);\r\n requires (forall i:int::{TV(i)} TV(i) && $i1 <= i && i < $i2 + 64 ==> $a[$aBase + (i - $i0)] == 0);\r\n requires $bb2vec4($a, $aBase, $bb, $i0, $i1, $i2, $g1, $g2);\r\n requires $Aligned(B($idx)) && $Aligned(B($g1));\r\n requires B($i2 - $i0) == $mul(16bv32, $sub(B($idx), B($g1)));\r\n requires $i1 == $i0;\r\n requires $le($shr(B($i2 - $i0), 6bv32), 67108863bv32) && $mul(64bv32, $shr(B($i2 - $i0), 6bv32)) == B($i2 - $i0) ==>\r\n $idx - $g1 == 4 * I($shr(B($i2 - $i0), 6bv32));\r\n requires (forall i:int::{TV(i)} TV(i) && $i2 <= i && i < $i2 + 64 ==>\r\n $le(B($i2 - $i0), B(i - $i0)) && $le(B(i - $i0), $add(B($i2 - $i0), 63bv32)));\r\n requires between($g1, $g2, $idx);\r\n requires B(0) == 0bv32;\r\n ensures $bb2vec4($a, $aBase, $bb[$idx := 0], $i0, $i1, $i2 + 64, $g1, $g2);\r\n\r\natomic ghost procedure _bb4Get2Bit($i0:int, $k:int);\r\n ensures $le($and($shr(B($k - $i0), 1bv32), 31bv32), 31bv32);\r\n\r\natomic ghost procedure _bb4Set2Bit($a:[int]int, $val:int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $k:int, $idx:int, $bbb:int, $_bbb:int, $ret:[int]int, $g1:int, $g2:int);\r\n requires $bb2vec4($a, $aBase, $bb, $i0, $i1, $i2, $g1, $g2);\r\n requires TV($k) && word($k - $i0) && $i1 <= $k && $k < $i2 && $Aligned(B($k - $i0));\r\n requires $idx == $g1 + 4 * I($shr(B($k - $i0), 6bv32));\r\n requires $le(B($val), 3bv32);\r\n requires B($bbb) == $and(B($bb[$idx]), $neg($shl(3bv32, $and($shr(B($k - $i0), 1bv32), 31bv32))));\r\n requires B($_bbb) == $or(B($bbb), $shl(B($val), $and($shr(B($k - $i0), 1bv32), 31bv32)));\r\n requires $ret == $bb[$idx := $_bbb];\r\n ensures $bb2vec4($a[$aBase + ($k - $i0) := $val], $aBase, $ret, $i0, $i1, $i2, $g1, $g2);\r\n ensures between($g1, $g2, $idx);\r\n ensures $le($and($shr(B($k - $i0), 1bv32), 31bv32), 31bv32);\r\n\r\natomic ghost procedure _const_gc();\r\n ensures $sub(1bv32, 1bv32) == 0bv32;\r\n ensures $add(1bv32, 1bv32) == 2bv32;\r\n ensures $add(2bv32, 1bv32) == 3bv32;\r\n ensures $add(2bv32, 2bv32) == 4bv32;\r\n ensures $add(4bv32, 1bv32) == 5bv32;\r\n ensures $add(5bv32, 1bv32) == 6bv32;\r\n ensures $add(5bv32, 2bv32) == 7bv32;\r\n ensures $mul(4bv32, 4bv32) == 16bv32;\r\n ensures $add(16bv32, 16bv32) == 32bv32;\r\n ensures $sub(32bv32, 1bv32) == 31bv32;\r\n ensures $add(32bv32, 32bv32) == 64bv32;\r\n ensures $sub(64bv32, 1bv32) == 63bv32;\r\n ensures $mul(32bv32, 4bv32) == 128bv32;\r\n ensures $sub(128bv32, 1bv32) == 127bv32;\r\n ensures $mul(16bv32, 16bv32) == 256bv32;\r\n ensures $add(256bv32, 256bv32) == 512bv32;\r\n ensures $mul(64bv32, 64bv32) == 4096bv32;\r\n ensures $sub(4096bv32, 1bv32) == 4095bv32;\r\n ensures $mul(256bv32, 256bv32) == 65536bv32;\r\n ensures $sub(65536bv32, 1bv32) == 65535bv32;\r\n ensures $mul(65536bv32, 32bv32) == 2097152bv32;\r\n ensures $sub(2097152bv32, 1bv32) == 2097151bv32;\r\n ensures $mul(65536bv32, 256bv32) == 16777216bv32;\r\n ensures $sub(16777216bv32, 1bv32) == 16777215bv32;\r\n ensures $mul(65536bv32, 512bv32) == 33554432bv32;\r\n ensures $sub(33554432bv32, 1bv32) == 33554431bv32;\r\n ensures $add(33554432bv32, 33554432bv32) == 67108864bv32;\r\n ensures $sub(67108864bv32, 1bv32) == 67108863bv32;\r\n ensures $mul(65536bv32, 65535bv32) == 4294901760bv32;\r\n ensures $add(4294901760bv32, 65535bv32) == 4294967295bv32;\r\n ensures $sub(4294967295bv32, 3bv32) == 4294967292bv32;\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/GC/BitVectorLemmasGc.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//- // TODO change to timeLimitMultiplier. I only needed this flag because I was diddling with a 5-sec timeout in NuBuild.\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation BitVectorLemmasGc\r\n{\r\n\r\n//- This file contains proofs of the declarations in VerifiedBitVectorsBuiltin.bpl.\r\n//- Many proofs are totally automatic, so that the implementations below have\r\n//- empty bodies. Other proofs require assertions to guide the prover.\r\n\r\n//- Verification requires the \"/bv:z\" option to enable Z3 support of bit vectors\r\n\r\n// Imports:\r\n// - TrustedBitVectorsBuiltin.bpl\r\n// Exports:\r\n// - VerifiedBitVectorsBuiltin.bpl\r\n\r\n// \\Spec#\\bin\\Boogie.exe /bv:z /noinfer TrustedBitVectorsBuiltin.bpl VerifiedBitVectorsBuiltin.bpl VerifiedBitVectorsBuiltinImpl.bpl\r\n\r\nimplementation _aligned($x:bv32)\r\n{\r\n}\r\n\r\nimplementation _zeroAligned()\r\n{\r\n}\r\n\r\nimplementation _andAligned($x:bv32)\r\n{\r\n}\r\n\r\nimplementation _addAligned($x:bv32, $y:bv32)\r\n{\r\n}\r\n\r\nimplementation _subAligned($x:bv32, $y:bv32)\r\n{\r\n}\r\n\r\nimplementation _notAligned($b:bv32)\r\n{\r\n}\r\n\r\nimplementation _is4kAligned($x:bv32)\r\n{\r\n}\r\n\r\nimplementation _is2m4kAligned($x:bv32)\r\n{\r\n}\r\n\r\nimplementation _add4kAligned($x:bv32)\r\n{\r\n}\r\n\r\nimplementation _initialize($unitSize:bv32)\r\n{\r\n}\r\n\r\nimplementation _bb4Zero($a:[int]int, $off:int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $g1:int, $g2:int, $idx:int)\r\n{\r\n assert $mul(128bv32, $shr(B($i2 - $i0), 7bv32)) == B($i2 - $i0);\r\n assert $idx - $g1 == 4 * I($shr(B($i2 - $i0), 7bv32));\r\n assert (forall i:int::{TV(i)} TV(i) && $i2 <= i && i < $i2 + 128 ==> $shr(B(i - $i0), 7bv32) == $shr(B($i2 - $i0), 7bv32));\r\n}\r\n\r\nimplementation _bb4GetBit($i0:int, $k:int)\r\n{\r\n}\r\n\r\nimplementation _bb4SetBit($a:[int]int, $on:int, $off:int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $k:int, $idx:int, $bbb:int, $ret:[int]int, $g1:int, $g2:int)\r\n{\r\n}\r\n\r\nimplementation _bb4Zero2($a:[int]int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $g1:int, $g2:int, $idx:int)\r\n{\r\n assert $mul(64bv32, $shr(B($i2 - $i0), 6bv32)) == B($i2 - $i0);\r\n assert $idx - $g1 == 4 * I($shr(B($i2 - $i0), 6bv32));\r\n assert (forall i:int::{TV(i)} TV(i) && $i2 <= i && i < $i2 + 64 ==> $shr(B(i - $i0), 6bv32) == $shr(B($i2 - $i0), 6bv32));\r\n assert {:split_here} true;\r\n}\r\n\r\nimplementation _bb4Get2Bit($i0:int, $k:int)\r\n{\r\n}\r\n\r\nimplementation _bb4Set2Bit($a:[int]int, $val:int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $k:int, $idx:int, $bbb:int, $_bbb:int, $ret:[int]int, $g1:int, $g2:int)\r\n{\r\n}\r\n\r\nimplementation _const_gc()\r\n{\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/GC/IntLemmasGc.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IntSpec;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface IntLemmasGc\r\n{\r\n\r\nfunction BitIndex(i0:int, i:int) returns(int);\r\nfunction BitZero(x:int, i0:int, i:int) returns(bool);\r\nfunction ColorIndex(i0:int, i:int) returns(int);\r\nfunction ColorGet(x:int, i0:int, i:int) returns(int);\r\n\r\nfunction bbvec4(a:[int]int, off:int, aBase:int, bb:[int]int, i0:int, i1:int, i2:int, g1:int, g2:int) returns(bool)\r\n{\r\n (forall i:int::{TV(i)} TV(i) && i1 <= i && i < i2 && Aligned(i - i0) ==>\r\n between(g1, g2, g1 + BitIndex(i0, i))\r\n && (a[aBase + (i - i0)] == off <==> BitZero(bb[g1 + BitIndex(i0, i)], i0, i))\r\n )\r\n}\r\n\r\nfunction bb2vec4(a:[int]int, aBase:int, bb:[int]int, i0:int, i1:int, i2:int, g1:int, g2:int) returns(bool)\r\n{\r\n (forall i:int::{TV(i)} TV(i) && word(i - i0) && i1 <= i && i < i2 && Aligned(i - i0) ==>\r\n between(g1, g2, g1 + ColorIndex(i0, i))\r\n && (a[aBase + (i - i0)] == ColorGet(bb[g1 + ColorIndex(i0, i)], i0, i))\r\n )\r\n}\r\n\r\natomic ghost procedure __zeroAligned();\r\n ensures Aligned(0);\r\n\r\natomic ghost procedure __andAligned($x:int);\r\n ensures word($x) ==> (and($x, 3) == 0 <==> Aligned($x));\r\n\r\natomic ghost procedure __addAligned($x:int, $y:int);\r\n ensures word($x) && word($y) && word(add($x, $y)) && Aligned($x) ==>\r\n (Aligned($y) <==> Aligned(add($x, $y)));\r\n\r\natomic ghost procedure __subAligned($x:int, $y:int);\r\n ensures word($x) && word($y) && word(sub($x, $y)) && Aligned($x) ==>\r\n (Aligned($y) <==> Aligned(sub($x, $y)));\r\n\r\natomic ghost procedure __notAligned($i:int);\r\n requires Aligned($i);\r\n requires word($i);\r\n ensures !Aligned(add($i, 1));\r\n ensures !Aligned(add($i, 2));\r\n ensures !Aligned(add($i, 3));\r\n ensures word(add($i, 1));\r\n ensures word(add($i, 2));\r\n ensures word(add($i, 3));\r\n\r\natomic ghost procedure __is4kAligned($x:int);\r\n requires word($x) && word(sub($x, 4096));\r\n ensures and(sub($x, and($x, 4095)), 4095) == 0;\r\n ensures le(0, and($x, 4095)) && le(and($x, 4095), 4095);\r\n\r\natomic ghost procedure __add4kAligned($x:int);\r\n requires and($x, 4095) == 0;\r\n requires word($x) && word(add($x, 4096));\r\n ensures and(add($x, 4096), 4095) == 0;\r\n ensures Aligned($x);\r\n\r\natomic ghost procedure __is2m4kAligned($x:int);\r\n requires word($x) && word($x - 2097152) && word($x + 2097152);\r\n ensures and(sub(add($x, 2097152), and($x, 2097151)), 4095) == 0;\r\n ensures le(0, and($x, 2097151)) && le(and($x, 2097151), 2097151);\r\n\r\natomic ghost procedure __initialize($unitSize:int, $heapLo:int);\r\n requires word(mul($unitSize, 256));\r\n ensures BitIndex($heapLo, $heapLo) == 0;\r\n ensures BitIndex($heapLo, add($heapLo, mul(128, $unitSize))) == mul(4, $unitSize);\r\n ensures BitIndex($heapLo, add($heapLo, mul(256, $unitSize))) == mul(8, $unitSize);\r\n\r\natomic ghost procedure __bb4Zero($a:[int]int, $off:int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $g1:int, $g2:int, $idx:int);\r\n requires (forall $i:int::{TV($i)} TV($i) && $i1 <= $i && $i < $i2 + 128 ==> $a[$aBase + ($i - $i0)] == $off);\r\n requires bbvec4($a, $off, $aBase, $bb, $i0, $i1, $i2, $g1, $g2);\r\n requires word($i1 - $i0) && word($i2 - $i0) && word($i2 - $i1) && word($i2 + 128 - $i0);\r\n requires word($idx) && word($g1);\r\n requires Aligned($idx) && Aligned($g1);\r\n requires $i2 - $i1 == mul(32, sub($idx, $g1));\r\n requires $i1 == $i0;\r\n requires between($g1, $g2, $idx);\r\n ensures bbvec4($a, $off, $aBase, $bb[$idx := 0], $i0, $i1, $i2 + 128, $g1, $g2);\r\n\r\natomic ghost procedure __bb4GetBit($a:[int]int, $off:int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $k:int, $idx:int, $bbb:int, $g1:int, $g2:int);\r\n requires bbvec4($a, $off, $aBase, $bb, $i0, $i1, $i2, $g1, $g2);\r\n requires TV($k) && word($k - $i0) && $i1 <= $k && $k < $i2 && Aligned($k - $i0);\r\n requires $idx == $g1 + 4 * shr($k - $i0, 7);\r\n requires $bbb == and($bb[$idx], shl(1, and(shr($k - $i0, 2), 31)));\r\n requires word($i1 - $i0) && word($i2 - $i0);\r\n ensures between($g1, $g2, $idx);\r\n ensures le(and(shr($k - $i0, 2), 31), 31);\r\n ensures $bbb == 0 <==> $a[$aBase + ($k - $i0)] == $off;\r\n\r\natomic ghost procedure __bb4SetBit($a:[int]int, $on:int, $off:int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $k:int, $idx:int, $bbb:int, $ret:[int]int, $g1:int, $g2:int);\r\n requires bbvec4($a, $off, $aBase, $bb, $i0, $i1, $i2, $g1, $g2);\r\n requires TV($k) && word($k - $i0) && $i1 <= $k && $k < $i2 && Aligned($k - $i0);\r\n requires $on != $off;\r\n requires $idx == $g1 + 4 * shr($k - $i0, 7);\r\n requires $bbb == or($bb[$idx], shl(1, and(shr($k - $i0, 2), 31)));\r\n requires $ret == $bb[$idx := $bbb];\r\n requires word($i1 - $i0) && word($i2 - $i0);\r\n ensures bbvec4($a[$aBase + ($k - $i0) := $on], $off, $aBase, $ret, $i0, $i1, $i2, $g1, $g2);\r\n ensures between($g1, $g2, $idx);\r\n ensures le(and(shr($k - $i0, 2), 31), 31);\r\n ensures 4 * shr($k - $i0, 7) == BitIndex($i0, $k);\r\n\r\natomic ghost procedure __bb4Zero2($a:[int]int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $g1:int, $g2:int, $idx:int);\r\n requires (forall $i:int::{TV($i)} TV($i) && $i1 <= $i && $i < $i2 + 64 ==> $a[$aBase + ($i - $i0)] == 0);\r\n requires bb2vec4($a, $aBase, $bb, $i0, $i1, $i2, $g1, $g2);\r\n requires word($i1 - $i0) && word($i2 - $i0) && word($i2 - $i1) && word($i2 + 64 - $i0);\r\n requires word($idx) && word($g1);\r\n requires Aligned($idx) && Aligned($g1);\r\n requires $i2 - $i1 == mul(16, sub($idx, $g1));\r\n requires $i1 == $i0;\r\n requires between($g1, $g2, $idx);\r\n ensures bb2vec4($a, $aBase, $bb[$idx := 0], $i0, $i1, $i2 + 64, $g1, $g2);\r\n\r\natomic ghost procedure __bb4Get2Bit($a:[int]int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $k:int, $idx:int, $bbb:int, $g1:int, $g2:int);\r\n requires bb2vec4($a, $aBase, $bb, $i0, $i1, $i2, $g1, $g2);\r\n requires TV($k) && word($k - $i0) && $i1 <= $k && $k < $i2 && Aligned($k - $i0);\r\n requires $idx == $g1 + 4 * shr($k - $i0, 6);\r\n requires $bbb == and(shr($bb[$idx], and(shr($k - $i0, 1), 31)), 3);\r\n ensures $a[$aBase + ($k - $i0)] == $bbb;\r\n ensures between($g1, $g2, $idx);\r\n ensures le(and(shr($k - $i0, 1), 31), 31);\r\n\r\natomic ghost procedure __bb4Set2Bit($a:[int]int, $val:int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $k:int, $idx:int, $bbb:int, $_bbb:int, $ret:[int]int, $g1:int, $g2:int);\r\n requires bb2vec4($a, $aBase, $bb, $i0, $i1, $i2, $g1, $g2);\r\n requires TV($k) && word($k - $i0) && $i1 <= $k && $k < $i2 && Aligned($k - $i0);\r\n requires $idx == $g1 + 4 * shr($k - $i0, 6);\r\n requires le(0, $val) && le($val, 3);\r\n requires $bbb == and($bb[$idx], neg(shl(3, and(shr($k - $i0, 1), 31))));\r\n requires $_bbb == or($bbb, shl($val, and(shr($k - $i0, 1), 31)));\r\n requires $ret == $bb[$idx := $_bbb];\r\n ensures bb2vec4($a[$aBase + ($k - $i0) := $val], $aBase, $ret, $i0, $i1, $i2, $g1, $g2);\r\n ensures between($g1, $g2, $idx);\r\n ensures le(and(shr($k - $i0, 1), 31), 31);\r\n ensures 4 * shr($k - $i0, 6) == ColorIndex($i0, $k);\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/GC/IntLemmasGc.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IntSpec;\r\n//-private-import BitVectorLemmasGc;\r\n//-\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation IntLemmasGc\r\n{\r\n\r\nfunction implementation BitIndex(i0:int, i:int):int { 4 * shr(i - i0, 7) }\r\n\r\nfunction implementation BitZero(x:int, i0:int, i:int):bool\r\n{\r\n 0 == and(x, shl(1, and(shr(i - i0, 2), 31)))\r\n}\r\n\r\nfunction implementation ColorIndex(i0:int, i:int):int { 4 * shr(i - i0, 6) }\r\n\r\nfunction implementation ColorGet(x:int, i0:int, i:int):int\r\n{\r\n and(shr(x, and(shr(i - i0, 1), 31)), 3)\r\n}\r\n\r\natomic ghost procedure _a($b1:bv32, $b2:bv32)\r\n requires word(add(I($b1), I($b2)));\r\n ensures add(I($b1), I($b2)) == I($add($b1, $b2));\r\n{\r\n}\r\n\r\natomic ghost procedure _s($b1:bv32, $b2:bv32)\r\n requires word(sub(I($b1), I($b2)));\r\n ensures sub(I($b1), I($b2)) == I($sub($b1, $b2));\r\n{\r\n}\r\n\r\natomic ghost procedure _m($b1:bv32, $b2:bv32)\r\n requires word(mul(I($b1), I($b2)));\r\n ensures mul(I($b1), I($b2)) == I($mul($b1, $b2));\r\n{\r\n}\r\n\r\natomic ghost procedure __const()\r\n ensures 0 == I(0bv32);\r\n ensures 2 == I(2bv32);\r\n ensures 3 == I(3bv32);\r\n ensures 4 == I(4bv32);\r\n ensures 5 == I(5bv32);\r\n ensures 6 == I(6bv32);\r\n ensures 7 == I(7bv32);\r\n ensures 16 == I(16bv32);\r\n ensures 32 == I(32bv32);\r\n ensures 31 == I(31bv32);\r\n ensures 64 == I(64bv32);\r\n ensures 63 == I(63bv32);\r\n ensures 128 == I(128bv32);\r\n ensures 127 == I(127bv32);\r\n ensures 256 == I(256bv32);\r\n ensures 16777215 == I(16777215bv32);\r\n ensures 33554431 == I(33554431bv32);\r\n ensures 67108863 == I(67108863bv32);\r\n{\r\n call _const_gc();\r\n call _s(1bv32, 1bv32);\r\n call _a(1bv32, 1bv32);\r\n call _a(2bv32, 1bv32);\r\n call _a(2bv32, 2bv32);\r\n call _a(4bv32, 1bv32);\r\n call _a(5bv32, 1bv32);\r\n call _a(5bv32, 2bv32);\r\n call _m(4bv32, 4bv32);\r\n call _a(16bv32, 16bv32);\r\n call _s(32bv32, 1bv32);\r\n call _a(32bv32, 32bv32);\r\n call _s(64bv32, 1bv32);\r\n call _m(32bv32, 4bv32);\r\n call _s(128bv32, 1bv32);\r\n call _m(16bv32, 16bv32);\r\n call _a(256bv32, 256bv32);\r\n call _m(256bv32, 256bv32);\r\n call _s(65536bv32, 1bv32);\r\n call _m(65536bv32, 256bv32);\r\n call _s(16777216bv32, 1bv32);\r\n call _m(65536bv32, 65535bv32);\r\n call _m(65536bv32, 512bv32);\r\n call _s(33554432bv32, 1bv32);\r\n call _a(33554432bv32, 33554432bv32);\r\n call _s(67108864bv32, 1bv32);\r\n}\r\n\r\natomic ghost procedure __const2()\r\n ensures 65535 == I(65535bv32);\r\n ensures 65536 == I(65536bv32);\r\n ensures add(add(2147483647, 2147483647), 1) == I(4294967295bv32);\r\n ensures sub(add(2147483647, 2147483647), 2) == I(4294967292bv32);\r\n{\r\n call __const();\r\n call _const_gc();\r\n call _m(256bv32, 256bv32);\r\n call _s(65536bv32, 1bv32);\r\n call _m(65536bv32, 65535bv32);\r\n call _a(4294901760bv32, 65535bv32);\r\n call _s(4294967295bv32, 3bv32);\r\n}\r\n\r\natomic ghost procedure __const3()\r\n ensures 4096 == I(4096bv32);\r\n ensures 4095 == I(4095bv32);\r\n{\r\n call __const();\r\n call _const_gc();\r\n call _m(64bv32, 64bv32);\r\n call _s(4096bv32, 1bv32);\r\n}\r\n\r\natomic ghost procedure __const4()\r\n ensures 2097152 == I(2097152bv32);\r\n ensures 2097151 == I(2097151bv32);\r\n{\r\n call __const();\r\n call _const_gc();\r\n call _m(256bv32, 256bv32);\r\n call _m(65536bv32, 32bv32);\r\n call _s(2097152bv32, 1bv32);\r\n}\r\n\r\nimplementation __zeroAligned()\r\n{\r\n call __const();\r\n call _zeroAligned();\r\n}\r\n\r\nimplementation __andAligned($x:int)\r\n{\r\n call __const();\r\n call _andAligned(B($x));\r\n}\r\n\r\nimplementation __addAligned($x:int, $y:int)\r\n{\r\n call __const();\r\n call _addAligned(B($x), B($y));\r\n}\r\n\r\nimplementation __subAligned($x:int, $y:int)\r\n{\r\n call __const();\r\n call _subAligned(B($x), B($y));\r\n}\r\n\r\nimplementation __notAligned($i:int)\r\n{\r\n call __const();\r\n call __const2();\r\n call _notAligned(B($i));\r\n assert le($i, 4294967292);\r\n}\r\n\r\nimplementation __is4kAligned($x:int)\r\n{\r\n call __const();\r\n call __const3();\r\n call _is4kAligned(B($x));\r\n assert le(and($x, 4095), 4095);\r\n}\r\n\r\nimplementation __is2m4kAligned($x:int)\r\n{\r\n call __const();\r\n call __const3();\r\n call __const4();\r\n call _is2m4kAligned(B($x));\r\n assert le(and($x, 2097151), 2097151);\r\n}\r\n\r\nimplementation __add4kAligned($x:int)\r\n{\r\n call __const();\r\n call __const3();\r\n call _add4kAligned(B($x));\r\n}\r\n\r\natomic ghost procedure helper()\r\n ensures (forall b1:bv32, b2:bv32::{$add(b1, b2)} word(add(I(b1), I(b2))) ==> add(I(b1), I(b2)) == I($add(b1, b2)));\r\n ensures (forall b1:bv32, b2:bv32::{$sub(b1, b2)} word(sub(I(b1), I(b2))) ==> sub(I(b1), I(b2)) == I($sub(b1, b2)));\r\n ensures (forall b1:bv32, b2:bv32::{$mul(b1, b2)} word(mul(I(b1), I(b2))) ==> mul(I(b1), I(b2)) == I($mul(b1, b2)));\r\n ensures (forall b1:bv32, b2:bv32::{$le(b1, b2)} le(I(b1), I(b2)) <==> $le(b1, b2));\r\n{\r\n}\r\n\r\nimplementation __initialize($unitSize:int, $heapLo:int)\r\n{\r\n call __const();\r\n call helper();\r\n call _initialize(B($unitSize));\r\n}\r\n\r\nimplementation __bb4Zero($a:[int]int, $off:int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $g1:int, $g2:int, $idx:int)\r\n{\r\n call __const();\r\n call helper();\r\n call _bb4Zero($a, $off, $aBase, $bb, $i0, $i1, $i2, $g1, $g2, $idx);\r\n}\r\n\r\nimplementation __bb4GetBit($a:[int]int, $off:int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $k:int, $idx:int, $bbb:int, $g1:int, $g2:int)\r\n{\r\n call __const();\r\n call _bb4GetBit($i0, $k);\r\n}\r\n\r\nimplementation __bb4SetBit($a:[int]int, $on:int, $off:int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $k:int, $idx:int, $bbb:int, $ret:[int]int, $g1:int, $g2:int)\r\n{\r\n call __const();\r\n call _bb4SetBit($a, $on, $off, $aBase, $bb, $i0, $i1, $i2, $k, $idx, $bbb, $ret, $g1, $g2);\r\n}\r\n\r\nimplementation __bb4Zero2($a:[int]int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $g1:int, $g2:int, $idx:int)\r\n{\r\n call __const();\r\n call helper();\r\n call _bb4Zero2($a, $aBase, $bb, $i0, $i1, $i2, $g1, $g2, $idx);\r\n}\r\n\r\nimplementation __bb4Get2Bit($a:[int]int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $k:int, $idx:int, $bbb:int, $g1:int, $g2:int)\r\n{\r\n call __const();\r\n call _bb4Get2Bit($i0, $k);\r\n}\r\n\r\nimplementation __bb4Set2Bit($a:[int]int, $val:int, $aBase:int, $bb:[int]int, $i0:int, $i1:int, $i2:int, $k:int, $idx:int, $bbb:int, $_bbb:int, $ret:[int]int, $g1:int, $g2:int)\r\n{\r\n call __const();\r\n call helper();\r\n call _bb4Set2Bit($a, $val, $aBase, $bb, $i0, $i1, $i2, $k, $idx, $bbb, $_bbb, $ret, $g1, $g2);\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/GC/SimpleCollector.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface SimpleCollector\r\n{\r\n\r\nconst ?GcCollector:int := 30;\r\n\r\n//- Verified copying garbage collector\r\n// Includes Spec/NucleusInvCopying_i.beat\r\n// Includes Spec/Gc_i.bpl\r\n\r\n//var $freshAbs:int;\r\n\r\n//- The allocation bitmap ranges from ?gcLo..HeapLo\r\n//- The spaces (from and to) range from HeapLo..?gcHi\r\nvar HeapLo @ statics;\r\n//- Fromspace ranges from Fi to Fl, where Fk..Fl is empty\r\n//- Tospace ranges from Ti to Tl, where Tk..Tl is empty\r\nvar Fi @ statics;\r\nvar Fk @ statics;\r\nvar Fl @ statics;\r\nvar Ti @ statics;\r\nvar Tj @ statics;\r\nvar Tk @ statics;\r\nvar Tl @ statics;\r\n//- Bitmaps for fromspace and tospace:\r\nvar BF @ statics;\r\nvar BT @ statics;\r\n\r\ntype gcVars = gcVars(freshAbs:int);\r\nfunction gcVarsInv(x:gcVars, m:mem):bool;\r\n#define $freshAbs $gcVars.freshAbs\r\n\r\n#define DECL_GcVars $commonVars:commonVars, $gcVars:gcVars\r\n#define GcVars $commonVars, $gcVars\r\n\r\n#define DECL_AllGcVars DECL_GcVars, $Time:Time\r\n#define AllGcVars GcVars, $Time\r\n\r\nconst no_owners:[int]int := (lambda i:int::0);\r\nconst empty_mem:mem := mem((lambda i:int::0), (lambda i:int::false));\r\nfunction submems(gc:mem, frm:mem, frms:[int][int]int):mems\r\n{\r\n mems(empty_mem, empty_mem, empty_mem, gc, frm, frms, empty_mem, (lambda s:int::(lambda i:int::0)))\r\n}\r\nfunction _NucleusInv(objLayouts:[int]ObjLayout, $S:int, $toAbs:[int]int, $absMem:[int][int]int, DECL_GcVars, $DECL__MemVars, $stacksFrames:[int]Frames) returns(bool);\r\nfunction NucleusInv(objLayouts:[int]ObjLayout, $S:int, $toAbs:[int]int, $absMem:[int][int]int, DECL_GcVars, $DECL_Mem_Vars, $stacksFrames:[int]Frames, DECL_IoVars) returns(bool)\r\n{\r\n _NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, me, init, statics,\r\n submems(mems.gc, mems.frm, mems.frms),\r\n $stacksFrames)\r\n && IoInv($IoVars, $pciMem)\r\n && MemInv($Mem_Vars)\r\n}\r\n\r\natomic ghost procedure proc_RevealAbssValue();\r\n ensures\r\n (forall objLayouts:[int]ObjLayout, $S:int, $toAbs:[int]int, $absMem:[int][int]int, DECL_GcVars, $DECL_Mem_Vars, $stacksFrames:[int]Frames, DECL_IoVars\r\n ::\r\n NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars)\r\n ==>\r\n (forall i:int:: StackLo(0) <= i && i < StackHi(0) && Aligned(i) ==>\r\n Value(objLayouts, true, $toAbs, $fMems[0][i], $stacksFrames[0].Abss[i])\r\n )\r\n &&\r\n // Chris tried to write a cleverer trigger than Wellformed's Nuclear Triggerbomb,\r\n // but it didn't actually trigger, so we gave up.\r\n// (forall i1:int, i2:int::{$stacksFrames[0].Abss[i1], $stacksFrames[0].Abss[i2]}\r\n// gcAddr(i1) && gcAddr(i2) && i1 != i2 && $toAbs[i1] != NO_ABS && $toAbs[i2] != NO_ABS\r\n// ==> $toAbs[i1] != $toAbs[i2])\r\n WellFormed($toAbs)\r\n );\r\n\r\n\r\nprocedure InitializeGc();\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires word(ebp);\r\n requires SMemRequireRA(112, stk, esp, RET);\r\n requires MemInv($Mem_Vars) && commonVarsInv($commonVars, statics);\r\n requires IoInv($IoVars, $pciMem);\r\n requires (forall i:int::{statics.dom[i]} memAddr(i) && !memAddrMain(i) ==> statics.dom[i]);\r\n// requires CurrentStack == $S;\r\n// requires (forall $s:int::{TStk($s)} TStk($s) ==> isStack($s) ==> IsEmpty($StackState[$s]));\r\n// requires (forall $s:int::{TStk($s)} TStk($s) ==> isStack($s) ==> StackTag($s, $tMems) == ?STACK_EMPTY);\r\n requires (forall i:int::{TV(i)} TV(i) ==> $toAbs[i] == NO_ABS);\r\n requires (forall $s:int::{TStk($s)} TStk($s) ==> isStack($s) ==>\r\n (forall i:int::{TV(i)} TV(i) ==> StackLo($s) <= i && i < StackHi($s) && Aligned(i) ==> $stacksFrames[$s].Abss[i] == 0));\r\n modifies stk, efl, eax, ebx, ecx, edx, esi, edi, ebp, esp;\r\n modifies $commonVars, $gcVars, $Time, mems;\r\n modifies HeapLo, Fi, Fk, Fl, Ti, Tj, Tk, Tl, BF, BT;\r\n ensures SMemEnsure(stk, old(stk), esp, old(esp));\r\n ensures MemInv($Mem_Vars) && commonVarsInv($commonVars, statics);\r\n ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n ensures WellFormed($toAbs);\r\n ensures ebp == old(ebp);\r\n\r\nghost procedure revealInv1($s:int, $_stackState:[int]StackState);\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires isStack($s);\r\n requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n ensures MemInv($Mem_Vars) && commonVarsInv($commonVars, statics);\r\n ensures IoInv($IoVars, $pciMem);\r\n\r\nghost procedure updateInv1($oldPciConfigState:[int]int, $oldmem:mems);\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, me, init, stk, statics, core_state, ptMem, $oldmem,\r\n $stacksFrames, io.(_pci := io._pci.(PciConfigState := $oldPciConfigState)));\r\n requires MemInv($Mem_Vars);\r\n requires IoInv($IoVars, $pciMem);\r\n requires mems.dat == $oldmem.dat;\r\n requires mems.gc == $oldmem.gc;\r\n requires mems.frm == $oldmem.frm;\r\n requires mems.tcb == $oldmem.tcb;\r\n ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n\r\n//- Call the garbage collector.\r\n// REVIEW: most system calls will share these preconditions and postconditions, so we should define some more abbreviations\r\nprocedure GarbageCollect();\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires word(ebp);\r\n requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n requires SMemRequireRA(212, stk, esp, RET);\r\n\r\n modifies $r1, $r2, $gcMem, $toAbs, $gcSlice, mems.frm, $fMems, $Time;\r\n modifies Ti, Tj, Tk, Tl, Fi, Fk, Fl, BF, BT;\r\n modifies efl, eax, ebx, ecx, edx, esi, edi, ebp, esp, stk;\r\n\r\n //- postcondition same as precondition, plus reached:\r\n ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n ensures (forall i:int::{TV(i)} TV(i) ==> Fi <= i && i < Fk && $toAbs[i] != NO_ABS ==>\r\n reached($toAbs[i], $Time));\r\n ensures ebp == old(ebp);\r\n ensures SMemEnsure(stk, old(stk), esp, old(esp));\r\n\r\natomic procedure gcFieldProperties(ptr:int, fld:int);\r\n inout my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires isStack($S);\r\n requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n requires Pointer($toAbs, ptr, $toAbs[ptr]);\r\n requires 0 <= fld && fld < numFields(objLayouts, $toAbs[ptr]);\r\n ensures word(ptr + 4 * fld);\r\n\r\natomic procedure gcLoadField(x:int, y:opn_mem, ptr:int, fld:int);\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires isStack($S);\r\n requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n requires Pointer($toAbs, ptr, $toAbs[ptr]);\r\n requires 0 <= fld && fld < numFields(objLayouts, $toAbs[ptr]);\r\n requires EvalPtrOk(y);\r\n requires EvalPtr(r, y) == ptr + 4 * fld;\r\n modifies r, mems;\r\n ensures mems == old(mems);\r\n ensures r.regs == old(r).regs[x := r.regs[x]];\r\n ensures r.efl == old(r).efl;\r\n ensures word(r.regs[x]);\r\n ensures Value(objLayouts, VFieldPtr(objLayouts, $toAbs[ptr], fld), $toAbs, r.regs[x], $absMem[$toAbs[ptr]][fld]);\r\n\r\natomic procedure gcStoreField(x:opn_mem, y:opn, ptr:int, fld:int, abs:int);\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires isStack($S);\r\n requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, me, init, stk, statics, core_state, ptMem, mems, $stacksFrames, $IoVars);\r\n requires Pointer($toAbs, ptr, $toAbs[ptr]);\r\n requires 0 <= fld && fld < numFields(objLayouts, $toAbs[ptr]);\r\n requires !isReadonlyField(0, fld);\r\n requires Value(objLayouts, VFieldPtr(objLayouts, $toAbs[ptr], fld), $toAbs, Eval(r, y), abs);\r\n requires EvalPtrOk(x);\r\n requires EvalPtr(r, x) == ptr + 4 * fld;\r\n requires SrcOk(y);\r\n modifies mems.gc, $absMem;\r\n ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, me, init, stk, statics, core_state, ptMem, mems, $stacksFrames, $IoVars);\r\n ensures $absMem == old($absMem[$toAbs[ptr] := $absMem[$toAbs[ptr]][fld := abs]]);\r\n\r\natomic procedure gcLoadStack(x:int, y:opn_mem, ptr:int);\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires isStack($S);\r\n requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n requires StackLo($S) <= ptr && ptr < StackHi($S);\r\n requires Aligned(ptr);\r\n requires EvalPtrOk(y);\r\n requires EvalPtr(r, y) == ptr;\r\n modifies r, mems;\r\n ensures mems == old(mems);\r\n ensures r.regs == old(r).regs[x := r.regs[x]];\r\n ensures word(r.regs[x]);\r\n ensures Value(objLayouts, true, $toAbs, r.regs[x], $stacksFrames[$S].Abss[ptr]);\r\n\r\natomic procedure gcStoreStack(x:opn_mem, y:opn, ptr:int, abs:int);\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires isStack($S);\r\n requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, me, init, stk, statics, core_state, ptMem, mems, $stacksFrames, $IoVars);\r\n requires StackLo($S) <= ptr && ptr < StackHi($S);\r\n requires Aligned(ptr);\r\n requires Value(objLayouts, true, $toAbs, Eval(r, y), abs);\r\n requires EvalPtrOk(x);\r\n requires EvalPtr(r, x) == ptr;\r\n requires SrcOk(y);\r\n modifies mems.frm, mems.frms, $stacksFrames;\r\n ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, me, init, stk, statics, core_state, ptMem, mems, $stacksFrames, $IoVars);\r\n ensures $stacksFrames == old($stacksFrames[$S := Frames($stacksFrames[$S].Abss[ptr := abs])]);\r\n\r\nprocedure AllocObject($abs:int, $numWords:int, $numPrimitiveWords:int);\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires word(ebp);\r\n //- GC invariant:\r\n requires isStack($S); // && $StackState[$S] == StackRunning;\r\n requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n //requires SMemRequireRA(224, stk, esp, RET);\r\n requires SMemRequireRA(228, stk, esp, RET);\r\n#ifdef x64\r\n requires ReturnToAddr64(stk[esp], stk[esp+4]) == RET;\r\n#else\r\n requires ReturnToAddr32(stk[esp]) == RET;\r\n#endif\r\n\r\n //- requirements on mutator root layout:\r\n requires ScanStackInv($S, $fMems[$S], $stacksFrames, stk[esp], esp, ebp);\r\n\r\n //- requirements on vtable and layout:\r\n requires stk[esp + (4 + IPSize)] == $numWords * 4;\r\n requires stk[esp + (8 + IPSize)] == $numPrimitiveWords * 4;\r\n requires sAddr(esp + (8 + IPSize));\r\n requires word($numWords * 4);\r\n\r\n //- require a fresh, empty abstract node:\r\n requires $abs != NO_ABS;\r\n requires objLayouts[$abs] == NoObjLayout();\r\n requires 2 <= $numPrimitiveWords && $numPrimitiveWords <= $numWords;\r\n requires (forall i:int::{TV(i)} TV(i) ==> gcAddr(i) ==> $toAbs[i] != $abs);\r\n\r\n modifies stk, efl, eax, ebx, ecx, edx, esi, edi, ebp, esp;\r\n modifies $absMem, $toAbs, objLayouts;\r\n modifies $commonVars, $gcVars, $Time, mems;\r\n modifies HeapLo, Fi, Fk, Fl, Ti, Tj, Tk, Tl, BF, BT;\r\n\r\n ensures SMemEnsureGcF(4, stk, old(stk), esp, old(esp), $stacksFrames, old($stacksFrames));\r\n ensures StackInv($stacksFrames[$S]);\r\n ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n ensures $absMem == old($absMem)[$abs := $absMem[$abs]];\r\n ensures (forall j:int::{TO(j)} $absMem[$abs][j] == if j == 0 then $numPrimitiveWords * 4 else if j == 1 then $numWords * 4 else NULL);\r\n// ensures $toAbs == old($toAbs)[eax - 4 := $abs];\r\n// ensures $toAbs[stk[esp] - 4] == $abs;\r\n ensures objLayouts == old(objLayouts)[$abs := ObjLayout($numWords, $numPrimitiveWords)];\r\n ensures Pointer($toAbs, stk[esp] - 4, $abs);\r\n ensures gcAddrEx(stk[esp]);\r\n ensures WellFormed($toAbs);\r\n ensures ebp == old(ebp);\r\n ensures esp == old(esp) + IPSize;\r\n\r\n//- note: keep stackGcOffset up to date if ?fLo or ?sLo change; see assertion in Entry.beat\r\n//- note: keep stackGcOffset in sync with DafnyCC/RegAlloc.cs, RegAlloc.stackGcOffset\r\nconst stackGcOffset:int := 0x111000; //- assert ?fLo - ?sLo == stackGcOffset;\r\n\r\nfunction frameGet(stacksFrames:[int]Frames, i:int):int { stacksFrames[0].Abss[i] }\r\n\r\n//- Reserve n bytes of stack space, argRet bytes of argument/return space, and require return address on stack\r\nfunction SMemRequireGcRA(n:int, argRet:int, sMem:mem, $esp:int, $RET:ReturnTo) returns(bool)\r\n{\r\n SMemRequire(n, sMem, $esp)\r\n#ifdef x64\r\n && ?sLo + n <= $esp \r\n && $esp + argRet <= ?sHi - 8 \r\n && ReturnToAddr64(sMem[$esp], sMem[$esp + 4]) == $RET \r\n#else\r\n && ?sLo + n <= $esp \r\n && $esp + argRet <= ?sHi - 4\r\n && ReturnToAddr32(sMem[$esp]) == $RET \r\n#endif\r\n}\r\n\r\n//- Stack contents not altered\r\nfunction SMemInvGc(argRet:int, sMem:mem, oldSMem:mem, $esp:int, oldEsp:int, sAbs:[int]int, oldSAbs:[int]int):bool\r\n{\r\n $esp == oldEsp\r\n && sMem[$esp] == oldSMem[$esp]\r\n#ifdef x64\r\n && sMem[$esp + 4] == oldSMem[$esp + 4]\r\n#endif\r\n && (forall i:int::{sMem[i]} $esp + argRet <= i ==> sMem[i] == oldSMem[i])\r\n && (forall i:int::{sAbs[i]} $esp + argRet + stackGcOffset <= i ==> sAbs[i] == oldSAbs[i])\r\n}\r\n\r\nfunction SMemInvGcF(argRet:int, sMem:mem, oldSMem:mem, $esp:int, oldEsp:int, stacksFrames:[int]Frames, oldStacksFrames:[int]Frames):bool\r\n{\r\n SMemInvGc(argRet, sMem, oldSMem, $esp, oldEsp, stacksFrames[$S].Abss, oldStacksFrames[$S].Abss)\r\n}\r\n\r\n//- Stack contents not altered\r\nfunction SMemEnsureGc(argRet:int, sMem:mem, oldSMem:mem, $esp:int, oldEsp:int, sAbs:[int]int, oldSAbs:[int]int):bool\r\n{\r\n $esp == oldEsp + IPSize\r\n && (forall i:int::{sMem[i]} $esp + argRet <= i ==> sMem[i] == oldSMem[i])\r\n && (forall i:int::{sAbs[i]} $esp + argRet + stackGcOffset <= i ==> sAbs[i] == oldSAbs[i])\r\n}\r\n\r\nfunction SMemEnsureGcF(argRet:int, sMem:mem, oldSMem:mem, $esp:int, oldEsp:int, stacksFrames:[int]Frames, oldStacksFrames:[int]Frames):bool\r\n{\r\n SMemEnsureGc(argRet, sMem, oldSMem, $esp, oldEsp, stacksFrames[$S].Abss, oldStacksFrames[$S].Abss)\r\n}\r\n\r\nfunction AbsExtend(toAbs:[int]int, oldToAbs:[int]int, objLayouts:[int]ObjLayout, oldObjLayouts:[int]ObjLayout):bool\r\n{\r\n (forall i:int::\r\n {objLayouts[i]}\r\n //{oldObjLayouts[i]} // commented out to slightly improve performance\r\n oldObjLayouts[i] != NoObjLayout() ==> oldObjLayouts[i] == objLayouts[i])\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/GC/SimpleCollector.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation SimpleCollector\r\n{\r\n\r\nfunction implementation gcVarsInv(x:gcVars, m:mem):bool\r\n{\r\n true\r\n && m.dom[&HeapLo]\r\n && m.dom[&Fi]\r\n && m.dom[&Fk]\r\n && m.dom[&Fl]\r\n && m.dom[&Ti]\r\n && m.dom[&Tj]\r\n && m.dom[&Tk]\r\n && m.dom[&Tl]\r\n && m.dom[&BF]\r\n && m.dom[&BT]\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- COPYING COLLECTOR\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nfunction IsFwdPtr(i:int) returns(bool) { i == 0 }\r\n\r\nfunction ObjectSpc(objLayouts:[int]ObjLayout, i1:int, i2:int, r:[int]int) returns (bool)\r\n{\r\n (forall i:int::{TV(i)} TV(i) ==> i1 <= i && i < i2 && r[i] != NO_ABS ==>\r\n i + 4 * numFields(objLayouts, r[i]) <= i2\r\n && (forall ii:int::{TV(ii)} TV(ii) ==> i < ii && ii < i + 4 * numFields(objLayouts, r[i]) ==> r[ii] == NO_ABS))\r\n}\r\n\r\nfunction ObjectSeq(objLayouts:[int]ObjLayout, i1:int, i2:int, r:[int]int) returns (bool)\r\n{\r\n (i1 == i2 || r[i1] != NO_ABS)\r\n && (forall i:int::{TV(i)} TV(i) ==> i1 <= i && i < i2 && r[i] != NO_ABS ==>\r\n (forall ii:int::{TV(ii)} TV(ii) ==> i < ii && ii < i + 4 * numFields(objLayouts, r[i]) ==>\r\n r[ii] == NO_ABS)\r\n && (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < numFields(objLayouts, r[i]) ==> gcAddr(i + 4 * j)) // REVIEW: necessary?\r\n && ( (i + 4 * numFields(objLayouts, r[i]) == i2)\r\n || (i + 4 * numFields(objLayouts, r[i]) < i2 && r[i + 4 * numFields(objLayouts, r[i])] != NO_ABS)))\r\n}\r\n\r\nfunction EmptySeq(i1:int, i2:int, r:[int]int, $toAbs:[int]int) returns (bool)\r\n{\r\n (forall i:int::{TV(i)} TV(i) ==> i1 <= i && i < i2 ==> gcAddr(i) && r[i] == NO_ABS && $toAbs[i] == NO_ABS) // REVIEW: gcAddr necessary?\r\n}\r\n\r\n//- invariant:\r\n//- note: typically, Tj = _tj and Tk = _tk\r\nfunction CopyGcInv(objLayouts:[int]ObjLayout, _tj:int, $Tk:int, _tk:int, $Time:Time,\r\n r1Live:bool, $toAbs:[int]int, $absMem:[int][int]int,\r\n $DECL__MemVars, $commonVars:commonVars, $gcVars:gcVars\r\n ):bool\r\n{\r\n ?gcLo <= HeapLo\r\n && HeapLo <= ?gcHi\r\n && ((Fi == HeapLo && Ti == Fl && BF == ?gcLo) || (Ti == HeapLo && Fi == Tl && BT == ?gcLo))\r\n && Fi <= Fk && Fk <= Fl && Fl <= ?gcHi\r\n && Ti <= Tj && Tj <= _tj && _tj <= $Tk && $Tk <= _tk && _tk <= Tl && Tl <= ?gcHi\r\n && Aligned(Fi) && Aligned(Fk) && Aligned(Ti) && Aligned(Tj) && Aligned($Tk)\r\n && WellFormed($toAbs)\r\n && ObjectSpc(objLayouts, Fi, Fk, $r1)\r\n && EmptySeq( Fk, Fl, $r1, $toAbs)\r\n && ObjectSpc(objLayouts, Ti, Tj, $r2)\r\n && ObjectSeq(objLayouts, _tj, $Tk, $r2)\r\n && EmptySeq( _tk, Tl, $r2, $toAbs)\r\n && (forall i:int::{TV(i)} TV(i) ==> gcAddr(i) ==> $toAbs[i] == NO_ABS || $toAbs[i] != $freshAbs)\r\n && (forall i:int::{TV(i)} TV(i) ==> gcAddr(i) ==> $r1[i] != NO_ABS && r1Live ==> Fi <= i && i < Fk)\r\n && (forall i:int::{TV(i)} TV(i) ==> gcAddr(i) ==> $r2[i] != NO_ABS ==> Ti <= i && i < _tk)\r\n && (forall i:int::{TV(i)} TV(i) ==> Fi <= i && i < Fk && $r1[i] != NO_ABS ==>\r\n ( IsFwdPtr($gcMem[i]) <==> $toAbs[i] == NO_ABS)\r\n && ( IsFwdPtr($gcMem[i]) ==> Pointer($r2, $gcMem[i + 4] - 4, $r1[i]) && AlignedHeapAddr(i + 4) && gcAddrEx($gcMem[i + 4]))\r\n && (!IsFwdPtr($gcMem[i]) ==> $toAbs[i] == $r1[i])\r\n && (!IsFwdPtr($gcMem[i]) ==> r1Live ==> ObjInv(objLayouts, i, $r1, $r1, $toAbs, $absMem, $gcMem, $gcSlice))\r\n && (r1Live ==> $gcSlice[i] == i && $gcSlice[i + 4] == i)\r\n && i + 4 < Fk // REVIEW: hack?\r\n && Aligned(i) // REVIEW: redundant?\r\n )\r\n && (forall i:int::{TV(i)} TV(i) ==> Fi <= i && i < Fl && $toAbs[i] != NO_ABS ==> $r1[i] != NO_ABS && $r1[i] != NO_ABS)\r\n && (forall i:int::{TV(i)} TV(i) ==> Ti <= i && i < Tl && $toAbs[i] != NO_ABS ==> $r2[i] != NO_ABS && $r2[i] != NO_ABS)\r\n && (forall i:int::{TV(i)} TV(i) ==> Ti <= i && i < Tj && $r2[i] != NO_ABS ==>\r\n $toAbs[i] != NO_ABS && $toAbs[i] == $r2[i]\r\n && reached($toAbs[i], $Time)\r\n && ObjInv(objLayouts, i, $r2, $r2, $toAbs, $absMem, $gcMem, $gcSlice)\r\n && !IsFwdPtr($gcMem[i])\r\n )\r\n && (Tj != _tj ==> (forall j:int::{TO(j)} TO(j) ==> 0 <= j && Tj + 4 * j < _tj ==>\r\n gcAddr(Tj + 4 * j) && $gcSlice[Tj + 4 * j] == Tj)) // REVIEW: gcAddr necessary?\r\n && (forall i:int::{TV(i)} TV(i) ==> Tj < i && i < _tj ==> $r2[i] == NO_ABS)\r\n && (forall i:int::{TV(i)} TV(i) ==> _tj <= i && i < $Tk && $r2[i] != NO_ABS ==>\r\n $toAbs[i] != NO_ABS && $toAbs[i] == $r2[i]\r\n && reached($toAbs[i], $Time)\r\n && ObjInv(objLayouts, i, $r2, $r1, $toAbs, $absMem, $gcMem, $gcSlice)\r\n && !IsFwdPtr($gcMem[i])\r\n )\r\n && commonVarsInv($commonVars, statics)\r\n && gcVarsInv($gcVars, statics)\r\n}\r\n\r\nfunction __NucleusInv(objLayouts:[int]ObjLayout, $toAbs:[int]int, $absMem:[int][int]int, DECL_GcVars, $DECL__MemVars, $stacksFrames:[int]Frames) returns(bool)\r\n{\r\n ?gcLo <= HeapLo\r\n && HeapLo <= ?gcHi\r\n && ((Fi == HeapLo && Ti == Fl && BF == ?gcLo) || (Ti == HeapLo && Fi == Tl && BT == ?gcLo))\r\n && Fi <= Fk && Fk <= Fl && Fl <= ?gcHi\r\n && Ti <= Tj && Tj <= Tk && Tk <= Tl && Tl <= ?gcHi\r\n && Aligned(Fi) && Aligned(Fk) && Aligned(Ti) && Aligned(Tj) && Aligned(Tk)\r\n && WellFormed($toAbs)\r\n && ObjectSpc(objLayouts, Fi, Fk, $toAbs)\r\n && EmptySeq( Fk, Fl, $toAbs, $toAbs)\r\n && EmptySeq( Ti, Tl, $toAbs, $toAbs)\r\n && (forall i:int::{TV(i)} TV(i) ==> gcAddr(i) ==> $toAbs[i] == NO_ABS || $toAbs[i] != $freshAbs)\r\n && (forall i:int::{TV(i)} TV(i) ==> gcAddr(i) ==> ($toAbs[i] != NO_ABS ==> Fi <= i && i < Fk))\r\n && (forall i:int::{TV(i)} TV(i) ==> Fi <= i && i < Fk && $toAbs[i] != NO_ABS ==>\r\n $toAbs[i] != NO_ABS\r\n && ObjInv(objLayouts, i, $toAbs, $toAbs, $toAbs, $absMem, $gcMem, $gcSlice)\r\n && !IsFwdPtr($gcMem[i])\r\n )\r\n && (forall i:int::{TV(i)} TV(i) ==> Fi <= i && i < Fl && $toAbs[i] != NO_ABS ==> $toAbs[i] != NO_ABS)\r\n && (forall i:int::{TV(i)} TV(i) ==> Ti <= i && i < Tl && $toAbs[i] != NO_ABS ==> false)\r\n && commonVarsInv($commonVars, statics)\r\n && gcVarsInv($gcVars, statics)\r\n}\r\n\r\n// REVIEW: this should be shared between collectors\r\nfunction _StateInv(objLayouts:[int]ObjLayout, $s:int, $toAbs:[int]int, $DECL__MemVars, $stacksFrames:[int]Frames) returns(bool)\r\n{\r\n MutatorStackInv(objLayouts, $s, $toAbs, $stacksFrames[$s], $fMems[$s])\r\n && ScanStackInv($s, $fMems[$s], $stacksFrames, StackRA($s, $tMems, $fMems), StackEsp($s, $tMems), StackEbp($s, $tMems))\r\n}\r\n\r\nfunction implementation _NucleusInv(objLayouts:[int]ObjLayout, $S:int, $toAbs:[int]int, $absMem:[int][int]int, DECL_GcVars, $DECL__MemVars, $stacksFrames:[int]Frames) returns(bool)\r\n{\r\n __NucleusInv(objLayouts, $toAbs, $absMem, GcVars, me, $__MemVars, $stacksFrames)\r\n && (forall $s:int::{TStk($s)} TStk($s) ==> isStack($s) ==> _StateInv(objLayouts, $s, $toAbs, me, $__MemVars, $stacksFrames))\r\n}\r\n\r\nimplementation proc_RevealAbssValue()\r\n{\r\n assert TStk(0);\r\n assert (forall objLayouts:[int]ObjLayout, $S:int, $toAbs:[int]int, $absMem:[int][int]int, DECL_GcVars, $DECL_Mem_Vars, $stacksFrames:[int]Frames, DECL_IoVars\r\n ::\r\n NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars)\r\n ==>\r\n (forall i:int:: TV(i) ==> StackLo(0) <= i && i < StackHi(0) && Aligned(i) ==>\r\n Value(objLayouts, true, $toAbs, $fMems[0][i], $stacksFrames[0].Abss[i])\r\n )\r\n );\r\n}\r\n\r\natomic ghost procedure espAligned()\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n requires Aligned(esp);\r\n ensures Aligned(esp - 4) && Aligned(esp - 8) && Aligned(esp - 12) && Aligned(esp - 16);\r\n ensures Aligned(esp - 20) && Aligned(esp - 24) && Aligned(esp - 28) && Aligned(esp - 32);\r\n ensures Aligned(esp - 36) && Aligned(esp - 40) && Aligned(esp - 44) && Aligned(esp - 48);\r\n ensures Aligned(esp - 52) && Aligned(esp - 56) && Aligned(esp - 60) && Aligned(esp - 64);\r\n{\r\n assert TV(esp) && TO(0-1) && TO(0-2) && TO(0-3) && TO(0-4) && TO(0-5) && TO(0-6) && TO(0-7) && TO(0-8) && TO(0-9) && TO(0-10) && TO(0-11) && TO(0-12) && TO(0-13) && TO(0-14) && TO(0-15) && TO(0-16);\r\n}\r\n\r\natomic ghost procedure espAlignedInline()\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n requires Aligned(esp);\r\n ensures Aligned(esp + 4) && Aligned(esp + 8) && Aligned(esp + 12) && Aligned(esp + 16);\r\n ensures Aligned(esp + 20) && Aligned(esp + 24) && Aligned(esp + 28) && Aligned(esp + 32);\r\n ensures Aligned(esp + 36) && Aligned(esp + 40) && Aligned(esp + 44) && Aligned(esp + 48);\r\n ensures Aligned(esp + 52) && Aligned(esp + 56) && Aligned(esp + 60) && Aligned(esp + 64);\r\n{\r\n assert TV(esp) && TO(1) && TO(2) && TO(3) && TO(4) && TO(5) && TO(6) && TO(7) && TO(8) && TO(9) && TO(10) && TO(11) && TO(12) && TO(13) && TO(14) && TO(15) && TO(16);\r\n}\r\n\r\nprocedure copyWord($ptr:int, $_tj:int, $ret:int, $ind:int, $s:int)\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires ecx == $ptr && esi == $ret && edx == 4 * $ind;\r\n requires Pointer($r1, $ptr, $r1[$ptr]) && TV($ptr);\r\n requires !IsFwdPtr($gcMem[$ptr]);\r\n requires $_tj <= Tk;\r\n\r\n requires $s == 4 * numFields(objLayouts, $r1[$ptr]);\r\n requires Tk == $ret + $s;\r\n requires Tk <= Tl;\r\n\r\n requires TO($ind) && 0 <= $ind && $ind < numFields(objLayouts, $r1[$ptr]);\r\n requires CopyGcInv(objLayouts, $_tj, $ret, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n requires MemInv($Mem_Vars);\r\n requires (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < $ind ==> gcAddr($ret + 4 * j) && $gcSlice[$ret + 4 * j] == $ret); // REVIEW: gcAddr necessary?\r\n requires EmptySeq($ret + 4 * $ind, Tk, $r2, $toAbs);\r\n requires (forall j:int::{TO(j)} TO(j) ==>\r\n 0 <= j && j < $ind ==> Value(objLayouts, VFieldPtr(objLayouts, $r1[$ptr], j), $r1, $gcMem[$ret + 4 * j], $absMem[$toAbs[$ptr]][j]));\r\n requires (forall i:int::{TV(i)} TV(i) ==> $ret < i && i < $ret + 4 * $ind ==> $r2[i] == NO_ABS);\r\n requires $r2[$ret] == NO_ABS;\r\n\r\n modifies $gcMem, $gcSlice;\r\n modifies efl, eax;\r\n\r\n ensures CopyGcInv(objLayouts, $_tj, $ret, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n ensures MemInv($Mem_Vars);\r\n ensures (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < $ind + 1 ==> gcAddr($ret + 4 * j) && $gcSlice[$ret + 4 * j] == $ret); // REVIEW: gcAddr necessary?\r\n ensures (forall j:int::{TO(j)} TO(j) ==>\r\n 0 <= j && j < $ind + 1 ==> Value(objLayouts, VFieldPtr(objLayouts, $r1[$ptr], j), $r1, $gcMem[$ret + 4 * j], $absMem[$toAbs[$ptr]][j]));\r\n ensures (forall j:int::{TO(j)} TO(j) ==> 0 <= j && Tj + 4 * j < $_tj ==>\r\n $gcMem[Tj + 4 * j] == old($gcMem)[Tj + 4 * j] && $gcSlice[Tj + 4 * j] == old($gcSlice[Tj + 4 * j]));\r\n\r\n ensures RExtend(old($r2), $r2);\r\n ensures $Time == old($Time);\r\n{\r\n call reveal_MemInvDetails();\r\n assert TO(numFields(objLayouts, $r1[$ptr]));\r\n assert TV($ret);\r\n\r\n call eax := Load(mems.gc, ecx + edx);\r\n assert TV($ret + 4 * $ind);\r\n $gcSlice[$ret + 4 * $ind] := $ret;\r\n call Store(inout mems.gc, esi + edx, eax);\r\n assert TO(1);\r\n}\r\n\r\nprocedure CopyAndForward($ptr:int, $_tj:int)\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires ecx == $ptr;\r\n requires CopyGcInv(objLayouts, $_tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n requires MemInv($Mem_Vars);\r\n requires Pointer($r1, $ptr, $r1[$ptr]) && TV($ptr);\r\n requires !IsFwdPtr($gcMem[$ptr]);\r\n requires $_tj <= Tk;\r\n requires reached($toAbs[$ptr], $Time);\r\n requires SMemRequireRA(100, stk, esp, RET);\r\n modifies $r2, $gcMem, $toAbs, Tk, $gcSlice;\r\n modifies efl, eax, ebx, ecx, edx, esi, esp;\r\n modifies stk;\r\n ensures CopyGcInv(objLayouts, $_tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n ensures MemInv($Mem_Vars);\r\n ensures RExtend(old($r2), $r2);\r\n ensures Pointer($r2, eax, $r1[$ptr]);\r\n ensures Tj == old(Tj);\r\n ensures Tk >= old(Tk);\r\n ensures old($toAbs)[Tj] != NO_ABS ==> $toAbs[Tj] != NO_ABS && $toAbs[Tj] == old($toAbs)[Tj];\r\n ensures (forall j:int::{TO(j)} TO(j) ==> 0 <= j && Tj + 4 * j < $_tj ==>\r\n $gcMem[Tj + 4 * j] == old($gcMem)[Tj + 4 * j] && $gcSlice[Tj + 4 * j] == old($gcSlice[Tj + 4 * j]));\r\n ensures Ti <= eax && eax < Tk && gcAddrEx(eax + 4);\r\n ensures SMemEnsure(stk, old(stk), esp, old(esp));\r\n ensures $Time == old($Time);\r\n{\r\n call reveal_MemInvDetails();\r\n call ebx := Load(mems.gc, ecx + 4);\r\n assert TV($ptr);\r\n assert TO(0) && TO(1);\r\n assert TO(numFields(objLayouts, $r1[$ptr]));\r\n\r\n eax := Tk;\r\n esi := eax;\r\n call eax := AddChecked(eax, ebx);\r\n Tk := eax;\r\n\r\n assert TV(esi);\r\n\r\n eax := Tl;\r\n if (Tk <= eax) { goto skip1; }\r\n // out of memory\r\n eax := 0x55550031;\r\n call DebugBreak();\r\n skip1:\r\n\r\n var ind:int := 0;\r\n edx := 0;\r\n // while (edx < ebx)\r\n loop:\r\n invariant 4 * ind == edx;\r\n invariant 4 * numFields(objLayouts, $r1[$ptr]) == ebx;\r\n invariant esi == old(Tk);\r\n invariant ecx == $ptr;\r\n invariant Tk == esi + ebx;\r\n invariant TO(ind) && 0 <= ind && ind <= numFields(objLayouts, $r1[$ptr]);\r\n invariant CopyGcInv(objLayouts, $_tj, esi, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n invariant MemInv($Mem_Vars);\r\n invariant RExtend(old($r2), $r2);\r\n invariant (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < ind ==> gcAddr(esi + 4 * j) && $gcSlice[esi + 4 * j] == esi); // REVIEW: gcAddr necessary?\r\n invariant EmptySeq(esi + 4 * ind, Tk, $r2, $toAbs);\r\n invariant (forall j:int::{TO(j)} TO(j) ==>\r\n 0 <= j && j < ind ==> Value(objLayouts, VFieldPtr(objLayouts, $r1[$ptr], j), $r1, $gcMem[esi + 4 * j], $absMem[$toAbs[$ptr]][j]));\r\n invariant (forall i:int::{TV(i)} TV(i) ==> esi < i && i < esi + 4 * ind ==> $r2[i] == NO_ABS);\r\n invariant (forall j:int::{TO(j)} TO(j) ==> 0 <= j && Tj + 4 * j < $_tj ==>\r\n $gcMem[Tj + 4 * j] == old($gcMem)[Tj + 4 * j] && $gcSlice[Tj + 4 * j] == old($gcSlice[Tj + 4 * j]));\r\n invariant $r2[esi] == NO_ABS;\r\n invariant SMemInv(stk, old(stk), esp, old(esp));\r\n invariant $Time == old($Time);\r\n if (edx >= ebx) { goto loopEnd; }\r\n\r\n call copyWord($ptr, $_tj, esi, ind, ebx);\r\n ind := ind + 1;\r\n call edx := Add(edx, 4);\r\n goto loop;\r\n loopEnd:\r\n\r\n // Set forwarding pointer\r\n call eax := Lea(esi + 4);\r\n call Store(inout mems.gc, ecx + 0, 0);\r\n call Store(inout mems.gc, ecx + 4, eax);\r\n\r\n eax := esi;\r\n\r\n $r2[eax] := $r1[$ptr];\r\n $toAbs[eax] := $toAbs[$ptr];\r\n $toAbs[$ptr] := NO_ABS;\r\n assert TO(0) && TO(1);\r\n\r\n assert TV(eax - Ti);\r\n\r\n Return;\r\n}\r\n\r\nprocedure forwardFromspacePtr($ptr:int, $abs:int, $_tj:int)\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires ecx == $ptr;\r\n requires CopyGcInv(objLayouts, $_tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n requires MemInv($Mem_Vars);\r\n requires word($ptr);\r\n requires Pointer($r1, $ptr - 4, $abs);\r\n requires $_tj <= Tk;\r\n requires IsFwdPtr($gcMem[$ptr - 4]) || reached($toAbs[$ptr - 4], $Time);\r\n requires SMemRequire(108, stk, esp);\r\n modifies $r2, $gcMem, $toAbs, Tk, $gcSlice;\r\n modifies efl, eax, ebx, ecx, edx, esi, esp;\r\n modifies stk;\r\n ensures CopyGcInv(objLayouts, $_tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n ensures MemInv($Mem_Vars);\r\n ensures RExtend(old($r2), $r2);\r\n ensures Pointer($r2, eax - 4, $abs);\r\n ensures Tj == old(Tj);\r\n ensures Tk >= old(Tk);\r\n ensures old($toAbs)[Tj] != NO_ABS ==> $toAbs[Tj] != NO_ABS && $toAbs[Tj] == old($toAbs)[Tj];\r\n ensures (forall j:int::{TO(j)} TO(j) ==> 0 <= j && Tj + 4 * j < $_tj ==>\r\n $gcMem[Tj + 4 * j] == old($gcMem)[Tj + 4 * j] && $gcSlice[Tj + 4 * j] == old($gcSlice[Tj + 4 * j]));\r\n ensures Ti <= eax - 4 && eax - 4 < Tk;\r\n ensures gcAddrEx(eax);\r\n ensures SMemInv(stk, old(stk), esp, old(esp));\r\n ensures $Time == old($Time);\r\n{\r\n call reveal_MemInvDetails();\r\n assert TV($ptr - 4);\r\n call ecx := Sub(ecx, 4);\r\n call eax := Load(mems.gc, ecx);\r\n\r\n if (eax != 0) { goto skip; }\r\n call eax := Load(mems.gc, ecx + 4);\r\n goto done;\r\n skip:\r\n call CopyAndForward($ptr - 4, $_tj);\r\n call eax := Add(eax, 4);\r\n done:\r\n assert TV(eax - 4);\r\n}\r\n\r\nprocedure scanObject()\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires CopyGcInv(objLayouts, Tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n requires MemInv($Mem_Vars);\r\n requires Tj < Tk;\r\n requires TV(Tj);\r\n requires SMemRequireInline(108, 24, stk, esp);\r\n modifies $r2, $gcMem, $toAbs, Tj, Tk, $gcSlice;\r\n modifies efl, eax, ebx, ecx, edx, esi, edi, ebp, esp, stk;\r\n ensures CopyGcInv(objLayouts, Tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n ensures MemInv($Mem_Vars);\r\n ensures RExtend(old($r2), $r2);\r\n ensures SMemInv(stk, old(stk), esp + 24, old(esp) + 24);\r\n ensures $Time == old($Time);\r\n{\r\n call reveal_MemInvDetails();\r\n var $ind:int;\r\n var $tj:int := Tj;\r\n\r\n call espAlignedInline();\r\n\r\n assert TO(0);\r\n assert TO(1);\r\n assert TO(numFields(objLayouts, $r2[Tj]));\r\n\r\n ebx := Tj;\r\n call edi := Load(mems.gc, ebx + 0); //- sizePrimitives\r\n call ebp := Load(mems.gc, ebx + 4); //- size\r\n $ind := numPrimitiveFields(objLayouts, $r2[$tj]);\r\n\r\n call edi := Add(edi, ebx);\r\n call ebp := Add(ebp, ebx);\r\n\r\n //while (edi < ebp)\r\n loop:\r\n invariant $tj == Tj;\r\n invariant edi == $tj + 4 * $ind;\r\n invariant ebp == $tj + 4 * numFields(objLayouts, $r2[$tj]);\r\n invariant TO($ind) && numPrimitiveFields(objLayouts, $r2[$tj]) <= $ind && $ind <= numFields(objLayouts, $r2[$tj]);\r\n invariant Pointer($r2, $tj, $r2[$tj]);\r\n invariant CopyGcInv(objLayouts, $tj + 4 * numFields(objLayouts, $r2[$tj]), Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n invariant MemInv($Mem_Vars);\r\n invariant RExtend(old($r2), $r2);\r\n invariant ObjInvPartial(objLayouts, $tj, 0, $ind, $r2, $r2, $toAbs, $absMem, $gcMem, $gcSlice);\r\n invariant ObjInvPartial(objLayouts, $tj, $ind, numFields(objLayouts, $r2[$tj]), $r2, $r1, $toAbs, $absMem, $gcMem, $gcSlice);\r\n invariant $toAbs[$tj] != NO_ABS && $toAbs[$tj] == $r2[$tj];\r\n invariant SMemInv(stk, old(stk), esp + 24, old(esp) + 24);\r\n invariant $Time == old($Time);\r\n invariant TO(0) && TO(1) && TO(2);\r\n if (edi >= ebp) { goto loopEnd; }\r\n\r\n call ecx := Load(mems.gc, edi);\r\n //if (gcAddrEx(ecx))\r\n if (ecx < GcLo) { goto skip1; }\r\n if (ecx > GcHi) { goto skip1; }\r\n assert TV(ecx - 4);\r\n call reach($toAbs[Tj], $ind, $Time);\r\n call forwardFromspacePtr(ecx, $absMem[$toAbs[Tj]][$ind], ebp);\r\n call Store(inout mems.gc, edi, eax);\r\n skip1:\r\n\r\n $ind := $ind + 1;\r\n call edi := Add(edi, 4);\r\n goto loop;\r\n loopEnd:\r\n\r\n Tj := ebp;\r\n}\r\n\r\nprocedure ScanObjects()\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires CopyGcInv(objLayouts, Tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n requires MemInv($Mem_Vars);\r\n requires SMemRequireRA(132, stk, esp, RET);\r\n modifies $r2, $gcMem, $toAbs, Tj, Tk, $gcSlice;\r\n modifies efl, eax, ebx, ecx, edx, esi, edi, ebp, esp, stk;\r\n ensures CopyGcInv(objLayouts, Tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n ensures MemInv($Mem_Vars);\r\n ensures RExtend(old($r2), $r2);\r\n ensures Tj == Tk;\r\n ensures SMemEnsure(stk, old(stk), esp, old(esp));\r\n ensures $Time == old($Time);\r\n{\r\n call espAligned();\r\n call esp := Sub(esp, 24);\r\n entry:\r\n loop:\r\n invariant CopyGcInv(objLayouts, Tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n invariant MemInv($Mem_Vars);\r\n invariant RExtend(old($r2), $r2);\r\n invariant SMemInv(stk, old(stk), esp + 24, old(esp));\r\n invariant $Time == old($Time);\r\n eax := Tk;\r\n if (Tj >= eax) { goto exit; }\r\n call scanObject();\r\n goto loop;\r\n exit:\r\n call esp := Add(esp, 24);\r\n Return;\r\n}\r\n\r\nprocedure ScanStack($s:int, $ra:int, $nextFp:int)\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires edi == StackLo($s);\r\n requires Aligned(edi);\r\n requires isStack($s);\r\n// requires ecx == $ra && word($ra);\r\n// requires edx == $nextFp && word($nextFp);\r\n requires GcStackInv(objLayouts, $s, $r1, $stacksFrames[$s], $fMems[$s]);\r\n requires CopyGcInv(objLayouts, Tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n requires MemInv($Mem_Vars);\r\n requires SMemRequireRA(172, stk, esp, RET);\r\n modifies $r2, $gcMem, $toAbs, Tk, $gcSlice, mems.frm, $fMems;\r\n modifies efl, eax, ebx, ecx, edx, esi, edi, ebp, esp, stk;\r\n ensures edi == StackHi($s);\r\n ensures Aligned(edi);\r\n ensures GcStackInv(objLayouts, $s, $r2, $stacksFrames[$s], $fMems[$s]);\r\n ensures CopyGcInv(objLayouts, Tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n ensures MemInv($Mem_Vars);\r\n ensures RExtend(old($r2), $r2);\r\n ensures (forall $ss:int::{TStk($ss)} TStk($ss) ==> $ss != $s ==> $fMems[$ss] == old($fMems)[$ss]);\r\n ensures SMemEnsure(stk, old(stk), esp, old(esp));\r\n ensures $Time == old($Time);\r\n{\r\n call reveal_MemInvDetails();\r\n call espAligned();\r\n call esp := Sub(esp, 8);\r\n var save1 @ stk[esp + 0];\r\n var save2 @ stk[esp + 4];\r\n\r\n var $ind:int := 0;\r\n call ebp := Lea(edi + ?FSize);\r\n\r\n //while (edi < ebp)\r\n loop:\r\n invariant 0 <= $ind && $ind <= ?fWords;\r\n invariant edi == StackLo($s) + 4 * $ind;\r\n invariant ebp == StackHi($s);\r\n invariant Aligned(edi);\r\n invariant CopyGcInv(objLayouts, Tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n invariant MemInv($Mem_Vars);\r\n invariant RExtend(old($r2), $r2);\r\n invariant (forall i:int::{TV(i)} TV(i) ==> edi <= i && i < StackHi($s) && Aligned(i) ==> Value(objLayouts, true, $r1, $fMems[$s][i], $stacksFrames[$s].Abss[i]));\r\n invariant (forall i:int::{TV(i)} TV(i) ==> StackLo($s) <= i && i < edi && Aligned(i) ==> Value(objLayouts, true, $r2, $fMems[$s][i], $stacksFrames[$s].Abss[i]));\r\n invariant SMemInv(stk, old(stk), esp + 8, old(esp));\r\n invariant (forall $ss:int::{TStk($ss)} TStk($ss) ==> $ss != $s ==> $fMems[$ss] == old($fMems)[$ss]);\r\n invariant $Time == old($Time);\r\n invariant TO($ind) && TV(edi);\r\n if (edi >= ebp) { goto loopEnd; }\r\n\r\n call ecx := Load(mems.frm/*[$s]*/, edi);\r\n assert TV(ecx - 4);\r\n //if (gcAddrEx(ecx))\r\n if (ecx < GcLo) { goto skip1; }\r\n if (ecx > GcHi) { goto skip1; }\r\n call reachStackRoot($s, edi, $Time);\r\n\r\n save1 := edi;\r\n save2 := ebp;\r\n call forwardFromspacePtr(ecx, $stacksFrames[$s].Abss[edi], Tj);\r\n edi := save1;\r\n ebp := save2;\r\n\r\n $fMems[$s][edi] := eax;\r\n call Store(inout mems.frm/*[$s]*/, edi, eax);\r\n skip1:\r\n\r\n assert TV(edi) && TO(1);\r\n $ind := $ind + 1;\r\n call __notAligned(edi);\r\n\r\n call edi := Add(edi, 4);\r\n goto loop;\r\n loopEnd:\r\n\r\n call esp := Add(esp, 8);\r\n Return;\r\n}\r\n\r\nprocedure ScanStacks()\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires CopyGcInv(objLayouts, Tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n requires MemInv($Mem_Vars);\r\n //requires SMemRequireRA(188, stk, esp, RET);\r\n requires SMemRequireRA(192, stk, esp, RET);\r\n requires (forall $s:int::{TStk($s)} TStk($s) ==> isStack($s) ==> _StateInv(objLayouts, $s, $r1, me, $__MemVars, $stacksFrames));\r\n modifies $r2, $gcMem, $toAbs, Tk, $gcSlice, mems.frm, $fMems;\r\n modifies efl, eax, ebx, ecx, edx, esi, edi, ebp, esp, stk;\r\n ensures CopyGcInv(objLayouts, Tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n ensures MemInv($Mem_Vars);\r\n ensures RExtend(old($r2), $r2);\r\n ensures SMemEnsure(stk, old(stk), esp, old(esp));\r\n ensures (forall $s:int::{TStk($s)} TStk($s) ==> isStack($s) ==> _StateInv(objLayouts, $s, $r2, me, $__MemVars, $stacksFrames));\r\n ensures $Time == old($Time);\r\n{\r\n call reveal_MemInvDetails();\r\n call espAligned();\r\n call esp := Sub(esp, 12);\r\n var s @ stk[esp + 0] := 0;\r\n edi := FLo;\r\n while (s < ?NumStacks)\r\n invariant 0 <= s && TStk(s);\r\n invariant CopyGcInv(objLayouts, Tj, Tk, Tk, $Time, true, $toAbs, $absMem, me, $__MemVars, $commonVars, $gcVars);\r\n invariant MemInv($Mem_Vars);\r\n invariant RExtend(old($r2), $r2);\r\n invariant SMemInv(stk, old(stk), esp + 12, old(esp));\r\n invariant (forall $s:int::{TStk($s)} TStk($s) ==> isStack($s) && s <= $s ==> _StateInv(objLayouts, $s, $r1, me, $__MemVars, $stacksFrames));\r\n invariant (forall $s:int::{TStk($s)} TStk($s) ==> isStack($s) && s > $s ==> _StateInv(objLayouts, $s, $r2, me, $__MemVars, $stacksFrames));\r\n invariant $Time == old($Time);\r\n invariant edi == StackLo(s);\r\n invariant Aligned(edi);\r\n {\r\n assert TStk($S) && TV(?sLo) && TO(512 + 65536 * 2 + 64 * s) && TO(512 + 65536 * 2 + 64 * s + 1) && TO(512 + 65536 * 2 + 64 * s + 2);\r\n call ScanStack(s, StackRA(s, $tMems, $fMems), StackEbp(s, $tMems));\r\n eax := s;\r\n call eax := Add(eax, 1);\r\n s := eax;\r\n }\r\n call esp := Add(esp, 12);\r\n Return;\r\n}\r\n\r\nprocedure __garbageCollect()\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires word(ebp);\r\n requires _NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, me, $__MemVars, $stacksFrames);\r\n requires MemInv($Mem_Vars);\r\n //requires SMemRequireInline(196, 4, stk, esp);\r\n requires SMemRequireInline(200, 4, stk, esp);\r\n requires IoInv($IoVars, $pciMem);\r\n\r\n modifies $r1, $r2, $gcMem, $toAbs, $gcSlice, mems.frm, $fMems, $Time;\r\n modifies Ti, Tj, Tk, Tl, Fi, Fk, Fl, BF, BT;\r\n modifies efl, eax, ebx, ecx, edx, esi, edi, ebp, esp, stk;\r\n\r\n // postcondition same as precondition, plus reached:\r\n ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n ensures (forall i:int::{TV(i)} TV(i) ==> Fi <= i && i < Fk && $toAbs[i] != NO_ABS ==>\r\n reached($toAbs[i], $Time));\r\n ensures ebp == old(ebp);\r\n ensures SMemInv(stk, old(stk), esp + 4, old(esp) + 4);\r\n{\r\n call reveal_MemInvDetails();\r\n call espAlignedInline();\r\n var saveEbp @ stk[esp + 0] := ebp;\r\n call newTime();\r\n\r\n $r1 := $toAbs;\r\n $r2 := (lambda i:int::NO_ABS);\r\n eax := Ti;\r\n Tj := eax;\r\n Tk := eax;\r\n\r\n eax := BT;\r\n ebx := Fi;\r\n if (ebx != HeapLo) { goto skip1; }\r\n ebx := HeapLo;\r\n goto skip2;\r\n skip1:\r\n ebx := BF;\r\n skip2:\r\n\r\n call ScanStacks();\r\n call ScanObjects();\r\n\r\n $toAbs := $r2;\r\n\r\n eax := Fi;\r\n ebx := Ti;\r\n Fi := ebx;\r\n Ti := eax;\r\n\r\n eax := Fl;\r\n ebx := Tl;\r\n Fl := ebx;\r\n Tl := eax;\r\n\r\n eax := Tk;\r\n Fk := eax;\r\n\r\n eax := Ti;\r\n Tk := eax;\r\n Tj := eax;\r\n\r\n eax := BF;\r\n ebx := BT;\r\n BF := ebx;\r\n BT := eax;\r\n\r\n ebp := saveEbp;\r\n}\r\n\r\nimplementation GarbageCollect()\r\n{\r\n call espAligned();\r\n call esp := Sub(esp, 12);\r\n call __garbageCollect();\r\n call esp := Add(esp, 12);\r\n Return;\r\n}\r\n\r\nprocedure doAllocCopyingWord($ret:int, $ind:int)\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires esi == $ret + 4 * $ind;\r\n\r\n requires TO($ind) && $ind >= 0;\r\n requires Aligned($ret) && Fk <= $ret && $ret + 4 * $ind + 4 <= Fl;\r\n requires __NucleusInv(objLayouts, $toAbs, $absMem, GcVars, me, $__MemVars, $stacksFrames);\r\n requires MemInv($Mem_Vars);\r\n requires (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < $ind ==> $gcSlice[$ret + 4 * j] == $ret);\r\n requires (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < $ind ==> gcAddr($ret + 4 * j)); // REVIEW: necessary?\r\n requires (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < $ind ==> $gcMem[$ret + 4 * j] == NULL);\r\n\r\n modifies efl, $gcMem, $gcSlice;\r\n\r\n ensures __NucleusInv(objLayouts, $toAbs, $absMem, GcVars, me, $__MemVars, $stacksFrames);\r\n ensures MemInv($Mem_Vars);\r\n ensures (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < $ind + 1 ==> $gcSlice[$ret + 4 * j] == $ret);\r\n ensures (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < $ind + 1 ==> gcAddr($ret + 4 * j)); // REVIEW: necessary?\r\n ensures (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < $ind + 1 ==> $gcMem[$ret + 4 * j] == NULL);\r\n ensures $Time == old($Time);\r\n{\r\n call reveal_MemInvDetails();\r\n assert TV($ret);\r\n assert TV($ret + 4 * $ind);// && TV($ret + 4 * $ind + 1) && TV($ret + 4 * $ind + 2) && TV($ret + 4 * $ind + 3);\r\n $gcSlice[$ret + 4 * $ind] := $ret;\r\n\r\n call Store(inout mems.gc, esi, 0);\r\n}\r\n\r\nprocedure doAllocCopyingWords($ret:int, $size:int, $nf:int)\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires eax == $ret;\r\n requires ebx == $ret + $size;\r\n requires $size == $nf * 4;\r\n requires $nf >= 0;\r\n requires __NucleusInv(objLayouts, $toAbs, $absMem, GcVars, me, $__MemVars, $stacksFrames);\r\n requires MemInv($Mem_Vars);\r\n requires Aligned($ret) && Fk <= $ret && $ret + $size <= Fl;\r\n\r\n modifies $gcMem, $gcSlice;\r\n modifies efl, esi;\r\n\r\n ensures __NucleusInv(objLayouts, $toAbs, $absMem, GcVars, me, $__MemVars, $stacksFrames);\r\n ensures MemInv($Mem_Vars);\r\n ensures (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < $nf ==> $gcSlice[$ret + 4 * j] == $ret);\r\n ensures (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < $nf ==> gcAddr($ret + 4 * j)); // REVIEW: necessary?\r\n ensures (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < $nf ==> $gcMem[$ret + 4 * j] == NULL);\r\n ensures ebp == old(ebp);\r\n ensures $Time == old($Time);\r\n{\r\n call reveal_MemInvDetails();\r\n var $ind:int;\r\n $ind := 0;\r\n\r\n esi := eax;\r\n\r\n //while (4 * $ind < $size)\r\n if (esi >= ebx) { goto loopEnd; }\r\n loop:\r\n invariant 4 * $ind < $size;\r\n invariant esi == $ret + 4 * $ind;\r\n invariant TO($ind) && $ind >= 0;\r\n invariant __NucleusInv(objLayouts, $toAbs, $absMem, GcVars, me, $__MemVars, $stacksFrames);\r\n invariant MemInv($Mem_Vars);\r\n invariant (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < $ind ==> $gcSlice[$ret + 4 * j] == $ret);\r\n invariant (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < $ind ==> gcAddr($ret + 4 * j)); // REVIEW: necessary?\r\n invariant (forall j:int::{TO(j)} TO(j) ==> 0 <= j && j < $ind ==> $gcMem[$ret + 4 * j] == NULL);\r\n invariant $Time == old($Time);\r\n\r\n call doAllocCopyingWord($ret, $ind);\r\n $ind := $ind + 1;\r\n call esi := Add(esi, 4);\r\n if (esi < ebx) { goto loop; }\r\n loopEnd:\r\n}\r\n\r\nprocedure doAllocObjectCopying($nextFp:int, $abs:int, $size:int, $sizePrimitives:int)\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n requires ebx == Fk + $size;\r\n requires ecx == $size;\r\n requires edx == $sizePrimitives;\r\n requires Fk + 4 * numFields(objLayouts, $abs) <= Fl;\r\n requires !VFieldPtr(objLayouts, $abs, 0);\r\n requires !VFieldPtr(objLayouts, $abs, 1);\r\n requires 2 <= numFields(objLayouts, $abs);\r\n requires $size == 4 * numFields(objLayouts, $abs);\r\n requires ObjSize(objLayouts, $abs, $size, $absMem[$abs][0]);\r\n requires _NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, me, $__MemVars, $stacksFrames);\r\n requires MemInv($Mem_Vars);\r\n\r\n //- requirements on vtable and layout:\r\n requires word($size);\r\n requires VTable(objLayouts, $abs, $size);\r\n requires ObjSize(objLayouts, $abs, $size, $sizePrimitives);\r\n\r\n //- require a fresh, empty abstract node:\r\n requires $abs != NO_ABS;\r\n requires (forall i:int::{TV(i)} TV(i) ==> gcAddr(i) ==> $toAbs[i] != $abs);\r\n requires $absMem[$abs][0] == $sizePrimitives;\r\n requires $absMem[$abs][1] == $size;\r\n requires (forall j:int::{TO(j)} TO(j) ==> 2 <= j && j < numFields(objLayouts, $abs) ==> $absMem[$abs][j] == NULL);\r\n requires IoInv($IoVars, $pciMem);\r\n\r\n modifies $gcMem, $toAbs, $gcSlice, Fk, $freshAbs;\r\n modifies efl, eax, ebx, ecx, edx, esi, edi, ebp;\r\n\r\n ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n ensures old($toAbs)[eax - 4] == NO_ABS;\r\n ensures $toAbs == old($toAbs)[eax - 4 := $abs];\r\n ensures Pointer($toAbs, eax - 4, $abs);\r\n ensures eax == old(Fk) + 4;\r\n ensures ebp == old(ebp);\r\n{\r\n call reveal_MemInvDetails();\r\n eax := Fk;\r\n\r\n assert TV(eax + 0) && TV(eax + 4);\r\n assert TO(0) && TO(1) && TO(2);\r\n assert TO(numFields(objLayouts, $abs));\r\n\r\n call doAllocCopyingWords(eax, $size, numFields(objLayouts, $abs));\r\n\r\n call Store(inout mems.gc, eax + 0, edx);\r\n call Store(inout mems.gc, eax + 4, ecx);\r\n\r\n assert TV(Fk - Fi);\r\n\r\n $toAbs[eax] := $abs;\r\n assert TV(Fk);\r\n assert TO(numFields(objLayouts, $abs));\r\n\r\n Fk := ebx;\r\n call eax := Add(eax, 4);\r\n\r\n assert TV(eax + 4);\r\n assert TO(0);\r\n $freshAbs := NO_ABS;\r\n}\r\n\r\nimplementation InitializeGc()\r\n{\r\n call reveal_MemInvDetails();\r\n call espAligned();\r\n call esp := Sub(esp, 8);\r\n var save @ stk[esp + 0] := ebp;\r\n var unitSize @ stk[esp + 4];\r\n\r\n ecx := FLo;\r\n eax := 0;\r\n loop1:\r\n invariant 0 <= eax && eax <= ?NumStacks;\r\n invariant ecx == StackLo(eax);\r\n invariant Aligned(ecx);\r\n invariant (forall $s:int::{TStk($s)} TStk($s) ==> 0 <= $s && $s < eax ==>\r\n (forall i:int::{TV(i)} TV(i) ==> StackLo($s) <= i && i < StackHi($s) && Aligned(i) ==> $fMems[$s][i] == 0));\r\n invariant logical_addressing_inv(init, ptMem, core_state);\r\n invariant SMemInv(stk, old(stk), esp + 8, old(esp));\r\n invariant MemInv($Mem_Vars) && commonVarsInv($commonVars, statics);\r\n invariant stk[esp + 0] == old(ebp);\r\n invariant IoInv($IoVars, $pciMem);\r\n if (eax >= ?NumStacks) { goto end1; }\r\n // for 0 <= $ind < ?fWords\r\n ebx := 0;\r\n var $ind:int := 0;\r\n loop2:\r\n invariant 0 <= eax && eax < ?NumStacks;\r\n invariant 0 <= $ind && $ind <= ?fWords;\r\n invariant ebx == 4 * $ind;\r\n invariant ecx == StackLo(eax) + 4 * $ind;\r\n invariant Aligned(ecx);\r\n invariant (forall $s:int::{TStk($s)} TStk($s) ==> 0 <= $s && $s <= eax ==>\r\n (forall i:int::{TV(i)} TV(i) ==> Aligned(i) && StackLo(eax) <= i && (i < (if $s < eax then StackHi(eax) else ecx)) ==> $fMems[$s][i] == 0));\r\n invariant logical_addressing_inv(init, ptMem, core_state);\r\n invariant SMemInv(stk, old(stk), esp + 8, old(esp));\r\n invariant MemInv($Mem_Vars) && commonVarsInv($commonVars, statics);\r\n invariant stk[esp + 0] == old(ebp);\r\n invariant IoInv($IoVars, $pciMem);\r\n assert ?fWords == 1024;\r\n if (ebx >= ?FSize) { goto end2; }\r\n\r\n $fMems[eax][ecx] := 0;\r\n call Store(inout mems.frm/*[eax]*/, ecx, 0);\r\n assert TV(ecx) && TO(1);\r\n $ind := $ind + 1;\r\n call __notAligned(ecx);\r\n ebx := ebx + 4;\r\n ecx := ecx + 4;\r\n goto loop2;\r\n end2:\r\n eax := eax + 1;\r\n goto loop1;\r\n end1:\r\n\r\n //- Compute gcMem size, in bytes and words\r\n esi := GcHi;\r\n call esi := SubLoad(statics, esi, GcLo);\r\n edi := esi;\r\n\r\n //- Break into 256-byte units. Let ebp be the number of units.\r\n edx := 0;\r\n eax := edi;\r\n ebx := 256;\r\n call eax, edx := Div(eax, edx, ebx);\r\n ebp := eax;\r\n unitSize := ebp;\r\n assert 256 * unitSize <= (?gcHi - ?gcLo);\r\n\r\n //- Divide heap into ?gcLo = ebx <--128--> ecx <--128--> ?gcHi\r\n edx := 0;\r\n call ebp := Lea(edx + 4 * ebp);\r\n eax := GcLo;\r\n BF := eax;\r\n BT := eax;\r\n ebx := eax;\r\n call ebp := Lea(edx + 4 * ebp);\r\n call ecx := Lea(ebx + 8 * ebp);\r\n call edx := Lea(ecx + 8 * ebp);\r\n\r\n HeapLo := ebx;\r\n Fi := ebx;\r\n Fk := ebx;\r\n Fl := ecx;\r\n Ti := ecx;\r\n Tj := ecx;\r\n Tk := ecx;\r\n Tl := edx;\r\n\r\n call __initialize(unitSize, HeapLo);\r\n\r\n assert TV(?gcLo);\r\n assert TV(HeapLo);\r\n assert TO(0);\r\n assert TO(unitSize);\r\n assert TO(2 * unitSize);\r\n assert TO(32 * unitSize);\r\n eax := GcLo;\r\n esi := unitSize;\r\n call ebx := Lea(eax + 4 * esi);\r\n\r\n $freshAbs := NO_ABS;\r\n\r\n ebp := save;\r\n call esp := Add(esp, 8);\r\n Return;\r\n}\r\n\r\nimplementation revealInv1($s:int, $_stackState:[int]StackState)\r\n{\r\n assert TStk($s);\r\n}\r\n\r\nimplementation updateInv1($oldPciConfigState:[int]int, $oldmem:mems)\r\n{\r\n call reveal_MemInvDetails();\r\n}\r\n\r\nimplementation gcFieldProperties(ptr:int, fld:int)\r\n{\r\n call reveal_MemInvDetails();\r\n assert TV(ptr) && TO(fld);\r\n}\r\n\r\nimplementation gcLoadField(x:int, y:opn_mem, ptr:int, fld:int)\r\n{\r\n call reveal_MemInvDetails();\r\n assert TV(ptr) && TO(fld);\r\n call logical_Load(inout r, core_state, mems.gc, x, y);\r\n}\r\n\r\nimplementation gcStoreField(x:opn_mem, y:opn, ptr:int, fld:int, abs:int)\r\n{\r\n call reveal_MemInvDetails();\r\n assert TVL($toAbs[ptr]);\r\n assert TV(Eval(r, y)) && TV(ptr);\r\n assert TO(fld);\r\n call logical_Store(r, core_state, inout mems.gc, x, y);\r\n $absMem := $absMem[$toAbs[ptr] := $absMem[$toAbs[ptr]][fld := abs]];\r\n}\r\n\r\nimplementation gcLoadStack(x:int, y:opn_mem, ptr:int)\r\n{\r\n call reveal_MemInvDetails();\r\n assert TStk($S) && TV(ptr);\r\n call logical_Load(inout r, core_state, mems.frm, x, y);\r\n}\r\n\r\nimplementation gcStoreStack(x:opn_mem, y:opn, ptr:int, abs:int)\r\n{\r\n call reveal_MemInvDetails();\r\n assert TStk($S) && TV(ptr);\r\n call logical_Store(r, core_state, inout mems.frm, x, y);\r\n $fMems[$S][ptr] := Eval(r, y);\r\n $stacksFrames := $stacksFrames[$S := Frames($stacksFrames[$S].Abss[ptr := abs])];\r\n}\r\n\r\nimplementation AllocObject($abs:int, $numWords:int, $numPrimitiveWords:int)\r\n{\r\n assert TV(esp) && TO(0) && TO(1) && TO(2) && TO(3);\r\n#ifdef x64\r\n assert TO(4);\r\n#endif\r\n\r\n#ifdef x64\r\n call ecx := Load(stk, esp + 12);\r\n call edx := Load(stk, esp + 16);\r\n#else\r\n call ecx := Load(stk, esp + 8);\r\n call edx := Load(stk, esp + 12);\r\n#endif\r\n\r\n $freshAbs := $abs;\r\n objLayouts[$abs] := ObjLayout($numWords, $numPrimitiveWords);\r\n $absMem[$abs] := (lambda i:int::if i == 0 then $numPrimitiveWords * 4 else if i == 1 then $numWords * 4 else NULL);\r\n\r\n ebx := Fk;\r\n call ebx := AddChecked(ebx, ecx);\r\n\r\n //if (!(Fk + size <= Fl))\r\n if (ebx <= Fl) { goto skip1; }\r\n call GarbageCollect();\r\n //- try one more time\r\n#ifdef x64\r\n call ecx := Load(stk, esp + 12);\r\n call edx := Load(stk, esp + 16);\r\n#else\r\n call ecx := Load(stk, esp + 8);\r\n call edx := Load(stk, esp + 12);\r\n#endif\r\n ebx := Fk;\r\n call ebx := AddChecked(ebx, ecx);\r\n if (ebx <= Fl) { goto skip1; }\r\n eax := 0x5555feed; // out of memory\r\n call debugBreak();\r\n skip1:\r\n\r\n call doAllocObjectCopying(ebp, $abs, $numWords * 4, $numPrimitiveWords * 4);\r\n\r\n#ifdef x64\r\n call Store(inout stk, esp + 8, eax);\r\n#else\r\n call Store(inout stk, esp + 4, eax);\r\n#endif\r\n Return;\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/GC/SimpleCommon.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface SimpleCommon\r\n{\r\n\r\nconst ?GcCommon:int := 20;\r\n\r\n//- Common definitions and procedures shared between garbage collectors.\r\n//- This file is included by the garbage collectors.\r\n\r\n// Imports:\r\n// - Trusted_i.bpl\r\n// - VerifiedBitVectors_i.bpl\r\n\r\n/*****************************************************************************\r\n******************************************************************************\r\n**** VERIFIED\r\n******************************************************************************\r\n*****************************************************************************/\r\n\r\nfunction AlignedHeapAddr(i:int):bool { gcAddr(i) && Aligned(i) }\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- LOCAL REASONING\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//- As a region evolves, it adds new mappings, but each mapping is\r\n//- permanent: RExtend ensures that new mappings do not overwrite old mappings.\r\nfunction RExtend(rOld:[int]int, rNew:[int]int):bool\r\n{\r\n (forall i:int::{rOld[i]}{rNew[i]} rOld[i] != NO_ABS ==> rOld[i] == rNew[i])\r\n}\r\n\r\nfunction AbsMapped(val:int, rev:[int]int, abs:int):bool\r\n{\r\n abs != NO_ABS && abs == rev[val]\r\n}\r\n\r\n// Both the mark-sweep and copying collectors only have two regions at\r\n// any given time.\r\n//var $r1:[int]int;\r\n//var $r2:[int]int;\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- STACKS\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n// TODO: clean up, move to right file\r\n\r\nfunction{:expand true} TStk($s:int) returns(bool) { true } // TODO: expand false\r\n\r\n//var $stackState:[int]StackState;\r\n\r\nvar CurrentStack @ statics;\r\ntype commonVars = commonVars(r1:[int]int, r2:[int]int, stackState:[int]StackState, gcSlice:[int]int);\r\nfunction commonVarsInv(x:commonVars, m:mem):bool\r\n{\r\n m.dom[&CurrentStack]\r\n}\r\n#define $r1 $commonVars.r1\r\n#define $r2 $commonVars.r2\r\n#define $stackState $commonVars.stackState\r\n#define $gcSlice $commonVars.gcSlice\r\n\r\natomic procedure initCommon();\r\n inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $toAbs:[int]int;\r\n requires (forall i:int::{statics.dom[i]} memAddr(i) && !memAddrMain(i) ==> statics.dom[i]);\r\n modifies $commonVars;\r\n ensures commonVarsInv($commonVars, statics);\r\n\r\nfunction StackTag(s:int, tMems:[int][int]int) returns(int) { tMems[s][?tLo + s * ?TSize + 0] }\r\nfunction StackEsp(s:int, tMems:[int][int]int) returns(int) { tMems[s][?tLo + s * ?TSize + 4] }\r\nfunction StackEbp(s:int, tMems:[int][int]int) returns(int) { tMems[s][?tLo + s * ?TSize + 8] }\r\nfunction StackEax(s:int, tMems:[int][int]int) returns(int) { tMems[s][?tLo + s * ?TSize + 12] }\r\nfunction StackEbx(s:int, tMems:[int][int]int) returns(int) { tMems[s][?tLo + s * ?TSize + 16] }\r\nfunction StackEcx(s:int, tMems:[int][int]int) returns(int) { tMems[s][?tLo + s * ?TSize + 20] }\r\nfunction StackEdx(s:int, tMems:[int][int]int) returns(int) { tMems[s][?tLo + s * ?TSize + 24] }\r\nfunction StackEsi(s:int, tMems:[int][int]int) returns(int) { tMems[s][?tLo + s * ?TSize + 28] }\r\nfunction StackEdi(s:int, tMems:[int][int]int) returns(int) { tMems[s][?tLo + s * ?TSize + 32] }\r\nfunction StackRA(s:int, tMems:[int][int]int, fMems:[int][int]int) returns(int) { fMems[s][StackEsp(s, tMems)] }\r\nfunction StackCS(s:int, tMems:[int][int]int, fMems:[int][int]int) returns(int) { fMems[s][StackEsp(s, tMems) + 4] }\r\nfunction StackEfl(s:int, tMems:[int][int]int, fMems:[int][int]int) returns(int) { fMems[s][StackEsp(s, tMems) + 8] }\r\n\r\nfunction IsEmpty($state:StackState) returns(bool)\r\n{\r\n StackStateTag($state) == ?STACK_EMPTY\r\n}\r\n\r\nfunction IsYielded($state:StackState) returns(bool)\r\n{\r\n StackStateTag($state) == ?STACK_YIELDED\r\n}\r\n\r\nfunction IsInterrupted($state:StackState) returns(bool)\r\n{\r\n StackStateTag($state) == ?STACK_INTERRUPTED\r\n}\r\n\r\nfunction MutatorStackInv(objLayouts:[int]ObjLayout, $s:int, r:[int]int, $Frames:Frames, $fMem:[int]int) returns(bool)\r\n{\r\n (forall i:int::{TV(i)} TV(i) ==> StackLo($s) <= i && i < StackHi($s) && Aligned(i) ==>\r\n Value(objLayouts, true, r, $fMem[i], $Frames.Abss[i])\r\n )\r\n}\r\n\r\nfunction GcStackInv(objLayouts:[int]ObjLayout, $s:int, r:[int]int, $Frames:Frames, $fMem:[int]int) returns(bool)\r\n{\r\n StackInv($Frames)\r\n && MutatorStackInv(objLayouts, $s, r, $Frames, $fMem)\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- OBJECTS\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//- Each object occupies a \"slice\" of the heap. If an object occupies\r\n//- addresses i + 0 ... i + m, then slice[i + 0] == i && ... && slice[i + m] == i.\r\n//- This helps distinguish addresses that belong to different objects.\r\n//var $gcSlice:[int]int;\r\n\r\n// REVIEW: cut $toAbs here?\r\nfunction ObjInvBase(objLayouts:[int]ObjLayout, i:int, rs:[int]int, $toAbs:[int]int,\r\n $absMem:[int][int]int, gcMem:mem, gcSlice:[int]int):bool\r\n{\r\n gcAddr(i) && rs[i] != NO_ABS ==>\r\n Aligned(i)\r\n && AlignedHeapAddr(i + 4) // REVIEW: this is convenient, but is it necessary?\r\n && VTable(objLayouts, rs[i], $absMem[rs[i]][1])\r\n && !VFieldPtr(objLayouts, rs[i], 1) // REVIEW: necessary?\r\n && numFields(objLayouts, rs[i]) >= 2 // REVIEW: necessary?\r\n && ObjSize(objLayouts, rs[i], $absMem[rs[i]][1], $absMem[rs[i]][0])\r\n && gcSlice[i] == i\r\n && gcSlice[i + 4] == i // REVIEW: this is convenient, but is it necessary?\r\n}\r\n\r\nfunction ObjInvField(objLayouts:[int]ObjLayout, i:int, j:int, rs:[int]int, rt:[int]int, $toAbs:[int]int,\r\n $absMem:[int][int]int, gcMem:mem, gcSlice:[int]int):bool\r\n{\r\n gcAddr(i) && rs[i] != NO_ABS ==>\r\n gcAddr(i + 4 * j) // REVIEW: necessary?\r\n && gcSlice[i + 4 * j] == i\r\n && Value(objLayouts, VFieldPtr(objLayouts, rs[i], j), rt, gcMem[i + 4 * j], $absMem[$toAbs[i]][j])\r\n}\r\n\r\nfunction ObjInvPartial(objLayouts:[int]ObjLayout, i:int, j1:int, j2:int, rs:[int]int, rt:[int]int, $toAbs:[int]int,\r\n $absMem:[int][int]int, gcMem:mem, gcSlice:[int]int):bool\r\n{\r\n ObjInvBase(objLayouts, i, rs, $toAbs, $absMem, gcMem, gcSlice)\r\n && (forall j:int::{TO(j)} TO(j) ==> j1 <= j && j < j2 ==>\r\n ObjInvField(objLayouts, i, j, rs, rt, $toAbs, $absMem, gcMem, gcSlice))\r\n}\r\n\r\nfunction ObjInv(objLayouts:[int]ObjLayout, i:int, rs:[int]int, rt:[int]int, $toAbs:[int]int, $absMem:[int][int]int,\r\n gcMem:mem, gcSlice:[int]int) returns (bool)\r\n{\r\n ObjInvPartial(objLayouts, i, 0, numFields(objLayouts, rs[i]), rs, rt, $toAbs, $absMem, gcMem, gcSlice)\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- STATE\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nfunction IoInv(DECL_IoVars, pciMem:mem):bool; // { true }\r\n\r\n//function IoInv_Transparent(DECL_IoVars, pciMem:mem):bool\r\n//{\r\n//true\r\n//}\r\nfunction IoInv_Transparent(DECL_IoVars, pciMem:mem):bool\r\n{\r\n //- Serial port has been initialized\r\n serialPortConfigged()\r\n //- We have enough device memory for the network driver\r\n && ?devMemHi - ?devMemLo > 0x204004 \r\n// && ?memHi == ?devMemLo\r\n// && ?memHi == ?memLo + 0x7400\r\n && ?devMemLo mod 0x10000 == 0 \r\n &&\r\n //- We properly maintain records of previously mapped devices\r\n //- as tuples of (id, addr, size) in the pciLo to pciHi region\r\n //- We use 16, so that it divides the size (1024) of PCI memory nicely\r\n (forall addr:int, j:int::{pciMem[addr],TV(j)} TV(j) && 0 <= j &&\r\n addr == ?pciLo + 16*j && addr <= ?pciHi - 16 ==>\r\n// pciMem[addr] == 0xffffffff)\r\n// //(IsValidPciId(pciMem[addr]) ==> false ))\r\n (IsValidPciId(pciMem[addr]) ==> \r\n pciMem[addr + 4] == PciMemAddr(pciMem[addr]) \r\n && pciMem[addr + 8] == PciMemSize(pciMem[addr])\r\n && word(PciMemAddr(pciMem[addr]))\r\n && word(PciMemSize(pciMem[addr]))\r\n && SafePciMemRegion(PciMemAddr(pciMem[addr]), PciMemSize(pciMem[addr]))\r\n && io._pci.PciConfigState[pciMem[addr]] == 4 ))\r\n &&\r\n (forall i:int::{io._pci.PciConfigState[i]}\r\n 0 <= i && i < 65536\r\n && (forall addr:int, j:int::{pciMem[addr],TV(j)}\r\n TV(j) && 0 <= j && addr == ?pciLo + 16*j && addr <= ?pciHi - 16 \r\n ==> pciMem[addr] != i)\r\n ==> io._pci.PciConfigState[i] == 0)\r\n\r\n// !(exists j:int :: {TV(j)} TV(j) && pciMem[?pciLo + 16*j] == i)\r\n// ==> io._pci.PciConfigState[i] == 0)\r\n\r\n// (forall i:int::{io._pci.PciConfigState[i]}\r\n// 0 <= i && i < 65536 ==>\r\n// io._pci.PciConfigState[i] == 0 \r\n//// || io._pci.PciConfigState[i] == 4)\r\n////// (forall i:int::{TV(i)} TV(i) ==>\r\n////// 0 <= i && i < 65536 ==>\r\n////// (io._pci.PciConfigState[i] == 0))\r\n// || (exists j:int :: {TV(j)} TV(j) && \r\n// pciMem[?pciLo + 12*j] == i &&\r\n// pciMem[?pciLo + 12*j + 4] == PciMemAddr(i) &&\r\n// pciMem[?pciLo + 12*j + 8] == PciMemSize(i) &&\r\n// SafePciMemRegion(PciMemAddr(i), PciMemSize(i)) &&\r\n// io._pci.PciConfigState[i] == 4 ))\r\n//// )\r\n \r\n// ((DmaAddr == 0 && !io._iom.IoMmuEnabled) || (DmaAddr == ?dmaLo && io._iom.IoMmuEnabled))\r\n// && ?dmaLo > 8 && word(?dmaLo - 8)\r\n// && (forall i:int::{TV(i)} TV(i) ==>\r\n// 0 <= i && i < 65536 ==>\r\n// (pciMem[?pciLo + 8 * i] == 0 && io._pci.PciConfigState[i] == 0)\r\n// || (pciMem[?pciLo + 8 * i] != 0 && io._pci.PciConfigState[i] == 4\r\n// && PciMemAddr(i) == pciMem[?pciLo + 8 * i]\r\n// && PciMemSize(i) == pciMem[?pciLo + 8 * i + 4]))\r\n}\r\n\r\natomic ghost procedure reveal_IoInv();\r\n ensures (forall io:IOState, pciMem:mem::{IoInv(io, pciMem)}\r\n IoInv(io, pciMem) <==> IoInv_Transparent(io, pciMem));\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/GC/SimpleCommon.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation SimpleCommon\r\n{\r\n\r\nimplementation initCommon()\r\n{\r\n}\r\n\r\nfunction implementation IoInv(DECL_IoVars, pciMem:mem):bool { IoInv_Transparent(io, pciMem) }\r\nimplementation reveal_IoInv() {}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/GC/SimpleGc.ifc.beat", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/GC/SimpleGcMemory.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface GcMemory\r\n{\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- ABSTRACT NODES\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//- The mutator controls an abstract graph consisting of abstract nodes,\r\n//- which contain abstract values. These abstract values may be\r\n//- abstract primitive values or abstract edges pointing to abstract nodes.\r\n\r\n//- Abstract values are represented by integers. For any integer A,\r\n//- we may interpret A as an abstract primitive value or an abstract pointer:\r\n//- - the abstract primitive value A represents the concrete integer A\r\n//- - the abstract pointer A may be one of the following:\r\n//- - NO_ABS, representing no value (used for partial maps)\r\n//- - any other value, representing a node in the abstract graph\r\n//- Any primitive value A will satisfy word(A). To avoid confusion\r\n//- between abstract primitive and abstract pointer values, the\r\n//- mutator should choose abstract pointer values A such that !word(A).\r\n\r\nconst NO_ABS:int := 0 - 1; //- the value \"none\"\r\n\r\n//- Each abstract object node A has some number of fields,\r\n//- which is chosen when A is allocated, and never changes afterwards.\r\ntype ObjLayout = ObjLayout(numFields:int, numPrimitiveFields:int) | NoObjLayout();\r\nfunction numFields(objLayouts:[int]ObjLayout, abs:int) returns (int) { objLayouts[abs].numFields }\r\nfunction numPrimitiveFields(objLayouts:[int]ObjLayout, abs:int) returns (int) { objLayouts[abs].numPrimitiveFields }\r\n\r\n// $absMem represents of the abstract graph's edges: for abstract node A\r\n// and field j, $absMem[A][j] is the abstract node pointed to by A's field j.\r\n//var $absMem:[int][int]int;\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- POINTERS AND VALUES\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nfunction Pointer(rev:[int]int, ptr:int, abs:int) returns (bool)\r\n{\r\n gcAddr(ptr) \r\n&& Aligned(ptr) \r\n&& abs != NO_ABS \r\n&& rev[ptr] == abs //- AbsMapped(ptr,rev,abs)\r\n}\r\n\r\n//- An interior pointer (\"interiorPtr\") points to an actual\r\n//- object address (\"ptr\") plus some offset (\"offset\"):\r\n//- !nullAddr(interiorPtr) ==> interiorPtr == ptr + offset && 0 <= offset && offset <= 4 * numFields(objLayouts, $toAbs[ptr - 4]) - 4;\r\nfunction InteriorValue(objLayouts:[int]ObjLayout, isPtr:bool, rev:[int]int, val:int, abs:int, offset:int) returns (bool)\r\n{\r\n (isPtr && word(val) && gcAddrEx(val) && Pointer(rev, val - 4 - offset, abs)\r\n && !word(abs)\r\n && 0 <= offset && offset <= 4 * numFields(objLayouts, abs) - 4)\r\n || (isPtr && word(val) && !gcAddrEx(val) && abs == val)\r\n || (!isPtr && word(val) && abs == val)\r\n}\r\n\r\nfunction Value(objLayouts:[int]ObjLayout, isPtr:bool, rev:[int]int, val:int, abs:int) returns (bool)\r\n{\r\n InteriorValue(objLayouts, isPtr, rev, val, abs, 0)\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- ABSTRACT AND CONCRETE GRAPHS\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//- Each integer i is considered a concrete node.\r\n//- The memory manager controls concrete nodes in memory. \r\n//- - Each abstract object node is either mapped to one concrete node or is unmapped\r\n//- - Each concrete node is either mapped to one abstract object node or is unmapped\r\n//- - If abstract object node A is mapped to concrete node C, then C is mapped to A\r\n//- Let the notation C<-->A indicate that A is mapped to C and C is mapped to A.\r\n//- Let the notation C-->none indicate that C is unmapped.\r\n//- Let the notation A-->none indicate that A is unmapped.\r\n\r\n//- The variable $toAbs maps concrete nodes to abstract nodes, and thereby\r\n//- exactly describes all C<-->A and C-->none. The A-->none mappings are\r\n//- implied; if there is no C such that C<-->A, then A-->none.\r\n//-var $toAbs:[int]int; // maps a concrete node C to an abstract node A or to \"none\"\r\n\r\n//- WellFormed($toAbs) ensures that if C1 != C2 and $toAbs[C1] != NO_ABS\r\n//- and $toAbs[C2] != NO_ABS then $toAbs[C1] != $toAbs[C2].\r\nfunction WellFormed($toAbs:[int]int) returns(bool)\r\n{\r\n (forall i1:int, i2:int::{TV(i1), TV(i2)} TV(i1) && TV(i2)\r\n && gcAddr(i1) && gcAddr(i2) && i1 != i2 && $toAbs[i1] != NO_ABS && $toAbs[i2] != NO_ABS\r\n ==> $toAbs[i1] != $toAbs[i2])\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- TRIGGERS\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//- TSlot is a trigger for slots in sparse tags\r\nfunction{:expand false} TSlot(slot:int) returns (bool) { true }\r\n\r\n//- TT is a trigger for tables\r\nfunction{:expand false} TT(table:int) returns (bool) { true }\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- MUTATOR INTERFACE\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nfunction isReadonlyField(t:int, j:int) returns(bool)\r\n{\r\n 0 <= j && j < 2\r\n}\r\n\r\n//- true ==> field j is pointer\r\n//- false ==> field j is primitive\r\nfunction VFieldPtr(objLayouts:[int]ObjLayout, abs:int, f:int) returns(bool)\r\n{\r\n !(0 <= f && f < objLayouts[abs].numPrimitiveFields)\r\n}\r\n\r\nfunction{:expand false} TVT(abs:int, vt:int) returns(bool) { true }\r\nfunction VTable(objLayouts:[int]ObjLayout, abs:int, vt:int) returns(bool)\r\n{\r\n !VFieldPtr(objLayouts, abs, 0) // REVIEW: is this redundant?\r\n && !VFieldPtr(objLayouts, abs, 1) // REVIEW: is this redundant?\r\n && (forall j:int::{TO(j)} TO(j) ==> (0 <= j && j < numPrimitiveFields(objLayouts, abs) <==> !VFieldPtr(objLayouts, abs, j)))\r\n}\r\n\r\nfunction pad(i:int) returns(int)\r\n{\r\n and(i + 3, neg(3))\r\n}\r\n\r\nfunction{:expand false} TVL(abs:int) returns(bool) { true }\r\nfunction ObjSize(objLayouts:[int]ObjLayout, abs:int, size:int, sizePrimitives:int) returns(bool)\r\n{\r\n 2 <= numPrimitiveFields(objLayouts, abs) && numPrimitiveFields(objLayouts, abs) <= numFields(objLayouts, abs)\r\n && 4 * numFields(objLayouts, abs) == size\r\n && 4 * numPrimitiveFields(objLayouts, abs) == sizePrimitives\r\n}\r\n\r\ntype Frames=Frames(Abss:[int]int);\r\n\r\n//var $stacksFrames:[int]Frames;\r\n\r\nfunction{:expand false} TVS(s:int, j:int) returns(bool) { true }\r\nfunction{:expand false} TVFT(f:int) returns(bool) { true }\r\n\r\nfunction StackInv($frames:Frames) returns(bool) { true }\r\n\r\n//- Each managed stack $s grows from StackHi($s) down to StackLo($s)\r\nfunction StackHi($s:int):int { ?fLo + $s * ?FSize + ?FSize }\r\nfunction StackLo($s:int):int { ?fLo + $s * ?FSize }\r\n\r\nconst ?fWords:int := ?FSize div 4;\r\n\r\n//- Requirement on entry to Nucleus from managed call:\r\n//- Since interrupts are disabled when calling the Nucleus, we do not\r\n//- require ?InterruptReserve be reserved between StackLo and esp.\r\nfunction SpRequire($s:int, sp:int, n:int) returns(bool)\r\n{\r\n StackLo($s) <= sp && sp + n <= StackHi($s) && Aligned(sp)\r\n}\r\n\r\nfunction StackCheckInv($s:int, $StackCheck:int) returns(bool)\r\n{\r\n StackLo($s) + ?StackReserve + ?InterruptReserve <= $StackCheck\r\n && $StackCheck <= StackHi($s)\r\n}\r\n\r\nfunction ScanStackInv($S:int, $Mem:[int]int,\r\n $stacksFrames:[int]Frames,\r\n $ra:int, $esp:int, $ebp:int) returns(bool)\r\n{\r\n StackInv($stacksFrames[$S])\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- REACHABILITY\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//- Extra internal sanity checking for GC: check that any uncollected objects\r\n//- were actually reached during the collection.\r\n\r\ntype Time;\r\nreadonly var $Time:Time;\r\n\r\n//- reached(A,T) means that the GC has reached abstract node A at some time\r\n//- after the initial time T. Initially (at time T), the mutator will\r\n//- say that reached(root, T). After that, the GC calls the \"reach\"\r\n//- ghost procedure to generate reached(A, T) for other A.\r\nfunction reached(a:int, t:Time) returns (bool);\r\n\r\natomic ghost procedure newTime();\r\n modifies $Time;\r\n\r\natomic ghost procedure reachStackRoot($s:int, $ptr:int, $t:Time);\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames;\r\n requires StackLo($s) <= $ptr && $ptr < StackHi($s);\r\n requires Aligned($ptr);\r\n ensures reached($stacksFrames[$s].Abss[$ptr], $t);\r\n\r\n//- If we've reached A, and A points to A', then reach A'.\r\natomic ghost procedure reach($a:int, $j:int, $t:Time);\r\n inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames;\r\n requires reached($a, $t);\r\n requires $absMem[$a][$j] != NO_ABS;\r\n ensures reached($absMem[$a][$j], $t);\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/GC/SimpleGcMemory.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation GcMemory\r\n{\r\n\r\nfunction implementation reached(a:int, t:Time):bool { true }\r\n\r\nimplementation newTime() {}\r\nimplementation reachStackRoot($s:int, $j:int, $t:Time) {}\r\nimplementation reach($a:int, $j:int, $t:Time) {}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/BitVectorLemmasMain.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface BitVectorLemmasMain\r\n{\r\n\r\natomic ghost procedure _const();\r\n ensures $sub(1bv32, 1bv32) == 0bv32;\r\n ensures $add(1bv32, 1bv32) == 2bv32;\r\n ensures $mul(2bv32, 2bv32) == 4bv32;\r\n ensures $mul(4bv32, 4bv32) == 16bv32;\r\n ensures $add(16bv32, 16bv32) == 32bv32;\r\n ensures $add(32bv32, 32bv32) == 64bv32;\r\n ensures $mul(16bv32, 16bv32) == 256bv32;\r\n ensures $sub(256bv32, 1bv32) == 255bv32;\r\n ensures $mul(256bv32, 256bv32) == 65536bv32;\r\n ensures $sub(65536bv32, 1bv32) == 65535bv32;\r\n\r\natomic ghost procedure _proc_XorLemmas();\r\n ensures (forall x:bv32::$xor(x, x) == 0bv32);\r\n ensures (forall x:bv32::$xor(x, 0bv32) == x);\r\n ensures (forall x:bv32, y:bv32::$xor(x, y) == $xor(y, x));\r\n ensures (forall x:bv32, y:bv32, z:bv32:: $xor(x, $xor(y,z)) == $xor(y, $xor(x,z)));\r\n ensures (forall x:bv32, y:bv32, z:bv32:: ($xor(x,z) == $xor(y,z)) ==> (x == y));\r\n\r\natomic ghost procedure _lemma_and_with_ff(x:bv32);\r\n ensures $le(0bv32, $and(x, 255bv32)) && $lt($and(x, 255bv32), 256bv32);\r\n\r\natomic ghost procedure _lemma_and_with_ffff(x:bv32);\r\n ensures $le(0bv32, $and(x, 65535bv32)) && $lt($and(x, 65535bv32), 65536bv32);\r\n\r\natomic ghost procedure _lemma_and_with_32_64(x:bv32);\r\n ensures $gt($and(x, 32bv32), 0bv32) ==> \r\n $mod($div($div($div($div($div(x, 2bv32), 2bv32), 2bv32), 2bv32), 2bv32), 2bv32) != 0bv32; //int_bit(x, 5) == 1;\r\n ensures $gt($and(x, 64bv32), 0bv32) ==> \r\n $mod($div($div($div($div($div($div(x, 2bv32), 2bv32), 2bv32), 2bv32), 2bv32), 2bv32), 2bv32) != 0bv32; //int_bit(x, 6) == 1;\r\n\r\natomic ghost procedure _lemma_xor_bytes(x:bv32, y:bv32);\r\n requires $le(0bv32, x);\r\n requires $lt(x, 256bv32);\r\n requires $le(0bv32, y);\r\n requires $lt(y, 256bv32);\r\n ensures $le(0bv32, $xor(x, y));\r\n ensures $lt($xor(x, y), 256bv32);\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/BitVectorLemmasMain.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation BitVectorLemmasMain\r\n{\r\n\r\nimplementation _const() {}\r\nimplementation _proc_XorLemmas() {}\r\nimplementation _lemma_and_with_ff(x:bv32) {}\r\nimplementation _lemma_and_with_ffff(x:bv32) {}\r\nimplementation _lemma_and_with_32_64(x:bv32) {}\r\nimplementation _lemma_xor_bytes(x:bv32, y:bv32) { }\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/Cube.ifc.beat", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface Cube\r\n{\r\n\r\ntype Tri = Triple(Pwd:int, Salt:int, Key:int);\r\ntype Map = MapCons(Domain:[Tri]bool, Range:[Tri]int);\r\nvar $ghost_Hashed:Map;\r\nconst stack_size__DafnyCC__Proc_Cube:int := 256 + 64;\r\n\r\nprocedure Proc_Cube(core_old:core_state, my_part__DafnyCC__old:partition, my__DafnyCC__mem_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_N:int)\r\n returns(core:core_state, my_part:partition, my__DafnyCC__mem:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_c:int);\r\n requires MemInv(me,init,$State,core_old,ptOwner__id,(mem.map),$part,my_part__DafnyCC__old,$mem__id,$sepVars__id,my__DafnyCC__mem_old,$sepVars);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars__id,$gcVars__id,$ioVars__id,$commonVars_old,$gcVars_old,me,init,$State,core_old,ptOwner__id,(mem.map),$part,my_part__DafnyCC__old,$mem__id,$sepVars__id,my__DafnyCC__mem_old,$sepVars,$stacksFrames_old,state._io,$ioVars);\r\n requires SMemRequireGcRA(stack_size__DafnyCC__Proc_Cube, 8, mems__stk(my__DafnyCC__mem_old), (core_old._regs)[ESP], RET);\r\n requires HeapInv($absMem_old, objLayouts_old, heap_old);\r\n// requires $serialState.Mode.DLAB == false;\r\n// requires (core_old._regs)[ECX] == $ghost_N;\r\n requires sMemGet(mems__stk(my__DafnyCC__mem_old), core_old._regs[ESP] + 8) == $ghost_N;\r\n requires 0 <= $ghost_N;\r\n modifies state, efl, $part, $sepVars, $Time; //, $global_sample_index, $ghost_Hashed;\r\n ensures core._regs[ESP] == old(core_old._regs[ESP]) + 4;\r\n// ensures $serialState.Mode == old($serialState.Mode);\r\n ensures MemInv(me,init,state,core_state,ptOwner__id,(mem.map),$part,my_part,$mem__id,$sepVars__id,my__DafnyCC__mem,$sepVars);\r\n ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars__id,$gcVars__id,$ioVars__id,$commonVars,$gcVars,me,init,$State,core,ptOwner__id,(mem.map),$part,my_part,$mem__id,$sepVars__id,my__DafnyCC__mem,$sepVars,$stacksFrames,state._io,$ioVars);\r\n ensures SMemEnsureGcF(8, mems__stk(my__DafnyCC__mem), old(mems__stk(my__DafnyCC__mem_old)), esp, old((core_old._regs)[ESP]), $stacksFrames, $stacksFrames_old);\r\n ensures HeapInv($absMem, objLayouts, heap);\r\n ensures AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n ensures $ghost_c == (($ghost_N * $ghost_N) * $ghost_N);\r\n// ensures eax == $ghost_c;\r\n ensures sMemGet(mems__stk(my__DafnyCC__mem), core_old._regs[ESP] + 4) == $ghost_c;\r\n\r\n//const stack_size__DafnyCC__Proc_XorIdentity:int := 0 + 0;\r\n//\r\n//procedure Proc_XorIdentity(core_old:core_state, my_part__DafnyCC__old:partition, my__DafnyCC__mem_old:mems, $ghost_a:int) returns(core:core_state, my_part:partition, my__DafnyCC__mem:mems, $ghost_r:int);\r\n// requires MemInv(me,init,$State,core_old,ptOwner__id,(mem.map),$part,my_part__DafnyCC__old,$mem__id,$sepVars__id,my__DafnyCC__mem_old,$sepVars);\r\n// requires SMemRequireRA(stack_size__DafnyCC__Proc_XorIdentity, mems__stk(my__DafnyCC__mem_old), (core_old._regs)[ESP], RET);\r\n//// requires $serialState.Mode.DLAB == false;\r\n// requires (core_old._regs)[ECX] == $ghost_a;\r\n// requires word($ghost_a);\r\n// modifies state, efl, $part, $serialState; //, $global_sample_index, $ghost_Hashed;\r\n// ensures esp == old((core_old._regs)[ESP])+4;\r\n// ensures $serialState.Mode == old($serialState.Mode);\r\n// ensures MemInv(me,init,state,core_state,ptOwner__id,(mem.map),$part,my_part,$mem__id,$sepVars__id,my__DafnyCC__mem,$sepVars);\r\n// ensures SMemEnsure(mems__stk(my__DafnyCC__mem), old(mems__stk(my__DafnyCC__mem_old)), esp, old((core_old._regs)[ESP]));\r\n// ensures $ghost_r == $ghost_a;\r\n// ensures eax == $ghost_r;\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/DafnyAssembly.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-private-import IoMain;\r\n//-private-import IntLemmasMain;\r\n//-private-basmonly-import Trusted;\r\n//-private-basmonly-import Checked;\r\n//-private-import Heap;\r\n//-private-import Seq;\r\n//-private-import dafny_DafnyPrelude;\r\nmodule interface DafnyAssembly\r\n{\r\n\r\n//- Connect Dafny's word32() to Boogie's word()\r\nfunction fun_word32($ghost_x:int):bool \r\n{\r\n word($ghost_x)\r\n}\r\n\r\nfunction fun_mod0x100000000($ghost_x:int):int\r\n{\r\n $ghost_x mod 0x100000000\r\n}\r\n\r\nfunction fun_asm__Add($ghost_x:int, $ghost_y:int):int\r\n{\r\n fun_mod0x100000000(INTERNAL_add_boogie($ghost_x, $ghost_y))\r\n}\r\n\r\nfunction fun_asm__Sub($ghost_x:int, $ghost_y:int):int\r\n{\r\n fun_mod0x100000000(INTERNAL_sub_boogie($ghost_x, $ghost_y))\r\n}\r\n\r\nfunction fun_asm__Mul($ghost_x:int, $ghost_y:int):int\r\n{\r\n fun_mod0x100000000(fun_INTERNAL__mul($ghost_x, $ghost_y))\r\n}\r\n\r\nfunction fun_asm__Div($ghost_x:int, $ghost_y:int):int\r\n{\r\n fun_mod0x100000000(fun_INTERNAL__div($ghost_x, $ghost_y))\r\n}\r\n\r\nfunction fun_asm__Mod($ghost_x:int, $ghost_y:int):int\r\n{\r\n fun_INTERNAL__mod($ghost_x, $ghost_y)\r\n}\r\n\r\nfunction fun_asm__LeftShift($ghost_x:int, $ghost_y:int):int\r\n{\r\n shl($ghost_x, $ghost_y)\r\n}\r\n\r\nfunction fun_asm__RightShift($ghost_x:int, $ghost_y:int):int\r\n{\r\n shr($ghost_x, $ghost_y)\r\n}\r\n\r\nfunction fun_asm__RotateLeft($ghost_x:int, $ghost_y:int):int\r\n{\r\n rol($ghost_x, $ghost_y)\r\n}\r\n\r\nfunction fun_asm__RotateRight($ghost_x:int, $ghost_y:int):int\r\n{\r\n ror($ghost_x, $ghost_y)\r\n}\r\n\r\nfunction fun_asm__BitwiseNot($ghost_x:int):int\r\n{\r\n neg($ghost_x)\r\n}\r\n\r\nfunction fun_asm__BitwiseAnd($ghost_x:int, $ghost_y:int):int\r\n{\r\n and($ghost_x, $ghost_y)\r\n}\r\n\r\nfunction fun_asm__BitwiseOr($ghost_x:int, $ghost_y:int):int\r\n{\r\n or($ghost_x, $ghost_y)\r\n}\r\n\r\nfunction fun_asm__BitwiseXor($ghost_x:int, $ghost_y:int):int\r\n{\r\n xor($ghost_x, $ghost_y)\r\n}\r\n\r\nfunction fun_IntBit($ghost_index:int, $ghost_val:int):bool\r\n{\r\n int_bit($ghost_val, 31 - $ghost_index) //- IntBit is big endian, int_bit is little endian\r\n}\r\n\r\nfunction trigger_fun_asm__Add($ghost_x:int, $ghost_y:int):bool { true }\r\natomic ghost procedure lemma_fun_ensures_fun_asm__Add();\r\n ensures (forall $ghost_x:int, $ghost_y:int::{fun_asm__Add($ghost_x, $ghost_y)}{trigger_fun_asm__Add($ghost_x, $ghost_y)}trigger_fun_asm__Add($ghost_x, $ghost_y) ==> (true && (fun_word32($ghost_x)) && (fun_word32($ghost_y))) ==> (true && (fun_word32(fun_asm__Add($ghost_x, $ghost_y))) && ((fun_asm__Add($ghost_x, $ghost_y)) == (fun_mod0x100000000(INTERNAL_add_boogie($ghost_x, $ghost_y))))));\r\natomic procedure proc_asm__Add(my r_old:regs, $ghost_x:int, $ghost_y:int, $opn_x:int, $opn_y:opn) returns(my r:regs, $ghost___result:int);\r\n requires $ghost_x == r_old.regs[$opn_x];\r\n requires $ghost_y == Eval(r_old, $opn_y);\r\n requires fun_word32($ghost_x);\r\n requires fun_word32($ghost_y);\r\n ensures $ghost___result == (fun_asm__Add($ghost_x, $ghost_y));\r\n ensures fun_word32(fun_asm__Add($ghost_x, $ghost_y));\r\n ensures (fun_asm__Add($ghost_x, $ghost_y)) == (fun_mod0x100000000(INTERNAL_add_boogie($ghost_x, $ghost_y)));\r\n ensures r.regs == r_old.regs[$opn_x := $ghost___result];\r\nfunction trigger_fun_asm__Sub($ghost_x:int, $ghost_y:int):bool { true }\r\natomic ghost procedure lemma_fun_ensures_fun_asm__Sub();\r\n ensures (forall $ghost_x:int, $ghost_y:int::{fun_asm__Sub($ghost_x, $ghost_y)}{trigger_fun_asm__Sub($ghost_x, $ghost_y)}trigger_fun_asm__Sub($ghost_x, $ghost_y) ==> (true && (fun_word32($ghost_x)) && (fun_word32($ghost_y))) ==> (true && (fun_word32(fun_asm__Sub($ghost_x, $ghost_y))) && ((fun_asm__Sub($ghost_x, $ghost_y)) == (fun_mod0x100000000(INTERNAL_sub_boogie($ghost_x, $ghost_y))))));\r\natomic procedure proc_asm__Sub(my r_old:regs, $ghost_x:int, $ghost_y:int, $opn_x:int, $opn_y:opn) returns(my r:regs, $ghost___result:int);\r\n requires $ghost_x == r_old.regs[$opn_x];\r\n requires $ghost_y == Eval(r_old, $opn_y);\r\n requires fun_word32($ghost_x);\r\n requires fun_word32($ghost_y);\r\n ensures $ghost___result == (fun_asm__Sub($ghost_x, $ghost_y));\r\n ensures fun_word32(fun_asm__Sub($ghost_x, $ghost_y));\r\n ensures (fun_asm__Sub($ghost_x, $ghost_y)) == (fun_mod0x100000000(INTERNAL_sub_boogie($ghost_x, $ghost_y)));\r\n ensures r.regs == r_old.regs[$opn_x := $ghost___result];\r\nfunction trigger_fun_asm__Mul($ghost_x:int, $ghost_y:int):bool { true }\r\natomic ghost procedure lemma_fun_ensures_fun_asm__Mul();\r\n ensures (forall $ghost_x:int, $ghost_y:int::{fun_asm__Mul($ghost_x, $ghost_y)}{trigger_fun_asm__Mul($ghost_x, $ghost_y)}trigger_fun_asm__Mul($ghost_x, $ghost_y) ==> (true && (fun_word32($ghost_x)) && (fun_word32($ghost_y))) ==> (true && (fun_word32(fun_asm__Mul($ghost_x, $ghost_y))) && ((fun_asm__Mul($ghost_x, $ghost_y)) == (fun_mod0x100000000(fun_INTERNAL__mul($ghost_x, $ghost_y))))));\r\nconst stack_size__DafnyCC__Proc_asm__Mul:int := 0 + 0;\r\nprocedure Proc_asm__Mul(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_x:int, $ghost_y:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost___result:int);\r\n requires MemInv(me,init,stk_old,statics_old,core_state,ptMem,mems_old);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk_old,statics_old,core_state,ptMem,mems_old,$stacksFrames_old,io_old);\r\n requires SMemRequireGcRA(stack_size__DafnyCC__Proc_asm__Mul, 16, stk_old, r_old.regs[ESP], RET);\r\n requires HeapInv($absMem_old, objLayouts_old, heap_old);\r\n requires (($ghost_x) == (stk_old.map[r_old.regs[ESP] + (4 + IPSize)]));\r\n requires (($ghost_y) == (stk_old.map[r_old.regs[ESP] + (8 + IPSize)]));\r\n requires fun_word32($ghost_x);\r\n requires fun_word32($ghost_y);\r\n modifies $Time;\r\n ensures r.regs[ESP] == old(r_old.regs[ESP]) + IPSize;\r\n ensures MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n ensures SMemEnsureGcF(16, stk, old(stk_old), r.regs[ESP], old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n ensures HeapInv($absMem, objLayouts, heap);\r\n ensures AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n ensures io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n ensures (forall i:int::{$absMem[i]}{heap.absData[i]} heap_old.absData[i] is AbsNone || (heap.absData[i] == heap_old.absData[i] && ($absMem[i] == $absMem_old[i])));\r\n ensures $ghost___result == (fun_asm__Mul($ghost_x, $ghost_y));\r\n ensures fun_word32(fun_asm__Mul($ghost_x, $ghost_y));\r\n ensures (fun_asm__Mul($ghost_x, $ghost_y)) == (fun_mod0x100000000(fun_INTERNAL__mul($ghost_x, $ghost_y)));\r\n ensures (($ghost___result) == (stk.map[r_old.regs[ESP] + IPSize]));\r\natomic procedure proc_asm__Mul64(my r_old:regs, $ghost_x:int, $ghost_y:int, $opn_hi:int, $opn_x:int, $opn_y:opn) returns(my r:regs, $ghost_hi:int, $ghost_lo:int);\r\n requires $opn_hi == EDX;\r\n requires $opn_x == EAX;\r\n requires $opn_y != OReg(EDX) && $opn_y != OReg(EAX);\r\n requires $ghost_x == r_old.regs[$opn_x];\r\n requires $ghost_y == Eval(r_old, $opn_y);\r\n requires fun_word32($ghost_x);\r\n requires fun_word32($ghost_y);\r\n ensures fun_word32($ghost_hi);\r\n ensures fun_word32($ghost_lo);\r\n ensures $ghost_lo == (fun_mod0x100000000(fun_INTERNAL__mul($ghost_x, $ghost_y)));\r\n ensures $ghost_hi == (fun_INTERNAL__div(fun_INTERNAL__mul($ghost_x, $ghost_y), 4294967296));\r\n ensures r.regs == r_old.regs[$opn_hi := $ghost_hi][$opn_x := $ghost_lo];\r\nfunction trigger_fun_asm__Div($ghost_x:int, $ghost_y:int):bool { true }\r\natomic ghost procedure lemma_fun_ensures_fun_asm__Div();\r\n ensures (forall $ghost_x:int, $ghost_y:int::{fun_asm__Div($ghost_x, $ghost_y)}{trigger_fun_asm__Div($ghost_x, $ghost_y)}trigger_fun_asm__Div($ghost_x, $ghost_y) ==> (true && (fun_word32($ghost_x)) && (fun_word32($ghost_y)) && (INTERNAL_gt_boogie($ghost_y, 0))) ==> (true && (fun_word32(fun_asm__Div($ghost_x, $ghost_y))) && ((fun_asm__Div($ghost_x, $ghost_y)) == (fun_mod0x100000000(fun_INTERNAL__div($ghost_x, $ghost_y))))));\r\nconst stack_size__DafnyCC__Proc_asm__Div:int := 0 + 0;\r\nprocedure Proc_asm__Div(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_x:int, $ghost_y:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost___result:int);\r\n requires MemInv(me,init,stk_old,statics_old,core_state,ptMem,mems_old);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk_old,statics_old,core_state,ptMem,mems_old,$stacksFrames_old,io_old);\r\n requires SMemRequireGcRA(stack_size__DafnyCC__Proc_asm__Div, 16, stk_old, r_old.regs[ESP], RET);\r\n requires HeapInv($absMem_old, objLayouts_old, heap_old);\r\n requires (($ghost_x) == (stk_old.map[r_old.regs[ESP] + (4 + IPSize)]));\r\n requires (($ghost_y) == (stk_old.map[r_old.regs[ESP] + (8 + IPSize)]));\r\n requires fun_word32($ghost_x);\r\n requires fun_word32($ghost_y);\r\n requires INTERNAL_gt_boogie($ghost_y, 0);\r\n modifies $Time;\r\n ensures r.regs[ESP] == old(r_old.regs[ESP]) + IPSize;\r\n ensures MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n ensures SMemEnsureGcF(12, stk, old(stk_old), r.regs[ESP], old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n ensures HeapInv($absMem, objLayouts, heap);\r\n ensures AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n ensures (forall i:int::{$absMem[i]}{heap.absData[i]} heap_old.absData[i] is AbsNone || (heap.absData[i] == heap_old.absData[i] && ($absMem[i] == $absMem_old[i])));\r\n ensures io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n ensures $ghost___result == (fun_asm__Div($ghost_x, $ghost_y));\r\n ensures fun_word32(fun_asm__Div($ghost_x, $ghost_y));\r\n ensures (fun_asm__Div($ghost_x, $ghost_y)) == (fun_mod0x100000000(fun_INTERNAL__div($ghost_x, $ghost_y)));\r\n ensures (($ghost___result) == (stk.map[r_old.regs[ESP] + IPSize]));\r\nfunction trigger_fun_asm__Mod($ghost_x:int, $ghost_y:int):bool { true }\r\natomic ghost procedure lemma_fun_ensures_fun_asm__Mod();\r\n ensures (forall $ghost_x:int, $ghost_y:int::{fun_asm__Mod($ghost_x, $ghost_y)}{trigger_fun_asm__Mod($ghost_x, $ghost_y)}trigger_fun_asm__Mod($ghost_x, $ghost_y) ==> (true && (fun_word32($ghost_x)) && (fun_word32($ghost_y)) && (INTERNAL_gt_boogie($ghost_y, 0))) ==> (true && (fun_word32(fun_asm__Mod($ghost_x, $ghost_y))) && ((fun_asm__Mod($ghost_x, $ghost_y)) == (fun_INTERNAL__mod($ghost_x, $ghost_y)))));\r\nconst stack_size__DafnyCC__Proc_asm__Mod:int := 0 + 0;\r\nprocedure Proc_asm__Mod(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_x:int, $ghost_y:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost___result:int);\r\n requires MemInv(me,init,stk_old,statics_old,core_state,ptMem,mems_old);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk_old,statics_old,core_state,ptMem,mems_old,$stacksFrames_old,io_old);\r\n requires SMemRequireGcRA(stack_size__DafnyCC__Proc_asm__Mod, 16, stk_old, r_old.regs[ESP], RET);\r\n requires HeapInv($absMem_old, objLayouts_old, heap_old);\r\n requires (($ghost_x) == (stk_old.map[r_old.regs[ESP] + (4 + IPSize)]));\r\n requires (($ghost_y) == (stk_old.map[r_old.regs[ESP] + (8 + IPSize)]));\r\n requires fun_word32($ghost_x);\r\n requires fun_word32($ghost_y);\r\n requires INTERNAL_gt_boogie($ghost_y, 0);\r\n modifies $Time;\r\n ensures r.regs[ESP] == old(r_old.regs[ESP]) + IPSize;\r\n ensures MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n ensures SMemEnsureGcF(16, stk, old(stk_old), r.regs[ESP], old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n ensures HeapInv($absMem, objLayouts, heap);\r\n ensures AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n ensures (forall i:int::{$absMem[i]}{heap.absData[i]} heap_old.absData[i] is AbsNone || (heap.absData[i] == heap_old.absData[i] && ($absMem[i] == $absMem_old[i])));\r\n ensures io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n ensures $ghost___result == (fun_asm__Mod($ghost_x, $ghost_y));\r\n ensures fun_word32(fun_asm__Mod($ghost_x, $ghost_y));\r\n ensures (fun_asm__Mod($ghost_x, $ghost_y)) == (fun_INTERNAL__mod($ghost_x, $ghost_y));\r\n ensures (($ghost___result) == (stk.map[r_old.regs[ESP] + IPSize]));\r\nfunction trigger_fun_asm__LeftShift($ghost_x:int, $ghost_amount:int):bool { true }\r\natomic ghost procedure lemma_fun_ensures_fun_asm__LeftShift();\r\n ensures (forall $ghost_x:int, $ghost_amount:int::{fun_asm__LeftShift($ghost_x, $ghost_amount)}{trigger_fun_asm__LeftShift($ghost_x, $ghost_amount)}trigger_fun_asm__LeftShift($ghost_x, $ghost_amount) ==> (true && (fun_word32($ghost_x)) && ((INTERNAL_le_boogie(0, $ghost_amount)) && (INTERNAL_lt_boogie($ghost_amount, 32)))) ==> (true && (fun_word32(fun_asm__LeftShift($ghost_x, $ghost_amount))) && ((forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__LeftShift($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(INTERNAL_sub_boogie(32, $ghost_amount), $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, 32))) ==> ((fun_IntBit($ghost__0_i, fun_asm__LeftShift($ghost_x, $ghost_amount))) == (false)))) && ((forall $ghost__1_i:int :: {fun_IntBit($ghost__1_i, fun_asm__LeftShift($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, INTERNAL_sub_boogie(32, $ghost_amount)))) ==> ((fun_IntBit($ghost__1_i, fun_asm__LeftShift($ghost_x, $ghost_amount))) == (fun_IntBit(INTERNAL_add_boogie($ghost__1_i, $ghost_amount), $ghost_x)))))));\r\natomic procedure proc_asm__LeftShift(my r_old:regs, $ghost_x:int, $ghost_amount:int, $opn_x:int, $opn_amount:opn) returns(my r:regs, $ghost___result:int);\r\n requires $ghost_x == r_old.regs[$opn_x];\r\n requires $ghost_amount == Eval(r_old, $opn_amount);\r\n requires fun_word32($ghost_x);\r\n requires (INTERNAL_le_boogie(0, $ghost_amount)) && (INTERNAL_lt_boogie($ghost_amount, 32));\r\n ensures $ghost___result == (fun_asm__LeftShift($ghost_x, $ghost_amount));\r\n ensures fun_word32(fun_asm__LeftShift($ghost_x, $ghost_amount));\r\n ensures (forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__LeftShift($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(INTERNAL_sub_boogie(32, $ghost_amount), $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, 32))) ==> ((fun_IntBit($ghost__0_i, fun_asm__LeftShift($ghost_x, $ghost_amount))) == (false)));\r\n ensures (forall $ghost__1_i:int :: {fun_IntBit($ghost__1_i, fun_asm__LeftShift($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, INTERNAL_sub_boogie(32, $ghost_amount)))) ==> ((fun_IntBit($ghost__1_i, fun_asm__LeftShift($ghost_x, $ghost_amount))) == (fun_IntBit(INTERNAL_add_boogie($ghost__1_i, $ghost_amount), $ghost_x))));\r\n ensures r.regs == r_old.regs[$opn_x := $ghost___result];\r\nfunction trigger_fun_asm__RightShift($ghost_x:int, $ghost_amount:int):bool { true }\r\natomic ghost procedure lemma_fun_ensures_fun_asm__RightShift();\r\n ensures (forall $ghost_x:int, $ghost_amount:int::{fun_asm__RightShift($ghost_x, $ghost_amount)}{trigger_fun_asm__RightShift($ghost_x, $ghost_amount)}trigger_fun_asm__RightShift($ghost_x, $ghost_amount) ==> (true && (fun_word32($ghost_x)) && ((INTERNAL_le_boogie(0, $ghost_amount)) && (INTERNAL_lt_boogie($ghost_amount, 32)))) ==> (true && (fun_word32(fun_asm__RightShift($ghost_x, $ghost_amount))) && ((forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__RightShift($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(0, $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, $ghost_amount))) ==> ((fun_IntBit($ghost__0_i, fun_asm__RightShift($ghost_x, $ghost_amount))) == (false)))) && ((forall $ghost__1_i:int :: {fun_IntBit($ghost__1_i, fun_asm__RightShift($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie($ghost_amount, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 32))) ==> ((fun_IntBit($ghost__1_i, fun_asm__RightShift($ghost_x, $ghost_amount))) == (fun_IntBit(INTERNAL_sub_boogie($ghost__1_i, $ghost_amount), $ghost_x)))))));\r\natomic procedure proc_asm__RightShift(my r_old:regs, $ghost_x:int, $ghost_amount:int, $opn_x:int, $opn_amount:opn) returns(my r:regs, $ghost___result:int);\r\n requires $ghost_x == r_old.regs[$opn_x];\r\n requires $ghost_amount == Eval(r_old, $opn_amount);\r\n requires fun_word32($ghost_x);\r\n requires (INTERNAL_le_boogie(0, $ghost_amount)) && (INTERNAL_lt_boogie($ghost_amount, 32));\r\n ensures $ghost___result == (fun_asm__RightShift($ghost_x, $ghost_amount));\r\n ensures fun_word32(fun_asm__RightShift($ghost_x, $ghost_amount));\r\n ensures (forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__RightShift($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(0, $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, $ghost_amount))) ==> ((fun_IntBit($ghost__0_i, fun_asm__RightShift($ghost_x, $ghost_amount))) == (false)));\r\n ensures (forall $ghost__1_i:int :: {fun_IntBit($ghost__1_i, fun_asm__RightShift($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie($ghost_amount, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 32))) ==> ((fun_IntBit($ghost__1_i, fun_asm__RightShift($ghost_x, $ghost_amount))) == (fun_IntBit(INTERNAL_sub_boogie($ghost__1_i, $ghost_amount), $ghost_x))));\r\n ensures r.regs == r_old.regs[$opn_x := $ghost___result];\r\nfunction trigger_fun_asm__RotateLeft($ghost_x:int, $ghost_amount:int):bool { true }\r\natomic ghost procedure lemma_fun_ensures_fun_asm__RotateLeft();\r\n ensures (forall $ghost_x:int, $ghost_amount:int::{fun_asm__RotateLeft($ghost_x, $ghost_amount)}{trigger_fun_asm__RotateLeft($ghost_x, $ghost_amount)}trigger_fun_asm__RotateLeft($ghost_x, $ghost_amount) ==> (true && (fun_word32($ghost_x)) && ((INTERNAL_le_boogie(0, $ghost_amount)) && (INTERNAL_lt_boogie($ghost_amount, 32)))) ==> (true && (fun_word32(fun_asm__RotateLeft($ghost_x, $ghost_amount))) && ((forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__RotateLeft($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(0, $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, INTERNAL_sub_boogie(32, $ghost_amount)))) ==> ((fun_IntBit($ghost__0_i, fun_asm__RotateLeft($ghost_x, $ghost_amount))) == (fun_IntBit(INTERNAL_add_boogie($ghost__0_i, $ghost_amount), $ghost_x))))) && ((forall $ghost__1_i:int :: {fun_IntBit($ghost__1_i, fun_asm__RotateLeft($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(INTERNAL_sub_boogie(32, $ghost_amount), $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 32))) ==> ((fun_IntBit($ghost__1_i, fun_asm__RotateLeft($ghost_x, $ghost_amount))) == (fun_IntBit(INTERNAL_sub_boogie($ghost__1_i, INTERNAL_sub_boogie(32, $ghost_amount)), $ghost_x)))))));\r\natomic procedure proc_asm__RotateLeft(my r_old:regs, $ghost_x:int, $ghost_amount:int, $opn_x:int, $opn_amount:opn) returns(my r:regs, $ghost___result:int);\r\n requires $ghost_x == r_old.regs[$opn_x];\r\n requires $ghost_amount == Eval(r_old, $opn_amount);\r\n requires fun_word32($ghost_x);\r\n requires (INTERNAL_le_boogie(0, $ghost_amount)) && (INTERNAL_lt_boogie($ghost_amount, 32));\r\n ensures $ghost___result == (fun_asm__RotateLeft($ghost_x, $ghost_amount));\r\n ensures fun_word32(fun_asm__RotateLeft($ghost_x, $ghost_amount));\r\n ensures (forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__RotateLeft($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(0, $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, INTERNAL_sub_boogie(32, $ghost_amount)))) ==> ((fun_IntBit($ghost__0_i, fun_asm__RotateLeft($ghost_x, $ghost_amount))) == (fun_IntBit(INTERNAL_add_boogie($ghost__0_i, $ghost_amount), $ghost_x))));\r\n ensures (forall $ghost__1_i:int :: {fun_IntBit($ghost__1_i, fun_asm__RotateLeft($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(INTERNAL_sub_boogie(32, $ghost_amount), $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 32))) ==> ((fun_IntBit($ghost__1_i, fun_asm__RotateLeft($ghost_x, $ghost_amount))) == (fun_IntBit(INTERNAL_sub_boogie($ghost__1_i, INTERNAL_sub_boogie(32, $ghost_amount)), $ghost_x))));\r\n ensures r.regs == r_old.regs[$opn_x := $ghost___result];\r\nfunction trigger_fun_asm__RotateRight($ghost_x:int, $ghost_amount:int):bool { true }\r\natomic ghost procedure lemma_fun_ensures_fun_asm__RotateRight();\r\n ensures (forall $ghost_x:int, $ghost_amount:int::{fun_asm__RotateRight($ghost_x, $ghost_amount)}{trigger_fun_asm__RotateRight($ghost_x, $ghost_amount)}trigger_fun_asm__RotateRight($ghost_x, $ghost_amount) ==> (true && (fun_word32($ghost_x)) && ((INTERNAL_le_boogie(0, $ghost_amount)) && (INTERNAL_lt_boogie($ghost_amount, 32)))) ==> (true && (fun_word32(fun_asm__RotateRight($ghost_x, $ghost_amount))) && ((forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__RotateRight($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(0, $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, $ghost_amount))) ==> ((fun_IntBit($ghost__0_i, fun_asm__RotateRight($ghost_x, $ghost_amount))) == (fun_IntBit(INTERNAL_add_boogie(INTERNAL_sub_boogie(32, $ghost_amount), $ghost__0_i), $ghost_x))))) && ((forall $ghost__1_i:int :: {fun_IntBit($ghost__1_i, fun_asm__RotateRight($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie($ghost_amount, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 32))) ==> ((fun_IntBit($ghost__1_i, fun_asm__RotateRight($ghost_x, $ghost_amount))) == (fun_IntBit(INTERNAL_sub_boogie($ghost__1_i, $ghost_amount), $ghost_x)))))));\r\natomic procedure proc_asm__RotateRight(my r_old:regs, $ghost_x:int, $ghost_amount:int, $opn_x:int, $opn_amount:opn) returns(my r:regs, $ghost___result:int);\r\n requires $ghost_x == r_old.regs[$opn_x];\r\n requires $ghost_amount == Eval(r_old, $opn_amount);\r\n requires fun_word32($ghost_x);\r\n requires (INTERNAL_le_boogie(0, $ghost_amount)) && (INTERNAL_lt_boogie($ghost_amount, 32));\r\n ensures $ghost___result == (fun_asm__RotateRight($ghost_x, $ghost_amount));\r\n ensures fun_word32(fun_asm__RotateRight($ghost_x, $ghost_amount));\r\n ensures (forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__RotateRight($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(0, $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, $ghost_amount))) ==> ((fun_IntBit($ghost__0_i, fun_asm__RotateRight($ghost_x, $ghost_amount))) == (fun_IntBit(INTERNAL_add_boogie(INTERNAL_sub_boogie(32, $ghost_amount), $ghost__0_i), $ghost_x))));\r\n ensures (forall $ghost__1_i:int :: {fun_IntBit($ghost__1_i, fun_asm__RotateRight($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie($ghost_amount, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 32))) ==> ((fun_IntBit($ghost__1_i, fun_asm__RotateRight($ghost_x, $ghost_amount))) == (fun_IntBit(INTERNAL_sub_boogie($ghost__1_i, $ghost_amount), $ghost_x))));\r\n ensures r.regs == r_old.regs[$opn_x := $ghost___result];\r\nfunction trigger_fun_asm__BitwiseNot($ghost_x:int):bool { true }\r\natomic ghost procedure lemma_fun_ensures_fun_asm__BitwiseNot();\r\n ensures (forall $ghost_x:int::{fun_asm__BitwiseNot($ghost_x)}{trigger_fun_asm__BitwiseNot($ghost_x)}trigger_fun_asm__BitwiseNot($ghost_x) ==> (true && (fun_word32($ghost_x))) ==> (true && (fun_word32(fun_asm__BitwiseNot($ghost_x))) && ((forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__BitwiseNot($ghost_x))} ((INTERNAL_le_boogie(0, $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, 32))) ==> ((fun_IntBit($ghost__0_i, fun_asm__BitwiseNot($ghost_x))) == ((!(fun_IntBit($ghost__0_i, $ghost_x)))))))));\r\natomic procedure proc_asm__BitwiseNot(my r_old:regs, $ghost_x:int, $opn_x:int) returns(my r:regs, $ghost___result:int);\r\n requires $ghost_x == r_old.regs[$opn_x];\r\n requires fun_word32($ghost_x);\r\n ensures $ghost___result == (fun_asm__BitwiseNot($ghost_x));\r\n ensures fun_word32(fun_asm__BitwiseNot($ghost_x));\r\n ensures (forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__BitwiseNot($ghost_x))} ((INTERNAL_le_boogie(0, $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, 32))) ==> ((fun_IntBit($ghost__0_i, fun_asm__BitwiseNot($ghost_x))) == ((!(fun_IntBit($ghost__0_i, $ghost_x))))));\r\n ensures r.regs == r_old.regs[$opn_x := $ghost___result];\r\nfunction trigger_fun_asm__BitwiseAnd($ghost_x:int, $ghost_y:int):bool { true }\r\natomic ghost procedure lemma_fun_ensures_fun_asm__BitwiseAnd();\r\n ensures (forall $ghost_x:int, $ghost_y:int::{fun_asm__BitwiseAnd($ghost_x, $ghost_y)}{trigger_fun_asm__BitwiseAnd($ghost_x, $ghost_y)}trigger_fun_asm__BitwiseAnd($ghost_x, $ghost_y) ==> (true && (fun_word32($ghost_x)) && (fun_word32($ghost_y))) ==> (true && (fun_word32(fun_asm__BitwiseAnd($ghost_x, $ghost_y))) && ((forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__BitwiseAnd($ghost_x, $ghost_y))} ((INTERNAL_le_boogie(0, $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, 32))) ==> ((fun_IntBit($ghost__0_i, fun_asm__BitwiseAnd($ghost_x, $ghost_y))) == ((fun_IntBit($ghost__0_i, $ghost_x)) && (fun_IntBit($ghost__0_i, $ghost_y))))))));\r\natomic procedure proc_asm__BitwiseAnd(my r_old:regs, $ghost_x:int, $ghost_y:int, $opn_x:int, $opn_y:opn) returns(my r:regs, $ghost___result:int);\r\n requires $ghost_x == r_old.regs[$opn_x];\r\n requires $ghost_y == Eval(r_old, $opn_y);\r\n requires fun_word32($ghost_x);\r\n requires fun_word32($ghost_y);\r\n ensures $ghost___result == (fun_asm__BitwiseAnd($ghost_x, $ghost_y));\r\n ensures fun_word32(fun_asm__BitwiseAnd($ghost_x, $ghost_y));\r\n ensures (forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__BitwiseAnd($ghost_x, $ghost_y))} ((INTERNAL_le_boogie(0, $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, 32))) ==> ((fun_IntBit($ghost__0_i, fun_asm__BitwiseAnd($ghost_x, $ghost_y))) == ((fun_IntBit($ghost__0_i, $ghost_x)) && (fun_IntBit($ghost__0_i, $ghost_y)))));\r\n ensures r.regs == r_old.regs[$opn_x := $ghost___result];\r\nfunction trigger_fun_asm__BitwiseOr($ghost_x:int, $ghost_y:int):bool { true }\r\natomic ghost procedure lemma_fun_ensures_fun_asm__BitwiseOr();\r\n ensures (forall $ghost_x:int, $ghost_y:int::{fun_asm__BitwiseOr($ghost_x, $ghost_y)}{trigger_fun_asm__BitwiseOr($ghost_x, $ghost_y)}trigger_fun_asm__BitwiseOr($ghost_x, $ghost_y) ==> (true && (fun_word32($ghost_x)) && (fun_word32($ghost_y))) ==> (true && (fun_word32(fun_asm__BitwiseOr($ghost_x, $ghost_y))) && ((forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__BitwiseOr($ghost_x, $ghost_y))} ((INTERNAL_le_boogie(0, $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, 32))) ==> ((fun_IntBit($ghost__0_i, fun_asm__BitwiseOr($ghost_x, $ghost_y))) == ((fun_IntBit($ghost__0_i, $ghost_x)) || (fun_IntBit($ghost__0_i, $ghost_y))))))));\r\natomic procedure proc_asm__BitwiseOr(my r_old:regs, $ghost_x:int, $ghost_y:int, $opn_x:int, $opn_y:opn) returns(my r:regs, $ghost___result:int);\r\n requires $ghost_x == r_old.regs[$opn_x];\r\n requires $ghost_y == Eval(r_old, $opn_y);\r\n requires fun_word32($ghost_x);\r\n requires fun_word32($ghost_y);\r\n ensures $ghost___result == (fun_asm__BitwiseOr($ghost_x, $ghost_y));\r\n ensures fun_word32(fun_asm__BitwiseOr($ghost_x, $ghost_y));\r\n ensures (forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__BitwiseOr($ghost_x, $ghost_y))} ((INTERNAL_le_boogie(0, $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, 32))) ==> ((fun_IntBit($ghost__0_i, fun_asm__BitwiseOr($ghost_x, $ghost_y))) == ((fun_IntBit($ghost__0_i, $ghost_x)) || (fun_IntBit($ghost__0_i, $ghost_y)))));\r\n ensures r.regs == r_old.regs[$opn_x := $ghost___result];\r\nfunction trigger_fun_asm__BitwiseXor($ghost_x:int, $ghost_y:int):bool { true }\r\natomic ghost procedure lemma_fun_ensures_fun_asm__BitwiseXor();\r\n ensures (forall $ghost_x:int, $ghost_y:int::{fun_asm__BitwiseXor($ghost_x, $ghost_y)}{trigger_fun_asm__BitwiseXor($ghost_x, $ghost_y)}trigger_fun_asm__BitwiseXor($ghost_x, $ghost_y) ==> (true && (fun_word32($ghost_x)) && (fun_word32($ghost_y))) ==> (true && (fun_word32(fun_asm__BitwiseXor($ghost_x, $ghost_y))) && ((forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__BitwiseXor($ghost_x, $ghost_y))} ((INTERNAL_le_boogie(0, $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, 32))) ==> ((fun_IntBit($ghost__0_i, fun_asm__BitwiseXor($ghost_x, $ghost_y))) == ((fun_IntBit($ghost__0_i, $ghost_x)) != (fun_IntBit($ghost__0_i, $ghost_y))))))));\r\natomic procedure proc_asm__BitwiseXor(my r_old:regs, $ghost_x:int, $ghost_y:int, $opn_x:int, $opn_y:opn) returns(my r:regs, $ghost___result:int);\r\n requires $ghost_x == r_old.regs[$opn_x];\r\n requires $ghost_y == Eval(r_old, $opn_y);\r\n requires fun_word32($ghost_x);\r\n requires fun_word32($ghost_y);\r\n ensures $ghost___result == (fun_asm__BitwiseXor($ghost_x, $ghost_y));\r\n ensures fun_word32(fun_asm__BitwiseXor($ghost_x, $ghost_y));\r\n ensures (forall $ghost__0_i:int :: {fun_IntBit($ghost__0_i, fun_asm__BitwiseXor($ghost_x, $ghost_y))} ((INTERNAL_le_boogie(0, $ghost__0_i)) && (INTERNAL_lt_boogie($ghost__0_i, 32))) ==> ((fun_IntBit($ghost__0_i, fun_asm__BitwiseXor($ghost_x, $ghost_y))) == ((fun_IntBit($ghost__0_i, $ghost_x)) != (fun_IntBit($ghost__0_i, $ghost_y)))));\r\n ensures r.regs == r_old.regs[$opn_x := $ghost___result];\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/DafnyAssembly.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-private-import IoMain;\r\n//-private-import IntLemmasMain;\r\n//-private-basmonly-import Trusted;\r\n//-private-basmonly-import Checked;\r\n//-private-import Heap;\r\n//-private-import Seq;\r\n//-private-import dafny_DafnyPrelude;\r\n\r\nmodule implementation DafnyAssembly\r\n{\r\nimplementation lemma_fun_ensures_fun_asm__Add() {}\r\nimplementation lemma_fun_ensures_fun_asm__Sub() {}\r\nimplementation lemma_fun_ensures_fun_asm__Mul() {}\r\nimplementation lemma_fun_ensures_fun_asm__Div() {}\r\nimplementation lemma_fun_ensures_fun_asm__Mod() {}\r\n\r\nimplementation lemma_fun_ensures_fun_asm__LeftShift()\r\n{\r\n forall $ghost_x:int, $ghost_amount:int::{fun_asm__LeftShift($ghost_x, $ghost_amount)}{trigger_fun_asm__LeftShift($ghost_x, $ghost_amount)}trigger_fun_asm__LeftShift($ghost_x, $ghost_amount) ==> (true && (fun_word32($ghost_x)) && ((INTERNAL_le_boogie(0, $ghost_amount)) && (INTERNAL_lt_boogie($ghost_amount, 32)))) ==> (true && (fun_word32(fun_asm__LeftShift($ghost_x, $ghost_amount))) && ((forall $ghost_i:int :: {fun_IntBit($ghost_i, fun_asm__LeftShift($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(32 - $ghost_amount, $ghost_i)) && (INTERNAL_lt_boogie($ghost_i, 32))) ==> ((fun_IntBit($ghost_i, fun_asm__LeftShift($ghost_x, $ghost_amount))) == (false)))) && ((forall $ghost_i:int :: {fun_IntBit($ghost_i, fun_asm__LeftShift($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(0, $ghost_i)) && (INTERNAL_lt_boogie($ghost_i, 32 - $ghost_amount))) ==> ((fun_IntBit($ghost_i, fun_asm__LeftShift($ghost_x, $ghost_amount))) == (fun_IntBit($ghost_i + $ghost_amount, $ghost_x))))))\r\n {\r\n call axiom_shl($ghost_x, $ghost_amount);\r\n call reveal_WORD_HI();\r\n }\r\n}\r\n\r\nimplementation lemma_fun_ensures_fun_asm__RightShift()\r\n{\r\n forall $ghost_x:int, $ghost_amount:int::{fun_asm__RightShift($ghost_x, $ghost_amount)}{trigger_fun_asm__RightShift($ghost_x, $ghost_amount)}trigger_fun_asm__RightShift($ghost_x, $ghost_amount) ==> (true && (fun_word32($ghost_x)) && ((INTERNAL_le_boogie(0, $ghost_amount)) && (INTERNAL_lt_boogie($ghost_amount, 32)))) ==> (true && (fun_word32(fun_asm__RightShift($ghost_x, $ghost_amount))) && ((forall $ghost_i:int :: {fun_IntBit($ghost_i, fun_asm__RightShift($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(0, $ghost_i)) && (INTERNAL_lt_boogie($ghost_i, $ghost_amount))) ==> ((fun_IntBit($ghost_i, fun_asm__RightShift($ghost_x, $ghost_amount))) == (false)))) && ((forall $ghost_i:int :: {fun_IntBit($ghost_i, fun_asm__RightShift($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie($ghost_amount, $ghost_i)) && (INTERNAL_lt_boogie($ghost_i, 32))) ==> ((fun_IntBit($ghost_i, fun_asm__RightShift($ghost_x, $ghost_amount))) == (fun_IntBit($ghost_i - $ghost_amount, $ghost_x)))))) \r\n {\r\n call axiom_shr($ghost_x, $ghost_amount);\r\n call reveal_WORD_HI();\r\n }\r\n}\r\n\r\nimplementation lemma_fun_ensures_fun_asm__RotateLeft()\r\n{\r\n forall $ghost_x:int, $ghost_amount:int::{fun_asm__RotateLeft($ghost_x, $ghost_amount)}{trigger_fun_asm__RotateLeft($ghost_x, $ghost_amount)}trigger_fun_asm__RotateLeft($ghost_x, $ghost_amount) ==> (true && (fun_word32($ghost_x)) && ((INTERNAL_le_boogie(0, $ghost_amount)) && (INTERNAL_lt_boogie($ghost_amount, 32)))) ==> (true && (fun_word32(fun_asm__RotateLeft($ghost_x, $ghost_amount))) && ((forall $ghost_i:int :: {fun_IntBit($ghost_i, fun_asm__RotateLeft($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(0, $ghost_i)) && (INTERNAL_lt_boogie($ghost_i, 32 - $ghost_amount))) ==> ((fun_IntBit($ghost_i, fun_asm__RotateLeft($ghost_x, $ghost_amount))) == (fun_IntBit($ghost_i + $ghost_amount, $ghost_x))))) && ((forall $ghost_i:int :: {fun_IntBit($ghost_i, fun_asm__RotateLeft($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(32 - $ghost_amount, $ghost_i)) && (INTERNAL_lt_boogie($ghost_i, 32))) ==> ((fun_IntBit($ghost_i, fun_asm__RotateLeft($ghost_x, $ghost_amount))) == (fun_IntBit($ghost_i - (32 - $ghost_amount), $ghost_x))))))\r\n {\r\n call axiom_rol($ghost_x, $ghost_amount);\r\n call reveal_WORD_HI();\r\n }\r\n}\r\n\r\nimplementation lemma_fun_ensures_fun_asm__RotateRight()\r\n{\r\n forall $ghost_x:int, $ghost_amount:int::{fun_asm__RotateRight($ghost_x, $ghost_amount)}{trigger_fun_asm__RotateRight($ghost_x, $ghost_amount)}trigger_fun_asm__RotateRight($ghost_x, $ghost_amount) ==> (true && (fun_word32($ghost_x)) && ((INTERNAL_le_boogie(0, $ghost_amount)) && (INTERNAL_lt_boogie($ghost_amount, 32)))) ==> (true && (fun_word32(fun_asm__RotateRight($ghost_x, $ghost_amount))) && ((forall $ghost_i:int :: {fun_IntBit($ghost_i, fun_asm__RotateRight($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie(0, $ghost_i)) && (INTERNAL_lt_boogie($ghost_i, $ghost_amount))) ==> ((fun_IntBit($ghost_i, fun_asm__RotateRight($ghost_x, $ghost_amount))) == (fun_IntBit((32 - $ghost_amount) + $ghost_i, $ghost_x))))) && ((forall $ghost_i:int :: {fun_IntBit($ghost_i, fun_asm__RotateRight($ghost_x, $ghost_amount))} ((INTERNAL_le_boogie($ghost_amount, $ghost_i)) && (INTERNAL_lt_boogie($ghost_i, 32))) ==> ((fun_IntBit($ghost_i, fun_asm__RotateRight($ghost_x, $ghost_amount))) == (fun_IntBit($ghost_i - $ghost_amount, $ghost_x))))))\r\n {\r\n call axiom_ror($ghost_x, $ghost_amount);\r\n call reveal_WORD_HI();\r\n }\r\n}\r\n\r\nimplementation lemma_fun_ensures_fun_asm__BitwiseNot()\r\n{\r\n forall $ghost_x:int::{fun_asm__BitwiseNot($ghost_x)}\r\n (true && (fun_word32($ghost_x))) ==> (true && (fun_word32(fun_asm__BitwiseNot($ghost_x))) && ((forall $ghost_i:int :: {fun_IntBit($ghost_i, fun_asm__BitwiseNot($ghost_x))} ((INTERNAL_le_boogie(0, $ghost_i)) && (INTERNAL_lt_boogie($ghost_i, 32))) ==> ((fun_IntBit($ghost_i, fun_asm__BitwiseNot($ghost_x))) == ((!(fun_IntBit($ghost_i, $ghost_x))))))))\r\n {\r\n call axiom_neg($ghost_x);\r\n call reveal_WORD_HI();\r\n }\r\n}\r\n\r\nimplementation lemma_fun_ensures_fun_asm__BitwiseAnd()\r\n{\r\n forall $ghost_x:int, $ghost_y:int::{fun_asm__BitwiseAnd($ghost_x, $ghost_y)}\r\n (true && (fun_word32($ghost_x)) && (fun_word32($ghost_y))) ==> (true && (fun_word32(fun_asm__BitwiseAnd($ghost_x, $ghost_y))) && ((forall $ghost_i:int :: {fun_IntBit($ghost_i, fun_asm__BitwiseAnd($ghost_x, $ghost_y))} ((INTERNAL_le_boogie(0, $ghost_i)) && (INTERNAL_lt_boogie($ghost_i, 32))) ==> ((fun_IntBit($ghost_i, fun_asm__BitwiseAnd($ghost_x, $ghost_y))) == ((fun_IntBit($ghost_i, $ghost_x)) && (fun_IntBit($ghost_i, $ghost_y)))))))\r\n {\r\n call axiom_and($ghost_x, $ghost_y);\r\n call reveal_WORD_HI();\r\n }\r\n}\r\n\r\nimplementation lemma_fun_ensures_fun_asm__BitwiseOr()\r\n{\r\n forall $ghost_x:int, $ghost_y:int::{fun_asm__BitwiseOr($ghost_x, $ghost_y)}\r\n (true && (fun_word32($ghost_x)) && (fun_word32($ghost_y))) ==> (true && (fun_word32(fun_asm__BitwiseOr($ghost_x, $ghost_y))) && ((forall $ghost_i:int :: {fun_IntBit($ghost_i, fun_asm__BitwiseOr($ghost_x, $ghost_y))} ((INTERNAL_le_boogie(0, $ghost_i)) && (INTERNAL_lt_boogie($ghost_i, 32))) ==> ((fun_IntBit($ghost_i, fun_asm__BitwiseOr($ghost_x, $ghost_y))) == ((fun_IntBit($ghost_i, $ghost_x)) || (fun_IntBit($ghost_i, $ghost_y)))))))\r\n {\r\n call axiom_or($ghost_x, $ghost_y);\r\n call reveal_WORD_HI();\r\n }\r\n}\r\n\r\nimplementation lemma_fun_ensures_fun_asm__BitwiseXor()\r\n{\r\n forall $ghost_x:int, $ghost_y:int::{fun_asm__BitwiseXor($ghost_x, $ghost_y)}\r\n (true && (fun_word32($ghost_x)) && (fun_word32($ghost_y))) ==> (true && (fun_word32(fun_asm__BitwiseXor($ghost_x, $ghost_y))) && ((forall $ghost_i:int :: {fun_IntBit($ghost_i, fun_asm__BitwiseXor($ghost_x, $ghost_y))} ((INTERNAL_le_boogie(0, $ghost_i)) && (INTERNAL_lt_boogie($ghost_i, 32))) ==> ((fun_IntBit($ghost_i, fun_asm__BitwiseXor($ghost_x, $ghost_y))) == ((fun_IntBit($ghost_i, $ghost_x)) != (fun_IntBit($ghost_i, $ghost_y)))))))\r\n {\r\n call axiom_xor($ghost_x, $ghost_y);\r\n call reveal_WORD_HI();\r\n }\r\n}\r\n\r\nimplementation proc_asm__Add(my r_old:regs, $ghost_x:int, $ghost_y:int, $opn_x:int, $opn_y:opn) returns(my r:regs, $ghost___result:int)\r\n{\r\n r := r_old;\r\n call reveal_WORD_HI();\r\n call reveal_wrap32($ghost_x + $ghost_y);\r\n call r := instr_Add(r, $opn_x, $opn_y);\r\n $ghost___result := fun_asm__Add($ghost_x, $ghost_y);\r\n}\r\n\r\nimplementation proc_asm__Sub(my r_old:regs, $ghost_x:int, $ghost_y:int, $opn_x:int, $opn_y:opn) returns(my r:regs, $ghost___result:int)\r\n{\r\n r := r_old;\r\n call reveal_WORD_HI();\r\n call reveal_wrap32($ghost_x - $ghost_y);\r\n call r := instr_Sub(r, $opn_x, $opn_y);\r\n $ghost___result := fun_asm__Sub($ghost_x, $ghost_y);\r\n}\r\n\r\nimplementation Proc_asm__Mul(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_x:int, $ghost_y:int)\r\n returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost___result:int)\r\n{\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n\r\n assert TV(esp) && TO(0) && TO(1) && TO(2) && TO(3) && TO(4);\r\n\r\n#ifdef x64\r\n call eax := Load(stk, esp + 12);\r\n call ebx := Load(stk, esp + 16);\r\n#else\r\n call eax := Load(stk, esp + 8);\r\n call ebx := Load(stk, esp + 12);\r\n#endif\r\n call reveal_WORD_HI();\r\n call reveal_wrap32(eax * ebx);\r\n call eax, edx := MulWrap(eax, ebx);\r\n assert TVM($ghost_x, $ghost_y);\r\n\r\n#ifdef x64\r\n call Store(inout stk, esp + 8, eax);\r\n#else\r\n call Store(inout stk, esp + 4, eax);\r\n#endif\r\n\r\n $ghost___result := fun_asm__Mul($ghost_x, $ghost_y);\r\n Return;\r\n}\r\n\r\nimplementation proc_asm__Mul64(my r_old:regs, $ghost_x:int, $ghost_y:int, $opn_hi:int, $opn_x:int, $opn_y:opn) returns(my r:regs, $ghost_hi:int, $ghost_lo:int)\r\n{\r\n r := r_old;\r\n call r := instr_Mul64(r, $opn_y);\r\n assert TVM($ghost_x, $ghost_y);\r\n assert TVD($ghost_x * $ghost_y, 0x100000000);\r\n $ghost_lo := (fun_mod0x100000000($ghost_x * $ghost_y));\r\n $ghost_hi := ($ghost_x * $ghost_y) div 0x100000000;\r\n forall ::\r\n $ghost_hi == Div(Mult($ghost_x, $ghost_y), 4294967296)\r\n && $ghost_lo == wrap32(Mult($ghost_x, $ghost_y))\r\n {\r\n call reveal_wrap32(Mult($ghost_x, $ghost_y));\r\n }\r\n}\r\n\r\nimplementation Proc_asm__Div(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_x:int, $ghost_y:int)\r\n returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost___result:int)\r\n{\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n\r\n assert TV(esp) && TO(0) && TO(1) && TO(2) && TO(3) && TO(4);\r\n\r\n#ifdef x64\r\n call eax := Load(stk, esp + 12);\r\n call ebx := Load(stk, esp + 16);\r\n#else\r\n call eax := Load(stk, esp + 8);\r\n call ebx := Load(stk, esp + 12);\r\n#endif\r\n call edx := Mov(0);\r\n call reveal_WORD_HI();\r\n call reveal_wrap32(eax div ebx);\r\n call eax, edx := Div(eax, edx, ebx);\r\n#ifdef x64\r\n call Store(inout stk, esp + 8, eax);\r\n#else\r\n call Store(inout stk, esp + 4, eax);\r\n#endif\r\n $ghost___result := fun_asm__Div($ghost_x, $ghost_y);\r\n Return;\r\n}\r\n\r\nimplementation Proc_asm__Mod(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_x:int, $ghost_y:int)\r\n returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost___result:int)\r\n{\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n\r\n assert TV(esp) && TO(0) && TO(1) && TO(2) && TO(3) && TO(4);\r\n\r\n#ifdef x64\r\n call eax := Load(stk, esp + 12);\r\n call ebx := Load(stk, esp + 16);\r\n#else\r\n call eax := Load(stk, esp + 8);\r\n call ebx := Load(stk, esp + 12);\r\n#endif\r\n\r\n call edx := Mov(0);\r\n call reveal_WORD_HI();\r\n call reveal_wrap32(eax div ebx);\r\n call eax, edx := Div(eax, edx, ebx);\r\n\r\n#ifdef x64\r\n call Store(inout stk, esp + 8, edx);\r\n#else\r\n call Store(inout stk, esp + 4, edx);\r\n#endif\r\n\r\n $ghost___result := fun_asm__Mod($ghost_x, $ghost_y);\r\n Return;\r\n}\r\n\r\nimplementation proc_asm__LeftShift(my r_old:regs, $ghost_x:int, $ghost_amount:int, $opn_x:int, $opn_amount:opn) returns(my r:regs, $ghost___result:int)\r\n{\r\n r := r_old;\r\n call r := instr_Shl(r, $opn_x, $opn_amount);\r\n $ghost___result := fun_asm__LeftShift($ghost_x, $ghost_amount);\r\n call lemma_fun_ensures_fun_asm__LeftShift();\r\n}\r\n\r\nimplementation proc_asm__RightShift(my r_old:regs, $ghost_x:int, $ghost_amount:int, $opn_x:int, $opn_amount:opn) returns(my r:regs, $ghost___result:int)\r\n{\r\n r := r_old;\r\n call r := instr_Shr(r, $opn_x, $opn_amount);\r\n $ghost___result := fun_asm__RightShift($ghost_x, $ghost_amount);\r\n call lemma_fun_ensures_fun_asm__RightShift();\r\n}\r\n\r\nimplementation proc_asm__RotateLeft(my r_old:regs, $ghost_x:int, $ghost_amount:int, $opn_x:int, $opn_amount:opn) returns(my r:regs, $ghost___result:int)\r\n{\r\n r := r_old;\r\n call r := instr_Rol(r, $opn_x, $opn_amount);\r\n $ghost___result := fun_asm__RotateLeft($ghost_x, $ghost_amount);\r\n call lemma_fun_ensures_fun_asm__RotateLeft();\r\n}\r\n\r\nimplementation proc_asm__RotateRight(my r_old:regs, $ghost_x:int, $ghost_amount:int, $opn_x:int, $opn_amount:opn) returns(my r:regs, $ghost___result:int)\r\n{\r\n r := r_old;\r\n call r := instr_Ror(r, $opn_x, $opn_amount);\r\n $ghost___result := fun_asm__RotateRight($ghost_x, $ghost_amount);\r\n call lemma_fun_ensures_fun_asm__RotateRight();\r\n}\r\n\r\nimplementation proc_asm__BitwiseNot(my r_old:regs, $ghost_x:int, $opn_x:int) returns(my r:regs, $ghost___result:int)\r\n{\r\n r := r_old;\r\n call r := instr_Not(r, $opn_x);\r\n $ghost___result := fun_asm__BitwiseNot($ghost_x);\r\n call lemma_fun_ensures_fun_asm__BitwiseNot();\r\n}\r\n\r\nimplementation proc_asm__BitwiseAnd(my r_old:regs, $ghost_x:int, $ghost_y:int, $opn_x:int, $opn_y:opn) returns(my r:regs, $ghost___result:int)\r\n{\r\n r := r_old;\r\n call r := instr_And(r, $opn_x, $opn_y);\r\n $ghost___result := fun_asm__BitwiseAnd($ghost_x, $ghost_y);\r\n call lemma_fun_ensures_fun_asm__BitwiseAnd();\r\n}\r\n\r\nimplementation proc_asm__BitwiseOr(my r_old:regs, $ghost_x:int, $ghost_y:int, $opn_x:int, $opn_y:opn) returns(my r:regs, $ghost___result:int)\r\n{\r\n r := r_old;\r\n call r := instr_Or(r, $opn_x, $opn_y);\r\n $ghost___result := fun_asm__BitwiseOr($ghost_x, $ghost_y);\r\n call lemma_fun_ensures_fun_asm__BitwiseOr();\r\n}\r\n\r\nimplementation proc_asm__BitwiseXor(my r_old:regs, $ghost_x:int, $ghost_y:int, $opn_x:int, $opn_y:opn) returns(my r:regs, $ghost___result:int)\r\n{\r\n r := r_old;\r\n call r := instr_Xor(r, $opn_x, $opn_y);\r\n $ghost___result := fun_asm__BitwiseXor($ghost_x, $ghost_y);\r\n call lemma_fun_ensures_fun_asm__BitwiseXor();\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/Entry.imp.beat", "content": "// Uh-oh: it looks like whether we need Symdiff in Main depends\r\n// on what app we're compiling! DafnyCCTest (nee Cube) didn't need it.\r\n// I guess as long as it's always *allowed*, we'll just pay for it\r\n// too often.\r\n// jonh: deleting all these import rules; we'll pick the correct\r\n// set up from dafny_Main_i via HorribleEntryStitcher.\r\n// Except we definitely need to add this one in:\r\n//private-import dafny_Main_i;\r\n// And we need annotations, which Horrible isn't transferring:\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n\r\n//-private-disabled BaseSpec;\r\n//-private-disabled MemorySpec;\r\n//-private-disabled IoTypesSpec;\r\n//-private-disabled MachineStateSpec;\r\n//-private-disabled AssemblySpec;\r\n//-private-disabled InterruptsSpec;\r\n//-private-disabled IoSpec;\r\n//-private-disabled Core;\r\n//-private-disabled LogicalAddressing;\r\n//-private-disabled Overflow;\r\n//-private-disabled Stacks;\r\n//-private-disabled Partition;\r\n//-private-disabled Instructions;\r\n//-private-disabled Util;\r\n//-private-disabled Separation;\r\n//-private-disabled IntLemmasBase;\r\n//-private-disabled IntLemmasGc;\r\n//-private-disabled SimpleGcMemory;\r\n//-private-disabled SimpleCommon;\r\n//-private-disabled SimpleCollector;\r\n//-private-disabled IoMain;\r\n//-private-disabled IntLemmasMain;\r\n//-private-basmonly-disabled Trusted;\r\n//-private-basmonly-disabled Checked;\r\n//-private-disabled Heap;\r\n//-private-disabled Seq;\r\n//-private-disabled dafny_DafnyPrelude;\r\n//-private-disabled DafnyAssembly;\r\n//-private-disabled dafny_relational_s;\r\n//-private-disabled dafny_base_s;\r\n//-private-disabled dafny_power2_s;\r\n//-private-disabled dafny_mul_i;\r\n//-private-disabled dafny_assembly_i;\r\n//-private-disabled dafny_bit_vector_lemmas_i;\r\n//-private-import AppLoaderContract;\r\n//-private-import ExtendedAssembly;\r\n\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\n//- Entry points from the outside world (e.g. from boot loader, interrupts, TAL code, etc.)\r\n\r\nmodule implementation Entry\r\n{\r\n\r\n#ifdef AppLoader\r\nimplementation LoaderEntryPoint(\r\n my r_in:regs,\r\n my core_state_in:core_state,\r\n linear initState_in:InitStateMachine,\r\n linear mem_in:mem,\r\n linear io_in:IOState,\r\n linear dev_states_in:DEV_StateMachines,\r\n $sl_len:int, $cpu_info:int)\r\n#else\r\nimplementation AppEntryPoint(\r\n my r_in:regs,\r\n my core_state_in:core_state,\r\n linear initState_in:InitStateMachine,\r\n linear mem_in:mem,\r\n linear code_mem:mem,\r\n linear io_in:IOState,\r\n app_entry:int,\r\n app_code_base:int,\r\n code_word_seq:Seq___int\r\n )\r\n#endif\r\n{\r\n call reveal_MemInvDetails();\r\n assert ?fLo - ?sLo == stackGcOffset;\r\n \r\n my var r:regs := r_in;\r\n my var core_state:core_state := core_state_in;\r\n linear var initState:InitStateMachine := initState_in;\r\n linear var mem:mem := mem_in;\r\n linear var stk:mem;\r\n linear var statics:mem;\r\n linear var static_mem:mem;\r\n linear var io:IOState := io_in;\r\n\r\n#ifdef AppLoader\r\n ecx := 0x300000;\r\n#else\r\n ecx := 0x340000;\r\n#endif\r\n\r\n if (eax != ecx) { //- We were loaded at the wrong address!\r\n eax := 0x55550001;\r\n call debugBreak();\r\n }\r\n call initState, static_mem := enableStatics(initState);\r\n\r\n assert ?memLo <= esp - 6*?SegmentDescriptorSize;\r\n assert esp <= ?memHi;\r\n// assert esp == 0x310000;\r\n// call reveal_Aligned(0x310000);\r\n assert TV(?CodeBase) && TO(123*1024*256) && TO(0x4000);\r\n assert Aligned(esp);\r\n#ifdef AppLoader //- Other apps require the loader to take care of this\r\n call fixupDS();\r\n#endif\r\n call enableLogicalAddressing();\r\n\r\n// edx := 300;\r\n// eax := 0x112233;\r\n// call writeHex();\r\n//\r\n//dummyLoop:\r\n// goto dummyLoop;\r\n \r\n\r\n#ifdef AppLoader\r\n linear var new_mem:mem;\r\n linear var dev_mem:mem;\r\n\r\n //- Initialize additional DEV protection, so we have more protected memory to work with\r\n call dev_mem := memEmpty();\r\n call mem, dev_mem := memTransfer(mem, dev_mem, (lambda i:int :: ?DEVLo <= i && i < ?DEVHi));\r\n assert (forall i:int :: {dev_mem.dom[i]} TV(i) ==> (dev_mem.dom[i] <==> (?DEVLo <= i && i < ?DEVHi)));\r\n linear var dev_states:DEV_StateMachines := dev_states_in;\r\n call new_mem := initDEV(dev_states, dev_mem);\r\n\r\n //- Merge the statics, the large swath of DEV-protected mem, and our original mem\r\n call static_mem, mem := memTransfer(static_mem, mem, (lambda i:int :: static_mem.dom[i]));\r\n call new_mem, mem := memTransfer(new_mem, mem, (lambda i:int :: new_mem.dom[i]));\r\n#else \r\n //- Merge the statics and our original mem\r\n call static_mem, mem := memTransfer(static_mem, mem, (lambda i:int :: static_mem.dom[i]));\r\n#endif\r\n\r\n //- Initialize separation module\r\n linear var mems:mems;\r\n linear var appCodeMem:mem;\r\n\r\n#ifdef AppLoader\r\n ebx := 0x10000;\r\n ecx := 0x300000;\r\n#else\r\n ebx := 0x100000;\r\n ecx := 0x340000;\r\n#endif\r\n assert ebx == ?CodeSpace;\r\n assert ecx == ?CodeBase;\r\n ebp := ecx;\r\n\r\n ecx := ecx + ebx;\r\n ecx := ecx + 0x1F000;\r\n\r\n edx := 0x08000000;\r\n assert ecx == ?sLo;\r\n call reveal_Aligned(?sLo);\r\n call stk, statics, mems, appCodeMem := initSeparation(mem);\r\n\r\n //- Switch to nucleus stack\r\n esp := DLo;\r\n call espAligned();\r\n call esp := Sub(esp, 16);\r\n\r\n //- Initialize GC\r\n var $absMem:[int][int]int := (lambda i:int::(lambda j:int::0));\r\n var $toAbs:[int]int := (lambda i:int::NO_ABS);\r\n var $stacksFrames:[int]Frames := (lambda i:int::Frames((lambda j:int::0)));\r\n var objLayouts:[int]ObjLayout := (lambda i:int::NoObjLayout());\r\n var heap:Heap;\r\n var _mem:[int]int;\r\n var _val:int;\r\n call heap := initHeap($absMem, objLayouts);\r\n\r\n ebp := 0;\r\n call initCommon();\r\n\r\n //- Initialize IO-related invariants\r\n call initializeSerialPort();\r\n#ifdef AppLoader\r\n esi := 0xdd00001;\r\n call serialDbgWordOut();\r\n call serialDbgNewlineOut();\r\n#else\r\n esi := 0xaa00001;\r\n call serialDbgWordOut();\r\n call serialDbgNewlineOut();\r\n#endif\r\n\r\n#ifdef AppLoader\r\n ebx := 0x32F000;\r\n#else\r\n ebx := 0x45F000;\r\n#endif\r\n assert ebx == ?sLo;\r\n ebx := ebx + 4096; //- Skip the stack\r\n assert ebx == ?sHi;\r\n ebx := ebx + 1024; //- Skip the data\r\n assert ebx == ?dHi;\r\n ebx := ebx + 1024; //- Args\r\n assert ebx == ?argHi;\r\n ecx := ebx;\r\n edx := ecx;\r\n edx := edx + 1024;\r\n\r\n assert ecx == ?pciLo;\r\n assert edx == ?pciHi;\r\n call initIoInv();\r\n\r\n call InitializeGc();\r\n\r\n#ifdef AppLoader\r\n //- Call the Loader's Main Dafny procedure which needs more arguments than usual\r\n\r\n //- Build an array containing the words of the app code\r\n call alignCall(r.regs[ESP]);\r\n var code_words:ArrayOfInt;\r\n {: call := logical_Call(inout r, core_state, inout stk);\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, code_words := Proc_ArrayAlloc(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, appCodeMem); :}\r\n //assert SMemInvGcF(16, stk, old(stk_old), r.regs[ESP] + 12, old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n#ifdef AppLoader\r\n esi := 0xdd00010;\r\n call serialDbgWordOut();\r\n call serialDbgNewlineOut();\r\n#endif\r\n\r\n assert (forall j:int :: 0 <= j && j < Arr_Length(code_words) ==> fun_INTERNAL__array__elems__index($absMem[code_words.arrAbs], j) == appCodeMem.map[0x340000 + j*4]);\r\n\r\n assert (Arr_Length(code_words) == 256*1024);\r\n call proc_Seq__FromArray__Length();\r\n assert (fun_Seq__Length___int(fun_Seq__FromArray($absMem, code_words)) == 256*1024);\r\n call proc_Seq__FromArray__Index();\r\n assert (forall j:int :: 0 <= j && j < 256*1024 ==> \r\n fun_Seq__Index___int(fun_Seq__FromArray($absMem, code_words), j) == fun_INTERNAL__array__elems__index($absMem[code_words.arrAbs], j));\r\n assert (forall j:int :: 0 <= j && j < 256*1024 ==> \r\n fun_Seq__Index___int(fun_Seq__FromArray($absMem, code_words), j) == appCodeMem.map[0x340000 + j*4]);\r\n\r\n //- We expect the code to be here\r\n ecx := 0x340000;\r\n assert ecx == ?appCodeLo;\r\n call reveal_MemInvDetails(); //- Shows that ?appCodeLo is sane\r\n var code_start:int := ecx;\r\n call Store(inout stk, esp + 4, ecx);\r\n\r\n //- First arg from the boot loader is the entry of the app code\r\n ecx := 0x330400; //-0x32F800; //0x316800;\r\n assert ecx == ?argLo;\r\n call reveal_MemInvDetails(); //- Shows that ArgLo is sane\r\n call ecx := Load($argMem, ecx); \r\n var entry_point:int := ecx;\r\n call Store(inout stk, esp + 8, ecx);\r\n\r\n // pop return value #0 at index 0 into destination code_words isPtr = True\r\n // regalloc_stack_load:: EAX := OMem(MReg(ESP, 1052672)) // var = code_words 1437\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, ECX, OMem(MReg(ESP, 0x101000)), EvalPtr(r, OMem(MReg(ESP, 0x101000))));\r\n// var code_words:int := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, 0x101000))));\r\n\r\n// call Store(inout stk, esp + 12, ecx);\r\n call reveal_WORD_HI();\r\n\r\n var $result:int;\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $result :=\r\n Proc_Main(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, code_start, entry_point, code_words);\r\n call eax := Load(stk, esp);\r\n \r\n assert eax == entry_point;\r\n\r\nedi := eax; //- Save eax == entry_point\r\n#ifdef AppLoader\r\n esi := 0xdd00100;\r\n call serialDbgWordOut();\r\n call serialDbgNewlineOut();\r\n#endif\r\neax := edi; //- Restore eax == entry_point\r\n assert eax == entry_point;\r\n\r\n ebx := 0x32F000;\r\n ebx := ebx + 4096;\r\n ebx := ebx + 1024;\r\n ebx := ebx + 1024;\r\n ecx := ebx;\r\n edx := ecx;\r\n edx := edx + 1024;\r\n\r\n assert ecx == ?pciLo;\r\n assert edx == ?pciHi;\r\n ebx := eax;\r\n call checkIoFresh();\r\n eax := ebx;\r\n assert eax == entry_point;\r\n\r\n ecx := eax;\r\n eax := 0x340000;\r\n ebx := ecx;\r\n call reveal_Aligned(eax);\r\n if (ebx < eax) {\r\n eax := 0x555500a1;\r\n call debugBreak(); //- App entry is below start of app code\r\n }\r\n ebx := eax;\r\n ebx := ebx + 0x100000;\r\n assert ebx == code_start + 0x100000;\r\n if (ecx >= ebx) {\r\n eax := 0x555500a2;\r\n call debugBreak(); //- App entry is beyond end of app code\r\n }\r\n\r\n ebx := ecx;\r\n\r\n assert eax == code_start;\r\n assert ebx == entry_point;\r\n// assert code_start <= entry_point;\r\n// assert entry_point < code_start + 0x100000;\r\n assert code_start <= entry_point && entry_point < code_start + 0x100000;\r\n// assert ?CodeBase == 0x300000;\r\n// assert ?memLo == ?CodeBase + 58*1024;\r\n// assert code_start == 0x32FC00;\r\n// assert ?memLo < code_start;\r\n// assert ?memLo < code_start + 0x100000;\r\n// assert ?memHi >= code_start + 120*1024*1024;\r\n\r\n ecx := eax;\r\n ecx := ecx + 0x7B00000;\r\n esp := ecx;\r\n\r\n assert code_start == ?appCodeLo;\r\n assert ?gcLo == code_start + 0x101000;\r\n //assert ?gcHi == code_start + 123*1024*1024;\r\n\r\n linear var dat:mem;\r\n linear var arg:mem;\r\n linear var pci:mem;\r\n linear var gc:mem;\r\n linear var frm:mem;\r\n var frms:[int][int]int;\r\n linear var tcb:mem;\r\n var tcbs:[int][int]int;\r\n let mems(dat, arg, pci, gc, frm, frms, tcb, tcbs) := mems;\r\n\r\n linear var app_mem:mem;\r\n call app_mem := memEmpty();\r\n call gc, app_mem := memTransfer(gc, app_mem, (lambda i:int :: code_start + 0x101000 <= i && i < 0x08000000));\r\n\r\n call logical_inv_is_flat();\r\n assert core_state.seg_regs[SS].descriptor.segBase == 0 && \r\n core_state.seg_regs[SS].descriptor.segType == ?SegmentDescriptorTypeData;\r\n assert core_state.seg_regs[DS].descriptor.segBase == 0 && \r\n core_state.seg_regs[DS].descriptor.segType == ?SegmentDescriptorTypeData;\r\n\r\n call proc_Seq__FromArray__Index();\r\n\r\n assert (forall j:int :: 0 <= j && j < 256*1024 ==> \r\n fun_Seq__Index___int(fun_Seq__FromArray($absMem, code_words), j) == appCodeMem.map[code_start + j*4]);\r\n\r\n //assert (forall i:int:: code_start + 0x100800 <= i && i < code_start + 123*1024*1024 <==> gc.dom[i]);\r\n\r\n edi := eax; //- Save EAX\r\n ebp := ebx; //- Save EBX\r\n#ifdef AppLoader\r\n esi := 0xdd0f000;\r\n call serialDbgWordOut();\r\n call serialDbgNewlineOut();\r\n#endif\r\n eax := edi; //- restore\r\n ebx := ebp; //- restore\r\n\r\n //- Transfer all of the bootloader args from our arg region to the app's\r\n ecx := 0x330400; \r\n assert ecx == ?argLo;\r\n call reveal_MemInvDetails(); //- Shows that ArgLo is sane\r\n// call ecx := Load($argMem, ecx); \r\n edx := ecx;\r\n edx := edx + 1024;\r\n assert edx == ?argHi;\r\n edi := 0x340000;\r\n edi := edi + 0x100000;\r\n edi := edi + 0x1F000; //- App's ?sLo\r\n edi := edi + 4096; //- App's dLo\r\n edi := edi + 1024; //- App's dHi/argLo\r\n\r\n var ctr:int := 0;\r\n\r\n \r\n call reveal_Aligned(0x330400);\r\n call reveal_Aligned(0x340000 + 0x100000 + 0x1F000 + 4096 + 1024);\r\nassert EvalPtrOk(OMem(MReg(EDI, 0)));\r\nassert Aligned(EvalPtr(r, OMem(MReg(EDI, 0))));\r\nassert PhysPtrOk(app_mem, EvalPtr(r, OMem(MReg(EDI, 0))));\r\nassert word(EvalPtr(r, OMem(MReg(EDI, 0))));\r\n\r\n while (ecx < edx) \r\n invariant edx == ?argHi;\r\n invariant 0 <= ctr && ctr <= 256;\r\n invariant ecx == ?argLo + ctr * 4;\r\n invariant edi == 0x340000 + 0x100000 + 0x1F000 + 4096 + 1024 + ctr * 4;\r\n invariant ?argLo <= ecx && ecx <= ?argHi;\r\n invariant ?gcLo <= edi && edi < ?gcHi;\r\n invariant ecx < edx ==> LogicalSrcOk(r, core_state, arg, OMem(MReg(ECX, 0)));\r\n invariant !init;\r\n invariant (forall j:int :: app_mem.dom[j] == (code_start + 0x101000 <= j && j < 0x08000000));\r\n invariant ecx < edx ==> LogicalDstOk(init, r, core_state, app_mem, OMem(MReg(EDI, 0)));\r\n invariant eax == code_start;\r\n invariant ebx == entry_point;\r\n invariant public(ctr);\r\n invariant public(io._inCtr);\r\n invariant public(io._outCtr);\r\n {\r\n assert TV(?argLo) && TO(ctr);\r\n assert TV(0x340000 + 0x100000 + 0x1F000 + 4096 + 1024) && TO(ctr);\r\n\r\n call ebp := Load(arg, ecx); \r\n call Store(inout app_mem, edi, ebp);\r\n \r\n ecx := ecx + 4;\r\n edi := edi + 4;\r\n ctr := ctr + 1;\r\n assert TV(?argLo) && TO(ctr);\r\n assert TV(0x340000 + 0x100000 + 0x1F000 + 4096 + 1024) && TO(ctr);\r\n \r\nassert EvalPtrOk(OMem(MReg(EDI, 0)));\r\nassert Aligned(EvalPtr(r, OMem(MReg(EDI, 0))));\r\nassert PhysPtrOk(app_mem, EvalPtr(r, OMem(MReg(EDI, 0))));\r\nassert word(EvalPtr(r, OMem(MReg(EDI, 0))));\r\n }\r\n assert eax == code_start;\r\n assert ebx == entry_point;\r\n\r\n //- Readjust esp\r\n ecx := eax;\r\n ecx := ecx + 0x7B00000;\r\n esp := ecx;\r\n\r\n call instr_Launch(r, core_state, initState, app_mem, appCodeMem, io, entry_point, code_start, fun_Seq__FromArray($absMem, code_words)) ;\r\n\r\n\r\n\r\n\r\n#else\r\n#ifndef AppLoader\r\n esi := 0xaa00100;\r\n call serialDbgWordOut();\r\n call serialDbgNewlineOut();\r\n#endif\r\n\r\n //- Call the Main Dafny procedure with contains all of the app logic\r\n var $result:int;\r\n ecx := 5;\r\n call Store(inout stk, esp + 4, ecx);\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $result :=\r\n Proc_Main(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap);\r\n call eax := Load(stk, esp);\r\n edx := 140;\r\n call writeHex();\r\n\r\n#ifndef AppLoader\r\n esi := 0xaa01000;\r\n call serialDbgWordOut();\r\n call serialDbgNewlineOut();\r\n#endif\r\n\r\n ebp := 0;\r\n call GarbageCollect();\r\n\r\n#endif\r\n\r\nmyInfLoop:\r\n invariant logical_addressing_inv(init, ptMem, core_state);\r\n// eax := 0x12345678;\r\n// edx := 140;\r\n// call writeHex();\r\n goto myInfLoop;\r\n \r\n////Can no longer turn on paging, since we don't have enough space!\r\n//\r\n// // Test out paging **************\r\n// \r\n// // Check that there's enough rooom for page tables\r\n// // 0x402000 = ?pageDirSize + ?numPDEs * ?pageTableSize + 4096 (padding to ensure 4k aligned)\r\n// eax := ecx;\r\n// call eax := AddChecked(eax, 0x402000); \r\n// if (eax >= edx) {\r\n// call debugBreak();\r\n// }\r\n//\r\n// // Adjust to ensure we're 4k aligned\r\n// eax := ecx;\r\n// call eax := And(eax, 0xFFFFF000);\r\n// call clear_12_lemma();\r\n// assert(eax == ClearLSBs(12, ecx));\r\n// call clear_select_consistent_lemma();\r\n// assert(Aligned4k(eax));\r\n// assert(aligned4k(eax));\r\n// call clear_less_than_equal_lemma();\r\n// assert(le(eax, ecx));\r\n// call eax := Add(eax, 0x1000);\r\n// assert(eax == add(ClearLSBs(12, ecx), 0x1000));\r\n// call alignment_4k_is_mod4096_lemma();\r\n//\r\n// // eax points to the address at which we want to build all of our page tables\r\n// assert aligned4k(eax);\r\n// call enablePaging(eax);\r\n//\r\n// call setInit();\r\n//// // Try writing to the guard region\r\n//// eax := 4095;\r\n//// call ecx := RoLoad32(eax);\r\n\r\n// call initializeSerialPort();\r\n//serialInfLoop:\r\n// ecx := 0x4a;\r\n// call serialDbgDataOut8();\r\n// goto serialInfLoop;\r\n\r\n eax := 0;\r\n edx := 0;\r\n ebx := 0;\r\n edi := 0;\r\n ebp := 0;\r\n\r\n edx := 0;\r\n call writeHex();\r\n\r\n //ecx := 10;\r\n //call core, mems, $r := Proc_pad_one_block(core, mems, 10);\r\n //call core, mems := Proc_one_time_pad(core, mems);\r\n\r\n pagingTestLoop:\r\n invariant logical_addressing_inv(init, ptMem, core_state);\r\n invariant init;\r\n eax := 0x98765432;\r\n edx := 20;\r\n call writeHex();\r\n goto pagingTestLoop;\r\n\r\n // End paging test ***************\r\n\r\n// var idtLo @ stk[esp + 0] := ebx;\r\n//\r\n// // Set up interrupt table\r\n// var entry@edi := 0;\r\n// var ptr@esi := idtLo;\r\n// while (entry < 256)\r\n// invariant entry >= 0 && TV(entry);\r\n// invariant ptr == idtLo + 8 * entry;\r\n// invariant (forall i:int::{TV(i)} TV(i) ==> 0 <= i && i < entry ==>\r\n// $IdtMemOk[?idtLo + 8 * i] && $IdtMemOk[?idtLo + 8 * i + 4]);\r\n// invariant MemInv($Mem_Vars);\r\n// invariant esp == DLo - 12;\r\n// {\r\n// var handler @ stk[esp + 4];\r\n////\r\n//// if (entry == 0) { handler := ?FaultHandler; }\r\n//// else {if(entry == 3) { handler := ?FaultHandler; }\r\n//// else {if(entry == 4) { handler := ?FaultHandler; }\r\n//// else {if(entry == 13) { handler := ?ErrorHandler; }\r\n//// else {if(entry == 14) { handler := ?ErrorHandler; }\r\n//// else {if(entry < 32) { handler := ?FatalHandler; }\r\n//// else { handler := ?InterruptHandler; }}}}}}\r\n////\r\n// handler := ?FatalHandler;\r\n//\r\n// edx := handler;\r\n// call edx := And(edx, 0x0000ffff);\r\n// ecx := 0x20;\r\n// call ecx := Shl(ecx, 16);\r\n// call ecx := Or(ecx, edx);\r\n// assert ecx == or(shl(?CodeSegmentSelector, 16), and(handler, ?Mask16Lo));\r\n// call IdtStore(entry, 0, handler, ptr, ecx);\r\n//\r\n// ecx := handler;\r\n// edx := 0xffff0000;\r\n// call ecx := And(ecx, edx);\r\n// call ecx := Or(ecx, 0x8e00);\r\n// call IdtStore(entry, 4, handler, ptr + 4, ecx);\r\n//\r\n// ptr := ptr + 8;\r\n// entry := entry + 1;\r\n// }\r\n//\r\n// // Set IDT register\r\n// ecx := idtLo;\r\n// edi := DLo;\r\n// call ecx := Shl(ecx, 16);\r\n// call ecx := Or(ecx, 2047);\r\n// call Store(mems.dat[edi], ecx);\r\n// ecx := idtLo;\r\n// call ecx := Shr(ecx, 16);\r\n// assert TV(DLo) && TO(1);\r\n// call Store(mems.dat[edi + 4], ecx);\r\n// call Lidt(edi);\r\n//\r\n// // Set up PIC\r\n// eax := 0x11; edx := 0x20; call PicOut8(0, 0, 0);\r\n// eax := 0x11; edx := 0xa0; call PicOut8(1, 0, 0);\r\n// eax := 0x70; edx := 0x21; call PicOut8(0, 1, 1);\r\n// eax := 0x78; edx := 0xa1; call PicOut8(1, 1, 1);\r\n// eax := 0x04; edx := 0x21; call PicOut8(0, 1, 2);\r\n// eax := 0x02; edx := 0xa1; call PicOut8(1, 1, 2);\r\n// eax := 0x01; edx := 0x21; call PicOut8(0, 1, 3);\r\n// eax := 0x01; edx := 0xa1; call PicOut8(1, 1, 3);\r\n// eax := 0xfe; edx := 0x21; call PicOut8(0, 1, 4);\r\n// eax := 0xff; edx := 0xa1; call PicOut8(1, 1, 4);\r\n// eax := 0x20; edx := 0x20; call PicOut8(0, 0, 5);\r\n// eax := 0x20; edx := 0xa0; call PicOut8(1, 0, 5);\r\n//\r\n// // Set up PCI table\r\n// entry := 0;\r\n// ptr := PciLo;\r\n// while (entry < 65536)\r\n// invariant 0 <= entry && entry <= 65536;\r\n// invariant ptr == PciLo + 8 * entry;\r\n// invariant (forall i:int::{TV(i)} TV(i) ==> 0 <= i && i < entry ==>\r\n// $pciMem[PciLo + 8 * i] == 0 && $PciConfigState[i] == 0);\r\n// invariant MemInv($Mem_Vars);\r\n// invariant esp == DLo - 12;\r\n// {\r\n// assert TV(PciLo) && TO(entry * 2);\r\n// call Store(mems.pci[ptr], 0);\r\n// entry := entry + 1;\r\n// ptr := ptr + 8;\r\n// }\r\n// call reveal_IoInv();\r\n//\r\n// // Set up IO-MMU tables\r\n// assert TV(?memLo) && TO(0 - 18 * 256 * 1024);\r\n// ecx := idtLo; ecx := ecx + 2048;\r\n// call SetupIoTables();\r\n// ebx := eax;\r\n//\r\n// // Set up IO-MMU\r\n// ebp := idtLo; ebp := ebp + 0x10800;\r\n// call StartIoMmu();\r\n//\r\n// // Set initial timer\r\n// ecx : = 0;\r\n// call startTimer();\r\n//\r\n// // Set state of all managed stacks to empty\r\n// var s @ stk[esp + 8] := 0;\r\n// ecx := TLo;\r\n// while (s < ?NumStacks)\r\n// invariant s >= 0;\r\n// invariant ecx == ?tLo + s * ?TSize;\r\n// invariant Aligned(ecx);\r\n// invariant (forall $s:int::{TStk($s)} TStk($s) ==> $s < s ==> isStack($s) ==> StackTag($s, $tMems) == ?STACK_EMPTY);\r\n// invariant MemInv($Mem_Vars);\r\n// invariant esp == DLo - 12;\r\n// invariant IoInv($IoVars, $pciMem);\r\n// {\r\n// assert TV(ecx) && TO(2) && TO(64);\r\n// call Store(mems.tcb[s][ecx], ?STACK_EMPTY);\r\n// ecx := ecx + ?TSize;\r\n// call s := Add(s, 1);\r\n// }\r\n//\r\n// esi := 0;\r\n// infloop:\r\n// edx := 140;\r\n// call esi := LeaUnchecked(esi + 1);\r\n// eax := esi;\r\n// call writeHex();\r\n// goto infloop;\r\n//\r\n// // Initialize GC\r\n// call initCommon();\r\n// CurrentStack := ?InitialStack;\r\n// ebp := 0;\r\n//\r\n// // assert $S == ?InitialStack;\r\n// // assert (forall $s:int::{$StackState[$s]} 0 <= $s && $s < ?NumStacks ==> StackStateTag($StackState[$s]) == ?STACK_EMPTY);\r\n// // assert (forall i:int::{TV(i)} $toAbs[i] == NO_ABS);\r\n// call InitializeGc();\r\n//\r\n// // Switch to initial managed stack\r\n// eax := FLo; eax := eax + ?StackReserve; eax := eax + ?InterruptReserve;\r\n// StackCheck := eax;\r\n// assert FLo == ?fLo;\r\n// esp := FLo; esp := esp + ?FSize; esp := esp - 8;\r\n// assert TV(FLo) && TO(4094) && TO(4095);\r\n// edi := TLo;\r\n// assert TV(TLo) && TO(2);\r\n//\r\n// ecx := ?KernelEntryPoint;\r\n// call setStackRunning1(0);\r\n// ebp := 0;\r\n//\r\n// return;\r\n//*/\r\n edx := 140;\r\n call writeHex();\r\n\r\n eax := 0x55550001;\r\n call debugBreak();\r\n\r\n // not reached\r\n return;\r\n}\r\n\r\n\r\n//procedure BuildCodeWordArray();\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars;\r\n// inout $absMem:[int][int]int, $toAbs:[int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout;\r\n// requires NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n// requires SMemRequireRA(212, stk, esp, RET);\r\n// modifies efl, eax, ebx, ecx, esp, stk;\r\n// // postcondition same as precondition, plus reached:\r\n// ensures NucleusInv(objLayouts, $S, $toAbs, $absMem, GcVars, $Mem_Vars, $stacksFrames, $IoVars);\r\n// ensures SMemEnsure(stk, old(stk), esp, old(esp));\r\n//{\r\n//\r\n//\r\n//}\r\n\r\n#ifdef AppLoader\r\nconst stack_size__DafnyCC__Proc_ArrayAlloc:int := 4 + max(stack_size__DafnyCC__Proc_AllocArrayOfInt + 4, 0);\r\nprocedure Proc_ArrayAlloc(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, const linear appCodeMem:mem) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_arr:ArrayOfInt);\r\n requires MemInv(me,init,stk_old,statics_old,core_state,ptMem,mems_old);\r\n requires (forall i:int::{appCodeAddr(i)}{appCodeMem.dom[i]} appCodeMem.dom[i] == appCodeAddr(i));\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk_old,statics_old,core_state,ptMem,mems_old,$stacksFrames_old,io_old);\r\n requires SMemRequireGcRA(stack_size__DafnyCC__Proc_ArrayAlloc, 4, stk_old, r_old.regs[ESP], RET);\r\n requires HeapInv($absMem_old, objLayouts_old, heap_old);\r\n modifies $Time;\r\n ensures r.regs[ESP] == old(r_old.regs[ESP]) + 4;\r\n ensures MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n ensures SMemEnsureGcF(4, stk, old(stk_old), r.regs[ESP], old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n ensures HeapInv($absMem, objLayouts, heap);\r\n ensures AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n ensures (forall i:int::{$absMem[i]}{heap.absData[i]} heap_old.absData[i] is AbsNone || (heap.absData[i] == heap_old.absData[i] && ($absMem[i] == $absMem_old[i])));\r\n ensures io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n ensures (heap_old.absData[$ghost_arr.arrAbs] is AbsNone);\r\n ensures $ghost_arr != (ArrayOfInt(0 - 1, NO_ABS));\r\n ensures ((Arr_Length($ghost_arr))) == 262144;\r\n ensures (forall j:int :: 0 <= j && j < Arr_Length($ghost_arr) ==> fun_INTERNAL__array__elems__index($absMem[$ghost_arr.arrAbs], j) == appCodeMem.map[0x340000 + j*4]);\r\n ensures fun_IsWordSeq(fun_Seq__FromArray($absMem, $ghost_arr));\r\n ensures StackAbsSlot(heap, $stacksFrames, r_old.regs[ESP] + 4 + stackGcOffset) == Abs_ArrayOfInt($ghost_arr);\r\n ensures frameGet($stacksFrames, r_old.regs[ESP] + 4 + stackGcOffset) == $ghost_arr.arrAbs;\r\n{\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var $ghost__temp__0:int;\r\n var $ghost_i:int;\r\n var $ghost_arr__abs:int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n call proc_Seq__FromArray__Length();\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n assert TV(r.regs[ESP]);\r\n assert TO(0 - 1);\r\n assert TO(263168 - 1);\r\n assert TO(0);\r\n assert TO(263168);\r\n assert TO(1);\r\n assert TO(263169);\r\n assert TO(0x443FF);\r\n assert TO(0x44400);\r\n assert TO(0x44401);\r\n assert TO(0x44402);\r\n call logical_Sub(inout r, ESP, OConst(4));\r\n\r\n // ###LINE: D:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Apps\\Loader\\Loader.i.dfy: 40\r\n // ###LINE: D:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Apps\\Loader\\Loader.i.dfy: 40\r\n // move:: $ghost__temp__0 := 262144 // isPtr = False\r\n call r := instr_Mov(r, EAX, OConst(262144));\r\n $ghost__temp__0 := r.regs[EAX];\r\n\r\n // push argument #0 at index 0 isPtr = False argument = $ghost__temp__0\r\n // regalloc_stack_store:: OMem(MReg(ESP, 0)) := EAX // var = $ghost__temp__0\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 0)), OReg(EAX));\r\n\r\n // call:: $ghost_arr := Proc_AllocArrayOfInt($ghost__temp__0) // isGhost = False\r\n call alignCall(r.regs[ESP]);\r\n {: call logical_Call(inout r, core_state, inout stk);\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_arr := Proc_AllocArrayOfInt(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost__temp__0); :}\r\n assert SMemInvGcF(8, stk, old(stk_old), r.regs[ESP] + 4, old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n\r\n // pop return value #0 at index 0 into destination $ghost_arr isPtr = True\r\n // regalloc_stack_load:: EAX := OMem(MReg(ESP, 0x101000)) // var = $ghost_arr 1437\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EAX, OMem(MReg(ESP, 0x111000)), EvalPtr(r, OMem(MReg(ESP, 0x111000))));\r\n $ghost_arr__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, 0x111000))));\r\n\r\n // ###LINE: D:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Apps\\Loader\\Loader.i.dfy: 41\r\n // ###LINE: D:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Apps\\Loader\\Loader.i.dfy: 41\r\n // ###LINE: D:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Apps\\Loader\\Loader.i.dfy: 41\r\n // ###LINE: D:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Apps\\Loader\\Loader.i.dfy: 41\r\n // move:: $ghost_i := 0 // isPtr = False\r\n call r := instr_Mov(r, ECX, OConst(0));\r\n $ghost_i := r.regs[ECX];\r\n\r\n // ###LINE: D:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Apps\\Loader\\Loader.i.dfy: 42\r\n // jump_to_label:: L2 condition = \r\n goto L2;\r\n\r\n // label:: L1 // isLoop = False\r\n L1:\r\n\r\n // ###LINE: D:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Apps\\Loader\\Loader.i.dfy: 45\r\n // ###LINE: D:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Apps\\Loader\\Loader.i.dfy: 46\r\n // ###LINE: D:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Apps\\Loader\\Loader.i.dfy: 46\r\n // storeArrayElement\r\n\r\n // New code:\r\n var foo:int := eax;\r\n var bar:int := ecx;\r\n ebp := eax; // Save the contents of eax\r\n esi := ecx; // Save the contents of ecx\r\n ebx := ecx; \r\n ecx := 0x340000;\r\n eax := ebx;\r\n assert eax == $ghost_i;\r\n edi := 4;\r\n call eax,edx := Mul(eax, edi);\r\n assert TVM($ghost_i, 4);\r\n call reveal_wrap32($ghost_i*4);\r\n assert eax == $ghost_i*4;\r\n call reveal_WORD_HI();\r\n ecx := ecx + eax;\r\n call reveal_MemInvDetails(); // Shows that ecx is sane\r\n call reveal_Aligned(0x340000);\r\n assert TV(0x340000) && TO(ebx);\r\n call ecx := Load(appCodeMem, ecx);\r\n edi := ecx; // Save the value we loaded\r\n\r\n eax := ebp; // Restore eax\r\n ecx := esi; // Restore ecx\r\n assert foo == eax;\r\n assert bar == ecx;\r\n // End new code\r\n \r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MIndex(EAX, 4, ECX, 8)), OReg(EDI), $ghost_i, appCodeMem.map[0x340000+$ghost_i*4], $ghost_arr__abs, r.regs[EAX]);\r\n\r\n // ###LINE: D:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Apps\\Loader\\Loader.i.dfy: 47\r\n // ###LINE: D:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Apps\\Loader\\Loader.i.dfy: 47\r\n // binary_assignment:: $ghost_i := instr_AddChecked($ghost_i, )\r\n call r := instr_AddChecked(r, ECX, OConst(1));\r\n $ghost_i := r.regs[ECX];\r\n\r\n call proc_lemma__2toX();\r\n call proc_lemma__word32(edi);\r\n call reveal_WORD_HI();\r\n\r\n // label:: L2 // isLoop = True\r\n L2:\r\n invariant MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n invariant NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n invariant SMemInvGcF(8, stk, old(stk_old), r.regs[ESP] + 4, old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n invariant HeapInv($absMem, objLayouts, heap);\r\n invariant AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n invariant (forall i:int::{$absMem[i]}{heap.absData[i]} heap_old.absData[i] is AbsNone || (heap.absData[i] == heap_old.absData[i] && ($absMem[i] == $absMem_old[i])));\r\n invariant io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n\r\n // loop invariants\r\n invariant $ghost_i == (r.regs[ECX]);\r\n invariant HeapAbsData(heap, $ghost_arr__abs) == Abs_ArrayOfInt($ghost_arr);\r\n invariant HeapValue(objLayouts, true, $toAbs, r.regs[EAX], $ghost_arr__abs);\r\n invariant $ghost_arr__abs == $ghost_arr.arrAbs;\r\n invariant 0 <= $ghost_i && $ghost_i <= 262144;\r\n invariant (forall j:int :: 0 <= j && j < $ghost_i ==> fun_INTERNAL__array__elems__index($absMem[$ghost_arr.arrAbs], j) == appCodeMem.map[0x340000 + j*4]);\r\n invariant (forall j:int :: 0 <= j && j < $ghost_i ==> fun_word32(fun_INTERNAL__array__elems__index($absMem[$ghost_arr.arrAbs], j)));\r\n //invariant (forall j:int :: 0 <= j && j < $ghost_i ==> word(fun_INTERNAL__array__elems__index($absMem[$ghost_arr.arrAbs], j)));\r\n assert !false;\r\n call proc_Seq__Equal__Equiv___int();\r\n call proc_Seq__Equal__Equiv___Seq___int();\r\n call proc_Seq__Equal__Equiv___atoe_Type();\r\n call proc_Seq__Equal__Equiv___Seq___atoe_Type();\r\n call proc_Seq__Equal__Equiv___bool();\r\n // jump_to_label:: L1 condition = $ghost_i < 262144\r\n if (ecx < 0x40000) {\r\n goto L1;\r\n }\r\n\r\n // label:: L3 // isLoop = False\r\n L3:\r\n\r\n // regalloc_stack_store:: OMem(MReg(ESP, 4104)) := EAX // var = $ghost_arr\r\n call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 0x111008)), OReg(EAX), EvalPtr(r, OMem(MReg(ESP, 0x111008))), $ghost_arr__abs);\r\n call logical_Add(inout r, ESP, OConst(4));\r\n\r\n call proc_Seq__FromArray__Index();\r\n call proc_lemma__word32__Word32();\r\n assert (forall j:int :: 0 <= j && j < 262144 ==> word(fun_INTERNAL__array__elems__index($absMem[$ghost_arr.arrAbs], j)));\r\n assert (forall j:int :: 0 <= j && j < 262144 ==> fun_Word32(fun_INTERNAL__array__elems__index($absMem[$ghost_arr.arrAbs], j)));\r\n\r\n // return\r\n {: call logical_Ret(inout r, core_state, stk); return; :}\r\n}\r\n#endif\r\n\r\n//implementation FaultHandler($_stackState:[int]StackState, $ebp:int, $esp:int, $eip:int)\r\n//{\r\n// var $__stackState:[int]StackState := $StackState[$S := StackEmpty];\r\n// call revealInv1($S, $StackState);\r\n//\r\n// eax := CurrentStack;\r\n// edx := ?TSize;\r\n// call eax, edx := Mul(eax, edx);\r\n// call eax := Add(eax, TLo);\r\n// assert TV(TLo) && TO(64 * $S);\r\n//\r\n// call setStackEmpty($S);\r\n// call revealInv1(?InterruptStack, $__stackState);\r\n//\r\n// ecx := FLo;\r\n// call ecx := Add(ecx, ?StackReserve);\r\n// call ecx := Add(ecx, ?InterruptReserve);\r\n// StackCheck := ecx;\r\n//\r\n// ecx := 0;\r\n// edi := TLo;\r\n// call ebx := Load(mems.tcb[?InterruptStack][edi]);\r\n// if (ebx != ?STACK_YIELDED)\r\n// {\r\n// // Fatal error: interrupt stack not ready to receive interrupt\r\n// eax := 0x55550004;\r\n// call debugBreak();\r\n// }\r\n//\r\n// call setStackRunning3(?InterruptStack, $__stackState, $ebp, $esp, $eip);\r\n// return;\r\n//}\r\n//\r\n//implementation ErrorHandler($_stackState:[int]StackState, $ebp:int, $esp:int, $eip:int)\r\n//{\r\n// var $__stackState:[int]StackState := $StackState[$S := StackEmpty];\r\n// call revealInv1($S, $StackState);\r\n//\r\n// eax := CurrentStack;\r\n// edx := ?TSize;\r\n// call eax, edx := Mul(eax, edx);\r\n// call eax := Add(eax, TLo);\r\n// assert TV(TLo) && TO(64 * $S);\r\n//\r\n// call setStackEmpty($S);\r\n// call revealInv1(?InterruptStack, $__stackState);\r\n//\r\n// ecx := FLo;\r\n// call ecx := Add(ecx, ?StackReserve);\r\n// call ecx := Add(ecx, ?InterruptReserve);\r\n// StackCheck := ecx;\r\n//\r\n// ecx := 0;\r\n// edi := TLo;\r\n// call ebx := Load(mems.tcb[?InterruptStack][edi]);\r\n// if (ebx != ?STACK_YIELDED)\r\n// {\r\n// // Fatal error: interrupt stack not ready to receive interrupt\r\n// eax := 0x55550005;\r\n// call debugBreak();\r\n// }\r\n//\r\n// call setStackRunning3(?InterruptStack, $__stackState, $ebp, $esp, $eip);\r\n// return;\r\n//}\r\n//\r\n//implementation InterruptHandler($_stackState:[int]StackState, $ebp:int, $esp:int, $eip:int)\r\n//{\r\n// var $__stackState:[int]StackState :=\r\n// $StackState[$S := StackInterrupted(eax, ebx, ecx, edx, esi, edi, ebp, esp + 12, $Mem[esp], $Mem[esp + 4], $Mem[esp + 8])];\r\n// call stacksProofs();\r\n// call setStackInterrupted();\r\n// call revealInv1(?InterruptStack, $__stackState);\r\n//\r\n// ecx := FLo;\r\n// call ecx := Add(ecx, ?StackReserve);\r\n// call ecx := Add(ecx, ?InterruptReserve);\r\n// StackCheck := ecx;\r\n//\r\n// ecx := 0;\r\n// edi := TLo;\r\n// call ebx := Load(mems.tcb[?InterruptStack][edi]);\r\n// if (ebx != ?STACK_YIELDED)\r\n// {\r\n// // Fatal error: interrupt stack not ready to receive interrupt\r\n// eax := 0x55550006;\r\n// call debugBreak();\r\n// }\r\n//\r\n// call setStackRunning3(?InterruptStack, $__stackState, $ebp, $esp, $eip);\r\n// return;\r\n//}\r\n//implementation Throw($_stackState:[int]StackState, $ebp:int, $esp:int, $eip:int)\r\n//{\r\n// var $__stackState:[int]StackState := $StackState[$S := StackEmpty];\r\n// call revealInv1($S, $StackState);\r\n//\r\n// eax := CurrentStack;\r\n// edx := ?TSize;\r\n// call eax, edx := Mul(eax, edx);\r\n// call eax := Add(eax, TLo);\r\n// assert TV(TLo) && TO(64 * $S);\r\n//\r\n// //assert&&& &&&(NucleusInv(objLayouts, $S, $StackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $FrameVars, $IoVars));\r\n// call setStackEmpty($S);\r\n// call revealInv1(?InterruptStack, $__stackState);\r\n//\r\n// eax := FLo;\r\n// call eax := Add(eax, ?StackReserve);\r\n// call eax := Add(eax, ?InterruptReserve);\r\n// call setStackCheck($__stackState);\r\n//\r\n// ecx := 0;\r\n// edi := TLo;\r\n// call ebx := Load(mems.tcb[?InterruptStack][edi]);\r\n// if (ebx != ?STACK_YIELDED)\r\n// {\r\n// // Fatal error: interrupt stack not ready to receive interrupt\r\n// eax := 0x55550003;\r\n// call debugBreak();\r\n// }\r\n//\r\n// call stacksProofs();\r\n// call setStackRunning3(?InterruptStack, $__stackState, $ebp, $esp, $eip);\r\n// return;\r\n//}\r\n\r\n//implementation FatalHandler()\r\n//{\r\n// eax := 0x55550007;\r\n// call debugBreak();\r\n// return;\r\n//}\r\n\r\n//implementation GetStackState($s:int)\r\n//{\r\n// if (ecx >= ?NumStacks)\r\n// {\r\n// eax := 0x55550009;\r\n// call debugBreak();\r\n// }\r\n// call revealInv1($s, $StackState);\r\n//\r\n// // Get $s state\r\n// eax := ecx;\r\n// edx := ?TSize;\r\n// call eax, edx := Mul(eax, edx);\r\n// call eax := Add(eax, TLo);\r\n// assert TV(TLo) && TO(64 * $s);\r\n// call eax := Load(mems.tcb[$s][eax]);\r\n// return;\r\n//}\r\n//\r\n//implementation ResetStack($s:int)\r\n//{\r\n// call stacksProofs();\r\n// if (ecx >= ?NumStacks)\r\n// {\r\n// eax := 0x55550009;\r\n// call debugBreak();\r\n// }\r\n// call revealInv1($s, $StackState);\r\n//\r\n// // Get $s state\r\n// eax := ecx;\r\n// edx := ?TSize;\r\n// call eax, edx := Mul(eax, edx);\r\n// call eax := Add(eax, TLo);\r\n// assert TV(TLo) && TO(64 * $s);\r\n// call ebx := Load(mems.tcb[$s][eax]);\r\n//\r\n// if (ebx == ?STACK_RUNNING)\r\n// {\r\n// // Can't reset our own stack\r\n// eax := 0x5555000a;\r\n// call debugBreak();\r\n// }\r\n//\r\n// call setStackEmpty($s);\r\n// return;\r\n//}\r\n//\r\n//\r\n//implementation YieldTo($s:int, $_stackState:[int]StackState,\r\n// $eax:int, $ebx:int, $ecx:int, $edx:int, $esi:int, $edi:int, $ebp:int, $esp:int,\r\n// $eip:int, $cs:int, $efl:int)\r\n//{\r\n// call stacksProofs();\r\n// if (ecx >= ?NumStacks)\r\n// {\r\n// eax := 0x55550008;\r\n// call debugBreak();\r\n// }\r\n//\r\n// var $__stackState:[int]StackState := $StackState[$S := StackYielded(ebp, esp + 4, $Mem[esp])];\r\n// call revealInv1($s, $StackState);\r\n//\r\n// // Set stack check limit\r\n// eax := ecx;\r\n// edx := ?FSize;\r\n// call eax, edx := Mul(eax, edx);\r\n// call eax := Add(eax, FLo);\r\n// call eax := Add(eax, ?StackReserve);\r\n// call eax := Add(eax, ?InterruptReserve);\r\n// call setStackCheck($StackState);\r\n//\r\n// // Get $s state\r\n// eax := ecx;\r\n// edx := ?TSize;\r\n// call eax, edx := Mul(eax, edx);\r\n// call eax := Add(eax, TLo);\r\n// assert TV(TLo) && TO(64 * $s);\r\n// call ebx := Load(mems.tcb[$s][eax]);\r\n// edi := eax;\r\n//\r\n// // Prepare to set $S state if necessary\r\n// eax := CurrentStack;\r\n// edx := ?TSize;\r\n// call eax, edx := Mul(eax, edx);\r\n// call eax := Add(eax, TLo);\r\n// assert TV(TLo) && TO(64 * $S);\r\n//\r\n// if (ebx == ?STACK_YIELDED)\r\n// {\r\n// call setStackYielded();\r\n// call setStackRunning3($s, $__stackState, $ebp, $esp, $eip);\r\n// return;\r\n// }\r\n// else {if(ebx == ?STACK_INTERRUPTED)\r\n// {\r\n// call setStackYielded();\r\n// call setStackRunning4($s, $__stackState, $eax, $ebx, $ecx, $edx, $esi, $edi, $ebp, $esp, $eip, $cs, $efl);\r\n// ireturn;\r\n// }\r\n// else {if(ebx == ?STACK_EMPTY)\r\n// {\r\n// call setStackYielded();\r\n//\r\n// eax := ecx;\r\n// edx := ?FSize;\r\n// call eax, edx := Mul(eax, edx);\r\n// call eax := Add(eax, FLo);\r\n// assert TV(FLo) && TO($s * 4096 + 4094) && TO($s * 4096 + 4095);\r\n// call esp := Lea(eax + 16376);\r\n// eax := ?KernelEntryPoint;\r\n// call setStackRunning2($s, $__stackState);\r\n// ebp := 0;\r\n// return;\r\n// }}}\r\n// // ebx == ?STACK_RUNNING\r\n// return;\r\n//}\r\n//\r\n//implementation VgaTextWrite()\r\n//{\r\n// if (ecx < 4000)\r\n// {\r\n// call VgaTextStore16(ecx + 1 * ecx + 0xb8000, edx);\r\n// }\r\n// return;\r\n//}\r\n//\r\n//implementation TryReadKeyboard()\r\n//{\r\n// call /*eax := */ KeyboardStatusIn8();\r\n// call eax := And(eax, 1);\r\n// if (eax != 0) { goto skip; }\r\n// call eax:=Mov(256);\r\n// return;\r\n// skip:\r\n// call /*eax := */ KeyboardDataIn8();\r\n// call eax := And(eax, 255);\r\n// return;\r\n//}\r\n//\r\n//implementation StartTimer()\r\n//{\r\n// call startTimer();\r\n// return;\r\n//}\r\n//\r\n//implementation SendEoi()\r\n//{\r\n// var $seq0:int := $PicSeq[0] + 1;\r\n// var $seq1:int := $PicSeq[1] + 1;\r\n// eax := 0x20; edx := 0x20; call PicOut8(0, 0, $seq0);\r\n// eax := 0x20; edx := 0xa0; call PicOut8(1, 0, $seq1);\r\n// return;\r\n//}\r\n//implementation CycleCounter()\r\n//{\r\n// call Rdtsc();\r\n// return;\r\n//}\r\n//\r\n//implementation DebugPrintHex()\r\n//{\r\n// if (ecx >= 72)\r\n// {\r\n// eax := 0x5555000b;\r\n// call debugBreak();\r\n// }\r\n// eax := edx;\r\n// call edx := Lea(ecx + ecx);\r\n// call writeHex();\r\n// return;\r\n//}\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/IntLemmasMain.ifc.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IntSpec;\r\n//-private-import BitVectorLemmasMain;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface IntLemmasMain\r\n{\r\n\r\natomic ghost procedure proc_XorLemmas();\r\n ensures (forall x:int::xor(x, x) == 0);\r\n ensures (forall x:int::word(x) ==> xor(x, 0) == x);\r\n ensures (forall x:int, y:int::xor(x, y) == xor(y, x));\r\n ensures (forall x:int, y:int, z:int:: xor(x, xor(y,z)) == xor(y, xor(x,z)));\r\n ensures (forall x:int, y:int, z:int :: (word(x) && word(y) && word(z)) ==> (xor(x,z) == xor(y,z)) ==> (x == y));\r\n \r\n\r\natomic ghost procedure lemma_and_with_ff(x:int);\r\n requires word(x);\r\n ensures le(0, and(x, 0xff)) && lt(and(x, 0xff), 0x100);\r\n\r\natomic ghost procedure lemma_and_with_ffff(x:int);\r\n requires word(x);\r\n ensures le(0, and(x, 0xffff)) && lt(and(x, 0xffff), 0x10000);\r\n\r\natomic ghost procedure lemma_and_with_32_64(x:int);\r\n requires word(x);\r\n ensures gt(and(x, 32), 0) ==> int_bit(x, 5);\r\n ensures gt(and(x, 64), 0) ==> int_bit(x, 6);\r\n\r\natomic ghost procedure lemma_xor_bytes(x:int, y:int);\r\n requires le(0, x) && lt(x, 256);\r\n requires le(0, y) && lt(y, 256);\r\n ensures le(0, xor(x, y)) && lt(xor(x, y), 256);\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/IntLemmasMain.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IntSpec;\r\n//-private-import BitVectorLemmasMain;\r\n//-\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation IntLemmasMain\r\n{\r\n\r\natomic ghost procedure _a($b1:bv32, $b2:bv32)\r\n requires word(add(I($b1), I($b2)));\r\n ensures add(I($b1), I($b2)) == I($add($b1, $b2));\r\n{\r\n}\r\n\r\natomic ghost procedure _s($b1:bv32, $b2:bv32)\r\n requires word(sub(I($b1), I($b2)));\r\n ensures sub(I($b1), I($b2)) == I($sub($b1, $b2));\r\n{\r\n}\r\n\r\natomic ghost procedure _m($b1:bv32, $b2:bv32)\r\n requires word(mul(I($b1), I($b2)));\r\n ensures mul(I($b1), I($b2)) == I($mul($b1, $b2));\r\n{\r\n}\r\n\r\n\r\natomic ghost procedure __const()\r\n ensures 0 == I(0bv32);\r\n ensures 2 == I(2bv32);\r\n ensures 4 == I(4bv32);\r\n ensures 16 == I(16bv32);\r\n ensures 32 == I(32bv32);\r\n ensures 64 == I(64bv32);\r\n ensures 255 == I(255bv32);\r\n ensures 256 == I(256bv32);\r\n ensures 0x10000 == I(65536bv32);\r\n ensures 0xffff == I(65535bv32);\r\n{\r\n call _const();\r\n call _s(1bv32, 1bv32);\r\n call _a(1bv32, 1bv32);\r\n call _m(2bv32, 2bv32);\r\n call _m(4bv32, 4bv32);\r\n call _a(16bv32, 16bv32);\r\n call _a(32bv32, 32bv32);\r\n call _m(16bv32, 16bv32);\r\n call _m(256bv32, 256bv32);\r\n call _s(256bv32, 1bv32);\r\n call _s(65536bv32, 1bv32);\r\n}\r\n\r\nimplementation proc_XorLemmas()\r\n{\r\n call __const();\r\n call _proc_XorLemmas();\r\n}\r\n\r\nimplementation lemma_and_with_ff(x:int)\r\n{\r\n call __const();\r\n call _lemma_and_with_ff(B(x));\r\n}\r\n\r\nimplementation lemma_and_with_ffff(x:int)\r\n{\r\n call __const();\r\n call _lemma_and_with_ffff(B(x));\r\n}\r\n\r\nimplementation lemma_and_with_32_64(x:int) \r\n{\r\n call __const();\r\n call _lemma_and_with_32_64(B(x));\r\n call reveal_int_bit(x, 5);\r\n call reveal_int_bit(x div 2, 4);\r\n call reveal_int_bit((x div 2) div 2, 3);\r\n call reveal_int_bit(((x div 2) div 2) div 2, 2);\r\n call reveal_int_bit((((x div 2) div 2) div 2) div 2, 1);\r\n call reveal_int_bit(((((x div 2) div 2) div 2) div 2) div 2, 0);\r\n\r\n assert gt(and(x, 32), 0) ==> _mod(_div(_div(_div(_div(_div(x, 2), 2), 2), 2), 2), 2) != 0; //int_bit(x, 5) == 1;\r\n\r\n call reveal_int_bit(x, 6);\r\n call reveal_int_bit(x div 2, 5);\r\n call reveal_int_bit((x div 2) div 2, 4);\r\n call reveal_int_bit(((x div 2) div 2) div 2, 3);\r\n call reveal_int_bit((((x div 2) div 2) div 2) div 2, 2);\r\n call reveal_int_bit(((((x div 2) div 2) div 2) div 2) div 2, 1);\r\n call reveal_int_bit((((((x div 2) div 2) div 2) div 2) div 2) div 2, 0);\r\n assert gt(and(x, 64), 0) ==> _mod(_div(_div(_div(_div(_div(_div(x, 2), 2), 2), 2), 2), 2), 2) != 0; //int_bit(x, 6) == 1;\r\n}\r\n\r\nimplementation lemma_xor_bytes(x:int, y:int)\r\n{\r\n call __const();\r\n\r\n assert le(0, x) && lt(x, 256);\r\n assert le(0, y) && lt(y, 256);\r\n\r\n call _lemma_xor_bytes(B(x), B(y));\r\n}\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/Main.ifc.beat", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-private-import IoMain;\r\n//-private-import IntLemmasMain;\r\n//-private-basmonly-import Trusted;\r\n//-private-basmonly-import Checked;\r\n//-private-import Heap;\r\n//-private-import Seq;\r\n//-private-import dafny_DafnyPrelude;\r\n//-private-import DafnyAssembly;\r\n//-private-import dafny_relational_s;\r\n//-private-import dafny_base_s;\r\n//-private-import dafny_power2_s;\r\n//-disallowd-xrivate-import dafny_mul_i;\r\n//-disallowd-xrivate-import dafny_assembly_i;\r\n//-disallowd-xrivate-import dafny_bit_vector_lemmas_i;\r\n//-disallowd-xrivate-import dafny_Main_i;\r\n//-private-import AppLoaderContract;\r\n//-private-import ExtendedAssembly;\r\n\r\nmodule interface Entry\r\n{\r\n\r\nvar $commonVars:commonVars;\r\nvar $gcVars:gcVars;\r\n\r\n//\r\n//// TODO: better dispatcher\r\n//procedure Throw($_stackState:[int]StackState, $ebp:int, $esp:int, $eip:int);\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n// inout mems:mems;\r\n// requires word(eax) && word(ebx) && word(ecx) && word(edx) && word(esi) && word(edi) && word(ebp) && word(esp);\r\n// requires isStack($S) && $StackState[$S] == StackRunning;\r\n// requires NucleusInv($S, $StackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars);\r\n// requires SpRequire($S, esp, 4);\r\n// requires $_stackState == $StackState[$S := StackEmpty][?InterruptStack := StackRunning];\r\n// requires (StackStateTag($StackState[?InterruptStack]) == ?STACK_YIELDED ==>\r\n// RET == ReturnToAddr($eip)\r\n// && $StackState[?InterruptStack] == StackYielded($ebp, $esp, $eip));\r\n// modifies state, efl, eax, ebx, ecx, edx, esi, edi, ebp, esp;\r\n// modifies AllGcVars, $_MemVars;\r\n// modifies StackCheck;\r\n// ensures StackCheckInv(?InterruptStack, StackCheck);\r\n// ensures (StackStateTag($StackState[?InterruptStack]) == ?STACK_YIELDED ==>\r\n// NucleusInv(?InterruptStack, $_stackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars)\r\n// && ebp == $ebp\r\n// && esp == $esp);\r\n//\r\n//procedure GetStackState($s:int);\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n// inout mems:mems;\r\n// requires word(ecx);\r\n// requires isStack($S) && $StackState[$S] == StackRunning;\r\n// requires ecx == $s;\r\n// requires NucleusInv($S, $StackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars);\r\n// requires ReturnToAddr($Mem[esp]) == RET;\r\n// requires SpRequire($S, esp, 4);\r\n// modifies state, efl, eax, ecx, edx, esp;\r\n// ensures NucleusInv($S, $StackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars);\r\n// ensures eax == StackStateTag($StackState[$s]);\r\n// ensures ebp == old(ebp);\r\n// ensures esp == old(esp) + 4;\r\n//\r\n//procedure ResetStack($s:int);\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n// inout mems:mems;\r\n// requires word(ecx);\r\n// requires isStack($S) && $StackState[$S] == StackRunning;\r\n// requires ecx == $s;\r\n// requires NucleusInv($S, $StackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars);\r\n// requires ScanStackInv($S, $Mem, $StacksFrames, $Mem[esp], esp, ebp);\r\n// requires $StackState[$s] != StackRunning ==> ReturnToAddr($Mem[esp]) == RET;\r\n// requires SpRequire($S, esp, 4);\r\n// modifies state, efl, eax, ebx, ecx, edx, esi, edi, ebp, esp;\r\n// modifies AllGcVars, $_MemVars;\r\n// ensures NucleusInv($S, $StackState[$s := StackEmpty], $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars);\r\n// ensures ebp == old(ebp);\r\n// ensures esp == old(esp) + 4;\r\n//\r\n//// extern static void YieldTo(uint stackId);\r\n//// Switch to a stack $s.\r\n//// - $s may be empty, yielded, interrupted, or the current running stack.\r\n//// Change the state of $S to yielded, then change the state of $s to running.\r\n//procedure YieldTo($s:int, $_stackState:[int]StackState,\r\n// $eax:int, $ebx:int, $ecx:int, $edx:int, $esi:int, $edi:int, $ebp:int, $esp:int,\r\n// $eip:int, $cs:int, $efl:int);\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState;\r\n// inout mems:mems;\r\n// requires ecx == $s;\r\n// requires word(eax) && word(ebx) && word(ecx) && word(edx) && word(esi) && word(edi) && word(ebp);\r\n// requires isStack($S) && $StackState[$S] == StackRunning;\r\n// requires NucleusInv($S, $StackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars);\r\n// requires ScanStackInv($S, $Mem, $StacksFrames, $Mem[esp], esp, ebp);\r\n// requires SpRequire($S, esp, 4);\r\n// requires $_stackState == $StackState[$S := StackYielded(ebp, esp + 4, $Mem[esp])][$s := StackRunning];\r\n// requires ($StackState[$s] == StackRunning && $s == $S && RET == ReturnToAddr($Mem[esp]))\r\n// || ($StackState[$s] == StackYielded($ebp, $esp, $eip) && RET == ReturnToAddr($eip))\r\n// || ($StackState[$s] == StackInterrupted($eax, $ebx, $ecx, $edx, $esi, $edi, $ebp, $esp, $eip, $cs, $efl)\r\n// && RET == ReturnToInterrupted($eip, $cs, $efl))\r\n// || ($StackState[$s] == StackEmpty && RET == ReturnToAddr(?KernelEntryPoint)\r\n// && $StacksFrames[$s].Count == 0);\r\n//\r\n// modifies state, efl, eax, ebx, ecx, edx, esi, edi, ebp, esp;\r\n// modifies AllGcVars, $_MemVars;\r\n// modifies StackCheck;\r\n//\r\n// ensures StackCheckInv($s, StackCheck);\r\n// ensures ($StackState[$s] == StackRunning ==>\r\n// NucleusInv($s, $StackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars)\r\n// && ebp == old(ebp)\r\n// && esp == old(esp) + 4);\r\n// ensures ($StackState[$s] == StackYielded($ebp, $esp, $eip) ==>\r\n// NucleusInv($s, $_stackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars)\r\n// && ebp == $ebp\r\n// && esp == $esp);\r\n// ensures ($StackState[$s] == StackInterrupted($eax, $ebx, $ecx, $edx, $esi, $edi, $ebp, $esp, $eip, $cs, $efl) ==>\r\n// NucleusInv($s, $_stackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars)\r\n// && ebp == $ebp\r\n// && esp == $esp\r\n// && eax == $eax && ebx == $ebx && ecx == $ecx && edx == $edx && esi == $esi && edi == $edi);\r\n// ensures ($StackState[$s] == StackEmpty ==>\r\n// NucleusInv($s, $_stackState, $toAbs, $AbsMem, GcVars, $Mem_Vars, $StacksFrames, $IoVars)\r\n// && esp == StackHi($s) - 4\r\n// && ebp == 0 // end of frame pointer linked list\r\n// );\r\n//*/\r\n///*\r\n//// extern static void VgaTextWrite(uint screenOffset, uint hexMessage);\r\n//procedure VgaTextWrite();\r\n// requires word(eax) && word(ebx) && word(ecx) && word(edx) && word(esi) && word(edi) && word(ebp);\r\n// requires RET == ReturnToAddr($Mem[esp]);\r\n// requires SpRequire($S, esp, 4);\r\n// modifies state, efl, esp;\r\n// modifies $VgaNextEvent, $VgaEvents;\r\n// ensures ecx < 4000 ==>\r\n// $VgaNextEvent == old($VgaNextEvent) + 1\r\n// && $VgaEvents == old($VgaEvents)[old($VgaNextEvent) := VgaTextStore(?VgaTextLo + 2 * ecx, edx)];\r\n// ensures esp == old(esp) + 4;\r\n//\r\n//// extern static uint TryReadKeyboard();\r\n//procedure TryReadKeyboard();\r\n// requires word(eax) && word(ebx) && word(ecx) && word(edx) && word(esi) && word(edi) && word(ebp);\r\n// requires RET == ReturnToAddr($Mem[esp]);\r\n// requires SpRequire($S, esp, 4);\r\n// modifies state, efl, eax, esp;\r\n// modifies $KeyboardAvailable, $KeyboardDone;\r\n// ensures $KeyboardAvailable == old($KeyboardDone) ==> eax == 256;\r\n// ensures $KeyboardAvailable > old($KeyboardDone) ==> eax == $KeyboardEvents[old($KeyboardDone)];\r\n// ensures esp == old(esp) + 4;\r\n//\r\n//// extern static uint StartTimer(uint freq);\r\n//procedure StartTimer();\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, mems:mems;\r\n// requires word(eax) && word(ebx) && word(ecx) && word(edx) && word(esi) && word(edi) && word(ebp);\r\n// requires RET == ReturnToAddr($Mem[esp]);\r\n// requires SpRequire($S, esp, 4);\r\n// modifies state, efl, eax, esp;\r\n// modifies $TimerSeq, $TimerFreq;\r\n// ensures TimerOk($TimerSeq) && $TimerFreq == old(ecx);\r\n// ensures esp == old(esp) + 4;\r\n//\r\n//// extern static void SendEoi();\r\n//procedure SendEoi();\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, mems:mems;\r\n// requires word(eax) && word(ebx) && word(ecx) && word(edx) && word(esi) && word(edi) && word(ebp);\r\n// requires RET == ReturnToAddr($Mem[esp]);\r\n// requires SpRequire($S, esp, 4);\r\n// requires PicOk($PicSeq);\r\n// modifies state, efl, eax, edx, esp;\r\n// modifies $PicSeq;\r\n// ensures $PicSeq[0] == old($PicSeq[0]) + 1;\r\n// ensures $PicSeq[1] == old($PicSeq[1]) + 1;\r\n// ensures esp == old(esp) + 4;\r\n//\r\n//// extern static long Rdtsc();\r\n//procedure CycleCounter();\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, mems:mems;\r\n// requires RET == ReturnToAddr($Mem[esp]);\r\n// requires SpRequire($S, esp, 4);\r\n// modifies state, efl, eax, edx, esp;\r\n// ensures esp == old(esp) + 4;\r\n//\r\n//// extern static void DebugPrintHex(uint screenOffset, uint hexMessage);\r\n//procedure DebugPrintHex();\r\n// inout my r:regs, my core_state:core_state, linear stk:mem, linear statics:mem, linear io:IOState, mems:mems;\r\n// requires word(eax) && word(ebx) && word(ecx) && word(edx) && word(esi) && word(edi) && word(ebp);\r\n// requires RET == ReturnToAddr($Mem[esp]);\r\n// requires SpRequire($S, esp, 4);\r\n// modifies state, efl, eax, ebx, ecx, edx, esi, edi, esp; // not ebp\r\n// ensures esp == old(esp) + 4;\r\n//\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/axiom.whitelist", "content": "axiom (forall f: int, x: int, y: int :: { v2_u.Je(v2_u.Efl_Cmp(f, x, y)) } v2_u.Je(v2_u.Efl_Cmp(f, x, y)) <==> x == y);\r\naxiom (forall f: int, x: int, y: int :: { v2_u.Jne(v2_u.Efl_Cmp(f, x, y)) } v2_u.Jne(v2_u.Efl_Cmp(f, x, y)) <==> x != y);\r\naxiom (forall f: int, x: int, y: int :: { v2_u.Jbe(v2_u.Efl_Cmp(f, x, y)) } v2_u.Jbe(v2_u.Efl_Cmp(f, x, y)) <==> x <= y);\r\naxiom (forall f: int, x: int, y: int :: { v2_u.Jb(v2_u.Efl_Cmp(f, x, y)) } v2_u.Jb(v2_u.Efl_Cmp(f, x, y)) <==> x < y);\r\naxiom (forall f: int, x: int, y: int :: { v2_u.Jae(v2_u.Efl_Cmp(f, x, y)) } v2_u.Jae(v2_u.Efl_Cmp(f, x, y)) <==> x >= y);\r\naxiom (forall f: int, x: int, y: int :: { v2_u.Ja(v2_u.Efl_Cmp(f, x, y)) } v2_u.Ja(v2_u.Efl_Cmp(f, x, y)) <==> x > y);\r\naxiom (forall i1: int, i2: int :: {:expand false} { v2_u.add(i1, i2): int } v2_u.add(i1, i2): int == i1 + i2);\r\naxiom (forall i1: int, i2: int :: {:expand false} { v2_u.sub(i1, i2): int } v2_u.sub(i1, i2): int == i1 - i2);\r\naxiom (forall i1: int, i2: int :: {:expand false} { v2_u.mul(i1, i2): int } v2_u.mul(i1, i2): int == i1 * i2);\r\naxiom (forall i1: int, i2: int :: {:expand false} { v2_u._div(i1, i2): int } v2_u._div(i1, i2): int == i1 div i2);\r\naxiom (forall i1: int, i2: int :: {:expand false} { v2_u._mod(i1, i2): int } v2_u._mod(i1, i2): int == i1 mod i2);\r\naxiom (forall i1: int, i2: int :: {:expand false} { v2_u.le(i1, i2): bool } v2_u.le(i1, i2): bool <==> i1 <= i2);\r\naxiom (forall i1: int, i2: int :: {:expand false} { v2_u.lt(i1, i2): bool } v2_u.lt(i1, i2): bool <==> i1 < i2);\r\naxiom (forall i1: int, i2: int :: {:expand false} { v2_u.ge(i1, i2): bool } v2_u.ge(i1, i2): bool <==> i1 >= i2);\r\naxiom (forall i1: int, i2: int :: {:expand false} { v2_u.gt(i1, i2): bool } v2_u.gt(i1, i2): bool <==> i1 > i2);\r\naxiom v2_u.EAX == 0;\r\naxiom v2_u.ECX == 1;\r\naxiom v2_u.EDX == 2;\r\naxiom v2_u.EBX == 3;\r\naxiom v2_u.ESI == 4;\r\naxiom v2_u.EDI == 5;\r\naxiom v2_u.EBP == 6;\r\naxiom v2_u.ESP == 7;\r\naxiom v2_u.TMP1 == 0 - 1;\r\naxiom v2_u.TMP2 == 0 - 2;\r\naxiom (forall r: int :: { v2_u.RegOk(r): bool } v2_u.RegOk(r): bool <==> v2_u.EAX <= r && r <= v2_u.ESP);\r\naxiom (forall x: mem_opn :: { v2_u.._mconst(x): int } v2_u.._mconst(x): int == _mconst#MConst(x));\r\naxiom (forall x: mem_opn :: { v2_u.._mreg(x): int } v2_u.._mreg(x): int == _mreg#MReg(x));\r\naxiom (forall x: mem_opn :: { v2_u.._moffset(x): int } v2_u.._moffset(x): int == _moffset#MReg(x));\r\naxiom (forall x: mem_opn :: { v2_u.._mbase(x): int } v2_u.._mbase(x): int == _mbase#MIndex(x));\r\naxiom (forall x: mem_opn :: { v2_u.._mscale(x): int } v2_u.._mscale(x): int == _mscale#MIndex(x));\r\naxiom (forall x: mem_opn :: { v2_u.._mindex(x): int } v2_u.._mindex(x): int == _mindex#MIndex(x));\r\naxiom (forall x: mem_opn :: { v2_u.._moff(x): int } v2_u.._moff(x): int == _moff#MIndex(x));\r\naxiom (forall x: opn :: { v2_u.._const(x): int } v2_u.._const(x): int == _const#OConst(x));\r\naxiom (forall x: opn :: { v2_u.._reg(x): int } v2_u.._reg(x): int == _reg#OReg(x));\r\naxiom (forall x: opn_mem :: { v2_u.._ptr(x): mem_opn } v2_u.._ptr(x): mem_opn == _ptr#OMem(x));\r\naxiom (forall x: mem :: { v2_u..map(x): [int]int } v2_u..map(x): [int]int == map#mem(x));\r\naxiom (forall x: mem :: { v2_u..dom(x): [int]bool } v2_u..dom(x): [int]bool == dom#mem(x));\r\naxiom (forall mem: mem, ptr: int, val: int :: { v2_u.mem_update(mem, ptr, val): mem } v2_u.mem_update(mem, ptr, val): mem == mem(v2_u..map(mem)[ptr := val], v2_u..dom(mem)));\r\naxiom (forall x: regs :: { v2_u.._regs(x): [int]int } v2_u.._regs(x): [int]int == _regs#regs(x));\r\naxiom (forall x: regs :: { v2_u.._efl(x): int } v2_u.._efl(x): int == _efl#regs(x));\r\naxiom (forall r: regs :: { v2_u..regs(r): [int]int } v2_u..regs(r): [int]int == v2_u.._regs(r));\r\naxiom (forall r: regs :: { v2_u..efl(r): int } v2_u..efl(r): int == v2_u.._efl(r));\r\naxiom (forall r: regs, m: mem_opn :: { v2_u.EvalMemOpn(r, m): int } v2_u.EvalMemOpn(r, m): int == (if is#MConst(m) then v2_u.._mconst(m) else (if is#MReg(m) then v2_u..regs(r)[v2_u.._mreg(m)] + v2_u.._moffset(m) else v2_u..regs(r)[v2_u.._mbase(m)] + v2_u.._mscale(m) * v2_u..regs(r)[v2_u.._mindex(m)] + v2_u.._moff(m))));\r\naxiom (forall m: mem_opn :: { v2_u.EvalMemOpnOk(m): bool } v2_u.EvalMemOpnOk(m): bool <==> (if is#MConst(m) then true else (if is#MReg(m) then v2_u.RegOk(v2_u.._mreg(m)) else v2_u.RegOk(v2_u.._mbase(m)) && v2_u.RegOk(v2_u.._mindex(m)))));\r\naxiom (forall r: regs, o: opn :: { v2_u.Eval(r, o): int } v2_u.Eval(r, o): int == (if is#OConst(o) then v2_u.._const(o) else v2_u..regs(r)[v2_u.._reg(o)]));\r\naxiom (forall r: regs, o: opn_mem :: { v2_u.EvalPtr(r, o): int } v2_u.EvalPtr(r, o): int == v2_u.EvalMemOpn(r, v2_u.._ptr(o)));\r\naxiom (forall o: opn_mem :: { v2_u.EvalPtrOk(o): bool } v2_u.EvalPtrOk(o): bool <==> v2_u.EvalMemOpnOk(v2_u.._ptr(o)));\r\naxiom (forall o: opn :: { v2_u.SrcOk(o): bool } v2_u.SrcOk(o): bool <==> (if is#OConst(o) then v2_u.word(v2_u.._const(o)) else v2_u.RegOk(v2_u.._reg(o))));\r\naxiom (forall o: opn :: { v2_u.DstOk(o): bool } v2_u.DstOk(o): bool <==> is#OReg(o) && v2_u.RegOk(v2_u.._reg(o)));\r\naxiom (forall r: regs, c: core_state, m: mem, o: opn_mem :: { v2_u.MemSrcOk(r, c, m, o): bool } v2_u.MemSrcOk(r, c, m, o): bool <==> v2_u.SrcOkViaSegment(r, c, m, v2_u.DS, o));\r\naxiom (forall r: regs, c: core_state, m: mem, o: opn_mem :: { v2_u.MemDstOk(r, c, m, o): bool } v2_u.MemDstOk(r, c, m, o): bool <==> v2_u.DstOkViaSegment(r, c, m, v2_u.DS, o));\r\naxiom (forall r__BEAT: regs, core__BEAT: core_state, m__BEAT: mem, o__BEAT: opn_mem :: { v2_u.LogicalSrcOk(r__BEAT, core__BEAT, m__BEAT, o__BEAT): bool } v2_u.LogicalSrcOk(r__BEAT, core__BEAT, m__BEAT, o__BEAT): bool <==> v2_u.EvalPtrOk(o__BEAT) && v2_u.PhysPtrOk(m__BEAT, v2_u.EvalPtr(r__BEAT, o__BEAT)) && v2_u.word(v2_u.EvalPtr(r__BEAT, o__BEAT)) && (v2_u.paging_enabled(core__BEAT) ==> !v2_u.in_guard_region(v2_u.EvalPtr(r__BEAT, o__BEAT))));\r\naxiom (forall init__BEAT: bool, r__BEAT: regs, core__BEAT: core_state, m__BEAT: mem, o__BEAT: opn_mem :: { v2_u.LogicalDstOk(init__BEAT, r__BEAT, core__BEAT, m__BEAT, o__BEAT): bool } v2_u.LogicalDstOk(init__BEAT, r__BEAT, core__BEAT, m__BEAT, o__BEAT): bool <==> v2_u.EvalPtrOk(o__BEAT) && v2_u.PhysPtrOk(m__BEAT, v2_u.EvalPtr(r__BEAT, o__BEAT)) && v2_u.word(v2_u.EvalPtr(r__BEAT, o__BEAT)) && (init__BEAT ==> !v2_u.in_guard_region(v2_u.EvalPtr(r__BEAT, o__BEAT)) && !v2_u.between(v2_u.?ptLo, v2_u.?ptHi, v2_u.EvalPtr(r__BEAT, o__BEAT))));\r\naxiom (forall m__BEAT: mem, r__BEAT: regs, o__BEAT: opn_mem :: { v2_u.LogicalEval(m__BEAT, r__BEAT, o__BEAT): int } v2_u.LogicalEval(m__BEAT, r__BEAT, o__BEAT): int == map#mem(m__BEAT)[v2_u.EvalPtr(r__BEAT, o__BEAT)]);\r\naxiom (forall stacksFrames__BEAT: [int]Frames, i__BEAT: int :: { v2_u.frameGet(stacksFrames__BEAT, i__BEAT): int } v2_u.frameGet(stacksFrames__BEAT, i__BEAT): int == Abss#Frames(stacksFrames__BEAT[0])[i__BEAT]);\r\naxiom (forall n__BEAT: int, argRet__BEAT: int, sMem__BEAT: mem, $esp__BEAT: int, $RET__BEAT: ReturnTo :: { v2_u.SMemRequireGcRA(n__BEAT, argRet__BEAT, sMem__BEAT, $esp__BEAT, $RET__BEAT): bool } v2_u.SMemRequireGcRA(n__BEAT, argRet__BEAT, sMem__BEAT, $esp__BEAT, $RET__BEAT): bool <==> v2_u.SMemRequire(n__BEAT, sMem__BEAT, $esp__BEAT) && v2_u.?sLo + n__BEAT <= $esp__BEAT && $esp__BEAT + argRet__BEAT <= v2_u.?sHi - 4 && v2_u.ReturnToAddr(map#mem(sMem__BEAT)[$esp__BEAT]) == $RET__BEAT);\r\naxiom (forall argRet__BEAT: int, sMem__BEAT: mem, oldSMem__BEAT: mem, $esp__BEAT: int, oldEsp__BEAT: int, sAbs__BEAT: [int]int, oldSAbs__BEAT: [int]int :: { v2_u.SMemInvGc(argRet__BEAT, sMem__BEAT, oldSMem__BEAT, $esp__BEAT, oldEsp__BEAT, sAbs__BEAT, oldSAbs__BEAT): bool } v2_u.SMemInvGc(argRet__BEAT, sMem__BEAT, oldSMem__BEAT, $esp__BEAT, oldEsp__BEAT, sAbs__BEAT, oldSAbs__BEAT): bool <==> $esp__BEAT == oldEsp__BEAT && map#mem(sMem__BEAT)[$esp__BEAT] == map#mem(oldSMem__BEAT)[$esp__BEAT] && (forall i__BEAT__BEAT: int :: { map#mem(sMem__BEAT)[i__BEAT__BEAT] } $esp__BEAT + argRet__BEAT <= i__BEAT__BEAT ==> map#mem(sMem__BEAT)[i__BEAT__BEAT] == map#mem(oldSMem__BEAT)[i__BEAT__BEAT]) && (forall i__BEAT__BEAT: int :: { sAbs__BEAT[i__BEAT__BEAT] } $esp__BEAT + argRet__BEAT + v2_u.stackGcOffset <= i__BEAT__BEAT ==> sAbs__BEAT[i__BEAT__BEAT] == oldSAbs__BEAT[i__BEAT__BEAT]));\r\naxiom (forall argRet__BEAT: int, sMem__BEAT: mem, oldSMem__BEAT: mem, $esp__BEAT: int, oldEsp__BEAT: int, stacksFrames__BEAT: [int]Frames, oldStacksFrames__BEAT: [int]Frames :: { v2_u.SMemInvGcF(argRet__BEAT, sMem__BEAT, oldSMem__BEAT, $esp__BEAT, oldEsp__BEAT, stacksFrames__BEAT, oldStacksFrames__BEAT): bool } v2_u.SMemInvGcF(argRet__BEAT, sMem__BEAT, oldSMem__BEAT, $esp__BEAT, oldEsp__BEAT, stacksFrames__BEAT, oldStacksFrames__BEAT): bool <==> v2_u.SMemInvGc(argRet__BEAT, sMem__BEAT, oldSMem__BEAT, $esp__BEAT, oldEsp__BEAT, Abss#Frames(stacksFrames__BEAT[v2_u.$S]), Abss#Frames(oldStacksFrames__BEAT[v2_u.$S])));\r\naxiom (forall argRet__BEAT: int, sMem__BEAT: mem, oldSMem__BEAT: mem, $esp__BEAT: int, oldEsp__BEAT: int, sAbs__BEAT: [int]int, oldSAbs__BEAT: [int]int :: { v2_u.SMemEnsureGc(argRet__BEAT, sMem__BEAT, oldSMem__BEAT, $esp__BEAT, oldEsp__BEAT, sAbs__BEAT, oldSAbs__BEAT): bool } v2_u.SMemEnsureGc(argRet__BEAT, sMem__BEAT, oldSMem__BEAT, $esp__BEAT, oldEsp__BEAT, sAbs__BEAT, oldSAbs__BEAT): bool <==> $esp__BEAT == oldEsp__BEAT + 4 && (forall i__BEAT__BEAT: int :: { map#mem(sMem__BEAT)[i__BEAT__BEAT] } $esp__BEAT + argRet__BEAT <= i__BEAT__BEAT ==> map#mem(sMem__BEAT)[i__BEAT__BEAT] == map#mem(oldSMem__BEAT)[i__BEAT__BEAT]) && (forall i__BEAT__BEAT: int :: { sAbs__BEAT[i__BEAT__BEAT] } $esp__BEAT + argRet__BEAT + v2_u.stackGcOffset <= i__BEAT__BEAT ==> sAbs__BEAT[i__BEAT__BEAT] == oldSAbs__BEAT[i__BEAT__BEAT]));\r\naxiom (forall argRet__BEAT: int, sMem__BEAT: mem, oldSMem__BEAT: mem, $esp__BEAT: int, oldEsp__BEAT: int, stacksFrames__BEAT: [int]Frames, oldStacksFrames__BEAT: [int]Frames :: { v2_u.SMemEnsureGcF(argRet__BEAT, sMem__BEAT, oldSMem__BEAT, $esp__BEAT, oldEsp__BEAT, stacksFrames__BEAT, oldStacksFrames__BEAT): bool } v2_u.SMemEnsureGcF(argRet__BEAT, sMem__BEAT, oldSMem__BEAT, $esp__BEAT, oldEsp__BEAT, stacksFrames__BEAT, oldStacksFrames__BEAT): bool <==> v2_u.SMemEnsureGc(argRet__BEAT, sMem__BEAT, oldSMem__BEAT, $esp__BEAT, oldEsp__BEAT, Abss#Frames(stacksFrames__BEAT[v2_u.$S]), Abss#Frames(oldStacksFrames__BEAT[v2_u.$S])));\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/dafny_FatNatX86_i.imp.beat", "content": " //-private-import BaseSpec;\r\n //-private-import MemorySpec;\r\n //-private-import IoTypesSpec;\r\n //-private-import MachineStateSpec;\r\n //-private-import AssemblySpec;\r\n //-private-import InterruptsSpec;\r\n //-private-import IoSpec;\r\n //-private-import Overflow;\r\n //-private-import Core;\r\n //-private-import LogicalAddressing;\r\n //-private-import Util;\r\n //-private-import Stacks;\r\n //-private-import Partition;\r\n //-private-import Instructions;\r\n //-private-import Separation;\r\n //-private-import IntLemmasGc;\r\n //-private-import SimpleGcMemory;\r\n //-private-import SimpleCommon;\r\n //-private-import SimpleCollector;\r\n //-private-import IntLemmasMain;\r\n //-private-import IntLemmasBase;\r\n //-private-import IoMain;\r\n //-private-basmonly-import Trusted;\r\n //-private-basmonly-import Checked;\r\n //-private-import Heap;\r\n //-private-import Seq;\r\n //-private-import dafny_DafnyPrelude;\r\n //-private-import DafnyAssembly;\r\n //-private-import dafny_base_s;\r\n //-private-import dafny_power2_s;\r\n //-private-import dafny_bytes_and_words_s;\r\n //-private-import dafny_be_sequences_s;\r\n //-private-import dafny_integer_sequences_s;\r\n //-private-import dafny_seqs_simple_i;\r\n //-private-import dafny_power_s;\r\n //-private-import dafny_mul_nonlinear_i;\r\n //-private-import dafny_mul_i;\r\n //-private-import dafny_power_i;\r\n //-private-import dafny_div_def_i;\r\n //-private-import dafny_div_boogie_i;\r\n //-private-import dafny_div_nonlinear_i;\r\n //-private-import dafny_div_i;\r\n //-private-import dafny_repeat_digit_i;\r\n //-private-import dafny_assembly_s;\r\n //-private-import dafny_power2_i;\r\n //-private-import dafny_seqs_and_ints_i;\r\n //-private-import dafny_seqs_common_i;\r\n //-private-import dafny_Word32_i;\r\n //-private-import dafny_relational_s;\r\n //-private-import dafny_assembly_i;\r\n //-private-import dafny_arrays_i;\r\n //-private-import dafny_seqs_transforms_i;\r\n //-private-import dafny_seqs_reverse_i;\r\n //-private-import dafny_integer_sequences_i;\r\n //-private-import dafny_integer_sequences_premium_i;\r\n //-private-import dafny_assembly_premium_i;\r\n //-private-import dafny_BigNatX86Shim_i;\r\n //-private-import dafny_seqs_canonical_i;\r\n //-private-import dafny_CanonicalArrays_i;\r\n //-private-import dafny_FatNatCommon_i;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n\r\nmodule implementation dafny_FatNatX86_i\r\n{\r\n\r\nprocedure arrayAdd(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_a:ArrayOfInt, $ghost_b:ArrayOfInt, $ghost_s:ArrayOfInt, a_opn:opn_mem, $ghost_a__abs:int, a_base:int, a_offset:int, b_opn:opn_mem, $ghost_b__abs:int, b_base:int, b_offset:int, s_opn:opn_mem, $ghost_s__abs:int, s_base:int, s_offset:int, $ghost_si:int, index_offset:int, old_carries:Seq___int, old_carry:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, new_carry:int, new_carries:Seq___int)\r\n requires MemInv(me,init,stk_old,statics_old,core_state,ptMem,mems_old);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk_old,statics_old,core_state,ptMem,mems_old,$stacksFrames_old,io_old);\r\n requires HeapInv($absMem_old, objLayouts_old, heap_old);\r\n requires $ghost_a != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires fun_IsWordSeq(fun_Seq__FromArray($absMem_old, $ghost_a));\r\n requires $ghost_b != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires fun_IsWordSeq(fun_Seq__FromArray($absMem_old, $ghost_b));\r\n requires $ghost_s != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires $ghost_b != $ghost_s;\r\n requires $ghost_a != $ghost_s;\r\n requires $ghost_a__abs != $ghost_s__abs;\r\n requires $ghost_b__abs != $ghost_s__abs;\r\n\r\n requires s_offset == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset;\r\n\r\n requires old_carry == if (Cf(r_old.efl)) then 1 else 0;\r\n\r\n requires $ghost_a.arrAbs == $ghost_a__abs;\r\n requires HeapAbsData(heap_old, $ghost_a__abs) is Abs_ArrayOfInt;\r\n requires 0 <= a_offset && a_offset < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, a_base, $ghost_a__abs);\r\n requires EvalPtrOk(a_opn);\r\n requires EvalPtr(r_old, a_opn) == a_base + 4 * (2 + a_offset);\r\n requires a_opn._ptr is MReg && a_opn._ptr._mreg == EAX;\r\n\r\n requires $ghost_b.arrAbs == $ghost_b__abs;\r\n requires HeapAbsData(heap_old, $ghost_b__abs) is Abs_ArrayOfInt;\r\n requires 0 <= b_offset && b_offset < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, b_base, $ghost_b__abs);\r\n requires EvalPtrOk(b_opn);\r\n requires EvalPtr(r_old, b_opn) == b_base + 4 * (2 + b_offset);\r\n requires b_opn._ptr is MReg && b_opn._ptr._mreg == EBX;\r\n\r\n requires $ghost_s.arrAbs == $ghost_s__abs;\r\n requires HeapAbsData(heap_old, $ghost_s__abs) is Abs_ArrayOfInt;\r\n requires 0 <= s_offset && s_offset < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, s_base, $ghost_s__abs);\r\n requires EvalPtrOk(s_opn);\r\n requires EvalPtr(r_old, s_opn) == s_base + 4 * (2 + s_offset);\r\n requires s_opn._ptr is MReg && s_opn._ptr._mreg == ECX;\r\n\r\n modifies $Time;\r\n ensures stk == stk_old;\r\n ensures $stacksFrames == $stacksFrames_old;\r\n ensures (forall i:int::{$stacksFrames[$S].Abss[i]} i != EvalPtr(r_old, s_opn) ==> $stacksFrames[$S].Abss[i] == $stacksFrames_old[$S].Abss[i]);\r\n\r\n ensures MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n ensures HeapInv($absMem, objLayouts, heap);\r\n ensures AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n ensures (forall i:int::{$absMem[i]}{heap.absData[i]} heap_old.absData[i] is AbsNone || (heap.absData[i] == heap_old.absData[i] && ($absMem[i] == $absMem_old[i] || i == (($ghost_s).arrAbs))));\r\n ensures io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n //- Only havocs edi, ebp\r\n ensures r.regs[EAX] == r_old.regs[EAX];\r\n ensures r.regs[EBX] == r_old.regs[EBX];\r\n ensures r.regs[ECX] == r_old.regs[ECX];\r\n ensures r.regs[EDX] == r_old.regs[EDX];\r\n ensures r.regs[ESI] == r_old.regs[ESI];\r\n ensures r.regs[ESP] == r_old.regs[ESP];\r\n\r\n ensures HeapValue(objLayouts, true, $toAbs, a_base, $ghost_a__abs);\r\n ensures HeapValue(objLayouts, true, $toAbs, b_base, $ghost_b__abs);\r\n ensures HeapValue(objLayouts, true, $toAbs, s_base, $ghost_s__abs);\r\n\r\n ensures new_carry == if (Cf(r.efl)) then 1 else 0;\r\n ensures new_carry == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset) + old_carry) >= WORD_HI) then 1 else 0;\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset) + old_carry);\r\n\r\n //- Arrays A and B are unmodified\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_a)))))) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_a.arrAbs], j)))));\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_b)))))) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_b.arrAbs], j)))));\r\n\r\n //- Array S is unmodified except for the one entry we touch\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_s.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_s))))) && j != s_offset) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_s.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_s.arrAbs], j)))));\r\n\r\n ensures fun_Seq__Length___int(new_carries) == fun_Seq__Length___int(old_carries) + 1;\r\n ensures (forall i:int :: 0 <= i && i < fun_Seq__Length___int(old_carries) ==> fun_Seq__Index___int(new_carries, i) == fun_Seq__Index___int(old_carries, i));\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 1) == new_carry;\r\n{\r\n //- Boilerplate variable propagation\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n\r\n //- Teach Beat about Dafny sequence operations\r\n call proc_Seq__Empty__ToZero___int();\r\n call proc_Seq__Empty__FromZero___int();\r\n call proc_Seq__Singleton__Length___int();\r\n call proc_Seq__Build__Length___int();\r\n call proc_Seq__Build__Index___int();\r\n call proc_Seq__Append__Length___int();\r\n call proc_Seq__Index__Singleton___int();\r\n call proc_Seq__Append__Index___int();\r\n call proc_Seq__Update__Length___int();\r\n call proc_Seq__Index__Update___int();\r\n call proc_Seq__Equal__Equiv___int();\r\n call proc_Seq__Take__Length___int();\r\n call proc_Seq__Take__Index___int();\r\n call proc_Seq__Drop__Length___int();\r\n call proc_Seq__Drop__Index___int();\r\n call proc_Seq__Append__TakeDrop___int();\r\n call proc_Seq__Update__CommuteTake1___int();\r\n call proc_Seq__Update__CommuteTake2___int();\r\n call proc_Seq__Update__CommuteDrop1___int();\r\n call proc_Seq__Update__CommuteDrop2___int();\r\n call proc_Seq__Build__CommuteDrop___int();\r\n call proc_Seq__Take__Empty___int();\r\n call proc_Seq__Drop__Empty___int();\r\n\r\n call proc_lemma__2toX();\r\n\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EDI, a_opn, a_offset, $ghost_a__abs, a_base); //- edi <- a[aii+1]\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBP, b_opn, b_offset, $ghost_b__abs, b_base); //- ebp <- b[bii+1]\r\n\r\n var old_edi:int := edi;\r\n var next_efl:int := r.efl;\r\n call edi := AddCarry(edi, ebp); //- edi == a[aii+index_offset] + b[bii+index_offset] + carry\r\n call reveal_wrap32(old_edi + ebp + old_carry);\r\n new_carry := if (old_edi + ebp + old_carry >= WORD_HI) then 1 else 0;\r\n new_carries := fun_Seq__Append___int(old_carries, fun_Seq__Build___int(fun_Seq__Empty___int(), new_carry));\r\n\r\n //- Write the result in edi back to s[sii+index_offset]\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, s_opn, OReg(EDI), s_offset, edi, $ghost_s__abs, s_base);\r\n\r\n call reveal_wrap32(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset) + old_carry);\r\n call reveal_WORD_HI();\r\n}\r\n\r\n\r\n\r\nprocedure arrayAdd4(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_a:ArrayOfInt, $ghost_b:ArrayOfInt, $ghost_s:ArrayOfInt, a_opn1:opn_mem, a_opn2:opn_mem, a_opn3:opn_mem, a_opn4:opn_mem,$ghost_a__abs:int, a_base:int, a_offset1:int, a_offset2:int, a_offset3:int, a_offset4:int, b_opn1:opn_mem, b_opn2:opn_mem, b_opn3:opn_mem, b_opn4:opn_mem, $ghost_b__abs:int, b_base:int, b_offset1:int, b_offset2:int, b_offset3:int, b_offset4:int, s_opn1:opn_mem, s_opn2:opn_mem, s_opn3:opn_mem, s_opn4:opn_mem, $ghost_s__abs:int, s_base:int, s_offset1:int, s_offset2:int, s_offset3:int, s_offset4:int, $ghost_si:int, index_offset1:int, index_offset2:int, index_offset3:int, index_offset4:int, old_carries:Seq___int, old_carry:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, new_carry:int, new_carries:Seq___int)\r\n requires MemInv(me,init,stk_old,statics_old,core_state,ptMem,mems_old);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk_old,statics_old,core_state,ptMem,mems_old,$stacksFrames_old,io_old);\r\n requires HeapInv($absMem_old, objLayouts_old, heap_old);\r\n requires $ghost_a != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires fun_IsWordSeq(fun_Seq__FromArray($absMem_old, $ghost_a));\r\n requires $ghost_b != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires fun_IsWordSeq(fun_Seq__FromArray($absMem_old, $ghost_b));\r\n requires $ghost_s != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires $ghost_b != $ghost_s;\r\n requires $ghost_a != $ghost_s;\r\n requires $ghost_a__abs != $ghost_s__abs;\r\n requires $ghost_b__abs != $ghost_s__abs;\r\n\r\n requires s_offset1 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset1;\r\n requires s_offset2 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset2;\r\n requires s_offset3 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset3;\r\n requires s_offset4 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset4;\r\n\r\n requires old_carry == if (Cf(r_old.efl)) then 1 else 0;\r\n\r\n requires $ghost_a.arrAbs == $ghost_a__abs;\r\n requires HeapAbsData(heap_old, $ghost_a__abs) is Abs_ArrayOfInt;\r\n requires 0 <= a_offset1 && a_offset1 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires 0 <= a_offset2 && a_offset2 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires 0 <= a_offset3 && a_offset3 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires 0 <= a_offset4 && a_offset4 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, a_base, $ghost_a__abs);\r\n requires EvalPtrOk(a_opn1);\r\n requires EvalPtrOk(a_opn2);\r\n requires EvalPtrOk(a_opn3);\r\n requires EvalPtrOk(a_opn4);\r\n requires EvalPtr(r_old, a_opn1) == a_base + 4 * (2 + a_offset1);\r\n requires EvalPtr(r_old, a_opn2) == a_base + 4 * (2 + a_offset2);\r\n requires EvalPtr(r_old, a_opn3) == a_base + 4 * (2 + a_offset3);\r\n requires EvalPtr(r_old, a_opn4) == a_base + 4 * (2 + a_offset4);\r\n requires a_offset1 == a_offset2 + 1 && a_offset2 == a_offset3 + 1 && a_offset3 == a_offset4 + 1;\r\n requires a_opn1._ptr is MReg && a_opn1._ptr._mreg == EAX;\r\n requires a_opn2._ptr is MReg && a_opn2._ptr._mreg == EAX;\r\n requires a_opn3._ptr is MReg && a_opn3._ptr._mreg == EAX;\r\n requires a_opn4._ptr is MReg && a_opn4._ptr._mreg == EAX;\r\n\r\n requires $ghost_b.arrAbs == $ghost_b__abs;\r\n requires HeapAbsData(heap_old, $ghost_b__abs) is Abs_ArrayOfInt;\r\n requires 0 <= b_offset1 && b_offset1 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires 0 <= b_offset2 && b_offset2 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires 0 <= b_offset3 && b_offset3 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires 0 <= b_offset4 && b_offset4 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, b_base, $ghost_b__abs);\r\n requires EvalPtrOk(b_opn1);\r\n requires EvalPtrOk(b_opn2);\r\n requires EvalPtrOk(b_opn3);\r\n requires EvalPtrOk(b_opn4);\r\n requires EvalPtr(r_old, b_opn1) == b_base + 4 * (2 + b_offset1);\r\n requires EvalPtr(r_old, b_opn2) == b_base + 4 * (2 + b_offset2);\r\n requires EvalPtr(r_old, b_opn3) == b_base + 4 * (2 + b_offset3);\r\n requires EvalPtr(r_old, b_opn4) == b_base + 4 * (2 + b_offset4);\r\n requires b_offset1 == b_offset2 + 1 && b_offset2 == b_offset3 + 1 && b_offset3 == b_offset4 + 1;\r\n requires b_opn1._ptr is MReg && b_opn1._ptr._mreg == EBX;\r\n requires b_opn2._ptr is MReg && b_opn2._ptr._mreg == EBX;\r\n requires b_opn3._ptr is MReg && b_opn3._ptr._mreg == EBX;\r\n requires b_opn4._ptr is MReg && b_opn4._ptr._mreg == EBX;\r\n\r\n requires $ghost_s.arrAbs == $ghost_s__abs;\r\n requires HeapAbsData(heap_old, $ghost_s__abs) is Abs_ArrayOfInt;\r\n requires 0 <= s_offset1 && s_offset1 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires 0 <= s_offset2 && s_offset2 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires 0 <= s_offset3 && s_offset3 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires 0 <= s_offset4 && s_offset4 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n\r\n requires INTERNAL_lt_boogie(s_offset1, (Arr_Length($ghost_s)));\r\n requires INTERNAL_lt_boogie(s_offset2, (Arr_Length($ghost_s)));\r\n requires INTERNAL_lt_boogie(s_offset3, (Arr_Length($ghost_s)));\r\n requires INTERNAL_lt_boogie(s_offset4, (Arr_Length($ghost_s)));\r\n\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, s_base, $ghost_s__abs);\r\n\r\n requires EvalPtrOk(s_opn1);\r\n requires EvalPtrOk(s_opn2);\r\n requires EvalPtrOk(s_opn3);\r\n requires EvalPtrOk(s_opn4);\r\n requires EvalPtr(r_old, s_opn1) == s_base + 4 * (2 + s_offset1);\r\n requires EvalPtr(r_old, s_opn2) == s_base + 4 * (2 + s_offset2);\r\n requires EvalPtr(r_old, s_opn3) == s_base + 4 * (2 + s_offset3);\r\n requires EvalPtr(r_old, s_opn4) == s_base + 4 * (2 + s_offset4);\r\n requires s_offset1 == s_offset2 + 1 && s_offset2 == s_offset3 + 1 && s_offset3 == s_offset4 + 1;\r\n requires s_opn1._ptr is MReg && s_opn1._ptr._mreg == ECX;\r\n requires s_opn2._ptr is MReg && s_opn2._ptr._mreg == ECX;\r\n requires s_opn3._ptr is MReg && s_opn3._ptr._mreg == ECX;\r\n requires s_opn4._ptr is MReg && s_opn4._ptr._mreg == ECX;\r\n\r\n requires fun_Seq__Length___int(old_carries) > 0;\r\n requires fun_Seq__Index___int(old_carries, fun_Seq__Length___int(old_carries) - 1) == old_carry;\r\n\r\n modifies $Time;\r\n ensures stk == stk_old;\r\n ensures $stacksFrames == $stacksFrames_old;\r\n ensures (forall i:int::{$stacksFrames[$S].Abss[i]} i != EvalPtr(r_old, s_opn1) && i != EvalPtr(r_old, s_opn2) && i != EvalPtr(r_old, s_opn3) && i != EvalPtr(r_old, s_opn4) ==> $stacksFrames[$S].Abss[i] == $stacksFrames_old[$S].Abss[i]);\r\n\r\n ensures MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n ensures HeapInv($absMem, objLayouts, heap);\r\n ensures AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n ensures (forall i:int::{$absMem[i]}{heap.absData[i]} heap_old.absData[i] is AbsNone || (heap.absData[i] == heap_old.absData[i] && ($absMem[i] == $absMem_old[i] || i == (($ghost_s).arrAbs))));\r\n ensures io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n //- Only havocs edi, ebp\r\n ensures r.regs[EAX] == r_old.regs[EAX];\r\n ensures r.regs[EBX] == r_old.regs[EBX];\r\n ensures r.regs[ECX] == r_old.regs[ECX];\r\n ensures r.regs[EDX] == r_old.regs[EDX];\r\n ensures r.regs[ESI] == r_old.regs[ESI];\r\n ensures r.regs[ESP] == r_old.regs[ESP];\r\n\r\n ensures HeapValue(objLayouts, true, $toAbs, a_base, $ghost_a__abs);\r\n ensures HeapValue(objLayouts, true, $toAbs, b_base, $ghost_b__abs);\r\n ensures HeapValue(objLayouts, true, $toAbs, s_base, $ghost_s__abs);\r\n\r\n ensures new_carry == if (Cf(r.efl)) then 1 else 0;\r\n ensures new_carry == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset4) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset4) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 2)) >= WORD_HI) then 1 else 0;\r\n //if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset4) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset4) + old_carry) >= WORD_HI) then 1 else 0;\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset1) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset1) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset1) + old_carry);\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset2) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset2) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset2) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 4));\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset3) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset3) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset3) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 3));\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset4) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset4) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset4) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 2));\r\n\r\n //- Arrays A and B are unmodified\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_a)))))) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_a.arrAbs], j)))));\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_b)))))) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_b.arrAbs], j)))));\r\n\r\n //- Array S is unmodified except for the four entries we touch\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_s.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_s))))) && j != s_offset1 && j != s_offset2 && j != s_offset3 && j != s_offset4) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_s.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_s.arrAbs], j)))));\r\n\r\n ensures fun_Seq__Length___int(new_carries) == fun_Seq__Length___int(old_carries) + 4;\r\n ensures (forall i:int :: 0 <= i && i < fun_Seq__Length___int(old_carries) ==> fun_Seq__Index___int(new_carries, i) == fun_Seq__Index___int(old_carries, i));\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 4) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset1) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset1) + old_carry) >= WORD_HI) then 1 else 0;\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 3) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset2) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset2) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 4)) >= WORD_HI) then 1 else 0;\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 2) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset3) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset3) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 3)) >= WORD_HI) then 1 else 0;\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 1) == new_carry;\r\n\r\n ensures (forall i:int :: TV(i) && 1 <= i && i <= 4 ==> fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - i) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset4 + i - 1) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset4 + i - 1) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - (i+1))) >= WORD_HI) then 1 else 0);\r\n{\r\n var $ghost_carries:Seq___int;\r\n var carry1:int;\r\n var carry2:int;\r\n var carry3:int;\r\n //- Boilerplate variable propagation\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n\r\n //- Teach Beat about Dafny sequence operations\r\n call proc_Seq__Empty__ToZero___int();\r\n call proc_Seq__Empty__FromZero___int();\r\n call proc_Seq__Singleton__Length___int();\r\n call proc_Seq__Build__Length___int();\r\n call proc_Seq__Build__Index___int();\r\n call proc_Seq__Append__Length___int();\r\n call proc_Seq__Index__Singleton___int();\r\n call proc_Seq__Append__Index___int();\r\n call proc_Seq__Update__Length___int();\r\n call proc_Seq__Index__Update___int();\r\n call proc_Seq__Equal__Equiv___int();\r\n call proc_Seq__Take__Length___int();\r\n call proc_Seq__Take__Index___int();\r\n call proc_Seq__Drop__Length___int();\r\n call proc_Seq__Drop__Index___int();\r\n call proc_Seq__Append__TakeDrop___int();\r\n call proc_Seq__Update__CommuteTake1___int();\r\n call proc_Seq__Update__CommuteTake2___int();\r\n call proc_Seq__Update__CommuteDrop1___int();\r\n call proc_Seq__Update__CommuteDrop2___int();\r\n call proc_Seq__Build__CommuteDrop___int();\r\n call proc_Seq__Take__Empty___int();\r\n call proc_Seq__Drop__Empty___int();\r\n\r\n call proc_lemma__2toX();\r\n\r\n $ghost_carries := old_carries;\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry1, $ghost_carries := \r\n arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n a_opn1, $ghost_a__abs, a_base, a_offset1,\r\n b_opn1, $ghost_b__abs, b_base, b_offset1,\r\n s_opn1, $ghost_s__abs, s_base, s_offset1,\r\n $ghost_si, index_offset1, $ghost_carries, old_carry);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry2, $ghost_carries := \r\n arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n a_opn2, $ghost_a__abs, a_base, a_offset2,\r\n b_opn2, $ghost_b__abs, b_base, b_offset2,\r\n s_opn2, $ghost_s__abs, s_base, s_offset2,\r\n $ghost_si, index_offset2, $ghost_carries, carry1);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry3, $ghost_carries := \r\n arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n a_opn3, $ghost_a__abs, a_base, a_offset3,\r\n b_opn3, $ghost_b__abs, b_base, b_offset3,\r\n s_opn3, $ghost_s__abs, s_base, s_offset3,\r\n $ghost_si, index_offset3, $ghost_carries, carry2);\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, new_carry, $ghost_carries := \r\n arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n a_opn4, $ghost_a__abs, a_base, a_offset4,\r\n b_opn4, $ghost_b__abs, b_base, b_offset4,\r\n s_opn4, $ghost_s__abs, s_base, s_offset4,\r\n $ghost_si, index_offset4, $ghost_carries, carry3);\r\n\r\n new_carries := $ghost_carries;\r\n}\r\n\r\nimplementation Proc_Add32__unrolled__8(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_a:ArrayOfInt, $ghost_ai:int, $ghost_b:ArrayOfInt, $ghost_bi:int, $ghost_s:ArrayOfInt, $ghost_si:int, $ghost_c_in:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_c_out:int, $ghost_carries:Seq___int)\r\n{\r\n var $ghost_a__abs:int;\r\n var $ghost_b__abs:int;\r\n var $ghost_s__abs:int;\r\n var gcStackOffset:int;\r\n\r\n //- Boilerplate variable propagation\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n\r\n //- Teach Beat about Dafny sequence operations\r\n call proc_Seq__Empty__ToZero___int();\r\n call proc_Seq__Empty__FromZero___int();\r\n call proc_Seq__Singleton__Length___int();\r\n call proc_Seq__Build__Length___int();\r\n call proc_Seq__Build__Index___int();\r\n call proc_Seq__Append__Length___int();\r\n call proc_Seq__Index__Singleton___int();\r\n call proc_Seq__Append__Index___int();\r\n call proc_Seq__Update__Length___int();\r\n call proc_Seq__Index__Update___int();\r\n call proc_Seq__Equal__Equiv___int();\r\n call proc_Seq__Take__Length___int();\r\n call proc_Seq__Take__Index___int();\r\n call proc_Seq__Drop__Length___int();\r\n call proc_Seq__Drop__Index___int();\r\n call proc_Seq__Append__TakeDrop___int();\r\n //- call proc_Seq__Append__TakeDrop__Restricted___int();\r\n call proc_Seq__Update__CommuteTake1___int();\r\n call proc_Seq__Update__CommuteTake2___int();\r\n call proc_Seq__Update__CommuteDrop1___int();\r\n call proc_Seq__Update__CommuteDrop2___int();\r\n call proc_Seq__Build__CommuteDrop___int();\r\n call proc_Seq__Take__Empty___int();\r\n call proc_Seq__Drop__Empty___int();\r\n\r\n gcStackOffset := 0x111000;\r\n\r\n call proc_lemma__2toX();\r\n\r\n assert Aligned(esp);\r\n //- Prove that we can load arguments from the stack (b/c accesses are aligned)\r\n assert TV(esp) && TO(0) && TO(1) && TO(2) && TO(3) && TO(4) && TO(5);\r\n\r\n //- Prove that we can load arguments from the GC stack (b/c accesses are aligned)\r\n assert TO(0x44401) && TO(0x44402) && TO(0x44403); //- (gcStackOffset + {4,8,12}) / 4\r\n\r\n //- Load pointer to array a into edx\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x111004)), EvalPtr(r, OMem(MReg(ESP, 0x111004)))); //- 0x111004 = gcStackOffset + 4\r\n var a_base:int;\r\n a_base := edx;\r\n $ghost_a__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 4))));\r\n\r\n //- Load its length into eax\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EAX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_a__abs, r.regs[EDX]);\r\n\r\n //- Adjust to the \"beginning\" of the values we care about\r\n eax := eax - 1;\r\n call edi := Load(stk, esp + 8); //- grab ai\r\n eax := eax - edi;\r\n var aii:int := eax;\r\n assert aii == Arr_Length($ghost_a) - 1 - $ghost_ai;\r\n\r\n //- Convert aii into a memory pointer\r\n call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, aii, $ghost_a__abs, edx); //- Proves we're within bounds for the Lea calculation\r\n call eax := Lea(edx + 4 * eax + 8);\r\n var aii_ptr @ eax; \r\n\r\n //- Load pointer to array b into edx\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x111008)), EvalPtr(r, OMem(MReg(ESP, 0x111008)))); //- 0x111008 = gcStackOffset + 8\r\n var b_base:int;\r\n b_base := edx;\r\n $ghost_b__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 8))));\r\n\r\n //- Load its length into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_b__abs, r.regs[EDX]);\r\n\r\n //- Adjust to the \"beginning\" of the values we care about\r\n ebx := ebx - 1;\r\n call edi := Load(stk, esp + 12); //- grab bi\r\n ebx := ebx - edi;\r\n var bii:int := ebx;\r\n assert bii == Arr_Length($ghost_b) - 1 - $ghost_bi;\r\n\r\n //- Convert aii into a memory pointer\r\n call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, bii, $ghost_b__abs, edx); //- Proves we're within bounds for the Lea calculation\r\n call ebx := Lea(edx + 4 * ebx + 8);\r\n var bii_ptr @ ebx; \r\n\r\n //- Load pointer to array s into edx\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x11100c)), EvalPtr(r, OMem(MReg(ESP, 0x11100c)))); //- 0x11100c == gcStackOffset + 12\r\n var s_base:int;\r\n s_base := edx;\r\n $ghost_s__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 12))));\r\n\r\n //- Load its length into ecx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, ECX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_s__abs, r.regs[EDX]);\r\n\r\n //- Adjust to the \"beginning\" of the values we care about\r\n ecx := ecx - 1;\r\n call edi := Load(stk, esp + 16); //- grab si\r\n ecx := ecx - edi;\r\n var sii:int := ecx;\r\n assert sii == Arr_Length($ghost_s) - 1 - $ghost_si;\r\n\r\n //- Convert sii into a memory pointer\r\n call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, sii, $ghost_s__abs, edx); //- Proves we're within bounds for the Lea calculation\r\n call ecx := Lea(edx + 4 * ecx + 8);\r\n var sii_ptr @ ecx; \r\n\r\n //-///////////// Start computing //////////////////////////\r\n\r\n //- First, \"load\" c_in into CF via a sneaky addition\r\n call edi := Load(stk, esp + 20); //- grab c_in\r\n assert edi == $ghost_c_in;\r\n call r := instr_Add(r, EDI, OConst(0xffffffff)); \r\n assert Cf(r.efl) == ($ghost_c_in == 1);\r\n\r\n //- Build the carries sequence\r\n $ghost_carries := fun_Seq__Build___int(fun_Seq__Empty___int(), $ghost_c_in);\r\n\r\n var carry:int;\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n OMem(MReg(EAX, 0)), OMem(MReg(EAX, (-4))), OMem(MReg(EAX, (-8))), OMem(MReg(EAX, (-12))), \r\n $ghost_a__abs, a_base, \r\n aii-0, aii-1, aii-2, aii-3,\r\n OMem(MReg(EBX, 0)), OMem(MReg(EBX, (-4))), OMem(MReg(EBX, (-8))), OMem(MReg(EBX, (-12))), \r\n $ghost_b__abs, b_base, \r\n bii-0, bii-1, bii-2, bii-3,\r\n OMem(MReg(ECX, 0)), OMem(MReg(ECX, (-4))), OMem(MReg(ECX, (-8))), OMem(MReg(ECX, (-12))), \r\n $ghost_s__abs, s_base, \r\n sii-0, sii-1, sii-2, sii-3,\r\n $ghost_si, 0, (-1), (-2), (-3), $ghost_carries, $ghost_c_in);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n OMem(MReg(EAX, (-16))), OMem(MReg(EAX, (-20))), OMem(MReg(EAX, (-24))), OMem(MReg(EAX, (-28))), \r\n $ghost_a__abs, a_base, \r\n aii-4, aii-5, aii-6, aii-7,\r\n OMem(MReg(EBX, (-16))), OMem(MReg(EBX, (-20))), OMem(MReg(EBX, (-24))), OMem(MReg(EBX, (-28))), \r\n $ghost_b__abs, b_base, \r\n bii-4, bii-5, bii-6, bii-7,\r\n OMem(MReg(ECX, (-16))), OMem(MReg(ECX, (-20))), OMem(MReg(ECX, (-24))), OMem(MReg(ECX, (-28))), \r\n $ghost_s__abs, s_base, \r\n sii-4, sii-5, sii-6, sii-7,\r\n $ghost_si, (-4), (-5), (-6), (-7), $ghost_carries, carry);\r\n\r\n //- Extract the final carry bit from EFL\r\n eax := 0;\r\n call r := instr_GetCf(r, EAX);\r\n assert Aligned(esp);\r\n assert Aligned(esp + 4);\r\n call Store(inout stk, esp + 4, eax);\r\n $ghost_c_out := carry;\r\n\r\n assert $ghost_a.arrAbs != $ghost_s.arrAbs;\r\n\r\n Return;\r\n}\r\n\r\n//implementation Proc_Add32__unrolled__8(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_a:ArrayOfInt, $ghost_ai:int, $ghost_b:ArrayOfInt, $ghost_bi:int, $ghost_s:ArrayOfInt, $ghost_si:int, $ghost_c_in:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_c_out:int, $ghost_carries:Seq___int)\r\n//{\r\n// var $ghost_a__abs:int;\r\n// var $ghost_b__abs:int;\r\n// var $ghost_s__abs:int;\r\n// var gcStackOffset:int;\r\n//\r\n// // Boilerplate variable propagation\r\n// r := r_old;\r\n// stk := stk_old;\r\n// statics := statics_old;\r\n// io := io_old;\r\n// mems := mems_old;\r\n// $commonVars := $commonVars_old;\r\n// $gcVars := $gcVars_old;\r\n// $toAbs := $toAbs_old;\r\n// $absMem := $absMem_old;\r\n// $stacksFrames := $stacksFrames_old;\r\n// objLayouts := objLayouts_old;\r\n// heap := heap_old;\r\n//\r\n// // Teach Beat about Dafny sequence operations\r\n// call proc_Seq__Empty__ToZero___int();\r\n// call proc_Seq__Empty__FromZero___int();\r\n// call proc_Seq__Singleton__Length___int();\r\n// call proc_Seq__Build__Length___int();\r\n// call proc_Seq__Build__Index___int();\r\n// call proc_Seq__Append__Length___int();\r\n// call proc_Seq__Index__Singleton___int();\r\n// call proc_Seq__Append__Index___int();\r\n// call proc_Seq__Update__Length___int();\r\n// call proc_Seq__Index__Update___int();\r\n// call proc_Seq__Equal__Equiv___int();\r\n// call proc_Seq__Take__Length___int();\r\n// call proc_Seq__Take__Index___int();\r\n// call proc_Seq__Drop__Length___int();\r\n// call proc_Seq__Drop__Index___int();\r\n// call proc_Seq__Append__TakeDrop___int();\r\n// // call proc_Seq__Append__TakeDrop__Restricted___int();\r\n// call proc_Seq__Update__CommuteTake1___int();\r\n// call proc_Seq__Update__CommuteTake2___int();\r\n// call proc_Seq__Update__CommuteDrop1___int();\r\n// call proc_Seq__Update__CommuteDrop2___int();\r\n// call proc_Seq__Build__CommuteDrop___int();\r\n// call proc_Seq__Take__Empty___int();\r\n// call proc_Seq__Drop__Empty___int();\r\n//\r\n// gcStackOffset := 0x111000;\r\n//\r\n// call proc_lemma__2toX();\r\n//\r\n// assert Aligned(esp);\r\n// // Prove that we can load arguments from the stack (b/c accesses are aligned)\r\n// assert TV(esp) && TO(0) && TO(1) && TO(2) && TO(3) && TO(4) && TO(5);\r\n//\r\n// // Prove that we can load arguments from the GC stack (b/c accesses are aligned)\r\n// assert TO(0x44401) && TO(0x44402) && TO(0x44403); // (gcStackOffset + {4,8,12}) / 4\r\n//\r\n// // Load pointer to array a into edx\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x111004)), EvalPtr(r, OMem(MReg(ESP, 0x111004)))); // 0x111004 = gcStackOffset + 4\r\n// var a_base:int;\r\n// a_base := edx;\r\n// $ghost_a__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 4))));\r\n//\r\n// // Load its length into eax\r\n// call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EAX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_a__abs, r.regs[EDX]);\r\n//\r\n// // Adjust to the \"beginning\" of the values we care about\r\n// eax := eax - 1;\r\n// call edi := Load(stk, esp + 8); // grab ai\r\n// eax := eax - edi;\r\n// var aii:int := eax;\r\n// assert aii == Arr_Length($ghost_a) - 1 - $ghost_ai;\r\n//\r\n// // Convert aii into a memory pointer\r\n// call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, aii, $ghost_a__abs, edx); // Proves we're within bounds for the Lea calculation\r\n// call eax := Lea(edx + 4 * eax + 8);\r\n// var aii_ptr @ eax; \r\n//\r\n// // Load pointer to array b into edx\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x111008)), EvalPtr(r, OMem(MReg(ESP, 0x111008)))); // 0x111008 = gcStackOffset + 8\r\n// var b_base:int;\r\n// b_base := edx;\r\n// $ghost_b__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 8))));\r\n//\r\n// // Load its length into ebx\r\n// call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_b__abs, r.regs[EDX]);\r\n//\r\n// // Adjust to the \"beginning\" of the values we care about\r\n// ebx := ebx - 1;\r\n// call edi := Load(stk, esp + 12); // grab bi\r\n// ebx := ebx - edi;\r\n// var bii:int := ebx;\r\n// assert bii == Arr_Length($ghost_b) - 1 - $ghost_bi;\r\n//\r\n// // Convert aii into a memory pointer\r\n// call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, bii, $ghost_b__abs, edx); // Proves we're within bounds for the Lea calculation\r\n// call ebx := Lea(edx + 4 * ebx + 8);\r\n// var bii_ptr @ ebx; \r\n//\r\n// // Load pointer to array s into edx\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x11100c)), EvalPtr(r, OMem(MReg(ESP, 0x11100c)))); // 0x11100c == gcStackOffset + 12\r\n// var s_base:int;\r\n// s_base := edx;\r\n// $ghost_s__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 12))));\r\n//\r\n// // Load its length into ecx\r\n// call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, ECX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_s__abs, r.regs[EDX]);\r\n//\r\n// // Adjust to the \"beginning\" of the values we care about\r\n// ecx := ecx - 1;\r\n// call edi := Load(stk, esp + 16); // grab si\r\n// ecx := ecx - edi;\r\n// var sii:int := ecx;\r\n// assert sii == Arr_Length($ghost_s) - 1 - $ghost_si;\r\n//\r\n// // Convert sii into a memory pointer\r\n// call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, sii, $ghost_s__abs, edx); // Proves we're within bounds for the Lea calculation\r\n// call ecx := Lea(edx + 4 * ecx + 8);\r\n// var sii_ptr @ ecx; \r\n//\r\n// /////////////// Start computing //////////////////////////\r\n//\r\n// // First, \"load\" c_in into CF via a sneaky addition\r\n// call edi := Load(stk, esp + 20); // grab c_in\r\n// assert edi == $ghost_c_in;\r\n// call r := instr_Add(r, EDI, OConst(0xffffffff)); \r\n// assert Cf(r.efl) == ($ghost_c_in == 1);\r\n//\r\n// // Build the carries sequence\r\n// $ghost_carries := fun_Seq__Build___int(fun_Seq__Empty___int(), $ghost_c_in);\r\n//\r\n// var carry:int;\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, 0)), $ghost_a__abs, a_base, aii-0,\r\n// OMem(MReg(EBX, 0)), $ghost_b__abs, b_base, bii-0,\r\n// OMem(MReg(ECX, 0)), $ghost_s__abs, s_base, sii-0,\r\n// $ghost_si, 0, $ghost_carries, $ghost_c_in);\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-4))), $ghost_a__abs, a_base, aii-1,\r\n// OMem(MReg(EBX, (-4))), $ghost_b__abs, b_base, bii-1,\r\n// OMem(MReg(ECX, (-4))), $ghost_s__abs, s_base, sii-1,\r\n// $ghost_si, (-1), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-8))), $ghost_a__abs, a_base, aii-2,\r\n// OMem(MReg(EBX, (-8))), $ghost_b__abs, b_base, bii-2,\r\n// OMem(MReg(ECX, (-8))), $ghost_s__abs, s_base, sii-2,\r\n// $ghost_si, (-2), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-12))), $ghost_a__abs, a_base, aii-3,\r\n// OMem(MReg(EBX, (-12))), $ghost_b__abs, b_base, bii-3,\r\n// OMem(MReg(ECX, (-12))), $ghost_s__abs, s_base, sii-3,\r\n// $ghost_si, (-3), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-16))), $ghost_a__abs, a_base, aii-4,\r\n// OMem(MReg(EBX, (-16))), $ghost_b__abs, b_base, bii-4,\r\n// OMem(MReg(ECX, (-16))), $ghost_s__abs, s_base, sii-4,\r\n// $ghost_si, (-4), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-20))), $ghost_a__abs, a_base, aii-5,\r\n// OMem(MReg(EBX, (-20))), $ghost_b__abs, b_base, bii-5,\r\n// OMem(MReg(ECX, (-20))), $ghost_s__abs, s_base, sii-5,\r\n// $ghost_si, (-5), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-24))), $ghost_a__abs, a_base, aii-6,\r\n// OMem(MReg(EBX, (-24))), $ghost_b__abs, b_base, bii-6,\r\n// OMem(MReg(ECX, (-24))), $ghost_s__abs, s_base, sii-6,\r\n// $ghost_si, (-6), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-28))), $ghost_a__abs, a_base, aii-7,\r\n// OMem(MReg(EBX, (-28))), $ghost_b__abs, b_base, bii-7,\r\n// OMem(MReg(ECX, (-28))), $ghost_s__abs, s_base, sii-7,\r\n// $ghost_si, (-7), $ghost_carries, carry);\r\n//\r\n// // Extract the final carry bit from EFL\r\n// eax := 0;\r\n// call r := instr_GetCf(r, EAX);\r\n// assert Aligned(esp);\r\n// assert Aligned(esp + 4);\r\n// call Store(inout stk, esp + 4, eax);\r\n// $ghost_c_out := carry;\r\n//\r\n// assert $ghost_a.arrAbs != $ghost_s.arrAbs;\r\n//\r\n// Return;\r\n//}\r\n\r\n\r\n\r\nimplementation Proc_Add32__unrolled__16(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_a:ArrayOfInt, $ghost_ai:int, $ghost_b:ArrayOfInt, $ghost_bi:int, $ghost_s:ArrayOfInt, $ghost_si:int, $ghost_c_in:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_c_out:int, $ghost_carries:Seq___int)\r\n{\r\n var $ghost_a__abs:int;\r\n var $ghost_b__abs:int;\r\n var $ghost_s__abs:int;\r\n var gcStackOffset:int;\r\n\r\n //- Boilerplate variable propagation\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n\r\n //- Teach Beat about Dafny sequence operations\r\n call proc_Seq__Empty__ToZero___int();\r\n call proc_Seq__Empty__FromZero___int();\r\n call proc_Seq__Singleton__Length___int();\r\n call proc_Seq__Build__Length___int();\r\n call proc_Seq__Build__Index___int();\r\n call proc_Seq__Append__Length___int();\r\n call proc_Seq__Index__Singleton___int();\r\n call proc_Seq__Append__Index___int();\r\n call proc_Seq__Update__Length___int();\r\n call proc_Seq__Index__Update___int();\r\n call proc_Seq__Equal__Equiv___int();\r\n call proc_Seq__Take__Length___int();\r\n call proc_Seq__Take__Index___int();\r\n call proc_Seq__Drop__Length___int();\r\n call proc_Seq__Drop__Index___int();\r\n call proc_Seq__Append__TakeDrop___int();\r\n //- call proc_Seq__Append__TakeDrop__Restricted___int();\r\n call proc_Seq__Update__CommuteTake1___int();\r\n call proc_Seq__Update__CommuteTake2___int();\r\n call proc_Seq__Update__CommuteDrop1___int();\r\n call proc_Seq__Update__CommuteDrop2___int();\r\n call proc_Seq__Build__CommuteDrop___int();\r\n call proc_Seq__Take__Empty___int();\r\n call proc_Seq__Drop__Empty___int();\r\n\r\n gcStackOffset := 0x111000;\r\n\r\n call proc_lemma__2toX();\r\n\r\n assert Aligned(esp);\r\n //- Prove that we can load arguments from the stack (b/c accesses are aligned)\r\n assert TV(esp) && TO(0) && TO(1) && TO(2) && TO(3) && TO(4) && TO(5);\r\n\r\n //- Prove that we can load arguments from the GC stack (b/c accesses are aligned)\r\n assert TO(0x44401) && TO(0x44402) && TO(0x44403); //- (gcStackOffset + {4,8,12}) / 4\r\n\r\n //- Load pointer to array a into edx\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x111004)), EvalPtr(r, OMem(MReg(ESP, 0x111004)))); //- 0x111004 = gcStackOffset + 4\r\n var a_base:int;\r\n a_base := edx;\r\n $ghost_a__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 4))));\r\n\r\n //- Load its length into eax\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EAX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_a__abs, r.regs[EDX]);\r\n\r\n //- Adjust to the \"beginning\" of the values we care about\r\n eax := eax - 1;\r\n call edi := Load(stk, esp + 8); //- grab ai\r\n eax := eax - edi;\r\n var aii:int := eax;\r\n assert aii == Arr_Length($ghost_a) - 1 - $ghost_ai;\r\n\r\n //- Convert aii into a memory pointer\r\n call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, aii, $ghost_a__abs, edx); //- Proves we're within bounds for the Lea calculation\r\n call eax := Lea(edx + 4 * eax + 8);\r\n var aii_ptr @ eax; \r\n\r\n //- Load pointer to array b into edx\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x111008)), EvalPtr(r, OMem(MReg(ESP, 0x111008)))); //- 0x111008 = gcStackOffset + 8\r\n var b_base:int;\r\n b_base := edx;\r\n $ghost_b__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 8))));\r\n\r\n //- Load its length into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_b__abs, r.regs[EDX]);\r\n\r\n //- Adjust to the \"beginning\" of the values we care about\r\n ebx := ebx - 1;\r\n call edi := Load(stk, esp + 12); //- grab bi\r\n ebx := ebx - edi;\r\n var bii:int := ebx;\r\n assert bii == Arr_Length($ghost_b) - 1 - $ghost_bi;\r\n\r\n //- Convert aii into a memory pointer\r\n call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, bii, $ghost_b__abs, edx); //- Proves we're within bounds for the Lea calculation\r\n call ebx := Lea(edx + 4 * ebx + 8);\r\n var bii_ptr @ ebx; \r\n\r\n //- Load pointer to array s into edx\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x11100c)), EvalPtr(r, OMem(MReg(ESP, 0x11100c)))); //- 0x11100c == gcStackOffset + 12\r\n var s_base:int;\r\n s_base := edx;\r\n $ghost_s__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 12))));\r\n\r\n //- Load its length into ecx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, ECX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_s__abs, r.regs[EDX]);\r\n\r\n //- Adjust to the \"beginning\" of the values we care about\r\n ecx := ecx - 1;\r\n call edi := Load(stk, esp + 16); //- grab si\r\n ecx := ecx - edi;\r\n var sii:int := ecx;\r\n assert sii == Arr_Length($ghost_s) - 1 - $ghost_si;\r\n\r\n //- Convert sii into a memory pointer\r\n call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, sii, $ghost_s__abs, edx); //- Proves we're within bounds for the Lea calculation\r\n call ecx := Lea(edx + 4 * ecx + 8);\r\n var sii_ptr @ ecx; \r\n\r\n //-///////////// Start computing //////////////////////////\r\n\r\n //- First, \"load\" c_in into CF via a sneaky addition\r\n call edi := Load(stk, esp + 20); //- grab c_in\r\n assert edi == $ghost_c_in;\r\n call r := instr_Add(r, EDI, OConst(0xffffffff)); \r\n assert Cf(r.efl) == ($ghost_c_in == 1);\r\n\r\n //- Build the carries sequence\r\n $ghost_carries := fun_Seq__Build___int(fun_Seq__Empty___int(), $ghost_c_in);\r\n\r\n var carry:int;\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n OMem(MReg(EAX, 0)), OMem(MReg(EAX, (-4))), OMem(MReg(EAX, (-8))), OMem(MReg(EAX, (-12))), \r\n $ghost_a__abs, a_base, \r\n aii-0, aii-1, aii-2, aii-3,\r\n OMem(MReg(EBX, 0)), OMem(MReg(EBX, (-4))), OMem(MReg(EBX, (-8))), OMem(MReg(EBX, (-12))), \r\n $ghost_b__abs, b_base, \r\n bii-0, bii-1, bii-2, bii-3,\r\n OMem(MReg(ECX, 0)), OMem(MReg(ECX, (-4))), OMem(MReg(ECX, (-8))), OMem(MReg(ECX, (-12))), \r\n $ghost_s__abs, s_base, \r\n sii-0, sii-1, sii-2, sii-3,\r\n $ghost_si, 0, (-1), (-2), (-3), $ghost_carries, $ghost_c_in);\r\n\r\n assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 4))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n OMem(MReg(EAX, (-16))), OMem(MReg(EAX, (-20))), OMem(MReg(EAX, (-24))), OMem(MReg(EAX, (-28))), \r\n $ghost_a__abs, a_base, \r\n aii-4, aii-5, aii-6, aii-7,\r\n OMem(MReg(EBX, (-16))), OMem(MReg(EBX, (-20))), OMem(MReg(EBX, (-24))), OMem(MReg(EBX, (-28))), \r\n $ghost_b__abs, b_base, \r\n bii-4, bii-5, bii-6, bii-7,\r\n OMem(MReg(ECX, (-16))), OMem(MReg(ECX, (-20))), OMem(MReg(ECX, (-24))), OMem(MReg(ECX, (-28))), \r\n $ghost_s__abs, s_base, \r\n sii-4, sii-5, sii-6, sii-7,\r\n $ghost_si, (-4), (-5), (-6), (-7), $ghost_carries, carry);\r\n\r\n assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 8))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n OMem(MReg(EAX, (-32))), OMem(MReg(EAX, (-36))), OMem(MReg(EAX, (-40))), OMem(MReg(EAX, (-44))), \r\n $ghost_a__abs, a_base, \r\n aii-8, aii-9, aii-10, aii-11,\r\n OMem(MReg(EBX, (-32))), OMem(MReg(EBX, (-36))), OMem(MReg(EBX, (-40))), OMem(MReg(EBX, (-44))), \r\n $ghost_b__abs, b_base, \r\n bii-8, bii-9, bii-10, bii-11,\r\n OMem(MReg(ECX, (-32))), OMem(MReg(ECX, (-36))), OMem(MReg(ECX, (-40))), OMem(MReg(ECX, (-44))), \r\n $ghost_s__abs, s_base, \r\n sii-8, sii-9, sii-10, sii-11,\r\n $ghost_si, (-8), (-9), (-10), (-11), $ghost_carries, carry);\r\n\r\n assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 12))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n OMem(MReg(EAX, (-48))), OMem(MReg(EAX, (-52))), OMem(MReg(EAX, (-56))), OMem(MReg(EAX, (-60))), \r\n $ghost_a__abs, a_base, \r\n aii-12, aii-13, aii-14, aii-15,\r\n OMem(MReg(EBX, (-48))), OMem(MReg(EBX, (-52))), OMem(MReg(EBX, (-56))), OMem(MReg(EBX, (-60))), \r\n $ghost_b__abs, b_base, \r\n bii-12, bii-13, bii-14, bii-15,\r\n OMem(MReg(ECX, (-48))), OMem(MReg(ECX, (-52))), OMem(MReg(ECX, (-56))), OMem(MReg(ECX, (-60))), \r\n $ghost_s__abs, s_base, \r\n sii-12, sii-13, sii-14, sii-15,\r\n $ghost_si, (-12), (-13), (-14), (-15), $ghost_carries, carry);\r\n\r\n// assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 16))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, 0)), $ghost_a__abs, a_base, aii-0,\r\n// OMem(MReg(EBX, 0)), $ghost_b__abs, b_base, bii-0,\r\n// OMem(MReg(ECX, 0)), $ghost_s__abs, s_base, sii-0,\r\n// $ghost_si, 0, $ghost_carries, $ghost_c_in);\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-4))), $ghost_a__abs, a_base, aii-1,\r\n// OMem(MReg(EBX, (-4))), $ghost_b__abs, b_base, bii-1,\r\n// OMem(MReg(ECX, (-4))), $ghost_s__abs, s_base, sii-1,\r\n// $ghost_si, (-1), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-8))), $ghost_a__abs, a_base, aii-2,\r\n// OMem(MReg(EBX, (-8))), $ghost_b__abs, b_base, bii-2,\r\n// OMem(MReg(ECX, (-8))), $ghost_s__abs, s_base, sii-2,\r\n// $ghost_si, (-2), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-12))), $ghost_a__abs, a_base, aii-3,\r\n// OMem(MReg(EBX, (-12))), $ghost_b__abs, b_base, bii-3,\r\n// OMem(MReg(ECX, (-12))), $ghost_s__abs, s_base, sii-3,\r\n// $ghost_si, (-3), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-16))), $ghost_a__abs, a_base, aii-4,\r\n// OMem(MReg(EBX, (-16))), $ghost_b__abs, b_base, bii-4,\r\n// OMem(MReg(ECX, (-16))), $ghost_s__abs, s_base, sii-4,\r\n// $ghost_si, (-4), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-20))), $ghost_a__abs, a_base, aii-5,\r\n// OMem(MReg(EBX, (-20))), $ghost_b__abs, b_base, bii-5,\r\n// OMem(MReg(ECX, (-20))), $ghost_s__abs, s_base, sii-5,\r\n// $ghost_si, (-5), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-24))), $ghost_a__abs, a_base, aii-6,\r\n// OMem(MReg(EBX, (-24))), $ghost_b__abs, b_base, bii-6,\r\n// OMem(MReg(ECX, (-24))), $ghost_s__abs, s_base, sii-6,\r\n// $ghost_si, (-6), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-28))), $ghost_a__abs, a_base, aii-7,\r\n// OMem(MReg(EBX, (-28))), $ghost_b__abs, b_base, bii-7,\r\n// OMem(MReg(ECX, (-28))), $ghost_s__abs, s_base, sii-7,\r\n// $ghost_si, (-7), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-32))), $ghost_a__abs, a_base, aii-8,\r\n// OMem(MReg(EBX, (-32))), $ghost_b__abs, b_base, bii-8,\r\n// OMem(MReg(ECX, (-32))), $ghost_s__abs, s_base, sii-8,\r\n// $ghost_si, (-8), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-36))), $ghost_a__abs, a_base, aii-9,\r\n// OMem(MReg(EBX, (-36))), $ghost_b__abs, b_base, bii-9,\r\n// OMem(MReg(ECX, (-36))), $ghost_s__abs, s_base, sii-9,\r\n// $ghost_si, (-9), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-40))), $ghost_a__abs, a_base, aii-10,\r\n// OMem(MReg(EBX, (-40))), $ghost_b__abs, b_base, bii-10,\r\n// OMem(MReg(ECX, (-40))), $ghost_s__abs, s_base, sii-10,\r\n// $ghost_si, (-10), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-44))), $ghost_a__abs, a_base, aii-11,\r\n// OMem(MReg(EBX, (-44))), $ghost_b__abs, b_base, bii-11,\r\n// OMem(MReg(ECX, (-44))), $ghost_s__abs, s_base, sii-11,\r\n// $ghost_si, (-11), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-48))), $ghost_a__abs, a_base, aii-12,\r\n// OMem(MReg(EBX, (-48))), $ghost_b__abs, b_base, bii-12,\r\n// OMem(MReg(ECX, (-48))), $ghost_s__abs, s_base, sii-12,\r\n// $ghost_si, (-12), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-52))), $ghost_a__abs, a_base, aii-13,\r\n// OMem(MReg(EBX, (-52))), $ghost_b__abs, b_base, bii-13,\r\n// OMem(MReg(ECX, (-52))), $ghost_s__abs, s_base, sii-13,\r\n// $ghost_si, (-13), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-56))), $ghost_a__abs, a_base, aii-14,\r\n// OMem(MReg(EBX, (-56))), $ghost_b__abs, b_base, bii-14,\r\n// OMem(MReg(ECX, (-56))), $ghost_s__abs, s_base, sii-14,\r\n// $ghost_si, (-14), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-60))), $ghost_a__abs, a_base, aii-15,\r\n// OMem(MReg(EBX, (-60))), $ghost_b__abs, b_base, bii-15,\r\n// OMem(MReg(ECX, (-60))), $ghost_s__abs, s_base, sii-15,\r\n// $ghost_si, (-15), $ghost_carries, carry);\r\n\r\n //- Extract the final carry bit from EFL\r\n eax := 0;\r\n call r := instr_GetCf(r, EAX);\r\n assert Aligned(esp);\r\n assert Aligned(esp + 4);\r\n call Store(inout stk, esp + 4, eax);\r\n $ghost_c_out := carry;\r\n\r\n assert $ghost_a.arrAbs != $ghost_s.arrAbs;\r\n\r\n Return;\r\n}\r\n\r\n\r\n//implementation Proc_Add32__unrolled__32(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_a:ArrayOfInt, $ghost_ai:int, $ghost_b:ArrayOfInt, $ghost_bi:int, $ghost_s:ArrayOfInt, $ghost_si:int, $ghost_c_in:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_c_out:int, $ghost_carries:Seq___int)\r\n//{\r\n// var $ghost_a__abs:int;\r\n// var $ghost_b__abs:int;\r\n// var $ghost_s__abs:int;\r\n// var gcStackOffset:int;\r\n//\r\n// // Boilerplate variable propagation\r\n// r := r_old;\r\n// stk := stk_old;\r\n// statics := statics_old;\r\n// io := io_old;\r\n// mems := mems_old;\r\n// $commonVars := $commonVars_old;\r\n// $gcVars := $gcVars_old;\r\n// $toAbs := $toAbs_old;\r\n// $absMem := $absMem_old;\r\n// $stacksFrames := $stacksFrames_old;\r\n// objLayouts := objLayouts_old;\r\n// heap := heap_old;\r\n//\r\n// // Teach Beat about Dafny sequence operations\r\n// call proc_Seq__Empty__ToZero___int();\r\n// call proc_Seq__Empty__FromZero___int();\r\n// call proc_Seq__Singleton__Length___int();\r\n// call proc_Seq__Build__Length___int();\r\n// call proc_Seq__Build__Index___int();\r\n// call proc_Seq__Append__Length___int();\r\n// call proc_Seq__Index__Singleton___int();\r\n// call proc_Seq__Append__Index___int();\r\n// call proc_Seq__Update__Length___int();\r\n// call proc_Seq__Index__Update___int();\r\n// call proc_Seq__Equal__Equiv___int();\r\n// call proc_Seq__Take__Length___int();\r\n// call proc_Seq__Take__Index___int();\r\n// call proc_Seq__Drop__Length___int();\r\n// call proc_Seq__Drop__Index___int();\r\n// call proc_Seq__Append__TakeDrop___int();\r\n// // call proc_Seq__Append__TakeDrop__Restricted___int();\r\n// call proc_Seq__Update__CommuteTake1___int();\r\n// call proc_Seq__Update__CommuteTake2___int();\r\n// call proc_Seq__Update__CommuteDrop1___int();\r\n// call proc_Seq__Update__CommuteDrop2___int();\r\n// call proc_Seq__Build__CommuteDrop___int();\r\n// call proc_Seq__Take__Empty___int();\r\n// call proc_Seq__Drop__Empty___int();\r\n//\r\n// assert false;\r\n//\r\n// gcStackOffset := 0x111000;\r\n//\r\n// call proc_lemma__2toX();\r\n//\r\n// assert Aligned(esp);\r\n// // Prove that we can load arguments from the stack (b/c accesses are aligned)\r\n// assert TV(esp) && TO(0) && TO(1) && TO(2) && TO(3) && TO(4) && TO(5);\r\n//\r\n// // Prove that we can load arguments from the GC stack (b/c accesses are aligned)\r\n// assert TO(0x44401) && TO(0x44402) && TO(0x44403); // (gcStackOffset + {4,8,12}) / 4\r\n//\r\n// // Load pointer to array a into edx\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x111004)), EvalPtr(r, OMem(MReg(ESP, 0x111004)))); // 0x111004 = gcStackOffset + 4\r\n// var a_base:int;\r\n// a_base := edx;\r\n// $ghost_a__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 4))));\r\n//\r\n// // Load its length into eax\r\n// call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EAX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_a__abs, r.regs[EDX]);\r\n//\r\n// // Adjust to the \"beginning\" of the values we care about\r\n// eax := eax - 1;\r\n// call edi := Load(stk, esp + 8); // grab ai\r\n// eax := eax - edi;\r\n// var aii:int := eax;\r\n// assert aii == Arr_Length($ghost_a) - 1 - $ghost_ai;\r\n//\r\n// // Convert aii into a memory pointer\r\n// call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, aii, $ghost_a__abs, edx); // Proves we're within bounds for the Lea calculation\r\n// call eax := Lea(edx + 4 * eax + 8);\r\n// var aii_ptr @ eax; \r\n//\r\n// // Load pointer to array b into edx\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x111008)), EvalPtr(r, OMem(MReg(ESP, 0x111008)))); // 0x111008 = gcStackOffset + 8\r\n// var b_base:int;\r\n// b_base := edx;\r\n// $ghost_b__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 8))));\r\n//\r\n// // Load its length into ebx\r\n// call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_b__abs, r.regs[EDX]);\r\n//\r\n// // Adjust to the \"beginning\" of the values we care about\r\n// ebx := ebx - 1;\r\n// call edi := Load(stk, esp + 12); // grab bi\r\n// ebx := ebx - edi;\r\n// var bii:int := ebx;\r\n// assert bii == Arr_Length($ghost_b) - 1 - $ghost_bi;\r\n//\r\n// // Convert aii into a memory pointer\r\n// call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, bii, $ghost_b__abs, edx); // Proves we're within bounds for the Lea calculation\r\n// call ebx := Lea(edx + 4 * ebx + 8);\r\n// var bii_ptr @ ebx; \r\n//\r\n// // Load pointer to array s into edx\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x11100c)), EvalPtr(r, OMem(MReg(ESP, 0x11100c)))); // 0x11100c == gcStackOffset + 12\r\n// var s_base:int;\r\n// s_base := edx;\r\n// $ghost_s__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 12))));\r\n//\r\n// // Load its length into ecx\r\n// call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, ECX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_s__abs, r.regs[EDX]);\r\n//\r\n// // Adjust to the \"beginning\" of the values we care about\r\n// ecx := ecx - 1;\r\n// call edi := Load(stk, esp + 16); // grab si\r\n// ecx := ecx - edi;\r\n// var sii:int := ecx;\r\n// assert sii == Arr_Length($ghost_s) - 1 - $ghost_si;\r\n//\r\n// // Convert sii into a memory pointer\r\n// call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, sii, $ghost_s__abs, edx); // Proves we're within bounds for the Lea calculation\r\n// call ecx := Lea(edx + 4 * ecx + 8);\r\n// var sii_ptr @ ecx; \r\n//\r\n// /////////////// Start computing //////////////////////////\r\n//\r\n// // First, \"load\" c_in into CF via a sneaky addition\r\n// call edi := Load(stk, esp + 20); // grab c_in\r\n// assert edi == $ghost_c_in;\r\n// call r := instr_Add(r, EDI, OConst(0xffffffff)); \r\n// assert Cf(r.efl) == ($ghost_c_in == 1);\r\n//\r\n// // Build the carries sequence\r\n// $ghost_carries := fun_Seq__Build___int(fun_Seq__Empty___int(), $ghost_c_in);\r\n//\r\n// var carry:int;\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, 0)), $ghost_a__abs, a_base, aii-0,\r\n// OMem(MReg(EBX, 0)), $ghost_b__abs, b_base, bii-0,\r\n// OMem(MReg(ECX, 0)), $ghost_s__abs, s_base, sii-0,\r\n// $ghost_si, 0, $ghost_carries, $ghost_c_in);\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-4))), $ghost_a__abs, a_base, aii-1,\r\n// OMem(MReg(EBX, (-4))), $ghost_b__abs, b_base, bii-1,\r\n// OMem(MReg(ECX, (-4))), $ghost_s__abs, s_base, sii-1,\r\n// $ghost_si, (-1), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-8))), $ghost_a__abs, a_base, aii-2,\r\n// OMem(MReg(EBX, (-8))), $ghost_b__abs, b_base, bii-2,\r\n// OMem(MReg(ECX, (-8))), $ghost_s__abs, s_base, sii-2,\r\n// $ghost_si, (-2), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-12))), $ghost_a__abs, a_base, aii-3,\r\n// OMem(MReg(EBX, (-12))), $ghost_b__abs, b_base, bii-3,\r\n// OMem(MReg(ECX, (-12))), $ghost_s__abs, s_base, sii-3,\r\n// $ghost_si, (-3), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-16))), $ghost_a__abs, a_base, aii-4,\r\n// OMem(MReg(EBX, (-16))), $ghost_b__abs, b_base, bii-4,\r\n// OMem(MReg(ECX, (-16))), $ghost_s__abs, s_base, sii-4,\r\n// $ghost_si, (-4), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-20))), $ghost_a__abs, a_base, aii-5,\r\n// OMem(MReg(EBX, (-20))), $ghost_b__abs, b_base, bii-5,\r\n// OMem(MReg(ECX, (-20))), $ghost_s__abs, s_base, sii-5,\r\n// $ghost_si, (-5), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-24))), $ghost_a__abs, a_base, aii-6,\r\n// OMem(MReg(EBX, (-24))), $ghost_b__abs, b_base, bii-6,\r\n// OMem(MReg(ECX, (-24))), $ghost_s__abs, s_base, sii-6,\r\n// $ghost_si, (-6), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-28))), $ghost_a__abs, a_base, aii-7,\r\n// OMem(MReg(EBX, (-28))), $ghost_b__abs, b_base, bii-7,\r\n// OMem(MReg(ECX, (-28))), $ghost_s__abs, s_base, sii-7,\r\n// $ghost_si, (-7), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-32))), $ghost_a__abs, a_base, aii-8,\r\n// OMem(MReg(EBX, (-32))), $ghost_b__abs, b_base, bii-8,\r\n// OMem(MReg(ECX, (-32))), $ghost_s__abs, s_base, sii-8,\r\n// $ghost_si, (-8), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-36))), $ghost_a__abs, a_base, aii-9,\r\n// OMem(MReg(EBX, (-36))), $ghost_b__abs, b_base, bii-9,\r\n// OMem(MReg(ECX, (-36))), $ghost_s__abs, s_base, sii-9,\r\n// $ghost_si, (-9), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-40))), $ghost_a__abs, a_base, aii-10,\r\n// OMem(MReg(EBX, (-40))), $ghost_b__abs, b_base, bii-10,\r\n// OMem(MReg(ECX, (-40))), $ghost_s__abs, s_base, sii-10,\r\n// $ghost_si, (-10), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-44))), $ghost_a__abs, a_base, aii-11,\r\n// OMem(MReg(EBX, (-44))), $ghost_b__abs, b_base, bii-11,\r\n// OMem(MReg(ECX, (-44))), $ghost_s__abs, s_base, sii-11,\r\n// $ghost_si, (-11), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-48))), $ghost_a__abs, a_base, aii-12,\r\n// OMem(MReg(EBX, (-48))), $ghost_b__abs, b_base, bii-12,\r\n// OMem(MReg(ECX, (-48))), $ghost_s__abs, s_base, sii-12,\r\n// $ghost_si, (-12), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-52))), $ghost_a__abs, a_base, aii-13,\r\n// OMem(MReg(EBX, (-52))), $ghost_b__abs, b_base, bii-13,\r\n// OMem(MReg(ECX, (-52))), $ghost_s__abs, s_base, sii-13,\r\n// $ghost_si, (-13), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-56))), $ghost_a__abs, a_base, aii-14,\r\n// OMem(MReg(EBX, (-56))), $ghost_b__abs, b_base, bii-14,\r\n// OMem(MReg(ECX, (-56))), $ghost_s__abs, s_base, sii-14,\r\n// $ghost_si, (-14), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-60))), $ghost_a__abs, a_base, aii-15,\r\n// OMem(MReg(EBX, (-60))), $ghost_b__abs, b_base, bii-15,\r\n// OMem(MReg(ECX, (-60))), $ghost_s__abs, s_base, sii-15,\r\n// $ghost_si, (-15), $ghost_carries, carry);\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-64))), $ghost_a__abs, a_base, aii-16,\r\n// OMem(MReg(EBX, (-64))), $ghost_b__abs, b_base, bii-16,\r\n// OMem(MReg(ECX, (-64))), $ghost_s__abs, s_base, sii-16,\r\n// $ghost_si, (-16), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-68))), $ghost_a__abs, a_base, aii-17,\r\n// OMem(MReg(EBX, (-68))), $ghost_b__abs, b_base, bii-17,\r\n// OMem(MReg(ECX, (-68))), $ghost_s__abs, s_base, sii-17,\r\n// $ghost_si, (-17), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-72))), $ghost_a__abs, a_base, aii-18,\r\n// OMem(MReg(EBX, (-72))), $ghost_b__abs, b_base, bii-18,\r\n// OMem(MReg(ECX, (-72))), $ghost_s__abs, s_base, sii-18,\r\n// $ghost_si, (-18), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-76))), $ghost_a__abs, a_base, aii-19,\r\n// OMem(MReg(EBX, (-76))), $ghost_b__abs, b_base, bii-19,\r\n// OMem(MReg(ECX, (-76))), $ghost_s__abs, s_base, sii-19,\r\n// $ghost_si, (-19), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-80))), $ghost_a__abs, a_base, aii-20,\r\n// OMem(MReg(EBX, (-80))), $ghost_b__abs, b_base, bii-20,\r\n// OMem(MReg(ECX, (-80))), $ghost_s__abs, s_base, sii-20,\r\n// $ghost_si, (-20), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-84))), $ghost_a__abs, a_base, aii-21,\r\n// OMem(MReg(EBX, (-84))), $ghost_b__abs, b_base, bii-21,\r\n// OMem(MReg(ECX, (-84))), $ghost_s__abs, s_base, sii-21,\r\n// $ghost_si, (-21), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-88))), $ghost_a__abs, a_base, aii-22,\r\n// OMem(MReg(EBX, (-88))), $ghost_b__abs, b_base, bii-22,\r\n// OMem(MReg(ECX, (-88))), $ghost_s__abs, s_base, sii-22,\r\n// $ghost_si, (-22), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-92))), $ghost_a__abs, a_base, aii-23,\r\n// OMem(MReg(EBX, (-92))), $ghost_b__abs, b_base, bii-23,\r\n// OMem(MReg(ECX, (-92))), $ghost_s__abs, s_base, sii-23,\r\n// $ghost_si, (-23), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-96))), $ghost_a__abs, a_base, aii-24,\r\n// OMem(MReg(EBX, (-96))), $ghost_b__abs, b_base, bii-24,\r\n// OMem(MReg(ECX, (-96))), $ghost_s__abs, s_base, sii-24,\r\n// $ghost_si, (-24), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-100))), $ghost_a__abs, a_base, aii-25,\r\n// OMem(MReg(EBX, (-100))), $ghost_b__abs, b_base, bii-25,\r\n// OMem(MReg(ECX, (-100))), $ghost_s__abs, s_base, sii-25,\r\n// $ghost_si, (-25), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-104))), $ghost_a__abs, a_base, aii-26,\r\n// OMem(MReg(EBX, (-104))), $ghost_b__abs, b_base, bii-26,\r\n// OMem(MReg(ECX, (-104))), $ghost_s__abs, s_base, sii-26,\r\n// $ghost_si, (-26), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-108))), $ghost_a__abs, a_base, aii-27,\r\n// OMem(MReg(EBX, (-108))), $ghost_b__abs, b_base, bii-27,\r\n// OMem(MReg(ECX, (-108))), $ghost_s__abs, s_base, sii-27,\r\n// $ghost_si, (-27), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-112))), $ghost_a__abs, a_base, aii-28,\r\n// OMem(MReg(EBX, (-112))), $ghost_b__abs, b_base, bii-28,\r\n// OMem(MReg(ECX, (-112))), $ghost_s__abs, s_base, sii-28,\r\n// $ghost_si, (-28), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-116))), $ghost_a__abs, a_base, aii-29,\r\n// OMem(MReg(EBX, (-116))), $ghost_b__abs, b_base, bii-29,\r\n// OMem(MReg(ECX, (-116))), $ghost_s__abs, s_base, sii-29,\r\n// $ghost_si, (-29), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-120))), $ghost_a__abs, a_base, aii-30,\r\n// OMem(MReg(EBX, (-120))), $ghost_b__abs, b_base, bii-30,\r\n// OMem(MReg(ECX, (-120))), $ghost_s__abs, s_base, sii-30,\r\n// $ghost_si, (-30), $ghost_carries, carry);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-124))), $ghost_a__abs, a_base, aii-31,\r\n// OMem(MReg(EBX, (-124))), $ghost_b__abs, b_base, bii-31,\r\n// OMem(MReg(ECX, (-124))), $ghost_s__abs, s_base, sii-31,\r\n// $ghost_si, (-31), $ghost_carries, carry);\r\n//\r\n//\r\n//\r\n// // Extract the final carry bit from EFL\r\n// eax := 0;\r\n// call r := instr_GetCf(r, EAX);\r\n// assert Aligned(esp);\r\n// assert Aligned(esp + 4);\r\n// call Store(inout stk, esp + 4, eax);\r\n// $ghost_c_out := carry;\r\n//\r\n// assert $ghost_a.arrAbs != $ghost_s.arrAbs;\r\n//\r\n// Return;\r\n//}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/dafny_FatNatX86big_i.imp.beat", "content": " //-private-import BaseSpec;\r\n //-private-import MemorySpec;\r\n //-private-import IoTypesSpec;\r\n //-private-import MachineStateSpec;\r\n //-private-import AssemblySpec;\r\n //-private-import InterruptsSpec;\r\n //-private-import IoSpec;\r\n //-private-import Overflow;\r\n //-private-import Core;\r\n //-private-import LogicalAddressing;\r\n //-private-import Util;\r\n //-private-import Stacks;\r\n //-private-import Partition;\r\n //-private-import Instructions;\r\n //-private-import Separation;\r\n //-private-import IntLemmasGc;\r\n //-private-import SimpleGcMemory;\r\n //-private-import SimpleCommon;\r\n //-private-import SimpleCollector;\r\n //-private-import IntLemmasMain;\r\n //-private-import IntLemmasBase;\r\n //-private-import IoMain;\r\n //-private-basmonly-import Trusted;\r\n //-private-basmonly-import Checked;\r\n //-private-import Heap;\r\n //-private-import Seq;\r\n //-private-import dafny_DafnyPrelude;\r\n //-private-import DafnyAssembly;\r\n //-private-import dafny_base_s;\r\n //-private-import dafny_power2_s;\r\n //-private-import dafny_bytes_and_words_s;\r\n //-private-import dafny_be_sequences_s;\r\n //-private-import dafny_integer_sequences_s;\r\n //-private-import dafny_seqs_simple_i;\r\n //-private-import dafny_power_s;\r\n //-private-import dafny_mul_nonlinear_i;\r\n //-private-import dafny_mul_i;\r\n //-private-import dafny_power_i;\r\n //-private-import dafny_div_def_i;\r\n //-private-import dafny_div_boogie_i;\r\n //-private-import dafny_div_nonlinear_i;\r\n //-private-import dafny_div_i;\r\n //-private-import dafny_repeat_digit_i;\r\n //-private-import dafny_assembly_s;\r\n //-private-import dafny_power2_i;\r\n //-private-import dafny_seqs_and_ints_i;\r\n //-private-import dafny_seqs_common_i;\r\n //-private-import dafny_Word32_i;\r\n //-private-import dafny_relational_s;\r\n //-private-import dafny_assembly_i;\r\n //-private-import dafny_arrays_i;\r\n //-private-import dafny_seqs_transforms_i;\r\n //-private-import dafny_seqs_reverse_i;\r\n //-private-import dafny_integer_sequences_i;\r\n //-private-import dafny_integer_sequences_premium_i;\r\n //-private-import dafny_assembly_premium_i;\r\n //-private-import dafny_BigNatX86Shim_i;\r\n //-private-import dafny_seqs_canonical_i;\r\n //-private-import dafny_CanonicalArrays_i;\r\n //-private-import dafny_FatNatCommon_i;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n\r\nmodule implementation dafny_FatNatX86big_i\r\n{\r\n\r\nprocedure arrayAdd(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_a:ArrayOfInt, $ghost_b:ArrayOfInt, $ghost_s:ArrayOfInt, a_opn:opn_mem, $ghost_a__abs:int, a_base:int, a_offset:int, b_opn:opn_mem, $ghost_b__abs:int, b_base:int, b_offset:int, s_opn:opn_mem, $ghost_s__abs:int, s_base:int, s_offset:int, $ghost_si:int, index_offset:int, old_carries:Seq___int, old_carry:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, new_carry:int, new_carries:Seq___int)\r\n requires MemInv(me,init,stk_old,statics_old,core_state,ptMem,mems_old);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk_old,statics_old,core_state,ptMem,mems_old,$stacksFrames_old,io_old);\r\n requires HeapInv($absMem_old, objLayouts_old, heap_old);\r\n requires $ghost_a != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires fun_IsWordSeq(fun_Seq__FromArray($absMem_old, $ghost_a));\r\n requires $ghost_b != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires fun_IsWordSeq(fun_Seq__FromArray($absMem_old, $ghost_b));\r\n requires $ghost_s != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires $ghost_b != $ghost_s;\r\n requires $ghost_a != $ghost_s;\r\n requires $ghost_a__abs != $ghost_s__abs;\r\n requires $ghost_b__abs != $ghost_s__abs;\r\n\r\n requires s_offset == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset;\r\n\r\n requires old_carry == if (Cf(r_old.efl)) then 1 else 0;\r\n\r\n requires $ghost_a.arrAbs == $ghost_a__abs;\r\n requires HeapAbsData(heap_old, $ghost_a__abs) is Abs_ArrayOfInt;\r\n requires 0 <= a_offset && a_offset < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, a_base, $ghost_a__abs);\r\n requires EvalPtrOk(a_opn);\r\n requires EvalPtr(r_old, a_opn) == a_base + 4 * (2 + a_offset);\r\n requires a_opn._ptr is MReg && a_opn._ptr._mreg == EAX;\r\n\r\n requires $ghost_b.arrAbs == $ghost_b__abs;\r\n requires HeapAbsData(heap_old, $ghost_b__abs) is Abs_ArrayOfInt;\r\n requires 0 <= b_offset && b_offset < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, b_base, $ghost_b__abs);\r\n requires EvalPtrOk(b_opn);\r\n requires EvalPtr(r_old, b_opn) == b_base + 4 * (2 + b_offset);\r\n requires b_opn._ptr is MReg && b_opn._ptr._mreg == EBX;\r\n\r\n requires $ghost_s.arrAbs == $ghost_s__abs;\r\n requires HeapAbsData(heap_old, $ghost_s__abs) is Abs_ArrayOfInt;\r\n requires 0 <= s_offset && s_offset < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, s_base, $ghost_s__abs);\r\n requires EvalPtrOk(s_opn);\r\n requires EvalPtr(r_old, s_opn) == s_base + 4 * (2 + s_offset);\r\n requires s_opn._ptr is MReg && s_opn._ptr._mreg == ECX;\r\n\r\n modifies $Time;\r\n ensures stk == stk_old;\r\n ensures $stacksFrames == $stacksFrames_old;\r\n ensures (forall i:int::{$stacksFrames[$S].Abss[i]} i != EvalPtr(r_old, s_opn) ==> $stacksFrames[$S].Abss[i] == $stacksFrames_old[$S].Abss[i]);\r\n\r\n ensures MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n ensures HeapInv($absMem, objLayouts, heap);\r\n ensures AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n ensures (forall i:int::{$absMem[i]}{heap.absData[i]} heap_old.absData[i] is AbsNone || (heap.absData[i] == heap_old.absData[i] && ($absMem[i] == $absMem_old[i] || i == (($ghost_s).arrAbs))));\r\n ensures io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n //- Only havocs edi, ebp\r\n ensures r.regs[EAX] == r_old.regs[EAX];\r\n ensures r.regs[EBX] == r_old.regs[EBX];\r\n ensures r.regs[ECX] == r_old.regs[ECX];\r\n ensures r.regs[EDX] == r_old.regs[EDX];\r\n ensures r.regs[ESI] == r_old.regs[ESI];\r\n ensures r.regs[ESP] == r_old.regs[ESP];\r\n\r\n ensures HeapValue(objLayouts, true, $toAbs, a_base, $ghost_a__abs);\r\n ensures HeapValue(objLayouts, true, $toAbs, b_base, $ghost_b__abs);\r\n ensures HeapValue(objLayouts, true, $toAbs, s_base, $ghost_s__abs);\r\n\r\n ensures new_carry == if (Cf(r.efl)) then 1 else 0;\r\n ensures new_carry == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset) + old_carry) >= WORD_HI) then 1 else 0;\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset) + old_carry);\r\n\r\n //- Arrays A and B are unmodified\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_a)))))) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_a.arrAbs], j)))));\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_b)))))) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_b.arrAbs], j)))));\r\n\r\n //- Array S is unmodified except for the one entry we touch\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_s.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_s))))) && j != s_offset) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_s.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_s.arrAbs], j)))));\r\n\r\n ensures fun_Seq__Length___int(new_carries) == fun_Seq__Length___int(old_carries) + 1;\r\n ensures (forall i:int :: 0 <= i && i < fun_Seq__Length___int(old_carries) ==> fun_Seq__Index___int(new_carries, i) == fun_Seq__Index___int(old_carries, i));\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 1) == new_carry;\r\n{\r\n //- Boilerplate variable propagation\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n\r\n //- Teach Beat about Dafny sequence operations\r\n call proc_Seq__Empty__ToZero___int();\r\n call proc_Seq__Empty__FromZero___int();\r\n call proc_Seq__Singleton__Length___int();\r\n call proc_Seq__Build__Length___int();\r\n call proc_Seq__Build__Index___int();\r\n call proc_Seq__Append__Length___int();\r\n call proc_Seq__Index__Singleton___int();\r\n call proc_Seq__Append__Index___int();\r\n call proc_Seq__Update__Length___int();\r\n call proc_Seq__Index__Update___int();\r\n call proc_Seq__Equal__Equiv___int();\r\n call proc_Seq__Take__Length___int();\r\n call proc_Seq__Take__Index___int();\r\n call proc_Seq__Drop__Length___int();\r\n call proc_Seq__Drop__Index___int();\r\n call proc_Seq__Append__TakeDrop___int();\r\n call proc_Seq__Update__CommuteTake1___int();\r\n call proc_Seq__Update__CommuteTake2___int();\r\n call proc_Seq__Update__CommuteDrop1___int();\r\n call proc_Seq__Update__CommuteDrop2___int();\r\n call proc_Seq__Build__CommuteDrop___int();\r\n call proc_Seq__Take__Empty___int();\r\n call proc_Seq__Drop__Empty___int();\r\n\r\n call proc_lemma__2toX();\r\n\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EDI, a_opn, a_offset, $ghost_a__abs, a_base); //- edi <- a[aii+1]\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBP, b_opn, b_offset, $ghost_b__abs, b_base); //- ebp <- b[bii+1]\r\n\r\n var old_edi:int := edi;\r\n var next_efl:int := r.efl;\r\n call edi := AddCarry(edi, ebp); //- edi == a[aii+index_offset] + b[bii+index_offset] + carry\r\n call reveal_wrap32(old_edi + ebp + old_carry);\r\n new_carry := if (old_edi + ebp + old_carry >= WORD_HI) then 1 else 0;\r\n new_carries := fun_Seq__Append___int(old_carries, fun_Seq__Build___int(fun_Seq__Empty___int(), new_carry));\r\n\r\n //- Write the result in edi back to s[sii+index_offset]\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, s_opn, OReg(EDI), s_offset, edi, $ghost_s__abs, s_base);\r\n\r\n call reveal_wrap32(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset) + old_carry);\r\n call reveal_WORD_HI();\r\n}\r\n\r\n\r\n\r\nprocedure arrayAdd4(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_a:ArrayOfInt, $ghost_b:ArrayOfInt, $ghost_s:ArrayOfInt, a_opn1:opn_mem, a_opn2:opn_mem, a_opn3:opn_mem, a_opn4:opn_mem,$ghost_a__abs:int, a_base:int, a_offset1:int, a_offset2:int, a_offset3:int, a_offset4:int, b_opn1:opn_mem, b_opn2:opn_mem, b_opn3:opn_mem, b_opn4:opn_mem, $ghost_b__abs:int, b_base:int, b_offset1:int, b_offset2:int, b_offset3:int, b_offset4:int, s_opn1:opn_mem, s_opn2:opn_mem, s_opn3:opn_mem, s_opn4:opn_mem, $ghost_s__abs:int, s_base:int, s_offset1:int, s_offset2:int, s_offset3:int, s_offset4:int, $ghost_si:int, index_offset1:int, index_offset2:int, index_offset3:int, index_offset4:int, old_carries:Seq___int, old_carry:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, new_carry:int, new_carries:Seq___int)\r\n requires MemInv(me,init,stk_old,statics_old,core_state,ptMem,mems_old);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk_old,statics_old,core_state,ptMem,mems_old,$stacksFrames_old,io_old);\r\n requires HeapInv($absMem_old, objLayouts_old, heap_old);\r\n requires $ghost_a != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires fun_IsWordSeq(fun_Seq__FromArray($absMem_old, $ghost_a));\r\n requires $ghost_b != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires fun_IsWordSeq(fun_Seq__FromArray($absMem_old, $ghost_b));\r\n requires $ghost_s != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires $ghost_b != $ghost_s;\r\n requires $ghost_a != $ghost_s;\r\n requires $ghost_a__abs != $ghost_s__abs;\r\n requires $ghost_b__abs != $ghost_s__abs;\r\n\r\n requires s_offset1 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset1;\r\n requires s_offset2 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset2;\r\n requires s_offset3 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset3;\r\n requires s_offset4 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset4;\r\n\r\n requires old_carry == if (Cf(r_old.efl)) then 1 else 0;\r\n\r\n requires $ghost_a.arrAbs == $ghost_a__abs;\r\n requires HeapAbsData(heap_old, $ghost_a__abs) is Abs_ArrayOfInt;\r\n requires 0 <= a_offset1 && a_offset1 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires 0 <= a_offset2 && a_offset2 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires 0 <= a_offset3 && a_offset3 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires 0 <= a_offset4 && a_offset4 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, a_base, $ghost_a__abs);\r\n requires EvalPtrOk(a_opn1);\r\n requires EvalPtrOk(a_opn2);\r\n requires EvalPtrOk(a_opn3);\r\n requires EvalPtrOk(a_opn4);\r\n requires EvalPtr(r_old, a_opn1) == a_base + 4 * (2 + a_offset1);\r\n requires EvalPtr(r_old, a_opn2) == a_base + 4 * (2 + a_offset2);\r\n requires EvalPtr(r_old, a_opn3) == a_base + 4 * (2 + a_offset3);\r\n requires EvalPtr(r_old, a_opn4) == a_base + 4 * (2 + a_offset4);\r\n requires a_offset1 == a_offset2 + 1 && a_offset2 == a_offset3 + 1 && a_offset3 == a_offset4 + 1;\r\n requires a_opn1._ptr is MReg && a_opn1._ptr._mreg == EAX;\r\n requires a_opn2._ptr is MReg && a_opn2._ptr._mreg == EAX;\r\n requires a_opn3._ptr is MReg && a_opn3._ptr._mreg == EAX;\r\n requires a_opn4._ptr is MReg && a_opn4._ptr._mreg == EAX;\r\n\r\n requires $ghost_b.arrAbs == $ghost_b__abs;\r\n requires HeapAbsData(heap_old, $ghost_b__abs) is Abs_ArrayOfInt;\r\n requires 0 <= b_offset1 && b_offset1 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires 0 <= b_offset2 && b_offset2 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires 0 <= b_offset3 && b_offset3 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires 0 <= b_offset4 && b_offset4 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, b_base, $ghost_b__abs);\r\n requires EvalPtrOk(b_opn1);\r\n requires EvalPtrOk(b_opn2);\r\n requires EvalPtrOk(b_opn3);\r\n requires EvalPtrOk(b_opn4);\r\n requires EvalPtr(r_old, b_opn1) == b_base + 4 * (2 + b_offset1);\r\n requires EvalPtr(r_old, b_opn2) == b_base + 4 * (2 + b_offset2);\r\n requires EvalPtr(r_old, b_opn3) == b_base + 4 * (2 + b_offset3);\r\n requires EvalPtr(r_old, b_opn4) == b_base + 4 * (2 + b_offset4);\r\n requires b_offset1 == b_offset2 + 1 && b_offset2 == b_offset3 + 1 && b_offset3 == b_offset4 + 1;\r\n requires b_opn1._ptr is MReg && b_opn1._ptr._mreg == EBX;\r\n requires b_opn2._ptr is MReg && b_opn2._ptr._mreg == EBX;\r\n requires b_opn3._ptr is MReg && b_opn3._ptr._mreg == EBX;\r\n requires b_opn4._ptr is MReg && b_opn4._ptr._mreg == EBX;\r\n\r\n requires $ghost_s.arrAbs == $ghost_s__abs;\r\n requires HeapAbsData(heap_old, $ghost_s__abs) is Abs_ArrayOfInt;\r\n requires 0 <= s_offset1 && s_offset1 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires 0 <= s_offset2 && s_offset2 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires 0 <= s_offset3 && s_offset3 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires 0 <= s_offset4 && s_offset4 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n\r\n requires INTERNAL_lt_boogie(s_offset1, (Arr_Length($ghost_s)));\r\n requires INTERNAL_lt_boogie(s_offset2, (Arr_Length($ghost_s)));\r\n requires INTERNAL_lt_boogie(s_offset3, (Arr_Length($ghost_s)));\r\n requires INTERNAL_lt_boogie(s_offset4, (Arr_Length($ghost_s)));\r\n\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, s_base, $ghost_s__abs);\r\n\r\n requires EvalPtrOk(s_opn1);\r\n requires EvalPtrOk(s_opn2);\r\n requires EvalPtrOk(s_opn3);\r\n requires EvalPtrOk(s_opn4);\r\n requires EvalPtr(r_old, s_opn1) == s_base + 4 * (2 + s_offset1);\r\n requires EvalPtr(r_old, s_opn2) == s_base + 4 * (2 + s_offset2);\r\n requires EvalPtr(r_old, s_opn3) == s_base + 4 * (2 + s_offset3);\r\n requires EvalPtr(r_old, s_opn4) == s_base + 4 * (2 + s_offset4);\r\n requires s_offset1 == s_offset2 + 1 && s_offset2 == s_offset3 + 1 && s_offset3 == s_offset4 + 1;\r\n requires s_opn1._ptr is MReg && s_opn1._ptr._mreg == ECX;\r\n requires s_opn2._ptr is MReg && s_opn2._ptr._mreg == ECX;\r\n requires s_opn3._ptr is MReg && s_opn3._ptr._mreg == ECX;\r\n requires s_opn4._ptr is MReg && s_opn4._ptr._mreg == ECX;\r\n\r\n requires fun_Seq__Length___int(old_carries) > 0;\r\n requires fun_Seq__Index___int(old_carries, fun_Seq__Length___int(old_carries) - 1) == old_carry;\r\n\r\n modifies $Time;\r\n ensures stk == stk_old;\r\n ensures $stacksFrames == $stacksFrames_old;\r\n ensures (forall i:int::{$stacksFrames[$S].Abss[i]} i != EvalPtr(r_old, s_opn1) && i != EvalPtr(r_old, s_opn2) && i != EvalPtr(r_old, s_opn3) && i != EvalPtr(r_old, s_opn4) ==> $stacksFrames[$S].Abss[i] == $stacksFrames_old[$S].Abss[i]);\r\n\r\n ensures MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n ensures HeapInv($absMem, objLayouts, heap);\r\n ensures AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n ensures (forall i:int::{$absMem[i]}{heap.absData[i]} heap_old.absData[i] is AbsNone || (heap.absData[i] == heap_old.absData[i] && ($absMem[i] == $absMem_old[i] || i == (($ghost_s).arrAbs))));\r\n ensures io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n //- Only havocs edi, ebp\r\n ensures r.regs[EAX] == r_old.regs[EAX];\r\n ensures r.regs[EBX] == r_old.regs[EBX];\r\n ensures r.regs[ECX] == r_old.regs[ECX];\r\n ensures r.regs[EDX] == r_old.regs[EDX];\r\n ensures r.regs[ESI] == r_old.regs[ESI];\r\n ensures r.regs[ESP] == r_old.regs[ESP];\r\n\r\n ensures HeapValue(objLayouts, true, $toAbs, a_base, $ghost_a__abs);\r\n ensures HeapValue(objLayouts, true, $toAbs, b_base, $ghost_b__abs);\r\n ensures HeapValue(objLayouts, true, $toAbs, s_base, $ghost_s__abs);\r\n\r\n ensures new_carry == if (Cf(r.efl)) then 1 else 0;\r\n ensures new_carry == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset4) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset4) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 2)) >= WORD_HI) then 1 else 0;\r\n //if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset4) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset4) + old_carry) >= WORD_HI) then 1 else 0;\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset1) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset1) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset1) + old_carry);\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset2) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset2) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset2) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 4));\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset3) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset3) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset3) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 3));\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset4) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset4) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset4) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 2));\r\n\r\n //- Arrays A and B are unmodified\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_a)))))) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_a.arrAbs], j)))));\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_b)))))) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_b.arrAbs], j)))));\r\n\r\n //- Array S is unmodified except for the four entries we touch\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_s.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_s))))) && j != s_offset1 && j != s_offset2 && j != s_offset3 && j != s_offset4) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_s.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_s.arrAbs], j)))));\r\n\r\n ensures fun_Seq__Length___int(new_carries) == fun_Seq__Length___int(old_carries) + 4;\r\n ensures (forall i:int :: 0 <= i && i < fun_Seq__Length___int(old_carries) ==> fun_Seq__Index___int(new_carries, i) == fun_Seq__Index___int(old_carries, i));\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 4) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset1) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset1) + old_carry) >= WORD_HI) then 1 else 0;\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 3) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset2) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset2) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 4)) >= WORD_HI) then 1 else 0;\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 2) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset3) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset3) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 3)) >= WORD_HI) then 1 else 0;\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 1) == new_carry;\r\n ensures (forall i:int :: TV(i) && 1 <= i && i <= 4 ==> fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - i) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset4 + i - 1) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset4 + i - 1) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - (i+1))) >= WORD_HI) then 1 else 0);\r\n{\r\n var $ghost_carries:Seq___int;\r\n var carry1:int;\r\n var carry2:int;\r\n var carry3:int;\r\n //- Boilerplate variable propagation\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n\r\n //- Teach Beat about Dafny sequence operations\r\n call proc_Seq__Empty__ToZero___int();\r\n call proc_Seq__Empty__FromZero___int();\r\n call proc_Seq__Singleton__Length___int();\r\n call proc_Seq__Build__Length___int();\r\n call proc_Seq__Build__Index___int();\r\n call proc_Seq__Append__Length___int();\r\n call proc_Seq__Index__Singleton___int();\r\n call proc_Seq__Append__Index___int();\r\n call proc_Seq__Update__Length___int();\r\n call proc_Seq__Index__Update___int();\r\n call proc_Seq__Equal__Equiv___int();\r\n call proc_Seq__Take__Length___int();\r\n call proc_Seq__Take__Index___int();\r\n call proc_Seq__Drop__Length___int();\r\n call proc_Seq__Drop__Index___int();\r\n call proc_Seq__Append__TakeDrop___int();\r\n call proc_Seq__Update__CommuteTake1___int();\r\n call proc_Seq__Update__CommuteTake2___int();\r\n call proc_Seq__Update__CommuteDrop1___int();\r\n call proc_Seq__Update__CommuteDrop2___int();\r\n call proc_Seq__Build__CommuteDrop___int();\r\n call proc_Seq__Take__Empty___int();\r\n call proc_Seq__Drop__Empty___int();\r\n\r\n call proc_lemma__2toX();\r\n\r\n $ghost_carries := old_carries;\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry1, $ghost_carries := \r\n arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n a_opn1, $ghost_a__abs, a_base, a_offset1,\r\n b_opn1, $ghost_b__abs, b_base, b_offset1,\r\n s_opn1, $ghost_s__abs, s_base, s_offset1,\r\n $ghost_si, index_offset1, $ghost_carries, old_carry);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry2, $ghost_carries := \r\n arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n a_opn2, $ghost_a__abs, a_base, a_offset2,\r\n b_opn2, $ghost_b__abs, b_base, b_offset2,\r\n s_opn2, $ghost_s__abs, s_base, s_offset2,\r\n $ghost_si, index_offset2, $ghost_carries, carry1);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry3, $ghost_carries := \r\n arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n a_opn3, $ghost_a__abs, a_base, a_offset3,\r\n b_opn3, $ghost_b__abs, b_base, b_offset3,\r\n s_opn3, $ghost_s__abs, s_base, s_offset3,\r\n $ghost_si, index_offset3, $ghost_carries, carry2);\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, new_carry, $ghost_carries := \r\n arrayAdd(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n a_opn4, $ghost_a__abs, a_base, a_offset4,\r\n b_opn4, $ghost_b__abs, b_base, b_offset4,\r\n s_opn4, $ghost_s__abs, s_base, s_offset4,\r\n $ghost_si, index_offset4, $ghost_carries, carry3);\r\n\r\n new_carries := $ghost_carries;\r\n}\r\n\r\n\r\nprocedure arrayAdd8(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_a:ArrayOfInt, $ghost_b:ArrayOfInt, $ghost_s:ArrayOfInt, a_opn1:opn_mem, a_opn2:opn_mem, a_opn3:opn_mem, a_opn4:opn_mem,a_opn5:opn_mem,a_opn6:opn_mem,a_opn7:opn_mem,a_opn8:opn_mem,$ghost_a__abs:int, a_base:int, a_offset1:int, a_offset2:int, a_offset3:int, a_offset4:int, a_offset5:int, a_offset6:int, a_offset7:int, a_offset8:int, b_opn1:opn_mem, b_opn2:opn_mem, b_opn3:opn_mem, b_opn4:opn_mem,b_opn5:opn_mem,b_opn6:opn_mem,b_opn7:opn_mem,b_opn8:opn_mem, $ghost_b__abs:int, b_base:int, b_offset1:int, b_offset2:int, b_offset3:int, b_offset4:int, b_offset5:int, b_offset6:int, b_offset7:int, b_offset8:int, s_opn1:opn_mem, s_opn2:opn_mem, s_opn3:opn_mem, s_opn4:opn_mem, s_opn5:opn_mem, s_opn6:opn_mem, s_opn7:opn_mem, s_opn8:opn_mem, $ghost_s__abs:int, s_base:int, s_offset1:int, s_offset2:int, s_offset3:int, s_offset4:int, s_offset5:int, s_offset6:int, s_offset7:int, s_offset8:int, $ghost_si:int, index_offset1:int, index_offset2:int, index_offset3:int, index_offset4:int, index_offset5:int, index_offset6:int, index_offset7:int, index_offset8:int, old_carries:Seq___int, old_carry:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, new_carry:int, new_carries:Seq___int)\r\n requires MemInv(me,init,stk_old,statics_old,core_state,ptMem,mems_old);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk_old,statics_old,core_state,ptMem,mems_old,$stacksFrames_old,io_old);\r\n requires HeapInv($absMem_old, objLayouts_old, heap_old);\r\n requires $ghost_a != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires fun_IsWordSeq(fun_Seq__FromArray($absMem_old, $ghost_a));\r\n requires $ghost_b != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires fun_IsWordSeq(fun_Seq__FromArray($absMem_old, $ghost_b));\r\n requires $ghost_s != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires $ghost_b != $ghost_s;\r\n requires $ghost_a != $ghost_s;\r\n requires $ghost_a__abs != $ghost_s__abs;\r\n requires $ghost_b__abs != $ghost_s__abs;\r\n\r\n requires s_offset1 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset1;\r\n requires s_offset2 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset2;\r\n requires s_offset3 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset3;\r\n requires s_offset4 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset4;\r\n requires s_offset5 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset5;\r\n requires s_offset6 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset6;\r\n requires s_offset7 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset7;\r\n requires s_offset8 == Arr_Length($ghost_s) - 1 - $ghost_si + index_offset8;\r\n\r\n requires old_carry == if (Cf(r_old.efl)) then 1 else 0;\r\n\r\n requires $ghost_a.arrAbs == $ghost_a__abs;\r\n requires HeapAbsData(heap_old, $ghost_a__abs) is Abs_ArrayOfInt;\r\n requires 0 <= a_offset1 && a_offset1 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires 0 <= a_offset2 && a_offset2 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires 0 <= a_offset3 && a_offset3 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires 0 <= a_offset4 && a_offset4 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires 0 <= a_offset5 && a_offset5 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires 0 <= a_offset6 && a_offset6 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires 0 <= a_offset7 && a_offset7 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires 0 <= a_offset8 && a_offset8 < HeapAbsData(heap_old, $ghost_a__abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, a_base, $ghost_a__abs);\r\n requires EvalPtrOk(a_opn1);\r\n requires EvalPtrOk(a_opn2);\r\n requires EvalPtrOk(a_opn3);\r\n requires EvalPtrOk(a_opn4);\r\n requires EvalPtrOk(a_opn5);\r\n requires EvalPtrOk(a_opn6);\r\n requires EvalPtrOk(a_opn7);\r\n requires EvalPtrOk(a_opn8);\r\n requires EvalPtr(r_old, a_opn1) == a_base + 4 * (2 + a_offset1);\r\n requires EvalPtr(r_old, a_opn2) == a_base + 4 * (2 + a_offset2);\r\n requires EvalPtr(r_old, a_opn3) == a_base + 4 * (2 + a_offset3);\r\n requires EvalPtr(r_old, a_opn4) == a_base + 4 * (2 + a_offset4);\r\n requires EvalPtr(r_old, a_opn5) == a_base + 4 * (2 + a_offset5);\r\n requires EvalPtr(r_old, a_opn6) == a_base + 4 * (2 + a_offset6);\r\n requires EvalPtr(r_old, a_opn7) == a_base + 4 * (2 + a_offset7);\r\n requires EvalPtr(r_old, a_opn8) == a_base + 4 * (2 + a_offset8);\r\n requires a_offset1 == a_offset2 + 1 && a_offset2 == a_offset3 + 1 && a_offset3 == a_offset4 + 1;\r\n requires a_offset4 == a_offset5 + 1 && a_offset5 == a_offset6 + 1 && a_offset6 == a_offset7 + 1 && a_offset7 == a_offset8 + 1;\r\n requires a_opn1._ptr is MReg && a_opn1._ptr._mreg == EAX;\r\n requires a_opn2._ptr is MReg && a_opn2._ptr._mreg == EAX;\r\n requires a_opn3._ptr is MReg && a_opn3._ptr._mreg == EAX;\r\n requires a_opn4._ptr is MReg && a_opn4._ptr._mreg == EAX;\r\n requires a_opn5._ptr is MReg && a_opn5._ptr._mreg == EAX;\r\n requires a_opn6._ptr is MReg && a_opn6._ptr._mreg == EAX;\r\n requires a_opn7._ptr is MReg && a_opn7._ptr._mreg == EAX;\r\n requires a_opn8._ptr is MReg && a_opn8._ptr._mreg == EAX;\r\n\r\n requires $ghost_b.arrAbs == $ghost_b__abs;\r\n requires HeapAbsData(heap_old, $ghost_b__abs) is Abs_ArrayOfInt;\r\n requires 0 <= b_offset1 && b_offset1 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires 0 <= b_offset2 && b_offset2 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires 0 <= b_offset3 && b_offset3 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires 0 <= b_offset4 && b_offset4 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires 0 <= b_offset5 && b_offset5 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires 0 <= b_offset6 && b_offset6 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires 0 <= b_offset7 && b_offset7 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires 0 <= b_offset8 && b_offset8 < HeapAbsData(heap_old, $ghost_b__abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, b_base, $ghost_b__abs);\r\n requires EvalPtrOk(b_opn1);\r\n requires EvalPtrOk(b_opn2);\r\n requires EvalPtrOk(b_opn3);\r\n requires EvalPtrOk(b_opn4);\r\n requires EvalPtrOk(b_opn5);\r\n requires EvalPtrOk(b_opn6);\r\n requires EvalPtrOk(b_opn7);\r\n requires EvalPtrOk(b_opn8);\r\n requires EvalPtr(r_old, b_opn1) == b_base + 4 * (2 + b_offset1);\r\n requires EvalPtr(r_old, b_opn2) == b_base + 4 * (2 + b_offset2);\r\n requires EvalPtr(r_old, b_opn3) == b_base + 4 * (2 + b_offset3);\r\n requires EvalPtr(r_old, b_opn4) == b_base + 4 * (2 + b_offset4);\r\n requires EvalPtr(r_old, b_opn5) == b_base + 4 * (2 + b_offset5);\r\n requires EvalPtr(r_old, b_opn6) == b_base + 4 * (2 + b_offset6);\r\n requires EvalPtr(r_old, b_opn7) == b_base + 4 * (2 + b_offset7);\r\n requires EvalPtr(r_old, b_opn8) == b_base + 4 * (2 + b_offset8);\r\n requires b_offset1 == b_offset2 + 1 && b_offset2 == b_offset3 + 1 && b_offset3 == b_offset4 + 1;\r\n requires b_offset4 == b_offset5 + 1 && b_offset5 == b_offset6 + 1 && b_offset6 == b_offset7 + 1 && b_offset7 == b_offset8 + 1;\r\n requires b_opn1._ptr is MReg && b_opn1._ptr._mreg == EBX;\r\n requires b_opn2._ptr is MReg && b_opn2._ptr._mreg == EBX;\r\n requires b_opn3._ptr is MReg && b_opn3._ptr._mreg == EBX;\r\n requires b_opn4._ptr is MReg && b_opn4._ptr._mreg == EBX;\r\n requires b_opn5._ptr is MReg && b_opn5._ptr._mreg == EBX;\r\n requires b_opn6._ptr is MReg && b_opn6._ptr._mreg == EBX;\r\n requires b_opn7._ptr is MReg && b_opn7._ptr._mreg == EBX;\r\n requires b_opn8._ptr is MReg && b_opn8._ptr._mreg == EBX;\r\n\r\n requires $ghost_s.arrAbs == $ghost_s__abs;\r\n requires HeapAbsData(heap_old, $ghost_s__abs) is Abs_ArrayOfInt;\r\n requires 0 <= s_offset1 && s_offset1 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires 0 <= s_offset2 && s_offset2 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires 0 <= s_offset3 && s_offset3 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires 0 <= s_offset4 && s_offset4 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires 0 <= s_offset5 && s_offset5 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires 0 <= s_offset6 && s_offset6 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires 0 <= s_offset7 && s_offset7 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n requires 0 <= s_offset8 && s_offset8 < HeapAbsData(heap_old, $ghost_s__abs).arr.arrCount;\r\n\r\n requires INTERNAL_lt_boogie(s_offset1, (Arr_Length($ghost_s)));\r\n requires INTERNAL_lt_boogie(s_offset2, (Arr_Length($ghost_s)));\r\n requires INTERNAL_lt_boogie(s_offset3, (Arr_Length($ghost_s)));\r\n requires INTERNAL_lt_boogie(s_offset4, (Arr_Length($ghost_s)));\r\n requires INTERNAL_lt_boogie(s_offset5, (Arr_Length($ghost_s)));\r\n requires INTERNAL_lt_boogie(s_offset6, (Arr_Length($ghost_s)));\r\n requires INTERNAL_lt_boogie(s_offset7, (Arr_Length($ghost_s)));\r\n requires INTERNAL_lt_boogie(s_offset8, (Arr_Length($ghost_s)));\r\n\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, s_base, $ghost_s__abs);\r\n\r\n requires EvalPtrOk(s_opn1);\r\n requires EvalPtrOk(s_opn2);\r\n requires EvalPtrOk(s_opn3);\r\n requires EvalPtrOk(s_opn4);\r\n requires EvalPtrOk(s_opn5);\r\n requires EvalPtrOk(s_opn6);\r\n requires EvalPtrOk(s_opn7);\r\n requires EvalPtrOk(s_opn8);\r\n requires EvalPtr(r_old, s_opn1) == s_base + 4 * (2 + s_offset1);\r\n requires EvalPtr(r_old, s_opn2) == s_base + 4 * (2 + s_offset2);\r\n requires EvalPtr(r_old, s_opn3) == s_base + 4 * (2 + s_offset3);\r\n requires EvalPtr(r_old, s_opn4) == s_base + 4 * (2 + s_offset4);\r\n requires EvalPtr(r_old, s_opn5) == s_base + 4 * (2 + s_offset5);\r\n requires EvalPtr(r_old, s_opn6) == s_base + 4 * (2 + s_offset6);\r\n requires EvalPtr(r_old, s_opn7) == s_base + 4 * (2 + s_offset7);\r\n requires EvalPtr(r_old, s_opn8) == s_base + 4 * (2 + s_offset8);\r\n requires s_offset1 == s_offset2 + 1 && s_offset2 == s_offset3 + 1 && s_offset3 == s_offset4 + 1;\r\n requires s_offset4 == s_offset5 + 1 && s_offset5 == s_offset6 + 1 && s_offset6 == s_offset7 + 1 && s_offset7 == s_offset8 + 1;\r\n requires s_opn1._ptr is MReg && s_opn1._ptr._mreg == ECX;\r\n requires s_opn2._ptr is MReg && s_opn2._ptr._mreg == ECX;\r\n requires s_opn3._ptr is MReg && s_opn3._ptr._mreg == ECX;\r\n requires s_opn4._ptr is MReg && s_opn4._ptr._mreg == ECX;\r\n requires s_opn5._ptr is MReg && s_opn5._ptr._mreg == ECX;\r\n requires s_opn6._ptr is MReg && s_opn6._ptr._mreg == ECX;\r\n requires s_opn7._ptr is MReg && s_opn7._ptr._mreg == ECX;\r\n requires s_opn8._ptr is MReg && s_opn8._ptr._mreg == ECX;\r\n\r\n requires fun_Seq__Length___int(old_carries) > 0;\r\n requires fun_Seq__Index___int(old_carries, fun_Seq__Length___int(old_carries) - 1) == old_carry;\r\n\r\n modifies $Time;\r\n ensures stk == stk_old;\r\n ensures $stacksFrames == $stacksFrames_old;\r\n ensures (forall i:int::{$stacksFrames[$S].Abss[i]} i != EvalPtr(r_old, s_opn1) && i != EvalPtr(r_old, s_opn2) \r\n && i != EvalPtr(r_old, s_opn3) \r\n && i != EvalPtr(r_old, s_opn4) \r\n && i != EvalPtr(r_old, s_opn5) \r\n && i != EvalPtr(r_old, s_opn6) \r\n && i != EvalPtr(r_old, s_opn7) \r\n && i != EvalPtr(r_old, s_opn8) \r\n ==> $stacksFrames[$S].Abss[i] == $stacksFrames_old[$S].Abss[i]);\r\n\r\n ensures MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n ensures HeapInv($absMem, objLayouts, heap);\r\n ensures AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n ensures (forall i:int::{$absMem[i]}{heap.absData[i]} heap_old.absData[i] is AbsNone || (heap.absData[i] == heap_old.absData[i] && ($absMem[i] == $absMem_old[i] || i == (($ghost_s).arrAbs))));\r\n ensures io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n //- Only havocs edi, ebp\r\n ensures r.regs[EAX] == r_old.regs[EAX];\r\n ensures r.regs[EBX] == r_old.regs[EBX];\r\n ensures r.regs[ECX] == r_old.regs[ECX];\r\n ensures r.regs[EDX] == r_old.regs[EDX];\r\n ensures r.regs[ESI] == r_old.regs[ESI];\r\n ensures r.regs[ESP] == r_old.regs[ESP];\r\n\r\n ensures HeapValue(objLayouts, true, $toAbs, a_base, $ghost_a__abs);\r\n ensures HeapValue(objLayouts, true, $toAbs, b_base, $ghost_b__abs);\r\n ensures HeapValue(objLayouts, true, $toAbs, s_base, $ghost_s__abs);\r\n\r\n ensures new_carry == if (Cf(r.efl)) then 1 else 0;\r\n ensures new_carry == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset8) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset8) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 2)) >= WORD_HI) then 1 else 0;\r\n\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset1) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset1) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset1) + old_carry);\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset2) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset2) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset2) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 8));\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset3) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset3) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset3) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 7));\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset4) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset4) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset4) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 6));\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset5) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset5) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset5) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 5));\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset6) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset6) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset6) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 4));\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset7) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset7) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset7) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 3));\r\n ensures fun_INTERNAL__array__elems__index($absMem[$ghost_s__abs], s_offset8) == fun_mod0x100000000(fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset8) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset8) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 2));\r\n\r\n //- Arrays A and B are unmodified\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_a)))))) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_a.arrAbs], j)))));\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_b)))))) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_b.arrAbs], j)))));\r\n\r\n //- Array S is unmodified except for the four entries we touch\r\n ensures (forall j:int :: { fun_INTERNAL__array__elems__index($absMem[$ghost_s.arrAbs], j) } (((INTERNAL_le_boogie(0, j)) && (INTERNAL_lt_boogie(j, (Arr_Length($ghost_s))))) && j != s_offset1 && j != s_offset2 && j != s_offset3 && j != s_offset4 && j != s_offset5 && j != s_offset6 && j != s_offset7 && j != s_offset8) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_s.arrAbs], j)) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_s.arrAbs], j)))));\r\n\r\n ensures fun_Seq__Length___int(new_carries) == fun_Seq__Length___int(old_carries) + 8;\r\n ensures (forall i:int :: 0 <= i && i < fun_Seq__Length___int(old_carries) ==> fun_Seq__Index___int(new_carries, i) == fun_Seq__Index___int(old_carries, i));\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 8) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset1) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset1) + old_carry) >= WORD_HI) then 1 else 0;\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 7) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset2) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset2) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 8)) >= WORD_HI) then 1 else 0;\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 6) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset3) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset3) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 7)) >= WORD_HI) then 1 else 0;\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 5) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset4) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset4) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 6)) >= WORD_HI) then 1 else 0;\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 4) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset5) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset5) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 5)) >= WORD_HI) then 1 else 0;\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 3) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset6) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset6) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 4)) >= WORD_HI) then 1 else 0;\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 2) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset7) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset7) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 3)) >= WORD_HI) then 1 else 0;\r\n ensures fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - 1) == new_carry;\r\n ensures (forall i:int :: TV(i) && 1 <= i && i <= 8 ==> fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - i) == if ((fun_INTERNAL__array__elems__index($absMem[$ghost_a__abs], a_offset8 + i - 1) + fun_INTERNAL__array__elems__index($absMem[$ghost_b__abs], b_offset8 + i - 1) + fun_Seq__Index___int(new_carries, fun_Seq__Length___int(new_carries) - (i+1))) >= WORD_HI) then 1 else 0);\r\n{\r\n var $ghost_carries:Seq___int;\r\n var carry1:int;\r\n var carry2:int;\r\n var carry3:int;\r\n //- Boilerplate variable propagation\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n\r\n //- Teach Beat about Dafny sequence operations\r\n call proc_Seq__Empty__ToZero___int();\r\n call proc_Seq__Empty__FromZero___int();\r\n call proc_Seq__Singleton__Length___int();\r\n call proc_Seq__Build__Length___int();\r\n call proc_Seq__Build__Index___int();\r\n call proc_Seq__Append__Length___int();\r\n call proc_Seq__Index__Singleton___int();\r\n call proc_Seq__Append__Index___int();\r\n call proc_Seq__Update__Length___int();\r\n call proc_Seq__Index__Update___int();\r\n call proc_Seq__Equal__Equiv___int();\r\n call proc_Seq__Take__Length___int();\r\n call proc_Seq__Take__Index___int();\r\n call proc_Seq__Drop__Length___int();\r\n call proc_Seq__Drop__Index___int();\r\n call proc_Seq__Append__TakeDrop___int();\r\n call proc_Seq__Update__CommuteTake1___int();\r\n call proc_Seq__Update__CommuteTake2___int();\r\n call proc_Seq__Update__CommuteDrop1___int();\r\n call proc_Seq__Update__CommuteDrop2___int();\r\n call proc_Seq__Build__CommuteDrop___int();\r\n call proc_Seq__Take__Empty___int();\r\n call proc_Seq__Drop__Empty___int();\r\n\r\n call proc_lemma__2toX();\r\n\r\n $ghost_carries := old_carries;\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry1, $ghost_carries := \r\n arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n a_opn1,a_opn2,a_opn3,a_opn4, \r\n $ghost_a__abs, a_base, \r\n a_offset1,a_offset2,a_offset3,a_offset4,\r\n b_opn1,b_opn2,b_opn3,b_opn4, \r\n $ghost_b__abs, b_base, \r\n b_offset1,b_offset2,b_offset3,b_offset4,\r\n s_opn1,s_opn2,s_opn3,s_opn4, \r\n $ghost_s__abs, s_base, \r\n s_offset1, s_offset2, s_offset3, s_offset4,\r\n $ghost_si, \r\n index_offset1, index_offset2, index_offset3, index_offset4, \r\n $ghost_carries, old_carry);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, new_carry, $ghost_carries := \r\n arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n $ghost_a, $ghost_b, $ghost_s, \r\n a_opn5,a_opn6,a_opn7,a_opn8, \r\n $ghost_a__abs, a_base, \r\n a_offset5,a_offset6,a_offset7,a_offset8,\r\n b_opn5,b_opn6,b_opn7,b_opn8, \r\n $ghost_b__abs, b_base, \r\n b_offset5,b_offset6,b_offset7,b_offset8,\r\n s_opn5,s_opn6,s_opn7,s_opn8, \r\n $ghost_s__abs, s_base, \r\n s_offset5, s_offset6, s_offset7, s_offset8,\r\n $ghost_si, \r\n index_offset5, index_offset6, index_offset7, index_offset8, \r\n $ghost_carries, carry1);\r\n\r\n new_carries := $ghost_carries;\r\n}\r\n\r\n//implementation Proc_Add32__unrolled__32(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_a:ArrayOfInt, $ghost_ai:int, $ghost_b:ArrayOfInt, $ghost_bi:int, $ghost_s:ArrayOfInt, $ghost_si:int, $ghost_c_in:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_c_out:int, $ghost_carries:Seq___int)\r\n//{\r\n// var $ghost_a__abs:int;\r\n// var $ghost_b__abs:int;\r\n// var $ghost_s__abs:int;\r\n// var gcStackOffset:int;\r\n//\r\n// // Boilerplate variable propagation\r\n// r := r_old;\r\n// stk := stk_old;\r\n// statics := statics_old;\r\n// io := io_old;\r\n// mems := mems_old;\r\n// $commonVars := $commonVars_old;\r\n// $gcVars := $gcVars_old;\r\n// $toAbs := $toAbs_old;\r\n// $absMem := $absMem_old;\r\n// $stacksFrames := $stacksFrames_old;\r\n// objLayouts := objLayouts_old;\r\n// heap := heap_old;\r\n//\r\n// // Teach Beat about Dafny sequence operations\r\n// call proc_Seq__Empty__ToZero___int();\r\n// call proc_Seq__Empty__FromZero___int();\r\n// call proc_Seq__Singleton__Length___int();\r\n// call proc_Seq__Build__Length___int();\r\n// call proc_Seq__Build__Index___int();\r\n// call proc_Seq__Append__Length___int();\r\n// call proc_Seq__Index__Singleton___int();\r\n// call proc_Seq__Append__Index___int();\r\n// call proc_Seq__Update__Length___int();\r\n// call proc_Seq__Index__Update___int();\r\n// call proc_Seq__Equal__Equiv___int();\r\n// call proc_Seq__Take__Length___int();\r\n// call proc_Seq__Take__Index___int();\r\n// call proc_Seq__Drop__Length___int();\r\n// call proc_Seq__Drop__Index___int();\r\n// call proc_Seq__Append__TakeDrop___int();\r\n// // call proc_Seq__Append__TakeDrop__Restricted___int();\r\n// call proc_Seq__Update__CommuteTake1___int();\r\n// call proc_Seq__Update__CommuteTake2___int();\r\n// call proc_Seq__Update__CommuteDrop1___int();\r\n// call proc_Seq__Update__CommuteDrop2___int();\r\n// call proc_Seq__Build__CommuteDrop___int();\r\n// call proc_Seq__Take__Empty___int();\r\n// call proc_Seq__Drop__Empty___int();\r\n//\r\n// gcStackOffset := 0x111000;\r\n//\r\n// call proc_lemma__2toX();\r\n//\r\n// assert Aligned(esp);\r\n// // Prove that we can load arguments from the stack (b/c accesses are aligned)\r\n// assert TV(esp) && TO(0) && TO(1) && TO(2) && TO(3) && TO(4) && TO(5);\r\n//\r\n// // Prove that we can load arguments from the GC stack (b/c accesses are aligned)\r\n// assert TO(0x44401) && TO(0x44402) && TO(0x44403); // (gcStackOffset + {4,8,12}) / 4\r\n//\r\n// // Load pointer to array a into edx\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x111004)), EvalPtr(r, OMem(MReg(ESP, 0x111004)))); // 0x111004 = gcStackOffset + 4\r\n// var a_base:int;\r\n// a_base := edx;\r\n// $ghost_a__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 4))));\r\n//\r\n// // Load its length into eax\r\n// call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EAX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_a__abs, r.regs[EDX]);\r\n//\r\n// // Adjust to the \"beginning\" of the values we care about\r\n// eax := eax - 1;\r\n// call edi := Load(stk, esp + 8); // grab ai\r\n// eax := eax - edi;\r\n// var aii:int := eax;\r\n// assert aii == Arr_Length($ghost_a) - 1 - $ghost_ai;\r\n//\r\n// // Convert aii into a memory pointer\r\n// call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, aii, $ghost_a__abs, edx); // Proves we're within bounds for the Lea calculation\r\n// call eax := Lea(edx + 4 * eax + 8);\r\n// var aii_ptr @ eax; \r\n//\r\n// // Load pointer to array b into edx\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x111008)), EvalPtr(r, OMem(MReg(ESP, 0x111008)))); // 0x111008 = gcStackOffset + 8\r\n// var b_base:int;\r\n// b_base := edx;\r\n// $ghost_b__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 8))));\r\n//\r\n// // Load its length into ebx\r\n// call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_b__abs, r.regs[EDX]);\r\n//\r\n// // Adjust to the \"beginning\" of the values we care about\r\n// ebx := ebx - 1;\r\n// call edi := Load(stk, esp + 12); // grab bi\r\n// ebx := ebx - edi;\r\n// var bii:int := ebx;\r\n// assert bii == Arr_Length($ghost_b) - 1 - $ghost_bi;\r\n//\r\n// // Convert aii into a memory pointer\r\n// call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, bii, $ghost_b__abs, edx); // Proves we're within bounds for the Lea calculation\r\n// call ebx := Lea(edx + 4 * ebx + 8);\r\n// var bii_ptr @ ebx; \r\n//\r\n// // Load pointer to array s into edx\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDX, OMem(MReg(ESP, 0x11100c)), EvalPtr(r, OMem(MReg(ESP, 0x11100c)))); // 0x11100c == gcStackOffset + 12\r\n// var s_base:int;\r\n// s_base := edx;\r\n// $ghost_s__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, gcStackOffset + 12))));\r\n//\r\n// // Load its length into ecx\r\n// call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, ECX, OMem(MReg(EDX, 4)), 0 - 1, $ghost_s__abs, r.regs[EDX]);\r\n//\r\n// // Adjust to the \"beginning\" of the values we care about\r\n// ecx := ecx - 1;\r\n// call edi := Load(stk, esp + 16); // grab si\r\n// ecx := ecx - edi;\r\n// var sii:int := ecx;\r\n// assert sii == Arr_Length($ghost_s) - 1 - $ghost_si;\r\n//\r\n// // Convert sii into a memory pointer\r\n// call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, sii, $ghost_s__abs, edx); // Proves we're within bounds for the Lea calculation\r\n// call ecx := Lea(edx + 4 * ecx + 8);\r\n// var sii_ptr @ ecx; \r\n//\r\n// /////////////// Start computing //////////////////////////\r\n//\r\n// // First, \"load\" c_in into CF via a sneaky addition\r\n// call edi := Load(stk, esp + 20); // grab c_in\r\n// assert edi == $ghost_c_in;\r\n// call r := instr_Add(r, EDI, OConst(0xffffffff)); \r\n// assert Cf(r.efl) == ($ghost_c_in == 1);\r\n//\r\n// // Build the carries sequence\r\n// $ghost_carries := fun_Seq__Build___int(fun_Seq__Empty___int(), $ghost_c_in);\r\n//\r\n// var carry:int;\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd8(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, 0)), OMem(MReg(EAX, (-4))), OMem(MReg(EAX, (-8))), OMem(MReg(EAX, (-12))), \r\n// OMem(MReg(EAX, (-16))), OMem(MReg(EAX, (-20))), OMem(MReg(EAX, (-24))), OMem(MReg(EAX, (-28))), \r\n// $ghost_a__abs, a_base, \r\n// aii-0, aii-1, aii-2, aii-3,\r\n// aii-4, aii-5, aii-6, aii-7,\r\n// OMem(MReg(EBX, 0)), OMem(MReg(EBX, (-4))), OMem(MReg(EBX, (-8))), OMem(MReg(EBX, (-12))), \r\n// OMem(MReg(EBX, (-16))), OMem(MReg(EBX, (-20))), OMem(MReg(EBX, (-24))), OMem(MReg(EBX, (-28))), \r\n// $ghost_b__abs, b_base, \r\n// bii-0, bii-1, bii-2, bii-3,\r\n// bii-4, bii-5, bii-6, bii-7,\r\n// OMem(MReg(ECX, 0)), OMem(MReg(ECX, (-4))), OMem(MReg(ECX, (-8))), OMem(MReg(ECX, (-12))), \r\n// OMem(MReg(ECX, (-16))), OMem(MReg(ECX, (-20))), OMem(MReg(ECX, (-24))), OMem(MReg(ECX, (-28))), \r\n// $ghost_s__abs, s_base, \r\n// sii-0, sii-1, sii-2, sii-3,\r\n// sii-4, sii-5, sii-6, sii-7,\r\n// $ghost_si, 0, (-1), (-2), (-3), (-4), (-5), (-6), (-7), $ghost_carries, $ghost_c_in);\r\n//\r\n// assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} TV($ghost__1_i) ==> ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 8))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd8(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-32))), OMem(MReg(EAX, (-36))), OMem(MReg(EAX, (-40))), OMem(MReg(EAX, (-44))), \r\n// OMem(MReg(EAX, (-48))), OMem(MReg(EAX, (-52))), OMem(MReg(EAX, (-56))), OMem(MReg(EAX, (-60))), \r\n// $ghost_a__abs, a_base, \r\n// aii-8, aii-9, aii-10, aii-11,\r\n// aii-12, aii-13, aii-14, aii-15,\r\n// OMem(MReg(EBX, (-32))), OMem(MReg(EBX, (-36))), OMem(MReg(EBX, (-40))), OMem(MReg(EBX, (-44))), \r\n// OMem(MReg(EBX, (-48))), OMem(MReg(EBX, (-52))), OMem(MReg(EBX, (-56))), OMem(MReg(EBX, (-60))), \r\n// $ghost_b__abs, b_base, \r\n// bii-8, bii-9, bii-10, bii-11,\r\n// bii-12, bii-13, bii-14, bii-15,\r\n// OMem(MReg(ECX, (-32))), OMem(MReg(ECX, (-36))), OMem(MReg(ECX, (-40))), OMem(MReg(ECX, (-44))), \r\n// OMem(MReg(ECX, (-48))), OMem(MReg(ECX, (-52))), OMem(MReg(ECX, (-56))), OMem(MReg(ECX, (-60))), \r\n// $ghost_s__abs, s_base, \r\n// sii-8, sii-9, sii-10, sii-11,\r\n// sii-12, sii-13, sii-14, sii-15,\r\n// $ghost_si, (-8), (-9), (-10), (-11), (-12), (-13), (-14), (-15), $ghost_carries, carry);\r\n//\r\n// assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} TV($ghost__1_i) ==> ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 16))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd8(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-64))), OMem(MReg(EAX, (-68))), OMem(MReg(EAX, (-72))), OMem(MReg(EAX, (-76))), \r\n// OMem(MReg(EAX, (-80))), OMem(MReg(EAX, (-84))), OMem(MReg(EAX, (-88))), OMem(MReg(EAX, (-92))), \r\n// $ghost_a__abs, a_base, \r\n// aii-16, aii-17, aii-18, aii-19,\r\n// aii-20, aii-21, aii-22, aii-23,\r\n// OMem(MReg(EBX, (-64))), OMem(MReg(EBX, (-68))), OMem(MReg(EBX, (-72))), OMem(MReg(EBX, (-76))), \r\n// OMem(MReg(EBX, (-80))), OMem(MReg(EBX, (-84))), OMem(MReg(EBX, (-88))), OMem(MReg(EBX, (-92))), \r\n// $ghost_b__abs, b_base, \r\n// bii-16, bii-17, bii-18, bii-19,\r\n// bii-20, bii-21, bii-22, bii-23,\r\n// OMem(MReg(ECX, (-64))), OMem(MReg(ECX, (-68))), OMem(MReg(ECX, (-72))), OMem(MReg(ECX, (-76))), \r\n// OMem(MReg(ECX, (-80))), OMem(MReg(ECX, (-84))), OMem(MReg(ECX, (-88))), OMem(MReg(ECX, (-92))), \r\n// $ghost_s__abs, s_base, \r\n// sii-16, sii-17, sii-18, sii-19,\r\n// sii-20, sii-21, sii-22, sii-23,\r\n// $ghost_si, (-16), (-17), (-18), (-19), (-20), (-21), (-22), (-23), $ghost_carries, carry);\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd8(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-96))), OMem(MReg(EAX, (-100))), OMem(MReg(EAX, (-104))), OMem(MReg(EAX, (-108))), \r\n// OMem(MReg(EAX, (-112))), OMem(MReg(EAX, (-116))), OMem(MReg(EAX, (-120))), OMem(MReg(EAX, (-124))), \r\n// $ghost_a__abs, a_base, \r\n// aii-24, aii-25, aii-26, aii-27,\r\n// aii-28, aii-29, aii-30, aii-31,\r\n// OMem(MReg(EBX, (-96))), OMem(MReg(EBX, (-100))), OMem(MReg(EBX, (-104))), OMem(MReg(EBX, (-108))), \r\n// OMem(MReg(EBX, (-112))), OMem(MReg(EBX, (-116))), OMem(MReg(EBX, (-120))), OMem(MReg(EBX, (-124))), \r\n// $ghost_b__abs, b_base, \r\n// bii-24, bii-25, bii-26, bii-27,\r\n// bii-28, bii-29, bii-30, bii-31,\r\n// OMem(MReg(ECX, (-96))), OMem(MReg(ECX, (-100))), OMem(MReg(ECX, (-104))), OMem(MReg(ECX, (-108))), \r\n// OMem(MReg(ECX, (-112))), OMem(MReg(ECX, (-116))), OMem(MReg(ECX, (-120))), OMem(MReg(ECX, (-124))), \r\n// $ghost_s__abs, s_base, \r\n// sii-24, sii-25, sii-26, sii-27,\r\n// sii-28, sii-29, sii-30, sii-31,\r\n// $ghost_si, (-24), (-25), (-26), (-27), (-28), (-29), (-30), (-31), $ghost_carries, carry);\r\n//\r\n// assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} TV($ghost__1_i) ==> ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 32))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n//\r\n///*\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, 0)), OMem(MReg(EAX, (-4))), OMem(MReg(EAX, (-8))), OMem(MReg(EAX, (-12))), \r\n// $ghost_a__abs, a_base, \r\n// aii-0, aii-1, aii-2, aii-3,\r\n// OMem(MReg(EBX, 0)), OMem(MReg(EBX, (-4))), OMem(MReg(EBX, (-8))), OMem(MReg(EBX, (-12))), \r\n// $ghost_b__abs, b_base, \r\n// bii-0, bii-1, bii-2, bii-3,\r\n// OMem(MReg(ECX, 0)), OMem(MReg(ECX, (-4))), OMem(MReg(ECX, (-8))), OMem(MReg(ECX, (-12))), \r\n// $ghost_s__abs, s_base, \r\n// sii-0, sii-1, sii-2, sii-3,\r\n// $ghost_si, 0, (-1), (-2), (-3), $ghost_carries, $ghost_c_in);\r\n//\r\n// assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 4))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n//\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-16))), OMem(MReg(EAX, (-20))), OMem(MReg(EAX, (-24))), OMem(MReg(EAX, (-28))), \r\n// $ghost_a__abs, a_base, \r\n// aii-4, aii-5, aii-6, aii-7,\r\n// OMem(MReg(EBX, (-16))), OMem(MReg(EBX, (-20))), OMem(MReg(EBX, (-24))), OMem(MReg(EBX, (-28))), \r\n// $ghost_b__abs, b_base, \r\n// bii-4, bii-5, bii-6, bii-7,\r\n// OMem(MReg(ECX, (-16))), OMem(MReg(ECX, (-20))), OMem(MReg(ECX, (-24))), OMem(MReg(ECX, (-28))), \r\n// $ghost_s__abs, s_base, \r\n// sii-4, sii-5, sii-6, sii-7,\r\n// $ghost_si, (-4), (-5), (-6), (-7), $ghost_carries, carry);\r\n//\r\n// assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 8))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-32))), OMem(MReg(EAX, (-36))), OMem(MReg(EAX, (-40))), OMem(MReg(EAX, (-44))), \r\n// $ghost_a__abs, a_base, \r\n// aii-8, aii-9, aii-10, aii-11,\r\n// OMem(MReg(EBX, (-32))), OMem(MReg(EBX, (-36))), OMem(MReg(EBX, (-40))), OMem(MReg(EBX, (-44))), \r\n// $ghost_b__abs, b_base, \r\n// bii-8, bii-9, bii-10, bii-11,\r\n// OMem(MReg(ECX, (-32))), OMem(MReg(ECX, (-36))), OMem(MReg(ECX, (-40))), OMem(MReg(ECX, (-44))), \r\n// $ghost_s__abs, s_base, \r\n// sii-8, sii-9, sii-10, sii-11,\r\n// $ghost_si, (-8), (-9), (-10), (-11), $ghost_carries, carry);\r\n//\r\n// assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 12))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-48))), OMem(MReg(EAX, (-52))), OMem(MReg(EAX, (-56))), OMem(MReg(EAX, (-60))), \r\n// $ghost_a__abs, a_base, \r\n// aii-12, aii-13, aii-14, aii-15,\r\n// OMem(MReg(EBX, (-48))), OMem(MReg(EBX, (-52))), OMem(MReg(EBX, (-56))), OMem(MReg(EBX, (-60))), \r\n// $ghost_b__abs, b_base, \r\n// bii-12, bii-13, bii-14, bii-15,\r\n// OMem(MReg(ECX, (-48))), OMem(MReg(ECX, (-52))), OMem(MReg(ECX, (-56))), OMem(MReg(ECX, (-60))), \r\n// $ghost_s__abs, s_base, \r\n// sii-12, sii-13, sii-14, sii-15,\r\n// $ghost_si, (-12), (-13), (-14), (-15), $ghost_carries, carry);\r\n//\r\n// assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 16))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-64))), OMem(MReg(EAX, (-68))), OMem(MReg(EAX, (-72))), OMem(MReg(EAX, (-76))), \r\n// $ghost_a__abs, a_base, \r\n// aii-16, aii-17, aii-18, aii-19,\r\n// OMem(MReg(EBX, (-64))), OMem(MReg(EBX, (-68))), OMem(MReg(EBX, (-72))), OMem(MReg(EBX, (-76))), \r\n// $ghost_b__abs, b_base, \r\n// bii-16, bii-17, bii-18, bii-19,\r\n// OMem(MReg(ECX, (-64))), OMem(MReg(ECX, (-68))), OMem(MReg(ECX, (-72))), OMem(MReg(ECX, (-76))), \r\n// $ghost_s__abs, s_base, \r\n// sii-16, sii-17, sii-18, sii-19,\r\n// $ghost_si, (-16), (-17), (-18), (-19), $ghost_carries, carry);\r\n//\r\n// assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 20))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-80))), OMem(MReg(EAX, (-84))), OMem(MReg(EAX, (-88))), OMem(MReg(EAX, (-92))), \r\n// $ghost_a__abs, a_base, \r\n// aii-20, aii-21, aii-22, aii-23,\r\n// OMem(MReg(EBX, (-80))), OMem(MReg(EBX, (-84))), OMem(MReg(EBX, (-88))), OMem(MReg(EBX, (-92))), \r\n// $ghost_b__abs, b_base, \r\n// bii-20, bii-21, bii-22, bii-23,\r\n// OMem(MReg(ECX, (-80))), OMem(MReg(ECX, (-84))), OMem(MReg(ECX, (-88))), OMem(MReg(ECX, (-92))), \r\n// $ghost_s__abs, s_base, \r\n// sii-20, sii-21, sii-22, sii-23,\r\n// $ghost_si, (-20), (-21), (-22), (-23), $ghost_carries, carry);\r\n//\r\n// assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 24))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-96))), OMem(MReg(EAX, (-100))), OMem(MReg(EAX, (-104))), OMem(MReg(EAX, (-108))), \r\n// $ghost_a__abs, a_base, \r\n// aii-24, aii-25, aii-26, aii-27,\r\n// OMem(MReg(EBX, (-96))), OMem(MReg(EBX, (-100))), OMem(MReg(EBX, (-104))), OMem(MReg(EBX, (-108))), \r\n// $ghost_b__abs, b_base, \r\n// bii-24, bii-25, bii-26, bii-27,\r\n// OMem(MReg(ECX, (-96))), OMem(MReg(ECX, (-100))), OMem(MReg(ECX, (-104))), OMem(MReg(ECX, (-108))), \r\n// $ghost_s__abs, s_base, \r\n// sii-24, sii-25, sii-26, sii-27,\r\n// $ghost_si, (-24), (-25), (-26), (-27), $ghost_carries, carry);\r\n//\r\n// assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 28))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n//\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, carry, $ghost_carries := \r\n// arrayAdd4(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \r\n// $ghost_a, $ghost_b, $ghost_s, \r\n// OMem(MReg(EAX, (-112))), OMem(MReg(EAX, (-116))), OMem(MReg(EAX, (-120))), OMem(MReg(EAX, (-124))), \r\n// $ghost_a__abs, a_base, \r\n// aii-28, aii-29, aii-30, aii-31,\r\n// OMem(MReg(EBX, (-112))), OMem(MReg(EBX, (-116))), OMem(MReg(EBX, (-120))), OMem(MReg(EBX, (-124))), \r\n// $ghost_b__abs, b_base, \r\n// bii-28, bii-29, bii-30, bii-31,\r\n// OMem(MReg(ECX, (-112))), OMem(MReg(ECX, (-116))), OMem(MReg(ECX, (-120))), OMem(MReg(ECX, (-124))), \r\n// $ghost_s__abs, s_base, \r\n// sii-28, sii-29, sii-30, sii-31,\r\n// $ghost_si, (-28), (-29), (-30), (-31), $ghost_carries, carry);\r\n//\r\n// assert (forall $ghost__1_i:int :: {fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i)))} ((INTERNAL_le_boogie(0, $ghost__1_i)) && (INTERNAL_lt_boogie($ghost__1_i, 32))) ==> ((fun_Seq__Index___int($ghost_carries, INTERNAL_add_boogie($ghost__1_i, 1))) == ((if (INTERNAL_ge_boogie(INTERNAL_add_boogie(INTERNAL_add_boogie(fun_INTERNAL__array__elems__index($absMem[$ghost_a.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_a)), $ghost_ai, $ghost__1_i))), fun_INTERNAL__array__elems__index($absMem[$ghost_b.arrAbs], (fun_FatNatAddIndex((Arr_Length($ghost_b)), $ghost_bi, $ghost__1_i)))), fun_Seq__Index___int($ghost_carries, $ghost__1_i)), 4294967296)) then (1) else (0)))));\r\n//*/\r\n// // Extract the final carry bit from EFL\r\n// eax := 0;\r\n// call r := instr_GetCf(r, EAX);\r\n// assert Aligned(esp);\r\n// assert Aligned(esp + 4);\r\n// call Store(inout stk, esp + 4, eax);\r\n// $ghost_c_out := carry;\r\n//\r\n// assert $ghost_a.arrAbs != $ghost_s.arrAbs;\r\n//\r\n// Return;\r\n//}\r\n\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/dafny_FleetNatMulLoopOpt_i.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-private-import Overflow;\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-private-import IntLemmasMain;\r\n//-private-import IntLemmasBase;\r\n//-private-import IoMain;\r\n//-private-basmonly-import Trusted;\r\n//-private-basmonly-import Checked;\r\n//-private-import Heap;\r\n//-private-import Seq;\r\n//-private-import dafny_DafnyPrelude;\r\n//-private-import DafnyAssembly;\r\n//-private-import dafny_base_s;\r\n//-private-import dafny_power2_s;\r\n//-private-import dafny_bytes_and_words_s;\r\n//-private-import dafny_be_sequences_s;\r\n//-private-import dafny_integer_sequences_s;\r\n//-private-import dafny_seqs_simple_i;\r\n//-private-import dafny_power_s;\r\n//-private-import dafny_mul_nonlinear_i;\r\n//-private-import dafny_mul_i;\r\n//-private-import dafny_power_i;\r\n//-private-import dafny_div_def_i;\r\n//-private-import dafny_div_boogie_i;\r\n//-private-import dafny_div_nonlinear_i;\r\n//-private-import dafny_div_i;\r\n//-private-import dafny_repeat_digit_i;\r\n//-private-import dafny_assembly_s;\r\n//-private-import dafny_power2_i;\r\n//-private-import dafny_seqs_and_ints_i;\r\n//-private-import dafny_seqs_common_i;\r\n//-private-import dafny_Word32_i;\r\n//-private-import dafny_relational_s;\r\n//-private-import dafny_assembly_i;\r\n//-private-import dafny_arrays_i;\r\n//-private-import dafny_seqs_transforms_i;\r\n//-private-import dafny_seqs_reverse_i;\r\n//-private-import dafny_integer_sequences_i;\r\n//-private-import dafny_integer_sequences_premium_i;\r\n//-private-import dafny_assembly_premium_i;\r\n//-private-import dafny_BigNatX86Shim_i;\r\n//-private-import dafny_seqs_canonical_i;\r\n//-private-import dafny_CanonicalArrays_i;\r\n//-private-import dafny_FatNatCommon_i;\r\n//-private-import dafny_FleetNatCommon_i;\r\n//-private-import dafny_FleetNatAdd_i;\r\n//-private-import dafny_FleetNatMulLemmas_i;\r\n//-private-import dafny_FleetNatMulOpt_i;\r\n//-private-import dafny_FleetNatMulLoopOptLemmas_i;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\nmodule implementation dafny_FleetNatMulLoopOpt_i\r\n{\r\n\r\n\r\nimplementation Proc_FleetNatMul__one__loop__opt(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_c:ArrayOfInt, $ghost_bi:int, $ghost_a:ArrayOfInt, $ghost_adigits:int, $ghost_bv:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_carry:int)\r\n{\r\n //- Standard boilerplate\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var mod0:int;\r\n var $ghost_pv:int;\r\n var $ghost_oldcs:Seq___int;\r\n var $ghost_alenm1:int;\r\n var $ghost__temp__0:int;\r\n var $ghost_clenm1:int;\r\n var $ghost__temp__1:int;\r\n var $ghost_j:int;\r\n var $ghost_lastj:int;\r\n var $ghost_lastcarry:int;\r\n var $ghost_lastcs:Seq___int;\r\n var $ghost_asq:Seq___int;\r\n var $ghost_ci:int;\r\n var $ghost__temp__5:int;\r\n var $ghost__temp__6:int;\r\n var $ghost_ai:int;\r\n var $ghost_aj:int;\r\n var $ghost_lastcj:int;\r\n var $ghost_newcj:int;\r\n var $ghost_c__abs:int;\r\n var $ghost_a__abs:int;\r\n var a_base:int;\r\n var c_base:int;\r\n var old_esi:int;\r\n var old_edi:int;\r\n var $ghost_mhi:int;\r\n var $ghost_mlo:int;\r\n var $ghost__temp__0:int;\r\n var $ghost_add1:int;\r\n var $ghost_carry1:int;\r\n var $ghost_carry2:int;\r\n var $ghost_add3:int;\r\n var $ghost_carry3:int;\r\n var $ghost_carry4:int;\r\n var tmp:int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___int();\r\n call lemma_fun_ensures_fun_Seq__Length___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___int();\r\n call proc_Seq__Empty__ToZero___int();\r\n call proc_Seq__Empty__FromZero___int();\r\n call proc_Seq__Singleton__Length___int();\r\n call proc_Seq__Build__Length___int();\r\n call proc_Seq__Build__Index___int();\r\n call proc_Seq__Append__Length___int();\r\n call proc_Seq__Index__Singleton___int();\r\n call proc_Seq__Append__Index___int();\r\n call proc_Seq__Update__Length___int();\r\n call proc_Seq__Index__Update___int();\r\n call proc_Seq__Equal__Equiv___int();\r\n call proc_Seq__Take__Length___int();\r\n call proc_Seq__Take__Index___int();\r\n call proc_Seq__Drop__Length___int();\r\n call proc_Seq__Drop__Index___int();\r\n call proc_Seq__Append__TakeDrop___int();\r\n call proc_Seq__Update__CommuteTake1___int();\r\n call proc_Seq__Update__CommuteTake2___int();\r\n call proc_Seq__Update__CommuteDrop1___int();\r\n call proc_Seq__Update__CommuteDrop2___int();\r\n call proc_Seq__Build__CommuteDrop___int();\r\n call proc_Seq__Take__Empty___int();\r\n call proc_Seq__Drop__Empty___int();\r\n call lemma_unroll_fun_Seq__FromArrayRange();\r\n call proc_Seq__FromArray__Length();\r\n call proc_Seq__FromArray__Index();\r\n call proc_Seq__FromArray__Update();\r\n call lemma_unroll_rec_fun____HASH_power2__FULL();\r\n call lemma_unroll_fun____HASH_power2__FULL();\r\n call lemma_fun_ensures_fun_power2();\r\n call lemma_unroll_rec_fun____HASH_BEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_fun____HASH_BEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_rec_fun____HASH_BEIntToDigitSeq__private__FULL();\r\n call lemma_unroll_fun____HASH_BEIntToDigitSeq__private__FULL();\r\n call lemma_unroll_rec_fun_RepeatDigit();\r\n call lemma_unroll_fun_RepeatDigit();\r\n call lemma_unroll_rec_fun____HASH_Reverse__FULL();\r\n call lemma_unroll_fun____HASH_Reverse__FULL();\r\n call lemma_unroll_rec_fun____HASH_power__FULL();\r\n call lemma_unroll_fun____HASH_power__FULL();\r\n call lemma_unroll_rec_fun_mul__pos();\r\n call lemma_unroll_fun_mul__pos();\r\n call lemma_unroll_rec_fun_my__div__pos();\r\n call lemma_unroll_fun_my__div__pos();\r\n call lemma_unroll_rec_fun_my__mod__recursive();\r\n call lemma_unroll_fun_my__mod__recursive();\r\n call lemma_fun_ensures_fun_RepeatDigit__premium();\r\n call lemma_unroll_rec_fun____HASH_SequenceOfZeros__FULL();\r\n call lemma_unroll_fun____HASH_SequenceOfZeros__FULL();\r\n call lemma_fun_ensures_fun_SequenceOfZeros();\r\n call lemma_fun_ensures_fun_BitwiseAnd();\r\n call lemma_fun_ensures_fun_BitwiseOr();\r\n call lemma_fun_ensures_fun_BitwiseNot();\r\n call lemma_fun_ensures_fun_BitwiseXor();\r\n call lemma_fun_ensures_fun_RotateRight();\r\n call lemma_fun_ensures_fun_RotateLeft();\r\n call lemma_fun_ensures_fun_RightShift();\r\n call lemma_fun_ensures_fun_LeftShift();\r\n call lemma_fun_ensures_fun_Add32();\r\n call lemma_fun_ensures_fun_Sub32();\r\n call lemma_fun_ensures_fun_Mul32();\r\n call lemma_fun_ensures_fun_Div32();\r\n call lemma_fun_ensures_fun_Mod32();\r\n call lemma_unroll_rec_fun____HASH_NatNumBits__FULL();\r\n call lemma_unroll_fun____HASH_NatNumBits__FULL();\r\n call lemma_fun_ensures_fun_NatNumBits();\r\n call lemma_fun_ensures_fun_asm__Add();\r\n call lemma_fun_ensures_fun_asm__Sub();\r\n call lemma_fun_ensures_fun_asm__Mul();\r\n call lemma_fun_ensures_fun_asm__Div();\r\n call lemma_fun_ensures_fun_asm__Mod();\r\n call lemma_fun_ensures_fun_asm__LeftShift();\r\n call lemma_fun_ensures_fun_asm__RightShift();\r\n call lemma_fun_ensures_fun_asm__RotateLeft();\r\n call lemma_fun_ensures_fun_asm__RotateRight();\r\n call lemma_fun_ensures_fun_asm__BitwiseNot();\r\n call lemma_fun_ensures_fun_asm__BitwiseAnd();\r\n call lemma_fun_ensures_fun_asm__BitwiseOr();\r\n call lemma_fun_ensures_fun_asm__BitwiseXor();\r\n call lemma_unroll_rec_fun____HASH_LEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_fun____HASH_LEDigitSeqToInt__private__FULL();\r\n call lemma_fun_ensures_fun_BEDigitSeqToInt__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToInt__premium();\r\n call lemma_fun_ensures_fun_BEIntToDigitSeq__premium();\r\n call lemma_fun_ensures_fun_BEIntToByteSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordToFourBytes__premium();\r\n call lemma_fun_ensures_fun_BEWordToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEByteSeqToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToByteSeq__premium();\r\n call lemma_fun_ensures_fun_Asm__Add();\r\n call lemma_fun_ensures_fun_Asm__Sub();\r\n call lemma_fun_ensures_fun_Asm__Mul();\r\n call lemma_fun_ensures_fun_Asm__Div();\r\n call lemma_fun_ensures_fun_Asm__Mod();\r\n call lemma_fun_ensures_fun_Asm__LeftShift();\r\n call lemma_fun_ensures_fun_Asm__RightShift();\r\n call lemma_fun_ensures_fun_Asm__RotateLeft();\r\n call lemma_fun_ensures_fun_Asm__RotateRight();\r\n call lemma_fun_ensures_fun_Asm__BitwiseNot();\r\n call lemma_fun_ensures_fun_Asm__BitwiseAnd();\r\n call lemma_fun_ensures_fun_Asm__BitwiseOr();\r\n call lemma_fun_ensures_fun_Asm__BitwiseXor();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___Seq___int();\r\n call lemma_fun_ensures_fun_Seq__Length___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___Seq___int();\r\n call proc_Seq__Empty__ToZero___Seq___int();\r\n call proc_Seq__Empty__FromZero___Seq___int();\r\n call proc_Seq__Singleton__Length___Seq___int();\r\n call proc_Seq__Build__Length___Seq___int();\r\n call proc_Seq__Build__Index___Seq___int();\r\n call proc_Seq__Append__Length___Seq___int();\r\n call proc_Seq__Index__Singleton___Seq___int();\r\n call proc_Seq__Append__Index___Seq___int();\r\n call proc_Seq__Update__Length___Seq___int();\r\n call proc_Seq__Index__Update___Seq___int();\r\n call proc_Seq__Equal__Equiv___Seq___int();\r\n call proc_Seq__Take__Length___Seq___int();\r\n call proc_Seq__Take__Index___Seq___int();\r\n call proc_Seq__Drop__Length___Seq___int();\r\n call proc_Seq__Drop__Index___Seq___int();\r\n call proc_Seq__Append__TakeDrop___Seq___int();\r\n call proc_Seq__Update__CommuteTake1___Seq___int();\r\n call proc_Seq__Update__CommuteTake2___Seq___int();\r\n call proc_Seq__Update__CommuteDrop1___Seq___int();\r\n call proc_Seq__Update__CommuteDrop2___Seq___int();\r\n call proc_Seq__Build__CommuteDrop___Seq___int();\r\n call proc_Seq__Take__Empty___Seq___int();\r\n call proc_Seq__Drop__Empty___Seq___int();\r\n call lemma_fun_ensures_fun_Width();\r\n call lemma_unroll_rec_fun_CanonicalizeSeq__def();\r\n call lemma_unroll_fun_CanonicalizeSeq__def();\r\n call lemma_fun_ensures_fun_CanonicalizeSeq();\r\n call lemma_fun_ensures_fun_IsZeroValue();\r\n call lemma_fun_ensures_fun_SelectDigits();\r\n call lemma_unroll_rec_fun____HASH_MaxLen__def__FULL();\r\n call lemma_unroll_fun____HASH_MaxLen__def__FULL();\r\n call lemma_fun_ensures_fun_MaxLen();\r\n call lemma_fun_ensures_fun_MaxLen3();\r\n call lemma_fun_ensures_fun_ArrayDigitAt();\r\n call lemma_fun_ensures_fun_ArrayDigitAt__add();\r\n call lemma_fun_ensures_fun_ArrayDigitAt__sub();\r\n call lemma_fun_ensures_fun_ArrayDigitAt__cmp();\r\n call lemma_fun_ensures_fun_ArrayDigitAt__mul();\r\n call lemma_fun_ensures_fun_J();\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n $ghost_c__abs := frameGet($stacksFrames, r_old.regs[ESP] + 4 + stackGcOffset);\r\n $ghost_a__abs := frameGet($stacksFrames, r_old.regs[ESP] + 8 + stackGcOffset);\r\n mod0 := ($ghost_c).arrAbs;\r\n assert TV(r.regs[ESP]);\r\n assert TO(0 - 1);\r\n assert TO(279552 - 1);\r\n assert TO(0 - 2);\r\n assert TO(279552 - 2);\r\n assert TO(0 - 3);\r\n assert TO(279552 - 3);\r\n assert TO(0 - 4);\r\n assert TO(279552 - 4);\r\n assert TO(0 - 5);\r\n assert TO(279552 - 5);\r\n assert TO(0 - 6);\r\n assert TO(279552 - 6);\r\n assert TO(0 - 7);\r\n assert TO(279552 - 7);\r\n assert TO(0 - 8);\r\n assert TO(279552 - 8);\r\n assert TO(0 - 9);\r\n assert TO(279552 - 9);\r\n assert TO(0 - 10);\r\n assert TO(279552 - 10);\r\n assert TO(0 - 11);\r\n assert TO(279552 - 11);\r\n assert TO(0 - 12);\r\n assert TO(279552 - 12);\r\n assert TO(0);\r\n assert TO(279552);\r\n assert TO(1);\r\n assert TO(279553);\r\n assert TO(2);\r\n assert TO(279554);\r\n assert TO(3);\r\n assert TO(279555);\r\n assert TO(4);\r\n assert TO(279556);\r\n\r\n assert $ghost_adigits > 0;\r\n assert Arr_Length($ghost_a) - $ghost_adigits >= 0;\r\n assert Arr_Length($ghost_a) - $ghost_adigits < Arr_Length($ghost_a);\r\n $ghost_pv := fun_power2(32);\r\n call proc_lemma__2toX();\r\n $ghost_oldcs := fun_Seq__FromArray($absMem, $ghost_c);\r\n\r\n //- Load array a ptr into edi\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDI, OMem(MReg(ESP, 0x111008)), EvalPtr(r, OMem(MReg(ESP, 0x111008))));\r\n a_base := edi;\r\n $ghost_a__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, 0x111008))));\r\n\r\n //- Load a's length into eax\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EAX, OMem(MReg(EDI, 4)), (0 - 1), $ghost_a__abs, r.regs[EDI]);\r\n assert eax == Arr_Length($ghost_a);\r\n //- Save a copy for use in bound calculation\r\n ecx := eax;\r\n\r\n call r := instr_Sub(r, EAX, OConst(1)); \r\n $ghost_alenm1 := eax; //- == alenm1\r\n call reveal_wrap32(Arr_Length($ghost_a) - 1);\r\n assert $ghost_alenm1 == Arr_Length($ghost_a) - 1; \r\n\r\n //- Load array c ptr into esi\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, ESI, OMem(MReg(ESP, 0x111004)), EvalPtr(r, OMem(MReg(ESP, 0x111004))));\r\n c_base := esi;\r\n $ghost_c__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, 0x111004))));\r\n\r\n //- Load c's length into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(ESI, 4)), (0 - 1), $ghost_c__abs, r.regs[ESI]);\r\n\r\n call r := instr_Sub(r, EBX, OConst(1)); \r\n call reveal_wrap32(Arr_Length($ghost_c) - 1);\r\n $ghost_clenm1 := ebx; //- == clenm1\r\n\r\n //- Grab bi from the stack\r\n call ebp := Load(stk, esp + 8); \r\n\r\n //- Adjust clenm1 by bi\r\n call r := instr_Sub(r, EBX, OReg(EBP)); \r\n call reveal_wrap32(Arr_Length($ghost_c) - 1 - $ghost_bi);\r\n assert ebx == Arr_Length($ghost_c) - 1 - $ghost_bi; \r\n\r\n //- Now create ptrs directly into the correct location in a and c respectively\r\n call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_alenm1, $ghost_a__abs, edi); //- Proves we're within bounds for the Lea calculation\r\n edx := edi; //- Save a copy to use for the loop bound\r\n call edi := Lea(edi + 4 * eax + 8);\r\n\r\n call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_clenm1 - $ghost_bi, $ghost_c__abs, esi); //- Proves we're within bounds for the Lea calculation\r\n call esi := Lea(esi + 4 * ebx + 8);\r\n\r\n //- Establish partial sum invariant\r\n call proc_lemma__BEWordSeqToInt__SelectDigitRange__empty(fun_Seq__FromArray($absMem, $ghost_a));\r\n\r\n //- Grab adigits\r\n call ebp := Load(stk, esp + 12); \r\n\r\n //- Compute the loop bound \r\n //- (take the a_ptr which is a.base + 8 + 4 * (a.Length - 1) and subtract 4*(adigits)\r\n //- which is a.Length - 1 - adigits\r\n assert ecx == Arr_Length($ghost_a);\r\n call r := instr_Sub(r, ECX, OReg(EBP)); \r\n call reveal_wrap32(Arr_Length($ghost_a) - $ghost_adigits);\r\n assert $ghost_adigits > 0;\r\n assert ecx == Arr_Length($ghost_a) - $ghost_adigits;\r\n assert 0 <= ecx;\r\n assert ecx < Arr_Length($ghost_a);\r\n call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, Arr_Length($ghost_a) - $ghost_adigits, $ghost_a__abs, edx); //- Proves we're within bounds for the Lea calculation\r\n call edx := Lea(edx + 4 * ecx + 8); \r\n ebx := edx; //- Ebx is now the appropriate loop bound\r\n assert ebx == a_base + 4 * (Arr_Length($ghost_a) - $ghost_adigits) + 8; \r\n\r\n //- Grab bv for multiplication purposes \r\n call ebp := Load(stk, esp + 16); \r\n\r\n //- Initialize ecx for use as the current/last carry value \r\n ecx := 0;\r\n $ghost_carry := ecx;\r\n\r\n $ghost_j := 0;\r\n\r\n assert {:split_here} true;\r\n\r\n while (edi >= ebx) \r\n invariant MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n invariant NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n invariant SMemInvGcF(20, stk, old(stk_old), r.regs[ESP], old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n invariant HeapInv($absMem, objLayouts, heap);\r\n invariant AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n invariant (forall i:int::{$absMem[i]}{heap.absData[i]} heap_old.absData[i] is AbsNone || (heap.absData[i] == heap_old.absData[i] && ($absMem[i] == $absMem_old[i] || i == (($ghost_c).arrAbs))));\r\n invariant io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n\r\n //- loop invariants\r\n invariant $ghost_carry == ecx;\r\n invariant $ghost_bv == ebp;\r\n\r\n invariant HeapAbsData(heap, $ghost_a__abs) == Abs_ArrayOfInt($ghost_a);\r\n invariant HeapValue(objLayouts, true, $toAbs, a_base, $ghost_a__abs);\r\n invariant $ghost_a__abs == $ghost_a.arrAbs;\r\n invariant HeapAbsData(heap, $ghost_c__abs) == Abs_ArrayOfInt($ghost_c);\r\n invariant HeapValue(objLayouts, true, $toAbs, c_base, $ghost_c__abs);\r\n invariant $ghost_c__abs == $ghost_c.arrAbs;\r\n invariant $ghost_bi >= 0;\r\n invariant (INTERNAL_le_boogie(0, $ghost_j)) && (INTERNAL_le_boogie($ghost_j, $ghost_adigits));\r\n \r\n\r\n invariant edi == a_base + 4 * (Arr_Length($ghost_a) - 1 - $ghost_j) + 8; \r\n invariant ebx == a_base + 4 * (Arr_Length($ghost_a) - $ghost_adigits) + 8; \r\n invariant esi == c_base + 4 * (Arr_Length($ghost_c) - 1 - ($ghost_j + $ghost_bi)) + 8; \r\n\r\n invariant fun_IsDigitSeq($ghost_pv, fun_Seq__FromArray($absMem, $ghost_c));\r\n invariant (INTERNAL_le_boogie(0, $ghost_carry)) && (INTERNAL_lt_boogie($ghost_carry, $ghost_pv));\r\n invariant (INTERNAL_add_boogie(fun_BEWordSeqToInt(fun_Seq__FromArray($absMem, $ghost_c)), fun_INTERNAL__mul($ghost_carry, fun_power($ghost_pv, INTERNAL_add_boogie($ghost_j, $ghost_bi))))) == (INTERNAL_add_boogie(fun_BEWordSeqToInt($ghost_oldcs), fun_INTERNAL__mul(fun_INTERNAL__mul(fun_BEWordSeqToInt(fun_SelectDigitRange(fun_Seq__FromArray($absMem, $ghost_a), $ghost_j, 0)), $ghost_bv), fun_power($ghost_pv, $ghost_bi))));\r\n invariant (forall $ghost__0_k:int :: ((INTERNAL_le_boogie(0, $ghost__0_k)) && (INTERNAL_lt_boogie($ghost__0_k, INTERNAL_sub_boogie(INTERNAL_sub_boogie((Arr_Length($ghost_c)), 1), INTERNAL_add_boogie($ghost_j, $ghost_bi))))) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_c.arrAbs], ($ghost__0_k))) == (old(fun_INTERNAL__array__elems__index($absMem_old[$ghost_c.arrAbs], ($ghost__0_k))))));\r\n {\r\n call proc_lemma__mod__properties();\r\n call proc_lemma__2toX();\r\n call proc_lemma__word32__Word32();\r\n call reveal_WORD_HI();\r\n\r\n $ghost_lastj := $ghost_j;\r\n $ghost_lastcarry := $ghost_carry;\r\n $ghost_lastcs := fun_Seq__FromArray($absMem, $ghost_c);\r\n $ghost_asq := fun_Seq__FromArray($absMem, $ghost_a);\r\n\r\n $ghost_ci := Arr_Length($ghost_c) - 1 - ($ghost_j + $ghost_bi);\r\n $ghost_ai := Arr_Length($ghost_a) - 1 - $ghost_j;\r\n \r\n //- eax := a[ai];\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EAX, OMem(MReg(EDI, 0)), $ghost_ai, $ghost_a__abs, a_base);\r\n $ghost_aj := eax;\r\n\r\n call edx, eax := Mul64(eax, ebp);\r\n $ghost_mhi := edx;\r\n $ghost_mlo := eax;\r\n call reveal_wrap32($ghost_aj * $ghost_bv);\r\n\r\n assert TVM($ghost_aj, $ghost_bv);\r\n assert TVD($ghost_aj * $ghost_bv, 0x100000000);\r\n call proc_lemma__asm__Mul64($ghost_aj, $ghost_bv, $ghost_mhi, $ghost_mlo);\r\n\r\n //- add1 (needs to be a direct call to instr_Add to bypass overflow check in logical add\r\n call r := instr_Add(r, EAX, OReg(ECX)); //- eax == mlo + lastcarry\r\n $ghost_add1 := eax;\r\n\r\n call reveal_wrap32($ghost_mlo + $ghost_lastcarry);\r\n $ghost_carry1 := if $ghost_add1 < $ghost_lastcarry then 1 else 0;\r\n assert if Cf(r.efl) then $ghost_carry1 == 1 else $ghost_carry1 == 0;\r\n call proc_lemma__asm__Add__properties($ghost_mlo, $ghost_lastcarry, $ghost_add1, $ghost_carry1);\r\n\r\n //- Add the carry bit to mhi\r\n call r := instr_AddCarry(r, EDX, OConst(0)); \r\n call reveal_wrap32($ghost_mhi + $ghost_carry1);\r\n assert edx == $ghost_mhi + $ghost_carry1;\r\n assert !Cf(r.efl);\r\n\r\n //- Load c into ecx, clobbering the no-longer-needed lastcarry\r\n //- ecx := c[ci];\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, ECX, OMem(MReg(ESI, 0)), $ghost_ci, $ghost_c__abs, c_base);\r\n $ghost_lastcj := ecx;\r\n \r\n assert eax == wrap32($ghost_mlo + $ghost_lastcarry);\r\n call eax := AddCarry(eax, ecx); //- eax == mlo + lastcarry + lastcj\r\n $ghost_newcj := eax;\r\n $ghost_carry2 := if (wrap32($ghost_mlo + $ghost_lastcarry) + $ghost_lastcj) >= 0x100000000 then 1 else 0;\r\n assert $ghost_newcj == wrap32(wrap32($ghost_mlo + $ghost_lastcarry) + $ghost_lastcj);\r\n\r\n //- Write back the new values of c\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 0)), OReg(EAX), $ghost_ci, eax, $ghost_c__abs, c_base);\r\n\r\n //- Add the carry bit to mhi\r\n call r := instr_AddCarry(r, EDX, OConst(0)); \r\n assert edx == wrap32($ghost_mhi + $ghost_carry1 + $ghost_carry2);\r\n $ghost_carry := edx;\r\n ecx := edx;\r\n\r\n assert $ghost_carry2 == if (wrap32($ghost_mlo + $ghost_lastcarry) + $ghost_lastcj) >= 0x100000000 then 1 else 0;\r\n call reveal_wrap32($ghost_mlo + $ghost_lastcarry);\r\n assert $ghost_carry2 == if (($ghost_mlo + $ghost_lastcarry) mod 0x100000000 + $ghost_lastcj) >= 0x100000000 then 1 else 0;\r\n call reveal_wrap32(($ghost_mlo + $ghost_lastcarry) mod 0x100000000 + $ghost_lastcj);\r\n call reveal_wrap32($ghost_mhi + $ghost_carry1 + $ghost_carry2);\r\n\r\n //- Update pointers and counters\r\n $ghost_j := $ghost_j + 1;\r\n old_edi := edi;\r\n call r := instr_Sub(r, EDI, OConst(4));\r\n call reveal_wrap32(old_edi - 4);\r\n assert edi == old_edi - 4;\r\n old_esi := esi;\r\n call r := instr_Sub(r, ESI, OConst(4));\r\n call reveal_wrap32(old_esi - 4);\r\n assert esi == old_esi - 4;\r\n\r\n call proc_lemma__FleetNatMul__one__element($ghost_pv, $ghost_newcj, $ghost_carry, $ghost_aj, $ghost_bv, $ghost_lastcj, $ghost_lastcarry, $ghost_mlo, $ghost_mhi, $ghost_add1, $ghost_carry1, $ghost_carry2);\r\n assert {:split_here} true;\r\n call proc_lemma__FleetNatMul__one__partial__sum__induction($ghost_pv, $ghost_oldcs, $ghost_lastcs, fun_Seq__FromArray($absMem, $ghost_c), fun_Seq__FromArray($absMem, $ghost_a), $ghost_adigits, $ghost_bi, $ghost_bv, $ghost_j, $ghost_lastj, $ghost_carry, $ghost_lastcarry, $ghost_lastcj, $ghost_newcj);\r\n\r\n }\r\n\r\n assert $ghost_j == $ghost_adigits;\r\n\r\n //- Store the final carrry back on the stack\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 4)), OReg(ECX)); \r\n\r\n Return;\r\n}\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/dafny_FleetNatMulOpt_i.imp.beat", "content": " //-private-import BaseSpec;\r\n //-private-import MemorySpec;\r\n //-private-import IoTypesSpec;\r\n //-private-import MachineStateSpec;\r\n //-private-import AssemblySpec;\r\n //-private-import InterruptsSpec;\r\n //-private-import IoSpec;\r\n //-private-import Overflow;\r\n //-private-import Core;\r\n //-private-import LogicalAddressing;\r\n //-private-import Util;\r\n //-private-import Stacks;\r\n //-private-import Partition;\r\n //-private-import Instructions;\r\n //-private-import Separation;\r\n //-private-import IntLemmasGc;\r\n //-private-import SimpleGcMemory;\r\n //-private-import SimpleCommon;\r\n //-private-import SimpleCollector;\r\n //-private-import IntLemmasMain;\r\n //-private-import IntLemmasBase;\r\n //-private-import IoMain;\r\n //-private-basmonly-import Trusted;\r\n //-private-basmonly-import Checked;\r\n //-private-import Heap;\r\n //-private-import Seq;\r\n //-private-import dafny_DafnyPrelude;\r\n //-private-import DafnyAssembly;\r\n //-private-import dafny_base_s;\r\n //-private-import dafny_power2_s;\r\n //-private-import dafny_bytes_and_words_s;\r\n //-private-import dafny_be_sequences_s;\r\n //-private-import dafny_integer_sequences_s;\r\n //-private-import dafny_seqs_simple_i;\r\n //-private-import dafny_power_s;\r\n //-private-import dafny_mul_nonlinear_i;\r\n //-private-import dafny_mul_i;\r\n //-private-import dafny_power_i;\r\n //-private-import dafny_div_def_i;\r\n //-private-import dafny_div_boogie_i;\r\n //-private-import dafny_div_nonlinear_i;\r\n //-private-import dafny_div_i;\r\n //-private-import dafny_repeat_digit_i;\r\n //-private-import dafny_assembly_s;\r\n //-private-import dafny_power2_i;\r\n //-private-import dafny_seqs_and_ints_i;\r\n //-private-import dafny_seqs_common_i;\r\n //-private-import dafny_Word32_i;\r\n //-private-import dafny_relational_s;\r\n //-private-import dafny_assembly_i;\r\n //-private-import dafny_arrays_i;\r\n //-private-import dafny_seqs_transforms_i;\r\n //-private-import dafny_seqs_reverse_i;\r\n //-private-import dafny_integer_sequences_i;\r\n //-private-import dafny_integer_sequences_premium_i;\r\n //-private-import dafny_assembly_premium_i;\r\n //-private-import dafny_BigNatX86Shim_i;\r\n //-private-import dafny_seqs_canonical_i;\r\n //-private-import dafny_CanonicalArrays_i;\r\n //-private-import dafny_FatNatCommon_i;\r\n //-private-import dafny_FleetNatCommon_i;\r\n //-private-import dafny_FleetNatAdd_i;\r\n //-private-import dafny_FleetNatMulLemmas_i;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n\r\nmodule implementation dafny_FleetNatMulOpt_i\r\n{\r\nimplementation Proc_FleetNatMulMathOpt(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_aj:int, $ghost_bv:int, $ghost_lastcj:int, $ghost_lastcarry:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_newcj:int, $ghost_newcarry:int)\r\n{\r\n //- Lots of boilerplate\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var $ghost_mhi:int;\r\n var $ghost_mlo:int;\r\n var $ghost__temp__0:int;\r\n var $ghost_add1:int;\r\n var $ghost_carry1:int;\r\n var $ghost_carry2:int;\r\n var $ghost_add3:int;\r\n var $ghost_carry3:int;\r\n var $ghost_carry4:int;\r\n var tmp:int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___int();\r\n call lemma_fun_ensures_fun_Seq__Length___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___int();\r\n call proc_Seq__Empty__ToZero___int();\r\n call proc_Seq__Empty__FromZero___int();\r\n call proc_Seq__Singleton__Length___int();\r\n call proc_Seq__Build__Length___int();\r\n call proc_Seq__Build__Index___int();\r\n call proc_Seq__Append__Length___int();\r\n call proc_Seq__Index__Singleton___int();\r\n call proc_Seq__Append__Index___int();\r\n call proc_Seq__Update__Length___int();\r\n call proc_Seq__Index__Update___int();\r\n call proc_Seq__Equal__Equiv___int();\r\n call proc_Seq__Take__Length___int();\r\n call proc_Seq__Take__Index___int();\r\n call proc_Seq__Drop__Length___int();\r\n call proc_Seq__Drop__Index___int();\r\n call proc_Seq__Append__TakeDrop___int();\r\n call proc_Seq__Update__CommuteTake1___int();\r\n call proc_Seq__Update__CommuteTake2___int();\r\n call proc_Seq__Update__CommuteDrop1___int();\r\n call proc_Seq__Update__CommuteDrop2___int();\r\n call proc_Seq__Build__CommuteDrop___int();\r\n call proc_Seq__Take__Empty___int();\r\n call proc_Seq__Drop__Empty___int();\r\n call lemma_unroll_fun_Seq__FromArrayRange();\r\n call proc_Seq__FromArray__Length();\r\n call proc_Seq__FromArray__Index();\r\n call proc_Seq__FromArray__Update();\r\n call lemma_unroll_rec_fun____HASH_power2__FULL();\r\n call lemma_unroll_fun____HASH_power2__FULL();\r\n call lemma_fun_ensures_fun_power2();\r\n call lemma_unroll_rec_fun____HASH_BEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_fun____HASH_BEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_rec_fun____HASH_BEIntToDigitSeq__private__FULL();\r\n call lemma_unroll_fun____HASH_BEIntToDigitSeq__private__FULL();\r\n call lemma_unroll_rec_fun_RepeatDigit();\r\n call lemma_unroll_fun_RepeatDigit();\r\n call lemma_unroll_rec_fun____HASH_Reverse__FULL();\r\n call lemma_unroll_fun____HASH_Reverse__FULL();\r\n call lemma_unroll_rec_fun____HASH_power__FULL();\r\n call lemma_unroll_fun____HASH_power__FULL();\r\n call lemma_unroll_rec_fun_mul__pos();\r\n call lemma_unroll_fun_mul__pos();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___bool();\r\n call lemma_fun_ensures_fun_Seq__Length___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___bool();\r\n call proc_Seq__Empty__ToZero___bool();\r\n call proc_Seq__Empty__FromZero___bool();\r\n call proc_Seq__Singleton__Length___bool();\r\n call proc_Seq__Build__Length___bool();\r\n call proc_Seq__Build__Index___bool();\r\n call proc_Seq__Append__Length___bool();\r\n call proc_Seq__Index__Singleton___bool();\r\n call proc_Seq__Append__Index___bool();\r\n call proc_Seq__Update__Length___bool();\r\n call proc_Seq__Index__Update___bool();\r\n call proc_Seq__Equal__Equiv___bool();\r\n call proc_Seq__Take__Length___bool();\r\n call proc_Seq__Take__Index___bool();\r\n call proc_Seq__Drop__Length___bool();\r\n call proc_Seq__Drop__Index___bool();\r\n call proc_Seq__Append__TakeDrop___bool();\r\n call proc_Seq__Update__CommuteTake1___bool();\r\n call proc_Seq__Update__CommuteTake2___bool();\r\n call proc_Seq__Update__CommuteDrop1___bool();\r\n call proc_Seq__Update__CommuteDrop2___bool();\r\n call proc_Seq__Build__CommuteDrop___bool();\r\n call proc_Seq__Take__Empty___bool();\r\n call proc_Seq__Drop__Empty___bool();\r\n call lemma_unroll_rec_fun_my__div__pos();\r\n call lemma_unroll_fun_my__div__pos();\r\n call lemma_unroll_rec_fun_my__mod__recursive();\r\n call lemma_unroll_fun_my__mod__recursive();\r\n call lemma_fun_ensures_fun_RepeatDigit__premium();\r\n call lemma_unroll_rec_fun____HASH_SequenceOfZeros__FULL();\r\n call lemma_unroll_fun____HASH_SequenceOfZeros__FULL();\r\n call lemma_fun_ensures_fun_SequenceOfZeros();\r\n call lemma_fun_ensures_fun_BitwiseAnd();\r\n call lemma_fun_ensures_fun_BitwiseOr();\r\n call lemma_fun_ensures_fun_BitwiseNot();\r\n call lemma_fun_ensures_fun_BitwiseXor();\r\n call lemma_fun_ensures_fun_RotateRight();\r\n call lemma_fun_ensures_fun_RotateLeft();\r\n call lemma_fun_ensures_fun_RightShift();\r\n call lemma_fun_ensures_fun_LeftShift();\r\n call lemma_fun_ensures_fun_Add32();\r\n call lemma_fun_ensures_fun_Sub32();\r\n call lemma_fun_ensures_fun_Mul32();\r\n call lemma_fun_ensures_fun_Div32();\r\n call lemma_fun_ensures_fun_Mod32();\r\n call lemma_unroll_rec_fun____HASH_NatNumBits__FULL();\r\n call lemma_unroll_fun____HASH_NatNumBits__FULL();\r\n call lemma_fun_ensures_fun_NatNumBits();\r\n call lemma_fun_ensures_fun_asm__Add();\r\n call lemma_fun_ensures_fun_asm__Sub();\r\n call lemma_fun_ensures_fun_asm__Mul();\r\n call lemma_fun_ensures_fun_asm__Div();\r\n call lemma_fun_ensures_fun_asm__Mod();\r\n call lemma_fun_ensures_fun_asm__LeftShift();\r\n call lemma_fun_ensures_fun_asm__RightShift();\r\n call lemma_fun_ensures_fun_asm__RotateLeft();\r\n call lemma_fun_ensures_fun_asm__RotateRight();\r\n call lemma_fun_ensures_fun_asm__BitwiseNot();\r\n call lemma_fun_ensures_fun_asm__BitwiseAnd();\r\n call lemma_fun_ensures_fun_asm__BitwiseOr();\r\n call lemma_fun_ensures_fun_asm__BitwiseXor();\r\n call lemma_unroll_rec_fun____HASH_LEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_fun____HASH_LEDigitSeqToInt__private__FULL();\r\n call lemma_fun_ensures_fun_BEDigitSeqToInt__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToInt__premium();\r\n call lemma_fun_ensures_fun_BEIntToDigitSeq__premium();\r\n call lemma_fun_ensures_fun_BEIntToByteSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordToFourBytes__premium();\r\n call lemma_fun_ensures_fun_BEWordToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEByteSeqToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToByteSeq__premium();\r\n call lemma_fun_ensures_fun_Asm__Add();\r\n call lemma_fun_ensures_fun_Asm__Sub();\r\n call lemma_fun_ensures_fun_Asm__Mul();\r\n call lemma_fun_ensures_fun_Asm__Div();\r\n call lemma_fun_ensures_fun_Asm__Mod();\r\n call lemma_fun_ensures_fun_Asm__LeftShift();\r\n call lemma_fun_ensures_fun_Asm__RightShift();\r\n call lemma_fun_ensures_fun_Asm__RotateLeft();\r\n call lemma_fun_ensures_fun_Asm__RotateRight();\r\n call lemma_fun_ensures_fun_Asm__BitwiseNot();\r\n call lemma_fun_ensures_fun_Asm__BitwiseAnd();\r\n call lemma_fun_ensures_fun_Asm__BitwiseOr();\r\n call lemma_fun_ensures_fun_Asm__BitwiseXor();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___Seq___int();\r\n call lemma_fun_ensures_fun_Seq__Length___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___Seq___int();\r\n call proc_Seq__Empty__ToZero___Seq___int();\r\n call proc_Seq__Empty__FromZero___Seq___int();\r\n call proc_Seq__Singleton__Length___Seq___int();\r\n call proc_Seq__Build__Length___Seq___int();\r\n call proc_Seq__Build__Index___Seq___int();\r\n call proc_Seq__Append__Length___Seq___int();\r\n call proc_Seq__Index__Singleton___Seq___int();\r\n call proc_Seq__Append__Index___Seq___int();\r\n call proc_Seq__Update__Length___Seq___int();\r\n call proc_Seq__Index__Update___Seq___int();\r\n call proc_Seq__Equal__Equiv___Seq___int();\r\n call proc_Seq__Take__Length___Seq___int();\r\n call proc_Seq__Take__Index___Seq___int();\r\n call proc_Seq__Drop__Length___Seq___int();\r\n call proc_Seq__Drop__Index___Seq___int();\r\n call proc_Seq__Append__TakeDrop___Seq___int();\r\n call proc_Seq__Update__CommuteTake1___Seq___int();\r\n call proc_Seq__Update__CommuteTake2___Seq___int();\r\n call proc_Seq__Update__CommuteDrop1___Seq___int();\r\n call proc_Seq__Update__CommuteDrop2___Seq___int();\r\n call proc_Seq__Build__CommuteDrop___Seq___int();\r\n call proc_Seq__Take__Empty___Seq___int();\r\n call proc_Seq__Drop__Empty___Seq___int();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___atoe_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Length__FULL___atoe_Type();\r\n// call lemma_fun_ensures_fun_Seq__Length___atoe_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___atoe_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Build__FULL___atoe_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___atoe_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Index__FULL___atoe_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___atoe_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Append__FULL___atoe_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___atoe_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Update__FULL___atoe_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___atoe_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Take__FULL___atoe_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___atoe_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Drop__FULL___atoe_Type();\r\n// call proc_Seq__Empty__ToZero___atoe_Type();\r\n// call proc_Seq__Empty__FromZero___atoe_Type();\r\n// call proc_Seq__Singleton__Length___atoe_Type();\r\n// call proc_Seq__Build__Length___atoe_Type();\r\n// call proc_Seq__Build__Index___atoe_Type();\r\n// call proc_Seq__Append__Length___atoe_Type();\r\n// call proc_Seq__Index__Singleton___atoe_Type();\r\n// call proc_Seq__Append__Index___atoe_Type();\r\n// call proc_Seq__Update__Length___atoe_Type();\r\n// call proc_Seq__Index__Update___atoe_Type();\r\n// call proc_Seq__Equal__Equiv___atoe_Type();\r\n// call proc_Seq__Take__Length___atoe_Type();\r\n// call proc_Seq__Take__Index___atoe_Type();\r\n// call proc_Seq__Drop__Length___atoe_Type();\r\n// call proc_Seq__Drop__Index___atoe_Type();\r\n// call proc_Seq__Append__TakeDrop___atoe_Type();\r\n// call proc_Seq__Update__CommuteTake1___atoe_Type();\r\n// call proc_Seq__Update__CommuteTake2___atoe_Type();\r\n// call proc_Seq__Update__CommuteDrop1___atoe_Type();\r\n// call proc_Seq__Update__CommuteDrop2___atoe_Type();\r\n// call proc_Seq__Build__CommuteDrop___atoe_Type();\r\n// call proc_Seq__Take__Empty___atoe_Type();\r\n// call proc_Seq__Drop__Empty___atoe_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___Seq___atoe_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Length__FULL___Seq___atoe_Type();\r\n// call lemma_fun_ensures_fun_Seq__Length___Seq___atoe_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___Seq___atoe_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Build__FULL___Seq___atoe_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___Seq___atoe_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Index__FULL___Seq___atoe_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___Seq___atoe_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Append__FULL___Seq___atoe_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___Seq___atoe_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Update__FULL___Seq___atoe_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___Seq___atoe_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Take__FULL___Seq___atoe_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___Seq___atoe_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Drop__FULL___Seq___atoe_Type();\r\n// call proc_Seq__Empty__ToZero___Seq___atoe_Type();\r\n// call proc_Seq__Empty__FromZero___Seq___atoe_Type();\r\n// call proc_Seq__Singleton__Length___Seq___atoe_Type();\r\n// call proc_Seq__Build__Length___Seq___atoe_Type();\r\n// call proc_Seq__Build__Index___Seq___atoe_Type();\r\n// call proc_Seq__Append__Length___Seq___atoe_Type();\r\n// call proc_Seq__Index__Singleton___Seq___atoe_Type();\r\n// call proc_Seq__Append__Index___Seq___atoe_Type();\r\n// call proc_Seq__Update__Length___Seq___atoe_Type();\r\n// call proc_Seq__Index__Update___Seq___atoe_Type();\r\n// call proc_Seq__Equal__Equiv___Seq___atoe_Type();\r\n// call proc_Seq__Take__Length___Seq___atoe_Type();\r\n// call proc_Seq__Take__Index___Seq___atoe_Type();\r\n// call proc_Seq__Drop__Length___Seq___atoe_Type();\r\n// call proc_Seq__Drop__Index___Seq___atoe_Type();\r\n// call proc_Seq__Append__TakeDrop___Seq___atoe_Type();\r\n// call proc_Seq__Update__CommuteTake1___Seq___atoe_Type();\r\n// call proc_Seq__Update__CommuteTake2___Seq___atoe_Type();\r\n// call proc_Seq__Update__CommuteDrop1___Seq___atoe_Type();\r\n// call proc_Seq__Update__CommuteDrop2___Seq___atoe_Type();\r\n// call proc_Seq__Build__CommuteDrop___Seq___atoe_Type();\r\n// call proc_Seq__Take__Empty___Seq___atoe_Type();\r\n// call proc_Seq__Drop__Empty___Seq___atoe_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___atoh_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Length__FULL___atoh_Type();\r\n// call lemma_fun_ensures_fun_Seq__Length___atoh_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___atoh_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Build__FULL___atoh_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___atoh_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Index__FULL___atoh_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___atoh_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Append__FULL___atoh_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___atoh_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Update__FULL___atoh_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___atoh_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Take__FULL___atoh_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___atoh_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Drop__FULL___atoh_Type();\r\n// call proc_Seq__Empty__ToZero___atoh_Type();\r\n// call proc_Seq__Empty__FromZero___atoh_Type();\r\n// call proc_Seq__Singleton__Length___atoh_Type();\r\n// call proc_Seq__Build__Length___atoh_Type();\r\n// call proc_Seq__Build__Index___atoh_Type();\r\n// call proc_Seq__Append__Length___atoh_Type();\r\n// call proc_Seq__Index__Singleton___atoh_Type();\r\n// call proc_Seq__Append__Index___atoh_Type();\r\n// call proc_Seq__Update__Length___atoh_Type();\r\n// call proc_Seq__Index__Update___atoh_Type();\r\n// call proc_Seq__Equal__Equiv___atoh_Type();\r\n// call proc_Seq__Take__Length___atoh_Type();\r\n// call proc_Seq__Take__Index___atoh_Type();\r\n// call proc_Seq__Drop__Length___atoh_Type();\r\n// call proc_Seq__Drop__Index___atoh_Type();\r\n// call proc_Seq__Append__TakeDrop___atoh_Type();\r\n// call proc_Seq__Update__CommuteTake1___atoh_Type();\r\n// call proc_Seq__Update__CommuteTake2___atoh_Type();\r\n// call proc_Seq__Update__CommuteDrop1___atoh_Type();\r\n// call proc_Seq__Update__CommuteDrop2___atoh_Type();\r\n// call proc_Seq__Build__CommuteDrop___atoh_Type();\r\n// call proc_Seq__Take__Empty___atoh_Type();\r\n// call proc_Seq__Drop__Empty___atoh_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___Seq___atoh_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Length__FULL___Seq___atoh_Type();\r\n// call lemma_fun_ensures_fun_Seq__Length___Seq___atoh_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___Seq___atoh_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Build__FULL___Seq___atoh_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___Seq___atoh_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Index__FULL___Seq___atoh_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___Seq___atoh_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Append__FULL___Seq___atoh_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___Seq___atoh_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Update__FULL___Seq___atoh_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___Seq___atoh_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Take__FULL___Seq___atoh_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___Seq___atoh_Type();\r\n// call lemma_unroll_fun____HASH_Seq__Drop__FULL___Seq___atoh_Type();\r\n// call proc_Seq__Empty__ToZero___Seq___atoh_Type();\r\n// call proc_Seq__Empty__FromZero___Seq___atoh_Type();\r\n// call proc_Seq__Singleton__Length___Seq___atoh_Type();\r\n// call proc_Seq__Build__Length___Seq___atoh_Type();\r\n// call proc_Seq__Build__Index___Seq___atoh_Type();\r\n// call proc_Seq__Append__Length___Seq___atoh_Type();\r\n// call proc_Seq__Index__Singleton___Seq___atoh_Type();\r\n// call proc_Seq__Append__Index___Seq___atoh_Type();\r\n// call proc_Seq__Update__Length___Seq___atoh_Type();\r\n// call proc_Seq__Index__Update___Seq___atoh_Type();\r\n// call proc_Seq__Equal__Equiv___Seq___atoh_Type();\r\n// call proc_Seq__Take__Length___Seq___atoh_Type();\r\n// call proc_Seq__Take__Index___Seq___atoh_Type();\r\n// call proc_Seq__Drop__Length___Seq___atoh_Type();\r\n// call proc_Seq__Drop__Index___Seq___atoh_Type();\r\n// call proc_Seq__Append__TakeDrop___Seq___atoh_Type();\r\n// call proc_Seq__Update__CommuteTake1___Seq___atoh_Type();\r\n// call proc_Seq__Update__CommuteTake2___Seq___atoh_Type();\r\n// call proc_Seq__Update__CommuteDrop1___Seq___atoh_Type();\r\n// call proc_Seq__Update__CommuteDrop2___Seq___atoh_Type();\r\n// call proc_Seq__Build__CommuteDrop___Seq___atoh_Type();\r\n// call proc_Seq__Take__Empty___Seq___atoh_Type();\r\n// call proc_Seq__Drop__Empty___Seq___atoh_Type();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___CandidateSeedWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Length__FULL___CandidateSeedWorksheetRow();\r\n// call lemma_fun_ensures_fun_Seq__Length___CandidateSeedWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___CandidateSeedWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Build__FULL___CandidateSeedWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___CandidateSeedWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Index__FULL___CandidateSeedWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___CandidateSeedWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Append__FULL___CandidateSeedWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___CandidateSeedWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Update__FULL___CandidateSeedWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___CandidateSeedWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Take__FULL___CandidateSeedWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___CandidateSeedWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Drop__FULL___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Empty__ToZero___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Empty__FromZero___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Singleton__Length___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Build__Length___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Build__Index___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Append__Length___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Index__Singleton___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Append__Index___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Update__Length___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Index__Update___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Equal__Equiv___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Take__Length___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Take__Index___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Drop__Length___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Drop__Index___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Append__TakeDrop___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Update__CommuteTake1___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Update__CommuteTake2___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Update__CommuteDrop1___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Update__CommuteDrop2___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Build__CommuteDrop___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Take__Empty___CandidateSeedWorksheetRow();\r\n// call proc_Seq__Drop__Empty___CandidateSeedWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___CandidateSeedWorksheet();\r\n// call lemma_unroll_fun____HASH_Seq__Length__FULL___CandidateSeedWorksheet();\r\n// call lemma_fun_ensures_fun_Seq__Length___CandidateSeedWorksheet();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___CandidateSeedWorksheet();\r\n// call lemma_unroll_fun____HASH_Seq__Build__FULL___CandidateSeedWorksheet();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___CandidateSeedWorksheet();\r\n// call lemma_unroll_fun____HASH_Seq__Index__FULL___CandidateSeedWorksheet();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___CandidateSeedWorksheet();\r\n// call lemma_unroll_fun____HASH_Seq__Append__FULL___CandidateSeedWorksheet();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___CandidateSeedWorksheet();\r\n// call lemma_unroll_fun____HASH_Seq__Update__FULL___CandidateSeedWorksheet();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___CandidateSeedWorksheet();\r\n// call lemma_unroll_fun____HASH_Seq__Take__FULL___CandidateSeedWorksheet();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___CandidateSeedWorksheet();\r\n// call lemma_unroll_fun____HASH_Seq__Drop__FULL___CandidateSeedWorksheet();\r\n// call proc_Seq__Empty__ToZero___CandidateSeedWorksheet();\r\n// call proc_Seq__Empty__FromZero___CandidateSeedWorksheet();\r\n// call proc_Seq__Singleton__Length___CandidateSeedWorksheet();\r\n// call proc_Seq__Build__Length___CandidateSeedWorksheet();\r\n// call proc_Seq__Build__Index___CandidateSeedWorksheet();\r\n// call proc_Seq__Append__Length___CandidateSeedWorksheet();\r\n// call proc_Seq__Index__Singleton___CandidateSeedWorksheet();\r\n// call proc_Seq__Append__Index___CandidateSeedWorksheet();\r\n// call proc_Seq__Update__Length___CandidateSeedWorksheet();\r\n// call proc_Seq__Index__Update___CandidateSeedWorksheet();\r\n// call proc_Seq__Equal__Equiv___CandidateSeedWorksheet();\r\n// call proc_Seq__Take__Length___CandidateSeedWorksheet();\r\n// call proc_Seq__Take__Index___CandidateSeedWorksheet();\r\n// call proc_Seq__Drop__Length___CandidateSeedWorksheet();\r\n// call proc_Seq__Drop__Index___CandidateSeedWorksheet();\r\n// call proc_Seq__Append__TakeDrop___CandidateSeedWorksheet();\r\n// call proc_Seq__Update__CommuteTake1___CandidateSeedWorksheet();\r\n// call proc_Seq__Update__CommuteTake2___CandidateSeedWorksheet();\r\n// call proc_Seq__Update__CommuteDrop1___CandidateSeedWorksheet();\r\n// call proc_Seq__Update__CommuteDrop2___CandidateSeedWorksheet();\r\n// call proc_Seq__Build__CommuteDrop___CandidateSeedWorksheet();\r\n// call proc_Seq__Take__Empty___CandidateSeedWorksheet();\r\n// call proc_Seq__Drop__Empty___CandidateSeedWorksheet();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___MRProbe();\r\n// call lemma_unroll_fun____HASH_Seq__Length__FULL___MRProbe();\r\n// call lemma_fun_ensures_fun_Seq__Length___MRProbe();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___MRProbe();\r\n// call lemma_unroll_fun____HASH_Seq__Build__FULL___MRProbe();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___MRProbe();\r\n// call lemma_unroll_fun____HASH_Seq__Index__FULL___MRProbe();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___MRProbe();\r\n// call lemma_unroll_fun____HASH_Seq__Append__FULL___MRProbe();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___MRProbe();\r\n// call lemma_unroll_fun____HASH_Seq__Update__FULL___MRProbe();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___MRProbe();\r\n// call lemma_unroll_fun____HASH_Seq__Take__FULL___MRProbe();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___MRProbe();\r\n// call lemma_unroll_fun____HASH_Seq__Drop__FULL___MRProbe();\r\n// call proc_Seq__Empty__ToZero___MRProbe();\r\n// call proc_Seq__Empty__FromZero___MRProbe();\r\n// call proc_Seq__Singleton__Length___MRProbe();\r\n// call proc_Seq__Build__Length___MRProbe();\r\n// call proc_Seq__Build__Index___MRProbe();\r\n// call proc_Seq__Append__Length___MRProbe();\r\n// call proc_Seq__Index__Singleton___MRProbe();\r\n// call proc_Seq__Append__Index___MRProbe();\r\n// call proc_Seq__Update__Length___MRProbe();\r\n// call proc_Seq__Index__Update___MRProbe();\r\n// call proc_Seq__Equal__Equiv___MRProbe();\r\n// call proc_Seq__Take__Length___MRProbe();\r\n// call proc_Seq__Take__Index___MRProbe();\r\n// call proc_Seq__Drop__Length___MRProbe();\r\n// call proc_Seq__Drop__Index___MRProbe();\r\n// call proc_Seq__Append__TakeDrop___MRProbe();\r\n// call proc_Seq__Update__CommuteTake1___MRProbe();\r\n// call proc_Seq__Update__CommuteTake2___MRProbe();\r\n// call proc_Seq__Update__CommuteDrop1___MRProbe();\r\n// call proc_Seq__Update__CommuteDrop2___MRProbe();\r\n// call proc_Seq__Build__CommuteDrop___MRProbe();\r\n// call proc_Seq__Take__Empty___MRProbe();\r\n// call proc_Seq__Drop__Empty___MRProbe();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___SelectRandomRequest();\r\n// call lemma_unroll_fun____HASH_Seq__Length__FULL___SelectRandomRequest();\r\n// call lemma_fun_ensures_fun_Seq__Length___SelectRandomRequest();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___SelectRandomRequest();\r\n// call lemma_unroll_fun____HASH_Seq__Build__FULL___SelectRandomRequest();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___SelectRandomRequest();\r\n// call lemma_unroll_fun____HASH_Seq__Index__FULL___SelectRandomRequest();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___SelectRandomRequest();\r\n// call lemma_unroll_fun____HASH_Seq__Append__FULL___SelectRandomRequest();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___SelectRandomRequest();\r\n// call lemma_unroll_fun____HASH_Seq__Update__FULL___SelectRandomRequest();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___SelectRandomRequest();\r\n// call lemma_unroll_fun____HASH_Seq__Take__FULL___SelectRandomRequest();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___SelectRandomRequest();\r\n// call lemma_unroll_fun____HASH_Seq__Drop__FULL___SelectRandomRequest();\r\n// call proc_Seq__Empty__ToZero___SelectRandomRequest();\r\n// call proc_Seq__Empty__FromZero___SelectRandomRequest();\r\n// call proc_Seq__Singleton__Length___SelectRandomRequest();\r\n// call proc_Seq__Build__Length___SelectRandomRequest();\r\n// call proc_Seq__Build__Index___SelectRandomRequest();\r\n// call proc_Seq__Append__Length___SelectRandomRequest();\r\n// call proc_Seq__Index__Singleton___SelectRandomRequest();\r\n// call proc_Seq__Append__Index___SelectRandomRequest();\r\n// call proc_Seq__Update__Length___SelectRandomRequest();\r\n// call proc_Seq__Index__Update___SelectRandomRequest();\r\n// call proc_Seq__Equal__Equiv___SelectRandomRequest();\r\n// call proc_Seq__Take__Length___SelectRandomRequest();\r\n// call proc_Seq__Take__Index___SelectRandomRequest();\r\n// call proc_Seq__Drop__Length___SelectRandomRequest();\r\n// call proc_Seq__Drop__Index___SelectRandomRequest();\r\n// call proc_Seq__Append__TakeDrop___SelectRandomRequest();\r\n// call proc_Seq__Update__CommuteTake1___SelectRandomRequest();\r\n// call proc_Seq__Update__CommuteTake2___SelectRandomRequest();\r\n// call proc_Seq__Update__CommuteDrop1___SelectRandomRequest();\r\n// call proc_Seq__Update__CommuteDrop2___SelectRandomRequest();\r\n// call proc_Seq__Build__CommuteDrop___SelectRandomRequest();\r\n// call proc_Seq__Take__Empty___SelectRandomRequest();\r\n// call proc_Seq__Drop__Empty___SelectRandomRequest();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___PrimeGenerationWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Length__FULL___PrimeGenerationWorksheetRow();\r\n// call lemma_fun_ensures_fun_Seq__Length___PrimeGenerationWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___PrimeGenerationWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Build__FULL___PrimeGenerationWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___PrimeGenerationWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Index__FULL___PrimeGenerationWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___PrimeGenerationWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Append__FULL___PrimeGenerationWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___PrimeGenerationWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Update__FULL___PrimeGenerationWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___PrimeGenerationWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Take__FULL___PrimeGenerationWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___PrimeGenerationWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Drop__FULL___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Empty__ToZero___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Empty__FromZero___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Singleton__Length___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Build__Length___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Build__Index___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Append__Length___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Index__Singleton___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Append__Index___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Update__Length___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Index__Update___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Equal__Equiv___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Take__Length___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Take__Index___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Drop__Length___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Drop__Index___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Append__TakeDrop___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Update__CommuteTake1___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Update__CommuteTake2___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Update__CommuteDrop1___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Update__CommuteDrop2___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Build__CommuteDrop___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Take__Empty___PrimeGenerationWorksheetRow();\r\n// call proc_Seq__Drop__Empty___PrimeGenerationWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___RSAKeyGenerationWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Length__FULL___RSAKeyGenerationWorksheetRow();\r\n// call lemma_fun_ensures_fun_Seq__Length___RSAKeyGenerationWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___RSAKeyGenerationWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Build__FULL___RSAKeyGenerationWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___RSAKeyGenerationWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Index__FULL___RSAKeyGenerationWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___RSAKeyGenerationWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Append__FULL___RSAKeyGenerationWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___RSAKeyGenerationWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Update__FULL___RSAKeyGenerationWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___RSAKeyGenerationWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Take__FULL___RSAKeyGenerationWorksheetRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___RSAKeyGenerationWorksheetRow();\r\n// call lemma_unroll_fun____HASH_Seq__Drop__FULL___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Empty__ToZero___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Empty__FromZero___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Singleton__Length___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Build__Length___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Build__Index___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Append__Length___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Index__Singleton___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Append__Index___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Update__Length___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Index__Update___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Equal__Equiv___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Take__Length___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Take__Index___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Drop__Length___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Drop__Index___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Append__TakeDrop___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Update__CommuteTake1___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Update__CommuteTake2___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Update__CommuteDrop1___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Update__CommuteDrop2___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Build__CommuteDrop___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Take__Empty___RSAKeyGenerationWorksheetRow();\r\n// call proc_Seq__Drop__Empty___RSAKeyGenerationWorksheetRow();\r\n// call lemma_fun_ensures_fun_Width();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___sub_Problem();\r\n// call lemma_unroll_fun____HASH_Seq__Length__FULL___sub_Problem();\r\n// call lemma_fun_ensures_fun_Seq__Length___sub_Problem();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___sub_Problem();\r\n// call lemma_unroll_fun____HASH_Seq__Build__FULL___sub_Problem();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___sub_Problem();\r\n// call lemma_unroll_fun____HASH_Seq__Index__FULL___sub_Problem();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___sub_Problem();\r\n// call lemma_unroll_fun____HASH_Seq__Append__FULL___sub_Problem();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___sub_Problem();\r\n// call lemma_unroll_fun____HASH_Seq__Update__FULL___sub_Problem();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___sub_Problem();\r\n// call lemma_unroll_fun____HASH_Seq__Take__FULL___sub_Problem();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___sub_Problem();\r\n// call lemma_unroll_fun____HASH_Seq__Drop__FULL___sub_Problem();\r\n// call proc_Seq__Empty__ToZero___sub_Problem();\r\n// call proc_Seq__Empty__FromZero___sub_Problem();\r\n// call proc_Seq__Singleton__Length___sub_Problem();\r\n// call proc_Seq__Build__Length___sub_Problem();\r\n// call proc_Seq__Build__Index___sub_Problem();\r\n// call proc_Seq__Append__Length___sub_Problem();\r\n// call proc_Seq__Index__Singleton___sub_Problem();\r\n// call proc_Seq__Append__Index___sub_Problem();\r\n// call proc_Seq__Update__Length___sub_Problem();\r\n// call proc_Seq__Index__Update___sub_Problem();\r\n// call proc_Seq__Equal__Equiv___sub_Problem();\r\n// call proc_Seq__Take__Length___sub_Problem();\r\n// call proc_Seq__Take__Index___sub_Problem();\r\n// call proc_Seq__Drop__Length___sub_Problem();\r\n// call proc_Seq__Drop__Index___sub_Problem();\r\n// call proc_Seq__Append__TakeDrop___sub_Problem();\r\n// call proc_Seq__Update__CommuteTake1___sub_Problem();\r\n// call proc_Seq__Update__CommuteTake2___sub_Problem();\r\n// call proc_Seq__Update__CommuteDrop1___sub_Problem();\r\n// call proc_Seq__Update__CommuteDrop2___sub_Problem();\r\n// call proc_Seq__Build__CommuteDrop___sub_Problem();\r\n// call proc_Seq__Take__Empty___sub_Problem();\r\n// call proc_Seq__Drop__Empty___sub_Problem();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___BigNat();\r\n// call lemma_unroll_fun____HASH_Seq__Length__FULL___BigNat();\r\n// call lemma_fun_ensures_fun_Seq__Length___BigNat();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___BigNat();\r\n// call lemma_unroll_fun____HASH_Seq__Build__FULL___BigNat();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___BigNat();\r\n// call lemma_unroll_fun____HASH_Seq__Index__FULL___BigNat();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___BigNat();\r\n// call lemma_unroll_fun____HASH_Seq__Append__FULL___BigNat();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___BigNat();\r\n// call lemma_unroll_fun____HASH_Seq__Update__FULL___BigNat();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___BigNat();\r\n// call lemma_unroll_fun____HASH_Seq__Take__FULL___BigNat();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___BigNat();\r\n// call lemma_unroll_fun____HASH_Seq__Drop__FULL___BigNat();\r\n// call proc_Seq__Empty__ToZero___BigNat();\r\n// call proc_Seq__Empty__FromZero___BigNat();\r\n// call proc_Seq__Singleton__Length___BigNat();\r\n// call proc_Seq__Build__Length___BigNat();\r\n// call proc_Seq__Build__Index___BigNat();\r\n// call proc_Seq__Append__Length___BigNat();\r\n// call proc_Seq__Index__Singleton___BigNat();\r\n// call proc_Seq__Append__Index___BigNat();\r\n// call proc_Seq__Update__Length___BigNat();\r\n// call proc_Seq__Index__Update___BigNat();\r\n// call proc_Seq__Equal__Equiv___BigNat();\r\n// call proc_Seq__Take__Length___BigNat();\r\n// call proc_Seq__Take__Index___BigNat();\r\n// call proc_Seq__Drop__Length___BigNat();\r\n// call proc_Seq__Drop__Index___BigNat();\r\n// call proc_Seq__Append__TakeDrop___BigNat();\r\n// call proc_Seq__Update__CommuteTake1___BigNat();\r\n// call proc_Seq__Update__CommuteTake2___BigNat();\r\n// call proc_Seq__Update__CommuteDrop1___BigNat();\r\n// call proc_Seq__Update__CommuteDrop2___BigNat();\r\n// call proc_Seq__Build__CommuteDrop___BigNat();\r\n// call proc_Seq__Take__Empty___BigNat();\r\n// call proc_Seq__Drop__Empty___BigNat();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___Problem();\r\n// call lemma_unroll_fun____HASH_Seq__Length__FULL___Problem();\r\n// call lemma_fun_ensures_fun_Seq__Length___Problem();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___Problem();\r\n// call lemma_unroll_fun____HASH_Seq__Build__FULL___Problem();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___Problem();\r\n// call lemma_unroll_fun____HASH_Seq__Index__FULL___Problem();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___Problem();\r\n// call lemma_unroll_fun____HASH_Seq__Append__FULL___Problem();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___Problem();\r\n// call lemma_unroll_fun____HASH_Seq__Update__FULL___Problem();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___Problem();\r\n// call lemma_unroll_fun____HASH_Seq__Take__FULL___Problem();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___Problem();\r\n// call lemma_unroll_fun____HASH_Seq__Drop__FULL___Problem();\r\n// call proc_Seq__Empty__ToZero___Problem();\r\n// call proc_Seq__Empty__FromZero___Problem();\r\n// call proc_Seq__Singleton__Length___Problem();\r\n// call proc_Seq__Build__Length___Problem();\r\n// call proc_Seq__Build__Index___Problem();\r\n// call proc_Seq__Append__Length___Problem();\r\n// call proc_Seq__Index__Singleton___Problem();\r\n// call proc_Seq__Append__Index___Problem();\r\n// call proc_Seq__Update__Length___Problem();\r\n// call proc_Seq__Index__Update___Problem();\r\n// call proc_Seq__Equal__Equiv___Problem();\r\n// call proc_Seq__Take__Length___Problem();\r\n// call proc_Seq__Take__Index___Problem();\r\n// call proc_Seq__Drop__Length___Problem();\r\n// call proc_Seq__Drop__Index___Problem();\r\n// call proc_Seq__Append__TakeDrop___Problem();\r\n// call proc_Seq__Update__CommuteTake1___Problem();\r\n// call proc_Seq__Update__CommuteTake2___Problem();\r\n// call proc_Seq__Update__CommuteDrop1___Problem();\r\n// call proc_Seq__Update__CommuteDrop2___Problem();\r\n// call proc_Seq__Build__CommuteDrop___Problem();\r\n// call proc_Seq__Take__Empty___Problem();\r\n// call proc_Seq__Drop__Empty___Problem();\r\n// call lemma_unroll_rec_fun_CanonicalizeSeq__def();\r\n// call lemma_unroll_fun_CanonicalizeSeq__def();\r\n// call lemma_fun_ensures_fun_CanonicalizeSeq();\r\n// call lemma_fun_ensures_fun_IsZeroValue();\r\n// call lemma_fun_ensures_fun_SelectDigits();\r\n// call lemma_unroll_rec_fun____HASH_MaxLen__def__FULL();\r\n// call lemma_unroll_fun____HASH_MaxLen__def__FULL();\r\n// call lemma_fun_ensures_fun_MaxLen();\r\n// call lemma_fun_ensures_fun_MaxLen3();\r\n// call lemma_fun_ensures_fun_ArrayDigitAt();\r\n// call lemma_fun_ensures_fun_ArrayDigitAt__add();\r\n// call lemma_fun_ensures_fun_ArrayDigitAt__sub();\r\n// call lemma_fun_ensures_fun_ArrayDigitAt__cmp();\r\n// call lemma_fun_ensures_fun_ArrayDigitAt__mul();\r\n// call lemma_fun_ensures_fun_J();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___MulRow();\r\n// call lemma_unroll_fun____HASH_Seq__Length__FULL___MulRow();\r\n// call lemma_fun_ensures_fun_Seq__Length___MulRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___MulRow();\r\n// call lemma_unroll_fun____HASH_Seq__Build__FULL___MulRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___MulRow();\r\n// call lemma_unroll_fun____HASH_Seq__Index__FULL___MulRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___MulRow();\r\n// call lemma_unroll_fun____HASH_Seq__Append__FULL___MulRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___MulRow();\r\n// call lemma_unroll_fun____HASH_Seq__Update__FULL___MulRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___MulRow();\r\n// call lemma_unroll_fun____HASH_Seq__Take__FULL___MulRow();\r\n// call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___MulRow();\r\n// call lemma_unroll_fun____HASH_Seq__Drop__FULL___MulRow();\r\n// call proc_Seq__Empty__ToZero___MulRow();\r\n// call proc_Seq__Empty__FromZero___MulRow();\r\n// call proc_Seq__Singleton__Length___MulRow();\r\n// call proc_Seq__Build__Length___MulRow();\r\n// call proc_Seq__Build__Index___MulRow();\r\n// call proc_Seq__Append__Length___MulRow();\r\n// call proc_Seq__Index__Singleton___MulRow();\r\n// call proc_Seq__Append__Index___MulRow();\r\n// call proc_Seq__Update__Length___MulRow();\r\n// call proc_Seq__Index__Update___MulRow();\r\n// call proc_Seq__Equal__Equiv___MulRow();\r\n// call proc_Seq__Take__Length___MulRow();\r\n// call proc_Seq__Take__Index___MulRow();\r\n// call proc_Seq__Drop__Length___MulRow();\r\n// call proc_Seq__Drop__Index___MulRow();\r\n// call proc_Seq__Append__TakeDrop___MulRow();\r\n// call proc_Seq__Update__CommuteTake1___MulRow();\r\n// call proc_Seq__Update__CommuteTake2___MulRow();\r\n// call proc_Seq__Update__CommuteDrop1___MulRow();\r\n// call proc_Seq__Update__CommuteDrop2___MulRow();\r\n// call proc_Seq__Build__CommuteDrop___MulRow();\r\n// call proc_Seq__Take__Empty___MulRow();\r\n// call proc_Seq__Drop__Empty___MulRow();\r\n\r\n //- Standard variable propagation\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old; \r\n\r\n //- Alignment triggers\r\n assert TV(r.regs[ESP]);\r\n assert TO(0 - 1);\r\n assert TO(279552 - 1);\r\n assert TO(0);\r\n assert TO(279552);\r\n assert TO(1);\r\n assert TO(279553);\r\n assert TO(2);\r\n assert TO(279554);\r\n assert TO(3);\r\n assert TO(279555);\r\n assert TO(4);\r\n assert TO(279556);\r\n assert TO(5);\r\n assert TO(279557);\r\n assert TO(6);\r\n assert TO(279558);\r\n\r\n call proc_lemma__mod__properties();\r\n call proc_lemma__2toX();\r\n call proc_lemma__word32__Word32();\r\n call reveal_WORD_HI();\r\n\r\n call eax := Load(stk, esp + 12); //- grab aj\r\n assert eax == $ghost_aj;\r\n\r\n call edx := Load(stk, esp + 16); //- grab bv\r\n assert edx == $ghost_bv;\r\n\r\n call edx, eax := Mul64(eax, edx);\r\n $ghost_mhi := edx;\r\n $ghost_mlo := eax;\r\n call reveal_wrap32($ghost_aj * $ghost_bv);\r\n assert TVM($ghost_aj, $ghost_bv);\r\n assert TVD($ghost_aj * $ghost_bv, 0x100000000);\r\n call proc_lemma__asm__Mul64($ghost_aj, $ghost_bv, $ghost_mhi, $ghost_mlo);\r\n\r\n call ebx := Load(stk, esp + 24); //- grab last carry\r\n assert ebx == $ghost_lastcarry;\r\n\r\n //- add1 (needs to be a direct call to instr_Add to bypass overflow check in logical add\r\n call r := instr_Add(r, EAX, OReg(EBX)); //- eax == mlo + lastcarry\r\n $ghost_add1 := eax;\r\n\r\n call reveal_wrap32($ghost_mlo + $ghost_lastcarry);\r\n $ghost_carry1 := if $ghost_add1 < $ghost_lastcarry then 1 else 0;\r\n assert if Cf(r.efl) then $ghost_carry1 == 1 else $ghost_carry1 == 0;\r\n call proc_lemma__asm__Add__properties($ghost_mlo, $ghost_lastcarry, $ghost_add1, $ghost_carry1);\r\n\r\n //- Add the carry bit to mhi\r\n call r := instr_AddCarry(r, EDX, OConst(0)); \r\n call reveal_wrap32($ghost_mhi + $ghost_carry1);\r\n assert edx == $ghost_mhi + $ghost_carry1;\r\n assert !Cf(r.efl);\r\n \r\n call ebx := Load(stk, esp + 20); //- grab last cj\r\n assert eax == wrap32($ghost_mlo + $ghost_lastcarry);\r\n assert ebx == $ghost_lastcj;\r\n call eax := AddCarry(eax, ebx); //- eax == mlo + lastcarry + lastcj\r\n $ghost_newcj := eax;\r\n $ghost_carry2 := if (wrap32($ghost_mlo + $ghost_lastcarry) + $ghost_lastcj) >= 0x100000000 then 1 else 0;\r\n assert $ghost_newcj == wrap32(wrap32($ghost_mlo + $ghost_lastcarry) + $ghost_lastcj);\r\n\r\n //- Add the carry bit to mhi\r\n call r := instr_AddCarry(r, EDX, OConst(0)); \r\n //-call reveal_wrap32($ghost_mhi + $ghost_carry1 + $ghost_carry2);\r\n //-assert edx == $ghost_mhi + $ghost_carry1 + $ghost_carry2;\r\n assert edx == wrap32($ghost_mhi + $ghost_carry1 + $ghost_carry2);\r\n\r\n //- Write back the results\r\n $ghost_newcj := eax;\r\n $ghost_newcarry := edx;\r\n call Store(inout stk, esp+4, eax);\r\n call Store(inout stk, esp+8, edx);\r\n\r\n// call proc_lemma__FleetNatMul__one__element__properties(4294967296, $ghost_aj, $ghost_bv, $ghost_mhi, $ghost_mlo, $ghost_lastcarry, $ghost_add1, $ghost_carry1, $ghost_lastcj, $ghost_newcj, $ghost_carry2, $ghost_add3, $ghost_carry3, $ghost_newcarry, $ghost_carry4);\r\n\r\n assert $ghost_carry2 == if (wrap32($ghost_mlo + $ghost_lastcarry) + $ghost_lastcj) >= 0x100000000 then 1 else 0;\r\n call reveal_wrap32($ghost_mlo + $ghost_lastcarry);\r\n assert $ghost_carry2 == if (($ghost_mlo + $ghost_lastcarry) mod 0x100000000 + $ghost_lastcj) >= 0x100000000 then 1 else 0;\r\n assert $ghost_newcj == wrap32(wrap32($ghost_mlo + $ghost_lastcarry) + $ghost_lastcj);\r\n assert $ghost_newcj == wrap32(($ghost_mlo + $ghost_lastcarry) mod 0x100000000 + $ghost_lastcj);\r\n call reveal_wrap32(($ghost_mlo + $ghost_lastcarry) mod 0x100000000 + $ghost_lastcj);\r\n assert $ghost_newcj == (($ghost_mlo + $ghost_lastcarry) mod 0x100000000+ $ghost_lastcj) mod 0x100000000;\r\n\r\n assert $ghost_newcarry == wrap32($ghost_mhi + $ghost_carry1 + $ghost_carry2);\r\n call reveal_wrap32($ghost_mhi + $ghost_carry1 + $ghost_carry2);\r\n assert $ghost_newcarry == ($ghost_mhi + $ghost_carry1 + $ghost_carry2) mod 0x100000000;\r\n\r\n assert {:split_here} true;\r\n \r\n Return;\r\n}\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/dafny_assembly_i.imp.beat", "content": "//-\r\n//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-private-import IoMain;\r\n//-private-import IntLemmasMain;\r\n//-private-basmonly-import Trusted;\r\n//-private-basmonly-import Checked;\r\n//-private-import Heap;\r\n//-private-import Seq;\r\n//-private-import dafny_DafnyPrelude;\r\n//-private-import DafnyAssembly;\r\n//-private-import dafny_base_s;\r\n//-private-import dafny_relational_s;\r\n//-\r\n//-\r\n//-\r\n\r\nmodule implementation dafny_assembly_i\r\n{\r\n\r\nimplementation proc_lemma__word32($ghost_x:int) returns()\r\n{\r\n call reveal_WORD_HI();\r\n}\r\n\r\n\r\n//function implementation fun_IntBit($ghost_index:int, $ghost_n:int):bool\r\n//{\r\n// int_bit($ghost_n, 31 - $ghost_index) // IntBit is big endian, int_bit is little endian\r\n//}\r\n\r\nimplementation proc_lemma__IntBit($ghost_index:int, $ghost_val:int) returns()\r\n{\r\n call reveal_int_bit($ghost_val, 31 - $ghost_index);\r\n}\r\n\r\nimplementation proc_lemma__mod0x100000000($ghost_x:int) returns()\r\n{\r\n}\r\n\r\nimplementation proc_method__Mul(my r_old:regs, $ghost_x:int, $ghost_y:int, $opn_hi:int, $opn_x:int, $opn_y:opn) returns(my r:regs, $ghost_hi:int, $ghost_r:int)\r\n{\r\n r := r_old;\r\n call r := instr_MulChecked(r, $opn_y);\r\n assert TVM($ghost_x, $ghost_y);\r\n $ghost_r := r.regs[EAX];\r\n $ghost_hi := r.regs[EDX];\r\n}\r\n\r\nimplementation proc_method__DivMod(my r_old:regs, $ghost_zero:int, $ghost_x:int, $ghost_y:int, $opn_zero:int, $opn_x:int, $opn_y:opn) returns(my r:regs, $ghost_m:int, $ghost_d:int)\r\n{\r\n r := r_old;\r\n call r := instr_Div(r, $opn_y);\r\n $ghost_d := r.regs[EAX];\r\n $ghost_m := r.regs[EDX];\r\n}\r\n\r\nimplementation Proc_asm__Rdtsc(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_high:int, $ghost_low:int)\r\n{\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n\r\n assert TV(esp) && TO(0) && TO(1) && TO(2) && TO(3);\r\n\r\n call Rdtsc();\r\n\r\n call Store(inout stk, esp + IPSize, edx);\r\n call Store(inout stk, esp + (4 + IPSize), eax);\r\n\r\n $ghost_high := edx;\r\n $ghost_low := eax;\r\n\r\n Return;\r\n}\r\n\r\nimplementation Proc_asm__declassify__result(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_concrete:int, $ghost_result:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_pub_result:int)\r\n{\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n\r\n assert TV(esp) && TO(0) && TO(1) && TO(2) && TO(3) && TO(4);\r\n\r\n call eax := Load(stk, esp + (4 + IPSize)); // Grab the concrete value off the stack\r\n\r\n assert eax == $ghost_concrete;\r\n\r\n call r := declassify(r, EAX, $ghost_result);\r\n\r\n assert eax == $ghost_result;\r\n\r\n call Store(inout stk, esp + IPSize, eax);\r\n\r\n $ghost_pub_result := eax;\r\n Return;\r\n}\r\n\r\n\r\nimplementation Proc_GetBootloaderArgWord(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_index:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_word:int)\r\n{\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n\r\n assert TV(esp) && TO(0) && TO(1) && TO(2) && TO(3);\r\n\r\n call eax := Load(stk, esp + (4 + IPSize));\r\n\r\n assert eax == $ghost_index;\r\n ebx := 4;\r\n call eax,edx := Mul(eax, ebx); //- Convert to bytes\r\n assert eax == wrap32(Mult($ghost_index, 4));\r\n\r\n //- Prove that we can convert this into eax == $ghost_index * 4\r\n assert TVM($ghost_index, 4); //- Reveals Mult\r\n call reveal_wrap32($ghost_index * 4);\r\n call reveal_WORD_HI();\r\n assert eax == $ghost_index * 4;\r\n \r\n call reveal_MemInvDetails(); //- Shows that ArgLo is sane\r\n ebx := ArgLo;\r\n call ebx := AddChecked(ebx, eax);\r\n assert Aligned(ArgLo);\r\n assert TV(ArgLo) && TO($ghost_index); //- Show that ebx is Aligned\r\n\r\n call edx := Load(mems.arg, ebx);\r\n //call edx := Load(arg, ebx);\r\n\r\n call Store(inout stk, esp + IPSize, edx);\r\n\r\n $ghost_word := edx;\r\n Return;\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/dafny_bit_vector_lemmas_i.imp.beat", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-private-import IoMain;\r\n//-private-import IntLemmasMain;\r\n//-private-basmonly-import Trusted;\r\n//-private-basmonly-import Checked;\r\n//-private-import Heap;\r\n//-private-import Seq;\r\n//-private-import dafny_DafnyPrelude;\r\n//-private-import DafnyAssembly;\r\n//-private-import dafny_base_s;\r\n//-private-import dafny_relational_s;\r\n//-private-import dafny_assembly_i;\r\n//-\r\n//-\r\n//-\r\n\r\nmodule implementation dafny_bit_vector_lemmas_i\r\n{\r\n\r\nimplementation proc_lemma__and__with__ff($ghost_x:int) returns()\r\n{\r\n call lemma_and_with_ff($ghost_x);\r\n}\r\n \r\nimplementation proc_lemma__and__with__ffff($ghost_x:int) returns()\r\n{\r\n call lemma_and_with_ffff($ghost_x);\r\n}\r\n\r\nimplementation proc_lemma__xor__bytes(x:int, y:int)\r\n{\r\n call lemma_xor_bytes(x, y);\r\n}\r\n\r\nimplementation proc_lemma__and__with__32__64(x:int)\r\n{\r\n call lemma_and_with_32_64(x);\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/dafny_io_mem_i.imp.beat", "content": "//-\r\n//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-private-import IoMain;\r\n//-private-import IntLemmasMain;\r\n//-private-basmonly-import Trusted;\r\n//-private-basmonly-import Checked;\r\n//-private-import Heap;\r\n//-private-import Seq;\r\n//-private-import dafny_DafnyPrelude;\r\n//-private-import DafnyAssembly;\r\n//-private-import dafny_io_mem_s;\r\n//-\r\n//-\r\n//-\r\n\r\nmodule implementation dafny_io_mem_i\r\n{\r\nimplementation Proc_IoMemAddrRead(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_r_addr:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_r_val:int)\r\n{\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var mem_tmp:[int]int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n assert TV(esp);\r\n assert TO(0);\r\n assert TO(768);\r\n assert TO(1);\r\n assert TO(769);\r\n assert TO(2);\r\n assert TO(770);\r\n\r\n //- Read arguments off the stack\r\n call edx := Load(stk, esp + 8); //- r_addr\r\n\r\n call ecx := IoMemAddrRead(edx);\r\n\r\n call Store(inout stk, esp + 4, ecx);\r\n $ghost_r_val := ecx;\r\n\r\n //- dummy method body for axiom\r\n Return;\r\n}\r\n\r\nimplementation Proc_IoMemAddrWrite(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_w_addr:int, $ghost_w_val:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap)\r\n{\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var mem_tmp:[int]int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n assert TV(esp);\r\n assert TO(0);\r\n assert TO(768);\r\n assert TO(1);\r\n assert TO(769);\r\n assert TO(2);\r\n assert TO(770);\r\n\r\n //- Read arguments off the stack\r\n call ebx := Load(stk, esp + 4); //- w_addr\r\n call edx := Load(stk, esp + 8); //- w_val\r\n\r\n call IoMemAddrWrite(ebx, edx);\r\n\r\n //- dummy method body for axiom\r\n Return;\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/dafny_pci_i.imp.beat", "content": "//-\r\n//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-private-import IoMain;\r\n//-private-import IntLemmasMain;\r\n//-private-basmonly-import Trusted;\r\n//-private-basmonly-import Checked;\r\n//-private-import Heap;\r\n//-private-import Seq;\r\n//-private-import dafny_DafnyPrelude;\r\n//-private-import DafnyAssembly;\r\n//-private-import PCI;\r\n//-private-import IntelNIC;\r\n//-private-import dafny_relational_s;\r\n//-private-import dafny_base_s;\r\n//-private-import dafny_power2_s;\r\n//-private-import dafny_bytes_and_words_s;\r\n//-\r\n//-\r\n//-\r\n\r\nmodule implementation dafny_pci_i\r\n{\r\nimplementation proc_reveal__mod4()\r\n{\r\n forall $ghost_n:int::fun_mod4($ghost_n) == fun____HASH_mod4__FULL($ghost_n)\r\n {\r\n assert unhide_fun_mod4($ghost_n);\r\n }\r\n}\r\nimplementation proc_reveal__mod16()\r\n{\r\n forall $ghost_n:int::fun_mod16($ghost_n) == fun____HASH_mod16__FULL($ghost_n)\r\n {\r\n assert unhide_fun_mod16($ghost_n);\r\n }\r\n}\r\nimplementation proc_reveal__mod128()\r\n{\r\n forall $ghost_n:int::fun_mod128($ghost_n) == fun____HASH_mod128__FULL($ghost_n)\r\n {\r\n assert unhide_fun_mod128($ghost_n);\r\n }\r\n}\r\nimplementation proc_reveal__div16()\r\n{\r\n forall $ghost_n:int::fun_div16($ghost_n) == fun____HASH_div16__FULL($ghost_n)\r\n {\r\n assert unhide_fun_div16($ghost_n);\r\n }\r\n}\r\n\r\nfunction implementation fun_IsValidPciId($ghost_id:int):bool\r\n{\r\n IsValidPciId($ghost_id)\r\n}\r\nfunction implementation fun_PciMemAddr($ghost_id:int):int\r\n{\r\n PciMemAddr($ghost_id)\r\n}\r\nfunction implementation fun_PciMemSize($ghost_id:int):int\r\n{\r\n PciMemSize($ghost_id)\r\n}\r\nfunction implementation fun_DeviceMemAddr():int\r\n{\r\n ?devMemLo\r\n}\r\nfunction implementation fun_DeviceMemSize():int\r\n{\r\n ?devMemHi - ?devMemLo\r\n}\r\n\r\nimplementation Proc_NetworkPciMemSetup(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_id:int, $ghost_size:int, $ghost_addr:int, $ghost_device_mem_addr:int)\r\n{\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var mem_tmp:[int]int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n assert TV(esp);\r\n assert TO(0);\r\n assert TO(768);\r\n assert TO(1);\r\n assert TO(769);\r\n assert TO(2);\r\n assert TO(770);\r\n assert TO(3);\r\n assert TO(771);\r\n assert TO(4);\r\n assert TO(772);\r\n\r\n call map_network_card();\r\n\r\n edx := eax;\r\n\r\n call Store(inout stk, esp + 4, ecx);\r\n $ghost_id := ecx;\r\n\r\n call Store(inout stk, esp + 8, edx);\r\n $ghost_size := edx;\r\n\r\n call Store(inout stk, esp + 12, ebx);\r\n $ghost_addr := ebx;\r\n\r\n call reveal_IoInv();\r\n assert IoInv_Transparent($IoVars, $pciMem);\r\n call reveal_WORD_HI();\r\n call proc_lemma__power2__32();\r\n\r\n// edx := SLo; // == ?memLo\r\n// assert edx == ?memLo;\r\n// assert ?memHi == ?devMemLo;\r\n// assert ?memHi == ?memLo + 0x7400;\r\n//\r\n//// assert ?devMemHi - ?devMemLo > 0x204004;\r\n//// assert ?devMemLo >= 0;\r\n//// assert word(edx);\r\n//// assert word(?devMemHi);\r\n//// assert word(?devMemLo);\r\n//\r\n// call edx := Add(edx, 0x7400); // == ?memHi == ?devMemLo\r\n//\r\n// assert edx == ?devMemLo;\r\n edx := 0x08000000;\r\n\r\n call Store(inout stk, esp + 16, edx);\r\n $ghost_device_mem_addr := edx;\r\n\r\n assert ?devMemLo mod 0x10000 == 0;\r\n call proc_reveal__mod16(); // Need to reveal it, so we can prove it's true\r\n \r\n // dummy method body for axiom\r\n Return;\r\n}\r\nimplementation Proc_PciMemStore(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_id:int, $ghost_dst:int, $ghost_val:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap)\r\n{\r\n call reveal_MemInvDetails();\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var mem_tmp:[int]int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n assert TV(esp);\r\n assert TO(0);\r\n assert TO(768);\r\n assert TO(1);\r\n assert TO(769);\r\n assert TO(2);\r\n assert TO(770);\r\n assert TO(3);\r\n assert TO(771);\r\n\r\n //- Read arguments off the stack\r\n call ebx := Load(stk, esp + 4); //- id\r\n call ecx := Load(stk, esp + 8); //- dst\r\n call edx := Load(stk, esp + 12); //- val\r\n\r\n //- Setup args to lookupMapping to ensure we've configured this device\r\n esi := ebx;\r\n edi := PciLo;\r\n edx := edi;\r\n call edx := Add(edx, 1024); //- == ?pciHi\r\n call lookupMapping(ebx, edi, edx);\r\n\r\n if (ecx != 1) { //- Failed to find the mapping!\r\n eax := 0x55550050;\r\n call debugBreak();\r\n }\r\n \r\n //- Re-read arguments off the stack\r\n call ebx := Load(stk, esp + 4); //- id\r\n call ecx := Load(stk, esp + 8); //- dst\r\n call edx := Load(stk, esp + 12); //- val\r\n\r\n call reveal_IoInv();\r\n assert IoInv_Transparent($IoVars, $pciMem);\r\n call PciMemStore32(ebx, ecx, edx);\r\n \r\n call reveal_IoInv();\r\n\r\n// assert $pciMem == old($pciMem);\r\n// assert io._pci == old(io._pci);\r\n// assert IoInv_Transparent($IoVars, $pciMem);\r\n\r\n// assert &&& &&& (forall addr:int, j:int::{$pciMem[addr],TV(j)} TV(j) && 0 <= j &&\r\n// addr == ?pciLo + 16*j && addr <= ?pciHi - 16 ==>\r\n// (IsValidPciId($pciMem[addr]) ==> \r\n// $pciMem[addr + 4] == PciMemAddr($pciMem[addr]) \r\n// && $pciMem[addr + 8] == PciMemSize($pciMem[addr])\r\n// && SafePciMemRegion(PciMemAddr($pciMem[addr]), PciMemSize($pciMem[addr]))\r\n// && io._pci.PciConfigState[$pciMem[addr]] == 4 ));\r\n\r\n// assert &&& &&& IoInv_Transparent($IoVars, $pciMem);\r\n// assert &&& &&& NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars__id,$gcVars__id,$ioVars__id,$commonVars,$gcVars,me,init,$State,core,ptOwner__id,(mem.map),$part,my_part,$mem__id,$sepVars__id,mems,$sepVars,$stacksFrames,state._io,$ioVars);\r\n\r\n // dummy method body for axiom\r\n Return;\r\n\r\n\r\n}\r\nimplementation Proc_PciMemLoad(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_id:int, $ghost_src:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_val:int)\r\n{\r\n call reveal_MemInvDetails();\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var mem_tmp:[int]int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n assert TV(esp);\r\n assert TO(0);\r\n assert TO(768);\r\n assert TO(1);\r\n assert TO(769);\r\n assert TO(2);\r\n assert TO(770);\r\n assert TO(3);\r\n assert TO(771);\r\n\r\n call ecx := Load(stk, esp + 8); //- id \r\n call edx := Load(stk, esp + 12); //- src\r\n\r\n //- Setup args to lookupMapping to ensure we've configured this device\r\n esi := ecx;\r\n edi := PciLo;\r\n edx := edi;\r\n call edx := Add(edx, 1024); //- == ?pciHi\r\n call lookupMapping(ecx, edi, edx);\r\n\r\n if (ecx != 1) { //- Failed to find the mapping!\r\n eax := 0x55550051;\r\n call debugBreak();\r\n }\r\n \r\n //- Re-read arguments off the stack\r\n call ecx := Load(stk, esp + 8); //- id \r\n call edx := Load(stk, esp + 12); //- src\r\n\r\n call reveal_IoInv();\r\n assert IoInv_Transparent($IoVars, $pciMem);\r\n\r\n call ebx := PciMemLoad32(ecx, edx);\r\n assert word(ebx);\r\n call reveal_IoInv();\r\n\r\n //- Store the return val\r\n call Store(inout stk, esp + 4, ebx);\r\n $ghost_val := ebx;\r\n assert word(ebx);\r\n\r\n call reveal_WORD_HI();\r\n call proc_lemma__power2__32();\r\n // dummy method body for axiom\r\n Return;\r\n}\r\nimplementation proc_DeviceMemStore(my r_old:regs, linear io_old:IOState, objLayouts:[int]ObjLayout, $S:int, $toAbs:[int]int, $absMem:[int][int]int, $commonVars:commonVars, $gcVars:gcVars, init:bool, stk:mem, statics:mem, core_state:core_state, ptMem:mem, mems:mems, $stacksFrames:[int]Frames, $ghost_dst:int, $ghost_val:int, $opn_dst:opn_mem, $opn_val:opn) returns(my r:regs, linear io:IOState)\r\n{\r\n r := r_old;\r\n io := io_old;\r\n\r\n call reveal_IoInv();\r\n assert IoInv_Transparent($IoVars, $pciMem);\r\n call io := instr_DeviceStore(r, io, $opn_dst, $opn_val);\r\n \r\n call reveal_IoInv();\r\n}\r\nimplementation proc_DeviceMemLoad(my r_old:regs, linear io_old:IOState, objLayouts:[int]ObjLayout, $S:int, $toAbs:[int]int, $absMem:[int][int]int, $commonVars:commonVars, $gcVars:gcVars, init:bool, stk:mem, statics:mem, core_state:core_state, ptMem:mem, mems:mems, $stacksFrames:[int]Frames, $ghost_src:int, $opn_src:opn_mem, $opn_val:int) returns(my r:regs, linear io:IOState, $ghost_val:int)\r\n{\r\n r := r_old;\r\n io := io_old;\r\n\r\n call reveal_IoInv();\r\n assert IoInv_Transparent($IoVars, $pciMem);\r\n\r\n call r, io := instr_DeviceLoad(r, io, $opn_val, $opn_src);\r\n call reveal_IoInv();\r\n\r\n call reveal_WORD_HI();\r\n call proc_lemma__power2__32();\r\n $ghost_val := r.regs[$opn_val];\r\n}\r\n//implementation Proc_little__endian__bytes__to__word(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_bytes:Seq___int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_w:int)\r\n//{\r\n// var $absMem_tmp:[int][int]int;\r\n// var objLayouts_tmp:[int]ObjLayout;\r\n// var heap_tmp:Heap;\r\n// var obj_tmp:int;\r\n// var val_tmp:int;\r\n// var mem_tmp:[int]int;\r\n// var $ghost_bytes__abs:int;\r\n// assert fun_unroll(0);\r\n// assert fun_unroll(1);\r\n// call lemma_fun_ensures_fun_asm__Add();\r\n// call lemma_fun_ensures_fun_asm__Sub();\r\n// call lemma_fun_ensures_fun_asm__Mul();\r\n// call lemma_fun_ensures_fun_asm__Div();\r\n// call lemma_fun_ensures_fun_asm__Mod();\r\n// call lemma_fun_ensures_fun_asm__LeftShift();\r\n// call lemma_fun_ensures_fun_asm__RightShift();\r\n// call lemma_fun_ensures_fun_asm__RotateLeft();\r\n// call lemma_fun_ensures_fun_asm__RotateRight();\r\n// call lemma_fun_ensures_fun_asm__BitwiseNot();\r\n// call lemma_fun_ensures_fun_asm__BitwiseAnd();\r\n// call lemma_fun_ensures_fun_asm__BitwiseOr();\r\n// call lemma_fun_ensures_fun_asm__BitwiseXor();\r\n// call lemma_unroll_fun_INTERNAL__mul__pos();\r\n// call lemma_unroll_fun_INTERNAL__mod__recursive();\r\n// call lemma_unroll_fun_INTERNAL__div__pos();\r\n// call lemma_unroll_fun_Seq__Length__FULL___int();\r\n// call lemma_fun_ensures_fun_Seq__Length___int();\r\n// call lemma_unroll_fun_Seq__Build__FULL___int();\r\n// call lemma_unroll_fun_Seq__Index__FULL___int();\r\n// call lemma_unroll_fun_Seq__Append__FULL___int();\r\n// call lemma_unroll_fun_Seq__Update__FULL___int();\r\n// call lemma_unroll_fun_Seq__Take__FULL___int();\r\n// call lemma_unroll_fun_Seq__Drop__FULL___int();\r\n// call proc_Seq__Empty__ToZero___int();\r\n// call proc_Seq__Empty__FromZero___int();\r\n// call proc_Seq__Singleton__Length___int();\r\n// call proc_Seq__Build__Length___int();\r\n// call proc_Seq__Build__Index___int();\r\n// call proc_Seq__Append__Length___int();\r\n// call proc_Seq__Index__Singleton___int();\r\n// call proc_Seq__Append__Index___int();\r\n// call proc_Seq__Update__Length___int();\r\n// call proc_Seq__Index__Update___int();\r\n// call proc_Seq__Equal__Equiv___int();\r\n// call proc_Seq__Take__Length___int();\r\n// call proc_Seq__Take__Index___int();\r\n// call proc_Seq__Drop__Length___int();\r\n// call proc_Seq__Drop__Index___int();\r\n// call proc_Seq__Append__TakeDrop___int();\r\n// call proc_Seq__Update__CommuteTake1___int();\r\n// call proc_Seq__Update__CommuteTake2___int();\r\n// call proc_Seq__Update__CommuteDrop1___int();\r\n// call proc_Seq__Update__CommuteDrop2___int();\r\n// call proc_Seq__Build__CommuteDrop___int();\r\n// call proc_Seq__Take__Empty___int();\r\n// call proc_Seq__Drop__Empty___int();\r\n// call lemma_unroll_fun_Seq__FromArrayRange();\r\n// call proc_Seq__FromArray__Length();\r\n// call proc_Seq__FromArray__Index();\r\n// call proc_Seq__FromArray__Update();\r\n// call lemma_unroll_fun_power2__FULL();\r\n// call lemma_fun_ensures_fun_power2();\r\n// call lemma_unroll_fun_BEDigitSeq__IntValue__FULL();\r\n// call lemma_unroll_fun_Seq__Length__FULL___bool();\r\n// call lemma_fun_ensures_fun_Seq__Length___bool();\r\n// call lemma_unroll_fun_Seq__Build__FULL___bool();\r\n// call lemma_unroll_fun_Seq__Index__FULL___bool();\r\n// call lemma_unroll_fun_Seq__Append__FULL___bool();\r\n// call lemma_unroll_fun_Seq__Update__FULL___bool();\r\n// call lemma_unroll_fun_Seq__Take__FULL___bool();\r\n// call lemma_unroll_fun_Seq__Drop__FULL___bool();\r\n// call proc_Seq__Empty__ToZero___bool();\r\n// call proc_Seq__Empty__FromZero___bool();\r\n// call proc_Seq__Singleton__Length___bool();\r\n// call proc_Seq__Build__Length___bool();\r\n// call proc_Seq__Build__Index___bool();\r\n// call proc_Seq__Append__Length___bool();\r\n// call proc_Seq__Index__Singleton___bool();\r\n// call proc_Seq__Append__Index___bool();\r\n// call proc_Seq__Update__Length___bool();\r\n// call proc_Seq__Index__Update___bool();\r\n// call proc_Seq__Equal__Equiv___bool();\r\n// call proc_Seq__Take__Length___bool();\r\n// call proc_Seq__Take__Index___bool();\r\n// call proc_Seq__Drop__Length___bool();\r\n// call proc_Seq__Drop__Index___bool();\r\n// call proc_Seq__Append__TakeDrop___bool();\r\n// call proc_Seq__Update__CommuteTake1___bool();\r\n// call proc_Seq__Update__CommuteTake2___bool();\r\n// call proc_Seq__Update__CommuteDrop1___bool();\r\n// call proc_Seq__Update__CommuteDrop2___bool();\r\n// call proc_Seq__Build__CommuteDrop___bool();\r\n// call proc_Seq__Take__Empty___bool();\r\n// call proc_Seq__Drop__Empty___bool();\r\n// call lemma_unroll_fun_SeqToInt__FULL();\r\n// call lemma_fun_ensures_fun_SeqToInt();\r\n// call lemma_unroll_fun_IntToSeq__FULL();\r\n// call lemma_fun_ensures_fun_IntToSeq();\r\n// call lemma_fun_ensures_fun_WordToSeq();\r\n// call lemma_fun_ensures_fun_word__to__bytes();\r\n// call lemma_unroll_fun_WordSeqToByteSeq__FULL();\r\n// call lemma_fun_ensures_fun_WordSeqToByteSeq();\r\n// call lemma_fun_ensures_fun_ByteSeqToWordSeq();\r\n// call lemma_unroll_fun_WordSeqToBits__FULL();\r\n// call lemma_fun_ensures_fun_WordSeqToBits();\r\n// call lemma_unroll_fun_WordSeqToNBits__FULL();\r\n// call lemma_fun_ensures_fun_WordSeqToNBits();\r\n// call lemma_fun_ensures_fun_ArrayToBitSequence();\r\n// call lemma_unroll_fun_SequenceOfFalses__FULL();\r\n// call lemma_fun_ensures_fun_SequenceOfFalses();\r\n// call lemma_unroll_fun_ByteToBoolSeqInner__FULL();\r\n// call lemma_fun_ensures_fun_ByteToBoolSeqInner();\r\n// call lemma_fun_ensures_fun_ByteToBoolSeq();\r\n// call lemma_unroll_fun_ByteSeqToBoolSeq__FULL();\r\n// call lemma_fun_ensures_fun_ByteSeqToBoolSeq();\r\n// call lemma_fun_ensures_fun_AddInstruction();\r\n// call lemma_fun_ensures_fun_SubInstruction();\r\n// call lemma_fun_ensures_fun_LeftShiftInstruction();\r\n// call lemma_fun_ensures_fun_RightShiftInstruction();\r\n// call lemma_fun_ensures_fun_RotateRightInstruction();\r\n// call lemma_fun_ensures_fun_RotateLeftInstruction();\r\n// call lemma_fun_ensures_fun_BitwiseNotInstruction();\r\n// call lemma_fun_ensures_fun_BitwiseAndInstruction();\r\n// call lemma_fun_ensures_fun_BitwiseOrInstruction();\r\n// call lemma_fun_ensures_fun_BitwiseXorInstruction();\r\n// call lemma_unroll_fun_power__FULL();\r\n// r := r_old;\r\n// stk := stk_old;\r\n// statics := statics_old;\r\n// io := io_old;\r\n// mems := mems_old;\r\n// $commonVars := $commonVars_old;\r\n// $gcVars := $gcVars_old;\r\n// $toAbs := $toAbs_old;\r\n// $absMem := $absMem_old;\r\n// $stacksFrames := $stacksFrames_old;\r\n// objLayouts := objLayouts_old;\r\n// heap := heap_old;\r\n// $ghost_bytes__abs := frameGet($stacksFrames, (core_old._regs)[ESP] + 4 + stackGcOffset);\r\n// assert TV(esp);\r\n// assert TO(0);\r\n// assert TO(768);\r\n// assert TO(1);\r\n// assert TO(769);\r\n//\r\n// // dummy method body for axiom\r\n// Return;\r\n//}\r\n\r\nimplementation Proc_debug__print(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_loc:int, $ghost_val:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap)\r\n{\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var mem_tmp:[int]int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems:= mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n assert TV(esp);\r\n assert TO(0);\r\n assert TO(768);\r\n assert TO(1);\r\n assert TO(769);\r\n assert TO(2);\r\n assert TO(770);\r\n\r\n\r\n //- Read arguments off the stack\r\n call ebx := Load(stk, esp + 4); //- loc\r\n call ecx := Load(stk, esp + 8); //- val\r\n\r\n ebp := ecx; //- Save a copy\r\n\r\n //- Assuming for now that loc (in ebx) is only 8 bits\r\n call reveal_IoInv(); //- Prove that serial port has been configured\r\n call serialDbgByteOut();\r\n\r\n //- Write out a space\r\n ecx := 32;\r\n call serialDbgDataOut8();\r\n\r\n //- Write out val\r\n esi := ebp;\r\n call serialDbgWordOut();\r\n call serialDbgNewlineOut();\r\n//- call Proc_SerialDbgWordOut();\r\n//- call Proc_SerialDbgNewlineOut();\r\n\r\n //- Re-read arguments off the stack\r\n call ebx := Load(stk, esp + 4); //- loc\r\n call ecx := Load(stk, esp + 8); //- val\r\n\r\n //- Write to the screen\r\n eax := ecx;\r\n edx := ebx;\r\n call writeHex();\r\n\r\n Return;\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/dafny_sha256opt2_i.imp.beat", "content": " //-private-import BaseSpec;\r\n //-private-import MemorySpec;\r\n //-private-import IoTypesSpec;\r\n //-private-import MachineStateSpec;\r\n //-private-import AssemblySpec;\r\n //-private-import InterruptsSpec;\r\n //-private-import IoSpec;\r\n //-private-import Overflow;\r\n //-private-import Core;\r\n //-private-import LogicalAddressing;\r\n //-private-import Util;\r\n //-private-import Stacks;\r\n //-private-import Partition;\r\n //-private-import Instructions;\r\n //-private-import Separation;\r\n //-private-import IntLemmasGc;\r\n //-private-import SimpleGcMemory;\r\n //-private-import SimpleCommon;\r\n //-private-import SimpleCollector;\r\n //-private-import IntLemmasMain;\r\n //-private-import IntLemmasBase;\r\n //-private-import IoMain;\r\n //-private-basmonly-import Trusted;\r\n //-private-basmonly-import Checked;\r\n //-private-import Heap;\r\n //-private-import Seq;\r\n //-private-import dafny_DafnyPrelude;\r\n //-private-import DafnyAssembly;\r\n //-private-import dafny_base_s;\r\n //-private-import dafny_power2_s;\r\n //-private-import dafny_bytes_and_words_s;\r\n //-private-import dafny_be_sequences_s;\r\n //-private-import dafny_assembly_s;\r\n //-private-import dafny_integer_sequences_s;\r\n //-private-import dafny_seq_blocking_s;\r\n //-private-import dafny_sha_common_s;\r\n //-private-import dafny_hmac_common_s;\r\n //-private-import dafny_sha256_s;\r\n //-private-import dafny_seqs_simple_i;\r\n //-private-import dafny_power_s;\r\n //-private-import dafny_mul_nonlinear_i;\r\n //-private-import dafny_mul_i;\r\n //-private-import dafny_power_i;\r\n //-private-import dafny_div_def_i;\r\n //-private-import dafny_div_boogie_i;\r\n //-private-import dafny_div_nonlinear_i;\r\n //-private-import dafny_div_i;\r\n //-private-import dafny_repeat_digit_i;\r\n //-private-import dafny_power2_i;\r\n //-private-import dafny_seqs_and_ints_i;\r\n //-private-import dafny_relational_s;\r\n //-private-import dafny_assembly_i;\r\n //-private-import dafny_arrays_i;\r\n //-private-import dafny_seqs_transforms_i;\r\n //-private-import dafny_seqs_reverse_i;\r\n //-private-import dafny_integer_sequences_i;\r\n //-private-import dafny_integer_sequences_premium_i;\r\n //-private-import dafny_assembly_premium_i;\r\n //-private-import dafny_bit_vector_lemmas_i;\r\n //-private-import dafny_bit_vector_lemmas_premium_i;\r\n //-private-import dafny_word_bits_i;\r\n //-private-import dafny_arrays_and_seqs_i;\r\n //-private-import dafny_round_s;\r\n //-private-import dafny_round_i;\r\n //-private-import dafny_seq_blocking_i;\r\n //-private-import dafny_sha_common_i;\r\n //-private-import dafny_sha_padding_i;\r\n //-private-import dafny_sha256common_i;\r\n //-private-import dafny_sha256opt_i;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\nmodule implementation dafny_sha256opt2_i\r\n{\r\n\r\nprocedure proc_ComputeOneStep__SHA256__optimized_A(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_M:ArrayOfInt, $ghost_words:int, $ghost_H:ArrayOfInt, $ghost_W:ArrayOfInt, $ghost_atoh:atoh_Type, $ghost_num_blocks:int, $ghost_a:int, $ghost_b:int, $ghost_c:int, $ghost_d:int, $ghost_e:int, $ghost_f:int, $ghost_g:int, $ghost_h:int, $ghost_z:SHA256Trace, $ghost_currentBlock:int, $ghost_currentStep:int, K:opn, Wopn:opn_mem, W_base:int, $ghost_W__abs:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_a_next:int, $ghost_b_next:int, $ghost_c_next:int, $ghost_d_next:int, $ghost_e_next:int, $ghost_f_next:int, $ghost_g_next:int, $ghost_h_next:int, $ghost_next_atoh:atoh_Type, $ghost_next_z:SHA256Trace)\r\n requires MemInv(me,init,stk_old,statics_old,core_state,ptMem,mems_old);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk_old,statics_old,core_state,ptMem,mems_old,$stacksFrames_old,io_old);\r\n //requires SMemRequireGcRA(stack_size__DafnyCC__Proc_ComputeOneStep__SHA256__optimized, 84, stk_old, r_old.regs[ESP], RET);\r\n requires SMemRequireGcRA(0, 76, stk_old, r_old.regs[ESP], RET);\r\n// requires SMemRequire(stack_size__DafnyCC__Proc_ComputeOneStep__SHA256__optimized, stk_old, r_old.regs[ESP]);\r\n// requires ?sLo + stack_size__DafnyCC__Proc_ComputeOneStep__SHA256__optimized <= r_old.regs[ESP];\r\n requires HeapInv($absMem_old, objLayouts_old, heap_old);\r\n requires (($ghost_words) == (stk_old.map[r_old.regs[ESP] + 36]));\r\n requires (($ghost_num_blocks) == (stk_old.map[r_old.regs[ESP] + 40]));\r\n //requires (($ghost_a) == (stk_old.map[r_old.regs[ESP] + 44]));\r\n requires $ghost_a == r_old.regs[EBP];\r\n requires (($ghost_b) == (stk_old.map[r_old.regs[ESP] + 48]));\r\n requires (($ghost_c) == (stk_old.map[r_old.regs[ESP] + 52]));\r\n requires (($ghost_d) == (stk_old.map[r_old.regs[ESP] + 56]));\r\n requires (($ghost_e) == (stk_old.map[r_old.regs[ESP] + 60]));\r\n requires (($ghost_f) == (stk_old.map[r_old.regs[ESP] + 64]));\r\n requires (($ghost_g) == (stk_old.map[r_old.regs[ESP] + 68]));\r\n requires (($ghost_h) == (stk_old.map[r_old.regs[ESP] + 72]));\r\n //requires (($ghost_currentBlock) == (stk_old.map[r_old.regs[ESP] + 76]));\r\n //requires (($ghost_currentStep) == (stk_old.map[r_old.regs[ESP] + 80]));\r\n\r\n requires EvalPtrOk(Wopn);\r\n requires EvalPtr(r_old, Wopn) == W_base + 4 * (2 + $ghost_currentStep);\r\n requires Wopn._ptr is MReg && Wopn._ptr._mreg == ESI;\r\n requires $ghost_W.arrAbs == $ghost_W__abs;\r\n requires HeapAbsData(heap_old, $ghost_W__abs) is Abs_ArrayOfInt;\r\n requires 0 <= $ghost_currentStep && $ghost_currentStep < HeapAbsData(heap_old, $ghost_W__abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, W_base, $ghost_W__abs);\r\n\r\n requires StackAbsSlot(heap_old, $stacksFrames_old, r_old.regs[ESP] + 4 + stackGcOffset) == Abs_ArrayOfInt($ghost_M);\r\n requires frameGet($stacksFrames_old, r_old.regs[ESP] + 4 + stackGcOffset) == $ghost_M.arrAbs;\r\n requires StackAbsSlot(heap_old, $stacksFrames_old, r_old.regs[ESP] + 8 + stackGcOffset) == Abs_ArrayOfInt($ghost_H);\r\n requires frameGet($stacksFrames_old, r_old.regs[ESP] + 8 + stackGcOffset) == $ghost_H.arrAbs;\r\n requires StackAbsSlot(heap_old, $stacksFrames_old, r_old.regs[ESP] + 12 + stackGcOffset) == Abs_ArrayOfInt($ghost_W);\r\n requires frameGet($stacksFrames_old, r_old.regs[ESP] + 12 + stackGcOffset) == $ghost_W.arrAbs;\r\n requires $ghost_H != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires $ghost_W != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires $ghost_M != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires $ghost_atoh == (atoh_c($ghost_a, $ghost_b, $ghost_c, $ghost_d, $ghost_e, $ghost_f, $ghost_g, $ghost_h));\r\n requires (INTERNAL_le_boogie(0, $ghost_words)) && (INTERNAL_le_boogie($ghost_words, (Arr_Length($ghost_M))));\r\n requires (INTERNAL_le_boogie(0, $ghost_currentBlock)) && (INTERNAL_lt_boogie($ghost_currentBlock, fun_Seq__Length___Seq___int((M#SHA256Trace_c($ghost_z)))));\r\n requires (INTERNAL_le_boogie(0, $ghost_currentStep)) && (INTERNAL_le_boogie($ghost_currentStep, 63));\r\n requires K is OConst && K._const == fun_K__SHA256($ghost_currentStep);\r\n requires fun_IsSHA256ReadyForStep($ghost_z, fun_SHA256__vars__to__state($absMem_old, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_atoh, $ghost_num_blocks), $ghost_currentBlock, $ghost_currentStep);\r\n modifies $Time;\r\n ensures r.regs[ESP] == old(r_old.regs[ESP]);\r\n ensures MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n //ensures SMemEnsureGcF(84, stk, old(stk_old), r.regs[ESP], old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n ensures r.regs[ESP] == old(r_old.regs[ESP]);\r\n ensures r.regs[ESI] == old(r_old.regs[ESI]);\r\n ensures stk[r.regs[ESP]] == old(stk_old)[r.regs[ESP]];\r\n ensures (forall i:int::{stk[i]} r.regs[ESP] + 76 <= i ==> stk[i] == old(stk_old)[i]);\r\n ensures (forall i:int::{$stacksFrames[$S].Abss[i]} r.regs[ESP] + 76 + stackGcOffset <= i ==> $stacksFrames[$S].Abss[i] == $stacksFrames_old[$S].Abss[i]);\r\n\r\n ensures HeapInv($absMem, objLayouts, heap);\r\n ensures AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n ensures (forall i:int::{$absMem[i]}{heap.absData[i]} heap_old.absData[i] is AbsNone || (heap.absData[i] == heap_old.absData[i] && ($absMem[i] == $absMem_old[i])));\r\n ensures io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n ensures fun_IsSHA256ReadyForStep($ghost_next_z, fun_SHA256__vars__to__state($absMem, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_next_atoh, $ghost_num_blocks), $ghost_currentBlock, INTERNAL_add_boogie($ghost_currentStep, 1));\r\n ensures fun_Seq__Equal___int(fun_Seq__FromArray($absMem, $ghost_H), old(fun_Seq__FromArray($absMem_old, $ghost_H)));\r\n ensures fun_Seq__Equal___int(fun_Seq__FromArray($absMem, $ghost_M), old(fun_Seq__FromArray($absMem_old, $ghost_M)));\r\n ensures fun_Seq__Equal___int(fun_Seq__FromArray($absMem, $ghost_W), old(fun_Seq__FromArray($absMem_old, $ghost_W)));\r\n ensures $ghost_next_atoh == (atoh_c($ghost_a_next, $ghost_b_next, $ghost_c_next, $ghost_d_next, $ghost_e_next, $ghost_f_next, $ghost_g_next, $ghost_h_next));\r\n //ensures (($ghost_a_next) == (stk.map[r_old.regs[ESP] + 4]));\r\n ensures $ghost_a_next == r.regs[EBP];\r\n ensures (($ghost_b_next) == (stk.map[r_old.regs[ESP] + 8]));\r\n ensures (($ghost_c_next) == (stk.map[r_old.regs[ESP] + 12]));\r\n ensures (($ghost_d_next) == (stk.map[r_old.regs[ESP] + 16]));\r\n ensures (($ghost_e_next) == (stk.map[r_old.regs[ESP] + 20]));\r\n ensures (($ghost_f_next) == (stk.map[r_old.regs[ESP] + 24]));\r\n ensures (($ghost_g_next) == (stk.map[r_old.regs[ESP] + 28]));\r\n ensures (($ghost_h_next) == (stk.map[r_old.regs[ESP] + 32]));\r\n\r\n //- Preserve calling requirements\r\n ensures (($ghost_words) == (stk.map[r.regs[ESP] + 36]));\r\n ensures (($ghost_num_blocks) == (stk.map[r.regs[ESP] + 40]));\r\n ensures HeapValue(objLayouts, true, $toAbs, W_base, $ghost_W__abs);\r\n ensures StackAbsSlot(heap, $stacksFrames, r.regs[ESP] + 4 + stackGcOffset) == Abs_ArrayOfInt($ghost_M);\r\n ensures frameGet($stacksFrames, r.regs[ESP] + 4 + stackGcOffset) == $ghost_M.arrAbs;\r\n ensures StackAbsSlot(heap, $stacksFrames, r.regs[ESP] + 8 + stackGcOffset) == Abs_ArrayOfInt($ghost_H);\r\n ensures frameGet($stacksFrames, r.regs[ESP] + 8 + stackGcOffset) == $ghost_H.arrAbs;\r\n ensures StackAbsSlot(heap, $stacksFrames, r.regs[ESP] + 12 + stackGcOffset) == Abs_ArrayOfInt($ghost_W);\r\n ensures frameGet($stacksFrames, r.regs[ESP] + 12 + stackGcOffset) == $ghost_W.arrAbs;\r\n{\r\n var t:opn_mem;\r\n var $result:int;\r\n var $result2:int;\r\n //- Lots of boilerplate follows\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var $ghost_s:SHA256_state;\r\n var $ghost_bsig0:int;\r\n var $ghost__temp__0:int;\r\n var $ghost__temp__1:int;\r\n var $ghost__temp__2:int;\r\n var $ghost__temp__3:int;\r\n var $ghost_bsig1:int;\r\n var $ghost__temp__4:int;\r\n var $ghost__temp__5:int;\r\n var $ghost__temp__6:int;\r\n var $ghost__temp__7:int;\r\n var $ghost_my_ch:int;\r\n var $ghost__temp__8:int;\r\n var $ghost__temp__9:int;\r\n var $ghost__temp__10:int;\r\n var $ghost_my_maj:int;\r\n var $ghost__temp__11:int;\r\n var $ghost__temp__12:int;\r\n var $ghost__temp__13:int;\r\n var $ghost__temp__14:int;\r\n var $ghost_T1:int;\r\n var $ghost__temp__15:int;\r\n var $ghost__temp__16:int;\r\n var $ghost__temp__17:int;\r\n var $ghost__temp__18:int;\r\n var $ghost__temp__19:int;\r\n var $ghost_T2:int;\r\n var $ghost_next_s:SHA256_state;\r\n var $ghost_M__abs:int;\r\n var $ghost_H__abs:int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___int();\r\n call lemma_fun_ensures_fun_Seq__Length___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___int();\r\n call proc_Seq__Empty__ToZero___int();\r\n call proc_Seq__Empty__FromZero___int();\r\n call proc_Seq__Singleton__Length___int();\r\n call proc_Seq__Build__Length___int();\r\n call proc_Seq__Build__Index___int();\r\n call proc_Seq__Append__Length___int();\r\n call proc_Seq__Index__Singleton___int();\r\n call proc_Seq__Append__Index___int();\r\n call proc_Seq__Update__Length___int();\r\n call proc_Seq__Index__Update___int();\r\n call proc_Seq__Equal__Equiv___int();\r\n call proc_Seq__Take__Length___int();\r\n call proc_Seq__Take__Index___int();\r\n call proc_Seq__Drop__Length___int();\r\n call proc_Seq__Drop__Index___int();\r\n call proc_Seq__Append__TakeDrop__Restricted___int();\r\n call proc_Seq__Update__CommuteTake1___int();\r\n call proc_Seq__Update__CommuteTake2___int();\r\n call proc_Seq__Update__CommuteDrop1___int();\r\n call proc_Seq__Update__CommuteDrop2___int();\r\n call proc_Seq__Build__CommuteDrop___int();\r\n call proc_Seq__Take__Empty___int();\r\n call proc_Seq__Drop__Empty___int();\r\n call lemma_unroll_fun_Seq__FromArrayRange();\r\n call proc_Seq__FromArray__Length();\r\n call proc_Seq__FromArray__Index();\r\n call proc_Seq__FromArray__Update();\r\n call lemma_unroll_rec_fun____HASH_power2__FULL();\r\n call lemma_unroll_fun____HASH_power2__FULL();\r\n call lemma_fun_ensures_fun_power2();\r\n call lemma_unroll_rec_fun____HASH_BEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_fun____HASH_BEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_rec_fun____HASH_BEIntToDigitSeq__private__FULL();\r\n call lemma_unroll_fun____HASH_BEIntToDigitSeq__private__FULL();\r\n call lemma_unroll_rec_fun_RepeatDigit();\r\n call lemma_unroll_fun_RepeatDigit();\r\n call lemma_unroll_rec_fun____HASH_Reverse__FULL();\r\n call lemma_unroll_fun____HASH_Reverse__FULL();\r\n call lemma_unroll_rec_fun____HASH_power__FULL();\r\n call lemma_unroll_fun____HASH_power__FULL();\r\n call lemma_unroll_rec_fun_mul__pos();\r\n call lemma_unroll_fun_mul__pos();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___bool();\r\n call lemma_fun_ensures_fun_Seq__Length___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___bool();\r\n call proc_Seq__Empty__ToZero___bool();\r\n call proc_Seq__Empty__FromZero___bool();\r\n call proc_Seq__Singleton__Length___bool();\r\n call proc_Seq__Build__Length___bool();\r\n call proc_Seq__Build__Index___bool();\r\n call proc_Seq__Append__Length___bool();\r\n call proc_Seq__Index__Singleton___bool();\r\n call proc_Seq__Append__Index___bool();\r\n call proc_Seq__Update__Length___bool();\r\n call proc_Seq__Index__Update___bool();\r\n call proc_Seq__Equal__Equiv___bool();\r\n call proc_Seq__Take__Length___bool();\r\n call proc_Seq__Take__Index___bool();\r\n call proc_Seq__Drop__Length___bool();\r\n call proc_Seq__Drop__Index___bool();\r\n call proc_Seq__Append__TakeDrop__Restricted___bool();\r\n call proc_Seq__Update__CommuteTake1___bool();\r\n call proc_Seq__Update__CommuteTake2___bool();\r\n call proc_Seq__Update__CommuteDrop1___bool();\r\n call proc_Seq__Update__CommuteDrop2___bool();\r\n call proc_Seq__Build__CommuteDrop___bool();\r\n call proc_Seq__Take__Empty___bool();\r\n call proc_Seq__Drop__Empty___bool();\r\n call lemma_unroll_rec_fun_my__div__pos();\r\n call lemma_unroll_fun_my__div__pos();\r\n call lemma_unroll_rec_fun_my__mod__recursive();\r\n call lemma_unroll_fun_my__mod__recursive();\r\n call lemma_fun_ensures_fun_RepeatDigit__premium();\r\n call lemma_unroll_rec_fun____HASH_SequenceOfZeros__FULL();\r\n call lemma_unroll_fun____HASH_SequenceOfZeros__FULL();\r\n call lemma_fun_ensures_fun_SequenceOfZeros();\r\n call lemma_fun_ensures_fun_BitwiseAnd();\r\n call lemma_fun_ensures_fun_BitwiseOr();\r\n call lemma_fun_ensures_fun_BitwiseNot();\r\n call lemma_fun_ensures_fun_BitwiseXor();\r\n call lemma_fun_ensures_fun_RotateRight();\r\n call lemma_fun_ensures_fun_RotateLeft();\r\n call lemma_fun_ensures_fun_RightShift();\r\n call lemma_fun_ensures_fun_LeftShift();\r\n call lemma_fun_ensures_fun_Add32();\r\n call lemma_fun_ensures_fun_Sub32();\r\n call lemma_fun_ensures_fun_Mul32();\r\n call lemma_fun_ensures_fun_Div32();\r\n call lemma_fun_ensures_fun_Mod32();\r\n call lemma_unroll_rec_fun____HASH_NatNumBits__FULL();\r\n call lemma_unroll_fun____HASH_NatNumBits__FULL();\r\n call lemma_fun_ensures_fun_NatNumBits();\r\n call lemma_fun_ensures_fun_asm__Add();\r\n call lemma_fun_ensures_fun_asm__Sub();\r\n call lemma_fun_ensures_fun_asm__Mul();\r\n call lemma_fun_ensures_fun_asm__Div();\r\n call lemma_fun_ensures_fun_asm__Mod();\r\n call lemma_fun_ensures_fun_asm__LeftShift();\r\n call lemma_fun_ensures_fun_asm__RightShift();\r\n call lemma_fun_ensures_fun_asm__RotateLeft();\r\n call lemma_fun_ensures_fun_asm__RotateRight();\r\n call lemma_fun_ensures_fun_asm__BitwiseNot();\r\n call lemma_fun_ensures_fun_asm__BitwiseAnd();\r\n call lemma_fun_ensures_fun_asm__BitwiseOr();\r\n call lemma_fun_ensures_fun_asm__BitwiseXor();\r\n call lemma_unroll_rec_fun____HASH_LEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_fun____HASH_LEDigitSeqToInt__private__FULL();\r\n call lemma_fun_ensures_fun_BEDigitSeqToInt__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToInt__premium();\r\n call lemma_fun_ensures_fun_BEIntToDigitSeq__premium();\r\n call lemma_fun_ensures_fun_BEIntToByteSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordToFourBytes__premium();\r\n call lemma_fun_ensures_fun_BEWordToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEByteSeqToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToByteSeq__premium();\r\n call lemma_fun_ensures_fun_Asm__Add();\r\n call lemma_fun_ensures_fun_Asm__Sub();\r\n call lemma_fun_ensures_fun_Asm__Mul();\r\n call lemma_fun_ensures_fun_Asm__Div();\r\n call lemma_fun_ensures_fun_Asm__Mod();\r\n call lemma_fun_ensures_fun_Asm__LeftShift();\r\n call lemma_fun_ensures_fun_Asm__RightShift();\r\n call lemma_fun_ensures_fun_Asm__RotateLeft();\r\n call lemma_fun_ensures_fun_Asm__RotateRight();\r\n call lemma_fun_ensures_fun_Asm__BitwiseNot();\r\n call lemma_fun_ensures_fun_Asm__BitwiseAnd();\r\n call lemma_fun_ensures_fun_Asm__BitwiseOr();\r\n call lemma_fun_ensures_fun_Asm__BitwiseXor();\r\n call lemma_fun_ensures_fun_ComputePower2();\r\n call lemma_fun_ensures_fun_ComputePower2Minus1__mostly();\r\n call lemma_fun_ensures_fun_ComputePower2Minus1();\r\n call lemma_fun_ensures_fun_GetWordBit();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___Seq___int();\r\n call lemma_fun_ensures_fun_Seq__Length___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___Seq___int();\r\n call proc_Seq__Empty__ToZero___Seq___int();\r\n call proc_Seq__Empty__FromZero___Seq___int();\r\n call proc_Seq__Singleton__Length___Seq___int();\r\n call proc_Seq__Build__Length___Seq___int();\r\n call proc_Seq__Build__Index___Seq___int();\r\n call proc_Seq__Append__Length___Seq___int();\r\n call proc_Seq__Index__Singleton___Seq___int();\r\n call proc_Seq__Append__Index___Seq___int();\r\n call proc_Seq__Update__Length___Seq___int();\r\n call proc_Seq__Index__Update___Seq___int();\r\n call proc_Seq__Equal__Equiv___Seq___int();\r\n call proc_Seq__Take__Length___Seq___int();\r\n call proc_Seq__Take__Index___Seq___int();\r\n call proc_Seq__Drop__Length___Seq___int();\r\n call proc_Seq__Drop__Index___Seq___int();\r\n call proc_Seq__Append__TakeDrop__Restricted___Seq___int();\r\n call proc_Seq__Update__CommuteTake1___Seq___int();\r\n call proc_Seq__Update__CommuteTake2___Seq___int();\r\n call proc_Seq__Update__CommuteDrop1___Seq___int();\r\n call proc_Seq__Update__CommuteDrop2___Seq___int();\r\n call proc_Seq__Build__CommuteDrop___Seq___int();\r\n call proc_Seq__Take__Empty___Seq___int();\r\n call proc_Seq__Drop__Empty___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_BreakIntoBlocks__FULL();\r\n call lemma_unroll_fun____HASH_BreakIntoBlocks__FULL();\r\n call lemma_fun_ensures_fun____HASH_Ch__FULL();\r\n call lemma_fun_ensures_fun_Ch();\r\n call lemma_fun_ensures_fun____HASH_Maj__FULL();\r\n call lemma_fun_ensures_fun_Maj();\r\n call lemma_fun_ensures_fun____HASH_Parity__FULL();\r\n call lemma_fun_ensures_fun_Parity();\r\n call lemma_fun_ensures_fun____HASH_ft__FULL();\r\n call lemma_fun_ensures_fun_ft();\r\n call lemma_fun_ensures_fun____HASH_BSIG0__FULL();\r\n call lemma_fun_ensures_fun_BSIG0();\r\n call lemma_fun_ensures_fun____HASH_BSIG1__FULL();\r\n call lemma_fun_ensures_fun_BSIG1();\r\n call lemma_fun_ensures_fun____HASH_SSIG0__FULL();\r\n call lemma_fun_ensures_fun_SSIG0();\r\n call lemma_fun_ensures_fun____HASH_SSIG1__FULL();\r\n call lemma_fun_ensures_fun_SSIG1();\r\n call lemma_fun_ensures_fun____HASH_NumPaddingZeroes__FULL();\r\n call lemma_fun_ensures_fun_NumPaddingZeroes();\r\n call lemma_unroll_rec_fun____HASH_SeqXor__FULL();\r\n call lemma_unroll_fun____HASH_SeqXor__FULL();\r\n call lemma_unroll_rec_fun____HASH_ConstPad__FULL();\r\n call lemma_unroll_fun____HASH_ConstPad__FULL();\r\n call lemma_fun_ensures_fun____HASH_GetArrayBit__FULL();\r\n call lemma_fun_ensures_fun_GetArrayBit();\r\n call lemma_fun_ensures_fun_DivideRoundingUp__premium();\r\n call lemma_fun_ensures_fun_RoundUpToMultiple__premium();\r\n call lemma_fun_ensures_fun_PadSequenceToMultiple__premium();\r\n call lemma_fun_ensures_fun_PadAndBreakIntoBlocks__premium();\r\n call lemma_fun_ensures_fun_Ch__impl();\r\n call lemma_fun_ensures_fun_Maj__impl();\r\n call lemma_fun_ensures_fun_Parity__impl();\r\n call lemma_fun_ensures_fun_ft__impl();\r\n call lemma_fun_ensures_fun_BSIG0__impl();\r\n call lemma_fun_ensures_fun_BSIG1__impl();\r\n call lemma_fun_ensures_fun_SSIG0__impl();\r\n call lemma_fun_ensures_fun_SSIG1__impl();\r\n call lemma_fun_ensures_fun_PadMessageForSHA__premium();\r\n call lemma_fun_ensures_fun____HASH_GetArrayBitOpaque__FULL();\r\n call lemma_fun_ensures_fun_GetArrayBitOpaque();\r\n call lemma_fun_ensures_fun____HASH_K__SHA256__FULL();\r\n call lemma_fun_ensures_fun_K__SHA256();\r\n call lemma_fun_ensures_fun____HASH_InitialH__SHA256__FULL();\r\n call lemma_fun_ensures_fun_InitialH__SHA256();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___atoh_Type();\r\n call lemma_fun_ensures_fun_Seq__Length___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___atoh_Type();\r\n call proc_Seq__Empty__ToZero___atoh_Type();\r\n call proc_Seq__Empty__FromZero___atoh_Type();\r\n call proc_Seq__Singleton__Length___atoh_Type();\r\n call proc_Seq__Build__Length___atoh_Type();\r\n call proc_Seq__Build__Index___atoh_Type();\r\n call proc_Seq__Append__Length___atoh_Type();\r\n call proc_Seq__Index__Singleton___atoh_Type();\r\n call proc_Seq__Append__Index___atoh_Type();\r\n call proc_Seq__Update__Length___atoh_Type();\r\n call proc_Seq__Index__Update___atoh_Type();\r\n call proc_Seq__Equal__Equiv___atoh_Type();\r\n call proc_Seq__Take__Length___atoh_Type();\r\n call proc_Seq__Take__Index___atoh_Type();\r\n call proc_Seq__Drop__Length___atoh_Type();\r\n call proc_Seq__Drop__Index___atoh_Type();\r\n call proc_Seq__Append__TakeDrop__Restricted___atoh_Type();\r\n call proc_Seq__Update__CommuteTake1___atoh_Type();\r\n call proc_Seq__Update__CommuteTake2___atoh_Type();\r\n call proc_Seq__Update__CommuteDrop1___atoh_Type();\r\n call proc_Seq__Update__CommuteDrop2___atoh_Type();\r\n call proc_Seq__Build__CommuteDrop___atoh_Type();\r\n call proc_Seq__Take__Empty___atoh_Type();\r\n call proc_Seq__Drop__Empty___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___Seq___atoh_Type();\r\n call lemma_fun_ensures_fun_Seq__Length___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___Seq___atoh_Type();\r\n call proc_Seq__Empty__ToZero___Seq___atoh_Type();\r\n call proc_Seq__Empty__FromZero___Seq___atoh_Type();\r\n call proc_Seq__Singleton__Length___Seq___atoh_Type();\r\n call proc_Seq__Build__Length___Seq___atoh_Type();\r\n call proc_Seq__Build__Index___Seq___atoh_Type();\r\n call proc_Seq__Append__Length___Seq___atoh_Type();\r\n call proc_Seq__Index__Singleton___Seq___atoh_Type();\r\n call proc_Seq__Append__Index___Seq___atoh_Type();\r\n call proc_Seq__Update__Length___Seq___atoh_Type();\r\n call proc_Seq__Index__Update___Seq___atoh_Type();\r\n call proc_Seq__Equal__Equiv___Seq___atoh_Type();\r\n call proc_Seq__Take__Length___Seq___atoh_Type();\r\n call proc_Seq__Take__Index___Seq___atoh_Type();\r\n call proc_Seq__Drop__Length___Seq___atoh_Type();\r\n call proc_Seq__Drop__Index___Seq___atoh_Type();\r\n call proc_Seq__Append__TakeDrop__Restricted___Seq___atoh_Type();\r\n call proc_Seq__Update__CommuteTake1___Seq___atoh_Type();\r\n call proc_Seq__Update__CommuteTake2___Seq___atoh_Type();\r\n call proc_Seq__Update__CommuteDrop1___Seq___atoh_Type();\r\n call proc_Seq__Update__CommuteDrop2___Seq___atoh_Type();\r\n call proc_Seq__Build__CommuteDrop___Seq___atoh_Type();\r\n call proc_Seq__Take__Empty___Seq___atoh_Type();\r\n call proc_Seq__Drop__Empty___Seq___atoh_Type();\r\n call lemma_fun_ensures_fun_SHA256();\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n $ghost_M__abs := frameGet($stacksFrames, r_old.regs[ESP] + 4 + stackGcOffset);\r\n $ghost_H__abs := frameGet($stacksFrames, r_old.regs[ESP] + 8 + stackGcOffset);\r\n assert TV(r.regs[ESP]);\r\n assert TO(0 - 1);\r\n assert TO(279552 - 1);\r\n assert TO(0 - 2);\r\n assert TO(279552 - 2);\r\n assert TO(0);\r\n assert TO(279552);\r\n assert TO(1);\r\n assert TO(279553);\r\n assert TO(2);\r\n assert TO(279554);\r\n assert TO(3);\r\n assert TO(279555);\r\n assert TO(4);\r\n assert TO(279556);\r\n assert TO(5);\r\n assert TO(279557);\r\n assert TO(6);\r\n assert TO(279558);\r\n assert TO(7);\r\n assert TO(279559);\r\n assert TO(8);\r\n assert TO(279560);\r\n assert TO(9);\r\n assert TO(279561);\r\n assert TO(10);\r\n assert TO(279562);\r\n assert TO(11);\r\n assert TO(279563);\r\n assert TO(12);\r\n assert TO(279564);\r\n assert TO(13);\r\n assert TO(279565);\r\n assert TO(14);\r\n assert TO(279566);\r\n assert TO(15);\r\n assert TO(279567);\r\n assert TO(16);\r\n assert TO(279568);\r\n assert TO(17);\r\n assert TO(279569);\r\n assert TO(18);\r\n assert TO(279570);\r\n assert TO(19);\r\n assert TO(279571);\r\n assert TO(20);\r\n assert TO(279572);\r\n assert TO(21);\r\n\r\n call proc_lemma__2toX();\r\n call proc_lemma__word32__Word32();\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt2.i.dfy: 38\r\n $ghost_s := fun_SHA256__vars__to__state($absMem, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_atoh, $ghost_num_blocks);\r\n\r\n// assert Aligned(esp);\r\n// // Prove that we can load arguments from the stack (b/c accesses are aligned)\r\n// assert TV(esp) && TO(0) && TO(1) && TO(2) && TO(3) && TO(4) && TO(5);\r\n//\r\n// // Prove that we can load arguments from the GC stack (b/c accesses are aligned)\r\n// assert TO(0x44401) && TO(0x44402) && TO(0x44403); // (gcStackOffset + {4,8,12}) / 4\r\n\r\n\r\n // Calculate my_maj\r\n//t := OMem(MReg(ESP, 44));\r\n//assert EvalPtrOk(t);\r\n//assert stk.dom[EvalPtr(r, t)];\r\n//assert Aligned(EvalPtr(r, t));\r\n//assert PhysPtrOk(stk, EvalPtr(r, t));\r\n//assert word(EvalPtr(r, t));\r\n//\r\n //call eax := Load(stk, esp + 44); // grab a\r\n //assert eax == $ghost_a;\r\n assert ebp == $ghost_a;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 8)), OReg(EBP)); // b_next <- a\r\n call ebx := Load(stk, esp + 48); // grab b\r\n assert ebx == $ghost_b;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 12)), OReg(EBX)); // c_next <- b\r\n call ecx := Load(stk, esp + 52); // grab c\r\n assert ecx == $ghost_c;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 16)), OReg(ECX)); // d_next <- c\r\n\r\n edx := ebx; // Store a copy of b\r\n call r, $result := proc_Asm__BitwiseAnd(r, $ghost_b, $ghost_a, EBX, OReg(EBP));\r\n call proc_lemma__bitwise__and__commutative($ghost_b, $ghost_a);\r\n assert fun_Asm__BitwiseAnd($ghost_b, $ghost_a) == fun_Asm__BitwiseAnd($ghost_a, $ghost_b);\r\n call r, $result := proc_Asm__BitwiseAnd(r, $ghost_b, $ghost_c, EDX, OReg(ECX)); \r\n call r, $result := proc_Asm__BitwiseAnd(r, $ghost_c, $ghost_a, ECX, OReg(EBP)); \r\n call proc_lemma__bitwise__and__commutative($ghost_c, $ghost_a);\r\n assert fun_Asm__BitwiseAnd($ghost_c, $ghost_a) == fun_Asm__BitwiseAnd($ghost_a, $ghost_c);\r\n \r\n call r, $result := proc_Asm__BitwiseXor(r, fun_Asm__BitwiseAnd($ghost_b, $ghost_a), fun_Asm__BitwiseAnd($ghost_c, $ghost_a), EBX, OReg(ECX));\r\n call r, $ghost_my_maj := proc_Asm__BitwiseXor(r, $result, fun_Asm__BitwiseAnd($ghost_b, $ghost_c), EBX, OReg(EDX));\r\n\r\n forall::($ghost_my_maj == (fun_Maj($ghost_a, $ghost_b, $ghost_c)))\r\n {\r\n call proc_reveal__Maj();\r\n }\r\n\r\n // At this point, ebp == a, ebx == my_maj\r\n assert ebp == $ghost_a;\r\n assert ebx == fun_Maj($ghost_a, $ghost_b, $ghost_c);\r\n\r\n // Calculate bsig0\r\n ecx := ebp;\r\n edx := ebp;\r\n call r, $result := proc_Asm__RotateRight(r, $ghost_a, 2, EBP, OConst(2));\r\n call r, $result := proc_Asm__RotateRight(r, $ghost_a, 13, ECX, OConst(13));\r\n call r, $result := proc_Asm__BitwiseXor(r, fun_Asm__RotateRight($ghost_a, 2), fun_Asm__RotateRight($ghost_a, 13), EBP, OReg(ECX));\r\n call r, $result2 := proc_Asm__RotateRight(r, $ghost_a, 22, EDX, OConst(22));\r\n call r, $ghost_bsig0 := proc_Asm__BitwiseXor(r, $result, fun_Asm__RotateRight($ghost_a, 22), EBP, OReg(EDX));\r\n\r\n forall::($ghost_bsig0 == (fun_BSIG0($ghost_a)))\r\n {\r\n call proc_reveal__BSIG0();\r\n }\r\n assert ebp == fun_BSIG0($ghost_a);\r\n\r\n call r, $ghost_T2 := proc_Asm__Add(r, $ghost_bsig0, $ghost_my_maj, EBP, OReg(EBX));\r\n assert ebp == $ghost_T2;\r\n\r\n //- Calculate my_ch\r\n call ebx := Load(stk, esp + 60); //- grab e\r\n assert ebx == $ghost_e;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 24)), OReg(EBX)); //- f_next <- e\r\n edx := ebx;\r\n call r, $result := proc_Asm__BitwiseNot(r, $ghost_e, EDX);\r\n call ecx := Load(stk, esp + 68); //- grab g\r\n assert ecx == $ghost_g;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 32)), OReg(ECX)); //- h_next <- g\r\n call r, $result := proc_Asm__BitwiseAnd(r, $result, $ghost_g, EDX, OReg(ECX)); //- !e & g\r\n assert edx == fun_Asm__BitwiseAnd(fun_Asm__BitwiseNot($ghost_e), $ghost_g);\r\n call ecx := Load(stk, esp + 64); //- grab f\r\n assert ecx == $ghost_f;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 28)), OReg(ECX)); //- g_next <- f\r\n call r, $result2 := proc_Asm__BitwiseAnd(r, $ghost_f, $ghost_e, ECX, OReg(EBX));\r\n call proc_lemma__bitwise__and__commutative($ghost_f, $ghost_e);\r\n assert fun_Asm__BitwiseAnd($ghost_f, $ghost_e) == fun_Asm__BitwiseAnd($ghost_e, $ghost_f);\r\n call r, $ghost_my_ch := proc_Asm__BitwiseXor(r, $result2, $result, ECX, OReg(EDX));\r\n\r\n forall::($ghost_my_ch == (fun_Ch($ghost_e, $ghost_f, $ghost_g)))\r\n {\r\n call proc_reveal__Ch();\r\n }\r\n //- Summary:\r\n assert ebp == $ghost_T2;\r\n assert ebx == $ghost_e;\r\n assert ecx == fun_Ch($ghost_e, $ghost_f, $ghost_g);\r\n\r\n //- Calculate bsig1\r\n edx := ebx;\r\n edi := ebx;\r\n call r, $result := proc_Asm__RotateRight(r, $ghost_e, 6, EDX, OConst(6));\r\n call r, $result2 := proc_Asm__RotateRight(r, $ghost_e, 11, EDI, OConst(11));\r\n call r, $result := proc_Asm__BitwiseXor(r, $result, $result2, EDX, OReg(EDI));\r\n call r, $result2 := proc_Asm__RotateRight(r, $ghost_e, 25, EBX, OConst(25));\r\n call r, $ghost_bsig1 := proc_Asm__BitwiseXor(r, $result, $result2, EDX, OReg(EBX));\r\n\r\n forall::($ghost_bsig1 == (fun_BSIG1($ghost_e)))\r\n {\r\n call proc_reveal__BSIG1();\r\n }\r\n //- Summary:\r\n assert ebp == $ghost_T2;\r\n assert ecx == fun_Ch($ghost_e, $ghost_f, $ghost_g);\r\n assert edx == fun_BSIG1($ghost_e);\r\n\r\n call ebx := Load(stk, esp + 72); //- grab h\r\n assert ebx == $ghost_h;\r\n\r\n call r, $result := proc_Asm__Add(r, $ghost_h, fun_BSIG1($ghost_e), EBX, OReg(EDX));\r\n call r, $result := proc_Asm__Add(r, $result, fun_Ch($ghost_e, $ghost_f, $ghost_g), EBX, OReg(ECX));\r\n\r\n call r, $result := proc_Asm__Add(r, $result, Eval(r,K), EBX, K);\r\n assert Eval(r,K) == fun_K__SHA256($ghost_currentStep);\r\n\r\n //- Load the value we want from W\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EDX, Wopn, $ghost_currentStep, $ghost_W__abs, W_base);\r\n $ghost__temp__19 := r.regs[EDX];\r\n\r\n call r, $ghost_T1 := proc_Asm__Add(r, $result, edx, EBX, OReg(EDX)); \r\n assert ebp == $ghost_T2;\r\n assert ebx == $ghost_T1;\r\n\r\n call r, $result := proc_Asm__Add(r, ebp, ebx, EBP, OReg(EBX)); //- a_next <- T2 + T1\r\n assert ebp == fun_Asm__Add($ghost_T1, $ghost_T2);\r\n //call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 4)), OReg(EAX)); \r\n\r\n call eax := Load(stk, esp + 56); //- grab d\r\n assert eax == $ghost_d;\r\n call r, $result := proc_Asm__Add(r, eax, ebx, EAX, OReg(EBX)); //- e_next <- d + T1\r\n assert eax == fun_Asm__Add((d#atoh_c($ghost_atoh)), $ghost_T1);\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 20)), OReg(EAX)); \r\n\r\n\r\n //- Ghost proofs of correctness\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt2.i.dfy: 68\r\n $ghost_next_atoh := atoh_c(fun_Asm__Add($ghost_T1, $ghost_T2), (a#atoh_c($ghost_atoh)), (b#atoh_c($ghost_atoh)), (c#atoh_c($ghost_atoh)), fun_Asm__Add((d#atoh_c($ghost_atoh)), $ghost_T1), (e#atoh_c($ghost_atoh)), (f#atoh_c($ghost_atoh)), (g#atoh_c($ghost_atoh)));\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt2.i.dfy: 69\r\n $ghost_next_z := SHA256Trace_c((M#SHA256Trace_c($ghost_z)), (H#SHA256Trace_c($ghost_z)), (W#SHA256Trace_c($ghost_z)), fun_Seq__Append___Seq___atoh_Type(fun_Seq__Take___Seq___atoh_Type((atoh#SHA256Trace_c($ghost_z)), $ghost_currentBlock), fun_Seq__Build___Seq___atoh_Type(fun_Seq__Empty___Seq___atoh_Type(), fun_Seq__Append___atoh_Type(fun_Seq__Index___Seq___atoh_Type((atoh#SHA256Trace_c($ghost_z)), $ghost_currentBlock), fun_Seq__Build___atoh_Type(fun_Seq__Empty___atoh_Type(), $ghost_next_atoh)))));\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt2.i.dfy: 70\r\n $ghost_next_s := fun_SHA256__vars__to__state($absMem, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_next_atoh, $ghost_num_blocks);\r\n\r\n// assert fun_AreSHA256TraceAndStateOK($ghost_z, $ghost_s);\r\n// assert fun_Seq__Length___Seq___int((H#SHA256Trace_c($ghost_z))) == INTERNAL_add_boogie($ghost_currentBlock, 1);\r\n// assert fun_Seq__Length___Seq___int((W#SHA256Trace_c($ghost_z))) == INTERNAL_add_boogie($ghost_currentBlock, 1);\r\n// assert fun_Seq__Length___Seq___atoh_Type(atoh#SHA256Trace_c($ghost_z)) == INTERNAL_add_boogie($ghost_currentBlock, 1);\r\n// assert (forall $ghost__1_blk:int :: \r\n// (INTERNAL_le_boogie(0, $ghost__1_blk) && INTERNAL_lt_boogie($ghost__1_blk, $ghost_currentBlock)) ==> \r\n// (fun_IsAToHWordSeqOfLen(fun_Seq__Index___Seq___atoh_Type(atoh#SHA256Trace_c($ghost_z), $ghost__1_blk), 65)));\r\n// assert fun_IsAToHWordSeqOfLen(fun_Seq__Index___Seq___atoh_Type(atoh#SHA256Trace_c($ghost_z), $ghost_currentBlock), INTERNAL_add_boogie($ghost_currentStep, 1));\r\n// assert fun_Seq__Equal___int(H#SHA256_state_c($ghost_s), fun_Seq__Index___Seq___int(H#SHA256Trace_c($ghost_z), $ghost_currentBlock));\r\n// assert fun_Seq__Equal___int(W#SHA256_state_c($ghost_s), fun_Seq__Index___Seq___int(W#SHA256Trace_c($ghost_z), $ghost_currentBlock));\r\n// assert atoh#SHA256_state_c($ghost_s) == fun_Seq__Index___atoh_Type(fun_Seq__Index___Seq___atoh_Type(atoh#SHA256Trace_c($ghost_z), $ghost_currentBlock), $ghost_currentStep);\r\n assert fun_IsSHA256ReadyForStep($ghost_z, $ghost_s, $ghost_currentBlock, $ghost_currentStep);\r\n\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt2.i.dfy: 72\r\n // call:: := proc_lemma__SHA256TransitionOKAfterSettingAtoH($ghost_z, $ghost_s, $ghost_next_z, $ghost_next_s, $ghost_currentBlock, $ghost_currentStep) // isGhost = True\r\n call proc_lemma__SHA256TransitionOKAfterSettingAtoH($ghost_z, $ghost_s, $ghost_next_z, $ghost_next_s, $ghost_currentBlock, $ghost_currentStep);\r\n\r\n //- Update ghost outputs\r\n $ghost_a_next := fun_Asm__Add($ghost_T1, $ghost_T2);\r\n $ghost_b_next := a#atoh_c($ghost_atoh);\r\n $ghost_c_next := b#atoh_c($ghost_atoh);\r\n $ghost_d_next := c#atoh_c($ghost_atoh);\r\n $ghost_e_next := fun_Asm__Add((d#atoh_c($ghost_atoh)), $ghost_T1);\r\n $ghost_f_next := e#atoh_c($ghost_atoh);\r\n $ghost_g_next := f#atoh_c($ghost_atoh);\r\n $ghost_h_next := g#atoh_c($ghost_atoh);\r\n\r\n //Return;\r\n}\r\n\r\nprocedure proc_ComputeOneStep__SHA256__optimized_B(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_M:ArrayOfInt, $ghost_words:int, $ghost_H:ArrayOfInt, $ghost_W:ArrayOfInt, $ghost_atoh:atoh_Type, $ghost_num_blocks:int, $ghost_a:int, $ghost_b:int, $ghost_c:int, $ghost_d:int, $ghost_e:int, $ghost_f:int, $ghost_g:int, $ghost_h:int, $ghost_z:SHA256Trace, $ghost_currentBlock:int, $ghost_currentStep:int, K:opn, Wopn:opn_mem, W_base:int, $ghost_W__abs:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_a_next:int, $ghost_b_next:int, $ghost_c_next:int, $ghost_d_next:int, $ghost_e_next:int, $ghost_f_next:int, $ghost_g_next:int, $ghost_h_next:int, $ghost_next_atoh:atoh_Type, $ghost_next_z:SHA256Trace)\r\n requires MemInv(me,init,stk_old,statics_old,core_state,ptMem,mems_old);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk_old,statics_old,core_state,ptMem,mems_old,$stacksFrames_old,io_old);\r\n //requires SMemRequireGcRA(stack_size__DafnyCC__Proc_ComputeOneStep__SHA256__optimized, 84, stk_old, r_old.regs[ESP], RET);\r\n requires SMemRequireGcRA(0, 76, stk_old, r_old.regs[ESP], RET);\r\n// requires SMemRequire(stack_size__DafnyCC__Proc_ComputeOneStep__SHA256__optimized, stk_old, r_old.regs[ESP]);\r\n// requires ?sLo + stack_size__DafnyCC__Proc_ComputeOneStep__SHA256__optimized <= r_old.regs[ESP];\r\n requires HeapInv($absMem_old, objLayouts_old, heap_old);\r\n requires (($ghost_words) == (stk_old.map[r_old.regs[ESP] + 36]));\r\n requires (($ghost_num_blocks) == (stk_old.map[r_old.regs[ESP] + 40]));\r\n //requires (($ghost_a) == (stk_old.map[r_old.regs[ESP] + 44]));\r\n requires $ghost_a == r_old.regs[EBP];\r\n requires (($ghost_b) == (stk_old.map[r_old.regs[ESP] + 8]));\r\n requires (($ghost_c) == (stk_old.map[r_old.regs[ESP] + 12]));\r\n requires (($ghost_d) == (stk_old.map[r_old.regs[ESP] + 16]));\r\n requires (($ghost_e) == (stk_old.map[r_old.regs[ESP] + 20]));\r\n requires (($ghost_f) == (stk_old.map[r_old.regs[ESP] + 24]));\r\n requires (($ghost_g) == (stk_old.map[r_old.regs[ESP] + 28]));\r\n requires (($ghost_h) == (stk_old.map[r_old.regs[ESP] + 32]));\r\n //requires (($ghost_currentBlock) == (stk_old.map[r_old.regs[ESP] + 76]));\r\n //requires (($ghost_currentStep) == (stk_old.map[r_old.regs[ESP] + 80]));\r\n\r\n requires EvalPtrOk(Wopn);\r\n requires EvalPtr(r_old, Wopn) == W_base + 4 * (2 + $ghost_currentStep);\r\n requires Wopn._ptr is MReg && Wopn._ptr._mreg == ESI;\r\n requires $ghost_W.arrAbs == $ghost_W__abs;\r\n requires HeapAbsData(heap_old, $ghost_W__abs) is Abs_ArrayOfInt;\r\n requires 0 <= $ghost_currentStep && $ghost_currentStep < HeapAbsData(heap_old, $ghost_W__abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, W_base, $ghost_W__abs);\r\n\r\n requires StackAbsSlot(heap_old, $stacksFrames_old, r_old.regs[ESP] + 4 + stackGcOffset) == Abs_ArrayOfInt($ghost_M);\r\n requires frameGet($stacksFrames_old, r_old.regs[ESP] + 4 + stackGcOffset) == $ghost_M.arrAbs;\r\n requires StackAbsSlot(heap_old, $stacksFrames_old, r_old.regs[ESP] + 8 + stackGcOffset) == Abs_ArrayOfInt($ghost_H);\r\n requires frameGet($stacksFrames_old, r_old.regs[ESP] + 8 + stackGcOffset) == $ghost_H.arrAbs;\r\n requires StackAbsSlot(heap_old, $stacksFrames_old, r_old.regs[ESP] + 12 + stackGcOffset) == Abs_ArrayOfInt($ghost_W);\r\n requires frameGet($stacksFrames_old, r_old.regs[ESP] + 12 + stackGcOffset) == $ghost_W.arrAbs;\r\n requires $ghost_H != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires $ghost_W != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires $ghost_M != (ArrayOfInt(0 - 1, NO_ABS));\r\n requires $ghost_atoh == (atoh_c($ghost_a, $ghost_b, $ghost_c, $ghost_d, $ghost_e, $ghost_f, $ghost_g, $ghost_h));\r\n requires (INTERNAL_le_boogie(0, $ghost_words)) && (INTERNAL_le_boogie($ghost_words, (Arr_Length($ghost_M))));\r\n requires (INTERNAL_le_boogie(0, $ghost_currentBlock)) && (INTERNAL_lt_boogie($ghost_currentBlock, fun_Seq__Length___Seq___int((M#SHA256Trace_c($ghost_z)))));\r\n requires (INTERNAL_le_boogie(0, $ghost_currentStep)) && (INTERNAL_le_boogie($ghost_currentStep, 63));\r\n requires K is OConst && K._const == fun_K__SHA256($ghost_currentStep);\r\n requires fun_IsSHA256ReadyForStep($ghost_z, fun_SHA256__vars__to__state($absMem_old, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_atoh, $ghost_num_blocks), $ghost_currentBlock, $ghost_currentStep);\r\n modifies $Time;\r\n ensures r.regs[ESP] == old(r_old.regs[ESP]);\r\n ensures MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n //ensures SMemEnsureGcF(84, stk, old(stk_old), r.regs[ESP], old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n ensures r.regs[ESP] == old(r_old.regs[ESP]);\r\n ensures r.regs[ESI] == old(r_old.regs[ESI]);\r\n ensures stk[r.regs[ESP]] == old(stk_old)[r.regs[ESP]];\r\n ensures (forall i:int::{stk[i]} r.regs[ESP] + 76 <= i ==> stk[i] == old(stk_old)[i]);\r\n ensures (forall i:int::{$stacksFrames[$S].Abss[i]} r.regs[ESP] + 76 + stackGcOffset <= i ==> $stacksFrames[$S].Abss[i] == $stacksFrames_old[$S].Abss[i]);\r\n\r\n ensures HeapInv($absMem, objLayouts, heap);\r\n ensures AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n ensures (forall i:int::{$absMem[i]}{heap.absData[i]} heap_old.absData[i] is AbsNone || (heap.absData[i] == heap_old.absData[i] && ($absMem[i] == $absMem_old[i])));\r\n ensures io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n ensures fun_IsSHA256ReadyForStep($ghost_next_z, fun_SHA256__vars__to__state($absMem, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_next_atoh, $ghost_num_blocks), $ghost_currentBlock, INTERNAL_add_boogie($ghost_currentStep, 1));\r\n ensures fun_Seq__Equal___int(fun_Seq__FromArray($absMem, $ghost_H), old(fun_Seq__FromArray($absMem_old, $ghost_H)));\r\n ensures fun_Seq__Equal___int(fun_Seq__FromArray($absMem, $ghost_M), old(fun_Seq__FromArray($absMem_old, $ghost_M)));\r\n ensures fun_Seq__Equal___int(fun_Seq__FromArray($absMem, $ghost_W), old(fun_Seq__FromArray($absMem_old, $ghost_W)));\r\n ensures $ghost_next_atoh == (atoh_c($ghost_a_next, $ghost_b_next, $ghost_c_next, $ghost_d_next, $ghost_e_next, $ghost_f_next, $ghost_g_next, $ghost_h_next));\r\n //ensures (($ghost_a_next) == (stk.map[r_old.regs[ESP] + 4]));\r\n ensures $ghost_a_next == r.regs[EBP];\r\n ensures (($ghost_b_next) == (stk.map[r_old.regs[ESP] + 48]));\r\n ensures (($ghost_c_next) == (stk.map[r_old.regs[ESP] + 52]));\r\n ensures (($ghost_d_next) == (stk.map[r_old.regs[ESP] + 56]));\r\n ensures (($ghost_e_next) == (stk.map[r_old.regs[ESP] + 60]));\r\n ensures (($ghost_f_next) == (stk.map[r_old.regs[ESP] + 64]));\r\n ensures (($ghost_g_next) == (stk.map[r_old.regs[ESP] + 68]));\r\n ensures (($ghost_h_next) == (stk.map[r_old.regs[ESP] + 72]));\r\n \r\n //- Preserve calling requirements\r\n ensures (($ghost_words) == (stk.map[r.regs[ESP] + 36]));\r\n ensures (($ghost_num_blocks) == (stk.map[r.regs[ESP] + 40]));\r\n ensures HeapValue(objLayouts, true, $toAbs, W_base, $ghost_W__abs);\r\n ensures StackAbsSlot(heap, $stacksFrames, r.regs[ESP] + 4 + stackGcOffset) == Abs_ArrayOfInt($ghost_M);\r\n ensures frameGet($stacksFrames, r.regs[ESP] + 4 + stackGcOffset) == $ghost_M.arrAbs;\r\n ensures StackAbsSlot(heap, $stacksFrames, r.regs[ESP] + 8 + stackGcOffset) == Abs_ArrayOfInt($ghost_H);\r\n ensures frameGet($stacksFrames, r.regs[ESP] + 8 + stackGcOffset) == $ghost_H.arrAbs;\r\n ensures StackAbsSlot(heap, $stacksFrames, r.regs[ESP] + 12 + stackGcOffset) == Abs_ArrayOfInt($ghost_W);\r\n ensures frameGet($stacksFrames, r.regs[ESP] + 12 + stackGcOffset) == $ghost_W.arrAbs;\r\n\r\n{\r\n var t:opn_mem;\r\n var $result:int;\r\n var $result2:int;\r\n // Lots of boilerplate follows\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var $ghost_s:SHA256_state;\r\n var $ghost_bsig0:int;\r\n var $ghost__temp__0:int;\r\n var $ghost__temp__1:int;\r\n var $ghost__temp__2:int;\r\n var $ghost__temp__3:int;\r\n var $ghost_bsig1:int;\r\n var $ghost__temp__4:int;\r\n var $ghost__temp__5:int;\r\n var $ghost__temp__6:int;\r\n var $ghost__temp__7:int;\r\n var $ghost_my_ch:int;\r\n var $ghost__temp__8:int;\r\n var $ghost__temp__9:int;\r\n var $ghost__temp__10:int;\r\n var $ghost_my_maj:int;\r\n var $ghost__temp__11:int;\r\n var $ghost__temp__12:int;\r\n var $ghost__temp__13:int;\r\n var $ghost__temp__14:int;\r\n var $ghost_T1:int;\r\n var $ghost__temp__15:int;\r\n var $ghost__temp__16:int;\r\n var $ghost__temp__17:int;\r\n var $ghost__temp__18:int;\r\n var $ghost__temp__19:int;\r\n var $ghost_T2:int;\r\n var $ghost_next_s:SHA256_state;\r\n var $ghost_M__abs:int;\r\n var $ghost_H__abs:int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___int();\r\n call lemma_fun_ensures_fun_Seq__Length___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___int();\r\n call proc_Seq__Empty__ToZero___int();\r\n call proc_Seq__Empty__FromZero___int();\r\n call proc_Seq__Singleton__Length___int();\r\n call proc_Seq__Build__Length___int();\r\n call proc_Seq__Build__Index___int();\r\n call proc_Seq__Append__Length___int();\r\n call proc_Seq__Index__Singleton___int();\r\n call proc_Seq__Append__Index___int();\r\n call proc_Seq__Update__Length___int();\r\n call proc_Seq__Index__Update___int();\r\n call proc_Seq__Equal__Equiv___int();\r\n call proc_Seq__Take__Length___int();\r\n call proc_Seq__Take__Index___int();\r\n call proc_Seq__Drop__Length___int();\r\n call proc_Seq__Drop__Index___int();\r\n call proc_Seq__Append__TakeDrop__Restricted___int();\r\n call proc_Seq__Update__CommuteTake1___int();\r\n call proc_Seq__Update__CommuteTake2___int();\r\n call proc_Seq__Update__CommuteDrop1___int();\r\n call proc_Seq__Update__CommuteDrop2___int();\r\n call proc_Seq__Build__CommuteDrop___int();\r\n call proc_Seq__Take__Empty___int();\r\n call proc_Seq__Drop__Empty___int();\r\n call lemma_unroll_fun_Seq__FromArrayRange();\r\n call proc_Seq__FromArray__Length();\r\n call proc_Seq__FromArray__Index();\r\n call proc_Seq__FromArray__Update();\r\n call lemma_unroll_rec_fun____HASH_power2__FULL();\r\n call lemma_unroll_fun____HASH_power2__FULL();\r\n call lemma_fun_ensures_fun_power2();\r\n call lemma_unroll_rec_fun____HASH_BEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_fun____HASH_BEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_rec_fun____HASH_BEIntToDigitSeq__private__FULL();\r\n call lemma_unroll_fun____HASH_BEIntToDigitSeq__private__FULL();\r\n call lemma_unroll_rec_fun_RepeatDigit();\r\n call lemma_unroll_fun_RepeatDigit();\r\n call lemma_unroll_rec_fun____HASH_Reverse__FULL();\r\n call lemma_unroll_fun____HASH_Reverse__FULL();\r\n call lemma_unroll_rec_fun____HASH_power__FULL();\r\n call lemma_unroll_fun____HASH_power__FULL();\r\n call lemma_unroll_rec_fun_mul__pos();\r\n call lemma_unroll_fun_mul__pos();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___bool();\r\n call lemma_fun_ensures_fun_Seq__Length___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___bool();\r\n call proc_Seq__Empty__ToZero___bool();\r\n call proc_Seq__Empty__FromZero___bool();\r\n call proc_Seq__Singleton__Length___bool();\r\n call proc_Seq__Build__Length___bool();\r\n call proc_Seq__Build__Index___bool();\r\n call proc_Seq__Append__Length___bool();\r\n call proc_Seq__Index__Singleton___bool();\r\n call proc_Seq__Append__Index___bool();\r\n call proc_Seq__Update__Length___bool();\r\n call proc_Seq__Index__Update___bool();\r\n call proc_Seq__Equal__Equiv___bool();\r\n call proc_Seq__Take__Length___bool();\r\n call proc_Seq__Take__Index___bool();\r\n call proc_Seq__Drop__Length___bool();\r\n call proc_Seq__Drop__Index___bool();\r\n call proc_Seq__Append__TakeDrop__Restricted___bool();\r\n call proc_Seq__Update__CommuteTake1___bool();\r\n call proc_Seq__Update__CommuteTake2___bool();\r\n call proc_Seq__Update__CommuteDrop1___bool();\r\n call proc_Seq__Update__CommuteDrop2___bool();\r\n call proc_Seq__Build__CommuteDrop___bool();\r\n call proc_Seq__Take__Empty___bool();\r\n call proc_Seq__Drop__Empty___bool();\r\n call lemma_unroll_rec_fun_my__div__pos();\r\n call lemma_unroll_fun_my__div__pos();\r\n call lemma_unroll_rec_fun_my__mod__recursive();\r\n call lemma_unroll_fun_my__mod__recursive();\r\n call lemma_fun_ensures_fun_RepeatDigit__premium();\r\n call lemma_unroll_rec_fun____HASH_SequenceOfZeros__FULL();\r\n call lemma_unroll_fun____HASH_SequenceOfZeros__FULL();\r\n call lemma_fun_ensures_fun_SequenceOfZeros();\r\n call lemma_fun_ensures_fun_BitwiseAnd();\r\n call lemma_fun_ensures_fun_BitwiseOr();\r\n call lemma_fun_ensures_fun_BitwiseNot();\r\n call lemma_fun_ensures_fun_BitwiseXor();\r\n call lemma_fun_ensures_fun_RotateRight();\r\n call lemma_fun_ensures_fun_RotateLeft();\r\n call lemma_fun_ensures_fun_RightShift();\r\n call lemma_fun_ensures_fun_LeftShift();\r\n call lemma_fun_ensures_fun_Add32();\r\n call lemma_fun_ensures_fun_Sub32();\r\n call lemma_fun_ensures_fun_Mul32();\r\n call lemma_fun_ensures_fun_Div32();\r\n call lemma_fun_ensures_fun_Mod32();\r\n call lemma_unroll_rec_fun____HASH_NatNumBits__FULL();\r\n call lemma_unroll_fun____HASH_NatNumBits__FULL();\r\n call lemma_fun_ensures_fun_NatNumBits();\r\n call lemma_fun_ensures_fun_asm__Add();\r\n call lemma_fun_ensures_fun_asm__Sub();\r\n call lemma_fun_ensures_fun_asm__Mul();\r\n call lemma_fun_ensures_fun_asm__Div();\r\n call lemma_fun_ensures_fun_asm__Mod();\r\n call lemma_fun_ensures_fun_asm__LeftShift();\r\n call lemma_fun_ensures_fun_asm__RightShift();\r\n call lemma_fun_ensures_fun_asm__RotateLeft();\r\n call lemma_fun_ensures_fun_asm__RotateRight();\r\n call lemma_fun_ensures_fun_asm__BitwiseNot();\r\n call lemma_fun_ensures_fun_asm__BitwiseAnd();\r\n call lemma_fun_ensures_fun_asm__BitwiseOr();\r\n call lemma_fun_ensures_fun_asm__BitwiseXor();\r\n call lemma_unroll_rec_fun____HASH_LEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_fun____HASH_LEDigitSeqToInt__private__FULL();\r\n call lemma_fun_ensures_fun_BEDigitSeqToInt__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToInt__premium();\r\n call lemma_fun_ensures_fun_BEIntToDigitSeq__premium();\r\n call lemma_fun_ensures_fun_BEIntToByteSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordToFourBytes__premium();\r\n call lemma_fun_ensures_fun_BEWordToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEByteSeqToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToByteSeq__premium();\r\n call lemma_fun_ensures_fun_Asm__Add();\r\n call lemma_fun_ensures_fun_Asm__Sub();\r\n call lemma_fun_ensures_fun_Asm__Mul();\r\n call lemma_fun_ensures_fun_Asm__Div();\r\n call lemma_fun_ensures_fun_Asm__Mod();\r\n call lemma_fun_ensures_fun_Asm__LeftShift();\r\n call lemma_fun_ensures_fun_Asm__RightShift();\r\n call lemma_fun_ensures_fun_Asm__RotateLeft();\r\n call lemma_fun_ensures_fun_Asm__RotateRight();\r\n call lemma_fun_ensures_fun_Asm__BitwiseNot();\r\n call lemma_fun_ensures_fun_Asm__BitwiseAnd();\r\n call lemma_fun_ensures_fun_Asm__BitwiseOr();\r\n call lemma_fun_ensures_fun_Asm__BitwiseXor();\r\n call lemma_fun_ensures_fun_ComputePower2();\r\n call lemma_fun_ensures_fun_ComputePower2Minus1__mostly();\r\n call lemma_fun_ensures_fun_ComputePower2Minus1();\r\n call lemma_fun_ensures_fun_GetWordBit();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___Seq___int();\r\n call lemma_fun_ensures_fun_Seq__Length___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___Seq___int();\r\n call proc_Seq__Empty__ToZero___Seq___int();\r\n call proc_Seq__Empty__FromZero___Seq___int();\r\n call proc_Seq__Singleton__Length___Seq___int();\r\n call proc_Seq__Build__Length___Seq___int();\r\n call proc_Seq__Build__Index___Seq___int();\r\n call proc_Seq__Append__Length___Seq___int();\r\n call proc_Seq__Index__Singleton___Seq___int();\r\n call proc_Seq__Append__Index___Seq___int();\r\n call proc_Seq__Update__Length___Seq___int();\r\n call proc_Seq__Index__Update___Seq___int();\r\n call proc_Seq__Equal__Equiv___Seq___int();\r\n call proc_Seq__Take__Length___Seq___int();\r\n call proc_Seq__Take__Index___Seq___int();\r\n call proc_Seq__Drop__Length___Seq___int();\r\n call proc_Seq__Drop__Index___Seq___int();\r\n call proc_Seq__Append__TakeDrop__Restricted___Seq___int();\r\n call proc_Seq__Update__CommuteTake1___Seq___int();\r\n call proc_Seq__Update__CommuteTake2___Seq___int();\r\n call proc_Seq__Update__CommuteDrop1___Seq___int();\r\n call proc_Seq__Update__CommuteDrop2___Seq___int();\r\n call proc_Seq__Build__CommuteDrop___Seq___int();\r\n call proc_Seq__Take__Empty___Seq___int();\r\n call proc_Seq__Drop__Empty___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_BreakIntoBlocks__FULL();\r\n call lemma_unroll_fun____HASH_BreakIntoBlocks__FULL();\r\n call lemma_fun_ensures_fun____HASH_Ch__FULL();\r\n call lemma_fun_ensures_fun_Ch();\r\n call lemma_fun_ensures_fun____HASH_Maj__FULL();\r\n call lemma_fun_ensures_fun_Maj();\r\n call lemma_fun_ensures_fun____HASH_Parity__FULL();\r\n call lemma_fun_ensures_fun_Parity();\r\n call lemma_fun_ensures_fun____HASH_ft__FULL();\r\n call lemma_fun_ensures_fun_ft();\r\n call lemma_fun_ensures_fun____HASH_BSIG0__FULL();\r\n call lemma_fun_ensures_fun_BSIG0();\r\n call lemma_fun_ensures_fun____HASH_BSIG1__FULL();\r\n call lemma_fun_ensures_fun_BSIG1();\r\n call lemma_fun_ensures_fun____HASH_SSIG0__FULL();\r\n call lemma_fun_ensures_fun_SSIG0();\r\n call lemma_fun_ensures_fun____HASH_SSIG1__FULL();\r\n call lemma_fun_ensures_fun_SSIG1();\r\n call lemma_fun_ensures_fun____HASH_NumPaddingZeroes__FULL();\r\n call lemma_fun_ensures_fun_NumPaddingZeroes();\r\n call lemma_unroll_rec_fun____HASH_SeqXor__FULL();\r\n call lemma_unroll_fun____HASH_SeqXor__FULL();\r\n call lemma_unroll_rec_fun____HASH_ConstPad__FULL();\r\n call lemma_unroll_fun____HASH_ConstPad__FULL();\r\n call lemma_fun_ensures_fun____HASH_GetArrayBit__FULL();\r\n call lemma_fun_ensures_fun_GetArrayBit();\r\n call lemma_fun_ensures_fun_DivideRoundingUp__premium();\r\n call lemma_fun_ensures_fun_RoundUpToMultiple__premium();\r\n call lemma_fun_ensures_fun_PadSequenceToMultiple__premium();\r\n call lemma_fun_ensures_fun_PadAndBreakIntoBlocks__premium();\r\n call lemma_fun_ensures_fun_Ch__impl();\r\n call lemma_fun_ensures_fun_Maj__impl();\r\n call lemma_fun_ensures_fun_Parity__impl();\r\n call lemma_fun_ensures_fun_ft__impl();\r\n call lemma_fun_ensures_fun_BSIG0__impl();\r\n call lemma_fun_ensures_fun_BSIG1__impl();\r\n call lemma_fun_ensures_fun_SSIG0__impl();\r\n call lemma_fun_ensures_fun_SSIG1__impl();\r\n call lemma_fun_ensures_fun_PadMessageForSHA__premium();\r\n call lemma_fun_ensures_fun____HASH_GetArrayBitOpaque__FULL();\r\n call lemma_fun_ensures_fun_GetArrayBitOpaque();\r\n call lemma_fun_ensures_fun____HASH_K__SHA256__FULL();\r\n call lemma_fun_ensures_fun_K__SHA256();\r\n call lemma_fun_ensures_fun____HASH_InitialH__SHA256__FULL();\r\n call lemma_fun_ensures_fun_InitialH__SHA256();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___atoh_Type();\r\n call lemma_fun_ensures_fun_Seq__Length___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___atoh_Type();\r\n call proc_Seq__Empty__ToZero___atoh_Type();\r\n call proc_Seq__Empty__FromZero___atoh_Type();\r\n call proc_Seq__Singleton__Length___atoh_Type();\r\n call proc_Seq__Build__Length___atoh_Type();\r\n call proc_Seq__Build__Index___atoh_Type();\r\n call proc_Seq__Append__Length___atoh_Type();\r\n call proc_Seq__Index__Singleton___atoh_Type();\r\n call proc_Seq__Append__Index___atoh_Type();\r\n call proc_Seq__Update__Length___atoh_Type();\r\n call proc_Seq__Index__Update___atoh_Type();\r\n call proc_Seq__Equal__Equiv___atoh_Type();\r\n call proc_Seq__Take__Length___atoh_Type();\r\n call proc_Seq__Take__Index___atoh_Type();\r\n call proc_Seq__Drop__Length___atoh_Type();\r\n call proc_Seq__Drop__Index___atoh_Type();\r\n call proc_Seq__Append__TakeDrop__Restricted___atoh_Type();\r\n call proc_Seq__Update__CommuteTake1___atoh_Type();\r\n call proc_Seq__Update__CommuteTake2___atoh_Type();\r\n call proc_Seq__Update__CommuteDrop1___atoh_Type();\r\n call proc_Seq__Update__CommuteDrop2___atoh_Type();\r\n call proc_Seq__Build__CommuteDrop___atoh_Type();\r\n call proc_Seq__Take__Empty___atoh_Type();\r\n call proc_Seq__Drop__Empty___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___Seq___atoh_Type();\r\n call lemma_fun_ensures_fun_Seq__Length___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___Seq___atoh_Type();\r\n call proc_Seq__Empty__ToZero___Seq___atoh_Type();\r\n call proc_Seq__Empty__FromZero___Seq___atoh_Type();\r\n call proc_Seq__Singleton__Length___Seq___atoh_Type();\r\n call proc_Seq__Build__Length___Seq___atoh_Type();\r\n call proc_Seq__Build__Index___Seq___atoh_Type();\r\n call proc_Seq__Append__Length___Seq___atoh_Type();\r\n call proc_Seq__Index__Singleton___Seq___atoh_Type();\r\n call proc_Seq__Append__Index___Seq___atoh_Type();\r\n call proc_Seq__Update__Length___Seq___atoh_Type();\r\n call proc_Seq__Index__Update___Seq___atoh_Type();\r\n call proc_Seq__Equal__Equiv___Seq___atoh_Type();\r\n call proc_Seq__Take__Length___Seq___atoh_Type();\r\n call proc_Seq__Take__Index___Seq___atoh_Type();\r\n call proc_Seq__Drop__Length___Seq___atoh_Type();\r\n call proc_Seq__Drop__Index___Seq___atoh_Type();\r\n call proc_Seq__Append__TakeDrop__Restricted___Seq___atoh_Type();\r\n call proc_Seq__Update__CommuteTake1___Seq___atoh_Type();\r\n call proc_Seq__Update__CommuteTake2___Seq___atoh_Type();\r\n call proc_Seq__Update__CommuteDrop1___Seq___atoh_Type();\r\n call proc_Seq__Update__CommuteDrop2___Seq___atoh_Type();\r\n call proc_Seq__Build__CommuteDrop___Seq___atoh_Type();\r\n call proc_Seq__Take__Empty___Seq___atoh_Type();\r\n call proc_Seq__Drop__Empty___Seq___atoh_Type();\r\n call lemma_fun_ensures_fun_SHA256();\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n $ghost_M__abs := frameGet($stacksFrames, r_old.regs[ESP] + 4 + stackGcOffset);\r\n $ghost_H__abs := frameGet($stacksFrames, r_old.regs[ESP] + 8 + stackGcOffset);\r\n assert TV(r.regs[ESP]);\r\n assert TO(0 - 1);\r\n assert TO(279552 - 1);\r\n assert TO(0 - 2);\r\n assert TO(279552 - 2);\r\n assert TO(0);\r\n assert TO(279552);\r\n assert TO(1);\r\n assert TO(279553);\r\n assert TO(2);\r\n assert TO(279554);\r\n assert TO(3);\r\n assert TO(279555);\r\n assert TO(4);\r\n assert TO(279556);\r\n assert TO(5);\r\n assert TO(279557);\r\n assert TO(6);\r\n assert TO(279558);\r\n assert TO(7);\r\n assert TO(279559);\r\n assert TO(8);\r\n assert TO(279560);\r\n assert TO(9);\r\n assert TO(279561);\r\n assert TO(10);\r\n assert TO(279562);\r\n assert TO(11);\r\n assert TO(279563);\r\n assert TO(12);\r\n assert TO(279564);\r\n assert TO(13);\r\n assert TO(279565);\r\n assert TO(14);\r\n assert TO(279566);\r\n assert TO(15);\r\n assert TO(279567);\r\n assert TO(16);\r\n assert TO(279568);\r\n assert TO(17);\r\n assert TO(279569);\r\n assert TO(18);\r\n assert TO(279570);\r\n assert TO(19);\r\n assert TO(279571);\r\n assert TO(20);\r\n assert TO(279572);\r\n assert TO(21);\r\n\r\n call proc_lemma__2toX();\r\n call proc_lemma__word32__Word32();\r\n call reveal_WORD_HI();\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt2.i.dfy: 38\r\n $ghost_s := fun_SHA256__vars__to__state($absMem, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_atoh, $ghost_num_blocks);\r\n\r\n// assert Aligned(esp);\r\n// // Prove that we can load arguments from the stack (b/c accesses are aligned)\r\n// assert TV(esp) && TO(0) && TO(1) && TO(2) && TO(3) && TO(4) && TO(5);\r\n//\r\n// // Prove that we can load arguments from the GC stack (b/c accesses are aligned)\r\n// assert TO(0x44401) && TO(0x44402) && TO(0x44403); // (gcStackOffset + {4,8,12}) / 4\r\n\r\n\r\n //- Calculate my_maj\r\n//t := OMem(MReg(ESP, 44));\r\n//assert EvalPtrOk(t);\r\n//assert stk.dom[EvalPtr(r, t)];\r\n//assert Aligned(EvalPtr(r, t));\r\n//assert PhysPtrOk(stk, EvalPtr(r, t));\r\n//assert word(EvalPtr(r, t));\r\n//\r\n //call eax := Load(stk, esp + 44); // grab a\r\n //assert eax == $ghost_a;\r\n assert ebp == $ghost_a;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 48)), OReg(EBP)); //- b_next <- a\r\n call ebx := Load(stk, esp + 8); //- grab b\r\n assert ebx == $ghost_b;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 52)), OReg(EBX)); //- c_next <- b\r\n call ecx := Load(stk, esp + 12); //- grab c\r\n assert ecx == $ghost_c;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 56)), OReg(ECX)); //- d_next <- c\r\n\r\n edx := ebx; //- Store a copy of b\r\n call r, $result := proc_Asm__BitwiseAnd(r, $ghost_b, $ghost_a, EBX, OReg(EBP));\r\n call proc_lemma__bitwise__and__commutative($ghost_b, $ghost_a);\r\n assert fun_Asm__BitwiseAnd($ghost_b, $ghost_a) == fun_Asm__BitwiseAnd($ghost_a, $ghost_b);\r\n call r, $result := proc_Asm__BitwiseAnd(r, $ghost_b, $ghost_c, EDX, OReg(ECX)); \r\n call r, $result := proc_Asm__BitwiseAnd(r, $ghost_c, $ghost_a, ECX, OReg(EBP)); \r\n call proc_lemma__bitwise__and__commutative($ghost_c, $ghost_a);\r\n assert fun_Asm__BitwiseAnd($ghost_c, $ghost_a) == fun_Asm__BitwiseAnd($ghost_a, $ghost_c);\r\n \r\n call r, $result := proc_Asm__BitwiseXor(r, fun_Asm__BitwiseAnd($ghost_b, $ghost_a), fun_Asm__BitwiseAnd($ghost_c, $ghost_a), EBX, OReg(ECX));\r\n call r, $ghost_my_maj := proc_Asm__BitwiseXor(r, $result, fun_Asm__BitwiseAnd($ghost_b, $ghost_c), EBX, OReg(EDX));\r\n\r\n forall::($ghost_my_maj == (fun_Maj($ghost_a, $ghost_b, $ghost_c)))\r\n {\r\n call proc_reveal__Maj();\r\n }\r\n\r\n //- At this point, ebp == a, ebx == my_maj\r\n assert ebp == $ghost_a;\r\n assert ebx == fun_Maj($ghost_a, $ghost_b, $ghost_c);\r\n\r\n //- Calculate bsig0\r\n ecx := ebp;\r\n edx := ebp;\r\n call r, $result := proc_Asm__RotateRight(r, $ghost_a, 2, EBP, OConst(2));\r\n call r, $result := proc_Asm__RotateRight(r, $ghost_a, 13, ECX, OConst(13));\r\n call r, $result := proc_Asm__BitwiseXor(r, fun_Asm__RotateRight($ghost_a, 2), fun_Asm__RotateRight($ghost_a, 13), EBP, OReg(ECX));\r\n call r, $result2 := proc_Asm__RotateRight(r, $ghost_a, 22, EDX, OConst(22));\r\n call r, $ghost_bsig0 := proc_Asm__BitwiseXor(r, $result, fun_Asm__RotateRight($ghost_a, 22), EBP, OReg(EDX));\r\n\r\n forall::($ghost_bsig0 == (fun_BSIG0($ghost_a)))\r\n {\r\n call proc_reveal__BSIG0();\r\n }\r\n assert ebp == fun_BSIG0($ghost_a);\r\n\r\n call r, $ghost_T2 := proc_Asm__Add(r, $ghost_bsig0, $ghost_my_maj, EBP, OReg(EBX));\r\n assert ebp == $ghost_T2;\r\n\r\n //- Calculate my_ch\r\n call ebx := Load(stk, esp + 20); //- grab e\r\n assert ebx == $ghost_e;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 64)), OReg(EBX)); //- f_next <- e\r\n edx := ebx;\r\n call r, $result := proc_Asm__BitwiseNot(r, $ghost_e, EDX);\r\n call ecx := Load(stk, esp + 28); //- grab g\r\n assert ecx == $ghost_g;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 72)), OReg(ECX)); //- h_next <- g\r\n call r, $result := proc_Asm__BitwiseAnd(r, $result, $ghost_g, EDX, OReg(ECX)); //- !e & g\r\n assert edx == fun_Asm__BitwiseAnd(fun_Asm__BitwiseNot($ghost_e), $ghost_g);\r\n call ecx := Load(stk, esp + 24); //- grab f\r\n assert ecx == $ghost_f;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 68)), OReg(ECX)); //- g_next <- f\r\n call r, $result2 := proc_Asm__BitwiseAnd(r, $ghost_f, $ghost_e, ECX, OReg(EBX));\r\n call proc_lemma__bitwise__and__commutative($ghost_f, $ghost_e);\r\n assert fun_Asm__BitwiseAnd($ghost_f, $ghost_e) == fun_Asm__BitwiseAnd($ghost_e, $ghost_f);\r\n call r, $ghost_my_ch := proc_Asm__BitwiseXor(r, $result2, $result, ECX, OReg(EDX));\r\n\r\n forall::($ghost_my_ch == (fun_Ch($ghost_e, $ghost_f, $ghost_g)))\r\n {\r\n call proc_reveal__Ch();\r\n }\r\n //- Summary:\r\n assert ebp == $ghost_T2;\r\n assert ebx == $ghost_e;\r\n assert ecx == fun_Ch($ghost_e, $ghost_f, $ghost_g);\r\n\r\n //- Calculate bsig1\r\n edx := ebx;\r\n edi := ebx;\r\n call r, $result := proc_Asm__RotateRight(r, $ghost_e, 6, EDX, OConst(6));\r\n call r, $result2 := proc_Asm__RotateRight(r, $ghost_e, 11, EDI, OConst(11));\r\n call r, $result := proc_Asm__BitwiseXor(r, $result, $result2, EDX, OReg(EDI));\r\n call r, $result2 := proc_Asm__RotateRight(r, $ghost_e, 25, EBX, OConst(25));\r\n call r, $ghost_bsig1 := proc_Asm__BitwiseXor(r, $result, $result2, EDX, OReg(EBX));\r\n\r\n forall::($ghost_bsig1 == (fun_BSIG1($ghost_e)))\r\n {\r\n call proc_reveal__BSIG1();\r\n }\r\n //- Summary:\r\n assert ebp == $ghost_T2;\r\n assert ecx == fun_Ch($ghost_e, $ghost_f, $ghost_g);\r\n assert edx == fun_BSIG1($ghost_e);\r\n\r\n call ebx := Load(stk, esp + 32); //- grab h\r\n assert ebx == $ghost_h;\r\n\r\n call r, $result := proc_Asm__Add(r, $ghost_h, fun_BSIG1($ghost_e), EBX, OReg(EDX));\r\n call r, $result := proc_Asm__Add(r, $result, fun_Ch($ghost_e, $ghost_f, $ghost_g), EBX, OReg(ECX));\r\n\r\n call r, $result := proc_Asm__Add(r, $result, Eval(r,K), EBX, K);\r\n assert Eval(r,K) == fun_K__SHA256($ghost_currentStep);\r\n\r\n //- Load the value we want from W\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EDX, Wopn, $ghost_currentStep, $ghost_W__abs, W_base);\r\n $ghost__temp__19 := r.regs[EDX];\r\n\r\n call r, $ghost_T1 := proc_Asm__Add(r, $result, edx, EBX, OReg(EDX)); \r\n assert ebp == $ghost_T2;\r\n assert ebx == $ghost_T1;\r\n\r\n call r, $result := proc_Asm__Add(r, ebp, ebx, EBP, OReg(EBX)); //- a_next <- T2 + T1\r\n assert ebp == fun_Asm__Add($ghost_T1, $ghost_T2);\r\n //call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 4)), OReg(EAX)); \r\n\r\n call eax := Load(stk, esp + 16); //- grab d\r\n assert eax == $ghost_d;\r\n call r, $result := proc_Asm__Add(r, eax, ebx, EAX, OReg(EBX)); //- e_next <- d + T1\r\n assert eax == fun_Asm__Add((d#atoh_c($ghost_atoh)), $ghost_T1);\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 60)), OReg(EAX)); \r\n\r\n\r\n //- Ghost proofs of correctness\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt2.i.dfy: 68\r\n $ghost_next_atoh := atoh_c(fun_Asm__Add($ghost_T1, $ghost_T2), (a#atoh_c($ghost_atoh)), (b#atoh_c($ghost_atoh)), (c#atoh_c($ghost_atoh)), fun_Asm__Add((d#atoh_c($ghost_atoh)), $ghost_T1), (e#atoh_c($ghost_atoh)), (f#atoh_c($ghost_atoh)), (g#atoh_c($ghost_atoh)));\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt2.i.dfy: 69\r\n $ghost_next_z := SHA256Trace_c((M#SHA256Trace_c($ghost_z)), (H#SHA256Trace_c($ghost_z)), (W#SHA256Trace_c($ghost_z)), fun_Seq__Append___Seq___atoh_Type(fun_Seq__Take___Seq___atoh_Type((atoh#SHA256Trace_c($ghost_z)), $ghost_currentBlock), fun_Seq__Build___Seq___atoh_Type(fun_Seq__Empty___Seq___atoh_Type(), fun_Seq__Append___atoh_Type(fun_Seq__Index___Seq___atoh_Type((atoh#SHA256Trace_c($ghost_z)), $ghost_currentBlock), fun_Seq__Build___atoh_Type(fun_Seq__Empty___atoh_Type(), $ghost_next_atoh)))));\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt2.i.dfy: 70\r\n $ghost_next_s := fun_SHA256__vars__to__state($absMem, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_next_atoh, $ghost_num_blocks);\r\n\r\n// assert fun_AreSHA256TraceAndStateOK($ghost_z, $ghost_s);\r\n// assert fun_Seq__Length___Seq___int((H#SHA256Trace_c($ghost_z))) == INTERNAL_add_boogie($ghost_currentBlock, 1);\r\n// assert fun_Seq__Length___Seq___int((W#SHA256Trace_c($ghost_z))) == INTERNAL_add_boogie($ghost_currentBlock, 1);\r\n// assert fun_Seq__Length___Seq___atoh_Type(atoh#SHA256Trace_c($ghost_z)) == INTERNAL_add_boogie($ghost_currentBlock, 1);\r\n// assert (forall $ghost__1_blk:int :: \r\n// (INTERNAL_le_boogie(0, $ghost__1_blk) && INTERNAL_lt_boogie($ghost__1_blk, $ghost_currentBlock)) ==> \r\n// (fun_IsAToHWordSeqOfLen(fun_Seq__Index___Seq___atoh_Type(atoh#SHA256Trace_c($ghost_z), $ghost__1_blk), 65)));\r\n// assert fun_IsAToHWordSeqOfLen(fun_Seq__Index___Seq___atoh_Type(atoh#SHA256Trace_c($ghost_z), $ghost_currentBlock), INTERNAL_add_boogie($ghost_currentStep, 1));\r\n// assert fun_Seq__Equal___int(H#SHA256_state_c($ghost_s), fun_Seq__Index___Seq___int(H#SHA256Trace_c($ghost_z), $ghost_currentBlock));\r\n// assert fun_Seq__Equal___int(W#SHA256_state_c($ghost_s), fun_Seq__Index___Seq___int(W#SHA256Trace_c($ghost_z), $ghost_currentBlock));\r\n// assert atoh#SHA256_state_c($ghost_s) == fun_Seq__Index___atoh_Type(fun_Seq__Index___Seq___atoh_Type(atoh#SHA256Trace_c($ghost_z), $ghost_currentBlock), $ghost_currentStep);\r\n assert fun_IsSHA256ReadyForStep($ghost_z, $ghost_s, $ghost_currentBlock, $ghost_currentStep);\r\n\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt2.i.dfy: 72\r\n // call:: := proc_lemma__SHA256TransitionOKAfterSettingAtoH($ghost_z, $ghost_s, $ghost_next_z, $ghost_next_s, $ghost_currentBlock, $ghost_currentStep) // isGhost = True\r\n call proc_lemma__SHA256TransitionOKAfterSettingAtoH($ghost_z, $ghost_s, $ghost_next_z, $ghost_next_s, $ghost_currentBlock, $ghost_currentStep);\r\n\r\n //- Update ghost outputs\r\n $ghost_a_next := fun_Asm__Add($ghost_T1, $ghost_T2);\r\n $ghost_b_next := a#atoh_c($ghost_atoh);\r\n $ghost_c_next := b#atoh_c($ghost_atoh);\r\n $ghost_d_next := c#atoh_c($ghost_atoh);\r\n $ghost_e_next := fun_Asm__Add((d#atoh_c($ghost_atoh)), $ghost_T1);\r\n $ghost_f_next := e#atoh_c($ghost_atoh);\r\n $ghost_g_next := f#atoh_c($ghost_atoh);\r\n $ghost_h_next := g#atoh_c($ghost_atoh);\r\n\r\n //Return;\r\n}\r\nimplementation Proc_ComputeSHA256__optimized__loop(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_M:ArrayOfInt, $ghost_words:int, $ghost_H:ArrayOfInt, $ghost_W:ArrayOfInt, $ghost_atoh:atoh_Type, $ghost_num_blocks:int, $ghost_a:int, $ghost_b:int, $ghost_c:int, $ghost_d:int, $ghost_e:int, $ghost_f:int, $ghost_g:int, $ghost_h:int, $ghost_z:SHA256Trace, $ghost_currentBlock:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, $ghost_a_final:int, $ghost_b_final:int, $ghost_c_final:int, $ghost_d_final:int, $ghost_e_final:int, $ghost_f_final:int, $ghost_g_final:int, $ghost_h_final:int, $ghost_final_atoh:atoh_Type, $ghost_final_z:SHA256Trace);\r\n{\r\n var $ghost_M__abs:int;\r\n var $ghost_H__abs:int;\r\n var $ghost_W__abs:int;\r\n\r\n var $ghost_local_a:int;\r\n var $ghost_local_b:int;\r\n var $ghost_local_c:int;\r\n var $ghost_local_d:int;\r\n var $ghost_local_e:int;\r\n var $ghost_local_f:int;\r\n var $ghost_local_g:int;\r\n var $ghost_local_h:int;\r\n\r\n var W_base:int;\r\n\r\n var $ghost_current_atoh:atoh_Type;\r\n var $ghost_current_z:SHA256Trace;\r\n\r\n //- Boilerplate variable propagation\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n $ghost_M__abs := frameGet($stacksFrames, r_old.regs[ESP] + 4 + stackGcOffset);\r\n $ghost_H__abs := frameGet($stacksFrames, r_old.regs[ESP] + 8 + stackGcOffset);\r\n $ghost_W__abs := frameGet($stacksFrames, r_old.regs[ESP] + 12 + stackGcOffset);\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n\r\n //- Functions we might want\r\n call lemma_fun_ensures_fun____HASH_K__SHA256__FULL();\r\n call lemma_fun_ensures_fun_K__SHA256();\r\n\r\n //- Alignment\r\n assert TV(r.regs[ESP]);\r\n assert TO(0 - 1);\r\n assert TO(279552 - 1);\r\n assert TO(0 - 2);\r\n assert TO(279552 - 2);\r\n assert TO(0);\r\n assert TO(279552);\r\n assert TO(1);\r\n assert TO(279553);\r\n assert TO(2);\r\n assert TO(279554);\r\n assert TO(3);\r\n assert TO(279555);\r\n assert TO(4);\r\n assert TO(279556);\r\n assert TO(5);\r\n assert TO(279557);\r\n assert TO(6);\r\n assert TO(279558);\r\n assert TO(7);\r\n assert TO(279559);\r\n assert TO(8);\r\n assert TO(279560);\r\n assert TO(9);\r\n assert TO(279561);\r\n assert TO(10);\r\n assert TO(279562);\r\n assert TO(11);\r\n assert TO(279563);\r\n assert TO(12);\r\n assert TO(279564);\r\n assert TO(13);\r\n assert TO(279565);\r\n assert TO(14);\r\n assert TO(279566);\r\n assert TO(15);\r\n assert TO(279567);\r\n assert TO(16);\r\n assert TO(279568);\r\n assert TO(17);\r\n assert TO(279569);\r\n assert TO(18);\r\n assert TO(279570);\r\n assert TO(19);\r\n assert TO(279571);\r\n assert TO(20);\r\n assert TO(279572);\r\n assert TO(21);\r\n\r\n //- Load the first a into ebp, where's compute expects it \r\n call ebp := Load(stk, esp + 44); //- grab a\r\n assert ebp == $ghost_a;\r\n\r\n //- Initialize local ghost variables\r\n $ghost_local_a:=$ghost_a;\r\n $ghost_local_b:=$ghost_b;\r\n $ghost_local_c:=$ghost_c;\r\n $ghost_local_d:=$ghost_d;\r\n $ghost_local_e:=$ghost_e;\r\n $ghost_local_f:=$ghost_f;\r\n $ghost_local_g:=$ghost_g;\r\n $ghost_local_h:=$ghost_h;\r\n\r\n $ghost_current_atoh := $ghost_atoh;\r\n $ghost_current_z := $ghost_z;\r\n\r\n\r\n //- Load W base into ESI\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, ESI, OMem(MReg(ESP, 0x11100C)), EvalPtr(r, OMem(MReg(ESP, 0x11100C))));\r\n W_base := esi;\r\n\r\n call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, 0, $ghost_W__abs, esi); //- Proves we're within bounds for the addition below\r\n esi := esi + 8; //- Skip past the header to reach the data we care about\r\n //assert OMem(MReg(ESI,0)) == esi + 4 * (2 + 0);\r\n\r\n call proc_reveal__K__SHA256();\r\n assert 0x428a2f98 == fun_K__SHA256(0);\r\n assert 0x71374491 == fun_K__SHA256(1);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 0, OConst(0x428a2f98), OMem(MReg(ESI,0)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 1, OConst(0x71374491), OMem(MReg(ESI,4)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 2, OConst(0xb5c0fbcf), OMem(MReg(ESI,8)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 3, OConst(0xe9b5dba5), OMem(MReg(ESI,12)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 4, OConst(0x3956c25b), OMem(MReg(ESI,16)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 5, OConst(0x59f111f1), OMem(MReg(ESI,20)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 6, OConst(0x923f82a4), OMem(MReg(ESI,24)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 7, OConst(0xab1c5ed5), OMem(MReg(ESI,28)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 8, OConst(0xd807aa98), OMem(MReg(ESI,32)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 9, OConst(0x12835b01), OMem(MReg(ESI,36)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 10, OConst(0x243185be), OMem(MReg(ESI,40)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 11, OConst(0x550c7dc3), OMem(MReg(ESI,44)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 12, OConst(0x72be5d74), OMem(MReg(ESI,48)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 13, OConst(0x80deb1fe), OMem(MReg(ESI,52)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 14, OConst(0x9bdc06a7), OMem(MReg(ESI,56)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 15, OConst(0xc19bf174), OMem(MReg(ESI,60)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 16, OConst(0xe49b69c1), OMem(MReg(ESI,64)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 17, OConst(0xefbe4786), OMem(MReg(ESI,68)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 18, OConst(0x0fc19dc6), OMem(MReg(ESI,72)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 19, OConst(0x240ca1cc), OMem(MReg(ESI,76)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 20, OConst(0x2de92c6f), OMem(MReg(ESI,80)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 21, OConst(0x4a7484aa), OMem(MReg(ESI,84)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 22, OConst(0x5cb0a9dc), OMem(MReg(ESI,88)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 23, OConst(0x76f988da), OMem(MReg(ESI,92)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 24, OConst(0x983e5152), OMem(MReg(ESI,96)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 25, OConst(0xa831c66d), OMem(MReg(ESI,100)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 26, OConst(0xb00327c8), OMem(MReg(ESI,104)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 27, OConst(0xbf597fc7), OMem(MReg(ESI,108)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 28, OConst(0xc6e00bf3), OMem(MReg(ESI,112)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 29, OConst(0xd5a79147), OMem(MReg(ESI,116)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 30, OConst(0x06ca6351), OMem(MReg(ESI,120)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 31, OConst(0x14292967), OMem(MReg(ESI,124)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 32, OConst(0x27b70a85), OMem(MReg(ESI,128)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 33, OConst(0x2e1b2138), OMem(MReg(ESI,132)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 34, OConst(0x4d2c6dfc), OMem(MReg(ESI,136)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 35, OConst(0x53380d13), OMem(MReg(ESI,140)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 36, OConst(0x650a7354), OMem(MReg(ESI,144)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 37, OConst(0x766a0abb), OMem(MReg(ESI,148)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 38, OConst(0x81c2c92e), OMem(MReg(ESI,152)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 39, OConst(0x92722c85), OMem(MReg(ESI,156)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 40, OConst(0xa2bfe8a1), OMem(MReg(ESI,160)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 41, OConst(0xa81a664b), OMem(MReg(ESI,164)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 42, OConst(0xc24b8b70), OMem(MReg(ESI,168)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 43, OConst(0xc76c51a3), OMem(MReg(ESI,172)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 44, OConst(0xd192e819), OMem(MReg(ESI,176)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 45, OConst(0xd6990624), OMem(MReg(ESI,180)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 46, OConst(0xf40e3585), OMem(MReg(ESI,184)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 47, OConst(0x106aa070), OMem(MReg(ESI,188)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 48, OConst(0x19a4c116), OMem(MReg(ESI,192)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 49, OConst(0x1e376c08), OMem(MReg(ESI,196)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 50, OConst(0x2748774c), OMem(MReg(ESI,200)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 51, OConst(0x34b0bcb5), OMem(MReg(ESI,204)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 52, OConst(0x391c0cb3), OMem(MReg(ESI,208)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 53, OConst(0x4ed8aa4a), OMem(MReg(ESI,212)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 54, OConst(0x5b9cca4f), OMem(MReg(ESI,216)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 55, OConst(0x682e6ff3), OMem(MReg(ESI,220)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 56, OConst(0x748f82ee), OMem(MReg(ESI,224)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 57, OConst(0x78a5636f), OMem(MReg(ESI,228)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 58, OConst(0x84c87814), OMem(MReg(ESI,232)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 59, OConst(0x8cc70208), OMem(MReg(ESI,236)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 60, OConst(0x90befffa), OMem(MReg(ESI,240)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 61, OConst(0xa4506ceb), OMem(MReg(ESI,244)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_A(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 62, OConst(0xbef9a3f7), OMem(MReg(ESI,248)), W_base, $ghost_W__abs);\r\n\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_atoh, $ghost_current_z := proc_ComputeOneStep__SHA256__optimized_B(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_current_atoh, $ghost_num_blocks, $ghost_local_a, $ghost_local_b, $ghost_local_c, $ghost_local_d, $ghost_local_e, $ghost_local_f, $ghost_local_g, $ghost_local_h, $ghost_current_z, $ghost_currentBlock, 63, OConst(0xc67178f2), OMem(MReg(ESI,252)), W_base, $ghost_W__abs);\r\n\r\n //- Move the returned arguments to the right location on the stack\r\n\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 4)), OReg(EBP)); //- a_final\r\n\r\n call ebx := Load(stk, esp + 48); //- grab b\r\n assert ebx == $ghost_local_b;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 8)), OReg(EBX)); //- b_final\r\n\r\n call ebx := Load(stk, esp + 52); //- grab c\r\n assert ebx == $ghost_local_c;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 12)), OReg(EBX)); //- c_final\r\n\r\n call ebx := Load(stk, esp + 56); //- grab d\r\n assert ebx == $ghost_local_d;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 16)), OReg(EBX)); //- d_final\r\n\r\n call ebx := Load(stk, esp + 60); //- grab e\r\n assert ebx == $ghost_local_e;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 20)), OReg(EBX)); //- e_final\r\n\r\n call ebx := Load(stk, esp + 64); //- grab f\r\n assert ebx == $ghost_local_f;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 24)), OReg(EBX)); //- f_final\r\n\r\n call ebx := Load(stk, esp + 68); //- grab g\r\n assert ebx == $ghost_local_g;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 28)), OReg(EBX)); //- g_final\r\n\r\n call ebx := Load(stk, esp + 72); //- grab h\r\n assert ebx == $ghost_local_h;\r\n call logical_Store(r, core_state, inout stk, OMem(MReg(ESP, 32)), OReg(EBX)); //- h_final\r\n\r\n// // From:\r\n// ensures $ghost_a_next == r.regs[EBP];\r\n// ensures (($ghost_b_next) == (stk.map[r_old.regs[ESP] + 48]));\r\n// ensures (($ghost_c_next) == (stk.map[r_old.regs[ESP] + 52]));\r\n// ensures (($ghost_d_next) == (stk.map[r_old.regs[ESP] + 56]));\r\n// ensures (($ghost_e_next) == (stk.map[r_old.regs[ESP] + 60]));\r\n// ensures (($ghost_f_next) == (stk.map[r_old.regs[ESP] + 64]));\r\n// ensures (($ghost_g_next) == (stk.map[r_old.regs[ESP] + 68]));\r\n// ensures (($ghost_h_next) == (stk.map[r_old.regs[ESP] + 72]));\r\n//\r\n// // To:\r\n// ensures (($ghost_a_final) == (stk.map[r_old.regs[ESP] + 4]));\r\n// ensures (($ghost_b_final) == (stk.map[r_old.regs[ESP] + 8]));\r\n// ensures (($ghost_c_final) == (stk.map[r_old.regs[ESP] + 12]));\r\n// ensures (($ghost_d_final) == (stk.map[r_old.regs[ESP] + 16]));\r\n// ensures (($ghost_e_final) == (stk.map[r_old.regs[ESP] + 20]));\r\n// ensures (($ghost_f_final) == (stk.map[r_old.regs[ESP] + 24]));\r\n// ensures (($ghost_g_final) == (stk.map[r_old.regs[ESP] + 28]));\r\n// ensures (($ghost_h_final) == (stk.map[r_old.regs[ESP] + 32]));\r\n\r\n $ghost_a_final := $ghost_local_a;\r\n $ghost_b_final := $ghost_local_b;\r\n $ghost_c_final := $ghost_local_c;\r\n $ghost_d_final := $ghost_local_d;\r\n $ghost_e_final := $ghost_local_e;\r\n $ghost_f_final := $ghost_local_f;\r\n $ghost_g_final := $ghost_local_g;\r\n $ghost_h_final := $ghost_local_h;\r\n\r\n $ghost_final_atoh := $ghost_current_atoh;\r\n $ghost_final_z := $ghost_current_z;\r\n\r\n Return;\r\n}\r\n\r\n\r\n\r\nimplementation Proc_ComputeWsForBlockStep1__SHA256__optimized(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_M:ArrayOfInt, $ghost_words:int, $ghost_H:ArrayOfInt, $ghost_W:ArrayOfInt, $ghost_atoh:atoh_Type, $ghost_num_blocks:int, $ghost_z:SHA256Trace, $ghost_currentBlock:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap)\r\n{\r\n // Lots of boilerplate\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var mod0:int;\r\n var $ghost_s:SHA256_state;\r\n var $ghost_t:int;\r\n var $ghost_m_index:int;\r\n var $ghost__temp__0:int;\r\n var $ghost__temp__1:int;\r\n var $ghost__temp__5:int;\r\n var $ghost_M__abs:int;\r\n var $ghost_H__abs:int;\r\n var $ghost_W__abs:int;\r\n var W_base:int;\r\n var M_base:int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___int();\r\n call lemma_fun_ensures_fun_Seq__Length___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___int();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___int();\r\n call proc_Seq__Empty__ToZero___int();\r\n call proc_Seq__Empty__FromZero___int();\r\n call proc_Seq__Singleton__Length___int();\r\n call proc_Seq__Build__Length___int();\r\n call proc_Seq__Build__Index___int();\r\n call proc_Seq__Append__Length___int();\r\n call proc_Seq__Index__Singleton___int();\r\n call proc_Seq__Append__Index___int();\r\n call proc_Seq__Update__Length___int();\r\n call proc_Seq__Index__Update___int();\r\n call proc_Seq__Equal__Equiv___int();\r\n call proc_Seq__Take__Length___int();\r\n call proc_Seq__Take__Index___int();\r\n call proc_Seq__Drop__Length___int();\r\n call proc_Seq__Drop__Index___int();\r\n call proc_Seq__Append__TakeDrop___int();\r\n call proc_Seq__Update__CommuteTake1___int();\r\n call proc_Seq__Update__CommuteTake2___int();\r\n call proc_Seq__Update__CommuteDrop1___int();\r\n call proc_Seq__Update__CommuteDrop2___int();\r\n call proc_Seq__Build__CommuteDrop___int();\r\n call proc_Seq__Take__Empty___int();\r\n call proc_Seq__Drop__Empty___int();\r\n call lemma_unroll_fun_Seq__FromArrayRange();\r\n call proc_Seq__FromArray__Length();\r\n call proc_Seq__FromArray__Index();\r\n call proc_Seq__FromArray__Update();\r\n call lemma_unroll_rec_fun____HASH_power2__FULL();\r\n call lemma_unroll_fun____HASH_power2__FULL();\r\n call lemma_fun_ensures_fun_power2();\r\n call lemma_unroll_rec_fun____HASH_BEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_fun____HASH_BEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_rec_fun____HASH_BEIntToDigitSeq__private__FULL();\r\n call lemma_unroll_fun____HASH_BEIntToDigitSeq__private__FULL();\r\n call lemma_unroll_rec_fun_RepeatDigit();\r\n call lemma_unroll_fun_RepeatDigit();\r\n call lemma_unroll_rec_fun____HASH_Reverse__FULL();\r\n call lemma_unroll_fun____HASH_Reverse__FULL();\r\n call lemma_unroll_rec_fun____HASH_power__FULL();\r\n call lemma_unroll_fun____HASH_power__FULL();\r\n call lemma_unroll_rec_fun_mul__pos();\r\n call lemma_unroll_fun_mul__pos();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___bool();\r\n call lemma_fun_ensures_fun_Seq__Length___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___bool();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___bool();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___bool();\r\n call proc_Seq__Empty__ToZero___bool();\r\n call proc_Seq__Empty__FromZero___bool();\r\n call proc_Seq__Singleton__Length___bool();\r\n call proc_Seq__Build__Length___bool();\r\n call proc_Seq__Build__Index___bool();\r\n call proc_Seq__Append__Length___bool();\r\n call proc_Seq__Index__Singleton___bool();\r\n call proc_Seq__Append__Index___bool();\r\n call proc_Seq__Update__Length___bool();\r\n call proc_Seq__Index__Update___bool();\r\n call proc_Seq__Equal__Equiv___bool();\r\n call proc_Seq__Take__Length___bool();\r\n call proc_Seq__Take__Index___bool();\r\n call proc_Seq__Drop__Length___bool();\r\n call proc_Seq__Drop__Index___bool();\r\n call proc_Seq__Append__TakeDrop___bool();\r\n call proc_Seq__Update__CommuteTake1___bool();\r\n call proc_Seq__Update__CommuteTake2___bool();\r\n call proc_Seq__Update__CommuteDrop1___bool();\r\n call proc_Seq__Update__CommuteDrop2___bool();\r\n call proc_Seq__Build__CommuteDrop___bool();\r\n call proc_Seq__Take__Empty___bool();\r\n call proc_Seq__Drop__Empty___bool();\r\n call lemma_unroll_rec_fun_my__div__pos();\r\n call lemma_unroll_fun_my__div__pos();\r\n call lemma_unroll_rec_fun_my__mod__recursive();\r\n call lemma_unroll_fun_my__mod__recursive();\r\n call lemma_fun_ensures_fun_RepeatDigit__premium();\r\n call lemma_unroll_rec_fun____HASH_SequenceOfZeros__FULL();\r\n call lemma_unroll_fun____HASH_SequenceOfZeros__FULL();\r\n call lemma_fun_ensures_fun_SequenceOfZeros();\r\n call lemma_fun_ensures_fun_BitwiseAnd();\r\n call lemma_fun_ensures_fun_BitwiseOr();\r\n call lemma_fun_ensures_fun_BitwiseNot();\r\n call lemma_fun_ensures_fun_BitwiseXor();\r\n call lemma_fun_ensures_fun_RotateRight();\r\n call lemma_fun_ensures_fun_RotateLeft();\r\n call lemma_fun_ensures_fun_RightShift();\r\n call lemma_fun_ensures_fun_LeftShift();\r\n call lemma_fun_ensures_fun_Add32();\r\n call lemma_fun_ensures_fun_Sub32();\r\n call lemma_fun_ensures_fun_Mul32();\r\n call lemma_fun_ensures_fun_Div32();\r\n call lemma_fun_ensures_fun_Mod32();\r\n call lemma_unroll_rec_fun____HASH_NatNumBits__FULL();\r\n call lemma_unroll_fun____HASH_NatNumBits__FULL();\r\n call lemma_fun_ensures_fun_NatNumBits();\r\n call lemma_fun_ensures_fun_asm__Add();\r\n call lemma_fun_ensures_fun_asm__Sub();\r\n call lemma_fun_ensures_fun_asm__Mul();\r\n call lemma_fun_ensures_fun_asm__Div();\r\n call lemma_fun_ensures_fun_asm__Mod();\r\n call lemma_fun_ensures_fun_asm__LeftShift();\r\n call lemma_fun_ensures_fun_asm__RightShift();\r\n call lemma_fun_ensures_fun_asm__RotateLeft();\r\n call lemma_fun_ensures_fun_asm__RotateRight();\r\n call lemma_fun_ensures_fun_asm__BitwiseNot();\r\n call lemma_fun_ensures_fun_asm__BitwiseAnd();\r\n call lemma_fun_ensures_fun_asm__BitwiseOr();\r\n call lemma_fun_ensures_fun_asm__BitwiseXor();\r\n call lemma_unroll_rec_fun____HASH_LEDigitSeqToInt__private__FULL();\r\n call lemma_unroll_fun____HASH_LEDigitSeqToInt__private__FULL();\r\n call lemma_fun_ensures_fun_BEDigitSeqToInt__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToInt__premium();\r\n call lemma_fun_ensures_fun_BEIntToDigitSeq__premium();\r\n call lemma_fun_ensures_fun_BEIntToByteSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordToFourBytes__premium();\r\n call lemma_fun_ensures_fun_BEWordToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEByteSeqToBitSeq__premium();\r\n call lemma_fun_ensures_fun_BEWordSeqToByteSeq__premium();\r\n call lemma_fun_ensures_fun_Asm__Add();\r\n call lemma_fun_ensures_fun_Asm__Sub();\r\n call lemma_fun_ensures_fun_Asm__Mul();\r\n call lemma_fun_ensures_fun_Asm__Div();\r\n call lemma_fun_ensures_fun_Asm__Mod();\r\n call lemma_fun_ensures_fun_Asm__LeftShift();\r\n call lemma_fun_ensures_fun_Asm__RightShift();\r\n call lemma_fun_ensures_fun_Asm__RotateLeft();\r\n call lemma_fun_ensures_fun_Asm__RotateRight();\r\n call lemma_fun_ensures_fun_Asm__BitwiseNot();\r\n call lemma_fun_ensures_fun_Asm__BitwiseAnd();\r\n call lemma_fun_ensures_fun_Asm__BitwiseOr();\r\n call lemma_fun_ensures_fun_Asm__BitwiseXor();\r\n call lemma_fun_ensures_fun_ComputePower2();\r\n call lemma_fun_ensures_fun_ComputePower2Minus1__mostly();\r\n call lemma_fun_ensures_fun_ComputePower2Minus1();\r\n call lemma_fun_ensures_fun_GetWordBit();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___Seq___int();\r\n call lemma_fun_ensures_fun_Seq__Length___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___Seq___int();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___Seq___int();\r\n call proc_Seq__Empty__ToZero___Seq___int();\r\n call proc_Seq__Empty__FromZero___Seq___int();\r\n call proc_Seq__Singleton__Length___Seq___int();\r\n call proc_Seq__Build__Length___Seq___int();\r\n call proc_Seq__Build__Index___Seq___int();\r\n call proc_Seq__Append__Length___Seq___int();\r\n call proc_Seq__Index__Singleton___Seq___int();\r\n call proc_Seq__Append__Index___Seq___int();\r\n call proc_Seq__Update__Length___Seq___int();\r\n call proc_Seq__Index__Update___Seq___int();\r\n call proc_Seq__Equal__Equiv___Seq___int();\r\n call proc_Seq__Take__Length___Seq___int();\r\n call proc_Seq__Take__Index___Seq___int();\r\n call proc_Seq__Drop__Length___Seq___int();\r\n call proc_Seq__Drop__Index___Seq___int();\r\n call proc_Seq__Append__TakeDrop___Seq___int();\r\n call proc_Seq__Update__CommuteTake1___Seq___int();\r\n call proc_Seq__Update__CommuteTake2___Seq___int();\r\n call proc_Seq__Update__CommuteDrop1___Seq___int();\r\n call proc_Seq__Update__CommuteDrop2___Seq___int();\r\n call proc_Seq__Build__CommuteDrop___Seq___int();\r\n call proc_Seq__Take__Empty___Seq___int();\r\n call proc_Seq__Drop__Empty___Seq___int();\r\n call lemma_unroll_rec_fun____HASH_BreakIntoBlocks__FULL();\r\n call lemma_unroll_fun____HASH_BreakIntoBlocks__FULL();\r\n call lemma_fun_ensures_fun____HASH_Ch__FULL();\r\n call lemma_fun_ensures_fun_Ch();\r\n call lemma_fun_ensures_fun____HASH_Maj__FULL();\r\n call lemma_fun_ensures_fun_Maj();\r\n call lemma_fun_ensures_fun____HASH_Parity__FULL();\r\n call lemma_fun_ensures_fun_Parity();\r\n call lemma_fun_ensures_fun____HASH_ft__FULL();\r\n call lemma_fun_ensures_fun_ft();\r\n call lemma_fun_ensures_fun____HASH_BSIG0__FULL();\r\n call lemma_fun_ensures_fun_BSIG0();\r\n call lemma_fun_ensures_fun____HASH_BSIG1__FULL();\r\n call lemma_fun_ensures_fun_BSIG1();\r\n call lemma_fun_ensures_fun____HASH_SSIG0__FULL();\r\n call lemma_fun_ensures_fun_SSIG0();\r\n call lemma_fun_ensures_fun____HASH_SSIG1__FULL();\r\n call lemma_fun_ensures_fun_SSIG1();\r\n call lemma_fun_ensures_fun____HASH_NumPaddingZeroes__FULL();\r\n call lemma_fun_ensures_fun_NumPaddingZeroes();\r\n call lemma_unroll_rec_fun____HASH_SeqXor__FULL();\r\n call lemma_unroll_fun____HASH_SeqXor__FULL();\r\n call lemma_unroll_rec_fun____HASH_ConstPad__FULL();\r\n call lemma_unroll_fun____HASH_ConstPad__FULL();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___atoe_Type();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___atoe_Type();\r\n call lemma_fun_ensures_fun_Seq__Length___atoe_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___atoe_Type();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___atoe_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___atoe_Type();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___atoe_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___atoe_Type();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___atoe_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___atoe_Type();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___atoe_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___atoe_Type();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___atoe_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___atoe_Type();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___atoe_Type();\r\n call proc_Seq__Empty__ToZero___atoe_Type();\r\n call proc_Seq__Empty__FromZero___atoe_Type();\r\n call proc_Seq__Singleton__Length___atoe_Type();\r\n call proc_Seq__Build__Length___atoe_Type();\r\n call proc_Seq__Build__Index___atoe_Type();\r\n call proc_Seq__Append__Length___atoe_Type();\r\n call proc_Seq__Index__Singleton___atoe_Type();\r\n call proc_Seq__Append__Index___atoe_Type();\r\n call proc_Seq__Update__Length___atoe_Type();\r\n call proc_Seq__Index__Update___atoe_Type();\r\n call proc_Seq__Equal__Equiv___atoe_Type();\r\n call proc_Seq__Take__Length___atoe_Type();\r\n call proc_Seq__Take__Index___atoe_Type();\r\n call proc_Seq__Drop__Length___atoe_Type();\r\n call proc_Seq__Drop__Index___atoe_Type();\r\n call proc_Seq__Append__TakeDrop___atoe_Type();\r\n call proc_Seq__Update__CommuteTake1___atoe_Type();\r\n call proc_Seq__Update__CommuteTake2___atoe_Type();\r\n call proc_Seq__Update__CommuteDrop1___atoe_Type();\r\n call proc_Seq__Update__CommuteDrop2___atoe_Type();\r\n call proc_Seq__Build__CommuteDrop___atoe_Type();\r\n call proc_Seq__Take__Empty___atoe_Type();\r\n call proc_Seq__Drop__Empty___atoe_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___Seq___atoe_Type();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___Seq___atoe_Type();\r\n call lemma_fun_ensures_fun_Seq__Length___Seq___atoe_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___Seq___atoe_Type();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___Seq___atoe_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___Seq___atoe_Type();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___Seq___atoe_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___Seq___atoe_Type();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___Seq___atoe_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___Seq___atoe_Type();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___Seq___atoe_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___Seq___atoe_Type();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___Seq___atoe_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___Seq___atoe_Type();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___Seq___atoe_Type();\r\n call proc_Seq__Empty__ToZero___Seq___atoe_Type();\r\n call proc_Seq__Empty__FromZero___Seq___atoe_Type();\r\n call proc_Seq__Singleton__Length___Seq___atoe_Type();\r\n call proc_Seq__Build__Length___Seq___atoe_Type();\r\n call proc_Seq__Build__Index___Seq___atoe_Type();\r\n call proc_Seq__Append__Length___Seq___atoe_Type();\r\n call proc_Seq__Index__Singleton___Seq___atoe_Type();\r\n call proc_Seq__Append__Index___Seq___atoe_Type();\r\n call proc_Seq__Update__Length___Seq___atoe_Type();\r\n call proc_Seq__Index__Update___Seq___atoe_Type();\r\n call proc_Seq__Equal__Equiv___Seq___atoe_Type();\r\n call proc_Seq__Take__Length___Seq___atoe_Type();\r\n call proc_Seq__Take__Index___Seq___atoe_Type();\r\n call proc_Seq__Drop__Length___Seq___atoe_Type();\r\n call proc_Seq__Drop__Index___Seq___atoe_Type();\r\n call proc_Seq__Append__TakeDrop___Seq___atoe_Type();\r\n call proc_Seq__Update__CommuteTake1___Seq___atoe_Type();\r\n call proc_Seq__Update__CommuteTake2___Seq___atoe_Type();\r\n call proc_Seq__Update__CommuteDrop1___Seq___atoe_Type();\r\n call proc_Seq__Update__CommuteDrop2___Seq___atoe_Type();\r\n call proc_Seq__Build__CommuteDrop___Seq___atoe_Type();\r\n call proc_Seq__Take__Empty___Seq___atoe_Type();\r\n call proc_Seq__Drop__Empty___Seq___atoe_Type();\r\n call lemma_fun_ensures_fun____HASH_GetArrayBit__FULL();\r\n call lemma_fun_ensures_fun_GetArrayBit();\r\n call lemma_fun_ensures_fun_DivideRoundingUp__premium();\r\n call lemma_fun_ensures_fun_RoundUpToMultiple__premium();\r\n call lemma_fun_ensures_fun_PadSequenceToMultiple__premium();\r\n call lemma_fun_ensures_fun_PadAndBreakIntoBlocks__premium();\r\n call lemma_fun_ensures_fun_Ch__impl();\r\n call lemma_fun_ensures_fun_Maj__impl();\r\n call lemma_fun_ensures_fun_Parity__impl();\r\n call lemma_fun_ensures_fun_ft__impl();\r\n call lemma_fun_ensures_fun_BSIG0__impl();\r\n call lemma_fun_ensures_fun_BSIG1__impl();\r\n call lemma_fun_ensures_fun_SSIG0__impl();\r\n call lemma_fun_ensures_fun_SSIG1__impl();\r\n call lemma_fun_ensures_fun_PadMessageForSHA__premium();\r\n call lemma_fun_ensures_fun____HASH_GetArrayBitOpaque__FULL();\r\n call lemma_fun_ensures_fun_GetArrayBitOpaque();\r\n call lemma_fun_ensures_fun____HASH_K__SHA256__FULL();\r\n call lemma_fun_ensures_fun_K__SHA256();\r\n call lemma_fun_ensures_fun____HASH_InitialH__SHA256__FULL();\r\n call lemma_fun_ensures_fun_InitialH__SHA256();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___atoh_Type();\r\n call lemma_fun_ensures_fun_Seq__Length___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___atoh_Type();\r\n call proc_Seq__Empty__ToZero___atoh_Type();\r\n call proc_Seq__Empty__FromZero___atoh_Type();\r\n call proc_Seq__Singleton__Length___atoh_Type();\r\n call proc_Seq__Build__Length___atoh_Type();\r\n call proc_Seq__Build__Index___atoh_Type();\r\n call proc_Seq__Append__Length___atoh_Type();\r\n call proc_Seq__Index__Singleton___atoh_Type();\r\n call proc_Seq__Append__Index___atoh_Type();\r\n call proc_Seq__Update__Length___atoh_Type();\r\n call proc_Seq__Index__Update___atoh_Type();\r\n call proc_Seq__Equal__Equiv___atoh_Type();\r\n call proc_Seq__Take__Length___atoh_Type();\r\n call proc_Seq__Take__Index___atoh_Type();\r\n call proc_Seq__Drop__Length___atoh_Type();\r\n call proc_Seq__Drop__Index___atoh_Type();\r\n call proc_Seq__Append__TakeDrop___atoh_Type();\r\n call proc_Seq__Update__CommuteTake1___atoh_Type();\r\n call proc_Seq__Update__CommuteTake2___atoh_Type();\r\n call proc_Seq__Update__CommuteDrop1___atoh_Type();\r\n call proc_Seq__Update__CommuteDrop2___atoh_Type();\r\n call proc_Seq__Build__CommuteDrop___atoh_Type();\r\n call proc_Seq__Take__Empty___atoh_Type();\r\n call proc_Seq__Drop__Empty___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Length__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Length__FULL___Seq___atoh_Type();\r\n call lemma_fun_ensures_fun_Seq__Length___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Build__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Build__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Index__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Index__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Append__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Append__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Update__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Update__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Take__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Take__FULL___Seq___atoh_Type();\r\n call lemma_unroll_rec_fun____HASH_Seq__Drop__FULL___Seq___atoh_Type();\r\n call lemma_unroll_fun____HASH_Seq__Drop__FULL___Seq___atoh_Type();\r\n call proc_Seq__Empty__ToZero___Seq___atoh_Type();\r\n call proc_Seq__Empty__FromZero___Seq___atoh_Type();\r\n call proc_Seq__Singleton__Length___Seq___atoh_Type();\r\n call proc_Seq__Build__Length___Seq___atoh_Type();\r\n call proc_Seq__Build__Index___Seq___atoh_Type();\r\n call proc_Seq__Append__Length___Seq___atoh_Type();\r\n call proc_Seq__Index__Singleton___Seq___atoh_Type();\r\n call proc_Seq__Append__Index___Seq___atoh_Type();\r\n call proc_Seq__Update__Length___Seq___atoh_Type();\r\n call proc_Seq__Index__Update___Seq___atoh_Type();\r\n call proc_Seq__Equal__Equiv___Seq___atoh_Type();\r\n call proc_Seq__Take__Length___Seq___atoh_Type();\r\n call proc_Seq__Take__Index___Seq___atoh_Type();\r\n call proc_Seq__Drop__Length___Seq___atoh_Type();\r\n call proc_Seq__Drop__Index___Seq___atoh_Type();\r\n call proc_Seq__Append__TakeDrop___Seq___atoh_Type();\r\n call proc_Seq__Update__CommuteTake1___Seq___atoh_Type();\r\n call proc_Seq__Update__CommuteTake2___Seq___atoh_Type();\r\n call proc_Seq__Update__CommuteDrop1___Seq___atoh_Type();\r\n call proc_Seq__Update__CommuteDrop2___Seq___atoh_Type();\r\n call proc_Seq__Build__CommuteDrop___Seq___atoh_Type();\r\n call proc_Seq__Take__Empty___Seq___atoh_Type();\r\n call proc_Seq__Drop__Empty___Seq___atoh_Type();\r\n call lemma_fun_ensures_fun_SHA256();\r\n //call lemma_fun_ensures_fun_ConvertAtoHToSeq__premium();\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n $ghost_M__abs := frameGet($stacksFrames, r_old.regs[ESP] + 4 + stackGcOffset);\r\n $ghost_H__abs := frameGet($stacksFrames, r_old.regs[ESP] + 8 + stackGcOffset);\r\n $ghost_W__abs := frameGet($stacksFrames, r_old.regs[ESP] + 12 + stackGcOffset);\r\n mod0 := ($ghost_W).arrAbs;\r\n assert TV(r.regs[ESP]);\r\n assert TO(0 - 1);\r\n assert TO(279552 - 1);\r\n assert TO(0 - 2);\r\n assert TO(279552 - 2);\r\n assert TO(0 - 3);\r\n assert TO(279552 - 3);\r\n assert TO(0 - 4);\r\n assert TO(279552 - 4);\r\n assert TO(0);\r\n assert TO(279552);\r\n assert TO(1);\r\n assert TO(279553);\r\n assert TO(2);\r\n assert TO(279554);\r\n assert TO(3);\r\n assert TO(279555);\r\n\r\n call proc_reveal__Mul16();\r\n call proc_lemma__word32__Word32();\r\n call proc_lemma__2toX();\r\n\r\n $ghost_s := fun_SHA256__vars__to__state($absMem, $ghost_M, $ghost_words, $ghost_H, $ghost_W, $ghost_atoh, $ghost_num_blocks);\r\n\r\n //- Load currentBlock\r\n call eax := Load(stk, esp+12);\r\n assert eax == $ghost_currentBlock;\r\n edx := 16;\r\n call edx,eax := Mul(eax, edx); //- Skip $currentBlock number of blocks, each 16 values\r\n\r\n //- Load W base into ESI\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, ESI, OMem(MReg(ESP, 0x11100C)), EvalPtr(r, OMem(MReg(ESP, 0x11100C))));\r\n W_base := esi;\r\n\r\n call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, 0, $ghost_W__abs, esi); //- Proves we're within bounds for the addition below\r\n esi := esi + 8; //- Skip past the header to reach the data we care about\r\n\r\n //- Calc statements imported from DafnyCC output\r\n assert 0 <= $ghost_currentBlock * 16;\r\n assert 0 <= $ghost_currentBlock * 16 + 15;\r\n\r\n assert $ghost_currentBlock*16 < $ghost_words;\r\n assert $ghost_currentBlock*16 + 15 < $ghost_words;\r\n\r\n //- Load M base into EDI\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EDI, OMem(MReg(ESP, 0x111004)), EvalPtr(r, OMem(MReg(ESP, 0x111004))));\r\n M_base := edi;\r\n //-assert Aligned(edi);\r\n\r\n call arrayElementProperties(core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_currentBlock*16 + 0, $ghost_M__abs, edi); //- Proves we're within bounds for the lea below\r\n\r\n assert word($ghost_currentBlock * 16);\r\n assert eax == wrap32(Mult($ghost_currentBlock, 16));\r\n assert TVM($ghost_currentBlock, 16);\r\n assert eax == wrap32($ghost_currentBlock * 16);\r\n call reveal_wrap32($ghost_currentBlock * 16);\r\n assert eax == ($ghost_currentBlock * 16) mod WORD_HI;\r\n assert 0 <= 16 * $ghost_currentBlock;\r\n assert 16 * $ghost_currentBlock < 0x100000000;\r\n call reveal_WORD_HI();\r\n assert eax == 16 * $ghost_currentBlock;\r\n\r\n assert word(edi + 4 * (2 + $ghost_currentBlock*16));\r\n call eax := Lea(edi + 4 * eax + 8); //- Convert eax into a pointer into M (index = 4*16*currentBlock, +8 to skip array header)\r\n assert TV(edi) && TO(16) && TO(18) && TO(2);\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 0)), $ghost_currentBlock*16 + 0, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 0)), OReg(EBX), 0, ebx, $ghost_W__abs, W_base);\r\n\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 0;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n assert fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], $ghost_t) == fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t);\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 4)), $ghost_currentBlock*16 + 1, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 4)), OReg(EBX), 1, ebx, $ghost_W__abs, W_base);\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 1;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n assert fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], $ghost_t) == fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t);\r\n\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 8)), $ghost_currentBlock*16 + 2, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 8)), OReg(EBX), 2, ebx, $ghost_W__abs, W_base);\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 2;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 12)), $ghost_currentBlock*16 + 3, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 12)), OReg(EBX), 3, ebx, $ghost_W__abs, W_base);\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 3;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 16)), $ghost_currentBlock*16 + 4, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 16)), OReg(EBX), 4, ebx, $ghost_W__abs, W_base);\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 4;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 20)), $ghost_currentBlock*16 + 5, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 20)), OReg(EBX), 5, ebx, $ghost_W__abs, W_base);\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 5;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 24)), $ghost_currentBlock*16 + 6, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 24)), OReg(EBX), 6, ebx, $ghost_W__abs, W_base);\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 6;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 28)), $ghost_currentBlock*16 + 7, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 28)), OReg(EBX), 7, ebx, $ghost_W__abs, W_base);\r\n\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 7;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 32)), $ghost_currentBlock*16 + 8, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 32)), OReg(EBX), 8, ebx, $ghost_W__abs, W_base);\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 8;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 36)), $ghost_currentBlock*16 + 9, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 36)), OReg(EBX), 9, ebx, $ghost_W__abs, W_base);\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 9;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 40)), $ghost_currentBlock*16 + 10, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 40)), OReg(EBX), 10, ebx, $ghost_W__abs, W_base);\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 10;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 44)), $ghost_currentBlock*16 + 11, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 44)), OReg(EBX), 11, ebx, $ghost_W__abs, W_base);\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 11;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 48)), $ghost_currentBlock*16 + 12, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 48)), OReg(EBX), 12, ebx, $ghost_W__abs, W_base);\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 12;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 52)), $ghost_currentBlock*16 + 13, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 52)), OReg(EBX), 13, ebx, $ghost_W__abs, W_base);\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 13;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 56)), $ghost_currentBlock*16 + 14, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 56)), OReg(EBX), 14, ebx, $ghost_W__abs, W_base);\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 14;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n\r\n //- Load the value we want from M into ebx\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MReg(EAX, 60)), $ghost_currentBlock*16 + 15, $ghost_M__abs, M_base);\r\n\r\n //- Copy it to W\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(ESI, 60)), OReg(EBX), 15, ebx, $ghost_W__abs, W_base);\r\n\r\n //- Calc statement imported from DafnyCC output\r\n $ghost_t := 15;\r\n forall::((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost_t))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n call proc_Lemma__BlockedSequencePrefixContainsElement(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words, 16, $ghost_currentBlock, $ghost_t);\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks(fun_Seq__Take___int(fun_Seq__FromArray($absMem, $ghost_M), $ghost_words), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n forall::((fun_Seq__Index___int(fun_Seq__Index___Seq___int(fun_BreakIntoBlocks((M#SHA256_state_c($ghost_s)), 16), $ghost_currentBlock), $ghost_t)) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost_t)))\r\n {\r\n }\r\n\r\n Return;\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/dafny_sha256opt_i.imp.basm", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-private-import IoMain;\r\n//-private-import IntLemmasMain;\r\n//-private-basmonly-import Trusted;\r\n//-private-basmonly-import Checked;\r\n//-private-import Heap;\r\n//-private-import Seq;\r\n//-private-import dafny_DafnyPrelude;\r\n//-private-import DafnyAssembly;\r\n//-private-import dafny_base_s;\r\n//-private-import dafny_power2_s;\r\n//-private-import dafny_bytes_and_words_s;\r\n//-private-import dafny_be_sequences_s;\r\n//-private-import dafny_assembly_s;\r\n//-private-import dafny_integer_sequences_s;\r\n//-private-import dafny_seq_blocking_s;\r\n//-private-import dafny_sha_common_s;\r\n//-private-import dafny_hmac_common_s;\r\n//-private-import dafny_sha256_s;\r\n//-private-import dafny_seqs_simple_i;\r\n//-private-import dafny_power_s;\r\n//-private-import dafny_mul_i;\r\n//-private-import dafny_mul_nonlinear_i;\r\n//-private-import dafny_power_i;\r\n//-private-import dafny_div_def_i;\r\n//-private-import dafny_div_boogie_i;\r\n//-private-import dafny_div_nonlinear_i;\r\n//-private-import dafny_div_i;\r\n//-private-import dafny_repeat_digit_i;\r\n//-private-import dafny_power2_i;\r\n//-private-import dafny_seqs_and_ints_i;\r\n//-private-import dafny_relational_s;\r\n//-private-import dafny_assembly_i;\r\n//-private-import dafny_arrays_i;\r\n//-private-import dafny_seqs_transforms_i;\r\n//-private-import dafny_seqs_reverse_i;\r\n//-private-import dafny_integer_sequences_i;\r\n//-private-import dafny_integer_sequences_premium_i;\r\n//-private-import dafny_assembly_premium_i;\r\n//-private-import dafny_bit_vector_lemmas_i;\r\n//-private-import dafny_bit_vector_lemmas_premium_i;\r\n//-private-import dafny_word_bits_i;\r\n//-private-import dafny_arrays_and_seqs_i;\r\n//-private-import dafny_round_s;\r\n//-private-import dafny_round_i;\r\n//-private-import dafny_seq_blocking_i;\r\n//-private-import dafny_sha_common_i;\r\n//-private-import dafny_sha256common_i;\r\n//-private-import dafny_sha_padding_i;\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n\r\nmodule implementation dafny_sha256opt_i\r\n{\r\nimplementation Proc_InitK__SHA256__0__to__10(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_Ks:ArrayOfInt) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap)\r\n{\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var mod0:int;\r\n var $ghost_Ks__abs:int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n $ghost_Ks__abs := frameGet($stacksFrames, r_old.regs[ESP] + 4 + stackGcOffset);\r\n mod0 := ($ghost_Ks).arrAbs;\r\n assert TV(r.regs[ESP]);\r\n assert TO(0);\r\n assert TO(263168);\r\n assert TO(1);\r\n assert TO(263169);\r\n assert TO(0x44400);\r\n assert TO(0x44401);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 116\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 116\r\n // regalloc_stack_load:: EAX := OMem(MReg(ESP, 1052676)) // var = $ghost_Ks 577\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EAX, OMem(MReg(ESP, 0x111004)), EvalPtr(r, OMem(MReg(ESP, 0x111004)))); // 0x111004 = stackGcOffset+4\r\n $ghost_Ks__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, stackGcOffset+4))));\r\n\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 8)), OConst(1116352408), 0, 1116352408, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 117\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 117\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 12)), OConst(1899447441), 1, 1899447441, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 118\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 118\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 16)), OConst(3049323471), 2, 3049323471, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 119\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 119\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 20)), OConst(3921009573), 3, 3921009573, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 120\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 120\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 24)), OConst(961987163), 4, 961987163, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 121\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 121\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 28)), OConst(1508970993), 5, 1508970993, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 122\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 122\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 32)), OConst(2453635748), 6, 2453635748, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 123\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 123\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 36)), OConst(2870763221), 7, 2870763221, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 124\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 124\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 40)), OConst(3624381080), 8, 3624381080, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 125\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 125\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 44)), OConst(310598401), 9, 310598401, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 126\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 126\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 48)), OConst(607225278), 10, 607225278, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 52)), OConst(1426881987), 11, 1426881987, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 137\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 137\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 56)), OConst(1925078388), 12, 1925078388, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 138\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 138\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 60)), OConst(2162078206), 13, 2162078206, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 139\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 139\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 64)), OConst(2614888103), 14, 2614888103, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 140\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 140\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 68)), OConst(3248222580), 15, 3248222580, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 141\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 141\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 72)), OConst(3835390401), 16, 3835390401, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 142\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 142\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 76)), OConst(4022224774), 17, 4022224774, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 143\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 143\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 80)), OConst(264347078), 18, 264347078, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 144\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 144\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 84)), OConst(604807628), 19, 604807628, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 145\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 145\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 88)), OConst(770255983), 20, 770255983, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 92)), OConst(1249150122), 21, 1249150122, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 156\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 156\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 96)), OConst(1555081692), 22, 1555081692, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 157\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 157\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 100)), OConst(1996064986), 23, 1996064986, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 158\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 158\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 104)), OConst(2554220882), 24, 2554220882, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 159\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 159\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 108)), OConst(2821834349), 25, 2821834349, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 160\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 160\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 112)), OConst(2952996808), 26, 2952996808, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 161\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 161\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 116)), OConst(3210313671), 27, 3210313671, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 162\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 162\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 120)), OConst(3336571891), 28, 3336571891, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 163\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 163\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 124)), OConst(3584528711), 29, 3584528711, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 164\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 164\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 128)), OConst(113926993), 30, 113926993, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 132)), OConst(338241895), 31, 338241895, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 175\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 175\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 136)), OConst(666307205), 32, 666307205, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 176\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 176\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 140)), OConst(773529912), 33, 773529912, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 177\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 177\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 144)), OConst(1294757372), 34, 1294757372, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 178\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 178\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 148)), OConst(1396182291), 35, 1396182291, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 179\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 179\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 152)), OConst(1695183700), 36, 1695183700, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 180\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 180\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 156)), OConst(1986661051), 37, 1986661051, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 181\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 181\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 160)), OConst(2177026350), 38, 2177026350, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 182\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 182\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 164)), OConst(2456956037), 39, 2456956037, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 183\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 183\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 168)), OConst(2730485921), 40, 2730485921, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 172)), OConst(2820302411), 41, 2820302411, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 194\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 194\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 176)), OConst(3259730800), 42, 3259730800, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 195\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 195\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 180)), OConst(3345764771), 43, 3345764771, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 196\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 196\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 184)), OConst(3516065817), 44, 3516065817, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 197\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 197\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 188)), OConst(3600352804), 45, 3600352804, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 198\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 198\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 192)), OConst(4094571909), 46, 4094571909, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 199\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 199\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 196)), OConst(275423344), 47, 275423344, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 200\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 200\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 200)), OConst(430227734), 48, 430227734, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 201\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 201\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 204)), OConst(506948616), 49, 506948616, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 202\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 202\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 208)), OConst(659060556), 50, 659060556, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 212)), OConst(883997877), 51, 883997877, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 213\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 213\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 216)), OConst(958139571), 52, 958139571, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 214\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 214\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 220)), OConst(1322822218), 53, 1322822218, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 215\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 215\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 224)), OConst(1537002063), 54, 1537002063, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 216\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 216\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 228)), OConst(1747873779), 55, 1747873779, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 217\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 217\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 232)), OConst(1955562222), 56, 1955562222, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 218\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 218\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 236)), OConst(2024104815), 57, 2024104815, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 219\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 219\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 240)), OConst(2227730452), 58, 2227730452, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 220\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 220\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 244)), OConst(2361852424), 59, 2361852424, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 221\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 221\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 248)), OConst(2428436474), 60, 2428436474, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 252)), OConst(2756734187), 61, 2756734187, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 232\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 232\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 256)), OConst(3204031479), 62, 3204031479, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 233\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 233\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MReg(EAX, 260)), OConst(3329325298), 63, 3329325298, $ghost_Ks__abs, r.regs[EAX]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 127\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 127\r\n // call:: := proc_reveal__K__SHA256() // isGhost = True\r\n call proc_reveal__K__SHA256();\r\n assert !false;\r\n\r\n // return\r\n {: call r := logical_Ret(r, core_state, stk); return; :}\r\n}\r\n\r\n\r\nimplementation Proc_InitK__SHA256(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_Ks:ArrayOfInt) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap)\r\n{\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var mod0:int;\r\n var $ghost_Ks__abs:int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n $ghost_Ks__abs := frameGet($stacksFrames, r_old.regs[ESP] + 4 + stackGcOffset);\r\n mod0 := ($ghost_Ks).arrAbs;\r\n assert TV(r.regs[ESP]);\r\n assert TO(0 - 1);\r\n assert TO(263168 - 1);\r\n assert TO(0);\r\n assert TO(0x44400 - 1);\r\n assert TO(0x44400);\r\n assert TO(1);\r\n assert TO(263169);\r\n assert TO(279553);\r\n call r := logical_Sub(r, ESP, OConst(4));\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 101\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 101\r\n // regalloc_stack_load:: EAX := OMem(MReg(ESP, 0x111008)) // var = $ghost_Ks 584\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EAX, OMem(MReg(ESP, 0x111008)), EvalPtr(r, OMem(MReg(ESP, 0x111008)))); // 0x111008 = 8 + stackGcOffset\r\n //call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EAX, OMem(MReg(ESP, 0x111008)), EvalPtr(r, OMem(MReg(ESP, 0x111008))));\r\n $ghost_Ks__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, 8 + stackGcOffset))));\r\n\r\n // push argument #0 at index 0 isPtr = True argument = $ghost_Ks\r\n // regalloc_stack_store:: OMem(MReg(ESP, 1052672)) := EAX // var = $ghost_Ks\r\n call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 0x111000)), OReg(EAX), EvalPtr(r, OMem(MReg(ESP, 0x111000))), $ghost_Ks__abs); // 0x111000 = stackGcOffset\r\n\r\n // regalloc_stack_store:: OMem(MReg(ESP, 1052680)) := EAX // var = $ghost_Ks\r\n call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 0x111008)), OReg(EAX), EvalPtr(r, OMem(MReg(ESP, 0x111008))), $ghost_Ks__abs); // 0x111008 = 8 + stackGcOffset\r\n\r\n // call:: := Proc_InitK__SHA256__0__to__10($ghost_Ks) // isGhost = False\r\n call alignCall(r.regs[ESP]);\r\n {: call r, stk := logical_Call(r, core_state, stk);\r\n call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap := Proc_InitK__SHA256__0__to__10(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_Ks); :}\r\n assert SMemInvGcF(8, stk, old(stk_old), r.regs[ESP] + 4, old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n assert !false;\r\n\r\n\r\n// // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 102\r\n// // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 102\r\n// // regalloc_stack_load:: EAX := OMem(MReg(ESP, 1052680)) // var = $ghost_Ks 585\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EAX, OMem(MReg(ESP, 1052680)), EvalPtr(r, OMem(MReg(ESP, 1052680))));\r\n// $ghost_Ks__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, 1052680))));\r\n//\r\n// // push argument #0 at index 0 isPtr = True argument = $ghost_Ks\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 1052672)) := EAX // var = $ghost_Ks\r\n// call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 1052672)), OReg(EAX), EvalPtr(r, OMem(MReg(ESP, 1052672))), $ghost_Ks__abs);\r\n//\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 1052680)) := EAX // var = $ghost_Ks\r\n// call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 1052680)), OReg(EAX), EvalPtr(r, OMem(MReg(ESP, 1052680))), $ghost_Ks__abs);\r\n//\r\n// // call:: := Proc_InitK__SHA256__11__to__20($ghost_Ks) // isGhost = False\r\n// call alignCall(r.regs[ESP]);\r\n// {: call r, stk := logical_Call(r, core_state, stk);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap := Proc_InitK__SHA256__11__to__20(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_Ks); :}\r\n// assert SMemInvGcF(8, stk, old(stk_old), r.regs[ESP] + 4, old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n// assert !false;\r\n//\r\n// // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 103\r\n// // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 103\r\n// // regalloc_stack_load:: EAX := OMem(MReg(ESP, 1052680)) // var = $ghost_Ks 586\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EAX, OMem(MReg(ESP, 1052680)), EvalPtr(r, OMem(MReg(ESP, 1052680))));\r\n// $ghost_Ks__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, 1052680))));\r\n//\r\n// // push argument #0 at index 0 isPtr = True argument = $ghost_Ks\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 1052672)) := EAX // var = $ghost_Ks\r\n// call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 1052672)), OReg(EAX), EvalPtr(r, OMem(MReg(ESP, 1052672))), $ghost_Ks__abs);\r\n//\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 1052680)) := EAX // var = $ghost_Ks\r\n// call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 1052680)), OReg(EAX), EvalPtr(r, OMem(MReg(ESP, 1052680))), $ghost_Ks__abs);\r\n//\r\n// // call:: := Proc_InitK__SHA256__21__to__30($ghost_Ks) // isGhost = False\r\n// call alignCall(r.regs[ESP]);\r\n// {: call r, stk := logical_Call(r, core_state, stk);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap := Proc_InitK__SHA256__21__to__30(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_Ks); :}\r\n// assert SMemInvGcF(8, stk, old(stk_old), r.regs[ESP] + 4, old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n// assert !false;\r\n//\r\n// // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 104\r\n// // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 104\r\n// // regalloc_stack_load:: EAX := OMem(MReg(ESP, 1052680)) // var = $ghost_Ks 587\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EAX, OMem(MReg(ESP, 1052680)), EvalPtr(r, OMem(MReg(ESP, 1052680))));\r\n// $ghost_Ks__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, 1052680))));\r\n//\r\n// // push argument #0 at index 0 isPtr = True argument = $ghost_Ks\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 1052672)) := EAX // var = $ghost_Ks\r\n// call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 1052672)), OReg(EAX), EvalPtr(r, OMem(MReg(ESP, 1052672))), $ghost_Ks__abs);\r\n//\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 1052680)) := EAX // var = $ghost_Ks\r\n// call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 1052680)), OReg(EAX), EvalPtr(r, OMem(MReg(ESP, 1052680))), $ghost_Ks__abs);\r\n//\r\n// // call:: := Proc_InitK__SHA256__31__to__40($ghost_Ks) // isGhost = False\r\n// call alignCall(r.regs[ESP]);\r\n// {: call r, stk := logical_Call(r, core_state, stk);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap := Proc_InitK__SHA256__31__to__40(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_Ks); :}\r\n// assert SMemInvGcF(8, stk, old(stk_old), r.regs[ESP] + 4, old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n// assert !false;\r\n//\r\n// // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 105\r\n// // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 105\r\n// // regalloc_stack_load:: EAX := OMem(MReg(ESP, 1052680)) // var = $ghost_Ks 588\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EAX, OMem(MReg(ESP, 1052680)), EvalPtr(r, OMem(MReg(ESP, 1052680))));\r\n// $ghost_Ks__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, 1052680))));\r\n//\r\n// // push argument #0 at index 0 isPtr = True argument = $ghost_Ks\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 1052672)) := EAX // var = $ghost_Ks\r\n// call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 1052672)), OReg(EAX), EvalPtr(r, OMem(MReg(ESP, 1052672))), $ghost_Ks__abs);\r\n//\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 1052680)) := EAX // var = $ghost_Ks\r\n// call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 1052680)), OReg(EAX), EvalPtr(r, OMem(MReg(ESP, 1052680))), $ghost_Ks__abs);\r\n//\r\n// // call:: := Proc_InitK__SHA256__41__to__50($ghost_Ks) // isGhost = False\r\n// call alignCall(r.regs[ESP]);\r\n// {: call r, stk := logical_Call(r, core_state, stk);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap := Proc_InitK__SHA256__41__to__50(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_Ks); :}\r\n// assert SMemInvGcF(8, stk, old(stk_old), r.regs[ESP] + 4, old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n// assert !false;\r\n//\r\n// // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 106\r\n// // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 106\r\n// // regalloc_stack_load:: EAX := OMem(MReg(ESP, 1052680)) // var = $ghost_Ks 589\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EAX, OMem(MReg(ESP, 1052680)), EvalPtr(r, OMem(MReg(ESP, 1052680))));\r\n// $ghost_Ks__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, 1052680))));\r\n//\r\n// // push argument #0 at index 0 isPtr = True argument = $ghost_Ks\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 1052672)) := EAX // var = $ghost_Ks\r\n// call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 1052672)), OReg(EAX), EvalPtr(r, OMem(MReg(ESP, 1052672))), $ghost_Ks__abs);\r\n//\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 1052680)) := EAX // var = $ghost_Ks\r\n// call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 1052680)), OReg(EAX), EvalPtr(r, OMem(MReg(ESP, 1052680))), $ghost_Ks__abs);\r\n//\r\n// // call:: := Proc_InitK__SHA256__51__to__60($ghost_Ks) // isGhost = False\r\n// call alignCall(r.regs[ESP]);\r\n// {: call r, stk := logical_Call(r, core_state, stk);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap := Proc_InitK__SHA256__51__to__60(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_Ks); :}\r\n// assert SMemInvGcF(8, stk, old(stk_old), r.regs[ESP] + 4, old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n// assert !false;\r\n//\r\n// // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 107\r\n// // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 107\r\n// // regalloc_stack_load:: EAX := OMem(MReg(ESP, 1052680)) // var = $ghost_Ks 590\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, EAX, OMem(MReg(ESP, 1052680)), EvalPtr(r, OMem(MReg(ESP, 1052680))));\r\n// $ghost_Ks__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, 1052680))));\r\n//\r\n// // push argument #0 at index 0 isPtr = True argument = $ghost_Ks\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 1052672)) := EAX // var = $ghost_Ks\r\n// call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 1052672)), OReg(EAX), EvalPtr(r, OMem(MReg(ESP, 1052672))), $ghost_Ks__abs);\r\n//\r\n// // call:: := Proc_InitK__SHA256__61__to__63($ghost_Ks) // isGhost = False\r\n// call alignCall(r.regs[ESP]);\r\n// {: call r, stk := logical_Call(r, core_state, stk);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap := Proc_InitK__SHA256__61__to__63(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost_Ks); :}\r\n// assert SMemInvGcF(8, stk, old(stk_old), r.regs[ESP] + 4, old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n// assert !false;\r\n call r := logical_Add(r, ESP, OConst(4));\r\n\r\n // return\r\n {: call r := logical_Ret(r, core_state, stk); return; :}\r\n}\r\nimplementation Proc_ComputeWsForBlockStep2__SHA256(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, $ghost_M:ArrayOfInt, $ghost_words:int, $ghost_H:ArrayOfInt, $ghost_W:ArrayOfInt, $ghost_atoh:atoh_Type, $ghost_num_blocks:int, $ghost_z:SHA256Trace, $ghost_currentBlock:int) returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap)\r\n{\r\n var $absMem_tmp:[int][int]int;\r\n var objLayouts_tmp:[int]ObjLayout;\r\n var heap_tmp:Heap;\r\n var obj_tmp:int;\r\n var val_tmp:int;\r\n var mod0:int;\r\n var $ghost_t:int;\r\n var $ghost__temp__3:int;\r\n var $ghost__temp__4:int;\r\n var $ghost__temp__5:int;\r\n var $ghost__temp__6:int;\r\n var $ghost__temp__7:int;\r\n var $ghost__temp__8:int;\r\n var $ghost__temp__9:int;\r\n var $ghost__temp__10:int;\r\n var $ghost__temp__11:int;\r\n var $ghost__temp__12:int;\r\n var $ghost__temp__13:int;\r\n var $ghost__temp__14:int;\r\n var $ghost__temp__15:int;\r\n var $ghost_M__abs:int;\r\n var $ghost_H__abs:int;\r\n var $ghost_W__abs:int;\r\n var $ghost_atoh__abs:int;\r\n var $ghost_x:int;\r\n var curW:int;\r\n assert fun_unroll(0);\r\n assert fun_unroll(1);\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n $ghost_M__abs := frameGet($stacksFrames, r_old.regs[ESP] + 4 + stackGcOffset);\r\n $ghost_H__abs := frameGet($stacksFrames, r_old.regs[ESP] + 8 + stackGcOffset);\r\n $ghost_W__abs := frameGet($stacksFrames, r_old.regs[ESP] + 12 + stackGcOffset);\r\n $ghost_atoh__abs := frameGet($stacksFrames, r_old.regs[ESP] + 20 + stackGcOffset);\r\n mod0 := ($ghost_W).arrAbs;\r\n assert TV(r.regs[ESP]);\r\n assert TO(0 - 1);\r\n assert TO(263168 - 1);\r\n assert TO(0 - 2);\r\n assert TO(263168 - 2);\r\n assert TO(0 - 3);\r\n assert TO(263168 - 3);\r\n assert TO(0 - 4);\r\n assert TO(263168 - 4);\r\n assert TO(0 - 5);\r\n assert TO(263168 - 5);\r\n assert TO(0);\r\n assert TO(263168);\r\n assert TO(1);\r\n assert TO(263169);\r\n assert TO(2);\r\n assert TO(263170);\r\n assert TO(3);\r\n assert TO(263171);\r\n assert TO(4);\r\n assert TO(263172);\r\n assert TO(5);\r\n assert TO(263173);\r\n assert TO(0x44400);\r\n assert TO(0x44403);\r\n assert TO(0x44404);\r\n assert TO(0x44405);\r\n assert TO(0x44408);\r\n call r := logical_Sub(r, ESP, OConst(20));\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 807\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 807\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 807\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 807\r\n // move:: $ghost_t := 16 // isPtr = False\r\n call r := instr_Mov(r, EBP, OConst(16));\r\n $ghost_t := r.regs[EBP];\r\n\r\n // regalloc_stack_load:: ESI := OMem(MReg(ESP, 0x111032)) // var = $ghost_W 604\r\n call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, ESI, OMem(MReg(ESP, 0x111020)), EvalPtr(r, OMem(MReg(ESP, 0x111020)))); // 0x111020 = stackGcOffset + 32\r\n $ghost_W__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, stackGcOffset + 32))));\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 808\r\n // jump_to_label:: L1 condition = \r\n goto L1;\r\n\r\n // label:: L0 // isLoop = False\r\n L0:\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 814\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 815\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 815\r\n // move:: $ghost__temp__8 := $ghost_t // isPtr = False\r\n call r := instr_Mov(r, ECX, OReg(EBP));\r\n $ghost__temp__8 := r.regs[ECX];\r\n\r\n // binary_assignment:: $ghost__temp__8 := instr_SubChecked($ghost__temp__8, )\r\n call r := instr_SubChecked(r, ECX, OConst(2));\r\n $ghost__temp__8 := r.regs[ECX];\r\n\r\n\r\n //assert HeapValue(objLayouts, true, $toAbs, r.regs[ESI], $ghost_W__abs);\r\n // loadArrayElement\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EDX, OMem(MIndex(ESI, 4, ECX, 8)), $ghost__temp__8, $ghost_W__abs, r.regs[ESI]);\r\n $ghost__temp__7 := r.regs[EDX];\r\n\r\n //- Have:\r\n //- eax == t\r\n //- ecx == t - 2\r\n //- edx == W[t-2]\r\n\r\n//- ebx := edx;\r\n//- call ebx := Ror(ebx, 17);\r\n//- ecx := edx;\r\n//- call ecx := Ror(ecx, 19);\r\n//- call ebx := Xor(ebx, ecx);\r\n curW := Eval(r, OReg(EDX)); \r\n call r := instr_Mov(r, EBX, OReg(EDX));\r\n call r, $ghost__temp__3 := proc_Asm__RotateRight(r, $ghost__temp__7, 17, EBX, OConst(17));\r\n call r := instr_Mov(r, ECX, OReg(EDX));\r\n call r, $ghost__temp__6 := proc_Asm__RotateRight(r, $ghost__temp__7, 19, ECX, OConst(19));\r\n call r, $ghost__temp__3 := proc_Asm__BitwiseXor(r, $ghost__temp__3, $ghost__temp__6, EBX, OReg(ECX));\r\n \r\n\r\n //- Save a move by squashing edx, which we don't need any more\r\n// call edx := Shr(edx, 10);\r\n// call ebx := Xor(ebx, edx);\r\n call r, $ghost__temp__4 := proc_Asm__RightShift(r, $ghost__temp__7, 10, EDX, OConst(10));\r\n call r, $ghost__temp__3 := proc_Asm__BitwiseXor(r, $ghost__temp__3, $ghost__temp__4, EBX, OReg(EDX));\r\n\r\n call proc_reveal__SSIG1();\r\n assert Eval(r, OReg(EBX)) == fun_SSIG1(curW);\r\n\r\n //- EAX == t\r\n //- EBX == result == SSIG(edx)\r\n\r\n//- edx := eax;\r\n//- eax := ebx;\r\n//- $ghost__temp__6 := eax;\r\n call r := instr_Mov(r, EAX, OReg(EBX));\r\n $ghost__temp__6 := Eval(r, OReg(EAX));\r\n\r\n //- Need:\r\n //- eax == SSIG1(edx)\r\n //- edx == t\r\n //- $ghost__temp__6 == eax?\r\n\r\n// // push argument #0 at index 1 isPtr = False argument = $ghost__temp__7\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 4)) := EDX // var = $ghost__temp__7\r\n// call stk := logical_Store(r, core_state, stk, OMem(MReg(ESP, 4)), OReg(EDX));\r\n//\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 12)) := EAX // var = $ghost_t\r\n// call stk := logical_Store(r, core_state, stk, OMem(MReg(ESP, 12)), OReg(EAX));\r\n//\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 1052704)) := EBX // var = $ghost_W\r\n// call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 1052704)), OReg(EBX), EvalPtr(r, OMem(MReg(ESP, 1052704))), $ghost_W__abs);\r\n//\r\n// // call:: $ghost__temp__6 := Proc_SSIG1__impl($ghost__temp__7) // isGhost = False\r\n// call alignCall(r.regs[ESP]);\r\n// {: call r, stk := logical_Call(r, core_state, stk);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost__temp__6 := Proc_SSIG1__impl(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost__temp__7); :}\r\n// assert SMemInvGcF(24, stk, old(stk_old), r.regs[ESP] + 20, old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n//\r\n// // pop return value #0 at index 0 into destination $ghost__temp__6 isPtr = False\r\n// $ghost__temp__6 := stk.map[r.regs[ESP] + 0];\r\n//\r\n// // regalloc_stack_load:: EAX := OMem(MReg(ESP, 0)) // var = $ghost__temp__6 605\r\n// call r := logical_Load(r, core_state, stk, EAX, OMem(MReg(ESP, 0)));\r\n// assert !false;\r\n//\r\n// // regalloc_stack_load:: EDX := OMem(MReg(ESP, 12)) // var = $ghost_t 606\r\n// call r := logical_Load(r, core_state, stk, EDX, OMem(MReg(ESP, 12)));\r\n\r\n // move:: $ghost__temp__10 := $ghost_t // isPtr = False\r\n call r := instr_Mov(r, ECX, OReg(EBP));\r\n $ghost__temp__10 := r.regs[ECX];\r\n\r\n // binary_assignment:: $ghost__temp__10 := instr_SubChecked($ghost__temp__10, )\r\n call r := instr_SubChecked(r, ECX, OConst(7));\r\n $ghost__temp__10 := r.regs[ECX];\r\n\r\n// // regalloc_stack_load:: ESI := OMem(MReg(ESP, 1052704)) // var = $ghost_W 607\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, ESI, OMem(MReg(ESP, 1052704)), EvalPtr(r, OMem(MReg(ESP, 1052704))));\r\n// $ghost_W__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, 1052704))));\r\n\r\n // loadArrayElement\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MIndex(ESI, 4, ECX, 8)), $ghost__temp__10, $ghost_W__abs, r.regs[ESI]);\r\n $ghost__temp__9 := r.regs[EBX];\r\n\r\n // binary_assignment:: $ghost__temp__5 := proc_Asm__Add($ghost__temp__6, )\r\n call r, $ghost__temp__5 := proc_Asm__Add(r, fun_SSIG1__impl(fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], (INTERNAL_sub_boogie($ghost_t, 2)))), fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], (INTERNAL_sub_boogie($ghost_t, 7))), EAX, OReg(EBX));\r\n $ghost__temp__6 := r.regs[EAX];\r\n\r\n // move:: $ghost__temp__5 := $ghost__temp__6 // isPtr = False\r\n call r := instr_Mov(r, ECX, OReg(EAX));\r\n $ghost__temp__5 := r.regs[ECX];\r\n assert !false;\r\n\r\n // move:: $ghost__temp__13 := $ghost_t // isPtr = False\r\n call r := instr_Mov(r, EAX, OReg(EBP));\r\n $ghost__temp__13 := r.regs[EAX];\r\n\r\n // binary_assignment:: $ghost__temp__13 := instr_SubChecked($ghost__temp__13, )\r\n call r := instr_SubChecked(r, EAX, OConst(15));\r\n $ghost__temp__13 := r.regs[EAX];\r\n\r\n // loadArrayElement\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MIndex(ESI, 4, EAX, 8)), $ghost__temp__13, $ghost_W__abs, r.regs[ESI]);\r\n $ghost__temp__12 := r.regs[EBX];\r\n\r\n // Arg is EBX\r\n // Saves ECX, EDX\r\n curW := Eval(r, OReg(EBX));\r\n\r\n call r := instr_Mov(r, EAX, OReg(EBX));\r\n\r\n // binary_assignment:: $ghost__temp__11 := proc_Asm__RotateRight($ghost__temp__1, )\r\n $ghost_x := Eval(r, OReg(EAX));\r\n call r, $ghost__temp__11 := proc_Asm__RotateRight(r, $ghost_x, 7, EAX, OConst(7));\r\n $ghost__temp__11 := r.regs[EAX];\r\n assert !false;\r\n\r\n // move:: $ghost__temp__3 := $ghost_x // isPtr = False\r\n call r := instr_Mov(r, EDI, OReg(EBX));\r\n $ghost__temp__3 := r.regs[EDI];\r\n\r\n // binary_assignment:: $ghost__temp__3 := proc_Asm__RotateRight($ghost__temp__2, )\r\n call r, $ghost__temp__3 := proc_Asm__RotateRight(r, $ghost_x, 18, EDI, OConst(18));\r\n $ghost__temp__3 := r.regs[EDI];\r\n assert !false;\r\n\r\n // binary_assignment:: $ghost__temp__12 := proc_Asm__BitwiseXor($ghost__temp__1, )\r\n call r, $ghost__temp__12 := proc_Asm__BitwiseXor(r, fun_Asm__RotateRight($ghost_x, 7), fun_Asm__RotateRight($ghost_x, 18), EAX, OReg(EDI));\r\n $ghost__temp__11 := r.regs[EAX];\r\n\r\n// // move:: $ghost__temp__12 := $ghost__temp__11 // isPtr = False\r\n// call r := instr_Mov(r, EDI, OReg(EAX));\r\n// $ghost__temp__12 := r.regs[EDI];\r\n// assert !false;\r\n\r\n// // move:: $ghost__temp__3 := $ghost_x // isPtr = False\r\n// call r := instr_Mov(r, EAX, OReg(EBX));\r\n// $ghost__temp__3 := r.regs[EAX];\r\n\r\n // binary_assignment:: $ghost__temp__3 := proc_Asm__RightShift($ghost__temp__3, )\r\n call r, $ghost__temp__3 := proc_Asm__RightShift(r, $ghost_x, 3, EBX, OConst(3));\r\n $ghost__temp__3 := r.regs[EBX];\r\n assert !false;\r\n\r\n // binary_assignment:: $ghost___result := proc_Asm__BitwiseXor($ghost__temp__12, )\r\n call r, $ghost__temp__11 := proc_Asm__BitwiseXor(r, fun_Asm__BitwiseXor(fun_Asm__RotateRight($ghost_x, 7), fun_Asm__RotateRight($ghost_x, 18)), fun_Asm__RightShift($ghost_x, 3), EAX, OReg(EBX));\r\n $ghost__temp__12 := r.regs[EAX];\r\n\r\n call proc_reveal__SSIG0();\r\n assert Eval(r, OReg(EAX)) == fun_SSIG0(curW);\r\n // call r := instr_Mov(r, EAX, OReg(EDI));\r\n\r\n\r\n// // push argument #0 at index 1 isPtr = False argument = $ghost__temp__12\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 4)) := EBX // var = $ghost__temp__12\r\n// call stk := logical_Store(r, core_state, stk, OMem(MReg(ESP, 4)), OReg(EBX));\r\n//\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 16)) := ECX // var = $ghost__temp__5\r\n// call stk := logical_Store(r, core_state, stk, OMem(MReg(ESP, 16)), OReg(ECX));\r\n//\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 12)) := EDX // var = $ghost_t\r\n// call stk := logical_Store(r, core_state, stk, OMem(MReg(ESP, 12)), OReg(EDX));\r\n//\r\n// // regalloc_stack_store:: OMem(MReg(ESP, 1052704)) := ESI // var = $ghost_W\r\n// call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 1052704)), OReg(ESI), EvalPtr(r, OMem(MReg(ESP, 1052704))), $ghost_W__abs);\r\n//\r\n// // call:: $ghost__temp__11 := Proc_SSIG0__impl($ghost__temp__12) // isGhost = False\r\n// call alignCall(r.regs[ESP]);\r\n// {: call r, stk := logical_Call(r, core_state, stk);\r\n// call r, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost__temp__11 := Proc_SSIG0__impl(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, $ghost__temp__12); :}\r\n// assert SMemInvGcF(24, stk, old(stk_old), r.regs[ESP] + 20, old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n//\r\n// // pop return value #0 at index 0 into destination $ghost__temp__11 isPtr = False\r\n// $ghost__temp__11 := stk.map[r.regs[ESP] + 0];\r\n//\r\n// // regalloc_stack_load:: EAX := OMem(MReg(ESP, 0)) // var = $ghost__temp__11 608\r\n// call r := logical_Load(r, core_state, stk, EAX, OMem(MReg(ESP, 0)));\r\n// assert !false;\r\n//\r\n// // regalloc_stack_load:: ECX := OMem(MReg(ESP, 16)) // var = $ghost__temp__5 609\r\n// call r := logical_Load(r, core_state, stk, ECX, OMem(MReg(ESP, 16)));\r\n\r\n call proc_reveal__SSIG0();\r\n // Result == EAX\r\n // need ECX == old(ECX)\r\n // need EDX == old(EDX)\r\n\r\n // binary_assignment:: $ghost__temp__4 := proc_Asm__Add($ghost__temp__5, )\r\n call r, $ghost__temp__4 := proc_Asm__Add(r, fun_Asm__Add(fun_SSIG1__impl(fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], (INTERNAL_sub_boogie($ghost_t, 2)))), fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], (INTERNAL_sub_boogie($ghost_t, 7)))), fun_SSIG0__impl(fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], (INTERNAL_sub_boogie($ghost_t, 15)))), ECX, OReg(EAX));\r\n $ghost__temp__5 := r.regs[ECX];\r\n\r\n // move:: $ghost__temp__4 := $ghost__temp__5 // isPtr = False\r\n call r := instr_Mov(r, EAX, OReg(ECX));\r\n $ghost__temp__4 := r.regs[EAX];\r\n assert !false;\r\n\r\n// // regalloc_stack_load:: EDX := OMem(MReg(ESP, 12)) // var = $ghost_t 610\r\n// call r := logical_Load(r, core_state, stk, EDX, OMem(MReg(ESP, 12)));\r\n\r\n // move:: $ghost__temp__15 := $ghost_t // isPtr = False\r\n call r := instr_Mov(r, ECX, OReg(EBP));\r\n $ghost__temp__15 := r.regs[ECX];\r\n\r\n // binary_assignment:: $ghost__temp__15 := instr_SubChecked($ghost__temp__15, )\r\n call r := instr_SubChecked(r, ECX, OConst(16));\r\n $ghost__temp__15 := r.regs[ECX];\r\n\r\n // regalloc_stack_load:: ESI := OMem(MReg(ESP, 1052704)) // var = $ghost_W 611\r\n// call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, ESI, OMem(MReg(ESP, 1052704)), EvalPtr(r, OMem(MReg(ESP, 1052704))));\r\n// $ghost_W__abs := frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, 1052704))));\r\n\r\n // loadArrayElement\r\n call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, EBX, OMem(MIndex(ESI, 4, ECX, 8)), $ghost__temp__15, $ghost_W__abs, r.regs[ESI]);\r\n $ghost__temp__14 := r.regs[EBX];\r\n\r\n // binary_assignment:: $ghost__temp__3 := proc_Asm__Add($ghost__temp__4, )\r\n call r, $ghost__temp__3 := proc_Asm__Add(r, fun_Asm__Add(fun_Asm__Add(fun_SSIG1__impl(fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], (INTERNAL_sub_boogie($ghost_t, 2)))), fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], (INTERNAL_sub_boogie($ghost_t, 7)))), fun_SSIG0__impl(fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], (INTERNAL_sub_boogie($ghost_t, 15))))), fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], (INTERNAL_sub_boogie($ghost_t, 16))), EAX, OReg(EBX));\r\n $ghost__temp__4 := r.regs[EAX];\r\n\r\n // move:: $ghost__temp__3 := $ghost__temp__4 // isPtr = False\r\n call r := instr_Mov(r, ECX, OReg(EAX));\r\n $ghost__temp__3 := r.regs[ECX];\r\n assert !false;\r\n\r\n // storeArrayElement\r\n call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, OMem(MIndex(ESI, 4, EBP, 8)), OReg(ECX), $ghost_t, $ghost__temp__3, $ghost_W__abs, r.regs[ESI]);\r\n\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 816\r\n // ###LINE: C:\\home\\git\\IroncladApps\\iron\\src\\Dafny\\Libraries\\Crypto\\Hash\\sha256opt.i.dfy: 816\r\n // binary_assignment:: $ghost_t := instr_AddChecked($ghost_t, )\r\n call r := instr_AddChecked(r, EBP, OConst(1));\r\n $ghost_t := r.regs[EBP];\r\n\r\n// // regalloc_move:: EAX := EDX\r\n// call r := instr_Mov(r, EAX, OReg(EDX));\r\n\r\n // regalloc_stack_store:: OMem(MReg(ESP, 1052704)) := ESI // var = $ghost_W\r\n// call mems, $stacksFrames := heapStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, OMem(MReg(ESP, 1052704)), OReg(ESI), EvalPtr(r, OMem(MReg(ESP, 1052704))), $ghost_W__abs);\r\n//\r\n // label:: L1 // isLoop = True\r\n L1:\r\n invariant MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n invariant NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n invariant SMemInvGcF(24, stk, old(stk_old), r.regs[ESP] + 20, old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n invariant HeapInv($absMem, objLayouts, heap);\r\n invariant AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n invariant (forall i:int::{$absMem[i]}{heap.absData[i]} heap_old.absData[i] is AbsNone || (heap.absData[i] == heap_old.absData[i] && ($absMem[i] == $absMem_old[i] || i == (($ghost_W).arrAbs))));\r\n invariant io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n\r\n // loop invariants\r\n invariant HeapValue(objLayouts, true, $toAbs, r.regs[ESI], $ghost_W__abs);\r\n invariant $ghost_t == (r.regs[EBP]);\r\n invariant StackAbsSlot(heap, $stacksFrames, EvalPtr(r, OMem(MReg(ESP, stackGcOffset+32)))) == Abs_ArrayOfInt($ghost_W);\r\n invariant frameGet($stacksFrames, EvalPtr(r, OMem(MReg(ESP, stackGcOffset+32)))) == $ghost_W.arrAbs;\r\n invariant (INTERNAL_le_boogie(16, $ghost_t)) && (INTERNAL_le_boogie($ghost_t, 64));\r\n invariant (forall $ghost__0_step:int :: ((INTERNAL_le_boogie(0, $ghost__0_step)) && (INTERNAL_lt_boogie($ghost__0_step, $ghost_t))) ==> (fun_Word32(fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost__0_step)))));\r\n invariant (forall $ghost__1_step:int :: {fun_TStep($ghost__1_step)} ((fun_TStep($ghost__1_step)) && ((INTERNAL_le_boogie(0, $ghost__1_step)) && (INTERNAL_lt_boogie($ghost__1_step, 16)))) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost__1_step))) == (fun_Seq__Index___int(fun_Seq__Index___Seq___int((M#SHA256Trace_c($ghost_z)), $ghost_currentBlock), $ghost__1_step))));\r\n invariant (forall $ghost__2_step:int :: {fun_TStep($ghost__2_step)} ((fun_TStep($ghost__2_step)) && ((INTERNAL_le_boogie(16, $ghost__2_step)) && (INTERNAL_lt_boogie($ghost__2_step, $ghost_t)))) ==> ((fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], ($ghost__2_step))) == (fun_Asm__Add(fun_Asm__Add(fun_Asm__Add(fun_SSIG1(fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], (INTERNAL_sub_boogie($ghost__2_step, 2)))), fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], (INTERNAL_sub_boogie($ghost__2_step, 7)))), fun_SSIG0(fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], (INTERNAL_sub_boogie($ghost__2_step, 15))))), fun_INTERNAL__array__elems__index($absMem[$ghost_W.arrAbs], (INTERNAL_sub_boogie($ghost__2_step, 16)))))));\r\n assert !false;\r\n call proc_Seq__Equal__Equiv___int();\r\n call proc_Seq__Equal__Equiv___Seq___int();\r\n call proc_Seq__Equal__Equiv___atoh_Type();\r\n call proc_Seq__Equal__Equiv___Seq___atoh_Type();\r\n call proc_Seq__Equal__Equiv___bool();\r\n // jump_to_label:: L0 condition = $ghost_t < 64\r\n call r := instr_Cmp(r, EBP, OConst(64)); if (Jb(r.efl)) { goto L0; }\r\n\r\n // label:: L2 // isLoop = False\r\n L2:\r\n call r := logical_Add(r, ESP, OConst(20));\r\n\r\n // return\r\n {: call r := logical_Ret(r, core_state, stk); return; :}\r\n}\r\n}\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/mul_plan.txt", "content": "\n\nMulOpt:\n mhi, mlo := Mul64(aj, bv)\n edx, eax\n\n add1 := Add(mlo, lastcarry)\n mhi := AddCarry(mhi,0)\n newcj := AddCarry(add1, lastcj)\n mhi := AddCarry(mhi,0) // == newcarry\n\n\nSuppose on input:\n eax == aj\n ebx == lastcarry\n ecx == lastcj\n edx == bv\n\nThen we have:\n edx, eax := Mul64(eax, edx);\n eax(mlo) := eax + ebx (lastcarry)\n edx(mhi) := AddCarry(edx, 0);\n ecx(newcj) := AddCarry(ecx, eax(add1));\n edx(newcarry) := AddCarry(edx, 0);\n\nEnsures:\n ecx == newcj // Written out to memory\n edx == newcarry // Need to move this to ebx for next call :-/\n\n\n\n\nLoop Plan:\n Need to hold pointer to a: \n Starts at a.Length-1-0. \n Then we sub 1 per iteration. \n Last iter is a.Length-1-(adigits-1) = a.Length - adigits \n Need to hold pointer to c: Starts at c.Length-1-(0+bi). Then we sub 1 per iteration \n Need to hold loop bound: aptr >= a.Length - adigits\n ---------------\n This requires 3 registers\n\n To hold the bv value in CPU, we need a 4th register\n\n Have to hold the value from a array and c array => 2 more registers\n Have to hold the previous carry => 1 more register\n\n And Mul64 is going to clobber eax and edx\n - Okay to clobber the value in aj (eax), but what can we clobber in edx?\n\nPlan:\n Setup the array pointers. (edi, esi)\n Compute the loop bound (ebx)\n Load bv (ebp)\n lastcarry (ecx) := 0\n\n ----> That only leaves eax, edx available!\n\n in the loop:\n Load from a into eax (aj)\n\n edx, eax := Mul64(eax, ebp)\n eax(mlo) := eax + ecx (lastcarry) // ecx now free\n edx(mhi) := AddCarry(edx, 0);\n\n Load from c into ecx (lastcj)\n ecx(newcj) := AddCarry(ecx, eax(add1));\n Store ecx back into c\n\n edx(newcarry) := AddCarry(edx, 0);\n ecx := edx; // Move newcarry out of the way for the next loop\n\n subtract 4 from a ptr (edi) and c ptr (esi)\n\n\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/sha256opt2.plan", "content": "\r\neax, ebx, ecx, edx, edi, esi, ebp\r\n\r\nNOTES/TODO:\r\n- For each variable that needs to be propagated, \r\n I should write it to the correct location on the stack for the next round\r\n immediately after reading it. That way, I don't need to hold onto it any longer than necessary\r\n - If we do that with b and c, we may be able to save a register\r\n\r\n-------------------------------------------------------------------\r\n- The block below requires 3 registers, if we want to keep a alive\r\n-------------------------------------------------------------------\r\nr1 <- Load a\r\nStore r1\r\nr2 <- r1\r\nr3 <- r1\r\nr2 <- RotateRight(r2, 2)\r\nr3 <- RotateRight(r3, 13)\r\nr2 <- r2 xor r3\r\nr3 <- r1\r\nr3 <- RotateRight(r3, 22)\r\nr2 <- r2 xor r3 // == bsig0\r\n------------------------------------- \r\nAfter above block:\r\nLive: \r\n r1 == a\r\n r2 == bsig0\r\n------------------------------------- \r\n\r\nAssuming r1 holds a:\r\nr3 <- Load b\r\nStore r3\r\nr4 <- r1\r\nr1 <- And(r1, r3) // a & b\r\nr3 <- Load c\r\nStore r3\r\nr4 <- And(r4, r3) // a & c\r\n\r\n\r\nNeed to hold: bsig0, a, b, and (a & b), since we need to combine c with a and with b\r\n - Do this before we calculate bsig0?\r\n\r\n\r\nr4 <- Load c\r\nStore r4\r\nr5 <- r1\r\nr5 <- r1 and r3 == a & b\r\nr6 <- r1\r\nr6 <- r1 and r4 == a & c\r\nr5 <- r5 xor r6\r\nr6 <- r3\r\nr6 <- r6 and r4 == b & c\r\nr5 <- r5 xor r6\r\n\r\n------------------------------------- \r\nAfter above block:\r\nLive: \r\n r1 == a\r\n r2 == bsig0\r\n r3 == b\r\n r4 == c\r\n r5 == my_maj\r\n------------------------------------- \r\n\r\nr2 <- Add(r2, r5) // T2\r\n\r\n------------------------------------- \r\nAfter above block:\r\nLive: \r\n r1 == a\r\n r2 == T2\r\n r3 == b\r\n r4 == c\r\n-------------------------------------\r\nAfter this point, we don't need a, b, or c any more, \r\nso write them back to the stack\r\n Store r1\r\n Store r3\r\n Store r4\r\n------------------------------------- \r\nAfter above block:\r\nLive: \r\n r2 == T2\r\n------------------------------------- \r\n// Calculate bsig1\r\n r1 <- Load e\r\n r3 <- r1\r\n r4 <- r1\r\n r3 <- RotateRight(r3, 6)\r\n r4 <- RotateRight(r4, 11)\r\n r3 <- r3 xor r4 \r\n r4 <- r1\r\n r4 <- RotateRight(r4, 25)\r\n r3 <- r3 xor r4 // == bsig1\r\n------------------------------------- \r\nAfter above block:\r\nLive: \r\n r1 == e\r\n r2 == T2\r\n r3 == bsig1\r\n------------------------------------- \r\n// Calculate my_ch\r\n// Assume e is already stored\r\n r4 <- r1\r\n r5 <- Load f\r\n Store r5\r\n r4 <- r4 and r5\r\n r1 <- not r1\r\n r5 <- Load g\r\n Store r5\r\n r1 <- r1 and r5\r\n r4 <- r4 xor r1 // my_ch\r\n------------------------------------- \r\nAfter above block:\r\nLive: \r\n r2 == T2\r\n r3 == bsig1\r\n r4 == my_ch\r\n------------------------------------- \r\n// Calculate T1\r\n r1 <- Load h\r\n r1 <- Add(r1, r3) // Frees up r3\r\n r1 <- Add(r1, r4) // Frees up r4 // Do some of this sooner?\r\n r1 <- Add(r1, Kconst)\r\n r3 <- Load(Wregister, currentStepConst)\r\n r1 <- Add(r1, r3) // T1\r\n------------------------------------- \r\nAfter above block:\r\nLive: \r\n r1 == T1\r\n r2 == T2\r\n------------------------------------- \r\n r2 <- r2 + r1 // May need a commutativity proof?\r\n Store r2 // T1 + T2 == a_next\r\n r2 <- Load d\r\n r1 <- r1 + r2 // May need a commutativity proof?\r\n Store r1 as e_next\r\n \r\n\r\n\r\n\r\n\r\n// Uses a\r\n// var bsig0 := Asm_BitwiseXor(Asm_BitwiseXor(Asm_RotateRight(a, 2), Asm_RotateRight(a, 13)), Asm_RotateRight(a, 22));\r\n\r\n// Uses e\r\n// var bsig1 := Asm_BitwiseXor(Asm_BitwiseXor(Asm_RotateRight(e, 6), Asm_RotateRight(e, 11)), Asm_RotateRight(e, 25));\r\n\r\n// Uses e, f, g\r\n// var my_ch := Asm_BitwiseXor(Asm_BitwiseAnd(e, f), Asm_BitwiseAnd(Asm_BitwiseNot(e), g));\r\n\r\n// Uses a, b, c\r\n// var my_maj := Asm_BitwiseXor(Asm_BitwiseXor(Asm_BitwiseAnd(a, b), Asm_BitwiseAnd(a, c)), Asm_BitwiseAnd(b, c));\r\n\r\n// Uses h\r\n// var T1 := Asm_Add(Asm_Add(Asm_Add(Asm_Add(h, bsig1), my_ch), Ks[currentStep]), W[currentStep]);\r\n\r\n// var T2 := Asm_Add(bsig0, my_maj);\r\n\r\n// Uses d\r\n a_next, b_next, c_next, d_next, e_next, f_next, g_next, h_next := Asm_Add(T1, T2), a, b, c, Asm_Add(d, T1), e, f, g;\r\n\r\n" }, { "path": "ironclad-apps/src/Checked/Nucleus/Main/sha256opt2.plan2", "content": "\r\nWe need to use 5 registers out of the following 7:\r\n eax, ebx, ecx, edx, edi, esi, ebp\r\n r1, r2, r3, r4, r5\r\n\r\nInitially, we can use the extra to point to Ks and W\r\n\r\nEventually, we should hard-code the Ks, giving us an extra register\r\n - Use it to keep one state var? Not sure it matters which.\r\n\r\n----------------------------------------------------------\r\nStart with my_maj. Uses 4 registers. Preserves a in r1\r\n----------------------------------------------------------\r\nr1 <- Load a\r\nStore r1\r\nr2 <- Load b\r\nStore r2\r\nr3 <- Load c\r\nStore r3\r\nr4 <- r2\r\nr2 <- And(r2, r1) // b & a // Need commutativity\r\nr4 <- And(r4, r3) // b & c\r\nr3 <- And(r3, r1) // c & a // Need commutativity\r\nr2 <- Xor(r2, r3)\r\nr2 <- Xor(r2, r4) // my_maj\r\n------------------------------------- \r\nAfter above block, live: \r\n r1 == a\r\n r2 == my_maj\r\n------------------------------------- \r\n// Calculate bsig0\r\nr3 <- r1\r\nr4 <- r1\r\nr1 <- RotateRight(r1, 2)\r\nr3 <- RotateRight(r3, 13)\r\nr1 <- r1 xor r3\r\nr4 <- RotateRight(r4, 22)\r\nr1 <- r1 xor r4 // == bsig0\r\nr1 <- Add(r1, r2) // == T2\r\n------------------------------------- \r\nAfter above block, live: \r\n r1 == T2\r\n------------------------------------- \r\n// Calculate my_ch\r\n r2 <- Load e\r\n Store e\r\n r4 <- r2\r\n r4 <- not r4\r\n r3 <- Load g\r\n Store r3\r\n r4 <- And(r4, r3) // !e & g\r\n r3 <- Load f\r\n Store r3\r\n r3 <- And(r3, r2) // f & e // Need commutativity\r\n r3 <- Xor(r3, r4) // my_ch // Need commutativity\r\n------------------------------------- \r\nAfter above block, live: \r\n r1 == T2\r\n r2 == e\r\n r3 == my_ch\r\n------------------------------------- \r\n // Calculate bsig1 \r\n r4 <- r2\r\n r5 <- r2\r\n r4 <- RotateRight(r4, 6)\r\n r5 <- RotateRight(r5, 11)\r\n r4 <- r4 xor r5 \r\n r2 <- RotateRight(r2, 25)\r\n r4 <- r4 xor r2 // == bsig1\r\n------------------------------------- \r\nAfter above block, live: \r\n r1 == T2\r\n r3 == my_ch\r\n r4 == bsig1\r\n------------------------------------- \r\n// Calculate T1\r\n r2 <- Load h\r\n r2 <- Add(r2, r4) // Frees r4\r\n r2 <- Add(r2, r3) // Frees r3\r\n r2 <- Add(r2, Kconst)\r\n r3 <- Load(Wregister, currentStepConst)\r\n r2 <- Add(r2, r3) // T1\r\n------------------------------------- \r\nAfter above block, live: \r\n r1 == T2\r\n r2 == T1\r\n------------------------------------- \r\n r1 <- r1 + r2 // T2 + T1 == a_next // May need a commutivity proof\r\n Store r1\r\n r1 <- Load d\r\n r1 <- r1 + r2 // d + T1\r\n Store r1 as e_next\r\n\r\n\r\n// Uses a\r\n// var bsig0 := Asm_BitwiseXor(Asm_BitwiseXor(Asm_RotateRight(a, 2), Asm_RotateRight(a, 13)), Asm_RotateRight(a, 22));\r\n\r\n// Uses e\r\n// var bsig1 := Asm_BitwiseXor(Asm_BitwiseXor(Asm_RotateRight(e, 6), Asm_RotateRight(e, 11)), Asm_RotateRight(e, 25));\r\n\r\n// Uses e, f, g\r\n// var my_ch := Asm_BitwiseXor(Asm_BitwiseAnd(e, f), Asm_BitwiseAnd(Asm_BitwiseNot(e), g));\r\n\r\n// Uses a, b, c\r\n// var my_maj := Asm_BitwiseXor(Asm_BitwiseXor(Asm_BitwiseAnd(a, b), Asm_BitwiseAnd(a, c)), Asm_BitwiseAnd(b, c));\r\n\r\n// Uses h\r\n//var T1 := Asm_Add(Asm_Add(Asm_Add(Asm_Add(h, bsig1), my_ch), Ks[currentStep]), W[currentStep]);\r\n\r\n//var T2 := Asm_Add(bsig0, my_maj);\r\n\r\n// Uses d\r\n a_next, b_next, c_next, d_next, e_next, f_next, g_next, h_next := Asm_Add(T1, T2), a, b, c, Asm_Add(d, T1), e, f, g;\r\n\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchSpec.py", "content": "\r\nSUT_IP=\"157.54.148.142\"\r\n\r\n\r\n# Converted (manually) from BenchmarkList.i.dfy\r\nBenchmarkList = {\r\n\"Nothing\" : 0,\r\n\"Sha1\" : 1,\r\n\"Sha256\" : 2,\r\n\"RsaKeyGen\" : 3,\r\n\"RsaEncrypt\" : 4,\r\n\"RsaDecrypt\" : 5,\r\n\"RsaDigestedSign\" : 6,\r\n\"RsaDigestedVerify\" : 7,\r\n\"TpmExtractRandom\" : 8,\r\n\"ByteSeqToWordSeq\" : 9,\r\n\"WordSeqToByteSeq\" : 10,\r\n#\"Sha1Raw\" : 11,\r\n#\"Sha256Raw\" : 12,\r\n\"DuplicateArray\" : 13,\r\n\"Max\" : 14,\r\n}\r\n\r\nclass BenchSpec():\r\n\tdef __init__(self, benchmark, iterations, key_length, message_length, use_words=False, use_original=False, annotation=\"\", elapsed_time=None):\r\n\t\tself.benchmark = benchmark\r\n\t\tself.iterations = iterations\r\n\t\tself.key_length = key_length\r\n\t\tself.message_length = message_length\r\n\t\tself.use_words = use_words\r\n\t\tself.use_original = use_original\r\n\t\tself.annotation = annotation\r\n\t\tself.elapsed_time = elapsed_time\r\n\r\n\tdef tuple(self):\r\n\t\treturn (self.benchmark, self.iterations, self.key_length, self.message_length, self.use_words, self.use_original, self.annotation, self.elapsed_time)\r\n\r\n\tdef __repr__(self):\r\n\t\treturn \"BenchSpec\"+str(self.tuple())+\",\"\r\n\r\n\tdef spec_tuple(self):\r\n\t\treturn (self.benchmark, self.iterations, self.key_length, self.message_length, self.use_words, self.use_original, self.annotation)\r\n\r\n\tdef compatible(self, other):\r\n\t\treturn self.spec_tuple() == other.spec_tuple()\r\n\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkAnalyzer.py", "content": "#!/usr/bin/python\r\n\r\nimport re\r\nfrom numpy import *\r\nfrom BenchSpec import BenchSpec\r\n\r\ndata = [\r\n#BenchSpec('RsaKeyGen', 1, 1024, '', 194.5417),\r\n#BenchSpec('RsaKeyGen', 1, 1024, '', 277.6209),\r\n#BenchSpec('RsaKeyGen', 1, 1024, '', 479.9764),\r\n#BenchSpec('RsaKeyGen', 1, 1024, '', 410.7493),\r\n#BenchSpec('RsaKeyGen', 1, 1024, '', 995.0421),\r\n#BenchSpec('RsaKeyGen', 1, 1024, '', 185.5208),\r\n#BenchSpec('RsaKeyGen', 1, 1024, '', 271.9875),\r\n#BenchSpec('RsaKeyGen', 1, 1024, '', 214.8805),\r\n#BenchSpec('RsaKeyGen', 1, 1024, '', 243.2842),\r\n#BenchSpec('RsaKeyGen', 1, 1024, '', 471.1768),\r\n#\r\n## Before Canonicalizing\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 16.77731),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 29.44297),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 25.03836),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 13.80892),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 7.543423),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 20.06039),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 73.0106),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 17.2482),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 23.70473),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 26.22202),\r\n#\r\n## After Canonicalizing\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 25.52086),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 40.67058),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 12.83777),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 11.71982),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 31.66075),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 17.82285),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 9.800225),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 8.215545),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 11.95486),\r\n#BenchSpec('RsaKeyGen', 1, 512, '', 6.170479),\r\n#\r\n#BenchSpec('RsaDecrypt', 8, 32, '', 3.906329),\r\n#BenchSpec('RsaDecrypt', 8, 32, '', 3.906904),\r\n#BenchSpec('RsaDecrypt', 8, 32, '', 3.907146),\r\n#BenchSpec('RsaDecrypt', 8, 32, '', 3.907072),\r\n#BenchSpec('RsaDecrypt', 8, 32, '', 3.906528),\r\n#BenchSpec('RsaDecrypt', 8, 32, '', 3.906117),\r\n#BenchSpec('RsaDecrypt', 8, 32, '', 3.904497),\r\n#BenchSpec('RsaDecrypt', 8, 32, '', 3.904088),\r\n#BenchSpec('RsaDecrypt', 8, 32, '', 3.907179),\r\n#BenchSpec('RsaDecrypt', 8, 32, '', 3.906088),\r\n#\r\n#BenchSpec('RsaEncrypt', 8, 32, '', 0.9219429),\r\n#BenchSpec('RsaEncrypt', 8, 32, '', 0.9286233),\r\n#BenchSpec('RsaEncrypt', 8, 32, '', 0.9285086),\r\n#BenchSpec('RsaEncrypt', 8, 32, '', 0.9285977),\r\n#BenchSpec('RsaEncrypt', 8, 32, '', 0.9280463),\r\n#BenchSpec('RsaEncrypt', 8, 32, '', 0.927805),\r\n#BenchSpec('RsaEncrypt', 8, 32, '', 0.9287491),\r\n#BenchSpec('RsaEncrypt', 8, 32, '', 0.9285343),\r\n#BenchSpec('RsaEncrypt', 8, 32, '', 0.9285265),\r\n#BenchSpec('RsaEncrypt', 8, 32, '', 0.9286342),\r\n#\r\n#BenchSpec('RsaKeyGen', 1, 1024, '', 327.0056),\r\n#BenchSpec('RsaDecrypt', 8, 64, '', 49.4005),\r\n#BenchSpec('RsaEncrypt', 8, 64, '', 2.30449),\r\n#BenchSpec('RsaDecrypt', 8, 64, '', 49.41412),\r\n#BenchSpec('RsaEncrypt', 8, 64, '', 2.304769),\r\n#BenchSpec('RsaDecrypt', 8, 64, '', 49.40992),\r\n#BenchSpec('RsaEncrypt', 8, 64, '', 2.304908),\r\n#BenchSpec('RsaDecrypt', 8, 64, '', 49.4192),\r\n#BenchSpec('RsaEncrypt', 8, 64, '', 2.305215),\r\n#BenchSpec('RsaDecrypt', 8, 64, '', 49.41233),\r\n#BenchSpec('RsaEncrypt', 8, 64, '', 2.304783),\r\n#BenchSpec('RsaDecrypt', 8, 64, '', 49.41201),\r\n#BenchSpec('RsaEncrypt', 8, 64, '', 2.304904),\r\n#BenchSpec('RsaDecrypt', 8, 64, '', 49.40812),\r\n#BenchSpec('RsaEncrypt', 8, 64, '', 2.306457),\r\n#BenchSpec('RsaDecrypt', 8, 64, '', 49.4155),\r\n#BenchSpec('RsaEncrypt', 8, 64, '', 2.305282),\r\n#BenchSpec('RsaDecrypt', 8, 64, '', 49.41673),\r\n#BenchSpec('RsaEncrypt', 8, 64, '', 2.304551),\r\n#BenchSpec('RsaDecrypt', 8, 64, '', 49.41605),\r\n#BenchSpec('RsaEncrypt', 8, 64, '', 2.304723),\r\n#\r\n## After Add32_unrolled_8 optimization, setting MR to 8.\r\n#BenchSpec('RsaKeyGen-u', 4, 512, '', 80.74383),\r\n#BenchSpec('RsaKeyGen-u', 4, 512, '', 73.37518),\r\n#BenchSpec('RsaKeyGen-u', 4, 512, '', 58.45101),\r\n#BenchSpec('RsaKeyGen-u', 4, 512, '', 60.88408),\r\n#BenchSpec('RsaKeyGen-u', 4, 512, '', 64.99814),\r\n#BenchSpec('RsaKeyGen-u', 4, 512, '', 48.6908),\r\n#BenchSpec('RsaKeyGen-u', 4, 512, '', 35.17658),\r\n#BenchSpec('RsaKeyGen-u', 4, 512, '', 70.93044),\r\n#BenchSpec('RsaKeyGen-u', 4, 512, '', 88.05916),\r\n#BenchSpec('RsaKeyGen-u', 4, 1024, '', 592.9341),\r\n#BenchSpec('RsaKeyGen-u', 4, 1024, '', 1156.92),\r\n#\r\n#BenchSpec('RsaKeyGen-v', 4, 512, '', 203.6944),\r\n#BenchSpec('RsaKeyGen-v', 4, 512, '', 142.6029),\r\n#BenchSpec('RsaKeyGen-v', 4, 512, '', 328.2928),\r\n#BenchSpec('RsaKeyGen-v', 4, 512, '', 186.0192),\r\n#BenchSpec('RsaKeyGen-v', 4, 512, '', 178.2307),\r\n#BenchSpec('RsaKeyGen-v', 4, 512, '', 188.0875),\r\n#BenchSpec('RsaKeyGen-v', 4, 512, '', 181.3387),\r\n#BenchSpec('RsaKeyGen-v', 4, 512, '', 144.2986),\r\n#BenchSpec('RsaKeyGen-v', 4, 512, '', 306.3781),\r\n#BenchSpec('RsaKeyGen-v', 4, 512, '', 94.22977),\r\n#BenchSpec('RsaKeyGen-v', 4, 512, '', 208.8214),\r\n#\r\n#BenchSpec('RsaDecrypt-v', 8, 32, '', 8.302419),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, '', 0.9127128),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, '', 8.301742),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, '', 0.9122038),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, '', 8.302255),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, '', 0.9126821),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, '', 8.301459),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, '', 0.9123324),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, '', 8.301554),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, '', 0.9124045),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, '', 8.301258),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, '', 0.9122229),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, '', 8.302022),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, '', 0.9121833),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, '', 8.301646),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, '', 0.912534),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, '', 8.302246),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, '', 0.9125597),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, '', 8.301321),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, '', 0.9054516),\r\n#\r\n#BenchSpec('RsaKeyGen-v', 1, 512, '', 36.56007),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, 'key_size_bits=512', 8.084312),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, 'key_size_bits=512', 0.9064715),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, 'key_size_bits=512', 8.084259),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, 'key_size_bits=512', 0.9062216),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, 'key_size_bits=512', 8.084807),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, 'key_size_bits=512', 0.9061556),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, 'key_size_bits=512', 8.084284),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, 'key_size_bits=512', 0.906733),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, 'key_size_bits=512', 8.084139),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, 'key_size_bits=512', 0.9060693),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, 'key_size_bits=512', 8.084414),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, 'key_size_bits=512', 0.9062116),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, 'key_size_bits=512', 8.084597),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, 'key_size_bits=512', 0.9064325),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, 'key_size_bits=512', 8.084273),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, 'key_size_bits=512', 0.8996112),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, 'key_size_bits=512', 8.084738),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, 'key_size_bits=512', 0.9063217),\r\n#BenchSpec('RsaDecrypt-v', 8, 32, 'key_size_bits=512', 8.0843),\r\n#BenchSpec('RsaEncrypt-v', 8, 32, 'key_size_bits=512', 0.9063667),\r\n\r\n# After enabling reciprocal estimator and fleetnatmul together (b3b8b0595701d467d8d7d432d673a8af9c3afb5f)\r\n#BenchSpec('RsaKeyGen', 1, 1024, 0, False, False, '', 12.13395),\r\n#BenchSpec('RsaDecrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.7093437),\r\n#BenchSpec('RsaEncrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.2144841),\r\n#BenchSpec('RsaDecrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.7089711),\r\n#BenchSpec('RsaEncrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.2206407),\r\n#BenchSpec('RsaDecrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.7149615),\r\n#BenchSpec('RsaEncrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.2142338),\r\n#BenchSpec('RsaDecrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.7045),\r\n#BenchSpec('RsaEncrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.2206872)\r\n\r\n# After enabling optimized assembly code for mul inner loop (725911c92ba3c3b54d9332c24fc50a26c8b2bdfe)\r\nBenchSpec('RsaKeyGen', 1, 1024, 0, False, False, '', 27.34745),\r\nBenchSpec('RsaDecrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.1813447),\r\nBenchSpec('RsaEncrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.2059516),\r\nBenchSpec('RsaDecrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.18114),\r\nBenchSpec('RsaEncrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.2123457),\r\nBenchSpec('RsaDecrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.1819137),\r\nBenchSpec('RsaEncrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.2059879),\r\nBenchSpec('RsaDecrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.1821488),\r\nBenchSpec('RsaEncrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.2059782),\r\nBenchSpec('RsaDecrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.1858502),\r\nBenchSpec('RsaEncrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.212652),\r\nBenchSpec('RsaDecrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.1829405),\r\nBenchSpec('RsaEncrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.2059838),\r\nBenchSpec('RsaDecrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.1820654),\r\nBenchSpec('RsaEncrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.2126007),\r\nBenchSpec('RsaDecrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.1808525),\r\nBenchSpec('RsaEncrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.2060691),\r\nBenchSpec('RsaDecrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.1799968),\r\nBenchSpec('RsaEncrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.2058071),\r\nBenchSpec('RsaDecrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.1813919),\r\nBenchSpec('RsaEncrypt', 8, 1024, 64, False, False, 'key_size_bits=1024', 0.2059153),\r\n\r\n]\r\n\r\ndef parse_openssl(label, text):\r\n\tdata = []\r\n#\tmo = re.compile(\"-DOPENSSL_(IA32_\\S*)\", re.MULTILINE).search(text)\r\n#\tconfig = mo.groups(0)[0]\r\n\treob = re.compile(\"Doing (.*) for .*s on (.*) size blocks: (\\S*) .*in (.*)s\")\r\n\tfor line in text.split(\"\\n\"):\r\n\t\tline = line.strip()\r\n\t\tmo = reob.search(line)\r\n\t\tif (mo!=None):\r\n\t\t\tbenchmark,block_size,iterations,elapsed_time = mo.groups(0)\r\n\t\t\tdata += [BenchSpec(\r\n\t\t\t\t\"%s-%s\" % (benchmark.capitalize(), label),\r\n\t\t\t\tint(iterations),\r\n\t\t\t\tint(block_size),\r\n\t\t\t\tfloat(elapsed_time))]\r\n\treturn data\r\n\r\ndata += parse_openssl(\"openssl-101g-noasm\", \"\"\"\r\n\t\tjonh@bilbao:~/openssl-1.0.1g$ ./apps/openssl speed sha1 sha256\r\nWARNING: can't open config file: /usr/local/ssl/openssl.cnf\r\nDoing sha1 for 3s on 16 size blocks: 2710384 sha1's in 3.00s\r\nDoing sha1 for 3s on 64 size blocks: 2021935 sha1's in 3.00s\r\nDoing sha1 for 3s on 256 size blocks: 1142245 sha1's in 3.00s\r\nDoing sha1 for 3s on 1024 size blocks: 417454 sha1's in 3.00s\r\nDoing sha1 for 3s on 8192 size blocks: 60375 sha1's in 3.00s\r\nDoing sha256 for 3s on 16 size blocks: 3497661 sha256's in 3.00s\r\nDoing sha256 for 3s on 64 size blocks: 2048970 sha256's in 3.00s\r\nDoing sha256 for 3s on 256 size blocks: 908001 sha256's in 3.00s\r\nDoing sha256 for 3s on 1024 size blocks: 282259 sha256's in 2.99s\r\nDoing sha256 for 3s on 8192 size blocks: 37976 sha256's in 3.00s\r\nOpenSSL 1.0.1g 7 Apr 2014\r\nbuilt on: Fri Apr 25 17:21:07 PDT 2014\r\noptions:bn(64,32) rc4(idx,int) des(ptr,risc1,16,long) aes(partial) idea(int) blowfish(idx)\r\ncompiler: gcc -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall\r\nThe 'numbers' are in 1000s of bytes per second processed.\r\ntype 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes\r\nsha1 14455.38k 43134.61k 97471.57k 142490.97k 164864.00k\r\nsha256 18654.19k 43711.36k 77482.75k 96666.63k 103699.80k\r\n\"\"\")\r\n\r\ndata += parse_openssl(\"openssl-101g-sse2\", \"\"\"\r\njonh@bilbao:~/openssl-1.0.1g-sse2$ ./apps/openssl speed sha1 sha256\r\nWARNING: can't open config file: /usr/local/ssl/openssl.cnf\r\nDoing sha1 for 3s on 16 size blocks: 4441307 sha1's in 3.00s\r\nDoing sha1 for 3s on 64 size blocks: 3619553 sha1's in 3.00s\r\nDoing sha1 for 3s on 256 size blocks: 2350814 sha1's in 3.00s\r\nDoing sha1 for 3s on 1024 size blocks: 977702 sha1's in 3.00s\r\nDoing sha1 for 3s on 8192 size blocks: 152203 sha1's in 3.00s\r\nDoing sha256 for 3s on 16 size blocks: 5747552 sha256's in 2.99s\r\nDoing sha256 for 3s on 64 size blocks: 3207098 sha256's in 3.00s\r\nDoing sha256 for 3s on 256 size blocks: 1355615 sha256's in 3.00s\r\nDoing sha256 for 3s on 1024 size blocks: 413892 sha256's in 3.00s\r\nDoing sha256 for 3s on 8192 size blocks: 55292 sha256's in 3.00s\r\nOpenSSL 1.0.1g 7 Apr 2014\r\nbuilt on: Fri Apr 25 17:32:19 PDT 2014\r\noptions:bn(64,32) rc4(8x,mmx) des(ptr,risc1,16,long) aes(partial) idea(int) blowfish(idx)\r\ncompiler: gcc -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM\r\nThe 'numbers' are in 1000s of bytes per second processed.\r\ntype 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes\r\nsha1 23686.97k 77217.13k 200602.79k 333722.28k 415615.66k\r\nsha256 30756.13k 68418.09k 115679.15k 141275.14k 150984.02k\r\n\"\"\")\r\n\r\ndata += parse_openssl(\"polarssl-1.3.6-O2\", \"\"\"\r\njonh@bilbao:~/polarssl-speedtest$ ./polarssl-speedtest\r\nDoing sha1 for awhiles on 16 size blocks: 6000000 sha1's in 2.847s\r\nDoing sha1 for awhiles on 64 size blocks: 3500000 sha1's in 2.944s\r\nDoing sha1 for awhiles on 256 size blocks: 2000000 sha1's in 3.944s\r\nDoing sha1 for awhiles on 1024 size blocks: 500000 sha1's in 3.238s\r\nDoing sha1 for awhiles on 8192 size blocks: 70000 sha1's in 3.409s\r\nDoing sha256 for awhiles on 16 size blocks: 6000000 sha256's in 3.188s\r\nDoing sha256 for awhiles on 64 size blocks: 3500000 sha256's in 3.329s\r\nDoing sha256 for awhiles on 256 size blocks: 1500000 sha256's in 3.333s\r\nDoing sha256 for awhiles on 1024 size blocks: 400000 sha256's in 2.933s\r\nDoing sha256 for awhiles on 8192 size blocks: 50000 sha256's in 2.748s\r\n\"\"\")\r\n\r\nbenchmarks = list(set(map(lambda b: b.benchmark, data)))\r\nbenchmarks.sort()\r\n\r\ndef Mean(benchmark, points):\r\n\tA = array(points)\r\n\tX = A[:,0]\r\n\tY = A[:,1]\r\n\tprint \"%s @ x=%s\" % (benchmark, X[0])\r\n\tprint \" mean %f std %f (%.0f%%)\" % (\r\n\t\tmean(Y), std(Y), 100.0*std(Y)/mean(Y))\r\n\r\ndef Means(benchmark, points):\r\n\tA = array(points)\r\n\tX = A[:,0]\r\n\tY = A[:,1]\r\n\txs = list(set(X))\r\n\txs.sort()\r\n\tfor x in xs:\r\n\t\tsubpoints = filter(lambda p: p[0]==x, points)\r\n\t\tMean(benchmark, subpoints)\r\n\r\ndef LinearRegression(benchmark, points):\r\n\tA = array(points)\r\n\tX = A[:,0]\r\n\tY = A[:,1]\r\n\tX1 = array([ X, ones(len(X)) ])\r\n\tw = linalg.lstsq(X1.T,Y)[0]\r\n\tprint benchmark\r\n\tprint \" %f ns s/B b=%f ns\" % (w[0]*1e9, w[1]*1e9)\r\n\t#print w\r\n\r\nfor benchmark in benchmarks:\r\n\tprint \"==>\",benchmark\r\n\tpoints = map(lambda b: (b.message_length, b.elapsed_time/b.iterations),\r\n\t\t\tfilter(lambda b: b.benchmark==benchmark, data))\r\n\tif (benchmark.startswith(\"Sha\")):\r\n\t\tLinearRegression(benchmark, points)\r\n\telse:\r\n\t\tMeans(benchmark, points)\r\n\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkDriver.py", "content": "#!/usr/bin/python\r\n\r\nimport subprocess\r\nimport re\r\nfrom BenchSpec import *\r\n\r\nclass HelpfulRE:\r\n\tdef __init__(self, pattern):\r\n\t\tself.pattern = pattern\r\n\t\tself.reob = re.compile(pattern, re.MULTILINE)\r\n\r\nclass BenchmarkDriver:\r\n\tdef __init__(self):\r\n\t\tself.re_elapsed_time = HelpfulRE(\"^Elapsed Time.*: (.*)$\")\r\n\r\n\t\tself.suite3()\r\n\r\n\tdef regrab(self, text, re):\r\n\t\tmo = re.reob.search(text)\r\n\t\tif (mo==None):\r\n\t\t\tprint text\r\n\t\t\traise Exception(\"Failed to find %s\" % re.pattern)\r\n\t\treturn mo.groups(0)[0]\r\n\r\n\tdef execute_test(self, spec):\r\n\t\ttest_id = BenchmarkList[spec.benchmark]\r\n\t\tcmd = [\"./BenchmarkRequestCmd/bin/Debug/BenchmarkRequestCmd.exe\", SUT_IP, str(test_id), str(spec.iterations), str(spec.key_length), str(spec.message_length), str(1 if spec.use_words else 0), str(1 if spec.use_original else 0)]\r\n\t\tprint \"sending: %s\" % (\" \".join(cmd))\r\n\t\tstdout_text = subprocess.check_output(cmd)\r\n\t\tresult = self.parse_reply(stdout_text, spec.annotation)\r\n\t\tspec.elapsed_time = result\r\n\t\tprint \"spec :\",spec\r\n\r\n\tdef parse_reply(self, text, annotation):\r\n\t\ttext = text.replace(\"\\r\", \"\")\r\n\t\treturn float(self.regrab(text, self.re_elapsed_time))\r\n\r\n\tdef suite0(self):\r\n\t\t#for bench in [\"Sha1\", \"Sha256\",\"ByteSeqToWordSeq\", \"WordSeqToByteSeq\"]:\r\n\t\tfor bench in [\"Sha256\" ]:\r\n\t\t\tfor block_size in [32768]:\r\n\t\t\t\titerations=32768\r\n\t\t\t\tself.execute_test(BenchSpec(bench, iterations, 0, block_size))\r\n\t\tfor reps in range(20):\r\n\t\t\tself.execute_test(BenchSpec(\"TpmExtractRandom\", 1024, 1024))\r\n\r\n\tdef suite1(self):\r\n\t\tfor loops in range(10):\r\n\t\t\tfor block_size in (512,):\r\n\t\t\t\tself.execute_test(BenchSpec(\"RsaKeyGen\", 4, block_size))\r\n\r\n\tdef suite2(self):\r\n\t\tfor reps in range(20):\r\n\t\t\tself.execute_test(BenchSpec(\"TpmExtractRandom\", 16, 1024))\r\n\r\n\tdef suite3(self):\r\n\t\t#for block_size in (32,64,128,256,512,1024,2048):\r\n\t\t\t#self.execute_test(BenchSpec(\"RsaKeyGen\", 1, block_size))\r\n\t\t# valid combinations: 512/32, 1024/64\r\n\t\t# block_size := greatest power of two less than or equal to key_size_bits/8-12.\r\n\t\tkey_size_bits = 1024\r\n\t\tblock_size_bytes = 64\r\n\r\n\t\t# create a key to encrypt against.\r\n\t\tself.execute_test(BenchSpec(\"RsaKeyGen\", 1, key_size_bits, 0))\r\n\t\tfor i in range(10):\r\n\t\t\tself.execute_test(BenchSpec(\"RsaDecrypt\", 8, key_size_bits, block_size_bytes, annotation=\"key_size_bits=%s\"%key_size_bits))\r\n\t\t\tself.execute_test(BenchSpec(\"RsaEncrypt\", 8, key_size_bits, block_size_bytes, annotation=\"key_size_bits=%s\"%key_size_bits))\r\n\r\nBenchmarkDriver()\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestCmd/App.config", "content": "\n\n \n \n \n\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestCmd/BenchmarkRequestCmd.csproj", "content": "\n\n \n \n Debug\n AnyCPU\n {AE099A52-1DB3-415A-AD29-2445711E7C1F}\n Exe\n Properties\n Ironclad.Benchmark\n BenchmarkRequestCmd\n v4.0\n 512\n \n \n \n AnyCPU\n true\n full\n false\n bin\\Debug\\\n DEBUG;TRACE\n prompt\n 4\n AllRules.ruleset\n \n \n AnyCPU\n pdbonly\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n {04c9f161-f1e7-4eee-b99e-417ce01a954b}\n Communication\n \n \n \n \n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestCmd/Program.cs", "content": "//--\r\n\r\n\r\n\r\n//--\r\nnamespace Ironclad.Benchmark\r\n{\r\n using System;\r\n using Ironclad.Benchmark.Communication;\r\n\r\n /\r\n /\r\n /\r\n public static class Program\r\n {\r\n /\r\n /\r\n /\r\n private const ulong CpuSpeed = 2992273000;\r\n\r\n /\r\n /\r\n /\r\n /\r\n private static void Main(string[] args)\r\n {\r\n if (args.Length == 7)\r\n {\r\n using (Connection connection = new Connection(args[0]))\r\n {\r\n \r\n \r\n \r\n Request request = new Request();\r\n\r\n UInt32 useWordsInt, useOriginalInt;\r\n if (byte.TryParse(args[1], out request.benchmark) &&\r\n UInt32.TryParse(args[2], out request.iterations) &&\r\n UInt32.TryParse(args[3], out request.keyLengthInBits) &&\r\n UInt32.TryParse(args[4], out request.messageLengthInBits) &&\r\n UInt32.TryParse(args[5], out useWordsInt) &&\r\n UInt32.TryParse(args[6], out useOriginalInt))\r\n {\r\n request.useWords = (useWordsInt != 0);\r\n request.useOriginal = (useOriginalInt != 0);\r\n }\r\n else\r\n {\r\n Usage();\r\n }\r\n\r\n \r\n \r\n \r\n request.SendOnConnection(connection);\r\n Console.WriteLine(\"Request sent.\");\r\n\r\n \r\n \r\n \r\n Response response = new Response(connection);\r\n if (response.Error != 0)\r\n {\r\n Console.WriteLine(\"Server returned error code 0x{0:x} ({0:d})\", response.Error);\r\n }\r\n else\r\n {\r\n Console.WriteLine(\"Response received.\");\r\n Console.WriteLine();\r\n Console.WriteLine(\"Benchmark: {0:G}\", response.Benchmark.ToString());\r\n Console.WriteLine(\"Iterations performed: 0x{0:x}, ({0:d})\", response.Iterations);\r\n Console.WriteLine(\"Key bits: 0x{0:x}, ({0:d})\", response.keyLengthInBits);\r\n Console.WriteLine(\"Message length in bits: 0x{0:x}, ({0:d})\", response.messageLengthInBits);\r\n Console.WriteLine(\"Use words: {0}\", response.useWords);\r\n Console.WriteLine(\"Use original: {0}\", response.useOriginal);\r\n Console.WriteLine(\"Begin Counter: 0x{0:x16}, ({0:d})\", response.BeginCounter);\r\n Console.WriteLine(\"End Counter: 0x{0:x16}, ({0:d})\", response.EndCounter);\r\n Console.WriteLine(\"Elapsed Counter: 0x{0:x16}, ({0:d})\", response.ElapsedCounter);\r\n\r\n Console.WriteLine(\"Elapsed Time (in seconds, assuming a {0} Hertz CPU): {1}\", Program.CpuSpeed, response.CalculateElapsedTime(Program.CpuSpeed));\r\n }\r\n }\r\n }\r\n else\r\n {\r\n Usage();\r\n }\r\n }\r\n\r\n /\r\n /\r\n /\r\n private static void Usage()\r\n {\r\n Console.WriteLine(\"Usage: BenchmarkRequestCmd \");\r\n Environment.Exit(1);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestCmd/Properties/AssemblyInfo.cs", "content": "//--\r\n\r\n\r\n\r\n//--\r\n\r\nusing System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"BenchmarkRequestCmd\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"BenchmarkRequestCmd\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n\r\n[assembly: Guid(\"de8c4517-c0ee-4905-a1bc-bc8aff0a0df7\")]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestGui/App.config", "content": "\n\n \n \n \n\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestGui/App.xaml", "content": "\n \n \n \n\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestGui/App.xaml.cs", "content": "namespace BenchmarkRequestGui\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Configuration;\r\n using System.Data;\r\n using System.Linq;\r\n using System.Threading.Tasks;\r\n using System.Windows;\r\n\r\n /\r\n /\r\n /\r\n public partial class App : Application\r\n {\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestGui/BenchmarkRequestGui.csproj", "content": "\n\n \n \n Debug\n AnyCPU\n {F6488513-9D8E-4064-BE53-F82606704ECA}\n WinExe\n Properties\n Ironclad.Benchmark\n BenchmarkRequestGui\n v4.0\n 512\n {60dc8134-eba5-43b8-bcc9-bb4bc16c2548};{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\n 4\n \n \n \n AnyCPU\n true\n full\n false\n bin\\Debug\\\n DEBUG;TRACE\n prompt\n 4\n AllRules.ruleset\n \n \n AnyCPU\n pdbonly\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n \n \n \n \n \n \n \n 4.0\n \n \n \n \n \n \n \n MSBuild:Compile\n Designer\n \n \n MSBuild:Compile\n Designer\n \n \n App.xaml\n Code\n \n \n \n MainWindow.xaml\n Code\n \n \n \n \n Code\n \n \n True\n True\n Resources.resx\n \n \n True\n Settings.settings\n True\n \n \n ResXFileCodeGenerator\n Resources.Designer.cs\n \n \n SettingsSingleFileGenerator\n Settings.Designer.cs\n \n \n \n \n \n \n \n \n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestGui/MainWindow.xaml", "content": "\n \n \n \n\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestGui/MainWindow.xaml.cs", "content": "namespace BenchmarkRequestGui\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n using System.Windows;\r\n using System.Windows.Controls;\r\n using System.Windows.Data;\r\n using System.Windows.Documents;\r\n using System.Windows.Input;\r\n using System.Windows.Media;\r\n using System.Windows.Media.Imaging;\r\n using System.Windows.Navigation;\r\n using System.Windows.Shapes;\r\n\r\n /\r\n /\r\n /\r\n public partial class MainWindow : Window\r\n {\r\n public MainWindow()\r\n {\r\n this.InitializeComponent();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestGui/Properties/AssemblyInfo.cs", "content": "//--\r\n\r\n\r\n\r\n//--\r\n\r\nusing System.Reflection;\r\nusing System.Resources;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\nusing System.Windows;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"BenchmarkRequestGui\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"BenchmarkRequestGui\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\n\r\n//\r\n\r\n[assembly: ThemeInfo(\r\n ResourceDictionaryLocation.None, \r\n \r\n ResourceDictionaryLocation.SourceAssembly \r\n \r\n)]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestGui/Properties/Resources.Designer.cs", "content": "//------------------------------------------------------------------------------\r\n\r\n\r\n\r\n//\r\n\r\n\r\n\r\n//------------------------------------------------------------------------------\r\n\r\nnamespace Ironclad.Benchmark.Properties {\r\n using System;\r\n \r\n \r\n /\r\n /\r\n /\r\n \r\n \r\n \r\n \r\n [global::System.CodeDom.Compiler.GeneratedCodeAttribute(\"System.Resources.Tools.StronglyTypedResourceBuilder\", \"4.0.0.0\")]\r\n [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]\r\n [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()]\r\n internal class Resources {\r\n \r\n private static global::System.Resources.ResourceManager resourceMan;\r\n \r\n private static global::System.Globalization.CultureInfo resourceCulture;\r\n \r\n [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute(\"Microsoft.Performance\", \"CA1811:AvoidUncalledPrivateCode\")]\r\n internal Resources() {\r\n }\r\n \r\n /\r\n /\r\n /\r\n [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]\r\n internal static global::System.Resources.ResourceManager ResourceManager {\r\n get {\r\n if (object.ReferenceEquals(resourceMan, null)) {\r\n global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager(\"Ironclad.Benchmark.Properties.Resources\", typeof(Resources).Assembly);\r\n resourceMan = temp;\r\n }\r\n return resourceMan;\r\n }\r\n }\r\n \r\n /\r\n /\r\n /\r\n /\r\n [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)]\r\n internal static global::System.Globalization.CultureInfo Culture {\r\n get {\r\n return resourceCulture;\r\n }\r\n set {\r\n resourceCulture = value;\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestGui/Properties/Resources.resx", "content": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n text/microsoft-resx\n \n \n 2.0\n \n \n System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\n \n \n System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\n \n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestGui/Properties/Settings.Designer.cs", "content": "//------------------------------------------------------------------------------\r\n\r\n\r\n\r\n//\r\n\r\n\r\n\r\n//------------------------------------------------------------------------------\r\n\r\nnamespace Ironclad.Benchmark.Properties {\r\n \r\n \r\n [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()]\r\n [global::System.CodeDom.Compiler.GeneratedCodeAttribute(\"Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\", \"12.0.0.0\")]\r\n internal sealed partial class Settings : global::System.Configuration.ApplicationSettingsBase {\r\n \r\n private static Settings defaultInstance = ((Settings)(global::System.Configuration.ApplicationSettingsBase.Synchronized(new Settings())));\r\n \r\n public static Settings Default {\r\n get {\r\n return defaultInstance;\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/BenchmarkRequestGui/Properties/Settings.settings", "content": "\n\n \n \n \n \n" }, { "path": "ironclad-apps/src/Clients/Benchmark/Communication/BenchmarkList.cs", "content": "//--\r\n\r\n\r\n\r\n//--\r\nnamespace Ironclad.Benchmark.Communication\r\n{\r\n using System;\r\n\r\n /\r\n /\r\n /\r\n /\r\n /\r\n /\r\n /\r\n /\r\n public enum Benchmark\r\n {\r\n /\r\n /\r\n /\r\n Nothing = 0,\r\n\r\n /\r\n /\r\n /\r\n Sha1 = 1,\r\n\r\n /\r\n /\r\n /\r\n Sha256 = 2,\r\n\r\n /\r\n /\r\n /\r\n RsaKeyGen = 3,\r\n\r\n /\r\n /\r\n /\r\n RsaEncrypt = 4,\r\n\r\n /\r\n /\r\n /\r\n RsaDecrypt = 5,\r\n\r\n /\r\n /\r\n /\r\n RsaDigestedSign = 6,\r\n\r\n /\r\n /\r\n /\r\n RsaDigestedVerify = 7,\r\n\r\n /\r\n /\r\n /\r\n TpmExtractRandom = 8,\r\n\r\n /\r\n /\r\n /\r\n ByteSeqToWordSeq = 9,\r\n\r\n /\r\n /\r\n /\r\n WordSeqToByteSeq = 10,\r\n\r\n DuplicateArray = 13,\r\n\r\n /\r\n /\r\n /\r\n Max = 14,\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/Communication/Communication.csproj", "content": "\n\n \n \n Debug\n AnyCPU\n {04C9F161-F1E7-4EEE-B99E-417CE01A954B}\n Library\n Properties\n Ironclad.Benchmark.Communication\n Communication\n v4.0\n 512\n \n \n \n true\n full\n false\n bin\\Debug\\\n DEBUG;TRACE\n prompt\n 4\n AllRules.ruleset\n \n \n pdbonly\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n" }, { "path": "ironclad-apps/src/Clients/Benchmark/Communication/Connection.cs", "content": "//--\r\n\r\n\r\n\r\n//--\r\nnamespace Ironclad.Benchmark.Communication\r\n{\r\n using System;\r\n using System.Net;\r\n using System.Net.Sockets;\r\n using System.Text;\r\n \r\n /\r\n /\r\n /\r\n public class Connection : IDisposable\r\n {\r\n /\r\n /\r\n /\r\n private Socket socket;\r\n\r\n /\r\n /\r\n /\r\n private bool disposed = false;\r\n\r\n /\r\n /\r\n /\r\n /\r\n public Connection(string serverName)\r\n {\r\n this.socket = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);\r\n this.socket.Connect(serverName, 77);\r\n }\r\n\r\n /\r\n /\r\n /\r\n internal Socket Socket\r\n {\r\n get { return this.socket; }\r\n }\r\n\r\n /\r\n /\r\n /\r\n public void Dispose()\r\n {\r\n this.Dispose(true);\r\n GC.SuppressFinalize(this);\r\n }\r\n\r\n /\r\n /\r\n /\r\n /\r\n protected virtual void Dispose(bool disposing)\r\n {\r\n if (!this.disposed)\r\n {\r\n if (disposing)\r\n {\r\n \r\n \r\n \r\n this.socket.Dispose();\r\n }\r\n\r\n this.disposed = true;\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/Communication/Properties/AssemblyInfo.cs", "content": "//--\r\n\r\n\r\n\r\n//--\r\n\r\nusing System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"Communication\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"Communication\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n\r\n[assembly: Guid(\"7aeeec60-c831-42a2-b90e-0cdb988ee4cc\")]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/Communication/Request.cs", "content": "//--\r\n\r\n\r\n\r\n//--\r\nnamespace Ironclad.Benchmark.Communication\r\n{\r\n using System;\r\n using System.Net;\r\n using System.Net.Sockets;\r\n\r\n /\r\n /\r\n /\r\n public class Request\r\n {\r\n /\r\n /\r\n /\r\n public byte benchmark;\r\n\r\n /\r\n /\r\n /\r\n public UInt32 iterations;\r\n\r\n /\r\n /\r\n /\r\n public UInt32 keyLengthInBits;\r\n\r\n /\r\n /\r\n /\r\n public bool useWords;\r\n\r\n /\r\n /\r\n /\r\n public bool useOriginal;\r\n\r\n /\r\n /\r\n /\r\n public UInt32 messageLengthInBits;\r\n\r\n /\r\n /\r\n /\r\n public Request()\r\n {\r\n this.benchmark = 0;\r\n this.iterations = 0;\r\n this.keyLengthInBits = 0;\r\n this.useWords = false;\r\n\t this.useOriginal = false;\r\n\t this.messageLengthInBits = 0;\r\n }\r\n\r\n /\r\n /\r\n /\r\n public Benchmark Benchmark\r\n {\r\n get { return (Benchmark)this.benchmark; }\r\n set { this.benchmark = (byte)value; }\r\n }\r\n\r\n /\r\n /\r\n /\r\n /\r\n /\r\n public int SendOnConnection(Connection connection)\r\n {\r\n if (connection == null)\r\n {\r\n return 0;\r\n }\r\n\r\n \r\n \r\n \r\n byte[] buffer = new byte[15];\r\n buffer[0] = this.benchmark;\r\n byte[] iterationsEncoded = Request.EncodeBEWord(this.iterations);\r\n iterationsEncoded.CopyTo(buffer, 1);\r\n byte[] keyLengthEncoded = Request.EncodeBEWord(this.keyLengthInBits);\r\n keyLengthEncoded.CopyTo(buffer, 5);\r\n byte[] messageLengthEncoded = Request.EncodeBEWord(this.messageLengthInBits);\r\n messageLengthEncoded.CopyTo(buffer, 9);\r\n buffer[13] = (byte)(this.useWords ? 1 : 0);\r\n buffer[14] = (byte)(this.useOriginal ? 1 : 0);\r\n\r\n return connection.Socket.Send(buffer);\r\n }\r\n\r\n private static byte[] EncodeBEWord(UInt32 value)\r\n {\r\n byte[] encoding = BitConverter.GetBytes(value);\r\n Array.Reverse(encoding);\r\n return encoding;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/Communication/Response.cs", "content": "using System.Linq;\r\n\r\n//--\r\n\r\n\r\n\r\n//--\r\nnamespace Ironclad.Benchmark.Communication\r\n{\r\n using System;\r\n using System.Net;\r\n using System.Net.Sockets;\r\n\r\n /\r\n /\r\n /\r\n public class Response\r\n {\r\n /\r\n /\r\n /\r\n private byte error;\r\n\r\n /\r\n /\r\n /\r\n private Benchmark benchmark;\r\n\r\n /\r\n /\r\n /\r\n private UInt32 iterations;\r\n\r\n /\r\n /\r\n /\r\n public UInt32 keyLengthInBits;\r\n\r\n /\r\n /\r\n /\r\n public UInt32 messageLengthInBits;\r\n\r\n /\r\n /\r\n /\r\n public bool useWords;\r\n\r\n /\r\n /\r\n /\r\n public bool useOriginal;\r\n /\r\n /\r\n /\r\n private UInt64 beginCounter;\r\n\r\n /\r\n /\r\n /\r\n private UInt64 endCounter;\r\n\r\n /\r\n /\r\n /\r\n /\r\n public Response(Connection connection)\r\n {\r\n this.benchmark = Benchmark.Nothing;\r\n this.iterations = 0;\r\n this.keyLengthInBits = 0;\r\n\t this.messageLengthInBits = 0;\r\n this.useWords = false;\r\n\t this.useOriginal = false;\r\n\r\n if (connection == null)\r\n {\r\n this.error = 1;\r\n return;\r\n }\r\n\r\n byte[] buffer = new byte[1500];\r\n\r\n int got = connection.Socket.Receive(buffer);\r\n if (got < 20)\r\n {\r\n this.error = 1;\r\n return;\r\n }\r\n\r\n#if false\r\n Console.WriteLine();\r\n for (int loop = 0; loop < 20; loop++)\r\n {\r\n Console.Write(\"{0:x2} \", buffer[loop]);\r\n }\r\n Console.WriteLine();\r\n#endif\r\n\r\n this.error = buffer[0];\r\n\r\n if ((Benchmark)buffer[1] < Benchmark.Max)\r\n {\r\n this.benchmark = (Benchmark)buffer[1];\r\n }\r\n else\r\n {\r\n this.error = 2;\r\n return;\r\n }\r\n\r\n this.iterations = Response.ExtractBEWord(buffer, 2);\r\n this.keyLengthInBits = Response.ExtractBEWord(buffer, 6);\r\n this.messageLengthInBits = Response.ExtractBEWord(buffer, 10);\r\n this.useWords = (buffer[14] != 0);\r\n this.useOriginal = (buffer[15] != 0);\r\n\r\n if (BitConverter.IsLittleEndian)\r\n {\r\n byte[] temp = ReverseByteOrder(buffer, 16, 8);\r\n this.beginCounter = BitConverter.ToUInt64(temp, 0);\r\n temp = ReverseByteOrder(buffer, 24, 8);\r\n this.endCounter = BitConverter.ToUInt64(temp, 0);\r\n }\r\n else\r\n {\r\n this.beginCounter = BitConverter.ToUInt64(buffer, 16);\r\n this.endCounter = BitConverter.ToUInt64(buffer, 24);\r\n }\r\n }\r\n\r\n /\r\n /\r\n /\r\n public byte Error\r\n {\r\n get { return this.error; }\r\n }\r\n\r\n /\r\n /\r\n /\r\n public Benchmark Benchmark\r\n {\r\n get { return this.benchmark; }\r\n }\r\n\r\n /\r\n /\r\n /\r\n public UInt32 Iterations\r\n {\r\n get { return this.iterations; }\r\n }\r\n\r\n /\r\n /\r\n /\r\n public UInt64 BeginCounter\r\n {\r\n get { return this.beginCounter; }\r\n }\r\n\r\n /\r\n /\r\n /\r\n public UInt64 EndCounter\r\n {\r\n get { return this.endCounter; }\r\n }\r\n\r\n /\r\n /\r\n /\r\n public UInt64 ElapsedCounter\r\n {\r\n get { return this.endCounter - this.beginCounter; }\r\n }\r\n\r\n /\r\n /\r\n /\r\n /\r\n /\r\n public float CalculateElapsedTime(UInt64 clockSpeedInHertz)\r\n {\r\n return (float)this.ElapsedCounter / (float)clockSpeedInHertz;\r\n }\r\n\r\n /\r\n /\r\n /\r\n /\r\n /\r\n /\r\n /\r\n private static byte[] ReverseByteOrder(byte[] input, int offset, int length)\r\n {\r\n byte[] output = new byte[length];\r\n\r\n for (int index = 0; index < length; index++)\r\n {\r\n output[index] = input[offset + length - 1 - index];\r\n }\r\n\r\n return output;\r\n }\r\n\r\n private static UInt32 ExtractBEWord(byte[] byteArray, int offset)\r\n {\r\n byte[] extractedBytes = byteArray.Skip(offset).Take(4).ToArray();\r\n Array.Reverse(extractedBytes);\r\n return BitConverter.ToUInt32(extractedBytes, 0);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/TestEcho.py", "content": "#!/usr/bin/python\r\n\r\nimport socket\r\n\r\nfrom BenchSpec import *\r\n\r\nUDP_PORT = 7\r\nMESSAGE = \"Hello, ironclad!\"\r\n\r\nsock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\r\nsock.sendto(MESSAGE, (SUT_IP, UDP_PORT))\r\nprint sock.recv(1024)\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark/notes", "content": "2014.04.25 values:\r\n\r\nSha256\r\n[ 2.68974487e-05 -7.74454427e-03]\r\nSha1\r\n[ 2.66306843e-05 -7.70144164e-03]\r\nByteSeqToWordSeq\r\n[ 2.07652270e-05 -5.97859852e-03]\r\nWordSeqToByteSeq\r\n[ 4.18720193e-05 -1.29082713e-02]\r\n\r\nY-intercepts are negative, likely nonsense stemming from larger block\r\nsizes running with fewer repetitions.\r\n\r\nslopes are 26-42us/byte.\r\n\r\nWhen arp rots:\r\nnetsh interface ipv4 add neighbors \"Ethernet 2\" 10.10.10.20 00-1b-21-31-8e-d9\r\n\r\nserial debug:\r\n/cygdrive/c/Program\\ Files\\ \\(x86\\)/raw/plink.exe -sercfg 115200,8,n,1 -serial com3\r\n" }, { "path": "ironclad-apps/src/Clients/Benchmark.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio 2013\nVisualStudioVersion = 12.0.30110.0\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"Communication\", \"Benchmark\\Communication\\Communication.csproj\", \"{04C9F161-F1E7-4EEE-B99E-417CE01A954B}\"\nEndProject\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"BenchmarkRequestCmd\", \"Benchmark\\BenchmarkRequestCmd\\BenchmarkRequestCmd.csproj\", \"{AE099A52-1DB3-415A-AD29-2445711E7C1F}\"\n\tProjectSection(ProjectDependencies) = postProject\n\t\t{04C9F161-F1E7-4EEE-B99E-417CE01A954B} = {04C9F161-F1E7-4EEE-B99E-417CE01A954B}\n\tEndProjectSection\nEndProject\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"BenchmarkRequestGui\", \"Benchmark\\BenchmarkRequestGui\\BenchmarkRequestGui.csproj\", \"{F6488513-9D8E-4064-BE53-F82606704ECA}\"\n\tProjectSection(ProjectDependencies) = postProject\n\t\t{04C9F161-F1E7-4EEE-B99E-417CE01A954B} = {04C9F161-F1E7-4EEE-B99E-417CE01A954B}\n\tEndProjectSection\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{04C9F161-F1E7-4EEE-B99E-417CE01A954B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{04C9F161-F1E7-4EEE-B99E-417CE01A954B}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{04C9F161-F1E7-4EEE-B99E-417CE01A954B}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{04C9F161-F1E7-4EEE-B99E-417CE01A954B}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{AE099A52-1DB3-415A-AD29-2445711E7C1F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{AE099A52-1DB3-415A-AD29-2445711E7C1F}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{AE099A52-1DB3-415A-AD29-2445711E7C1F}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{AE099A52-1DB3-415A-AD29-2445711E7C1F}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{F6488513-9D8E-4064-BE53-F82606704ECA}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{F6488513-9D8E-4064-BE53-F82606704ECA}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{F6488513-9D8E-4064-BE53-F82606704ECA}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{F6488513-9D8E-4064-BE53-F82606704ECA}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironclad-apps/src/Clients/Clients.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 12.00\r\n# Visual Studio 2012\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"Notary\", \"Notary\\Notary.csproj\", \"{482B3A42-D9E8-4D48-9E44-27392205EDB0}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"Common\", \"Common\\Common.csproj\", \"{5E394D90-C3D6-41A1-A6B4-715E43E54D7C}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"TrInc\", \"TrInc\\TrInc.csproj\", \"{EC3E5C90-B0FD-44CE-883C-1BA3FC896C02}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"PassHash\", \"PassHash\\PassHash.csproj\", \"{92AFE843-D88C-4A62-8159-B8C5EEDB5171}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"DiffPriv\", \"DiffPriv\\DiffPriv.csproj\", \"{9F8B6096-C335-433E-B00F-092D5CDF0CE1}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"DotNetSHABench\", \"DotNetSHABench\\DotNetSHABench.csproj\", \"{4494E273-A2EF-4799-8D7E-C893C31D1362}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"PassHashSrv\", \"PassHashSrv\\PassHashSrv.csproj\", \"{49E13550-3EC8-4FCC-AE5D-CBD278A33B20}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"NotarySrv\", \"NotarySrv\\NotarySrv.csproj\", \"{9D47885D-EC02-4454-8D4C-B6BA048F7AF5}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"TrIncSrv\", \"TrIncSrv\\TrIncSrv.csproj\", \"{B99001E4-00B2-4A1B-A1D6-8B4773C0F5FB}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"DiffPrivSrv\", \"DiffPrivSrv\\DiffPrivSrv.csproj\", \"{29139FBF-8F54-41A3-B135-F9AFCA3714C1}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Any CPU = Debug|Any CPU\r\n\t\tRelease|Any CPU = Release|Any CPU\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{482B3A42-D9E8-4D48-9E44-27392205EDB0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{482B3A42-D9E8-4D48-9E44-27392205EDB0}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{482B3A42-D9E8-4D48-9E44-27392205EDB0}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{482B3A42-D9E8-4D48-9E44-27392205EDB0}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{5E394D90-C3D6-41A1-A6B4-715E43E54D7C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{5E394D90-C3D6-41A1-A6B4-715E43E54D7C}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{5E394D90-C3D6-41A1-A6B4-715E43E54D7C}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{5E394D90-C3D6-41A1-A6B4-715E43E54D7C}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{EC3E5C90-B0FD-44CE-883C-1BA3FC896C02}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{EC3E5C90-B0FD-44CE-883C-1BA3FC896C02}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{EC3E5C90-B0FD-44CE-883C-1BA3FC896C02}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{EC3E5C90-B0FD-44CE-883C-1BA3FC896C02}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{92AFE843-D88C-4A62-8159-B8C5EEDB5171}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{92AFE843-D88C-4A62-8159-B8C5EEDB5171}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{92AFE843-D88C-4A62-8159-B8C5EEDB5171}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{92AFE843-D88C-4A62-8159-B8C5EEDB5171}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{9F8B6096-C335-433E-B00F-092D5CDF0CE1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{9F8B6096-C335-433E-B00F-092D5CDF0CE1}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{9F8B6096-C335-433E-B00F-092D5CDF0CE1}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{9F8B6096-C335-433E-B00F-092D5CDF0CE1}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{4494E273-A2EF-4799-8D7E-C893C31D1362}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{4494E273-A2EF-4799-8D7E-C893C31D1362}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{4494E273-A2EF-4799-8D7E-C893C31D1362}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{4494E273-A2EF-4799-8D7E-C893C31D1362}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{49E13550-3EC8-4FCC-AE5D-CBD278A33B20}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{49E13550-3EC8-4FCC-AE5D-CBD278A33B20}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{49E13550-3EC8-4FCC-AE5D-CBD278A33B20}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{49E13550-3EC8-4FCC-AE5D-CBD278A33B20}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{9D47885D-EC02-4454-8D4C-B6BA048F7AF5}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{9D47885D-EC02-4454-8D4C-B6BA048F7AF5}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{9D47885D-EC02-4454-8D4C-B6BA048F7AF5}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{9D47885D-EC02-4454-8D4C-B6BA048F7AF5}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{B99001E4-00B2-4A1B-A1D6-8B4773C0F5FB}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{B99001E4-00B2-4A1B-A1D6-8B4773C0F5FB}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{B99001E4-00B2-4A1B-A1D6-8B4773C0F5FB}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{B99001E4-00B2-4A1B-A1D6-8B4773C0F5FB}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{29139FBF-8F54-41A3-B135-F9AFCA3714C1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{29139FBF-8F54-41A3-B135-F9AFCA3714C1}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{29139FBF-8F54-41A3-B135-F9AFCA3714C1}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{29139FBF-8F54-41A3-B135-F9AFCA3714C1}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "ironclad-apps/src/Clients/Common/Common.cs", "content": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Net;\r\nusing System.Net.Sockets;\r\nusing System.Numerics;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace Common\r\n{\r\n public class ErrorCodeException : Exception\r\n {\r\n private UInt32 error_code;\r\n\r\n public ErrorCodeException(UInt32 i_error_code)\r\n {\r\n error_code = i_error_code;\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return string.Format(\"Error code {0}\", error_code);\r\n }\r\n }\r\n\r\n public class InvalidRequest\r\n {\r\n public InvalidRequest() { }\r\n }\r\n\r\n public class InvalidResponse\r\n {\r\n public InvalidResponse() { }\r\n\r\n public static byte[] Encode()\r\n {\r\n byte[] response = new byte[1];\r\n response[0] = 0;\r\n return response;\r\n }\r\n }\r\n\r\n public class CommonRoutines\r\n {\r\n public static UInt32 ExtractBEWord(byte[] byteArray, int offset)\r\n {\r\n byte[] extractedBytes = byteArray.Skip(offset).Take(4).ToArray();\r\n Array.Reverse(extractedBytes);\r\n return BitConverter.ToUInt32(extractedBytes, 0);\r\n }\r\n\r\n public static byte[] EncodeBEWord(UInt32 value)\r\n {\r\n byte[] encoding = BitConverter.GetBytes(value);\r\n Array.Reverse(encoding);\r\n return encoding;\r\n }\r\n\r\n public static byte[] EncodeMPInt(UInt32 value)\r\n {\r\n Stack encoding = new Stack();\r\n while (value > 0)\r\n {\r\n encoding.Push((byte)(value % 256));\r\n value = value / 256;\r\n }\r\n if (encoding.Count != 0 && encoding.Peek() >= 128)\r\n {\r\n encoding.Push((byte) 0);\r\n }\r\n byte[] length_encoded = EncodeBEWord((uint)encoding.Count);\r\n byte[] encoding_bytes = encoding.ToArray();\r\n return CombineByteArrays(length_encoded, encoding_bytes);\r\n }\r\n\r\n public static byte[] EncodeMPBigInteger(BigInteger value)\r\n {\r\n byte[] rawEncoding = value.ToByteArray();\r\n Array.Reverse(rawEncoding);\r\n byte[] lengthEncoded = EncodeBEWord((uint)rawEncoding.Length);\r\n return CombineByteArrays(lengthEncoded, rawEncoding);\r\n }\r\n\r\n public static UInt32 DecodeShortMPInt(byte[] byteArray, ref int offset)\r\n {\r\n if (byteArray.Length < offset + 4)\r\n {\r\n throw new Exception(\"Byte array too short to decode the length of an MPInt from\");\r\n }\r\n\r\n int value_length = (int)ExtractBEWord(byteArray, offset);\r\n if (byteArray.Length < offset + 4 + value_length)\r\n {\r\n throw new Exception(\"Byte array too short to decode an MPInt from\");\r\n }\r\n\r\n byte[] value_encoded = byteArray.Skip(offset + 4).Take(value_length).ToArray();\r\n\r\n UInt32 value = 0;\r\n for (int pos = 0; pos < value_encoded.Length; ++pos)\r\n {\r\n value = value * 256 + value_encoded[pos];\r\n }\r\n\r\n offset = offset + 4 + value_length;\r\n return value;\r\n }\r\n\r\n public static BigInteger DecodeMPBigInteger(byte[] byteArray, ref int offset)\r\n {\r\n if (byteArray.Length < offset + 4)\r\n {\r\n return new BigInteger(-1);\r\n }\r\n\r\n int value_length = (int)ExtractBEWord(byteArray, offset);\r\n if (byteArray.Length < offset + 4 + value_length)\r\n {\r\n return new BigInteger(-1);\r\n }\r\n\r\n byte[] value_encoded = byteArray.Skip(offset + 4).Take(value_length).ToArray();\r\n Array.Reverse(value_encoded);\r\n offset = offset + 4 + value_length;\r\n return new BigInteger(value_encoded);\r\n }\r\n\r\n public static byte[] StripProtectiveZero(byte[] mpi)\r\n {\r\n if (0 < mpi[0] && mpi[0] < 128)\r\n {\r\n return mpi;\r\n }\r\n else\r\n {\r\n return mpi.Skip(1).ToArray();\r\n }\r\n }\r\n\r\n public static RSACryptoServiceProvider DecodePublicKey(byte[] encoded_public_key)\r\n {\r\n \r\n\r\n int header_length = (int)ExtractBEWord(encoded_public_key, 0);\r\n if (header_length != 7)\r\n {\r\n Console.WriteLine(\"Header of encoded public key has invalid length {0} != 7\", header_length);\r\n throw new Exception(\"Header of encoded public key has invalid length\");\r\n }\r\n System.Text.UTF8Encoding encoder = new System.Text.UTF8Encoding();\r\n string header = encoder.GetString(encoded_public_key.Skip(4).Take(header_length).ToArray());\r\n if (header != \"ssh-rsa\")\r\n {\r\n Console.WriteLine(\"Header of encoded public key is {0}, not ssh-rsa\", header);\r\n throw new Exception(\"Header of encoded public key is not ssh-rsa\");\r\n }\r\n\r\n \r\n\r\n int exponent_length = (int)ExtractBEWord(encoded_public_key, 4 + header_length);\r\n if (encoded_public_key.Length < 4 + header_length + 4 + exponent_length + 4)\r\n {\r\n Console.WriteLine(\"Encoded public key not long enough to hold exponent of length {0}\", exponent_length);\r\n throw new Exception(\"Encoded public key not long enough to hold exponent\");\r\n }\r\n\r\n \r\n\r\n byte[] exponent = encoded_public_key.Skip(4 + header_length + 4).Take(exponent_length).ToArray();\r\n\r\n \r\n\r\n int modulus_length = (int)ExtractBEWord(encoded_public_key, 4 + header_length + 4 + exponent_length);\r\n if (encoded_public_key.Length < 4 + header_length + 4 + exponent_length + 4 + modulus_length)\r\n {\r\n Console.WriteLine(\"Encoded public key not long enough to hold modulus of length {0}\", modulus_length);\r\n throw new Exception(\"Encoded public key not long enough to hold modulus\");\r\n }\r\n\r\n \r\n\r\n byte[] modulus = encoded_public_key.Skip(4 + header_length + 4 + exponent_length + 4).Take(modulus_length).ToArray();\r\n\r\n modulus = StripProtectiveZero(modulus);\r\n\r\n \r\n\r\n RSACryptoServiceProvider provider = new RSACryptoServiceProvider();\r\n RSAParameters info = new RSAParameters();\r\n info.Exponent = exponent;\r\n info.Modulus = modulus;\r\n\r\n try\r\n {\r\n provider.ImportParameters(info);\r\n }\r\n catch\r\n {\r\n if (CommonParams.ignoreKey)\r\n {\r\n return null;\r\n }\r\n else\r\n {\r\n throw;\r\n }\r\n }\r\n\r\n return provider;\r\n }\r\n\r\n public static byte[] ParseFakeReply(string pastedhex)\r\n {\r\n string[] hexwords = pastedhex.Split(' ');\r\n int offset = 0x2a;\r\n byte[] output = new byte[hexwords.Length-offset];\r\n for (int i = offset; i < hexwords.Length; i++)\r\n {\r\n output[i-offset] = Convert.ToByte(hexwords[i], 16);\r\n }\r\n return output;\r\n }\r\n\r\n static public void WriteHexArray(StreamWriter sw, byte[] bytes, string label)\r\n {\r\n sw.WriteLine(\" var \"+label+\" = [\");\r\n for (int i=0; i a.Length)];\r\n int offset = 0;\r\n foreach (byte[] array in arrays) {\r\n System.Buffer.BlockCopy(array, 0, rv, offset, array.Length);\r\n offset += array.Length;\r\n }\r\n return rv;\r\n }\r\n\r\n public static byte[] mpint_encode(byte[] raw)\r\n {\r\n int i;\r\n for (i = 0; i < raw.Length-1; i++)\r\n {\r\n if (raw[i] != 0)\r\n {\r\n break;\r\n }\r\n }\r\n \r\n \r\n raw = raw.Skip(i).ToArray();\r\n\r\n if (raw[0]>=0x80)\r\n {\r\n byte[] zero = new byte[1];\r\n zero[0] = 0;\r\n raw = CombineByteArrays(zero, raw);\r\n }\r\n byte[] length = EncodeBEWord((UInt32)raw.Length);\r\n return CombineByteArrays(length, raw);\r\n }\r\n\r\n public static byte[] EncodePublicKey (RSACryptoServiceProvider key_pair)\r\n {\r\n RSAParameters rsa_params = key_pair.ExportParameters(false);\r\n\r\n byte[] header = new System.Text.UTF8Encoding().GetBytes(\"ssh-rsa\");\r\n byte[] header_length = EncodeBEWord((UInt32)header.Length);\r\n byte[] exponent_encoded = mpint_encode(rsa_params.Exponent);\r\n byte[] modulus_encoded = mpint_encode(rsa_params.Modulus);\r\n\r\n return CombineByteArrays(header_length, header, exponent_encoded, modulus_encoded);\r\n }\r\n\r\n public static UInt32[] BEByteSeqToWordSeq(byte[] bytes)\r\n {\r\n int num_words = bytes.Length / 4;\r\n UInt32[] words = new UInt32[num_words];\r\n for (int i = 0; i < num_words; ++i)\r\n {\r\n words[i] = ((UInt32)bytes[i * 4] << 24) + ((UInt32)bytes[i * 4 + 1] << 16) + ((UInt32)bytes[i * 4 + 2] << 8) + (UInt32)bytes[i * 4 + 3];\r\n }\r\n return words;\r\n }\r\n\r\n public static IPEndPoint GetIPEndPoint(string hostname, int port)\r\n {\r\n IPHostEntry hostEntry = Dns.GetHostEntry(hostname);\r\n foreach (IPAddress addr in hostEntry.AddressList)\r\n {\r\n if (addr.AddressFamily == AddressFamily.InterNetwork)\r\n {\r\n IPEndPoint ep = new IPEndPoint(addr, port);\r\n return ep;\r\n }\r\n }\r\n Console.Error.WriteLine(\"Could not find address for host name {0}\", CommonParams.hostname);\r\n throw new Exception(\"Could not find address for host name\");\r\n }\r\n\r\n public static UdpClient StartClient()\r\n {\r\n IPEndPoint serverEp = new IPEndPoint(IPAddress.Parse(CommonParams.hostname), CommonParams.port);\r\n UdpClient client = new UdpClient();\r\n client.Connect(serverEp);\r\n return client;\r\n }\r\n\r\n public static UdpClient StartServer()\r\n {\r\n IPEndPoint ep = new IPEndPoint(IPAddress.Parse(CommonParams.hostname), CommonParams.port);\r\n UdpClient server = new UdpClient(ep);\r\n return server;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Common/Common.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {5E394D90-C3D6-41A1-A6B4-715E43E54D7C}\r\n Library\r\n Properties\r\n Common\r\n Common\r\n v4.5\r\n 512\r\n \r\n \r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/Common/CommonParams.cs", "content": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace Common\r\n{\r\n public class CommonParams\r\n {\r\n public static string hostname = \"localhost\";\r\n public static int port = 1983;\r\n public static int numberOfRuns = 105;\r\n public static bool ignoreKey = false;\r\n public static string loaderHash = \"6768033E216468247BD031A0A2D9876D79818F8F\";\r\n public static string appHash = \"\";\r\n public static int serverKeyBits = 2048;\r\n public static bool printValues = true;\r\n\r\n public static void Print()\r\n {\r\n Console.Error.WriteLine(\"hostname\\t{0}\", hostname);\r\n Console.Error.WriteLine(\"port\\t{0}\", port);\r\n Console.Error.WriteLine(\"numberOfRuns\\t{0}\", numberOfRuns);\r\n Console.Error.WriteLine(\"ignoreKey\\t{0}\", ignoreKey);\r\n Console.Error.WriteLine(\"loaderHash\\t{0}\", loaderHash);\r\n Console.Error.WriteLine(\"appHash\\t{0}\", appHash);\r\n Console.Error.WriteLine(\"serverKeyBits\\t{0}\", serverKeyBits);\r\n Console.Error.WriteLine(\"printValues\\t{0}\", printValues);\r\n }\r\n\r\n public static void PrintUsage()\r\n {\r\n Console.Out.WriteLine(\" hostname = host name of the TrInc service\");\r\n Console.Out.WriteLine(\" port = port that the TrInc service listens to\");\r\n Console.Out.WriteLine(\" numberOfRuns = number of times to run each benchmark\");\r\n Console.Out.WriteLine(\" ignoreKey = 1 means ignore the public key and don't do any checking using it\");\r\n Console.Out.WriteLine(\" loaderHash = hex value of SHA-1 of loader, e.g., 01EF..23CD\");\r\n Console.Out.WriteLine(\" appHash = hex value of SHA-1 of app, e.g., 01EF..23CD\");\r\n Console.Out.WriteLine(\" serverKeyBits = number of bits for server key\");\r\n Console.Out.WriteLine(\" printValues = 1 means print all profile values, 0 means just print aggregates\");\r\n }\r\n\r\n public static bool ApplyArgument (string parameter, string value)\r\n {\r\n if (String.Compare(parameter, \"hostname\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n CommonParams.hostname = value;\r\n return true;\r\n }\r\n if (String.Compare(parameter, \"port\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n CommonParams.port = Convert.ToInt32(value);\r\n return true;\r\n }\r\n if (String.Compare(parameter, \"numberOfRuns\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n CommonParams.numberOfRuns = Convert.ToInt32(value);\r\n return true;\r\n }\r\n if (String.Compare(parameter, \"ignoreKey\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n CommonParams.ignoreKey = (Convert.ToInt32(value) != 0);\r\n return true;\r\n }\r\n if (String.Compare(parameter, \"loaderHash\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n CommonParams.loaderHash = value;\r\n return true;\r\n }\r\n if (String.Compare(parameter, \"appHash\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n CommonParams.appHash = value;\r\n return true;\r\n }\r\n if (String.Compare(parameter, \"serverKeyBits\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n CommonParams.serverKeyBits = Convert.ToInt32(value);\r\n return true;\r\n }\r\n if (String.Compare(parameter, \"printValues\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n CommonParams.printValues = (Convert.ToInt32(value) != 0);\r\n return true;\r\n }\r\n return false;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Common/GetQuote.cs", "content": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace Common\r\n{\r\n public class GetQuoteRequest\r\n {\r\n private byte[] nonce;\r\n\r\n public GetQuoteRequest()\r\n {\r\n Random rng = new Random();\r\n nonce = new byte[20];\r\n rng.NextBytes(nonce);\r\n }\r\n\r\n public GetQuoteRequest(byte[] i_nonce)\r\n {\r\n nonce = i_nonce;\r\n }\r\n\r\n public byte[] GetPacket()\r\n {\r\n Random rng = new Random();\r\n byte[] packet = new byte[21];\r\n packet[0] = 1;\r\n nonce.CopyTo(packet, 1);\r\n return packet;\r\n }\r\n\r\n public static object ParseRequest (byte[] packet)\r\n {\r\n if (packet.Length < 21)\r\n {\r\n Console.Error.WriteLine(\"Received get-quote request with fewer than 21 bytes\");\r\n return new InvalidRequest();\r\n }\r\n byte[] nonce = packet.Skip(1).Take(20).ToArray();\r\n return new GetQuoteRequest(nonce);\r\n }\r\n }\r\n\r\n public class GetQuoteResponse\r\n {\r\n private UInt32 error_code;\r\n private RSACryptoServiceProvider public_key;\r\n private byte[] pcr_info;\r\n private byte[] sig;\r\n\r\n public RSACryptoServiceProvider PublicKey { get { return public_key; } }\r\n\r\n public GetQuoteResponse(byte[] packet)\r\n {\r\n if (packet.Length < 17)\r\n {\r\n throw new Exception(\"Invalid GetQuoteResponse packet -- length < 17\");\r\n }\r\n if (packet[0] != 1)\r\n {\r\n throw new Exception(\"First byte of GetQuoteResponse is not 1\");\r\n }\r\n error_code = CommonRoutines.ExtractBEWord(packet, 1);\r\n if (error_code != 0)\r\n {\r\n throw new ErrorCodeException(error_code);\r\n }\r\n int encoded_public_key_length = (int)CommonRoutines.ExtractBEWord(packet, 5);\r\n int pcr_info_bytes_length = (int)CommonRoutines.ExtractBEWord(packet, 9);\r\n int sig_bytes_length = (int)CommonRoutines.ExtractBEWord(packet, 13);\r\n if (packet.Length < 17 + encoded_public_key_length + pcr_info_bytes_length + sig_bytes_length)\r\n {\r\n throw new Exception(\"Invalid GetQuoteResponse packet -- length not big enough\");\r\n }\r\n byte[] encoded_public_key = packet.Skip(17).Take(encoded_public_key_length).ToArray();\r\n pcr_info = packet.Skip(17 + encoded_public_key_length).Take(pcr_info_bytes_length).ToArray();\r\n sig = packet.Skip(17 + encoded_public_key_length + pcr_info_bytes_length).Take(sig_bytes_length).ToArray();\r\n\r\n CheckPCRInfo(pcr_info, encoded_public_key);\r\n\r\n public_key = CommonRoutines.DecodePublicKey(encoded_public_key);\r\n }\r\n\r\n public GetQuoteResponse (UInt32 i_error_code, RSACryptoServiceProvider i_public_key)\r\n {\r\n error_code = i_error_code;\r\n public_key = i_public_key;\r\n\r\n pcr_info = new byte[25];\r\n pcr_info[0] = 0;\r\n pcr_info[1] = 3;\r\n pcr_info[2] = 0;\r\n pcr_info[3] = 0;\r\n pcr_info[4] = 14;\r\n if (CommonParams.loaderHash.Length == 40 && CommonParams.appHash.Length == 40) {\r\n SHA1Managed hasher = new SHA1Managed();\r\n byte[] encoded_public_key = CommonRoutines.EncodePublicKey(public_key);\r\n byte[] pcr17 = GetExpectedPCR17();\r\n byte[] pcr18 = GetZeroPCR();\r\n byte[] pcr19 = GetExpectedPCR19(hasher, encoded_public_key);\r\n byte[] tpm_pcr_composite = CommonRoutines.CombineByteArrays(pcr_info.Take(5).ToArray(), BitConverter.GetBytes((UInt32)60), pcr17, pcr18, pcr19);\r\n byte[] h1 = hasher.ComputeHash(tpm_pcr_composite);\r\n Array.Copy(h1, 0, pcr_info, 5, 20);\r\n }\r\n\r\n sig = new byte[1];\r\n sig[0] = 0;\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return string.Format(\"GetQuoteResponse(error_code={0}, public_key={1}, pcr_info={2}, sig={3})\", error_code, public_key, pcr_info, sig);\r\n }\r\n\r\n private byte[] GetZeroPCR()\r\n {\r\n byte[] values = new byte[20];\r\n for (int i = 0; i < 20; ++i)\r\n {\r\n values[i] = 0;\r\n }\r\n return values;\r\n }\r\n\r\n private byte[] ExtendPCR(SHA1Managed hasher, byte[] currentValue, byte[] valueToExtendBy)\r\n {\r\n return hasher.ComputeHash(CommonRoutines.CombineByteArrays(currentValue, valueToExtendBy));\r\n }\r\n\r\n private byte[] ConvertHexStringToByteArray(string hex)\r\n {\r\n int num_bytes = hex.Length / 2;\r\n byte[] arr = new byte[num_bytes];\r\n for (int i = 0; i < num_bytes; ++i)\r\n {\r\n arr[i] = Convert.ToByte(hex.Substring(i * 2, 2), 16);\r\n }\r\n return arr;\r\n }\r\n\r\n private byte[] GetExpectedPCR17()\r\n {\r\n return ConvertHexStringToByteArray(CommonParams.loaderHash);\r\n }\r\n\r\n private byte[] GetExpectedPCR19(SHA1Managed hasher, byte[] encoded_public_key)\r\n {\r\n byte[] pcr = GetZeroPCR();\r\n pcr = ExtendPCR(hasher, pcr, ConvertHexStringToByteArray(CommonParams.appHash));\r\n pcr = ExtendPCR(hasher, pcr, hasher.ComputeHash(encoded_public_key));\r\n return pcr;\r\n }\r\n\r\n private void CheckPCRInfo(byte[] pcr_info, byte[] encoded_public_key)\r\n {\r\n if (pcr_info[0] != 0 || pcr_info[1] != 3 || pcr_info[2] != 0 || pcr_info[3] != 0 || pcr_info[4] != 14)\r\n {\r\n throw new Exception(\"Invalid PCR selection in PCR info\");\r\n }\r\n\r\n if (CommonParams.loaderHash.Length != 40 || CommonParams.appHash.Length != 40)\r\n {\r\n Console.Error.WriteLine(\"Skipping TPM composite hash check because loader hash and app hash weren't supplied\");\r\n return;\r\n }\r\n\r\n SHA1Managed hasher = new SHA1Managed();\r\n byte[] pcr17 = GetExpectedPCR17();\r\n byte[] pcr18 = GetZeroPCR();\r\n byte[] pcr19 = GetExpectedPCR19(hasher, encoded_public_key);\r\n byte[] tpm_pcr_composite = CommonRoutines.CombineByteArrays(pcr_info.Take(5).ToArray(), BitConverter.GetBytes((UInt32)60), pcr17, pcr18, pcr19);\r\n byte[] h1 = hasher.ComputeHash(tpm_pcr_composite);\r\n\r\n byte[] received_h1 = pcr_info.Skip(5).Take(20).ToArray();\r\n\r\n if (!h1.SequenceEqual(received_h1))\r\n {\r\n throw new Exception(\"Composite hash in received PCR info not what was expected\");\r\n }\r\n }\r\n\r\n public byte[] Encode ()\r\n {\r\n byte[] header = new byte[1];\r\n header[0] = 1;\r\n\r\n byte[] error_code = CommonRoutines.EncodeBEWord(0);\r\n\r\n byte[] encoded_public_key = CommonRoutines.EncodePublicKey(public_key);\r\n byte[] encoded_public_key_length = CommonRoutines.EncodeBEWord((uint)encoded_public_key.Length);\r\n\r\n byte[] pcr_info_length = CommonRoutines.EncodeBEWord((uint)pcr_info.Length);\r\n byte[] sig_length = CommonRoutines.EncodeBEWord((uint)sig.Length);\r\n\r\n return CommonRoutines.CombineByteArrays(header, error_code, encoded_public_key_length, pcr_info_length, sig_length, encoded_public_key, pcr_info, sig);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Common/Profiler.cs", "content": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\nusing System.Web.UI.DataVisualization.Charting;\r\n\r\nnamespace Common\r\n{\r\n public class Aggregator\r\n {\r\n private static Chart chart;\r\n private string name;\r\n private bool times;\r\n private long total;\r\n private int count;\r\n private double sumsq;\r\n\r\n public static void Initialize()\r\n {\r\n chart = new Chart();\r\n }\r\n\r\n public Aggregator(string i_name, bool i_times)\r\n {\r\n name = i_name;\r\n times = i_times;\r\n total = 0;\r\n count = 0;\r\n sumsq = 0;\r\n }\r\n\r\n public void AddValue(long value)\r\n {\r\n if (CommonParams.printValues)\r\n {\r\n Console.WriteLine(\"{0}\\t{1}\", name, value * 1.0 / Stopwatch.Frequency);\r\n }\r\n\r\n total += value;\r\n count++;\r\n sumsq += (value * 1.0 * value);\r\n }\r\n\r\n public void AddTime(Stopwatch s)\r\n {\r\n AddValue(s.ElapsedTicks);\r\n }\r\n\r\n public override string ToString()\r\n {\r\n if (count < 1) { return name + \": \"; }\r\n\r\n if (times)\r\n {\r\n double total_sec = total * 1.0 / Stopwatch.Frequency;\r\n if (count == 1) { return name + \": \" + total_sec.ToString(); }\r\n double average_sec = total_sec / count;\r\n double sumsq_sec = sumsq / Stopwatch.Frequency / Stopwatch.Frequency;\r\n double variance = (sumsq_sec - total_sec * total_sec / count) / (count - 1);\r\n double stdev = Math.Sqrt(variance);\r\n double conf95 = stdev * chart.DataManipulator.Statistics.InverseTDistribution(0.05, count-1) / Math.Sqrt(count);\r\n return string.Format(\"{0}: avg_sec {1} conf95plusorminus {2} stdev {3}\", name, average_sec, conf95, stdev);\r\n }\r\n else\r\n {\r\n if (count == 1) { return total.ToString(); }\r\n double average = total * 1.0 / count;\r\n double variance = (sumsq - (total * 1.0 * total) / count) / (count - 1);\r\n double stdev = Math.Sqrt(variance);\r\n double conf95 = stdev * chart.DataManipulator.Statistics.InverseTDistribution(0.05, count-1) / Math.Sqrt(count);\r\n return string.Format(\"{0}: avg {1} conf95plusorminus {2} stdev {3}\", name, average, conf95, stdev);\r\n }\r\n }\r\n }\r\n\r\n public class Profiler\r\n {\r\n static Dictionary aggregators;\r\n\r\n public static void Initialize()\r\n {\r\n aggregators = new Dictionary();\r\n Aggregator.Initialize();\r\n }\r\n\r\n public static void Record(string name, long value)\r\n {\r\n if (!aggregators.ContainsKey(name))\r\n {\r\n aggregators[name] = new Aggregator(name, false);\r\n }\r\n\r\n aggregators[name].AddValue(value);\r\n }\r\n\r\n public static void Record(string name, Stopwatch stopwatch)\r\n {\r\n if (!aggregators.ContainsKey(name))\r\n {\r\n aggregators[name] = new Aggregator(name, true);\r\n }\r\n\r\n aggregators[name].AddValue(stopwatch.ElapsedTicks);\r\n }\r\n\r\n public static void Print()\r\n {\r\n foreach (KeyValuePair entry in aggregators)\r\n {\r\n Console.WriteLine(entry.Value.ToString());\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Common/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"Common\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"Common\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n\r\n[assembly: Guid(\"50f794c5-efb1-4501-9fdb-81ece815247d\")]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/Clients/DiffPriv/App.config", "content": "\r\n\r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/DiffPriv/DiffPriv.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {9F8B6096-C335-433E-B00F-092D5CDF0CE1}\r\n Exe\r\n Properties\r\n DiffPriv\r\n DiffPriv\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {5e394d90-c3d6-41a1-a6b4-715e43e54d7c}\r\n Common\r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/DiffPriv/DiffPrivRequests.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace DiffPriv\r\n{\r\n public class InitializeDBRequest\r\n {\r\n private Rational budget;\r\n\r\n public InitializeDBRequest(Rational i_budget)\r\n {\r\n budget = i_budget;\r\n }\r\n\r\n public byte[] GetPacket()\r\n {\r\n byte[] header = new byte[1]; header[0] = 2;\r\n byte[] encoded_budget_num = CommonRoutines.EncodeBEWord(budget.num);\r\n byte[] encoded_budget_den = CommonRoutines.EncodeBEWord(budget.den);\r\n return CommonRoutines.CombineByteArrays(header, encoded_budget_num, encoded_budget_den);\r\n }\r\n }\r\n\r\n public class AddRowRequest\r\n {\r\n private UInt32[] values;\r\n private Rational max_budget;\r\n private byte[] nonce;\r\n\r\n public AddRowRequest(UInt32[] i_values, Rational i_max_budget, Random rng)\r\n {\r\n values = i_values;\r\n max_budget = i_max_budget;\r\n nonce = new byte[Parameters.nonceBytes];\r\n rng.NextBytes(nonce);\r\n }\r\n\r\n public byte[] GetPacket(RSACryptoServiceProvider ironclad_public_key)\r\n {\r\n byte[] header = new byte[1]; header[0] = 3;\r\n byte[] row_nonce_size_encoded = CommonRoutines.EncodeBEWord((UInt32)nonce.Length);\r\n byte[] row_data_size_encoded = CommonRoutines.EncodeBEWord((UInt32)values.Length * 4);\r\n byte[] max_budget_num_encoded = CommonRoutines.EncodeBEWord(max_budget.num);\r\n byte[] max_budget_den_encoded = CommonRoutines.EncodeBEWord(max_budget.den);\r\n\r\n byte[] row_encoded = new byte[values.Length*4];\r\n for (int i = 0; i < values.Length; ++i)\r\n {\r\n byte[] value_encoded = CommonRoutines.EncodeBEWord(values[i]);\r\n value_encoded.CopyTo(row_encoded, i * 4);\r\n }\r\n\r\n byte[] plaintext = CommonRoutines.CombineByteArrays(\r\n row_nonce_size_encoded,\r\n row_data_size_encoded,\r\n max_budget_num_encoded,\r\n max_budget_den_encoded,\r\n nonce,\r\n row_encoded);\r\n byte[] encrypted = ironclad_public_key.Encrypt(plaintext, false);\r\n return CommonRoutines.CombineByteArrays(header, encrypted);\r\n }\r\n }\r\n\r\n public class QueryRequest\r\n {\r\n private UInt32 row_min;\r\n private UInt32 row_max;\r\n private UInt32 answer_units;\r\n private UInt32 answer_min;\r\n private UInt32 answer_max;\r\n private Rational alpha;\r\n private Rational beta;\r\n private UInt32[] program;\r\n\r\n public QueryRequest(UInt32 i_row_min, UInt32 i_row_max, UInt32 i_answer_units, UInt32 i_answer_min, UInt32 i_answer_max,\r\n Rational i_alpha, Rational i_beta, UInt32[] i_program)\r\n {\r\n row_min = i_row_min;\r\n row_max = i_row_max;\r\n answer_units = i_answer_units;\r\n answer_min = i_answer_min;\r\n answer_max = i_answer_max;\r\n alpha = i_alpha;\r\n beta = i_beta;\r\n program = i_program;\r\n }\r\n\r\n public byte[] GetPacket()\r\n {\r\n byte[] header = new byte[1]; header[0] = 4;\r\n byte[] program_size_encoded = CommonRoutines.EncodeBEWord((UInt32)program.Length * 4);\r\n byte[] row_min_encoded = CommonRoutines.EncodeBEWord(row_min);\r\n byte[] row_max_encoded = CommonRoutines.EncodeBEWord(row_max);\r\n byte[] answer_units_encoded = CommonRoutines.EncodeBEWord(answer_units);\r\n byte[] answer_min_encoded = CommonRoutines.EncodeBEWord(answer_min);\r\n byte[] answer_max_encoded = CommonRoutines.EncodeBEWord(answer_max);\r\n byte[] alpha_num_encoded = CommonRoutines.EncodeBEWord(alpha.num);\r\n byte[] alpha_den_encoded = CommonRoutines.EncodeBEWord(alpha.den);\r\n byte[] beta_num_encoded = CommonRoutines.EncodeBEWord(beta.num);\r\n byte[] beta_den_encoded = CommonRoutines.EncodeBEWord(beta.den);\r\n\r\n byte[] program_encoded = new byte[program.Length*4];\r\n for (int i = 0; i < program.Length; ++i)\r\n {\r\n byte[] instruction_encoded = CommonRoutines.EncodeBEWord(program[i]);\r\n instruction_encoded.CopyTo(program_encoded, i * 4);\r\n }\r\n\r\n return CommonRoutines.CombineByteArrays(header, program_size_encoded, row_min_encoded, row_max_encoded,\r\n answer_units_encoded, answer_min_encoded, answer_max_encoded,\r\n alpha_num_encoded, alpha_den_encoded,\r\n beta_num_encoded, beta_den_encoded, program_encoded);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/DiffPriv/DiffPrivResponses.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace DiffPriv\r\n{\r\n class InitializeDBResponse\r\n {\r\n private UInt32 error_code;\r\n\r\n public UInt32 ErrorCode { get { return error_code; } }\r\n\r\n public InitializeDBResponse(byte[] packet)\r\n {\r\n if (packet.Length < 5)\r\n {\r\n throw new Exception(\"Invalid InitializeDBResponse packet -- length < 5\");\r\n }\r\n if (packet[0] != 2)\r\n {\r\n throw new Exception(\"First byte of InitializeDBResponse packet is not 2\");\r\n }\r\n error_code = CommonRoutines.ExtractBEWord(packet, 1);\r\n if (error_code != 0)\r\n {\r\n throw new ErrorCodeException(error_code);\r\n }\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return string.Format(\"InitializeDBResponse(error_code={0})\", error_code);\r\n }\r\n }\r\n\r\n class AddRowResponse\r\n {\r\n public AddRowResponse(byte[] packet)\r\n {\r\n if (packet.Length < 1)\r\n {\r\n throw new Exception(\"Invalid AddRowResponse packet -- length < 5\");\r\n }\r\n if (packet[0] != 3)\r\n {\r\n throw new Exception(\"First byte of AddRowResponse packet is not 3\");\r\n }\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return string.Format(\"AddRowResponse()\");\r\n }\r\n }\r\n\r\n class QueryResponse\r\n {\r\n private UInt32 error_code;\r\n private UInt32 response_value;\r\n\r\n public UInt32 ErrorCode { get { return error_code; } }\r\n public UInt32 ResponseValue { get { return response_value; } }\r\n\r\n public QueryResponse(byte[] packet)\r\n {\r\n if (packet.Length < 9)\r\n {\r\n throw new Exception(\"Invalid QueryResponse packet -- length < 9\");\r\n }\r\n if (packet[0] != 4)\r\n {\r\n throw new Exception(\"First byte of QueryResponse packet is not 4\");\r\n }\r\n error_code = CommonRoutines.ExtractBEWord(packet, 1);\r\n if (error_code != 0)\r\n {\r\n throw new ErrorCodeException(error_code);\r\n }\r\n response_value = CommonRoutines.ExtractBEWord(packet, 5);\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return string.Format(\"QueryResponse(error_code={0})\", error_code);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/DiffPriv/Parameters.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace DiffPriv\r\n{\r\n class InvalidParameterException : Exception\r\n {\r\n public string contents;\r\n public InvalidParameterException(string i_contents) { contents = i_contents; }\r\n }\r\n\r\n public class Parameters\r\n {\r\n public static int numColumns = 4;\r\n public static int maxColumnValue = 2048;\r\n public static int numRows = 105;\r\n public static int numQueries = 105;\r\n public static int nonceBytes = 20;\r\n\r\n public static void Print()\r\n {\r\n CommonParams.Print();\r\n Console.Error.WriteLine(\"numColumns\\t{0}\", numColumns);\r\n Console.Error.WriteLine(\"maxColumnValue\\t{0}\", maxColumnValue);\r\n Console.Error.WriteLine(\"numRows\\t{0}\", numRows);\r\n Console.Error.WriteLine(\"numQueries\\t{0}\", numQueries);\r\n Console.Error.WriteLine(\"nonceBytes\\t{0}\", nonceBytes);\r\n }\r\n\r\n public static void PrintUsage()\r\n {\r\n Console.Out.WriteLine(\"Usage: DiffPriv.exe [filename or param=value]... where filename contains\");\r\n Console.Out.WriteLine(\" lines of the form param=value and param must be one of the following.\");\r\n Console.Out.WriteLine();\r\n CommonParams.PrintUsage();\r\n Console.Out.WriteLine(\" numColumns = number of columns in each row\");\r\n Console.Out.WriteLine(\" maxColumnValue = maximum value in each column\");\r\n Console.Out.WriteLine(\" numRows = number of rows to add\");\r\n Console.Out.WriteLine(\" numQueries = number of queries to run\");\r\n Console.Out.WriteLine(\" nonceBytes = number of bytes to use in each row nonce\");\r\n }\r\n\r\n public static void ApplyArguments (string[] args)\r\n {\r\n try\r\n {\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n catch (InvalidParameterException e)\r\n {\r\n Console.Out.WriteLine(e.contents);\r\n Parameters.PrintUsage();\r\n Environment.Exit(-1);\r\n }\r\n }\r\n\r\n public static void ApplyArgument (string arg)\r\n {\r\n char[] splitter = {'='};\r\n string[] sp = arg.ToLower().Split(splitter);\r\n\r\n if (sp.Length == 1)\r\n {\r\n ApplyArgumentsInFile(arg);\r\n return;\r\n }\r\n else if (sp.Length != 2)\r\n {\r\n throw new InvalidParameterException(\"Invalid command-line argument \" + arg);\r\n }\r\n\r\n string parameter = sp[0];\r\n string value = sp[1];\r\n\r\n if (CommonParams.ApplyArgument(parameter, value))\r\n {\r\n return;\r\n }\r\n if (String.Compare(parameter, \"numColumns\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n Parameters.numColumns = Convert.ToInt32(value);\r\n return;\r\n }\r\n if (String.Compare(parameter, \"maxColumnValue\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n Parameters.maxColumnValue = Convert.ToInt32(value);\r\n return;\r\n }\r\n if (String.Compare(parameter, \"numRows\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n Parameters.numRows = Convert.ToInt32(value);\r\n return;\r\n }\r\n if (String.Compare(parameter, \"numQueries\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n Parameters.numQueries = Convert.ToInt32(value);\r\n return;\r\n }\r\n if (String.Compare(parameter, \"nonceBytes\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n Parameters.nonceBytes = Convert.ToInt32(value);\r\n return;\r\n }\r\n\r\n throw new InvalidParameterException(\"Invalid command-line parameter \" + parameter);\r\n }\r\n\r\n public static void ApplyArgumentsInFile(string filename)\r\n {\r\n string[] args = File.ReadAllLines(filename);\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/DiffPriv/Program.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\nusing System.Linq;\r\nusing System.Net;\r\nusing System.Net.Sockets;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace DiffPriv\r\n{\r\n class Program\r\n {\r\n static void InitializeDB(UdpClient client, Rational budget)\r\n {\r\n InitializeDBRequest initializeDBRequest = new InitializeDBRequest(budget);\r\n byte[] request = initializeDBRequest.GetPacket();\r\n byte[] response = CommonRoutines.SendRequest(client, request, \"InitializeDB\");\r\n InitializeDBResponse initializeDBResponse = new InitializeDBResponse(response);\r\n }\r\n\r\n static UInt32[] GetRandomRow(Random rng)\r\n {\r\n UInt32[] row = new UInt32[Parameters.numColumns];\r\n for (int col = 0; col < Parameters.numColumns; ++col)\r\n {\r\n row[col] = (UInt32)rng.Next(Parameters.maxColumnValue);\r\n }\r\n return row;\r\n }\r\n\r\n static void AddRow(UdpClient client, Rational max_budget, UInt32[] values, RSACryptoServiceProvider ironclad_public_key, Random rng)\r\n {\r\n AddRowRequest addRowRequest = new AddRowRequest(values, max_budget, rng);\r\n byte[] request = addRowRequest.GetPacket(ironclad_public_key);\r\n byte[] response = CommonRoutines.SendRequest(client, request, \"AddRow\");\r\n AddRowResponse addRowResponse = new AddRowResponse(response);\r\n }\r\n\r\n static void PerformQuery(UdpClient client, UInt32 row_min, UInt32 row_max, UInt32 answer_units, UInt32 answer_min,\r\n UInt32 answer_max, Rational alpha, Rational beta, UInt32[] program)\r\n {\r\n QueryRequest queryRequest = new QueryRequest(row_min, row_max, answer_units, answer_min, answer_max, alpha, beta, program);\r\n byte[] request = queryRequest.GetPacket();\r\n byte[] response = CommonRoutines.SendRequest(client, request, \"Query\");\r\n QueryResponse queryResponse = new QueryResponse(response);\r\n Console.Error.WriteLine(\"Noised answer received was {0}\", queryResponse.ResponseValue);\r\n }\r\n\r\n static UInt32[] MakeProgram()\r\n {\r\n UInt32[] program = new UInt32[Parameters.numColumns * 5 - 1];\r\n\r\n \r\n \r\n \r\n\r\n int pos = 0;\r\n for (UInt32 col = 0; col < Parameters.numColumns; ++col)\r\n {\r\n program[pos++] = col;\r\n program[pos++] = 2000000001; \r\n if (col > 0)\r\n {\r\n program[pos++] = 2000000003; \r\n program[pos++] = (UInt32)Parameters.maxColumnValue;\r\n program[pos++] = 2000000007; \r\n }\r\n }\r\n\r\n program[pos++] = (UInt32)(Parameters.maxColumnValue / 2);\r\n program[pos++] = 2000000009; \r\n Debug.Assert(pos == program.Length);\r\n\r\n return program;\r\n }\r\n\r\n static void Main(string[] args)\r\n {\r\n Parameters.ApplyArguments(args);\r\n Profiler.Initialize();\r\n UdpClient client = CommonRoutines.StartClient();\r\n\r\n Console.Error.WriteLine(\"Getting Ironclad public key\");\r\n RSACryptoServiceProvider ironclad_public_key = CommonRoutines.GetIroncladPublicKey(client);\r\n\r\n UInt32 row_min = 0;\r\n UInt32 row_max = 1;\r\n UInt32 answer_units = 1;\r\n UInt32 answer_min = 0;\r\n UInt32 answer_max = (UInt32)Parameters.numRows;\r\n Rational alpha = new Rational(1009, 1000);\r\n Rational beta = new Rational(101, 100);\r\n UInt32[] program = MakeProgram();\r\n\r\n Rational budget = new Rational((UInt32) Math.Ceiling(Math.Pow(beta.Value, Parameters.numQueries * 3)));\r\n \r\n Console.Error.WriteLine(\"Initializing database\");\r\n for (UInt32 run_number = 0; run_number < CommonParams.numberOfRuns; ++run_number)\r\n {\r\n InitializeDB(client, budget);\r\n }\r\n\r\n Random rng = new Random();\r\n for (UInt32 row_number = 0; row_number < Parameters.numRows; ++row_number)\r\n {\r\n Console.Error.WriteLine(\"Adding row {0}\", row_number + 1);\r\n UInt32[] row = GetRandomRow(rng);\r\n AddRow(client, budget, row, ironclad_public_key, rng);\r\n }\r\n\r\n Console.Error.WriteLine(\"Performing queries\");\r\n\r\n for (UInt32 query_number = 0; query_number < Parameters.numQueries; ++query_number)\r\n {\r\n Console.Error.WriteLine(\"Performing query {0}\", query_number + 1);\r\n PerformQuery(client, row_min, row_max, answer_units, answer_min, answer_max, alpha, beta, program);\r\n }\r\n\r\n Profiler.Print();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/DiffPriv/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"DiffPriv\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"DiffPriv\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n\r\n[assembly: Guid(\"5cb0f60c-30fc-40f1-8445-be38e3ffa50e\")]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/Clients/DiffPriv/Rational.cs", "content": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace DiffPriv\r\n{\r\n public class Rational\r\n {\r\n public UInt32 num;\r\n public UInt32 den;\r\n\r\n public Rational(UInt32 i_num, UInt32 i_den)\r\n {\r\n num = i_num;\r\n den = i_den;\r\n }\r\n\r\n public Rational(UInt32 value)\r\n {\r\n num = value;\r\n den = 1;\r\n }\r\n\r\n public double Value { get { return num * 1.0 / den; } }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/DiffPrivSrv/App.config", "content": "\r\n\r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/DiffPrivSrv/BigRational.cs", "content": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Numerics;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace DiffPrivSrv\r\n{\r\n class BigRational\r\n {\r\n private BigInteger numerator;\r\n private BigInteger denominator;\r\n\r\n public BigRational(BigInteger i_numerator, BigInteger i_denominator)\r\n {\r\n numerator = i_numerator;\r\n denominator = i_denominator;\r\n }\r\n\r\n public BigRational(int i_numerator, int i_denominator)\r\n {\r\n numerator = new BigInteger(i_numerator);\r\n denominator = new BigInteger(i_denominator);\r\n }\r\n\r\n public BigRational(int value)\r\n {\r\n numerator = new BigInteger(value);\r\n denominator = new BigInteger(1);\r\n }\r\n\r\n public BigRational(BigInteger value)\r\n {\r\n numerator = value;\r\n denominator = new BigInteger(1);\r\n }\r\n\r\n public bool IsNegative()\r\n {\r\n return (numerator < 0 && denominator > 0) || (numerator > 0 && denominator < 0);\r\n }\r\n\r\n public bool IsZero()\r\n {\r\n return numerator == 0;\r\n }\r\n\r\n public bool IsPositive()\r\n {\r\n return (numerator > 0 && denominator > 0) || (numerator < 0 && denominator < 0);\r\n }\r\n\r\n public static BigRational operator +(BigRational r1, BigRational r2)\r\n {\r\n return new BigRational(r1.numerator * r2.denominator + r2.numerator * r1.denominator, r1.denominator * r2.denominator);\r\n }\r\n\r\n public static BigRational operator -(BigRational r1, BigRational r2)\r\n {\r\n return new BigRational(r1.numerator * r2.denominator - r2.numerator * r1.denominator, r1.denominator * r2.denominator);\r\n }\r\n\r\n public static BigRational operator *(BigRational r1, BigRational r2)\r\n {\r\n return new BigRational(r1.numerator * r2.numerator, r1.denominator * r2.denominator);\r\n }\r\n\r\n public static BigRational operator /(BigRational r1, BigRational r2)\r\n {\r\n return new BigRational(r1.numerator * r2.denominator, r1.denominator * r2.numerator);\r\n }\r\n\r\n public static bool operator <(BigRational r1, BigRational r2)\r\n {\r\n return (r1 - r2).IsNegative();\r\n }\r\n\r\n public static bool operator >(BigRational r1, BigRational r2)\r\n {\r\n return (r1 - r2).IsPositive();\r\n }\r\n\r\n public static bool operator ==(BigRational r1, BigRational r2)\r\n {\r\n return (r1 - r2).IsZero();\r\n }\r\n\r\n public static bool operator !=(BigRational r1, BigRational r2)\r\n {\r\n return !(r1 - r2).IsZero();\r\n }\r\n\r\n public static bool operator <=(BigRational r1, BigRational r2)\r\n {\r\n return !(r1 - r2).IsPositive();\r\n }\r\n\r\n public static bool operator >=(BigRational r1, BigRational r2)\r\n {\r\n return !(r1 - r2).IsNegative();\r\n }\r\n\r\n public override bool Equals(object obj)\r\n {\r\n return obj is BigRational && this == (BigRational)obj;\r\n }\r\n\r\n public override int GetHashCode()\r\n {\r\n return 0;\r\n }\r\n\r\n public static BigRational Power(BigRational x, UInt32 e)\r\n {\r\n BigRational x_to_e = new BigRational(1);\r\n while (e > 0)\r\n {\r\n x_to_e *= x;\r\n e -= 1;\r\n }\r\n return x_to_e;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/DiffPrivSrv/DiffPrivRequest.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\nusing System.Linq;\r\nusing System.Text;\r\n\r\nnamespace DiffPrivSrv\r\n{\r\n public class DiffPrivRequest\r\n {\r\n public DiffPrivRequest() { }\r\n\r\n public static object ParseRequest (byte[] request)\r\n {\r\n if (request.Length < 1)\r\n {\r\n Console.Error.WriteLine(\"Received request with no bytes\");\r\n return new Common.InvalidRequest();\r\n }\r\n if (request[0] == 1)\r\n {\r\n return Common.GetQuoteRequest.ParseRequest(request);\r\n }\r\n if (request[0] == 2)\r\n {\r\n return InitializeDBRequest.ParseRequest(request);\r\n }\r\n if (request[0] == 3)\r\n {\r\n return AddRowRequest.ParseRequest(request);\r\n }\r\n if (request[0] == 4)\r\n {\r\n return QueryRequest.ParseRequest(request);\r\n }\r\n Console.Error.WriteLine(\"Received request with invalid type\");\r\n return new Common.InvalidRequest();\r\n }\r\n }\r\n\r\n public class InitializeDBRequest\r\n {\r\n public UInt32 budget_num;\r\n public UInt32 budget_den;\r\n\r\n public InitializeDBRequest(UInt32 i_budget_num, UInt32 i_budget_den)\r\n {\r\n budget_num = i_budget_num;\r\n budget_den = i_budget_den;\r\n }\r\n\r\n public static object ParseRequest (byte[] request)\r\n {\r\n if (request.Length < 9)\r\n {\r\n Console.Error.WriteLine(\"Received initialize-DB request with fewer than 9 bytes\");\r\n return new Common.InvalidRequest();\r\n }\r\n UInt32 budget_num = CommonRoutines.ExtractBEWord(request, 1);\r\n UInt32 budget_den = CommonRoutines.ExtractBEWord(request, 5);\r\n return new InitializeDBRequest(budget_num, budget_den);\r\n }\r\n }\r\n\r\n public class AddRowRequest\r\n {\r\n public byte[] ciphertext;\r\n\r\n public AddRowRequest(byte[] i_ciphertext)\r\n {\r\n ciphertext = i_ciphertext;\r\n }\r\n\r\n public static object ParseRequest (byte[] request)\r\n {\r\n if (request.Length < 2 || (request.Length-1) % 4 != 0)\r\n {\r\n Console.Error.WriteLine(\"Received add-row request with invalid number of bytes {0}\", request.Length);\r\n return new Common.InvalidRequest();\r\n }\r\n byte[] ciphertext = request.Skip(1).ToArray();\r\n return new AddRowRequest(ciphertext);\r\n }\r\n }\r\n\r\n public class QueryRequest\r\n {\r\n public UInt32 row_min;\r\n public UInt32 row_max;\r\n public UInt32 answer_units;\r\n public UInt32 answer_min;\r\n public UInt32 answer_max;\r\n public UInt32 alpha_num;\r\n public UInt32 alpha_den;\r\n public UInt32 beta_num;\r\n public UInt32 beta_den;\r\n public byte[] program_encoding;\r\n\r\n public QueryRequest(UInt32 i_row_min, UInt32 i_row_max, UInt32 i_answer_units, UInt32 i_answer_min, UInt32 i_answer_max,\r\n UInt32 i_alpha_num, UInt32 i_alpha_den, UInt32 i_beta_num, UInt32 i_beta_den, byte[] i_program_encoding)\r\n {\r\n row_min = i_row_min;\r\n row_max = i_row_max;\r\n answer_units = i_answer_units;\r\n answer_min = i_answer_min;\r\n answer_max = i_answer_max;\r\n alpha_num = i_alpha_num;\r\n alpha_den = i_alpha_den;\r\n beta_num = i_beta_num;\r\n beta_den = i_beta_den;\r\n program_encoding = i_program_encoding;\r\n }\r\n\r\n public static object ParseRequest (byte[] request)\r\n {\r\n if (request.Length < 41)\r\n {\r\n Console.Error.WriteLine(\"Received query request with fewer than 41 bytes\");\r\n return new Common.InvalidRequest();\r\n }\r\n int program_size = (int)CommonRoutines.ExtractBEWord(request, 1);\r\n if (request.Length < 41 + program_size)\r\n {\r\n Console.Error.WriteLine(\"Received query request without enough bytes to fit program\");\r\n return new Common.InvalidRequest();\r\n }\r\n if (program_size % 4 != 0)\r\n {\r\n Console.Error.WriteLine(\"Received query request with program not consisting of an integer number of words\");\r\n return new Common.InvalidRequest();\r\n }\r\n\r\n UInt32 row_min = CommonRoutines.ExtractBEWord(request, 5);\r\n UInt32 row_max = CommonRoutines.ExtractBEWord(request, 9);\r\n UInt32 answer_units = CommonRoutines.ExtractBEWord(request, 13);\r\n UInt32 answer_min = CommonRoutines.ExtractBEWord(request, 17);\r\n UInt32 answer_max = CommonRoutines.ExtractBEWord(request, 21);\r\n UInt32 alpha_num = CommonRoutines.ExtractBEWord(request, 25);\r\n UInt32 alpha_den = CommonRoutines.ExtractBEWord(request, 29);\r\n UInt32 beta_num = CommonRoutines.ExtractBEWord(request, 33);\r\n UInt32 beta_den = CommonRoutines.ExtractBEWord(request, 37);\r\n byte[] program_encoding = request.Skip(41).ToArray();\r\n\r\n return new QueryRequest(row_min, row_max, answer_units, answer_min, answer_max,\r\n alpha_num, alpha_den, beta_num, beta_den, program_encoding);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/DiffPrivSrv/DiffPrivResponse.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace DiffPrivSrv\r\n{\r\n class DiffPrivSrvResponse\r\n {\r\n public static byte[] EncodeInitializeDBResponse (UInt32 error_code)\r\n {\r\n byte[] header = new byte[1];\r\n header[0] = 2;\r\n\r\n byte[] error_code_encoded = CommonRoutines.EncodeBEWord(error_code);\r\n\r\n return CommonRoutines.CombineByteArrays(header, error_code_encoded);\r\n }\r\n\r\n public static byte[] EncodeAddRowResponse ()\r\n {\r\n byte[] header = new byte[1];\r\n header[0] = 3;\r\n return header;\r\n }\r\n\r\n public static byte[] EncodeQueryResponse (UInt32 error_code, UInt32 response_value)\r\n {\r\n byte[] header = new byte[1];\r\n header[0] = 4;\r\n\r\n byte[] error_code_encoded = CommonRoutines.EncodeBEWord(error_code);\r\n byte[] response_value_encoded = CommonRoutines.EncodeBEWord((uint)response_value);\r\n\r\n return CommonRoutines.CombineByteArrays(header, error_code_encoded, response_value_encoded);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/DiffPrivSrv/DiffPrivSrv.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {29139FBF-8F54-41A3-B135-F9AFCA3714C1}\r\n Exe\r\n Properties\r\n DiffPrivSrv\r\n DiffPrivSrv\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {5e394d90-c3d6-41a1-a6b4-715e43e54d7c}\r\n Common\r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/DiffPrivSrv/Parameters.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Text;\r\n\r\nnamespace DiffPrivSrv\r\n{\r\n class InvalidParameterException : Exception\r\n {\r\n public string contents;\r\n public InvalidParameterException(string i_contents) { contents = i_contents; }\r\n }\r\n\r\n public class Parameters\r\n {\r\n public static void Print()\r\n {\r\n CommonParams.Print();\r\n }\r\n\r\n public static void PrintUsage()\r\n {\r\n Console.Out.WriteLine(\"Usage: DiffPrivSrv.exe [filename or param=value]... where filename contains\");\r\n Console.Out.WriteLine(\" lines of the form param=value and param must be one of the following.\");\r\n Console.Out.WriteLine();\r\n CommonParams.PrintUsage();\r\n }\r\n\r\n public static void ApplyArguments (string[] args)\r\n {\r\n try\r\n {\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n catch (InvalidParameterException e)\r\n {\r\n Console.Out.WriteLine(e.contents);\r\n Parameters.PrintUsage();\r\n Environment.Exit(-1);\r\n }\r\n }\r\n\r\n public static void ApplyArgument (string arg)\r\n {\r\n char[] splitter = {'='};\r\n string[] sp = arg.ToLower().Split(splitter);\r\n\r\n if (sp.Length == 1)\r\n {\r\n ApplyArgumentsInFile(arg);\r\n return;\r\n }\r\n else if (sp.Length != 2)\r\n {\r\n throw new InvalidParameterException(\"Invalid command-line argument \" + arg);\r\n }\r\n\r\n string parameter = sp[0];\r\n string value = sp[1];\r\n\r\n if (CommonParams.ApplyArgument(parameter, value))\r\n {\r\n return;\r\n }\r\n\r\n throw new InvalidParameterException(\"Invalid command-line parameter \" + parameter);\r\n }\r\n\r\n public static void ApplyArgumentsInFile(string filename)\r\n {\r\n string[] args = File.ReadAllLines(filename);\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/DiffPrivSrv/Program.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Net;\r\nusing System.Net.Sockets;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace DiffPrivSrv\r\n{\r\n class Program\r\n {\r\n static byte[] HandleRequest(byte[] request)\r\n {\r\n return new byte[0];\r\n }\r\n\r\n static void Main(string[] args)\r\n {\r\n Parameters.ApplyArguments(args);\r\n UdpClient server = CommonRoutines.StartServer();\r\n StateMachine stateMachine = new StateMachine();\r\n IPEndPoint client = new IPEndPoint(IPAddress.Any, 0);\r\n while (true)\r\n {\r\n byte[] request = server.Receive(ref client);\r\n byte[] response = stateMachine.HandleRequest(request);\r\n server.Send(response, response.Length, client);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/DiffPrivSrv/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"DiffPrivSrv\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"DiffPrivSrv\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n\r\n[assembly: Guid(\"889d7ec6-ade0-45ed-897a-b73a6dc8d276\")]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/Clients/DiffPrivSrv/StateMachine.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Numerics;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\n\r\nnamespace DiffPrivSrv\r\n{\r\n class DiffPrivRow\r\n {\r\n public byte[] nonce;\r\n public UInt32[] data;\r\n\r\n public DiffPrivRow(byte[] i_nonce, UInt32[] i_data)\r\n {\r\n nonce = i_nonce;\r\n data = i_data;\r\n }\r\n }\r\n\r\n abstract class Operation\r\n {\r\n public Operation() { }\r\n\r\n public static Operation ConvertWordToOperation(UInt32 w)\r\n {\r\n if (w == 2000000001) { return new OperationColumn(); }\r\n if (w == 2000000002) { return new OperationIf(); }\r\n if (w == 2000000003) { return new OperationAdd(); }\r\n if (w == 2000000004) { return new OperationSub(); }\r\n if (w == 2000000005) { return new OperationMul(); }\r\n if (w == 2000000006) { return new OperationDiv(); }\r\n if (w == 2000000007) { return new OperationMod(); }\r\n if (w == 2000000008) { return new OperationGt(); }\r\n if (w == 2000000009) { return new OperationLt(); }\r\n if (w == 2000000010) { return new OperationEq(); }\r\n if (w == 2000000011) { return new OperationGe(); }\r\n if (w == 2000000012) { return new OperationLe(); }\r\n return new OperationPush(w);\r\n }\r\n\r\n public abstract int StackSizeChange();\r\n public abstract void Apply(Stack stack, UInt32[] data);\r\n }\r\n\r\n class OperationColumn : Operation\r\n {\r\n public OperationColumn() { }\r\n public override int StackSizeChange() { return 0; }\r\n\r\n public override void Apply(Stack stack, UInt32[] data)\r\n {\r\n UInt32 column = stack.Pop();\r\n UInt32 value = (column >= 0 && column < data.Length ? data[column] : 0);\r\n stack.Push(value);\r\n }\r\n }\r\n\r\n class OperationIf : Operation\r\n {\r\n public OperationIf() { }\r\n public override int StackSizeChange() { return -2; }\r\n\r\n public override void Apply(Stack stack, UInt32[] data)\r\n {\r\n UInt32 false_value = stack.Pop();\r\n UInt32 true_value = stack.Pop();\r\n UInt32 condition = stack.Pop();\r\n UInt32 value = (condition != 0 ? true_value : false_value);\r\n stack.Push(value);\r\n }\r\n }\r\n\r\n class OperationAdd : Operation\r\n {\r\n public OperationAdd() { }\r\n public override int StackSizeChange() { return -1; }\r\n\r\n public override void Apply(Stack stack, UInt32[] data)\r\n {\r\n UInt32 value2 = stack.Pop();\r\n UInt32 value1 = stack.Pop();\r\n UInt32 value = value1 + value2;\r\n stack.Push(value);\r\n }\r\n }\r\n\r\n class OperationSub : Operation\r\n {\r\n public OperationSub() { }\r\n public override int StackSizeChange() { return -1; }\r\n\r\n public override void Apply(Stack stack, UInt32[] data)\r\n {\r\n UInt32 value2 = stack.Pop();\r\n UInt32 value1 = stack.Pop();\r\n UInt32 value = value1 - value2;\r\n stack.Push(value);\r\n }\r\n }\r\n\r\n class OperationMul : Operation\r\n {\r\n public OperationMul() { }\r\n public override int StackSizeChange() { return -1; }\r\n\r\n public override void Apply(Stack stack, UInt32[] data)\r\n {\r\n UInt32 value2 = stack.Pop();\r\n UInt32 value1 = stack.Pop();\r\n UInt32 value = value1 * value2;\r\n stack.Push(value);\r\n }\r\n }\r\n\r\n class OperationDiv : Operation\r\n {\r\n public OperationDiv() { }\r\n public override int StackSizeChange() { return -1; }\r\n\r\n public override void Apply(Stack stack, UInt32[] data)\r\n {\r\n UInt32 value2 = stack.Pop();\r\n UInt32 value1 = stack.Pop();\r\n UInt32 value = (value2 != 0 ? value1 / value2 : 0);\r\n stack.Push(value);\r\n }\r\n }\r\n\r\n class OperationMod : Operation\r\n {\r\n public OperationMod() { }\r\n public override int StackSizeChange() { return -1; }\r\n\r\n public override void Apply(Stack stack, UInt32[] data)\r\n {\r\n UInt32 value2 = stack.Pop();\r\n UInt32 value1 = stack.Pop();\r\n UInt32 value = (value2 != 0 ? value1 % value2 : 0);\r\n stack.Push(value);\r\n }\r\n }\r\n\r\n class OperationGt : Operation\r\n {\r\n public OperationGt() { }\r\n public override int StackSizeChange() { return -1; }\r\n\r\n public override void Apply(Stack stack, UInt32[] data)\r\n {\r\n UInt32 value2 = stack.Pop();\r\n UInt32 value1 = stack.Pop();\r\n UInt32 value = (UInt32)(value1 > value2 ? 1 : 0);\r\n stack.Push(value);\r\n }\r\n }\r\n\r\n class OperationLt : Operation\r\n {\r\n public OperationLt() { }\r\n public override int StackSizeChange() { return -1; }\r\n\r\n public override void Apply(Stack stack, UInt32[] data)\r\n {\r\n UInt32 value2 = stack.Pop();\r\n UInt32 value1 = stack.Pop();\r\n UInt32 value = (UInt32)(value1 < value2 ? 1 : 0);\r\n stack.Push(value);\r\n }\r\n }\r\n\r\n class OperationEq : Operation\r\n {\r\n public OperationEq() { }\r\n public override int StackSizeChange() { return -1; }\r\n\r\n public override void Apply(Stack stack, UInt32[] data)\r\n {\r\n UInt32 value2 = stack.Pop();\r\n UInt32 value1 = stack.Pop();\r\n UInt32 value = (UInt32)(value1 == value2 ? 1 : 0);\r\n stack.Push(value);\r\n }\r\n }\r\n\r\n class OperationGe : Operation\r\n {\r\n public OperationGe() { }\r\n public override int StackSizeChange() { return -1; }\r\n\r\n public override void Apply(Stack stack, UInt32[] data)\r\n {\r\n UInt32 value2 = stack.Pop();\r\n UInt32 value1 = stack.Pop();\r\n UInt32 value = (UInt32)(value1 >= value2 ? 1 : 0);\r\n stack.Push(value);\r\n }\r\n }\r\n\r\n class OperationLe : Operation\r\n {\r\n public OperationLe() { }\r\n public override int StackSizeChange() { return -1; }\r\n\r\n public override void Apply(Stack stack, UInt32[] data)\r\n {\r\n UInt32 value2 = stack.Pop();\r\n UInt32 value1 = stack.Pop();\r\n UInt32 value = (UInt32)(value1 <= value2 ? 1 : 0);\r\n stack.Push(value);\r\n }\r\n }\r\n\r\n class OperationPush : Operation\r\n {\r\n public UInt32 value;\r\n public OperationPush(UInt32 i_value) { value = i_value; }\r\n public override int StackSizeChange() { return 1; }\r\n\r\n public override void Apply(Stack stack, UInt32[] data)\r\n {\r\n stack.Push(value);\r\n }\r\n }\r\n\r\n public class MapperProgram\r\n {\r\n private Operation[] operations;\r\n\r\n public MapperProgram(UInt32[] program_encoding)\r\n {\r\n operations = new Operation[program_encoding.Length];\r\n for (int i = 0; i < program_encoding.Length; ++i)\r\n {\r\n operations[i] = Operation.ConvertWordToOperation(program_encoding[i]);\r\n }\r\n }\r\n\r\n public bool IsValid()\r\n {\r\n int stack_size = 0;\r\n foreach (Operation operation in operations)\r\n {\r\n stack_size += operation.StackSizeChange();\r\n if (stack_size < 1)\r\n {\r\n return false;\r\n }\r\n }\r\n return (stack_size == 1);\r\n }\r\n\r\n public UInt32 Run(UInt32[] data)\r\n {\r\n Stack stack = new Stack();\r\n foreach (Operation operation in operations)\r\n {\r\n operation.Apply(stack, data);\r\n }\r\n return stack.Pop();\r\n }\r\n }\r\n\r\n public class StateMachine\r\n {\r\n private RSACryptoServiceProvider key_pair;\r\n private List rows;\r\n private BigRational budget;\r\n private int rows_received;\r\n private Random rng;\r\n\r\n public StateMachine()\r\n {\r\n key_pair = new RSACryptoServiceProvider(CommonParams.serverKeyBits);\r\n rows = new List();\r\n budget = new BigRational(1);\r\n rows_received = 0;\r\n rng = new Random();\r\n }\r\n\r\n public byte[] HandleRequest(byte[] requestBytes)\r\n {\r\n object request = DiffPrivRequest.ParseRequest(requestBytes);\r\n if (request is Common.GetQuoteRequest)\r\n {\r\n GetQuoteResponse getQuoteResponse = new GetQuoteResponse(0, key_pair);\r\n return getQuoteResponse.Encode();\r\n }\r\n if (request is InitializeDBRequest)\r\n {\r\n InitializeDBRequest r = (InitializeDBRequest)request;\r\n if (rows_received != 0)\r\n {\r\n Console.Error.WriteLine(\"Received request to initialize DB after receiving rows\");\r\n return DiffPrivSrvResponse.EncodeInitializeDBResponse(18);\r\n }\r\n\r\n if (r.budget_num < r.budget_den)\r\n {\r\n Console.Error.WriteLine(\"Received request to initialize DB with budget < 1\");\r\n return DiffPrivSrvResponse.EncodeInitializeDBResponse(16);\r\n }\r\n\r\n budget = new BigRational(r.budget_num, r.budget_den);\r\n rows.Clear();\r\n return DiffPrivSrvResponse.EncodeInitializeDBResponse(0);\r\n }\r\n if (request is AddRowRequest)\r\n {\r\n byte[] ciphertext = ((AddRowRequest)request).ciphertext;\r\n byte[] plaintext;\r\n try\r\n {\r\n plaintext = key_pair.Decrypt(ciphertext, false);\r\n }\r\n catch\r\n {\r\n Console.Error.WriteLine(\"Received undecryptable add-row request\");\r\n return DiffPrivSrvResponse.EncodeAddRowResponse();\r\n }\r\n\r\n HandleAddRowRequest(plaintext);\r\n return DiffPrivSrvResponse.EncodeAddRowResponse();\r\n }\r\n if (request is QueryRequest)\r\n {\r\n QueryRequest r = (QueryRequest)request;\r\n return HandleQueryRequest(r);\r\n }\r\n return InvalidResponse.Encode();\r\n }\r\n\r\n public void HandleAddRowRequest(byte[] plaintext)\r\n {\r\n if (plaintext.Length < 16)\r\n {\r\n Console.Error.WriteLine(\"Received add-row request with < 16 bytes, with length {0}\", plaintext.Length);\r\n return;\r\n }\r\n\r\n int row_nonce_size = (int)CommonRoutines.ExtractBEWord(plaintext, 0);\r\n int row_data_size = (int)CommonRoutines.ExtractBEWord(plaintext, 4);\r\n if (plaintext.Length < 16 + row_nonce_size + row_data_size)\r\n {\r\n Console.Error.WriteLine(\"Received too-small add-row request, with length {0}\", plaintext.Length);\r\n return;\r\n }\r\n\r\n UInt32 max_budget_num = CommonRoutines.ExtractBEWord(plaintext, 8);\r\n UInt32 max_budget_den = CommonRoutines.ExtractBEWord(plaintext, 12);\r\n byte[] row_nonce = plaintext.Skip(16).Take(row_nonce_size).ToArray();\r\n byte[] row_data = plaintext.Skip(16 + row_nonce_size).Take(row_data_size).ToArray();\r\n UInt32[] row_words = CommonRoutines.BEByteSeqToWordSeq(row_data);\r\n\r\n if (max_budget_den == 0)\r\n {\r\n Console.Error.WriteLine(\"Received add-row request with 0 budget denominator\");\r\n return;\r\n }\r\n\r\n BigRational max_budget = new BigRational(max_budget_num, max_budget_den);\r\n if (budget > max_budget)\r\n {\r\n Console.Error.WriteLine(\"Received add-row request with too restrictive a budget requirement\");\r\n return;\r\n }\r\n\r\n foreach (DiffPrivRow row in rows)\r\n {\r\n if (row.nonce.SequenceEqual(row_nonce))\r\n {\r\n Console.Error.WriteLine(\"Received add-row request with duplicate nonce, so not adding it\");\r\n return;\r\n }\r\n }\r\n\r\n rows.Add(new DiffPrivRow(row_nonce, row_words));\r\n }\r\n\r\n private static bool FindHigherPowerOfTwo (BigRational r, out UInt32 x)\r\n {\r\n x = 0;\r\n BigRational two = new BigRational(2);\r\n BigRational two_to_x = new BigRational(1);\r\n while (x < 0xFFFFFFFF)\r\n {\r\n if (two_to_x >= r)\r\n {\r\n return true;\r\n }\r\n ++x;\r\n two_to_x *= two;\r\n }\r\n return two_to_x >= r;\r\n }\r\n\r\n private static UInt32 DivideRoundingUp (UInt32 a, UInt32 b)\r\n {\r\n return (a + b - 1) / b;\r\n }\r\n\r\n private static UInt32 RoundUpToMultiple (UInt32 a, UInt32 b)\r\n {\r\n UInt32 m = a % b;\r\n if (m == 0)\r\n {\r\n return a;\r\n }\r\n else\r\n {\r\n return a + (b - m);\r\n }\r\n }\r\n\r\n private static UInt32 FindHighestPowerLeThreshold (BigRational alpha, BigRational threshold, UInt32 max_power)\r\n {\r\n UInt32 e = 0;\r\n BigRational alpha_to_e = new BigRational(1);\r\n while (e < max_power)\r\n {\r\n alpha_to_e = alpha_to_e * alpha;\r\n if (alpha_to_e > threshold)\r\n {\r\n return e;\r\n }\r\n ++e;\r\n }\r\n return max_power;\r\n }\r\n\r\n private static UInt32 ClipWord32 (UInt32 x, UInt32 min_x, UInt32 max_x)\r\n {\r\n if (x <= min_x)\r\n {\r\n return min_x;\r\n }\r\n if (x >= max_x)\r\n {\r\n return max_x;\r\n }\r\n return x;\r\n }\r\n\r\n private static UInt32 SaturatingAdd (UInt32 x, UInt32 y)\r\n {\r\n if (x + y < x)\r\n {\r\n return 0xFFFFFFFF;\r\n }\r\n else\r\n {\r\n return x + y;\r\n }\r\n }\r\n\r\n private UInt32 ComputeSum (MapperProgram program, UInt32 row_min, UInt32 row_max, UInt32 answer_units,\r\n UInt32 answer_min, UInt32 answer_max)\r\n {\r\n UInt32 clipped_scaled_sum = 0;\r\n UInt32 total_remainder = 0;\r\n\r\n foreach (DiffPrivRow row in rows)\r\n {\r\n UInt32 row_value = program.Run(row.data);\r\n UInt32 clipped_value = ClipWord32(row_value, row_min, row_max);\r\n UInt32 scaled_value = clipped_value / answer_units;\r\n UInt32 scaling_remainder = clipped_value % answer_units;\r\n\r\n clipped_scaled_sum = SaturatingAdd(clipped_scaled_sum, scaled_value);\r\n total_remainder = total_remainder + scaling_remainder;\r\n if (total_remainder >= answer_units)\r\n {\r\n clipped_scaled_sum = SaturatingAdd(clipped_scaled_sum, 1);\r\n total_remainder -= answer_units;\r\n }\r\n }\r\n\r\n UInt32 extra = (UInt32)(total_remainder * 2 >= answer_units ? 1 : 0);\r\n clipped_scaled_sum = SaturatingAdd(clipped_scaled_sum, extra);\r\n return ClipWord32(clipped_scaled_sum, answer_min, answer_max);\r\n }\r\n\r\n private UInt32 AddNoise (UInt32 answer, UInt32 absolute_noise, bool negate_noise)\r\n {\r\n if (negate_noise)\r\n {\r\n if (answer < absolute_noise)\r\n {\r\n return 0;\r\n }\r\n else\r\n {\r\n return answer - absolute_noise;\r\n }\r\n }\r\n else\r\n {\r\n return SaturatingAdd(answer, absolute_noise);\r\n }\r\n }\r\n\r\n public byte[] HandleQueryRequest(QueryRequest request)\r\n {\r\n if (request.row_min > request.row_max)\r\n {\r\n Console.Error.WriteLine(\"Row value range empty\");\r\n return DiffPrivSrvResponse.EncodeQueryResponse(1, 0);\r\n }\r\n if (request.answer_min > request.answer_max)\r\n {\r\n Console.Error.WriteLine(\"Answer range empty\");\r\n return DiffPrivSrvResponse.EncodeQueryResponse(2, 0);\r\n }\r\n if (request.answer_units <= 0)\r\n {\r\n Console.Error.WriteLine(\"Answer units not positive\");\r\n return DiffPrivSrvResponse.EncodeQueryResponse(3, 0);\r\n }\r\n if (request.alpha_num <= request.alpha_den)\r\n {\r\n Console.Error.WriteLine(\"Alpha not greater than 1\");\r\n return DiffPrivSrvResponse.EncodeQueryResponse(6, 0);\r\n }\r\n if (request.beta_num <= request.beta_den)\r\n {\r\n Console.Error.WriteLine(\"Beta not greater than 1\");\r\n return DiffPrivSrvResponse.EncodeQueryResponse(13, 0);\r\n }\r\n\r\n UInt32[] program_words = CommonRoutines.BEByteSeqToWordSeq(request.program_encoding);\r\n MapperProgram program = new MapperProgram(program_words);\r\n if (!program.IsValid())\r\n {\r\n Console.Error.WriteLine(\"Invalid program provided for query\");\r\n return DiffPrivSrvResponse.EncodeQueryResponse(4, 0);\r\n }\r\n\r\n if (request.answer_units >= 0x80000000)\r\n {\r\n Console.Error.WriteLine(\"Answer granularity too high\");\r\n return DiffPrivSrvResponse.EncodeQueryResponse(17, 0);\r\n }\r\n\r\n BigRational alpha = new BigRational(request.alpha_num, request.alpha_den);\r\n BigRational beta = new BigRational(request.beta_num, request.beta_den);\r\n UInt32 delta = DivideRoundingUp(request.row_max - request.row_min, request.answer_units);\r\n UInt32 B = request.answer_max - request.answer_min;\r\n\r\n if (B <= 0)\r\n {\r\n Console.Error.WriteLine(\"Answer range empty\");\r\n return DiffPrivSrvResponse.EncodeQueryResponse(5, 0);\r\n }\r\n if (alpha <= new BigRational(1))\r\n {\r\n return DiffPrivSrvResponse.EncodeQueryResponse(6, 0);\r\n }\r\n BigRational alpha_to_delta = BigRational.Power(alpha, delta);\r\n if (beta <= alpha_to_delta)\r\n {\r\n Console.Error.WriteLine(\"Beta not greater than alpha to the power of delta\");\r\n return DiffPrivSrvResponse.EncodeQueryResponse(7, 0);\r\n }\r\n\r\n if (beta > budget)\r\n {\r\n Console.Error.WriteLine(\"Not enough budget for request\");\r\n return DiffPrivSrvResponse.EncodeQueryResponse(11, 0);\r\n }\r\n\r\n BigRational one = new BigRational(1);\r\n BigRational two = new BigRational(2);\r\n BigRational min_alpha_minus_1_and_2 = alpha - one;\r\n if (min_alpha_minus_1_and_2 > two)\r\n {\r\n min_alpha_minus_1_and_2 = two;\r\n }\r\n BigRational noiseEntropyPart1 = (alpha + one) * (beta + one) / ((beta - alpha_to_delta) * min_alpha_minus_1_and_2);\r\n\r\n UInt32 r1;\r\n if (!FindHigherPowerOfTwo(noiseEntropyPart1, out r1) || r1 >= 0xFFFFFFE0)\r\n {\r\n Console.Error.WriteLine(\"Requires too many bits of randomness due to noise entropy part 1\");\r\n return DiffPrivSrvResponse.EncodeQueryResponse(8, 0);\r\n }\r\n\r\n UInt32 log_alpha;\r\n if (!FindHigherPowerOfTwo(alpha, out log_alpha) || log_alpha > 0xFFFFFFFFUL / B)\r\n {\r\n Console.Error.WriteLine(\"Requires too many bits of randomness due to alpha\");\r\n return DiffPrivSrvResponse.EncodeQueryResponse(8, 0);\r\n }\r\n\r\n UInt32 r2 = log_alpha * (B-1);\r\n if (r2 >= 0xFFFFFFC8 - r1)\r\n {\r\n Console.Error.WriteLine(\"Requires too many bits of randomness due to r2\");\r\n return DiffPrivSrvResponse.EncodeQueryResponse(8, 0);\r\n }\r\n\r\n UInt32 r = RoundUpToMultiple(r1 + r2 + 7, 8);\r\n UInt32 num_randoms_needed = RoundUpToMultiple(r / 8, 4) + 1;\r\n\r\n bool negate_noise = (rng.Next() % 2 == 0);\r\n byte[] randoms = new byte[num_randoms_needed];\r\n rng.NextBytes(randoms);\r\n randoms[num_randoms_needed - 1] = 0;\r\n BigInteger U = new BigInteger(randoms);\r\n\r\n BigRational one_half = new BigRational(1, 2);\r\n BigRational numerator = new BigRational(U) + one_half;\r\n BigRational denominator = BigRational.Power(two, (num_randoms_needed - 1) * 8);\r\n BigRational u = numerator / denominator;\r\n\r\n BigRational threshold = (two * alpha) / (u * (alpha + one));\r\n UInt32 absolute_noise = FindHighestPowerLeThreshold(alpha, threshold, B);\r\n\r\n UInt32 answer = ComputeSum(program, request.row_min, request.row_max, request.answer_units, request.answer_min, request.answer_max);\r\n UInt32 noised_answer = AddNoise(answer, absolute_noise, negate_noise);\r\n UInt32 response = ClipWord32(noised_answer, request.answer_min, request.answer_max);\r\n\r\n budget = budget / beta;\r\n return DiffPrivSrvResponse.EncodeQueryResponse(0, response);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/DotNetSHABench/App.config", "content": "\r\n\r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/DotNetSHABench/DotNetSHABench.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {4494E273-A2EF-4799-8D7E-C893C31D1362}\r\n Exe\r\n Properties\r\n DotNetSHABench\r\n DotNetSHABench\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {5e394d90-c3d6-41a1-a6b4-715e43e54d7c}\r\n Common\r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/DotNetSHABench/Parameters.cs", "content": "using System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace DotNetSHABench\r\n{\r\n class InvalidParameterException : Exception\r\n {\r\n public string contents;\r\n public InvalidParameterException(string i_contents) { contents = i_contents; }\r\n }\r\n\r\n public class Parameters\r\n {\r\n public static int messageSize = 2048;\r\n public static int numberOfRuns = 100;\r\n\r\n public static void Print()\r\n {\r\n Console.Error.WriteLine(\"messageSize\\t{0}\", messageSize);\r\n Console.Error.WriteLine(\"numberOfRuns\\t{0}\", numberOfRuns);\r\n }\r\n\r\n public static void PrintUsage()\r\n {\r\n Console.Out.WriteLine(\"Usage: DotNetSHABench.exe [filename or param=value]... where filename contains\");\r\n Console.Out.WriteLine(\" lines of the form param=value and param must be one of the following.\");\r\n Console.Out.WriteLine();\r\n Console.Out.WriteLine(\" messageSize = message size, in bytes\");\r\n Console.Out.WriteLine(\" numberOfRuns = number of times to advance counter\");\r\n }\r\n\r\n public static void ApplyArguments (string[] args)\r\n {\r\n try\r\n {\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n catch (InvalidParameterException e)\r\n {\r\n Console.Out.WriteLine(e.contents);\r\n Parameters.PrintUsage();\r\n Environment.Exit(-1);\r\n }\r\n }\r\n\r\n public static void ApplyArgument (string arg)\r\n {\r\n char[] splitter = {'='};\r\n string[] sp = arg.ToLower().Split(splitter);\r\n\r\n if (sp.Length == 1)\r\n {\r\n ApplyArgumentsInFile(arg);\r\n return;\r\n }\r\n else if (sp.Length != 2)\r\n {\r\n throw new InvalidParameterException(\"Invalid command-line argument \" + arg);\r\n }\r\n\r\n string parameter = sp[0];\r\n string value = sp[1];\r\n\r\n if (String.Compare(parameter, \"messageSize\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n Parameters.messageSize = Convert.ToInt32(value);\r\n }\r\n else if (String.Compare(parameter, \"numberOfRuns\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n Parameters.numberOfRuns = Convert.ToInt32(value);\r\n }\r\n else\r\n {\r\n throw new InvalidParameterException(\"Invalid command-line parameter \" + parameter);\r\n }\r\n }\r\n\r\n public static void ApplyArgumentsInFile(string filename)\r\n {\r\n string[] args = File.ReadAllLines(filename);\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/DotNetSHABench/Program.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\nusing System.Linq;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace DotNetSHABench\r\n{\r\n class Program\r\n {\r\n static void TestSHA (int message_size, int num_runs)\r\n {\r\n string profileID = string.Format(\"SHA256-{0}Bytes\", message_size);\r\n SHA256Managed hasher = new SHA256Managed();\r\n byte[] message = new byte[message_size];\r\n Random rng = new Random();\r\n Stopwatch stopwatch = new Stopwatch();\r\n for (int run_number = 0; run_number < Parameters.numberOfRuns; ++run_number)\r\n {\r\n rng.NextBytes(message);\r\n stopwatch.Restart();\r\n byte[] hash = hasher.ComputeHash(message);\r\n stopwatch.Stop();\r\n Profiler.Record(profileID, stopwatch);\r\n }\r\n }\r\n\r\n static void DoAllTests()\r\n {\r\n Stopwatch stopwatch = new Stopwatch();\r\n int run_number = 0;\r\n SHA1Managed sha1_hasher = new SHA1Managed();\r\n SHA256Managed sha256_hasher = new SHA256Managed();\r\n byte[] msg32 = new byte[32];\r\n byte[] msg256 = new byte[256];\r\n byte[] msg8192 = new byte[8192];\r\n Random rng = new Random();\r\n rng.NextBytes(msg32);\r\n rng.NextBytes(msg256);\r\n rng.NextBytes(msg8192);\r\n double usec_per_op;\r\n double msec_per_op;\r\n double nsec_per_byte;\r\n byte[] hash;\r\n byte[] encrypted = null;\r\n byte[] decrypted;\r\n RSACryptoServiceProvider key_pair = null;\r\n RSAParameters p;\r\n\r\n stopwatch.Restart();\r\n for (run_number = 0; run_number < Parameters.numberOfRuns; ++run_number)\r\n {\r\n key_pair = new RSACryptoServiceProvider(1024);\r\n p = key_pair.ExportParameters(true);\r\n }\r\n stopwatch.Stop();\r\n msec_per_op = stopwatch.ElapsedTicks * 1000.0 / Stopwatch.Frequency / Parameters.numberOfRuns;\r\n Console.WriteLine(\"RSA KeyGen\\t1024b\\t{0} ms/op\", msec_per_op);\r\n\r\n stopwatch.Restart();\r\n for (run_number = 0; run_number < Parameters.numberOfRuns; ++run_number)\r\n {\r\n encrypted = key_pair.Encrypt(msg32, false);\r\n }\r\n stopwatch.Stop();\r\n usec_per_op = stopwatch.ElapsedTicks * 1000000.0 / Stopwatch.Frequency / Parameters.numberOfRuns;\r\n Console.WriteLine(\"RSA Public\\t1024b\\t{0} us/op\", usec_per_op);\r\n\r\n stopwatch.Restart();\r\n for (run_number = 0; run_number < Parameters.numberOfRuns; ++run_number)\r\n {\r\n decrypted = key_pair.Decrypt(encrypted, false);\r\n }\r\n stopwatch.Stop();\r\n usec_per_op = stopwatch.ElapsedTicks * 1000000.0 / Stopwatch.Frequency / Parameters.numberOfRuns;\r\n Console.WriteLine(\"RSA Private\\t1024b\\t{0} us/op\", usec_per_op);\r\n\r\n/*\r\n stopwatch.Restart();\r\n for (run_number = 0; run_number < Parameters.numberOfRuns; ++run_number)\r\n {\r\n hash = sha1_hasher.ComputeHash(msg256);\r\n }\r\n stopwatch.Stop();\r\n usec_per_op = stopwatch.ElapsedTicks * 1000000.0 / Stopwatch.Frequency / Parameters.numberOfRuns;\r\n nsec_per_byte = usec_per_op * 1000.0 / 256;\r\n Console.WriteLine(\"SHA-1\\t256B\\t{0} us/op\\t{1} ns/B\", usec_per_op, nsec_per_byte);\r\n\r\n stopwatch.Restart();\r\n for (run_number = 0; run_number < Parameters.numberOfRuns; ++run_number)\r\n {\r\n hash = sha1_hasher.ComputeHash(msg8192);\r\n }\r\n stopwatch.Stop();\r\n usec_per_op = stopwatch.ElapsedTicks * 1000000.0 / Stopwatch.Frequency / Parameters.numberOfRuns;\r\n nsec_per_byte = usec_per_op * 1000.0 / 8192;\r\n Console.WriteLine(\"SHA-1\\t8192B\\t{0} us/op\\t{1} ns/B\", usec_per_op, nsec_per_byte);\r\n*/\r\n\r\n stopwatch.Restart();\r\n for (run_number = 0; run_number < Parameters.numberOfRuns; ++run_number)\r\n {\r\n hash = sha256_hasher.ComputeHash(msg256);\r\n }\r\n stopwatch.Stop();\r\n usec_per_op = stopwatch.ElapsedTicks * 1000000.0 / Stopwatch.Frequency / Parameters.numberOfRuns;\r\n nsec_per_byte = usec_per_op * 1000.0 / 256;\r\n Console.WriteLine(\"SHA-256\\t256B\\t{0} us/op\\t{1} ns/B\", usec_per_op, nsec_per_byte);\r\n\r\n stopwatch.Restart();\r\n for (run_number = 0; run_number < Parameters.numberOfRuns; ++run_number)\r\n {\r\n hash = sha1_hasher.ComputeHash(msg8192);\r\n }\r\n stopwatch.Stop();\r\n usec_per_op = stopwatch.ElapsedTicks * 1000000.0 / Stopwatch.Frequency / Parameters.numberOfRuns;\r\n nsec_per_byte = usec_per_op * 1000.0 / 8192;\r\n Console.WriteLine(\"SHA-256\\t8192B\\t{0} us/op\\t{1} ns/B\", usec_per_op, nsec_per_byte);\r\n }\r\n\r\n static void Main(string[] args)\r\n {\r\n Parameters.ApplyArguments(args);\r\n DoAllTests();\r\n/*\r\n Profiler.Initialize();\r\n TestSHA(Parameters.messageSize, Parameters.numberOfRuns);\r\n Profiler.Print();\r\n*/ \r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/DotNetSHABench/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"DotNetSHABench\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"DotNetSHABench\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n\r\n[assembly: Guid(\"5642cbcd-359b-42a5-9469-0af61eca1e2d\")]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/Clients/Notary/App.config", "content": "\r\n\r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/Notary/Notary.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {482B3A42-D9E8-4D48-9E44-27392205EDB0}\r\n Exe\r\n Properties\r\n Notary\r\n Notary\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {5e394d90-c3d6-41a1-a6b4-715e43e54d7c}\r\n Common\r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/Notary/NotaryRequests.cs", "content": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\nusing System.Linq;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace Notary\r\n{\r\n public class AdvanceCounterRequest\r\n {\r\n private byte[] message;\r\n\r\n public AdvanceCounterRequest(byte[] i_message)\r\n {\r\n message = i_message;\r\n }\r\n\r\n public byte[] GetPacket()\r\n {\r\n Debug.Assert(message.Length < 256);\r\n byte[] packet = new byte[2 + message.Length];\r\n packet[0] = 2;\r\n packet[1] = (byte)message.Length;\r\n message.CopyTo(packet, 2);\r\n return packet;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Notary/NotaryResponses.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\nusing System.Linq;\r\nusing System.Net.Sockets;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace Notary\r\n{\r\n class AdvanceCounterResponse\r\n {\r\n private UInt32 error_code;\r\n private UInt32 new_counter_value;\r\n private byte[] message;\r\n\r\n public UInt32 ErrorCode { get { return error_code; } }\r\n public UInt32 NewCounterValue { get { return new_counter_value; } }\r\n public byte[] Message { get { return message; } }\r\n\r\n public AdvanceCounterResponse(byte[] packet, RSACryptoServiceProvider ironclad_public_key)\r\n {\r\n if (packet.Length < 13)\r\n {\r\n throw new Exception(\"Invalid AdvanceCounterResponsePacket -- length < 13\");\r\n }\r\n if (packet[0] != 2)\r\n {\r\n throw new Exception(\"First byte of AdvanceCounterResponse is not 2\");\r\n }\r\n error_code = CommonRoutines.ExtractBEWord(packet, 1);\r\n if (error_code != 0)\r\n {\r\n throw new ErrorCodeException(error_code);\r\n }\r\n int notary_statement_length = (int)CommonRoutines.ExtractBEWord(packet, 5);\r\n int notary_attestation_length = (int)CommonRoutines.ExtractBEWord(packet, 9);\r\n byte[] notary_statement = packet.Skip(13).Take(notary_statement_length).ToArray();\r\n byte[] notary_attestation = packet.Skip(13 + notary_statement_length).Take(notary_attestation_length).ToArray();\r\n\r\n if (notary_statement.Length < 1)\r\n {\r\n throw new Exception(\"Notary statement too short\");\r\n }\r\n if (notary_statement[0] != 34)\r\n {\r\n throw new Exception(\"Notary statement does not start with magic byte 34\");\r\n }\r\n\r\n int offset = 1;\r\n new_counter_value = CommonRoutines.DecodeShortMPInt(notary_statement, ref offset);\r\n message = notary_statement.Skip(offset).ToArray();\r\n\r\n if (!CommonParams.ignoreKey &&\r\n !ironclad_public_key.VerifyData(notary_statement, CryptoConfig.MapNameToOID(\"SHA256\"), notary_attestation))\r\n {\r\n throw new Exception(\"Could not verify signature of notary statement\");\r\n }\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return string.Format(\"AdvanceCounterResponse(error_code={0}\", error_code);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Notary/Parameters.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Text;\r\n\r\nnamespace Notary\r\n{\r\n class InvalidParameterException : Exception\r\n {\r\n public string contents;\r\n public InvalidParameterException(string i_contents) { contents = i_contents; }\r\n }\r\n\r\n public class Parameters\r\n {\r\n public static int messageLength = 32;\r\n\r\n public static void Print()\r\n {\r\n CommonParams.Print();\r\n Console.Error.WriteLine(\"messageLength\\t{0}\", messageLength);\r\n }\r\n\r\n public static void PrintUsage()\r\n {\r\n Console.Out.WriteLine(\"Usage: Notary.exe [filename or param=value]... where filename contains\");\r\n Console.Out.WriteLine(\" lines of the form param=value and param must be one of the following.\");\r\n Console.Out.WriteLine();\r\n CommonParams.PrintUsage();\r\n Console.Out.WriteLine(\" messageLength = length of message to notarize\");\r\n }\r\n\r\n public static void ApplyArguments (string[] args)\r\n {\r\n try\r\n {\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n catch (InvalidParameterException e)\r\n {\r\n Console.Out.WriteLine(e.contents);\r\n Parameters.PrintUsage();\r\n Environment.Exit(-1);\r\n }\r\n }\r\n\r\n public static void ApplyArgument (string arg)\r\n {\r\n char[] splitter = {'='};\r\n string[] sp = arg.ToLower().Split(splitter);\r\n\r\n if (sp.Length == 1)\r\n {\r\n ApplyArgumentsInFile(arg);\r\n return;\r\n }\r\n else if (sp.Length != 2)\r\n {\r\n throw new InvalidParameterException(\"Invalid command-line argument \" + arg);\r\n }\r\n\r\n string parameter = sp[0];\r\n string value = sp[1];\r\n\r\n if (CommonParams.ApplyArgument(parameter, value))\r\n {\r\n return;\r\n }\r\n if (String.Compare(parameter, \"messageLength\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n Parameters.messageLength = Convert.ToInt32(value);\r\n return;\r\n }\r\n\r\n throw new InvalidParameterException(\"Invalid command-line parameter \" + parameter);\r\n }\r\n\r\n public static void ApplyArgumentsInFile(string filename)\r\n {\r\n string[] args = File.ReadAllLines(filename);\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Notary/Program.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\nusing System.Linq;\r\nusing System.Net;\r\nusing System.Net.Sockets;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\nusing System.IO;\r\n\r\nnamespace Notary\r\n{\r\n class Program\r\n {\r\n static void AdvanceCounter(UdpClient client, RSACryptoServiceProvider ironclad_public_key, byte[] message,\r\n bool new_counter_value_known, ref UInt32 new_counter_value)\r\n {\r\n AdvanceCounterRequest advanceCounterRequest = new AdvanceCounterRequest(message);\r\n byte[] request = advanceCounterRequest.GetPacket();\r\n byte[] response = CommonRoutines.SendRequest(client, request, \"AdvanceCounter\");\r\n AdvanceCounterResponse advanceCounterResponse = new AdvanceCounterResponse(response, ironclad_public_key);\r\n\r\n if (new_counter_value_known && advanceCounterResponse.NewCounterValue != new_counter_value)\r\n {\r\n throw new Exception(\"New counter value in AdvanceCounterResponse did not match expected counter value\");\r\n }\r\n new_counter_value = advanceCounterResponse.NewCounterValue;\r\n\r\n if (!advanceCounterResponse.Message.SequenceEqual(message))\r\n {\r\n throw new Exception(\"Message in AdvanceCounterResponse did not match expected message\");\r\n }\r\n }\r\n\r\n static void TestStuff()\r\n {\r\n CommonRoutines.SquirtBakedKey();\r\n byte[] getQuoteResponseBytes = CommonRoutines.ParseFakeReply(\"68 05 CA 1A 1D 69 00 1B 21 31 8E D9 08 00 45 00 01 80 00 00 00 00 80 11 11 3C 0A 0A 0A 14 0A 0A 0A 0A 07 BF F4 96 01 6C 3F C7 01 00 00 00 00 00 00 00 57 00 00 01 00 00 00 00 07 73 73 68 2D 72 73 61 00 00 00 03 01 00 01 00 00 00 41 00 A9 52 43 21 04 37 54 10 11 92 9F 70 A8 D3 3B 4A 44 F3 62 C3 47 89 78 93 3E 38 D8 B8 FF 33 32 3F F8 8D 03 3B B0 D7 81 47 1A 79 75 A6 6F 38 57 D9 E7 82 9D 8D 51 7F 40 BA 50 4E 22 B5 95 95 13 B5 2A 5F C5 F6 6C F3 73 85 94 D2 72 4F A3 D9 C1 8E A9 09 7B 32 2F 38 14 FD 50 22 D1 FE B1 0B 16 CD 0B 5E D7 1B 5A CF 34 14 04 4D 49 91 25 44 A3 4C 4B 3E 01 B4 14 4F 33 FA D3 9B 84 A4 4A 23 7F 13 10 0E D4 FB EC 74 53 FD 52 62 95 8A AF D6 FC B6 DB 5B 07 43 3E 70 12 5E 71 9B 15 EB 82 81 60 01 0E A2 87 A0 86 12 E0 71 17 4E 2C 4F 4C 0E 29 57 D5 F2 73 8E 52 72 14 96 CD 19 17 60 AC D2 4C 02 5D EE D5 A7 D0 D4 14 F4 FE B0 71 8A 08 C7 86 94 0E B9 7F E9 ED E2 5C 97 30 C2 6C E0 72 2A CF EE BE 52 D1 32 48 75 00 0D 3C DA ED AA 5D 35 DC 0B B4 40 8D DB 65 F7 C1 56 54 D9 44 85 D1 1E 34 D1 17 A5 A9 41 9E 68 CD 0E 4C E1 BF 30 65 E3 0E 95 A2 46 EF A5 23 B5 5E 68 EA 1D 08 8A 12 19 57 05 34 B8 2E 71 DA 67 84 55 BB 74 92 D4 F3 B9 61 BE 56 8E D8 65 33 82 3E 7E 69 AF F1 92 59 CD 47 3F\");\r\n GetQuoteResponse gr = new GetQuoteResponse(getQuoteResponseBytes);\r\n byte[] advanceCounterResponseBytes = CommonRoutines.ParseFakeReply(\"68 05 CA 1A 1D 69 00 1B 21 31 8E D9 08 00 45 00 00 70 00 00 00 00 80 11 12 4C 0A 0A 0A 14 0A 0A 0A 0A 07 BF F4 96 00 5C B6 A7 02 00 00 00 00 00 00 00 07 00 00 00 40 22 00 00 00 01 01 64 03 FC D3 33 B6 D2 25 38 08 7E FD 31 E6 64 D5 A9 C0 5D 26 E1 2E 4C 97 8D AC D5 EA 6D 50 5A C6 EF 98 62 DC 4B 54 AF 32 96 E3 5D EF 96 D3 B6 83 D3 80 8F 68 EE 8F 3E 9F 7C 9C B2 EB 50 EF F4 52 3B\");\r\n AdvanceCounterResponse a = new AdvanceCounterResponse(advanceCounterResponseBytes, gr.PublicKey);\r\n while (true) { }\r\n }\r\n\r\n static void Main(string[] args)\r\n {\r\n Parameters.ApplyArguments(args);\r\n Profiler.Initialize();\r\n UdpClient client = CommonRoutines.StartClient();\r\n\r\n Console.Error.WriteLine(\"Getting Ironclad public key\");\r\n RSACryptoServiceProvider ironclad_public_key = CommonRoutines.GetIroncladPublicKey(client);\r\n\r\n/*\r\n for (UInt32 run_number = 1; run_number < CommonParams.numberOfRuns; ++run_number)\r\n {\r\n GetQuoteRequest getQuoteRequest = new GetQuoteRequest();\r\n byte[] request = getQuoteRequest.GetPacket();\r\n byte[] response = CommonRoutines.SendRequest(client, request, \"GetIroncladPublicKey\");\r\n }\r\n*/ \r\n\r\n byte[] message = new byte[Parameters.messageLength];\r\n Random rng = new Random();\r\n UInt32 last_counter_value = 0;\r\n\r\n for (UInt32 run_number = 0; run_number < CommonParams.numberOfRuns; ++run_number)\r\n {\r\n Console.Error.WriteLine(\"Performing run {0}\", run_number + 1);\r\n rng.NextBytes(message);\r\n if (run_number == 0)\r\n {\r\n AdvanceCounter(client, ironclad_public_key, message, false, ref last_counter_value);\r\n }\r\n else\r\n {\r\n last_counter_value++;\r\n AdvanceCounter(client, ironclad_public_key, message, true, ref last_counter_value);\r\n }\r\n }\r\n\r\n Profiler.Print();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/Notary/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"Notary\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"Notary\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n\r\n[assembly: Guid(\"afd3163e-a9ef-44a6-8dd6-70ecea95636c\")]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/Clients/NotarySrv/App.config", "content": "\r\n\r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/NotarySrv/NotaryRequest.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\nusing System.Linq;\r\nusing System.Text;\r\n\r\nnamespace NotarySrv\r\n{\r\n public class NotaryRequest\r\n {\r\n public NotaryRequest() { }\r\n\r\n public static object ParseRequest (byte[] request)\r\n {\r\n if (request.Length < 1)\r\n {\r\n Console.Error.WriteLine(\"Received request with no bytes\");\r\n return new Common.InvalidRequest();\r\n }\r\n if (request[0] == 1)\r\n {\r\n return Common.GetQuoteRequest.ParseRequest(request);\r\n }\r\n if (request[0] == 2)\r\n {\r\n return AdvanceCounterRequest.ParseRequest(request);\r\n }\r\n Console.Error.WriteLine(\"Received request with invalid type\");\r\n return new Common.InvalidRequest();\r\n }\r\n }\r\n\r\n public class AdvanceCounterRequest\r\n {\r\n public byte[] message;\r\n\r\n public AdvanceCounterRequest(byte[] i_message)\r\n {\r\n message = i_message;\r\n }\r\n\r\n public static object ParseRequest (byte[] request)\r\n {\r\n if (request.Length < 2)\r\n {\r\n Console.Error.WriteLine(\"Received advance-counter request with fewer than 2 bytes\");\r\n return new Common.InvalidRequest();\r\n }\r\n int messageLength = (int)request[1];\r\n if (request.Length < 2 + messageLength)\r\n {\r\n Console.Error.WriteLine(\"Received advance-counter request without enough bytes to encode message\");\r\n return new Common.InvalidRequest();\r\n }\r\n byte[] message = request.Skip(2).Take(messageLength).ToArray();\r\n return new AdvanceCounterRequest(message);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/NotarySrv/NotaryResponse.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace NotarySrv\r\n{\r\n class NotarySrvResponse\r\n {\r\n public static byte[] EncodeAdvanceCounterResponse (UInt32 error_code, byte[] notary_statement, byte[] notary_attestation)\r\n {\r\n byte[] header = new byte[1];\r\n header[0] = 2;\r\n\r\n byte[] error_code_encoded = CommonRoutines.EncodeBEWord(error_code);\r\n byte[] notary_statement_length = CommonRoutines.EncodeBEWord((uint)notary_statement.Length);\r\n byte[] notary_attestation_length = CommonRoutines.EncodeBEWord((uint)notary_attestation.Length);\r\n\r\n return CommonRoutines.CombineByteArrays(header, error_code_encoded, notary_statement_length, notary_attestation_length, notary_statement, notary_attestation);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/NotarySrv/NotarySrv.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {9D47885D-EC02-4454-8D4C-B6BA048F7AF5}\r\n Exe\r\n Properties\r\n NotarySrv\r\n NotarySrv\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {5e394d90-c3d6-41a1-a6b4-715e43e54d7c}\r\n Common\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/NotarySrv/Parameters.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Text;\r\n\r\nnamespace NotarySrv\r\n{\r\n class InvalidParameterException : Exception\r\n {\r\n public string contents;\r\n public InvalidParameterException(string i_contents) { contents = i_contents; }\r\n }\r\n\r\n public class Parameters\r\n {\r\n public static void Print()\r\n {\r\n CommonParams.Print();\r\n }\r\n\r\n public static void PrintUsage()\r\n {\r\n Console.Out.WriteLine(\"Usage: NotarySrv.exe [filename or param=value]... where filename contains\");\r\n Console.Out.WriteLine(\" lines of the form param=value and param must be one of the following.\");\r\n Console.Out.WriteLine();\r\n CommonParams.PrintUsage();\r\n }\r\n\r\n public static void ApplyArguments (string[] args)\r\n {\r\n try\r\n {\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n catch (InvalidParameterException e)\r\n {\r\n Console.Out.WriteLine(e.contents);\r\n Parameters.PrintUsage();\r\n Environment.Exit(-1);\r\n }\r\n }\r\n\r\n public static void ApplyArgument (string arg)\r\n {\r\n char[] splitter = {'='};\r\n string[] sp = arg.ToLower().Split(splitter);\r\n\r\n if (sp.Length == 1)\r\n {\r\n ApplyArgumentsInFile(arg);\r\n return;\r\n }\r\n else if (sp.Length != 2)\r\n {\r\n throw new InvalidParameterException(\"Invalid command-line argument \" + arg);\r\n }\r\n\r\n string parameter = sp[0];\r\n string value = sp[1];\r\n\r\n if (CommonParams.ApplyArgument(parameter, value))\r\n {\r\n return;\r\n }\r\n\r\n throw new InvalidParameterException(\"Invalid command-line parameter \" + parameter);\r\n }\r\n\r\n public static void ApplyArgumentsInFile(string filename)\r\n {\r\n string[] args = File.ReadAllLines(filename);\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/NotarySrv/Program.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Net;\r\nusing System.Net.Sockets;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace NotarySrv\r\n{\r\n class Program\r\n {\r\n static byte[] HandleRequest(byte[] request)\r\n {\r\n return new byte[0];\r\n }\r\n\r\n static void Main(string[] args)\r\n {\r\n Parameters.ApplyArguments(args);\r\n UdpClient server = CommonRoutines.StartServer();\r\n StateMachine stateMachine = new StateMachine();\r\n IPEndPoint client = new IPEndPoint(IPAddress.Any, 0);\r\n while (true)\r\n {\r\n byte[] request = server.Receive(ref client);\r\n byte[] response = stateMachine.HandleRequest(request);\r\n server.Send(response, response.Length, client);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/NotarySrv/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"NotarySrv\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"NotarySrv\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n\r\n[assembly: Guid(\"5491bcbe-7d26-4b1b-a159-57de21b02c0f\")]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/Clients/NotarySrv/StateMachine.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Numerics;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\n\r\nnamespace NotarySrv\r\n{\r\n class StateMachine\r\n {\r\n private RSACryptoServiceProvider key_pair;\r\n private BigInteger counter;\r\n\r\n public StateMachine()\r\n {\r\n key_pair = new RSACryptoServiceProvider(CommonParams.serverKeyBits);\r\n counter = new BigInteger(0);\r\n }\r\n\r\n public byte[] HandleRequest(byte[] requestBytes)\r\n {\r\n object request = NotaryRequest.ParseRequest(requestBytes);\r\n if (request is Common.GetQuoteRequest)\r\n {\r\n GetQuoteResponse getQuoteResponse = new GetQuoteResponse(0, key_pair);\r\n return getQuoteResponse.Encode();\r\n }\r\n if (request is AdvanceCounterRequest)\r\n {\r\n AdvanceCounterRequest r = (AdvanceCounterRequest)request;\r\n counter = counter + 1;\r\n byte[] header = new byte[1];\r\n header[0] = 34;\r\n byte[] new_counter_value_encoding = CommonRoutines.EncodeMPBigInteger(counter);\r\n byte[] notary_statement = CommonRoutines.CombineByteArrays(header, new_counter_value_encoding, r.message);\r\n byte[] notary_attestation = key_pair.SignData(notary_statement, CryptoConfig.MapNameToOID(\"SHA256\"));\r\n return NotarySrvResponse.EncodeAdvanceCounterResponse(0, notary_statement, notary_attestation);\r\n }\r\n return InvalidResponse.Encode();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/PassHash/App.config", "content": "\r\n\r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/PassHash/Parameters.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace PassHash\r\n{\r\n class InvalidParameterException : Exception\r\n {\r\n public string contents;\r\n public InvalidParameterException(string i_contents) { contents = i_contents; }\r\n }\r\n\r\n public class Parameters\r\n {\r\n public static int passwordLength = 12;\r\n public static int saltLength = 16;\r\n\r\n public static void Print()\r\n {\r\n CommonParams.Print();\r\n Console.Error.WriteLine(\"passwordLength\\t{0}\", passwordLength);\r\n Console.Error.WriteLine(\"saltLength\\t{0}\", saltLength);\r\n }\r\n\r\n public static void PrintUsage()\r\n {\r\n Console.Out.WriteLine(\"Usage: PassHash.exe [filename or param=value]... where filename contains\");\r\n Console.Out.WriteLine(\" lines of the form param=value and param must be one of the following.\");\r\n Console.Out.WriteLine();\r\n CommonParams.PrintUsage();\r\n Console.Out.WriteLine(\" passwordLength = length of password to use\");\r\n Console.Out.WriteLine(\" saltLength = length of salt to use\");\r\n }\r\n\r\n public static void ApplyArguments (string[] args)\r\n {\r\n try\r\n {\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n catch (InvalidParameterException e)\r\n {\r\n Console.Out.WriteLine(e.contents);\r\n Parameters.PrintUsage();\r\n Environment.Exit(-1);\r\n }\r\n }\r\n\r\n public static void ApplyArgument (string arg)\r\n {\r\n char[] splitter = {'='};\r\n string[] sp = arg.ToLower().Split(splitter);\r\n\r\n if (sp.Length == 1)\r\n {\r\n ApplyArgumentsInFile(arg);\r\n return;\r\n }\r\n else if (sp.Length != 2)\r\n {\r\n throw new InvalidParameterException(\"Invalid command-line argument \" + arg);\r\n }\r\n\r\n string parameter = sp[0];\r\n string value = sp[1];\r\n\r\n if (CommonParams.ApplyArgument(parameter, value))\r\n {\r\n return;\r\n }\r\n if (String.Compare(parameter, \"passwordLength\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n Parameters.passwordLength = Convert.ToInt32(value);\r\n return;\r\n }\r\n if (String.Compare(parameter, \"saltLength\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n Parameters.saltLength = Convert.ToInt32(value);\r\n return;\r\n }\r\n\r\n throw new InvalidParameterException(\"Invalid command-line parameter \" + parameter);\r\n }\r\n\r\n public static void ApplyArgumentsInFile(string filename)\r\n {\r\n string[] args = File.ReadAllLines(filename);\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/PassHash/PassHash.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {92AFE843-D88C-4A62-8159-B8C5EEDB5171}\r\n Exe\r\n Properties\r\n PassHash\r\n PassHash\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {5e394d90-c3d6-41a1-a6b4-715e43e54d7c}\r\n Common\r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/PassHash/PassHashRequests.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace PassHash\r\n{\r\n public class PerformHashRequest\r\n {\r\n private byte[] message;\r\n private byte[] salt;\r\n\r\n public PerformHashRequest(byte[] i_message, byte[] i_salt)\r\n {\r\n message = i_message;\r\n salt = i_salt;\r\n }\r\n\r\n public byte[] GetPacket()\r\n {\r\n byte[] header = new byte[1]; header[0] = 1;\r\n byte[] message_length_encoded = CommonRoutines.EncodeBEWord((UInt32)message.Length);\r\n byte[] salt_length_encoded = CommonRoutines.EncodeBEWord((UInt32)salt.Length);\r\n return CommonRoutines.CombineByteArrays(header, message_length_encoded, salt_length_encoded, message, salt);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/PassHash/PassHashResponses.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace PassHash\r\n{\r\n class PerformHashResponse\r\n {\r\n private UInt32 error_code;\r\n private byte[] hash;\r\n\r\n public UInt32 ErrorCode { get { return error_code; } }\r\n\r\n public PerformHashResponse(byte[] packet)\r\n {\r\n if (packet.Length < 37)\r\n {\r\n throw new Exception(\"Invalid PerformHashResponsePacket -- length < 37\");\r\n }\r\n if (packet[0] != 1)\r\n {\r\n throw new Exception(\"First byte of PerformHashResponse is not 1\");\r\n }\r\n error_code = CommonRoutines.ExtractBEWord(packet, 1);\r\n if (error_code != 0)\r\n {\r\n throw new ErrorCodeException(error_code);\r\n }\r\n hash = packet.Skip(5).Take(32).ToArray();\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return string.Format(\"PerformHashResponse(error_code={0}\", error_code);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/PassHash/Program.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Net;\r\nusing System.Net.Sockets;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace PassHash\r\n{\r\n class Program\r\n {\r\n static void PerformHash(UdpClient client, byte[] password, byte[] salt)\r\n {\r\n PerformHashRequest performHashRequest = new PerformHashRequest(password, salt);\r\n byte[] request = performHashRequest.GetPacket();\r\n byte[] response = CommonRoutines.SendRequest(client, request, \"PerformHash\");\r\n PerformHashResponse performHashResponse = new PerformHashResponse(response);\r\n }\r\n\r\n static void Main(string[] args)\r\n {\r\n Parameters.ApplyArguments(args);\r\n Profiler.Initialize();\r\n UdpClient client = CommonRoutines.StartClient();\r\n\r\n byte[] password = new byte[Parameters.passwordLength];\r\n byte[] salt = new byte[Parameters.saltLength];\r\n Random rng = new Random();\r\n for (UInt32 run_number = 0; run_number < CommonParams.numberOfRuns; ++run_number)\r\n {\r\n Console.Error.WriteLine(\"Performing run {0}\", run_number + 1);\r\n rng.NextBytes(password);\r\n rng.NextBytes(salt);\r\n PerformHash(client, password, salt);\r\n }\r\n\r\n Profiler.Print();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/PassHash/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"PassHash\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"PassHash\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n\r\n[assembly: Guid(\"2e4bc7a9-7cd9-4eb1-bfb4-2be444a47b3c\")]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/Clients/PassHashSrv/App.config", "content": "\r\n\r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/PassHashSrv/Parameters.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Text;\r\n\r\nnamespace PassHashSrv\r\n{\r\n class InvalidParameterException : Exception\r\n {\r\n public string contents;\r\n public InvalidParameterException(string i_contents) { contents = i_contents; }\r\n }\r\n\r\n public class Parameters\r\n {\r\n public static int secretLength = 32;\r\n\r\n public static void Print()\r\n {\r\n CommonParams.Print();\r\n Console.Error.WriteLine(\"secretLength\\t{0}\", secretLength);\r\n }\r\n\r\n public static void PrintUsage()\r\n {\r\n Console.Out.WriteLine(\"Usage: PassHashSrv.exe [filename or param=value]... where filename contains\");\r\n Console.Out.WriteLine(\" lines of the form param=value and param must be one of the following.\");\r\n Console.Out.WriteLine();\r\n CommonParams.PrintUsage();\r\n Console.Out.WriteLine(\" secretLength = length of secret to use\");\r\n }\r\n\r\n public static void ApplyArguments (string[] args)\r\n {\r\n try\r\n {\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n catch (InvalidParameterException e)\r\n {\r\n Console.Out.WriteLine(e.contents);\r\n Parameters.PrintUsage();\r\n Environment.Exit(-1);\r\n }\r\n }\r\n\r\n public static void ApplyArgument (string arg)\r\n {\r\n char[] splitter = {'='};\r\n string[] sp = arg.ToLower().Split(splitter);\r\n\r\n if (sp.Length == 1)\r\n {\r\n ApplyArgumentsInFile(arg);\r\n return;\r\n }\r\n else if (sp.Length != 2)\r\n {\r\n throw new InvalidParameterException(\"Invalid command-line argument \" + arg);\r\n }\r\n\r\n string parameter = sp[0];\r\n string value = sp[1];\r\n\r\n if (CommonParams.ApplyArgument(parameter, value))\r\n {\r\n return;\r\n }\r\n if (String.Compare(parameter, \"secretLength\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n Parameters.secretLength = Convert.ToInt32(value);\r\n return;\r\n }\r\n\r\n throw new InvalidParameterException(\"Invalid command-line parameter \" + parameter);\r\n }\r\n\r\n public static void ApplyArgumentsInFile(string filename)\r\n {\r\n string[] args = File.ReadAllLines(filename);\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/PassHashSrv/PassHashRequest.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\nusing System.Linq;\r\nusing System.Text;\r\n\r\nnamespace PassHashSrv\r\n{\r\n public class PassHashRequest\r\n {\r\n public PassHashRequest() { }\r\n\r\n public static PassHashRequest ParseRequest (byte[] request)\r\n {\r\n if (request.Length < 1)\r\n {\r\n Console.Error.WriteLine(\"Received request with no bytes\");\r\n return new InvalidRequest();\r\n }\r\n if (request[0] == 1)\r\n {\r\n return PerformHashRequest.ParsePassHashRequest(request);\r\n }\r\n Console.Error.WriteLine(\"Received request with invalid type\");\r\n return new InvalidRequest();\r\n }\r\n }\r\n\r\n public class InvalidRequest : PassHashRequest\r\n {\r\n public InvalidRequest() { }\r\n }\r\n\r\n public class PerformHashRequest : PassHashRequest\r\n {\r\n public byte[] message;\r\n public byte[] salt;\r\n\r\n public PerformHashRequest(byte[] i_message, byte[] i_salt)\r\n {\r\n message = i_message;\r\n salt = i_salt;\r\n }\r\n\r\n public static PassHashRequest ParsePassHashRequest (byte[] request)\r\n {\r\n if (request.Length < 9)\r\n {\r\n Console.Error.WriteLine(\"Received perform-hash request with fewer than 9 bytes\");\r\n return new InvalidRequest();\r\n }\r\n int messageLength = (int)CommonRoutines.ExtractBEWord(request, 1);\r\n int saltLength = (int)CommonRoutines.ExtractBEWord(request, 5);\r\n if (request.Length < 9 + messageLength + saltLength)\r\n {\r\n Console.Error.WriteLine(\"Received perform-hash request without enough bytes to encode message and salt\");\r\n return new InvalidRequest();\r\n }\r\n byte[] message = request.Skip(9).Take(messageLength).ToArray();\r\n byte[] salt = request.Skip(9 + messageLength).Take(saltLength).ToArray();\r\n return new PerformHashRequest(message, salt);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/PassHashSrv/PassHashResponse.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace PassHashSrv\r\n{\r\n class PassHashResponse\r\n {\r\n public static byte[] EncodePerformHashResponse (UInt32 errorCode, byte[] hash)\r\n {\r\n if (hash.Length != 32)\r\n {\r\n throw new Exception(\"Tried to encode hash not of length 32 bytes\");\r\n }\r\n\r\n byte[] response = new byte[37];\r\n response[0] = 1;\r\n byte[] encodedErrorCode = CommonRoutines.EncodeBEWord(errorCode);\r\n Array.Copy(encodedErrorCode, 0, response, 1, 4);\r\n Array.Copy(hash, 0, response, 5, 32);\r\n return response;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/PassHashSrv/PassHashSrv.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {49E13550-3EC8-4FCC-AE5D-CBD278A33B20}\r\n Exe\r\n Properties\r\n PassHashSrv\r\n PassHashSrv\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {5e394d90-c3d6-41a1-a6b4-715e43e54d7c}\r\n Common\r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/PassHashSrv/Program.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Net;\r\nusing System.Net.Sockets;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace PassHashSrv\r\n{\r\n class Program\r\n {\r\n static byte[] HandleRequest(byte[] request)\r\n {\r\n return new byte[0];\r\n }\r\n\r\n static void Main(string[] args)\r\n {\r\n Parameters.ApplyArguments(args);\r\n UdpClient server = CommonRoutines.StartServer();\r\n StateMachine stateMachine = new StateMachine();\r\n IPEndPoint client = new IPEndPoint(IPAddress.Any, 0);\r\n while (true)\r\n {\r\n byte[] request = server.Receive(ref client);\r\n byte[] response = stateMachine.HandleRequest(request);\r\n server.Send(response, response.Length, client);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/PassHashSrv/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"PassHashSrv\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"PassHashSrv\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n\r\n[assembly: Guid(\"71784f06-0d20-461f-a4bb-4beb266e8e50\")]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/Clients/PassHashSrv/StateMachine.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\n\r\nnamespace PassHashSrv\r\n{\r\n class StateMachine\r\n {\r\n private byte[] secret;\r\n private SHA256 hasher;\r\n\r\n public StateMachine()\r\n {\r\n secret = new byte[Parameters.secretLength];\r\n Random rng = new Random();\r\n rng.NextBytes(secret);\r\n hasher = new SHA256Managed();\r\n }\r\n\r\n public byte[] HandleRequest(byte[] requestBytes)\r\n {\r\n PassHashRequest request = PassHashRequest.ParseRequest(requestBytes);\r\n if (request is PerformHashRequest)\r\n {\r\n PerformHashRequest performHashRequest = (PerformHashRequest)request;\r\n byte[] message = performHashRequest.message;\r\n byte[] salt = performHashRequest.salt;\r\n\r\n byte[] mashup = CommonRoutines.CombineByteArrays(secret, salt, message);\r\n byte[] hash = hasher.ComputeHash(mashup);\r\n return PassHashResponse.EncodePerformHashResponse(0, hash);\r\n }\r\n else\r\n {\r\n return Common.InvalidResponse.Encode();\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/TrInc/App.config", "content": "\r\n\r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/TrInc/Parameters.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Text;\r\n\r\nnamespace TrInc\r\n{\r\n class InvalidParameterException : Exception\r\n {\r\n public string contents;\r\n public InvalidParameterException(string i_contents) { contents = i_contents; }\r\n }\r\n\r\n public class Parameters\r\n {\r\n public static int messageLength = 32;\r\n public static int publicKeyBits = 2048;\r\n\r\n public static void Print()\r\n {\r\n CommonParams.Print();\r\n Console.Error.WriteLine(\"messageLength\\t{0}\", messageLength);\r\n Console.Error.WriteLine(\"publicKeyBits\\t{0}\", publicKeyBits);\r\n }\r\n\r\n public static void PrintUsage()\r\n {\r\n Console.Out.WriteLine(\"Usage: TrInc.exe [filename or param=value]... where filename contains\");\r\n Console.Out.WriteLine(\" lines of the form param=value and param must be one of the following.\");\r\n Console.Out.WriteLine();\r\n CommonParams.PrintUsage();\r\n Console.Out.WriteLine(\" messageLength = length of message to attest\");\r\n Console.Out.WriteLine(\" publicKeyBits = bits in our counter's public key\");\r\n }\r\n\r\n public static void ApplyArguments (string[] args)\r\n {\r\n try\r\n {\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n catch (InvalidParameterException e)\r\n {\r\n Console.Out.WriteLine(e.contents);\r\n Parameters.PrintUsage();\r\n Environment.Exit(-1);\r\n }\r\n }\r\n\r\n public static void ApplyArgument (string arg)\r\n {\r\n char[] splitter = {'='};\r\n string[] sp = arg.ToLower().Split(splitter);\r\n\r\n if (sp.Length == 1)\r\n {\r\n ApplyArgumentsInFile(arg);\r\n return;\r\n }\r\n else if (sp.Length != 2)\r\n {\r\n throw new InvalidParameterException(\"Invalid command-line argument \" + arg);\r\n }\r\n\r\n string parameter = sp[0];\r\n string value = sp[1];\r\n\r\n if (CommonParams.ApplyArgument(parameter, value))\r\n {\r\n return;\r\n }\r\n if (String.Compare(parameter, \"messageLength\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n Parameters.messageLength = Convert.ToInt32(value);\r\n return;\r\n }\r\n if (String.Compare(parameter, \"publicKeyBits\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n Parameters.publicKeyBits = Convert.ToInt32(value);\r\n return;\r\n }\r\n if (String.Compare(parameter, \"numberOfRuns\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n CommonParams.numberOfRuns = Convert.ToInt32(value);\r\n return;\r\n }\r\n if (String.Compare(parameter, \"ignoreKey\", StringComparison.OrdinalIgnoreCase) == 0)\r\n {\r\n CommonParams.ignoreKey = Convert.ToInt32(value) != 0;\r\n return;\r\n }\r\n\r\n throw new InvalidParameterException(\"Invalid command-line parameter \" + parameter);\r\n }\r\n\r\n public static void ApplyArgumentsInFile(string filename)\r\n {\r\n string[] args = File.ReadAllLines(filename);\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/TrInc/Program.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\nusing System.Linq;\r\nusing System.Net.Sockets;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace TrInc\r\n{\r\n class Program\r\n {\r\n static RSACryptoServiceProvider CreateNewCounter(UdpClient client, bool counter_index_known, ref UInt32 counter_index)\r\n {\r\n CreateCounterRequest createCounterRequest = new CreateCounterRequest(Parameters.publicKeyBits);\r\n byte[] request = createCounterRequest.GetPacket();\r\n byte[] response = CommonRoutines.SendRequest(client, request, \"CreateNewCounter\");\r\n CreateCounterResponse createCounterResponse = new CreateCounterResponse(response);\r\n\r\n if (counter_index_known && createCounterResponse.CounterIndex != counter_index)\r\n {\r\n throw new Exception(\"New counter index in CreateNewCounterResponse did not match expected counter index\");\r\n }\r\n counter_index = createCounterResponse.CounterIndex;\r\n\r\n return createCounterRequest.KeyPair;\r\n }\r\n\r\n static void AdvanceCounter(UdpClient client, RSACryptoServiceProvider ironclad_public_key,\r\n RSACryptoServiceProvider counter_key_pair, SHA256Managed hasher, UInt32 counter_index,\r\n byte[] message, UInt32 old_counter_value, UInt32 new_counter_value)\r\n {\r\n AdvanceCounterRequest advanceCounterRequest =\r\n new AdvanceCounterRequest(counter_index, new_counter_value, message, counter_key_pair);\r\n byte[] request = advanceCounterRequest.GetPacket(hasher);\r\n byte[] response = CommonRoutines.SendRequest(client, request, \"AdvanceCounter\");\r\n AdvanceCounterResponse advanceCounterResponse = new AdvanceCounterResponse(response, ironclad_public_key);\r\n\r\n if (advanceCounterResponse.OldCounterValue != old_counter_value)\r\n {\r\n throw new Exception(\"AdvanceCounter statement had wrong old counter value\");\r\n }\r\n if (advanceCounterResponse.NewCounterValue != new_counter_value)\r\n {\r\n throw new Exception(\"AdvanceCounter statement had wrong new counter value\");\r\n }\r\n if (!advanceCounterResponse.Message.SequenceEqual(message))\r\n {\r\n throw new Exception(\"AdvanceCounter statement had wrong message\");\r\n }\r\n }\r\n\r\n static void Main(string[] args)\r\n {\r\n Parameters.ApplyArguments(args);\r\n Profiler.Initialize();\r\n UdpClient client = CommonRoutines.StartClient();\r\n\r\n Console.Error.WriteLine(\"Getting Ironclad public key\");\r\n RSACryptoServiceProvider ironclad_public_key = CommonRoutines.GetIroncladPublicKey(client);\r\n\r\n Console.Error.WriteLine(\"Creating TrInc counter for advancing runs\");\r\n UInt32 counter_index = 0;\r\n RSACryptoServiceProvider counter_key_pair = CreateNewCounter(client, false, ref counter_index);\r\n\r\n Console.Error.WriteLine(\"Advancing counter {0}\", counter_index);\r\n\r\n byte[] message = new byte[Parameters.messageLength];\r\n Random rng = new Random();\r\n SHA256Managed hasher = new SHA256Managed();\r\n for (UInt32 counter_value = 0; counter_value < CommonParams.numberOfRuns; ++counter_value)\r\n {\r\n Console.Error.WriteLine(\"Performing advance-counter run {0}\", counter_value + 1);\r\n rng.NextBytes(message);\r\n AdvanceCounter(client, ironclad_public_key, counter_key_pair, hasher, counter_index, message, counter_value,\r\n counter_value + 1);\r\n }\r\n\r\n Console.Error.WriteLine(\"Creating new counters\");\r\n\r\n for (UInt32 run_number = 0; run_number < CommonParams.numberOfRuns; ++run_number)\r\n {\r\n Console.Error.WriteLine(\"Performing create-counter run {0}\", run_number + 1);\r\n ++counter_index;\r\n RSACryptoServiceProvider new_counter_key_pair = CreateNewCounter(client, true, ref counter_index);\r\n }\r\n\r\n Profiler.Print();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/TrInc/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"TrInc\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"TrInc\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n\r\n[assembly: Guid(\"9dfc9946-9439-416d-85dc-ef059cf7f824\")]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/Clients/TrInc/TrInc.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {EC3E5C90-B0FD-44CE-883C-1BA3FC896C02}\r\n Exe\r\n Properties\r\n TrInc\r\n TrInc\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {5e394d90-c3d6-41a1-a6b4-715e43e54d7c}\r\n Common\r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/TrInc/TrIncRequests.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace TrInc\r\n{\r\n public class CreateCounterRequest\r\n {\r\n private int key_size;\r\n private RSACryptoServiceProvider key_pair;\r\n\r\n public RSACryptoServiceProvider KeyPair { get { return key_pair; } }\r\n\r\n public CreateCounterRequest(int i_key_size)\r\n {\r\n key_size = i_key_size;\r\n key_pair = new RSACryptoServiceProvider(key_size);\r\n }\r\n\r\n public byte[] GetPacket()\r\n {\r\n byte[] header = new byte[1]; header[0] = 2;\r\n byte[] encoded_public_key = CommonRoutines.EncodePublicKey(key_pair);\r\n byte[] encoded_public_key_length = CommonRoutines.EncodeBEWord((UInt32)encoded_public_key.Length);\r\n return CommonRoutines.CombineByteArrays(header, encoded_public_key_length, encoded_public_key);\r\n }\r\n }\r\n\r\n public class AdvanceCounterRequest\r\n {\r\n private UInt32 counter_index;\r\n private UInt32 new_counter_value;\r\n private byte[] message;\r\n private RSACryptoServiceProvider key_pair;\r\n\r\n public AdvanceCounterRequest(UInt32 i_counter_index, UInt32 i_new_counter_value, byte[] i_message, RSACryptoServiceProvider i_key_pair)\r\n {\r\n counter_index = i_counter_index;\r\n new_counter_value = i_new_counter_value;\r\n message = i_message;\r\n key_pair = i_key_pair;\r\n }\r\n\r\n public byte[] GetPacket(SHA256Managed hasher)\r\n {\r\n byte[] header = new byte[1]; header[0] = 3;\r\n byte[] counter_index_encoded = CommonRoutines.EncodeBEWord(counter_index);\r\n\r\n byte[] new_counter_value_encoded = CommonRoutines.EncodeMPInt(new_counter_value);\r\n byte[] new_counter_value_length_encoded = CommonRoutines.EncodeBEWord((UInt32)new_counter_value_encoded.Length);\r\n\r\n byte[] message_length_encoded = CommonRoutines.EncodeBEWord((UInt32) message.Length);\r\n\r\n byte[] request = CommonRoutines.CombineByteArrays(new_counter_value_encoded, message);\r\n byte[] request_attestation = key_pair.SignData(request, CryptoConfig.MapNameToOID(\"SHA256\"));\r\n byte[] request_attestation_length_encoded = CommonRoutines.EncodeBEWord((UInt32)request_attestation.Length);\r\n\r\n return CommonRoutines.CombineByteArrays(header, counter_index_encoded, new_counter_value_length_encoded, message_length_encoded,\r\n request_attestation_length_encoded, new_counter_value_encoded, message,\r\n request_attestation);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/TrInc/TrIncResponses.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace TrInc\r\n{\r\n class CreateCounterResponse\r\n {\r\n private UInt32 error_code;\r\n private UInt32 counter_index;\r\n\r\n public UInt32 CounterIndex { get { return counter_index; } }\r\n public UInt32 ErrorCode { get { return error_code; } }\r\n\r\n public CreateCounterResponse(byte[] packet)\r\n {\r\n if (packet.Length < 9)\r\n {\r\n throw new Exception(\"Invalid CreateCounterResponsePacket -- length < 9\");\r\n }\r\n if (packet[0] != 2)\r\n {\r\n throw new Exception(\"First byte of CreateCounterResponse is not 2\");\r\n }\r\n error_code = CommonRoutines.ExtractBEWord(packet, 1);\r\n if (error_code != 0)\r\n {\r\n throw new ErrorCodeException(error_code);\r\n }\r\n counter_index = CommonRoutines.ExtractBEWord(packet, 5);\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return string.Format(\"CreateCounterResponse(error_code={0}, counter_index={1})\", error_code, counter_index);\r\n }\r\n }\r\n\r\n class AdvanceCounterResponse\r\n {\r\n private UInt32 error_code;\r\n private UInt32 counter_index;\r\n private UInt32 old_counter_value;\r\n private UInt32 new_counter_value;\r\n private byte[] message;\r\n\r\n public UInt32 ErrorCode { get { return error_code; } }\r\n public UInt32 CounterIndex { get { return counter_index; } }\r\n public UInt32 OldCounterValue { get { return old_counter_value; } }\r\n public UInt32 NewCounterValue { get { return new_counter_value; } }\r\n public byte[] Message { get { return message; } }\r\n\r\n public AdvanceCounterResponse(byte[] packet, RSACryptoServiceProvider ironclad_public_key)\r\n {\r\n if (packet.Length < 13)\r\n {\r\n throw new Exception(\"Invalid AdvanceCounterResponsePacket -- length < 13\");\r\n }\r\n if (packet[0] != 3)\r\n {\r\n throw new Exception(\"First byte of AdvanceCounterResponse is not 3\");\r\n }\r\n error_code = CommonRoutines.ExtractBEWord(packet, 1);\r\n if (error_code != 0)\r\n {\r\n throw new ErrorCodeException(error_code);\r\n }\r\n int trinc_statement_length = (int)CommonRoutines.ExtractBEWord(packet, 5);\r\n int trinc_attestation_length = (int)CommonRoutines.ExtractBEWord(packet, 9);\r\n byte[] trinc_statement = packet.Skip(13).Take(trinc_statement_length).ToArray();\r\n byte[] trinc_attestation = packet.Skip(13 + trinc_statement_length).Take(trinc_attestation_length).ToArray();\r\n\r\n if (trinc_statement.Length < 1)\r\n {\r\n throw new Exception(\"TrInc statement too short\");\r\n }\r\n if (trinc_statement[0] != 34)\r\n {\r\n throw new Exception(\"TrInc statement does not start with magic byte 34\");\r\n }\r\n\r\n counter_index = CommonRoutines.ExtractBEWord(trinc_statement, 1);\r\n int offset = 5;\r\n old_counter_value = CommonRoutines.DecodeShortMPInt(trinc_statement, ref offset);\r\n new_counter_value = CommonRoutines.DecodeShortMPInt(trinc_statement, ref offset);\r\n message = trinc_statement.Skip(offset).ToArray();\r\n\r\n if (!CommonParams.ignoreKey &&\r\n !ironclad_public_key.VerifyData(trinc_statement, CryptoConfig.MapNameToOID(\"SHA256\"), trinc_attestation))\r\n {\r\n throw new Exception(\"Could not verify signature of TrInc statement\");\r\n }\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return string.Format(\"AdvanceCounterResponse(error_code={0}\", error_code);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/TrIncSrv/App.config", "content": "\r\n\r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/TrIncSrv/Parameters.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Text;\r\n\r\nnamespace TrIncSrv\r\n{\r\n class InvalidParameterException : Exception\r\n {\r\n public string contents;\r\n public InvalidParameterException(string i_contents) { contents = i_contents; }\r\n }\r\n\r\n public class Parameters\r\n {\r\n public static void Print()\r\n {\r\n CommonParams.Print();\r\n }\r\n\r\n public static void PrintUsage()\r\n {\r\n Console.Out.WriteLine(\"Usage: TrIncSrv.exe [filename or param=value]... where filename contains\");\r\n Console.Out.WriteLine(\" lines of the form param=value and param must be one of the following.\");\r\n Console.Out.WriteLine();\r\n CommonParams.PrintUsage();\r\n }\r\n\r\n public static void ApplyArguments (string[] args)\r\n {\r\n try\r\n {\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n catch (InvalidParameterException e)\r\n {\r\n Console.Out.WriteLine(e.contents);\r\n Parameters.PrintUsage();\r\n Environment.Exit(-1);\r\n }\r\n }\r\n\r\n public static void ApplyArgument (string arg)\r\n {\r\n char[] splitter = {'='};\r\n string[] sp = arg.ToLower().Split(splitter);\r\n\r\n if (sp.Length == 1)\r\n {\r\n ApplyArgumentsInFile(arg);\r\n return;\r\n }\r\n else if (sp.Length != 2)\r\n {\r\n throw new InvalidParameterException(\"Invalid command-line argument \" + arg);\r\n }\r\n\r\n string parameter = sp[0];\r\n string value = sp[1];\r\n\r\n if (CommonParams.ApplyArgument(parameter, value))\r\n {\r\n return;\r\n }\r\n\r\n throw new InvalidParameterException(\"Invalid command-line parameter \" + parameter);\r\n }\r\n\r\n public static void ApplyArgumentsInFile(string filename)\r\n {\r\n string[] args = File.ReadAllLines(filename);\r\n foreach (string arg in args)\r\n {\r\n ApplyArgument(arg);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/TrIncSrv/Program.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Net;\r\nusing System.Net.Sockets;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace TrIncSrv\r\n{\r\n class Program\r\n {\r\n static byte[] HandleRequest(byte[] request)\r\n {\r\n return new byte[0];\r\n }\r\n\r\n static void Main(string[] args)\r\n {\r\n Parameters.ApplyArguments(args);\r\n UdpClient server = CommonRoutines.StartServer();\r\n StateMachine stateMachine = new StateMachine();\r\n IPEndPoint client = new IPEndPoint(IPAddress.Any, 0);\r\n while (true)\r\n {\r\n byte[] request = server.Receive(ref client);\r\n byte[] response = stateMachine.HandleRequest(request);\r\n server.Send(response, response.Length, client);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/TrIncSrv/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"TrIncSrv\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"TrIncSrv\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n\r\n[assembly: Guid(\"8abf08df-e907-4fcc-a116-745c4a62caa6\")]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/Clients/TrIncSrv/StateMachine.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Numerics;\r\nusing System.Security.Cryptography;\r\nusing System.Text;\r\n\r\nnamespace TrIncSrv\r\n{\r\n class TrIncCounter\r\n {\r\n private RSACryptoServiceProvider public_key;\r\n private BigInteger counter;\r\n\r\n public RSACryptoServiceProvider PublicKey { get { return public_key; } }\r\n public BigInteger Value { get { return counter; } set { counter = value; } }\r\n\r\n public TrIncCounter(RSACryptoServiceProvider i_public_key)\r\n {\r\n public_key = i_public_key;\r\n counter = new BigInteger(0);\r\n }\r\n }\r\n\r\n class StateMachine\r\n {\r\n private RSACryptoServiceProvider key_pair;\r\n private List counters;\r\n private SHA256Managed hasher;\r\n\r\n public StateMachine()\r\n {\r\n key_pair = new RSACryptoServiceProvider(CommonParams.serverKeyBits);\r\n counters = new List();\r\n hasher = new SHA256Managed();\r\n }\r\n\r\n public byte[] HandleRequest(byte[] requestBytes)\r\n {\r\n object request = TrIncRequest.ParseRequest(requestBytes);\r\n if (request is Common.GetQuoteRequest)\r\n {\r\n GetQuoteResponse getQuoteResponse = new GetQuoteResponse(0, key_pair);\r\n return getQuoteResponse.Encode();\r\n }\r\n if (request is CreateCounterRequest)\r\n {\r\n CreateCounterRequest r = (CreateCounterRequest)request;\r\n RSACryptoServiceProvider public_key = CommonRoutines.DecodePublicKey(r.public_key);\r\n if (public_key == null)\r\n {\r\n return TrIncSrvResponse.EncodeCreateCounterResponse(3, 0);\r\n }\r\n TrIncCounter counter = new TrIncCounter(public_key);\r\n counters.Add(counter);\r\n UInt32 counter_index = (UInt32)(counters.Count - 1);\r\n return TrIncSrvResponse.EncodeCreateCounterResponse(0, counter_index);\r\n }\r\n if (request is AdvanceCounterRequest)\r\n {\r\n AdvanceCounterRequest r = (AdvanceCounterRequest)request;\r\n if (r.counter_index < 0 || r.counter_index >= counters.Count)\r\n {\r\n Console.Error.WriteLine(\"Received request for invalid counter index {0}\", r.counter_index);\r\n return TrIncSrvResponse.EncodeAdvanceCounterResponse(1, new byte[0], new byte[0]);\r\n }\r\n\r\n TrIncCounter counter = counters[(int)r.counter_index];\r\n byte[] req = CommonRoutines.CombineByteArrays(r.new_counter_value, r.message);\r\n if (!counter.PublicKey.VerifyData(req, CryptoConfig.MapNameToOID(\"SHA256\"), r.request_attestation))\r\n {\r\n Console.Error.WriteLine(\"Received invalid request attestation\");\r\n return TrIncSrvResponse.EncodeAdvanceCounterResponse(5, new byte[0], new byte[0]);\r\n }\r\n\r\n int offset = 0;\r\n BigInteger new_counter_value = CommonRoutines.DecodeMPBigInteger(r.new_counter_value, ref offset);\r\n if (new_counter_value < 0 || offset != r.new_counter_value.Length)\r\n {\r\n Console.Error.WriteLine(\"Received invalid new counter value encoding\");\r\n return TrIncSrvResponse.EncodeAdvanceCounterResponse(6, new byte[0], new byte[0]);\r\n }\r\n\r\n if (new_counter_value < counter.Value)\r\n {\r\n Console.Error.WriteLine(\"New counter value requested {0} is smaller than current counter value {1}\", new_counter_value, counter.Value);\r\n return TrIncSrvResponse.EncodeAdvanceCounterResponse(7, new byte[0], new byte[0]);\r\n }\r\n\r\n BigInteger old_counter_value = counter.Value;\r\n counter.Value = new_counter_value;\r\n\r\n byte[] header = new byte[1];\r\n header[0] = 34;\r\n byte[] counter_index_encoding = CommonRoutines.EncodeBEWord(r.counter_index);\r\n byte[] old_counter_value_encoding = CommonRoutines.EncodeMPBigInteger(old_counter_value);\r\n byte[] new_counter_value_encoding = CommonRoutines.EncodeMPBigInteger(new_counter_value);\r\n byte[] trinc_statement = CommonRoutines.CombineByteArrays(header, counter_index_encoding, old_counter_value_encoding, new_counter_value_encoding, r.message);\r\n byte[] trinc_attestation = key_pair.SignData(trinc_statement, CryptoConfig.MapNameToOID(\"SHA256\"));\r\n return TrIncSrvResponse.EncodeAdvanceCounterResponse(0, trinc_statement, trinc_attestation);\r\n }\r\n return InvalidResponse.Encode();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/TrIncSrv/TrIncRequest.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\nusing System.Linq;\r\nusing System.Text;\r\n\r\nnamespace TrIncSrv\r\n{\r\n public class TrIncRequest\r\n {\r\n public TrIncRequest() { }\r\n\r\n public static object ParseRequest (byte[] request)\r\n {\r\n if (request.Length < 1)\r\n {\r\n Console.Error.WriteLine(\"Received request with no bytes\");\r\n return new Common.InvalidRequest();\r\n }\r\n if (request[0] == 1)\r\n {\r\n return Common.GetQuoteRequest.ParseRequest(request);\r\n }\r\n if (request[0] == 2)\r\n {\r\n return CreateCounterRequest.ParseRequest(request);\r\n }\r\n if (request[0] == 3)\r\n {\r\n return AdvanceCounterRequest.ParseRequest(request);\r\n }\r\n Console.Error.WriteLine(\"Received request with invalid type\");\r\n return new Common.InvalidRequest();\r\n }\r\n }\r\n\r\n public class CreateCounterRequest\r\n {\r\n public byte[] public_key;\r\n\r\n public CreateCounterRequest(byte[] i_public_key)\r\n {\r\n public_key = i_public_key;\r\n }\r\n\r\n public static object ParseRequest (byte[] request)\r\n {\r\n if (request.Length < 5)\r\n {\r\n Console.Error.WriteLine(\"Received create-counter request with fewer than 5 bytes\");\r\n return new Common.InvalidRequest();\r\n }\r\n int public_key_length = (int)CommonRoutines.ExtractBEWord(request, 1);\r\n if (request.Length < 5 + public_key_length)\r\n {\r\n Console.Error.WriteLine(\"Received create-counter request without enough bytes to encode public key\");\r\n return new Common.InvalidRequest();\r\n }\r\n byte[] public_key = request.Skip(5).Take(public_key_length).ToArray();\r\n return new CreateCounterRequest(public_key);\r\n }\r\n }\r\n\r\n public class AdvanceCounterRequest\r\n {\r\n public UInt32 counter_index;\r\n public byte[] new_counter_value;\r\n public byte[] message;\r\n public byte[] request_attestation;\r\n\r\n public AdvanceCounterRequest(UInt32 i_counter_index, byte[] i_new_counter_value, byte[] i_message, byte[] i_request_attestation)\r\n {\r\n counter_index = i_counter_index;\r\n new_counter_value = i_new_counter_value;\r\n message = i_message;\r\n request_attestation = i_request_attestation;\r\n }\r\n\r\n public static object ParseRequest (byte[] request)\r\n {\r\n if (request.Length < 17)\r\n {\r\n Console.Error.WriteLine(\"Received advance-counter request with fewer than 17 bytes\");\r\n return new Common.InvalidRequest();\r\n }\r\n UInt32 counter_index = CommonRoutines.ExtractBEWord(request, 1);\r\n int new_counter_len = (int)CommonRoutines.ExtractBEWord(request, 5);\r\n int message_len = (int)CommonRoutines.ExtractBEWord(request, 9);\r\n int request_attestation_len = (int)CommonRoutines.ExtractBEWord(request, 13);\r\n if (request.Length < 17 + new_counter_len + message_len + request_attestation_len)\r\n {\r\n Console.Error.WriteLine(\"Received advance-counter request without enough bytes to encode all fields\");\r\n return new Common.InvalidRequest();\r\n }\r\n byte[] new_counter_value = request.Skip(17).Take(new_counter_len).ToArray();\r\n byte[] message = request.Skip(17 + new_counter_len).Take(message_len).ToArray();\r\n byte[] request_attestation = request.Skip(17 + new_counter_len + message_len).Take(request_attestation_len).ToArray();\r\n return new AdvanceCounterRequest(counter_index, new_counter_value, message, request_attestation);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/TrIncSrv/TrIncResponse.cs", "content": "using Common;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace TrIncSrv\r\n{\r\n class TrIncSrvResponse\r\n {\r\n public static byte[] EncodeCreateCounterResponse (UInt32 error_code, UInt32 counter_index)\r\n {\r\n byte[] header = new byte[1];\r\n header[0] = 2;\r\n\r\n byte[] error_code_encoded = CommonRoutines.EncodeBEWord(error_code);\r\n byte[] counter_index_encoded = CommonRoutines.EncodeBEWord((uint)counter_index);\r\n\r\n return CommonRoutines.CombineByteArrays(header, error_code_encoded, counter_index_encoded);\r\n }\r\n\r\n public static byte[] EncodeAdvanceCounterResponse (UInt32 error_code, byte[] trinc_statement, byte[] trinc_attestation)\r\n {\r\n byte[] header = new byte[1];\r\n header[0] = 3;\r\n\r\n byte[] error_code_encoded = CommonRoutines.EncodeBEWord(error_code);\r\n byte[] trinc_statement_length = CommonRoutines.EncodeBEWord((uint)trinc_statement.Length);\r\n byte[] trinc_attestation_length = CommonRoutines.EncodeBEWord((uint)trinc_attestation.Length);\r\n\r\n return CommonRoutines.CombineByteArrays(header, error_code_encoded, trinc_statement_length, trinc_attestation_length, trinc_statement, trinc_attestation);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/TrIncSrv/TrIncSrv.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {B99001E4-00B2-4A1B-A1D6-8B4773C0F5FB}\r\n Exe\r\n Properties\r\n TrIncSrv\r\n TrIncSrv\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {5e394d90-c3d6-41a1-a6b4-715e43e54d7c}\r\n Common\r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/UdpEchoClient/App.config", "content": "\r\n\r\n \r\n \r\n \r\n\r\n" }, { "path": "ironclad-apps/src/Clients/UdpEchoClient/Program.cs", "content": "using System;\r\nusing System.Net;\r\nusing System.Net.Sockets;\r\nusing System.Text;\r\n\r\nnamespace UdpEchoClient\r\n{\r\n class Program\r\n {\r\n static void Main(string[] Args)\r\n {\r\n UdpClient Client = null;\r\n ASCIIEncoding asciiEncoding = new ASCIIEncoding();\r\n\r\n if (Args.Length > 0)\r\n { \r\n Client = new UdpClient(Args[0], 7);\r\n\r\n if (Args.Length == 1)\r\n {\r\n String Line = null;\r\n IPEndPoint RemoteEndpoint = null;\r\n\r\n do\r\n {\r\n Console.Write(\"Send: \");\r\n Line = Console.ReadLine();\r\n if (Line != null)\r\n {\r\n byte[] Data = asciiEncoding.GetBytes(Line);\r\n Client.Send(Data, Data.Length);\r\n Data = Client.Receive(ref RemoteEndpoint);\r\n Console.WriteLine(\"Received: \" + asciiEncoding.GetString(Data));\r\n }\r\n } while (Line != null);\r\n }\r\n else if (Args.Length == 2)\r\n {\r\n byte[] Data = asciiEncoding.GetBytes(Args[1]);\r\n Client.Send(Data, Data.Length);\r\n }\r\n else\r\n {\r\n Usage();\r\n }\r\n }\r\n else\r\n {\r\n Usage();\r\n }\r\n }\r\n\r\n static void Usage()\r\n {\r\n Console.WriteLine(\"Usage: UdpEchoClient []\");\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Clients/UdpEchoClient/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"UdpEchoClient\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"UdpEchoClient\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n\r\n[assembly: Guid(\"31275927-e376-4e31-ba3f-9c027b40dc70\")]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/Clients/UdpEchoClient/UdpEchoClient.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {FA18D21B-EB2B-4ACE-B4A7-BC77D3836077}\r\n Exe\r\n Properties\r\n UdpEchoClient\r\n UdpEchoClient\r\n v4.0\r\n 512\r\n \r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n true\r\n bin\\x86\\Debug\\\r\n DEBUG;TRACE\r\n full\r\n x86\r\n prompt\r\n MinimumRecommendedRules.ruleset\r\n true\r\n \r\n \r\n bin\\x86\\Release\\\r\n TRACE\r\n true\r\n pdbonly\r\n x86\r\n prompt\r\n MinimumRecommendedRules.ruleset\r\n true\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/Clients/UdpEchoClient.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 12.00\r\n# Visual Studio 2013\r\nVisualStudioVersion = 12.0.30110.0\r\nMinimumVisualStudioVersion = 10.0.40219.1\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"UdpEchoClient\", \"UdpEchoClient\\UdpEchoClient.csproj\", \"{FA18D21B-EB2B-4ACE-B4A7-BC77D3836077}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Any CPU = Debug|Any CPU\r\n\t\tDebug|x86 = Debug|x86\r\n\t\tRelease|Any CPU = Release|Any CPU\r\n\t\tRelease|x86 = Release|x86\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{FA18D21B-EB2B-4ACE-B4A7-BC77D3836077}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{FA18D21B-EB2B-4ACE-B4A7-BC77D3836077}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{FA18D21B-EB2B-4ACE-B4A7-BC77D3836077}.Debug|x86.ActiveCfg = Debug|x86\r\n\t\t{FA18D21B-EB2B-4ACE-B4A7-BC77D3836077}.Debug|x86.Build.0 = Debug|x86\r\n\t\t{FA18D21B-EB2B-4ACE-B4A7-BC77D3836077}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{FA18D21B-EB2B-4ACE-B4A7-BC77D3836077}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{FA18D21B-EB2B-4ACE-B4A7-BC77D3836077}.Release|x86.ActiveCfg = Release|x86\r\n\t\t{FA18D21B-EB2B-4ACE-B4A7-BC77D3836077}.Release|x86.Build.0 = Release|x86\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "ironclad-apps/src/Dafny/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/AddPerf/Main.i.dfy", "content": "\n\n\ninclude \"../../Libraries/Util/insecure_prng.i.dfy\"\ninclude \"../../Libraries/FleetNat/FleetNatAdd.i.dfy\"\ninclude \"../../Libraries/FleetNat/FleetNatMul.i.dfy\"\ninclude \"../../Libraries/FatNat/FatNatMod.i.dfy\"\ninclude \"../../Drivers/IO/pci.i.dfy\"\n\n//-\n//- A wrapper utility for benchmarking various parts of the system.\n//-\n\nmethod print_array(alabel:int, a:array)\n requires 0 <= alabel < 120;\n requires a != null;\n requires IsDigitSeq(power2(32), a[..]);\n{\n var i := 0;\n while (i < a.Length) \n invariant 0 <= i <= a.Length;\n invariant IsDigitSeq(power2(32), a[..i]); \n {\n debug_print(alabel, a[i]);\n i := i+1;\n }\n\n}\n\nmethod repeat_array(v:int, l:nat) returns (a:array)\n requires 0<=v a[i]==v;\n ensures IsDigitSeq(power2(32), a[..]);\n ensures 0 v <=BEWordSeqToInt(a[..]);\n{\n a := new int[l];\n var j := 0;\n while (j < l)\n invariant 0<=j<=l;\n invariant forall i :: 0<=i a[i]==v;\n {\n a[j] := v;\n j := j + 1;\n }\n if (0)\r\n//- ensures fresh(arr);\r\n//- ensures arr != null;\r\n//- ensures arr.Length == 0x40000;\r\n//- ensures forall j :: 0 <= j < arr.Length ==> arr[j] == j;\r\n//- ensures IsWordSeq(arr[..]);\r\n//-{\r\n//- arr := new int[0x40000];\r\n//- var i := 0;\r\n//- while (i < 0x40000) \r\n//- invariant 0 <= i <= 0x40000;\r\n//- invariant forall j :: 0 <= j < i ==> arr[j] == j;\r\n//- invariant forall j :: 0 <= j < i ==> Word32(arr[j]);\r\n//- {\r\n//- arr[i] := i;\r\n//- i := i + 1;\r\n//- lemma_2toX();\r\n//- }\r\n//-}\r\n\r\nmethod PrependArray(first:int, second:int, rest:array) returns (unified:array)\r\n requires Word32(first) && Word32(second);\r\n requires rest != null;\r\n requires IsWordSeq(rest[..]);\r\n ensures fresh(unified);\r\n ensures unified != null;\r\n ensures IsWordSeqOfLen(unified[..], 2 + rest.Length);\r\n ensures unified[..] == [first, second] + rest[..];\r\n{\r\n unified := new int[2 + rest.Length];\r\n unified[0] := first;\r\n unified[1] := second;\r\n\r\n var i := 0;\r\n while (i < rest.Length)\r\n invariant 0 <= i <= rest.Length;\r\n invariant unified[..i+2] == [first, second] + rest[..i];\r\n {\r\n unified[i+2] := rest[i];\r\n assert unified[..i+3] == unified[..i+2] + [unified[i+2]]; //- dafnycc\r\n assert rest[..i+1] == rest[..i] + [rest[i]]; //- dafnycc\r\n i := i + 1;\r\n }\r\n calc {\r\n unified[..];\r\n unified[..rest.Length+2];\r\n [first, second] + rest[..rest.Length];\r\n [first, second] + rest[..];\r\n }\r\n}\r\n\r\nmethod hash_code_region(code_start:int, entry_point:int, code_words:array) returns (hash_bytes:seq)\r\n requires Word32(code_start) && Word32(entry_point);\r\n requires code_words != null;\r\n requires code_words.Length == 0x40000;\r\n requires IsWordSeq(code_words[..]);\r\n ensures var hash_input := BEWordSeqToBitSeq_premium([code_start, entry_point] + code_words[..]);\r\n |hash_input| < power2(64) &&\r\n IsBitSeq(hash_input) &&\r\n hash_bytes == BEWordSeqToByteSeq_premium(SHA1(hash_input));\r\n{\r\n lemma_2toX();\r\n ghost var sha_input_words := [code_start, entry_point] + code_words[..];\r\n var unified_input := PrependArray(code_start, entry_point, code_words);\r\n assert unified_input[..] == [code_start, entry_point] + code_words[..];\r\n assert |unified_input[..]| == 0x40002;\r\n assert |BEWordSeqToBitSeq_premium([code_start, entry_point] + code_words[..])| == 32*0x40002; \r\n assert |BEWordSeqToBitSeq_premium([code_start, entry_point] + code_words[..])| < power2(64);\r\n\r\n var unified_input_bytes := new int[unified_input.Length*4];\r\n BEWordArrayToByteArray(unified_input, unified_input_bytes);\r\n\r\n var hash_arr := SHA1_impl_Bytes_arrays(unified_input_bytes);\r\n assert hash_arr[..] == SHA1(BEByteSeqToBitSeq_premium(unified_input_bytes[..]));\r\n var hash_seq := hash_arr[..];\r\n hash_bytes := BEWordSeqToByteSeq_impl(hash_seq);\r\n lemma_BEByteSeqToBitSeq_BEWordSeqToByteSeq([code_start, entry_point] + code_words[..]);\r\n}\r\n\r\nmethod Main (code_start:int, entry_point:int, code_words:array) returns (result:int)\r\n requires word32(code_start) && word32(entry_point);\r\n requires code_words != null;\r\n requires code_words.Length == 0x40000;\r\n requires IsWordSeq(code_words[..]);\r\n requires TPM_valid(TPM);\r\n requires TPM.PCR_19 == [];\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures Word32(code_start) && Word32(entry_point);\r\n ensures var hash_input := BEWordSeqToBitSeq([code_start, entry_point] + code_words[..]);\r\n |hash_input| < power2(64) &&\r\n IsBitSeq(hash_input) &&\r\n TPM.PCR_19 == [BEWordSeqToByteSeq(SHA1(hash_input))];\r\n ensures result == entry_point;\r\n{\r\n establish_locality();\r\n lemma_2toX();\r\n lemma_word32_Word32();\r\n assert word32(code_start) ==> Word32(code_start);\r\n assert word32(entry_point) ==> Word32(entry_point);\r\n \r\n var hash_bytes := hash_code_region(code_start, entry_point, code_words);\r\n var success := extend_PCR(hash_bytes);\r\n\r\n if (!success) { //- Can't guarantee anything about PCR 19 at this point\r\n while true\r\n decreases *;\r\n {\r\n debug_print(0, 0x44440021);\r\n }\r\n }\r\n\r\n//- calc {\r\n//- TPM.PCR_19;\r\n//- [hash_bytes];\r\n//- [BEWordSeqToByteSeq(hash_seq)];\r\n//- [BEWordSeqToByteSeq(SHA1(BEByteSeqToBitSeq_premium(unified_input_bytes[..])))];\r\n//- [BEWordSeqToByteSeq(SHA1(BEByteSeqToBitSeq_premium(BEWordSeqToByteSeq(sha_input_words))))];\r\n//- [BEWordSeqToByteSeq(SHA1(BEByteSeqToBitSeq_premium(BEWordSeqToByteSeq_premium([code_start, entry_point] + code_words[..]))))];\r\n//- }\r\n lemma_BEByteSeqToBitSeq_BEWordSeqToByteSeq([code_start, entry_point] + code_words[..]);\r\n\r\n return entry_point;\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/BenchmarkApp/Main.i.dfy", "content": "//-\r\ninclude \"../BenchmarkService/BenchmarkList.i.dfy\"\r\ninclude \"../BenchmarkService/BenchmarkCore.i.dfy\"\r\ninclude \"../../Libraries/Util/insecure_prng.i.dfy\"\r\ninclude \"../../Libraries/Crypto/Hash/sha256opt2.i.dfy\"\r\n\r\n//-\r\n//- A wrapper utility for benchmarking various parts of the system.\r\n//-\r\n\r\nmethod print_array(alabel:int, a:array)\r\n requires 0 <= alabel < 120;\r\n requires a != null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n{\r\n var i := 0;\r\n while (i < a.Length) \r\n invariant 0 <= i <= a.Length;\r\n invariant IsDigitSeq(power2(32), a[..i]); \r\n {\r\n debug_print(alabel, a[i]);\r\n i := i+1;\r\n }\r\n\r\n}\r\n\r\nmethod print_state(state:BenchmarkState)\r\n requires WellformedBenchmarkState(state);\r\n{\r\n if state.FatNatAddState? {\r\n var b_ref := state.b;\r\n reveal_WellformedBenchmarkState();\r\n print_array(0xa, state.a);\r\n reveal_WellformedBenchmarkState();\r\n print_array(0xb, state.b);\r\n }\r\n}\r\n\r\n\r\n//-\r\n//- Main benchmark app entry point.\r\n//-\r\nmethod Main()\r\n returns (Result:int)\r\n ensures public(true);\r\n requires TPM_valid(TPM);\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n requires IoMemPerm.Null?;\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n{\r\n lemma_2toX();\r\n\r\n Result := 0;\r\n\r\n var rand := insecure_get_random(42); \r\n var dummy_array := new int[1];\r\n\r\n //-\r\n //- TPM initialization.\r\n //-\r\n//- [jonh] comment next line out to build C# version\r\n establish_locality();\r\n //-var bms := BenchmarkState_c(KeyPairOptAbsent());\r\n ResetTally();\r\n\r\n var benchmark := BenchmarkSha256();\r\n //-var benchmark := BenchmarkFatAdd();\r\n var valid,state := prepare_state(benchmark, 512, true, false, 8192*8);\r\n\r\n if valid {\r\n var BeginHigh, BeginLow, EndHigh, EndLow, TestResult, state' := TimeIt(benchmark, 100000, state, dummy_array);\r\n //-print_state(state');\r\n debug_print(0x89, BeginHigh);\r\n debug_print(0x89, BeginLow);\r\n debug_print(0x89, EndHigh);\r\n debug_print(0x89, EndLow);\r\n DisplayTally();\r\n } else {\r\n debug_print(0x66, 0x666666);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/BenchmarkService/BenchmarkCore.i.dfy", "content": "include \"../../Drivers/CPU/assembly_premium.i.dfy\"\r\ninclude \"../../Libraries/Util/integer_sequences.i.dfy\"\r\ninclude \"../../Libraries/Util/word_bits.i.dfy\"\r\ninclude \"../../Libraries/Crypto/Hash/sha1.i.dfy\"\r\ninclude \"../../Libraries/Crypto/Hash/sha256.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSA.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSAOps.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSA_Decrypt.i.dfy\"\r\ninclude \"BenchmarkList.i.dfy\"\r\ninclude \"../../Libraries/BigNum/BigNatTestLib.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSAPublicWrapper.i.dfy\"\r\n\r\n//-\r\n//- Core utilities for benchmarking various parts of the system.\r\n//-\r\n\r\ndatatype BenchmarkState = NopState() \r\n | RsaState(keypair:RSAKeyPairImpl, text:seq) \r\n | RsaKeyGenState(num_key_bits:int) \r\n | FatNatAddState(a:array, b:array)\r\n | ShaState(arr_is_words:bool, arr:array, use_original:bool)\r\n\r\npredicate {:opaque} {:heap} WellformedBenchmarkState(state:BenchmarkState)\r\n reads if state.FatNatAddState? then state.a else null;\r\n reads if state.FatNatAddState? then state.b else null;\r\n reads if state.ShaState? then state.arr else null;\r\n{\r\n if state.RsaState? then WellformedRSAKeyPairImpl(state.keypair)\r\n && IsByteSeq(state.text)\r\n && 0 < |state.text| <= state.keypair.pub.size - 11\r\n else if state.RsaKeyGenState? then 20 < state.num_key_bits < power2(28)\r\n else if state.FatNatAddState? then state.a != null \r\n && state.b != null \r\n && IsDigitSeq(power2(32), state.a[..]) \r\n && IsDigitSeq(power2(32), state.b[..])\r\n else if state.ShaState? then state.arr != null \r\n && if state.arr_is_words then\r\n ( Word32(state.arr.Length*32) \r\n && state.arr.Length*32 < power2(64) \r\n && IsWordSeq(state.arr[..]))\r\n else \r\n ( Word32(state.arr.Length*8) \r\n && state.arr.Length*8 < power2(64) \r\n && IsByteSeq(state.arr[..]))\r\n else true\r\n}\r\n\r\npredicate {:opaque} CorrectBenchmarkState(state:BenchmarkState, Benchmark:int)\r\n{\r\n if Benchmark == BenchmarkFatAdd() || Benchmark == BenchmarkFatAddSlowly() then state.FatNatAddState?\r\n else if Benchmark == BenchmarkSha256() then state.ShaState?\r\n else if Benchmark == BenchmarkRsaEncrypt() || Benchmark == BenchmarkRsaDecrypt() then state.RsaState?\r\n else if Benchmark == BenchmarkRsaKeyGen() then state.RsaKeyGenState?\r\n else true\r\n}\r\n\r\nmethod ZeroArray(arr:array)\r\n requires arr != null;\r\n modifies arr;\r\n ensures IsByteSeq(arr[..]);\r\n{\r\n var i := 0;\r\n while (i < arr.Length) \r\n invariant 0 <= i <= arr.Length;\r\n invariant IsByteSeq(arr[..i]);\r\n {\r\n arr[i] := 0;\r\n assert arr[..i+1] == arr[..i] + [arr[i]]; //- dafnycc\r\n i := i + 1;\r\n }\r\n assert arr[..] == arr[..arr.Length];\r\n}\r\n\r\nmethod make_array(val:int, len:int) returns (a:array)\r\n requires 0 <= val < power2(32);\r\n requires len > 0;\r\n ensures a != null; \r\n ensures fresh(a);\r\n ensures a.Length == len;\r\n ensures forall i:int :: 0 <= i < len ==> a[i] == val;\r\n{\r\n a := new int[len];\r\n\r\n var i := 0;\r\n while (i < a.Length) \r\n invariant 0 <= i <= a.Length;\r\n //-invariant IsDigitSeq(power2(32), a[..i]); \r\n invariant forall j:int :: 0 <= j < i ==> a[j] == val;\r\n {\r\n lemma_2toX();\r\n a[i] := val;\r\n assert a[..i+1] == a[..i] + [a[i]]; //- this line added for DafnyCC's sake\r\n i := i + 1;\r\n }\r\n //-assert IsDigitSeq(power2(32), a[0..a.Length]); \r\n assert a[..] == a[0..a.Length];\r\n //-assert IsDigitSeq(power2(32), a[..]); \r\n}\r\n\r\n\r\nmethod mkFatNatAddState() returns (state:BenchmarkState)\r\n ensures state.FatNatAddState?;\r\n ensures state.a != null && state.b != null; \r\n ensures fresh(state.a) && fresh(state.b);\r\n ensures IsDigitSeq(power2(32), state.a[..]) && IsDigitSeq(power2(32), state.b[..]);\r\n ensures WellformedBenchmarkState(state);\r\n{\r\n lemma_2toX();\r\n var a := make_array(42,32);\r\n var b := make_array(12,32);\r\n\r\n state := FatNatAddState(a, b);\r\n reveal_WellformedBenchmarkState();\r\n}\r\n\r\nmethod mkShaState(use_words:bool,use_original:bool, len_bits:int) returns (valid:bool, state:BenchmarkState)\r\n ensures valid ==> state.ShaState?;\r\n ensures valid ==> WellformedBenchmarkState(state);\r\n{\r\n lemma_2toX();\r\n valid := true;\r\n\r\n if len_bits <= 0 || len_bits > 0x1000000 || len_bits / 32 <= 0 || len_bits / 8 <= 0 {\r\n return false, NopState();\r\n }\r\n\r\n var a;\r\n if (use_words) {\r\n var len_words := len_bits / 32;\r\n a := make_array(42,len_words);\r\n } else {\r\n var len_bytes := len_bits / 8;\r\n a := make_array(42,len_bytes);\r\n }\r\n\r\n state := ShaState(use_words, a, use_original);\r\n reveal_WellformedBenchmarkState();\r\n}\r\n\r\nmethod mkRsaState(num_key_bits:int) returns (state:BenchmarkState)\r\n requires 100 < num_key_bits < 0x10000;\r\n requires TPM_ready();\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures state.RsaState?;\r\n ensures WellformedBenchmarkState(state);\r\n ensures TPM_ready();\r\n{\r\n lemma_2toX();\r\n\r\n var TestKeyPair:RSAKeyPairImpl;\r\n\r\n calc {\r\n 0x10000;\r\n < { lemma_2toX32(); }\r\n power2(28);\r\n }\r\n TestKeyPair := RSAKeyGen(num_key_bits);\r\n var s := RepeatDigit_impl(42, TestKeyPair.pub.size - 11);\r\n\r\n state := RsaState(TestKeyPair, s);\r\n reveal_WellformedBenchmarkState();\r\n}\r\n\r\nmethod prepare_state(Benchmark:int, num_key_bits:int, use_words:bool, use_original:bool, len_bits:int) returns (valid:bool,state:BenchmarkState)\r\n //-requires IsByte(Benchmark);\r\n //-requires 100 < num_key_bits < 0x10000;\r\n requires TPM_ready();\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures valid ==> WellformedBenchmarkState(state);\r\n ensures valid ==> CorrectBenchmarkState(state, Benchmark);\r\n ensures TPM_ready();\r\n{\r\n state := NopState();\r\n valid := true;\r\n if Benchmark == BenchmarkFatAdd() || Benchmark == BenchmarkFatAddSlowly() {\r\n state := mkFatNatAddState();\r\n } else if Benchmark == BenchmarkRsaEncrypt() || Benchmark == BenchmarkRsaDecrypt() {\r\n if 100 < num_key_bits < 0x10000 {\r\n state := mkRsaState(num_key_bits);\r\n } else {\r\n valid := false;\r\n state := NopState();\r\n }\r\n } else if Benchmark == BenchmarkRsaKeyGen() {\r\n if 100 < num_key_bits < 0x10000 {\r\n calc {\r\n 0x10000;\r\n < { lemma_2toX32(); }\r\n power2(28);\r\n }\r\n state := RsaKeyGenState(num_key_bits);\r\n } else {\r\n valid := false;\r\n state := NopState();\r\n }\r\n } else if Benchmark == BenchmarkSha256() {\r\n valid,state := mkShaState(use_words, use_original, len_bits);\r\n }\r\n reveal_WellformedBenchmarkState();\r\n reveal_CorrectBenchmarkState();\r\n}\r\n\r\n\r\nmethod BenchmarkOp(Benchmark:int, state:BenchmarkState) returns (TestResult:seq,state':BenchmarkState)\r\n requires TPM_ready();\r\n requires WellformedBenchmarkState(state);\r\n requires CorrectBenchmarkState(state, Benchmark);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures WellformedBenchmarkState(state');\r\n ensures CorrectBenchmarkState(state', Benchmark);\r\n{\r\n state' := state;\r\n if (Benchmark == 0)\r\n {\r\n //- No-op benchmark.\r\n TestResult := [];\r\n state' := NopState();\r\n reveal_WellformedBenchmarkState();\r\n reveal_CorrectBenchmarkState();\r\n }\r\n else if (Benchmark == 2)\r\n {\r\n assert Benchmark == BenchmarkSha256();\r\n reveal_WellformedBenchmarkState();\r\n reveal_CorrectBenchmarkState();\r\n if (state.arr_is_words) {\r\n if (state.use_original) {\r\n var dummy_TestResult_array := SHA256_impl_Words_arrays_original(state.arr);\r\n } else {\r\n var dummy_TestResult_array := SHA256_impl_Words_arrays(state.arr);\r\n }\r\n } else {\r\n if (state.use_original) {\r\n var dummy_TestResult_array := SHA256_impl_Bytes_arrays_original(state.arr);\r\n } else {\r\n var dummy_TestResult_array := SHA256_impl_Bytes_arrays(state.arr);\r\n }\r\n }\r\n TestResult := [];\r\n }\r\n else if (Benchmark == 3)\r\n {\r\n assert Benchmark == BenchmarkRsaKeyGen();\r\n reveal_WellformedBenchmarkState();\r\n reveal_CorrectBenchmarkState();\r\n var dummy_keys := RSAKeyGen(state.num_key_bits);\r\n TestResult := [];\r\n }\r\n else if (Benchmark == 4)\r\n {\r\n assert Benchmark == BenchmarkRsaEncrypt();\r\n reveal_WellformedBenchmarkState();\r\n reveal_CorrectBenchmarkState();\r\n TestResult := Encrypt(state.keypair.pub, state.text);\r\n }\r\n else if (Benchmark == 5)\r\n {\r\n assert Benchmark == BenchmarkRsaDecrypt();\r\n reveal_WellformedBenchmarkState();\r\n reveal_CorrectBenchmarkState();\r\n var success;\r\n success, TestResult := Decrypt(state.keypair, state.text);\r\n }\r\n else if (Benchmark == 14)\r\n {\r\n assert Benchmark == BenchmarkFatAdd();\r\n reveal_WellformedBenchmarkState();\r\n reveal_CorrectBenchmarkState();\r\n var c := FatNatAdd_optimized(state.a, state.b);\r\n TestResult := [];\r\n //-state' := FatNatAddState(state.a, c);\r\n state' := FatNatAddState(state.a, state.b);\r\n //-state' := FatNatAddState(c, c);\r\n reveal_WellformedBenchmarkState();\r\n }\r\n else if (Benchmark == 15) \r\n {\r\n assert Benchmark == BenchmarkFatAddSlowly();\r\n reveal_WellformedBenchmarkState();\r\n reveal_CorrectBenchmarkState();\r\n var a_ref := state.a;\r\n var b_ref := state.b;\r\n var c := FatNatAdd(state.a, state.b);\r\n TestResult := [];\r\n //-state' := FatNatAddState(state.a, c);\r\n state' := FatNatAddState(state.a, state.b);\r\n //-state' := FatNatAddState(c, c);\r\n reveal_WellformedBenchmarkState();\r\n } \r\n else \r\n {\r\n TestResult := [];\r\n state' := NopState();\r\n reveal_WellformedBenchmarkState();\r\n reveal_CorrectBenchmarkState();\r\n }\r\n\r\n\r\n\r\n /*\r\n else if (Benchmark == BenchmarkSha1())\r\n {\r\n //-\r\n //- SHA1 Benchmark - Hash a block of bytes.\r\n //-\r\n CopyArraySimple(TestArray, TestInput);\r\n assert ti == TestInput[..];\r\n assert IsByteSeq(TestInput[..]);\r\n assert IsByteSeq(TestArray[..]);\r\n var dummy_TestResult_array := SHA1_impl_Bytes_arrays(TestArray);\r\n }\r\n else if (Benchmark == BenchmarkDuplicateArray())\r\n {\r\n CopyArraySimple(TestArray, TestInput);\r\n //-assert ti == TestInput[..];\r\n }\r\n else if (Benchmark == BenchmarkRsaKeyGen())\r\n {\r\n var TestKeyPair:RSAKeyPairImpl;\r\n\r\n //-\r\n //- RSA KeyGen Benchmark - Generate a public/private key pair.\r\n //-\r\n assert TestValue > 20; //- OBSERVE!\r\n assert TestValue < 0x10000; //- OBSERVE!\r\n calc\r\n {\r\n 0x10000;\r\n < { lemma_2toX32(); }\r\n power2(28);\r\n }\r\n\r\n debug_print(0x90, 0x09001000+TestValue);\r\n TestKeyPair := RSAKeyGen(TestValue);\r\n debug_print(0x90, 0x09002000);\r\n //- Save the keypair for future use.\r\n state' := BenchmarkState_c(KeyPairOptPresent(TestKeyPair));\r\n }\r\n else if (Benchmark == BenchmarkRsaEncrypt())\r\n {\r\n//- debug_print(0x90, 0x090e0001);\r\n if (state.kpo.KeyPairOptPresent?)\r\n {\r\n//- debug_print(0x90, 0x090e0002);\r\n var KeyPair := state.kpo.keypair;\r\n if (TestValue <= KeyPair.pub.size-12)\r\n {\r\n//- debug_print(0x90, 0x090e0003);\r\n //- RSA Encrypt with fake key.\r\n TestResult := Encrypt(KeyPair.pub, TestSeq);\r\n//- debug_print(0x90, 0x090e0004);\r\n }\r\n else\r\n {\r\n//- debug_print(0x90, 0x090e0040);\r\n//- debug_print(0x90, TestValue);\r\n//- debug_print(0x90, KeyPair.pub.size);\r\n//- debug_print(0x90, 0x090e004f);\r\n }\r\n//- debug_print(0x90, 0x090e0005);\r\n }\r\n//- debug_print(0x90, 0x090e0006);\r\n }\r\n else if (Benchmark == BenchmarkRsaDecrypt())\r\n {\r\n if (state.kpo.KeyPairOptPresent?)\r\n {\r\n var KeyPair := state.kpo.keypair;\r\n if (TestValue <= KeyPair.pub.size-12)\r\n {\r\n var result;\r\n if (|TestSeq|==0)\r\n {\r\n debug_print(0x90, 0xffff0001);\r\n }\r\n else\r\n {\r\n var divr := TestValue / 4;\r\n var mulr := divr * 4;\r\n var modr := TestValue - mulr;\r\n assert modr == TestValue % 4;\r\n if (modr==0)\r\n {\r\n assert TestValue%4==0;\r\n result,TestResult := Decrypt(KeyPair, TestSeq);\r\n }\r\n else\r\n {\r\n debug_print(0x90, 0xffff0002);\r\n }\r\n }\r\n }\r\n }\r\n }\r\n else if (Benchmark == BenchmarkTpmExtractRandom())\r\n {\r\n //-\r\n //- TPM benchmark - Extract random bytes from the TPM.\r\n //-\r\n lemma_2toX();\r\n TestResult := get_random(TestValue);\r\n }\r\n else if (Benchmark == BenchmarkByteSeqToWordSeq())\r\n {\r\n //-\r\n //- Benchmark ByteSeqToWordSeq method.\r\n //-\r\n ghost var TestPadding:seq;\r\n TestResult, TestPadding := BEByteSeqToWordSeq_impl(TestSeq);\r\n }\r\n else if (Benchmark == BenchmarkWordSeqToByteSeq())\r\n {\r\n //-\r\n //- Benchmark WordSeqToByteSeq method.\r\n //-\r\n lemma_2toX();\r\n TestResult := BEWordSeqToByteSeq_impl(TestSeq);\r\n }\r\n */\r\n}\r\n\r\n//-\r\n//- Time a particular benchmark for the given number of iterations.\r\n//-\r\nmethod {:timeLimitMultiplier 2} TimeIt(Benchmark:int, Iterations:int, state:BenchmarkState, dummy_array:array)\r\n returns (BeginHigh:int, BeginLow:int, EndHigh:int, EndLow:int, TestResult:seq, state':BenchmarkState)\r\n requires Word32(Iterations);\r\n requires dummy_array != null;\r\n requires TPM_ready();\r\n requires WellformedBenchmarkState(state);\r\n requires CorrectBenchmarkState(state, Benchmark);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures Word32(BeginHigh);\r\n ensures Word32(BeginLow);\r\n ensures Word32(EndHigh);\r\n ensures Word32(EndLow);\r\n ensures WellformedBenchmarkState(state');\r\n ensures CorrectBenchmarkState(state, Benchmark);\r\n{\r\n lemma_2toX();\r\n\r\n var a_ref := if state.FatNatAddState? then state.a else \r\n if state.ShaState? then state.arr else dummy_array; //- DafnyCC\r\n var b_ref := if state.FatNatAddState? then state.b else dummy_array; //- DafnyCC\r\n\r\n TestResult := [];\r\n\r\n var RemainingIterations:int := Iterations;\r\n state' := state;\r\n var a'_ref := if state'.FatNatAddState? then state'.a else dummy_array; //- DafnyCC\r\n var b'_ref := if state'.FatNatAddState? then state'.b else dummy_array; //- DafnyCC\r\n\r\n debug_print(0x90, 0x09000010);\r\n\r\n //-\r\n //- Take starting timestamp.\r\n //-\r\n BeginHigh, BeginLow := Asm_Rdtsc();\r\n\r\n //-//////////////\r\n calc {\r\n true;\r\n ==> { reveal_WellformedBenchmarkState(); }\r\n WellformedBenchmarkState(state'); \r\n }\r\n //-//////////////\r\n\r\n //-\r\n //- Repeatedly do the thing we're timing.\r\n //-\r\n while (RemainingIterations > 0)\r\n decreases RemainingIterations;\r\n invariant RemainingIterations >= 0;\r\n invariant TPM_ready();\r\n invariant WellformedBenchmarkState(state');\r\n invariant CorrectBenchmarkState(state', Benchmark);\r\n {\r\n var a'_ref := if state'.FatNatAddState? then state'.a else \r\n if state'.ShaState? then state'.arr else dummy_array; //- DafnyCC\r\n var b'_ref := if state'.FatNatAddState? then state'.b else dummy_array; //- DafnyCC\r\n\r\n TestResult, state' := BenchmarkOp(Benchmark, state');\r\n RemainingIterations := RemainingIterations - 1;\r\n }\r\n\r\n var a'2_ref := if state'.FatNatAddState? then state'.a else \r\n if state'.ShaState? then state'.arr else dummy_array; //- DafnyCC\r\n var b'2_ref := if state'.FatNatAddState? then state'.b else dummy_array; //- DafnyCC\r\n\r\n //-\r\n //- Take ending timestamp.\r\n //-\r\n EndHigh, EndLow := Asm_Rdtsc();\r\n\r\n //-//////////////\r\n calc {\r\n true;\r\n ==> { reveal_WellformedBenchmarkState(); }\r\n WellformedBenchmarkState(state'); \r\n }\r\n //-//////////////\r\n}\r\n\r\n//-\r\n//- Time a particular benchmark (that requires a RSA key) for the given number of iterations.\r\n//-\r\n//-method TimeItWithRSAKey(Benchmark:int, Iterations:int, TestValue:int, TestData:seq)\r\n//- returns (BeginHigh:int, BeginLow:int, EndHigh:int, EndLow:int, TestResult:seq)\r\n//- requires IsByte(Benchmark);\r\n//- requires Word16(Iterations);\r\n//- requires Word16(TestValue);\r\n//- requires IsByteSeq(TestData);\r\n//- requires TPM_ready();\r\n//- modifies this`TPM;\r\n//- modifies this`IoMemPerm;\r\n//- ensures TPM_ready();\r\n//- ensures Word32(BeginHigh);\r\n//- ensures Word32(BeginLow);\r\n//- ensures Word32(EndHigh);\r\n//- ensures Word32(EndLow);\r\n//-{\r\n//- lemma_2toX();\r\n//-\r\n//- var RemainingIterations := Iterations;\r\n//-\r\n//- //-\r\n//- //- Pre-benchmark prep work.\r\n//- //- Some of this is specific to particular benchmarks.\r\n//- //-\r\n//- var TestBlock:seq := [];\r\n//- var TestKeyPair:RSAKeyPairImpl;\r\n//- TestResult := [];\r\n//- var ActualValue := TestValue;\r\n//-\r\n//- var NeedRSASizedValue:bool := Benchmark == BenchmarkRsaEncrypt();\r\n//- if (NeedRSASizedValue && ActualValue > 245)\r\n//- {\r\n//- //- RSA request too big.\r\n//- debug_print(0x90, 0xde012210);\r\n//- ActualValue := 245;\r\n//- }\r\n//-\r\n//- TestBlock := RepeatDigit_impl(0x1c, ActualValue);\r\n//-\r\n//- //-\r\n//- //- Generate a 2048-bit public/private key pair.\r\n//- //-\r\n//- calc\r\n//- {\r\n//- 2048;\r\n//- < { lemma_2toX32(); } power2(29);\r\n//- }\r\n//- TestKeyPair := RSAKeyGen(2048);\r\n//- assert TestKeyPair.pub.size >= 2048 / 8;\r\n//-//- assert TestKeyPair.pub.size % 4 == 0;\r\n//- assert NeedRSASizedValue ==> |TestBlock| <= TestKeyPair.pub.size - 11;\r\n//-\r\n//- //-\r\n//- //- Take starting timestamp.\r\n//- //-\r\n//- BeginHigh, BeginLow := Asm_Rdtsc();\r\n//-\r\n//- //-\r\n//- //- Repeatedly do the thing we're timing.\r\n//- //-\r\n//- while (RemainingIterations > 0)\r\n//- decreases RemainingIterations;\r\n//- invariant RemainingIterations >= 0;\r\n//- invariant TPM_ready();\r\n//- invariant WellformedRSAKeyPairImpl(TestKeyPair);\r\n//- {\r\n//- if (Benchmark == BenchmarkRsaEncrypt())\r\n//- {\r\n//- TestResult := Encrypt(TestKeyPair.pub, TestBlock);\r\n//- }\r\n//- else if (Benchmark == BenchmarkRsaDecrypt())\r\n//- {\r\n//- var result;\r\n//- result,TestResult := Decrypt(TestKeyPair, TestBlock);\r\n//- }\r\n//- else if (Benchmark == BenchmarkRsaDigestedSign())\r\n//- {\r\n//- //- RSA Digested Sign.\r\n//- }\r\n//- else if (Benchmark == BenchmarkRsaDigestedVerify())\r\n//- {\r\n//- //- RSA Digested Verify.\r\n//- }\r\n//-\r\n//- RemainingIterations := RemainingIterations - 1;\r\n//- }\r\n//-\r\n//- //-\r\n//- //- Take ending timestamp.\r\n//- //-\r\n//- EndHigh, EndLow := Asm_Rdtsc();\r\n//-}\r\n\r\nmethod DebugPrintSequence(Offset:int, Data:seq)\r\n requires 0 <= Offset <= 160 - 16;\r\n requires IsByteSeq(Data);\r\n requires |Data| >= 0;\r\n{\r\n var Index:int := 0;\r\n\r\n while (Index < |Data|)\r\n decreases |Data| - Index;\r\n invariant Index >= 0;\r\n invariant Index <= |Data|;\r\n {\r\n debug_print(Offset, Data[Index]);\r\n Index := Index + 1;\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/BenchmarkService/BenchmarkList.i.dfy", "content": "//-\r\n//- List of benchmarks we support.\r\n//-\r\nstatic function method BenchmarkNothing():int { 0 }\r\nstatic function method BenchmarkSha1():int { 1 }\r\nstatic function method BenchmarkSha256():int { 2 }\r\nstatic function method BenchmarkRsaKeyGen():int { 3 }\r\nstatic function method BenchmarkRsaEncrypt():int { 4 }\r\nstatic function method BenchmarkRsaDecrypt():int { 5 }\r\nstatic function method BenchmarkRsaDigestedSign():int { 6 }\r\nstatic function method BenchmarkRsaDigestedVerify():int { 7 }\r\nstatic function method BenchmarkTpmExtractRandom():int { 8 }\r\nstatic function method BenchmarkByteSeqToWordSeq():int { 9 }\r\nstatic function method BenchmarkWordSeqToByteSeq():int { 10 }\r\nstatic function method BenchmarkSha1Raw():int { 11 }\r\nstatic function method BenchmarkSha256Raw():int { 12 }\r\nstatic function method BenchmarkDuplicateArray():int { 13 }\r\nstatic function method BenchmarkFatAdd():int { 14 }\r\nstatic function method BenchmarkFatAddSlowly():int { 15 }\r\nstatic function method BenchmarkMax():int { 16 }\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/BenchmarkService/Main.i.dfy", "content": "//-\r\ninclude \"../../Drivers/CPU/assembly_premium.i.dfy\"\r\ninclude \"../../Drivers/Network/Intel/driver.i.dfy\"\r\ninclude \"../../Libraries/Net/ethernet.i.dfy\"\r\ninclude \"../../Libraries/Net/IPv4.i.dfy\"\r\ninclude \"../../Libraries/Net/Udp.i.dfy\"\r\ninclude \"../../Libraries/Util/integer_sequences.i.dfy\"\r\ninclude \"../../Libraries/Util/word_bits.i.dfy\"\r\ninclude \"../../Libraries/Crypto/Hash/sha1.i.dfy\"\r\ninclude \"../../Libraries/Crypto/Hash/sha256.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSA.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSAOps.i.dfy\"\r\ninclude \"../../Libraries/Crypto/Rsa/RSA_Decrypt.i.dfy\"\r\ninclude \"BenchmarkList.i.dfy\"\r\ninclude \"BenchmarkCore.i.dfy\"\r\ninclude \"Protocol.i.dfy\"\r\ninclude \"../../Libraries/BigNum/BigNatTestLib.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSAPublicWrapper.i.dfy\"\r\n\r\n//-\r\n//- A wrapper utility for benchmarking various parts of the system.\r\n//-\r\n\r\n\r\n//-\r\n//- Main benchmark app entry point.\r\n//-\r\nmethod Main()\r\n returns (Result:int)\r\n ensures public(true);\r\n requires TPM_valid(TPM);\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n requires IoMemPerm.Null?;\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n{\r\n lemma_2toX();\r\n\r\n Result := 0;\r\n\r\n //-\r\n //- TPM initialization.\r\n //-\r\n establish_locality();\r\n\r\n //-\r\n //- Network initialization.\r\n //-\r\n var NetUp, net_state := init_network_card();\r\n\r\n if NetUp {\r\n lemma_2toX();\r\n debug_print(0x90, 0xded0d0d0);\r\n\r\n var Success:bool := true;\r\n var EtherSource:ethernet_addr;\r\n var IPSource:IPv4Address;\r\n var IPDest:IPv4Address;\r\n var SourcePort:int;\r\n var DestPort:int;\r\n var Request:seq;\r\n\r\n while (Success)\r\n invariant valid_network_state(net_state);\r\n invariant TPM_ready();\r\n {\r\n Success, net_state, EtherSource, IPSource, IPDest, SourcePort, DestPort, Request := UdpReceive(net_state);\r\n if (Success)\r\n {\r\n lemma_2toX();\r\n \r\n//- DebugPrintSequence(0x90, Request);\r\n debug_print(0x90, 0xdedadada);\r\n\r\n if (DestPort == 77)\r\n {\r\n //-\r\n //- Port 77 is \"any private remote job entry\" port.\r\n //- We use our own custom protocol to issue benchmark job requests.\r\n //-\r\n var Response;\r\n Response := RunBenchmark(Request);\r\n net_state := UdpSend(net_state, EtherSource, IPDest, IPSource, DestPort, SourcePort, Response);\r\n }\r\n\r\n if (DestPort == 7)\r\n {\r\n //-\r\n //- Port 7 is the Echo Service port.\r\n //- Echo the data received back to the sender.\r\n //-\r\n net_state := UdpSend(net_state, EtherSource, IPDest, IPSource, DestPort, SourcePort, Request);\r\n }\r\n\r\n }\r\n else\r\n {\r\n Result := 0xdeadbeef;\r\n debug_print(0x90, 0xdeadbeef);\r\n }\r\n }\r\n } else {\r\n Result := 0xdeaddead;\r\n debug_print(0x90, 0xdeaddead);\r\n }\r\n}\r\n\r\n//-\r\n//- Handle a benchmark request.\r\n//-\r\nmethod RunBenchmark(Input:seq)\r\n returns (Output:seq)\r\n requires IsByteSeq(Input);\r\n requires |Input| >= 0 && |Input| <= 1472;\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures IsByteSeq(Output);\r\n ensures |Output| <= 1472;\r\n{\r\n lemma_2toX();\r\n var dummy_array := new int[1];\r\n\r\n //-\r\n //- Decode input to extract benchmark to run, etc.\r\n //-\r\n var Error, Operation, Benchmark, Iterations, state := DecodeRequest(Input);\r\n\r\n var a_ref := if state.FatNatAddState? then state.a else \r\n if state.ShaState? then state.arr else dummy_array; //- DafnyCC\r\n var b_ref := if state.FatNatAddState? then state.b else dummy_array; //- DafnyCC\r\n\r\n if (Error != 0)\r\n {\r\n Output := EncodeErrorResponse(Error, Input);\r\n return;\r\n }\r\n if (Benchmark >= BenchmarkMax())\r\n {\r\n Output := EncodeErrorResponse(2, Input);\r\n return;\r\n }\r\n\r\n\r\n //-//////////////\r\n calc {\r\n true;\r\n ==> { reveal_WellformedBenchmarkState(); }\r\n WellformedBenchmarkState(state); \r\n }\r\n //-//////////////\r\n\r\n //-\r\n //- Time the desired benchmark in a loop.\r\n //-\r\n var BeginHigh, BeginLow, EndHigh, EndLow, TestResult, state';\r\n BeginHigh, BeginLow, EndHigh, EndLow, TestResult, state' := TimeIt(Benchmark, Iterations, state, dummy_array);\r\n\r\n //-\r\n //- Prepare results to send back to the client.\r\n //-\r\n Output := EncodeSuccessfulResponse(Input, BeginHigh, BeginLow, EndHigh, EndLow);\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/BenchmarkService/Protocol.i.dfy", "content": "include \"../../Libraries/Util/integer_sequences.i.dfy\"\r\ninclude \"../../Libraries/Util/word_bits.i.dfy\"\r\ninclude \"BenchmarkCore.i.dfy\"\r\n\r\n//-\r\n//- Methods related to the custom remote job entry protocol we use for running benchmarks.\r\n//-\r\n\r\n\r\n//-\r\n//- Decode a remote request to perform some benchmark tests.\r\n//-\r\n//- The Operation value is currently unused.\r\n//- The Benchmark value determines what benchmark we run.\r\n//- Iterations is the number of times to run the benchmark in a loop.\r\n//- TestValue and the TestData are benchmark-specific arguments.\r\n//-\r\n//- A non-zero Error value indicates a parsing failure.\r\n//-\r\nmethod DecodeRequest(Data:seq)\r\n returns (Error:int, Operation:int, Benchmark:int, Iterations:int, state:BenchmarkState)\r\n requires IsByteSeq(Data);\r\n requires TPM_ready();\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures IsByte(Error);\r\n ensures Error == 0 ==> |Data| >= 15;\r\n ensures Error == 0 ==> IsByte(Operation);\r\n ensures Error == 0 ==> IsByte(Benchmark);\r\n ensures Error == 0 ==> Word32(Iterations);\r\n ensures Error == 0 ==> WellformedBenchmarkState(state);\r\n ensures Error == 0 ==> CorrectBenchmarkState(state, Benchmark);\r\n ensures TPM_ready();\r\n{\r\n lemma_2toX();\r\n state := NopState();\r\n\r\n //-\r\n //- Initialize everything to keep DafnyCC happy.\r\n //-\r\n Error := 0;\r\n Operation := 0;\r\n Benchmark := 0;\r\n Iterations := 0;\r\n\r\n //-\r\n //- Our header is 15 bytes long.\r\n //-\r\n if (|Data| < 15)\r\n {\r\n Error := 1;\r\n return;\r\n }\r\n\r\n Benchmark := Data[0];\r\n Iterations := BEFourBytesToWord_impl(Data[1..5]);\r\n var key_bits := BEFourBytesToWord_impl(Data[5..9]);\r\n var len_bits := BEFourBytesToWord_impl(Data[9..13]);\r\n\r\n //-\r\n //- Next byte is which interface to use (> 0 = words, 0 = bytes)\r\n //-\r\n\r\n var use_words := false;\r\n if Data[13] > 0 {\r\n use_words := true;\r\n }\r\n\r\n //-\r\n //- Next byte is which code version to use (> 0 = old version, 0 = current)\r\n //-\r\n var use_original := false;\r\n if Data[14] > 0 {\r\n use_original := true;\r\n }\r\n\r\n var valid;\r\n valid, state := prepare_state(Benchmark, key_bits, use_words, use_original, len_bits);\r\n\r\n if !valid {\r\n Error := 5;\r\n return;\r\n }\r\n\r\n}\r\n\r\n//-\r\n//- Encode an error response to return to the client that sent us the request.\r\n//-\r\nmethod EncodeErrorResponse(Error:int, OriginalRequest:seq)\r\n returns (Data:seq)\r\n requires IsByte(Error);\r\n requires Error != 0;\r\n requires IsByteSeq(OriginalRequest);\r\n requires |OriginalRequest| <= 1472;\r\n ensures IsByteSeq(Data);\r\n ensures |Data| <= 1472;\r\n{\r\n lemma_2toX();\r\n\r\n //-\r\n //- On responses, first byte is the error code.\r\n //-\r\n Data := [Error];\r\n\r\n //-\r\n //- On *error* responses, any subsequent bytes are the same as in the original request.\r\n //- This is to help the sender determine what went wrong.\r\n //-\r\n if (|OriginalRequest| != 0)\r\n {\r\n Data := Data + OriginalRequest[1..];\r\n }\r\n}\r\n\r\n//-\r\n//- Encode the benchmark results to return to the client that sent us the request.\r\n//-\r\nmethod EncodeSuccessfulResponse(OriginalRequest:seq, BeginHigh:int, BeginLow:int, EndHigh:int, EndLow:int)\r\n returns (Data:seq)\r\n requires Word32(BeginHigh);\r\n requires Word32(BeginLow);\r\n requires Word32(EndHigh);\r\n requires Word32(EndLow);\r\n requires IsByteSeq(OriginalRequest);\r\n requires |OriginalRequest| >= 15;\r\n requires |OriginalRequest| <= 1472;\r\n ensures IsByteSeq(Data);\r\n ensures |Data| <= 1472;\r\n{\r\n //-\r\n //- Convert the four 32-bit words into four 4-byte sequences.\r\n //-\r\n var BeginHighSeq:seq := BEWordSeqToByteSeq_impl([BeginHigh]);\r\n var BeginLowSeq:seq := BEWordSeqToByteSeq_impl([BeginLow]);\r\n var EndHighSeq:seq := BEWordSeqToByteSeq_impl([EndHigh]);\r\n var EndLowSeq:seq := BEWordSeqToByteSeq_impl([EndLow]);\r\n\r\n //-\r\n //- On responses, first byte is the error code (zero indicates no error).\r\n //- Next 15 bytes are the request (for id purposes).\r\n //- The subsequent sixteen bytes are the begin and end timestamps.\r\n //-\r\n Data := [0]\r\n + OriginalRequest[..15]\r\n + BeginHighSeq\r\n + BeginLowSeq\r\n + EndHighSeq\r\n + EndLowSeq;\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/Common/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/Common/CommonState.i.dfy", "content": "include \"CommonState.s.dfy\"\r\ninclude \"../../Drivers/TPM/tpm-wrapper.i.dfy\"\r\ninclude \"../../Libraries/Util/Halter.i.dfy\"\r\ninclude \"../../Libraries/Util/DebugPrint.i.dfy\"\r\n\r\ninclude \"../../Libraries/Crypto/RSA/rfc4251impl.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSAPublicWrapper.i.dfy\"\r\n\r\ndatatype CommonStateImpl = CommonStateImplConstructor(sk:TPMSessionAndKey, key_pair:RSAKeyPairImpl, key_bits:nat)\r\n\r\nfunction {:autoReq} CommonStateImplToSpec (s:CommonStateImpl) : CommonState\r\n{\r\n CommonStateConstructor(KeyPairImplToSpec(s.key_pair), s.key_bits)\r\n}\r\n\r\nstatic lemma AModestKeyCanBeEncodedWithRFC4251(key_pair:RSAKeyPairSpec)\r\n requires key_pair.pub.e < power2(power2(31));\r\n requires key_pair.pub.n < power2(power2(31));\r\n ensures key_pair.pub.e < power2(power2(34));\r\n ensures key_pair.pub.n < power2(power2(34));\r\n ensures IsWordSeq([|STR_SSH_RSA()|]);\r\n ensures IsWordSeq([|rfc4251_positive_to_twoscomplement(BEIntToByteSeq(key_pair.pub.e))|]);\r\n ensures IsWordSeq([|rfc4251_positive_to_twoscomplement(BEIntToByteSeq(key_pair.pub.n))|]);\r\n ensures IsByteSeq(rfc4251_sshrsa_encoding(key_pair.pub.e,key_pair.pub.n));\r\n{\r\n reveal_power2();\r\n lemma_power2_increases(31, 34);\r\n lemma_power2_increases(power2(31), power2(34));\r\n lemma_rfc4251_sshrsa_encoding_premium(key_pair.pub.e, key_pair.pub.n);\r\n}\r\n\r\nstatic predicate KeyCanBeEncodedWithRFC4251(key_pair:RSAKeyPairSpec)\r\n requires key_pair.pub.e < power2(power2(31));\r\n requires key_pair.pub.n < power2(power2(31));\r\n ensures key_pair.pub.e < power2(power2(34));\r\n ensures key_pair.pub.n < power2(power2(34));\r\n ensures IsWordSeq([|STR_SSH_RSA()|]);\r\n ensures IsWordSeq([|rfc4251_positive_to_twoscomplement(BEIntToByteSeq(key_pair.pub.e))|]);\r\n ensures IsWordSeq([|rfc4251_positive_to_twoscomplement(BEIntToByteSeq(key_pair.pub.n))|]);\r\n ensures IsByteSeq(rfc4251_sshrsa_encoding(key_pair.pub.e,key_pair.pub.n));\r\n{\r\n AModestKeyCanBeEncodedWithRFC4251(key_pair);\r\n true\r\n}\r\n\r\npredicate CommonStateImplValid (s:CommonStateImpl)\r\n{\r\n TPMSessionAndKeyValid(s.sk)\r\n && WellformedRSAKeyPairImpl(s.key_pair)\r\n && ModestKeyValue(s.key_pair.pub.e)\r\n && ModestKeyValue(s.key_pair.pub.n)\r\n && KeyCanBeEncodedWithRFC4251(KeyPairImplToSpec(s.key_pair))\r\n}\r\n\r\nmethod ExtendPCRRepeatedly (s:seq>) returns (success:bool)\r\n requires forall i :: 0 <= i < |s| ==> IsByteSeqOfLen(s[i], 20);\r\n\r\n requires TPM_ready();\r\n\r\n ensures success ==> TPM.PCR_19 == old(TPM.PCR_19) + s;\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM)[PCR_19 := TPM.PCR_19]);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n{\r\n success := true;\r\n\r\n ghost var old_PCR_19 := TPM.PCR_19;\r\n var i:int := 0;\r\n while i < |s|\r\n invariant 0 <= i <= |s|;\r\n invariant TPM_ready();\r\n invariant TPMs_match(TPM, old(TPM)[PCR_19 := old_PCR_19 + s[..i]]);\r\n {\r\n success := extend_PCR(s[i]);\r\n if !success {\r\n return;\r\n }\r\n i := i + 1;\r\n }\r\n}\r\n\r\nmethod GenerateKeyPair (key_bits:nat) returns (success:bool, key_pair:RSAKeyPairImpl)\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n\r\n ensures success ==> WellformedRSAKeyPairImpl(key_pair)\r\n && RSAKeyGenerationValid(key_bits, KeyPairImplToSpec(key_pair), TPM_random_bytes(old(TPM).random_index, TPM.random_index))\r\n && key_pair.pub.size >= key_bits / 8\r\n && ModestKeyValue(key_pair.pub.e)\r\n && ModestKeyValue(key_pair.pub.n);\r\n\r\n ensures TPM_ready();\r\n ensures TPMs_match_except_for_randoms(TPM, old(TPM));\r\n{\r\n success := false;\r\n\r\n if (key_bits <= 20 || key_bits >= 0x10000000) {\r\n key_pair := GenDummyKey(); //- dafnycc: initialize variable\r\n return;\r\n }\r\n calc {\r\n key_bits;\r\n < 0x10000000;\r\n == { lemma_2toX(); lemma_power2_add8(24); }\r\n power2(28);\r\n }\r\n\r\n key_pair := RSAKeyGen(key_bits);\r\n var modest_e := IsModestKeyValue(key_pair.pub.e);\r\n var modest_n := IsModestKeyValue(key_pair.pub.n);\r\n\r\n if !modest_e || !modest_n {\r\n return;\r\n }\r\n\r\n success := true;\r\n}\r\n\r\nstatic predicate KeyCanBeExtendedIntoPCR(key_pair:RSAKeyPairSpec)\r\n{\r\n key_pair.pub.e < power2(power2(31)) &&\r\n key_pair.pub.n < power2(power2(31)) &&\r\n KeyCanBeEncodedWithRFC4251(key_pair) &&\r\n var public_key_encoding := rfc4251_sshrsa_encoding(key_pair.pub.e, key_pair.pub.n);\r\n IsByteSeq(public_key_encoding) &&\r\n var public_key_encoding_bits := BEByteSeqToBitSeq(public_key_encoding);\r\n IsBitSeq(public_key_encoding_bits) &&\r\n |public_key_encoding_bits| < power2(64)\r\n}\r\n\r\nmethod ExtendCommonStateKeyIntoPCR19 (key_bits:nat, state:CommonStateImpl, ghost TPM_before_keygen:TPM_struct)\r\n requires TPM_ready();\r\n requires CommonStateImplValid(state);\r\n requires WellformedRSAKeyPairImpl(state.key_pair);\r\n requires state.key_bits == key_bits;\r\n requires RSAKeyGenerationValid(key_bits, KeyPairImplToSpec(state.key_pair),\r\n TPM_random_bytes(TPM_before_keygen.random_index, TPM.random_index));\r\n requires state.key_pair.pub.size >= key_bits / 8;\r\n requires ModestKeyValue(state.key_pair.pub.e);\r\n requires ModestKeyValue(state.key_pair.pub.n);\r\n requires TPMs_match(TPM, TPM_before_keygen[random_index := TPM.random_index]);\r\n\r\n ensures KeyCanBeExtendedIntoPCR(CommonStateImplToSpec(state).key_pair);\r\n ensures TPM_ready();\r\n ensures CommonStateGeneratedCorrectly(key_bits, CommonStateImplToSpec(state), TPM_before_keygen, TPM);\r\n ensures TPMs_match(TPM, TPM_before_keygen[random_index := TPM.random_index][PCR_19 := TPM.PCR_19]);\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n{\r\n var encoded_public_key := rfc4251_encode_sshrsa_pubkey(state.key_pair.pub);\r\n if |encoded_public_key| >= 0x20000000 {\r\n HaltMachine(0x31);\r\n }\r\n\r\n debug_print(0x90, 0x89280003);\r\n\r\n calc {\r\n |encoded_public_key|*8;\r\n < 0x20000000 * 8;\r\n == 0x100000000;\r\n == { lemma_2toX32(); } power2(32);\r\n }\r\n lemma_power2_strictly_increases(32, 64);\r\n\r\n var public_key_hash_words := SHA1_impl_Bytes(encoded_public_key);\r\n var public_key_hash_bytes := BEWordSeqToByteSeq_impl(public_key_hash_words);\r\n\r\n var success := extend_PCR(public_key_hash_bytes);\r\n if !success {\r\n HaltMachine(0x32);\r\n }\r\n}\r\n\r\nmethod GenerateCommonState (key_bits:nat) returns (state:CommonStateImpl)\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n\r\n ensures TPM_ready() &&\r\n CommonStateImplValid(state) &&\r\n KeyCanBeExtendedIntoPCR(CommonStateImplToSpec(state).key_pair) &&\r\n CommonStateGeneratedCorrectly(key_bits, CommonStateImplToSpec(state), old(TPM), TPM);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPMs_match_except_for_randoms(TPM, old(TPM)[PCR_19 := TPM.PCR_19]);\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n{\r\n ghost var old_TPM := TPM;\r\n\r\n establish_locality();\r\n\r\n debug_print(0x90, 0x89280000);\r\n\r\n var success, sk := establish_TPM_session_and_key();\r\n if !success {\r\n HaltMachine(0x2F);\r\n }\r\n\r\n debug_print(0x90, 0x89280001);\r\n\r\n//- swap comments to enable baked key\r\n var key_pair;\r\n success, key_pair := GenerateKeyPair(key_bits);\r\n//- key_pair := GetBakedKey(key_bits);\r\n//- success := true;\r\n\r\n debug_print(0x90, 0x89280002);\r\n\r\n if !success {\r\n HaltMachine(0x30);\r\n }\r\n\r\n assert WellformedRSAKeyPairImpl(key_pair);\r\n assert RSAKeyGenerationValid(key_bits, KeyPairImplToSpec(key_pair), TPM_random_bytes(old_TPM.random_index, TPM.random_index));\r\n\r\n state := CommonStateImplConstructor(sk, key_pair, key_bits);\r\n\r\n ExtendCommonStateKeyIntoPCR19(key_bits, state, old_TPM);\r\n}\r\n\r\nmethod HandleGetQuoteRequest (common_state_in:CommonStateImpl, nonce_external:seq)\r\n returns (common_state_out:CommonStateImpl, encoded_public_key:seq, pcr_info_bytes:seq,\r\n sig_bytes:seq)\r\n requires IsByteSeqOfLen(nonce_external, 20);\r\n requires CommonStateImplValid(common_state_in);\r\n ensures HandleGetQuoteRequestValid(CommonStateImplToSpec(common_state_in), old(TPM), TPM, nonce_external,\r\n encoded_public_key, pcr_info_bytes, sig_bytes);\r\n\r\n requires TPM_ready();\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM));\r\n\r\n ensures CommonStateImplValid(common_state_out);\r\n ensures common_state_out == common_state_in[sk := common_state_out.sk];\r\n ensures IsByteSeq(encoded_public_key);\r\n ensures IsByteSeq(pcr_info_bytes);\r\n ensures IsByteSeq(sig_bytes);\r\n ensures Word32(|encoded_public_key|);\r\n ensures Word32(|pcr_info_bytes|);\r\n ensures Word32(|sig_bytes|);\r\n{\r\n ghost var old_TPM := TPM;\r\n\r\n lemma_2toX();\r\n reveal_power2();\r\n\r\n encoded_public_key := rfc4251_encode_sshrsa_pubkey(common_state_in.key_pair.pub);\r\n var success:bool;\r\n var new_sk:TPMSessionAndKey;\r\n success, new_sk, pcr_info_bytes, sig_bytes := quote(common_state_in.sk, nonce_external);\r\n if !success {\r\n HaltMachine(0x51);\r\n }\r\n if |encoded_public_key| > 0xFFFFFFFF {\r\n HaltMachine(0x52);\r\n }\r\n if |pcr_info_bytes| > 0xFFFFFFFF {\r\n HaltMachine(0x53);\r\n }\r\n if |sig_bytes| > 0xFFFFFFFF {\r\n HaltMachine(0x54);\r\n }\r\n common_state_out := common_state_in[sk := new_sk];\r\n assert 0xFFFFFFFF < power2(32);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/Common/CommonState.s.dfy", "content": "include \"../../Libraries/Crypto/RSA/RSASpec.s.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/rfc4251.s.dfy\"\r\ninclude \"../../Libraries/Crypto/Hash/sha1.s.dfy\"\r\ninclude \"../../Libraries/Util/integer_sequences.s.dfy\"\r\ninclude \"../../Libraries/Util/be_sequences.s.dfy\"\r\ninclude \"../../Libraries/Math/power2.s.dfy\"\r\ninclude \"../../Drivers/TPM/tpm-device.s.dfy\"\r\n\r\ndatatype CommonState = CommonStateConstructor(key_pair:RSAKeyPairSpec, key_bits:nat)\r\n\r\ndatatype CommonStateMachine = CommonStateMachine_ctor(initialized:bool, common_state:CommonState, TPM:TPM_struct)\r\n\r\nghost var {:readonly} current_common_state:CommonStateMachine;\r\n\r\nstatic predicate {:autoReq} PCR19ReflectsKey (state:CommonState, before_TPM:TPM_struct, after_TPM:TPM_struct)\r\n{\r\n var encoded_public_key := rfc4251_sshrsa_encoding(state.key_pair.pub.e, state.key_pair.pub.n);\r\n after_TPM.PCR_19 == before_TPM.PCR_19 + [BEWordSeqToByteSeq(SHA1(BEByteSeqToBitSeq(encoded_public_key)))]\r\n}\r\n\r\nstatic predicate {:autoReq} CommonStateGeneratedCorrectly (key_bits:nat, state:CommonState, before_TPM:TPM_struct, after_TPM:TPM_struct)\r\n{\r\n state.key_bits == key_bits\r\n && RSAKeyGenerationValid(state.key_bits, state.key_pair, TPM_random_bytes(before_TPM.random_index, after_TPM.random_index))\r\n && Locality3_obtained()\r\n && TPM_valid(after_TPM)\r\n && TPM_satisfies_integrity_policy(after_TPM)\r\n && PCR19ReflectsKey(state, before_TPM, after_TPM)\r\n && TPMs_match(after_TPM, before_TPM[random_index := after_TPM.random_index][PCR_19 := after_TPM.PCR_19])\r\n}\r\n\r\n//- This function is used to ensure that the routine to get a quote operates correctly.\r\n//- It should output the public key and quote.\r\n\r\nstatic predicate {:autoReq} HandleGetQuoteRequestValid (state:CommonState, old_TPM:TPM_struct, new_TPM:TPM_struct,\r\n nonce_external_in:seq, encoded_public_key_out:seq,\r\n pcr_info_bytes_out:seq, sig_bytes_out:seq)\r\n{\r\n TPMs_match(new_TPM, old_TPM)\r\n && encoded_public_key_out == rfc4251_sshrsa_encoding(state.key_pair.pub.e, state.key_pair.pub.n)\r\n && Verve_quote(pcr_info_bytes_out, sig_bytes_out, nonce_external_in, old_TPM.PCR_19)\r\n}\r\n\r\nghost method {:axiom} {:autoReq} InitializeCommonStateMachine(common_state:CommonState)\r\n requires !current_common_state.initialized;\r\n requires CommonStateGeneratedCorrectly(1024, common_state, current_common_state.TPM, TPM);\r\n ensures current_common_state == CommonStateMachine_ctor(true, common_state, TPM);\r\n modifies this`current_common_state;\r\n\r\nghost method {:axiom} {:autoReq} AdvanceCommonStateMachineViaGetQuote\r\n (nonce_external_in:seq, encoded_public_key_out:seq, pcr_info_bytes_out:seq, sig_bytes_out:seq)\r\n returns (declassified_encoded_public_key_out:seq, declassified_pcr_info_bytes_out:seq, declassified_sig_bytes_out:seq)\r\n requires current_common_state.initialized;\r\n requires public(nonce_external_in);\r\n requires HandleGetQuoteRequestValid(current_common_state.common_state, current_common_state.TPM, TPM, nonce_external_in,\r\n encoded_public_key_out, pcr_info_bytes_out, sig_bytes_out);\r\n modifies this`current_common_state;\r\n ensures current_common_state == old(current_common_state)[TPM := TPM];\r\n ensures IsByteSeqOfLen(declassified_encoded_public_key_out, |encoded_public_key_out|);\r\n ensures public(|encoded_public_key_out|);\r\n ensures relation(forall i :: left(i) == right(i) && 0 <= left(i) < left(|declassified_encoded_public_key_out|) ==>\r\n declassified(left(declassified_encoded_public_key_out[i]), right(declassified_encoded_public_key_out[i]),\r\n left(encoded_public_key_out[i]), right(encoded_public_key_out[i])));\r\n ensures IsByteSeqOfLen(declassified_pcr_info_bytes_out, |pcr_info_bytes_out|);\r\n ensures public(|pcr_info_bytes_out|);\r\n ensures relation(forall i :: left(i) == right(i) && 0 <= left(i) < left(|declassified_pcr_info_bytes_out|) ==>\r\n declassified(left(declassified_pcr_info_bytes_out[i]), right(declassified_pcr_info_bytes_out[i]),\r\n left(pcr_info_bytes_out[i]), right(pcr_info_bytes_out[i])));\r\n ensures public(|sig_bytes_out|);\r\n ensures IsByteSeqOfLen(declassified_sig_bytes_out, |sig_bytes_out|);\r\n ensures relation(forall i :: left(i) == right(i) && 0 <= left(i) < left(|declassified_sig_bytes_out|) ==>\r\n declassified(left(declassified_sig_bytes_out[i]), right(declassified_sig_bytes_out[i]),\r\n left(sig_bytes_out[i]), right(sig_bytes_out[i])));\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DafnyCCTest/Main.i.dfy", "content": "//-\r\n//-\r\n//-\r\n//-\r\n//-\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Overflow;\r\n//-private-import Util;\r\n//-private-import Stacks;\r\n//-private-import Partition;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import IntLemmasBase;\r\n//-private-import IntLemmasGc;\r\n//-private-import SimpleGcMemory;\r\n//-private-import SimpleCommon;\r\n//-private-import SimpleCollector;\r\n//-private-import IoMain;\r\n//-private-import IntLemmasMain;\r\n//-private-basmonly-import Trusted;\r\n//-private-basmonly-import Checked;\r\n//-private-import Heap;\r\n//-private-import Seq;\r\n//-private-import dafny_DafnyPrelude;\r\n//-private-import DafnyAssembly;\r\n//-private-import dafny_relational_s;\r\n//-private-import dafny_base_s;\r\n//-private-import dafny_power2_s;\r\n//-private-import dafny_mul_i;\r\n//-private-import dafny_assembly_i;\r\n//-private-import dafny_bit_vector_lemmas_i;\r\n//-private-import dafny_Main_i;\r\n//-\r\n//-\r\n//-\r\n\r\ninclude \"../../../Dafny/Libraries/Util/relational.s.dfy\"\r\ninclude \"../../../Dafny/Libraries/Math/power2.s.dfy\"\r\ninclude \"../../../Dafny/Libraries/Math/mul.i.dfy\"\r\ninclude \"../../../Dafny/Drivers/CPU/assembly.i.dfy\"\r\ninclude \"../../../Dafny/Libraries/Math/bit_vector_lemmas.i.dfy\"\r\n\r\n/*\r\nfunction True(x:int) : bool \r\n{\r\n true\r\n}\r\n\r\n\r\nmethod rel1(x:int, y:int) returns(z:int)\r\n requires relation(left(x) == right(x));\r\n requires relation(True(left(x)) == True(right(x))); \r\n requires public(y); //- Equivalent to: relation(left(y) == right(y));\r\n ensures relation(left(z) == right(z));\r\n{\r\n z := x + y;\r\n}\r\n\r\nmethod rel2(x:int, y:int) returns(z:int)\r\n requires relation(left(x) == right(x));\r\n ensures relation(left(z) == right(z));\r\n{\r\n z := 0;\r\n//- z := rel1(x, y); //- should fail symdiff checking if uncommented\r\n z := rel1(x, x);\r\n//- if (y > 1) //- should fail symdiff checking if uncommented\r\n if (x > 1)\r\n {\r\n z := 1;\r\n }\r\n}\r\n\r\nmethod rel3(x:int, y:int) returns(z:int, w:int)\r\n requires relation(left(x) == right(x));\r\n ensures relation(left(z) == right(z));\r\n{\r\n z := 0;\r\n w := 0;\r\n//- while (z < y) //- should fail symdiff checking if uncommented\r\n while (z < x)\r\n invariant relation(left(x) == right(x));\r\n invariant relation(left(z) == right(z));\r\n invariant public(w);\r\n {\r\n//- z := z + y; //- should fail symdiff checking if uncommented\r\n z := z + y + 1 - y;\r\n }\r\n z := 5;\r\n}\r\n\r\nmethod rel4(x:int, y:int, s:int) returns(z:int)\r\n requires public(x);\r\n requires public(y);\r\n ensures public(z);\r\n{\r\n z := rel1(x, y);\r\n z := rel1(z, y);\r\n z := rel1(x, z);\r\n z := rel1(z, z);\r\n//- z := rel1(z, s); //- should fail symdiff checking if uncommented\r\n z := rel1(z, z);\r\n}\r\n\r\nmethod rel5(n:int) returns(s:seq)\r\n requires public(n);\r\n ensures public(s);\r\n{\r\n var i:int := 0;\r\n s := [];\r\n while (i < n)\r\n invariant public(i);\r\n invariant public(n);\r\n invariant public(s);\r\n {\r\n s := [i] + s;\r\n }\r\n}\r\n\r\ndatatype D = D(d:int);\r\nmethod rel6(D:D) returns(d:int)\r\n requires public(D);\r\n ensures public(D.d);\r\n ensures public(d);\r\n{\r\n d := D.d;\r\n}\r\n\r\nmethod relQ(x:seq) returns(y:seq)\r\n requires relation(left(|x|) == right(|x|));\r\n requires relation(forall i :: 0 <= i < |left(x)| ==> left(x[i]) == right(x[i]));\r\n ensures relation(|left(y)| == |right(y)|);\r\n ensures relation(forall i :: 0 <= i < right(|y|) ==> left(y)[i] == right(y)[i]);\r\n{\r\n y := x;\r\n}\r\n\r\n/* Example below behaves as expected in SymDiff\r\n Commented out, since the bodyless gen_secret causes compilation to fail.\r\n \r\nmethod gen_secret() returns (s:int)\r\nmethod rel4(x:int) returns(z:int)\r\n requires public(x);\r\n ensures public(z);\r\n{\r\n var secret := gen_secret();\r\n //-z := x + secret; //- Causes the ensures to fail\r\n z := x + secret + 1 - secret;\r\n}\r\n*/\r\n\r\nmethod rel5(s:seq) returns (i:int)\r\n requires |s| == 1; \r\n requires public(s);\r\n ensures public(i);\r\n{\r\n i := s[0]; \r\n}\r\n\r\nmethod rel6(s:seq) returns (s_new:seq)\r\n requires |s| == 10;\r\n requires public(s);\r\n ensures public(s_new);\r\n{\r\n s_new := s[0..5];\r\n}\r\n\r\nmethod rel7(s:seq, x:int) returns (t:seq)\r\n requires public(s);\r\n requires public(x);\r\n ensures public(t);\r\n{\r\n t := s + [x];\r\n}\r\n\r\nmethod clone_array(a:array) returns(b:array)\r\n ensures b != a;\r\n ensures a.Length == b.Length;\r\n ensures (forall i::0 <= i < a.Length ==> b[i] == a[i]);\r\n ensures fresh(b);\r\n{\r\n b := new int[a.Length];\r\n var k := 0;\r\n var n := a.Length;\r\n while (k < n)\r\n invariant 0 <= k <= a.Length;\r\n invariant a.Length == b.Length == n;\r\n invariant (forall i::0 <= i < k ==> b[i] == a[i]);\r\n invariant fresh(b);\r\n {\r\n b[k] := a[k];\r\n k := k + 1;\r\n }\r\n}\r\n\r\n/*\r\nmethod test_modifies1(a:array)\r\n requires a.Length > 0;\r\n modifies a;\r\n ensures a[0] == 10;\r\n{\r\n a[0] := 10;\r\n}\r\n\r\nmethod test_modifies2(a:array, b:array)\r\n requires a != null;\r\n requires a.Length > 0;\r\n requires b.Length > 0;\r\n requires b[0] == 20;\r\n requires a != b;\r\n modifies a;\r\n ensures a[0] == 10;\r\n ensures b[0] == 20;\r\n{\r\n var k:int := 0;\r\n test_modifies1(a);\r\n while(k < 10)\r\n invariant a[0] == 10;\r\n {\r\n test_modifies1(a);\r\n k := k + 1;\r\n }\r\n assert a[0] == 10;\r\n assert b[0] == 20;\r\n}\r\n\r\n\r\nmethod test_seq()\r\n{\r\n//- assert [10,20] + [30] == [10,20,30];\r\n//- assert [10,20,30][1..] == [20,30];\r\n//- assert [10,20,30][1] == 20;\r\n//- assert [10,20,30][..1] == [10];\r\n//- assert [10,20,30][1:=40] == [10,40,30];\r\n var x := [10,20] + [30,40];\r\n//- var n := |x|;\r\n//- assert n == 4;\r\n//- x := x[1..3];\r\n//- assert x == [20,30];\r\n var n := x[2];\r\n assert n == 30;\r\n}\r\n\r\n\r\n\r\nmethod testNat(x:nat) returns(y:nat)\r\n{\r\n y := 0;\r\n while (y < 100)\r\n {\r\n y := y + 1 + x;\r\n }\r\n assert power2(100) > 0;\r\n}\r\n\r\ndatatype List = Nil() | Cons(hd:A, tl:List);\r\n\r\ndatatype DT = DT1(x1:int, y1:int) | DT2(x2:int, a2:List, y2:int, b2:DT, z2:int);\r\n\r\nfunction len(l:List):int\r\n ensures len(l) >= 0;\r\n{\r\n if l.Cons? then 1 + len(l.tl) else 0\r\n}\r\n\r\nghost method Length(l:List) returns(n:int)\r\n ensures n == len(l);\r\n{\r\n if (l.Cons?)\r\n {\r\n var m:int := Length(l.tl);\r\n n := 1 + m;\r\n }\r\n else\r\n {\r\n n := 0;\r\n }\r\n}\r\n\r\nghost method TestLength()\r\n{\r\n var n:int;\r\n n := Length(Cons(10, Cons(20, Nil())));\r\n assert unroll(1) && unroll(2);\r\n assert n == 2;\r\n}\r\n\r\nmethod GetLength(l:List) returns(n:int)\r\n ensures n == len(l);\r\n{\r\n n := 0;\r\n var iter := l;\r\n while (iter.Cons?)\r\n decreases len(iter);\r\n invariant n + len(iter) == len(l);\r\n {\r\n iter := iter.tl;\r\n n := n + 1;\r\n }\r\n}\r\n\r\nmethod TestGetLength()\r\n{\r\n var n:int;\r\n n := GetLength(Cons(10, Cons(20, Nil())));\r\n assert unroll(1) && unroll(2);\r\n assert n == 2;\r\n}\r\n\r\nfunction method id(a:A):A { a }\r\n\r\nmethod Foo(i:int, j:int) returns(k:int)\r\n requires i >= 5 && j >= 6;\r\n ensures k == id(i) + j;\r\n{\r\n TestLength();\r\n k := i + id(j);\r\n}\r\n\r\nmethod Bar() returns(k:int)\r\n ensures k == 15;\r\n{\r\n k := Foo(7, 8);\r\n}\r\n\r\nmethod A(x:List) returns(y:List)\r\n ensures x == y;\r\n{\r\n var i:int := 0;\r\n var z:List;\r\n z := x;\r\n y := z;\r\n while (i < 10)\r\n invariant y == x;\r\n {\r\n Skip();\r\n i := i + 1;\r\n }\r\n}\r\n\r\nmethod Skip()\r\n{\r\n}\r\n\r\nmethod B(x:List) returns(y:List)\r\n ensures x == y;\r\n{\r\n var i:int := 0;\r\n var z:List;\r\n z := x;\r\n while (i < 10)\r\n invariant z == x;\r\n {\r\n Skip();\r\n z := A(z);\r\n Skip();\r\n i := i + 1;\r\n }\r\n y := z;\r\n}\r\n\r\nmethod TestAlloc(x:List) returns(y:List)\r\n ensures y.tl.hd == 20;\r\n ensures y == Cons(10, Cons(20, Nil()));\r\n ensures y.Cons?;\r\n{\r\n y := B(Cons(10, Cons(20, Nil())));\r\n var b:bool := y.Nil?;\r\n assert y.hd == 10;\r\n assert y.tl.hd == 20;\r\n var i:int := y.hd;\r\n var j:int := y.tl.hd;\r\n assert !b;\r\n assert i == 10;\r\n assert j == 20;\r\n var d:DT := DT2(100, x, 200, DT1(1000, 2000), 300);\r\n assert d.DT2?;\r\n b := d.DT2?;\r\n assert b;\r\n assert d.b2.y1 == 2000;\r\n i := d.b2.y1;\r\n assert i == 2000;\r\n}\r\n*/\r\n\r\n*/\r\n\r\n//- From Dafny sample files\r\nmethod Cube(N: int) returns (c: int)\r\n requires 0 <= N;\r\n ensures c == N*N*N;\r\n{\r\n c := 0;\r\n var n := 0;\r\n var k := 1;\r\n var m := 6;\r\n while (n < N)\r\n invariant n <= N;\r\n invariant c == n*n*n;\r\n invariant k == 3*n*n + 3*n + 1;\r\n invariant m == 6*n + 6;\r\n {\r\n calc\r\n {\r\n 3 * (n + 1) * (n + 1) + 3 * (n + 1) + 1;\r\n (3 * n + 3) * (n + 1) + 3 * n + 4;\r\n { lemma_mul_is_distributive_forall(); }\r\n (3 * n + 3) * n + (3 * n + 3) * 1 + 3 * n + 4;\r\n { lemma_mul_is_distributive_forall(); }\r\n 3 * n * n + 3 * n + 3 * n + 3 + 3 * n + 4;\r\n k + m;\r\n }\r\n calc\r\n {\r\n (n + 1) * (n + 1) * (n + 1);\r\n { lemma_mul_is_distributive_forall(); }\r\n ((n + 1) * n + (n + 1) * 1) * (n + 1);\r\n { lemma_mul_is_distributive_forall(); }\r\n ((n * n + 1 * n) + (n * 1 + 1 * 1)) * (n + 1);\r\n (n * n + 2 * n + 1) * (n + 1);\r\n { lemma_mul_is_distributive_forall(); }\r\n (n * n + 2 * n + 1) * n + (n * n + 2 * n + 1) * 1;\r\n { lemma_mul_is_distributive_forall(); }\r\n n * n * n + 2 * n * n + 1 * n + n * n + 2 * n + 1;\r\n n * n * n + ((2 * n * n + 1 * n * n) + (1 * n + 2 * n) + 1);\r\n { lemma_mul_is_distributive_forall(); }\r\n n * n * n + ((2 + 1) * n * n + (1 + 2) * n + 1);\r\n c + k;\r\n }\r\n c := c + k;\r\n k := k + m;\r\n m := m + 6;\r\n n := n + 1;\r\n }\r\n return;\r\n}\r\n\r\nmethod Main() returns (result:int)\r\n{\r\n //-lemma_xor_bytes(0, 0);\r\n result := Cube(5);\r\n}\r\n/*\r\nfunction method{:axiom}{:imported} word_32(x:int):bool\r\nfunction method{:axiom}{:imported} and (x:int, y:int):int\r\nfunction method{:axiom}{:imported} or (x:int, y:int):int\r\nfunction method{:axiom}{:imported} xor (x:int, y:int):int\r\n\r\n/*\r\n//- mutural summay ensures that M_1[r_1] == M_2[r_2]\r\n//- ghost method Sample (M:map) returns (r:int)\r\n//- requires (forall x:int, y:int :: x in M && y in M ==> M[x] == M[y] ==> x == y);\r\nmethod{:axiom}{:imported} serialPortOut (x:int)\r\nmethod{:axiom}{:imported} serialPortIn () returns (r:int)\r\n ensures (word_32(r));\r\nmethod{:axiom}{:imported} sample (ghost M:map) returns (r:int)\r\n\r\nghost method{:axiom}{:imported} SampleLemma(p:int, M:map)\r\n ensures (forall x:int :: x in M ==> M[x] == xor(x,p));\r\n*/\r\n\r\nghost method{:axiom}{:imported} XorLemmas()\r\n ensures (forall x:int::xor(x, x) == 0);\r\n ensures (forall x:int::word_32(x) ==> xor(x, 0) == x);\r\n ensures (forall x:int, y:int::xor(x, y) == xor(y, x));\r\n ensures (forall x:int, y:int:: word_32(x) && word_32(y) ==> word_32(xor(x, y)));\r\n ensures (forall x:int, y:int, z:int:: xor(x, xor(y,z)) == xor(y, xor(x,z)));\r\n ensures (forall x:int, y:int:: xor(x,xor(y,x)) == y);\r\n\r\nmethod XorIdentity(a:int) returns(r:int)\r\n requires word_32(a);\r\n ensures r == a;\r\n{\r\n XorLemmas();\r\n lemma_word32(a);\r\n r := xor(xor(a, a), a);\r\n var z := asm_BitwiseXor(a, a);\r\n}\r\n\r\n/*\r\nmethod pad_one_block (p:int) returns (r:int)\r\n requires word_32(p);\r\n//- ensures r == One_Time_Pad(p, old(sample_index));\r\n//- ensures (exists s:int :: sampleCall(old(index), index, s) && r == xor(p,s));\r\n//- relational verification should verify that true ==> r<1> == r<2>\r\n{\r\n XorLemmas();\r\n //- var i:int := 0;\r\n var k:int;\r\n ghost var M:map;\r\n SampleLemma(p, M);\r\n k := sample(M);\r\n r := xor(k,p);\r\n assert r == xor(k,p);\r\n //- return r;\r\n}\r\n\r\n\r\nmethod one_time_pad( ) returns ()\r\n modifies this;\r\n//- add requirement on maintaining the serial port queue later\r\n//- requires ps != null;\r\n//- requires forall i :: 0<= i < index ==> word_32(ps[i]);\r\n//- ensures rs != null;\r\n//- ensures ps.Length == rs.Length;\r\n//- ensures forall i :: 0<= i < index ==> rs[i] == xor (k, ps[i]);\r\n//- ensures forall i :: 0<= i < index ==> word_32(rs[i]);\r\n{\r\n //- read in a value (plain text) from serial port\r\n var length:int := 10;\r\n var index:int := 0;\r\n var p:int := 0;\r\n var r:int := 0;\r\n //-while (index < length) {\r\n p := serialPortIn();\r\n r := pad_one_block (p);\r\n //- write the xor(p,k) (encryption) to the serial port\r\n serialPortOut(r);\r\n index := index+1;\r\n //-}\r\n}\r\n*/\r\n\r\n/* encryption of multiple blocks. This function ensures that:\r\n 1. each block b is encrypted into xor(b,k), where k is the global key\r\n 2. each encrypted blocks are still words\r\n*/\r\n/*\r\nmethod Encrypt (ps: array, k:int) returns (rs: array)\r\n requires ps != null;\r\n requires forall i :: 0<= i < ps.Length ==> word_32(ps[i]);\r\n requires word_32(k);\r\n ensures rs != null;\r\n ensures ps.Length == rs.Length;\r\n ensures forall i :: 0<= i < ps.Length ==> rs[i] == xor (k, ps[i]);\r\n ensures forall i :: 0<= i < ps.Length ==> word_32(rs[i]);\r\n{\r\n var index:int := 0;\r\n rs := new int[ps.Length];\r\n\r\n while (index < ps.Length)\r\n invariant 0 <= index <= ps.Length;\r\n invariant forall i :: 0 <= i < index ==> rs[i] == xor(k, ps[i]);\r\n {\r\n if (index == ps.Length) {break;}\r\n rs := encrypt_nat(ps, k, index);\r\n index := index + 1;\r\n }\r\n}\r\n*/\r\n*/\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/Database.s.dfy", "content": "include \"../../Libraries/Util/be_sequences.s.dfy\"\r\ninclude \"Math.s.dfy\"\r\n\r\ndatatype Row = Row_ctor(nonce:seq, data:seq);\r\n\r\nstatic predicate RowValid(row:Row)\r\n{\r\n IsWordSeq(row.data)\r\n}\r\n\r\nstatic predicate DatabaseValid(db:seq)\r\n{\r\n forall i:int :: 0 <= i < |db| ==> RowValid(db[i])\r\n}\r\n\r\nstatic predicate DatabasesIdenticalExceptForOneRow (db1:seq, db2:seq, diff_row:int)\r\n{\r\n |db1| == |db2| &&\r\n (forall i :: 0 <= i < |db1| && i != diff_row ==> db1[i] == db2[i])\r\n}\r\n\r\nstatic predicate DatabasesSimilar (db1:seq, db2:seq)\r\n{\r\n exists diff_row :: DatabasesIdenticalExceptForOneRow(db1, db2, diff_row)\r\n}\r\n\r\nstatic predicate DatabaseContainsNonce (db:seq, nonce:seq)\r\n{\r\n exists i:int :: 0 <= i < |db| && db[i].nonce == nonce\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/DiffPriv.i.dfy", "content": "//-\r\n//- \r\ninclude \"../../Libraries/BigNum/BigRat.i.dfy\"\r\ninclude \"../../Libraries/Util/relational.s.dfy\"\r\ninclude \"../../Libraries/Util/arrays_and_seqs.i.dfy\"\r\ninclude \"../../Drivers/TPM/tpm-wrapper.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSA_Decrypt.i.dfy\"\r\ninclude \"DiffPriv.s.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\ninclude \"ErrorCodes.i.dfy\"\r\ninclude \"Noise.i.dfy\"\r\ninclude \"SumReducer.i.dfy\"\r\ninclude \"RelationalProperties.i.dfy\"\r\ninclude \"../Common/CommonState.i.dfy\"\r\n\r\nstatic function method{:CompiledSpec} CompiledSpec_Clip (value:int, min:int, max:int):int\r\n\r\n//-////////////////////////////////////////////\r\n//- DiffPrivStateImpl\r\n//-////////////////////////////////////////////\r\n\r\ndatatype DiffPrivStateImpl = DiffPrivStateImpl_ctor(db:seq, budget:BigRat, rows_received:int);\r\n\r\nstatic function DiffPrivStateImplToSpec(s:DiffPrivStateImpl) : DiffPrivState\r\n{\r\n DiffPrivState_ctor(s.db, if WellformedBigRat(s.budget) then RV(s.budget) else 0.0, s.rows_received)\r\n}\r\n\r\n//-////////////////////////////////////////////\r\n//- Query parameters\r\n//-////////////////////////////////////////////\r\n\r\nstatic method GetDiffPrivParametersFromQueryParameters (q:QueryParametersImpl) returns (p:DiffPrivParametersImpl)\r\n requires QueryParametersImplValid(q);\r\n requires QueryParametersValid(QueryParametersImplToSpec(q));\r\n ensures WellformedDiffPrivParameters(p);\r\n ensures DiffPrivParametersImplToSpec(p) == QueryParametersToDiffPrivParameters(QueryParametersImplToSpec(q));\r\n\r\n requires public(q);\r\n ensures public(p);\r\n{\r\n var alpha := BigRat_ctor(MakeSmallLiteralBigNum(q.alpha_num), MakeSmallLiteralBigNat(q.alpha_den));\r\n var beta := BigRat_ctor(MakeSmallLiteralBigNum(q.beta_num), MakeSmallLiteralBigNat(q.beta_den));\r\n var delta := DivideRoundingUp(q.row_max - q.row_min, q.answer_units);\r\n Lemma_DivideRoundingUpPreservesWord32(q.row_max - q.row_min, q.answer_units);\r\n var B := q.answer_max - q.answer_min;\r\n\r\n assert RV(alpha) == real(q.alpha_num) / real(q.alpha_den);\r\n assert RV(beta) == real(q.beta_num) / real(q.beta_den);\r\n\r\n p := DiffPrivParametersImpl_ctor(alpha, beta, delta, B);\r\n}\r\n\r\n//-////////////////////////////////////////////\r\n//- Comparing to one\r\n//-////////////////////////////////////////////\r\n\r\nstatic lemma Lemma_CompareDivisionToOne(x:int, y:int)\r\n requires x >= 0;\r\n requires y > 0;\r\n ensures var x_over_y := real(x) / real(y);\r\n (x < y ==> x_over_y < 1.0) &&\r\n (x == y ==> x_over_y == 1.0) &&\r\n (x > y ==> x_over_y > 1.0);\r\n{\r\n if x == 0 {\r\n assert x < y;\r\n assert real(x) / real(y) == 0.0 < 1.0;\r\n }\r\n else {\r\n assert real(x) / real(x) == 1.0;\r\n\r\n if x == y {\r\n calc {\r\n real(x) / real(y);\r\n { assert real(y) == real(x); }\r\n real(x) / real(x);\r\n }\r\n }\r\n else if x < y {\r\n calc {\r\n real(x) / real(y);\r\n < { assert real(y) > real(x); }\r\n real(x) / real(x);\r\n }\r\n }\r\n else {\r\n assert x > y;\r\n calc {\r\n real(x) / real(y);\r\n > { lemma_real_div_gt(real(x), real(y)); }\r\n real(x) / real(x);\r\n }\r\n }\r\n }\r\n}\r\n\r\n//-////////////////////////////////////////////\r\n//- Decrypting add-row requests\r\n//-////////////////////////////////////////////\r\n\r\nstatic predicate WellformedDecryptedAddRowRequest(request:DecryptedAddRowRequest)\r\n{\r\n match request\r\n case DecryptedAddRowRequest_c(row, max_budget_num, max_budget_den) =>\r\n RowValid(row) && Word32(max_budget_num) && Word32(max_budget_den)\r\n case InvalidAddRowRequest_c => true\r\n case UndecryptableAddRowRequest_c => true\r\n}\r\n\r\nstatic lemma Lemma_WellformedDecryptedAddRowRequest(request:DecryptedAddRowRequest)\r\n requires request.DecryptedAddRowRequest_c?;\r\n requires RowValid(request.row);\r\n requires Word32(request.max_budget_num);\r\n requires Word32(request.max_budget_den);\r\n ensures WellformedDecryptedAddRowRequest(request);\r\n{\r\n}\r\n\r\nstatic method ParseDecryptedAddRowRequest_impl (plaintext:seq) returns (request:DecryptedAddRowRequest)\r\n requires IsByteSeq(plaintext);\r\n ensures WellformedDecryptedAddRowRequest(request);\r\n ensures request == ParseDecryptedAddRowRequest(plaintext);\r\n{\r\n if |plaintext| < 16 {\r\n request := InvalidAddRowRequest_c();\r\n return;\r\n }\r\n\r\n var row_nonce_size := BEFourBytesToWord_impl(plaintext[0..4]);\r\n var row_data_size := BEFourBytesToWord_impl(plaintext[4..8]);\r\n assert row_nonce_size == BEByteSeqToInt(plaintext[0..4]);\r\n assert row_data_size == BEByteSeqToInt(plaintext[4..8]);\r\n if row_nonce_size < 0 || row_data_size < 0 || |plaintext| < 16 + row_nonce_size + row_data_size || row_data_size % 4 != 0 {\r\n request := InvalidAddRowRequest_c();\r\n return;\r\n }\r\n assert row_nonce_size >= 0 && row_data_size >= 0 && |plaintext| >= 16 + row_nonce_size + row_data_size && row_data_size % 4 == 0;\r\n\r\n ghost var fields := plaintext[8:4:4:row_nonce_size:row_data_size];\r\n\r\n var max_budget_num := BEFourBytesToWord_impl(plaintext[8..12]);\r\n assert max_budget_num == BEByteSeqToInt(fields[1]);\r\n var max_budget_den := BEFourBytesToWord_impl(plaintext[12..16]);\r\n assert max_budget_den == BEByteSeqToInt(fields[2]);\r\n var row_nonce := plaintext[16..16+row_nonce_size];\r\n assert row_nonce == fields[3];\r\n var row_data := plaintext[16+row_nonce_size..16+row_nonce_size+row_data_size];\r\n assert row_data == fields[4];\r\n var row_data_words, padbytes := BEByteSeqToWordSeq_impl(row_data);\r\n assert row_data_words == BEByteSeqToWordSeq(row_data);\r\n\r\n var row:Row := Row_ctor(row_nonce, row_data_words);\r\n request := DecryptedAddRowRequest_c(row, max_budget_num, max_budget_den);\r\n\r\n Lemma_WellformedDecryptedAddRowRequest(request);\r\n}\r\n\r\nmethod DecryptAddRowRequest_impl(ciphertext:seq, key_pair:RSAKeyPairImpl) returns (request:DecryptedAddRowRequest)\r\n requires IsByteSeq(ciphertext);\r\n requires |ciphertext| > 0;\r\n requires WellformedRSAKeyPairImpl(key_pair);\r\n ensures AddRowRequestDecryptedCorrectly(ciphertext, KeyPairImplToSpec(key_pair), request);\r\n ensures WellformedDecryptedAddRowRequest(request);\r\n{\r\n var success, plaintext := Decrypt(key_pair, ciphertext);\r\n if !success {\r\n request := UndecryptableAddRowRequest_c();\r\n return;\r\n }\r\n request := ParseDecryptedAddRowRequest_impl(plaintext);\r\n}\r\n\r\n//-////////////////////////////////////////////\r\n//- Exported methods\r\n//-////////////////////////////////////////////\r\n\r\nmethod DiffPrivInitialize() returns (diffpriv_state:DiffPrivStateImpl)\r\n ensures DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state));\r\n ensures DiffPrivInitializeValid(DiffPrivStateImplToSpec(diffpriv_state));\r\n ensures public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state)));\r\n{\r\n lemma_2toX();\r\n var one := MakeSmallLiteralBigRat(1);\r\n diffpriv_state := DiffPrivStateImpl_ctor([], one, 0);\r\n assert PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state)) == DiffPrivState_ctor([], 1.0, 0);\r\n}\r\n\r\nstatic method DiffPrivInitializeDB(old_state:DiffPrivStateImpl, budget_num:int, budget_den:int)\r\n returns (error_code:int, new_state:DiffPrivStateImpl)\r\n requires DiffPrivStateValid(DiffPrivStateImplToSpec(old_state));\r\n requires Word32(budget_num);\r\n requires Word32(budget_den);\r\n requires budget_den != 0;\r\n ensures Word32(error_code);\r\n ensures error_code == 0 ==> DiffPrivInitializedDBCorrectly(DiffPrivStateImplToSpec(old_state), DiffPrivStateImplToSpec(new_state),\r\n real(budget_num) / real(budget_den));\r\n ensures error_code != 0 ==> new_state == old_state;\r\n\r\n requires public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(old_state)));\r\n requires public(budget_num);\r\n requires public(budget_den);\r\n ensures public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(new_state)));\r\n ensures public(error_code);\r\n{\r\n lemma_2toX();\r\n\r\n if (old_state.rows_received != 0) {\r\n error_code := ErrorInitializingTooLate();\r\n new_state := old_state;\r\n return;\r\n }\r\n\r\n assert real(budget_num) >= 0.0;\r\n assert real(budget_den) > 0.0;\r\n\r\n Lemma_CompareDivisionToOne(budget_num, budget_den);\r\n if budget_num < budget_den {\r\n error_code := ErrorBudgetLessThanOne();\r\n new_state := old_state;\r\n return;\r\n }\r\n\r\n error_code := 0;\r\n\r\n //- At this point, the error code is set so we can look at private data.\r\n\r\n var budget := BigRat_ctor(MakeSmallLiteralBigNum(budget_num), MakeSmallLiteralBigNat(budget_den));\r\n assert RV(budget) == real(budget_num) / real(budget_den);\r\n new_state := DiffPrivStateImpl_ctor([], budget, old_state.rows_received);\r\n}\r\n\r\nlemma Lemma_AddingValidRowToValidDatabasePreservesValidity (db_prev:seq, row:Row, db_next:seq)\r\n requires DatabaseValid(db_prev);\r\n requires RowValid(row);\r\n requires db_next == db_prev + [row];\r\n ensures DatabaseValid(db_next);\r\n{\r\n}\r\n\r\nmethod DiffPrivAddRow (old_state:DiffPrivStateImpl, key_pair:RSAKeyPairImpl, request_ciphertext:seq)\r\n returns (new_state:DiffPrivStateImpl)\r\n requires DiffPrivStateValid(DiffPrivStateImplToSpec(old_state));\r\n requires WellformedRSAKeyPairImpl(key_pair);\r\n requires IsByteSeq(request_ciphertext);\r\n requires |request_ciphertext| > 0;\r\n ensures DiffPrivRowAddedCorrectly(DiffPrivStateImplToSpec(old_state), DiffPrivStateImplToSpec(new_state),\r\n KeyPairImplToSpec(key_pair), request_ciphertext);\r\n\r\n requires public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(old_state)));\r\n ensures public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(new_state)));\r\n{\r\n lemma_2toX();\r\n\r\n var request := DecryptAddRowRequest_impl(request_ciphertext, key_pair);\r\n new_state := old_state[rows_received := old_state.rows_received + 1];\r\n\r\n if !request.DecryptedAddRowRequest_c? {\r\n return;\r\n }\r\n\r\n if request.max_budget_den == 0 {\r\n return;\r\n }\r\n\r\n var max_budget := BigRat_ctor(MakeSmallLiteralBigNum(request.max_budget_num), MakeSmallLiteralBigNat(request.max_budget_den));\r\n var insufficient := BigRatGt(old_state.budget, max_budget);\r\n if insufficient {\r\n return;\r\n }\r\n\r\n //- At this point, the error code is set so we can look at private data.\r\n\r\n var already_exists:bool := DoesDatabaseContainNonce(old_state.db, request.row.nonce);\r\n if !already_exists {\r\n new_state := DiffPrivStateImpl_ctor(old_state.db + [request.row], old_state.budget, old_state.rows_received + 1);\r\n Lemma_AddingValidRowToValidDatabasePreservesValidity(old_state.db, request.row, new_state.db);\r\n assert DatabaseValid(DiffPrivStateImplToSpec(new_state).db);\r\n } \r\n}\r\n\r\n//-////////////////////////////////////////////\r\n//- Helpers\r\n//-////////////////////////////////////////////\r\n\r\nstatic method DoesDatabaseContainNonce (db:seq, nonce:seq) returns (already_exists:bool)\r\n requires DatabaseValid(db);\r\n ensures already_exists == DatabaseContainsNonce(db, nonce);\r\n{\r\n var i:int := 0;\r\n while i < |db|\r\n invariant 0 <= i <= |db|;\r\n invariant forall j :: 0 <= j < i ==> db[j].nonce != nonce;\r\n {\r\n if db[i].nonce == nonce {\r\n already_exists := true;\r\n return;\r\n }\r\n i := i + 1;\r\n }\r\n\r\n already_exists := false;\r\n}\r\n\r\nstatic method DetermineIfQueryParametersValid (q:QueryParametersImpl) returns (error_code:int, program:seq)\r\n requires QueryParametersImplValid(q);\r\n ensures Word32(error_code);\r\n ensures error_code == 0 <==> QueryParametersValid(QueryParametersImplToSpec(q));\r\n ensures error_code == 0 ==> program == MessageToProgram(q.program_encoding);\r\n\r\n requires public(q);\r\n ensures public(error_code);\r\n ensures public(program);\r\n{\r\n lemma_2toX();\r\n\r\n //-\r\n //- Validate the input values.\r\n //-\r\n program := []; //- dafnycc: initialize variable\r\n\r\n if (q.row_min > q.row_max) {\r\n error_code := ErrorRowMinGreaterThanRowMax();\r\n return;\r\n }\r\n if (q.answer_min > q.answer_max) {\r\n error_code := ErrorAnswerMinGreaterThanAnswerMax();\r\n return;\r\n }\r\n if (q.answer_units <= 0) {\r\n error_code := ErrorAnswerUnitsNotPositive();\r\n return;\r\n }\r\n\r\n Lemma_CompareDivisionToOne(q.alpha_num, q.alpha_den);\r\n if (q.alpha_num <= q.alpha_den) {\r\n error_code := ErrorAlphaNotGreaterThanOne();\r\n return;\r\n }\r\n\r\n Lemma_CompareDivisionToOne(q.beta_num, q.beta_den);\r\n if (q.beta_num <= q.beta_den) {\r\n error_code := ErrorBetaNotGreaterThanOne();\r\n return;\r\n }\r\n\r\n //-\r\n //- Convert the program encoding into a program and validate it.\r\n //-\r\n\r\n program := ConvertMessageToProgram(q.program_encoding);\r\n var valid:bool := DetermineIfProgramIsValid(program);\r\n if (!valid) {\r\n error_code := ErrorProgramInvalid();\r\n return;\r\n }\r\n\r\n error_code := 0;\r\n}\r\n\r\nmethod ParseQueryParameters (q:QueryParametersImpl) returns (error_code:int, program:seq, p:DiffPrivParametersImpl)\r\n requires QueryParametersImplValid(q);\r\n ensures Word32(error_code);\r\n ensures error_code == 0 ==> QueryParametersValid(QueryParametersImplToSpec(q)) &&\r\n program == MessageToProgram(q.program_encoding) &&\r\n ProgramValid(program) &&\r\n Word32(q.answer_units * 2) &&\r\n WellformedDiffPrivParameters(p) &&\r\n DiffPrivParametersImplToSpec(p) == QueryParametersToDiffPrivParameters(QueryParametersImplToSpec(q)) &&\r\n DiffPrivParametersValid(DiffPrivParametersImplToSpec(p));\r\n\r\n requires public(q);\r\n ensures public(error_code);\r\n ensures public(program);\r\n ensures public(p);\r\n{\r\n //-\r\n //- Validate the input values.\r\n //-\r\n\r\n program := []; //- dafnycc: initialize variable\r\n var r0 := MakeSmallLiteralBigRat(0);\r\n p := DiffPrivParametersImpl_ctor(r0, r0, 0, 0); //- dafnycc: initialize variable\r\n\r\n error_code, program := DetermineIfQueryParametersValid(q);\r\n if (error_code != 0) {\r\n return;\r\n }\r\n\r\n //-\r\n //- Make sure the answer units aren't too high.\r\n //-\r\n\r\n error_code := TestAnswerUnits(q.answer_units);\r\n if (error_code != 0) {\r\n return;\r\n }\r\n\r\n //-\r\n //- Compute noise parameters and validate them.\r\n //-\r\n\r\n p := GetDiffPrivParametersFromQueryParameters(q);\r\n error_code := DetermineIfDiffPrivParametersValid(p);\r\n}\r\n\r\nmethod GetErrorCodeForPerformQuery (q:QueryParametersImpl, budget:BigRat)\r\n returns (error_code:int, program:seq, p:DiffPrivParametersImpl,\r\n num_randoms_needed:nat)\r\n requires QueryParametersImplValid(q);\r\n requires WellformedBigRat(budget);\r\n ensures Word32(error_code);\r\n ensures error_code == 0 ==> QueryParametersValid(QueryParametersImplToSpec(q)) &&\r\n program == MessageToProgram(q.program_encoding) &&\r\n ProgramValid(program) &&\r\n Word32(q.answer_units * 2) &&\r\n WellformedDiffPrivParameters(p) &&\r\n DiffPrivParametersImplToSpec(p) == QueryParametersToDiffPrivParameters(QueryParametersImplToSpec(q)) &&\r\n DiffPrivParametersValid(DiffPrivParametersImplToSpec(p)) &&\r\n RV(budget) >= RV(p.beta) &&\r\n Word32((num_randoms_needed-1)*8+1) &&\r\n SufficientBytesForNoiseGeneration(DiffPrivParametersImplToSpec(p), num_randoms_needed);\r\n\r\n requires public(q);\r\n requires public(RV(budget));\r\n ensures public(error_code);\r\n ensures public(program);\r\n ensures public(p);\r\n ensures public(num_randoms_needed);\r\n{\r\n lemma_2toX();\r\n\r\n error_code, program, p := ParseQueryParameters(q);\r\n num_randoms_needed := 0; //- dafnycc: initialize variable\r\n if error_code != 0 {\r\n return;\r\n }\r\n\r\n //-\r\n //- See if there's sufficient budget.\r\n //-\r\n\r\n var InsufficientPrivacyBudget:bool := BigRatGt(p.beta, budget);\r\n if InsufficientPrivacyBudget {\r\n error_code := ErrorInsufficientPrivacyBudget();\r\n return;\r\n }\r\n\r\n //-\r\n //- Determine how many random numbers we need.\r\n //-\r\n\r\n error_code, num_randoms_needed := ComputeBytesForNoiseGeneration(p);\r\n}\r\n\r\nmethod GenerateNoise (p:DiffPrivParametersImpl, budget:BigRat, num_randoms_needed:nat)\r\n returns (negate_noise:bool, absolute_noise:nat, ghost noise:int,\r\n remaining_budget:BigRat, randoms_used:seq)\r\n requires WellformedDiffPrivParameters(p);\r\n requires DiffPrivParametersValid(DiffPrivParametersImplToSpec(p));\r\n requires WellformedBigRat(budget);\r\n requires Word32((num_randoms_needed-1)*8+1);\r\n requires SufficientBytesForNoiseGeneration(DiffPrivParametersImplToSpec(p), num_randoms_needed);\r\n requires RV(budget) >= RV(p.beta) >= 1.0;\r\n\r\n ensures Word32(absolute_noise);\r\n ensures WellformedBigRat(remaining_budget);\r\n ensures IsByteSeq(randoms_used);\r\n ensures noise == (if negate_noise then -absolute_noise else absolute_noise);\r\n ensures NoiseComputedCorrectly(DiffPrivParametersImplToSpec(p), randoms_used, noise);\r\n ensures randoms_used == TPM_random_bytes(old(TPM.random_index), TPM.random_index);\r\n ensures RV(remaining_budget) == RV(budget) / RV(p.beta);\r\n\r\n requires TPM_ready();\r\n ensures TPM_ready();\r\n ensures TPMs_match_except_for_randoms(old(TPM), TPM);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures old(TPM.random_index) <= TPM.random_index;\r\n{\r\n ghost var old_random_index := TPM.random_index;\r\n\r\n randoms_used := get_random(num_randoms_needed);\r\n\r\n //- Compute the noise to use.\r\n\r\n negate_noise, absolute_noise, noise := ComputeNoise(p, randoms_used);\r\n\r\n //- Reduce the budget by beta.\r\n\r\n Lemma_IfBigRatGeOneItsNotZero(p.beta);\r\n remaining_budget := BigRatDiv(budget, p.beta);\r\n\r\n assert SufficientBytesForNoiseGeneration(DiffPrivParametersImplToSpec(p), num_randoms_needed);\r\n assert SufficientBytesForNoiseGeneration(DiffPrivParametersImplToSpec(p), |randoms_used|);\r\n}\r\n\r\nstatic method TestAnswerUnits (answer_units:int) returns (error_code:int)\r\n requires Word32(answer_units);\r\n ensures Word32(error_code);\r\n ensures error_code == 0 ==> Word32(answer_units * 2);\r\n\r\n requires public(answer_units);\r\n ensures public(error_code);\r\n{\r\n lemma_2toX();\r\n error_code := if answer_units < 0x80000000 then 0 else ErrorAnswerUnitsTooLarge();\r\n}\r\n\r\nstatic method AddNoise (ghost db:seq, ghost sum:int, answer:int, q:QueryParametersImpl,\r\n negate_noise:bool, absolute_noise:nat, ghost noise:int)\r\n returns (response:int)\r\n requires DatabaseValid(db);\r\n requires QueryParametersImplValid(q);\r\n requires QueryParametersValid(QueryParametersImplToSpec(q));\r\n requires sum == MapperSum(db, MessageToProgram(q.program_encoding), q.row_min, q.row_max);\r\n requires answer == Clip(Scale(sum, q.answer_units), q.answer_min, q.answer_max);\r\n requires noise == if negate_noise then -absolute_noise else absolute_noise;\r\n requires Word32(absolute_noise);\r\n ensures Word32(response);\r\n ensures sum == MapperSum(db, MessageToProgram(q.program_encoding), q.row_min, q.row_max);\r\n ensures response == QueryResponse(db, QueryParametersImplToSpec(q), noise);\r\n{\r\n var noised_answer:int;\r\n if negate_noise {\r\n if (answer < absolute_noise) {\r\n noised_answer := 0;\r\n }\r\n else {\r\n noised_answer := answer - absolute_noise;\r\n }\r\n }\r\n else {\r\n noised_answer := SaturatingAdd(answer, absolute_noise);\r\n }\r\n\r\n //-\r\n //- Clip the noised answer to get the response.\r\n //-\r\n\r\n response := Clip(noised_answer, q.answer_min, q.answer_max);\r\n Lemma_QueryResponseComputedCorrectly(db, sum, QueryParametersImplToSpec(q), negate_noise, absolute_noise, noise, answer, noised_answer, response);\r\n}\r\n\r\n//-////////////////////////\r\n//- Lemmas\r\n//-////////////////////////\r\n\r\nstatic lemma {:timeLimitMultiplier 3} Lemma_QueryPerformedCorrectly (old_state:DiffPrivState, new_state:DiffPrivState, q:QueryParameters,\r\n p:DiffPrivParameters, old_TPM:TPM_struct, new_TPM:TPM_struct, ghost noise:int,\r\n response:int)\r\n requires DiffPrivStateValid(old_state);\r\n requires QueryParametersValid(q);\r\n requires DiffPrivParametersValid(p);\r\n requires p == QueryParametersToDiffPrivParameters(q);\r\n requires Word32(response);\r\n requires old_state.budget >= p.beta >= 1.0;\r\n requires new_state.db == old_state.db;\r\n requires new_state.rows_received == old_state.rows_received;\r\n requires new_state.budget == old_state.budget / p.beta;\r\n requires TPMs_match_except_for_randoms(old_TPM, new_TPM);\r\n requires NoiseComputedCorrectly(p, TPM_random_bytes(old_TPM.random_index, new_TPM.random_index), noise);\r\n requires response == QueryResponse(old_state.db, q, noise);\r\n ensures DiffPrivQueryPerformedCorrectly(old_state, new_state, q, response, old_TPM, new_TPM);\r\n ensures new_state.budget >= 1.0;\r\n{\r\n reveal_DiffPrivQueryPerformedCorrectly();\r\n\r\n var program := MessageToProgram(q.program_encoding);\r\n Lemma_DividingBySmallerProducesAtLeastOne(old_state.budget, p.beta);\r\n\r\n assert QuerySuccessfulTrigger(noise);\r\n Lemma_SensitivityOfComputeSum(program, q.row_min, q.row_max, q.answer_units, q.answer_min, q.answer_max,\r\n DivideRoundingUp(q.row_max - q.row_min, q.answer_units));\r\n assert QuerySuccessful(old_state, new_state, q, response, TPM_random_bytes(old_TPM.random_index, new_TPM.random_index), noise);\r\n}\r\n\r\nstatic lemma Lemma_QueryResponseComputedCorrectly (ghost db:seq, ghost sum:int, q:QueryParameters,\r\n negate_noise:bool, absolute_noise:nat, ghost noise:int,\r\n answer:int, noised_answer:int, response:int)\r\n requires DatabaseValid(db);\r\n requires QueryParametersValid(q);\r\n requires Word32(absolute_noise);\r\n requires Word32(answer);\r\n requires Word32(noised_answer);\r\n requires Word32(response);\r\n requires sum == MapperSum(db, MessageToProgram(q.program_encoding), q.row_min, q.row_max);\r\n requires answer == Clip(Scale(sum, q.answer_units), q.answer_min, q.answer_max);\r\n requires noise == if negate_noise then -absolute_noise else absolute_noise;\r\n requires noised_answer == (if negate_noise then\r\n (if answer < absolute_noise then 0 else answer - absolute_noise)\r\n else\r\n SaturatingAdd(answer, absolute_noise));\r\n requires response == Clip(noised_answer, q.answer_min, q.answer_max);\r\n ensures response == QueryResponse(db, q, noise);\r\n{\r\n}\r\n\r\nstatic lemma Lemma_DividingBySmallerProducesAtLeastOne (x:real, y:real)\r\n requires x >= y > 0.0;\r\n ensures x/y >= 1.0;\r\n{\r\n}\r\n\r\nstatic lemma Lemma_IfBigRatGeOneItsNotZero (Q:BigRat)\r\n requires WellformedBigRat(Q);\r\n requires RV(Q) >= 1.0;\r\n ensures nonzero(Q.n.value);\r\n{\r\n if !nonzero(Q.n.value) {\r\n calc {\r\n RV(Q);\r\n real(BV(Q.n)) / real(I(Q.d));\r\n 0.0 / real(I(Q.d));\r\n 0.0;\r\n }\r\n assert false;\r\n }\r\n}\r\n\r\nstatic lemma Lemma_IndexingIntoSequenceConcatenation (seq1:seq, seq2:seq, i:nat)\r\n requires |seq1| <= i < |seq1| + |seq2|;\r\n ensures (seq1 + seq2)[i] == seq2[i-|seq1|];\r\n{\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/DiffPriv.s.dfy", "content": "include \"../../Libraries/Util/be_sequences.s.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSASpec.s.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/rfc4251.s.dfy\"\r\ninclude \"../Common/CommonState.s.dfy\"\r\ninclude \"../../Drivers/TPM/tpm-device.s.dfy\"\r\ninclude \"Mapper.s.dfy\"\r\ninclude \"SumReducer.s.dfy\"\r\ninclude \"Noise.s.dfy\"\r\n\r\ndatatype DiffPrivState = DiffPrivState_ctor(db:seq, budget:real, rows_received:int);\r\n\r\nstatic predicate DiffPrivStateValid (s:DiffPrivState)\r\n{\r\n DatabaseValid(s.db) &&\r\n s.budget >= 1.0\r\n}\r\n\r\nstatic function PublicPartOfDiffPrivState (s:DiffPrivState) : DiffPrivState\r\n{\r\n DiffPrivState_ctor([], s.budget, s.rows_received)\r\n}\r\n\r\n//- This function is used to ensure that DiffPriv initialization operates correctly.\r\n\r\nstatic predicate {:autoReq} DiffPrivInitializeValid(diffpriv_state:DiffPrivState)\r\n{\r\n diffpriv_state.db == [] &&\r\n diffpriv_state.budget == 1.0 &&\r\n diffpriv_state.rows_received == 0\r\n}\r\n\r\ndatatype QueryParameters = QueryParameters_ctor(program_encoding:seq, row_min:int, row_max:int,\r\n answer_units:int, answer_min:int, answer_max:int,\r\n alpha:real, beta:real)\r\n\r\nstatic predicate QueryParametersValid (q:QueryParameters)\r\n{\r\n Word32(q.row_min) &&\r\n Word32(q.row_max) &&\r\n Word32(q.answer_units) &&\r\n Word32(q.answer_min) &&\r\n Word32(q.answer_max) &&\r\n q.row_min <= q.row_max &&\r\n q.answer_min <= q.answer_max &&\r\n q.alpha > 1.0 &&\r\n q.beta > 1.0 &&\r\n q.answer_units > 0 &&\r\n IsWordSeq(q.program_encoding) &&\r\n ProgramValid(MessageToProgram(q.program_encoding))\r\n}\r\n\r\nstatic predicate DiffPrivInitializedDBCorrectly (old_state:DiffPrivState, new_state:DiffPrivState, budget:real)\r\n{\r\n DiffPrivStateValid(new_state) &&\r\n budget >= 1.0 &&\r\n old_state.rows_received == 0 &&\r\n new_state.db == [] &&\r\n new_state.budget == budget &&\r\n new_state.rows_received == old_state.rows_received\r\n}\r\n\r\ndatatype DecryptedAddRowRequest = DecryptedAddRowRequest_c(row:Row, max_budget_num:int, max_budget_den:int) |\r\n InvalidAddRowRequest_c() |\r\n UndecryptableAddRowRequest_c();\r\n\r\nstatic function ParseDecryptedAddRowRequest(plaintext:seq) : DecryptedAddRowRequest\r\n requires IsByteSeq(plaintext);\r\n{\r\n if |plaintext| < 16 then\r\n InvalidAddRowRequest_c()\r\n else\r\n (\r\n var row_nonce_size := BEByteSeqToInt(plaintext[0..4]);\r\n var row_data_size := BEByteSeqToInt(plaintext[4..8]);\r\n if row_nonce_size < 0 || row_data_size < 0 || |plaintext| < 16 + row_nonce_size + row_data_size || row_data_size % 4 != 0 then\r\n InvalidAddRowRequest_c()\r\n else\r\n (var fields := plaintext[8 :4 :4 :row_nonce_size :row_data_size ];\r\n var _, max_budget_num, max_budget_den, row_nonce, row_data :=\r\n fields[0], BEByteSeqToInt(fields[1]), BEByteSeqToInt(fields[2]), fields[3], fields[4] ;\r\n var row_data_words := BEIntToDigitSeq(power2(32), |row_data|/4, BEDigitSeqToInt(power2(8), row_data));\r\n DecryptedAddRowRequest_c(Row_ctor(row_nonce, row_data_words), max_budget_num, max_budget_den))\r\n )\r\n}\r\n\r\nstatic predicate AddRowRequestDecryptedCorrectly(ciphertext:seq, key_pair:RSAKeyPairSpec, request:DecryptedAddRowRequest)\r\n requires IsByteSeq(ciphertext);\r\n{\r\n (\r\n exists plaintext:seq :: RSADecryptionRelation(key_pair, ciphertext, plaintext) &&\r\n request == ParseDecryptedAddRowRequest(plaintext)\r\n )\r\n ||\r\n (\r\n request == UndecryptableAddRowRequest_c()\r\n && !exists plaintext:seq :: RSADecryptionRelation(key_pair, ciphertext, plaintext)\r\n )\r\n}\r\n\r\nstatic predicate DiffPrivRowAddedCorrectly (old_state:DiffPrivState, new_state:DiffPrivState, key_pair:RSAKeyPairSpec,\r\n request_ciphertext:seq)\r\n{\r\n IsByteSeq(request_ciphertext) &&\r\n DiffPrivStateValid(new_state) &&\r\n new_state.budget == old_state.budget &&\r\n new_state.rows_received == old_state.rows_received + 1 &&\r\n (\r\n exists request:DecryptedAddRowRequest ::\r\n AddRowRequestDecryptedCorrectly(request_ciphertext, key_pair, request) &&\r\n if request.DecryptedAddRowRequest_c?\r\n && request.max_budget_den > 0\r\n && old_state.budget <= real(request.max_budget_num) / real(request.max_budget_den)\r\n && !DatabaseContainsNonce(old_state.db, request.row.nonce) then\r\n new_state.db == old_state.db + [request.row]\r\n else\r\n new_state.db == old_state.db\r\n )\r\n}\r\n\r\nstatic function QueryResponse (db:seq, q:QueryParameters, noise:int) : int\r\n requires DatabaseValid(db);\r\n requires QueryParametersValid(q);\r\n{\r\n var program := MessageToProgram(q.program_encoding);\r\n var sum := MapperSum(db, program, q.row_min, q.row_max);\r\n var scaled_sum := Scale(sum, q.answer_units);\r\n var answer := Clip(scaled_sum, q.answer_min, q.answer_max);\r\n var noised_answer := answer + noise;\r\n Clip(noised_answer, q.answer_min, q.answer_max)\r\n}\r\n\r\nstatic function QueryParametersToDiffPrivParameters (q:QueryParameters) : DiffPrivParameters\r\n requires QueryParametersValid(q);\r\n{\r\n DiffPrivParameters_ctor(q.alpha,\r\n q.beta,\r\n DivideRoundingUp(q.row_max - q.row_min, q.answer_units),\r\n q.answer_max - q.answer_min)\r\n}\r\n\r\nstatic predicate QuerySuccessful (old_state:DiffPrivState, new_state:DiffPrivState, q:QueryParameters, response:int,\r\n randoms_used:seq, noise:int)\r\n requires DiffPrivStateValid(old_state);\r\n requires QueryParametersValid(q);\r\n{\r\n var p := QueryParametersToDiffPrivParameters(q);\r\n\r\n DiffPrivParametersValid(p) &&\r\n old_state.budget >= p.beta &&\r\n new_state.db == old_state.db &&\r\n new_state.rows_received == old_state.rows_received &&\r\n new_state.budget == old_state.budget / p.beta &&\r\n NoiseComputedCorrectly(p, randoms_used, noise) &&\r\n response == QueryResponse(old_state.db, q, noise) &&\r\n (forall db1:seq, db2:seq ::\r\n (var program, row_min, row_max, answer_units, answer_min, answer_max :=\r\n MessageToProgram(q.program_encoding), q.row_min, q.row_max, q.answer_units, q.answer_min, q.answer_max;\r\n var delta := DivideRoundingUp(row_max - row_min, answer_units);\r\n DatabaseValid(db1) && DatabaseValid(db2) && DatabasesSimilar(db1, db2) ==>\r\n -delta <= Clip(Scale(MapperSum(db1, program, row_min, row_max), answer_units), answer_min, answer_max) -\r\n Clip(Scale(MapperSum(db2, program, row_min, row_max), answer_units), answer_min, answer_max) <= delta)\r\n )\r\n}\r\n\r\nstatic predicate QuerySuccessfulTrigger (noise:int)\r\n{\r\n true\r\n}\r\n\r\nstatic predicate {:opaque} DiffPrivQueryPerformedCorrectly (old_state:DiffPrivState, new_state:DiffPrivState, q:QueryParameters,\r\n response:int, old_TPM:TPM_struct, new_TPM:TPM_struct)\r\n requires DiffPrivStateValid(old_state);\r\n{\r\n DiffPrivStateValid(new_state) &&\r\n QueryParametersValid(q) &&\r\n TPMs_match(new_TPM, old_TPM[random_index := new_TPM.random_index]) &&\r\n (exists noise:int {:trigger QuerySuccessfulTrigger(noise)} ::\r\n QuerySuccessful(old_state, new_state, q, response, TPM_random_bytes(old_TPM.random_index, new_TPM.random_index), noise))\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/DiffPrivPerformQuery.i.dfy", "content": "//-\r\n//- \r\ninclude \"../../Libraries/BigNum/BigRat.i.dfy\"\r\ninclude \"../../Libraries/Util/relational.s.dfy\"\r\ninclude \"../../Libraries/Util/arrays_and_seqs.i.dfy\"\r\ninclude \"../../Drivers/TPM/tpm-wrapper.i.dfy\"\r\ninclude \"DiffPriv.s.dfy\"\r\ninclude \"ErrorCodes.i.dfy\"\r\ninclude \"Noise.i.dfy\"\r\ninclude \"SumReducer.i.dfy\"\r\ninclude \"../Common/CommonState.i.dfy\"\r\ninclude \"DiffPriv.i.dfy\"\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} {:timeLimitMultiplier 3} DiffPrivPerformQuery\r\n (old_state:DiffPrivStateImpl, q:QueryParametersImpl)\r\n returns (error_code:int, response:int, new_state:DiffPrivStateImpl)\r\n requires DiffPrivStateValid(DiffPrivStateImplToSpec(old_state));\r\n requires QueryParametersImplValid(q);\r\n ensures DiffPrivStateValid(DiffPrivStateImplToSpec(new_state));\r\n ensures Word32(error_code);\r\n ensures Word32(response);\r\n ensures error_code == 0 ==> DiffPrivQueryPerformedCorrectly(DiffPrivStateImplToSpec(old_state), DiffPrivStateImplToSpec(new_state),\r\n QueryParametersImplToSpec(q), response, old(TPM), TPM);\r\n ensures error_code != 0 ==> TPM == old(TPM) && new_state == old_state;\r\n\r\n requires public(q);\r\n requires public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(old_state)));\r\n ensures public(error_code);\r\n ensures public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(new_state)));\r\n\r\n //- TPM stuff:\r\n requires TPM_ready();\r\n ensures TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n{\r\n var program:seq, p:DiffPrivParametersImpl, num_randoms_needed:nat;\r\n error_code, program, p, num_randoms_needed := GetErrorCodeForPerformQuery(q, old_state.budget);\r\n if error_code != 0 {\r\n response := 0;\r\n new_state := old_state;\r\n return;\r\n }\r\n\r\n //-\r\n //- At this point, the error code is set so we can look at private data.\r\n //- (All we looked at before was old_state.budget and |old_state.randoms|.)\r\n //-\r\n\r\n //-\r\n //- Generate the noise.\r\n //-\r\n\r\n var negate_noise:bool, absolute_noise:nat, remaining_budget:BigRat, remaining_randoms:seq;\r\n ghost var noise:int, randoms_used:seq;\r\n negate_noise, absolute_noise, noise, remaining_budget, randoms_used := GenerateNoise(p, old_state.budget, num_randoms_needed);\r\n\r\n //-\r\n //- Run the reducer.\r\n //-\r\n\r\n var answer:int;\r\n ghost var sum:int;\r\n answer, sum := ComputeSum(old_state.db, program, q.row_min, q.row_max, q.answer_units, q.answer_min, q.answer_max);\r\n\r\n //-\r\n //- Convert the answer into a response by adding noise and clipping.\r\n //-\r\n\r\n response := AddNoise(old_state.db, sum, answer, q, negate_noise, absolute_noise, noise);\r\n\r\n //-\r\n //- Update the state to reduce the privacy budget and remove the random numbers used.\r\n //-\r\n\r\n new_state := DiffPrivStateImpl_ctor(old_state.db, remaining_budget, old_state.rows_received);\r\n Lemma_QueryPerformedCorrectly(DiffPrivStateImplToSpec(old_state), DiffPrivStateImplToSpec(new_state), QueryParametersImplToSpec(q),\r\n DiffPrivParametersImplToSpec(p), old(TPM), TPM, noise, response);\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/ErrorCodes.i.dfy", "content": "static function method ErrorRowMinGreaterThanRowMax() : int { 1 }\r\nstatic function method ErrorAnswerMinGreaterThanAnswerMax() : int { 2 }\r\nstatic function method ErrorAnswerUnitsNotPositive() : int { 3 }\r\nstatic function method ErrorProgramInvalid() : int { 4 }\r\nstatic function method ErrorAnswerRangeNotPositive() : int { 5 }\r\nstatic function method ErrorAlphaNotGreaterThanOne() : int { 6 }\r\nstatic function method ErrorBetaNotGreaterThanAlphaToPowerOfSensitivity() : int { 7 }\r\nstatic function method ErrorRequiresTooManyBitsOfRandomness() : int { 8 }\r\nstatic function method ErrorAlphaDenominatorZero() : int { 9 }\r\nstatic function method ErrorBetaDenominatorZero() : int { 10 }\r\nstatic function method ErrorInsufficientPrivacyBudget() : int { 11 }\r\nstatic function method ErrorInsufficientRandomness() : int { 12 }\r\nstatic function method ErrorBetaNotGreaterThanOne() : int { 13 }\r\nstatic function method ErrorBudgetDenominatorZero() : int { 14 }\r\nstatic function method ErrorTooMuchBudgetToAddRow() : int { 15 }\r\nstatic function method ErrorBudgetLessThanOne() : int { 16 }\r\nstatic function method ErrorAnswerUnitsTooLarge() : int { 17 }\r\nstatic function method ErrorInitializingTooLate() : int { 18 }\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/Main.i.dfy", "content": "//-\r\n//-\r\ninclude \"StateMachine.i.dfy\"\r\ninclude \"../../Libraries/Net/Udp.i.dfy\"\r\n\r\nmethod MainInitialize () returns (diffpriv_state:DiffPrivStateImpl, common_state:CommonStateImpl, net_state:network_state)\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n requires current_common_state.TPM == TPM;\r\n requires !current_common_state.initialized;\r\n requires !current_diffpriv_state.initialized;\r\n\r\n ensures DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state));\r\n ensures TPM_ready();\r\n ensures CommonStateImplValid(common_state);\r\n ensures common_state.key_pair.pub.size >= 1024 / 8;\r\n ensures KeyCanBeExtendedIntoPCR(CommonStateImplToSpec(common_state).key_pair);\r\n ensures current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state), TPM);\r\n ensures current_diffpriv_state == DiffPrivStateMachine_ctor(true, DiffPrivStateImplToSpec(diffpriv_state));\r\n ensures valid_network_state(net_state);\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_common_state;\r\n modifies this`current_diffpriv_state;\r\n ensures TPMs_match_except_for_randoms(TPM, old(TPM)[PCR_19 := TPM.PCR_19]);\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n\r\n ensures public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state)));\r\n ensures public(net_state);\r\n{\r\n var success:bool;\r\n success, net_state := init_network_card();\r\n if !success {\r\n HaltMachine(0x40);\r\n }\r\n\r\n common_state := GenerateCommonState(1024);\r\n assert TPMs_match_except_for_randoms(TPM, old(TPM)[PCR_19 := TPM.PCR_19]);\r\n ghost var common_state_key_pair := common_state.key_pair;\r\n ghost var common_state_spec := CommonStateImplToSpec(common_state);\r\n InitializeCommonStateMachine(common_state_spec);\r\n\r\n diffpriv_state := DiffPrivInitialize();\r\n ghost var diffpriv_state_spec := DiffPrivStateImplToSpec(diffpriv_state);\r\n assert DiffPrivInitializeValid(diffpriv_state_spec);\r\n InitializeDiffPrivStateMachine(diffpriv_state_spec);\r\n}\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} MainOneStep\r\n (diffpriv_state_in:DiffPrivStateImpl, common_state_in:CommonStateImpl, net_state_in:network_state)\r\n returns (diffpriv_state_out:DiffPrivStateImpl, common_state_out:CommonStateImpl, net_state_out:network_state)\r\n requires TPM_ready();\r\n requires valid_network_state(net_state_in);\r\n requires DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state_in));\r\n requires CommonStateImplValid(common_state_in);\r\n requires common_state_in.key_pair.pub.size >= 1024 / 8;\r\n requires current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state_in), TPM);\r\n requires current_diffpriv_state == DiffPrivStateMachine_ctor(true, DiffPrivStateImplToSpec(diffpriv_state_in));\r\n\r\n ensures DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state_out));\r\n ensures TPM_ready();\r\n ensures valid_network_state(net_state_out);\r\n ensures current_diffpriv_state == DiffPrivStateMachine_ctor(true, DiffPrivStateImplToSpec(diffpriv_state_out));\r\n ensures current_common_state == old(current_common_state)[TPM := TPM];\r\n ensures CommonStateImplValid(common_state_out);\r\n ensures CommonStateImplToSpec(common_state_out) == CommonStateImplToSpec(common_state_in);\r\n\r\n requires public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state_in)));\r\n requires public(net_state_in);\r\n ensures public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state_out)));\r\n ensures public(net_state_out);\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_diffpriv_state;\r\n modifies this`current_common_state;\r\n{\r\n ghost var diffpriv_state_in_spec := DiffPrivStateImplToSpec(diffpriv_state_in);\r\n ghost var common_state_spec := CommonStateImplToSpec(common_state_in);\r\n ghost var common_state_key_pair := common_state_in.key_pair;\r\n\r\n var success:bool, client_eth:ethernet_addr, client_ip:IPv4Address, my_ip:IPv4Address, client_port:int, my_port:int, request_bytes:seq;\r\n success, net_state_out, client_eth, client_ip, my_ip, client_port, my_port, request_bytes := UdpReceive(net_state_in);\r\n if !success {\r\n diffpriv_state_out := diffpriv_state_in;\r\n common_state_out := common_state_in;\r\n return;\r\n }\r\n\r\n var response_bytes:seq;\r\n response_bytes, diffpriv_state_out, common_state_out := HandleOneRequestRaw(request_bytes, diffpriv_state_in, common_state_in);\r\n if |response_bytes| <= 1472 {\r\n net_state_out := UdpSend(net_state_out, client_eth, my_ip, client_ip, my_port, client_port, response_bytes);\r\n }\r\n}\r\n\r\nmethod Main () returns (result:int)\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n requires current_common_state.TPM == TPM;\r\n requires !current_common_state.initialized;\r\n requires !current_diffpriv_state.initialized;\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_common_state;\r\n modifies this`current_diffpriv_state;\r\n ensures public(true); //- Needed to convince DafnyCC this procedure involves relational calls\r\n{\r\n var diffpriv_state, common_state, net_state := MainInitialize();\r\n\r\n while true\r\n invariant TPM_ready();\r\n invariant DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state));\r\n invariant valid_network_state(net_state);\r\n invariant CommonStateImplValid(common_state);\r\n invariant common_state.key_pair.pub.size >= 1024 / 8;\r\n invariant current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state), TPM);\r\n invariant current_diffpriv_state == DiffPrivStateMachine_ctor(true, DiffPrivStateImplToSpec(diffpriv_state));\r\n invariant public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state)));\r\n invariant public(net_state);\r\n decreases *;\r\n {\r\n diffpriv_state, common_state, net_state := MainOneStep(diffpriv_state, common_state, net_state);\r\n }\r\n\r\n return 0;\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/Mapper.i.dfy", "content": "include \"../../Libraries/Math/power2.i.dfy\"\r\ninclude \"../../Drivers/CPU/assembly_premium.i.dfy\"\r\ninclude \"Mapper.s.dfy\"\r\n\r\nstatic function method{:CompiledSpec} CompiledSpec_BooleanToInt(b:bool):int\r\nstatic function method{:CompiledSpec} CompiledSpec_ExtractColumn(column_index:int, row:Row):int\r\n//-static function method{:CompiledSpec} CompiledSpec_StackSizeChangeFromOperation(t:Operation):int\r\nstatic function method{:CompiledSpec} CompiledSpec_WordToOperation(w:int):Operation\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Premium versions of spec functions\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic lemma Lemma_BooleanToInt_IsWord32(b:bool)\r\n ensures Word32(BooleanToInt(b));\r\n{\r\n lemma_2toX();\r\n}\r\n\r\nstatic lemma Lemma_ApplyBinaryInstructionProducesWords(inst:BinaryInstruction, v1:int, v2:int)\r\n requires Word32(v1);\r\n requires Word32(v2);\r\n ensures Word32(ApplyBinaryInstruction(inst, v1, v2));\r\n{\r\n lemma_2toX();\r\n reveal_Mod0x100000000();\r\n reveal_ApplyBinaryInstruction();\r\n\r\n if inst.InstAdd? {\r\n lemma_mod0x100000000(v1+v2);\r\n } else if inst.InstSub? {\r\n lemma_mod0x100000000(v1-v2);\r\n } else if inst.InstMul? {\r\n lemma_mod0x100000000(v1 * v2);\r\n } else if inst.InstDiv? {\r\n if (v2 != 0) {\r\n lemma_mod0x100000000(v1 / v2);\r\n }\r\n } else if inst.InstMod? {\r\n if (v2 != 0) {\r\n lemma_mod0x100000000(v1 % v2);\r\n }\r\n } else if inst.InstGt? {\r\n Lemma_BooleanToInt_IsWord32(v1 > v2);\r\n } else if inst.InstLt? {\r\n Lemma_BooleanToInt_IsWord32(v1 < v2);\r\n } else if inst.InstEq? {\r\n Lemma_BooleanToInt_IsWord32(v1 == v2);\r\n } else if inst.InstGe? {\r\n Lemma_BooleanToInt_IsWord32(v1 >= v2);\r\n } else if inst.InstLe? {\r\n Lemma_BooleanToInt_IsWord32(v1 <= v2);\r\n }\r\n}\r\n\r\nstatic method ApplyBinaryInstructionImpl(inst:BinaryInstruction, v1:int, v2:int) returns (result:int)\r\n requires Word32(v1);\r\n requires Word32(v2);\r\n ensures result == ApplyBinaryInstruction(inst, v1, v2);\r\n ensures Word32(result);\r\n{\r\n lemma_2toX();\r\n reveal_Mod0x100000000();\r\n reveal_ApplyBinaryInstruction();\r\n\r\n if inst.InstAdd? {\r\n lemma_mod0x100000000(v1+v2);\r\n result := Asm_Add(v1, v2);\r\n } else if inst.InstSub? {\r\n lemma_mod0x100000000(v1-v2);\r\n result := Asm_Sub(v1, v2);\r\n } else if inst.InstMul? {\r\n lemma_mod0x100000000(v1 * v2);\r\n result := Asm_Mul(v1, v2);\r\n } else if inst.InstDiv? {\r\n if (v2 == 0) {\r\n result := 0;\r\n } else {\r\n lemma_mod0x100000000(v1 / v2);\r\n result := Asm_Div(v1, v2);\r\n }\r\n } else if inst.InstMod? {\r\n if (v2 == 0) {\r\n result := 0;\r\n } else {\r\n lemma_mod0x100000000(v1 % v2);\r\n result := Asm_Mod(v1, v2);\r\n }\r\n } else if inst.InstGt? {\r\n Lemma_BooleanToInt_IsWord32(v1 > v2);\r\n result := BooleanToInt(v1 > v2);\r\n } else if inst.InstLt? {\r\n Lemma_BooleanToInt_IsWord32(v1 < v2);\r\n result := BooleanToInt(v1 < v2);\r\n } else if inst.InstEq? {\r\n Lemma_BooleanToInt_IsWord32(v1 == v2);\r\n result := BooleanToInt(v1 == v2);\r\n } else if inst.InstGe? {\r\n Lemma_BooleanToInt_IsWord32(v1 >= v2);\r\n result := BooleanToInt(v1 >= v2);\r\n } else { assert inst.InstLe?;\r\n Lemma_BooleanToInt_IsWord32(v1 <= v2);\r\n result := BooleanToInt(v1 <= v2);\r\n }\r\n}\r\n\r\nstatic function HowOperationChangesExpressionStackWhenValid(op:Operation, estack:seq):seq\r\n requires |estack| + StackSizeChangeFromOperation(op) >= 1;\r\n ensures |HowOperationChangesExpressionStackWhenValid(op, estack)| == |estack| + StackSizeChangeFromOperation(op);\r\n{\r\n match op\r\n case OperationPush(i) => estack + [ExpInt(i)]\r\n case OperationColumn => estack[..|estack|-1] + [ExpColumn(estack[|estack|-1])]\r\n case OperationBinary(inst) => estack[..|estack| - 2] + [ExpBinary(inst, estack[|estack| - 2], estack[|estack| - 1])]\r\n case OperationIf => estack[..|estack| - 3] + [ExpIf(estack[|estack|-3], estack[|estack| - 2], estack[|estack| - 1])]\r\n}\r\n\r\nstatic lemma Lemma_HowOperationChangesExpressionStackWhenValidEquivalent(op:Operation, estack:seq)\r\n requires |estack| + StackSizeChangeFromOperation(op) >= 1;\r\n ensures HowOperationChangesExpressionStackWhenValid(op, estack) == HowOperationChangesExpressionStack(op, estack);\r\n{\r\n if op.OperationPush? {\r\n assert StackSizeChangeFromOperation(op) == 1;\r\n } else if op.OperationColumn? {\r\n assert StackSizeChangeFromOperation(op) == 0;\r\n } else if op.OperationBinary? {\r\n assert StackSizeChangeFromOperation(op) == -1;\r\n } else if op.OperationIf? {\r\n assert StackSizeChangeFromOperation(op) == -2;\r\n }\r\n}\r\n\r\nstatic function HowOperationChangesExpressionStack_premium(op:Operation, estack:seq):seq\r\n requires |estack| + StackSizeChangeFromOperation(op) >= 1;\r\n ensures HowOperationChangesExpressionStack_premium(op, estack) == HowOperationChangesExpressionStack(op, estack);\r\n{\r\n Lemma_HowOperationChangesExpressionStackWhenValidEquivalent(op, estack);\r\n HowOperationChangesExpressionStackWhenValid(op, estack)\r\n}\r\n\r\nstatic lemma Lemma_PrefixOfValidProgramPrefixIsValid(program:seq, k:int)\r\n requires ProgramPrefixValid(program);\r\n requires 1 <= k <= |program|;\r\n ensures ProgramPrefixValid(program[..k]);\r\n{\r\n var prefix := program[..k];\r\n assert forall i :: 1 <= i <= |prefix| ==> prefix[..i] == program[..i];\r\n}\r\n\r\nstatic lemma Lemma_PrefixesOfValidProgramPrefixesAreValid(program:seq)\r\n requires ProgramPrefixValid(program);\r\n ensures forall k :: 1 <= k <= |program| ==> ProgramPrefixValid(program[..k]);\r\n{\r\n forall k:int | 1 <= k <= |program|\r\n ensures ProgramPrefixValid(program[..k]);\r\n {\r\n Lemma_PrefixOfValidProgramPrefixIsValid(program, k);\r\n }\r\n}\r\n\r\nstatic lemma Lemma_StackSizeAfterRunningProgramPrefix(program:seq)\r\n requires ProgramPrefixValid(program);\r\n ensures |ProgramPrefixToExpressionStack(program)| == StackSizeAfterRunning(program);\r\n{\r\n reveal_ProgramPrefixToExpressionStack();\r\n Lemma_PrefixesOfValidProgramPrefixesAreValid(program);\r\n assert program[..|program|] == program;\r\n assert |program| == 1 ==> StackSizeAfterRunning(program[..0]) + StackSizeChangeFromOperation(program[|program|-1]) >= 1;\r\n assert |program| > 1 ==> StackSizeAfterRunning(program[..|program|-1]) + StackSizeChangeFromOperation(program[|program|-1]) >= 1;\r\n if |program| == 0 {\r\n }\r\n else if |program| == 1 {\r\n }\r\n else {\r\n calc {\r\n StackSizeAfterRunning(program);\r\n StackSizeAfterRunning(program[..|program| - 1]) + StackSizeChangeFromOperation(program[|program| - 1]);\r\n { Lemma_StackSizeAfterRunningProgramPrefix(program[..|program|-1]); }\r\n |ProgramPrefixToExpressionStack(program[..|program|-1])| + StackSizeChangeFromOperation(program[|program| - 1]);\r\n }\r\n\r\n calc {\r\n |ProgramPrefixToExpressionStack(program[..|program|-1])| + StackSizeChangeFromOperation(program[|program| - 1]);\r\n == StackSizeAfterRunning(program);\r\n >= 1;\r\n }\r\n\r\n calc {\r\n |ProgramPrefixToExpressionStack(program[..|program|-1])| + StackSizeChangeFromOperation(program[|program| - 1]);\r\n |HowOperationChangesExpressionStackWhenValid(program[|program|-1], ProgramPrefixToExpressionStack(program[..|program|-1]))|;\r\n { Lemma_HowOperationChangesExpressionStackWhenValidEquivalent(program[|program|-1], ProgramPrefixToExpressionStack(program[..|program|-1])); }\r\n |HowOperationChangesExpressionStack(program[|program|-1], ProgramPrefixToExpressionStack(program[..|program|-1]))|;\r\n |ProgramPrefixToExpressionStack(program)|;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma Lemma_ProgramPrefixToExpressionStackContainsOnlyWords(program:seq)\r\n requires ProgramPrefixValid(program);\r\n ensures ExpressionStackContainsOnlyWords(ProgramPrefixToExpressionStack(program));\r\n{\r\n Lemma_PrefixesOfValidProgramPrefixesAreValid(program);\r\n assert program[..|program|] == program;\r\n assert |program| == 1 ==> StackSizeAfterRunning(program[..0]) + StackSizeChangeFromOperation(program[|program|-1]) >= 1;\r\n assert |program| > 1 ==> StackSizeAfterRunning(program[..|program|-1]) + StackSizeChangeFromOperation(program[|program|-1]) >= 1;\r\n reveal_ProgramPrefixToExpressionStack();\r\n if |program| == 0 {\r\n }\r\n else {\r\n Lemma_ProgramPrefixToExpressionStackContainsOnlyWords(program[..|program|-1]);\r\n }\r\n}\r\n\r\nstatic lemma Lemma_EvaluateExpressionProducesWord(e:Expression, row:Row)\r\n requires ExpressionValid(e);\r\n requires RowValid(row);\r\n ensures Word32(EvaluateExpression(e, row));\r\n{\r\n if e.ExpInt? {\r\n }\r\n else if e.ExpColumn? {\r\n Lemma_EvaluateExpressionProducesWord(e.col, row);\r\n }\r\n else if e.ExpBinary? {\r\n Lemma_EvaluateExpressionProducesWord(e.e1, row);\r\n Lemma_EvaluateExpressionProducesWord(e.e2, row);\r\n Lemma_ApplyBinaryInstructionProducesWords(e.inst, EvaluateExpression(e.e1, row), EvaluateExpression(e.e2, row));\r\n }\r\n else if e.ExpIf? {\r\n Lemma_EvaluateExpressionProducesWord(e.e_cond, row);\r\n Lemma_EvaluateExpressionProducesWord(e.e_true, row);\r\n Lemma_EvaluateExpressionProducesWord(e.e_false, row);\r\n }\r\n}\r\n\r\nstatic function EvaluateExpression_premium(e:Expression, row:Row):int\r\n requires ExpressionValid(e);\r\n requires RowValid(row);\r\n ensures Word32(EvaluateExpression_premium(e, row));\r\n ensures EvaluateExpression_premium(e, row) == EvaluateExpression(e, row);\r\n{\r\n Lemma_EvaluateExpressionProducesWord(e, row);\r\n EvaluateExpression(e, row)\r\n}\r\n\r\nstatic lemma Lemma_ProgramToExpressionYieldsValidExpression(program:seq)\r\n requires ProgramValid(program);\r\n ensures ExpressionValid(ProgramToExpression(program));\r\n{\r\n var estack := ProgramPrefixToExpressionStack(program);\r\n Lemma_StackSizeAfterRunningProgramPrefix(program);\r\n assert |estack| == 1;\r\n Lemma_ProgramPrefixToExpressionStackContainsOnlyWords(program);\r\n}\r\n\r\nstatic function ProgramToExpression_premium(program:seq):Expression\r\n requires ProgramValid(program);\r\n ensures ExpressionValid(ProgramToExpression_premium(program));\r\n ensures ProgramToExpression_premium(program) == ProgramToExpression(program);\r\n{\r\n Lemma_ProgramToExpressionYieldsValidExpression(program);\r\n ProgramToExpression(program)\r\n}\r\n\r\nstatic lemma Lemma_MessageToProgramCreatesProgramOfOnlyWords(message:seq)\r\n requires forall i :: 0 <= i < |message| ==> Word32(message[i]);\r\n ensures ProgramContainsOnlyWords(MessageToProgram(message));\r\n{\r\n if |message| == 0 {\r\n }\r\n else {\r\n Lemma_MessageToProgramCreatesProgramOfOnlyWords(message[..|message|-1]);\r\n }\r\n}\r\n\r\nstatic function MessageToProgram_premium(message:seq):seq\r\n requires forall i :: 0 <= i < |message| ==> Word32(message[i]);\r\n ensures ProgramContainsOnlyWords(MessageToProgram_premium(message));\r\n ensures MessageToProgram_premium(message) == MessageToProgram(message);\r\n{\r\n Lemma_MessageToProgramCreatesProgramOfOnlyWords(message);\r\n MessageToProgram(message)\r\n}\r\n\r\nstatic lemma Lemma_EvaluateProgramProducesWord(program:seq, row:Row)\r\n requires ProgramValid(program);\r\n requires RowValid(row);\r\n ensures Word32(EvaluateProgram(program, row));\r\n{\r\n Lemma_ProgramToExpressionYieldsValidExpression(program);\r\n Lemma_EvaluateExpressionProducesWord(ProgramToExpression(program), row);\r\n}\r\n\r\nstatic function EvaluateProgram_premium(program:seq, row:Row):int\r\n requires ProgramValid(program);\r\n requires RowValid(row);\r\n ensures Word32(EvaluateProgram_premium(program, row));\r\n ensures EvaluateProgram_premium(program, row) == EvaluateProgram(program, row);\r\n{\r\n Lemma_EvaluateProgramProducesWord(program, row);\r\n EvaluateProgram(program, row)\r\n}\r\n\r\n//-//////////////////////////////////////////////////////////////////////\r\n//- Methods\r\n//-//////////////////////////////////////////////////////////////////////\r\n\r\nstatic method DetermineIfProgramIsValid(program:seq) returns (ret:bool)\r\n requires ProgramContainsOnlyWords(program);\r\n ensures ret == ProgramValid(program);\r\n{\r\n var k := 0;\r\n var stack_size := 0;\r\n\r\n while k < |program|\r\n invariant 0 <= k <= |program|;\r\n invariant stack_size == StackSizeAfterRunning(program[..k]);\r\n invariant forall i :: 1 <= i <= k ==> StackSizeAfterRunning(program[..i]) >= 1;\r\n {\r\n //- stack_size := stack_size + StackSizeChangeFromOperation(program[k]); //- dafnycc TODO: signed arithmetic\r\n match program[k]\r\n {\r\n case OperationPush(i) => stack_size := stack_size + 1;\r\n case OperationColumn => {}\r\n case OperationBinary(inst) => stack_size := stack_size - 1;\r\n case OperationIf => stack_size := stack_size - 2;\r\n }\r\n assert program[..k] + [program[k]] == program[..k+1];\r\n k := k + 1;\r\n assert StackSizeAfterRunning(program[..k]) == stack_size;\r\n if stack_size < 1\r\n {\r\n return false;\r\n }\r\n }\r\n\r\n assert program[..k] == program;\r\n return stack_size == 1;\r\n}\r\n\r\nstatic method ConvertMessageToProgram(message:seq) returns (ret:seq)\r\n requires forall i :: 0 <= i < |message| ==> Word32(message[i]);\r\n ensures ProgramContainsOnlyWords(ret);\r\n ensures ret == MessageToProgram(message);\r\n{\r\n var i := 0;\r\n ret := [];\r\n\r\n while i < |message|\r\n invariant 0 <= i <= |message|;\r\n invariant ProgramContainsOnlyWords(ret);\r\n invariant ret == MessageToProgram(message[..i]);\r\n {\r\n ret := ret + [WordToOperation(message[i])];\r\n assert message[..i] + [message[i]] == message[..i+1];\r\n i := i + 1;\r\n }\r\n\r\n assert message[..i] == message;\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} RunOneInstructionPush(program:seq, row:Row, k:int, stack:seq, ghost estack:seq, i:int)\r\n returns (new_stack:seq, ghost new_estack:seq)\r\n requires ProgramValid(program);\r\n requires RowValid(row);\r\n requires 0 <= k < |program|;\r\n requires |stack| == StackSizeAfterRunning(program[..k]);\r\n requires |estack| == |stack|;\r\n requires estack == ProgramPrefixToExpressionStack(program[..k]);\r\n requires forall i :: 0 <= i < |stack| ==> Word32(stack[i]);\r\n requires forall i :: 0 <= i < |estack| ==> ExpressionValid(estack[i]);\r\n requires forall i :: 0 <= i < |stack| ==> stack[i] == EvaluateExpression_premium(estack[i], row);\r\n requires program[k] == OperationPush(i);\r\n\r\n ensures |new_stack| == StackSizeAfterRunning(program[..k+1]);\r\n ensures |new_estack| == |new_stack|;\r\n ensures new_estack == ProgramPrefixToExpressionStack(program[..k+1]);\r\n ensures forall i :: 0 <= i < |new_stack| ==> Word32(new_stack[i]);\r\n ensures forall i :: 0 <= i < |new_estack| ==> ExpressionValid(new_estack[i]);\r\n ensures forall i :: 0 <= i < |new_stack| ==> new_stack[i] == EvaluateExpression_premium(new_estack[i], row);\r\n{\r\n assert program[..k+1] == program[..k] + [program[k]];\r\n\r\n new_estack := estack + [ExpInt(i)];\r\n new_stack := stack + [i];\r\n reveal_ProgramPrefixToExpressionStack();\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} RunOneInstructionColumn(program:seq, row:Row, k:int, stack:seq, ghost estack:seq)\r\n returns (new_stack:seq, ghost new_estack:seq)\r\n requires ProgramValid(program);\r\n requires RowValid(row);\r\n requires 0 <= k < |program|;\r\n requires |stack| == StackSizeAfterRunning(program[..k]);\r\n requires |estack| == |stack|;\r\n requires estack == ProgramPrefixToExpressionStack(program[..k]);\r\n requires forall i :: 0 <= i < |stack| ==> Word32(stack[i]);\r\n requires forall i :: 0 <= i < |estack| ==> ExpressionValid(estack[i]);\r\n requires forall i :: 0 <= i < |stack| ==> stack[i] == EvaluateExpression_premium(estack[i], row);\r\n requires program[k] == OperationColumn;\r\n\r\n ensures |new_stack| == StackSizeAfterRunning(program[..k+1]);\r\n ensures |new_estack| == |new_stack|;\r\n ensures new_estack == ProgramPrefixToExpressionStack(program[..k+1]);\r\n ensures forall i :: 0 <= i < |new_stack| ==> Word32(new_stack[i]);\r\n ensures forall i :: 0 <= i < |new_estack| ==> ExpressionValid(new_estack[i]);\r\n ensures forall i :: 0 <= i < |new_stack| ==> new_stack[i] == EvaluateExpression_premium(new_estack[i], row);\r\n{\r\n assert program[..k+1] == program[..k] + [program[k]];\r\n\r\n new_estack := estack[..|estack|-1] + [ExpColumn(estack[|estack|-1])];\r\n new_stack := stack[..|stack|-1] + [ExtractColumn(stack[|stack|-1], row)];\r\n reveal_ProgramPrefixToExpressionStack();\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} RunOneInstructionBinary(program:seq, row:Row, k:int, stack:seq, ghost estack:seq, inst:BinaryInstruction)\r\n returns (new_stack:seq, ghost new_estack:seq)\r\n requires ProgramValid(program);\r\n requires RowValid(row);\r\n requires 0 <= k < |program|;\r\n requires |stack| == StackSizeAfterRunning(program[..k]);\r\n requires |estack| == |stack|;\r\n requires estack == ProgramPrefixToExpressionStack(program[..k]);\r\n requires forall i :: 0 <= i < |stack| ==> Word32(stack[i]);\r\n requires forall i :: 0 <= i < |estack| ==> ExpressionValid(estack[i]);\r\n requires forall i :: 0 <= i < |stack| ==> stack[i] == EvaluateExpression_premium(estack[i], row);\r\n requires program[k] == OperationBinary(inst);\r\n\r\n ensures |new_stack| == StackSizeAfterRunning(program[..k+1]);\r\n ensures |new_estack| == |new_stack|;\r\n ensures new_estack == ProgramPrefixToExpressionStack(program[..k+1]);\r\n ensures forall i :: 0 <= i < |new_stack| ==> Word32(new_stack[i]);\r\n ensures forall i :: 0 <= i < |new_estack| ==> ExpressionValid(new_estack[i]);\r\n ensures forall i :: 0 <= i < |new_stack| ==> new_stack[i] == EvaluateExpression_premium(new_estack[i], row);\r\n{\r\n assert program[..k+1] == program[..k] + [program[k]];\r\n\r\n new_estack := estack[..|estack| - 2] + [ExpBinary(inst, estack[|estack| - 2], estack[|estack| - 1])];\r\n var result := ApplyBinaryInstructionImpl(inst, stack[|stack| - 2], stack[|stack| - 1]);\r\n new_stack := stack[..|stack| - 2] + [result];\r\n reveal_ProgramPrefixToExpressionStack();\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} RunOneInstructionIf(program:seq, row:Row, k:int, stack:seq, ghost estack:seq)\r\n returns (new_stack:seq, ghost new_estack:seq)\r\n requires ProgramValid(program);\r\n requires RowValid(row);\r\n requires 0 <= k < |program|;\r\n requires |stack| == StackSizeAfterRunning(program[..k]);\r\n requires |estack| == |stack|;\r\n requires estack == ProgramPrefixToExpressionStack(program[..k]);\r\n requires forall i :: 0 <= i < |stack| ==> Word32(stack[i]);\r\n requires forall i :: 0 <= i < |estack| ==> ExpressionValid(estack[i]);\r\n requires forall i :: 0 <= i < |stack| ==> stack[i] == EvaluateExpression_premium(estack[i], row);\r\n requires program[k] == OperationIf;\r\n\r\n ensures |new_stack| == StackSizeAfterRunning(program[..k+1]);\r\n ensures |new_estack| == |new_stack|;\r\n ensures new_estack == ProgramPrefixToExpressionStack(program[..k+1]);\r\n ensures forall i :: 0 <= i < |new_stack| ==> Word32(new_stack[i]);\r\n ensures forall i :: 0 <= i < |new_estack| ==> ExpressionValid(new_estack[i]);\r\n ensures forall i :: 0 <= i < |new_stack| ==> new_stack[i] == EvaluateExpression_premium(new_estack[i], row);\r\n{\r\n assert program[..k+1] == program[..k] + [program[k]];\r\n\r\n new_estack := estack[..|estack| - 3] + [ExpIf(estack[|estack|-3], estack[|estack| - 2], estack[|estack| - 1])];\r\n new_stack := stack[..|stack| - 3] + [if stack[|stack|-3] != 0 then stack[|stack| - 2] else stack[|stack| - 1]];\r\n reveal_ProgramPrefixToExpressionStack();\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} RunOneInstruction(program:seq, row:Row, k:int, stack:seq, ghost estack:seq)\r\n returns (new_stack:seq, ghost new_estack:seq)\r\n requires ProgramValid(program);\r\n requires RowValid(row);\r\n requires 0 <= k < |program|;\r\n requires |stack| == StackSizeAfterRunning(program[..k]);\r\n requires |estack| == |stack|;\r\n requires estack == ProgramPrefixToExpressionStack(program[..k]);\r\n requires forall i :: 0 <= i < |stack| ==> Word32(stack[i]);\r\n requires forall i :: 0 <= i < |estack| ==> ExpressionValid(estack[i]);\r\n requires forall i :: 0 <= i < |stack| ==> stack[i] == EvaluateExpression_premium(estack[i], row);\r\n\r\n ensures |new_stack| == StackSizeAfterRunning(program[..k+1]);\r\n ensures |new_estack| == |new_stack|;\r\n ensures new_estack == ProgramPrefixToExpressionStack(program[..k+1]);\r\n ensures forall i :: 0 <= i < |new_stack| ==> Word32(new_stack[i]);\r\n ensures forall i :: 0 <= i < |new_estack| ==> ExpressionValid(new_estack[i]);\r\n ensures forall i :: 0 <= i < |new_stack| ==> new_stack[i] == EvaluateExpression_premium(new_estack[i], row);\r\n{\r\n assert program[..k+1] == program[..k] + [program[k]];\r\n\r\n match program[k]\r\n {\r\n case OperationPush(i) =>\r\n new_stack, new_estack := RunOneInstructionPush(program, row, k, stack, estack, i);\r\n\r\n case OperationColumn =>\r\n new_stack, new_estack := RunOneInstructionColumn(program, row, k, stack, estack);\r\n\r\n case OperationBinary(inst) =>\r\n new_stack, new_estack := RunOneInstructionBinary(program, row, k, stack, estack, inst);\r\n\r\n case OperationIf =>\r\n new_stack, new_estack := RunOneInstructionIf(program, row, k, stack, estack);\r\n }\r\n}\r\n\r\nstatic lemma lemma_EmptyProgramPrefixToExpressionStack(program:seq)\r\n ensures ProgramPrefixToExpressionStack(program[..0]) == [];\r\n{\r\n reveal_ProgramPrefixToExpressionStack();\r\n}\r\n\r\nstatic method RunProgram(program:seq, row:Row) returns(ret:int)\r\n requires ProgramValid(program);\r\n requires RowValid(row);\r\n ensures ret == EvaluateExpression_premium(ProgramToExpression_premium(program), row);\r\n ensures Word32(ret);\r\n{\r\n var stack:seq := [];\r\n var k:int := 0;\r\n\r\n ghost var estack:seq := [];\r\n\r\n Lemma_PrefixesOfValidProgramPrefixesAreValid(program);\r\n lemma_EmptyProgramPrefixToExpressionStack(program);\r\n while (k < |program|)\r\n invariant 0 <= k <= |program|;\r\n invariant |stack| == StackSizeAfterRunning(program[..k]);\r\n invariant |estack| == |stack|;\r\n invariant estack == ProgramPrefixToExpressionStack(program[..k]);\r\n invariant forall i :: 0 <= i < |stack| ==> Word32(stack[i]);\r\n invariant forall i :: 0 <= i < |estack| ==> ExpressionValid(estack[i]);\r\n invariant forall i :: 0 <= i < |stack| ==> stack[i] == EvaluateExpression_premium(estack[i], row);\r\n {\r\n stack, estack := RunOneInstruction(program, row, k, stack, estack);\r\n k := k + 1;\r\n }\r\n\r\n assert program == program[..|program|];\r\n assert |stack| == 1;\r\n ret := stack[0];\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/Mapper.s.dfy", "content": "include \"../../Drivers/CPU/assembly.s.dfy\"\r\ninclude \"Database.s.dfy\"\r\n\r\n//-/////////////////////////////////////////\r\n//- Binary instructions\r\n//-/////////////////////////////////////////\r\n\r\ndatatype BinaryInstruction = InstAdd | InstSub | InstMul | InstDiv | InstMod | InstGt | InstLt | InstEq | InstGe | InstLe\r\n\r\nstatic function method BooleanToInt(b:bool):int\r\n{\r\n if b then 1 else 0\r\n}\r\n\r\nstatic function{:opaque} Mod0x100000000(i:int):int { i % 0x100000000 }\r\n\r\nstatic function{:opaque} ApplyBinaryInstruction(inst:BinaryInstruction, v1:int, v2:int):int\r\n{\r\n match inst\r\n case InstAdd => Mod0x100000000(v1 + v2)\r\n case InstSub => Mod0x100000000(v1 - v2)\r\n case InstMul => Mod0x100000000(v1 * v2)\r\n case InstDiv => if v2 == 0 then 0 else Mod0x100000000(v1 / v2)\r\n case InstMod => if v2 == 0 then 0 else Mod0x100000000(v1 % v2)\r\n case InstGt => BooleanToInt(v1 > v2)\r\n case InstLt => BooleanToInt(v1 < v2)\r\n case InstEq => BooleanToInt(v1 == v2)\r\n case InstGe => BooleanToInt(v1 >= v2)\r\n case InstLe => BooleanToInt(v1 <= v2)\r\n}\r\n\r\n//-/////////////////////////////////////////\r\n//- Expressions\r\n//-/////////////////////////////////////////\r\n\r\ndatatype Expression = ExpInt(i:int)\r\n | ExpColumn(col:Expression)\r\n | ExpBinary(inst:BinaryInstruction, e1:Expression, e2:Expression)\r\n | ExpIf(e_cond:Expression, e_true:Expression, e_false:Expression)\r\n\r\nstatic predicate ExpressionValid(e:Expression)\r\n{\r\n match e\r\n case ExpInt(i) => Word32(i)\r\n case ExpColumn(e1) => ExpressionValid(e1)\r\n case ExpBinary(inst, e1, e2) => ExpressionValid(e1) && ExpressionValid(e2)\r\n case ExpIf(e1, e2, e3) => ExpressionValid(e1) && ExpressionValid(e2) && ExpressionValid(e3)\r\n}\r\n\r\nstatic predicate ExpressionStackContainsOnlyWords(estack:seq)\r\n{\r\n forall i:int :: 0 <= i < |estack| ==> ExpressionValid(estack[i])\r\n}\r\n\r\nstatic function EvaluateExpression(e:Expression, row:Row):int\r\n{\r\n match e\r\n case ExpInt(i) => i\r\n case ExpColumn(e1) => ExtractColumn(EvaluateExpression(e1, row), row)\r\n case ExpBinary(inst, e1, e2) => ApplyBinaryInstruction(inst, EvaluateExpression(e1, row), EvaluateExpression(e2, row))\r\n case ExpIf(e_cond, e_true, e_false) =>\r\n if EvaluateExpression(e_cond, row) != 0 then EvaluateExpression(e_true, row) else EvaluateExpression(e_false, row)\r\n}\r\n\r\n//-/////////////////////////////////////////\r\n//- Operations\r\n//-/////////////////////////////////////////\r\n\r\nstatic function method ExtractColumn(column_index:int, row:Row):int\r\n{\r\n if 0 <= column_index < |row.data| then row.data[column_index] else 0\r\n}\r\n\r\ndatatype Operation = OperationPush(i:int)\r\n | OperationColumn\r\n | OperationBinary(inst:BinaryInstruction)\r\n | OperationIf\r\n\r\nstatic predicate OperationValid(op:Operation)\r\n{\r\n if op.OperationPush? then Word32(op.i) else true\r\n}\r\n\r\nstatic function method StackSizeChangeFromOperation(t:Operation):int\r\n{\r\n match t\r\n case OperationPush(_) => 1\r\n case OperationColumn => 0\r\n case OperationBinary(_) => -1\r\n case OperationIf => -2\r\n}\r\n\r\n///////////////////////////////////////////\r\n\r\n///////////////////////////////////////////\r\n\r\nstatic predicate ProgramContainsOnlyWords(program:seq)\r\n{\r\n forall k :: 0 <= k < |program| ==> OperationValid(program[k])\r\n}\r\n\r\n///////////////////////////////////////////\r\n\r\n///////////////////////////////////////////\r\n\r\nstatic function HowOperationChangesExpressionStack(op:Operation, estack:seq):seq\r\n{\r\n match op\r\n case OperationPush(i) => estack + [ExpInt(i)]\r\n case OperationColumn => if |estack| >= 1 then estack[..|estack|-1] + [ExpColumn(estack[|estack|-1])] else []\r\n case OperationBinary(inst) => if |estack| >= 2 then estack[..|estack|-2] + [ExpBinary(inst, estack[|estack| - 2], estack[|estack| - 1])] else []\r\n case OperationIf => if |estack| >= 3 then estack[..|estack|-3] + [ExpIf(estack[|estack|-3], estack[|estack| - 2], estack[|estack| - 1])] else []\r\n}\r\n\r\nstatic function StackSizeAfterRunning(program:seq):int\r\n{\r\n if |program| == 0 then 0\r\n else StackSizeAfterRunning(program[..|program| - 1]) + StackSizeChangeFromOperation(program[|program| - 1])\r\n}\r\n\r\nstatic predicate ProgramPrefixValid(program:seq)\r\n{\r\n ProgramContainsOnlyWords(program) &&\r\n forall k :: 1 <= k <= |program| ==> StackSizeAfterRunning(program[..k]) >= 1\r\n}\r\n\r\nstatic predicate ProgramValid(program:seq)\r\n{\r\n ProgramPrefixValid(program) && StackSizeAfterRunning(program) == 1\r\n}\r\n\r\nstatic function {:opaque} ProgramPrefixToExpressionStack(program:seq):seq\r\n{\r\n if |program| == 0 then\r\n []\r\n else\r\n HowOperationChangesExpressionStack(program[|program|-1], ProgramPrefixToExpressionStack(program[..|program|-1]))\r\n}\r\n\r\nstatic function ProgramToExpression(program:seq):Expression\r\n{\r\n var estack := ProgramPrefixToExpressionStack(program);\r\n if |estack| == 1 then estack[0] else ExpInt(0)\r\n}\r\n\r\nstatic function EvaluateProgram(program:seq, row:Row):int\r\n{\r\n EvaluateExpression(ProgramToExpression(program), row)\r\n}\r\n\r\n///////////////////////////////////////////\r\n\r\n///////////////////////////////////////////\r\n\r\nstatic function method WordToOperation(w:int):Operation\r\n requires Word32(w);\r\n{\r\n if w == 2000000001 then OperationColumn\r\n else if w == 2000000002 then OperationIf\r\n else if w == 2000000003 then OperationBinary(InstAdd)\r\n else if w == 2000000004 then OperationBinary(InstSub)\r\n else if w == 2000000005 then OperationBinary(InstMul)\r\n else if w == 2000000006 then OperationBinary(InstDiv)\r\n else if w == 2000000007 then OperationBinary(InstMod)\r\n else if w == 2000000008 then OperationBinary(InstGt)\r\n else if w == 2000000009 then OperationBinary(InstLt)\r\n else if w == 2000000010 then OperationBinary(InstEq)\r\n else if w == 2000000011 then OperationBinary(InstGe)\r\n else if w == 2000000012 then OperationBinary(InstLe)\r\n else OperationPush(w)\r\n}\r\n\r\nstatic function MessageToProgram(message:seq):seq\r\n requires IsWordSeq(message);\r\n{\r\n if |message| == 0 then [] else MessageToProgram(message[..|message|-1]) + [WordToOperation(message[|message|-1])]\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/Math.s.dfy", "content": "include \"../../Libraries/Math/round.s.dfy\"\r\n\r\nstatic function method Clip (value:int, min:int, max:int):int\r\n requires min <= max;\r\n ensures min <= Clip(value, min, max) <= max;\r\n{\r\n if value < min then min else if value > max then max else value\r\n}\r\n\r\nstatic function method Scale (value:int, units:int) : int\r\n requires units > 0;\r\n{\r\n (value / units) + (if (value % units) * 2 >= units then 1 else 0)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/Noise.i.dfy", "content": "//-\r\n//- \r\n//- \r\ninclude \"Noise.s.dfy\"\r\ninclude \"../../Libraries/BigNum/BigRat.i.dfy\"\r\ninclude \"../../Libraries/Math/round.i.dfy\"\r\ninclude \"../../Libraries/Util/arrays_and_seqs.i.dfy\"\r\ninclude \"../../Libraries/Util/seqs_and_ints.i.dfy\"\r\ninclude \"../../Libraries/BigNum/BigNumBEAdaptor.i.dfy\"\r\ninclude \"ErrorCodes.i.dfy\"\r\n\r\ndatatype DiffPrivParametersImpl = DiffPrivParametersImpl_ctor(alpha:BigRat, beta:BigRat, delta:int, B:int);\r\n\r\nstatic function WellformedDiffPrivParameters (p:DiffPrivParametersImpl) : bool\r\n{\r\n WellformedBigRat(p.alpha) && WellformedBigRat(p.beta) && Word32(p.delta) && Word32(p.B)\r\n}\r\n\r\nstatic function DiffPrivParametersImplToSpec (p:DiffPrivParametersImpl) : DiffPrivParameters\r\n requires WellformedDiffPrivParameters(p);\r\n{\r\n DiffPrivParameters_ctor(RV(p.alpha), RV(p.beta), p.delta, p.B)\r\n}\r\n\r\nmethod BigRatPower(x:BigRat, e:int) returns (r:BigRat)\r\n requires WellformedBigRat(x);\r\n requires e >= 0;\r\n ensures WellformedBigRat(r);\r\n ensures RV(r) == RealPower(RV(x), e);\r\n{\r\n r := MakeSmallLiteralBigRat(1);\r\n\r\n var k := 0;\r\n while k < e\r\n invariant 0 <= k <= e;\r\n invariant WellformedBigRat(r);\r\n invariant RV(r) == RealPower(RV(x), k);\r\n {\r\n r := BigRatMul(r, x);\r\n k := k + 1;\r\n }\r\n}\r\n\r\nmethod BigRatMin (a:BigRat, b:BigRat) returns (r:BigRat)\r\n requires WellformedBigRat(a);\r\n requires WellformedBigRat(b);\r\n ensures WellformedBigRat(r);\r\n ensures RV(r) == RealMin(RV(a), RV(b));\r\n{\r\n var a_less_than_b:bool := BigRatLt(a, b);\r\n if (a_less_than_b) {\r\n r := a;\r\n }\r\n else {\r\n r := b;\r\n }\r\n}\r\n\r\nmethod {:timeLimitMultiplier 2} FindHigherPowerOfTwo (y:BigRat) returns (success:bool, x:nat)\r\n requires WellformedBigRat(y);\r\n ensures Word32(x);\r\n ensures success ==> real(power2(x)) >= RV(y);\r\n\r\n requires public(RV(y));\r\n ensures public(success);\r\n ensures public(x);\r\n{\r\n lemma_2toX();\r\n reveal_power2();\r\n\r\n x := 0;\r\n var two_to_x:BigNat := MakeSmallLiteralBigNat(1);\r\n var two:BigNat := MakeSmallLiteralBigNat(2);\r\n\r\n while x < 0xFFFFFFFF\r\n invariant Word32(x);\r\n invariant WellformedBigNat(two_to_x);\r\n invariant I(two_to_x) == power2(x);\r\n invariant public(RV(y));\r\n invariant public(x);\r\n invariant public(I(two_to_x));\r\n invariant public(I(two));\r\n {\r\n var done:bool := BigRatGe(BigNatToBigRat(two_to_x), y);\r\n if (done) {\r\n success := true;\r\n return;\r\n }\r\n ghost var old_two_to_x := two_to_x;\r\n two_to_x := BigNatMul(two, two_to_x);\r\n calc {\r\n I(two_to_x);\r\n I(two) * I(old_two_to_x);\r\n I(two) * power2(x);\r\n { lemma_mul_is_mul_boogie(I(two), power2(x)); }\r\n 2 * power2(x);\r\n power2(x+1);\r\n }\r\n x := x + 1;\r\n }\r\n\r\n //- At the end of the loop, handle the case of x == 0xFFFFFFFF.\r\n\r\n success := BigRatGe(BigNatToBigRat(two_to_x), y);\r\n}\r\n\r\nmethod DetermineIfDiffPrivParametersValid (p:DiffPrivParametersImpl) returns (error_code:int)\r\n requires WellformedDiffPrivParameters(p);\r\n requires p.delta >= 0;\r\n ensures Word32(error_code);\r\n ensures error_code == 0 <==> DiffPrivParametersValid(DiffPrivParametersImplToSpec(p));\r\n\r\n requires public(p);\r\n ensures public(error_code);\r\n{\r\n lemma_2toX();\r\n\r\n if p.B <= 0 {\r\n error_code := ErrorAnswerRangeNotPositive();\r\n return;\r\n }\r\n\r\n var One := MakeSmallLiteralBigRat(1);\r\n var AlphaLeOne:bool := BigRatLe(p.alpha, One);\r\n if (AlphaLeOne) {\r\n error_code := ErrorAlphaNotGreaterThanOne();\r\n return;\r\n }\r\n\r\n var AlphaToDelta := BigRatPower(p.alpha, p.delta);\r\n var BetaLeAlphaToDelta := BigRatLe(p.beta, AlphaToDelta);\r\n if (BetaLeAlphaToDelta) {\r\n error_code := ErrorBetaNotGreaterThanAlphaToPowerOfSensitivity();\r\n return;\r\n }\r\n\r\n Lemma_RealPowerPreservesGeOne(RV(p.alpha), p.delta);\r\n error_code := 0;\r\n}\r\n\r\nmethod {:timeLimitMultiplier 6} ComputeRequiredNoiseEntropyPart1 (p:DiffPrivParametersImpl) returns (entropy:BigRat)\r\n requires WellformedDiffPrivParameters(p);\r\n requires DiffPrivParametersValid(DiffPrivParametersImplToSpec(p));\r\n ensures WellformedBigRat(entropy);\r\n ensures RV(entropy) == RequiredNoiseEntropyPart1(DiffPrivParametersImplToSpec(p));\r\n ensures RV(entropy) > 0.0;\r\n{\r\n lemma_2toX();\r\n var One := MakeSmallLiteralBigRat(1);\r\n var Two := MakeSmallLiteralBigRat(2);\r\n var AlphaPlusOne := BigRatAdd(p.alpha, One);\r\n var BetaPlusOne := BigRatAdd(p.beta, One);\r\n var AlphaToDelta := BigRatPower(p.alpha, p.delta);\r\n var BetaMinusAlphaToDelta := BigRatSub(p.beta, AlphaToDelta);\r\n var Numerator := BigRatMul(AlphaPlusOne, BetaPlusOne);\r\n var AlphaMinusOne := BigRatSub(p.alpha, One);\r\n var MinAlphaMinusOneAndTwo := BigRatMin(AlphaMinusOne, Two);\r\n var Denominator := BigRatMul(BetaMinusAlphaToDelta, MinAlphaMinusOneAndTwo);\r\n entropy := BigRatDiv(Numerator, Denominator);\r\n\r\n Lemma_RequiredNoiseEntropyPart1Correct(DiffPrivParametersImplToSpec(p), RV(AlphaPlusOne), RV(BetaPlusOne),\r\n RV(One), RV(Two), RV(AlphaToDelta), RV(BetaMinusAlphaToDelta),\r\n RV(Numerator), RV(AlphaMinusOne), RV(MinAlphaMinusOneAndTwo), RV(Denominator), RV(entropy));\r\n}\r\n\r\nmethod ComputeBytesForNoiseGeneration (p:DiffPrivParametersImpl) returns (error_code:int, bytes:nat)\r\n requires WellformedDiffPrivParameters(p);\r\n requires DiffPrivParametersValid(DiffPrivParametersImplToSpec(p));\r\n ensures Word32(error_code);\r\n ensures error_code == 0 ==> Word32((bytes-1)*8+1);\r\n ensures error_code == 0 ==> SufficientBytesForNoiseGeneration(DiffPrivParametersImplToSpec(p), bytes);\r\n ensures error_code != 0 ==> bytes == 0;\r\n\r\n requires public(p);\r\n ensures public(error_code);\r\n ensures public(bytes);\r\n{\r\n lemma_2toX();\r\n reveal_power2();\r\n\r\n var entropy_part_1 := ComputeRequiredNoiseEntropyPart1(p);\r\n var success, r1 := FindHigherPowerOfTwo(entropy_part_1);\r\n if !success || r1 >= 0xFFFFFFE0 {\r\n error_code := ErrorRequiresTooManyBitsOfRandomness();\r\n bytes := 0;\r\n return;\r\n }\r\n\r\n var log_alpha:nat;\r\n success, log_alpha := FindHigherPowerOfTwo(p.alpha);\r\n if !success || log_alpha > 0xFFFFFFFF / p.B {\r\n error_code := ErrorRequiresTooManyBitsOfRandomness();\r\n bytes := 0;\r\n return;\r\n }\r\n lemma_mul_nonnegative(log_alpha, p.B-1);\r\n var r2:nat := log_alpha * (p.B-1);\r\n Lemma_SufficientR2(RV(p.alpha), p.B, log_alpha, r2);\r\n\r\n if r2 >= 0xFFFFFFC8 - r1 {\r\n error_code := ErrorRequiresTooManyBitsOfRandomness();\r\n bytes := 0;\r\n return;\r\n }\r\n\r\n error_code := 0;\r\n var min_r := r1 + r2 + 7; //- need 7 extra bits so we can use an entire byte for the sign bit\r\n bytes := TurnSufficientBitsIntoSufficientBytes(min_r);\r\n Lemma_RealPowerPreservesPositivity(RV(p.alpha), p.B-1);\r\n Lemma_BreakdownOfSufficientBytesForNoiseGeneration(DiffPrivParametersImplToSpec(p), r1, r2, bytes);\r\n}\r\n\r\nstatic method TurnSufficientBitsIntoSufficientBytes (min_r:nat) returns (bytes:int)\r\n requires min_r < 0xFFFFFFD0;\r\n ensures Word32((bytes-1)*8+1);\r\n ensures bytes >= 1;\r\n ensures ModuloFour(bytes) == 1;\r\n ensures bytes * 8 >= min_r;\r\n\r\n requires public(min_r);\r\n ensures public(bytes);\r\n{\r\n reveal_ModuloFour();\r\n\r\n var r:int := RoundUpToMultiple(min_r, 8);\r\n assert r == RoundUpToMultiple_premium(min_r, 8);\r\n lemma_mod_is_mod_boogie(r, 8);\r\n var bytes1:int := r / 8;\r\n var bytes2:int := RoundUpToMultiple(bytes1, 4);\r\n assert bytes2 == RoundUpToMultiple_premium(bytes1, 4);\r\n lemma_mod_is_mod_boogie(bytes2, 4);\r\n bytes := bytes2 + 1;\r\n lemma_mod_is_mod_boogie(bytes2, 4);\r\n\r\n calc {\r\n (bytes-1)*8 + 1;\r\n bytes2 * 8 + 1;\r\n < (bytes1 + 4) * 8 + 1;\r\n bytes1 * 8 + 33;\r\n (r / 8) * 8 + 33;\r\n <= ((min_r + 8) / 8) * 8 + 33;\r\n < ((0xFFFFFFD0 + 8) / 8) * 8 + 33;\r\n < 0xFFFFFFFF;\r\n < { lemma_2toX(); reveal_power2(); }\r\n power2(32);\r\n }\r\n}\r\n\r\nmethod BigNatPower2 (e:nat) returns (r:BigNat)\r\n requires Word32(e+1);\r\n ensures WellformedBigNat(r);\r\n ensures I(r) == power2(e);\r\n{\r\n lemma_2toX();\r\n reveal_power2();\r\n var One := MakeSmallLiteralBigNat(1);\r\n ghost var rc:nat;\r\n r, rc := BigNatBitShift_(One, 1, e);\r\n lemma_mul_is_mul_boogie(power2(e), I(One));\r\n}\r\n\r\nmethod FindHighestPowerLeThreshold (alpha:BigRat, threshold:BigRat, max_power:nat, ghost u:BigRat) returns (e:nat)\r\n requires WellformedBigRat(alpha);\r\n requires WellformedBigRat(threshold);\r\n requires Word32(max_power);\r\n requires WellformedBigRat(u);\r\n requires RV(u) > 0.0;\r\n requires RV(alpha) > 1.0;\r\n requires RV(threshold) >= 1.0;\r\n requires RV(threshold) == NoiseThreshold(RV(alpha), RV(u));\r\n ensures RealPower(RV(alpha), e) <= RV(threshold);\r\n ensures e == max_power || RealPower(RV(alpha), e+1) > RV(threshold);\r\n ensures Word32(e);\r\n ensures RV(threshold) == NoiseThreshold(RV(alpha), RV(u));\r\n{\r\n var alpha_to_e := MakeSmallLiteralBigRat(1);\r\n e := 0;\r\n\r\n while e < max_power\r\n invariant 0 <= e <= max_power;\r\n invariant WellformedBigRat(alpha_to_e);\r\n invariant RV(alpha_to_e) == RealPower(RV(alpha), e);\r\n invariant RV(alpha_to_e) <= RV(threshold);\r\n {\r\n alpha_to_e := BigRatMul(alpha, alpha_to_e);\r\n var done := BigRatGt(alpha_to_e, threshold);\r\n if (done) {\r\n assert RealPower(RV(alpha), e+1) == RV(alpha_to_e) > RV(threshold);\r\n return;\r\n }\r\n e := e + 1;\r\n }\r\n}\r\n\r\nmethod {:timeLimitMultiplier 6} DeriveRandomValues (randoms:seq) returns (negate_noise:bool, u:BigRat)\r\n requires |randoms| > 0;\r\n requires Word32((|randoms|-1) * 8 + 1);\r\n requires IsByteSeq(randoms);\r\n ensures WellformedBigRat(u);\r\n ensures negate_noise == ShouldNegateNoise(randoms[0]);\r\n ensures RV(u) == GetUniformBetweenZeroAndOne(randoms[1..]);\r\n ensures 0.0 < RV(u) <= 1.0;\r\n{\r\n reveal_ShouldNegateNoise();\r\n\r\n negate_noise := (randoms[0] % 2 == 1);\r\n\r\n lemma_2toX();\r\n var U:BigNat := BEByteSeqToBigNat(randoms[1..]);\r\n assert I(U) == BEByteSeqToInt(randoms[1..]);\r\n var OneHalf:BigRat := BigRat_ctor(MakeSmallLiteralBigNum(1), MakeSmallLiteralBigNat(2));\r\n var Numerator:BigRat := BigRatAdd(BigNatToBigRat(U), OneHalf);\r\n var Denominator:BigNat := BigNatPower2((|randoms|-1)*8);\r\n u := BigRatDiv(Numerator, BigNatToBigRat(Denominator));\r\n assert WellformedBigRat(u);\r\n\r\n Lemma_RandomDerivationsCorrect(randoms, RV(u), negate_noise, I(U), RV(OneHalf), RV(Numerator), I(Denominator));\r\n}\r\n\r\nmethod ComputeNoiseThreshold (alpha:BigRat, u:BigRat) returns (Threshold:BigRat)\r\n requires WellformedBigRat(alpha);\r\n requires WellformedBigRat(u);\r\n requires RV(alpha) > 1.0;\r\n requires 0.0 < RV(u) <= 1.0;\r\n ensures WellformedBigRat(Threshold);\r\n ensures RV(Threshold) == NoiseThreshold(RV(alpha), RV(u));\r\n ensures RV(Threshold) >= 1.0;\r\n{\r\n lemma_2toX();\r\n\r\n var ThresholdNumerator := BigRatMul(MakeSmallLiteralBigRat(2), alpha);\r\n var AlphaPlusOne := BigRatAdd(alpha, MakeSmallLiteralBigRat(1));\r\n var ThresholdDenominator := BigRatMul(u, AlphaPlusOne);\r\n\r\n Threshold := BigRatDiv(ThresholdNumerator, ThresholdDenominator);\r\n Lemma_ThresholdCorrect(RV(alpha), RV(u), RV(ThresholdNumerator), RV(AlphaPlusOne), RV(ThresholdDenominator), RV(Threshold));\r\n Lemma_ThresholdGeOne(RV(alpha), RV(u), RV(Threshold));\r\n}\r\n\r\nmethod {:timeLimitMultiplier 6} ComputeNoise (p:DiffPrivParametersImpl, randoms:seq)\r\n returns (negate_noise:bool, absolute_noise:int, ghost noise:int)\r\n requires WellformedDiffPrivParameters(p);\r\n requires IsByteSeq(randoms);\r\n requires DiffPrivParametersValid(DiffPrivParametersImplToSpec(p));\r\n requires |randoms| > 0;\r\n requires Word32((|randoms|-1)*8+1);\r\n requires SufficientBytesForNoiseGeneration(DiffPrivParametersImplToSpec(p), |randoms|);\r\n ensures Word32(absolute_noise);\r\n ensures noise == if negate_noise then -absolute_noise else absolute_noise;\r\n ensures NoiseComputedCorrectly(DiffPrivParametersImplToSpec(p), randoms, noise);\r\n{\r\n var u:BigRat;\r\n negate_noise, u := DeriveRandomValues(randoms);\r\n assert RV(u) == GetUniformBetweenZeroAndOne(randoms[1..]);\r\n var Threshold := ComputeNoiseThreshold(p.alpha, u);\r\n absolute_noise := FindHighestPowerLeThreshold(p.alpha, Threshold, p.B, u);\r\n assert RV(Threshold) == NoiseThreshold(RV(p.alpha), RV(u));\r\n noise := if negate_noise then -absolute_noise else absolute_noise;\r\n\r\n Lemma_NoiseComputedCorrectlyFromRandomValues(DiffPrivParametersImplToSpec(p), randoms, RV(u), negate_noise, absolute_noise, noise);\r\n}\r\n\r\nstatic lemma {:timeLimitMultiplier 3}\r\n Lemma_RequiredNoiseEntropyPart1Correct (p:DiffPrivParameters, AlphaPlusOne:real, BetaPlusOne:real,\r\n One:real, Two:real, AlphaToDelta:real, BetaMinusAlphaToDelta:real,\r\n Numerator:real, AlphaMinusOne:real, MinAlphaMinusOneAndTwo:real, Denominator:real,\r\n entropy:real)\r\n requires Word32(p.delta);\r\n requires Word32(p.B);\r\n requires DiffPrivParametersValid(p);\r\n requires One == 1.0;\r\n requires Two == 2.0;\r\n requires AlphaPlusOne == p.alpha + One;\r\n requires BetaPlusOne == p.beta + One;\r\n requires AlphaToDelta == RealPower(p.alpha, p.delta);\r\n requires BetaMinusAlphaToDelta == p.beta - AlphaToDelta;\r\n requires Numerator == AlphaPlusOne * BetaPlusOne;\r\n requires AlphaMinusOne == p.alpha - One;\r\n requires MinAlphaMinusOneAndTwo == RealMin(AlphaMinusOne, Two);\r\n requires Denominator == BetaMinusAlphaToDelta * MinAlphaMinusOneAndTwo;\r\n requires Denominator != 0.0;\r\n requires entropy == Numerator / Denominator;\r\n ensures entropy == RequiredNoiseEntropyPart1(p);\r\n{\r\n calc {\r\n entropy;\r\n Numerator / Denominator;\r\n (AlphaPlusOne * BetaPlusOne) / Denominator;\r\n ((p.alpha + One) * BetaPlusOne) / Denominator;\r\n ((p.alpha + One) * (p.beta + One)) / Denominator;\r\n ((p.alpha + One) * (p.beta + One)) / (BetaMinusAlphaToDelta * MinAlphaMinusOneAndTwo);\r\n ((p.alpha + One) * (p.beta + One)) / ((p.beta - AlphaToDelta) * MinAlphaMinusOneAndTwo);\r\n ((p.alpha + One) * (p.beta + One)) / ((p.beta - RealPower(p.alpha, p.delta)) * MinAlphaMinusOneAndTwo);\r\n ((p.alpha + One) * (p.beta + One)) / ((p.beta - RealPower(p.alpha, p.delta)) * RealMin(AlphaMinusOne, Two));\r\n ((p.alpha + One) * (p.beta + One)) / ((p.beta - RealPower(p.alpha, p.delta)) * RealMin(p.alpha - One, Two));\r\n }\r\n}\r\n\r\nstatic lemma Lemma_RealPowerPreservesGeOne (x:real, e:nat)\r\n requires x >= 1.0;\r\n ensures RealPower(x, e) >= 1.0;\r\n decreases e;\r\n{\r\n if e != 0 {\r\n Lemma_RealPowerPreservesGeOne(x, e-1);\r\n }\r\n}\r\n\r\nstatic lemma Lemma_DividingByPositiveMaintainsInequality(smaller:real, larger:real, denominator:real)\r\n requires denominator > 0.0;\r\n requires smaller <= larger;\r\n ensures smaller / denominator <= larger / denominator;\r\n{\r\n}\r\n\r\nstatic lemma Lemma_RandomDerivationsCorrect (randoms:seq, u:real, negate_noise:bool, U:nat, OneHalf:real, Numerator:real, Denominator:nat)\r\n requires |randoms| > 0;\r\n requires IsByteSeq(randoms);\r\n requires negate_noise == (randoms[0] % 2 == 1);\r\n requires U == BEByteSeqToInt(randoms[1..]);\r\n requires OneHalf == 0.5;\r\n requires Numerator == real(U) + OneHalf;\r\n requires Denominator == power2((|randoms|-1)*8);\r\n requires u == Numerator / real(Denominator);\r\n ensures u == GetUniformBetweenZeroAndOne(randoms[1..]);\r\n ensures 0.0 < u <= 1.0;\r\n decreases U;\r\n{\r\n calc {\r\n Denominator;\r\n power2((|randoms|-1)*8);\r\n >= { lemma_power2_increases(0, (|randoms|-1)*8); } power2(0);\r\n == { reveal_power2(); } 1;\r\n }\r\n calc {\r\n real(Denominator);\r\n >= real(1);\r\n > 0.0;\r\n }\r\n calc ==> {\r\n true;\r\n { lemma_BEByteSeqToInt_bound(randoms[1..]); }\r\n U <= power2((|randoms|-1)*8) - 1;\r\n real(U) <= real(power2((|randoms|-1)*8) - 1);\r\n real(U) + OneHalf <= real(power2((|randoms|-1)*8) - 1) + OneHalf;\r\n { Lemma_DividingByPositiveMaintainsInequality(real(U) + OneHalf, real(power2((|randoms|-1)*8) - 1) + OneHalf, real(Denominator)); }\r\n (real(U) + OneHalf) / real(Denominator) <= (real(power2((|randoms|-1)*8) - 1) + OneHalf) / real(Denominator);\r\n }\r\n calc {\r\n u;\r\n Numerator / real(Denominator);\r\n (real(U) + OneHalf) / real(Denominator);\r\n <=\r\n (real(power2((|randoms|-1)*8) - 1) + OneHalf) / real(Denominator);\r\n (real(power2((|randoms|-1)*8) - 1) + 0.5) / real(Denominator);\r\n (real(power2((|randoms|-1)*8) - 1) + 0.5) / real(power2((|randoms|-1)*8));\r\n < real(power2((|randoms|-1)*8)) / real(power2((|randoms|-1)*8));\r\n 1.0;\r\n }\r\n}\r\n\r\nstatic lemma Lemma_ThresholdCorrect (alpha:real, u:real, ThresholdNumerator:real, AlphaPlusOne:real, ThresholdDenominator:real, Threshold:real)\r\n requires u > 0.0;\r\n requires alpha > 1.0;\r\n requires ThresholdNumerator == 2.0 * alpha;\r\n requires AlphaPlusOne == alpha + 1.0;\r\n requires ThresholdDenominator == u * AlphaPlusOne;\r\n requires Threshold == ThresholdNumerator / ThresholdDenominator;\r\n ensures Threshold == NoiseThreshold(alpha, u);\r\n{\r\n}\r\n\r\nstatic lemma Lemma_NoiseComputedCorrectlyFromRandomValues (p:DiffPrivParameters, randoms:seq,\r\n u:real, negate_noise:bool, absolute_noise:nat, ghost noise:int)\r\n requires DiffPrivParametersValid(p);\r\n requires p.alpha > 1.0;\r\n requires u > 0.0;\r\n requires IsByteSeq(randoms);\r\n requires |randoms| > 0;\r\n requires SufficientBytesForNoiseGeneration(p, |randoms|);\r\n requires negate_noise == ShouldNegateNoise(randoms[0]);\r\n requires u == GetUniformBetweenZeroAndOne(randoms[1..]);\r\n requires RealPower(p.alpha, absolute_noise) <= NoiseThreshold(p.alpha, u);\r\n requires (absolute_noise == p.B || RealPower(p.alpha, absolute_noise + 1) > NoiseThreshold(p.alpha, u));\r\n requires noise == if negate_noise then -absolute_noise else absolute_noise;\r\n ensures NoiseComputedCorrectly(p, randoms, noise);\r\n{\r\n assert AbsoluteNoiseComputedCorrectlyTrigger(absolute_noise);\r\n assert NoiseOK(p, negate_noise, u, absolute_noise, noise);\r\n}\r\n\r\nstatic lemma Lemma_ThresholdGeOne (alpha:real, u:real, threshold:real)\r\n requires 1.0 >= u > 0.0;\r\n requires alpha > 1.0;\r\n requires threshold == NoiseThreshold(alpha, u);\r\n ensures threshold >= 1.0;\r\n{\r\n calc {\r\n threshold;\r\n (2.0 * alpha) / (u * (alpha + 1.0));\r\n (alpha + alpha) / (u * (alpha + 1.0));\r\n (alpha + alpha) / (u * (alpha + 1.0));\r\n (alpha + alpha) / (alpha + 1.0) / u;\r\n >= 1.0 / u;\r\n >= 1.0;\r\n }\r\n}\r\n\r\nstatic function RequiredNoiseEntropyPart1 (p:DiffPrivParameters) : real\r\n requires DiffPrivParametersValid(p);\r\n ensures RequiredNoiseEntropyPart1(p) > 0.0;\r\n{\r\n assert p.beta - RealPower(p.alpha, p.delta) > 0.0;\r\n assert RealMin(p.alpha - 1.0, 2.0) > 0.0;\r\n (p.alpha + 1.0) * (p.beta + 1.0) / ((p.beta - RealPower(p.alpha, p.delta)) * RealMin(p.alpha - 1.0, 2.0))\r\n}\r\n\r\nstatic lemma Lemma_SufficientR2 (alpha:real, B:int, log_alpha:nat, r2:nat)\r\n requires B > 0;\r\n requires alpha > 1.0;\r\n requires real(power2(log_alpha)) >= alpha;\r\n requires r2 >= log_alpha * (B-1);\r\n ensures real(power2(r2)) >= RealPower(alpha, B-1);\r\n decreases B;\r\n{\r\n if B > 1 {\r\n calc {\r\n r2 - log_alpha;\r\n >= log_alpha * (B-1) - log_alpha;\r\n log_alpha * (B-1) - log_alpha * 1;\r\n { lemma_mul_is_distributive_sub(log_alpha, B-1, 1); lemma_mul_is_mul_boogie(log_alpha, 1); }\r\n log_alpha * (B-1 - 1);\r\n log_alpha * (B-2);\r\n }\r\n lemma_mul_nonnegative(log_alpha, B-2);\r\n assert r2 - log_alpha >= log_alpha * (B-2) >= 0;\r\n Lemma_SufficientR2(alpha, B-1, log_alpha, r2 - log_alpha);\r\n assert real(power2(r2 - log_alpha)) >= RealPower(alpha, B-2);\r\n calc {\r\n real(power2(r2));\r\n { lemma_power2_adds(log_alpha, r2-log_alpha); }\r\n real(power2(log_alpha) * power2(r2-log_alpha));\r\n { Lemma_RealOfMultiplyIsMultiply(power2(log_alpha), power2(r2-log_alpha)); }\r\n real(power2(log_alpha)) * real(power2(r2-log_alpha));\r\n >= alpha * real(power2(r2-log_alpha));\r\n >= alpha * RealPower(alpha, B-2);\r\n RealPower(alpha, B-1);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma Lemma_MultiplyDivideOrderIrrelevant (x:real, y:real, z:real)\r\n requires y != 0.0;\r\n ensures (x/y)*z == (x*z)/y;\r\n{\r\n}\r\n\r\nstatic lemma Lemma_BreakdownOfSufficientBytesForNoiseGeneration (p:DiffPrivParameters, r1:nat, r2:nat, bytes:nat)\r\n requires DiffPrivParametersValid(p);\r\n requires real(power2(r1)) >= RequiredNoiseEntropyPart1(p) > 0.0;\r\n requires real(power2(r2)) >= RealPower(p.alpha, p.B - 1) > 0.0;\r\n requires bytes >= 1;\r\n requires ModuloFour(bytes) == 1;\r\n requires bytes * 8 - 7 >= r1 + r2;\r\n ensures SufficientBytesForNoiseGeneration(p, bytes);\r\n decreases r1;\r\n{\r\n//- assert (p.beta - RealPower(p.alpha, p.delta)) > 0.0;\r\n//- assert RealMin(p.alpha - 1.0, 2.0) > 0.0;\r\n//- assert (p.beta - RealPower(p.alpha, p.delta)) * RealMin(p.alpha - 1.0, 2.0) > 0.0;\r\n\r\n//- assert real(power2(r2)) >= RealPower(p.alpha, p.B - 1);\r\n calc ==> {\r\n true;\r\n {\r\n calc {\r\n real(power2(bytes * 8 - 7));\r\n >= { lemma_power2_increases(r1 + r2, bytes * 8 - 7); }\r\n real(power2(r1 + r2));\r\n { lemma_power2_adds(r1, r2); }\r\n real(power2(r1) * power2(r2));\r\n { Lemma_RealOfMultiplyIsMultiply(power2(r1), power2(r2)); }\r\n real(power2(r1)) * real(power2(r2));\r\n >= RequiredNoiseEntropyPart1(p) * real(power2(r2));\r\n }\r\n }\r\n real(power2(bytes * 8 - 7)) >= RequiredNoiseEntropyPart1(p) * real(power2(r2));\r\n {\r\n calc {\r\n RequiredNoiseEntropyPart1(p) * real(power2(r2));\r\n >= { assert real(power2(r2)) >= RealPower(p.alpha, p.B - 1); }\r\n RequiredNoiseEntropyPart1(p) * RealPower(p.alpha, p.B - 1);\r\n == { assert p.beta - RealPower(p.alpha, p.delta) > 0.0; assert RealMin(p.alpha - 1.0, 2.0) > 0.0; }\r\n ((p.alpha + 1.0) * (p.beta + 1.0) / ((p.beta - RealPower(p.alpha, p.delta)) * RealMin(p.alpha - 1.0, 2.0))) * RealPower(p.alpha, p.B - 1);\r\n == { Lemma_MultiplyDivideOrderIrrelevant((p.alpha + 1.0) * (p.beta + 1.0), (p.beta - RealPower(p.alpha, p.delta)) * RealMin(p.alpha - 1.0, 2.0), RealPower(p.alpha, p.B - 1)); }\r\n (p.alpha + 1.0) * (p.beta + 1.0) * RealPower(p.alpha, p.B - 1) / ((p.beta - RealPower(p.alpha, p.delta)) * RealMin(p.alpha - 1.0, 2.0));\r\n RequiredNoiseEntropy(p);\r\n }\r\n }\r\n real(power2(bytes * 8 - 7)) >= RequiredNoiseEntropy(p);\r\n }\r\n\r\n//- calc { ModuloFour(bytes); { reveal_ModuloFour(); } 1; }\r\n calc {\r\n true;\r\n { reveal_SufficientBytesForNoiseGeneration(); }\r\n//- { assert bytes >= 1; }\r\n//- { assert ModuloFour(bytes) == 1; }\r\n//- { assert real(power2(bytes * 8 - 7)) >= RequiredNoiseEntropy(p); }\r\n SufficientBytesForNoiseGeneration(p, bytes);\r\n }\r\n}\r\n\r\nstatic lemma Lemma_RealPowerPreservesPositivity (x:real, e:nat)\r\n requires x > 0.0;\r\n ensures RealPower(x, e) > 0.0;\r\n decreases e;\r\n{\r\n if e > 0 {\r\n Lemma_RealPowerPreservesPositivity(x, e-1);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/Noise.s.dfy", "content": "//- \r\ninclude \"../../Libraries/Util/be_sequences.s.dfy\"\r\n\r\nstatic function RealPower(x:real, e:nat) : real\r\n decreases e;\r\n{\r\n if e == 0 then 1.0 else x * RealPower(x, e-1)\r\n}\r\n\r\nstatic function RealMin(a:real, b:real) : real\r\n{\r\n if a < b then a else b\r\n}\r\n\r\ndatatype DiffPrivParameters = DiffPrivParameters_ctor(alpha:real, beta:real, delta:int, B:int);\r\n\r\nstatic function DiffPrivParametersValid (p:DiffPrivParameters) : bool\r\n{\r\n p.delta >= 0 &&\r\n p.alpha > 1.0 &&\r\n p.beta > RealPower(p.alpha, p.delta) &&\r\n p.B > 0 &&\r\n p.beta >= 1.0\r\n}\r\n\r\nstatic function RequiredNoiseEntropy (p:DiffPrivParameters) : real\r\n requires DiffPrivParametersValid(p);\r\n{\r\n (p.alpha + 1.0) * (p.beta + 1.0) * RealPower(p.alpha, p.B - 1) / ((p.beta - RealPower(p.alpha, p.delta)) * RealMin(p.alpha - 1.0, 2.0))\r\n}\r\n\r\nstatic function {:opaque} ModuloFour (x:int) : int\r\n{\r\n x % 4\r\n}\r\n\r\nstatic function {:opaque} SufficientBytesForNoiseGeneration (p:DiffPrivParameters, bytes:nat) : bool\r\n requires DiffPrivParametersValid(p);\r\n{\r\n bytes >= 1 &&\r\n ModuloFour(bytes) == 1 &&\r\n real(power2(bytes * 8 - 7)) >= RequiredNoiseEntropy(p) //- We need 7 extra bits because we use an entire byte for the sign bit.\r\n}\r\n\r\nstatic function NoiseThreshold (alpha:real, u:real) : real\r\n requires u > 0.0;\r\n requires alpha > 1.0;\r\n{\r\n (2.0 * alpha) / (u * (alpha + 1.0))\r\n}\r\n\r\nstatic predicate {:opaque} ShouldNegateNoise (r:int)\r\n{\r\n (r % 2 == 1)\r\n}\r\n\r\nstatic function GetUniformBetweenZeroAndOne (randoms:seq) : real\r\n requires IsByteSeq(randoms);\r\n{\r\n (real(BEByteSeqToInt(randoms)) + 0.5) / real(power2(|randoms|*8))\r\n}\r\n\r\nstatic function NoiseOK (p:DiffPrivParameters, negate_noise:bool, u:real, absolute_noise:nat, noise:int) : bool\r\n requires DiffPrivParametersValid(p);\r\n{\r\n u > 0.0 &&\r\n RealPower(p.alpha, absolute_noise) <= NoiseThreshold(p.alpha, u) &&\r\n (absolute_noise == p.B || RealPower(p.alpha, absolute_noise + 1) > NoiseThreshold(p.alpha, u)) &&\r\n noise == (if negate_noise then -absolute_noise else absolute_noise)\r\n}\r\n\r\nstatic function AbsoluteNoiseComputedCorrectlyTrigger (absolute_noise:nat) : bool\r\n{\r\n true\r\n}\r\n\r\nstatic function NoiseComputedCorrectly (p:DiffPrivParameters, randoms:seq, noise:int) : bool\r\n requires DiffPrivParametersValid(p);\r\n{\r\n |randoms| > 0 &&\r\n IsByteSeq(randoms) &&\r\n SufficientBytesForNoiseGeneration(p, |randoms|) &&\r\n exists absolute_noise:nat {:trigger AbsoluteNoiseComputedCorrectlyTrigger(absolute_noise)} ::\r\n NoiseOK(p, ShouldNegateNoise(randoms[0]), GetUniformBetweenZeroAndOne(randoms[1..]), absolute_noise, noise)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/PacketParsing.c.dfy", "content": "include \"DiffPriv.s.dfy\"\r\n\r\n//-///////////////////////////\r\n//- Request parsing\r\n//-///////////////////////////\r\n\r\ndatatype DiffPrivRequest = InvalidRequest_ctor()\r\n | GetQuoteRequest_ctor(nonce_external:seq)\r\n | InitializeDBRequest_ctor(budget:real)\r\n | AddRowRequest_ctor(request_ciphertext:seq)\r\n | QueryRequest_ctor(q:QueryParameters);\r\n\r\nstatic predicate RequestParsedCorrectly (data:seq, request:DiffPrivRequest)\r\n requires IsByteSeq(data);\r\n{\r\n if |data| == 0 then\r\n request.InvalidRequest_ctor?\r\n else if data[0] == 1 then\r\n GetQuoteRequestParsedCorrectly(data, request)\r\n else if data[0] == 2 then\r\n InitializeDBRequestParsedCorrectly(data, request)\r\n else if data[0] == 3 then\r\n AddRowRequestParsedCorrectly(data, request)\r\n else if data[0] == 4 then\r\n QueryRequestParsedCorrectly(data, request)\r\n else\r\n request.InvalidRequest_ctor?\r\n}\r\n\r\nstatic predicate GetQuoteRequestParsedCorrectly(data:seq, request:DiffPrivRequest)\r\n requires |data| > 0;\r\n requires data[0] == 1;\r\n{\r\n if |data| < 21 then\r\n request.InvalidRequest_ctor?\r\n else\r\n request.GetQuoteRequest_ctor?\r\n && request.nonce_external == data[1..21]\r\n}\r\n\r\nstatic predicate InitializeDBRequestParsedCorrectly (data:seq, request:DiffPrivRequest)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 2;\r\n{\r\n if |data| < 9 then\r\n request.InvalidRequest_ctor?\r\n else\r\n (var fields := data[1 :4 :4 ];\r\n var _, budget_num, budget_den :=\r\n fields[0], BEByteSeqToInt(fields[1]), BEByteSeqToInt(fields[2]) ;\r\n if budget_den == 0 then\r\n request.InvalidRequest_ctor?\r\n else\r\n request.InitializeDBRequest_ctor? &&\r\n request.budget == real(budget_num) / real(budget_den))\r\n}\r\n\r\nstatic predicate AddRowRequestParsedCorrectly (data:seq, request:DiffPrivRequest)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 3;\r\n{\r\n if |data| == 1 then\r\n request == InvalidRequest_ctor()\r\n else\r\n request == AddRowRequest_ctor(data[1..])\r\n}\r\n\r\nstatic predicate QueryRequestParsedCorrectly (data:seq, request:DiffPrivRequest)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 4;\r\n{\r\n if |data| < 41 then\r\n request.InvalidRequest_ctor?\r\n else\r\n (\r\n var program_size := BEByteSeqToInt(data[1..5]);\r\n if program_size < 0 || |data| < 41 + program_size || program_size % 4 != 0 then\r\n request.InvalidRequest_ctor?\r\n else\r\n (var fields := data[5:4:4:4:4:4:4:4:4:4:program_size];\r\n var _, row_min, row_max, answer_units, answer_min, answer_max, alpha_num, alpha_den, beta_num, beta_den, program_encoding :=\r\n fields[0], BEByteSeqToInt(fields[1]), BEByteSeqToInt(fields[2]), BEByteSeqToInt(fields[3]),\r\n BEByteSeqToInt(fields[4]), BEByteSeqToInt(fields[5]), BEByteSeqToInt(fields[6]), BEByteSeqToInt(fields[7]),\r\n BEByteSeqToInt(fields[8]), BEByteSeqToInt(fields[9]), fields[10];\r\n if alpha_den == 0 || beta_den == 0 then\r\n request.InvalidRequest_ctor?\r\n else\r\n request.QueryRequest_ctor? &&\r\n request.q.row_min == row_min &&\r\n request.q.row_max == row_max &&\r\n request.q.answer_units == answer_units &&\r\n request.q.answer_min == answer_min &&\r\n request.q.answer_max == answer_max &&\r\n request.q.alpha == real(alpha_num) / real(alpha_den) &&\r\n request.q.beta == real(beta_num) / real(beta_den) &&\r\n request.q.program_encoding == BEIntToDigitSeq(power2(32), |program_encoding|/4, BEDigitSeqToInt(power2(8), program_encoding)))\r\n )\r\n}\r\n\r\n//-///////////////////////////\r\n//- Response parsing\r\n//-///////////////////////////\r\n\r\ndatatype DiffPrivResponse = NullResponse_ctor()\r\n | GetQuoteResponse_ctor(get_quote_error_code:int, encoded_public_key:seq, pcr_info_bytes:seq, sig_bytes:seq)\r\n | InitializeDBResponse_ctor(init_error_code:int)\r\n | AddRowResponse_ctor()\r\n | QueryResponse_ctor(query_error_code:int, response:int);\r\n\r\nstatic predicate ResponseFormedCorrectly (response:DiffPrivResponse, data:seq)\r\n requires IsByteSeq(data);\r\n{\r\n match response\r\n case NullResponse_ctor =>\r\n |data| >= 1 &&\r\n data[0] == 0\r\n\r\n case GetQuoteResponse_ctor(get_quote_error_code, encoded_public_key, pcr_info_bytes, sig_bytes) =>\r\n Word32(get_quote_error_code)\r\n && Word32(|encoded_public_key|)\r\n && Word32(|pcr_info_bytes|)\r\n && Word32(|sig_bytes|)\r\n && IsByteSeq(encoded_public_key)\r\n && IsByteSeq(pcr_info_bytes)\r\n && IsByteSeq(sig_bytes)\r\n && data == [1] + BEWordToFourBytes(get_quote_error_code) + BEWordToFourBytes(|encoded_public_key|) +\r\n BEWordToFourBytes(|pcr_info_bytes|) + BEWordToFourBytes(|sig_bytes|) + encoded_public_key +\r\n pcr_info_bytes + sig_bytes\r\n\r\n case InitializeDBResponse_ctor(error_code) =>\r\n Word32(error_code)\r\n && data == [2] + BEWordToFourBytes(error_code)\r\n\r\n case AddRowResponse_ctor =>\r\n data == [3]\r\n //- The error code is not public, so we can't output it.\r\n\r\n case QueryResponse_ctor(error_code, response_value) =>\r\n Word32(error_code)\r\n && Word32(response_value)\r\n && data == [4] + BEWordToFourBytes(error_code) + BEWordToFourBytes(response_value)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/PacketParsing.i.dfy", "content": "//-\r\ninclude \"PacketParsing.c.dfy\"\r\ninclude \"../../Libraries/Util/seqs_transforms.i.dfy\"\r\n\r\n//-//////////////////////////\r\n//- Query parameters\r\n//-//////////////////////////\r\n\r\ndatatype QueryParametersImpl = QueryParametersImpl_ctor(program_encoding:seq, row_min:int, row_max:int,\r\n answer_units:int, answer_min:int, answer_max:int,\r\n alpha_num:int, alpha_den:int, beta_num:int, beta_den:int)\r\n\r\nstatic predicate QueryParametersImplValid (q:QueryParametersImpl)\r\n{\r\n (forall i :: 0 <= i < |q.program_encoding| ==> Word32(q.program_encoding[i])) &&\r\n Word32(q.row_min) &&\r\n Word32(q.row_max) &&\r\n Word32(q.answer_units) &&\r\n Word32(q.answer_min) &&\r\n Word32(q.answer_max) &&\r\n Word32(q.alpha_num) &&\r\n Word32(q.alpha_den) &&\r\n Word32(q.beta_num) &&\r\n Word32(q.beta_den) &&\r\n q.alpha_den != 0 &&\r\n q.beta_den != 0\r\n}\r\n\r\nstatic function QueryParametersImplToSpec(q:QueryParametersImpl) : QueryParameters\r\n requires QueryParametersImplValid(q);\r\n{\r\n QueryParameters_ctor(q.program_encoding, q.row_min, q.row_max, q.answer_units, q.answer_min, q.answer_max,\r\n real(q.alpha_num) / real(q.alpha_den), real(q.beta_num) / real(q.beta_den))\r\n}\r\n\r\n//-//////////////////////////\r\n//- Request implementation\r\n//-//////////////////////////\r\n\r\ndatatype DiffPrivRequestImpl = InvalidRequestImpl_ctor()\r\n | GetQuoteRequestImpl_ctor(nonce_external:seq)\r\n | InitializeDBRequestImpl_ctor(budget_num:int, budget_den:int)\r\n | AddRowRequestImpl_ctor(request_ciphertext:seq)\r\n | QueryRequestImpl_ctor(q:QueryParametersImpl)\r\n\r\nstatic predicate WellformedDiffPrivRequest(request:DiffPrivRequestImpl)\r\n{\r\n match request\r\n case InvalidRequestImpl_ctor => true\r\n case GetQuoteRequestImpl_ctor(nonce_external) => IsByteSeqOfLen(nonce_external, 20)\r\n case InitializeDBRequestImpl_ctor(budget_num, budget_den) => Word32(budget_num) && Word32(budget_den) && budget_den != 0\r\n case AddRowRequestImpl_ctor(request_ciphertext) => IsByteSeq(request_ciphertext) && |request_ciphertext| > 0\r\n case QueryRequestImpl_ctor(q) => QueryParametersImplValid(q)\r\n}\r\n\r\nstatic function DiffPrivRequestImplToSpec(request:DiffPrivRequestImpl) : DiffPrivRequest\r\n requires WellformedDiffPrivRequest(request);\r\n{\r\n match request\r\n case InvalidRequestImpl_ctor => InvalidRequest_ctor()\r\n case GetQuoteRequestImpl_ctor(nonce_external) => GetQuoteRequest_ctor(nonce_external)\r\n case InitializeDBRequestImpl_ctor(budget_num, budget_den) => InitializeDBRequest_ctor(real(budget_num) / real(budget_den))\r\n case AddRowRequestImpl_ctor(request_ciphertext) => AddRowRequest_ctor(request_ciphertext)\r\n case QueryRequestImpl_ctor(q:QueryParametersImpl) => QueryRequest_ctor(QueryParametersImplToSpec(q))\r\n}\r\n\r\n//-//////////////////////////\r\n//- Request parsing\r\n//-//////////////////////////\r\n\r\nstatic lemma Lemma_InitializeDBWellformedDiffPrivRequest(request:DiffPrivRequestImpl)\r\n requires request.InitializeDBRequestImpl_ctor?;\r\n requires Word32(request.budget_num);\r\n requires Word32(request.budget_den);\r\n requires request.budget_den != 0;\r\n ensures WellformedDiffPrivRequest(request);\r\n{\r\n}\r\n\r\nstatic lemma Lemma_QueryWellformedDiffPrivRequest(request:DiffPrivRequestImpl)\r\n requires request.QueryRequestImpl_ctor?;\r\n requires QueryParametersImplValid(request.q);\r\n ensures WellformedDiffPrivRequest(request);\r\n{\r\n}\r\n\r\nmethod ParseRequestPacket (data:seq) returns (request:DiffPrivRequestImpl)\r\n requires IsByteSeq(data);\r\n ensures WellformedDiffPrivRequest(request);\r\n ensures RequestParsedCorrectly(data, DiffPrivRequestImplToSpec(request));\r\n\r\n requires public(data);\r\n ensures public(request);\r\n{\r\n if |data| == 0 {\r\n request := InvalidRequestImpl_ctor();\r\n return;\r\n }\r\n if data[0] == 1 {\r\n request := ParseGetQuoteRequestPacket(data);\r\n return;\r\n }\r\n if data[0] == 2 {\r\n request := ParseInitializeDBRequestPacket(data);\r\n return;\r\n }\r\n if data[0] == 3 {\r\n request := ParseAddRowRequestPacket(data);\r\n return;\r\n }\r\n if data[0] == 4 {\r\n request := ParseQueryRequestPacket(data);\r\n return;\r\n }\r\n request := InvalidRequestImpl_ctor();\r\n}\r\n\r\nstatic method ParseGetQuoteRequestPacket (data:seq) returns (request:DiffPrivRequestImpl)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 1;\r\n ensures WellformedDiffPrivRequest(request);\r\n ensures GetQuoteRequestParsedCorrectly(data, DiffPrivRequestImplToSpec(request));\r\n\r\n requires public(data);\r\n ensures public(request);\r\n{\r\n if |data| < 21 {\r\n request := InvalidRequestImpl_ctor();\r\n return;\r\n }\r\n var nonce_external := data[1..21];\r\n return GetQuoteRequestImpl_ctor(nonce_external);\r\n}\r\n\r\nstatic method ParseInitializeDBRequestPacket (data:seq) returns (request:DiffPrivRequestImpl)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 2;\r\n ensures WellformedDiffPrivRequest(request);\r\n ensures InitializeDBRequestParsedCorrectly(data, DiffPrivRequestImplToSpec(request));\r\n\r\n requires public(data);\r\n ensures public(request);\r\n{\r\n if |data| < 9 {\r\n request := InvalidRequestImpl_ctor();\r\n return;\r\n }\r\n var budget_num := BEFourBytesToWord_impl(data[1..5]);\r\n var budget_den := BEFourBytesToWord_impl(data[5..9]);\r\n if (budget_den == 0) {\r\n request := InvalidRequestImpl_ctor();\r\n return;\r\n }\r\n request := InitializeDBRequestImpl_ctor(budget_num, budget_den);\r\n Lemma_InitializeDBWellformedDiffPrivRequest(request);\r\n}\r\n\r\nmethod ParseAddRowRequestPacket (data:seq) returns (request:DiffPrivRequestImpl)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 3;\r\n ensures WellformedDiffPrivRequest(request);\r\n ensures AddRowRequestParsedCorrectly(data, DiffPrivRequestImplToSpec(request));\r\n\r\n requires public(data);\r\n ensures public(request);\r\n{\r\n if |data| == 1 {\r\n request := InvalidRequestImpl_ctor();\r\n return;\r\n }\r\n return AddRowRequestImpl_ctor(data[1..]);\r\n}\r\n\r\nstatic method ParseQueryRequestFields (data:seq, ghost fields:seq>, program_size:int) returns\r\n (row_min:int, row_max:int, answer_units:int, answer_min:int, answer_max:int, alpha_num:int, alpha_den:int, beta_num:int, beta_den:int,\r\n program_encoding_words:seq)\r\n requires 0 <= program_size <= |data| - 41;\r\n requires program_size % 4 == 0;\r\n requires IsByteSeq(data);\r\n requires fields == data[5:4:4:4:4:4:4:4:4:4:program_size];\r\n ensures IsByteSeq(fields[1]);\r\n ensures IsByteSeq(fields[2]);\r\n ensures IsByteSeq(fields[3]);\r\n ensures IsByteSeq(fields[4]);\r\n ensures IsByteSeq(fields[5]);\r\n ensures IsByteSeq(fields[6]);\r\n ensures IsByteSeq(fields[7]);\r\n ensures IsByteSeq(fields[8]);\r\n ensures IsByteSeq(fields[9]);\r\n ensures row_min == BEByteSeqToInt(fields[1]);\r\n ensures row_max == BEByteSeqToInt(fields[2]);\r\n ensures answer_units == BEByteSeqToInt(fields[3]);\r\n ensures answer_min == BEByteSeqToInt(fields[4]);\r\n ensures answer_max == BEByteSeqToInt(fields[5]);\r\n ensures alpha_num == BEByteSeqToInt(fields[6]);\r\n ensures alpha_den == BEByteSeqToInt(fields[7]);\r\n ensures beta_num == BEByteSeqToInt(fields[8]);\r\n ensures beta_den == BEByteSeqToInt(fields[9]);\r\n ensures program_encoding_words == BEIntToDigitSeq(power2(32), |fields[10]|/4, BEDigitSeqToInt(power2(8), fields[10]));\r\n ensures Word32(row_min);\r\n ensures Word32(row_max);\r\n ensures Word32(answer_units);\r\n ensures Word32(answer_min);\r\n ensures Word32(answer_max);\r\n ensures Word32(alpha_num);\r\n ensures Word32(alpha_den);\r\n ensures Word32(beta_num);\r\n ensures Word32(beta_den);\r\n ensures forall i :: 0 <= i < |program_encoding_words| ==> Word32(program_encoding_words[i]);\r\n{\r\n row_min := BEFourBytesToWord_impl(data[5..9]);\r\n row_max := BEFourBytesToWord_impl(data[9..13]);\r\n answer_units := BEFourBytesToWord_impl(data[13..17]);\r\n answer_min := BEFourBytesToWord_impl(data[17..21]);\r\n answer_max := BEFourBytesToWord_impl(data[21..25]);\r\n alpha_num := BEFourBytesToWord_impl(data[25..29]);\r\n alpha_den := BEFourBytesToWord_impl(data[29..33]);\r\n beta_num := BEFourBytesToWord_impl(data[33..37]);\r\n beta_den := BEFourBytesToWord_impl(data[37..41]);\r\n\r\n var program_encoding := data[41..41+program_size];\r\n ghost var padbytes:seq;\r\n program_encoding_words, padbytes := BEByteSeqToWordSeq_impl(program_encoding);\r\n assert program_encoding_words == BEByteSeqToWordSeq(program_encoding);\r\n}\r\n\r\nstatic method ParseQueryRequestPacket (data:seq) returns (request:DiffPrivRequestImpl)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 4;\r\n ensures WellformedDiffPrivRequest(request);\r\n ensures QueryRequestParsedCorrectly(data, DiffPrivRequestImplToSpec(request));\r\n\r\n requires public(data);\r\n ensures public(request);\r\n{\r\n if |data| < 41 {\r\n request := InvalidRequestImpl_ctor();\r\n return;\r\n }\r\n var program_size := BEFourBytesToWord_impl(data[1..5]);\r\n if |data| < 41 + program_size || program_size % 4 != 0 {\r\n request := InvalidRequestImpl_ctor();\r\n return;\r\n }\r\n assert program_size >= 0 && |data| >= 41 + program_size && program_size % 4 == 0;\r\n\r\n ghost var fields := data[5:4:4:4:4:4:4:4:4:4:program_size];\r\n var row_min, row_max, answer_units, answer_min, answer_max, alpha_num, alpha_den, beta_num, beta_den, program_encoding_words :=\r\n ParseQueryRequestFields(data, fields, program_size);\r\n\r\n if alpha_den == 0 || beta_den == 0 {\r\n request := InvalidRequestImpl_ctor();\r\n return;\r\n }\r\n\r\n var q := QueryParametersImpl_ctor(program_encoding_words, row_min, row_max, answer_units, answer_min, answer_max, alpha_num, alpha_den,\r\n beta_num, beta_den);\r\n request := QueryRequestImpl_ctor(q);\r\n Lemma_QueryWellformedDiffPrivRequest(request);\r\n}\r\n\r\n//-//////////////////////////\r\n//- Response forming\r\n//-//////////////////////////\r\n\r\nstatic predicate WellformedResponse (response:DiffPrivResponse)\r\n{\r\n match response\r\n case NullResponse_ctor => true\r\n\r\n case GetQuoteResponse_ctor(error_code, encoded_public_key, pcr_info_bytes, sig_bytes) =>\r\n Word32(error_code)\r\n && Word32(|encoded_public_key|)\r\n && Word32(|pcr_info_bytes|)\r\n && Word32(|sig_bytes|)\r\n && IsByteSeq(encoded_public_key)\r\n && IsByteSeq(pcr_info_bytes)\r\n && IsByteSeq(sig_bytes)\r\n\r\n case InitializeDBResponse_ctor(error_code) => Word32(error_code)\r\n case AddRowResponse_ctor => true\r\n case QueryResponse_ctor(error_code, response_value) => Word32(error_code) && Word32(response_value)\r\n}\r\n\r\nstatic method FormResponsePacket (response:DiffPrivResponse) returns (data:seq)\r\n requires WellformedResponse(response);\r\n ensures IsByteSeq(data);\r\n ensures ResponseFormedCorrectly(response, data);\r\n\r\n requires public(response);\r\n ensures public(data);\r\n{\r\n lemma_2toX();\r\n match response {\r\n case NullResponse_ctor =>\r\n data := [0];\r\n\r\n case GetQuoteResponse_ctor(get_quote_error_code, encoded_public_key, pcr_info_bytes, sig_bytes) =>\r\n var get_quote_error_code_encoded := BEWordToFourBytes_impl(get_quote_error_code);\r\n var encoded_public_key_len_encoded := BEWordToFourBytes_impl(|encoded_public_key|);\r\n var pcr_info_bytes_len_encoded := BEWordToFourBytes_impl(|pcr_info_bytes|);\r\n var sig_bytes_len_encoded := BEWordToFourBytes_impl(|sig_bytes|);\r\n data := [1] + get_quote_error_code_encoded + encoded_public_key_len_encoded + pcr_info_bytes_len_encoded +\r\n sig_bytes_len_encoded + encoded_public_key + pcr_info_bytes + sig_bytes;\r\n assert forall i :: 0 <= i < |data| ==> IsByte(data[i]);\r\n assert ResponseFormedCorrectly(response, data);\r\n\r\n case InitializeDBResponse_ctor(error_code) =>\r\n var error_code_encoded := BEWordToFourBytes_impl(error_code);\r\n data := [2] + error_code_encoded;\r\n\r\n case AddRowResponse_ctor =>\r\n data := [3];\r\n\r\n case QueryResponse_ctor(error_code, response_value) =>\r\n var error_code_encoded := BEWordToFourBytes_impl(error_code);\r\n var response_value_encoded := BEWordToFourBytes_impl(response_value);\r\n data := [4] + error_code_encoded + response_value_encoded;\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/RelationalProperties.i.dfy", "content": "include \"SumReducer.i.dfy\"\r\n\r\n//////////////////////////////////////////////\r\n\r\n//////////////////////////////////////////////\r\n\r\nstatic lemma Lemma_SensitivityOfMapperSumSpecific(db1:seq, db2:seq, diff_row:int,\r\n program:seq, row_min:int, row_max:int)\r\n requires DatabaseValid(db1);\r\n requires DatabaseValid(db2);\r\n requires DatabasesIdenticalExceptForOneRow(db1, db2, diff_row);\r\n requires ProgramValid(program);\r\n requires row_min <= row_max;\r\n ensures row_min - row_max <= MapperSum(db1, program, row_min, row_max) - MapperSum(db2, program, row_min, row_max) <= row_max - row_min;\r\n decreases |db1|;\r\n{\r\n if |db1| > 0\r\n {\r\n if diff_row == |db1| - 1\r\n {\r\n assert forall i:int :: 0 <= i < diff_row ==> db1[i] == db2[i];\r\n assert db1[..diff_row] == db2[..diff_row];\r\n }\r\n else\r\n {\r\n Lemma_SensitivityOfMapperSumSpecific(db1[..|db1|-1], db2[..|db2|-1], diff_row, program, row_min, row_max);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma Lemma_SensitivityOfMapperSum(program:seq, row_min:int, row_max:int)\r\n requires ProgramValid(program);\r\n requires row_min <= row_max;\r\n ensures forall db1:seq, db2:seq ::\r\n DatabaseValid(db1) && DatabaseValid(db2) && DatabasesSimilar(db1, db2) ==>\r\n row_min - row_max <= MapperSum(db1, program, row_min, row_max) - MapperSum(db2, program, row_min, row_max) <= row_max - row_min;\r\n{\r\n forall db1:seq, db2:seq, diff_row:int |\r\n DatabaseValid(db1) && DatabaseValid(db2) && DatabasesIdenticalExceptForOneRow(db1, db2, diff_row)\r\n ensures row_min - row_max <= MapperSum(db1, program, row_min, row_max) - MapperSum(db2, program, row_min, row_max) <= row_max - row_min;\r\n {\r\n Lemma_SensitivityOfMapperSumSpecific(db1, db2, diff_row, program, row_min, row_max);\r\n }\r\n}\r\n\r\nstatic lemma Lemma_SensitivityOfComputeSumSpecific(db1:seq, db2:seq, diff_row:int, program:seq,\r\n row_min:int, row_max:int, answer_units:int, answer_min:int, answer_max:int, delta:int)\r\n requires DatabaseValid(db1);\r\n requires DatabaseValid(db2);\r\n requires DatabasesIdenticalExceptForOneRow(db1, db2, diff_row);\r\n requires ProgramValid(program);\r\n requires row_min <= row_max;\r\n requires answer_units > 0;\r\n requires answer_min <= answer_max;\r\n requires delta == DivideRoundingUp(row_max - row_min, answer_units);\r\n ensures -delta <= Clip(Scale(MapperSum(db1, program, row_min, row_max), answer_units), answer_min, answer_max) -\r\n Clip(Scale(MapperSum(db2, program, row_min, row_max), answer_units), answer_min, answer_max) <= delta;\r\n decreases |db1|;\r\n{\r\n Lemma_SensitivityOfMapperSumSpecific(db1, db2, diff_row, program, row_min, row_max);\r\n assert -(row_max-row_min) <= MapperSum(db1, program, row_min, row_max) - MapperSum(db2, program, row_min, row_max) <= row_max - row_min;\r\n Lemma_EffectOfScaleOnDifference(MapperSum(db1, program, row_min, row_max), MapperSum(db2, program, row_min, row_max),\r\n row_max - row_min, answer_units, delta);\r\n assert -delta <= Scale(MapperSum(db1, program, row_min, row_max), answer_units) - Scale(MapperSum(db2, program, row_min, row_max), answer_units) <= delta;\r\n Lemma_EffectOfClipOnDifference(Scale(MapperSum(db1, program, row_min, row_max), answer_units),\r\n Scale(MapperSum(db2, program, row_min, row_max), answer_units),\r\n delta, answer_min, answer_max);\r\n assert -delta <= Clip(Scale(MapperSum(db1, program, row_min, row_max), answer_units), answer_min, answer_max) - Clip(Scale(MapperSum(db2, program, row_min, row_max), answer_units), answer_min, answer_max) <= delta;\r\n}\r\n\r\nstatic lemma Lemma_SensitivityOfComputeSum(program:seq, row_min:int, row_max:int, answer_units:int, answer_min:int,\r\n answer_max:int, delta:int)\r\n requires ProgramValid(program);\r\n requires row_min <= row_max;\r\n requires answer_units > 0;\r\n requires answer_min <= answer_max;\r\n requires delta == DivideRoundingUp(row_max - row_min, answer_units);\r\n ensures forall db1:seq, db2:seq ::\r\n DatabaseValid(db1) && DatabaseValid(db2) && DatabasesSimilar(db1, db2) ==>\r\n -delta <= Clip(Scale(MapperSum(db1, program, row_min, row_max), answer_units), answer_min, answer_max) -\r\n Clip(Scale(MapperSum(db2, program, row_min, row_max), answer_units), answer_min, answer_max) <= delta;\r\n{\r\n forall db1:seq, db2:seq, diff_row:int |\r\n DatabaseValid(db1) && DatabaseValid(db2) && DatabasesIdenticalExceptForOneRow(db1, db2, diff_row)\r\n ensures -delta <= Clip(Scale(MapperSum(db1, program, row_min, row_max), answer_units), answer_min, answer_max) -\r\n Clip(Scale(MapperSum(db2, program, row_min, row_max), answer_units), answer_min, answer_max) <= delta;\r\n {\r\n Lemma_SensitivityOfComputeSumSpecific(db1, db2, diff_row, program, row_min, row_max, answer_units, answer_min, answer_max, delta);\r\n }\r\n}\r\n\r\nstatic lemma Lemma_EffectOfScaleOnDifference (v1:int, v2:int, delta:int, d:int, scaled_delta:int)\r\n requires delta >= 0;\r\n requires d > 0;\r\n requires -delta <= v1 - v2 <= delta;\r\n requires scaled_delta == DivideRoundingUp(delta, d);\r\n ensures -scaled_delta <= Scale(v1, d) - Scale(v2, d) <= scaled_delta;\r\n{\r\n var sv1 := Scale(v1, d);\r\n var sv2 := Scale(v2, d);\r\n\r\n Lemma_ScaledValueOffByNoMoreThanHalf(v1, d, sv1);\r\n Lemma_ScaledValueOffByNoMoreThanHalf(v2, d, sv2);\r\n Lemma_TwoThingsLessThanHalfDifferByLessThanWhole(d * sv1 - v1, d * sv2 - v2, d);\r\n assert -d < (d * sv1 - v1) - (d * sv2 - v2) < d;\r\n assert -d < (d * sv1) - (d * sv2) - (v1 - v2) < d;\r\n lemma_mul_is_distributive_sub(d, sv1, sv2);\r\n assert -d < d * (sv1 - sv2) - (v1 - v2) < d;\r\n assert -d + (v1 - v2) < d * (sv1 - sv2) < d + (v1 - v2);\r\n assert -(d+delta) < d * (sv1 - sv2) < d + delta;\r\n Lemma_ScalingDivision(sv1 - sv2, d, delta, scaled_delta);\r\n}\r\n\r\nstatic lemma Lemma_EffectOfClipOnDifference (v1:int, v2:int, delta:int, min:int, max:int)\r\n requires delta >= 0;\r\n requires -delta <= v1 - v2 <= delta;\r\n requires min <= max;\r\n ensures -delta <= Clip(v1, min, max) - Clip(v2, min, max) <= delta;\r\n{\r\n}\r\n\r\nstatic lemma Lemma_ScaledValueOffByNoMoreThanHalf (x:int, d:int, sx:int)\r\n requires d > 0;\r\n requires sx == Scale(x, d);\r\n ensures -d < 2 * (d * sx - x) <= d;\r\n{\r\n var q := x / d;\r\n var r := x % d;\r\n lemma_fundamental_div_mod(x, d);\r\n\r\n lemma_mod_remainder_specific(x, d);\r\n\r\n if r * 2 >= d {\r\n calc {\r\n 2 * (d * sx - x);\r\n 2 * (d * (q + 1) - x);\r\n { lemma_mul_is_distributive_add(d, q, 1); lemma_mul_is_mul_boogie(d, 1); }\r\n 2 * (d * q + d * 1 - x);\r\n 2 * (d * q + d - x);\r\n 2 * (d * q + r + d - r - x);\r\n 2 * (d - r);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma Lemma_TwoThingsLessThanHalfDifferByLessThanWhole (x1:int, x2:int, y:int)\r\n requires -y < x1 * 2 <= y;\r\n requires -y < x2 * 2 <= y;\r\n ensures -y < x1 - x2 < y;\r\n{\r\n}\r\n\r\nstatic lemma Lemma_ScalingDivision (x:int, d:int, delta:int, scaled_delta:int)\r\n requires delta >= 0;\r\n requires d > 0;\r\n requires -(d+delta) < d * x < d+delta;\r\n requires scaled_delta == DivideRoundingUp(delta, d);\r\n ensures -scaled_delta <= x <= scaled_delta;\r\n{\r\n Lemma_DivideRoundingUpHasLimit(delta, d);\r\n assert delta <= d * scaled_delta < d + delta;\r\n lemma_mul_is_commutative_forall();\r\n\r\n if x > scaled_delta {\r\n calc ==> {\r\n true;\r\n x-1 >= scaled_delta;\r\n { lemma_mul_inequality(scaled_delta, x-1, d); }\r\n d * (x-1) >= d * scaled_delta;\r\n d * (x-1) >= delta;\r\n { lemma_mul_is_distributive_sub(d, x, 1); lemma_mul_is_mul_boogie(d, 1); }\r\n d * x - d >= delta;\r\n d * x >= delta + d;\r\n false;\r\n }\r\n }\r\n else if x < -scaled_delta {\r\n lemma_mul_is_mul_boogie(-1, scaled_delta);\r\n lemma_mul_is_mul_boogie(-1, d);\r\n lemma_mul_is_mul_boogie(-1, d * scaled_delta);\r\n lemma_mul_is_mul_boogie(d, -1);\r\n calc ==> {\r\n true;\r\n x+1 <= -scaled_delta;\r\n { lemma_mul_inequality(x+1, -scaled_delta, d); }\r\n d * (x+1) <= d * (-scaled_delta);\r\n d * (x+1) <= d * (-1 * scaled_delta);\r\n { lemma_mul_is_associative(d, -1, scaled_delta); }\r\n d * (x+1) <= (d * -1) * scaled_delta;\r\n d * (x+1) <= (-1 * d) * scaled_delta;\r\n { lemma_mul_is_associative(-1, d, scaled_delta); }\r\n d * (x+1) <= -1 * (d * scaled_delta);\r\n d * (x+1) <= -1 * delta;\r\n { lemma_mul_is_mul_boogie(-1, delta); }\r\n d * (x+1) <= -delta;\r\n { lemma_mul_is_distributive_add(d, x, 1); lemma_mul_is_mul_boogie(d, 1); }\r\n d * x + d <= -delta;\r\n d * x <= -(d+delta);\r\n false;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma Lemma_DivideRoundingUpHasLimit (x:int, d:int)\r\n requires x >= 0;\r\n requires d > 0;\r\n ensures x <= d * DivideRoundingUp(x, d) < x + d;\r\n{\r\n lemma_fundamental_div_mod(x, d);\r\n if x % d != 0 {\r\n calc {\r\n d * DivideRoundingUp(x, d);\r\n d * (x/d + 1);\r\n { lemma_mul_is_distributive_add(d, x/d, 1); lemma_mul_is_mul_boogie(d, 1); }\r\n d * (x/d) + d;\r\n }\r\n lemma_mod_remainder_specific(x, d);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/StateMachine.i.dfy", "content": "//-\r\n//-\r\ninclude \"StateMachine.s.dfy\"\r\ninclude \"DiffPriv.i.dfy\"\r\ninclude \"DiffPrivPerformQuery.i.dfy\"\r\ninclude \"StateMachine2.i.dfy\"\r\ninclude \"../../Libraries/Net/Udp.i.dfy\"\r\ninclude \"../../Libraries/Util/Halter.i.dfy\"\r\ninclude \"../../Libraries/Util/relational.i.dfy\"\r\n\r\nmethod HandleQueryRequest(diffpriv_state_in:DiffPrivStateImpl, common_state:CommonStateImpl, q:QueryParametersImpl)\r\n returns (diffpriv_state_out:DiffPrivStateImpl, response:DiffPrivResponse)\r\n requires CommonStateImplValid(common_state);\r\n requires TPM_ready();\r\n requires DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state_in));\r\n requires current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state), TPM);\r\n requires current_diffpriv_state == DiffPrivStateMachine_ctor(true, DiffPrivStateImplToSpec(diffpriv_state_in));\r\n requires QueryParametersImplValid(q);\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_diffpriv_state;\r\n modifies this`current_common_state;\r\n\r\n ensures DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state_out));\r\n ensures TPM_ready();\r\n ensures WellformedResponse(response);\r\n ensures current_diffpriv_state == DiffPrivStateMachine_ctor(true, DiffPrivStateImplToSpec(diffpriv_state_out));\r\n ensures current_common_state == old(current_common_state)[TPM := TPM];\r\n\r\n requires public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state_in)));\r\n requires public(q);\r\n ensures public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state_out)));\r\n ensures public(response);\r\n{\r\n var query_error_code:int, answer:int;\r\n query_error_code, answer, diffpriv_state_out := DiffPrivPerformQuery(diffpriv_state_in, q);\r\n var usable_answer:int;\r\n if query_error_code != 0 {\r\n usable_answer := 0;\r\n }\r\n else {\r\n ghost var declassified_answer :=\r\n AdvanceDiffPrivStateMachineByAnsweringQuery(QueryParametersImplToSpec(q),\r\n DiffPrivStateImplToSpec(diffpriv_state_out),\r\n answer);\r\n usable_answer := Asm_declassify_result(answer, declassified_answer);\r\n }\r\n response := QueryResponse_ctor(query_error_code, usable_answer);\r\n}\r\n\r\n\r\nmethod HandleOneRequest (request:DiffPrivRequestImpl, diffpriv_state_in:DiffPrivStateImpl, common_state_in:CommonStateImpl)\r\n returns (response:DiffPrivResponse, diffpriv_state_out:DiffPrivStateImpl, common_state_out:CommonStateImpl)\r\n requires CommonStateImplValid(common_state_in);\r\n requires common_state_in.key_pair.pub.size >= 1024 / 8;\r\n requires TPM_ready();\r\n requires DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state_in));\r\n requires current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state_in), TPM);\r\n requires current_diffpriv_state == DiffPrivStateMachine_ctor(true, DiffPrivStateImplToSpec(diffpriv_state_in));\r\n requires WellformedDiffPrivRequest(request);\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_diffpriv_state;\r\n modifies this`current_common_state;\r\n\r\n ensures DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state_out));\r\n ensures TPM_ready();\r\n ensures WellformedResponse(response);\r\n ensures current_diffpriv_state == DiffPrivStateMachine_ctor(true, DiffPrivStateImplToSpec(diffpriv_state_out));\r\n ensures current_common_state == old(current_common_state)[TPM := TPM];\r\n ensures CommonStateImplValid(common_state_out);\r\n ensures CommonStateImplToSpec(common_state_out) == CommonStateImplToSpec(common_state_in);\r\n\r\n requires public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state_in)));\r\n requires public(request);\r\n ensures public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state_out)));\r\n ensures public(response);\r\n{\r\n match request {\r\n case InvalidRequestImpl_ctor =>\r\n response := NullResponse_ctor();\r\n diffpriv_state_out := diffpriv_state_in;\r\n common_state_out := common_state_in;\r\n\r\n case GetQuoteRequestImpl_ctor(nonce_external) =>\r\n diffpriv_state_out := diffpriv_state_in;\r\n response, common_state_out := HandleGetDiffPrivQuoteRequest(common_state_in, nonce_external);\r\n\r\n case InitializeDBRequestImpl_ctor(budget_num, budget_den) =>\r\n diffpriv_state_out, response := HandleInitializeDBRequest(diffpriv_state_in, budget_num, budget_den);\r\n common_state_out := common_state_in;\r\n\r\n case AddRowRequestImpl_ctor(request_ciphertext) =>\r\n diffpriv_state_out, response := HandleAddRowRequest(diffpriv_state_in, common_state_in, request_ciphertext);\r\n common_state_out := common_state_in;\r\n\r\n case QueryRequestImpl_ctor(q) =>\r\n diffpriv_state_out, response := HandleQueryRequest(diffpriv_state_in, common_state_in, q);\r\n common_state_out := common_state_in;\r\n }\r\n}\r\n\r\nmethod HandleOneRequestRaw (request_bytes:seq, diffpriv_state_in:DiffPrivStateImpl, common_state_in:CommonStateImpl)\r\n returns (response_bytes:seq, diffpriv_state_out:DiffPrivStateImpl, common_state_out:CommonStateImpl)\r\n requires CommonStateImplValid(common_state_in);\r\n requires common_state_in.key_pair.pub.size >= 1024 / 8;\r\n requires TPM_ready();\r\n requires DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state_in));\r\n requires current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state_in), TPM);\r\n requires current_diffpriv_state == DiffPrivStateMachine_ctor(true, DiffPrivStateImplToSpec(diffpriv_state_in));\r\n requires IsByteSeq(request_bytes);\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_diffpriv_state;\r\n modifies this`current_common_state;\r\n\r\n ensures DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state_out));\r\n ensures TPM_ready();\r\n ensures IsByteSeq(response_bytes);\r\n ensures current_diffpriv_state == DiffPrivStateMachine_ctor(true, DiffPrivStateImplToSpec(diffpriv_state_out));\r\n ensures current_common_state == old(current_common_state)[TPM := TPM];\r\n ensures CommonStateImplValid(common_state_out);\r\n ensures CommonStateImplToSpec(common_state_out) == CommonStateImplToSpec(common_state_in);\r\n\r\n requires public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state_in)));\r\n requires public(request_bytes);\r\n ensures public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state_out)));\r\n ensures public(response_bytes);\r\n{\r\n var request := ParseRequestPacket(request_bytes);\r\n var response:DiffPrivResponse;\r\n response, diffpriv_state_out, common_state_out := HandleOneRequest(request, diffpriv_state_in, common_state_in);\r\n response_bytes := FormResponsePacket(response);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/StateMachine.s.dfy", "content": "include \"DiffPriv.s.dfy\"\r\ninclude \"../../Drivers/TPM/tpm-device.s.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSASpec.s.dfy\"\r\ninclude \"../../Libraries/Util/be_sequences.s.dfy\"\r\n\r\n//-///////////////////////////\r\n//- State machine\r\n//-///////////////////////////\r\n\r\ndatatype DiffPrivStateMachine = DiffPrivStateMachine_ctor(initialized:bool, diffpriv_state:DiffPrivState)\r\n\r\nghost var {:readonly} current_diffpriv_state:DiffPrivStateMachine;\r\n\r\nghost method {:axiom} {:autoReq} InitializeDiffPrivStateMachine(diffpriv_state:DiffPrivState)\r\n requires !current_diffpriv_state.initialized;\r\n requires DiffPrivInitializeValid(diffpriv_state);\r\n ensures current_diffpriv_state == DiffPrivStateMachine_ctor(true, diffpriv_state);\r\n modifies this`current_diffpriv_state;\r\n\r\nghost method {:axiom} {:autoReq} AdvanceDiffPrivStateMachineByInitializingDB(budget_in:real, new_diffpriv_state:DiffPrivState)\r\n requires current_diffpriv_state.initialized;\r\n requires current_common_state.initialized;\r\n requires current_common_state.TPM == TPM;\r\n requires public(budget_in);\r\n requires public(PublicPartOfDiffPrivState(new_diffpriv_state));\r\n requires DiffPrivInitializedDBCorrectly(current_diffpriv_state.diffpriv_state, new_diffpriv_state, budget_in);\r\n modifies this`current_diffpriv_state;\r\n ensures current_diffpriv_state == old(current_diffpriv_state)[diffpriv_state := new_diffpriv_state];\r\n\r\nghost method {:axiom} {:autoReq} AdvanceDiffPrivStateMachineByAddingRow\r\n (request_ciphertext_in:seq, new_diffpriv_state:DiffPrivState)\r\n requires current_diffpriv_state.initialized;\r\n requires current_common_state.initialized;\r\n requires current_common_state.TPM == TPM;\r\n requires public(request_ciphertext_in);\r\n requires public(PublicPartOfDiffPrivState(new_diffpriv_state));\r\n requires DiffPrivRowAddedCorrectly(current_diffpriv_state.diffpriv_state, new_diffpriv_state,\r\n current_common_state.common_state.key_pair, request_ciphertext_in);\r\n modifies this`current_diffpriv_state;\r\n ensures current_diffpriv_state == old(current_diffpriv_state)[diffpriv_state := new_diffpriv_state];\r\n\r\nghost method {:axiom} {:autoReq} AdvanceDiffPrivStateMachineByAnsweringQuery\r\n (query_parameters_in:QueryParameters, new_diffpriv_state:DiffPrivState, response_out:int)\r\n returns (declassified_response_out:int)\r\n requires current_diffpriv_state.initialized;\r\n requires current_common_state.initialized;\r\n requires public(query_parameters_in);\r\n requires public(PublicPartOfDiffPrivState(new_diffpriv_state));\r\n requires DiffPrivQueryPerformedCorrectly(current_diffpriv_state.diffpriv_state, new_diffpriv_state, query_parameters_in,\r\n response_out, current_common_state.TPM, TPM);\r\n requires Word32(response_out);\r\n modifies this`current_common_state;\r\n modifies this`current_diffpriv_state;\r\n ensures current_common_state == old(current_common_state)[TPM := TPM];\r\n ensures current_diffpriv_state == old(current_diffpriv_state)[diffpriv_state := new_diffpriv_state];\r\n ensures relation(declassified(left(declassified_response_out), right(declassified_response_out), left(response_out), right(response_out)));\r\n ensures Word32(declassified_response_out);\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/StateMachine2.i.dfy", "content": "//-\r\n//-\r\ninclude \"StateMachine.s.dfy\"\r\ninclude \"DiffPriv.i.dfy\"\r\ninclude \"DiffPrivPerformQuery.i.dfy\"\r\ninclude \"../../Libraries/Net/Udp.i.dfy\"\r\ninclude \"../../Libraries/Util/Halter.i.dfy\"\r\ninclude \"../../Libraries/Util/relational.i.dfy\"\r\n\r\nmethod {:timeLimitMultiplier 4} HandleGetDiffPrivQuoteRequest(common_state_in:CommonStateImpl, nonce_external:seq)\r\n returns (response:DiffPrivResponse, common_state_out:CommonStateImpl)\r\n requires CommonStateImplValid(common_state_in);\r\n requires common_state_in.key_pair.pub.size >= 1024 / 8;\r\n requires TPM_ready();\r\n requires current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state_in), TPM);\r\n requires IsByteSeqOfLen(nonce_external, 20);\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_common_state;\r\n\r\n ensures TPM_ready();\r\n ensures WellformedResponse(response);\r\n ensures current_common_state == old(current_common_state)[TPM := TPM];\r\n ensures CommonStateImplValid(common_state_out);\r\n ensures CommonStateImplToSpec(common_state_out) == CommonStateImplToSpec(common_state_in);\r\n\r\n requires public(nonce_external);\r\n ensures public(response);\r\n{\r\n var encoded_public_key:seq, pcr_info_bytes:seq, sig_bytes:seq;\r\n common_state_out, encoded_public_key, pcr_info_bytes, sig_bytes := HandleGetQuoteRequest(common_state_in, nonce_external);\r\n ghost var declassified_encoded_public_key, declassified_pcr_info_bytes, declassified_sig_bytes :=\r\n AdvanceCommonStateMachineViaGetQuote(nonce_external, encoded_public_key, pcr_info_bytes, sig_bytes);\r\n var usable_encoded_public_key := UseDeclassifiedByteSequence(encoded_public_key, declassified_encoded_public_key);\r\n var usable_pcr_info_bytes := UseDeclassifiedByteSequence(pcr_info_bytes, declassified_pcr_info_bytes);\r\n var usable_sig_bytes := UseDeclassifiedByteSequence(sig_bytes, declassified_sig_bytes);\r\n response := GetQuoteResponse_ctor(0, usable_encoded_public_key, usable_pcr_info_bytes, usable_sig_bytes);\r\n}\r\n\r\nmethod HandleInitializeDBRequest(diffpriv_state_in:DiffPrivStateImpl, budget_num:int, budget_den:int)\r\n returns (diffpriv_state_out:DiffPrivStateImpl, response:DiffPrivResponse)\r\n requires current_common_state.initialized;\r\n requires current_common_state.TPM == TPM;\r\n requires DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state_in));\r\n requires current_diffpriv_state == DiffPrivStateMachine_ctor(true, DiffPrivStateImplToSpec(diffpriv_state_in));\r\n requires Word32(budget_num);\r\n requires Word32(budget_den);\r\n requires budget_den != 0;\r\n\r\n modifies this`current_diffpriv_state;\r\n\r\n ensures DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state_out));\r\n ensures WellformedResponse(response);\r\n ensures current_diffpriv_state == DiffPrivStateMachine_ctor(true, DiffPrivStateImplToSpec(diffpriv_state_out));\r\n\r\n requires public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state_in)));\r\n requires public(budget_num);\r\n requires public(budget_den);\r\n ensures public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state_out)));\r\n ensures public(response);\r\n{\r\n var init_error_code:int;\r\n init_error_code, diffpriv_state_out := DiffPrivInitializeDB(diffpriv_state_in, budget_num, budget_den);\r\n if init_error_code == 0 {\r\n AdvanceDiffPrivStateMachineByInitializingDB(real(budget_num) / real(budget_den), DiffPrivStateImplToSpec(diffpriv_state_out));\r\n }\r\n response := InitializeDBResponse_ctor(init_error_code);\r\n}\r\n\r\nmethod HandleAddRowRequest(diffpriv_state_in:DiffPrivStateImpl, common_state:CommonStateImpl, request_ciphertext:seq)\r\n returns (diffpriv_state_out:DiffPrivStateImpl, response:DiffPrivResponse)\r\n requires CommonStateImplValid(common_state);\r\n requires common_state.key_pair.pub.size >= 1024 / 8;\r\n requires TPM_ready();\r\n requires DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state_in));\r\n requires current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state), TPM);\r\n requires current_diffpriv_state == DiffPrivStateMachine_ctor(true, DiffPrivStateImplToSpec(diffpriv_state_in));\r\n requires IsByteSeq(request_ciphertext);\r\n requires |request_ciphertext| > 0;\r\n\r\n modifies this`current_diffpriv_state;\r\n\r\n ensures DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state_out));\r\n ensures WellformedResponse(response);\r\n ensures current_diffpriv_state == DiffPrivStateMachine_ctor(true, DiffPrivStateImplToSpec(diffpriv_state_out));\r\n\r\n requires public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state_in)));\r\n requires public(request_ciphertext);\r\n ensures public(PublicPartOfDiffPrivState(DiffPrivStateImplToSpec(diffpriv_state_out)));\r\n ensures public(response);\r\n{\r\n diffpriv_state_out := DiffPrivAddRow(diffpriv_state_in, common_state.key_pair, request_ciphertext);\r\n AdvanceDiffPrivStateMachineByAddingRow(request_ciphertext, DiffPrivStateImplToSpec(diffpriv_state_out));\r\n response := AddRowResponse_ctor();\r\n assert response.AddRowResponse_ctor?; // OBSERVE\r\n //assert DiffPrivStateValid(DiffPrivStateImplToSpec(diffpriv_state_out));\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/SumReducer.i.dfy", "content": "include \"SumReducer.s.dfy\"\r\ninclude \"Mapper.i.dfy\"\r\n\r\nstatic method ComputeSum (db:seq, program:seq, row_min:int, row_max:int,\r\n answer_units:int, answer_min:int, answer_max:int) returns (answer:int, ghost sum:int)\r\n requires DatabaseValid(db);\r\n requires ProgramValid(program);\r\n requires Word32(row_min);\r\n requires Word32(row_max);\r\n requires Word32(answer_units);\r\n requires Word32(answer_min);\r\n requires Word32(answer_max);\r\n requires row_min <= row_max;\r\n requires answer_units > 0;\r\n requires Word32(answer_units * 2);\r\n requires answer_min <= answer_max;\r\n ensures sum == MapperSum(db, program, row_min, row_max);\r\n ensures Word32(answer);\r\n ensures answer == Clip(Scale(sum, answer_units), answer_min, answer_max);\r\n{\r\n sum := 0;\r\n ghost var scaled_sum:int := 0;\r\n\r\n var clipped_scaled_sum:int := 0;\r\n var total_remainder:int := 0;\r\n\r\n lemma_mul_is_mul_boogie(answer_units, scaled_sum);\r\n\r\n var which_row := 0;\r\n while which_row < |db|\r\n invariant 0 <= which_row <= |db|;\r\n invariant Word32(clipped_scaled_sum);\r\n invariant sum == MapperSum(db[..which_row], program, row_min, row_max);\r\n invariant sum == answer_units * scaled_sum + total_remainder;\r\n invariant clipped_scaled_sum == (if scaled_sum < power2(32) then scaled_sum else power2(32) - 1);\r\n invariant 0 <= total_remainder < answer_units;\r\n invariant sum >= 0;\r\n {\r\n var row_value := RunProgram(program, db[which_row]);\r\n var clipped_value := ClipWord32(row_value, row_min, row_max);\r\n\r\n var scaled_value := clipped_value / answer_units;\r\n var scaling_remainder := clipped_value % answer_units;\r\n lemma_div_is_ordered_by_denominator(clipped_value, 1, answer_units);\r\n lemma_div_by_one_is_identity(clipped_value);\r\n lemma_div_pos_is_pos(clipped_value, answer_units);\r\n\r\n ghost var old_sum := sum;\r\n ghost var old_scaled_sum := scaled_sum;\r\n ghost var old_total_remainder := total_remainder;\r\n\r\n sum := sum + clipped_value;\r\n scaled_sum := scaled_sum + scaled_value;\r\n clipped_scaled_sum := SaturatingAdd(clipped_scaled_sum, scaled_value);\r\n\r\n lemma_mod_remainder_pos_specific(clipped_value, answer_units);\r\n assert 0 <= scaling_remainder < answer_units;\r\n assert Word32(total_remainder + scaling_remainder); //- so there's no need to use SaturatingAdd to add these\r\n total_remainder := total_remainder + scaling_remainder;\r\n\r\n calc {\r\n answer_units * scaled_sum + total_remainder;\r\n answer_units * (old_scaled_sum + scaled_value) + total_remainder;\r\n answer_units * (old_scaled_sum + scaled_value) + (old_total_remainder + scaling_remainder);\r\n { lemma_mul_is_distributive_add(answer_units, old_scaled_sum, scaled_value); }\r\n (answer_units * old_scaled_sum) + (answer_units * scaled_value) + (old_total_remainder + scaling_remainder);\r\n (answer_units * old_scaled_sum) + old_total_remainder + (answer_units * scaled_value) + scaling_remainder;\r\n old_sum + (answer_units * scaled_value) + scaling_remainder;\r\n { lemma_fundamental_div_mod(clipped_value, answer_units); }\r\n old_sum + clipped_value;\r\n sum;\r\n }\r\n\r\n if total_remainder >= answer_units {\r\n ghost var intermediate_scaled_sum := scaled_sum;\r\n ghost var intermediate_total_remainder := total_remainder;\r\n scaled_sum := scaled_sum + 1;\r\n clipped_scaled_sum := SaturatingAdd(clipped_scaled_sum, 1);\r\n total_remainder := total_remainder - answer_units;\r\n calc {\r\n answer_units * scaled_sum + total_remainder;\r\n answer_units * (intermediate_scaled_sum + 1) + total_remainder;\r\n { lemma_mul_is_distributive_add(answer_units, intermediate_scaled_sum, 1); lemma_mul_is_mul_boogie(answer_units, 1); }\r\n answer_units * intermediate_scaled_sum + answer_units * 1 + total_remainder;\r\n answer_units * intermediate_scaled_sum + answer_units + total_remainder;\r\n answer_units * intermediate_scaled_sum + answer_units + intermediate_total_remainder - answer_units;\r\n answer_units * intermediate_scaled_sum + intermediate_total_remainder;\r\n sum;\r\n }\r\n }\r\n\r\n which_row := which_row + 1;\r\n assert db[..which_row][..|db[..which_row]|-1] == db[..which_row-1];\r\n }\r\n\r\n var extra:int := (if total_remainder * 2 >= answer_units then 1 else 0);\r\n clipped_scaled_sum := SaturatingAdd(clipped_scaled_sum, extra);\r\n\r\n assert db[..which_row] == db;\r\n lemma_mul_is_commutative(answer_units, scaled_sum);\r\n lemma_fundamental_div_mod_converse(sum, answer_units, scaled_sum, total_remainder);\r\n assert sum / answer_units == scaled_sum;\r\n assert sum % answer_units == total_remainder;\r\n calc {\r\n Scale(MapperSum(db, program, row_min, row_max), answer_units);\r\n Scale(sum, answer_units);\r\n (sum / answer_units) + (if (sum % answer_units) * 2 >= answer_units then 1 else 0);\r\n (sum / answer_units) + extra;\r\n scaled_sum + extra;\r\n }\r\n\r\n assert db[..which_row] == db;\r\n answer := ClipWord32(clipped_scaled_sum, answer_min, answer_max);\r\n}\r\n\r\n//-////////////////////////////////////\r\n//- Helpers\r\n//-////////////////////////////////////\r\n\r\nstatic function method SaturatingAdd(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(SaturatingAdd(x, y));\r\n ensures SaturatingAdd(x, y) == if x + y < power2(32) then x + y else power2(32) - 1;\r\n{\r\n lemma_2toX();\r\n if x + y <= 0xFFFFFFFF then x + y else 0xFFFFFFFF\r\n}\r\n\r\nstatic function method ClipWord32 (value:int, min:int, max:int) : int\r\n requires Word32(value);\r\n requires Word32(min);\r\n requires Word32(max);\r\n requires min <= max;\r\n ensures ClipWord32(value, min, max) == Clip(value, min, max);\r\n{\r\n if value < min then min else if value > max then max else value\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/DiffPriv/SumReducer.s.dfy", "content": "include \"Math.s.dfy\"\r\ninclude \"Mapper.s.dfy\"\r\n\r\nstatic function MapperSum (db:seq, program:seq, row_min:int, row_max:int) : int\r\n requires DatabaseValid(db);\r\n requires ProgramValid(program);\r\n requires row_min <= row_max;\r\n{\r\n if |db| == 0 then\r\n 0\r\n else\r\n MapperSum(db[..|db|-1], program, row_min, row_max) + Clip(EvaluateProgram(program, db[|db|-1]), row_min, row_max)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/EtherTest/EtherTest.i.dfy", "content": "include \"../../Drivers/Network/Intel/driver.i.dfy\"\r\ninclude \"../../Libraries/Net/ethernet.i.dfy\"\r\ninclude \"../../Libraries/Util/integer_sequences.i.dfy\"\r\n\r\n//-\r\n//- Ethernet Test App.\r\n//-\r\n\r\n//-method DebugPrintSequence(Offset:int, Data:seq)\r\n//- requires 0 <= Offset <= 160 - 16;\r\n//- requires IsByteSeq(Data);\r\n//- requires |Data| >= 0;\r\n//-{\r\n//- var Index:int := 0;\r\n//-\r\n//- while (Index < |Data|)\r\n//- decreases |Data| - Index;\r\n//- invariant Index >= 0;\r\n//- invariant Index <= |Data|;\r\n//- {\r\n//- debug_print(Offset, Data[Index]);\r\n//- Index := Index + 1;\r\n//- }\r\n//-}\r\n\r\nmethod GenerateSecret() returns (secret:int)\r\n ensures IsByte(secret);\r\n{\r\n secret := 42;\r\n}\r\n\r\nmethod Main()\r\n returns (Result:int)\r\n ensures public(true);\r\n{\r\n lemma_2toX();\r\n\r\n var NetUp, net_state := init_network_card();\r\n\r\n //-var my_secret := GenerateSecret();\r\n\r\n if NetUp {\r\n var Headers := [0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20];\r\n var Data := [0x57, 0x6f, 0x72, 0x6c, 0x64, 0x21];\r\n\r\n //- This line fails SymDiff, as expected\r\n //-Data := Data + [my_secret];\r\n\r\n assert IsByteSeq(Headers);\r\n assert IsByteSeq(Data);\r\n\r\n debug_print(0x90, 0xded0d0d0);\r\n\r\n net_state := EtherSend(net_state, ethernet_addr_builder([0x60, 0x61, 0x62, 0x63, 0x64, 0x65]), Headers, Data);\r\n\r\n debug_print(0x90, 0xdedadada);\r\n Result := 0xdedadada;\r\n\r\n } else {\r\n Result := 0xdeaddead;\r\n debug_print(0x90, 0xdeaddead);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/Notary/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/Notary/Main.i.dfy", "content": "//-\r\ninclude \"StateMachine.i.dfy\"\r\ninclude \"MainOneStep.i.dfy\"\r\ninclude \"../../Libraries/Net/Udp.i.dfy\"\r\n\r\nmethod MainInitialize () returns (notary_state:NotaryStateImpl, common_state:CommonStateImpl, net_state:network_state)\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n requires current_common_state.TPM == TPM;\r\n requires !current_common_state.initialized;\r\n requires !current_notary_state.initialized;\r\n\r\n ensures TPM_ready();\r\n ensures NotaryStateImplValid(notary_state);\r\n ensures CommonStateImplValid(common_state);\r\n ensures common_state.key_pair.pub.size >= 1024 / 8;\r\n ensures KeyCanBeExtendedIntoPCR(CommonStateImplToSpec(common_state).key_pair);\r\n ensures current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state), TPM);\r\n ensures current_notary_state == NotaryStateMachine_ctor(true, NotaryStateImplToSpec(notary_state));\r\n ensures valid_network_state(net_state);\r\n \r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_common_state;\r\n modifies this`current_notary_state;\r\n ensures TPMs_match_except_for_randoms(TPM, old(TPM)[PCR_19 := TPM.PCR_19]);\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n\r\n ensures public(NotaryStateImplToSpec(notary_state));\r\n ensures public(net_state);\r\n{\r\n var success:bool;\r\n success, net_state := init_network_card();\r\n if !success {\r\n HaltMachine(0x40);\r\n }\r\n\r\n common_state := GenerateCommonState(1024);\r\n assert TPMs_match_except_for_randoms(TPM, old(TPM)[PCR_19 := TPM.PCR_19]);\r\n ghost var common_state_key_pair := common_state.key_pair;\r\n ghost var common_state_spec := CommonStateImplToSpec(common_state);\r\n InitializeCommonStateMachine(common_state_spec);\r\n\r\n notary_state := NotaryInitialize();\r\n ghost var notary_state_spec := NotaryStateImplToSpec(notary_state);\r\n assert NotaryStateImplValid(notary_state) && NotaryInitializeValid(notary_state_spec);\r\n InitializeNotaryStateMachine(notary_state_spec);\r\n}\r\n\r\n//-//////////////////////////////////\r\n//- Main routine\r\n//-//////////////////////////////////\r\n\r\nmethod Main () returns (result:int)\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n requires current_common_state.TPM == TPM;\r\n requires !current_common_state.initialized;\r\n requires !current_notary_state.initialized;\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_common_state;\r\n modifies this`current_notary_state;\r\n ensures public(true); //- Needed to convince DafnyCC this procedure involves relational calls\r\n{\r\n var notary_state, common_state, net_state := MainInitialize();\r\n\r\n ghost var post_init_TPM := TPM;\r\n\r\n while true\r\n invariant TPM_ready();\r\n invariant valid_network_state(net_state);\r\n invariant NotaryStateImplValid(notary_state);\r\n invariant CommonStateImplValid(common_state);\r\n invariant common_state.key_pair.pub.size >= 1024 / 8;\r\n invariant current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state), TPM);\r\n invariant current_notary_state == NotaryStateMachine_ctor(true, NotaryStateImplToSpec(notary_state));\r\n invariant TPMs_match(TPM, post_init_TPM);\r\n invariant public(NotaryStateImplToSpec(notary_state));\r\n invariant public(net_state);\r\n decreases *;\r\n {\r\n notary_state, common_state, net_state := MainOneStep(notary_state, common_state, net_state);\r\n }\r\n\r\n return 0;\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/Notary/MainOneStep.i.dfy", "content": "//-\r\ninclude \"StateMachine.i.dfy\"\r\ninclude \"../../Libraries/Net/Udp.i.dfy\"\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} MainOneStep\r\n (notary_state_in:NotaryStateImpl, common_state_in:CommonStateImpl, net_state_in:network_state)\r\n returns (notary_state_out:NotaryStateImpl, common_state_out:CommonStateImpl, net_state_out:network_state)\r\n requires TPM_ready();\r\n requires valid_network_state(net_state_in);\r\n requires CommonStateImplValid(common_state_in);\r\n requires common_state_in.key_pair.pub.size >= 1024 / 8;\r\n requires NotaryStateImplValid(notary_state_in);\r\n requires current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state_in), TPM);\r\n requires current_notary_state == NotaryStateMachine_ctor(true, NotaryStateImplToSpec(notary_state_in));\r\n\r\n ensures TPM_ready();\r\n ensures valid_network_state(net_state_out);\r\n ensures NotaryStateImplValid(notary_state_out);\r\n ensures current_notary_state == NotaryStateMachine_ctor(true, NotaryStateImplToSpec(notary_state_out));\r\n ensures current_common_state == old(current_common_state)[TPM := TPM];\r\n ensures CommonStateImplValid(common_state_out);\r\n ensures CommonStateImplToSpec(common_state_out) == CommonStateImplToSpec(common_state_in);\r\n ensures TPMs_match(TPM, old(TPM));\r\n\r\n requires public(NotaryStateImplToSpec(notary_state_in));\r\n requires public(net_state_in);\r\n ensures public(NotaryStateImplToSpec(notary_state_out));\r\n ensures public(net_state_out);\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_notary_state;\r\n modifies this`current_common_state;\r\n{\r\n ghost var notary_state_in_spec := NotaryStateImplToSpec(notary_state_in);\r\n ghost var common_state_spec := CommonStateImplToSpec(common_state_in);\r\n ghost var common_state_key_pair := common_state_in.key_pair;\r\n\r\n var success:bool, client_eth:ethernet_addr, client_ip:IPv4Address, my_ip:IPv4Address, client_port:int, my_port:int, request_packet:seq;\r\n success, net_state_out, client_eth, client_ip, my_ip, client_port, my_port, request_packet := UdpReceive(net_state_in);\r\n if !success {\r\n notary_state_out := notary_state_in;\r\n common_state_out := common_state_in;\r\n return;\r\n }\r\n\r\n var request := ParseRequestPacket(request_packet);\r\n var response:NotaryResponse;\r\n response, notary_state_out, common_state_out := HandleOneRequest(request, notary_state_in, common_state_in);\r\n var response_bytes := FormResponsePacket(response);\r\n if |response_bytes| <= 1472 {\r\n net_state_out := UdpSend(net_state_out, client_eth, my_ip, client_ip, my_port, client_port, response_bytes);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/Notary/Notary.i.dfy", "content": "//-\r\ninclude \"Notary.s.dfy\"\r\ninclude \"../../Libraries/Util/relational.s.dfy\"\r\ninclude \"../../Libraries/BigNum/BigNum.i.dfy\"\r\ninclude \"../../Libraries/BigNum/BigNatBitCount.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/KeyGen.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSA.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSAOps.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/rfc4251impl.i.dfy\"\r\ninclude \"../Common/CommonState.i.dfy\"\r\n\r\n//- This method has problems verifying unless it's the first one in the file.\r\n\r\nmethod {:timeLimitMultiplier 2} CreateNotaryStatement (new_counter_value:BigNat, message:seq) returns (success:bool, notary_statement:seq)\r\n requires WellformedBigNat(new_counter_value);\r\n requires ModestBigNatValue(new_counter_value);\r\n requires IsByteSeq(message);\r\n\r\n ensures I(new_counter_value) < power2(power2(34));\r\n ensures notary_statement == [34] + rfc4251_mpint_encoding_premium(I(new_counter_value)) + message;\r\n ensures success == (|notary_statement| <= 0xFFFFFF);\r\n ensures success ==> Word32(|rfc4251_positive_to_twoscomplement(BEIntToByteSeq(I(new_counter_value)))|) &&\r\n IsByteSeq(notary_statement) && |notary_statement| < power2(28) && Word32(|notary_statement|) &&\r\n notary_statement == NotaryCounterAdvanceStatement(I(new_counter_value), message);\r\n{\r\n lemma_2toX();\r\n lemma_power2_add8(24);\r\n\r\n var counter_encoding := rfc4251_encode_mpint_legacy(new_counter_value);\r\n notary_statement := [34] + counter_encoding + message;\r\n success := |notary_statement| <= 0xFFFFFF;\r\n if !success {\r\n return;\r\n }\r\n\r\n Lemma_NotaryCounterAdvanceStatementValid(notary_statement, I(new_counter_value), message, counter_encoding);\r\n assert IsByte(34);\r\n assert IsByteSeq(notary_statement);\r\n assert |notary_statement| <= 0xFFFFFFF < power2(28);\r\n assert Word32(|rfc4251_positive_to_twoscomplement(BEIntToByteSeq(I(new_counter_value)))|);\r\n assert Word32(|notary_statement|);\r\n assert notary_statement == NotaryCounterAdvanceStatement(I(new_counter_value), message);\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- Implementing NotaryState with NotaryStateImpl\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\ndatatype NotaryStateImpl = NotaryStateImplConstructor(counter:BigNat);\r\n\r\nstatic function NotaryStateImplToSpec(s:NotaryStateImpl):NotaryState\r\n{\r\n NotaryStateConstructor(if WellformedBigNat(s.counter) then I(s.counter) else 0)\r\n}\r\n\r\nstatic predicate NotaryStateImplValid(notary_state:NotaryStateImpl)\r\n{\r\n WellformedBigNat(notary_state.counter)\r\n && ModestBigNatValue(notary_state.counter)\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- Lemmas\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nlemma Lemma_NotaryCounterAdvanceStatementValid(statement:seq, new_counter_value:nat, message:seq, counter_encoding:seq)\r\n requires IsByteSeq(message);\r\n requires new_counter_value < power2(power2(34));\r\n requires counter_encoding == rfc4251_mpint_encoding_premium(new_counter_value);\r\n requires statement == [34] + counter_encoding + message;\r\n ensures statement == NotaryCounterAdvanceStatement(new_counter_value, message);\r\n{\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- Exported methods\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nmethod NotaryInitialize() returns (notary_state:NotaryStateImpl)\r\n ensures NotaryStateImplValid(notary_state);\r\n ensures NotaryInitializeValid(NotaryStateImplToSpec(notary_state));\r\n ensures public(NotaryStateImplToSpec(notary_state));\r\n{\r\n var zero := MakeSmallLiteralBigNat(0);\r\n notary_state := NotaryStateImplConstructor(zero);\r\n assert NotaryStateImplToSpec(notary_state) == NotaryStateConstructor(0);\r\n}\r\n\r\nstatic predicate NotaryAdvanceCounterValid_premium(in_state:NotaryState, out_state:NotaryState, common_state:CommonState,\r\n message_in:seq, notary_statement_out:seq, notary_attestation_out:seq)\r\n requires WellformedRSAKeyPairSpec(common_state.key_pair);\r\n requires IsByteSeq(message_in);\r\n requires IsByteSeq(notary_statement_out);\r\n requires Word32(|notary_statement_out|);\r\n requires IsByteSeq(notary_attestation_out);\r\n requires Word32(|notary_attestation_out|);\r\n requires out_state.counter < KindaBigNat();\r\n requires RSASignatureRequires(common_state.key_pair, notary_statement_out);\r\n{\r\n calc {\r\n out_state.counter;\r\n < KindaBigNat();\r\n == power2(power2(31));\r\n <= { lemma_power2_increases(31, 34); lemma_power2_increases(power2(31), power2(34)); }\r\n power2(power2(34));\r\n }\r\n assert IsByteSeq(rfc4251_mpint_encoding_premium(out_state.counter));\r\n assert IsDigitSeq(power2(32), [|rfc4251_positive_to_twoscomplement(BEIntToByteSeq(out_state.counter))|]);\r\n NotaryAdvanceCounterValid(in_state, out_state, common_state, message_in, notary_statement_out, notary_attestation_out)\r\n}\r\n\r\nmethod AddOneAndRemainModest (n:BigNat) returns (success:bool, nPlusOne:BigNat)\r\n requires WellformedBigNat(n);\r\n\r\n ensures WellformedBigNat(nPlusOne);\r\n ensures I(nPlusOne) == I(n) + 1;\r\n ensures success == (WellformedBigNat(nPlusOne) && I(nPlusOne) < KindaBigNat());\r\n{\r\n lemma_2toX();\r\n\r\n var one := MakeSmallLiteralBigNat(1);\r\n nPlusOne := BigNatAdd(n, one);\r\n success := IsModestBigNat(nPlusOne);\r\n}\r\n\r\nmethod{:dafnycc_conservative_seq_triggers} NotaryAdvanceCounter (in_state:NotaryStateImpl, common_state:CommonStateImpl, message:seq)\r\n returns (out_state:NotaryStateImpl, error_code:int, notary_statement:seq, notary_attestation:seq)\r\n requires NotaryStateImplValid(in_state);\r\n requires CommonStateImplValid(common_state);\r\n requires common_state.key_pair.pub.size >= 1024 / 8;\r\n requires IsByteSeq(message);\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures old(TPM)==TPM;\r\n ensures NotaryStateImplValid(out_state);\r\n ensures Word32(error_code);\r\n ensures Word32(|notary_statement|);\r\n ensures Word32(|notary_attestation|);\r\n ensures IsByteSeq(notary_statement);\r\n ensures IsByteSeq(notary_attestation);\r\n ensures error_code == 0 ==> RSASignatureRequires(CommonStateImplToSpec(common_state).key_pair, notary_statement) &&\r\n NotaryAdvanceCounterValid_premium(NotaryStateImplToSpec(in_state), NotaryStateImplToSpec(out_state),\r\n CommonStateImplToSpec(common_state), message, notary_statement,\r\n notary_attestation);\r\n ensures error_code != 0 ==> out_state == in_state && notary_statement == [] && notary_attestation == [];\r\n requires public(NotaryStateImplToSpec(in_state));\r\n requires public(message);\r\n ensures public(NotaryStateImplToSpec(out_state));\r\n ensures public(error_code);\r\n ensures public(notary_statement);\r\n{\r\n lemma_2toX();\r\n\r\n var success, new_counter_value := AddOneAndRemainModest(in_state.counter);\r\n if !success {\r\n error_code := 1;\r\n out_state := in_state;\r\n notary_statement := [];\r\n notary_attestation := [];\r\n return;\r\n }\r\n\r\n success, notary_statement := CreateNotaryStatement(new_counter_value, message);\r\n if !success {\r\n error_code := 2;\r\n out_state := in_state;\r\n notary_statement := [];\r\n notary_attestation := [];\r\n return;\r\n }\r\n\r\n assert old(TPM)==TPM;\r\n notary_attestation := DigestedSign(common_state.key_pair, notary_statement);\r\n assert old(TPM)==TPM;\r\n\r\n error_code := 0;\r\n out_state := NotaryStateImplConstructor(new_counter_value);\r\n\r\n assert NotaryStateImplToSpec(out_state) == NotaryStateConstructor(I(new_counter_value));\r\n assert notary_statement == NotaryCounterAdvanceStatement(NotaryStateImplToSpec(out_state).counter, message);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/Notary/Notary.s.dfy", "content": "include \"../../Libraries/Util/be_sequences.s.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSASpec.s.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/rfc4251.s.dfy\"\r\ninclude \"../Common/CommonState.s.dfy\"\r\ninclude \"../../Drivers/TPM/tpm-device.s.dfy\"\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Structures\r\n//-///////////////////////////////////////////////////\r\n\r\ndatatype NotaryState = NotaryStateConstructor(counter:nat);\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Helpers\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic function {:autoReq} NotaryCounterAdvanceStatement(new_counter_value:nat, message:seq) : seq\r\n{\r\n [34] + rfc4251_mpint_encoding(new_counter_value) + message\r\n}\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Specifications for correct method operation\r\n//-///////////////////////////////////////////////////\r\n\r\n//- This function is used to ensure that notary initialization operates correctly.\r\n\r\nstatic predicate {:autoReq} NotaryInitializeValid(notary_state:NotaryState)\r\n{\r\n notary_state.counter == 0\r\n}\r\n\r\n//- This function is used to ensure that NotaryAdvanceCounter operates\r\n//- correctly. That method is supposed to advance the given counter to the\r\n//- next counter value. It should then return an attestation that the\r\n//- counter was advanced.\r\n\r\nstatic predicate {:autoReq} NotaryAdvanceCounterValid(in_state:NotaryState, out_state:NotaryState, common_state:CommonState,\r\n message_in:seq, notary_statement_out:seq, notary_attestation_out:seq)\r\n{\r\n out_state.counter == in_state.counter + 1 &&\r\n WellformedRSAKeyPairSpec(common_state.key_pair) &&\r\n IsByteSeq(message_in) &&\r\n IsByteSeq(notary_statement_out) &&\r\n IsByteSeq(notary_attestation_out) &&\r\n notary_statement_out == NotaryCounterAdvanceStatement(out_state.counter, message_in) &&\r\n notary_attestation_out == RSASignature(common_state.key_pair, notary_statement_out)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/Notary/PacketParsing.c.dfy", "content": "include \"Notary.s.dfy\"\r\n\r\n//-///////////////////////////\r\n//- Request parsing\r\n//-///////////////////////////\r\n\r\ndatatype NotaryRequest = InvalidRequest_ctor()\r\n | GetQuoteRequest_ctor(nonce_external:seq)\r\n | AdvanceCounterRequest_ctor(message:seq)\r\n\r\nstatic predicate RequestParsedCorrectly(data:seq, request:NotaryRequest)\r\n{\r\n if |data| == 0 then\r\n request.InvalidRequest_ctor?\r\n else if data[0] == 1 then\r\n GetQuoteRequestParsedCorrectly(data, request)\r\n else if data[0] == 2 then\r\n AdvanceCounterRequestParsedCorrectly(data, request)\r\n else\r\n request.InvalidRequest_ctor?\r\n}\r\n\r\nstatic predicate GetQuoteRequestParsedCorrectly(data:seq, request:NotaryRequest)\r\n requires |data| > 0;\r\n requires data[0] == 1;\r\n{\r\n if |data| < 21 then\r\n request.InvalidRequest_ctor?\r\n else\r\n request.GetQuoteRequest_ctor?\r\n && request.nonce_external == data[1..21]\r\n}\r\n\r\nstatic predicate AdvanceCounterRequestParsedCorrectly(data:seq, request:NotaryRequest)\r\n requires |data| > 0;\r\n requires data[0] == 2;\r\n{\r\n if |data| < 2 then\r\n request.InvalidRequest_ctor?\r\n else\r\n (\r\n var message_len := data[1];\r\n if message_len < 0 || |data| < 2 + message_len then\r\n request.InvalidRequest_ctor?\r\n else\r\n request.AdvanceCounterRequest_ctor?\r\n && request.message == data[2..2+message_len]\r\n )\r\n}\r\n\r\n//-///////////////////////////\r\n//- Response parsing\r\n//-///////////////////////////\r\n\r\ndatatype NotaryResponse = NullResponse_ctor()\r\n | GetQuoteResponse_ctor(get_quote_error_code:int, encoded_public_key:seq,\r\n pcr_info_bytes:seq, sig_bytes:seq)\r\n | AdvanceCounterResponse_ctor(advance_error_code:int, notary_statement:seq, notary_attestation:seq)\r\n\r\nstatic predicate ResponseFormedCorrectly(response:NotaryResponse, data:seq)\r\n{\r\n match response\r\n case NullResponse_ctor =>\r\n |data| >= 1 && data[0] == 0\r\n\r\n case GetQuoteResponse_ctor(get_quote_error_code, encoded_public_key, pcr_info_bytes, sig_bytes) =>\r\n Word32(get_quote_error_code)\r\n && Word32(|encoded_public_key|)\r\n && Word32(|pcr_info_bytes|)\r\n && Word32(|sig_bytes|)\r\n && IsByteSeq(encoded_public_key)\r\n && IsByteSeq(pcr_info_bytes)\r\n && IsByteSeq(sig_bytes)\r\n && data == [1] + BEWordToFourBytes(get_quote_error_code) + BEWordToFourBytes(|encoded_public_key|) +\r\n BEWordToFourBytes(|pcr_info_bytes|) + BEWordToFourBytes(|sig_bytes|) + encoded_public_key +\r\n pcr_info_bytes + sig_bytes\r\n\r\n case AdvanceCounterResponse_ctor(advance_error_code, notary_statement, notary_attestation) =>\r\n Word32(advance_error_code)\r\n && IsByteSeq(notary_statement)\r\n && IsByteSeq(notary_attestation)\r\n && Word32(|notary_statement|)\r\n && Word32(|notary_attestation|)\r\n && data == [2] + BEWordToFourBytes(advance_error_code) + BEWordToFourBytes(|notary_statement|) +\r\n BEWordToFourBytes(|notary_attestation|) + notary_statement + notary_attestation\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/Notary/PacketParsing.i.dfy", "content": "//-\r\ninclude \"PacketParsing.c.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSA.i.dfy\"\r\ninclude \"../../Libraries/Util/Halter.i.dfy\"\r\n\r\n//-//////////////////////////\r\n//- Request parsing\r\n//-//////////////////////////\r\n\r\nstatic predicate RequestValid (request:NotaryRequest)\r\n{\r\n match request\r\n case InvalidRequest_ctor => true\r\n case GetQuoteRequest_ctor(nonce_external) => IsByteSeq(nonce_external) && |nonce_external| == 20\r\n case AdvanceCounterRequest_ctor(message) => IsByteSeq(message)\r\n}\r\n\r\nstatic method ParseRequestPacket (data:seq) returns (request:NotaryRequest)\r\n requires IsByteSeq(data);\r\n requires public(data);\r\n ensures RequestParsedCorrectly(data, request);\r\n ensures RequestValid(request);\r\n ensures public(request);\r\n{\r\n if |data| == 0 {\r\n request := InvalidRequest_ctor();\r\n return;\r\n }\r\n if data[0] == 1 {\r\n request := ParseGetQuoteRequestPacket(data);\r\n return;\r\n }\r\n if data[0] == 2 {\r\n request := ParseAdvanceCounterRequestPacket(data);\r\n return;\r\n }\r\n request := InvalidRequest_ctor();\r\n}\r\n\r\nstatic method ParseGetQuoteRequestPacket (data:seq) returns (request:NotaryRequest)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 1;\r\n requires public(data);\r\n ensures GetQuoteRequestParsedCorrectly(data, request);\r\n ensures RequestValid(request);\r\n ensures public(request);\r\n{\r\n if |data| < 21 {\r\n request := InvalidRequest_ctor();\r\n return;\r\n }\r\n var nonce_external := data[1..21];\r\n return GetQuoteRequest_ctor(nonce_external);\r\n}\r\n\r\nstatic method ParseAdvanceCounterRequestPacket (data:seq) returns (request:NotaryRequest)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 2;\r\n requires public(data);\r\n ensures AdvanceCounterRequestParsedCorrectly(data, request);\r\n ensures RequestValid(request);\r\n ensures public(request);\r\n{\r\n if |data| < 2 {\r\n request := InvalidRequest_ctor();\r\n return;\r\n }\r\n var message_len := data[1];\r\n if |data| < 2 + message_len {\r\n request := InvalidRequest_ctor();\r\n return;\r\n }\r\n request := AdvanceCounterRequest_ctor(data[2..2+message_len]);\r\n}\r\n\r\n//-//////////////////////////\r\n//- Response forming\r\n//-//////////////////////////\r\n\r\nstatic predicate WellformedResponse (response:NotaryResponse)\r\n{\r\n match response\r\n case NullResponse_ctor => true\r\n\r\n case GetQuoteResponse_ctor(error_code, encoded_public_key, pcr_info_bytes, sig_bytes) =>\r\n Word32(error_code)\r\n && Word32(|encoded_public_key|)\r\n && Word32(|pcr_info_bytes|)\r\n && Word32(|sig_bytes|)\r\n && IsByteSeq(encoded_public_key)\r\n && IsByteSeq(pcr_info_bytes)\r\n && IsByteSeq(sig_bytes)\r\n\r\n case AdvanceCounterResponse_ctor(error_code, statement, attestation) =>\r\n Word32(error_code)\r\n && Word32(|statement|)\r\n && Word32(|attestation|)\r\n && IsByteSeq(statement)\r\n && IsByteSeq(attestation)\r\n}\r\n\r\nstatic method FormResponsePacket (response:NotaryResponse) returns (data:seq)\r\n requires WellformedResponse(response);\r\n requires public(response);\r\n ensures IsByteSeq(data);\r\n ensures ResponseFormedCorrectly(response, data);\r\n ensures public(data);\r\n{\r\n lemma_2toX();\r\n\r\n match response {\r\n case NullResponse_ctor =>\r\n data := [0];\r\n assert ResponseFormedCorrectly(response, data);\r\n\r\n case GetQuoteResponse_ctor(get_quote_error_code, encoded_public_key, pcr_info_bytes, sig_bytes) =>\r\n var get_quote_error_code_encoded := BEWordToFourBytes_impl(get_quote_error_code);\r\n var encoded_public_key_len_encoded := BEWordToFourBytes_impl(|encoded_public_key|);\r\n var pcr_info_bytes_len_encoded := BEWordToFourBytes_impl(|pcr_info_bytes|);\r\n var sig_bytes_len_encoded := BEWordToFourBytes_impl(|sig_bytes|);\r\n data := [1] + get_quote_error_code_encoded + encoded_public_key_len_encoded + pcr_info_bytes_len_encoded +\r\n sig_bytes_len_encoded + encoded_public_key + pcr_info_bytes + sig_bytes;\r\n assert forall i :: 0 <= i < |data| ==> IsByte(data[i]);\r\n assert ResponseFormedCorrectly(response, data);\r\n\r\n case AdvanceCounterResponse_ctor(advance_error_code, notary_statement, notary_attestation) =>\r\n var advance_error_code_encoded := BEWordToFourBytes_impl(advance_error_code);\r\n var notary_statement_len_encoded := BEWordToFourBytes_impl(|notary_statement|);\r\n var notary_attestation_len_encoded := BEWordToFourBytes_impl(|notary_attestation|);\r\n data := [2] + advance_error_code_encoded + notary_statement_len_encoded + notary_attestation_len_encoded +\r\n notary_statement + notary_attestation;\r\n assert forall i :: 0 <= i < |data| ==> IsByte(data[i]);\r\n assert ResponseFormedCorrectly(response, data);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/Notary/StateMachine.i.dfy", "content": "//-\r\ninclude \"StateMachine.s.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\ninclude \"Notary.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSA.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSAOps.i.dfy\"\r\ninclude \"../../Libraries/Net/Udp.i.dfy\"\r\ninclude \"../../Libraries/Util/Halter.i.dfy\"\r\ninclude \"../../Libraries/Util/relational.i.dfy\"\r\n\r\nmethod {:timeLimitMultiplier 6} HandleOneRequest (request:NotaryRequest, notary_state_in:NotaryStateImpl, common_state_in:CommonStateImpl)\r\n returns (response:NotaryResponse, notary_state_out:NotaryStateImpl, common_state_out:CommonStateImpl)\r\n requires NotaryStateImplValid(notary_state_in);\r\n requires CommonStateImplValid(common_state_in);\r\n requires common_state_in.key_pair.pub.size >= 1024 / 8;\r\n requires TPM_ready();\r\n requires current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state_in), TPM);\r\n requires current_notary_state == NotaryStateMachine_ctor(true, NotaryStateImplToSpec(notary_state_in));\r\n requires RequestValid(request);\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_notary_state;\r\n modifies this`current_common_state;\r\n\r\n ensures NotaryStateImplValid(notary_state_out);\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM));\r\n ensures WellformedResponse(response);\r\n ensures current_notary_state == NotaryStateMachine_ctor(true, NotaryStateImplToSpec(notary_state_out));\r\n ensures current_common_state == old(current_common_state)[TPM := TPM];\r\n ensures CommonStateImplValid(common_state_out);\r\n ensures CommonStateImplToSpec(common_state_out) == CommonStateImplToSpec(common_state_in);\r\n\r\n requires public(NotaryStateImplToSpec(notary_state_in));\r\n requires public(request);\r\n ensures public(NotaryStateImplToSpec(notary_state_out));\r\n ensures public(response);\r\n{\r\n ghost var old_TPM := TPM;\r\n\r\n match request {\r\n case InvalidRequest_ctor =>\r\n notary_state_out := notary_state_in;\r\n response := NullResponse_ctor();\r\n common_state_out := common_state_in;\r\n\r\n case GetQuoteRequest_ctor(nonce_external) =>\r\n var encoded_public_key:seq, pcr_info_bytes:seq, sig_bytes:seq;\r\n common_state_out, encoded_public_key, pcr_info_bytes, sig_bytes := HandleGetQuoteRequest(common_state_in, nonce_external);\r\n ghost var declassified_encoded_public_key, declassified_pcr_info_bytes, declassified_sig_bytes :=\r\n AdvanceCommonStateMachineViaGetQuote(nonce_external, encoded_public_key, pcr_info_bytes, sig_bytes);\r\n var usable_encoded_public_key := UseDeclassifiedByteSequence(encoded_public_key, declassified_encoded_public_key);\r\n var usable_pcr_info_bytes := UseDeclassifiedByteSequence(pcr_info_bytes, declassified_pcr_info_bytes);\r\n var usable_sig_bytes := UseDeclassifiedByteSequence(sig_bytes, declassified_sig_bytes);\r\n notary_state_out := notary_state_in;\r\n response := GetQuoteResponse_ctor(0, usable_encoded_public_key, usable_pcr_info_bytes, usable_sig_bytes);\r\n\r\n case AdvanceCounterRequest_ctor(message) =>\r\n var error_code:int, notary_statement:seq, notary_attestation:seq;\r\n notary_state_out, error_code, notary_statement, notary_attestation :=\r\n NotaryAdvanceCounter(notary_state_in, common_state_in, message);\r\n var usable_notary_attestation:seq;\r\n if error_code != 0 {\r\n usable_notary_attestation := [];\r\n }\r\n else {\r\n ghost var declassified_notary_attestation :=\r\n AdvanceNotaryStateMachineViaAdvanceCounter(message, NotaryStateImplToSpec(notary_state_out),\r\n notary_statement, notary_attestation);\r\n usable_notary_attestation := UseDeclassifiedByteSequence(notary_attestation, declassified_notary_attestation);\r\n }\r\n response := AdvanceCounterResponse_ctor(error_code, notary_statement, usable_notary_attestation);\r\n common_state_out := common_state_in;\r\n }\r\n}\r\n\r\nmethod HandleOneRequestRaw (request_bytes:seq, notary_state_in:NotaryStateImpl, common_state_in:CommonStateImpl)\r\n returns (response_bytes:seq, notary_state_out:NotaryStateImpl, common_state_out:CommonStateImpl)\r\n requires NotaryStateImplValid(notary_state_in);\r\n requires CommonStateImplValid(common_state_in);\r\n requires common_state_in.key_pair.pub.size >= 1024 / 8;\r\n requires TPM_ready();\r\n requires current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state_in), TPM);\r\n requires current_notary_state == NotaryStateMachine_ctor(true, NotaryStateImplToSpec(notary_state_in));\r\n requires IsByteSeq(request_bytes);\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_notary_state;\r\n modifies this`current_common_state;\r\n\r\n ensures NotaryStateImplValid(notary_state_out);\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM));\r\n ensures IsByteSeq(response_bytes);\r\n ensures current_notary_state == NotaryStateMachine_ctor(true, NotaryStateImplToSpec(notary_state_out));\r\n ensures current_common_state == old(current_common_state)[TPM := TPM];\r\n ensures CommonStateImplValid(common_state_out);\r\n ensures CommonStateImplToSpec(common_state_out) == CommonStateImplToSpec(common_state_in);\r\n\r\n requires public(NotaryStateImplToSpec(notary_state_in));\r\n requires public(request_bytes);\r\n ensures public(NotaryStateImplToSpec(notary_state_out));\r\n ensures public(response_bytes);\r\n{\r\n var request := ParseRequestPacket(request_bytes);\r\n var response:NotaryResponse;\r\n response, notary_state_out, common_state_out := HandleOneRequest(request, notary_state_in, common_state_in);\r\n response_bytes := FormResponsePacket(response);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/Notary/StateMachine.s.dfy", "content": "include \"Notary.s.dfy\"\r\ninclude \"../Common/CommonState.s.dfy\"\r\n\r\n//-///////////////////////////\r\n//- State machine\r\n//-///////////////////////////\r\n\r\ndatatype NotaryStateMachine = NotaryStateMachine_ctor(initialized:bool, notary_state:NotaryState)\r\n\r\nghost var {:readonly} current_notary_state:NotaryStateMachine;\r\n\r\nghost method {:axiom} {:autoReq} InitializeNotaryStateMachine(notary_state:NotaryState)\r\n requires !current_notary_state.initialized;\r\n requires NotaryInitializeValid(notary_state);\r\n ensures current_notary_state == NotaryStateMachine_ctor(true, notary_state);\r\n modifies this`current_notary_state;\r\n\r\nghost method {:axiom} {:autoReq} AdvanceNotaryStateMachineViaAdvanceCounter\r\n (message_in:seq, new_notary_state:NotaryState, notary_statement_out:seq, notary_attestation_out:seq)\r\n returns (declassified_notary_attestation_out:seq)\r\n requires current_notary_state.initialized;\r\n requires current_common_state.initialized;\r\n requires current_common_state.TPM == TPM;\r\n requires public(message_in);\r\n requires public(new_notary_state);\r\n requires NotaryAdvanceCounterValid(current_notary_state.notary_state, new_notary_state, current_common_state.common_state, message_in,\r\n notary_statement_out, notary_attestation_out);\r\n modifies this`current_notary_state;\r\n ensures current_notary_state == old(current_notary_state)[notary_state := new_notary_state];\r\n ensures IsByteSeqOfLen(declassified_notary_attestation_out, |notary_attestation_out|);\r\n ensures public(|notary_attestation_out|);\r\n ensures relation(forall i :: left(i) == right(i) && 0 <= left(i) < left(|declassified_notary_attestation_out|) ==>\r\n declassified(left(declassified_notary_attestation_out[i]), right(declassified_notary_attestation_out[i]),\r\n left(notary_attestation_out[i]), right(notary_attestation_out[i])));\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/PassHash/Main.i.dfy", "content": "//-\r\ninclude \"StateMachine.s.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSA.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSAOps.i.dfy\"\r\ninclude \"../../Libraries/Net/Udp.i.dfy\"\r\ninclude \"../../Libraries/Util/Halter.i.dfy\"\r\ninclude \"../../Libraries/Util/relational.i.dfy\"\r\ninclude \"PassHash.i.dfy\"\r\n\r\n//-//////////////////////////////\r\n//- Initialization\r\n//-//////////////////////////////\r\n\r\nmethod MainInitialize () returns (passhash_state:PassHashStateImpl, net_state:network_state)\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n requires current_state.TPM == TPM;\r\n requires !current_state.initialized;\r\n\r\n ensures TPM_ready();\r\n ensures PassHashStateImplValid(passhash_state);\r\n ensures PassHashInitializeValid(PassHashStateImplToSpec(passhash_state), old(TPM), TPM);\r\n ensures current_state == StateMachine_ctor(true, PassHashStateImplToSpec(passhash_state), TPM);\r\n ensures valid_network_state(net_state);\r\n \r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_state;\r\n ensures TPMs_match_except_for_randoms(TPM, old(TPM)[PCR_19 := TPM.PCR_19]);\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n ensures public(net_state);\r\n{\r\n var success:bool;\r\n success, net_state := init_network_card();\r\n if !success {\r\n HaltMachine(0x40);\r\n }\r\n\r\n passhash_state := PassHashInitialize();\r\n\r\n assert TPMs_match_except_for_randoms(TPM, old(TPM)[PCR_19 := TPM.PCR_19]);\r\n assert PassHashStateImplValid(passhash_state)\r\n && PassHashInitializeValid(PassHashStateImplToSpec(passhash_state), old(TPM), TPM);\r\n\r\n ghost var passhash_state_spec := PassHashStateImplToSpec(passhash_state);\r\n\r\n InitializeStateMachine(passhash_state_spec);\r\n}\r\n\r\n//-//////////////////////////////\r\n//- Handling requests\r\n//-//////////////////////////////\r\n\r\nmethod HandleNullRequest() returns (response_data:seq)\r\n ensures IsByteSeq(response_data);\r\n ensures public(response_data);\r\n{\r\n var response := NullResponse_ctor();\r\n response_data := FormResponsePacket(response);\r\n}\r\n\r\nmethod HandlePerformHashRequest (passhash_state:PassHashStateImpl, request:PassHashRequest) returns (response_data:seq)\r\n requires current_state == StateMachine_ctor(true, PassHashStateImplToSpec(passhash_state), TPM);\r\n requires PassHashStateImplValid(passhash_state);\r\n requires RequestValid(request);\r\n requires request.PerformHashRequest_ctor?;\r\n requires public(request);\r\n\r\n ensures IsByteSeq(response_data);\r\n ensures public(response_data);\r\n{\r\n var error_code, computed_hash := PassHashPerformHash(passhash_state, request.message, request.salt);\r\n\r\n ghost var declassified_hash:seq := AdvanceStateMachineViaPerformHash(request.message, request.salt, error_code, computed_hash);\r\n var usable_hash := UseDeclassifiedByteSequence(computed_hash, declassified_hash);\r\n\r\n var response := PerformHashResponse_ctor(error_code, usable_hash);\r\n response_data := FormResponsePacket(response);\r\n}\r\n\r\nmethod HandleRequest (passhash_state:PassHashStateImpl, request_data:seq) returns (response_data:seq)\r\n requires current_state == StateMachine_ctor(true, PassHashStateImplToSpec(passhash_state), TPM);\r\n requires PassHashStateImplValid(passhash_state);\r\n requires public(request_data);\r\n requires IsByteSeq(request_data);\r\n\r\n ensures IsByteSeq(response_data);\r\n ensures public(response_data);\r\n{\r\n var request := ParseRequestPacket(request_data);\r\n\r\n match request {\r\n case InvalidRequest_ctor =>\r\n response_data := HandleNullRequest();\r\n\r\n case PerformHashRequest_ctor(_, _) =>\r\n response_data := HandlePerformHashRequest(passhash_state, request);\r\n }\r\n}\r\n\r\nmethod{:dafnycc_conservative_seq_triggers} ReceiveRequestAndSendReply (passhash_state:PassHashStateImpl, net_state_in:network_state)\r\n returns (net_state_out:network_state)\r\n requires current_state == StateMachine_ctor(true, PassHashStateImplToSpec(passhash_state), TPM);\r\n requires PassHashStateImplValid(passhash_state);\r\n requires valid_network_state(net_state_in);\r\n requires public(net_state_in);\r\n\r\n ensures valid_network_state(net_state_out);\r\n ensures public(net_state_out);\r\n{\r\n ghost var passhash_state_spec := PassHashStateImplToSpec(passhash_state);\r\n\r\n var success:bool, client_eth:ethernet_addr, client_ip:IPv4Address, my_ip:IPv4Address, client_port:int, my_port:int, request_data:seq;\r\n success, net_state_out, client_eth, client_ip, my_ip, client_port, my_port, request_data := UdpReceive(net_state_in);\r\n if !success {\r\n return;\r\n }\r\n\r\n var response_data:seq := HandleRequest(passhash_state, request_data);\r\n\r\n if |response_data| <= 1472 {\r\n net_state_out := UdpSend(net_state_out, client_eth, my_ip, client_ip, my_port, client_port, response_data);\r\n }\r\n}\r\n\r\nmethod Main() returns (result:int)\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n requires current_state.TPM == TPM;\r\n requires !current_state.initialized;\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_state;\r\n ensures public(true); //- Needed to convince DafnyCC this procedure involves relational calls\r\n{\r\n var passhash_state, net_state := MainInitialize();\r\n\r\n ghost var post_init_TPM := TPM;\r\n\r\n while true\r\n invariant TPM_ready();\r\n invariant valid_network_state(net_state);\r\n invariant PassHashStateImplValid(passhash_state);\r\n invariant current_state == StateMachine_ctor(true, PassHashStateImplToSpec(passhash_state), TPM);\r\n invariant TPM == post_init_TPM;\r\n invariant public(net_state);\r\n {\r\n net_state := ReceiveRequestAndSendReply(passhash_state, net_state);\r\n }\r\n\r\n return 0;\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/PassHash/PacketParsing.c.dfy", "content": "include \"PassHash.s.dfy\"\r\n\r\n//-///////////////////////////\r\n//- Request parsing\r\n//-///////////////////////////\r\n\r\ndatatype PassHashRequest = InvalidRequest_ctor()\r\n | PerformHashRequest_ctor(message:seq, salt:seq)\r\n\r\nstatic predicate RequestParsedCorrectly(data:seq, request:PassHashRequest)\r\n requires IsByteSeq(data);\r\n{\r\n if |data| == 0 then\r\n request.InvalidRequest_ctor?\r\n else if data[0] == 1 then\r\n PerformHashRequestParsedCorrectly(data, request)\r\n else\r\n request.InvalidRequest_ctor?\r\n}\r\n\r\nstatic predicate PerformHashRequestParsedCorrectly(data:seq, request:PassHashRequest)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 1;\r\n{\r\n if |data| < 9 then\r\n request.InvalidRequest_ctor?\r\n else\r\n (\r\n var message_len := BEByteSeqToInt(data[1..5]);\r\n var salt_len := BEByteSeqToInt(data[5..9]);\r\n if message_len < 0 || salt_len < 0 || |data| < 9 + message_len + salt_len then\r\n request.InvalidRequest_ctor?\r\n else\r\n request.PerformHashRequest_ctor?\r\n && request.message == data[9..9+message_len]\r\n && request.salt == data[9+message_len..9+message_len+salt_len]\r\n )\r\n}\r\n\r\n//-///////////////////////////\r\n//- Response parsing\r\n//-///////////////////////////\r\n\r\ndatatype PassHashResponse = NullResponse_ctor()\r\n | PerformHashResponse_ctor(hash_error_code:int, passhash_hash:seq);\r\n\r\nstatic predicate ResponseFormedCorrectly(response:PassHashResponse, data:seq)\r\n{\r\n match response\r\n case NullResponse_ctor =>\r\n |data| >= 1 && data[0] == 0\r\n\r\n case PerformHashResponse_ctor(hash_error_code, passhash_hash) =>\r\n Word32(hash_error_code) &&\r\n IsByteSeqOfLen(passhash_hash, 32) &&\r\n |data| >= 37 &&\r\n data[0] == 1 &&\r\n data[1..5] == BEWordToFourBytes(hash_error_code) &&\r\n data[5..37] == passhash_hash\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/PassHash/PacketParsing.i.dfy", "content": "//-\r\ninclude \"PacketParsing.c.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSA.i.dfy\"\r\ninclude \"../../Libraries/Util/Halter.i.dfy\"\r\n\r\n//-//////////////////////////\r\n//- Request parsing\r\n//-//////////////////////////\r\n\r\nstatic predicate RequestValid (request:PassHashRequest)\r\n{\r\n match request\r\n case InvalidRequest_ctor => true\r\n case PerformHashRequest_ctor(message, salt) => IsByteSeq(message) && IsByteSeq(salt)\r\n}\r\n\r\nstatic lemma Lemma_PerformHashRequestPacketParsedCorrectly (data:seq, request:PassHashRequest)\r\n requires IsByteSeq(data);\r\n requires request.PerformHashRequest_ctor?;\r\n requires |data| >= 9 + |request.message| + |request.salt|;\r\n requires data[0] == 1;\r\n requires |request.message| == BEByteSeqToInt(data[1..5]);\r\n requires |request.salt| == BEByteSeqToInt(data[5..9]);\r\n requires request.message == data[9..9+|request.message|];\r\n requires request.salt == data[9+|request.message|..9+|request.message|+|request.salt|];\r\n ensures PerformHashRequestParsedCorrectly(data, request);\r\n{\r\n}\r\n\r\nstatic method ParseRequestPacket (data:seq) returns (request:PassHashRequest)\r\n requires IsByteSeq(data);\r\n requires public(data);\r\n\r\n ensures RequestParsedCorrectly(data, request);\r\n ensures RequestValid(request);\r\n ensures public(request);\r\n{\r\n if |data| == 0 {\r\n request := InvalidRequest_ctor();\r\n return;\r\n }\r\n if data[0] == 1 {\r\n request := ParsePerformHashRequestPacket(data);\r\n return;\r\n }\r\n request := InvalidRequest_ctor();\r\n}\r\n\r\nstatic method ParsePerformHashRequestPacket (data:seq) returns (request:PassHashRequest)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 1;\r\n requires public(data);\r\n\r\n ensures PerformHashRequestParsedCorrectly(data, request);\r\n ensures RequestValid(request);\r\n ensures public(request);\r\n{\r\n if |data| < 9 {\r\n request := InvalidRequest_ctor();\r\n return;\r\n }\r\n var message_len := BEFourBytesToWord_impl(data[1..5]);\r\n assert message_len == BEByteSeqToInt(data[1..5]);\r\n var salt_len := BEFourBytesToWord_impl(data[5..9]);\r\n assert salt_len == BEByteSeqToInt(data[5..9]);\r\n\r\n if message_len < 0 || salt_len < 0 || |data| < 9 + message_len + salt_len {\r\n request := InvalidRequest_ctor();\r\n return;\r\n }\r\n\r\n var message := data[9..9+message_len];\r\n var salt := data[9+message_len..9+message_len+salt_len];\r\n request := PerformHashRequest_ctor(message, salt);\r\n Lemma_PerformHashRequestPacketParsedCorrectly(data, request);\r\n}\r\n\r\n//-//////////////////////////\r\n//- Response forming\r\n//-//////////////////////////\r\n\r\nstatic predicate WellformedResponse (response:PassHashResponse)\r\n{\r\n match response\r\n case NullResponse_ctor => true\r\n\r\n case PerformHashResponse_ctor(hash_error_code, passhash_hash) =>\r\n Word32(hash_error_code)\r\n && IsByteSeqOfLen(passhash_hash, 32)\r\n}\r\n\r\nstatic method FormResponsePacket (response:PassHashResponse) returns (data:seq)\r\n requires WellformedResponse(response);\r\n requires public(response);\r\n\r\n ensures IsByteSeq(data);\r\n ensures ResponseFormedCorrectly(response, data);\r\n ensures public(data);\r\n{\r\n lemma_2toX();\r\n\r\n match response {\r\n case NullResponse_ctor =>\r\n data := [0];\r\n assert ResponseFormedCorrectly(response, data);\r\n\r\n case PerformHashResponse_ctor(hash_error_code, passhash_hash) =>\r\n var hash_error_code_encoded := BEWordToFourBytes_impl(hash_error_code);\r\n data := [1] + hash_error_code_encoded + passhash_hash;\r\n assert data[0] == 1;\r\n assert data[1..5] == hash_error_code_encoded == BEWordToFourBytes(hash_error_code);\r\n assert data[5..37] == passhash_hash;\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/PassHash/PassHash.i.dfy", "content": "//-\r\ninclude \"PassHash.s.dfy\"\r\ninclude \"../../Libraries/Util/relational.s.dfy\"\r\ninclude \"../../Libraries/Util/repeat_digit.i.dfy\"\r\ninclude \"../../Libraries/Crypto/Hash/sha256.i.dfy\"\r\ninclude \"../../Drivers/TPM/tpm-wrapper.i.dfy\"\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- Implementing PassHashState with PassHashStateImpl\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\ndatatype PassHashStateImpl = PassHashStateImplConstructor(secret:seq);\r\n\r\nstatic function PassHashStateImplToSpec(s:PassHashStateImpl):PassHashState\r\n{\r\n PassHashStateConstructor(s.secret)\r\n}\r\n\r\nstatic predicate PassHashStateImplValid(s:PassHashStateImpl)\r\n{\r\n IsByteSeq(s.secret) &&\r\n 32 <= |s.secret| <= 2048\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- Exported methods\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nmethod PassHashInitialize() returns (passhash_state:PassHashStateImpl)\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n\r\n ensures TPM_ready();\r\n ensures PassHashStateImplValid(passhash_state);\r\n ensures PassHashInitializeValid(PassHashStateImplToSpec(passhash_state), old(TPM), TPM);\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures TPMs_match_except_for_randoms(TPM, old(TPM)[PCR_19 := TPM.PCR_19]);\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n{\r\n lemma_2toX();\r\n establish_locality();\r\n var secret := get_random(32);\r\n passhash_state := PassHashStateImplConstructor(secret);\r\n}\r\n\r\nmethod{:dafnycc_conservative_seq_triggers} PassHashPerformHash (passhash_state:PassHashStateImpl, message:seq, salt:seq)\r\n returns (error_code:int, passhash_hash:seq)\r\n requires PassHashStateImplValid(passhash_state);\r\n requires IsByteSeq(message);\r\n requires IsByteSeq(salt);\r\n\r\n ensures Word32(error_code);\r\n ensures |passhash_hash| == 32;\r\n ensures IsByteSeq(passhash_hash);\r\n ensures error_code == 0 ==> |BEByteSeqToBitSeq_premium(passhash_state.secret + salt + message)| < power2(64);\r\n ensures PassHashPerformHashValid(PassHashStateImplToSpec(passhash_state), message, salt, error_code, passhash_hash);\r\n\r\n requires public(message);\r\n requires public(salt);\r\n ensures public(error_code);\r\n{\r\n lemma_2toX();\r\n\r\n if !((|salt| + |message| + 2048) * 8 <= 0xFFFFFFFF) {\r\n error_code := 1;\r\n passhash_hash := RepeatDigit_impl(0, 32);\r\n return;\r\n }\r\n\r\n error_code := 0;\r\n\r\n var preimage := passhash_state.secret + salt + message;\r\n calc {\r\n |preimage| * 8;\r\n <= (|passhash_state.secret| + |salt| + |message|) * 8;\r\n <= (|salt| + |message| + 2048) * 8;\r\n <= 0xFFFFFFFF;\r\n < power2(32);\r\n }\r\n\r\n calc {\r\n |BEByteSeqToBitSeq_premium(preimage)|;\r\n == 8 * |preimage|;\r\n < power2(32);\r\n < { lemma_power2_strictly_increases(35, 64); }\r\n power2(64);\r\n }\r\n\r\n var hash := SHA256_impl_Bytes(preimage);\r\n passhash_hash := BEWordSeqToByteSeq_impl(hash);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/PassHash/PassHash.s.dfy", "content": "include \"../../Libraries/Util/be_sequences.s.dfy\"\r\ninclude \"../../Libraries/Crypto/Hash/sha256.s.dfy\"\r\ninclude \"../../Drivers/TPM/tpm-device.s.dfy\"\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Structures\r\n//-///////////////////////////////////////////////////\r\n\r\ndatatype PassHashState = PassHashStateConstructor(secret:seq);\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Specifications for correct method operation\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic predicate {:autoReq} PassHashInitializeValid(passhash_state:PassHashState, before_TPM:TPM_struct, after_TPM:TPM_struct)\r\n{\r\n TPMs_match(after_TPM, before_TPM[random_index := after_TPM.random_index]) &&\r\n passhash_state.secret == TPM_random_bytes(before_TPM.random_index, after_TPM.random_index) &&\r\n IsByteSeq(passhash_state.secret) &&\r\n |passhash_state.secret| >= 32\r\n}\r\n\r\nstatic predicate {:autoReq} PassHashPerformHashValid(passhash_state:PassHashState, message_in:seq, salt_in:seq,\r\n error_code_out:int, passhash_hash_out:seq)\r\n{\r\n if error_code_out == 0 then\r\n IsByteSeq(passhash_state.secret) &&\r\n passhash_hash_out == BEWordSeqToByteSeq(SHA256(BEByteSeqToBitSeq(passhash_state.secret + salt_in + message_in)))\r\n else\r\n passhash_hash_out == RepeatDigit(0, 32)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/PassHash/StateMachine.s.dfy", "content": "include \"PassHash.s.dfy\"\r\n\r\ndatatype StateMachine = StateMachine_ctor(initialized:bool, passhash_state:PassHashState, TPM:TPM_struct)\r\n\r\nghost var {:readonly} current_state:StateMachine;\r\n\r\nghost method {:axiom} InitializeStateMachine(passhash_state:PassHashState)\r\n requires !current_state.initialized;\r\n requires PassHashInitializeValid(passhash_state, current_state.TPM, TPM);\r\n ensures current_state == StateMachine_ctor(true, passhash_state, TPM);\r\n modifies this`current_state;\r\n\r\nghost method {:axiom} {:autoReq} AdvanceStateMachineViaPerformHash(message_in:seq, salt_in:seq,\r\n error_code_out:int, hash_out:seq)\r\n returns (declassified_hash_out:seq)\r\n requires current_state.initialized;\r\n requires current_state.TPM == TPM;\r\n requires public(message_in);\r\n requires public(salt_in);\r\n requires PassHashPerformHashValid(current_state.passhash_state, message_in, salt_in, error_code_out, hash_out);\r\n\r\n ensures IsByteSeqOfLen(declassified_hash_out, |hash_out|);\r\n ensures relation(forall i :: left(i) == right(i) && 0 <= left(i) < left(|declassified_hash_out|) ==>\r\n declassified(left(declassified_hash_out[i]), right(declassified_hash_out[i]),\r\n left(hash_out[i]), right(hash_out[i])));\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/TPMTest/TPMTest.i.dfy", "content": "include \"../../Drivers/TPM/tpm-wrapper.i.dfy\"\r\ninclude \"../../Drivers/IO/pci.i.dfy\"\r\ninclude \"../../Libraries/Util/repeat_digit.i.dfy\"\r\n\r\n\r\nmethod test_get_pcr()\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n ensures TPM_satisfies_integrity_policy(TPM);\r\n{\r\n var success, pcr17 := get_pcr(17);\r\n if !success {\r\n debug_print(0x30, 0xB000);\r\n }\r\n else {\r\n debug_print(0x30, 0x3333);\r\n debug_print(0x31, pcr17[0]);\r\n debug_print(0x32, pcr17[1]);\r\n debug_print(0x33, pcr17[2]);\r\n debug_print(0x34, pcr17[3]);\r\n debug_print(0x35, pcr17[4]);\r\n }\r\n\r\n var success2, pcr18 := get_pcr(18);\r\n if !success2 {\r\n debug_print(0x40, 0xB000);\r\n }\r\n else {\r\n debug_print(0x40, 0x4444);\r\n debug_print(0x41, pcr18[0]);\r\n debug_print(0x42, pcr18[1]);\r\n debug_print(0x43, pcr18[2]);\r\n debug_print(0x44, pcr18[3]);\r\n debug_print(0x45, pcr18[4]);\r\n }\r\n}\r\n\r\nmethod test_random()\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n ensures TPM_satisfies_integrity_policy(TPM);\r\n{\r\n lemma_2toX();\r\n var rand_bytes := get_random(100);\r\n debug_print(0x50, rand_bytes[0]);\r\n debug_print(0x51, rand_bytes[1]);\r\n debug_print(0x52, rand_bytes[2]);\r\n debug_print(0x53, rand_bytes[3]);\r\n debug_print(0x54, rand_bytes[4]);\r\n\r\n rand_bytes := get_random(100);\r\n debug_print(0x60, rand_bytes[0]);\r\n debug_print(0x61, rand_bytes[1]);\r\n debug_print(0x62, rand_bytes[2]);\r\n debug_print(0x63, rand_bytes[3]);\r\n debug_print(0x64, rand_bytes[4]);\r\n}\r\n\r\nmethod test_quote()\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n ensures TPM_satisfies_integrity_policy(TPM);\r\n{\r\n var success:bool;\r\n var pcr_info_bytes:seq;\r\n var sig_bytes:seq;\r\n var nonce_external := RepeatDigit_impl(0, 20);\r\n success, pcr_info_bytes, sig_bytes := quote(nonce_external);\r\n\r\n if !success {\r\n debug_print(0x80, 0xB00B00);\r\n }\r\n else {\r\n debug_print(0x80, 0x4444);\r\n debug_print(0x81, |pcr_info_bytes|);\r\n debug_print(0x82, |sig_bytes|);\r\n if |sig_bytes| >= 2 {\r\n debug_print(0x83, sig_bytes[0]);\r\n debug_print(0x84, sig_bytes[1]);\r\n }\r\n }\r\n}\r\n\r\nmethod Main () returns (result:int)\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n{\r\n debug_print(0x10, 0x1111);\r\n\r\n establish_locality();\r\n\r\n debug_print(0x20, 0x2222);\r\n\r\n test_get_pcr();\r\n test_random();\r\n test_quote();\r\n\r\n return 0;\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/TrInc/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/TrInc/Main.i.dfy", "content": "//-\r\ninclude \"StateMachine.i.dfy\"\r\ninclude \"../../Libraries/Net/Udp.i.dfy\"\r\n\r\nmethod MainInitialize () returns (trinc_state:TrIncStateImpl, common_state:CommonStateImpl, net_state:network_state)\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n requires current_common_state.TPM == TPM;\r\n requires !current_common_state.initialized;\r\n requires !current_trinc_state.initialized;\r\n\r\n ensures TPM_ready();\r\n ensures TrIncStateImplValid(trinc_state);\r\n ensures CommonStateImplValid(common_state);\r\n ensures common_state.key_pair.pub.size >= 1024 / 8;\r\n ensures KeyCanBeExtendedIntoPCR(CommonStateImplToSpec(common_state).key_pair);\r\n ensures current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state), TPM);\r\n ensures current_trinc_state == TrIncStateMachine_ctor(true, TrIncStateImplToSpec(trinc_state));\r\n ensures valid_network_state(net_state);\r\n \r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_common_state;\r\n modifies this`current_trinc_state;\r\n ensures TPMs_match_except_for_randoms(TPM, old(TPM)[PCR_19 := TPM.PCR_19]);\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n\r\n ensures public(TrIncStateImplToSpec(trinc_state));\r\n ensures public(net_state);\r\n{\r\n var success:bool;\r\n success, net_state := init_network_card();\r\n if !success {\r\n HaltMachine(0x40);\r\n }\r\n\r\n common_state := GenerateCommonState(1024);\r\n assert TPMs_match_except_for_randoms(TPM, old(TPM)[PCR_19 := TPM.PCR_19]);\r\n ghost var common_state_key_pair := common_state.key_pair;\r\n ghost var common_state_spec := CommonStateImplToSpec(common_state);\r\n InitializeCommonStateMachine(common_state_spec);\r\n\r\n trinc_state := TrIncInitialize();\r\n ghost var trinc_state_spec := TrIncStateImplToSpec(trinc_state);\r\n assert TrIncStateImplValid(trinc_state) && TrIncInitializeValid(trinc_state_spec);\r\n InitializeTrIncStateMachine(trinc_state_spec);\r\n}\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} MainOneStep\r\n (trinc_state_in:TrIncStateImpl, common_state_in:CommonStateImpl, net_state_in:network_state)\r\n returns (trinc_state_out:TrIncStateImpl, common_state_out:CommonStateImpl, net_state_out:network_state)\r\n requires TPM_ready();\r\n requires valid_network_state(net_state_in);\r\n requires CommonStateImplValid(common_state_in);\r\n requires common_state_in.key_pair.pub.size >= 1024 / 8;\r\n requires TrIncStateImplValid(trinc_state_in);\r\n requires current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state_in), TPM);\r\n requires current_trinc_state == TrIncStateMachine_ctor(true, TrIncStateImplToSpec(trinc_state_in));\r\n\r\n ensures TPM_ready();\r\n ensures valid_network_state(net_state_out);\r\n ensures TrIncStateImplValid(trinc_state_out);\r\n ensures current_trinc_state == TrIncStateMachine_ctor(true, TrIncStateImplToSpec(trinc_state_out));\r\n ensures current_common_state == old(current_common_state)[TPM := TPM];\r\n ensures CommonStateImplValid(common_state_out);\r\n ensures CommonStateImplToSpec(common_state_out) == CommonStateImplToSpec(common_state_in);\r\n ensures TPMs_match(TPM, old(TPM));\r\n\r\n requires public(TrIncStateImplToSpec(trinc_state_in));\r\n requires public(net_state_in);\r\n ensures public(TrIncStateImplToSpec(trinc_state_out));\r\n ensures public(net_state_out);\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_trinc_state;\r\n modifies this`current_common_state;\r\n{\r\n ghost var trinc_state_in_spec := TrIncStateImplToSpec(trinc_state_in);\r\n ghost var common_state_spec := CommonStateImplToSpec(common_state_in);\r\n ghost var common_state_key_pair := common_state_in.key_pair;\r\n\r\n var success:bool, client_eth:ethernet_addr, client_ip:IPv4Address, my_ip:IPv4Address, client_port:int, my_port:int, request_bytes:seq;\r\n success, net_state_out, client_eth, client_ip, my_ip, client_port, my_port, request_bytes := UdpReceive(net_state_in);\r\n if !success {\r\n trinc_state_out := trinc_state_in;\r\n common_state_out := common_state_in;\r\n return;\r\n }\r\n\r\n var response_bytes:seq;\r\n response_bytes, trinc_state_out, common_state_out := HandleOneRequestRaw(request_bytes, trinc_state_in, common_state_in);\r\n if |response_bytes| <= 1472 {\r\n net_state_out := UdpSend(net_state_out, client_eth, my_ip, client_ip, my_port, client_port, response_bytes);\r\n }\r\n}\r\n\r\n//-//////////////////////////////////\r\n//- Main routine\r\n//-//////////////////////////////////\r\n\r\nmethod Main () returns (result:int)\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM_satisfies_integrity_policy(TPM);\r\n requires current_common_state.TPM == TPM;\r\n requires !current_common_state.initialized;\r\n requires !current_trinc_state.initialized;\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_common_state;\r\n modifies this`current_trinc_state;\r\n ensures public(true); //- Needed to convince DafnyCC this procedure involves relational calls\r\n{\r\n var trinc_state, common_state, net_state := MainInitialize();\r\n\r\n ghost var post_init_TPM := TPM;\r\n\r\n while true\r\n invariant TPM_ready();\r\n invariant valid_network_state(net_state);\r\n invariant TrIncStateImplValid(trinc_state);\r\n invariant CommonStateImplValid(common_state);\r\n invariant common_state.key_pair.pub.size >= 1024 / 8;\r\n invariant current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state), TPM);\r\n invariant current_trinc_state == TrIncStateMachine_ctor(true, TrIncStateImplToSpec(trinc_state));\r\n invariant TPMs_match(TPM, post_init_TPM);\r\n invariant public(TrIncStateImplToSpec(trinc_state));\r\n invariant public(net_state);\r\n decreases *;\r\n {\r\n trinc_state, common_state, net_state := MainOneStep(trinc_state, common_state, net_state);\r\n }\r\n\r\n return 0;\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/TrInc/PacketParsing.c.dfy", "content": "include \"TrInc.s.dfy\"\r\n\r\n//-///////////////////////////\r\n//- Request parsing\r\n//-///////////////////////////\r\n\r\ndatatype TrIncRequest = InvalidRequest_ctor()\r\n | GetQuoteRequest_ctor(nonce_external:seq)\r\n | CreateCounterRequest_ctor(public_key_encoding:seq)\r\n | AdvanceCounterRequest_ctor(counter_index:nat, new_counter_value_encoding:seq, message:seq, request_attestation:seq)\r\n\r\nstatic predicate RequestParsedCorrectly (data:seq, request:TrIncRequest)\r\n requires IsByteSeq(data);\r\n{\r\n if |data| == 0 then\r\n request.InvalidRequest_ctor?\r\n else if data[0] == 1 then\r\n GetQuoteRequestParsedCorrectly(data, request)\r\n else if data[0] == 2 then\r\n CreateCounterRequestParsedCorrectly(data, request)\r\n else if data[0] == 3 then\r\n AdvanceCounterRequestParsedCorrectly(data, request)\r\n else\r\n request.InvalidRequest_ctor?\r\n}\r\n\r\nstatic predicate GetQuoteRequestParsedCorrectly(data:seq, request:TrIncRequest)\r\n requires |data| > 0;\r\n requires data[0] == 1;\r\n{\r\n if |data| < 21 then\r\n request.InvalidRequest_ctor?\r\n else\r\n request.GetQuoteRequest_ctor?\r\n && request.nonce_external == data[1..21]\r\n}\r\n\r\nstatic predicate CreateCounterRequestParsedCorrectly (data:seq, request:TrIncRequest)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 2;\r\n{\r\n if |data| < 5 then\r\n request.InvalidRequest_ctor?\r\n else\r\n (\r\n var public_key_length := BEByteSeqToInt(data[1..5]);\r\n if public_key_length < 0 || |data| < 5 + public_key_length then\r\n request.InvalidRequest_ctor?\r\n else\r\n request.CreateCounterRequest_ctor? &&\r\n request.public_key_encoding == data[5..5+public_key_length]\r\n )\r\n}\r\n\r\nstatic predicate AdvanceCounterRequestParsedCorrectly (data:seq, request:TrIncRequest)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 3;\r\n{\r\n if |data| < 17 then\r\n request.InvalidRequest_ctor?\r\n else\r\n (\r\n var counter_index := BEByteSeqToInt(data[1..5]);\r\n var new_counter_len := BEByteSeqToInt(data[5..9]);\r\n var message_len := BEByteSeqToInt(data[9..13]);\r\n var request_attestation_len := BEByteSeqToInt(data[13..17]);\r\n if new_counter_len < 0 || message_len < 0 || request_attestation_len < 0 || |data| < 17 + new_counter_len + message_len + request_attestation_len then\r\n request.InvalidRequest_ctor?\r\n else\r\n request.AdvanceCounterRequest_ctor? &&\r\n request.counter_index == counter_index &&\r\n request.new_counter_value_encoding == data[17..17+new_counter_len] &&\r\n request.message == data[17+new_counter_len..17+new_counter_len+message_len] &&\r\n request.request_attestation == data[17+new_counter_len+message_len..17+new_counter_len+message_len+request_attestation_len]\r\n )\r\n}\r\n\r\n//-///////////////////////////\r\n//- Response parsing\r\n//-///////////////////////////\r\n\r\ndatatype TrIncResponse = NullResponse_ctor()\r\n | GetQuoteResponse_ctor(get_quote_error_code:int, encoded_public_key:seq, pcr_info_bytes:seq, sig_bytes:seq)\r\n | CreateCounterResponse_ctor(create_error_code:int, counter_index:nat)\r\n | AdvanceCounterResponse_ctor(advance_error_code:int, TrInc_statement:seq, TrInc_attestation:seq)\r\n\r\nstatic function ResponseFormedCorrectly (response:TrIncResponse, data:seq) : bool\r\n requires IsByteSeq(data);\r\n{\r\n match response\r\n case NullResponse_ctor =>\r\n |data| >= 1 && data[0] == 0\r\n\r\n case GetQuoteResponse_ctor(get_quote_error_code, encoded_public_key, pcr_info_bytes, sig_bytes) =>\r\n Word32(get_quote_error_code)\r\n && Word32(|encoded_public_key|)\r\n && Word32(|pcr_info_bytes|)\r\n && Word32(|sig_bytes|)\r\n && IsByteSeq(encoded_public_key)\r\n && IsByteSeq(pcr_info_bytes)\r\n && IsByteSeq(sig_bytes)\r\n && data == [1] + BEWordToFourBytes(get_quote_error_code) + BEWordToFourBytes(|encoded_public_key|) +\r\n BEWordToFourBytes(|pcr_info_bytes|) + BEWordToFourBytes(|sig_bytes|) + encoded_public_key +\r\n pcr_info_bytes + sig_bytes\r\n\r\n case CreateCounterResponse_ctor(create_error_code, counter_index) =>\r\n Word32(create_error_code)\r\n && Word32(counter_index)\r\n && data == [2] + BEWordToFourBytes(create_error_code) + BEWordToFourBytes(counter_index)\r\n\r\n case AdvanceCounterResponse_ctor(advance_error_code, TrInc_statement, TrInc_attestation) =>\r\n Word32(advance_error_code)\r\n && IsByteSeq(TrInc_statement)\r\n && IsByteSeq(TrInc_attestation)\r\n && Word32(|TrInc_statement|)\r\n && Word32(|TrInc_attestation|)\r\n && data == [3] + BEWordToFourBytes(advance_error_code) + BEWordToFourBytes(|TrInc_statement|) +\r\n BEWordToFourBytes(|TrInc_attestation|) + TrInc_statement + TrInc_attestation\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/TrInc/PacketParsing.i.dfy", "content": "//-\r\ninclude \"PacketParsing.c.dfy\"\r\ninclude \"../../Libraries/Util/seqs_transforms.i.dfy\"\r\n\r\n//-//////////////////////////\r\n//- Request parsing\r\n//-//////////////////////////\r\n\r\nstatic predicate RequestValid (request:TrIncRequest)\r\n{\r\n match request\r\n case InvalidRequest_ctor => true\r\n case GetQuoteRequest_ctor(nonce_external) => IsByteSeq(nonce_external) && |nonce_external| == 20\r\n case CreateCounterRequest_ctor(public_key_encoding) => IsByteSeq(public_key_encoding)\r\n case AdvanceCounterRequest_ctor(counter_index, new_counter_value_encoding, message, message_attestation) =>\r\n Word32(counter_index) && IsByteSeq(new_counter_value_encoding) && IsByteSeq(message) && IsByteSeq(message_attestation)\r\n}\r\n\r\nstatic method ParseRequestPacket (data:seq) returns (request:TrIncRequest)\r\n requires IsByteSeq(data);\r\n requires public(data);\r\n ensures RequestParsedCorrectly(data, request);\r\n ensures RequestValid(request);\r\n ensures public(request);\r\n{\r\n if |data| == 0 {\r\n request := InvalidRequest_ctor();\r\n return;\r\n }\r\n if data[0] == 1 {\r\n request := ParseGetQuoteRequestPacket(data);\r\n return;\r\n }\r\n if data[0] == 2 {\r\n request := ParseCreateCounterRequestPacket(data);\r\n return;\r\n }\r\n if data[0] == 3 {\r\n request := ParseAdvanceCounterRequestPacket(data);\r\n return;\r\n }\r\n request := InvalidRequest_ctor();\r\n}\r\n\r\nstatic method ParseGetQuoteRequestPacket (data:seq) returns (request:TrIncRequest)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 1;\r\n requires public(data);\r\n ensures GetQuoteRequestParsedCorrectly(data, request);\r\n ensures RequestValid(request);\r\n ensures public(request);\r\n{\r\n if |data| < 21 {\r\n request := InvalidRequest_ctor();\r\n return;\r\n }\r\n var nonce_external := data[1..21];\r\n return GetQuoteRequest_ctor(nonce_external);\r\n}\r\n\r\nstatic method ParseCreateCounterRequestPacket (data:seq) returns (request:TrIncRequest)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 2;\r\n requires public(data);\r\n ensures CreateCounterRequestParsedCorrectly(data, request);\r\n ensures RequestValid(request);\r\n ensures public(request);\r\n{\r\n request := InvalidRequest_ctor();\r\n if |data| < 5 {\r\n request := InvalidRequest_ctor();\r\n return;\r\n }\r\n\r\n var public_key_len := BEFourBytesToWord_impl(data[1..5]);\r\n if public_key_len < 0 || |data| < 5 + public_key_len {\r\n request := InvalidRequest_ctor();\r\n return;\r\n }\r\n\r\n request := CreateCounterRequest_ctor(data[5..5+public_key_len]);\r\n}\r\n\r\nstatic method ParseAdvanceCounterRequestPacket (data:seq) returns (request:TrIncRequest)\r\n requires IsByteSeq(data);\r\n requires |data| > 0;\r\n requires data[0] == 3;\r\n requires public(data);\r\n ensures AdvanceCounterRequestParsedCorrectly(data, request);\r\n ensures RequestValid(request);\r\n ensures public(request);\r\n{\r\n if |data| < 17 {\r\n request := InvalidRequest_ctor();\r\n return;\r\n }\r\n\r\n var counter_index := BEFourBytesToWord_impl(data[1..5]);\r\n var new_counter_len := BEFourBytesToWord_impl(data[5..9]);\r\n var message_len := BEFourBytesToWord_impl(data[9..13]);\r\n var request_attestation_len := BEFourBytesToWord_impl(data[13..17]);\r\n\r\n if new_counter_len < 0 || message_len < 0 || request_attestation_len < 0 || |data| < 17 + new_counter_len + message_len + request_attestation_len {\r\n request := InvalidRequest_ctor();\r\n return;\r\n }\r\n\r\n lemma_2toX();\r\n reveal_power2();\r\n assert Word32(counter_index);\r\n\r\n request := AdvanceCounterRequest_ctor(counter_index, data[17..17+new_counter_len],\r\n data[17+new_counter_len..17+new_counter_len+message_len],\r\n data[17+new_counter_len+message_len..17+new_counter_len+message_len+request_attestation_len]);\r\n}\r\n\r\n//-//////////////////////////\r\n//- Response forming\r\n//-//////////////////////////\r\n\r\nstatic predicate WellformedResponse (response:TrIncResponse)\r\n{\r\n match response\r\n case NullResponse_ctor => true\r\n\r\n case GetQuoteResponse_ctor(error_code, encoded_public_key, pcr_info_bytes, sig_bytes) =>\r\n Word32(error_code)\r\n && Word32(|encoded_public_key|)\r\n && Word32(|pcr_info_bytes|)\r\n && Word32(|sig_bytes|)\r\n && IsByteSeq(encoded_public_key)\r\n && IsByteSeq(pcr_info_bytes)\r\n && IsByteSeq(sig_bytes)\r\n\r\n case CreateCounterResponse_ctor(error_code, counter_index) => Word32(error_code) && Word32(counter_index)\r\n\r\n case AdvanceCounterResponse_ctor(error_code, statement, attestation) =>\r\n Word32(error_code) && Word32(|statement|) && Word32(|attestation|) && IsByteSeq(statement) && IsByteSeq(attestation)\r\n}\r\n\r\nstatic method FormResponsePacket (response:TrIncResponse) returns (data:seq)\r\n requires WellformedResponse(response);\r\n requires public(response);\r\n ensures IsByteSeq(data);\r\n ensures ResponseFormedCorrectly(response, data);\r\n ensures public(data);\r\n{\r\n lemma_2toX();\r\n\r\n match response {\r\n case NullResponse_ctor =>\r\n data := [0];\r\n\r\n case GetQuoteResponse_ctor(get_quote_error_code, encoded_public_key, pcr_info_bytes, sig_bytes) =>\r\n var get_quote_error_code_encoded := BEWordToFourBytes_impl(get_quote_error_code);\r\n var encoded_public_key_len_encoded := BEWordToFourBytes_impl(|encoded_public_key|);\r\n var pcr_info_bytes_len_encoded := BEWordToFourBytes_impl(|pcr_info_bytes|);\r\n var sig_bytes_len_encoded := BEWordToFourBytes_impl(|sig_bytes|);\r\n data := [1] + get_quote_error_code_encoded + encoded_public_key_len_encoded + pcr_info_bytes_len_encoded +\r\n sig_bytes_len_encoded + encoded_public_key + pcr_info_bytes + sig_bytes;\r\n assert forall i :: 0 <= i < |data| ==> IsByte(data[i]);\r\n assert ResponseFormedCorrectly(response, data);\r\n\r\n case CreateCounterResponse_ctor(create_error_code, counter_index) =>\r\n var create_error_code_encoded := BEWordToFourBytes_impl(create_error_code);\r\n var counter_index_encoded := BEWordToFourBytes_impl(counter_index);\r\n data := [2] + create_error_code_encoded + counter_index_encoded;\r\n assert ResponseFormedCorrectly(response, data);\r\n\r\n case AdvanceCounterResponse_ctor(advance_error_code, TrInc_statement, TrInc_attestation) =>\r\n var advance_error_code_encoded := BEWordToFourBytes_impl(advance_error_code);\r\n var TrInc_statement_len_encoded := BEWordToFourBytes_impl(|TrInc_statement|);\r\n var TrInc_attestation_len_encoded := BEWordToFourBytes_impl(|TrInc_attestation|);\r\n data := [3] + advance_error_code_encoded + TrInc_statement_len_encoded + TrInc_attestation_len_encoded +\r\n TrInc_statement + TrInc_attestation;\r\n assert IsByteSeq(data);\r\n assert ResponseFormedCorrectly(response, data);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/TrInc/StateMachine.i.dfy", "content": "//-\r\ninclude \"StateMachine.s.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\ninclude \"TrInc.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSA.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSAOps.i.dfy\"\r\ninclude \"../../Libraries/Net/Udp.i.dfy\"\r\ninclude \"../../Libraries/Util/relational.i.dfy\"\r\n\r\nmethod {:timeLimitMultiplier 4} HandleOneRequest (request:TrIncRequest, trinc_state_in:TrIncStateImpl, common_state_in:CommonStateImpl)\r\n returns (response:TrIncResponse, trinc_state_out:TrIncStateImpl, common_state_out:CommonStateImpl)\r\n requires TrIncStateImplValid(trinc_state_in);\r\n requires CommonStateImplValid(common_state_in);\r\n requires common_state_in.key_pair.pub.size >= 1024 / 8;\r\n requires TPM_ready();\r\n requires current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state_in), TPM);\r\n requires current_trinc_state == TrIncStateMachine_ctor(true, TrIncStateImplToSpec(trinc_state_in));\r\n requires RequestValid(request);\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_trinc_state;\r\n modifies this`current_common_state;\r\n\r\n ensures TrIncStateImplValid(trinc_state_out);\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM));\r\n ensures WellformedResponse(response);\r\n ensures current_trinc_state == TrIncStateMachine_ctor(true, TrIncStateImplToSpec(trinc_state_out));\r\n ensures current_common_state == old(current_common_state)[TPM := TPM];\r\n ensures CommonStateImplValid(common_state_out);\r\n ensures CommonStateImplToSpec(common_state_out) == CommonStateImplToSpec(common_state_in);\r\n\r\n requires public(TrIncStateImplToSpec(trinc_state_in));\r\n requires public(request);\r\n ensures public(TrIncStateImplToSpec(trinc_state_out));\r\n ensures public(response);\r\n{\r\n match request {\r\n case InvalidRequest_ctor =>\r\n response := NullResponse_ctor();\r\n trinc_state_out := trinc_state_in;\r\n common_state_out := common_state_in;\r\n\r\n case GetQuoteRequest_ctor(nonce_external) =>\r\n var encoded_public_key:seq, pcr_info_bytes:seq, sig_bytes:seq;\r\n common_state_out, encoded_public_key, pcr_info_bytes, sig_bytes := HandleGetQuoteRequest(common_state_in, nonce_external);\r\n ghost var declassified_encoded_public_key, declassified_pcr_info_bytes, declassified_sig_bytes :=\r\n AdvanceCommonStateMachineViaGetQuote(nonce_external, encoded_public_key, pcr_info_bytes, sig_bytes);\r\n var usable_encoded_public_key := UseDeclassifiedByteSequence(encoded_public_key, declassified_encoded_public_key);\r\n var usable_pcr_info_bytes := UseDeclassifiedByteSequence(pcr_info_bytes, declassified_pcr_info_bytes);\r\n var usable_sig_bytes := UseDeclassifiedByteSequence(sig_bytes, declassified_sig_bytes);\r\n trinc_state_out := trinc_state_in;\r\n response := GetQuoteResponse_ctor(0, usable_encoded_public_key, usable_pcr_info_bytes, usable_sig_bytes);\r\n\r\n case CreateCounterRequest_ctor(public_key_encoding) =>\r\n var create_error_code:int, counter_index:nat;\r\n trinc_state_out, create_error_code, counter_index := TrIncCreateCounter(trinc_state_in, common_state_in, public_key_encoding);\r\n if create_error_code == 0 {\r\n AdvanceTrIncStateMachineViaCreateCounter(public_key_encoding, TrIncStateImplToSpec(trinc_state_out), counter_index);\r\n }\r\n response := CreateCounterResponse_ctor(create_error_code, counter_index);\r\n common_state_out := common_state_in;\r\n\r\n case AdvanceCounterRequest_ctor(counter_index, new_counter_value_encoding, message, message_attestation) =>\r\n var advance_error_code:int, trinc_statement:seq, trinc_attestation:seq;\r\n trinc_state_out, advance_error_code, trinc_statement, trinc_attestation :=\r\n TrIncAdvanceCounter(trinc_state_in, common_state_in, counter_index, new_counter_value_encoding, message, message_attestation);\r\n var usable_trinc_attestation:seq;\r\n if advance_error_code != 0 {\r\n usable_trinc_attestation := [];\r\n }\r\n else {\r\n ghost var declassified_trinc_attestation :=\r\n AdvanceTrIncStateMachineViaAdvanceCounter(counter_index, new_counter_value_encoding, message,\r\n message_attestation, TrIncStateImplToSpec(trinc_state_out),\r\n trinc_statement, trinc_attestation);\r\n usable_trinc_attestation := UseDeclassifiedByteSequence(trinc_attestation, declassified_trinc_attestation);\r\n }\r\n response := AdvanceCounterResponse_ctor(advance_error_code, trinc_statement, usable_trinc_attestation);\r\n common_state_out := common_state_in;\r\n }\r\n}\r\n\r\nmethod HandleOneRequestRaw (request_bytes:seq, trinc_state_in:TrIncStateImpl, common_state_in:CommonStateImpl)\r\n returns (response_bytes:seq, trinc_state_out:TrIncStateImpl, common_state_out:CommonStateImpl)\r\n requires TrIncStateImplValid(trinc_state_in);\r\n requires CommonStateImplValid(common_state_in);\r\n requires common_state_in.key_pair.pub.size >= 1024 / 8;\r\n requires TPM_ready();\r\n requires current_common_state == CommonStateMachine_ctor(true, CommonStateImplToSpec(common_state_in), TPM);\r\n requires current_trinc_state == TrIncStateMachine_ctor(true, TrIncStateImplToSpec(trinc_state_in));\r\n requires IsByteSeq(request_bytes);\r\n\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n modifies this`current_trinc_state;\r\n modifies this`current_common_state;\r\n\r\n ensures TrIncStateImplValid(trinc_state_out);\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM));\r\n ensures IsByteSeq(response_bytes);\r\n ensures current_trinc_state == TrIncStateMachine_ctor(true, TrIncStateImplToSpec(trinc_state_out));\r\n ensures current_common_state == old(current_common_state)[TPM := TPM];\r\n ensures CommonStateImplValid(common_state_out);\r\n ensures CommonStateImplToSpec(common_state_out) == CommonStateImplToSpec(common_state_in);\r\n\r\n requires public(TrIncStateImplToSpec(trinc_state_in));\r\n requires public(request_bytes);\r\n ensures public(TrIncStateImplToSpec(trinc_state_out));\r\n ensures public(response_bytes);\r\n{\r\n var request := ParseRequestPacket(request_bytes);\r\n var response:TrIncResponse;\r\n response, trinc_state_out, common_state_out := HandleOneRequest(request, trinc_state_in, common_state_in);\r\n response_bytes := FormResponsePacket(response);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/TrInc/StateMachine.s.dfy", "content": "include \"TrInc.s.dfy\"\r\n\r\n//-///////////////////////////\r\n//- State machine\r\n//-///////////////////////////\r\n\r\ndatatype TrIncStateMachine = TrIncStateMachine_ctor(initialized:bool, trinc_state:TrIncState)\r\n\r\nghost var {:readonly} current_trinc_state:TrIncStateMachine;\r\n\r\nghost method {:axiom} {:autoReq} InitializeTrIncStateMachine(trinc_state:TrIncState)\r\n requires !current_trinc_state.initialized;\r\n requires TrIncInitializeValid(trinc_state);\r\n ensures current_trinc_state == TrIncStateMachine_ctor(true, trinc_state);\r\n modifies this`current_trinc_state;\r\n\r\nghost method {:axiom} {:autoReq} AdvanceTrIncStateMachineViaCreateCounter\r\n (public_key_encoding_in:seq, new_trinc_state:TrIncState, counter_index_out:nat)\r\n requires current_trinc_state.initialized;\r\n requires current_common_state.initialized;\r\n requires current_common_state.TPM == TPM;\r\n requires public(public_key_encoding_in);\r\n requires public(new_trinc_state);\r\n requires TrIncCreateCounterValid(current_trinc_state.trinc_state, new_trinc_state, current_common_state.common_state,\r\n public_key_encoding_in, counter_index_out);\r\n modifies this`current_trinc_state;\r\n ensures current_trinc_state == old(current_trinc_state)[trinc_state := new_trinc_state];\r\n\r\nghost method {:axiom} {:autoReq} AdvanceTrIncStateMachineViaAdvanceCounter\r\n (counter_index_in:nat, new_counter_value_encoding_in:seq, message_in:seq, message_attestation_in:seq,\r\n new_trinc_state:TrIncState, trinc_statement_out:seq, trinc_attestation_out:seq)\r\n returns (declassified_trinc_attestation_out:seq)\r\n requires current_trinc_state.initialized;\r\n requires current_common_state.initialized;\r\n requires current_common_state.TPM == TPM;\r\n requires public(counter_index_in);\r\n requires public(new_counter_value_encoding_in);\r\n requires public(message_in);\r\n requires public(message_attestation_in);\r\n requires public(new_trinc_state);\r\n requires TrIncAdvanceCounterValid(current_trinc_state.trinc_state, new_trinc_state, current_common_state.common_state,\r\n counter_index_in, new_counter_value_encoding_in, message_in, message_attestation_in,\r\n trinc_statement_out, trinc_attestation_out);\r\n modifies this`current_trinc_state;\r\n ensures current_trinc_state == old(current_trinc_state)[trinc_state := new_trinc_state];\r\n ensures IsByteSeqOfLen(declassified_trinc_attestation_out, |trinc_attestation_out|);\r\n ensures public(|trinc_attestation_out|);\r\n ensures relation(forall i :: left(i) == right(i) && 0 <= left(i) < left(|declassified_trinc_attestation_out|) ==>\r\n declassified(left(declassified_trinc_attestation_out[i]), right(declassified_trinc_attestation_out[i]),\r\n left(trinc_attestation_out[i]), right(trinc_attestation_out[i])));\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/TrInc/TrInc.i.dfy", "content": "//-\r\ninclude \"TrInc.s.dfy\"\r\ninclude \"../../Libraries/Util/relational.s.dfy\"\r\ninclude \"../../Libraries/BigNum/BigNum.i.dfy\"\r\ninclude \"../../Libraries/BigNum/BigNatBitCount.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/KeyGen.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSA.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSAOps.i.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/rfc4251decode.i.dfy\"\r\ninclude \"../Common/CommonState.i.dfy\"\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- Implementing TrIncCounter with TrIncCounterImpl\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\ndatatype TrIncCounterImpl = TrIncCounterImpl_c(public_key:RSAPubKeyImpl, counter_value:BigNat);\r\n\r\npredicate TrIncCounterImplValid (c:TrIncCounterImpl)\r\n{\r\n WellformedBigNat(c.counter_value) &&\r\n ModestBigNatValue(c.counter_value) &&\r\n WellformedRSAPubKeyImpl(c.public_key) &&\r\n WellformedRSAPubKeySpec(PubKeyImplToSpec(c.public_key)) &&\r\n RSA_DIGEST_MIN_KEY_SIZE() <= PubKeyImplToSpec(c.public_key).size < power2(60)\r\n}\r\n\r\npredicate TrIncCounterImplSeqValid (s:seq)\r\n{\r\n forall i :: 0 <= i < |s| ==> TrIncCounterImplValid(s[i])\r\n}\r\n\r\nfunction TrIncCounterImplToSpec (c:TrIncCounterImpl) : TrIncCounter\r\n requires TrIncCounterImplValid(c);\r\n{\r\n TrIncCounterConstructor(PubKeyImplToSpec(c.public_key), I(c.counter_value))\r\n}\r\n\r\nfunction TrIncCounterImplSeqToSpec (s:seq) : seq\r\n requires TrIncCounterImplSeqValid(s);\r\n{\r\n if |s| == 0 then\r\n []\r\n else\r\n TrIncCounterImplSeqToSpec(s[..|s|-1]) + [TrIncCounterImplToSpec(s[|s|-1])]\r\n}\r\n\r\nlemma Lemma_TrIncCounterImplSeqToSpecRelation (s_impl:seq, s_spec:seq)\r\n requires TrIncCounterImplSeqValid(s_impl);\r\n requires s_spec == TrIncCounterImplSeqToSpec(s_impl);\r\n ensures |s_spec| == |s_impl|;\r\n ensures forall i :: 0 <= i < |s_spec| ==> s_spec[i] == TrIncCounterImplToSpec(s_impl[i]);\r\n ensures forall i :: 0 <= i < |s_spec| ==> s_spec[i].public_key == PubKeyImplToSpec(s_impl[i].public_key);\r\n ensures forall i :: 0 <= i < |s_spec| ==> s_spec[i].counter_value == I(s_impl[i].counter_value);\r\n decreases |s_impl|;\r\n{\r\n if |s_impl| > 0 {\r\n assert s_spec == TrIncCounterImplSeqToSpec(s_impl[..|s_impl|-1]) + [TrIncCounterImplToSpec(s_impl[|s_impl|-1])];\r\n assert s_spec[|s_spec|-1] == TrIncCounterImplToSpec(s_impl[|s_impl|-1]);\r\n Lemma_TrIncCounterImplSeqToSpecRelation(s_impl[..|s_impl|-1], s_spec[..|s_spec|-1]);\r\n assert forall i :: 0 <= i < |s_spec|-1 ==> s_spec[i] == TrIncCounterImplToSpec(s_impl[i]);\r\n }\r\n}\r\n\r\nlemma Lemma_TrIncCounterImplSeqToSpecOfOne(c:TrIncCounterImpl)\r\n requires TrIncCounterImplValid(c);\r\n ensures TrIncCounterImplSeqToSpec([c]) == [TrIncCounterImplToSpec(c)];\r\n{\r\n calc {\r\n TrIncCounterImplSeqToSpec([c]);\r\n TrIncCounterImplSeqToSpec([c][..|[c]|-1]) + [TrIncCounterImplToSpec([c][|[c]|-1])];\r\n TrIncCounterImplSeqToSpec([c][..0]) + [TrIncCounterImplToSpec([c][|[c]|-1])];\r\n TrIncCounterImplSeqToSpec([]) + [TrIncCounterImplToSpec([c][|[c]|-1])];\r\n [] + [TrIncCounterImplToSpec([c][|[c]|-1])];\r\n [TrIncCounterImplToSpec([c][|[c]|-1])];\r\n [TrIncCounterImplToSpec([c][0])];\r\n [TrIncCounterImplToSpec(c)];\r\n }\r\n}\r\n\r\nlemma Lemma_IndexIntoSequenceConcatenation(s1:seq, s2:seq, i:int)\r\n requires |s1| <= i < |s1| + |s2|;\r\n ensures (s1+s2)[i] == s2[i - |s1|];\r\n{\r\n}\r\n\r\nlemma Lemma_TrIncCounterImplSeqToSpecConcatenation (s1:seq, s2:seq)\r\n requires TrIncCounterImplSeqValid(s1);\r\n requires TrIncCounterImplSeqValid(s2);\r\n ensures TrIncCounterImplSeqToSpec(s1+s2) == TrIncCounterImplSeqToSpec(s1) + TrIncCounterImplSeqToSpec(s2);\r\n{\r\n ghost var s12 := s1 + s2;\r\n ghost var s1_spec := TrIncCounterImplSeqToSpec(s1);\r\n ghost var s2_spec := TrIncCounterImplSeqToSpec(s2);\r\n ghost var s12_spec := TrIncCounterImplSeqToSpec(s1+s2);\r\n ghost var s1_spec_s2_spec := s1_spec + s2_spec;\r\n\r\n Lemma_TrIncCounterImplSeqToSpecRelation(s1, s1_spec);\r\n Lemma_TrIncCounterImplSeqToSpecRelation(s2, s2_spec);\r\n Lemma_TrIncCounterImplSeqToSpecRelation(s12, s12_spec);\r\n\r\n forall i | 0 <= i < |s1|\r\n ensures s1_spec_s2_spec[i] == s12_spec[i];\r\n {\r\n calc {\r\n s1_spec_s2_spec[i];\r\n s1_spec[i];\r\n s12_spec[i];\r\n }\r\n }\r\n\r\n forall i | |s1| <= i < |s1|+|s2|\r\n ensures s1_spec_s2_spec[i] == s12_spec[i];\r\n {\r\n calc {\r\n s1_spec_s2_spec[i];\r\n (s1_spec + s2_spec)[i];\r\n { Lemma_IndexIntoSequenceConcatenation(s1_spec, s2_spec, i); }\r\n s2_spec[i - |s1_spec|];\r\n s2_spec[i - |s1|];\r\n {\r\n Lemma_TrIncCounterImplSeqToSpecRelation(s1, s1_spec);\r\n Lemma_TrIncCounterImplSeqToSpecRelation(s2, s2_spec);\r\n Lemma_TrIncCounterImplSeqToSpecRelation(s12, s12_spec);\r\n }\r\n s12_spec[i];\r\n }\r\n }\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- Implementing TrIncState with TrIncStateImpl\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\ndatatype TrIncStateImpl = TrIncStateImpl_c(counters:seq);\r\n\r\npredicate TrIncStateImplValid (trinc_state:TrIncStateImpl)\r\n{\r\n Word32(|trinc_state.counters|)\r\n && TrIncCounterImplSeqValid(trinc_state.counters)\r\n}\r\n\r\nfunction TrIncStateImplToSpec (s:TrIncStateImpl) : TrIncState\r\n requires TrIncStateImplValid(s);\r\n{\r\n TrIncStateConstructor(TrIncCounterImplSeqToSpec(s.counters))\r\n}\r\n\r\nlemma Lemma_TrIncStateImplToSpecRelation (s_impl:TrIncStateImpl, s_spec:TrIncState)\r\n requires TrIncStateImplValid(s_impl);\r\n requires s_spec == TrIncStateImplToSpec(s_impl);\r\n ensures |s_spec.counters| == |s_impl.counters|;\r\n ensures forall i :: 0 <= i < |s_spec.counters| ==> s_spec.counters[i] == TrIncCounterImplToSpec(s_impl.counters[i]);\r\n{\r\n Lemma_TrIncCounterImplSeqToSpecRelation(s_impl.counters, s_spec.counters);\r\n}\r\n\r\nlemma Lemma_TrIncStateImplValidImpliesTrIncStateValid (trinc_state:TrIncStateImpl)\r\n requires TrIncStateImplValid(trinc_state);\r\n ensures TrIncStateValid(TrIncStateImplToSpec(trinc_state));\r\n{\r\n Lemma_TrIncStateImplToSpecRelation(trinc_state, TrIncStateImplToSpec(trinc_state));\r\n}\r\n\r\nlemma Lemma_ConvertStateCounterImpl (state:TrIncStateImpl, i:int)\r\n requires TrIncStateImplValid(state);\r\n requires 0 <= i < |state.counters|;\r\n ensures |TrIncStateImplToSpec(state).counters| == |state.counters|;\r\n ensures TrIncCounterImplToSpec(state.counters[i]) == TrIncStateImplToSpec(state).counters[i];\r\n{\r\n Lemma_TrIncStateImplToSpecRelation(state, TrIncStateImplToSpec(state));\r\n}\r\n\r\nlemma Lemma_SplittingOffHeadOfCounterSequence (s:seq, left:int, right:int)\r\n requires 0 <= left < right <= |s|;\r\n ensures s[left..right] == [s[left]] + s[left+1..right];\r\n{\r\n}\r\n\r\nlemma Lemma_SplittingOffHeadOfTrIncCounterImplSequence (s:seq, left:int, right:int)\r\n requires 0 <= left < right <= |s|;\r\n ensures s[left..right] == [s[left]] + s[left+1..right];\r\n{\r\n}\r\n\r\nlemma Lemma_ConvertStateCounterImplSeqSubset (state:TrIncStateImpl, left:int, right:int)\r\n requires TrIncStateImplValid(state);\r\n requires 0 <= left <= right <= |state.counters|;\r\n ensures |TrIncStateImplToSpec(state).counters| == |state.counters|;\r\n ensures TrIncCounterImplSeqToSpec(state.counters[left..right]) == TrIncStateImplToSpec(state).counters[left..right];\r\n decreases right - left;\r\n{\r\n ghost var state_spec := TrIncStateImplToSpec(state);\r\n Lemma_TrIncStateImplToSpecRelation(state, state_spec);\r\n if left < right {\r\n calc {\r\n TrIncCounterImplSeqToSpec(state.counters[left..right]);\r\n { Lemma_SplittingOffHeadOfTrIncCounterImplSequence(state.counters, left, right);\r\n Lemma_TrIncCounterImplSeqToSpecConcatenation([state.counters[left]], state.counters[left+1..right]); }\r\n TrIncCounterImplSeqToSpec([state.counters[left]] + state.counters[left+1..right]);\r\n { Lemma_TrIncCounterImplSeqToSpecConcatenation([state.counters[left]], state.counters[left+1..right]); }\r\n TrIncCounterImplSeqToSpec([state.counters[left]]) + TrIncCounterImplSeqToSpec(state.counters[left+1..right]);\r\n { Lemma_ConvertStateCounterImplSeqSubset(state, left+1, right); }\r\n TrIncCounterImplSeqToSpec([state.counters[left]]) + state_spec.counters[left+1..right];\r\n { Lemma_TrIncCounterImplSeqToSpecOfOne(state.counters[left]); }\r\n [TrIncCounterImplToSpec(state.counters[left])] + state_spec.counters[left+1..right];\r\n { Lemma_ConvertStateCounterImpl(state, left); }\r\n [state_spec.counters[left]] + state_spec.counters[left+1..right];\r\n { Lemma_SplittingOffHeadOfCounterSequence(state_spec.counters, left, right); }\r\n state_spec.counters[left..right];\r\n }\r\n }\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- Lemmas\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nlemma Lemma_UpdatingStateEnsuresProperUpdatesToSpec (in_state:TrIncStateImpl, out_state:TrIncStateImpl,\r\n in_state_spec:TrIncState, out_state_spec:TrIncState,\r\n counter_index:nat, new_counter_value:BigNat)\r\n requires TrIncStateImplValid(in_state);\r\n requires in_state_spec == TrIncStateImplToSpec(in_state);\r\n requires TrIncStateImplValid(out_state);\r\n requires out_state_spec == TrIncStateImplToSpec(out_state);\r\n requires |in_state_spec.counters| == |in_state.counters|;\r\n requires 0 <= counter_index < |in_state.counters|;\r\n requires WellformedBigNat(new_counter_value);\r\n requires |out_state.counters| == |in_state.counters|;\r\n requires forall i :: 0 <= i < |in_state.counters| && i != counter_index ==> out_state.counters[i] == in_state.counters[i];\r\n requires out_state.counters[counter_index].public_key == in_state.counters[counter_index].public_key;\r\n requires out_state.counters[counter_index].counter_value == new_counter_value;\r\n\r\n ensures |in_state_spec.counters| == |out_state_spec.counters|;\r\n ensures forall i :: 0 <= i < |in_state.counters| && i != counter_index ==> out_state_spec.counters[i] == in_state_spec.counters[i];\r\n ensures out_state_spec.counters[counter_index].public_key == in_state_spec.counters[counter_index].public_key;\r\n ensures out_state_spec.counters[counter_index].counter_value == I(new_counter_value);\r\n ensures TrIncStateImplValid(out_state);\r\n{\r\n Lemma_TrIncStateImplToSpecRelation(in_state, in_state_spec);\r\n Lemma_TrIncStateImplToSpecRelation(out_state, out_state_spec);\r\n}\r\n\r\nlemma Lemma_TrIncCounterAdvanceStatementValid (statement:seq, counter_index:nat, old_counter_value:nat, new_counter_value:nat,\r\n counter_index_encoding:seq, old_counter_value_encoding:seq,\r\n new_counter_value_encoding:seq, message:seq)\r\n requires IsByteSeq(message);\r\n requires Word32(counter_index);\r\n requires old_counter_value < power2(power2(34));\r\n requires new_counter_value < power2(power2(34));\r\n requires counter_index_encoding == rfc4251_word32_encoding(counter_index);\r\n requires old_counter_value_encoding == rfc4251_mpint_encoding_premium(old_counter_value);\r\n requires new_counter_value_encoding == rfc4251_mpint_encoding_premium(new_counter_value);\r\n requires statement == [34] + counter_index_encoding + old_counter_value_encoding + new_counter_value_encoding + message;\r\n ensures statement == TrIncCounterAdvanceStatement(counter_index, old_counter_value, new_counter_value, message);\r\n ensures IsByteSeq(statement);\r\n{\r\n lemma_2toX();\r\n reveal_power2();\r\n assert IsByte(34);\r\n assert counter_index_encoding == BEWordSeqToByteSeq_premium([counter_index]);\r\n assert IsByteSeq(counter_index_encoding);\r\n assert IsByteSeq(old_counter_value_encoding);\r\n assert IsByteSeq(new_counter_value_encoding);\r\n}\r\n\r\nlemma Lemma_SufficientlySmallMessageCanBeSigned (message:seq)\r\n requires IsByteSeq(message);\r\n requires |message| <= 0xFFFFFFFF;\r\n ensures |message| < power2(61);\r\n ensures |BEByteSeqToBitSeq(message)| < power2(64);\r\n{\r\n calc {\r\n |BEByteSeqToBitSeq(message)|;\r\n |BEByteSeqToBitSeq_premium(message)|;\r\n 8 * |message|;\r\n <= 8 * 0xFFFFFFFF;\r\n < 0x800000000;\r\n < { lemma_2toX(); reveal_power2(); }\r\n power2(64);\r\n }\r\n\r\n calc {\r\n |message|;\r\n <= 0xFFFFFFFF;\r\n < { lemma_2toX(); reveal_power2(); }\r\n power2(61);\r\n }\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- Helpers\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nmethod CheckClientSignature (public_key:RSAPubKeyImpl, new_counter_value_encoding:seq, message:seq,\r\n request_attestation:seq) returns (error_code:int)\r\n requires WellformedRSAPubKeyImpl(public_key);\r\n requires RSA_DIGEST_MIN_KEY_SIZE() <= public_key.size < power2(60);\r\n requires IsByteSeq(new_counter_value_encoding);\r\n requires IsByteSeq(message);\r\n requires IsByteSeq(request_attestation);\r\n\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures TPM==old(TPM);\r\n\r\n ensures Word32(error_code);\r\n ensures error_code == 0 ==>\r\n var request := new_counter_value_encoding + message;\r\n |request| < power2(28) &&\r\n RSAVerificationRelationRequires(PubKeyImplToSpec(public_key), request, request_attestation) &&\r\n RSAVerificationRelation(PubKeyImplToSpec(public_key), request, request_attestation);\r\n\r\n requires public(PubKeyImplToSpec(public_key));\r\n requires public(new_counter_value_encoding);\r\n requires public(message);\r\n requires public(request_attestation);\r\n ensures public(error_code);\r\n{\r\n lemma_2toX32();\r\n\r\n var request:seq := new_counter_value_encoding + message;\r\n\r\n if |request| >= 0x10000000 {\r\n error_code := 2;\r\n return;\r\n }\r\n calc {\r\n |request|;\r\n < 0x10000000;\r\n == { reveal_power2(); }\r\n power2(28);\r\n }\r\n Lemma_SufficientlySmallMessageCanBeSigned(request);\r\n\r\n if |request_attestation| != public_key.size {\r\n error_code := 3;\r\n return;\r\n }\r\n\r\n var signature_ok := DigestedVerify(public_key, request, request_attestation);\r\n if !signature_ok {\r\n error_code := 5;\r\n return;\r\n }\r\n\r\n error_code := 0;\r\n}\r\n\r\nmethod CheckAdvanceCounterParameters (in_state:TrIncStateImpl, counter_index:nat, new_counter_value_encoding:seq,\r\n message:seq, request_attestation:seq)\r\n returns (error_code:int, new_counter_value:BigNat)\r\n requires TrIncStateImplValid(in_state);\r\n requires IsByteSeq(new_counter_value_encoding);\r\n requires IsByteSeq(message);\r\n requires IsByteSeq(request_attestation);\r\n\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures TPM==old(TPM);\r\n\r\n ensures Word32(error_code);\r\n ensures WellformedBigNat(new_counter_value);\r\n ensures error_code == 0 ==> 0 <= counter_index < |in_state.counters| &&\r\n ModestBigNatValue(new_counter_value) &&\r\n I(new_counter_value) < power2(power2(34)) &&\r\n new_counter_value_encoding == rfc4251_mpint_encoding_premium(I(new_counter_value)) &&\r\n I(in_state.counters[counter_index].counter_value) <= I(new_counter_value) &&\r\n WellformedRSAPubKeyImpl(in_state.counters[counter_index].public_key) &&\r\n RSAVerificationRelationRequires(PubKeyImplToSpec(in_state.counters[counter_index].public_key),\r\n new_counter_value_encoding + message, request_attestation) &&\r\n RSAVerificationRelation(PubKeyImplToSpec(in_state.counters[counter_index].public_key),\r\n new_counter_value_encoding + message, request_attestation);\r\n\r\n requires public(TrIncStateImplToSpec(in_state));\r\n requires public(counter_index);\r\n requires public(new_counter_value_encoding);\r\n requires public(message);\r\n requires public(request_attestation);\r\n ensures public(error_code);\r\n ensures public(I(new_counter_value));\r\n{\r\n Lemma_TrIncStateImplToSpecRelation(in_state, TrIncStateImplToSpec(in_state));\r\n new_counter_value := MakeSmallLiteralBigNat(0);\r\n\r\n lemma_2toX();\r\n\r\n if counter_index < 0 || counter_index >= |in_state.counters| {\r\n error_code := 1;\r\n return;\r\n }\r\n\r\n error_code := CheckClientSignature(in_state.counters[counter_index].public_key, new_counter_value_encoding, message,\r\n request_attestation);\r\n if error_code != 0 {\r\n return;\r\n }\r\n\r\n var success:bool;\r\n var bytes_consumed:int;\r\n success, new_counter_value, bytes_consumed := rfc4251_decode_mpint_legacy(new_counter_value_encoding);\r\n if !success {\r\n error_code := 6;\r\n new_counter_value := MakeSmallLiteralBigNat(0);\r\n return;\r\n }\r\n if bytes_consumed != |new_counter_value_encoding| {\r\n error_code := 7;\r\n new_counter_value := MakeSmallLiteralBigNat(0);\r\n return;\r\n }\r\n\r\n assert I(in_state.counters[counter_index].counter_value) == TrIncStateImplToSpec(in_state).counters[counter_index].counter_value;\r\n var too_small := BigNatLt(new_counter_value, in_state.counters[counter_index].counter_value);\r\n if too_small {\r\n error_code := 7;\r\n return;\r\n }\r\n assert I(new_counter_value) >= I(in_state.counters[counter_index].counter_value);\r\n\r\n var modest := IsModestBigNat(new_counter_value);\r\n if !modest {\r\n error_code := 8;\r\n return;\r\n }\r\n\r\n error_code := 0;\r\n}\r\n\r\nmethod EncodeAdvanceStatement (in_state:TrIncStateImpl, counter_index:nat, new_counter_value:BigNat,\r\n new_counter_value_encoding:seq, message:seq)\r\n returns (error_code:int, TrInc_statement:seq, ghost ghost_old_counter_value_encoding:seq)\r\n requires TrIncStateImplValid(in_state);\r\n requires WellformedBigNat(new_counter_value);\r\n requires IsByteSeq(message);\r\n requires 0 <= counter_index < |in_state.counters|;\r\n requires I(in_state.counters[counter_index].counter_value) <= I(new_counter_value);\r\n requires ModestBigNatValue(new_counter_value);\r\n requires I(new_counter_value) < power2(power2(34));\r\n requires new_counter_value_encoding == rfc4251_mpint_encoding_premium(I(new_counter_value));\r\n ensures Word32(error_code);\r\n ensures ghost_old_counter_value_encoding == rfc4251_mpint_encoding_premium(I(in_state.counters[counter_index].counter_value));\r\n ensures IsByteSeq(TrInc_statement);\r\n ensures TrInc_statement == TrIncCounterAdvanceStatement(counter_index,\r\n I(in_state.counters[counter_index].counter_value),\r\n I(new_counter_value),\r\n message);\r\n ensures error_code == 0 ==>\r\n I(in_state.counters[counter_index].counter_value) < power2(power2(34)) &&\r\n Word32(|TrInc_statement|) &&\r\n |TrInc_statement| < power2(28) &&\r\n |BEByteSeqToBitSeq_premium(TrInc_statement)| < power2(64);\r\n\r\n requires public(TrIncStateImplToSpec(in_state));\r\n requires public(counter_index);\r\n requires public(I(new_counter_value));\r\n requires public(new_counter_value_encoding);\r\n requires public(message);\r\n ensures public(error_code);\r\n ensures public(TrInc_statement);\r\n{\r\n Lemma_TrIncStateImplToSpecRelation(in_state, TrIncStateImplToSpec(in_state));\r\n lemma_2toX32();\r\n\r\n assert KV(in_state.counters[counter_index].counter_value) == I(in_state.counters[counter_index].counter_value);\r\n assert KV(in_state.counters[counter_index].counter_value) == TrIncStateImplToSpec(in_state).counters[counter_index].counter_value;\r\n\r\n var counter_index_encoding := rfc4251_encode_word32(counter_index);\r\n var old_counter_value_encoding := rfc4251_encode_mpint_legacy(in_state.counters[counter_index].counter_value);\r\n ghost_old_counter_value_encoding := old_counter_value_encoding;\r\n TrInc_statement := [34] + counter_index_encoding + old_counter_value_encoding + new_counter_value_encoding + message;\r\n Lemma_TrIncCounterAdvanceStatementValid(TrInc_statement, counter_index,\r\n I(in_state.counters[counter_index].counter_value), I(new_counter_value),\r\n counter_index_encoding, old_counter_value_encoding, new_counter_value_encoding, message);\r\n\r\n if |TrInc_statement| >= 0x10000000 {\r\n error_code := 7;\r\n return;\r\n }\r\n calc {\r\n |TrInc_statement|;\r\n < 0x10000000;\r\n ==\r\n power2(28);\r\n }\r\n\r\n\r\n error_code := 0;\r\n assert IsByte(34);\r\n assert IsByteSeq(TrInc_statement);\r\n Lemma_SufficientlySmallMessageCanBeSigned(TrInc_statement);\r\n\r\n assert TrInc_statement == TrIncCounterAdvanceStatement(counter_index,\r\n TrIncStateImplToSpec(in_state).counters[counter_index].counter_value,\r\n I(new_counter_value),\r\n message);\r\n}\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} UpdateStateByModifyingCounterValue\r\n (in_state:TrIncStateImpl, ghost in_state_spec:TrIncState, counter_index:nat, new_counter_value:BigNat)\r\n returns (out_state:TrIncStateImpl)\r\n requires TrIncStateImplValid(in_state);\r\n requires in_state_spec == TrIncStateImplToSpec(in_state);\r\n requires 0 <= counter_index < |in_state.counters|;\r\n requires WellformedBigNat(new_counter_value);\r\n requires ModestBigNatValue(new_counter_value);\r\n ensures |out_state.counters| == |in_state.counters|;\r\n ensures forall i :: 0 <= i < |in_state.counters| && i != counter_index ==> out_state.counters[i] == in_state.counters[i];\r\n ensures out_state.counters[counter_index].public_key == in_state.counters[counter_index].public_key;\r\n ensures out_state.counters[counter_index].counter_value == new_counter_value;\r\n\r\n requires public(in_state_spec);\r\n requires public(counter_index);\r\n requires public(I(new_counter_value));\r\n ensures public(TrIncStateImplToSpec(out_state));\r\n{\r\n Lemma_TrIncCounterImplSeqToSpecRelation(in_state.counters, TrIncCounterImplSeqToSpec(in_state.counters));\r\n var counters:seq := [];\r\n var j:int := 0;\r\n\r\n counters := in_state.counters[..counter_index] +\r\n [TrIncCounterImpl_c(in_state.counters[counter_index].public_key, new_counter_value)] +\r\n in_state.counters[counter_index+1..];\r\n out_state := TrIncStateImpl_c(counters);\r\n\r\n calc {\r\n TrIncStateImplToSpec(out_state);\r\n TrIncStateConstructor(TrIncCounterImplSeqToSpec(out_state.counters));\r\n TrIncStateConstructor(TrIncCounterImplSeqToSpec(counters));\r\n TrIncStateConstructor(TrIncCounterImplSeqToSpec(\r\n in_state.counters[..counter_index] + [TrIncCounterImpl_c(in_state.counters[counter_index].public_key, new_counter_value)] +\r\n in_state.counters[counter_index+1..]));\r\n { Lemma_TrIncCounterImplSeqToSpecConcatenation(\r\n in_state.counters[..counter_index] + [TrIncCounterImpl_c(in_state.counters[counter_index].public_key, new_counter_value)],\r\n in_state.counters[counter_index+1..]); }\r\n TrIncStateConstructor(TrIncCounterImplSeqToSpec(\r\n in_state.counters[..counter_index] + [TrIncCounterImpl_c(in_state.counters[counter_index].public_key, new_counter_value)]) +\r\n TrIncCounterImplSeqToSpec(in_state.counters[counter_index+1..]));\r\n { Lemma_TrIncCounterImplSeqToSpecConcatenation(\r\n in_state.counters[..counter_index],\r\n [TrIncCounterImpl_c(in_state.counters[counter_index].public_key, new_counter_value)]); }\r\n TrIncStateConstructor(TrIncCounterImplSeqToSpec(in_state.counters[..counter_index]) +\r\n TrIncCounterImplSeqToSpec([TrIncCounterImpl_c(in_state.counters[counter_index].public_key, new_counter_value)]) +\r\n TrIncCounterImplSeqToSpec(in_state.counters[counter_index+1..]));\r\n { Lemma_ConvertStateCounterImplSeqSubset(in_state, 0, counter_index);\r\n assert in_state.counters[..counter_index] == in_state.counters[0..counter_index];\r\n assert in_state_spec.counters[..counter_index] == in_state_spec.counters[0..counter_index]; }\r\n TrIncStateConstructor(in_state_spec.counters[..counter_index] +\r\n TrIncCounterImplSeqToSpec([TrIncCounterImpl_c(in_state.counters[counter_index].public_key, new_counter_value)]) +\r\n TrIncCounterImplSeqToSpec(in_state.counters[counter_index+1..]));\r\n { Lemma_ConvertStateCounterImplSeqSubset(in_state, counter_index+1, |in_state.counters|);\r\n assert |in_state.counters| == |in_state_spec.counters|;\r\n assert in_state.counters[counter_index+1..] == in_state.counters[counter_index+1..|in_state.counters|];\r\n assert in_state_spec.counters[counter_index+1..] == in_state_spec.counters[counter_index+1..|in_state.counters|]; }\r\n TrIncStateConstructor(in_state_spec.counters[..counter_index] +\r\n TrIncCounterImplSeqToSpec([TrIncCounterImpl_c(in_state.counters[counter_index].public_key, new_counter_value)]) +\r\n in_state_spec.counters[counter_index+1..]);\r\n { Lemma_TrIncCounterImplSeqToSpecOfOne(TrIncCounterImpl_c(in_state.counters[counter_index].public_key, new_counter_value)); }\r\n TrIncStateConstructor(in_state_spec.counters[..counter_index] +\r\n [TrIncCounterImplToSpec(TrIncCounterImpl_c(in_state.counters[counter_index].public_key, new_counter_value))] +\r\n in_state_spec.counters[counter_index+1..]);\r\n { Lemma_ConvertStateCounterImpl(in_state, counter_index); }\r\n TrIncStateConstructor(in_state_spec.counters[..counter_index] +\r\n [TrIncCounterConstructor(in_state_spec.counters[counter_index].public_key, I(new_counter_value))] +\r\n in_state_spec.counters[counter_index+1..]);\r\n }\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- Exported methods\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nmethod TrIncInitialize () returns (trinc_state:TrIncStateImpl)\r\n ensures TrIncStateImplValid(trinc_state);\r\n ensures TrIncInitializeValid(TrIncStateImplToSpec(trinc_state));\r\n ensures public(TrIncStateImplToSpec(trinc_state));\r\n{\r\n trinc_state := TrIncStateImpl_c([]); //- dafnycc: initialize variable\r\n Lemma_TrIncStateImplToSpecRelation(trinc_state, TrIncStateImplToSpec(trinc_state));\r\n}\r\n\r\nmethod TrIncCreateCounter (in_state:TrIncStateImpl, common_state:CommonStateImpl, public_key_encoding:seq)\r\n returns (out_state:TrIncStateImpl, error_code:int, counter_index:nat)\r\n requires TrIncStateImplValid(in_state);\r\n requires CommonStateImplValid(common_state);\r\n requires IsByteSeq(public_key_encoding);\r\n ensures TrIncStateImplValid(out_state);\r\n ensures error_code == 0 ==> TrIncCreateCounterValid(TrIncStateImplToSpec(in_state), TrIncStateImplToSpec(out_state),\r\n CommonStateImplToSpec(common_state), public_key_encoding, counter_index);\r\n ensures error_code != 0 ==> out_state == in_state;\r\n ensures Word32(error_code);\r\n ensures Word32(counter_index);\r\n\r\n requires public(TrIncStateImplToSpec(in_state));\r\n requires public(public_key_encoding);\r\n ensures public(TrIncStateImplToSpec(out_state));\r\n ensures public(error_code);\r\n ensures public(counter_index);\r\n{\r\n out_state := in_state;\r\n counter_index := 0;\r\n\r\n lemma_2toX();\r\n Lemma_TrIncStateImplToSpecRelation(in_state, TrIncStateImplToSpec(in_state));\r\n if |in_state.counters| >= 0xFFFFFFFF {\r\n error_code := 1;\r\n return;\r\n }\r\n\r\n if |public_key_encoding| >= 0xFFFFFFFF {\r\n error_code := 2;\r\n return;\r\n }\r\n\r\n var success, public_key := rfc4251_decode_sshrsa(public_key_encoding);\r\n if !success {\r\n error_code := 3;\r\n return;\r\n }\r\n\r\n assert WellformedRSAPubKeyImpl(public_key);\r\n assert WellformedRSAPubKeySpec(PubKeyImplToSpec(public_key));\r\n\r\n if public_key.size < RSA_DIGEST_MIN_KEY_SIZE() || public_key.size >= 0xFFFFFFFF {\r\n error_code := 4;\r\n return;\r\n }\r\n\r\n error_code := 0;\r\n var zero := MakeSmallLiteralBigNat(0);\r\n var new_counter := TrIncCounterImpl_c(public_key, zero);\r\n out_state := TrIncStateImpl_c(in_state.counters + [new_counter]);\r\n counter_index := |out_state.counters| - 1;\r\n\r\n calc {\r\n TrIncStateImplToSpec(out_state);\r\n TrIncStateConstructor(TrIncCounterImplSeqToSpec(in_state.counters + [new_counter]));\r\n { Lemma_TrIncCounterImplSeqToSpecConcatenation(in_state.counters, [new_counter]); }\r\n TrIncStateConstructor(TrIncCounterImplSeqToSpec(in_state.counters) + TrIncCounterImplSeqToSpec([new_counter]));\r\n { Lemma_TrIncCounterImplSeqToSpecOfOne(new_counter); }\r\n TrIncStateConstructor(TrIncCounterImplSeqToSpec(in_state.counters) + [TrIncCounterImplToSpec(new_counter)]);\r\n TrIncStateConstructor(TrIncStateImplToSpec(in_state).counters + [TrIncCounterImplToSpec(new_counter)]);\r\n TrIncStateConstructor(TrIncStateImplToSpec(in_state).counters + [TrIncCounterConstructor(PubKeyImplToSpec(new_counter.public_key), I(new_counter.counter_value))]);\r\n TrIncStateConstructor(TrIncStateImplToSpec(in_state).counters + [TrIncCounterConstructor(PubKeyImplToSpec(new_counter.public_key), 0)]);\r\n TrIncStateConstructor(TrIncStateImplToSpec(in_state).counters + [TrIncCounterConstructor(PubKeyImplToSpec(public_key), 0)]);\r\n }\r\n\r\n//- Lemma_TrIncStateImplToSpecRelation(out_state, TrIncStateImplToSpec(out_state));\r\n//- Lemma_TrIncCounterImplSeqToSpecConcatenation(in_state.counters, [new_counter]);\r\n assert counter_index == |TrIncStateImplToSpec(out_state).counters| - 1;\r\n}\r\n\r\nmethod{:dafnycc_conservative_seq_triggers} TrIncAdvanceCounter\r\n (in_state:TrIncStateImpl, common_state:CommonStateImpl, counter_index:nat,\r\n new_counter_value_encoding:seq, message:seq, request_attestation:seq)\r\n returns (out_state:TrIncStateImpl, error_code:int, TrInc_statement:seq, TrInc_attestation:seq)\r\n requires TrIncStateImplValid(in_state);\r\n requires CommonStateImplValid(common_state);\r\n requires RSA_DIGEST_MIN_KEY_SIZE() <= common_state.key_pair.pub.size;\r\n requires IsByteSeq(new_counter_value_encoding);\r\n requires IsByteSeq(message);\r\n requires IsByteSeq(request_attestation);\r\n\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM==old(TPM);\r\n ensures TPM_ready();\r\n\r\n ensures TrIncStateImplValid(out_state);\r\n ensures error_code == 0 ==> TrIncAdvanceCounterValid(TrIncStateImplToSpec(in_state), TrIncStateImplToSpec(out_state),\r\n CommonStateImplToSpec(common_state),\r\n counter_index, new_counter_value_encoding, message, request_attestation,\r\n TrInc_statement, TrInc_attestation);\r\n ensures error_code != 0 ==> out_state == in_state;\r\n ensures TrIncStateImplValid(out_state);\r\n ensures Word32(error_code);\r\n ensures Word32(|TrInc_statement|);\r\n ensures Word32(|TrInc_attestation|);\r\n ensures IsByteSeq(TrInc_statement);\r\n ensures IsByteSeq(TrInc_attestation);\r\n\r\n requires public(TrIncStateImplToSpec(in_state));\r\n requires public(counter_index);\r\n requires public(new_counter_value_encoding);\r\n requires public(message);\r\n requires public(request_attestation);\r\n ensures public(TrIncStateImplToSpec(out_state));\r\n ensures public(error_code);\r\n ensures public(TrInc_statement);\r\n{\r\n out_state := in_state;\r\n TrInc_statement := [];\r\n TrInc_attestation := [];\r\n ghost var in_state_spec := TrIncStateImplToSpec(in_state);\r\n Lemma_TrIncStateImplValidImpliesTrIncStateValid(in_state);\r\n\r\n var new_counter_value:BigNat;\r\n error_code, new_counter_value := CheckAdvanceCounterParameters(in_state, counter_index, new_counter_value_encoding,\r\n message, request_attestation);\r\n if (error_code != 0) {\r\n out_state := in_state;\r\n return;\r\n }\r\n\r\n ghost var old_counter_value_encoding:seq;\r\n error_code, TrInc_statement, old_counter_value_encoding := \r\n EncodeAdvanceStatement(in_state, counter_index, new_counter_value, new_counter_value_encoding, message);\r\n if (error_code != 0) {\r\n out_state := in_state;\r\n TrInc_statement := [];\r\n return;\r\n }\r\n\r\n TrInc_attestation := DigestedSign(common_state.key_pair, TrInc_statement);\r\n\r\n out_state := UpdateStateByModifyingCounterValue(in_state, in_state_spec, counter_index, new_counter_value);\r\n Lemma_TrIncCounterImplSeqToSpecRelation(in_state.counters, in_state_spec.counters);\r\n Lemma_UpdatingStateEnsuresProperUpdatesToSpec(in_state, out_state,\r\n in_state_spec, TrIncStateImplToSpec(out_state),\r\n counter_index, new_counter_value);\r\n Lemma_TrIncStateImplToSpecRelation(out_state, TrIncStateImplToSpec(out_state));\r\n\r\n ghost var new_counter_value_int := I(new_counter_value); //- Introduce a witness Dafny needs\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/TrInc/TrInc.s.dfy", "content": "include \"../../Libraries/Util/be_sequences.s.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/RSASpec.s.dfy\"\r\ninclude \"../../Libraries/Crypto/RSA/rfc4251.s.dfy\"\r\ninclude \"../Common/CommonState.s.dfy\"\r\ninclude \"../../Drivers/TPM/tpm-device.s.dfy\"\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Structures\r\n//-///////////////////////////////////////////////////\r\n\r\n//- Each counter has an RSA public key associated with it; only users\r\n//- in possession of the corresponding private key are allowed to\r\n//- advance the counter.\r\n\r\ndatatype TrIncCounter = TrIncCounterConstructor(public_key:RSAPubKeySpec, counter_value:nat);\r\ndatatype TrIncState = TrIncStateConstructor(counters:seq);\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Helpers\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic predicate TrIncStateValid(state:TrIncState)\r\n{\r\n Word32(|state.counters|) &&\r\n (forall i :: 0 <= i < |state.counters| ==> WellformedRSAPubKeySpec(state.counters[i].public_key))\r\n}\r\n\r\nstatic function {:autoReq} TrIncCounterAdvanceStatement(counter_index:nat, old_counter_value:nat, new_counter_value:nat,\r\n message:seq) : seq\r\n{\r\n [34] /* counter advance */ + rfc4251_word32_encoding(counter_index) + rfc4251_mpint_encoding(old_counter_value)\r\n + rfc4251_mpint_encoding(new_counter_value) + message\r\n}\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Specifications for correct method operation\r\n//-///////////////////////////////////////////////////\r\n\r\n//- This function is used to ensure that TrInc initialization operates correctly.\r\n//- It should initialize the counter set to be empty.\r\n\r\nstatic predicate {:autoReq} TrIncInitializeValid(state:TrIncState)\r\n{\r\n |state.counters| == 0\r\n}\r\n\r\n//- This function is used to ensure that TrIncCreateCounter operates correctly.\r\n//- That method is supposed to create a new counter with the given public key.\r\n//- It returns the index of the new counter.\r\n\r\nstatic predicate {:autoReq} TrIncCreateCounterValid(in_state:TrIncState, out_state:TrIncState, common_state:CommonState,\r\n public_key_encoding_in:seq, counter_index_out:nat)\r\n requires IsByteSeq(public_key_encoding_in);\r\n{\r\n TrIncStateValid(out_state) &&\r\n exists public_key_in:RSAPubKeySpec ::\r\n public_key_encoding_in == rfc4251_sshrsa_encoding(public_key_in.e, public_key_in.n) &&\r\n out_state.counters == in_state.counters + [TrIncCounterConstructor(public_key_in, 0)] &&\r\n counter_index_out == |in_state.counters|\r\n}\r\n\r\n//- This function is used to ensure that TrIncAdvanceCounter operates\r\n//- correctly. That method is supposed to advance the given counter to the\r\n//- given new counter value. It should then return an attestation that the\r\n//- counter was advanced.\r\n\r\nstatic predicate {:autoReq} TrIncAdvanceCounterValid(in_state:TrIncState, out_state:TrIncState, common_state:CommonState,\r\n counter_index_in:nat, new_counter_value_encoding_in:seq,\r\n message_in:seq, request_attestation_in:seq,\r\n TrInc_statement_out:seq, TrInc_attestation_out:seq)\r\n requires IsByteSeq(new_counter_value_encoding_in);\r\n requires IsByteSeq(message_in);\r\n requires IsByteSeq(request_attestation_in);\r\n{\r\n //- Note that, as in the TrInc paper, it is acceptable to advance the counter to\r\n //- the same value that it had before. This is OK because the attestation will\r\n //- state the old and new counter values, so the recipient of that attestation\r\n //- can't mistake it for a non-zero counter advance.\r\n\r\n TrIncStateValid(out_state) &&\r\n exists new_counter_value_in:nat ::\r\n //- The parameters are valid\r\n\r\n 0 <= counter_index_in < |in_state.counters| &&\r\n new_counter_value_encoding_in == rfc4251_mpint_encoding(new_counter_value_in) &&\r\n in_state.counters[counter_index_in].counter_value <= new_counter_value_in &&\r\n WellformedRSAPubKeySpec(in_state.counters[counter_index_in].public_key) &&\r\n RSAVerificationRelation(in_state.counters[counter_index_in].public_key, new_counter_value_encoding_in + message_in, request_attestation_in) &&\r\n\r\n //- Most of the state stays the same...\r\n\r\n |out_state.counters| == |in_state.counters| &&\r\n (forall i :: 0 <= i < |in_state.counters| && i != counter_index_in ==> out_state.counters[i] == in_state.counters[i]) &&\r\n out_state.counters[counter_index_in].public_key == in_state.counters[counter_index_in].public_key &&\r\n\r\n //- ...except for the counter value for the counter with the given index...\r\n\r\n out_state.counters[counter_index_in].counter_value == new_counter_value_in &&\r\n\r\n //- ...and an attestation is returned.\r\n\r\n TrInc_statement_out == TrIncCounterAdvanceStatement(counter_index_in, in_state.counters[counter_index_in].counter_value,\r\n new_counter_value_in, message_in) &&\r\n TrInc_attestation_out == RSASignature(common_state.key_pair, TrInc_statement_out)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/UdpEchoService/UdpEchoService.i.dfy", "content": "include \"../../Drivers/Network/Intel/driver.i.dfy\"\r\ninclude \"../../Libraries/Net/ethernet.i.dfy\"\r\ninclude \"../../Libraries/Net/IPv4.i.dfy\"\r\ninclude \"../../Libraries/Net/Udp.i.dfy\"\r\ninclude \"../../Libraries/Util/integer_sequences.i.dfy\"\r\n\r\n//-\r\n//- A simple UDP Echo Service.\r\n//-\r\n\r\nmethod DebugPrintSequence(Offset:int, Data:seq)\r\n requires 0 <= Offset <= 160 - 16;\r\n requires IsByteSeq(Data);\r\n requires |Data| >= 0;\r\n{\r\n var Index:int := 0;\r\n\r\n while (Index < |Data|)\r\n decreases |Data| - Index;\r\n invariant Index >= 0;\r\n invariant Index <= |Data|;\r\n {\r\n debug_print(Offset, Data[Index]);\r\n Index := Index + 1;\r\n }\r\n}\r\n\r\nmethod Main()\r\n returns (Result:int)\r\n ensures public(true);\r\n{\r\n lemma_2toX();\r\n\r\n Result := 0;\r\n\r\n var NetUp, net_state := init_network_card();\r\n\r\n if NetUp {\r\n lemma_2toX();\r\n debug_print(0x90, 0xded0d0d0);\r\n\r\n var Success:bool := true;\r\n var EtherSource:ethernet_addr;\r\n var IPSource:IPv4Address;\r\n var IPDest:IPv4Address;\r\n var SourcePort:int;\r\n var DestPort:int;\r\n var Data:seq;\r\n\r\n while (Success)\r\n invariant valid_network_state(net_state);\r\n invariant public(net_state);\r\n invariant public(Success);\r\n decreases *;\r\n {\r\n Success, net_state, EtherSource, IPSource, IPDest, SourcePort, DestPort, Data := UdpReceive(net_state);\r\n if (Success)\r\n {\r\n lemma_2toX();\r\n \r\n//- DebugPrintSequence(0x90, Data);\r\n debug_print(0x90, 0xdedadada);\r\n\r\n if (DestPort == 7)\r\n {\r\n //-\r\n //- Port 7 is the Echo Service port.\r\n //- Echo the data received back to the sender.\r\n //- \r\n net_state := UdpSend(net_state, EtherSource, IPDest, IPSource, DestPort, SourcePort, Data);\r\n }\r\n }\r\n else\r\n {\r\n Result := 0xdeadbeef;\r\n debug_print(0x90, 0xdeadbeef);\r\n }\r\n }\r\n } else {\r\n Result := 0xdeaddead;\r\n debug_print(0x90, 0xdeaddead);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Apps/apps.dfy.batch", "content": "# This file only activates the apps we want for the paper analysis.\r\n# Perhaps we should have another file for the build server to build everything.\r\n#src/Dafny/Apps/AppLoader/Main.i.dfy\r\n#src/Dafny/Apps/BenchmarkApp/Main.i.dfy\r\nsrc/Dafny/Apps/DafnyCCTest/Main.i.dfy\r\nsrc/Dafny/Apps/DiffPriv/Main.i.dfy\r\nsrc/Dafny/Apps/Notary/Main.i.dfy\r\nsrc/Dafny/Apps/PassHash/Main.i.dfy\r\nsrc/Dafny/Apps/TrInc/Main.i.dfy\r\n" }, { "path": "ironclad-apps/src/Dafny/BuildExceptions.py", "content": "# this file is included by ironmake.py\r\n\r\nclass Exceptions():\r\n\tdef __init__(self):\r\n\t\tself.flags = {}\r\n##############################################################################\r\n## Add flags here:\r\n\t\tself.addFlag(\"Noise.i.dfy\", \"/z3opt:ARITH_RANDOM_SEED=2\")\r\n\t\tfor real_file in [\"Noise.s.dfy\", \"Noise.i.dfy\", \"BigRat.i.dfy\", \"DiffPriv.i.dfy\", \"DiffPrivPerformQuery.i.dfy\", \"mul_nonlinear.i.dfy\", \"div_nonlinear.i.dfy\"]:\r\n\t\t\tself.addFlag(real_file, \"/z3opt:NL_ARITH=true\")\r\n##############################################################################\r\n\r\n\tdef addFlag(self, basename, flagstr):\r\n\t\t# flagstr may contain spaces for multiple flags.\r\n\t\tself.flags[basename.lower()] = flagstr\r\n\r\n\tdef __getitem__(self, basename):\r\n\t\tbasename = basename.lower()\r\n\t\tif (basename in self.flags):\r\n\t\t\tprint \"Exception for %s : %s\" % (basename, self.flags[basename])\r\n\t\t\treturn self.flags[basename]\r\n\t\treturn \"\"\r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/CPU/assembly.i.dfy", "content": "//-\r\ninclude \"../../Libraries/base.s.dfy\"\r\ninclude \"../../Libraries/Util/relational.s.dfy\"\r\n//-include \"assembly.s.dfy\"\r\n\r\n//-//////////////////////////////////////////////////////\r\n//- You should never need to call these! Please use the \r\n//- routines in assembly_premium.i.dfy instead.\r\n//- DafnyCC connects these methods to the underlying\r\n//- Boogie spec for the corresponding assembly \r\n//- instructions. Please do not change them, unless\r\n//- you also change the underlying Boogie spec. If\r\n//- you need more properties, add them to the Premium\r\n//- versions in assembly_premium.dfy\r\n//-//////////////////////////////////////////////////////\r\n\r\nstatic function {:imported} IntBit(index:int, val:int):bool\r\nstatic lemma{:decl} lemma_IntBit(index:int, val:int)\r\n ensures word32(val) && 0 <= index < 32 ==> \r\n IntBit(index, val) == if (index < 31) then IntBit(index + 1, val / 2) else val % 2 != 0;\r\n\r\n//- Undefined. Mapped to Boogie's word32\r\nstatic function{:imported} word32(x:int):bool\r\nstatic lemma{:decl} lemma_word32(x:int)\r\n ensures word32(x) <==> 0 <= x < 0x100000000;\r\n\r\nstatic function{:imported} mod0x100000000(x:int):int\r\nstatic lemma{:decl} lemma_mod0x100000000(x:int)\r\n ensures mod0x100000000(x) == x % 0x100000000;\r\n\r\nstatic method{:decl}{:dafnycc_heap_unmodified}{:instruction \"out@EDX\", \"inout@EAX\", \"in\"}{:strict_operands} method_Mul(x:int, y:int) returns(hi:int, r:int)\r\n ensures r == x * y;\r\n\r\nstatic method{:decl}{:dafnycc_heap_unmodified}{:instruction \"inout@EDX\", \"inout@EAX\", \"in\"}{:strict_operands} method_DivMod(zero:int, x:int, y:int) returns(m:int, d:int)\r\n requires zero == 0;\r\n requires y != 0;\r\n ensures d == x / y;\r\n ensures m == x % y;\r\n\r\nstatic function method{:imported}{:instruction \"inout\", \"in\"} asm_Add(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n ensures word32(asm_Add(x, y));\r\n ensures asm_Add(x, y) == mod0x100000000(x + y);\r\n\r\nstatic function method{:imported}{:instruction \"inout\", \"in\"} asm_Sub(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n ensures word32(asm_Sub(x, y));\r\n ensures asm_Sub(x, y) == mod0x100000000(x - y);\r\n\r\nstatic function method{:imported} asm_Mul(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n ensures word32(asm_Mul(x, y));\r\n ensures asm_Mul(x, y) == mod0x100000000(x * y);\r\n\r\nstatic method{:imported}{:instruction \"out@EDX\", \"inout@EAX\", \"in\"}{:strict_operands} asm_Mul64(x:int, y:int) returns (hi:int, lo:int)\r\n requires word32(x);\r\n requires word32(y);\r\n ensures word32(hi);\r\n ensures word32(lo);\r\n ensures lo == mod0x100000000(x * y);\r\n ensures hi == (x * y) / 0x100000000;\r\n\r\nstatic function method{:imported} asm_Div(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n requires y > 0;\r\n ensures word32(asm_Div(x, y));\r\n ensures asm_Div(x, y) == mod0x100000000(x / y);\r\n\r\nstatic function method{:imported} asm_Mod(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n requires y > 0;\r\n ensures word32(asm_Mod(x, y));\r\n ensures asm_Mod(x, y) == x % y;\r\n\r\nstatic function method{:imported}{:instruction \"inout\", \"in@ECX\"} asm_LeftShift(x:int, amount:int):int\r\n requires word32(x);\r\n requires 0 <= amount < 32;\r\n ensures word32(asm_LeftShift(x, amount));\r\n ensures forall i {:trigger IntBit(i, asm_LeftShift(x, amount))} :: 32 - amount <= i < 32 ==> IntBit(i, asm_LeftShift(x, amount)) == false;\r\n ensures forall i {:trigger IntBit(i, asm_LeftShift(x, amount))} :: 0 <= i < 32 - amount ==> IntBit(i, asm_LeftShift(x, amount)) == IntBit(i + amount, x);\r\n\r\nstatic function method{:imported}{:instruction \"inout\", \"in@ECX\"} asm_RightShift(x:int, amount:int):int\r\n requires word32(x);\r\n requires 0 <= amount < 32;\r\n ensures word32(asm_RightShift(x, amount));\r\n ensures forall i {:trigger IntBit(i, asm_RightShift(x, amount))} :: 0 <= i < amount ==> IntBit(i, asm_RightShift(x, amount)) == false; \r\n ensures forall i {:trigger IntBit(i, asm_RightShift(x, amount))} :: amount <= i < 32 ==> IntBit(i, asm_RightShift(x, amount)) == IntBit(i - amount, x); \r\n\r\nstatic function method{:imported}{:instruction \"inout\", \"in@ECX\"} asm_RotateLeft(x:int, amount:int):int\r\n requires word32(x);\r\n requires 0 <= amount < 32;\r\n ensures word32(asm_RotateLeft(x, amount));\r\n ensures forall i {:trigger IntBit(i, asm_RotateLeft(x, amount))} :: 0 <= i < 32 - amount ==> IntBit(i, asm_RotateLeft(x, amount)) == IntBit(i + amount, x);\r\n ensures forall i {:trigger IntBit(i, asm_RotateLeft(x, amount))} :: 32 - amount <= i < 32 ==> IntBit(i, asm_RotateLeft(x, amount)) == IntBit(i - (32 - amount), x); \r\n\r\nstatic function method{:imported}{:instruction \"inout\", \"in@ECX\"} asm_RotateRight(x:int, amount:int):int\r\n requires word32(x);\r\n requires 0 <= amount < 32;\r\n ensures word32(asm_RotateRight(x, amount));\r\n ensures forall i {:trigger IntBit(i, asm_RotateRight(x, amount))} :: 0 <= i < amount ==> IntBit(i, asm_RotateRight(x, amount)) == IntBit((32 - amount)+i, x);\r\n ensures forall i {:trigger IntBit(i, asm_RotateRight(x, amount))} :: amount <= i < 32 ==> IntBit(i, asm_RotateRight(x, amount)) == IntBit(i - amount, x);\r\n\r\nstatic function method{:imported}{:instruction \"inout\"} asm_BitwiseNot(x:int):int\r\n requires word32(x);\r\n ensures word32(asm_BitwiseNot(x));\r\n ensures forall i {:trigger IntBit(i, asm_BitwiseNot(x))} :: 0 <= i < 32 ==> IntBit(i, asm_BitwiseNot(x)) == !IntBit(i, x);\r\n\r\nstatic function method{:imported}{:instruction \"inout\", \"in\"} asm_BitwiseAnd(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n ensures word32(asm_BitwiseAnd(x, y));\r\n ensures forall i {:trigger IntBit(i, asm_BitwiseAnd(x, y))} :: 0 <= i < 32 ==> IntBit(i, asm_BitwiseAnd(x, y)) == (IntBit(i, x) && IntBit(i, y));\r\n\r\nstatic function method{:imported}{:instruction \"inout\", \"in\"} asm_BitwiseOr(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n ensures word32(asm_BitwiseOr(x, y));\r\n ensures forall i {:trigger IntBit(i, asm_BitwiseOr(x, y))} :: 0 <= i < 32 ==> IntBit(i, asm_BitwiseOr(x, y)) == (IntBit(i, x) || IntBit(i, y));\r\n\r\nstatic function method{:imported}{:instruction \"inout\", \"in\"} asm_BitwiseXor(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n ensures word32(asm_BitwiseXor(x, y));\r\n ensures forall i {:trigger IntBit(i, asm_BitwiseXor(x, y))} :: 0 <= i < 32 ==> IntBit(i, asm_BitwiseXor(x, y)) == (IntBit(i, x) != IntBit(i, y));\r\n\r\nstatic method{:decl} asm_Rdtsc() returns (high:int, low:int)\r\n ensures word32(high);\r\n ensures word32(low);\r\n\r\nmethod{:decl} asm_declassify_result(concrete:int, ghost result:int) returns (pub_result:int)\r\n requires word32(concrete);\r\n requires relation(declassified(left(result), right(result), left(concrete), right(concrete)));\r\n ensures pub_result == result;\r\n ensures public(pub_result);\r\n\r\nstatic method{:decl} GetBootloaderArgWord(index:int) returns (word:int)\r\n requires 0 <= index < 256;\r\n ensures word32(word);\r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/CPU/assembly.s.dfy", "content": "include \"../../Libraries/Util/bytes_and_words.s.dfy\"\r\ninclude \"../../Libraries/Util/be_sequences.s.dfy\"\r\n\r\n//-/////////////////////////////////////////////\r\n//- Abstract definitions of 32-bit operations\r\n//- that we may want to talk about in specs\r\n//-/////////////////////////////////////////////\r\n\r\n \r\nstatic function UndefinedBit(index:int, val:int):bool\r\nstatic function IntBit_spec(index:int, val:int):bool\r\n{\r\n var bits := BEWordToBitSeq(val);\r\n if 0 <= index < |bits| then bits[index] == 1\r\n else UndefinedBit(index, val)\r\n}\r\n\r\n\r\n//-static lemma{:decl} lemma_IntBit_spec(index:int, val:int)\r\n//- ensures Word32(val) && 0 <= index < 32 ==> \r\n//- IntBit_spec(index, val) == if (index < 31) then IntBit_spec(index + 1, val / 2) else val % 2 != 0;\r\n\r\nstatic function{:axiom} BitwiseAnd(x:int, y:int) : int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(BitwiseAnd(x, y));\r\n ensures forall i {:trigger IntBit_spec(i, BitwiseAnd(x, y))} :: 0 <= i < 32 ==> IntBit_spec(i, BitwiseAnd(x, y)) == (IntBit_spec(i, x) && IntBit_spec(i, y));\r\n\r\nstatic function{:axiom} BitwiseOr(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(BitwiseOr(x, y));\r\n ensures forall i {:trigger IntBit_spec(i, BitwiseOr(x, y))} :: 0 <= i < 32 ==> IntBit_spec(i, BitwiseOr(x, y)) == (IntBit_spec(i, x) || IntBit_spec(i, y));\r\n\r\nstatic function{:axiom} BitwiseNot(x:int) : int\r\n requires Word32(x);\r\n ensures Word32(BitwiseNot(x));\r\n ensures forall i {:trigger IntBit_spec(i, BitwiseNot(x))} :: 0 <= i < 32 ==> IntBit_spec(i, BitwiseNot(x)) == !IntBit_spec(i, x);\r\n\r\nstatic function{:axiom} BitwiseXor(x:int, y:int) : int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(BitwiseXor(x, y));\r\n ensures forall i {:trigger IntBit_spec(i, BitwiseXor(x, y))} :: 0 <= i < 32 ==> IntBit_spec(i, BitwiseXor(x, y)) == (IntBit_spec(i, x) != IntBit_spec(i, y));\r\n\r\nstatic function{:axiom} RotateRight(x:int, amount:int) : int\r\n requires Word32(x);\r\n requires 0 <= amount < 32;\r\n ensures Word32(RotateRight(x, amount));\r\n ensures forall i {:trigger IntBit_spec(i, RotateRight(x, amount))} :: 0 <= i < amount ==> IntBit_spec(i, RotateRight(x, amount)) == IntBit_spec((32 - amount)+i, x);\r\n ensures forall i {:trigger IntBit_spec(i, RotateRight(x, amount))} :: amount <= i < 32 ==> IntBit_spec(i, RotateRight(x, amount)) == IntBit_spec(i - amount, x);\r\n\r\nstatic function{:axiom} RotateLeft(x:int, amount:int):int\r\n requires Word32(x);\r\n requires 0 <= amount < 32;\r\n ensures Word32(RotateLeft(x, amount));\r\n ensures forall i {:trigger IntBit_spec(i, RotateLeft(x, amount))} :: 0 <= i < 32 - amount ==> IntBit_spec(i, RotateLeft(x, amount)) == IntBit_spec(i + amount, x);\r\n ensures forall i {:trigger IntBit_spec(i, RotateLeft(x, amount))} :: 32 - amount <= i < 32 ==> IntBit_spec(i, RotateLeft(x, amount)) == IntBit_spec(i - (32 - amount), x); \r\n\r\nstatic function{:axiom} RightShift(x:int, amount:int) : int\r\n requires Word32(x);\r\n requires 0 <= amount < 32;\r\n ensures Word32(RightShift(x, amount));\r\n ensures forall i {:trigger IntBit_spec(i, RightShift(x, amount))} :: 0 <= i < amount ==> IntBit_spec(i, RightShift(x, amount)) == false; \r\n ensures forall i {:trigger IntBit_spec(i, RightShift(x, amount))} :: amount <= i < 32 ==> IntBit_spec(i, RightShift(x, amount)) == IntBit_spec(i - amount, x); \r\n\r\nstatic function{:axiom} LeftShift(x:int, amount:int):int\r\n requires Word32(x);\r\n requires 0 <= amount < 32;\r\n ensures Word32(LeftShift(x, amount));\r\n ensures forall i {:trigger IntBit_spec(i, LeftShift(x, amount))} :: 32 - amount <= i < 32 ==> IntBit_spec(i, LeftShift(x, amount)) == false;\r\n ensures forall i {:trigger IntBit_spec(i, LeftShift(x, amount))} :: 0 <= i < 32 - amount ==> IntBit_spec(i, LeftShift(x, amount)) == IntBit_spec(i + amount, x);\r\n\r\nstatic function{:axiom} Add32(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(Add32(x, y));\r\n ensures Add32(x, y) == (x + y) % 0x100000000;\r\n\r\nstatic function{:axiom} Sub32(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(Sub32(x, y));\r\n ensures Sub32(x, y) == (x - y) % 0x100000000;\r\n\r\nstatic function{:axiom} Mul32(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(Mul32(x, y));\r\n ensures Mul32(x, y) == (x * y) % 0x100000000;\r\n\r\nstatic function{:axiom} Div32(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n requires y != 0;\r\n ensures Word32(Div32(x, y));\r\n ensures Div32(x, y) == (x / y) % 0x100000000;\r\n\r\nstatic function{:axiom} Mod32(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n requires y != 0;\r\n ensures Word32(Mod32(x, y));\r\n ensures Mod32(x, y) == (x / y) % 0x100000000;\r\n\r\n//-//////////////////////////////////////////////////////////////\r\n//- Versions with bodies\r\n//-//////////////////////////////////////////////////////////////\r\n\r\n/*\r\nstatic function BitwiseNot(x:int) : int\r\n requires Word32(x);\r\n //-ensures Word32(BitwiseNot(x));\r\n{\r\n BitwiseNot_helper(x, 32)\r\n}\r\n\r\nstatic function BitwiseNot_helper(x:int, bits:int) : int\r\n{\r\n if bits <= 0 then 0\r\n else 2*BitwiseNot_helper(x, bits - 1) + (1 - (x % 2))\r\n}\r\n\r\nstatic function BitwiseAnd(x:int, y:int) : int\r\n requires Word32(x);\r\n requires Word32(y);\r\n //-ensures Word32(BitwiseAnd(x, y));\r\n{\r\n BitwiseAnd_helper(x, y, 32)\r\n}\r\n\r\nstatic function BitwiseAnd_helper(x:int, y:int, bits:int) : int\r\n{\r\n if bits <= 0 then 0\r\n else 2*BitwiseAnd_helper(x, y, bits - 1) + if (x % 2) == 1 && (y % 2) == 1 then 1 else 0 \r\n}\r\n*/\r\n\r\n\r\n/*\r\nstatic function BitwiseNot(x:int) : int\r\n requires Word32(x);\r\n ensures Word32(BitwiseNot(x));\r\n{\r\n BEBitSeqToInt(BitwiseNot_helper(x, 32))\r\n}\r\n\r\nstatic function BitwiseNot_helper(x:int, bits:int) : seq\r\n{\r\n if bits <= 0 then []\r\n else BitwiseNot_helper(x, bits - 1) + [(1 - BEWordToBitSeq(x)[bits-1])]\r\n}\r\n*/\r\n\r\n/*\r\nstatic function BitwiseNot(x:int) : int\r\n requires Word32(x);\r\n ensures Word32(BitwiseNot(x));\r\n{\r\n var z :| Word32(z) && forall i :: 0 <= i < 32 ==>\r\n BEWordToBitSeq(z)[i] == 1 - BEWordToBitSeq(x)[i];\r\n z\r\n}\r\n\r\nstatic function BitwiseAnd(x:int, y:int) : int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(BitwiseAnd(x, y));\r\n{\r\n var z :| Word32(z) && forall i :: 0 <= i < 32 ==> \r\n BEWordToBitSeq(z)[i] == if BEWordToBitSeq(x)[i] == 1 && BEWordToBitSeq(y)[i] == 1 then 1 else 0;\r\n z\r\n}\r\n\r\nstatic function BitwiseXor(x:int, y:int) : int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(BitwiseXor(x, y));\r\n{\r\n var z :| Word32(z) && forall i :: 0 <= i < 32 ==> \r\n BEWordToBitSeq(z)[i] == if BEWordToBitSeq(x)[i] != BEWordToBitSeq(y)[i] then 1 else 0;\r\n z\r\n}\r\n\r\nstatic function RotateRight(x:int, amount:int) : int\r\n requires Word32(x);\r\n requires 0 <= amount < 32;\r\n ensures Word32(RotateRight(x, amount));\r\n{\r\n var z :| Word32(z) && forall i :: 0 <= i < 32 ==> \r\n BEWordToBitSeq(z) == BEWordToBitSeq(x)[32-amount..] + BEWordToBitSeq(x)[..32-amount];\r\n z\r\n}\r\n\r\nstatic function RotateLeft(x:int, amount:int):int\r\n requires Word32(x);\r\n requires 0 <= amount < 32;\r\n ensures Word32(RotateLeft(x, amount));\r\n{\r\n var z :| Word32(z) && forall i :: 0 <= i < 32 ==> \r\n BEWordToBitSeq(z) == BEWordToBitSeq(x)[amount..] + BEWordToBitSeq(x)[..amount];\r\n z\r\n}\r\n\r\nstatic function RightShift(x:int, amount:int) : int\r\n requires Word32(x);\r\n requires 0 <= amount < 32;\r\n ensures Word32(RightShift(x, amount));\r\n{\r\n var z :| Word32(z) && forall i :: 0 <= i < 32 ==> \r\n BEWordToBitSeq(z) == RepeatDigit(0, amount) + BEWordToBitSeq(x)[..32-amount];\r\n z\r\n}\r\n\r\nstatic function LeftShift(x:int, amount:int):int\r\n requires Word32(x);\r\n requires 0 <= amount < 32;\r\n ensures Word32(LeftShift(x, amount));\r\n{\r\n var z :| Word32(z) && forall i :: 0 <= i < 32 ==> \r\n BEWordToBitSeq(z) == BEWordToBitSeq(x)[amount..] + RepeatDigit(0, amount);\r\n z\r\n}\r\n\r\nstatic function Add32(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(Add32(x, y));\r\n{\r\n (x + y) % 0x100000000\r\n}\r\n\r\n*/\r\n\r\n/*\r\n//- Undefined. Mapped to Boogie's word32\r\nstatic function{:imported} word32(x:int):bool\r\nstatic lemma{:imported} lemma_word32(x:int)\r\n ensures word32(x) <==> 0 <= x < 0x100000000;\r\n\r\nstatic function{:imported} mod0x100000000(x:int):int\r\nstatic lemma{:imported} lemma_mod0x100000000(x:int)\r\n ensures mod0x100000000(x) == x % 0x100000000;\r\n\r\nstatic function{:imported} IntBit_spec(index:int, n:int):bool\r\nstatic lemma{:imported} lemma_IntBit_spec(index:int, n:int)\r\n ensures IntBit_spec(index, n) == if (index > 0) then IntBit_spec(index - 1, n / 2) else n % 2 != 0;\r\n\r\nstatic method{:imported} method_Mul(x:int, y:int) returns(r:int)\r\n ensures r == x * y;\r\n\r\nstatic method{:imported} method_Div(x:int, y:int) returns(r:int)\r\n requires y != 0;\r\n ensures r == x / y;\r\n\r\nstatic method{:imported} method_Mod(x:int, y:int) returns(r:int)\r\n requires y != 0;\r\n ensures r == x % y;\r\n\r\nstatic function method{:imported} asm_Add(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n ensures word32(asm_Add(x, y));\r\n ensures asm_Add(x, y) == mod0x100000000(x + y);\r\n\r\nstatic function method{:imported} asm_Sub(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n ensures word32(asm_Sub(x, y));\r\n ensures asm_Sub(x, y) == mod0x100000000(x - y);\r\n\r\nstatic function method{:imported} asm_Mul(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n ensures word32(asm_Mul(x, y));\r\n ensures asm_Mul(x, y) == mod0x100000000(x * y);\r\n\r\nstatic function method{:imported} asm_Div(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n requires y > 0;\r\n ensures word32(asm_Div(x, y));\r\n ensures asm_Div(x, y) == mod0x100000000(x * y);\r\n\r\nstatic function method{:imported} asm_Mod(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n requires y > 0;\r\n ensures word32(asm_Mod(x, y));\r\n ensures asm_Mod(x, y) == x % y;\r\n\r\nstatic function method{:imported} asm_LeftShift(x:int, amount:int):int\r\n requires word32(x);\r\n requires 0 <= amount < 32;\r\n ensures word32(asm_LeftShift(x, amount));\r\n ensures forall i {:trigger IntBit_spec(i, asm_LeftShift(x, amount))} :: 0 <= i < amount ==> IntBit_spec(i, asm_LeftShift(x, amount)) == false;\r\n ensures forall i {:trigger IntBit_spec(i, asm_LeftShift(x, amount))} :: amount <= i < 32 ==> IntBit_spec(i, asm_LeftShift(x, amount)) == IntBit_spec(i - amount, x);\r\n\r\nstatic function method{:imported} asm_RightShift(x:int, amount:int):int\r\n requires word32(x);\r\n requires 0 <= amount < 32;\r\n ensures word32(asm_RightShift(x, amount));\r\n ensures forall i {:trigger IntBit_spec(i, asm_RightShift(x, amount))} :: 0 <= i < 32 - amount ==> IntBit_spec(i, asm_RightShift(x, amount)) == IntBit_spec(i + amount, x);\r\n ensures forall i {:trigger IntBit_spec(i, asm_RightShift(x, amount))} :: 32 - amount <= i < 32 ==> IntBit_spec(i, asm_RightShift(x, amount)) == false;\r\n\r\nstatic function method{:imported} asm_RotateLeft(x:int, amount:int):int\r\n requires word32(x);\r\n requires 0 <= amount < 32;\r\n ensures word32(asm_RotateLeft(x, amount));\r\n ensures forall i {:trigger IntBit_spec(i, asm_RotateLeft(x, amount))} :: 0 <= i < amount ==> IntBit_spec(i, asm_RotateLeft(x, amount)) == IntBit_spec(i + 32 - amount, x);\r\n ensures forall i {:trigger IntBit_spec(i, asm_RotateLeft(x, amount))} :: amount <= i < 32 ==> IntBit_spec(i, asm_RotateLeft(x, amount)) == IntBit_spec(i - amount, x);\r\n\r\nstatic function method{:imported} asm_RotateRight(x:int, amount:int):int\r\n requires word32(x);\r\n requires 0 <= amount < 32;\r\n ensures word32(asm_RotateRight(x, amount));\r\n ensures forall i {:trigger IntBit_spec(i, asm_RotateRight(x, amount))} :: 0 <= i < 32 - amount ==> IntBit_spec(i, asm_RotateRight(x, amount)) == IntBit_spec(i + amount, x);\r\n ensures forall i {:trigger IntBit_spec(i, asm_RotateRight(x, amount))} :: 32 - amount <= i < 32 ==> IntBit_spec(i, asm_RotateRight(x, amount)) == IntBit_spec(i + amount-32, x);\r\n\r\nstatic function method{:imported} asm_BitwiseNot(x:int):int\r\n requires word32(x);\r\n ensures word32(asm_BitwiseNot(x));\r\n ensures forall i {:trigger IntBit_spec(i, asm_BitwiseNot(x))} :: 0 <= i < 32 ==> IntBit_spec(i, asm_BitwiseNot(x)) == !IntBit_spec(i, x);\r\n\r\nstatic function method{:imported} asm_BitwiseAnd(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n ensures word32(asm_BitwiseAnd(x, y));\r\n ensures forall i {:trigger IntBit_spec(i, asm_BitwiseAnd(x, y))} :: 0 <= i < 32 ==> IntBit_spec(i, asm_BitwiseAnd(x, y)) == (IntBit_spec(i, x) && IntBit_spec(i, y));\r\n\r\nstatic function method{:imported} asm_BitwiseOr(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n ensures word32(asm_BitwiseOr(x, y));\r\n ensures forall i {:trigger IntBit_spec(i, asm_BitwiseOr(x, y))} :: 0 <= i < 32 ==> IntBit_spec(i, asm_BitwiseOr(x, y)) == (IntBit_spec(i, x) || IntBit_spec(i, y));\r\n\r\nstatic function method{:imported} asm_BitwiseXor(x:int, y:int):int\r\n requires word32(x);\r\n requires word32(y);\r\n ensures word32(asm_BitwiseXor(x, y));\r\n ensures forall i {:trigger IntBit_spec(i, asm_BitwiseXor(x, y))} :: 0 <= i < 32 ==> IntBit_spec(i, asm_BitwiseXor(x, y)) == (IntBit_spec(i, x) != IntBit_spec(i, y));\r\n\r\n*/\r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/CPU/assembly_premium.i.dfy", "content": "//-\r\ninclude \"../../Libraries/Util/bytes_and_words.s.dfy\"\r\ninclude \"../../Libraries/Util/be_sequences.s.dfy\"\r\ninclude \"../../Libraries/Util/integer_sequences_premium.i.dfy\"\r\ninclude \"assembly.i.dfy\"\r\n\r\n//-////////////////////////////////////////////////////////////\r\n//- Upscale wrappers around the basic assembly instructions\r\n//- that Boogie exposes via assembly.i.dfy\r\n//-////////////////////////////////////////////////////////////\r\n\r\n//-///////////////// Helpers ////////////////////////////////\r\n\r\nstatic lemma lemma_word32_Word32()\r\n ensures forall x:int {:trigger word32(x)} :: word32(x) == Word32(x);\r\n{\r\n forall x:int\r\n ensures word32(x) == Word32(x);\r\n {\r\n lemma_word32(x);\r\n lemma_power2_32();\r\n }\r\n}\r\n\r\nstatic lemma lemma_IntBit_is_BEWordToBitSeq()\r\n ensures forall x, i :: Word32(x) && 0 <= i < 32 ==> (IntBit(i, x) <==> (BEWordToBitSeq_premium(x)[i] == 1));\r\n ensures forall x, i :: Word32(x) && 0 <= i < 32 ==> (!IntBit(i, x) <==> (BEWordToBitSeq_premium(x)[i] == 0));\r\n{\r\n forall x, i | Word32(x) && 0 <= i < 32 \r\n ensures IntBit(i, x) <==> (BEWordToBitSeq_premium(x)[i] == 1);\r\n ensures !IntBit(i, x) <==> (BEWordToBitSeq_premium(x)[i] == 0);\r\n {\r\n lemma_IntBit(i, x);\r\n lemma_IntBit_is_BEWordToBitSeq_specific(i, x);\r\n }\r\n}\r\n\r\nstatic lemma lemma_IntBit_is_IntBit_spec()\r\n ensures forall x, i :: Word32(x) && 0 <= i < 32 ==> IntBit(i, x) == IntBit_spec(i, x);\r\n{\r\n lemma_IntBit_is_BEWordToBitSeq();\r\n}\r\n\r\nstatic lemma lemma_IntBit_is_BEWordToBitSeq_specific(index:int, x:int)\r\n requires 0 <= index < 32;\r\n requires Word32(x);\r\n ensures IntBit(index, x) <== (BEWordToBitSeq_premium(x)[index] == 1);\r\n ensures IntBit(index, x) ==> (BEWordToBitSeq_premium(x)[index] == 1);\r\n decreases 32 - index;\r\n{\r\n lemma_IntBit(index, x);\r\n lemma_word32(x);\r\n lemma_2toX();\r\n \r\n calc {\r\n BEWordToBitSeq_premium(x);\r\n BEIntToDigitSeq(power2(1), 32, x);\r\n { reveal_power2(); } \r\n BEIntToDigitSeq(2, 32, x);\r\n BEIntToDigitSeq_private(2, 32, x);\r\n { reveal_BEIntToDigitSeq_private(); }\r\n BEIntToDigitSeq_private(2, 32-1, x/2) + [ x % 2];\r\n }\r\n\r\n if (index == 31) {\r\n lemma_2toX();\r\n calc {\r\n power(2, 31);\r\n { lemma_power2_is_power_2_general(); }\r\n power2(31);\r\n { lemma_power2_adds(24, 7); lemma_power2_adds(3, 4); reveal_power2(); }\r\n 0x80000000;\r\n }\r\n\r\n lemma_BEIntToDigitSeq_private_properties(2, 31, x/2);\r\n } else {\r\n lemma_IntBit_is_BEWordToBitSeq_specific(index + 1, x/2);\r\n\r\n assert IntBit(index, x) == IntBit(index + 1, x/2);\r\n assert IntBit(index + 1, x/2) ==> BEWordToBitSeq_premium(x/2)[index+1] == 1;\r\n calc {\r\n BEWordToBitSeq_premium(x/2)[index+1];\r\n BEIntToDigitSeq_private(power2(1), 32, x/2)[index+1];\r\n { lemma_power2_1_is_2(); }\r\n BEIntToDigitSeq_private(2, 32, x/2)[index+1];\r\n { lemma_index_shift(index, x); }\r\n BEIntToDigitSeq_private(2, 32-1, x/2)[index];\r\n BEWordToBitSeq_premium(x)[index];\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_index_shift(index:int, x:int) \r\n requires 0 <= index < 31;\r\n requires Word32(x);\r\n ensures |BEIntToDigitSeq_private(2, 32, x/2)| == 32; //- To assuage function precondition below\r\n ensures |BEIntToDigitSeq_private(2, 32-1, x/2)| == 31; //- To assuage function precondition below\r\n ensures BEIntToDigitSeq_private(2, 32, x/2)[index+1] ==\r\n BEIntToDigitSeq_private(2, 32-1, x/2)[index];\r\n{\r\n reveal_power2();\r\n var y := x/2;\r\n assert y < power2(31);\r\n\r\n lemma_power2_is_power_2(31);\r\n lemma_power2_increases(31,32);\r\n lemma_power2_is_power_2(32);\r\n\r\n lemma_BEIntToDigitSeq_private_properties(2, 32, y);\r\n assert |BEIntToDigitSeq_private(2, 32, x/2)| == 32;\r\n\r\n lemma_BEIntToDigitSeq_private_properties(2, 31, y);\r\n assert |BEIntToDigitSeq_private(2, 32-1, x/2)| == 31;\r\n\r\n\r\n\r\n calc {\r\n BEIntToDigitSeq_private(2, 32, y);\r\n BEIntToDigitSeq_private(power2(1), 32, y);\r\n {\r\n lemma_mul_is_mul_boogie(1,31);\r\n lemma_mul_is_mul_boogie(1,32);\r\n lemma_BEIntToDigitSeq_private_chop(1, 32, 31, y);\r\n }\r\n BEIntToDigitSeq_private(power2(1), 32-31, y/power2(1*31)) + BEIntToDigitSeq_private(power2(1), 31, y%power2(1*31));\r\n { lemma_small_mod(y, power2(31)); }\r\n BEIntToDigitSeq_private(power2(1), 32-31, y/power2(1*31)) + BEIntToDigitSeq_private(2, 31, y);\r\n { lemma_small_div(); }\r\n BEIntToDigitSeq_private(2, 1, 0) + BEIntToDigitSeq_private(2, 31, y);\r\n {\r\n reveal_BEIntToDigitSeq_private();\r\n lemma_small_div();\r\n lemma_small_mod(0, 2);\r\n }\r\n [0] + BEIntToDigitSeq_private(2, 31, y);\r\n }\r\n assert BEIntToDigitSeq_private(2, 32, y)[index+1] == BEIntToDigitSeq_private(2, 31, y)[index];\r\n}\r\n\r\nstatic lemma lemma_bits_match_implies_ints_match_general()\r\n ensures forall x, y :: Word32(x) && Word32(y) && (forall i :: 0 <= i < 32 ==> IntBit(i, x) == IntBit(i, y))\r\n ==> x == y;\r\n{\r\n forall x, y | Word32(x) && Word32(y) && (forall i :: 0 <= i < 32 ==> IntBit(i, x) == IntBit(i, y))\r\n ensures x == y;\r\n {\r\n lemma_bits_match_implies_ints_match(x, y);\r\n }\r\n}\r\n\r\n\r\nstatic lemma lemma_bits_match_implies_ints_match(x:int, y:int) \r\n requires Word32(x) && Word32(y);\r\n requires forall i :: 0 <= i < 32 ==> IntBit(i, x) == IntBit(i, y);\r\n ensures x == y;\r\n{\r\n var xb := BEWordToBitSeq_premium(x);\r\n var yb := BEWordToBitSeq_premium(y);\r\n\r\n assert |xb| == |yb| == 32;\r\n forall i | 0 <= i < 32 \r\n ensures xb[i] == yb[i];\r\n {\r\n calc {\r\n xb[i] == 1;\r\n { lemma_IntBit_is_BEWordToBitSeq(); }\r\n IntBit(i, x);\r\n IntBit(i, y);\r\n { lemma_IntBit_is_BEWordToBitSeq(); }\r\n yb[i] == 1;\r\n }\r\n }\r\n\r\n assert xb == yb;\r\n\r\n calc {\r\n x;\r\n BEBitSeqToInt(xb);\r\n BEBitSeqToInt(yb);\r\n y;\r\n }\r\n}\r\n\r\n\r\n//-static lemma lemma_bits_match_implies_ints_match_helper(x:int, y:int, index:int) \r\n//- requires Word32(x) && Word32(y);\r\n//- requires forall i :: 0 <= i < 32 ==> IntBit(i, x) == IntBit(i, y);\r\n \r\n\r\n//-///////////////// Methods ////////////////////////////////\r\n\r\nstatic method{:instruction \"out@EDX\", \"inout@EAX\", \"in\"}{:strict_operands} Method_Mul(x:int, y:int) returns(hi:int, r:int)\r\n ensures r == x * y;\r\n{\r\n lemma_mul_is_mul_boogie(x, y);\r\n hi, r := method_Mul(x, y);\r\n}\r\n\r\nstatic method{:instruction \"inout@EDX\", \"inout@EAX\", \"in\"}{:strict_operands} Method_DivMod(zero:int, x:int, y:int) returns(m:int, r:int)\r\n requires zero == 0;\r\n requires y != 0;\r\n ensures r == x / y;\r\n ensures y > 0 ==> m == x % y;\r\n{\r\n lemma_div_is_div_boogie(x, y);\r\n if (y > 0) { lemma_mod_is_mod_boogie(x, y); }\r\n m, r := method_DivMod(zero, x, y);\r\n}\r\n\r\nstatic function method{:instruction \"inout\", \"in\"} Asm_Add(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(Asm_Add(x, y));\r\n ensures Asm_Add(x, y) == mod0x100000000(x + y);\r\n ensures Asm_Add(x, y) == Add32(x, y);\r\n{\r\n lemma_word32_Word32();\r\n lemma_mod0x100000000(x+y);\r\n asm_Add(x, y)\r\n}\r\n\r\nstatic function method{:instruction \"inout\", \"in\"} Asm_Sub(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(Asm_Sub(x, y));\r\n ensures Asm_Sub(x, y) == mod0x100000000(x - y);\r\n{\r\n lemma_word32_Word32();\r\n lemma_mod0x100000000(x-y);\r\n asm_Sub(x, y)\r\n}\r\n\r\nstatic function method Asm_Mul(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(Asm_Mul(x, y));\r\n ensures Asm_Mul(x, y) == mod0x100000000(x*y);\r\n{\r\n lemma_word32_Word32();\r\n lemma_mod0x100000000(x*y);\r\n asm_Mul(x, y)\r\n}\r\n\r\nstatic function method Asm_Div(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n requires y > 0;\r\n ensures Word32(Asm_Div(x, y));\r\n ensures Asm_Div(x, y) == mod0x100000000(x/y);\r\n{\r\n lemma_word32_Word32();\r\n lemma_mod0x100000000(x/y);\r\n asm_Div(x, y)\r\n}\r\n\r\nstatic function method Asm_Mod(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n requires y > 0;\r\n ensures Word32(Asm_Mod(x, y));\r\n ensures Asm_Mod(x, y) == x % y;\r\n{\r\n lemma_word32_Word32();\r\n lemma_mod0x100000000(x%y);\r\n asm_Mod(x, y)\r\n}\r\n\r\nstatic function method{:instruction \"inout\", \"in@ECX\"} Asm_LeftShift(x:int, amount:int):int\r\n requires Word32(x);\r\n requires 0 <= amount < 32;\r\n ensures Word32(Asm_LeftShift(x, amount));\r\n ensures |BEWordToBitSeq_premium(x)| == 32;\r\n ensures BEWordToBitSeq_premium(Asm_LeftShift(x, amount)) == BEWordToBitSeq_premium(x)[amount..] + RepeatDigit_premium(0, amount);\r\n ensures Asm_LeftShift(x, amount) == LeftShift(x, amount); //- Fulfills spec\r\n{\r\n lemma_word32_Word32();\r\n lemma_IntBit_is_BEWordToBitSeq();\r\n lemma_bits_match_implies_ints_match_general();\r\n lemma_IntBit_is_IntBit_spec();\r\n asm_LeftShift(x, amount)\r\n}\r\n\r\nstatic function method{:instruction \"inout\", \"in@ECX\"} Asm_RightShift(x:int, amount:int):int\r\n requires Word32(x);\r\n requires 0 <= amount < 32;\r\n ensures Word32(Asm_RightShift(x, amount));\r\n ensures |BEWordToBitSeq(x)| == 32;\r\n ensures BEWordToBitSeq_premium(Asm_RightShift(x, amount)) == RepeatDigit_premium(0, amount) + BEWordToBitSeq_premium(x)[..32-amount];\r\n ensures Asm_RightShift(x, amount) == RightShift(x, amount); //- Fulfills spec\r\n{\r\n lemma_word32_Word32();\r\n lemma_IntBit_is_BEWordToBitSeq();\r\n lemma_bits_match_implies_ints_match_general();\r\n lemma_IntBit_is_IntBit_spec();\r\n asm_RightShift(x, amount)\r\n}\r\n\r\nstatic function method{:instruction \"inout\", \"in@ECX\"} Asm_RotateLeft(x:int, amount:int):int\r\n requires Word32(x);\r\n requires 0 <= amount < 32;\r\n ensures Word32(Asm_RotateLeft(x, amount));\r\n ensures |BEWordToBitSeq(x)| == 32;\r\n ensures BEWordToBitSeq_premium(Asm_RotateLeft(x, amount)) == BEWordToBitSeq_premium(x)[amount..] + BEWordToBitSeq_premium(x)[..amount];\r\n ensures Asm_RotateLeft(x, amount) == RotateLeft(x, amount); //- Fulfills spec\r\n{\r\n lemma_word32_Word32();\r\n lemma_IntBit_is_BEWordToBitSeq();\r\n lemma_bits_match_implies_ints_match_general();\r\n lemma_IntBit_is_IntBit_spec();\r\n asm_RotateLeft(x, amount)\r\n}\r\n\r\nstatic function method{:instruction \"inout\", \"in@ECX\"} Asm_RotateRight(x:int, amount:int):int\r\n requires Word32(x);\r\n requires 0 <= amount < 32;\r\n ensures Word32(Asm_RotateRight(x, amount));\r\n ensures |BEWordToBitSeq(x)| == 32;\r\n ensures BEWordToBitSeq_premium(Asm_RotateRight(x, amount)) == BEWordToBitSeq_premium(x)[32-amount..] + BEWordToBitSeq_premium(x)[..32-amount];\r\n ensures Asm_RotateRight(x, amount) == RotateRight(x, amount); //- Fulfills spec\r\n{\r\n lemma_word32_Word32();\r\n lemma_IntBit_is_BEWordToBitSeq();\r\n lemma_bits_match_implies_ints_match_general();\r\n lemma_IntBit_is_IntBit_spec();\r\n asm_RotateRight(x, amount)\r\n}\r\n\r\nstatic function method{:instruction \"inout\"} Asm_BitwiseNot(x:int):int\r\n requires Word32(x);\r\n ensures Word32(Asm_BitwiseNot(x));\r\n ensures |BEWordToBitSeq_premium(x)| == |BEWordToBitSeq_premium(Asm_BitwiseNot(x))| == 32;\r\n ensures forall i {:trigger BEWordToBitSeq(Asm_BitwiseNot(x))[i]} :: 0 <= i < 32 ==>\r\n BEWordToBitSeq_premium(Asm_BitwiseNot(x))[i] == 1 - BEWordToBitSeq_premium(x)[i];\r\n ensures Asm_BitwiseNot(x) == BitwiseNot(x); //- Fulfills spec\r\n{\r\n lemma_word32_Word32();\r\n lemma_IntBit_is_BEWordToBitSeq();\r\n lemma_bits_match_implies_ints_match_general();\r\n lemma_IntBit_is_IntBit_spec();\r\n asm_BitwiseNot(x)\r\n}\r\n\r\nstatic lemma lemma_bitwise_and_commutative(x:int, y:int)\r\n requires Word32(x) && Word32(y);\r\n ensures Asm_BitwiseAnd(x, y) == Asm_BitwiseAnd(y, x);\r\n{\r\n forall i | 0 <= i < 32 \r\n //-ensures Asm_BitwiseAnd(x, y) == Asm_BitwiseAnd(y, x);\r\n ensures BEWordToBitSeq_premium(Asm_BitwiseAnd(x, y))[i] == BEWordToBitSeq_premium(Asm_BitwiseAnd(y, x))[i];\r\n {\r\n calc {\r\n BEWordToBitSeq_premium(Asm_BitwiseAnd(x, y))[i];\r\n if (BEWordToBitSeq_premium(x)[i] == 1 && BEWordToBitSeq_premium(y)[i] == 1) then 1 else 0;\r\n BEWordToBitSeq_premium(Asm_BitwiseAnd(y, x))[i];\r\n }\r\n }\r\n assert BEWordToBitSeq_premium(Asm_BitwiseAnd(x, y)) == BEWordToBitSeq_premium(Asm_BitwiseAnd(y, x));\r\n}\r\n\r\nstatic function method{:instruction \"inout\", \"in\"} Asm_BitwiseAnd(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(Asm_BitwiseAnd(x, y));\r\n ensures |BEWordToBitSeq_premium(x)| == |BEWordToBitSeq_premium(y)| == |BEWordToBitSeq_premium(Asm_BitwiseAnd(x, y))| == 32;\r\n ensures forall i {:trigger BEWordToBitSeq(Asm_BitwiseAnd(x, y))[i]} :: 0 <= i < 32 ==>\r\n BEWordToBitSeq_premium(Asm_BitwiseAnd(x, y))[i] == if (BEWordToBitSeq_premium(x)[i] == 1 && BEWordToBitSeq_premium(y)[i] == 1) then 1 else 0;\r\n ensures Asm_BitwiseAnd(x, y) == BitwiseAnd(x, y); //- Fulfills spec\r\n{\r\n lemma_word32_Word32();\r\n lemma_IntBit_is_BEWordToBitSeq();\r\n lemma_bits_match_implies_ints_match_general();\r\n lemma_IntBit_is_IntBit_spec();\r\n asm_BitwiseAnd(x,y)\r\n}\r\n\r\nstatic function method{:instruction \"inout\", \"in\"} Asm_BitwiseOr(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(Asm_BitwiseOr(x, y));\r\n ensures |BEWordToBitSeq_premium(x)| == |BEWordToBitSeq_premium(y)| == |BEWordToBitSeq_premium(Asm_BitwiseOr(x, y))| == 32;\r\n ensures forall i {:trigger BEWordToBitSeq(Asm_BitwiseOr(x, y))[i]} :: 0 <= i < 32 ==>\r\n BEWordToBitSeq_premium(Asm_BitwiseOr(x, y))[i] == if (BEWordToBitSeq_premium(x)[i] == 1 || BEWordToBitSeq_premium(y)[i] == 1) then 1 else 0;\r\n ensures Asm_BitwiseOr(x, y) == BitwiseOr(x, y);\r\n{\r\n lemma_word32_Word32();\r\n lemma_IntBit_is_BEWordToBitSeq();\r\n lemma_bits_match_implies_ints_match_general();\r\n lemma_IntBit_is_IntBit_spec();\r\n asm_BitwiseOr(x, y)\r\n}\r\n\r\nstatic function method{:instruction \"inout\", \"in\"} Asm_BitwiseXor(x:int, y:int):int\r\n requires Word32(x);\r\n requires Word32(y);\r\n ensures Word32(Asm_BitwiseXor(x, y));\r\n ensures |BEWordToBitSeq_premium(x)| == |BEWordToBitSeq_premium(y)| == |BEWordToBitSeq_premium(Asm_BitwiseXor(x, y))| == 32;\r\n ensures forall i {:trigger BEWordToBitSeq(Asm_BitwiseXor(x, y))[i]} :: 0 <= i < 32 ==>\r\n BEWordToBitSeq_premium(Asm_BitwiseXor(x, y))[i] == if (BEWordToBitSeq_premium(x)[i] != BEWordToBitSeq_premium(y)[i]) then 1 else 0;\r\n ensures Asm_BitwiseXor(x, y) == BitwiseXor(x, y); //- Fulfills spec\r\n{\r\n lemma_word32_Word32();\r\n lemma_IntBit_is_BEWordToBitSeq();\r\n lemma_bits_match_implies_ints_match_general();\r\n lemma_IntBit_is_IntBit_spec();\r\n asm_BitwiseXor(x, y)\r\n}\r\n\r\nstatic method Asm_Rdtsc() returns (high:int, low:int)\r\n ensures Word32(high);\r\n ensures Word32(low);\r\n{\r\n lemma_word32_Word32();\r\n high, low := asm_Rdtsc();\r\n}\r\n\r\nmethod Asm_declassify_result(concrete:int, ghost result:int) returns (pub_result:int)\r\n requires Word32(concrete);\r\n requires relation(declassified(left(result), right(result), left(concrete), right(concrete)));\r\n ensures pub_result == result;\r\n ensures public(pub_result);\r\n{\r\n lemma_word32_Word32();\r\n pub_result := asm_declassify_result(concrete, result);\r\n}\r\n\r\nstatic method GetBootloaderArgWord_premium(index:int) returns (word:int)\r\n requires 0 <= index < 256;\r\n ensures Word32(word);\r\n{\r\n lemma_word32_Word32();\r\n word := GetBootloaderArgWord(index);\r\n}\r\n\r\nstatic method GetBootloaderArgBytes(left:int, right:int) returns (s:seq)\r\n requires 0 <= left <= right < 256 * 4;\r\n requires left % 4 == 0;\r\n ensures IsByteSeqOfLen(s, right - left);\r\n{\r\n s := [];\r\n\r\n var cur := left;\r\n var done := false;\r\n while cur < right\r\n invariant !done ==> left <= cur <= right < 256 * 4;\r\n invariant cur % 4 == 0;\r\n invariant IsByteSeqOfLen(s, cur - left);\r\n {\r\n var word := GetBootloaderArgWord_premium(cur / 4);\r\n var bytes := BEWordToFourBytes_impl(word);\r\n var reverse_bytes := [bytes[3], bytes[2], bytes[1], bytes[0]];\r\n s := s + reverse_bytes;\r\n cur := cur + 4;\r\n if cur > right {\r\n done := true;\r\n }\r\n }\r\n\r\n if cur > right\r\n {\r\n s := s[0..right - left];\r\n }\r\n\r\n assert IsByteSeqOfLen(s, right - left);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/IO/io_mem.i.dfy", "content": "include \"io_mem.s.dfy\"\r\n\r\n/******************************************************\r\n * Connection to Verve for interacting with IO memory *\r\n ******************************************************/\r\n\r\nmethod {:decl} IoMemAddrRead(r_addr:int) returns (r_val:int)\r\n requires IoMemPerm.IoReadAddr?;\r\n requires IoMemPerm.r_addr == r_addr;\r\n modifies this`IoMemPerm;\r\n ensures IoMemPerm.Null?;\r\n ensures r_val == old(IoMemPerm).r_val;\r\n\r\nmethod {:decl} IoMemAddrWrite(w_addr:int, w_val:int)\r\n requires IoMemPerm.IoWriteAddr?;\r\n requires IoMemPerm.w_addr == w_addr;\r\n requires IoMemPerm.w_val == w_val;\r\n modifies this`IoMemPerm;\r\n ensures IoMemPerm.Null?;\r\n \r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/IO/io_mem.s.dfy", "content": "\r\n/***********************************************************\r\n * Spec for granting permission to interact with IO memory *\r\n ***********************************************************/\r\n\r\ndatatype {:imported} IoMemPerm_t = Null() | IoReadAddr(r_addr:int, r_val:int) | IoWriteAddr(w_addr:int, w_val:int);\r\n\r\nghost var {:imported} {:readonly} IoMemPerm:IoMemPerm_t;\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/IO/pci.i.dfy", "content": "//-\r\ninclude \"../../Libraries/Util/relational.s.dfy\"\r\ninclude \"../../Libraries/Util/bytes_and_words.s.dfy\"\r\n\r\nfunction {:opaque} mod4(n:int):int { n % 4 }\r\nfunction {:opaque} mod16(n:int):int { n % 16 }\r\nfunction {:opaque} mod128(n:int):int { n % 128 }\r\nfunction {:opaque} div16(n:int):int { n / 16 }\r\n\r\n/**************************************************\r\n * Spec for interacting with the network card\r\n **************************************************/\r\n\r\n//-function intel_NIC_device_vendor_id() : int { 0x107c8086 }\r\n\r\n//- Track whether we've initialized the network card\r\n//- TODO: dafnycc support for: var net_init:bool;\r\n\r\nfunction IsValidPciId(id:int):bool\r\nfunction PciMemAddr(id:int):int //- Region where the device's PCI config registers are mapped into memory\r\nfunction PciMemSize(id:int):int\r\nfunction DeviceMemAddr() : int //- Region where devices are allowed to read/write\r\nfunction DeviceMemSize() : int\r\n\r\n/****************************************\r\n Connections to Verve's PCI interface\r\n ****************************************/\r\nmethod {:decl} NetworkPciMemSetup() returns (id:int, size:int, addr:int, device_mem_addr:int)\r\n ensures Word32(size) && Word32(addr) && Word32(device_mem_addr);\r\n ensures IsValidPciId(id);\r\n ensures size == PciMemSize(id);\r\n ensures addr == PciMemAddr(id);\r\n ensures Word32(addr + size);\r\n ensures Word32(DeviceMemAddr() + DeviceMemSize());\r\n ensures DeviceMemAddr() == device_mem_addr;\r\n ensures mod16(device_mem_addr) == 0;\r\n ensures DeviceMemSize() > 0x204004;\r\n ensures public(id);\r\n ensures public(size);\r\n ensures public(addr);\r\n ensures public(device_mem_addr);\r\n\r\nmethod {:decl} PciMemStore(id:int, dst:int, val:int)\r\n requires IsValidPciId(id);\r\n requires PciMemAddr(id) <= dst && dst + 4 <= PciMemAddr(id) + PciMemSize(id);\r\n requires Word32(val);\r\n requires public(id);\r\n requires public(dst);\r\n requires public(val);\r\n\r\nmethod {:decl} PciMemLoad(id:int, src:int) returns (val:int)\r\n requires IsValidPciId(id);\r\n requires PciMemAddr(id) <= src && src + 4 <= PciMemAddr(id) + PciMemSize(id);\r\n ensures Word32(val);\r\n requires public(id);\r\n requires public(src);\r\n ensures public(val);\r\n\r\nmethod {:decl} {:instruction \"mem\", \"in\"} {:modifies_io} DeviceMemStore(dst:int, val:int)\r\n requires DeviceMemAddr() <= dst && dst + 4 <= DeviceMemAddr() + DeviceMemSize();\r\n requires Word32(dst);\r\n requires Word32(val);\r\n requires public(dst);\r\n requires public(val);\r\n\r\nmethod {:decl} {:instruction \"mem\", \"out\"} {:modifies_io} DeviceMemLoad(src:int) returns (val:int)\r\n requires DeviceMemAddr() <= src && src + 4 <= DeviceMemAddr() + DeviceMemSize();\r\n requires Word32(src);\r\n requires public(src);\r\n ensures Word32(val);\r\n ensures public(val);\r\n\r\nstatic method {:decl} debug_print(loc:int, val:int)\r\n requires 0 <= loc <= 160 - 16;\r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/Network/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/Network/Intel/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/Network/Intel/driver.i.dfy", "content": "//-\r\ninclude \"../../../Libraries/base.s.dfy\"\r\ninclude \"../../../Libraries/Util/relational.s.dfy\"\r\ninclude \"../../CPU/assembly_premium.i.dfy\"\r\ninclude \"../../../Libraries/Math/bit_vector_lemmas_premium.i.dfy\"\r\ninclude \"../../../Libraries/Util/repeat_digit.i.dfy\"\r\ninclude \"../../../Libraries/Util/integer_sequences.i.dfy\"\r\ninclude \"../../../Libraries/Math/div.i.dfy\"\r\ninclude \"../../../Libraries/Util/word_bits.i.dfy\"\r\ninclude \"../../IO/pci.i.dfy\"\r\n\r\n//-\r\n//- Driver for Intel Network Card 82541PI.\r\n//- Sofware Developer's Manual labelled 317453006EN.PDF, Revision 4.0.\r\n//-\r\n//- Implementation Notes:\r\n//-\r\n//- - We don't support VLAN mode.\r\n//- - We don't prefetch or write-back transmit descriptors.\r\n//- - We leave the transmit absolute delay function (see 13.4.44) disabled.\r\n//- - We don't support large segment offload.\r\n//- - We use the \"legacy\" format of transmit/receive descriptors.\r\n//-\r\n\r\n//-\r\n//- Register addresses relative to the card's base address.\r\n//- See Table 13-2 on pages 219-222.\r\n//-\r\n//- Note: all registers should be accessed as 32-bit words.\r\n//-\r\n\r\n//- General Registers:\r\nfunction method{:dafnycc_inline} register_ctrl(addr:int):int { addr + 0x0000 }\r\nfunction method{:dafnycc_inline} register_status(addr:int):int { addr + 0x0008 }\r\nfunction method{:dafnycc_inline} register_ctrl_ext(addr:int):int { addr + 0x0018 }\r\nfunction method{:dafnycc_inline} register_fcal(addr:int):int { addr + 0x0028 }\r\nfunction method{:dafnycc_inline} register_fcah(addr:int):int { addr + 0x002c }\r\nfunction method{:dafnycc_inline} register_fct(addr:int):int { addr + 0x0030 }\r\nfunction method{:dafnycc_inline} register_fcttv(addr:int):int { addr + 0x0170 }\r\n\r\n//- Receive Registers:\r\nfunction method{:dafnycc_inline} register_rx_ctrl(addr:int):int { addr + 0x0100 }\r\nfunction method{:dafnycc_inline} register_rx_desc_base_lo(addr:int):int { addr + 0x2800 }\r\nfunction method{:dafnycc_inline} register_rx_desc_base_hi(addr:int):int { addr + 0x2804 }\r\nfunction method{:dafnycc_inline} register_rx_desc_length(addr:int):int { addr + 0x2808 }\r\nfunction method{:dafnycc_inline} register_rx_desc_head(addr:int):int { addr + 0x2810 }\r\nfunction method{:dafnycc_inline} register_rx_desc_tail(addr:int):int { addr + 0x2818 }\r\nfunction method{:dafnycc_inline} register_rx_delay_timer(addr:int):int { addr + 0x2820 }\r\nfunction method{:dafnycc_inline} register_rx_int_abs_timer(addr:int):int { addr + 0x282c }\r\nfunction method{:dafnycc_inline} register_rx_cksum_ctrl(addr:int):int { addr + 0x5000 }\r\nfunction method{:dafnycc_inline} register_rx_mcast_table(addr:int):int { addr + 0x5200 }\r\nfunction method{:dafnycc_inline} register_rx_addrN_lo(addr:int):int { addr + 0x5400 }\r\nfunction method{:dafnycc_inline} register_rx_addrN_hi(addr:int):int { addr + 0x5404 }\r\n\r\n//- Transmit Registers:\r\nfunction method{:dafnycc_inline} register_tx_ctrl(addr:int):int { addr + 0x0400 }\r\nfunction method{:dafnycc_inline} register_tx_ipg(addr:int):int { addr + 0x0410 }\r\nfunction method{:dafnycc_inline} register_tx_desc_base_lo(addr:int):int { addr + 0x3800 }\r\nfunction method{:dafnycc_inline} register_tx_desc_base_hi(addr:int):int { addr + 0x3804 }\r\nfunction method{:dafnycc_inline} register_tx_desc_length(addr:int):int { addr + 0x3808 }\r\nfunction method{:dafnycc_inline} register_tx_desc_head(addr:int):int { addr + 0x3810 }\r\nfunction method{:dafnycc_inline} register_tx_desc_tail(addr:int):int { addr + 0x3818 }\r\n\r\n//-\r\n//- Register-related Constants:\r\n\r\n//-\r\n\r\n//- Device Control Register (register_ctrl). See Section 13.4.1.\r\n//- Device Reset Bit:\r\nfunction method{:dafnycc_inline} ctrl_reset():int { 0x04000000 } //- i.e. Bit 26.\r\n//- PHY Reset Bit:\r\nfunction method{:dafnycc_inline} ctrl_phy_reset():int { 0x80000000 } //- i.e. Bit 31.\r\n\r\n//- Receive Control Register (register_rx_ctrl). See Section 13.4.22.\r\n//- Receiver Enable Bit:\r\nfunction method{:dafnycc_inline} ctrl_rx_enable():int { 2 } //- i.e. Bit 1.\r\n\r\n\r\n//- Transmit Control Register (register_tx_ctrl). See Section 13.4.33.\r\n//- Transmit Enable Bit:\r\nfunction method{:dafnycc_inline} ctrl_tx_enable():int { 2 } //- i.e. Bit 1.\r\n//- Pad Short Packets Bit:\r\nfunction method{:dafnycc_inline} tx_pad_short_packets():int { 8 } //- i.e. Bit 3.\r\n\r\n//- Transmit Inter-Packet Gap Register (register_tx_ipg). See Section 13.4.34.\r\n//- Default Value:\r\nfunction method{:dafnycc_inline} tx_ipg_default():int { 10 }\r\n\r\n//- Receive Delay Timer (register_rx_delay_timer). See Section 13.4.30.\r\n\r\n//- Default Value:\r\nfunction method{:dafnycc_inline} rxdelaytimers_rx_delay_timer():int { 100 } //- ~100us.\r\n\r\n//- Receive Interrupt Absolute Delay Timer(register_rx_int_abs_timer). See Section 13.4.31.\r\n//- Default Value:\r\n\r\nfunction method{:dafnycc_inline} rxdelaytimers_rx_absolute_timer():int { 1000 } //- ~1000us.\r\n\r\n//-\r\n//- Ring Buffer Configuration Values.\r\n//-\r\nfunction method{:dafnycc_inline} bytes_per_descriptor():int { 16 }\r\nfunction method{:dafnycc_inline} num_descriptors():int { 512 }\r\n//-function method{:dafnycc_inline} total_desc_bytes():int { num_descriptors() * bytes_per_descriptor() }\r\nfunction method{:dafnycc_inline} total_desc_bytes():int { 512 * bytes_per_descriptor() }\r\nfunction method{:dafnycc_inline} bytes_per_buffer():int { 2 * 1024 }\r\n//-function method{:dafnycc_inline} total_buffer_bytes():int { num_descriptors() * bytes_per_buffer() }\r\nfunction method{:dafnycc_inline} total_buffer_bytes():int { 512 * bytes_per_buffer() }\r\n\r\n//-\r\n//- Hard code the MAC address to 90:e2:ba:4f:0c:5b.\r\n//- Hard code the MAC address to 00:1b:21:31:8e:d9.\r\n\r\n\r\n//-\r\nfunction method my_ethernet_addr() : ethernet_addr\r\n{\r\n ethernet_addr_builder( [ 0x90, 0xe2, 0xba, 0x4f, 0x0c, 0x5b] ) \r\n//- ethernet_addr_builder( [ 0x00, 0x1b, 0x21, 0x31, 0x8e, 0xd9] )\r\n \r\n}\r\n\r\n//-\r\n//- Define what an \"ethernet_addr\" is.\r\n//-\r\ndatatype ethernet_addr = ethernet_addr_builder(bytes:seq);\r\nfunction valid_ethernet_addr(addr:ethernet_addr) : bool\r\n{\r\n IsByteSeqOfLen(addr.bytes, 6)\r\n}\r\n\r\n/****************************************\r\n Ring buffers used for tx/rx\r\n ****************************************/\r\ndatatype network_state = network_state_build(rx_rb:rx_ring_buffer, tx_rb:tx_ring_buffer);\r\ndatatype rx_ring_buffer = rx_ring_buffer_build(rb:ring_buffer);\r\ndatatype tx_ring_buffer = tx_ring_buffer_build(rb:ring_buffer);\r\ndatatype ring_buffer = ring_buffer_build(base:int, size:int, head:int, tail:int, id:int, reg_addr:int);\r\n\r\nfunction valid_ring_buffer(rb:ring_buffer):bool\r\n requires num_descriptors() == 512;\r\n{\r\n mod16(rb.base) == 0 && rb.base >= 0 &&\r\n Word32(rb.base + total_desc_bytes() + total_buffer_bytes()) && //- Include space for descriptors and the buffers they point at\r\n DeviceMemAddr() <= rb.base && rb.base + total_desc_bytes() + total_buffer_bytes() + 4 <= DeviceMemAddr() + DeviceMemSize() &&\r\n DeviceMemSize() >= 0x204000 &&\r\n mod128(rb.size) == 0 && 128 <= rb.size < power2(19) &&\r\n div16(rb.size) == 512 &&\r\n Word32(rb.base + rb.size) &&\r\n 0 <= rb.head < power2(16) && rb.base + 16 * rb.head <= rb.base + rb.size - 16 && //- Assuming head and tail are measured in descriptors (16B each)\r\n 0 <= rb.tail < power2(16) && rb.base + 16 * rb.tail <= rb.base + rb.size - 16 && //- Assuming head and tail are measured in descriptors (16B each)\r\n rb.reg_addr == PciMemAddr(rb.id) && rb.reg_addr >= 0 && Word32(rb.reg_addr + 128 * 1024) &&\r\n IsValidPciId(rb.id) && PciMemSize(rb.id) >= 128 * 1024 \r\n}\r\n\r\nfunction valid_network_state(state:network_state):bool\r\n{\r\n valid_ring_buffer(state.rx_rb.rb) && valid_ring_buffer(state.tx_rb.rb) \r\n}\r\n\r\n\r\n/*\r\n * Device Memory layout plan:\r\n * Verve gives us, via NetworkPciMemSetup, an address in device memory.\r\n * That memory is untrusted, but accessible to devices. We will lay it out as follows:\r\n * +1M\r\n * Rx Buffers x 512 (2K each)\r\n * +8K\r\n * Rx Ring Descriptors x 512 (16B each)\r\n * +1M\r\n * Tx Buffers x 512 (2K each)\r\n * +8K\r\n * Tx Ring Descriptors x 512 (16B each)\r\n * dev_addr->\r\n *\r\n * Thus, we need 2M + 16K bytes = 0x204000.\r\n */\r\n\r\n\r\n//-lemma init_network_card_lemma1(addr:int)\r\n//- //-requires mod4(addr) == 0;\r\n//- //-ensures mod4(register_fcal(addr)) == 0;\r\n//- //-ensures mod4(register_fcah(addr)) == 0;\r\n//- //-ensures mod4(register_fct(addr)) == 0;\r\n//- //-ensures mod4(register_fcttv(addr)) == 0;\r\n//- //-ensures mod4(register_rx_addrN_lo(addr)) == 0;\r\n//- //-ensures mod4(register_rx_addrN_hi(addr)) == 0;\r\n//- //-ensures mod4(register_rx_desc_base_lo(addr)) == 0;\r\n//- //-ensures mod4(register_rx_desc_base_hi(addr)) == 0;\r\n//- //-ensures mod4(register_rx_desc_length(addr)) == 0;\r\n//- //-ensures mod4(register_rx_desc_head(addr)) == 0;\r\n//- //-ensures mod4(register_rx_desc_tail(addr)) == 0;\r\n//- //-ensures mod4(register_rx_ctrl(addr)) == 0;\r\n//- //-ensures mod4(register_rx_delay_timer(addr)) == 0;\r\n//- //-ensures mod4(register_rx_int_abs_timer(addr)) == 0;\r\n//- //-ensures mod4(register_rx_cksum_ctrl(addr)) == 0;\r\n//- //-ensures mod4(register_tx_desc_base_lo(addr)) == 0;\r\n//- //-ensures mod4(register_tx_desc_base_hi(addr)) == 0;\r\n//- //-ensures mod4(register_tx_desc_length(addr)) == 0;\r\n//- //-ensures mod4(register_tx_desc_head(addr)) == 0;\r\n//- //-ensures mod4(register_tx_desc_tail(addr)) == 0;\r\n//- //-ensures mod4(register_tx_ctrl(addr)) == 0;\r\n//- //-ensures mod4(register_tx_ipg(addr)) == 0;\r\n//-{\r\n//- reveal_mod4();\r\n//- reveal_mod16();\r\n//- reveal_mod128();\r\n//- reveal_div16();\r\n//-}\r\n\r\nlemma init_network_card_lemma2a(dev_addr:int)\r\n requires mod16(dev_addr) == 0;\r\n requires Word32(dev_addr); //- HACK to avoid timeout\r\n ensures mod4(dev_addr) == 0;\r\n{\r\n reveal_mod4();\r\n reveal_mod16();\r\n}\r\n\r\nlemma init_network_card_lemma2b(dev_addr:int)\r\n requires mod4(dev_addr) == 0;\r\n ensures mod4(dev_addr + 512 * 16 + 512 * 2 * 1024) == 0;\r\n{\r\n reveal_mod4();\r\n}\r\n\r\nlemma init_network_card_lemma2c(dev_addr:int)\r\n requires mod16(dev_addr) == 0;\r\n ensures mod16(dev_addr + 512 * 16 + 512 * 2 * 1024) == 0;\r\n{\r\n reveal_mod16();\r\n}\r\n\r\nlemma init_network_card_lemma3()\r\n ensures mod128(total_desc_bytes()) == 0;\r\n ensures div16(total_desc_bytes()) == 512;\r\n{\r\n reveal_mod4();\r\n reveal_mod16();\r\n reveal_mod128();\r\n reveal_div16();\r\n}\r\n\r\n//-lemma init_network_card_lemma4(addr:int, mta_register:int)\r\n//- //-requires mod4(addr) == 0;\r\n//- //-ensures mod4(register_rx_mcast_table(addr) + mta_register * 4) == 0;\r\n//-{\r\n//- reveal_mod4();\r\n//- reveal_mod16();\r\n//- reveal_mod128();\r\n//- reveal_div16();\r\n//-}\r\n\r\n//-\r\n//- Debug print a register value.\r\n//-\r\n//-method debug_print_register(loc:int, id:int, reg:int)\r\n//- requires IsValidPciId(id);\r\n//- requires PciMemAddr(id) <= reg && reg + 4 <= PciMemAddr(id) + PciMemSize(id);\r\n//- requires 0 <= loc <= 160 - 16;\r\n//- requires public(id);\r\n//- requires public(reg);\r\n//-{\r\n//- var reg_dbg := PciMemLoad(id, reg);\r\n//- debug_print(loc, reg_dbg);\r\n//-}\r\n\r\n//-\r\n//- Busy-wait something in the neighborhood of the requested amount of time.\r\n//-\r\nmethod delay(microseconds:int)\r\n requires 0 <= microseconds < 0xEFFFFFFF;\r\n{\r\n var ms := microseconds;\r\n while (ms > 0) \r\n decreases ms;\r\n {\r\n var count := 3 * 1000; //- 3K ops on a 3 GHz machine should be ~1 us.\r\n while (count > 0)\r\n decreases count;\r\n {\r\n count := count - 1;\r\n }\r\n ms := ms - 1;\r\n }\r\n}\r\n\r\n\r\n//-\r\n//- Card Initialization Routines.\r\n//-\r\nmethod init_network_card() returns (success:bool, state:network_state)\r\n ensures success ==> valid_network_state(state);\r\n ensures public(success);\r\n ensures public(state);\r\n{\r\n var id, size, addr, dev_addr := NetworkPciMemSetup();\r\n\r\n//- debug_print(0x00, 0xbeefcafe);\r\n//- debug_print(0x00, addr);\r\n//- debug_print(0x12, size);\r\n//- debug_print(0x24, dev_addr);\r\n\r\n var rx_ring_buff:rx_ring_buffer;\r\n var tx_ring_buff:tx_ring_buffer;\r\n\r\n if (size < 128 * 1024) {\r\n //-\r\n //- We expect the Intel NIC to get 128K worth of PCI config space mapped into memory.\r\n //- So this is bad.\r\n //-\r\n success := false;\r\n var buff := ring_buffer_build(0, 0, 0, 0, 0, 0); //- TODO: dafnycc: had to add this line because dafnycc doesn't handle returning uninitialized variables.\r\n rx_ring_buff := rx_ring_buffer_build(buff); \r\n tx_ring_buff := tx_ring_buffer_build(buff);\r\n } else {\r\n assert 512 == num_descriptors(); \r\n lemma_2toX();\r\n\r\n //\r\n \r\n //\r\n\r\n init_network_card_step1(id, addr);\r\n init_network_card_step2(id, addr);\r\n rx_ring_buff := init_network_card_step2rx(id, addr, size, dev_addr);\r\n\r\n init_network_card_step3(id, addr, size);\r\n tx_ring_buff := init_network_card_step3tx(id, addr, size, dev_addr);\r\n\r\n init_network_card_step4(id, addr, size);\r\n \r\n success := true;\r\n }\r\n\r\n state := network_state_build(rx_ring_buff, tx_ring_buff);\r\n}\r\n\r\nmethod init_network_card_step1a_stop_everything(id:int, addr:int)\r\n requires Word32(addr);\r\n requires IsValidPciId(id);\r\n requires addr == PciMemAddr(id);\r\n requires PciMemSize(id) >= 128 * 1024;\r\n requires public(id);\r\n requires public(addr);\r\n{\r\n init_network_card_lemma3();\r\n lemma_2toX();\r\n\r\n //-\r\n //- Stop everything.\r\n \r\n //-\r\n PciMemStore(id, register_rx_ctrl(addr), 0);\r\n PciMemStore(id, register_tx_ctrl(addr), tx_pad_short_packets());\r\n\r\n //- Allow pending PCI transactions to complete.\r\n delay(10 * 1000);\r\n}\r\n\r\n\r\nmethod init_network_card_step1b_reset(id:int, addr:int)\r\n requires Word32(addr);\r\n requires IsValidPciId(id);\r\n requires addr == PciMemAddr(id);\r\n requires PciMemSize(id) >= 128 * 1024;\r\n requires public(id);\r\n requires public(addr);\r\n{\r\n lemma_2toX();\r\n //-\r\n //- Reset the card.\r\n \r\n //-\r\n var ctrl_reg := PciMemLoad(id, register_ctrl(addr));\r\n //-debug_print(0x48, ctrl_reg); \r\n var temp_reg := ctrl_reg; \r\n temp_reg := Asm_BitwiseOr(temp_reg, ctrl_phy_reset());\r\n //-debug_print(0x48, temp_reg);\r\n PciMemStore(id, register_ctrl(addr), temp_reg);\r\n delay(5 * 1000);\r\n\r\n temp_reg := Asm_BitwiseOr(ctrl_reg, ctrl_reset());\r\n PciMemStore(id, register_ctrl(addr), temp_reg);\r\n //-debug_print(0x48, temp_reg);\r\n\r\n //- Wait 3us (or more) for the board to quiesce.\r\n delay(20 * 1000);\r\n \r\n \r\n delay(1 * 1000 * 1000);\r\n}\r\n\r\n\r\nmethod init_network_card_step1c_set_ctrl(id:int, addr:int)\r\n requires Word32(addr);\r\n requires IsValidPciId(id);\r\n requires addr == PciMemAddr(id);\r\n requires PciMemSize(id) >= 128 * 1024;\r\n requires public(id);\r\n requires public(addr);\r\n{\r\n lemma_2toX();\r\n //- Set the device control register to values we want:\r\n //- (See Table 13-3 in section 13.4.1)\r\n //- Bit 0: Full-Duplex (Must also set the Force-Duplex Bit (Bit 12)).\r\n //- Bit 5: Auto-Speed Detection Enable (ASDE).\r\n //- Bit 6: Set Link Up (SLU).\r\n //- Bit 12: Force-Duplex Bit.\r\n PciMemStore(id, register_ctrl(addr), 0x1061); \r\n\r\n //- Wait for the autonegotiation to complete.\r\n \r\n \r\n var negotiated := false;\r\n var ctrl:int := 0;\r\n var count := 0;\r\n while (!negotiated)\r\n decreases *;\r\n invariant public(id);\r\n invariant public(addr);\r\n invariant public(negotiated);\r\n {\r\n //-debug_print(0x90, count);\r\n ctrl := PciMemLoad(id, register_ctrl(addr));\r\n var done := Asm_BitwiseAnd(ctrl, ctrl_reset());\r\n if (done == 0) {\r\n negotiated := true;\r\n }\r\n count := count + 1;\r\n }\r\n}\r\n\r\nmethod init_network_card_step1d_disable_flow_ctrl(id:int, addr:int)\r\n requires Word32(addr);\r\n requires IsValidPciId(id);\r\n requires addr == PciMemAddr(id);\r\n requires PciMemSize(id) >= 128 * 1024;\r\n requires public(id);\r\n requires public(addr);\r\n{\r\n //-\r\n //- Turn off flow control.\r\n //- See Section 14.3, General Configuration.\r\n //-\r\n PciMemStore(id, register_fcal(addr), 0);\r\n PciMemStore(id, register_fcah(addr), 0);\r\n PciMemStore(id, register_fct(addr), 0);\r\n PciMemStore(id, register_fcttv(addr), 0);\r\n}\r\n\r\n\r\nmethod init_network_card_step1(id:int, addr:int)\r\n requires Word32(addr);\r\n requires IsValidPciId(id);\r\n requires addr == PciMemAddr(id);\r\n requires PciMemSize(id) >= 128 * 1024;\r\n requires public(id);\r\n requires public(addr);\r\n{\r\n init_network_card_step1a_stop_everything(id, addr);\r\n init_network_card_step1b_reset(id, addr);\r\n init_network_card_step1c_set_ctrl(id, addr);\r\n init_network_card_step1d_disable_flow_ctrl(id, addr);\r\n}\r\n\r\n\r\n\r\n//-\r\n//- Clear the multicast table.\r\n//-\r\nmethod clear_multicast(id:int, addr:int)\r\n requires Word32(addr);\r\n requires IsValidPciId(id);\r\n requires addr == PciMemAddr(id);\r\n requires PciMemSize(id) >= 128 * 1024;\r\n requires public(id);\r\n requires public(addr);\r\n{\r\n var mta_entry := 0;\r\n while (mta_entry < 128)\r\n invariant mta_entry >= 0;\r\n invariant public(id);\r\n invariant public(addr);\r\n invariant public(mta_entry);\r\n {\r\n PciMemStore(id, register_rx_mcast_table(addr) + mta_entry * 4, 0);\r\n mta_entry := mta_entry + 1;\r\n }\r\n}\r\n\r\nmethod init_network_card_step2(id:int, addr:int)\r\n requires Word32(addr);\r\n requires IsValidPciId(id);\r\n requires addr == PciMemAddr(id);\r\n requires PciMemSize(id) >= 128 * 1024;\r\n requires public(id);\r\n requires public(addr);\r\n{\r\n //-init_network_card_lemma1(addr);\r\n init_network_card_lemma3();\r\n lemma_2toX();\r\n\r\n //-\r\n //- Setup the MAC address.\r\n \r\n //-\r\n var mac_addr := my_ethernet_addr();\r\n var addr_lo := mac_addr.bytes[0] + 256 * mac_addr.bytes[1] + 256 * 256 * mac_addr.bytes[2] + 256 * 256 * 256 * mac_addr.bytes[3]; //-little_endian_bytes_to_word(mac_addr.bytes[0..4]);\r\n var addr_hi := mac_addr.bytes[4] + 256 * mac_addr.bytes[5]; //-little_endian_bytes_to_word(mac_addr.bytes[4..6]);\r\n PciMemStore(id, register_rx_addrN_lo(addr), addr_lo);\r\n var temp_reg := addr_hi;\r\n temp_reg := Asm_BitwiseOr(temp_reg, 0x80000000); //- Set the Address Valid bit\r\n PciMemStore(id, register_rx_addrN_hi(addr), temp_reg);\r\n\r\n clear_multicast(id, addr);\r\n}\r\n\r\nmethod init_network_card_step2rx(id:int, addr:int, size:int, dev_addr:int)\r\n returns (rx_ring_buff:rx_ring_buffer)\r\n requires Word32(size) && Word32(addr) && Word32(dev_addr);\r\n requires IsValidPciId(id);\r\n requires size == PciMemSize(id);\r\n requires addr == PciMemAddr(id);\r\n requires Word32(addr + size);\r\n requires Word32(DeviceMemAddr() + DeviceMemSize());\r\n requires size >= 128 * 1024;\r\n requires DeviceMemAddr() == dev_addr;\r\n requires mod16(dev_addr) == 0;\r\n requires DeviceMemSize() > 0x204004;\r\n requires public(id);\r\n requires public(addr);\r\n requires public(dev_addr);\r\n ensures valid_ring_buffer(rx_ring_buff.rb);\r\n ensures public(rx_ring_buff);\r\n{\r\n //-init_network_card_lemma1(addr);\r\n init_network_card_lemma2a(dev_addr);\r\n init_network_card_lemma2b(dev_addr);\r\n init_network_card_lemma2c(dev_addr);\r\n init_network_card_lemma3();\r\n lemma_2toX();\r\n\r\n //-\r\n //- Setup Receive Descriptor Queue.\r\n //- See Section 3.2.6.\r\n //-\r\n\r\n var rx_desc_base_lo := dev_addr + total_desc_bytes() + total_buffer_bytes();\r\n var rx_desc_len := total_desc_bytes(); \r\n\r\n assert(rx_desc_base_lo == dev_addr + 512 * 16 + 512 * 2 * 1024);\r\n\r\n //- assert rx_desc_base_lo % 16 == 0;\r\n //- assert rx_desc_len % 128 == 0 && 128 <= rx_desc_len < power2(19);\r\n //- assert (512 * 16 + 512 * 2 * 1024) % 4 == 0;\r\n //- assert rx_desc_base_lo % 4 == dev_addr % 4;\r\n\r\n //-\r\n //- The head pointer references the next empty descriptor to be filled with an incoming packet.\r\n //- Once the hardware has written a packet to that descriptor, it advances the head pointer.\r\n //- The tail pointer references one descriptor past the last one the hardware is allowed to write to.\r\n //- Once the driver has processed the packet in the (tail + 1) descriptor, it advances the tail pointer.\r\n //-\r\n //- When the head pointer is advanced to equal the tail pointer, there are no free (empty) descriptors available\r\n //- for the hardware to fill, and the hardware will stop adding packets to the circular queue until the driver\r\n //- processes some packets and advances the tail pointer.\r\n //-\r\n //- When the tail pointer is advanced to the point where it is one less than the head pointer, then all the\r\n //- receive descriptors are empty and are waiting for the hardware to fill them with packets.\r\n //- This is the initial state we establish below.\r\n //-\r\n var rx_desc_head := 1;\r\n var rx_desc_tail := 0;\r\n\r\n assert rx_desc_head < power2(16);\r\n assert rx_desc_tail < power2(16);\r\n\r\n PciMemStore(id, register_rx_desc_base_lo(addr), rx_desc_base_lo);\r\n PciMemStore(id, register_rx_desc_base_hi(addr), 0);\r\n PciMemStore(id, register_rx_desc_length(addr), rx_desc_len);\r\n PciMemStore(id, register_rx_desc_head(addr), rx_desc_head); \r\n PciMemStore(id, register_rx_desc_tail(addr), rx_desc_tail);\r\n\r\n //-\r\n //- Create a full set of empty descriptors and buffers.\r\n //-\r\n BuildDescriptors(rx_desc_base_lo, false);\r\n\r\n rx_ring_buff := rx_ring_buffer_build(ring_buffer_build(rx_desc_base_lo, rx_desc_len, rx_desc_head, rx_desc_tail, id, addr));\r\n}\r\n\r\nmethod init_network_card_step3(id:int, addr:int, size:int)\r\n requires Word32(size) && Word32(addr);\r\n requires IsValidPciId(id);\r\n requires size == PciMemSize(id);\r\n requires addr == PciMemAddr(id);\r\n requires Word32(addr + size);\r\n requires Word32(DeviceMemAddr() + DeviceMemSize());\r\n requires size >= 128 * 1024;\r\n requires public(id);\r\n requires public(addr);\r\n{\r\n //-init_network_card_lemma1(addr);\r\n init_network_card_lemma3();\r\n lemma_2toX();\r\n\r\n //-\r\n //- Set Receiever Control flags (See Table 13-67 in Section 13.4.22):\r\n //- Bits 8-9: Receive Descriptor Minimum Threshold Size set to 1/4 of RDLEN (01).\r\n //- Bit 26: Strip Ethernet CRC from incoming packet.\r\n //-\r\n //- Note: We leave all other bits at their initial zero value. This means:\r\n //- - Receiver Enable is not set (we enable this in final step).\r\n //- - We do not store bad packets.\r\n //- - Unicast Promiscuous is disabled.\r\n //- - Multicast Promiscuous is disabled.\r\n //- - We discard packets longer than 1522 bytes.\r\n //- - Loopback is off.\r\n //- - Multicast Offset - bits 47:36 are used in the lookup.\r\n //- - We ignore broadcast packets.\r\n //- - Receive Buffer Size is set to 2048 bytes.\r\n //- - Various VLAN things (Filter, Canonical Form Indicator) are disabled.\r\n //- - We don't Discard Pause Frames (used by flow control, if it's enabled).\r\n //-\r\n assert bytes_per_buffer() == 2 * 1024; //- Ensure we match the Receive Buffer Size flag.\r\n PciMemStore(id, register_rx_ctrl(addr), 0x04000100);\r\n//- PciMemStore(id, register_rx_ctrl(addr), 0x04008118); //- Promiscuous everything.\r\n\r\n //-\r\n //- Setup the rx interrupt delay.\r\n //- TODO: Don't we have interrupts off? Why do this?\r\n //- TODO: Manual *strongly recommends* against using these fields.\r\n //-\r\n//- PciMemStore(id, register_rx_delay_timer(addr), rxdelaytimers_rx_delay_timer());\r\n//- PciMemStore(id, register_rx_int_abs_timer(addr), rxdelaytimers_rx_absolute_timer());\r\n\r\n //-\r\n //- Enable IP and TCP receive checksum calculation offloading.\r\n \r\n//- PciMemStore(id, register_rx_cksum_ctrl(addr), 0x00000700);\r\n //- Flags value above corresponds to:\r\n //- rxchecksum_ip_checksum_enable() | //- 1u << 8\r\n //- rxchecksum_tcp_checksum_enable() | //- 1u << 9\r\n //- rxchecksum_ip6_checksum_enable() )); //- 1u << 10\r\n}\r\n\r\nmethod init_network_card_step3tx(id:int, addr:int, size:int, dev_addr:int)\r\n returns (tx_ring_buff:tx_ring_buffer)\r\n requires Word32(size) && Word32(addr) && Word32(dev_addr);\r\n requires IsValidPciId(id);\r\n requires size == PciMemSize(id);\r\n requires addr == PciMemAddr(id);\r\n requires Word32(addr + size);\r\n requires Word32(DeviceMemAddr() + DeviceMemSize());\r\n requires size >= 128 * 1024;\r\n requires DeviceMemAddr() == dev_addr;\r\n requires mod16(dev_addr) == 0;\r\n requires DeviceMemSize() > 0x204000;\r\n requires public(id);\r\n requires public(addr);\r\n requires public(dev_addr);\r\n ensures valid_ring_buffer(tx_ring_buff.rb);\r\n ensures public(tx_ring_buff);\r\n{\r\n //-init_network_card_lemma1(addr);\r\n init_network_card_lemma2a(dev_addr);\r\n init_network_card_lemma2b(dev_addr);\r\n init_network_card_lemma2c(dev_addr);\r\n init_network_card_lemma3();\r\n lemma_2toX();\r\n\r\n //-debug_print(0x24, dev_addr);\r\n\r\n var tx_desc_base_lo := dev_addr;\r\n var tx_desc_len := total_desc_bytes();\r\n var tx_desc_head := 0;\r\n var tx_desc_tail := 0; //- tail == head ==> queue is empty (Sec. 3.4) ==> no packets to transmit.\r\n\r\n assert tx_desc_head < power2(16);\r\n assert tx_desc_tail < power2(16);\r\n\r\n PciMemStore(id, register_tx_desc_base_lo(addr), tx_desc_base_lo);\r\n PciMemStore(id, register_tx_desc_base_hi(addr), 0);\r\n PciMemStore(id, register_tx_desc_length(addr), tx_desc_len);\r\n PciMemStore(id, register_tx_desc_head(addr), tx_desc_head);\r\n PciMemStore(id, register_tx_desc_tail(addr), tx_desc_tail);\r\n \r\n //-\r\n //- Create a full set of empty descriptors and buffers.\r\n //-\r\n BuildDescriptors(tx_desc_base_lo, true);\r\n\r\n tx_ring_buff := tx_ring_buffer_build(ring_buffer_build(tx_desc_base_lo, tx_desc_len, tx_desc_head, tx_desc_tail, id, addr));\r\n}\r\n\r\nmethod init_network_card_step4(id:int, addr:int, size:int)\r\n requires Word32(size) && Word32(addr);\r\n requires IsValidPciId(id);\r\n requires size == PciMemSize(id);\r\n requires addr == PciMemAddr(id);\r\n requires Word32(addr + size);\r\n requires Word32(DeviceMemAddr() + DeviceMemSize());\r\n requires size >= 128 * 1024;\r\n requires public(id);\r\n requires public(addr);\r\n{\r\n //-init_network_card_lemma1(addr);\r\n init_network_card_lemma3();\r\n lemma_2toX();\r\n\r\n //-\r\n //- Set Transmit Control flags:\r\n //- Bit 3: Pad Short Packets to 64 bytes (including CRC).\r\n //- Bits 4-11: Collision Threshold set to 0xf. TODO: Only for half-duplex?\r\n //- Bits 12-21: Collision Distance set to 0x40.\r\n //-\r\n //- Note: We leave all other bits at their initial zero value. This means:\r\n //- - Transmit Enable is not zet (we enable this in final step).\r\n //- - Software XOFF Transmission is disabled.\r\n //- - Re-transmit on Late Collision is disabled (ignored for full-duplex).\r\n //-\r\n PciMemStore(id, register_tx_ctrl(addr), 0x000400F8);\r\n\r\n //- Setup Transmit Inter Frame Gap.\r\n PciMemStore(id, register_tx_ipg(addr), tx_ipg_default());\r\n\r\n //-\r\n //- Start receiving.\r\n //-\r\n var temp_reg := PciMemLoad(id, register_rx_ctrl(addr));\r\n temp_reg := Asm_BitwiseOr(temp_reg, ctrl_rx_enable());\r\n PciMemStore(id, register_rx_ctrl(addr), temp_reg);\r\n\r\n //-\r\n //- Start transmitting.\r\n //-\r\n temp_reg := PciMemLoad(id, register_tx_ctrl(addr));\r\n temp_reg := Asm_BitwiseOr(temp_reg, ctrl_tx_enable());\r\n PciMemStore(id, register_tx_ctrl(addr), temp_reg);\r\n\r\n //-debug_print_register(0x36, id, register_status(addr));\r\n}\r\n\r\n//-\r\n//- Setup a static set of descriptors pointing at a static set of buffers.\r\n//-\r\nmethod BuildDescriptors(BaseAddress:int, Transmit:bool)\r\n requires mod4(BaseAddress) == 0;\r\n requires num_descriptors() == 512;\r\n requires bytes_per_descriptor() == 16;\r\n requires bytes_per_buffer() == 2 * 1024;\r\n requires Word32(BaseAddress);\r\n requires Word32(BaseAddress + total_desc_bytes() + total_buffer_bytes());\r\n requires DeviceMemAddr() <= BaseAddress && BaseAddress + total_desc_bytes() + total_buffer_bytes() <= DeviceMemAddr() + DeviceMemSize();\r\n requires public(BaseAddress);\r\n requires public(Transmit);\r\n{\r\n var Index := 0;\r\n var StartingStatus := 0;\r\n\r\n //-\r\n //- For transmit descriptors, we initialize the DD bit in the Status field to 1.\r\n //- This mimics the \"transmission complete\" state (i.e. our code is free to use them).\r\n //- For receive descriptors, we initialize the DD bit in the Status field to 0.\r\n //- This is the state that the hardware expects to find them prior to using them.\r\n //-\r\n if (Transmit)\r\n {\r\n StartingStatus := 1; //- Set the DD bit.\r\n }\r\n \r\n while (Index < 512)\r\n invariant Index >= 0;\r\n invariant public(BaseAddress); \r\n invariant public(Index);\r\n invariant public(StartingStatus);\r\n {\r\n var Descriptor := BaseAddress + Index * 16;\r\n var Buffer := BaseAddress + total_desc_bytes() + Index * 2 * 1024;\r\n DeviceMemStore(Descriptor + 0, Buffer);\r\n DeviceMemStore(Descriptor + 4, 0);\r\n DeviceMemStore(Descriptor + 8, 0);\r\n DeviceMemStore(Descriptor + 12, StartingStatus);\r\n\r\n Index := Index + 1;\r\n }\r\n}\r\n\r\n//- Write out the packet to device memory.\r\nmethod write_out_packet(addr:int, ghost data_buffer:int, packet:seq)\r\n returns (final_addr:int)\r\n requires IsWordSeq(packet);\r\n requires addr == data_buffer;\r\n requires Word32(addr);\r\n requires Word32(addr + 4 * |packet|);\r\n requires DeviceMemAddr() <= addr && data_buffer + 4 * |packet| <= DeviceMemAddr() + DeviceMemSize();\r\n requires public(addr);\r\n requires public(packet);\r\n ensures final_addr == data_buffer + 4 * |packet|;\r\n{\r\n var i := 0;\r\n var local_addr := addr;\r\n if (|packet| > 0) {\r\n ghost var complete := false;\r\n while (i < |packet|)\r\n invariant i < |packet| ==> !complete;\r\n invariant !complete ==> 0 <= i < |packet|;\r\n invariant IsWordSeq(packet);\r\n invariant Word32(local_addr);\r\n invariant local_addr == data_buffer + 4 * i;\r\n //-invariant valid_ring_buffer(tx_buff);\r\n invariant !complete ==> DeviceMemAddr() <= local_addr && local_addr + 4 <= DeviceMemAddr() + DeviceMemSize();\r\n invariant complete ==> i == |packet|;\r\n invariant public(local_addr);\r\n invariant public(i);\r\n invariant public(packet);\r\n {\r\n DeviceMemStore(local_addr, packet[i]);\r\n local_addr := local_addr + 4;\r\n i := i + 1;\r\n complete := complete || (i == |packet|);\r\n }\r\n }\r\n\r\n final_addr := local_addr;\r\n}\r\n\r\n//-\r\n//- Reverse the byte-order in the given 32-bit word.\r\n//-\r\nmethod ByteSwapWord32(InWord:int)\r\n returns (OutWord:int)\r\n requires Word32(InWord);\r\n ensures Word32(OutWord);\r\n ensures relation(left(InWord) == right(InWord) ==> left(OutWord) == right(OutWord));\r\n{\r\n lemma_2toX();\r\n\r\n var ByteA := Asm_RightShift(Asm_BitwiseAnd(InWord, 0xff000000), 24);\r\n var ByteB := Asm_RightShift(Asm_BitwiseAnd(InWord, 0x00ff0000), 8);\r\n var ByteC := Asm_LeftShift(Asm_BitwiseAnd(InWord, 0x0000ff00), 8);\r\n var ByteD := Asm_LeftShift(Asm_BitwiseAnd(InWord, 0x000000ff), 24);\r\n\r\n OutWord := Asm_BitwiseOr(Asm_BitwiseOr(ByteA, ByteB), Asm_BitwiseOr(ByteC, ByteD));\r\n}\r\n\r\n//-\r\n//- Copy packet data to buffer.\r\n//-\r\nmethod CopyPacketToBuffer(BufferAddr:int, PacketData:seq)\r\n requires Word32(BufferAddr);\r\n requires IsByteSeq(PacketData);\r\n requires Word32(BufferAddr + |PacketData| + 4);\r\n requires DeviceMemAddr() <= BufferAddr;\r\n requires BufferAddr + |PacketData| + 4 <= DeviceMemAddr() + DeviceMemSize();\r\n requires public(BufferAddr);\r\n requires public(PacketData);\r\n{\r\n lemma_2toX();\r\n\r\n //-\r\n //- Convert the packet data byte sequence to a sequence of 32-bit words.\r\n //-\r\n var Words := BEByteSeqToWordSeqTailPadding(PacketData);\r\n\r\n var Index := 0;\r\n var WordAddr := BufferAddr;\r\n\r\n if (|Words| > 0) {\r\n ghost var Complete := false;\r\n\r\n //-\r\n //- Write the 32-bit words that comprise the packet data out to the buffer.\r\n //- We byte-swap the words in the process as BEByteSeqToWordSeqTailPadding gave\r\n //- us the opposite of what we need. \r\n //- \r\n while (Index < |Words|)\r\n invariant Index < |Words| ==> !Complete;\r\n invariant !Complete ==> 0 <= Index < |Words|;\r\n invariant IsWordSeq(Words);\r\n invariant Word32(WordAddr);\r\n invariant WordAddr == BufferAddr + 4 * Index;\r\n invariant !Complete ==> DeviceMemAddr() <= WordAddr && WordAddr + 4 <= DeviceMemAddr() + DeviceMemSize();\r\n invariant Complete ==> Index == |Words|;\r\n invariant public(Words);\r\n invariant public(Index);\r\n invariant public(WordAddr);\r\n {\r\n var Word := ByteSwapWord32(Words[Index]);\r\n DeviceMemStore(WordAddr, Word);\r\n WordAddr := WordAddr + 4;\r\n Index := Index + 1;\r\n Complete := Complete || (Index == |Words|);\r\n }\r\n }\r\n}\r\n\r\n//-\r\n//- Copy buffer contents to packet representation.\r\n//-\r\nmethod CopyBufferToPacket(BufferAddr:int, Length:int)\r\n returns (Success:bool, PacketData:seq)\r\n requires Word32(BufferAddr);\r\n requires DeviceMemAddr() <= BufferAddr;\r\n requires Word16(Length);\r\n requires Word32(BufferAddr + 2048 + 4);\r\n requires BufferAddr + 2048 + 4 <= DeviceMemAddr() + DeviceMemSize();\r\n requires public(BufferAddr);\r\n requires public(Length);\r\n ensures Success ==> IsByteSeq(PacketData);\r\n ensures Success ==> |PacketData| == Length;\r\n ensures public(PacketData);\r\n ensures public(Success);\r\n{\r\n reveal_mod4();\r\n reveal_mod16();\r\n reveal_mod128();\r\n reveal_div16();\r\n\r\n lemma_2toX();\r\n\r\n PacketData := [];\r\n\r\n //-\r\n //- Sanity-check the amount of data this is supposedly in this buffer.\r\n //- We use 2K buffers, so anything more than that doesn't make sense.\r\n //- We also protect ourselves against the hardware indicating it received a zero byte packet.\r\n //-\r\n if ((Length <= 0) || (Length > 2048))\r\n {\r\n Success := false;\r\n }\r\n else\r\n {\r\n //-\r\n //- Calculate the number of 32-bit words (containing valid data) in the buffer.\r\n //- Note that only some of the bytes in the last word of this count may contain valid data.\r\n //-\r\n var NumWords := ((Length - 1) / 4) + 1;\r\n assert 0 <= NumWords <= 512;\r\n\r\n //-\r\n //- Read in the packet data from the buffer.\r\n //-\r\n var Words := [];\r\n var Index := 0;\r\n var WordAddr := BufferAddr;\r\n\r\n ghost var Complete := false;\r\n while (Index < NumWords)\r\n invariant Index < NumWords ==> !Complete;\r\n invariant !Complete ==> 0 <= Index < NumWords;\r\n invariant IsWordSeq(Words);\r\n invariant Word32(WordAddr);\r\n//- invariant Word32(WordAddr) && WordAddr % 4 == 0;\r\n invariant WordAddr == BufferAddr + 4 * Index;\r\n invariant !Complete ==> DeviceMemAddr() <= WordAddr && WordAddr + 4 <= DeviceMemAddr() + DeviceMemSize();\r\n invariant Complete ==> Index == NumWords;\r\n invariant |Words| == Index;\r\n invariant 0 <= Index <= 512;\r\n invariant public(WordAddr);\r\n invariant public(Words);\r\n invariant public(Index);\r\n invariant public(NumWords);\r\n invariant public(Length);\r\n invariant public(Complete);\r\n {\r\n var Word := DeviceMemLoad(WordAddr);\r\n Word := ByteSwapWord32(Word);\r\n Words := Words + [Word];\r\n\r\n WordAddr := WordAddr + 4;\r\n Index := Index + 1;\r\n\r\n Complete := Complete || (Index == NumWords);\r\n }\r\n\r\n PacketData := BEWordSeqToByteSeq_impl(Words);\r\n PacketData := PacketData[0..Length];\r\n Success := true;\r\n }\r\n}\r\n\r\n\r\nmethod update_tx_descriptor(tx_rb:tx_ring_buffer, packet_size:int)\r\n requires valid_ring_buffer(tx_rb.rb);\r\n requires Word32(packet_size);\r\n requires public(tx_rb);\r\n requires public(packet_size);\r\n{\r\n lemma_2toX();\r\n //-\r\n //- Update the corresponding (legacy format) transmit descriptor.\r\n //- See Table 3-8 and 3-9 in Section 3.3.3.\r\n //-\r\n //- Bytes 0 to 7 of the transmit descriptor contain the address of its\r\n //- corresponding buffer, which we never change after initialization.\r\n //-\r\n //- Bytes 8 and 9 contain the length of the data to be sent.\r\n //- Byte 10 is the Checksum Offset, which we currently do not use.\r\n //- Byte 11 is the Command Field (See Section 3.3.3.1):\r\n //- Bit 0: Indicates this descriptor is the End Of Packet (EOP).\r\n //- Bit 1: Insert FCS/CRC field (IFCS). Valid only if EOP is set.\r\n //- Bit 2: Insert Checksum (IC). We currently do not set.\r\n //- Bit 3: Report Status (RS). Hardware sets Status DD bit when done.\r\n //- Bit 4: Only for 82544GC/CI, reserved bit for the 82541.\r\n //- Bit 5: Extention (DEXT). We write as 0 for legacy mode.\r\n //- Bit 6: VLAN Packet Enable (VLE). We currently do not set.\r\n //- Bit 7: Interrupt Delay Enable. We currently do not set.\r\n //- Byte 12 is the Status Field (bits 0-2, bits 3-7 are Reserved).\r\n //- Byte 13 is the Checksum Start Field, which we currently do not use.\r\n //- Bytes 14 and 15 is the Special Field (VLAN related, we do not use).\r\n //-\r\n //- We write 32 bits at a time, so we write bytes 8-11 in one operation,\r\n //- and 12-14 in another.\r\n //-\r\n var TailDesc := tx_rb.rb.base + 16 * tx_rb.rb.tail;\r\n//- debug_print(0x90, TailDesc); //- Debug.\r\n //-\r\n //- We set RS, IFCS, and EOP bits (i.e. 0xb) in the Command Field.\r\n //-\r\n var Temp := Asm_BitwiseOr(0x0b000000, packet_size);\r\n DeviceMemStore(TailDesc + 8, Temp); //- Bytes 8-11.\r\n DeviceMemStore(TailDesc + 12, 0); //- Bytes 12-15.\r\n}\r\n\r\n//-\r\n//- Before advancing the tail descriptor, make sure the hardware is done\r\n//- with the next entry.\r\n//-\r\nmethod wait_for_available_tx_buffer(tx_rb:tx_ring_buffer, NextIndex:int)\r\n requires valid_ring_buffer(tx_rb.rb);\r\n requires 0 <= NextIndex < 512;\r\n requires public(tx_rb);\r\n requires public(NextIndex);\r\n{\r\n lemma_2toX();\r\n var done := 0;\r\n while (done != 1)\r\n invariant valid_ring_buffer(tx_rb.rb);\r\n invariant public(tx_rb);\r\n invariant public(done);\r\n invariant public(NextIndex);\r\n decreases *;\r\n {\r\n var NextDescStatus := DeviceMemLoad(tx_rb.rb.base + 16 * NextIndex + 12);\r\n done := Asm_BitwiseAnd(NextDescStatus, 1); //- Check DD bit.\r\n }\r\n}\r\n\r\nmethod tx_cleanup(tx_rb:tx_ring_buffer, NextIndex:int)\r\n requires valid_ring_buffer(tx_rb.rb);\r\n requires 0 <= NextIndex < 512;\r\n requires public(tx_rb);\r\n requires public(NextIndex);\r\n{\r\n lemma_2toX();\r\n //- Clear out the status register. TODO: Why?\r\n DeviceMemStore(tx_rb.rb.base + 16 * NextIndex + 12, 0);\r\n\r\n //-\r\n //- Advance the tail pointer. This submits the descriptor pointed to by\r\n //- the current tail pointer to the hardware for processing.\r\n //-\r\n PciMemStore(tx_rb.rb.id, register_tx_desc_tail(tx_rb.rb.reg_addr), NextIndex);\r\n}\r\n\r\n//-\r\n//- Send an Ethernet packet on our interface.\r\n//-\r\nmethod NetIfSend(state:network_state, Headers:seq, Data:seq)\r\n returns (new_state:network_state)\r\n requires valid_network_state(state);\r\n requires public(state);\r\n requires |Headers| >= 14; //- Must contain at least an Ethernet header.\r\n requires |Headers| + |Data| <= 1514; //- Cannot exceed maximum Ethernet packet size.\r\n requires IsByteSeq(Headers);\r\n requires IsByteSeq(Data);\r\n requires public(Headers);\r\n requires public(Data);\r\n ensures valid_network_state(new_state);\r\n ensures new_state == state[tx_rb := tx_ring_buffer_build(ring_buffer_build(state.tx_rb.rb.base, state.tx_rb.rb.size, state.tx_rb.rb.head, (state.tx_rb.rb.tail + 1) % 512, state.tx_rb.rb.id, state.tx_rb.rb.reg_addr))];\r\n ensures public(new_state);\r\n{\r\n reveal_mod4();\r\n reveal_mod16();\r\n reveal_mod128();\r\n reveal_div16();\r\n\r\n lemma_2toX();\r\n\r\n var Ring:ring_buffer := state.tx_rb.rb;\r\n\r\n //-debug_print(0x60, Ring.base);\r\n//- debug_print(0x84, Ring.tail);\r\n\r\n //-\r\n //- Determine how much padding we need to add to meet minimal Ethernet packet size (if any).\r\n //-\r\n var Padding := [];\r\n if (|Headers| + |Data| < 60)\r\n {\r\n Padding := SequenceOfZerosIterative(60 - |Headers| - |Data|);\r\n }\r\n\r\n //-\r\n //- Write the packet data to the buffer indicated by the tail pointer.\r\n //- The tail pointer is the index of the next descriptor in the circular\r\n //- queue beyond that which has already been submitted to the hardware.\r\n //-\r\n //- The data buffers start at total_desc_bytes above the base address.\r\n //- Ring.tail is an index into the array, and each buffer is 2KB in size.\r\n //-\r\n var PacketBuffer := Ring.base + total_desc_bytes() + Ring.tail * 2048;\r\n CopyPacketToBuffer(PacketBuffer, Headers + Data + Padding);\r\n\r\n update_tx_descriptor(state.tx_rb, |Headers| + |Data| + |Padding|);\r\n\r\n //-\r\n //- Find the next entry in the descriptor ring.\r\n //-\r\n var NextIndex := (Ring.tail + 1) % 512; //- ModInstruction(Ring.tail + 1, 512);\r\n //-lemma_mod_512(Ring.tail + 1);\r\n assert NextIndex == (Ring.tail + 1) % 512;\r\n assert 0 <= NextIndex < 512;\r\n\r\n //-\r\n //- Before advancing the tail descriptor, make sure the hardware is done\r\n //- with the next entry.\r\n //-\r\n wait_for_available_tx_buffer(state.tx_rb, NextIndex);\r\n\r\n tx_cleanup(state.tx_rb, NextIndex);\r\n\r\n //-\r\n //- Update the ring buffer state that we pass around.\r\n //-\r\n var NewRing := tx_ring_buffer_build(ring_buffer_build(Ring.base, Ring.size, Ring.head, NextIndex, Ring.id, Ring.reg_addr));\r\n new_state := state[tx_rb := NewRing];\r\n}\r\n\r\n//-\r\n//- Advance a descriptor pointer to the next descriptor in the ring.\r\n//-\r\nmethod AdvanceDescriptorIndex(Index:int) returns (NewIndex:int)\r\n requires num_descriptors() == 512;\r\n requires 0 <= Index < 512;\r\n requires public(Index);\r\n ensures 0 <= NewIndex < 512;\r\n ensures public(NewIndex);\r\n{\r\n ghost var OldIndex := Index;\r\n NewIndex := (Index + 1) % 512;\r\n //-lemma_mod_512(OldIndex + 1);\r\n assert NewIndex == (OldIndex + 1) % 512;\r\n}\r\n\r\n//-method check_for_eop(TailDesc:int,TailIndex:int,rx_rb:rx_ring_buffer) returns (NewTailIndex:int, EndOfPacket:bool, Success:bool, NewData:seq)\r\n//- requires 0 <= TailIndex < 512 && rx_rb.rb.base + 16 * TailIndex < rx_rb.rb.base + rx_rb.rb.size;\r\n//- requires valid_ring_buffer(rx_rb.rb);\r\n//- requires public(TailDesc);\r\n//- requires public(rx_rb);\r\n//- ensures 0 <= NewTailIndex < 512; //- && rx_rb.rb.base + 16 * NewTailIndex < rx_rb.rb.base + rx_rb.rb.size;\r\n//- ensures Success ==> IsByteSeq(NewData);\r\n//- ensures public(NewTailIndex);\r\n//- ensures public(EndOfPacket);\r\n//- ensures public(Success);\r\n//- ensures public(NewData);\r\n//-{\r\n//- //-\r\n//- //- Receive descriptor format.\r\n//- //- See Table 3-1 and 3-2 in Section 3.2.3.\r\n//- //-\r\n//- //- Bytes 0 to 7 of the receive descriptor contain the address of its\r\n//- //- corresponding buffer, which we never change after initialization.\r\n//- //-\r\n//- //- Bytes 8 and 9 contain the length of the data received into this descriptor's buffer.\r\n//- //- Bytes 10 and 11 contain the Packet Checksum, which we currently do not use.\r\n//- //- Byte 12 is the Status field (See Section 3.2.3.1):\r\n//- //- Bit 0: Indicates whether the hardware is Done with this Descriptor (DD).\r\n//- //- Bit 1: Indicates whether this descriptor is the End Of Packet (EOP).\r\n//- //- Bit 2: Ignore Checksum Indication (IXSM), which we currently do not use.\r\n//- //- Bit 3: VLAN related. We do not use.\r\n//- //- Bit 4: Reserved bit. We ignore it.\r\n//- //- Bit 5: Indicates whether the TCP CheckSum (TCPCS) was calculated on the packet.\r\n//- //- Bit 6: Indicates whether the IP CheckSum (IPCS) was calculated on the packet.\r\n//- //- Bit 7: Indicates whether the packet Passed an In-exact Filter (PIF).\r\n//- //- Byte 13 is the Errors field, which we currently do not use (note we do not store bad packets).\r\n//- //- Bytes 14 and 15 is the Special field (VLAN related, we do not use).\r\n//- //-\r\n//- //- We read 32 bits at a time, so we read bytes 8-11 in one operation, and 12-14 in another.\r\n//- //-\r\n//-\r\n//- //-\r\n//- //- Check the Descriptor Done (DD) bit in the Status field.\r\n//- //-\r\n//- var WordContainingStatus := DeviceMemLoad(TailDesc + 12); //- Bytes 12-14.\r\n//- var DDBit := Asm_BitwiseAnd(WordContainingStatus, 1); //- Bit 0.\r\n//- NewData := [];\r\n//- if (DDBit == 1) {\r\n//- var WordContainingLength := DeviceMemLoad(TailDesc + 8); //- Bytes 8-11.\r\n//- var Length := TruncateToWord16(WordContainingLength); //- Bytes 8-9.\r\n//-\r\n//- var PacketBuffer := rx_rb.rb.base + total_desc_bytes() + TailIndex * 2048;\r\n//- var ReadOkay, NewData := CopyBufferToPacket(PacketBuffer, Length);\r\n//-\r\n//- if (!ReadOkay || (|NewData| >= 0x10000)) {\r\n//- Success := false;\r\n//- NewData := [];\r\n//- }\r\n//-\r\n//- //-\r\n//- //- Clear out the status field before giving this descriptor back to the hardware.\r\n//- //- Note we still have a copy of the status value in WordContainingStatus.\r\n//- //-\r\n//- DeviceMemStore(TailDesc + 12, 0);\r\n//-\r\n//- //-\r\n//- //- Tell the hardware that we are done with all descriptors preceeding this one in the ring.\r\n//- //- TODO: Only do this after we reach end of packet? Optimization trade-off, not a correctness issue.\r\n//- //-\r\n//- PciMemStore(rx_rb.rb.id, register_rx_desc_tail(rx_rb.rb.reg_addr), TailIndex);\r\n//-\r\n//- //-\r\n//- //- Was this descriptor the end of the current packet?\r\n//- //- If not, proceed to the next descriptor in the ring.\r\n//- //-\r\n//- var Eop := Asm_BitwiseAnd(WordContainingStatus, 2); //- Bit 1.\r\n//- if (Eop > 0) {\r\n//- EndOfPacket := true;\r\n//- }\r\n//- else\r\n//- {\r\n//- NewTailIndex := AdvanceDescriptorIndex(TailIndex);\r\n//- }\r\n//- }\r\n//-\r\n//-}\r\n//-\r\n//-\r\n//-method NetIfReceive(state:network_state)\r\n//- returns (Success:bool, new_state:network_state, Data:seq)\r\n//- requires valid_network_state(state);\r\n//- requires public(state);\r\n//- requires num_descriptors() == 512;\r\n//- requires bytes_per_buffer() == 2048;\r\n//- ensures valid_network_state(new_state);\r\n//- ensures public(new_state);\r\n//- ensures Success ==> IsByteSeq(Data);\r\n//- ensures public(Success);\r\n//- ensures public(Data);\r\n//-{\r\n//- reveal_mod4();\r\n//- reveal_mod16();\r\n//- reveal_mod128();\r\n//- reveal_div16();\r\n//-\r\n//- lemma_2toX();\r\n//-\r\n//- Success := true;\r\n//- Data := [];\r\n//-\r\n//- var Ring := state.rx_rb.rb;\r\n//-\r\n//- //-debug_print(0x72, Ring.base);\r\n//-\r\n//- //-\r\n//- //- The next descriptor we should read is *the one after* the current tail pointer.\r\n//- //-\r\n//- var TailIndex:int := AdvanceDescriptorIndex(Ring.tail);\r\n//-\r\n//- //-\r\n//- //- Wait for the hardware to be done with this descriptor.\r\n//- //- Note that receipt of a single packet can result in the use of multiple descriptors,\r\n//- //- so we loop until we find a descriptor with the End-Of-Packet bit set.\r\n//- //-\r\n//- var EndOfPacket:bool := false;\r\n//- while (!EndOfPacket)\r\n//- decreases *;\r\n//- invariant IsByteSeq(Data);\r\n//- invariant valid_ring_buffer(Ring);\r\n//- invariant public(Ring);\r\n//- invariant 0 <= TailIndex < 512 && Ring.base + 16 * TailIndex < Ring.base + Ring.size;\r\n//- invariant |Data| < power2(16);\r\n//- invariant public(Data);\r\n//- invariant public(TailIndex);\r\n//- invariant public(Success);\r\n//- invariant public(EndOfPacket);\r\n//- {\r\n//- lemma_2toX();\r\n//-\r\n//- //-\r\n//- //- Convert tail index to descriptor address.\r\n//- //-\r\n//- var TailDesc := Ring.base + 16 * TailIndex;\r\n//- var NewData:seq;\r\n//- TailDesc, EndOfPacket, Success, NewData := check_for_eop(TailDesc, TailIndex, state.rx_rb);\r\n//- Data := Data + NewData;\r\n//- }\r\n//-\r\n//- var NewRing := rx_ring_buffer_build(ring_buffer_build(Ring.base, Ring.size, Ring.head, TailIndex, Ring.id, Ring.reg_addr));\r\n//- new_state := state[rx_rb := NewRing];\r\n//-}\r\n\r\n\r\n\r\n//-\r\n//- Check the Descriptor Done (DD) bit in the Status field.\r\n//-\r\nmethod check_desc_dd(src:int) returns (DD:bool, Length:int, Eop:bool)\r\n requires DeviceMemAddr() <= src + 4 <= DeviceMemAddr() + DeviceMemSize();\r\n requires DeviceMemAddr() <= src + 8 + 4 <= DeviceMemAddr() + DeviceMemSize();\r\n requires DeviceMemAddr() <= src + 12 + 4 <= DeviceMemAddr() + DeviceMemSize();\r\n requires Word32(src + 8);\r\n requires Word32(src + 12);\r\n requires public(src);\r\n ensures Word16(Length);\r\n ensures public (DD);\r\n ensures public(Length);\r\n ensures public(Eop);\r\n{\r\n DD := false;\r\n Length := 0;\r\n var WordContainingStatus := DeviceMemLoad(src + 12); //- Bytes 12-14.\r\n var DDBit := Asm_BitwiseAnd(WordContainingStatus, 1); //- Bit 0.\r\n if (DDBit == 1) {\r\n DD := true;\r\n var WordContainingLength := DeviceMemLoad(src + 8); //- Bytes 8-11.\r\n Length := TruncateToWord16(WordContainingLength); //- Bytes 8-9.\r\n } \r\n \r\n //- Was this descriptor the end of the current packet?\r\n var EopBit := Asm_BitwiseAnd(WordContainingStatus, 2); //- Bit 1.\r\n if EopBit > 0 {\r\n Eop := true;\r\n } else {\r\n Eop := false;\r\n }\r\n\r\n}\r\n\r\nmethod reset_descriptor(desc:int,rx_rb:rx_ring_buffer, TailIndex:int)\r\n requires DeviceMemAddr() <= desc + 12 && desc + 12 + 4 <= DeviceMemAddr() + DeviceMemSize();\r\n requires Word32(desc + 12);\r\n requires valid_ring_buffer(rx_rb.rb);\r\n requires Word32(TailIndex);\r\n requires public(desc);\r\n requires public(rx_rb);\r\n requires public(TailIndex);\r\n{\r\n //-\r\n //- Clear out the status field before giving this descriptor back to the hardware.\r\n //- Note we still have a copy of the status value in WordContainingStatus.\r\n //-\r\n DeviceMemStore(desc + 12, 0);\r\n\r\n //-\r\n //- Tell the hardware that we are done with all descriptors preceeding this one in the ring.\r\n \r\n //-\r\n PciMemStore(rx_rb.rb.id, register_rx_desc_tail(rx_rb.rb.reg_addr), TailIndex);\r\n}\r\n\r\nmethod receive_loop_body(rx_rb:rx_ring_buffer, TailIndex:int) returns (NewTailIndex:int, EndOfPacket:bool, NewData:seq, Success:bool)\r\n requires valid_ring_buffer(rx_rb.rb);\r\n requires 0 <= TailIndex < 512;\r\n requires rx_rb.rb.base + 16 * TailIndex < rx_rb.rb.base + rx_rb.rb.size;\r\n requires public(rx_rb);\r\n requires public(TailIndex);\r\n ensures 0 <= NewTailIndex < 512;\r\n ensures IsByteSeq(NewData);\r\n ensures public(NewTailIndex);\r\n ensures public(EndOfPacket);\r\n ensures public(NewData);\r\n ensures public(Success);\r\n\r\n{\r\n lemma_2toX();\r\n reveal_mod16();\r\n\r\n NewTailIndex := TailIndex;\r\n NewData := [];\r\n EndOfPacket := false;\r\n Success := true;\r\n //-\r\n //- Convert tail index to descriptor address.\r\n //-\r\n var TailDesc := rx_rb.rb.base + 16 * TailIndex;\r\n\r\n //-\r\n //- Receive descriptor format.\r\n //- See Table 3-1 and 3-2 in Section 3.2.3.\r\n //-\r\n //- Bytes 0 to 7 of the receive descriptor contain the address of its\r\n //- corresponding buffer, which we never change after initialization.\r\n //-\r\n //- Bytes 8 and 9 contain the length of the data received into this descriptor's buffer.\r\n //- Bytes 10 and 11 contain the Packet Checksum, which we currently do not use.\r\n //- Byte 12 is the Status field (See Section 3.2.3.1):\r\n //- Bit 0: Indicates whether the hardware is Done with this Descriptor (DD).\r\n //- Bit 1: Indicates whether this descriptor is the End Of Packet (EOP).\r\n //- Bit 2: Ignore Checksum Indication (IXSM), which we currently do not use.\r\n //- Bit 3: VLAN related. We do not use.\r\n //- Bit 4: Reserved bit. We ignore it.\r\n //- Bit 5: Indicates whether the TCP CheckSum (TCPCS) was calculated on the packet.\r\n //- Bit 6: Indicates whether the IP CheckSum (IPCS) was calculated on the packet.\r\n //- Bit 7: Indicates whether the packet Passed an In-exact Filter (PIF).\r\n //- Byte 13 is the Errors field, which we currently do not use (note we do not store bad packets).\r\n //- Bytes 14 and 15 is the Special field (VLAN related, we do not use).\r\n //-\r\n //- We read 32 bits at a time, so we read bytes 8-11 in one operation, and 12-14 in another.\r\n //-\r\n\r\n //-\r\n //- Check the Descriptor Done (DD) bit in the Status field.\r\n //-\r\n var DD, Length, Eop := check_desc_dd(TailDesc);\r\n\r\n if (DD) {\r\n var PacketBuffer := rx_rb.rb.base + total_desc_bytes() + TailIndex * 2048;\r\n var ReadOkay:bool;\r\n ReadOkay, NewData := CopyBufferToPacket(PacketBuffer, Length);\r\n\r\n if (!ReadOkay || (|NewData| >= 0x10000)) {\r\n Success := false;\r\n NewData := [];\r\n }\r\n\r\n reset_descriptor(TailDesc, rx_rb, TailIndex);\r\n\r\n //-\r\n //- Was this descriptor the end of the current packet?\r\n //- If not, proceed to the next descriptor in the ring.\r\n //-\r\n if (Eop) {\r\n EndOfPacket := true;\r\n }\r\n else\r\n {\r\n NewTailIndex := AdvanceDescriptorIndex(TailIndex);\r\n }\r\n }\r\n}\r\n\r\nmethod NetIfReceive(state:network_state)\r\n returns (Success:bool, new_state:network_state, Data:seq)\r\n requires valid_network_state(state);\r\n requires public(state);\r\n requires num_descriptors() == 512;\r\n requires bytes_per_buffer() == 2048;\r\n ensures valid_network_state(new_state);\r\n ensures Success ==> IsByteSeq(Data);\r\n ensures public(Success);\r\n ensures public(new_state);\r\n ensures public(Data);\r\n{\r\n//- reveal_mod4();\r\n//- reveal_mod16();\r\n//- reveal_mod128();\r\n reveal_div16();\r\n\r\n lemma_2toX();\r\n\r\n Success := true;\r\n Data := [];\r\n\r\n //-debug_print(0x72, state.rx_rb.rb.base);\r\n\r\n //-\r\n //- The next descriptor we should read is *the one after* the current tail pointer.\r\n //-\r\n var TailIndex:int := AdvanceDescriptorIndex(state.rx_rb.rb.tail);\r\n\r\n //-\r\n //- Wait for the hardware to be done with this descriptor.\r\n //- Note that receipt of a single packet can result in the use of multiple descriptors,\r\n //- so we loop until we find a descriptor with the End-Of-Packet bit set.\r\n //-\r\n var EndOfPacket:bool := false;\r\n while (!EndOfPacket)\r\n decreases *;\r\n invariant IsByteSeq(Data);\r\n invariant valid_ring_buffer(state.rx_rb.rb);\r\n invariant 0 <= TailIndex < 512 && state.rx_rb.rb.base + 16 * TailIndex < state.rx_rb.rb.base + state.rx_rb.rb.size;\r\n invariant |Data| < power2(16);\r\n invariant public(state);\r\n invariant public(Data);\r\n invariant public(TailIndex);\r\n invariant public(Success);\r\n invariant public(EndOfPacket);\r\n {\r\n var NewData:seq;\r\n TailIndex, EndOfPacket, NewData, Success := receive_loop_body(state.rx_rb, TailIndex);\r\n Data := Data + NewData;\r\n if !Success || |Data| >= 0x10000 {\r\n Success := false;\r\n Data := [];\r\n }\r\n }\r\n\r\n var NewRing := rx_ring_buffer_build(ring_buffer_build(state.rx_rb.rb.base, state.rx_rb.rb.size, state.rx_rb.rb.head, TailIndex, state.rx_rb.rb.id, state.rx_rb.rb.reg_addr));\r\n new_state := state[rx_rb := NewRing];\r\n}\r\n\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/TPM/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/TPM/tpm-device.s.dfy", "content": "include \"../../Libraries/Math/power2.s.dfy\"\r\ninclude \"../../Libraries/Util/integer_sequences.s.dfy\"\r\ninclude \"../../Libraries/Util/relational.s.dfy\"\r\ninclude \"../../Libraries/Crypto/Hash/sha1.s.dfy\"\r\ninclude \"../IO/io_mem.s.dfy\"\r\n\r\n//-/////////////////////////////////////\r\n//- App Spec Interface\r\n//-/////////////////////////////////////\r\n\r\n//- App must specify an invariant on values it wants to write to the TPM then read later with assurance of integrity\r\nstatic function TPM_app_policy_okay_to_trust(trusted_data:seq) : bool\r\n\r\n//-//////////////////////////////////////////////////////////\r\n//- Basic functions and datatypes\r\n//- (Note: Sec. 2.1.1 of Part 2: Everything is big endian)\r\n//-//////////////////////////////////////////////////////////\r\n\r\ndatatype CommandState = Idle | AlmostReady | Ready | CmdReception | Executing | CmdComplete;\r\n\r\ndatatype TPM_struct = TPM_build(\r\n PCR_19 : seq>, //- Since we allow extension of this PCR, this represents the sequence of things extended into the PCR\r\n cmd_state : CommandState,\r\n cmd_buf : seq,\r\n reply_buf : seq,\r\n random_index : int //- Tracks our current position in the stream of randomness from the TPM\r\n );\r\n\r\nstatic predicate TPM_valid(aTPM:TPM_struct)\r\n{\r\n IsByteSeq(aTPM.cmd_buf)\r\n && IsByteSeq(aTPM.reply_buf)\r\n}\r\n\r\nstatic predicate TPMs_match(TPM1:TPM_struct, TPM2:TPM_struct)\r\n{\r\n TPM1.PCR_19 == TPM2.PCR_19 &&\r\n TPM1.random_index == TPM2.random_index\r\n}\r\n\r\n//-/////////////////////////////////////\r\n//- Verve Entry Interface\r\n//-/////////////////////////////////////\r\n\r\n//- Invariant that must be true on Verve entry, and that remains true throughout TPM executions\r\nstatic predicate TPM_satisfies_integrity_policy(aTPM:TPM_struct)\r\n{\r\n TPM_valid(aTPM)\r\n}\r\n\r\n//- Verve entry should include:\r\n//- requires TPM_valid(TPM);\r\n//- requires TPM_satisfies_integrity_policy(TPM);\r\n//- requires TPM.PCR_19 == [];\r\n\r\n//- We model the infinite stream of randomness as a series of \"constants\" returned\r\n//- by this function that are discovered by calls to read_random\r\nstatic function TPM_random_byte(index:int) : int\r\n\r\nstatic function TPM_random_bytes (old_random_index:int, new_random_index:int) : seq\r\n decreases new_random_index - old_random_index;\r\n{\r\n if old_random_index >= new_random_index then\r\n []\r\n else\r\n TPM_random_bytes(old_random_index, new_random_index-1) + [TPM_random_byte(new_random_index-1)]\r\n}\r\n\r\n//- We only use this for 17 & 18, which don't change while we're executing\r\nstatic function PCR_val(index:int) : seq\r\n\r\n//- Tracks whether we have taken control of the TPM at access level 3\r\n//- Tracked via a function, since it cannot change while we execute\r\nstatic predicate Locality3_requested()\r\nstatic predicate Locality3_obtained()\r\n\r\nghost var{:readonly} TPM:TPM_struct;\r\n\r\n//- Condenses all of the public information in the TPM\r\n//- I.e., public = PCR_19\r\nstatic function TPM_public(aTPM:TPM_struct, s:seq) : bool\r\n{\r\n (exists i:int | 0 <= i < |aTPM.PCR_19| :: s == aTPM.PCR_19[i])\r\n}\r\n/* TODO: dafnycc\r\nstatic function TPM_public(aTPM:TPM_struct) : set>\r\n{\r\n (set i:int | 0 <= i < |aTPM.PCR_19| :: aTPM.PCR_19[i])\r\n}\r\n*/\r\n\r\n/********************************************************\r\n * Low-level TPM interactions\r\n ********************************************************/\r\n\r\nghost method {:axiom} TPM_enable_request_access()\r\n requires IoMemPerm.Null?;\r\n modifies this`IoMemPerm;\r\n ensures Locality3_requested();\r\n ensures IoMemPerm == IoWriteAddr(0xFED43000, 2); //- movb 2 -> 0xFED43000 (0xFED4 || TPM_ACCESS_3 (3000h))\r\n\r\nghost method {:axiom} TPM_enable_check_access_status() returns (status:int)\r\n requires IoMemPerm.Null?;\r\n requires Locality3_requested();\r\n modifies this`IoMemPerm;\r\n ensures Word32(status); \r\n ensures |BEWordToBitSeq(status)| == 32;\r\n ensures BEWordToBitSeq(status)[26] == 1 ==> Locality3_obtained(); //- bit 5 = activeLocality\r\n ensures IoMemPerm == IoReadAddr(0xFED43000, status);\r\n\r\n//- See Table 16 of the TCG PC Client Spec 1.20\r\nghost method {:axiom} TPM_enable_issue_command_ready()\r\n requires IoMemPerm.Null?;\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM); \r\n ensures old(TPM.cmd_state.Idle? || TPM.cmd_state.AlmostReady?) ==> TPM.cmd_state.AlmostReady? || TPM.cmd_state.Ready?;\r\n ensures old(TPM.cmd_state.Ready?) ==> TPM.cmd_state == Ready;\r\n ensures old(TPM.cmd_state.CmdReception? || TPM.cmd_state.Executing? || TPM.cmd_state.CmdComplete?) ==> \r\n (TPM.cmd_state.Idle? || TPM.cmd_state.AlmostReady? || TPM.cmd_state.Ready?); //- Depends on TPM impl and timeout values\r\n ensures TPM_valid(TPM);\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPM == old(TPM)[cmd_state := TPM.cmd_state][cmd_buf := []][reply_buf := []];\r\n ensures IoMemPerm == IoWriteAddr(0xFED43018, 0x40);\r\n\r\nghost method {:axiom} TPM_enable_check_command_ready() returns (status:int)\r\n requires IoMemPerm.Null?;\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires TPM.cmd_state.AlmostReady? || TPM.cmd_state.Ready?;\r\n ensures Word32(status); \r\n ensures |BEWordToBitSeq(status)| == 32;\r\n ensures BEWordToBitSeq(status)[25] == 1 ==> TPM.cmd_state.Ready?; //- bit 6 = commandReady\r\n ensures BEWordToBitSeq(status)[25] != 1 ==> TPM.cmd_state == old(TPM.cmd_state);\r\n ensures TPM_valid(TPM);\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPM == old(TPM)[cmd_state := TPM.cmd_state];\r\n ensures IoMemPerm == IoReadAddr(0xFED43018, status);\r\n\r\nghost method {:axiom} TPM_enable_write_FIFO(c:int)\r\n requires IoMemPerm.Null?;\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires IsByte(c);\r\n requires TPM.cmd_state.Ready? || TPM.cmd_state.CmdReception?;\r\n ensures TPM_valid(TPM);\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPM == old(TPM)[cmd_state := CmdReception()][cmd_buf := old(TPM.cmd_buf) + [c]];\r\n ensures IoMemPerm == IoWriteAddr(0xFED43024, c);\r\n\r\nghost method {:axiom} TPM_enable_go()\r\n requires IoMemPerm.Null?;\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires power2(32) == 0x100000000;\r\n requires forall new_TPM : TPM_struct :: async_TPM_execution(TPM, new_TPM) ==> TPM_satisfies_integrity_policy(new_TPM);\r\n requires TPM.cmd_state.CmdReception?;\r\n//-dafnycc requires forall new_TPM : TPM_struct :: TPM_valid(new_TPM) && async_TPM_execution(TPM, new_TPM) ==> TPM_public(left(new_TPM)) == TPM_public(right(new_TPM));\r\n//-Wait for SymDiff: requires forall new_TPM : TPM_struct :: TPM_valid(new_TPM) && async_TPM_execution(TPM, new_TPM) ==> forall s :: TPM_public(left(new_TPM), s) == TPM_public(right(new_TPM), s);\r\n ensures TPM_valid(TPM);\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPM == old(TPM)[cmd_state := Executing];\r\n ensures IoMemPerm == IoWriteAddr(0xFED43018, 0x20);\r\n\r\nghost method {:axiom} TPM_enable_check_data_available() returns (r:int)\r\n requires IoMemPerm.Null?;\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires TPM.cmd_state.Executing? || TPM.cmd_state.CmdComplete?;\r\n requires power2(32) == 0x100000000;\r\n ensures TPM_valid(TPM);\r\n ensures old(TPM.cmd_state.Executing?) ==> async_TPM_execution(old(TPM), TPM) //- May bump us to CmdComplete, or may leave us in Executing\r\n && (r == 0x90 <==> TPM.cmd_state.CmdComplete?); //- 0x90 = TIS_STS_VALID (0x80) + TIS_STS_DATA_AVAIL (0x10)\r\n ensures old(TPM.cmd_state.CmdComplete?) ==> (r == 0x90 ==> |TPM.reply_buf| > 0) && old(TPM) == TPM;\r\n ensures old(TPM.cmd_state.CmdComplete?) ==> (r == 0x80 ==> |TPM.reply_buf| == 0) && old(TPM) == TPM;\r\n modifies this`TPM; //- Modifications specified by Async_TPM, so no additional details below\r\n modifies this`IoMemPerm;\r\n ensures IoMemPerm == IoReadAddr(0xFED43018, r);\r\n\r\nghost method {:axiom} TPM_enable_read_FIFO() returns (c:int)\r\n requires IoMemPerm.Null?;\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires TPM.cmd_state.CmdComplete? && |TPM.reply_buf| > 0;\r\n ensures TPM_valid(TPM);\r\n ensures old(TPM.reply_buf) == [c] + TPM.reply_buf;\r\n ensures IsByte(c);\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPM == old(TPM)[reply_buf := TPM.reply_buf];\r\n ensures IoMemPerm == IoReadAddr(0xFED43024, c);\r\n\r\nstatic predicate async_TPM_execution(old_TPM:TPM_struct, new_TPM:TPM_struct)\r\n requires IsByteSeq(old_TPM.cmd_buf);\r\n{\r\n //- We execute a valid command\r\n (IsByteSeq(new_TPM.reply_buf) && |new_TPM.reply_buf| > 0 && TPM_executed_some_command(old_TPM, new_TPM))\r\n ||\r\n //- Or there's a valid command present, but the TPM is still executing it\r\n (valid_cmd_present(old_TPM) && old_TPM == new_TPM)\r\n ||\r\n //- Or there's an unexpected command, so we know nothing about the TPM's state\r\n !valid_cmd_present(old_TPM)\r\n //- havoc!\r\n\r\n}\r\n\r\n/***************************************\r\n * TPM Tags\r\n ***************************************/\r\n\r\nstatic function TPM_TAG_RQU_COMMAND() : seq\r\n{\r\n [ 0, 0xC1 ]\r\n}\r\n\r\nstatic function TPM_TAG_RQU_AUTH1_COMMAND() : seq\r\n{\r\n [ 0, 0xC2 ]\r\n}\r\n\r\nstatic function method TPM_TAG_RSP_COMMAND() : seq\r\n{\r\n [ 0, 0xC4 ]\r\n}\r\n\r\nstatic function method TPM_TAG_RSP_AUTH1_COMMAND() : seq\r\n{\r\n [ 0, 0xC5 ]\r\n}\r\n\r\n/***************************************\r\n * TPM Command Ordinals\r\n ***************************************/\r\n\r\nstatic function TPM_ORD_Extend() : int\r\n{\r\n 0x14\r\n}\r\n\r\nstatic function TPM_ORD_Quote2() : int\r\n{\r\n 0x3E\r\n}\r\n\r\nstatic function TPM_ORD_GetRandom() : int\r\n{\r\n 0x46\r\n}\r\n\r\nstatic function TPM_ORD_PcrRead() : int\r\n{\r\n 0x15\r\n}\r\n\r\nstatic function TPM_ORD_OIAP() : int\r\n{\r\n 0x0A\r\n}\r\n\r\nstatic function TPM_ORD_LoadKey2() : int\r\n{\r\n 0x41\r\n}\r\n\r\n/***************************************\r\n * TPM return codes\r\n ***************************************/\r\n\r\nstatic function method TPM_SUCCESS() : int\r\n{\r\n 0\r\n}\r\n\r\n/********************************************************\r\n * TPM structure parsing\r\n ********************************************************/\r\n\r\nstatic function method PCR_SELECTION_covering_PCRs_17_and_18() : seq\r\n{\r\n [ 0, 3, 0, 0, 6 ] //- pcrSelection = size (0x0003), PCR bit map. Selects PCR 17 & 18 from byte 2 (0-indexed\r\n}\r\n\r\nstatic function method PCR_SELECTION_covering_PCRs_17_through_19() : seq\r\n{\r\n [ 0, 3, 0, 0, 14 ] //- pcrSelection = size (0x0003), PCR bit map. Selects PCR 17, 18, 19 from byte 2 (0-indexed\r\n}\r\n\r\ndatatype PCRInfoShort = PCRInfoShort17And18_c(pcrs_17_18_digest:seq) |\r\n PCRInfoShort17Through19_c(pcrs_17_18_19_digest:seq) |\r\n PCRInfoShortInvalid_c()\r\n\r\nstatic function parse_PCR_info_short(s:seq) : PCRInfoShort\r\n{\r\n if |s| != 26 then\r\n PCRInfoShortInvalid_c()\r\n else\r\n (\r\n var fields := s[5 :1 :20 ];\r\n var pcr_selection, localities_bit_vector, pcrs_digest :=\r\n fields[0], fields[1], fields[2];\r\n //- Note: we don't care about the localities: NVRAM uses PCR protections and it's irrelevant for Quote\r\n if pcr_selection == PCR_SELECTION_covering_PCRs_17_through_19() then\r\n PCRInfoShort17Through19_c(pcrs_digest)\r\n else if pcr_selection == PCR_SELECTION_covering_PCRs_17_and_18() then\r\n PCRInfoShort17And18_c(pcrs_digest)\r\n else \r\n PCRInfoShortInvalid_c()\r\n )\r\n}\r\n\r\nstatic predicate is_TPM_COMPOSITE_HASH(h:seq, PCR_17:seq, PCR_18:seq)\r\n{\r\n var pcr_composite := PCR_SELECTION_covering_PCRs_17_and_18() +\r\n [0, 0, 0, 40] + //- size of next two PCRs\r\n PCR_17 + PCR_18;\r\n IsByteSeq(pcr_composite) &&\r\n (var pcr_composite_bits := BEByteSeqToBitSeq(pcr_composite);\r\n IsBitSeq(pcr_composite_bits) && |pcr_composite_bits| < power2(64) &&\r\n h == BEWordSeqToByteSeq(SHA1(pcr_composite_bits)))\r\n}\r\n\r\nstatic predicate Verve_quote(pcr_info:seq, sig:seq, nonce:seq, PCR_19_history:seq>)\r\n\r\n/********************************************************\r\n * TPM command parsing\r\n ********************************************************/\r\n\r\ndatatype TPMCommand = TPMCommandQuote2_c(nonce_external:seq, key_handle:seq, auth_handle:seq) |\r\n TPMCommandReadPCR17Or18_c(pcr_to_read:int) |\r\n TPMCommandExtendPCR19_c(value_to_extend:seq) |\r\n TPMCommandGetRandom_c(random_bytes:int) |\r\n TPMCommandOIAP_c() |\r\n TPMCommandLoadKey2_c() |\r\n TPMCommandInvalid_c()\r\n\r\nstatic function parse_TPM_command_quote2(s:seq) : TPMCommand\r\n requires IsByteSeq(s);\r\n{\r\n if |s| != 85 then\r\n TPMCommandInvalid_c()\r\n else\r\n (\r\n var fields := s[10 :4 :20 :5 :1 :4 :20 :1 :20 ];\r\n var _, key_handle, nonce_external, pcr_selection, add_version, auth_handle, nonce_odd, continue_auth_session, priv_auth :=\r\n fields[0], fields[1], fields[2], fields[3], fields[4], fields[5], fields[6], fields[7], fields[8] ;\r\n if pcr_selection == PCR_SELECTION_covering_PCRs_17_through_19() &&\r\n add_version == [1] && //- When TRUE add TPM_CAP_VERSION_INFO to the output\r\n continue_auth_session == [1] then //- continueAuthSession?\r\n TPMCommandQuote2_c(nonce_external, key_handle, auth_handle)\r\n else\r\n TPMCommandInvalid_c()\r\n )\r\n}\r\n\r\nstatic function parse_TPM_command_read_PCR_17_or_18(s:seq) : TPMCommand\r\n requires IsByteSeq(s);\r\n{\r\n if |s| != 14 then\r\n TPMCommandInvalid_c()\r\n else\r\n (\r\n var pcr := BEByteSeqToInt(s[10..14]);\r\n if pcr == 17 || pcr == 18 then\r\n TPMCommandReadPCR17Or18_c(pcr)\r\n else\r\n TPMCommandInvalid_c()\r\n )\r\n}\r\n\r\nstatic function parse_TPM_command_extend_PCR_19(s:seq) : TPMCommand\r\n requires IsByteSeq(s);\r\n{\r\n if |s| != 34 then\r\n TPMCommandInvalid_c()\r\n else\r\n (\r\n var fields := s[10 :4 :20 ];\r\n var _, pcr, data :=\r\n fields[0], fields[1], fields[2] ;\r\n if BEByteSeqToInt(pcr) == 19 then\r\n TPMCommandExtendPCR19_c(data)\r\n else\r\n TPMCommandInvalid_c()\r\n )\r\n}\r\n\r\nstatic function parse_TPM_command_get_random(s:seq) : TPMCommand\r\n requires IsByteSeq(s);\r\n{\r\n if |s| != 14 then\r\n TPMCommandInvalid_c()\r\n else\r\n (\r\n var random_bytes := BEByteSeqToInt(s[10..14]);\r\n TPMCommandGetRandom_c(random_bytes)\r\n )\r\n}\r\n\r\nstatic function parse_TPM_command_OIAP(s:seq) : TPMCommand\r\n requires IsByteSeq(s);\r\n{\r\n if |s| != 10 then\r\n TPMCommandInvalid_c()\r\n else\r\n TPMCommandOIAP_c() //- Nothing to the command but the header\r\n}\r\n\r\nstatic function parse_TPM_command_LoadKey2(s:seq) : TPMCommand\r\n requires IsByteSeq(s);\r\n{\r\n if |s| < 59 then\r\n TPMCommandInvalid_c()\r\n else\r\n TPMCommandLoadKey2_c() //- Nothing to track for security purposes\r\n}\r\n\r\nstatic function parse_TPM_command(s:seq) : TPMCommand\r\n requires IsByteSeq(s);\r\n{\r\n if |s| < 10 then\r\n TPMCommandInvalid_c()\r\n else\r\n (\r\n var fields := s[2 :4 :4 ];\r\n var tag, length, command :=\r\n fields[0], fields[1], fields[2];\r\n var command_code := BEByteSeqToInt(command);\r\n if BEByteSeqToInt(length) != |s| then\r\n TPMCommandInvalid_c()\r\n else if tag == TPM_TAG_RQU_COMMAND() then\r\n (\r\n if command_code == TPM_ORD_PcrRead() then\r\n parse_TPM_command_read_PCR_17_or_18(s)\r\n else if command_code == TPM_ORD_Extend() then\r\n parse_TPM_command_extend_PCR_19(s)\r\n else if command_code == TPM_ORD_GetRandom() then\r\n parse_TPM_command_get_random(s)\r\n else if command_code == TPM_ORD_OIAP() then\r\n parse_TPM_command_OIAP(s)\r\n else if command_code == TPM_ORD_LoadKey2() then\r\n parse_TPM_command_LoadKey2(s)\r\n else\r\n TPMCommandInvalid_c()\r\n )\r\n else if tag == TPM_TAG_RQU_AUTH1_COMMAND() then\r\n (\r\n if command_code == TPM_ORD_Quote2() then\r\n parse_TPM_command_quote2(s)\r\n else if command_code == TPM_ORD_LoadKey2() then\r\n parse_TPM_command_LoadKey2(s)\r\n else\r\n TPMCommandInvalid_c()\r\n )\r\n else\r\n TPMCommandInvalid_c()\r\n )\r\n}\r\n\r\nstatic predicate valid_cmd(s:seq)\r\n requires IsByteSeq(s);\r\n{\r\n !(parse_TPM_command(s).TPMCommandInvalid_c?)\r\n}\r\n\r\nstatic predicate {:autoReq} valid_cmd_present(aTPM:TPM_struct)\r\n{\r\n valid_cmd(aTPM.cmd_buf)\r\n}\r\n\r\n/********************************************************\r\n * TPM reply parsing\r\n ********************************************************/\r\n\r\ndatatype TPMReply = TPMReplyQuote2_c(nonce_even:seq, pcr_info:seq, sig:seq) |\r\n TPMReplyReadPCR17Or18_c(pcr_value_read:seq) |\r\n TPMReplyExtendPCR19_c() |\r\n TPMReplyGetRandom_c(randoms:seq) |\r\n TPMReplyOIAP() |\r\n TPMReplyLoadKey2() |\r\n TPMReplyInvalid_c()\r\n\r\nstatic predicate is_TPM_reply_header_ok(s:seq, expected_tag:seq)\r\n requires IsByteSeq(s);\r\n{\r\n |s| >= 10 &&\r\n (var fields := s[2 :4 :4 ];\r\n var tag, length, return_code :=\r\n fields[0], BEByteSeqToInt(fields[1]), BEByteSeqToInt(fields[2]) ;\r\n tag == expected_tag &&\r\n length == |s| &&\r\n return_code == TPM_SUCCESS())\r\n}\r\n\r\n\r\nstatic function parse_TPM_reply_quote2(s:seq) : TPMReply\r\n requires IsByteSeq(s);\r\n{\r\n if !is_TPM_reply_header_ok(s,TPM_TAG_RSP_AUTH1_COMMAND()) || |s| < 40 then\r\n TPMReplyInvalid_c()\r\n else\r\n (\r\n var f_a := s[10 :26 :4 ];\r\n var _, pcr_info_bytes, version_info_size :=\r\n f_a[0], f_a[1], BEByteSeqToInt(f_a[2]) ;\r\n var pcr_info := parse_PCR_info_short(pcr_info_bytes);\r\n if !pcr_info.PCRInfoShort17Through19_c? || |s| < 44 + version_info_size || version_info_size < 0 then\r\n TPMReplyInvalid_c()\r\n else\r\n (\r\n var f_b := s[40 :version_info_size :4 ];\r\n var _, version_info, sig_size :=\r\n f_b[0], f_b[1], BEByteSeqToInt(f_b[2]) ;\r\n if |s| != 85 + version_info_size + sig_size || sig_size < 0 then\r\n TPMReplyInvalid_c()\r\n else\r\n (\r\n var f_c := s[44+version_info_size :sig_size :20 :1 :20 ];\r\n var _, sig, nonce_even, continue_session, res_auth :=\r\n f_c[0], f_c[1], f_c[2], f_c[3], f_c[4] ;\r\n if continue_session == [1] then\r\n TPMReplyQuote2_c(nonce_even, pcr_info_bytes, sig)\r\n else\r\n TPMReplyInvalid_c()\r\n )\r\n )\r\n )\r\n}\r\n\r\nstatic function parse_TPM_reply_read_PCR_17_or_18(s:seq) : TPMReply\r\n requires IsByteSeq(s);\r\n{\r\n if !is_TPM_reply_header_ok(s,TPM_TAG_RSP_COMMAND()) || |s| != 30 then\r\n TPMReplyInvalid_c()\r\n else\r\n TPMReplyReadPCR17Or18_c(s[10..30])\r\n}\r\n\r\nstatic function parse_TPM_reply_extend_PCR_19(s:seq) : TPMReply\r\n requires IsByteSeq(s);\r\n{\r\n if !is_TPM_reply_header_ok(s,TPM_TAG_RSP_COMMAND()) || |s| != 30 then\r\n TPMReplyInvalid_c()\r\n else\r\n TPMReplyExtendPCR19_c()\r\n}\r\n\r\nstatic function parse_TPM_reply_get_random(s:seq) : TPMReply\r\n requires IsByteSeq(s);\r\n{\r\n if !is_TPM_reply_header_ok(s,TPM_TAG_RSP_COMMAND()) || |s| < 14 then\r\n TPMReplyInvalid_c()\r\n else\r\n (\r\n var random_bytes_size := BEByteSeqToInt(s[10..14]);\r\n if |s| != 14 + random_bytes_size || random_bytes_size < 0 then\r\n TPMReplyInvalid_c()\r\n else\r\n TPMReplyGetRandom_c(s[14..14+random_bytes_size])\r\n )\r\n}\r\n\r\nstatic function parse_TPM_reply_OIAP(s:seq) : TPMReply\r\n requires IsByteSeq(s);\r\n{\r\n if !is_TPM_reply_header_ok(s,TPM_TAG_RSP_COMMAND()) || |s| != 34 then\r\n TPMReplyInvalid_c()\r\n else\r\n TPMReplyOIAP() \r\n}\r\n\r\nstatic function parse_TPM_reply_LoadKey2(s:seq) : TPMReply\r\n requires IsByteSeq(s);\r\n{\r\n if !is_TPM_reply_header_ok(s, TPM_TAG_RSP_AUTH1_COMMAND()) || |s| != 55 then\r\n TPMReplyInvalid_c()\r\n else\r\n TPMReplyLoadKey2() \r\n}\r\n\r\n/********************************************************\r\n * Semantic-level TPM Commands\r\n ********************************************************/\r\n\r\nstatic predicate TPM_executed_extend_PCR_19(old_TPM:TPM_struct, new_TPM:TPM_struct)\r\n requires IsByteSeq(old_TPM.cmd_buf);\r\n requires IsByteSeq(new_TPM.reply_buf);\r\n{\r\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\r\n var reply := parse_TPM_reply_extend_PCR_19(new_TPM.reply_buf);\r\n cmd.TPMCommandExtendPCR19_c? &&\r\n (var data := cmd.value_to_extend;\r\n //- The PCR was successfully updated\r\n (reply.TPMReplyExtendPCR19_c? ==> new_TPM.PCR_19 == old_TPM.PCR_19 + [data])\r\n //- If it was updated at all, it was updated with data\r\n && (new_TPM.PCR_19 == old_TPM.PCR_19 || new_TPM.PCR_19 == old_TPM.PCR_19 + [data])\r\n && |new_TPM.reply_buf| > 0\r\n && new_TPM == old_TPM[cmd_state := CmdComplete()][reply_buf := new_TPM.reply_buf][PCR_19 := new_TPM.PCR_19])\r\n}\r\n\r\nstatic predicate TPM_executed_quote2(old_TPM:TPM_struct, new_TPM:TPM_struct)\r\n requires IsByteSeq(old_TPM.cmd_buf);\r\n requires IsByteSeq(new_TPM.reply_buf);\r\n{\r\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\r\n var reply := parse_TPM_reply_quote2(new_TPM.reply_buf);\r\n cmd.TPMCommandQuote2_c? &&\r\n (reply.TPMReplyQuote2_c? ==> Verve_quote(reply.pcr_info, reply.sig, cmd.nonce_external, old_TPM.PCR_19))\r\n && 0 < |new_TPM.reply_buf| <= power2(33)\r\n && new_TPM == old_TPM[cmd_state := CmdComplete()][reply_buf := new_TPM.reply_buf]\r\n}\r\n\r\nstatic predicate TPM_executed_get_random(old_TPM:TPM_struct, new_TPM:TPM_struct)\r\n requires IsByteSeq(old_TPM.cmd_buf);\r\n requires IsByteSeq(new_TPM.reply_buf);\r\n{\r\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\r\n var reply := parse_TPM_reply_get_random(new_TPM.reply_buf);\r\n cmd.TPMCommandGetRandom_c? &&\r\n (reply.TPMReplyGetRandom_c? ==>\r\n |reply.randoms| <= cmd.random_bytes\r\n && new_TPM.random_index == old_TPM.random_index + |reply.randoms|\r\n && (forall j :: 0 <= j < |reply.randoms| ==> reply.randoms[j] == TPM_random_byte(old_TPM.random_index + j)))\r\n && (reply.TPMReplyInvalid_c? ==> old_TPM.random_index == new_TPM.random_index)\r\n && new_TPM == old_TPM[cmd_state := CmdComplete()][reply_buf := new_TPM.reply_buf][random_index := new_TPM.random_index]\r\n}\r\n\r\nstatic predicate TPM_executed_read_PCR_17_or_18(old_TPM:TPM_struct, new_TPM:TPM_struct)\r\n requires IsByteSeq(old_TPM.cmd_buf);\r\n requires IsByteSeq(new_TPM.reply_buf);\r\n{\r\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\r\n var reply := parse_TPM_reply_read_PCR_17_or_18(new_TPM.reply_buf);\r\n cmd.TPMCommandReadPCR17Or18_c? &&\r\n (reply.TPMReplyReadPCR17Or18_c? ==> reply.pcr_value_read == PCR_val(cmd.pcr_to_read))\r\n && new_TPM == old_TPM[cmd_state := CmdComplete()][reply_buf := new_TPM.reply_buf]\r\n}\r\n\r\nstatic predicate TPM_executed_OIAP(old_TPM:TPM_struct, new_TPM:TPM_struct)\r\n requires IsByteSeq(old_TPM.cmd_buf);\r\n requires IsByteSeq(new_TPM.reply_buf);\r\n{\r\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\r\n var reply := parse_TPM_reply_OIAP(new_TPM.reply_buf);\r\n cmd.TPMCommandOIAP_c? &&\r\n new_TPM == old_TPM //- Doesn't affect any of the TPM state we track\r\n}\r\n\r\nstatic predicate TPM_executed_LoadKey2(old_TPM:TPM_struct, new_TPM:TPM_struct)\r\n requires IsByteSeq(old_TPM.cmd_buf);\r\n requires IsByteSeq(new_TPM.reply_buf);\r\n{\r\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\r\n var reply := parse_TPM_reply_LoadKey2(new_TPM.reply_buf);\r\n cmd.TPMCommandLoadKey2_c? &&\r\n new_TPM == old_TPM //- Doesn't affect any of the TPM state we track\r\n}\r\n\r\nstatic predicate TPM_executed_some_command(old_TPM:TPM_struct, new_TPM:TPM_struct)\r\n requires IsByteSeq(old_TPM.cmd_buf);\r\n requires IsByteSeq(new_TPM.reply_buf);\r\n{\r\n TPM_executed_extend_PCR_19(old_TPM, new_TPM)\r\n || TPM_executed_quote2(old_TPM, new_TPM)\r\n || TPM_executed_get_random(old_TPM, new_TPM)\r\n || TPM_executed_read_PCR_17_or_18(old_TPM, new_TPM)\r\n || TPM_executed_OIAP(old_TPM, new_TPM)\r\n || TPM_executed_LoadKey2(old_TPM, new_TPM)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/TPM/tpm-device.s.dfy.disabled", "content": "include \"../../Libraries/Math/power2.s.dfy\"\ninclude \"../../Libraries/Util/integer_sequences.s.dfy\"\ninclude \"../../Libraries/Util/relational.s.dfy\"\ninclude \"../../Libraries/Crypto/Hash/sha1.s.dfy\"\ninclude \"../IO/io_mem.s.dfy\"\n\n///////////////////////////////////////\n// App Spec Interface\n///////////////////////////////////////\n\n// App must specify an invariant on values it wants to write to the TPM then read later with assurance of integrity\nstatic function TPM_app_policy_okay_to_trust(trusted_data:seq) : bool\n\n////////////////////////////////////////////////////////////\n// Basic functions and datatypes\n// (Note: Sec. 2.1.1 of Part 2: Everything is big endian)\n////////////////////////////////////////////////////////////\n\ndatatype CommandState = Idle | AlmostReady | Ready | CmdReception | Executing | CmdComplete;\n\ndatatype TPM_struct = TPM_build(\n PCR_19 : seq>, // Since we allow extension of this PCR, this represents the sequence of things extended into the PCR\n NVRAM : seq>,\n NV_locked : bool, // Is the TPM enforcing NV restrictions?\n NV_perms_ok : seq,\n cmd_state : CommandState,\n cmd_buf : seq,\n reply_buf : seq,\n random_index : int // Tracks our current position in the stream of randomness from the TPM\n );\n\nstatic predicate TPM_valid(aTPM:TPM_struct)\n{\n |aTPM.NVRAM| == |aTPM.NV_perms_ok|\n && Word32(|aTPM.NVRAM|)\n && (forall i {:trigger IsByteSeqOfLen(aTPM.PCR_19[i], 20)} :: 0 <= i < |aTPM.PCR_19| ==> IsByteSeqOfLen(aTPM.PCR_19[i], 20)) // Must be sets of 20 bytes\n && IsByteSeq(aTPM.cmd_buf)\n && IsByteSeq(aTPM.reply_buf)\n && (forall a :: valid_nv_index(aTPM, a) ==> IsByteSeq(aTPM.NVRAM[a]) && Word32(|aTPM.NVRAM[a]|+14)) // Added +14 because size of read really must be a word\n}\n\nstatic predicate TPMs_match(TPM1:TPM_struct, TPM2:TPM_struct)\n{\n TPM1.PCR_19 == TPM2.PCR_19 &&\n TPM1.NVRAM == TPM2.NVRAM &&\n TPM1.NV_locked == TPM2.NV_locked &&\n TPM1.NV_perms_ok == TPM2.NV_perms_ok &&\n TPM1.random_index == TPM2.random_index\n}\n\n///////////////////////////////////////\n// Verve Entry Interface\n///////////////////////////////////////\n\n// Invariant that must be true on Verve entry, and that remains true throughout TPM executions\nstatic predicate TPM_satisfies_integrity_policy(aTPM:TPM_struct)\n{\n TPM_valid(aTPM) &&\n (forall a :: 0 <= a < |aTPM.NVRAM| && aTPM.NV_perms_ok[a] && aTPM.NV_locked ==>\n |aTPM.NVRAM[a]| == NV_size() && (TPM_app_policy_okay_to_trust(aTPM.NVRAM[a]) || aTPM.NVRAM[a] == newly_created_NV_value()))\n}\n\n// Verve entry should include:\n// requires TPM_valid(TPM);\n// requires TPM_satisfies_integrity_policy(TPM);\n// requires TPM.PCR_19 == [];\n\n// We model the infinite stream of randomness as a series of \"constants\" returned\n// by this function that are discovered by calls to read_random\nstatic function TPM_random_byte(index:int) : int\n\nstatic function TPM_random_bytes (old_random_index:int, new_random_index:int) : seq\n decreases new_random_index - old_random_index;\n{\n if old_random_index >= new_random_index then\n []\n else\n TPM_random_bytes(old_random_index, new_random_index-1) + [TPM_random_byte(new_random_index-1)]\n}\n\n// We only use this for 17 & 18, which don't change while we're executing\nstatic function PCR_val(index:int) : seq\n\n// Tracks whether we have taken control of the TPM at access level 3\n// Tracked via a function, since it cannot change while we execute\nstatic predicate Locality3_requested()\nstatic predicate Locality3_obtained()\n\nghost var{:readonly} TPM:TPM_struct;\n\n// \"Constants\"\nstatic function NV_size() : int\n{\n 256\n}\n\nstatic predicate valid_nv_index(aTPM:TPM_struct, a:int)\n{\n 0 <= a < |aTPM.NVRAM|\n && 0 <= a < |aTPM.NV_perms_ok|\n}\n\nstatic function newly_created_NV_value() : seq\n{\n RepeatDigit(0xFF, NV_size())\n}\n\n// Condenses all of the public information in the TPM\n// I.e., public = PCR_19 + all NVRAM for which !perms_ok\nstatic function TPM_public(aTPM:TPM_struct, s:seq) : bool\n{\n (exists i:int | 0 <= i < |aTPM.PCR_19| :: s == aTPM.PCR_19[i]) ||\n (exists a:int | 0 <= a < |aTPM.NVRAM| && 0 <= a < |aTPM.NV_perms_ok| && (!aTPM.NV_perms_ok[a] || !aTPM.NV_locked) :: s == aTPM.NVRAM[a])\n}\n/* TODO: dafnycc\nstatic function TPM_public(aTPM:TPM_struct) : set>\n{\n (set i:int | 0 <= i < |aTPM.PCR_19| :: aTPM.PCR_19[i]) +\n (set a:int | 0 <= a < |aTPM.NVRAM| && 0 <= a < |aTPM.NV_perms_ok| && (!aTPM.NV_perms_ok[a] || !aTPM.NV_locked) :: aTPM.NVRAM[a])\n}\n*/\n\n/********************************************************\n * Low-level TPM interactions\n ********************************************************/\n\nghost method {:axiom} TPM_enable_request_access()\n requires IoMemPerm.Null?;\n modifies this`IoMemPerm;\n ensures Locality3_requested();\n ensures IoMemPerm == IoWriteAddr(0xFED43000, 2); // movb 2 -> 0xFED43000 (0xFED4 || TPM_ACCESS_3 (3000h))\n\nghost method {:axiom} TPM_enable_check_access_status() returns (status:int)\n requires IoMemPerm.Null?;\n requires Locality3_requested();\n modifies this`IoMemPerm;\n ensures Word32(status); \n ensures |BEWordToBitSeq(status)| == 32;\n ensures BEWordToBitSeq(status)[26] == 1 ==> Locality3_obtained(); // bit 5 = activeLocality\n ensures IoMemPerm == IoReadAddr(0xFED43000, status);\n\n// See Table 16 of the TCG PC Client Spec 1.20\nghost method {:axiom} TPM_enable_issue_command_ready()\n requires IoMemPerm.Null?;\n requires Locality3_obtained();\n requires TPM_valid(TPM); \n ensures old(TPM.cmd_state.Idle? || TPM.cmd_state.AlmostReady?) ==> TPM.cmd_state.AlmostReady? || TPM.cmd_state.Ready?;\n ensures old(TPM.cmd_state.Ready?) ==> TPM.cmd_state == Ready;\n ensures old(TPM.cmd_state.CmdReception? || TPM.cmd_state.Executing? || TPM.cmd_state.CmdComplete?) ==> \n (TPM.cmd_state.Idle? || TPM.cmd_state.AlmostReady? || TPM.cmd_state.Ready?); // Depends on TPM impl and timeout values\n ensures TPM_valid(TPM);\n modifies this`TPM; \n modifies this`IoMemPerm;\n ensures TPM == old(TPM)[cmd_state := TPM.cmd_state][cmd_buf := []][reply_buf := []];\n ensures IoMemPerm == IoWriteAddr(0xFED43018, 0x40);\n\nghost method {:axiom} TPM_enable_check_command_ready() returns (status:int)\n requires IoMemPerm.Null?;\n requires Locality3_obtained();\n requires TPM_valid(TPM);\n requires TPM.cmd_state.AlmostReady? || TPM.cmd_state.Ready?;\n ensures Word32(status); \n ensures |BEWordToBitSeq(status)| == 32;\n ensures BEWordToBitSeq(status)[25] == 1 ==> TPM.cmd_state.Ready?; // bit 6 = commandReady\n ensures BEWordToBitSeq(status)[25] != 1 ==> TPM.cmd_state == old(TPM.cmd_state);\n ensures TPM_valid(TPM);\n modifies this`TPM; \n modifies this`IoMemPerm;\n ensures TPM == old(TPM)[cmd_state := TPM.cmd_state];\n ensures IoMemPerm == IoReadAddr(0xFED43018, status);\n\nghost method {:axiom} TPM_enable_write_FIFO(c:int)\n requires IoMemPerm.Null?;\n requires Locality3_obtained();\n requires TPM_valid(TPM);\n requires IsByte(c);\n requires TPM.cmd_state.Ready? || TPM.cmd_state.CmdReception?;\n ensures TPM_valid(TPM);\n modifies this`TPM; \n modifies this`IoMemPerm;\n ensures TPM == old(TPM)[cmd_state := CmdReception()][cmd_buf := old(TPM.cmd_buf) + [c]];\n ensures IoMemPerm == IoWriteAddr(0xFED43024, c);\n\nghost method {:axiom} TPM_enable_go()\n requires IoMemPerm.Null?;\n requires Locality3_obtained();\n requires TPM_valid(TPM);\n requires power2(32) == 0x100000000;\n requires forall new_TPM : TPM_struct :: async_TPM_execution(TPM, new_TPM) ==> TPM_satisfies_integrity_policy(new_TPM);\n requires TPM.cmd_state.CmdReception?;\n//dafnycc requires forall new_TPM : TPM_struct :: TPM_valid(new_TPM) && async_TPM_execution(TPM, new_TPM) ==> TPM_public(left(new_TPM)) == TPM_public(right(new_TPM));\n//Wait for SymDiff: requires forall new_TPM : TPM_struct :: TPM_valid(new_TPM) && async_TPM_execution(TPM, new_TPM) ==> forall s :: TPM_public(left(new_TPM), s) == TPM_public(right(new_TPM), s);\n ensures TPM_valid(TPM);\n modifies this`TPM; \n modifies this`IoMemPerm;\n ensures TPM == old(TPM)[cmd_state := Executing];\n ensures IoMemPerm == IoWriteAddr(0xFED43018, 0x20);\n\nghost method {:axiom} TPM_enable_check_data_available() returns (r:int)\n requires IoMemPerm.Null?;\n requires Locality3_obtained();\n requires TPM_valid(TPM);\n requires TPM.cmd_state.Executing? || TPM.cmd_state.CmdComplete?;\n requires power2(32) == 0x100000000;\n ensures TPM_valid(TPM);\n ensures old(TPM.cmd_state.Executing?) ==> async_TPM_execution(old(TPM), TPM) // May bump us to CmdComplete, or may leave us in Executing\n && (r == 0x90 <==> TPM.cmd_state.CmdComplete?); // 0x90 = TIS_STS_VALID (0x80) + TIS_STS_DATA_AVAIL (0x10)\n ensures old(TPM.cmd_state.CmdComplete?) ==> (r == 0x90 ==> |TPM.reply_buf| > 0) && old(TPM) == TPM;\n ensures old(TPM.cmd_state.CmdComplete?) ==> (r == 0x80 ==> |TPM.reply_buf| == 0) && old(TPM) == TPM;\n modifies this`TPM; // Modifications specified by Async_TPM, so no additional details below\n modifies this`IoMemPerm;\n ensures IoMemPerm == IoReadAddr(0xFED43018, r);\n\nghost method {:axiom} TPM_enable_read_FIFO() returns (c:int)\n requires IoMemPerm.Null?;\n requires Locality3_obtained();\n requires TPM_valid(TPM);\n requires TPM.cmd_state.CmdComplete? && |TPM.reply_buf| > 0;\n ensures TPM_valid(TPM);\n ensures old(TPM.reply_buf) == [c] + TPM.reply_buf;\n ensures IsByte(c);\n modifies this`TPM; \n modifies this`IoMemPerm;\n ensures TPM == old(TPM)[reply_buf := TPM.reply_buf];\n ensures IoMemPerm == IoReadAddr(0xFED43024, c);\n\nstatic predicate async_TPM_execution(old_TPM:TPM_struct, new_TPM:TPM_struct)\n requires IsByteSeq(old_TPM.cmd_buf);\n{\n // We execute a valid command\n (IsByteSeq(new_TPM.reply_buf) && |new_TPM.reply_buf| > 0 && TPM_executed_some_command(old_TPM, new_TPM))\n ||\n // Or there's a valid command present, but the TPM is still executing it\n (valid_cmd_present(old_TPM) && old_TPM == new_TPM)\n ||\n // Or there's an unexpected command, so we know nothing about the TPM's state\n !valid_cmd_present(old_TPM)\n // havoc!\n\n}\n\n/***************************************\n * TPM Tags\n ***************************************/\n\nstatic function TPM_TAG_RQU_COMMAND() : seq\n{\n [ 0, 0xC1 ]\n}\n\nstatic function TPM_TAG_RQU_AUTH1_COMMAND() : seq\n{\n [ 0, 0xC2 ]\n}\n\nstatic function method TPM_TAG_RSP_COMMAND() : seq\n{\n [ 0, 0xC4 ]\n}\n\nstatic function method TPM_TAG_RSP_AUTH1_COMMAND() : seq\n{\n [ 0, 0xC5 ]\n}\n\nstatic function method TPM_TAG_NV_DATA_PUBLIC() : seq\n{\n [ 0, 0x18 ]\n}\n\nstatic function method TPM_TAG_NV_ATTRIBUTES() : seq\n{\n [ 0, 23 ]\n}\n\nstatic function TPM_TAG_PERMANENT_FLAGS() : seq\n{\n [ 0, 0x1f ]\n}\n\n/***************************************\n * TPM Command Ordinals\n ***************************************/\n\nstatic function TPM_ORD_GetCapability() : int\n{\n 0x65\n}\n\nstatic function TPM_ORD_NV_ReadValue() : int\n{\n 0xCF\n}\n\nstatic function TPM_ORD_NV_WriteValue() : int\n{\n 0xCD\n}\n\nstatic function TPM_ORD_Extend() : int\n{\n 0x14\n}\n\nstatic function TPM_ORD_Quote2() : int\n{\n 0x3E\n}\n\nstatic function TPM_ORD_GetRandom() : int\n{\n 0x46\n}\n\nstatic function TPM_ORD_PcrRead() : int\n{\n 0x15\n}\n\nstatic function TPM_ORD_OIAP() : int\n{\n 0x0A\n}\n\nstatic function TPM_ORD_LoadKey2() : int\n{\n 0x41\n}\n\nstatic function TPM_CAP_NV_INDEX() : int\n{\n 0x11\n}\n\nstatic function TPM_CAP_FLAG() : int\n{\n 4\n}\n\nstatic function TPM_CAP_FLAG_PERMANENT() : int\n{\n 0x00000108\n}\n\n/***************************************\n * TPM return codes\n ***************************************/\n\nstatic function method TPM_SUCCESS() : int\n{\n 0\n}\n\n/********************************************************\n * TPM structure parsing\n ********************************************************/\n\nstatic function method PCR_SELECTION_covering_PCRs_17_and_18() : seq\n{\n [ 0, 3, 0, 0, 6 ] // pcrSelection = size (0x0003), PCR bit map. Selects PCR 17 & 18 from byte 2 (0-indexed\n}\n\nstatic function method PCR_SELECTION_covering_PCRs_17_through_19() : seq\n{\n [ 0, 3, 0, 0, 14 ] // pcrSelection = size (0x0003), PCR bit map. Selects PCR 17, 18, 19 from byte 2 (0-indexed\n}\n\ndatatype PCRInfoShort = PCRInfoShort17And18_c(pcrs_17_18_digest:seq) |\n PCRInfoShort17Through19_c(pcrs_17_18_19_digest:seq) |\n PCRInfoShortInvalid_c()\n\nstatic function parse_PCR_info_short(s:seq) : PCRInfoShort\n{\n if |s| != 26 then\n PCRInfoShortInvalid_c()\n else\n (\n var fields := s[5 :1 :20 ];\n var pcr_selection, localities_bit_vector, pcrs_digest :=\n fields[0], fields[1], fields[2];\n // Note: we don't care about the localities: NVRAM uses PCR protections and it's irrelevant for Quote\n if pcr_selection == PCR_SELECTION_covering_PCRs_17_through_19() then\n PCRInfoShort17Through19_c(pcrs_digest)\n else if pcr_selection == PCR_SELECTION_covering_PCRs_17_and_18() then\n PCRInfoShort17And18_c(pcrs_digest)\n else \n PCRInfoShortInvalid_c()\n )\n}\n\nstatic predicate is_TPM_COMPOSITE_HASH(h:seq, PCR_17:seq, PCR_18:seq)\n{\n var pcr_composite := PCR_SELECTION_covering_PCRs_17_and_18() +\n [0, 0, 0, 40] + // size of next two PCRs\n PCR_17 + PCR_18;\n IsByteSeq(pcr_composite) &&\n (var pcr_composite_bits := BEByteSeqToBitSeq(pcr_composite);\n IsBitSeq(pcr_composite_bits) && |pcr_composite_bits| < power2(64) &&\n h == BEWordSeqToByteSeq(SHA1(pcr_composite_bits)))\n}\n\nstatic predicate Verve_quote(pcr_info:seq, sig:seq, nonce:seq, PCR_19_history:seq>)\n\n/********************************************************\n * TPM command parsing\n ********************************************************/\n\ndatatype TPMCommand = TPMCommandQuote2_c(nonce_external:seq, key_handle:seq, auth_handle:seq) |\n TPMCommandReadPCR17Or18_c(pcr_to_read:int) |\n TPMCommandExtendPCR19_c(value_to_extend:seq) |\n TPMCommandGetRandom_c(random_bytes:int) |\n TPMCommandGetNVRAMCapability_c(nvindex_to_get_cap:int) |\n TPMCommandGetPermanentFlags_c() |\n TPMCommandReadNVRAM_c(nvindex_to_read:int) |\n TPMCommandWriteNVRAM_c(nvindex_to_write:int, value_to_write:seq) |\n TPMCommandOIAP_c() |\n TPMCommandLoadKey2_c() |\n TPMCommandInvalid_c()\n\nstatic function parse_TPM_command_quote2(s:seq) : TPMCommand\n requires IsByteSeq(s);\n{\n if |s| != 85 then\n TPMCommandInvalid_c()\n else\n (\n var fields := s[10 :4 :20 :5 :1 :4 :20 :1 :20 ];\n var _, key_handle, nonce_external, pcr_selection, add_version, auth_handle, nonce_odd, continue_auth_session, priv_auth :=\n fields[0], fields[1], fields[2], fields[3], fields[4], fields[5], fields[6], fields[7], fields[8] ;\n if pcr_selection == PCR_SELECTION_covering_PCRs_17_through_19() &&\n add_version == [1] && // When TRUE add TPM_CAP_VERSION_INFO to the output\n continue_auth_session == [1] then // continueAuthSession?\n TPMCommandQuote2_c(nonce_external, key_handle, auth_handle)\n else\n TPMCommandInvalid_c()\n )\n}\n\nstatic function parse_TPM_command_read_PCR_17_or_18(s:seq) : TPMCommand\n requires IsByteSeq(s);\n{\n if |s| != 14 then\n TPMCommandInvalid_c()\n else\n (\n var pcr := BEByteSeqToInt(s[10..14]);\n if pcr == 17 || pcr == 18 then\n TPMCommandReadPCR17Or18_c(pcr)\n else\n TPMCommandInvalid_c()\n )\n}\n\nstatic function parse_TPM_command_extend_PCR_19(s:seq) : TPMCommand\n requires IsByteSeq(s);\n{\n if |s| != 34 then\n TPMCommandInvalid_c()\n else\n (\n var fields := s[10 :4 :20 ];\n var _, pcr, data :=\n fields[0], fields[1], fields[2] ;\n if BEByteSeqToInt(pcr) == 19 then\n TPMCommandExtendPCR19_c(data)\n else\n TPMCommandInvalid_c()\n )\n}\n\nstatic function parse_TPM_command_get_random(s:seq) : TPMCommand\n requires IsByteSeq(s);\n{\n if |s| != 14 then\n TPMCommandInvalid_c()\n else\n (\n var random_bytes := BEByteSeqToInt(s[10..14]);\n TPMCommandGetRandom_c(random_bytes)\n )\n}\n\nstatic function parse_TPM_command_get_capability(s:seq) : TPMCommand\n requires IsByteSeq(s);\n{\n if |s| != 22 then\n TPMCommandInvalid_c()\n else\n (\n var fields := s[10 :4 :4 :4 ];\n var _, capability_area, subcap_size, subcap :=\n fields[0], BEByteSeqToInt(fields[1]), BEByteSeqToInt(fields[2]), BEByteSeqToInt(fields[3]) ;\n if subcap_size != 4 then\n TPMCommandInvalid_c()\n else\n if capability_area == TPM_CAP_NV_INDEX() then\n TPMCommandGetNVRAMCapability_c(subcap)\n else if capability_area == TPM_CAP_FLAG() then\n if subcap == TPM_CAP_FLAG_PERMANENT() then\n TPMCommandGetPermanentFlags_c()\n else\n TPMCommandInvalid_c()\n else\n TPMCommandInvalid_c()\n )\n}\n\nstatic function parse_TPM_command_read_NVRAM(s:seq) : TPMCommand\n requires IsByteSeq(s);\n{\n if |s| != 22 then\n TPMCommandInvalid_c()\n else\n (\n var fields := s[10 :4 :4 :4 ];\n var _, nvindex, offset, data_size :=\n fields[0], BEByteSeqToInt(fields[1]), BEByteSeqToInt(fields[2]), BEByteSeqToInt(fields[3]) ;\n if offset == 0 && data_size == NV_size() then\n TPMCommandReadNVRAM_c(nvindex)\n else\n TPMCommandInvalid_c()\n )\n}\n\nstatic function parse_TPM_command_write_NVRAM(s:seq) : TPMCommand\n requires IsByteSeq(s);\n{\n if |s| != 22 + NV_size() then\n TPMCommandInvalid_c()\n else\n (\n var fields := s[10 :4 :4 :4 ];\n var _, nvindex, offset, data_size :=\n fields[0], BEByteSeqToInt(fields[1]), BEByteSeqToInt(fields[2]), BEByteSeqToInt(fields[3]) ;\n if offset == 0 && data_size == NV_size() then\n (\n var data := s[22..22+NV_size()];\n TPMCommandWriteNVRAM_c(nvindex, data)\n )\n else\n TPMCommandInvalid_c()\n )\n}\n\nstatic function parse_TPM_command_OIAP(s:seq) : TPMCommand\n requires IsByteSeq(s);\n{\n if |s| != 10 then\n TPMCommandInvalid_c()\n else\n TPMCommandOIAP_c() // Nothing to the command but the header\n}\n\nstatic function parse_TPM_command_LoadKey2(s:seq) : TPMCommand\n requires IsByteSeq(s);\n{\n if |s| < 59 then\n TPMCommandInvalid_c()\n else\n TPMCommandLoadKey2_c() // Nothing to track for security purposes\n}\n\nstatic function parse_TPM_command(s:seq) : TPMCommand\n requires IsByteSeq(s);\n{\n if |s| < 10 then\n TPMCommandInvalid_c()\n else\n (\n var fields := s[2 :4 :4 ];\n var tag, length, command :=\n fields[0], fields[1], fields[2];\n var command_code := BEByteSeqToInt(command);\n if BEByteSeqToInt(length) != |s| then\n TPMCommandInvalid_c()\n else if tag == TPM_TAG_RQU_COMMAND() then\n (\n if command_code == TPM_ORD_PcrRead() then\n parse_TPM_command_read_PCR_17_or_18(s)\n else if command_code == TPM_ORD_Extend() then\n parse_TPM_command_extend_PCR_19(s)\n else if command_code == TPM_ORD_GetRandom() then\n parse_TPM_command_get_random(s)\n else if command_code == TPM_ORD_GetCapability() then\n parse_TPM_command_get_capability(s)\n else if command_code == TPM_ORD_NV_ReadValue() then\n parse_TPM_command_read_NVRAM(s)\n else if command_code == TPM_ORD_NV_WriteValue() then\n parse_TPM_command_write_NVRAM(s)\n else if command_code == TPM_ORD_OIAP() then\n parse_TPM_command_OIAP(s)\n else if command_code == TPM_ORD_LoadKey2() then\n parse_TPM_command_LoadKey2(s)\n else\n TPMCommandInvalid_c()\n )\n else if tag == TPM_TAG_RQU_AUTH1_COMMAND() then\n (\n if command_code == TPM_ORD_Quote2() then\n parse_TPM_command_quote2(s)\n else if command_code == TPM_ORD_LoadKey2() then\n parse_TPM_command_LoadKey2(s)\n else\n TPMCommandInvalid_c()\n )\n else\n TPMCommandInvalid_c()\n )\n}\n\nstatic predicate valid_cmd(s:seq)\n requires IsByteSeq(s);\n{\n !(parse_TPM_command(s).TPMCommandInvalid_c?)\n}\n\nstatic predicate {:autoReq} valid_cmd_present(aTPM:TPM_struct)\n{\n valid_cmd(aTPM.cmd_buf)\n}\n\n/********************************************************\n * TPM reply parsing\n ********************************************************/\n\ndatatype TPMReply = TPMReplyQuote2_c(nonce_even:seq, pcr_info:seq, sig:seq) |\n TPMReplyReadPCR17Or18_c(pcr_value_read:seq) |\n TPMReplyExtendPCR19_c() |\n TPMReplyGetRandom_c(randoms:seq) |\n TPMReplyGetNVRAMCapability_c(nvindex:int, pcrs_digest:seq, data_size:int) |\n TPMReplyGetPermanentFlags_c(nv_locked:bool) |\n TPMReplyReadNVRAM_c(nvram_value_read:seq) |\n TPMReplyWriteNVRAM_c() |\n TPMReplyOIAP() |\n TPMReplyLoadKey2() |\n TPMReplyInvalid_c()\n\nstatic predicate is_TPM_reply_header_ok(s:seq, expected_tag:seq)\n requires IsByteSeq(s);\n{\n |s| >= 10 &&\n (var fields := s[2 :4 :4 ];\n var tag, length, return_code :=\n fields[0], BEByteSeqToInt(fields[1]), BEByteSeqToInt(fields[2]) ;\n tag == expected_tag &&\n length == |s| &&\n return_code == TPM_SUCCESS())\n}\n\n// REVIEW: Why so much detail about the reply?\nstatic function parse_TPM_reply_quote2(s:seq) : TPMReply\n requires IsByteSeq(s);\n{\n if !is_TPM_reply_header_ok(s,TPM_TAG_RSP_AUTH1_COMMAND()) || |s| < 40 then\n TPMReplyInvalid_c()\n else\n (\n var f_a := s[10 :26 :4 ];\n var _, pcr_info_bytes, version_info_size :=\n f_a[0], f_a[1], BEByteSeqToInt(f_a[2]) ;\n var pcr_info := parse_PCR_info_short(pcr_info_bytes);\n if !pcr_info.PCRInfoShort17Through19_c? || |s| < 44 + version_info_size || version_info_size < 0 then\n TPMReplyInvalid_c()\n else\n (\n var f_b := s[40 :version_info_size :4 ];\n var _, version_info, sig_size :=\n f_b[0], f_b[1], BEByteSeqToInt(f_b[2]) ;\n if |s| != 85 + version_info_size + sig_size || sig_size < 0 then\n TPMReplyInvalid_c()\n else\n (\n var f_c := s[44+version_info_size :sig_size :20 :1 :20 ];\n var _, sig, nonce_even, continue_session, res_auth :=\n f_c[0], f_c[1], f_c[2], f_c[3], f_c[4] ;\n if continue_session == [1] then\n TPMReplyQuote2_c(nonce_even, pcr_info_bytes, sig)\n else\n TPMReplyInvalid_c()\n )\n )\n )\n}\n\nstatic function parse_TPM_reply_read_PCR_17_or_18(s:seq) : TPMReply\n requires IsByteSeq(s);\n{\n if !is_TPM_reply_header_ok(s,TPM_TAG_RSP_COMMAND()) || |s| != 30 then\n TPMReplyInvalid_c()\n else\n TPMReplyReadPCR17Or18_c(s[10..30])\n}\n\nstatic function parse_TPM_reply_extend_PCR_19(s:seq) : TPMReply\n requires IsByteSeq(s);\n{\n if !is_TPM_reply_header_ok(s,TPM_TAG_RSP_COMMAND()) || |s| != 30 then\n TPMReplyInvalid_c()\n else\n TPMReplyExtendPCR19_c()\n}\n\nstatic function parse_TPM_reply_get_random(s:seq) : TPMReply\n requires IsByteSeq(s);\n{\n if !is_TPM_reply_header_ok(s,TPM_TAG_RSP_COMMAND()) || |s| < 14 then\n TPMReplyInvalid_c()\n else\n (\n var random_bytes_size := BEByteSeqToInt(s[10..14]);\n if |s| != 14 + random_bytes_size || random_bytes_size < 0 then\n TPMReplyInvalid_c()\n else\n TPMReplyGetRandom_c(s[14..14+random_bytes_size])\n )\n}\n\nstatic function parse_TPM_reply_get_NVRAM_capability(s:seq) : TPMReply\n requires IsByteSeq(s);\n{\n if !is_TPM_reply_header_ok(s,TPM_TAG_RSP_COMMAND()) || |s| != 85 then\n TPMReplyInvalid_c()\n else\n (\n var fields := s[10 :4 :2 :4 :26 :26 :2 :4 :1 :1 :1 :4 ];\n var _, resp_size, tag, nvindex, pcr_info_read, pcr_info_write, permission_tag, permission_attributes, read_st_clear, write_st_clear, write_define, data_size :=\n fields[0], BEByteSeqToInt(fields[1]), fields[2], BEByteSeqToInt(fields[3]), parse_PCR_info_short(fields[4]), parse_PCR_info_short(fields[5]), fields[6], fields[7], fields[8], fields[9], fields[10], BEByteSeqToInt(fields[11]) ;\n if resp_size == 71 &&\n tag == TPM_TAG_NV_DATA_PUBLIC() &&\n pcr_info_read.PCRInfoShort17And18_c? && pcr_info_write.PCRInfoShort17And18_c? &&\n pcr_info_read.pcrs_17_18_digest == pcr_info_write.pcrs_17_18_digest &&\n permission_tag == TPM_TAG_NV_ATTRIBUTES() &&\n permission_attributes == [ 0, 0, 0x20, 0 ] && // TPM_NV_PER_WRITEDEFINE=bit 13=0x20\n read_st_clear == [0] && // bReadSTClear: Set to FALSE on each TPM_Startup(ST_Clear) and set to TRUE after a ReadValuexxx with datasize of 0\n write_st_clear == [0] && // bWriteSTClear: Set to FALSE on each TPM_Startup(ST_CLEAR) and set to TRUE after a WriteValuexxx with a datasize of 0.\n write_define == [0] then // bWriteDefine: Set to FALSE after TPM_NV_DefineSpace and set to TRUE after a successful WriteValuexxx with a datasize of 0\n TPMReplyGetNVRAMCapability_c(nvindex, pcr_info_read.pcrs_17_18_digest, data_size)\n else\n TPMReplyInvalid_c()\n )\n}\n\nstatic function parse_TPM_reply_get_permanent_flags(s:seq) : TPMReply\n requires IsByteSeq(s);\n{\n if !is_TPM_reply_header_ok(s,TPM_TAG_RSP_COMMAND()) || |s| != 36 then\n TPMReplyInvalid_c()\n else\n (\n var fields := s[10 :4 :2 :15 :1 ];\n var _, resp_size, tag, _, nv_locked :=\n fields[0], BEByteSeqToInt(fields[1]), fields[2], fields[3], fields[4] ;\n if resp_size == 22 && \n tag == TPM_TAG_PERMANENT_FLAGS() &&\n (nv_locked == [0] || nv_locked == [1]) then\n TPMReplyGetPermanentFlags_c(nv_locked == [1])\n else\n TPMReplyInvalid_c()\n )\n}\n\nstatic function parse_TPM_reply_read_NVRAM(s:seq) : TPMReply\n requires IsByteSeq(s);\n{\n if !is_TPM_reply_header_ok(s,TPM_TAG_RSP_COMMAND()) || |s| < 14 then\n TPMReplyInvalid_c()\n else\n (\n var data_size := BEByteSeqToInt(s[10..14]);\n if |s| == 14 + data_size then\n TPMReplyReadNVRAM_c(s[14..14+data_size])\n else\n TPMReplyInvalid_c()\n )\n}\n\nstatic function parse_TPM_reply_write_NVRAM(s:seq) : TPMReply\n requires IsByteSeq(s);\n{\n if !is_TPM_reply_header_ok(s,TPM_TAG_RSP_COMMAND()) || |s| != 10 then\n TPMReplyInvalid_c()\n else\n TPMReplyWriteNVRAM_c()\n}\n\nstatic function parse_TPM_reply_OIAP(s:seq) : TPMReply\n requires IsByteSeq(s);\n{\n if !is_TPM_reply_header_ok(s,TPM_TAG_RSP_COMMAND()) || |s| != 34 then\n TPMReplyInvalid_c()\n else\n TPMReplyOIAP() // For security purposes, we don't care. We only use this for quote, which is checked remotely\n}\n\nstatic function parse_TPM_reply_LoadKey2(s:seq) : TPMReply\n requires IsByteSeq(s);\n{\n if !is_TPM_reply_header_ok(s, TPM_TAG_RSP_AUTH1_COMMAND()) || |s| != 55 then\n TPMReplyInvalid_c()\n else\n TPMReplyLoadKey2() // For security purposes, we don't care. We only use this for quote, which is checked remotely\n}\n\n/********************************************************\n * Semantic-level TPM Commands\n ********************************************************/\n\nstatic predicate TPM_executed_read_NVRAM(old_TPM:TPM_struct, new_TPM:TPM_struct)\n requires IsByteSeq(old_TPM.cmd_buf);\n requires IsByteSeq(new_TPM.reply_buf);\n{\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\n var reply := parse_TPM_reply_read_NVRAM(new_TPM.reply_buf);\n cmd.TPMCommandReadNVRAM_c? &&\n (reply.TPMReplyReadNVRAM_c? ==> valid_nv_index(old_TPM, cmd.nvindex_to_read) && reply.nvram_value_read == old_TPM.NVRAM[cmd.nvindex_to_read])\n && new_TPM == old_TPM[cmd_state := CmdComplete()][reply_buf := new_TPM.reply_buf]\n}\n\n\nstatic predicate TPM_executed_write_NVRAM(old_TPM:TPM_struct, new_TPM:TPM_struct)\n requires IsByteSeq(old_TPM.cmd_buf);\n requires IsByteSeq(new_TPM.reply_buf);\n{\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\n var reply := parse_TPM_reply_write_NVRAM(new_TPM.reply_buf);\n cmd.TPMCommandWriteNVRAM_c? &&\n (var a := cmd.nvindex_to_write;\n // If we get a successful reply, then the NVRAM has been updated to the requested value\n (reply.TPMReplyWriteNVRAM_c? ==> valid_nv_index(new_TPM, a) && new_TPM.NVRAM[a] == cmd.value_to_write)\n // If the NVRAM was updated, it was updated to the requested value\n // Note that this used to say:\n // reply.TPMReplyInvalid_c? ==> old_TPM.NVRAM == new_TPM.NVRAM\n // but, to be paranoid, we allow an error code to be returned even if the value was updated.\n && (valid_nv_index(old_TPM, a) && valid_nv_index(new_TPM, a) ==> new_TPM.NVRAM[a] == old_TPM.NVRAM[a] || new_TPM.NVRAM[a] == cmd.value_to_write)\n // All other NVRAM locations are unaffected\n && |old_TPM.NVRAM| == |new_TPM.NVRAM|\n && (forall a':int ::\n valid_nv_index(old_TPM, a') && valid_nv_index(new_TPM, a') && a' != a ==>\n new_TPM.NVRAM[a'] == old_TPM.NVRAM[a'])\n && |new_TPM.reply_buf| > 0\n && new_TPM == old_TPM[cmd_state := CmdComplete()][reply_buf := new_TPM.reply_buf][NVRAM := new_TPM.NVRAM])\n}\n\nstatic predicate TPM_executed_extend_PCR_19(old_TPM:TPM_struct, new_TPM:TPM_struct)\n requires IsByteSeq(old_TPM.cmd_buf);\n requires IsByteSeq(new_TPM.reply_buf);\n{\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\n var reply := parse_TPM_reply_extend_PCR_19(new_TPM.reply_buf);\n cmd.TPMCommandExtendPCR19_c? &&\n (var data := cmd.value_to_extend;\n // The PCR was successfully updated\n (reply.TPMReplyExtendPCR19_c? ==> new_TPM.PCR_19 == old_TPM.PCR_19 + [data])\n // If it was updated at all, it was updated with data\n && (new_TPM.PCR_19 == old_TPM.PCR_19 || new_TPM.PCR_19 == old_TPM.PCR_19 + [data])\n && |new_TPM.reply_buf| > 0\n && new_TPM == old_TPM[cmd_state := CmdComplete()][reply_buf := new_TPM.reply_buf][PCR_19 := new_TPM.PCR_19])\n}\n\nstatic predicate TPM_executed_get_NVRAM_capability(old_TPM:TPM_struct, new_TPM:TPM_struct)\n requires IsByteSeq(old_TPM.cmd_buf);\n requires IsByteSeq(new_TPM.reply_buf);\n{\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\n var reply := parse_TPM_reply_get_NVRAM_capability(new_TPM.reply_buf);\n cmd.TPMCommandGetNVRAMCapability_c? &&\n (var a := cmd.nvindex_to_get_cap;\n (reply.TPMReplyGetNVRAMCapability_c?\n && reply.nvindex == a\n && is_TPM_COMPOSITE_HASH(reply.pcrs_digest, PCR_val(17), PCR_val(18))\n && reply.data_size == NV_size()\n ==> valid_nv_index(old_TPM, a) && old_TPM.NV_perms_ok[a])\n && |new_TPM.reply_buf| > 0\n && new_TPM == old_TPM[cmd_state := CmdComplete()][reply_buf := new_TPM.reply_buf])\n}\n\nstatic predicate TPM_executed_get_permanent_flags(old_TPM:TPM_struct, new_TPM:TPM_struct)\n requires IsByteSeq(old_TPM.cmd_buf);\n requires IsByteSeq(new_TPM.reply_buf);\n{\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\n var reply := parse_TPM_reply_get_permanent_flags(new_TPM.reply_buf);\n cmd.TPMCommandGetPermanentFlags_c? &&\n (reply.TPMReplyGetPermanentFlags_c? ==> reply.nv_locked == old_TPM.NV_locked)\n && new_TPM == old_TPM[cmd_state := CmdComplete()][reply_buf := new_TPM.reply_buf]\n}\n\nstatic predicate TPM_executed_quote2(old_TPM:TPM_struct, new_TPM:TPM_struct)\n requires IsByteSeq(old_TPM.cmd_buf);\n requires IsByteSeq(new_TPM.reply_buf);\n{\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\n var reply := parse_TPM_reply_quote2(new_TPM.reply_buf);\n cmd.TPMCommandQuote2_c? &&\n (reply.TPMReplyQuote2_c? ==> Verve_quote(reply.pcr_info, reply.sig, cmd.nonce_external, old_TPM.PCR_19))\n && 0 < |new_TPM.reply_buf| <= power2(33)\n && new_TPM == old_TPM[cmd_state := CmdComplete()][reply_buf := new_TPM.reply_buf]\n}\n\nstatic predicate TPM_executed_get_random(old_TPM:TPM_struct, new_TPM:TPM_struct)\n requires IsByteSeq(old_TPM.cmd_buf);\n requires IsByteSeq(new_TPM.reply_buf);\n{\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\n var reply := parse_TPM_reply_get_random(new_TPM.reply_buf);\n cmd.TPMCommandGetRandom_c? &&\n (reply.TPMReplyGetRandom_c? ==>\n |reply.randoms| <= cmd.random_bytes\n && new_TPM.random_index == old_TPM.random_index + |reply.randoms|\n && (forall j :: 0 <= j < |reply.randoms| ==> reply.randoms[j] == TPM_random_byte(old_TPM.random_index + j)))\n && (reply.TPMReplyInvalid_c? ==> old_TPM.random_index == new_TPM.random_index)\n && new_TPM == old_TPM[cmd_state := CmdComplete()][reply_buf := new_TPM.reply_buf][random_index := new_TPM.random_index]\n}\n\nstatic predicate TPM_executed_read_PCR_17_or_18(old_TPM:TPM_struct, new_TPM:TPM_struct)\n requires IsByteSeq(old_TPM.cmd_buf);\n requires IsByteSeq(new_TPM.reply_buf);\n{\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\n var reply := parse_TPM_reply_read_PCR_17_or_18(new_TPM.reply_buf);\n cmd.TPMCommandReadPCR17Or18_c? &&\n (reply.TPMReplyReadPCR17Or18_c? ==> reply.pcr_value_read == PCR_val(cmd.pcr_to_read))\n && new_TPM == old_TPM[cmd_state := CmdComplete()][reply_buf := new_TPM.reply_buf]\n}\n\nstatic predicate TPM_executed_OIAP(old_TPM:TPM_struct, new_TPM:TPM_struct)\n requires IsByteSeq(old_TPM.cmd_buf);\n requires IsByteSeq(new_TPM.reply_buf);\n{\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\n var reply := parse_TPM_reply_OIAP(new_TPM.reply_buf);\n cmd.TPMCommandOIAP_c? &&\n new_TPM == old_TPM // Doesn't affect any of the TPM state we track\n}\n\nstatic predicate TPM_executed_LoadKey2(old_TPM:TPM_struct, new_TPM:TPM_struct)\n requires IsByteSeq(old_TPM.cmd_buf);\n requires IsByteSeq(new_TPM.reply_buf);\n{\n var cmd := parse_TPM_command(old_TPM.cmd_buf);\n var reply := parse_TPM_reply_LoadKey2(new_TPM.reply_buf);\n cmd.TPMCommandLoadKey2_c? &&\n new_TPM == old_TPM // Doesn't affect any of the TPM state we track\n}\n\nstatic predicate TPM_executed_some_command(old_TPM:TPM_struct, new_TPM:TPM_struct)\n requires IsByteSeq(old_TPM.cmd_buf);\n requires IsByteSeq(new_TPM.reply_buf);\n{\n TPM_executed_read_NVRAM(old_TPM, new_TPM)\n || TPM_executed_write_NVRAM(old_TPM, new_TPM)\n || TPM_executed_extend_PCR_19(old_TPM, new_TPM)\n || TPM_executed_get_NVRAM_capability(old_TPM, new_TPM)\n || TPM_executed_get_permanent_flags(old_TPM, new_TPM)\n || TPM_executed_quote2(old_TPM, new_TPM)\n || TPM_executed_get_random(old_TPM, new_TPM)\n || TPM_executed_read_PCR_17_or_18(old_TPM, new_TPM)\n || TPM_executed_OIAP(old_TPM, new_TPM)\n || TPM_executed_LoadKey2(old_TPM, new_TPM)\n}\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/TPM/tpm-driver.i.dfy", "content": "include \"tpm-device.s.dfy\"\r\ninclude \"../../Libraries/Math/mul.i.dfy\"\r\ninclude \"../../Libraries/Math/div.i.dfy\"\r\ninclude \"../../Libraries/Math/power2.i.dfy\"\r\ninclude \"../../Libraries/Math/bit_vector_lemmas_premium.i.dfy\"\r\ninclude \"../../Libraries/Util/integer_sequences.i.dfy\"\r\ninclude \"../CPU/assembly_premium.i.dfy\"\r\ninclude \"../IO/io_mem.i.dfy\"\r\n\r\nstatic function method{:CompiledSpec} CompiledSpec_TPM_TAG_RSP_COMMAND() : seq\r\nstatic function method{:CompiledSpec} CompiledSpec_TPM_TAG_RSP_AUTH1_COMMAND() : seq\r\n/*\r\nstatic function method{:CompiledSpec} CompiledSpec_TPM_TAG_NV_DATA_PUBLIC() : seq\r\nstatic function method{:CompiledSpec} CompiledSpec_TPM_TAG_NV_ATTRIBUTES() : seq\r\n*/\r\nstatic function method{:CompiledSpec} CompiledSpec_TPM_SUCCESS() : int\r\nstatic function method{:CompiledSpec} CompiledSpec_PCR_SELECTION_covering_PCRs_17_and_18() : seq\r\nstatic function method{:CompiledSpec} CompiledSpec_PCR_SELECTION_covering_PCRs_17_through_19() : seq\r\n\r\n\r\n/***************************************************************************\r\n * TPM INSTRUCTION WRAPPERS\r\n ***************************************************************************/\r\n\r\nmethod TPM_instr_request_access()\r\n requires IoMemPerm.Null?;\r\n modifies this`IoMemPerm;\r\n ensures Locality3_requested();\r\n ensures IoMemPerm.Null?;\r\n{\r\n TPM_enable_request_access();\r\n IoMemAddrWrite(0xFED43000, 2);\r\n}\r\n\r\nmethod TPM_instr_check_access_status() returns (status:int)\r\n requires IoMemPerm.Null?;\r\n requires Locality3_requested();\r\n modifies this`IoMemPerm;\r\n ensures Word32(status); \r\n ensures |BEWordToBitSeq(status)| == 32;\r\n ensures BEWordToBitSeq(status)[26] == 1 ==> Locality3_obtained(); //- bit 5 = activeLocality\r\n ensures IoMemPerm.Null?;\r\n{\r\n ghost var _ := TPM_enable_check_access_status();\r\n status := IoMemAddrRead(0xFED43000);\r\n}\r\n\r\nmethod TPM_instr_issue_command_ready()\r\n requires IoMemPerm.Null?;\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM); \r\n ensures old(TPM.cmd_state.Idle? || TPM.cmd_state.AlmostReady?) ==> TPM.cmd_state.AlmostReady? || TPM.cmd_state.Ready?;\r\n ensures old(TPM.cmd_state.Ready?) ==> TPM.cmd_state == Ready;\r\n ensures old(TPM.cmd_state.CmdReception? || TPM.cmd_state.Executing? || TPM.cmd_state.CmdComplete?) ==> \r\n (TPM.cmd_state.Idle? || TPM.cmd_state.AlmostReady? || TPM.cmd_state.Ready?); //- Depends on TPM impl and timeout values\r\n ensures TPM_valid(TPM);\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPM == old(TPM)[cmd_state := TPM.cmd_state][cmd_buf := []][reply_buf := []];\r\n ensures IoMemPerm.Null?;\r\n{\r\n TPM_enable_issue_command_ready();\r\n IoMemAddrWrite(0xFED43018, 0x40);\r\n}\r\n\r\nmethod TPM_instr_check_command_ready() returns (status:int)\r\n requires IoMemPerm.Null?;\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires TPM.cmd_state.AlmostReady? || TPM.cmd_state.Ready?;\r\n ensures Word32(status); \r\n ensures |BEWordToBitSeq(status)| == 32;\r\n ensures BEWordToBitSeq(status)[25] == 1 ==> TPM.cmd_state.Ready?; //- bit 6 = commandReady\r\n ensures BEWordToBitSeq(status)[25] != 1 ==> TPM.cmd_state == old(TPM.cmd_state);\r\n ensures TPM_valid(TPM);\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPM == old(TPM)[cmd_state := TPM.cmd_state];\r\n ensures IoMemPerm.Null?;\r\n{\r\n ghost var _ := TPM_enable_check_command_ready();\r\n status := IoMemAddrRead(0xFED43018);\r\n}\r\n\r\nmethod TPM_instr_write_FIFO(c:int)\r\n requires IoMemPerm.Null?;\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires IsByte(c);\r\n requires TPM.cmd_state.Ready? || TPM.cmd_state.CmdReception?;\r\n ensures TPM_valid(TPM);\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPM == old(TPM)[cmd_state := CmdReception()][cmd_buf := old(TPM.cmd_buf) + [c]];\r\n ensures IoMemPerm.Null?;\r\n{\r\n TPM_enable_write_FIFO(c);\r\n IoMemAddrWrite(0xFED43024, c);\r\n}\r\n\r\nmethod TPM_instr_go()\r\n requires IoMemPerm.Null?;\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires power2(32) == 0x100000000;\r\n requires forall new_TPM : TPM_struct :: async_TPM_execution(TPM, new_TPM) ==> TPM_satisfies_integrity_policy(new_TPM);\r\n requires TPM.cmd_state.CmdReception?;\r\n ensures TPM_valid(TPM);\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPM == old(TPM)[cmd_state := Executing];\r\n ensures IoMemPerm.Null?;\r\n{\r\n TPM_enable_go();\r\n IoMemAddrWrite(0xFED43018, 0x20);\r\n}\r\n\r\nmethod TPM_instr_check_data_available() returns (r:int)\r\n requires IoMemPerm.Null?;\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires TPM.cmd_state.Executing? || TPM.cmd_state.CmdComplete?;\r\n requires power2(32) == 0x100000000;\r\n ensures TPM_valid(TPM);\r\n ensures old(TPM.cmd_state.Executing?) ==> async_TPM_execution(old(TPM), TPM) //- May bump us to CmdComplete, or may leave us in Executing\r\n && (r == 0x90 <==> TPM.cmd_state.CmdComplete?); //- 0x90 = TIS_STS_VALID (0x80) + TIS_STS_DATA_AVAIL (0x10)\r\n ensures old(TPM.cmd_state.CmdComplete?) ==> (r == 0x90 ==> |TPM.reply_buf| > 0) && old(TPM) == TPM;\r\n ensures old(TPM.cmd_state.CmdComplete?) ==> (r == 0x80 ==> |TPM.reply_buf|== 0) && old(TPM) == TPM;\r\n modifies this`TPM; //- Modifications specified by Async_TPM, so no additional details below\r\n modifies this`IoMemPerm;\r\n ensures IoMemPerm.Null?;\r\n{\r\n ghost var _ := TPM_enable_check_data_available();\r\n r := IoMemAddrRead(0xFED43018);\r\n}\r\n\r\nmethod TPM_instr_read_FIFO() returns (c:int)\r\n requires IoMemPerm.Null?;\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires TPM.cmd_state.CmdComplete? && |TPM.reply_buf| > 0;\r\n ensures TPM_valid(TPM);\r\n ensures old(TPM.reply_buf) == [c] + TPM.reply_buf;\r\n ensures IsByte(c);\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPM == old(TPM)[reply_buf := TPM.reply_buf];\r\n ensures IoMemPerm.Null?;\r\n{\r\n ghost var _ := TPM_enable_read_FIFO();\r\n c := IoMemAddrRead(0xFED43024);\r\n}\r\n\r\n/***************************************************************************\r\n * LOW-LEVEL TPM INTERACTION\r\n ***************************************************************************/\r\n\r\nmethod establish_locality()\r\n requires IoMemPerm.Null?;\r\n ensures Locality3_obtained();\r\n modifies this`IoMemPerm;\r\n ensures IoMemPerm.Null?;\r\n{\r\n TPM_instr_request_access();\r\n\r\n lemma_2toX();\r\n //-lemma_and_with_32_64_premium();\r\n\r\n var done := false;\r\n while(!done)\r\n decreases *;\r\n invariant Locality3_requested();\r\n invariant IoMemPerm.Null?;\r\n invariant done ==> Locality3_obtained();\r\n {\r\n var status := TPM_instr_check_access_status();\r\n ghost var old_status := status;\r\n status := Asm_BitwiseAnd(status, 32);\r\n lemma_and_with_32_64_specific_premium(old_status);\r\n if status > 0 {\r\n done := true;\r\n }\r\n }\r\n}\r\n\r\n//\r\n//\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n//\r\n//\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n//\r\n\r\n\r\n\r\n\r\n// \r\n\r\n\r\n\r\n\r\n\r\n//\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nstatic lemma lemma_sequence_concatenation_is_associative(s1:seq, s2:seq, s3:seq)\r\n ensures s1 + s2 + s3 == s1 + (s2 + s3);\r\n{\r\n}\r\n\r\nmethod perform_command(command_bytes:seq) returns (reply_bytes:seq)\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires IsByteSeq(command_bytes);\r\n requires |command_bytes| >= 1;\r\n requires valid_cmd(command_bytes);\r\n requires var intermediate_TPM_1 := TPM[cmd_state := CmdReception][cmd_buf := command_bytes][reply_buf := []];\r\n forall new_TPM : TPM_struct ::\r\n async_TPM_execution(intermediate_TPM_1, new_TPM) ==> TPM_satisfies_integrity_policy(new_TPM);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures var intermediate_TPM_2:TPM_struct := old(TPM)[cmd_state := Executing][cmd_buf := command_bytes][reply_buf := []];\r\n var intermediate_TPM_3:TPM_struct := TPM[cmd_state := CmdComplete][reply_buf := reply_bytes];\r\n async_TPM_execution(intermediate_TPM_2, intermediate_TPM_3);\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n ensures TPM.cmd_state.CmdComplete?;\r\n ensures IsByteSeq(reply_bytes);\r\n{\r\n ghost var intermediate_TPM_1:TPM_struct := TPM[cmd_state := CmdReception][cmd_buf := command_bytes][reply_buf := []];\r\n ghost var intermediate_TPM_2:TPM_struct := intermediate_TPM_1[cmd_state := Executing];\r\n lemma_2toX();\r\n\r\n send_command(command_bytes);\r\n assert TPM.cmd_buf == command_bytes;\r\n assert TPM == intermediate_TPM_1;\r\n\r\n assert forall new_TPM : TPM_struct :: async_TPM_execution(TPM, new_TPM) ==> TPM_satisfies_integrity_policy(new_TPM);\r\n execute_command();\r\n assert TPM.cmd_state == Executing;\r\n assert TPM == intermediate_TPM_2;\r\n\r\n poll_data_available();\r\n\r\n ghost var intermediate_TPM_3:TPM_struct := TPM;\r\n assert TPM_valid(intermediate_TPM_2);\r\n assert async_TPM_execution(intermediate_TPM_2, intermediate_TPM_3);\r\n\r\n reply_bytes := retrieve_response();\r\n assert intermediate_TPM_3.reply_buf == reply_bytes;\r\n assert intermediate_TPM_3 == TPM[cmd_state := CmdComplete][reply_buf := reply_bytes];\r\n assert async_TPM_execution(intermediate_TPM_2, intermediate_TPM_3);\r\n assert command_bytes == old(command_bytes);\r\n}\r\n\r\nmethod make_ready()\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n ensures TPM == old(TPM)[cmd_state := Ready()][cmd_buf := []][reply_buf := []];\r\n{\r\n assert TPM.cmd_state.Idle? || TPM.cmd_state.AlmostReady? || TPM.cmd_state.Ready? || TPM.cmd_state.CmdReception? || TPM.cmd_state.Executing? || TPM.cmd_state.CmdComplete?;\r\n TPM_instr_issue_command_ready();\r\n TPM_instr_issue_command_ready();\r\n assert TPM.cmd_state.AlmostReady? || TPM.cmd_state.Ready?;\r\n\r\n lemma_2toX();\r\n var done := false;\r\n while(!done)\r\n decreases *;\r\n invariant Locality3_obtained();\r\n invariant TPM_valid(TPM);\r\n invariant IoMemPerm.Null?;\r\n invariant TPM.cmd_state.AlmostReady? || TPM.cmd_state.Ready?;\r\n invariant TPM == old(TPM)[cmd_state := TPM.cmd_state][cmd_buf := []][reply_buf := []];\r\n invariant done ==> TPM.cmd_state.Ready?;\r\n {\r\n var status := TPM_instr_check_command_ready();\r\n ghost var old_status := status;\r\n status := Asm_BitwiseAnd(status, 64);\r\n lemma_and_with_32_64_specific_premium(old_status);\r\n //-assert status > 0 ==> BEWordToBitSeq(stat)[25] == 1;\r\n if status > 0 {\r\n done := true;\r\n }\r\n }\r\n}\r\n\r\nmethod send_command(command_bytes:seq)\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires IsByteSeq(command_bytes);\r\n requires |command_bytes| >= 1;\r\n requires power2(32) == 0x100000000;\r\n requires valid_cmd(command_bytes);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n ensures TPM == old(TPM)[cmd_state := CmdReception()][cmd_buf := command_bytes[..]][reply_buf := []];\r\n{\r\n//- assert TPM.cmd_state.Idle? || TPM.cmd_state.AlmostReady? || TPM.cmd_state.Ready? || TPM.cmd_state.CmdReception? || TPM.cmd_state.Executing? || TPM.cmd_state.CmdComplete?;\r\n//- TPM_instr_issue_command_ready();\r\n//- TPM_instr_issue_command_ready();\r\n//- assert TPM.cmd_state.Ready?;\r\n make_ready();\r\n\r\n ghost var readyTPM := TPM;\r\n assert readyTPM == old(TPM)[cmd_state := Ready()][cmd_buf := []][reply_buf := []];\r\n\r\n lemma_2toX();\r\n\r\n //- Write one byte to move us into CmdReception\r\n TPM_instr_write_FIFO(command_bytes[0]);\r\n\r\n calc {\r\n TPM;\r\n readyTPM[cmd_state := CmdReception()][cmd_buf := readyTPM.cmd_buf + [command_bytes[0]]];\r\n { assert readyTPM.cmd_buf + [command_bytes[0]] == [] + [command_bytes[0]] == [command_bytes[0]]; }\r\n readyTPM[cmd_state := CmdReception()][cmd_buf := [command_bytes[0]]];\r\n old(TPM)[cmd_state := Ready()][cmd_buf := []][reply_buf := []][cmd_state := CmdReception()][cmd_buf := [command_bytes[0]]];\r\n old(TPM)[cmd_state := CmdReception()][cmd_buf := [command_bytes[0]]][reply_buf := []];\r\n { assert command_bytes[0..1] == [command_bytes[0]]; }\r\n old(TPM)[cmd_state := CmdReception()][cmd_buf := command_bytes[0..1]][reply_buf := []];\r\n }\r\n\r\n var i := 1;\r\n while (i < |command_bytes|)\r\n invariant TPM_valid(TPM);\r\n invariant IoMemPerm.Null?;\r\n invariant 1 <= i <= |command_bytes|;\r\n invariant TPM == old(TPM)[cmd_state := CmdReception()][cmd_buf := command_bytes[0..i]][reply_buf := []];\r\n {\r\n TPM_instr_write_FIFO(command_bytes[i]);\r\n i := i + 1;\r\n assert command_bytes[0..i] == command_bytes[0..i-1] + [command_bytes[i-1]];\r\n }\r\n\r\n assert command_bytes[0..i] == command_bytes[..];\r\n}\r\n\r\n\r\nmethod execute_command()\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM.cmd_state.CmdReception?;\r\n requires power2(32) == 0x100000000;\r\n requires valid_cmd_present(TPM);\r\n requires forall new_TPM : TPM_struct :: async_TPM_execution(TPM, new_TPM) ==> TPM_satisfies_integrity_policy(new_TPM);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM == old(TPM)[cmd_state := Executing()];\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n ensures valid_cmd_present(TPM);\r\n{\r\n TPM_instr_go();\r\n}\r\n\r\nmethod poll_data_available()\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM.cmd_state.Executing?;\r\n requires power2(32) == 0x100000000;\r\n requires valid_cmd_present(TPM);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n ensures valid_cmd_present(TPM);\r\n ensures TPM.cmd_state.CmdComplete?;\r\n ensures |TPM.reply_buf| > 0;\r\n ensures async_TPM_execution(old(TPM), TPM);\r\n{\r\n //-ghost var old_TPM := TPM;\r\n var r := check_data_available_wrapper();\r\n while (r != 0x90)\r\n invariant TPM_valid(TPM);\r\n invariant IoMemPerm.Null?;\r\n invariant valid_cmd_present(TPM);\r\n invariant TPM.cmd_state.CmdComplete? || TPM.cmd_state.Executing?;\r\n invariant r == 0x90 ==> |TPM.reply_buf| > 0;\r\n invariant r != 0x90 ==> TPM == old(TPM);\r\n invariant r == 0x90 ==> async_TPM_execution(old(TPM), TPM);\r\n invariant (r == 0x90 <==> TPM.cmd_state.CmdComplete?);\r\n decreases *;\r\n {\r\n r := check_data_available_wrapper();\r\n }\r\n\r\n assert async_TPM_execution(old(TPM), TPM);\r\n}\r\n\r\nmethod retrieve_response() returns (ret:seq)\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM.cmd_state.CmdComplete?;\r\n requires power2(32) == 0x100000000;\r\n requires valid_cmd_present(TPM);\r\n requires |TPM.reply_buf| > 0;\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n ensures valid_cmd_present(TPM);\r\n ensures ret == old(TPM).reply_buf;\r\n ensures TPM == old(TPM)[reply_buf := []];\r\n{\r\n var r := check_data_available_wrapper();\r\n\r\n assert TPM == old(TPM)[reply_buf := TPM.reply_buf];\r\n\r\n ret := [];\r\n while (r == 0x90)\r\n invariant TPM_valid(TPM);\r\n invariant IoMemPerm.Null?;\r\n invariant valid_cmd_present(TPM);\r\n invariant TPM.cmd_state.CmdComplete?;\r\n invariant r == 0x90 <==> |TPM.reply_buf| > 0;\r\n invariant ret + TPM.reply_buf == old(TPM.reply_buf);\r\n decreases *;\r\n invariant TPM == old(TPM)[reply_buf := TPM.reply_buf];\r\n {\r\n ghost var old_reply_buf := TPM.reply_buf;\r\n ghost var old_ret := ret;\r\n //-assert old_ret + old_reply_buf == old(TPM.reply_buf);\r\n var c := TPM_instr_read_FIFO();\r\n //-assert [c] + TPM.reply_buf == old_reply_buf;\r\n ret := ret + [c];\r\n assert ret == old_ret + [c];\r\n calc {\r\n ret + TPM.reply_buf;\r\n old_ret + [c] + TPM.reply_buf;\r\n { lemma_sequence_concatenation_is_associative(old_ret, [c], TPM.reply_buf); }\r\n old_ret + ([c] + TPM.reply_buf);\r\n old_ret + old_reply_buf;\r\n old(TPM.reply_buf);\r\n }\r\n r := check_data_available_wrapper();\r\n }\r\n}\r\n\r\nmethod check_data_available_wrapper() returns (r:int)\r\n requires Locality3_obtained();\r\n requires TPM_valid(TPM);\r\n requires IoMemPerm.Null?;\r\n requires TPM.cmd_state.CmdComplete? || TPM.cmd_state.Executing?;\r\n requires power2(32) == 0x100000000;\r\n requires valid_cmd_present(TPM);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_valid(TPM);\r\n ensures IoMemPerm.Null?;\r\n ensures r == 0x90 ==> TPM.cmd_state.CmdComplete?;\r\n ensures r == 0x90 ==> |TPM.reply_buf| > 0;\r\n ensures TPM.cmd_state.CmdComplete? || TPM.cmd_state.Executing?;\r\n //-ensures transitioned(old(TPM), TPM, r);\r\n ensures old(TPM) == TPM || (old(TPM.cmd_state.Executing?) && TPM.cmd_state.CmdComplete?);\r\n ensures old(TPM.cmd_state.Executing?) ==> async_TPM_execution(old(TPM), TPM) && //- May bump us to CmdComplete, or may leave us in Executing\r\n (r == 0x90 <==> TPM.cmd_state.CmdComplete?); //- 0x90 = TIS_STS_VALID (0x80) + TIS_STS_DATA_AVAIL (0x10)\r\n ensures old(TPM.cmd_state.CmdComplete?) ==> (r == 0x90 ==> |TPM.reply_buf| > 0) && old(TPM) == TPM;\r\n ensures old(TPM.cmd_state.CmdComplete?) ==> (r == 0x80 ==> |TPM.reply_buf| == 0) && old(TPM) == TPM;\r\n ensures valid_cmd_present(TPM);\r\n ensures r == 0x80 || r == 0x90;\r\n{\r\n //-r := TPM_instr_check_data_available();\r\n r := 0;\r\n while (!(r == 0x80 || r == 0x90)) \r\n invariant Locality3_obtained();\r\n invariant TPM_valid(TPM);\r\n invariant IoMemPerm.Null?;\r\n invariant TPM.cmd_state.CmdComplete? || TPM.cmd_state.Executing?;\r\n invariant power2(32) == 0x100000000;\r\n invariant valid_cmd_present(TPM);\r\n invariant r == 0x90 ==> TPM.cmd_state.CmdComplete?;\r\n invariant r == 0x90 ==> |TPM.reply_buf| > 0;\r\n invariant old(TPM) == TPM || (old(TPM.cmd_state.Executing?) && TPM.cmd_state.CmdComplete?);\r\n invariant old(TPM.cmd_state.Executing?) ==> async_TPM_execution(old(TPM), TPM) && //- May bump us to CmdComplete, or may leave us in Executing\r\n (r == 0x90 <==> TPM.cmd_state.CmdComplete?); //- 0x90 = TIS_STS_VALID (0x80) + TIS_STS_DATA_AVAIL (0x10)\r\n invariant old(TPM.cmd_state.CmdComplete?) ==> (r == 0x90 ==> |TPM.reply_buf| > 0) && old(TPM) == TPM;\r\n invariant old(TPM.cmd_state.CmdComplete?) ==> (r == 0x80 ==> |TPM.reply_buf| == 0) && old(TPM) == TPM;\r\n //-invariant r == 0x80 || r == 0x90;\r\n decreases *;\r\n {\r\n r := TPM_instr_check_data_available();\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEWordToFourBytesProducesByteSeq(v:int)\r\n requires Word32(v);\r\n ensures IsByteSeq(BEWordToFourBytes(v));\r\n ensures |BEWordToFourBytes(v)| == 4;\r\n{\r\n lemma_2toX();\r\n lemma_power2_is_power_2_general();\r\n\r\n calc {\r\n power(power2(8), 4);\r\n power(power(2, 8), 4);\r\n { lemma_power_multiplies(2, 8, 4); }\r\n power(2, 8*4);\r\n power2(32);\r\n }\r\n lemma_BEIntToDigitSeq_private_properties(power2(8), 4, v);\r\n}\r\n\r\nstatic lemma lemma_BEWordToFourBytesAlwaysProducesByteSeq()\r\n ensures forall v:int :: Word32(v) ==> IsByteSeq(BEWordToFourBytes(v)) && |BEWordToFourBytes(v)| == 4;\r\n{\r\n forall v:int | Word32(v)\r\n ensures IsByteSeq(BEWordToFourBytes(v));\r\n ensures |BEWordToFourBytes(v)| == 4;\r\n {\r\n lemma_BEWordToFourBytesProducesByteSeq(v);\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/TPM/tpm-wrapper-randoms.i.dfy", "content": "include \"tpm-device.s.dfy\"\r\n\r\nstatic predicate read_random_forall(start_index:int, random_bytes:seq)\r\n{\r\n forall j :: 0 <= j < |random_bytes| ==> TPM_random_byte(start_index + j) == random_bytes[j]\r\n}\r\n\r\nstatic lemma lemma_randoms_forall_is_TPM_random_bytes(start_index:int, random_bytes:seq)\r\n ensures read_random_forall(start_index, random_bytes)\r\n == (TPM_random_bytes(start_index, start_index+|random_bytes|) == random_bytes);\r\n decreases |random_bytes|;\r\n{\r\n if (|random_bytes|==0)\r\n {\r\n }\r\n else\r\n {\r\n lemma_randoms_forall_is_TPM_random_bytes(start_index, random_bytes[..|random_bytes|-1]);\r\n }\r\n}\r\n\r\nstatic lemma lemma_random_comprehension(start_index:int, ra:seq, rb:seq)\r\n requires TPM_random_bytes(start_index, start_index+|ra|) == ra;\r\n requires TPM_random_bytes(start_index+|ra|, start_index+|ra|+|rb|) == rb;\r\n ensures TPM_random_bytes(start_index, start_index+|ra|+|rb|) == ra+rb;\r\n{\r\n lemma_randoms_forall_is_TPM_random_bytes(start_index, ra);\r\n lemma_randoms_forall_is_TPM_random_bytes(start_index+|ra|, rb);\r\n lemma_randoms_forall_is_TPM_random_bytes(start_index, ra+rb);\r\n}\r\n\r\nstatic lemma lemma_TPM_random_bytes_length(old_random_index:int, new_random_index:int)\r\n requires old_random_index <= new_random_index;\r\n ensures |TPM_random_bytes(old_random_index, new_random_index)| == new_random_index - old_random_index;\r\n decreases new_random_index-old_random_index;\r\n{\r\n if (old_random_index == new_random_index)\r\n {\r\n }\r\n else\r\n {\r\n lemma_TPM_random_bytes_length(old_random_index, new_random_index-1);\r\n }\r\n}\r\n\r\nstatic function TPM_random_bytes_premium (old_random_index:int, new_random_index:int) : seq\r\n requires old_random_index <= new_random_index;\r\n ensures |TPM_random_bytes_premium(old_random_index, new_random_index)| == new_random_index - old_random_index;\r\n{\r\n lemma_TPM_random_bytes_length(old_random_index, new_random_index);\r\n TPM_random_bytes(old_random_index, new_random_index)\r\n}\r\n\r\nstatic predicate TPMs_match_except_for_randoms (TPM1:TPM_struct, TPM2:TPM_struct)\r\n{\r\n TPMs_match(TPM1, TPM2[random_index := TPM1.random_index])\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Drivers/TPM/tpm-wrapper.i.dfy", "content": "include \"tpm-driver.i.dfy\"\r\ninclude \"tpm-wrapper-randoms.i.dfy\"\r\ninclude \"../../Libraries/Crypto/Hash/sha1_hmac.i.dfy\"\r\ninclude \"../../Libraries/Util/integer_sequences.i.dfy\"\r\ninclude \"../../Libraries/Util/repeat_digit.i.dfy\"\r\ninclude \"../IO/pci.i.dfy\"\r\n\r\n\r\n\r\n\r\n\r\n/***************************************************************************\r\n * Higher-level Implementation\r\n ***************************************************************************/\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n/***********************************************************************************\r\n Datatypes\r\n ***********************************************************************************/\r\n\r\ndatatype TPMSessionAndKey = TPMSessionAndKey_c(auth_handle:seq, nonce_even:seq, key_handle:seq, key_auth:seq)\r\n\r\npredicate TPMSessionAndKeyValid(sk:TPMSessionAndKey)\r\n{\r\n IsByteSeqOfLen(sk.auth_handle, 4) &&\r\n IsByteSeqOfLen(sk.nonce_even, 20) &&\r\n IsByteSeqOfLen(sk.key_handle, 4) &&\r\n IsByteSeqOfLen(sk.key_auth, 20)\r\n}\r\n\r\n/***********************************************************************************\r\n Useful lemmas\r\n ***********************************************************************************/\r\n\r\nstatic lemma lemma_length_two_sequences_match_iff_all_match(s1:seq, s2:seq)\r\n requires |s1| == |s2| == 2;\r\n ensures s1 != s2 <==> (s1[0] != s2[0] || s1[1] != s2[1]);\r\n{\r\n}\r\n\r\nstatic lemma lemma_length_five_sequences_match_iff_all_match(s1:seq, s2:seq)\r\n requires |s1| == |s2| == 5;\r\n ensures s1 != s2 <==> (s1[0] != s2[0] || s1[1] != s2[1] || s1[2] != s2[2] || s1[3] != s2[3] || s1[4] != s2[4]);\r\n{\r\n}\r\n\r\n/***********************************************************************************\r\n Useful functions\r\n ***********************************************************************************/\r\n\r\npredicate TPM_ready()\r\n reads this`TPM;\r\n reads this`IoMemPerm;\r\n{\r\n Locality3_obtained()\r\n && TPM_valid(TPM)\r\n && TPM_satisfies_integrity_policy(TPM)\r\n && IoMemPerm.Null?\r\n}\r\n\r\n/***********************************************************************************\r\n Assemble the sequences for each cmd\r\n ***********************************************************************************/\r\n\r\n/*\r\nstatic method build_get_permanent_flags_cmd() returns (cmd:seq) \r\n ensures IsByteSeq(cmd);\r\n ensures |cmd| > 1;\r\n ensures parse_TPM_command(cmd) == TPMCommandGetPermanentFlags_c();\r\n{\r\n cmd := [ 0x00, 0xc1, 0x00, 0x00, 0x00, 22, 0x00, 0x00, 0x00, 0x65, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 4, 0x00, 0x00, 0x01, 0x08];\r\n lemma_2toX();\r\n lemma_ValueOfFourByteSeqSpecific(cmd[2..6], 22); //- command length\r\n lemma_ValueOfFourByteSeqSpecific(cmd[6..10], TPM_ORD_GetCapability());\r\n lemma_ValueOfFourByteSeqSpecific(cmd[10..14], TPM_CAP_FLAG());\r\n lemma_ValueOfFourByteSeqSpecific(cmd[14..18], 4); //- subcap length\r\n lemma_ValueOfFourByteSeqSpecific(cmd[18..22], TPM_CAP_FLAG_PERMANENT());\r\n}\r\n\r\nstatic method build_write_NVRAM_cmd(secret:seq) returns (cmd:seq)\r\n requires IsByteSeqOfLen(secret, NV_size());\r\n ensures IsByteSeq(cmd);\r\n ensures |cmd| > 1;\r\n ensures parse_TPM_command(cmd) == TPMCommandWriteNVRAM_c(0x00011228, secret);\r\n{\r\n var nvindex := 0x00011228;\r\n lemma_2toX();\r\n var nvindex_bytes := BEWordToFourBytes_impl(nvindex);\r\n\r\n cmd := [ 0x00, 0xc1, 0, 0, 1, 22, 0x00, 0x00, 0x00, 0xcd] + nvindex_bytes + [ 0, 0, 0, 0, 0, 0, 1, 0 ] + secret;\r\n //- TPM_TAG_RQU_COMMAND cmd_len==22+256 TPM_ORD_NV_WriteValue offset==0 data_size==256\r\n\r\n lemma_ValueOfFourByteSeqSpecific(cmd[2..6], 22 + 256); //- command length\r\n lemma_ValueOfFourByteSeqSpecific(cmd[6..10], TPM_ORD_NV_WriteValue());\r\n assert cmd[10..14] == nvindex_bytes;\r\n lemma_ValueOfFourByteSeqSpecific(cmd[14..18], 0); //- offset\r\n lemma_ValueOfFourByteSeqSpecific(cmd[18..22], 256); //- data size\r\n assert cmd[22..22+NV_size()] == secret;\r\n}\r\n\r\nstatic method build_get_NVRAM_capability_cmd(a:int) returns (cmd:seq)\r\n requires Word32(a);\r\n ensures IsByteSeq(cmd);\r\n ensures |cmd| > 1;\r\n ensures parse_TPM_command(cmd) == TPMCommandGetNVRAMCapability_c(a);\r\n{\r\n lemma_2toX();\r\n var a_bytes := BEWordToFourBytes_impl(a);\r\n cmd := [ 0x00, 0xc1, 0x00, 0x00, 0x00, 22, 0x00, 0x00, 0x00, 0x65, 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 4] + a_bytes;\r\n\r\n lemma_ValueOfFourByteSeqSpecific(cmd[2..6], 22); //- command length\r\n lemma_ValueOfFourByteSeqSpecific(cmd[6..10], TPM_ORD_GetCapability());\r\n lemma_ValueOfFourByteSeqSpecific(cmd[10..14], TPM_CAP_NV_INDEX());\r\n lemma_ValueOfFourByteSeqSpecific(cmd[14..18], 4); //- subcap length\r\n assert cmd[18..22] == a_bytes;\r\n}\r\n*/\r\n\r\nstatic method build_read_PCR_17_or_18_cmd(a:int) returns (cmd:seq)\r\n requires a == 17 || a == 18;\r\n ensures IsByteSeq(cmd);\r\n ensures |cmd| > 1;\r\n ensures parse_TPM_command(cmd) == TPMCommandReadPCR17Or18_c(a);\r\n{\r\n cmd := [ 0x00, 0xc1, 0x00, 0x00, 0x00, 14, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, a ];\r\n lemma_2toX();\r\n\r\n lemma_ValueOfFourByteSeqSpecific(cmd[2..6], 14); //- command length\r\n lemma_ValueOfFourByteSeqSpecific(cmd[6..10], TPM_ORD_PcrRead());\r\n lemma_ValueOfFourByteSeqSpecific(cmd[10..14], a);\r\n}\r\n\r\n/*\r\nstatic method build_read_NVRAM_cmd(nvindex:int) returns (cmd:seq)\r\n requires Word32(nvindex);\r\n ensures IsByteSeq(cmd);\r\n ensures |cmd| > 1;\r\n ensures parse_TPM_command(cmd) == TPMCommandReadNVRAM_c(nvindex);\r\n{\r\n lemma_2toX();\r\n var nvindex_bytes := BEWordToFourBytes_impl(nvindex);\r\n cmd := [ 0x00, 0xc1, 0x00, 0x00, 0x00, 22, 0x00, 0x00, 0x00, 0xcf ] + nvindex_bytes + [ 0, 0, 0, 0, 0, 0, 1, 0 ];\r\n\r\n lemma_ValueOfFourByteSeqSpecific(cmd[2..6], 22); //- command length\r\n lemma_ValueOfFourByteSeqSpecific(cmd[6..10], TPM_ORD_NV_ReadValue());\r\n assert cmd[10..14] == nvindex_bytes;\r\n lemma_ValueOfFourByteSeqSpecific(cmd[14..18], 0); //- offset\r\n lemma_ValueOfFourByteSeqSpecific(cmd[18..22], 256); //- data size\r\n}\r\n*/\r\n\r\nstatic method build_get_random_cmd(num_bytes:int) returns (cmd:seq)\r\n requires Word32(num_bytes); \r\n ensures IsByteSeq(cmd);\r\n ensures |cmd| > 1;\r\n ensures parse_TPM_command(cmd) == TPMCommandGetRandom_c(num_bytes);\r\n{\r\n var num_bytes_bytes := BEWordToFourBytes_impl(num_bytes);\r\n cmd := [ 0x00, 0xc1, 0x00, 0x00, 0x00, 14, 0x00, 0x00, 0x00, 0x46] + num_bytes_bytes;\r\n lemma_2toX();\r\n \r\n lemma_ValueOfFourByteSeqSpecific(cmd[2..6], 14); //- command length\r\n lemma_ValueOfFourByteSeqSpecific(cmd[6..10], TPM_ORD_GetRandom());\r\n assert cmd[10..14] == num_bytes_bytes;\r\n}\r\n\r\nmethod compute_quote_command_hmac(nonce_external:seq, pcr_selection:seq, add_version:seq, nonce_even:seq,\r\n nonce_odd:seq, continue_auth_session:seq, key_usage_auth:seq) returns (h:seq)\r\n requires IsByteSeqOfLen(nonce_external, 20) && IsByteSeqOfLen(pcr_selection, 5) && IsByteSeqOfLen(add_version, 1) && IsByteSeqOfLen(nonce_even, 20) &&\r\n IsByteSeqOfLen(nonce_odd, 20) && IsByteSeqOfLen(continue_auth_session, 1) && IsByteSeqOfLen(key_usage_auth, 20);\r\n ensures IsByteSeqOfLen(h, 20);\r\n{\r\n var ordinal := [ 0x00, 0x00, 0x00, 0x3E ];\r\n\r\n lemma_2toX();\r\n\r\n var sha_input := ordinal + nonce_external + pcr_selection + add_version;\r\n var sha_words := SHA1_impl_Bytes(sha_input);\r\n var sha_output := BEWordSeqToByteSeq_impl(sha_words);\r\n\r\n var hmac_input := sha_output + nonce_even + nonce_odd + continue_auth_session;\r\n var auth_data_words := HMAC_SHA1_impl_Seqs(key_usage_auth, hmac_input); \r\n var auth_data := BEWordSeqToByteSeq_impl(auth_data_words);\r\n h := auth_data;\r\n}\r\n\r\nstatic lemma lemma_quote_cmd_ok (cmd:seq, key_handle:seq, nonce_external:seq, pcr_selection:seq,\r\n auth_handle:seq, nonce_odd:seq, auth_data:seq)\r\n requires IsByteSeqOfLen(key_handle, 4);\r\n requires IsByteSeqOfLen(nonce_external, 20);\r\n requires IsByteSeqOfLen(pcr_selection, 5);\r\n requires IsByteSeqOfLen(auth_handle, 4);\r\n requires IsByteSeqOfLen(nonce_odd, 20);\r\n requires IsByteSeqOfLen(auth_data, 20);\r\n requires cmd == [ 0x00, 0xc2, 0x00, 0x00, 0x00, 85, 0x00, 0x00, 0x00, 0x3e ] +\r\n key_handle + nonce_external + pcr_selection + [ 1 ] + auth_handle + nonce_odd + [ 1 ] + auth_data;\r\n ensures IsByteSeqOfLen(cmd, 85);\r\n ensures cmd[0..2] == TPM_TAG_RQU_AUTH1_COMMAND();\r\n ensures cmd[0..2] != TPM_TAG_RQU_COMMAND();\r\n ensures BEByteSeqToInt(cmd[2..6]) == 85;\r\n ensures BEByteSeqToInt(cmd[6..10]) == TPM_ORD_Quote2();\r\n ensures cmd[10..14] == key_handle;\r\n ensures cmd[14..34] == nonce_external;\r\n ensures cmd[34..39] == pcr_selection;\r\n ensures cmd[39] == 1;\r\n ensures cmd[40..44] == auth_handle;\r\n ensures cmd[44..64] == nonce_odd;\r\n ensures cmd[64] == 1;\r\n ensures cmd[65..85] == auth_data;\r\n{\r\n lemma_2toX();\r\n\r\n lemma_length_two_sequences_match_iff_all_match(cmd[0..2], TPM_TAG_RQU_COMMAND()); //- prove it's not TPM_TAG_RQU_COMMAND\r\n lemma_ValueOfFourByteSeqSpecific(cmd[2..6], 85); //- command length\r\n lemma_ValueOfFourByteSeqSpecific(cmd[6..10], TPM_ORD_Quote2());\r\n}\r\n\r\nmethod build_quote_cmd (nonce_external:seq, key_handle:seq, auth_handle:seq, nonce_even:seq, usage_key:seq)\r\n returns (cmd:seq)\r\n requires IsByteSeqOfLen(nonce_external, 20);\r\n requires IsByteSeqOfLen(key_handle, 4);\r\n requires IsByteSeqOfLen(auth_handle, 4);\r\n requires IsByteSeqOfLen(nonce_even, 20);\r\n requires IsByteSeqOfLen(usage_key, 20);\r\n ensures IsByteSeq(cmd);\r\n ensures |cmd| > 1;\r\n ensures parse_TPM_command(cmd) == TPMCommandQuote2_c(nonce_external, key_handle, auth_handle);\r\n{\r\n lemma_2toX();\r\n\r\n var pcr_selection := [ 0x00, 0x03, 0x00, 0x00, 0x0E ];\r\n var nonce_odd := [ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ];\r\n\r\n var auth_data := compute_quote_command_hmac(nonce_external, pcr_selection, [ 1 ], nonce_even, nonce_odd, [ 1 ], usage_key);\r\n\r\n cmd := [ 0x00, 0xc2, 0x00, 0x00, 0x00, 85, 0x00, 0x00, 0x00, 0x3e ] +\r\n key_handle +\r\n nonce_external +\r\n pcr_selection +\r\n [ 1 ] +\r\n auth_handle +\r\n nonce_odd +\r\n [ 1 ] +\r\n auth_data;\r\n assert cmd[44..64] == nonce_odd;\r\n\r\n lemma_quote_cmd_ok(cmd, key_handle, nonce_external, pcr_selection, auth_handle, nonce_odd, auth_data);\r\n}\r\n\r\nstatic method build_extend_PCR_19_cmd(data:seq) returns (cmd:seq)\r\n requires IsByteSeqOfLen(data, 20);\r\n ensures IsByteSeq(cmd);\r\n ensures |cmd| > 1;\r\n ensures parse_TPM_command(cmd) == TPMCommandExtendPCR19_c(data);\r\n{\r\n cmd := [ 0x00, 0xc1, 0x00, 0x00, 0x00, 34, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 19 ] + data;\r\n lemma_2toX();\r\n\r\n lemma_ValueOfFourByteSeqSpecific(cmd[2..6], 34); //- command length\r\n lemma_ValueOfFourByteSeqSpecific(cmd[6..10], TPM_ORD_Extend());\r\n lemma_ValueOfFourByteSeqSpecific(cmd[10..14], 19); //- pcr index\r\n assert cmd[14..34] == data;\r\n}\r\n\r\nstatic method build_oiap_cmd() returns (cmd:seq)\r\n ensures IsByteSeq(cmd);\r\n ensures |cmd| > 1;\r\n ensures parse_TPM_command(cmd) == TPMCommandOIAP_c();\r\n{\r\n cmd := [ 0x00, 0xc1, 0x00, 0x00, 0x00, 10, 0x00, 0x00, 0x00, 0x0A ];\r\n lemma_2toX();\r\n\r\n lemma_ValueOfFourByteSeqSpecific(cmd[2..6], 10); //- command length\r\n lemma_ValueOfFourByteSeqSpecific(cmd[6..10], TPM_ORD_OIAP());\r\n}\r\n\r\nmethod build_loadkey_cmd(key:seq, auth_handle:seq, nonce_even:seq) returns (cmd:seq)\r\n requires IsByteSeq(key);\r\n requires |key| < 10000;\r\n requires IsByteSeqOfLen(auth_handle, 4);\r\n requires IsByteSeqOfLen(nonce_even, 20);\r\n ensures IsByteSeq(cmd);\r\n ensures |cmd| > 1;\r\n ensures parse_TPM_command(cmd) == TPMCommandLoadKey2_c();\r\n{\r\n lemma_2toX();\r\n\r\n var len := 59 + |key|;\r\n var len_bytes := BEWordToFourBytes_impl(len);\r\n var ordinal := [ 0x00, 0x00, 0x00, 0x41 ];\r\n var header := [ 0x00, 0xc2 ] + len_bytes + ordinal;\r\n var SRK_handle := [ 0x40, 0, 0, 0 ]; //-0x40000000\r\n var nonce_odd := [ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ];\r\n var srk_authdata := nonce_odd; //- SRK auth is 20 0s; just happens to match the nonce_odd we chose\r\n var continue := [ 1 ];\r\n\r\n var sha_input := ordinal + key;\r\n var sha_words := SHA1_impl_Bytes(sha_input);\r\n var sha_output := BEWordSeqToByteSeq_impl(sha_words);\r\n\r\n var hmac_input := sha_output + nonce_even + nonce_odd + continue;\r\n var auth_data_words := HMAC_SHA1_impl_Seqs(srk_authdata, hmac_input); \r\n var auth_data := BEWordSeqToByteSeq_impl(auth_data_words);\r\n\r\n cmd := header + SRK_handle + key + auth_handle + nonce_odd + continue + auth_data;\r\n\r\n lemma_ValueOfFourByteSeqSpecific(cmd[6..10], TPM_ORD_LoadKey2());\r\n lemma_length_two_sequences_match_iff_all_match(cmd[0..2], TPM_TAG_RQU_COMMAND()); //- prove it's not TPM_TAG_RQU_COMMAND\r\n assert cmd[2..6] == len_bytes;\r\n assert len == |cmd|;\r\n}\r\n//-////////////////////////////////////////////////////////////////////////////////\r\n//- Methods for dealing with replies\r\n//-////////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic method compute_is_TPM_reply_header_ok(reply:seq, expected_tag:seq) returns (ok:int)\r\n requires IsByteSeq(reply);\r\n requires IsByteSeqOfLen(expected_tag, 2);\r\n ensures ok == 0 <==> is_TPM_reply_header_ok(reply, expected_tag);\r\n{\r\n if |reply| < 10 {\r\n ok := 1;\r\n return;\r\n }\r\n\r\n lemma_length_two_sequences_match_iff_all_match(reply[0..2], expected_tag);\r\n if reply[0] != expected_tag[0] || reply[1] != expected_tag[1] {\r\n ok := 2;\r\n return;\r\n }\r\n\r\n var packet_size := BEFourBytesToWord_impl(reply[2..6]);\r\n if packet_size != |reply| {\r\n ok := 0x8000000 + packet_size * 0x1000 + |reply|;\r\n if (ok == 0) { ok := 3; } //- Assure Dafny that ok didn't become 0 when added to packet_size\r\n return;\r\n }\r\n\r\n lemma_ValueOfFourByteSeq(reply[6..10]);\r\n if reply[6] != 0 || reply[7] != 0 || reply[8] != 0 || reply[9] != 0 {\r\n ok := 4;\r\n return;\r\n }\r\n\r\n ok := 0;\r\n}\r\n\r\n//-/////////////////////////////////////////////////////////////////\r\n//- Actual functionality\r\n//-/////////////////////////////////////////////////////////////////\r\n\r\n//- Template for TPM operations\r\n//- modifies this`TPM; //- Except...\r\n//- ensures old(TPM.PCR_19) == TPM.PCR_19;\r\n//- ensures old(TPM.NVRAM) == TPM.NVRAM;\r\n//- ensures old(TPM.NV_locked) == TPM.NV_locked;\r\n//- ensures old(TPM.NV_perms_ok) == TPM.NV_perms_ok;\r\n//- ensures old(TPM.cmd_state) == TPM.cmd_state;\r\n//- ensures old(TPM.cmd_buf) == TPM.cmd_buf;\r\n//- ensures old(TPM.reply_buf) == TPM.reply_buf;\r\n//- ensures old(TPM.random_index) == TPM.random_index;\r\n\r\nmethod get_pcr(a:int) returns (r:bool, pcr:seq)\r\n requires a == 17 || a == 18;\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures r ==> PCR_val(a) == pcr;\r\n ensures r ==> IsByteSeqOfLen(pcr, 20);\r\n\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM));\r\n{\r\n //- Build the command:\r\n var cmd := build_read_PCR_17_or_18_cmd(a);\r\n lemma_2toX();\r\n ghost var intermediate_TPM:TPM_struct := TPM[cmd_state := Executing][cmd_buf := cmd];\r\n\r\n var reply := perform_command(cmd);\r\n ghost var after_TPM:TPM_struct := TPM[reply_buf := reply];\r\n assert async_TPM_execution(intermediate_TPM, after_TPM);\r\n assert TPM_executed_read_PCR_17_or_18(intermediate_TPM, after_TPM);\r\n\r\n r := false;\r\n pcr := [];\r\n\r\n var ok := compute_is_TPM_reply_header_ok(reply, [0, 0xC4]);\r\n if ok != 0 { return; }\r\n if |reply| != 30 { return; }\r\n\r\n r := true;\r\n pcr := reply[10..30];\r\n}\r\n\r\n/*\r\n//- Determine whether the TPM NVRAM has been properly locked\r\nmethod check_locked() returns (r:bool)\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures r ==> TPM.NV_locked;\r\n\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM));\r\n{\r\n //- Build the command:\r\n var cmd := build_get_permanent_flags_cmd();\r\n\r\n ghost var intermediate_TPM:TPM_struct := TPM[cmd_state := Executing][cmd_buf := cmd];\r\n\r\n var reply := perform_command(cmd);\r\n ghost var after_TPM:TPM_struct := TPM[reply_buf := reply];\r\n assert async_TPM_execution(intermediate_TPM, after_TPM);\r\n assert TPM_executed_get_permanent_flags(intermediate_TPM, after_TPM);\r\n\r\n r := false;\r\n\r\n lemma_2toX();\r\n var ok := compute_is_TPM_reply_header_ok(reply, [0, 0xC4]);\r\n if ok != 0 { return; }\r\n if |reply| != 36 { return; }\r\n\r\n var resp_size := BEFourBytesToWord_impl(reply[10..14]);\r\n if resp_size != 22 { return; }\r\n\r\n lemma_length_two_sequences_match_iff_all_match(reply[14..16], TPM_TAG_PERMANENT_FLAGS());\r\n var tag := reply[14..16];\r\n if tag[0] != 0 || tag[1] != 0x1F { return; }\r\n\r\n var nv_locked := reply[31];\r\n r := (nv_locked == 1);\r\n}\r\n\r\nfunction method{:dafnycc_conservative_seq_triggers} check_perms_reply_given_pcrs_digest(reply:seq, desired_pcrs_digest:seq) : bool\r\n requires |reply| == 85;\r\n{\r\n var tag := reply[14..16];\r\n var pcr_info_read := reply[20..46];\r\n var pcr_selection_read := pcr_info_read[0..5];\r\n var localities_bit_vector_read := pcr_info_read[5];\r\n var pcrs_digest_read := pcr_info_read[6..26];\r\n var pcr_info_write := reply[46..72];\r\n var pcr_selection_write := pcr_info_write[0..5];\r\n var localities_bit_vector_write := pcr_info_write[5];\r\n var pcrs_digest_write := pcr_info_write[6..26];\r\n var permission_tag := reply[72..74];\r\n var permission_attributes := reply[74..78];\r\n var read_st_clear := reply[78];\r\n var write_st_clear := reply[79];\r\n var write_define := reply[80];\r\n var desired_pcr_selection := [ 0, 3, 0, 0, 6 ];\r\n !(\r\n tag[0] != 0 || tag[1] != 0x18 ||\r\n pcr_selection_read != desired_pcr_selection ||\r\n pcrs_digest_read != desired_pcrs_digest ||\r\n pcr_selection_write != desired_pcr_selection ||\r\n pcrs_digest_write != desired_pcrs_digest ||\r\n permission_tag != [ 0, 23 ] ||\r\n permission_attributes != [ 0, 0, 0x20, 0 ] ||\r\n read_st_clear != 0 ||\r\n write_st_clear != 0 ||\r\n write_define != 0\r\n )\r\n}\r\n\r\nmethod{:dafnycc_conservative_seq_triggers} check_perms_given_pcrs_digest(a:int, desired_pcrs_digest:seq) returns (r:bool)\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n requires Word32(a);\r\n ensures r && is_TPM_COMPOSITE_HASH(desired_pcrs_digest, PCR_val(17), PCR_val(18)) ==> valid_nv_index(TPM, a) && TPM.NV_perms_ok[a];\r\n\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM));\r\n{\r\n //- Build the command:\r\n var cmd := build_get_NVRAM_capability_cmd(a); \r\n lemma_2toX();\r\n ghost var intermediate_TPM:TPM_struct := TPM[cmd_state := Executing][cmd_buf := cmd];\r\n\r\n var reply := perform_command(cmd);\r\n ghost var after_TPM:TPM_struct := TPM[reply_buf := reply];\r\n\r\n assert var parsed := parse_TPM_reply_get_NVRAM_capability(reply); parsed.TPMReplyInvalid_c? || parsed.TPMReplyGetNVRAMCapability_c?;\r\n\r\n r := false;\r\n\r\n var ok := compute_is_TPM_reply_header_ok(reply, [0, 0xC4]);\r\n if ok != 0 { return; }\r\n if |reply| != 85 { return; }\r\n\r\n var resp_size := BEFourBytesToWord_impl(reply[10..14]);\r\n var nvindex := BEFourBytesToWord_impl(reply[16..20]);\r\n var data_size := BEFourBytesToWord_impl(reply[81..85]);\r\n if resp_size != 71 { return; }\r\n if nvindex != a { return; }\r\n if data_size != 256 { return; }\r\n\r\n r := check_perms_reply_given_pcrs_digest(reply, desired_pcrs_digest);\r\n\r\n ghost var tag := reply[14..16];\r\n ghost var pcr_info_read := reply[20..46];\r\n ghost var pcr_selection_read := pcr_info_read[0..5];\r\n ghost var pcr_info_write := reply[46..72];\r\n ghost var pcr_selection_write := pcr_info_write[0..5];\r\n ghost var desired_pcr_selection := [ 0, 3, 0, 0, 6 ];\r\n lemma_length_five_sequences_match_iff_all_match(pcr_selection_read, desired_pcr_selection);\r\n lemma_length_five_sequences_match_iff_all_match(pcr_selection_write, desired_pcr_selection);\r\n lemma_length_two_sequences_match_iff_all_match(tag, TPM_TAG_NV_DATA_PUBLIC());\r\n}\r\n\r\nmethod create_pcrs_digest(PCR_17:seq, PCR_18:seq) returns (pcrs_digest:seq)\r\n requires IsByteSeqOfLen(PCR_17, 20);\r\n requires IsByteSeqOfLen(PCR_18, 20);\r\n ensures is_TPM_COMPOSITE_HASH(pcrs_digest, PCR_17, PCR_18);\r\n{\r\n lemma_2toX();\r\n var pcr_composite := PCR_SELECTION_covering_PCRs_17_and_18() +\r\n [0, 0, 0, 40] + //- size of next two PCRs\r\n PCR_17 + PCR_18;\r\n var hash_words := SHA1_impl_Bytes(pcr_composite);\r\n pcrs_digest := BEWordSeqToByteSeq_impl(hash_words);\r\n}\r\n\r\nmethod check_perms(a:int) returns (r:bool)\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n requires Word32(a);\r\n ensures r ==> valid_nv_index(TPM, a) && TPM.NV_perms_ok[a];\r\n\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM));\r\n{\r\n var PCR_17:seq, PCR_18:seq;\r\n r, PCR_17 := get_pcr(17);\r\n if !r { return; }\r\n r, PCR_18 := get_pcr(18);\r\n if !r { return; }\r\n\r\n var pcrs_digest := create_pcrs_digest(PCR_17, PCR_18);\r\n r := check_perms_given_pcrs_digest(a, pcrs_digest);\r\n}\r\n*/\r\n\r\nmethod extend_PCR(data:seq) returns (r:bool)\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n requires IsByteSeqOfLen(data, 20);\r\n ensures r ==> TPM.PCR_19 == old(TPM.PCR_19) + [data];\r\n\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM)[PCR_19 := TPM.PCR_19]);\r\n{\r\n //- Build the command:\r\n var cmd := build_extend_PCR_19_cmd(data);\r\n\r\n ghost var intermediate_TPM:TPM_struct := TPM[cmd_state := Executing][cmd_buf := cmd];\r\n\r\n lemma_2toX();\r\n var reply := perform_command(cmd);\r\n ghost var after_TPM:TPM_struct := TPM[reply_buf := reply];\r\n assert TPM_executed_extend_PCR_19(intermediate_TPM, after_TPM);\r\n\r\n r := false;\r\n\r\n var ok := compute_is_TPM_reply_header_ok(reply,[0, 0xC4]);\r\n if ok != 0 { return; }\r\n if |reply| != 30 { return; }\r\n\r\n r := true;\r\n}\r\n\r\n/*\r\nmethod store_secret(secret:seq) returns (r:bool)\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n requires IsByteSeqOfLen(secret, NV_size());\r\n requires secret[0] != 0xFF;\r\n requires TPM_app_policy_okay_to_trust(secret);\r\n requires valid_nv_index(TPM, 0x00011228);\r\n ensures r ==> valid_nv_index(TPM, 0x00011228) && TPM.NVRAM[0x00011228] == secret;\r\n ensures |TPM.NVRAM| == |old(TPM).NVRAM|;\r\n ensures forall a :: a != 0x00011228 && old(valid_nv_index(TPM, a)) && valid_nv_index(TPM, a) ==> old(TPM.NVRAM[a]) == TPM.NVRAM[a];\r\n\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM)[NVRAM := TPM.NVRAM]);\r\n{\r\n lemma_2toX();\r\n\r\n var nvindex := 0x00011228;\r\n var cmd := build_write_NVRAM_cmd(secret);\r\n\r\n var locked := check_locked();\r\n var perms_okay := check_perms(nvindex);\r\n\r\n if (!locked || ! perms_okay) {\r\n return false;\r\n }\r\n\r\n assert TPM.NV_locked;\r\n assert TPM.NV_perms_ok[nvindex];\r\n\r\n ghost var intermediate_TPM:TPM_struct := TPM[cmd_state := Executing][cmd_buf := cmd];\r\n\r\n var reply := perform_command(cmd);\r\n ghost var after_TPM:TPM_struct := TPM[reply_buf := reply];\r\n assert async_TPM_execution(intermediate_TPM, after_TPM);\r\n assert TPM_executed_write_NVRAM(intermediate_TPM, after_TPM);\r\n\r\n r := false;\r\n\r\n var ok := compute_is_TPM_reply_header_ok(reply,[0, 0xC4]);\r\n if ok != 0 { return; }\r\n if |reply| != 10 { return; }\r\n\r\n r := true;\r\n}\r\n\r\nmethod read_secret() returns (r:bool, secret:seq)\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n requires valid_nv_index(TPM, 0x00011228);\r\n ensures r ==> TPM_app_policy_okay_to_trust(secret);\r\n\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM));\r\n{\r\n //- Build the command:\r\n var nvindex := 0x00011228;\r\n assert Word32(nvindex);\r\n r := false;\r\n secret := [];\r\n\r\n var locked := check_locked();\r\n var perms_okay := check_perms(nvindex);\r\n\r\n if (!locked || ! perms_okay) {\r\n return;\r\n }\r\n\r\n var cmd := build_read_NVRAM_cmd(nvindex);\r\n\r\n ghost var intermediate_TPM:TPM_struct := TPM[cmd_state := Executing][cmd_buf := cmd];\r\n\r\n var reply := perform_command(cmd);\r\n ghost var after_TPM:TPM_struct := TPM[reply_buf := reply];\r\n\r\n lemma_2toX();\r\n var ok := compute_is_TPM_reply_header_ok(reply,[0, 0xC4]);\r\n if ok != 0 { return; }\r\n if |reply| < 14 { return; }\r\n\r\n var data_size := BEFourBytesToWord_impl(reply[10..14]);\r\n if |reply| != 14 + data_size { return; }\r\n\r\n var data := reply[14..14+data_size];\r\n if (data[0] == 0xFF) { return; } //- make sure it isn't newly_created_NV_value()\r\n\r\n assert TPM_satisfies_integrity_policy(TPM);\r\n assert data == TPM.NVRAM[nvindex];\r\n assert TPM_app_policy_okay_to_trust(data) || data == newly_created_NV_value();\r\n Lemma_RepeatDigitProperties(0xFF, NV_size()); //- This proves that newly_created_NV_value()[0] == 0xff, so data isn't newly_created_NV_value()\r\n assert data != newly_created_NV_value();\r\n\r\n r := true;\r\n secret := data;\r\n}\r\n*/\r\n\r\n//- Start an authorization session with the TPM\r\nmethod start_oiap_session() returns (success:bool, auth_handle:seq, nonce_even:seq)\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures success ==> IsByteSeqOfLen(auth_handle, 4);\r\n ensures success ==> IsByteSeqOfLen(nonce_even, 20);\r\n ensures TPM_ready();\r\n //-ensures TPMs_match(TPM, old(TPM)[random_index := old(TPM).random_index + |random_bytes|]);\r\n ensures TPM == old(TPM);\r\n{\r\n //- Build the command:\r\n var cmd := build_oiap_cmd();\r\n lemma_2toX();\r\n ghost var intermediate_TPM:TPM_struct := TPM[cmd_state := Executing][cmd_buf := cmd];\r\n\r\n var reply := perform_command(cmd);\r\n ghost var after_TPM:TPM_struct := TPM[reply_buf := reply];\r\n assert async_TPM_execution(intermediate_TPM, after_TPM);\r\n assert TPM_executed_OIAP(intermediate_TPM, after_TPM);\r\n\r\n var ok := compute_is_TPM_reply_header_ok(reply,[0, 0xC4]);\r\n auth_handle := [];\r\n nonce_even := [];\r\n if ok != 0 { \r\n if |reply| >= 10\r\n {\r\n debug_print(0x49, ok);\r\n debug_print(0x50, reply[6]);\r\n debug_print(0x51, reply[7]);\r\n debug_print(0x52, reply[8]);\r\n debug_print(0x53, reply[9]);\r\n }\r\n success := false;\r\n return; \r\n }\r\n if |reply| != 34 { success := false; return; }\r\n\r\n var header:seq;\r\n var fields := reply[10: 4: 20];\r\n header , auth_handle, nonce_even :=\r\n fields[0], fields[1], fields[2];\r\n success := true;\r\n}\r\n\r\nmethod debug_print_key_bytes(key_bytes:seq)\r\n{\r\n var i := 0;\r\n while (i<|key_bytes|)\r\n invariant 0 <= i <= |key_bytes|;\r\n {\r\n debug_print(0x28, key_bytes[i]);\r\n i := i + 1;\r\n }\r\n}\r\n\r\nmethod load_key(auth_handle:seq, nonce_even:seq) returns (success:bool, key_handle:seq, nonce_even_new:seq)\r\n requires TPM_ready();\r\n requires IsByteSeqOfLen(auth_handle, 4);\r\n requires IsByteSeqOfLen(nonce_even, 20);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures success ==> IsByteSeqOfLen(key_handle, 4);\r\n ensures success ==> IsByteSeqOfLen(nonce_even_new, 20);\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM));\r\n{\r\n key_handle := [];\r\n nonce_even_new := [];\r\n\r\n var key_len := GetBootloaderArgWord(1);\r\n debug_print(0x88, key_len);\r\n\r\n if (key_len > 1024 - 8 - 1 || key_len < 0) {\r\n success := false;\r\n return;\r\n }\r\n\r\n var key_bytes := GetBootloaderArgBytes(8, 8+key_len);\r\n//- debug_print_key_bytes(key_bytes);\r\n\r\n var cmd := build_loadkey_cmd(key_bytes, auth_handle, nonce_even); \r\n\r\n lemma_2toX();\r\n ghost var intermediate_TPM:TPM_struct := TPM[cmd_state := Executing][cmd_buf := cmd];\r\n\r\n var reply := perform_command(cmd);\r\n ghost var after_TPM:TPM_struct := TPM[reply_buf := reply];\r\n assert async_TPM_execution(intermediate_TPM, after_TPM);\r\n assert TPM_executed_LoadKey2(intermediate_TPM, after_TPM);\r\n\r\n var ok := compute_is_TPM_reply_header_ok(reply,[0, 0xC5]);\r\n if ok != 0 { \r\n if |reply| >= 10 {\r\n debug_print(0x29, ok);\r\n debug_print(0x29, reply[6]);\r\n debug_print(0x29, reply[7]);\r\n debug_print(0x29, reply[8]);\r\n debug_print(0x29, reply[9]);\r\n }\r\n success := false;\r\n return; \r\n }\r\n if |reply| != 55 { success := false; return; }\r\n\r\n var header:seq, continue:seq, auth:seq;\r\n var fields := reply[10: 4: 20: 1: 20];\r\n header , key_handle, nonce_even_new, continue, auth :=\r\n fields[0], fields[1], fields[2], fields[3], fields[4];\r\n success := true;\r\n}\r\n\r\nstatic method compute_aik_auth_data() returns (aik_auth:seq)\r\n ensures IsByteSeqOfLen(aik_auth, 20);\r\n{\r\n lemma_2toX();\r\n var aik_secret := [115, 101, 99, 114, 101, 116]; // Shhh, don't tell!\r\n var hash_words := SHA1_impl_Bytes(aik_secret);\r\n aik_auth := BEWordSeqToByteSeq_impl(hash_words);\r\n}\r\n\r\nmethod establish_TPM_session_and_key () returns (success:bool, sk:TPMSessionAndKey)\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n\r\n ensures success ==> TPMSessionAndKeyValid(sk);\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM));\r\n{\r\n lemma_2toX();\r\n sk := TPMSessionAndKey_c([], [], [], []);\r\n\r\n var auth_handle:seq, nonce_even:seq;\r\n success, auth_handle, nonce_even := start_oiap_session();\r\n if (!success) {\r\n debug_print(0x24, 0x0);\r\n return;\r\n }\r\n\r\n var key_handle:seq;\r\n success, key_handle, nonce_even := load_key(auth_handle, nonce_even);\r\n if (!success) {\r\n debug_print(0x24, 0xa);\r\n return;\r\n }\r\n\r\n var key_auth := compute_aik_auth_data();\r\n sk := TPMSessionAndKey_c(auth_handle, nonce_even, key_handle, key_auth);\r\n}\r\n\r\nmethod{:dafnycc_conservative_seq_triggers} quote(sk_in:TPMSessionAndKey, nonce_external:seq)\r\n returns (r:bool, sk_out:TPMSessionAndKey, pcr_info:seq, sig:seq)\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n requires TPMSessionAndKeyValid(sk_in);\r\n requires IsByteSeqOfLen(nonce_external, 20);\r\n\r\n ensures r ==> Verve_quote(pcr_info, sig, nonce_external, old(TPM).PCR_19);\r\n ensures TPMSessionAndKeyValid(sk_out);\r\n ensures IsByteSeq(pcr_info);\r\n ensures IsByteSeq(sig);\r\n\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM));\r\n{\r\n//- lemma_2toX();\r\n//-\r\n//- var bootloader_bytes := GetBootloaderArgBytes(0, 48);\r\n//- var fields := bootloader_bytes[4 :4 :20 :20 ];\r\n//- var key_handle, auth_handle, nonce_even, usage_key :=\r\n//- fields[0], fields[1], fields[2], fields[3] ;\r\n//-\r\n//- //-auth_handle := [auth_handle[3], auth_handle[2], auth_handle[1], auth_handle[0]];\r\n//-\r\n//- var success, auth_handle, nonce_even:= start_oiap_session();\r\n//- r := false;\r\n//- q := [];\r\n//- if (!success) { debug_print(0x24, 0x0); return; }\r\n//- auth_handle := auth_handle_new;\r\n//- nonce_even := nonce_even_new;\r\n//-\r\n//- var key_handle:seq;\r\n//- success, key_handle, nonce_even := load_key(auth_handle, nonce_even);\r\n//- if (!success) { debug_print(0x24, 0xa); return; }\r\n//-\r\n//- var key_auth := compute_aik_auth_data();\r\n//-\r\n//- var cmd := build_quote_cmd(nonce_external, key_handle, auth_handle, nonce_even, key_auth);\r\n\r\n r := false;\r\n pcr_info := [];\r\n sig := [];\r\n sk_out := sk_in;\r\n var cmd := build_quote_cmd(nonce_external, sk_in.key_handle, sk_in.auth_handle, sk_in.nonce_even, sk_in.key_auth);\r\n\r\n ghost var intermediate_TPM:TPM_struct := TPM[cmd_state := Executing][cmd_buf := cmd];\r\n\r\n var reply := perform_command(cmd);\r\n assert old(intermediate_TPM) == intermediate_TPM;\r\n assert old(nonce_external) == nonce_external;\r\n\r\n lemma_2toX();\r\n\r\n ghost var after_TPM:TPM_struct := TPM[reply_buf := reply];\r\n assert async_TPM_execution(intermediate_TPM, after_TPM);\r\n assert TPM_executed_quote2(intermediate_TPM, after_TPM);\r\n\r\n var ok := compute_is_TPM_reply_header_ok(reply, [0, 0xC5]);\r\n if ok != 0 { \r\n if |reply| >= 10\r\n {\r\n debug_print(0x20, ok);\r\n debug_print(0x20, reply[6]);\r\n debug_print(0x21, reply[7]);\r\n debug_print(0x22, reply[8]);\r\n debug_print(0x23, reply[9]);\r\n }\r\n return; \r\n }\r\n if |reply| < 40 { debug_print(0x24, 0x1); return; }\r\n\r\n pcr_info := reply[10..36];\r\n var pcr_selection := pcr_info[0..5];\r\n var localities_bit_vector := pcr_info[5];\r\n lemma_length_five_sequences_match_iff_all_match(pcr_selection, PCR_SELECTION_covering_PCRs_17_through_19());\r\n if pcr_selection[0] != 0 || pcr_selection[1] != 3 || pcr_selection[2] != 0 || pcr_selection[3] != 0 || pcr_selection[4] != 14 { debug_print(0x24, 0x3); return; }\r\n\r\n var version_info_size := BEFourBytesToWord_impl(reply[36..40]);\r\n if |reply| < 44 + version_info_size || version_info_size < 0 { debug_print(0x24, 0x4); return; }\r\n\r\n var sig_size := BEFourBytesToWord_impl(reply[40+version_info_size..44+version_info_size]);\r\n if |reply| != 85 + version_info_size + sig_size || sig_size < 0 { debug_print(0x24, 0x5); return; }\r\n\r\n var new_nonce_even := reply[44+version_info_size+sig_size..64+version_info_size+sig_size];\r\n var continue_session := reply[64+version_info_size+sig_size];\r\n if continue_session != 1 { debug_print(0x24, 0x6); return; }\r\n\r\n r := true;\r\n sig := reply[44+version_info_size..44+version_info_size+sig_size];\r\n sk_out := sk_in[nonce_even := new_nonce_even];\r\n}\r\n\r\nmethod get_random(num_bytes:nat) returns (random_bytes:seq)\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures IsByteSeqOfLen(random_bytes, num_bytes);\r\n ensures forall j :: 0 <= j < num_bytes ==> TPM_random_byte(old(TPM).random_index + j) == random_bytes[j];\r\n ensures random_bytes == TPM_random_bytes(old(TPM).random_index, TPM.random_index);\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM)[random_index := old(TPM).random_index + num_bytes]);\r\n{\r\n random_bytes := [];\r\n\r\n var num_bytes_still_needed := num_bytes;\r\n\r\n assert TPM == old(TPM)[cmd_state := TPM.cmd_state];\r\n\r\n while (num_bytes_still_needed > 0)\r\n decreases *;\r\n invariant num_bytes_still_needed >= 0;\r\n invariant forall j :: 0 <= j < |random_bytes| ==> TPM_random_byte(old(TPM).random_index + j) == random_bytes[j];\r\n invariant IsByteSeq(random_bytes);\r\n invariant |random_bytes| + num_bytes_still_needed == num_bytes;\r\n invariant TPM_ready();\r\n invariant TPMs_match(TPM, old(TPM)[random_index := old(TPM).random_index + |random_bytes|]);\r\n {\r\n var bytes_to_get := if num_bytes_still_needed <= 0xFFFFFFFF then num_bytes_still_needed else 0xFFFFFFFF;\r\n lemma_2toX();\r\n var bytes := get_random_basic(bytes_to_get);\r\n random_bytes := random_bytes + bytes;\r\n num_bytes_still_needed := num_bytes_still_needed - |bytes|;\r\n }\r\n\r\n lemma_randoms_forall_is_TPM_random_bytes(old(TPM).random_index, random_bytes);\r\n}\r\n\r\n//- Attempt to get a batch of random bytes from the TPM; TPM may reply with less\r\nmethod get_random_basic(num_bytes:int) returns (random_bytes:seq)\r\n requires TPM_ready();\r\n requires Word32(num_bytes);\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures 0 <= |random_bytes| <= num_bytes;\r\n ensures IsByteSeq(random_bytes);\r\n ensures forall j :: 0 <= j < |random_bytes| ==> TPM_random_byte(old(TPM).random_index + j) == random_bytes[j];\r\n ensures TPM_ready();\r\n ensures TPMs_match(TPM, old(TPM)[random_index := old(TPM).random_index + |random_bytes|]);\r\n{\r\n //- Build the command:\r\n var cmd := build_get_random_cmd(num_bytes);\r\n lemma_2toX();\r\n ghost var intermediate_TPM:TPM_struct := TPM[cmd_state := Executing][cmd_buf := cmd];\r\n\r\n var reply := perform_command(cmd);\r\n ghost var after_TPM:TPM_struct := TPM[reply_buf := reply];\r\n assert async_TPM_execution(intermediate_TPM, after_TPM);\r\n assert TPM_executed_get_random(intermediate_TPM, after_TPM);\r\n\r\n random_bytes := [];\r\n\r\n var ok := compute_is_TPM_reply_header_ok(reply,[0, 0xC4]);\r\n if ok != 0 { return; }\r\n if |reply| < 14 { return; }\r\n\r\n var random_bytes_size := BEFourBytesToWord_impl(reply[10..14]);\r\n if |reply| != 14 + random_bytes_size || random_bytes_size < 0 { return; }\r\n\r\n random_bytes := reply[14..14+random_bytes_size];\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/BigNatAdd.i.dfy", "content": "include \"Word32.i.dfy\"\r\ninclude \"BigNatCore.i.dfy\"\r\ninclude \"BigNatX86Shim.i.dfy\"\r\ninclude \"BigNatCompare.i.dfy\"\r\n\r\ndatatype Problem = Problem_ctor(\r\n A:BigNat, B:BigNat, c:nat);\r\n\r\nstatic predicate WellformedCarry(carry:nat)\r\n { carry==0 || carry==1 }\r\n\r\nstatic predicate WellformedProblem(p:Problem)\r\n { WellformedBigNat(p.A) && WellformedBigNat(p.B) && WellformedCarry(p.c) }\r\n\r\nstatic predicate WorksheetProblemsWellformed(ps:seq)\r\n { forall i :: 0 <= i < |ps| ==> WellformedProblem(ps[i]) }\r\n\r\nstatic function method ZeroProblem(p:Problem) : bool\r\n requires WellformedProblem(p);\r\n { zero(p.A) && zero(p.B) && p.c==0 }\r\n\r\nstatic predicate WorksheetProblemsConnected(p0:Problem, s0:nat, p1:Problem)\r\n requires WellformedProblem(p0);\r\n requires Word32(s0);\r\n requires WellformedProblem(p1);\r\n{\r\n p1.A == hi(p0.A)\r\n && p1.B == hi(p0.B)\r\n && lo(p0.A) + lo(p0.B) + p0.c == s0 + p1.c * Width()\r\n && !ZeroProblem(p0)\r\n}\r\n\r\nstatic predicate WellformedSolutions(ss:seq)\r\n{\r\n forall i :: 0 <= i < |ss| ==> ss[i]>=0 && Word32(ss[i])\r\n}\r\n\r\nstatic predicate WorksheetConsistent(ps:seq, ss:seq)\r\n{\r\n WorksheetProblemsWellformed(ps)\r\n && |ps| == |ss|+1\r\n && WellformedSolutions(ss)\r\n && (forall i:nat :: i < |ps|-1 ==>\r\n WorksheetProblemsConnected(ps[i], ss[i], ps[i+1]))\r\n}\r\n\r\nstatic predicate WorksheetComplete(ps:seq, ss:seq)\r\n{\r\n WorksheetConsistent(ps, ss)\r\n && ZeroProblem(ps[|ps|-1])\r\n}\r\n\r\nstatic predicate problem_smaller(p0:Problem, p1:Problem)\r\n requires WellformedProblem(p0);\r\n requires WellformedProblem(p1);\r\n{\r\n I(p0.A) < I(p1.A)\r\n || (I(p0.A) == I(p1.A)\r\n && I(p0.B) < I(p1.B))\r\n || (I(p0.A) == I(p1.A)\r\n && I(p0.B) == I(p1.B)\r\n && p0.c < p1.c)\r\n}\r\n\r\nstatic method solve_one_(p:Problem) returns (s:nat, pnew:Problem)\r\n requires WellformedProblem(p);\r\n requires !ZeroProblem(p);\r\n ensures s>=0 && Word32(s);\r\n ensures WellformedProblem(pnew);\r\n ensures Word32(s);\r\n ensures WorksheetProblemsConnected(p,s,pnew);\r\n ensures problem_smaller(pnew, p);\r\n ensures ZeroProblem(pnew) ==> s != 0;\r\n{\r\n var m:nat,c:nat := Add32_with_carry(lo(p.A), lo(p.B), p.c);\r\n s := m;\r\n pnew := Problem_ctor(hi(p.A), hi(p.B), c);\r\n\r\n if |p.A.words|==0 && |p.B.words|==0 {\r\n } else if |p.A.words|==0 {\r\n } else {\r\n }\r\n\r\n lemma_2to32();\r\n lemma_mul_is_mul_boogie_Width();\r\n reveal_I();\r\n/* TODO: should dafnycc support ghost if statements in non-ghost methods?\r\n if (ZeroProblem(pnew))\r\n {\r\n if (s==0)\r\n {\r\n calc {\r\n 0;\r\n s;\r\n lo(p.A) + lo(p.B) + p.c - c*Width();\r\n lo(p.A) + lo(p.B) + p.c - pnew.c*Width();\r\n { lemma_mul_basics_forall(); }\r\n lo(p.A) + lo(p.B) + p.c;\r\n }\r\n assert !ZeroProblem(p);\r\n assert false;\r\n }\r\n assert s != 0;\r\n }\r\n\r\n if (I(p.A)!=0) {\r\n lemma_hi_decreases(p.A);\r\n } else if (I(p.B)!=0) {\r\n lemma_hi_decreases(p.A);\r\n lemma_hi_decreases(p.B);\r\n } else {\r\n lemma_hi_decreases(p.A);\r\n lemma_hi_decreases(p.B);\r\n assert p.c > 0; //- !ZeroProblem(p)\r\n assert p.c == 1; //- WellformedProblem(p)\r\n if (pnew.c > 0)\r\n {\r\n calc {\r\n s+pnew.c*Width();\r\n lo(p.A) + lo(p.B) + c;\r\n { assert zero(p.A); }\r\n 0 + lo(p.B) + c;\r\n { assert zero(p.B); }\r\n 0 + 0 + c;\r\n c;\r\n 1;\r\n }\r\n assert pnew.c == 1;\r\n calc {\r\n 1;\r\n < { lemma_2to32(); }\r\n Width();\r\n { lemma_mul_basics(Width()); }\r\n pnew.c*Width();\r\n }\r\n assert false;\r\n }\r\n assert pnew.c < p.c;\r\n }\r\n*/\r\n}\r\n\r\nstatic method BigNatAdd_(A:BigNat, B:BigNat) returns (ss:seq, ghost ps:seq)\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n ensures |ps|>0;\r\n ensures ps[0].A == A;\r\n ensures ps[0].B == B;\r\n ensures ps[0].c == 0;\r\n ensures WorksheetComplete(ps,ss);\r\n ensures |ss|>0 ==> ss[|ss|-1]>0;\r\n{\r\n var p:Problem := Problem_ctor(A,B,0);\r\n ps := [ p ];\r\n ss := [];\r\n\r\n lemma_I_is_nonnegative_forall();\r\n\r\n while (!ZeroProblem(p)) \r\n decreases I(p.A),I(p.B),p.c;\r\n invariant 0 < |ps|;\r\n invariant ps[|ps|-1] == p;\r\n invariant WorksheetConsistent(ps, ss);\r\n invariant ps[0].A==A && ps[0].B==B && ps[0].c==0;\r\n invariant WellformedProblem(p);\r\n invariant forall i :: 0<=i<|ps|-1 ==> !ZeroProblem(ps[i]);\r\n invariant ZeroProblem(p) ==> (|ss|>0 ==> ss[|ss|-1]>0);\r\n {\r\n ghost var pold := p;\r\n var s:nat,pnew:Problem := solve_one_(p);\r\n ss := ss + [s];\r\n ps := ps + [pnew];\r\n\r\n assert WorksheetProblemsConnected(p,s,pnew);\r\n assert ps[|ps|-2] == p;\r\n assert ss[|ss|-1] == s;\r\n assert ps[|ps|-1] == pnew;\r\n assert WorksheetProblemsConnected(ps[|ps|-2], ss[|ss|-1], ps[|ps|-1]);\r\n\r\n\r\n\r\n assert forall i :: 0 <= i < |ps|-1 ==> WorksheetProblemsConnected(ps[i], ss[i], ps[i+1]);\r\n assert WorksheetConsistent(ps, ss);\r\n assert ZeroProblem(p) ==> ss[|ss|-1]>0;\r\n/* TODO: should dafnycc support forall statement in non-ghost methods?\r\n forall (i:nat | i < |ps|-1)\r\n ensures WorksheetProblemsConnected(ps[i], ss[i], ps[i+1]);\r\n {\r\n if (i < |ps|-2)\r\n {\r\n //- induction hypothesis WorksheetConsistent(ps,ss);\r\n assert WorksheetProblemsConnected(ps[i], ss[i], ps[i+1]);\r\n }\r\n else\r\n {\r\n //- solve_one ensures\r\n assert WorksheetProblemsConnected(p, s, pnew);\r\n assert WorksheetProblemsConnected(ps[i], ss[i], ps[i+1]);\r\n }\r\n }\r\n assert WorksheetConsistent(ps, ss);\r\n\r\n if (ZeroProblem(p))\r\n {\r\n assert ss[|ss|-1]>0;\r\n }\r\n*/\r\n\r\n assert problem_smaller(pnew,p);\r\n p := pnew;\r\n\r\n lemma_I_is_nonnegative_forall();\r\n assert 0<=I(p.A);\r\n assert 0<=I(p.B);\r\n }\r\n}\r\n\r\nstatic function ProblemValue(p:Problem) : int\r\n requires WellformedProblem(p);\r\n{\r\n I(p.A) + I(p.B) + p.c\r\n}\r\n\r\nstatic predicate WellformedBigNatSeq(R:seq)\r\n{\r\n forall i :: 0 <= i < |R| ==> WellformedBigNat(R[i])\r\n}\r\n\r\nstatic predicate WellformedWordSeq(s:seq)\r\n{\r\n forall i :: 0 <= i < |s| ==> s[i]>=0 && Word32(s[i])\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- These functions define the relationship between a sequence of words\r\n//- and a sequence of BigNats formed from subsequences of the word seq.\r\n//- That's so that we can show that the high-place-value partial sums\r\n//- (one word at a time) can be viewed as correct BigNat solutions to the\r\n//- truncated problems. Then we inductively include low-order words one\r\n//- at a time until we've reconstructed the original problem.\r\n\r\nstatic predicate BigNatsForSumWords_Base(ss:seq, R:seq)\r\n requires WellformedBigNatSeq(R);\r\n{\r\n |R| == |ss|+1\r\n && R[|R|-1] == BigNat_ctor([])\r\n && R[0] == BigNat_ctor(ss)\r\n}\r\n\r\nstatic predicate BigNatsForSumWords_Nonzero(ss:seq, R:seq)\r\n requires WellformedBigNatSeq(R);\r\n requires BigNatsForSumWords_Base(ss, R);\r\n { forall i :: 0 <= i < |ss| ==> nonzero(R[i]) }\r\n\r\nstatic predicate BigNatsForSumWords_Assembly(ss:seq, R:seq)\r\n requires WellformedBigNatSeq(R);\r\n requires BigNatsForSumWords_Base(ss, R);\r\n { forall i :: 0 <= i <=|ss| ==> R[i] == BigNat_ctor(ss[i..]) }\r\n\r\nstatic predicate ShiftRelation(M:seq, i:nat)\r\n requires WellformedBigNatSeq(M);\r\n requires i < |M|-1;\r\n{ I(M[i]) == I(M[i+1]) * Width() + lo(M[i]) }\r\n\r\nstatic predicate ShiftRelationSeq(ss:seq, R:seq)\r\n requires WellformedBigNatSeq(R);\r\n requires |R| == |ss|+1;\r\n{ forall i :: 0 <= i < |ss| ==> ShiftRelation(R, i) }\r\n\r\nstatic lemma ShiftRelationLemma(M:seq, i:nat)\r\n requires WellformedBigNatSeq(M);\r\n requires i < |M|-1;\r\n requires ShiftRelation(M,i);\r\n ensures I(M[i]) == I(M[i+1]) * Width() + lo(M[i]);\r\n{\r\n reveal_I();\r\n}\r\n\r\nstatic predicate BigNatsForSumWords(ss:seq, R:seq)\r\n requires WellformedBigNatSeq(R);\r\n{\r\n BigNatsForSumWords_Base(ss,R)\r\n && BigNatsForSumWords_Nonzero(ss, R)\r\n && BigNatsForSumWords_Assembly(ss, R)\r\n && ShiftRelationSeq(ss,R)\r\n}\r\n\r\nstatic lemma ConstructBigNatsFromSumWords_lemma(ss:seq, R:seq)\r\n requires WellformedBigNatSeq(R);\r\n requires WellformedWordSeq(ss);\r\n requires |ss|>0;\r\n requires ss[|ss|-1] > 0;\r\n requires |R| == |ss|+1;\r\n requires BigNatsForSumWords(ss[1..],R[1..]);\r\n requires nonzero(R[0]);\r\n requires R[0] == BigNat_ctor(ss);\r\n ensures BigNatsForSumWords_Base(ss,R);\r\n ensures BigNatsForSumWords(ss,R);\r\n{\r\n forall (i:nat | i < |ss|)\r\n ensures nonzero(R[i]);\r\n {\r\n if (i>0)\r\n {\r\n assert nonzero(R[1..][i-1]);\r\n assert nonzero(R[i]);\r\n }\r\n }\r\n assert BigNatsForSumWords_Nonzero(ss,R);\r\n\r\n forall (i:nat | i <=|ss|)\r\n ensures R[i] == BigNat_ctor(ss[i..]);\r\n {\r\n if (i==0)\r\n {\r\n assert ss == ss[0..];\r\n }\r\n else\r\n {\r\n assert R[1..][i-1] == R[i];\r\n assert ss[1..][i-1..] == ss[i..];\r\n }\r\n }\r\n assert BigNatsForSumWords_Assembly(ss,R);\r\n\r\n forall (i:nat | i < |ss|)\r\n ensures ShiftRelation(R, i);\r\n {\r\n if (i==0)\r\n {\r\n reveal_I();\r\n assert ShiftRelation(R, 0);\r\n }\r\n else\r\n {\r\n assert R[1..][i-1] == R[i];\r\n calc ==>\r\n {\r\n ShiftRelationSeq(ss[1..],R[1..]);\r\n ShiftRelation(R[1..], i-1);\r\n ShiftRelation(R, i);\r\n }\r\n }\r\n }\r\n assert ShiftRelationSeq(ss,R);\r\n}\r\n\r\nstatic lemma ConstructBigNatsFromSumWords_(ss:seq) returns (R:seq)\r\n requires WellformedWordSeq(ss);\r\n requires |ss|>0 ==> ss[|ss|-1] > 0;\r\n ensures WellformedBigNatSeq(R);\r\n ensures BigNatsForSumWords(ss,R);\r\n{\r\n var r:BigNat := BigNat_ctor(ss);\r\n var tail:seq;\r\n\r\n if |ss|==0\r\n {\r\n tail := [];\r\n R := [r] + tail;\r\n } else {\r\n tail := ConstructBigNatsFromSumWords_(ss[1..]);\r\n R := [r] + tail;\r\n var next:BigNat:= tail[0];\r\n ConstructBigNatsFromSumWords_lemma(ss, R);\r\n }\r\n}\r\n\r\nstatic lemma lemma_accumulate(s:int, ss:seq, ps:seq, Ms:seq)\r\n decreases |ss|-s;\r\n requires 0<=s<=|ss|;\r\n requires WorksheetComplete(ps,ss);\r\n requires WellformedBigNatSeq(Ms);\r\n requires BigNatsForSumWords(ss,Ms);\r\n ensures I(Ms[s]) == ProblemValue(ps[s]);\r\n{\r\n if (s==|ss|)\r\n {\r\n calc\r\n {\r\n ProblemValue(ps[s]);\r\n I(ps[s].A) + I(ps[s].B) + ps[s].c;\r\n { reveal_I(); }\r\n 0;\r\n { reveal_I(); }\r\n I(Ms[s]);\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n I(Ms[s]);\r\n { ShiftRelationLemma(Ms, s); }\r\n I(Ms[s+1]) * Width() + lo(Ms[s]);\r\n I(Ms[s+1]) * Width() + ss[s];\r\n I(Ms[s+1]) * Width() + lo(ps[s].A)+lo(ps[s].B)+ps[s].c - ps[s+1].c * Width();\r\n { lemma_accumulate(s+1, ss, ps, Ms); }\r\n I(Ms[s+1]) * Width() + lo(ps[s].A)+lo(ps[s].B)+ps[s].c - ((I(Ms[s+1]) - I(ps[s+1].A)) - I(ps[s+1].B)) * Width();\r\n //-{ lemma_mul_properties(); }\r\n { lemma_mul_is_commutative(Width(), (I(Ms[s+1]) - I(ps[s+1].A)) - I(ps[s+1].B)); }\r\n I(Ms[s+1]) * Width() + lo(ps[s].A)+lo(ps[s].B)+ps[s].c - Width() * ((I(Ms[s+1]) - I(ps[s+1].A)) - I(ps[s+1].B));\r\n //-{ lemma_mul_properties(); }\r\n { lemma_mul_is_distributive_sub(Width(), I(Ms[s+1]) - I(ps[s+1].A), I(ps[s+1].B)); }\r\n I(Ms[s+1]) * Width() + lo(ps[s].A)+lo(ps[s].B)+ps[s].c - (Width() * (I(Ms[s+1]) - I(ps[s+1].A)) - Width() * I(ps[s+1].B));\r\n //-{ lemma_mul_properties(); }\r\n { lemma_mul_is_distributive_sub(Width(), I(Ms[s+1]), I(ps[s+1].A)); }\r\n I(Ms[s+1]) * Width() + lo(ps[s].A)+lo(ps[s].B)+ps[s].c - (Width() * I(Ms[s+1]) - Width() * I(ps[s+1].A) - Width() * I(ps[s+1].B));\r\n //-{ lemma_mul_properties(); }\r\n { lemma_mul_is_commutative(Width(),I(Ms[s+1])); }\r\n Width() * I(Ms[s+1]) + lo(ps[s].A)+lo(ps[s].B)+ps[s].c - (Width() * I(Ms[s+1]) - Width() * I(ps[s+1].A) - Width() * I(ps[s+1].B));\r\n Width() * I(Ms[s+1]) + lo(ps[s].A)+lo(ps[s].B)+ps[s].c - Width() * I(Ms[s+1]) + Width() * I(ps[s+1].A) + Width() * I(ps[s+1].B);\r\n //- Collapse the canceling terms\r\n lo(ps[s].A)+Width() * I( ps[s+1].A ) +lo(ps[s].B)+ps[s].c+Width() * I(ps[s+1].B);\r\n {\r\n lemma_mul_is_commutative(Width(),I( ps[s+1].A ));\r\n lemma_mul_is_commutative(Width(),I( ps[s+1].B ));\r\n }\r\n lo(ps[s].A)+I( ps[s+1].A ) * Width() +lo(ps[s].B)+ps[s].c+I(ps[s+1].B) * Width();\r\n lo(ps[s].A)+I(hi(ps[s].A)) * Width() +lo(ps[s].B)+I(hi(ps[s].B)) * Width() +ps[s].c;\r\n { lemma_hilo(ps[s].A); lemma_hilo(ps[s].B); }\r\n I(ps[s].A) + I(ps[s].B)+ps[s].c;\r\n ProblemValue(ps[s]);\r\n }\r\n }\r\n}\r\n\r\nstatic method BigNatAdd(A:BigNat, B:BigNat) returns (R:BigNat)\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n ensures WellformedBigNat(R);\r\n ensures I(A)+I(B) == I(R);\r\n{\r\n var ss:seq;\r\n ghost var ps:seq;\r\n ss,ps := BigNatAdd_(A,B);\r\n ghost var Ms:seq := ConstructBigNatsFromSumWords_(ss);\r\n //- Ms[i] is the BigNat formed by ss[i..]. It includes Ms[|ss|], which is always BigNat_ctor([]) (0)\r\n\r\n R := BigNat_ctor(ss);\r\n calc {\r\n I(R);\r\n I(Ms[0]);\r\n { lemma_accumulate(0,ss,ps,Ms); }\r\n ProblemValue(ps[0]);\r\n I(ps[0].A) + I(ps[0].B) + ps[0].c;\r\n I(ps[0].A) + I(ps[0].B);\r\n I(A) + I(B);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/BigNatBitCount.i.dfy", "content": "include \"../../Drivers/IO/pci.i.dfy\"\r\ninclude \"BigNatX86Shim.i.dfy\"\r\ninclude \"BigNatCore.i.dfy\"\r\ninclude \"BigNatCompare.i.dfy\" //- just for the mul synonyms. clean up.\r\ninclude \"../Math/power2.i.dfy\"\r\n\r\nstatic lemma lemma_power2_5_is_32()\r\n ensures power2(5) == 32;\r\n{\r\n lemma_power2_1_is_2();\r\n reveal_power2();\r\n assert power2(2)==4;\r\n assert power2(3)==8;\r\n assert power2(4)==16;\r\n assert power2(5)==32;\r\n}\r\n\r\nstatic lemma lemma_mul32power226_is_power31()\r\n ensures 32 * power2(26) == power2(31);\r\n{\r\n calc {\r\n 32 * power2(26);\r\n { lemma_power2_5_is_32(); }\r\n power2(5) * power2(26);\r\n { lemma_exponentiation(5,26); }\r\n power2(5+26);\r\n power2(31);\r\n }\r\n}\r\n\r\nstatic predicate ZeroBitRepresentation(A:BigNat, c:nat)\r\n requires WellformedBigNat(A);\r\n{\r\n c==0 <==> zero(A)\r\n}\r\n\r\nstatic predicate BitCount(A:BigNat, c:nat)\r\n requires WellformedBigNat(A);\r\n{\r\n ZeroBitRepresentation(A,c)\r\n && ((c>0) ==> (power2(c-1) <= I(A)))\r\n && (I(A) < power2(c))\r\n}\r\n\r\n\r\n\r\n\r\n\r\n\r\nstatic function {:opaque} IntBitCount_inner(a:nat) : nat\r\n{\r\n if (a==0) then\r\n 0\r\n else\r\n IntBitCount_inner(a/2)+1\r\n}\r\n\r\nstatic lemma lemma_IntBitCount(a:nat, b:nat)\r\n requires b == IntBitCount_inner(a);\r\n ensures (b>0) ==> (power2(b-1) <= a);\r\n ensures a < power2(b);\r\n decreases a;\r\n{\r\n reveal_IntBitCount_inner();\r\n if (a==0)\r\n {\r\n }\r\n else\r\n {\r\n assert b == IntBitCount_inner(a) == IntBitCount_inner(a/2)+1;\r\n assert b-1 == IntBitCount_inner(a/2);\r\n lemma_IntBitCount(a/2, b-1);\r\n assert (b-1>0) ==> (power2(b-1-1) <= a/2);\r\n assert a/2 < power2(b-1);\r\n assert a/2 <= power2(b-1)-1;\r\n\r\n if (a==1)\r\n {\r\n assert b==1;\r\n calc {\r\n power2(b-1);\r\n power2(0);\r\n { lemma_power2_0_is_1(); }\r\n 1;\r\n <=\r\n a;\r\n }\r\n }\r\n else\r\n {\r\n assert b == IntBitCount_inner(a/4)+2;\r\n assert b>1;\r\n calc {\r\n power2(b-1);\r\n { reveal_power2(); }\r\n 2*power2(b-2);\r\n <=\r\n 2*(a/2);\r\n <=\r\n 2*(a/2)+a%2;\r\n a;\r\n }\r\n }\r\n\r\n calc {\r\n a;\r\n 2*(a/2)+a%2;\r\n <=\r\n 2*(power2(b-1)-1)+a%2;\r\n 2*power2(b-1)-2+a%2;\r\n <\r\n 2*power2(b-1);\r\n { reveal_power2(); }\r\n power2(b);\r\n }\r\n }\r\n}\r\n\r\nstatic function IntBitCount(a:nat) : nat\r\n ensures (IntBitCount(a)>0) ==> (power2(IntBitCount(a)-1) <= a);\r\n ensures a < power2(IntBitCount(a));\r\n{\r\n lemma_IntBitCount(a, IntBitCount_inner(a));\r\n IntBitCount_inner(a)\r\n}\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nstatic function KindaBigNat() : nat\r\n{\r\n \r\n \r\n power2(power2(31))\r\n}\r\n\r\nstatic predicate ModestBigNatValue(A:BigNat)\r\n{\r\n WellformedBigNat(A)\r\n && I(A) < KindaBigNat()\r\n}\r\n\r\nstatic predicate ModestBigNatBits(A:BigNat,ac:nat)\r\n{\r\n WellformedBigNat(A)\r\n && BitCount(A,ac)\r\n && ac<=power2(31)\r\n}\r\n\r\nstatic predicate ModestBigNatWords(A:BigNat)\r\n{\r\n WellformedBigNat(A)\r\n && |A.words| <= power2(26)\r\n}\r\n\r\nstatic lemma WordConstructOneBits(s:nat) returns (a:nat)\r\n requires s<=32;\r\n ensures power2(s)-1==a;\r\n ensures s==0 <==> (a==0);\r\n ensures Word32(a);\r\n{\r\n if (s==0)\r\n {\r\n a := 0;\r\n lemma_power2_0_is_1();\r\n }\r\n else if (s==1)\r\n {\r\n a := 1;\r\n lemma_power2_1_is_2();\r\n }\r\n else\r\n {\r\n var sub_a:nat := WordConstructOneBits(s-1);\r\n a := 2*sub_a + 1;\r\n reveal_power2();\r\n }\r\n\r\n assert power2(s)-1==a;\r\n\r\n if (s>0)\r\n {\r\n assert power2(s)-1 < power2(s);\r\n lemma_power2_increases(s,32);\r\n assert power2(s) <= power2(32);\r\n assert a < power2(32);\r\n }\r\n}\r\n\r\nstatic lemma MakePower2Minus1(thirtytwos:nat,ones:nat) returns (S:BigNat)\r\n requires 0 S.words[i] == Width() - 1;\r\n{\r\n lemma_mul_nonnegative(32,thirtytwos);\r\n\r\n if (thirtytwos == 0)\r\n {\r\n var ones_word:nat := WordConstructOneBits(ones);\r\n assert ones_word > 0;\r\n S := BigNat_ctor([ones_word]);\r\n calc ==>\r\n {\r\n true;\r\n { selectively_reveal_I(S); }\r\n I(S) == I(BigNat_ctor(S.words[1..])) * Width()+S.words[0];\r\n { assert |S.words[1..]| == 0; }\r\n I(S) == I(BigNat_ctor([])) * Width()+ones_word;\r\n {\r\n assert zero(BigNat_ctor([]));\r\n lemma_mul_annihilate(Width());\r\n }\r\n I(S) == ones_word;\r\n I(S) == power2(ones)-1;\r\n { lemma_mul_annihilate(32); }\r\n I(S) == power2(32 * thirtytwos+ones)-1;\r\n }\r\n }\r\n else\r\n {\r\n var sub_S:BigNat := MakePower2Minus1(thirtytwos-1, ones);\r\n //- I(sub_S) == power2(32*(thirtytwos-1) + ones)-1;\r\n var low_word:nat := WordConstructOneBits(32);\r\n S := BigNat_ctor([low_word] + sub_S.words);\r\n calc {\r\n I(S);\r\n { selectively_reveal_I(S); }\r\n I(sub_S) * Width() + low_word;\r\n //- MakePower2Minus1(sub_S) ensures\r\n (power2(32*(thirtytwos-1) + ones)-1) * Width() + low_word;\r\n //- Width ensures\r\n (power2(32*(thirtytwos-1) + ones)-1) * power2(32) + low_word;\r\n { lemma_mul_is_commutative(power2(32*(thirtytwos-1) + ones)-1, power2(32)); }\r\n power2(32) * (power2(32*(thirtytwos-1) + ones)-1) + low_word;\r\n { lemma_mul_is_distributive_sub(power2(32),power2(32*(thirtytwos-1) + ones),1); }\r\n power2(32) * (power2(32*(thirtytwos-1) + ones)) - power2(32) * 1 + low_word;\r\n { lemma_exponentiation(32, 32*(thirtytwos-1) + ones); }\r\n power2(32+32*(thirtytwos-1) + ones) - power2(32) * 1 + low_word;\r\n { lemma_mul_is_distributive_add(32,1,thirtytwos-1); }\r\n power2(32*thirtytwos + ones) - power2(32) * 1 + low_word;\r\n //- WordConstructOneBits ensures\r\n power2(32*thirtytwos + ones) - power2(32) * 1 + power2(32) - 1;\r\n power2(32*thirtytwos + ones) - power2(32) + power2(32) - 1;\r\n power2(32*thirtytwos + ones) - 1;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_bit_boundaries(A:BigNat, ac:nat, v:nat)\r\n requires WellformedBigNat(A);\r\n requires I(A) < power2(v);\r\n requires BitCount(A,ac);\r\n ensures ac <= v;\r\n{\r\n if (v\r\n {\r\n power2(ac-1) <= I(A);\r\n { lemma_power2_increases(v,ac-1); }\r\n power2(v) <= I(A);\r\n false;\r\n }\r\n }\r\n assert ac<=v;\r\n}\r\n\r\nstatic lemma lemma_modesty_bit_value_equivalence(A:BigNat,ac:nat)\r\n requires WellformedBigNat(A);\r\n requires BitCount(A,ac);\r\n ensures ModestBigNatBits(A,ac) <==> ModestBigNatValue(A);\r\n{\r\n if (ModestBigNatBits(A,ac))\r\n {\r\n calc ==> {\r\n //- ModestBigNatBits ensures\r\n ac <= power2(31);\r\n { lemma_power2_increases(ac, power2(31)); }\r\n power2(ac) <= power2(power2(31));\r\n //- BitCount(A,ac) ensures I(A) < power2(ac);\r\n I(A) < power2(power2(31));\r\n I(A) < KindaBigNat();\r\n ModestBigNatValue(A);\r\n }\r\n }\r\n assert ModestBigNatBits(A,ac) ==> ModestBigNatValue(A);\r\n\r\n if (ModestBigNatValue(A))\r\n {\r\n calc ==> {\r\n //- ModestBigNatValue(A) ensures\r\n I(A) < KindaBigNat();\r\n I(A) < power2(power2(31));\r\n { lemma_bit_boundaries(A, ac, power2(31)); }\r\n ac <= power2(31);\r\n ModestBigNatBits(A,ac);\r\n }\r\n }\r\n assert ModestBigNatValue(A) ==> ModestBigNatBits(A,ac);\r\n}\r\n\r\nstatic lemma lemma_modesty_word_value_equivalence(A:BigNat)\r\n requires WellformedBigNat(A);\r\n ensures ModestBigNatWords(A) <==> ModestBigNatValue(A);\r\n{\r\n var kinda_bignum:BigNat := MakePower2Minus1(power2(26)-1,32);\r\n calc {\r\n I(kinda_bignum);\r\n power2(32*(power2(26)-1) + 32)-1;\r\n power2(32*(power2(26)-1) + 32 * 1)-1;\r\n { lemma_mul_is_distributive_add(32,power2(26)-1,1); }\r\n power2(32 * power2(26))-1;\r\n { lemma_power2_5_is_32(); }\r\n power2(power2(5) * power2(26))-1;\r\n { lemma_exponentiation(5,26); }\r\n power2(power2(5+26))-1;\r\n KindaBigNat()-1;\r\n }\r\n\r\n if (ModestBigNatWords(A))\r\n {\r\n if (|A.words| < |kinda_bignum.words|)\r\n {\r\n lemma_cmp_inequal_length(A,kinda_bignum);\r\n assert I(A) <= I(kinda_bignum);\r\n }\r\n else\r\n {\r\n lemma_le_equal_length(A,kinda_bignum);\r\n assert I(A) <= I(kinda_bignum);\r\n }\r\n assert I(A) < KindaBigNat();\r\n assert ModestBigNatValue(A);\r\n }\r\n assert ModestBigNatWords(A) ==> ModestBigNatValue(A);\r\n\r\n if (ModestBigNatValue(A))\r\n {\r\n assert I(A) < KindaBigNat();\r\n assert I(A) <= I(kinda_bignum);\r\n if (|A.words| > |kinda_bignum.words|)\r\n {\r\n lemma_cmp_inequal_length(kinda_bignum, A);\r\n assert I(kinda_bignum) < I(A);\r\n assert false;\r\n }\r\n assert |A.words| <= power2(26);\r\n assert ModestBigNatWords(A);\r\n }\r\n assert ModestBigNatValue(A) ==> ModestBigNatWords(A);\r\n}\r\n\r\nstatic lemma lemma_zero_bits(A:BigNat, ac:nat)\r\n requires WellformedBigNat(A);\r\n requires BitCount(A,ac);\r\n ensures zero(A) <==> (ac==0);\r\n{\r\n assert ZeroBitRepresentation(A,ac);\r\n}\r\n\r\nstatic function method {:opaque} MakeSmallLiteralBigNat_def(x:nat) : BigNat\r\n requires x < Width();\r\n ensures WellformedBigNat(MakeSmallLiteralBigNat_def(x));\r\n{\r\n if (x==0) then\r\n BigNat_ctor([])\r\n else\r\n BigNat_ctor([x])\r\n}\r\n\r\nstatic lemma lemma_MakeSmallLiteralBigNat(x:nat)\r\n requires x < Width();\r\n ensures I(MakeSmallLiteralBigNat_def(x)) == x;\r\n{\r\n reveal_MakeSmallLiteralBigNat_def();\r\n var R:BigNat := MakeSmallLiteralBigNat_def(x);\r\n assert WellformedBigNat(R);\r\n if (x==0)\r\n {\r\n assert zero(R);\r\n assert I(R) == 0;\r\n }\r\n else\r\n {\r\n assert R.words == [x];\r\n calc {\r\n I(R);\r\n { reveal_I(); }\r\n I(BigNat_ctor(R.words[1..])) * Width()+R.words[0];\r\n { assert |R.words[1..]| == 0; }\r\n I(BigNat_ctor([])) * Width()+R.words[0];\r\n {\r\n reveal_I();\r\n lemma_mul_basics_forall();\r\n }\r\n R.words[0];\r\n x;\r\n }\r\n assert I(R) == x;\r\n }\r\n}\r\n\r\nstatic function method MakeSmallLiteralBigNat(x:nat) : BigNat\r\n requires x < Width();\r\n ensures WellformedBigNat(MakeSmallLiteralBigNat(x));\r\n ensures I(MakeSmallLiteralBigNat(x))==x;\r\n{\r\n lemma_MakeSmallLiteralBigNat(x);\r\n MakeSmallLiteralBigNat_def(x)\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- FrumpyBigNat: For when you need room to multiply two numbers.\r\n\r\nstatic function Frump() : nat\r\n{\r\n power2(power2(30))\r\n}\r\n\r\nstatic function FrumpyBigNat(N:BigNat) : bool\r\n{\r\n WellformedBigNat(N)\r\n && I(N) < Frump()\r\n}\r\n\r\nstatic lemma lemma_frumpy_is_modest(X:BigNat)\r\n requires FrumpyBigNat(X);\r\n ensures ModestBigNatWords(X);\r\n{\r\n lemma_power2_strictly_increases(30,31);\r\n lemma_power2_strictly_increases(power2(30),power2(31));\r\n lemma_modesty_word_value_equivalence(X);\r\n}\r\n\r\nstatic lemma lemma_frumpy_product_is_modest(X:BigNat,Y:BigNat,XY:BigNat)\r\n requires FrumpyBigNat(X);\r\n requires FrumpyBigNat(Y);\r\n requires WellformedBigNat(XY);\r\n requires I(X)*I(Y) == I(XY);\r\n ensures ModestBigNatWords(XY);\r\n{\r\n calc {\r\n I(XY);\r\n I(X) * I(Y);\r\n <= { lemma_mul_inequality(I(X), Frump(), I(Y)); }\r\n Frump() * I(Y);\r\n { lemma_mul_is_commutative_forall(); }\r\n I(Y) * Frump();\r\n < { lemma_mul_strict_inequality(I(Y), Frump(), Frump()); }\r\n Frump() * Frump();\r\n power2(power2(30)) * power2(power2(30));\r\n { lemma_power2_adds(power2(30), power2(30)); }\r\n power2(power2(30) + power2(30));\r\n power2(2 * power2(30));\r\n { reveal_power2(); }\r\n power2(power2(31));\r\n }\r\n lemma_modesty_word_value_equivalence(XY);\r\n}\r\n\r\nstatic lemma lemma_frumpy_squared_is_modest(X:BigNat,Xsquared:BigNat)\r\n requires FrumpyBigNat(X);\r\n requires WellformedBigNat(Xsquared);\r\n requires I(X)*I(X) == I(Xsquared);\r\n ensures ModestBigNatWords(Xsquared);\r\n{\r\n lemma_frumpy_product_is_modest(X,X,Xsquared);\r\n}\r\n\r\nstatic lemma lemma_power2_strictly_increases_converse_imply(e1: int, e2: int)\r\n ensures 0 <= e1 && 0 < e2 && power2(e1) < power2(e2) ==> e1 < e2;\r\n{\r\n if (0 <= e1 && 0 < e2 && power2(e1) < power2(e2))\r\n {\r\n lemma_power2_strictly_increases_converse(e1,e2);\r\n }\r\n}\r\n\r\nmethod WordCountBits(a:nat) returns (s:nat)\r\n requires Word32(a);\r\n ensures s>0 ==> power2(s-1) <= a;\r\n ensures s==0 <==> (a==0);\r\n ensures a < power2(s);\r\n ensures s<=32;\r\n{\r\n \r\n \r\n s := 0;\r\n var ps := 1;\r\n ghost var gps := 1;\r\n\r\n lemma_power2_0_is_1();\r\n while (s<32 && ps<=a)\r\n decreases Width()-gps;\r\n invariant gps == power2(s);\r\n invariant s>0 ==> power2(s-1) <= a;\r\n invariant a==0 ==> s==0;\r\n invariant 0<=s<=32;\r\n invariant s<=31 ==> ps==gps;\r\n invariant s==0 ==> a==0 || gps<=a;\r\n {\r\n s := s + 1;\r\n//- ps := 2*ps; // TODO: implement *\r\n gps := gps+gps;\r\n if (s<32)\r\n {\r\n ps := ps+ps;\r\n }\r\n reveal_power2();\r\n }\r\n//- if (s>1)\r\n {\r\n assert s>1 ==> power2(s-1) <= a;\r\n assert a < Width();\r\n assert a < power2(32);\r\n assert s>1 ==> power2(s-1) < power2(32);\r\n lemma_power2_strictly_increases_converse_imply(s-1,32);\r\n assert s-1 < 32;\r\n assert s <= 32;\r\n }\r\n assert s <= 32;\r\n}\r\n\r\n\r\nmethod BigNatCountBits(A:BigNat) returns (c:nat)\r\n requires WellformedBigNat(A);\r\n requires ModestBigNatWords(A);\r\n ensures Word32(c);\r\n ensures BitCount(A, c);\r\n ensures c == NatNumBits(I(A));\r\n{\r\n if (zero(A))\r\n {\r\n c := 0;\r\n lemma_power2_0_is_1();\r\n }\r\n else\r\n {\r\n var last_word:nat := A.words[|A.words|-1];\r\n var last_word_bits:nat := WordCountBits(last_word);\r\n\r\n calc ==> {\r\n //- ModestBigNatWords(A) ensures\r\n |A.words| <= power2(26);\r\n { lemma_power2_increases(26,32); }\r\n |A.words| <= power2(32);\r\n |A.words| <= Width();\r\n |A.words|-1 < Width();\r\n Word32(|A.words|-1);\r\n }\r\n\r\n lemma_2to32();\r\n assert Word32(32);\r\n\r\n var l,h := Product32(32, |A.words|-1);\r\n if (h>0)\r\n {\r\n h := h; // HACK: turn ghost if into real if until dafnycc can handle ghost if in real methods\r\n calc\r\n {\r\n Width();\r\n <= { lemma_mul_properties(); }\r\n h * Width();\r\n <= l+h * Width();\r\n //- Product32 ensures\r\n <= 32 * (|A.words|-1);\r\n <= { lemma_mul_is_distributive_add(32,|A.words|,1); }\r\n 32 * |A.words|- 32 * 1;\r\n < { lemma_mul_strictly_positive_forall(); }\r\n 32 * |A.words|;\r\n //- Conflicts with ModestBigNat(A);\r\n }\r\n calc ==>\r\n {\r\n |A.words| <= power2(26);\r\n { lemma_mul_left_inequality(32,|A.words|,power2(26)); }\r\n 32 * |A.words| <= 32 * power2(26);\r\n { lemma_mul32power226_is_power31(); }\r\n 32 * |A.words| <= power2(31);\r\n { lemma_power2_strictly_increases(31,32); }\r\n 32 * |A.words| < Width();\r\n }\r\n assert false;\r\n }\r\n assert h==0;\r\n lemma_mul_annihilate(Width());\r\n assert l == 32 * (|A.words|-1);\r\n\r\n c := l + last_word_bits;\r\n assert c > 0;\r\n assert zero(A) <==> c==0;\r\n\r\n \r\n ghost var thirtytwos:nat;\r\n ghost var ones:nat;\r\n ghost var lo_proxy:BigNat;\r\n\r\n //- Prove lower bound. Requires special case at 1, where we can't ask for a\r\n //- MakePower2Minus1, since that's 2^0-1 == 0, which has no defined 'ones' part.\r\n //- So special-casing here keeps the main case cleaner.\r\n if (|A.words|==1 && last_word_bits==1)\r\n {\r\n last_word_bits := last_word_bits; // HACK: turn ghost if into real if until dafnycc can handle ghost if in real methods\r\n calc ==> {\r\n c == 32 * (|A.words|-1) + last_word_bits;\r\n { lemma_mul_annihilate(32); }\r\n c == 1;\r\n }\r\n lemma_power2_0_is_1();\r\n lemma_power2_1_is_2();\r\n assert power2(c-1) == power2(0) == 1 <= last_word < 2 == power2(c);\r\n assert last_word == 1;\r\n assert A.words[0] == last_word;\r\n assert A.words == [last_word];\r\n calc {\r\n I(A);\r\n I(BigNat_ctor([1]));\r\n { selectively_reveal_I(BigNat_ctor([1])); }\r\n I(BigNat_ctor(A.words[1..])) * Width()+1;\r\n { selectively_reveal_I(BigNat_ctor([])); }\r\n { reveal_I(); }\r\n 0 * Width()+1;\r\n { lemma_mul_basics_forall(); }\r\n 1;\r\n }\r\n assert I(A) == 1;\r\n\r\n assert I(A) < power2(c);\r\n }\r\n else if (last_word_bits==1)\r\n {\r\n last_word_bits := last_word_bits; // HACK: turn ghost if into real if until dafnycc can handle ghost if in real methods\r\n assert 2<=|A.words|;\r\n//- ghost var thirtytwos:nat := |A.words|-2;\r\n//- ghost var ones:nat := 32;\r\n//- ghost var lo_proxy:BigNat := MakePower2Minus1(thirtytwos,ones);\r\n thirtytwos := |A.words|-2;\r\n ones := 32;\r\n lo_proxy := MakePower2Minus1(thirtytwos,ones);\r\n\r\n calc {\r\n 32*thirtytwos+ones;\r\n 32*thirtytwos+32 * 1;\r\n { lemma_mul_is_distributive_add(32,thirtytwos,1); }\r\n 32 * (thirtytwos+1);\r\n 32 * (|A.words|-1);\r\n c - 1;\r\n }\r\n assert power2(c-1)-1 == I(lo_proxy);\r\n lemma_cmp_inequal_length(lo_proxy, A);\r\n assert power2(c-1) <= I(A);\r\n }\r\n else\r\n {\r\n//- ghost var thirtytwos:nat := |A.words|-1;\r\n//- ghost var ones:nat := last_word_bits-1;\r\n//- ghost var lo_proxy:BigNat := MakePower2Minus1(thirtytwos,ones);\r\n thirtytwos := |A.words|-1;\r\n ones := last_word_bits-1;\r\n lo_proxy := MakePower2Minus1(thirtytwos,ones);\r\n\r\n assert c == 32*thirtytwos+ones+1;\r\n assert power2(c-1)-1 == I(lo_proxy);\r\n lemma_lt_equal_length(lo_proxy, A);\r\n assert power2(c-1) <= I(A);\r\n }\r\n\r\n ghost var hi_proxy:BigNat := MakePower2Minus1(|A.words|-1,last_word_bits);\r\n\r\n calc ==>\r\n {\r\n true;\r\n //- MakePower2Minus1 ensures\r\n I(hi_proxy) == power2(32*(|A.words|-1) + last_word_bits)-1;\r\n I(hi_proxy) == power2(c)-1;\r\n {\r\n assert |A.words| == |A.words|-1 + 1 == |hi_proxy.words|;\r\n assert A.words[|A.words|-1] < power2(c) <==> A.words[|A.words|-1] <= power2(c)-1 <==> A.words[|A.words|-1] <= hi_proxy.words[|hi_proxy.words|-1];\r\n /* [ckh] current workaround for non-ghost calc doesn't handle nested calcs\r\n calc {\r\n |A.words|;\r\n |A.words|-1 + 1;\r\n |hi_proxy.words|;\r\n }\r\n calc ==> {\r\n A.words[|A.words|-1] < power2(c);\r\n A.words[|A.words|-1] <= power2(c)-1;\r\n A.words[|A.words|-1] <= hi_proxy.words[|hi_proxy.words|-1];\r\n }\r\n*/\r\n lemma_le_equal_length(A, hi_proxy);\r\n }\r\n I(A) <= power2(c)-1;\r\n I(A) < power2(c);\r\n }\r\n\r\n calc ==>\r\n {\r\n c == 32*(|A.words|-1) + last_word_bits;\r\n c <= 32*(|A.words|-1) + 32;\r\n c <= 32*(|A.words|-1) + 32 * 1;\r\n { lemma_mul_is_distributive_add(32,|A.words|-1,1); }\r\n c <= 32 * |A.words|;\r\n //- ModestBigNatWords(A) ensures |A.words|<=power2(26)\r\n { lemma_mul_left_inequality(32,|A.words|,power2(26)); }\r\n c <= 32 * power2(26);\r\n { lemma_mul32power226_is_power31(); }\r\n c <= power2(31);\r\n { lemma_power2_strictly_increases(31,32); }\r\n c < Width();\r\n Word32(c);\r\n }\r\n }\r\n lemma_Power2BoundIsNatNumBits(c, I(A));\r\n}\r\n\r\nstatic lemma lemma_unroll_power2(exp:nat)\r\n ensures power2(0) == 1;\r\n ensures power2(exp + 1) == 2 * power2(exp);\r\n{\r\n reveal_power2();\r\n}\r\n\r\nstatic method MakePower2Word32(exp:nat) returns (w:nat)\r\n requires exp<32;\r\n ensures w == power2(exp);\r\n ensures Word32(w);\r\n{\r\n lemma_2to32();\r\n reveal_power2();\r\n var n:int := 0;\r\n w := 1;\r\n//- lemma_unroll_power2(0);\r\n while (n < exp)\r\n invariant 0 <= n <= exp;\r\n invariant w == power2(n);\r\n invariant Word32(w);\r\n {\r\n//- lemma_unroll_power2(n);\r\n//- assert Word32(w + w);\r\n w := w + w;\r\n n := n + 1;\r\n lemma_power2_strictly_increases(n, 32);\r\n }\r\n/*\r\n \r\n w := [\r\n 1,\r\n 2,\r\n 4,\r\n 8,\r\n 16,\r\n 32,\r\n 64,\r\n 128,\r\n 256,\r\n 512,\r\n 1024,\r\n 2048,\r\n 4096,\r\n 8192,\r\n 16384,\r\n 32768,\r\n 65536,\r\n 131072,\r\n 262144,\r\n 524288,\r\n 1048576,\r\n 2097152,\r\n 4194304,\r\n 8388608,\r\n 16777216,\r\n 33554432,\r\n 67108864,\r\n 134217728,\r\n 268435456,\r\n 536870912,\r\n 1073741824,\r\n 2147483648 ][exp];\r\n\r\n lemma_2to32();\r\n\r\n reveal_power2();\r\n assert 1==power2(0);\r\n assert 2==power2(1);\r\n assert 4==power2(2);\r\n assert 8==power2(3);\r\n assert 16==power2(4);\r\n assert 32==power2(5);\r\n assert 64==power2(6);\r\n assert 128==power2(7);\r\n assert 256==power2(8);\r\n assert 512==power2(9);\r\n assert 1024==power2(10);\r\n assert 2048==power2(11);\r\n assert 4096==power2(12);\r\n assert 8192==power2(13);\r\n assert 16384==power2(14);\r\n assert 32768==power2(15);\r\n assert 65536==power2(16);\r\n assert 131072==power2(17);\r\n assert 262144==power2(18);\r\n assert 524288==power2(19);\r\n assert 1048576==power2(20);\r\n assert 2097152==power2(21);\r\n assert 4194304==power2(22);\r\n assert 8388608==power2(23);\r\n assert 16777216==power2(24);\r\n assert 33554432==power2(25);\r\n assert 67108864==power2(26);\r\n assert 134217728==power2(27);\r\n assert 268435456==power2(28);\r\n assert 536870912==power2(29);\r\n assert 1073741824==power2(30);\r\n assert 2147483648==power2(31);\r\n*/\r\n}\r\n\r\nstatic method IsModestBigNat (A:BigNat) returns (modest:bool)\r\n requires WellformedBigNat(A);\r\n ensures modest == ModestBigNatValue(A);\r\n{\r\n modest := (|A.words| <= 0x4000000);\r\n lemma_2to32();\r\n reveal_power2();\r\n assert 0x4000000 == power2(26);\r\n assert modest == ModestBigNatWords(A);\r\n lemma_modesty_word_value_equivalence(A);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/BigNatBitwise.i.dfy", "content": "include \"BigNatCore.i.dfy\"\r\ninclude \"BigNatBitCount.i.dfy\"\r\ninclude \"BigNatCompare.i.dfy\"\r\ninclude \"BigNumBEAdaptor.i.dfy\"\r\ninclude \"../Math/BitwiseOperations.i.dfy\"\r\ninclude \"../Util/word_bits.i.dfy\"\r\ninclude \"../Util/arrays_2.i.dfy\"\r\n\r\nstatic lemma lemma_SelectBitWord(b:nat, M:seq)\r\n requires b<|M|*32;\r\n requires IsWordSeq(M);\r\n ensures 0 <= b/32 < |M|;\r\n ensures SelectBit(b, BEWordSeqToInt_premium(M)) == SelectBit(b%32, M[|M|-1-b/32]);\r\n{\r\n ghost var m := BEWordSeqToInt_premium(M);\r\n ghost var br := (b/32)*32;\r\n lemma_div_pos_is_pos(m, power2(br));\r\n calc {\r\n SelectBit(b, m);\r\n { lemma_SelectBit_div(b, m, br); }\r\n SelectBit(b-br, m / power2(br));\r\n SelectBit(b%32, m / power2(br));\r\n {\r\n lemma_SelectBit_mod(b%32, m/power2(br), 32);\r\n lemma_mod_pos_bound(m / power2(br), power2(32));\r\n }\r\n SelectBit(b%32, (m / power2(br)) % power2(32));\r\n { lemma_BEWordSeq_extract(M, b/32); }\r\n SelectBit(b%32, M[|M|-1-b/32]);\r\n }\r\n}\r\n\r\nstatic method BEBitwiseMask(X:seq, c:nat) returns (M:seq)\r\n requires IsWordSeq(X);\r\n//- requires |X| < power2(32); //- if we want to avoid runtime overflow\r\n requires Word32(c);\r\n ensures IsWordSeq(M);\r\n ensures PureBitwiseAnd(BEWordSeqToInt_premium(X), power2(c)-1) == BEWordSeqToInt(M);\r\n{\r\n ghost var mask_index := (|X|*32-(1+c))/32;\r\n var use_mask_index;\r\n var nonnegative_mask_index;\r\n if (|X|*32 < 1+c)\r\n {\r\n use_mask_index := false;\r\n nonnegative_mask_index := 0;\r\n }\r\n else\r\n {\r\n use_mask_index := true;\r\n nonnegative_mask_index := (|X|*32-(1+c))/32;\r\n }\r\n assert use_mask_index ==> nonnegative_mask_index == mask_index;\r\n assert 0<=nonnegative_mask_index;\r\n\r\n M := [];\r\n var i:=0;\r\n lemma_power2_increases(c%32,32);\r\n ghost var mask := power2(c)-1;\r\n ghost var x := BEWordSeqToInt_premium(X);\r\n assert IsWordSeq(RepeatDigit_premium(0,|X|-|M|));\r\n\r\n while (i<|X|)\r\n invariant |M|==i;\r\n invariant i<=|X|;\r\n//- invariant forall i::0<=i<|M|\r\n//- ==> M[i] == if i==mask_index then Asm_BitwiseAnd(X[i], power2(c%32)-1) else X[i];\r\n invariant IsWordSeq(M);\r\n invariant IsWordSeq(M + RepeatDigit(0,|X|-|M|));\r\n invariant forall b:: ((|X|-|M|)*32 <= b < |X|*32)\r\n ==> (SelectBit(b, BEWordSeqToInt_premium(M + RepeatDigit(0,|X|-|M|))) ==\r\n (if b=c;\r\n //- ...and we're off the top of the mask.\r\n calc {\r\n SelectBit(b, pm');\r\n { lemma_SelectBitWord(b, PM'); }\r\n SelectBit(b%32, PM'[wordi]);\r\n SelectBit(b%32, 0);\r\n (div(0,power2(b%32))) % 2 == 1;\r\n { lemma_div_basics(power2(b%32)); }\r\n 0 == 1;\r\n false;\r\n if (b= (|X|-|M'|)*32;\r\n calc {\r\n SelectBit(b, pm');\r\n { lemma_SelectBitWord(b, PM'); }\r\n SelectBit(b%32, PM'[wordi]);\r\n SelectBit(b%32, nextword);\r\n SelectBit(b%32, X[wordi]) && SelectBit(b%32, word_mask);\r\n { lemma_SelectBitWord(b, X); }\r\n SelectBit(b, x) && SelectBit(b%32, word_mask);\r\n { lemma_mask_structure(c%32, b%32); }\r\n SelectBit(b, x) && (b%32 (SelectBit(b, BEWordSeqToInt_premium(M' + RepeatDigit(0,|X|-|M'|))) ==\r\n (if b=|X|*32)\r\n {\r\n lemma_BEWordSeqToInt_bound(M);\r\n lemma_power2_increases(|X|*32, b);\r\n lemma_SelectBit_overflow(b,m);\r\n lemma_BEWordSeqToInt_bound(X);\r\n lemma_SelectBit_overflow(b,x);\r\n }\r\n else if (b (a < b);\r\n//-\r\n//-method Eq32(a:nat, b:nat) returns (r:bool)\r\n//- requires Word32(a);\r\n//- requires Word32(b);\r\n//- ensures r <==> (a==b);\r\n//-\r\n//-///////////////////////////////////////////\r\n\r\n\r\nstatic lemma lemma_bignum_lower_bound(A:BigNat)\r\n decreases |A.words|;\r\n requires WellformedBigNat(A);\r\n requires nonzero(A);\r\n ensures 0 <= 32 * (|A.words|-1);\r\n ensures power2(32 * (|A.words|-1)) <= I(A);\r\n{\r\n var alen:int := |A.words|;\r\n if (alen==1)\r\n {\r\n lemma_mul_nonnegative(32,(alen-1));\r\n calc\r\n {\r\n power2(32 * (|A.words|-1));\r\n power2(32 * 0);\r\n { lemma_mul_annihilate(32); }\r\n power2(0);\r\n { lemma_power2_0_is_1(); }\r\n 1;\r\n }\r\n calc {\r\n 1;\r\n <= { reveal_I(); }\r\n I(A);\r\n }\r\n }\r\n else\r\n {\r\n lemma_mul_nonnegative(32,(alen-1));\r\n assert 0<=32 *(alen-1);\r\n lemma_mul_nonnegative(32,(alen-2));\r\n assert 0<=32 *(alen-2);\r\n\r\n assert 0 < Width();\r\n assert Width() == power2(32);\r\n assert 0 <= lo(A);\r\n\r\n calc ==> {\r\n true;\r\n { lemma_bignum_lower_bound(hi(A)); }\r\n power2(32*(alen-2)) <= I(hi(A));\r\n { lemma_mul_left_inequality(Width(), power2(32*(alen-2)), I(hi(A))); }\r\n Width() * power2(32*(alen-2)) <= Width() * I(hi(A));\r\n power2(32) * power2(32*(alen-2)) <= Width() * I(hi(A));\r\n { lemma_power2_adds(32, 32*(alen-2)); }\r\n power2(32 + 32*(alen-2)) <= Width() * I(hi(A));\r\n power2(32*1 + 32*(alen-2)) <= Width() * I(hi(A));\r\n { lemma_mul_is_distributive_add(32, 1, alen-2); }\r\n power2(32 * (1 + (alen-2))) <= Width() * I(hi(A));\r\n //- additive math\r\n power2(32 * (alen-1)) <= Width() * I(hi(A));\r\n //- add 0<=lo(A) to each sides\r\n power2(32*(alen-1)) + 0 <= Width() * I(hi(A)) + lo(A);\r\n { lemma_hilo(A); lemma_mul_is_commutative(Width(), I(hi(A))); }\r\n power2(32*(alen-1)) <= I(A);\r\n power2(32 * (|A.words|-1)) <= I(A);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_bignum_upper_bound(A:BigNat)\r\n decreases |A.words|;\r\n requires WellformedBigNat(A);\r\n ensures 0 <= 32 * |A.words|;\r\n ensures I(A) <= power2(32 * |A.words|)-1;\r\n{\r\n var alen:int := |A.words|;\r\n lemma_mul_nonnegative(32,alen);\r\n if (alen==0)\r\n {\r\n calc ==>\r\n {\r\n true;\r\n { reveal_I(); }\r\n I(A) == 0;\r\n { lemma_power2_0_is_1(); }\r\n I(A) < power2(0);\r\n { lemma_mul_annihilate(32); }\r\n I(A) < power2(32*0);\r\n I(A) < power2(32*alen);\r\n }\r\n }\r\n else\r\n {\r\n lemma_mul_nonnegative(32,alen-1);\r\n calc ==> {\r\n true;\r\n { lemma_bignum_upper_bound(hi(A)); }\r\n I(hi(A)) <= power2(32*(alen-1)) - 1;\r\n { lemma_mul_left_inequality(Width(), I(hi(A)), power2(32*(alen-1))-1); }\r\n Width() * I(hi(A)) <= Width() * (power2(32*(alen-1)) - 1);\r\n { lemma_mul_is_distributive_sub(Width(), power2(32*(alen-1)), 1); }\r\n Width() * I(hi(A)) <= Width() * power2(32*(alen-1)) - Width() * 1;\r\n Width() * I(hi(A)) <= Width() * power2(32*(alen-1)) - Width();\r\n Width() * I(hi(A)) <= power2(32) * power2(32*(alen-1)) - Width();\r\n { lemma_exponentiation(32, 32*(alen-1)); }\r\n Width() * I(hi(A)) <= power2(32 + 32*(alen-1)) - Width();\r\n Width() * I(hi(A)) <= power2(32*1 + 32*(alen-1)) - Width();\r\n { lemma_mul_is_distributive_add(32, 1, alen-1); }\r\n Width() * I(hi(A)) <= power2(32*alen) - Width();\r\n //- add lo(A) <= power2(32)-1;\r\n Width() * I(hi(A)) + lo(A) <= power2(32*alen) - Width() + power2(32) - 1;\r\n { lemma_hilo(A); lemma_mul_is_commutative(Width(), I(hi(A))); }\r\n I(A) <= power2(32*alen) - 1;\r\n }\r\n }\r\n}\r\n\r\n\r\n\r\nstatic lemma lemma_word_bound(A:BigNat)\r\n requires WellformedBigNat(A);\r\n requires !zero(A);\r\n ensures 0<=32 * |A.words|;\r\n ensures I(A) < power2(32*|A.words|);\r\n ensures 0<=32*(|A.words|-1);\r\n ensures power2(32*(|A.words|-1)) <= I(A);\r\n{\r\n lemma_bignum_lower_bound(A);\r\n lemma_bignum_upper_bound(A);\r\n}\r\n\r\nstatic lemma{:dafnycc_conservative_seq_triggers} behead(A:BigNat,i:int) returns (t:int, m:int, l:int)\r\n requires WellformedBigNat(A);\r\n requires |A.words| > 0;\r\n requires 0<=i<|A.words|;\r\n ensures 32*i >= 0;\r\n ensures 32*(i+1) >= 0;\r\n ensures I(A)==power2(32*(i+1)) * t + power2(32*i) * m + l;\r\n ensures WellformedBigNat(BigNat_ctor(A.words[i+1..]));\r\n ensures t == I(BigNat_ctor(A.words[i+1..]));\r\n ensures m == A.words[i];\r\n ensures 0 <= l < power2(32*i);\r\n{\r\n calc ==> {\r\n 0<=i;\r\n { lemma_mul_left_inequality(32,0,i); }\r\n 32*0 <= 32*i;\r\n { lemma_mul_annihilate(32); }\r\n 0 <= 32*i;\r\n }\r\n\r\n var ts:seq := A.words[i+1..];\r\n var ms:seq := A.words[i..i+1];\r\n var ls:seq := A.words[0..i];\r\n\r\n var T:BigNat := BigNat_ctor(ts);\r\n assert WellformedBigNat(T);\r\n\r\n t := V(ts);\r\n lemma_V_I(T);\r\n assert V(ts) == I(T);\r\n\r\n m := V(ms);\r\n lemma_V_singleton(ms);\r\n assert m == A.words[i];\r\n\r\n l := V(ls);\r\n lemma_V_lower_bound(ls);\r\n assert 0 <= l;\r\n lemma_V_upper_bound(ls);\r\n assert l < power2(32*i);\r\n\r\n lemma_V_power(ls,ms);\r\n assert V(ls+ms) == power2(32*i) *V(ms)+V(ls);\r\n lemma_V_power(ls+ms,ts);\r\n assert V((ls+ms)+ts) == power2(32*(i+1))*V(ts) +V(ls+ms);\r\n assert V((ls+ms)+ts) == power2(32*(i+1))*V(ts) + power2(32*i) * V(ms) + V(ls);\r\n assert V((ls+ms)+ts) == power2(32*(i+1))*t+power2(32*i) * m +l;\r\n assert ls+(ms+ts) == A.words;\r\n assert (ls+ms)+ts == A.words;\r\n lemma_V_I(A);\r\n assert I(A) == V(A.words);\r\n assert I(A) == V((ls+ms)+ts);\r\n assert I(A) == power2(32*(i+1))*t+power2(32*i)*m+l;\r\n}\r\n\r\ndatatype BNCmp = BNCmpLt | BNCmpEq | BNCmpGt;\r\n\r\nstatic lemma BigNatLtEqualLengthOne_(A:BigNat, B:BigNat, i:int)\r\n decreases i;\r\n requires |A.words|==|B.words|;\r\n requires 0 <= i < |A.words|;\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n requires forall k:int :: i < k < |A.words| ==> A.words[k]==B.words[k];\r\n requires A.words[i] < B.words[i];\r\n ensures I(A) < I(B);\r\n{\r\n ghost var At,Am,Al := behead(A,i);\r\n ghost var Bt,Bm,Bl := behead(B,i);\r\n\r\n var Atop:seq := A.words[i+1..];\r\n var Btop:seq := B.words[i+1..];\r\n assert Atop == Btop;\r\n calc\r\n {\r\n At;\r\n I(BigNat_ctor(Atop));\r\n I(BigNat_ctor(Btop));\r\n Bt;\r\n }\r\n\r\n ghost var t:int := power2(32*(i+1));\r\n ghost var m:int := power2(32*i);\r\n\r\n assert I(B)==power2(32*(i+1)) * Bt + power2(32*i) * Bm + Bl;\r\n assert I(B)==t * Bt + m * Bm + Bl;\r\n\r\n calc ==>\r\n {\r\n //- behead\r\n I(A) == t * At + m * Am + Al;\r\n //- behead { Al <= k; }\r\n I(A) < t * At + m * Am + m;\r\n { lemma_mul_is_distributive_add(m,Am,1); }\r\n I(A) < t * At + m * (Am+1);\r\n { assert Am+1 <= Bm; lemma_mul_left_inequality(m,Am+1,Bm); }\r\n I(A) < t * Bt + m * Bm;\r\n //- behead { 0 <= Bl; }\r\n I(A) < t * Bt + m * Bm + Bl;\r\n //- behead\r\n I(A) < I(B);\r\n }\r\n}\r\n\r\nstatic lemma lemma_lt_equal_length(A:BigNat, B:BigNat)\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n requires |A.words|==|B.words|;\r\n requires !zero(A);\r\n requires A.words[|A.words|-1] < B.words[|A.words|-1];\r\n ensures I(A) < I(B);\r\n{\r\n BigNatLtEqualLengthOne_(A, B, |A.words|-1);\r\n}\r\n\r\nstatic lemma BigNatLeEqualLengthOne_(A:BigNat, B:BigNat, i:int)\r\n decreases i;\r\n requires |A.words|==|B.words|;\r\n requires 0 <= i < |A.words|;\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n requires forall k:int :: i < k < |A.words| ==> A.words[k]==B.words[k];\r\n requires forall j:int :: 0 <= j <= i ==> A.words[j]<=B.words[j];\r\n ensures I(A) <= I(B);\r\n{\r\n if (A.words[i] < B.words[i])\r\n {\r\n BigNatLtEqualLengthOne_(A, B, i);\r\n //- We've established inequality\r\n }\r\n else if (A.words[i] > B.words[i])\r\n {\r\n assert false;\r\n }\r\n else if (i > 0)\r\n {\r\n //- continue in the loop towards equality.\r\n BigNatLeEqualLengthOne_(A, B, i - 1);\r\n }\r\n else\r\n {\r\n lemma_BigNatEqEqualLength_(A,B);\r\n }\r\n}\r\n\r\nstatic lemma lemma_BigNatEqEqualLength_(A:BigNat, B:BigNat)\r\n requires |A.words|==|B.words|;\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n requires forall k:int :: 0 <= k < |A.words| ==> A.words[k]==B.words[k];\r\n ensures I(A) == I(B);\r\n{\r\n calc ==> {\r\n A.words == B.words;\r\n A == B;\r\n I(A) == I(B);\r\n }\r\n}\r\n\r\nstatic method BigNatCmpEqualLength_(A:BigNat, B:BigNat, i:int) returns (c:BNCmp)\r\n requires |A.words|==|B.words|;\r\n requires 0 <= i < |A.words|;\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n requires forall k:int :: i < k < |A.words| ==> A.words[k]==B.words[k];\r\n ensures (c==BNCmpLt) <==> (I(A) < I(B));\r\n ensures (c==BNCmpEq) <==> (I(A) == I(B));\r\n ensures (c==BNCmpGt) <==> (I(A) > I(B));\r\n{\r\n var n := i + 1;\r\n while (n > 0)\r\n invariant 0 <= n <= i + 1;\r\n invariant forall k:int :: n <= k < |A.words| ==> A.words[k]==B.words[k];\r\n {\r\n n := n - 1;\r\n if (A.words[n] < B.words[n])\r\n {\r\n BigNatLtEqualLengthOne_(A,B,n);\r\n c := BNCmpLt;\r\n return;\r\n }\r\n else if (A.words[n] > B.words[n])\r\n {\r\n BigNatLtEqualLengthOne_(B,A,n);\r\n c := BNCmpGt;\r\n return;\r\n }\r\n }\r\n c := BNCmpEq;\r\n lemma_BigNatEqEqualLength_(A,B);\r\n}\r\n\r\nstatic lemma lemma_cmp_inequal_length(A:BigNat, B:BigNat)\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n requires |A.words| < |B.words|;\r\n ensures I(A) < I(B);\r\n{\r\n lemma_bignum_upper_bound(A);\r\n assert I(A) < power2(32 * (|A.words|));\r\n lemma_bignum_lower_bound(B);\r\n assert power2(32 * (|B.words|-1)) <= I(B);\r\n assert |A.words| <= |B.words|-1;\r\n lemma_mul_left_inequality(32, |A.words|, |B.words|-1);\r\n assert 32*|A.words| <= 32 * (|B.words|-1);\r\n lemma_power2_increases(32*|A.words|, 32 * (|B.words|-1));\r\n assert power2(32 * (|A.words|)) <= power2(32 * (|B.words|-1));\r\n}\r\n\r\nstatic lemma lemma_hi_decreases(A:BigNat)\r\n requires WellformedBigNat(A);\r\n ensures zero(A) || I(hi(A)) zero(hi(A));\r\n{\r\n if (zero(A))\r\n {\r\n assert zero(hi(A));\r\n }\r\n else\r\n {\r\n assert |hi(A).words| < |A.words|;\r\n lemma_cmp_inequal_length(hi(A), A);\r\n }\r\n}\r\n\r\nstatic method BigNatCmp(A:BigNat, B:BigNat) returns (c:BNCmp)\r\n decreases |A.words|;\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n ensures (c==BNCmpLt) <==> (I(A) < I(B));\r\n ensures (c==BNCmpEq) <==> (I(A) == I(B));\r\n ensures (c==BNCmpGt) <==> (I(A) > I(B));\r\n{\r\n if (zero(A))\r\n {\r\n if (zero(B))\r\n {\r\n c := BNCmpEq;\r\n }\r\n else\r\n {\r\n c := BNCmpLt;\r\n }\r\n }\r\n else if (zero(B))\r\n {\r\n c := BNCmpGt;\r\n }\r\n else if (|A.words| < |B.words|)\r\n {\r\n lemma_cmp_inequal_length(A,B);\r\n c := BNCmpLt;\r\n }\r\n else if (|A.words| > |B.words|)\r\n {\r\n lemma_cmp_inequal_length(B,A);\r\n c := BNCmpGt;\r\n }\r\n else\r\n {\r\n c := BigNatCmpEqualLength_(A,B,|A.words|-1);\r\n }\r\n}\r\n\r\nstatic method BigNatLt(A:BigNat, B:BigNat) returns (r:bool)\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n ensures r <==> I(A) I(A)<=I(B);\r\n{\r\n var c := BigNatCmp(A,B);\r\n r := (c.BNCmpLt?) || (c.BNCmpEq?);\r\n}\r\n\r\nstatic method BigNatEq(A:BigNat, B:BigNat) returns (r:bool)\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n ensures r <==> I(A)==I(B);\r\n{\r\n var c := BigNatCmp(A,B);\r\n r := (c.BNCmpEq?);\r\n}\r\n\r\nstatic method BigNatGe(A:BigNat, B:BigNat) returns (r:bool)\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n ensures r <==> I(A)>=I(B);\r\n{\r\n var c := BigNatCmp(A,B);\r\n r := (c.BNCmpGt?) || (c.BNCmpEq?);\r\n}\r\n\r\nstatic method BigNatGt(A:BigNat, B:BigNat) returns (r:bool)\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n ensures r <==> I(A)>I(B);\r\n{\r\n var c := BigNatCmp(A,B);\r\n r := (c.BNCmpGt?);\r\n}\r\n\r\n\r\nstatic function method TestEqSmallLiteralBigNat_def(x:nat, X: BigNat) : bool\r\n requires x < Width();\r\n requires WellformedBigNat(X);\r\n{\r\n if (zero(X)) then\r\n x==0\r\n else if |X.words|>1 then\r\n false\r\n else\r\n X.words[0]==x\r\n}\r\n\r\nstatic lemma lemma_TestEqSmallLiteralBigNat(x:nat, X: BigNat)\r\n requires x < Width();\r\n requires WellformedBigNat(X);\r\n ensures x==I(X) <==> TestEqSmallLiteralBigNat_def(x,X);\r\n{\r\n if (zero(X))\r\n {\r\n }\r\n else if (|X.words|>1)\r\n {\r\n calc ==> {\r\n 1 <= |X.words|-1;\r\n { lemma_mul_inequality_forall(); }\r\n 1 * 32 <= (|X.words|-1) * 32;\r\n { lemma_mul_is_mul_boogie(1,32); }\r\n 32 <= (|X.words|-1) * 32;\r\n { lemma_mul_is_commutative_forall(); }\r\n 32 <= 32 * (|X.words|-1);\r\n { lemma_power2_increases(32, 32 * (|X.words|-1)); }\r\n power2(32) <= power2(32 * (|X.words|-1));\r\n { lemma_bignum_lower_bound(X); }\r\n Width() <= power2(32 * (|X.words|-1)) <= I(X);\r\n }\r\n\r\n assert x < Width();\r\n }\r\n else\r\n {\r\n assert |X.words|==1;\r\n calc {\r\n I(X);\r\n { reveal_I(); }\r\n I(BigNat_ctor(X.words[1..])) * Width()+X.words[0];\r\n { assert X.words[1..] == []; }\r\n I(BigNat_ctor([])) * Width()+X.words[0];\r\n { reveal_I(); }\r\n 0 * Width()+X.words[0];\r\n { lemma_mul_basics_forall(); }\r\n X.words[0];\r\n }\r\n }\r\n}\r\n\r\nstatic function method TestEqSmallLiteralBigNat(x:nat, X: BigNat) : bool\r\n requires x < Width();\r\n requires WellformedBigNat(X);\r\n ensures x==I(X) <==> TestEqSmallLiteralBigNat(x,X);\r\n{\r\n lemma_TestEqSmallLiteralBigNat(x, X);\r\n TestEqSmallLiteralBigNat_def(x, X)\r\n}\r\n\r\nstatic lemma lemma_le_equal_length(A:BigNat, B:BigNat)\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n requires |A.words|==|B.words|;\r\n requires !zero(A);\r\n requires forall i:nat :: i < |A.words| ==> A.words[i] <= B.words[i];\r\n ensures I(A) <= I(B);\r\n{\r\n BigNatLeEqualLengthOne_(A, B, |A.words|-1);\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/BigNatCore.i.dfy", "content": "include \"../Math/mul.i.dfy\"\r\ninclude \"Word32.i.dfy\"\r\n\r\ndatatype BigNat = BigNat_ctor(\r\n words : seq);\r\n\r\nstatic function WellformedBigNat(b:BigNat) : bool\r\n{\r\n (forall i :: 0 <= i < |b.words| ==> b.words[i]>=0 && Word32(b.words[i]))\r\n && (|b.words|==0 || b.words[|b.words|-1] > 0)\r\n}\r\n\r\nstatic function {:opaque} I(b:BigNat) : nat\r\n decreases |b.words|;\r\n requires WellformedBigNat(b);\r\n{\r\n lemma_mul_nonnegative_forall();\r\n if (|b.words|==0) then\r\n 0\r\n else\r\n I(BigNat_ctor(b.words[1..])) * Width()+b.words[0]\r\n}\r\n\r\nstatic function method lo(a:BigNat) : nat\r\n requires WellformedBigNat(a);\r\n ensures Word32(lo(a));\r\n{\r\n if (|a.words|==0) then 0 else a.words[0]\r\n}\r\n\r\nstatic function method hi(a:BigNat) : BigNat\r\n requires WellformedBigNat(a);\r\n ensures WellformedBigNat(hi(a));\r\n{\r\n if (|a.words|==0) then\r\n BigNat_ctor([])\r\n else\r\n BigNat_ctor(a.words[1..])\r\n}\r\n\r\nstatic lemma lemma_hilo(A:BigNat)\r\n requires WellformedBigNat(A);\r\n ensures I(A)==I(hi(A)) * Width() + lo(A);\r\n{\r\n reveal_I();\r\n if (|A.words|==0)\r\n {\r\n calc {\r\n I(A);\r\n 0;\r\n { lemma_mul_properties(); }\r\n 0 * Width();\r\n I(hi(A)) * Width();\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_I_length_implies_value(a:BigNat)\r\n decreases |a.words|;\r\n requires WellformedBigNat(a);\r\n ensures |a.words|==0 ==> I(a)==0;\r\n ensures |a.words|>0 ==> I(a)>0;\r\n{\r\n if (|a.words|==0)\r\n {\r\n reveal_I();\r\n assert I(a)==0;\r\n }\r\n else if (|a.words|==1)\r\n {\r\n reveal_I();\r\n lemma_mul_basics_forall();\r\n assert I(a)>0;\r\n }\r\n else\r\n {\r\n var sub_a:BigNat := hi(a);\r\n lemma_I_length_implies_value(sub_a);\r\n assert |sub_a.words| > 0;\r\n assert I(sub_a) > 0;\r\n calc {\r\n I(a);\r\n { reveal_I(); }\r\n I(BigNat_ctor(a.words[1..])) * Width() + a.words[0];\r\n I(sub_a) * Width() + a.words[0];\r\n > {\r\n assert I(sub_a) > 0;\r\n assert Width() > 0;\r\n lemma_mul_strictly_positive_forall();\r\n assert I(sub_a) * Width() > 0;\r\n }\r\n 0;\r\n }\r\n assert I(a)>0;\r\n }\r\n}\r\n\r\nstatic lemma lemma_I_value_implies_length(a:BigNat)\r\n requires WellformedBigNat(a);\r\n ensures I(a)==0 ==> |a.words|==0;\r\n{\r\n if (I(a)==0)\r\n {\r\n if (|a.words|>0)\r\n {\r\n lemma_I_length_implies_value(a);\r\n assert I(a)>0;\r\n assert false;\r\n }\r\n assert |a.words|==0;\r\n }\r\n else\r\n {\r\n if (|a.words|==0)\r\n {\r\n lemma_I_length_implies_value(a);\r\n assert I(a)==0;\r\n assert false;\r\n }\r\n assert |a.words|>0;\r\n }\r\n}\r\n\r\nstatic function method nonzero(a:BigNat) : bool\r\n requires WellformedBigNat(a);\r\n ensures nonzero(a) <==> I(a)!=0;\r\n{\r\n lemma_I_length_implies_value(a);\r\n lemma_I_value_implies_length(a);\r\n |a.words|>0\r\n}\r\n\r\nstatic function method zero(a:BigNat) : bool\r\n requires WellformedBigNat(a);\r\n ensures zero(a) <==> I(a)==0;\r\n{\r\n lemma_I_length_implies_value(a);\r\n lemma_I_value_implies_length(a);\r\n |a.words|==0\r\n}\r\n\r\nstatic function method BigNatZero() : BigNat\r\n ensures WellformedBigNat(BigNatZero());\r\n ensures zero(BigNatZero());\r\n ensures zero(BigNatZero()) <==> I(BigNatZero())==0;\r\n ensures I(BigNatZero()) == 0;\r\n{\r\n reveal_I();\r\n BigNat_ctor([])\r\n}\r\n\r\nstatic lemma selectively_reveal_I(A:BigNat)\r\n requires WellformedBigNat(A);\r\n ensures I(A) ==\r\n if (|A.words|==0) then\r\n 0\r\n else\r\n I(BigNat_ctor(A.words[1..])) * Width()+A.words[0];\r\n{\r\n reveal_I();\r\n}\r\n\r\nstatic lemma lemma_I_is_nonnegative(A:BigNat)\r\n requires WellformedBigNat(A);\r\n ensures 0 <= I(A);\r\n{\r\n if (|A.words|==0)\r\n {\r\n }\r\n else\r\n {\r\n calc {\r\n I(A);\r\n { selectively_reveal_I(A); }\r\n I(BigNat_ctor(A.words[1..])) * Width()+A.words[0];\r\n >= { lemma_mul_nonnegative_forall(); }\r\n 0+A.words[0];\r\n >= 0;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_I_is_nonnegative_forall()\r\n ensures forall A:BigNat :: WellformedBigNat(A) ==> 0 <= I(A);\r\n{\r\n forall (A:BigNat | WellformedBigNat(A))\r\n ensures 0 <= I(A);\r\n {\r\n lemma_I_is_nonnegative(A);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/BigNatDiv.i.dfy", "content": "include \"BigNatSub.i.dfy\"\r\ninclude \"BigNatMul.i.dfy\"\r\ninclude \"BigNatBitCount.i.dfy\"\r\n\r\nstatic method fill_sequence(value:nat, copies:nat) returns (vs:seq)\r\n decreases copies;\r\n ensures forall k :: 0 <= k < |vs| ==> vs[k] == value;\r\n ensures |vs|==copies;\r\n{\r\n vs := [];\r\n var i := 0;\r\n while (i < copies)\r\n invariant forall k :: 0 <= k < |vs| ==> vs[k] == value;\r\n invariant |vs| == i;\r\n invariant 0 <= i <= copies;\r\n {\r\n vs := [value] + vs;\r\n i := i + 1;\r\n }\r\n}\r\n\r\nstatic lemma lemma_MakePower2(S:BigNat)\r\n decreases |S.words|;\r\n requires WellformedBigNat(S);\r\n requires !zero(S);\r\n requires forall i:int :: 0<=i<|S.words|-1 ==> S.words[i]==0;\r\n ensures 0 <= 32 * (|S.words|-1);\r\n ensures I(S) == power2(32 * (|S.words|-1)) * S.words[|S.words|-1];\r\n{\r\n lemma_mul_nonnegative(32,|S.words|-1);\r\n if (|S.words|==1)\r\n {\r\n calc {\r\n I(S);\r\n {\r\n selectively_reveal_I(S);\r\n }\r\n I(BigNat_ctor(S.words[1..])) * Width() +S.words[0];\r\n {\r\n assert S.words[1..] == [];\r\n selectively_reveal_I(BigNat_ctor([]));\r\n }\r\n 0*Width()+S.words[0];\r\n {\r\n lemma_mul_basics_forall();\r\n }\r\n S.words[0];\r\n 1 * S.words[|S.words|-1];\r\n {\r\n lemma_mul_annihilate(32);\r\n lemma_power2_0_is_1();\r\n }\r\n power2(32 * 0) * S.words[|S.words|-1];\r\n power2(32 * (|S.words|-1)) * S.words[|S.words|-1];\r\n }\r\n }\r\n else\r\n {\r\n var top:nat := S.words[|S.words|-1];\r\n var sub_S := BigNat_ctor(S.words[1..]);\r\n lemma_mul_is_mul_boogie(32, |sub_S.words| - 1); //- dafnycc\r\n calc {\r\n I(S);\r\n { selectively_reveal_I(S); }\r\n I(sub_S) * Width()+S.words[0];\r\n I(sub_S) * Width();\r\n {\r\n lemma_MakePower2(sub_S);\r\n assert sub_S.words[|sub_S.words|-1] == top;\r\n }\r\n power2(32 * (|sub_S.words|-1)) * top * Width();\r\n power2(32 * (|sub_S.words|-1)) * top * power2(32);\r\n { lemma_mul_is_commutative(top, power2(32 * (|sub_S.words|-1))); }\r\n top * power2(32 * (|sub_S.words|-1)) * power2(32);\r\n { lemma_mul_is_associative(top, power2(32 * (|sub_S.words|-1)), power2(32)); }\r\n top * (power2(32 * (|sub_S.words|-1)) * power2(32));\r\n { lemma_exponentiation(32 * (|sub_S.words|-1), 32); }\r\n top * power2(32 * (|sub_S.words|-1)+32);\r\n top * power2(32 * (|sub_S.words|-1)+32 * 1);\r\n { lemma_mul_is_distributive_add(32, |sub_S.words|-1, 1); }\r\n top * power2(32 * (|sub_S.words|-1+1));\r\n //- definition sub_S\r\n top * power2(32 * (|S.words|-1));\r\n { lemma_mul_is_commutative(power2(32 * (|S.words|-1)), top); }\r\n power2(32 * (|S.words|-1)) * top;\r\n power2(32 * (|S.words|-1)) * S.words[|S.words|-1];\r\n }\r\n }\r\n}\r\n\r\nmethod BNMakePower2(thirtytwos:nat,ones:nat) returns (S:BigNat)\r\n requires 0<=ones<32;\r\n ensures WellformedBigNat(S);\r\n ensures |S.words| == thirtytwos + 1;\r\n ensures 0 <= 32*thirtytwos;\r\n ensures I(S) == power2(32*thirtytwos+ones);\r\n ensures forall i::0<=i<|S.words|-1 ==> S.words[i]==0;\r\n ensures S.words[|S.words|-1] == power2(ones);\r\n{\r\n var vs:seq := fill_sequence(0,thirtytwos);\r\n var small_power_2 := MakePower2Word32(ones);\r\n S := BigNat_ctor(vs + [small_power_2]);\r\n\r\n assert WellformedBigNat(S);\r\n assert !zero(S);\r\n assert forall i:int :: 0<=i<|S.words|-1 ==> S.words[i]==0;\r\n\r\n lemma_MakePower2(S);\r\n calc {\r\n I(S);\r\n power2(32*(|S.words|-1)) * S.words[|S.words|-1];\r\n power2(32*(|S.words|-1)) * power2(ones);\r\n { lemma_exponentiation(32*(|S.words|-1), ones); }\r\n power2(32*(|S.words|-1) + ones);\r\n power2(32*thirtytwos + ones);\r\n }\r\n}\r\n\r\nmethod MakePower2Simple(exp:nat) returns (S:BigNat)\r\n requires Word32(exp);\r\n ensures WellformedBigNat(S);\r\n ensures I(S) == power2(exp);\r\n{\r\n lemma_2to32();\r\n var thirtytwos,ones := Divide32(exp, 32);\r\n assert thirtytwos*32+ones == exp;\r\n//- if (ones==0)\r\n//- {\r\n//- var new_thirtytwos := thirtytwos - 1;\r\n//- var new_ones := 32;\r\n//- calc {\r\n//- new_thirtytwos * 32+new_ones;\r\n//- (thirtytwos - 1) * 32+32;\r\n//- { lemma_mul_basics_forall(); }\r\n//- (thirtytwos - 1) * 32 + 32 * 1;\r\n//- { lemma_mul_is_commutative_forall(); }\r\n//- 32 * (thirtytwos - 1)+32*1;\r\n//- { lemma_mul_is_distributive_add_forall(); }\r\n//- 32*thirtytwos;\r\n//- 32*thirtytwos+ones;\r\n//- { lemma_mul_is_commutative_forall(); }\r\n//- thirtytwos*32+ones;\r\n//- exp;\r\n//- }\r\n//- thirtytwos := new_thirtytwos;\r\n//- ones := new_ones;\r\n//- assert thirtytwos*32+ones == exp;\r\n//- }\r\n S := BNMakePower2(thirtytwos,ones);\r\n calc {\r\n I(S);\r\n power2(32*thirtytwos+ones);\r\n { lemma_mul_is_commutative_forall(); }\r\n power2(thirtytwos*32+ones);\r\n power2(exp);\r\n }\r\n}\r\n\r\nstatic lemma lemma_BigNatWordShift_(A:BigNat, R:BigNat, w:nat)\r\n decreases w;\r\n requires WellformedBigNat(A);\r\n requires nonzero(A);\r\n requires WellformedBigNat(R);\r\n requires |R.words| == |A.words|+w;\r\n requires forall i :: 0<=i R.words[i] == 0;\r\n requires forall i :: 0<=i<|A.words| ==> A.words[i] == R.words[w+i];\r\n ensures 0<=32 * w;\r\n ensures I(R) == I(A) * power2(32 * w);\r\n{\r\n lemma_mul_nonnegative(32,w);\r\n if (w==0)\r\n {\r\n calc {\r\n I(R);\r\n { assert R.words == A.words; }\r\n I(A);\r\n I(A) * 1;\r\n { lemma_power2_0_is_1(); }\r\n I(A) * power2(0);\r\n { lemma_mul_annihilate(32); }\r\n I(A) * power2(32 * 0);\r\n I(A) * power2(32 * w);\r\n }\r\n }\r\n else\r\n {\r\n var sub_A:BigNat := BigNat_ctor([0]+A.words);\r\n assert sub_A.words[|sub_A.words|-1] == A.words[|A.words|-1] > 0;\r\n assert WellformedBigNat(sub_A);\r\n forall (i | 0<=i<|sub_A.words|)\r\n ensures sub_A.words[i] == R.words[w-1+i];\r\n {\r\n if (i==0)\r\n {\r\n assert sub_A.words[i] == 0 == R.words[w-1+i];\r\n }\r\n else\r\n {\r\n calc {\r\n sub_A.words[i];\r\n A.words[i-1];\r\n R.words[w+i-1];\r\n }\r\n }\r\n }\r\n lemma_mul_is_mul_boogie(32, w - 1); //- dafnycc\r\n calc {\r\n I(R);\r\n { lemma_BigNatWordShift_(sub_A, R, w-1); }\r\n I(sub_A) * power2(32*(w-1));\r\n { selectively_reveal_I(sub_A); }\r\n I(BigNat_ctor(sub_A.words[1..])) * Width() * power2(32*(w-1));\r\n I(A) * Width() * power2(32*(w-1));\r\n I(A) * power2(32) * power2(32*(w-1));\r\n { lemma_mul_is_associative(I(A),power2(32),power2(32*(w-1))); }\r\n I(A) * (power2(32) * power2(32*(w-1)));\r\n { lemma_power2_adds(32, 32*(w-1)); }\r\n I(A) * power2(32+32*(w-1));\r\n I(A) * power2(32*1+32*(w-1));\r\n { lemma_mul_is_distributive_add(32,1,w-1); }\r\n I(A) * power2(32 * w);\r\n }\r\n }\r\n}\r\n\r\nstatic method BigNatWordShift_(A:BigNat, ghost ac:nat, w:nat) returns (R:BigNat, ghost rc:nat)\r\n requires WellformedBigNat(A);\r\n requires nonzero(A);\r\n requires BitCount(A,ac);\r\n requires ac+32 * w < Width();\r\n ensures 0<=32 * w;\r\n ensures WellformedBigNat(R);\r\n ensures I(R) == I(A) * power2(32 * w);\r\n ensures BitCount(R,rc);\r\n ensures rc == ac+32 * w;\r\n{\r\n lemma_mul_nonnegative(32,w);\r\n var vs:seq := fill_sequence(0,w);\r\n R := BigNat_ctor(vs + A.words);\r\n rc := ac + 32 * w;\r\n assert WellformedBigNat(R);\r\n lemma_BigNatWordShift_(A, R, w);\r\n\r\n calc ==> {\r\n !zero(A);\r\n { lemma_zero_bits(A,ac); }\r\n ac>0;\r\n }\r\n\r\n assert rc>0;\r\n assert !(rc==0) && !zero(R);\r\n assert rc==0 <==> zero(R);\r\n\r\n if (0 == w)\r\n {\r\n assert |vs|==0;\r\n assert R.words == vs + A.words == A.words;\r\n assert R==A;\r\n lemma_mul_annihilate(32);\r\n assert rc == ac;\r\n }\r\n else\r\n {\r\n//- lemma_mul_strictly_positive_forall();\r\n ghost var w32 := 32*w;\r\n assert 0 < w32;\r\n calc ==> {\r\n power2(ac-1) <= I(A) < power2(ac);\r\n {\r\n lemma_mul_left_inequality(power2(w32), power2(ac-1), I(A));\r\n lemma_mul_left_inequality(power2(w32), I(A), power2(ac));\r\n }\r\n power2(w32) * power2(ac-1) <= power2(w32) * I(A) < power2(w32) * power2(ac);\r\n { lemma_power2_adds(w32, ac-1); assert power2(w32) * power2(ac-1) == power2((w32)+(ac-1));}\r\n power2(w32+(ac-1)) <= power2(w32) * I(A) < power2(w32) * power2(ac);\r\n { lemma_power2_adds(w32, ac);\r\n assert power2(w32 + ac) == power2(w32)*power2(ac);\r\n }\r\n power2(w32+(ac-1)) <= power2(w32) * I(A) < power2((w32)+ac);\r\n power2(w32+ac-1) <= power2(w32) * I(A) < power2((w32)+ac);\r\n { lemma_mul_is_commutative(power2(w32), I(A)); }\r\n power2(w32+ac-1) <= I(A) * power2(w32) < power2(ac+w32);\r\n power2((ac+w32)-1) <= I(A) * power2(w32) < power2(ac+w32);\r\n //- defn rc\r\n power2(rc-1) <= I(A) * power2(w32) < power2(rc);\r\n //- lemma_BigNatWordShift_ ensures\r\n power2(rc-1) <= I(R) < power2(rc);\r\n BitCount(R,rc);\r\n }\r\n }\r\n}\r\n\r\n//-function IsBit(a:int)\r\n//- { a==0 || a==1 }\r\n//-\r\n//-function IsBitSeq(bs:seq)\r\n//- { forall b in bs :: IsBit(b) }\r\n//-\r\n//-function BitsFor(A:BigNat, ac:nat, bits:seq)\r\n//- requires WellformedBigNat(A);\r\n//- requires BitCount(A,ac);\r\n//- requires IsBitSeq(bits);\r\n//- { forall i:int :: 0<=i\r\n decreases w;\r\n ensures w == |zero_seq(w)|;\r\n ensures forall i :: 0<=i zero_seq(w)[i]==0;\r\n{\r\n if (w==0) then [] else zero_seq(w-1)+[0]\r\n}\r\n\r\nmethod BigNatSmallBitShift_(A:BigNat, ghost ac:nat, s:nat) returns (R:BigNat, ghost rc:nat)\r\n requires WellformedBigNat(A);\r\n requires !zero(A);\r\n requires s < 32;\r\n requires BitCount(A,ac);\r\n requires ac+s < Width();\r\n ensures WellformedBigNat(R);\r\n ensures |R.words| <= |A.words|+1;\r\n ensures I(R) == I(A) * power2(s);\r\n ensures BitCount(R,rc);\r\n ensures rc == ac+s;\r\n{\r\n \r\n \r\n \r\n\r\n var S:BigNat := BNMakePower2(0, s);\r\n lemma_mul_annihilate(32);\r\n assert I(S) == power2(s);\r\n\r\n R := BigNatMul(A,S);\r\n rc := ac + s;\r\n calc {\r\n I(R);\r\n I(A) * I(S);\r\n I(A) * power2(32 * 0+s);\r\n { lemma_mul_annihilate(32); }\r\n I(A) * power2(s);\r\n }\r\n\r\n calc ==> {\r\n I(A) < power2(ac);\r\n { lemma_mul_left_inequality(I(S), I(A), power2(ac)); }\r\n I(S) * I(A) < I(S) * power2(ac);\r\n { lemma_mul_is_commutative(I(A), I(S)); }\r\n I(A) * I(S) < I(S) * power2(ac);\r\n I(A) * I(S) < power2(s) * power2(ac);\r\n { lemma_exponentiation(s,ac); }\r\n I(A) * I(S) < power2(s+ac);\r\n I(R) < power2(rc);\r\n }\r\n\r\n if (rc>0)\r\n {\r\n calc ==> {\r\n power2(ac-1) <= I(A);\r\n { lemma_mul_left_inequality(I(S), power2(ac-1), I(A)); }\r\n I(S) * power2(ac-1) <= I(S) * I(A);\r\n { lemma_mul_is_commutative(I(A), I(S)); }\r\n I(S) * power2(ac-1) <= I(A) * I(S);\r\n power2(s) * power2(ac-1) <= I(A) * I(S);\r\n { lemma_exponentiation(s,ac-1); }\r\n power2(s+ac-1) <= I(A) * I(S);\r\n power2(rc-1) <= I(R);\r\n }\r\n }\r\n assert BitCount(R,rc);\r\n\r\n lemma_mul_is_mul_boogie(32, |R.words| - 1); //- dafnycc\r\n lemma_mul_is_mul_boogie(32, |A.words|); //- dafnycc\r\n lemma_mul_is_mul_boogie(32, |A.words| + 1); //- dafnycc\r\n calc ==> {\r\n true;\r\n { lemma_word_bound(A); }\r\n I(A) < power2(32 *|A.words|);\r\n { lemma_mul_left_inequality(power2(s), I(A), power2(32*|A.words|)); }\r\n power2(s) * I(A) < power2(s) * power2(32*|A.words|);\r\n {\r\n lemma_mul_is_commutative(power2(s), I(A));\r\n assert I(R) == power2(s) * I(A);\r\n }\r\n I(R) < power2(s) * power2(32*|A.words|);\r\n { lemma_exponentiation(s, 32*|A.words|); }\r\n I(R) < power2(32*|A.words|+s);\r\n {\r\n calc ==> {\r\n s < 32;\r\n 32*|A.words| + s < 32*|A.words| + 32;\r\n { lemma_power2_strictly_increases(32*|A.words| + s, 32*|A.words| + 32); }\r\n power2(32*|A.words| + s) < power2(32*|A.words| + 32);\r\n I(R) < power2(32*|A.words| + 32);\r\n I(R) < power2(32*|A.words| + 32 *1);\r\n { lemma_mul_is_distributive_add(32, |A.words|, 1); }\r\n I(R) < power2(32 * (|A.words| + 1));\r\n }\r\n lemma_mul_nonnegative_forall();\r\n assert 0<=32 *(|A.words|+1);\r\n }\r\n I(R) < power2(32 *(|A.words|+1));\r\n }\r\n\r\n calc ==> {\r\n true;\r\n { lemma_word_bound(R); }\r\n power2(32*(|R.words|-1)) <= I(R);\r\n //- by calc above\r\n {\r\n lemma_mul_nonnegative_forall();\r\n assert 0<=32*(|A.words|+1);\r\n }\r\n power2(32*(|R.words|-1)) < power2(32*(|A.words|+1));\r\n { lemma_power2_monotonic_inverse(32*(|R.words|-1), 32*(|A.words|+1)); }\r\n 32*(|R.words|-1) < 32*(|A.words|+1);\r\n { lemma_mul_is_commutative_forall(); }\r\n (|R.words|-1) * 32 < (|A.words|+1) * 32;\r\n { lemma_mul_strict_inequality_converse(|R.words|-1,|A.words|+1,32); }\r\n |R.words|-1 < |A.words|+1;\r\n |R.words| <= |A.words|+1;\r\n }\r\n}\r\n\r\nstatic lemma thirty_two_isnt_so_big_after_all()\r\n ensures Word32(32);\r\n{\r\n assert unroll(1) && unroll(2) && unroll(3) && unroll(4);\r\n reveal_power2();\r\n lemma_power2_add8(0);\r\n lemma_2to32();\r\n}\r\n\r\nmethod BigNatBitShift_(A:BigNat, ghost ac:nat, s:nat) returns (R:BigNat, ghost rc:nat)\r\n requires WellformedBigNat(A);\r\n requires nonzero(A);\r\n requires s < Width();\r\n requires BitCount(A,ac);\r\n requires ac+s < Width();\r\n ensures WellformedBigNat(R);\r\n ensures I(R) == power2(s) * I(A);\r\n ensures BitCount(R,rc);\r\n ensures rc == ac+s;\r\n{\r\n thirty_two_isnt_so_big_after_all();\r\n var thirtytwos:nat,ones:nat := Divide32(s,32);\r\n //- Ensures thirtytwos*32 + ones == s;\r\n calc ==> {\r\n //- requires\r\n ac + s < Width();\r\n ac + thirtytwos*32 + ones < Width();\r\n { lemma_mul_nonnegative(thirtytwos,32); }\r\n ac + ones < Width();\r\n }\r\n var R_ones:BigNat,r1c:nat := BigNatSmallBitShift_(A, ac, ones);\r\n\r\n calc ==> {\r\n ac + thirtytwos*32 + ones < Width();\r\n //- BigNatSmallBitShift_ ensures r1c == ac+ones;\r\n ac + thirtytwos*32 + r1c - ac < Width();\r\n { lemma_mul_is_commutative(thirtytwos,32); }\r\n //- and + math\r\n r1c + 32*thirtytwos < Width();\r\n }\r\n R,rc := BigNatWordShift_(R_ones, r1c, thirtytwos);\r\n\r\n calc {\r\n rc;\r\n //- BigNatWordShift_ ensures\r\n r1c+32*thirtytwos;\r\n //- BigNatSmallBitShift_ ensures\r\n ac+ones+32*thirtytwos;\r\n //- Divide32 ensures\r\n { lemma_mul_is_commutative(thirtytwos,32); }\r\n ac+s;\r\n }\r\n\r\n calc {\r\n I(R);\r\n //- BigNatWordShift_ ensures\r\n I(R_ones) * power2(32*thirtytwos);\r\n //- BigNatSmallBitShift_ ensures\r\n I(A) * power2(ones) * power2(32*thirtytwos);\r\n { lemma_mul_is_associative(I(A), power2(ones), power2(32*thirtytwos)); }\r\n I(A) * (power2(ones) * power2(32*thirtytwos));\r\n { lemma_exponentiation(ones,32*thirtytwos); }\r\n I(A) * power2(ones+32*thirtytwos);\r\n { lemma_mul_is_commutative(thirtytwos,32); }\r\n I(A) * power2(thirtytwos*32+ones);\r\n //- Divide32 ensures\r\n I(A) * power2(s);\r\n { lemma_mul_is_commutative(I(A), power2(s)); }\r\n power2(s) * I(A);\r\n }\r\n}\r\n\r\nstatic lemma lemma_modesty_preservation(A:BigNat, ac:nat, B:BigNat, bc:nat)\r\n requires WellformedBigNat(A);\r\n requires BitCount(A,ac);\r\n requires ModestBigNatBits(B,bc);\r\n requires I(A) <= I(B);\r\n ensures ModestBigNatWords(A);\r\n{\r\n calc ==> {\r\n ModestBigNatBits(B,bc);\r\n { lemma_modesty_bit_value_equivalence(B,bc); }\r\n ModestBigNatValue(B);\r\n I(B) < KindaBigNat();\r\n I(A) < KindaBigNat();\r\n ModestBigNatValue(A);\r\n { lemma_modesty_word_value_equivalence(A); }\r\n ModestBigNatWords(A);\r\n }\r\n}\r\n\r\nstatic lemma lemma_power2_monotonic_inverse(a:nat,b:nat)\r\n decreases a;\r\n requires power2(a)<=power2(b);\r\n ensures a<=b;\r\n{\r\n if (a>b)\r\n {\r\n lemma_power2_strictly_increases(b,a);\r\n assert power2(a) > power2(b);\r\n assert false;\r\n }\r\n assert a<=b;\r\n}\r\n\r\nstatic lemma lemma_ModestBigNatNremainder(N:BigNat, ghost nc:nat, D:BigNat, N_remainder:BigNat)\r\n requires ModestBigNatBits(N,nc);\r\n requires WellformedBigNat(D);\r\n requires WellformedBigNat(N_remainder);\r\n requires I(N)-I(D) == I(N_remainder);\r\n ensures ModestBigNatWords(N_remainder);\r\n{\r\n calc ==> {\r\n true;\r\n { lemma_modesty_bit_value_equivalence(N,nc); }\r\n I(N) < KindaBigNat();\r\n { assert I(N_remainder) <= I(N); } //- BigNatSub ensures\r\n I(N_remainder) < KindaBigNat();\r\n ModestBigNatValue(N_remainder);\r\n { lemma_modesty_word_value_equivalence(N_remainder); }\r\n ModestBigNatWords(N_remainder);\r\n }\r\n}\r\n\r\nstatic method bignum_one() returns (one:BigNat)\r\n ensures WellformedBigNat(one);\r\n ensures BitCount(one,1);\r\n ensures I(one)==1;\r\n{\r\n reveal_I();\r\n one := BigNat_ctor([1]);\r\n lemma_2to32();\r\n\r\n selectively_reveal_I(one);\r\n selectively_reveal_I(BigNat_ctor([]));\r\n assert 0 == I(BigNat_ctor([]));\r\n lemma_mul_annihilate(Width());\r\n assert 1 == I(one);\r\n lemma_power2_0_is_1();\r\n assert power2(1-1) == 1;\r\n assert 1 <= 1;\r\n assert power2(1-1) <= I(one);\r\n lemma_power2_1_is_2();\r\n assert I(one) == 1 < 2 == power2(1);\r\n assert I(one) < power2(1);\r\n}\r\n\r\n/*\r\nstatic method BigNatDivInductiveStep(N:BigNat, ghost nc:nat, D:BigNat, ghost dc:nat, s:nat, DS:BigNat) returns (Q:BigNat, R:BigNat)\r\n decreases 2 * I(N);\r\n requires ModestBigNatBits(N,nc);\r\n requires ModestBigNatBits(D,dc);\r\n requires nonzero(D);\r\n requires WellformedBigNat(DS);\r\n requires 0 < I(DS) <= I(N);\r\n requires I(DS) == power2(s) * I(D);\r\n requires s+10 ==> power2(dc-1) <= I(D);\r\n requires nc < dc;\r\n ensures I(N) < I(D);\r\n{\r\n lemma_power2_increases(nc,dc-1);\r\n}\r\n\r\n/*\r\nstatic method BigNatDivBaseCase(N:BigNat, D:BigNat) returns (Q:BigNat, R:BigNat)\r\n requires WellformedBigNat(N);\r\n requires WellformedBigNat(D);\r\n requires I(N) < I(D);\r\n ensures WellformedBigNat(Q);\r\n ensures WellformedBigNat(R);\r\n ensures I(R) < I(D);\r\n ensures I(Q) * I(D) + I(R) == I(N);\r\n{\r\n R := N;\r\n Q := BigNatZero();\r\n assert(I(Q)==0);\r\n\r\n calc\r\n {\r\n I(Q) * I(D) + I(R);\r\n 0 * I(D) + I(R);\r\n { lemma_mul_annihilate(I(D)); }\r\n 0 + I(R);\r\n I(R);\r\n I(N);\r\n }\r\n}\r\n\r\nstatic method BigNatDiv(N:BigNat, D:BigNat) returns (Q:BigNat, R:BigNat)\r\n decreases 2 * I(N) + 1;\r\n requires ModestBigNatWords(N);\r\n requires ModestBigNatWords(D);\r\n requires nonzero(D);\r\n ensures WellformedBigNat(Q);\r\n ensures WellformedBigNat(R);\r\n ensures I(R) < I(D);\r\n ensures I(Q) * I(D) + I(R) == I(N);\r\n{\r\n lemma_mul_nonnegative_forall();\r\n if (zero(N))\r\n {\r\n Q:=BigNatZero();\r\n R:=BigNatZero();\r\n lemma_mul_annihilate(I(D));\r\n }\r\n else\r\n {\r\n var nc:nat :=BigNatCountBits(N);\r\n\r\n lemma_modesty_word_value_equivalence(N);\r\n lemma_modesty_bit_value_equivalence(N,nc);\r\n assert ModestBigNatBits(N,nc);\r\n\r\n var dc:nat :=BigNatCountBits(D);\r\n\r\n lemma_modesty_word_value_equivalence(D);\r\n lemma_modesty_bit_value_equivalence(D,dc);\r\n assert ModestBigNatBits(D,dc);\r\n\r\n if (nc < dc)\r\n {\r\n lemma_nbits(N,D,nc,dc);\r\n assert I(N) < I(D);\r\n Q,R := BigNatDivBaseCase(N,D);\r\n }\r\n else\r\n {\r\n var s:nat := nc - dc;\r\n assert s+1 I(N) < I(D);\r\n ensures !residue_small ==> WellformedBigNat(QS);\r\n ensures !residue_small ==> WellformedBigNat(DS);\r\n ensures !residue_small ==> 0 < I(DS) <= I(N);\r\n ensures !residue_small ==> I(QS)*I(D) == I(DS);\r\n{\r\n QS := BigNatZero();\r\n DS := BigNatZero();\r\n //-lemma_mul_nonnegative_forall();\r\n if (zero(N))\r\n {\r\n residue_small := true;\r\n }\r\n else\r\n {\r\n var nc:nat :=BigNatCountBits(N);\r\n\r\n lemma_modesty_word_value_equivalence(N);\r\n lemma_modesty_bit_value_equivalence(N,nc);\r\n assert ModestBigNatBits(N,nc);\r\n\r\n var dc:nat :=BigNatCountBits(D);\r\n\r\n lemma_modesty_word_value_equivalence(D);\r\n lemma_modesty_bit_value_equivalence(D,dc);\r\n assert ModestBigNatBits(D,dc);\r\n\r\n if (nc < dc)\r\n {\r\n lemma_nbits(N,D,nc,dc);\r\n assert I(N) < I(D);\r\n residue_small := true;\r\n }\r\n else\r\n {\r\n var s:nat := nc - dc;\r\n assert s+1 WellformedBigNat(DS);\r\n invariant !residue_small ==> WellformedBigNat(QS);\r\n decreases I(Nresidue);\r\n invariant ModestBigNatWords(Nresidue);\r\n invariant residue_small ==> I(Nresidue) < I(D);\r\n invariant !residue_small ==> 0 < I(DS) <= I(Nresidue);\r\n invariant !residue_small ==> I(QS)*I(D) == I(DS);\r\n invariant I(N) == I(Qaccum)*I(D) + I(Nresidue);\r\n {\r\n //-ProfileTally(Tally_BigNatDivWhileLoops(), 1);\r\n ghost var IQaccum_old := I(Qaccum);\r\n ghost var Nresidue_old := Nresidue;\r\n ghost var INresidue_old := I(Nresidue);\r\n Qaccum := BigNatAdd(Qaccum, QS);\r\n Nresidue := BigNatSub(Nresidue, DS);\r\n\r\n calc {\r\n I(N);\r\n IQaccum_old * I(D) + INresidue_old;\r\n IQaccum_old*I(D) + I(QS)*I(D) + INresidue_old - I(DS);\r\n //- { lemma_mul_is_distributive_forall(); }\r\n { lemma_mul_is_distributive_add(I(D), IQaccum_old, I(QS)); lemma_mul_is_commutative_forall(); }\r\n (IQaccum_old+I(QS))*I(D) + INresidue_old-I(DS);\r\n I(Qaccum)*I(D) + I(Nresidue);\r\n }\r\n\r\n//- assert ModestBigNatWords(Nresidue_old);\r\n lemma_modesty_word_value_equivalence(Nresidue_old);\r\n//- assert ModestBigNatValue(Nresidue_old);\r\n//- assert ModestBigNatValue(Nresidue);\r\n lemma_modesty_word_value_equivalence(Nresidue);\r\n QS,DS,residue_small := BigNatDivIterative_Split(Nresidue, D);\r\n }\r\n Q := Qaccum;\r\n R := Nresidue;\r\n}\r\n\r\nmethod BigNatDivImmodest(N:BigNat, D:BigNat) returns (Q:BigNat, R:BigNat)\r\n requires WellformedBigNat(N);\r\n requires WellformedBigNat(D);\r\n requires nonzero(D);\r\n ensures WellformedBigNat(Q);\r\n ensures WellformedBigNat(R);\r\n ensures I(R) < I(D);\r\n ensures I(Q) * I(D) + I(R) == I(N);\r\n{\r\n if (|N.words| <= 0x4000000 && |D.words| <= 0x4000000)\r\n {\r\n calc ==> { true; { lemma_2toX32(); } ModestBigNatWords(N) && ModestBigNatWords(D); }\r\n Q, R := BigNatDiv(N, D);\r\n return;\r\n }\r\n \r\n Q := MakeSmallLiteralBigNat(0);\r\n R := N;\r\n lemma_mul_basics(I(D));\r\n while (true)\r\n invariant WellformedBigNat(Q);\r\n invariant WellformedBigNat(R);\r\n invariant I(Q) * I(D) + I(R) == I(N);\r\n decreases I(R);\r\n {\r\n var c := BigNatCmp(R, D);\r\n if (c.BNCmpLt?)\r\n {\r\n return;\r\n }\r\n var one := MakeSmallLiteralBigNat(1);\r\n calc {\r\n (I(Q) + 1) * I(D) + (I(R) - I(D));\r\n { lemma_mul_is_distributive(I(D), I(Q) + 1, 1); }\r\n { lemma_mul_is_mul_boogie(1, I(D)); }\r\n I(Q) * I(D) + I(R);\r\n }\r\n Q := BigNatAdd(Q, one);\r\n R := BigNatSub(R, D);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/BigNatMod.i.dfy", "content": "include \"BigNatDiv.i.dfy\"\r\ninclude \"BigNatBitCount.i.dfy\"\r\ninclude \"../Math/power.i.dfy\"\r\n\r\nmethod BigNatModulo(N:BigNat, M:BigNat) returns (R:BigNat)\r\n requires ModestBigNatWords(N);\r\n requires ModestBigNatWords(M);\r\n requires 0 <= I(N);\r\n requires 0 < I(M);\r\n ensures WellformedBigNat(R);\r\n ensures I(N) % I(M) == I(R);\r\n ensures I(R) < I(M);\r\n ensures ModestBigNatWords(R);\r\n{\r\n var Q:BigNat;\r\n Q,R := BigNatDiv(N,M);\r\n\r\n lemma_fundamental_div_mod_converse(I(N), I(M), I(Q), I(R));\r\n\r\n assert I(R) x*y == 0;\r\n{\r\n forall (x:int, y:int | x==0 || y==0)\r\n ensures x*y==0;\r\n {\r\n if (x==0)\r\n {\r\n lemma_mul_basics(y);\r\n assert x*y == 0;\r\n }\r\n else\r\n {\r\n assert y==0;\r\n lemma_mul_basics(x);\r\n lemma_mul_is_commutative(x,y);\r\n assert x*y == 0;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_monotonic(x:int, y:int)\r\n ensures (1 < x && 0 < y) ==> (y < x*y);\r\n{ lemma_mul_properties(); }\r\n\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nmethod SmallMul_(a:nat, b:nat) returns (s:BigNat)\r\n requires Word32(a);\r\n requires Word32(b);\r\n ensures WellformedBigNat(s);\r\n ensures I(s) == a*b;\r\n{\r\n\r\n var l,h := Product32(a,b);\r\n if (l==0 && h==0)\r\n {\r\n lemma_mul_zero();\r\n s := BigNat_ctor([]);\r\n reveal_I();\r\n }\r\n else if (h==0)\r\n {\r\n s := BigNat_ctor([l]);\r\n reveal_I();\r\n }\r\n else\r\n {\r\n s := BigNat_ctor([l,h]);\r\n calc {\r\n I(s);\r\n { reveal_I(); }\r\n I(BigNat_ctor(s.words[1..])) * Width() + l;\r\n { reveal_I(); lemma_mul_zero(); }\r\n h * Width() + l;\r\n //- Product32 ensures\r\n a*b;\r\n }\r\n }\r\n}\r\n\r\nmethod BigNatLeftShift_(A:BigNat) returns (R:BigNat)\r\n requires WellformedBigNat(A);\r\n ensures WellformedBigNat(R);\r\n ensures I(R) == I(A) * Width();\r\n{\r\n if (zero(A))\r\n {\r\n lemma_mul_zero();\r\n R := A;\r\n }\r\n else\r\n {\r\n R := BigNat_ctor([0] + A.words);\r\n reveal_I();\r\n }\r\n}\r\n\r\nstatic lemma lemma_step1(b:int, ihiAW:int, loA:int)\r\n ensures b * ihiAW + b * loA == b * (ihiAW + loA);\r\n{\r\n lemma_mul_is_distributive_add(b, ihiAW, loA);\r\n}\r\n\r\nmethod BigNatSingleMul_(A:BigNat, b:nat) returns (R:BigNat)\r\n decreases |A.words|;\r\n requires WellformedBigNat(A);\r\n requires Word32(b);\r\n ensures WellformedBigNat(R);\r\n ensures I(A) * b == I(R);\r\n{\r\n R := BigNatZero();\r\n calc {\r\n I(BigNatZero()) * b;\r\n 0 * b;\r\n { lemma_mul_zero(); }\r\n 0;\r\n I(R);\r\n }\r\n var n := |A.words|;\r\n assert A.words[n..] == [];\r\n while (n > 0)\r\n invariant 0 <= n <= |A.words|;\r\n invariant WellformedBigNat(R);\r\n invariant I(R) == I(BigNat_ctor(A.words[n..])) * b; //- induction hypothesis\r\n {\r\n ghost var hi_A := BigNat_ctor(A.words[n..]);\r\n ghost var ugly_expression := I(hi_A) * Width();\r\n n := n - 1;\r\n ghost var hilo_A := BigNat_ctor(A.words[n..]);\r\n assert hi_A.words == hi(hilo_A).words;\r\n var sub_R := R;\r\n var parent:BigNat := BigNatLeftShift_(sub_R);\r\n var child:BigNat := SmallMul_(A.words[n], b);\r\n R := BigNatAdd(parent, child);\r\n\r\n calc {\r\n I(R);\r\n I(parent) + I(child);\r\n I(parent) + A.words[n] * b;\r\n I(sub_R) * Width() + A.words[n] * b;\r\n (I(hi_A) * b) * Width() + A.words[n] * b;\r\n { lemma_mul_is_commutative(I(hi_A),b); }\r\n (b * I(hi_A)) * Width() + A.words[n] * b;\r\n { lemma_mul_is_associative(b, I(hi_A), Width()); }\r\n b * (I(hi_A) * Width()) + A.words[n] * b;\r\n { lemma_mul_is_commutative(b,A.words[n]); }\r\n b * ugly_expression + b * A.words[n];\r\n { lemma_step1(b, ugly_expression, A.words[n]); }\r\n b * (ugly_expression + A.words[n]);\r\n { lemma_hilo(hilo_A); }\r\n b * I(hilo_A);\r\n { lemma_mul_is_commutative(b,I(hilo_A)); }\r\n I(hilo_A) * b;\r\n }\r\n }\r\n assert A.words[0..] == A.words;\r\n}\r\n\r\nmethod BigNatMul(A:BigNat, B:BigNat) returns (R:BigNat)\r\n decreases |B.words|;\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n ensures WellformedBigNat(R);\r\n ensures I(A) * I(B) == I(R);\r\n{\r\n if (zero(A))\r\n {\r\n lemma_mul_zero();\r\n R := A;\r\n return;\r\n }\r\n R := BigNatZero();\r\n var n := |B.words|;\r\n assert B.words[n..] == [];\r\n lemma_mul_zero();\r\n while (n > 0)\r\n invariant 0 <= n <= |B.words|;\r\n invariant WellformedBigNat(R);\r\n invariant I(R) == I(A) * I(BigNat_ctor(B.words[n..])); //- induction hypothesis\r\n {\r\n ghost var hi_B := BigNat_ctor(B.words[n..]);\r\n n := n - 1;\r\n ghost var hilo_B := BigNat_ctor(B.words[n..]);\r\n assert hi_B.words == hi(hilo_B).words;\r\n var sub_R := R;\r\n var parent:BigNat := BigNatLeftShift_(sub_R);\r\n var child:BigNat := BigNatSingleMul_(A, B.words[n]);\r\n R := BigNatAdd(parent, child);\r\n\r\n calc\r\n {\r\n I(R);\r\n I(parent) + I(child);\r\n I(sub_R) * Width() + I(child);\r\n I(sub_R) * Width() + I(A) * B.words[n];\r\n (I(A) * I(hi_B)) * Width() + I(A) * B.words[n];\r\n { lemma_mul_is_associative(I(A), I(hi_B), Width()); }\r\n I(A) * (I(hi_B) * Width()) + I(A) * B.words[n];\r\n { lemma_mul_is_distributive_add(I(A), I(hi_B) * Width(), B.words[n]); }\r\n I(A) * (I(hi_B) * Width() + B.words[n]);\r\n { lemma_hilo(hilo_B); }\r\n I(A) * I(hilo_B);\r\n }\r\n }\r\n assert B.words[0..] == B.words;\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/BigNatPartial.i.dfy", "content": "//-include \"../Util/assembly_deprecated.s.dfy\"\r\ninclude \"BigNatCore.i.dfy\"\r\ninclude \"../Util/integer_sequences.s.dfy\"\r\n\r\n//-static predicate IsWordSeq(ws:seq) { IsIsWordSeq(ws) }\r\n\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\n\r\n\r\n\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function {:opaque} V(vs:seq) : int\r\n{\r\n if (|vs|==0) then\r\n 0\r\n else\r\n Width() * V(vs[1..]) + vs[0]\r\n}\r\n\r\nstatic lemma selectively_reveal_V(vs:seq)\r\n ensures V(vs) ==\r\n if (|vs|==0) then\r\n 0\r\n else\r\n Width() * V(vs[1..])+vs[0];\r\n{\r\n reveal_V();\r\n}\r\n\r\nstatic lemma lemma_V_I(A:BigNat)\r\n decreases |A.words|;\r\n requires WellformedBigNat(A);\r\n ensures I(A) == V(A.words);\r\n{\r\n if (zero(A))\r\n {\r\n reveal_V();\r\n assert I(A) == 0 == V(A.words);\r\n }\r\n else\r\n {\r\n lemma_V_I(hi(A));\r\n reveal_V();\r\n reveal_V();\r\n calc {\r\n I(A);\r\n { reveal_I(); }\r\n I(hi(A)) * Width() + lo(A);\r\n { lemma_mul_is_commutative(I(hi(A)), Width()); }\r\n Width() * I(hi(A)) + lo(A);\r\n Width() * V(hi(A).words) + lo(A);\r\n V(A.words);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma{:dafnycc_conservative_seq_triggers} lemma_V_power(ls:seq, hs:seq)\r\n decreases |ls|;\r\n ensures 32 * |ls| >= 0;\r\n ensures V(ls+hs) == power2(32 * |ls|) * V(hs) + V(ls);\r\n{\r\n lemma_mul_left_inequality(32,0,|ls|);\r\n lemma_mul_basics(32);\r\n\r\n if (|ls|==0)\r\n {\r\n assert ls+hs == hs;\r\n calc {\r\n power2((32*|ls|)) * V(hs) + V(ls);\r\n power2(32 * 0) * V(hs) + V(ls);\r\n { lemma_mul_basics(32); }\r\n power2(0) * V(hs) + V(ls);\r\n { lemma_power2_0_is_1(); }\r\n 1 * V(hs) + V(ls);\r\n { lemma_mul_basics(V(hs)); }\r\n V(hs) + V(ls);\r\n { reveal_V(); }\r\n V(hs);\r\n V(ls+hs);\r\n }\r\n }\r\n else\r\n {\r\n lemma_V_power(ls[1..], hs);\r\n assert V(ls[1..]+hs) == power2(32 *(|ls|-1)) * V(hs) + V(ls[1..]);\r\n\r\n calc {\r\n V(ls+hs);\r\n { selectively_reveal_V(ls+hs); }\r\n Width() * V((ls+hs)[1..]) + (ls+hs)[0];\r\n { assert (ls+hs)[1..] == ls[1..]+hs; }\r\n Width() * V(ls[1..]+hs) + (ls+hs)[0];\r\n { assert (ls+hs)[0] == ls[0]; }\r\n Width() * V(ls[1..]+hs) + ls[0];\r\n Width() * (power2(32*(|ls|-1)) * V(hs) + V(ls[1..])) + ls[0];\r\n power2(32) * (power2(32*(|ls|-1)) * V(hs) + V(ls[1..])) + ls[0];\r\n { lemma_mul_is_distributive_add(power2(32), power2(32*(|ls|-1)) * V(hs), V(ls[1..])); }\r\n power2(32) * (power2(32*(|ls|-1)) * V(hs)) + power2(32) * V(ls[1..]) + ls[0];\r\n { lemma_mul_is_associative(power2(32), power2(32*(|ls|-1)), V(hs)); }\r\n power2(32) * power2(32*(|ls|-1)) * V(hs) + power2(32) * V(ls[1..]) + ls[0];\r\n { lemma_power2_adds(32, 32*(|ls|-1)); }\r\n power2(32 + 32*(|ls|-1)) * V(hs) + power2(32) * V(ls[1..]) + ls[0];\r\n { lemma_mul_basics(32); }\r\n power2(32*1 + 32*(|ls|-1)) * V(hs) + power2(32) * V(ls[1..]) + ls[0];\r\n { lemma_mul_is_distributive_add(32,1,|ls|-1); }\r\n power2(32*|ls|) * V(hs) + power2(32) * V(ls[1..]) + ls[0];\r\n { reveal_V(); }\r\n power2(32*|ls|) * V(hs) + V(ls);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_V_singleton(s:seq)\r\n requires |s|==1;\r\n ensures V(s) == s[0];\r\n{\r\n reveal_V();\r\n lemma_mul_basics(Width());\r\n}\r\n\r\nstatic lemma lemma_V_upper_bound(s:seq)\r\n decreases |s|;\r\n requires IsWordSeq(s);\r\n ensures 32 * |s| >= 0;\r\n ensures V(s) <= power2(32*|s|)-1;\r\n{\r\n reveal_V();\r\n if (|s|==0)\r\n {\r\n lemma_power2_0_is_1();\r\n lemma_mul_basics(32);\r\n }\r\n else\r\n {\r\n lemma_mul_nonnegative_forall();\r\n calc {\r\n V(s);\r\n == { selectively_reveal_V(s); }\r\n Width() * V(s[1..]) + s[0];\r\n <= {\r\n lemma_V_upper_bound(s[1..]);\r\n assert V(s[1..]) <= power2(32*(|s|-1))-1;\r\n lemma_mul_left_inequality(Width(), V(s[1..]), power2(32*(|s|-1))-1);\r\n }\r\n Width() * (power2(32*(|s|-1))-1) + s[0];\r\n <=\r\n Width() * (power2(32*(|s|-1))-1) + power2(32) - 1;\r\n Width() * (power2(32*(|s|-1))-1) + Width() - 1;\r\n { lemma_mul_basics(Width()); }\r\n Width() * (power2(32*(|s|-1))-1) + Width()*1 - 1;\r\n { lemma_mul_is_distributive_add(Width(), power2(32*(|s|-1))-1, 1); }\r\n Width() * (power2(32*(|s|-1))-1+1) - 1;\r\n Width() * power2(32*(|s|-1)) - 1;\r\n power2(32) * power2(32*(|s|-1)) - 1;\r\n { lemma_power2_adds(32, 32*(|s|-1)); }\r\n power2(32 + 32*(|s|-1)) - 1;\r\n { lemma_mul_basics(32); }\r\n power2(32*1 + 32*(|s|-1)) - 1;\r\n { lemma_mul_is_distributive_add(32, 1, |s|-1); }\r\n power2(32*|s|) - 1;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_V_lower_bound(s:seq)\r\n requires IsWordSeq(s);\r\n ensures 0 <= V(s);\r\n{\r\n reveal_V();\r\n if (|s|==0)\r\n { }\r\n else\r\n {\r\n lemma_V_lower_bound(s[1..]);\r\n reveal_V();\r\n lemma_mul_left_inequality(Width(), 0, V(s[1..]));\r\n lemma_mul_basics(Width());\r\n }\r\n}\r\n\r\nstatic lemma lemma_V_high_zeros(s:seq)\r\n requires |s|>0;\r\n requires s[|s|-1]==0;\r\n ensures V(s) == V(s[..|s|-1]);\r\n{\r\n if (|s|==1)\r\n {\r\n calc {\r\n V(s);\r\n { selectively_reveal_V(s); }\r\n Width() * V(s[1..])+s[0];\r\n { assert s[1..] == []; }\r\n Width() * V([])+s[0];\r\n { selectively_reveal_V([]); }\r\n Width() * 0+s[0];\r\n { lemma_mul_basics_forall(); }\r\n s[0];\r\n s[|s|-1];\r\n 0;\r\n { selectively_reveal_V([]); }\r\n V([]);\r\n { assert s[..|s|-1] == []; }\r\n V(s[..|s|-1]);\r\n }\r\n }\r\n else\r\n {\r\n var hi_s := s[1..];\r\n var trunc_s := s[..|s|-1];\r\n\r\n calc {\r\n //- 2,3,0,0\r\n V(s);\r\n { selectively_reveal_V(s); }\r\n //- 3,0,0*w + 2\r\n Width() * V(hi_s) +s[0];\r\n { lemma_V_high_zeros(hi_s); }\r\n //- 3,0*w + 2\r\n Width() * V(hi_s[..|hi_s|-1])+s[0];\r\n calc {\r\n hi_s[..|hi_s|-1];\r\n s[1..][..|s[1..]|-1];\r\n s[1..][..|s|-2];\r\n s[1..|s|-1];\r\n s[..|s|-1][1..];\r\n trunc_s[1..];\r\n }\r\n Width() * V(trunc_s[1..]) + s[0];\r\n Width() * V(trunc_s[1..]) + trunc_s[0];\r\n //- 2,3,0\r\n { selectively_reveal_V(trunc_s); }\r\n V(trunc_s);\r\n V(s[..|s|-1]);\r\n }\r\n }\r\n}\r\n\r\nstatic function {:opaque} TruncatingBigNatCtor_def(ss:seq) : BigNat\r\n decreases |ss|;\r\n requires IsWordSeq(ss);\r\n{\r\n if (|ss|==0) then\r\n BigNat_ctor([])\r\n else if (ss[|ss|-1] > 0) then\r\n BigNat_ctor(ss)\r\n else\r\n TruncatingBigNatCtor_def(ss[..|ss|-1])\r\n}\r\n\r\nstatic function TruncatingBigNatCtor(ss:seq) : BigNat\r\n requires IsWordSeq(ss);\r\n ensures WellformedBigNat(TruncatingBigNatCtor(ss));\r\n ensures V(ss) == I(TruncatingBigNatCtor(ss));\r\n ensures |TruncatingBigNatCtor(ss).words| <= |ss|;\r\n{\r\n lemma_TruncatingBigNatCtor(ss,TruncatingBigNatCtor_def(ss));\r\n TruncatingBigNatCtor_def(ss)\r\n}\r\n\r\nstatic method TruncatingBigNatCtor_impl(ss:seq) returns(N:BigNat)\r\n requires IsWordSeq(ss);\r\n ensures N == TruncatingBigNatCtor(ss);\r\n{\r\n reveal_TruncatingBigNatCtor_def();\r\n var k := |ss|;\r\n assert ss == ss[..k];\r\n while (k > 0)\r\n invariant 0 <= k <= |ss|;\r\n invariant TruncatingBigNatCtor_def(ss) == TruncatingBigNatCtor_def(ss[..k]);\r\n invariant IsWordSeq(ss[..k]);\r\n {\r\n k := k - 1;\r\n if (ss[k] > 0)\r\n {\r\n N := BigNat_ctor(ss[..k+1]);\r\n return;\r\n }\r\n assert ss[..k+1][..k] == ss[..k];\r\n }\r\n N := BigNat_ctor([]);\r\n}\r\n\r\nstatic lemma lemma_TruncatingBigNatCtor(ss:seq,N:BigNat)\r\n decreases |ss|;\r\n requires IsWordSeq(ss);\r\n requires N == TruncatingBigNatCtor_def(ss);\r\n ensures WellformedBigNat(N);\r\n ensures V(ss) == I(N);\r\n ensures |N.words| <= |ss|;\r\n{\r\n reveal_TruncatingBigNatCtor_def();\r\n\r\n if (|ss|==0)\r\n {\r\n assert N == BigNat_ctor([]);\r\n calc {\r\n I(N);\r\n { reveal_I(); }\r\n 0;\r\n { reveal_V(); }\r\n V(ss);\r\n }\r\n }\r\n else if (ss[|ss|-1] > 0)\r\n {\r\n assert N == BigNat_ctor(ss);\r\n lemma_V_I(N);\r\n }\r\n else\r\n {\r\n assert N == TruncatingBigNatCtor_def(ss[..|ss|-1]);\r\n lemma_TruncatingBigNatCtor(ss[..|ss|-1],N);\r\n calc {\r\n I(N);\r\n V(ss[..|ss|-1]);\r\n { lemma_V_high_zeros(ss); }\r\n V(ss);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_TruncatingBigNat_alignment(ss:seq,N:BigNat)\r\n decreases |ss|;\r\n requires IsWordSeq(ss);\r\n requires N == TruncatingBigNatCtor(ss);\r\n ensures forall i :: 0<=i<|N.words| ==> N.words[i] == ss[i];\r\n ensures forall i :: |N.words|<=i<|ss| ==> ss[i] == 0;\r\n{\r\n reveal_TruncatingBigNatCtor_def();\r\n\r\n if (|ss|==0)\r\n {\r\n selectively_reveal_V(ss);\r\n assert V(ss) == 0;\r\n assert I(N) == 0;\r\n assert zero(N);\r\n }\r\n else if (ss[|ss|-1] > 0)\r\n {\r\n assert N == BigNat_ctor(ss);\r\n assert |N.words| == |ss|;\r\n }\r\n else\r\n {\r\n assert N == TruncatingBigNatCtor(ss[..|ss|-1]);\r\n forall (i | 0<=i<|N.words|)\r\n ensures N.words[i] == ss[i];\r\n {\r\n calc {\r\n N.words[i];\r\n { lemma_TruncatingBigNat_alignment(ss[..|ss|-1], N); }\r\n ss[..|ss|-1][i];\r\n ss[i];\r\n }\r\n }\r\n forall (i | |N.words|<=i<|ss|)\r\n ensures ss[i] == 0;\r\n {\r\n if (i<|ss|-1)\r\n {\r\n calc {\r\n ss[i];\r\n ss[..|ss|-1][i];\r\n { lemma_TruncatingBigNat_alignment(ss[..|ss|-1], N); }\r\n 0;\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_TruncatingBigNat_hilo(ss:seq)\r\n requires IsWordSeq(ss);\r\n requires |ss|>0;\r\n ensures I(TruncatingBigNatCtor(ss)) == I(TruncatingBigNatCtor(ss[1..]))*Width() + ss[0];\r\n{\r\n calc {\r\n I(TruncatingBigNatCtor(ss));\r\n V(ss);\r\n {\r\n reveal_V();\r\n lemma_mul_is_commutative_forall();\r\n }\r\n V(ss[1..])*Width() + ss[0];\r\n I(TruncatingBigNatCtor(ss[1..]))*Width() + ss[0];\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/BigNatRandom.i.dfy", "content": "include \"BigNatCompare.i.dfy\"\r\ninclude \"BigNatBitCount.i.dfy\"\r\ninclude \"../Crypto/RandomNumberGen.s.dfy\"\r\ninclude \"BigNumBEAdaptor.i.dfy\"\r\ninclude \"BigNatBitwise.i.dfy\"\r\ninclude \"../../Drivers/TPM/tpm-wrapper.i.dfy\"\r\n\r\n\r\nstatic predicate CandidateSeedWorksheetValid_precondition(worksheet:CandidateSeedWorksheet)\r\n{\r\n 0 < |worksheet.rows|\r\n}\r\n\r\nstatic method truncate_high_zeros(ws:seq) returns (ts:seq)\r\n decreases |ws|;\r\n ensures |ts| <= |ws|;\r\n ensures forall i:nat :: i<|ts| ==> ws[i]==ts[i];\r\n ensures 0<|ts| ==> ts[|ts|-1] != 0;\r\n{\r\n var n := |ws|;\r\n while (n > 0)\r\n invariant 0 <= n <= |ws|;\r\n invariant forall i :: n <= i < |ws| ==> ws[i] == 0;\r\n decreases n;\r\n {\r\n n := n - 1;\r\n if (ws[n] != 0)\r\n {\r\n ts := ws[0..n+1];\r\n return;\r\n }\r\n }\r\n ts := [];\r\n}\r\n\r\nmethod BigNatRandomPower2(c:nat) returns (R:BigNat, ghost randoms:seq)\r\n requires Word32(c);\r\n requires TPM_ready();\r\n ensures WellformedBigNat(R);\r\n ensures I(R) < power2(c);\r\n ensures |randoms| == DivideRoundingUp(c, 8);\r\n ensures IsByteSeq(randoms);\r\n ensures I(R) == BEByteSeqToInt(randoms) % power2(c);\r\n ensures TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPMs_match_except_for_randoms(old(TPM), TPM);\r\n ensures old(TPM).random_index <= TPM.random_index;\r\n ensures randoms == TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index);\r\n{\r\n lemma_2to32();\r\n var full_bytes,extra_bits := Divide32(c, 8);\r\n assert full_bytes*8+extra_bits == c;\r\n var byte_count := full_bytes;\r\n if (extra_bits > 0)\r\n {\r\n //- pluck an extra byte to get the extra bits from\r\n byte_count := full_bytes + 1;\r\n }\r\n lemma_mod_pos_bound(extra_bits, 8);\r\n assert c == full_bytes*8+extra_bits;\r\n lemma_fundamental_div_mod_converse(c, 8, full_bytes, extra_bits);\r\n ghost var L8 := 8;\r\n assert full_bytes == c/L8;\r\n assert extra_bits == c%L8;\r\n\r\n calc {\r\n DivideRoundingUp_premium(c, 8);\r\n { lemma_div_is_div_boogie(c+7, 8); }\r\n (c+7)/8;\r\n (c-1)/8 + 1;\r\n }\r\n\r\n calc {\r\n (c-1)/8 + 1;\r\n { lemma_hoist_over_denominator(c-1, 1, 8); }\r\n (c-1+1*8)/8;\r\n (c+7)/8;\r\n }\r\n if (extra_bits==0)\r\n {\r\n calc {\r\n byte_count;\r\n full_bytes;\r\n c/L8;\r\n { lemma_round_down(c, 7, 8); }\r\n (L8*((c+7)/L8))/L8;\r\n {\r\n lemma_hoist_over_denominator(0, (c+7)/L8, L8);\r\n lemma_mul_is_commutative_forall();\r\n }\r\n div(0,L8) + (c+7)/L8;\r\n { lemma_div_basics(L8); }\r\n (c+7)/L8;\r\n { lemma_div_is_div_boogie(c+7,8); }\r\n (c+7)/8;\r\n (c-1)/8+1;\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n byte_count;\r\n full_bytes+1;\r\n c/L8+1;\r\n {\r\n calc {\r\n c - c%L8;\r\n c - extra_bits;\r\n <=\r\n c-1;\r\n }\r\n lemma_mod_properties();\r\n assert c-1 < c + L8 - c%L8;\r\n if (c CandidateSeedWorksheetRowValid(req, worksheet.rows[i]))\r\n //- all but last row fail\r\n && (forall i:int :: 0<=i<|worksheet.rows|-1 ==> !worksheet.rows[i].accepted)\r\n //- last as specified\r\n && (|worksheet.rows|>0 ==>\r\n worksheet.rows[|worksheet.rows|-1].accepted == last_succeeds)\r\n //- randoms properly accounted for\r\n && CandidateSeedWorksheetConsumesRandoms(worksheet.rows) == worksheet.randoms\r\n}\r\n\r\nmethod BigNatRandomFromInclusiveRange(L:BigNat, H:BigNat, ghost req:SelectRandomRequest) returns (R:BigNat, ghost worksheet:CandidateSeedWorksheet)\r\n requires WellformedBigNat(L);\r\n requires ModestBigNatWords(H);\r\n requires I(L) <= I(H);\r\n requires req.l == I(L);\r\n requires req.h == I(H);\r\n requires SelectRandomRequestValid(req);\r\n requires TPM_ready();\r\n ensures TPM_ready();\r\n ensures WellformedBigNat(R);\r\n ensures I(L) <= I(R) <= I(H);\r\n ensures CandidateSeedWorksheetValid(req, worksheet);\r\n ensures I(R) == CandidateSeedWorksheetOutput(worksheet);\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPMs_match_except_for_randoms(old(TPM), TPM);\r\n ensures old(TPM).random_index <= TPM.random_index;\r\n ensures worksheet.randoms == TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index);\r\n{\r\n var c:nat := BigNatCountBits(H);\r\n\r\n lemma_bit_count_is_unique(I(H), c, req.h_bits);\r\n \r\n var lobound:bool := false;\r\n var hibound:bool := false;\r\n\r\n ghost var randoms;\r\n worksheet := CandidateSeedWorksheet_c([], []);\r\n\r\n ghost var started := false;\r\n R := L; //- dafnycc: initialize variable\r\n var accepted := false;\r\n while (!accepted)\r\n decreases *; //- Possibly doesn't terminate.\r\n invariant started ==> WellformedBigNat(R);\r\n invariant started ==> lobound == (I(L)<=I(R));\r\n invariant started ==> hibound == (I(R)<=I(H));\r\n invariant started ==> 0<|worksheet.rows|;\r\n invariant accepted ==> started;\r\n invariant CandidateSeedWorksheetValid_incremental(req, worksheet, accepted);\r\n invariant accepted ==> CandidateSeedWorksheetOutput(worksheet) == I(R);\r\n invariant TPM_ready();\r\n invariant TPMs_match_except_for_randoms(old(TPM), TPM);\r\n invariant old(TPM).random_index <= TPM.random_index;\r\n invariant worksheet.randoms == TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index);\r\n invariant TPM.random_index - old(TPM).random_index == |worksheet.randoms|;\r\n {\r\n R,randoms := BigNatRandomPower2(c);\r\n lobound := BigNatLe(L, R);\r\n hibound := BigNatLe(R, H);\r\n started := true;\r\n accepted := lobound && hibound;\r\n\r\n ghost var row := CandidateSeedWorksheetRow_c(I(R), accepted, randoms);\r\n ghost var worksheet' := CandidateSeedWorksheet_c(\r\n worksheet.rows + [row],\r\n worksheet.randoms + randoms);\r\n lemma_random_comprehension(old(TPM).random_index, worksheet.randoms, randoms);\r\n\r\n worksheet := worksheet';\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/BigNatSub.i.dfy", "content": "include \"Word32.i.dfy\"\r\ninclude \"BigNatCore.i.dfy\"\r\ninclude \"BigNatPartial.i.dfy\"\r\ninclude \"BigNatX86Shim.i.dfy\"\r\n\r\ninclude \"../Util/ProfileIfc.i.dfy\"\r\n\r\ndatatype sub_Problem = sub_Problem_ctor(\r\n A:BigNat, B:BigNat, c:nat);\r\n\r\nstatic predicate WellformedBorrow(borrow:nat)\r\n { borrow==0 || borrow==1 }\r\n\r\nstatic predicate sub_WellformedProblem(p:sub_Problem)\r\n{\r\n WellformedBigNat(p.A)\r\n && WellformedBigNat(p.B)\r\n && I(p.A) >= (I(p.B) + p.c)\r\n && WellformedBorrow(p.c)\r\n}\r\n\r\nstatic predicate sub_WorksheetProblemsWellformed(ps:seq)\r\n { forall i :: 0 <= i < |ps| ==> sub_WellformedProblem(ps[i]) }\r\n\r\nstatic predicate method sub_ZeroProblem(p:sub_Problem)\r\n requires sub_WellformedProblem(p);\r\n { zero(p.A) && zero(p.B) && p.c==0 }\r\n\r\nstatic predicate sub_WorksheetProblemsConnected(p0:sub_Problem, s0:nat, p1:sub_Problem)\r\n requires sub_WellformedProblem(p0);\r\n requires Word32(s0);\r\n requires sub_WellformedProblem(p1);\r\n{\r\n p1.A == hi(p0.A)\r\n && p1.B == hi(p0.B)\r\n && lo(p0.A) - lo(p0.B) - p0.c == s0 - p1.c * Width()\r\n && !sub_ZeroProblem(p0)\r\n}\r\n\r\nstatic predicate sub_WellformedSolutions(ss:seq)\r\n{\r\n forall i :: 0 <= i < |ss| ==> ss[i]>=0 && Word32(ss[i])\r\n}\r\n\r\nstatic predicate sub_IncompleteWorksheetConsistent(ps:seq, ss:seq)\r\n{\r\n sub_WorksheetProblemsWellformed(ps)\r\n && |ps| == |ss|+1\r\n && sub_WellformedSolutions(ss)\r\n && (forall i:nat :: i < |ps|-1 ==>\r\n sub_WorksheetProblemsConnected(ps[i], ss[i], ps[i+1]))\r\n}\r\n\r\nstatic predicate sub_WorksheetConsistent(ps:seq, ss:seq)\r\n{\r\n sub_IncompleteWorksheetConsistent(ps, ss)\r\n && sub_ZeroProblem(ps[|ps|-1])\r\n}\r\n\r\nstatic lemma lemma_sub_solve_one(p:sub_Problem, m:nat, c:nat, pnew:sub_Problem)\r\n requires sub_WellformedProblem(p);\r\n requires !zero(p.A);\r\n requires Word32(m);\r\n requires c==0 || c==1;\r\n requires lo(p.A)-lo(p.B)-p.c == m - c*Width();\r\n requires pnew == sub_Problem_ctor(hi(p.A), hi(p.B), c);\r\n ensures sub_WellformedProblem(pnew);\r\n ensures Word32(m);\r\n ensures sub_WorksheetProblemsConnected(p, m, pnew);\r\n ensures I(pnew.A) < I(p.A);\r\n{\r\n lemma_2to32();\r\n lemma_mul_is_mul_boogie_Width();\r\n reveal_I();\r\n\r\n if (I(pnew.A) < I(pnew.B) + pnew.c) //- proof by contradiction\r\n {\r\n calc {\r\n I(p.A);\r\n { lemma_hilo(p.A); }\r\n I(hi(p.A))*Width() + lo(p.A);\r\n I(pnew.A)*Width() + lo(p.A);\r\n <= { lemma_mul_inequality(I(pnew.A), (I(pnew.B) + pnew.c - 1), Width()); }\r\n (I(pnew.B) + pnew.c - 1) * Width() + lo(p.A);\r\n { lemma_mul_is_distributive_add_other_way(Width(), I(pnew.B) + pnew.c, -1); }\r\n I(pnew.B)*Width() + pnew.c*Width() + (-1) * Width() + lo(p.A);\r\n { lemma_mul_unary_negation(-1,Width()); }\r\n I(pnew.B)*Width() + pnew.c*Width() - 1 * Width() + lo(p.A);\r\n { lemma_mul_basics(Width()); }\r\n I(pnew.B)*Width() + pnew.c*Width() - Width() + lo(p.A);\r\n I(pnew.B)*Width() - Width() + m + lo(p.B) + p.c;\r\n < { assert m < Width(); }\r\n I(pnew.B)*Width() + lo(p.B) + p.c;\r\n I(hi(p.B))*Width() + lo(p.B) + p.c;\r\n { lemma_hilo(p.B); }\r\n I(p.B) + p.c;\r\n }\r\n assert false;\r\n }\r\n assert I(pnew.A) >= I(pnew.B) + pnew.c;\r\n assert sub_WellformedProblem(pnew);\r\n\r\n if (|p.A.words| == 1)\r\n {\r\n calc {\r\n I(pnew.A);\r\n I(hi(p.A));\r\n { reveal_I(); }\r\n 0;\r\n <\r\n //- WellformedBigNat(p.A) && |p.A.words|==1\r\n p.A.words[0];\r\n { lemma_mul_basics_forall(); }\r\n 0 * Width()+p.A.words[0];\r\n { reveal_I(); }\r\n I(BigNat_ctor(p.A.words[1..])) * Width()+p.A.words[0];\r\n { reveal_I(); }\r\n I(p.A);\r\n }\r\n }\r\n else\r\n {\r\n assert |hi(p.A).words|>0;\r\n assert !zero(hi(p.A));\r\n calc {\r\n I(pnew.A);\r\n I(hi(p.A));\r\n < {\r\n assert 1, ghost ps:seq)\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n requires I(A) >= I(B);\r\n ensures |ps|>0;\r\n ensures ps[0].A == A;\r\n ensures ps[0].B == B;\r\n ensures ps[0].c == 0;\r\n ensures sub_WorksheetConsistent(ps,ss);\r\n{\r\n var start_problem:sub_Problem := sub_Problem_ctor(A,B,0);\r\n var p:sub_Problem := start_problem;\r\n ps := [ p ];\r\n ss := [];\r\n\r\n while (!sub_ZeroProblem(p))\r\n decreases I(p.A);\r\n invariant sub_IncompleteWorksheetConsistent(ps, ss);\r\n invariant sub_WellformedProblem(p);\r\n invariant ps[0] == start_problem;\r\n invariant ps[|ps|-1] == p;\r\n {\r\n var s:nat,pnew:sub_Problem := sub_solve_one_(p);\r\n assert(I(pnew.A) < I(p.A));\r\n ss := ss + [s];\r\n ps := ps + [pnew];\r\n\r\n//- assert sub_WorksheetProblemsConnected(p, s, pnew); // TODO delete\r\n //- should fall straight out of sub_solve_one_!\r\n//- assert sub_WellformedSolutions(ss);\r\n\r\n \r\n \r\n \r\n\r\n p := pnew;\r\n }\r\n\r\n assert sub_ZeroProblem(ps[|ps|-1]);\r\n assert sub_WorksheetConsistent(ps, ss);\r\n}\r\n\r\nstatic function sub_ProblemValue(p:sub_Problem) : int\r\n requires sub_WellformedProblem(p);\r\n{\r\n I(p.A) - I(p.B) - p.c\r\n}\r\n\r\nstatic predicate sub_WellformedBigNatSeq(R:seq)\r\n{\r\n forall i :: 0 <= i < |R| ==> WellformedBigNat(R[i])\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- These functions define the relationship between a sequence of words\r\n//- and a sequence of BigNats formed from subsequences of the word seq.\r\n//- That's so that we can show that the high-place-value partial sums\r\n//- (one word at a time) can be viewed as correct BigNat solutions to the\r\n//- truncated problems. Then we inductively include low-order words one\r\n//- at a time until we've reconstructed the original problem.\r\n\r\nstatic predicate sub_BigNatsForSumWords_Base(ss:seq, R:seq)\r\n requires IsWordSeq(ss);\r\n requires sub_WellformedBigNatSeq(R);\r\n{\r\n |R| == |ss|+1\r\n && R[|R|-1] == TruncatingBigNatCtor([])\r\n && R[0] == TruncatingBigNatCtor(ss)\r\n}\r\n\r\nstatic predicate sub_BigNatsForSumWords_Assembly(ss:seq, R:seq)\r\n requires sub_WellformedBigNatSeq(R);\r\n requires IsWordSeq(ss);\r\n requires sub_BigNatsForSumWords_Base(ss, R);\r\n { forall i :: 0 <= i <=|ss| ==> R[i] == TruncatingBigNatCtor(ss[i..]) }\r\n\r\nstatic predicate sub_ShiftRelation(M:seq, i:nat)\r\n requires sub_WellformedBigNatSeq(M);\r\n requires i < |M|-1;\r\n{ I(M[i]) == I(M[i+1]) * Width() + lo(M[i]) }\r\n\r\nstatic predicate sub_ShiftRelationSeq(ss:seq, R:seq)\r\n requires sub_WellformedBigNatSeq(R);\r\n requires |R| == |ss|+1;\r\n{ forall i :: 0 <= i < |ss| ==> sub_ShiftRelation(R, i) }\r\n\r\nstatic lemma sub_ShiftRelationLemma(M:seq, i:nat)\r\n requires sub_WellformedBigNatSeq(M);\r\n requires i < |M|-1;\r\n requires sub_ShiftRelation(M,i);\r\n ensures I(M[i]) == I(M[i+1]) * Width() + lo(M[i]);\r\n{\r\n reveal_I();\r\n}\r\n\r\nstatic predicate sub_BigNatsForSumWords(ss:seq, R:seq)\r\n requires IsWordSeq(ss);\r\n requires sub_WellformedBigNatSeq(R);\r\n{\r\n sub_BigNatsForSumWords_Base(ss,R)\r\n && sub_BigNatsForSumWords_Assembly(ss, R)\r\n && sub_ShiftRelationSeq(ss,R)\r\n}\r\n\r\nstatic lemma sub_ConstructBigNatsFromSumWords_lemma(ss:seq, R:seq)\r\n requires sub_WellformedBigNatSeq(R);\r\n requires IsWordSeq(ss);\r\n requires |ss|>0;\r\n requires |R| == |ss|+1;\r\n requires sub_BigNatsForSumWords(ss[1..],R[1..]);\r\n requires R[0] == TruncatingBigNatCtor(ss);\r\n ensures sub_BigNatsForSumWords_Base(ss,R);\r\n ensures sub_BigNatsForSumWords(ss,R);\r\n{\r\n\r\n forall (i:nat | i <=|ss|)\r\n ensures R[i] == TruncatingBigNatCtor(ss[i..]);\r\n {\r\n if (i==0)\r\n {\r\n assert ss == ss[0..];\r\n }\r\n else\r\n {\r\n assert R[1..][i-1] == R[i];\r\n assert ss[1..][i-1..] == ss[i..];\r\n }\r\n }\r\n assert sub_BigNatsForSumWords_Assembly(ss,R);\r\n\r\n forall (i:nat | i < |ss|)\r\n ensures sub_ShiftRelation(R, i);\r\n {\r\n if (i==0)\r\n {\r\n if (zero(R[0]))\r\n {\r\n calc {\r\n ss[0];\r\n { lemma_TruncatingBigNat_alignment(ss, R[0]); }\r\n 0;\r\n lo(R[0]);\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n ss[0];\r\n { lemma_TruncatingBigNat_alignment(ss, R[0]); }\r\n lo(R[0]);\r\n }\r\n }\r\n calc {\r\n I(R[0]);\r\n I(TruncatingBigNatCtor(ss));\r\n { lemma_TruncatingBigNat_hilo(ss); }\r\n I(TruncatingBigNatCtor(ss[1..]))*Width() + ss[0];\r\n //- inductive application of sub_BigNatsForSumWords_Assembly\r\n I(R[1])*Width() + ss[0];\r\n //- proven above this calc\r\n I(R[1])*Width() + lo(R[0]);\r\n }\r\n assert sub_ShiftRelation(R, 0);\r\n }\r\n else\r\n {\r\n assert R[1..][i-1] == R[i];\r\n calc ==> {\r\n sub_ShiftRelationSeq(ss[1..],R[1..]);\r\n sub_ShiftRelation(R[1..], i-1);\r\n sub_ShiftRelation(R, i);\r\n }\r\n }\r\n }\r\n assert sub_ShiftRelationSeq(ss,R);\r\n}\r\n\r\nstatic ghost method sub_ConstructBigNatsFromSumWords_(ss:seq) returns (R:seq)\r\n requires IsWordSeq(ss);\r\n ensures sub_WellformedBigNatSeq(R);\r\n ensures sub_BigNatsForSumWords(ss,R);\r\n{\r\n var r:BigNat := TruncatingBigNatCtor(ss);\r\n var tail:seq;\r\n\r\n if |ss|==0\r\n {\r\n tail := [];\r\n R := [r] + tail;\r\n } else {\r\n tail := sub_ConstructBigNatsFromSumWords_(ss[1..]);\r\n R := [r] + tail;\r\n sub_ConstructBigNatsFromSumWords_lemma(ss, R);\r\n }\r\n}\r\n\r\nstatic lemma sub_lemma_accumulate(s:int, ss:seq, ps:seq, Ms:seq)\r\n decreases |ss|-s;\r\n requires 0<=s<=|ss|;\r\n requires sub_WorksheetConsistent(ps,ss);\r\n requires sub_WellformedBigNatSeq(Ms);\r\n requires sub_BigNatsForSumWords(ss,Ms);\r\n ensures I(Ms[s]) == sub_ProblemValue(ps[s]);\r\n{\r\n if (s==|ss|)\r\n {\r\n calc\r\n {\r\n sub_ProblemValue(ps[s]);\r\n I(ps[s].A) - I(ps[s].B) - ps[s].c;\r\n { reveal_I(); }\r\n 0;\r\n { reveal_I(); }\r\n I(Ms[s]);\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n I(Ms[s]);\r\n { sub_ShiftRelationLemma(Ms, s); }\r\n I(Ms[s+1]) * Width() + lo(Ms[s]);\r\n {\r\n lemma_TruncatingBigNat_alignment(ss[s..], Ms[s]);\r\n if (0 == |Ms[s].words|)\r\n {\r\n assert zero(Ms[s]);\r\n calc {\r\n lo(Ms[s]);\r\n 0;\r\n ss[s..][0];\r\n ss[s];\r\n }\r\n } else {\r\n calc {\r\n lo(Ms[s]);\r\n Ms[s].words[0];\r\n ss[s..][0];\r\n ss[s];\r\n }\r\n }\r\n }\r\n I(Ms[s+1]) * Width() + ss[s];\r\n //- sub_WorksheetProblemsConnected(ps[s],ss[s],ps[s+1]);\r\n I(Ms[s+1]) * Width() + lo(ps[s].A)-lo(ps[s].B)-ps[s].c + ps[s+1].c * Width();\r\n {\r\n sub_lemma_accumulate(s+1, ss, ps, Ms);\r\n assert ps[s+1].c == -I(Ms[s+1]) + I(ps[s+1].A) - I(ps[s+1].B);\r\n }\r\n I(Ms[s+1]) * Width() + lo(ps[s].A)-lo(ps[s].B)-ps[s].c + (-I(Ms[s+1]) + I(ps[s+1].A) - I(ps[s+1].B)) * Width();\r\n { lemma_mul_is_commutative(Width(), -I(Ms[s+1]) + I(ps[s+1].A) - I(ps[s+1].B)); }\r\n I(Ms[s+1]) * Width() + lo(ps[s].A)-lo(ps[s].B)-ps[s].c + Width() * (I(ps[s+1].A) - I(Ms[s+1]) - I(ps[s+1].B));\r\n { lemma_mul_is_distributive_sub(Width(), I(ps[s+1].A) - I(Ms[s+1]), I(ps[s+1].B)); }\r\n I(Ms[s+1]) * Width() + lo(ps[s].A)-lo(ps[s].B)-ps[s].c + Width() * (I(ps[s+1].A) - I(Ms[s+1])) - Width() * I(ps[s+1].B);\r\n { lemma_mul_is_distributive_sub(Width(), I(ps[s+1].A), I(Ms[s+1])); }\r\n I(Ms[s+1]) * Width() + lo(ps[s].A)-lo(ps[s].B)-ps[s].c + (Width() * I(ps[s+1].A) - Width() * I(Ms[s+1]) - Width() * I(ps[s+1].B));\r\n I(Ms[s+1]) * Width() + lo(ps[s].A)-lo(ps[s].B)-ps[s].c + Width() * I(ps[s+1].A) - Width() * I(Ms[s+1]) - Width() * I(ps[s+1].B);\r\n { lemma_mul_is_commutative(Width(),I(Ms[s+1])); }\r\n Width() * I(Ms[s+1]) + lo(ps[s].A)-lo(ps[s].B)-ps[s].c + Width() * I(ps[s+1].A) - Width() * I(Ms[s+1]) - Width() * I(ps[s+1].B);\r\n //- cancel terms\r\n lo(ps[s].A)-lo(ps[s].B)-ps[s].c + Width() * I(ps[s+1].A) - Width() * I(ps[s+1].B);\r\n //- rearrange terms\r\n Width() * I(ps[s+1].A) + lo(ps[s].A) - (Width() * I(ps[s+1].B) + lo(ps[s].B)) - ps[s].c;\r\n //- sub_WorksheetProblemsConnected(ps[s],...,ps[s+1]);\r\n Width() * I(hi(ps[s].A)) + lo(ps[s].A) - (Width() * I(hi(ps[s].B)) + lo(ps[s].B)) - ps[s].c;\r\n {\r\n lemma_mul_is_commutative(Width(), I(hi(ps[s].A)));\r\n lemma_mul_is_commutative(Width(), I(hi(ps[s].B)));\r\n lemma_hilo(ps[s].A);\r\n lemma_hilo(ps[s].B);\r\n }\r\n I(ps[s].A) - I(ps[s].B) - ps[s].c;\r\n sub_ProblemValue(ps[s]);\r\n }\r\n }\r\n}\r\n\r\nstatic method BigNatSub(A:BigNat, B:BigNat) returns (R:BigNat)\r\n requires WellformedBigNat(A);\r\n requires WellformedBigNat(B);\r\n requires I(A) >= I(B);\r\n ensures WellformedBigNat(R);\r\n ensures I(A)-I(B) == I(R);\r\n{\r\n //-ProfileTally(Tally_BigNatSub(), 1);\r\n\r\n var ss:seq;\r\n ghost var ps:seq;\r\n ss,ps := BigNatSub_(A,B);\r\n ghost var Ms:seq := sub_ConstructBigNatsFromSumWords_(ss);\r\n //- Ms[i] is the BigNat formed by ss[i..]. It includes Ms[|ss|], which is always TruncatingBigNatCtor([]) (0)\r\n\r\n R := TruncatingBigNatCtor_impl(ss);\r\n calc {\r\n I(R);\r\n I(Ms[0]);\r\n { sub_lemma_accumulate(0,ss,ps,Ms); }\r\n sub_ProblemValue(ps[0]);\r\n I(ps[0].A) - I(ps[0].B) - ps[0].c;\r\n I(ps[0].A) - I(ps[0].B);\r\n I(A) - I(B);\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/BigNatTestLib.i.dfy", "content": "include \"BigNatBitCount.i.dfy\"\r\ninclude \"BigNatMod.i.dfy\"\r\ninclude \"../Util/seqs_reverse.i.dfy\"\r\ninclude \"BigNumBEAdaptor.i.dfy\"\r\n\r\nstatic method FakeBigNat(digit:nat, count:nat) returns (F:BigNat)\r\n requires Word32(digit);\r\n requires 1 F.words[i]==digit;\r\n{\r\n var s := RepeatDigit_impl(digit, count);\r\n ghost var rs := Reverse(s);\r\n F := BigNat_ctor(s);\r\n\r\n lemma_BigNatIIsLEDigitSeqToInt(F);\r\n lemma_Reverse_symmetry(rs, F.words);\r\n lemma_Reverse(rs, F.words);\r\n lemma_Reverse_converts_endianness(Width(), rs, F.words);\r\n calc {\r\n I(F);\r\n LEDigitSeqToInt(Width(), F.words);\r\n BEDigitSeqToInt_premium(Width(), rs);\r\n }\r\n lemma_BEDigitSeqToInt_bound(Width(), rs);\r\n lemma_2toX32();\r\n\r\n calc {\r\n 32 * count;\r\n < { lemma_mul_strict_inequality_forall(); lemma_mul_is_commutative_forall(); }\r\n 32 * power2(25);\r\n power2(5)*power2(25);\r\n { lemma_power2_adds(5,25); }\r\n power2(30);\r\n }\r\n calc {\r\n I(F);\r\n BEDigitSeqToInt(Width(), rs);\r\n < power(Width(), |rs|);\r\n power(power2(32), |rs|);\r\n { lemma_power2_is_power_2(32); }\r\n power(power(2,32), |rs|);\r\n { lemma_power_multiplies(2,32,|rs|); }\r\n power(2,32*|rs|);\r\n { lemma_power2_is_power_2(32 * |rs|); }\r\n power2(32 * |rs|);\r\n power2(32 * count);\r\n < { lemma_power2_strictly_increases(32 * count, power2(30)); }\r\n power2(power2(30));\r\n Frump();\r\n }\r\n\r\n lemma_2toX();\r\n lemma_power_1(Width());\r\n lemma_power_increases(Width(), 1, |rs|-1);\r\n calc {\r\n 1;\r\n <\r\n power(Width(), |rs|-1);\r\n <= { lemma_mul_increases(rs[0], power(Width(), |rs|-1)); }\r\n rs[0] * power(Width(), |rs|-1);\r\n <= BEDigitSeqToInt(Width(), rs);\r\n I(F);\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/BigNatX86Shim.i.dfy", "content": "include \"Word32.i.dfy\"\r\ninclude \"../../Drivers/CPU/assembly_premium.i.dfy\"\r\ninclude \"../Util/seqs_and_ints.i.dfy\"\r\n\r\nstatic method Add32_two_arguments_ordered(a:nat, b:nat) returns (sum:nat, carry:nat)\r\n requires Word32(a);\r\n requires Word32(b);\r\n requires a<=b;\r\n ensures Word32(sum);\r\n ensures carry==0 || carry==1;\r\n ensures a+b == sum + 0x100000000 * carry;\r\n{\r\n lemma_2toX();\r\n lemma_word32(a);\r\n lemma_word32(b);\r\n lemma_mod0x100000000(a + b);\r\n\r\n sum := asm_Add(a, b);\r\n carry := if sum < b then 1 else 0;\r\n\r\n/*\r\n lemma_2toX();\r\n lemma_word32(a);\r\n lemma_word32(b);\r\n\r\n lemma_mod_properties();\r\n lemma_mod0x100000000(a+b);\r\n lemma_mod_is_mod_boogie(a+b, Width());\r\n lemma_mul_is_commutative_forall();\r\n\r\n var tsum := asm_Add(a, b);\r\n carry := if tsum < b then 1 else 0;\r\n\r\n if (a+b < Width())\r\n {\r\n calc {\r\n tsum;\r\n (a+b) % Width();\r\n a+b;\r\n >= b;\r\n }\r\n assert carry == 0;\r\n lemma_small_div();\r\n assert (a+b)/Width() == carry;\r\n } else {\r\n lemma_mod_properties();\r\n assert tsum < a+b;\r\n assert tsum < b;\r\n assert carry == 1;\r\n lemma_div_basics(Width());\r\n lemma_div_is_ordered(Width(), a+b, Width());\r\n assert 0 < (a+b)/Width();\r\n if (2 <= (a+b)/Width())\r\n {\r\n var L2 := 2;\r\n calc {\r\n 2*Width();\r\n { lemma_mul_is_mul_boogie(L2, Width()); }\r\n L2*Width();\r\n <= { lemma_mul_inequality(2, (a+b)/Width(), Width()); }\r\n ((a+b)/Width())*Width();\r\n <= { lemma_fundamental_div_mod(a+b, Width()); }\r\n a+b;\r\n < { lemma_mul_strict_inequality_forall(); }\r\n Width() + Width();\r\n }\r\n assert false;\r\n }\r\n assert (a+b)/Width() < 2;\r\n assert (a+b)/Width() == carry;\r\n }\r\n\r\n calc {\r\n a+b;\r\n { lemma_fundamental_div_mod(a+b, Width()); }\r\n Width() * ((a+b)/Width()) + (a+b)%Width();\r\n Width() * ((a+b)/Width()) + tsum;\r\n Width() * carry + tsum;\r\n tsum + carry * Width();\r\n }\r\n sum := tsum;\r\n*/\r\n}\r\n\r\nstatic method Add32_two_arguments(a:nat, b:nat) returns (sum:nat, carry:nat)\r\n requires Word32(a);\r\n requires Word32(b);\r\n ensures Word32(sum);\r\n ensures carry==0 || carry==1;\r\n ensures a+b == sum + 0x100000000 * carry;\r\n{\r\n if (a<=b)\r\n {\r\n sum,carry := Add32_two_arguments_ordered(a, b);\r\n } else {\r\n sum,carry := Add32_two_arguments_ordered(b, a);\r\n }\r\n}\r\n\r\nstatic method Add32_with_carry(a:nat, b:nat, c:nat) returns (sum:nat, carry:nat)\r\n requires Word32(a);\r\n requires Word32(b);\r\n requires c==0 || c==1;\r\n ensures Word32(sum);\r\n ensures carry==0 || carry==1;\r\n ensures a+b+c == sum + carry * Width();\r\n{\r\n lemma_2toX();\r\n lemma_word32(a);\r\n lemma_word32(b);\r\n//- lemma_mul_basics_forall();\r\n\r\n var psum,pcarry;\r\n if (a<=b)\r\n {\r\n psum,pcarry := Add32_two_arguments(a,b);\r\n } else {\r\n psum,pcarry := Add32_two_arguments(b,a);\r\n }\r\n var qsum,qcarry := Add32_two_arguments(c, psum);\r\n\r\n/*\r\n assert a+b == psum + pcarry * Width();\r\n assert c == -psum + qsum + qcarry * Width();\r\n assert a+b+c == pcarry * Width() + qsum + qcarry * Width();\r\n calc {\r\n pcarry * Width() + qcarry * Width();\r\n { lemma_mul_is_distributive_forall(); }\r\n (pcarry + qcarry) * Width();\r\n }\r\n assert a+b+c == (pcarry + qcarry) * Width() + qsum;\r\n assert 0 <= pcarry <= 1;\r\n assert 0 <= qcarry <= 1;\r\n*/\r\n\r\n sum := qsum;\r\n var zcarry;\r\n carry,zcarry := Add32_two_arguments(pcarry, qcarry);\r\n lemma_mul_is_mul_boogie(carry, 0x100000000);\r\n\r\n/*\r\n if (zcarry > 0)\r\n {\r\n calc {\r\n Width();\r\n <= { lemma_mul_increases(zcarry, Width()); }\r\n zcarry * Width();\r\n <=\r\n carry + zcarry * Width();\r\n pcarry + qcarry;\r\n <=\r\n 2;\r\n }\r\n }\r\n assert zcarry == 0;\r\n lemma_mul_basics(zcarry);\r\n*/\r\n}\r\n\r\nstatic method Sub32_two_arguments(a:nat, b:nat) returns (difference:nat, carry:nat)\r\n requires Word32(a);\r\n requires Word32(b);\r\n ensures Word32(difference);\r\n ensures carry==0 || carry==1;\r\n ensures a-b == difference - 0x100000000 * carry;\r\n{\r\n lemma_2toX();\r\n lemma_word32(a);\r\n lemma_word32(b);\r\n\r\n//- lemma_mod_properties();\r\n lemma_mod0x100000000(a-b);\r\n//- lemma_mod_is_mod_boogie(a-b, Width());\r\n//- lemma_mul_is_commutative_forall();\r\n\r\n difference := asm_Sub(a, b);\r\n carry := if a>=b then 0 else 1;\r\n\r\n}\r\n\r\nstatic method Sub32_with_borrow(a:nat, b:nat, c:nat) returns (difference:nat, carry:nat)\r\n requires Word32(a);\r\n requires Word32(b);\r\n requires c==0 || c==1;\r\n ensures Word32(difference);\r\n ensures carry==0 || carry==1;\r\n ensures a-b-c == difference - carry * Width();\r\n{\r\n lemma_2toX();\r\n//- lemma_mul_is_distributive_forall();\r\n//- lemma_mul_basics_forall();\r\n\r\n var pdiff, pcarry, qcarry;\r\n pdiff, pcarry := Sub32_two_arguments(a,b);\r\n difference, qcarry := Sub32_two_arguments(pdiff, c);\r\n carry := if (pcarry == 1 || qcarry == 1) then 1 else 0;\r\n assert carry == pcarry + qcarry;\r\n lemma_mul_is_mul_boogie(carry, 0x100000000);\r\n}\r\n\r\nstatic method Product32(a:nat, b:nat) returns (l:nat, h:nat)\r\n requires Word32(a);\r\n requires Word32(b);\r\n ensures Word32(l);\r\n ensures Word32(h);\r\n ensures l+(h*Width()) == a*b;\r\n{\r\n lemma_2toX();\r\n lemma_word32_Word32();\r\n var hi,lo := asm_Mul64(a,b);\r\n\r\n ghost var ab := a*b;\r\n\r\n calc {\r\n a*b;\r\n ab;\r\n { lemma_fundamental_div_mod(ab, 0x100000000); }\r\n 0x100000000 * (ab / 0x100000000) + ab % 0x100000000;\r\n { lemma_mod0x100000000(ab); } \r\n 0x100000000 * (ab / 0x100000000) + mod0x100000000(ab); \r\n 0x100000000 * (ab / 0x100000000) + mod0x100000000(a*b); \r\n 0x100000000 * (ab / 0x100000000) + lo;\r\n 0x100000000 * ((a*b) / 0x100000000) + lo;\r\n { lemma_mul_is_commutative_forall(); }\r\n ((a*b) / 0x100000000) * 0x100000000 + lo;\r\n hi * 0x100000000 + lo;\r\n hi * Width() + lo;\r\n }\r\n\r\n l := lo;\r\n h := hi;\r\n}\r\n\r\nstatic lemma lemma_small_division(n:nat, d:nat) \r\n requires Word32(n);\r\n requires Word32(d);\r\n requires 0 < d;\r\n ensures (n / d) % 0x100000000 == n / d;\r\n{\r\n lemma_2toX();\r\n if d == 1 {\r\n } else if n == 0 {\r\n lemma_div_of_0(d);\r\n assert 0 / d == 0;\r\n assert 0 % 0x100000000 == 0;\r\n } else {\r\n calc < {\r\n n / d;\r\n { lemma_div_decreases(n, d); }\r\n n;\r\n power2(32);\r\n }\r\n calc <= {\r\n 0;\r\n { lemma_div_pos_is_pos(n, d); }\r\n n / d;\r\n }\r\n { lemma_small_mod(n / d, 0x100000000); }\r\n }\r\n}\r\n\r\nstatic method Divide32(n:nat, d:nat) returns (q:nat, r:nat)\r\n requires Word32(n);\r\n requires Word32(d);\r\n requires 0 < d;\r\n ensures Word32(q);\r\n ensures Word32(r);\r\n ensures 0<=r {\r\n r == n % d;\r\n { lemma_mod_properties(); }\r\n 0 <= r < d;\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/BigNum.i.dfy", "content": "include \"BigNatDiv.i.dfy\"\r\n\r\ndatatype BigNum = BigNum_ctor(\r\n negate : bool,\r\n value : BigNat);\r\n\r\nstatic function WellformedBigNum(A:BigNum) : bool\r\n{\r\n WellformedBigNat(A.value)\r\n //- disallow redundant zero (-0)\r\n && (zero(A.value) ==> !A.negate)\r\n}\r\n\r\nstatic function BV(A:BigNum) : int\r\n requires WellformedBigNum(A);\r\n ensures (BV(A) < 0) <==> A.negate;\r\n{\r\n if (A.negate) then\r\n -I(A.value)\r\n else\r\n I(A.value)\r\n}\r\n\r\nstatic function method BigNumNegate(A:BigNum) : BigNum\r\n requires WellformedBigNum(A);\r\n ensures WellformedBigNum(BigNumNegate(A));\r\n ensures BV(BigNumNegate(A)) == -BV(A);\r\n{\r\n if (zero(A.value)) then\r\n A\r\n else\r\n BigNum_ctor(!A.negate, A.value)\r\n}\r\n\r\nstatic method BigNumAddSameSign(A:BigNum, B:BigNum) returns (R:BigNum)\r\n requires A.negate == B.negate;\r\n requires WellformedBigNum(A);\r\n requires WellformedBigNum(B);\r\n ensures WellformedBigNum(R);\r\n ensures BV(A)+BV(B) == BV(R);\r\n{\r\n var value:BigNat := BigNatAdd(A.value, B.value);\r\n assert I(value) == I(A.value) + I(B.value);\r\n R := BigNum_ctor(A.negate, value);\r\n if (A.negate)\r\n {\r\n assert B.negate;\r\n calc {\r\n BV(R);\r\n -I(R.value);\r\n -(I(A.value)+I(B.value));\r\n -I(A.value)-I(B.value);\r\n BV(A)+BV(B);\r\n }\r\n }\r\n else\r\n {\r\n assert !B.negate;\r\n calc {\r\n BV(R);\r\n I(R.value);\r\n I(A.value)+I(B.value);\r\n BV(A)+BV(B);\r\n }\r\n }\r\n}\r\n\r\nstatic method BigNumSubPos(A:BigNum, B:BigNum) returns (R:BigNum)\r\n requires !A.negate && !B.negate;\r\n requires WellformedBigNum(A);\r\n requires WellformedBigNum(B);\r\n ensures WellformedBigNum(R);\r\n ensures BV(A)-BV(B) == BV(R);\r\n{\r\n //- A - B ==> this is the interesting case\r\n var negate:bool := BigNatLt(A.value,B.value);\r\n if (negate)\r\n {\r\n assert I(B.value) > I(A.value);\r\n var value:BigNat := BigNatSub(B.value, A.value);\r\n R := BigNum_ctor(negate, value);\r\n calc {\r\n BV(R);\r\n -I(value);\r\n -(I(B.value)-I(A.value));\r\n I(A.value)-I(B.value);\r\n BV(A) - BV(B);\r\n }\r\n }\r\n else\r\n {\r\n assert I(B.value) <= I(A.value);\r\n var value:BigNat := BigNatSub(A.value, B.value);\r\n R := BigNum_ctor(negate, value);\r\n calc {\r\n BV(R);\r\n I(value);\r\n I(A.value)-I(B.value);\r\n BV(A) - BV(B);\r\n }\r\n }\r\n}\r\n\r\nstatic method BigNumAdd(A:BigNum, B:BigNum) returns (R:BigNum)\r\n requires WellformedBigNum(A);\r\n requires WellformedBigNum(B);\r\n ensures WellformedBigNum(R);\r\n ensures BV(A)+BV(B) == BV(R);\r\n{\r\n if (A.negate == B.negate)\r\n {\r\n R := BigNumAddSameSign(A, B);\r\n }\r\n else if (A.negate)\r\n {\r\n assert !B.negate;\r\n R := BigNumSubPos(B,BigNumNegate(A));\r\n calc {\r\n BV(R);\r\n BV(B) - BV(BigNumNegate(A));\r\n BV(B) - (-BV(A));\r\n BV(B) + BV(A);\r\n BV(A) + BV(B);\r\n }\r\n }\r\n else\r\n {\r\n //- A - B\r\n R := BigNumSubPos(A,BigNumNegate(B));\r\n calc {\r\n BV(R);\r\n BV(A)-BV(BigNumNegate(B));\r\n BV(A)-(-BV(B));\r\n BV(A)+BV(B);\r\n }\r\n }\r\n}\r\n\r\nstatic method BigNumSub(A:BigNum, B:BigNum) returns (R:BigNum)\r\n requires WellformedBigNum(A);\r\n requires WellformedBigNum(B);\r\n ensures WellformedBigNum(R);\r\n ensures BV(A)-BV(B) == BV(R);\r\n{\r\n if (B.negate)\r\n {\r\n //- -A - -B == -A + B\r\n //- A - -B == A + B\r\n R := BigNumAdd(A, BigNumNegate(B));\r\n calc {\r\n BV(R);\r\n BV(A) + BV(BigNumNegate(B));\r\n BV(A) + -BV(B);\r\n BV(A) - BV(B);\r\n }\r\n }\r\n else if (A.negate)\r\n {\r\n assert !B.negate;\r\n //- -A - B == - (A + B)\r\n var value:BigNat := BigNatAdd(A.value, B.value);\r\n R := BigNum_ctor(true, value);\r\n calc {\r\n BV(R);\r\n -I(value);\r\n -(I(A.value) + I(B.value));\r\n -I(A.value) - I(B.value);\r\n BV(A) - BV(B);\r\n }\r\n }\r\n else\r\n {\r\n R := BigNumSubPos(A, B);\r\n }\r\n}\r\n\r\nstatic method BigNumCmp(A:BigNum, B:BigNum) returns (c:BNCmp)\r\n requires WellformedBigNum(A);\r\n requires WellformedBigNum(B);\r\n ensures (c==BNCmpLt) <==> (BV(A) < BV(B));\r\n ensures (c==BNCmpEq) <==> (BV(A) == BV(B));\r\n ensures (c==BNCmpGt) <==> (BV(A) > BV(B));\r\n{\r\n if (A.negate)\r\n {\r\n if (!B.negate)\r\n { //- -A, B\r\n c := BNCmpLt;\r\n assert BV(A) < 0 <= BV(B);\r\n }\r\n else\r\n { //- -A,-B\r\n var nc := BigNatCmp(A.value,B.value);\r\n if (nc.BNCmpEq?)\r\n {\r\n c := BNCmpEq;\r\n assert BV(A)==-I(A.value)==-I(B.value)==BV(B);\r\n }\r\n else if (nc.BNCmpLt?)\r\n {\r\n c := BNCmpGt;\r\n assert BV(A)==-I(A.value) > -I(B.value)==BV(B);\r\n }\r\n else\r\n {\r\n c := BNCmpLt;\r\n assert BV(A)==-I(A.value) < -I(B.value)==BV(B);\r\n }\r\n }\r\n }\r\n else\r\n {\r\n if (B.negate)\r\n { //- A, -B\r\n c := BNCmpGt;\r\n assert BV(A) >= 0 > BV(B);\r\n }\r\n else\r\n { //- A, B\r\n c := BigNatCmp(A.value,B.value);\r\n if (c==BNCmpEq)\r\n {\r\n assert BV(A)==I(A.value)==I(B.value)==BV(B);\r\n }\r\n else if (c==BNCmpLt)\r\n {\r\n assert BV(A)==I(A.value)I(B.value)==BV(B);\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic method BigNumLt(A:BigNum, B:BigNum) returns (r:bool)\r\n requires WellformedBigNum(A);\r\n requires WellformedBigNum(B);\r\n ensures r <==> BV(A) BV(A)<=BV(B);\r\n{\r\n var c := BigNumCmp(A,B);\r\n r := c.BNCmpLt? || c.BNCmpEq?;\r\n}\r\n\r\nstatic method BigNumEq(A:BigNum, B:BigNum) returns (r:bool)\r\n requires WellformedBigNum(A);\r\n requires WellformedBigNum(B);\r\n ensures r <==> BV(A)==BV(B);\r\n{\r\n var c := BigNumCmp(A,B);\r\n r := c.BNCmpEq?;\r\n}\r\n\r\nstatic method BigNumGe(A:BigNum, B:BigNum) returns (r:bool)\r\n requires WellformedBigNum(A);\r\n requires WellformedBigNum(B);\r\n ensures r <==> BV(A)>=BV(B);\r\n{\r\n var c := BigNumCmp(A,B);\r\n r := c.BNCmpGt? || c.BNCmpEq?;\r\n}\r\n\r\nstatic method BigNumGt(A:BigNum, B:BigNum) returns (r:bool)\r\n requires WellformedBigNum(A);\r\n requires WellformedBigNum(B);\r\n ensures r <==> BV(A)>BV(B);\r\n{\r\n var c := BigNumCmp(A,B);\r\n r := c.BNCmpGt?;\r\n}\r\n\r\nmethod BigNumMul(A:BigNum, B:BigNum) returns (R:BigNum)\r\n requires WellformedBigNum(A);\r\n requires WellformedBigNum(B);\r\n ensures WellformedBigNum(R);\r\n ensures BV(A)*BV(B) == BV(R);\r\n{\r\n if ((A.negate && B.negate)\r\n || (!A.negate && !B.negate))\r\n {\r\n var value:BigNat := BigNatMul(A.value, B.value);\r\n R := BigNum_ctor(false, value);\r\n\r\n if (A.negate)\r\n {\r\n calc {\r\n BV(R);\r\n I(value);\r\n I(A.value) * I(B.value);\r\n { lemma_mul_cancels_negatives(I(A.value), I(B.value)); }\r\n (-I(A.value)) * (-I(B.value));\r\n BV(A) * BV(B);\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n BV(R);\r\n I(value);\r\n I(A.value) * I(B.value);\r\n BV(A) * BV(B);\r\n }\r\n }\r\n }\r\n else //- if ((!A.negate && B.negate) || (A.negate && !B.negate))\r\n {\r\n if ((B.negate && zero(A.value))\r\n || (A.negate && zero(B.value)))\r\n {\r\n \r\n R := BigNum_ctor(false, BigNatZero());\r\n if (zero(A.value))\r\n {\r\n assert I(A.value)==0;\r\n calc {\r\n BV(A) * BV(B);\r\n I(A.value) * -I(B.value);\r\n 0 * (-I(B.value));\r\n { lemma_mul_basics_forall(); }\r\n 0;\r\n I(BigNatZero());\r\n BV(R);\r\n }\r\n }\r\n else\r\n {\r\n assert I(B.value)==0;\r\n calc {\r\n BV(A) * BV(B);\r\n (-I(A.value)) * I(B.value);\r\n (-I(A.value)) * 0;\r\n { lemma_mul_basics_forall(); }\r\n 0;\r\n I(BigNatZero());\r\n BV(R);\r\n }\r\n }\r\n }\r\n else\r\n {\r\n var value:BigNat := BigNatMul(A.value, B.value);\r\n R := BigNum_ctor(true, value);\r\n\r\n calc ==> {\r\n !zero(A.value) && !zero(B.value);\r\n I(A.value)!=0 && I(B.value)!=0;\r\n { lemma_mul_nonzero_forall(); }\r\n I(A.value)*I(B.value) != 0;\r\n I(value) != 0;\r\n !zero(value);\r\n WellformedBigNum(R);\r\n }\r\n\r\n if (A.negate)\r\n {\r\n calc {\r\n BV(R);\r\n -I(value);\r\n -(I(A.value) * I(B.value));\r\n { lemma_mul_properties(); }\r\n (-I(A.value)) * I(B.value);\r\n BV(A) * BV(B);\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n BV(R);\r\n -I(value);\r\n -(I(A.value) * I(B.value));\r\n { lemma_mul_properties(); }\r\n I(A.value) * (-(I(B.value)));\r\n BV(A) * BV(B);\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic predicate ModestBigNumWords(A:BigNum)\r\n{\r\n WellformedBigNum(A)\r\n && ModestBigNatWords(A.value)\r\n}\r\n\r\nmethod BigNumDiv(N:BigNum, D:BigNum) returns (Q:BigNum, R:BigNum)\r\n requires WellformedBigNum(N);\r\n requires WellformedBigNum(D);\r\n requires nonzero(D.value);\r\n\r\n requires BV(D) >= 0;\r\n ensures WellformedBigNum(Q);\r\n ensures WellformedBigNum(R);\r\n ensures 0 <= BV(R) < BV(D); //- negative D inverts this condition.\r\n ensures BV(Q)*BV(D) + BV(R) == BV(N);\r\n ensures BV(N) / BV(D) == BV(Q);\r\n ensures BV(N) % BV(D) == BV(R);\r\n{\r\n\r\n//- if (D.negate)\r\n//- {\r\n//- var q:BigNat,r:BigNat := BigNatDiv(N, BigNumNegate(D));\r\n//- Q := BigNum_ctor(true, q);\r\n//- R := BigNum_ctor(false, r);\r\n//- }\r\n\r\n var q:BigNat,r:BigNat := BigNatDivImmodest(N.value, D.value);\r\n if (N.negate && !zero(r))\r\n {\r\n var one := MakeSmallLiteralBigNat(1);\r\n q := BigNatAdd(q, one);\r\n Q := BigNum_ctor(true, q);\r\n r := BigNatSub(D.value, r);\r\n R := BigNum_ctor(false, r);\r\n calc ==> {\r\n 0 <= I(r) < I(D.value);\r\n 0 <= BV(R) < BV(D);\r\n }\r\n calc ==> {\r\n (I(q)-1)*I(D.value) + (I(D.value) - I(r)) == I(N.value);\r\n { lemma_mul_is_distributive_forall(); }\r\n { lemma_mul_is_mul_boogie(1, I(D.value)); }\r\n I(q)*I(D.value) - I(D.value) + (I(D.value) - I(r)) == I(N.value);\r\n I(q)*I(D.value) - I(r) == I(N.value);\r\n { lemma_mul_unary_negation(I(q), I(D.value)); }\r\n (-I(q))*I(D.value) + I(r) == -I(N.value);\r\n BV(Q)*BV(D) + BV(R) == BV(N);\r\n }\r\n }\r\n else\r\n {\r\n if (N.negate && zero(q))\r\n {\r\n calc {\r\n I(q)*I(D.value) + I(r) == I(N.value);\r\n { lemma_mul_is_mul_boogie(0, I(D.value)); }\r\n 0*I(D.value) + 0 == I(N.value);\r\n false;\r\n }\r\n }\r\n Q := BigNum_ctor(N.negate, q);\r\n R := BigNum_ctor(false, r);\r\n calc ==> {\r\n 0 <= I(r) < I(D.value);\r\n 0 <= BV(R) < BV(D);\r\n }\r\n if (N.negate)\r\n {\r\n calc ==> {\r\n I(q)*I(D.value) + I(r) == I(N.value);\r\n I(q)*I(D.value) == I(N.value);\r\n { lemma_mul_unary_negation(I(q), I(D.value)); }\r\n (-I(q))*I(D.value) == -I(N.value);\r\n BV(Q)*BV(D) == BV(N);\r\n BV(Q)*BV(D) + BV(R) == BV(N);\r\n }\r\n }\r\n else\r\n {\r\n calc ==> {\r\n I(q)*I(D.value) + I(r) == I(N.value);\r\n BV(Q)*BV(D) + BV(R) == BV(N);\r\n }\r\n }\r\n }\r\n lemma_fundamental_div_mod_converse(BV(N), BV(D), BV(Q), BV(R));\r\n}\r\n\r\nstatic function method MakeSmallLiteralBigNum_def(x:nat) : BigNum\r\n requires x < Width();\r\n ensures WellformedBigNum(MakeSmallLiteralBigNum_def(x));\r\n{\r\n if (x==0) then\r\n BigNum_ctor(false, BigNat_ctor([]))\r\n else\r\n BigNum_ctor(false, BigNat_ctor([x]))\r\n}\r\n\r\nstatic lemma lemma_MakeSmallLiteralBigNum(x:nat)\r\n requires x < Width();\r\n ensures BV(MakeSmallLiteralBigNum_def(x)) == x;\r\n{\r\n var R:BigNum := MakeSmallLiteralBigNum_def(x);\r\n assert WellformedBigNum(R);\r\n assert WellformedBigNat(R.value);\r\n if (x==0)\r\n {\r\n assert zero(R.value);\r\n assert BV(R) == 0;\r\n }\r\n else\r\n {\r\n assert R.value.words == [x];\r\n calc {\r\n I(R.value);\r\n { reveal_I(); }\r\n I(BigNat_ctor(R.value.words[1..]))*Width()+R.value.words[0];\r\n { assert R.value.words[1..] == []; }\r\n I(BigNat_ctor([]))*Width()+R.value.words[0];\r\n {\r\n reveal_I();\r\n lemma_mul_basics_forall();\r\n }\r\n R.value.words[0];\r\n x;\r\n }\r\n assert I(R.value) == x;\r\n assert BV(R) == x;\r\n }\r\n}\r\n\r\nstatic function method MakeSmallLiteralBigNum(x:nat) : BigNum\r\n requires x < Width();\r\n ensures WellformedBigNum(MakeSmallLiteralBigNum(x));\r\n ensures BV(MakeSmallLiteralBigNum(x))==x;\r\n{\r\n lemma_MakeSmallLiteralBigNum(x);\r\n MakeSmallLiteralBigNum_def(x)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/BigNumBEAdaptor.i.dfy", "content": "include \"BigNatCore.i.dfy\"\r\ninclude \"../Util/seqs_transforms.i.dfy\"\r\ninclude \"../Util/seqs_reverse.i.dfy\"\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- Convert between \"legacy\" little-endian, well-formed-required BigNats\r\n//- and new-style BEIsByteSeq\r\n\r\nstatic predicate ZeroPrefix(s:seq, s_suffix:seq)\r\n{\r\n |s| >= |s_suffix|\r\n && s[ |s|-|s_suffix| .. ] == s_suffix\r\n && forall i :: 0 <= i < |s|-|s_suffix| ==> s[i] == 0\r\n}\r\n\r\n//- Takes a string that may contain leading zeros.\r\n//- Returns a string with no leading zeros.\r\nstatic method StripLeadingZeros(ghost pv:int, ins:seq) returns (outs:seq)\r\n requires 10 ==> outs[0]!=0;\r\n{\r\n var ptr := 0;\r\n while (ptr<|ins| && ins[ptr]==0)\r\n invariant 0 <= ptr <= |ins|;\r\n invariant forall i :: 0 <= i < ptr ==> ins[i] == 0;\r\n {\r\n ptr := ptr + 1;\r\n }\r\n outs := ins[ptr..];\r\n}\r\n\r\n\r\n\r\nstatic lemma lemma_BigNatIIsLEDigitSeqToInt(a:BigNat)\r\n requires WellformedBigNat(a);\r\n decreases |a.words|;\r\n ensures I(a) == LEDigitSeqToInt(Width(), a.words);\r\n{\r\n reveal_I();\r\n reveal_LEDigitSeqToInt_private();\r\n if (|a.words|>0)\r\n {\r\n lemma_BigNatIIsLEDigitSeqToInt(BigNat_ctor(a.words[1..]));\r\n }\r\n}\r\n\r\nstatic method BigNatToBEByteSeq(M:BigNat) returns (m:seq)\r\n requires WellformedBigNat(M);\r\n ensures IsByteSeq(m);\r\n ensures BEByteSeqToInt(m) == I(M);\r\n ensures BEIntToByteSeq(I(M)) == m;\r\n ensures |m|==0 || 0) returns (M:BigNat)\r\n requires IsByteSeq(m);\r\n ensures WellformedBigNat(M);\r\n ensures BEByteSeqToInt(m) == I(M);\r\n//- ensures BEIntToByteSeq(I(M)) == m; //- not available, unless we require no prefix 0s.\r\n{\r\n lemma_2toX();\r\n var be_words:seq;\r\n ghost var pad_bytes:seq;\r\n be_words,pad_bytes := BEByteSeqToWordSeq_impl(m);\r\n var be_words_normalized := StripLeadingZeros(4294967296, be_words);\r\n//- assert |be_words_normalized|>0 ==> be_words_normalized[0]!=0;\r\n\r\n var le_words := ReverseDigitSeq(4294967296, be_words_normalized);\r\n lemma_Reverse(be_words_normalized, le_words);\r\n//- assert |le_words|>0 ==> le_words[|le_words|-1]!=0;\r\n\r\n M := BigNat_ctor(le_words);\r\n\r\n calc {\r\n I(M);\r\n { lemma_BigNatIIsLEDigitSeqToInt(M); }\r\n LEDigitSeqToInt(Width(), le_words);\r\n { lemma_Reverse_converts_endianness_inner(Width(), be_words_normalized, le_words); }\r\n BEDigitSeqToInt(Width(), be_words_normalized);\r\n { lemma_LeadingZeros(Width(), be_words_normalized, be_words); }\r\n BEDigitSeqToInt(Width(), be_words);\r\n BEDigitSeqToInt(power2(8), m);\r\n BEByteSeqToInt(m);\r\n }\r\n}\r\n\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/BigRat.i.dfy", "content": "//- \r\ninclude \"BigNum.i.dfy\"\r\ninclude \"../Math/mul.i.dfy\"\r\n\r\ndatatype BigRat = BigRat_ctor(\r\n n : BigNum,\r\n d : BigNat);\r\n\r\nstatic function WellformedBigRat(Q:BigRat) : bool\r\n{\r\n WellformedBigNum(Q.n) && WellformedBigNat(Q.d) && !zero(Q.d)\r\n}\r\n\r\nstatic function RV(Q:BigRat) : real\r\n requires WellformedBigRat(Q);\r\n{\r\n real(BV(Q.n)) / real(I(Q.d))\r\n}\r\n\r\nstatic function method BigRatNegate(Q:BigRat) : BigRat\r\n requires WellformedBigRat(Q);\r\n ensures WellformedBigRat(BigRatNegate(Q));\r\n ensures RV(BigRatNegate(Q)) == 0.0 - RV(Q);\r\n{\r\n BigRat_ctor(BigNumNegate(Q.n), Q.d)\r\n}\r\n\r\nstatic lemma Lemma_BigRatAdd(an:int, ad:int, bn:int, bd:int)\r\n requires ad != 0;\r\n requires bd != 0;\r\n ensures real(ad * bd) != 0.0;\r\n ensures real(an * bd + bn * ad) / real(ad * bd) == real(an) / real(ad) + real(bn) / real(bd);\r\n{\r\n lemma_mul_nonzero(ad, bd);\r\n Lemma_RealOfMultiplyIsMultiply(an, bd);\r\n Lemma_RealOfMultiplyIsMultiply(ad, bd);\r\n Lemma_RealOfMultiplyIsMultiply(bn, ad);\r\n Lemma_RealOfMultiplyIsMultiply(bd, ad);\r\n}\r\n\r\nmethod BigRatAdd(A:BigRat, B:BigRat) returns (R:BigRat)\r\n requires WellformedBigRat(A);\r\n requires WellformedBigRat(B);\r\n ensures WellformedBigRat(R);\r\n ensures RV(R) == RV(A) + RV(B);\r\n{\r\n var ScaledANumerator:BigNum := BigNumMul(A.n, BigNum_ctor(false, B.d));\r\n var ScaledBNumerator:BigNum := BigNumMul(B.n, BigNum_ctor(false, A.d));\r\n var ResultNumerator:BigNum := BigNumAdd(ScaledANumerator, ScaledBNumerator);\r\n var ResultDenominator:BigNat := BigNatMul(A.d, B.d);\r\n lemma_mul_nonzero(I(A.d), I(B.d));\r\n R := BigRat_ctor(ResultNumerator, ResultDenominator);\r\n Lemma_BigRatAdd(BV(A.n), I(A.d), BV(B.n), I(B.d));\r\n}\r\n\r\nstatic lemma Lemma_BigRatSub(an:int, ad:int, bn:int, bd:int)\r\n requires ad != 0;\r\n requires bd != 0;\r\n ensures real(ad * bd) != 0.0;\r\n ensures real(an * bd - bn * ad) / real(ad * bd) == real(an) / real(ad) - real(bn) / real(bd);\r\n{\r\n lemma_mul_nonzero(ad, bd);\r\n Lemma_RealOfMultiplyIsMultiply(an, bd);\r\n Lemma_RealOfMultiplyIsMultiply(ad, bd);\r\n Lemma_RealOfMultiplyIsMultiply(bn, ad);\r\n Lemma_RealOfMultiplyIsMultiply(bd, ad);\r\n}\r\n\r\nmethod BigRatSub(A:BigRat, B:BigRat) returns (R:BigRat)\r\n requires WellformedBigRat(A);\r\n requires WellformedBigRat(B);\r\n ensures WellformedBigRat(R);\r\n ensures RV(R) == RV(A) - RV(B);\r\n{\r\n var ScaledANumerator:BigNum := BigNumMul(A.n, BigNum_ctor(false, B.d));\r\n var ScaledBNumerator:BigNum := BigNumMul(B.n, BigNum_ctor(false, A.d));\r\n var ResultNumerator:BigNum := BigNumSub(ScaledANumerator, ScaledBNumerator);\r\n var ResultDenominator:BigNat := BigNatMul(A.d, B.d);\r\n lemma_mul_nonzero(I(A.d), I(B.d));\r\n R := BigRat_ctor(ResultNumerator, ResultDenominator);\r\n Lemma_BigRatSub(BV(A.n), I(A.d), BV(B.n), I(B.d));\r\n calc {\r\n RV(R);\r\n real(BV(R.n)) / real(I(R.d));\r\n real(BV(A.n)) / real(I(A.d)) - real(BV(B.n)) / real(I(B.d));\r\n RV(A) - RV(B);\r\n }\r\n}\r\n\r\nmethod BigRatCmp(A:BigRat, B:BigRat) returns (c:BNCmp)\r\n requires WellformedBigRat(A);\r\n requires WellformedBigRat(B);\r\n ensures (c==BNCmpLt) <==> (RV(A) < RV(B));\r\n ensures (c==BNCmpEq) <==> (RV(A) == RV(B));\r\n ensures (c==BNCmpGt) <==> (RV(A) > RV(B));\r\n{\r\n var ScaledANumerator:BigNum := BigNumMul(A.n, BigNum_ctor(false, B.d));\r\n var ScaledBNumerator:BigNum := BigNumMul(B.n, BigNum_ctor(false, A.d));\r\n c := BigNumCmp(ScaledANumerator, ScaledBNumerator);\r\n\r\n ghost var CommonDenominator:BigNat := BigNatMul(A.d, B.d);\r\n lemma_mul_nonzero(I(A.d), I(B.d));\r\n ghost var ScaledA := BigRat_ctor(ScaledANumerator, CommonDenominator);\r\n ghost var ScaledB := BigRat_ctor(ScaledBNumerator, CommonDenominator);\r\n Lemma_ScalingPreservesValue(A, ScaledA, B.d);\r\n lemma_mul_is_commutative(I(A.d), I(B.d));\r\n Lemma_ScalingPreservesValue(B, ScaledB, A.d);\r\n Lemma_DivideByPositiveRealPreservesOrder(real(BV(ScaledANumerator)), real(BV(ScaledBNumerator)), real(I(CommonDenominator)));\r\n}\r\n\r\nmethod BigRatLt(A:BigRat, B:BigRat) returns (r:bool)\r\n requires WellformedBigRat(A);\r\n requires WellformedBigRat(B);\r\n ensures r == (RV(A) < RV(B));\r\n{\r\n var c := BigRatCmp(A,B);\r\n r := (c.BNCmpLt?);\r\n}\r\n\r\nmethod BigRatLe(A:BigRat, B:BigRat) returns (r:bool)\r\n requires WellformedBigRat(A);\r\n requires WellformedBigRat(B);\r\n ensures r == (RV(A) <= RV(B));\r\n{\r\n var c := BigRatCmp(A,B);\r\n r := (c.BNCmpLt? || c.BNCmpEq?);\r\n}\r\n\r\nmethod BigRatEq(A:BigRat, B:BigRat) returns (r:bool)\r\n requires WellformedBigRat(A);\r\n requires WellformedBigRat(B);\r\n ensures r == (RV(A) == RV(B));\r\n{\r\n var c := BigRatCmp(A,B);\r\n r := (c.BNCmpEq?);\r\n}\r\n\r\nmethod BigRatNe(A:BigRat, B:BigRat) returns (r:bool)\r\n requires WellformedBigRat(A);\r\n requires WellformedBigRat(B);\r\n ensures r == (RV(A) != RV(B));\r\n{\r\n var c := BigRatCmp(A,B);\r\n r := !(c.BNCmpEq?);\r\n}\r\n\r\nmethod BigRatGe(A:BigRat, B:BigRat) returns (r:bool)\r\n requires WellformedBigRat(A);\r\n requires WellformedBigRat(B);\r\n ensures r == (RV(A) >= RV(B));\r\n{\r\n var c := BigRatCmp(A,B);\r\n r := (c.BNCmpGt? || c.BNCmpEq?);\r\n}\r\n\r\nmethod BigRatGt(A:BigRat, B:BigRat) returns (r:bool)\r\n requires WellformedBigRat(A);\r\n requires WellformedBigRat(B);\r\n ensures r == (RV(A) > RV(B));\r\n{\r\n var c := BigRatCmp(A,B);\r\n r := (c.BNCmpGt?);\r\n}\r\n\r\nmethod BigRatMul(A:BigRat, B:BigRat) returns (R:BigRat)\r\n requires WellformedBigRat(A);\r\n requires WellformedBigRat(B);\r\n ensures WellformedBigRat(R);\r\n ensures RV(R) == RV(A) * RV(B);\r\n{\r\n var ResultNumerator:BigNum := BigNumMul(A.n, B.n);\r\n var ResultDenominator:BigNat := BigNatMul(A.d, B.d);\r\n lemma_mul_nonzero(I(A.d), I(B.d));\r\n R := BigRat_ctor(ResultNumerator, ResultDenominator);\r\n\r\n Lemma_RealOfMultiplyIsMultiply(BV(A.n), BV(B.n));\r\n Lemma_RealOfMultiplyIsMultiply(I(A.d), I(B.d));\r\n assert !zero(R.d);\r\n}\r\n\r\nmethod BigRatDiv(A:BigRat, B:BigRat) returns (R:BigRat)\r\n requires WellformedBigRat(A);\r\n requires WellformedBigRat(B);\r\n requires nonzero(B.n.value);\r\n ensures WellformedBigRat(R);\r\n ensures RV(R) == RV(A) / RV(B);\r\n{\r\n if (zero(A.n.value)) {\r\n R := BigRat_ctor(MakeSmallLiteralBigNum(0), MakeSmallLiteralBigNat(1));\r\n assert RV(R) == real(0) == RV(A) / RV(B);\r\n return;\r\n }\r\n\r\n var ResultNegative:bool := (A.n.negate != B.n.negate);\r\n var ResultNumerator:BigNum := BigNumMul(BigNum_ctor(ResultNegative, A.n.value), BigNum_ctor(false, B.d));\r\n var ResultDenominator:BigNat := BigNatMul(B.n.value, A.d);\r\n lemma_mul_nonzero(I(B.n.value), I(A.d));\r\n R := BigRat_ctor(ResultNumerator, ResultDenominator);\r\n\r\n Lemma_RealOfMultiplyIsMultiply(BV(BigNum_ctor(ResultNegative, A.n.value)), BV(BigNum_ctor(false, B.d)));\r\n Lemma_RealOfMultiplyIsMultiply(I(B.n.value), I(A.d));\r\n assert I(ResultDenominator) == I(B.n.value) * I(A.d);\r\n\r\n calc {\r\n RV(R);\r\n real(BV(ResultNumerator)) / real(I(ResultDenominator));\r\n real(BV(ResultNumerator)) / real(I(B.n.value) * I(A.d));\r\n }\r\n}\r\n\r\nstatic function method MakeSmallLiteralBigRat(x:nat) : BigRat\r\n requires x < Width();\r\n ensures WellformedBigRat(MakeSmallLiteralBigRat(x));\r\n ensures RV(MakeSmallLiteralBigRat(x)) == real(x);\r\n{\r\n lemma_2toX();\r\n BigRat_ctor(MakeSmallLiteralBigNum(x), MakeSmallLiteralBigNat(1))\r\n}\r\n\r\nstatic function method BigNatToBigRat(x:BigNat) : BigRat\r\n requires WellformedBigNat(x);\r\n ensures WellformedBigRat(BigNatToBigRat(x));\r\n ensures RV(BigNatToBigRat(x)) == real(I(x));\r\n{\r\n lemma_2toX();\r\n BigRat_ctor(BigNum_ctor(false, x), MakeSmallLiteralBigNat(1))\r\n}\r\n\r\n//-/////////////////////////////////\r\n//- Useful mathematical lemmas\r\n//-/////////////////////////////////\r\n\r\nstatic lemma Lemma_RealOfMultiplyIsMultiply(a:int, b:int)\r\n ensures real(a * b) == real(a) * real(b);\r\n{\r\n lemma_mul_is_mul_boogie(a, b);\r\n}\r\n\r\nstatic lemma Lemma_ScalingPreservesValue(A:BigRat, ScaledA:BigRat, scale:BigNat)\r\n requires WellformedBigRat(A);\r\n requires WellformedBigRat(ScaledA);\r\n requires WellformedBigNat(scale);\r\n requires nonzero(scale);\r\n requires BV(ScaledA.n) == BV(A.n) * I(scale);\r\n requires I(ScaledA.d) == I(A.d) * I(scale);\r\n ensures RV(A) == RV(ScaledA);\r\n{\r\n Lemma_RealOfMultiplyIsMultiply(BV(A.n), I(scale));\r\n Lemma_RealOfMultiplyIsMultiply(I(A.d), I(scale));\r\n}\r\n\r\nstatic lemma Lemma_DivideByPositiveRealPreservesOrder(a:real, b:real, c:real)\r\n requires c > 0.0;\r\n ensures a < b <==> a/c < b/c;\r\n ensures a == b <==> a/c == b/c;\r\n ensures a > b <==> a/c > b/c;\r\n{\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/BigNum/Word32.i.dfy", "content": "//-include \"../Util/assembly_deprecated.s.dfy\"\r\ninclude \"../Math/power2.i.dfy\"\r\n\r\n//-static function Word(w:nat, x:nat) : bool\r\n//-{\r\n//- 0 <= x < power2(w)\r\n//-}\r\n\r\nstatic function Width() : int\r\n ensures 0 < Width();\r\n { power2(32) }\r\n\r\n//-static function Word32(x: nat): bool\r\n//- ensures Word32(x) <==> (x\r\n\r\nstatic lemma lemma_SHA256_DigestInfo_properties()\r\n ensures IsByteSeq(SHA256_DigestInfo());\r\n ensures |SHA256_DigestInfo()|==19;\r\n{\r\n lemma_2toX();\r\n}\r\n\r\nstatic function SHA256_DigestInfo_premium() : seq\r\n ensures IsByteSeq(SHA256_DigestInfo());\r\n ensures |SHA256_DigestInfo()|==19;\r\n{\r\n lemma_2toX();\r\n SHA256_DigestInfo()\r\n}\r\n\r\nstatic lemma lemma_SHA256_preserves_type(msg:seq)\r\n requires IsBitSeq(msg);\r\n requires |msg| < power2(64);\r\n ensures IsWordSeq(SHA256(msg));\r\n{\r\n//- lemma_BitSeqToBoolSeq_ensures(msg);\r\n}\r\n\r\nstatic predicate SHA256_BytesRequires(msg_bytes:seq)\r\n{\r\n IsByteSeq(msg_bytes)\r\n && IsBitSeq(BEByteSeqToBitSeq(msg_bytes))\r\n && |BEByteSeqToBitSeq(msg_bytes)| < power2(64)\r\n && IsWordSeq(SHA256(BEByteSeqToBitSeq(msg_bytes)))\r\n}\r\n\r\nstatic lemma lemma_SHA256_Bytes_preserves_IsByteSeq(msg:seq)\r\n requires IsByteSeq(msg);\r\n requires |msg| < power2(61);\r\n requires SHA256_BytesRequires(msg);\r\n ensures IsByteSeq(SHA256_Bytes(msg));\r\n{\r\n lemma_BEByteSeqToBitSeq_ensures(msg);\r\n assert IsBitSeq(BEByteSeqToBitSeq(msg));\r\n calc {\r\n |BEByteSeqToBitSeq(msg)|;\r\n |msg|*8;\r\n < power2(61)*8;\r\n { lemma_2to64(); lemma_power2_add8(56); }\r\n power2(64);\r\n }\r\n lemma_SHA256_preserves_type(BEByteSeqToBitSeq(msg));\r\n lemma_BEWordSeqToByteSeq_ensures(SHA256(BEByteSeqToBitSeq(msg)));\r\n}\r\n\r\n//-static lemma lemma_SHA256Digest_properties(msg:seq)\r\n//- requires IsByteSeq(msg);\r\n//- requires |msg| < power2(60);\r\n//- ensures SHA256_BytesRequires(msg);\r\n//- ensures IsByteSeq(SHA256Digest(msg));\r\n//- ensures |SHA256Digest(msg)|==32;\r\n//-{\r\n//- lemma_2toX();\r\n//- lemma_SHA256_DigestInfo_properties();\r\n//- lemma_concat_preserves_IsByteSeq(SHA256_DigestInfo(), msg);\r\n//- calc {\r\n//- |SHA256_DigestInfo() + msg|;\r\n//- |SHA256_DigestInfo()|+|msg|;\r\n//- < 19+power2(60);\r\n//- <= { lemma_2to64(); lemma_power2_add8(56); }\r\n//- power2(61);\r\n//- }\r\n//- assert IsBitSeq(BEByteSeqToBitSeq_premium(SHA256_DigestInfo() + msg));\r\n//- lemma_SHA256_Bytes_preserves_IsByteSeq(SHA256_DigestInfo() + msg);\r\n//-\r\n//- calc {\r\n//- |SHA256Digest(msg)|;\r\n//- |SHA256_Bytes(SHA256_DigestInfo() + msg)|;\r\n//- |BEWordSeqToByteSeq(SHA256(BEByteSeqToBitSeq(SHA256_DigestInfo() + msg)))|;\r\n//- }\r\n//- assert |SHA256(BEByteSeqToBitSeq(SHA256_DigestInfo() + msg))| == 8;\r\n//- lemma_BEWordSeqToByteSeq_ensures(SHA256(BEByteSeqToBitSeq(SHA256_DigestInfo() + msg)));\r\n//- assert |BEWordSeqToByteSeq(SHA256(BEByteSeqToBitSeq(SHA256_DigestInfo() + msg)))| == 4*8;\r\n//-}\r\n\r\nstatic lemma lemma_SHA256Digest_premium(msg:seq)\r\n requires IsByteSeq(msg);\r\n requires |msg|) : seq\r\n requires IsByteSeq(msg);\r\n requires |msg|) returns (digest:seq)\r\n requires IsByteSeq(msg);\r\n requires |msg| < power2(29);\r\n ensures IsByteSeq(digest);\r\n ensures |msg| < power2(61);\r\n ensures digest == SHA256Digest_premium(msg);\r\n ensures |digest| == 51;\r\n{\r\n lemma_2toX32();\r\n lemma_power2_increases(29, 61);\r\n lemma_power2_increases(32, 64);\r\n \r\n var msg_digest_words := SHA256_impl_Bytes(msg);\r\n var msg_digest_bytes := BEWordSeqToByteSeq_impl(msg_digest_words);\r\n digest := SHA256_DigestInfo() + msg_digest_bytes;\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/Digest.s.dfy", "content": "include \"../../Util/integer_sequences.s.dfy\"\r\ninclude \"../Hash/sha256.s.dfy\"\r\n\r\nstatic function {:autoReq} SHA256_Bytes(msg_bytes:seq) : seq\r\n{\r\n BEWordSeqToByteSeq(SHA256(BEByteSeqToBitSeq(msg_bytes)))\r\n}\r\n\r\n//- http://www.ietf.org/rfc/rfc3447.txt\r\n//- (Note that https://tools.ietf.org/html/rfc5754 is a different\r\n//- thing, for SMIMECapability.)\r\nstatic function method {:autoReq} SHA256_DigestInfo() : seq\r\n{\r\n [ 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01,\r\n 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20 ]\r\n}\r\n\r\nstatic function {:autoReq} SHA256Digest(msg:seq) : seq\r\n{\r\n SHA256_DigestInfo() + SHA256_Bytes(msg)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/hmac_common.i.dfy", "content": "include \"hmac_common.s.dfy\"\r\ninclude \"../../../Drivers/CPU/assembly_premium.i.dfy\"\r\ninclude \"../../Util/integer_sequences_premium.i.dfy\"\r\ninclude \"sha_padding.i.dfy\"\r\n\r\n//-///////////////////////////////////////////////////\r\n//- ConstPad lemmas\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic lemma lemma_ConstPad_properties(len:int, const:int)\r\n requires len >= 0;\r\n requires Mod32_const(len) == 0;\r\n requires Word32(const);\r\n ensures IsBitSeq(ConstPad(len, const));\r\n ensures |ConstPad(len, const)| == len;\r\n ensures ConstPad(len, const) == if len <= 0 then [] else BEWordToBitSeq(const) + ConstPad(len - 32, const);\r\n{\r\n reveal_ConstPad();\r\n if len == 0 {\r\n }\r\n else {\r\n reveal_Mod32_const();\r\n lemma_ConstPad_properties(len - 32, const);\r\n assert BEWordToBitSeq_premium(const) == BEWordToBitSeq(const);\r\n }\r\n}\r\n\r\nstatic function ConstPad_premium(len:int, const:int) : seq\r\n requires len >= 0;\r\n requires Mod32_const(len) == 0;\r\n requires Word32(const);\r\n ensures IsBitSeq(ConstPad_premium(len, const));\r\n ensures |ConstPad_premium(len, const)| == len;\r\n ensures ConstPad_premium(len, const) == if len <= 0 then [] else BEWordToBitSeq(const) + ConstPad(len - 32, const);\r\n{\r\n lemma_ConstPad_properties(len, const);\r\n ConstPad(len, const)\r\n}\r\n\r\nstatic function Ipad_premium(len:int) : seq\r\n requires len >= 0;\r\n requires Mod32_const(len) == 0;\r\n ensures IsBitSeq(Ipad_premium(len));\r\n ensures |Ipad_premium(len)| == len;\r\n{\r\n lemma_2toX();\r\n lemma_ConstPad_properties(len, 0x36363636);\r\n Ipad(len)\r\n}\r\n\r\nstatic function Opad_premium(len:int) : seq\r\n requires len >= 0;\r\n requires Mod32_const(len) == 0;\r\n ensures IsBitSeq(Opad_premium(len));\r\n ensures |Opad_premium(len)| == len;\r\n{\r\n lemma_2toX();\r\n lemma_ConstPad_properties(len, 0x5c5c5c5c);\r\n Opad(len)\r\n}\r\n\r\n//-///////////////////////////////////////////////////\r\n//- SeqXor lemmas\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic lemma{:dafnycc_conservative_seq_triggers} lemma_SeqXor_properties(a: seq, b: seq)\r\n requires IsBitSeq(a);\r\n requires IsBitSeq(b);\r\n requires |a|==|b|;\r\n ensures |SeqXor(a, b)| == |a|;\r\n ensures forall i :: 0 <= i < |a| ==> SeqXor(a, b)[i] == Xor(a[i], b[i]);\r\n{\r\n reveal_SeqXor();\r\n if |a| != 0 {\r\n lemma_SeqXor_properties(a[1..], b[1..]);\r\n }\r\n}\r\n\r\nstatic function SeqXor_premium(a: seq, b: seq) : seq\r\n requires IsBitSeq(a);\r\n requires IsBitSeq(b);\r\n requires |a|==|b|;\r\n ensures |SeqXor_premium(a, b)| == |a|;\r\n ensures forall i {:trigger a[i]}{:trigger b[i]}{:trigger SeqXor_premium(a, b)[i]} :: 0 <= i < |a| ==>\r\n SeqXor_premium(a, b)[i] == Xor(a[i], b[i]);\r\n{\r\n lemma_SeqXor_properties(a, b);\r\n SeqXor(a, b)\r\n}\r\n\r\nstatic lemma{:dafnycc_conservative_seq_triggers} lemma_SeqXor_Split(a: seq, A: seq, b: seq, B: seq)\r\n requires IsBitSeq(a) && IsBitSeq(b) && IsBitSeq(A) && IsBitSeq(B);\r\n requires |a| == |b| && |A| == |B|;\r\n ensures SeqXor_premium(a + A, b + B) == SeqXor_premium(a, b) + SeqXor_premium(A, B);\r\n{\r\n if a == [] {\r\n assert a + A == A;\r\n assert b + B == B;\r\n } else {\r\n calc {\r\n SeqXor(a + A, b + B);\r\n { reveal_SeqXor(); }\r\n { assert a + A == [a[0]] + (a[1..] + A); assert b + B == [b[0]] + (b[1..] + B); }\r\n [Xor(a[0], b[0])] + SeqXor(a[1..] + A, b[1..]+B);\r\n { lemma_SeqXor_Split(a[1..], A, b[1..], B); }\r\n [Xor(a[0], b[0])] + SeqXor(a[1..], b[1..]) + SeqXor(A, B);\r\n { reveal_SeqXor(); }\r\n SeqXor(a, b) + SeqXor(A, B);\r\n }\r\n }\r\n}\r\n\r\n\r\nstatic lemma lemma_mul_mod_32(x:int, y:int)\r\n requires x == 32 * y;\r\n ensures x % 32 == 0;\r\n{\r\n}\r\n\r\n\r\nstatic lemma lemma_SeqXor_WordSeqToBitSeq(i:int, pad:seq, key:seq, const:int)\r\n requires |pad| == |key| == i;\r\n requires Word32(const);\r\n requires forall j {:trigger pad[j]}{:trigger key[j]} :: 0 <= j < |pad| ==> Word32(pad[j]) && Word32(key[j]);\r\n requires forall j {:trigger pad[j]}{:trigger key[j]} :: 0 <= j < |pad| ==> pad[j] == Asm_BitwiseXor(key[j], const);\r\n ensures Mod32_const(i*32) == 0;\r\n ensures BEWordSeqToBitSeq_premium(pad) == SeqXor(BEWordSeqToBitSeq_premium(key), ConstPad_premium(i*32, const));\r\n{\r\n calc { Mod32_const(i*32); { lemma_Mod32_const(i*32); } 0; }\r\n if i == 0 {\r\n reveal_SeqXor();\r\n assert BEWordSeqToBitSeq_premium(pad) == SeqXor(BEWordSeqToBitSeq_premium(key), ConstPad_premium(i*32, const));\r\n } else {\r\n var len0 := i * 32;\r\n var len1 := (i - 1) * 32;\r\n ghost var x := SeqXor_premium(BEWordToBitSeq_premium(key[0]), BEWordToBitSeq_premium(const));\r\n lemma_mul_mod_32(len0, i);\r\n calc { Mod32_const(len0); { reveal_Mod32_const(); } 0; }\r\n calc {\r\n SeqXor_premium(BEWordSeqToBitSeq_premium(key), ConstPad_premium(len0, const));\r\n { lemma_WordSeqToBitSeqChopHead(key); }\r\n SeqXor_premium(BEWordToBitSeq_premium(key[0]) + BEWordSeqToBitSeq_premium(key[1..]), ConstPad_premium(len0, const));\r\n { reveal_Mod32_const(); }\r\n SeqXor_premium(BEWordToBitSeq_premium(key[0]) + BEWordSeqToBitSeq_premium(key[1..]),\r\n BEWordToBitSeq_premium(const) + ConstPad_premium(len1, const));\r\n { assert len1 % 32 == 0; }\r\n { assert |ConstPad_premium(len1, const)| == len1; }\r\n { lemma_SeqXor_Split(BEWordToBitSeq_premium(key[0]), BEWordSeqToBitSeq_premium(key[1..]),\r\n BEWordToBitSeq_premium(const), ConstPad_premium(len1, const)); }\r\n SeqXor_premium(BEWordToBitSeq_premium(key[0]), BEWordToBitSeq_premium(const)) +\r\n SeqXor_premium(BEWordSeqToBitSeq_premium(key[1..]), ConstPad_premium(len1, const));\r\n x + SeqXor_premium(BEWordSeqToBitSeq_premium(key[1..]), ConstPad_premium(len1, const));\r\n { assert |pad[1..]| == |key[1..]| == i - 1; }\r\n { lemma_SeqXor_WordSeqToBitSeq(i - 1, pad[1..], key[1..], const); }\r\n { assert BEWordSeqToBitSeq_premium(pad[1..]) == SeqXor_premium(BEWordSeqToBitSeq_premium(key[1..]), ConstPad_premium(len1, const)); }\r\n x + BEWordSeqToBitSeq_premium(pad[1..]);\r\n SeqXor_premium(BEWordToBitSeq_premium(key[0]), BEWordToBitSeq_premium(const)) + BEWordSeqToBitSeq_premium(pad[1..]);\r\n { lemma_SeqXor_properties(BEWordToBitSeq_premium(key[0]), BEWordToBitSeq_premium(const)); }\r\n { assert forall j :: 0 <= j < |BEWordToBitSeq_premium(key[0])| ==>\r\n SeqXor_premium(BEWordToBitSeq_premium(key[0]),\r\n BEWordToBitSeq_premium(const))[j] == BEWordToBitSeq_premium(Asm_BitwiseXor(key[0], const))[j]; }\r\n BEWordToBitSeq_premium(Asm_BitwiseXor(key[0], const)) + BEWordSeqToBitSeq_premium(pad[1..]);\r\n BEWordToBitSeq_premium(pad[0]) + BEWordSeqToBitSeq_premium(pad[1..]);\r\n { lemma_WordSeqToBitSeqChopHead(pad); }\r\n BEWordSeqToBitSeq_premium(pad);\r\n }\r\n }\r\n}\r\n\r\n//-///////////////////////////////////////////////////\r\n//- HMAC\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic method xor_pad(key:array, const:int) returns (pad:array)\r\n requires key != null && key.Length == 16;\r\n requires forall i {:trigger key[i]} :: 0 <= i < key.Length ==> Word32(key[i]);\r\n requires Word32(const);\r\n ensures fresh(pad);\r\n ensures forall i {:trigger pad[i]} :: 0 <= i < pad.Length ==> Word32(pad[i]);\r\n ensures pad.Length == 16;\r\n ensures Mod32_const(512) == 0;\r\n ensures BEWordSeqToBitSeq_premium(pad[..]) == SeqXor(BEWordSeqToBitSeq_premium(key[..]), ConstPad_premium(512, const));\r\n{\r\n pad := new int[16];\r\n\r\n var i := 0;\r\n while (i < 16)\r\n invariant 0 <= i <= 16;\r\n invariant forall j {:trigger pad[j]} :: 0 <= j < i ==> Word32(pad[j]);\r\n invariant forall j {:trigger pad[j]}{:trigger key[j]} :: 0 <= j < i ==> pad[j] == Asm_BitwiseXor(key[j], const);\r\n {\r\n pad[i] := Asm_BitwiseXor(key[i], const);\r\n i := i + 1;\r\n }\r\n lemma_SeqXor_WordSeqToBitSeq(16, pad[..], key[..], const);\r\n calc { Mod32_const(512); { reveal_Mod32_const(); } 0; }\r\n}\r\n\r\nstatic lemma lemma_padded_length_32(x:int, y:int)\r\n requires x >= 0 && y >= 0;\r\n requires PaddedLength(32*x) / 32 == y;\r\n ensures y * 32 == PaddedLength(32*x);\r\n{\r\n reveal_NumPaddingZeroes();\r\n reveal_PaddedLength();\r\n\r\n calc {\r\n y * 32;\r\n (PaddedLength(32*x) / 32) * 32;\r\n ((32*x + 1 + NumPaddingZeroes(32*x) + 64) / 32) * 32;\r\n ((32*x + 1 + ((959 - (32*x) % 512) % 512) + 64) / 32) * 32;\r\n 32*x + 1 + ((959 - (32*x) % 512) % 512) + 64;\r\n PaddedLength(32*x);\r\n }\r\n}\r\n\r\nstatic method {:timeLimitMultiplier 4} consolidate_arrays(a:array, b:array) returns (c:array)\r\n requires a != null && b != null;\r\n requires forall i {:trigger a[i]} :: 0 <= i < a.Length ==> Word32(a[i]);\r\n requires forall i {:trigger b[i]} :: 0 <= i < b.Length ==> Word32(b[i]);\r\n ensures fresh(c);\r\n ensures forall i {:trigger c[i]} :: 0 <= i < c.Length ==> Word32(c[i]);\r\n ensures c.Length * 32 == PaddedLength(32*(a.Length+b.Length));\r\n ensures c.Length >= a.Length + b.Length;\r\n ensures c[..a.Length+b.Length] == a[..] + b[..];\r\n ensures a[..] == old(a[..]);\r\n ensures b[..] == old(b[..]);\r\n{\r\n calc { true; { reveal_PaddedLength(); } 0 <= a.Length + b.Length <= PaddedLength(32*(a.Length+b.Length))/ 32; }\r\n c := new int[PaddedLength(32*(a.Length+b.Length))/ 32];\r\n assert c.Length >= a.Length + b.Length;\r\n\r\n var i := 0;\r\n while (i < a.Length)\r\n invariant 0 <= i <= a.Length;\r\n invariant forall j :: 0 <= j < a.Length ==> Word32(a[j]);\r\n invariant forall j :: 0 <= j < i ==> c[j] == a[j] && Word32(c[j]);\r\n invariant a[..] == old(a[..]);\r\n invariant b[..] == old(b[..]);\r\n {\r\n c[i] := a[i];\r\n i := i+1;\r\n }\r\n\r\n var k := 0;\r\n while (k < b.Length)\r\n invariant 0 <= k <= b.Length;\r\n invariant i == k + a.Length;\r\n invariant a.Length <= i <= a.Length + b.Length;\r\n invariant forall j :: 0 <= j < a.Length ==> c[j] == a[j] && Word32(c[j]);\r\n invariant forall j :: 0 <= j < k ==> c[j+a.Length] == b[j];\r\n//- invariant forall j :: a.Length <= j < a.Length + k ==> c[j] == b[j-a.Length];\r\n invariant forall j :: a.Length <= j < a.Length + k ==> Word32(c[j]);\r\n invariant a[..] == old(a[..]);\r\n invariant b[..] == old(b[..]);\r\n {\r\n c[i] := b[k];\r\n i := i + 1;\r\n k := k + 1;\r\n }\r\n\r\n while (i < c.Length)\r\n invariant a.Length + b.Length <= i <= c.Length;\r\n invariant forall j :: 0 <= j < a.Length ==> c[j] == a[j] && Word32(c[j]);\r\n invariant forall j :: a.Length <= j < a.Length + b.Length ==> c[j] == b[j-a.Length] && Word32(c[j]);\r\n invariant forall j :: a.Length + b.Length <= j < i ==> Word32(c[j]);\r\n invariant a[..] == old(a[..]);\r\n invariant b[..] == old(b[..]);\r\n {\r\n lemma_2toX();\r\n c[i] := 0;\r\n i := i + 1;\r\n }\r\n\r\n assert forall j :: 0 <= j < a.Length ==> c[..a.Length + b.Length][j] == a[j];\r\n assert forall j :: a.Length <= j < a.Length + b.Length ==> c[..a.Length + b.Length][j] == b[j - a.Length] && Word32(c[j]);\r\n\r\n lemma_padded_length_32(a.Length+b.Length, c.Length);\r\n}\r\n\r\nstatic method HMAC_outer_input(key: array, inner_hash: array) returns (input: array)\r\n requires IsWordArray(key);\r\n requires key.Length == 16;\r\n requires IsWordArray(inner_hash);\r\n ensures fresh(input);\r\n ensures IsWordArray(input);\r\n ensures input.Length * 32 == PaddedLength(32*(16+inner_hash.Length));\r\n ensures 16+inner_hash.Length <= input.Length;\r\n ensures Mod32_const(|key[..]|*32) == 0;\r\n ensures BEWordSeqToBitSeq_premium(input[..]) == SeqXor(BEWordSeqToBitSeq_premium(key[..]), Opad_premium(|key[..]|*32)) + BEWordSeqToBitSeq_premium(inner_hash[..]) + BEWordSeqToBitSeq_premium(input[16+inner_hash.Length..]);\r\n{\r\n ghost var old_key := key[..];\r\n lemma_2toX();\r\n var opad := xor_pad(key, 0x5c5c5c5c);\r\n assert old_key == key[..];\r\n\r\n ghost var old_opad := opad[..];\r\n\r\n input := consolidate_arrays(opad, inner_hash);\r\n assert key[..] == old_key;\r\n assert opad[..] == old_opad;\r\n\r\n ghost var sum := opad.Length + inner_hash.Length;\r\n calc {\r\n BEWordSeqToBitSeq_premium(input[..]);\r\n { lemma_WordSeqToBitSeqChop(input[..], input[..sum], input[sum..]); }\r\n BEWordSeqToBitSeq_premium(input[..sum]) + BEWordSeqToBitSeq_premium(input[sum..]);\r\n BEWordSeqToBitSeq_premium(opad[..] + inner_hash[..]) + BEWordSeqToBitSeq_premium(input[sum..]);\r\n { lemma_WordSeqToBitSeqChop(opad[..] + inner_hash[..], opad[..], inner_hash[..]); }\r\n BEWordSeqToBitSeq_premium(opad[..]) + BEWordSeqToBitSeq_premium(inner_hash[..]) + BEWordSeqToBitSeq_premium(input[sum..]);\r\n { reveal_Mod32_const(); }\r\n SeqXor(BEWordSeqToBitSeq_premium(key[..]), Opad(|key[..]|*32)) + BEWordSeqToBitSeq_premium(inner_hash[..]) + BEWordSeqToBitSeq_premium(input[sum..]);\r\n }\r\n}\r\n\r\nstatic lemma lemma_HMAC_inner_input1(key: array, data: array, input:array, ipad:array)\r\n requires key != null;\r\n requires data != null;\r\n requires input != null;\r\n requires ipad != null;\r\n requires forall i {:trigger key[i]} :: 0 <= i < key.Length ==> Word32(key[i]);\r\n requires forall i {:trigger data[i]} :: 0 <= i < data.Length ==> Word32(data[i]);\r\n requires forall i {:trigger input[i]} :: 0 <= i < input.Length ==> Word32(input[i]);\r\n requires forall i {:trigger ipad[i]} :: 0 <= i < ipad.Length ==> Word32(ipad[i]);\r\n requires ipad.Length + data.Length <= input.Length;\r\n requires input[..(ipad.Length + data.Length)] == ipad[..] + data[..];\r\n requires Mod32_const(|key[..]|*32) == 0;\r\n requires |BEWordSeqToBitSeq_premium(key[..])| == |Ipad_premium(|key[..]|*32)|;\r\n requires BEWordSeqToBitSeq_premium(ipad[..]) == SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(|key[..]|*32));\r\n ensures BEWordSeqToBitSeq_premium(input[..]) == SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(|key[..]|*32)) + BEWordSeqToBitSeq_premium(data[..]) + BEWordSeqToBitSeq_premium(input[(ipad.Length + data.Length)..]);\r\n{\r\n ghost var sum := ipad.Length + data.Length;\r\n calc {\r\n BEWordSeqToBitSeq_premium(input[..]);\r\n { lemma_WordSeqToBitSeqChop(input[..], input[..sum], input[sum..]); }\r\n BEWordSeqToBitSeq_premium(input[..sum]) + BEWordSeqToBitSeq_premium(input[sum..]);\r\n BEWordSeqToBitSeq_premium(ipad[..] + data[..]) + BEWordSeqToBitSeq_premium(input[sum..]);\r\n { lemma_WordSeqToBitSeqChop(ipad[..] + data[..], ipad[..], data[..]); }\r\n BEWordSeqToBitSeq_premium(ipad[..]) + BEWordSeqToBitSeq_premium(data[..]) + BEWordSeqToBitSeq_premium(input[sum..]);\r\n { reveal_Mod32_const(); }\r\n SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(|key[..]|*32)) +\r\n BEWordSeqToBitSeq_premium(data[..]) + BEWordSeqToBitSeq_premium(input[sum..]);\r\n }\r\n}\r\n\r\nstatic lemma lemma_HMAC_inner_input2(len:int, dataLength32:int, inputLength32:int)\r\n requires inputLength32 == PaddedLength(512 + dataLength32);\r\n requires 0 <= len <= dataLength32;\r\n ensures len + 512 <= PaddedLength(len + 512) <= inputLength32;\r\n{\r\n reveal_PaddedLength();\r\n reveal_NumPaddingZeroes();\r\n lemma_PaddedLengthMonotonic(len+512, 512+dataLength32);\r\n}\r\n\r\nstatic method HMAC_inner_input(key: array, data: array, len: int) returns (input: array)\r\n requires Word32(len);\r\n requires key != null && key.Length == 16;\r\n requires forall i {:trigger key[i]} :: 0 <= i < key.Length ==> Word32(key[i]);\r\n requires data != null;\r\n requires 0 <= len <= data.Length * 32;\r\n requires forall i {:trigger data[i]} :: 0 <= i < data.Length ==> Word32(data[i]);\r\n ensures fresh(input);\r\n ensures forall i {:trigger input[i]} :: 0 <= i < input.Length ==> Word32(input[i]);\r\n ensures len + 512 <= PaddedLength(len + 512) <= input.Length * 32;\r\n ensures input.Length >= 16 + data.Length;\r\n ensures Mod32_const(|key[..]|*32) == 0;\r\n ensures BEWordSeqToBitSeq_premium(input[..]) == SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(|key[..]|*32)) + BEWordSeqToBitSeq_premium(data[..]) + BEWordSeqToBitSeq_premium(input[16+data.Length..]);\r\n{\r\n ghost var old_key := key[..];\r\n lemma_2toX();\r\n var ipad := xor_pad(key, 0x36363636);\r\n assert old_key == key[..];\r\n\r\n ghost var old_ipad := ipad[..];\r\n\r\n input := consolidate_arrays(ipad, data);\r\n assert key[..] == old_key;\r\n assert ipad[..] == old_ipad;\r\n\r\n reveal_Mod32_const();\r\n lemma_HMAC_inner_input1(key, data, input, ipad);\r\n lemma_HMAC_inner_input2(len, data.Length * 32, input.Length * 32);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/hmac_common.s.dfy", "content": "include \"../../Util/be_sequences.s.dfy\"\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- HMAC specification based on:\r\n//- http://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function Xor(a:int, b:int) : int\r\n{ if a!=b then 1 else 0 }\r\n\r\nstatic function{:opaque} SeqXor(a: seq, b: seq) : seq\r\n requires IsBitSeq(a);\r\n requires IsBitSeq(b);\r\n requires |a|==|b|;\r\n{\r\n if |a| == 0 then\r\n []\r\n else\r\n [ Xor(a[0], b[0]) ] + SeqXor(a[1..], b[1..])\r\n}\r\n\r\nstatic function {:autoReq} {:opaque} ConstPad(len:int, const:int) : seq\r\n//- requires len % 32 == 0;\r\n\r\n\r\n\r\n{\r\n if len <= 0 then\r\n []\r\n else\r\n BEWordToBitSeq(const) + ConstPad(len - 32, const)\r\n}\r\n\r\nstatic function {:autoReq} Opad(len:int) : seq\r\n\r\n\r\n\r\n{\r\n ConstPad(len, 0x5c5c5c5c)\r\n}\r\n\r\nstatic function {:autoReq} Ipad(len:int) : seq\r\n\r\n\r\n\r\n{\r\n ConstPad(len, 0x36363636)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/sha1.i.dfy", "content": "include \"sha1.s.dfy\"\r\ninclude \"../../Util/seq_blocking.i.dfy\"\r\ninclude \"../../Util/arrays_and_seqs.i.dfy\"\r\ninclude \"../../Util/integer_sequences_premium.i.dfy\"\r\ninclude \"sha_padding.i.dfy\"\r\ninclude \"sha_common.i.dfy\"\r\n\r\nstatic function method{:CompiledSpec} CompiledSpec_K_SHA1(n: int) : int\r\nstatic function method{:CompiledSpec} CompiledSpec_InitialH_SHA1(index: int) : int\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Utility functions for AtoE\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic predicate Word32AtoE(v:atoe_Type)\r\n{\r\n Word32(v.a) && Word32(v.b) && Word32(v.c) && Word32(v.d) && Word32(v.e)\r\n}\r\n\r\nstatic predicate IsAtoEWordSeq(vs:seq)\r\n{\r\n forall i :: 0 <= i < |vs| ==> Word32AtoE(vs[i])\r\n}\r\n\r\nstatic function ConvertAtoEToSeq_premium(v:atoe_Type) : seq\r\n requires Word32AtoE(v);\r\n ensures IsWordSeqOfLen(ConvertAtoEToSeq_premium(v), 5);\r\n ensures ConvertAtoEToSeq_premium(v) == ConvertAtoEToSeq(v);\r\n{\r\n ConvertAtoEToSeq(v)\r\n}\r\n\r\nstatic predicate{:opaque} TheAtoEsAreOK(z:SHA1Trace, blk: int, t: int)\r\n requires 0 <= t <= 79;\r\n requires 0 <= blk;\r\n requires |z.atoe| > blk;\r\n requires |z.atoe[blk]| > t+1;\r\n requires Word32AtoE(z.atoe[blk][t]);\r\n requires |z.W| > blk;\r\n requires IsWordSeqOfLen(z.W[blk], 80);\r\n{\r\n var T := Add32(Add32(Add32(Add32(Asm_RotateLeft(z.atoe[blk][t].a, 5),\r\n ft(t, z.atoe[blk][t].b, z.atoe[blk][t].c, z.atoe[blk][t].d)),\r\n z.atoe[blk][t].e),\r\n K_SHA1(t)),\r\n z.W[blk][t]);\r\n z.atoe[blk][t+1].e == z.atoe[blk][t].d &&\r\n z.atoe[blk][t+1].d == z.atoe[blk][t].c &&\r\n z.atoe[blk][t+1].c == Asm_RotateLeft(z.atoe[blk][t].b, 30) &&\r\n z.atoe[blk][t+1].b == z.atoe[blk][t].a &&\r\n z.atoe[blk][t+1].a == T\r\n}\r\n\r\nstatic lemma Lemma_TheAtoEsAreOKIsStable(z1:SHA1Trace, z2:SHA1Trace, blk: int, t: int)\r\n requires 0 <= t <= 79;\r\n requires 0 <= blk;\r\n requires |z1.atoe| == |z2.atoe| > blk;\r\n requires |z1.atoe[blk]| > t+1;\r\n requires |z2.atoe[blk]| > t+1;\r\n requires Word32AtoE(z1.atoe[blk][t]);\r\n requires z1.atoe[blk][t+1] == z2.atoe[blk][t+1];\r\n requires z1.atoe[blk][t] == z2.atoe[blk][t];\r\n requires |z1.W| > blk;\r\n requires z1.W == z2.W;\r\n requires IsWordSeqOfLen(z1.W[blk], 80);\r\n requires TheAtoEsAreOK(z1, blk, t);\r\n ensures TheAtoEsAreOK(z2, blk, t);\r\n{\r\n reveal_TheAtoEsAreOK();\r\n}\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Initialization of data structures\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic method InitH_SHA1(H:array)\r\n requires H != null && H.Length == 5;\r\n ensures forall i :: 0 <= i < H.Length ==> H[i] == InitialH_SHA1(i);\r\n modifies H;\r\n{\r\n reveal_InitialH_SHA1();\r\n H[0] := 0x67452301;\r\n H[1] := 0xefcdab89;\r\n H[2] := 0x98badcfe;\r\n H[3] := 0x10325476;\r\n H[4] := 0xc3d2e1f0;\r\n}\r\n\r\nstatic method InitK_SHA1(Ks: array)\r\n requires Ks != null && Ks.Length == 80;\r\n ensures forall i :: 0 <= i < Ks.Length ==> Ks[i] == K_SHA1(i);\r\n modifies Ks;\r\n{\r\n reveal_InitialH_SHA1();\r\n reveal_K_SHA1();\r\n var i := 0;\r\n while i < 80\r\n invariant 0 <= i <= 80;\r\n invariant forall j :: 0 <= j < i ==> Ks[j] == K_SHA1(j);\r\n {\r\n if 0 <= i <= 19 {\r\n Ks[i] := 0x5a827999;\r\n }\r\n else if 20 <= i <= 39 {\r\n Ks[i] := 0x6ed9eba1;\r\n }\r\n else if 40 <= i <= 59 {\r\n Ks[i] := 0x8f1bbcdc;\r\n }\r\n else {\r\n Ks[i] := 0xca62c1d6;\r\n }\r\n i := i + 1;\r\n }\r\n}\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Partial SHA1 traces\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic predicate PartialSHA1TraceHasCorrectHs(z:SHA1Trace)\r\n{\r\n |z.H| > 0 &&\r\n |z.H| <= |z.atoe|+1 &&\r\n (forall blk :: 0 <= blk < |z.H| ==> IsWordSeqOfLen(z.H[blk], 5)) &&\r\n (forall j :: 0 <= j < 5 ==> z.H[0][j] == InitialH_SHA1(j)) &&\r\n (forall blk {:trigger TBlk(blk)} :: TBlk(blk) && 0 <= blk < |z.H|-1 ==>\r\n IsAtoEWordSeqOfLen(z.atoe[blk], 81) &&\r\n forall j :: 0 <= j < 5 ==> z.H[blk+1][j] == Add32(ConvertAtoEToSeq(z.atoe[blk][80])[j], z.H[blk][j]))\r\n}\r\n\r\nstatic predicate PartialSHA1TraceHasCorrectWs(z:SHA1Trace)\r\n{\r\n |z.W| <= |z.M| &&\r\n forall blk :: 0 <= blk < |z.W| ==>\r\n IsWordSeqOfLen(z.W[blk], 80) &&\r\n IsWordSeqOfLen(z.M[blk], 16) &&\r\n forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < 80 ==>\r\n (0 <= t <= 15 ==> z.W[blk][t] == z.M[blk][t]) &&\r\n (16 <= t <= 79 ==> z.W[blk][t] ==\r\n Asm_RotateLeft(Asm_BitwiseXor(Asm_BitwiseXor(Asm_BitwiseXor(z.W[blk][t-3], z.W[blk][t-8]), z.W[blk][t-14]), z.W[blk][t-16]),\r\n 1))\r\n}\r\n\r\nstatic predicate PartialSHA1TraceHasCorrectatoesWf(z:SHA1Trace)\r\n{\r\n |z.atoe| <= |z.H| &&\r\n |z.atoe| <= |z.W| &&\r\n (forall blk :: 0 <= blk < |z.atoe|-1 ==> IsAtoEWordSeqOfLen(z.atoe[blk], 81)) &&\r\n forall blk :: 0 <= blk < |z.atoe| ==>\r\n |z.atoe[blk]| <= 81 &&\r\n IsWordSeqOfLen(z.W[blk], 80) &&\r\n IsAtoEWordSeq(z.atoe[blk]) &&\r\n (|z.atoe[blk]| > 0 ==> IsWordSeqOfLen(z.H[blk], 5) && ConvertAtoEToSeq(z.atoe[blk][0]) == z.H[blk])\r\n}\r\n\r\nstatic predicate{:opaque} PartialSHA1TraceHasCorrectatoesOpaque(z:SHA1Trace)\r\n{\r\n |z.atoe| <= |z.H| &&\r\n |z.atoe| <= |z.W| &&\r\n (forall blk :: 0 <= blk < |z.atoe|-1 ==> IsAtoEWordSeqOfLen(z.atoe[blk], 81)) &&\r\n forall blk :: 0 <= blk < |z.atoe| ==>\r\n |z.atoe[blk]| <= 81 &&\r\n IsWordSeqOfLen(z.W[blk], 80) &&\r\n IsAtoEWordSeq(z.atoe[blk]) &&\r\n (|z.atoe[blk]| > 0 ==> IsWordSeqOfLen(z.H[blk], 5) && ConvertAtoEToSeq(z.atoe[blk][0]) == z.H[blk]) &&\r\n forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < |z.atoe[blk]|-1 ==>\r\n var T := Add32(Add32(Add32(Add32(Asm_RotateLeft(z.atoe[blk][t].a, 5),\r\n ft(t, z.atoe[blk][t].b, z.atoe[blk][t].c, z.atoe[blk][t].d)),\r\n z.atoe[blk][t].e),\r\n K_SHA1(t)),\r\n z.W[blk][t]);\r\n z.atoe[blk][t+1].e == z.atoe[blk][t].d &&\r\n z.atoe[blk][t+1].d == z.atoe[blk][t].c &&\r\n z.atoe[blk][t+1].c == Asm_RotateLeft(z.atoe[blk][t].b, 30) &&\r\n z.atoe[blk][t+1].b == z.atoe[blk][t].a &&\r\n z.atoe[blk][t+1].a == T\r\n}\r\n\r\nstatic predicate PartialSHA1TraceHasCorrectatoes(z:SHA1Trace)\r\n{\r\n PartialSHA1TraceHasCorrectatoesWf(z) && PartialSHA1TraceHasCorrectatoesOpaque(z)\r\n}\r\n\r\nstatic predicate PartialSHA1TraceIsCorrect(z:SHA1Trace)\r\n{\r\n PartialSHA1TraceHasCorrectWs(z) && PartialSHA1TraceHasCorrectHs(z) && PartialSHA1TraceHasCorrectatoes(z)\r\n}\r\n\r\nstatic lemma PartialSHA1TraceIsCorrectImpliesTraceIsCorrect(z:SHA1Trace)\r\n requires IsCompleteSHA1Trace(z);\r\n requires PartialSHA1TraceIsCorrect(z);\r\n ensures SHA1TraceIsCorrect(z);\r\n{\r\n reveal_PartialSHA1TraceHasCorrectatoesOpaque();\r\n}\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Intermediate SHA1 state\r\n//-///////////////////////////////////////////////////\r\n\r\ndatatype SHA1_state = SHA1_state_c(M:seq, H:seq, W:seq, Ks:seq, atoe:atoe_Type, num_blocks:int);\r\n\r\nstatic function SHA1_vars_to_state(M:array, words:int, H:array, W:array, Ks:array, atoe:atoe_Type, num_blocks:int)\r\n : SHA1_state\r\n requires M != null && H != null && W != null && Ks != null;\r\n requires 0 <= words <= M.Length;\r\n reads M, H, W, Ks;\r\n{\r\n SHA1_state_c(M[..words], H[..], W[..], Ks[..], atoe, num_blocks)\r\n}\r\n\r\nstatic predicate AreSHA1TraceAndStateOK(z:SHA1Trace, s:SHA1_state)\r\n{\r\n PartialSHA1TraceIsCorrect(z) &&\r\n IsWordSeq(s.M) &&\r\n z.M == BreakIntoBlocks(s.M, 16) &&\r\n (forall i :: 0 <= i < |z.M| ==> IsWordSeqOfLen(z.M[i], 16)) &&\r\n Mul16(|z.M|) == |s.M| &&\r\n |z.M| == s.num_blocks &&\r\n |s.Ks| == 80 &&\r\n (forall t :: 0 <= t <= 79 ==> s.Ks[t] == K_SHA1(t))\r\n}\r\n\r\nstatic predicate IsSHA1ReadyForBlock(z:SHA1Trace, s:SHA1_state, nextBlock:int)\r\n requires 0 <= nextBlock;\r\n{\r\n AreSHA1TraceAndStateOK(z, s) &&\r\n |z.H| == nextBlock + 1 &&\r\n |z.W| == nextBlock &&\r\n |z.atoe| == nextBlock &&\r\n (forall blk :: 0 <= blk < nextBlock ==> IsAtoEWordSeqOfLen(z.atoe[blk], 81)) &&\r\n s.H == z.H[nextBlock]\r\n}\r\n\r\nstatic predicate IsSHA1DoneComputingWs(z:SHA1Trace, s:SHA1_state, currentBlock:int)\r\n requires 0 <= currentBlock;\r\n{\r\n AreSHA1TraceAndStateOK(z, s) &&\r\n |z.H| == currentBlock + 1 &&\r\n |z.W| == currentBlock + 1 &&\r\n |z.atoe| == currentBlock &&\r\n (forall blk :: 0 <= blk < currentBlock ==> IsAtoEWordSeqOfLen(z.atoe[blk], 81)) &&\r\n s.H == z.H[currentBlock] &&\r\n s.W == z.W[currentBlock]\r\n}\r\n\r\nstatic predicate IsSHA1ReadyForStep(z:SHA1Trace, s:SHA1_state, currentBlock:int, nextStep:int)\r\n requires 0 <= currentBlock;\r\n requires 0 <= nextStep <= 80;\r\n{\r\n AreSHA1TraceAndStateOK(z, s) &&\r\n |z.H| == currentBlock + 1 &&\r\n |z.W| == currentBlock + 1 &&\r\n |z.atoe| == currentBlock + 1 &&\r\n (forall blk :: 0 <= blk < currentBlock ==> IsAtoEWordSeqOfLen(z.atoe[blk], 81)) &&\r\n IsAtoEWordSeqOfLen(z.atoe[currentBlock], nextStep+1) &&\r\n s.H == z.H[currentBlock] &&\r\n s.W == z.W[currentBlock] &&\r\n s.atoe == z.atoe[currentBlock][nextStep]\r\n}\r\n\r\n/////////////////////////////////////////////////////\r\n\r\n/////////////////////////////////////////////////////\r\n\r\nstatic lemma {:timeLimitMultiplier 3} lemma_SHA1TransitionOKAfterSettingHsStep1(z1:SHA1Trace, s1:SHA1_state, z2:SHA1Trace, s2:SHA1_state,\r\n currentBlock:int)\r\n requires 0 <= currentBlock;\r\n requires IsSHA1ReadyForStep(z1, s1, currentBlock, 80);\r\n requires s2.M == s1.M;\r\n requires IsWordSeqOfLen(s2.H, 5);\r\n requires forall j :: 0 <= j < 5 ==> s2.H[j] == Add32(ConvertAtoEToSeq_premium(s1.atoe)[j], s1.H[j]);\r\n requires s2.Ks == s1.Ks;\r\n requires s2.num_blocks == s1.num_blocks;\r\n requires z2 == SHA1Trace_c(z1.M, z1.H + [s2.H], z1.W, z1.atoe);\r\n ensures forall blk :: 0 <= blk < |z2.H| ==> IsWordSeqOfLen(z2.H[blk], 5);\r\n ensures forall blk {:trigger TBlk(blk)} :: TBlk(blk) && 0 <= blk < currentBlock + 1 ==>\r\n IsAtoEWordSeqOfLen(z2.atoe[blk], 81) &&\r\n forall j :: 0 <= j < 5 ==> z2.H[blk+1][j] == Add32(ConvertAtoEToSeq_premium(z2.atoe[blk][80])[j], z2.H[blk][j]);\r\n{\r\n assert |z2.H| == currentBlock + 2;\r\n\r\n forall blk | 0 <= blk < |z2.H|\r\n ensures IsWordSeqOfLen(z2.H[blk], 5);\r\n {\r\n if (blk == |z2.H|-1) {\r\n assert z2.H[blk] == s2.H;\r\n }\r\n else {\r\n assert z2.H[blk] == z1.H[blk];\r\n }\r\n }\r\n\r\n assert forall blk {:trigger TBlk(blk)} :: TBlk(blk) && 0 <= blk < currentBlock + 1 ==> IsWordSeqOfLen(z2.H[blk+1], 5);\r\n\r\n forall blk {:trigger TBlk(blk)} | TBlk(blk) && 0 <= blk < currentBlock + 1\r\n ensures IsAtoEWordSeqOfLen(z2.atoe[blk], 81);\r\n ensures forall j :: 0 <= j < 5 ==> z2.H[blk+1][j] == Add32(ConvertAtoEToSeq_premium(z2.atoe[blk][80])[j], z2.H[blk][j]);\r\n {\r\n assert z2.atoe[blk] == z1.atoe[blk];\r\n if blk == currentBlock {\r\n assert IsSHA1ReadyForStep(z1, s1, currentBlock, 80);\r\n assert IsAtoEWordSeqOfLen(z1.atoe[currentBlock], 80+1);\r\n assert IsAtoEWordSeqOfLen(z1.atoe[blk], 81);\r\n calc {\r\n true\r\n ==> forall j :: 0 <= j < 5 ==> s2.H[j] == Add32(ConvertAtoEToSeq_premium(s1.atoe)[j], s1.H[j]);\r\n ==> { assert z2.H[blk+1] == s2.H; }\r\n forall j :: 0 <= j < 5 ==> z2.H[blk+1][j] == Add32(ConvertAtoEToSeq_premium(s1.atoe)[j], s1.H[j]);\r\n ==> { assert z2.atoe[blk][80] == s1.atoe; }\r\n forall j :: 0 <= j < 5 ==> z2.H[blk+1][j] == Add32(ConvertAtoEToSeq_premium(z2.atoe[blk][80])[j], s1.H[j]);\r\n ==> { assert z2.H[blk] == s1.H; }\r\n forall j :: 0 <= j < 5 ==> z2.H[blk+1][j] == Add32(ConvertAtoEToSeq_premium(z2.atoe[blk][80])[j], z2.H[blk][j]);\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic lemma {:timeLimitMultiplier 3} lemma_SHA1TransitionOKAfterSettingHs(z1:SHA1Trace, s1:SHA1_state, z2:SHA1Trace, s2:SHA1_state,\r\n currentBlock:int)\r\n requires 0 <= currentBlock;\r\n requires IsSHA1ReadyForStep(z1, s1, currentBlock, 80);\r\n requires s2.M == s1.M;\r\n requires IsWordSeqOfLen(s2.H, 5);\r\n requires forall j :: 0 <= j < 5 ==> s2.H[j] == Add32(ConvertAtoEToSeq_premium(s1.atoe)[j], s1.H[j]);\r\n requires s2.Ks == s1.Ks;\r\n requires s2.num_blocks == s1.num_blocks;\r\n requires z2 == SHA1Trace_c(z1.M, z1.H + [s2.H], z1.W, z1.atoe);\r\n ensures IsSHA1ReadyForBlock(z2, s2, currentBlock+1);\r\n{\r\n lemma_SHA1TransitionOKAfterSettingHsStep1(z1, s1, z2, s2, currentBlock);\r\n reveal_PartialSHA1TraceHasCorrectatoesOpaque();\r\n}\r\n\r\nstatic lemma lemma_EarlierWsAreWords(W:seq)\r\n requires IsWordSeqOfLen(W, 80);\r\n ensures forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < |W| ==>\r\n (16 <= t <= 79 ==> Word32(W[t-3]) && Word32(W[t-8]) && Word32(W[t-14]) && Word32(W[t-16]));\r\n{\r\n}\r\n\r\nstatic lemma lemma_SHA1TransitionOKAfterSettingWs(z1:SHA1Trace, s1:SHA1_state, z2:SHA1Trace, s2:SHA1_state, currentBlock:int)\r\n requires 0 <= currentBlock < |z1.M|;\r\n requires IsSHA1ReadyForBlock(z1, s1, currentBlock);\r\n requires IsWordSeqOfLen(s2.W, 80);\r\n requires forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t <= 15 ==> s2.W[t] == z1.M[currentBlock][t];\r\n requires forall t {:trigger TStep(t)} :: TStep(t) && 16 <= t <= 79 ==> s2.W[t] == Asm_RotateLeft(Asm_BitwiseXor(Asm_BitwiseXor(Asm_BitwiseXor(s2.W[t-3], s2.W[t-8]),\r\n s2.W[t-14]),\r\n s2.W[t-16]),\r\n 1);\r\n requires z2 == SHA1Trace_c(z1.M, z1.H, z1.W + [s2.W], z1.atoe);\r\n requires s2.M == s1.M;\r\n requires s2.H == s1.H;\r\n requires s2.Ks == s1.Ks;\r\n requires s2.num_blocks == s1.num_blocks;\r\n ensures IsSHA1DoneComputingWs(z2, s2, currentBlock);\r\n{\r\n assert z2.M == z1.M;\r\n assert z2.H == z1.H;\r\n assert |z2.W| == |z1.W| + 1;\r\n assert forall blk :: 0 <= blk < |z1.W| ==> z2.W[blk] == z1.W[blk];\r\n assert z2.W[|z1.W|] == s2.W;\r\n assert z2.atoe == z1.atoe;\r\n\r\n forall blk | 0 <= blk < |z2.W|\r\n ensures IsWordSeqOfLen(z2.W[blk], 80);\r\n ensures forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < |z2.W[blk]| ==>\r\n (16 <= t <= 79 ==> Word32(z2.W[blk][t-3]) && Word32(z2.W[blk][t-8]) && Word32(z2.W[blk][t-14]) && Word32(z2.W[blk][t-16]));\r\n ensures forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < |z2.W[blk]| ==>\r\n (0 <= t <= 15 ==> z2.W[blk][t] == z2.M[blk][t]) &&\r\n (16 <= t <= 79 ==> z2.W[blk][t] == Asm_RotateLeft(Asm_BitwiseXor(Asm_BitwiseXor(Asm_BitwiseXor(z2.W[blk][t-3],\r\n z2.W[blk][t-8]),\r\n z2.W[blk][t-14]),\r\n z2.W[blk][t-16]),\r\n 1));\r\n {\r\n if blk < |z2.W|-1 {\r\n assert IsWordSeqOfLen(z2.W[blk], 80);\r\n lemma_EarlierWsAreWords(z2.W[blk]);\r\n assert forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < |z2.W[blk]| ==>\r\n (0 <= t <= 15 ==> z2.W[blk][t] == z2.M[blk][t]) &&\r\n (16 <= t <= 79 ==> z2.W[blk][t] == Asm_RotateLeft(Asm_BitwiseXor(Asm_BitwiseXor(Asm_BitwiseXor(z2.W[blk][t-3],\r\n z2.W[blk][t-8]),\r\n z2.W[blk][t-14]),\r\n z2.W[blk][t-16]),\r\n 1));\r\n }\r\n else {\r\n assert blk == |z2.W|-1;\r\n assert z2.W[blk] == s2.W;\r\n lemma_EarlierWsAreWords(z2.W[blk]);\r\n assert forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < |z2.W[blk]| ==>\r\n (0 <= t <= 15 ==> z2.W[blk][t] == z2.M[blk][t]) &&\r\n (16 <= t <= 79 ==> z2.W[blk][t] == Asm_RotateLeft(Asm_BitwiseXor(Asm_BitwiseXor(Asm_BitwiseXor(z2.W[blk][t-3],\r\n z2.W[blk][t-8]),\r\n z2.W[blk][t-14]),\r\n z2.W[blk][t-16]),\r\n 1));\r\n }\r\n }\r\n reveal_PartialSHA1TraceHasCorrectatoesOpaque();\r\n}\r\n\r\nstatic lemma lemma_SHA1TransitionOKAfterSettingAtoEStep1Helper1(z:SHA1Trace, blk:int, t:int)\r\n requires 0 <= t <= 79;\r\n requires 0 <= blk;\r\n requires |z.atoe| > blk;\r\n requires |z.atoe[blk]| > t+1;\r\n requires Word32AtoE(z.atoe[blk][t]);\r\n requires |z.W| > blk;\r\n requires IsWordSeqOfLen(z.W[blk], 80);\r\n requires PartialSHA1TraceHasCorrectatoes(z);\r\n ensures TheAtoEsAreOK(z, blk, t);\r\n{\r\n assert TBlk(blk) && TStep(t);\r\n reveal_TheAtoEsAreOK();\r\n reveal_PartialSHA1TraceHasCorrectatoesOpaque();\r\n}\r\n\r\nstatic lemma lemma_SHA1TransitionOKAfterSettingAtoEStep1(z1:SHA1Trace, s1:SHA1_state, z2:SHA1Trace, s2:SHA1_state,\r\n currentBlock:int, currentStep:int)\r\n requires TBlk(currentBlock) && TBlk(currentBlock + 1) && TStep(currentStep) && TStep(currentStep + 1);\r\n requires 0 <= currentBlock < |z1.M|;\r\n requires 0 <= currentStep <= 79;\r\n requires IsSHA1ReadyForStep(z1, s1, currentBlock, currentStep);\r\n requires var T := Add32(Add32(Add32(Add32(Asm_RotateLeft(s1.atoe.a, 5),\r\n ft(currentStep, s1.atoe.b, s1.atoe.c, s1.atoe.d)),\r\n s1.atoe.e),\r\n s1.Ks[currentStep]),\r\n s1.W[currentStep]);\r\n s2.atoe.e == s1.atoe.d &&\r\n s2.atoe.d == s1.atoe.c &&\r\n s2.atoe.c == Asm_RotateLeft(s1.atoe.b, 30) &&\r\n s2.atoe.b == s1.atoe.a &&\r\n s2.atoe.a == T;\r\n requires s2.M == s1.M;\r\n requires s2.H == s1.H;\r\n requires s2.W == s1.W;\r\n requires s2.Ks == s1.Ks;\r\n requires s2.num_blocks == s1.num_blocks;\r\n requires z2.M == z1.M && z2.H == z1.H && z2.W == z1.W;\r\n requires z2.atoe == z1.atoe[..currentBlock] + [z1.atoe[currentBlock] + [s2.atoe]];\r\n requires |z2.atoe| == |z1.atoe|;\r\n requires forall blk :: 0 <= blk < currentBlock ==> z2.atoe[blk] == z1.atoe[blk];\r\n requires forall t :: 0 <= t < |z1.atoe[currentBlock]| ==> z2.atoe[currentBlock][t] == z1.atoe[currentBlock][t];\r\n requires z2.atoe[currentBlock][|z1.atoe[currentBlock]|] == s2.atoe;\r\n ensures forall blk :: 0 <= blk < |z2.atoe| ==>\r\n |z2.atoe[blk]| <= |z2.W[blk]| + 1 &&\r\n |z2.atoe[blk]| <= 81 &&\r\n IsWordSeq(z2.W[blk]) &&\r\n IsAtoEWordSeq(z2.atoe[blk]) &&\r\n (|z2.atoe[blk]| > 0 ==> IsWordSeqOfLen(z2.H[blk], 5) && ConvertAtoEToSeq(z2.atoe[blk][0]) == z2.H[blk]) &&\r\n (forall t :: 0 <= t < |z2.atoe[blk]|-1 ==> TheAtoEsAreOK(z2, blk, t));\r\n{\r\n forall blk {:trigger TBlk(blk)} | TBlk(blk) && 0 <= blk < |z2.atoe|\r\n ensures |z2.atoe[blk]| <= |z2.W[blk]| + 1;\r\n ensures |z2.atoe[blk]| <= 81;\r\n ensures IsWordSeq(z2.W[blk]);\r\n ensures IsAtoEWordSeq(z2.atoe[blk]);\r\n ensures (|z2.atoe[blk]| > 0 ==> IsWordSeqOfLen(z2.H[blk], 5) && ConvertAtoEToSeq(z2.atoe[blk][0]) == z2.H[blk]);\r\n ensures forall t :: 0 <= t < |z2.atoe[blk]|-1 ==> TheAtoEsAreOK(z2, blk, t);\r\n {\r\n assert |z2.atoe[blk]| <= |z2.W[blk]| + 1;\r\n assert |z2.atoe[blk]| <= 81;\r\n assert IsWordSeq(z2.W[blk]);\r\n assert IsAtoEWordSeq(z2.atoe[blk]);\r\n\r\n if blk < |z2.atoe|-1 {\r\n assert blk < currentBlock;\r\n assert z2.atoe[blk] == z1.atoe[blk];\r\n assert (|z2.atoe[blk]| > 0 ==> IsWordSeqOfLen(z2.H[blk], 5) && ConvertAtoEToSeq(z2.atoe[blk][0]) == z2.H[blk]);\r\n forall t | 0 <= t < |z1.atoe[blk]|-1\r\n ensures TheAtoEsAreOK(z2, blk, t);\r\n {\r\n lemma_SHA1TransitionOKAfterSettingAtoEStep1Helper1(z1, blk, t);\r\n Lemma_TheAtoEsAreOKIsStable(z1, z2, blk, t);\r\n }\r\n assert forall t :: 0 <= t < |z2.atoe[blk]|-1 ==> TheAtoEsAreOK(z2, blk, t);\r\n }\r\n else {\r\n assert blk == currentBlock;\r\n assert (|z2.atoe[blk]| > 0 ==> IsWordSeqOfLen(z2.H[blk], 5) && ConvertAtoEToSeq(z2.atoe[blk][0]) == z2.H[blk]);\r\n forall t | 0 <= t < |z2.atoe[blk]|-1\r\n ensures TheAtoEsAreOK(z2, blk, t);\r\n {\r\n if t < |z2.atoe[blk]|-2 {\r\n assert t < currentStep;\r\n lemma_SHA1TransitionOKAfterSettingAtoEStep1Helper1(z1, blk, t);\r\n Lemma_TheAtoEsAreOKIsStable(z1, z2, blk, t);\r\n }\r\n else {\r\n assert t == currentStep;\r\n calc { true; { reveal_TheAtoEsAreOK(); } TheAtoEsAreOK(z2, blk, t); }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_SHA1TransitionOKAfterSettingAtoE(z1:SHA1Trace, s1:SHA1_state, z2:SHA1Trace, s2:SHA1_state,\r\n currentBlock:int, currentStep:int)\r\n requires TBlk(currentBlock) && TBlk(currentBlock + 1) && TStep(currentStep) && TStep(currentStep + 1);\r\n requires 0 <= currentBlock < |z1.M|;\r\n requires 0 <= currentStep <= 79;\r\n requires IsSHA1ReadyForStep(z1, s1, currentBlock, currentStep);\r\n requires var T := Add32(Add32(Add32(Add32(Asm_RotateLeft(s1.atoe.a, 5),\r\n ft(currentStep, s1.atoe.b, s1.atoe.c, s1.atoe.d)),\r\n s1.atoe.e),\r\n s1.Ks[currentStep]),\r\n s1.W[currentStep]);\r\n s2.atoe.e == s1.atoe.d &&\r\n s2.atoe.d == s1.atoe.c &&\r\n s2.atoe.c == Asm_RotateLeft(s1.atoe.b, 30) &&\r\n s2.atoe.b == s1.atoe.a &&\r\n s2.atoe.a == T;\r\n requires s2.M == s1.M;\r\n requires s2.H == s1.H;\r\n requires s2.W == s1.W;\r\n requires s2.Ks == s1.Ks;\r\n requires s2.num_blocks == s1.num_blocks;\r\n requires z2 == SHA1Trace_c(z1.M, z1.H, z1.W, z1.atoe[..currentBlock] + [z1.atoe[currentBlock] + [s2.atoe]]);\r\n ensures IsSHA1ReadyForStep(z2, s2, currentBlock, currentStep+1);\r\n{\r\n lemma_SHA1TransitionOKAfterSettingAtoEStep1(z1, s1, z2, s2, currentBlock, currentStep);\r\n\r\n assert forall blk :: 0 <= blk < |z2.atoe| ==>\r\n |z2.atoe[blk]| <= |z2.W[blk]| + 1 &&\r\n |z2.atoe[blk]| <= 81 &&\r\n IsWordSeq(z2.W[blk]) &&\r\n IsAtoEWordSeq(z2.atoe[blk]) &&\r\n (|z2.atoe[blk]| > 0 ==> IsWordSeqOfLen(z2.H[blk], 5) && ConvertAtoEToSeq(z2.atoe[blk][0]) == z2.H[blk]) &&\r\n (forall t :: 0 <= t < |z2.atoe[blk]|-1 ==> TheAtoEsAreOK(z2, blk, t));\r\n\r\n forall blk | 0 <= blk < |z2.atoe|\r\n ensures IsAtoEWordSeq(z2.atoe[blk]);\r\n ensures forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < |z2.atoe[blk]|-1 ==>\r\n Word32AtoE(z2.atoe[blk][t]) &&\r\n var T := Add32(Add32(Add32(Add32(Asm_RotateLeft(z2.atoe[blk][t].a, 5),\r\n ft(t, z2.atoe[blk][t].b, z2.atoe[blk][t].c, z2.atoe[blk][t].d)),\r\n z2.atoe[blk][t].e),\r\n K_SHA1(t)),\r\n z2.W[blk][t]);\r\n z2.atoe[blk][t+1].e == z2.atoe[blk][t].d &&\r\n z2.atoe[blk][t+1].d == z2.atoe[blk][t].c &&\r\n z2.atoe[blk][t+1].c == Asm_RotateLeft(z2.atoe[blk][t].b, 30) &&\r\n z2.atoe[blk][t+1].b == z2.atoe[blk][t].a &&\r\n z2.atoe[blk][t+1].a == T;\r\n {\r\n forall t {:trigger TStep(t)} | TStep(t) && 0 <= t < |z2.atoe[blk]|-1\r\n ensures Word32AtoE(z2.atoe[blk][t]);\r\n ensures var T := Add32(Add32(Add32(Add32(Asm_RotateLeft(z2.atoe[blk][t].a, 5),\r\n ft(t, z2.atoe[blk][t].b, z2.atoe[blk][t].c, z2.atoe[blk][t].d)),\r\n z2.atoe[blk][t].e),\r\n K_SHA1(t)),\r\n z2.W[blk][t]);\r\n z2.atoe[blk][t+1].e == z2.atoe[blk][t].d &&\r\n z2.atoe[blk][t+1].d == z2.atoe[blk][t].c &&\r\n z2.atoe[blk][t+1].c == Asm_RotateLeft(z2.atoe[blk][t].b, 30) &&\r\n z2.atoe[blk][t+1].b == z2.atoe[blk][t].a &&\r\n z2.atoe[blk][t+1].a == T;\r\n {\r\n reveal_TheAtoEsAreOK();\r\n assert TheAtoEsAreOK(z2, blk, t);\r\n }\r\n }\r\n reveal_PartialSHA1TraceHasCorrectatoesOpaque();\r\n}\r\n\r\n/////////////////////////////////////////////////////\r\n\r\n/////////////////////////////////////////////////////\r\n\r\nstatic method InitializeVars_SHA1(M:array, words:int, H:array, W:array, Ks:array)\r\n returns (atoe:atoe_Type, num_blocks:int, ghost z:SHA1Trace)\r\n requires H != null && H.Length == 5;\r\n requires W != null;\r\n requires Ks != null && Ks.Length == 80;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires Mod16(words) == 0;\r\n requires forall i :: 0 <= i < words ==> Word32(M[i]);\r\n ensures IsSHA1ReadyForBlock(z, SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks), 0);\r\n ensures |z.M| == num_blocks;\r\n requires H != Ks && H != M && H != W && Ks != M && Ks != W;\r\n modifies H;\r\n modifies Ks;\r\n ensures M[..] == old(M[..]);\r\n ensures W[..] == old(W[..]);\r\n{\r\n reveal_Mul16();\r\n reveal_Mod16();\r\n reveal_PartialSHA1TraceHasCorrectatoesOpaque();\r\n InitH_SHA1(H);\r\n InitK_SHA1(Ks);\r\n Lemma_AllBlocksAreOfEqualSize(M[..words], 16);\r\n Lemma_AllBlocksAreWordSeqs(M[..words], 16);\r\n z := SHA1Trace_c(BreakIntoBlocks(M[..words], 16), [H[..]], [], []);\r\n num_blocks := words / 16;\r\n atoe := atoe_c(0, 0, 0, 0, 0);\r\n}\r\n\r\nstatic method ComputeWsForBlockStep1_SHA1(M:array, words:int, H:array, W:array, Ks:array,\r\n atoe:atoe_Type, num_blocks:int, ghost z:SHA1Trace, currentBlock:int)\r\n requires H != null;\r\n requires W != null && W.Length == 80;\r\n requires Ks != null;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA1ReadyForBlock(z, SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks), currentBlock);\r\n requires W != H && W != Ks && W != M;\r\n modifies W;\r\n ensures Ks[..] == old(Ks[..]);\r\n ensures H[..] == old(H[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures forall t :: 0 <= t < 16 ==> Word32(W[t]);\r\n ensures forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < 16 ==> W[t] == z.M[currentBlock][t];\r\n ensures IsSHA1ReadyForBlock(z, SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks), currentBlock);\r\n{\r\n ghost var s := SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks);\r\n\r\n var t:int := 0;\r\n while t < 16\r\n invariant 0 <= t <= 16;\r\n invariant s.M == M[..words];\r\n invariant forall step :: 0 <= step < t ==> Word32(W[step]);\r\n invariant forall step {:trigger TStep(step)} :: TStep(step) && 0 <= step < t ==> W[step] == z.M[currentBlock][step];\r\n {\r\n reveal_Mul16();\r\n calc {\r\n 0;\r\n <= { lemma_mul_nonnegative(currentBlock, 16); }\r\n currentBlock * 16;\r\n <= currentBlock * 16 + t;\r\n }\r\n calc {\r\n currentBlock * 16 + t;\r\n 16 * currentBlock + t;\r\n 16 * (currentBlock+1) - 16 + t;\r\n <= 16*|z.M| - 16 + t;\r\n < 16*|z.M|;\r\n == Mul16(|z.M|);\r\n == words;\r\n }\r\n W[t] := M[currentBlock * 16 + t];\r\n calc {\r\n W[t];\r\n { lemma_mul_is_mul_boogie(currentBlock, 16);\r\n Lemma_BlockedSequencePrefixContainsElement(M[..], words, 16, currentBlock, t); }\r\n BreakIntoBlocks(M[..words], 16)[currentBlock][t];\r\n BreakIntoBlocks(s.M, 16)[currentBlock][t];\r\n z.M[currentBlock][t];\r\n }\r\n t := t + 1;\r\n }\r\n}\r\n\r\nstatic method ComputeWsForBlockStep2_SHA1(M:array, words:int, H:array, W:array, Ks:array,\r\n atoe:atoe_Type, num_blocks:int, ghost z:SHA1Trace, currentBlock:int)\r\n requires H != null;\r\n requires W != null && W.Length == 80;\r\n requires Ks != null;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA1ReadyForBlock(z, SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks), currentBlock);\r\n requires forall t :: 0 <= t < 16 ==> Word32(W[t]);\r\n requires forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < 16 ==> W[t] == z.M[currentBlock][t];\r\n requires W != H && W != Ks && W != M;\r\n modifies W;\r\n ensures Ks[..] == old(Ks[..]);\r\n ensures H[..] == old(H[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures forall t :: 0 <= t <= 79 ==> Word32(W[t]);\r\n ensures forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < 16 ==> W[t] == z.M[currentBlock][t];\r\n ensures forall t {:trigger TStep(t)} :: TStep(t) && 16 <= t <= 79 ==> W[t] == Asm_RotateLeft(Asm_BitwiseXor(Asm_BitwiseXor(Asm_BitwiseXor(W[t-3], W[t-8]), W[t-14]),\r\n W[t-16]),\r\n 1);\r\n{\r\n var t := 16;\r\n while t < 80\r\n invariant 16 <= t <= 80;\r\n invariant forall step :: 0 <= step < t ==> Word32(W[step]);\r\n invariant forall step {:trigger TStep(step)} :: TStep(step) && 0 <= step < 16 ==> W[step] == z.M[currentBlock][step];\r\n invariant forall step {:trigger TStep(step)} :: TStep(step) && 16 <= step < t ==>\r\n W[step] == Asm_RotateLeft(Asm_BitwiseXor(Asm_BitwiseXor(Asm_BitwiseXor(W[step-3], W[step-8]), W[step-14]), W[step-16]), 1);\r\n {\r\n W[t] := Asm_RotateLeft(Asm_BitwiseXor(Asm_BitwiseXor(Asm_BitwiseXor(W[t-3], W[t-8]), W[t-14]), W[t-16]), 1);\r\n t := t + 1;\r\n }\r\n}\r\n\r\nstatic method ComputeWsForBlock_SHA1(M:array, words:int, H:array, W:array, Ks:array, atoe:atoe_Type,\r\n num_blocks:int, ghost z:SHA1Trace, currentBlock:int)\r\n returns (ghost next_z:SHA1Trace)\r\n requires H != null;\r\n requires W != null && W.Length == 80;\r\n requires Ks != null;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA1ReadyForBlock(z, SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks), currentBlock);\r\n requires W != H && W != Ks && W != M;\r\n modifies W;\r\n ensures Ks[..] == old(Ks[..]);\r\n ensures H[..] == old(H[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures IsSHA1DoneComputingWs(next_z, SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks), currentBlock);\r\n{\r\n ghost var s := SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks);\r\n\r\n ComputeWsForBlockStep1_SHA1(M, words, H, W, Ks, atoe, num_blocks, z, currentBlock);\r\n ComputeWsForBlockStep2_SHA1(M, words, H, W, Ks, atoe, num_blocks, z, currentBlock);\r\n\r\n next_z := SHA1Trace_c(z.M, z.H, z.W + [W[..]], z.atoe);\r\n ghost var next_s := SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks);\r\n\r\n lemma_SHA1TransitionOKAfterSettingWs(z, s, next_z, next_s, currentBlock);\r\n}\r\n\r\nstatic method ComputeInitialAtoEForBlock_SHA1(M:array, words:int, H:array, W:array, Ks:array,\r\n atoe:atoe_Type, num_blocks:int,\r\n ghost z:SHA1Trace, currentBlock:int)\r\n returns (next_atoe:atoe_Type, ghost next_z:SHA1Trace)\r\n requires H != null;\r\n requires W != null;\r\n requires Ks != null;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA1DoneComputingWs(z, SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks), currentBlock);\r\n ensures IsSHA1ReadyForStep(next_z, SHA1_vars_to_state(M, words, H, W, Ks, next_atoe, num_blocks), currentBlock, 0);\r\n{\r\n reveal_PartialSHA1TraceHasCorrectatoesOpaque();\r\n next_atoe := atoe_c(H[0], H[1], H[2], H[3], H[4]);\r\n next_z := SHA1Trace_c(z.M, z.H, z.W, z.atoe + [[next_atoe]]);\r\n}\r\n\r\nstatic method ComputeOneStep_SHA1(M:array, words:int, H:array, W:array, Ks:array, atoe:atoe_Type, num_blocks:int,\r\n ghost z:SHA1Trace, currentBlock:int, currentStep:int)\r\n returns (next_atoe:atoe_Type, ghost next_z:SHA1Trace)\r\n requires H != null;\r\n requires W != null;\r\n requires Ks != null;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires 0 <= currentStep <= 79;\r\n requires IsSHA1ReadyForStep(z, SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks), currentBlock, currentStep);\r\n ensures IsSHA1ReadyForStep(next_z, SHA1_vars_to_state(M, words, H, W, Ks, next_atoe, num_blocks), currentBlock, currentStep+1);\r\n\r\n ensures Ks[..] == old(Ks[..]);\r\n ensures H[..] == old(H[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures W[..] == old(W[..]);\r\n{\r\n assert TBlk(currentBlock) && TBlk(currentBlock + 1) && TStep(currentStep) && TStep(currentStep + 1);\r\n ghost var s := SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks);\r\n\r\n var T := Asm_Add(Asm_Add(Asm_Add(Asm_Add(Asm_RotateLeft(atoe.a, 5),\r\n ft_impl(currentStep, atoe.b, atoe.c, atoe.d)),\r\n atoe.e),\r\n Ks[currentStep]),\r\n W[currentStep]);\r\n next_atoe := atoe_c(T, atoe.a, Asm_RotateLeft(atoe.b, 30), atoe.c, atoe.d);\r\n next_z := SHA1Trace_c(z.M, z.H, z.W, z.atoe[..currentBlock] + [z.atoe[currentBlock] + [next_atoe]]);\r\n ghost var next_s := SHA1_vars_to_state(M, words, H, W, Ks, next_atoe, num_blocks);\r\n\r\n lemma_SHA1TransitionOKAfterSettingAtoE(z, s, next_z, next_s, currentBlock, currentStep);\r\n}\r\n\r\nstatic method ComputeHsForBlockStep1_SHA1(M:array, words:int, H:array, W:array, Ks:array,\r\n atoe:atoe_Type, num_blocks:int, ghost z:SHA1Trace, currentBlock:int)\r\n requires H != null && H.Length == 5;\r\n requires W != null;\r\n requires Ks != null;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA1ReadyForStep(z, SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks), currentBlock, 80);\r\n requires H != W && H != Ks && H != M;\r\n modifies H;\r\n ensures Ks[..] == old(Ks[..]);\r\n ensures W[..] == old(W[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures forall j :: 0 <= j < 5 ==> Word32(H[j]) && H[j] == Add32(ConvertAtoEToSeq_premium(atoe)[j], old(H[j]));\r\n{\r\n ghost var s := SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks);\r\n ghost var atoe_seq := ConvertAtoEToSeq_premium(atoe);\r\n\r\n H[0], H[1], H[2], H[3], H[4] := Asm_Add(atoe.a, H[0]), Asm_Add(atoe.b, H[1]), Asm_Add(atoe.c, H[2]),\r\n Asm_Add(atoe.d, H[3]), Asm_Add(atoe.e, H[4]);\r\n\r\n forall j | 0 <= j < 5\r\n ensures Word32(H[j]);\r\n ensures H[j] == Add32(ConvertAtoEToSeq_premium(atoe)[j], s.H[j]);\r\n ensures M[..] == old(M[..]);\r\n ensures W[..] == old(W[..]);\r\n {\r\n ghost var atoe_seq := ConvertAtoEToSeq_premium(atoe);\r\n if j == 0 { assert H[0] == Add32(atoe_seq[0], s.H[0]); }\r\n else if j == 1 { assert H[1] == Add32(atoe_seq[1], s.H[1]); }\r\n else if j == 2 { assert H[2] == Add32(atoe_seq[2], s.H[2]); }\r\n else if j == 3 { assert H[3] == Add32(atoe_seq[3], s.H[3]); }\r\n else if j == 4 { assert H[4] == Add32(atoe_seq[4], s.H[4]); }\r\n }\r\n}\r\n\r\nstatic method ComputeHsForBlock_SHA1(M:array, words:int, H:array, W:array, Ks:array, atoe:atoe_Type,\r\n num_blocks:int, ghost z:SHA1Trace, currentBlock:int)\r\n returns (ghost next_z:SHA1Trace)\r\n requires H != null && H.Length == 5;\r\n requires W != null;\r\n requires Ks != null;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA1ReadyForStep(z, SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks), currentBlock, 80);\r\n requires H != W && H != Ks && H != M;\r\n modifies H;\r\n ensures Ks[..] == old(Ks[..]);\r\n ensures W[..] == old(W[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures IsSHA1ReadyForBlock(next_z, SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks), currentBlock+1);\r\n{\r\n ghost var s := SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks);\r\n\r\n ComputeHsForBlockStep1_SHA1(M, words, H, W, Ks, atoe, num_blocks, z, currentBlock);\r\n\r\n next_z := SHA1Trace_c(z.M, z.H + [H[..]], z.W, z.atoe);\r\n ghost var next_s := SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks);\r\n\r\n lemma_SHA1TransitionOKAfterSettingHs(z, s, next_z, next_s, currentBlock);\r\n}\r\n\r\nstatic method PerformOneBlockOfSHA1Computation(M:array, words:int, H:array, W:array, Ks:array,\r\n atoe:atoe_Type, num_blocks:int, ghost z:SHA1Trace, currentBlock:int)\r\n returns (next_atoe:atoe_Type, ghost next_z:SHA1Trace)\r\n requires H != null && H.Length == 5;\r\n requires W != null && W.Length == 80;\r\n requires Ks != null;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA1ReadyForBlock(z, SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks), currentBlock);\r\n requires W != H && W != Ks && W != M && H != Ks && H != M;\r\n modifies H;\r\n modifies W;\r\n ensures M[..] == old(M[..]);\r\n ensures Ks[..] == old(Ks[..]);\r\n ensures IsSHA1ReadyForBlock(next_z, SHA1_vars_to_state(M, words, H, W, Ks, next_atoe, num_blocks), currentBlock+1);\r\n{\r\n var current_z := ComputeWsForBlock_SHA1(M, words, H, W, Ks, atoe, num_blocks, z, currentBlock);\r\n var current_atoe:atoe_Type;\r\n current_atoe, current_z := ComputeInitialAtoEForBlock_SHA1(M, words, H, W, Ks, atoe, num_blocks, current_z, currentBlock);\r\n\r\n var t := 0;\r\n while t < 80\r\n invariant 0 <= t <= 80;\r\n invariant M[..] == old(M[..]);\r\n invariant Ks[..] == old(Ks[..]);\r\n invariant IsSHA1ReadyForStep(current_z, SHA1_vars_to_state(M, words, H, W, Ks, current_atoe, num_blocks), currentBlock, t);\r\n {\r\n current_atoe, current_z := ComputeOneStep_SHA1(M, words, H, W, Ks, current_atoe, num_blocks, current_z, currentBlock, t);\r\n t := t + 1;\r\n }\r\n\r\n current_z := ComputeHsForBlock_SHA1(M, words, H, W, Ks, current_atoe, num_blocks, current_z, currentBlock);\r\n\r\n next_atoe := current_atoe;\r\n next_z := current_z;\r\n}\r\n\r\nstatic lemma Lemma_IsSHA1ReadyForLastBlockImpliesTraceIsCorrect(messageBits:seq, z:SHA1Trace, s:SHA1_state)\r\n requires 0 <= s.num_blocks;\r\n requires IsSHA1ReadyForBlock(z, s, s.num_blocks);\r\n ensures SHA1TraceIsCorrect(z);\r\n{\r\n reveal_PartialSHA1TraceHasCorrectatoesOpaque();\r\n}\r\n\r\nstatic lemma Lemma_IsSHA1Demonstration(messageBits:seq, hash:seq, z:SHA1Trace)\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n requires IsCompleteSHA1Trace(z);\r\n requires z.M == BlockMessageForSHA(PadMessageForSHA_premium(messageBits));\r\n requires SHA1TraceIsCorrect(z);\r\n requires hash == z.H[|z.M|];\r\n ensures IsSHA1(messageBits, hash);\r\n{\r\n}\r\n\r\nstatic lemma Lemma_MessageInSHA1TraceCorrespondsToMessageInArray(M:array, words:int, messageBits:seq, z:SHA1Trace)\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires Mod16(words) == 0;\r\n requires forall i :: 0 <= i < words ==> Word32(M[i]);\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n requires BEWordSeqToBitSeq(M[..words]) == PadMessageForSHA(messageBits);\r\n requires z.M == BreakIntoBlocks(M[..words], 16);\r\n ensures z.M == BlockMessageForSHA(PadMessageForSHA_premium(messageBits));\r\n{\r\n assert |BEWordSeqToBitSeq_premium(M[..words])| == words * 32;\r\n calc {\r\n z.M;\r\n BreakIntoBlocks(M[..words], 16);\r\n { reveal_power2();\r\n lemma_BEDigitSeqToInt_invertibility(power2(32), BEDigitSeqToInt_premium(power2(32), M[..words]), M[..words]); }\r\n BreakIntoBlocks(BEIntToDigitSeq(power2(32), words, BEWordSeqToInt_premium(M[..words])), 16);\r\n { lemma_BEBitSeqToInt_BEWordSeqToBitSeq(M[..words]); }\r\n BreakIntoBlocks(BEIntToDigitSeq(power2(32), words, BEBitSeqToInt(BEWordSeqToBitSeq(M[..words]))), 16);\r\n BreakIntoBlocks(BEIntToDigitSeq(power2(32), words, BEBitSeqToInt(PadMessageForSHA(messageBits))), 16);\r\n { lemma_mul_is_mul_boogie(words, 32); lemma_div_by_multiple(words, 32); assert (words*32)/32 == words; }\r\n BreakIntoBlocks(BEIntToDigitSeq(power2(32), (words*32)/32, BEBitSeqToInt(PadMessageForSHA(messageBits))), 16);\r\n BreakIntoBlocks(BEIntToDigitSeq(power2(32), |BEWordSeqToBitSeq_premium(M[..words])|/32, BEBitSeqToInt(PadMessageForSHA(messageBits))), 16);\r\n BreakIntoBlocks(BEIntToDigitSeq(power2(32), |PadMessageForSHA(messageBits)|/32, BEBitSeqToInt(PadMessageForSHA(messageBits))), 16);\r\n { reveal_BlockMessageForSHA(); lemma_PadMessageForSHA_properties(messageBits); }\r\n BlockMessageForSHA(PadMessageForSHA(messageBits));\r\n }\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} ComputeSHA1AfterPadding_arrays(M:array, words:int, ghost messageBits:seq) returns (hash:array)\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires Mod16(words) == 0;\r\n requires forall i :: 0 <= i < words ==> Word32(M[i]);\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n requires BEWordSeqToBitSeq(M[..words]) == PadMessageForSHA(messageBits);\r\n ensures hash!=null;\r\n ensures IsSHA1(messageBits, hash[..]);\r\n{\r\n \r\n\r\n var H := new int[5];\r\n var W := new int[80];\r\n var Ks := new int[80];\r\n\r\n \r\n\r\n var atoe:atoe_Type;\r\n var num_blocks:int;\r\n ghost var z:SHA1Trace;\r\n atoe, num_blocks, z := InitializeVars_SHA1(M, words, H, W, Ks);\r\n\r\n \r\n\r\n var currentBlock:int := 0;\r\n while currentBlock < num_blocks\r\n invariant 0 <= currentBlock <= num_blocks;\r\n invariant M[..] == old(M[..]);\r\n invariant BEWordSeqToBitSeq(M[..words]) == PadMessageForSHA(messageBits);\r\n invariant IsSHA1ReadyForBlock(z, SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks), currentBlock);\r\n {\r\n atoe, z := PerformOneBlockOfSHA1Computation(M, words, H, W, Ks, atoe, num_blocks, z, currentBlock);\r\n currentBlock := currentBlock + 1;\r\n }\r\n\r\n \r\n\r\n hash := H;\r\n\r\n \r\n\r\n Lemma_MessageInSHA1TraceCorrespondsToMessageInArray(M, words, messageBits, z);\r\n Lemma_IsSHA1ReadyForLastBlockImpliesTraceIsCorrect(messageBits, z, SHA1_vars_to_state(M, words, H, W, Ks, atoe, num_blocks));\r\n Lemma_IsSHA1Demonstration(messageBits, H[..], z);\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} ComputeSHA1AfterPadding(M:array, words:int, ghost messageBits:seq) returns (hash:seq)\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires Mod16(words) == 0;\r\n requires forall i :: 0 <= i < words ==> Word32(M[i]);\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n requires BEWordSeqToBitSeq(M[..words]) == PadMessageForSHA(messageBits);\r\n ensures IsSHA1(messageBits, hash[..]);\r\n{\r\n var H := ComputeSHA1AfterPadding_arrays(M, words, messageBits);\r\n hash := H[..];\r\n}\r\n\r\nstatic lemma lemma_PaddedLength_words(message_len:int, padded_len:int, words:int)\r\n requires padded_len == PaddedLength(message_len);\r\n requires words == padded_len / 32;\r\n ensures padded_len == words * 32;\r\n{\r\n lemma_PaddedLength_properties(message_len);\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} SHA1_impl_ArrayInPlace(M:array, bits:int) returns (hash:seq)\r\n requires IsWordArray(M);\r\n requires Word32(bits);\r\n requires 0 <= bits < power2(64);\r\n requires 0 <= PaddedLength(bits) <= M.Length * 32;\r\n ensures bits <= M.Length * 32;\r\n ensures IsWordSeqOfLen(hash, 5);\r\n ensures IsSHA1(old(BEWordSeqToBitSeq_premium(M[..])[..bits]), hash);\r\n ensures hash == SHA1(old(BEWordSeqToBitSeq_premium(M[..])[..bits]));\r\n modifies M;\r\n{\r\n calc <= { bits; { lemma_PaddedLength_properties(bits); } |BEWordSeqToBitSeq_premium(M[..])|; }\r\n\r\n ghost var messageBits := BEWordSeqToBitSeq_premium(M[..])[..bits];\r\n PadMessageArray(M, bits);\r\n var words := PaddedLength(bits)/32;\r\n\r\n calc {\r\n PadMessageForSHA(messageBits);\r\n BEWordSeqToBitSeq_premium(M[..])[..PaddedLength(bits)];\r\n { lemma_PaddedLength_properties(bits); }\r\n BEWordSeqToBitSeq_premium(M[..])[..words*32];\r\n { lemma_WordSeqToBitSeqChop(M[..], M[..words], M[words..]); }\r\n (BEWordSeqToBitSeq_premium(M[..words]) + BEWordSeqToBitSeq_premium(M[words..]))[..words*32];\r\n BEWordSeqToBitSeq_premium(M[..words])[..words*32];\r\n BEWordSeqToBitSeq_premium(M[..words]);\r\n }\r\n\r\n lemma_mod_words(bits, words);\r\n\r\n hash := ComputeSHA1AfterPadding(M, words, messageBits);\r\n lemma_SHA1IsAFunction(old(BEWordSeqToBitSeq_premium(M[..])[..bits]), hash);\r\n}\r\n\r\nstatic method SHA1_impl_Bytes(messageBytes:seq) returns (hash:seq)\r\n requires Word32(|messageBytes|*8);\r\n requires |messageBytes|*8 < power2(64);\r\n requires IsByteSeq(messageBytes);\r\n ensures IsWordSeqOfLen(hash, 5);\r\n ensures IsSHA1(BEByteSeqToBitSeq_premium(messageBytes), hash);\r\n ensures hash == SHA1(BEByteSeqToBitSeq_premium(messageBytes));\r\n{\r\n var M, bits := CreateArrayForSHA(messageBytes);\r\n hash := SHA1_impl_ArrayInPlace(M, bits);\r\n lemma_SHA1IsAFunction(BEByteSeqToBitSeq_premium(messageBytes), hash);\r\n}\r\n\r\nstatic method SHA1_impl_Bytes_arrays(messageBytes:array) returns (hash:array)\r\n requires messageBytes != null;\r\n requires Word32(messageBytes.Length*8);\r\n requires messageBytes.Length*8 < power2(64);\r\n requires IsByteSeq(messageBytes[..]);\r\n ensures hash != null;\r\n ensures IsWordSeqOfLen(hash[..], 5);\r\n ensures IsSHA1(BEByteSeqToBitSeq_premium(messageBytes[..]), hash[..]);\r\n ensures hash[..] == SHA1(BEByteSeqToBitSeq_premium(messageBytes[..]));\r\n{\r\n \r\n var M, bits := CreateArrayForSHA_arrays(messageBytes);\r\n ghost var Minput_seq := M[..];\r\n assert BEByteSeqToBitSeq_premium(messageBytes[..]) == BEWordSeqToBitSeq(Minput_seq)[..bits];\r\n ghost var oldMessageBytes_seq := old(messageBytes)[..];\r\n \r\n \r\n\r\n ghost var messageBits := BEWordSeqToBitSeq_premium(M[..])[..bits];\r\n PadMessageArray(M, bits);\r\n var words := PaddedLength(bits)/32;\r\n \r\n calc {\r\n PadMessageForSHA(messageBits);\r\n BEWordSeqToBitSeq_premium(M[..])[..PaddedLength(bits)];\r\n { lemma_PaddedLength_words(bits, PaddedLength(bits), words); }\r\n BEWordSeqToBitSeq_premium(M[..])[..words*32];\r\n { lemma_WordSeqToBitSeqChop(M[..], M[..words], M[words..]); }\r\n (BEWordSeqToBitSeq_premium(M[..words]) + BEWordSeqToBitSeq_premium(M[words..]))[..words*32];\r\n BEWordSeqToBitSeq_premium(M[..words])[..words*32];\r\n BEWordSeqToBitSeq_premium(M[..words]);\r\n }\r\n\r\n lemma_mod_words(bits, words);\r\n\r\n hash := ComputeSHA1AfterPadding_arrays(M, words, messageBits);\r\n\r\n\r\n ghost var hash_seq := hash[..];\r\n\r\n ghost var messageBytes_seq := old(messageBytes)[..];\r\n assert IsSHA1(messageBits, hash_seq);\r\n \r\n assert old(messageBytes)[..] == oldMessageBytes_seq;\r\n\r\n lemma_SHA_impl_Bytes_arrays_bitmangle(old(messageBytes), messageBytes_seq, messageBits, Minput_seq, bits);\r\n assert IsSHA1(BEByteSeqToBitSeq_premium(messageBytes_seq), hash_seq);\r\n lemma_SHA1IsAFunction(BEByteSeqToBitSeq_premium(messageBytes_seq), hash_seq);\r\n}\r\n \r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/sha1.s.dfy", "content": "include \"sha_common.s.dfy\"\r\ninclude \"hmac_common.s.dfy\"\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Constants\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic function method{:opaque} K_SHA1(n: int) : int\r\n requires 0 <= n <= 79;\r\n ensures Word32(K_SHA1(n));\r\n{\r\n /*call_lemma:*/lemma_power2_32();\r\n if 0 <= n <= 19 then\r\n 0x5a827999\r\n else if 20 <= n <= 39 then\r\n 0x6ed9eba1\r\n else if 40 <= n <= 59 then\r\n 0x8f1bbcdc\r\n else\r\n 0xca62c1d6\r\n}\r\n\r\nstatic function method{:opaque} InitialH_SHA1(index: int) : int\r\n requires 0 <= index <= 4;\r\n ensures Word32(InitialH_SHA1(index));\r\n{\r\n /*call_lemma:*/lemma_power2_32();\r\n [0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0][index]\r\n}\r\n\r\n//-//////////////////////////////////\r\n//- SHA-1 trace\r\n//-//////////////////////////////////\r\n\r\n//- The fields of a SHA1Trace have the following meanings:\r\n//-\r\n//- M[blk][i] = word #i of message block #blk\r\n//- W[blk][t] = W_t during processing of message block #blk\r\n//- H[blk][j] = H_j before processing message block #blk\r\n//- atoe[blk][t].a = a before step t of processing of message block #blk\r\n//- ...\r\n//- atoe[blk][t].e = e before step t of processing message block #blk\r\n\r\ndatatype atoe_Type = atoe_c(a:int, b:int, c:int, d:int, e:int);\r\ndatatype SHA1Trace = SHA1Trace_c(M:seq>, H:seq>, W:seq>, atoe:seq>);\r\n\r\nstatic predicate IsAtoEWordSeqOfLen(vs:seq, len:int)\r\n{\r\n |vs| == len &&\r\n forall i :: 0 <= i < len ==> Word32(vs[i].a) && Word32(vs[i].b) && Word32(vs[i].c) && Word32(vs[i].d) && Word32(vs[i].e)\r\n}\r\n\r\nstatic function ConvertAtoEToSeq(v:atoe_Type) : seq\r\n{\r\n [v.a, v.b, v.c, v.d, v.e]\r\n}\r\n\r\nstatic predicate IsCompleteSHA1Trace(z:SHA1Trace)\r\n{\r\n (forall i :: 0 <= i < |z.M| ==> IsWordSeqOfLen(z.M[i], 16)) &&\r\n |z.H| == |z.M| + 1 &&\r\n |z.W| == |z.atoe| == |z.M| &&\r\n (forall blk :: 0 <= blk < |z.M| ==> IsWordSeqOfLen(z.W[blk], 80)) &&\r\n (forall blk :: 0 <= blk < |z.M| ==> IsAtoEWordSeqOfLen(z.atoe[blk], 81)) &&\r\n (forall blk :: 0 <= blk <= |z.M| ==> IsWordSeqOfLen(z.H[blk], 5))\r\n}\r\n\r\nstatic predicate SHA1TraceHasCorrectHs(z:SHA1Trace)\r\n requires IsCompleteSHA1Trace(z);\r\n{\r\n (forall j :: 0 <= j < 5 ==> z.H[0][j] == InitialH_SHA1(j)) &&\r\n (forall blk {:trigger TBlk(blk)} :: TBlk(blk) ==> forall j :: 0 <= blk < |z.M| && 0 <= j < 5 ==> z.H[blk+1][j] == Add32(ConvertAtoEToSeq(z.atoe[blk][80])[j], z.H[blk][j]))\r\n}\r\n\r\nstatic predicate SHA1TraceHasCorrectWs(z:SHA1Trace)\r\n requires IsCompleteSHA1Trace(z);\r\n{\r\n forall blk ::\r\n 0 <= blk < |z.M| ==>\r\n forall t {:trigger TStep(t)} :: TStep(t) ==>\r\n (0 <= t <= 15 ==> z.W[blk][t] == z.M[blk][t]) &&\r\n (16 <= t <= 79 ==> z.W[blk][t] ==\r\n RotateLeft(BitwiseXor(BitwiseXor(BitwiseXor(z.W[blk][t-3], z.W[blk][t-8]), z.W[blk][t-14]), z.W[blk][t-16]), 1))\r\n}\r\n\r\nstatic predicate SHA1TraceHasCorrectatoes(z:SHA1Trace)\r\n requires IsCompleteSHA1Trace(z);\r\n{\r\n forall blk :: 0 <= blk < |z.M| ==>\r\n ConvertAtoEToSeq(z.atoe[blk][0]) == z.H[blk] &&\r\n forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t <= 79 ==>\r\n (var T := Add32(Add32(Add32(Add32(RotateLeft(z.atoe[blk][t].a, 5),\r\n ft(t, z.atoe[blk][t].b, z.atoe[blk][t].c, z.atoe[blk][t].d)),\r\n z.atoe[blk][t].e),\r\n K_SHA1(t)),\r\n z.W[blk][t]);\r\n z.atoe[blk][t+1].e == z.atoe[blk][t].d &&\r\n z.atoe[blk][t+1].d == z.atoe[blk][t].c &&\r\n z.atoe[blk][t+1].c == RotateLeft(z.atoe[blk][t].b, 30) &&\r\n z.atoe[blk][t+1].b == z.atoe[blk][t].a &&\r\n z.atoe[blk][t+1].a == T)\r\n}\r\n\r\nstatic predicate {:autoReq} SHA1TraceIsCorrect(z:SHA1Trace)\r\n{\r\n SHA1TraceHasCorrectHs(z) && SHA1TraceHasCorrectWs(z) && SHA1TraceHasCorrectatoes(z)\r\n}\r\n\r\nstatic predicate {:autoReq} IsSHA1(messageBits:seq, hash:seq)\r\n requires IsBitSeq(messageBits);\r\n{\r\n exists z:SHA1Trace ::\r\n IsCompleteSHA1Trace(z) &&\r\n z.M == BlockMessageForSHA(PadMessageForSHA(messageBits)) &&\r\n SHA1TraceIsCorrect(z) &&\r\n hash == z.H[|z.M|]\r\n}\r\n\r\nstatic function {:axiom} SHA1(messageBits:seq) : seq\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n ensures IsWordSeqOfLen(SHA1(messageBits), 5);\r\n\r\nstatic lemma {:axiom} lemma_SHA1IsAFunction(messageBits:seq, hash:seq)\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n requires IsWordSeqOfLen(hash, 5);\r\n requires IsSHA1(messageBits, hash);\r\n ensures SHA1(messageBits) == hash;\r\n\r\n//-///////////////////////////////////////////////////////////////////////////////\r\n//- HMAC specification based on:\r\n//- http://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf\r\n//-///////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function {:autoReq} HMAC_SHA1(k: seq, m: seq) : seq\r\n requires |k|==512;\r\n{\r\n SHA1(SeqXor(k, Opad(|k|)) + BEWordSeqToBitSeq(SHA1(SeqXor(k, Ipad(|k|)) + m)))\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/sha1_hmac.i.dfy", "content": "include \"sha_common.s.dfy\"\r\ninclude \"hmac_common.s.dfy\"\r\ninclude \"sha1.i.dfy\"\r\ninclude \"hmac_common.i.dfy\"\r\ninclude \"../../Util/arrays_and_seqs.i.dfy\"\r\n\r\nmethod HMAC_SHA1_inner_hash(key: array, data: array, len: int) returns (hash: array)\r\n requires Word32(len);\r\n requires IsWordArray(key);\r\n requires key.Length == 16;\r\n requires len <= power2(32) - 1 - 512;\r\n requires IsWordArray(data);\r\n requires 0 <= data.Length;\r\n requires 0 <= len <= data.Length * 32;\r\n ensures fresh(hash);\r\n ensures key[..] == old(key[..]);\r\n ensures data[..] == old(data[..]);\r\n ensures IsWordArray(hash);\r\n ensures Mod32_const(512) == 0;\r\n ensures IsSHA1(SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512)) + BEWordSeqToBitSeq_premium(data[..])[..len], hash[..]);\r\n{\r\n var input := HMAC_inner_input(key, data, len);\r\n assert data[..] == old(data[..]);\r\n assert key[..] == old(key[..]);\r\n lemma_2toX();\r\n ghost var old_input := BEWordSeqToBitSeq_premium(input[..])[..len+512];\r\n\r\n calc {\r\n old_input;\r\n BEWordSeqToBitSeq_premium(input[..])[..len+512];\r\n (SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512)) + BEWordSeqToBitSeq_premium(data[..]) +\r\n BEWordSeqToBitSeq_premium(input[16+data.Length..]))[..len+512];\r\n { assert |SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512))| == 512; }\r\n { assert |BEWordSeqToBitSeq_premium(data[..])| >= len; } //- == |data[..]|*32;\r\n SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512)) + BEWordSeqToBitSeq_premium(data[..])[..len];\r\n }\r\n\r\n var hash_seq := SHA1_impl_ArrayInPlace(input, len+512);\r\n hash := SeqToArray(hash_seq);\r\n lemma_Mod32_const(512);\r\n}\r\n\r\nmethod HMAC_SHA1_impl_Array(key: array, data: array, len: int) returns (hash: seq)\r\n requires Word32(len);\r\n requires IsWordArray(key);\r\n requires key.Length == 16;\r\n requires len <= power2(32) - 1 - 512;\r\n requires data != null;\r\n requires 0 <= len <= data.Length * 32;\r\n requires IsWordArray(data);\r\n ensures IsWordSeqOfLen(hash, 5);\r\n ensures key[..] == old(key[..]);\r\n ensures data[..] == old(data[..]);\r\n ensures var k := BEWordSeqToBitSeq_premium(key[..]);\r\n var m := BEWordSeqToBitSeq_premium(data[..])[..len];\r\n IsBitSeqOfLen(k, 512) &&\r\n IsBitSeqOfLen(Ipad(512), 512) &&\r\n IsBitSeq(SeqXor(k, Ipad(512)) + m) &&\r\n |SeqXor(k, Ipad(512)) + m| < power2(64) &&\r\n IsBitSeqOfLen(Opad(512), 512) &&\r\n IsBitSeq(SeqXor(k, Opad(512)) + BEWordSeqToBitSeq(SHA1(SeqXor(k, Ipad(512)) + m))) &&\r\n |SeqXor(k, Opad(512)) + BEWordSeqToBitSeq(SHA1(SeqXor(k, Ipad(512)) + m))| < power2(64) &&\r\n hash == HMAC_SHA1(k, m);\r\n{\r\n var inner_hash := HMAC_SHA1_inner_hash(key, data, len);\r\n assert key[..] == old( key[..]);\r\n assert data[..] == old(data[..]);\r\n lemma_2toX();\r\n reveal_Mod32_const();\r\n lemma_SHA1IsAFunction(SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512)) + BEWordSeqToBitSeq_premium(data[..])[..len],\r\n inner_hash[..]);\r\n assert inner_hash[..] == SHA1(SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512)) + BEWordSeqToBitSeq_premium(data[..])[..len]);\r\n ghost var old_inner_hash := inner_hash[..];\r\n\r\n var input := HMAC_outer_input(key, inner_hash);\r\n assert old_inner_hash == inner_hash[..];\r\n assert key[..] == old( key[..]);\r\n assert data[..] == old(data[..]);\r\n ghost var original_input := input[..];\r\n\r\n var bit_len := 32*(key.Length + inner_hash.Length);\r\n assert old_inner_hash == inner_hash[..];\r\n assert key[..] == old( key[..]);\r\n assert data[..] == old(data[..]);\r\n assert input[..] == original_input;\r\n ghost var old_input := BEWordSeqToBitSeq_premium(input[..])[..bit_len];\r\n\r\n calc <= { 16+8; {lemma_PaddedLength_properties(32*(16+inner_hash.Length));} input.Length; }\r\n\r\n calc {\r\n old_input;\r\n BEWordSeqToBitSeq_premium(input[..])[..bit_len];\r\n (SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Opad_premium(512)) +\r\n BEWordSeqToBitSeq_premium(inner_hash[..]) + BEWordSeqToBitSeq_premium(input[16+8..]))[..bit_len];\r\n (SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Opad_premium(512)) +\r\n BEWordSeqToBitSeq_premium(inner_hash[..]))[..bit_len];\r\n SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Opad_premium(512)) + BEWordSeqToBitSeq_premium(inner_hash[..]);\r\n SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Opad_premium(512)) +\r\n BEWordSeqToBitSeq_premium(SHA1(SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512)) +\r\n BEWordSeqToBitSeq_premium(data[..])[..len]));\r\n }\r\n\r\n hash := SHA1_impl_ArrayInPlace(input, bit_len);\r\n assert hash == SHA1(old_input);\r\n assert old_inner_hash == inner_hash[..];\r\n assert key[..] == old( key[..]);\r\n assert data[..] == old(data[..]);\r\n\r\n ghost var k := BEWordSeqToBitSeq_premium(key[..]);\r\n ghost var m := BEWordSeqToBitSeq_premium(data[..])[..len];\r\n calc {\r\n hash;\r\n SHA1(old_input);\r\n SHA1(SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Opad_premium(512)) + BEWordSeqToBitSeq_premium(SHA1(SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512)) + BEWordSeqToBitSeq_premium(data[..])[..len])));\r\n { assert BEWordSeqToBitSeq_premium(key[..])[..key.Length*32] == BEWordSeqToBitSeq_premium(key[..]); }\r\n SHA1(SeqXor_premium(k, Opad_premium(|k|)) + BEWordSeqToBitSeq_premium(SHA1(SeqXor_premium(k, Ipad_premium(|k|)) + m)));\r\n HMAC_SHA1(k, m);\r\n }\r\n}\r\n\r\nmethod HMAC_SHA1_impl_Seqs(keyBytes: seq, dataBytes: seq) returns (hash: seq)\r\n requires Word32(|dataBytes|*8);\r\n requires IsByteSeq(keyBytes);\r\n requires |keyBytes| <= 64;\r\n requires |dataBytes|*8 <= power2(32) - 1 - 512;\r\n requires IsByteSeq(dataBytes);\r\n ensures IsWordSeqOfLen(hash, 5);\r\n ensures var k := BEByteSeqToBitSeq_premium(keyBytes + RepeatDigit_premium(0, 64 - |keyBytes|));\r\n var m := BEByteSeqToBitSeq_premium(dataBytes);\r\n IsBitSeqOfLen(k, 512) &&\r\n IsBitSeqOfLen(Ipad(512), 512) &&\r\n IsBitSeq(SeqXor(k, Ipad(512)) + m) &&\r\n |SeqXor(k, Ipad(512)) + m| < power2(64) &&\r\n IsBitSeqOfLen(Opad(512), 512) &&\r\n IsBitSeq(SeqXor(k, Opad(512)) + BEWordSeqToBitSeq(SHA1(SeqXor(k, Ipad(512)) + m))) &&\r\n |SeqXor(k, Opad(512)) + BEWordSeqToBitSeq(SHA1(SeqXor(k, Ipad(512)) + m))| < power2(64) &&\r\n hash == HMAC_SHA1(k, m);\r\n{\r\n var requiredKeyBytePadding := RepeatDigit_impl(0, 64 - |keyBytes|);\r\n var keyBytesPadded := keyBytes + requiredKeyBytePadding;\r\n var keyWords, padbytes := BEByteSeqToWordSeq_impl(keyBytesPadded);\r\n var keyArray := SeqToArray(keyWords);\r\n var dataWords := BEByteSeqToWordSeqTailPadding(dataBytes);\r\n var dataArray := SeqToArray(dataWords);\r\n var len := |dataBytes|*8;\r\n calc {\r\n len;\r\n |dataBytes|*8;\r\n <= |BEWordSeqToBitSeq_premium(dataWords)|;\r\n |dataWords| * 32;\r\n dataArray.Length * 32;\r\n }\r\n calc {\r\n keyArray.Length;\r\n |keyWords|;\r\n |keyBytesPadded| / 4;\r\n (|keyBytes| + 64 - |keyBytes|) / 4;\r\n 64 / 4;\r\n 16;\r\n }\r\n hash := HMAC_SHA1_impl_Array(keyArray, dataArray, len);\r\n\r\n lemma_2toX();\r\n ghost var k := BEByteSeqToBitSeq_premium(keyBytesPadded);\r\n ghost var m := BEByteSeqToBitSeq_premium(dataBytes);\r\n reveal_Mod32_const();\r\n assert IsBitSeqOfLen(k, 512);\r\n assert IsBitSeqOfLen(Ipad_premium(512), 512);\r\n assert IsBitSeq(SeqXor_premium(k, Ipad_premium(512)) + m);\r\n assert |SeqXor_premium(k, Ipad_premium(512)) + m| < power2(64);\r\n assert IsBitSeqOfLen(Opad_premium(512), 512);\r\n assert IsBitSeq(SeqXor_premium(k, Opad_premium(512)) + BEWordSeqToBitSeq_premium(SHA1(SeqXor_premium(k, Ipad_premium(512)) + m)));\r\n assert |SeqXor_premium(k, Opad_premium(512)) + BEWordSeqToBitSeq_premium(SHA1(SeqXor_premium(k, Ipad_premium(512)) + m))| < power2(64);\r\n calc {\r\n hash;\r\n HMAC_SHA1(BEWordSeqToBitSeq_premium(keyArray[..]), BEWordSeqToBitSeq_premium(dataArray[..])[..len]);\r\n { assert keyWords == keyArray[..]; }\r\n HMAC_SHA1(BEWordSeqToBitSeq_premium(keyWords), BEWordSeqToBitSeq_premium(dataArray[..])[..len]);\r\n HMAC_SHA1(k, BEWordSeqToBitSeq_premium(dataArray[..])[..len]);\r\n HMAC_SHA1(k, BEByteSeqToBitSeq_premium(dataBytes));\r\n HMAC_SHA1(k, m);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/sha256.i.dfy", "content": "\r\n\r\ninclude \"sha256.s.dfy\"\r\ninclude \"../../Util/seq_blocking.i.dfy\"\r\ninclude \"../../Util/arrays_and_seqs.i.dfy\"\r\ninclude \"../../Util/integer_sequences_premium.i.dfy\"\r\ninclude \"sha_padding.i.dfy\"\r\ninclude \"sha_common.i.dfy\"\r\ninclude \"sha256opt.i.dfy\"\r\ninclude \"sha256opt2.i.dfy\"\r\ninclude \"sha256common.i.dfy\"\r\ninclude \"../../../Drivers/CPU/assembly_premium.i.dfy\"\r\n\r\nstatic function method{:CompiledSpec} CompiledSpec_K_SHA256(t: int) : int\r\nstatic function method{:CompiledSpec} CompiledSpec_InitialH_SHA256(j: int) : int\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Utility functions for AtoH\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic function ConvertAtoHToSeq_premium(v:atoh_Type) : seq\r\n requires Word32AtoH(v);\r\n ensures IsWordSeqOfLen(ConvertAtoHToSeq_premium(v), 8);\r\n ensures ConvertAtoHToSeq_premium(v) == ConvertAtoHToSeq(v);\r\n{\r\n ConvertAtoHToSeq(v)\r\n}\r\n\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Initialization of data structures\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic method InitH_SHA256(H:array)\r\n requires H != null && H.Length == 8;\r\n ensures forall i :: 0 <= i < H.Length ==> H[i] == InitialH_SHA256(i);\r\n modifies H;\r\n{\r\n H[0] := 1779033703;\r\n H[1] := 3144134277;\r\n H[2] := 1013904242;\r\n H[3] := 2773480762;\r\n H[4] := 1359893119;\r\n H[5] := 2600822924;\r\n H[6] := 528734635;\r\n H[7] := 1541459225;\r\n reveal_InitialH_SHA256();\r\n}\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Partial SHA256 traces\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic lemma PartialSHA256TraceIsCorrectImpliesTraceIsCorrect(z:SHA256Trace)\r\n requires IsCompleteSHA256Trace(z);\r\n requires PartialSHA256TraceIsCorrect(z);\r\n ensures SHA256TraceIsCorrect(z);\r\n{\r\n reveal_PartialSHA256TraceHasCorrectatohsOpaque();\r\n}\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Intermediate SHA256 state\r\n//-///////////////////////////////////////////////////\r\n\r\n\r\nstatic predicate IsSHA256DoneComputingWs(z:SHA256Trace, s:SHA256_state, currentBlock:int)\r\n requires 0 <= currentBlock;\r\n{\r\n AreSHA256TraceAndStateOK(z, s) &&\r\n |z.H| == currentBlock + 1 &&\r\n |z.W| == currentBlock + 1 &&\r\n |z.atoh| == currentBlock &&\r\n (forall blk :: 0 <= blk < currentBlock ==> IsAToHWordSeqOfLen(z.atoh[blk], 65)) &&\r\n s.H == z.H[currentBlock] &&\r\n s.W == z.W[currentBlock]\r\n}\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Proofs that transitions between states are OK\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic lemma{:dafnycc_conservative_seq_triggers} lemma_SHA256TransitionOKAfterSettingHsStep1(z1:SHA256Trace, s1:SHA256_state, z2:SHA256Trace, s2:SHA256_state,\r\n currentBlock:int)\r\n requires 0 <= currentBlock;\r\n requires IsSHA256ReadyForStep(z1, s1, currentBlock, 64);\r\n requires s2.M == s1.M;\r\n requires IsWordSeqOfLen(s2.H, 8);\r\n requires forall j :: 0 <= j < 8 ==> s2.H[j] == Asm_Add(ConvertAtoHToSeq_premium(s1.atoh)[j], s1.H[j]);\r\n requires s2.num_blocks == s1.num_blocks;\r\n requires z2 == SHA256Trace_c(z1.M, z1.H + [s2.H], z1.W, z1.atoh);\r\n ensures forall blk :: 0 <= blk < |z2.H| ==> IsWordSeqOfLen(z2.H[blk], 8);\r\n ensures forall blk {:trigger TBlk(blk)} :: TBlk(blk) && 0 <= blk < currentBlock + 1 ==>\r\n IsAToHWordSeqOfLen(z2.atoh[blk], 65) &&\r\n forall j :: 0 <= j < 8 ==> z2.H[blk+1][j] == Asm_Add(ConvertAtoHToSeq_premium(z2.atoh[blk][64])[j], z2.H[blk][j]);\r\n{\r\n assert |z2.H| == currentBlock + 2;\r\n\r\n forall blk | 0 <= blk < |z2.H|\r\n ensures IsWordSeqOfLen(z2.H[blk], 8);\r\n {\r\n if (blk == |z2.H|-1) {\r\n assert z2.H[blk] == s2.H;\r\n }\r\n else {\r\n assert z2.H[blk] == z1.H[blk];\r\n }\r\n }\r\n\r\n assert forall blk {:trigger TBlk(blk)} :: TBlk(blk) && 0 <= blk < currentBlock + 1 ==> IsWordSeqOfLen(z2.H[blk+1], 8);\r\n\r\n forall blk | TBlk(blk) && 0 <= blk < currentBlock + 1\r\n ensures IsAToHWordSeqOfLen(z2.atoh[blk], 65);\r\n ensures forall j :: 0 <= j < 8 ==> z2.H[blk+1][j] == Asm_Add(ConvertAtoHToSeq_premium(z2.atoh[blk][64])[j], z2.H[blk][j]);\r\n {\r\n assert z2.atoh[blk] == z1.atoh[blk];\r\n if blk == currentBlock {\r\n assert IsSHA256ReadyForStep(z1, s1, currentBlock, 64);\r\n assert IsAToHWordSeqOfLen(z1.atoh[currentBlock], 64+1);\r\n assert IsAToHWordSeqOfLen(z1.atoh[blk], 65);\r\n calc {\r\n true\r\n ==> forall j :: 0 <= j < 8 ==> s2.H[j] == Asm_Add(ConvertAtoHToSeq_premium(s1.atoh)[j], s1.H[j]);\r\n ==> { assert z2.H[blk+1] == s2.H; }\r\n forall j :: 0 <= j < 8 ==> z2.H[blk+1][j] == Asm_Add(ConvertAtoHToSeq_premium(s1.atoh)[j], s1.H[j]);\r\n ==> { assert z2.atoh[blk][64] == s1.atoh; }\r\n forall j :: 0 <= j < 8 ==> z2.H[blk+1][j] == Asm_Add(ConvertAtoHToSeq_premium(z2.atoh[blk][64])[j], s1.H[j]);\r\n ==> { assert z2.H[blk] == s1.H; }\r\n forall j :: 0 <= j < 8 ==> z2.H[blk+1][j] == Asm_Add(ConvertAtoHToSeq_premium(z2.atoh[blk][64])[j], z2.H[blk][j]);\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic lemma {:timeLimitMultiplier 3} {:dafnycc_conservative_seq_triggers} lemma_SHA256TransitionOKAfterSettingHs(z1:SHA256Trace, s1:SHA256_state, z2:SHA256Trace, s2:SHA256_state,\r\n currentBlock:int)\r\n requires 0 <= currentBlock;\r\n requires IsSHA256ReadyForStep(z1, s1, currentBlock, 64);\r\n requires s2.M == s1.M;\r\n requires IsWordSeqOfLen(s2.H, 8);\r\n requires forall j :: 0 <= j < 8 ==> s2.H[j] == Asm_Add(ConvertAtoHToSeq_premium(s1.atoh)[j], s1.H[j]);\r\n requires s2.num_blocks == s1.num_blocks;\r\n requires z2 == SHA256Trace_c(z1.M, z1.H + [s2.H], z1.W, z1.atoh);\r\n ensures IsSHA256ReadyForBlock(z2, s2, currentBlock+1);\r\n{\r\n lemma_SHA256TransitionOKAfterSettingHsStep1(z1, s1, z2, s2, currentBlock);\r\n reveal_PartialSHA256TraceHasCorrectatohsOpaque();\r\n}\r\n\r\nstatic lemma lemma_Earlier256WsAreWords(W:seq)\r\n requires IsWordSeqOfLen(W, 64);\r\n ensures forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < |W| ==>\r\n (16 <= t <= 63 ==> Word32(W[t-2]) && Word32(W[t-7]) && Word32(W[t-15]) && Word32(W[t-16]));\r\n{\r\n}\r\n\r\nstatic lemma lemma_SHA256TransitionOKAfterSettingWs(z1:SHA256Trace, s1:SHA256_state, z2:SHA256Trace, s2:SHA256_state, currentBlock:int)\r\n requires 0 <= currentBlock < |z1.M|;\r\n requires IsSHA256ReadyForBlock(z1, s1, currentBlock);\r\n requires IsWordSeqOfLen(s2.W, 64);\r\n requires forall t :: TStep(t) && 0 <= t <= 15 ==> s2.W[t] == z1.M[currentBlock][t];\r\n requires forall t :: TStep(t) && 16 <= t <= 63 ==> s2.W[t] == Asm_Add(Asm_Add(Asm_Add(SSIG1(s2.W[t-2]), s2.W[t-7]), SSIG0(s2.W[t-15])),\r\n s2.W[t-16]);\r\n requires z2 == SHA256Trace_c(z1.M, z1.H, z1.W + [s2.W], z1.atoh);\r\n requires s2.M == s1.M;\r\n requires s2.H == s1.H;\r\n requires s2.num_blocks == s1.num_blocks;\r\n ensures IsSHA256DoneComputingWs(z2, s2, currentBlock);\r\n{\r\n assert z2.M == z1.M;\r\n assert z2.H == z1.H;\r\n assert |z2.W| == |z1.W| + 1;\r\n assert forall blk :: 0 <= blk < |z1.W| ==> z2.W[blk] == z1.W[blk];\r\n assert z2.W[|z1.W|] == s2.W;\r\n assert z2.atoh == z1.atoh;\r\n\r\n forall blk | 0 <= blk < |z2.W|\r\n ensures IsWordSeqOfLen(z2.W[blk], 64);\r\n ensures forall t :: 0 <= t < |z2.W[blk]| ==> (16 <= t <= 63 ==> Word32(z2.W[blk][t-2]) && Word32(z2.W[blk][t-7]) && Word32(z2.W[blk][t-15]) && Word32(z2.W[blk][t-16]));\r\n//- ensures forall t :: t < |z2.W[blk]| ==> 16 <= t <= 63 ==> Word32(z2.W[blk][t-16]);\r\n//- ensures forall t :: t < |z2.W[blk]| ==> 16 <= t <= 63 ==> Word32(z2.W[blk][t-15]);\r\n//- ensures forall t :: t < |z2.W[blk]| ==> 16 <= t <= 63 ==> Word32(z2.W[blk][t-7]);\r\n//- ensures forall t :: t < |z2.W[blk]| ==> 16 <= t <= 63 ==> Word32(z2.W[blk][t-2]);\r\n ensures forall t {:trigger TStep(t)} :: TStep(t) && t < |z2.W[blk]| ==>\r\n (0 <= t <= 15 ==> z2.W[blk][t] == z2.M[blk][t]) &&\r\n (16 <= t <= 63 ==> z2.W[blk][t] == Asm_Add(Asm_Add(Asm_Add(SSIG1(z2.W[blk][t-2]), z2.W[blk][t-7]), SSIG0(z2.W[blk][t-15])),\r\n z2.W[blk][t-16]));\r\n {\r\n if blk < |z2.W|-1 {\r\n assert IsWordSeqOfLen(z2.W[blk], 64);\r\n lemma_Earlier256WsAreWords(z2.W[blk]);\r\n assert forall t {:trigger TStep(t)} :: TStep(t) && t < |z2.W[blk]| ==>\r\n (0 <= t <= 15 ==> z2.W[blk][t] == z2.M[blk][t]) &&\r\n (16 <= t <= 63 ==> z2.W[blk][t] == Asm_Add(Asm_Add(Asm_Add(SSIG1(z2.W[blk][t-2]), z2.W[blk][t-7]), SSIG0(z2.W[blk][t-15])),\r\n z2.W[blk][t-16]));\r\n }\r\n else {\r\n assert blk == |z2.W|-1;\r\n assert z2.W[blk] == s2.W;\r\n lemma_Earlier256WsAreWords(z2.W[blk]);\r\n assert forall t {:trigger TStep(t)} :: TStep(t) && t < |z2.W[blk]| ==>\r\n (0 <= t <= 15 ==> z2.W[blk][t] == z2.M[blk][t]) &&\r\n (16 <= t <= 63 ==> z2.W[blk][t] == Asm_Add(Asm_Add(Asm_Add(SSIG1(z2.W[blk][t-2]), z2.W[blk][t-7]), SSIG0(z2.W[blk][t-15])),\r\n z2.W[blk][t-16]));\r\n }\r\n }\r\n reveal_PartialSHA256TraceHasCorrectatohsOpaque();\r\n}\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Methods for performing SHA-256 calculations\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic method InitializeVars_SHA256(M:array, words:int, H:array, W:array)\r\n returns (a_next:int, b_next:int, c_next:int, d_next:int, e_next:int, f_next:int, g_next:int, h_next:int,ghost atoh:atoh_Type, num_blocks:int, ghost z:SHA256Trace)\r\n requires H != null && H.Length == 8;\r\n requires W != null;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires Mod16(words) == 0;\r\n requires forall i :: 0 <= i < words ==> Word32(M[i]);\r\n ensures IsSHA256ReadyForBlock(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), 0);\r\n ensures |z.M| == num_blocks;\r\n requires H != M && H != W; \r\n modifies H;\r\n ensures M[..] == old(M[..]);\r\n ensures W[..] == old(W[..]);\r\n ensures atoh == atoh_c(a_next, b_next, c_next, d_next, e_next, f_next, g_next, h_next);\r\n{\r\n reveal_Mul16();\r\n reveal_Mod16();\r\n reveal_PartialSHA256TraceHasCorrectatohsOpaque();\r\n InitH_SHA256(H);\r\n Lemma_AllBlocksAreOfEqualSize(M[..words], 16);\r\n Lemma_AllBlocksAreWordSeqs(M[..words], 16);\r\n z := SHA256Trace_c(BreakIntoBlocks(M[..words], 16), [H[..]], [], []);\r\n num_blocks := words / 16;\r\n atoh := atoh_c(0, 0, 0, 0, 0, 0, 0, 0);\r\n a_next, b_next, c_next, d_next, e_next, f_next, g_next, h_next := 0, 0, 0, 0, 0, 0, 0, 0;\r\n}\r\n\r\nstatic method ComputeWsForBlockStep1_SHA256(M:array, words:int, H:array, W:array,\r\n ghost atoh:atoh_Type, num_blocks:int, ghost z:SHA256Trace, currentBlock:int)\r\n requires H != null;\r\n requires W != null && W.Length == 64;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA256ReadyForBlock(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n requires W != H && W != M;\r\n modifies W;\r\n ensures H[..] == old(H[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures forall t :: 0 <= t < 16 ==> Word32(W[t]);\r\n ensures forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < 16 ==> W[t] == z.M[currentBlock][t];\r\n ensures IsSHA256ReadyForBlock(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n{\r\n ghost var s := SHA256_vars_to_state(M, words, H, W, atoh, num_blocks);\r\n\r\n var t:int := 0;\r\n var m_index := currentBlock * 16;\r\n while t < 16\r\n invariant 0 <= t <= 16;\r\n invariant m_index == currentBlock * 16 + t;\r\n invariant s.M == M[..words];\r\n invariant forall step :: 0 <= step < t ==> Word32(W[step]);\r\n invariant forall step {:trigger TStep(step)} :: TStep(step) && 0 <= step < t ==> W[step] == z.M[currentBlock][step];\r\n {\r\n reveal_Mul16();\r\n calc {\r\n 0;\r\n <= { lemma_mul_nonnegative(currentBlock, 16); }\r\n currentBlock * 16;\r\n <= currentBlock * 16 + t;\r\n }\r\n calc {\r\n currentBlock * 16 + t;\r\n 16 * currentBlock + t;\r\n 16 * (currentBlock+1) - 16 + t;\r\n <= 16*|z.M| - 16 + t;\r\n < 16*|z.M|;\r\n == Mul16(|z.M|);\r\n == words;\r\n }\r\n W[t] := M[m_index];\r\n calc {\r\n W[t];\r\n { lemma_mul_is_mul_boogie(currentBlock, 16);\r\n Lemma_BlockedSequencePrefixContainsElement(M[..], words, 16, currentBlock, t); }\r\n BreakIntoBlocks(M[..words], 16)[currentBlock][t];\r\n BreakIntoBlocks(s.M, 16)[currentBlock][t];\r\n z.M[currentBlock][t];\r\n }\r\n t := t + 1;\r\n m_index := m_index + 1;\r\n }\r\n}\r\n\r\nstatic method ComputeWsForBlock_SHA256_original(M:array, words:int, H:array, W:array, ghost atoh:atoh_Type,\r\n num_blocks:int, ghost z:SHA256Trace, currentBlock:int)\r\n returns (ghost next_z:SHA256Trace)\r\n requires H != null;\r\n requires W != null && W.Length == 64;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA256ReadyForBlock(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n requires W != H && W != M;\r\n modifies W;\r\n ensures H[..] == old(H[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures IsSHA256DoneComputingWs(next_z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n{\r\n ghost var s := SHA256_vars_to_state(M, words, H, W, atoh, num_blocks);\r\n\r\n ComputeWsForBlockStep1_SHA256(M, words, H, W, atoh, num_blocks, z, currentBlock);\r\n ComputeWsForBlockStep2_SHA256(M, words, H, W, atoh, num_blocks, z, currentBlock);\r\n\r\n next_z := SHA256Trace_c(z.M, z.H, z.W + [W[..]], z.atoh);\r\n ghost var next_s := SHA256_vars_to_state(M, words, H, W, atoh, num_blocks);\r\n\r\n lemma_SHA256TransitionOKAfterSettingWs(z, s, next_z, next_s, currentBlock);\r\n}\r\n\r\nstatic method ComputeWsForBlock_SHA256_optimized(M:array, words:int, H:array, W:array, ghost atoh:atoh_Type,\r\n num_blocks:int, ghost z:SHA256Trace, currentBlock:int)\r\n returns (ghost next_z:SHA256Trace)\r\n requires H != null;\r\n requires W != null && W.Length == 64;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA256ReadyForBlock(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n requires W != H && W != M;\r\n modifies W;\r\n ensures H[..] == old(H[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures IsSHA256DoneComputingWs(next_z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n{\r\n ghost var s := SHA256_vars_to_state(M, words, H, W, atoh, num_blocks);\r\n\r\n ComputeWsForBlockStep1_SHA256_optimized(M, words, H, W, atoh, num_blocks, z, currentBlock);\r\n ComputeWsForBlockStep2_SHA256(M, words, H, W, atoh, num_blocks, z, currentBlock);\r\n\r\n next_z := SHA256Trace_c(z.M, z.H, z.W + [W[..]], z.atoh);\r\n ghost var next_s := SHA256_vars_to_state(M, words, H, W, atoh, num_blocks);\r\n\r\n lemma_SHA256TransitionOKAfterSettingWs(z, s, next_z, next_s, currentBlock);\r\n}\r\n\r\nstatic method ComputeInitialAtoHForBlock_SHA256(M:array, words:int, H:array, W:array,\r\n ghost atoh:atoh_Type, num_blocks:int,\r\n ghost z:SHA256Trace, currentBlock:int)\r\n returns (a_next:int, b_next:int, c_next:int, d_next:int, e_next:int, f_next:int, g_next:int, h_next:int, ghost next_atoh:atoh_Type, ghost next_z:SHA256Trace)\r\n requires H != null;\r\n requires W != null;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA256DoneComputingWs(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n ensures IsSHA256ReadyForStep(next_z, SHA256_vars_to_state(M, words, H, W, next_atoh, num_blocks), currentBlock, 0);\r\n ensures next_atoh == atoh_c(a_next, b_next, c_next, d_next, e_next, f_next, g_next, h_next);\r\n{\r\n reveal_PartialSHA256TraceHasCorrectatohsOpaque();\r\n a_next, b_next, c_next, d_next, e_next, f_next, g_next, h_next := H[0], H[1], H[2], H[3], H[4], H[5], H[6], H[7];\r\n next_atoh := atoh_c(H[0], H[1], H[2], H[3], H[4], H[5], H[6], H[7]);\r\n next_z := SHA256Trace_c(z.M, z.H, z.W, z.atoh + [[next_atoh]]);\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} ComputeOneStep_SHA256(M:array, words:int, H:array, W:array, ghost atoh:atoh_Type, num_blocks:int, a:int, b:int, c:int, d:int, e:int, f:int, g:int, h:int,\r\n ghost z:SHA256Trace, currentBlock:int, currentStep:int)\r\n returns (a_next:int, b_next:int, c_next:int, d_next:int, e_next:int, f_next:int, g_next:int, h_next:int, ghost next_atoh:atoh_Type, ghost next_z:SHA256Trace)\r\n requires H != null;\r\n requires W != null;\r\n requires M != null;\r\n requires atoh == atoh_c(a, b, c, d, e, f, g, h);\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires 0 <= currentStep <= 63;\r\n requires IsSHA256ReadyForStep(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock, currentStep);\r\n ensures IsSHA256ReadyForStep(next_z, SHA256_vars_to_state(M, words, H, W, next_atoh, num_blocks), currentBlock, currentStep+1);\r\n\r\n ensures H[..] == old(H[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures W[..] == old(W[..]);\r\n ensures next_atoh == atoh_c(a_next, b_next, c_next, d_next, e_next, f_next, g_next, h_next);\r\n{\r\n assert TBlk(currentBlock) && TBlk(currentBlock + 1) && TStep(currentStep) && TStep(currentStep + 1);\r\n ghost var s := SHA256_vars_to_state(M, words, H, W, atoh, num_blocks);\r\n\r\n var bsig0 := Asm_BitwiseXor(Asm_BitwiseXor(Asm_RotateRight(a, 2), Asm_RotateRight(a, 13)), Asm_RotateRight(a, 22));\r\n calc {\r\n bsig0;\r\n { reveal_BSIG0(); }\r\n BSIG0(a);\r\n }\r\n var bsig1 := Asm_BitwiseXor(Asm_BitwiseXor(Asm_RotateRight(e, 6), Asm_RotateRight(e, 11)), Asm_RotateRight(e, 25));\r\n calc {\r\n bsig1;\r\n { reveal_BSIG1(); }\r\n BSIG1(e);\r\n }\r\n var my_ch := Asm_BitwiseXor(Asm_BitwiseAnd(e, f), Asm_BitwiseAnd(Asm_BitwiseNot(e), g));\r\n calc {\r\n my_ch;\r\n { reveal_Ch(); }\r\n Ch(e, f, g);\r\n }\r\n var my_maj := Asm_BitwiseXor(Asm_BitwiseXor(Asm_BitwiseAnd(a, b), Asm_BitwiseAnd(a, c)), Asm_BitwiseAnd(b, c));\r\n calc {\r\n my_maj;\r\n { reveal_Maj(); }\r\n Maj(a, b, c);\r\n }\r\n\r\n var K := K_SHA256(currentStep);\r\n var T1 := Asm_Add(Asm_Add(Asm_Add(Asm_Add(h, bsig1), my_ch), K), W[currentStep]);\r\n var T2 := Asm_Add(bsig0, my_maj);\r\n a_next, b_next, c_next, d_next, e_next, f_next, g_next, h_next := Asm_Add(T1, T2), a, b, c, Asm_Add(d, T1), e, f, g;\r\n next_atoh := atoh_c(Asm_Add(T1, T2), atoh.a, atoh.b, atoh.c, Asm_Add(atoh.d, T1), atoh.e, atoh.f, atoh.g);\r\n next_z := SHA256Trace_c(z.M, z.H, z.W, z.atoh[..currentBlock] + [z.atoh[currentBlock] + [next_atoh]]);\r\n ghost var next_s := SHA256_vars_to_state(M, words, H, W, next_atoh, num_blocks);\r\n\r\n lemma_SHA256TransitionOKAfterSettingAtoH(z, s, next_z, next_s, currentBlock, currentStep);\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} ComputeHsForBlockStep1_SHA256(a:int, b:int, c:int, d:int, e:int, f:int, g:int, h:int, M:array, words:int, H:array, W:array,\r\n ghost atoh:atoh_Type, num_blocks:int, ghost z:SHA256Trace, currentBlock:int)\r\n requires atoh == atoh_c(a, b, c, d, e, f, g, h);\r\n requires H != null && H.Length == 8;\r\n requires W != null;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA256ReadyForStep(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock, 64);\r\n requires H != W && H != M;\r\n modifies H;\r\n ensures W[..] == old(W[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures forall j :: 0 <= j < 8 ==> Word32(H[j]) && H[j] == Asm_Add(ConvertAtoHToSeq_premium(atoh)[j], old(H[j]));\r\n{\r\n ghost var s := SHA256_vars_to_state(M, words, H, W, atoh, num_blocks);\r\n ghost var atoh_seq := ConvertAtoHToSeq_premium(atoh);\r\n\r\n H[0], H[1], H[2], H[3], H[4], H[5], H[6], H[7] := Asm_Add(a, H[0]), Asm_Add(b, H[1]), Asm_Add(c, H[2]),\r\n Asm_Add(d, H[3]), Asm_Add(e, H[4]), Asm_Add(f, H[5]),\r\n Asm_Add(g, H[6]), Asm_Add(h, H[7]);\r\n\r\n forall j | 0 <= j < 8\r\n ensures Word32(H[j]);\r\n ensures H[j] == Asm_Add(ConvertAtoHToSeq_premium(atoh)[j], s.H[j]);\r\n ensures M[..] == old(M[..]);\r\n ensures W[..] == old(W[..]);\r\n {\r\n ghost var atoh_seq := ConvertAtoHToSeq_premium(atoh);\r\n if j == 0 { assert H[0] == Asm_Add(a, s.H[0]); }\r\n else if j == 1 { assert H[1] == Asm_Add(b, s.H[1]); }\r\n else if j == 2 { assert H[2] == Asm_Add(c, s.H[2]); }\r\n else if j == 3 { assert H[3] == Asm_Add(d, s.H[3]); }\r\n else if j == 4 { assert H[4] == Asm_Add(e, s.H[4]); }\r\n else if j == 5 { assert H[5] == Asm_Add(f, s.H[5]); }\r\n else if j == 6 { assert H[6] == Asm_Add(g, s.H[6]); }\r\n else if j == 7 { assert H[7] == Asm_Add(h, s.H[7]); }\r\n }\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} ComputeHsForBlock_SHA256(M:array, words:int, H:array, W:array, ghost atoh:atoh_Type,\r\n num_blocks:int, ghost z:SHA256Trace, currentBlock:int,\r\n a:int, b:int, c:int, d:int, e:int, f:int, g:int, h:int)\r\n returns (ghost next_z:SHA256Trace)\r\n requires atoh == atoh_c(a, b, c, d, e, f, g, h);\r\n requires H != null && H.Length == 8;\r\n requires W != null;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA256ReadyForStep(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock, 64);\r\n requires H != W && H != M;\r\n modifies H;\r\n ensures W[..] == old(W[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures IsSHA256ReadyForBlock(next_z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock+1);\r\n{\r\n ghost var s := SHA256_vars_to_state(M, words, H, W, atoh, num_blocks);\r\n\r\n ComputeHsForBlockStep1_SHA256(a, b, c, d, e, f, g, h, M, words, H, W, atoh, num_blocks, z, currentBlock);\r\n\r\n next_z := SHA256Trace_c(z.M, z.H + [H[..]], z.W, z.atoh);\r\n ghost var next_s := SHA256_vars_to_state(M, words, H, W, atoh, num_blocks);\r\n\r\n lemma_SHA256TransitionOKAfterSettingHs(z, s, next_z, next_s, currentBlock);\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} PerformOneBlockOfSHA256Computation(M:array, words:int, H:array, W:array,\r\n ghost atoh:atoh_Type, num_blocks:int, ghost z:SHA256Trace, currentBlock:int)\r\n returns (ghost next_atoh:atoh_Type, ghost next_z:SHA256Trace)\r\n requires H != null && H.Length == 8;\r\n requires W != null && W.Length == 64;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA256ReadyForBlock(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n requires W != H && W != M && H != M;\r\n modifies H;\r\n modifies W;\r\n ensures M[..] == old(M[..]);\r\n ensures IsSHA256ReadyForBlock(next_z, SHA256_vars_to_state(M, words, H, W, next_atoh, num_blocks), currentBlock+1);\r\n{\r\n var current_z := ComputeWsForBlock_SHA256_original(M, words, H, W, atoh, num_blocks, z, currentBlock);\r\n ghost var current_atoh:atoh_Type;\r\n var local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h;\r\n local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h, current_atoh, current_z := ComputeInitialAtoHForBlock_SHA256(M, words, H, W, atoh, num_blocks, current_z, currentBlock);\r\n var t := 0;\r\n while t < 64\r\n invariant 0 <= t <= 64;\r\n invariant M[..] == old(M[..]);\r\n invariant current_atoh == atoh_c(local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h);\r\n invariant IsSHA256ReadyForStep(current_z, SHA256_vars_to_state(M, words, H, W, current_atoh, num_blocks), currentBlock, t);\r\n {\r\n local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h, current_atoh, current_z := ComputeOneStep_SHA256(M, words, H, W, current_atoh, num_blocks, local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h, current_z, currentBlock, t);\r\n t := t + 1;\r\n }\r\n\r\n current_z := ComputeHsForBlock_SHA256(M, words, H, W, current_atoh, num_blocks, current_z, currentBlock, local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h);\r\n\r\n next_atoh := current_atoh;\r\n next_z := current_z;\r\n}\r\n\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} PerformOneBlockOfSHA256Computation_optimized(M:array, words:int, H:array, W:array,\r\n ghost atoh:atoh_Type, num_blocks:int, ghost z:SHA256Trace, currentBlock:int)\r\n returns (ghost next_atoh:atoh_Type, ghost next_z:SHA256Trace)\r\n requires H != null && H.Length == 8;\r\n requires W != null && W.Length == 64;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA256ReadyForBlock(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n requires W != H && W != M && H != M;\r\n modifies H;\r\n modifies W;\r\n ensures M[..] == old(M[..]);\r\n ensures IsSHA256ReadyForBlock(next_z, SHA256_vars_to_state(M, words, H, W, next_atoh, num_blocks), currentBlock+1);\r\n{\r\n var current_z := ComputeWsForBlock_SHA256_optimized(M, words, H, W, atoh, num_blocks, z, currentBlock);\r\n ghost var current_atoh:atoh_Type;\r\n var local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h;\r\n local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h, current_atoh, current_z := ComputeInitialAtoHForBlock_SHA256(M, words, H, W, atoh, num_blocks, current_z, currentBlock);\r\n\r\n local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h, current_atoh, current_z := ComputeSHA256_optimized_loop(M, words, H, W, current_atoh, num_blocks, local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h, current_z, currentBlock);\r\n\r\n current_z := ComputeHsForBlock_SHA256(M, words, H, W, current_atoh, num_blocks, current_z, currentBlock, local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h);\r\n \r\n next_atoh := current_atoh;\r\n next_z := current_z;\r\n}\r\n\r\nstatic lemma Lemma_IsSHA256ReadyForLastBlockImpliesTraceIsCorrect(messageBits:seq, z:SHA256Trace, s:SHA256_state)\r\n requires 0 <= s.num_blocks;\r\n requires IsSHA256ReadyForBlock(z, s, s.num_blocks);\r\n ensures SHA256TraceIsCorrect(z);\r\n{\r\n reveal_PartialSHA256TraceHasCorrectatohsOpaque();\r\n}\r\n\r\nstatic lemma Lemma_IsSHA256Demonstration(messageBits:seq, hash:seq, z:SHA256Trace)\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n requires IsCompleteSHA256Trace(z);\r\n requires z.M == BlockMessageForSHA(PadMessageForSHA_premium(messageBits));\r\n requires SHA256TraceIsCorrect(z);\r\n requires hash == z.H[|z.M|];\r\n ensures IsSHA256(messageBits, hash);\r\n{\r\n}\r\n\r\nstatic lemma Lemma_MessageInSHA256TraceCorrespondsToMessageInArray(M:array, words:int, messageBits:seq, z:SHA256Trace)\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires Mod16(words) == 0;\r\n requires forall i :: 0 <= i < words ==> Word32(M[i]);\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n requires BEWordSeqToBitSeq(M[..words]) == PadMessageForSHA(messageBits);\r\n requires z.M == BreakIntoBlocks(M[..words], 16);\r\n ensures z.M == BlockMessageForSHA(PadMessageForSHA_premium(messageBits));\r\n{\r\n assert |BEWordSeqToBitSeq_premium(M[..words])| == words * 32;\r\n calc {\r\n z.M;\r\n BreakIntoBlocks(M[..words], 16);\r\n { reveal_power2();\r\n lemma_BEDigitSeqToInt_invertibility(power2(32), BEDigitSeqToInt_premium(power2(32), M[..words]), M[..words]); }\r\n BreakIntoBlocks(BEIntToDigitSeq(power2(32), words, BEWordSeqToInt_premium(M[..words])), 16);\r\n { lemma_BEBitSeqToInt_BEWordSeqToBitSeq(M[..words]); }\r\n BreakIntoBlocks(BEIntToDigitSeq(power2(32), words, BEBitSeqToInt(BEWordSeqToBitSeq(M[..words]))), 16);\r\n BreakIntoBlocks(BEIntToDigitSeq(power2(32), words, BEBitSeqToInt(PadMessageForSHA(messageBits))), 16);\r\n { lemma_mul_is_mul_boogie(words, 32); lemma_div_by_multiple(words, 32); assert (words*32)/32 == words; }\r\n BreakIntoBlocks(BEIntToDigitSeq(power2(32), (words*32)/32, BEBitSeqToInt(PadMessageForSHA(messageBits))), 16);\r\n BreakIntoBlocks(BEIntToDigitSeq(power2(32), |BEWordSeqToBitSeq_premium(M[..words])|/32, BEBitSeqToInt(PadMessageForSHA(messageBits))), 16);\r\n BreakIntoBlocks(BEIntToDigitSeq(power2(32), |PadMessageForSHA(messageBits)|/32, BEBitSeqToInt(PadMessageForSHA(messageBits))), 16);\r\n { reveal_BlockMessageForSHA(); lemma_PadMessageForSHA_properties(messageBits); }\r\n BlockMessageForSHA(PadMessageForSHA(messageBits));\r\n }\r\n}\r\n\r\nstatic lemma Lemma_ComputeSHA256AfterPadding(M:array, words:int, ghost messageBits:seq, z:SHA256Trace, s:SHA256_state, hash:seq)\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires Mod16(words) == 0;\r\n requires forall i :: 0 <= i < words ==> Word32(M[i]);\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n requires BEWordSeqToBitSeq(M[..words]) == PadMessageForSHA(messageBits);\r\n requires s.M == M[..words];\r\n requires s.H == hash;\r\n requires 0 <= s.num_blocks;\r\n requires IsSHA256ReadyForBlock(z, s, s.num_blocks);\r\n ensures IsSHA256(messageBits, hash);\r\n{\r\n Lemma_MessageInSHA256TraceCorrespondsToMessageInArray(M, words, messageBits, z);\r\n Lemma_IsSHA256ReadyForLastBlockImpliesTraceIsCorrect(messageBits, z, s);\r\n Lemma_IsSHA256Demonstration(messageBits, hash, z);\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} ComputeSHA256AfterPadding_arrays_original(M:array, words:int, ghost messageBits:seq) returns (hash:array)\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires Mod16(words) == 0;\r\n requires forall i :: 0 <= i < words ==> Word32(M[i]);\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n requires BEWordSeqToBitSeq(M[..words]) == PadMessageForSHA(messageBits);\r\n ensures hash!=null;\r\n ensures IsSHA256(messageBits, hash[..]);\r\n{\r\n //- Initialize arrays for use in computing SHA.\r\n\r\n var H := new int[8];\r\n var W := new int[64];\r\n\r\n //- Initialize state to get ready for first block.\r\n\r\n ghost var atoh:atoh_Type;\r\n var local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h;\r\n var num_blocks:int;\r\n ghost var z:SHA256Trace;\r\n local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h, atoh, num_blocks, z := InitializeVars_SHA256(M, words, H, W);\r\n\r\n //- Loop through the blocks one at a time.\r\n\r\n var currentBlock:int := 0;\r\n while currentBlock < num_blocks\r\n invariant 0 <= currentBlock <= num_blocks;\r\n invariant M[..] == old(M[..]);\r\n invariant BEWordSeqToBitSeq(M[..words]) == PadMessageForSHA(messageBits);\r\n invariant IsSHA256ReadyForBlock(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n {\r\n atoh, z := PerformOneBlockOfSHA256Computation(M, words, H, W, atoh, num_blocks, z, currentBlock);\r\n currentBlock := currentBlock + 1;\r\n }\r\n\r\n //- The final value of H is the desired hash.\r\n\r\n hash := H;\r\n\r\n //- The following is a proof that the hash is correct.\r\n\r\n Lemma_ComputeSHA256AfterPadding(M, words, messageBits, z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), hash[..]);\r\n}\r\n\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} ComputeSHA256AfterPadding_arrays_optimized(M:array, words:int, ghost messageBits:seq) returns (hash:array)\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires Mod16(words) == 0;\r\n requires forall i :: 0 <= i < words ==> Word32(M[i]);\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n requires BEWordSeqToBitSeq(M[..words]) == PadMessageForSHA(messageBits);\r\n ensures hash!=null;\r\n ensures IsSHA256(messageBits, hash[..]);\r\n{\r\n //- Initialize arrays for use in computing SHA.\r\n\r\n var H := new int[8];\r\n var W := new int[64];\r\n\r\n //- Initialize state to get ready for first block.\r\n\r\n ghost var atoh:atoh_Type;\r\n var local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h;\r\n var num_blocks:int;\r\n ghost var z:SHA256Trace;\r\n local_a, local_b, local_c, local_d, local_e, local_f, local_g, local_h, atoh, num_blocks, z := InitializeVars_SHA256(M, words, H, W);\r\n\r\n //- Loop through the blocks one at a time.\r\n\r\n var currentBlock:int := 0;\r\n while currentBlock < num_blocks\r\n invariant 0 <= currentBlock <= num_blocks;\r\n invariant M[..] == old(M[..]);\r\n invariant BEWordSeqToBitSeq(M[..words]) == PadMessageForSHA(messageBits);\r\n invariant IsSHA256ReadyForBlock(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n {\r\n atoh, z := PerformOneBlockOfSHA256Computation_optimized(M, words, H, W, atoh, num_blocks, z, currentBlock);\r\n currentBlock := currentBlock + 1;\r\n }\r\n\r\n //- The final value of H is the desired hash.\r\n\r\n hash := H;\r\n\r\n //- The following is a proof that the hash is correct.\r\n\r\n Lemma_ComputeSHA256AfterPadding(M, words, messageBits, z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), hash[..]);\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} ComputeSHA256AfterPadding_original(M:array, words:int, ghost messageBits:seq) returns (hash:seq)\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires Mod16(words) == 0;\r\n requires forall i :: 0 <= i < words ==> Word32(M[i]);\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n requires BEWordSeqToBitSeq(M[..words]) == PadMessageForSHA(messageBits);\r\n ensures IsSHA256(messageBits, hash);\r\n{\r\n var H := ComputeSHA256AfterPadding_arrays_original(M, words, messageBits);\r\n hash := H[..];\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} ComputeSHA256AfterPadding_optimized(M:array, words:int, ghost messageBits:seq) returns (hash:seq)\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires Mod16(words) == 0;\r\n requires forall i :: 0 <= i < words ==> Word32(M[i]);\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n requires BEWordSeqToBitSeq(M[..words]) == PadMessageForSHA(messageBits);\r\n ensures IsSHA256(messageBits, hash);\r\n{\r\n var H := ComputeSHA256AfterPadding_arrays_optimized(M, words, messageBits);\r\n hash := H[..];\r\n}\r\n\r\nstatic method {:timeLimitMultiplier 5} {:dafnycc_conservative_seq_triggers} SHA256_impl_ArrayInPlace(M:array, bits:int) returns (hash:seq)\r\n requires IsWordArray(M);\r\n requires Word32(bits);\r\n requires 0 <= bits < power2(64);\r\n requires 0 <= PaddedLength(bits) <= M.Length * 32;\r\n ensures bits <= M.Length * 32;\r\n ensures IsWordSeqOfLen(hash, 8);\r\n ensures IsSHA256(old(BEWordSeqToBitSeq_premium(M[..])[..bits]), hash);\r\n ensures hash == SHA256(old(BEWordSeqToBitSeq_premium(M[..])[..bits]));\r\n modifies M;\r\n{\r\n calc <= { bits; { lemma_PaddedLength_properties(bits); } |BEWordSeqToBitSeq_premium(M[..])|; }\r\n\r\n ghost var messageBits := BEWordSeqToBitSeq_premium(M[..])[..bits];\r\n PadMessageArray(M, bits);\r\n var words := PaddedLength(bits)/32;\r\n\r\n calc {\r\n PadMessageForSHA(messageBits);\r\n BEWordSeqToBitSeq_premium(M[..])[..PaddedLength(bits)];\r\n { lemma_PaddedLength_properties(bits); }\r\n BEWordSeqToBitSeq_premium(M[..])[..words*32];\r\n { lemma_WordSeqToBitSeqChop(M[..], M[..words], M[words..]); }\r\n (BEWordSeqToBitSeq_premium(M[..words]) + BEWordSeqToBitSeq_premium(M[words..]))[..words*32];\r\n BEWordSeqToBitSeq_premium(M[..words])[..words*32];\r\n BEWordSeqToBitSeq_premium(M[..words]);\r\n }\r\n\r\n lemma_mod_words(bits, words);\r\n\r\n hash := ComputeSHA256AfterPadding_optimized(M, words, messageBits);\r\n lemma_SHA256IsAFunction(old(BEWordSeqToBitSeq_premium(M[..])[..bits]), hash);\r\n}\r\n\r\n\r\nstatic method SHA256_impl_Bytes(messageBytes:seq) returns (hash:seq)\r\n requires Word32(|messageBytes|*8);\r\n requires |messageBytes|*8 < power2(64);\r\n requires IsByteSeq(messageBytes);\r\n ensures IsWordSeqOfLen(hash, 8);\r\n ensures IsSHA256(BEByteSeqToBitSeq_premium(messageBytes), hash);\r\n ensures hash == SHA256(BEByteSeqToBitSeq_premium(messageBytes));\r\n{\r\n var M, bits := CreateArrayForSHA(messageBytes);\r\n hash := SHA256_impl_ArrayInPlace(M, bits);\r\n lemma_SHA256IsAFunction(BEByteSeqToBitSeq_premium(messageBytes), hash);\r\n}\r\n\r\nstatic method SHA256_impl_Bytes_arrays_original(messageBytes:array) returns (hash:array)\r\n requires messageBytes != null;\r\n requires Word32(messageBytes.Length*8);\r\n requires messageBytes.Length*8 < power2(64);\r\n requires IsByteSeq(messageBytes[..]);\r\n ensures hash != null;\r\n ensures IsWordSeqOfLen(hash[..], 8);\r\n ensures IsSHA256(BEByteSeqToBitSeq_premium(messageBytes[..]), hash[..]);\r\n ensures hash[..] == SHA256(BEByteSeqToBitSeq_premium(messageBytes[..]));\r\n ensures messageBytes[..] == old(messageBytes[..]);\r\n{\r\n var M, bits := CreateArrayForSHA_arrays(messageBytes);\r\n ghost var Minput_seq := M[..];\r\n assert BEByteSeqToBitSeq_premium(messageBytes[..]) == BEWordSeqToBitSeq(Minput_seq)[..bits];\r\n\r\n ghost var messageBits := BEWordSeqToBitSeq_premium(M[..])[..bits];\r\n PadMessageArray(M, bits);\r\n var words := PaddedLength(bits)/32;\r\n \r\n calc {\r\n PadMessageForSHA(messageBits);\r\n BEWordSeqToBitSeq_premium(M[..])[..PaddedLength(bits)];\r\n { lemma_PaddedLength_properties(bits); }\r\n BEWordSeqToBitSeq_premium(M[..])[..words*32];\r\n { lemma_WordSeqToBitSeqChop(M[..], M[..words], M[words..]); }\r\n (BEWordSeqToBitSeq_premium(M[..words]) + BEWordSeqToBitSeq_premium(M[words..]))[..words*32];\r\n BEWordSeqToBitSeq_premium(M[..words])[..words*32];\r\n BEWordSeqToBitSeq_premium(M[..words]);\r\n }\r\n\r\n lemma_mod_words(bits, words);\r\n\r\n hash := ComputeSHA256AfterPadding_arrays_original(M, words, messageBits);\r\n ghost var hash_seq := hash[..];\r\n ghost var messageBytes_seq := old(messageBytes)[..];\r\n assert IsSHA256(messageBits, hash_seq);\r\n lemma_SHA_impl_Bytes_arrays_bitmangle(old(messageBytes), messageBytes_seq, messageBits, Minput_seq, bits);\r\n assert IsSHA256(BEByteSeqToBitSeq_premium(messageBytes_seq), hash_seq);\r\n lemma_SHA256IsAFunction(BEByteSeqToBitSeq_premium(messageBytes_seq), hash_seq);\r\n}\r\n\r\n\r\nstatic method SHA256_impl_Words_arrays_original(messageWords:array) returns (hash:array)\r\n requires messageWords != null;\r\n requires Word32(messageWords.Length*32);\r\n requires messageWords.Length*32 < power2(64);\r\n requires IsWordSeq(messageWords[..]);\r\n ensures hash != null;\r\n ensures IsWordSeqOfLen(hash[..], 8);\r\n ensures IsSHA256(BEWordSeqToBitSeq_premium(messageWords[..]), hash[..]);\r\n ensures hash[..] == SHA256(BEWordSeqToBitSeq_premium(messageWords[..]));\r\n ensures messageWords[..] == old(messageWords[..]);\r\n{\r\n var M, bits := CreateArrayForSHA_arrays_words(messageWords);\r\n ghost var Minput_seq := M[..];\r\n assert BEWordSeqToBitSeq_premium(messageWords[..]) == BEWordSeqToBitSeq(Minput_seq)[..bits];\r\n\r\n ghost var messageBits := BEWordSeqToBitSeq_premium(M[..])[..bits];\r\n PadMessageArray(M, bits);\r\n var words := PaddedLength(bits)/32;\r\n \r\n calc {\r\n PadMessageForSHA(messageBits);\r\n BEWordSeqToBitSeq_premium(M[..])[..PaddedLength(bits)];\r\n { lemma_PaddedLength_properties(bits); }\r\n BEWordSeqToBitSeq_premium(M[..])[..words*32];\r\n { lemma_WordSeqToBitSeqChop(M[..], M[..words], M[words..]); }\r\n (BEWordSeqToBitSeq_premium(M[..words]) + BEWordSeqToBitSeq_premium(M[words..]))[..words*32];\r\n BEWordSeqToBitSeq_premium(M[..words])[..words*32];\r\n BEWordSeqToBitSeq_premium(M[..words]);\r\n }\r\n\r\n lemma_mod_words(bits, words);\r\n\r\n hash := ComputeSHA256AfterPadding_arrays_original(M, words, messageBits);\r\n ghost var hash_seq := hash[..];\r\n ghost var messageWords_seq := old(messageWords)[..];\r\n assert IsSHA256(messageBits, hash_seq);\r\n lemma_SHA_impl_Words_arrays_bitmangle(old(messageWords), messageWords_seq, messageBits, Minput_seq, bits);\r\n assert IsSHA256(BEWordSeqToBitSeq_premium(messageWords_seq), hash_seq);\r\n lemma_SHA256IsAFunction(BEWordSeqToBitSeq_premium(messageWords_seq), hash_seq);\r\n}\r\n\r\n\r\nstatic method SHA256_impl_Bytes_arrays(messageBytes:array) returns (hash:array)\r\n requires messageBytes != null;\r\n requires Word32(messageBytes.Length*8);\r\n requires messageBytes.Length*8 < power2(64);\r\n requires IsByteSeq(messageBytes[..]);\r\n ensures hash != null;\r\n ensures IsWordSeqOfLen(hash[..], 8);\r\n ensures IsSHA256(BEByteSeqToBitSeq_premium(messageBytes[..]), hash[..]);\r\n ensures hash[..] == SHA256(BEByteSeqToBitSeq_premium(messageBytes[..]));\r\n ensures messageBytes[..] == old(messageBytes[..]);\r\n{\r\n var M, bits := CreateArrayForSHA_arrays(messageBytes);\r\n ghost var Minput_seq := M[..];\r\n assert BEByteSeqToBitSeq_premium(messageBytes[..]) == BEWordSeqToBitSeq(Minput_seq)[..bits];\r\n\r\n ghost var messageBits := BEWordSeqToBitSeq_premium(M[..])[..bits];\r\n PadMessageArray(M, bits);\r\n var words := PaddedLength(bits)/32;\r\n \r\n calc {\r\n PadMessageForSHA(messageBits);\r\n BEWordSeqToBitSeq_premium(M[..])[..PaddedLength(bits)];\r\n { lemma_PaddedLength_properties(bits); }\r\n BEWordSeqToBitSeq_premium(M[..])[..words*32];\r\n { lemma_WordSeqToBitSeqChop(M[..], M[..words], M[words..]); }\r\n (BEWordSeqToBitSeq_premium(M[..words]) + BEWordSeqToBitSeq_premium(M[words..]))[..words*32];\r\n BEWordSeqToBitSeq_premium(M[..words])[..words*32];\r\n BEWordSeqToBitSeq_premium(M[..words]);\r\n }\r\n\r\n lemma_mod_words(bits, words);\r\n\r\n hash := ComputeSHA256AfterPadding_arrays_optimized(M, words, messageBits);\r\n ghost var hash_seq := hash[..];\r\n ghost var messageBytes_seq := old(messageBytes)[..];\r\n assert IsSHA256(messageBits, hash_seq);\r\n lemma_SHA_impl_Bytes_arrays_bitmangle(old(messageBytes), messageBytes_seq, messageBits, Minput_seq, bits);\r\n assert IsSHA256(BEByteSeqToBitSeq_premium(messageBytes_seq), hash_seq);\r\n lemma_SHA256IsAFunction(BEByteSeqToBitSeq_premium(messageBytes_seq), hash_seq);\r\n}\r\n\r\n\r\nstatic method SHA256_impl_Words_arrays(messageWords:array) returns (hash:array)\r\n requires messageWords != null;\r\n requires Word32(messageWords.Length*32);\r\n requires messageWords.Length*32 < power2(64);\r\n requires IsWordSeq(messageWords[..]);\r\n ensures hash != null;\r\n ensures IsWordSeqOfLen(hash[..], 8);\r\n ensures IsSHA256(BEWordSeqToBitSeq_premium(messageWords[..]), hash[..]);\r\n ensures hash[..] == SHA256(BEWordSeqToBitSeq_premium(messageWords[..]));\r\n ensures messageWords[..] == old(messageWords[..]);\r\n{\r\n var M, bits := CreateArrayForSHA_arrays_words(messageWords);\r\n ghost var Minput_seq := M[..];\r\n assert BEWordSeqToBitSeq_premium(messageWords[..]) == BEWordSeqToBitSeq(Minput_seq)[..bits];\r\n\r\n ghost var messageBits := BEWordSeqToBitSeq_premium(M[..])[..bits];\r\n PadMessageArray(M, bits);\r\n var words := PaddedLength(bits)/32;\r\n \r\n calc {\r\n PadMessageForSHA(messageBits);\r\n BEWordSeqToBitSeq_premium(M[..])[..PaddedLength(bits)];\r\n { lemma_PaddedLength_properties(bits); }\r\n BEWordSeqToBitSeq_premium(M[..])[..words*32];\r\n { lemma_WordSeqToBitSeqChop(M[..], M[..words], M[words..]); }\r\n (BEWordSeqToBitSeq_premium(M[..words]) + BEWordSeqToBitSeq_premium(M[words..]))[..words*32];\r\n BEWordSeqToBitSeq_premium(M[..words])[..words*32];\r\n BEWordSeqToBitSeq_premium(M[..words]);\r\n }\r\n\r\n lemma_mod_words(bits, words);\r\n\r\n hash := ComputeSHA256AfterPadding_arrays_optimized(M, words, messageBits);\r\n ghost var hash_seq := hash[..];\r\n ghost var messageWords_seq := old(messageWords)[..];\r\n assert IsSHA256(messageBits, hash_seq);\r\n lemma_SHA_impl_Words_arrays_bitmangle(old(messageWords), messageWords_seq, messageBits, Minput_seq, bits);\r\n assert IsSHA256(BEWordSeqToBitSeq_premium(messageWords_seq), hash_seq);\r\n lemma_SHA256IsAFunction(BEWordSeqToBitSeq_premium(messageWords_seq), hash_seq);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/sha256.s.dfy", "content": "include \"sha_common.s.dfy\"\r\ninclude \"hmac_common.s.dfy\"\r\n\r\nstatic function method{:opaque} K_SHA256(t: int) : int\r\n requires 0 <= t <= 63;\r\n ensures Word32(K_SHA256(t));\r\n{\r\n /*call_lemma:*/lemma_power2_32();\r\n if t < 8 then OneOf8(t - 0 , 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5)\r\n else if t < 16 then OneOf8(t - 8 , 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174)\r\n else if t < 24 then OneOf8(t - 16, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da)\r\n else if t < 32 then OneOf8(t - 24, 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967)\r\n else if t < 40 then OneOf8(t - 32, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85)\r\n else if t < 48 then OneOf8(t - 40, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070)\r\n else if t < 56 then OneOf8(t - 48, 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3)\r\n else OneOf8(t - 56, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2)\r\n/* causes excessive run-time allocation in current dafnycc implementation:\r\n [0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,\r\n 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,\r\n 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,\r\n 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,\r\n 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,\r\n 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,\r\n 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\r\n 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2][t]\r\n*/\r\n}\r\n\r\nstatic function method{:opaque} InitialH_SHA256(j: int) : int\r\n requires 0 <= j <= 7;\r\n ensures Word32(InitialH_SHA256(j));\r\n{\r\n /*call_lemma:*/lemma_power2_32();\r\n OneOf8(j, 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19)\r\n//- [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19][j]\r\n}\r\n\r\n//- The fields of a SHA256Trace have the following meanings:\r\n//-\r\n//- M[blk][i] = word #i of message block #blk\r\n//- W[blk][t] = W_t during processing of message block #blk\r\n//- H[blk][j] = H_j before processing message block #blk\r\n//- atoh[blk][t].a = a before step t of processing of message block #blk\r\n//- ...\r\n//- atoh[blk][t].h = h before step t of processing message block #blk\r\n\r\ndatatype atoh_Type = atoh_c(a:int, b:int, c:int, d:int, e:int, f:int, g:int, h:int);\r\ndatatype SHA256Trace = SHA256Trace_c(M:seq>, H:seq>, W:seq>, atoh:seq>);\r\n\r\nstatic predicate IsAToHWordSeqOfLen(vs:seq, len:int)\r\n{\r\n |vs| == len &&\r\n forall i :: 0 <= i < len ==> Word32(vs[i].a) && Word32(vs[i].b) && Word32(vs[i].c) && Word32(vs[i].d) &&\r\n Word32(vs[i].e) && Word32(vs[i].f) && Word32(vs[i].g) && Word32(vs[i].h)\r\n}\r\n\r\nstatic function ConvertAtoHToSeq(v:atoh_Type) : seq\r\n{\r\n [v.a, v.b, v.c, v.d, v.e, v.f, v.g, v.h]\r\n}\r\n\r\nstatic predicate IsCompleteSHA256Trace(z:SHA256Trace)\r\n{\r\n (forall i :: 0 <= i < |z.M| ==> IsWordSeqOfLen(z.M[i], 16)) &&\r\n |z.H| == |z.M| + 1 &&\r\n |z.W| == |z.atoh| == |z.M| &&\r\n (forall blk :: 0 <= blk < |z.M| ==> IsWordSeqOfLen(z.W[blk], 64)) &&\r\n (forall blk :: 0 <= blk < |z.M| ==> IsAToHWordSeqOfLen(z.atoh[blk], 65)) &&\r\n (forall blk :: 0 <= blk <= |z.M| ==> IsWordSeqOfLen(z.H[blk], 8))\r\n}\r\n\r\nstatic predicate SHA256TraceHasCorrectHs(z:SHA256Trace)\r\n requires IsCompleteSHA256Trace(z);\r\n{\r\n (forall j :: 0 <= j < 8 ==> z.H[0][j] == InitialH_SHA256(j)) &&\r\n (forall blk {:trigger TBlk(blk)} :: TBlk(blk) ==> forall j ::\r\n 0 <= blk < |z.M| && 0 <= j < 8 ==> z.H[blk+1][j] == Add32(ConvertAtoHToSeq(z.atoh[blk][64])[j], z.H[blk][j]))\r\n}\r\n\r\nstatic predicate SHA256TraceHasCorrectWs(z:SHA256Trace)\r\n requires IsCompleteSHA256Trace(z);\r\n{\r\n forall blk ::\r\n 0 <= blk < |z.M| ==>\r\n forall t {:trigger TStep(t)} :: TStep(t) ==>\r\n (0 <= t <= 15 ==> z.W[blk][t] == z.M[blk][t]) &&\r\n (16 <= t <= 63 ==> z.W[blk][t] == Add32(Add32(Add32(SSIG1(z.W[blk][t-2]), z.W[blk][t-7]), SSIG0(z.W[blk][t-15])),\r\n z.W[blk][t-16]))\r\n}\r\n\r\nstatic predicate SHA256TraceHasCorrectatohs(z:SHA256Trace)\r\n requires IsCompleteSHA256Trace(z);\r\n{\r\n forall blk :: 0 <= blk < |z.M| ==>\r\n ConvertAtoHToSeq(z.atoh[blk][0]) == z.H[blk] &&\r\n forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t <= 63 ==>\r\n (var T1 := Add32(Add32(Add32(Add32(z.atoh[blk][t].h, BSIG1(z.atoh[blk][t].e)),\r\n Ch(z.atoh[blk][t].e, z.atoh[blk][t].f, z.atoh[blk][t].g)), K_SHA256(t)),\r\n z.W[blk][t]);\r\n var T2 := Add32(BSIG0(z.atoh[blk][t].a), Maj(z.atoh[blk][t].a, z.atoh[blk][t].b, z.atoh[blk][t].c));\r\n z.atoh[blk][t+1].h == z.atoh[blk][t].g &&\r\n z.atoh[blk][t+1].g == z.atoh[blk][t].f &&\r\n z.atoh[blk][t+1].f == z.atoh[blk][t].e &&\r\n z.atoh[blk][t+1].e == Add32(z.atoh[blk][t].d, T1) &&\r\n z.atoh[blk][t+1].d == z.atoh[blk][t].c &&\r\n z.atoh[blk][t+1].c == z.atoh[blk][t].b &&\r\n z.atoh[blk][t+1].b == z.atoh[blk][t].a &&\r\n z.atoh[blk][t+1].a == Add32(T1, T2))\r\n}\r\n\r\nstatic predicate {:autoReq} SHA256TraceIsCorrect(z:SHA256Trace)\r\n{\r\n SHA256TraceHasCorrectHs(z) && SHA256TraceHasCorrectWs(z) && SHA256TraceHasCorrectatohs(z)\r\n}\r\n\r\nstatic predicate {:autoReq} IsSHA256(messageBits:seq, hash:seq)\r\n{\r\n exists z:SHA256Trace ::\r\n IsCompleteSHA256Trace(z) &&\r\n z.M == BlockMessageForSHA(PadMessageForSHA(messageBits)) &&\r\n SHA256TraceIsCorrect(z) &&\r\n hash == z.H[|z.M|]\r\n}\r\n\r\nstatic function {:axiom} SHA256(messageBits:seq) : seq\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n ensures IsWordSeqOfLen(SHA256(messageBits), 8);\r\n\r\nstatic lemma {:axiom} lemma_SHA256IsAFunction(messageBits:seq, hash:seq)\r\n requires IsBitSeq(messageBits);\r\n requires |messageBits| < power2(64);\r\n requires IsWordSeqOfLen(hash, 8);\r\n requires IsSHA256(messageBits, hash);\r\n ensures SHA256(messageBits) == hash;\r\n\r\nstatic function {:autoReq} HMAC_SHA256(k:seq, m:seq) : seq\r\n{\r\n SHA256(SeqXor(k, Opad(512)) + BEWordSeqToBitSeq(SHA256(SeqXor(k, Ipad(512)) + m)))\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/sha256_hmac.i.dfy", "content": "include \"sha_common.s.dfy\"\r\ninclude \"hmac_common.s.dfy\"\r\ninclude \"sha256.i.dfy\"\r\ninclude \"hmac_common.i.dfy\"\r\ninclude \"../../Util/arrays_and_seqs.i.dfy\"\r\n\r\nmethod HMAC_SHA256_inner_hash(key: array, data: array, len: int) returns (hash: array)\r\n requires Word32(len);\r\n requires IsWordArray(key);\r\n requires key.Length == 16;\r\n requires len <= power2(32) - 1 - 512;\r\n requires IsWordArray(data);\r\n requires 0 <= data.Length;\r\n requires 0 <= len <= data.Length * 32;\r\n ensures fresh(hash);\r\n ensures key[..] == old(key[..]);\r\n ensures data[..] == old(data[..]);\r\n ensures IsWordArray(hash);\r\n ensures Mod32_const(512) == 0;\r\n ensures IsSHA256(SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512)) + BEWordSeqToBitSeq_premium(data[..])[..len], hash[..]);\r\n{\r\n var input := HMAC_inner_input(key, data, len);\r\n assert data[..] == old(data[..]);\r\n assert key[..] == old(key[..]);\r\n lemma_2toX();\r\n ghost var old_input := BEWordSeqToBitSeq_premium(input[..])[..len+512];\r\n\r\n calc {\r\n old_input;\r\n BEWordSeqToBitSeq_premium(input[..])[..len+512];\r\n (SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512)) + BEWordSeqToBitSeq_premium(data[..]) +\r\n BEWordSeqToBitSeq_premium(input[16+data.Length..]))[..len+512];\r\n { assert |SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512))| == 512; }\r\n { assert |BEWordSeqToBitSeq_premium(data[..])| >= len; } //- == |data[..]|*32;\r\n SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512)) + BEWordSeqToBitSeq_premium(data[..])[..len];\r\n }\r\n\r\n var hash_seq := SHA256_impl_ArrayInPlace(input, len+512);\r\n hash := SeqToArray(hash_seq);\r\n lemma_Mod32_const(512);\r\n}\r\n\r\nmethod HMAC_SHA256_impl_Array(key: array, data: array, len: int) returns (hash: seq)\r\n requires Word32(len);\r\n requires IsWordArray(key);\r\n requires key.Length == 16;\r\n requires len <= power2(32) - 1 - 512;\r\n requires data != null;\r\n requires 0 <= len <= data.Length * 32;\r\n requires IsWordArray(data);\r\n ensures IsWordSeqOfLen(hash, 8);\r\n ensures key[..] == old(key[..]);\r\n ensures data[..] == old(data[..]);\r\n ensures var k := BEWordSeqToBitSeq_premium(key[..]);\r\n var m := BEWordSeqToBitSeq_premium(data[..])[..len];\r\n IsBitSeqOfLen(k, 512) &&\r\n IsBitSeqOfLen(Ipad(512), 512) &&\r\n IsBitSeq(SeqXor(k, Ipad(512)) + m) &&\r\n |SeqXor(k, Ipad(512)) + m| < power2(64) &&\r\n IsBitSeqOfLen(Opad(512), 512) &&\r\n IsBitSeq(SeqXor(k, Opad(512)) + BEWordSeqToBitSeq(SHA256(SeqXor(k, Ipad(512)) + m))) &&\r\n |SeqXor(k, Opad(512)) + BEWordSeqToBitSeq(SHA256(SeqXor(k, Ipad(512)) + m))| < power2(64) &&\r\n hash == HMAC_SHA256(k, m);\r\n{\r\n var inner_hash := HMAC_SHA256_inner_hash(key, data, len);\r\n assert key[..] == old( key[..]);\r\n assert data[..] == old(data[..]);\r\n lemma_2toX();\r\n reveal_Mod32_const();\r\n lemma_SHA256IsAFunction(SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512)) + BEWordSeqToBitSeq_premium(data[..])[..len],\r\n inner_hash[..]);\r\n assert inner_hash[..] == SHA256(SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512)) + BEWordSeqToBitSeq_premium(data[..])[..len]);\r\n ghost var old_inner_hash := inner_hash[..];\r\n\r\n var input := HMAC_outer_input(key, inner_hash);\r\n assert old_inner_hash == inner_hash[..];\r\n assert key[..] == old( key[..]);\r\n assert data[..] == old(data[..]);\r\n ghost var original_input := input[..];\r\n\r\n var bit_len := 32*(key.Length + inner_hash.Length);\r\n assert old_inner_hash == inner_hash[..];\r\n assert key[..] == old( key[..]);\r\n assert data[..] == old(data[..]);\r\n assert input[..] == original_input;\r\n ghost var old_input := BEWordSeqToBitSeq_premium(input[..])[..bit_len];\r\n\r\n calc {\r\n old_input;\r\n BEWordSeqToBitSeq_premium(input[..])[..bit_len];\r\n (SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Opad_premium(512)) +\r\n BEWordSeqToBitSeq_premium(inner_hash[..]) + BEWordSeqToBitSeq_premium(input[16+8..]))[..bit_len];\r\n (SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Opad_premium(512)) +\r\n BEWordSeqToBitSeq_premium(inner_hash[..]))[..bit_len];\r\n SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Opad_premium(512)) + BEWordSeqToBitSeq_premium(inner_hash[..]);\r\n SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Opad_premium(512)) +\r\n BEWordSeqToBitSeq_premium(SHA256(SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512)) +\r\n BEWordSeqToBitSeq_premium(data[..])[..len]));\r\n }\r\n\r\n hash := SHA256_impl_ArrayInPlace(input, bit_len);\r\n assert hash == SHA256(old_input);\r\n assert old_inner_hash == inner_hash[..];\r\n assert key[..] == old( key[..]);\r\n assert data[..] == old(data[..]);\r\n\r\n ghost var k := BEWordSeqToBitSeq_premium(key[..]);\r\n ghost var m := BEWordSeqToBitSeq_premium(data[..])[..len];\r\n calc {\r\n hash;\r\n SHA256(old_input);\r\n SHA256(SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Opad_premium(512)) + BEWordSeqToBitSeq_premium(SHA256(SeqXor_premium(BEWordSeqToBitSeq_premium(key[..]), Ipad_premium(512)) + BEWordSeqToBitSeq_premium(data[..])[..len])));\r\n { assert BEWordSeqToBitSeq_premium(key[..])[..key.Length*32] == BEWordSeqToBitSeq_premium(key[..]); }\r\n SHA256(SeqXor_premium(k, Opad_premium(|k|)) + BEWordSeqToBitSeq_premium(SHA256(SeqXor_premium(k, Ipad_premium(|k|)) + m)));\r\n HMAC_SHA256(k, m);\r\n }\r\n}\r\n\r\nmethod HMAC_SHA256_impl_Seqs(keyBytes: seq, dataBytes: seq) returns (hash: seq)\r\n requires Word32(|dataBytes|*8);\r\n requires IsByteSeq(keyBytes);\r\n requires |keyBytes| <= 64;\r\n requires |dataBytes|*8 <= power2(32) - 1 - 512;\r\n requires IsByteSeq(dataBytes);\r\n ensures IsWordSeqOfLen(hash, 8);\r\n ensures var k := BEByteSeqToBitSeq_premium(keyBytes + RepeatDigit_premium(0, 64 - |keyBytes|));\r\n var m := BEByteSeqToBitSeq_premium(dataBytes);\r\n IsBitSeqOfLen(k, 512) &&\r\n IsBitSeqOfLen(Ipad(512), 512) &&\r\n IsBitSeq(SeqXor(k, Ipad(512)) + m) &&\r\n |SeqXor(k, Ipad(512)) + m| < power2(64) &&\r\n IsBitSeqOfLen(Opad(512), 512) &&\r\n IsBitSeq(SeqXor(k, Opad(512)) + BEWordSeqToBitSeq(SHA256(SeqXor(k, Ipad(512)) + m))) &&\r\n |SeqXor(k, Opad(512)) + BEWordSeqToBitSeq(SHA256(SeqXor(k, Ipad(512)) + m))| < power2(64) &&\r\n hash == HMAC_SHA256(k, m);\r\n{\r\n var requiredKeyBytePadding := RepeatDigit_impl(0, 64 - |keyBytes|);\r\n var keyBytesPadded := keyBytes + requiredKeyBytePadding;\r\n var keyWords, padbytes := BEByteSeqToWordSeq_impl(keyBytesPadded);\r\n var keyArray := SeqToArray(keyWords);\r\n var dataWords := BEByteSeqToWordSeqTailPadding(dataBytes);\r\n var dataArray := SeqToArray(dataWords);\r\n var len := |dataBytes|*8;\r\n calc {\r\n len;\r\n |dataBytes|*8;\r\n <= |BEWordSeqToBitSeq_premium(dataWords)|;\r\n |dataWords| * 32;\r\n dataArray.Length * 32;\r\n }\r\n calc {\r\n keyArray.Length;\r\n |keyWords|;\r\n |keyBytesPadded| / 4;\r\n (|keyBytes| + 64 - |keyBytes|) / 4;\r\n 64 / 4;\r\n 16;\r\n }\r\n hash := HMAC_SHA256_impl_Array(keyArray, dataArray, len);\r\n\r\n lemma_2toX();\r\n ghost var k := BEByteSeqToBitSeq_premium(keyBytesPadded);\r\n ghost var m := BEByteSeqToBitSeq_premium(dataBytes);\r\n reveal_Mod32_const();\r\n assert IsBitSeqOfLen(k, 512);\r\n assert IsBitSeqOfLen(Ipad_premium(512), 512);\r\n assert IsBitSeq(SeqXor_premium(k, Ipad_premium(512)) + m);\r\n assert |SeqXor_premium(k, Ipad_premium(512)) + m| < power2(64);\r\n assert IsBitSeqOfLen(Opad_premium(512), 512);\r\n assert IsBitSeq(SeqXor_premium(k, Opad_premium(512)) + BEWordSeqToBitSeq_premium(SHA256(SeqXor_premium(k, Ipad_premium(512)) + m)));\r\n assert |SeqXor_premium(k, Opad_premium(512)) + BEWordSeqToBitSeq_premium(SHA256(SeqXor_premium(k, Ipad_premium(512)) + m))|\r\n < power2(64);\r\n calc {\r\n hash;\r\n HMAC_SHA256(BEWordSeqToBitSeq_premium(keyArray[..]), BEWordSeqToBitSeq_premium(dataArray[..])[..len]);\r\n { assert keyWords == keyArray[..]; }\r\n HMAC_SHA256(BEWordSeqToBitSeq_premium(keyWords), BEWordSeqToBitSeq_premium(dataArray[..])[..len]);\r\n HMAC_SHA256(k, BEWordSeqToBitSeq_premium(dataArray[..])[..len]);\r\n HMAC_SHA256(k, BEByteSeqToBitSeq_premium(dataBytes));\r\n HMAC_SHA256(k, m);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/sha256common.i.dfy", "content": "//- Stuff shared by sha256.i.dfy and sha256opt.i.dfy\r\n\r\ninclude \"sha256.s.dfy\"\r\ninclude \"../../Util/seq_blocking.i.dfy\"\r\ninclude \"../../Util/arrays_and_seqs.i.dfy\"\r\ninclude \"../../Util/integer_sequences_premium.i.dfy\"\r\ninclude \"sha_padding.i.dfy\"\r\ninclude \"sha_common.i.dfy\"\r\ninclude \"../../../Drivers/CPU/assembly_premium.i.dfy\"\r\n\r\nstatic predicate Word32AtoH(v:atoh_Type)\r\n{\r\n Word32(v.a) && Word32(v.b) && Word32(v.c) && Word32(v.d) && Word32(v.e) && Word32(v.f) && Word32(v.g) && Word32(v.h)\r\n}\r\n\r\nstatic predicate IsAToHWordSeq(vs:seq)\r\n{\r\n forall i :: 0 <= i < |vs| ==> Word32AtoH(vs[i])\r\n}\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Intermediate SHA256 state\r\n//-///////////////////////////////////////////////////\r\n\r\ndatatype SHA256_state = SHA256_state_c(M:seq, H:seq, W:seq, atoh:atoh_Type, num_blocks:int);\r\n\r\nstatic function SHA256_vars_to_state(M:array, words:int, H:array, W:array, atoh:atoh_Type, num_blocks:int)\r\n : SHA256_state\r\n requires M != null && H != null && W != null;\r\n requires 0 <= words <= M.Length;\r\n reads M, H, W;\r\n{\r\n SHA256_state_c(M[..words], H[..], W[..], atoh, num_blocks)\r\n}\r\n\r\nstatic predicate PartialSHA256TraceHasCorrectHs(z:SHA256Trace)\r\n{\r\n |z.H| > 0 &&\r\n |z.H| <= |z.atoh|+1 &&\r\n (forall blk :: 0 <= blk < |z.H| ==> IsWordSeqOfLen(z.H[blk], 8)) &&\r\n (forall j :: 0 <= j < 8 ==> z.H[0][j] == InitialH_SHA256(j)) &&\r\n (forall blk {:trigger TBlk(blk)} :: TBlk(blk) && 0 <= blk < |z.H|-1 ==>\r\n IsAToHWordSeqOfLen(z.atoh[blk], 65) &&\r\n forall j :: 0 <= j < 8 ==> z.H[blk+1][j] == Add32(ConvertAtoHToSeq(z.atoh[blk][64])[j], z.H[blk][j]))\r\n}\r\n\r\nstatic predicate PartialSHA256TraceHasCorrectWs(z:SHA256Trace)\r\n{\r\n |z.W| <= |z.M| &&\r\n forall blk :: 0 <= blk < |z.W| ==>\r\n IsWordSeqOfLen(z.W[blk], 64) &&\r\n IsWordSeqOfLen(z.M[blk], 16) &&\r\n forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < 64 ==>\r\n (0 <= t <= 15 ==> z.W[blk][t] == z.M[blk][t]) &&\r\n (16 <= t <= 63 ==> z.W[blk][t] == Add32(Add32(Add32(SSIG1(z.W[blk][t-2]), z.W[blk][t-7]), SSIG0(z.W[blk][t-15])),\r\n z.W[blk][t-16]))\r\n}\r\n\r\nstatic predicate PartialSHA256TraceHasCorrectatohsWf(z:SHA256Trace)\r\n{\r\n |z.atoh| <= |z.H| &&\r\n |z.atoh| <= |z.W| &&\r\n (forall blk :: 0 <= blk < |z.atoh|-1 ==> IsAToHWordSeqOfLen(z.atoh[blk], 65)) &&\r\n forall blk :: 0 <= blk < |z.atoh| ==>\r\n |z.atoh[blk]| <= 65 &&\r\n IsWordSeqOfLen(z.W[blk], 64) &&\r\n IsAToHWordSeq(z.atoh[blk]) &&\r\n (|z.atoh[blk]| > 0 ==> IsWordSeqOfLen(z.H[blk], 8) && ConvertAtoHToSeq(z.atoh[blk][0]) == z.H[blk])\r\n}\r\n\r\nstatic predicate{:opaque} PartialSHA256TraceHasCorrectatohsOpaque(z:SHA256Trace)\r\n{\r\n |z.atoh| <= |z.H| &&\r\n |z.atoh| <= |z.W| &&\r\n (forall blk :: 0 <= blk < |z.atoh|-1 ==> IsAToHWordSeqOfLen(z.atoh[blk], 65)) &&\r\n forall blk :: 0 <= blk < |z.atoh| ==>\r\n |z.atoh[blk]| <= 65 &&\r\n IsWordSeqOfLen(z.W[blk], 64) &&\r\n IsAToHWordSeq(z.atoh[blk]) &&\r\n (|z.atoh[blk]| > 0 ==> IsWordSeqOfLen(z.H[blk], 8) && ConvertAtoHToSeq(z.atoh[blk][0]) == z.H[blk]) &&\r\n forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < |z.atoh[blk]|-1 ==>\r\n var T1 := Add32(Add32(Add32(Add32(z.atoh[blk][t].h, BSIG1(z.atoh[blk][t].e)),\r\n Ch(z.atoh[blk][t].e, z.atoh[blk][t].f, z.atoh[blk][t].g)),\r\n K_SHA256(t)),\r\n z.W[blk][t]);\r\n var T2 := Add32(BSIG0(z.atoh[blk][t].a), Maj(z.atoh[blk][t].a, z.atoh[blk][t].b, z.atoh[blk][t].c));\r\n z.atoh[blk][t+1].h == z.atoh[blk][t].g &&\r\n z.atoh[blk][t+1].g == z.atoh[blk][t].f &&\r\n z.atoh[blk][t+1].f == z.atoh[blk][t].e &&\r\n z.atoh[blk][t+1].e == Add32(z.atoh[blk][t].d, T1) &&\r\n z.atoh[blk][t+1].d == z.atoh[blk][t].c &&\r\n z.atoh[blk][t+1].c == z.atoh[blk][t].b &&\r\n z.atoh[blk][t+1].b == z.atoh[blk][t].a &&\r\n z.atoh[blk][t+1].a == Add32(T1, T2)\r\n}\r\n\r\nstatic predicate PartialSHA256TraceHasCorrectatohs(z:SHA256Trace)\r\n{\r\n PartialSHA256TraceHasCorrectatohsWf(z) && PartialSHA256TraceHasCorrectatohsOpaque(z)\r\n}\r\n\r\nstatic predicate PartialSHA256TraceIsCorrect(z:SHA256Trace)\r\n{\r\n PartialSHA256TraceHasCorrectWs(z) && PartialSHA256TraceHasCorrectHs(z) && PartialSHA256TraceHasCorrectatohs(z)\r\n}\r\n\r\nstatic predicate AreSHA256TraceAndStateOK(z:SHA256Trace, s:SHA256_state)\r\n{\r\n PartialSHA256TraceIsCorrect(z) &&\r\n IsWordSeq(s.M) &&\r\n z.M == BreakIntoBlocks(s.M, 16) &&\r\n (forall i :: 0 <= i < |z.M| ==> IsWordSeqOfLen(z.M[i], 16)) &&\r\n Mul16(|z.M|) == |s.M| &&\r\n |z.M| == s.num_blocks\r\n}\r\n\r\n\r\nstatic predicate IsSHA256ReadyForBlock(z:SHA256Trace, s:SHA256_state, nextBlock:int)\r\n requires 0 <= nextBlock;\r\n{\r\n AreSHA256TraceAndStateOK(z, s) &&\r\n |z.H| == nextBlock + 1 &&\r\n |z.W| == nextBlock &&\r\n |z.atoh| == nextBlock &&\r\n (forall blk :: 0 <= blk < nextBlock ==> IsAToHWordSeqOfLen(z.atoh[blk], 65)) &&\r\n s.H == z.H[nextBlock]\r\n}\r\n\r\nstatic predicate{:opaque} TheAToHsAreOK(z:SHA256Trace, blk: int, t: int)\r\n requires 0 <= t <= 63;\r\n requires 0 <= blk;\r\n requires |z.atoh| > blk;\r\n requires |z.atoh[blk]| > t+1;\r\n requires Word32AtoH(z.atoh[blk][t]);\r\n requires |z.W| > blk;\r\n requires IsWordSeqOfLen(z.W[blk], 64);\r\n{\r\n var T1 := Add32(Add32(Add32(Add32(z.atoh[blk][t].h, BSIG1(z.atoh[blk][t].e)),\r\n Ch(z.atoh[blk][t].e, z.atoh[blk][t].f, z.atoh[blk][t].g)),\r\n K_SHA256(t)),\r\n z.W[blk][t]);\r\n var T2 := Add32(BSIG0(z.atoh[blk][t].a), Maj(z.atoh[blk][t].a, z.atoh[blk][t].b, z.atoh[blk][t].c));\r\n z.atoh[blk][t+1].h == z.atoh[blk][t].g &&\r\n z.atoh[blk][t+1].g == z.atoh[blk][t].f &&\r\n z.atoh[blk][t+1].f == z.atoh[blk][t].e &&\r\n z.atoh[blk][t+1].e == Add32(z.atoh[blk][t].d, T1) &&\r\n z.atoh[blk][t+1].d == z.atoh[blk][t].c &&\r\n z.atoh[blk][t+1].c == z.atoh[blk][t].b &&\r\n z.atoh[blk][t+1].b == z.atoh[blk][t].a &&\r\n z.atoh[blk][t+1].a == Add32(T1, T2)\r\n}\r\n\r\nstatic predicate IsSHA256ReadyForStep(z:SHA256Trace, s:SHA256_state, currentBlock:int, nextStep:int)\r\n requires 0 <= currentBlock;\r\n requires 0 <= nextStep <= 64;\r\n{\r\n AreSHA256TraceAndStateOK(z, s) &&\r\n |z.H| == currentBlock + 1 &&\r\n |z.W| == currentBlock + 1 &&\r\n |z.atoh| == currentBlock + 1 &&\r\n (forall blk :: 0 <= blk < currentBlock ==> IsAToHWordSeqOfLen(z.atoh[blk], 65)) &&\r\n IsAToHWordSeqOfLen(z.atoh[currentBlock], nextStep+1) &&\r\n s.H == z.H[currentBlock] &&\r\n s.W == z.W[currentBlock] &&\r\n s.atoh == z.atoh[currentBlock][nextStep]\r\n}\r\n\r\nstatic lemma lemma_SHA256TransitionOKAfterSettingAtoHStep1Helper1(z:SHA256Trace, blk:int, t:int)\r\n requires 0 <= t <= 63;\r\n requires 0 <= blk;\r\n requires |z.atoh| > blk;\r\n requires |z.atoh[blk]| > t+1;\r\n requires Word32AtoH(z.atoh[blk][t]);\r\n requires |z.W| > blk;\r\n requires IsWordSeqOfLen(z.W[blk], 64);\r\n requires PartialSHA256TraceHasCorrectatohs(z);\r\n ensures TheAToHsAreOK(z, blk, t);\r\n{\r\n assert TBlk(blk) && TStep(t);\r\n reveal_TheAToHsAreOK();\r\n reveal_PartialSHA256TraceHasCorrectatohsOpaque();\r\n}\r\n\r\nstatic lemma Lemma_TheAToHsAreOKIsStable(z1:SHA256Trace, z2:SHA256Trace, blk: int, t: int)\r\n requires 0 <= t <= 63;\r\n requires 0 <= blk;\r\n requires |z1.atoh| == |z2.atoh| > blk;\r\n requires |z1.atoh[blk]| > t+1;\r\n requires |z2.atoh[blk]| > t+1;\r\n requires Word32AtoH(z1.atoh[blk][t]);\r\n requires z1.atoh[blk][t+1] == z2.atoh[blk][t+1];\r\n requires z1.atoh[blk][t] == z2.atoh[blk][t];\r\n requires |z1.W| > blk;\r\n requires z1.W == z2.W;\r\n requires IsWordSeqOfLen(z1.W[blk], 64);\r\n requires TheAToHsAreOK(z1, blk, t);\r\n ensures TheAToHsAreOK(z2, blk, t);\r\n{\r\n reveal_TheAToHsAreOK();\r\n}\r\n\r\nstatic lemma {:timeLimitMultiplier 2} lemma_SHA256TransitionOKAfterSettingAtoHStep1(z1:SHA256Trace, s1:SHA256_state, z2:SHA256Trace, s2:SHA256_state,\r\n currentBlock:int, currentStep:int)\r\n requires TBlk(currentBlock) && TBlk(currentBlock + 1) && TStep(currentStep) && TStep(currentStep + 1);\r\n requires 0 <= currentBlock < |z1.M|;\r\n requires 0 <= currentStep <= 63;\r\n requires IsSHA256ReadyForStep(z1, s1, currentBlock, currentStep);\r\n requires var T1 := Asm_Add(Asm_Add(Asm_Add(Asm_Add(s1.atoh.h, BSIG1(s1.atoh.e)), Ch(s1.atoh.e, s1.atoh.f, s1.atoh.g)),\r\n K_SHA256(currentStep)),\r\n s1.W[currentStep]);\r\n var T2 := Asm_Add(BSIG0(s1.atoh.a), Maj(s1.atoh.a, s1.atoh.b, s1.atoh.c));\r\n s2.atoh.h == s1.atoh.g &&\r\n s2.atoh.g == s1.atoh.f &&\r\n s2.atoh.f == s1.atoh.e &&\r\n s2.atoh.e == Asm_Add(s1.atoh.d, T1) &&\r\n s2.atoh.d == s1.atoh.c &&\r\n s2.atoh.c == s1.atoh.b &&\r\n s2.atoh.b == s1.atoh.a &&\r\n s2.atoh.a == Asm_Add(T1, T2);\r\n requires s2.M == s1.M;\r\n requires s2.H == s1.H;\r\n requires s2.W == s1.W;\r\n requires s2.num_blocks == s1.num_blocks;\r\n requires z2.M == z1.M && z2.H == z1.H && z2.W == z1.W;\r\n requires z2.atoh == z1.atoh[..currentBlock] + [z1.atoh[currentBlock] + [s2.atoh]];\r\n requires |z2.atoh| == |z1.atoh|;\r\n requires forall blk :: 0 <= blk < currentBlock ==> z2.atoh[blk] == z1.atoh[blk];\r\n requires forall t :: 0 <= t < |z1.atoh[currentBlock]| ==> z2.atoh[currentBlock][t] == z1.atoh[currentBlock][t];\r\n requires z2.atoh[currentBlock][|z1.atoh[currentBlock]|] == s2.atoh;\r\n ensures forall blk :: 0 <= blk < |z2.atoh| ==>\r\n |z2.atoh[blk]| <= |z2.W[blk]| + 1 &&\r\n |z2.atoh[blk]| <= 65 &&\r\n IsWordSeq(z2.W[blk]) &&\r\n IsAToHWordSeq(z2.atoh[blk]) &&\r\n (|z2.atoh[blk]| > 0 ==> IsWordSeqOfLen(z2.H[blk], 8) && ConvertAtoHToSeq(z2.atoh[blk][0]) == z2.H[blk]) &&\r\n (forall t :: 0 <= t < |z2.atoh[blk]|-1 ==> TheAToHsAreOK(z2, blk, t));\r\n{\r\n forall blk | TBlk(blk) && 0 <= blk < |z2.atoh|\r\n ensures |z2.atoh[blk]| <= |z2.W[blk]| + 1;\r\n ensures |z2.atoh[blk]| <= 65;\r\n ensures IsWordSeq(z2.W[blk]);\r\n ensures IsAToHWordSeq(z2.atoh[blk]);\r\n ensures (|z2.atoh[blk]| > 0 ==> IsWordSeqOfLen(z2.H[blk], 8) && ConvertAtoHToSeq(z2.atoh[blk][0]) == z2.H[blk]);\r\n ensures forall t :: 0 <= t < |z2.atoh[blk]|-1 ==> TheAToHsAreOK(z2, blk, t);\r\n {\r\n assert |z2.atoh[blk]| <= |z2.W[blk]| + 1;\r\n assert |z2.atoh[blk]| <= 65;\r\n assert IsWordSeq(z2.W[blk]);\r\n\r\n if blk < |z2.atoh|-1 {\r\n assert blk < currentBlock;\r\n assert z2.atoh[blk] == z1.atoh[blk];\r\n assert IsAToHWordSeq(z2.atoh[blk]);\r\n assert (|z2.atoh[blk]| > 0 ==> IsWordSeqOfLen(z2.H[blk], 8) && ConvertAtoHToSeq(z2.atoh[blk][0]) == z2.H[blk]);\r\n forall t | 0 <= t < |z1.atoh[blk]|-1\r\n ensures TheAToHsAreOK(z2, blk, t);\r\n {\r\n lemma_SHA256TransitionOKAfterSettingAtoHStep1Helper1(z1, blk, t);\r\n Lemma_TheAToHsAreOKIsStable(z1, z2, blk, t);\r\n }\r\n assert forall t :: 0 <= t < |z2.atoh[blk]|-1 ==> TheAToHsAreOK(z2, blk, t);\r\n }\r\n else {\r\n assert blk == currentBlock;\r\n assert IsAToHWordSeq(z2.atoh[blk]);\r\n assert (|z2.atoh[blk]| > 0 ==> IsWordSeqOfLen(z2.H[blk], 8) && ConvertAtoHToSeq(z2.atoh[blk][0]) == z2.H[blk]);\r\n forall t | 0 <= t < |z2.atoh[blk]|-1\r\n ensures TheAToHsAreOK(z2, blk, t);\r\n {\r\n if t < |z2.atoh[blk]|-2 {\r\n assert t < currentStep;\r\n lemma_SHA256TransitionOKAfterSettingAtoHStep1Helper1(z1, blk, t);\r\n Lemma_TheAToHsAreOKIsStable(z1, z2, blk, t);\r\n assert TheAToHsAreOK(z2, blk, t);\r\n }\r\n else {\r\n assert t == currentStep;\r\n calc { true; { reveal_TheAToHsAreOK(); } TheAToHsAreOK(z2, blk, t); }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic lemma{:dafnycc_conservative_seq_triggers} lemma_SHA256TransitionOKAfterSettingAtoH(z1:SHA256Trace, s1:SHA256_state, z2:SHA256Trace, s2:SHA256_state,\r\n currentBlock:int, currentStep:int)\r\n requires TBlk(currentBlock) && TBlk(currentBlock + 1) && TStep(currentStep) && TStep(currentStep + 1);\r\n requires 0 <= currentBlock < |z1.M|;\r\n requires 0 <= currentStep <= 63;\r\n requires IsSHA256ReadyForStep(z1, s1, currentBlock, currentStep);\r\n requires var T1 := Asm_Add(Asm_Add(Asm_Add(Asm_Add(s1.atoh.h, BSIG1(s1.atoh.e)), Ch(s1.atoh.e, s1.atoh.f, s1.atoh.g)),\r\n K_SHA256(currentStep)),\r\n s1.W[currentStep]);\r\n var T2 := Asm_Add(BSIG0(s1.atoh.a), Maj(s1.atoh.a, s1.atoh.b, s1.atoh.c));\r\n s2.atoh.h == s1.atoh.g &&\r\n s2.atoh.g == s1.atoh.f &&\r\n s2.atoh.f == s1.atoh.e &&\r\n s2.atoh.e == Asm_Add(s1.atoh.d, T1) &&\r\n s2.atoh.d == s1.atoh.c &&\r\n s2.atoh.c == s1.atoh.b &&\r\n s2.atoh.b == s1.atoh.a &&\r\n s2.atoh.a == Asm_Add(T1, T2);\r\n requires s2.M == s1.M;\r\n requires s2.H == s1.H;\r\n requires s2.W == s1.W;\r\n requires s2.num_blocks == s1.num_blocks;\r\n requires z2 == SHA256Trace_c(z1.M, z1.H, z1.W, z1.atoh[..currentBlock] + [z1.atoh[currentBlock] + [s2.atoh]]);\r\n ensures IsSHA256ReadyForStep(z2, s2, currentBlock, currentStep+1);\r\n{\r\n lemma_SHA256TransitionOKAfterSettingAtoHStep1(z1, s1, z2, s2, currentBlock, currentStep);\r\n\r\n assert forall blk :: 0 <= blk < |z2.atoh| ==>\r\n |z2.atoh[blk]| <= |z2.W[blk]| + 1 &&\r\n |z2.atoh[blk]| <= 65 &&\r\n IsWordSeq(z2.W[blk]) &&\r\n IsAToHWordSeq(z2.atoh[blk]) &&\r\n (|z2.atoh[blk]| > 0 ==> IsWordSeqOfLen(z2.H[blk], 8) && ConvertAtoHToSeq(z2.atoh[blk][0]) == z2.H[blk]) &&\r\n (forall t :: 0 <= t < |z2.atoh[blk]|-1 ==> TheAToHsAreOK(z2, blk, t));\r\n\r\n forall blk | 0 <= blk < |z2.atoh|\r\n ensures IsAToHWordSeq(z2.atoh[blk]);\r\n ensures forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < |z2.atoh[blk]|-1 ==>\r\n Word32AtoH(z2.atoh[blk][t]) &&\r\n var T1 := Asm_Add(Asm_Add(Asm_Add(Asm_Add(z2.atoh[blk][t].h, BSIG1(z2.atoh[blk][t].e)),\r\n Ch(z2.atoh[blk][t].e, z2.atoh[blk][t].f, z2.atoh[blk][t].g)),\r\n K_SHA256(t)),\r\n z2.W[blk][t]);\r\n var T2 := Asm_Add(BSIG0(z2.atoh[blk][t].a), Maj(z2.atoh[blk][t].a, z2.atoh[blk][t].b, z2.atoh[blk][t].c));\r\n z2.atoh[blk][t+1].h == z2.atoh[blk][t].g &&\r\n z2.atoh[blk][t+1].g == z2.atoh[blk][t].f &&\r\n z2.atoh[blk][t+1].f == z2.atoh[blk][t].e &&\r\n z2.atoh[blk][t+1].e == Asm_Add(z2.atoh[blk][t].d, T1) &&\r\n z2.atoh[blk][t+1].d == z2.atoh[blk][t].c &&\r\n z2.atoh[blk][t+1].c == z2.atoh[blk][t].b &&\r\n z2.atoh[blk][t+1].b == z2.atoh[blk][t].a &&\r\n z2.atoh[blk][t+1].a == Asm_Add(T1, T2);\r\n {\r\n forall t {:trigger TStep(t)} | TStep(t) && 0 <= t < |z2.atoh[blk]|-1\r\n ensures Word32AtoH(z2.atoh[blk][t]);\r\n ensures var T1 := Asm_Add(Asm_Add(Asm_Add(Asm_Add(z2.atoh[blk][t].h, BSIG1(z2.atoh[blk][t].e)),\r\n Ch(z2.atoh[blk][t].e, z2.atoh[blk][t].f, z2.atoh[blk][t].g)),\r\n K_SHA256(t)),\r\n z2.W[blk][t]);\r\n var T2 := Asm_Add(BSIG0(z2.atoh[blk][t].a), Maj(z2.atoh[blk][t].a, z2.atoh[blk][t].b, z2.atoh[blk][t].c));\r\n z2.atoh[blk][t+1].h == z2.atoh[blk][t].g &&\r\n z2.atoh[blk][t+1].g == z2.atoh[blk][t].f &&\r\n z2.atoh[blk][t+1].f == z2.atoh[blk][t].e &&\r\n z2.atoh[blk][t+1].e == Asm_Add(z2.atoh[blk][t].d, T1) &&\r\n z2.atoh[blk][t+1].d == z2.atoh[blk][t].c &&\r\n z2.atoh[blk][t+1].c == z2.atoh[blk][t].b &&\r\n z2.atoh[blk][t+1].b == z2.atoh[blk][t].a &&\r\n z2.atoh[blk][t+1].a == Asm_Add(T1, T2);\r\n {\r\n assert TheAToHsAreOK(z2, blk, t);\r\n reveal_TheAToHsAreOK();\r\n }\r\n }\r\n reveal_PartialSHA256TraceHasCorrectatohsOpaque();\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/sha256opt.i.dfy", "content": "//- HAND-OPTIMIZED PIECES of SHA 256\r\n\r\ninclude \"sha256.s.dfy\"\r\ninclude \"../../Util/seq_blocking.i.dfy\"\r\ninclude \"../../Util/arrays_and_seqs.i.dfy\"\r\ninclude \"../../Util/integer_sequences_premium.i.dfy\"\r\ninclude \"sha_padding.i.dfy\"\r\ninclude \"sha_common.i.dfy\"\r\ninclude \"sha256common.i.dfy\"\r\ninclude \"../../../Drivers/CPU/assembly_premium.i.dfy\"\r\n\r\n\r\nstatic method InitK_SHA256(Ks: array)\r\n requires Ks != null && Ks.Length == 64;\r\n ensures forall i :: 0 <= i < Ks.Length ==> Ks[i] == K_SHA256(i);\r\n modifies Ks;\r\n{\r\n InitK_SHA256_0_to_10(Ks);\r\n}\r\n\r\nstatic method {:decl} InitK_SHA256_0_to_10(Ks: array)\r\n requires Ks != null && Ks.Length == 64;\r\n modifies Ks;\r\n ensures forall i :: 0 <= i < 64 ==> Ks[i] == K_SHA256(i);\r\n\r\n\r\nstatic method {:decl} ComputeWsForBlockStep2_SHA256(M:array, words:int, H:array, W:array,\r\n ghost atoh:atoh_Type, num_blocks:int, ghost z:SHA256Trace, currentBlock:int)\r\n requires H != null;\r\n requires W != null && W.Length == 64;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA256ReadyForBlock(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n requires forall t :: 0 <= t < 16 ==> Word32(W[t]);\r\n requires forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < 16 ==> W[t] == z.M[currentBlock][t];\r\n requires W != H && W != M;\r\n modifies W;\r\n ensures H[..] == old(H[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures forall t :: 0 <= t <= 63 ==> Word32(W[t]);\r\n ensures forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < 16 ==> W[t] == z.M[currentBlock][t];\r\n ensures forall t {:trigger TStep(t)} :: TStep(t) && 16 <= t <= 63 ==> W[t] == Asm_Add(Asm_Add(Asm_Add(SSIG1(W[t-2]), W[t-7]), SSIG0(W[t-15])), W[t-16]);\r\n//-{\r\n//- var t := 16;\r\n//- while t < 64\r\n//- invariant 16 <= t <= 64;\r\n//- invariant forall step :: 0 <= step < t ==> Word32(W[step]);\r\n//- invariant forall step {:trigger TStep(step)} :: TStep(step) && 0 <= step < 16 ==> W[step] == z.M[currentBlock][step];\r\n//- invariant forall step {:trigger TStep(step)} :: TStep(step) && 16 <= step < t ==>\r\n//- W[step] == Asm_Add(Asm_Add(Asm_Add(SSIG1(W[step-2]), W[step-7]), SSIG0(W[step-15])), W[step-16]);\r\n//- {\r\n//- W[t] := Asm_Add(Asm_Add(Asm_Add(SSIG1_impl(W[t-2]), W[t-7]), SSIG0_impl(W[t-15])), W[t-16]);\r\n//- t := t + 1;\r\n//- }\r\n//-}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/sha256opt2.i.dfy", "content": "//- OPTIMIZED VERSION\r\n \r\ninclude \"sha256.s.dfy\"\r\ninclude \"../../Util/seq_blocking.i.dfy\"\r\ninclude \"../../Util/arrays_and_seqs.i.dfy\"\r\ninclude \"../../Util/integer_sequences_premium.i.dfy\"\r\ninclude \"sha_padding.i.dfy\"\r\ninclude \"sha_common.i.dfy\"\r\ninclude \"sha256opt.i.dfy\"\r\ninclude \"sha256common.i.dfy\"\r\ninclude \"../../../Drivers/CPU/assembly_premium.i.dfy\"\r\n\r\n/*\r\nstatic method{:dafnycc_conservative_seq_triggers} ComputeOneStep_SHA256_optimized(M:array, words:int, H:array, W:array, ghost atoh:atoh_Type, num_blocks:int, a:int, b:int, c:int, d:int, e:int, f:int, g:int, h:int,\r\n ghost z:SHA256Trace, currentBlock:int, currentStep:int, K:int)\r\n returns (a_next:int, b_next:int, c_next:int, d_next:int, e_next:int, f_next:int, g_next:int, h_next:int, ghost next_atoh:atoh_Type, ghost next_z:SHA256Trace)\r\n requires H != null;\r\n requires W != null;\r\n requires M != null;\r\n requires atoh == atoh_c(a, b, c, d, e, f, g, h);\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires 0 <= currentStep <= 63;\r\n requires K == K_SHA256(currentStep); \r\n requires IsSHA256ReadyForStep(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock, currentStep);\r\n ensures IsSHA256ReadyForStep(next_z, SHA256_vars_to_state(M, words, H, W, next_atoh, num_blocks), currentBlock, currentStep+1);\r\n\r\n ensures H[..] == old(H[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures W[..] == old(W[..]);\r\n ensures next_atoh == atoh_c(a_next, b_next, c_next, d_next, e_next, f_next, g_next, h_next);\r\n*/\r\n/*\r\n{\r\n assert TBlk(currentBlock) && TBlk(currentBlock + 1) && TStep(currentStep) && TStep(currentStep + 1);\r\n ghost var s := SHA256_vars_to_state(M, words, H, W, Ks, atoh, num_blocks);\r\n\r\n var bsig0 := Asm_BitwiseXor(Asm_BitwiseXor(Asm_RotateRight(a, 2), Asm_RotateRight(a, 13)), Asm_RotateRight(a, 22));\r\n calc {\r\n bsig0;\r\n { reveal_BSIG0(); }\r\n BSIG0(a);\r\n }\r\n var bsig1 := Asm_BitwiseXor(Asm_BitwiseXor(Asm_RotateRight(e, 6), Asm_RotateRight(e, 11)), Asm_RotateRight(e, 25));\r\n calc {\r\n bsig1;\r\n { reveal_BSIG1(); }\r\n BSIG1(e);\r\n }\r\n var my_ch := Asm_BitwiseXor(Asm_BitwiseAnd(e, f), Asm_BitwiseAnd(Asm_BitwiseNot(e), g));\r\n calc {\r\n my_ch;\r\n { reveal_Ch(); }\r\n Ch(e, f, g);\r\n }\r\n var my_maj := Asm_BitwiseXor(Asm_BitwiseXor(Asm_BitwiseAnd(a, b), Asm_BitwiseAnd(a, c)), Asm_BitwiseAnd(b, c));\r\n calc {\r\n my_maj;\r\n { reveal_Maj(); }\r\n Maj(a, b, c);\r\n }\r\n\r\n var T1 := Asm_Add(Asm_Add(Asm_Add(Asm_Add(h, bsig1), my_ch), Ks[currentStep]), W[currentStep]);\r\n var T2 := Asm_Add(bsig0, my_maj);\r\n a_next, b_next, c_next, d_next, e_next, f_next, g_next, h_next := Asm_Add(T1, T2), a, b, c, Asm_Add(d, T1), e, f, g;\r\n next_atoh := atoh_c(Asm_Add(T1, T2), atoh.a, atoh.b, atoh.c, Asm_Add(atoh.d, T1), atoh.e, atoh.f, atoh.g);\r\n next_z := SHA256Trace_c(z.M, z.H, z.W, z.atoh[..currentBlock] + [z.atoh[currentBlock] + [next_atoh]]);\r\n ghost var next_s := SHA256_vars_to_state(M, words, H, W, Ks, next_atoh, num_blocks);\r\n\r\n lemma_SHA256TransitionOKAfterSettingAtoH(z, s, next_z, next_s, currentBlock, currentStep);\r\n}\r\n*/\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers}{:decl} ComputeSHA256_optimized_loop(M:array, words:int, H:array, W:array, ghost atoh:atoh_Type, num_blocks:int, \r\n a:int, b:int, c:int, d:int, e:int, f:int, g:int, h:int,\r\n ghost z:SHA256Trace, currentBlock:int)\r\n returns (a_final:int, b_final:int, c_final:int, d_final:int, e_final:int, f_final:int, g_final:int, h_final:int, ghost final_atoh:atoh_Type, ghost final_z:SHA256Trace)\r\n requires H != null && H.Length == 8;\r\n requires W != null && W.Length == 64;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n //-requires IsSHA256ReadyForBlock(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n requires IsSHA256ReadyForStep(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock, 0);\r\n requires W != H && W != M && H != M;\r\n requires atoh == atoh_c(a, b, c, d, e, f, g, h);\r\n ensures M[..] == old(M[..]);\r\n ensures H[..] == old(H[..]);\r\n ensures W[..] == old(W[..]);\r\n ensures IsSHA256ReadyForStep(final_z, SHA256_vars_to_state(M, words, H, W, final_atoh, num_blocks), currentBlock, 64);\r\n //-ensures IsSHA256ReadyForBlock(next_z, SHA256_vars_to_state(M, words, H, W, next_atoh, num_blocks), currentBlock+1);\r\n ensures final_atoh == atoh_c(a_final, b_final, c_final, d_final, e_final, f_final, g_final, h_final);\r\n\r\n\r\nstatic method {:decl} ComputeWsForBlockStep1_SHA256_optimized(M:array, words:int, H:array, W:array,\r\n ghost atoh:atoh_Type, num_blocks:int, ghost z:SHA256Trace, currentBlock:int)\r\n requires H != null;\r\n requires W != null && W.Length == 64;\r\n requires M != null;\r\n requires 0 <= words <= M.Length;\r\n requires 0 <= currentBlock < |z.M|;\r\n requires IsSHA256ReadyForBlock(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n requires W != H && W != M;\r\n modifies W;\r\n ensures H[..] == old(H[..]);\r\n ensures M[..] == old(M[..]);\r\n ensures forall t :: 0 <= t < 16 ==> Word32(W[t]);\r\n ensures forall t {:trigger TStep(t)} :: TStep(t) && 0 <= t < 16 ==> W[t] == z.M[currentBlock][t];\r\n ensures IsSHA256ReadyForBlock(z, SHA256_vars_to_state(M, words, H, W, atoh, num_blocks), currentBlock);\r\n//-{\r\n//- ghost var s := SHA256_vars_to_state(M, words, H, W, atoh, num_blocks);\r\n//-\r\n//- var t:int := 0;\r\n//- var m_index := currentBlock * 16;\r\n//- while t < 16\r\n//- invariant 0 <= t <= 16;\r\n//- invariant m_index == currentBlock * 16 + t;\r\n//- invariant s.M == M[..words];\r\n//- invariant forall step :: 0 <= step < t ==> Word32(W[step]);\r\n//- invariant forall step {:trigger TStep(step)} :: TStep(step) && 0 <= step < t ==> W[step] == z.M[currentBlock][step];\r\n//- {\r\n//- reveal_Mul16();\r\n//- calc {\r\n//- 0;\r\n//- <= { lemma_mul_nonnegative(currentBlock, 16); }\r\n//- currentBlock * 16;\r\n//- <= currentBlock * 16 + t;\r\n//- }\r\n//- calc {\r\n//- currentBlock * 16 + t;\r\n//- 16 * currentBlock + t;\r\n//- 16 * (currentBlock+1) - 16 + t;\r\n//- <= 16*|z.M| - 16 + t;\r\n//- < 16*|z.M|;\r\n//- == Mul16(|z.M|);\r\n//- == words;\r\n//- }\r\n//- W[t] := M[m_index];\r\n//- calc {\r\n//- W[t];\r\n//- { lemma_mul_is_mul_boogie(currentBlock, 16);\r\n//- Lemma_BlockedSequencePrefixContainsElement(M[..], words, 16, currentBlock, t); }\r\n//- BreakIntoBlocks(M[..words], 16)[currentBlock][t];\r\n//- BreakIntoBlocks(s.M, 16)[currentBlock][t];\r\n//- z.M[currentBlock][t];\r\n//- }\r\n//- t := t + 1;\r\n//- m_index := m_index + 1;\r\n//- }\r\n//-}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/sha_common.i.dfy", "content": "include \"../../base.s.dfy\"\r\ninclude \"../../../Drivers/CPU/assembly.s.dfy\"\r\ninclude \"../../../Drivers/CPU/assembly_premium.i.dfy\"\r\ninclude \"../../Util/integer_sequences.s.dfy\"\r\ninclude \"../../Util/seq_blocking.s.dfy\"\r\ninclude \"sha_common.s.dfy\"\r\n\r\nstatic function method{:CompiledSpec} CompiledSpec_NumPaddingZeroes(message_len: int) : int\r\nstatic function method{:CompiledSpec} CompiledSpec_OneOf8(i: int, n0: int, n1: int, n2: int, n3: int, n4: int, n5: int, n6: int, n7: int) : int\r\n\r\nstatic function{:opaque} Mul16(i:int):int { i * 16 }\r\nstatic function{:opaque} Mod16(i:int):int { i % 16 }\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Ch, Maj, BSIG0, BSIG1, SSIG0, SSIG1\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic function method Ch_impl(x: int, y: int, z: int) : int\r\n requires Word32(x);\r\n requires Word32(y);\r\n requires Word32(z);\r\n ensures Word32(Ch_impl(x, y, z));\r\n ensures Ch_impl(x, y, z) == Ch(x, y, z);\r\n{\r\n reveal_Ch();\r\n Asm_BitwiseXor(Asm_BitwiseAnd(x, y), Asm_BitwiseAnd(Asm_BitwiseNot(x), z))\r\n}\r\n\r\nstatic function method Maj_impl(x: int, y: int, z: int) : int\r\n requires Word32(x);\r\n requires Word32(y);\r\n requires Word32(z);\r\n ensures Word32(Maj_impl(x, y, z));\r\n ensures Maj_impl(x, y, z) == Maj(x, y, z);\r\n{\r\n reveal_Maj();\r\n Asm_BitwiseXor(Asm_BitwiseXor(Asm_BitwiseAnd(x, y), Asm_BitwiseAnd(x, z)), Asm_BitwiseAnd(y, z))\r\n}\r\n\r\nstatic function method Parity_impl(x: int, y: int, z: int) : int\r\n requires Word32(x);\r\n requires Word32(y);\r\n requires Word32(z);\r\n ensures Word32(Parity_impl(x, y, z));\r\n ensures Parity_impl(x, y, z) == Parity(x, y, z);\r\n{\r\n reveal_Parity();\r\n Asm_BitwiseXor(Asm_BitwiseXor(x, y), z)\r\n}\r\n\r\nstatic function method ft_impl(t: int, x: int, y: int, z: int) : int\r\n requires 0 <= t <= 79;\r\n requires Word32(x);\r\n requires Word32(y);\r\n requires Word32(z);\r\n ensures Word32(ft_impl(t, x, y, z));\r\n ensures ft_impl(t, x, y, z) == ft(t, x, y, z);\r\n{\r\n reveal_ft();\r\n\r\n if t >= 0 && t <= 19 then\r\n Ch_impl(x, y, z)\r\n\r\n else if t >= 40 && t <= 59 then\r\n Maj_impl(x, y, z)\r\n else\r\n Parity_impl(x, y, z)\r\n}\r\n\r\nstatic function method BSIG0_impl(x: int) : int\r\n requires Word32(x);\r\n ensures Word32(BSIG0_impl(x));\r\n ensures BSIG0_impl(x) == BSIG0(x);\r\n{\r\n reveal_BSIG0();\r\n Asm_BitwiseXor(Asm_BitwiseXor(Asm_RotateRight(x, 2), Asm_RotateRight(x, 13)), Asm_RotateRight(x, 22))\r\n}\r\n\r\nstatic function method BSIG1_impl(x: int) : int\r\n requires Word32(x);\r\n ensures Word32(BSIG1_impl(x));\r\n ensures BSIG1_impl(x) == BSIG1(x);\r\n{\r\n reveal_BSIG1();\r\n Asm_BitwiseXor(Asm_BitwiseXor(Asm_RotateRight(x, 6), Asm_RotateRight(x, 11)), Asm_RotateRight(x, 25))\r\n}\r\n\r\nstatic function method SSIG0_impl(x: int) : int\r\n requires Word32(x);\r\n ensures Word32(SSIG0_impl(x));\r\n ensures SSIG0_impl(x) == SSIG0(x);\r\n{\r\n reveal_SSIG0();\r\n Asm_BitwiseXor(Asm_BitwiseXor(Asm_RotateRight(x, 7), Asm_RotateRight(x, 18)), Asm_RightShift(x, 3))\r\n}\r\n\r\nstatic function method SSIG1_impl(x: int) : int\r\n requires Word32(x);\r\n ensures Word32(SSIG1_impl(x));\r\n ensures SSIG1_impl(x) == SSIG1(x);\r\n{\r\n reveal_SSIG1();\r\n Asm_BitwiseXor(Asm_BitwiseXor(Asm_RotateRight(x, 17), Asm_RotateRight(x, 19)), Asm_RightShift(x, 10))\r\n}\r\n\r\nstatic lemma lemma_SHA_impl_Bytes_arrays_bitmangle(messageBytes:array,\r\n messageBytes_seq:seq, messageBits:seq, M_seq:seq, bits:int)\r\n requires messageBytes!=null;\r\n requires IsWordSeq(M_seq);\r\n requires 0 <= bits <= |BEWordSeqToBitSeq_premium(M_seq)|;\r\n requires messageBits == BEWordSeqToBitSeq_premium(M_seq)[..bits];\r\n requires messageBytes_seq == messageBytes[..];\r\n requires IsByteSeq(messageBytes_seq);\r\n requires BEByteSeqToBitSeq_premium(messageBytes[..]) == BEWordSeqToBitSeq(M_seq)[..bits];\r\n ensures messageBits == BEByteSeqToBitSeq_premium(messageBytes_seq);\r\n{\r\n calc {\r\n messageBits;\r\n BEWordSeqToBitSeq_premium(M_seq)[..bits];\r\n BEWordSeqToBitSeq(M_seq)[..bits];\r\n BEByteSeqToBitSeq_premium(messageBytes[..]);\r\n BEByteSeqToBitSeq_premium(messageBytes_seq);\r\n }\r\n}\r\n\r\nstatic lemma lemma_SHA_impl_Words_arrays_bitmangle(messageWords:array,\r\n messageWords_seq:seq, messageBits:seq, M_seq:seq, bits:int)\r\n requires messageWords!=null;\r\n requires IsWordSeq(M_seq);\r\n requires 0 <= bits <= |BEWordSeqToBitSeq_premium(M_seq)|;\r\n requires messageBits == BEWordSeqToBitSeq_premium(M_seq)[..bits];\r\n requires messageWords_seq == messageWords[..];\r\n requires IsWordSeq(messageWords_seq);\r\n requires BEWordSeqToBitSeq_premium(messageWords[..]) == BEWordSeqToBitSeq(M_seq)[..bits];\r\n ensures messageBits == BEWordSeqToBitSeq_premium(messageWords_seq);\r\n{\r\n calc {\r\n messageBits;\r\n BEWordSeqToBitSeq_premium(M_seq)[..bits];\r\n BEWordSeqToBitSeq(M_seq)[..bits];\r\n BEWordSeqToBitSeq_premium(messageWords[..]);\r\n BEWordSeqToBitSeq_premium(messageWords_seq);\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/sha_common.s.dfy", "content": "include \"../../base.s.dfy\"\r\ninclude \"../../../Drivers/CPU/assembly.s.dfy\"\r\ninclude \"../../Util/integer_sequences.s.dfy\"\r\ninclude \"../../Util/seq_blocking.s.dfy\"\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Ch, Maj, BSIG0, BSIG1, SSIG0, SSIG1\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic function {:opaque} Ch(x: int, y: int, z: int) : int\r\n requires Word32(x);\r\n requires Word32(y);\r\n requires Word32(z);\r\n ensures Word32(Ch(x, y, z));\r\n{\r\n BitwiseXor(BitwiseAnd(x, y), BitwiseAnd(BitwiseNot(x), z))\r\n}\r\n\r\nstatic function {:opaque} Maj(x: int, y: int, z: int) : int\r\n requires Word32(x);\r\n requires Word32(y);\r\n requires Word32(z);\r\n ensures Word32(Maj(x, y, z));\r\n{\r\n BitwiseXor(BitwiseXor(BitwiseAnd(x, y), BitwiseAnd(x, z)), BitwiseAnd(y, z))\r\n}\r\n\r\nstatic function {:opaque} Parity(x: int, y: int, z: int) : int\r\n requires Word32(x);\r\n requires Word32(y);\r\n requires Word32(z);\r\n ensures Word32(Parity(x, y, z));\r\n{\r\n BitwiseXor(BitwiseXor(x, y), z)\r\n}\r\n\r\nstatic function {:opaque} ft(t: int, x: int, y: int, z: int) : int\r\n requires 0 <= t <= 79;\r\n requires Word32(x);\r\n requires Word32(y);\r\n requires Word32(z);\r\n ensures Word32(ft(t, x, y, z));\r\n{\r\n\r\n if t >= 0 && t <= 19 then\r\n Ch(x, y, z)\r\n\r\n else if t >= 40 && t <= 59 then\r\n Maj(x, y, z)\r\n else\r\n Parity(x, y, z)\r\n}\r\n\r\nstatic function {:opaque} BSIG0(x: int) : int\r\n requires Word32(x);\r\n ensures Word32(BSIG0(x));\r\n{\r\n BitwiseXor(BitwiseXor(RotateRight(x, 2), RotateRight(x, 13)), RotateRight(x, 22))\r\n}\r\n\r\nstatic function {:opaque} BSIG1(x: int) : int\r\n requires Word32(x);\r\n ensures Word32(BSIG1(x));\r\n{\r\n BitwiseXor(BitwiseXor(RotateRight(x, 6), RotateRight(x, 11)), RotateRight(x, 25))\r\n}\r\n\r\nstatic function {:opaque} SSIG0(x: int) : int\r\n requires Word32(x);\r\n ensures Word32(SSIG0(x));\r\n{\r\n BitwiseXor(BitwiseXor(RotateRight(x, 7), RotateRight(x, 18)), RightShift(x, 3))\r\n}\r\n\r\nstatic function {:opaque} SSIG1(x: int) : int\r\n requires Word32(x);\r\n ensures Word32(SSIG1(x));\r\n{\r\n BitwiseXor(BitwiseXor(RotateRight(x, 17), RotateRight(x, 19)), RightShift(x, 10))\r\n}\r\n\r\nstatic function method {:opaque} NumPaddingZeroes(message_len: int) : int\r\n //- According to the spec, this is the smallest non-negative k such that message_len + 1 + k = 448 (mod 512)\r\n //- ensures (message_len + 1 + NumPaddingZeroes(message_len)) % 512 == 448;\r\n \r\n //- ensures NumPaddingZeroes(message_len) <= (448 - message_len - 1) % 512;\r\n //- ensures (message_len + NumPaddingZeroes(message_len) + 1) % 32 == 0;\r\n ensures 0 <= NumPaddingZeroes(message_len) < 512;\r\n{\r\n (959 - (message_len % 512)) % 512\r\n}\r\n\r\nstatic function PadMessageForSHA(messageBits: seq) : seq\r\n{\r\n messageBits + [1] + RepeatDigit(0, NumPaddingZeroes(|messageBits|)) + BEIntToDigitSeq(2, 64, |messageBits|)\r\n}\r\n\r\nstatic function {:opaque} BlockMessageForSHA(paddedMessageBits: seq) : seq>\r\n requires IsBitSeq(paddedMessageBits);\r\n requires |paddedMessageBits| % 512 == 0;\r\n{\r\n BreakIntoBlocks(BEIntToDigitSeq(power2(32), |paddedMessageBits|/32, BEBitSeqToInt(paddedMessageBits)), 16)\r\n}\r\n\r\nstatic function method OneOf8(i: int, n0: int, n1: int, n2: int, n3: int, n4: int, n5: int, n6: int, n7: int) : int\r\n requires 0 <= i < 8;\r\n{\r\n if i == 0 then n0 else if i == 1 then n1 else if i == 2 then n2 else if i == 3 then n3\r\n else if i == 4 then n4 else if i == 5 then n5 else if i == 6 then n6 else n7\r\n}\r\n\r\n//- Used to avoid matching loops in some uses of forall\r\n//- (avoid formulas of the form \"forall i :: ...a[i]...a[i+1]...\", which can loop\r\n//- if the trigger is a[i] and the i+1 in the body is used to instantiate the i in the trigger)\r\nstatic function TBlk(blk:int):bool { true }\r\nstatic function TStep(t:int):bool { true }\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/sha_padding.i.dfy", "content": "include \"sha_common.s.dfy\"\r\ninclude \"sha_common.i.dfy\"\r\ninclude \"../../Util/arrays_and_seqs.i.dfy\"\r\ninclude \"../../Util/integer_sequences_premium.i.dfy\"\r\n\r\nstatic function {:opaque} Mul32_const(i:int):int { i * 32 }\r\nstatic function {:opaque} Div32_const(i:int):int { i / 32 }\r\nstatic function {:opaque} Mod32_const(i:int):int { i % 32 }\r\nstatic lemma lemma_Mul32_const(i:int) ensures Mul32_const(i) == i * 32; { reveal_Mul32_const(); }\r\nstatic lemma lemma_Div32_const(i:int) ensures Div32_const(i) == i / 32; { reveal_Div32_const(); }\r\nstatic lemma lemma_Mod32_const(i:int) ensures Mod32_const(i) == i % 32; { reveal_Mod32_const(); }\r\n\r\n//-///////////////////////////////////////////////////\r\n//- Padding message\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic function method {:opaque} PaddedLength(message_len: int) : int\r\n{\r\n message_len + 1 + NumPaddingZeroes(message_len) + 64\r\n}\r\n\r\nstatic lemma lemma_PaddedLength_properties(message_len: int)\r\n ensures PaddedLength(message_len) == message_len + 65 + NumPaddingZeroes(message_len);\r\n ensures PaddedLength(message_len) == message_len + 65 + (959 - (message_len%512)) % 512;\r\n ensures PaddedLength(message_len) % 512 == 0;\r\n{\r\n reveal_PaddedLength();\r\n reveal_NumPaddingZeroes();\r\n\r\n var padded_length := PaddedLength(message_len);\r\n var padding_zeroes := NumPaddingZeroes(message_len);\r\n\r\n var q := message_len/512;\r\n var r := message_len%512;\r\n calc {\r\n padded_length % 512;\r\n (message_len + 1 + padding_zeroes + 64) % 512;\r\n (message_len + 65 + padding_zeroes) % 512;\r\n { reveal_NumPaddingZeroes(); }\r\n (message_len + 65 + (959 - (message_len % 512)) % 512) % 512;\r\n (message_len + 65 + (959 - r) % 512) % 512;\r\n (q * 512 + r + 65 + (959 - r) % 512) % 512;\r\n (r + 65 + (959 - r) % 512) % 512;\r\n 1024 % 512;\r\n 0;\r\n }\r\n}\r\n\r\nstatic lemma{:dafnycc_conservative_seq_triggers} lemma_PadMessageForSHA_properties(m:seq)\r\n requires IsBitSeq(m);\r\n requires |m| < power2(64);\r\n ensures IsBitSeq(PadMessageForSHA(m));\r\n ensures |PadMessageForSHA(m)| == PaddedLength(|m|);\r\n ensures |PadMessageForSHA(m)| == |m| + 1 + NumPaddingZeroes(|m|) + 64;\r\n ensures |PadMessageForSHA(m)| % 512 == 0;\r\n ensures forall i :: 0 <= i < |m| ==> PadMessageForSHA(m)[i] == m[i];\r\n ensures PadMessageForSHA(m)[|m|] == 1;\r\n ensures forall i :: |m| + 1 <= i <= |m| + NumPaddingZeroes(|m|) ==> PadMessageForSHA(m)[i] == 0;\r\n ensures PadMessageForSHA(m)[|m|+NumPaddingZeroes(|m|)+1..] == BEIntToDigitSeq(2, 64, |m|);\r\n ensures PadMessageForSHA(m) == PadMessageForSHA(m);\r\n ensures IsBitSeq(PadMessageForSHA(m));\r\n{\r\n lemma_PaddedLength_properties(|m|);\r\n\r\n reveal_power2();\r\n assert 2 == power2(1);\r\n\r\n var paddedBits := PadMessageForSHA(m);\r\n var paddingZeroes := NumPaddingZeroes(|m|);\r\n Lemma_RepeatDigitProperties(0, paddingZeroes);\r\n\r\n calc {\r\n |PadMessageForSHA(m)|;\r\n |m + [1] + RepeatDigit(0, paddingZeroes) + BEIntToDigitSeq(2, 64, |m|)|;\r\n |m| + 1 + paddingZeroes + |BEIntToDigitSeq(2, 64, |m|)|;\r\n { lemma_power2_is_power_2(64); lemma_BEIntToDigitSeq_private_properties(2, 64, |m|); }\r\n |m| + 1 + paddingZeroes + 64;\r\n }\r\n\r\n forall i | 0 <= i < |paddedBits|\r\n ensures IsBit(paddedBits[i]);\r\n ensures 0 <= i < |m| ==> PadMessageForSHA(m)[i] == m[i];\r\n ensures |m| + 1 <= i <= |m| + NumPaddingZeroes(|m|) ==> PadMessageForSHA(m)[i] == 0;\r\n {\r\n if 0 <= i < |m| {\r\n assert paddedBits[i] == m[i];\r\n }\r\n else if i == |m| {\r\n assert paddedBits[i] == 1;\r\n }\r\n else if |m|+1 <= i <= |m| + paddingZeroes {\r\n calc {\r\n paddedBits[i];\r\n (m + [1] + RepeatDigit_premium(0, paddingZeroes) + BEIntToDigitSeq(2, 64, |m|))[i];\r\n ([1] + RepeatDigit_premium(0, paddingZeroes) + BEIntToDigitSeq(2, 64, |m|))[i - |m|];\r\n (RepeatDigit_premium(0, paddingZeroes) + BEIntToDigitSeq(2, 64, |m|))[i - |m| - 1];\r\n 0;\r\n }\r\n }\r\n else {\r\n calc {\r\n i;\r\n < |paddedBits|;\r\n == |m + [1] + RepeatDigit_premium(0, paddingZeroes) + BEIntToDigitSeq(2, 64, |m|)|;\r\n == |m| + 1 + paddingZeroes + |BEIntToDigitSeq(2, 64, |m|)|;\r\n }\r\n calc {\r\n paddedBits[i];\r\n (m + [1] + RepeatDigit_premium(0, paddingZeroes) + BEIntToDigitSeq(2, 64, |m|))[i];\r\n ([1] + RepeatDigit_premium(0, paddingZeroes) + BEIntToDigitSeq(2, 64, |m|))[i - |m|];\r\n (RepeatDigit_premium(0, paddingZeroes) + BEIntToDigitSeq(2, 64, |m|))[i - |m| - 1];\r\n BEIntToDigitSeq(2, 64, |m|)[i - |m| - 1 - paddingZeroes];\r\n }\r\n lemma_BEIntToDigitSeq_produces_DigitSeq(2, 64, |m|);\r\n assert 0 <= BEIntToDigitSeq(2, 64, |m|)[i - |m| - 1 - paddingZeroes] < 2;\r\n assert 0 <= paddedBits[i] < 2;\r\n }\r\n }\r\n}\r\n\r\nstatic function PadMessageForSHA_premium(m:seq) : seq\r\n requires IsBitSeq(m);\r\n requires |m| < power2(64);\r\n ensures IsBitSeq(PadMessageForSHA_premium(m));\r\n ensures |PadMessageForSHA_premium(m)| == PaddedLength(|m|);\r\n ensures |PadMessageForSHA_premium(m)| == |m| + 1 + NumPaddingZeroes(|m|) + 64;\r\n ensures |PadMessageForSHA_premium(m)| % 512 == 0;\r\n ensures |m| < power2(64) ==> |PadMessageForSHA_premium(m)| == |m| + 1 + NumPaddingZeroes(|m|) + 64;\r\n ensures forall i :: 0 <= i < |m| ==> PadMessageForSHA_premium(m)[i] == m[i];\r\n ensures PadMessageForSHA_premium(m)[|m|] == 1;\r\n ensures forall i :: |m| + 1 <= i <= |m| + NumPaddingZeroes(|m|) ==> PadMessageForSHA_premium(m)[i] == 0;\r\n ensures PadMessageForSHA_premium(m)[|m|+NumPaddingZeroes(|m|)+1..] == BEIntToDigitSeq(2, 64, |m|);\r\n ensures PadMessageForSHA_premium(m) == PadMessageForSHA(m);\r\n{\r\n lemma_PadMessageForSHA_properties(m);\r\n lemma_PaddedLength_properties(|m|);\r\n PadMessageForSHA(m)\r\n}\r\n\r\nstatic lemma {:timeLimitMultiplier 2} lemma_ExtractingWordFromArray(n1:int, n2:int, a:array, b:int, s:seq)\r\n requires Mod32_const(n1) == 0;\r\n requires n1 + 32 == n2;\r\n requires 0 <= n1 < n2 <= |s|;\r\n requires IsWordArray(a);\r\n requires n2 <= a.Length * 32;\r\n requires forall i :: n1 <= i < n2 ==> s[i] == GetArrayBit(a, i);\r\n requires a[n1 / 32] == b;\r\n ensures s[n1..n2] == BEWordToBitSeq(b);\r\n{\r\n reveal_Mod32_const();\r\n reveal_GetArrayBit();\r\n assert IsBitSeq(BEWordToBitSeq_premium(b));\r\n assert |BEWordToBitSeq(b)| == 32;\r\n assert forall i :: n1 <= i < n2 ==> s[i] == BEWordToBitSeq_premium(b)[i - n1];\r\n}\r\n\r\nstatic lemma lemma_PaddedMessageLen(message_len: int)\r\n ensures Mod32_const(message_len + NumPaddingZeroes(message_len)) == 31;\r\n{\r\n reveal_Mod32_const();\r\n reveal_NumPaddingZeroes();\r\n}\r\n\r\nstatic lemma lemma_mod32_fact(x:int)\r\n requires Mod32_const(x) == 31;\r\n ensures Mod32_const(x + 1) == 0;\r\n ensures Mod32_const(x + 33) == 0;\r\n{\r\n reveal_Mod32_const();\r\n}\r\n\r\nstatic lemma lemma_LengthInPaddedMessageIsWordAligned(message_len: int)\r\n ensures Mod32_const(message_len + NumPaddingZeroes(message_len) + 1) == 0;\r\n ensures Mod32_const(message_len + NumPaddingZeroes(message_len) + 33) == 0;\r\n{\r\n lemma_PaddedMessageLen(message_len);\r\n var x := message_len + NumPaddingZeroes(message_len);\r\n lemma_mod32_fact(x);\r\n}\r\n\r\nstatic lemma lemma_WhatHappensToMod512WhenYouAddOne(x:int)\r\n requires 0 <= x;\r\n ensures (x+1)%512 == x%512+1 || (x+1)%512 == x%512 - 511;\r\n{\r\n}\r\n\r\nstatic lemma lemma_WhatHappensToPaddedLengthWhenYouAddOne(x:int)\r\n requires 0 <= x;\r\n ensures PaddedLength(x+1) == PaddedLength(x) || PaddedLength(x+1) == PaddedLength(x)+512;\r\n{\r\n lemma_WhatHappensToMod512WhenYouAddOne(x);\r\n lemma_WhatHappensToMod512WhenYouAddOne(958 - x%512);\r\n if (x+1)%512 == x%512+1 {\r\n if (958 - x%512 + 1)%512 == (958 - x%512)%512 + 1 {\r\n calc {\r\n PaddedLength(x+1);\r\n { reveal_PaddedLength(); }\r\n x + 66 + NumPaddingZeroes(x+1);\r\n { reveal_NumPaddingZeroes(); }\r\n x + 66 + (959 - ((x+1)%512))%512;\r\n x + 66 + (959 - (x%512+1))%512;\r\n x + 66 + (958 - x%512)%512;\r\n x + 66 + (958 - x%512 + 1)%512 - 1;\r\n x + 65 + (959 - x%512)%512;\r\n { reveal_NumPaddingZeroes(); }\r\n x + 65 + NumPaddingZeroes(x);\r\n { reveal_PaddedLength(); }\r\n PaddedLength(x);\r\n }\r\n }\r\n else {\r\n assert (958 - x%512 + 1)%512 == (958 - x%512)%512 - 511;\r\n calc {\r\n PaddedLength(x+1);\r\n { reveal_PaddedLength(); }\r\n x + 66 + NumPaddingZeroes(x+1);\r\n { reveal_NumPaddingZeroes(); }\r\n x + 66 + (959 - ((x+1)%512))%512;\r\n x + 66 + (959 - (x%512+1))%512;\r\n x + 66 + (958 - x%512)%512;\r\n x + 66 + (958 - x%512 + 1)%512 + 511;\r\n x + 65 + (959 - x%512)%512 + 512;\r\n { reveal_NumPaddingZeroes(); }\r\n x + 65 + NumPaddingZeroes(x) + 512;\r\n { reveal_PaddedLength(); }\r\n PaddedLength(x) + 512;\r\n }\r\n }\r\n }\r\n else {\r\n assert (x+1)%512 == x%512-511;\r\n if (958 - x%512 + 1)%512 == (958 - x%512)%512 + 1 {\r\n calc {\r\n PaddedLength(x+1);\r\n { reveal_PaddedLength(); }\r\n x + 66 + NumPaddingZeroes(x+1);\r\n { reveal_NumPaddingZeroes(); }\r\n x + 66 + (959 - ((x+1)%512))%512;\r\n x + 66 + (959 - (x%512-511))%512;\r\n x + 66 + (959 + 511 - x%512)%512;\r\n x + 66 + (958 - x%512)%512;\r\n x + 66 + (958 - x%512 + 1)%512 - 1;\r\n x + 65 + (959 - x%512)%512;\r\n { reveal_NumPaddingZeroes(); }\r\n x + 65 + NumPaddingZeroes(x);\r\n { reveal_PaddedLength(); }\r\n PaddedLength(x);\r\n }\r\n }\r\n else {\r\n assert (958 - x%512 + 1)%512 == (958 - x%512)%512 - 511;\r\n calc {\r\n PaddedLength(x+1);\r\n { reveal_PaddedLength(); }\r\n x + 66 + NumPaddingZeroes(x+1);\r\n { reveal_NumPaddingZeroes(); }\r\n x + 66 + (959 - ((x+1)%512))%512;\r\n x + 66 + (959 - (x%512-511))%512;\r\n x + 66 + (959 + 511 - x%512)%512;\r\n x + 66 + (958 - x%512)%512;\r\n x + 66 + (958 - x%512 + 1)%512 + 511;\r\n x + 65 + (959 - x%512)%512 + 512;\r\n { reveal_NumPaddingZeroes(); }\r\n x + 65 + NumPaddingZeroes(x) + 512;\r\n { reveal_PaddedLength(); }\r\n PaddedLength(x) + 512;\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_PaddedLengthMonotonic(a:int, b:int)\r\n requires 0 <= a <= b;\r\n decreases b;\r\n ensures PaddedLength(a) <= PaddedLength(b);\r\n{\r\n if a < b {\r\n lemma_PaddedLengthMonotonic(a, b-1);\r\n lemma_WhatHappensToPaddedLengthWhenYouAddOne(b-1);\r\n }\r\n}\r\n\r\nstatic lemma lemma_64BitValueIsZerosThen32Bits(v: int)\r\n requires Word32(v);\r\n ensures BEIntToDigitSeq(2, 64, v) == SequenceOfZeros(32) + BEWordToBitSeq(v);\r\n{\r\n lemma_power2_is_power_2_general();\r\n lemma_BEIntToDigitSeqProducesRightSizedDigits(2, 32, v);\r\n calc {\r\n BEDigitSeqToInt(2, SequenceOfZeros(32) + BEIntToDigitSeq(2, 32, v));\r\n { lemma_LeadingZeros(2, BEIntToDigitSeq(2, 32, v), SequenceOfZeros(32) + BEIntToDigitSeq(2, 32, v)); }\r\n BEDigitSeqToInt(2, BEIntToDigitSeq(2, 32, v));\r\n }\r\n calc {\r\n BEDigitSeqToInt(2, SequenceOfZeros(32) + BEIntToDigitSeq(2, 32, v));\r\n { lemma_BEIntToDigitSeq_private_properties(2, 32, v);\r\n lemma_BEIntToDigitSeq_invertibility(2, v, BEIntToDigitSeq(2, 32, v)); }\r\n v;\r\n }\r\n calc {\r\n BEIntToDigitSeq(2, 64, v);\r\n { lemma_BEDigitSeqToInt_invertibility(2, v, SequenceOfZeros(32) + BEIntToDigitSeq(2, 32, v));\r\n lemma_BEIntToDigitSeq_private_properties(2, 32, v); }\r\n SequenceOfZeros(32) + BEIntToDigitSeq(2, 32, v);\r\n { lemma_power2_1_is_2(); }\r\n SequenceOfZeros(32) + BEWordToBitSeq(v);\r\n }\r\n}\r\n\r\nstatic function {:opaque} GetArrayBitOpaque(a: array, b:int) : int\r\n requires IsWordArray(a);\r\n requires 0 <= b < Mul32_const(a.Length);\r\n ensures IsBit(GetArrayBitOpaque(a, b));\r\n ensures b < |BEWordSeqToBitSeq_premium(a[..])|;\r\n ensures /*REVIEW: GetArrayBitOpaque*/ GetArrayBit(a, b) == BEWordSeqToBitSeq_premium(a[..])[b];\r\n reads a;\r\n{\r\n reveal_Mul32_const();\r\n GetArrayBit(a, b)\r\n}\r\n\r\nghost static method {:dafnycc_conservative_seq_triggers} {:timeLimitMultiplier 6} Lemma_ArrayIsPaddedMessageHelper(a: array, b: int, m: seq)\r\n requires IsWordArray(a);\r\n requires |m| == b;\r\n requires Word32(b);\r\n requires 0 <= b < power2(64);\r\n requires b + 1 + NumPaddingZeroes(b) + 64 <= Mul32_const(a.Length);\r\n requires 0 <= PaddedLength(b) <= Mul32_const(a.Length);\r\n requires forall i {:trigger GetArrayBit(a, i)}{:trigger m[i]} :: 0 <= i < b ==> GetArrayBitOpaque(a, i) == m[i];\r\n requires GetArrayBitOpaque(a, b) == 1;\r\n requires a.Length > Div32_const(b + NumPaddingZeroes(b) + 33);\r\n requires 0 <= Div32_const(b + NumPaddingZeroes(b) + 1) < a.Length;\r\n requires 0 <= Div32_const(b + NumPaddingZeroes(b) + 33) < a.Length;\r\n requires forall i {:trigger GetArrayBit(a, i)} :: b + 1 <= i <= b + NumPaddingZeroes(b) ==> GetArrayBitOpaque(a, i) == 0;\r\n requires a[Div32_const(b + NumPaddingZeroes(b) + 1)] == 0;\r\n requires a[Div32_const(b + NumPaddingZeroes(b) + 33)] == b;\r\n ensures PaddedLength(b) <= |BEWordSeqToBitSeq(a[..])|;\r\n ensures BEWordSeqToBitSeq(a[..])[..PaddedLength(b)] == PadMessageForSHA(m);\r\n{\r\n ghost var s := BEWordSeqToBitSeq_premium(a[..]);\r\n assert forall j :: 0 <= j < a.Length ==> s[j] == GetArrayBit(a, j);\r\n\r\n calc <= { PaddedLength(b); { reveal_Mul32_const(); } |s|; }\r\n calc {\r\n s[..PaddedLength(b)];\r\n { reveal_PaddedLength(); }\r\n s[0..|m|+NumPaddingZeroes(|m|)+65];\r\n { lemma_LengthInPaddedMessageIsWordAligned(|m|);\r\n reveal_Mul32_const();\r\n lemma_subseq_concatenation(s, 0, |m|+NumPaddingZeroes(|m|)+33, |m|+NumPaddingZeroes(|m|)+65); }\r\n s[0..|m|+NumPaddingZeroes(|m|)+33] + s[|m|+NumPaddingZeroes(|m|)+33..|m|+NumPaddingZeroes(|m|)+65];\r\n { reveal_Mul32_const(); reveal_Div32_const(); }\r\n { lemma_LengthInPaddedMessageIsWordAligned(|m|); }\r\n { lemma_ExtractingWordFromArray(b+NumPaddingZeroes(b)+33, b+NumPaddingZeroes(b)+65, a, b, s); }\r\n s[0..|m|+NumPaddingZeroes(|m|)+33] + BEWordToBitSeq(b);\r\n { reveal_Mul32_const(); }\r\n { lemma_subseq_concatenation(s, 0, |m|+NumPaddingZeroes(|m|)+1, |m|+NumPaddingZeroes(|m|)+33); }\r\n s[0..|m|+NumPaddingZeroes(|m|)+1] + s[|m|+NumPaddingZeroes(|m|)+1..|m|+NumPaddingZeroes(|m|)+33] + BEWordToBitSeq(b);\r\n { reveal_Div32_const(); }\r\n { lemma_LengthInPaddedMessageIsWordAligned(|m|); }\r\n { lemma_ExtractingWordFromArray(b+NumPaddingZeroes(b)+1, b+NumPaddingZeroes(b)+33, a, 0, s); }\r\n s[0..|m|+NumPaddingZeroes(|m|)+1] + BEWordToBitSeq(0) + BEWordToBitSeq(b);\r\n { reveal_power2(); lemma_BEIntToDigitSeq_private_zero(power2(1), 32); }\r\n s[0..|m|+NumPaddingZeroes(|m|)+1] + SequenceOfZeros(32) + BEWordToBitSeq(b);\r\n { lemma_64BitValueIsZerosThen32Bits(b); }\r\n s[0..|m|+NumPaddingZeroes(|m|)+1] + BEIntToDigitSeq(2, 64, b);\r\n { lemma_subseq_concatenation(s, 0, |m|+1, |m|+NumPaddingZeroes(|m|)+1); }\r\n s[0..|m|+1] + s[|m|+1..|m|+NumPaddingZeroes(|m|)+1] + BEIntToDigitSeq(2, 64, b);\r\n { assert forall j :: |m|+1 <= j < |m|+NumPaddingZeroes(|m|)+1 ==> s[j] == GetArrayBit(a, j); reveal_GetArrayBitOpaque(); }\r\n s[0..|m|+1] + SequenceOfZeros(NumPaddingZeroes(|m|)) + BEIntToDigitSeq(2, 64, b);\r\n { lemma_subseq_concatenation(s, 0, |m|, |m|+1); }\r\n s[0..|m|] + s[|m|..|m|+1] + SequenceOfZeros(NumPaddingZeroes(|m|)) + BEIntToDigitSeq(2, 64, b);\r\n { reveal_GetArrayBitOpaque(); assert s[|m|] == 1; assert s[|m|..|m|+1] == [1]; }\r\n s[0..|m|] + [1] + SequenceOfZeros(NumPaddingZeroes(|m|)) + BEIntToDigitSeq(2, 64, b);\r\n { reveal_GetArrayBitOpaque();\r\n assert forall i {:trigger GetArrayBit(a, i)}{:trigger m[i]} :: 0 <= i < b ==> GetArrayBit(a, i) == m[i];\r\n lemma_seq_equality(s[0..|m|], m, b); }\r\n m + [1] + SequenceOfZeros(NumPaddingZeroes(|m|)) + BEIntToDigitSeq(2, 64, b);\r\n { lemma_SequenceOfZerosIsRepeatDigitZero(NumPaddingZeroes(|m|));\r\n assert |m| == b; }\r\n PadMessageForSHA(m);\r\n }\r\n}\r\n\r\nghost static method Lemma_ArrayIsPaddedMessage(a: array, b: int, m: seq)\r\n requires IsWordArray(a);\r\n requires |m| == b;\r\n requires Word32(b);\r\n requires 0 <= b < power2(64);\r\n requires b + 1 + NumPaddingZeroes(b) + 64 <= a.Length * 32;\r\n requires 0 <= PaddedLength(b) <= a.Length * 32;\r\n requires forall i {:trigger GetArrayBit(a, i)}{:trigger m[i]} :: 0 <= i < b ==> GetArrayBit(a, i) == m[i];\r\n requires GetArrayBit(a, b) == 1;\r\n requires a.Length > (b + NumPaddingZeroes(b) + 33) / 32;\r\n requires forall i {:trigger GetArrayBit(a, i)} :: b + 1 <= i <= b + NumPaddingZeroes(b) ==> GetArrayBit(a, i) == 0;\r\n requires a[(b + NumPaddingZeroes(b) + 1) / 32] == 0;\r\n requires a[(b + NumPaddingZeroes(b) + 33) / 32] == b;\r\n ensures BEWordSeqToBitSeq(a[..])[..PaddedLength(b)] == PadMessageForSHA(m);\r\n{\r\n reveal_Mul32_const();\r\n reveal_Div32_const();\r\n reveal_GetArrayBitOpaque();\r\n Lemma_ArrayIsPaddedMessageHelper(a, b, m);\r\n}\r\n\r\nstatic method {:dafnycc_conservative_seq_triggers} PadMessageArray(a: array, b: int)\r\n requires IsWordArray(a);\r\n requires Word32(b);\r\n requires 0 <= b < power2(64);\r\n requires 0 <= PaddedLength(b) <= a.Length * 32;\r\n ensures IsWordSeq(a[..]);\r\n ensures |BEWordSeqToBitSeq(a[..])| >= PaddedLength(b);\r\n ensures |old(BEWordSeqToBitSeq(a[..]))| >= b;\r\n ensures BEWordSeqToBitSeq(a[..])[..PaddedLength(b)] == old(PadMessageForSHA(BEWordSeqToBitSeq(a[..])[..b]));\r\n modifies a;\r\n{\r\n var numPad := NumPaddingZeroes(b);\r\n\r\n calc {\r\n a.Length * 32;\r\n >= PaddedLength(b);\r\n == { reveal_PaddedLength(); }\r\n b + 1 + NumPaddingZeroes(b) + 64;\r\n b + 1 + numPad + 64;\r\n > b + numPad + 33;\r\n }\r\n\r\n calc {\r\n (b + numPad + 1) % 32;\r\n (b + NumPaddingZeroes(b) + 1) % 32;\r\n == { reveal_NumPaddingZeroes(); }\r\n 0;\r\n }\r\n\r\n calc {\r\n (b + numPad + 33) % 32;\r\n (32 + b + numPad + 1) % 32;\r\n { lemma_mod_add_multiples_vanish(b + numPad + 1, 32); }\r\n (b + numPad + 1) % 32;\r\n 0;\r\n }\r\n\r\n lemma_BEWordSeqToBitSeq_ensures(a[..]);\r\n ghost var m := BEWordSeqToBitSeq(a[..])[..b];\r\n\r\n AppendBitToArray(a, b, 1);\r\n AppendBitsToArray(a, b + 1, 0, numPad);\r\n AppendWordToArray(a, b + numPad + 1, 0);\r\n AppendWordToArray(a, b + numPad + 33, b);\r\n\r\n assert IsWordArray(a);\r\n assert forall i {:trigger m[i]}{:trigger GetArrayBit(a, i)} :: 0 <= i < b ==> GetArrayBit(a, i) == m[i];\r\n assert GetArrayBit(a, b) == 1;\r\n assert forall i {:trigger GetArrayBit(a, i)} :: b + 1 <= i <= b + numPad ==> GetArrayBit(a, i) == 0;\r\n assert a[(b + numPad + 1) / 32] == 0;\r\n assert a[(b + numPad + 33) / 32] == b;\r\n\r\n Lemma_ArrayIsPaddedMessage(a, b, m);\r\n}\r\n\r\nstatic method {:dafnycc_conservative_seq_triggers} CreateArrayForSHA(messageBytes:seq) returns (a: array, b: int)\r\n requires IsByteSeq(messageBytes);\r\n ensures fresh(a);\r\n ensures b == |messageBytes| * 8;\r\n ensures b >= 0;\r\n ensures 0 <= PaddedLength(b) <= a.Length * 32;\r\n ensures IsWordArray(a);\r\n ensures |BEWordSeqToBitSeq_premium(a[..])| >= b;\r\n ensures BEByteSeqToBitSeq_premium(messageBytes) == BEWordSeqToBitSeq(a[..])[..b];\r\n{\r\n reveal_PaddedLength();\r\n\r\n b := |messageBytes| * 8;\r\n var paddedLength := PaddedLength(b);\r\n\r\n lemma_LengthInPaddedMessageIsWordAligned(b);\r\n reveal_Mod32_const();\r\n assert paddedLength % 32 == 0;\r\n a := new int[paddedLength / 32];\r\n\r\n var wordseq := BEByteSeqToWordSeqTailPadding(messageBytes);\r\n ghost var wordseq_extended :=\r\n if |wordseq| <= a.Length then wordseq + RepeatDigit_premium(0, a.Length - |wordseq|) else wordseq[..a.Length];\r\n assert |wordseq_extended| == a.Length;\r\n\r\n lemma_2toX();\r\n\r\n var i := 0;\r\n while i < a.Length\r\n invariant 0 <= i <= a.Length;\r\n invariant forall j :: 0 <= j < i ==> Word32(a[j]);\r\n invariant a[..i] == wordseq_extended[..i];\r\n {\r\n if i < |wordseq| {\r\n a[i] := wordseq[i];\r\n }\r\n else {\r\n a[i] := 0;\r\n }\r\n assert a[..i+1] == a[..i] + [a[i]]; //- dafnycc triggering\r\n assert wordseq_extended[..i+1] == wordseq_extended[..i] + [wordseq_extended[i]]; //- dafnycc triggering\r\n i := i + 1;\r\n }\r\n\r\n assert a[..] == wordseq_extended[..a.Length] == wordseq_extended;\r\n\r\n if |wordseq| <= a.Length {\r\n calc {\r\n BEWordSeqToBitSeq_premium(wordseq_extended)[..b];\r\n { lemma_WordSeqToBitSeqChop(wordseq_extended, wordseq, RepeatDigit(0, a.Length - |wordseq|)); }\r\n (BEWordSeqToBitSeq_premium(wordseq) + BEWordSeqToBitSeq_premium(RepeatDigit(0, a.Length - |wordseq|)))[..b];\r\n BEWordSeqToBitSeq_premium(wordseq)[..b];\r\n }\r\n }\r\n else {\r\n calc {\r\n BEWordSeqToBitSeq_premium(wordseq_extended)[..b];\r\n BEWordSeqToBitSeq_premium(wordseq[..a.Length])[..b];\r\n (BEWordSeqToBitSeq_premium(wordseq[..a.Length]) + BEWordSeqToBitSeq_premium(wordseq[a.Length..]))[..b];\r\n { lemma_WordSeqToBitSeqChop(wordseq, wordseq[..a.Length], wordseq[a.Length..]); }\r\n BEWordSeqToBitSeq_premium(wordseq)[..b];\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_wordseq_dafnycc_trigger(wordseq_extended:seq, i:int)\r\n requires 0 <= i < |wordseq_extended|;\r\n ensures wordseq_extended[..i+1] == wordseq_extended[..i] + [wordseq_extended[i]];\r\n{\r\n}\r\n\r\n\r\n\r\n\r\nstatic method CreateArrayForSHA_arrays(messageBytes:array) returns (a: array, b: int)\r\n requires messageBytes!=null;\r\n requires IsByteSeq(messageBytes[..]);\r\n ensures fresh(a);\r\n ensures b == messageBytes.Length * 8;\r\n ensures b >= 0;\r\n ensures 0 <= PaddedLength(b) <= a.Length * 32;\r\n ensures IsWordArray(a);\r\n ensures |BEWordSeqToBitSeq_premium(a[..])| >= b;\r\n ensures BEByteSeqToBitSeq_premium(messageBytes[..]) == BEWordSeqToBitSeq(a[..])[..b];\r\n{\r\n reveal_PaddedLength();\r\n\r\n b := messageBytes.Length * 8;\r\n var paddedLength := PaddedLength(b);\r\n\r\n lemma_LengthInPaddedMessageIsWordAligned(b);\r\n reveal_Mod32_const();\r\n assert paddedLength % 32 == 0;\r\n a := new int[paddedLength / 32];\r\n\r\n ghost var messageByteSeq := messageBytes[..];\r\n var wa,wordseq := BEByteSeqToWordSeqTailPadding_arrays(messageBytes, messageByteSeq);\r\n//- assert BEByteSeqToBitSeq(messageByteSeq) == BEWordSeqToBitSeq(wordseq)[..|messageByteSeq|*8];\r\n\r\n ghost var wordseq_extended :=\r\n if |wordseq| <= a.Length then wordseq + RepeatDigit_premium(0, a.Length - |wordseq|) else wordseq[..a.Length];\r\n assert |wordseq_extended| == a.Length;\r\n\r\n lemma_2toX();\r\n\r\n var i := 0;\r\n while i < a.Length\r\n invariant 0 <= i <= a.Length;\r\n invariant wa[..] == wordseq;\r\n invariant forall j :: 0 <= j < i ==> Word32(a[j]);\r\n invariant a[..i] == wordseq_extended[..i];\r\n {\r\n if i < wa.Length {\r\n a[i] := wa[i];\r\n }\r\n else {\r\n a[i] := 0;\r\n }\r\n assert a[..i+1] == a[..i] + [a[i]]; //- dafnycc triggering\r\n //-assert wordseq_extended[..i+1] == wordseq_extended[..i] + [wordseq_extended[i]]; //- dafnycc triggering\r\n lemma_wordseq_dafnycc_trigger(wordseq_extended, i);\r\n i := i + 1;\r\n }\r\n\r\n assert a[..] == wordseq_extended[..a.Length] == wordseq_extended;\r\n\r\n if |wordseq| <= a.Length {\r\n calc {\r\n BEWordSeqToBitSeq_premium(wordseq_extended)[..b];\r\n { lemma_WordSeqToBitSeqChop(wordseq_extended, wordseq, RepeatDigit(0, a.Length - |wordseq|)); }\r\n (BEWordSeqToBitSeq_premium(wordseq) + BEWordSeqToBitSeq_premium(RepeatDigit(0, a.Length - |wordseq|)))[..b];\r\n BEWordSeqToBitSeq_premium(wordseq)[..b];\r\n }\r\n }\r\n else {\r\n calc {\r\n BEWordSeqToBitSeq_premium(wordseq_extended)[..b];\r\n BEWordSeqToBitSeq_premium(wordseq[..a.Length])[..b];\r\n (BEWordSeqToBitSeq_premium(wordseq[..a.Length]) + BEWordSeqToBitSeq_premium(wordseq[a.Length..]))[..b];\r\n { lemma_WordSeqToBitSeqChop(wordseq, wordseq[..a.Length], wordseq[a.Length..]); }\r\n BEWordSeqToBitSeq_premium(wordseq)[..b];\r\n }\r\n }\r\n\r\n assert messageByteSeq == messageBytes[..]; //- OBSERVE\r\n//- assert BEByteSeqToBitSeq(messageByteSeq) == BEWordSeqToBitSeq(wordseq)[..|messageByteSeq|*8];\r\n//- assert BEByteSeqToBitSeq(messageBytes[..]) == BEWordSeqToBitSeq(wordseq)[..|messageBytes[..]|*8];\r\n calc {\r\n BEByteSeqToBitSeq_premium(messageBytes[..]);\r\n BEWordSeqToBitSeq_premium(wordseq)[..b];\r\n BEWordSeqToBitSeq_premium(wordseq_extended)[..b];\r\n BEWordSeqToBitSeq(a[..])[..b];\r\n }\r\n}\r\n\r\nstatic method CreateArrayForSHA_arrays_words(messageWords:array) returns (a: array, b: int)\r\n requires messageWords!=null;\r\n requires IsWordSeq(messageWords[..]);\r\n ensures fresh(a);\r\n ensures b == messageWords.Length * 32;\r\n ensures b >= 0;\r\n ensures 0 <= PaddedLength(b) <= a.Length * 32;\r\n ensures IsWordArray(a);\r\n ensures |BEWordSeqToBitSeq_premium(a[..])| >= b;\r\n ensures BEWordSeqToBitSeq_premium(messageWords[..]) == BEWordSeqToBitSeq(a[..])[..b];\r\n{\r\n reveal_PaddedLength();\r\n\r\n b := messageWords.Length * 32;\r\n var paddedLength := PaddedLength(b);\r\n\r\n lemma_LengthInPaddedMessageIsWordAligned(b);\r\n reveal_Mod32_const();\r\n assert paddedLength % 32 == 0;\r\n a := new int[paddedLength / 32];\r\n\r\n ghost var messageWordSeq := messageWords[..];\r\n ghost var wordseq := messageWordSeq;\r\n//- var wa,wordseq := BEByteSeqToWordSeqTailPadding_arrays(messageBytes, messageByteSeq);\r\n//- assert BEByteSeqToBitSeq(messageByteSeq) == BEWordSeqToBitSeq(wordseq)[..|messageByteSeq|*8];\r\n\r\n ghost var wordseq_extended :=\r\n if |wordseq| <= a.Length then wordseq + RepeatDigit_premium(0, a.Length - |wordseq|) else wordseq[..a.Length];\r\n assert |wordseq_extended| == a.Length;\r\n\r\n lemma_2toX();\r\n\r\n var i := 0;\r\n while i < a.Length\r\n invariant 0 <= i <= a.Length;\r\n invariant messageWords[..] == wordseq;\r\n invariant forall j :: 0 <= j < i ==> Word32(a[j]);\r\n invariant a[..i] == wordseq_extended[..i];\r\n {\r\n if i < messageWords.Length {\r\n a[i] := messageWords[i];\r\n }\r\n else {\r\n a[i] := 0;\r\n }\r\n assert a[..i+1] == a[..i] + [a[i]]; //- dafnycc triggering\r\n //-assert wordseq_extended[..i+1] == wordseq_extended[..i] + [wordseq_extended[i]]; //- dafnycc triggering\r\n lemma_wordseq_dafnycc_trigger(wordseq_extended, i);\r\n i := i + 1;\r\n }\r\n\r\n assert a[..] == wordseq_extended[..a.Length] == wordseq_extended;\r\n\r\n if |wordseq| <= a.Length {\r\n calc {\r\n BEWordSeqToBitSeq_premium(wordseq_extended)[..b];\r\n { lemma_WordSeqToBitSeqChop(wordseq_extended, wordseq, RepeatDigit(0, a.Length - |wordseq|)); }\r\n (BEWordSeqToBitSeq_premium(wordseq) + BEWordSeqToBitSeq_premium(RepeatDigit(0, a.Length - |wordseq|)))[..b];\r\n BEWordSeqToBitSeq_premium(wordseq)[..b];\r\n }\r\n }\r\n else {\r\n calc {\r\n BEWordSeqToBitSeq_premium(wordseq_extended)[..b];\r\n BEWordSeqToBitSeq_premium(wordseq[..a.Length])[..b];\r\n (BEWordSeqToBitSeq_premium(wordseq[..a.Length]) + BEWordSeqToBitSeq_premium(wordseq[a.Length..]))[..b];\r\n { lemma_WordSeqToBitSeqChop(wordseq, wordseq[..a.Length], wordseq[a.Length..]); }\r\n BEWordSeqToBitSeq_premium(wordseq)[..b];\r\n }\r\n }\r\n\r\n assert messageWordSeq == messageWords[..]; //- OBSERVE\r\n//- assert BEByteSeqToBitSeq(messageByteSeq) == BEWordSeqToBitSeq(wordseq)[..|messageByteSeq|*8];\r\n//- assert BEByteSeqToBitSeq(messageBytes[..]) == BEWordSeqToBitSeq(wordseq)[..|messageBytes[..]|*8];\r\n calc {\r\n BEWordSeqToBitSeq_premium(messageWords[..]);\r\n BEWordSeqToBitSeq_premium(wordseq)[..b];\r\n BEWordSeqToBitSeq_premium(wordseq_extended)[..b];\r\n BEWordSeqToBitSeq(a[..])[..b];\r\n }\r\n}\r\n\r\nstatic lemma lemma_mod_words(bits:int, words:int)\r\n requires words == PaddedLength(bits)/32;\r\n ensures Mod16(words) == 0;\r\n{ \r\n reveal_Mod16(); lemma_PaddedLength_properties(bits); \r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/Hash/sha_test.i.dfy", "content": "include \"sha256.i.dfy\"\r\ninclude \"sha1.i.dfy\"\r\n\r\nstatic method PrintHash(hash:seq)\r\n{\r\n var i := 0;\r\n while (i < |hash|)\r\n invariant 0 <= i <= |hash|;\r\n {\r\n print hash[i];\r\n i := i + 1;\r\n }\r\n}\r\n\r\n//- FIPS says:\r\n//- SHA1(\"abc\") = A9993E36 4706816A BA3E2571 7850C26C 9CD0D89D\r\n//- http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/SHA1.pdf\r\n//- SHA256(\"abc\") = BA7816BF 8F01CFEA 414140DE 5DAE2223 B00361A3 96177A9C B410FF61 F20015AD\r\n//- http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/SHA256.pdf\r\nmethod Test1()\r\n{\r\n var data := [0x61, 0x62, 0x63];\r\n\r\n lemma_2toX();\r\n\r\n var hash_sha1 := SHA1_impl_Bytes(data);\r\n PrintHash(hash_sha1);\r\n var hash_sha256 := SHA256_impl_Bytes(data);\r\n PrintHash(hash_sha256);\r\n}\r\n\r\n//- FIPS says:\r\n//- SHA1(\"abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq\") =\r\n//- 84983E44 1C3BD26E BAAE4AA1 F95129E5 E54670F1\r\n//- http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/SHA1.pdf\r\n//- SHA256(\"abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq\") =\r\n//- 248D6A61 D20638B8 E5C02693 0C3E6039 A33CE459 64FF2167 F6ECEDD4 19DB06C1\r\n//- http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/SHA256.pdf\r\nmethod Test2()\r\n{\r\n var data := [\r\n 0x61, 0x62, 0x63, 0x64,\r\n 0x62, 0x63, 0x64, 0x65,\r\n 0x63, 0x64, 0x65, 0x66,\r\n 0x64, 0x65, 0x66, 0x67,\r\n 0x65, 0x66, 0x67, 0x68,\r\n 0x66, 0x67, 0x68, 0x69,\r\n 0x67, 0x68, 0x69, 0x6A,\r\n 0x68, 0x69, 0x6A, 0x6B,\r\n 0x69, 0x6A, 0x6B, 0x6C,\r\n 0x6A, 0x6B, 0x6C, 0x6D,\r\n 0x6B, 0x6C, 0x6D, 0x6E,\r\n 0x6C, 0x6D, 0x6E, 0x6F,\r\n 0x6D, 0x6E, 0x6F, 0x70,\r\n 0x6E, 0x6F, 0x70, 0x71\r\n ];\r\n\r\n lemma_2toX();\r\n\r\n var hash_sha1 := SHA1_impl_Bytes(data);\r\n PrintHash(hash_sha1);\r\n var hash_sha256 := SHA256_impl_Bytes(data);\r\n PrintHash(hash_sha256);\r\n}\r\n\r\nmethod Main() {\r\n Test1();\r\n Test2();\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/BlockEncoding.i.dfy", "content": "include \"../../BigNum/BigNum.i.dfy\"\r\ninclude \"../../Util/seqs_reverse.i.dfy\"\r\ninclude \"RSASpec.s.dfy\"\r\ninclude \"ByteSequences.i.dfy\"\r\ninclude \"../../../Drivers/TPM/tpm-wrapper.i.dfy\"\r\ninclude \"../../FatNat/FatNatCommon.i.dfy\"\r\ninclude \"../../FatNat/Transforms.i.dfy\"\r\n\r\nstatic function method{:CompiledSpec} CompiledSpec_BlockType(pad_mode:PadMode) : int\r\nstatic function method{:CompiledSpec} CompiledSpec_SignaturePadByte() : int\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- octet-string to octet-string encoding\r\n\r\nmethod PadMessage(msg:seq, keysize_octets:nat, pad_mode:PadMode)\r\n returns (padded_msg:seq)\r\n requires IsByteSeq(msg);\r\n requires |msg| <= keysize_octets - 11;\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures pad_mode==PadModeSign() ==> TPM == old(TPM);\r\n ensures pad_mode==PadModeSign() ==> IoMemPerm == old(IoMemPerm);\r\n ensures TPM_ready();\r\n ensures IsByteSeq(padded_msg);\r\n ensures |padded_msg| == keysize_octets;\r\n ensures PKCS15_PaddingRelation(padded_msg, msg, pad_mode);\r\n ensures pad_mode==PadModeSign()\r\n ==> PKCS15_SignaturePad(msg, keysize_octets) == padded_msg;\r\n{\r\n var ps_len:int := keysize_octets - |msg| - 3;\r\n assert ps_len>=8;\r\n var ps := MakePaddingString(ps_len, pad_mode);\r\n padded_msg := [0, BlockType(pad_mode)] + ps + [0] + msg;\r\n assert |padded_msg| == keysize_octets;\r\n\r\n var i := ps_len + 3;\r\n\r\n //- PaddedMessageStartIndex conjuncts\r\n lemma_2toX();\r\n assert IsByteSeq(padded_msg);\r\n assert 0 < i <= |padded_msg|;\r\n assert 2 <= |padded_msg|;\r\n var padding := ps;\r\n assert IsByteSeq(padding);\r\n assert (forall j :: 0 <= j < |padding| ==> padding[j]!=0);\r\n assert padded_msg[0]==0;\r\n assert padded_msg[1]==BlockType(pad_mode);\r\n assert 2 padded_msg[j]!=0;\r\n//- assert padded_msg[i-1]==0;\r\n assert PaddedMessageStartIndex(padded_msg, i, pad_mode, ps);\r\n\r\n assert i >= 11;\r\n assert padded_msg[i..] == msg;\r\n\r\n assert PKCS15_PaddingRelationWith(padded_msg, msg, pad_mode, ps);\r\n}\r\n\r\nmethod RandomNonzeroOctet() returns (octet:int)\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures IsByte(octet);\r\n ensures 0!=octet;\r\n{\r\n lemma_2toX();\r\n var byte_seq := get_random(1);\r\n octet := byte_seq[0];\r\n if (octet==0)\r\n {\r\n octet:=42; // a popular value.\r\n }\r\n}\r\n\r\n\r\nstatic lemma lemma_RepeatDigit_for_ByteSeq(digit:int, count:int)\r\n decreases count;\r\n requires 0<=digit RepeatDigit(digit, count)[i] == digit;\r\n ensures IsByteSeq(RepeatDigit(digit, count));\r\n{\r\n if (count>0)\r\n {\r\n lemma_RepeatDigit_for_ByteSeq(digit, count-1);\r\n }\r\n}\r\n\r\nmethod MakePaddingString(ps_len:nat, pad_mode:PadMode) returns (os:seq)\r\n requires 8 <= ps_len; \r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures pad_mode==PadModeSign() ==> TPM == old(TPM);\r\n ensures pad_mode==PadModeSign() ==> IoMemPerm == old(IoMemPerm);\r\n ensures TPM_ready();\r\n ensures IsByteSeq(os);\r\n ensures |os| == ps_len;\r\n ensures forall octet :: 0 <= octet < |os| ==> os[octet] != 0;\r\n ensures pad_mode==PadModeSign()\r\n ==> os == RepeatDigit(SignaturePadByte(), |os|);\r\n{\r\n os := [];\r\n while (|os| IsByte(os[octet]);\r\n invariant forall octet :: 0 <= octet < |os| ==> os[octet] != 0;\r\n invariant pad_mode==PadModeSign()\r\n ==> forall i :: 0<=i<|os| ==> os[i] == SignaturePadByte();\r\n invariant TPM_ready();\r\n invariant pad_mode==PadModeSign() ==> TPM == old(TPM);\r\n invariant pad_mode==PadModeSign() ==> IoMemPerm == old(IoMemPerm);\r\n {\r\n var next_octet:int;\r\n assert pad_mode.PadModeSign? || pad_mode.PadModeEncrypt?;\r\n if (pad_mode.PadModeSign?)\r\n {\r\n next_octet := 0xff;\r\n }\r\n else //- if (pad_mode.PadModeEncrypt?)\r\n {\r\n next_octet := RandomNonzeroOctet();\r\n }\r\n/*\r\n else\r\n {\r\n assert false;\r\n }\r\n*/\r\n os := os + [next_octet];\r\n }\r\n\r\n lemma_2toX();\r\n lemma_RepeatDigit_for_ByteSeq(SignaturePadByte(), |os|);\r\n if (pad_mode.PadModeSign?)\r\n {\r\n ghost var obligation := RepeatDigit(SignaturePadByte(), |os|);\r\n assert |obligation| == |os|;\r\n forall (i | 0<=i<|os|)\r\n ensures obligation[i] == os[i];\r\n {\r\n assert obligation[i] == SignaturePadByte() == os[i];\r\n }\r\n assert obligation == os;\r\n }\r\n}\r\n\r\nstatic method UnpadMessage(padded_msg:seq, pad_mode:PadMode) returns (msg:seq)\r\n requires IsByteSeq(padded_msg);\r\n requires exists m :: IsByteSeq(m) && PKCS15_PaddingRelation(padded_msg, m, pad_mode);\r\n ensures IsByteSeq(msg);\r\n ensures PKCS15_PaddingRelation(padded_msg, msg, pad_mode);\r\n{\r\n ghost var gm :| IsByteSeq(gm) && PKCS15_PaddingRelation(padded_msg, gm, pad_mode);\r\n ghost var padding :| PKCS15_PaddingRelationWith(padded_msg, gm, pad_mode, padding);\r\n ghost var pl := |padding|+3;\r\n assert pl <= |padded_msg|;\r\n\r\n assert padded_msg[0]==0;\r\n assert padded_msg[1]==BlockType(pad_mode);\r\n\r\n var pad_idx:int := 2;\r\n\r\n if (2<=pad_idx < pl-1) {\r\n assert padded_msg[pad_idx] == padding[0];\r\n assert padded_msg[pad_idx]!=0;\r\n }\r\n\r\n while (padded_msg[pad_idx]!=0)\r\n decreases pl - pad_idx;\r\n invariant forall j::2<=j padded_msg[j]!=0;\r\n invariant 2<=pad_idx < pl;\r\n invariant 2<=pad_idx < pl-1 ==> padded_msg[pad_idx]!=0;\r\n {\r\n pad_idx := pad_idx + 1;\r\n if (pad_idx >= pl)\r\n {\r\n assert padded_msg[pl-1] == 0;\r\n assert false; //- violates invariant\r\n }\r\n if (2<=pad_idx < pl-1)\r\n {\r\n assert padded_msg[pad_idx] == padding[pad_idx-2];\r\n }\r\n }\r\n assert pad_idx == pl-1;\r\n\r\n pad_idx := pad_idx + 1; //- skip the end-of-pad zero\r\n msg := padded_msg[pad_idx..];\r\n assert pad_idx==|padding|+3;\r\n assert padded_msg[|padding|+3..] == msg;\r\n\r\n assert PKCS15_PaddingRelationWith(padded_msg, msg, pad_mode, padding);\r\n}\r\n\r\nstatic method UnpadMessageOrFail(padded_msg:seq, pad_mode:PadMode) returns (success:bool, msg:seq)\r\n requires IsByteSeq(padded_msg);\r\n ensures IsByteSeq(msg);\r\n ensures (success <==> exists m :: (IsByteSeq(m) && PKCS15_PaddingRelation(padded_msg, m, pad_mode)));\r\n ensures (success ==> PKCS15_PaddingRelation(padded_msg, msg, pad_mode));\r\n{\r\n msg := [];\r\n\r\n if (|padded_msg| < 11)\r\n {\r\n success := false;\r\n return;\r\n }\r\n\r\n //- must start with zero, BlockType\r\n if (padded_msg[0]!=0)\r\n {\r\n success := false;\r\n return;\r\n }\r\n if (padded_msg[1]!=BlockType(pad_mode))\r\n {\r\n success := false;\r\n return;\r\n }\r\n\r\n var pad_idx:int := 2;\r\n while (pad_idx < |padded_msg| && padded_msg[pad_idx]!=0)\r\n invariant pad_idx >= 2;\r\n invariant forall j::2<=j padded_msg[j]!=0;\r\n {\r\n pad_idx := pad_idx + 1;\r\n }\r\n\r\n if (pad_idx >= |padded_msg|)\r\n {\r\n success := false;\r\n return;\r\n\r\n }\r\n\r\n ghost var padding := padded_msg[2..pad_idx];\r\n assert padded_msg[pad_idx] == 0;\r\n pad_idx := pad_idx + 1; //- skip the end-of-pad zero\r\n\r\n if (pad_idx < 11)\r\n {\r\n success := false;\r\n forall (m:seq | IsByteSeq(m))\r\n ensures !PKCS15_PaddingRelation(padded_msg, m, pad_mode);\r\n {\r\n forall (padding:seq)\r\n ensures !PKCS15_PaddingRelationWith(padded_msg, m, pad_mode, padding);\r\n {\r\n if (PKCS15_PaddingRelationWith(padded_msg, m, pad_mode, padding))\r\n {\r\n assert |padding|>=8;\r\n assert padded_msg[2..|padding|+3-1] == padding;\r\n if (pad_idx >= 3)\r\n {\r\n calc {\r\n 0;\r\n padded_msg[pad_idx-1];\r\n padded_msg[2..|padding|+3-1][pad_idx-3];\r\n padding[pad_idx-3];\r\n != 0;\r\n }\r\n assert false;\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n }\r\n }\r\n//- assert !(exists padding:seq :: PKCS15_PaddingRelationWith(padded_msg, m, pad_mode, padding));\r\n//- assert !PKCS15_PaddingRelation(padded_msg, m, pad_mode);\r\n }\r\n//- assert !exists m :: (IsByteSeq(m) && PKCS15_PaddingRelation(padded_msg, m, pad_mode));\r\n return;\r\n }\r\n\r\n success := true;\r\n msg := padded_msg[pad_idx..];\r\n\r\n assert PKCS15_PaddingRelationWith(padded_msg, msg, pad_mode, padding);\r\n assert PKCS15_PaddingRelation(padded_msg, msg, pad_mode);\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- encoding an octet string to integers\r\n\r\nstatic function method LEBytesToWord(os:seq) : int\r\n requires IsByteSeq(os);\r\n requires |os|==4;\r\n ensures Word32(LEBytesToWord(os));\r\n{\r\n lemma_2to32();\r\n os[0] + 256*os[1] + 65536*os[2] + 16777216*os[3]\r\n}\r\n\r\nstatic lemma lemma_LEBytesToWord(os:seq)\r\n requires IsByteSeq(os);\r\n requires |os|==4;\r\n ensures LittleEndianIntegerValue(os) == LEBytesToWord(os);\r\n{\r\n calc {\r\n LittleEndianIntegerValue(os);\r\n LittleEndianIntegerValue(os[1..])*256 + os[0];\r\n (LittleEndianIntegerValue(os[1..][1..])*256 + os[1..][0])*256 + os[0];\r\n {\r\n assert os[1..][1..] == os[2..];\r\n assert os[1..][0] == os[1];\r\n }\r\n (LittleEndianIntegerValue(os[2..])*256 + os[1])*256 + os[0];\r\n ((LittleEndianIntegerValue(os[2..][1..])*256 + os[2..][0])*256 + os[1])*256 + os[0];\r\n ((LittleEndianIntegerValue(os[3..])*256 + os[2])*256 + os[1])*256 + os[0];\r\n (((LittleEndianIntegerValue(os[3..][1..])*256 + os[3..][0])*256 + os[2])*256 + os[1])*256 + os[0];\r\n (((LittleEndianIntegerValue(os[4..])*256 + os[3])*256 + os[2])*256 + os[1])*256 + os[0];\r\n (((LittleEndianIntegerValue([])*256 + os[3])*256 + os[2])*256 + os[1])*256 + os[0];\r\n (((0*256 + os[3])*256 + os[2])*256 + os[1])*256 + os[0];\r\n ((os[3]*256 + os[2])*256 + os[1])*256 + os[0];\r\n (os[3]*256*256 + os[2]*256 + os[1])*256 + os[0];\r\n os[3]*256*256*256 + os[2]*256*256 + os[1]*256 + os[0];\r\n LEBytesToWord(os);\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEByteSeqToWordSeq_preserves_nonzero_prefix_property(bs:seq, ws:seq, padbytes:seq)\r\n requires IsByteSeq(bs);\r\n requires IsWordSeq(ws);\r\n requires |bs|==0 || bs[0] > 0;\r\n requires |bs|>0 ==> |ws|>0;\r\n requires |ws| == (|bs|+3)/4;\r\n requires BEByteSeqToInt(bs) == BEWordSeqToInt(ws);\r\n requires |BEWordSeqToByteSeq(ws)| >= |bs|;\r\n requires padbytes == SequenceOfZeros(|ws|*4 - |bs|);\r\n requires IsByteSeq(padbytes);\r\n requires BEWordSeqToByteSeq(ws) == padbytes + bs;\r\n requires (|bs|%4)==0 ==> BEWordSeqToByteSeq(ws) == bs;\r\n\r\n ensures |ws| == 0 || ws[0] != 0;\r\n{\r\n lemma_2toX();\r\n if (|bs|==0)\r\n {\r\n assert |ws| == 0;\r\n } else if (ws[0]==0) {\r\n var prefix := padbytes + bs[..4-|padbytes|];\r\n assert prefix[|padbytes|] != 0;\r\n var L4 := 4;\r\n calc {\r\n BEIntToDigitSeq(power2(8), 1*4, 0);\r\n { lemma_BEDigitSeqToInt_of_zeros(power2(32), [0]); }\r\n BEIntToDigitSeq(power2(8), |[0]|*4, BEDigitSeqToInt(power2(32), [0]));\r\n BEWordSeqToByteSeq([0]);\r\n BEWordSeqToByteSeq([ws[0]]);\r\n { assert [ws[0]] == ws[..1]; }\r\n BEWordSeqToByteSeq(ws[..1]);\r\n//- BEIntToDigitSeq(power2(8), |ws[..1]|*4, BEDigitSeqToInt(power2(32), ws[..1]));\r\n BEIntToDigitSeq(power2(8), |ws[..1]|*4, BEDigitSeqToInt(power2(32), ws[..1]));\r\n { lemma_mul_is_mul_boogie(|ws[..1]|, 4); }\r\n BEIntToDigitSeq(power2(8), |ws[..1]|*L4, BEDigitSeqToInt(power2(32), ws[..1]));\r\n { lemma_mul_is_mul_boogie(8,4);\r\n lemma_mul_is_mul_boogie(1,4);\r\n lemma_select_from_transform(ws, ws[..1], ws[1..], 8, 4, 32, 4);\r\n//- assert |ws[..1]| == 1;\r\n lemma_mul_basics_forall();\r\n//- assert |ws[..1]|*L4 == 4;\r\n lemma_BEIntToDigitSeq_mp_min(power2(8), |ws|*L4, BEDigitSeqToInt_premium(power2(32), ws));\r\n lemma_mul_is_mul_boogie(|ws|, 4);\r\n//- assert 4 <= |ws|*L4;\r\n//- assert 4 <= |BEIntToDigitSeq(power2(8), |ws|*L4, BEDigitSeqToInt(power2(32), ws))|;\r\n }\r\n BEIntToDigitSeq(power2(8), |ws|*L4, BEDigitSeqToInt(power2(32), ws))[..4];\r\n { lemma_mul_is_mul_boogie(|ws|, 4); }\r\n BEWordSeqToByteSeq(ws)[..4];\r\n prefix;\r\n }\r\n//- assert prefix == BEIntToDigitSeq(power2(8), 4, 0);\r\n lemma_BEIntToDigitSeq_of_zero(power2(8), prefix);\r\n//- assert prefix[|padbytes|] == 0;\r\n assert false;\r\n }\r\n}\r\n\r\nmethod BESeqToInteger(be_padded_msg:seq) returns (M:array)\r\n requires IsByteSeq(be_padded_msg);\r\n//- requires |be_padded_msg|%4==0;\r\n requires |be_padded_msg|>0;\r\n//- requires be_padded_msg[1] != 0;\r\n ensures WellformedFatNat(M);\r\n ensures J(M) == BigEndianIntegerValue(be_padded_msg);\r\n ensures J(M) == BEByteSeqToInt(be_padded_msg);\r\n{\r\n lemma_2toX();\r\n var trimmed_be_byte_string := TrimLeadingZeros(256, be_padded_msg);\r\n assert |trimmed_be_byte_string|==0 || trimmed_be_byte_string[0] != 0;\r\n \r\n var big_endian_word_string,padbytes := BEByteSeqToWordSeq_impl(trimmed_be_byte_string);\r\n lemma_BEByteSeqToWordSeq_preserves_nonzero_prefix_property(trimmed_be_byte_string, big_endian_word_string, padbytes);\r\n\r\n M := SeqToArray(big_endian_word_string);\r\n calc {\r\n J(M);\r\n BEDigitSeqToInt(power2(32), big_endian_word_string);\r\n BEByteSeqToInt(trimmed_be_byte_string);\r\n BEByteSeqToInt(be_padded_msg);\r\n { lemma_BigEndianIntegerValue_equals_BEByteSeqToInt(be_padded_msg); }\r\n BigEndianIntegerValue(be_padded_msg);\r\n }\r\n lemma_BigEndianIntegerValue_equals_BEByteSeqToInt(be_padded_msg);\r\n}\r\n\r\nmethod MessageToInteger(msg:seq, keysize_octets:nat, pad_mode:PadMode) returns (M:array, ghost pm:seq)\r\n requires IsByteSeq(msg);\r\n//- requires keysize_octets % 4 == 0;\r\n requires |msg| <= keysize_octets - 11;\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures pad_mode==PadModeSign() ==> TPM == old(TPM);\r\n ensures pad_mode==PadModeSign() ==> IoMemPerm == old(IoMemPerm);\r\n ensures WellformedFatNat(M);\r\n ensures IsByteSeq(pm);\r\n ensures PKCS15_PaddingRelation(pm, msg, pad_mode);\r\n ensures pad_mode==PadModeSign()\r\n ==> PKCS15_SignaturePad(msg, keysize_octets) == pm;\r\n ensures BigEndianIntegerValue(pm)==J(M);\r\n ensures BEByteSeqToInt(pm)==J(M);\r\n ensures 0 < J(M) < power2(8*(keysize_octets-1));\r\n ensures |pm|==keysize_octets;\r\n ensures fresh(M);\r\n{\r\n var be_padded_msg:seq := PadMessage(msg, keysize_octets, pad_mode);\r\n pm := be_padded_msg;\r\n\r\n var be_bytes := SeqToArray(be_padded_msg);\r\n M := BEByteArrayToWordArray(be_bytes);\r\n\r\n calc {\r\n BigEndianIntegerValue(be_padded_msg);\r\n { lemma_BigEndianIntegerValue_zero_prefix(be_padded_msg, be_padded_msg[1..]); }\r\n BigEndianIntegerValue(be_padded_msg[1..]);\r\n < { lemma_BigEndianIntegerValue_bound(be_padded_msg[1..]); }\r\n power2(8*|be_padded_msg[1..]|);\r\n power2(8*(|be_padded_msg|-1));\r\n power2(8*(keysize_octets-1));\r\n }\r\n\r\n calc {\r\n BigEndianIntegerValue(be_padded_msg);\r\n { lemma_BigEndianIntegerValue_zero_prefix(be_padded_msg, be_padded_msg[1..]); }\r\n BigEndianIntegerValue(be_padded_msg[1..]);\r\n >= { lemma_BigEndianIntegerValue_bound(be_padded_msg[1..]); }\r\n power2(8*(|be_padded_msg[1..]|-1))*be_padded_msg[1..][0];\r\n { assert be_padded_msg[1..][0] == BlockType(pad_mode); }\r\n mul(power2(8*(|be_padded_msg[1..]|-1)),BlockType(pad_mode));\r\n mul(power2(8*(|be_padded_msg|-2)),BlockType(pad_mode));\r\n { lemma_mul_is_commutative_forall(); }\r\n mul(BlockType(pad_mode),power2(8*(|be_padded_msg|-2)));\r\n >= {\r\n assert 1 <= BlockType(pad_mode) <= 2;\r\n lemma_mul_increases(BlockType(pad_mode),power2(8*(|be_padded_msg|-2)));\r\n }\r\n power2(8*(|be_padded_msg|-2));\r\n power2(8*|be_padded_msg|-16);\r\n >= {\r\n assert 11 <= keysize_octets;\r\n calc {\r\n 8*(|be_padded_msg|-2);\r\n 8*|be_padded_msg| - 16;\r\n 8*keysize_octets - 16;\r\n >=\r\n 8*11 - 16;\r\n 88 - 16;\r\n 72;\r\n > 0;\r\n }\r\n lemma_power2_increases(0, 8*(|be_padded_msg|-2));\r\n }\r\n power2(0);\r\n { lemma_power2_0_is_1(); }\r\n 1;\r\n > 0;\r\n }\r\n\r\n lemma_2toX();\r\n calc {\r\n BEByteSeqToInt(pm);\r\n BEByteSeqToInt(be_bytes[..]);\r\n BEWordSeqToInt(M[..]);\r\n J(M);\r\n }\r\n lemma_BigEndianIntegerValue_equals_BEByteSeqToInt(pm);\r\n}\r\n\r\nstatic method LEWordToBytes(word:int) returns (os:seq)\r\n requires Word32(word);\r\n ensures IsByteSeq(os);\r\n ensures |os|==4;\r\n ensures LEBytesToWord(os) == word;\r\n{\r\n \r\n var r0 := word % 256;\r\n var q0 := word / 256;\r\n var r1 := q0 % 256;\r\n var q1 := q0 / 256;\r\n var r2 := q1 % 256;\r\n var q2 := q1 / 256;\r\n os := [ r0, r1, r2, q2 ];\r\n\r\n lemma_2to32();\r\n\r\n calc {\r\n LEBytesToWord(os);\r\n os[0] + 256*os[1] + 65536*os[2] + 16777216*os[3];\r\n r0 + 256*r1 + 65536*r2 + 16777216*q2;\r\n r0 + 256*(r1 + 256*r2 + 65536*q2);\r\n r0 + 256*(r1 + 256*(r2 + 256*q2));\r\n {\r\n lemma_mul_is_mul_boogie(256,q2);\r\n lemma_mul_is_mul_boogie(256,r2 + 256*q2);\r\n lemma_mul_is_mul_boogie(256,r1 + 256*(r2 + 256*q2));\r\n }\r\n r0 + mul(256,(r1 + mul(256,(r2 + mul(256,q2)))));\r\n {\r\n lemma_fundamental_div_mod(q1, 256);\r\n assert q1 == mul(256, div(q1, 256)) + mod(q1,256);\r\n assert div(q1,256) == q1/256 == q2;\r\n assert q1 == mul(256, q2) + r2;\r\n }\r\n r0 + mul(256,(r1 + mul(256,q1)));\r\n {\r\n lemma_fundamental_div_mod(q0, 256);\r\n assert q0 == mul(256, div(q0, 256)) + mod(q0,256);\r\n assert q0 == mul(256, q1) + r1;\r\n }\r\n r0 + mul(256,q0);\r\n {\r\n lemma_fundamental_div_mod(word, 256);\r\n assert word == mul(256, div(word, 256)) + mod(word,256);\r\n assert word == mul(256, q0) + r0;\r\n }\r\n word;\r\n }\r\n}\r\n\r\nstatic lemma lemma_LittleEndianIntegerValue_chomps_word(os:seq)\r\n requires IsByteSeq(os);\r\n requires |os|>=4;\r\n ensures LittleEndianIntegerValue(os)\r\n == LEBytesToWord(os[0..4]) + Width()*LittleEndianIntegerValue(os[4..]);\r\n{\r\n calc {\r\n LittleEndianIntegerValue(os);\r\n LittleEndianIntegerValue(os[1..])*256 + os[0];\r\n (LittleEndianIntegerValue(os[1..][1..])*256 + os[1..][0])*256 + os[0];\r\n {\r\n assert os[1..][1..] == os[2..];\r\n assert os[1..][0] == os[1];\r\n }\r\n (LittleEndianIntegerValue(os[2..])*256 + os[1])*256 + os[0];\r\n ((LittleEndianIntegerValue(os[2..][1..])*256 + os[2..][0])*256 + os[1])*256 + os[0];\r\n {\r\n assert os[2..][1..] == os[3..];\r\n assert os[2..][0] == os[2];\r\n }\r\n ((LittleEndianIntegerValue(os[3..])*256 + os[2])*256 + os[1])*256 + os[0];\r\n (((LittleEndianIntegerValue(os[3..][1..])*256 + os[3..][0])*256 + os[2])*256 + os[1])*256 + os[0];\r\n {\r\n assert os[3..][1..] == os[4..];\r\n assert os[3..][0] == os[3];\r\n }\r\n (((LittleEndianIntegerValue(os[4..])*256 + os[3])*256 + os[2])*256 + os[1])*256 + os[0];\r\n ((LittleEndianIntegerValue(os[4..])*256*256 + os[3]*256 + os[2])*256 + os[1])*256 + os[0];\r\n (LittleEndianIntegerValue(os[4..])*256*256*256 + os[3]*256*256 + os[2]*256 + os[1])*256 + os[0];\r\n LittleEndianIntegerValue(os[4..])*256*256*256*256 + os[3]*256*256*256 + os[2]*256*256 + os[1]*256 + os[0];\r\n calc {\r\n LittleEndianIntegerValue(os[4..])*256*256*256*256;\r\n { mul_associates256(LittleEndianIntegerValue(os[4..])); }\r\n LittleEndianIntegerValue(os[4..])*256*256*(256*256);\r\n { mul_associates256(LittleEndianIntegerValue(os[4..])); }\r\n LittleEndianIntegerValue(os[4..])*(256*256)*(256*256);\r\n { lemma_mul_is_associative(LittleEndianIntegerValue(os[4..]), (256*256), (256*256)); }\r\n LittleEndianIntegerValue(os[4..])*(256*256*256*256);\r\n }\r\n {\r\n lemma_2to32(); \r\n //-lemma_mul_is_mul_boogie(LittleEndianIntegerValue(os[4..]), Width());\r\n }\r\n LittleEndianIntegerValue(os[4..])*Width() + os[3]*256*256*256 + os[2]*256*256 + os[1]*256 + os[0];\r\n LittleEndianIntegerValue(os[4..])*Width() + os[0] + 256*os[1] + 65536*os[2] + 16777216*os[3];\r\n { lemma_mul_is_commutative(LittleEndianIntegerValue(os[4..]),Width()); }\r\n LEBytesToWord(os[0..4]) + Width()*LittleEndianIntegerValue(os[4..]);\r\n }\r\n}\r\n\r\nstatic lemma mul_associates256(x:int)\r\n ensures (x*256)*256 == x * (256 * 256);\r\n{\r\n lemma_mul_is_associative(x, 256, 256);\r\n}\r\n\r\nstatic method WordsToOctets(ws:seq) returns (os:seq)\r\n requires IsWordSeq(ws);\r\n ensures IsByteSeq(os);\r\n ensures LittleEndianIntegerValue(os) == V(ws);\r\n{\r\n os := [];\r\n var end_ptr := |ws|;\r\n\r\n calc {\r\n LittleEndianIntegerValue(os);\r\n 0;\r\n { reveal_V(); }\r\n V([]);\r\n { assert ws[end_ptr..] == []; }\r\n V(ws[end_ptr..]);\r\n }\r\n\r\n while (end_ptr > 0)\r\n invariant 0 <= end_ptr <= |ws|;\r\n invariant IsByteSeq(os);\r\n invariant LittleEndianIntegerValue(os) == V(ws[end_ptr..]);\r\n {\r\n var word_os := LEWordToBytes(ws[end_ptr-1]);\r\n ghost var old_os := os;\r\n os := word_os + os;\r\n\r\n calc {\r\n LittleEndianIntegerValue(os);\r\n { lemma_LittleEndianIntegerValue_chomps_word(os); }\r\n LEBytesToWord(word_os) + Width()*LittleEndianIntegerValue(old_os);\r\n ws[end_ptr-1] + Width()*V(ws[end_ptr..]);\r\n { reveal_V(); }\r\n V([ws[end_ptr-1]] + ws[end_ptr..]);\r\n { assert [ws[end_ptr-1]] + ws[end_ptr..] == ws[end_ptr-1..]; }\r\n V(ws[end_ptr-1..]);\r\n }\r\n\r\n end_ptr := end_ptr - 1;\r\n }\r\n assert ws==ws[0..];\r\n}\r\n\r\npredicate {:heap} CanDecodeFatInteger(M:array, keysize_octets:nat, pad_mode:PadMode)\r\n requires WellformedFatNat(M);\r\n reads M;\r\n{\r\n exists pm:seq, m:seq ::\r\n IsByteSeq(pm)\r\n && IsByteSeq(m)\r\n && PKCS15_PaddingRelation(pm, m, pad_mode)\r\n && BigEndianIntegerValue(pm)==J(M)\r\n && |pm|==keysize_octets\r\n}\r\n\r\nstatic predicate CanDecodeInteger(M:BigNat, keysize_octets:nat, pad_mode:PadMode)\r\n requires WellformedBigNat(M);\r\n{\r\n exists pm:seq, m:seq ::\r\n IsByteSeq(pm)\r\n && IsByteSeq(m)\r\n && PKCS15_PaddingRelation(pm, m, pad_mode)\r\n && BigEndianIntegerValue(pm)==I(M)\r\n && |pm|==keysize_octets\r\n}\r\n\r\nmethod IntegerToBESeq(M:array) returns (be_padded_msg:seq)\r\n requires WellformedFatNat(M);\r\n ensures IsByteSeq(be_padded_msg);\r\n ensures |be_padded_msg| > 0;\r\n ensures be_padded_msg[0] == 0;\r\n ensures (|be_padded_msg| > 1) ==> be_padded_msg[1] != 0;\r\n ensures J(M) == BigEndianIntegerValue(be_padded_msg);\r\n ensures |be_padded_msg| > 2 ==> power2(8*(|be_padded_msg|-2)) <= BigEndianIntegerValue(be_padded_msg);\r\n ensures [0] + BEIntToByteSeq(J(M)) == be_padded_msg;\r\n{\r\n var wordy_be_padded_msg := BEWordArrayToByteArray(M);\r\n\r\n lemma_2toX();\r\n var stripped_be_padded_msg := StripLeadingZeros(256, wordy_be_padded_msg[..]);\r\n //- now no zeros.\r\n\r\n be_padded_msg := [0] + stripped_be_padded_msg;\r\n \r\n\r\n assert |stripped_be_padded_msg|>0 ==> stripped_be_padded_msg[0]!=0;\r\n assert |be_padded_msg|>1 ==> be_padded_msg[1]!=0;\r\n\r\n calc {\r\n BigEndianIntegerValue(be_padded_msg);\r\n { lemma_BigEndianIntegerValue_zero_prefix(be_padded_msg, stripped_be_padded_msg); }\r\n BigEndianIntegerValue(stripped_be_padded_msg);\r\n { lemma_BigEndianIntegerValue_zero_prefix(wordy_be_padded_msg[..], stripped_be_padded_msg); }\r\n BigEndianIntegerValue(wordy_be_padded_msg[..]);\r\n { lemma_BigEndianIntegerValue_equals_BEByteSeqToInt(wordy_be_padded_msg[..]); }\r\n BEByteSeqToInt(wordy_be_padded_msg[..]);\r\n J(M);\r\n }\r\n\r\n lemma_2toX();\r\n if (|be_padded_msg| == 0)\r\n {\r\n assert false;\r\n }\r\n if (|be_padded_msg| <= 2)\r\n {\r\n lemma_BigEndianIntegerValue_equals_BEByteSeqToInt(be_padded_msg);\r\n }\r\n else\r\n {\r\n assert |stripped_be_padded_msg| > 0;\r\n calc {\r\n power2(8*(|be_padded_msg|-2));\r\n power2(8*(|stripped_be_padded_msg|-1));\r\n power2(8*(|stripped_be_padded_msg|-1))*1;\r\n { lemma_mul_is_mul_boogie(power2(8*(|stripped_be_padded_msg|-1)),1); }\r\n mul(power2(8*(|stripped_be_padded_msg|-1)),1);\r\n <= { lemma_mul_left_inequality(power2(8*(|stripped_be_padded_msg|-1)), 1, stripped_be_padded_msg[0]); }\r\n power2(8*(|stripped_be_padded_msg|-1))*stripped_be_padded_msg[0];\r\n <= { lemma_BigEndianIntegerValue_bound(stripped_be_padded_msg); }\r\n BigEndianIntegerValue(stripped_be_padded_msg);\r\n { lemma_BigEndianIntegerValue_zero_prefix(be_padded_msg, stripped_be_padded_msg); }\r\n BigEndianIntegerValue(be_padded_msg);\r\n }\r\n lemma_BigEndianIntegerValue_equals_BEByteSeqToInt(be_padded_msg);\r\n }\r\n assert J(M) == BigEndianIntegerValue(be_padded_msg) == BEByteSeqToInt(be_padded_msg);\r\n\r\n ghost var beseq := BEIntToByteSeq(J(M));\r\n lemma_BEIntToByteSeq_decoding(J(M));\r\n assert IsByteSeq(beseq);\r\n\r\n calc {\r\n BigEndianIntegerValue(beseq);\r\n { lemma_BigEndianIntegerValue_equals_BEByteSeqToInt(beseq); }\r\n BEByteSeqToInt(beseq);\r\n { lemma_BEIntToByteSeq_decoding(J(M)); }\r\n J(M);\r\n }\r\n\r\n assert BigEndianIntegerValue(beseq) == J(M);\r\n\r\n assert BigEndianIntegerValue(beseq) == BigEndianIntegerValue(be_padded_msg);\r\n\r\n lemma_BEIntToByteSeq_form(J(M));\r\n assert |beseq|==0 || beseq[0] != 0;\r\n ghost var zbeseq := [0]+beseq;\r\n lemma_BigEndianIntegerValue_zero_prefix(zbeseq, beseq);\r\n assert BigEndianIntegerValue(zbeseq) == BigEndianIntegerValue(be_padded_msg);\r\n\r\n//- lemma_BigEndianIntegerValue_zero_prefix_converse_inner(s0:seq, s1:seq)\r\n//- requires IsByteSeq(s0);\r\n//- requires IsByteSeq(s1);\r\n//- requires |s0| >= |s1|;\r\n//- requires BigEndianIntegerValue(s0) == BigEndianIntegerValue(s1);\r\n//- ensures ZeroPrefix(s0, s1);\r\n\r\n assert IsByteSeq(zbeseq);\r\n assert |zbeseq| > 0;\r\n assert zbeseq[0] == 0;\r\n assert |zbeseq|>1 ==> zbeseq[1] != 0;\r\n assert BigEndianIntegerValue(be_padded_msg) == BigEndianIntegerValue(zbeseq);\r\n lemma_SingleZeroPrefixedBigEndianIntegerValuesEqual(zbeseq, be_padded_msg);\r\n assert [0] + BEIntToByteSeq(J(M)) == zbeseq == be_padded_msg;\r\n}\r\n\r\nmethod IntegerToMessage(M:array, keysize_octets:nat, pad_mode:PadMode) returns (success:bool, msg:seq, ghost be_padded_msg:seq)\r\n requires WellformedFatNat(M);\r\n ensures IsByteSeq(msg);\r\n ensures success <==> CanDecodeFatInteger(M, keysize_octets, pad_mode);\r\n ensures success ==>\r\n IsByteSeq(be_padded_msg)\r\n && PKCS15_PaddingRelation(be_padded_msg, msg, pad_mode)\r\n && BigEndianIntegerValue(be_padded_msg)==J(M)\r\n && |be_padded_msg| == keysize_octets;\r\n{\r\n var be_padded_msg_real := IntegerToBESeq(M);\r\n be_padded_msg := be_padded_msg_real;\r\n\r\n if (|be_padded_msg_real| != keysize_octets)\r\n {\r\n success := false;\r\n msg := [];\r\n forall (pm:seq, m:seq |\r\n IsByteSeq(pm)\r\n && IsByteSeq(m)\r\n && PKCS15_PaddingRelation(pm, m, pad_mode)\r\n && BigEndianIntegerValue(pm)==J(M)\r\n && |pm|==keysize_octets)\r\n ensures false;\r\n {\r\n calc {\r\n keysize_octets;\r\n |pm|;\r\n {\r\n calc {\r\n BigEndianIntegerValue(be_padded_msg_real);\r\n J(M);\r\n BigEndianIntegerValue(pm);\r\n }\r\n lemma_SingleZeroPrefixedBigEndianIntegerValuesEqual(pm, be_padded_msg_real);\r\n }\r\n |be_padded_msg_real|;\r\n != keysize_octets;\r\n }\r\n }\r\n assert !CanDecodeFatInteger(M, keysize_octets, pad_mode);\r\n }\r\n else\r\n {\r\n success,msg := UnpadMessageOrFail(be_padded_msg_real, pad_mode);\r\n\r\n if (!success)\r\n {\r\n forall pm:seq, m:seq\r\n ensures !(IsByteSeq(pm)\r\n && IsByteSeq(m)\r\n && PKCS15_PaddingRelation(pm, m, pad_mode)\r\n && BigEndianIntegerValue(pm)==J(M));\r\n {\r\n if (IsByteSeq(pm)\r\n && IsByteSeq(m)\r\n && BigEndianIntegerValue(pm)==J(M))\r\n {\r\n lemma_BigEndianIntegerValue_zero_prefix_converse(pm, be_padded_msg);\r\n if (pm == be_padded_msg)\r\n {\r\n assert !(exists m :: (IsByteSeq(m) && PKCS15_PaddingRelation(be_padded_msg, m, pad_mode)));\r\n assert !PKCS15_PaddingRelation(pm, m, pad_mode);\r\n }\r\n else if (ZeroPrefix(pm, be_padded_msg))\r\n {\r\n assert |pm| >= |be_padded_msg|;\r\n assert |pm| > |be_padded_msg|;\r\n if (1 < |pm|-|be_padded_msg|)\r\n {\r\n assert pm[1]==0;\r\n }\r\n else if (1 == |pm|-|be_padded_msg|)\r\n {\r\n calc {\r\n pm[1];\r\n pm[ 1 .. ][0];\r\n be_padded_msg[0];\r\n 0;\r\n }\r\n }\r\n else\r\n {\r\n assert 0 == |pm|-|be_padded_msg|;\r\n assert pm == be_padded_msg;\r\n assert false;\r\n }\r\n assert !PKCS15_PaddingRelation(pm, m, pad_mode);\r\n }\r\n else\r\n {\r\n assert ZeroPrefix(be_padded_msg, pm);\r\n if (0 == |be_padded_msg|-|pm|)\r\n {\r\n assert pm == be_padded_msg;\r\n assert false;\r\n }\r\n else if (1 < |be_padded_msg|-|pm|)\r\n {\r\n assert be_padded_msg[1] == 0;\r\n assert false;\r\n }\r\n else if (|pm| < 1)\r\n {\r\n assert !PKCS15_PaddingRelation(pm, m, pad_mode);\r\n }\r\n else if (|be_padded_msg| < 2)\r\n {\r\n assert |pm| <= |be_padded_msg|;\r\n assert !PKCS15_PaddingRelation(pm, m, pad_mode);\r\n }\r\n else\r\n {\r\n assert 1 == |be_padded_msg|-|pm|;\r\n calc {\r\n be_padded_msg[1];\r\n be_padded_msg[ 1.. ][0];\r\n pm[0];\r\n }\r\n assert pm[0]!=0;\r\n assert !PKCS15_PaddingRelation(pm, m, pad_mode);\r\n }\r\n }\r\n }\r\n }\r\n }\r\n else\r\n {\r\n assert IsByteSeq(be_padded_msg);\r\n assert PKCS15_PaddingRelation(be_padded_msg, msg, pad_mode);\r\n }\r\n }\r\n}\r\n\r\nstatic method BEWordToBytes(word:int) returns (os:seq)\r\n requires Word32(word);\r\n ensures IsByteSeq(os);\r\n ensures |os|==4;\r\n ensures BigEndianIntegerValue(os) == word;\r\n{\r\n var leseq := LEWordToBytes(word);\r\n os := ReverseOctetString(leseq);\r\n\r\n calc {\r\n BigEndianIntegerValue(os);\r\n { lemma_endian_reversal(os); }\r\n LittleEndianIntegerValue(Reverse(os));\r\n { lemma_Reverse_symmetry(os, leseq); }\r\n LittleEndianIntegerValue(leseq);\r\n { lemma_LEBytesToWord(leseq); }\r\n LEBytesToWord(leseq);\r\n word;\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/ByteSequences.i.dfy", "content": "include \"RSASpec.s.dfy\"\r\ninclude \"../../Math/power2.i.dfy\"\r\ninclude \"../../Util/integer_sequences_premium.i.dfy\"\r\ninclude \"../../BigNum/BigNumBEAdaptor.i.dfy\"\r\n\r\nstatic function BigEndianIntegerValue(os:seq) : nat\r\n decreases |os|;\r\n requires IsByteSeq(os);\r\n{\r\n if (os==[]) then\r\n 0\r\n else\r\n BigEndianIntegerValue(os[0..|os|-1])*256 + os[|os|-1]\r\n}\r\n\r\nstatic lemma lemma_BigEndianIntegerValue_nonnegative(os:seq)\r\n decreases |os|;\r\n requires IsByteSeq(os);\r\n ensures 0 <= BigEndianIntegerValue(os);\r\n{\r\n if (os!=[])\r\n {\r\n calc {\r\n BigEndianIntegerValue(os);\r\n BigEndianIntegerValue(os[0..|os|-1])*256 + os[|os|-1];\r\n >= { lemma_BigEndianIntegerValue_nonnegative(os[0..|os|-1]); }\r\n 0*256 + os[|os|-1];\r\n os[|os|-1];\r\n >= 0;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_BigEndianIntegerValue_strip_hi(os:seq)\r\n decreases |os|;\r\n requires IsByteSeq(os);\r\n requires 0 < |os|;\r\n ensures BigEndianIntegerValue(os) == os[0]*power2(8*(|os|-1)) + BigEndianIntegerValue(os[1..]);\r\n{\r\n if(|os|==1)\r\n {\r\n calc {\r\n BigEndianIntegerValue(os);\r\n BigEndianIntegerValue(os[0..|os|-1])*256 + os[|os|-1];\r\n BigEndianIntegerValue([])*256 + os[0];\r\n 0*256 + os[0];\r\n os[0];\r\n { lemma_mul_basics_forall(); }\r\n mul(os[0],1);\r\n { lemma_power2_0_is_1(); }\r\n os[0]*power2(0);\r\n os[0]*power2(8*0);\r\n os[0]*power2(8*(|os|-1));\r\n os[0]*power2(8*(|os|-1)) + 0;\r\n os[0]*power2(8*(|os|-1)) + BigEndianIntegerValue(os[1..]);\r\n }\r\n } else {\r\n var sos := os[0..|os|-1];\r\n calc {\r\n BigEndianIntegerValue(os);\r\n //- defn BigEndianIntegerValue\r\n BigEndianIntegerValue(os[0..|os|-1])*256 + os[|os|-1];\r\n //- defn sos\r\n BigEndianIntegerValue(sos)*256 + os[|os|-1];\r\n { lemma_BigEndianIntegerValue_strip_hi(sos); }\r\n (sos[0]*power2(8*(|sos|-1)) + BigEndianIntegerValue(sos[1..]))*256 + os[|os|-1];\r\n //- distributitivity of boogie mul\r\n (sos[0]*power2(8*(|sos|-1)))*256 + BigEndianIntegerValue(sos[1..])*256 + os[|os|-1];\r\n {\r\n assert |sos|-1 == |os|-2;\r\n assert sos[1..] == os[1..|os|-1];\r\n }\r\n (os[0]*power2(8*(|os|-2)))*256 + BigEndianIntegerValue(os[1..|os|-1])*256 + os[|os|-1];\r\n { lemma_mul_is_mul_boogie(os[0]*power2(8*(|os|-2)),256); }\r\n mul(os[0]*power2(8*(|os|-2)),256) + BigEndianIntegerValue(os[1..|os|-1])*256 + os[|os|-1];\r\n { lemma_mul_is_associative_forall(); }\r\n os[0]*mul(power2(8*(|os|-2)),256) + BigEndianIntegerValue(os[1..|os|-1])*256 + os[|os|-1];\r\n {\r\n lemma_2toX();\r\n assert power2(8)==256;\r\n }\r\n os[0]*(power2(8*(|os|-2))*power2(8)) + BigEndianIntegerValue(os[1..|os|-1])*256 + os[|os|-1];\r\n { lemma_power2_adds(8*(|os|-2), 8); }\r\n os[0]*power2(8*(|os|-2)+8) + BigEndianIntegerValue(os[1..|os|-1])*256 + os[|os|-1];\r\n {\r\n lemma_mul_is_mul_boogie(8, |os|-2);\r\n lemma_mul_basics_forall();\r\n }\r\n os[0]*power2(mul(8,(|os|-2))+mul(8,1)) + BigEndianIntegerValue(os[1..|os|-1])*256 + os[|os|-1];\r\n { lemma_mul_is_distributive_forall(); }\r\n os[0]*power2(mul(8,(|os|-2)+1)) + BigEndianIntegerValue(os[1..|os|-1])*256 + os[|os|-1];\r\n //- boogie additive arithmetic\r\n os[0]*power2(mul(8,|os|-1)) + BigEndianIntegerValue(os[1..|os|-1])*256 + os[|os|-1];\r\n { lemma_mul_is_mul_boogie(8, |os|-1); }\r\n os[0]*power2(8*(|os|-1)) + BigEndianIntegerValue(os[1..|os|-1])*256 + os[|os|-1];\r\n {\r\n assert os[1..|os|-1] == os[1..][0..|os[1..]|-1];\r\n assert os[|os|-1] == os[1..][|os[1..]|-1];\r\n }\r\n os[0]*power2(8*(|os|-1)) + BigEndianIntegerValue(os[1..][0..|os[1..]|-1])*256 + os[1..][|os[1..]|-1];\r\n //- BigEndianIntegerValue ensures\r\n os[0]*power2(8*(|os|-1)) + BigEndianIntegerValue(os[1..]);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_BigEndianIntegerValue_zero_prefix(s:seq, s_suffix:seq)\r\n requires IsByteSeq(s);\r\n requires IsByteSeq(s_suffix);\r\n requires ZeroPrefix(s, s_suffix);\r\n ensures BigEndianIntegerValue(s) == BigEndianIntegerValue(s_suffix);\r\n{\r\n if (|s| == |s_suffix|)\r\n {\r\n assert s == s_suffix;\r\n }\r\n else\r\n {\r\n calc {\r\n BigEndianIntegerValue(s);\r\n { lemma_BigEndianIntegerValue_strip_hi(s); }\r\n s[0]*power2(8*(|s|-1)) + BigEndianIntegerValue(s[1..]);\r\n mul(0,power2(8*(|s|-1))) + BigEndianIntegerValue(s[1..]);\r\n { lemma_mul_basics_forall(); }\r\n BigEndianIntegerValue(s[1..]);\r\n { lemma_BigEndianIntegerValue_zero_prefix(s[1..], s_suffix); }\r\n BigEndianIntegerValue(s_suffix);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_BigEndianIntegerValue_bound(s:seq)\r\n decreases |s|;\r\n requires IsByteSeq(s);\r\n ensures |s|>0 ==> power2(8*(|s|-1))*s[0] <= BigEndianIntegerValue(s);\r\n ensures |s|>0 ==> BigEndianIntegerValue(s) < power2(8*(|s|-1))*(s[0]+1);\r\n ensures BigEndianIntegerValue(s) < power2(8*|s|);\r\n{\r\n if (s==[])\r\n {\r\n calc {\r\n BigEndianIntegerValue(s);\r\n 0;\r\n < 1;\r\n { lemma_power2_0_is_1(); }\r\n power2(0);\r\n power2(8*|s|);\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n BigEndianIntegerValue(s);\r\n BigEndianIntegerValue(s[0..|s|-1])*256 + s[|s|-1];\r\n <= { lemma_BigEndianIntegerValue_bound(s[0..|s|-1]); }\r\n (power2(8*|s[0..|s|-1]|)-1)*256 + s[|s|-1];\r\n { assert |s[0..|s|-1]| == |s|-1; }\r\n (power2(8*(|s|-1))-1)*256 + s[|s|-1];\r\n {\r\n lemma_mul_is_mul_boogie(power2(8*(|s|-1))-1,256);\r\n }\r\n mul(power2(8*(|s|-1))-1,256) + s[|s|-1];\r\n {\r\n lemma_2toX();\r\n assert power2(8)==256;\r\n }\r\n mul(power2(8*(|s|-1))-1,power2(8)) + s[|s|-1];\r\n { lemma_mul_is_distributive_forall(); }\r\n mul(power2(8*(|s|-1)),power2(8))-mul(1,power2(8)) + s[|s|-1];\r\n { lemma_power2_adds(8*(|s|-1), 8); }\r\n power2(8*(|s|-1)+8) - mul(1,power2(8)) + s[|s|-1];\r\n { lemma_mul_basics_forall(); }\r\n power2(8*(|s|-1)+8) - power2(8) + s[|s|-1];\r\n {\r\n lemma_2toX();\r\n assert power2(8)==256;\r\n }\r\n power2(8*(|s|-1)+8) - 256 + s[|s|-1];\r\n < { lemma_2toX(); assert s[|s|-1] < 256; }\r\n power2(8*(|s|-1)+8);\r\n power2(8*|s|);\r\n }\r\n\r\n calc {\r\n BigEndianIntegerValue(s);\r\n { lemma_BigEndianIntegerValue_strip_hi(s); }\r\n s[0]*power2(8*(|s|-1)) + BigEndianIntegerValue(s[1..]);\r\n < { lemma_BigEndianIntegerValue_bound(s[1..]); }\r\n s[0]*power2(8*(|s|-1)) + power2(8*|s[1..]|);\r\n s[0]*power2(8*(|s|-1)) + power2(8*(|s|-1));\r\n { lemma_mul_basics_forall(); }\r\n s[0]*power2(8*(|s|-1)) + mul(1,power2(8*(|s|-1)));\r\n { lemma_mul_is_distributive_forall(); }\r\n (s[0]+1)*power2(8*(|s|-1));\r\n { lemma_mul_is_commutative_forall(); }\r\n power2(8*(|s|-1))*(s[0]+1);\r\n }\r\n\r\n if (|s|==1)\r\n {\r\n calc {\r\n power2(8*(|s|-1))*s[0];\r\n power2(8*0)*s[0];\r\n power2(0)*s[0];\r\n { lemma_power2_0_is_1(); }\r\n mul(1,s[0]);\r\n { lemma_mul_is_mul_boogie(1,s[0]); }\r\n 1*s[0];\r\n s[0];\r\n s[|s|-1];\r\n 0*256 + s[|s|-1];\r\n BigEndianIntegerValue([])*256 + s[|s|-1];\r\n BigEndianIntegerValue(s[0..|s|-1])*256 + s[|s|-1];\r\n BigEndianIntegerValue(s);\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n power2(8*(|s|-1))*s[0];\r\n power2(8*(|s|-2+1))*s[0];\r\n power2(8*(|s|-2)+8)*s[0];\r\n { lemma_power2_adds(8*(|s|-2), 8); }\r\n (power2(8*(|s|-2))*power2(8))*s[0];\r\n { lemma_mul_is_associative_forall(); }\r\n power2(8*(|s|-2))*(power2(8)*s[0]);\r\n { lemma_mul_is_commutative_forall(); }\r\n power2(8*(|s|-2))*(s[0]*power2(8));\r\n { lemma_mul_is_associative_forall(); }\r\n (power2(8*(|s|-2))*s[0])*power2(8);\r\n {\r\n lemma_2toX();\r\n assert power2(8)==256;\r\n }\r\n mul(power2(8*(|s|-2))*s[0],256);\r\n { lemma_mul_is_mul_boogie(power2(8*(|s|-2))*s[0],256); }\r\n (power2(8*(|s|-2))*s[0])*256;\r\n <= (power2(8*(|s|-2))*s[0])*256 + s[|s|-1];\r\n <= {\r\n lemma_BigEndianIntegerValue_bound(s[0..|s|-1]);\r\n assert |s[0..|s|-1]|>0 ==> power2(8*(|s[0..|s|-1]|-1))*s[0..|s|-1][0] <= BigEndianIntegerValue(s[0..|s|-1]);\r\n assert power2(8*(|s[0..|s|-1]|-1))*s[0..|s|-1][0] <= BigEndianIntegerValue(s[0..|s|-1]);\r\n assert |s[0..|s|-1]|-1 == |s|-2;\r\n assert s[0..|s|-1][0] == s[0];\r\n assert power2(8*(|s|-2))*s[0] <= BigEndianIntegerValue(s[0..|s|-1]);\r\n lemma_mul_inequality(power2(8*(|s|-2))*s[0], BigEndianIntegerValue(s[0..|s|-1]), 256);\r\n }\r\n BigEndianIntegerValue(s[0..|s|-1])*256 + s[|s|-1];\r\n BigEndianIntegerValue(s);\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_BigEndianIntegerValue_increases(prefix:seq, common:seq)\r\n requires IsByteSeq(prefix);\r\n requires IsByteSeq(common);\r\n ensures BigEndianIntegerValue(common) <= BigEndianIntegerValue(prefix+common);\r\n{\r\n if (|prefix|==0)\r\n {\r\n assert common == prefix+common;\r\n }\r\n else\r\n {\r\n calc {\r\n BigEndianIntegerValue(common);\r\n <= { lemma_BigEndianIntegerValue_increases(prefix[1..],common); }\r\n BigEndianIntegerValue(prefix[1..]+common);\r\n { assert prefix[1..]+common == (prefix+common)[1..]; }\r\n BigEndianIntegerValue((prefix+common)[1..]);\r\n <= { lemma_mul_nonnegative((prefix+common)[0], power2(8*(|(prefix+common)|-1))); }\r\n (prefix+common)[0]*power2(8*(|(prefix+common)|-1)) + BigEndianIntegerValue((prefix+common)[1..]);\r\n { lemma_BigEndianIntegerValue_strip_hi(prefix+common); }\r\n BigEndianIntegerValue(prefix+common);\r\n }\r\n }\r\n}\r\n\r\n\r\n\r\nstatic lemma lemma_BigEndianIntegerValue_equal_prefix_increases(s0:seq, s1:seq, i:int)\r\n requires IsByteSeq(s0);\r\n requires IsByteSeq(s1);\r\n requires 0<=i<|s0|==|s1|;\r\n requires forall j :: 0<=j s0[j] == s1[j];\r\n requires s0[i] < s1[i];\r\n ensures BigEndianIntegerValue(s0) < BigEndianIntegerValue(s1);\r\n{\r\n if (i==0)\r\n {\r\n calc\r\n {\r\n BigEndianIntegerValue(s0);\r\n < { lemma_BigEndianIntegerValue_bound(s0); }\r\n power2(8*(|s0|-1))*(s0[0]+1);\r\n power2(8*(|s1|-1))*(s0[0]+1);\r\n <= { lemma_mul_left_inequality(power2(8*(|s1|-1)),s0[0]+1,s1[0]); }\r\n power2(8*(|s1|-1))*s1[0];\r\n <= { lemma_BigEndianIntegerValue_bound(s1); }\r\n BigEndianIntegerValue(s1);\r\n }\r\n }\r\n else\r\n {\r\n calc\r\n {\r\n BigEndianIntegerValue(s0);\r\n { lemma_BigEndianIntegerValue_strip_hi(s0); }\r\n s0[0]*power2(8*(|s0|-1)) + BigEndianIntegerValue(s0[1..]);\r\n < { lemma_BigEndianIntegerValue_equal_prefix_increases(s0[1..], s1[1..], i-1); }\r\n s0[0]*power2(8*(|s1|-1)) + BigEndianIntegerValue(s1[1..]);\r\n s1[0]*power2(8*(|s1|-1)) + BigEndianIntegerValue(s1[1..]);\r\n { lemma_BigEndianIntegerValue_strip_hi(s1); }\r\n BigEndianIntegerValue(s1);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_BigEndianIntegerValue_equal_prefix_unequal(s0:seq, s1:seq, i:int)\r\n requires IsByteSeq(s0);\r\n requires IsByteSeq(s1);\r\n requires 0<=i<|s0|==|s1|;\r\n requires forall j :: 0<=j s0[j] == s1[j];\r\n requires s0[i] != s1[i];\r\n ensures BigEndianIntegerValue(s0) != BigEndianIntegerValue(s1);\r\n{\r\n if (s0[i], s1:seq) returns(w0':int)\r\n requires 0 <= w0 <= w1 < |s1| == |s0tail|;\r\n requires forall j :: 0 <= j < w0 ==> s0tail[j]==s1[j];\r\n requires s0tail[w1] != s1[w1];\r\n decreases w1 - w0;\r\n ensures 0 <= w0' <= w1 < |s1| == |s0tail|;\r\n ensures forall j :: 0 <= j < w0' ==> s0tail[j]==s1[j];\r\n ensures s0tail[w0'] != s1[w0'];\r\n{\r\n w0' := w0;\r\n if (w0 <= w1 && s0tail[w0]==s1[w0])\r\n {\r\n w0' := lemma_lemma_BigEndianIntegerValue_zero_prefix_converse_inner_helper(w0 + 1, w1, s0tail, s1);\r\n }\r\n}\r\n\r\nstatic lemma lemma_BigEndianIntegerValue_zero_prefix_converse_inner(s0:seq, s1:seq)\r\n requires IsByteSeq(s0);\r\n requires IsByteSeq(s1);\r\n requires |s0| >= |s1|;\r\n requires BigEndianIntegerValue(s0) == BigEndianIntegerValue(s1);\r\n ensures ZeroPrefix(s0, s1);\r\n{\r\n if !(forall i :: 0 <= i < |s0|-|s1| ==> s0[i] == 0)\r\n {\r\n //- a prefix byte isn't zero.\r\n var witness :| 0 <= witness < |s0|-|s1| && s0[witness] != 0;\r\n assert |s1| <= |s0|-witness-1;\r\n calc {\r\n BigEndianIntegerValue(s1);\r\n < { lemma_BigEndianIntegerValue_bound(s1); }\r\n power2(8*|s1|);\r\n <= { lemma_power2_increases(8*|s1|, 8*(|s0|-witness-1)); }\r\n power2(8*(|s0|-witness-1));\r\n <= { lemma_mul_increases_forall(); }\r\n s0[witness]*power2(8*(|s0|-witness-1));\r\n { lemma_mul_is_commutative_forall(); }\r\n power2(8*(|s0|-witness-1))*s0[witness];\r\n power2(8*(|s0[witness..]|-1))*s0[witness..][0];\r\n <= { lemma_BigEndianIntegerValue_bound(s0[witness..]); }\r\n BigEndianIntegerValue(s0[witness..]);\r\n <= { lemma_BigEndianIntegerValue_increases(s0[..witness], s0[witness..]); }\r\n BigEndianIntegerValue(s0[..witness]+s0[witness..]);\r\n { assert s0[..witness]+s0[witness..] == s0; }\r\n BigEndianIntegerValue(s0);\r\n }\r\n assert false;\r\n }\r\n else if (s0[ |s0|-|s1| .. ] != s1)\r\n {\r\n //- don't agree on suffix\r\n var s0tail := s0[ |s0|-|s1| .. ];\r\n\r\n var w1 :| 0 <= w1 < |s1| && (s0tail[w1] != s1[w1]);\r\n assert w1 < |s1|;\r\n\r\n //- convince Dafny there's a LEAST such element.\r\n var w0 := lemma_lemma_BigEndianIntegerValue_zero_prefix_converse_inner_helper(0, w1, s0tail, s1);\r\n/* dafnycc TODO: ghost while loops\r\n var w0 := 0;\r\n while (w0 <= w1\r\n && s0tail[w0]==s1[w0])\r\n invariant w0 <= w1 < |s1| == |s0tail|;\r\n invariant forall j :: 0 <= j < w0 ==> s0tail[j]==s1[j];\r\n {\r\n w0 := w0 + 1;\r\n }\r\n*/\r\n\r\n if (w0 > w1)\r\n {\r\n assert s0tail[w1]!=s1[w1];\r\n assert forall j :: 0 <= j < w1 ==> s0tail[j]==s1[j];\r\n }\r\n else\r\n {\r\n w1 := w0;\r\n assert s0tail[w1]!=s1[w1];\r\n assert forall j :: 0 <= j < w1 ==> s0tail[j]==s1[j];\r\n }\r\n\r\n lemma_BigEndianIntegerValue_zero_prefix(s0, s0tail);\r\n assert BigEndianIntegerValue(s0) == BigEndianIntegerValue(s0tail);\r\n lemma_BigEndianIntegerValue_equal_prefix_unequal(s0tail, s1, w1);\r\n assert BigEndianIntegerValue(s0tail) != BigEndianIntegerValue(s1);\r\n assert false;\r\n }\r\n else\r\n {\r\n assert ZeroPrefix(s0, s1);\r\n }\r\n}\r\n\r\nstatic lemma lemma_BigEndianIntegerValue_zero_prefix_converse(s0:seq, s1:seq)\r\n requires IsByteSeq(s0);\r\n requires IsByteSeq(s1);\r\n requires BigEndianIntegerValue(s0) == BigEndianIntegerValue(s1);\r\n ensures ZeroPrefix(s0, s1) || ZeroPrefix(s1, s0);\r\n{\r\n if (|s0| >= |s1|)\r\n {\r\n lemma_BigEndianIntegerValue_zero_prefix_converse_inner(s0, s1);\r\n }\r\n else\r\n {\r\n lemma_BigEndianIntegerValue_zero_prefix_converse_inner(s1, s0);\r\n }\r\n}\r\n\r\nstatic lemma lemma_SingleZeroPrefixedBigEndianIntegerValuesEqual(s0:seq, s1:seq)\r\n requires IsByteSeq(s0);\r\n requires IsByteSeq(s1);\r\n requires BigEndianIntegerValue(s0) == BigEndianIntegerValue(s1);\r\n requires |s0|>0;\r\n requires |s1|>0;\r\n//- requires |s0|>0 ==> s0[0] == 0;\r\n//- requires |s1|>0 ==> s1[0] == 0;\r\n requires s0[0] == 0;\r\n requires s1[0] == 0;\r\n requires |s0|>1 ==> s0[1] != 0;\r\n requires |s1|>1 ==> s1[1] != 0;\r\n ensures s0 == s1;\r\n{\r\n lemma_BigEndianIntegerValue_zero_prefix_converse(s0, s1);\r\n}\r\n\r\nstatic function LittleEndianIntegerValue(os:seq) : nat\r\n requires IsByteSeq(os);\r\n{\r\n if (os==[]) then\r\n 0\r\n else\r\n LittleEndianIntegerValue(os[1..])*256 + os[0]\r\n}\r\n\r\nstatic method ReverseOctetString(os:seq) returns (rs:seq)\r\n ensures rs == Reverse(os);\r\n ensures IsByteSeq(os) ==> IsByteSeq(rs);\r\n ensures |os| == |rs|;\r\n ensures forall i :: 0<=i<|os| ==> os[i] == rs[|rs|-1-i];\r\n{\r\n reveal_Reverse();\r\n rs := [];\r\n var ptr:int := 0;\r\n\r\n while (ptr < |os|)\r\n invariant 0 <= ptr <= |os|;\r\n invariant rs == Reverse(os[0..ptr]);\r\n {\r\n ghost var old_rs := rs;\r\n\r\n rs := [os[ptr]] + rs;\r\n\r\n ghost var os1 := os[0..ptr+1];\r\n calc {\r\n rs;\r\n [os[ptr]] + old_rs;\r\n [os[ptr]] + Reverse(os[0..ptr]);\r\n [os1[|os1|-1]] + Reverse(os[0..ptr]);\r\n {\r\n calc {\r\n os[0..ptr];\r\n {\r\n assert forall i :: 0<=i\r\n os[0..ptr][i] == os1[0..ptr][i];\r\n }\r\n os1[0..ptr];\r\n os1[0..|os1|-1];\r\n }\r\n }\r\n [os1[|os1|-1]] + Reverse(os1[0..|os1|-1]);\r\n Reverse(os1);\r\n }\r\n\r\n ptr := ptr + 1;\r\n }\r\n\r\n assert os[0..ptr] == os;\r\n lemma_Reverse(os, rs);\r\n if (IsByteSeq(os))\r\n {\r\n forall (i | 0<=i<|rs|)\r\n ensures 0<=rs[i])\r\n decreases |bes|;\r\n requires IsByteSeq(bes);\r\n ensures IsByteSeq(Reverse(bes));\r\n ensures LittleEndianIntegerValue(Reverse(bes)) == BigEndianIntegerValue(bes);\r\n{\r\n reveal_Reverse();\r\n lemma_Reverse(bes, Reverse(bes));\r\n\r\n if (bes==[])\r\n {\r\n }\r\n else\r\n {\r\n lemma_endian_reversal(bes[0..|bes|-1]);\r\n/*\r\n var les := Reverse(bes);\r\n assert les == [bes[|bes|-1]] + Reverse(bes[0..|bes|-1]);\r\n\r\n calc {\r\n LittleEndianIntegerValue(Reverse(bes));\r\n LittleEndianIntegerValue(les);\r\n LittleEndianIntegerValue(les[1..])*256 + les[0];\r\n LittleEndianIntegerValue( Reverse(bes[0..|bes|-1]) )*256 + bes[|bes|-1];\r\n { lemma_endian_reversal(bes[0..|bes|-1]); }\r\n BigEndianIntegerValue(bes[0..|bes|-1])*256 + bes[|bes|-1];\r\n BigEndianIntegerValue(bes);\r\n }\r\n*/\r\n }\r\n}\r\n\r\nstatic lemma lemma_BigEndianIntegerValue_equals_BEByteSeqToInt(bs:seq)\r\n decreases |bs|;\r\n requires IsByteSeq(bs);\r\n ensures BigEndianIntegerValue(bs) == BEByteSeqToInt(bs);\r\n{\r\n lemma_2toX();\r\n if (bs==[])\r\n {\r\n calc {\r\n BigEndianIntegerValue(bs);\r\n 0;\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEDigitSeqToInt_private(power2(8), bs);\r\n BEDigitSeqToInt(power2(8), bs);\r\n BEByteSeqToInt(bs);\r\n }\r\n }\r\n else\r\n {\r\n lemma_BigEndianIntegerValue_equals_BEByteSeqToInt(bs[0..|bs|-1]);\r\n calc {\r\n BigEndianIntegerValue(bs);\r\n BigEndianIntegerValue(bs[0..|bs|-1])*256 + bs[|bs|-1];\r\n { lemma_BigEndianIntegerValue_equals_BEByteSeqToInt(bs[0..|bs|-1]); }\r\n BEByteSeqToInt(bs[0..|bs|-1])*256 + bs[|bs|-1];\r\n BEDigitSeqToInt_private(256, bs[0..|bs|-1])*256 + bs[|bs|-1];\r\n { lemma_mul_is_mul_boogie(BEDigitSeqToInt_private(256, bs[0..|bs|-1]), 256); }\r\n mul(BEDigitSeqToInt_private(256, bs[0..|bs|-1]),256) + bs[|bs|-1];\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEDigitSeqToInt_private(256, bs);\r\n BEDigitSeqToInt(256, bs);\r\n { lemma_2toX(); }\r\n BEDigitSeqToInt(power2(8), bs);\r\n BEByteSeqToInt(bs);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/Extended_GCD.i.dfy", "content": "//-include \"../../BigNum/BigNatDiv.i.dfy\"\r\n//-include \"../../BigNum/BigNum.i.dfy\"\r\ninclude \"../../FatNat/FatInt.i.dfy\"\r\ninclude \"division.i.dfy\"\r\n\r\nstatic predicate opposing_signs(x:int, y:int)\r\n{\r\n x==0\r\n || y==0\r\n || (x<0 <==> y>=0)\r\n}\r\n\r\ndatatype Egcd_data = Egcd_data_c(\r\n R:array,\r\n X:FatInt,\r\n Y:FatInt,\r\n next_R:array,\r\n next_R_zero:bool,\r\n next_X:FatInt,\r\n next_Y:FatInt\r\n );\r\n\r\ndatatype Egcd_ghost = Egcd_ghost_c(\r\n a:nat,\r\n b:nat\r\n );\r\n\r\npredicate {:heap} Egcd_invariant(d:Egcd_data, g:Egcd_ghost)\r\n reads d.R;\r\n reads d.X.value;\r\n reads d.Y.value;\r\n reads d.next_R;\r\n reads d.next_X.value;\r\n reads d.next_Y.value;\r\n{\r\n true\r\n && (WellformedFatNat(d.R))\r\n && (WellformedFatInt(d.X))\r\n && (WellformedFatInt(d.Y))\r\n && (WellformedFatNat(d.next_R))\r\n && (WellformedFatInt(d.next_X))\r\n && (WellformedFatInt(d.next_Y))\r\n && (J(d.R) != 0)\r\n && (g.b == 0\r\n ==> J(d.next_R)==0 && FIV(d.X) == 1 && FIV(d.Y) == 0)\r\n && (g.a * FIV( d.X) + g.b * FIV( d.Y) == J( d.R))\r\n && (g.a * FIV(d.next_X) + g.b * FIV(d.next_Y) == J(d.next_R))\r\n //- && (gcd(J(A), g.b) == gcd(J(R), J(d.next_R)))\r\n && (forall c:nat :: is_gcd(J(d.R), J(d.next_R), c) ==> is_gcd(g.a, g.b, c))\r\n && ((J(d.next_R)==0) <==> (BEWordSeqToInt(d.next_R[..])==0))\r\n && (d.next_R_zero <==> J(d.next_R)==0)\r\n}\r\n\r\npredicate {:heap} Extended_gcd_requires(A:array, B:array)\r\n reads A;\r\n reads B;\r\n{\r\n (A!=null)\r\n && (IsWordSeq(A[..]))\r\n && (B!=null)\r\n && (IsWordSeq(B[..]))\r\n && (1<=BEWordSeqToInt(A[..]))\r\n && (BEWordSeqToInt(B[..]) < BEWordSeqToInt(A[..]))\r\n}\r\n\r\npredicate {:heap} Extended_gcd_ensures(A:array, B:array, X:FatInt, Y:FatInt)\r\n reads A;\r\n reads B;\r\n reads X.value;\r\n reads Y.value;\r\n requires Extended_gcd_requires(A, B);\r\n{\r\n (WellformedFatInt(X))\r\n//- && (X.value.Length < power2(27))\r\n && (WellformedFatInt(Y))\r\n//- && (Y.value.Length < power2(27))\r\n && (0 <= BEWordSeqToInt(A[..])*FIV(X) + BEWordSeqToInt(B[..])*FIV(Y))\r\n && (0 <= BEWordSeqToInt(B[..])) //- satisfy precondition. Need a premium.\r\n && (is_gcd(BEWordSeqToInt(A[..]), BEWordSeqToInt(B[..]), BEWordSeqToInt(A[..])*FIV(X) + BEWordSeqToInt(B[..])*FIV(Y)))\r\n\r\n //- These size constraints are used to show downstream modesty,\r\n //- but also to show that the solution for 'd' is within a phi of [0,phi).\r\n && ((FIV(X)==1 && FIV(Y)==0) || -BEWordSeqToInt(B[..]) <= FIV(X) <= BEWordSeqToInt(B[..]))\r\n && (-BEWordSeqToInt(A[..]) <= FIV(Y) <= BEWordSeqToInt(A[..]))\r\n && (opposing_signs(FIV(X), FIV(Y)))\r\n && (FIV(X)!=0 || FIV(Y)!=0)\r\n}\r\n\r\nmethod Extended_gcd_init(A:array, B:array) returns (d:Egcd_data, ghost g:Egcd_ghost)\r\n requires Extended_gcd_requires(A, B);\r\n ensures g.a == BEWordSeqToInt(A[..]);\r\n ensures g.b == BEWordSeqToInt(B[..]);\r\n ensures Egcd_invariant(d, g);\r\n{\r\n ghost var a := J(A);\r\n ghost var b := J(B);\r\n\r\n lemma_2toX();\r\n var X := MakeSmallLiteralFatInt(1);\r\n var x_ref := X.value; //- do something real to X.value to convince dafnycc it's allocated\r\n var Y := MakeSmallLiteralFatInt(0);\r\n var y_ref := Y.value; //- do something real to Y.value to convince dafnycc it's allocated\r\n var R := A;\r\n var next_R := B;\r\n var next_X := Y;\r\n var next_Y := X;\r\n\r\n calc {\r\n a * FIV(X) + b * FIV(Y);\r\n a * 1 + b * 0;\r\n a;\r\n J(R);\r\n }\r\n\r\n calc {\r\n a * FIV(next_X) + b * FIV(next_Y);\r\n a * 0 + b * 1;\r\n J(next_R);\r\n }\r\n\r\n var next_R_zero := FatNatIsZero(next_R);\r\n d := Egcd_data_c(R, X, Y, next_R, next_R_zero, next_X, next_Y);\r\n g := Egcd_ghost_c(a, b);\r\n}\r\n\r\nmethod {:timeLimitMultiplier 3} Extended_gcd_step(d:Egcd_data, ghost g:Egcd_ghost) returns (d':Egcd_data, ghost g':Egcd_ghost)\r\n requires Egcd_invariant(d, g);\r\n requires !d.next_R_zero;\r\n ensures Egcd_invariant(d', g');\r\n ensures g'==g; \r\n \r\n ensures 0 <= J(d'.next_R) < J(d.next_R);\r\n{\r\n var dr_ref := d.R; //- do something real to d.R to convince dafnycc it's allocated\r\n var dnr_ref := d.next_R; //- do something real to d.next_R to convince dafnycc it's allocated\r\n var dx_ref := d.X.value; //- do something real to d.X.value to convince dafnycc it's allocated\r\n var dy_ref := d.Y.value; //- do something real to d.Y.value to convince dafnycc it's allocated\r\n var dnx_ref := d.next_X.value; //- do something real to d.next_X.value to convince dafnycc it's allocated\r\n var dny_ref := d.next_Y.value; //- do something real to d.next_Y.value to convince dafnycc it's allocated\r\n\r\n var Q, M := FatNatDiv(d.R, d.next_R);\r\n calc {\r\n J(d.next_R)*J(Q);\r\n { lemma_mul_is_commutative_forall(); }\r\n J(Q)*J(d.next_R);\r\n }\r\n lemma_fundamental_div_mod_converse(J(d.R), J(d.next_R), J(Q), J(M));\r\n assert J(M) < J(d.next_R);\r\n//- lemma_modesty_word_value_equivalence(M);\r\n//- lemma_modesty_word_value_equivalence(d.next_R);\r\n\r\n var X' := FatIntMul(FatInt_ctor(false, Q), d.next_X);\r\n var x_ref := X'.value; //- do something real to X'.value to convince dafnycc it's allocated\r\n X' := FatIntSub(d.X, X');\r\n x_ref := X'.value; //- do something real to X'.value to convince dafnycc it's allocated\r\n assert WellformedFatInt(d.Y);\r\n assert WellformedFatInt(d.next_Y);\r\n var Y' := FatIntMul(FatInt_ctor(false, Q), d.next_Y);\r\n var y_ref := Y'.value; //- do something real to Y'.value to convince dafnycc it's allocated\r\n assert WellformedFatInt(d.Y);\r\n Y' := FatIntSub(d.Y, Y');\r\n y_ref := Y'.value; //- do something real to Y'.value to convince dafnycc it's allocated\r\n\r\n ghost var r := J(d.R);\r\n ghost var nr := J(d.next_R);\r\n ghost var x := FIV(d.X);\r\n ghost var y := FIV(d.Y);\r\n ghost var nx := FIV(d.next_X);\r\n ghost var ny := FIV(d.next_Y);\r\n ghost var x' := FIV(X');\r\n ghost var y' := FIV(Y');\r\n ghost var a := g.a;\r\n ghost var b := g.b;\r\n assert a * x + b * y == r; //- loop invariant\r\n assert a * nx + b * ny == nr; //- loop invariant\r\n calc {\r\n//- J(A)*FIV(X') + J(B)*FIV(Y');\r\n a * x' + b * y';\r\n a * (x - (r / nr) * nx) + b * (y - (r / nr) * ny);\r\n { lemma_mul_is_distributive(a, x, (r / nr) * nx); }\r\n { lemma_mul_is_distributive(b, y, (r / nr) * ny); }\r\n a * x + b * y - (a * ((r / nr) * nx) + b * ((r / nr) * ny));\r\n { lemma_mul_is_commutative_forall(); }\r\n { lemma_mul_is_associative_forall(); }\r\n a * x + b * y - (a * nx * (r / nr) + b * ny * (r / nr));\r\n { lemma_mul_is_distributive(r / nr, a * nx, b * ny); }\r\n a * x + b * y - (a * nx + b * ny) * (r / nr);\r\n r - nr * (r / nr);\r\n { lemma_fundamental_div_mod(r, nr); }\r\n r % nr;\r\n J(M);\r\n }\r\n\r\n forall g:nat\r\n ensures is_gcd(nr, r % nr, g) ==> is_gcd(a, b, g);\r\n {\r\n if (is_gcd(nr, r % nr, g))\r\n {\r\n calc ==> {\r\n divides(g, r % nr) && divides(g, nr);\r\n { lemma_divides_multiple(g, nr, r / nr); }\r\n divides(g, r % nr) && divides(g, nr * (r / nr));\r\n { lemma_divides_sum(g, r % nr, nr * (r / nr)); }\r\n divides(g, r % nr + nr * (r / nr));\r\n divides(g, nr * (r / nr) + r % nr);\r\n { lemma_fundamental_div_mod(r, nr); }\r\n divides(g, r);\r\n }\r\n forall x:int\r\n ensures g < x ==> !(divides(x, r) && divides(x, nr));\r\n {\r\n if (g < x && divides(x, r) && divides(x, nr))\r\n {\r\n calc {\r\n (r % nr) % x;\r\n { lemma_fundamental_div_mod(nr, x); }\r\n (r % (x * (nr / x) + nr % x)) % x;\r\n (r % (x * (nr / x))) % x;\r\n {\r\n calc ==> {\r\n true;\r\n { lemma_nothing_bigger_divides(nr); }\r\n x <= nr;\r\n { lemma_div_is_ordered(x, nr, x); }\r\n x / x <= nr / x;\r\n { lemma_div_basics(x); }\r\n 1 <= nr / x;\r\n }\r\n }\r\n { lemma_mod_mod(r, x, nr / x); }\r\n r % x;\r\n }\r\n\r\n assert divides(x, r % nr);\r\n assert false; //- due to is_gcd(nr, r % nr, g)\r\n }\r\n }\r\n assert is_gcd(r, nr, g);\r\n assert is_gcd(a, b, g); //- by loop invariant\r\n }\r\n }\r\n\r\n var next_R_zero := FatNatIsZero(M);\r\n d' := Egcd_data_c(d.next_R, d.next_X, d.next_Y, M, next_R_zero, X', Y');\r\n g' := Egcd_ghost_c(a, b);\r\n}\r\n\r\nmethod Extended_gcd_conclusion(A:array, B:array, d:Egcd_data, ghost g:Egcd_ghost) returns (X:FatInt, Y:FatInt)\r\n requires Extended_gcd_requires(A, B);\r\n requires Egcd_invariant(d, g);\r\n requires J(d.next_R)==0; //- loop termination condition\r\n requires BEWordSeqToInt(A[..]) == g.a;\r\n requires BEWordSeqToInt(B[..]) == g.b;\r\n ensures Extended_gcd_ensures(A, B, X, Y);\r\n{\r\n var dr_ref := d.R; //- do something real to d.R to convince dafnycc it's allocated\r\n var dnr_ref := d.next_R; //- do something real to d.next_R to convince dafnycc it's allocated\r\n var dx_ref := d.X.value; //- do something real to d.X.value to convince dafnycc it's allocated\r\n var dy_ref := d.Y.value; //- do something real to d.Y.value to convince dafnycc it's allocated\r\n var dnx_ref := d.next_X.value; //- do something real to d.next_X.value to convince dafnycc it's allocated\r\n var dny_ref := d.next_Y.value; //- do something real to d.next_Y.value to convince dafnycc it's allocated\r\n\r\n X := d.X;\r\n Y := d.Y;\r\n ghost var r := J(d.R);\r\n ghost var x := FIV(X);\r\n ghost var y := FIV(Y);\r\n ghost var a := g.a;\r\n ghost var b := g.b;\r\n\r\n calc {\r\n is_gcd(r, 0, r);\r\n { lemma_anything_divides_itself(r); }\r\n { lemma_anything_divides_zero(r); }\r\n { lemma_nothing_bigger_divides(r); }\r\n true;\r\n }\r\n\r\n assert is_gcd(r, 0, r);\r\n //- loop invariant: is_gcd(r, J(next_R), r) ==> is_gcd(a, b, r)\r\n //- loop termination: J(next_R) == 0\r\n assert is_gcd(a, b, r);\r\n //- loop invariant: r == a * x + b * y\r\n\r\n assert is_gcd(a, b, a * x + b * y);\r\n\r\n \r\n //- put x, y into canonical form where 0 <= y < a\r\n //- y := y % a;\r\n //- x := x + b * (y / a);\r\n calc {\r\n a * (x + b * (y / a)) + b * (y % a);\r\n { lemma_mul_is_distributive(a, x, b * (y / a)); }\r\n a * x + a * (b * (y / a)) + b * (y % a);\r\n calc {\r\n a * (b * (y / a));\r\n { lemma_mul_is_associative(a, b, y/a); }\r\n (a * b) * (y / a);\r\n { lemma_mul_is_commutative_forall(); }\r\n (b * a) * (y / a);\r\n { lemma_mul_is_associative(b, a, y/a); }\r\n b * (a * (y / a));\r\n }\r\n a * x + b * (a * (y / a)) + b * (y % a);\r\n { lemma_mul_is_distributive(b, a * (y / a), y % a); }\r\n a * x + b * (a * (y / a) + (y % a));\r\n { lemma_fundamental_div_mod(y, a); }\r\n a * x + b * y;\r\n }\r\n\r\n //- ensures -I(A) <= BV(Y) <= I(A);\r\n//- lemma_mod_remainder_specific(y, a);\r\n\r\n //- ensures (FIV(X)==1 && FIV(Y)==0) || -J(B) <= FIV(X) <= J(B);\r\n if (b == 0)\r\n {\r\n calc {\r\n x;\r\n x + 0 * (y / a);\r\n x + b * (y / a);\r\n 1;\r\n }\r\n \r\n calc {\r\n y;\r\n y % a;\r\n 0;\r\n }\r\n//-\r\n//- \r\n//- calc {\r\n//- x == 1;\r\n//- //-{ lemma_mul_is_mul_boogie(b, y / a); }\r\n//- x + b * (y / a) == 1;\r\n//- }\r\n//- calc {\r\n//- y == 0;\r\n//- //-{ lemma_mod_is_mod_boogie(0, a); }\r\n//- y % a == 0;\r\n//- }\r\n }\r\n else\r\n {\r\n calc ==> {\r\n true;\r\n { lemma_nothing_bigger_divides(a); }\r\n { lemma_nothing_bigger_divides(b); }\r\n r <= a && r <= b;\r\n }\r\n calc ==> {\r\n 0 <= y % a <= a - 1;\r\n { lemma_mul_inequality(y % a, a - 1, b); }\r\n { lemma_mul_inequality(0, y % a, b); }\r\n//- { lemma_mul_basics(b); }\r\n 0 <= (y % a) * b <= (a - 1) * b;\r\n { lemma_mul_is_distributive(b, a, 1); }\r\n//- { lemma_mul_basics(b); }\r\n 0 <= (y % a) * b <= a * b - b;\r\n//- { lemma_mul_is_commutative_forall(); }\r\n 0 <= b * (y % a) <= a * b - b;\r\n a * (x + b * (y / a)) <= a * (x + b * (y / a)) + b * (y % a) <= a * (x + b * (y / a)) + a * b - b;\r\n a * (x + b * (y / a)) <= r <= a * (x + b * (y / a)) + a * b - b;\r\n a * (x + b * (y / a)) <= r <= a * (x + b * (y / a)) + a * b;\r\n { lemma_mul_is_distributive(a, x + b * (y / a), b); }\r\n a * (x + b * (y / a)) <= r <= a * (x + b * (y / a) + b);\r\n { lemma_div_is_ordered(a * (x + b * (y / a)), r, a); }\r\n { lemma_div_is_ordered(r, a * (x + b * (y / a) + b), a); }\r\n a * (x + b * (y / a)) / a <= r / a <= a * (x + b * (y / a) + b) / a;\r\n { lemma_div_multiples_vanish(x + b * (y / a), a); }\r\n { lemma_div_multiples_vanish(x + b * (y / a) + b, a); }\r\n x + b * (y / a) <= r / a <= x + b * (y / a) + b;\r\n { assert 0 <= r <= a; }\r\n { lemma_small_div(); }\r\n//- { lemma_div_basics(a); }\r\n x + b * (y / a) <= 1 && 0 <= x + b * (y / a) + b;\r\n -b <= x + b * (y / a) <= b;\r\n }\r\n }\r\n\r\n//- assert Y.value.Length < power2(27);\r\n var YQ, YC := FatIntDiv(Y, FatInt_ctor(false, A));\r\n var yq_ref := YQ.value; //- do something real to YQ.value to convince dafnycc it's allocated\r\n var yc_ref := YC.value; //- do something real to YC.value to convince dafnycc it's allocated\r\n\r\n lemma_fundamental_div_mod_converse(FIV(Y), J(A), FIV(YQ), FIV(YC));\r\n assert J(YC.value) < J(A);\r\n//- lemma_modesty_word_value_equivalence(YC.value);\r\n//- lemma_modesty_word_value_equivalence(A);\r\n Y := YC;\r\n\r\n var XC := FatIntMul(FatInt_ctor(false, B), YQ);\r\n var xc_ref := XC.value; //- do something real to XC.value to convince dafnycc it's allocated\r\n X := FatIntAdd(X, XC);\r\n var x_ref := X.value; //- do something real to X.value to convince dafnycc it's allocated\r\n//- lemma_modesty_word_value_equivalence(X.value);\r\n//- lemma_modesty_word_value_equivalence(B);\r\n\r\n //- renaming these symbols to catch up with new values of X, Y\r\n x := FIV(X);\r\n y := FIV(Y);\r\n\r\n //- ensures FIV(X)!=0 || FIV(Y)!=0;\r\n calc <==> {\r\n x == 0 && y == 0;\r\n { assert is_gcd(a, b, a * x + b * y); lemma_mul_basics(a); lemma_mul_basics(b); }\r\n//- { lemma_mul_is_mul_boogie(a, 0); }\r\n//- { lemma_mul_is_mul_boogie(b, 0); }\r\n is_gcd(a, b, 0);\r\n false;\r\n }\r\n\r\n //- ensures opposing_signs(FIV(X), FIV(Y));\r\n if (b != 0)\r\n {\r\n calc ==> {\r\n 1 <= x && 1 <= y;\r\n { lemma_mul_inequality(1, x, a); }\r\n { lemma_mul_inequality(1, y, b); }\r\n//- { lemma_mul_basics(a); }\r\n//- { lemma_mul_basics(b); }\r\n a <= x * a && b <= y * b;\r\n//- { lemma_mul_is_commutative_forall(); }\r\n { lemma_mul_is_commutative(a, b); lemma_mul_is_commutative(y, b); }\r\n a <= a * x && b <= b * y;\r\n a + b <= a * x + b * y;\r\n r < a * x + b * y;\r\n false;\r\n }\r\n }\r\n \r\n//- assert A.Length < power2(27);\r\n//- var Xc := CanonicalizeFatInt(X);\r\n//- ghost var pv := power2(32);\r\n//- lemma_2toX();\r\n//- assert x < a;\r\n \r\n//- calc {\r\n//- BEDigitSeqToInt(pv, Xc.value[..]);\r\n//- BEDigitSeqToInt(pv, X.value[..]);\r\n//- <\r\n//- BEDigitSeqToInt(pv, A[..]);\r\n//- }\r\n//- lemma_CanonicalLength_inherit(pv, Xc.value[..], A[..], power2(27));\r\n//- assert (Xc.value.Length < power2(27));\r\n//-\r\n//- var Yc := CanonicalizeFatInt(Y);\r\n//- lemma_CanonicalLength_inherit(pv, Yc.value[..], A[..], power2(27));\r\n//-\r\n//- X := Xc;\r\n//- Y := Yc;\r\n\r\n assert a == BEWordSeqToInt(A[..]);\r\n assert b == BEWordSeqToInt(B[..]);\r\n}\r\n\r\nmethod Extended_gcd(A:array, B:array) returns (X:FatInt, Y:FatInt)\r\n//- decreases J(A);\r\n requires Extended_gcd_requires(A, B);\r\n ensures Extended_gcd_ensures(A, B, X, Y);\r\n{\r\n var d;\r\n ghost var g;\r\n d,g := Extended_gcd_init(A, B);\r\n while (!d.next_R_zero)\r\n invariant Egcd_invariant(d, g);\r\n invariant g.a == BEWordSeqToInt(A[..]);\r\n invariant g.b == BEWordSeqToInt(B[..]);\r\n decreases J(d.next_R);\r\n {\r\n d, g := Extended_gcd_step(d, g);\r\n }\r\n X,Y := Extended_gcd_conclusion(A, B, d, g);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/KeyGen.i.dfy", "content": "include \"KeyGen.s.dfy\"\r\ninclude \"MillerRabin.i.dfy\"\r\n\r\n\r\n\r\n\r\nstatic predicate PrimeGenerationWorksheetValid_precondition(worksheet:PrimeGenerationWorksheet)\r\n{\r\n 0 < |worksheet.rows|\r\n//- && CandidateSeedWorksheetValid_precondition(worksheet.rows[|worksheet.rows|-1].candidate)\r\n}\r\n\r\nstatic predicate PrimeGenerationWorksheetValid_incremental(keybits:int, worksheet:PrimeGenerationWorksheet, last_succeeds:bool)\r\n requires 0 PrimeGenerationWorksheetRowValid(keybits, worksheet.rows[i]))\r\n //- all but last row fail, last row as specified\r\n &&\r\n (forall i :: 0<=i<|worksheet.rows|-1 ==> !worksheet.rows[i].miller_rabin_worksheet.is_probably_prime)\r\n && (\r\n 0<|worksheet.rows| ==> \r\n worksheet.rows[|worksheet.rows|-1].miller_rabin_worksheet.is_probably_prime == last_succeeds\r\n )\r\n //- randoms properly accounted for\r\n && PrimeGenerationWorksheetConsumesRandoms(worksheet.rows) == worksheet.randoms\r\n}\r\n\r\nstatic function PrimeGenerationWorksheetAppend(keybits:int, worksheet:PrimeGenerationWorksheet, worksheet_row:PrimeGenerationWorksheetRow, last_accepted:bool) : PrimeGenerationWorksheet\r\n requires 0, ghost worksheet:PrimeGenerationWorksheet)\r\n requires 3 < keybits;\r\n requires keybits < power2(32);\r\n ensures WellformedFatNat(Random);\r\n ensures IsProbablyPrime(J(Random), Configure_MillerRabinStrength());\r\n ensures power2(keybits-1) <= J(Random) < power2(keybits);\r\n ensures PrimeGenerationWorksheetValid_precondition(worksheet);\r\n ensures PrimeGenerationWorksheetValid(keybits, worksheet);\r\n ensures PrimeGenerationOutput(worksheet) == J(Random);\r\n\r\n \r\n \r\n \r\n requires TPM_ready();\r\n ensures TPM_ready();\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPMs_match_except_for_randoms(old(TPM), TPM);\r\n ensures old(TPM).random_index <= TPM.random_index;\r\n ensures worksheet.randoms == TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index);\r\n{\r\n var isProbablyPrime:bool := false;\r\n worksheet := PrimeGenerationWorksheet_c([], []);\r\n\r\n lemma_power2_strictly_increases(30,32);\r\n//- assert(Word32(keybits-1));\r\n var Offset := FatPower2(keybits-1);\r\n Random := Offset; //- dafnycc: initialize variable\r\n ghost var started := false;\r\n\r\n while (!isProbablyPrime)\r\n decreases *;\r\n invariant WellformedFatNat(Offset);\r\n invariant J(Offset) == power2(keybits-1);\r\n invariant isProbablyPrime ==> WellformedFatNat(Random);\r\n invariant isProbablyPrime ==> power2(keybits-1) <= J(Random) < power2(keybits);\r\n invariant isProbablyPrime ==> IsProbablyPrime(J(Random), Configure_MillerRabinStrength());\r\n invariant PrimeGenerationWorksheetValid_incremental(keybits, worksheet, isProbablyPrime);\r\n invariant isProbablyPrime ==> 0 < |worksheet.rows|;\r\n invariant isProbablyPrime ==> started;\r\n invariant started ==> PrimeGenerationWorksheetValid_precondition(worksheet);\r\n invariant isProbablyPrime ==> PrimeGenerationOutput(worksheet) == J(Random);\r\n invariant TPM_ready();\r\n invariant TPMs_match_except_for_randoms(old(TPM), TPM);\r\n invariant old(TPM).random_index <= TPM.random_index;\r\n invariant worksheet.randoms == TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index);\r\n {\r\n var Entropy:array;\r\n ghost var randoms:seq;\r\n ghost var loop_TPM_index := TPM.random_index;\r\n Entropy,randoms := FatNatRandomPower2(keybits-1);\r\n assert randoms == TPM_random_bytes_premium(loop_TPM_index, TPM.random_index);\r\n\r\n assert 0<=J(Entropy));\r\n\r\nstatic predicate CandidatePrimeWorksheetValid(keybits:int, worksheet:CandidatePrimeWorksheet)\r\n requires 0);\r\n\r\nstatic predicate PrimeGenerationWorksheetRowValid(keybits:int, row:PrimeGenerationWorksheetRow)\r\n requires 0,\r\n randoms:seq);\r\n\r\nstatic function PrimeGenerationWorksheetConsumesRandoms(rows:seq) : seq\r\n{\r\n if (rows==[]) then\r\n []\r\n else\r\n PrimeGenerationWorksheetConsumesRandoms(rows[..|rows|-1]) + rows[|rows|-1].randoms\r\n}\r\n\r\nstatic predicate {:autoReq} PrimeGenerationWorksheetValid(keybits:int, worksheet:PrimeGenerationWorksheet)\r\n{\r\n //- each row locally valid\r\n (forall i :: 0<=i<|worksheet.rows| ==> PrimeGenerationWorksheetRowValid(keybits, worksheet.rows[i]))\r\n //- all but last row fail, last row succeeds\r\n && (forall i :: 0<=i<|worksheet.rows|-1 ==> !worksheet.rows[i].miller_rabin_worksheet.is_probably_prime)\r\n && 0<|worksheet.rows|\r\n && worksheet.rows[|worksheet.rows|-1].miller_rabin_worksheet.is_probably_prime\r\n //- randoms properly accounted for\r\n && PrimeGenerationWorksheetConsumesRandoms(worksheet.rows) == worksheet.randoms\r\n}\r\n\r\nstatic function {:autoReq} PrimeGenerationOutput(worksheet:PrimeGenerationWorksheet) : int\r\n requires 0<|worksheet.rows|;\r\n{\r\n worksheet.rows[|worksheet.rows|-1].candidate.candidate\r\n}\r\n\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/KeyImpl.i.dfy", "content": "include \"RSASpec.s.dfy\"\r\ninclude \"../../FatNat/FatNatCommon.i.dfy\"\r\ninclude \"../../FatNat/FatNatReciprocal.i.dfy\"\r\n\r\ndatatype RSAPubKeyImpl_internal = RSAPubKeyImpl_c_internal(\r\n n:array, //- modulus\r\n size:nat,\r\n e:array, //- public key exponent\r\n nReciprocal:FNDivReciprocal\r\n );\r\n\r\npredicate {:heap} WellformedRSAPubKeyImpl_internal(pub:RSAPubKeyImpl_internal)\r\n reads pub.n;\r\n reads pub.e;\r\n reads if pub.nReciprocal.FNDivKnownReciprocal? then pub.nReciprocal.TwoTo32wDividedByD else pub.n;\r\n{\r\n//- FrumpyBigNat(pub.n)\r\n true\r\n && WellformedFatNat(pub.n)\r\n && WellformedFatNat(pub.e)\r\n//- && pub.n.Length < power2(25) //- transitional, while converting to FatNats\r\n && 0 //- private key exponent\r\n );\r\n\r\npredicate {:heap} WellformedRSAKeyPairImpl_internal(p:RSAKeyPairImpl_internal)\r\n reads p.pub.n;\r\n reads p.pub.e;\r\n reads p.d;\r\n reads if p.pub.nReciprocal.FNDivKnownReciprocal? then p.pub.nReciprocal.TwoTo32wDividedByD else p.pub.n;\r\n{\r\n WellformedRSAPubKeyImpl_internal(p.pub)\r\n && WellformedFatNat(p.d)\r\n//- && FrumpyBigNat(p.d)\r\n}\r\n\r\nfunction {:heap} PubKeyImplToSpec_internal(pubkey:RSAPubKeyImpl_internal) : RSAPubKeySpec\r\n requires WellformedRSAPubKeyImpl_internal(pubkey);\r\n reads pubkey.n;\r\n reads pubkey.e;\r\n reads if pubkey.nReciprocal.FNDivKnownReciprocal? then pubkey.nReciprocal.TwoTo32wDividedByD else pubkey.n;\r\n{\r\n RSAPublicKeySpec_c(J(pubkey.n), pubkey.size, J(pubkey.e))\r\n}\r\n\r\nfunction {:heap} KeyPairImplToSpec_internal(key:RSAKeyPairImpl_internal) : RSAKeyPairSpec\r\n requires WellformedRSAKeyPairImpl_internal(key);\r\n reads key.d;\r\n reads key.pub.n;\r\n reads key.pub.e;\r\n reads if key.pub.nReciprocal.FNDivKnownReciprocal? then key.pub.nReciprocal.TwoTo32wDividedByD else key.pub.n;\r\n{\r\n RSAKeyPairSpec_c(PubKeyImplToSpec_internal(key.pub), J(key.d))\r\n}\r\n\r\nlemma {:heap} lemma_WellformedPubKeyImplImpliesWellformedPubKeySpec (pubkey:RSAPubKeyImpl_internal)\r\n requires WellformedRSAPubKeyImpl_internal(pubkey);\r\n ensures WellformedRSAPubKeySpec(PubKeyImplToSpec_internal(pubkey));\r\n{\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/KeybitsLength.i.dfy", "content": "include \"../../BigNum/BigNumBEAdaptor.i.dfy\"\r\n\r\nlemma lemma_keybits_implies_length(N:BigNat, w:nat)\r\n requires WellformedBigNat(N);\r\n requires 0 !divides(cf, n)\r\n}\r\n\r\npredicate IsEvenFatNat_inner(N:array)\r\n reads N;\r\n requires WellformedFatNat(N);\r\n{\r\n N.Length==0 || IsEven(ArrayDigitAt(N,0))\r\n}\r\n\r\nlemma lemma_bignat_even(N:array)\r\n requires WellformedFatNat(N);\r\n ensures IsEven(BEWordSeqToInt(N[..])) == IsEvenFatNat_inner(N);\r\n{\r\n var Ns := N[..];\r\n var Nv := BEWordSeqToInt(Ns);\r\n if (N.Length == 0)\r\n {\r\n calc {\r\n IsEven(BEWordSeqToInt(N[..]));\r\n IsEven(Nv);\r\n { lemma_even_mod_0_pos(Nv); }\r\n mod(Nv, 2) == 0;\r\n { reveal_BEDigitSeqToInt_private(); }\r\n mod(0, 2) == 0;\r\n { lemma_small_mod(0,2); }\r\n true;\r\n IsEvenFatNat_inner(N);\r\n }\r\n }\r\n else\r\n {\r\n lemma_2toX();\r\n var pv := power2(32);\r\n var Hv := BEDigitSeqToInt(pv, SelectDigitRange(Ns, |Ns|, 1));\r\n var Lv := DigitAt(Ns,0);\r\n\r\n if (|Ns|==1)\r\n {\r\n assert Ns == [Lv]; //- OBSERVE SEQ\r\n calc {\r\n Nv;\r\n BEDigitSeqToInt(pv, [Lv]);\r\n { lemma_BEDigitSeqToInt_singleton(pv, Lv); }\r\n Lv;\r\n ArrayDigitAt(N,0);\r\n }\r\n }\r\n else\r\n {\r\n var L2 := 2;\r\n calc {\r\n Nv;\r\n { lemma_BEInterpretation_Select(pv, Ns, 1); }\r\n Hv * power(pv,1) + BEDigitSeqToInt(pv, SelectDigitRange(Ns, 1, 0));\r\n { lemma_SelectSingletonRange(Ns, 1, 0); }\r\n Hv * power(pv,1) + BEDigitSeqToInt(pv, [DigitAt(Ns,0)]);\r\n { lemma_BEDigitSeqToInt_singleton(pv, Lv); }\r\n Hv * power(pv,1) + Lv;\r\n { lemma_power2_unfolding(32, 1);\r\n lemma_mul_is_mul_boogie(32, 1); }\r\n Hv * power2(32*1) + Lv;\r\n { lemma_power2_adds(32*1-1,1); }\r\n Hv * (power2(32*1-1) * power2(1)) + Lv;\r\n { lemma_mul_is_associative_forall(); }\r\n (Hv*power2(32*1-1)) * power2(1) + Lv;\r\n { lemma_fundamental_div_mod(Lv,L2); }\r\n (Hv*power2(32*1-1)) * power2(1) + L2*(Lv/L2) + Lv%L2;\r\n { lemma_power2_1_is_2();\r\n lemma_mul_is_commutative_forall(); }\r\n L2*(Hv*power2(32*1-1)) + L2*(Lv/L2) + Lv%L2;\r\n { lemma_mul_is_distributive_forall(); }\r\n L2*(Hv*power2(32*1-1) + Lv/L2) + Lv%L2;\r\n }\r\n var ugly := Hv*power2(32*1-1) + Lv/L2;\r\n calc {\r\n Nv % L2;\r\n (L2*ugly + Lv%L2) % L2;\r\n { lemma_mod_multiples_vanish(ugly, Lv%L2, L2); }\r\n (Lv%L2) % L2;\r\n { lemma_mod_properties();\r\n lemma_small_mod(Lv%L2, L2); }\r\n Lv%L2;\r\n ArrayDigitAt(N,0) % L2;\r\n }\r\n }\r\n calc {\r\n IsEven(BEWordSeqToInt(N[..]));\r\n { lemma_even_mod_0_pos(Nv); }\r\n mod(Nv, 2) == 0;\r\n mod(ArrayDigitAt(N,0), 2) == 0;\r\n { lemma_even_mod_0_pos(ArrayDigitAt(N,0)); }\r\n IsEvenFatNat_inner(N);\r\n }\r\n }\r\n\r\n//- var w31 := power2(31);\r\n//- reveal_power2();\r\n//- assert w31*2 == Width();\r\n//- { lemma_mul_is_mul_boogie(w31,2); }\r\n//- assert mul(w31,2) == Width();\r\n\r\n//- if (IsEven(lo(N)))\r\n//- {\r\n//- var y0:int :| mul(y0, 2) == lo(N);\r\n//- lemma_mul_is_mul_boogie(y0, 2);\r\n//- var y := w31 * J(hi(N)) + y0;\r\n//-\r\n//- calc {\r\n//- mul(y, 2);\r\n//- { lemma_mul_is_mul_boogie(y, 2); }\r\n//- y * 2;\r\n//- (w31*J(hi(N)) + y0) * 2;\r\n//- { lemma_mul_is_distributive_add_forall(); }\r\n//- (w31*J(hi(N)))*2 + y0*2;\r\n//- { lemma_mul_is_mul_boogie((w31*J(hi(N))),2); }\r\n//- mul(w31*J(hi(N)),2) + y0*2;\r\n//- { lemma_mul_is_commutative_forall(); }\r\n//- mul(2,w31*J(hi(N))) + y0*2;\r\n//- { lemma_mul_is_associative_forall(); }\r\n//- mul(mul(2,w31),J(hi(N))) + y0*2;\r\n//- { lemma_mul_is_commutative_forall(); }\r\n//- mul(mul(w31,2),J(hi(N))) + y0*2;\r\n//- mul(Width(),J(hi(N))) + y0*2;\r\n//- Width()*J(hi(N)) + y0*2;\r\n//- Width()*J(hi(N)) + lo(N);\r\n//- {\r\n//- lemma_hilo(N);\r\n//- lemma_mul_is_commutative_forall();\r\n//- }\r\n//- J(N);\r\n//- }\r\n//- assert IsEven(J(N));\r\n//- }\r\n//- if (IsEven(J(N)))\r\n//- {\r\n//- var y :| mul(y, 2) == J(N);\r\n//- lemma_mul_is_mul_boogie(y, 2);\r\n//- calc ==> {\r\n//- true;\r\n//- {\r\n//- lemma_hilo(N);\r\n//- lemma_mul_is_commutative_forall();\r\n//- }\r\n//- y*2 == Width()*J(hi(N)) + lo(N);\r\n//- y*2 == mul(w31,2)*J(hi(N)) + lo(N);\r\n//- y*2 - mul(w31,2)*J(hi(N)) == lo(N);\r\n//- {\r\n//- lemma_mul_is_commutative_forall();\r\n//- lemma_mul_is_associative_forall();\r\n//- }\r\n//- y*2 - mul(mul(w31,J(hi(N))),2) == lo(N);\r\n//- { lemma_mul_is_mul_boogie(y,2); }\r\n//- mul(y,2) - mul(mul(w31,J(hi(N))),2) == lo(N);\r\n//- { lemma_mul_is_commutative_forall(); }\r\n//- mul(2,y) - mul(2,mul(w31,J(hi(N)))) == lo(N);\r\n//- { lemma_mul_is_distributive_sub(2, y, mul(w31,J(hi(N)))); }\r\n//- mul(2, y - mul(w31,J(hi(N)))) == lo(N);\r\n//- mul(2, y - w31*J(hi(N))) == lo(N);\r\n//- { lemma_mul_is_commutative_forall(); }\r\n//- mul(y - w31*J(hi(N)), 2) == lo(N);\r\n//- { lemma_mul_is_mul_boogie(y - w31*J(hi(N)),2); }\r\n//- IsEven(lo(N));\r\n//- }\r\n//- }\r\n}\r\n\r\nstatic function method WordIsEven_def(x:nat) : bool\r\n requires Word32(x);\r\n{\r\n \r\n x%2 == 0\r\n}\r\n\r\nstatic lemma lemma_WordIsEven(x:nat)\r\n requires Word32(x);\r\n ensures WordIsEven_def(x) == IsEven(x);\r\n{\r\n lemma_even_mod_0_pos(x);\r\n lemma_mod_is_mod_boogie(x, 2);\r\n}\r\n\r\nstatic function method WordIsEven(x:nat) : bool\r\n requires Word32(x);\r\n ensures IsEven(x) == WordIsEven(x);\r\n{\r\n lemma_WordIsEven(x);\r\n WordIsEven_def(x)\r\n \r\n}\r\n\r\n\r\nfunction method IsEvenFatNat_def(N:array) : bool\r\n reads N;\r\n requires WellformedFatNat(N);\r\n{\r\n if (N.Length==0) then\r\n true\r\n else\r\n WordIsEven(ArrayDigitAt(N,0))\r\n}\r\n\r\nlemma lemma_IsEvenFatNat(N:array)\r\n requires WellformedFatNat(N);\r\n ensures IsEvenFatNat_def(N) == IsEven(J(N));\r\n{\r\n if (N.Length==0) {\r\n calc {\r\n IsEvenFatNat_def(N);\r\n true;\r\n { lemma_mul_is_mul_boogie(0, 2); }\r\n { assert mul(0, 2) == 0; }\r\n IsEven(0);\r\n { reveal_BEDigitSeqToInt_private(); }\r\n IsEven(J(N));\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n IsEvenFatNat_def(N);\r\n WordIsEven(ArrayDigitAt(N,0));\r\n IsEven(ArrayDigitAt(N,0));\r\n { lemma_bignat_even(N); }\r\n IsEven(J(N));\r\n }\r\n }\r\n}\r\n\r\nfunction method IsEvenFatNat(N:array) : bool\r\n reads N;\r\n requires WellformedFatNat(N);\r\n ensures IsEvenFatNat(N) == IsEven(J(N));\r\n{\r\n lemma_IsEvenFatNat(N);\r\n IsEvenFatNat_def(N)\r\n}\r\n\r\nstatic lemma lemma_dividing_by_two(n:nat, q:nat, r:nat)\r\n requires 0 < n;\r\n requires mul(q,2)+r==n;\r\n requires r<2;\r\n requires IsEven(n);\r\n ensures 0 < q;\r\n ensures q < n;\r\n ensures r == 0;\r\n{\r\n if (r!=0)\r\n {\r\n var y:int :| mul(y, 2) == n;\r\n assert r==1;\r\n calc ==> {\r\n mul(q,2)+1==n;\r\n mul(q,2)+1==mul(y,2);\r\n 1==mul(y,2) - mul(q,2);\r\n { lemma_mul_is_commutative_forall(); }\r\n 1==mul(2,y) - mul(2,q);\r\n { lemma_mul_is_distributive_sub(2,y,q); }\r\n 1==mul(2,y-q);\r\n { lemma_mul_is_mul_boogie(2,y-q); }\r\n 1==2*(y-q);\r\n { lemma_no_half(y-q); }\r\n false;\r\n }\r\n }\r\n assert r==0;\r\n\r\n calc ==> {\r\n 0 < mul(q,2);\r\n { lemma_mul_basics(2); }\r\n mul(0,2) < mul(q,2);\r\n { lemma_mul_strict_inequality_converse(0,q,2); }\r\n 0 < q;\r\n }\r\n\r\n calc ==> {\r\n true;\r\n { lemma_mul_strictly_increases(2,q); }\r\n q < mul(2,q);\r\n { lemma_mul_is_commutative_forall(); }\r\n q < mul(q,2);\r\n q < n;\r\n }\r\n}\r\n\r\nmethod MR_find_s_D(N:array, two:array) returns (s:nat, D:array)\r\n decreases J(N);\r\n//- requires ModestBigNatWords(N);\r\n requires WellformedFatNat(N);\r\n requires 0 < J(N);\r\n requires WellformedFatNat(two);\r\n requires J(two) == 2;\r\n//- requires ModestBigNatWords(two);\r\n ensures WellformedFatNat(D);\r\n ensures 0 < J(D);\r\n ensures power2(s)*J(D) == J(N);\r\n ensures J(D) <= J(N);\r\n ensures !IsEven(J(D));\r\n \r\n \r\n \r\n{\r\n D := N;\r\n s := 0;\r\n\r\n calc {\r\n power2(s)*J(D);\r\n power2(0)*J(D);\r\n { lemma_power2_0_is_1(); }\r\n mul(1,J(D));\r\n { lemma_mul_basics_forall(); }\r\n J(D);\r\n J(N);\r\n }\r\n\r\n while (IsEvenFatNat(D))\r\n invariant WellformedFatNat(D);\r\n invariant 0 < J(D);\r\n invariant power2(s)*J(D) == J(N);\r\n invariant J(D) <= J(N);\r\n decreases J(D);\r\n {\r\n lemma_2to32();\r\n assert 2 < Width();\r\n\r\n//- assert ModestBigNatWords(D);\r\n var Nover2_nc:array,zero:array := FatNatDiv(D, two);\r\n var Nover2 := CanonicalizeArray(Nover2_nc);\r\n\r\n calc {\r\n mul(J(Nover2),2)+J(zero);\r\n { lemma_mul_is_commutative_forall(); }\r\n J(D);\r\n }\r\n lemma_dividing_by_two(J(D), J(Nover2), J(zero));\r\n assert 0 < J(Nover2);\r\n assert J(Nover2) < J(D);\r\n assert J(zero)==0; //- else !WordIsEven()\r\n\r\n//- calc ==> {\r\n//- J(Nover2) <= J(D);\r\n//- { lemma_modesty_word_value_equivalence(D); }\r\n//- J(Nover2) < KindaBigNat();\r\n//- { lemma_modesty_word_value_equivalence(Nover2); }\r\n//- ModestBigNatWords(Nover2);\r\n//- }\r\n\r\n calc {\r\n power2(s+1) * J(Nover2);\r\n { lemma_power2_adds(s,1); }\r\n (power2(s) * power2(1)) * J(Nover2);\r\n { lemma_mul_is_associative_forall(); }\r\n power2(s) * (power2(1) * J(Nover2));\r\n { lemma_power2_1_is_2(); }\r\n power2(s) * mul(2, J(Nover2));\r\n { lemma_mul_is_commutative_forall(); }\r\n power2(s) * mul(J(Nover2), 2);\r\n power2(s) * (J(D));\r\n J(N);\r\n }\r\n D := Nover2;\r\n s := s + 1;\r\n }\r\n}\r\n\r\nstatic lemma lemma_even_divisble_by_2(x:int)\r\n requires 0 <= x;\r\n requires IsEven(x);\r\n ensures divides(2,x);\r\n{\r\n lemma_even_mod_0_pos(x);\r\n assert mod(x, 2) == 0;\r\n assert divides(2,x);\r\n}\r\n\r\nmethod ProbeLoop(N:array, Nminus1:array, Xinit:array, s:int, ghost problem:MRProblem, ghost probe_init:MRProbe)\r\n returns (isProbablyPrime:bool, ghost probe:MRProbe)\r\n\r\n requires WellformedFatNat(N);\r\n requires MRProblemNeedsProbes(problem);\r\n requires WellformedFatNat(Nminus1);\r\n requires J(Nminus1) == J(N) - 1;\r\n requires WellformedFatNat(Xinit);\r\n requires MRProblemValid(problem);\r\n requires probe_init.squares == [J(Xinit)];\r\n requires J(Xinit) != 1;\r\n requires J(Xinit) != problem.n-1;\r\n requires MRProbeInit(problem, probe_init);\r\n requires problem.n == J(N);\r\n requires problem.s == s;\r\n ensures probe.a == probe_init.a;\r\n ensures isProbablyPrime ==> MRProbeSucceeds(problem, probe);\r\n ensures !isProbablyPrime ==> MRProbeFails(problem, probe);\r\n{\r\n//- lemma_frumpy_is_modest(N);\r\n\r\n isProbablyPrime := true;\r\n probe := probe_init;\r\n\r\n var si:int := 1;\r\n var probing := true;\r\n var X:array := Xinit;\r\n while (si <= s-1)\r\n//- invariant FrumpyBigNat(X);\r\n invariant MRProblemValid(problem);\r\n invariant 0 < |probe.squares|;\r\n invariant 0 |probe.squares| <= s;\r\n invariant MRProbeInit(problem, probe);\r\n invariant si==|probe.squares|;\r\n invariant probe.a == probe_init.a;\r\n invariant WellformedFatNat(X);\r\n invariant probe.squares[si-1] == J(X);\r\n invariant isProbablyPrime ==>\r\n (forall i :: 0\r\n MRProbeChain(problem, probe, i));\r\n invariant !isProbablyPrime || probing || MRProbeSucceeds(problem, probe);\r\n invariant !isProbablyPrime ==> MRProbeFails(problem, probe);\r\n invariant isProbablyPrime && !probing ==> probe.squares[|probe.squares|-1]==problem.n-1;\r\n invariant MRProbeValid(problem, probe);\r\n invariant forall i :: 0 probe.squares[i] != 1;\r\n invariant si <= MRProbeLimit(problem);\r\n invariant forall i :: 0<=i<|probe.squares| ==> probe.squares[i] != problem.n-1;\r\n {\r\n var Xsquared:array := FatNatMul(X,X);\r\n lemma_mul_nonnegative(J(X),J(X));\r\n//- lemma_frumpy_squared_is_modest(X,Xsquared);\r\n assert 0 <= J(Xsquared);\r\n assert 0 < J(N);\r\n var oldX := X;\r\n var X_nc := FatNatModulo(Xsquared, N);\r\n X := CanonicalizeArray(X_nc);\r\n\r\n ghost var old_probe := probe;\r\n assert |old_probe.squares|==si;\r\n assert forall i :: 0\r\n MRProbeChain(problem, old_probe, i);\r\n assert forall i :: 0\r\n old_probe.squares[i] != 1;\r\n probe := MRProbe_c(probe.a, probe.squares + [J(X)]);\r\n\r\n lemma_mod_pos_bound(J(Xsquared),J(N));\r\n assert J(X) < J(N);\r\n//- assert FrumpyBigNat(X);\r\n lemma_2to32();\r\n\r\n calc {\r\n probe.squares[si];\r\n J(X);\r\n J(Xsquared) % J(N);\r\n (J(oldX)*J(oldX)) % J(N);\r\n { lemma_square_is_power_2(J(oldX)); }\r\n power(J(oldX),2) % J(N);\r\n { assert probe.squares[si-1] == J(oldX); }\r\n power(probe.squares[si-1],2) % J(N);\r\n power(probe.squares[si-1],2) % problem.n;\r\n }\r\n\r\n var is_one:bool := TestEqSmallLiteralFatNat(1, X);\r\n if (is_one)\r\n {\r\n //- n divides (a^{d2^{r-1}}-1)(a^{d2^{r-1}}+1);\r\n //- hence n could be factored.\r\n \r\n \r\n isProbablyPrime := false;\r\n probing := false;\r\n assert probing ==> s <= si;\r\n forall (i:int | 0 probe.squares[i]!=1);\r\n }\r\n else\r\n {\r\n assert (0 probe.squares[i]!=1);\r\n }\r\n }\r\n\r\n assert 0 < |probe.squares| <= problem.s;\r\n assert MRProblemValid(problem);\r\n assert MRProbeInit(problem,probe);\r\n assert forall i:int ::\r\n (0 MRProbeChain(problem, probe, i));\r\n assert forall i:int ::\r\n (0 probe.squares[i]!=1);\r\n \r\n assert MRProbeValid(problem, probe);\r\n assert probing ==> forall i :: 0<=i<|probe.squares| ==> probe.squares[i] != problem.n-1;\r\n break;\r\n }\r\n assert |probe.squares| == si+1;\r\n assert probe.squares[si] == power(probe.squares[si-1], 2) % problem.n;\r\n assert MRProbeChain(problem, probe, si);\r\n\r\n var is_nminus1:bool := FatNatEq(X, Nminus1);\r\n\r\n if (is_nminus1)\r\n {\r\n //- \"do next WitnessLoop\" -- this one is successful\r\n probing := false;\r\n calc {\r\n |probe.squares|;\r\n si+1;\r\n <= s;\r\n }\r\n calc {\r\n probe.squares[|probe.squares|-1];\r\n J(X);\r\n J(Nminus1);\r\n J(N)-1;\r\n problem.n-1;\r\n }\r\n forall (i | 0 s <= si;\r\n assert MRProbeValid(problem, probe);\r\n assert probing ==> forall i :: 0<=i<|probe.squares| ==> probe.squares[i] != problem.n-1;\r\n break;\r\n }\r\n\r\n ghost var old_si:int := si;\r\n assert forall i :: 0\r\n MRProbeChain(problem, old_probe, i);\r\n forall (i | 0\r\n MRProbeChain(problem, probe, i);\r\n }\r\n\r\n if (probing)\r\n {\r\n //- Unsatisfactory initial X, and never\r\n //- found the x-1 we needed in s-1 additional steps.\r\n isProbablyPrime := false;\r\n }\r\n assert isProbablyPrime ==> MRProbeSucceeds(problem, probe);\r\n\r\n if (!isProbablyPrime)\r\n {\r\n assert MRProbeValid(problem, probe);\r\n assert (|probe.squares| == MRProbeLimit(problem)\r\n || (0 < |probe.squares|\r\n && probe.squares[|probe.squares|-1] == 1));\r\n assert probe.squares!=[1];\r\n assert probe.squares!=[problem.n-1];\r\n assert probe.squares[|probe.squares|-1]!=problem.n-1;\r\n }\r\n \r\n assert !isProbablyPrime ==> MRProbeFails(problem, probe);\r\n}\r\n\r\nstatic predicate MillerRabinSpecSucceeding_incremental(problem:MRProblem, probes:seq)\r\n //- all probes succeed\r\n //- probed exactly as many times as problem strength requires\r\n{\r\n MRProblemNeedsProbes(problem)\r\n && problem.n%2==1\r\n && problem.n>3\r\n && forall i :: 0 <= i < |probes|-1 ==> MRProbeSucceeds(problem, probes[i])\r\n}\r\n\r\nstatic predicate MillerRabinWorksheetValid_incremental(n:int, worksheet:MillerRabinWorksheet)\r\n{\r\n |worksheet.probes|==|worksheet.probe_candidates|\r\n && |worksheet.probes|==|worksheet.probe_seed_reqs|\r\n && (forall i :: 0<=i<|worksheet.probes| ==> MillerRabinProbeConsistency(n, worksheet.probe_candidates[i], worksheet.probe_seed_reqs[i], worksheet.probes[i]))\r\n && worksheet.problem.n == n\r\n && worksheet.problem.strength == Configure_MillerRabinStrength()\r\n && MillerRabinSpecSucceeding_incremental(worksheet.problem, worksheet.probes)\r\n && MillerRabinWorksheetConsumesRandoms(worksheet.probe_candidates) == worksheet.randoms\r\n}\r\n\r\n\r\n\r\n\r\nmethod GhostFatNatCountBits(x:array) returns (ghost e:nat)\r\n requires x!=null && IsWordSeq(x[..]);\r\n ensures FatNatBitCount(x[..], e);\r\n{\r\n var real_e := FatNatCountBits(x);\r\n e := real_e;\r\n}\r\n\r\nmethod {:timeLimitMultiplier 3} WitnessLoop(N:array, Nminus1:array, Nminus2:array, D:array, s:int, two:array, strength:nat, ghost problem:MRProblem)\r\n returns (isProbablyPrime:bool, ghost worksheet:MillerRabinWorksheet)\r\n\r\n requires WellformedFatNat(N);\r\n//- requires FrumpyBigNat(N);\r\n requires MRProblemNeedsProbes(problem);\r\n requires WellformedFatNat(Nminus1);\r\n requires J(Nminus1) == J(N) - 1;\r\n requires WellformedFatNat(Nminus2);\r\n//- requires ModestBigNatWords(Nminus2);\r\n requires J(Nminus2) == J(N) - 2;\r\n requires WellformedFatNat(D);\r\n//- requires FrumpyBigNat(D);\r\n requires WellformedFatNat(two);\r\n//- requires ModestBigNatWords(two);\r\n requires J(two) == 2;\r\n requires strength == Configure_MillerRabinStrength();\r\n requires MRProblemValid(problem);\r\n requires problem.n == J(N);\r\n requires problem.strength == strength;\r\n requires problem.s == s;\r\n requires problem.d == J(D);\r\n ensures MillerRabinWorksheetValid(problem.n, worksheet);\r\n ensures MillerRabinSpecValid(problem, worksheet.probes, worksheet.is_probably_prime);\r\n ensures worksheet.is_probably_prime == isProbablyPrime;\r\n requires TPM_ready();\r\n ensures TPM_ready();\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPMs_match_except_for_randoms(old(TPM), TPM);\r\n ensures old(TPM).random_index <= TPM.random_index;\r\n ensures worksheet.randoms == TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index);\r\n{\r\n ghost var probes := [];\r\n\r\n worksheet := MillerRabinWorksheet_c(\r\n problem,\r\n [],\r\n [],\r\n [],\r\n true,\r\n []);\r\n assert MillerRabinWorksheetValid_incremental(J(N), worksheet);\r\n\r\n var ki:int :=0;\r\n isProbablyPrime := true;\r\n while (ki < strength && isProbablyPrime)\r\n decreases strength - ki;\r\n invariant (forall i :: 0<=i<|probes|-1\r\n ==> MRProbeSucceeds(problem, probes[i]));\r\n invariant !isProbablyPrime ==>\r\n 0<|probes| && MRProbeFails(problem, probes[|probes|-1]);\r\n invariant (forall probe :: 0 <= probe < |probes|\r\n ==> MRProbeValid(problem, probes[probe]));\r\n invariant isProbablyPrime ==>\r\n (forall probe :: 0 <= probe < |probes|\r\n ==> MRProbeSucceeds(problem, probes[probe]));\r\n invariant MRProblemValid(problem);\r\n invariant |probes|==ki;\r\n invariant ki <= strength;\r\n invariant worksheet.problem == problem;\r\n invariant worksheet.probes == probes;\r\n invariant MillerRabinWorksheetValid_incremental(J(N), worksheet);\r\n invariant worksheet.is_probably_prime == isProbablyPrime;\r\n invariant TPM_ready();\r\n invariant TPMs_match_except_for_randoms(old(TPM), TPM);\r\n invariant old(TPM).random_index <= TPM.random_index;\r\n invariant worksheet.randoms == TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index);\r\n {\r\n ghost var loop_TPM_index := TPM.random_index;\r\n ghost var Nminus2fatbits := GhostFatNatCountBits(Nminus2);\r\n ghost var req := SelectRandomRequest_c(2, J(Nminus2), Nminus2fatbits);\r\n lemma_power2_0_is_1();\r\n var A:array,candidate_worksheet := FatNatRandomFromInclusiveRange(two, Nminus2, req);\r\n assert TPM_random_bytes_premium(loop_TPM_index, TPM.random_index) == candidate_worksheet.randoms;\r\n\r\n var X:array := FatNatModExp(A, D, N);\r\n//- assert FrumpyBigNat(X);\r\n\r\n ghost var probe:MRProbe := MRProbe_c(J(A), [J(X)]);\r\n calc {\r\n probe.squares[0];\r\n J(X);\r\n power(J(A),J(D)) % J(N);\r\n power(probe.a, problem.d) % problem.n;\r\n }\r\n assert MRProbeInit(problem, probe);\r\n\r\n assert MRProbeValid(problem, probe);\r\n lemma_2toX();\r\n var is_one:bool := TestEqSmallLiteralFatNat(1, X);\r\n if (is_one)\r\n { //- \"continue\"\r\n assert probe.squares==[J(X)]==[1];\r\n assert MRProbeSucceeds(problem, probe);\r\n }\r\n else\r\n {\r\n var is_nminus1:bool := FatNatEq(X, Nminus1);\r\n if (is_nminus1)\r\n { //- \"continue\"\r\n calc {\r\n probe.squares;\r\n [J(X)];\r\n [J(Nminus1)];\r\n [J(N)-1];\r\n [problem.n - 1];\r\n }\r\n assert MRProbeSucceeds(problem, probe);\r\n }\r\n else\r\n {\r\n isProbablyPrime,probe := ProbeLoop(N, Nminus1, X, s, problem, probe);\r\n } //- \"continue\"\r\n } //- \"continue\"\r\n\r\n probes := probes + [probe];\r\n\r\n ki := ki + 1;\r\n\r\n ghost var worksheet' := MillerRabinWorksheet_c(\r\n problem,\r\n worksheet.probe_candidates + [candidate_worksheet],\r\n worksheet.probe_seed_reqs + [req],\r\n worksheet.probes + [probe],\r\n isProbablyPrime,\r\n worksheet.randoms + candidate_worksheet.randoms);\r\n\r\n//- assert MillerRabinWorksheetConsumesRandoms(worksheet'.probe_candidates) == worksheet'.randoms;\r\n assert MillerRabinWorksheetValid_incremental(J(N), worksheet');\r\n\r\n assert old(TPM).random_index + |worksheet.randoms| == loop_TPM_index;\r\n assert TPM_random_bytes_premium(\r\n old(TPM).random_index,\r\n old(TPM).random_index + |worksheet.randoms|)\r\n == worksheet.randoms; // loop invariant\r\n assert TPM_random_bytes_premium(loop_TPM_index, TPM.random_index) == candidate_worksheet.randoms; // FatNatRandomFromInclusiveRange\r\n assert loop_TPM_index == old(TPM).random_index + |worksheet.randoms|;\r\n assert TPM.random_index == loop_TPM_index + |candidate_worksheet.randoms|;\r\n assert TPM_random_bytes_premium(\r\n old(TPM).random_index + |worksheet.randoms|,\r\n old(TPM).random_index + |worksheet.randoms| + |candidate_worksheet.randoms|)\r\n == candidate_worksheet.randoms;\r\n lemma_random_comprehension(old(TPM).random_index, worksheet.randoms, candidate_worksheet.randoms);\r\n\r\n worksheet := worksheet';\r\n assert (forall probe :: 0 <= probe < |probes|\r\n ==> MRProbeValid(problem, probes[probe]));\r\n }\r\n if (isProbablyPrime)\r\n {\r\n assert strength <= ki;\r\n assert forall probe :: 0 <= probe < |probes|\r\n ==> MRProbeSucceeds(problem, probes[probe]);\r\n calc {\r\n problem.strength;\r\n strength;\r\n <= ki;\r\n |probes|;\r\n }\r\n assert MillerRabinSpecSucceeds(problem, probes);\r\n }\r\n else\r\n {\r\n assert MRProbeValid(problem, probes[|probes|-1]);\r\n assert MillerRabinSpecFails(problem, probes);\r\n }\r\n}\r\n\r\nmethod {:timeLimitMultiplier 3} MillerRabinTest(N:array, strength:nat) returns (isProbablyPrime:bool, ghost worksheet:MillerRabinWorksheet)\r\n//- requires FrumpyBigNat(N);\r\n requires WellformedFatNat(N);\r\n requires J(N) > 3;\r\n requires strength == Configure_MillerRabinStrength();\r\n ensures isProbablyPrime ==> IsProbablyPrime(J(N), strength);\r\n ensures MillerRabinWorksheetValid(J(N), worksheet);\r\n ensures worksheet.is_probably_prime == isProbablyPrime;\r\n requires TPM_ready();\r\n ensures TPM_ready();\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPMs_match_except_for_randoms(old(TPM), TPM);\r\n ensures old(TPM).random_index <= TPM.random_index;\r\n ensures worksheet.randoms == TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index);\r\n{\r\n ProfileTally(Tally_MillerRabinTest(), 1);\r\n//- debug_print(0x90, 0x88778877);\r\n//- lemma_frumpy_is_modest(N);\r\n lemma_2toX();\r\n\r\n var early_reject:bool := false;\r\n var three := MakeBELiteralArray(3);\r\n var too_small := FatNatLe(N, three);\r\n if (too_small)\r\n {\r\n early_reject := true;\r\n assert J(N)<=3;\r\n }\r\n else if (IsEvenFatNat(N))\r\n {\r\n early_reject := true;\r\n lemma_even_divisble_by_2(J(N));\r\n lemma_mod_is_mod_boogie(J(N), 2);\r\n assert J(N) % 2 == 0;\r\n//- assert divides(2, J(N));\r\n//- assert !IsPrime(J(N));\r\n }\r\n assert early_reject ==> (J(N) <= 3 || J(N)%2==0);\r\n\r\n if (early_reject)\r\n {\r\n isProbablyPrime := false;\r\n\r\n //- even N? s & d irrelevant.\r\n ghost var problem := MRProblem_c(J(N), strength, 0, 0);\r\n worksheet := MillerRabinWorksheet_c(\r\n problem,\r\n //- No probes in this case.\r\n [],\r\n [],\r\n [],\r\n false,\r\n []);\r\n assert MillerRabinSpecFails(problem, []);\r\n }\r\n else\r\n {\r\n var one:array := MakeBELiteralArray(1);\r\n lemma_2toX32();\r\n assert 2 < Width();\r\n var two:array := MakeBELiteralArray(2);\r\n var Nminus1:array := FatNatSub(N,one);\r\n\r\n//- lemma_modesty_word_value_equivalence(N);\r\n//- lemma_modesty_word_value_equivalence(Nminus1);\r\n//- assert ModestBigNatWords(Nminus1);\r\n\r\n var Nminus2:array := FatNatSub(N,two);\r\n//- lemma_modesty_word_value_equivalence(Nminus2);\r\n\r\n lemma_power2_increases(power2(1), power2(31));\r\n//- lemma_modesty_word_value_equivalence(two);\r\n\r\n var s:int,D:array := MR_find_s_D(Nminus1, two);\r\n//- assert FrumpyBigNat(D);\r\n\r\n ghost var problem:MRProblem := MRProblem_c(J(N), strength, s, J(D));\r\n assert s==problem.s;\r\n\r\n lemma_x_odd(J(N));\r\n lemma_x_odd(J(D));\r\n calc {\r\n power(2,problem.s)*problem.d;\r\n power(2,s)*J(D);\r\n { lemma_power2_is_power_2(s); }\r\n power2(s)*J(D);\r\n J(N)-1;\r\n }\r\n assert MRProblemValid(problem);\r\n\r\n isProbablyPrime,worksheet := WitnessLoop(N, Nminus1, Nminus2, D, s, two, strength, problem);\r\n if (isProbablyPrime)\r\n {\r\n MillerRabinSpec(problem, worksheet.probes);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/MillerRabin.s.dfy", "content": "include \"../RandomNumberGen.s.dfy\"\r\ninclude \"../../Math/power.s.dfy\"\r\n\r\nstatic function method Configure_MillerRabinStrength() : int { 8 }\r\n //- According to HAC table 4.4,\r\n //- 512 bit key => 256 bit prime => 12 probes,\r\n //- 1024 bit key => 512 bit prime => 8 probes.\r\n\r\n//------------------------------------------------------------//\r\n\r\n//- This worksheet is valid if a MillerRabin worksheet (from\r\n//- MillerRabin.s) is correctly configured for this prime test,\r\n//- valid, and its probes legitimately constructed from the\r\n//- randoms supply.\r\n//- The MillerRabin.s file doesn't track randomness budget,\r\n//- hence the glue.\r\n\r\n\r\n\r\n\r\ndatatype MillerRabinWorksheet = MillerRabinWorksheet_c(\r\n problem:MRProblem,\r\n probe_candidates:seq,\r\n probe_seed_reqs:seq,\r\n //- probe_seed_req merely defers the work of demonstrating existence\r\n //- of a feasible h_bits value to the implementation.\r\n probes:seq,\r\n is_probably_prime:bool,\r\n randoms:seq);\r\n\r\nstatic function MillerRabinWorksheetConsumesRandoms(rows:seq) : seq\r\n{\r\n if (rows==[]) then\r\n []\r\n else\r\n MillerRabinWorksheetConsumesRandoms(rows[..|rows|-1]) + rows[|rows|-1].randoms\r\n}\r\n\r\n//-static predicate MillerRabinWorksheetConsumesRandoms(rows:seq, randoms:seq)\r\n//-{\r\n//- if (|rows|==0) then\r\n//- |randoms|==0\r\n//- else\r\n//- is_suffix(rows[|rows|-1].randoms, randoms)\r\n//- && MillerRabinWorksheetConsumesRandoms(rows[..|rows|-1], randoms[..|randoms|-|rows])\r\n//- |rows[0].randoms|..])\r\n//-}\r\n\r\nstatic predicate IsMillerRabinProbeSeed(n:int, req:SelectRandomRequest)\r\n{\r\n req.l == 2\r\n && req.h == n-2\r\n && SelectRandomRequestValid(req)\r\n}\r\n\r\nstatic predicate MillerRabinProbeConsistency(\r\n n:int,\r\n probe_candidate:CandidateSeedWorksheet,\r\n probe_seed_req:SelectRandomRequest,\r\n probe:MRProbe)\r\n{\r\n IsMillerRabinProbeSeed(n, probe_seed_req)\r\n && CandidateSeedWorksheetValid(probe_seed_req, probe_candidate)\r\n && probe.a == CandidateSeedWorksheetOutput(probe_candidate)\r\n}\r\n\r\nstatic predicate MillerRabinWorksheetValid(n:int, worksheet:MillerRabinWorksheet)\r\n{\r\n |worksheet.probes|==|worksheet.probe_candidates|\r\n && |worksheet.probes|==|worksheet.probe_seed_reqs|\r\n && (forall i :: 0<=i<|worksheet.probes| ==> MillerRabinProbeConsistency(n, worksheet.probe_candidates[i], worksheet.probe_seed_reqs[i], worksheet.probes[i]))\r\n && worksheet.problem.n == n\r\n && worksheet.problem.strength == Configure_MillerRabinStrength()\r\n && MillerRabinSpecValid(worksheet.problem, worksheet.probes, worksheet.is_probably_prime)\r\n && MillerRabinWorksheetConsumesRandoms(worksheet.probe_candidates) == worksheet.randoms\r\n}\r\n\r\n//------------------------------------------------------------//\r\n\r\ndatatype MRProblem = MRProblem_c(\r\n n:nat,\r\n strength:nat,\r\n s:nat,\r\n d:nat)\r\n\r\nstatic predicate MRProblemEarlyReject(problem:MRProblem)\r\n{\r\n problem.n <= 3\r\n || problem.n%2 == 0\r\n}\r\n\r\nstatic predicate MRProblemNeedsProbes(problem:MRProblem)\r\n{\r\n !MRProblemEarlyReject(problem)\r\n\r\n //- Input: k, a parameter that determines the accuracy of the test\r\n && problem.strength == Configure_MillerRabinStrength()\r\n\r\n //- write n - 1 as 2^sd with d odd by factoring powers of 2 from n - 1\r\n && problem.n-1 == power(2,problem.s)*problem.d\r\n && problem.d%2==1\r\n}\r\n\r\nstatic predicate MRProblemValid(problem:MRProblem)\r\n{\r\n MRProblemEarlyReject(problem)\r\n || MRProblemNeedsProbes(problem)\r\n}\r\n\r\n//- The algorithm describes a \"WitnessLoop\" as one of the following.\r\n//- Our \"MRProbe\" is evidence of having done one of these.\r\n//- It captures a, plus the fact that we have either:\r\n//- one x value x==1 or x==n-1 (\"then do next WitnessLoop\")\r\n//- or\r\n//- <=s values, each the square-mod-n of the previous,\r\n//- with no intermediate values equal to 1, and\r\n//- with the last one equal to n-1.\r\n//-\r\n//- pick a random integer a in the range [2, n - 2]\r\n//- x := a^d mod n\r\n//- if x = 1 or x = n - 1 then do next WitnessLoop\r\n//- repeat s - 1 times:\r\n//- x := x^2 mod n\r\n//- if x = 1 then return composite\r\n//- if x = n - 1 then do next WitnessLoop\r\n//- return composite\r\n\r\ndatatype MRProbe = MRProbe_c(\r\n a:nat,\r\n squares:seq)\r\n\r\nstatic predicate MRProbeInit(problem:MRProblem, probe:MRProbe)\r\n requires MRProblemNeedsProbes(problem);\r\n requires 0 < |probe.squares|;\r\n{\r\n probe.squares[0] == power(probe.a,problem.d) % problem.n\r\n}\r\n\r\nstatic predicate MRProbeChain(problem:MRProblem, probe:MRProbe, i:nat)\r\n requires MRProblemNeedsProbes(problem);\r\n requires 0 < i < |probe.squares|;\r\n{\r\n probe.squares[i]==power(probe.squares[i-1], 2) % problem.n\r\n}\r\n\r\n//- If problem.s == 0, then \r\nstatic predicate MRProbeValid(problem:MRProblem, probe:MRProbe)\r\n{\r\n MRProblemNeedsProbes(problem)\r\n && 0<|probe.squares|\r\n \r\n \r\n \r\n && MRProbeInit(problem,probe)\r\n && (forall i:int ::\r\n (0 MRProbeChain(problem, probe, i)))\r\n && (forall i:int ::\r\n (0 probe.squares[i]!=1))\r\n}\r\n\r\nstatic function MRProbeLimit(problem:MRProblem) : int\r\n{\r\n if (problem.s==0) then 1 else problem.s\r\n}\r\n\r\nstatic predicate MRProbeSucceeds(problem:MRProblem, probe:MRProbe)\r\n requires MRProblemNeedsProbes(problem);\r\n{\r\n MRProbeValid(problem, probe)\r\n //- probe length: no more than s trials.\r\n \r\n && 0 < |probe.squares| <= MRProbeLimit(problem)\r\n //- probe structure: two early successes, or stop if we see an n-1\r\n && (\r\n probe.squares==[1]\r\n || probe.squares==[problem.n-1]\r\n || probe.squares[|probe.squares|-1]==problem.n-1\r\n )\r\n}\r\n\r\nstatic predicate MRProbeFails(problem:MRProblem, probe:MRProbe)\r\n requires MRProblemNeedsProbes(problem);\r\n{\r\n MRProbeValid(problem, probe)\r\n //- probe length: terminates after s trials, or if we found a 1.\r\n && (|probe.squares| == MRProbeLimit(problem)\r\n || (0 < |probe.squares|\r\n && probe.squares[|probe.squares|-1] == 1))\r\n //- probe structure: not one of the success cases\r\n && (\r\n probe.squares!=[1]\r\n && probe.squares!=[problem.n-1]\r\n && probe.squares[|probe.squares|-1]!=problem.n-1\r\n )\r\n}\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nstatic predicate MillerRabinSpecFails(problem:MRProblem, probes:seq)\r\n //- last probe fails\r\n //- didn't probe more than problem strength requires\r\n{\r\n \r\n MRProblemEarlyReject(problem)\r\n ||\r\n (\r\n MRProblemNeedsProbes(problem)\r\n && (\r\n 1 <= |probes| <= problem.strength\r\n && (forall i :: (0 <= i < |probes|-1 ==> MRProbeSucceeds(problem, probes[i])))\r\n && MRProbeFails(problem, probes[|probes|-1])\r\n )\r\n )\r\n}\r\n\r\nstatic predicate MillerRabinSpecSucceeds(problem:MRProblem, probes:seq)\r\n //- all probes succeed\r\n //- probed exactly as many times as problem strength requires\r\n{\r\n MRProblemNeedsProbes(problem)\r\n && problem.n%2==1\r\n && problem.n>3\r\n && |probes| == problem.strength\r\n && (forall i :: 0 <= i < |probes| ==> MRProbeSucceeds(problem, probes[i]))\r\n}\r\n\r\nstatic predicate MillerRabinSpecValid(problem:MRProblem, probes:seq, result:bool)\r\n{\r\n (MillerRabinSpecSucceeds(problem, probes) && result)\r\n || (MillerRabinSpecFails(problem, probes) && !result)\r\n}\r\n\r\nstatic predicate IsProbablyPrime(n:nat,strength:nat)\r\n\r\nstatic lemma {:axiom} MillerRabinSpec(problem:MRProblem, probes:seq)\r\n requires MRProblemValid(problem);\r\n requires MillerRabinSpecValid(problem, probes, true);\r\n ensures IsProbablyPrime(problem.n, problem.strength);\r\n\r\n\r\n\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/MultiplicativeInverse.i.dfy", "content": "include \"RSASpec.s.dfy\"\r\ninclude \"../Hash/Digest.i.dfy\"\r\ninclude \"../../BigNum/BigNum.i.dfy\"\r\ninclude \"../../BigNum/BigNatDiv.i.dfy\"\r\ninclude \"../../BigNum/BigNatMod.i.dfy\"\r\ninclude \"Extended_GCD.i.dfy\"\r\ninclude \"KeyGen.i.dfy\"\r\ninclude \"BlockEncoding.i.dfy\"\r\ninclude \"KeyImpl.i.dfy\"\r\ninclude \"../../FatNat/BigNatToFatNatAdaptor.i.dfy\"\r\ninclude \"../../FatNat/FatNatMod.i.dfy\"\r\n\r\n\r\nstatic function K(x:seq) : int\r\n requires IsWordSeq(x);\r\n{\r\n BEWordSeqToInt(x)\r\n}\r\n\r\n\r\nlemma lemma_MultiplicativeInverse(phi:seq, e:seq, d:seq, k_num:int, d_num:int, gcd:int)\r\n requires IsWordSeq(phi);\r\n requires IsWordSeq(e);\r\n requires IsWordSeq(d);\r\n requires gcd == K(phi)*k_num + K(e)*d_num;\r\n requires 1 == gcd;\r\n requires 0 <= K(e);\r\n requires 0 <= 1 < K(phi);\r\n requires d_num <= K(phi);\r\n requires is_gcd(K(phi), K(e), gcd);\r\n requires K(d) == if d_num < 0 then d_num + K(phi) else d_num;\r\n \r\n ensures K(d) <= K(phi);\r\n ensures mul(K(d), K(e)) % K(phi) == 1;\r\n ensures is_gcd(K(phi),K(e),1);\r\n{\r\n calc {\r\n 1;\r\n \r\n gcd;\r\n K(phi)*k_num + K(e)*d_num + 0*K(phi);\r\n { lemma_mul_is_mul_boogie(0, K(phi)); }\r\n K(phi) * k_num + K(e) * d_num + mul(0, K(phi));\r\n }\r\n \r\n lemma_mul_basics_forall();\r\n assert K(phi) * k_num + K(e) * d_num == mul(0, K(phi)) + 1;\r\n lemma_fundamental_div_mod_converse(\r\n K(phi) * k_num + K(e) * d_num,\r\n K(phi),\r\n 0,\r\n 1);\r\n assert (K(phi) * k_num + K(e) * d_num) % K(phi) == 1;\r\n \r\n calc ==> {\r\n true;\r\n (K(phi) * k_num + K(e) * d_num) % K(phi) == 1;\r\n { lemma_mod_multiples_vanish(k_num, K(e) * d_num, K(phi)); }\r\n (K(e) * d_num) % K(phi) == 1;\r\n { lemma_mul_is_commutative_forall(); }\r\n (d_num * K(e)) % K(phi) == 1;\r\n }\r\n\r\n\r\n if (0 <= d_num)\r\n {\r\n calc {\r\n K(d);\r\n d_num;\r\n <= K(phi);\r\n }\r\n }\r\n else\r\n {\r\n \r\n calc {\r\n 1;\r\n (d_num*K(e)) % K(phi);\r\n { lemma_mod_multiples_vanish(K(e), d_num*K(e), K(phi)); }\r\n (K(phi)*K(e) + d_num*K(e)) % K(phi);\r\n { lemma_mul_is_commutative_forall(); }\r\n (d_num*K(e) + K(e) * K(phi)) % K(phi);\r\n { lemma_mul_is_commutative_forall(); }\r\n (d_num*K(e) + K(phi) * K(e)) % K(phi);\r\n { lemma_mul_is_distributive_forall(); }\r\n ((d_num + K(phi)) * K(e)) % K(phi);\r\n//- (FIV(d_prime)*K(e)) % K(phi);\r\n (K(d)*K(e)) % K(phi);\r\n }\r\n \r\n//- assert WellformedFatInt(d_prime);\r\n \r\n calc {\r\n K(d);\r\n//- FIV(d_prime);\r\n d_num+K(phi);\r\n <= K(phi);\r\n }\r\n }\r\n}\r\n\r\nmethod {:timeLimitMultiplier 3} MultiplicativeInverse(phi:array, e:array) returns (success:bool, d:array)\r\n requires WellformedFatNat(phi);\r\n requires 1 WellformedFatNat(d);\r\n ensures success ==> J(d) <= J(phi);\r\n ensures success ==> mul(J(d), J(e)) % J(phi) == 1;\r\n ensures success <==> is_gcd(J(phi),J(e),1);\r\n{\r\n//- lemma_frumpy_is_modest(phi);\r\n//- lemma_frumpy_is_modest(e);\r\n ghost var phi_seq := phi[..];\r\n ghost var phi_v := K(phi_seq);\r\n ghost var e_seq := e[..];\r\n ghost var e_v := K(e_seq);\r\n assert IsWordSeq(e_seq);\r\n var k_num:FatInt,d_num:FatInt := Extended_gcd(phi,e);\r\n var k_ref := k_num.value; //- do something real to k_num.value so dafnycc realizes it's allocated\r\n var d_ref := d_num.value; //- do something real to d_num.value so dafnycc realizes it's allocated\r\n\r\n ghost var k_num_v := FIV(k_num);\r\n ghost var d_num_v := FIV(d_num);\r\n//- ghost var k_num_s := k_num.value[..];\r\n\r\n assert WellformedFatInt(k_num);\r\n assert WellformedFatInt(d_num);\r\n \r\n var phik:FatInt := FatIntMul(FatInt_ctor(false, phi),k_num);\r\n var phik_ref := phik.value; //- do something real to phik.value so dafnycc realizes it's allocated\r\n ghost var phik_v := FIV(phik);\r\n assert phi_seq==phi[..]; //- OBSERVE array\r\n var ed:FatInt := FatIntMul(FatInt_ctor(false, e),d_num);\r\n var ed_ref := ed.value; //- do something real to ed.value so dafnycc realizes it's allocated\r\n assert phi_seq==phi[..]; //- OBSERVE array\r\n ghost var ed_v := FIV(ed);\r\n var gcd:FatInt := FatIntAdd(phik,ed);\r\n var gcd_ref := gcd.value; //- do something real to gcd.value so dafnycc realizes it's allocated\r\n assert phi_seq==phi[..]; //- OBSERVE array\r\n ghost var gcd_v := FIV(gcd);\r\n calc {\r\n gcd_v;\r\n phik_v+ed_v;\r\n phi_v*k_num_v + e_v*d_num_v;\r\n }\r\n assert WellformedFatInt(k_num);\r\n \r\n lemma_2toX();\r\n var one := MakeSmallLiteralFatInt(1);\r\n var one_ref := one.value; //- do something real to one.value so dafnycc realizes it's allocated\r\n var sane_gcd:bool := FatIntEq(gcd, one);\r\n assert WellformedFatInt(k_num);\r\n if (sane_gcd)\r\n {\r\n success := true;\r\n }\r\n else\r\n {\r\n success := false;\r\n }\r\n\r\n if (success)\r\n {\r\n if (!d_num.negate)\r\n {\r\n d := d_num.value;\r\n assert WellformedFatNat(d);\r\n//- assert phi_seq==phi[..]; //- OBSERVE array\r\n }\r\n else\r\n {\r\n var d_prime:FatInt := FatIntAdd(d_num, FatInt_ctor(false, phi));\r\n var dprime_ref := d_prime.value; //- do something real to d_prime.value so dafnycc realizes it's allocated\r\n//- assert phi_seq==phi[..]; //- OBSERVE array\r\n assert 0<=FIV(d_prime);\r\n d := d_prime.value;\r\n assert FIV(d_prime) == J(d);\r\n assert WellformedFatNat(d);\r\n }\r\n\r\n assert FIV(gcd)==gcd_v==phi_v*k_num_v + e_v*d_num_v;\r\n assert phi_seq==phi[..]; //- OBSERVE array\r\n assert phi_v==K(phi_seq);\r\n assert e_v==K(e[..]);\r\n assert k_num_v==FIV(k_num);\r\n assert d_num_v==FIV(d_num);\r\n assert e_seq==e[..];\r\n lemma_MultiplicativeInverse(phi[..], e[..], d[..], FIV(k_num), FIV(d_num), FIV(gcd));\r\n calc {\r\n mul(J(d), J(e)) % J(phi);\r\n mul(K(d[..]), K(e[..])) % K(phi[..]);\r\n 1;\r\n }\r\n calc ==> {\r\n true;\r\n is_gcd(K(phi[..]),K(e[..]),1);\r\n is_gcd(J(phi),J(e),1);\r\n }\r\n }\r\n else\r\n {\r\n //- dafnycc: initialize variables\r\n d := e;\r\n assert WellformedFatNat(d);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/OAEP.i.dfy", "content": "include \"OAEP.s.dfy\"\r\ninclude \"../../Math/power.i.dfy\"\r\ninclude \"../../Math/power2.i.dfy\"\r\ninclude \"../../Math/round.i.dfy\"\r\ninclude \"../../Math/bit_vector_lemmas_premium.i.dfy\"\r\ninclude \"../../Util/integer_sequences_premium.i.dfy\"\r\n\r\nstatic function SHA256_BytesToBytes_premium(M:seq) : seq\r\n requires IsByteSeq(M);\r\n requires |M| < power2(61) || |BEByteSeqToBitSeq(M)| < power2(64);\r\n\r\n ensures IsBitSeq(BEByteSeqToBitSeq(M));\r\n ensures |BEByteSeqToBitSeq(M)| < power2(64);\r\n\r\n ensures SHA256_BytesToBytes_premium(M) == SHA256_BytesToBytes(M);\r\n ensures IsByteSeqOfLen(SHA256_BytesToBytes(M), hLen());\r\n{\r\n calc {\r\n |M| < power2(61);\r\n ==> 8*|M| < 8*power2(61);\r\n ==> { lemma_2toX(); lemma_power2_add8(56); } 8*|M| < power2(64);\r\n ==> |BEByteSeqToBitSeq_premium(M)| < power2(64);\r\n }\r\n BEWordSeqToByteSeq_premium(SHA256(BEByteSeqToBitSeq_premium(M)))\r\n}\r\n\r\nstatic function ByteSeqXor_premium(X:seq, Y:seq) : seq\r\n requires IsByteSeq(X);\r\n requires IsByteSeq(Y);\r\n requires |X| == |Y|;\r\n\r\n ensures |ByteSeqXor_premium(X, Y)| == |X|;\r\n ensures IsByteSeq(ByteSeqXor_premium(X, Y));\r\n ensures ByteSeqXor_premium(X, Y) == ByteSeqXor(X, Y);\r\n{\r\n if X == [] || Y == [] then\r\n []\r\n else\r\n lemma_power2_strictly_increases(8, 32);\r\n lemma_2toX();\r\n lemma_xor_bytes_premium(X[0], Y[0]);\r\n [BitwiseXor(X[0], Y[0])] + ByteSeqXor_premium(X[1..], Y[1..])\r\n}\r\n\r\nstatic function I2OSP_premium(x:int, xLen:int) : seq\r\n requires 0 <= xLen;\r\n requires 0 <= x < power(power2(8), xLen);\r\n\r\n ensures IsByteSeq(I2OSP_premium(x, xLen));\r\n ensures I2OSP_premium(x, xLen) == I2OSP(x, xLen);\r\n ensures |I2OSP_premium(x, xLen)| == xLen;\r\n{\r\n lemma_2toX();\r\n BEIntToDigitSeq_premium(power2(8), xLen, x)\r\n}\r\n\r\nstatic function OS2IP_premium(X:seq) : int\r\n requires IsByteSeq(X);\r\n\r\n ensures OS2IP_premium(X) == OS2IP(X);\r\n ensures 0 <= OS2IP_premium(X) < power(power2(8), |X|);\r\n{\r\n lemma_2toX();\r\n BEDigitSeqToInt_premium(power2(8), X)\r\n}\r\n\r\nstatic predicate MGF1_step_requirements_simplified(seed:seq, counter:nat)\r\n ensures MGF1_step_requirements_simplified(seed, counter) ==> MGF1_step_requirements(seed, counter);\r\n{\r\n if Word32(counter) && IsByteSeq(seed) && |seed| < power2(60) then\r\n Lemma_MGF1_step_requirements_simplified_imply_MGF1_step_requirements(seed, counter);\r\n true\r\n else\r\n false\r\n}\r\n\r\nstatic lemma Lemma_MGF1_step_requirements_simplified_imply_MGF1_step_requirements(seed:seq, counter:nat)\r\n requires IsByteSeq(seed);\r\n requires |seed| < power2(60);\r\n requires Word32(counter);\r\n ensures MGF1_step_requirements(seed, counter);\r\n{\r\n calc {\r\n counter;\r\n < { lemma_power2_unfolding(8, 4); lemma_mul_is_mul_boogie(8, 4); } power(power2(8), 4);\r\n }\r\n assert IsByteSeq(I2OSP_premium(counter, 4));\r\n assert IsBitSeq(BEByteSeqToBitSeq_premium(seed + I2OSP_premium(counter, 4)));\r\n\r\n calc {\r\n |BEByteSeqToBitSeq_premium(seed + I2OSP_premium(counter, 4))|;\r\n |seed + I2OSP_premium(counter, 4)| * 8;\r\n == |seed| * 8 + |I2OSP_premium(counter, 4)| * 8;\r\n <= |seed| * 8 + 4 * 8;\r\n <= |seed| * 8 + 32;\r\n < power2(60) * 8 + 32;\r\n < { lemma_2toX(); } power2(64);\r\n }\r\n\r\n assert |BEByteSeqToBitSeq(seed + I2OSP_premium(counter, 4))| < power2(64);\r\n}\r\n\r\nstatic function MGF1_step_premium(seed:seq, counter:nat) : seq\r\n requires IsByteSeq(seed);\r\n requires |seed| < power2(60);\r\n requires Word32(counter);\r\n ensures MGF1_step_requirements(seed, counter);\r\n ensures MGF1_step_premium(seed, counter) == MGF1_step(seed, counter);\r\n ensures IsByteSeqOfLen(MGF1_step_premium(seed, counter), hLen());\r\n{\r\n assert MGF1_step_requirements_simplified(seed, counter);\r\n var C := I2OSP_premium(counter, 4);\r\n SHA256_BytesToBytes_premium(seed + C)\r\n}\r\n\r\nstatic function MGF1_prefix_premium(seed:seq, counter:nat) : seq\r\n requires IsByteSeq(seed);\r\n requires |seed| < power2(60);\r\n requires Word32(counter);\r\n\r\n ensures forall j :: 0 <= j < counter ==> MGF1_step_requirements(seed, j);\r\n ensures MGF1_prefix_premium(seed, counter) == MGF1_prefix(seed, counter);\r\n ensures IsByteSeq(MGF1_prefix_premium(seed, counter));\r\n ensures |MGF1_prefix_premium(seed, counter)| == hLen() * counter;\r\n\r\n decreases counter;\r\n{\r\n assert forall j :: 0 <= j < counter ==> MGF1_step_requirements_simplified(seed, j);\r\n if counter == 0 then\r\n calc {\r\n |[]|;\r\n 32 * 0;\r\n { lemma_mul_is_mul_boogie(32, 0); }\r\n hLen() * counter;\r\n }\r\n []\r\n else\r\n calc {\r\n |MGF1_prefix_premium(seed, counter-1) + MGF1_step_premium(seed, counter-1)|;\r\n |MGF1_prefix_premium(seed, counter-1)| + |MGF1_step_premium(seed, counter-1)|;\r\n hLen() * (counter-1) + hLen();\r\n hLen() * (counter-1) + hLen() * 1;\r\n { lemma_mul_is_distributive_add(hLen(), counter-1, 1); lemma_mul_is_mul_boogie(hLen(), 1); }\r\n hLen() * (counter-1+1);\r\n hLen() * counter;\r\n }\r\n MGF1_prefix_premium(seed, counter-1) + MGF1_step_premium(seed, counter-1)\r\n}\r\n\r\nstatic function MGF1_premium(seed:seq, maskLen:int) : seq\r\n requires IsByteSeq(seed);\r\n requires |seed| < power2(60);\r\n requires Word32(maskLen);\r\n\r\n ensures 0 <= maskLen <= power2(32) * hLen();\r\n ensures var counter := DivideRoundingUp(maskLen, hLen());\r\n counter >= 0 &&\r\n (forall j :: 0 <= j < counter ==> MGF1_step_requirements(seed, j)) &&\r\n |MGF1_prefix(seed, counter)| >= maskLen;\r\n\r\n ensures MGF1_premium(seed, maskLen) == MGF1(seed, maskLen);\r\n ensures IsByteSeqOfLen(MGF1_premium(seed, maskLen), maskLen);\r\n{\r\n calc {\r\n maskLen;\r\n < power2(32);\r\n == { lemma_2toX(); } 0x100000000;\r\n < 0x100000000 * 32;\r\n == { lemma_2toX(); } power2(32) * 32;\r\n == { lemma_mul_is_mul_boogie(power2(32), hLen()); } power2(32) * hLen();\r\n }\r\n\r\n var counter := DivideRoundingUp_premium(maskLen, hLen());\r\n lemma_mul_is_commutative(hLen(), counter);\r\n MGF1_prefix_premium(seed, counter)[..maskLen]\r\n}\r\n\r\nstatic function RSAEP_premium(pubkey:RSAPubKeySpec, m:int) : int\r\n requires WellformedRSAPubKeySpec(pubkey);\r\n requires 0 <= m < pubkey.n;\r\n\r\n ensures 0 <= RSAEP_premium(pubkey, m) < pubkey.n;\r\n{\r\n lemma_mod_properties();\r\n power(m, pubkey.e) % pubkey.n\r\n}\r\n\r\nstatic function RSAES_OAEP_ENCRYPT_premium(pubkey:RSAPubKeySpec, M:seq, L:seq, seed:seq) : seq\r\n requires WellformedRSAPubKeySpec(pubkey);\r\n requires IsByteSeq(M);\r\n requires IsByteSeq(L);\r\n requires IsByteSeq(seed);\r\n requires |M| <= pubkey.size - 2 * hLen() - 2;\r\n requires |seed| == hLen();\r\n requires Word32(pubkey.size);\r\n\r\n requires Word32(pubkey.size);\r\n requires |L| < power2(61);\r\n\r\n ensures IsBitSeq(BEByteSeqToBitSeq(L)) &&\r\n |BEByteSeqToBitSeq(L)| < power2(64) &&\r\n var lHash := SHA256_BytesToBytes(L);\r\n var k := pubkey.size;\r\n var PS := RepeatDigit(0, k - |M| - 2*hLen() - 2);\r\n var DB := lHash + PS + [0x01] + M;\r\n IsByteSeq(DB) &&\r\n var maskLen := pubkey.size - hLen() - 1;\r\n var counter := DivideRoundingUp(maskLen, hLen());\r\n 0 <= maskLen <= power2(32) * hLen() &&\r\n counter >= 0 &&\r\n (forall j :: 0 <= j < counter ==> MGF1_step_requirements(seed, j)) &&\r\n |MGF1_prefix(seed, counter)| >= maskLen &&\r\n var dbMask := MGF1(seed, k - hLen() - 1);\r\n IsByteSeq(DB) &&\r\n IsByteSeq(dbMask) &&\r\n var maskedDB := ByteSeqXor(DB, dbMask);\r\n var maskLen2 := hLen();\r\n var counter2 := DivideRoundingUp(maskLen2, hLen());\r\n 0 <= maskLen2 <= power2(32) * hLen() &&\r\n counter2 >= 0 &&\r\n (forall j :: 0 <= j < counter2 ==> MGF1_step_requirements(maskedDB, j)) &&\r\n |MGF1_prefix(maskedDB, counter2)| >= maskLen2 &&\r\n var seedMask := MGF1(maskedDB, hLen());\r\n IsByteSeq(seedMask) &&\r\n var maskedSeed := ByteSeqXor(seed, seedMask);\r\n var EM := [0x00] + maskedSeed + maskedDB;\r\n IsByteSeq(EM) &&\r\n var m := OS2IP(EM);\r\n 0 <= m < pubkey.n &&\r\n var c := RSAEP(pubkey, m);\r\n 0 <= c < power(power2(8), pubkey.size);\r\n\r\n ensures RSAES_OAEP_ENCRYPT_premium(pubkey, M, L, seed) == RSAES_OAEP_ENCRYPT(pubkey, M, L, seed);\r\n{\r\n calc {\r\n |BEByteSeqToBitSeq_premium(L)|;\r\n 8*|L|;\r\n < 8*power2(61);\r\n { lemma_2toX(); lemma_power2_add8(56); }\r\n power2(64);\r\n }\r\n var lHash := SHA256_BytesToBytes_premium(L);\r\n var k := pubkey.size;\r\n var PS := RepeatDigit_premium(0, k - |M| - 2*hLen() - 2);\r\n var DB := lHash + PS + [0x01] + M;\r\n calc {\r\n 0x01;\r\n < { lemma_2toX(); } power2(8);\r\n }\r\n assert IsByteSeq(DB);\r\n var maskLen := pubkey.size - hLen() - 1;\r\n var counter := DivideRoundingUp_premium(maskLen, hLen());\r\n calc {\r\n maskLen;\r\n < power2(32) - hLen() - 1;\r\n == power2(32) - 33;\r\n == { lemma_2toX(); } 0x100000000 - 33;\r\n < 0x100000000 * 32;\r\n == { lemma_2toX(); } power2(32) * 32;\r\n == { lemma_mul_is_mul_boogie(power2(32), hLen()); } power2(32) * hLen();\r\n }\r\n calc {\r\n |seed|;\r\n hLen();\r\n < { lemma_2toX(); } power2(60);\r\n }\r\n var dbMask := MGF1_premium(seed, k - hLen() - 1);\r\n assert IsByteSeq(DB);\r\n assert IsByteSeq(dbMask);\r\n var maskedDB := ByteSeqXor_premium(DB, dbMask);\r\n calc {\r\n |maskedDB|;\r\n k - hLen() - 1;\r\n < power2(32);\r\n < { lemma_power2_strictly_increases(32, 60); } power2(60);\r\n }\r\n var seedMask := MGF1_premium(maskedDB, hLen());\r\n assert IsByteSeq(seedMask);\r\n var maskedSeed := ByteSeqXor_premium(seed, seedMask);\r\n var EM := [0x00] + maskedSeed + maskedDB;\r\n assert IsByteSeq(EM);\r\n var m := OS2IP_premium(EM);\r\n calc {\r\n m;\r\n == { lemma_LeadingZeros(power2(8), EM[1..], EM); }\r\n OS2IP_premium(EM[1..]);\r\n < power(power2(8), |EM|-1);\r\n == power(power2(8), k-1);\r\n == { lemma_power2_unfolding(8, k-1); lemma_mul_is_mul_boogie(8, k-1); } power2(8*(k-1));\r\n <= pubkey.n;\r\n }\r\n var c := RSAEP_premium(pubkey, m);\r\n calc {\r\n c;\r\n < pubkey.n;\r\n <= power2(8*k);\r\n == { lemma_power2_unfolding(8, k); lemma_mul_is_mul_boogie(8, k); } power(power2(8), k);\r\n }\r\n\r\n RSAES_OAEP_ENCRYPT(pubkey, M, L, seed)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/OAEP.s.dfy", "content": "include \"../../Math/power.s.dfy\"\r\ninclude \"../../Math/round.s.dfy\"\r\ninclude \"../../Util/be_sequences.s.dfy\"\r\ninclude \"../../../Drivers/TPM/tpm-device.s.dfy\"\r\ninclude \"RSASpec.s.dfy\"\r\n\r\n//-\r\n//- The spec in this file is based on RFC 3447, which can be found at\r\n//- http://www.ietf.org/rfc/rfc3447.txt\r\n//-\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- High-level functions for external use\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\ndatatype OAEPDecryptionResult = OAEPDecryptionResult_Success(M:seq) |\r\n OAEPDecryptionResult_Undecryptable();\r\n\r\nstatic predicate {:autoReq} OAEPEncryptionRelation(pubkey:RSAPubKeySpec, M:seq, EM:seq, old_TPM:TPM_struct, new_TPM:TPM_struct)\r\n{\r\n new_TPM.random_index - old_TPM.random_index == hLen() &&\r\n EM == RSAES_OAEP_ENCRYPT(pubkey, M, [] /* use empty string as label */, TPM_random_bytes(old_TPM.random_index, new_TPM.random_index))\r\n}\r\n\r\nstatic predicate {:autoReq} OAEPDecryptionRelation(key:RSAKeyPairSpec, C:seq, decryption_result:OAEPDecryptionResult)\r\n{\r\n RSAES_OAEP_DECRYPT(key, C, [] /* use empty string as label */) == decryption_result\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- Helper functions\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function {:autoReq} SHA256_BytesToBytes(M:seq) : seq\r\n requires IsByteSeq(M);\r\n{\r\n BEWordSeqToByteSeq(SHA256(BEByteSeqToBitSeq(M)))\r\n}\r\n\r\nstatic function ByteSeqXor(X:seq, Y:seq) : seq\r\n requires IsByteSeq(X);\r\n requires IsByteSeq(Y);\r\n{\r\n if X == [] || Y == [] then\r\n []\r\n else if Word32(X[0]) && Word32(Y[0]) then\r\n [BitwiseXor(X[0], Y[0])] + ByteSeqXor(X[1..], Y[1..])\r\n else\r\n [0] + ByteSeqXor(X[1..], Y[1..])\r\n}\r\n\r\nstatic function FindFirstNonzeroByte(s:seq, minpos:nat) : int\r\n ensures FindFirstNonzeroByte(s, minpos) >= minpos;\r\n decreases |s| - minpos;\r\n{\r\n if minpos >= |s| || s[minpos] != 0 then\r\n minpos\r\n else\r\n FindFirstNonzeroByte(s, minpos + 1)\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- Definitions from RFC 3447 section 2\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function hLen() : int\r\n{\r\n 32 \r\n}\r\n\r\nstatic function sLen() : int\r\n{\r\n hLen()\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- I2OSP, OS2IP as defined in RFC 3447 section 4.1\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function I2OSP(x:int, xLen:int) : seq\r\n requires 0 <= xLen;\r\n requires 0 <= x < power(power2(8), xLen);\r\n{\r\n BEIntToDigitSeq(power2(8), xLen, x)\r\n}\r\n\r\nstatic function OS2IP(X:seq) : int\r\n requires IsByteSeq(X);\r\n{\r\n BEByteSeqToInt(X)\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- RSAEP, RSADP as defined in RFC 3447 section 5.1\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function RSAEP(pubkey:RSAPubKeySpec, m:int) : int\r\n requires WellformedRSAPubKeySpec(pubkey);\r\n requires 0 <= m < pubkey.n;\r\n{\r\n power(m, pubkey.e) % pubkey.n\r\n}\r\n\r\nstatic function RSADP(keypair:RSAKeyPairSpec, c:int) : int\r\n requires WellformedRSAKeyPairSpec(keypair);\r\n requires 0 <= c < keypair.pub.n;\r\n{\r\n power(c, keypair.d) % keypair.pub.n\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- RSASP1 as defined in RFC 3447 section 5.2\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function RSASP1(key:RSAKeyPairSpec, m:int) : int\r\n requires WellformedRSAKeyPairSpec(key);\r\n requires 0 <= m < key.pub.n;\r\n{\r\n power(m, key.d) % key.pub.n\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- MGF1 as defined in RFC 3447 section B.2.1\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic predicate MGF1_step_requirements(seed:seq, counter:nat)\r\n{\r\n 0 <= counter < power(power2(8), 4)\r\n && IsByteSeq(seed)\r\n && IsByteSeq(I2OSP(counter, 4))\r\n && IsBitSeq(BEByteSeqToBitSeq(seed + I2OSP(counter, 4)))\r\n && |BEByteSeqToBitSeq(seed + I2OSP(counter, 4))| < power2(64)\r\n}\r\n\r\nstatic function MGF1_step(seed:seq, counter:nat) : seq\r\n requires MGF1_step_requirements(seed, counter);\r\n{\r\n var C := I2OSP(counter, 4);\r\n SHA256_BytesToBytes(seed + C)\r\n}\r\n\r\nstatic function MGF1_prefix(seed:seq, counter:nat) : seq\r\n requires forall j :: 0 <= j < counter ==> MGF1_step_requirements(seed, j);\r\n decreases counter;\r\n{\r\n if counter == 0 then [] else MGF1_prefix(seed, counter-1) + MGF1_step(seed, counter-1)\r\n}\r\n\r\nstatic function MGF1(seed:seq, maskLen:int) : seq\r\n requires 0 <= maskLen <= power2(32) * hLen();\r\n requires var counter := DivideRoundingUp(maskLen, hLen());\r\n counter >= 0 &&\r\n (forall j :: 0 <= j < counter ==> MGF1_step_requirements(seed, j)) &&\r\n |MGF1_prefix(seed, counter)| >= maskLen;\r\n{\r\n MGF1_prefix(seed, DivideRoundingUp(maskLen, hLen()))[..maskLen]\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- RSAES_OAEP_ENCRYPT as defined in RFC 3447 section 7.1.1\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function {:autoReq} RSAES_OAEP_ENCRYPT(pubkey:RSAPubKeySpec, M:seq, L:seq, seed:seq) : seq\r\n requires WellformedRSAPubKeySpec(pubkey);\r\n requires IsByteSeq(M);\r\n requires IsByteSeq(L);\r\n requires IsByteSeq(seed);\r\n requires |M| <= pubkey.size - 2 * hLen() - 2;\r\n requires |seed| == hLen();\r\n{\r\n var lHash := SHA256_BytesToBytes(L);\r\n var k := pubkey.size;\r\n var PS := RepeatDigit(0, k - |M| - 2*hLen() - 2);\r\n var DB := lHash + PS + [0x01] + M;\r\n var dbMask := MGF1(seed, k - hLen() - 1);\r\n var maskedDB := ByteSeqXor(DB, dbMask);\r\n var seedMask := MGF1(maskedDB, hLen());\r\n var maskedSeed := ByteSeqXor(seed, seedMask);\r\n var EM := [0x00] + maskedSeed + maskedDB;\r\n var m := OS2IP(EM);\r\n var c := RSAEP(pubkey, m);\r\n var C := I2OSP(c, k);\r\n C\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- RSAES-OAEP-DECRYPT as defined in RFC 3447 section 7.1.2\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function {:autoReq} RSAES_OAEP_DECRYPT(key:RSAKeyPairSpec, C:seq, L:seq) : OAEPDecryptionResult\r\n requires WellformedRSAKeyPairSpec(key);\r\n requires IsByteSeq(C);\r\n requires IsByteSeq(L);\r\n{\r\n var k := key.pub.size;\r\n if |C| != k || k < 2*hLen() + 2 then\r\n OAEPDecryptionResult_Undecryptable()\r\n else\r\n var c := OS2IP(C);\r\n var m := RSADP(key, c);\r\n var EM := I2OSP(m, k);\r\n var lHash := SHA256_BytesToBytes(L);\r\n if |EM| != k then\r\n OAEPDecryptionResult_Undecryptable()\r\n else\r\n var Y := EM[0];\r\n var maskedSeed := EM[1..hLen()+1];\r\n var maskedDB := EM[hLen()+1..k];\r\n var seedMask := MGF1(maskedDB, hLen());\r\n var seed := ByteSeqXor(maskedSeed, seedMask);\r\n var dbMask := MGF1(seed, k - hLen() - 1);\r\n var DB := ByteSeqXor(maskedDB, dbMask);\r\n if |DB| < hLen() then\r\n OAEPDecryptionResult_Undecryptable()\r\n else\r\n var lHash' := DB[..hLen()];\r\n var firstNonZero := FindFirstNonzeroByte(DB, hLen());\r\n if lHash' != lHash || firstNonZero >= |DB| || DB[firstNonZero] != 0x01 || Y != 0 then\r\n OAEPDecryptionResult_Undecryptable()\r\n else\r\n OAEPDecryptionResult_Success(DB[firstNonZero+1..])\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/PSS.s.dfy", "content": "include \"OAEP.s.dfy\"\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- High-level functions for external use\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic predicate {:autoReq} PSSSignatureRelation(key:RSAKeyPairSpec, M:seq, S:seq, old_TPM:TPM_struct, new_TPM:TPM_struct)\r\n{\r\n new_TPM.random_index - old_TPM.random_index == sLen() &&\r\n S == RSASSA_PSS_SIGN(key, M, TPM_random_bytes(old_TPM.random_index, new_TPM.random_index))\r\n}\r\n\r\nstatic predicate {:autoReq} PSSVerificationRelation(pubkey:RSAPubKeySpec, M:seq, S:seq, verification_result:bool)\r\n{\r\n RSASSA_PSS_VERIFY(pubkey, M, S) == verification_result\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- Helper functions\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function CountBits(x:nat) : int\r\n{\r\n if x == 0 then 0 else 1 + CountBits(x/2)\r\n}\r\n\r\nstatic function ClearMSBs(s:seq, numZeroBits:int) : seq\r\n requires 0 <= numZeroBits <= 8;\r\n{\r\n if s == [] then\r\n s\r\n else\r\n s[0 := s[0] % power2(8 - numZeroBits)]\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- RSAVP1 as defined in RFC 3447 section 5.2\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function RSAVP1(pubkey:RSAPubKeySpec, s:int) : int\r\n requires WellformedRSAPubKeySpec(pubkey);\r\n requires 0 <= s < pubkey.n;\r\n{\r\n power(s, pubkey.e) % pubkey.n\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- RSASSA-PSS-SIGN as defined in RFC 3447 section 8.1.1\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function {:autoReq} RSASSA_PSS_SIGN(key:RSAKeyPairSpec, M:seq, salt:seq) : seq\r\n requires WellformedRSAKeyPairSpec(key);\r\n requires IsByteSeq(M);\r\n requires IsByteSeqOfLen(salt, sLen());\r\n{\r\n var modBits := CountBits(key.pub.n);\r\n var EM := EMSA_PSS_ENCODE(M, modBits - 1, salt);\r\n var m := OS2IP(EM);\r\n var s := RSASP1(key, m);\r\n var S := I2OSP(s, key.pub.size);\r\n S\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- RSASSA-RSS-VERIFY as defined in RFC 3447 section 8.1.2\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic predicate {:autoReq} RSASSA_PSS_VERIFY(pubkey:RSAPubKeySpec, M:seq, S:seq)\r\n requires WellformedRSAPubKeySpec(pubkey);\r\n requires IsByteSeq(M);\r\n requires IsByteSeq(S);\r\n{\r\n |S|==pubkey.size &&\r\n var s := OS2IP(S);\r\n 0 <= s < pubkey.n &&\r\n var m := RSAVP1(pubkey, s);\r\n var modBits := CountBits(pubkey.n);\r\n var emLen := DivideRoundingUp(modBits - 1, 8);\r\n emLen >= 0 &&\r\n 0 <= m < power(power2(8), emLen) &&\r\n var EM := I2OSP(m, emLen);\r\n EMSA_PSS_VERIFY(M, EM, modBits - 1)\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- EMSA-PSS-ENCODE as defined in RFC 3447 section 9.1.1\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function {:autoReq} EMSA_PSS_ENCODE(M:seq, emBits:int, salt:seq) : seq\r\n requires IsByteSeq(M);\r\n requires |M| * 8 >= emBits;\r\n requires IsByteSeqOfLen(salt, sLen());\r\n requires DivideRoundingUp(emBits, 8) >= hLen() + sLen() + 2;\r\n requires 8 * DivideRoundingUp(emBits, 8) - emBits <= 8;\r\n{\r\n var mHash := SHA256_BytesToBytes(M);\r\n var emLen := DivideRoundingUp(emBits, 8);\r\n var M' := RepeatDigit(0, 8) + mHash + salt;\r\n var H := SHA256_BytesToBytes(M');\r\n var PS := RepeatDigit(0, emLen - sLen() - hLen() - 2);\r\n var DB := PS + [0x01] + salt;\r\n var dbMask := MGF1(H, emLen - hLen() - 1);\r\n var maskedDB := ByteSeqXor(DB, dbMask);\r\n var nZeroBits := 8 * emLen - emBits;\r\n var maskedDB_reduced := ClearMSBs(maskedDB, nZeroBits);\r\n var EM := maskedDB_reduced + H + [0xbc];\r\n EM\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////\r\n//- EMSA-PSS-VERIFY as defined in RFC 3447 section 9.1.2\r\n//-////////////////////////////////////////////////////////////////////////\r\n\r\nstatic predicate {:autoReq} EMSA_PSS_VERIFY(M:seq, EM:seq, emBits:int)\r\n requires IsByteSeq(EM);\r\n requires IsByteSeq(M);\r\n{\r\n |M| < power2(61) &&\r\n var mHash := SHA256_BytesToBytes(M);\r\n var emLen := DivideRoundingUp(emBits, 8);\r\n emLen >= hLen() + sLen() + 2 &&\r\n |EM| >= emLen - 1 &&\r\n EM[|EM|-1] == 0xbc &&\r\n var maskedDB:seq := EM[.. emLen - hLen() - 1];\r\n var H := EM[emLen - hLen() - 1 .. emLen - 1];\r\n var nZeroBits := 8*emLen - emBits;\r\n |maskedDB| > 0 &&\r\n 8 - nZeroBits >= 0 &&\r\n maskedDB[0] < power2(8-nZeroBits) &&\r\n var dbMask := MGF1(H, emLen - hLen() - 1);\r\n var DB := ByteSeqXor(maskedDB, dbMask);\r\n var DB_reduced := ClearMSBs(DB, nZeroBits);\r\n |DB_reduced| > emLen - hLen() - sLen() - 2 &&\r\n DB_reduced[.. emLen - hLen() - sLen() - 2] == RepeatDigit(0, emLen - hLen() - sLen() - 2) &&\r\n DB_reduced[emLen - hLen() - sLen() - 2] == 0x01 &&\r\n |DB_reduced| >= sLen() &&\r\n var salt := DB_reduced[|DB_reduced| - sLen() ..];\r\n var M' := RepeatDigit(0, 8) + mHash + salt;\r\n var H' := SHA256_BytesToBytes(M');\r\n H == H'\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/RSA.i.dfy", "content": "include \"RSASpec.s.dfy\"\r\ninclude \"../Hash/Digest.i.dfy\"\r\ninclude \"../../BigNum/BigNum.i.dfy\"\r\ninclude \"../../BigNum/BigNatDiv.i.dfy\"\r\ninclude \"../../BigNum/BigNatMod.i.dfy\"\r\ninclude \"Extended_GCD.i.dfy\"\r\ninclude \"KeyGen.i.dfy\"\r\ninclude \"BlockEncoding.i.dfy\"\r\ninclude \"KeyImpl.i.dfy\"\r\ninclude \"../../FatNat/BigNatToFatNatAdaptor.i.dfy\"\r\ninclude \"../../FatNat/FatNatMod.i.dfy\"\r\ninclude \"../../FatNat/Transforms.i.dfy\"\r\ninclude \"../../FatNat/FatNatReciprocal.i.dfy\"\r\ninclude \"KeybitsLength.i.dfy\"\r\ninclude \"MultiplicativeInverse.i.dfy\"\r\n\r\nmethod ComputeKeySize(N:array) returns (k:nat)\r\n requires WellformedFatNat(N);\r\n requires 00)\r\n {\r\n calc {\r\n power2(8*(k-1));\r\n power2(8*k-8);\r\n <= {\r\n lemma_mod_remainder();\r\n assert 0 <= mod(bit_count-1,8);\r\n assert 8*k-8 <= 8*k - 8 + mod(bit_count-1,8);\r\n lemma_power2_increases(8*k-8, 8*k - 8 + mod(bit_count-1,8));\r\n }\r\n power2(8*k - 8 + mod(bit_count-1,8));\r\n power2(bit_count-1);\r\n <= J(N);\r\n }\r\n }\r\n\r\n calc {\r\n J(N);\r\n < power2(bit_count);\r\n power2(bit_count-1+1);\r\n power2(8*k - 8 + mod(bit_count-1,8) + 1);\r\n power2(8*k - 7 + mod(bit_count-1,8));\r\n <= {\r\n lemma_mod_remainder();\r\n assert mod(bit_count-1,8) < 8;\r\n lemma_power2_increases(8*k - 7 + mod(bit_count-1,8), 8*k);\r\n }\r\n power2(8*k);\r\n }\r\n}\r\n\r\nstatic predicate RSAKeyGenerationWorksheetValid_premium(keybits:int, worksheet:RSAKeyGenerationWorksheet)\r\n requires forall i :: 0 <= i < |worksheet.rows|\r\n ==> 0 < |worksheet.rows[i].P.rows|\r\n && 0 < |worksheet.rows[i].Q.rows|\r\n ;\r\n//- && 0 < |worksheet.rows[i].P.rows[|worksheet.rows[i].P.rows|-1].candidate.rows|\r\n//- && 0 < |worksheet.rows[i].Q.rows[|worksheet.rows[i].Q.rows|-1].candidate.rows|;\r\n{\r\n RSAKeyGenerationWorksheetValid(keybits, worksheet)\r\n}\r\n\r\nstatic predicate RSAKeyConsistentWithWorksheet_precondition(worksheet:RSAKeyGenerationWorksheet)\r\n{\r\n (forall i :: 0 <= i < |worksheet.rows|\r\n ==> PrimeGenerationWorksheetValid_precondition(worksheet.rows[i].P)\r\n && PrimeGenerationWorksheetValid_precondition(worksheet.rows[i].Q))\r\n}\r\n\r\nstatic predicate RSAKeyConsistentWithWorksheet_premium(requested_keybits:int, key:RSAKeyPairSpec, worksheet:RSAKeyGenerationWorksheet)\r\n requires RSAKeyConsistentWithWorksheet_precondition(worksheet);\r\n{\r\n RSAKeyConsistentWithWorksheet(requested_keybits, key, worksheet)\r\n}\r\n\r\nstatic predicate RSAKeyGenerationWorksheetSummaryValid_Impl(worksheet:RSAKeyGenerationWorksheet, last_accepted:bool)\r\n requires 0 < |worksheet.rows|;\r\n requires 0 < |worksheet.rows[|worksheet.rows|-1].P.rows|;\r\n requires 0 < |worksheet.rows[|worksheet.rows|-1].Q.rows|;\r\n{\r\n var final := worksheet.rows[|worksheet.rows|-1];\r\n worksheet.rows[|worksheet.rows|-1].accepted == last_accepted\r\n && 0 < |final.P.rows|\r\n && worksheet.p == PrimeGenerationOutput(final.P)\r\n && 0 < |final.Q.rows|\r\n && worksheet.q == PrimeGenerationOutput(final.Q)\r\n && worksheet.phi == (worksheet.p-1)*(worksheet.q-1)\r\n && worksheet.phi != 0\r\n && worksheet.n == worksheet.p*worksheet.q\r\n}\r\n\r\nstatic predicate RSAKeyGenerationWorksheetValid_Impl(keybits:int, worksheet:RSAKeyGenerationWorksheet, last_accepted:bool)\r\n requires RSAKeyConsistentWithWorksheet_precondition(worksheet);\r\n{\r\n (forall i :: 0 <= i < |worksheet.rows| ==> RSAKeyGenerationWorksheetRowValid(worksheet.keybits, worksheet.rows[i]))\r\n && (forall i :: 0 <= i < |worksheet.rows|-1 ==> !worksheet.rows[i].accepted)\r\n && (0<|worksheet.rows| ==> worksheet.rows[|worksheet.rows|-1].accepted == last_accepted)\r\n && (RSAKeyGenerationWorksheetConsumesRandoms(worksheet.rows) == worksheet.randoms)\r\n && (0<|worksheet.rows| ==> RSAKeyGenerationWorksheetSummaryValid_Impl(worksheet, last_accepted))\r\n}\r\n\r\nstatic function RSAKeyGenerationWorksheetAppend(worksheet:RSAKeyGenerationWorksheet, worksheet_row:RSAKeyGenerationWorksheetRow, last_accepted:bool) : RSAKeyGenerationWorksheet\r\n requires 0 < |worksheet_row.P.rows|;\r\n requires 0 < |worksheet_row.Q.rows|;\r\n requires RSAKeyConsistentWithWorksheet_precondition(worksheet);\r\n requires RSAKeyGenerationWorksheetValid_Impl(worksheet.keybits, worksheet, false);\r\n{\r\n RSAKeyGenerationWorksheet_c(\r\n worksheet.keybits,\r\n worksheet.rows + [worksheet_row],\r\n worksheet.randoms + worksheet_row.randoms,\r\n PrimeGenerationOutput(worksheet_row.P),\r\n PrimeGenerationOutput(worksheet_row.Q),\r\n (PrimeGenerationOutput(worksheet_row.P)-1)*(PrimeGenerationOutput(worksheet_row.Q)-1),\r\n PrimeGenerationOutput(worksheet_row.P)*PrimeGenerationOutput(worksheet_row.Q))\r\n}\r\n\r\nstatic lemma WorksheetAppend_lemma(worksheet:RSAKeyGenerationWorksheet, worksheet_row:RSAKeyGenerationWorksheetRow, last_accepted:bool, worksheet':RSAKeyGenerationWorksheet)\r\n requires RSAKeyConsistentWithWorksheet_precondition(worksheet);\r\n requires RSAKeyGenerationWorksheetValid_Impl(worksheet.keybits, worksheet, false);\r\n requires 0 < |worksheet_row.P.rows|;\r\n requires 0 < |worksheet_row.Q.rows|;\r\n requires worksheet' == RSAKeyGenerationWorksheetAppend(worksheet, worksheet_row, last_accepted);\r\n requires PrimeGenerationWorksheetValid_precondition(worksheet_row.P);\r\n requires PrimeGenerationWorksheetValid_precondition(worksheet_row.Q);\r\n requires RSAKeyGenerationWorksheetRowValid(worksheet'.keybits, worksheet_row);\r\n requires worksheet'.rows[|worksheet'.rows|-1].accepted == last_accepted;\r\n requires worksheet'.p == PrimeGenerationOutput(worksheet'.rows[|worksheet'.rows|-1].P);\r\n requires worksheet'.q == PrimeGenerationOutput(worksheet'.rows[|worksheet'.rows|-1].Q);\r\n requires worksheet'.phi == (worksheet'.p-1)*(worksheet'.q-1);\r\n requires worksheet'.phi != 0;\r\n requires worksheet'.n == worksheet'.p*worksheet'.q;\r\n ensures RSAKeyConsistentWithWorksheet_precondition(worksheet');\r\n ensures last_accepted ==> RSAKeyGenerationWorksheetValid_Impl(worksheet'.keybits, worksheet', last_accepted);\r\n ensures RSAKeyGenerationWorksheetConsumesRandoms(worksheet'.rows) == worksheet'.randoms;\r\n ensures 0 < |worksheet'.rows|;\r\n{\r\n}\r\n\r\nmethod RSAKeyGenSetup(keybits:nat) returns (e:array, halfbits:nat)\r\n requires 20, q:array, n:int)\r\n requires keybits <= 2*halfbits-2;\r\n requires WellformedFatNat(p);\r\n requires WellformedFatNat(q);\r\n requires n == J(p)*J(q);\r\n requires power2(halfbits-1) <= J(p);\r\n requires power2(halfbits-1) <= J(q);\r\n ensures power2(keybits) <= n;\r\n{\r\n calc {\r\n power2(keybits);\r\n <= { lemma_power2_increases(keybits, halfbits-1 + halfbits-1); }\r\n power2(halfbits-1 + halfbits-1);\r\n { lemma_power2_adds(halfbits-1, halfbits-1); }\r\n power2(halfbits-1) * power2(halfbits-1);\r\n <= { lemma_mul_inequality(power2(halfbits-1), J(p), power2(halfbits-1)); }\r\n J(p) * power2(halfbits-1);\r\n <= { lemma_mul_left_inequality(J(p), power2(halfbits-1), J(q)); }\r\n J(p) * J(q);\r\n n;\r\n }\r\n}\r\n\r\nlemma lemma_RSAKeyGen_2(keybits:nat, halfbits:nat, p:array, q:array, n:int, e:array, pMinus1:array, qMinus1:array, phi_n:array)\r\n requires keybits <= 2*halfbits-2;\r\n//- requires 3 < halfbits < power2(30);\r\n requires 3 < halfbits < power2(32);\r\n requires 20, halfbits:nat, one:array)\r\n reads one;\r\n reads e;\r\n reads this`TPM;\r\n reads this`IoMemPerm;\r\n{\r\n true\r\n && (20,\r\n started:bool,\r\n p:array,\r\n q:array,\r\n d:array,\r\n n:int,\r\n worksheet:RSAKeyGenerationWorksheet)\r\n requires WellformedFatNat(e);\r\n reads e;\r\n reads p;\r\n reads d;\r\n reads q;\r\n{\r\n true\r\n && (WellformedFatNat(p))\r\n && (WellformedFatNat(q))\r\n && (WellformedFatNat(d))\r\n && (n == J(p)*J(q))\r\n && (n != 0)\r\n && (power2(keybits) <= n)\r\n && (((J(p)-1)*(J(q)-1)) != 0)\r\n && (mul(J(d), J(e)) % ((J(p)-1)*(J(q)-1)) == 1)\r\n && (started)\r\n && (worksheet.p == J(p))\r\n && (worksheet.q == J(q))\r\n}\r\n\r\npredicate RSAKeyGenLoop_invariant(\r\n keybits:nat,\r\n e:array,\r\n started:bool,\r\n success:bool,\r\n p:array,\r\n q:array,\r\n d:array,\r\n n:int,\r\n worksheet:RSAKeyGenerationWorksheet,\r\n oldTPM:TPM_struct,\r\n curTPM:TPM_struct)\r\n requires WellformedFatNat(e);\r\n reads e;\r\n reads p;\r\n reads q;\r\n reads d;\r\n{\r\n true\r\n && (success ==> RSAKeyGenLoop_success_properties(keybits, e, started, p, q, d, n, worksheet))\r\n && (started ==> 0 < |worksheet.rows|)\r\n && (RSAKeyConsistentWithWorksheet_precondition(worksheet))\r\n && (RSAKeyGenerationWorksheetValid_Impl(keybits, worksheet, success))\r\n && (worksheet.keybits == keybits)\r\n && (RSAKeyGenerationWorksheetConsumesRandoms(worksheet.rows) == worksheet.randoms)\r\n && (TPMs_match_except_for_randoms(oldTPM, curTPM))\r\n && (oldTPM.random_index <= curTPM.random_index)\r\n && (curTPM.random_index == oldTPM.random_index + |worksheet.randoms|)\r\n && (worksheet.randoms == TPM_random_bytes_premium(oldTPM.random_index, curTPM.random_index))\r\n}\r\n\r\nmethod {:timeLimitMultiplier 2} RSAKeyGenLoop_step(\r\n keybits:nat,\r\n e:array,\r\n halfbits:nat,\r\n one:array,\r\n ghost started:bool,\r\n p:array,\r\n q:array,\r\n d:array,\r\n ghost n:int,\r\n ghost worksheet:RSAKeyGenerationWorksheet,\r\n ghost origTPM:TPM_struct)\r\n returns (\r\n success':bool,\r\n p':array,\r\n q':array,\r\n d':array,\r\n ghost n':int,\r\n ghost worksheet':RSAKeyGenerationWorksheet)\r\n requires RSAKeyGenLoop_requires(keybits, e, halfbits, one);\r\n requires RSAKeyGenLoop_invariant(keybits, e, started, false, p, q, d, n, worksheet, origTPM, TPM);\r\n requires TPM_ready(); \r\n ensures RSAKeyGenLoop_invariant(keybits, e, true, success', p', q', d', n', worksheet', origTPM, TPM);\r\n ensures TPM_ready();\r\n\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n{\r\n ghost var loop_TPM_index := TPM.random_index;\r\n ghost var p_worksheet, q_worksheet;\r\n assert TPM_ready();\r\n p', p_worksheet := GenRandomPrime(halfbits);\r\n ghost var mid_TPM_index := TPM.random_index;\r\n q', q_worksheet := GenRandomPrime(halfbits);\r\n//- assert J(p') < power2(power2(29));\r\n//- assert J(q') < power2(power2(29));\r\n\r\n assert J(p')!=0;\r\n assert J(q')!=0;\r\n n' := J(p')*J(q');\r\n lemma_mul_nonzero(J(p'), J(q'));\r\n assert n'!=0;\r\n \r\n lemma_RSAKeyGen_1(keybits, halfbits, p', q', n');\r\n\r\n var pMinus1:array := FatNatSub(p',one);\r\n var qMinus1:array := FatNatSub(q',one);\r\n//- assert J(pMinus1) < power2(power2(29));\r\n//- assert J(qMinus1) < power2(power2(29));\r\n \r\n var phi_n:array := FatNatMul(pMinus1,qMinus1);\r\n\r\n lemma_RSAKeyGen_2(keybits, halfbits, p', q', n', e, pMinus1, qMinus1, phi_n);\r\n\r\n//- assert J(phi_n) < power2(power2(30)) == Frump();\r\n//- assert FrumpyBigNat(phi_n);\r\n \r\n//- assert J(e) < J(phi_n);\r\n//- assert FrumpyBigNat(e);\r\n \r\n success',d' := MultiplicativeInverse(phi_n, e);\r\n \r\n ghost var worksheet_row := RSAKeyGenerationWorksheetRow_c(\r\n p_worksheet, q_worksheet, success', p_worksheet.randoms + q_worksheet.randoms);\r\n\r\n \r\n \r\n /**/ assert TPM.random_index == mid_TPM_index + |q_worksheet.randoms|;\r\n /**/ assert mid_TPM_index == loop_TPM_index + |p_worksheet.randoms|;\r\n lemma_random_comprehension(loop_TPM_index, p_worksheet.randoms, q_worksheet.randoms);\r\n /**/ assert TPM.random_index == loop_TPM_index + |p_worksheet.randoms| + |q_worksheet.randoms|;\r\n \r\n worksheet' := RSAKeyGenerationWorksheetAppend(worksheet, worksheet_row, success');\r\n /**/ assert worksheet.randoms == TPM_random_bytes_premium(origTPM.random_index, loop_TPM_index);\r\n /**/ assert worksheet.randoms == TPM_random_bytes(origTPM.random_index, origTPM.random_index + |worksheet.randoms|);\r\n /**/ assert loop_TPM_index + |worksheet_row.randoms| == TPM.random_index;\r\n /**/ assert TPM_random_bytes(loop_TPM_index, TPM.random_index) == worksheet_row.randoms;\r\n lemma_random_comprehension(origTPM.random_index, worksheet.randoms, worksheet_row.randoms);\r\n /**/ assert TPM.random_index == origTPM.random_index + |worksheet'.randoms|;\r\n\r\n ghost var randoms' := worksheet.randoms + worksheet_row.randoms;\r\n\r\n WorksheetAppend_lemma(worksheet, worksheet_row, success', worksheet');\r\n assert worksheet'.randoms == randoms';\r\n\r\n lemma_RSAKeyGen_3(worksheet, worksheet_row, worksheet', success');\r\n\r\n calc {\r\n n';\r\n J(p')*J(q');\r\n }\r\n}\r\n\r\nmethod RSAKeyGenLoop(keybits:nat, e:array, halfbits:nat, one:array)\r\n returns (p:array, q:array, d:array, ghost worksheet:RSAKeyGenerationWorksheet, ghost n:int)\r\n requires RSAKeyGenLoop_requires(keybits, e, halfbits, one);\r\n \r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n\r\n ensures RSAKeyConsistentWithWorksheet_precondition(worksheet);\r\n ensures RSAKeyGenerationWorksheetValid_Impl(keybits, worksheet, true);\r\n ensures worksheet.keybits == keybits;\r\n ensures RSAKeyGenerationWorksheetConsumesRandoms(worksheet.rows) == worksheet.randoms;\r\n ensures TPM_ready();\r\n ensures TPMs_match_except_for_randoms(old(TPM), TPM);\r\n ensures old(TPM).random_index <= TPM.random_index;\r\n ensures TPM.random_index == old(TPM).random_index + |worksheet.randoms|;\r\n ensures worksheet.randoms == TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index);\r\n ensures 0 < |worksheet.rows|;\r\n\r\n ensures WellformedFatNat(p);\r\n ensures WellformedFatNat(q);\r\n ensures WellformedFatNat(d);\r\n ensures n == J(p)*J(q);\r\n ensures n != 0;\r\n ensures power2(keybits) <= n;\r\n ensures ((J(p)-1)*(J(q)-1)) != 0;\r\n ensures mul(J(d), J(e)) % ((J(p)-1)*(J(q)-1)) == 1;\r\n ensures worksheet.p == J(p);\r\n ensures worksheet.q == J(q);\r\n{\r\n worksheet := RSAKeyGenerationWorksheet_c(keybits, [], [], 0, 0, 0, 0);\r\n p := one; //- dafnycc: initialize variable\r\n q := one; //- dafnycc: initialize variable\r\n d := one; //- dafnycc: initialize variable\r\n\r\n ghost var started := false;\r\n var success:bool := false;\r\n while (!success)\r\n decreases *;\r\n invariant RSAKeyGenLoop_invariant(keybits, e, started, success, p, q, d, n, worksheet, old(TPM), TPM);\r\n invariant TPM_ready();\r\n {\r\n success,p,q,d,n,worksheet := RSAKeyGenLoop_step(keybits, e, halfbits, one, started, p, q, d, n, worksheet, old(TPM));\r\n started := true;\r\n }\r\n}\r\n\r\nlemma lemma_prime_bound(halfbits:nat, wks:CandidatePrimeWorksheet)\r\n requires 0, wks:RSAKeyGenerationWorksheet)\r\n//- requires keybits= power2(keybits);\r\n ensures key.pub.size >= keybits / 8;\r\n ensures RSAKeyGenerationValid(keybits, KeyPairImplToSpec_internal(key), TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index));\r\n{\r\n lemma_2to32();\r\n var one := MakeBELiteralArray(1);\r\n var e, halfbits;\r\n lemma_power2_increases(28, 29);\r\n e,halfbits := RSAKeyGenSetup(keybits);\r\n\r\n var p:array, q:array, d:array;\r\n ghost var worksheet:RSAKeyGenerationWorksheet;\r\n ghost var n:int;\r\n lemma_power2_increases(28, 32);\r\n p, q, d, worksheet, n := RSAKeyGenLoop(keybits, e, halfbits, one);\r\n\r\n var N:array := FatNatMul(p, q);\r\n assert J(N)==n;\r\n//- assert FrumpyBigNat(N);\r\n assert J(N)!=0;\r\n \r\n var size := ComputeKeySize(N);\r\n var nReciprocal := FatNatComputeReciprocal(N);\r\n var recip_ref := if nReciprocal.FNDivKnownReciprocal? then nReciprocal.TwoTo32wDividedByD else p; //- do something real to nReciprocal.TwoTo32wDividedByD\r\n key := RSAKeyPairImpl_c_internal(RSAPubKeyImpl_c_internal(N, size, e, nReciprocal), d);\r\n\r\n if (key.pub.size < keybits/8)\r\n {\r\n calc {\r\n power2(keybits);\r\n <= J(key.pub.n);\r\n < power2(8 * key.pub.size);\r\n < { lemma_power2_strictly_increases(8 * key.pub.size, 8 * (keybits / 8)); }\r\n power2(8 * (keybits / 8));\r\n <= { lemma_power2_increases(8 * (keybits / 8), keybits); }\r\n power2(keybits);\r\n }\r\n assert false;\r\n }\r\n\r\n//- lemma_modulus_length_acceptable(keybits, N, worksheet);\r\n assert WellformedFatNat(key.d);\r\n assert WellformedRSAKeyPairImpl_internal(key);\r\n assert RSAKeyGenerationWorksheetConsumesRandoms(worksheet.rows) == worksheet.randoms;\r\n assert RSAKeyGenerationWorksheetValid(keybits, worksheet);\r\n assert RSAKeyConsistentWithWorksheet(keybits, KeyPairImplToSpec_internal(key), worksheet);\r\n assert RSAKeyGenerationValid(keybits, KeyPairImplToSpec_internal(key), worksheet.randoms);\r\n}\r\n\r\nmethod GenDummyKey_internal() returns (key_pair:RSAKeyPairImpl_internal)\r\n //- used when dafnycc requires that we initialize a variable\r\n{\r\n var zilch := MakeBELiteralArray(0);\r\n key_pair := RSAKeyPairImpl_c_internal(RSAPubKeyImpl_c_internal(zilch, 0, zilch, FNDivUnknownReciprocal()), zilch);\r\n}\r\n\r\nmethod MakeNullKey(bits:nat) returns (key:RSAKeyPairImpl_internal)\r\nrequires Word32(bits);\r\n{\r\n var n := FatPower2(bits);\r\n lemma_2to32();\r\n var one := MakeBELiteralArray(1);\r\n key := RSAKeyPairImpl_c_internal(RSAPubKeyImpl_c_internal(n, 1, one, FNDivUnknownReciprocal()), one);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/RSADigestedSign.i.dfy", "content": "include \"RSASpec.s.dfy\"\r\ninclude \"RSA.i.dfy\"\r\ninclude \"RSAOps.i.dfy\"\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} DigestedSign_internal(key:RSAKeyPairImpl_internal, message:seq)\r\n returns (signature:array)\r\n requires WellformedRSAKeyPairImpl_internal(key);\r\n requires IsByteSeq(message);\r\n requires |message| < power2(28);\r\n requires RSA_DIGEST_MIN_KEY_SIZE() <= key.pub.size;\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures TPM==old(TPM);\r\n ensures IoMemPerm==old(IoMemPerm);\r\n ensures RSASignatureRequires(KeyPairImplToSpec_internal(key), message);\r\n ensures signature!=null;\r\n ensures IsByteSeq(signature[..]);\r\n ensures RSASignature(KeyPairImplToSpec_internal(key), message) == signature[..];\r\n ensures fresh(signature);\r\n//- ensures Word32(signature.Length);\r\n{\r\n var nref := key.pub.n; //- do something real to key.pub.n so dafnycc knows it's allocated\r\n var eref := key.pub.e; //- do something real to key.pub.e so dafnycc knows it's allocated\r\n var dref := key.d; //- do something real to key.d so dafnycc knows it's allocated\r\n var recip_ref := if key.pub.nReciprocal.FNDivKnownReciprocal? then key.pub.nReciprocal.TwoTo32wDividedByD else key.pub.n; //- dafnycc\r\n\r\n calc {\r\n |BEByteSeqToBitSeq_premium(message)|;\r\n <\r\n calc {\r\n |BEByteSeqToBitSeq_premium(message)|;\r\n { lemma_BEByteSeqToBitSeq_ensures(message); }\r\n |message|*8;\r\n { lemma_mul_is_mul_boogie(|message|, 8); }\r\n mul(|message|,8);\r\n { lemma_2toX32(); }\r\n |message|*power2(3);\r\n < { lemma_mul_strict_inequality(|message|,power2(28),power2(3)); }\r\n power2(28)*power2(3);\r\n { lemma_power2_adds(28,3); }\r\n power2(31);\r\n <= { lemma_power2_increases(31,64); }\r\n power2(64);\r\n }\r\n power2(64);\r\n }\r\n\r\n lemma_power2_increases(28,61);\r\n lemma_power2_increases(28,29);\r\n\r\n var digested_message := SHA256DigestImpl(message);\r\n signature := DigestedSignSecondPart(key, message, digested_message);\r\n}\r\n\r\npredicate {:heap} DigestedSignSecondPartRequirements(key:RSAKeyPairImpl_internal, message:seq, digested_message:seq)\r\n reads key.pub.n;\r\n reads key.pub.e;\r\n reads key.d;\r\n reads if key.pub.nReciprocal.FNDivKnownReciprocal? then key.pub.nReciprocal.TwoTo32wDividedByD else key.pub.n;\r\n{\r\n WellformedRSAKeyPairImpl_internal(key)\r\n && IsByteSeq(message)\r\n && |message| < power2(28)\r\n && |message| < power2(29)\r\n && |message| < power2(61)\r\n && RSA_DIGEST_MIN_KEY_SIZE() <= key.pub.size\r\n && |BEByteSeqToBitSeq(message)| < power2(64)\r\n && IsBitSeq(BEByteSeqToBitSeq(message))\r\n && IsByteSeq(digested_message)\r\n && digested_message == SHA256Digest(message)\r\n && |digested_message| == 51\r\n}\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} DigestedSignSecondPart(key:RSAKeyPairImpl_internal, message:seq, digested_message:seq)\r\n returns (signature:array)\r\n requires DigestedSignSecondPartRequirements(key, message, digested_message);\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures TPM==old(TPM);\r\n ensures IoMemPerm==old(IoMemPerm);\r\n ensures RSASignatureRequires(KeyPairImplToSpec_internal(key), message);\r\n ensures signature!=null;\r\n ensures IsByteSeq(signature[..]);\r\n ensures RSASignature(KeyPairImplToSpec_internal(key), message) == signature[..];\r\n ensures fresh(signature);\r\n{\r\n var nref := key.pub.n; //- do something real to key.pub.n so dafnycc knows it's allocated\r\n var eref := key.pub.e; //- do something real to key.pub.e so dafnycc knows it's allocated\r\n var dref := key.d; //- do something real to key.d so dafnycc knows it's allocated\r\n var recip_ref := if key.pub.nReciprocal.FNDivKnownReciprocal? then key.pub.nReciprocal.TwoTo32wDividedByD else key.pub.n; //- dafnycc\r\n\r\n calc {\r\n PadCount(digested_message, key.pub.size);\r\n key.pub.size - 3 - |digested_message|;\r\n >= RSA_DIGEST_MIN_KEY_SIZE() - 3 - 51;\r\n 62 - 3 - 51;\r\n 8;\r\n }\r\n\r\n var messageN:array;\r\n ghost var padded_msg:seq;\r\n messageN,padded_msg := MessageToInteger(digested_message, key.pub.size, PadModeSign());\r\n assert padded_msg == PKCS15_SignaturePad(SHA256Digest(message), key.pub.size);\r\n\r\n assert TPM == old(TPM);\r\n assert IoMemPerm == old(IoMemPerm);\r\n\r\n lemma_PKCS15_SignaturePad(SHA256Digest_premium(message), key.pub.size);\r\n assert RSASignatureRequires(KeyPairImplToSpec_internal(key), message);\r\n signature := DigestedSignThirdPart(key, message, digested_message, messageN, padded_msg);\r\n}\r\n\r\npredicate {:heap} DigestedSignThirdPartRequirements (key:RSAKeyPairImpl_internal, message:seq, digested_message:seq,\r\n messageN:seq, padded_msg:seq)\r\n reads key.pub.n;\r\n reads key.pub.e;\r\n reads key.d;\r\n reads if key.pub.nReciprocal.FNDivKnownReciprocal? then key.pub.nReciprocal.TwoTo32wDividedByD else key.pub.n;\r\n{\r\n DigestedSignSecondPartRequirements(key, message, digested_message)\r\n && IsWordSeq(messageN)\r\n && IsByteSeq(padded_msg)\r\n//- && PKCS15_SignaturePad(SHA256Digest(message), key.pub.size) == [0, BlockType(PadModeSign())] + RepeatDigit(SignaturePadByte(), key.pub.size - 3 - |SHA256Digest(message)|) + [0] + SHA256Digest(message)\r\n && PKCS15_SignaturePad(digested_message, key.pub.size) == padded_msg\r\n && PKCS15_PaddingRelation(padded_msg, digested_message, PadModeSign())\r\n && RSASignatureRequires(KeyPairImplToSpec_internal(key), message)\r\n && BigEndianIntegerValue(padded_msg)==BEWordSeqToInt(messageN)\r\n && BEByteSeqToInt(padded_msg)==BEWordSeqToInt(messageN)\r\n && 0 < BEWordSeqToInt(messageN) < power2(8*(key.pub.size-1))\r\n && |padded_msg|==key.pub.size\r\n}\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} DigestedSignThirdPart(key:RSAKeyPairImpl_internal, ghost message:seq,\r\n ghost digested_message:seq, messageN:array,\r\n ghost padded_msg:seq) returns (signature:array)\r\n requires WellformedFatNat(messageN);\r\n requires DigestedSignThirdPartRequirements(key, message, digested_message, messageN[..], padded_msg);\r\n requires messageN != key.pub.n && messageN != key.pub.e;\r\n requires key.pub.nReciprocal.FNDivKnownReciprocal? ==> messageN != key.pub.nReciprocal.TwoTo32wDividedByD;\r\n ensures RSASignatureRequires(KeyPairImplToSpec_internal(key), message);\r\n ensures signature!=null;\r\n ensures IsByteSeq(signature[..]);\r\n ensures RSASignature(KeyPairImplToSpec_internal(key), message) == signature[..];\r\n ensures fresh(signature);\r\n{\r\n var nref := key.pub.n; //- do something real to key.pub.n so dafnycc knows it's allocated\r\n var eref := key.pub.e; //- do something real to key.pub.e so dafnycc knows it's allocated\r\n var dref := key.d; //- do something real to key.d so dafnycc knows it's allocated\r\n var recip_ref := if key.pub.nReciprocal.FNDivKnownReciprocal? then key.pub.nReciprocal.TwoTo32wDividedByD else key.pub.n; //- dafnycc\r\n\r\n var signatureN:array := InnerDecrypt(key, messageN);\r\n var short_signature := BEWordArrayToByteArray(signatureN);\r\n\r\n calc {\r\n BEDigitSeqToInt(power2(8), short_signature[..]);\r\n J(signatureN);\r\n <\r\n J(key.pub.n);\r\n <\r\n power2(8*key.pub.size);\r\n { lemma_power2_unfolding(8, key.pub.size);\r\n lemma_mul_is_mul_boogie(8, key.pub.size); }\r\n power(power2(8), key.pub.size);\r\n }\r\n lemma_CanonicalLengthBound(power2(8), short_signature[..], key.pub.size);\r\n //-assert short_signature.Length <= key.pub.size;\r\n\r\n signature := DigestedSignFourthPart(key, message, digested_message, messageN[..], padded_msg, signatureN[..], short_signature);\r\n}\r\n\r\npredicate {:heap} DigestedSignFourthPartRequirements (key:RSAKeyPairImpl_internal, message:seq, digested_message:seq,\r\n messageN:seq, padded_msg:seq, signatureN:seq,\r\n short_signature:seq)\r\n reads key.pub.n;\r\n reads key.pub.e;\r\n reads key.d;\r\n reads if key.pub.nReciprocal.FNDivKnownReciprocal? then key.pub.nReciprocal.TwoTo32wDividedByD else key.pub.n;\r\n{\r\n DigestedSignThirdPartRequirements(key, message, digested_message, messageN, padded_msg)\r\n && IsWordSeq(signatureN)\r\n && BEWordSeqToInt(signatureN) == power(BEWordSeqToInt(messageN), BEWordSeqToInt(key.d[..])) % BEWordSeqToInt(key.pub.n[..])\r\n && IsByteSeq(short_signature)\r\n && BEByteSeqToInt(short_signature) == BEWordSeqToInt(signatureN)\r\n && |short_signature| <= key.pub.size\r\n && BEByteSeqToInt(short_signature) < power(power2(8), key.pub.size)\r\n}\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} DigestedSignFourthPart(key:RSAKeyPairImpl_internal, ghost message:seq,\r\n ghost digested_message:seq, ghost messageN:seq,\r\n ghost padded_msg:seq, ghost signatureN:seq,\r\n short_signature:array) returns (signature:array)\r\n requires short_signature != null;\r\n requires DigestedSignFourthPartRequirements(key, message, digested_message, messageN, padded_msg, signatureN, short_signature[..]);\r\n requires short_signature != key.pub.n && short_signature != key.pub.e;\r\n requires key.pub.nReciprocal.FNDivKnownReciprocal? ==> short_signature != key.pub.nReciprocal.TwoTo32wDividedByD;\r\n ensures RSASignatureRequires(KeyPairImplToSpec_internal(key), message);\r\n ensures signature!=null;\r\n ensures IsByteSeq(signature[..]);\r\n ensures RSASignature(KeyPairImplToSpec_internal(key), message) == signature[..];\r\n ensures fresh(signature);\r\n{\r\n var nref := key.pub.n; //- do something real to key.pub.n so dafnycc knows it's allocated\r\n var eref := key.pub.e; //- do something real to key.pub.e so dafnycc knows it's allocated\r\n var dref := key.d; //- do something real to key.d so dafnycc knows it's allocated\r\n var recip_ref := if key.pub.nReciprocal.FNDivKnownReciprocal? then key.pub.nReciprocal.TwoTo32wDividedByD else key.pub.n; //- dafnycc\r\n\r\n signature := PadArrayLeft(key.pub.size - short_signature.Length, short_signature);\r\n\r\n ghost var shorts := short_signature[..];\r\n ghost var longs := signature[..];\r\n forall (i | |longs|-|shorts|<=i<|longs|)\r\n ensures longs[i] == shorts[i - (|longs|-|shorts|)];\r\n {\r\n calc {\r\n longs[i];\r\n signature[..][i];\r\n signature[key.pub.size - short_signature.Length .. ][i - (key.pub.size - short_signature.Length)];\r\n { assert signature[key.pub.size - short_signature.Length .. ] == short_signature[..]; }\r\n short_signature[..][i - (key.pub.size - short_signature.Length)];\r\n shorts[i - (key.pub.size - short_signature.Length)];\r\n shorts[i - (|longs|-|shorts|)];\r\n }\r\n }\r\n \r\n calc {\r\n BEByteSeqToInt(signature[..]);\r\n { lemma_LeadingZeros(power2(8), short_signature[..], signature[..]); }\r\n BEByteSeqToInt(short_signature[..]);\r\n BEWordSeqToInt(signatureN);\r\n }\r\n\r\n Lemma_DigestedSignFourthPartHelper(KeyPairImplToSpec_internal(key), message, digested_message, messageN, padded_msg, signatureN, short_signature[..], signature[..]);\r\n}\r\n\r\nlemma {:dafnycc_conservative_seq_triggers} Lemma_DigestedSignFourthPartHelper(key:RSAKeyPairSpec, message:seq,\r\n digested_message:seq, messageN:seq,\r\n padded_msg:seq, signatureN:seq,\r\n short_signature:seq, signature:seq)\r\n requires WellformedRSAKeyPairSpec(key);\r\n requires IsByteSeq(message);\r\n requires RSA_DIGEST_MIN_KEY_SIZE() <= key.pub.size;\r\n requires IsByteSeq(padded_msg);\r\n requires IsByteSeq(digested_message);\r\n requires IsBitSeq(BEByteSeqToBitSeq(message));\r\n requires |BEByteSeqToBitSeq(message)| < power2(64);\r\n requires digested_message == SHA256Digest(message);\r\n requires |digested_message| == 51;\r\n requires PKCS15_PaddingRelation(padded_msg, digested_message, PadModeSign());\r\n requires PKCS15_SignaturePad(digested_message, key.pub.size) == padded_msg;\r\n requires RSASignatureRequires(key, message);\r\n requires IsWordSeq(messageN);\r\n requires BigEndianIntegerValue(padded_msg)==BEWordSeqToInt(messageN);\r\n requires BEByteSeqToInt(padded_msg)==BEWordSeqToInt(messageN);\r\n requires |padded_msg|==key.pub.size;\r\n requires IsWordSeq(signatureN);\r\n requires BEWordSeqToInt(signatureN) == power(BEWordSeqToInt(messageN), key.d) % key.pub.n;\r\n requires IsByteSeq(short_signature);\r\n requires BEByteSeqToInt(short_signature) == BEWordSeqToInt(signatureN);\r\n requires |short_signature| <= key.pub.size;\r\n requires BEByteSeqToInt(short_signature) < power(power2(8), key.pub.size);\r\n requires |signature| == key.pub.size;\r\n requires IsByteSeq(signature);\r\n requires forall i :: |signature|-|short_signature| <= i < |signature| ==> signature[i] == short_signature[i - (|signature| - |short_signature|)];\r\n requires BEByteSeqToInt(signature) == BEWordSeqToInt(signatureN);\r\n\r\n ensures RSASignature(key, message) == signature;\r\n{\r\n //-assert BEIntToByteSeq(I(signatureN)) == signature;\r\n\r\n ghost var padded_nint := BEByteSeqToInt(PKCS15_SignaturePad(SHA256Digest(message), key.pub.size));\r\n ghost var sign_n := power(padded_nint, key.d) % key.pub.n;\r\n assert power(padded_nint, key.d) % key.pub.n == BEWordSeqToInt(signatureN);\r\n ghost var sslen := |short_signature|;\r\n if (key.pub.size < sslen)\r\n {\r\n //- The calc below is nested to hide the internals of the calc from later code even in DafnyCC\r\n calc {\r\n true ==>\r\n calc {\r\n key.pub.n;\r\n <\r\n power2(8*key.pub.size);\r\n <= { lemma_power2_increases(8*key.pub.size, 8*(sslen-1)); }\r\n power2(8*(sslen-1));\r\n { lemma_power2_unfolding(8, (sslen-1));\r\n lemma_mul_is_mul_boogie(8, (sslen-1)); }\r\n power(power2(8), sslen-1);\r\n { lemma_mul_basics_forall(); }\r\n mul(1, power(power2(8), sslen-1));\r\n <= {\r\n lemma_power_positive(power2(8), sslen-1);\r\n lemma_mul_inequality(1, short_signature[0], power(power2(8), sslen-1));\r\n }\r\n short_signature[0] * power(power2(8), sslen-1);\r\n <= { lemma_BEDigitSeqToInt_bound(power2(8), short_signature); }\r\n BEByteSeqToInt(short_signature);\r\n BEWordSeqToInt(signatureN);\r\n }\r\n false;\r\n }\r\n }\r\n calc {\r\n signature;\r\n { lemma_BEDigitSeqToInt_invertibility(power2(8), BEWordSeqToInt(signatureN), signature); }\r\n BEIntToDigitSeq(power2(8), |signature|, BEWordSeqToInt(signatureN));\r\n BEIntToDigitSeq(power2(8), key.pub.size, sign_n);\r\n { assert WellformedRSAKeyPairSpec(key); }\r\n RSASignature(key, message);\r\n }\r\n\r\n assert BEWordSeqToInt(signatureN) < key.pub.n;\r\n lemma_BEIntToDigitSeq_properties(power2(8), 0, BEWordSeqToInt(signatureN));\r\n\r\n calc {\r\n |signature|;\r\n <= { if (BEWordSeqToInt(signatureN)==0) { reveal_BEIntToDigitSeq_private(); } }\r\n key.pub.size;\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/RSAOps.i.dfy", "content": "include \"RSASpec.s.dfy\"\r\ninclude \"RSA.i.dfy\"\r\n\r\n//- Eventually useful for lemma_message_transmission\r\npredicate {:heap} EncryptionRelation(pubkey:RSAPubKeyImpl_internal, p:array, c:array)\r\n requires WellformedRSAPubKeyImpl_internal(pubkey);\r\n requires WellformedFatNat(p);\r\n requires WellformedFatNat(c);\r\n reads pubkey.n;\r\n reads pubkey.e;\r\n reads if pubkey.nReciprocal.FNDivKnownReciprocal? then pubkey.nReciprocal.TwoTo32wDividedByD else pubkey.n;\r\n reads p;\r\n reads c;\r\n{\r\n J(c)==power(J(p),J(pubkey.e)) % J(pubkey.n)\r\n}\r\n\r\nmethod InnerEncrypt(pubkey:RSAPubKeyImpl_internal, plaintext:array) returns (ciphertext:array)\r\n requires WellformedRSAPubKeyImpl_internal(pubkey);\r\n//- requires FrumpyBigNat(plaintext);\r\n requires WellformedFatNat(plaintext);\r\n requires 0 < J(plaintext) < J(pubkey.n);\r\n//- ensures FrumpyBigNat(ciphertext);\r\n ensures WellformedFatNat(ciphertext);\r\n ensures J(ciphertext) < J(pubkey.n);\r\n ensures EncryptionRelation(pubkey, plaintext, ciphertext);\r\n{\r\n//- ciphertext := BigNatModExp(plaintext, pubkey.e, pubkey.n);\r\n//- var B := BigNatToFatNat(plaintext);\r\n//- var E := BigNatToFatNat(pubkey.e);\r\n//- var N := BigNatToFatNat(pubkey.n);\r\n var B := plaintext;\r\n var E := pubkey.e;\r\n var N := pubkey.n;\r\n\r\n ghost var pv := power2(32);\r\n//- assert IsCanonicalDigitSeq(pv, B[..]);\r\n//- assert IsCanonicalDigitSeq(pv, E[..]);\r\n//- assert IsCanonicalDigitSeq(pv, N[..]);\r\n ghost var Bv := BEWordSeqToInt(B[..]);\r\n ghost var Ev := BEWordSeqToInt(E[..]);\r\n ghost var Nv := BEWordSeqToInt(N[..]);\r\n\r\n assert Bv < Nv;\r\n//- calc {\r\n//- Ev;\r\n//- <\r\n//- Frump();\r\n//- power2(power2(30));\r\n//- <= { lemma_power2_increases(30,31);\r\n//- lemma_power2_increases(power2(30),power2(31)); }\r\n//- power2(power2(31));\r\n//- }\r\n//- lemma_CanonicalLength_inherit(pv, B[..], N[..], power2(25));\r\n//- requires BEWordSeqToInt(E[..]) < power2(power2(31));\r\n//- requires B.Length < power2(25);\r\n//- requires N.Length < power2(25);\r\n\r\n var R := FatNatModExpUsingReciprocal(B, E, N, pubkey.nReciprocal);\r\n//- ciphertext := FatNatToBigNat(R);\r\n ciphertext := R;\r\n}\r\n\r\nstatic predicate RSAEncryptionRequires(pubkey:RSAPubKeySpec, msg:seq, padding:seq)\r\n{\r\n WellformedRSAPubKeySpec(pubkey)\r\n && IsByteSeq(msg)\r\n && IsByteSeq(padding)\r\n && |padding| == PadCount(msg, pubkey.size)\r\n && PadCount(msg, pubkey.size) >= 8\r\n && NonzeroPad(padding)\r\n && IsDigitSeq(power2(8), PKCS15_EncryptionPad(msg, pubkey.size, padding))\r\n}\r\n\r\nstatic lemma lemma_seq_remove_first_element(s:seq, j:int)\r\n requires 0 <= j < |s|;\r\n ensures s[j..] == [s[j]] + s[j+1..];\r\n{\r\n}\r\n\r\nstatic lemma lemma_seq_break_middle(s:seq, i:int, j:int)\r\n requires 0 <= i <= j <= |s|;\r\n ensures s[i..] == s[i..j] + s[j..];\r\n{\r\n}\r\n\r\nlemma {:heap} lemma_Encrypt_fragile_bit(pubkey:RSAPubKeySpec, plaintext:seq, padded_plaintext:seq, ep:seq, padding:seq)\r\n requires WellformedRSAPubKeySpec(pubkey);\r\n requires IsByteSeq(plaintext);\r\n requires IsByteSeq(padded_plaintext);\r\n requires IsByteSeq(ep);\r\n requires IsByteSeq(padding);\r\n requires PKCS15_PaddingRelationWith(padded_plaintext, plaintext, PadModeEncrypt(), padding);\r\n requires |padding| == PadCount(plaintext, pubkey.size);\r\n requires ep == PKCS15_EncryptionPad(plaintext, pubkey.size, padding);\r\n ensures padded_plaintext == ep;\r\n{\r\n calc {\r\n padded_plaintext;\r\n { lemma_seq_remove_first_element(padded_plaintext, 0); }\r\n [padded_plaintext[0]] + padded_plaintext[1..];\r\n [0] + padded_plaintext[1..];\r\n { lemma_seq_remove_first_element(padded_plaintext, 1); }\r\n [0] + [padded_plaintext[1]] + padded_plaintext[2..];\r\n [0] + [BlockType(PadModeEncrypt())] + padded_plaintext[2..];\r\n { lemma_seq_break_middle(padded_plaintext, 2, |padding|+2); }\r\n [0] + [BlockType(PadModeEncrypt())] + padded_plaintext[2..|padding|+2] + padded_plaintext[|padding|+2..];\r\n [0] + [BlockType(PadModeEncrypt())] + padding + padded_plaintext[|padding|+2..];\r\n { lemma_seq_remove_first_element(padded_plaintext, |padding|+2); }\r\n [0] + [BlockType(PadModeEncrypt())] + padding + [padded_plaintext[|padding|+2]] + padded_plaintext[|padding|+3..];\r\n [0] + [BlockType(PadModeEncrypt())] + padding + [0] + padded_plaintext[|padding|+3..];\r\n [0] + [BlockType(PadModeEncrypt())] + padding + [0] + plaintext;\r\n { assert [0, BlockType(PadModeEncrypt())] == [0] + [BlockType(PadModeEncrypt())]; }\r\n [0, BlockType(PadModeEncrypt())] + padding + [0] + plaintext;\r\n PKCS15_EncryptionPad(plaintext, pubkey.size, padding);\r\n ep;\r\n }\r\n}\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} Encrypt_internal(pubkey:RSAPubKeyImpl_internal, plaintext:seq) returns (ciphertext:seq)\r\n requires IsByteSeq(plaintext);\r\n requires WellformedRSAPubKeyImpl_internal(pubkey);\r\n requires |plaintext| <= pubkey.size - 11;\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures WellformedRSAPubKeyImpl_internal(pubkey);\r\n ensures WellformedRSAPubKeySpec(PubKeyImplToSpec_internal(pubkey));\r\n ensures IsByteSeq(ciphertext);\r\n ensures exists padding:seq ::\r\n RSAEncryptionRequires(PubKeyImplToSpec_internal(pubkey), plaintext, padding)\r\n && RSAEncryption(PubKeyImplToSpec_internal(pubkey), plaintext, padding) == ciphertext;\r\n{\r\n var nref := pubkey.n; //- do something real to pubkey.n so dafnycc knows it's allocated\r\n var eref := pubkey.e; //- do something real to pubkey.e so dafnycc knows it's allocated\r\n var recip_ref := if pubkey.nReciprocal.FNDivKnownReciprocal? then pubkey.nReciprocal.TwoTo32wDividedByD else pubkey.n; //- do something real to reciprocal for dafnycc\r\n\r\n var plainN:array;\r\n ghost var padded_plaintext:seq;\r\n plainN,padded_plaintext := MessageToInteger(plaintext, pubkey.size, PadModeEncrypt());\r\n \r\n calc {\r\n J(plainN);\r\n <= power2(8*(pubkey.size-1));\r\n <= {\r\n //- KeySizeIs ensures\r\n assert KeyModulusMatchesSizeInBytes(PubKeyImplToSpec_internal(pubkey).n, pubkey.size);\r\n assert (pubkey.size>0 ==> power2(8*(pubkey.size-1)) <= J(pubkey.n));\r\n assert power2(8*(pubkey.size-1)) <= J(pubkey.n);\r\n }\r\n J(pubkey.n);\r\n }\r\n//- assert FrumpyBigNat(plainN);\r\n \r\n var cipherN:array := InnerEncrypt(pubkey, plainN);\r\n var ciphertext_raw := IntegerToBESeq(cipherN);\r\n\r\n assert IsByteSeq(ciphertext_raw); \r\n assert IsByteSeq(padded_plaintext);\r\n assert PKCS15_PaddingRelation(padded_plaintext, plaintext, PadModeEncrypt());\r\n\r\n calc {\r\n BigEndianIntegerValue(ciphertext_raw);\r\n J(cipherN);\r\n //- InnerEncrypt ensures, EncryptionRelation ensures\r\n power(J(plainN),J(pubkey.e)) % J(pubkey.n);\r\n power(BigEndianIntegerValue(padded_plaintext),J(pubkey.e)) % J(pubkey.n);\r\n power(BigEndianIntegerValue(padded_plaintext),PubKeyImplToSpec_internal(pubkey).e) % PubKeyImplToSpec_internal(pubkey).n;\r\n }\r\n\r\n ciphertext := EncryptSecondStep(PubKeyImplToSpec_internal(pubkey), plaintext, J(plainN), padded_plaintext, J(cipherN), ciphertext_raw);\r\n}\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} EncryptSecondStep(ghost pubkey:RSAPubKeySpec, ghost plaintext:seq,\r\n ghost plainN:int, ghost padded_plaintext:seq, ghost cipherN:int,\r\n ciphertext_raw:seq) returns (ciphertext:seq)\r\n requires IsByteSeq(plaintext);\r\n requires WellformedRSAPubKeySpec(pubkey);\r\n requires |plaintext| <= pubkey.size - 11;\r\n requires plainN < pubkey.n;\r\n requires IsByteSeqOfLen(padded_plaintext, pubkey.size);\r\n requires PKCS15_PaddingRelation(padded_plaintext, plaintext, PadModeEncrypt());\r\n requires plainN == BigEndianIntegerValue(padded_plaintext);\r\n requires cipherN < pubkey.n;\r\n requires cipherN == power(plainN, pubkey.e) % pubkey.n;\r\n requires IsByteSeq(ciphertext_raw);\r\n requires |ciphertext_raw| >= 1;\r\n requires cipherN == BigEndianIntegerValue(ciphertext_raw);\r\n requires ciphertext_raw == [0] + BEIntToByteSeq(cipherN);\r\n requires BigEndianIntegerValue(ciphertext_raw) == power(BigEndianIntegerValue(padded_plaintext), pubkey.e) % pubkey.n;\r\n ensures IsByteSeq(ciphertext);\r\n ensures exists padding:seq ::\r\n RSAEncryptionRequires(pubkey, plaintext, padding)\r\n && RSAEncryption(pubkey, plaintext, padding) == ciphertext;\r\n{\r\n \r\n \r\n ciphertext := ciphertext_raw[1..];\r\n \r\n ghost var padding:seq :| PKCS15_PaddingRelationWith(padded_plaintext, plaintext, PadModeEncrypt(), padding);\r\n \r\n ghost var ep := PKCS15_EncryptionPad(plaintext, pubkey.size, padding);\r\n //- assert IsByteSeq(ep);\r\n ghost var pad_msg := BEByteSeqToInt(ep);\r\n\r\n lemma_Encrypt_fragile_bit(pubkey, plaintext, padded_plaintext, ep, padding);\r\n\r\n calc {\r\n RSAEncryption(pubkey, plaintext, padding);\r\n BEIntToByteSeq(power(pad_msg, pubkey.e) % pubkey.n);\r\n {\r\n calc { \r\n power(pad_msg, pubkey.e) % pubkey.n;\r\n {\r\n calc {\r\n plainN;\r\n BigEndianIntegerValue(padded_plaintext);\r\n { lemma_BigEndianIntegerValue_equals_BEByteSeqToInt(padded_plaintext); }\r\n BEByteSeqToInt(ep);\r\n pad_msg;\r\n }\r\n }\r\n power(plainN, pubkey.e) % pubkey.n;\r\n cipherN;\r\n }\r\n //- Note that here we merely show equivalent integer values;\r\n //- the legacy function IntegerToBESeq has been equipped with an\r\n //- additional ensures about BEIntToByteSeq.\r\n }\r\n BEIntToByteSeq(cipherN);\r\n { assert [0] + BEIntToByteSeq(cipherN) == ciphertext_raw; }\r\n ciphertext_raw[1..];\r\n ciphertext;\r\n }\r\n}\r\n\r\n//- Eventually useful for lemma_message_transmission\r\npredicate {:heap} DecryptionRelation(key:RSAKeyPairImpl_internal, c:array, p:array)\r\n requires WellformedRSAKeyPairImpl_internal(key);\r\n requires WellformedFatNat(c);\r\n requires WellformedFatNat(p);\r\n reads c;\r\n reads p;\r\n reads key.pub.n;\r\n reads key.pub.e;\r\n reads key.d;\r\n reads if key.pub.nReciprocal.FNDivKnownReciprocal? then key.pub.nReciprocal.TwoTo32wDividedByD else key.pub.n;\r\n{\r\n J(p)==power(J(c),J(key.d)) % J(key.pub.n)\r\n}\r\n\r\nmethod InnerDecrypt(key:RSAKeyPairImpl_internal, ciphertext:array) returns (plaintext:array)\r\n requires WellformedRSAKeyPairImpl_internal(key);\r\n requires WellformedFatNat(ciphertext);\r\n requires 0 < J(ciphertext) < J(key.pub.n);\r\n ensures WellformedFatNat(plaintext);\r\n ensures J(plaintext) < J(key.pub.n);\r\n ensures DecryptionRelation(key, ciphertext, plaintext);\r\n{\r\n plaintext := FatNatModExpUsingReciprocal(ciphertext, key.d, key.pub.n, key.pub.nReciprocal);\r\n}\r\n\r\nstatic lemma lemma_about_PKCS15_PaddingRelationWith(padded_msg:seq, msg:seq, pad_mode:PadMode, padding:seq)\r\n requires IsByteSeq(padded_msg);\r\n requires IsByteSeq(msg);\r\n requires PKCS15_PaddingRelationWith(padded_msg, msg, pad_mode, padding);\r\n ensures padded_msg == [0] + [BlockType(pad_mode)] + padding + [0] + msg;\r\n{\r\n}\r\n\r\nstatic lemma lemma_PKCS15_EncryptionPad(msg:seq, k:nat, padding:seq)\r\n requires IsByteSeq(msg);\r\n requires IsByteSeq(padding);\r\n requires |padding| == k - 3 - |msg|;\r\n requires |padding| >= 8;\r\n requires NonzeroPad(padding);\r\n ensures PKCS15_EncryptionPad(msg, k, padding)\r\n == [0, BlockType(PadModeEncrypt())] + padding + [0] + msg;\r\n ensures IsByteSeq(PKCS15_EncryptionPad(msg, k, padding));\r\n{\r\n lemma_2toX();\r\n}\r\n\r\nstatic lemma lemma_PKCS15_SignaturePad(msg:seq, k:nat)\r\n requires IsByteSeq(msg);\r\n requires k - 3 - |msg| >= 8;\r\n ensures PKCS15_SignaturePad(msg, k)\r\n == [0, BlockType(PadModeSign())] + RepeatDigit(SignaturePadByte(), k - 3 - |msg|) + [0] + msg;\r\n ensures IsByteSeq(PKCS15_SignaturePad(msg, k));\r\n{\r\n lemma_2toX();\r\n lemma_RepeatDigit_for_ByteSeq(SignaturePadByte(), k - 3 - |msg|);\r\n}\r\n\r\nstatic lemma lemma_obvious_concatenation(x:int, y:int)\r\n ensures [x] + [y] == [x,y];\r\n{\r\n}\r\n\r\nstatic lemma lemma_obvious_length(x:seq, y:seq, z:seq)\r\n requires x == y + z;\r\n ensures |x| == |y| + |z|;\r\n{\r\n}\r\n\r\nstatic predicate RSASignatureRequires(key: RSAKeyPairSpec, message: seq)\r\n{\r\n WellformedRSAKeyPairSpec(key)\r\n && IsByteSeq(message)\r\n && IsBitSeq(BEByteSeqToBitSeq_premium(message))\r\n && |BEByteSeqToBitSeq_premium( message)| < power2(64)\r\n && IsWordSeq(SHA256(BEByteSeqToBitSeq_premium(message)))\r\n && IsByteSeq(SHA256Digest(message))\r\n && PadCount(SHA256Digest(message), key.pub.size) >= 8\r\n && IsByteSeq(PKCS15_SignaturePad(SHA256Digest(message), key.pub.size))\r\n}\r\n\r\nstatic lemma lemma_RSA_message_length_bound(message:seq)\r\n requires IsByteSeq(message);\r\n requires |message| < power2(28);\r\n ensures IsByteSeq(SHA256_DigestInfo_premium() + message);\r\n ensures |BEByteSeqToBitSeq_premium(SHA256_DigestInfo_premium() + message)| < power2(64);\r\n{\r\n calc {\r\n |SHA256_DigestInfo() + message|;\r\n 19 + |message|;\r\n < 19 + power2(28);\r\n < { lemma_2toX(); lemma_power2_add8(24); lemma_power2_add8(56); }\r\n power2(61);\r\n }\r\n //- Drop a hint to Dafny that IsByteSeq extends across seq addition:\r\n assert IsByteSeq(SHA256_DigestInfo_premium() + message);\r\n calc {\r\n |BEByteSeqToBitSeq_premium(SHA256_DigestInfo() + message)|;\r\n 8*|SHA256_DigestInfo() + message|;\r\n < 8*power2(61);\r\n { lemma_2toX(); lemma_power2_add8(56); }\r\n power2(64);\r\n }\r\n}\r\n\r\nstatic function method RSA_DIGEST_MIN_KEY_SIZE() : int { 62 }\r\n\r\nstatic predicate RSAVerificationRelationRequires(pubkey:RSAPubKeySpec, message:seq, signature:seq)\r\n{\r\n //- NB we premium-ify methods to trigger corresponding ensures\r\n IsByteSeq(signature)\r\n && IsByteSeq(message)\r\n && IsBitSeq(BEByteSeqToBitSeq_premium(message))\r\n && |BEByteSeqToBitSeq_premium(message)| < power2(64)\r\n && IsWordSeq(SHA256(BEByteSeqToBitSeq_premium(message)))\r\n && IsByteSeq(SHA256Digest(message))\r\n && PadCount(SHA256Digest(message), pubkey.size) >= 8\r\n && IsByteSeq(PKCS15_SignaturePad(SHA256Digest(message), pubkey.size))\r\n}\r\n\r\nmethod {:timeLimitMultiplier 3} DigestedVerifyCommonCase(pubkey:RSAPubKeyImpl_internal, message:seq, signature:seq, signatureN:array) returns (verifies:bool)\r\n requires WellformedRSAPubKeyImpl_internal(pubkey);\r\n requires RSA_DIGEST_MIN_KEY_SIZE() <= pubkey.size < power2(60);\r\n requires RSAVerificationRelationRequires(PubKeyImplToSpec_internal(pubkey), message, signature);\r\n requires |message| < power2(28);\r\n requires |signature| == pubkey.size;\r\n requires WellformedRSAPubKeySpec(PubKeyImplToSpec_internal(pubkey));\r\n requires signatureN != null;\r\n requires IsWordSeq(signatureN[..]);\r\n requires BEWordSeqToInt(signatureN[..]) == BEByteSeqToInt(signature);\r\n requires |signature| == pubkey.size;\r\n requires BEWordSeqToInt(signatureN[..]) != 0;\r\n requires J(signatureN) < J(pubkey.n);\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures TPM==old(TPM);\r\n ensures IoMemPerm==old(IoMemPerm);\r\n ensures WellformedRSAPubKeySpec(PubKeyImplToSpec_internal(pubkey));\r\n ensures verifies <==> RSAVerificationRelation(PubKeyImplToSpec_internal(pubkey), message, signature);\r\n{\r\n var nref := pubkey.n; //- do something real to pubkey.n so dafnycc knows it's allocated\r\n var eref := pubkey.e; //- do something real to pubkey.e so dafnycc knows it's allocated\r\n var recip_ref := if pubkey.nReciprocal.FNDivKnownReciprocal? then pubkey.nReciprocal.TwoTo32wDividedByD else pubkey.n; //- dafnycc\r\n\r\n lemma_2toX32();\r\n var digested_message := SHA256DigestImpl(message);\r\n var padded_message_raw := PadMessage(digested_message, pubkey.size, PadModeSign());\r\n var padded_message := padded_message_raw;\r\n var padded_message_array := SeqToArray(padded_message);\r\n var padded_messageN := BEByteArrayToWordArray(padded_message_array);\r\n\r\n assert 0 < J(signatureN) < J(pubkey.n);\r\n var putative_padded_messageN := InnerEncrypt(pubkey, signatureN);\r\n\r\n verifies := FatNatEq(padded_messageN, putative_padded_messageN);\r\n\r\n lemma_RSA_message_length_bound(message);\r\n}\r\n\r\nmethod DigestedVerify_internal(pubkey:RSAPubKeyImpl_internal, message:seq, signature:seq) returns (verifies:bool)\r\n requires WellformedRSAPubKeyImpl_internal(pubkey);\r\n requires RSA_DIGEST_MIN_KEY_SIZE() <= pubkey.size < power2(60);\r\n requires IsByteSeq(message);\r\n//- requires |message| < power2(61);\r\n requires |message| < power2(28);\r\n requires IsByteSeq(signature);\r\n requires |signature| == pubkey.size;\r\n//- requires signature[0] == 0;\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures TPM==old(TPM);\r\n ensures IoMemPerm==old(IoMemPerm);\r\n ensures WellformedRSAPubKeySpec(PubKeyImplToSpec_internal(pubkey));\r\n ensures verifies <==> (\r\n RSAVerificationRelationRequires(PubKeyImplToSpec_internal(pubkey), message, signature)\r\n && RSAVerificationRelation(PubKeyImplToSpec_internal(pubkey), message, signature));\r\n{\r\n var nref := pubkey.n; //- do something real to pubkey.n so dafnycc knows it's allocated\r\n var eref := pubkey.e; //- do something real to pubkey.e so dafnycc knows it's allocated\r\n var recip_ref := if pubkey.nReciprocal.FNDivKnownReciprocal? then pubkey.nReciprocal.TwoTo32wDividedByD else pubkey.n; //- dafnycc\r\n\r\n lemma_WellformedPubKeyImplImpliesWellformedPubKeySpec(pubkey);\r\n\r\n var signature_array := SeqToArray(signature);\r\n var signatureN := BEByteArrayToWordArray(signature_array);\r\n\r\n var zerosig := FatNatIsZero(signatureN);\r\n if (|signature|!=pubkey.size || zerosig)\r\n {\r\n assert BEByteSeqToInt(signature)==0;\r\n verifies := false;\r\n return;\r\n }\r\n\r\n lemma_2toX32();\r\n calc {\r\n |BEByteSeqToBitSeq_premium(message)|;\r\n |message|*8;\r\n <= power2(28)*8;\r\n { lemma_mul_is_mul_boogie(power2(28), 8); }\r\n power2(28)*power2(3);\r\n { lemma_power2_adds(28,3); }\r\n power2(31);\r\n }\r\n lemma_power2_strictly_increases(31,61);\r\n lemma_power2_strictly_increases(31,64);\r\n lemma_PKCS15_SignaturePad(SHA256Digest_premium(message), pubkey.size);\r\n\r\n var sig_short_enough := FatNatLt(signatureN, pubkey.n);\r\n if (!sig_short_enough)\r\n {\r\n assert !(BEByteSeqToInt(signature) < PubKeyImplToSpec_internal(pubkey).n);\r\n assert !RSAVerificationRelation(PubKeyImplToSpec_internal(pubkey), message, signature);\r\n verifies := false;\r\n return;\r\n }\r\n\r\n verifies := DigestedVerifyCommonCase(pubkey, message, signature, signatureN);\r\n}\r\n\r\n//-lemma lemma_message_transmission(key:RSAKeyPairImpl_internal, p_in:BigNat, c:BigNat, p_out:BigNat)\r\n//- requires WellformedRSAKeyPairImpl_internal(key);\r\n//- requires WellformedBigNat(p_in);\r\n//- requires WellformedBigNat(c);\r\n//- requires WellformedBigNat(p_out);\r\n//- requires I(p_in) < I(key.pub.n);\r\n//- requires I(c) < I(key.pub.n);\r\n//- requires I(p_out) < I(key.pub.n);\r\n//- requires EncryptionRelation(key.pub, p_in, c);\r\n//- requires DecryptionRelation(key, c, p_out);\r\n//- ensures p_in == p_out;\r\n//\r\n//\r\n//\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/RSAPublicWrapper.i.dfy", "content": "//-\r\ninclude \"RSASpec.s.dfy\"\r\ninclude \"KeyImpl.i.dfy\"\r\ninclude \"RSA.i.dfy\"\r\ninclude \"RSAOps.i.dfy\"\r\ninclude \"RSADigestedSign.i.dfy\"\r\ninclude \"RSA_Decrypt.i.dfy\"\r\ninclude \"rfc4251impl.i.dfy\"\r\ninclude \"rfc4251decode.i.dfy\"\r\ninclude \"../../BigNum/BigNum.i.dfy\"\r\n\r\n\r\n\r\n\r\n\r\n\r\ndatatype RSAPubKeyImpl = RSAPubKeyImpl_c(\r\n n:BigNat, //- modulus\r\n size:nat,\r\n e:BigNat //- public key exponent\r\n );\r\n\r\npredicate WellformedRSAPubKeyImpl(pub:RSAPubKeyImpl)\r\n{\r\n true\r\n && WellformedBigNat(pub.n)\r\n && WellformedBigNat(pub.e)\r\n && 0rc;\r\n{\r\n rc := IsModestBigNat(x);\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n\r\nmethod RSAPubKeyFromInternal(pi:RSAPubKeyImpl_internal) returns (pub:RSAPubKeyImpl)\r\n requires WellformedRSAPubKeyImpl_internal(pi);\r\n ensures WellformedRSAPubKeyImpl(pub);\r\n ensures pi.size == pub.size;\r\n ensures J(pi.n) == I(pub.n);\r\n ensures J(pi.e) == I(pub.e);\r\n{\r\n var nref := pi.n; //- do something real to pi.n so dafnycc knows it's allocated\r\n var eref := pi.e; //- do something real to pi.e so dafnycc knows it's allocated\r\n var recip_ref := if pi.nReciprocal.FNDivKnownReciprocal? then pi.nReciprocal.TwoTo32wDividedByD else pi.n; //- do something real to reciprocal for dafnycc\r\n\r\n var fn := FatNatToBigNat(pi.n);\r\n var fe := FatNatToBigNat(pi.e);\r\n pub := RSAPubKeyImpl_c(fn, pi.size, fe);\r\n}\r\n\r\nmethod RSAKeyPairFromInternal(kpi:RSAKeyPairImpl_internal) returns (kp:RSAKeyPairImpl)\r\n requires WellformedRSAKeyPairImpl_internal(kpi);\r\n ensures WellformedRSAKeyPairImpl(kp);\r\n ensures kpi.pub.size == kp.pub.size;\r\n ensures J(kpi.pub.n) == I(kp.pub.n);\r\n ensures J(kpi.pub.e) == I(kp.pub.e);\r\n ensures J(kpi.d) == I(kp.d);\r\n{\r\n var nref := kpi.pub.n; //- do something real to kpi.pub.n so dafnycc knows it's allocated\r\n var eref := kpi.pub.e; //- do something real to kpi.pub.e so dafnycc knows it's allocated\r\n var dref := kpi.d; //- do something real to kpi.d so dafnycc knows it's allocated\r\n var recip_ref := if kpi.pub.nReciprocal.FNDivKnownReciprocal? then kpi.pub.nReciprocal.TwoTo32wDividedByD else kpi.pub.n; //- do something real to reciprocal for dafnycc\r\n\r\n var pub := RSAPubKeyFromInternal(kpi.pub);\r\n var fd := FatNatToBigNat(kpi.d);\r\n kp := RSAKeyPairImpl_c(pub, fd);\r\n assert I(kp.pub.n) == J(kpi.pub.n); //- OBSERVE\r\n}\r\n\r\nmethod RSAInternalFromPubKey(pub:RSAPubKeyImpl) returns (pi:RSAPubKeyImpl_internal)\r\n requires WellformedRSAPubKeyImpl(pub);\r\n ensures WellformedRSAPubKeyImpl_internal(pi);\r\n ensures pi.size == pub.size;\r\n ensures J(pi.n) == I(pub.n);\r\n ensures J(pi.e) == I(pub.e);\r\n ensures PubKeyImplToSpec_internal(pi) == PubKeyImplToSpec(pub);\r\n{\r\n var bn := BigNatToFatNat(pub.n);\r\n var be := BigNatToFatNat(pub.e);\r\n var nReciprocal := FatNatComputeReciprocal(bn);\r\n var nReciprocal_ref := nReciprocal.TwoTo32wDividedByD; //- reference this array for DafnyCC's sake\r\n pi := RSAPubKeyImpl_c_internal(bn, pub.size, be, nReciprocal);\r\n}\r\n\r\nmethod RSAInternalFromKeyPair(kp:RSAKeyPairImpl) returns (kpi:RSAKeyPairImpl_internal)\r\n requires WellformedRSAKeyPairImpl(kp);\r\n ensures WellformedRSAKeyPairImpl_internal(kpi);\r\n ensures kpi.pub.size == kp.pub.size;\r\n ensures J(kpi.pub.n) == I(kp.pub.n);\r\n ensures J(kpi.pub.e) == I(kp.pub.e);\r\n ensures J(kpi.d) == I(kp.d);\r\n{\r\n var pi := RSAInternalFromPubKey(kp.pub);\r\n var nref := pi.n; //- do something real to pi.n so dafnycc knows it's allocated\r\n var eref := pi.e; //- do something real to pi.e so dafnycc knows it's allocated\r\n var recip_ref := if pi.nReciprocal.FNDivKnownReciprocal? then pi.nReciprocal.TwoTo32wDividedByD else pi.n; //- do something real to reciprocal for dafnycc\r\n\r\n var bd := BigNatToFatNat(kp.d);\r\n kpi := RSAKeyPairImpl_c_internal(pi, bd);\r\n assert J(pi.n) == I(kp.pub.n);\r\n assert J(pi.e) == I(kp.pub.e);\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nmethod GenDummyKey() returns (key_pair:RSAKeyPairImpl)\r\n{\r\n var zilch := MakeSmallLiteralBigNat(0);\r\n key_pair := RSAKeyPairImpl_c(RSAPubKeyImpl_c(zilch, 0, zilch), zilch);\r\n}\r\n\r\nfunction KV(X:BigNat) : int\r\n requires WellformedBigNat(X);\r\n{\r\n I(X)\r\n}\r\n\r\nmethod RSAKeyGen(keybits:nat) returns (key:RSAKeyPairImpl)\r\n requires 20= power2(keybits);\r\n ensures key.pub.size >= keybits / 8;\r\n ensures RSAKeyGenerationValid(keybits, KeyPairImplToSpec(key), TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index));\r\n{\r\n var kpi := RSAKeyGen_internal(keybits);\r\n var nref := kpi.pub.n; //- do something real to kpi.pub.n so dafnycc knows it's allocated\r\n var eref := kpi.pub.e; //- do something real to kpi.pub.e so dafnycc knows it's allocated\r\n var dref := kpi.d; //- do something real to kpi.d so dafnycc knows it's allocated\r\n var recip_ref := if kpi.pub.nReciprocal.FNDivKnownReciprocal? then kpi.pub.nReciprocal.TwoTo32wDividedByD else kpi.pub.n; //- do something real to reciprocal for dafnycc\r\n\r\n key := RSAKeyPairFromInternal(kpi);\r\n assert KeyPairImplToSpec(key)==KeyPairImplToSpec_internal(kpi);\r\n assert RSAKeyGenerationValid(keybits, KeyPairImplToSpec(key), TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index));\r\n calc {\r\n KV(key.pub.n);\r\n J(kpi.pub.n);\r\n >=\r\n power2(keybits);\r\n }\r\n}\r\n\r\nmethod rfc4251_encode_sshrsa_pubkey(pubkey:RSAPubKeyImpl) returns (msg:seq)\r\n requires ModestKeyValue(pubkey.e);\r\n requires ModestKeyValue(pubkey.n);\r\n requires WellformedRSAPubKeyImpl(pubkey);\r\n ensures IsByteSeq(msg);\r\n ensures PubKeyImplToSpec(pubkey).e < power2(power2(34));\r\n ensures PubKeyImplToSpec(pubkey).n < power2(power2(34));\r\n ensures msg == rfc4251_sshrsa_pubkey_encoding_premium(PubKeyImplToSpec(pubkey));\r\n{\r\n var kpi := RSAInternalFromPubKey(pubkey);\r\n var nref := kpi.n; //- do something real to kpi.n so dafnycc knows it's allocated\r\n var eref := kpi.e; //- do something real to kpi.e so dafnycc knows it's allocated\r\n var recip_ref := if kpi.nReciprocal.FNDivKnownReciprocal? then kpi.nReciprocal.TwoTo32wDividedByD else kpi.n; //- do something real to reciprocal for dafnycc\r\n\r\n msg := rfc4251_encode_sshrsa_pubkey_internal(kpi);\r\n}\r\n\r\nmethod rfc4251_decode_sshrsa(msg:seq) returns (success:bool, pubkey:RSAPubKeyImpl)\r\n requires IsByteSeq(msg);\r\n requires Word32(|msg|);\r\n requires public(msg);\r\n ensures WellformedRSAPubKeyImpl(pubkey);\r\n ensures success ==> PubKeyImplToSpec(pubkey).e < power2(power2(34));\r\n ensures success ==> PubKeyImplToSpec(pubkey).n < power2(power2(34));\r\n ensures success ==> (msg == rfc4251_sshrsa_pubkey_encoding_premium(PubKeyImplToSpec(pubkey)));\r\n ensures public(success);\r\n ensures public(pubkey.size);\r\n ensures public(KV(pubkey.n));\r\n ensures public(KV(pubkey.e));\r\n{\r\n var pi;\r\n success,pi := rfc4251_decode_sshrsa_internal(msg);\r\n var nref := pi.n; //- do something real to pi.n so dafnycc knows it's allocated\r\n var eref := pi.e; //- do something real to pi.e so dafnycc knows it's allocated\r\n var recip_ref := if pi.nReciprocal.FNDivKnownReciprocal? then pi.nReciprocal.TwoTo32wDividedByD else pi.n; //- do something real to reciprocal for dafnycc\r\n\r\n pubkey := RSAPubKeyFromInternal(pi);\r\n assert PubKeyImplToSpec(pubkey) == PubKeyImplToSpec_internal(pi);\r\n}\r\n\r\nmethod rfc4251_encode_mpint_legacy(V:BigNat) returns (msg:seq)\r\n requires ModestBigNatValue(V);\r\n ensures KV(V) < power2(power2(34));\r\n ensures IsByteSeq(msg);\r\n ensures msg == rfc4251_mpint_encoding_premium(KV(V));\r\n{\r\n var vfn := BigNatToFatNat(V);\r\n msg := rfc4251_encode_mpint(vfn);\r\n}\r\n\r\nmethod rfc4251_decode_mpint_legacy(msg:seq) returns (success:bool,V:BigNat,bytes_consumed:int)\r\n requires IsByteSeq(msg);\r\n requires public(msg);\r\n ensures ModestKeyValue(V);\r\n ensures I(V) < power2(power2(34));\r\n ensures 0 <= bytes_consumed <= |msg|;\r\n ensures success ==> (msg[..bytes_consumed] == rfc4251_mpint_encoding_premium(KV(V)));\r\n ensures public(success);\r\n ensures public(I(V));\r\n ensures public(bytes_consumed);\r\n{\r\n var vfn;\r\n success,vfn,bytes_consumed := rfc4251_decode_mpint(msg);\r\n V := FatNatToBigNat(vfn);\r\n}\r\n\r\nmethod Decrypt(key:RSAKeyPairImpl, ciphertext:seq) returns (result:bool, plaintext:seq)\r\n requires WellformedRSAKeyPairImpl(key);\r\n requires IsByteSeq(ciphertext);\r\n requires |ciphertext|>0;\r\n//- requires |ciphertext|%4==0;\r\n \r\n \r\n \r\n \r\n \r\n ensures WellformedRSAKeyPairSpec(KeyPairImplToSpec(key));\r\n ensures result ==> (IsByteSeq(plaintext) && RSADecryptionRelation(KeyPairImplToSpec(key), ciphertext, plaintext));\r\n ensures !result ==>\r\n forall any_plaintext :: !(IsByteSeq(any_plaintext) && RSADecryptionRelation(KeyPairImplToSpec(key), ciphertext, any_plaintext));\r\n{\r\n var kpi := RSAInternalFromKeyPair(key);\r\n var nref := kpi.pub.n; //- do something real to kpi.pub.n so dafnycc knows it's allocated\r\n var eref := kpi.pub.e; //- do something real to kpi.pub.e so dafnycc knows it's allocated\r\n var dref := kpi.d; //- do something real to kpi.d so dafnycc knows it's allocated\r\n var recip_ref := if kpi.pub.nReciprocal.FNDivKnownReciprocal? then kpi.pub.nReciprocal.TwoTo32wDividedByD else kpi.pub.n; //- do something real to reciprocal for dafnycc\r\n\r\n result,plaintext := Decrypt_internal(kpi, ciphertext);\r\n}\r\n\r\nmethod Encrypt(pubkey:RSAPubKeyImpl, plaintext:seq) returns (ciphertext:seq)\r\n requires IsByteSeq(plaintext);\r\n requires WellformedRSAPubKeyImpl(pubkey);\r\n requires |plaintext| <= pubkey.size - 11;\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures WellformedRSAPubKeySpec(PubKeyImplToSpec(pubkey));\r\n ensures IsByteSeq(ciphertext);\r\n ensures exists padding:seq ::\r\n RSAEncryptionRequires(PubKeyImplToSpec(pubkey), plaintext, padding)\r\n && RSAEncryption(PubKeyImplToSpec(pubkey), plaintext, padding) == ciphertext;\r\n{\r\n var pi := RSAInternalFromPubKey(pubkey);\r\n var nref := pi.n; //- do something real to pi.n so dafnycc knows it's allocated\r\n var eref := pi.e; //- do something real to pi.e so dafnycc knows it's allocated\r\n var recip_ref := if pi.nReciprocal.FNDivKnownReciprocal? then pi.nReciprocal.TwoTo32wDividedByD else pi.n; //- do something real to reciprocal for dafnycc\r\n\r\n ciphertext := Encrypt_internal(pi, plaintext);\r\n}\r\n\r\nmethod DigestedSign(key:RSAKeyPairImpl, message:seq) returns (signature:seq)\r\n requires WellformedRSAKeyPairImpl(key);\r\n requires IsByteSeq(message);\r\n requires |message| < power2(28);\r\n requires RSA_DIGEST_MIN_KEY_SIZE() <= key.pub.size;\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures TPM==old(TPM);\r\n ensures IoMemPerm==old(IoMemPerm);\r\n ensures RSASignatureRequires(KeyPairImplToSpec(key), message);\r\n ensures IsByteSeq(signature);\r\n ensures RSASignature(KeyPairImplToSpec(key), message) == signature;\r\n ensures |signature|, signature:seq) returns (verifies:bool)\r\n requires WellformedRSAPubKeyImpl(pubkey);\r\n requires RSA_DIGEST_MIN_KEY_SIZE() <= pubkey.size < power2(60);\r\n requires IsByteSeq(message);\r\n//- requires |message| < power2(61);\r\n requires |message| < power2(28);\r\n requires IsByteSeq(signature);\r\n requires |signature| == pubkey.size;\r\n//- requires signature[0] == 0;\r\n requires TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPM_ready();\r\n ensures TPM==old(TPM);\r\n ensures IoMemPerm==old(IoMemPerm);\r\n ensures WellformedRSAPubKeySpec(PubKeyImplToSpec(pubkey));\r\n ensures verifies <==> (\r\n RSAVerificationRelationRequires(PubKeyImplToSpec(pubkey), message, signature)\r\n && RSAVerificationRelation(PubKeyImplToSpec(pubkey), message, signature));\r\n{\r\n var pi := RSAInternalFromPubKey(pubkey);\r\n var nref := pi.n; //- do something real to pi.n so dafnycc knows it's allocated\r\n var eref := pi.e; //- do something real to pi.e so dafnycc knows it's allocated\r\n var recip_ref := if pi.nReciprocal.FNDivKnownReciprocal? then pi.nReciprocal.TwoTo32wDividedByD else pi.n; //- do something real to reciprocal for dafnycc\r\n\r\n verifies := DigestedVerify_internal(pi, message, signature);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/RSASpec.s.dfy", "content": "include \"../Hash/Digest.s.dfy\"\r\ninclude \"../../Math/power.s.dfy\"\r\ninclude \"MillerRabin.s.dfy\"\r\ninclude \"../../Math/GCD.s.dfy\"\r\ninclude \"KeyGen.s.dfy\"\r\n\r\ndatatype PadMode = PadModeEncrypt() | PadModeSign();\r\n\r\nstatic function method BlockType(pad_mode:PadMode) : int\r\n{\r\n if (pad_mode.PadModeSign?) then 1 else 2\r\n}\r\n\r\nstatic function method SignaturePadByte() : int { 0xff }\r\n\r\nstatic predicate PaddedMessageStartIndex(padded_msg:seq, i:nat, pad_mode:PadMode, padding:seq)\r\n{\r\n IsByteSeq(padded_msg)\r\n && 0 < i <= |padded_msg|\r\n && 2 <= |padded_msg|\r\n && IsByteSeq(padding)\r\n && (forall j :: 0 <= j < |padding| ==> padding[j]!=0)\r\n && padded_msg[0]==0\r\n && padded_msg[1]==BlockType(pad_mode)\r\n && 2, msg:seq, pad_mode:PadMode, padding:seq)\r\n requires IsByteSeq(padded_msg);\r\n requires IsByteSeq(msg);\r\n{\r\n |padding| >= 8\r\n && PaddedMessageStartIndex(padded_msg, |padding|+3, pad_mode, padding)\r\n && padded_msg[|padding|+3..] == msg\r\n}\r\n\r\nstatic predicate PKCS15_PaddingRelation(padded_msg:seq, msg:seq, pad_mode:PadMode)\r\n requires IsByteSeq(padded_msg); \r\n requires IsByteSeq(msg);\r\n{\r\n exists padding:seq :: PKCS15_PaddingRelationWith(padded_msg, msg, pad_mode, padding)\r\n}\r\n\r\nstatic function PadCount(msg:seq, k:nat) : int\r\n { k - 3 - |msg| }\r\n\r\nstatic predicate NonzeroPad(padding:seq)\r\n{\r\n forall i :: 0 <= i < |padding| ==> padding[i] != 0\r\n}\r\n\r\n\r\n\r\n\r\n\r\n\r\nstatic function PKCS15_EncryptionPad(msg:seq, k:nat, padding:seq) : seq\r\n requires IsByteSeq(msg);\r\n requires IsByteSeq(padding);\r\n requires |padding| == PadCount(msg, k);\r\n requires NonzeroPad(padding);\r\n requires PadCount(msg, k) >= 8;\r\n //- lemma proves PKCS15_PaddingRelation(PKCS15_EncryptionPad(msg), msg, PadModeEncrypt())\r\n{\r\n [0, BlockType(PadModeEncrypt())] + padding + [0] + msg\r\n}\r\n\r\nstatic function PKCS15_SignaturePad(msg:seq, k:nat) : seq\r\n requires IsByteSeq(msg);\r\n requires PadCount(msg, k) >= 8;\r\n //- lemma proves PKCS15_PaddingRelation(PKCS15_SignaturePad(msg), msg, PadModeSign())\r\n{\r\n [0, BlockType(PadModeSign())] + RepeatDigit(SignaturePadByte(), PadCount(msg,k)) + [0] + msg\r\n}\r\n\r\ndatatype RSAPubKeySpec = RSAPublicKeySpec_c(\r\n n:nat, //- modulus\r\n size:nat,\r\n e:nat //- public key exponent\r\n );\r\n\r\nstatic predicate KeyModulusMatchesSizeInBytes(n:nat, k:nat)\r\n{\r\n (k>0 ==> power2(8*(k-1)) <= n)\r\n && n < power2(8*k)\r\n}\r\n\r\nstatic predicate WellformedRSAPubKeySpec(pubkey:RSAPubKeySpec)\r\n{\r\n 0 < pubkey.n\r\n && KeyModulusMatchesSizeInBytes(pubkey.n, pubkey.size)\r\n}\r\n\r\ndatatype RSAKeyPairSpec = RSAKeyPairSpec_c(\r\n pub:RSAPubKeySpec,\r\n d:nat //- private key exponent\r\n );\r\n\r\nstatic predicate WellformedRSAKeyPairSpec(key:RSAKeyPairSpec)\r\n{\r\n WellformedRSAPubKeySpec(key.pub)\r\n}\r\n\r\nstatic function {:autoReq} RSAEncryption(pubkey:RSAPubKeySpec, msg:seq, padding:seq) : seq\r\n requires WellformedRSAPubKeySpec(pubkey);\r\n{\r\n var pad_msg :=\r\n BEByteSeqToInt(PKCS15_EncryptionPad(msg, pubkey.size, padding));\r\n\r\n BEIntToByteSeq(power(pad_msg, pubkey.e) % pubkey.n)\r\n}\r\n\r\n//- predicate form is appropriate here, where we don't actually know\r\n//- the value of the padding (and can't, until it's decrypted!)\r\n\r\nstatic predicate {:autoReq} RSADecryptionRelation(key:RSAKeyPairSpec, ciphertext:seq, msg:seq)\r\n{\r\n var cipher_n := BEByteSeqToInt(ciphertext);\r\n\r\n WellformedRSAKeyPairSpec(key)\r\n && cipher_n < key.pub.n //- Decrypter MUST ignore aliased ciphertexts.\r\n && exists padding:seq :: (\r\n var padded_msg_n := BEByteSeqToInt(PKCS15_EncryptionPad(msg, key.pub.size, padding));\r\n power(cipher_n, key.d) % key.pub.n == padded_msg_n)\r\n}\r\n\r\nstatic function {:autoReq} RSASignature(key:RSAKeyPairSpec, message:seq) : seq\r\n requires WellformedRSAKeyPairSpec(key);\r\n{\r\n var padded_nint := BEByteSeqToInt(PKCS15_SignaturePad(SHA256Digest(message), key.pub.size));\r\n BEIntToDigitSeq(power2(8), key.pub.size, power(padded_nint, key.d) % key.pub.n)\r\n}\r\n\r\n//- predicate form is appropriate here, because that's the actual output.\r\n\r\nstatic predicate {:autoReq} RSAVerificationRelation(pubkey:RSAPubKeySpec, message:seq, signature:seq)\r\n{\r\n var sig_n := BEByteSeqToInt(signature);\r\n var padded_msg_n := BEByteSeqToInt(PKCS15_SignaturePad(SHA256Digest(message), pubkey.size));\r\n\r\n WellformedRSAPubKeySpec(pubkey)\r\n && sig_n != 0\r\n && |signature| == pubkey.size\r\n && sig_n < pubkey.n //- disallow \"alias\" signatures (sig_n + k * pubkey.n)\r\n && power(sig_n, pubkey.e) % pubkey.n == padded_msg_n\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//------------------------------------------------------------//\r\n\r\ndatatype RSAKeyGenerationWorksheetRow = RSAKeyGenerationWorksheetRow_c(\r\n P:PrimeGenerationWorksheet,\r\n Q:PrimeGenerationWorksheet,\r\n accepted:bool,\r\n randoms:seq);\r\n\r\nstatic function RSA_public_exponent() : int { 65537 }\r\n\r\nstatic predicate {:autoReq} RSAKeyAccepted(row:RSAKeyGenerationWorksheetRow)\r\n{\r\n var phi_n := (PrimeGenerationOutput(row.P)-1) * (PrimeGenerationOutput(row.Q)-1);\r\n if (phi_n < 0) then\r\n false //- case shouldn't occur, but don't want to prove that here.\r\n else\r\n is_gcd(phi_n, RSA_public_exponent(), 1)\r\n}\r\n\r\nstatic predicate {:autoReq} RSAKeyGenerationWorksheetRowValid(keybits:int, row:RSAKeyGenerationWorksheetRow)\r\n{\r\n var halfbits := keybits/2 + 2;\r\n PrimeGenerationWorksheetValid(halfbits, row.P)\r\n && PrimeGenerationWorksheetValid(halfbits, row.Q)\r\n && row.accepted == RSAKeyAccepted(row)\r\n && row.randoms == row.P.randoms + row.Q.randoms\r\n}\r\n\r\n//------------------------------------------------------------//\r\n\r\ndatatype RSAKeyGenerationWorksheet = RSAKeyGenerationWorksheet_c(\r\n keybits:int,\r\n rows:seq,\r\n randoms:seq,\r\n p:int,\r\n q:int,\r\n phi:int,\r\n n:int\r\n );\r\n\r\nstatic function RSAKeyGenerationWorksheetConsumesRandoms(rows:seq) : seq\r\n{\r\n if (rows==[]) then\r\n []\r\n else\r\n RSAKeyGenerationWorksheetConsumesRandoms(rows[..|rows|-1]) + rows[|rows|-1].randoms\r\n}\r\n\r\nstatic predicate RSAKeyGenerationWorksheetSummaryValid(worksheet:RSAKeyGenerationWorksheet)\r\n requires 0 < |worksheet.rows|;\r\n{\r\n var final := worksheet.rows[|worksheet.rows|-1];\r\n worksheet.rows[|worksheet.rows|-1].accepted\r\n && 0 < |final.P.rows|\r\n && worksheet.p == PrimeGenerationOutput(final.P)\r\n && 0 < |final.Q.rows|\r\n && worksheet.q == PrimeGenerationOutput(final.Q)\r\n && worksheet.phi == (worksheet.p-1)*(worksheet.q-1)\r\n && worksheet.phi != 0\r\n && worksheet.n == worksheet.p*worksheet.q\r\n}\r\n\r\nstatic predicate {:autoReq} RSAKeyGenerationWorksheetValid(keybits:int, worksheet:RSAKeyGenerationWorksheet)\r\n{\r\n worksheet.keybits == keybits\r\n && (forall i :: 0 <= i < |worksheet.rows| ==> RSAKeyGenerationWorksheetRowValid(worksheet.keybits, worksheet.rows[i]))\r\n && (forall i :: 0 <= i < |worksheet.rows|-1 ==> !worksheet.rows[i].accepted)\r\n && RSAKeyGenerationWorksheetConsumesRandoms(worksheet.rows) == worksheet.randoms\r\n && 0<|worksheet.rows|\r\n && RSAKeyGenerationWorksheetSummaryValid(worksheet)\r\n}\r\n\r\nstatic predicate {:autoReq} RSAKeyConsistentWithWorksheet(requested_keybits:int, key:RSAKeyPairSpec, worksheet:RSAKeyGenerationWorksheet)\r\n{\r\n WellformedRSAKeyPairSpec(key)\r\n && RSAKeyGenerationWorksheetValid(requested_keybits, worksheet)\r\n && key.pub.n == worksheet.p * worksheet.q\r\n && key.pub.e == RSA_public_exponent()\r\n && key.pub.size >= requested_keybits / 8\r\n && (key.d * key.pub.e) % worksheet.phi == 1\r\n}\r\n\r\nstatic predicate {:autoReq} RSAKeyGenerationValid(requested_keybits:int, key:RSAKeyPairSpec, randoms:seq)\r\n{\r\n exists worksheet:RSAKeyGenerationWorksheet ::\r\n RSAKeyConsistentWithWorksheet(requested_keybits, key, worksheet) && worksheet.randoms == randoms\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/RSA_Decrypt.i.dfy", "content": "include \"RSASpec.s.dfy\"\r\ninclude \"../Hash/Digest.i.dfy\"\r\ninclude \"../../BigNum/BigNum.i.dfy\"\r\ninclude \"../../BigNum/BigNatDiv.i.dfy\"\r\ninclude \"../../BigNum/BigNatMod.i.dfy\"\r\ninclude \"KeyGen.i.dfy\"\r\ninclude \"BlockEncoding.i.dfy\"\r\ninclude \"KeyImpl.i.dfy\"\r\ninclude \"RSA.i.dfy\"\r\ninclude \"RSAOps.i.dfy\"\r\n\r\nstatic function PKCS15_EncryptionPad_premium(msg:seq, k:nat, padding:seq) : seq\r\n requires IsByteSeq(msg);\r\n requires IsByteSeq(padding);\r\n requires |padding| == PadCount(msg, k);\r\n requires NonzeroPad(padding);\r\n requires PadCount(msg, k) >= 8;\r\n ensures IsByteSeq(PKCS15_EncryptionPad_premium(msg, k, padding));\r\n{\r\n lemma_PKCS15_EncryptionPad(msg, k, padding);\r\n PKCS15_EncryptionPad(msg, k, padding)\r\n}\r\n\r\nlemma lemma_zero_ciphertexts_do_not_decrypt(key:RSAKeyPairImpl_internal, ciphertext:seq, cipherN:array)\r\n requires WellformedRSAKeyPairImpl_internal(key);\r\n requires IsByteSeq(ciphertext);\r\n requires |ciphertext|>0;\r\n requires WellformedFatNat(cipherN);\r\n requires J(cipherN) == BEByteSeqToInt(ciphertext);\r\n requires J(cipherN)==0;\r\n ensures forall any_plaintext :: !RSADecryptionRelation(KeyPairImplToSpec_internal(key), ciphertext, any_plaintext);\r\n{\r\n forall (any_plaintext |\r\n IsByteSeq(any_plaintext))\r\n ensures !RSADecryptionRelation(KeyPairImplToSpec_internal(key), ciphertext, any_plaintext);\r\n {\r\n forall (padding |\r\n IsByteSeq(padding)\r\n && |padding| == PadCount(any_plaintext, key.pub.size)\r\n && NonzeroPad(padding)\r\n && PadCount(any_plaintext, key.pub.size) >= 8)\r\n ensures\r\n var padded_msg_n := BEByteSeqToInt(PKCS15_EncryptionPad_premium(any_plaintext, key.pub.size, padding));\r\n power(J(cipherN), J(key.d)) % J(key.pub.n) != padded_msg_n;\r\n {\r\n var padded_msg := PKCS15_EncryptionPad_premium(any_plaintext, key.pub.size, padding);\r\n var padtail := padded_msg[1..];\r\n assert padtail[0]==2;\r\n\r\n var padded_msg_n := BEByteSeqToInt(padded_msg);\r\n var L0 := 0;\r\n var L1 := 1;\r\n assert J(cipherN) == 0;\r\n\r\n if (J(key.d)==0)\r\n {\r\n //- This case isn't really meaningful, but our spec doesn't currently disallow it.\r\n calc {\r\n power(J(cipherN), J(key.d)) % J(key.pub.n);\r\n { reveal_power(); }\r\n L1 % J(key.pub.n);\r\n <= { lemma_mod_decreases(L1, J(key.pub.n)); }\r\n 1;\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n power(J(cipherN), J(key.d)) % J(key.pub.n);\r\n { lemma_0_power(J(key.d)); }\r\n L0 % J(key.pub.n);\r\n { lemma_small_mod(L0, J(key.pub.n)); }\r\n L0;\r\n 0;\r\n }\r\n }\r\n calc\r\n {\r\n power(J(cipherN), J(key.d)) % J(key.pub.n);\r\n <\r\n 2;\r\n { lemma_mul_is_mul_boogie(1, 2); }\r\n mul(1, 2);\r\n <= {\r\n lemma_power_positive(power2(8), |padtail|-1);\r\n lemma_mul_inequality_forall();\r\n }\r\n mul(power(power2(8), |padtail|-1), 2);\r\n { lemma_mul_is_commutative_forall(); }\r\n mul(2, power(power2(8), |padtail|-1));\r\n <= { lemma_BEDigitSeqToInt_bound(power2(8), padtail); }\r\n BEByteSeqToInt(padtail);\r\n { lemma_LeadingZeros(power2(8), padtail, padded_msg); }\r\n BEByteSeqToInt(padded_msg);\r\n padded_msg_n;\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_mispadded_plaintexts_do_not_decrypt(key:RSAKeyPairImpl_internal, ciphertext:seq, cipherN:array, plainN:array)\r\n requires WellformedRSAKeyPairImpl_internal(key);\r\n requires IsByteSeq(ciphertext);\r\n requires |ciphertext|>0;\r\n requires WellformedFatNat(cipherN);\r\n requires WellformedFatNat(plainN);\r\n requires J(cipherN) == BEByteSeqToInt(ciphertext);\r\n requires J(plainN)==power(J(cipherN),J(key.d)) % J(key.pub.n);\r\n requires !CanDecodeFatInteger(plainN, key.pub.size, PadModeEncrypt());\r\n ensures forall any_plaintext :: !RSADecryptionRelation(KeyPairImplToSpec_internal(key), ciphertext, any_plaintext);\r\n{\r\n forall (any_plaintext | IsByteSeq(any_plaintext))\r\n ensures !RSADecryptionRelation(KeyPairImplToSpec_internal(key), ciphertext, any_plaintext);\r\n {\r\n forall (padding |\r\n IsByteSeq(padding)\r\n && |padding| == PadCount(any_plaintext, key.pub.size)\r\n && NonzeroPad(padding)\r\n && PadCount(any_plaintext, key.pub.size) >= 8)\r\n ensures\r\n var padded_msg_n := BEByteSeqToInt(PKCS15_EncryptionPad_premium(any_plaintext, key.pub.size, padding));\r\n power(J(cipherN), J(key.d)) % J(key.pub.n) != padded_msg_n;\r\n {\r\n var pm := PKCS15_EncryptionPad_premium(any_plaintext, key.pub.size, padding);\r\n assert !IsByteSeq(pm)\r\n || !IsByteSeq(any_plaintext)\r\n || !PKCS15_PaddingRelation(pm, any_plaintext, PadModeEncrypt())\r\n || !(BigEndianIntegerValue(pm)==J(plainN))\r\n || !(|pm|==key.pub.size); //- OBSERVE\r\n\r\n var padded_msg_n := BEByteSeqToInt(PKCS15_EncryptionPad_premium(any_plaintext, key.pub.size, padding));\r\n if (power(J(cipherN), J(key.d)) % J(key.pub.n) == padded_msg_n)\r\n {\r\n lemma_BigEndianIntegerValue_equals_BEByteSeqToInt(pm);\r\n assert !PKCS15_PaddingRelationWith(pm, any_plaintext, PadModeEncrypt(), padding); //- OBSERVE\r\n //- assert false; //- This is a contradiction.\r\n }\r\n }\r\n }\r\n}\r\n\r\nmethod{:dafnycc_conservative_seq_triggers} Decrypt_internal(key:RSAKeyPairImpl_internal, ciphertext:seq) returns (result:bool, plaintext:seq)\r\n requires WellformedRSAKeyPairImpl_internal(key);\r\n requires IsByteSeq(ciphertext);\r\n requires |ciphertext|>0;\r\n//- requires |ciphertext|%4==0;\r\n \r\n \r\n \r\n \r\n \r\n ensures WellformedRSAKeyPairSpec(KeyPairImplToSpec_internal(key));\r\n ensures result ==> (IsByteSeq(plaintext) && RSADecryptionRelation(KeyPairImplToSpec_internal(key), ciphertext, plaintext));\r\n ensures !result ==>\r\n forall any_plaintext :: !(IsByteSeq(any_plaintext) && RSADecryptionRelation(KeyPairImplToSpec_internal(key), ciphertext, any_plaintext));\r\n{\r\n var nref := key.pub.n; //- do something real to key.pub.n so dafnycc knows it's allocated\r\n var eref := key.pub.e; //- do something real to key.pub.e so dafnycc knows it's allocated\r\n var dref := key.d; //- do something real to key.d so dafnycc knows it's allocated\r\n var recip_ref := if key.pub.nReciprocal.FNDivKnownReciprocal? then key.pub.nReciprocal.TwoTo32wDividedByD else key.pub.n; //- dafnycc\r\n\r\n var plaintext_raw := [];\r\n plaintext := []; //- dafnycc: initialize variable\r\n\r\n var cipherN:array := BESeqToInteger(ciphertext);\r\n assert WellformedFatNat(cipherN);\r\n\r\n var ciphertext_too_big:bool := FatNatGe(cipherN, key.pub.n);\r\n\r\n var cipherZero := FatNatIsZero(cipherN);\r\n if (cipherZero)\r\n {\r\n lemma_zero_ciphertexts_do_not_decrypt(key, ciphertext, cipherN);\r\n result := false;\r\n }\r\n else if (ciphertext_too_big)\r\n {\r\n //- basic condition of spec\r\n forall (any_plaintext |\r\n IsByteSeq(any_plaintext))\r\n ensures !RSADecryptionRelation(KeyPairImplToSpec_internal(key), ciphertext, any_plaintext);\r\n {\r\n }\r\n result := false;\r\n }\r\n else\r\n {\r\n assert J(cipherN) < J(key.pub.n); //- we just checked.\r\n\r\n var plainN:array := InnerDecrypt(key, cipherN);\r\n ghost var padded_plaintext:seq;\r\n var success:bool;\r\n success,plaintext_raw,padded_plaintext := IntegerToMessage(plainN, key.pub.size, PadModeEncrypt());\r\n\r\n if (!success) {\r\n lemma_mispadded_plaintexts_do_not_decrypt(key, ciphertext, cipherN, plainN);\r\n result := false;\r\n }\r\n else {\r\n result := true;\r\n plaintext := DecryptCommonCase(KeyPairImplToSpec_internal(key), ciphertext, J(cipherN), J(plainN), plaintext_raw, padded_plaintext);\r\n assert 0, ghost cipherN:int,\r\n ghost plainN:int, plaintext_raw:seq, ghost padded_plaintext:seq)\r\n returns (plaintext:seq)\r\n requires WellformedRSAKeyPairSpec(key);\r\n requires IsByteSeq(ciphertext);\r\n requires |ciphertext|>0;\r\n requires 0 < cipherN < key.pub.n;\r\n requires cipherN == BigEndianIntegerValue(ciphertext);\r\n requires 0 <= plainN < key.pub.n;\r\n requires plainN == power(cipherN, key.d) % key.pub.n;\r\n requires IsByteSeq(plaintext_raw);\r\n requires IsByteSeq(padded_plaintext);\r\n requires PKCS15_PaddingRelation(padded_plaintext, plaintext_raw, PadModeEncrypt());\r\n requires BigEndianIntegerValue(padded_plaintext) == plainN;\r\n requires |padded_plaintext| == key.pub.size;\r\n ensures IsByteSeq(plaintext);\r\n ensures RSADecryptionRelation(key, ciphertext, plaintext);\r\n{\r\n ghost var padding:seq :| PKCS15_PaddingRelationWith(padded_plaintext, plaintext_raw, PadModeEncrypt(), padding);\r\n lemma_about_PKCS15_PaddingRelationWith(padded_plaintext, plaintext_raw, PadModeEncrypt(), padding);\r\n assert padded_plaintext == [0] + [BlockType(PadModeEncrypt())] + padding + [0] + plaintext_raw;\r\n\r\n plaintext := plaintext_raw;\r\n assert IsByteSeq(padded_plaintext);\r\n\r\n calc {\r\n power(BigEndianIntegerValue(ciphertext), key.d) % key.pub.n;\r\n power(cipherN, key.d) % key.pub.n;\r\n plainN;\r\n BigEndianIntegerValue(padded_plaintext);\r\n }\r\n\r\n assert power(BigEndianIntegerValue(ciphertext), key.d) % key.pub.n\r\n == BigEndianIntegerValue(padded_plaintext);\r\n assert PKCS15_PaddingRelation(padded_plaintext, plaintext_raw, PadModeEncrypt());\r\n\r\n //- proving RSADecryptionRelation(key, ciphertext, plaintext)\r\n ghost var padding_n := padding;\r\n ghost var ep := PKCS15_EncryptionPad(plaintext, key.pub.size, padding_n);\r\n\r\n lemma_PKCS15_EncryptionPad(plaintext, key.pub.size, padding_n);\r\n assert IsByteSeq(ep);\r\n\r\n ghost var cipher_n := BEByteSeqToInt(ciphertext);\r\n ghost var padded_msg_n := BEByteSeqToInt(ep);\r\n assert IsByteSeq(ep);\r\n calc { \r\n padded_plaintext;\r\n [0] + [BlockType(PadModeEncrypt())] + padding + [0] + plaintext_raw;\r\n [0] + [BlockType(PadModeEncrypt())] + padding_n + [0] + plaintext;\r\n { lemma_obvious_concatenation(0, BlockType(PadModeEncrypt())); }\r\n [0, BlockType(PadModeEncrypt())] + padding_n + [0] + plaintext;\r\n ep;\r\n }\r\n\r\n calc {\r\n cipher_n;\r\n BEByteSeqToInt(ciphertext);\r\n { lemma_BigEndianIntegerValue_equals_BEByteSeqToInt(ciphertext); }\r\n BigEndianIntegerValue(ciphertext);\r\n cipherN;\r\n }\r\n\r\n calc { \r\n power(cipher_n, key.d) % key.pub.n;\r\n power(cipherN, key.d) % key.pub.n;\r\n plainN;\r\n calc {\r\n plainN;\r\n BigEndianIntegerValue(padded_plaintext);\r\n { lemma_BigEndianIntegerValue_equals_BEByteSeqToInt(padded_plaintext); }\r\n BEByteSeqToInt(ep);\r\n padded_msg_n;\r\n }\r\n padded_msg_n;\r\n }\r\n assert power(cipher_n, key.d) % key.pub.n == padded_msg_n;\r\n assert RSADecryptionRelation(key, ciphertext, plaintext);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/division.i.dfy", "content": "include \"../../Math/div.i.dfy\"\r\ninclude \"../../Math/GCD.s.dfy\"\r\n\r\n\r\nstatic lemma lemma_anything_divides_itself(a:nat)\r\n requires a != 0;\r\n ensures divides(a, a);\r\n{\r\n lemma_mod_properties();\r\n assert a % a == 0;\r\n}\r\n\r\nstatic lemma lemma_anything_divides_zero(a:nat)\r\n requires a != 0;\r\n ensures divides(a, 0);\r\n{\r\n lemma_mod_is_mod_recursive_forall();\r\n}\r\n\r\nstatic lemma lemma_nothing_bigger_divides(a:nat)\r\n requires 0 !divides(x,a);\r\n{\r\n forall (x | a\r\n{\r\n BEWordSeqToByteSeq([w])\r\n}\r\n\r\nstatic function {:autoReq} rfc4251_string_encoding(s:seq) : seq\r\n //- NB caller responsible to check that the result IsByteSeq().\r\n{\r\n rfc4251_word32_encoding(|s|) + s\r\n}\r\n\r\n//- RFC4251 allows for encoding negative numbers two's-complement,\r\n//- and thus mandates how we encode positive numbers that use the top bit.\r\nstatic predicate rfc4251_positive_twoscomplement(s:seq)\r\n{\r\n (|s|==0\r\n || 01 && s[1]>=128))\r\n}\r\n\r\n//- Takes a normalized natural-valued seq (left byte nonzero) and returns\r\n//- an equivalently-valued rfc4251 twoscomplement number satisfying\r\n//- rfc4251_positive_twoscomplement().\r\nstatic function rfc4251_positive_to_twoscomplement(s:seq) : seq\r\n{\r\n if |s|==0 || s[0]<128 then\r\n s\r\n else\r\n [0]+s\r\n}\r\n\r\nstatic function {:autoReq} rfc4251_mpint_encoding(v:nat) : seq\r\n{\r\n var tc := rfc4251_positive_to_twoscomplement(BEIntToByteSeq(v));\r\n rfc4251_word32_encoding(|tc|) + tc\r\n}\r\n\r\nstatic function method STR_SSH_RSA() : seq\r\n //-ensures ByteSeq(STR_SSH_RSA())\r\n{\r\n \r\n //- This sequence is the string \"ssh-rsa\"\r\n [115, 115, 104, 45, 114, 115, 97]\r\n}\r\n\r\nstatic function {:autoReq} rfc4251_sshrsa_encoding(e:nat, n:nat) : seq\r\n{\r\n rfc4251_string_encoding(STR_SSH_RSA())\r\n + rfc4251_mpint_encoding(e)\r\n + rfc4251_mpint_encoding(n)\r\n}\r\n\r\nstatic function {:autoReq} rfc4251_sshrsa_pubkey_encoding(key:RSAPubKeySpec) : seq\r\n requires WellformedRSAPubKeySpec(key);\r\n{\r\n rfc4251_sshrsa_encoding(key.e, key.n)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/rfc4251decode.i.dfy", "content": "//-\r\ninclude \"rfc4251impl.i.dfy\"\r\ninclude \"KeybitsLength.i.dfy\"\r\ninclude \"../../FatNat/FatNatDiv.i.dfy\"\r\ninclude \"../../FatNat/FatNatReciprocal.i.dfy\"\r\n\r\nlemma lemma_1_is_small_enough(N:array)\r\n requires WellformedFatNat(N);\r\n requires J(N) == 1;\r\n ensures J(N) < power2(power2(29));\r\n{\r\n lemma_2toX32();\r\n calc {\r\n J(N);\r\n 1;\r\n <\r\n power2(2);\r\n power2(power2(1));\r\n <= {\r\n lemma_power2_increases(1, 29);\r\n lemma_power2_increases(power2(1), power2(29)); }\r\n power2(power2(29));\r\n }\r\n}\r\n\r\nlemma lemma_prep_dummy_key(N:array, k:nat)\r\n requires WellformedFatNat(N);\r\n requires J(N)==1;\r\n requires k==1;\r\n//- ensures 1 < Frump();\r\n ensures KeyModulusMatchesSizeInBytes(J(N), k);\r\n{\r\n lemma_2toX32();\r\n calc {\r\n J(N);\r\n <\r\n 16;\r\n power2(4);\r\n <= { lemma_power2_increases(4, power2(30)); }\r\n power2(power2(30));\r\n }\r\n//- assert FrumpyBigNat(N);\r\n ghost var n := 1;\r\n assert n == J(N);\r\n calc {\r\n power2(8*(k-1));\r\n power2(8*0);\r\n power2(0);\r\n 1;\r\n <=\r\n n;\r\n }\r\n calc {\r\n n;\r\n <=\r\n 256;\r\n power2(8);\r\n power2(8*1);\r\n power2(8*k);\r\n }\r\n assert power2(8*(k-1)) <= n;\r\n assert n < power2(8*k);\r\n \r\n assert KeyModulusMatchesSizeInBytes(J(N), k);\r\n}\r\n\r\nmethod {:timeLimitMultiplier 3} make_dummy_key() returns (pubkey:RSAPubKeyImpl_internal)\r\n ensures WellformedRSAPubKeyImpl_internal(pubkey);\r\n ensures public(pubkey.size);\r\n ensures public(J(pubkey.n));\r\n ensures public(J(pubkey.e));\r\n{\r\n lemma_2toX32();\r\n var N := MakeBELiteralArray(1);\r\n assert WellformedFatNat(N);\r\n\r\n var E := MakeBELiteralArray(1);\r\n lemma_prep_dummy_key(N, 1);\r\n\r\n//- assert FrumpyBigNat(E);\r\n\r\n pubkey := RSAPubKeyImpl_c_internal(N, 1, E, FNDivUnknownReciprocal()); //- dafnycc\r\n assert N == pubkey.n; //- OBSERVE\r\n\r\n assert KeyModulusMatchesSizeInBytes(J(pubkey.n), pubkey.size);\r\n lemma_1_is_small_enough(N);\r\n assert WellformedFatNat(N);\r\n assert J(N) < power2(power2(29));\r\n\r\n//- lemma_keybits_implies_length25(N);\r\n\r\n lemma_power2_increases(29, 30);\r\n lemma_power2_increases(power2(25), power2(30));\r\n\r\n assert N == pubkey.n;\r\n//- assert WellformedFatNat(N);\r\n assert WellformedRSAPubKeyImpl_internal(pubkey);\r\n}\r\n\r\nmethod rfc4251_decode_sshrsa_internal(msg:seq) returns (success:bool, pubkey:RSAPubKeyImpl_internal)\r\n requires IsByteSeq(msg);\r\n requires Word32(|msg|);\r\n requires public(msg);\r\n ensures WellformedRSAPubKeyImpl_internal(pubkey);\r\n ensures success ==> PubKeyImplToSpec_internal(pubkey).e < power2(power2(34));\r\n ensures success ==> PubKeyImplToSpec_internal(pubkey).n < power2(power2(34));\r\n ensures success ==> (msg == rfc4251_sshrsa_pubkey_encoding_premium(PubKeyImplToSpec_internal(pubkey)));\r\n ensures public(success);\r\n ensures public(pubkey.size);\r\n ensures public(J(pubkey.n));\r\n ensures public(J(pubkey.e));\r\n \r\n \r\n \r\n{\r\n success := false;\r\n\r\n var sub_rc,E,N := rfc4251_decode_sshrsa_inner(msg);\r\n if (!sub_rc)\r\n {\r\n pubkey := make_dummy_key();\r\n return;\r\n }\r\n\r\n//- lemma_frumpy_is_modest(N);\r\n//- lemma_modesty_word_value_equivalence(N);\r\n var size_bits := FatNatCountBits(N);\r\n var size_bytes := (size_bits+7)/8;\r\n\r\n lemma_power2_increases(8*(size_bytes-1), size_bits-1);\r\n lemma_power2_increases(size_bits, 8*size_bytes);\r\n //-assert power2(8*(size_bytes-1)) <= J(N);\r\n //-assert J(N) < power2(8*size_bytes);\r\n\r\n var nReciprocal := FatNatComputeReciprocal(N);\r\n var nReciprocal_ref := nReciprocal.TwoTo32wDividedByD; //- reference this array for DafnyCC's sake\r\n pubkey := RSAPubKeyImpl_c_internal(N, size_bytes, E, nReciprocal);\r\n//- lemma_keybits_implies_length25(N);\r\n //-assert J(E) < power2(power2(30));\r\n //-assert J(N) < power2(power2(30));\r\n //-assert WellformedRSAPubKeyImpl_internal(pubkey);\r\n//- calc {\r\n//- PubKeyImplToSpec_internal(pubkey).e;\r\n//- J(E);\r\n//- <\r\n//- power2(power2(34));\r\n//- }\r\n success := true;\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RSA/rfc4251impl.i.dfy", "content": "//-\r\n//-\r\ninclude \"../../BigNum/BigNum.i.dfy\"\r\ninclude \"rfc4251.s.dfy\"\r\ninclude \"RSASpec.s.dfy\"\r\ninclude \"../../Util/seqs_simple.i.dfy\"\r\ninclude \"BlockEncoding.i.dfy\"\r\ninclude \"KeyImpl.i.dfy\"\r\ninclude \"../../FatNat/FatNatModesty.i.dfy\"\r\n\r\nstatic function method{:CompiledSpec} CompiledSpec_STR_SSH_RSA() : seq\r\n\r\nstatic method rfc4251_encode_word32(w:int) returns (msg:seq)\r\n requires Word32(w); //- redundant; falls out of definition.\r\n ensures IsByteSeq(msg);\r\n ensures msg == rfc4251_word32_encoding(w);\r\n ensures |msg|==4;\r\n{\r\n var wordseq := [w];\r\n msg := BEWordSeqToByteSeq_impl(wordseq);\r\n}\r\n\r\nstatic method rfc4251_encode_string(s:seq) returns (msg:seq)\r\n requires IsByteSeq(s);\r\n requires Word32(|s|);\r\n ensures IsByteSeq(msg);\r\n ensures msg == rfc4251_string_encoding(s);\r\n{\r\n var l := rfc4251_encode_word32(|s|);\r\n msg := l + s;\r\n\r\n assert msg[0..4] == l;\r\n}\r\n\r\nstatic lemma lemma_rfc4251_positive_to_twoscomplement(s:seq)\r\n requires IsByteSeq(s);\r\n ensures |rfc4251_positive_to_twoscomplement(s)| <= |s|+1;\r\n ensures IsByteSeq(rfc4251_positive_to_twoscomplement(s));\r\n{\r\n}\r\n\r\nstatic function rfc4251_positive_to_twoscomplement_premium(s:seq) : seq\r\n requires IsByteSeq(s);\r\n ensures |rfc4251_positive_to_twoscomplement(s)| <= |s|+1;\r\n ensures IsByteSeq(rfc4251_positive_to_twoscomplement(s));\r\n ensures rfc4251_positive_to_twoscomplement_premium(s)\r\n == rfc4251_positive_to_twoscomplement(s);\r\n{\r\n lemma_rfc4251_positive_to_twoscomplement(s);\r\n rfc4251_positive_to_twoscomplement(s)\r\n}\r\n\r\nstatic lemma lemma_BEIntToByteSeq_length_bound(v:int)\r\n requires 0 <= v < power2(power2(34)); \r\n ensures |BEIntToByteSeq(v)| < power2(32)-1;\r\n{\r\n lemma_2toX();\r\n var vs := BEIntToByteSeq(v);\r\n if (v==0)\r\n {\r\n reveal_BEIntToDigitSeq_private();\r\n assert |vs| == 0;\r\n }\r\n else\r\n {\r\n if (power2(32)-1 <= |vs|) {\r\n lemma_2to32();\r\n lemma_power2_add8(24);\r\n lemma_power2_add8(32);\r\n calc {\r\n v;\r\n < //- { requires assumption }\r\n power2(power2(34));\r\n power2(8 * power2(31));\r\n { lemma_mul_is_mul_boogie(8, power2(31)); }\r\n//-dafnycc power2(mul(8,power2(31)));\r\n { lemma_power2_is_power_2(mul(8,power2(31))); }\r\n power(2, mul(8,power2(31)));\r\n { lemma_power_multiplies(2, 8, power2(31)); }\r\n power(power(2,8), power2(31));\r\n { lemma_power2_is_power_2(8); }\r\n power(256, power2(31));\r\n <= { lemma_power_increases(256, power2(31), power2(32)-2); }\r\n power(256, power2(32)-2);\r\n <= { lemma_power_increases(256, power2(32)-2, |vs|-1); } //- contradiction hyp\r\n power(256, |vs|-1);\r\n power(power2(8), |vs|-1);\r\n <= { lemma_BEIntToDigitSeq_properties(power2(8), 0, v); }\r\n v;\r\n }\r\n assert false;\r\n }\r\n }\r\n\r\n lemma_2toX();\r\n assert 0 <= |vs| < power2(32)-1;\r\n}\r\n\r\nstatic lemma lemma_TwosComplement_length_bound(x:int)\r\n requires 0 <= x < power2(power2(34)); \r\n ensures |rfc4251_positive_to_twoscomplement(BEIntToByteSeq(x))| < power2(32);\r\n{\r\n lemma_BEIntToByteSeq_length_bound(x);\r\n}\r\n\r\nstatic lemma lemma_rfc4251_mpint_encoding_premium(v:nat)\r\n requires v < power2(power2(34));\r\n ensures |rfc4251_positive_to_twoscomplement(BEIntToByteSeq(v))| < power2(32);\r\n ensures IsByteSeq(rfc4251_mpint_encoding(v));\r\n{\r\n lemma_2toX();\r\n lemma_TwosComplement_length_bound(v);\r\n\r\n lemma_BEIntToByteSeq_decoding(v);\r\n var vs := BEIntToByteSeq(v);\r\n lemma_BEIntToDigitSeq_properties(power2(8), 0, v);\r\n assert v>0 ==> power(power2(8), |vs|-1) <= v;\r\n \r\n var tc := rfc4251_positive_to_twoscomplement(vs);\r\n assert |tc| <= |vs|+1;\r\n\r\n assert 0 <= |tc| < power2(32);\r\n\r\n lemma_BEInt_decoding_general(power2(8), 4, |tc|);\r\n\r\n assert IsDigitSeq(power2(8), BEIntToDigitSeq(power2(8), 4, |tc|));\r\n assert IsByteSeq(BEIntToDigitSeq(power2(8), 4, |tc|));\r\n\r\n assert IsDigitSeq(power2(32), [|tc|]);\r\n lemma_BEDigitSeqToInt_bound(power2(32), [|tc|]);\r\n lemma_BEIntToDigitSeq_produces_DigitSeq(power2(8), 4, BEDigitSeqToInt(power2(32), [|tc|]));\r\n assert IsDigitSeq(power2(8), BEIntToDigitSeq(power2(8), 4, BEDigitSeqToInt(power2(32), [|tc|])));\r\n assert IsByteSeq(BEIntToDigitSeq(power2(8), 4, BEDigitSeqToInt(power2(32), [|tc|])));\r\n\r\n calc {\r\n BEIntToDigitSeq(power2(8), 4, BEDigitSeqToInt(power2(32), [|tc|]));\r\n BEIntToDigitSeq(power2(8), |[|tc|]|*4, BEDigitSeqToInt(power2(32), [|tc|]));\r\n BEWordSeqToByteSeq([|tc|]);\r\n rfc4251_word32_encoding(|tc|);\r\n }\r\n\r\n assert IsByteSeq(rfc4251_word32_encoding(|tc|));\r\n assert IsByteSeq(tc);\r\n assert IsByteSeq(rfc4251_mpint_encoding(v));\r\n}\r\n\r\nstatic function rfc4251_mpint_encoding_premium(v:nat) : seq\r\n requires v < power2(power2(34));\r\n ensures IsByteSeq(BEIntToByteSeq(v));\r\n ensures IsByteSeq(rfc4251_mpint_encoding_premium(v));\r\n ensures IsDigitSeq(power2(32), [|rfc4251_positive_to_twoscomplement(BEIntToByteSeq(v))|]);\r\n ensures rfc4251_mpint_encoding_premium(v) == rfc4251_mpint_encoding(v);\r\n{\r\n lemma_BEIntToByteSeq_decoding(v);\r\n var tc := rfc4251_positive_to_twoscomplement(BEIntToByteSeq(v));\r\n assert 0<=|tc|;\r\n \r\n lemma_rfc4251_mpint_encoding_premium(v);\r\n assert IsDigitSeq(power2(32), [|tc|]);\r\n rfc4251_word32_encoding(|tc|) + tc\r\n}\r\n\r\nlemma lemma_rfc4251_modesty_suffices_for_encoding(V:array)\r\n requires ModestFatNatValue(V);\r\n ensures J(V) < power2(power2(34));\r\n{\r\n lemma_power2_strictly_increases(31, 34);\r\n lemma_power2_strictly_increases(power2(31), power2(34));\r\n}\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} rfc4251_encode_mpint(V:array) returns (msg:seq)\r\n requires ModestFatNatValue(V);\r\n ensures J(V) < power2(power2(34));\r\n ensures IsByteSeq(msg);\r\n ensures msg == rfc4251_mpint_encoding_premium(J(V));\r\n{\r\n lemma_rfc4251_modesty_suffices_for_encoding(V);\r\n\r\n \r\n var v_bytes := IntegerToBESeq(V);\r\n\r\n lemma_2to32();\r\n\r\n assert J(V) < power2(power2(31));\r\n if (|v_bytes|>2)\r\n {\r\n assert power2(8*(|v_bytes|-2)) <= BigEndianIntegerValue(v_bytes);\r\n\r\n lemma_2to32();\r\n lemma_power2_add8(0);\r\n lemma_power2_add8(24);\r\n calc ==> {\r\n power2(8*(|v_bytes|-2)) <= power2(power2(31));\r\n { lemma_power2_increases_converse(8*(|v_bytes|-2), power2(31)); }\r\n 8*(|v_bytes|-2) <= power2(31);\r\n |v_bytes|-2 <= power2(28);\r\n |v_bytes| < Width();\r\n }\r\n assert Word32(|v_bytes|);\r\n }\r\n else\r\n {\r\n assert |v_bytes| <= 2;\r\n assert Word32(|v_bytes|);\r\n }\r\n assert Word32(|v_bytes|);\r\n\r\n if (|v_bytes|>=2 && v_bytes[1]<128)\r\n {\r\n ghost var old_v_bytes := v_bytes;\r\n v_bytes := v_bytes[1..];\r\n lemma_BigEndianIntegerValue_zero_prefix(old_v_bytes, v_bytes);\r\n }\r\n else if (|v_bytes|==1)\r\n {\r\n ghost var old_v_bytes := v_bytes;\r\n assert v_bytes[0]==0;\r\n v_bytes := [];\r\n }\r\n\r\n assert Word32(|v_bytes|);\r\n var v_seq := v_bytes;\r\n var len_bits := rfc4251_encode_word32(|v_seq|);\r\n msg := len_bits + v_seq;\r\n\r\n assert msg[0..4] == len_bits;\r\n}\r\n\r\nstatic lemma lemma_rfc4251_modest_twoscomplement(v:nat)\r\n requires 0 <= v < power2(power2(34));\r\n ensures |rfc4251_positive_to_twoscomplement(BEIntToByteSeq(v))| < power2(32);\r\n{\r\n lemma_BEIntToByteSeq_length_bound(v);\r\n assert |BEIntToByteSeq(v)| < power2(32)-1;\r\n}\r\n\r\nstatic lemma lemma_rfc4251_word32_encoding(w:int)\r\n requires 0 <= w < power2(32);\r\n ensures IsByteSeq(rfc4251_word32_encoding(w));\r\n{\r\n lemma_2toX();\r\n lemma_BEDigitSeqToInt_bound(power2(32), [w]);\r\n lemma_BEIntToDigitSeq_produces_DigitSeq(power2(8), 4, BEWordSeqToInt([w]));\r\n}\r\n\r\nstatic function rfc4251_word32_encoding_premium(w:int) : seq\r\n requires 0 <= w < power2(32);\r\n ensures rfc4251_word32_encoding(w) == rfc4251_word32_encoding_premium(w);\r\n ensures IsByteSeq(rfc4251_word32_encoding(w));\r\n{\r\n lemma_rfc4251_word32_encoding(w);\r\n rfc4251_word32_encoding(w)\r\n}\r\n\r\nstatic lemma lemma_rfc4251_string_encoding(s:seq)\r\n requires IsByteSeq(s);\r\n requires |s| < power2(32);\r\n ensures IsByteSeq(rfc4251_string_encoding(s));\r\n{\r\n assert rfc4251_string_encoding(s) == rfc4251_word32_encoding_premium(|s|) + s;\r\n}\r\n\r\nstatic function rfc4251_string_encoding_premium(s:seq) : seq\r\n requires IsByteSeq(s);\r\n requires |s| < power2(32);\r\n ensures rfc4251_string_encoding(s) == rfc4251_string_encoding_premium(s);\r\n ensures IsByteSeq(rfc4251_string_encoding(s));\r\n{\r\n lemma_rfc4251_string_encoding(s);\r\n rfc4251_string_encoding(s)\r\n}\r\n\r\nstatic lemma lemma_rfc4251_sshrsa_encoding_premium(e:nat, n:nat)\r\n requires e < power2(power2(34));\r\n requires n < power2(power2(34));\r\n ensures IsWordSeq([|STR_SSH_RSA()|]);\r\n ensures IsWordSeq([|rfc4251_positive_to_twoscomplement(BEIntToByteSeq(e))|]);\r\n ensures IsWordSeq([|rfc4251_positive_to_twoscomplement(BEIntToByteSeq(n))|]);\r\n ensures IsByteSeq(rfc4251_sshrsa_encoding(e,n));\r\n{\r\n lemma_2toX();\r\n lemma_rfc4251_modest_twoscomplement(e);\r\n lemma_rfc4251_modest_twoscomplement(n);\r\n assert IsByteSeq(rfc4251_string_encoding_premium(STR_SSH_RSA()));\r\n lemma_rfc4251_mpint_encoding_premium(e);\r\n assert rfc4251_mpint_encoding(e) == rfc4251_mpint_encoding_premium(e);\r\n assert IsByteSeq(rfc4251_mpint_encoding_premium(e));\r\n lemma_rfc4251_mpint_encoding_premium(n);\r\n assert rfc4251_mpint_encoding(n) == rfc4251_mpint_encoding_premium(n);\r\n assert IsByteSeq(rfc4251_mpint_encoding(n));\r\n}\r\n\r\nstatic function rfc4251_sshrsa_encoding_premium(e:nat, n:nat) : seq\r\n requires e < power2(power2(34));\r\n requires n < power2(power2(34));\r\n ensures IsWordSeq([|STR_SSH_RSA()|]);\r\n ensures IsWordSeq([|rfc4251_positive_to_twoscomplement(BEIntToByteSeq(e))|]);\r\n ensures IsWordSeq([|rfc4251_positive_to_twoscomplement(BEIntToByteSeq(n))|]);\r\n ensures rfc4251_sshrsa_encoding_premium(e,n) == rfc4251_sshrsa_encoding(e,n);\r\n{\r\n lemma_rfc4251_sshrsa_encoding_premium(e,n);\r\n rfc4251_sshrsa_encoding(e,n)\r\n}\r\n\r\nstatic function rfc4251_sshrsa_pubkey_encoding_premium(pubkey:RSAPubKeySpec) : seq\r\n requires WellformedRSAPubKeySpec(pubkey);\r\n requires pubkey.e < power2(power2(34));\r\n requires pubkey.n < power2(power2(34));\r\n ensures IsWordSeq([|STR_SSH_RSA()|]);\r\n ensures IsWordSeq([|rfc4251_positive_to_twoscomplement(BEIntToByteSeq(pubkey.e))|]);\r\n ensures IsWordSeq([|rfc4251_positive_to_twoscomplement(BEIntToByteSeq(pubkey.n))|]);\r\n ensures rfc4251_sshrsa_pubkey_encoding_premium(pubkey) == rfc4251_sshrsa_pubkey_encoding(pubkey);\r\n{\r\n lemma_rfc4251_sshrsa_encoding_premium(pubkey.e, pubkey.n);\r\n rfc4251_sshrsa_pubkey_encoding(pubkey)\r\n}\r\n\r\nmethod rfc4251_encode_sshrsa_inner(E:array, N:array) returns (msg:seq)\r\n requires ModestFatNatValue(E);\r\n requires ModestFatNatValue(N);\r\n ensures IsByteSeq(msg);\r\n ensures J(E) < power2(power2(34));\r\n ensures J(N) < power2(power2(34));\r\n ensures msg == rfc4251_sshrsa_encoding_premium(J(E), J(N));\r\n{\r\n lemma_rfc4251_modesty_suffices_for_encoding(E);\r\n lemma_rfc4251_modesty_suffices_for_encoding(N);\r\n\r\n lemma_2to32();\r\n //- reveal_rfc4251_sshrsa_encoding();\r\n assert |STR_SSH_RSA()| < power2(32);\r\n\r\n var enc_s := rfc4251_encode_string(STR_SSH_RSA());\r\n var enc_e := rfc4251_encode_mpint(E);\r\n var enc_n := rfc4251_encode_mpint(N);\r\n\r\n msg := enc_s + enc_e + enc_n;\r\n\r\n assert IsByteSeq(enc_s);\r\n assert IsByteSeq(enc_e);\r\n assert IsByteSeq(enc_n);\r\n assert IsByteSeq(msg);\r\n assert enc_s == rfc4251_string_encoding(STR_SSH_RSA());\r\n assert enc_e == rfc4251_mpint_encoding_premium(J(E));\r\n assert enc_n == rfc4251_mpint_encoding_premium(J(N));\r\n assert msg == rfc4251_sshrsa_encoding_premium(J(E), J(N));\r\n}\r\n\r\nmethod rfc4251_encode_sshrsa_pubkey_internal(pubkey:RSAPubKeyImpl_internal) returns (msg:seq)\r\n requires ModestFatNatValue(pubkey.e);\r\n requires ModestFatNatValue(pubkey.n);\r\n requires WellformedRSAPubKeyImpl_internal(pubkey);\r\n ensures IsByteSeq(msg);\r\n ensures PubKeyImplToSpec_internal(pubkey).e < power2(power2(34));\r\n ensures PubKeyImplToSpec_internal(pubkey).n < power2(power2(34));\r\n ensures msg == rfc4251_sshrsa_pubkey_encoding_premium(PubKeyImplToSpec_internal(pubkey));\r\n{\r\n lemma_power2_increases(30, 34);\r\n lemma_power2_increases(power2(30), power2(34));\r\n//- lemma_frumpy_is_modest(pubkey.e);\r\n//- lemma_modesty_word_value_equivalence(pubkey.e);\r\n//- lemma_frumpy_is_modest(pubkey.n);\r\n//- lemma_modesty_word_value_equivalence(pubkey.n);\r\n msg := rfc4251_encode_sshrsa_inner(pubkey.e, pubkey.n);\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- decoding\r\n\r\nmethod rfc4251_decode_word32(msg:seq) returns (success:bool, w:int, bytes_consumed:int)\r\n requires IsByteSeq(msg);\r\n requires public(msg);\r\n ensures Word32(w);\r\n ensures 0 <= bytes_consumed <= 4;\r\n ensures success ==> 4<=|msg|;\r\n ensures success ==> (msg[..bytes_consumed] == rfc4251_word32_encoding(w));\r\n ensures public(success);\r\n ensures public(w);\r\n ensures public(bytes_consumed);\r\n{\r\n if (|msg|<4)\r\n {\r\n success := false;\r\n w := 0;\r\n bytes_consumed := 0;\r\n return;\r\n }\r\n else\r\n {\r\n var wordseq,padbytes := BEByteSeqToWordSeq_impl(msg[..4]);\r\n//- assert |wordseq| == 1;\r\n//- assert |padbytes| == 0;\r\n success := true;\r\n w := wordseq[0];\r\n assert wordseq == [w]; //- hint required\r\n bytes_consumed := 4;\r\n }\r\n}\r\n\r\nmethod rfc4251_decode_string(msg:seq) returns (success:bool, s:seq, bytes_consumed:int)\r\n requires IsByteSeq(msg);\r\n requires Word32(|msg|);\r\n requires public(msg);\r\n ensures IsByteSeq(s);\r\n ensures Word32(|s|);\r\n ensures 0 <= bytes_consumed <= |msg|;\r\n ensures success ==> (msg[..bytes_consumed] == rfc4251_string_encoding(s));\r\n ensures public(success);\r\n ensures public(s);\r\n ensures public(bytes_consumed);\r\n{\r\n //- failure case return values\r\n success := false;\r\n bytes_consumed := 0;\r\n s := [];\r\n\r\n var subrc,l,sub_bytes_consumed := rfc4251_decode_word32(msg);\r\n if (!subrc || !(0 <= l <= |msg|-sub_bytes_consumed))\r\n {\r\n return;\r\n }\r\n\r\n s := msg[sub_bytes_consumed .. sub_bytes_consumed + l];\r\n bytes_consumed := sub_bytes_consumed + l;\r\n success := true; // fixed liveness bug\r\n}\r\n\r\nlemma lemma_rfc4251_modesty_helper()\r\n ensures 0 < power2(power2(31));\r\n ensures 0 < power2(power2(34));\r\n ensures power2(power2(31)) < power2(power2(34));\r\n{\r\n calc {\r\n 0;\r\n < { lemma_power2_0_is_1(); }\r\n power2(0);\r\n <= { lemma_power2_increases(0, power2(31)); }\r\n power2(power2(31));\r\n }\r\n lemma_power2_strictly_increases(31, 34);\r\n lemma_power2_strictly_increases(power2(31), power2(34));\r\n}\r\n\r\nmethod rfc4251_decode_mpint(msg:seq) returns (success:bool,V:array,bytes_consumed:int)\r\n requires IsByteSeq(msg);\r\n requires public(msg);\r\n ensures ModestFatNatValue(V);\r\n ensures J(V) < power2(power2(34));\r\n ensures 0 <= bytes_consumed <= |msg|;\r\n ensures success ==> (msg[..bytes_consumed] == rfc4251_mpint_encoding_premium(J(V)));\r\n ensures public(success);\r\n ensures public(J(V));\r\n ensures public(bytes_consumed);\r\n{\r\n lemma_2toX32();\r\n\r\n success := false;\r\n V := FatNatZero();\r\n bytes_consumed := 0;\r\n lemma_rfc4251_modesty_helper();\r\n\r\n var subrc,l,sub_bytes_consumed := rfc4251_decode_word32(msg);\r\n if (!subrc || !(0 <= l <= |msg|-sub_bytes_consumed))\r\n {\r\n return;\r\n }\r\n\r\n var S := msg[sub_bytes_consumed .. sub_bytes_consumed + l];\r\n bytes_consumed := sub_bytes_consumed + l;\r\n\r\n var power2_28 := 0x10000000;\r\n if (|S| >= power2_28)\r\n {\r\n //- encoded integer too big\r\n return;\r\n }\r\n if (|S|>0 && S[0] >= 128)\r\n {\r\n //- msg encodes negative integer\r\n return;\r\n }\r\n\r\n if (|S|>0 && S[0]==0)\r\n {\r\n if (|S|-1==0 || S[1]<128)\r\n {\r\n //- message has an improper number of leading zeros.\r\n return;\r\n }\r\n }\r\n\r\n success := true;\r\n V := rfc4251_decode_mpint_common_case(msg, l, sub_bytes_consumed, S, bytes_consumed);\r\n}\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} rfc4251_decode_mpint_common_case(msg:seq, w:int, sub_bytes_consumed:int, S:seq, bytes_consumed:int) returns (V:array)\r\n requires IsByteSeq(msg);\r\n requires Word32(w);\r\n requires 4 <= |msg|;\r\n requires 0 <= w <= |msg|-sub_bytes_consumed;\r\n requires 0 <= sub_bytes_consumed;\r\n requires msg[..sub_bytes_consumed] == rfc4251_word32_encoding(w);\r\n requires bytes_consumed == sub_bytes_consumed + w;\r\n requires 0 <= bytes_consumed <= |msg|;\r\n requires S == msg[sub_bytes_consumed .. bytes_consumed];\r\n requires |S| < 0x10000000;\r\n requires |S| == 0 || S[0] < 128;\r\n requires |S|>0 && S[0] == 0 ==> |S| > 1 && S[1] >= 128;\r\n\r\n requires public(msg);\r\n requires public(w);\r\n requires public(sub_bytes_consumed);\r\n requires public(bytes_consumed);\r\n requires public(S);\r\n\r\n ensures ModestFatNatValue(V);\r\n ensures J(V) < power2(power2(34));\r\n ensures msg[..bytes_consumed] == rfc4251_mpint_encoding_premium(J(V));\r\n ensures public(J(V));\r\n{\r\n lemma_2toX32();\r\n\r\n var V_seq,padding := BEByteSeqToWordSeq_impl(S);\r\n V := SeqToArray(V_seq);\r\n\r\n if (|S|>0 && S[0]==0)\r\n {\r\n lemma_LeadingZeros(power2(8), S[1..], S);\r\n lemma_BEDigitSeqToInt_invertibility_tight(power2(8), J(V), S[1..]);\r\n assert S == rfc4251_positive_to_twoscomplement(BEIntToByteSeq_premium(J(V)));\r\n }\r\n else\r\n {\r\n lemma_BEDigitSeqToInt_invertibility_tight(power2(8), J(V), S);\r\n assert S == rfc4251_positive_to_twoscomplement(BEIntToByteSeq_premium(J(V)));\r\n }\r\n\r\n //- The nesting of the calc below is for dafnycc's sake\r\n\r\n calc {\r\n J(V);\r\n <\r\n calc {\r\n J(V);\r\n BEByteSeqToInt(S);\r\n < { lemma_BEByteSeqToInt_bound(S); }\r\n power2(8*|S|);\r\n power2(|S|*8);\r\n//-dafnycc power2(|S|*8);\r\n < { lemma_mul_is_mul_boogie(|S|, 8);\r\n lemma_mul_strict_inequality(|S|,power2(28),8);\r\n lemma_power2_strictly_increases(|S|*8, power2(28)*8); }\r\n power2(power2(28)*8);\r\n { lemma_mul_is_commutative(power2(28), 8); }\r\n power2(8*power2(28));\r\n power2(power2(3)*power2(28));\r\n { lemma_power2_adds(3,28); }\r\n power2(power2(31));\r\n }\r\n power2(power2(31));\r\n }\r\n\r\n calc {\r\n power2(power2(31));\r\n <= { lemma_power2_increases(31, 34); lemma_power2_increases(power2(31), power2(34)); }\r\n power2(power2(34));\r\n }\r\n}\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} {:timeLimitMultiplier 3} rfc4251_decode_sshrsa_inner(msg:seq) returns (success:bool, E:array, N:array)\r\n requires IsByteSeq(msg);\r\n requires Word32(|msg|);\r\n requires public(msg);\r\n ensures ModestFatNatValue(E);\r\n ensures ModestFatNatValue(N);\r\n ensures J(N) < power2(power2(29));\r\n ensures J(E) < power2(power2(30));\r\n ensures J(N) < power2(power2(30));\r\n ensures J(E) < power2(power2(34));\r\n ensures J(N) < power2(power2(34));\r\n ensures success ==> J(N) != 0;\r\n ensures success ==> (msg == rfc4251_sshrsa_encoding_premium(J(E), J(N)));\r\n ensures public(success);\r\n ensures public(J(E));\r\n ensures public(J(N));\r\n{\r\n lemma_power2_increases(30, 34);\r\n lemma_power2_increases(power2(30), power2(34));\r\n\r\n lemma_2toX32();\r\n var power2_29 := 0x20000000;\r\n var power2_30 := 0x40000000;\r\n //- reveal_rfc4251_sshrsa_encoding();\r\n assert |STR_SSH_RSA()| < power2(32);\r\n\r\n success := false;\r\n E := FatNatZero();\r\n N := FatNatZero();\r\n lemma_rfc4251_modesty_helper();\r\n\r\n lemma_rfc4251_modesty_suffices_for_encoding(E);\r\n lemma_rfc4251_modesty_suffices_for_encoding(N);\r\n\r\n var subrc,dec_s,bytes_consumed := rfc4251_decode_string(msg);\r\n if (!subrc || dec_s != STR_SSH_RSA())\r\n {\r\n return;\r\n }\r\n\r\n var enc_s := msg[..bytes_consumed];\r\n var msg2 := msg[bytes_consumed..];\r\n var subrc2,dec_e,bytes_consumed2 := rfc4251_decode_mpint(msg2);\r\n if (!subrc2)\r\n {\r\n return;\r\n }\r\n//- lemma_modesty_word_value_equivalence(dec_e);\r\n assert BEWordSeqToInt_premium(dec_e[..]) == J(dec_e);\r\n var e_size := FatNatCountBits(dec_e);\r\n if (e_size >= power2_29)\r\n {\r\n return;\r\n }\r\n lemma_power2_increases(e_size, power2(30));\r\n\r\n var enc_e := msg2[..bytes_consumed2];\r\n var msg3 := msg2[bytes_consumed2..];\r\n var subrc3,dec_n,bytes_consumed3 := rfc4251_decode_mpint(msg3);\r\n if (!subrc3 || bytes_consumed3!=|msg3|)\r\n {\r\n return;\r\n }\r\n//- lemma_modesty_word_value_equivalence(dec_n);\r\n assert BEWordSeqToInt_premium(dec_n[..]) == J(dec_n);\r\n var n_size := FatNatCountBits(dec_n);\r\n if (n_size >= power2_29)\r\n {\r\n return;\r\n }\r\n lemma_power2_increases(n_size, power2(29));\r\n lemma_power2_increases(n_size, power2(30));\r\n\r\n var enc_n := msg3[..bytes_consumed3];\r\n\r\n E := dec_e;\r\n N := dec_n;\r\n assert IsZeroValue(N[..]) == (J(N) == 0);\r\n var nz := FatNatIsZero(N);\r\n if (nz)\r\n {\r\n return;\r\n }\r\n\r\n lemma_rfc4251_modesty_suffices_for_encoding(E);\r\n lemma_rfc4251_modesty_suffices_for_encoding(N);\r\n\r\n calc {\r\n msg2;\r\n msg2[..bytes_consumed2] + msg2[bytes_consumed2..];\r\n enc_e + msg3;\r\n }\r\n calc {\r\n msg;\r\n enc_s + msg2;\r\n enc_s + (enc_e + msg3);\r\n enc_s + (enc_e + enc_n);\r\n { lemma_seq_concatenation_associative(enc_s, enc_e, enc_n); }\r\n enc_s + enc_e + enc_n;\r\n }\r\n assert IsByteSeq(enc_s);\r\n assert IsByteSeq(enc_e);\r\n assert IsByteSeq(enc_n);\r\n assert IsByteSeq(msg);\r\n assert enc_s == rfc4251_string_encoding(STR_SSH_RSA());\r\n assert enc_e == rfc4251_mpint_encoding_premium(J(E));\r\n assert enc_n == rfc4251_mpint_encoding_premium(J(N));\r\n assert msg == rfc4251_sshrsa_encoding_premium(J(E), J(N));\r\n success := true;\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RandomNumberGen.s.dfy", "content": "include \"../Math/power2.s.dfy\"\r\ninclude \"../Math/round.s.dfy\"\r\ninclude \"../Util/be_sequences.s.dfy\"\r\ninclude \"RandomTracing.s.dfy\"\r\n\r\n//------------------------------------------------------------//\r\n\r\n//- Selecting a random number in a range\r\n//- Used to select the seeds for MillerRabin tests.\r\n\r\ndatatype SelectRandomRequest = SelectRandomRequest_c(\r\n l:int, h:int, h_bits:int);\r\n\r\nstatic predicate SelectRandomRequestValid(req:SelectRandomRequest)\r\n \r\n \r\n{\r\n 0);\r\n\r\nstatic predicate CandidateSeedWorksheetRowValid(req:SelectRandomRequest, row:CandidateSeedWorksheetRow)\r\n{\r\n //- consume exactly the required number of random bytes\r\n SelectRandomRequestValid(req)\r\n && |row.randoms| == DivideRoundingUp(req.h_bits, 8)\r\n && IsByteSeq(row.randoms)\r\n && row.n == BEByteSeqToInt(row.randoms) % power2(req.h_bits)\r\n && row.accepted == (req.l<=row.n && row.n<=req.h)\r\n}\r\n\r\n//------------------------------------------------------------//\r\n\r\ndatatype CandidateSeedWorksheet = CandidateSeedWorksheet_c(\r\n rows:seq,\r\n randoms:seq);\r\n\r\n//- NB Every predicate of the form *ConsumesRandoms() has exactly the same\r\n//- body -- they're duplicated because they're talking about different\r\n//- row types, and those types aren't polymorphic.\r\n\r\nstatic function CandidateSeedWorksheetConsumesRandoms(rows:seq) : seq\r\n{\r\n if (rows==[]) then\r\n []\r\n else\r\n CandidateSeedWorksheetConsumesRandoms(rows[..|rows|-1]) + rows[|rows|-1].randoms\r\n}\r\n\r\nstatic predicate CandidateSeedWorksheetValid(req:SelectRandomRequest, worksheet:CandidateSeedWorksheet)\r\n{\r\n //- there is at least one candidate\r\n 0<|worksheet.rows|\r\n //- each row locally valid\r\n && (forall i :: 0<=i<|worksheet.rows| ==> CandidateSeedWorksheetRowValid(req, worksheet.rows[i]))\r\n //- all but last row fail, last row succeeds\r\n && (forall i:int :: 0<=i<|worksheet.rows|-1 ==> !worksheet.rows[i].accepted)\r\n && worksheet.rows[|worksheet.rows|-1].accepted\r\n //- randoms properly accounted for\r\n && CandidateSeedWorksheetConsumesRandoms(worksheet.rows) == worksheet.randoms\r\n}\r\n\r\nstatic function CandidateSeedWorksheetOutput(worksheet:CandidateSeedWorksheet) : int\r\n requires 0<|worksheet.rows|;\r\n{\r\n worksheet.rows[|worksheet.rows|-1].n\r\n}\r\n\r\n//------------------------------------------------------------//\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Crypto/RandomTracing.s.dfy", "content": "static predicate is_prefix(prefix:seq, super:seq)\r\n{\r\n |super| >= |prefix|\r\n && super[..|prefix|] == prefix\r\n}\r\n\r\nstatic predicate is_suffix(suffix:seq, super:seq)\r\n{\r\n |super| >= |suffix|\r\n && super[|suffix|..] == suffix\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/BigNatToFatNatAdaptor.i.dfy", "content": "include \"FatNatCommon.i.dfy\"\r\ninclude \"../BigNum/BigNatCore.i.dfy\"\r\ninclude \"../BigNum/BigNumBEAdaptor.i.dfy\"\r\ninclude \"CanonicalArrays.i.dfy\"\r\n\r\ninclude \"FatInt.i.dfy\"\r\ninclude \"../BigNum/BigNum.i.dfy\"\r\n\r\nmethod BigNatToFatNat(B:BigNat) returns (F:array)\r\n requires WellformedBigNat(B);\r\n ensures F!=null && IsWordSeq(F[..]);\r\n ensures I(B) == BEWordSeqToInt(F[..]);\r\n ensures |B.words| == F.Length;\r\n ensures IsCanonicalDigitSeq(power2(32), F[..]);\r\n{\r\n F := new int[|B.words|];\r\n var i:=0;\r\n while (i<|B.words|)\r\n invariant 0<=i<=|B.words|;\r\n invariant forall j::0<=j F[j] == B.words[|B.words|-1-j];\r\n {\r\n F[i] := B.words[|B.words|-1-i];\r\n i := i + 1;\r\n }\r\n \r\n lemma_2toX();\r\n calc {\r\n I(B);\r\n { lemma_BigNatIIsLEDigitSeqToInt(B); }\r\n LEDigitSeqToInt(Width(), B.words);\r\n { lemma_Reverse_converts_endianness_inner(Width(), F[..], B.words); }\r\n BEDigitSeqToInt(Width(), F[..]);\r\n }\r\n}\r\n\r\nmethod FatNatToBigNat(F:array) returns (B:BigNat)\r\n requires F!=null && IsWordSeq(F[..]);\r\n ensures WellformedBigNat(B);\r\n ensures I(B) == BEWordSeqToInt(F[..]);\r\n ensures |B.words| <= F.Length;\r\n{\r\n lemma_2toX();\r\n\r\n var t := CountTopZeroWords(F);\r\n \r\n var lewords := ReverseDigitSeq(power2(32), F[t..]);\r\n lemma_Reverse(F[t..], lewords);\r\n if (|lewords|>0)\r\n {\r\n assert lewords[|lewords|-1] == F[t..][0] == F[t]; //- OBSERVE\r\n }\r\n B := BigNat_ctor(lewords);\r\n\r\n calc {\r\n I(B);\r\n { lemma_BigNatIIsLEDigitSeqToInt(B); }\r\n LEDigitSeqToInt(Width(), B.words);\r\n { lemma_Reverse_converts_endianness_inner(Width(), F[t..], lewords); }\r\n BEDigitSeqToInt(Width(), F[t..]);\r\n { lemma_LeadingZeros(power2(32), F[t..], F[..]); }\r\n BEDigitSeqToInt(Width(), F[..]);\r\n }\r\n}\r\n\r\nmethod FatIntToBigNum(F:FatInt) returns (B:BigNum)\r\n requires WellformedFatInt(F);\r\n ensures WellformedBigNum(B);\r\n ensures BV(B) == FIV(F);\r\n ensures |B.value.words| <= F.value.Length;\r\n{\r\n var bv := FatNatToBigNat(F.value);\r\n B := BigNum_ctor(F.negate, bv);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/Bitwise.i.dfy", "content": "include \"FatNatCommon.i.dfy\"\r\ninclude \"FatNatMul.i.dfy\"\r\ninclude \"CanonicalArrays.i.dfy\"\r\ninclude \"../Math/power2methods.i.dfy\"\r\ninclude \"../Util/seqs_common.i.dfy\"\r\ninclude \"../Util/seqs_and_ints.i.dfy\"\r\n\r\n\r\n\r\nmethod BitShiftRight_Word(x:nat, b:nat) returns (xb:nat)\r\n requires IsWord(x);\r\n ensures IsWord(xb);\r\n ensures xb == x/power2(b);\r\n{\r\n if (b>=32)\r\n {\r\n xb := 0;\r\n lemma_power2_increases(32,b);\r\n lemma_small_div();\r\n return;\r\n }\r\n lemma_power2_strictly_increases(b,32);\r\n var p2b := MakePower2(b);\r\n var r_discard;\r\n xb,r_discard := Divide32(x, p2b);\r\n lemma_fundamental_div_mod_converse(x, p2b, xb, r_discard);\r\n}\r\n\r\nmethod BitShiftLeft_Word(x:nat, b:nat) returns (xb:nat)\r\n requires IsWord(x);\r\n ensures IsWord(xb);\r\n ensures xb == (x*power2(b)) % power2(32);\r\n{\r\n if (b>=32)\r\n {\r\n xb := 0;\r\n calc {\r\n (x*power2(b)) % power2(32);\r\n { lemma_power2_adds(b-32,32);\r\n lemma_mul_is_associative_forall(); }\r\n (x*power2(b-32)*power2(32)) % power2(32);\r\n { lemma_mul_is_commutative_forall(); }\r\n power2(32)*(x*power2(b-32)) % power2(32);\r\n { lemma_mod_multiples_vanish(x*power2(b-32), 0, power2(32));\r\n lemma_small_mod(0, power2(32));\r\n }\r\n 0;\r\n }\r\n return;\r\n }\r\n lemma_power2_strictly_increases(b,32);\r\n var p2b := MakePower2(b);\r\n var r_discard;\r\n xb,r_discard := Product32(x, p2b);\r\n calc {\r\n (x*power2(b)) % power2(32);\r\n (xb + r_discard * power2(32)) % power2(32);\r\n { lemma_mul_is_commutative_forall(); }\r\n (power2(32)*r_discard + xb) % power2(32);\r\n { lemma_mod_multiples_vanish(r_discard, xb, power2(32));\r\n lemma_small_mod(xb, power2(32)); }\r\n xb;\r\n }\r\n}\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} TakeTopBits_first_word_ge_p2b(n:array, top_word:int, b:nat, first_word:int, n_length:int,\r\n ghost pv:int, ghost Ns_all:seq, ghost Ns:seq,\r\n ghost Nv:int) returns (s:int, e:nat)\r\n requires n!=null;\r\n requires IsWordSeq(n[..]);\r\n requires 0<=top_word n[j]==0;\r\n requires 0= power2(b);\r\n requires first_word == n[top_word];\r\n requires n_length == n.Length - top_word;\r\n requires pv == power2(32);\r\n requires Ns == n[top_word..];\r\n requires Ns_all == n[..];\r\n requires Nv == BEWordSeqToInt(Ns);\r\n requires BEDigitSeqToInt(pv, Ns) == BEDigitSeqToInt(pv, Ns_all);\r\n requires 0 < BEDigitSeqToInt(pv, Ns);\r\n ensures 0 < s < power2(b);\r\n ensures s == BEWordSeqToInt(n[..]) / power2(e);\r\n ensures b>0 && e>0 ==> power2(b-1) <= s;\r\n{\r\n //- shift right a smidgen and we're done.\r\n var ne := CountBits(first_word);\r\n if (b > ne)\r\n {\r\n lemma_power2_strictly_increases(ne, b);\r\n assert false;\r\n }\r\n calc {\r\n b;\r\n <\r\n ne;\r\n }\r\n var shift := ne - b;\r\n s := BitShiftRight_Word(first_word, shift);\r\n e := 32*(n_length-1) + shift;\r\n assert e == 32*(|Ns|-1) + shift;\r\n if (0==s)\r\n {\r\n calc {\r\n first_word;\r\n { lemma_fundamental_div_mod(first_word, power2(shift)); }\r\n power2(shift) * (first_word/power2(shift)) + first_word%power2(shift);\r\n power2(shift) * s + first_word%power2(shift);\r\n { lemma_mul_basics(power2(shift)); }\r\n first_word%power2(shift);\r\n < { lemma_mod_properties(); }\r\n power2(shift);\r\n <= { lemma_power2_increases(shift, ne-1); }\r\n power2(ne-1);\r\n <=\r\n first_word;\r\n }\r\n assert false;\r\n }\r\n assert first_word < power2(ne);\r\n calc {\r\n s;\r\n first_word / power2(shift);\r\n first_word / power2(ne-b);\r\n < { lemma_power2_adds(b, ne-b);\r\n lemma_div_by_multiple_is_strongly_ordered(first_word, power2(ne), power2(b), power2(ne-b)); }\r\n power2(ne) / power2(ne-b);\r\n { lemma_power2_div_is_sub(ne-b, ne); }\r\n power2(b);\r\n }\r\n assert 0 < s < power2(b);\r\n calc {\r\n BEWordSeqToInt(n[..]) / power2(e);\r\n BEWordSeqToInt(Ns_all) / power2(e);\r\n BEWordSeqToInt(Ns) / power2(e);\r\n { lemma_BEInterpretation(pv, Ns, |Ns|-1);\r\n assert Ns[..1] == [Ns[0]]; //- OBSERVE\r\n lemma_BEDigitSeqToInt_singleton(pv, Ns[0]);\r\n }\r\n (Ns[0]*power(pv, |Ns|-1) + BEWordSeqToInt(Ns[1..]))\r\n / power2(e);\r\n { lemma_power2_unfolding(32, |Ns|-1);\r\n lemma_mul_is_mul_boogie(32, |Ns|-1); }\r\n (Ns[0]*power2(32*(|Ns|-1)) + BEWordSeqToInt(Ns[1..]))\r\n / power2(e);\r\n { lemma_fundamental_div_mod(Ns[0], power2(shift)); }\r\n ((power2(shift)*(Ns[0]/power2(shift)) + Ns[0]%power2(shift))\r\n *power2(32*(|Ns|-1)) + BEWordSeqToInt(Ns[1..]))\r\n / power2(e);\r\n { lemma_mul_is_distributive_add_other_way(power2(32*(|Ns|-1)), power2(shift)*(Ns[0]/power2(shift)), Ns[0]%power2(shift)); }\r\n (power2(shift)*(Ns[0]/power2(shift))*power2(32*(|Ns|-1))\r\n + (Ns[0]%power2(shift))*power2(32*(|Ns|-1))\r\n + BEWordSeqToInt(Ns[1..]))\r\n / power2(e);\r\n { lemma_mul_is_associative(power2(shift), Ns[0]/power2(shift), power2(32*(|Ns|-1))); }\r\n { lemma_mul_is_commutative(Ns[0]/power2(shift), power2(32*(|Ns|-1))); }\r\n { lemma_mul_is_associative(power2(shift), power2(32*(|Ns|-1)), Ns[0]/power2(shift)); }\r\n { lemma_power2_adds(shift, 32*(|Ns|-1)); }\r\n (power2(e)*(Ns[0]/power2(shift))\r\n + (Ns[0]%power2(shift))*power2(32*(|Ns|-1))\r\n + BEWordSeqToInt(Ns[1..]))\r\n / power2(e);\r\n { lemma_mod_properties();\r\n lemma_mul_nonnegative(Ns[0]%power2(shift),power2(32*(|Ns|-1)));\r\n assert 0<=Ns[0]%power2(shift);\r\n assert 0<=power2(32*(|Ns|-1));\r\n calc {\r\n (Ns[0]%power2(shift))*power2(32*(|Ns|-1))\r\n + BEWordSeqToInt(Ns[1..]);\r\n <= { lemma_mod_properties();\r\n lemma_mul_inequality(Ns[0]%power2(shift), power2(shift)-1, power2(32*(|Ns|-1))); }\r\n (power2(shift)-1) * power2(32*(|Ns|-1))\r\n + BEWordSeqToInt(Ns[1..]);\r\n < { lemma_BEDigitSeqToInt_bound(pv, Ns[1..]);\r\n lemma_power2_unfolding(32, |Ns|-1);\r\n lemma_mul_is_mul_boogie(32, |Ns|-1); }\r\n (power2(shift)-1)* power2(32*(|Ns|-1))\r\n + power2(32*(|Ns|-1));\r\n { lemma_mul_basics_forall(); }\r\n (power2(shift)-1)* power2(32*(|Ns|-1))\r\n + mul(1,power2(32*(|Ns|-1)));\r\n { lemma_mul_is_distributive_add_other_way(power2(32*(|Ns|-1)), power2(shift)-1, 1); }\r\n power2(shift)*power2(32*(|Ns|-1));\r\n { lemma_power2_adds(shift, 32*(|Ns|-1)); }\r\n power2(e);\r\n }\r\n assert (Ns[0]%power2(shift))*power2(32*(|Ns|-1)) + BEWordSeqToInt(Ns[1..]) < power2(e);\r\n lemma_BEDigitSeqToInt_bound(pv, Ns[1..]);\r\n lemma_div_multiples_vanish_fancy(\r\n Ns[0]/power2(shift),\r\n (Ns[0]%power2(shift))*power2(32*(|Ns|-1)) + BEWordSeqToInt(Ns[1..]),\r\n power2(e)); }\r\n Ns[0]/power2(shift);\r\n s;\r\n }\r\n if (00 ==> 0, top_word:int, b:nat) returns (s:int, e:nat)\r\n requires n!=null;\r\n requires IsWordSeq(n[..]);\r\n requires 0<=top_word n[j]==0;\r\n requires 00 && e>0 ==> power2(b-1) <= s;\r\n{\r\n lemma_2toX();\r\n ghost var pv := power2(32);\r\n ghost var Ns_all := n[..];\r\n ghost var Ns := n[top_word..];\r\n lemma_LeadingZeros(pv, Ns, Ns_all);\r\n ghost var Nv := BEWordSeqToInt(Ns);\r\n assert Nv == BEWordSeqToInt(Ns_all);\r\n calc {\r\n 0;\r\n < { lemma_power_positive(pv, |Ns|-1);\r\n lemma_mul_strictly_positive(Ns[0], power(pv, |Ns|-1)); }\r\n Ns[0] * power(pv, |Ns|-1);\r\n <= { lemma_BEDigitSeqToInt_bound(pv, Ns); }\r\n BEDigitSeqToInt(pv, Ns);\r\n }\r\n\r\n var first_word := n[top_word];\r\n var n_length := n.Length - top_word;\r\n var first_word_ge_p2b:bool;\r\n\r\n if (b==32) {\r\n first_word_ge_p2b := false;\r\n assert first_word < power2(b);\r\n } else {\r\n var p2b := MakePower2(b);\r\n first_word_ge_p2b := (first_word >= p2b);\r\n }\r\n assert first_word_ge_p2b == (first_word >= power2(b));\r\n\r\n if (first_word_ge_p2b)\r\n {\r\n s, e := TakeTopBits_first_word_ge_p2b(n, top_word, b, first_word, n_length, pv, Ns_all, Ns, Nv);\r\n }\r\n else if (n_length == 1)\r\n {\r\n s := first_word;\r\n lemma_BEDigitSeqToInt_singleton(pv, s);\r\n assert Ns==[s]; //- OBSERVE SEQS\r\n assert BEWordSeqToInt(n[..])==s;\r\n e := 0;\r\n lemma_power2_0_is_1();\r\n lemma_div_basics(BEWordSeqToInt(n[..]));\r\n }\r\n else\r\n {\r\n //- Need a left shift and some high bits from next word down.\r\n //- This is a lot like the case above, but even longer since\r\n //- we have to shuffle more power2()s around.\r\n var ne := CountBits(first_word);\r\n\r\n if (b <= ne-1)\r\n {\r\n lemma_power2_increases(b, ne-1);\r\n//- assert p2b <= power2(ne-1) <= first_word < p2b;\r\n }\r\n\r\n assert 0 < ne <= b;\r\n\r\n var left_shift := b - ne;\r\n var hi_s := BitShiftLeft_Word(first_word, left_shift);\r\n\r\n calc {\r\n first_word*power2(left_shift);\r\n < { lemma_mul_strict_inequality(first_word, power2(ne), power2(left_shift)); }\r\n power2(ne)*power2(left_shift);\r\n { lemma_power2_adds(ne, left_shift); }\r\n power2(b);\r\n <= { lemma_power2_increases(b,32); }\r\n power2(32);\r\n }\r\n lemma_mul_nonnegative(first_word, power2(left_shift));\r\n lemma_small_mod(first_word*power2(left_shift), power2(32));\r\n\r\n var second_word := n[top_word+1];\r\n var right_shift := 32 - left_shift;\r\n var low_s := BitShiftRight_Word(second_word, right_shift);\r\n\r\n s := hi_s + low_s;\r\n e := 32*(n_length-1) - left_shift;\r\n\r\n lemma_mul_strictly_positive(first_word, power2(left_shift));\r\n assert 0 < hi_s;\r\n\r\n assert 0 <= low_s;\r\n calc {\r\n low_s;\r\n second_word/power2(right_shift);\r\n < { lemma_power2_adds(32-right_shift, right_shift);\r\n lemma_div_by_multiple_is_strongly_ordered(second_word, power2(32), power2(32 - right_shift), power2(right_shift)); }\r\n power2(32)/power2(right_shift);\r\n { lemma_power2_div_is_sub(right_shift, 32); }\r\n power2(left_shift);\r\n }\r\n calc {\r\n s;\r\n hi_s + low_s;\r\n first_word*power2(left_shift) + low_s;\r\n <\r\n first_word*power2(left_shift) + power2(left_shift);\r\n { lemma_mul_basics_forall(); }\r\n first_word*power2(left_shift) + mul(1,power2(left_shift));\r\n { lemma_mul_is_distributive_add_other_way(power2(left_shift), first_word, 1); }\r\n (first_word+1)*power2(left_shift);\r\n <= { lemma_mul_inequality(first_word+1, power2(ne), power2(left_shift)); }\r\n power2(ne)*power2(left_shift);\r\n { lemma_power2_adds(ne, left_shift); }\r\n power2(b);\r\n }\r\n assert 0 < s < power2(b);\r\n calc {\r\n BEWordSeqToInt(Ns);\r\n { lemma_BEInterpretation(pv, Ns, n_length-1);\r\n assert Ns[..1] == [Ns[0]]; //- OBSERVE\r\n lemma_BEDigitSeqToInt_singleton(pv, Ns[0]);\r\n lemma_power2_unfolding(32, n_length-1);\r\n lemma_mul_is_mul_boogie(32, n_length-1); }\r\n first_word*power2(32*(n_length-1)) + BEWordSeqToInt(Ns[1..]);\r\n { lemma_BEInterpretation(pv, Ns[1..], n_length-2);\r\n assert Ns[1..][..1] == [Ns[1]]; //- OBSERVE\r\n assert Ns[1..][1..] == Ns[2..]; //- OBSERVE\r\n lemma_BEDigitSeqToInt_singleton(pv, Ns[1]);\r\n lemma_power2_unfolding(32, n_length-2);\r\n lemma_mul_is_mul_boogie(32, n_length-2); }\r\n first_word*power2(32*(n_length-1))\r\n + second_word*power2(32*(n_length-2))\r\n + BEWordSeqToInt(Ns[2..]);\r\n { lemma_power2_adds(left_shift, 32*(n_length-1)-left_shift);\r\n lemma_mul_is_associative_forall(); }\r\n hi_s*power2(e)\r\n + second_word*power2(32*(n_length-2))\r\n + BEWordSeqToInt(Ns[2..]);\r\n { lemma_fundamental_div_mod(second_word, power2(right_shift)); }\r\n\r\n hi_s*power2(e)\r\n + (power2(right_shift)*low_s + second_word%power2(right_shift))\r\n *power2(32*(n_length-2))\r\n + BEWordSeqToInt(Ns[2..]);\r\n {\r\n calc {\r\n (power2(right_shift)*low_s + second_word%power2(right_shift))\r\n *power2(32*(n_length-2));\r\n { lemma_mul_is_distributive_add_other_way(power2(32*(n_length-2)), power2(right_shift)*low_s, second_word%power2(right_shift)); }\r\n (power2(right_shift)*low_s)*power2(32*(n_length-2))\r\n +(second_word%power2(right_shift))*power2(32*(n_length-2));\r\n { lemma_mul_is_commutative(power2(right_shift), low_s); }\r\n (low_s*power2(right_shift))*power2(32*(n_length-2))\r\n +(second_word%power2(right_shift))*power2(32*(n_length-2));\r\n { lemma_mul_is_associative(low_s, power2(right_shift), power2(32*(n_length-2))); }\r\n low_s*(power2(right_shift)*power2(32*(n_length-2)))\r\n +(second_word%power2(right_shift))*power2(32*(n_length-2));\r\n { lemma_power2_adds(right_shift, 32*(n_length-2)); }\r\n low_s*power2(e)\r\n +(second_word%power2(right_shift))*power2(32*(n_length-2));\r\n }\r\n }\r\n hi_s*power2(e)\r\n + low_s*power2(e)\r\n + (second_word%power2(right_shift)) * power2(32*(n_length-2))\r\n + BEWordSeqToInt(Ns[2..]);\r\n { lemma_mul_is_distributive_add_other_way(power2(e), hi_s, low_s); }\r\n s*power2(e)\r\n + (second_word%power2(right_shift)) * power2(32*(n_length-2))\r\n + BEWordSeqToInt(Ns[2..]);\r\n }\r\n\r\n calc {\r\n 0;\r\n <= { lemma_mod_properties(); assert(power2(right_shift) > 0); }\r\n second_word%power2(right_shift);\r\n }\r\n lemma_mul_nonnegative(\r\n second_word%power2(right_shift),\r\n power2(32*(n_length-2)));\r\n lemma_BEDigitSeqToInt_bound(pv, Ns[2..]);\r\n calc {\r\n (second_word%power2(right_shift)) * power2(32*(n_length-2))\r\n + BEWordSeqToInt(Ns[2..]);\r\n < { lemma_power2_unfolding(32, n_length-2);\r\n lemma_mul_is_mul_boogie(32, n_length-2); }\r\n (second_word%power2(right_shift)) * power2(32*(n_length-2))\r\n + power2(32*(n_length-2));\r\n <= { lemma_mod_properties();\r\n lemma_mul_inequality(\r\n second_word%power2(right_shift),\r\n (power2(right_shift)-1),\r\n power2(32*(n_length-2))); }\r\n (power2(right_shift)-1) * power2(32*(n_length-2))\r\n + power2(32*(n_length-2));\r\n { lemma_mul_basics_forall(); }\r\n (power2(right_shift)-1) * power2(32*(n_length-2))\r\n + mul(1,power2(32*(n_length-2))); //- OBSERVE\r\n { lemma_mul_is_distributive_add_other_way(power2(32*(n_length-2)), power2(right_shift)-1, 1); }\r\n power2(right_shift) * power2(32*(n_length-2));\r\n { lemma_power2_adds(right_shift, 32*(n_length-2)); }\r\n power2(e);\r\n }\r\n lemma_div_multiples_vanish_fancy(s,\r\n (second_word%power2(right_shift)) * power2(32*(n_length-2))\r\n + BEWordSeqToInt(Ns[2..]),\r\n power2(e));\r\n lemma_mul_is_commutative_forall();\r\n assert s == BEWordSeqToInt(n[..]) / power2(e);\r\n\r\n if (b>0 && e>0)\r\n {\r\n calc {\r\n power2(b-1);\r\n { lemma_power2_adds(ne-1, left_shift); }\r\n power2(ne-1)*power2(left_shift);\r\n <= { lemma_mul_inequality(power2(ne-1), first_word, power2(left_shift)); }\r\n first_word*power2(left_shift);\r\n <=\r\n s;\r\n }\r\n }\r\n }\r\n}\r\n\r\nmethod {:dafnycc_conservative_seq_triggers} TakeTopBits(n:array, b:nat) returns (s:int, e:nat)\r\n requires n!=null;\r\n requires IsWordSeq(n[..]);\r\n requires BEWordSeqToInt(n[..])!=0;\r\n requires 0 < b <= 32;\r\n ensures 0 < s < power2(b);\r\n ensures s == BEWordSeqToInt(n[..]) / power2(e);\r\n ensures b>0 && e>0 ==> power2(b-1) <= s;\r\n{\r\n lemma_2to32();\r\n ghost var Ns := n[..];\r\n\r\n if (n.Length==0)\r\n {\r\n reveal_BEDigitSeqToInt_private();\r\n//- assert n[..] == Ns;\r\n assert BEWordSeqToInt(n[..])==0;\r\n assert false;\r\n }\r\n var top_word := CountTopZeroWords(n);\r\n if (top_word==n.Length)\r\n {\r\n lemma_LeadingZeros(power2(32), [], Ns);\r\n reveal_BEDigitSeqToInt_private();\r\n//- assert BEWordSeqToInt(Ns)==0;\r\n//- assert BEWordSeqToInt(n[..])==0;\r\n s := 0; e := 0; //- dafnycc\r\n assert false;\r\n return;\r\n }\r\n s,e := TakeTopBits_inner(n, top_word, b);\r\n}\r\n\r\nmethod BitShiftLeft_Array(x:array, b:nat) returns (xb:array)\r\n requires x!=null;\r\n requires IsWordSeq(x[..]);\r\n requires IsWord(b);\r\n ensures xb!=null;\r\n ensures IsWordSeq(xb[..]);\r\n ensures BEWordSeqToInt(xb[..]) == BEWordSeqToInt(x[..])*power2(b);\r\n \r\n{\r\n lemma_2toX();\r\n var s_words, s_bits := Divide32(b, 32);\r\n lemma_mul_is_mul_boogie(s_words, 32);\r\n lemma_mod_properties();\r\n var base_word := MakePower2(s_bits);\r\n lemma_power2_strictly_increases(s_bits, 32);\r\n var Xs := x[..];\r\n\r\n xb := MultiplyOneRow(x, base_word, s_words);\r\n calc {\r\n BEWordSeqToInt(xb[..]);\r\n base_word * power2(32*s_words) * BEWordSeqToInt(x[..]);\r\n base_word * power2(32*s_words) * BEWordSeqToInt(Xs);\r\n power2(s_bits) * power2(32*s_words) * BEWordSeqToInt(Xs);\r\n { lemma_power2_adds(s_bits, 32*s_words); }\r\n power2(s_bits + 32*s_words) * BEWordSeqToInt(Xs);\r\n power2(b) * BEWordSeqToInt(Xs);\r\n { lemma_mul_is_commutative_forall(); }\r\n BEWordSeqToInt(Xs) * power2(b);\r\n BEWordSeqToInt(x[..]) * power2(b);\r\n }\r\n}\r\n\r\npredicate FatNatBitCount(X:seq, e:nat)\r\n requires IsWordSeq(X);\r\n{\r\n true\r\n && (e>0 ==> 00 ==> power2(e-1) <= BEWordSeqToInt(X))\r\n && (BEWordSeqToInt(X)>0\r\n ==> 0) returns (e:nat)\r\n requires x!=null && IsWordSeq(x[..]);\r\n ensures FatNatBitCount(x[..], e);\r\n ensures e == NatNumBits(BEWordSeqToInt_premium(x[..]));\r\n{\r\n ghost var pv := power2(32);\r\n lemma_2toX();\r\n ghost var Xs := x[..];\r\n\r\n var t := CountTopZeroWords(x);\r\n ghost var Xss := x[t..];\r\n ghost var Xv := BEWordSeqToInt(Xss);\r\n lemma_LeadingZeros(power2(32), Xss, Xs);\r\n if (t==x.Length)\r\n {\r\n e := 0;\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_power2_0_is_1();\r\n lemma_Power2BoundIsNatNumBits(e, Xv);\r\n return;\r\n }\r\n var b := CountBits(x[t]);\r\n e := 32*(x.Length - t - 1) + b;\r\n\r\n calc {\r\n BEWordSeqToInt(x[..]);\r\n BEWordSeqToInt(Xs);\r\n BEWordSeqToInt(Xss);\r\n Xv;\r\n }\r\n\r\n assert Xss[0] == x[t];\r\n assert 0)\r\n requires Word32(exp);\r\n ensures WellformedFatNat(S);\r\n ensures J(S) == power2(exp);\r\n{\r\n lemma_2toX();\r\n var one := MakeBELiteralArray(1); \r\n S := BitShiftLeft_Array(one, exp);\r\n lemma_mul_basics_forall();\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/CanonicalArrays.i.dfy", "content": "include \"../Util/seqs_canonical.i.dfy\"\r\ninclude \"../Util/seqs_and_ints.i.dfy\"\r\ninclude \"../Util/seqs_common.i.dfy\"\r\n\r\nmethod CountTopZeroWords(n:array) returns (i:int)\r\n requires n!=null;\r\n//- requires IsWordSeq(n[..]);\r\n ensures 0<=i<=n.Length;\r\n ensures forall j :: 0<=j n[j]==0;\r\n ensures i n[i]!=0;\r\n{\r\n i := 0;\r\n while (i < n.Length)\r\n invariant 0<=i<=n.Length;\r\n invariant forall j :: 0<=j n[j]==0;\r\n {\r\n if (n[i]!=0) {\r\n return;\r\n }\r\n i := i + 1;\r\n }\r\n}\r\n\r\nmethod CopyArray(dst:array, doff:nat, src:array, soff:nat, count:nat)\r\n requires src!=null;\r\n requires soff+count <= src.Length;\r\n requires dst!=null;\r\n requires doff+count <= dst.Length;\r\n requires src!=dst;\r\n modifies dst;\r\n ensures dst[doff..doff+count] == src[soff..soff+count];\r\n{\r\n var i:=0;\r\n while (i, src:array)\r\n requires dst != null;\r\n requires src != null;\r\n requires dst.Length == src.Length;\r\n requires dst != src;\r\n modifies dst;\r\n ensures dst != src;\r\n ensures dst[..] == src[..];\r\n{\r\n CopyArray(dst, 0, src, 0, src.Length);\r\n assert dst[..] == dst[0..src.Length]; //- OBSERVE SEQ\r\n assert src[..] == src[0..src.Length]; //- OBSERVE SEQ\r\n}\r\n\r\n\r\n\r\n\r\nfunction CanonicalizeSeq_def(pv:int, s:seq) : seq\r\n requires 1)\r\n requires 1) : seq\r\n requires 1) returns (na:array)\r\n requires a!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n ensures na!=null;\r\n ensures IsCanonicalDigitSeq(power2(32), na[..]);\r\n ensures BEWordSeqToInt(na[..]) == BEWordSeqToInt(a[..]);\r\n ensures na.Length <= a.Length;\r\n ensures fresh(na) || na == a;\r\n{\r\n lemma_2toX();\r\n ghost var As := a[..];\r\n\r\n var t := CountTopZeroWords(a);\r\n if (t==0)\r\n {\r\n na := a;\r\n return;\r\n }\r\n var count := a.Length - t;\r\n na := new int[count];\r\n CopyArray(na, 0, a, t, count);\r\n ghost var Nas := na[..];\r\n\r\n assert Nas==Nas[0..count]; //- OBSERVE SEQ\r\n\r\n lemma_LeadingZeros(power2(32), Nas, As);\r\n}\r\n\r\nmethod MakeBELiteralArray(x:nat) returns (xa:array)\r\n requires IsWord(x);\r\n ensures xa!=null;\r\n ensures IsWordSeq(xa[..]);\r\n ensures BEWordSeqToInt(xa[..]) == x;\r\n ensures xa.Length == if x==0 then 0 else 1;\r\n ensures IsCanonicalDigitSeq(power2(32), xa[..]);\r\n ensures fresh(xa);\r\n{\r\n if (x==0)\r\n {\r\n xa := new int[0];\r\n reveal_BEDigitSeqToInt_private();\r\n return;\r\n }\r\n xa := new int[1];\r\n xa[0] := x;\r\n lemma_2toX();\r\n assert xa[..]==[x]; //- OBSERVE\r\n lemma_BEDigitSeqToInt_singleton(power2(32), x);\r\n}\r\n\r\npredicate IsZeroValue_def(a:seq)\r\n requires IsWordSeq(a);\r\n{\r\n forall j :: 0<=j<|a| ==> a[j]==0\r\n}\r\n\r\nlemma lemma_IsZeroValue(a:seq)\r\n requires IsWordSeq(a);\r\n ensures IsZeroValue_def(a) <==> (BEWordSeqToInt(a[..])==0);\r\n decreases |a|;\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_2toX();\r\n\r\n if (IsZeroValue_def(a))\r\n {\r\n if (0<|a|)\r\n {\r\n lemma_IsZeroValue(a[0..|a|-1]);\r\n }\r\n } else {\r\n lemma_BEDigitSeqToInt_bound(power2(32), a[0..|a|-1]);\r\n if (a[|a|-1]!=0) {\r\n calc {\r\n BEWordSeqToInt(a[..]);\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEWordSeqToInt(a[0..|a|-1])*power2(32) + a[|a|-1];\r\n > 0;\r\n }\r\n } else {\r\n if (IsZeroValue_def(a[0..|a|-1]))\r\n {\r\n forall (i | 0<=i<|a|)\r\n ensures a[i]==0;\r\n {\r\n if (i<|a|-1)\r\n {\r\n assert a[i]==a[0..|a|-1][i]; //- OBSERVE SEQ\r\n }\r\n }\r\n assert false;\r\n }\r\n //- assert !IsZeroValue_def(a[0..|a|-1]);\r\n lemma_IsZeroValue(a[0..|a|-1]);\r\n//- assert BEWordSeqToInt(a)!=0;\r\n }\r\n }\r\n}\r\n\r\npredicate IsZeroValue(a:seq)\r\n requires IsWordSeq(a);\r\n ensures IsZeroValue(a) <==> (BEWordSeqToInt(a[..])==0);\r\n{\r\n lemma_IsZeroValue(a);\r\n IsZeroValue_def(a)\r\n}\r\n\r\n\r\nmethod FatNatIsZero(a:array) returns (rc:bool)\r\n requires a!=null;\r\n requires IsWordSeq(a[..]);\r\n ensures rc <==> IsZeroValue(a[..]);\r\n{\r\n var t := CountTopZeroWords(a);\r\n rc := t==a.Length;\r\n}\r\n\r\nmethod FatNatZero() returns (Z:array)\r\n ensures Z!=null;\r\n ensures IsWordSeq(Z[..]);\r\n ensures BEWordSeqToInt(Z[..]) == 0;\r\n ensures fresh(Z);\r\n{\r\n Z := new int[0];\r\n assert IsZeroValue(Z[..]);\r\n}\r\n\r\nmethod TrimLeadingZerosArray(ghost pv:int, M:array) returns (N:array)\r\n requires 1) returns (c:array)\r\n requires a!=null;\r\n ensures c!=null;\r\n ensures fresh(c);\r\n ensures c.Length == zeros+a.Length;\r\n ensures forall i :: 0<=i c[i]==0;\r\n ensures c[zeros..] == a[..];\r\n ensures IsByteSeq(a[..]) ==> IsByteSeq(c[..]);\r\n ensures IsWordSeq(a[..]) ==> IsWordSeq(c[..]);\r\n{\r\n var outlen := zeros+a.Length;\r\n c := new int[outlen];\r\n\r\n var j := 0;\r\n while (j c[i]==0;\r\n {\r\n c[j] := 0;\r\n j := j + 1;\r\n }\r\n\r\n while (j c[i]==0;\r\n invariant c[zeros..j] == a[..j-zeros];\r\n {\r\n c[j] := a[j-zeros];\r\n assert c[zeros..j+1] == c[zeros..j] + [c[j]];\r\n assert a[..j+1-zeros] == a[..j-zeros] + [a[j-zeros]];\r\n j := j + 1;\r\n }\r\n assert c[zeros..] == c[zeros..j]; //- OBSERVE SEQ\r\n assert a[..j-zeros] == a[..]; //- OBSERVE SEQ\r\n lemma_2toX();\r\n assert power2(8)==256;\r\n //- ensures IsByteSeq(a[..]) ==> IsByteSeq(c[..]);\r\n if (IsByteSeq(a[..]))\r\n {\r\n forall (i | 0<=i);\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nfunction {:heap} WellformedFatInt(A:FatInt) : bool\r\n reads A.value;\r\n{\r\n A.value != null\r\n && IsWordSeq(A.value[..])\r\n && (IsZeroValue(A.value[..]) ==> !A.negate) //- disallow redundant zero (-0)\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nfunction {:heap} FIV(A:FatInt) : int\r\n requires WellformedFatInt(A);\r\n reads A.value;\r\n ensures (FIV(A) < 0) <==> A.negate;\r\n{\r\n lemma_2toX();\r\n lemma_BEDigitSeqToInt_bound(power2(32), A.value[..]);\r\n if (A.negate) then\r\n -BEWordSeqToInt(A.value[..])\r\n else\r\n BEWordSeqToInt(A.value[..])\r\n}\r\n\r\nmethod FatIntNegate(A:FatInt) returns (R:FatInt)\r\n requires WellformedFatInt(A);\r\n ensures WellformedFatInt(R);\r\n ensures FIV(R) == -FIV(A);\r\n{\r\n var z := FatNatIsZero(A.value);\r\n if (z) {\r\n R := A;\r\n } else {\r\n R := FatInt_ctor(!A.negate, A.value);\r\n }\r\n}\r\n\r\nmethod FatIntAddSameSign(A:FatInt, B:FatInt) returns (R:FatInt)\r\n requires A.negate == B.negate;\r\n requires WellformedFatInt(A);\r\n requires WellformedFatInt(B);\r\n ensures WellformedFatInt(R);\r\n ensures FIV(A)+FIV(B) == FIV(R);\r\n{\r\n ghost var As := A.value[..];\r\n ghost var Bs := B.value[..];\r\n var value:array := FatNatAdd(A.value, B.value);\r\n ghost var Rs := value[..];\r\n assert BEWordSeqToInt(Rs) == BEWordSeqToInt(As) + BEWordSeqToInt(Bs);\r\n R := FatInt_ctor(A.negate, value);\r\n lemma_BEDigitSeqToInt_bound(power2(32), As);\r\n lemma_BEDigitSeqToInt_bound(power2(32), Bs);\r\n if (A.negate)\r\n {\r\n assert B.negate;\r\n calc {\r\n FIV(R);\r\n -BEWordSeqToInt(Rs);\r\n -(BEWordSeqToInt(As)+BEWordSeqToInt(Bs));\r\n -BEWordSeqToInt(As)-BEWordSeqToInt(Bs);\r\n FIV(A)+FIV(B);\r\n }\r\n }\r\n else\r\n {\r\n assert !B.negate;\r\n calc {\r\n FIV(R);\r\n BEWordSeqToInt(Rs);\r\n BEWordSeqToInt(As)+BEWordSeqToInt(Bs);\r\n FIV(A)+FIV(B);\r\n }\r\n }\r\n}\r\n\r\nmethod FatIntSubPos(A:FatInt, B:FatInt) returns (R:FatInt)\r\n requires !A.negate && !B.negate;\r\n requires WellformedFatInt(A);\r\n requires WellformedFatInt(B);\r\n ensures WellformedFatInt(R);\r\n ensures FIV(A)-FIV(B) == FIV(R);\r\n{\r\n //- A - B ==> this is the interesting case\r\n ghost var As := A.value[..];\r\n ghost var Bs := B.value[..];\r\n var cmp := FatNatCompare(A.value,B.value);\r\n lemma_BEDigitSeqToInt_bound(power2(32), As);\r\n lemma_BEDigitSeqToInt_bound(power2(32), Bs);\r\n if (cmp.CmpLt?)\r\n {\r\n var value:array := FatNatSub(B.value, A.value);\r\n R := FatInt_ctor(true, value);\r\n }\r\n else\r\n {\r\n var value:array := FatNatSub(A.value, B.value);\r\n R := FatInt_ctor(false, value);\r\n }\r\n}\r\n\r\nmethod FatIntAdd(A:FatInt, B:FatInt) returns (R:FatInt)\r\n requires WellformedFatInt(A);\r\n requires WellformedFatInt(B);\r\n ensures WellformedFatInt(R);\r\n ensures FIV(A)+FIV(B) == FIV(R);\r\n{\r\n var a_ref := A.value; //- do something real to A.value to convince dafyncc it's allocated\r\n var b_ref := B.value; //- do something real to B.value to convince dafyncc it's allocated\r\n\r\n if (A.negate == B.negate)\r\n {\r\n R := FatIntAddSameSign(A, B);\r\n }\r\n else if (A.negate)\r\n {\r\n assert !B.negate;\r\n var NA := FatIntNegate(A);\r\n var na_ref := NA.value; //- do something real to NA.value to convince dafnycc it's allocated\r\n R := FatIntSubPos(B,NA);\r\n }\r\n else\r\n {\r\n //- A - B\r\n var NB := FatIntNegate(B);\r\n var nb_ref := NB.value; //- do something real to NB.value to convince dafnycc it's allocated\r\n R := FatIntSubPos(A,NB);\r\n }\r\n}\r\n\r\nmethod FatIntSub(A:FatInt, B:FatInt) returns (R:FatInt)\r\n requires WellformedFatInt(A);\r\n requires WellformedFatInt(B);\r\n ensures WellformedFatInt(R);\r\n ensures FIV(A)-FIV(B) == FIV(R);\r\n{\r\n var a_ref := A.value; //- do something real to A.value to convince dafyncc it's allocated\r\n var b_ref := B.value; //- do something real to B.value to convince dafyncc it's allocated\r\n\r\n if (B.negate)\r\n {\r\n //- -A - -B == -A + B\r\n //- A - -B == A + B\r\n var NB := FatIntNegate(B);\r\n var nb_ref := NB.value; //- do something real to NB.value to convince dafnycc it's allocated\r\n R := FatIntAdd(A, NB);\r\n calc {\r\n FIV(R);\r\n FIV(A) + FIV(NB);\r\n FIV(A) + -FIV(B);\r\n FIV(A) - FIV(B);\r\n }\r\n }\r\n else if (A.negate)\r\n {\r\n assert !B.negate;\r\n //- -A - B == - (A + B)\r\n ghost var As := A.value[..];\r\n ghost var Bs := B.value[..];\r\n var value:array := FatNatAdd(A.value, B.value);\r\n lemma_BEDigitSeqToInt_bound(power2(32), As);\r\n lemma_BEDigitSeqToInt_bound(power2(32), Bs);\r\n R := FatInt_ctor(true, value);\r\n }\r\n else\r\n {\r\n R := FatIntSubPos(A, B);\r\n }\r\n}\r\n\r\nmethod FatIntCmp(A:FatInt, B:FatInt) returns (c:Cmp)\r\n requires WellformedFatInt(A);\r\n requires WellformedFatInt(B);\r\n ensures (c.CmpLt?) <==> (FIV(A) < FIV(B));\r\n ensures (c.CmpEq?) <==> (FIV(A) == FIV(B));\r\n ensures (c.CmpGt?) <==> (FIV(A) > FIV(B));\r\n{\r\n var a_ref := A.value; //- do something real to A.value to convince dafyncc it's allocated\r\n var b_ref := B.value; //- do something real to B.value to convince dafyncc it's allocated\r\n\r\n if (A.negate)\r\n {\r\n if (!B.negate)\r\n { //- -A, B\r\n c := CmpLt;\r\n assert FIV(A) < 0 <= FIV(B);\r\n }\r\n else\r\n { //- -A,-B\r\n var nc := FatNatCompare(A.value,B.value);\r\n if (nc.CmpEq?)\r\n {\r\n c := CmpEq;\r\n }\r\n else if (nc.CmpLt?)\r\n {\r\n c := CmpGt;\r\n }\r\n else\r\n {\r\n c := CmpLt;\r\n }\r\n }\r\n }\r\n else\r\n {\r\n if (B.negate)\r\n { //- A, -B\r\n c := CmpGt;\r\n assert FIV(A) >= 0 > FIV(B);\r\n }\r\n else\r\n { //- A, B\r\n c := FatNatCompare(A.value,B.value);\r\n }\r\n }\r\n}\r\n\r\nmethod FatIntLt(A:FatInt, B:FatInt) returns (r:bool)\r\n requires WellformedFatInt(A);\r\n requires WellformedFatInt(B);\r\n ensures r <==> FIV(A) FIV(A)<=FIV(B);\r\n{\r\n var c := FatIntCmp(A,B);\r\n r := c.CmpLt? || c.CmpEq?;\r\n}\r\n\r\nmethod FatIntEq(A:FatInt, B:FatInt) returns (r:bool)\r\n requires WellformedFatInt(A);\r\n requires WellformedFatInt(B);\r\n ensures r <==> FIV(A)==FIV(B);\r\n{\r\n var c := FatIntCmp(A,B);\r\n r := c.CmpEq?;\r\n}\r\n\r\nmethod FatIntGe(A:FatInt, B:FatInt) returns (r:bool)\r\n requires WellformedFatInt(A);\r\n requires WellformedFatInt(B);\r\n ensures r <==> FIV(A)>=FIV(B);\r\n{\r\n var c := FatIntCmp(A,B);\r\n r := c.CmpGt? || c.CmpEq?;\r\n}\r\n\r\nmethod FatIntGt(A:FatInt, B:FatInt) returns (r:bool)\r\n requires WellformedFatInt(A);\r\n requires WellformedFatInt(B);\r\n ensures r <==> FIV(A)>FIV(B);\r\n{\r\n var c := FatIntCmp(A,B);\r\n r := c.CmpGt?;\r\n}\r\n\r\nmethod FatIntMul(A:FatInt, B:FatInt) returns (R:FatInt)\r\n requires WellformedFatInt(A);\r\n requires WellformedFatInt(B);\r\n ensures WellformedFatInt(R);\r\n ensures FIV(A)*FIV(B) == FIV(R);\r\n{\r\n var a_ref := A.value; //- do something real to A.value to convince dafyncc it's allocated\r\n var b_ref := B.value; //- do something real to B.value to convince dafyncc it's allocated\r\n\r\n ghost var As := A.value[..];\r\n ghost var Bs := B.value[..];\r\n lemma_BEDigitSeqToInt_bound(power2(32), As);\r\n lemma_BEDigitSeqToInt_bound(power2(32), Bs);\r\n\r\n if ((A.negate && B.negate)\r\n || (!A.negate && !B.negate))\r\n {\r\n var value:array := FatNatMul(A.value, B.value);\r\n ghost var Rs := value[..];\r\n R := FatInt_ctor(false, value);\r\n\r\n if (A.negate)\r\n {\r\n calc {\r\n FIV(R);\r\n BEWordSeqToInt(Rs);\r\n BEWordSeqToInt(As) * BEWordSeqToInt(Bs);\r\n { lemma_mul_cancels_negatives(BEWordSeqToInt(As), BEWordSeqToInt(Bs)); }\r\n (-BEWordSeqToInt(As)) * (-BEWordSeqToInt(Bs));\r\n FIV(A) * FIV(B);\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n FIV(R);\r\n BEWordSeqToInt(Rs);\r\n BEWordSeqToInt(As) * BEWordSeqToInt(Bs);\r\n FIV(A) * FIV(B);\r\n }\r\n }\r\n }\r\n else //- if ((!A.negate && B.negate) || (A.negate && !B.negate))\r\n {\r\n var za := FatNatIsZero(A.value);\r\n var zb := FatNatIsZero(B.value);\r\n assert za <==> (BEWordSeqToInt(As)==0);\r\n if ((B.negate && za) || (A.negate && zb))\r\n {\r\n \r\n var Z := FatNatZero();\r\n R := FatInt_ctor(false, Z);\r\n lemma_mul_basics_forall();\r\n }\r\n else\r\n {\r\n var value:array := FatNatMul(A.value, B.value);\r\n ghost var Rs := value[..];\r\n R := FatInt_ctor(true, value);\r\n\r\n calc ==> {\r\n !IsZeroValue(As) && !IsZeroValue(Bs);\r\n BEWordSeqToInt(As)!=0 && BEWordSeqToInt(Bs)!=0;\r\n { lemma_mul_nonzero_forall(); }\r\n BEWordSeqToInt(As)*BEWordSeqToInt(Bs) != 0;\r\n BEWordSeqToInt(Rs) != 0;\r\n !IsZeroValue(Rs);\r\n WellformedFatInt(R);\r\n }\r\n\r\n if (A.negate)\r\n {\r\n calc {\r\n FIV(R);\r\n -BEWordSeqToInt(Rs);\r\n -(BEWordSeqToInt(As) * BEWordSeqToInt(Bs));\r\n { lemma_mul_properties(); }\r\n (-BEWordSeqToInt(As)) * BEWordSeqToInt(Bs);\r\n FIV(A) * FIV(B);\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n FIV(R);\r\n -BEWordSeqToInt(Rs);\r\n -(BEWordSeqToInt(As) * BEWordSeqToInt(Bs));\r\n { lemma_mul_properties(); }\r\n BEWordSeqToInt(As) * (-(BEWordSeqToInt(Bs)));\r\n FIV(A) * FIV(B);\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\nmethod FatIntDiv(N:FatInt, D:FatInt) returns (Q:FatInt, R:FatInt)\r\n requires WellformedFatInt(N);\r\n//- requires N.value.Length < power2(27);\r\n requires WellformedFatInt(D);\r\n requires BEWordSeqToInt(D.value[..])!=0;\r\n\r\n requires FIV(D) >= 0;\r\n ensures WellformedFatInt(Q);\r\n ensures WellformedFatInt(R);\r\n ensures 0 <= FIV(R) < FIV(D); //- negative D inverts this condition.\r\n ensures FIV(Q)*FIV(D) + FIV(R) == FIV(N);\r\n ensures FIV(N) / FIV(D) == FIV(Q);\r\n ensures FIV(N) % FIV(D) == FIV(R);\r\n{\r\n var n_ref := N.value; //- do something real to N.value to convince dafyncc it's allocated\r\n var d_ref := D.value; //- do something real to D.value to convince dafyncc it's allocated\r\n\r\n\r\n//- if (D.negate)\r\n//- {\r\n//- var q:BigNat,r:BigNat := BigNatDiv(N, FatIntNegate(D));\r\n//- Q := FatInt_ctor(true, q);\r\n//- R := FatInt_ctor(false, r);\r\n//- }\r\n\r\n ghost var Ns := N.value[..];\r\n ghost var Nv := BEWordSeqToInt(Ns);\r\n ghost var Ds := D.value[..];\r\n ghost var Dv := BEWordSeqToInt(Ds);\r\n var q:array,r:array := FatNatDiv(N.value, D.value);\r\n ghost var Qs := q[..];\r\n ghost var Qv := BEWordSeqToInt(Qs);\r\n ghost var Rs := r[..];\r\n ghost var Rv := BEWordSeqToInt(Rs);\r\n\r\n var zr := FatNatIsZero(r);\r\n if (N.negate && !zr)\r\n {\r\n var one := MakeBELiteralArray(1);\r\n ghost var Ones := one[..];\r\n ghost var Onev := BEWordSeqToInt(Ones);\r\n\r\n var q' := FatNatAdd(q, one);\r\n ghost var Q's := q'[..];\r\n ghost var Q'v := BEWordSeqToInt(Q's);\r\n Q := FatInt_ctor(true, q');\r\n lemma_BEDigitSeqToInt_bound(power2(32), Qs);\r\n var r' := FatNatSub(D.value, r);\r\n ghost var R's := r'[..];\r\n ghost var R'v := BEWordSeqToInt(R's);\r\n R := FatInt_ctor(false, r');\r\n calc ==> {\r\n true;\r\n 0 <= R'v < Dv;\r\n 0 <= FIV(R) < FIV(D);\r\n }\r\n calc ==> {\r\n true;\r\n Dv*Qv + Rv == Nv;\r\n { lemma_mul_is_commutative_forall(); }\r\n Qv*Dv + Rv == Nv;\r\n (Q'v-1)*Dv + (Dv - R'v) == Nv;\r\n { lemma_mul_is_distributive_forall(); }\r\n { lemma_mul_is_mul_boogie(1, Dv); }\r\n Q'v*Dv - Dv + (Dv - R'v) == Nv;\r\n Q'v*Dv - R'v == Nv;\r\n { lemma_mul_unary_negation(Q'v, Dv); }\r\n (-Q'v)*Dv + R'v == -Nv;\r\n FIV(Q)*FIV(D) + FIV(R) == FIV(N);\r\n }\r\n }\r\n else\r\n {\r\n var zq := FatNatIsZero(q);\r\n if (N.negate && zq)\r\n {\r\n calc ==> {\r\n true;\r\n Dv*Qv + Rv == Nv;\r\n { lemma_mul_is_commutative_forall(); }\r\n Qv*Dv + Rv == Nv;\r\n Qv*Dv == Nv;\r\n { lemma_mul_is_mul_boogie(0, Dv); }\r\n 0*Dv == Nv;\r\n false;\r\n }\r\n }\r\n Q := FatInt_ctor(N.negate, q);\r\n R := FatInt_ctor(false, r);\r\n calc ==> {\r\n 0 <= Rv < Dv;\r\n 0 <= FIV(R) < FIV(D);\r\n }\r\n if (N.negate)\r\n {\r\n calc ==> {\r\n true;\r\n Dv*Qv + Rv == Nv;\r\n { lemma_mul_is_commutative_forall(); }\r\n Qv*Dv + Rv == Nv;\r\n Qv*Dv == Nv;\r\n { lemma_mul_unary_negation(Qv, Dv); }\r\n (-Qv)*Dv == -Nv;\r\n FIV(Q)*FIV(D) == FIV(N);\r\n FIV(Q)*FIV(D) + FIV(R) == FIV(N);\r\n }\r\n }\r\n else\r\n {\r\n calc ==> {\r\n true;\r\n Dv*Qv + Rv == Nv;\r\n { lemma_mul_is_commutative_forall(); }\r\n Qv*Dv + Rv == Nv;\r\n FIV(Q)*FIV(D) + FIV(R) == FIV(N);\r\n }\r\n }\r\n }\r\n lemma_fundamental_div_mod_converse(FIV(N), FIV(D), FIV(Q), FIV(R));\r\n}\r\n\r\nmethod MakeSmallLiteralFatInt(x:nat) returns (f:FatInt)\r\n requires x < Width();\r\n ensures WellformedFatInt(f);\r\n ensures FIV(f)==x;\r\n{\r\n var a;\r\n if (x==0) {\r\n a := FatNatZero();\r\n } else {\r\n a := MakeBELiteralArray(x);\r\n }\r\n f := FatInt_ctor(false, a);\r\n}\r\n\r\nmethod CanonicalizeFatInt(f:FatInt) returns (na:FatInt)\r\n requires WellformedFatInt(f);\r\n ensures WellformedFatInt(na);\r\n ensures FIV(f) == FIV(na);\r\n ensures na.value.Length <= f.value.Length;\r\n ensures IsCanonicalDigitSeq(power2(32), na.value[..]);\r\n{\r\n var fvc := CanonicalizeArray(f.value);\r\n na := FatInt_ctor(f.negate, fvc);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatAdd.i.dfy", "content": "include \"FatNatCommon.i.dfy\"\r\ninclude \"FatNatX86.i.dfy\"\r\ninclude \"../Util/beseqs_simple.i.dfy\"\r\ninclude \"FatNatAddLemmas.i.dfy\"\r\n\r\npredicate FNAddRelation_local(pv:int, a:seq, b:seq, c:seq, carryin:seq, i:int)\r\n requires 1, b:seq, c:seq, carryin:seq)\r\n requires 1 FNAddRelation_local(pv, a, b, c, carryin, i)\r\n}\r\n\r\nlemma lemma_FNAddition_recursive(pv:int, a:seq, b:seq, c:seq, carryin:seq)\r\n requires 1, b:seq, c:seq, carryin:seq)\r\n requires 1, b:seq, c:seq, carryin:seq, j:int)\r\n requires 1= j;\r\n{\r\n forall i :: 0 <= i < j\r\n ==> FNAddRelation_local(pv, a, b, c[|c|-j..], carryin, i)\r\n}\r\n\r\nlemma lemma_AddRelationInduction(pv:int, a:seq, b:seq, c:seq, carryin:seq, j:int)\r\n requires 1 0)\r\n {\r\n lemma_mul_increases(DigitAt(carryin,i), pv);\r\n assert false;\r\n }\r\n }\r\n }\r\n}\r\n\r\n\r\n\r\nlemma lemma_FNAddition_induction(pv:int, oml:int, a:seq, b:seq, oldc:seq, c:seq, oldcarryin:seq, carryin:seq, oldj:int, j:int, lastcarry:int)\r\n requires 1 DigitAt(c, i) == DigitAt(oldc, i);\r\n requires FNAddRelation_inductive(pv, a, b, oldc, oldcarryin, oldj);\r\n requires DigitAt(a,oldj)+DigitAt(b,oldj)+DigitAt(oldcarryin,oldj) == DigitAt(c,oldj) + DigitAt(carryin,j) * pv;\r\n ensures 0 <= |c|-j < |c|;\r\n ensures IsDigitSeq(pv, c[|c|-j..]);\r\n ensures FNAddRelation_inductive(pv, a, b, c, [lastcarry]+oldcarryin, j);\r\n{\r\n assert 0 <= |c|-j < |c|;\r\n\r\n assert lastcarry == DigitAt(carryin, j);\r\n\r\n ghost var olda := a;\r\n ghost var oldb := b;\r\n ghost var newc := c[|c|-j..];\r\n forall (i | 0 <= i < j)\r\n ensures FNAddRelation_local(pv, a, b, newc, carryin, i);\r\n {\r\n if (i FNAddRelation_local(pv, a, b, newc, carryin, i);\r\n assert forall i :: 0 <= i < j\r\n ==> FNAddRelation_local(pv, a, b, c[|c|-j..], carryin, i);\r\n assert FNAddRelation_inductive(pv, a, b, c, carryin, j);\r\n}\r\n\r\nmethod FatNatAdd(a:array, b:array) returns (c:array)\r\n requires a!=null;\r\n requires b!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n requires IsDigitSeq(power2(32), b[..]);\r\n ensures c!=null;\r\n ensures IsDigitSeq(power2(32), c[..]);\r\n ensures BEWordSeqToInt(a[..]) + BEWordSeqToInt(b[..]) == BEWordSeqToInt(c[..]);\r\n{\r\n ghost var pv := power2(32);\r\n lemma_2toX32();\r\n ghost var carryin:seq := [0];\r\n var iml := (if a.Length > b.Length then a.Length else b.Length);\r\n var oml := iml + 1; //- +1 => leave space for overflow\r\n c := new int[oml];\r\n assert oml == MaxLen3(a[..],b[..],c[..]);\r\n var lastcarry := 0;\r\n var j:=0;\r\n while (j < oml)\r\n invariant 0 <= j <= oml;\r\n invariant IsBitSeq(carryin);\r\n invariant lastcarry == DigitAt(carryin, j);\r\n invariant DigitAt(carryin, 0) == 0;\r\n invariant IsDigitSeq(pv, c[c.Length-j..]);\r\n invariant |carryin| == j+1;\r\n invariant FNAddRelation_inductive(pv, a[..], b[..], c[..], carryin, j);\r\n {\r\n ghost var olda := a[..];\r\n ghost var oldb := b[..];\r\n ghost var oldc := c[..];\r\n ghost var oldcarryin := carryin[..];\r\n ghost var oldj := j;\r\n assert FNAddRelation_inductive(pv, olda, oldb, oldc, oldcarryin, oldj);\r\n\r\n var sum,carry := Add32_with_carry(\r\n ArrayDigitAt_add(a,j), ArrayDigitAt_add(b,j), lastcarry);\r\n assert c[..] == oldc; //- OBSERVE\r\n\r\n carryin := [carry] + carryin;\r\n lastcarry := carry;\r\n c[c.Length - 1 - j] := sum;\r\n\r\n assert c[c.Length-1-j..] == [c[c.Length-1-j]] + c[c.Length-j..]; //- OBSERVE\r\n\r\n j:=j+1;\r\n assert olda==a[..];\r\n assert oldb==b[..];\r\n lemma_FNAddition_induction(pv, oml, a[..], b[..], oldc, c[..], oldcarryin, carryin, oldj, j, lastcarry);\r\n }\r\n\r\n assert c[..] == c[c.Length-oml..]; //- OBSERVE\r\n\r\n lemma_AddRelationInduction(pv, a[..], b[..], c[..], carryin, oml);\r\n\r\n ghost var la := [0]+a[..];\r\n ghost var lb := [0]+b[..];\r\n ghost var lc := [0]+c[..];\r\n lemma_FNAddition(pv, la, lb, lc, carryin);\r\n lemma_LeadingZeros(pv, a[..], la);\r\n lemma_LeadingZeros(pv, b[..], lb);\r\n lemma_LeadingZeros(pv, c[..], lc);\r\n}\r\n\r\nlemma lemma_FNAddition_induction_unrolled(pv:int, a:seq, b:seq, oldc:seq, c:seq, oldcarryin:seq, carryin:seq, oldj:int, j:int, loopsize:int, loopcarries:seq)\r\n requires 1 DigitAt(c, i) == DigitAt(oldc, i);\r\n requires FNAddRelation_inductive(pv, a, b, oldc, oldcarryin, oldj);\r\n requires forall i :: 0<=i\r\n DigitAt(a,oldj+i)+DigitAt(b,oldj+i)+DigitAt(carryin,oldj+i) == DigitAt(c,oldj+i) + DigitAt(carryin,oldj+i+1) * pv;\r\n//- ensures 0 <= |c|-j < |c|;\r\n ensures IsDigitSeq(pv, c[|c|-j..]);\r\n ensures FNAddRelation_inductive(pv, a, b, c, carryin, j);\r\n decreases loopsize;\r\n{\r\n if (loopsize==0)\r\n {\r\n//- assert oldc==c;\r\n assert oldj==j;\r\n assert FNAddRelation_inductive(pv, a, b, oldc, oldcarryin, oldj);\r\n assert forall i :: 0 <= i < oldj\r\n ==> FNAddRelation_local(pv, a, b, oldc[|oldc|-oldj..], oldcarryin, i);\r\n forall (i | 0 <= i < j)\r\n ensures FNAddRelation_local(pv, a, b, c[|c|-j..], carryin, i);\r\n {\r\n if (i < oldj)\r\n {\r\n assert j == |c[|c|-j..]| == |oldc[|oldc|-oldj..]|;\r\n forall (ci | 0 <= ci < j)\r\n ensures c[|c|-j..][ci] == oldc[|oldc|-oldj..][ci];\r\n {\r\n calc {\r\n c[|c|-j..][ci];\r\n c[|c|-j+ci];\r\n DigitAt(c, j-ci-1);\r\n DigitAt(oldc, j-ci-1);\r\n oldc[|oldc|-oldj+ci];\r\n oldc[|oldc|-oldj..][ci];\r\n }\r\n }\r\n assert c[|c|-j..] == oldc[|oldc|-oldj..];\r\n assert FNAddRelation_local(pv, a, b, oldc[|oldc|-oldj..], oldcarryin, i);\r\n assert FNAddRelation_local(pv, a, b, c[|c|-j..], carryin, i);\r\n }\r\n else\r\n {\r\n }\r\n }\r\n\r\n assert forall i :: 0 <= i < j\r\n ==> FNAddRelation_local(pv, a, b, c[|c|-j..], carryin, i);\r\n assert FNAddRelation_inductive(pv, a, b, c, carryin, j);\r\n }\r\n else\r\n {\r\n lemma_2toX32();\r\n forall (ci | 0 <= ci < |c[|c|-(j-1)..]|)\r\n ensures 0 <= c[|c|-(j-1)..][ci] < pv;\r\n {\r\n var v := c[|c|-j+1+ci];\r\n assert v == c[|c|-(j-1)..][ci]; //- OBSERVE\r\n assert v == c[|c|-j..][ci+1]; //- OBSERVE\r\n assert IsDigitSeq(pv, c[|c|-j..]);\r\n assert 0 <= v < pv;\r\n }\r\n assert IsDigitSeq(pv, c[|c|-(j-1)..]);\r\n\r\n var r_carryin := carryin[1..];\r\n lemma_selection_preserves_digit_seq(2, carryin, 1);\r\n var r_loopcarries := loopcarries[1..];\r\n calc {\r\n r_carryin;\r\n carryin[1..];\r\n (loopcarries + oldcarryin)[1..];\r\n loopcarries[1..] + oldcarryin;\r\n r_loopcarries + oldcarryin;\r\n }\r\n\r\n lemma_FNAddition_induction_unrolled(pv, a, b, oldc, c,\r\n oldcarryin, r_carryin, oldj, j-1, loopsize-1, r_loopcarries);\r\n\r\n lemma_FNAddition_induction(pv, |c|, a, b, c, c, r_carryin, carryin, j-1, j, loopcarries[0]);\r\n }\r\n}\r\n\r\nmethod {:timeLimitMultiplier 3} FatNatAddUnrolledLoop(a:array, b:array) returns (c:array)\r\n requires a!=null;\r\n requires b!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n requires IsDigitSeq(power2(32), b[..]);\r\n requires a.Length == b.Length;\r\n requires a.Length%8 == 0;\r\n ensures c!=null;\r\n ensures IsDigitSeq(power2(32), c[..]);\r\n ensures BEWordSeqToInt(a[..]) + BEWordSeqToInt(b[..]) == BEWordSeqToInt(c[..]);\r\n ensures fresh(c);\r\n{\r\n ghost var pv := power2(32);\r\n lemma_2toX32();\r\n ghost var carryin:seq := [0];\r\n\r\n var iml := a.Length;\r\n var oml := iml + 1; //- +1 => leave space for carry overflow\r\n c := new int[oml];\r\n assert oml == MaxLen3(a[..],b[..],c[..]);\r\n\r\n var lastcarry := 0;\r\n var j:=0;\r\n while (j < iml)\r\n invariant j%8 == 0;\r\n invariant 0 <= j <= iml;\r\n invariant IsBitSeq(carryin);\r\n invariant lastcarry == DigitAt(carryin, j);\r\n invariant DigitAt(carryin, 0) == 0;\r\n invariant IsDigitSeq(pv, c[c.Length-j..]);\r\n invariant |carryin| == j+1;\r\n invariant FNAddRelation_inductive(pv, a[..], b[..], c[..], carryin, j);\r\n {\r\n ghost var olda := a[..];\r\n ghost var oldb := b[..];\r\n ghost var oldc := c[..];\r\n ghost var oldcarryin := carryin[..];\r\n ghost var oldj := j;\r\n ghost var old_lastcarry := lastcarry;\r\n assert FNAddRelation_inductive(pv, olda, oldb, oldc, oldcarryin, oldj);\r\n\r\n//- ghost var c1,c2,c3,c4,c5,c6,c7,carries;\r\n//- lastcarry,c1,c2,c3,c4,c5,c6,c7,carries := Add32_unrolled_8(a, j, b, j, c, j, lastcarry);\r\n \r\n ghost var carries;\r\n lastcarry,carries := Add32_unrolled_8(a, j, b, j, c, j, lastcarry);\r\n ghost var c1,c2,c3,c4,c5,c6,c7;\r\n c1 := carries[1];\r\n assert c1 == if a[a.Length-1-(j+0)] +b[b.Length-1-(j+0)] + carries[0] >= 0x100000000 then 1 else 0;\r\n c2 := carries[2];\r\n c3 := carries[3];\r\n c4 := carries[4];\r\n c5 := carries[5];\r\n c6 := carries[6];\r\n c7 := carries[7];\r\n\r\n ghost var loopcarries := [ lastcarry, c7, c6, c5, c4, c3, c2, c1 ];\r\n//- ghost var loopcarries := [ lastcarry ] + carries;\r\n carryin := loopcarries + carryin;\r\n\r\n ghost var sc := c[..];\r\n\r\n lemma_FatNatAddUnrolledLoop_DigitSeq_preservation(oldc, sc, j);\r\n\r\n lemma_Add32_unrolled_8_glue(\r\n a[..], j, b[..], j, c[..], j, old_lastcarry,\r\n lastcarry, c1, c2, c3, c4, c5, c6, c7,\r\n//- lastcarry, carries[1], carries[2], carries[3], carries[4], carries[5], carries[6], carries[7],\r\n loopcarries, oldcarryin, carryin);\r\n \r\n j:=j+8;\r\n assert olda==a[..];\r\n assert oldb==b[..];\r\n assert |carryin| == j+1;\r\n ghost var loopsize := 8;\r\n\r\n lemma_FNAddition_induction_unrolled(pv, a[..], b[..], oldc, c[..], oldcarryin, carryin, oldj, j, loopsize, loopcarries);\r\n }\r\n\r\n assert c[..] == c[c.Length-oml..]; //- OBSERVE SEQ\r\n\r\n //- Original FatNatAdd, to propagate the carry\r\n //- into c's last slot, used ArrayDigitAt's implicit zeros for a and b.\r\n //- We avoid ArrayDigitAt entirely, which is nice, but instead we\r\n //- must stuff the lastcarry into c explicitly after the loop.\r\n c[0] := lastcarry;\r\n\r\n ghost var sa := a[..];\r\n ghost var sb := b[..];\r\n ghost var sc := c[..];\r\n assert |carryin|==j+1;\r\n ghost var fcarryin := [0] + carryin; //- that's f/inal/ carryin.\r\n\r\n forall (i | 0<=i<|sc|)\r\n ensures 0<=sc[i]0)\r\n {\r\n //- assert IsDigitSeq(pv, sc[1..]);\r\n assert sc[i] == sc[1..][i-1]; //- OBSERVE SEQ\r\n }\r\n }\r\n\r\n forall (i | 0 <= i < oml)\r\n ensures FNAddRelation_local(pv, sa, sb, sc[|sc|-oml..], fcarryin, i);\r\n {\r\n if (i, si:int, i:int)\r\n requires 0 <= si;\r\n requires si+8 <= |s|;\r\n requires 0 <= i < 8;\r\n{\r\n 0 <= s[|s|-1-(si+i)] < 0x100000000\r\n}\r\n\r\nlemma {:timeLimitMultiplier 2} lemma_Add32_unrolled_8_glue(\r\n a:seq, ai:int, b:seq, bi:int, s:seq, si:int, c_in:int,\r\n c_out:int, ghost c1:int, ghost c2:int, ghost c3:int, ghost c4:int, ghost c5:int, ghost c6:int, ghost c7:int,\r\n loopcarries:seq, oldcarries:seq, allcarries:seq)\r\n \r\n //- Add32_unrolled_8 requires\r\n requires IsWordSeq(a);\r\n requires 0 <= ai;\r\n requires ai+8 <= |a|;\r\n requires IsWordSeq(b);\r\n requires 0 <= bi;\r\n requires bi+8 <= |b|;\r\n requires 0 <= si;\r\n requires si+8 <= |s|;\r\n requires 0<=c_in<=1;\r\n\r\n //- Add32_unrolled_8 ensures\r\n requires 0<=c_out<=1;\r\n requires \r\n s[FatNatAddIndex(|s|,si,0)] == \r\n mod0x100000000(a[|a|-1-(ai+0)] +b[|b|-1-(bi+0)] + c_in);\r\n requires \r\n s[FatNatAddIndex(|s|,si,1)] == \r\n mod0x100000000(a[|a|-1-(ai+1)] +b[|b|-1-(bi+1)] + c1);\r\n requires \r\n s[FatNatAddIndex(|s|,si,2)] == \r\n mod0x100000000(a[|a|-1-(ai+2)] +b[|b|-1-(bi+2)] + c2);\r\n requires \r\n s[FatNatAddIndex(|s|,si,3)] == \r\n mod0x100000000(a[|a|-1-(ai+3)] +b[|b|-1-(bi+3)] + c3);\r\n requires \r\n s[FatNatAddIndex(|s|,si,4)] == \r\n mod0x100000000(a[|a|-1-(ai+4)] +b[|b|-1-(bi+4)] + c4);\r\n requires \r\n s[FatNatAddIndex(|s|,si,5)] == \r\n mod0x100000000(a[|a|-1-(ai+5)] +b[|b|-1-(bi+5)] + c5);\r\n requires \r\n s[FatNatAddIndex(|s|,si,6)] == \r\n mod0x100000000(a[|a|-1-(ai+6)] +b[|b|-1-(bi+6)] + c6);\r\n requires \r\n s[FatNatAddIndex(|s|,si,7)] == \r\n mod0x100000000(a[|a|-1-(ai+7)] +b[|b|-1-(bi+7)] + c7);\r\n\r\n requires c1 == if a[|a|-1-(ai+0)] +b[|b|-1-(bi+0)] + c_in >= 0x100000000 then 1 else 0;\r\n requires c2 == if a[|a|-1-(ai+1)] +b[|b|-1-(bi+1)] + c1 >= 0x100000000 then 1 else 0;\r\n requires c3 == if a[|a|-1-(ai+2)] +b[|b|-1-(bi+2)] + c2 >= 0x100000000 then 1 else 0;\r\n requires c4 == if a[|a|-1-(ai+3)] +b[|b|-1-(bi+3)] + c3 >= 0x100000000 then 1 else 0;\r\n requires c5 == if a[|a|-1-(ai+4)] +b[|b|-1-(bi+4)] + c4 >= 0x100000000 then 1 else 0;\r\n requires c6 == if a[|a|-1-(ai+5)] +b[|b|-1-(bi+5)] + c5 >= 0x100000000 then 1 else 0;\r\n requires c7 == if a[|a|-1-(ai+6)] +b[|b|-1-(bi+6)] + c6 >= 0x100000000 then 1 else 0;\r\n requires c_out == if a[|a|-1-(ai+7)] +b[|b|-1-(bi+7)] + c7 >= 0x100000000 then 1 else 0;\r\n\r\n requires IsDigitSeq(power2(32), a);\r\n requires IsDigitSeq(power2(32), b);\r\n requires loopcarries == [ c_out, c7, c6, c5, c4, c3, c2, c1 ];\r\n requires |oldcarries| == si+1;\r\n requires oldcarries[0] == c_in;\r\n requires allcarries == loopcarries + oldcarries;\r\n requires IsDigitSeq(power2(32), s[|s|-si..]);\r\n\r\n ensures IsDigitSeq(power2(32), s[|s|-(si+8)..]);\r\n ensures IsDigitSeq(2, loopcarries);\r\n ensures forall i :: 0<=i<8 ==>\r\n DigitAt(s, si+i) + DigitAt(loopcarries, i) * 0x100000000\r\n == DigitAt(a, ai+i) + DigitAt(b, bi+i) + DigitAt(allcarries, si+i);\r\n{\r\n lemma_2toX();\r\n\r\n forall (i | 0<=i<8)\r\n ensures DigitAt(s,si+i) == \r\n mod0x100000000(DigitAt(a, ai+i) + DigitAt(b, bi+i) + DigitAt(allcarries,si+i));\r\n {\r\n }\r\n\r\n forall (i | 0<=i<8)\r\n ensures HappyDigit(s, si, i);\r\n {\r\n if (i==0) {\r\n lemma_mod0x100000000(a[|a|-1-(ai+0)] +b[|b|-1-(bi+0)] + c_in);\r\n } else if (i==1) {\r\n lemma_mod0x100000000(a[|a|-1-(ai+1)] +b[|b|-1-(bi+1)] + c1);\r\n } else if (i==2) {\r\n lemma_mod0x100000000(a[|a|-1-(ai+2)] +b[|b|-1-(bi+2)] + c2);\r\n } else if (i==3) {\r\n lemma_mod0x100000000(a[|a|-1-(ai+3)] +b[|b|-1-(bi+3)] + c3);\r\n } else if (i==4) {\r\n lemma_mod0x100000000(a[|a|-1-(ai+4)] +b[|b|-1-(bi+4)] + c4);\r\n } else if (i==5) {\r\n lemma_mod0x100000000(a[|a|-1-(ai+5)] +b[|b|-1-(bi+5)] + c5);\r\n } else if (i==6) {\r\n lemma_mod0x100000000(a[|a|-1-(ai+6)] +b[|b|-1-(bi+6)] + c6);\r\n } else if (i==7) {\r\n lemma_mod0x100000000(a[|a|-1-(ai+7)] +b[|b|-1-(bi+7)] + c7);\r\n }\r\n }\r\n\r\n var stail := s[|s|-(si+8)..];\r\n forall (ri | 0<=ri<|stail|)\r\n ensures 0<=stail[ri]= 0x100000000 then 1 else 0;\r\n {\r\n var co := DigitAt(allcarries,si+i+1);\r\n var ei := if DigitAt(a,ai+i) +DigitAt(b,bi+i) + DigitAt(allcarries,si+i) >= 0x100000000 then 1 else 0;\r\n if (i==0)\r\n {\r\n assert c1 == DigitAt(allcarries, si+i+1);\r\n assert c_in == DigitAt(allcarries, si+i);\r\n assert co == ei;\r\n } else if (i==1) {\r\n assert c2 == DigitAt(allcarries, si+i+1);\r\n assert c1 == DigitAt(allcarries, si+i);\r\n assert co == ei;\r\n } else if (i==2) {\r\n assert c3 == DigitAt(allcarries, si+i+1);\r\n assert c2 == DigitAt(allcarries, si+i);\r\n assert co == ei;\r\n } else if (i==3) {\r\n assert c4 == DigitAt(allcarries, si+i+1);\r\n assert c3 == DigitAt(allcarries, si+i);\r\n assert co == ei;\r\n } else if (i==4) {\r\n assert c5 == DigitAt(allcarries, si+i+1);\r\n assert c4 == DigitAt(allcarries, si+i);\r\n assert co == ei;\r\n } else if (i==5) {\r\n assert c6 == DigitAt(allcarries, si+i+1);\r\n assert c5 == DigitAt(allcarries, si+i);\r\n assert co == ei;\r\n } else if (i==6) {\r\n assert c7 == DigitAt(allcarries, si+i+1);\r\n assert c6 == DigitAt(allcarries, si+i);\r\n assert co == ei;\r\n } else if (i==7) {\r\n assert c_out == DigitAt(allcarries, si+i+1);\r\n assert c7 == DigitAt(allcarries, si+i);\r\n assert co == ei;\r\n } else {\r\n assert false;\r\n }\r\n }\r\n\r\n forall (i | 0<=i<8)\r\n ensures\r\n DigitAt(s, si+i) + DigitAt(loopcarries, i) * 0x100000000\r\n == DigitAt(a, ai+i) + DigitAt(b, bi+i) + DigitAt(allcarries, si+i);\r\n {\r\n var va := DigitAt(a, ai+i);\r\n var vb := DigitAt(b, bi+i);\r\n var vs := DigitAt(s, si+i);\r\n var ci := DigitAt(allcarries, si+i);\r\n var cox := DigitAt(allcarries, si+i+1);\r\n lemma_mod0x100000000(va + vb + ci);\r\n var fs := (va+vb+ci);\r\n assert 0 <= fs < 0x200000000;\r\n assert vs == fs % 0x100000000;\r\n assert cox == if fs >= 0x100000000 then 1 else 0;\r\n assert cox == fs/0x100000000;\r\n lemma_fundamental_div_mod_converse(fs, 0x100000000, cox, vs);\r\n assert vs + cox*0x100000000 == fs;\r\n\r\n }\r\n}\r\n\r\n\r\nlemma lemma_FatNatAddUnrolledLoop_DigitSeq_preservation(oldc:seq, sc:seq, j:int)\r\n requires |oldc|==|sc|;\r\n requires 0<=j<|oldc|;\r\n requires IsDigitSeq(power2(32), oldc[|oldc|-j..]);\r\n requires forall i :: 0<=i<|sc| && !(j<=i sc[|sc|-1-i]==oldc[|sc|-1-i];\r\n ensures IsDigitSeq(power2(32), sc[|sc|-j..]);\r\n{\r\n var pv:=power2(32);\r\n forall (i | 0<=i s[s.Length-1-i]==old(s[s.Length-1-i]);\r\n assert 0<=ri<|sc| && !(j<=ri, b:array) returns (c:array)\r\n requires a!=null;\r\n requires b!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n requires IsDigitSeq(power2(32), b[..]);\r\n ensures c!=null;\r\n ensures IsDigitSeq(power2(32), c[..]);\r\n ensures BEWordSeqToInt(a[..]) + BEWordSeqToInt(b[..]) == BEWordSeqToInt(c[..]);\r\n ensures fresh(c);\r\n{\r\n var maxlen := if a.Length > b.Length then a.Length else b.Length;\r\n var padding := if (maxlen%8==0) then 0 else 8 - maxlen % 8;\r\n var paddedlen := maxlen + padding;\r\n assert paddedlen % 8 == 0; //- OBSERVE\r\n\r\n lemma_2toX();\r\n\r\n var apad := PadArrayLeft(paddedlen-a.Length, a);\r\n lemma_LeadingZeros(power2(32), a[..], apad[..]);\r\n\r\n var bpad := PadArrayLeft(paddedlen-b.Length, b);\r\n lemma_LeadingZeros(power2(32), b[..], bpad[..]);\r\n\r\n c := FatNatAddUnrolledLoop(apad, bpad);\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatCommon.i.dfy", "content": "include \"../Util/seqs_and_ints.i.dfy\"\r\ninclude \"../Util/seqs_common.i.dfy\"\r\ninclude \"../BigNum/BigNatX86Shim.i.dfy\"\r\ninclude \"CanonicalArrays.i.dfy\"\r\n\r\nfunction FatNatAddIndex(L:int, index:int, i:int) : int { L - 1 - (index + i) }\r\n\r\n//- Treat i as a \"little-endian index\", so LEDigitAt(0) is the least-valued,\r\n//- rightmost digit in a BE sequence.\r\nstatic function method DigitAt(a:seq, i:int) : int\r\n{\r\n if (0 <= i < |a|) then a[|a|-1-i] else 0\r\n}\r\n\r\n//- SelectDigitRange(a, 1, 0) is the bottom digit of a BEDigitSeq\r\n//- (just as a[0..1] is the bottom digit of a LEDigitSeq).\r\nfunction method SelectDigitRange(a:seq, i:int, j:int) : seq\r\n requires 0<=j<=i<=|a|;\r\n{\r\n a[|a|-i..|a|-j]\r\n}\r\n\r\nlemma lemma_SelectSingletonRange(a:seq, i:int, j:int)\r\n requires 0<=j<|a|;\r\n requires i==j+1;\r\n ensures SelectDigitRange(a,i,j)==[DigitAt(a,j)];\r\n{\r\n calc {\r\n SelectDigitRange(a, i, j);\r\n a[|a|-i..|a|-j];\r\n [a[|a|-i]];\r\n [a[|a|-1-j]];\r\n [DigitAt(a, j)];\r\n }\r\n}\r\n\r\nlemma lemma_SelectDigitNest(a:seq, h1:int, l1:int, h0:int, l0:int)\r\n requires 0<=l1<=h1<=|a|;\r\n requires 0<=l0<=h0<=(h1-l1);\r\n ensures SelectDigitRange(SelectDigitRange(a, h1, l1), h0, l0)\r\n == SelectDigitRange(a, h0+l1, l0+l1);\r\n{\r\n var inner := SelectDigitRange(a, h1, l1);\r\n assert inner == a[|a|-h1..|a|-l1];\r\n var outer := SelectDigitRange(inner, h0, l0);\r\n assert outer == inner[|inner|-h0..|inner|-l0];\r\n assert |inner| == h1-l1;\r\n var p := |a|-h1;\r\n var q := |a|-l1;\r\n var r := h1-l1-h0;\r\n var s := h1-l1-l0;\r\n assert |a[p..q][r..s]| == |a[p+r..p+s]|;\r\n forall (i | 0<=i<|a[p+r..p+s]|)\r\n ensures a[p..q][r..s][i] == a[p+r..p+s][i];\r\n {\r\n //- OBSERVE SEQ wow, Dafny really needed teeth pulled here!\r\n }\r\n assert a[p..q][r..s] == a[p+r..p+s];\r\n//- calc {\r\n//- SelectDigitRange(SelectDigitRange(a, h1, l1), h0, l0);\r\n//- SelectDigitRange(inner, h0, l0);\r\n//- a[|a|-h1..|a|-l1][h1-l1-h0..h1-l1-l0];\r\n//- a[p..q][r..s];\r\n//- a[p+r..p+s];\r\n//- a[h1-l1-h0+|a|-h1..h1-l1-l0+|a|-h1];\r\n//- a[|a|-(h0+l1)..|a|-(l0+l1)];\r\n//- SelectDigitRange(a, h0+l1, l0+l1);\r\n//- }\r\n}\r\n\r\nlemma lemma_BEInterpretation_Select(pv:int, A:seq, i:int)\r\n //- i counts from right (in LE order)\r\n requires 1, h:int, m:int, l:int)\r\n requires 0<=l<=m<=h<=|a|;\r\n ensures SelectDigitRange(a, h, l) == SelectDigitRange(a, h, m) + SelectDigitRange(a, m, l);\r\n{\r\n}\r\n\r\n//- Note that SelectDigits(a,0) == [].\r\nfunction method SelectDigits(a:seq, i:int) : seq\r\n requires 0<=i<=|a|;\r\n ensures SelectDigits(a,i) == SelectDigitRange(a,i,0);\r\n{\r\n a[|a|-i..]\r\n}\r\n\r\n\r\nfunction {:opaque} MaxLen_def(ss:seq>) : int\r\n decreases |ss|;\r\n{\r\n if (|ss|==0)\r\n then 0\r\n else\r\n var carlen := |ss[0]|;\r\n var cdrlen := MaxLen_def(ss[1..]);\r\n if (carlen > cdrlen) then carlen else cdrlen\r\n}\r\n\r\nlemma lemma_MaxLen(ss:seq>)\r\n ensures forall i :: 0<=i<|ss| ==> |ss[i]| <= MaxLen_def(ss);\r\n ensures |ss|>0 ==> exists i :: 0<=i<|ss| && |ss[i]|==MaxLen_def(ss);\r\n{\r\n reveal_MaxLen_def();\r\n if (|ss|==0) {\r\n } else {\r\n var cdr := ss[1..];\r\n lemma_MaxLen(cdr);\r\n\r\n var carlen := |ss[0]|;\r\n var cdrlen := MaxLen_def(cdr);\r\n var i;\r\n if (carlen > cdrlen) {\r\n i := 0;\r\n assert 0<=i<|ss| && |ss[i]|==MaxLen_def(ss);\r\n } else if (|cdr|==0) {\r\n i := 0;\r\n assert 0<=i<|ss| && |ss[i]|==MaxLen_def(ss);\r\n } else {\r\n assert |cdr|>0;\r\n assert exists j :: 0<=j<|cdr| && |cdr[j]|==MaxLen_def(cdr);\r\n var j :| 0<=j<|cdr| && |cdr[j]|==MaxLen_def(cdr);\r\n i := j+1;\r\n assert 0<=i<|ss| && |ss[i]|==MaxLen_def(ss);\r\n }\r\n\r\n forall (i | 0<=i<|ss|)\r\n ensures |ss[i]| <= MaxLen_def(ss);\r\n {\r\n if (i==0)\r\n {\r\n }\r\n else\r\n {\r\n assert cdr[i-1] == ss[i];\r\n }\r\n }\r\n\r\n }\r\n}\r\n\r\n\r\n\r\n\r\n\r\nfunction MaxLen(ss:seq>) : int\r\n ensures forall i :: 0<=i<|ss| ==> |ss[i]| <= MaxLen(ss);\r\n ensures |ss|>0 ==> exists i :: 0<=i<|ss| && |ss[i]|==MaxLen(ss);\r\n{\r\n lemma_MaxLen(ss);\r\n MaxLen_def(ss)\r\n}\r\n\r\nfunction MaxLen3(a:seq, b:seq, c:seq) : int\r\n ensures |a| <= MaxLen3(a,b,c);\r\n ensures |b| <= MaxLen3(a,b,c);\r\n ensures |c| <= MaxLen3(a,b,c);\r\n ensures |a|==MaxLen3(a,b,c) || |b|==MaxLen3(a,b,c) || |c|==MaxLen3(a,b,c);\r\n{\r\n \r\n \r\n var s3 := [a,b,c];\r\n assert a == s3[0];\r\n assert b == s3[1];\r\n assert c == s3[2];\r\n MaxLen(s3)\r\n}\r\n\r\nfunction Stretch(s:seq, len:int) : seq\r\n requires |s| <= len;\r\n{\r\n RepeatDigit_premium(0, len-|s|) + s\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- Array access\r\n\r\nstatic function method ArrayDigitAt(a:array, i:int) : int\r\n requires a!=null;\r\n reads a;\r\n ensures ArrayDigitAt(a,i) == DigitAt(a[..],i);\r\n{\r\n if (0 <= i < a.Length) then a[a.Length-1-i] else 0\r\n}\r\n\r\nfunction method ArrayDigitAt_add(a:array, i:int) : int\r\n requires a!=null;\r\n reads a;\r\n ensures ArrayDigitAt_add(a,i) == DigitAt(a[..],i);\r\n{\r\n if (0 <= i < a.Length) then a[a.Length-1-i] else 0\r\n}\r\n\r\nfunction method ArrayDigitAt_sub(a:array, i:int) : int\r\n requires a!=null;\r\n reads a;\r\n ensures ArrayDigitAt_sub(a,i) == DigitAt(a[..],i);\r\n{\r\n if (0 <= i < a.Length) then a[a.Length-1-i] else 0\r\n}\r\n\r\nfunction method ArrayDigitAt_cmp(a:array, i:int) : int\r\n requires a!=null;\r\n reads a;\r\n ensures ArrayDigitAt_cmp(a,i) == DigitAt(a[..],i);\r\n{\r\n if (0 <= i < a.Length) then a[a.Length-1-i] else 0\r\n}\r\n\r\nfunction method ArrayDigitAt_mul(a:array, i:int) : int\r\n requires a!=null;\r\n reads a;\r\n ensures ArrayDigitAt_mul(a,i) == DigitAt(a[..],i);\r\n{\r\n if (0 <= i < a.Length) then a[a.Length-1-i] else 0\r\n}\r\n\r\npredicate {:heap} WellformedFatNat(X:array)\r\n//- Word-specific wellformedness.\r\n reads X;\r\n{\r\n X!=null && IsWordSeq(X[..])\r\n}\r\n\r\nfunction {:heap} J(X:array) : int\r\n reads X;\r\n requires WellformedFatNat(X);\r\n ensures 0<=J(X);\r\n{\r\n lemma_BEDigitSeqToInt_bound(power2(32), X[..]);\r\n BEWordSeqToInt(X[..])\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatCompare.i.dfy", "content": "include \"../Util/seqs_common.i.dfy\"\r\ninclude \"FatNatCommon.i.dfy\"\r\ninclude \"CanonicalArrays.i.dfy\"\r\n\r\ndatatype Cmp = CmpLt | CmpEq | CmpGt;\r\n\r\npredicate DefCmp(a:int, cmp:Cmp, b:int)\r\n{\r\n (cmp==CmpLt <==> (a < b))\r\n && (cmp==CmpEq <==> (a == b))\r\n && (cmp==CmpGt <==> (a > b))\r\n}\r\n\r\nlemma lemma_FNCompare_inner_core_eq(pv:int, As:seq, Bs:seq, i:int, da:int, db:int)\r\n requires pv==power2(32);\r\n requires IsWordSeq(As);\r\n requires IsWordSeq(Bs);\r\n requires |As| == |Bs|;\r\n requires 0 < i <= |Bs|;\r\n requires DigitAt(As,i-1) == da;\r\n requires DigitAt(Bs,i-1) == db;\r\n requires BEDigitSeqToInt(pv, SelectDigitRange(As, |As|, i))\r\n == BEDigitSeqToInt(pv, SelectDigitRange(Bs, |Bs|, i));\r\n requires da==db;\r\n ensures BEDigitSeqToInt(pv, SelectDigitRange(As, |As|, i-1))\r\n == BEDigitSeqToInt(pv, SelectDigitRange(Bs, |Bs|, i-1));\r\n{\r\n ghost var Ass := SelectDigitRange(As, |As|, i);\r\n ghost var Asl := SelectDigitRange(As, |As|, i-1);\r\n ghost var Bss := SelectDigitRange(Bs, |Bs|, i);\r\n ghost var Bsl := SelectDigitRange(Bs, |Bs|, i-1);\r\n\r\n calc { \r\n Asl[|Asl|-1];\r\n DigitAt(As,i-1);\r\n DigitAt(Bs,i-1);\r\n Bsl[|Bsl|-1];\r\n }\r\n\r\n calc {\r\n BEDigitSeqToInt(pv, Asl);\r\n { reveal_BEDigitSeqToInt_private();\r\n assert Asl[0..|Asl|-1] == Asl[..|Asl|-1]; //- OBSERVE SEQ\r\n assert Asl[..|Asl|-1] == Ass; //- OBSERVE SEQ\r\n }\r\n BEDigitSeqToInt(pv, Ass)*pv + Asl[|Asl|-1];\r\n BEDigitSeqToInt(pv, Bss)*pv + Bsl[|Bsl|-1];\r\n { reveal_BEDigitSeqToInt_private();\r\n assert Bsl[0..|Bsl|-1] == Bsl[..|Bsl|-1]; //- OBSERVE SEQ\r\n assert Bsl[..|Bsl|-1] == Bss; //- OBSERVE SEQ\r\n }\r\n BEDigitSeqToInt(pv, Bsl);\r\n }\r\n}\r\n\r\nlemma lemma_FNCompare_inner_core_lt(pv:int, As:seq, Bs:seq, i:int, da:int, db:int)\r\n requires pv==power2(32);\r\n requires IsWordSeq(As);\r\n requires IsWordSeq(Bs);\r\n requires |As| == |Bs|;\r\n requires 0 < i <= |Bs|;\r\n requires DigitAt(As,i-1) == da;\r\n requires DigitAt(Bs,i-1) == db;\r\n requires BEDigitSeqToInt(pv, SelectDigitRange(As, |As|, i))\r\n == BEDigitSeqToInt(pv, SelectDigitRange(Bs, |Bs|, i));\r\n requires da, b:array) returns (cmp:Cmp)\r\n requires a!=null;\r\n requires IsWordSeq(a[..]);\r\n requires b!=null;\r\n requires IsWordSeq(b[..]);\r\n requires a.Length<=b.Length;\r\n ensures (cmp==CmpLt) <==> (BEWordSeqToInt(a[..]) < BEWordSeqToInt(b[..]));\r\n ensures (cmp==CmpEq) <==> (BEWordSeqToInt(a[..]) == BEWordSeqToInt(b[..]));\r\n ensures (cmp==CmpGt) <==> (BEWordSeqToInt(a[..]) > BEWordSeqToInt(b[..]));\r\n{\r\n lemma_2to32();\r\n ghost var pv := power2(32);\r\n ghost var Bs := b[..];\r\n ghost var As_short := a[..];\r\n ghost var As := RepeatDigit_premium(0,b.Length-a.Length) + As_short;\r\n lemma_LeadingZeros(pv, As_short, As);\r\n assert BEWordSeqToInt(As_short) == BEWordSeqToInt(As);\r\n//- assert |Bs|==b.Length;\r\n//- assert |As|==|Bs|;\r\n\r\n if (b.Length==0)\r\n {\r\n cmp := CmpEq;\r\n reveal_BEDigitSeqToInt_private();\r\n return;\r\n }\r\n assert 0<|Bs|;\r\n\r\n var i_plus_one := b.Length+1; //- DafnyCC ints can't go negative!\r\n ghost var i := |Bs|;\r\n\r\n assert As[..0] == []; //- OBSERVE SEQ\r\n assert Bs[..0] == []; //- OBSERVE SEQ\r\n //- i is the number of digits, starting from MSW, not yet known to be equal.\r\n //- If As==[x y z] and i==1, then As[0]==x==Bs[0],\r\n //- and da==As[1]==y and db==Bs[1]==y'.\r\n\r\n while (i_plus_one > 0+1)\r\n invariant 0+1 <= i_plus_one <= |Bs|+1;\r\n invariant i_plus_one == i+1;\r\n invariant 0 <= i <= |Bs|;\r\n invariant As_short == a[..];\r\n invariant Bs == b[..];\r\n invariant BEDigitSeqToInt(pv, SelectDigitRange(As, |As|, i))\r\n == BEDigitSeqToInt(pv, SelectDigitRange(Bs, |Bs|, i));\r\n {\r\n var da := ArrayDigitAt_cmp(a, i_plus_one-1-1);\r\n var db := ArrayDigitAt_cmp(b, i_plus_one-1-1);\r\n\r\n if (da < db) {\r\n cmp := CmpLt;\r\n lemma_FNCompare_inner_core_lt(pv, As, Bs, i, da, db);\r\n return;\r\n }\r\n if (db < da) {\r\n cmp := CmpGt;\r\n lemma_FNCompare_inner_core_lt(pv, Bs, As, i, db, da);\r\n return;\r\n }\r\n lemma_FNCompare_inner_core_eq(pv, Bs, As, i, db, da);\r\n i_plus_one := i_plus_one - 1;\r\n i := i - 1;\r\n }\r\n cmp := CmpEq;\r\n assert i==0;\r\n assert As==As[0..|As|]; //- OBSERVE SEQ\r\n assert Bs==Bs[0..|Bs|]; //- OBSERVE SEQ\r\n assert BEWordSeqToInt(a[..]) == BEWordSeqToInt(b[..]);\r\n}\r\n\r\nmethod FatNatCompare(a:array, b:array) returns (cmp:Cmp)\r\n requires a!=null;\r\n requires IsWordSeq(a[..]);\r\n requires b!=null;\r\n requires IsWordSeq(b[..]);\r\n ensures (cmp.CmpLt?) <==> (BEWordSeqToInt(a[..]) < BEWordSeqToInt(b[..]));\r\n ensures (cmp.CmpEq?) <==> (BEWordSeqToInt(a[..]) == BEWordSeqToInt(b[..]));\r\n ensures (cmp.CmpGt?) <==> (BEWordSeqToInt(a[..]) > BEWordSeqToInt(b[..]));\r\n{\r\n if (a.Length > b.Length)\r\n {\r\n var neg_cmp := FNCompare_inner(b, a);\r\n match neg_cmp {\r\n case CmpEq =>\r\n cmp := CmpEq;\r\n case CmpLt =>\r\n cmp := CmpGt;\r\n case CmpGt =>\r\n cmp := CmpLt;\r\n }\r\n }\r\n else\r\n {\r\n cmp := FNCompare_inner(a, b);\r\n }\r\n}\r\n\r\nmethod FatNatLt(a:array, b:array) returns (rc:bool)\r\n requires WellformedFatNat(a);\r\n requires WellformedFatNat(b);\r\n ensures rc <==> (BEWordSeqToInt(a[..]) < BEWordSeqToInt(b[..]));\r\n{\r\n var cv := FatNatCompare(a, b);\r\n rc := cv.CmpLt?;\r\n}\r\n\r\nmethod FatNatLe(a:array, b:array) returns (rc:bool)\r\n requires WellformedFatNat(a);\r\n requires WellformedFatNat(b);\r\n ensures rc <==> (BEWordSeqToInt(a[..]) <= BEWordSeqToInt(b[..]));\r\n{\r\n var cv := FatNatCompare(a, b);\r\n rc := cv.CmpEq? || cv.CmpLt?;\r\n}\r\n\r\nmethod FatNatEq(a:array, b:array) returns (rc:bool)\r\n requires WellformedFatNat(a);\r\n requires WellformedFatNat(b);\r\n ensures rc <==> (BEWordSeqToInt(a[..]) == BEWordSeqToInt(b[..]));\r\n{\r\n var cv := FatNatCompare(a, b);\r\n rc := cv.CmpEq?;\r\n}\r\n\r\nmethod FatNatGe(a:array, b:array) returns (rc:bool)\r\n requires WellformedFatNat(a);\r\n requires WellformedFatNat(b);\r\n ensures rc <==> (BEWordSeqToInt(a[..]) >= BEWordSeqToInt(b[..]));\r\n{\r\n var cv := FatNatCompare(a, b);\r\n rc := cv.CmpEq? || cv.CmpGt?;\r\n}\r\n\r\nmethod FatNatGt(a:array, b:array) returns (rc:bool)\r\n requires WellformedFatNat(a);\r\n requires WellformedFatNat(b);\r\n ensures rc <==> (BEWordSeqToInt(a[..]) > BEWordSeqToInt(b[..]));\r\n{\r\n var cv := FatNatCompare(a, b);\r\n rc := cv.CmpGt?;\r\n}\r\n\r\nmethod TestEqSmallLiteralFatNat(x:nat, X:array) returns (rc:bool)\r\n requires IsWord(x);\r\n requires WellformedFatNat(X);\r\n ensures rc <==> J(X)==x;\r\n{\r\n if (X.Length==0) {\r\n reveal_BEDigitSeqToInt_private();\r\n assert J(X)==0;\r\n rc := x==0;\r\n } else if (X.Length==1) {\r\n lemma_2toX();\r\n lemma_BEDigitSeqToInt_singleton(power2(32), X[0]);\r\n assert X[..] == [X[0]]; //- OBSERVE SEQ\r\n assert J(X)==X[0];\r\n rc := x==X[0];\r\n } else {\r\n \r\n var probe := MakeBELiteralArray(x);\r\n rc := FatNatEq(probe, X);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatDiv.i.dfy", "content": "include \"../Util/seqs_canonical.i.dfy\"\r\ninclude \"FatNatDivDefs.i.dfy\"\r\ninclude \"FatNatDivEstTrivial.i.dfy\"\r\ninclude \"FatNatDivEstDiv32.i.dfy\"\r\ninclude \"FatNatReciprocal.i.dfy\"\r\ninclude \"../FleetNat/FleetNatMul.i.dfy\"\r\ninclude \"../FleetNat/FleetNatSub.i.dfy\"\r\ninclude \"CanonicalArrays.i.dfy\"\r\n\r\nmethod FNDivision_init(n:array, dv:array) returns (d:FNDivData, ghost g:FNDivGhost)\r\n requires n!=null;\r\n requires IsWordSeq(n[..]);\r\n//- requires n.Length < power2(27);\r\n requires dv!=null;\r\n requires IsWordSeq(dv[..]);\r\n requires 1, r:array)\r\n requires FNDivision_invariant(d, g);\r\n requires BEWordSeqToInt(g.Rs) < BEWordSeqToInt(g.Ds);\r\n ensures q!=null;\r\n ensures r!=null;\r\n ensures FNDivision_invariant(d, g); //- we don't lose any structure here\r\n ensures IsWordSeq(q[..]);\r\n ensures IsWordSeq(r[..]);\r\n ensures 0 <= BEWordSeqToInt(r[..]) < BEWordSeqToInt(d.dv[..]);\r\n ensures BEWordSeqToInt(d.n[..]) ==\r\n BEWordSeqToInt(d.dv[..]) * BEWordSeqToInt(q[..]) + BEWordSeqToInt(r[..]);\r\n{\r\n q := d.q;\r\n r := d.r;\r\n\r\n lemma_BEDigitSeqToInt_bound(power2(32), r[..]);\r\n lemma_mul_is_commutative_forall();\r\n}\r\n\r\nmethod FNDivision_trivial(n:array, dv:array) returns (success:bool, q:array, r:array)\r\n requires n!=null;\r\n requires dv!=null;\r\n requires IsWordSeq(n[..]);\r\n requires IsWordSeq(dv[..]);\r\n ensures !success ==> 1!=BEWordSeqToInt(dv[..]);\r\n ensures success ==> q!=null && IsWordSeq(q[..]);\r\n ensures success ==> r!=null && IsWordSeq(r[..]);\r\n ensures success ==> 0 <= BEWordSeqToInt(r[..]) < BEWordSeqToInt(dv[..]);\r\n ensures success ==> BEWordSeqToInt(n[..]) ==\r\n BEWordSeqToInt(dv[..]) * BEWordSeqToInt(q[..]) + BEWordSeqToInt(r[..]);\r\n ensures success ==> BEWordSeqToInt(q[..]) == BEWordSeqToInt(n[..]) / BEWordSeqToInt(dv[..]);\r\n ensures success ==> BEWordSeqToInt(r[..]) == BEWordSeqToInt(n[..]) % BEWordSeqToInt(dv[..]);\r\n ensures n[..]==old(n[..]);\r\n ensures dv[..]==old(dv[..]);\r\n{\r\n \r\n lemma_2toX();\r\n var one := MakeBELiteralArray(1);\r\n ghost var ones := one[..];\r\n assert BEWordSeqToInt(ones) == 1;\r\n ghost var divs := dv[..];\r\n var one_cmp:Cmp := FatNatCompare(one, dv);\r\n if (one_cmp.CmpEq?)\r\n {\r\n success := true;\r\n q := n;\r\n r := new int[0];\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_mul_basics_forall();\r\n lemma_mul_is_commutative(BEWordSeqToInt(dv[..]), BEWordSeqToInt(q[..]));\r\n lemma_fundamental_div_mod_converse(BEWordSeqToInt_premium(n[..]), BEWordSeqToInt_premium(dv[..]), BEWordSeqToInt_premium(q[..]), BEWordSeqToInt_premium(r[..]));\r\n return;\r\n } else {\r\n q := new int[0]; //- dafnycc.\r\n \r\n r := q;\r\n success := false;\r\n }\r\n}\r\n\r\nmethod FatNatDivUsingReciprocal(n:array, dv:array, reciprocal:FNDivReciprocal) returns (q:array, r:array)\r\n requires n!=null;\r\n requires dv!=null;\r\n//- requires n.Length < power2(27);\r\n requires IsWordSeq(n[..]);\r\n requires IsWordSeq(dv[..]);\r\n requires 0 (BEWordSeqToInt(g.Rs) < BEWordSeqToInt(g.Ds));\r\n decreases BEWordSeqToInt(d.r[..]);\r\n {\r\n ghost var old_d := d;\r\n d,g := FNDivision_step(d,g,reciprocal);\r\n var r_ref := d.r; //- do something real to d.r to convince dafyncc it's allocated\r\n var q_ref := d.q; //- do something real to d.q to convince dafyncc it's allocated\r\n assert BEWordSeqToInt(d.r[..]) < BEWordSeqToInt(old_d.r[..]); //- OBSERVE\r\n r_d_cmp := FatNatCompare(d.r, d.dv);\r\n }\r\n q,r := FNDivision_conclusion(d, g);\r\n assert n[..] == g.Ns; //- OBSERVE\r\n assert dv[..] == g.Ds; //- OBSERVE\r\n lemma_mul_is_commutative(BEWordSeqToInt(dv[..]), BEWordSeqToInt(q[..]));\r\n lemma_fundamental_div_mod_converse(BEWordSeqToInt_premium(n[..]), BEWordSeqToInt_premium(dv[..]), BEWordSeqToInt_premium(q[..]), BEWordSeqToInt_premium(r[..]));\r\n}\r\n\r\n\r\nmethod FatNatDiv(n:array, dv:array) returns (q:array, r:array)\r\n requires n!=null;\r\n requires dv!=null;\r\n//- requires n.Length < power2(27);\r\n requires IsWordSeq(n[..]);\r\n requires IsWordSeq(dv[..]);\r\n requires 0)\r\n requires |s| > 0;\r\n requires s[0] == 1;\r\n requires forall i :: 1 <= i < |s| ==> s[i] == 0;\r\n requires IsWordSeq(s);\r\n ensures BEWordSeqToInt(s) == power2(32*(|s|-1));\r\n{\r\n calc {\r\n BEWordSeqToInt(s);\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEWordSeqToInt(s[0..|s|-1])*power2(32) + s[|s|-1];\r\n { assert s[0..|s|-1] == s[..|s|-1]; }\r\n BEWordSeqToInt(s[..|s|-1])*power2(32) + s[|s|-1];\r\n }\r\n\r\n if |s| == 1 {\r\n calc {\r\n BEWordSeqToInt(s[..|s|-1])*power2(32) + s[|s|-1];\r\n { assert s[..|s|-1] == []; }\r\n BEWordSeqToInt([])*power2(32) + s[|s|-1];\r\n { reveal_BEDigitSeqToInt_private(); }\r\n { lemma_mul_is_mul_boogie(0, power2(32)); }\r\n 0*power2(32) + s[|s|-1];\r\n s[|s|-1];\r\n s[0];\r\n 1;\r\n { reveal_power2(); }\r\n power2(0);\r\n power2(32*(|s|-1));\r\n }\r\n }\r\n else {\r\n calc {\r\n BEWordSeqToInt(s[..|s|-1])*power2(32) + s[|s|-1];\r\n BEWordSeqToInt(s[..|s|-1])*power2(32);\r\n { Lemma_OneFollowedByxZeroesIsPower2To32x(s[..|s|-1]); }\r\n power2(32*(|s|-2)) * power2(32);\r\n { lemma_power2_adds(32*(|s|-2), 32); }\r\n power2(32*(|s|-2) + 32);\r\n power2(32*(|s|-1));\r\n }\r\n }\r\n}\r\n\r\nmethod FatNatPower2To32x(x:nat) returns (q:array)\r\n ensures fresh(q);\r\n ensures q != null;\r\n ensures IsWordSeq(q[..]);\r\n ensures BEWordSeqToInt(q[..]) == power2(32 * x);\r\n{\r\n q := new int[x+1];\r\n q[0] := 1;\r\n lemma_2toX();\r\n\r\n var i := 1;\r\n while i < q.Length\r\n invariant 1 <= i <= q.Length;\r\n invariant q[0] == 1;\r\n invariant forall j :: 1 <= j < i ==> q[j] == 0;\r\n invariant IsWordSeq(q[..i]);\r\n {\r\n q[i] := 0;\r\n i := i + 1;\r\n }\r\n\r\n assert q[..] == q[..q.Length];\r\n Lemma_OneFollowedByxZeroesIsPower2To32x(q[..]);\r\n}\r\n\r\nmethod FatNatComputeReciprocal(dv:array) returns (reciprocal:FNDivReciprocal)\r\n requires dv != null;\r\n requires IsWordSeq(dv[..]);\r\n requires BEWordSeqToInt(dv[..]) > 0;\r\n ensures reciprocal.FNDivKnownReciprocal?;\r\n ensures FNDivReciprocalValid(reciprocal, dv);\r\n{\r\n var w := dv.Length * 2;\r\n var two_to_32w := FatNatPower2To32x(w);\r\n var q,r := FatNatDiv(two_to_32w, dv);\r\n reciprocal := FNDivKnownReciprocal(w, q);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatDivDefs.i.dfy", "content": "include \"FatNatCommon.i.dfy\"\r\ninclude \"FatNatMul.i.dfy\"\r\ninclude \"FatNatSub.i.dfy\"\r\ninclude \"FatNatCompare.i.dfy\"\r\ninclude \"../Util/seqs_canonical.i.dfy\"\r\n\r\ndatatype FNDivData = FNDivData_c(\r\n n:array, dv:array, r:array, q:array);\r\n\r\ndatatype FNDivGhost = FNDivGhost_c(\r\n Ns:seq,\r\n Ds:seq,\r\n Rs:seq,\r\n Qs:seq,\r\n wks:seq,\r\n remainders:seq);\r\n\r\npredicate {:heap} FNDivision_invariant(d:FNDivData, g:FNDivGhost)\r\n reads d.n;\r\n reads d.dv;\r\n reads d.r;\r\n reads d.q;\r\n{\r\n d.n != null\r\n && d.dv != null\r\n && d.r != null\r\n && d.n[..] == g.Ns\r\n && d.dv[..] == g.Ds\r\n && d.r[..] == g.Rs\r\n && d.q != null\r\n && d.q[..] == g.Qs\r\n && IsWordSeq(g.Ns)\r\n && IsWordSeq(g.Ds)\r\n\r\n && IsWordSeq(g.Rs)\r\n//- && IsCanonicalDigitSeq(power2(32), g.Rs)\r\n//- && |g.Ns| < power2(27)\r\n\r\n && BEWordSeqToInt(g.Rs) <= BEWordSeqToInt(g.Ns)\r\n && IsWordSeq(g.Qs)\r\n && 1 < BEWordSeqToInt(g.Ds)\r\n && FNMulProblemValid_partial(g.wks, BEWordSeqToInt(g.Ds), 0)\r\n && |g.wks| == |g.remainders|\r\n && g.remainders[|g.remainders|-1] == BEWordSeqToInt(g.Rs)\r\n && g.wks[|g.wks|-1].a_partial_sum == BEWordSeqToInt(g.Qs)\r\n && (forall i :: 0<=i<|g.wks| ==>\r\n g.wks[i].product + g.remainders[i] == BEWordSeqToInt(g.Ns))\r\n//- && (forall i :: 1<=i<|g.wks| ==>\r\n//- g.wks[i].product + g.remainders[i] == g.wks[i-1].product + g.remainders[i-1])\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatDivEstDiv32.i.dfy", "content": "include \"FatNatDivDefs.i.dfy\"\r\ninclude \"FatNatDivEstTrivial.i.dfy\"\r\ninclude \"Bitwise.i.dfy\"\r\ninclude \"WordBoundHack.i.dfy\"\r\n\r\nmethod FNDivision_Estimate_Q_div32(n:array, dv:array) returns (q:array)\r\n requires n!=null;\r\n requires IsWordSeq(n[..]);\r\n requires dv!=null;\r\n requires IsWordSeq(dv[..]);\r\n requires 1 < BEWordSeqToInt(dv[..]) <= BEWordSeqToInt(n[..]);\r\n ensures q!=null;\r\n ensures IsWordSeq(q[..]);\r\n ensures 0 < BEWordSeqToInt(q[..])*BEWordSeqToInt(dv[..]);\r\n ensures BEWordSeqToInt(q[..])*BEWordSeqToInt(dv[..]) <= BEWordSeqToInt(n[..]);\r\n{\r\n lemma_2toX32();\r\n ghost var Ns := n[..];\r\n ghost var Nv := BEWordSeqToInt(Ns);\r\n ghost var Divs := dv[..];\r\n ghost var Divv := BEWordSeqToInt(Divs);\r\n\r\n var n_approx,n_approx_exp := TakeTopBits(n, 32);\r\n assert n_approx == Nv / power2(n_approx_exp);\r\n assert 0 < BEWordSeqToInt(dv[..]);\r\n var div_approx,div_approx_exp := TakeTopBits(dv, 16);\r\n assert div_approx == Divv / power2(div_approx_exp);\r\n //- this step is redundant, since dv never changes.\r\n \r\n \r\n var div_approx_conservative := div_approx + 1;\r\n\r\n var q_approx,r_discard :=\r\n Divide32(n_approx,div_approx_conservative);\r\n lemma_fundamental_div_mod_converse(n_approx,div_approx_conservative,q_approx,r_discard);\r\n assert q_approx == n_approx/div_approx_conservative;\r\n \r\n lemma_power_0(power2(32));\r\n lemma_mul_basics_forall();\r\n if (q_approx == 0)\r\n {\r\n //- this should only occur when n and d are very close\r\n //- (and hence n_approx_exp==d_approx_expr==0);\r\n //- otherwise, TakeBits(n) should be able to find more\r\n //- bits of n.\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n q := FNDivision_Estimate_Q_trivial(n,dv);\r\n return;\r\n }\r\n\r\n calc {\r\n Divv;\r\n { lemma_fundamental_div_mod(Divv, power2(div_approx_exp)); }\r\n power2(div_approx_exp)*(Divv/power2(div_approx_exp))+Divv%power2(div_approx_exp);\r\n <= { lemma_mod_properties(); }\r\n power2(div_approx_exp)*(Divv/power2(div_approx_exp))+power2(div_approx_exp);\r\n { lemma_mul_is_distributive_add(power2(div_approx_exp), Divv/power2(div_approx_exp), 1); }\r\n power2(div_approx_exp)*(Divv/power2(div_approx_exp)+1);\r\n power2(div_approx_exp)*(div_approx+1);\r\n power2(div_approx_exp)*(div_approx_conservative);\r\n }\r\n calc {\r\n n_approx*power2(n_approx_exp);\r\n { lemma_mul_is_commutative(n_approx, power2(n_approx_exp)); }\r\n power2(n_approx_exp)*n_approx;\r\n power2(n_approx_exp)*(Nv/power2(n_approx_exp));\r\n <= { lemma_mod_properties(); }\r\n power2(n_approx_exp)*(Nv/power2(n_approx_exp))+Nv%power2(n_approx_exp);\r\n { lemma_fundamental_div_mod(Nv, power2(n_approx_exp)); }\r\n Nv;\r\n }\r\n\r\n if (n_approx_exp >= div_approx_exp) {\r\n //- common case: n much bigger than d\r\n var q_approx_exp := n_approx_exp - div_approx_exp;\r\n\r\n var q_approx_ary := new int[1];\r\n q_approx_ary[0] := q_approx;\r\n ghost var Qas := q_approx_ary[..];\r\n ghost var Qav := BEWordSeqToInt(Qas);\r\n reveal_BEDigitSeqToInt_private();\r\n calc {\r\n Qav;\r\n BEWordSeqToInt(Qas[0..|Qas|-1])*power(power2(32),0)+Qas[|Qas|-1];\r\n BEWordSeqToInt([])*power(power2(32),0)+Qas[|Qas|-1];\r\n mul(0,power(power2(32),0))+Qas[|Qas|-1];\r\n Qas[|Qas|-1];\r\n q_approx;\r\n }\r\n\r\n constrain_word_from_overflowing(q_approx_exp);\r\n//- if (power2(32)<=q_approx_exp)\r\n//- {\r\n//- calc {\r\n//- power2(power2(32));\r\n//- <= { lemma_power2_increases(power2(32), n_approx_exp); }\r\n//- power2(n_approx_exp);\r\n//- <= { lemma_mul_increases(n_approx, power2(n_approx_exp)); }\r\n//- n_approx*power2(n_approx_exp);\r\n//- <=\r\n//- BEDigitSeqToInt(power2(32), Ns);\r\n//- < { lemma_BEDigitSeqToInt_bound(power2(32), Ns); }\r\n//- power(power2(32),|Ns|);\r\n//- { lemma_power2_unfolding(32, |Ns|);\r\n//- lemma_mul_is_mul_boogie(32, |Ns|); }\r\n//- power2(32*|Ns|);\r\n//- <= { lemma_power2_increases(32*|Ns|, 32*power2(27)); }\r\n//- power2(32*power2(27));\r\n//- { lemma_2toX32(); lemma_mul_is_mul_boogie(32, power2(27)); }\r\n//- power2(power2(5)*power2(27));\r\n//- { lemma_power2_adds(5, 27); }\r\n//- power2(power2(32));\r\n//- }\r\n//- assert false;\r\n//- }\r\n\r\n assert IsWord(q_approx_exp);\r\n q := BitShiftLeft_Array(q_approx_ary, q_approx_exp);\r\n ghost var Qs := q[..];\r\n ghost var Qv := BEWordSeqToInt(Qs);\r\n assert Qv == Qav * power2(q_approx_exp);\r\n\r\n assert 0 < q_approx;\r\n lemma_BEDigitSeqToInt_bound(power2(32), Qas);\r\n lemma_power2_positive();\r\n lemma_mul_strictly_positive(BEWordSeqToInt(Qas), power2(q_approx_exp));\r\n\r\n assert 0 < Qv;\r\n assert 0 < Divv;\r\n lemma_mul_strictly_positive(Qv,Divv);\r\n assert 0 < Qv*Divv;\r\n\r\n assert 0 < div_approx_conservative;\r\n assert 0 < power2(div_approx_exp);\r\n lemma_mul_strictly_positive(div_approx_conservative, power2(div_approx_exp));\r\n calc {\r\n Qv;\r\n Qav * power2(q_approx_exp);\r\n q_approx * power2(q_approx_exp);\r\n (n_approx/div_approx_conservative)*power2(q_approx_exp);\r\n <= { lemma_mul_is_commutative(power2(q_approx_exp), n_approx/div_approx_conservative);\r\n lemma_mul_hoist_inequality(power2(q_approx_exp), n_approx, div_approx_conservative);\r\n lemma_mul_is_commutative(n_approx, power2(q_approx_exp)); }\r\n (n_approx*power2(q_approx_exp))/div_approx_conservative;\r\n { lemma_mul_nonnegative(n_approx, power2(q_approx_exp));\r\n lemma_div_multiples_vanish_quotient(power2(div_approx_exp), n_approx*power2(q_approx_exp), div_approx_conservative); }\r\n (power2(div_approx_exp)*(n_approx*power2(q_approx_exp)))\r\n /(power2(div_approx_exp)*div_approx_conservative); // Commute\r\n (n_approx*power2(q_approx_exp)*power2(div_approx_exp))\r\n /(power2(div_approx_exp)*div_approx_conservative); // Commute \r\n (n_approx*power2(q_approx_exp)*power2(div_approx_exp))\r\n /(div_approx_conservative*power2(div_approx_exp));\r\n { lemma_mul_is_associative(n_approx, power2(q_approx_exp), power2(div_approx_exp));\r\n lemma_power2_adds(q_approx_exp,div_approx_exp); }\r\n (n_approx*power2(n_approx_exp))\r\n /(div_approx_conservative*power2(div_approx_exp));\r\n <= { lemma_div_is_ordered(n_approx*power2(n_approx_exp), Nv, div_approx_conservative*power2(div_approx_exp)); }\r\n Nv / (div_approx_conservative*power2(div_approx_exp));\r\n <= {\r\n lemma_mul_is_commutative(div_approx_conservative, power2(div_approx_exp));\r\n lemma_div_is_ordered_by_denominator(Nv, Divv, div_approx_conservative*power2(div_approx_exp)); }\r\n Nv / Divv;\r\n }\r\n calc {\r\n BEWordSeqToInt(Qs)*BEWordSeqToInt(Divs);\r\n Qv * Divv;\r\n <= { lemma_mul_inequality(Qv, Nv / Divv, Divv);\r\n lemma_mul_is_commutative(Nv / Divv, Divv); }\r\n Divv * (Nv / Divv);\r\n <= { lemma_mul_hoist_inequality(Divv, Nv, Divv); }\r\n (Divv * Nv) / Divv;\r\n { lemma_mul_is_commutative(Divv, Nv);\r\n lemma_div_multiples_vanish(Nv, Divv); }\r\n Nv;\r\n BEWordSeqToInt(Ns);\r\n }\r\n return;\r\n }\r\n\r\n //- n very nearly d; negative exponent implies some bits\r\n //- of result are actually describing the remainder, not the quotient.\r\n lemma_word32(q_approx);\r\n var neg_exp := div_approx_exp - n_approx_exp;\r\n assert 0 <= neg_exp;\r\n\r\n \r\n \r\n if (neg_exp >= 32) //- contradiction\r\n {\r\n calc {\r\n Nv;\r\n { lemma_fundamental_div_mod(Nv, power2(n_approx_exp)); }\r\n power2(n_approx_exp) * (Nv / power2(n_approx_exp))\r\n + Nv % power2(n_approx_exp);\r\n <= { lemma_mod_properties(); }\r\n power2(n_approx_exp) * (Nv / power2(n_approx_exp))\r\n + power2(n_approx_exp);\r\n power2(n_approx_exp) * n_approx\r\n + mul(power2(n_approx_exp),1);\r\n { lemma_mul_is_distributive(power2(n_approx_exp), n_approx, 1); }\r\n power2(n_approx_exp) * (n_approx + 1);\r\n <= { lemma_mul_inequality(n_approx + 1, power2(32), power2(n_approx_exp));\r\n lemma_mul_is_commutative(power2(n_approx_exp), n_approx + 1);\r\n lemma_mul_is_commutative(power2(n_approx_exp), power2(32)); }\r\n power2(n_approx_exp) * power2(32);\r\n { lemma_power2_adds(n_approx_exp, 32); }\r\n power2(n_approx_exp + 32);\r\n <= { lemma_power2_increases(n_approx_exp+32, div_approx_exp); }\r\n power2(div_approx_exp);\r\n < { lemma_mul_strictly_increases(\r\n (Divv / power2(div_approx_exp)),\r\n power2(div_approx_exp));\r\n assert 1 < (Divv / power2(div_approx_exp));\r\n assert 0 < power2(div_approx_exp);\r\n }\r\n (Divv / power2(div_approx_exp)) * power2(div_approx_exp);\r\n { lemma_mul_is_commutative(power2(div_approx_exp), Divv / power2(div_approx_exp)); }\r\n power2(div_approx_exp) * (Divv / power2(div_approx_exp));\r\n <= { lemma_mul_hoist_inequality(power2(div_approx_exp), Divv, power2(div_approx_exp)); }\r\n (power2(div_approx_exp) * Divv) / power2(div_approx_exp);\r\n { lemma_div_multiples_vanish(Divv, power2(div_approx_exp)); }\r\n Divv;\r\n }\r\n assert false;\r\n }\r\n\r\n assert 0 < div_approx_exp;\r\n\r\n var q_approx_scaled := BitShiftRight_Word(q_approx, neg_exp);\r\n assert q_approx_scaled == q_approx / power2(neg_exp);\r\n\r\n if (q_approx_scaled == 0)\r\n {\r\n \r\n q := FNDivision_Estimate_Q_trivial(n,dv);\r\n return;\r\n }\r\n\r\n lemma_word32(q_approx_scaled);\r\n q := new int[1];\r\n q[0] := q_approx_scaled;\r\n ghost var Qs := q[..];\r\n ghost var Qv := BEWordSeqToInt(Qs);\r\n\r\n assert Qs == [q_approx_scaled]; //- OBSERVE\r\n lemma_BEDigitSeqToInt_singleton(power2(32), q_approx_scaled);\r\n assert Qv == q_approx_scaled;\r\n\r\n lemma_mul_strictly_positive(Qv, Divv);\r\n assert 0 < BEWordSeqToInt(Qs)*BEWordSeqToInt(Divs);\r\n\r\n calc {\r\n Qv * Divv;\r\n <= { lemma_mul_is_commutative(Qv, Divv);\r\n lemma_mul_is_associative(Qv, power2(div_approx_exp), div_approx_conservative);\r\n lemma_mul_is_commutative(Qv, power2(div_approx_exp) * div_approx_conservative);\r\n lemma_mul_inequality(Divv, power2(div_approx_exp)*div_approx_conservative, Qv); }\r\n Qv * power2(div_approx_exp) * div_approx_conservative;\r\n { lemma_power2_adds(n_approx_exp, neg_exp);\r\n lemma_mul_is_associative(Qv, power2(n_approx_exp), power2(neg_exp)); }\r\n Qv * power2(n_approx_exp) * power2(neg_exp) * div_approx_conservative;\r\n (q_approx / power2(neg_exp)) * power2(n_approx_exp) * power2(neg_exp) * div_approx_conservative;\r\n { lemma_mul_is_associative(q_approx / power2(neg_exp), power2(n_approx_exp), power2(neg_exp)); }\r\n (q_approx / power2(neg_exp)) * (power2(n_approx_exp) * power2(neg_exp)) * div_approx_conservative;\r\n { lemma_mul_is_commutative(power2(n_approx_exp), power2(neg_exp)); }\r\n (q_approx / power2(neg_exp)) * (power2(neg_exp) * power2(n_approx_exp)) * div_approx_conservative;\r\n { lemma_mul_is_associative(q_approx / power2(neg_exp), power2(neg_exp), power2(n_approx_exp)); }\r\n (q_approx / power2(neg_exp)) * power2(neg_exp) * power2(n_approx_exp) * div_approx_conservative;\r\n { lemma_mul_is_commutative(q_approx / power2(neg_exp), power2(neg_exp)); }\r\n power2(neg_exp) * (q_approx / power2(neg_exp)) * power2(n_approx_exp) * div_approx_conservative;\r\n { lemma_mul_is_associative(power2(neg_exp) * (q_approx / power2(neg_exp)), power2(n_approx_exp), div_approx_conservative); }\r\n power2(neg_exp) * (q_approx / power2(neg_exp)) * (power2(n_approx_exp) * div_approx_conservative);\r\n <= { lemma_fundamental_div_mod(q_approx, power2(neg_exp));\r\n lemma_mod_properties();\r\n lemma_mul_nonnegative(power2(n_approx_exp), div_approx_conservative);\r\n lemma_mul_inequality(\r\n power2(neg_exp) * (q_approx / power2(neg_exp)),\r\n q_approx,\r\n (power2(n_approx_exp) * div_approx_conservative)); }\r\n q_approx * (power2(n_approx_exp) * div_approx_conservative);\r\n { lemma_mul_is_commutative(power2(n_approx_exp), div_approx_conservative);\r\n lemma_mul_is_associative(q_approx, div_approx_conservative, power2(n_approx_exp)); }\r\n q_approx * div_approx_conservative * power2(n_approx_exp);\r\n <= {\r\n calc {\r\n q_approx * div_approx_conservative;\r\n { lemma_mul_is_commutative(q_approx, div_approx_conservative); }\r\n div_approx_conservative * (n_approx / div_approx_conservative);\r\n <= { lemma_mul_hoist_inequality(div_approx_conservative, n_approx, div_approx_conservative); }\r\n (div_approx_conservative * n_approx) / div_approx_conservative;\r\n { lemma_div_multiples_vanish(n_approx, div_approx_conservative); }\r\n n_approx;\r\n }\r\n lemma_mul_inequality_forall();\r\n }\r\n n_approx * power2(n_approx_exp);\r\n <=\r\n Nv;\r\n }\r\n assert BEWordSeqToInt(Qs)*BEWordSeqToInt(Divs) <= BEWordSeqToInt(n[..]);\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatDivEstTrivial.i.dfy", "content": "include \"FatNatDivDefs.i.dfy\"\r\n\r\n//- The simplest possible estimator: it subtracts q=1 copy of dv at a time.\r\n//- Runtime is linear in the value of the final quotient.\r\n\r\nmethod FNDivision_Estimate_Q_trivial(n:array, dv:array) returns (q:array)\r\n requires n!=null;\r\n requires IsWordSeq(n[..]);\r\n requires dv!=null;\r\n requires IsWordSeq(dv[..]);\r\n requires 0 < BEWordSeqToInt(dv[..]) <= BEWordSeqToInt(n[..]);\r\n ensures q!=null;\r\n ensures IsWordSeq(q[..]);\r\n ensures 0 < BEWordSeqToInt(q[..])*BEWordSeqToInt(dv[..]);\r\n ensures BEWordSeqToInt(q[..])*BEWordSeqToInt(dv[..]) <= BEWordSeqToInt(n[..]);\r\n{\r\n ghost var Divs := dv[..];\r\n q := new int[1];\r\n q[0] := 1;\r\n ghost var Qs := q[..];\r\n lemma_2toX();\r\n ghost var Qv := BEWordSeqToInt(Qs);\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_mul_basics_forall();\r\n assert Qs[0..|Qs|-1] == []; //- OBSERVE\r\n assert Qv == BEWordSeqToInt(Qs[0..|Qs|-1])*power2(32) + Qs[|Qs|-1]; //- OBSERVE\r\n assert Qv == 1;\r\n calc {\r\n BEWordSeqToInt(q[..])*BEWordSeqToInt(dv[..]);\r\n BEWordSeqToInt(Qs)*BEWordSeqToInt(Divs);\r\n Qv*BEWordSeqToInt(Divs);\r\n BEWordSeqToInt(Divs);\r\n BEWordSeqToInt(dv[..]);\r\n }\r\n lemma_BEDigitSeqToInt_bound(power2(32), Qs);\r\n lemma_BEDigitSeqToInt_bound(power2(32), Divs);\r\n assert 0 < BEWordSeqToInt(q[..]);\r\n assert 0 < BEWordSeqToInt(dv[..]);\r\n lemma_mul_strictly_positive(BEWordSeqToInt(q[..]), BEWordSeqToInt(dv[..]));\r\n}\r\n\r\n\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatMod.i.dfy", "content": "include \"../Util/seqs_canonical.i.dfy\"\r\ninclude \"FatNatDiv.i.dfy\"\r\ninclude \"../FleetNat/FleetNatMUl.i.dfy\"\r\ninclude \"CanonicalArrays.i.dfy\"\r\ninclude \"WordBoundHack.i.dfy\"\r\n\r\n\r\n\r\n\r\n\r\n\r\nmethod FatNatModuloUsingReciprocal(X:array, N:array, Nreciprocal:FNDivReciprocal) returns (R:array)\r\n requires X!=null && IsWordSeq(X[..]);\r\n requires N!=null && IsWordSeq(N[..]);\r\n//- requires X.Length < power2(27);\r\n requires 0 <= BEWordSeqToInt(X[..]);\r\n requires 0 < BEWordSeqToInt(N[..]);\r\n requires FNDivReciprocalValid(Nreciprocal, N);\r\n ensures R!=null && IsWordSeq(R[..]);\r\n ensures BEWordSeqToInt(X[..]) % BEWordSeqToInt(N[..]) == BEWordSeqToInt(R[..]);\r\n ensures BEWordSeqToInt(R[..]) < BEWordSeqToInt(N[..]);\r\n{\r\n ProfileTally(Tally_FatNatMod(), 1);\r\n\r\n var Q:array;\r\n Q,R := FatNatDivUsingReciprocal(X,N,Nreciprocal);\r\n\r\n lemma_mul_is_commutative_forall();\r\n lemma_fundamental_div_mod_converse(\r\n BEWordSeqToInt(X[..]), BEWordSeqToInt(N[..]), BEWordSeqToInt(Q[..]), BEWordSeqToInt(R[..]));\r\n}\r\n\r\nmethod FatNatModulo(X:array, N:array) returns (R:array)\r\n requires X!=null && IsWordSeq(X[..]);\r\n requires N!=null && IsWordSeq(N[..]);\r\n//- requires X.Length < power2(27);\r\n requires 0 <= BEWordSeqToInt(X[..]);\r\n requires 0 < BEWordSeqToInt(N[..]);\r\n ensures R!=null && IsWordSeq(R[..]);\r\n ensures BEWordSeqToInt(X[..]) % BEWordSeqToInt(N[..]) == BEWordSeqToInt(R[..]);\r\n ensures BEWordSeqToInt(R[..]) < BEWordSeqToInt(N[..]);\r\n{\r\n R := FatNatModuloUsingReciprocal(X, N, FNDivUnknownReciprocal());\r\n}\r\n\r\nlemma lemma_lengths_squared(pv:int, X:seq, Y:seq, e:nat, Z:seq)\r\n requires pv==power2(32);\r\n requires IsDigitSeq(pv, X);\r\n requires IsDigitSeq(pv, Y);\r\n//- requires 00)\r\n {\r\n lemma_mul_basics_forall();\r\n calc {\r\n 0;\r\n < { lemma_power_positive(pv,|Z|-1);\r\n lemma_mul_strictly_positive(Z[0], power(pv,|Z|-1)); }\r\n Z[0]*power(pv,|Z|-1);\r\n <= { lemma_BEDigitSeqToInt_bound(pv, Z); }\r\n Zv;\r\n }\r\n assert false;\r\n }\r\n lemma_power2_positive();\r\n }\r\n else\r\n {\r\n calc {\r\n Zv;\r\n Xv*Yv;\r\n <= {\r\n lemma_BEDigitSeqToInt_bound(pv, X);\r\n lemma_BEDigitSeqToInt_bound(pv, Y);\r\n lemma_mul_inequality(Xv, power(pv,|X|)-1, Yv);\r\n lemma_mul_inequality(Yv, power(pv,|Y|)-1, power(pv,|X|)-1);\r\n lemma_mul_is_commutative_forall();\r\n }\r\n (power(pv, |X|)-1) * (power(pv,|Y|)-1);\r\n { lemma_mul_is_distributive_forall(); }\r\n power(pv, |X|)*(power(pv, |Y|)-1) - mul(1,(power(pv, |Y|)-1));\r\n { lemma_mul_basics_forall(); }\r\n power(pv, |X|)*(power(pv, |Y|)-1) - (power(pv, |Y|)-1);\r\n < {\r\n reveal_BEDigitSeqToInt_private();\r\n calc {\r\n 1;\r\n <\r\n pv;\r\n { lemma_power_1(pv); }\r\n power(pv,1);\r\n <= { lemma_power_increases(pv,1,|Y|); }\r\n power(pv,|Y|);\r\n }\r\n }\r\n power(pv, |X|)*(power(pv, |Y|)-1);\r\n { lemma_mul_is_distributive_forall(); }\r\n power(pv, |X|)*power(pv, |Y|)-mul(power(pv, |X|),1);\r\n { lemma_mul_basics_forall(); }\r\n power(pv, |X|)*power(pv, |Y|)-power(pv, |X|);\r\n <= { lemma_power_positive(pv, |X|); }\r\n power(pv, |X|)*power(pv, |Y|)-1;\r\n { lemma_power_adds(pv, |X|, |Y|); }\r\n power(pv, |X|+|Y|)-1;\r\n { lemma_power2_unfolding(32, |X|+|Y|);\r\n lemma_mul_is_mul_boogie(32, |X|+|Y|); }\r\n power2(32*(|X|+|Y|))-1;\r\n <= {\r\n calc {\r\n |X|+|Y|;\r\n <\r\n power2(e)+power2(e);\r\n { lemma_mul_is_mul_boogie(2,power2(e)); }\r\n mul(2,power2(e));\r\n { lemma_power2_1_is_2(); }\r\n mul(power2(1),power2(e));\r\n { lemma_power2_adds(1,e); }\r\n power2(e+1);\r\n }\r\n lemma_power2_increases(32*(|X|+|Y|), 32*power2(e+1)); }\r\n power2(32*power2(e+1));\r\n { lemma_power2_unfolding(32, power2(e+1));\r\n lemma_mul_is_mul_boogie(32, power2(e+1)); }\r\n power(pv, power2(e+1));\r\n <= { lemma_power2_strictly_increases(e+1,e+2);\r\n lemma_power_increases(pv, power2(e+1), power2(e+2)-1); }\r\n power(pv, power2(e+2)-1);\r\n }\r\n lemma_CanonicalLengthBound(pv, Z, power2(e+2)-1);\r\n assert |Z| < power2(e+2);\r\n }\r\n}\r\n\r\ndatatype FatNatModExp_data = FatNatModExp_data_c(\r\n bp2:int,\r\n B:array,\r\n E:array,\r\n N:array,\r\n R:array,\r\n ec:int,\r\n E1:array,\r\n one:array);\r\n\r\ndatatype FatNatModExp_ghost = FatNatModExp_ghost_c(\r\n Bv:int,\r\n Ev:int,\r\n Nv:int,\r\n Rv:int,\r\n E1v:int,\r\n Onev:int);\r\n\r\npredicate FatNatRepresents(a:array, av:int)\r\n reads a;\r\n{\r\n a!=null\r\n && IsWordSeq(a[..])\r\n && BEWordSeqToInt(a[..]) == av\r\n && 0<=BEWordSeqToInt(a[..]) \r\n}\r\n\r\npredicate {:heap} FatNatModExp_invariant(d:FatNatModExp_data, g:FatNatModExp_ghost)\r\n reads d.B;\r\n reads d.E;\r\n reads d.N;\r\n reads d.R;\r\n reads d.E1;\r\n reads d.one;\r\n{\r\n true\r\n && FatNatRepresents(d.B, g.Bv)\r\n//- && (d.B.Length < power2(25))\r\n && g.Bv != 0\r\n\r\n && FatNatRepresents(d.E, g.Ev)\r\n && (0 <= d.bp2 <= d.ec < power2(32))\r\n && FatNatBitCount(d.E[..], d.ec)\r\n\r\n && FatNatRepresents(d.N, g.Nv)\r\n//- && (d.N.Length < power2(25))\r\n && FatNatRepresents(d.R, g.Rv)\r\n\r\n//- && (IsCanonicalDigitSeq(power2(32), d.R[..]))\r\n && d.R != null\r\n && (IsWordSeq(d.R[..]))\r\n\r\n//- && (d.R.Length < power2(25))\r\n && (g.Rv < g.Nv)\r\n\r\n && FatNatRepresents(d.E1, g.E1v)\r\n && (g.E1v < power2(d.bp2))\r\n\r\n && FatNatRepresents(d.one, g.Onev)\r\n && g.Onev == 1\r\n\r\n && ((power(g.Bv,g.E1v) * power(g.Rv,power2(d.bp2))) % g.Nv\r\n == power(g.Bv,g.Ev) % g.Nv)\r\n}\r\n\r\nmethod FatNatModExp_init(\r\n B:array,\r\n E:array,\r\n N:array)\r\n returns (d:FatNatModExp_data, ghost g:FatNatModExp_ghost)\r\n requires B!=null && IsWordSeq(B[..]);\r\n requires E!=null && IsWordSeq(E[..]);\r\n requires N!=null && IsWordSeq(N[..]);\r\n requires BEWordSeqToInt(B[..])!=0;\r\n requires 1 < BEWordSeqToInt(N[..]);\r\n//- requires BEWordSeqToInt(E[..]) < power2(power2(31));\r\n//- requires B.Length < power2(25);\r\n//- requires N.Length < power2(25);\r\n ensures FatNatModExp_invariant(d, g);\r\n ensures d.B == B;\r\n ensures d.E == E;\r\n ensures d.N == N;\r\n{\r\n ghost var pv := power2(32);\r\n lemma_2toX32();\r\n lemma_mul_basics_forall();\r\n\r\n ghost var Bs := B[..];\r\n ghost var Bv := BEWordSeqToInt(Bs);\r\n ghost var Es := E[..];\r\n ghost var Ev := BEWordSeqToInt(Es);\r\n ghost var Ns := N[..];\r\n ghost var Nv := BEWordSeqToInt(Ns);\r\n\r\n lemma_BEDigitSeqToInt_bound(pv, Bs);\r\n lemma_BEDigitSeqToInt_bound(pv, Es);\r\n lemma_BEDigitSeqToInt_bound(pv, Ns);\r\n\r\n var one := MakeBELiteralArray(1);\r\n ghost var Ones := one[..];\r\n ghost var Onev := BEWordSeqToInt(Ones);\r\n\r\n var ec:nat := FatNatCountBits(E);\r\n constrain_word_from_overflowing(ec);\r\n//- if (power2(32) <= ec)\r\n//- {\r\n//- calc {\r\n//- power2(power2(31));\r\n//- < { lemma_2toX32();\r\n//- lemma_power2_strictly_increases(power2(31), power2(32)-1); }\r\n//- power2(power2(32)-1);\r\n//- <= { lemma_power2_increases(power2(32)-1, ec-1); }\r\n//- Ev;\r\n//- <\r\n//- power2(power2(31));\r\n//- }\r\n//- assert false;\r\n//- }\r\n d := FatNatModExp_data_c(ec, B, E, N, one, ec, E, one);\r\n g := FatNatModExp_ghost_c(Bv, Ev, Nv, Onev, Ev, Onev);\r\n\r\n lemma_1_power(power2(ec));\r\n}\r\n\r\nlemma {:heap} lemma_E_propagation(d:FatNatModExp_data, ghost g:FatNatModExp_ghost,\r\n E_subv:int, R_bigv:int, bp2':nat)\r\n requires FatNatModExp_invariant(d, g);\r\n requires 0, ghost E2v:int,\r\n R2:array, ghost R2v:int,\r\n R2modN:array, ghost R2modNv:int)\r\n returns (E_sub:array, ghost E_subv:int, R':array, ghost Rv':int)\r\n requires FatNatModExp_invariant(d, g);\r\n requires 0, ghost E2v:int,\r\n R2:array, ghost R2v:int,\r\n R2modN:array, ghost R2modNv:int)\r\n returns (E_sub:array, ghost E_subv:int, R':array, ghost Rv':int)\r\n requires FatNatModExp_invariant(d, g);\r\n requires 0 := FleetNatMul(d.R, d.R); //- nc == \"non-canonical\"\r\n ghost var R2ncv := BEWordSeqToInt(R2nc[..]);\r\n\r\n//- var R2 := CanonicalizeArray(R2nc; //- UNDONE length constraints\r\n var R2 := R2nc;\r\n ghost var R2v := BEWordSeqToInt(R2[..]);\r\n\r\n//- lemma_lengths_squared(pv, d.R[..], d.R[..], 25, R2[..]);\r\n//- assert R2.Length < power2(27);\r\n\r\n lemma_mul_nonnegative(g.Rv, g.Rv);\r\n var R2modN := FatNatModuloUsingReciprocal(R2, d.N, Nreciprocal);\r\n ghost var R2modNv := BEWordSeqToInt(R2modN[..]);\r\n lemma_BEDigitSeqToInt_bound(pv, R2modN[..]);\r\n\r\n var E2:array := BitShiftLeft_Array(d.one, bp2');\r\n ghost var E2v := BEWordSeqToInt(E2[..]);\r\n calc {\r\n E2v;\r\n g.Onev*power2(bp2');\r\n { lemma_mul_basics_forall(); }\r\n power2(bp2');\r\n }\r\n\r\n var R':array;\r\n ghost var Rv':int;\r\n var E_sub:array;\r\n ghost var E_subv:int;\r\n var cmpE1E2 := FatNatCompare(d.E1, E2);\r\n var use_this_product:bool := (!cmpE1E2.CmpLt?);\r\n if (use_this_product)\r\n {\r\n E_sub,E_subv,R',Rv' := FatNatModExp_step_add(d, Nreciprocal, g, bp2', E2, E2v, R2, R2v, R2modN, R2modNv);\r\n }\r\n else\r\n {\r\n E_sub,E_subv,R',Rv' := FatNatModExp_step_noadd(d, g, bp2', E2, E2v, R2, R2v, R2modN, R2modNv);\r\n }\r\n\r\n \r\n \r\n \r\n \r\n R' := CanonicalizeArray(R');\r\n \r\n var E1' := E_sub;\r\n d' := FatNatModExp_data_c(bp2', d.B, d.E, d.N, R', d.ec, E1', d.one);\r\n g' := FatNatModExp_ghost_c(g.Bv, g.Ev, g.Nv, Rv', BEWordSeqToInt(E1'[..]), g.Onev);\r\n lemma_BEDigitSeqToInt_bound(pv, d'.R[..]);\r\n\r\n//- lemma_CanonicalLength_inherit(pv, R'[..], d.N[..], power2(25));\r\n}\r\n\r\nmethod FatNatModExp_conclusion(d:FatNatModExp_data, ghost g:FatNatModExp_ghost)\r\n requires FatNatModExp_invariant(d, g);\r\n requires d.bp2==0; //- loop termination condition\r\n ensures 0<=BEWordSeqToInt(d.E[..]); //- to meet precondition on next line\r\n ensures power(BEWordSeqToInt(d.B[..]),BEWordSeqToInt(d.E[..])) % BEWordSeqToInt(d.N[..])\r\n == BEWordSeqToInt(d.R[..]);\r\n ensures BEWordSeqToInt(d.R[..]) < BEWordSeqToInt(d.N[..]);\r\n ensures FatNatModExp_invariant(d, g);\r\n{\r\n calc {\r\n power(g.Bv,g.Ev) % g.Nv;\r\n //- loop invariant\r\n mul(power(g.Bv,g.E1v), power(g.Rv,power2(d.bp2))) % g.Nv;\r\n { lemma_power2_0_is_1(); } //- loop termination\r\n mul(power(g.Bv,0), power(g.Rv,1)) % g.Nv;\r\n { lemma_power_0(g.Bv); lemma_power_1(g.Rv); }\r\n mul(1, g.Rv) % g.Nv;\r\n { lemma_mul_basics_forall(); }\r\n g.Rv % g.Nv;\r\n { lemma_small_mod(g.Rv, g.Nv); }\r\n g.Rv;\r\n }\r\n}\r\n\r\nmethod FatNatModExpUsingReciprocal(B:array, E:array, N:array, Nreciprocal:FNDivReciprocal) returns (R:array)\r\n requires B!=null && IsWordSeq(B[..]);\r\n requires E!=null && IsWordSeq(E[..]);\r\n requires N!=null && IsWordSeq(N[..]);\r\n requires BEWordSeqToInt(B[..])!=0;\r\n requires 1 < BEWordSeqToInt(N[..]);\r\n//- requires BEWordSeqToInt(E[..]) < power2(power2(31));\r\n requires FNDivReciprocalValid(Nreciprocal, N);\r\n//- requires B.Length < power2(25);\r\n//- requires N.Length < power2(25);\r\n ensures R!=null;\r\n ensures IsWordSeq(R[..]);\r\n ensures 0<=BEWordSeqToInt(E[..]); //- to meet precondition on next line\r\n ensures power(BEWordSeqToInt(B[..]),BEWordSeqToInt(E[..])) % BEWordSeqToInt(N[..])\r\n == BEWordSeqToInt(R[..]);\r\n ensures BEWordSeqToInt(R[..]) < BEWordSeqToInt(N[..]);\r\n{\r\n ProfileTally(Tally_FatNatModExp(), 1);\r\n\r\n var recip_ref := if Nreciprocal.FNDivKnownReciprocal? then Nreciprocal.TwoTo32wDividedByD else B; //- do something real to Nreciprocal.TwoTo32wDividedByD\r\n\r\n var d;\r\n ghost var g;\r\n d,g := FatNatModExp_init(B, E, N);\r\n var db_ref := d.B; //- do something real to d.B so dafnycc realizes it's allocated\r\n var de_ref := d.E; //- do something real to d.E so dafnycc realizes it's allocated\r\n var dn_ref := d.N; //- do something real to d.N so dafnycc realizes it's allocated\r\n var dr_ref := d.R; //- do something real to d.R so dafnycc realizes it's allocated\r\n var de1_ref := d.E1; //- do something real to d.E1 so dafnycc realizes it's allocated\r\n var done_ref := d.one; //- do something real to d.one so dafnycc realizes it's allocated\r\n while (d.bp2 != 0)\r\n decreases d.bp2;\r\n invariant d.B == B;\r\n invariant d.E == E;\r\n invariant d.N == N;\r\n invariant FatNatModExp_invariant(d, g);\r\n invariant IsWordSeq(d.R[..]);\r\n {\r\n d,g := FatNatModExp_step(d, Nreciprocal, g);\r\n db_ref := d.B; //- do something real to d.B so dafnycc realizes it's allocated\r\n de_ref := d.E; //- do something real to d.E so dafnycc realizes it's allocated\r\n dn_ref := d.N; //- do something real to d.N so dafnycc realizes it's allocated\r\n dr_ref := d.R; //- do something real to d.R so dafnycc realizes it's allocated\r\n de1_ref := d.E1; //- do something real to d.E1 so dafnycc realizes it's allocated\r\n done_ref := d.one; //- do something real to d.one so dafnycc realizes it's allocated\r\n//- print d.R.Length;\r\n//- print \"\\n\";\r\n }\r\n FatNatModExp_conclusion(d, g);\r\n R := d.R;\r\n}\r\n\r\nmethod FatNatModExp(B:array, E:array, N:array) returns (R:array)\r\n requires B!=null && IsWordSeq(B[..]);\r\n requires E!=null && IsWordSeq(E[..]);\r\n requires N!=null && IsWordSeq(N[..]);\r\n requires BEWordSeqToInt(B[..])!=0;\r\n requires 1 < BEWordSeqToInt(N[..]);\r\n//- requires BEWordSeqToInt(E[..]) < power2(power2(31));\r\n//- requires B.Length < power2(25);\r\n//- requires N.Length < power2(25);\r\n ensures R!=null && IsWordSeq(R[..]);\r\n ensures 0<=BEWordSeqToInt(E[..]); //- to meet precondition on next line\r\n ensures power(BEWordSeqToInt(B[..]),BEWordSeqToInt(E[..])) % BEWordSeqToInt(N[..])\r\n == BEWordSeqToInt(R[..]);\r\n ensures BEWordSeqToInt(R[..]) < BEWordSeqToInt(N[..]);\r\n{\r\n R := FatNatModExpUsingReciprocal(B, E, N, FNDivUnknownReciprocal());\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatModesty.i.dfy", "content": "include \"FatNatCommon.i.dfy\"\r\ninclude \"Bitwise.i.dfy\"\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\npredicate {:heap} ModestFatNatValue(X:array)\r\n reads X;\r\n{\r\n WellformedFatNat(X)\r\n && J(X) < power2(power2(31))\r\n}\r\n\r\nmethod IsModestFatNat(X:array) returns (rc:bool)\r\n requires WellformedFatNat(X);\r\n ensures rc <==> ModestFatNatValue(X);\r\n{\r\n var xc := FatNatCountBits(X);\r\n rc := xc <= 0x80000000;\r\n lemma_2toX32();\r\n if (rc) {\r\n lemma_power2_increases(xc, 0x80000000);\r\n } else {\r\n lemma_power2_increases(power2(31), xc-1);\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatMul.i.dfy", "content": "include \"../Util/seqs_common.i.dfy\"\r\ninclude \"FatNatCommon.i.dfy\"\r\ninclude \"FatNatAddUnrolled.i.dfy\"\r\ninclude \"../FleetNat/FleetNatAdd.i.dfy\"\r\n\r\ninclude \"../Util/ProfileIfc.i.dfy\"\r\n\r\ninclude \"../Util/ProfileIfc.i.dfy\"\r\n\r\ndatatype MulRow = MulRow_c(\r\n a_fragment:int, a_partial_sum:int, product:int);\r\n\r\npredicate FNMulBase(row:MulRow)\r\n{\r\n row.a_partial_sum == row.a_fragment\r\n}\r\n\r\npredicate FNMulRelation(row:MulRow, b:int, r:int)\r\n{\r\n row.product == row.a_partial_sum * b + r\r\n}\r\n\r\npredicate FNMulNext(row:MulRow, row':MulRow)\r\n{\r\n row'.a_partial_sum == row'.a_fragment + row.a_partial_sum\r\n}\r\n\r\npredicate FNMulEnd(row:MulRow, p:int, a:int)\r\n{\r\n row.product == p\r\n && row.a_partial_sum == a\r\n}\r\n\r\npredicate FNMulProblemValid_partial(wks:seq, b:int, r:int)\r\n{\r\n 0<|wks|\r\n && (forall i :: 0<=i<|wks| ==> FNMulRelation(wks[i], b, r))\r\n && FNMulBase(wks[0])\r\n && (forall i :: 1<=i<|wks| ==> FNMulNext(wks[i-1], wks[i]))\r\n}\r\n\r\npredicate FNMulProblemValid(wks:seq, p:int, a:int, b:int, r:int)\r\n{\r\n FNMulProblemValid_partial(wks, b, r)\r\n && FNMulEnd(wks[|wks|-1], p, a)\r\n}\r\n\r\nlemma lemma_FNMultiplication(wks:seq, p:int, a:int, b:int, r:int)\r\n requires FNMulProblemValid(wks, p, a, b, r);\r\n ensures p == a * b + r;\r\n{\r\n}\r\n\r\npredicate FNMulRowReflectsBEDigits(pv:int, wks:seq, i:int, a:seq)\r\n requires 1, a:seq)\r\n requires 1 FNMulRowReflectsBEDigits(pv, wks, i, a)\r\n}\r\n\r\npredicate FNMulProblemReflectsBESeq(pv:int, wks:seq, p:seq, a:seq, b:seq, r:seq)\r\n requires 1, p:seq, a:seq, b:seq, r:seq)\r\n requires 1)\r\n requires right_zeros<=c;\r\n ensures a!=null;\r\n ensures fresh(a);\r\n ensures a.Length==c;\r\n ensures forall i :: 0<=i ArrayDigitAt(a, i)==0;\r\n{\r\n a := new int[c];\r\n var j := 0;\r\n while (j < right_zeros)\r\n invariant 0 <= j <= right_zeros;\r\n invariant forall i :: 0<=i ArrayDigitAt(a, i)==0;\r\n {\r\n assert forall i :: 0<=i a[c-1-i]==ArrayDigitAt(a,i); //- OBSERVE\r\n\r\n a[c-1-j] := 0;\r\n j := j + 1; // BURNED AGAIN by lack of termination-checking (decreases)!\r\n }\r\n}\r\n\r\ndatatype M1Data = M1Data_c(b:array, a:int, shiftd:int, pp:array, i:int, carry:int);\r\ndatatype M1Ghost = M1Ghost_c(Bs:seq, Ps:seq);\r\n\r\npredicate {:heap} M1invariant(d:M1Data, g:M1Ghost)\r\n reads d.b;\r\n reads d.pp;\r\n{\r\n 0<=d.a DigitAt(g.Ps, j)==0)\r\n && IsDigitSeq(power2(32), SelectDigitRange(g.Ps, d.shiftd+d.i, d.shiftd))\r\n && d.a * BEWordSeqToInt(SelectDigits(g.Bs, d.i))\r\n == BEWordSeqToInt(SelectDigitRange(g.Ps, d.shiftd+d.i, d.shiftd)) + d.carry * power2(32*d.i)\r\n}\r\n\r\nmethod M1init(b:array, a:int, shiftd:int) returns (d:M1Data, ghost g:M1Ghost)\r\n requires b!=null;\r\n requires IsDigitSeq(power2(32), b[..]);\r\n requires 0<=a ArrayDigitAt(pp, i)==DigitAt(Ps,i);\r\n assert forall j :: 0<=j DigitAt(Ps, j)==0;\r\n\r\n d := M1Data_c(b, a, shiftd, pp, 0, 0);\r\n g := M1Ghost_c(b[..], pp[..]);\r\n assert Ps==pp[..];\r\n\r\n lemma_mul_basics_forall();\r\n reveal_BEDigitSeqToInt_private();\r\n assert IsWordSeq(SelectDigits(g.Bs, d.i));\r\n calc {\r\n BEWordSeqToInt(SelectDigits(g.Bs, d.i));\r\n d.a*BEWordSeqToInt(g.Bs[|g.Bs|-d.i..|g.Bs|]);\r\n d.a*BEWordSeqToInt(g.Bs[|g.Bs|..|g.Bs|]);\r\n { assert g.Bs[|g.Bs|..|g.Bs|]==[]; } //- OBSERVE\r\n d.a*BEWordSeqToInt([]);\r\n 0;\r\n BEWordSeqToInt([]);\r\n { assert g.Ps[|g.Ps|-d.shiftd..|g.Ps|-d.shiftd]==[]; } //- OBSERVE\r\n BEWordSeqToInt(g.Ps[|g.Ps|-d.shiftd-d.i..|g.Ps|-d.shiftd]);\r\n BEWordSeqToInt(g.Ps[|g.Ps|-d.shiftd-d.i..|g.Ps|-d.shiftd]) + d.carry*power2(32*d.i);\r\n BEWordSeqToInt(SelectDigitRange(g.Ps, d.shiftd+d.i, d.shiftd)) + d.carry*power2(32*d.i);\r\n }\r\n}\r\n\r\n\r\nlemma lemma_M1step_a(g'Bs:seq, di:int, d'i:int,\r\n b':seq, t:seq, b:seq)\r\n requires IsWordSeq(g'Bs);\r\n requires 0<=di;\r\n requires di+1==d'i;\r\n requires d'i<=|g'Bs|;\r\n requires b'== SelectDigitRange(g'Bs, d'i, 0);\r\n requires t == SelectDigitRange(g'Bs, d'i, di);\r\n requires b == SelectDigitRange(g'Bs, di, 0);\r\n ensures b' == t+b;\r\n ensures b'[..|b'|-di] == t;\r\n ensures b'[|b'|-di..] == b;\r\n{\r\n assert b' == t+b; //- OBSERVE\r\n assert b'[..|b'|-di] == t;\r\n assert b'[|b'|-di..] == b;\r\n}\r\n\r\nmethod M1step(d:M1Data, ghost g:M1Ghost) returns (d':M1Data, ghost g':M1Ghost)\r\n requires M1invariant(d, g);\r\n requires d.i<|g.Bs|;\r\n modifies d.pp;\r\n ensures M1invariant(d', g');\r\n ensures d'.pp == d.pp;\r\n ensures d'.a == d.a;\r\n ensures d'.shiftd == d.shiftd;\r\n ensures d'.b == d.b;\r\n{\r\n var dpp_ref := d.pp; //- do something real to d.pp so dafnycc will realize that d.pp is allocated, and thus that d.pp is unaffected by methods that don't affect allocated parts of the heap\r\n\r\n ghost var pv := power2(32);\r\n lemma_2toX();\r\n\r\n var ml,mh := Product32(d.a, ArrayDigitAt_mul(d.b,d.i));\r\n var sl,acarry := Add32_two_arguments(ml, d.carry);\r\n dpp_ref[dpp_ref.Length - 1 - d.shiftd - d.i] := sl;\r\n\r\n assert 0 <= acarry < 2;\r\n\r\n var zero,carry;\r\n carry,zero := Add32_two_arguments(mh, acarry);\r\n \r\n ghost var m := ml + mh*pv;\r\n lemma_mul_nonnegative(mh,pv);\r\n calc {\r\n m;\r\n d.a * ArrayDigitAt(d.b,d.i);\r\n <= { lemma_mul_inequality(d.a, pv-1, ArrayDigitAt(d.b,d.i)); }\r\n (pv-1) * ArrayDigitAt(d.b,d.i);\r\n { lemma_mul_is_commutative_forall(); }\r\n ArrayDigitAt(d.b,d.i) * (pv-1);\r\n <= { lemma_mul_inequality(ArrayDigitAt(d.b,d.i), pv-1, pv-1); }\r\n (pv-1) * (pv-1);\r\n { lemma_mul_is_distributive_forall(); }\r\n pv*(pv-1)-mul(1,pv-1);\r\n { lemma_mul_basics_forall(); }\r\n pv*(pv-1)-(pv-1);\r\n { lemma_mul_is_distributive_forall(); }\r\n pv*pv-mul(pv,1)-(pv-1);\r\n { lemma_mul_basics_forall(); }\r\n pv*pv-pv-pv+1;\r\n { lemma_mul_is_mul_boogie(2,pv); }\r\n pv*pv-mul(2,pv)+1;\r\n { lemma_mul_is_distributive_forall(); }\r\n (pv-2)*pv+1;\r\n }\r\n calc {\r\n mh;\r\n { lemma_fundamental_div_mod_converse(m, pv, mh, ml); }\r\n m / pv;\r\n <= { lemma_div_is_ordered(m, ((pv-2)*pv + 1), pv); }\r\n ((pv-2)*pv + 1) / pv;\r\n { lemma_mul_is_commutative_forall(); }\r\n (pv*(pv-2) + 1) / pv;\r\n { lemma_div_multiples_vanish_fancy(pv-2, 1, pv); }\r\n pv-2;\r\n }\r\n assert mh+acarry < pv;\r\n lemma_mul_is_mul_boogie(0x100000000,zero);\r\n assert zero==0;\r\n\r\n d' := M1Data_c(d.b, d.a, d.shiftd, d.pp, d.i+1, carry);\r\n g' := M1Ghost_c(d.b[..], d.pp[..]);\r\n\r\n forall (j | 0<=j0)\r\n {\r\n assert 0 <= le_range[j-1] < pv;\r\n calc {\r\n le_range[j-1];\r\n be_range[j-1];\r\n g.Ps[|g.Ps|-d.shiftd-d.i..|g.Ps|-d.shiftd][j-1];\r\n g.Ps[|g.Ps|-d.shiftd-d.i+j-1];\r\n g'.Ps[|g'.Ps|-d'.shiftd-d'.i+j];\r\n be_range'[j];\r\n le_range'[j];\r\n }\r\n assert 0 <= le_range'[j] < pv;\r\n }\r\n }\r\n assert IsDigitSeq(power2(32), SelectDigitRange(g'.Ps, d'.shiftd+d'.i, d'.shiftd));\r\n\r\n ghost var b' := SelectDigitRange(g'.Bs, d'.i, 0);\r\n ghost var t := SelectDigitRange(g'.Bs, d'.i, d.i);\r\n ghost var b := SelectDigitRange(g'.Bs, d.i, 0);\r\n lemma_M1step_a(g'.Bs, d.i, d'.i, b', t, b);\r\n\r\n //- nicknames for subsequences of the product sequence\r\n ghost var HL := SelectDigitRange(g'.Ps, d'.i+d.shiftd, d.shiftd);\r\n ghost var HM := SelectDigitRange(g'.Ps, d'.i+d.shiftd, d.i+d.shiftd);\r\n ghost var ML := SelectDigitRange(g'.Ps, d.i+d.shiftd, d.shiftd);\r\n assert ML == SelectDigitRange(g.Ps, d.i+d.shiftd, d.shiftd); //- OBSERVE\r\n assert IsDigitSeq(pv, ML);\r\n\r\n calc {\r\n d'.a * BEWordSeqToInt(SelectDigits(g'.Bs, d'.i));\r\n d'.a * BEWordSeqToInt(SelectDigitRange(g'.Bs, d'.i, 0));\r\n { lemma_BEInterpretation(pv, b', d.i);}\r\n d'.a *(\r\n BEWordSeqToInt(SelectDigitRange(g'.Bs, d'.i, d.i))*power(pv,d.i)\r\n + BEWordSeqToInt(SelectDigitRange(g'.Bs, d.i, 0)));\r\n { lemma_mul_is_distributive_forall(); lemma_mul_is_associative_forall(); }\r\n d'.a*BEWordSeqToInt(SelectDigitRange(g'.Bs, d'.i, d.i))*power(pv,d.i)\r\n + d'.a*BEWordSeqToInt(SelectDigitRange(g'.Bs, d.i, 0));\r\n //- equal primed terms\r\n { assert d'.a==d.a; assert g'.Bs==g.Bs; //- OBSERVE\r\n }\r\n d.a*BEWordSeqToInt(SelectDigitRange(g.Bs, d'.i, d.i))*power(pv,d.i)\r\n + d.a*BEWordSeqToInt(SelectDigitRange(g.Bs, d.i, 0));\r\n //- induction hypothesis and\r\n { lemma_power2_unfolding(32, d.i);\r\n lemma_mul_is_mul_boogie(32, d.i); }\r\n d.a*BEWordSeqToInt(SelectDigitRange(g.Bs, d'.i, d.i))*power(pv,d.i)\r\n + BEWordSeqToInt(SelectDigitRange(g.Ps, d.i+d.shiftd, d.shiftd))\r\n + d.carry * power(pv,d.i);\r\n { lemma_mul_is_distributive_add_other_way(power(pv, d.i), d.a*BEWordSeqToInt(SelectDigitRange(g.Bs, d'.i, d.i)), d.carry); }\r\n (d.a*BEWordSeqToInt(SelectDigitRange(g.Bs, d'.i, d.i))\r\n + d.carry)*power(pv,d.i)\r\n + BEWordSeqToInt(SelectDigitRange(g.Ps, d.i+d.shiftd, d.shiftd));\r\n {\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_SelectSingletonRange(g.Bs, d'.i, d.i);\r\n var s := [DigitAt(g.Bs, d.i)];\r\n assert s[0..|s|-1] == []; \r\n lemma_BEDigitSeqToInt_singleton(pv, DigitAt(g.Bs, d.i));\r\n }\r\n\r\n (d.a*DigitAt(g.Bs,d.i)\r\n + d.carry)*power(pv,d.i)\r\n + BEWordSeqToInt(SelectDigitRange(g.Ps, d.i+d.shiftd, d.shiftd));\r\n { //- apply the 32-bit multiplication:\r\n assert ml+mh*pv == d.a * ArrayDigitAt(d.b,d.i);\r\n assert ArrayDigitAt(d.b,d.i)==DigitAt(g.Bs,d.i); }\r\n (ml+mh*pv + d.carry)*power(pv,d.i)\r\n + BEWordSeqToInt(SelectDigitRange(g.Ps, d.i+d.shiftd, d.shiftd));\r\n { lemma_mul_is_distributive_add_other_way(power(pv,d.i), ml + d.carry, mh*pv); }\r\n (ml+ d.carry)*power(pv,d.i)+mh*pv *power(pv,d.i)\r\n + BEWordSeqToInt(SelectDigitRange(g.Ps, d.i+d.shiftd, d.shiftd));\r\n { //- apply the first 32-bit add\r\n lemma_mul_is_mul_boogie(acarry, pv);\r\n }\r\n (sl+acarry*pv)*power(pv,d.i)+mh*pv *power(pv,d.i)\r\n + BEWordSeqToInt(SelectDigitRange(g.Ps, d.i+d.shiftd, d.shiftd));\r\n { lemma_mul_is_distributive_add_other_way(power(pv,d.i), sl, acarry*pv); }\r\n sl*power(pv,d.i)+acarry*pv*power(pv,d.i)+mh*pv*power(pv,d.i)\r\n + BEWordSeqToInt(SelectDigitRange(g.Ps, d.i+d.shiftd, d.shiftd));\r\n { lemma_mul_is_associative(mh, pv, power(pv,d.i)); }\r\n { lemma_mul_is_associative(acarry, pv, power(pv,d.i)); }\r\n { lemma_mul_is_distributive_add_other_way(pv*power(pv,d.i), acarry, mh); }\r\n { lemma_mul_is_associative(acarry + mh, pv, power(pv,d.i)); }\r\n sl*power(pv,d.i)+(acarry+mh)*pv*power(pv,d.i)\r\n + BEWordSeqToInt(SelectDigitRange(g.Ps, d.i+d.shiftd, d.shiftd));\r\n { //- apply the second 32-bit add\r\n lemma_mul_basics_forall();\r\n assert carry == carry+zero*pv == mh+acarry; }\r\n sl*power(pv,d.i)\r\n + BEWordSeqToInt(SelectDigitRange(g.Ps, d.i+d.shiftd, d.shiftd))\r\n +carry*pv*power(pv,d.i);\r\n //- re-prime\r\n sl*power(pv,d.i) + BEWordSeqToInt(ML) +carry*pv*power(pv,d.i);\r\n {\r\n lemma_SelectSingletonRange(g'.Ps, d'.i+d.shiftd, d.i+d.shiftd);\r\n lemma_BEDigitSeqToInt_singleton(pv, sl);\r\n }\r\n BEWordSeqToInt(HM)*power(pv,d.i) + BEWordSeqToInt(ML)\r\n +carry*pv*power(pv,d.i);\r\n { \r\n lemma_SelectDigitSubrange(g'.Ps, d'.i+d.shiftd, d.i+d.shiftd, d.shiftd);\r\n assert HL == HM+ML;\r\n lemma_BEInterpretation(pv, HL, d.i);\r\n assert BEWordSeqToInt(HL)\r\n == BEWordSeqToInt(HM)*power(pv,d.i) + BEWordSeqToInt(ML);\r\n }\r\n BEWordSeqToInt(SelectDigitRange(g'.Ps, d'.i+d.shiftd, d.shiftd))\r\n +carry*pv*power(pv,d.i);\r\n //- assignment of local into d'\r\n BEWordSeqToInt(SelectDigitRange(g'.Ps, d'.i+d.shiftd, d.shiftd))\r\n +d'.carry*pv*power(pv,d.i);\r\n { lemma_mul_is_associative_forall(); }\r\n BEWordSeqToInt(SelectDigitRange(g'.Ps, d'.i+d.shiftd, d.shiftd))\r\n +d'.carry*(pv*power(pv,d.i));\r\n { lemma_power_1(pv); }\r\n BEWordSeqToInt(SelectDigitRange(g'.Ps, d'.i+d.shiftd, d.shiftd))\r\n +d'.carry*(power(pv,1)*power(pv,d.i));\r\n { lemma_power_adds(pv,1,d.i); }\r\n BEWordSeqToInt(SelectDigitRange(g'.Ps, d'.i+d.shiftd, d.shiftd))\r\n +d'.carry*power(pv,d'.i);\r\n { lemma_power2_unfolding(32, d'.i);\r\n lemma_mul_is_mul_boogie(32, d'.i); }\r\n BEWordSeqToInt(SelectDigitRange(g'.Ps, d'.shiftd+d'.i, d'.shiftd)) + d'.carry * power2(32*d'.i);\r\n }\r\n}\r\n\r\nmethod M1conclusion(d:M1Data, ghost g:M1Ghost) returns (pp:array)\r\n requires M1invariant(d, g);\r\n requires d.i == |g.Bs|;\r\n modifies d.pp;\r\n ensures pp!=null;\r\n ensures IsDigitSeq(power2(32), pp[..]);\r\n ensures d.a * power2(32*d.shiftd) * BEWordSeqToInt(d.b[..]) == BEWordSeqToInt(pp[..]);\r\n ensures d.a * power(power2(32),d.shiftd) * BEWordSeqToInt(d.b[..]) == BEWordSeqToInt(pp[..]);\r\n ensures pp == d.pp; //- used to propagate fresh()\r\n{\r\n ghost var pv:=power2(32);\r\n lemma_2toX();\r\n\r\n var db_ref := d.b; //- do something real to d.b so dafnycc will realize that d.b is allocated, and thus that d.b is unaffected by methods that don't affect allocated parts of the heap\r\n\r\n pp := d.pp;\r\n pp[0] := d.carry;\r\n\r\n ghost var Ps := pp[..];\r\n//- assert IsWordSeq(SelectDigitRange(g.Ps, d.shiftd+d.i, d.shiftd));\r\n forall (j | 0<=j<|Ps|)\r\n ensures 0<=Ps[j] MLs[i]==0;\r\n calc {\r\n BEWordSeqToInt(pp[..]);\r\n BEWordSeqToInt(Ps);\r\n { lemma_BEInterpretation(pv, Ps, d.shiftd); }\r\n BEDigitSeqToInt(pv, HMs) * power(pv,d.shiftd) + BEDigitSeqToInt(pv, MLs);\r\n { lemma_LeadingZeros(pv, [], MLs); }\r\n BEDigitSeqToInt(pv, HMs) * power(pv,d.shiftd) + BEDigitSeqToInt(pv, []);\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEDigitSeqToInt(pv, HMs) * power(pv,d.shiftd);\r\n }\r\n\r\n ghost var HMi := HMs[..|HMs|-d.i];\r\n ghost var MLi := HMs[|HMs|-d.i..];\r\n assert HMs == HMi+MLi;\r\n calc {\r\n BEWordSeqToInt(HMs);\r\n { lemma_BEInterpretation(pv, HMs, d.i); }\r\n BEWordSeqToInt(HMi)*power(pv,d.i)+BEWordSeqToInt(MLi);\r\n { assert HMi==[d.carry]; //- OBSERVE\r\n lemma_BEDigitSeqToInt_singleton(pv, d.carry); }\r\n d.carry*power(pv,d.i)+BEWordSeqToInt(MLi);\r\n { lemma_power2_unfolding(32, d.i);\r\n lemma_mul_is_mul_boogie(32, d.i); }\r\n d.carry*power2(32*d.i)+BEWordSeqToInt(MLi);\r\n { assert MLi == SelectDigitRange(g.Ps, d.shiftd+d.i, d.shiftd); //- OBSERVE\r\n }\r\n d.carry*power2(32*d.i)\r\n +BEWordSeqToInt(SelectDigitRange(g.Ps, d.shiftd+d.i, d.shiftd));\r\n d.a * BEWordSeqToInt(SelectDigits(g.Bs, d.i));\r\n { assert g.Bs[0..|g.Bs|] == g.Bs; //- OBSERVE\r\n }\r\n d.a * BEWordSeqToInt(g.Bs);\r\n d.a * BEWordSeqToInt(d.b[..]);\r\n }\r\n calc {\r\n BEWordSeqToInt(pp[..]);\r\n d.a * BEWordSeqToInt(d.b[..]) * power(pv,d.shiftd);\r\n { lemma_mul_is_associative(d.a, BEWordSeqToInt(d.b[..]), power(pv,d.shiftd));\r\n lemma_mul_is_commutative(BEWordSeqToInt(d.b[..]), power(pv,d.shiftd));\r\n lemma_mul_is_associative(d.a, power(pv,d.shiftd), BEWordSeqToInt(d.b[..])); }\r\n d.a * power(pv,d.shiftd) * BEWordSeqToInt(d.b[..]);\r\n }\r\n lemma_power2_unfolding(32, d.shiftd);\r\n lemma_mul_is_mul_boogie(32, d.shiftd);\r\n}\r\n\r\nmethod MultiplyOneRow(b:array, a:int, shiftd:int) returns (pp:array)\r\n requires b!=null;\r\n requires IsDigitSeq(power2(32), b[..]);\r\n requires 0<=a, ghost Bs:seq, a:int, shiftd:int) returns (pp:array, ghost Ps:seq)\r\n requires b!=null;\r\n requires Bs == b[..];\r\n requires IsDigitSeq(power2(32), Bs);\r\n requires 0<=a, ghost As:seq, b:array, ghost Bs:seq) returns (c:array, ghost Cs:seq)\r\n requires a!=null;\r\n requires As == a[..];\r\n requires b!=null;\r\n requires Bs == b[..];\r\n requires IsDigitSeq(power2(32), As);\r\n requires IsDigitSeq(power2(32), Bs);\r\n ensures c!=null;\r\n ensures Cs == c[..];\r\n ensures IsDigitSeq(power2(32), Cs);\r\n ensures BEWordSeqToInt(As) + BEWordSeqToInt(Bs) == BEWordSeqToInt(Cs);\r\n{\r\n c := FatNatAdd(a, b);\r\n//- c := new int[0];\r\n// \r\n// \r\n// \r\n//- c := FleetNatAdd(c, a, b);\r\n Cs := c[..];\r\n}\r\n\r\npredicate FNMultiply_loop_invariant(pv:int, As:seq, Bs:seq, Rs:seq, wks:seq, i:int)\r\n{\r\n 1, Bs:seq, Rs:seq, wks:seq)\r\n requires 1, Bs:seq,\r\n old_Rs:seq, old_wks:seq, old_i:int,\r\n Ms:seq, a_fragment:int, a_partial_sum:int, rowi:MulRow,\r\n Rs:seq, wks:seq, i:int)\r\n requires FNMultiply_loop_invariant(pv, As, Bs, old_Rs, old_wks, old_i);\r\n requires IsDigitSeq(pv, Ms);\r\n requires i==old_i+1;\r\n requires old_i < |As|;\r\n requires BEDigitSeqToInt(pv,Ms) == DigitAt(As,old_i) * power(pv,old_i) * BEDigitSeqToInt(pv,Bs);\r\n requires IsDigitSeq(pv, Rs);\r\n requires BEDigitSeqToInt(pv,Rs) == BEDigitSeqToInt(pv,old_Rs) + BEDigitSeqToInt(pv,Ms);\r\n requires wks == old_wks + [rowi];\r\n requires a_fragment == DigitAt(As,old_i)*power(pv,old_i);\r\n requires a_partial_sum == a_fragment + old_wks[|old_wks|-1].a_partial_sum;\r\n requires rowi == MulRow_c(a_fragment, a_partial_sum, BEDigitSeqToInt(pv,Rs));\r\n ensures FNMultiply_loop_invariant(pv, As, Bs, Rs, wks, i);\r\n{\r\n assert IsDigitSeq(pv, Rs);\r\n assert 0 < i == |wks| <= |As|;\r\n assert IsDigitSeq(pv, Rs);\r\n\r\n var Bv := BEDigitSeqToInt(pv,Bs);\r\n assert 0<|wks|;\r\n forall (j | 0<=j<|wks|)\r\n ensures FNMulRelation(wks[j], Bv, 0);\r\n {\r\n if (j<|old_wks|)\r\n {\r\n assert FNMulRelation(old_wks[j], Bv, 0);\r\n }\r\n else\r\n {\r\n calc {\r\n wks[j].product;\r\n rowi.product;\r\n BEDigitSeqToInt(pv,Rs);\r\n BEDigitSeqToInt(pv,old_Rs) + BEDigitSeqToInt(pv,Ms);\r\n old_wks[|old_wks|-1].a_partial_sum*Bv + BEDigitSeqToInt(pv,Ms);\r\n old_wks[|old_wks|-1].a_partial_sum*Bv +\r\n DigitAt(As,old_i) * power(pv,old_i) * Bv;\r\n DigitAt(As,old_i)*power(pv,old_i)*Bv\r\n + old_wks[|old_wks|-1].a_partial_sum*Bv;\r\n a_fragment*Bv + old_wks[|old_wks|-1].a_partial_sum*Bv;\r\n { lemma_mul_is_distributive_forall(); }\r\n (a_fragment + old_wks[|old_wks|-1].a_partial_sum) * Bv;\r\n rowi.a_partial_sum * Bv;\r\n wks[j].a_partial_sum * Bv + 0;\r\n }\r\n assert FNMulRelation(wks[j], Bv, 0);\r\n }\r\n }\r\n assert FNMulBase(wks[0]);\r\n forall (j | 1<=j<|wks|)\r\n ensures FNMulNext(wks[j-1], wks[j]);\r\n {\r\n if (j<|old_wks|)\r\n {\r\n assert FNMulNext(old_wks[j-1], old_wks[j]);\r\n }\r\n else\r\n {\r\n assert FNMulNext(wks[j-1], wks[j]);\r\n }\r\n }\r\n\r\n assert FNMulProblemValid_partial(wks, Bv, 0);\r\n\r\n forall (j | 0<=j<|wks|)\r\n ensures FNMulRowReflectsBEDigits(pv, wks, j, As);\r\n {\r\n if (j<|old_wks|)\r\n {\r\n assert FNMulRowReflectsBEDigits(pv, old_wks, j, As);\r\n }\r\n else\r\n {\r\n assert j==|old_wks|==|wks|-1==i-1;\r\n var As1j := As[|As|-1-j..];\r\n assert |As1j| == j+1;\r\n calc {\r\n BEDigitSeqToInt(pv, As[|As|-1-j..]);\r\n BEDigitSeqToInt(pv, As1j);\r\n { lemma_BEInterpretation(pv, As1j, j); }\r\n BEDigitSeqToInt(pv, As1j[..|As1j|-j]) * power(pv,j) + BEDigitSeqToInt(pv, As1j[|As1j|-j..]);\r\n {\r\n assert As1j[..|As1j|-j] == As[|As|-1-j..|As|-j];\r\n assert As1j[|As1j|-j..] == As[|As|-j..];\r\n }\r\n BEDigitSeqToInt(pv, As[|As|-1-j..|As|-j]) * power(pv,j) + BEDigitSeqToInt(pv, As1j[|As1j|-j..]);\r\n\r\n }\r\n ghost var Astail := As[|As|-1-j..];\r\n calc {\r\n wks[j].a_partial_sum;\r\n a_partial_sum;\r\n a_fragment + old_wks[|old_wks|-1].a_partial_sum;\r\n DigitAt(As,old_i)*power(pv,old_i) + old_wks[|old_wks|-1].a_partial_sum;\r\n { assert FNMulRowReflectsBEDigits(pv, old_wks, j-1, As); }\r\n DigitAt(As,old_i)*power(pv,old_i) + BEDigitSeqToInt(pv, As[|As|-j..]);\r\n { assert As[|As|-j..] == Astail[|Astail|-old_i..]; }\r\n DigitAt(As,old_i)*power(pv,old_i) + BEDigitSeqToInt(pv, Astail[|Astail|-old_i..]);\r\n {\r\n assert Astail[..|Astail|-old_i] == [DigitAt(As,old_i)];\r\n lemma_mul_basics_forall();\r\n reveal_BEDigitSeqToInt_private();\r\n assert [DigitAt(As,old_i)][0..|[DigitAt(As,old_i)]|-1] == [];\r\n \r\n calc {\r\n DigitAt(As,old_i);\r\n mul(0,power(pv,1)) + DigitAt(As,old_i);\r\n BEDigitSeqToInt(pv, [])*power(pv,1) + DigitAt(As,old_i);\r\n BEDigitSeqToInt(pv, [DigitAt(As,old_i)]);\r\n BEDigitSeqToInt(pv, Astail[..|Astail|-old_i]);\r\n }\r\n }\r\n BEDigitSeqToInt(pv, Astail[..|Astail|-old_i]) * power(pv,old_i) + BEDigitSeqToInt(pv, Astail[|Astail|-old_i..]);\r\n { lemma_BEInterpretation(pv, Astail, old_i); }\r\n BEDigitSeqToInt(pv, As[|As|-1-j..]);\r\n }\r\n assert FNMulRowReflectsBEDigits(pv, wks, j, As);\r\n }\r\n }\r\n assert PNWksReflectsBEDigits(pv, wks, As);\r\n assert wks[|wks|-1].product == BEDigitSeqToInt(pv,Rs);\r\n}\r\n\r\ndatatype FNMulData = FNMulData_c(a:array, b:array, running_sum:array, i:int);\r\ndatatype FNMulGhost = FNMulGhost_c(As:seq, Bs:seq, Rs:seq, wks:seq);\r\n\r\npredicate {:heap} FNMultiply_loop_invariant_kit(d:FNMulData, g:FNMulGhost)\r\n reads d.a;\r\n reads d.b;\r\n reads d.running_sum;\r\n{\r\n d.a != null\r\n && d.a[..] == g.As\r\n && d.b != null\r\n && d.b[..] == g.Bs\r\n && d.running_sum != null\r\n && d.running_sum[..] == g.Rs\r\n && FNMultiply_loop_invariant(power2(32), g.As, g.Bs, g.Rs, g.wks, d.i)\r\n}\r\n\r\nmethod FNMultiply_init_kit(a:array, b:array) returns (d:FNMulData, ghost g:FNMulGhost)\r\n requires a!=null;\r\n requires 0)\r\n requires FNMultiply_loop_invariant_kit(d, g);\r\n requires d.i == |g.As|;\r\n ensures p!=null;\r\n ensures IsWordSeq(p[..]);\r\n ensures BEWordSeqToInt(d.a[..]) * BEWordSeqToInt(d.b[..]) == BEWordSeqToInt(p[..]);\r\n{\r\n ghost var pv := power2(32);\r\n p := d.running_sum;\r\n assert g.As[|g.As|-d.i..] == g.As; //- OBSERVE\r\n assert g.As == d.a[..]; //- OBSERVE\r\n\r\n assert PNWksReflectsBEDigits(pv, g.wks, g.As);\r\n assert FNMulRowReflectsBEDigits(pv, g.wks, |g.wks|-1, g.As); //- OBSERVE\r\n ghost var Av := BEDigitSeqToInt(pv, g.As);\r\n ghost var Bv := BEDigitSeqToInt(pv, g.Bs);\r\n//- calc {\r\n//- wks[|wks|-1].a_partial_sum;\r\n//- BEDigitSeqToInt(pv, As[|As|-1-(|wks|-1)..]);\r\n//- Av;\r\n//- }\r\n//- assert g.wks[|g.wks|-1].a_partial_sum == Av;\r\n//- assert FNMulEnd(g.wks[|g.wks|-1], BEDigitSeqToInt(pv, g.Rs), Av);\r\n//- assert FNMulProblemValid(g.wks, BEDigitSeqToInt(pv, g.Rs), Av, Bv, 0);\r\n reveal_BEDigitSeqToInt_private();\r\n//- assert FNMulProblemValid(g.wks, BEDigitSeqToInt(pv, g.Rs), BEDigitSeqToInt(pv, g.As), BEDigitSeqToInt(pv, g.Bs), BEDigitSeqToInt(pv, []));\r\n//- assert FNMulProblemReflectsBESeq(pv, g.wks, g.Rs, g.As, g.Bs, []);\r\n//- assert FNMulProblemReflectsBESeq(pv, g.wks, p[..], d.a[..], d.b[..], []);\r\n lemma_FNMultiplication_BE(pv, g.wks, p[..], d.a[..], d.b[..], []);\r\n}\r\n\r\nmethod FatNatMul(a:array, b:array) returns (p:array)\r\n requires a!=null;\r\n requires b!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n requires IsDigitSeq(power2(32), b[..]);\r\n ensures p!=null;\r\n ensures IsDigitSeq(power2(32), p[..]);\r\n ensures BEWordSeqToInt(a[..]) * BEWordSeqToInt(b[..]) == BEWordSeqToInt(p[..]);\r\n{\r\n ProfileTally(Tally_FatNatMul(), 1);\r\n\r\n //- 0* case\r\n if (a.Length==0)\r\n {\r\n lemma_2toX32();\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_mul_basics_forall();\r\n lemma_mul_nonnegative_forall();\r\n p := new int[0];\r\n return;\r\n }\r\n\r\n var d:FNMulData;\r\n ghost var g:FNMulGhost;\r\n d,g := FNMultiply_init_kit(a, b);\r\n\r\n while (d.i < a.Length)\r\n invariant a[..] == g.As;\r\n invariant b[..] == g.Bs;\r\n invariant FNMultiply_loop_invariant_kit(d, g);\r\n invariant d.a == a;\r\n invariant d.b == b;\r\n {\r\n d,g := FNMultiply_step_kit(d, g);\r\n }\r\n\r\n p := FNMultiply_conclusion_kit(d, g);\r\n calc {\r\n BEWordSeqToInt(a[..]) * BEWordSeqToInt(b[..]);\r\n BEWordSeqToInt(d.a[..]) * BEWordSeqToInt(d.b[..]);\r\n BEWordSeqToInt(p[..]);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatRandom.i.dfy", "content": "include \"FatNatCompare.i.dfy\"\r\ninclude \"Bitwise.i.dfy\"\r\ninclude \"../Crypto/RandomNumberGen.s.dfy\"\r\ninclude \"../../Drivers/TPM/tpm-wrapper.i.dfy\"\r\n//-include \"../Math/round.i.dfy\"\r\n//-include \"../Math/BitwiseOperations.i.dfy\"\r\n//-include \"../../Drivers/TPM/tpm-wrapper.i.dfy\"\r\n//-include \"../../Drivers/CPU/assembly_premium.i.dfy\"\r\n\r\nmethod BEWordSeqToFatNat(s:seq) returns (F:array)\r\n requires IsWordSeq(s);\r\n ensures fresh(F);\r\n ensures WellformedFatNat(F);\r\n ensures F[..] == s;\r\n ensures J(F) == BEWordSeqToInt(s);\r\n{\r\n F := new int[|s|];\r\n\r\n var i:int := 0;\r\n while i < |s|\r\n invariant 0 <= i <= |s|;\r\n invariant IsWordSeq(F[..i]);\r\n invariant F[..i] == s[..i];\r\n {\r\n F[i] := s[i];\r\n assert F[..i+1] == F[..i] + [F[i]];\r\n assert s[..i+1] == s[..i] + [s[i]];\r\n i := i + 1;\r\n }\r\n\r\n calc {\r\n F[..];\r\n F[..i];\r\n s[..i];\r\n s;\r\n }\r\n}\r\n\r\nmethod MakeTopBitsZero(x:int, bits:int) returns (y:int)\r\n requires 0 <= bits < 32;\r\n requires Word32(x);\r\n ensures y == x % power2(32-bits);\r\n ensures Word32(y);\r\n{\r\n if bits == 0 {\r\n y := x;\r\n lemma_small_mod(x, power2(32));\r\n }\r\n else {\r\n var two_to_bits := ComputePower2(32-bits);\r\n y := Asm_Mod(x, two_to_bits);\r\n lemma_mod_is_mod_boogie(x, power2(32-bits));\r\n }\r\n}\r\n\r\nlemma Lemma_ModMultiplies(a:int, b:int, m:int)\r\n requires a >= 0;\r\n requires b > 0;\r\n requires m > 0;\r\n ensures m * b != 0;\r\n ensures (a % m) * b == (a * b) % (m * b);\r\n{\r\n calc {\r\n m * b;\r\n > { lemma_mul_strict_inequality(0, m, b); lemma_mul_is_mul_boogie(0, b); }\r\n 0 * b;\r\n 0;\r\n }\r\n\r\n calc {\r\n a * b;\r\n { lemma_mul_is_commutative(a, b); }\r\n b * a;\r\n { lemma_fundamental_div_mod(a, m); }\r\n b * (m * (a / m) + (a % m));\r\n { lemma_mul_is_distributive_add(b, m * (a / m), a % m); }\r\n b * (m * (a / m)) + b * (a % m);\r\n { lemma_mul_is_associative(b, m, a/m); }\r\n (b * m) * (a / m) + b * (a % m);\r\n { lemma_mul_is_commutative(a/m, b*m); }\r\n (a / m) * (b * m) + b * (a % m);\r\n { lemma_mul_is_commutative(b, m); }\r\n (a / m) * (m * b) + b * (a % m);\r\n }\r\n calc {\r\n b * (a % m);\r\n { lemma_mul_is_commutative(b, a % m); }\r\n (a % m) * b;\r\n <= { lemma_mod_pos_bound(a, m); lemma_mul_inequality(a % m, m-1, b); }\r\n (m - 1) * b;\r\n { lemma_mul_is_commutative(b, m-1); }\r\n b * (m - 1);\r\n { lemma_mul_is_distributive_sub(b, m, 1); lemma_mul_is_mul_boogie(b, 1); }\r\n b * m - b * 1;\r\n { lemma_mul_is_commutative(m, b); }\r\n m * b - b * 1;\r\n < m * b;\r\n }\r\n calc {\r\n (a * b) % (m * b);\r\n { lemma_mul_nonnegative(m, b);\r\n lemma_mod_pos_bound(a, m);\r\n lemma_mul_nonnegative(b, a % m);\r\n lemma_fundamental_div_mod_converse(a * b, m * b, a / m, b * (a % m)); }\r\n b * (a % m);\r\n }\r\n lemma_mul_is_commutative(b, a % m);\r\n}\r\n\r\nlemma Lemma_ExpressWordSeqInTermsOfTopWord(y:seq)\r\n requires IsWordSeq(y);\r\n requires |y| > 0;\r\n ensures BEWordSeqToInt(y) == y[0] * power2(32*(|y|-1)) + BEWordSeqToInt(y[1..]);\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n calc {\r\n BEWordSeqToInt([y[0]]);\r\n BEWordSeqToInt([y[0]][0..|[y[0]]|-1])*power2(32) + [y[0]][|[y[0]]|-1];\r\n BEWordSeqToInt([])*power2(32) + [y[0]][|[y[0]]|-1];\r\n BEWordSeqToInt([])*power2(32) + y[0];\r\n { lemma_mul_is_mul_boogie(0, power2(32)); }\r\n 0*power2(32) + y[0];\r\n y[0];\r\n }\r\n calc {\r\n BEWordSeqToInt(y);\r\n { lemma_2to32(); lemma_BEInterpretation(power2(32), y, |y|-1); }\r\n BEWordSeqToInt(y[..1]) * power(power2(32), |y|-1) + BEWordSeqToInt(y[1..]);\r\n { assert y[..1] == [y[0]]; }\r\n BEWordSeqToInt([y[0]]) * power(power2(32), |y|-1) + BEWordSeqToInt(y[1..]);\r\n { assert BEWordSeqToInt([y[0]]) == y[0]; }\r\n y[0] * power(power2(32), |y|-1) + BEWordSeqToInt(y[1..]);\r\n { lemma_power2_unfolding(32, |y|-1); lemma_mul_is_mul_boogie(32, |y|-1); }\r\n y[0] * power2(32*(|y|-1)) + BEWordSeqToInt(y[1..]);\r\n }\r\n}\r\n\r\nlemma Lemma_MakingTopBitsZeroAffectsEntireSequence(x:seq, y:seq, bits:int)\r\n requires 0 <= bits < 32;\r\n requires |x| == |y|;\r\n requires |x| > 0;\r\n requires IsWordSeq(x);\r\n requires IsWordSeq(y);\r\n requires y[0] == x[0] % power2(32-bits);\r\n requires forall i :: 0 < i < |x| ==> y[i] == x[i];\r\n ensures BEWordSeqToInt(y) == BEWordSeqToInt(x) % power2(|x|*32-bits);\r\n decreases |x|;\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n calc {\r\n BEWordSeqToInt(y);\r\n { Lemma_ExpressWordSeqInTermsOfTopWord(y); }\r\n y[0] * power2(32*(|y|-1)) + BEWordSeqToInt(y[1..]);\r\n { assert y[1..] == x[1..]; }\r\n y[0] * power2(32*(|x|-1)) + BEWordSeqToInt(x[1..]);\r\n (x[0] % power2(32-bits)) * power2(32*(|x|-1)) + BEWordSeqToInt(x[1..]);\r\n }\r\n calc {\r\n BEWordSeqToInt(x[1..]);\r\n < { lemma_BEDigitSeqToInt_bound(power2(32), x[1..]); }\r\n power(power2(32), |x|-1);\r\n { lemma_power2_unfolding(32, |x|-1); lemma_mul_is_mul_boogie(32, |x|-1); }\r\n power2(32 * (|x|-1));\r\n }\r\n calc {\r\n (x[0] % power2(32-bits)) * power2(32*(|x|-1)) + BEWordSeqToInt(x[1..]);\r\n < (x[0] % power2(32-bits)) * power2(32*(|x|-1)) + power2(32*(|x|-1));\r\n { lemma_mul_is_commutative(x[0] % power2(32-bits), power2(32*(|x|-1))); }\r\n power2(32*(|x|-1)) * (x[0] % power2(32-bits)) + power2(32*(|x|-1));\r\n power2(32*(|x|-1)) * (x[0] % power2(32-bits)) + power2(32*(|x|-1)) * 1;\r\n { lemma_mul_is_distributive_add(power2(32*(|x|-1)), x[0] % power2(32-bits), 1); lemma_mul_is_mul_boogie(power2(32*(|x|-1)), 1); }\r\n power2(32*(|x|-1)) * (x[0] % power2(32-bits) + 1);\r\n { lemma_mul_is_commutative(power2(32*(|x|-1)), x[0] % power2(32-bits) + 1); }\r\n (x[0] % power2(32-bits) + 1) * power2(32*(|x|-1));\r\n <= { lemma_mod_properties(); lemma_mul_inequality(x[0] % power2(32-bits) + 1, power2(32-bits), power2(32*(|x|-1))); }\r\n power2(32-bits) * power2(32*(|x|-1));\r\n { lemma_power2_adds(32-bits, 32*(|x|-1)); }\r\n power2(32 - bits + 32*(|x|-1));\r\n { lemma_mul_is_mul_boogie(32, |x|-1); lemma_mul_is_distributive_sub(32, |x|, 1); lemma_mul_is_mul_boogie(32, 1); }\r\n power2(32 - bits + 32*|x| - 32*1);\r\n power2(32*|x| - bits);\r\n }\r\n calc {\r\n (x[0] % power2(32-bits)) * power2(32*(|x|-1)) + BEWordSeqToInt(x[1..]);\r\n { Lemma_ModMultiplies(x[0], power2(32*(|x|-1)), power2(32-bits)); }\r\n (x[0] * power2(32*(|x|-1))) % (power2(32-bits)*power2(32*(|x|-1))) + BEWordSeqToInt(x[1..]);\r\n { lemma_power2_adds(32-bits, 32*(|x|-1)); }\r\n (x[0] * power2(32*(|x|-1))) % power2(32-bits + 32*(|x|-1)) + BEWordSeqToInt(x[1..]);\r\n { lemma_mul_is_mul_boogie(32, |x|-1); lemma_mul_is_distributive_sub(32, |x|, 1); lemma_mul_is_mul_boogie(32, 1); }\r\n (x[0] * power2(32*(|x|-1))) % power2(32-bits + 32*|x|-32*1) + BEWordSeqToInt(x[1..]);\r\n (x[0] * power2(32*(|x|-1))) % power2(32*|x|-bits) + BEWordSeqToInt(x[1..]);\r\n calc {\r\n BEWordSeqToInt(x[1..]);\r\n < { lemma_BEDigitSeqToInt_bound(power2(32), x[1..]); }\r\n power(power2(32), |x|-1);\r\n { lemma_power2_unfolding(32, |x|-1); lemma_mul_is_mul_boogie(32, |x|-1); }\r\n power2(32 * (|x|-1));\r\n { lemma_mul_is_distributive_sub(32, |x|, 1); lemma_mul_is_mul_boogie(32, |x|-1); lemma_mul_is_mul_boogie(32, |x|); lemma_mul_is_mul_boogie(32, 1); }\r\n power2(32 * |x| - 32 * 1);\r\n power2(32 * |x| - 32);\r\n <= { lemma_power2_increases(32 * |x| - 32, 32 * |x| - bits); } power2(32 * |x| - bits);\r\n }\r\n { lemma_small_mod(BEWordSeqToInt_premium(x[1..]), power2(32 * |x| - bits)); }\r\n (x[0] * power2(32*(|x|-1))) % power2(32*|x|-bits) + BEWordSeqToInt(x[1..]) % power2(32*|x|-bits);\r\n }\r\n calc {\r\n (x[0] * power2(32*(|x|-1))) % power2(32*|x|-bits) + BEWordSeqToInt(x[1..]) % power2(32*|x|-bits);\r\n { assert (x[0] * power2(32*(|x|-1))) % power2(32*|x|-bits) + BEWordSeqToInt(x[1..]) % power2(32*|x|-bits) == BEWordSeqToInt_premium(y); }\r\n { lemma_small_mod((x[0] * power2(32*(|x|-1))) % power2(32*|x|-bits) + BEWordSeqToInt(x[1..]) % power2(32*|x|-bits), power2(32*|x|-bits)); }\r\n ((x[0] * power2(32*(|x|-1))) % power2(32*|x|-bits) + BEWordSeqToInt(x[1..]) % power2(32*|x|-bits)) % power2(32*|x|-bits);\r\n { lemma_add_mod_noop(x[0] * power2(32*(|x|-1)), BEWordSeqToInt(x[1..]), power2(32*|x|-bits)); }\r\n (x[0] * power2(32*(|x|-1)) + BEWordSeqToInt(x[1..])) % power2(32*|x|-bits);\r\n { Lemma_ExpressWordSeqInTermsOfTopWord(x); }\r\n BEWordSeqToInt(x) % power2(32*|x|-bits);\r\n }\r\n}\r\n\r\nmethod FatNatRandomPower2(c:nat) returns (R:array, ghost randoms:seq)\r\n requires TPM_ready();\r\n ensures fresh(R);\r\n ensures R != null;\r\n ensures WellformedFatNat(R);\r\n ensures IsByteSeqOfLen(randoms, DivideRoundingUp(c, 8));\r\n ensures J(R) == BEByteSeqToInt(randoms) % power2(c);\r\n ensures J(R) < power2(c);\r\n ensures TPM_ready();\r\n modifies this`TPM;\r\n modifies this`IoMemPerm;\r\n ensures TPMs_match_except_for_randoms(old(TPM), TPM);\r\n ensures old(TPM).random_index <= TPM.random_index;\r\n ensures randoms == TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index);\r\n{\r\n lemma_2to32();\r\n var byte_count := DivideRoundingUp_premium(c, 8);\r\n\r\n var byte_seq := get_random(byte_count);\r\n randoms := byte_seq;\r\n assert |randoms| == byte_count == DivideRoundingUp(c, 8);\r\n var word_seq,padding := BEByteSeqToWordSeq_impl(byte_seq);\r\n assert |word_seq| == (|byte_seq|+3)/4;\r\n//- var trim_seq := TrimLeadingZeros(4294967296, word_seq);\r\n\r\n R := BEWordSeqToFatNat(word_seq);\r\n assert WellformedFatNat(R);\r\n assert J(R) == BEWordSeqToInt(word_seq) == BEByteSeqToInt(randoms);\r\n\r\n calc {\r\n byte_count*8;\r\n >= { lemma_mul_is_mul_boogie(byte_count, 8); } c;\r\n }\r\n\r\n if byte_count > 0 {\r\n calc {\r\n |word_seq| * 32 - c;\r\n (byte_count+3)/4 * 32 - c;\r\n (DivideRoundingUp_premium(c, 8)+3)/4 * 32 - c;\r\n ((c + 7)/8 +3)/4 * 32 - c;\r\n ((c + 7)/8 + 24 / 8)/4 * 32 - c;\r\n ((c + 31)/8)/4 * 32 - c;\r\n (c + 31)/32 * 32 - c;\r\n DivideRoundingUp_premium(c, 32) * 32 - c;\r\n < { lemma_mul_is_commutative(DivideRoundingUp_premium(c, 32), 32); }\r\n c + 32 - c;\r\n 32;\r\n }\r\n R[0] := MakeTopBitsZero(R[0], |word_seq| * 32 - c);\r\n Lemma_MakingTopBitsZeroAffectsEntireSequence(word_seq, R[..], |word_seq| * 32 - c);\r\n calc {\r\n J(R);\r\n BEWordSeqToInt(word_seq) % power2(|word_seq|*32-(|word_seq|*32-c));\r\n BEWordSeqToInt(word_seq) % power2(c);\r\n }\r\n assert J(R) == BEByteSeqToInt(randoms) % power2(c);\r\n }\r\n else {\r\n calc {\r\n J(R);\r\n BEWordSeqToInt([]);\r\n { reveal_BEDigitSeqToInt_private(); }\r\n 0;\r\n }\r\n calc {\r\n BEByteSeqToInt(randoms) % power2(c);\r\n < { lemma_mod_properties(); } power2(c);\r\n { reveal_power2(); }\r\n 1;\r\n }\r\n }\r\n\r\n lemma_mod_properties();\r\n assert J(R) < power2(c);\r\n}\r\n//-\r\nstatic predicate CandidateSeedWorksheetValid_incremental(req:SelectRandomRequest, worksheet:CandidateSeedWorksheet, last_succeeds:bool)\r\n{\r\n (forall i :: 0<=i<|worksheet.rows| ==> CandidateSeedWorksheetRowValid(req, worksheet.rows[i]))\r\n //- all but last row fail\r\n && (forall i:int :: 0<=i<|worksheet.rows|-1 ==> !worksheet.rows[i].accepted)\r\n //- last as specified\r\n && (|worksheet.rows|>0 ==> worksheet.rows[|worksheet.rows|-1].accepted == last_succeeds)\r\n //- randoms properly accounted for\r\n && CandidateSeedWorksheetConsumesRandoms(worksheet.rows) == worksheet.randoms\r\n}\r\n\r\nmethod FatNatRandomFromInclusiveRange(L:array, H:array, ghost req:SelectRandomRequest) returns (R:array, ghost worksheet:CandidateSeedWorksheet)\r\n requires WellformedFatNat(L);\r\n requires WellformedFatNat(H);\r\n requires J(L) <= J(H);\r\n requires req.l == J(L);\r\n requires req.h == J(H);\r\n requires SelectRandomRequestValid(req);\r\n requires TPM_ready();\r\n ensures TPM_ready();\r\n ensures WellformedFatNat(R);\r\n ensures J(L) <= J(R) <= J(H);\r\n ensures CandidateSeedWorksheetValid(req, worksheet);\r\n ensures J(R) == CandidateSeedWorksheetOutput(worksheet);\r\n modifies this`TPM; \r\n modifies this`IoMemPerm;\r\n ensures TPMs_match_except_for_randoms(old(TPM), TPM);\r\n ensures old(TPM).random_index <= TPM.random_index;\r\n ensures worksheet.randoms == TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index);\r\n{\r\n var c:nat := FatNatCountBits(H);\r\n\r\n lemma_bit_count_is_unique(J(H), c, req.h_bits);\r\n\r\n var lobound:bool := false;\r\n var hibound:bool := false;\r\n\r\n ghost var randoms;\r\n worksheet := CandidateSeedWorksheet_c([], []);\r\n\r\n ghost var started := false;\r\n R := new int[0]; //- dafnycc requires us to initialize this variable, and doesn't support initializing it to null.\r\n var accepted := false;\r\n while (!accepted)\r\n decreases *; //- Possibly doesn't terminate.\r\n invariant started ==> WellformedFatNat(R);\r\n invariant started ==> lobound == (J(L)<=J(R));\r\n invariant started ==> hibound == (J(R)<=J(H));\r\n invariant started ==> 0<|worksheet.rows|;\r\n invariant accepted ==> started;\r\n invariant CandidateSeedWorksheetValid_incremental(req, worksheet, accepted);\r\n invariant accepted ==> CandidateSeedWorksheetOutput(worksheet) == J(R);\r\n invariant TPM_ready();\r\n invariant TPMs_match_except_for_randoms(old(TPM), TPM);\r\n invariant old(TPM).random_index <= TPM.random_index;\r\n invariant worksheet.randoms == TPM_random_bytes_premium(old(TPM).random_index, TPM.random_index);\r\n invariant TPM.random_index - old(TPM).random_index == |worksheet.randoms|;\r\n {\r\n R, randoms := FatNatRandomPower2(c);\r\n lobound := FatNatLe(L, R);\r\n hibound := FatNatLe(R, H);\r\n started := true;\r\n accepted := lobound && hibound;\r\n\r\n ghost var row := CandidateSeedWorksheetRow_c(J(R), accepted, randoms);\r\n ghost var worksheet' := CandidateSeedWorksheet_c(\r\n worksheet.rows + [row],\r\n worksheet.randoms + randoms);\r\n lemma_random_comprehension(old(TPM).random_index, worksheet.randoms, randoms);\r\n\r\n worksheet := worksheet';\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatReciprocal.i.dfy", "content": "include \"FatNatDivDefs.i.dfy\"\r\ninclude \"../FleetNat/FleetNatMul.i.dfy\"\r\ninclude \"CanonicalArrays.i.dfy\"\r\n\r\ndatatype FNDivReciprocal = FNDivKnownReciprocal(w:int, TwoTo32wDividedByD:array) |\r\n FNDivUnknownReciprocal();\r\n\r\npredicate FNDivReciprocalValid(reciprocal:FNDivReciprocal, dv:array)\r\n reads dv;\r\n reads if reciprocal.FNDivKnownReciprocal? then reciprocal.TwoTo32wDividedByD else dv;\r\n{\r\n dv != null &&\r\n IsWordSeq(dv[..]) &&\r\n BEWordSeqToInt(dv[..]) != 0 &&\r\n (reciprocal.FNDivKnownReciprocal? ==>\r\n (reciprocal.w >= dv.Length * 2 &&\r\n reciprocal.TwoTo32wDividedByD != null &&\r\n IsWordSeq(reciprocal.TwoTo32wDividedByD[..]) &&\r\n BEWordSeqToInt(reciprocal.TwoTo32wDividedByD[..]) == power2(32*reciprocal.w) / BEWordSeqToInt(dv[..])))\r\n}\r\n\r\nlemma Lemma_RemovingLastWordDividesBy2To32(s:seq)\r\n requires |s| > 0;\r\n requires IsWordSeq(s);\r\n ensures BEWordSeqToInt(s[..|s|-1]) == BEWordSeqToInt(s) / power2(32);\r\n{\r\n var pv := power2(32);\r\n lemma_2toX();\r\n lemma_BEInterpretation(pv, s, 1);\r\n lemma_power2_unfolding(32, 1);\r\n lemma_BEDigitSeqToInt_bound(pv, s[|s|-1..]);\r\n lemma_fundamental_div_mod_converse(\r\n BEDigitSeqToInt(pv, s),\r\n pv,\r\n BEDigitSeqToInt(pv, s[..|s|-1]),\r\n BEDigitSeqToInt(pv, s[|s|-1..]));\r\n}\r\n\r\nlemma Lemma_RemovingLastNWordsDividesBy2To32n(s:seq, n:nat)\r\n requires |s| >= n;\r\n requires IsWordSeq(s);\r\n ensures BEWordSeqToInt(s[..|s|-n]) == BEWordSeqToInt(s) / power2(32 * n);\r\n decreases n;\r\n{\r\n if n == 0 {\r\n calc {\r\n BEWordSeqToInt(s[..|s|-n]);\r\n { assert s == s[..|s|]; }\r\n BEWordSeqToInt(s);\r\n BEWordSeqToInt(s) / 1;\r\n { reveal_power2(); lemma_div_is_div_boogie(BEWordSeqToInt(s), 1); }\r\n BEWordSeqToInt(s) / power2(0);\r\n BEWordSeqToInt(s) / power2(32 * n);\r\n }\r\n }\r\n else {\r\n Lemma_RemovingLastNWordsDividesBy2To32n(s, n-1);\r\n assert BEWordSeqToInt(s[..|s|-(n-1)]) == BEWordSeqToInt(s) / power2(32 * (n-1));\r\n calc {\r\n BEWordSeqToInt(s[..|s|-n]);\r\n { Lemma_RemovingLastWordDividesBy2To32(s[..|s|-(n-1)]); assert var q := s[..|s|-(n-1)]; q[..|q|-1] == s[..|s|-n]; }\r\n BEWordSeqToInt(s[..|s|-(n-1)]) / power2(32);\r\n { Lemma_RemovingLastNWordsDividesBy2To32n(s, n-1); }\r\n (BEWordSeqToInt(s) / power2(32 * (n-1))) / power2(32);\r\n { assert BEWordSeqToInt_premium(s) >= 0;\r\n lemma_div_denominator(BEWordSeqToInt(s), power2(32 * (n-1)), power2(32));\r\n lemma_power2_positive();\r\n lemma_mul_strictly_positive(power2(32 * (n-1)), power2(32)); }\r\n BEWordSeqToInt(s) / (power2(32 * (n-1)) * power2(32));\r\n { lemma_power2_adds(32 * (n-1), 32); }\r\n BEWordSeqToInt(s) / power2(32 * (n-1) + 32);\r\n BEWordSeqToInt(s) / power2(32 * n);\r\n }\r\n }\r\n}\r\n\r\nmethod FNShiftRightByWords(n:array, w:nat) returns (r:array)\r\n requires n != null;\r\n requires IsWordSeq(n[..]);\r\n ensures r != null;\r\n ensures fresh(r);\r\n ensures IsWordSeq(r[..]);\r\n ensures BEWordSeqToInt(r[..]) == BEWordSeqToInt(n[..]) / power2(32*w);\r\n{\r\n if n.Length <= w {\r\n lemma_BEDigitSeqToInt_bound(power2(32), n[..]);\r\n calc {\r\n BEWordSeqToInt(n[..]);\r\n < power(power2(32), n.Length);\r\n { lemma_power2_is_power_2(32); }\r\n power(power(2, 32), n.Length);\r\n { lemma_power_multiplies(2, 32, n.Length); lemma_mul_is_mul_boogie(32, n.Length); }\r\n power(2, 32 * n.Length);\r\n { lemma_power2_is_power_2(32 * n.Length); }\r\n power2(32 * n.Length);\r\n <= { lemma_mul_is_commutative_forall();\r\n lemma_mul_is_mul_boogie(32, n.Length);\r\n lemma_mul_is_mul_boogie(32, w);\r\n lemma_mul_inequality(n.Length, w, 32);\r\n lemma_power2_increases(32 * n.Length, 32 * w); }\r\n power2(32 * w);\r\n }\r\n r := new int[0];\r\n calc {\r\n BEWordSeqToInt(r[..]);\r\n { assert r[..] == []; }\r\n BEWordSeqToInt([]);\r\n { reveal_BEDigitSeqToInt_private(); }\r\n 0;\r\n { lemma_small_div(); }\r\n BEWordSeqToInt(n[..]) / power2(32*w);\r\n }\r\n return;\r\n }\r\n\r\n r := new int[n.Length - w];\r\n\r\n var i := 0;\r\n assert IsWordSeq(n[..]);\r\n while i < r.Length\r\n invariant 0 <= i <= r.Length;\r\n invariant r[..i] == n[..i];\r\n invariant IsWordSeq(r[..i]);\r\n {\r\n r[i] := n[i];\r\n assert r[..i+1] == r[..i] + [r[i]];\r\n assert n[..i+1] == n[..i] + [n[i]];\r\n i := i + 1;\r\n }\r\n\r\n assert r[..] == n[..r.Length];\r\n Lemma_RemovingLastNWordsDividesBy2To32n(n[..], w);\r\n assert BEWordSeqToInt(r[..]) == BEWordSeqToInt(n[..]) / power2(32*w);\r\n}\r\n\r\nlemma Lemma_AnyDigitNonzeroMakesValueNonzero(s:seq, i:int)\r\n requires IsWordSeq(s);\r\n requires 0 <= i < |s|;\r\n requires s[i] != 0;\r\n ensures BEWordSeqToInt(s) != 0;\r\n decreases |s|;\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n if i == |s| - 1 {\r\n calc {\r\n BEWordSeqToInt_premium(s);\r\n BEWordSeqToInt_premium(s[0..|s|-1])*power2(32) + s[|s|-1];\r\n >= { lemma_mul_inequality(0, BEWordSeqToInt_premium(s[0..|s|-1]), power2(32)); lemma_mul_is_mul_boogie(0, power2(32)); }\r\n 0*power2(32) + s[|s|-1];\r\n s[|s|-1];\r\n > 0;\r\n }\r\n }\r\n else {\r\n Lemma_AnyDigitNonzeroMakesValueNonzero(s[0..|s|-1], i);\r\n calc {\r\n BEWordSeqToInt_premium(s);\r\n BEWordSeqToInt_premium(s[0..|s|-1])*power2(32) + s[|s|-1];\r\n > { lemma_mul_strict_inequality(0, BEWordSeqToInt_premium(s[0..|s|-1]), power2(32)); lemma_mul_is_mul_boogie(0, power2(32)); }\r\n 0*power2(32) + s[|s|-1];\r\n s[|s|-1];\r\n >= 0;\r\n }\r\n }\r\n}\r\n\r\nmethod IsFatNatZero(n:array) returns (b:bool)\r\n requires n != null;\r\n requires IsWordSeq(n[..]);\r\n ensures b == (BEWordSeqToInt(n[..]) == 0);\r\n{\r\n var i := 0;\r\n\r\n calc {\r\n BEWordSeqToInt(n[..0]);\r\n { assert n[..0] == []; }\r\n BEWordSeqToInt([]);\r\n { reveal_BEDigitSeqToInt_private(); }\r\n 0;\r\n }\r\n\r\n while i < n.Length\r\n invariant 0 <= i <= n.Length;\r\n invariant forall j :: 0 <= j < i ==> n[j] == 0;\r\n invariant BEWordSeqToInt(n[..i]) == 0;\r\n {\r\n if n[i] != 0 {\r\n b := false;\r\n Lemma_AnyDigitNonzeroMakesValueNonzero(n[..], i);\r\n return;\r\n }\r\n calc {\r\n BEWordSeqToInt(n[..i+1]);\r\n { assert |n[..i+1]| == i+1; assert n[..i+1][0..i] == n[..i]; reveal_BEDigitSeqToInt_private(); }\r\n BEWordSeqToInt(n[..i])*power2(32) + n[i];\r\n { lemma_mul_is_mul_boogie(0, power2(32)); }\r\n 0*power2(32) + n[i];\r\n n[i];\r\n 0;\r\n }\r\n i := i + 1;\r\n }\r\n\r\n b := true;\r\n assert n[..] == n[..i];\r\n}\r\n\r\nlemma Lemma_VerySpecificDivisionInequality(x:int, y:int, z:int)\r\n requires x >= 0;\r\n requires y > 0;\r\n requires z > 0;\r\n ensures (x * (y / z) / y) * z <= x;\r\n{\r\n var y_div_z := y / z;\r\n var y_mod_z := y % z;\r\n var w := x * y_div_z;\r\n var w_div_y := w / y;\r\n var w_mod_y := w % y;\r\n\r\n calc {\r\n x * y + z * w_mod_y + x * y_mod_z;\r\n >= { lemma_mod_properties(); lemma_mul_nonnegative(z, w_mod_y); lemma_mul_nonnegative(x, y_mod_z); }\r\n x * y;\r\n { lemma_fundamental_div_mod(y, z); }\r\n x * (z * y_div_z + y_mod_z);\r\n { lemma_mul_is_distributive_add(x, z * y_div_z, y_mod_z); }\r\n x * (z * y_div_z) + x * y_mod_z;\r\n }\r\n calc {\r\n x * y + z * w_mod_y;\r\n >= x * (z * y_div_z);\r\n { lemma_mul_is_commutative(z, y_div_z); }\r\n x * (y_div_z * z);\r\n { lemma_mul_is_associative(x, y_div_z, z); }\r\n (x * y_div_z) * z;\r\n w * z;\r\n { lemma_fundamental_div_mod(w, y); }\r\n (y * w_div_y + w_mod_y) * z;\r\n { lemma_mul_is_commutative(y * w_div_y + w_mod_y, z); }\r\n z * (y * w_div_y + w_mod_y);\r\n { lemma_mul_is_distributive_add(z, y * w_div_y, w_mod_y); }\r\n z * (y * w_div_y) + z * w_mod_y;\r\n }\r\n calc {\r\n x * y;\r\n >= z * (y * w_div_y);\r\n { lemma_mul_is_commutative(y, w_div_y); }\r\n z * (w_div_y * y);\r\n { lemma_mul_is_associative(z, w_div_y, y); }\r\n (z * w_div_y) * y;\r\n { lemma_mul_is_commutative(z, w_div_y); }\r\n (w_div_y * z) * y;\r\n }\r\n if x < w_div_y * z {\r\n lemma_mul_strict_inequality(x, w_div_y * z, y);\r\n }\r\n assert x >= w_div_y * z;\r\n}\r\n\r\nmethod FNDivision_Estimate_Q_Reciprocal(n:array, dv:array, reciprocal:FNDivReciprocal) returns (q:array)\r\n requires n!=null;\r\n requires IsWordSeq(n[..]);\r\n requires dv!=null;\r\n requires IsWordSeq(dv[..]);\r\n requires 1 < BEWordSeqToInt(dv[..]) <= BEWordSeqToInt(n[..]);\r\n requires reciprocal.FNDivKnownReciprocal?;\r\n requires FNDivReciprocalValid(reciprocal, dv);\r\n ensures q!=null;\r\n ensures IsWordSeq(q[..]);\r\n ensures 0 < BEWordSeqToInt(q[..])*BEWordSeqToInt(dv[..]);\r\n ensures BEWordSeqToInt(q[..])*BEWordSeqToInt(dv[..]) <= BEWordSeqToInt(n[..]);\r\n{\r\n ghost var g_x := BEWordSeqToInt(reciprocal.TwoTo32wDividedByD[..]);\r\n ghost var g_two_to_32w := power2(32 * reciprocal.w);\r\n ghost var g_dv := BEWordSeqToInt(dv[..]);\r\n ghost var w := reciprocal.w;\r\n ghost var g_y := g_two_to_32w - g_x * g_dv;\r\n ghost var g_n := BEWordSeqToInt(n[..]);\r\n ghost var g_nx := g_n * g_x;\r\n\r\n assert g_x == g_two_to_32w / g_dv;\r\n assert g_x * g_dv + g_y == g_two_to_32w;\r\n\r\n var nx := FleetNatMul(n, reciprocal.TwoTo32wDividedByD);\r\n\r\n assert BEWordSeqToInt(nx[..]) == g_nx;\r\n\r\n q := FNShiftRightByWords(nx, reciprocal.w);\r\n ghost var g_q := BEWordSeqToInt(q[..]);\r\n assert g_q == g_nx / power2(32*w);\r\n\r\n var q_is_zero := IsFatNatZero(q);\r\n if q_is_zero {\r\n lemma_2toX();\r\n q := MakeBELiteralArray(1);\r\n assert BEWordSeqToInt(q[..]) == 1;\r\n calc {\r\n BEWordSeqToInt_premium(q[..])*BEWordSeqToInt_premium(dv[..]);\r\n { lemma_mul_is_mul_boogie(1, BEWordSeqToInt_premium(dv[..])); }\r\n 1*BEWordSeqToInt_premium(dv[..]);\r\n <= BEWordSeqToInt_premium(n[..]);\r\n }\r\n }\r\n else {\r\n calc {\r\n BEWordSeqToInt_premium(q[..])*BEWordSeqToInt_premium(dv[..]);\r\n g_q * g_dv;\r\n (g_nx / power2(32*w)) * g_dv;\r\n (g_n * g_x / power2(32*w)) * g_dv;\r\n (g_n * (power2(32*w) / g_dv) / power2(32*w)) * g_dv;\r\n <= { Lemma_VerySpecificDivisionInequality(g_n, power2(32*w), g_dv); }\r\n g_n;\r\n }\r\n }\r\n\r\n calc {\r\n BEWordSeqToInt_premium(q[..])*BEWordSeqToInt_premium(dv[..]);\r\n >= { lemma_mul_inequality(1, BEWordSeqToInt_premium(q[..]), BEWordSeqToInt_premium(dv[..]));\r\n lemma_mul_is_mul_boogie(1, BEWordSeqToInt_premium(dv[..])); }\r\n 1*BEWordSeqToInt_premium(dv[..]);\r\n BEWordSeqToInt_premium(dv[..]);\r\n > 1;\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatSub.i.dfy", "content": "include \"FatNatCommon.i.dfy\"\r\n\r\npredicate FNSubRelation_local(pv:int, a:seq, b:seq, c:seq, carryin:seq, i:int)\r\n requires 1, b:seq, c:seq, carryin:seq)\r\n requires 1 FNSubRelation_local(pv, a, b, c, carryin, i)\r\n}\r\n\r\nlemma lemma_FNSubtraction_recursive(pv:int, a:seq, b:seq, c:seq, carryin:seq)\r\n requires 1, b:seq, c:seq, carryin:seq)\r\n requires 1, b:seq, c:seq, carryin:seq, j:int)\r\n requires 1= j;\r\n{\r\n forall i :: 0 <= i < j\r\n ==> FNSubRelation_local(pv, a, b, c[|c|-j..], carryin, i)\r\n}\r\n\r\nlemma lemma_SubRelationInduction(pv:int, a:seq, b:seq, c:seq, carryin:seq, j:int)\r\n requires 1, b:seq, oldc:seq, c:seq, oldcarryin:seq, carryin:seq, oldj:int, j:int, lastcarry:int)\r\n requires 1 DigitAt(c, i) == DigitAt(oldc, i);\r\n requires FNSubRelation_inductive(pv, a, b, oldc, oldcarryin, oldj);\r\n requires DigitAt(carryin,j) * pv + DigitAt(a,oldj)\r\n == DigitAt(b,oldj) + DigitAt(c,oldj) + DigitAt(oldcarryin,oldj);\r\n ensures IsDigitSeq(pv, c[|c|-j..]);\r\n ensures FNSubRelation_inductive(pv, a, b, c, [lastcarry]+oldcarryin, j);\r\n{\r\n assert 0 <= |c|-j < |c|;\r\n\r\n assert lastcarry == DigitAt(carryin, j);\r\n\r\n ghost var olda := a;\r\n ghost var oldb := b;\r\n ghost var newc := c[|c|-j..];\r\n forall (i | 0 <= i < j)\r\n ensures FNSubRelation_local(pv, a, b, newc, carryin, i);\r\n {\r\n if (i FNSubRelation_local(pv, a, b, newc, carryin, i);\r\n assert forall i :: 0 <= i < j\r\n ==> FNSubRelation_local(pv, a, b, c[|c|-j..], carryin, i);\r\n assert FNSubRelation_inductive(pv, a, b, c, carryin, j);\r\n}\r\n\r\n//- inner variant exposes the borrow\r\nmethod FNSubtract_inner(ghost pv:int, a:array, b:array) returns (c:array, ghost borrow:int)\r\n requires pv == power2(32);\r\n requires a!=null;\r\n requires b!=null;\r\n requires IsDigitSeq(pv, a[..]);\r\n requires IsDigitSeq(pv, b[..]);\r\n ensures c!=null;\r\n ensures IsDigitSeq(pv, c[..]);\r\n ensures c.Length <= a.Length || c.Length <= b.Length;\r\n ensures 0<=borrow;\r\n ensures borrow * power(pv,MaxLen3(a[..],b[..],c[..])) + BEDigitSeqToInt(pv,a[..])\r\n == BEDigitSeqToInt(pv,b[..]) + BEDigitSeqToInt(pv,c[..]);\r\n{\r\n lemma_2toX32();\r\n ghost var carryin:seq := [0];\r\n var iml := (if a.Length > b.Length then a.Length else b.Length);\r\n var oml := iml;\r\n c := new int[oml];\r\n assert oml == MaxLen3(a[..],b[..],c[..]);\r\n var lastcarry := 0;\r\n var j:=0;\r\n while (j < oml)\r\n invariant 0 <= j <= oml;\r\n invariant IsBitSeq(carryin);\r\n invariant lastcarry == DigitAt(carryin, j);\r\n invariant DigitAt(carryin, 0) == 0;\r\n invariant IsDigitSeq(pv, c[c.Length-j..]);\r\n invariant |carryin| == j+1;\r\n invariant FNSubRelation_inductive(pv, a[..], b[..], c[..], carryin, j);\r\n {\r\n ghost var olda := a[..];\r\n ghost var oldb := b[..];\r\n ghost var oldc := c[..];\r\n ghost var oldcarryin := carryin[..];\r\n ghost var oldj := j;\r\n assert FNSubRelation_inductive(pv, olda, oldb, oldc, oldcarryin, oldj);\r\n\r\n var difference,carry := Sub32_with_borrow(\r\n ArrayDigitAt_sub(a,j), ArrayDigitAt_sub(b,j), lastcarry);\r\n assert c[..] == oldc; //- OBSERVE\r\n\r\n carryin := [carry] + carryin;\r\n lastcarry := carry;\r\n c[c.Length - 1 - j] := difference;\r\n\r\n assert c[c.Length-1-j..] == [c[c.Length-1-j]] + c[c.Length-j..]; //- OBSERVE\r\n\r\n j:=j+1;\r\n assert olda==a[..];\r\n assert oldb==b[..];\r\n lemma_FNSubtraction_induction(pv, oml, a[..], b[..], oldc, c[..], oldcarryin, carryin, oldj, j, lastcarry);\r\n }\r\n\r\n assert c[..] == c[c.Length-oml..]; //- OBSERVE\r\n\r\n lemma_SubRelationInduction(pv, a[..], b[..], c[..], carryin, oml);\r\n\r\n assert DigitAt(carryin,0)==0;\r\n borrow := DigitAt(carryin,oml);\r\n calc {\r\n borrow * power(pv,MaxLen3(a[..],b[..],c[..])) + BEDigitSeqToInt(pv,a[..]);\r\n DigitAt(carryin,oml) * power(pv,oml) + BEDigitSeqToInt(pv,a[..]);\r\n { lemma_FNSubtraction(pv, a[..], b[..], c[..], carryin); }\r\n BEDigitSeqToInt(pv,b[..]) + BEDigitSeqToInt(pv,c[..]) + DigitAt(carryin,0);\r\n BEDigitSeqToInt(pv,b[..]) + BEDigitSeqToInt(pv,c[..]);\r\n }\r\n}\r\n\r\nmethod FatNatSub(a:array, b:array) returns (c:array)\r\n requires a!=null;\r\n requires b!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n requires IsDigitSeq(power2(32), b[..]);\r\n requires BEDigitSeqToInt(power2(32), a[..]) >= BEDigitSeqToInt(power2(32), b[..]);\r\n ensures c!=null;\r\n ensures IsDigitSeq(power2(32), c[..]);\r\n ensures c.Length <= a.Length || c.Length <= b.Length;\r\n ensures BEDigitSeqToInt(power2(32),a[..])\r\n == BEDigitSeqToInt(power2(32),b[..]) + BEDigitSeqToInt(power2(32),c[..]);\r\n{\r\n ghost var As := a[..];\r\n ghost var Bs := b[..];\r\n\r\n lemma_mul_basics_forall();\r\n ghost var borrow;\r\n c,borrow := FNSubtract_inner(power2(32), a, b);\r\n if (borrow > 0)\r\n {\r\n ghost var pv := power2(32);\r\n calc {\r\n BEDigitSeqToInt(pv,c[..]);\r\n < { lemma_BEDigitSeqToInt_bound(pv, c[..]); }\r\n power(pv,|c[..]|);\r\n <= { lemma_power_increases(pv, |c[..]|, MaxLen3(a[..],b[..],c[..])); }\r\n power(pv,MaxLen3(a[..],b[..],c[..]));\r\n }\r\n calc {\r\n BEDigitSeqToInt(pv,a[..]);\r\n <\r\n power(pv,MaxLen3(a[..],b[..],c[..])) + BEDigitSeqToInt(pv,a[..])\r\n - BEDigitSeqToInt(pv,c[..]);\r\n { lemma_mul_basics_forall(); }\r\n mul(1, power(pv,MaxLen3(a[..],b[..],c[..]))) + BEDigitSeqToInt(pv,a[..])\r\n - BEDigitSeqToInt(pv,c[..]);\r\n <= {\r\n lemma_power_positive(pv, MaxLen3(a[..],b[..],c[..]));\r\n lemma_mul_inequality(1, borrow, power(pv,MaxLen3(a[..],b[..],c[..]))); }\r\n borrow * power(pv,MaxLen3(a[..],b[..],c[..])) + BEDigitSeqToInt(pv,a[..])\r\n - BEDigitSeqToInt(pv,c[..]);\r\n BEDigitSeqToInt(pv,b[..]);\r\n }\r\n assert false;\r\n }\r\n assert borrow == 0;\r\n ghost var pv := power2(32);\r\n calc {\r\n BEDigitSeqToInt(power2(32),a[..]);\r\n { lemma_mul_basics(power(pv,MaxLen3(a[..],b[..],c[..]))); }\r\n borrow * power(pv,MaxLen3(a[..],b[..],c[..])) + BEDigitSeqToInt(pv,a[..]);\r\n BEDigitSeqToInt(power2(32),b[..]) + BEDigitSeqToInt(power2(32),c[..]);\r\n BEDigitSeqToInt(pv,b[..]) + BEDigitSeqToInt(pv,c[..]);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatX86.i.dfy", "content": "include \"FatNatCommon.i.dfy\"\r\ninclude \"../BigNum/BigNatX86Shim.i.dfy\"\r\n//-include \"FatNatX86big.i.dfy\"\r\n\r\nmethod {:decl} Add32_unrolled_8(\r\n a:array, ai:int,\r\n b:array, bi:int,\r\n s:array, si:int,\r\n c_in:int)\r\n returns (c_out:int, ghost carries:seq)\r\n requires a!=null;\r\n requires IsWordSeq(a[..]);\r\n requires 0 <= ai;\r\n requires ai+8 <= a.Length;\r\n requires b!=null;\r\n requires IsWordSeq(b[..]);\r\n requires 0 <= bi;\r\n requires bi+8 <= b.Length;\r\n requires s!=null;\r\n requires 0 <= si;\r\n requires si+8 <= s.Length;\r\n requires 0<=c_in<=1;\r\n requires b!=s;\r\n requires a!=s;\r\n modifies s;\r\n ensures forall i :: 0<=i s[s.Length-1-i]==old(s[s.Length-1-i]);\r\n ensures 0<=c_out<=1;\r\n ensures |carries| == 9;\r\n ensures carries[0] == c_in;\r\n ensures carries[8] == c_out;\r\n ensures forall i :: 0<=i<8 ==> carries[i+1] == \r\n if a[a.Length-1-(ai+i)] +b[b.Length-1-(bi+i)] + carries[i] >= 0x100000000 then 1 else 0;\r\n ensures forall i {:trigger s[FatNatAddIndex(s.Length, si, i)]} :: 0<=i<8 ==> s[FatNatAddIndex(s.Length, si, i)] == \r\n mod0x100000000(a[FatNatAddIndex(a.Length, ai,i)] +b[FatNatAddIndex(b.Length, bi, i)] + carries[i]);\r\n\r\n\r\nmethod {:decl} Add32_unrolled_16(\r\n a:array, ai:int,\r\n b:array, bi:int,\r\n s:array, si:int,\r\n c_in:int)\r\n returns (c_out:int, ghost carries:seq)\r\n requires a!=null;\r\n requires IsWordSeq(a[..]);\r\n requires 0 <= ai;\r\n requires ai+16 <= a.Length;\r\n requires b!=null;\r\n requires IsWordSeq(b[..]);\r\n requires 0 <= bi;\r\n requires bi+16 <= b.Length;\r\n requires s!=null;\r\n requires 0 <= si;\r\n requires si+16 <= s.Length;\r\n requires 0<=c_in<=1;\r\n requires b!=s;\r\n requires a!=s;\r\n modifies s;\r\n ensures forall i :: 0<=i s[s.Length-1-i]==old(s[s.Length-1-i]);\r\n ensures 0<=c_out<=1;\r\n ensures |carries| == 17;\r\n ensures carries[0] == c_in;\r\n ensures carries[16] == c_out;\r\n\r\n ensures forall i {:trigger a[FatNatAddIndex(a.Length, ai, i)]} :: 0<=i<16 ==> carries[i+1] == \r\n if a[FatNatAddIndex(a.Length,ai,i)] +b[FatNatAddIndex(b.Length,bi,i)] + carries[i] >= 0x100000000 then 1 else 0;\r\n ensures forall i {:trigger s[FatNatAddIndex(s.Length, si, i)]} :: 0<=i<16 ==> s[FatNatAddIndex(s.Length, si, i)] == \r\n mod0x100000000(a[FatNatAddIndex(a.Length, ai,i)] +b[FatNatAddIndex(b.Length, bi, i)] + carries[i]);\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/FatNatX86big.i.dfy", "content": "include \"FatNatCommon.i.dfy\"\r\ninclude \"../BigNum/BigNatX86Shim.i.dfy\"\r\n\r\n/*\r\nmethod {:decl} Add32_unrolled_32(\r\n a:array, ai:int,\r\n b:array, bi:int,\r\n s:array, si:int,\r\n c_in:int)\r\n returns (c_out:int, ghost carries:seq)\r\n requires a!=null;\r\n requires IsWordSeq(a[..]);\r\n requires 0 <= ai;\r\n requires ai+32 <= a.Length;\r\n requires b!=null;\r\n requires IsWordSeq(b[..]);\r\n requires 0 <= bi;\r\n requires bi+32 <= b.Length;\r\n requires s!=null;\r\n requires 0 <= si;\r\n requires si+32 <= s.Length;\r\n requires 0<=c_in<=1;\r\n requires b!=s;\r\n requires a!=s;\r\n modifies s;\r\n ensures forall i :: 0<=i s[s.Length-1-i]==old(s[s.Length-1-i]);\r\n ensures 0<=c_out<=1;\r\n ensures |carries| == 33;\r\n ensures carries[0] == c_in;\r\n ensures carries[32] == c_out;\r\n //- This line will go through in 347s\r\n ensures forall i {:trigger a[FatNatAddIndex(a.Length, ai, i)]} :: 0<=i<32 ==> carries[i+1] == \r\n if a[FatNatAddIndex(a.Length,ai,i)] +b[FatNatAddIndex(b.Length,bi,i)] + carries[i] >= 0x100000000 then 1 else 0;\r\n //- This line times out after 687s\r\n ensures forall i {:trigger s[FatNatAddIndex(s.Length, si, i)]} :: 0<=i<32 ==> s[FatNatAddIndex(s.Length, si, i)] == \r\n mod0x100000000(a[FatNatAddIndex(a.Length, ai,i)] +b[FatNatAddIndex(b.Length, bi, i)] + carries[i]);\r\n*/\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FatNat/Transforms.i.dfy", "content": "include \"../Util/arrays_and_seqs.i.dfy\"\r\ninclude \"CanonicalArrays.i.dfy\"\r\n\r\nmethod BEWordArrayToByteArray(M:array) returns (m:array)\r\n requires M!=null;\r\n requires IsWordSeq(M[..]);\r\n ensures m!=null;\r\n ensures IsByteSeq(m[..]);\r\n ensures BEByteSeqToInt(m[..]) == BEWordSeqToInt(M[..]);\r\n//- ensures BEIntToByteSeq(I(M)) == m; //- no seq relation equivalence\r\n ensures m.Length==0 || 0) returns (M:array)\r\n requires m!=null;\r\n requires IsByteSeq(m[..]);\r\n ensures M!=null;\r\n ensures IsWordSeq(M[..]);\r\n ensures BEByteSeqToInt(m[..]) == BEWordSeqToInt(M[..]);\r\n//- ensures BEIntToByteSeq(I(M)) == m; //- no seq relation equivalence\r\n ensures M.Length==0 || 0, lastcs:seq, bs:seq, bdigits:int, cs:seq, lastj:int, j:int, lastborrow:int, borrow:int)\r\n requires 1<=j<=bdigits<=|oldcs|==|lastcs|==|cs|;\r\n requires bdigits <= |bs|;\r\n requires lastj+1 == j;\r\n requires 0<=lastborrow<2;\r\n requires 0<=borrow<2;\r\n requires pv==power2(32)==0x100000000;\r\n requires IsDigitSeq(power2(32), oldcs);\r\n requires IsDigitSeq(power2(32), bs);\r\n requires IsDigitSeq(power2(32), cs);\r\n requires IsDigitSeq(power2(32), lastcs);\r\n requires BEWordSeqToInt(oldcs) - BEWordSeqToInt(bs) ==\r\n ( BEWordSeqToInt(SelectDigitRange(lastcs, |lastcs|, lastj))\r\n + lastborrow\r\n - BEWordSeqToInt(SelectDigitRange(bs, bdigits, lastj)) ) * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, lastj, 0));\r\n ensures IsDigitSeq(power2(32), cs);\r\n ensures BEWordSeqToInt(oldcs) - BEWordSeqToInt(bs) ==\r\n ( BEWordSeqToInt(SelectDigitRange(cs, |cs|, j))\r\n + borrow\r\n - BEWordSeqToInt(SelectDigitRange(bs, bdigits, j)) ) * power(pv,j)\r\n + BEWordSeqToInt(SelectDigitRange(cs, j, 0));\r\n{\r\n assume false;\r\n}\r\n\r\nlemma lemma_FleetNatSub_c_adequate_length(cs:seq, bs:seq, bdigits:int)\r\n requires IsWordSeq(cs);\r\n requires IsWordSeq(bs);\r\n requires BEWordSeqToInt(bs) <= BEWordSeqToInt(cs);\r\n requires (BEWordSeqToInt(bs)==0 && bdigits==0)\r\n || (0, b:array)\r\n //- always in-place because c always has enough room!\r\n requires b!=null;\r\n requires IsWordSeq(b[..]);\r\n requires c!=null;\r\n requires IsWordSeq(c[..]);\r\n requires c!=b;\r\n requires BEWordSeqToInt(b[..]) <= BEWordSeqToInt(c[..]);\r\n modifies c;\r\n ensures IsWordSeq(c[..]);\r\n ensures BEWordSeqToInt(old(c[..])) - BEWordSeqToInt(b[..]) == BEWordSeqToInt(c[..]);\r\n{\r\n ghost var pv := power2(32); lemma_2toX();\r\n\r\n var bdigits := CountNonzeroDigits(b);\r\n\r\n lemma_FleetNatSub_c_adequate_length(c[..], b[..], bdigits);\r\n\r\n var borrow := 0;\r\n var blenm1 := b.Length - 1;\r\n var clenm1 := c.Length - 1;\r\n var j:=0;\r\n\r\n //- bridge from preconditions to subtract loop invariant\r\n calc {\r\n BEWordSeqToInt(old(c[..])) - BEWordSeqToInt(b[..]);\r\n { lemma_power_0(pv); }\r\n ( BEWordSeqToInt(c[..]) - BEWordSeqToInt(b[..]) ) * power(pv,j);\r\n {\r\n assert SelectDigitRange(c[..], c.Length, j) == c[..]; //- OBSERVE SEQ\r\n }\r\n ( BEWordSeqToInt(SelectDigitRange(c[..], c.Length, j))\r\n + borrow\r\n - BEWordSeqToInt(SelectDigitRange(b[..], bdigits, j)) ) * power(pv,j);\r\n {\r\n assert SelectDigitRange(c[..], j, 0)==[]; //- OBSERVE SEQ\r\n reveal_BEDigitSeqToInt_private();\r\n }\r\n ( BEWordSeqToInt(SelectDigitRange(c[..], c.Length, j))\r\n + borrow\r\n - BEWordSeqToInt(SelectDigitRange(b[..], bdigits, j)) ) * power(pv,j)\r\n + BEWordSeqToInt(SelectDigitRange(c[..], j, 0));\r\n }\r\n\r\n var C, B;\r\n assume C - B == borrow; \r\n\r\n while (j, bdigits:int, lastcs:seq, oldcs:seq, newcs:seq, j:int, oldj:int, lastcarry:int, prevcarry:int)\r\n requires pv==power2(32);\r\n requires 0 <= bdigits <= |bs|;\r\n requires bdigits <= |lastcs| == |oldcs| == |newcs|;\r\n requires 1<=j<=bdigits;\r\n requires oldj+1 == j;\r\n requires IsDigitSeq(pv, bs);\r\n requires IsDigitSeq(pv, SelectDigitRange(bs, j, oldj));\r\n requires IsDigitSeq(pv, SelectDigitRange(lastcs, oldj, 0));\r\n requires IsDigitSeq(pv, oldcs);\r\n requires IsDigitSeq(pv, SelectDigitRange(newcs, j, 0));\r\n requires IsDigitSeq(pv, SelectDigitRange(newcs, oldj, 0));\r\n requires IsDigitSeq(pv, SelectDigitRange(newcs, j, oldj));\r\n //- things right of oldj are stable\r\n requires SelectDigitRange(lastcs, oldj, 0) == SelectDigitRange(newcs, oldj, 0);\r\n //- local step math result\r\n requires BEWordSeqToInt(SelectDigitRange(bs, j, oldj)) + BEWordSeqToInt(SelectDigitRange(oldcs, j, oldj)) + prevcarry\r\n == BEWordSeqToInt(SelectDigitRange(newcs, j, oldj)) + pv * lastcarry;\r\n //- induction hypothesis loop invariant\r\n requires BEWordSeqToInt(SelectDigitRange(bs, oldj, 0)) + BEWordSeqToInt(SelectDigitRange(oldcs, oldj, 0))\r\n == BEWordSeqToInt(SelectDigitRange(lastcs, oldj, 0)) + prevcarry * power(pv, oldj);\r\n ensures BEWordSeqToInt(SelectDigitRange(bs, j, 0))\r\n + BEWordSeqToInt(SelectDigitRange(oldcs, j, 0))\r\n == BEWordSeqToInt(SelectDigitRange(newcs, j, 0)) + lastcarry * power(pv, j);\r\n{\r\n lemma_2toX32();\r\n calc {\r\n BEWordSeqToInt(SelectDigitRange(bs, j, 0))\r\n + BEWordSeqToInt(SelectDigitRange(oldcs, j, 0));\r\n { lemma_BEInterpretation_Select_general(pv, bs, j, oldj, 0); }\r\n BEWordSeqToInt(SelectDigitRange(bs, j, oldj))*power(pv,oldj) + BEWordSeqToInt(SelectDigitRange(bs, oldj, 0))\r\n + BEWordSeqToInt(SelectDigitRange(oldcs, j, 0));\r\n { lemma_BEInterpretation_Select_general(pv, oldcs, j, oldj, 0); }\r\n BEWordSeqToInt(SelectDigitRange(bs, j, oldj))*power(pv,oldj) + BEWordSeqToInt(SelectDigitRange(bs, oldj, 0))\r\n + BEWordSeqToInt(SelectDigitRange(oldcs, j, oldj))*power(pv,oldj) + BEWordSeqToInt(SelectDigitRange(oldcs, oldj, 0));\r\n { lemma_mul_is_distributive_forall(); }\r\n (BEWordSeqToInt(SelectDigitRange(bs, j, oldj)) + BEWordSeqToInt(SelectDigitRange(oldcs, j, oldj)))\r\n *power(pv,oldj)\r\n + BEWordSeqToInt(SelectDigitRange(bs, oldj, 0)) + BEWordSeqToInt(SelectDigitRange(oldcs, oldj, 0));\r\n //- induction hypothesis loop invariant transforms last lines of expressions\r\n (BEWordSeqToInt(SelectDigitRange(bs, j, oldj)) + BEWordSeqToInt(SelectDigitRange(oldcs, j, oldj)))\r\n *power(pv,oldj)\r\n + BEWordSeqToInt(SelectDigitRange(bs, oldj, 0)) + BEWordSeqToInt(SelectDigitRange(oldcs, oldj, 0));\r\n { lemma_mul_is_distributive_forall(); }\r\n (BEWordSeqToInt(SelectDigitRange(bs, j, oldj)) + BEWordSeqToInt(SelectDigitRange(oldcs, j, oldj))\r\n +prevcarry)\r\n *power(pv,oldj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, oldj, 0));\r\n //- by local math step\r\n (BEWordSeqToInt(SelectDigitRange(newcs, j, oldj)) + pv * lastcarry)*power(pv, oldj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, oldj, 0));\r\n (BEWordSeqToInt(SelectDigitRange(newcs, j, oldj)) + pv * lastcarry)*power(pv, oldj)\r\n + BEWordSeqToInt(SelectDigitRange(newcs, oldj, 0));\r\n { lemma_mul_is_distributive_forall(); }\r\n BEWordSeqToInt(SelectDigitRange(newcs, j, oldj))*power(pv, oldj) + (pv * lastcarry)*power(pv, oldj)\r\n + BEWordSeqToInt(SelectDigitRange(newcs, oldj, 0));\r\n { lemma_mul_is_associative_forall(); }\r\n BEWordSeqToInt(SelectDigitRange(newcs, j, oldj))*power(pv, oldj) + lastcarry*(pv*power(pv, oldj))\r\n + BEWordSeqToInt(SelectDigitRange(newcs, oldj, 0));\r\n { lemma_power_1(pv); lemma_power_adds(pv,1,oldj); }\r\n BEWordSeqToInt(SelectDigitRange(newcs, j, oldj))*power(pv, oldj) + lastcarry*power(pv, j)\r\n + BEWordSeqToInt(SelectDigitRange(newcs, oldj, 0));\r\n { lemma_BEInterpretation_Select_general(pv, newcs, j, oldj, 0); }\r\n BEWordSeqToInt(SelectDigitRange(newcs, j, 0)) + lastcarry * power(pv, j);\r\n }\r\n}\r\n\r\nmethod FleetNatAddSimple(c:array, b:array, bdigits:int) returns (carry:int)\r\n requires c!=null;\r\n requires b!=null;\r\n requires c!=b;\r\n requires IsDigitSeq(power2(32), c[..]);\r\n requires IsDigitSeq(power2(32), b[..]);\r\n requires 0<=bdigits<=b.Length;\r\n requires bdigits <= c.Length;\r\n modifies c;\r\n ensures c!=null;\r\n ensures c==old(c);\r\n ensures IsDigitSeq(power2(32), c[..]);\r\n//- ensures BEWordSeqToInt(old(c[c.Length-bdigits..])) + BEWordSeqToInt(b[b.Length-bdigits..])\r\n//- == BEWordSeqToInt(c[c.Length-bdigits..]) + power(power2(32), bdigits)*carry;\r\n ensures 0<=carry<2;\r\n ensures BEWordSeqToInt(old(c[..])) + BEWordSeqToInt(b[b.Length-bdigits..])\r\n == BEWordSeqToInt(c[..]) + power(power2(32), bdigits)*carry;\r\n{\r\n ghost var pv := power2(32);\r\n lemma_2toX32();\r\n ghost var bs := b[..];\r\n ghost var oldcs := c[..];\r\n ghost var clen := c.Length;\r\n\r\n var lastcarry:int := 0;\r\n var j:=0;\r\n\r\n calc {\r\n BEWordSeqToInt(SelectDigitRange(bs, j, 0)) + BEWordSeqToInt(SelectDigitRange(oldcs, j, 0));\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEWordSeqToInt(SelectDigitRange(c[..], j, 0)) + lastcarry * power(pv, j);\r\n }\r\n\r\n var clenm1 := c.Length - 1;\r\n var blenm1 := b.Length - 1;\r\n while (j, place:nat, carry:int) returns (c':array)\r\n requires c!=null;\r\n requires IsDigitSeq(power2(32), c[..]);\r\n requires 0<=place<=c.Length;\r\n requires 0<=carry, a:array, b:array) returns (c':array)\r\n requires a!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n requires b!=null;\r\n requires IsDigitSeq(power2(32), b[..]);\r\n requires c!=null;\r\n requires IsDigitSeq(power2(32), c[..]);\r\n requires c!=b;\r\n requires c!=a; \r\n modifies c;\r\n ensures c'!=null;\r\n ensures c'==c || fresh(c');\r\n ensures IsDigitSeq(power2(32), c'[..]);\r\n ensures BEWordSeqToInt(old(a[..])) + BEWordSeqToInt(b[..]) == BEWordSeqToInt(c'[..]);\r\n{\r\n lemma_2toX();\r\n\r\n var bdigits := CountNonzeroDigits(b);\r\n\r\n//- RevealAbssValue();\r\n//- if (c!=a)\r\n//- {\r\n//- assert c!=a;\r\n \r\n c' := FleetCopy(c, a, bdigits);\r\n assert BEWordSeqToInt(old(a[..])) == BEWordSeqToInt(c'[..]);\r\n//- }\r\n//- else if (c.Length, b:array) returns (c:array)\r\n requires a!=null;\r\n requires b!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n requires IsDigitSeq(power2(32), b[..]);\r\n ensures c!=null;\r\n ensures IsDigitSeq(power2(32), c[..]);\r\n ensures BEWordSeqToInt(a[..]) + BEWordSeqToInt(b[..]) == BEWordSeqToInt(c[..]);\r\n{\r\n c := FleetAlloc(a.Length); //- could just be c:=null, but DafnyCC doesn't allow it yet\r\n \r\n assert c!=a; \r\n c := FleetNatAdd(c, a, b);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FleetNat/FleetNatCommon.i.dfy", "content": "include \"../Util/seqs_and_ints.i.dfy\"\r\ninclude \"../Util/seqs_common.i.dfy\"\r\ninclude \"../FatNat/FatNatCommon.i.dfy\"\r\ninclude \"../FatNat/CanonicalArrays.i.dfy\"\r\n\r\n//- dafnycc was having a hard time stringing these together.\r\nlemma lemma_FasterCopyArray_helper(dst:array, doff:int, rdi:int, src:array, soff:int, rsi:int)\r\n requires dst!=null;\r\n requires src!=null;\r\n requires 0<=doff, doff:nat, src:array, soff:nat, count:nat)\r\n requires src!=null;\r\n requires soff+count <= src.Length;\r\n requires dst!=null;\r\n requires doff+count <= dst.Length;\r\n requires src!=dst;\r\n modifies dst;\r\n ensures dst[doff..doff+count] == src[soff..soff+count];\r\n ensures dst[..doff] == old(dst[..doff]);\r\n ensures dst[doff+count..] == old(dst[doff+count..]);\r\n{\r\n var rdi := doff;\r\n var rsi := soff;\r\n var rcount := count;\r\n while (rcount>8)\r\n invariant 0<=rcount<=count;\r\n invariant rdi + rcount == doff + count;\r\n invariant rsi + rcount == soff + count;\r\n invariant dst[doff..rdi] == src[soff..rsi];\r\n invariant dst[..doff] == old(dst[..doff]);\r\n invariant dst[doff+count..] == old(dst[doff+count..]);\r\n {\r\n assert dst[doff..rdi] == src[soff..rsi];\r\n dst[rdi] := src[rsi]; rdi:=rdi+1; rsi:=rsi+1;\r\n lemma_FasterCopyArray_helper(dst, doff, rdi, src, soff, rsi);\r\n\r\n assert dst[doff..rdi] == src[soff..rsi];\r\n dst[rdi] := src[rsi]; rdi:=rdi+1; rsi:=rsi+1;\r\n lemma_FasterCopyArray_helper(dst, doff, rdi, src, soff, rsi);\r\n\r\n assert dst[doff..rdi] == src[soff..rsi];\r\n dst[rdi] := src[rsi]; rdi:=rdi+1; rsi:=rsi+1;\r\n lemma_FasterCopyArray_helper(dst, doff, rdi, src, soff, rsi);\r\n\r\n assert dst[doff..rdi] == src[soff..rsi];\r\n dst[rdi] := src[rsi]; rdi:=rdi+1; rsi:=rsi+1;\r\n lemma_FasterCopyArray_helper(dst, doff, rdi, src, soff, rsi);\r\n\r\n assert dst[doff..rdi] == src[soff..rsi];\r\n dst[rdi] := src[rsi]; rdi:=rdi+1; rsi:=rsi+1;\r\n lemma_FasterCopyArray_helper(dst, doff, rdi, src, soff, rsi);\r\n\r\n assert dst[doff..rdi] == src[soff..rsi];\r\n dst[rdi] := src[rsi]; rdi:=rdi+1; rsi:=rsi+1;\r\n lemma_FasterCopyArray_helper(dst, doff, rdi, src, soff, rsi);\r\n\r\n assert dst[doff..rdi] == src[soff..rsi];\r\n dst[rdi] := src[rsi]; rdi:=rdi+1; rsi:=rsi+1;\r\n lemma_FasterCopyArray_helper(dst, doff, rdi, src, soff, rsi);\r\n\r\n assert dst[doff..rdi] == src[soff..rsi];\r\n dst[rdi] := src[rsi]; rdi:=rdi+1; rsi:=rsi+1;\r\n lemma_FasterCopyArray_helper(dst, doff, rdi, src, soff, rsi);\r\n\r\n assert dst[doff..rdi] == src[soff..rsi];\r\n rcount := rcount - 8;\r\n }\r\n\r\n while (rcount>0)\r\n invariant 0<=rcount<=count;\r\n invariant rdi + rcount == doff + count;\r\n invariant rsi + rcount == soff + count;\r\n invariant dst[doff..rdi] == src[soff..rsi];\r\n invariant dst[..doff] == old(dst[..doff]);\r\n invariant dst[doff+count..] == old(dst[doff+count..]);\r\n {\r\n dst[rdi] := src[rsi]; rdi:=rdi+1; rsi:=rsi+1;\r\n rcount := rcount - 1;\r\n lemma_FasterCopyArray_helper(dst, doff, rdi, src, soff, rsi);\r\n assert dst[doff..rdi] == src[soff..rsi];\r\n }\r\n}\r\n\r\nmethod CountNonzeroDigits(c:array) returns (digits:int)\r\n requires c!=null;\r\n ensures 0<=digits<=c.Length;\r\n ensures forall i :: 0<=i c[i]==0;\r\n requires IsWordSeq(c[..]);\r\n ensures BEWordSeqToInt(c[..]) == BEWordSeqToInt(SelectDigitRange(c[..], digits, 0));\r\n ensures BEWordSeqToInt(c[..]) < power(power2(32), digits);\r\n ensures (BEWordSeqToInt(c[..])==0 && digits==0)\r\n || (0 c[i]==0;\r\n {\r\n zeros := zeros + 1;\r\n }\r\n digits := c.Length - zeros;\r\n\r\n lemma_2toX();\r\n lemma_LeadingZeros(power2(32), SelectDigitRange(c[..], digits, 0), c[..]);\r\n lemma_BEDigitSeqToInt_bound(power2(32), SelectDigitRange(c[..], digits, 0));\r\n if (digits==0)\r\n {\r\n reveal_BEDigitSeqToInt_private();\r\n assert BEWordSeqToInt(c[..])==0;\r\n } else {\r\n lemma_power_positive(power2(32), digits-1);\r\n lemma_mul_inequality(1, SelectDigitRange(c[..], digits, 0)[0], power(power2(32), digits-1));\r\n }\r\n}\r\n\r\nmethod FleetCopy_copy_step(c:array, a:array, adigits:int)\r\n requires a!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n requires a!=c;\r\n requires c!=null;\r\n requires adigits <= c.Length;\r\n requires 0<=adigits<=a.Length;\r\n modifies c;\r\n ensures adigits<=c.Length;\r\n ensures c[c.Length-adigits..]==a[a.Length-adigits..];\r\n ensures IsDigitSeq(power2(32), c[c.Length-adigits..]);\r\n{\r\n var alen := a.Length;\r\n var clen := c.Length;\r\n var cz:=clen-adigits;\r\n var ai:=alen-adigits;\r\n var ci:=cz;\r\n ghost var az := alen-adigits;\r\n while (ai, adigits:int)\r\n requires c!=null;\r\n requires 0 <= adigits <= c.Length;\r\n modifies c;\r\n ensures forall i :: 0<=i c[i]==0;\r\n ensures c[c.Length-adigits..] == old(c[c.Length-adigits..]);\r\n{\r\n var cz:=c.Length-adigits;\r\n\r\n var ci:=0;\r\n while (ci c[j]==0;\r\n {\r\n c[ci] := 0;\r\n ci:=ci+1;\r\n }\r\n}\r\n\r\nlemma lemma_FleetCopy_IsDigitSeq(asq:seq, is:seq, cs:seq, adigits:int)\r\n requires IsDigitSeq(power2(32), asq);\r\n requires 0<=adigits<=|asq|;\r\n requires adigits<=|is|;\r\n requires forall i :: 0<=i<|asq|-adigits ==> asq[i]==0;\r\n requires is[|is|-adigits..]==asq[|asq|-adigits..];\r\n requires IsDigitSeq(power2(32), is[|is|-adigits..]);\r\n requires |is|<=|cs|;\r\n requires forall i :: 0<=i<|cs|-adigits ==> cs[i]==0;\r\n requires cs[|cs|-adigits..] == is[|is|-adigits..];\r\n ensures IsDigitSeq(power2(32), cs);\r\n ensures BEDigitSeqToInt(power2(32), asq) == BEDigitSeqToInt(power2(32), cs);\r\n{\r\n ghost var pv := power2(32);\r\n lemma_2toX();\r\n ghost var az := |asq| - adigits;\r\n ghost var cz := |cs| - adigits;\r\n forall (i | 0<=i<|cs|)\r\n ensures 0<=cs[i]=cz)\r\n {\r\n calc {\r\n cs[i];\r\n cs[cz..][i-cz];\r\n asq[az..][i-cz];\r\n asq[i-cz+az];\r\n asq[i-|cs|+adigits+|asq|-adigits];\r\n asq[i-|cs|+|asq|];\r\n }\r\n }\r\n }\r\n ghost var azeros := |asq|-adigits;\r\n ghost var shorta := asq[azeros..];\r\n lemma_LeadingZeros(power2(32), shorta, cs[..]);\r\n lemma_LeadingZeros(power2(32), shorta, asq[..]);\r\n}\r\n\r\n//- mimics polar's mpi_copy\r\n\r\n\r\n\r\n\r\n\r\nmethod FleetCopy(c:array, a:array, minlen:nat) returns (c':array)\r\n requires a!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n requires a!=c;\r\n requires c != null; \r\n modifies c;\r\n ensures c'!=null;\r\n ensures c'==c || fresh(c');\r\n ensures minlen <= c'.Length;\r\n ensures IsDigitSeq(power2(32), c'[..]);\r\n ensures BEDigitSeqToInt(power2(32), c'[..]) == BEDigitSeqToInt(power2(32), a[..]);\r\n{\r\n var alen := a.Length;\r\n if (/*c!=null &&*/ alen==c.Length && minlen<=c.Length) //- Fastpath\r\n {\r\n FasterCopyArray(c,0,a,0,alen);\r\n c':=c;\r\n calc { //- OBSERVE SEQ\r\n c'[..];\r\n c[..];\r\n c[0..alen];\r\n a[0..alen];\r\n a[..];\r\n }\r\n return;\r\n }\r\n\r\n ghost var pv := power2(32);\r\n lemma_2toX();\r\n var adigits:int := CountNonzeroDigits(a);\r\n\r\n var mindigits := adigits;\r\n if (mindigits < minlen)\r\n {\r\n mindigits := minlen;\r\n }\r\n if (/*c==null ||*/ c.Length < mindigits)\r\n {\r\n c' := new int[mindigits];\r\n }\r\n else\r\n {\r\n c' := c;\r\n }\r\n ghost var c'len := c'.Length;\r\n assert adigits<=c'len;\r\n\r\n ghost var asq := a[..];\r\n FleetCopy_copy_step(c', a, adigits);\r\n ghost var is := c'[..];\r\n FleetCopy_zero_step(c', adigits);\r\n\r\n lemma_FleetCopy_IsDigitSeq(asq, is, c'[..], adigits);\r\n}\r\n\r\nmethod FleetGrow(c:array, minlen:nat) returns (c':array)\r\n requires c!=null;\r\n requires IsDigitSeq(power2(32), c[..]);\r\n requires c.Length < minlen; //- else why call me?\r\n ensures c'!=null;\r\n ensures c'==c || fresh(c');\r\n ensures minlen == c'.Length;\r\n ensures IsDigitSeq(power2(32), c'[..]);\r\n ensures BEDigitSeqToInt(power2(32), c'[..]) == BEDigitSeqToInt(power2(32), c[..]);\r\n ensures c'[c'.Length-c.Length..] == c[..];\r\n{\r\n c' := new int[minlen];\r\n ghost var asq := c[..];\r\n FleetCopy_copy_step(c', c, c.Length);\r\n ghost var is := c'[..];\r\n FleetCopy_zero_step(c', c.Length);\r\n\r\n lemma_FleetCopy_IsDigitSeq(asq, is, c'[..], c.Length);\r\n}\r\n\r\nmethod FleetAlloc(len:nat) returns (c:array)\r\n ensures c!=null;\r\n ensures fresh(c);\r\n ensures c.Length == len;\r\n ensures forall i :: 0<=i c[i]==0;\r\n ensures BEDigitSeqToInt(power2(32), c[..]) == 0;\r\n{\r\n c := new int[len];\r\n FleetCopy_zero_step(c, 0);\r\n lemma_2toX();\r\n lemma_LeadingZeros(power2(32), [], c[..]);\r\n reveal_BEDigitSeqToInt_private();\r\n}\r\n\r\n//- This generalized version tolerates h<|a| and 0, h:int, m:int, l:int)\r\n requires 1, b:seq, h:int, hi:int, li:int, l:int)\r\n requires 0<=l<=li<=hi<=h<=|a|==|b|;\r\n requires SelectDigitRange(a, h, l) == SelectDigitRange(b, h, l);\r\n ensures SelectDigitRange(a, hi, li) == SelectDigitRange(b, hi, li);\r\n{\r\n var ai := SelectDigitRange(a, hi, li);\r\n var bi := SelectDigitRange(b, hi, li);\r\n assert |ai| == |bi|;\r\n forall (i | 0<=i<|ai|)\r\n ensures ai[i] == bi[i];\r\n {\r\n var xi := h-hi+i;\r\n calc {\r\n ai[i];\r\n SelectDigitRange(a, hi, li)[i];\r\n a[|a|-hi..|a|-li][i];\r\n a[|a|-hi+i];\r\n a[|a|-h+xi];\r\n a[|a|-h..|a|-l][xi];\r\n SelectDigitRange(a, h, l)[xi];\r\n SelectDigitRange(b, h, l)[xi];\r\n b[|b|-h..|b|-l][xi];\r\n b[|b|-h+xi];\r\n b[|b|-hi+i];\r\n b[|b|-hi..|b|-li][i];\r\n SelectDigitRange(b, hi, li)[i];\r\n bi[i];\r\n }\r\n }\r\n assert ai==bi;\r\n}\r\n\r\nlemma lemma_asm_Add_properties(x:int, y:int, z:int, c:int)\r\n requires word32(x);\r\n requires word32(y);\r\n requires z == mod0x100000000(x + y);\r\n requires c==0 || c==1;\r\n requires (c==1) <==> (z < y);\r\n ensures z == (x+y) % 0x100000000;\r\n ensures x+y == z + 0x100000000*c;\r\n{\r\n var pv := 0x100000000;\r\n lemma_mod0x100000000(x+y);\r\n lemma_word32(x);\r\n lemma_word32(y);\r\n lemma_mod_properties();\r\n lemma_fundamental_div_mod(x+y, pv);\r\n}\r\n\r\nlemma lemma_BEWordSeqToInt_SelectDigitRange_empty(s:seq)\r\n requires IsDigitSeq(power2(32), s);\r\n ensures BEWordSeqToInt(SelectDigitRange(s, 0, 0)) == 0;\r\n{\r\n assert SelectDigitRange(s, 0, 0) == [];\r\n reveal_BEDigitSeqToInt_private();\r\n}\r\n\r\nlemma lemma_PluckDigit_general(s:seq, h:int, i:int, l:int)\r\n requires IsDigitSeq(power2(32), s);\r\n requires 0<=l<=i, i:int)\r\n requires IsDigitSeq(power2(32), s);\r\n requires 0 <= i < |s|;\r\n ensures BEWordSeqToInt(s)\r\n == BEWordSeqToInt(SelectDigitRange(s, |s|, i+1)) * power(power2(32), i+1)\r\n + DigitAt(s, i) * power(power2(32), i)\r\n + BEWordSeqToInt(SelectDigitRange(s, i, 0));\r\n{\r\n assert SelectDigitRange(s, |s|, 0) == s; //- OBSERVE SEQ\r\n lemma_PluckDigit_general(s, |s|, i, 0);\r\n}\r\n\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FleetNat/FleetNatMul.i.dfy", "content": "include \"FleetNatAdd.i.dfy\"\r\ninclude \"FleetNatMulLoopOpt.i.dfy\"\r\n\r\nmethod FleetNatMul_one(c:array, bi:nat, a:array, adigits:int, bv:int)\r\n requires c!=null;\r\n requires IsDigitSeq(power2(32), c[..]);\r\n requires a!=c;\r\n requires a!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n requires 0<=adigits<=a.Length;\r\n requires adigits <= c.Length;\r\n //- c-adequate-length requirement:\r\n requires BEWordSeqToInt(c[..])\r\n + BEWordSeqToInt(SelectDigitRange(a[..], adigits, 0)) * bv * power(power2(32),bi)\r\n < power(power2(32), c.Length);\r\n requires adigits + bi <= c.Length;\r\n requires 0 <= bv < power2(32);\r\n modifies c;\r\n ensures IsDigitSeq(power2(32), c[..]);\r\n ensures BEWordSeqToInt(c[..])\r\n == BEWordSeqToInt(old(c[..]))\r\n + BEWordSeqToInt(SelectDigitRange(a[..], adigits, 0)) * bv * power(power2(32),bi);\r\n{\r\n ghost var pv := power2(32);\r\n lemma_2toX();\r\n ghost var oldcs := c[..];\r\n\r\n var clenm1 := c.Length-1;\r\n\r\n var j := adigits;\r\n var carry;\r\n if (0 == adigits)\r\n {\r\n carry := 0;\r\n lemma_BEWordSeqToInt_SelectDigitRange_empty(a[..]);\r\n }\r\n else\r\n {\r\n carry := FleetNatMul_one_loop_opt(c, bi, a, adigits, bv);\r\n }\r\n\r\n //- propagate the carry out\r\n while (carry > 0)\r\n invariant adigits<=j<=c.Length;\r\n invariant 0<=carry= c.Length)\r\n {\r\n calc {\r\n power(pv, c.Length);\r\n > //- contradicts requirement c-adequate-length.\r\n BEWordSeqToInt(oldcs)\r\n + BEWordSeqToInt(SelectDigitRange(a[..], adigits, 0)) * bv * power(pv, bi);\r\n BEWordSeqToInt(c[..]) + carry*power(pv, j+bi);\r\n >= { lemma_BEWordSeqToInt_bound(c[..]); }\r\n carry*power(pv, j+bi);\r\n >= { lemma_power_positive(pv,j+bi); lemma_mul_increases(carry, power(pv, j+bi)); }\r\n power(pv, j+bi);\r\n >= { lemma_power_increases(pv, c.Length, j+bi); }\r\n power(pv, c.Length);\r\n }\r\n }\r\n var ci := clenm1 - (j+bi);\r\n var lastcj := c[ci];\r\n\r\n lemma_word32(carry);\r\n lemma_word32(lastcj);\r\n var newcj := asm_Add(carry, lastcj);\r\n lemma_mod0x100000000(carry+lastcj);\r\n c[ci] := newcj;\r\n carry := 0;\r\n if (newcj < lastcj) { carry := 1; }\r\n j := j + 1;\r\n \r\n\r\n calc {\r\n newcj * power(pv, lastj+bi) + carry*power(pv, j+bi);\r\n {\r\n lemma_mod0x100000000(lastcarry+lastcj);\r\n lemma_mod_properties();\r\n lemma_asm_Add_properties(lastcarry, lastcj, newcj, carry);\r\n }\r\n (lastcarry+lastcj-pv*carry) * power(pv, lastj+bi) + carry*power(pv, j+bi);\r\n { lemma_mul_is_distributive_forall(); }\r\n (lastcarry+lastcj) * power(pv, lastj+bi) - (pv*carry) * power(pv, lastj+bi) + carry*power(pv, j+bi);\r\n { lemma_mul_is_distributive_forall(); }\r\n lastcarry*power(pv, lastj+bi) + lastcj*power(pv, lastj+bi) - (pv*carry) * power(pv, lastj+bi) + carry*power(pv, j+bi);\r\n lastcj*power(pv,lastj+bi) + lastcarry*power(pv,lastj+bi)\r\n - (pv*carry)*power(pv,lastj+bi) + carry*power(pv, j+bi);\r\n {\r\n calc {\r\n (pv * carry) * power(pv,lastj+bi);\r\n { lemma_mul_is_associative_forall(); }\r\n carry * (pv*power(pv,lastj+bi));\r\n { lemma_power_1(pv); }\r\n carry * (power(pv,1)*power(pv,lastj+bi));\r\n { lemma_power_adds(pv,1,lastj+bi); }\r\n carry * power(pv,j+bi);\r\n }\r\n }\r\n lastcj*power(pv, lastj+bi) + lastcarry * power(pv, lastj+bi);\r\n }\r\n ghost var leftjunk := BEWordSeqToInt(SelectDigitRange(c[..], c.Length, j+bi));\r\n assert SelectDigitRange(c[..], c.Length, j+bi) == SelectDigitRange(lastcs, |lastcs|, j+bi); //- OBSERVE SEQ\r\n ghost var rightjunk := BEWordSeqToInt(SelectDigitRange(c[..], lastj+bi, 0));\r\n assert SelectDigitRange(c[..], lastj+bi, 0) == SelectDigitRange(lastcs, lastj+bi, 0); //- OBSERVE SEQ\r\n calc {\r\n BEWordSeqToInt(c[..]) + carry*power(pv, j+bi);\r\n { lemma_PluckDigit(c[..], lastj+bi); }\r\n BEWordSeqToInt(SelectDigitRange(c[..], c.Length, j+bi)) * power(pv, j+bi)\r\n + DigitAt(c[..], lastj+bi) * power(pv, lastj+bi)\r\n + BEWordSeqToInt(SelectDigitRange(c[..], lastj+bi, 0))\r\n + carry*power(pv, j+bi);\r\n leftjunk * power(pv, j+bi)\r\n + newcj * power(pv, lastj+bi)\r\n + rightjunk\r\n + carry*power(pv, j+bi);\r\n leftjunk * power(pv, j+bi)\r\n + lastcj * power(pv, lastj+bi)\r\n + rightjunk\r\n + lastcarry * power(pv, lastj+bi);\r\n BEWordSeqToInt(SelectDigitRange(lastcs, |lastcs|, j+bi)) * power(pv, j+bi)\r\n + DigitAt(lastcs, lastj+bi) * power(pv, lastj+bi)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, lastj+bi, 0))\r\n + lastcarry * power(pv, lastj+bi);\r\n { lemma_PluckDigit(lastcs, lastj+bi); }\r\n BEWordSeqToInt(lastcs) + lastcarry * power(pv, lastj+bi);\r\n }\r\n }\r\n}\r\n\r\nlemma {:timeLimitMultiplier 2} lemma_FleetNatMul_c_adequate_length(a:array, b:array, adigits:nat, bdigits:nat, bi:nat, bv:int)\r\n requires a!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n requires b!=null;\r\n requires IsDigitSeq(power2(32), b[..]);\r\n requires 0<=adigits<=a.Length;\r\n requires 0<=bi, b:array) returns (c:array)\r\n requires a!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n requires b!=null;\r\n requires IsDigitSeq(power2(32), b[..]);\r\n ensures c!=null;\r\n ensures fresh(c);\r\n ensures IsDigitSeq(power2(32), c[..]);\r\n ensures BEWordSeqToInt(c[..]) == BEWordSeqToInt(a[..]) * BEWordSeqToInt(b[..]);\r\n{\r\n ghost var pv := power2(32); lemma_2toX();\r\n var adigits := CountNonzeroDigits(a);\r\n var bdigits := CountNonzeroDigits(b);\r\n var cdigits := adigits + bdigits;\r\n\r\n c := FleetAlloc(cdigits);\r\n\r\n var bi := 0;\r\n\r\n lemma_LeadingZeros(pv, [], SelectDigitRange(b[..], bi, 0));\r\n lemma_BEWordSeqToInt_SelectDigitRange_empty(b[..]);\r\n\r\n var blenm1 := b.Length - 1;\r\n while (bi < bdigits)\r\n invariant 0<=bi<=bdigits;\r\n invariant IsDigitSeq(power2(32), c[..]);\r\n invariant BEWordSeqToInt(c[..]) == BEWordSeqToInt(a[..]) * BEWordSeqToInt(SelectDigitRange(b[..], bi, 0));\r\n {\r\n ghost var lastc := c[..];\r\n ghost var lastbi := bi;\r\n var bv := b[blenm1 - bi];\r\n\r\n lemma_FleetNatMul_c_adequate_length(a, b, adigits, bdigits, bi, bv);\r\n FleetNatMul_one(c, bi, a, adigits, bv);\r\n bi := bi + 1;\r\n calc {\r\n BEWordSeqToInt(c[..]);\r\n BEWordSeqToInt(lastc)\r\n + BEWordSeqToInt(SelectDigitRange(a[..], adigits, 0)) * bv * power(pv,lastbi);\r\n \r\n BEWordSeqToInt(lastc)\r\n + BEWordSeqToInt(a[..]) * bv * power(pv,lastbi);\r\n \r\n BEWordSeqToInt(a[..]) * BEWordSeqToInt(SelectDigitRange(b[..], lastbi, 0))\r\n + BEWordSeqToInt(a[..]) * bv * power(pv,lastbi);\r\n { lemma_mul_is_associative(BEWordSeqToInt(a[..]), bv, power(pv,lastbi)); }\r\n BEWordSeqToInt(a[..]) * BEWordSeqToInt(SelectDigitRange(b[..], lastbi, 0))\r\n + BEWordSeqToInt(a[..]) * (bv * power(pv,lastbi)); \r\n { lemma_mul_is_distributive(BEWordSeqToInt(a[..]), BEWordSeqToInt(SelectDigitRange(b[..], lastbi, 0)), bv * power(pv,lastbi)); }\r\n BEWordSeqToInt(a[..]) * (\r\n BEWordSeqToInt(SelectDigitRange(b[..], lastbi, 0)) + bv * power(pv,lastbi));\r\n { lemma_SelectSingletonRange(b[..], bi, lastbi);\r\n lemma_BEDigitSeqToInt_singleton(pv, DigitAt(b[..], lastbi)); }\r\n BEWordSeqToInt(a[..]) * (\r\n BEWordSeqToInt(SelectDigitRange(b[..], bi, lastbi)) * power(pv, lastbi)\r\n + BEWordSeqToInt(SelectDigitRange(b[..], lastbi, 0)));\r\n { lemma_BEInterpretation_Select_general(pv, b[..], bi, lastbi, 0); }\r\n BEWordSeqToInt(a[..]) * BEWordSeqToInt(SelectDigitRange(b[..], bi, 0));\r\n }\r\n }\r\n\r\n lemma_LeadingZeros(pv, SelectDigitRange(b[..], bi, 0), b[..]);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FleetNat/FleetNatMulLemmas.i.dfy", "content": "include \"FleetNatAdd.i.dfy\"\r\n\r\nlemma lemma_asm_Mul64(x:int, y:int, hi:int, lo:int)\r\n requires word32(x);\r\n requires word32(y);\r\n requires word32(hi);\r\n requires word32(lo);\r\n requires lo == mod0x100000000(x * y);\r\n requires hi == (x * y) / 0x100000000;\r\n ensures hi*power2(32)+lo == x*y;\r\n ensures 0 <= lo < power2(32);\r\n ensures 0 <= hi < power2(32)-1;\r\n ensures 0 <= x*y;\r\n{\r\n lemma_2toX();\r\n var pv:=power2(32);\r\n lemma_word32(x);\r\n lemma_word32(y);\r\n lemma_word32(hi);\r\n lemma_word32(lo);\r\n calc {\r\n x*y;\r\n <= { lemma_mul_inequality(x,pv-1,y); }\r\n (pv-1)*y;\r\n <= { lemma_mul_inequality(y,pv-1,pv-1); }\r\n (pv-1)*(pv-1);\r\n { lemma_mul_is_distributive_forall(); }\r\n pv*pv-2*pv+1;\r\n }\r\n lemma_mod_properties();\r\n\r\n lemma_mod0x100000000(x*y);\r\n lemma_fundamental_div_mod(x*y, pv);\r\n\r\n if (pv<=hi)\r\n {\r\n calc {\r\n pv*pv;\r\n <= { lemma_fundamental_div_mod(x*y,pv); }\r\n pv*((x*y)/pv);\r\n <= x*y;\r\n < { lemma_mul_strict_inequality(x, pv, y); }\r\n pv*y;\r\n < { lemma_mul_strict_inequality(y, pv, pv); }\r\n pv*pv;\r\n } //- contradiction\r\n }\r\n if (hi == pv-1)\r\n {\r\n calc {\r\n pv*pv - pv;\r\n <\r\n (pv-1)*pv;\r\n <=\r\n (pv-1)*pv+lo;\r\n hi*pv+lo;\r\n x*y;\r\n <\r\n (pv-1)*(pv-1);\r\n pv*pv-2*pv-1;\r\n <\r\n pv*pv - pv;\r\n } //- contradiction\r\n }\r\n}\r\n\r\nlemma lemma_FleetNatMul_one_element_properties(pv:int,\r\n aj:int, bv:int, mhi:int, mlo:int,\r\n lastcarry:int, add1:int, carry1:int,\r\n lastcj:int, newcj:int, carry2:int,\r\n add3:int, carry3:int,\r\n carry:int, carry4:int)\r\n requires pv==power2(32);\r\n requires 0<=aj= pv*pv;\r\n//- assert aj*bv + lastcarry + lastcj < pv*pv;\r\n//- }\r\n//- assert carry4==0;\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FleetNat/FleetNatMulLoopOpt.i.dfy", "content": "include \"FleetNatMulOpt.i.dfy\"\r\ninclude \"FleetNatMulLoopOptLemmas.i.dfy\"\r\n\r\n// Bryan, here's the most important loop we run. This is a working\r\n// implementation that calls out to your FleetNatMulMathOpt inner-loop\r\n// to exploit adc propagation.\r\n// Your goal is to optimize the loop, in particular by inlining the\r\n// mul/add/adc bit. I think we'll get a bunch of benefit even without\r\n// unrolling.\r\n\r\nmethod FleetNatMul_one_loop_opt(c:array, bi:nat, a:array, adigits:int, bv:int) returns (carry:int)\r\n requires c!=null;\r\n requires IsDigitSeq(power2(32), c[..]);\r\n requires a!=c;\r\n requires a!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n requires 0= 0;\r\n requires a.Length > 0;\r\n requires c.Length > 0;\r\n requires 0 <= bv < power2(32);\r\n modifies c;\r\n ensures 0 <= carry < power2(32);\r\n ensures IsDigitSeq(power2(32), c[..]);\r\n ensures BEWordSeqToInt(c[..]) + carry*power(power2(32), adigits+bi)\r\n == BEWordSeqToInt(old(c[..]))\r\n + BEWordSeqToInt(SelectDigitRange(a[..], adigits, 0)) * bv * power(power2(32), bi);\r\n ensures forall k :: 0 <= k < c.Length-1-(adigits+bi) ==> c[k] == old(c[k]);\r\n{\r\n ghost var pv := power2(32);\r\n lemma_2toX();\r\n ghost var oldcs := c[..];\r\n\r\n var alenm1 := a.Length-1;\r\n var clenm1 := c.Length-1;\r\n var j := 0;\r\n carry := 0;\r\n lemma_BEWordSeqToInt_SelectDigitRange_empty(a[..]); //- establish partial sum invariant\r\n\r\n while (j < adigits)\r\n invariant 0<=j<=adigits;\r\n invariant IsDigitSeq(pv, c[..]);\r\n invariant 0<=carry c[k] == old(c[k]);\r\n {\r\n ghost var lastj := j;\r\n ghost var lastcarry := carry;\r\n ghost var lastcs := c[..];\r\n ghost var asq := a[..];\r\n\r\n var ci := clenm1 - (j+bi);\r\n var ai := alenm1 - j;\r\n var aj := a[ai];\r\n var lastcj := c[ci];\r\n var newcj;\r\n\r\n//- #if opt\r\n newcj,carry := FleetNatMulMathOpt(aj, bv, lastcj, carry);\r\n//- #endif opt\r\n//- #if standard\r\n//- //- mul\r\n//- lemma_mod_properties();\r\n//- lemma_word32(aj);\r\n//- lemma_word32(bv);\r\n//- var mhi,mlo := asm_Mul64(aj, bv);\r\n//- lemma_asm_Mul64(aj, bv, mhi, mlo);\r\n//-\r\n//- //- add1\r\n//- lemma_word32(mlo);\r\n//- lemma_word32(lastcarry);\r\n//- var add1 := asm_Add(mlo, carry);\r\n//- var carry1 := 0;\r\n//- if (add1 < carry) { carry1 := 1; }\r\n//- lemma_asm_Add_properties(mlo, lastcarry, add1, carry1);\r\n//-\r\n//- //- add2\r\n//- lemma_word32(lastcj);\r\n//- newcj := asm_Add(add1, lastcj);\r\n//- var carry2 := 0;\r\n//- if (newcj < lastcj) { carry2 := 1; }\r\n//- lemma_asm_Add_properties(add1, lastcj, newcj, carry2);\r\n//-\r\n//- //- add3\r\n//- lemma_word32(carry1);\r\n//- lemma_word32(carry2);\r\n//- var add3 := asm_Add(carry1, carry2);\r\n//- ghost var carry3 := 0;\r\n//- if (add3 < carry2) { carry3 := 1; }\r\n//- lemma_asm_Add_properties(carry1, carry2, add3, carry3);\r\n//-\r\n//- //- add4\r\n//- carry := asm_Add(add3, mhi);\r\n//- ghost var carry4 := 0;\r\n//- if (carry < mhi) { carry4 := 1; }\r\n//- lemma_asm_Add_properties(add3, mhi, carry, carry4);\r\n//-\r\n//- lemma_FleetNatMul_one_element_properties(pv,\r\n//- aj, bv, mhi, mlo,\r\n//- lastcarry, add1, carry1,\r\n//- lastcj, newcj, carry2,\r\n//- add3, carry3,\r\n//- carry, carry4);\r\n//- #endif standard\r\n\r\n c[ci] := newcj;\r\n j := j + 1;\r\n\r\n lemma_FleetNatMul_one_partial_sum_induction(\r\n pv, oldcs, lastcs, c[..], a[..], adigits, bi, bv, j, lastj, carry, lastcarry,\r\n lastcj, newcj);\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FleetNat/FleetNatMulLoopOptLemmas.i.dfy", "content": "include \"FleetNatAdd.i.dfy\"\r\n\r\n//- mpi_mul_hlp uses 16/8/1 unrolling and muladdc and optionally a special MULADDC_HUIT instruction\r\n//- then it propagates the carries out.\r\n//- s is the source value, d is the dest value (shifted with pointer math), b is the single\r\n//- limb being multiplied in.\r\n//- mpi_mul_mpi counts up the zeros and preallocates i+j, since that's actually precise.\r\n// Noice.\r\n// The contents of X is always discarded, so all we could possibly save is an allocation.\r\n// Let's ignore that option for now.\r\n\r\nlemma lemma_FleetNatMul_one_element(pv:int, newcj:int, carry:int, aj:int, bv:int, lastcj:int, lastcarry:int,\r\n mlo:int, mhi:int, add1:int, carry1:int, carry2:int)\r\n requires pv==power2(32);\r\n requires Word32(newcj);\r\n requires Word32(carry);\r\n requires Word32(aj);\r\n requires Word32(bv);\r\n requires Word32(lastcj);\r\n requires Word32(lastcarry);\r\n requires mhi == (aj * bv) / 0x100000000;\r\n requires mlo == mod0x100000000(aj * bv);\r\n requires add1 == mod0x100000000(mlo + lastcarry);\r\n requires carry1 == if add1 < lastcarry then 1 else 0;\r\n requires newcj == mod0x100000000(mod0x100000000(mlo + lastcarry) + lastcj);\r\n requires carry2 == if mod0x100000000(mlo + lastcarry) + lastcj >= 0x100000000 then 1 else 0;\r\n requires carry == mod0x100000000(mhi + carry1 + carry2);\r\n\r\n ensures newcj + carry*pv == aj * bv + lastcj + lastcarry;\r\n{ \r\n lemma_2toX();\r\n\r\n calc {\r\n 0;\r\n <= { lemma_mul_nonnegative_forall(); }\r\n aj * bv;\r\n }\r\n \r\n // Strip off Boogie-level definitions\r\n lemma_mod0x100000000(aj * bv);\r\n assert mlo == (aj * bv) % 0x100000000;\r\n lemma_mod0x100000000(mlo + lastcarry);\r\n assert add1 == (mlo + lastcarry) % 0x100000000;\r\n lemma_mod0x100000000(((mlo + lastcarry) % 0x100000000) + lastcj);\r\n assert newcj == (((mlo + lastcarry) % 0x100000000) + lastcj) % 0x100000000;\r\n\r\n var product := aj * bv;\r\n calc {\r\n product;\r\n { lemma_fundamental_div_mod(product, pv); }\r\n pv * (product / pv) + (product % pv);\r\n pv * mhi + mlo;\r\n }\r\n assert product == pv * mhi + mlo;\r\n\r\n calc {\r\n mlo + lastcarry;\r\n { lemma_word32(mlo);\r\n lemma_word32(lastcarry);\r\n lemma_word32(add1);\r\n lemma_asm_Add_properties(mlo, lastcarry, add1, carry1); }\r\n carry1 * pv + add1;\r\n }\r\n\r\n calc {\r\n add1 + lastcj;\r\n { lemma_word32(add1);\r\n lemma_word32(lastcj);\r\n lemma_word32(newcj);\r\n lemma_asm_Add_properties(add1, lastcj, newcj, carry2); }\r\n carry2 * pv + newcj;\r\n }\r\n\r\n var untruncated_carry := mhi + carry1 + carry2;\r\n calc {\r\n untruncated_carry * pv;\r\n (mhi + carry1 + carry2) * pv;\r\n { lemma_mul_is_distributive_forall(); }\r\n mhi * pv + carry1 * pv + carry2 * pv;\r\n mhi * pv + (mlo + lastcarry - add1) + carry2*pv;\r\n mhi * pv + (mlo + lastcarry - add1) + (add1 + lastcj - newcj);\r\n mhi * pv + mlo + lastcarry + lastcj - newcj;\r\n }\r\n\r\n calc {\r\n newcj + untruncated_carry * pv;\r\n mhi * pv + mlo + lastcarry + lastcj;\r\n { lemma_mul_is_commutative_forall(); }\r\n product + lastcarry + lastcj;\r\n }\r\n\r\n if (untruncated_carry >= pv) {\r\n calc {\r\n newcj + untruncated_carry * pv;\r\n product + lastcarry + lastcj;\r\n <= calc {\r\n product;\r\n aj*bv;\r\n <= { lemma_mul_upper_bound(aj, pv - 1, bv, pv - 1); }\r\n (pv - 1)*(pv - 1);\r\n }\r\n (pv-1)*(pv-1) + pv - 1 + pv - 1;\r\n pv*pv - 2*pv + 1 + pv - 1 + pv - 1;\r\n pv*pv - 1;\r\n <\r\n pv * pv;\r\n }\r\n assert untruncated_carry * pv >= pv * pv;\r\n }\r\n assert untruncated_carry < pv;\r\n lemma_div_pos_is_pos(product, pv);\r\n assert 0 <= untruncated_carry;\r\n lemma_small_mod(untruncated_carry, pv);\r\n lemma_mod0x100000000(untruncated_carry);\r\n assert mod0x100000000(untruncated_carry) == untruncated_carry;\r\n}\r\n\r\n\r\nlemma lemma_FleetNatMul_one_partial_sum_induction(pv:int,\r\n oldcs:seq, lastcs:seq, cs:seq, asq:seq, adigits:int,\r\n bi:int, bv:int, j:int, lastj:int, carry:int, lastcarry:int,\r\n lastcj:int, newcj:int)\r\n requires pv==power2(32);\r\n requires IsWordSeq(cs);\r\n requires IsWordSeq(oldcs);\r\n requires IsWordSeq(lastcs);\r\n requires IsWordSeq(asq);\r\n requires |cs|==|lastcs|==|oldcs|;\r\n requires forall i :: 0<=i<|cs| && i!=|cs|-1-(lastj+bi) ==> lastcs[i]==cs[i];\r\n requires lastj+1 == j <= adigits <= |asq|;\r\n requires 0 <= lastj;\r\n requires 0 <= bi;\r\n requires lastj+bi < |cs|;\r\n //- element operation components\r\n requires lastcj == DigitAt(lastcs, lastj+bi);\r\n requires newcj == DigitAt(cs, lastj+bi);\r\n requires newcj + carry*pv == DigitAt(asq, lastj) * bv + lastcj + lastcarry;\r\n requires 0<=carry x < y;\r\n requires z == mod0x100000000(x - y);\r\n ensures z == (x - y) % 0x100000000;\r\n ensures x-y == z - 0x100000000*c;\r\n{\r\n var pv := 0x100000000;\r\n lemma_mod0x100000000(x-y);\r\n lemma_word32(x);\r\n lemma_word32(y);\r\n lemma_mod_properties();\r\n lemma_fundamental_div_mod(x-y, pv);\r\n}\r\n\r\nlemma lemma_FleetNatSub_local_math(pv:int, lastcj:int, newcj:int, midcj:int, bj:int, lastborrow:int, borrow1:int, borrow2:int, borrow:int)\r\n requires pv==power2(32)==0x100000000;\r\n requires 0<=lastcj, cs:seq, lastj:int, j:int, lastborrow:int)\r\n requires 1<=j<=|lastcs|==|cs|;\r\n requires lastj+1 == j;\r\n requires 0<=lastborrow<2;\r\n requires pv==power2(32)==0x100000000;\r\n requires IsDigitSeq(power2(32), cs);\r\n requires IsDigitSeq(power2(32), lastcs);\r\n requires SelectDigitRange(lastcs, |lastcs|, j) == SelectDigitRange(cs, |cs|, j); //- stability\r\n requires SelectDigitRange(lastcs, lastj, 0) == SelectDigitRange(cs, lastj, 0); //- stability\r\n ensures\r\n BEWordSeqToInt(SelectDigitRange(lastcs, |lastcs|, lastj)) * power(pv,lastj)\r\n - lastborrow * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, lastj, 0))\r\n == BEWordSeqToInt(SelectDigitRange(cs, |cs|, j)) * power(pv,j)\r\n + DigitAt(lastcs, lastj) * power(pv,lastj)\r\n - lastborrow * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(cs, lastj, 0));\r\n{\r\n calc {\r\n BEWordSeqToInt(SelectDigitRange(lastcs, |lastcs|, lastj)) * power(pv,lastj)\r\n - lastborrow * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, lastj, 0));\r\n { lemma_BEInterpretation_Select_general(pv, lastcs, |lastcs|, j, lastj); }\r\n ( BEWordSeqToInt(SelectDigitRange(lastcs, |lastcs|, j)) * power(pv,1)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, j, lastj)) ) * power(pv,lastj)\r\n - lastborrow * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, lastj, 0));\r\n { lemma_mul_is_distributive_forall(); }\r\n BEWordSeqToInt(SelectDigitRange(lastcs, |lastcs|, j)) * power(pv,1) * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, j, lastj)) * power(pv,lastj)\r\n - lastborrow * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, lastj, 0));\r\n { lemma_mul_is_associative_forall(); lemma_power_adds(pv, 1, lastj); }\r\n BEWordSeqToInt(SelectDigitRange(lastcs, |lastcs|, j)) * power(pv,j)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, j, lastj)) * power(pv,lastj)\r\n - lastborrow * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, lastj, 0));\r\n { lemma_SelectSingletonRange(lastcs, j, lastj);\r\n lemma_BEDigitSeqToInt_singleton(pv, DigitAt(lastcs,lastj)); }\r\n BEWordSeqToInt(SelectDigitRange(lastcs, |lastcs|, j)) * power(pv,j)\r\n + DigitAt(lastcs, lastj) * power(pv,lastj)\r\n - lastborrow * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, lastj, 0));\r\n //- stability hypothesis\r\n BEWordSeqToInt(SelectDigitRange(cs, |cs|, j)) * power(pv,j)\r\n + DigitAt(lastcs, lastj) * power(pv,lastj)\r\n - lastborrow * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(cs, lastj, 0));\r\n }\r\n}\r\n\r\nlemma lemma_FleetNatSub_digit_rearrangement(pv:int, oldcs:seq, lastcs:seq, bs:seq, bdigits:int, cs:seq, lastj:int, j:int, lastborrow:int, borrow:int)\r\n requires 1<=j<=bdigits<=|oldcs|==|lastcs|==|cs|;\r\n requires bdigits <= |bs|;\r\n requires lastj+1 == j;\r\n requires 0<=lastborrow<2;\r\n requires 0<=borrow<2;\r\n requires pv==power2(32)==0x100000000;\r\n requires IsDigitSeq(power2(32), oldcs);\r\n requires IsDigitSeq(power2(32), bs);\r\n requires IsDigitSeq(power2(32), cs);\r\n requires IsDigitSeq(power2(32), lastcs);\r\n requires SelectDigitRange(lastcs, |lastcs|, j) == SelectDigitRange(cs, |cs|, j); //- stability\r\n requires SelectDigitRange(lastcs, lastj, 0) == SelectDigitRange(cs, lastj, 0); //- stability\r\n requires BEWordSeqToInt(oldcs) - BEWordSeqToInt(bs) ==\r\n ( BEWordSeqToInt(SelectDigitRange(lastcs, |lastcs|, lastj))\r\n - lastborrow\r\n - BEWordSeqToInt(SelectDigitRange(bs, bdigits, lastj)) ) * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, lastj, 0));\r\n requires DigitAt(lastcs, lastj) - lastborrow - DigitAt(bs, lastj)\r\n == DigitAt(cs, lastj) - pv*borrow; //- local math step\r\n ensures 0<=borrow<2;\r\n ensures IsDigitSeq(power2(32), cs);\r\n ensures BEWordSeqToInt(oldcs) - BEWordSeqToInt(bs) ==\r\n ( BEWordSeqToInt(SelectDigitRange(cs, |cs|, j))\r\n - borrow\r\n - BEWordSeqToInt(SelectDigitRange(bs, bdigits, j)) ) * power(pv,j)\r\n + BEWordSeqToInt(SelectDigitRange(cs, j, 0));\r\n{\r\n //-ghost var pv := power2(32); lemma_2toX();\r\n \r\n \r\n lemma_2toX();\r\n\r\n lemma_SelectSingletonRange(lastcs, j, lastj);\r\n lemma_BEDigitSeqToInt_singleton(pv, DigitAt(lastcs,lastj));\r\n//- assert BEWordSeqToInt(SelectDigitRange(lastcs, j, lastj)) == DigitAt(lastcs, lastj);\r\n\r\n lemma_SelectSingletonRange(cs, j, lastj);\r\n lemma_BEDigitSeqToInt_singleton(pv, DigitAt(cs,lastj));\r\n//- assert BEWordSeqToInt(SelectDigitRange(cs, j, lastj)) == DigitAt(cs, lastj);\r\n\r\n //- b-split\r\n calc {\r\n BEWordSeqToInt(SelectDigitRange(bs, bdigits, lastj)) * power(pv,lastj);\r\n { lemma_BEInterpretation_Select_general(pv, bs, bdigits, j, lastj); }\r\n ( BEWordSeqToInt(SelectDigitRange(bs, bdigits, j)) * power(pv,1)\r\n + BEWordSeqToInt(SelectDigitRange(bs, j, lastj)) )\r\n * power(pv,lastj);\r\n { lemma_mul_is_distributive_forall(); }\r\n BEWordSeqToInt(SelectDigitRange(bs, bdigits, j)) * power(pv,1) * power(pv, lastj)\r\n + BEWordSeqToInt(SelectDigitRange(bs, j, lastj)) * power(pv, lastj);\r\n { lemma_mul_is_associative_forall(); lemma_power_adds(pv, 1, lastj); }\r\n BEWordSeqToInt(SelectDigitRange(bs, bdigits, j)) * power(pv,j)\r\n + BEWordSeqToInt(SelectDigitRange(bs, j, lastj)) * power(pv, lastj);\r\n { lemma_SelectSingletonRange(bs, j, lastj);\r\n lemma_BEDigitSeqToInt_singleton(pv, DigitAt(bs,lastj)); }\r\n BEWordSeqToInt(SelectDigitRange(bs, bdigits, j)) * power(pv,j)\r\n + DigitAt(bs, lastj) * power(pv, lastj);\r\n }\r\n\r\n //- core\r\n calc {\r\n DigitAt(lastcs, lastj) * power(pv,lastj)\r\n - lastborrow * power(pv,lastj)\r\n - DigitAt(bs, lastj) * power(pv, lastj);\r\n { lemma_mul_is_distributive_forall(); }\r\n (DigitAt(lastcs, lastj) - lastborrow - DigitAt(bs, lastj)) * power(pv, lastj);\r\n //- requires \"local math step\"\r\n (DigitAt(cs, lastj) - borrow*pv) * power(pv, lastj);\r\n { lemma_mul_is_distributive_forall(); }\r\n DigitAt(cs, lastj)*power(pv,lastj)\r\n - borrow * pv * power(pv,lastj);\r\n { lemma_mul_is_associative_forall(); lemma_power_adds(pv, 1, lastj); lemma_power_1(pv); }\r\n DigitAt(cs, lastj)*power(pv,lastj)\r\n - borrow * power(pv,j);\r\n }\r\n\r\n calc {\r\n BEWordSeqToInt(oldcs) - BEWordSeqToInt(bs);\r\n ( BEWordSeqToInt(SelectDigitRange(lastcs, |lastcs|, lastj))\r\n - lastborrow\r\n - BEWordSeqToInt(SelectDigitRange(bs, bdigits, lastj)) ) * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, lastj, 0));\r\n { lemma_mul_is_distributive_forall(); }\r\n BEWordSeqToInt(SelectDigitRange(lastcs, |lastcs|, lastj)) * power(pv,lastj)\r\n - lastborrow * power(pv,lastj)\r\n - BEWordSeqToInt(SelectDigitRange(bs, bdigits, lastj)) * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, lastj, 0));\r\n { lemma_FleetNatSub_rearrangement_left(pv, lastcs, cs, lastj, j, lastborrow); }\r\n BEWordSeqToInt(SelectDigitRange(cs, |cs|, j)) * power(pv,j)\r\n + DigitAt(lastcs, lastj) * power(pv,lastj)\r\n - lastborrow * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(cs, lastj, 0))\r\n - BEWordSeqToInt(SelectDigitRange(bs, bdigits, lastj)) * power(pv,lastj);\r\n //- calc \"b-split\"\r\n BEWordSeqToInt(SelectDigitRange(cs, |cs|, j))*power(pv,j)\r\n + DigitAt(lastcs, lastj) * power(pv,lastj)\r\n - lastborrow * power(pv,lastj)\r\n - BEWordSeqToInt(SelectDigitRange(bs, bdigits, j)) * power(pv,j)\r\n - DigitAt(bs, lastj) * power(pv, lastj)\r\n + BEWordSeqToInt(SelectDigitRange(cs, lastj, 0));\r\n //- calc \"core\"\r\n BEWordSeqToInt(SelectDigitRange(cs, |cs|, j)) * power(pv,j)\r\n - borrow * power(pv,j)\r\n - BEWordSeqToInt(SelectDigitRange(bs, bdigits, j)) * power(pv,j)\r\n + DigitAt(cs, lastj)*power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(cs, lastj, 0));\r\n BEWordSeqToInt(SelectDigitRange(cs, |cs|, j)) * power(pv,j)\r\n - borrow * power(pv,j)\r\n - BEWordSeqToInt(SelectDigitRange(bs, bdigits, j)) * power(pv,j)\r\n + BEWordSeqToInt(SelectDigitRange(cs, j, lastj))*power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(cs, lastj, 0));\r\n { lemma_BEInterpretation_Select_general(pv, cs, j, lastj, 0); }\r\n BEWordSeqToInt(SelectDigitRange(cs, |cs|, j)) * power(pv,j)\r\n - borrow * power(pv,j)\r\n - BEWordSeqToInt(SelectDigitRange(bs, bdigits, j)) * power(pv,j)\r\n + BEWordSeqToInt(SelectDigitRange(cs, j, 0));\r\n { lemma_mul_is_distributive_forall(); }\r\n ( BEWordSeqToInt(SelectDigitRange(cs, |cs|, j))\r\n - borrow\r\n - BEWordSeqToInt(SelectDigitRange(bs, bdigits, j)) ) * power(pv,j)\r\n + BEWordSeqToInt(SelectDigitRange(cs, j, 0));\r\n }\r\n}\r\n\r\nlemma lemma_FleetNatSub_c_adequate_length(cs:seq, bs:seq, bdigits:int)\r\n requires IsWordSeq(cs);\r\n requires IsWordSeq(bs);\r\n requires BEWordSeqToInt(bs) <= BEWordSeqToInt(cs);\r\n requires (BEWordSeqToInt(bs)==0 && bdigits==0)\r\n || (0, lastcs:seq, bs:seq, cs:seq, lastj:int, j:int, lastborrow:int, borrow:int)\r\n requires 1<=j<=|oldcs|==|lastcs|==|cs|;\r\n requires lastj+1 == j;\r\n requires 0<=lastborrow<2;\r\n requires 0<=borrow<2;\r\n requires pv==power2(32)==0x100000000;\r\n requires IsDigitSeq(power2(32), oldcs);\r\n requires IsDigitSeq(power2(32), bs);\r\n requires IsDigitSeq(power2(32), cs);\r\n requires IsDigitSeq(power2(32), lastcs);\r\n requires SelectDigitRange(lastcs, |lastcs|, j) == SelectDigitRange(cs, |cs|, j); //- stability\r\n requires SelectDigitRange(lastcs, lastj, 0) == SelectDigitRange(cs, lastj, 0); //- stability\r\n requires DigitAt(lastcs, lastj) - lastborrow == DigitAt(cs, lastj) - borrow * pv; //- core step\r\n requires BEWordSeqToInt(oldcs) - BEWordSeqToInt(bs) ==\r\n ( BEWordSeqToInt(SelectDigitRange(lastcs, |lastcs|, lastj))\r\n - lastborrow) * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, lastj, 0));\r\n ensures BEWordSeqToInt(oldcs) - BEWordSeqToInt(bs) ==\r\n ( BEWordSeqToInt(SelectDigitRange(cs, |cs|, j))\r\n - borrow) * power(pv,j)\r\n + BEWordSeqToInt(SelectDigitRange(cs, j, 0));\r\n{\r\n calc {\r\n DigitAt(lastcs, lastj) * power(pv,lastj) - lastborrow * power(pv,lastj);\r\n { lemma_mul_is_distributive_forall(); }\r\n (DigitAt(lastcs, lastj) - lastborrow) * power(pv,lastj);\r\n //- core step\r\n (DigitAt(cs, lastj) - borrow * pv) * power(pv,lastj);\r\n { lemma_mul_is_distributive_forall(); }\r\n DigitAt(cs, lastj) * power(pv, lastj) - borrow * pv * power(pv,lastj);\r\n { lemma_mul_is_associative_forall(); lemma_power_adds(pv, 1, lastj); lemma_power_1(pv); }\r\n DigitAt(cs, lastj) * power(pv, lastj) - borrow * power(pv,j);\r\n }\r\n calc {\r\n ( BEWordSeqToInt(SelectDigitRange(lastcs, |lastcs|, lastj))\r\n - lastborrow) * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, lastj, 0));\r\n { lemma_mul_is_distributive_forall(); }\r\n BEWordSeqToInt(SelectDigitRange(lastcs, |lastcs|, lastj)) * power(pv,lastj)\r\n - lastborrow * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(lastcs, lastj, 0));\r\n { lemma_FleetNatSub_rearrangement_left(pv, lastcs, cs, lastj, j, lastborrow); }\r\n BEWordSeqToInt(SelectDigitRange(cs, |cs|, j)) * power(pv,j)\r\n + DigitAt(lastcs, lastj) * power(pv,lastj)\r\n - lastborrow * power(pv,lastj)\r\n + BEWordSeqToInt(SelectDigitRange(cs, lastj, 0));\r\n //- core calc\r\n BEWordSeqToInt(SelectDigitRange(cs, |cs|, j)) * power(pv,j)\r\n - borrow * power(pv,j)\r\n + DigitAt(cs, lastj) * power(pv, lastj)\r\n + BEWordSeqToInt(SelectDigitRange(cs, lastj, 0));\r\n { lemma_SelectSingletonRange(cs, j, lastj);\r\n lemma_BEDigitSeqToInt_singleton(pv, DigitAt(cs,lastj)); }\r\n BEWordSeqToInt(SelectDigitRange(cs, |cs|, j)) * power(pv,j)\r\n - borrow * power(pv,j)\r\n + BEWordSeqToInt(SelectDigitRange(cs, j, lastj)) * power(pv, lastj)\r\n + BEWordSeqToInt(SelectDigitRange(cs, lastj, 0));\r\n { lemma_BEInterpretation_Select_general(pv, cs, j, lastj, 0); }\r\n BEWordSeqToInt(SelectDigitRange(cs, |cs|, j)) * power(pv,j)\r\n - borrow * power(pv,j)\r\n + BEWordSeqToInt(SelectDigitRange(cs, j, 0));\r\n { lemma_mul_is_distributive_forall(); }\r\n ( BEWordSeqToInt(SelectDigitRange(cs, |cs|, j))\r\n - borrow) * power(pv,j)\r\n + BEWordSeqToInt(SelectDigitRange(cs, j, 0));\r\n }\r\n}\r\n\r\nmethod FleetNatSub(c:array, b:array)\r\n //- always in-place because c always has enough room!\r\n requires b!=null;\r\n requires IsWordSeq(b[..]);\r\n requires c!=null;\r\n requires IsWordSeq(c[..]);\r\n requires c!=b;\r\n requires BEWordSeqToInt(b[..]) <= BEWordSeqToInt(c[..]);\r\n modifies c;\r\n ensures IsWordSeq(c[..]);\r\n ensures BEWordSeqToInt(old(c[..])) - BEWordSeqToInt(b[..]) == BEWordSeqToInt(c[..]);\r\n{\r\n ghost var pv := power2(32); lemma_2toX();\r\n\r\n var bdigits := CountNonzeroDigits(b);\r\n\r\n lemma_FleetNatSub_c_adequate_length(c[..], b[..], bdigits);\r\n\r\n var borrow := 0;\r\n var blenm1 := b.Length - 1;\r\n var clenm1 := c.Length - 1;\r\n var j:=0;\r\n\r\n //- bridge from preconditions to subtract loop invariant\r\n calc {\r\n BEWordSeqToInt(old(c[..])) - BEWordSeqToInt(b[..]);\r\n { lemma_power_0(pv); }\r\n ( BEWordSeqToInt(c[..]) - BEWordSeqToInt(b[..]) ) * power(pv,j);\r\n {\r\n assert SelectDigitRange(c[..], c.Length, j) == c[..]; //- OBSERVE SEQ\r\n }\r\n ( BEWordSeqToInt(SelectDigitRange(c[..], c.Length, j))\r\n + borrow\r\n - BEWordSeqToInt(SelectDigitRange(b[..], bdigits, j)) ) * power(pv,j);\r\n {\r\n assert SelectDigitRange(c[..], j, 0)==[]; //- OBSERVE SEQ\r\n reveal_BEDigitSeqToInt_private();\r\n }\r\n ( BEWordSeqToInt(SelectDigitRange(c[..], c.Length, j))\r\n + borrow\r\n - BEWordSeqToInt(SelectDigitRange(b[..], bdigits, j)) ) * power(pv,j)\r\n + BEWordSeqToInt(SelectDigitRange(c[..], j, 0));\r\n }\r\n\r\n //- subtract loop\r\n while (j0)\r\n { //- borrow can't fall off the top, because we requires-ed that c>=b.\r\n calc {\r\n BEWordSeqToInt(old(c[..])) - BEWordSeqToInt(b[..]);\r\n ( BEWordSeqToInt(SelectDigitRange(c[..], c.Length, j)) - 1) * power(pv,j)\r\n + BEWordSeqToInt(SelectDigitRange(c[..], j, 0));\r\n { assert SelectDigitRange(c[..], c.Length, j)==[]; reveal_BEDigitSeqToInt_private(); }\r\n - 1 * power(pv,j) + BEWordSeqToInt(SelectDigitRange(c[..], j, 0));\r\n < { lemma_BEDigitSeqToInt_bound(pv, SelectDigitRange(c[..], j, 0)); }\r\n 0;\r\n } assert false;\r\n }\r\n}\r\n\r\n//- Caller assumes newly-allocated c.\r\nmethod ICantBelieveItsNotFatNatSub(a:array, b:array) returns (c:array)\r\n requires a!=null;\r\n requires b!=null;\r\n requires IsDigitSeq(power2(32), a[..]);\r\n requires IsDigitSeq(power2(32), b[..]);\r\n requires BEWordSeqToInt(b[..]) <= BEWordSeqToInt(a[..]);\r\n ensures c!=null;\r\n ensures fresh(c);\r\n ensures IsDigitSeq(power2(32), c[..]);\r\n ensures BEWordSeqToInt(a[..]) - BEWordSeqToInt(b[..]) == BEWordSeqToInt(c[..]);\r\n{\r\n c := FleetAlloc(a.Length); //- could just be c:=null, but DafnyCC doesn't allow it yet\r\n assert c!=null; \r\n c := FleetCopy(c, a, 0);\r\n FleetNatSub(c, b);\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/FleetNat/FleetNatSubOpt.i.dfy", "content": "\r\n\r\n\r\nmethod FleetNatSub_local_math_core(lastcj:int, bj:int, lastborrow:int) returns (newcj:int, borrow:int)\r\n requires 0<=lastcj<0x100000000;\r\n requires 0<=bj<0x100000000;\r\n requires 0<=lastborrow<2;\r\n ensures 0<=newcj<0x100000000;\r\n ensures 0<=borrow<2;\r\n ensures lastcj - lastborrow - bj == newcj - 0x100000000*borrow;\r\n{\r\n var lastcj := c[ci];\r\n var borrow1 := 0;\r\n if (lastcj < borrow) { borrow1 := 1; }\r\n lemma_word32(lastcj);\r\n lemma_word32(borrow);\r\n var midcj := asm_Sub(lastcj, borrow);\r\n\r\n lemma_asm_Sub_properties(lastcj, borrow, midcj, borrow1);\r\n\r\n lemma_word32(1);\r\n var borrow2 := 0;\r\n if (midcj < bj) {\r\n borrow2 := 1;\r\n }\r\n lemma_word32(bj);\r\n newcj := asm_Sub(midcj, bj);\r\n\r\n lemma_asm_Sub_properties(midcj, bj, newcj, borrow2);\r\n lemma_word32(borrow1);\r\n borrow := asm_Add(borrow1, borrow2);\r\n lemma_mod0x100000000(borrow1+borrow2);\r\n}\r\n\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/BitwiseOperations.i.dfy", "content": "include \"power2.s.dfy\"\r\ninclude \"power2.i.dfy\"\r\ninclude \"../Util/be_sequences.s.dfy\"\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- Pure bitwise operations -- \"pure\" in that they're defined over nats,\r\n//- not Word32s.\r\n\r\nstatic function BitAnd(x:nat, y:nat) : nat\r\n requires IsBit(x);\r\n requires IsBit(y);\r\n ensures IsBit(BitAnd(x,y));\r\n{\r\n if x==1 && y==1 then 1 else 0\r\n}\r\n\r\nstatic function PureBitwiseAnd(x:nat, y:nat) : nat\r\n decreases x+y;\r\n{\r\n \r\n\r\n\r\n \r\n if (x==0 || y==0) then\r\n 0\r\n else\r\n PureBitwiseAnd(x/2, y/2)*2 + BitAnd(x%2, y%2)\r\n}\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nstatic predicate SelectBit(b:nat, x:nat)\r\n{\r\n (x/power2(b)) % 2 == 1\r\n}\r\n\r\nstatic lemma lemma_SelectBit_mod(b:nat, x:nat, y:nat)\r\n requires 0<=b forall b:nat :: !SelectBit(b,x);\r\n decreases x;\r\n{\r\n if (x==0)\r\n {\r\n forall (b:nat)\r\n ensures !SelectBit(b,x);\r\n {\r\n lemma_power2_positive();\r\n lemma_SelectBit_overflow(b,x);\r\n }\r\n }\r\n if (forall b:nat :: !SelectBit(b,x))\r\n {\r\n if (x==1)\r\n {\r\n lemma_power2_0_is_1();\r\n lemma_div_is_div_boogie(x,1);\r\n assert SelectBit(0,x);\r\n }\r\n else if (x>1)\r\n {\r\n lemma_SelectBit_zero(x/2);\r\n var b:nat :| SelectBit(b,x/2);\r\n var L2 := 2;\r\n calc {\r\n (x/power2(b+1)) % 2;\r\n { reveal_power2(); }\r\n (x/(2*power2(b))) % 2;\r\n { lemma_mul_is_mul_boogie(2,power2(b)); }\r\n (x/(L2*power2(b))) % 2;\r\n { lemma_div_denominator(x,2,power2(b)); }\r\n ((x/L2)/power2(b)) % 2;\r\n { lemma_div_is_div_boogie(x,2); }\r\n ((x/2)/power2(b)) % 2;\r\n 1;\r\n }\r\n assert SelectBit(b+1,x);\r\n assert false;\r\n }\r\n assert x==0;\r\n }\r\n}\r\n\r\nstatic predicate BitwiseAndPredicate(x:nat, y:nat, z:nat)\r\n{\r\n forall b:nat :: (SelectBit(b, x) && SelectBit(b, y)) == SelectBit(b, z)\r\n}\r\n\r\nstatic lemma lemma_mask_div_mod(x:nat, c:nat)\r\n requires 0 !(divides(x,a) && divides(x,b))\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/bit_vector_lemmas.i.dfy", "content": "include \"../../Drivers/CPU/assembly.i.dfy\"\r\n\r\n//-///////////////////////////////////////////////////\r\n//- These connect to the underlying lemmas proven \r\n//- in Boogie. It is strongly suggested that you\r\n//- call the premium versions of these lemmas \r\n//- (in bit_vector_lemmas_premium.i.dfy) instead of\r\n//- calling these directly.\r\n//-///////////////////////////////////////////////////\r\n\r\nstatic lemma {:decl} lemma_xor_bytes(x:int, y:int)\r\n requires 0 <= x < 256;\r\n requires 0 <= y < 256;\r\n requires word32(x);\r\n requires word32(y);\r\n ensures 0 <= asm_BitwiseXor(x, y) < 256;\r\n\r\nstatic lemma {:decl} lemma_and_with_ff(x:int)\r\n requires word32(x);\r\n requires word32(0xFF);\r\n ensures 0 <= asm_BitwiseAnd(x, 0xFF) < 256;\r\n\r\nstatic lemma {:decl} lemma_and_with_ffff(x:int)\r\n requires word32(x);\r\n requires word32(0xFFFF);\r\n ensures 0 <= asm_BitwiseAnd(x, 0xFFFF) < 0x10000;\r\n\r\nstatic lemma {:decl} lemma_and_with_32_64(x:int)\r\n requires word32(x);\r\n requires word32(32);\r\n requires word32(64);\r\n ensures asm_BitwiseAnd(x, 32) > 0 ==> IntBit(26, x);\r\n ensures asm_BitwiseAnd(x, 64) > 0 ==> IntBit(25, x);\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/bit_vector_lemmas_premium.i.dfy", "content": "include \"bit_vector_lemmas.i.dfy\"\r\ninclude \"../../Drivers/CPU/assembly_premium.i.dfy\"\r\n\r\nstatic lemma lemma_and_with_ff_premium()\r\n ensures Word32(0xFF);\r\n ensures forall x :: Word32(x) ==> 0 <= Asm_BitwiseAnd(x, 0xFF) < 256 && IsByte(Asm_BitwiseAnd(x, 0xFF));\r\n{\r\n lemma_2toX();\r\n forall x | Word32(x)\r\n ensures 0 <= Asm_BitwiseAnd(x, 0xFF) < 256;\r\n ensures Word16(Asm_BitwiseAnd(x, 0xFF));\r\n {\r\n lemma_word32_Word32();\r\n lemma_and_with_ff(x);\r\n }\r\n}\r\n\r\nstatic lemma lemma_and_with_ffff_premium()\r\n ensures Word32(0xFFFF);\r\n ensures forall x :: Word32(x) ==> 0 <= Asm_BitwiseAnd(x, 0xFFFF) < 0x10000 && Word16(Asm_BitwiseAnd(x, 0xFFFF));\r\n{\r\n lemma_2toX();\r\n forall x | Word32(x)\r\n ensures 0 <= Asm_BitwiseAnd(x, 0xFFFF) < 0x10000;\r\n ensures Word16(Asm_BitwiseAnd(x, 0xFFFF));\r\n {\r\n lemma_word32_Word32();\r\n lemma_and_with_ffff(x);\r\n }\r\n}\r\n\r\n\r\nstatic lemma lemma_and_with_32_64_specific_premium(x:int)\r\n requires Word32(x);\r\n ensures Word32(32) && Word32(64);\r\n ensures Asm_BitwiseAnd(x, 32) > 0 ==> BEWordToBitSeq(x)[26] == 1;\r\n ensures Asm_BitwiseAnd(x, 64) > 0 ==> BEWordToBitSeq(x)[25] == 1;\r\n{\r\n lemma_and_with_32_64_premium();\r\n}\r\n\r\nstatic lemma lemma_and_with_32_64_premium()\r\n ensures Word32(32) && Word32(64);\r\n ensures forall x :: Word32(x) ==> (Asm_BitwiseAnd(x, 32) > 0 ==> BEWordToBitSeq(x)[26] == 1);\r\n ensures forall x :: Word32(x) ==> (Asm_BitwiseAnd(x, 64) > 0 ==> BEWordToBitSeq(x)[25] == 1);\r\n{\r\n lemma_2toX();\r\n forall x | Word32(x)\r\n ensures Asm_BitwiseAnd(x, 32) > 0 ==> BEWordToBitSeq(x)[26] == 1;\r\n ensures Asm_BitwiseAnd(x, 64) > 0 ==> BEWordToBitSeq(x)[25] == 1;\r\n {\r\n lemma_word32_Word32();\r\n lemma_and_with_32_64(x);\r\n lemma_IntBit_is_BEWordToBitSeq();\r\n }\r\n\r\n}\r\n\r\nstatic lemma lemma_xor_bytes_premium(x:int, y:int)\r\n requires 0 <= x < 256;\r\n requires 0 <= y < 256;\r\n\r\n ensures word32(x);\r\n ensures word32(y);\r\n ensures Word32(x);\r\n ensures Word32(y);\r\n ensures 0 <= asm_BitwiseXor(x, y) < 256;\r\n ensures 0 <= Asm_BitwiseXor(x, y) < 256;\r\n ensures 0 <= BitwiseXor(x, y) < 256;\r\n{\r\n lemma_2toX();\r\n lemma_word32(x);\r\n lemma_word32(y);\r\n lemma_xor_bytes(x, y);\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/div.i.dfy", "content": "include \"power.i.dfy\"\r\ninclude \"mul.i.dfy\"\r\ninclude \"div_def.i.dfy\"\r\ninclude \"div_boogie.i.dfy\"\r\ninclude \"div_nonlinear.i.dfy\"\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//-\r\n//- Core div lemmas, with named arguments.\r\n//-\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic lemma lemma_div_by_one_is_identity(x:int)\r\n ensures x/1 == x;\r\n{\r\n}\r\n\r\nstatic lemma lemma_div_basics(x:int)\r\n ensures x != 0 ==> 0 / x == 0;\r\n ensures x / 1 == x;\r\n ensures x!=0 ==> x / x == 1;\r\n{\r\n lemma_div_by_one_is_identity(x);\r\n forall x:int | x != 0 \r\n ensures x / x == 1;\r\n ensures 0 / x == 0;\r\n {\r\n lemma_div_by_self(x);\r\n lemma_div_of_0(x);\r\n }\r\n}\r\n\r\n\r\nstatic lemma lemma_small_div_converse()\r\n ensures forall x, d :: 0<=x && 0 x < d;\r\n{\r\n forall (x,d | 0<=x && 0= d)\r\n {\r\n calc {\r\n 1;\r\n { lemma_div_basics(d); }\r\n d/d;\r\n <= { lemma_div_is_ordered(d, x, d); }\r\n x/d;\r\n }\r\n assert false;\r\n }\r\n }\r\n}\r\n\r\n\r\nstatic lemma lemma_div_is_ordered_by_denominator(x:int, y:int, z:int)\r\n requires x >= 0;\r\n requires 1 <= y <= z;\r\n ensures x / y >= x / z;\r\n decreases x;\r\n{\r\n lemma_div_is_div_recursive_forall();\r\n\r\n if (x < z)\r\n {\r\n lemma_div_is_ordered(0, x, y);\r\n }\r\n else\r\n {\r\n lemma_div_is_ordered(x-z, x-y, y);\r\n lemma_div_is_ordered_by_denominator(x-z, y, z);\r\n }\r\n}\r\n\r\nstatic lemma lemma_div_is_strictly_ordered_by_denominator(x:int, d:int)\r\n requires 0 < x;\r\n requires 1 < d;\r\n ensures x/d < x;\r\n decreases x;\r\n{\r\n lemma_div_is_div_recursive_forall();\r\n if (x {\r\n a%d + b%d == R + (a+b)%d;\r\n (a+b)-(a+b)%d - R == a-(a%d) + b - (b%d);\r\n {\r\n lemma_fundamental_div_mod(a+b,d);\r\n lemma_fundamental_div_mod(a,d);\r\n lemma_fundamental_div_mod(b,d);\r\n }\r\n d*((a+b)/d) - R == d*(a/d) + d*(b/d);\r\n }\r\n}\r\n\r\n\r\n//-static lemma lemma_negative_divisor(x:int, d:int)\r\n//- requires d < 0;\r\n//- ensures x / (-1*d) == -1*(x / d); \r\n//-{\r\n//- var q := x / (-1*d);\r\n//- var r := x % (-1*d);\r\n//- \r\n//- calc {\r\n//- x;\r\n//- { lemma_fundamental_div_mod(x, -1*d); }\r\n//- q * (-1*d) + r;\r\n//- { lemma_mul_is_associative(q, -1, d); }\r\n//- (q*-1)*d + r;\r\n//- { lemma_mul_is_commutative(q, -1); }\r\n//- (-q) * d + r;\r\n//- }\r\n//- lemma_mod_range(x, -1*d);\r\n//- lemma_fundamental_div_mod_converse(x, d, -q, r);\r\n//- assert x / d == -q;\r\n//- assert -1*(x/d) == q;\r\n//-}\r\n\r\n\r\nstatic lemma lemma_div_pos_is_pos(x:int, divisor:int)\r\n requires 0 <= x;\r\n requires 0 < divisor;\r\n ensures x / divisor >= 0;\r\n{\r\n if (x < divisor) {\r\n lemma_small_div();\r\n } else {\r\n calc {\r\n x / divisor;\r\n { lemma_div_is_div_recursive_forall(); }\r\n 1 + ((x - divisor) / divisor);\r\n >= { lemma_div_pos_is_pos(x-divisor, divisor); }\r\n 0;\r\n }\r\n }\r\n}\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//-\r\n//- Forall lemmas: these restate the core lemmas with foralls,\r\n//- so callers needn't name the specific expressions to manipulate.\r\n//-\r\n//- These are all boilerplate transformations of args/requires/ensures\r\n//- into forall args :: requires ==> ensures, with a correpsonding\r\n//- mechanically generated forall proof that invokes the core lemma.\r\n\r\n//-\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic lemma lemma_div_basics_forall()\r\n ensures forall x :: x != 0 ==> 0 / x == 0;\r\n ensures forall x :: x / 1 == x;\r\n ensures forall x, y :: x >= 0 && y > 0 ==> x/y >= 0;\r\n ensures forall x, y :: x >= 0 && y > 0 ==> x/y <= x;\r\n{\r\n forall (x:int)\r\n ensures x != 0 ==> 0 / x == 0;\r\n ensures x / 1 == x;\r\n {\r\n lemma_div_basics(x);\r\n }\r\n forall x:int, y:int | x >= 0 && y > 0\r\n ensures x / y >= 0;\r\n ensures x / y <= x;\r\n {\r\n lemma_div_pos_is_pos(x, y);\r\n lemma_div_is_ordered_by_denominator(x, 1, y);\r\n }\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n//\r\n\r\n\r\n\r\n\r\n\r\nstatic lemma lemma_div_neg_neg(x:int, d:int)\r\n requires d > 0;\r\n ensures x/d == -((-x+d-1)/d);\r\n decreases if x > 0 then x + 1 else -x;\r\n{\r\n if (x<0) {\r\n calc {\r\n x/d;\r\n { lemma_div_is_div_recursive_forall(); }\r\n -1 + my_div_pos(x+d, d);\r\n { lemma_div_is_div_recursive_forall(); }\r\n -1 + (x+d)/d;\r\n {\r\n if (x < -d)\r\n {\r\n lemma_div_neg_neg(x+d,d);\r\n }\r\n else\r\n {\r\n calc {\r\n (x+d)/d;\r\n { lemma_div_is_div_recursive_forall(); }\r\n 0;\r\n { lemma_div_is_div_recursive_forall(); }\r\n -((-(x+d)+d-1)/d);\r\n }\r\n }\r\n }\r\n -1 + -((-(x+d)+d-1)/d);\r\n -1 + -1*((-(x+d)+d-1)/d);\r\n -1 * (1 + ((-(x+d)+d-1)/d));\r\n -1 * (1 + ((-(x+d)+d-1)/d));\r\n { lemma_div_is_div_recursive_forall(); }\r\n -1 * ((-1*x+d-1)/d);\r\n -((-x+d-1)/d);\r\n }\r\n } else if (x= 0;\r\n requires x % 2 == 1;\r\n ensures (x+1)%2 == 0;\r\n{\r\n}\r\n\r\nstatic lemma lemma_mod2_plus2(x:int)\r\n requires x % 2 == 1;\r\n ensures (x+2) % 2 == 1;\r\n{\r\n}\r\n\r\nstatic lemma lemma_mod32(x:int)\r\n requires x >= 32;\r\n ensures (x-32) % 32 == x % 32;\r\n{\r\n}\r\n\r\n////////////////////////////////////////////////\r\n\r\n////////////////////////////////////////////////\r\n\r\nstatic lemma lemma_mod_remainder_neg_specific(x:int, m:int)\r\n requires m > 0 && x < 0;\r\n ensures 0 <= x%m < m;\r\n decreases -1*x;\r\n{\r\n lemma_mod_is_mod_recursive_forall();\r\n if (x + m >= 0) {\r\n lemma_mod_remainder_pos();\r\n } else {\r\n lemma_mul_is_mul_recursive_forall();\r\n lemma_mod_remainder_neg_specific(m+x, m);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mod_remainder_neg()\r\n ensures forall x:int, m:int :: m > 0 && x < 0 ==> 0 <= x%m < m;\r\n{\r\n forall x:int, m:int | m > 0 && x < 0\r\n ensures 0 <= x%m < m;\r\n {\r\n lemma_mod_remainder_neg_specific(x,m);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mod_remainder_pos_specific(x:int, m:int)\r\n requires m > 0 && x >= 0;\r\n ensures 0 <= x % m < m;\r\n{\r\n lemma_mod_is_mod_recursive_forall();\r\n if x == 0 {\r\n } else if x < m {\r\n } else {\r\n lemma_mod_remainder_pos_specific(x - m, m);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mod_remainder_pos()\r\n ensures forall x, m :: m > 0 && x >= 0 ==> 0 <= x % m < m;\r\n{\r\n forall x, m | m > 0 && x >= 0\r\n ensures 0 <= x % m < m;\r\n {\r\n lemma_mod_remainder_pos_specific(x,m);\r\n }\r\n}\r\n\r\n\r\nstatic lemma lemma_mod_remainder_specific(x:int, m:int)\r\n requires m > 0;\r\n ensures 0 <= x % m < m;\r\n{\r\n if (x < 0) {\r\n lemma_mod_remainder_neg_specific(x, m);\r\n }\r\n else {\r\n lemma_mod_remainder_pos_specific(x, m);\r\n }\r\n}\r\nstatic lemma lemma_mod_remainder()\r\n ensures forall x:int, m:int :: m > 0 ==> 0 <= x%m < m;\r\n{\r\n lemma_mod_remainder_pos();\r\n lemma_mod_remainder_neg();\r\n}\r\n\r\nstatic lemma lemma_mod_basics()\r\n ensures forall m:int :: m > 0 ==> m % m == 0;\r\n ensures forall x:int, m:int :: m > 0 ==> (x%m)% m == x%m;\r\n{\r\n forall m:int | m>0 \r\n ensures m > 0 ==> m % m == 0;\r\n {\r\n lemma_mod_yourself(m);\r\n }\r\n\r\n forall (x,m | m>0)\r\n ensures (x%m)% m == x%m;\r\n {\r\n assert x%m < m; \r\n lemma_small_mod(x%m,m);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mod_properties()\r\n ensures forall m:int :: m > 0 ==> m % m == 0;\r\n ensures forall x:int, m:int :: m > 0 ==> (x%m)% m == x%m;\r\n ensures forall x:int, m:int :: m > 0 ==> 0 <= x%m < m;\r\n{\r\n lemma_mod_basics();\r\n\r\n forall (x,m | m>0)\r\n ensures m > 0 ==> 0 <= x%m < m;\r\n {\r\n lemma_mod_remainder();\r\n assert x%m 0 then a else -a;\r\n requires 0 < m;\r\n ensures (m*a + b) % m == b % m;\r\n{\r\n if (0 == a)\r\n {\r\n assert (m*a + b) % m == b % m;\r\n } else if (0 < a) {\r\n calc {\r\n (m*a + b) % m;\r\n (m*((a-1)+1) + b) % m;\r\n { lemma_mul_is_distributive_forall(); }\r\n (m*(a-1)+m*1 + b) % m;\r\n { lemma_mul_basics_forall(); }\r\n (m*(a-1) + m + b) % m;\r\n { lemma_mod_multiples_vanish(a-1,m+b,m); }\r\n (m + b) % m;\r\n { lemma_mod_add_multiples_vanish(b, m); }\r\n b % m;\r\n }\r\n } else {\r\n calc {\r\n (m*a + b) % m;\r\n (m*((a+1)-1) + b) % m;\r\n { lemma_mul_is_distributive_forall(); }\r\n (m*(a+1)+m*-1 + b) % m;\r\n (m*(a+1) - m + b) % m;\r\n { lemma_mod_multiples_vanish(a+1,-m+b,m); }\r\n (- m + b) % m;\r\n { lemma_mod_sub_multiples_vanish(b, m); }\r\n b % m;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_add_mod_noop(x:int, y:int, m:int)\r\n requires 0 < m;\r\n ensures ((x % m) + (y % m)) % m == (x+y) % m;\r\n{\r\n calc {\r\n (x%m + y%m) % m;\r\n {\r\n lemma_fundamental_div_mod(x,m);\r\n lemma_fundamental_div_mod(y,m);\r\n }\r\n (x - m*(x/m) + y - m*(y/m)) % m;\r\n {\r\n lemma_mul_unary_negation(m,x/m);\r\n lemma_mul_unary_negation(m,y/m);\r\n }\r\n (x + m*(-(x/m)) + y + m*(-(y/m))) % m;\r\n { lemma_mod_multiples_vanish(-(x/m), x+y+m*(-(y/m)), m); }\r\n (x + y + m*(-(y/m))) % m;\r\n { lemma_mod_multiples_vanish(-(y/m), x+y, m); }\r\n (x + y) % m;\r\n }\r\n}\r\n\r\nstatic lemma lemma_mod_equivalence(x:int, y:int, m:int)\r\n requires 0 < m;\r\n ensures x % m == y % m <==> (x - y) % m == 0;\r\n{\r\n calc ==> {\r\n x % m == y % m;\r\n { lemma_fundamental_div_mod(x,m); }\r\n x - (m * (x/m)) == y % m;\r\n { lemma_fundamental_div_mod(y,m); }\r\n x - (m * (x/m)) == y - (m * (y/m));\r\n x - y == (m * (x/m)) - (m * (y/m));\r\n { lemma_mul_is_distributive_forall(); }\r\n x - y == m * (x/m - y/m);\r\n (x - y) % m == (m * (x/m - y/m)) % m;\r\n { lemma_mod_multiples_vanish(x/m - y/m, 0, m); } \r\n (x - y) % m == 0 % m;\r\n { lemma_0_mod_anything(); }\r\n (x - y) % m == 0;\r\n }\r\n\r\n var k := ((x-y)/m);\r\n calc ==> {\r\n (x - y) % m == 0;\r\n { lemma_fundamental_div_mod(x-y,m); }\r\n (x - y) - m * ((x-y)/m) == 0;\r\n (x - y) - m * k == 0;\r\n x == y + m * k;\r\n x % m == (y + m * k) % m;\r\n { lemma_mod_multiples_vanish(k, y, m); }\r\n x % m == y % m;\r\n }\r\n}\r\n\r\nstatic lemma lemma_sub_mod_noop_helper(x:int, y:int, m:int)\r\n requires 0 < m;\r\n ensures ((x % m) - (y % m)) % m == ((x % m) + (-y % m)) % m; \r\n{\r\n var minus_y := -y;\r\n var diff := ((x % m) - (y % m)) - ((x % m) + (-y % m));\r\n calc { \r\n diff % m;\r\n calc {\r\n diff;\r\n ((x % m) - (y % m)) - ((x % m) + (-y % m));\r\n -(y % m) - (-y % m);\r\n -(y % m) - (minus_y % m);\r\n { lemma_fundamental_div_mod(y,m); }\r\n -(y - m * (y/m)) - (minus_y % m);\r\n { lemma_fundamental_div_mod(minus_y,m); }\r\n - (y - m * (y/m)) - (minus_y - m * (minus_y/m));\r\n { lemma_mul_is_distributive_forall(); }\r\n m * (y/m) + m * (minus_y/m);\r\n { lemma_mul_is_distributive_forall(); }\r\n m * (y/m + minus_y/m);\r\n }\r\n (m * (y/m + minus_y/m)) % m;\r\n { lemma_mod_multiples_vanish(y/m + minus_y/m, 0, m); }\r\n 0 % m;\r\n { lemma_0_mod_anything(); }\r\n 0;\r\n }\r\n lemma_mod_equivalence((x % m) - (y % m), (x % m) + (-y % m), m);\r\n}\r\n\r\nstatic lemma lemma_sub_mod_noop(x:int, y:int, m:int)\r\n requires 0 < m;\r\n ensures ((x % m) - (y % m)) % m == (x-y) % m;\r\n{\r\n var A := -y;\r\n calc {\r\n (x-y) % m;\r\n (x+A) % m;\r\n { lemma_add_mod_noop(x, A, m); }\r\n ((x % m) + (A % m)) % m; \r\n ((x % m) + (-y % m)) % m; \r\n { lemma_sub_mod_noop_helper(x, y, m); }\r\n ((x % m) - (y % m)) % m;\r\n }\r\n}\r\n\r\nstatic lemma lemma_mod_adds(a:int, b:int, d:int)\r\n requires 0 a%d + b%d == (a+b)%d;\r\n{\r\n calc {\r\n a%d + b%d;\r\n { lemma_fundamental_div_mod(a%d+b%d, d); }\r\n d*((a%d + b%d)/d) + (a%d + b%d)%d;\r\n { lemma_add_mod_noop(a, b, d); }\r\n d*((a%d + b%d)/d) + (a+b)%d;\r\n }\r\n if ((a%d + b%d) < d)\r\n {\r\n lemma_mod_properties();\r\n assert 0 <= a%d + b%d;\r\n lemma_small_div();\r\n assert (a%d + b%d)/d == 0;\r\n lemma_mul_basics_forall();\r\n assert d*((a%d + b%d)/d) == d*0 == 0;\r\n calc {\r\n a%d + b%d;\r\n (a+b)%d + d*((a%d + b%d)/d);\r\n (a+b)%d;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_mod_neg_neg(x:int, d:int)\r\n requires d > 0;\r\n ensures x%d == (x*(1-d))%d;\r\n{\r\n calc {\r\n (x*(1-d)) % d;\r\n { lemma_mul_is_distributive_forall(); }\r\n (x - x*d) % d;\r\n { lemma_mul_unary_negation_forall(); }\r\n (x + -1*x*d) % d;\r\n { lemma_mul_is_associative_forall(); lemma_mul_is_commutative_forall(); }\r\n (x + (-x)*d) % d;\r\n { lemma_mul_is_commutative(-x,d); }\r\n (d*(-x) + x) % d;\r\n { lemma_mod_multiples_vanish(-x, x, d); }\r\n x % d;\r\n }\r\n}\r\n\r\nstatic lemma lemma_fundamental_div_mod_unique_helper(x:int, d:nat, q1:int, r1:nat, q2:int, r2:nat)\r\n requires 0 < d;\r\n requires r1 < d;\r\n requires r2 < d;\r\n requires q1 > q2;\r\n requires x == q1 * d + r1;\r\n requires x == q2 * d + r2;\r\n ensures q1 == q2;\r\n{\r\n calc ==> {\r\n true;\r\n d * q1 - d * q2 + r1 - r2 == 0;\r\n { lemma_mul_is_distributive_forall(); }\r\n d * (q1 - q2) + r1 - r2 == 0;\r\n d * (q1 - q2) == r2 - r1;\r\n { lemma_mul_increases(q1-q2, d); }\r\n r2 - r1 >= d;\r\n false;\r\n }\r\n}\r\n\r\nstatic lemma lemma_fundamental_div_mod_unique(x:int, d:nat, q1:int, r1:nat, q2:int, r2:nat)\r\n requires 0 < d;\r\n requires r1 < d;\r\n requires r2 < d;\r\n requires x == d * q1 + r1;\r\n requires x == d * q2 + r2;\r\n ensures q1 == q2;\r\n ensures r1 == r2;\r\n{\r\n if q1 == q2 {\r\n calc <==> {\r\n x == x;\r\n d * q1 + r1 == d * q2 + r2;\r\n r1 == r2;\r\n }\r\n } else {\r\n if (q1 > q2) {\r\n lemma_fundamental_div_mod_unique_helper(x, d, q1, r1, q2, r2);\r\n } else {\r\n lemma_fundamental_div_mod_unique_helper(x, d, q2, r2, q1, r1);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_fundamental_div_mod_converse(x:int, d:int, q:int, r:int)\r\n requires d != 0;\r\n requires 0 <= r < d;\r\n requires x == q * d + r;\r\n ensures q == x/d;\r\n ensures r == x%d;\r\n{\r\n if q != x / d || r != x % d {\r\n calc ==> {\r\n true;\r\n { lemma_fundamental_div_mod(x, d); }\r\n x == d * (x / d) + (x % d);\r\n x == d * (x / d) + (x % d);\r\n { lemma_mul_is_commutative_forall(); \r\n lemma_fundamental_div_mod_unique(x, d, q, r, x / d, x % d); }\r\n false;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_mod_pos_bound(x:int, m:int)\r\n decreases x;\r\n requires 0 <= x;\r\n requires 0 < m;\r\n ensures 0 <= x%m < m;\r\n{\r\n if (x < m)\r\n {\r\n lemma_mod_is_mod_recursive_forall();\r\n }\r\n else\r\n {\r\n assert 0 <= x - m;\r\n lemma_mod_is_mod_recursive_forall();\r\n lemma_mod_pos_bound(x -m, m);\r\n }\r\n}\r\n\r\n\r\nstatic lemma lemma_mul_mod_noop_left(x:int, y:int, m:int)\r\n requires 0 < m;\r\n ensures (x % m)*y % m == x*y % m;\r\n{\r\n calc {\r\n (x*y) % m;\r\n { lemma_fundamental_div_mod(x,m); }\r\n ((m*(x/m) + x%m) * y) % m;\r\n { lemma_mul_is_distributive_forall(); }\r\n ((m*(x/m))*y + (x%m)*y) % m;\r\n { lemma_mul_is_associative_forall(); }\r\n (m*((x/m)*y) + (x%m)*y) % m;\r\n { lemma_add_mod_noop(m*((x/m)*y), (x%m)*y, m); }\r\n (((m*((x/m)*y)) % m) + (((x%m)*y) % m)) % m;\r\n (((m*((x/m)*y) + 0) % m) + (((x%m)*y) % m)) % m;\r\n { lemma_mod_multiples_vanish((x/m)*y, 0, m); lemma_small_mod(0, m); }\r\n ((0 % m) + (((x%m)*y) % m)) % m;\r\n { lemma_mod_of_zero_is_zero(m); }\r\n (((x%m)*y) % m) % m;\r\n { lemma_mod_properties(); }\r\n ((x%m)*y) % m;\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_mod_noop_right(x:int, y:int, m:int)\r\n requires 0 < m;\r\n ensures x*(y % m) % m == (x*y) % m;\r\n{\r\n lemma_mul_is_commutative_forall();\r\n lemma_mul_mod_noop_left(y, x, m);\r\n}\r\n\r\nstatic lemma lemma_mul_mod_noop_general(x:int, y:int, m:int)\r\n requires 0 < m;\r\n ensures ((x % m) * y ) % m == (x * y) % m;\r\n ensures ( x * (y % m)) % m == (x * y) % m;\r\n ensures ((x % m) * (y % m)) % m == (x * y) % m;\r\n{\r\n lemma_mod_properties();\r\n lemma_mul_mod_noop_left(x, y, m);\r\n lemma_mul_mod_noop_right(x, y, m);\r\n lemma_mul_mod_noop_right(x % m, y, m);\r\n}\r\n\r\n\r\nstatic lemma lemma_mul_mod_noop(x:int, y:int, m:int)\r\n requires 0 < m;\r\n ensures (x % m) * (y % m) % m == (x*y) % m;\r\n{\r\n lemma_mul_mod_noop_general(x, y, m);\r\n}\r\n\r\nstatic lemma lemma_power_mod_noop(b:int, e:nat, m:int)\r\n decreases e;\r\n requires 0 < m;\r\n ensures power(b % m, e) % m == power(b, e) % m;\r\n{\r\n reveal_power();\r\n lemma_mod_properties();\r\n if (e > 0)\r\n {\r\n calc {\r\n power(b % m, e) % m;\r\n ((b % m) * power(b % m, e - 1)) % m;\r\n { lemma_mul_mod_noop_general(b, power(b % m, e - 1), m); }\r\n ((b % m) * (power(b % m, e - 1) % m) % m) % m;\r\n { lemma_power_mod_noop(b, e - 1, m); }\r\n ((b % m) * (power(b, e - 1) % m) % m) % m;\r\n { lemma_mul_mod_noop_general(b, power(b, e - 1), m); }\r\n (b * (power(b, e - 1)) % m) % m;\r\n (b * (power(b, e - 1))) % m;\r\n power(b, e) % m;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_mod_subtraction(x:nat, s:nat, d:nat)\r\n requires 0 0;\r\n requires x >= 0;\r\n ensures (x * m) % m == 0;\r\n decreases if x > 0 then x else -x;\r\n{\r\n lemma_mod_is_mod_recursive_forall();\r\n if (x < 0) {\r\n calc {\r\n (x * m) % m;\r\n (x * m + m) % m;\r\n (x * m + 1*m) % m;\r\n { lemma_mul_is_distributive_forall(); }\r\n ((x+1)*m) % m;\r\n { lemma_mod_multiples_basic(x+1, m); }\r\n 0;\r\n }\r\n } else if (x == 0) {\r\n calc {\r\n (x*m)%m;\r\n {\r\n assert x 0;\r\n //-requires x >= 0;\r\n ensures 1 + x / d == (d + x) / d;\r\n{\r\n var A := (d + x) / d;\r\n var Z := 1 + x / d;\r\n calc {\r\n d * A;\r\n d * ((d + x) / d);\r\n { lemma_fundamental_div_mod(d+x, d); }\r\n (d + x) - ((d + x) % d);\r\n { lemma_add_mod_noop(d, x, d); lemma_mod_properties(); } \r\n (d + x) - x % d;\r\n { lemma_fundamental_div_mod(x, d); }\r\n d + d * (x / d);\r\n { lemma_mul_is_distributive_forall(); } \r\n d * (1 + x / d);\r\n d * Z;\r\n }\r\n lemma_mul_equality_converse(A, Z, d);\r\n lemma_mul_is_commutative_forall();\r\n}\r\n\r\nstatic lemma lemma_div_minus_one(x:int, d:int)\r\n requires d > 0;\r\n ensures -1 + x / d == (-d + x) / d;\r\n{\r\n var A := (-d + x) / d;\r\n var Z := -1 + x / d;\r\n calc {\r\n d * A;\r\n d * ((-d + x) / d);\r\n { lemma_fundamental_div_mod(x-d, d); }\r\n (x - d) - ((x - d) % d);\r\n { lemma_sub_mod_noop(x, d, d); lemma_mod_properties(); } \r\n (x - d) - x % d;\r\n { lemma_fundamental_div_mod(x, d); }\r\n -d + d * (x / d);\r\n { lemma_mul_is_distributive_forall(); } \r\n d * (-1 + x / d);\r\n d * Z;\r\n }\r\n lemma_mul_equality_converse(A, Z, d);\r\n lemma_mul_is_commutative_forall();\r\n}\r\n\r\nstatic lemma lemma_mod_mod(x:int, a:int, b:int)\r\n requires 0 0;\r\n decreases if x >= 0 then x else -(x-d);\r\n ensures my_div_pos(x, d) == x / d;\r\n{\r\n if x < 0 {\r\n calc {\r\n my_div_pos(x, d);\r\n -1 + my_div_pos(x+d, d);\r\n { lemma_div_is_div_pos(x+d, d); } \r\n -1 + (x+d) / d;\r\n { lemma_div_minus_one(x+d, d); }\r\n (-d + x + d) / d;\r\n x / d;\r\n }\r\n } else if x < d {\r\n lemma_small_div();\r\n } else {\r\n calc {\r\n my_div_pos(x, d);\r\n 1 + my_div_pos(x-d, d);\r\n { lemma_div_is_div_pos(x-d, d); } \r\n 1 + (x-d) / d;\r\n { lemma_div_plus_one(x-d, d); }\r\n x / d;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_div_is_div_recursive(x:int, d:int)\r\n requires d > 0;\r\n ensures my_div_recursive(x, d) == x / d;\r\n{\r\n lemma_div_is_div_pos(x, d); \r\n\r\n\r\n//\r\n//- if d > 0 {\r\n//- lemma_div_is_div_pos(x, d); \r\n//- } else {\r\n//- calc {\r\n//- my_div_recursive(x, d);\r\n//- -1 * my_div_pos(x, -1*d);\r\n//- { lemma_div_is_div_pos(x, -1*d); }\r\n//- -1 * (x / (-1*d));\r\n//- { lemma_negative_divisor(x, d); }\r\n//- x / d;\r\n//- }\r\n//- }\r\n}\r\n\r\nstatic lemma lemma_div_is_div_recursive_forall()\r\n ensures forall x:int, d:int :: d > 0 ==> my_div_recursive(x, d) == x / d;\r\n{\r\n forall x:int, d:int | d > 0\r\n ensures my_div_recursive(x, d) == x / d;\r\n {\r\n lemma_div_is_div_recursive(x, d);\r\n }\r\n}\r\n\r\n//-/////////////////////////////////////////////////////\r\n\r\n//-/////////////////////////////////////////////////////\r\n//- Proof that mod is recursive mod\r\n//-/////////////////////////////////////////////////////\r\n\r\nstatic lemma lemma_mod_is_mod_recursive(x:int, m:int)\r\n requires m > 0;\r\n ensures my_mod_recursive(x, m) == x % m;\r\n decreases if x < 0 then -x + m else x;\r\n{\r\n\r\n if x < 0 { \r\n calc { \r\n my_mod_recursive(x, m);\r\n my_mod_recursive(x + m, m);\r\n { lemma_mod_is_mod_recursive(x + m, m); }\r\n (x + m) % m;\r\n { lemma_add_mod_noop(x, m, m); } \r\n ((x % m) + (m % m)) % m;\r\n { lemma_mod_basics(); }\r\n (x % m) % m;\r\n { lemma_mod_basics(); }\r\n x % m;\r\n }\r\n } else if x < m { \r\n lemma_small_mod(x, m);\r\n } else {\r\n calc { \r\n my_mod_recursive(x, m);\r\n my_mod_recursive(x - m, m);\r\n { lemma_mod_is_mod_recursive(x - m, m); }\r\n (x - m) % m;\r\n { lemma_sub_mod_noop(x, m, m); } \r\n ((x % m) - (m % m)) % m;\r\n { lemma_mod_basics(); }\r\n (x % m) % m;\r\n { lemma_mod_basics(); }\r\n x % m;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_mod_is_mod_recursive_forall()\r\n ensures forall x:int, d:int :: d > 0 ==> my_mod_recursive(x, d) == x % d;\r\n{\r\n forall x:int, d:int | d > 0\r\n ensures my_mod_recursive(x, d) == x % d;\r\n {\r\n lemma_mod_is_mod_recursive(x, d);\r\n }\r\n}\r\n\r\n//-/////////////////////////////////////////////////////\r\n\r\n\r\nstatic lemma lemma_basic_div(d:int)\r\n requires d > 0;\r\n ensures forall x :: 0 <= x < d ==> x / d == 0;\r\n{\r\n lemma_div_is_div_recursive_forall();\r\n}\r\n\r\nstatic lemma lemma_odd_div(d:int)\r\n requires d >= 0;\r\n requires d % 2 == 1;\r\n ensures 2 * (d / 2) + 1 == d;\r\n{\r\n lemma_div_is_div_recursive_forall();\r\n if (d >= 2)\r\n {\r\n lemma_odd_div(d - 2);\r\n }\r\n}\r\n\r\n\r\nstatic lemma lemma_div_is_ordered(x:int, y:int, z:int)\r\n requires x <= y;\r\n requires z > 0;\r\n ensures x / z <= y / z;\r\n decreases if x >= 0 then x else z - x;\r\n{\r\n if (x < 0) {\r\n calc <= {\r\n x / z;\r\n { lemma_div_is_div_recursive_forall(); }\r\n -1 + (x+z)/z;\r\n { lemma_div_is_ordered(x+z, y+z, z); }\r\n -1 + (y+z) / z;\r\n { lemma_div_is_div_recursive_forall(); }\r\n y / z;\r\n }\r\n }\r\n else if (x < z) {\r\n lemma_small_div();\r\n lemma_div_pos_is_pos(y, z);\r\n } else {\r\n calc <= {\r\n x / z;\r\n { lemma_div_is_div_recursive_forall(); }\r\n 1 + (x-z) / z;\r\n { lemma_div_is_ordered(x-z, y-z, z); }\r\n 1 + (y-z) / z;\r\n { lemma_div_is_div_recursive_forall(); }\r\n y / z;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_div_decreases(x:int, d:int)\r\n requires 0 {\r\n x <= x/d;\r\n { lemma_mul_inequality(x, x/d, d); lemma_mul_is_commutative_forall(); }\r\n d*x <= d*(x/d);\r\n d*x + x%d <= d*(x/d) + x%d;\r\n { lemma_fundamental_div_mod(x,d);\r\n assert d*(x/d) + x%d == x;\r\n }\r\n d*x + x%d <= x;\r\n { lemma_mod_properties(); }\r\n d*x <= x;\r\n false;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_div_nonincreasing(x:int, d:int)\r\n requires 0<=x;\r\n requires 0 { lemma_remainder_upper(x-divisor, divisor); }\r\n 1*divisor + ((x - divisor) - divisor);\r\n { lemma_mul_properties(); }\r\n x-divisor;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_remainder_lower(x:int, divisor:int)\r\n requires 0 <= x;\r\n requires 0 < divisor;\r\n ensures x >= x / divisor * divisor;\r\n{\r\n\r\n if (x < divisor) {\r\n lemma_mul_properties();\r\n lemma_small_div();\r\n } else {\r\n calc {\r\n x / divisor * divisor;\r\n { lemma_div_is_div_recursive_forall(); }\r\n (1 + (x-divisor) / divisor) * divisor;\r\n { lemma_mul_properties(); }\r\n 1*divisor + ((x-divisor) / divisor) * divisor;\r\n <= { lemma_remainder_lower(x-divisor, divisor); }\r\n 1*divisor + x - divisor;\r\n { lemma_mul_properties(); }\r\n x;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_remainder(x:int, divisor:int)\r\n requires 0 <= x;\r\n requires 0 < divisor;\r\n ensures 0 <= x - x / divisor * divisor < divisor;\r\n{\r\n lemma_remainder_upper(x, divisor);\r\n lemma_remainder_lower(x, divisor);\r\n}\r\n\r\n\r\nstatic lemma lemma_div_denominator(x:int,c:nat,d:nat)\r\n requires 0 <= x;\r\n requires 0= d) {\r\n lemma_fundamental_div_mod(R, c);\r\n//- assert R >= c*(R/c);\r\n lemma_mul_inequality(d, R/c, c);\r\n lemma_mul_is_commutative_forall();\r\n//- assert c*(R/c) >= c*d;\r\n//- assert R >= c*d;\r\n assert false;\r\n }\r\n assert R/c < d;\r\n\r\n lemma_mul_basics_forall();\r\n lemma_fundamental_div_mod_converse(R/c, d, 0, R/c);\r\n assert (R/c) % d == R/c;\r\n\r\n lemma_fundamental_div_mod(R, c);\r\n assert c*(R/c) + R%c == R;\r\n\r\n assert c*((R/c) % d) + R%c == R;\r\n\r\n var k := x/(c*d);\r\n lemma_fundamental_div_mod(x, c*d);\r\n assert x == (c*d)*(x/(c*d)) + x % (c*d);\r\n assert R == x - (c*d)*(x/(c*d));\r\n assert R == x - (c*d)*k;\r\n\r\n calc {\r\n c*((x/c)%d) + x%c;\r\n { lemma_mod_multiples_vanish(-k, x/c, d); lemma_mul_is_commutative_forall(); }\r\n c*((x/c+(-k)*d) % d) + x%c;\r\n { lemma_hoist_over_denominator(x, (-k)*d, c); }\r\n c*(((x+(((-k)*d)*c))/c) % d) + x%c;\r\n { lemma_mul_is_associative(-k,d,c); }\r\n c*(((x+((-k)*(d*c)))/c) % d) + x%c;\r\n { lemma_mul_unary_negation(k,d*c); }\r\n c*(((x+(-(k*(d*c))))/c) % d) + x%c;\r\n { lemma_mul_is_associative(k,d,c); }\r\n c*(((x+(-(k*d*c)))/c) % d) + x%c;\r\n c*(((x-k*d*c)/c) % d) + x%c;\r\n {\r\n lemma_mul_is_associative_forall();\r\n lemma_mul_is_commutative_forall();\r\n }\r\n c*((R/c) % d) + x%c;\r\n c*(R/c) + x%c;\r\n { lemma_fundamental_div_mod(R,c);\r\n assert R == c*(R/c) + R % c;\r\n lemma_mod_mod(x,c,d);\r\n assert R%c == x%c;\r\n }\r\n R;\r\n { lemma_mod_is_mod_recursive_forall(); }\r\n R%(c*d);\r\n (x-(c*d)*k) % (c*d);\r\n { lemma_mul_unary_negation(c*d,k); }\r\n (x+(c*d)*(-k)) % (c*d);\r\n { lemma_mod_multiples_vanish(-k, x, c*d); }\r\n x % (c*d);\r\n }\r\n calc ==> {\r\n c*(x/c) + x%c - R == c*(x/c) - c*((x/c)%d);\r\n { lemma_fundamental_div_mod(x,c); }\r\n x - R == c*(x/c) - c*((x/c)%d);\r\n }\r\n calc ==> {\r\n true;\r\n { lemma_fundamental_div_mod(x/c,d); }\r\n d*((x/c)/d) == x/c - ((x/c)%d);\r\n c*(d*((x/c)/d)) == c*(x/c - ((x/c)%d));\r\n { lemma_mul_is_associative_forall(); }\r\n (c*d)*((x/c)/d) == c*(x/c - ((x/c)%d));\r\n { lemma_mul_is_distributive_forall(); }\r\n (c*d)*((x/c)/d) == c*(x/c) - c*((x/c)%d);\r\n (c*d)*((x/c)/d) == x - R;\r\n { lemma_fundamental_div_mod(x, c*d); }\r\n (c*d)*((x/c)/d) == (c*d)*(x/(c*d)) + x%(c*d) - R;\r\n (c*d)*((x/c)/d) == (c*d)*(x/(c*d));\r\n { lemma_mul_one_to_one(c*d, (x/c)/d, x/(c*d)); }\r\n (x/c)/d == x/(c*d);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_hoist_inequality(x:int, y:int, z:int)\r\n requires 0 <= x;\r\n requires 0 < z;\r\n ensures x*(y/z) <= (x*y)/z;\r\n{\r\n calc {\r\n (x*y)/z;\r\n { lemma_fundamental_div_mod(y, z); }\r\n (x*(z*(y/z)+y%z))/z;\r\n { lemma_mul_is_distributive_forall(); }\r\n (x*(z*(y/z))+x*(y%z))/z;\r\n >= {\r\n lemma_mod_properties();\r\n lemma_mul_nonnegative(x, y%z);\r\n lemma_div_is_ordered(x*(z*(y/z)), x*(z*(y/z))+x*(y%z), z); }\r\n (x*(z*(y/z)))/z;\r\n { lemma_mul_is_associative_forall();\r\n lemma_mul_is_commutative_forall(); }\r\n (z*(x*(y/z)))/z;\r\n { lemma_div_multiples_vanish(x*(y/z), z); }\r\n x*(y/z);\r\n }\r\n}\r\n\r\nstatic lemma lemma_indistinguishable_quotients(a:int, b:int, d:int)\r\n requires 0 a/d)\r\n {\r\n calc {\r\n a - a%d + d;\r\n d*(a/d)+d;\r\n { lemma_mul_basics_forall(); }\r\n d*(a/d)+d*1;\r\n { lemma_mul_is_distributive_forall(); }\r\n d*(a/d+1);\r\n <= { lemma_mul_inequality(a/d+1, b/d, d);\r\n lemma_mul_is_commutative_forall(); }\r\n d*(b/d);\r\n <= { lemma_mod_properties(); \r\n lemma_fundamental_div_mod(b,d); }\r\n b;\r\n }\r\n assert false;\r\n }\r\n}\r\n\r\nstatic lemma lemma_truncate_middle(x:int, b:int, c:int)\r\n requires 0<=x;\r\n requires 0 {\r\n true;\r\n { lemma_fundamental_div_mod(x,c); }\r\n x == c*(x/c) + x%c;\r\n b*x == b*(c*(x/c) + x%c);\r\n { lemma_mul_is_distributive_forall(); }\r\n b*x == b*(c*(x/c)) + b*(x%c);\r\n { lemma_mul_is_associative_forall(); }\r\n b*x == (b*c)*(x/c) + b*(x%c);\r\n }\r\n}\r\n\r\nstatic lemma lemma_div_multiples_vanish_quotient(x:int, a:int, d:int)\r\n requires 0 0;\r\n ensures x / z < y / z;\r\n{\r\n lemma_div_by_multiple(m, z);\r\n assert(y / z == m);\r\n\r\n var k := x / z;\r\n var r := x - x / z * z;\r\n lemma_remainder(x, z);\r\n lemma_div_pos_is_pos(x, z);\r\n\r\n assert r >= 0;\r\n assert k*z <= k*z + r < m*z;\r\n lemma_div_by_multiple(k, z);\r\n assert (k*z) / z == k;\r\n\r\n lemma_mul_properties();\r\n\r\n calc {\r\n x / z;\r\n k;\r\n < { lemma_mul_strict_inequality_converse(k,m,z); }\r\n m;\r\n y / z;\r\n }\r\n}\r\n\r\nstatic lemma lemma_hoist_over_denominator(x:int, j:int, d:nat)\r\n requires 0 {\r\n true;\r\n { lemma_mod_properties(); }\r\n b*(a/b) % (b*c) < b*c;\r\n b*((a/b) - (c*((b*(a/b))/(b*c)))) < b*c;\r\n { lemma_mul_is_commutative_forall(); lemma_mul_strict_inequality_converse_forall(); }\r\n ((a/b) - (c*((b*(a/b))/(b*c)))) < c;\r\n ((a/b) - (c*((b*(a/b))/(b*c)))) <= c-1;\r\n { lemma_mul_is_commutative_forall(); lemma_mul_inequality_forall(); }\r\n b*((a/b) - (c*((b*(a/b))/(b*c)))) <= b*(c-1);\r\n b*(a/b) % (b*c) <= b*(c-1);\r\n }\r\n}\r\n\r\nlemma lemma_part_bound2(a:int, b:int, c:int)\r\n requires 0<=a;\r\n requires 0 c * d != 0;\r\n ensures forall x:int,c:nat,d:nat :: 0 <= x && 0 < c && 0 < d\r\n ==> (x/c)/d == x/(c*d);\r\n{\r\n lemma_mul_nonzero_forall();\r\n forall (x:int,c:nat,d:nat | 0 <= x && 0 < c && 0 < d)\r\n ensures c * d != 0;\r\n ensures (x/c)/d == x/(c*d);\r\n {\r\n lemma_div_denominator(x,c,d);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/div_boogie.i.dfy", "content": "include \"div_def.i.dfy\"\r\ninclude \"mul.i.dfy\"\r\n\r\nstatic lemma lemma_div_is_div_boogie(x:int, d:int)\r\n requires d != 0;\r\n//- ensures INTERNAL_div(x, d) == INTERNAL_div_boogie(x, d);\r\n{\r\n}\r\n\r\nstatic lemma lemma_mod_is_mod_boogie(x:int, d:int)\r\n requires d > 0;\r\n //-ensures INTERNAL_mod(x, d) == INTERNAL_mod_boogie(x, d);\r\n{\r\n}\r\n\r\n//-static lemma lemma_div_is_div_boogie_at_least_for_2(x:int)\r\n//- ensures INTERNAL_div(x, 2) == INTERNAL_div_boogie(x,2);\r\n//-{\r\n//-}\r\n//-\r\n//-static lemma lemma_div_is_div_boogie_for_4_which_is_also_a_number(x:int)\r\n//- ensures INTERNAL_div(x, 4) == INTERNAL_div_boogie(x,4);\r\n//-{\r\n//-}\r\n//-\r\n//-static lemma lemma_div_is_div_boogie_for_8_which_is_also_a_number(x:int)\r\n//- ensures INTERNAL_div(x, 8) == INTERNAL_div_boogie(x,8);\r\n//-{\r\n//-}\r\n//-\r\n//-static lemma lemma_div_is_div_boogie_for_16_which_is_also_a_number(x:int)\r\n//- ensures INTERNAL_div(x, 16) == INTERNAL_div_boogie(x,16);\r\n//-{\r\n//-}\r\n//-\r\n\r\n//-static lemma lemma_div_is_div_boogie_for_256_which_is_also_a_number(x:int)\r\n//- ensures INTERNAL_div(x, 256) == INTERNAL_div_boogie(x,256);\r\n//-{\r\n//-}\r\n//-\r\n//-static lemma lemma_div_is_div_boogie_for_65536_which_is_also_a_number(x:int)\r\n//- ensures INTERNAL_div(x, 65536) == INTERNAL_div_boogie(x,65536);\r\n//-{\r\n//-}\r\n//-\r\n//-static lemma lemma_div_is_div_boogie_for_16777216_which_is_also_a_number(x:int)\r\n//- ensures INTERNAL_div(x, 16777216) == INTERNAL_div_boogie(x,16777216);\r\n//-{\r\n//-}\r\n//-\r\n//-static lemma lemma_mod_is_mod_boogie_for_2_which_is_also_a_number(x:int)\r\n//- ensures INTERNAL_mod(x, 2) == INTERNAL_mod_boogie(x,2);\r\n//-{\r\n//-}\r\n//-\r\n//-static lemma lemma_mod_is_mod_boogie_for_4_which_is_also_a_number(x:int)\r\n//- ensures INTERNAL_mod(x, 4) == INTERNAL_mod_boogie(x,4);\r\n//-{\r\n//-}\r\n//-\r\n//-static lemma lemma_mod_is_mod_boogie_for_16_which_is_also_a_number(x:int)\r\n//- ensures INTERNAL_mod(x, 16) == INTERNAL_mod_boogie(x,16);\r\n//-{\r\n//-}\r\n//-\r\n//-static lemma lemma_mod_is_mod_boogie_for_256_which_is_also_a_number(x:int)\r\n//- ensures INTERNAL_mod(x, 256) == INTERNAL_mod_boogie(x,256);\r\n//-{\r\n//-}\r\n//-\r\n//-static lemma lemma_mod_is_mod_boogie_for_65536_which_is_also_a_number(x:int)\r\n//- ensures INTERNAL_mod(x, 65536) == INTERNAL_mod_boogie(x,65536);\r\n//-{\r\n//-}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/div_def.i.dfy", "content": "//- Specs/implements mathematical div and mod, not the C version.\r\n//- This may produce \"surprising\" results for negative values\r\n//- For example, -3 div 5 is -1 and -3 mod 5 is 2.\r\n//- Note this is consistent: -3 * -1 + 2 == 5\r\n/*\r\nstatic function mod(x:int, m:int) : int\r\n requires m > 0;\r\n decreases if x < 0 then (m - x) else x;\r\n{\r\n if x < 0 then\r\n mod(m + x, m)\r\n else if x < m then\r\n x\r\n else\r\n mod(x - m, m)\r\n}\r\n*/\r\n\r\nstatic function div(x:int, d:int) : int\r\n requires d != 0;\r\n{\r\n x/d\r\n}\r\n\r\nstatic function mod(x:int, d:int) : int\r\n requires d != 0;\r\n{\r\n x%d\r\n}\r\n\r\nstatic function div_recursive(x:int, d:int) : int\r\n requires d != 0;\r\n{ INTERNAL_div_recursive(x,d) }\r\n\r\nstatic function mod_recursive(x:int, d:int) : int\r\n requires d > 0;\r\n{ INTERNAL_mod_recursive(x,d) }\r\n\r\nstatic function mod_boogie(x:int, y:int) : int\r\n requires y != 0;\r\n{ x % y } //- INTERNAL_mod_boogie(x,y) }\r\n\r\nstatic function div_boogie(x:int, y:int) : int\r\n requires y != 0;\r\n{ x / y } //-{ INTERNAL_div_boogie(x,y) }\r\n\r\nstatic function my_div_recursive(x:int, d:int) : int\r\n requires d != 0;\r\n{\r\n if d > 0 then\r\n my_div_pos(x, d)\r\n else\r\n -1 * my_div_pos(x, -1*d)\r\n}\r\n\r\nstatic function my_div_pos(x:int, d:int) : int\r\n requires d > 0;\r\n decreases if x < 0 then (d - x) else x;\r\n{\r\n if x < 0 then\r\n -1 + my_div_pos(x+d, d)\r\n else if x < d then\r\n 0\r\n else\r\n 1 + my_div_pos(x-d, d)\r\n}\r\n\r\nstatic function my_mod_recursive(x:int, m:int) : int\r\n requires m > 0;\r\n decreases if x < 0 then (m - x) else x;\r\n{\r\n if x < 0 then\r\n my_mod_recursive(m + x, m)\r\n else if x < m then\r\n x\r\n else\r\n my_mod_recursive(x - m, m)\r\n}\r\n\r\n\r\n//- Kept for legacy reasons:\r\n//-static function INTERNAL_mod_boogie(x:int, m:int) : int { x % y }\r\nstatic function INTERNAL_mod_recursive(x:int, m:int) : int \r\n requires m > 0;\r\n{ my_mod_recursive(x, m) }\r\n\r\n//-static function INTERNAL_div_boogie(x:int, m:int) : int { x / m }\r\nstatic function INTERNAL_div_recursive(x:int, d:int) : int \r\n requires d != 0;\r\n{ my_div_recursive(x, d) }\r\n\r\n\r\n/*\r\nstatic ghost method mod_test()\r\n{\r\n assert -3 % 5 == 2;\r\n assert 10 % -5 == 0;\r\n assert 1 % -5 == 1;\r\n assert -3 / 5 == -1;\r\n}\r\n*/\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/div_nonlinear.i.dfy", "content": "//- \r\n//- WARNING: In general, you shouldn't need to call these directly. Try\r\n//- to use the ones in div.i.dfy instead. They're more full-featured anyway.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nstatic lemma lemma_div_of_0(d:int)\r\n requires d != 0;\r\n ensures 0/d == 0;\r\n{ }\r\n\r\nstatic lemma lemma_div_by_self(d:int)\r\n requires d != 0;\r\n ensures d/d == 1;\r\n{ }\r\n\r\nstatic lemma lemma_small_div()\r\n ensures forall x, d :: 0 <= x < d && d > 0 ==> x / d == 0;\r\n{ }\r\n\r\nstatic lemma lemma_mod_of_zero_is_zero(m:int)\r\n requires 0 < m;\r\n ensures 0 % m == 0;\r\n{ }\r\n\r\nstatic lemma lemma_fundamental_div_mod(x:int, d:int)\r\n requires d != 0;\r\n ensures x == d * (x/d) + (x%d);\r\n{ }\r\n\r\nstatic lemma lemma_0_mod_anything()\r\n ensures forall m:int :: m > 0 ==> 0 % m == 0;\r\n{ }\r\n\r\nstatic lemma lemma_mod_yourself(m:int)\r\n ensures m > 0 ==> m % m == 0;\r\n{ }\r\n\r\nstatic lemma lemma_small_mod(x:nat, m:nat)\r\n requires x 0;\r\n ensures 0 <= x % m < m;\r\n{ }\r\n\r\nstatic lemma lemma_real_div_gt(x:real, y:real)\r\n requires x > y;\r\n requires x >= 0.0;\r\n requires y > 0.0;\r\n ensures x / y > real(1);\r\n{ }\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/evenodd.i.dfy", "content": "include \"mul.i.dfy\"\r\ninclude \"div.i.dfy\"\r\n\r\nstatic function IsEven(x:int) : bool\r\n{\r\n exists y:int :: mul(y, 2) == x\r\n}\r\n\r\nstatic lemma lemma_no_half(i:int)\r\n ensures 2*i != 1;\r\n{\r\n/*\r\n if (i==0)\r\n {\r\n }\r\n else if (i>0)\r\n {\r\n lemma_mul_increases(i,2);\r\n assert 2<=mul(i,2);\r\n lemma_mul_is_commutative_forall();\r\n assert 2 <= 2*i;\r\n assert 1 != 2*i;\r\n }\r\n else\r\n {\r\n var mi:int := -i;\r\n assert 0= -1*mul(mi,2);\r\n lemma_mul_is_mul_boogie(-1,mul(mi,2));\r\n lemma_mul_is_associative_forall();\r\n assert -2 >= mul(mul(-1,mi),2);\r\n assert mul(mul(-1,mi),2) <= -2;\r\n assert 2*i <= -2;\r\n assert 2*i <= 2*(-1);\r\n lemma_mul_inequality_converse_forall();\r\n assert 2*i <= -1;\r\n }\r\n*/\r\n}\r\n\r\n//-datatype IntDivResult = IntDivResult_c(q:int, r:int);\r\n//-\r\n//-function DivMod(x:int, d:int) : IntDivResult\r\n//- requires d>0;\r\n//- ensures d*DivMod(x,d).q+DivMod(x,d).r == x;\r\n//- ensures 0<=DivMod(x,d).r (mod(x, 2) == 0);\r\n{\r\n lemma_mod_is_mod_boogie(x, 2);\r\n if (IsEven(x))\r\n {\r\n var y:int :| mul(y, 2) == x;\r\n lemma_mul_is_mul_boogie(y, 2);\r\n assert mod(x, 2) == 0;\r\n }\r\n if (mod(x, 2) == 0)\r\n {\r\n lemma_mul_is_mul_boogie(x / 2, 2);\r\n assert mul(x / 2, 2) == x;\r\n assert IsEven(x);\r\n }\r\n/*\r\n var q:int,r:int := DivMod(x,2);\r\n lemma_mul_is_mul_boogie(2,q);\r\n assert 2*q+r == mul(2,q)+r == x;\r\n assert 0<=r<2;\r\n assert r==mod(x,2);\r\n\r\n if (mod(x,2) == 0)\r\n {\r\n assert r == 0;\r\n assert 2*q == x;\r\n lemma_mul_is_commutative(2,q);\r\n assert q*2 == x;\r\n assert IsEven(x);\r\n }\r\n else\r\n {\r\n assert r == 1;\r\n assert 2*q+1 == x;\r\n assert 1 == x-2*q;\r\n if (IsEven(x))\r\n {\r\n var y:int :| y*2 == x;\r\n lemma_mul_is_commutative(2,y);\r\n assert 2*y == x;\r\n assert 1 == 2*y - 2*q;\r\n lemma_mul_is_distributive_sub(2,y,q);\r\n assert 1 == 2*(y - q);\r\n var z:int := y - q;\r\n assert 1 == 2*z;\r\n lemma_no_half(z);\r\n assert false;\r\n }\r\n assert !IsEven(x);\r\n }\r\n*/\r\n}\r\n\r\nstatic lemma lemma_x_odd(x:int)\r\n requires 0 <= x;\r\n requires !IsEven(x);\r\n ensures mod(x,2)==1;\r\n{\r\n lemma_even_mod_0_pos(x);\r\n assert mod(x,2) != 0;\r\n lemma_mod_pos_bound(x,2);\r\n assert mod(x,2) < 2;\r\n assert mod(x,2) == 1;\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/mul.i.dfy", "content": "include \"mul_nonlinear.i.dfy\"\r\n\r\nstatic function mul(x:int, y:int) : int { x*y }\r\n\r\n//-////////////////////////////////////////////////////////////\r\n//- Recursive definitions that can be handy for proving \r\n//- properties we can't or don't want to rely on nonlinear for\r\n//-////////////////////////////////////////////////////////////\r\n\r\nstatic function mul_recursive(x:int, y:int) : int\r\n{\r\n if x >= 0 then mul_pos(x, y)\r\n else -1*mul_pos(-1*x, y)\r\n}\r\n\r\nstatic function mul_pos(x:int, y:int) : int\r\n requires x >= 0;\r\n{\r\n if x == 0 then 0\r\n else y + mul_pos(x - 1, y)\r\n}\r\n\r\nstatic lemma lemma_mul_is_mul_recursive(x:int, y:int)\r\n ensures x * y == mul_recursive(x, y);\r\n{\r\n if x >= 0 {\r\n lemma_mul_is_mul_pos(x, y);\r\n } else {\r\n var neg_x := -1 * x;\r\n calc {\r\n mul_recursive(x, y);\r\n -1 * mul_pos(-1*x, y);\r\n -1 * mul_pos(neg_x, y);\r\n { lemma_mul_is_mul_pos(neg_x, y); }\r\n -1 * (neg_x * y);\r\n { lemma_mul_is_associative(-1, neg_x, y); }\r\n (-1 * neg_x) * y;\r\n { lemma_mul_is_associative(-1, -1, x); }\r\n ((-1 * -1) * x) * y;\r\n x * y;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_is_mul_pos(x:int, y:int)\r\n requires x >= 0;\r\n ensures x * y == mul_pos(x, y);\r\n{\r\n if x == 0 {\r\n } else {\r\n calc {\r\n y + mul_pos(x - 1, y);\r\n { lemma_mul_is_mul_pos(x - 1, y); }\r\n y + (x-1)*y;\r\n 1*y + (x-1)*y;\r\n { lemma_mul_is_commutative_forall(); lemma_mul_is_distributive_add(y, 1, x-1); }\r\n (1 + x - 1) * y;\r\n x * y;\r\n }\r\n }\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//-\r\n//- Core lemmas, with named arguments.\r\n//-\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic lemma lemma_mul_basics(x:int)\r\n ensures 0*x == 0;\r\n ensures x*0 == 0;\r\n ensures 1*x == x;\r\n ensures x*1 == x;\r\n{\r\n}\r\n\r\nstatic lemma lemma_mul_is_commutative(x:int, y:int)\r\n ensures x*y == y*x;\r\n{\r\n}\r\n\r\nstatic lemma lemma_mul_ordering_general()\r\n ensures forall x:int, y:int, b:int :: (0 < x && 0 < y && 0 <= x*y < b) ==> x < b && y < b;\r\n{\r\n forall x:int, y:int, b:int | 0 < x && 0 < y && 0 <= x*y < b\r\n ensures x < b && y < b;\r\n {\r\n lemma_mul_ordering(x, y, b);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_is_mul_boogie(x:int, y:int)\r\n{\r\n}\r\n\r\nstatic lemma lemma_mul_inequality(x:int, y:int, z:int)\r\n requires x <= y;\r\n requires z >= 0;\r\n ensures x*z <= y*z;\r\n{\r\n if z == 0 {\r\n } else {\r\n if (x == y) {\r\n } else {\r\n lemma_mul_strict_inequality(x, y, z);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_upper_bound(x:int, x_bound:int, y:int, y_bound:int)\r\n requires x <= x_bound;\r\n requires y <= y_bound;\r\n requires 0<=x;\r\n requires 0<=y;\r\n ensures x*y <= x_bound * y_bound;\r\n{\r\n lemma_mul_inequality(x, x_bound, y);\r\n lemma_mul_inequality(y, y_bound, x_bound);\r\n}\r\n\r\n//- This lemma is less precise than the non-strict version, since\r\n//- it uses two < facts to achieve only one < result. Thus, use it with\r\n//- caution -- it may be throwing away precision you'll require later.\r\nstatic lemma lemma_mul_strict_upper_bound(x:int, x_bound:int, y:int, y_bound:int)\r\n requires x < x_bound;\r\n requires y < y_bound;\r\n requires 0<=x;\r\n requires 0<=y;\r\n ensures x*y < x_bound * y_bound;\r\n{\r\n if (y_bound==1)\r\n {\r\n lemma_mul_strictly_positive(x_bound, y_bound);\r\n }\r\n else\r\n {\r\n calc\r\n {\r\n x*y;\r\n <= { lemma_mul_upper_bound(x, x_bound-1, y, y_bound-1); }\r\n (x_bound-1)*(y_bound-1);\r\n < { lemma_mul_strict_inequality(x_bound-1, x_bound, y_bound-1); }\r\n (y_bound-1)*x_bound;\r\n < { lemma_mul_strict_inequality(y_bound-1, y_bound, x_bound); }\r\n x_bound * y_bound;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_left_inequality(x:int, y:int, z:int)\r\n requires x > 0;\r\n ensures y <= z ==> x*y <= x*z;\r\n ensures y < z ==> x*y < x*z;\r\n{\r\n lemma_mul_is_commutative_forall();\r\n lemma_mul_inequality_forall();\r\n lemma_mul_strict_inequality_forall();\r\n}\r\n\r\nstatic lemma lemma_mul_strict_inequality_converse(x:int, y:int, z:int)\r\n requires x*z < y*z;\r\n requires z >= 0;\r\n ensures x < y;\r\n{\r\n if (x >= y)\r\n {\r\n lemma_mul_inequality(y, x, z);\r\n assert false;\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_inequality_converse(x:int, y:int, z:int)\r\n requires x*z <= y*z;\r\n requires z > 0;\r\n ensures x <= y;\r\n{\r\n if (x > y)\r\n {\r\n lemma_mul_strict_inequality(y, x, z);\r\n assert false;\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_equality_converse(x:int, y:int, z:int)\r\n requires x*z == y*z;\r\n requires 0=0 then x else -1*x;\r\n{\r\n lemma_mul_is_mul_recursive_forall();\r\n if (x == 0) {\r\n } else if (x > 0) {\r\n lemma_mul_is_distributive_sub(x - 1, y, z);\r\n } else {\r\n lemma_mul_is_distributive_sub(x + 1, y, z);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_is_distributive(x:int, y:int, z:int)\r\n ensures x*(y + z) == x*y + x*z;\r\n ensures x*(y - z) == x*y - x*z;\r\n ensures (y + z)*x == y*x + z*x;\r\n ensures (y - z)*x == y*x - z*x;\r\n ensures x*(y + z) == (y + z)*x;\r\n ensures x*(y - z) == (y - z)*x;\r\n ensures x*y == y*x;\r\n ensures x*z == z*x;\r\n{\r\n lemma_mul_is_distributive_add(x, y, z);\r\n lemma_mul_is_distributive_sub(x, y, z);\r\n lemma_mul_is_commutative_forall();\r\n}\r\n\r\nstatic lemma lemma_mul_strictly_increases(x:int, y:int)\r\n requires 1 < x;\r\n requires 0 < y;\r\n ensures y < x*y;\r\n{\r\n if (1 < x && 0 < y)\r\n {\r\n lemma_mul_strict_inequality(1,x,y);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_increases(x:int, y:int)\r\n requires 0y)\r\n {\r\n lemma_mul_strict_inequality(y,x,m);\r\n assert m*y < m*x;\r\n }\r\n assert x==y;\r\n}\r\n\r\nstatic lemma lemma_mul_one_to_one(m:int, x:int, y:int)\r\n requires m!=0;\r\n requires m*x == m*y;\r\n ensures x == y;\r\n{\r\n if (m>0)\r\n {\r\n lemma_mul_one_to_one_pos(m,x,y);\r\n }\r\n else\r\n {\r\n lemma_mul_unary_negation(m,x);\r\n lemma_mul_unary_negation(m,y);\r\n lemma_mul_one_to_one_pos(-m,x,y);\r\n }\r\n}\r\n\r\n\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//-\r\n//- Forall lemmas: these restate the core lemmas with foralls,\r\n//- so callers needn't name the specific expressions to manipulate.\r\n//-\r\n//- These are all boilerplate transformations of args/requires/ensures\r\n//- into forall args :: requires ==> ensures, with a correpsonding\r\n//- mechanically generated forall proof that invokes the core lemma.\r\n\r\n//-\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic lemma lemma_mul_is_mul_recursive_forall()\r\n ensures forall x:int, y:int :: x * y == mul_recursive(x, y);\r\n{\r\n forall x:int, y:int\r\n ensures x * y == mul_recursive(x, y);\r\n {\r\n lemma_mul_is_mul_recursive(x, y);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_basics_forall()\r\n ensures forall x:int :: 0*x == 0;\r\n ensures forall x:int :: x*0 == 0;\r\n ensures forall x:int :: 1*x == x;\r\n ensures forall x:int :: x*1 == x;\r\n{\r\n}\r\n\r\nstatic lemma lemma_mul_is_commutative_forall()\r\n ensures forall x:int, y:int :: x*y == y*x;\r\n{\r\n}\r\n\r\nstatic lemma lemma_mul_ordering_forall()\r\n ensures forall x:int, y:int, b:int ::\r\n 0 < x && 0 < y && 0 <= x*y < b\r\n ==> x < b && y < b;\r\n{\r\n forall (x:int, y:int, b:int | 0 < x && 0 < y && 0 <= x*y < b)\r\n ensures x < b && y < b;\r\n {\r\n lemma_mul_ordering(x,y,b);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_strict_inequality_forall()\r\n ensures forall x:int, y:int, z:int ::\r\n x < y && z>0 ==> x*z < y*z;\r\n{\r\n forall (x:int, y:int, z:int | x < y && z>0)\r\n ensures x*z < y*z;\r\n {\r\n lemma_mul_strict_inequality(x, y, z);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_inequality_forall()\r\n ensures forall x:int, y:int, z:int ::\r\n x <= y && z>=0 ==> x*z <= y*z;\r\n{\r\n forall (x:int, y:int, z:int | x <= y && z>=0)\r\n ensures x*z <= y*z;\r\n {\r\n lemma_mul_inequality(x, y, z);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_strict_inequality_converse_forall()\r\n ensures forall x:int, y:int, z:int ::\r\n x*z < y*z && z>=0 ==> x < y;\r\n{\r\n forall (x:int, y:int, z:int | x*z < y*z && z>=0)\r\n ensures x < y;\r\n {\r\n lemma_mul_strict_inequality_converse(x,y,z);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_inequality_converse_forall()\r\n ensures forall x:int, y:int, z:int ::\r\n x*z <= y*z && z>0 ==> x <= y;\r\n{\r\n forall (x:int, y:int, z:int | x*z <= y*z && z>0)\r\n ensures x <= y;\r\n {\r\n lemma_mul_inequality_converse(x,y,z);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_is_distributive_add_forall()\r\n ensures forall x:int, y:int, z:int :: x*(y + z) == x*y + x*z;\r\n{\r\n forall (x:int, y:int, z:int)\r\n ensures x*(y + z) == x*y + x*z;\r\n {\r\n lemma_mul_is_distributive_add(x,y,z);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_is_distributive_sub_forall()\r\n ensures forall x:int, y:int, z:int :: x*(y - z) == x*y - x*z;\r\n{\r\n forall (x:int, y:int, z:int)\r\n ensures x*(y - z) == x*y - x*z;\r\n {\r\n lemma_mul_is_distributive_sub(x,y,z);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_is_distributive_forall()\r\n ensures forall x:int, y:int, z:int :: x*(y + z) == x*y + x*z;\r\n ensures forall x:int, y:int, z:int :: x*(y - z) == x*y - x*z;\r\n ensures forall x:int, y:int, z:int :: (y + z)*x == y*x + z*x;\r\n ensures forall x:int, y:int, z:int :: (y - z)*x == y*x - z*x;\r\n{\r\n lemma_mul_is_distributive_add_forall();\r\n lemma_mul_is_distributive_sub_forall();\r\n lemma_mul_is_commutative_forall();\r\n}\r\n\r\nstatic lemma lemma_mul_is_associative_forall()\r\n ensures forall x:int, y:int, z:int :: x * (y * z) == (x * y) * z;\r\n{\r\n forall (x:int, y:int, z:int)\r\n ensures x * (y * z) == (x * y) * z;\r\n {\r\n lemma_mul_is_associative(x,y,z);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_nonzero_forall()\r\n ensures forall x:int, y:int :: x*y != 0 <==> x != 0 && y != 0;\r\n{\r\n forall (x:int, y:int)\r\n ensures x*y != 0 <==> x != 0 && y != 0;\r\n {\r\n lemma_mul_nonzero(x,y);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_nonnegative_forall()\r\n ensures forall x:int, y:int :: 0 <= x && 0 <= y ==> 0 <= x*y;\r\n{\r\n forall (x:int, y:int | 0 <= x && 0 <= y)\r\n ensures 0 <= x*y;\r\n {\r\n lemma_mul_nonnegative(x,y);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_unary_negation_forall()\r\n ensures forall x:int, y:int :: (-x)*y == -(x*y) == x*(-y);\r\n{\r\n forall (x:int, y:int) \r\n ensures (-x)*y == -(x*y) == x*(-y);\r\n {\r\n lemma_mul_unary_negation(x,y);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_strictly_increases_forall()\r\n ensures forall x:int, y:int :: (1 < x && 0 < y) ==> (y < x*y);\r\n{\r\n forall (x:int, y:int | 1 < x && 0 < y)\r\n ensures y < x*y;\r\n {\r\n lemma_mul_strictly_increases(x,y);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_increases_forall()\r\n ensures forall x:int, y:int :: (0 < x && 0 < y) ==> (y <= x*y);\r\n{\r\n forall (x:int, y:int | 0 < x && 0 < y)\r\n ensures y <= x*y;\r\n {\r\n lemma_mul_increases(x,y);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_strictly_positive_forall()\r\n ensures forall x:int, y:int :: (0 < x && 0 < y) ==> (0 < x*y);\r\n{\r\n forall (x:int, y:int | 0 < x && 0 < y)\r\n ensures 0 < x*y;\r\n {\r\n lemma_mul_strictly_positive(x,y);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mul_one_to_one_forall()\r\n ensures forall m:int, x:int, y:int :: (m!=0 && m*x == m*y) ==> x==y;\r\n{\r\n forall (m:int, x:int, y:int | m!=0 && m*x == m*y)\r\n ensures x==y;\r\n {\r\n lemma_mul_one_to_one(m, x, y);\r\n }\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n//\r\n\r\n\r\n\r\n\r\n//\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic lemma lemma_mul_properties()\r\n ensures forall x:int, y:int :: x*y == y*x;\r\n ensures forall x:int :: x*0 == 0*x == 0;\r\n ensures forall x:int :: x*1 == 1*x == x;\r\n ensures forall x:int, y:int, z:int :: x < y && z > 0 ==> x*z < y*z;\r\n ensures forall x:int, y:int, z:int :: x <= y && z >= 0 ==> x*z <= y*z;\r\n ensures forall x:int, y:int, z:int :: x*(y + z) == x*y + x*z;\r\n ensures forall x:int, y:int, z:int :: x*(y - z) == x*y - x*z;\r\n ensures forall x:int, y:int, z:int :: (y + z)*x == y*x + z*x;\r\n ensures forall x:int, y:int, z:int :: (y - z)*x == y*x - z*x;\r\n ensures forall x:int, y:int, z:int :: x*y*z == x*y*z;\r\n ensures forall x:int, y:int :: x*y != 0 <==> x != 0 && y != 0;\r\n ensures forall x:int, y:int :: 0 <= x && 0 <= y ==> 0 <= x*y;\r\n ensures forall x:int, y:int, b:int :: 0 < x && 0 < y && 0 <= x*y < b ==> x < b && y < b;\r\n ensures forall x:int, y:int :: (1 < x && 0 < y) ==> (y < x*y);\r\n ensures forall x:int, y:int :: (0 < x && 0 < y) ==> (y <= x*y);\r\n ensures forall x:int, y:int :: (0 < x && 0 < y) ==> (0 < x*y);\r\n{\r\n lemma_mul_strict_inequality_forall();\r\n lemma_mul_inequality_forall();\r\n lemma_mul_is_distributive_forall();\r\n lemma_mul_is_associative_forall();\r\n lemma_mul_ordering_forall();\r\n lemma_mul_nonzero_forall();\r\n lemma_mul_nonnegative_forall();\r\n lemma_mul_strictly_increases_forall();\r\n lemma_mul_increases_forall();\r\n}\r\n\r\nlemma lemma_mul_cancels_negatives(a:int, b:int)\r\n ensures a*b == (-a)*(-b);\r\n{\r\n lemma_mul_properties();\r\n}\r\n\r\n//- Kept for legacy reasons:\r\nstatic function INTERNAL_mul_recursive(x:int, y:int) : int { mul_recursive(x, y) }\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/mul_nonlinear.i.dfy", "content": "//- \r\n//- WARNING: In general, you shouldn't need to call these directly. Try\r\n//- to use the ones in mul.i.dfy instead. They're more full-featured anyway.\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nstatic lemma lemma_mul_strictly_positive(x:int, y:int)\r\n ensures (0 < x && 0 < y) ==> (0 < x*y);\r\n{}\r\n\r\nstatic lemma lemma_mul_nonzero(x:int, y:int)\r\n ensures x*y != 0 <==> x != 0 && y != 0;\r\n{}\r\n\r\nstatic lemma lemma_mul_is_associative(x:int, y:int, z:int)\r\n ensures x * (y * z) == (x * y) * z;\r\n{}\r\n\r\nstatic lemma lemma_mul_is_distributive_add(x:int, y:int, z:int)\r\n ensures x*(y + z) == x*y + x*z;\r\n{}\r\n\r\nstatic lemma lemma_mul_ordering(x:int, y:int, b:int)\r\n requires 0 < x;\r\n requires 0 < y;\r\n requires 0 <= x*y < b;\r\n ensures x < b && y < b;\r\n{ }\r\n\r\nstatic lemma lemma_mul_strict_inequality(x:int, y:int, z:int)\r\n requires x < y;\r\n requires z > 0;\r\n ensures x*z < y*z;\r\n{}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/power.i.dfy", "content": "include \"power.s.dfy\"\r\ninclude \"mul.i.dfy\"\r\n\r\n//-lemma lemma_mul_passes_harmlessly_through_mod(\r\n//- ensures mul(x,y) % m == mul(x\r\n\r\nstatic lemma lemma_power_0(b:int)\r\n ensures power(b,0) == 1;\r\n{\r\n reveal_power();\r\n}\r\n\r\nstatic lemma lemma_power_1(b:int)\r\n ensures power(b,1) == b;\r\n{\r\n calc {\r\n power(b,1);\r\n { reveal_power(); }\r\n b*power(b,0);\r\n { lemma_power_0(b); }\r\n b*1;\r\n { lemma_mul_basics_forall(); }\r\n b;\r\n }\r\n}\r\n\r\nstatic lemma lemma_0_power(e:nat)\r\n requires e > 0;\r\n ensures power(0,e) == 0;\r\n{\r\n reveal_power();\r\n lemma_mul_basics_forall();\r\n if (e != 1)\r\n {\r\n lemma_0_power(e - 1);\r\n }\r\n}\r\n\r\nstatic lemma lemma_1_power(e:nat)\r\n ensures power(1,e) == 1;\r\n{\r\n reveal_power();\r\n lemma_mul_basics_forall();\r\n if (e != 0)\r\n {\r\n lemma_1_power(e - 1);\r\n }\r\n}\r\n\r\nstatic lemma lemma_power_adds(b:int, e1:nat, e2:nat)\r\n decreases e1;\r\n ensures power(b,e1)*power(b,e2) == power(b,e1+e2);\r\n{\r\n if (e1==0)\r\n {\r\n calc {\r\n power(b,e1)*power(b,e2);\r\n { lemma_power_0(b); }\r\n 1*power(b,e2);\r\n { lemma_mul_basics_forall(); }\r\n power(b,0+e2);\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n power(b,e1)*power(b,e2);\r\n { reveal_power(); }\r\n (b*power(b,e1-1))*power(b,e2);\r\n { lemma_mul_is_associative_forall(); }\r\n b*(power(b,e1-1)*power(b,e2));\r\n { lemma_power_adds(b, e1-1, e2); }\r\n b*power(b,e1-1+e2);\r\n { reveal_power(); }\r\n power(b,e1+e2);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_power_multiplies(a:nat,b:nat,c:nat)\r\n decreases c;\r\n ensures 0<=b*c;\r\n ensures power(a,b*c) == power(power(a,b),c);\r\n{\r\n lemma_mul_nonnegative(b,c);\r\n if (0==c)\r\n {\r\n lemma_mul_basics_forall();\r\n calc {\r\n power(a,b*c);\r\n { lemma_power_0(a); }\r\n 1;\r\n { lemma_power_0(power(a,b)); }\r\n power(power(a,b),c);\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n b*c - b;\r\n { lemma_mul_basics_forall(); }\r\n b*c - mul(b,1);\r\n { lemma_mul_is_distributive_forall(); }\r\n b*(c-1);\r\n }\r\n lemma_mul_nonnegative(b,c-1);\r\n assert 0 <= b*c-b;\r\n\r\n calc {\r\n power(a,b*c);\r\n power(a,b+b*c-b);\r\n { lemma_power_adds(a,b,b*c-b); }\r\n power(a,b)*power(a,b*c-b);\r\n power(a,b)*power(a,b*(c-1));\r\n { lemma_power_multiplies(a,b,c-1); }\r\n power(a,b)*power(power(a,b),c-1);\r\n { reveal_power(); }\r\n power(power(a,b),c);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_power_distributes(a:int, b:int, e:nat)\r\n decreases e;\r\n ensures power(a*b, e) == power(a, e) * power(b, e);\r\n{\r\n reveal_power();\r\n lemma_mul_basics_forall();\r\n if (e > 0)\r\n {\r\n calc {\r\n power(a*b, e);\r\n (a*b) * power(a*b, e - 1);\r\n { lemma_power_distributes(a, b, e - 1); }\r\n (a*b) * (power(a, e - 1) * power(b, e - 1));\r\n { lemma_mul_is_associative_forall(); lemma_mul_is_commutative_forall(); }\r\n (a*power(a, e - 1)) * (b*power(b, e - 1));\r\n power(a,e) * power(b,e);\r\n }\r\n lemma_mul_is_distributive_forall();\r\n }\r\n}\r\n\r\nstatic lemma lemma_power_positive(b:int, e:nat)\r\n decreases e;\r\n requires 0 {\r\n lemma_power_positive(b,e-1);\r\n lemma_mul_strictly_positive_forall();\r\n }\r\n 0;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_power_increases(b:nat,e1:nat,e2:nat)\r\n requires 0 0;\r\n{\r\n if (exp==0) then\r\n 1\r\n else\r\n 2*power2(exp-1)\r\n}\r\n*/\r\n\r\nstatic lemma lemma_power2_strictly_increases(e1: int, e2: int)\r\n requires 0 <= e1 < e2;\r\n ensures power2(e1) < power2(e2);\r\n decreases e2;\r\n{\r\n if e1+1 == e2 {\r\n reveal_power2();\r\n } else {\r\n reveal_power2();\r\n lemma_power2_strictly_increases(e1, e2-1);\r\n }\r\n}\r\n\r\nstatic lemma lemma_power2_increases(e1: int, e2: int)\r\n requires 0 <= e1 <= e2;\r\n ensures power2(e1) <= power2(e2);\r\n decreases e2;\r\n{\r\n if e2 == e1 {\r\n } else {\r\n reveal_power2();\r\n lemma_power2_increases(e1, e2-1);\r\n }\r\n}\r\n\r\nstatic lemma lemma_power2_positive()\r\n ensures forall e:nat :: 0 < power2(e);\r\n{\r\n forall (e:nat)\r\n ensures 0 < power2(e);\r\n {\r\n lemma_power2_0_is_1();\r\n lemma_power2_increases(0,e);\r\n }\r\n}\r\n\r\nstatic lemma lemma_power2_nonzero_bigger_than_one()\r\n ensures forall e:nat :: 0 1 < power2(e);\r\n{\r\n forall (e:nat | 0= e2)\r\n {\r\n lemma_power2_increases(e2, e1);\r\n assert false;\r\n }\r\n}\r\n\r\nstatic lemma lemma_power2_increases_converse(e1: int, e2: int)\r\n requires 0 < e1;\r\n requires 0 < e2;\r\n requires power2(e1) <= power2(e2);\r\n ensures e1 <= e2;\r\n{\r\n if (e1 > e2) {\r\n lemma_power2_strictly_increases(e2, e1);\r\n assert false;\r\n }\r\n}\r\n\r\nstatic lemma lemma_power2_adds(e1:nat, e2:nat)\r\n decreases e2;\r\n ensures power2(e1 + e2) == power2(e1) * power2(e2);\r\n{\r\n if e2 == 0 {\r\n lemma_mul_properties();\r\n reveal_power2();\r\n } else {\r\n var e2min1 := e2 - 1;\r\n calc {\r\n power2(e1 + e2);\r\n { reveal_power2(); }\r\n power2(e1 + e2 - 1) * 2;\r\n power2(e1 + e2min1) * 2;\r\n { lemma_power2_adds(e1, e2min1); }\r\n (power2(e1) * power2(e2min1)) * 2;\r\n { lemma_mul_is_associative(power2(e1), power2(e2min1), 2); }\r\n (power2(e1) * (power2(e2min1) * 2));\r\n {\r\n assert e2!=0;\r\n reveal_power2();\r\n assert power2(e2min1) * 2 == power2(e2);\r\n }\r\n power2(e1) * power2(e2);\r\n }\r\n assert power2(e1 + e2) == power2(e1) * power2(e2);\r\n }\r\n}\r\n\r\nstatic lemma lemma_power2_div_is_sub(x:int, y:int)\r\n requires 0 <= x <= y;\r\n ensures power2(y - x) == power2(y) / power2(x) >= 0;\r\n{\r\n calc {\r\n power2(y) / power2(x);\r\n { lemma_power2_adds(y-x, x); }\r\n (power2(y-x)*power2(x)) / power2(x);\r\n { lemma_div_by_multiple(power2(y-x), power2(x)); }\r\n power2(y-x);\r\n }\r\n}\r\n\r\nstatic lemma lemma_2toX32()\r\n ensures power2(0) == 0x1;\r\n ensures power2(1) == 0x2;\r\n ensures power2(2) == 0x4;\r\n ensures power2(3) == 0x8;\r\n ensures power2(4) == 0x10;\r\n ensures power2(5) == 0x20;\r\n ensures power2(6) == 0x40;\r\n ensures power2(7) == 0x80;\r\n ensures power2(8) == 0x100;\r\n ensures power2(9) == 0x200;\r\n ensures power2(10) == 0x400;\r\n ensures power2(11) == 0x800;\r\n ensures power2(12) == 0x1000;\r\n ensures power2(13) == 0x2000;\r\n ensures power2(14) == 0x4000;\r\n ensures power2(15) == 0x8000;\r\n ensures power2(16) == 0x10000;\r\n ensures power2(17) == 0x20000;\r\n ensures power2(18) == 0x40000;\r\n ensures power2(19) == 0x80000;\r\n ensures power2(20) == 0x100000;\r\n ensures power2(21) == 0x200000;\r\n ensures power2(22) == 0x400000;\r\n ensures power2(23) == 0x800000;\r\n ensures power2(24) == 0x1000000;\r\n ensures power2(25) == 0x2000000;\r\n ensures power2(26) == 0x4000000;\r\n ensures power2(27) == 0x8000000;\r\n ensures power2(28) == 0x10000000;\r\n ensures power2(29) == 0x20000000;\r\n ensures power2(30) == 0x40000000;\r\n ensures power2(31) == 0x80000000;\r\n ensures power2(32) == 0x100000000;\r\n{\r\n reveal_power2();\r\n}\r\n\r\nstatic lemma lemma_2toX()\r\n ensures power2(64) == 18446744073709551616;\r\n ensures power2(60) == 1152921504606846976;\r\n ensures power2(32) == 4294967296;\r\n ensures power2(24) == 16777216;\r\n ensures power2(19) == 524288;\r\n ensures power2(16) == 65536;\r\n ensures power2(8) == 256;\r\n{\r\n lemma_2to32();\r\n lemma_2to64();\r\n}\r\n\r\nstatic lemma lemma_power2_add8(n:int)\r\n requires n >= 0;\r\n ensures power2(n + 1) == 2 * power2(n);\r\n ensures power2(n + 2) == 4 * power2(n);\r\n ensures power2(n + 3) == 8 * power2(n);\r\n ensures power2(n + 4) == 16 * power2(n);\r\n ensures power2(n + 5) == 32 * power2(n);\r\n ensures power2(n + 6) == 64 * power2(n);\r\n ensures power2(n + 7) == 128 * power2(n);\r\n ensures power2(n + 8) == 256 * power2(n);\r\n{\r\n reveal_power2();\r\n}\r\n\r\nstatic lemma lemma_2to32()\r\n ensures power2(32) == 4294967296;\r\n ensures power2(24) == 16777216;\r\n ensures power2(19) == 524288;\r\n ensures power2(16) == 65536;\r\n ensures power2(8) == 256;\r\n ensures power2(0) == 1;\r\n{\r\n lemma_power2_0_is_1();\r\n lemma_power2_add8(0);\r\n lemma_power2_add8(8);\r\n lemma_power2_add8(16);\r\n lemma_power2_add8(24);\r\n}\r\n\r\nstatic lemma lemma_2to64()\r\n ensures power2(64) == 18446744073709551616;\r\n ensures power2(60) == 1152921504606846976;\r\n{\r\n lemma_2to32();\r\n lemma_power2_add8(32);\r\n lemma_power2_add8(40);\r\n lemma_power2_add8(48);\r\n lemma_power2_add8(56);\r\n}\r\n\r\nstatic lemma lemma_power2_0_is_1()\r\n ensures power2(0) == 1;\r\n{\r\n reveal_power2();\r\n}\r\n\r\nstatic lemma lemma_power2_1_is_2()\r\n ensures power2(1) == 2;\r\n{\r\n lemma_power2_0_is_1();\r\n reveal_power2();\r\n}\r\n\r\nstatic lemma lemma_bit_count_is_unique(x:int, a:int, b:int)\r\n requires 0= 0 ==> x / power2(24) == x / 16777216;\r\n ensures forall x :: x >= 0 ==> x / power2(16) == x / 65536;\r\n ensures forall x :: x >= 0 ==> x / power2(8) == x / 256;\r\n{\r\n lemma_2toX();\r\n reveal_power2();\r\n lemma_div_is_div_recursive_forall();\r\n forall x | x >= 0\r\n ensures x / power2(24) == x / 16777216 && x / power2(16) == x / 65536 && x / power2(8) == x / 256;\r\n {\r\n lemma_div_2_to_8(x);\r\n lemma_div_2_to_16(x);\r\n lemma_div_2_to_24(x);\r\n }\r\n}\r\n\r\nstatic lemma lemma_div_2_to_8(x:int)\r\n requires x >= 0;\r\n ensures x / power2(8) == x / 256;\r\n{\r\n lemma_2toX();\r\n lemma_div_is_div_recursive_forall();\r\n if (x < 256) {\r\n } else {\r\n lemma_div_2_to_8(x - 256);\r\n }\r\n}\r\n\r\nstatic lemma lemma_div_2_to_16(x:int)\r\n requires x >= 0;\r\n ensures x / power2(16) == x / 65536;\r\n{\r\n lemma_2toX();\r\n lemma_div_is_div_recursive_forall();\r\n if (x < 65536) {\r\n } else {\r\n lemma_div_2_to_16(x - 65536);\r\n }\r\n}\r\n\r\nstatic lemma lemma_div_2_to_24(x:int)\r\n requires x >= 0;\r\n ensures x / power2(24) == x / 16777216;\r\n{\r\n lemma_2toX();\r\n lemma_div_is_div_recursive_forall();\r\n if (x < 16777216) {\r\n } else {\r\n lemma_div_2_to_24(x - 16777216);\r\n }\r\n}\r\n\r\n//-\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic lemma lemma_power2_is_power_2_general()\r\n ensures forall x:nat :: power2(x) == power(2,x);\r\n{\r\n forall x:nat\r\n ensures power2(x) == power(2,x);\r\n {\r\n lemma_power2_is_power_2(x);\r\n }\r\n}\r\n\r\nstatic lemma lemma_power2_is_power_2(x:nat)\r\n ensures power2(x) == power(2,x);\r\n{\r\n if (x==0)\r\n {\r\n reveal_power2();\r\n reveal_power();\r\n }\r\n else\r\n {\r\n calc {\r\n power2(x);\r\n { reveal_power2(); }\r\n 2*power2(x-1);\r\n { lemma_mul_is_mul_boogie(2,power2(x-1)); }\r\n (2 * power2(x-1));\r\n { lemma_power2_is_power_2(x-1); }\r\n (2 * power(2,x-1));\r\n { reveal_power(); }\r\n power(2,x);\r\n }\r\n }\r\n}\r\n\r\n\r\nlemma lemma_word_to_bytes_unique_specific_power2_helper1(a:int, b:int)\r\n requires a % 256 == b % 256;\r\n requires (a / power2(8)) % 256 == (b / power2(8)) % 256;\r\n requires 0 <= a;\r\n requires 0 <= b;\r\n ensures a % 65536 == b % 65536;\r\n{\r\n var d := 256;\r\n var c := 256;\r\n assert d*c == 65536;\r\n lemma_2toX();\r\n\r\n calc {\r\n a % 65536;\r\n a % (d*c);\r\n { lemma_mod_breakdown(a,d,c); }\r\n d * ((a/d)%c) + a%d;\r\n d * ((b/d)%c) + b%d;\r\n { lemma_mod_breakdown(b,d,c); }\r\n b % (d*c);\r\n b % 65536;\r\n }\r\n}\r\n\r\nlemma lemma_word_to_bytes_unique_specific_power2_helper2(a:int, b:int)\r\n requires (a / power2(16)) % 256 == (b / power2(16)) % 256;\r\n requires a / power2(24) == b / power2(24);\r\n requires 0 <= a;\r\n requires 0 <= b;\r\n ensures a / power2(16) == b / power2(16);\r\n{\r\n var ap := a/power2(16);\r\n var bp := b/power2(16);\r\n var d := power2(8);\r\n\r\n lemma_2toX();\r\n lemma_mul_strictly_positive_forall();\r\n\r\n calc {\r\n ap/d;\r\n { lemma_div_denominator(a,power2(16),power2(8)); }\r\n a/(power2(16)*power2(8));\r\n { lemma_power2_adds(16,8); }\r\n a/power2(24);\r\n b/power2(24);\r\n { lemma_power2_adds(16,8); }\r\n b/(power2(16)*power2(8));\r\n { lemma_div_denominator(b,power2(16),power2(8)); }\r\n bp/d;\r\n }\r\n calc {\r\n a/power2(16);\r\n ap;\r\n { lemma_fundamental_div_mod(ap,d); }\r\n d*(ap/d)+ap%d;\r\n d*(bp/d)+bp%d;\r\n { lemma_fundamental_div_mod(bp,d); }\r\n bp;\r\n b/power2(16);\r\n }\r\n}\r\n\r\nlemma lemma_word_to_bytes_unique_specific_power2_helper3(a:int, b:int)\r\n requires a % 65536 == b % 65536;\r\n requires a / power2(16) == b / power2(16);\r\n requires 0 <= a;\r\n requires 0 <= b;\r\n ensures a == b;\r\n{\r\n lemma_2toX();\r\n lemma_fundamental_div_mod(a,65536);\r\n lemma_fundamental_div_mod(b,65536);\r\n}\r\n\r\nlemma lemma_word_to_bytes_unique_specific_power2(a:int, b:int)\r\n requires a % 256 == b % 256;\r\n requires (a / power2(8)) % 256 == (b / power2(8)) % 256;\r\n requires (a / power2(16)) % 256 == (b / power2(16)) % 256;\r\n requires a / power2(24) == b / power2(24);\r\n requires 0 <= a;\r\n requires 0 <= b;\r\n ensures a == b;\r\n{\r\n lemma_word_to_bytes_unique_specific_power2_helper1(a, b);\r\n lemma_word_to_bytes_unique_specific_power2_helper2(a, b);\r\n lemma_word_to_bytes_unique_specific_power2_helper3(a, b);\r\n}\r\n\r\nstatic lemma lemma_pull_out_powers_of_2(x:nat, y:nat, z:nat)\r\n ensures 0<=x*y;\r\n ensures 0<=y*z;\r\n ensures power(power2(x*y), z) == power(power2(x), y*z);\r\n{\r\n lemma_mul_nonnegative(x,y);\r\n lemma_mul_nonnegative(y,z);\r\n lemma_power_positive(2,x);\r\n calc {\r\n power(power2(x*y), z);\r\n { lemma_power2_is_power_2(x*y); }\r\n power(power(2,x*y), z);\r\n { lemma_power_multiplies(2, x, y); }\r\n power(power(power(2,x),y), z);\r\n { lemma_power_multiplies(power(2,x), y, z); }\r\n power(power(2,x), y*z);\r\n { lemma_power2_is_power_2(x); }\r\n power(power2(x), y*z);\r\n }\r\n}\r\n\r\nstatic lemma lemma_SequenceOfZerosIsRepeatDigitZero(count: int)\r\n requires count >= 0;\r\n ensures SequenceOfZeros(count) == RepeatDigit(0, count);\r\n{\r\n if (count > 0)\r\n {\r\n lemma_SequenceOfZerosIsRepeatDigitZero(count - 1);\r\n }\r\n}\r\n\r\nstatic lemma lemma_mask_div_2(c:nat)\r\n requires 0 {\r\n x/power2(s) >= power2(p-s);\r\n { lemma_mul_inequality(power2(p-s), x/power2(s), power2(s)); }\r\n (x/power2(s))*power2(s) >= power2(p-s)*power2(s);\r\n { lemma_fundamental_div_mod(x, power2(s));\r\n lemma_mul_is_commutative_forall(); }\r\n x - x%power2(s) >= power2(p-s)*power2(s);\r\n { lemma_power2_adds(p-s, s); }\r\n x - x%power2(s) >= power2(p);\r\n { lemma_mod_properties(); }\r\n x >= power2(p);\r\n false;\r\n }\r\n}\r\n\r\nstatic lemma lemma_power2_unfolding(a:nat, b:nat)\r\n ensures 0<=a*b;\r\n ensures power(power2(a), b) == power2(a*b);\r\n{\r\n lemma_mul_nonnegative(a,b);\r\n lemma_power2_is_power_2(a);\r\n lemma_power_multiplies(2,a,b);\r\n lemma_power2_is_power_2(a*b);\r\n}\r\n\r\nstatic function{:opaque} NatNumBits(n:nat):nat\r\n ensures NatNumBits(n) >= 0;\r\n{\r\n if n == 0 then 0 else 1 + NatNumBits(n / 2)\r\n}\r\n\r\nstatic lemma lemma_Power2BoundIsNatNumBits(c:nat, n:nat) \r\n ensures (((c>0) ==> (power2(c-1) <= n)) && (n < power2(c))) <==> c == NatNumBits(n);\r\n{\r\n reveal_NatNumBits();\r\n reveal_power2();\r\n if (c > 0)\r\n {\r\n lemma_Power2BoundIsNatNumBits(c - 1, n / 2);\r\n }\r\n assert NatNumBits(n / 2) >= 0; //- dafnycc\r\n}\r\n\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/power2.s.dfy", "content": "include \"../base.s.dfy\"\r\n\r\nstatic function {:opaque} power2(exp: nat) : nat\r\n ensures power2(exp) > 0;\r\n{\r\n if (exp==0) then\r\n 1\r\n else\r\n 2*power2(exp-1)\r\n}\r\n\r\n\r\nstatic lemma lemma_power2_32()\r\n ensures power2(8) == 0x100;\r\n ensures power2(16) == 0x10000;\r\n ensures power2(24) == 0x1000000;\r\n ensures power2(32) == 0x100000000;\r\n{\r\n reveal_power2();\r\n assert unroll(1) && unroll(2) && unroll(3) && unroll(4) && unroll(5) && unroll(6) && unroll(7) && unroll(8);\r\n assert power2(0) == 0x1;\r\n assert power2(2) == 0x4;\r\n assert power2(4) == 0x10;\r\n assert power2(6) == 0x40;\r\n assert power2(8) == 0x100;\r\n assert power2(10) == 0x400;\r\n assert power2(12) == 0x1000;\r\n assert power2(14) == 0x4000;\r\n assert power2(16) == 0x10000;\r\n assert power2(18) == 0x40000;\r\n assert power2(20) == 0x100000;\r\n assert power2(22) == 0x400000;\r\n assert power2(24) == 0x1000000;\r\n assert power2(26) == 0x4000000;\r\n assert power2(28) == 0x10000000;\r\n assert power2(30) == 0x40000000;\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/power2methods.i.dfy", "content": "include \"power2.i.dfy\"\r\n\r\nmethod MakePower2(e:nat) returns (x:nat)\r\n requires e < 32;\r\n ensures x==power2(e);\r\n{\r\n lemma_2toX32();\r\n if (e<16) {\r\n if (e<8) {\r\n if (e<4) {\r\n if (e<2) {\r\n if (e<1) {\r\n x := 1;\r\n } else {\r\n x := 2;\r\n }\r\n } else {\r\n if (e<3) {\r\n x := 4;\r\n } else {\r\n x := 8;\r\n }\r\n }\r\n } else {\r\n if (e<6) {\r\n if (e<5) {\r\n x := 16;\r\n } else {\r\n x := 32;\r\n }\r\n } else {\r\n if (e<7) {\r\n x := 64;\r\n } else {\r\n x := 128;\r\n }\r\n }\r\n }\r\n } else {\r\n if (e<12) {\r\n if (e<10) {\r\n if (e<9) {\r\n x := 256;\r\n } else {\r\n x := 512;\r\n }\r\n } else {\r\n if (e<11) {\r\n x := 1024;\r\n } else {\r\n x := 2048;\r\n }\r\n }\r\n } else {\r\n if (e<14) {\r\n if (e<13) {\r\n x := 4096;\r\n } else {\r\n x := 8192;\r\n }\r\n } else {\r\n if (e<15) {\r\n x := 16384;\r\n } else {\r\n x := 32768;\r\n }\r\n }\r\n }\r\n }\r\n } else {\r\n if (e<24) {\r\n if (e<20) {\r\n if (e<18) {\r\n if (e<17) {\r\n x := 65536;\r\n } else {\r\n x := 131072;\r\n }\r\n } else {\r\n if (e<19) {\r\n x := 262144;\r\n } else {\r\n x := 524288;\r\n }\r\n }\r\n } else {\r\n if (e<22) {\r\n if (e<21) {\r\n x := 1048576;\r\n } else {\r\n x := 2097152;\r\n }\r\n } else {\r\n if (e<23) {\r\n x := 4194304;\r\n } else {\r\n x := 8388608;\r\n }\r\n }\r\n }\r\n } else {\r\n if (e<28) {\r\n if (e<26) {\r\n if (e<25) {\r\n x := 16777216;\r\n } else {\r\n x := 33554432;\r\n }\r\n } else {\r\n if (e<27) {\r\n x := 67108864;\r\n } else {\r\n x := 134217728;\r\n }\r\n }\r\n } else {\r\n if (e<30) {\r\n if (e<29) {\r\n x := 268435456;\r\n } else {\r\n x := 536870912;\r\n }\r\n } else {\r\n if (e<31) {\r\n x := 1073741824;\r\n } else {\r\n x := 2147483648;\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\nmethod CountBits(x:nat) returns (e:nat)\r\n requires x0 ==> 0 0;\r\n requires x >= 0;\r\n ensures RoundUpToMultiple(x, m) % m == 0;\r\n ensures x <= RoundUpToMultiple(x, m) < x + m;\r\n ensures RoundUpToMultiple(x, m) == (if x%m == 0 then x else x + m - x%m);\r\n{\r\n var r := RoundUpToMultiple(x, m);\r\n\r\n lemma_div_pos_is_pos(x + m - 1, m);\r\n lemma_mod_multiples_basic(((x + m - 1) / m), m);\r\n\r\n ghost var a := x / m;\r\n ghost var b := x % m;\r\n lemma_div_pos_is_pos(x, m);\r\n lemma_mul_nonnegative(a, m);\r\n lemma_mul_is_commutative(a, m);\r\n lemma_fundamental_div_mod(x, m);\r\n assert x == m * a + b;\r\n\r\n if (b == 0) {\r\n calc {\r\n r;\r\n ((x + m - 1) / m) * m;\r\n ((m * a + m - 1) / m) * m;\r\n { lemma_fundamental_div_mod_converse(m * a + m - 1, m, a, m - 1); }\r\n a * m;\r\n x;\r\n }\r\n }\r\n else {\r\n calc <= { 1; { lemma_mod_properties(); } b; }\r\n calc <= { b; { lemma_mod_properties(); } m - 1; }\r\n lemma_mul_nonnegative(m, a+1);\r\n lemma_mul_is_commutative(m, a+1);\r\n calc {\r\n r;\r\n ((x + m - 1) / m) * m;\r\n ((m * a + b + m - 1) / m) * m;\r\n (((m * a + m) + b - 1) / m) * m;\r\n (((m * a + m * 1) + b - 1) / m) * m;\r\n { lemma_mul_is_distributive_add(m, a, 1); }\r\n ((m * (a + 1) + b - 1) / m) * m;\r\n { lemma_fundamental_div_mod_converse(m * (a+1) + b - 1, m, a + 1, b - 1); }\r\n (a + 1) * m;\r\n m * (a + 1);\r\n { lemma_mul_is_distributive_add(m, a, 1); }\r\n a * m + 1 * m;\r\n m * a + 1 * m;\r\n a * m + m;\r\n }\r\n }\r\n}\r\n\r\nstatic function RoundUpToMultiple_premium(x:int, m:int) : int\r\n requires m > 0;\r\n requires x >= 0;\r\n ensures RoundUpToMultiple(x, m) % m == 0;\r\n ensures x <= RoundUpToMultiple(x, m) < x + m;\r\n ensures RoundUpToMultiple(x, m) == (if x%m == 0 then x else x + m - x%m);\r\n{\r\n lemma_RoundUpToMultiple_properties(x, m);\r\n RoundUpToMultiple(x, m)\r\n}\r\n\r\n//-//////////////////////////////////////\r\n//- DivideRoundingUp\r\n//-//////////////////////////////////////\r\n\r\nstatic lemma Lemma_DivideRoundingUpPreservesWord32 (x:int, m:int)\r\n requires m > 0;\r\n ensures Word32(x) ==> Word32(DivideRoundingUp(x, m));\r\n{\r\n if Word32(x) {\r\n if m == 1 {\r\n calc {\r\n DivideRoundingUp(x, m);\r\n (x / m) + (if x % m == 0 then 0 else 1);\r\n { Lemma_Mod1IsZero(x); }\r\n (x / m) + 0;\r\n x / m;\r\n { lemma_div_basics(x); }\r\n x;\r\n }\r\n }\r\n else {\r\n lemma_2toX();\r\n calc {\r\n 0;\r\n <= { lemma_div_pos_is_pos(x, m); }\r\n x / m;\r\n <= (x / m) + (if x % m == 0 then 0 else 1);\r\n DivideRoundingUp(x, m);\r\n }\r\n calc {\r\n DivideRoundingUp(x, m);\r\n (x / m) + (if x % m == 0 then 0 else 1);\r\n <= (x / m) + 1;\r\n <= { lemma_div_is_ordered_by_denominator(x, 2, m); }\r\n (x / 2) + 1;\r\n <= power2(32) / 2 + 1;\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic lemma Lemma_Mod1IsZero (x:int)\r\n requires x >= 0;\r\n ensures x % 1 == 0;\r\n{\r\n lemma_mod_is_mod_recursive_forall();\r\n if x >= 1 {\r\n Lemma_Mod1IsZero(x-1);\r\n }\r\n}\r\n\r\nstatic lemma Lemma_DivideRoundingUpProducesCeiling (x:int, m:int)\r\n requires x >= 0;\r\n requires m > 0;\r\n ensures x <= DivideRoundingUp(x, m) * m < x + m;\r\n{\r\n if x % m == 0 {\r\n calc {\r\n DivideRoundingUp(x, m) * m;\r\n (x/m) * m;\r\n { lemma_mul_is_commutative(m, x/m); }\r\n m * (x/m);\r\n m * (x/m) + x % m;\r\n { lemma_fundamental_div_mod(x, m); }\r\n x;\r\n }\r\n }\r\n else {\r\n calc {\r\n DivideRoundingUp(x, m) * m;\r\n (x/m + 1) * m;\r\n { lemma_mul_is_commutative(m, x/m + 1); }\r\n m * (x/m + 1);\r\n { lemma_mul_is_distributive_add(m, x/m, 1); lemma_mul_is_mul_boogie(m, 1); }\r\n m * (x/m) + m * 1;\r\n m * (x/m) + m;\r\n { lemma_fundamental_div_mod(x, m); }\r\n x + m - x%m;\r\n }\r\n calc {\r\n x + m - x%m;\r\n > { lemma_mod_properties(); }\r\n x;\r\n }\r\n calc {\r\n x + m - x%m;\r\n < { lemma_mod_properties(); }\r\n x + m;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma Lemma_DivideMultipleGeneral (x:int, y:int, m:int)\r\n requires m > 0;\r\n requires x >= 0;\r\n requires 0 <= y < m;\r\n ensures (x * m + y) / m == x;\r\n{\r\n calc {\r\n x * m + y;\r\n { lemma_fundamental_div_mod(x * m + y, m); }\r\n m * ((x * m + y) / m) + ((x * m + y) % m);\r\n { lemma_mul_is_commutative(x, m); }\r\n { lemma_mod_multiples_vanish(x, y, m); }\r\n m * ((x * m + y) / m) + (y % m);\r\n { lemma_small_mod(y, m); }\r\n m * ((x * m + y) / m) + y;\r\n { lemma_mul_is_commutative(m, (x * m + y) / m); }\r\n ((x * m + y) / m) * m + y;\r\n }\r\n\r\n assert x * m == ((x * m + y) / m) * m;\r\n assert (x * m) / m == (((x * m + y) / m) * m) / m;\r\n lemma_div_by_multiple(x, m);\r\n lemma_mul_nonnegative(x, m);\r\n lemma_div_pos_is_pos(x * m + y, m);\r\n lemma_div_by_multiple((x * m + y) / m, m);\r\n}\r\n\r\nstatic lemma Lemma_DivideRoundingUpEquivalentFormula (x:int, m:int)\r\n requires x >= 0;\r\n requires m > 0;\r\n ensures DivideRoundingUp(x, m) == (x+m-1)/m;\r\n ensures DivideRoundingUp(x, m) == (x-1)/m+1;\r\n{\r\n if x % m == 0 {\r\n calc {\r\n x+m-1;\r\n { lemma_fundamental_div_mod(x+m-1, m); }\r\n m * ((x+m-1)/m) + (x+m-1)%m;\r\n { lemma_small_mod(m-1, m); lemma_mod_adds(x, m-1, m); }\r\n m * ((x+m-1)/m) + m-1;\r\n { lemma_mul_is_commutative(m, (x+m-1)/m); }\r\n ((x+m-1)/m) * m + m-1;\r\n }\r\n assert x == ((x+m-1)/m) * m;\r\n lemma_div_pos_is_pos(x+m-1, m);\r\n lemma_div_by_multiple(((x+m-1)/m), m);\r\n assert x / m == ((x+m-1)/m);\r\n }\r\n else {\r\n calc {\r\n x + m - 1;\r\n { lemma_fundamental_div_mod(x, m); }\r\n m * (x/m) + (x%m) + m - 1;\r\n >= { lemma_mod_properties(); } m * (x/m) + 1 + m - 1;\r\n m * (x/m) + m;\r\n m * (x/m) + m * 1;\r\n { lemma_mul_is_distributive_add(m, x/m, 1); lemma_mul_is_mul_boogie(m, 1); }\r\n m * (x/m + 1);\r\n { lemma_mul_is_commutative(m, x/m+1); }\r\n (x/m + 1) * m;\r\n }\r\n\r\n calc {\r\n (x + m - 1) / m;\r\n >= { lemma_div_is_ordered((x/m + 1) * m, x + m - 1, m); }\r\n ((x/m + 1) * m) / m;\r\n { lemma_div_pos_is_pos(x, m); }\r\n { lemma_div_by_multiple(x/m + 1, m); }\r\n x/m + 1;\r\n DivideRoundingUp(x, m);\r\n }\r\n\r\n calc {\r\n x + m - 1;\r\n { lemma_fundamental_div_mod(x, m); }\r\n m * (x/m) + (x%m) + m - 1;\r\n < { lemma_mod_properties(); } m * (x/m) + m + m - 1;\r\n m * (x/m) + m * 1 + m - 1;\r\n { lemma_mul_is_distributive_add(m, x/m, 1); lemma_mul_is_mul_boogie(m, 1); }\r\n m * (x/m + 1) + m - 1;\r\n { lemma_mul_is_commutative(m, x/m+1); }\r\n (x/m + 1) * m + m - 1;\r\n }\r\n\r\n calc {\r\n (x + m - 1) / m;\r\n <= { lemma_div_is_ordered(x + m - 1, (x/m + 1) * m + m - 1, m); }\r\n ((x/m + 1) * m + m - 1) / m;\r\n { lemma_div_pos_is_pos(x, m); Lemma_DivideMultipleGeneral(x/m + 1, m-1, m); }\r\n x/m + 1;\r\n DivideRoundingUp(x, m);\r\n }\r\n }\r\n calc {\r\n (x-1)/m+1;\r\n { lemma_hoist_over_denominator(x-1, 1, m); }\r\n ((x-1)+mul(1,m)) / m;\r\n { lemma_mul_basics_forall(); }\r\n (x+m-1) / m;\r\n }\r\n}\r\n\r\nstatic function method DivideRoundingUp_premium (x:int, m:int) : int\r\n requires x >= 0;\r\n requires m > 0;\r\n ensures DivideRoundingUp_premium(x, m) == DivideRoundingUp(x, m);\r\n ensures DivideRoundingUp_premium(x, m) >= 0;\r\n ensures Word32(x) ==> Word32(DivideRoundingUp_premium(x, m));\r\n ensures x <= DivideRoundingUp_premium(x, m) * m < x + m;\r\n ensures DivideRoundingUp_premium(x, m) == (x + m - 1) / m;\r\n ensures DivideRoundingUp_premium(x, m) == (x-1)/m+1;\r\n{\r\n calc {\r\n (x/m) + (if x % m == 0 then 0 else 1);\r\n >= x/m;\r\n >= { lemma_div_pos_is_pos(x, m); } 0;\r\n }\r\n Lemma_DivideRoundingUpPreservesWord32(x, m);\r\n Lemma_DivideRoundingUpProducesCeiling(x, m);\r\n Lemma_DivideRoundingUpEquivalentFormula(x, m);\r\n DivideRoundingUp(x, m)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Math/round.s.dfy", "content": "static function method RoundUpToMultiple (x:int, m:int) : int\r\n requires m > 0;\r\n requires x >= 0;\r\n{\r\n ((x + m - 1) / m) * m\r\n}\r\n\r\nstatic function method DivideRoundingUp (x:int, m:int) : int\r\n requires x >= 0;\r\n requires m > 0;\r\n{\r\n (x/m) + (if x % m == 0 then 0 else 1)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Net/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Net/IPv4.i.dfy", "content": "//-\r\ninclude \"../Util/bytes_and_words.s.dfy\"\r\ninclude \"../Util/integer_sequences.i.dfy\"\r\ninclude \"../Math/power2.i.dfy\"\r\ninclude \"../../Drivers/Network/Intel/driver.i.dfy\"\r\ninclude \"ethernet.i.dfy\"\r\ninclude \"InternetChecksum.i.dfy\"\r\n\r\n//\r\n\r\n//\r\n\r\nfunction method {:opaque} Serialize16(Value:int) : seq\r\n requires Word16(Value);\r\n ensures IsByteSeqOfLen(Serialize16(Value), 2);\r\n{\r\n lemma_2toX();\r\n\r\n [Value / 0x100] + [Value % 0x100]\r\n}\r\n\r\nfunction method {:opaque} Deserialize16(Bytes:seq) : int\r\n requires IsByteSeq(Bytes);\r\n requires |Bytes| == 2;\r\n ensures Word16(Deserialize16(Bytes));\r\n{\r\n lemma_2toX();\r\n\r\n Bytes[0] * 0x100 + Bytes[1]\r\n}\r\n\r\n\r\n//-\r\n//- Define an IPv4 Address.\r\n//-\r\ndatatype IPv4Address = IPv4AddressBuilder(bytes:seq);\r\nfunction ValidIPv4Address(Addr:IPv4Address) : bool\r\n{\r\n //-\r\n //- Technically all 2^32 are valid, although some are reserved.\r\n //-\r\n IsByteSeqOfLen(Addr.bytes, 4)\r\n}\r\n\r\n//-\r\n//- IPv4 Header Format:\r\n//-\r\n//- Byte 0 Byte 1 Byte 2 Byte 3\r\n//- ---------------------------------------------------------------------\r\n//- | Vers / Hdr Len | DSCP / ECN | Total Length |\r\n//- ---------------------------------------------------------------------\r\n//- | Identification | Flags / Frag Offset |\r\n//- ---------------------------------------------------------------------\r\n//- | Time To Live | Protocol | Header Checksum |\r\n//- ---------------------------------------------------------------------\r\n//- | Source IP Address |\r\n//- ---------------------------------------------------------------------\r\n//- | Destination IP Address |\r\n//- ---------------------------------------------------------------------\r\n//-\r\n//- Version = 4 and Header Length = 5 (32-bit words), so first byte = 0x45.\r\n//- DSCP / ECN we can leave at zero.\r\n//- Total Length = Header + Payload Length in bytes. We need to set this.\r\n//- Identification should be unique per packet, but can be ignored if we never fragment?\r\n//- Flags / Fragment Offset we can leave at zero.\r\n//- Time To Live (TTL) is really a hop count, we can use anything reasonable (e.g. 0x80).\r\n//- Protocol could be passed to us, or can be hard-wired to UDP (0x11).\r\n//- Header checksum needs to be calculated properly.\r\n//- Source IP Address could be passed to us or can be hard-wired.\r\n//- Destination IP Address should be passed to us.\r\n//-\r\n\r\n//-\r\n//- Send the given Data via IPv4 to the given destination ethernet address and IPv4 address.\r\n//- Use the given Protocol value as the number for the contained protocol.\r\n//- Use the given Headers as the header for the contained prtocol.\r\n//- Use the given source IPv4 address as the source.\r\n//-\r\n//- Note: Caller is responsible for ensuring that the provided destination IPv4 address is valid for the station with the provided ethernet address.\r\n//-\r\n\r\n\r\nmethod{:dafnycc_conservative_seq_triggers} compute_header(TotalLength:int, Id:int, Protocol:int, Checksum:int, IPSource:IPv4Address, IPDest:IPv4Address) returns (IpHeader:seq)\r\n requires 0 <= TotalLength <= 1500; \r\n requires IsByte(Id);\r\n requires IsByte(Protocol);\r\n requires Word16(Checksum);\r\n requires ValidIPv4Address(IPSource);\r\n requires ValidIPv4Address(IPDest);\r\n requires public(TotalLength);\r\n requires public(Id);\r\n requires public(Protocol);\r\n requires public(Checksum);\r\n requires public(IPSource);\r\n requires public(IPDest);\r\n ensures IsByteSeqOfLen(IpHeader,20);\r\n ensures public(IpHeader);\r\n{ \r\n lemma_2toX();\r\n IpHeader := [0x45] //- Version and Header Length.\r\n + [0x00] //- DSCP bits and ECN bit.\r\n + Serialize16(TotalLength) //- Total Length.\r\n + Serialize16(Id) //- Identification.\r\n + [0x0] //- First byte of Flags and Fragement Offset.\r\n + [0x0] //- Second byte of Flags and Fragement Offset.\r\n + [0x80] //- Time to live (TTL).\r\n + [Protocol] //- Higher-level Protocol.\r\n + Serialize16(Checksum) //- IP Header Checksum.\r\n + IPSource.bytes //- Source IP address.\r\n + IPDest.bytes; //- Destination IP address.\r\n}\r\n\r\nmethod{:dafnycc_conservative_seq_triggers} IPv4Send(state:network_state, EtherDest:ethernet_addr, IPSource:IPv4Address, IPDest:IPv4Address, Protocol:int, Headers:seq, Data:seq)\r\n returns (new_state:network_state)\r\n requires valid_network_state(state);\r\n requires ValidIPv4Address(IPSource);\r\n requires ValidIPv4Address(IPDest);\r\n requires valid_ethernet_addr(EtherDest);\r\n requires IsByte(Protocol);\r\n requires |Headers| + |Data| <= 1480; \r\n requires IsByteSeq(Headers);\r\n requires IsByteSeq(Data);\r\n requires public(state);\r\n requires public(EtherDest);\r\n requires public(IPSource);\r\n requires public(IPDest);\r\n requires public(Protocol);\r\n requires public(Headers);\r\n requires public(Data);\r\n ensures valid_network_state(new_state);\r\n ensures public(new_state);\r\n{\r\n lemma_2toX();\r\n\r\n var TotalLength := 20 + |Headers| + |Data|;\r\n var Id := 0;\r\n\r\n //-\r\n //- First create the header over which to calculate the checksum.\r\n //-\r\n var Checksum := 0;\r\n var IpHeader := compute_header(TotalLength, Id, Protocol, Checksum, IPSource, IPDest); \r\n\r\n //-\r\n //- Re-create the header using the valid checksum.\r\n //-\r\n Checksum := InternetChecksum(IpHeader);\r\n IpHeader := compute_header(TotalLength, Id, Protocol, Checksum, IPSource, IPDest); \r\n\r\n new_state := EtherSend(state, EtherDest, IpHeader + Headers, Data);\r\n}\r\n\r\n\r\nmethod{:dafnycc_conservative_seq_triggers} IPv4Receive(state:network_state)\r\n returns (Success:bool, new_state:network_state, EtherSource:ethernet_addr, IPSource:IPv4Address, IPDest:IPv4Address, Protocol:int, Data:seq)\r\n requires valid_network_state(state);\r\n requires public(state);\r\n ensures valid_network_state(new_state);\r\n ensures Success ==> valid_ethernet_addr(EtherSource);\r\n ensures Success ==> ValidIPv4Address(IPSource);\r\n ensures Success ==> ValidIPv4Address(IPDest);\r\n ensures Success ==> IsByte(Protocol);\r\n ensures Success ==> IsByteSeq(Data);\r\n ensures Success ==> |Data| <= 1480;\r\n ensures public(new_state);\r\n ensures public(Success);\r\n ensures public(EtherSource);\r\n ensures public(IPSource);\r\n ensures public(IPDest);\r\n ensures public(Protocol);\r\n ensures public(Data);\r\n{\r\n lemma_2toX();\r\n\r\n var EtherType:seq;\r\n\r\n Protocol := 0;\r\n IPSource := IPv4AddressBuilder([0, 0, 0, 0]);\r\n IPDest := IPv4AddressBuilder([0, 0, 0, 0]);\r\n\r\n Success, new_state, EtherSource, EtherType, Data := EtherReceive(state);\r\n\r\n if (Success)\r\n {\r\n if (EtherType[0] != 0x08 || EtherType[1] != 0x00)\r\n {\r\n //- Wrong Ethernet type field for IPv4.\r\n Success := false;\r\n //-debug_print(0x90, 0xdead3001);\r\n }\r\n else if (|Data| < 20)\r\n {\r\n //- Received data too short to contain an IPv4 header.\r\n Success := false;\r\n //-debug_print(0x90, 0xdead3002);\r\n }\r\n else\r\n {\r\n var Checksum := InternetChecksum(Data[0..20]);\r\n if (Checksum != 0)\r\n {\r\n //- Checksum failed, packet corrupted.\r\n Success := false;\r\n //-debug_print(0x90, 0xdead3003);\r\n }\r\n else if (Data[0] != 0x45)\r\n {\r\n //- Not an option-less IPv4 header.\r\n Success := false;\r\n //-debug_print(0x90, 0xdead3004);\r\n }\r\n else\r\n {\r\n var TotalLength := Deserialize16(Data[2..4]);\r\n if (TotalLength < 20)\r\n {\r\n //- TotalLength field is bogus (too small to include IPv4 header).\r\n Success := false;\r\n //-debug_print(0x90, 0xdead3005);\r\n }\r\n else if (TotalLength > |Data|)\r\n {\r\n //- Not enough data to hold packet described by IPv4 header.\r\n Success := false;\r\n //-debug_print(0x90, 0xdead3006);\r\n }\r\n else\r\n {\r\n Protocol := Data[9];\r\n IPSource := IPv4AddressBuilder(Data[12..16]);\r\n IPDest := IPv4AddressBuilder(Data[16..20]);\r\n\r\n //-\r\n //- Everything looks good.\r\n //- Strip off the IPv4 header and trim to TotalLength.\r\n //-\r\n Data := Data[20..TotalLength];\r\n }\r\n }\r\n }\r\n }\r\n//- else\r\n//- {\r\n//- debug_print(0x90, 0xdead3000);\r\n//- }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Net/InternetChecksum.i.dfy", "content": "//-\r\ninclude \"../Math/power2.s.dfy\"\r\ninclude \"../Math/bit_vector_lemmas_premium.i.dfy\"\r\ninclude \"../../Drivers/CPU/assembly.s.dfy\"\r\ninclude \"../../Drivers/CPU/assembly_premium.i.dfy\"\r\ninclude \"../Util/word_bits.i.dfy\"\r\ninclude \"../Util/relational.s.dfy\"\r\n\r\n//-\r\n//- The \"Internet Checksum\" is the checksum used for error-checking of the IPv4\r\n//- header (see RFC 791) as well as for error-checking of the UDP (see RFC 768)\r\n//- and TCP (see RFC 793) headers and payloads.\r\n//-\r\n//- The checksum is the 16 bit one's complement of the one's complement sum of\r\n//- all the 16 bit values covered by the checksum. If an odd number of bytes\r\n//- are being checksummed, a virtual zero byte is added at the end.\r\n//-\r\n//- See also RFC 1071.\r\n//-\r\n\r\nmethod InternetChecksum(Data:seq)\r\n returns (Checksum:int)\r\n requires IsByteSeq(Data);\r\n requires |Data| > 0;\r\n requires public(Data);\r\n ensures Word16(Checksum);\r\n ensures public(Checksum);\r\n{\r\n lemma_power2_32();\r\n\r\n Checksum := PartialChecksum(Data);\r\n Checksum := Asm_BitwiseAnd(Asm_BitwiseNot(Checksum), 0xffff);\r\n\r\n lemma_and_with_ffff_premium();\r\n}\r\n\r\nmethod PartialChecksum(Data:seq)\r\n returns (Checksum:int)\r\n requires IsByteSeq(Data);\r\n requires |Data| > 0;\r\n requires public(Data);\r\n ensures Word16(Checksum);\r\n ensures public(Checksum);\r\n{\r\n lemma_power2_32();\r\n\r\n Checksum := 0;\r\n var Index := 0;\r\n\r\n while (Index < |Data| - 1)\r\n invariant Index >= 0;\r\n invariant Word16(Checksum);\r\n invariant public(Index);\r\n invariant public(Checksum);\r\n invariant public(Data);\r\n {\r\n Checksum := OnesComplementSum16(Checksum, Data[Index] * 0x100 + Data[Index + 1]);\r\n Index := Index + 2;\r\n }\r\n\r\n if (Index < |Data|)\r\n {\r\n Checksum := OnesComplementSum16(Checksum, Data[Index] * 0x100);\r\n }\r\n}\r\n\r\nmethod OnesComplementSum16(x:int, y:int)\r\n returns (Sum:int)\r\n requires Word16(x);\r\n requires Word16(y);\r\n requires public(x);\r\n requires public(y);\r\n ensures Word16(Sum);\r\n ensures public(Sum);\r\n{\r\n //-\r\n //- First calculate the conventional sum.\r\n //-\r\n Sum := x + y;\r\n\r\n //-\r\n //- To convert this value into a 16 bit one's complement representation,\r\n //- we need to check whether this sum has overflowed the maximum 16 bit\r\n //- value. If so, we need to perform an \"end-around carry\". This entails\r\n //- taking the overflow (i.e. carry) value and adding it back into the sum.\r\n //-\r\n //- Note that the maximum value the conventional sum of two unsigned 16 bit\r\n //- values can reach is 2 * 0xffff = 0x1fffe. This means that at most the\r\n //- overflow is a single carry bit, which we can safely add back into our\r\n //- remaining value (i.e. max 0xfffe) without concern for another overflow.\r\n //-\r\n if (Sum >= 0x10000)\r\n {\r\n Sum := Sum - 0x10000 + 1;\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Net/Udp.i.dfy", "content": "//-\r\ninclude \"../Util/bytes_and_words.s.dfy\"\r\ninclude \"../Util/integer_sequences.i.dfy\"\r\ninclude \"../Math/power2.i.dfy\"\r\ninclude \"IPv4.i.dfy\"\r\n\r\n\r\n//-\r\n//- UDP Header Format:\r\n//-\r\n//- Byte 0 Byte 1 Byte 2 Byte 3\r\n//- ---------------------------------------------------------------------\r\n//- | Source Port | Destination Port |\r\n//- ---------------------------------------------------------------------\r\n//- | Length | Checksum |\r\n//- ---------------------------------------------------------------------\r\n//-\r\n//- Source Port is the sender's 16 bit port number.\r\n//- Destination Port is the receiver's 16 bit port number.\r\n//- Length = UDP Header + Payload Length in bytes.\r\n//- Checksum is the standard Internet Checksum computed over the Pseudo Header and data.\r\n//-\r\n\r\n\r\n//-\r\n//- Send the given Data via UDP to the given destination ethernet address, IPv4 address, and UDP port.\r\n//- Use the given source IPv4 address and UDP port as the source.\r\n//-\r\n//- Note: Caller is responsible for ensuring that the provided destination IPv4 address is valid for the station with the provided ethernet address.\r\n//-\r\nmethod{:dafnycc_conservative_seq_triggers} UdpSend(state:network_state, EtherDest:ethernet_addr, IPSource:IPv4Address, IPDest:IPv4Address, SourcePort:int, DestPort:int, Data:seq)\r\n returns (new_state:network_state)\r\n requires valid_network_state(state);\r\n requires ValidIPv4Address(IPSource);\r\n requires ValidIPv4Address(IPDest);\r\n requires valid_ethernet_addr(EtherDest);\r\n requires Word16(SourcePort);\r\n requires Word16(DestPort);\r\n requires |Data| <= 1472; \r\n requires IsByteSeq(Data);\r\n requires public(state);\r\n requires public(EtherDest);\r\n requires public(IPSource);\r\n requires public(IPDest);\r\n requires public(SourcePort);\r\n requires public(DestPort);\r\n requires public(Data);\r\n ensures valid_network_state(new_state);\r\n ensures public(new_state);\r\n{\r\n lemma_2toX();\r\n\r\n var Length := 8 + |Data|;\r\n\r\n var PseudoHeader := IPSource.bytes + IPDest.bytes + [0] + [17] + Serialize16(Length);\r\n\r\n var Checksum := 0;\r\n var UdpHeader:seq := Serialize16(SourcePort)\r\n + Serialize16(DestPort)\r\n + Serialize16(Length)\r\n + Serialize16(Checksum);\r\n\r\n Checksum := InternetChecksum(PseudoHeader + UdpHeader + Data);\r\n if (Checksum == 0)\r\n {\r\n Checksum := 0xffff;\r\n }\r\n\r\n UdpHeader := Serialize16(SourcePort)\r\n + Serialize16(DestPort)\r\n + Serialize16(Length)\r\n + Serialize16(Checksum);\r\n\r\n new_state := IPv4Send(state, EtherDest, IPSource, IPDest, 17, UdpHeader, Data);\r\n}\r\n\r\nmethod{:dafnycc_conservative_seq_triggers} UdpReceive(state:network_state)\r\n returns (Success:bool, new_state:network_state, EtherSource:ethernet_addr, IPSource:IPv4Address, IPDest:IPv4Address, SourcePort:int, DestPort:int, Data:seq)\r\n requires valid_network_state(state);\r\n requires public(state);\r\n ensures valid_network_state(new_state);\r\n ensures Success ==> valid_ethernet_addr(EtherSource);\r\n ensures Success ==> ValidIPv4Address(IPSource);\r\n ensures Success ==> ValidIPv4Address(IPDest);\r\n ensures Success ==> Word16(SourcePort);\r\n ensures Success ==> Word16(DestPort);\r\n ensures Success ==> IsByteSeq(Data);\r\n ensures Success ==> |Data| <= 1472;\r\n ensures public(Success);\r\n ensures public(new_state);\r\n ensures public(EtherSource);\r\n ensures public(IPSource);\r\n ensures public(IPDest);\r\n ensures public(SourcePort);\r\n ensures public(DestPort);\r\n ensures public(Data);\r\n{\r\n lemma_2toX();\r\n\r\n var Protocol:int;\r\n\r\n SourcePort := 0;\r\n DestPort := 0;\r\n\r\n Success, new_state, EtherSource, IPSource, IPDest, Protocol, Data := IPv4Receive(state);\r\n\r\n if (Success)\r\n {\r\n if (Protocol != 17)\r\n {\r\n //- Not a UDP packet.\r\n Success := false;\r\n }\r\n else if (|Data| < 8 )\r\n {\r\n //- Received data is too short to contain a UDP header.\r\n Success := false;\r\n }\r\n else\r\n {\r\n var Length:int := Deserialize16(Data[4..6]);\r\n if (Length < 8)\r\n {\r\n //- Length field is bogus (too small to include UDP header).\r\n Success := false;\r\n }\r\n else if (Length > |Data|)\r\n {\r\n //- Not enough data to hold packet described by IPv4 header.\r\n Success := false;\r\n }\r\n else\r\n {\r\n var PseudoHeader := IPSource.bytes + IPDest.bytes + [0] + [17] + Serialize16(Length);\r\n var Checksum:int := InternetChecksum(PseudoHeader + Data);\r\n if (Checksum != 0)\r\n {\r\n //- Checksum failed, packet corrupted.\r\n Success := false;\r\n }\r\n else\r\n {\r\n SourcePort := Deserialize16(Data[0..2]);\r\n DestPort := Deserialize16(Data[2..4]);\r\n\r\n //-\r\n //- Everything looks good.\r\n //- Strip off the UDP header and trim to Length.\r\n //-\r\n Data := Data[8..Length];\r\n }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Net/ethernet.i.dfy", "content": "//-\r\ninclude \"../Util/integer_sequences.i.dfy\"\r\ninclude \"../../Drivers/Network/Intel/driver.i.dfy\"\r\n\r\n//-\r\n//- Ethernet-level interface to the network.\r\n//-\r\n\r\n//-\r\n//- Send the given Headers and Data to the given ethernet destination address.\r\n//-\r\nmethod EtherSend(state:network_state, EtherDest:ethernet_addr, Headers:seq, Data:seq)\r\n returns (new_state:network_state)\r\n requires valid_network_state(state);\r\n requires valid_ethernet_addr(EtherDest);\r\n requires IsByteSeq(Headers);\r\n requires IsByteSeq(Data);\r\n requires |Headers| + |Data| <= 1500;\r\n requires public(state);\r\n requires public(EtherDest);\r\n requires public(Headers);\r\n requires public(Data);\r\n ensures valid_network_state(new_state);\r\n ensures public(new_state);\r\n{\r\n lemma_2toX();\r\n\r\n //-\r\n //- Create an Ethernet header to prepend to the caller's headers and data.\r\n //-\r\n var EtherSource := my_ethernet_addr();\r\n var EtherType := [0x08, 0x00]; //- Fix the type to be IPv4\r\n \r\n var EtherHeader := EtherDest.bytes + EtherSource.bytes + EtherType;\r\n\r\n assert |EtherHeader| == 14;\r\n\r\n//- assert Data == old(Data);\r\n//- assert app_approves_disclosure(left(UserData), right(UserData), 1500);\r\n\r\n new_state := NetIfSend(state, EtherHeader + Headers, Data);\r\n}\r\n\r\nmethod EtherReceive(state:network_state)\r\n returns (Success:bool, new_state:network_state, EtherSource:ethernet_addr, EtherType:seq, Data:seq)\r\n//- requires net_init;\r\n requires valid_network_state(state);\r\n requires public(state);\r\n ensures valid_network_state(new_state);\r\n ensures Success ==> valid_ethernet_addr(EtherSource);\r\n ensures Success ==> IsByteSeq(EtherType);\r\n ensures Success ==> |EtherType| == 2;\r\n ensures Success ==> IsByteSeq(Data);\r\n ensures Success ==> 46 <= |Data| <= 1500;\r\n ensures public(Success);\r\n ensures public(new_state);\r\n ensures public(EtherSource);\r\n ensures public(EtherType);\r\n ensures public(Data);\r\n{\r\n lemma_2toX();\r\n\r\n EtherSource := ethernet_addr_builder([]); // TODO: dafnycc: had to add this line because dafnycc doesn't handle returning uninitialized variables.\r\n EtherType := [0x00, 0x00];\r\n\r\n Success, new_state, Data := NetIfReceive(state);\r\n\r\n if (Success)\r\n {\r\n if (|Data| < 60) {\r\n //-\r\n //- Too short for an Ethernet packet.\r\n //-\r\n Success := false;\r\n //-debug_print(0x90, 0xdead2001);\r\n\r\n } else {\r\n //\r\n \r\n \r\n //\r\n var EtherDest := ethernet_addr_builder(Data[0..6]);\r\n assert valid_ethernet_addr(EtherDest);\r\n\r\n EtherSource := ethernet_addr_builder(Data[6..12]);\r\n assert valid_ethernet_addr(EtherSource);\r\n\r\n EtherType := Data[12..14];\r\n\r\n //-\r\n //- Remove the Ethernet Header and trim the data length to a maximum of 1500 bytes.\r\n //-\r\n var Length := |Data| - 14;\r\n if (Length > 1500)\r\n {\r\n Length := 1500;\r\n }\r\n Data := Data[14..14 + Length];\r\n }\r\n }\r\n else\r\n {\r\n //-debug_print(0x90, 0xdead2000);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/DebugPrint.i.dfy", "content": "include \"../../Drivers/IO/pci.i.dfy\"\r\ninclude \"../../Drivers/CPU/assembly.i.dfy\"\r\ninclude \"seqs_and_ints.i.dfy\"\r\n\r\nstatic method debug_print_seq(marker:int, seqn:seq)\r\n requires 0<=marker<256;\r\n requires IsByteSeq(seqn);\r\n{\r\n var i := 0;\r\n var shifted_marker := marker * 256 * 256;\r\n debug_print(0x90, 0x41000000 + shifted_marker);\r\n while (i < |seqn|)\r\n invariant 0 <= i <= |seqn|;\r\n {\r\n debug_print(0x90, 0x48000000 + shifted_marker + seqn[i]);\r\n i := i + 1;\r\n }\r\n debug_print(0x90, 0x4f000000 + shifted_marker);\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/Halter.i.dfy", "content": "include \"../../Libraries/Math/power2.i.dfy\"\r\ninclude \"DebugPrint.i.dfy\"\r\n//-include \"../../Libraries/Net/Udp.i.dfy\"\r\n\r\nmethod HaltMachine(error_code:int)\r\n requires 0 <= error_code < 0x10000;\r\n ensures false;\r\n{\r\n lemma_2toX();\r\n debug_print(0, 0x44440000 + error_code);\r\n while true\r\n decreases *;\r\n {\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/ProfileIfc.i.dfy", "content": "static function method Tally_TestDigits() : int { 1 }\r\nstatic function method Tally_BigNatSub() : int { 2 }\r\nstatic function method Tally_BigNatModExpCalls() : int { 3 }\r\nstatic function method Tally_BigNatModExpWhileLoops() : int { 4 }\r\nstatic function method Tally_BigNatDivCalls() : int { 5 }\r\nstatic function method Tally_BigNatDivWhileLoops() : int { 6 }\r\n\r\nstatic function method Tally_FatNatModExp() : int { 7 }\r\nstatic function method Tally_FatNatMul() : int { 8 }\r\nstatic function method Tally_FatNatMod() : int { 9 }\r\nstatic function method Tally_MillerRabinTest() : int { 10 }\r\n\r\n//- Mark these 'ghost' unless profiling to avoid creating runtime code\r\n//- in real build.\r\nstatic ghost method ResetTally() {}\r\nstatic ghost method ProfileTally(category:int, value:int) {}\r\nstatic ghost method DisplayTally() {}\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/arrays.i.dfy", "content": "include \"bytes_and_words.s.dfy\"\r\n\r\nstatic method ArrayCpy(dst:array, dst_offset:nat, src:array, src_offset:nat, count:nat)\r\n requires dst != null;\r\n requires src != null;\r\n requires dst_offset+count <= dst.Length;\r\n requires src_offset+count <= src.Length;\r\n requires src != dst;\r\n modifies dst;\r\n ensures dst[..dst_offset] == old(dst)[..dst_offset];\r\n ensures dst[dst_offset+count..] == old(dst)[dst_offset+count..];\r\n ensures dst[dst_offset..dst_offset+count] == src[src_offset..src_offset+count];\r\n{\r\n var i := 0;\r\n while (i < count)\r\n invariant 0 <= i <= count;\r\n invariant dst[..dst_offset] == old(dst)[..dst_offset];\r\n invariant dst[dst_offset+count..] == old(dst)[dst_offset+count..];\r\n invariant dst[dst_offset..dst_offset+i] == src[src_offset..src_offset+i];\r\n {\r\n ghost var old_src := src[..];\r\n ghost var old_dst := dst[..];\r\n ghost var old_i := i;\r\n\r\n assert old_dst[dst_offset..dst_offset+old_i] == old_src[src_offset..src_offset+old_i];\r\n assert src[..]==old_src;\r\n dst[dst_offset+i] := src[src_offset+i];\r\n i := i + 1;\r\n assert src[..]==old_src;\r\n\r\n assert old_dst[dst_offset..dst_offset+old_i] == old_src[src_offset..src_offset+old_i];\r\n\r\n forall (k | 0<=k, dst_offset:nat, count:nat, value:int)\r\n requires dst != null;\r\n requires dst_offset+count <= dst.Length;\r\n modifies dst;\r\n ensures forall i :: 0<=i dst[i]==old(dst[..])[i];\r\n ensures forall i :: dst_offset+count<=i dst[i]==old(dst[..])[i];\r\n ensures forall i :: dst_offset<=i dst[i]==value;\r\n{\r\n var j := 0;\r\n while (j < count)\r\n invariant 0 <= j <= count;\r\n invariant forall i :: 0<=i dst[i]==old(dst[..])[i];\r\n invariant forall i :: dst_offset+count<=i dst[i]==old(dst[..])[i];\r\n invariant forall i :: dst_offset<=i dst[i]==value;\r\n {\r\n dst[dst_offset+j] := value;\r\n j := j + 1;\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/arrays_2.i.dfy", "content": "\r\ninclude \"../../Drivers/CPU/assembly_premium.i.dfy\"\r\ninclude \"../Math/BitwiseOperations.i.dfy\"\r\n\r\nstatic lemma lemma_SelectBit_is_IntBit_spec(b:nat, x:nat)\r\n requires b<32;\r\n requires x=32)\r\n {\r\n lemma_power2_increases(32,i);\r\n lemma_SelectBit_overflow(i, x);\r\n }\r\n }\r\n lemma_BitwiseAnd_equivalence(x,y,z);\r\n}\r\n\r\nstatic lemma lemma_Asm_BitwiseAnd(x:int, c:nat)\r\n requires Word32(x);\r\n requires 0)\r\n requires Word32(w);\r\n requires bs == [ w / 16777216, (w / 65536) % 256, (w / 256) % 256, w % 256 ];\r\n ensures IsByteSeq(bs);\r\n ensures BEWordSeqToByteSeq([w])==bs;\r\n{\r\n lemma_2toX();\r\n calc {\r\n w;\r\n { lemma_fundamental_div_mod(w, 256); lemma_mul_is_commutative_forall(); }\r\n mul(div(w,256),256) + mod(w, 256);\r\n { lemma_fundamental_div_mod(div(w,256), 256); lemma_mul_is_commutative_forall(); }\r\n mul(mul(div(div(w,256),256),256) + mod(div(w,256),256),256) + mod(w, 256);\r\n { lemma_div_denominator_forall(); }\r\n mul(mul(div(w,mul(256,256)),256) + mod(div(w,256),256),256) + mod(w, 256);\r\n { lemma_mul_is_mul_boogie(256, 256); }\r\n mul(mul(div(w,65536),256) + mod(div(w,256),256),256) + mod(w, 256);\r\n { lemma_fundamental_div_mod(div(w,65536), 256); lemma_mul_is_commutative_forall(); }\r\n mul(mul(mul(div(div(w,65536),256),256) + mod(div(w,65536),256),256) + mod(div(w,256),256),256) + mod(w, 256);\r\n { lemma_div_denominator_forall(); }\r\n mul(mul(mul(div(w,mul(65536,256)),256) + mod(div(w,65536),256),256) + mod(div(w,256),256),256) + mod(w, 256);\r\n { lemma_mul_is_mul_boogie(65536, 256); }\r\n mul(mul(mul(div(w,16777216),256) + mod(div(w,65536),256),256) + mod(div(w,256),256),256) + mod(w, 256);\r\n mul(mul(mul(div(w,16777216),power2(8)) + mod(div(w,65536),256),power2(8)) + mod(div(w,256),256),power2(8)) + mod(w, 256);\r\n mul(mul(mul(w/16777216,power2(8)) + mod(w/65536,256),power2(8)) + mod(w/256,256),power2(8)) + mod(w, 256);\r\n mul(mul(mul(w/16777216,power2(8)) + (w/65536)%256,power2(8)) + (w/256)%256,power2(8)) + w%256;\r\n }\r\n\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_mul_basics_forall();\r\n var ws := [w];\r\n calc {\r\n BEByteSeqToInt(bs);\r\n { lemma_BEByteSeqToInt_unpack_four(bs, []); }\r\n BEByteSeqToInt([])*power2(32)\r\n + (((bs[|bs|-4])*power2(8) + bs[|bs|-3])*power2(8) + bs[|bs|-2])*power2(8) + bs[|bs|-1];\r\n (((bs[0])*power2(8) + bs[1])*power2(8) + bs[2])*power2(8) + bs[3];\r\n mul(mul(mul(bs[0],power2(8)) + bs[1],power2(8)) + bs[2],power2(8)) + bs[3];\r\n mul(mul(mul(w/16777216,power2(8)) + (w/65536)%256,power2(8)) + (w/256)%256,power2(8)) + w%256;\r\n w;\r\n BEDigitSeqToInt(power2(32), ws[0..0])*power2(32) + ws[0];\r\n BEWordSeqToInt(ws);\r\n }\r\n\r\n lemma_BEDigitSeqToInt_bound(power2(8), bs);\r\n lemma_BEDigitSeqToInt_invertibility(power2(8), BEByteSeqToInt(bs), bs);\r\n}\r\n\r\n\r\nstatic lemma lemma_WordToByte_concatenation(ws:seq, prefix_words:seq, suffix_words:seq, bs:seq, prefix_bytes:seq, suffix_bytes:seq)\r\n requires IsWordSeq(ws);\r\n requires IsWordSeq(prefix_words);\r\n requires IsWordSeq(suffix_words);\r\n requires ws == prefix_words + suffix_words;\r\n requires IsByteSeq(bs);\r\n requires IsByteSeq(prefix_bytes);\r\n requires IsByteSeq(suffix_bytes);\r\n requires bs == prefix_bytes + suffix_bytes;\r\n requires |suffix_words| == 1;\r\n requires |suffix_bytes| == 4;\r\n requires BEByteSeqToInt(prefix_bytes) == BEWordSeqToInt(prefix_words);\r\n requires BEByteSeqToInt(suffix_bytes) == BEWordSeqToInt(suffix_words);\r\n ensures BEByteSeqToInt(bs) == BEWordSeqToInt(ws);\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_2toX();\r\n lemma_mul_basics_forall();\r\n calc {\r\n BEByteSeqToInt(bs);\r\n { lemma_BEByteSeqToInt_strip_four(bs, prefix_bytes, suffix_bytes); }\r\n BEByteSeqToInt(prefix_bytes) * power2(32) + BEByteSeqToInt(suffix_bytes);\r\n BEWordSeqToInt(prefix_words) * power2(32) + BEWordSeqToInt(suffix_words);\r\n BEWordSeqToInt(prefix_words) * power2(32) + (BEDigitSeqToInt(power2(32), suffix_words[0..0])*power2(32) + suffix_words[0]);\r\n BEWordSeqToInt(prefix_words) * power2(32) + (BEDigitSeqToInt(power2(32), [])*power2(32) + suffix_words[0]);\r\n BEWordSeqToInt(prefix_words) * power2(32) + (mul(0,power2(32)) + suffix_words[0]);\r\n BEWordSeqToInt(prefix_words) * power2(32) + suffix_words[0];\r\n { assert suffix_words[0] == ws[|ws|-1]; }\r\n BEWordSeqToInt(prefix_words) * power2(32) + ws[|ws|-1];\r\n { assert prefix_words == ws[0..|ws|-1]; }\r\n BEDigitSeqToInt(power2(32), ws[0..|ws|-1])*power2(32) + ws[|ws|-1];\r\n BEWordSeqToInt(ws);\r\n }\r\n}\r\n\r\nstatic lemma lemma_divide_power2_24(w:int)\r\n requires Word32(w);\r\n ensures w/power2(24) < 256;\r\n{\r\n lemma_2toX();\r\n calc {\r\n w/power2(24);\r\n div(w,16777216);\r\n { lemma_div_is_div_boogie(w, 16777216); }\r\n w/16777216;\r\n <\r\n 256;\r\n }\r\n}\r\n\r\nstatic lemma lemma_Asm_Div_premiumer(x:int, d:int, q:int)\r\n requires Word32(x);\r\n requires Word32(d);\r\n requires 0, ba:array)\r\n requires wa!=null;\r\n requires ba!=null;\r\n requires wa!=ba;\r\n requires ba.Length == wa.Length*4;\r\n requires IsWordSeq(wa[..]);\r\n modifies ba;\r\n ensures IsByteSeq(ba[..]);\r\n ensures BEWordSeqToByteSeq(wa[..])==ba[..];\r\n{\r\n lemma_2toX32();\r\n var i:=0;\r\n var j:=0;\r\n//- calc {\r\n//- BEWordSeqToByteSeq_premium(wa[..i]);\r\n//- BEWordSeqToByteSeq([]);\r\n//- { reveal_BEDigitSeqToInt_private(); }\r\n//- ba[..j];\r\n//- }\r\n while (i 0<=bs[k]<256;\r\n assert forall k :: 0<=k ba[k]==bs[k];\r\n assert forall k :: 0<=k 0<=ba[k]<256;\r\n\r\n ghost var bss := ba[j..j+4];\r\n lemma_div_is_div_boogie(wa[i], 16777216);\r\n lemma_div_is_div_boogie(wa[i], 65536);\r\n lemma_mod_is_mod_boogie(wa[i]/65536, 256);\r\n lemma_div_is_div_boogie(wa[i], 256);\r\n lemma_mod_is_mod_boogie(wa[i]/256, 256);\r\n lemma_mod_is_mod_boogie(wa[i], 256);\r\n lemma_WordToByte_properties(wa[i], ba[j..j+4]);\r\n\r\n ghost var wss := [wa[i]];\r\n lemma_BEWordSeqToInt_BEIntToByteSeq(bs, ws);\r\n calc {\r\n BEByteSeqToInt(bs[..j]);\r\n { assert bs[..j] == bs; }\r\n BEByteSeqToInt(bs);\r\n//- BEByteSeqToInt(ba[..j]);\r\n//- BEByteSeqToInt(bs);\r\n BEWordSeqToInt(ws);\r\n BEWordSeqToInt(wa[..i]);\r\n }\r\n\r\n lemma_BEWordSeqToInt_BEIntToByteSeq(bss, wss);\r\n calc {\r\n BEByteSeqToInt(bss);\r\n { lemma_BEIntToByteSeq_BEWordSeqToInt(bss, wss); }\r\n BEWordSeqToInt(wss);\r\n }\r\n assert BEByteSeqToInt(bss) == BEWordSeqToInt(wss); //- OBSERVE\r\n lemma_WordToByte_concatenation(wa[..i+1], wa[..i], wss, ba[..j+4], bs[..j], bss);\r\n lemma_BEIntToByteSeq_BEWordSeqToInt(ba[..j+4], wa[..i+1]);\r\n\r\n i:=i+1;\r\n j:=j+4;\r\n }\r\n\r\n assert ba[..j] == ba[..];\r\n assert wa[..i] == wa[..];\r\n assert IsByteSeq(ba[..j]);\r\n assert BEWordSeqToByteSeq(wa[..i])==ba[..j];\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/arrays_and_seqs.i.dfy", "content": "include \"be_sequences.s.dfy\"\r\ninclude \"seqs_and_ints.i.dfy\"\r\ninclude \"integer_sequences_premium.i.dfy\"\r\ninclude \"word_bits.i.dfy\"\r\ninclude \"seqs_transforms.i.dfy\"\r\ninclude \"../Math/div.i.dfy\"\r\ninclude \"../Math/power2.i.dfy\"\r\ninclude \"../Math/power.i.dfy\"\r\ninclude \"../base.s.dfy\"\r\n//-include \"../assembly.s.dfy\"\r\n\r\nstatic predicate IsWordArray(a: array)\r\n reads a;\r\n{\r\n a != null &&\r\n forall i :: 0 <= i < a.Length ==> Word32(a[i])\r\n}\r\n\r\nstatic function {:opaque} GetArrayBit(a: array, b:int) : int\r\n requires IsWordArray(a);\r\n requires 0 <= b < a.Length * 32;\r\n ensures IsBit(GetArrayBit(a, b));\r\n ensures GetArrayBit(a, b) == BEWordSeqToBitSeq_premium(a[..])[b];\r\n reads a;\r\n{\r\n calc {\r\n BEWordSeqToBitSeq_premium(a[..])[b];\r\n BEIntToDigitSeq(power2(1), |a[..]|*32, BEDigitSeqToInt(power2(32), a[..]))[b];\r\n { lemma_power2_1_is_2(); }\r\n BEIntToDigitSeq(2, |a[..]|*32, BEDigitSeqToInt(power2(32), a[..]))[b];\r\n { lemma_BEIntToWordSeq_decomposition(a[..], b); }\r\n BEIntToDigitSeq(2, 32, a[..][b/32])[b%32];\r\n BEIntToDigitSeq(2, 32, a[b/32])[b%32];\r\n { lemma_power2_1_is_2(); }\r\n BEWordToBitSeq(a[b/32])[b%32];\r\n GetWordBit(a[b / 32], b % 32);\r\n }\r\n GetWordBit(a[b / 32], b % 32)\r\n}\r\n\r\n//-/////////////////////\r\n//- Updating arrays\r\n//-/////////////////////\r\n\r\nstatic method UpdateBitOfArray(a: array, pos: int, value: int)\r\n requires IsWordArray(a);\r\n requires 0 <= pos < a.Length * 32;\r\n requires IsBit(value);\r\n ensures IsWordArray(a);\r\n ensures GetArrayBit(a, pos) == value;\r\n ensures forall i {:trigger GetArrayBit(a, i)}{:trigger old(GetArrayBit(a, i))} ::\r\n 0 <= i < a.Length * 32 && i != pos ==> GetArrayBit(a, i) == old(GetArrayBit(a, i));\r\n modifies a;\r\n{\r\n reveal_GetArrayBit();\r\n a[pos / 32] := UpdateBitOfWord(a[pos / 32], pos % 32, value);\r\n\r\n calc {\r\n GetArrayBit(a, pos);\r\n { reveal_GetArrayBit(); }\r\n GetWordBit(a[pos / 32], pos % 32);\r\n value;\r\n }\r\n\r\n forall i | 0 <= i < a.Length * 32 && i != pos\r\n ensures GetArrayBit(a, i) == old(GetArrayBit(a, i));\r\n {\r\n if (i / 32 != pos / 32) {\r\n reveal_GetArrayBit(); \r\n }\r\n else {\r\n calc {\r\n GetArrayBit(a, i);\r\n { reveal_GetArrayBit(); }\r\n GetWordBit(a[pos / 32], i % 32);\r\n { lemma_fundamental_div_mod(i, 32); lemma_fundamental_div_mod(pos, 32); assert i % 32 != pos % 32; }\r\n GetWordBit(old(a[i / 32]), i % 32);\r\n old(GetArrayBit(a, i));\r\n }\r\n assert GetArrayBit(a, i) == old(GetArrayBit(a, i));\r\n }\r\n }\r\n}\r\n\r\nstatic method AppendBitToArray(a: array, b: int, value: int)\r\n requires IsWordArray(a);\r\n requires 0 <= b < a.Length * 32;\r\n requires IsBit(value);\r\n ensures IsWordArray(a);\r\n ensures forall i {:trigger GetArrayBit(a, i)}{:trigger old(GetArrayBit(a, i))} :: 0 <= i < b ==> GetArrayBit(a, i) == old(GetArrayBit(a, i));\r\n ensures GetArrayBit(a, b) == value;\r\n modifies a;\r\n{\r\n UpdateBitOfArray(a, b, value);\r\n}\r\n\r\n\r\nstatic method AppendWordToArray(a: array, b: int, value: int)\r\n requires IsWordArray(a);\r\n requires 0 <= b;\r\n requires b % 32 == 0;\r\n requires b + 32 <= a.Length * 32;\r\n requires Word32(value);\r\n ensures IsWordArray(a);\r\n ensures forall i {:trigger GetArrayBit(a, i)}{:trigger old(GetArrayBit(a, i))} :: 0 <= i < b ==> GetArrayBit(a, i) == old(GetArrayBit(a, i));\r\n ensures forall i {:trigger a[i]}:: 0 <= i * 32 < b ==> a[i] == old(a[i]);\r\n ensures a[b / 32] == value;\r\n modifies a;\r\n{\r\n reveal_GetArrayBit();\r\n a[b / 32] := value;\r\n reveal_GetArrayBit();\r\n}\r\n\r\nstatic method AppendBitsToArray(a: array, b: int, value: int, num_values: int)\r\n requires IsWordArray(a);\r\n requires 0 <= b;\r\n requires 0 <= num_values;\r\n requires b + num_values <= a.Length * 32;\r\n requires IsBit(value);\r\n ensures IsWordArray(a);\r\n ensures forall i {:trigger GetArrayBit(a, i)}{:trigger old(GetArrayBit(a, i))} :: 0 <= i < b ==> GetArrayBit(a, i) == old(GetArrayBit(a, i));\r\n ensures forall i {:trigger GetArrayBit(a, i)} :: b <= i < b + num_values ==> GetArrayBit(a, i) == value;\r\n modifies a;\r\n{\r\n var j := 0;\r\n while (j < num_values)\r\n invariant 0 <= b <= b + j <= b + num_values <= a.Length * 32;\r\n invariant forall i :: 0 <= i < a.Length ==> Word32(a[i]);\r\n invariant forall i :: 0 <= i < b ==> GetArrayBit(a, i) == old(GetArrayBit(a, i));\r\n invariant forall i :: b <= i < b + j ==> GetArrayBit(a, i) == value;\r\n {\r\n var old_j := j;\r\n if (value == 0 && (b + j) % 32 == 0 && j + 32 <= num_values) {\r\n lemma_2toX();\r\n AppendWordToArray(a, b + j, 0);\r\n j := j + 32;\r\n forall (i | b + old_j <= i < b + j)\r\n ensures GetArrayBit(a, i) == 0;\r\n {\r\n assert i/32 == (b + old_j) / 32;\r\n\r\n assert (b + old_j) % 32 == 0;\r\n var k := i - (b+old_j);\r\n assert k < 32;\r\n assert i == k + (b+old_j);\r\n assert i/32 == (k + (b+old_j))/32 == (b+old_j)/32;\r\n assert a[i/32] == a[(b+old_j)/ 32] == 0;\r\n assert k == i % 32;\r\n\r\n calc {\r\n GetArrayBit(a, i);\r\n { reveal_GetArrayBit(); }\r\n GetWordBit(a[i / 32], i % 32);\r\n GetWordBit(0, i % 32);\r\n GetWordBit(0, k);\r\n { reveal_power2(); lemma_BEIntToDigitSeq_private_zero(power2(1), 32); }\r\n 0;\r\n }\r\n }\r\n }\r\n else {\r\n AppendBitToArray(a, b + j, value);\r\n j := j + 1;\r\n forall (i | b <= i < b + j) ensures GetArrayBit(a, i) == value;\r\n {\r\n if (i == b + old_j) { }\r\n }\r\n }\r\n reveal_GetArrayBit();\r\n }\r\n}\r\n\r\nstatic lemma lemma_array_seq_equality(a:array, b:array, a_start:int, a_end:int, b_start:int, b_end:int)\r\n requires a != null && b != null;\r\n requires b_end - b_start == a_end - a_start;\r\n requires 0 <= a_start < a_end <= a.Length;\r\n requires 0 <= b_start < b_end <= b.Length;\r\n requires forall i :: 0 <= i < a_end - a_start ==> a[a_start + i] == b[b_start + i];\r\n ensures a[a_start..a_end] == b[b_start..b_end];\r\n{\r\n ghost var A := a[a_start..a_end];\r\n ghost var B := b[b_start..b_end];\r\n\r\n assert |A| == |B|;\r\n forall i | 0 <= i < |A|\r\n ensures 0 <= i < |A| ==> A[i] == B[i];\r\n {\r\n calc {\r\n A[i];\r\n a[a_start..a_end][i];\r\n a[a_start + i];\r\n { assert forall j :: 0 <= j < a_end - a_start ==> a[a_start + j] == b[b_start + j]; }\r\n //-{ assert 0 <= i < a_end - a_start; }\r\n b[b_start + i];\r\n b[b_start..b_end][i];\r\n B[i];\r\n }\r\n assert A[i] == B[i];\r\n //-assert a[a_start..a_end][i] == b[b_start..b_end][i];\r\n }\r\n assert A == B;\r\n assert a[a_start..a_end] == b[b_start..b_end];\r\n}\r\n\r\nmethod SeqToArray(s:seq) returns (a:array)\r\n ensures fresh(a);\r\n ensures a != null;\r\n ensures a.Length == |s|;\r\n ensures forall i :: 0 <= i < |s| ==> s[i] == a[i];\r\n ensures a[..] == s;\r\n ensures fresh(a);\r\n{\r\n a := new int[|s|];\r\n\r\n var i := 0;\r\n while i < |s|\r\n invariant 0 <= i <= |s|;\r\n invariant forall j :: 0 <= j < i ==> s[j] == a[j];\r\n {\r\n a[i] := s[i];\r\n i := i + 1;\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/be_sequences.s.dfy", "content": "include \"../Math/power2.s.dfy\"\r\ninclude \"bytes_and_words.s.dfy\"\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- Sequence types\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic predicate IsDigitSeq(place_value:int, digits:seq)\r\n{\r\n forall i {:trigger digits[i]} :: 0<=i<|digits| ==> 0 <= digits[i] < place_value\r\n}\r\n\r\nstatic predicate IsBitSeq(bs:seq)\r\n{\r\n IsDigitSeq(power2(1), bs)\r\n}\r\n\r\nstatic predicate IsByteSeq(os:seq)\r\n{\r\n IsDigitSeq(power2(8), os)\r\n}\r\n\r\nstatic predicate IsWordSeq(ws:seq)\r\n{\r\n IsDigitSeq(power2(32), ws)\r\n}\r\n\r\nstatic predicate IsBitSeqOfLen(os:seq, len:int)\r\n{\r\n IsBitSeq(os) && |os| == len\r\n}\r\n\r\nstatic predicate IsByteSeqOfLen(os:seq, len:int)\r\n{\r\n IsByteSeq(os) && |os| == len\r\n}\r\n\r\nstatic predicate IsWordSeqOfLen(os:seq, len:int)\r\n{\r\n IsWordSeq(os) && |os| == len\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- Relationships among sequences of different digit sizes\r\n//- (bit, byte, word, and ghost int)\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//- BE/LE refers to the endianness of the transformation. There's no\r\n//- inherent endianness in a sequence until it's interpreted.\r\n\r\n\r\nstatic function {:opaque} BEDigitSeqToInt_private(place_value:int, digits:seq) : int\r\n decreases |digits|;\r\n{\r\n if (digits==[]) then\r\n 0\r\n else\r\n \r\n \r\n BEDigitSeqToInt_private(place_value, digits[0..|digits|-1])*place_value + digits[|digits|-1]\r\n}\r\n\r\nstatic function BEDigitSeqToInt(place_value:int, digits:seq) : int\r\n requires IsDigitSeq(place_value, digits);\r\n{\r\n BEDigitSeqToInt_private(place_value, digits)\r\n}\r\n\r\nstatic function {:autoReq}BEBitSeqToInt(bits:seq) : int\r\n{\r\n BEDigitSeqToInt(power2(1), bits)\r\n}\r\n\r\nstatic function {:autoReq} BEByteSeqToInt(bytes:seq) : int\r\n{\r\n BEDigitSeqToInt(power2(8), bytes)\r\n}\r\n\r\nstatic function {:autoReq} BEWordSeqToInt(words:seq) : int\r\n{\r\n BEDigitSeqToInt(power2(32), words)\r\n}\r\n\r\n\r\n\r\n\r\nstatic function {:opaque} BEIntToDigitSeq_private(place_value:int, min_places:int, v:int) : seq\r\n decreases if v>min_places then v else min_places;\r\n{\r\n if (1 n/d < n;\r\n ensures n<=0 ==> n/d <= 0;\r\n\r\nstatic function BEIntToDigitSeq(place_value:int, min_places:int, v:int) : seq\r\n{\r\n BEIntToDigitSeq_private(place_value, min_places, v)\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic predicate BEDigitSeqEqInt(place_value:int, digits:seq, v:int)\r\n{\r\n IsDigitSeq(place_value, digits)\r\n && BEDigitSeqToInt(place_value, digits)==v\r\n}\r\n\r\nstatic predicate BEBitSeqEqInt(bitseq:seq, v:int)\r\n{\r\n BEDigitSeqEqInt(2, bitseq, v)\r\n}\r\n\r\nstatic predicate BEBitSeqEqByte(bitseq:seq, byte:int)\r\n{\r\n IsByte(byte) && BEBitSeqEqInt(bitseq, byte)\r\n}\r\n\r\nstatic predicate BEBitSeqEqWord(bitseq:seq, word:int)\r\n{\r\n IsWord(word) && BEBitSeqEqInt(bitseq, word)\r\n}\r\n\r\nstatic predicate BEByteSeqEqInt(byteseq:seq, v:int)\r\n{\r\n BEDigitSeqEqInt(256, byteseq, v)\r\n}\r\n\r\nstatic predicate BEByteSeqEqWord(byteseq:seq, word:int)\r\n{\r\n IsWord(word) && BEByteSeqEqInt(byteseq, word)\r\n}\r\n\r\nstatic predicate BEWordSeqEqInt(byteseq:seq, v:int)\r\n{\r\n BEDigitSeqEqInt(power2(32), byteseq, v)\r\n}\r\n\r\nstatic predicate BEBitSeqEqByteSeq(bitseq:seq, byteseq:seq)\r\n{\r\n exists v:int ::\r\n BEBitSeqEqInt(bitseq, v) && BEByteSeqEqInt(byteseq, v)\r\n}\r\n\r\nstatic predicate BEBitSeqEqWordSeq(bitseq:seq, wordseq:seq)\r\n{\r\n exists v:int ::\r\n BEBitSeqEqInt(bitseq, v) && BEWordSeqEqInt(wordseq, v)\r\n}\r\n\r\nstatic predicate BEByteSeqEqWordSeq(byteseq:seq, wordseq:seq)\r\n{\r\n exists v:int ::\r\n BEByteSeqEqInt(byteseq, v) && BEWordSeqEqInt(wordseq, v)\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- Generator functions (as opposed to recognizer predicates)\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n\r\n\r\n\r\n\r\n//\r\n\r\nstatic function BEIntToByteSeq(x: int) : seq\r\n{\r\n BEIntToDigitSeq(power2(8), 0, x)\r\n}\r\n\r\nstatic function BEWordToFourBytes(x: int) : seq\r\n requires Word32(x);\r\n{\r\n BEIntToDigitSeq(power2(8), 4, x)\r\n}\r\n\r\nstatic function BEWordToBitSeq(x:int) : seq\r\n{\r\n BEIntToDigitSeq(power2(1), 32, x)\r\n}\r\n\r\nstatic function {:autoReq} BEWordSeqToBitSeq(wordseq:seq) : seq\r\n{\r\n BEIntToDigitSeq(power2(1), |wordseq|*32, BEDigitSeqToInt(power2(32), wordseq))\r\n}\r\n\r\nstatic function {:autoReq} BEByteSeqToBitSeq(byteseq:seq) : seq\r\n{\r\n BEIntToDigitSeq(power2(1), |byteseq|*8, BEDigitSeqToInt(power2(8), byteseq))\r\n}\r\n\r\nstatic function {:autoReq} BEWordSeqToByteSeq(wordseq:seq) : seq\r\n{\r\n BEIntToDigitSeq(power2(8), |wordseq|*4, BEDigitSeqToInt(power2(32), wordseq))\r\n}\r\n\r\nstatic function RepeatDigit(digit:int, count:int) : seq\r\n decreases count;\r\n{\r\n if (count<=0) then [] else RepeatDigit(digit, count-1) + [digit]\r\n}\r\n\r\nstatic function {:opaque} Reverse(os:seq) : seq\r\n decreases |os|;\r\n{\r\n if (os==[]) then\r\n []\r\n else\r\n [os[|os|-1]] + Reverse(os[0..|os|-1])\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/beseqs_simple.i.dfy", "content": "include \"be_sequences.s.dfy\"\r\n\r\nstatic lemma lemma_selection_preserves_digit_seq(pv:int, a:seq, i:int)\r\n requires IsDigitSeq(pv, a);\r\n requires 0 <= i <= |a|;\r\n ensures IsDigitSeq(pv, a[i..]);\r\n ensures IsDigitSeq(pv, a[..i]);\r\n{\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/bytes_and_words.s.dfy", "content": "include \"../Math/power2.s.dfy\"\r\n\r\nstatic predicate IsBit(b:int)\r\n{\r\n 0 <= b < 2\r\n}\r\n\r\nstatic predicate IsByte(b:int)\r\n{\r\n 0 <= b < 256\r\n}\r\n\r\n//\r\n\r\n\r\n//\r\nstatic predicate Word16(x:int)\r\n{\r\n 0 <= x < 0x10000\r\n}\r\n\r\nstatic predicate Word32(x: int)\r\n{\r\n 0 <= x < power2(32)\r\n}\r\n\r\n//\r\n\r\n//\r\n\r\nstatic predicate IsWord(w: int)\r\n{\r\n Word32(w)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/insecure_prng.i.dfy", "content": "include \"../../Drivers/CPU/assembly_premium.i.dfy\"\r\ninclude \"../Math/bit_vector_lemmas_premium.i.dfy\"\r\n\r\n//- Implements an Xorshift random number generator based on the example from:\r\n//- http://en.wikipedia.org/wiki/Xorshift\r\n\r\nmethod update_state(w:int, x:int, y:int, z:int) returns (w':int, x':int, y':int, z':int)\r\n requires Word32(w) && Word32(x) && Word32(y) && Word32(z);\r\n ensures Word32(w') && Word32(x') && Word32(y') && Word32(z');\r\n{\r\n lemma_2toX();\r\n var t := Asm_BitwiseXor(x, Asm_LeftShift(x, 11));\r\n x' := y;\r\n y' := z;\r\n z' := w;\r\n w' := Asm_BitwiseXor(w, Asm_BitwiseXor(Asm_RightShift(w, 19), Asm_BitwiseXor(t, Asm_RightShift(t, 8)))); \r\n}\r\n\r\nmethod insecure_get_random(num_bytes:int) returns (random_bytes:seq)\r\n requires Word32(num_bytes);\r\n ensures IsByteSeqOfLen(random_bytes, num_bytes);\r\n{\r\n //- Use rdtsc as a seed\r\n var x, y := Asm_Rdtsc();\r\n var w := 5331;\r\n var z := 4229;\r\n\r\n lemma_2toX();\r\n\r\n //- Iterate the PRNG a few times to absorb the rdtsc 'randomness'\r\n var i := 0;\r\n while (i < 100) \r\n invariant Word32(w) && Word32(x) && Word32(y) && Word32(z);\r\n {\r\n w, x, y, z := update_state(w, x, y, z);\r\n i := i + 1;\r\n }\r\n\r\n //- Generate the actual 'random' bytes requested\r\n var bytes := [];\r\n i := 0;\r\n while (i < num_bytes) \r\n invariant 0 <= i <= num_bytes;\r\n invariant IsByteSeqOfLen(bytes, i);\r\n invariant Word32(w) && Word32(x) && Word32(y) && Word32(z);\r\n {\r\n w, x, y, z := update_state(w, x, y, z);\r\n\r\n var rand_byte := Asm_BitwiseAnd(w, 0xFF);\r\n lemma_and_with_ff_premium();\r\n\r\n //- Grab the lowest byte for our collection\r\n bytes := [rand_byte] + bytes;\r\n i := i + 1;\r\n }\r\n\r\n random_bytes := bytes;\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/integer_sequences.i.dfy", "content": "include \"integer_sequences.s.dfy\"\r\ninclude \"seqs_simple.i.dfy\"\r\ninclude \"seqs_and_ints.i.dfy\"\r\ninclude \"seqs_transforms.i.dfy\"\r\ninclude \"seqs_reverse.i.dfy\"\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\n\r\n\r\n\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/integer_sequences.s.dfy", "content": "include \"be_sequences.s.dfy\"\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/integer_sequences_premium.i.dfy", "content": "include \"../Math/power.i.dfy\"\r\ninclude \"integer_sequences.i.dfy\"\r\n\r\n//- \"Premium\" versions of {:autoReq} spec functions, which include\r\n//- explicit requires and appropriate ensures for composition with\r\n//- other functions.\r\n\r\nstatic function BEDigitSeqToInt_premium(place_value:int, digits:seq) : int\r\n requires 1) : int\r\n requires IsBitSeq(bits);\r\n{\r\n BEBitSeqToInt(bits)\r\n}\r\n\r\nstatic function BEByteSeqToInt_premium(bytes:seq) : int\r\n requires IsByteSeq(bytes);\r\n{\r\n BEByteSeqToInt(bytes)\r\n}\r\n\r\nstatic function BEWordSeqToInt_premium(words:seq) : int\r\n requires IsWordSeq(words);\r\n ensures 0<=BEWordSeqToInt(words);\r\n{\r\n lemma_BEDigitSeqToInt_bound(power2(32), words);\r\n BEWordSeqToInt(words)\r\n}\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_IsDigitSeq(place_value:int, min_places:int, v:int)\r\n requires 1min_places then v else min_places;\r\n//- decreases if (v>0) then v else 0,min_places;\r\n{\r\n var sq := BEIntToDigitSeq(place_value, min_places, v);\r\n\r\n reveal_BEIntToDigitSeq_private();\r\n if (00)\r\n {\r\n lemma_div_decreases(v, place_value);\r\n lemma_div_pos_is_pos(v, place_value);\r\n }\r\n else\r\n {\r\n lemma_small_div();\r\n }\r\n lemma_BEIntToDigitSeq_IsDigitSeq(place_value, min_places-1, v/place_value);\r\n lemma_mod_properties();\r\n }\r\n else\r\n {\r\n assert |sq|==0;\r\n }\r\n}\r\n\r\nstatic function BEIntToDigitSeq_premium(place_value:int, min_places:int, v:int) : seq\r\n requires 1 |BEIntToDigitSeq(place_value, min_places, v)| == min_places;\r\n{\r\n lemma_BEIntToDigitSeq_IsDigitSeq(place_value, min_places, v);\r\n lemma_BEIntToDigitSeq_properties(place_value, min_places, v);\r\n BEIntToDigitSeq(place_value, min_places, v)\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- Generator functions (as opposed to recognizer predicates)\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic function BEIntToByteSeq_premium(x: int) : seq\r\n requires 0 <= x;\r\n ensures IsByteSeq(BEIntToByteSeq(x));\r\n ensures BEByteSeqToInt(BEIntToByteSeq(x)) == x;\r\n{\r\n reveal_power2();\r\n lemma_BEInt_decoding_general(power2(8), 0, x);\r\n BEIntToByteSeq(x)\r\n}\r\n\r\n//- Lost static tag because lemmas in seqs_transforms aren't static.\r\n\r\nstatic function BEWordToFourBytes_premium(x: int) : seq\r\n requires Word32(x);\r\n ensures IsByteSeq(BEWordToFourBytes(x));\r\n\r\n\r\n\r\n{\r\n reveal_power2();\r\n calc {\r\n x;\r\n < power2(32);\r\n { lemma_power2_is_power_2(32); }\r\n power(2, 8*4);\r\n { lemma_mul_is_mul_boogie(8,4); lemma_power_multiplies(2,8,4); }\r\n power(power(2,8), 4);\r\n { lemma_power2_is_power_2(8); }\r\n power(power2(8), 4);\r\n }\r\n lemma_BEIntToDigitSeqProducesRightSizedDigits(power2(8), 4, x);\r\n \r\n BEWordToFourBytes(x)\r\n}\r\n\r\nstatic function BEWordToBitSeq_premium(x:int) : seq\r\n requires Word32(x);\r\n ensures IsBitSeq(BEWordToBitSeq(x));\r\n ensures |BEWordToBitSeq(x)| == 32;\r\n ensures forall i :: 0 <= i < 32 ==> IsBit(BEWordToBitSeq(x)[i]);\r\n ensures BEBitSeqToInt(BEWordToBitSeq(x)) == x;\r\n{\r\n reveal_power2();\r\n lemma_power2_is_power_2(1);\r\n calc {\r\n x;\r\n < power2(32);\r\n { lemma_power2_is_power_2(32); }\r\n power(2, 32);\r\n power(power2(1), 32);\r\n }\r\n lemma_BEIntToDigitSeqProducesRightSizedDigits(power2(1), 32, x);\r\n lemma_BEIntToDigitSeq_private_properties(power2(1), 32, x);\r\n lemma_BEIntToBitSeq_decoding(x);\r\n\r\n BEWordToBitSeq(x)\r\n}\r\n\r\nstatic function BEWordSeqToBitSeq_premium(wordseq:seq) : seq\r\n requires IsWordSeq(wordseq);\r\n ensures IsBitSeq(BEWordSeqToBitSeq(wordseq));\r\n ensures |BEWordSeqToBitSeq(wordseq)| == |wordseq|*32;\r\n\r\n\r\n{\r\n lemma_BEWordSeqToBitSeq_ensures(wordseq);\r\n\r\n BEWordSeqToBitSeq(wordseq)\r\n}\r\n\r\nstatic function BEByteSeqToBitSeq_premium(byteseq:seq) : seq\r\n requires IsByteSeq(byteseq);\r\n ensures IsBitSeq(BEByteSeqToBitSeq(byteseq));\r\n ensures |BEByteSeqToBitSeq(byteseq)| == |byteseq|*8;\r\n//- ensures BEBitSeqToInt(BEByteSeqToBitSeq(byteseq)) == BEByteSeqToInt(byteseq);\r\n{\r\n lemma_BEByteSeqToBitSeq_ensures(byteseq);\r\n \r\n BEByteSeqToBitSeq(byteseq)\r\n}\r\n\r\nstatic function BEWordSeqToByteSeq_premium(wordseq:seq) : seq\r\n requires IsWordSeq(wordseq);\r\n ensures IsByteSeq(BEWordSeqToByteSeq(wordseq));\r\n ensures |BEWordSeqToByteSeq(wordseq)| == |wordseq|*4;\r\n//- ensures BEByteSeqToInt(BEWordSeqToByteSeq(wordseq)) == BEWordSeqToInt(wordseq);\r\n{\r\n lemma_BEWordSeqToByteSeq_ensures(wordseq);\r\n \r\n BEWordSeqToByteSeq(wordseq)\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\n//- Two equal-valued DigitSeqs differ only by a zero prefix,\r\n//- regardless of how they are constructed with BEIntToDigitSeq\r\n\r\nstatic lemma lemma_equal_suffixes(pv:int, short:seq, long:seq)\r\n requires 1 long[i] == 0;\r\n ensures forall i :: |long|-|short|<=i<|long| ==> long[i] == short[i - (|long|-|short|)];\r\n decreases |long|;\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n var x := BEDigitSeqToInt_premium(pv, short);\r\n if (|short|==0)\r\n {\r\n if (|long|==0)\r\n {\r\n }\r\n else\r\n {\r\n assert BEDigitSeqToInt_premium(pv, short)==0;\r\n forall (i | 0<=i<|long|-|short|)\r\n ensures long[i] == 0;\r\n {\r\n if (i==|long|-1)\r\n {\r\n calc {\r\n 0;\r\n x;\r\n BEDigitSeqToInt_premium(pv, long[0..|long|-1])*pv + long[|long|-1];\r\n }\r\n lemma_mul_nonnegative(BEDigitSeqToInt_premium(pv, long[0..|long|-1]), pv);\r\n assert long[i] == 0;\r\n }\r\n else\r\n {\r\n if (BEDigitSeqToInt_premium(pv, long[0..|long|-1])>0)\r\n {\r\n lemma_mul_strictly_positive(BEDigitSeqToInt_premium(pv, long[0..|long|-1]), pv);\r\n assert false;\r\n }\r\n calc {\r\n long[i];\r\n long[0..|long|-1][i];\r\n { lemma_equal_suffixes(pv, short, long[0..|long|-1]); }\r\n 0;\r\n }\r\n }\r\n }\r\n }\r\n }\r\n else\r\n {\r\n//- assert x == BEDigitSeqToInt_premium(pv, short[0..|short|-1])*pv + short[|short|-1];\r\n //- assert x == BEDigitSeqToInt_premium(pv, long[0..|long|-1])*pv + long[|long|-1];\r\n\r\n lemma_fundamental_div_mod_converse(x, pv, BEDigitSeqToInt_premium(pv, short[0..|short|-1]), short[|short|-1]);\r\n lemma_fundamental_div_mod_converse(x, pv, BEDigitSeqToInt_premium(pv, long[0..|long|-1]), long[|long|-1]);\r\n\r\n calc {\r\n BEDigitSeqToInt_premium(pv, short[0..|short|-1]);\r\n x/pv;\r\n BEDigitSeqToInt_premium(pv, long[0..|long|-1]);\r\n }\r\n calc {\r\n short[|short|-1];\r\n x%pv;\r\n long[|long|-1];\r\n }\r\n//- assert short[|short|-1] == long[|long|-1];\r\n lemma_equal_suffixes(pv, short[0..|short|-1], long[0..|long|-1]);\r\n\r\n forall (i | 0<=i<|long|-|short|)\r\n ensures long[i] == 0;\r\n {\r\n if (i==|long|-1)\r\n {\r\n assert long[i] == 0;\r\n }\r\n else\r\n {\r\n calc {\r\n long[i];\r\n long[0..|long|-1][i];\r\n { lemma_equal_suffixes(pv, short[0..|short|-1], long[0..|long|-1]); }\r\n 0;\r\n }\r\n assert long[i] == 0;\r\n }\r\n }\r\n forall (i | |long|-|short|<=i<|long|)\r\n ensures long[i] == short[i - (|long|-|short|)];\r\n {\r\n if (i==|long|-1)\r\n {\r\n assert long[i] == short[i - (|long|-|short|)];\r\n }\r\n else\r\n {\r\n assert long[i] == short[i - (|long|-|short|)];\r\n }\r\n }\r\n }\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\n\r\n\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_of_zero(pv:int, s:seq)\r\n requires 1 s[i] == 0;\r\n decreases |s|;\r\n{\r\n if (|s|==0)\r\n {\r\n }\r\n else if (s[0]==0)\r\n {\r\n calc {\r\n 0;\r\n { lemma_BEInt_decoding_general(pv, |s|, 0); }\r\n BEDigitSeqToInt(pv, s);\r\n { lemma_LeadingZeros(pv, s[1..], s); }\r\n BEDigitSeqToInt(pv, s[1..]);\r\n }\r\n\r\n lemma_BEDigitSeqToInt_invertibility(pv, 0, s[1..]);\r\n assert s[1..] == BEIntToDigitSeq(pv, |s[1..]|, 0);\r\n //- recurse.\r\n lemma_BEIntToDigitSeq_of_zero(pv, s[1..]);\r\n forall (i | 0<=i<|s|)\r\n ensures s[i]==0;\r\n {\r\n if (i>0)\r\n {\r\n assert s[i] == s[1..][i-1];\r\n }\r\n }\r\n }\r\n else\r\n {\r\n lemma_BEInt_decoding_general(pv, |s|, 0);\r\n assert BEDigitSeqToInt(pv, s) == 0;\r\n lemma_BEDigitSeqToInt_bound(pv, s);\r\n calc {\r\n 0;\r\n <\r\n s[0];\r\n <= { lemma_power_positive(pv, |s|-1);\r\n lemma_mul_increases(power(pv, |s|-1), s[0]); }\r\n power(pv, |s|-1) * s[0];\r\n { lemma_mul_is_commutative_forall(); }\r\n s[0] * power(pv, |s|-1);\r\n <= BEDigitSeqToInt(pv, s);\r\n 0;\r\n } \r\n assert false;\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEDigitSeqToInt_of_zeros(pv:int, s:seq)\r\n requires 1 s[i] == 0;\r\n ensures BEDigitSeqToInt(pv, s) == 0;\r\n decreases |s|;\r\n{\r\n if (|s|==0)\r\n {\r\n reveal_BEDigitSeqToInt_private();\r\n }\r\n else\r\n {\r\n calc {\r\n BEDigitSeqToInt(pv, s);\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEDigitSeqToInt_private(pv, s[0..|s|-1])*pv + s[0];\r\n { lemma_BEDigitSeqToInt_of_zeros(pv, s[0..|s|-1]); }\r\n mul(0,pv) + s[0];\r\n { lemma_mul_basics_forall(); }\r\n 0;\r\n }\r\n }\r\n}\r\n \r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\n\r\n\r\n\r\nstatic lemma lemma_select_from_transform(inseq:seq, headseq:seq, tailseq:seq, outbits:nat, scale:nat, inbits:nat, crop:nat)\r\n requires IsDigitSeq(power2(inbits), inseq);\r\n requires IsDigitSeq(power2(inbits), inseq);\r\n requires IsDigitSeq(power2(inbits), headseq);\r\n requires IsDigitSeq(power2(inbits), tailseq);\r\n requires inseq == headseq + tailseq;\r\n requires 0\r\ninclude \"relational.s.dfy\"\r\ninclude \"be_sequences.s.dfy\"\r\ninclude \"../Math/power2.i.dfy\"\r\ninclude \"../../Drivers/CPU/assembly_premium.i.dfy\"\r\n\r\nmethod UseDeclassifiedByteSequence(computed:seq, ghost declassed:seq) returns (usable:seq)\r\n requires |declassed| == |computed|;\r\n requires IsByteSeq(computed);\r\n requires public(|computed|);\r\n requires relation(forall i :: left(i) == right(i) && 0 <= left(i) < left(|declassed|) ==> declassified(left(declassed[i]), right(declassed[i]), left(computed[i]), right(computed[i]))); \r\n ensures |usable| == |declassed|;\r\n ensures forall i :: 0 <= i < |declassed| ==> declassed[i] == usable[i];\r\n ensures public(usable);\r\n{ \r\n var i := 0;\r\n usable := [];\r\n while (i < |computed|) \r\n invariant 0 <= i <= |computed|;\r\n invariant |usable| == i;\r\n invariant forall j :: 0 <= j < i ==> declassed[j] == usable[j];\r\n invariant IsByteSeq(computed);\r\n invariant public(i);\r\n invariant public(|computed|);\r\n invariant public(usable);\r\n invariant relation(forall j :: left(j) == right(j) && 0 <= left(j) < left(|declassed|) ==> declassified(left(declassed[j]), right(declassed[j]), left(computed[j]), right(computed[j]))); \r\n invariant |computed| == |declassed|;\r\n {\r\n calc {\r\n computed[i];\r\n < power2(8);\r\n < { lemma_power2_strictly_increases(8, 32); }\r\n power2(32);\r\n }\r\n var result := Asm_declassify_result(computed[i], declassed[i]);\r\n usable := usable + [result];\r\n i := i + 1;\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/relational.s.dfy", "content": "//-//////////////////////////////////////////\r\n//- Relational interface used by SymDiff\r\n//-//////////////////////////////////////////\r\n\r\n//- Dummy functions that are translated into BoogieAsm keywords:\r\nstatic function left(x:t) : t { x }\r\nstatic function right(x:t) : t { x }\r\nstatic predicate relation(x:t) { true }\r\nstatic predicate public(x:t) { true }\r\n\r\n//- Imported functions:\r\nstatic predicate{:imported} declassified(lg:int, rg:int, l:int, r:int)\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/repeat_digit.i.dfy", "content": "include \"be_sequences.s.dfy\"\r\ninclude \"../Math/div.i.dfy\"\r\ninclude \"seqs_simple.i.dfy\"\r\n\r\nstatic lemma Lemma_RepeatDigitProperties(digit:int, count:int)\r\n decreases count;\r\n ensures |RepeatDigit(digit, count)| == if count < 0 then 0 else count;\r\n ensures forall i :: 0 <= i < count ==> RepeatDigit(digit, count)[i] == digit;\r\n{\r\n if (count > 0)\r\n {\r\n Lemma_RepeatDigitProperties(digit, count - 1);\r\n }\r\n}\r\n\r\nstatic function RepeatDigit_premium(digit:int, count:int) : seq\r\n ensures |RepeatDigit(digit, count)| == if count < 0 then 0 else count;\r\n ensures forall i :: 0 <= i < count ==> RepeatDigit(digit, count)[i] == digit;\r\n{\r\n Lemma_RepeatDigitProperties(digit, count);\r\n RepeatDigit(digit, count)\r\n}\r\n\r\nstatic function {:opaque} SequenceOfZeros(n:nat) : seq\r\n//- ensures SequenceOfZeros(n)!=NSeqInt_n();\r\n ensures |SequenceOfZeros(n)|==n;\r\n ensures forall i :: 0<=i SequenceOfZeros(n)[i]==0;\r\n ensures forall pv :: 0 IsDigitSeq(pv, SequenceOfZeros(n));\r\n{\r\n if (n==0) then [] else SequenceOfZeros(n-1)+[0]\r\n}\r\n\r\nstatic lemma lemma_SequenceOfZeros_is_RepeatDigit(count:nat)\r\n ensures SequenceOfZeros(count) == RepeatDigit(0, count);\r\n{\r\n Lemma_RepeatDigitProperties(0, count);\r\n}\r\n\r\nstatic method SequenceOfZerosIterative(n:nat) returns (Z:seq)\r\n requires Word32(n);\r\n ensures Z == SequenceOfZeros(n);\r\n//- ensures Z!=NSeqInt_n();\r\n ensures |Z|==n;\r\n ensures forall i :: 0<=i Z[i]==0;\r\n ensures forall pv :: 0 IsDigitSeq(pv, Z);\r\n{\r\n reveal_SequenceOfZeros();\r\n\r\n var num_zeros := 0;\r\n var z := [];\r\n while (num_zeros < n)\r\n invariant 0 <= num_zeros <= n;\r\n invariant z == SequenceOfZeros(num_zeros);\r\n {\r\n z := z + [0];\r\n num_zeros := num_zeros + 1;\r\n }\r\n Z := z;\r\n}\r\n\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_private_zero(pv:int, b:int)\r\n requires 1 BEIntToDigitSeq_private(pv, b, 0)[i] == 0;\r\n{\r\n reveal_BEIntToDigitSeq_private();\r\n if (b==0)\r\n {\r\n }\r\n else\r\n {\r\n lemma_BEIntToDigitSeq_private_zero(pv, b-1);\r\n calc {\r\n BEIntToDigitSeq_private(pv, b, 0);\r\n { lemma_div_pos_is_pos(0,pv); }\r\n BEIntToDigitSeq_private(pv, b-1, div(0,pv)) + [ mod(0,pv) ];\r\n { lemma_small_mod(0,pv); }\r\n BEIntToDigitSeq_private(pv, b-1, div(0,pv)) + [ 0 ];\r\n { lemma_div_basics(pv); }\r\n BEIntToDigitSeq_private(pv, b-1, 0) + [ 0 ];\r\n }\r\n forall (i | 0<=i BEIntToDigitSeq_private(pv, b, 0)[i] == 0;\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_invertibility_zero(pv:int, digitseq:seq)\r\n requires 1 digitseq[i] == 0;\r\n decreases |digitseq|;\r\n ensures BEDigitSeqToInt(pv, digitseq) == 0;\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n reveal_BEIntToDigitSeq_private();\r\n if (|digitseq|==0)\r\n {\r\n }\r\n else\r\n {\r\n calc {\r\n BEDigitSeqToInt(pv, digitseq);\r\n BEDigitSeqToInt_private(pv, digitseq);\r\n BEDigitSeqToInt_private(pv, digitseq[0..|digitseq|-1])*pv + digitseq[|digitseq|-1];\r\n {\r\n var prefix := digitseq[..|digitseq|-1];\r\n lemma_BEIntToDigitSeq_private_zero(pv, |digitseq|-1);\r\n var subzero := BEIntToDigitSeq_private(pv, |digitseq|-1, 0);\r\n assert |subzero| == |digitseq| - 1;\r\n assert forall i::0<=i<|digitseq|-1 ==> subzero[i] == 0;\r\n assert subzero == prefix;\r\n\r\n lemma_BEIntToDigitSeq_invertibility_zero(pv, subzero);\r\n assert BEDigitSeqToInt(pv, subzero) == 0;\r\n assert BEDigitSeqToInt_private(pv, prefix) == 0;\r\n calc {\r\n BEDigitSeqToInt_private(pv, digitseq[0..|digitseq|-1]);\r\n { lemma_vacuous_statement_about_a_sequence(digitseq, |digitseq|-1); }\r\n BEDigitSeqToInt_private(pv, prefix);\r\n 0;\r\n }\r\n }\r\n mul(0,pv) + digitseq[|digitseq|-1];\r\n { lemma_mul_basics_forall(); }\r\n digitseq[|digitseq|-1];\r\n 0;\r\n }\r\n }\r\n}\r\n\r\nstatic method RepeatDigit_impl(digit:int, count:int) returns (os:seq)\r\n ensures os == RepeatDigit_premium(digit, count);\r\n{\r\n os := [];\r\n\r\n if count < 0 {\r\n return;\r\n }\r\n\r\n var i := 0;\r\n while i < count\r\n invariant 0 <= i <= count;\r\n invariant os == RepeatDigit(digit, i);\r\n {\r\n os := os + [digit];\r\n i := i + 1;\r\n }\r\n}\r\n\r\nstatic method RepeatDigit_impl_arrays(digit:int, count:int) returns (os:array)\r\n ensures os != null;\r\n ensures os[..] == RepeatDigit_premium(digit, count);\r\n{\r\n if count < 0 {\r\n os := new int[0];\r\n return;\r\n }\r\n\r\n os := new int[count];\r\n var i := 0;\r\n while i < count\r\n invariant 0 <= i <= count;\r\n invariant os[..i] == RepeatDigit(digit, i);\r\n {\r\n os[i] := digit;\r\n i := i + 1;\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/seq_blocking.i.dfy", "content": "include \"seq_blocking.s.dfy\"\r\ninclude \"seqs_simple.i.dfy\"\r\ninclude \"arrays_and_seqs.i.dfy\"\r\ninclude \"../Math/round.i.dfy\"\r\ninclude \"../Math/div.i.dfy\"\r\ninclude \"../Math/mul.i.dfy\"\r\n\r\nstatic lemma Lemma_SubtractOneBlock(block_num:int, block_size:int, block_index:int)\r\n ensures (block_num-1)*block_size + block_index == block_num * block_size + block_index - block_size;\r\n{\r\n calc {\r\n (block_num-1)*block_size;\r\n { lemma_mul_is_commutative(block_num-1, block_size);}\r\n block_size * (block_num-1);\r\n { lemma_mul_is_distributive_sub(block_size, block_num, 1); }\r\n (block_size * block_num) - (block_size * 1);\r\n (block_size * block_num) - block_size;\r\n { lemma_mul_is_commutative(block_size, block_num); }\r\n (block_num * block_size) - block_size;\r\n }\r\n}\r\n\r\nstatic lemma{:dafnycc_conservative_seq_triggers} Lemma_BlockedSequenceContainsElement(os:seq, block_size:int, block_num:int, block_index:int)\r\n requires 0 <= block_index < block_size;\r\n requires 0 <= block_num;\r\n requires 0 <= block_num * block_size + block_index < |os|;\r\n ensures block_num < |BreakIntoBlocks(os, block_size)|;\r\n ensures block_index < |BreakIntoBlocks(os, block_size)[block_num]|;\r\n ensures 0 <= block_num * block_size + block_index;\r\n ensures os[block_num * block_size + block_index] == BreakIntoBlocks(os, block_size)[block_num][block_index];\r\n{\r\n reveal_BreakIntoBlocks();\r\n calc {\r\n |os|;\r\n > block_num * block_size + block_index;\r\n >= { lemma_mul_inequality(0, block_num, block_size); lemma_mul_is_mul_boogie(0, block_size); }\r\n (0 * block_size) + block_index;\r\n == 0 + block_index;\r\n >= 0;\r\n }\r\n assert |os| > 0;\r\n\r\n calc {\r\n block_num * block_size + block_index;\r\n >= { lemma_mul_inequality(0, block_num, block_size); lemma_mul_is_mul_boogie(0, block_size); }\r\n (0 * block_size) + block_index;\r\n == 0 + block_index;\r\n >= 0;\r\n }\r\n\r\n if |os| < block_size {\r\n if block_num >= 1 {\r\n calc {\r\n |os|;\r\n > block_num * block_size + block_index;\r\n >= { lemma_mul_inequality(1, block_num, block_size); lemma_mul_is_mul_boogie(1, block_size); }\r\n (1 * block_size) + block_index;\r\n == block_size + block_index;\r\n >= block_size;\r\n >= |os|;\r\n }\r\n assert false;\r\n }\r\n assert 0 == block_num < |BreakIntoBlocks(os, block_size)|;\r\n calc {\r\n |BreakIntoBlocks(os, block_size)[block_num]|;\r\n == |os|;\r\n > block_num * block_size + block_index;\r\n == { lemma_mul_is_mul_boogie(0, block_size); }\r\n 0 * block_size + block_index;\r\n == block_index;\r\n }\r\n calc {\r\n os[block_num * block_size + block_index];\r\n { lemma_mul_is_mul_boogie(0, block_size); }\r\n os[0 * block_size + block_index];\r\n os[block_index];\r\n BreakIntoBlocks(os, block_size)[0][block_index];\r\n BreakIntoBlocks(os, block_size)[block_num][block_index];\r\n }\r\n }\r\n else {\r\n if block_num > 0 {\r\n calc {\r\n (block_num-1)*block_size + block_index;\r\n >= { lemma_mul_nonnegative(block_num-1, block_size); }\r\n 0 + block_index;\r\n >= 0;\r\n }\r\n calc {\r\n (block_num-1)*block_size + block_index;\r\n { Lemma_SubtractOneBlock(block_num, block_size, block_index); }\r\n block_num * block_size - block_size + block_index;\r\n < |os| - block_size;\r\n == |os[block_size..]|;\r\n }\r\n Lemma_BlockedSequenceContainsElement(os[block_size..], block_size, block_num-1, block_index);\r\n calc {\r\n os[block_num * block_size + block_index];\r\n calc {\r\n block_num * block_size + block_index;\r\n >= { lemma_mul_inequality(1, block_num, block_size); lemma_mul_is_mul_boogie(1, block_size); }\r\n 1 * block_size + block_index;\r\n == block_size + block_index;\r\n >= block_size;\r\n }\r\n { lemma_seq_suffix(os, block_size, block_num * block_size + block_index); }\r\n os[block_size..][block_num * block_size + block_index - block_size];\r\n { Lemma_SubtractOneBlock(block_num, block_size, block_index); }\r\n os[block_size..][(block_num-1) * block_size + block_index];\r\n { Lemma_BlockedSequenceContainsElement(os[block_size..], block_size, block_num-1, block_index); }\r\n BreakIntoBlocks(os[block_size..], block_size)[block_num-1][block_index];\r\n ([os[..block_size]] + BreakIntoBlocks(os[block_size..], block_size))[block_num][block_index];\r\n BreakIntoBlocks(os, block_size)[block_num][block_index];\r\n }\r\n }\r\n else {\r\n calc {\r\n os[block_num * block_size + block_index];\r\n { lemma_mul_is_mul_boogie(0, block_size); }\r\n os[0 * block_size + block_index];\r\n os[block_index];\r\n os[..block_size][block_index];\r\n ([os[..block_size]] + BreakIntoBlocks(os[block_size..], block_size))[0][block_index];\r\n ([os[..block_size]] + BreakIntoBlocks(os[block_size..], block_size))[block_num][block_index];\r\n BreakIntoBlocks(os, block_size)[block_num][block_index];\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic lemma Lemma_BlockedSequencePrefixContainsElement(os:seq, prefix_size:int, block_size:int, block_num:int, block_index:int)\r\n requires 0 <= block_index < block_size;\r\n requires 0 <= block_num;\r\n requires 0 <= prefix_size;\r\n requires 0 <= block_num * block_size + block_index < prefix_size <= |os|;\r\n ensures block_num < |BreakIntoBlocks(os, block_size)|;\r\n ensures block_index < |BreakIntoBlocks(os, block_size)[block_num]|;\r\n ensures block_num < |BreakIntoBlocks(os[..prefix_size], block_size)|;\r\n ensures block_index < |BreakIntoBlocks(os[..prefix_size], block_size)[block_num]|;\r\n ensures os[block_num * block_size + block_index] == BreakIntoBlocks(os[..prefix_size], block_size)[block_num][block_index];\r\n{\r\n Lemma_BlockedSequenceContainsElement(os, block_size, block_num, block_index);\r\n Lemma_BlockedSequenceContainsElement(os[..prefix_size], block_size, block_num, block_index);\r\n calc {\r\n os[block_num * block_size + block_index];\r\n (os[..prefix_size] + os[prefix_size..])[block_num * block_size + block_index];\r\n os[..prefix_size][block_num * block_size + block_index];\r\n BreakIntoBlocks(os[..prefix_size], block_size)[block_num][block_index];\r\n }\r\n}\r\n\r\nstatic lemma Lemma_AllBlocksAreOfEqualSize(os:seq, block_size:int)\r\n requires 0 < block_size;\r\n requires |os| % block_size == 0;\r\n ensures |BreakIntoBlocks(os, block_size)| == |os| / block_size;\r\n ensures forall blk :: 0 <= blk < |BreakIntoBlocks(os, block_size)| ==> |BreakIntoBlocks(os, block_size)[blk]| == block_size;\r\n{\r\n reveal_BreakIntoBlocks();\r\n var num_blocks := |os| / block_size;\r\n var blocks := BreakIntoBlocks(os, block_size);\r\n\r\n calc {\r\n |os|;\r\n { lemma_fundamental_div_mod(|os|, block_size); }\r\n block_size * (|os| / block_size) + |os| % block_size;\r\n block_size * num_blocks + |os| % block_size;\r\n block_size * num_blocks + 0;\r\n block_size * num_blocks;\r\n }\r\n\r\n if |os| == 0 {\r\n lemma_div_basics(block_size);\r\n }\r\n else if |os| < block_size {\r\n calc {\r\n (0 * block_size) + |os|;\r\n |os|;\r\n }\r\n lemma_fundamental_div_mod_converse(|os|, block_size, 0, |os|);\r\n assert |os| % block_size == |os| == 0;\r\n assert false;\r\n }\r\n else {\r\n calc {\r\n num_blocks;\r\n == |os| / block_size;\r\n >= { lemma_div_is_ordered(block_size, |os|, block_size); }\r\n block_size / block_size;\r\n { lemma_div_basics(block_size); }\r\n 1;\r\n }\r\n calc {\r\n |os[block_size..]| % block_size;\r\n (|os| - block_size) % block_size;\r\n (-1 * block_size + |os|) % block_size;\r\n (block_size * -1 + |os|) % block_size;\r\n { lemma_mul_is_mul_boogie(block_size, -1);\r\n lemma_mod_multiples_vanish(-1, |os|, block_size); }\r\n |os| % block_size;\r\n 0;\r\n }\r\n Lemma_AllBlocksAreOfEqualSize(os[block_size..], block_size);\r\n assert |BreakIntoBlocks(os[block_size..], block_size)| == |os[block_size..]| / block_size;\r\n calc {\r\n |blocks|;\r\n 1 + |BreakIntoBlocks(os[block_size..], block_size)|;\r\n 1 + |os[block_size..]| / block_size;\r\n 1 + (|os| - block_size) / block_size;\r\n 1 + (block_size * num_blocks - block_size) / block_size;\r\n 1 + (block_size * num_blocks - 1 * block_size) / block_size;\r\n { lemma_mul_is_mul_boogie(1, block_size);\r\n lemma_mul_is_commutative(1, block_size);\r\n lemma_mul_is_distributive_sub(block_size, num_blocks, 1); }\r\n 1 + (block_size * (num_blocks - 1)) / block_size;\r\n { lemma_mul_is_commutative(block_size, num_blocks - 1);\r\n lemma_div_by_multiple(num_blocks - 1, block_size); }\r\n 1 + (num_blocks - 1);\r\n |os| / block_size;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma Lemma_AllBlocksAreWordSeqs(os:seq, block_size:int)\r\n requires 0 < block_size;\r\n requires IsWordSeq(os);\r\n ensures forall blk :: 0 <= blk < |BreakIntoBlocks(os, block_size)| ==> IsWordSeq(BreakIntoBlocks(os, block_size)[blk]);\r\n{\r\n reveal_BreakIntoBlocks();\r\n if (|os| >= block_size)\r\n {\r\n Lemma_AllBlocksAreWordSeqs(os[block_size..], block_size);\r\n assert BreakIntoBlocks(os, block_size) == [os[..block_size]] + BreakIntoBlocks(os[block_size..], block_size); //- dafnycc triggering\r\n }\r\n}\r\n\r\nstatic predicate BlockBoundariesAreWithinSequence(i:int, block_size:int, len:int)\r\n{\r\n 0 <= i*block_size <= (i+1)*block_size <= len\r\n}\r\n\r\nstatic lemma Lemma_BoundariesOfSeqBlock(s:seq, block_size:int)\r\n requires 0 < block_size;\r\n requires |s| % block_size == 0;\r\n ensures forall i :: 0 <= i < (|s| / block_size) ==> BlockBoundariesAreWithinSequence(i, block_size, |s|);\r\n ensures |s| == (|s| / block_size) * block_size;\r\n{\r\n Lemma_AllBlocksAreOfEqualSize(s, block_size);\r\n\r\n var num_blocks := |s| / block_size;\r\n\r\n calc {\r\n |s|;\r\n { lemma_fundamental_div_mod(|s|, block_size); }\r\n block_size * (|s| / block_size) + |s| % block_size;\r\n block_size * num_blocks + |s| % block_size;\r\n block_size * num_blocks + 0;\r\n block_size * num_blocks;\r\n { lemma_mul_is_commutative(block_size, num_blocks); }\r\n num_blocks * block_size;\r\n }\r\n\r\n forall j | 0 <= j < num_blocks\r\n ensures 0 <= j*block_size;\r\n {\r\n lemma_mul_nonnegative(j, block_size);\r\n }\r\n\r\n forall j | 0 <= j < num_blocks\r\n ensures j*block_size <= (j+1)*block_size <= |s|;\r\n {\r\n calc {\r\n j*block_size;\r\n <= { lemma_mul_inequality(j, j+1, block_size); }\r\n (j+1)*block_size;\r\n }\r\n calc {\r\n (j+1) * block_size;\r\n <= { lemma_mul_inequality(j+1, num_blocks, block_size); }\r\n num_blocks * block_size;\r\n |s|;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma Lemma_EqualBlockingCausesSpecificSubsequences(s:seq, block_size:int, i:int)\r\n requires 0 < block_size;\r\n requires |s| % block_size == 0;\r\n requires 0 <= i < (|s| / block_size);\r\n ensures 0 <= i*block_size <= (i+1)*block_size <= |s|;\r\n ensures |BreakIntoBlocks(s, block_size)| == |s| / block_size;\r\n ensures BreakIntoBlocks(s, block_size)[i] == s[i*block_size .. (i+1)*block_size];\r\n{\r\n Lemma_AllBlocksAreOfEqualSize(s, block_size);\r\n Lemma_BoundariesOfSeqBlock(s, block_size);\r\n assert BlockBoundariesAreWithinSequence(i, block_size, |s|);\r\n\r\n if i == 0 {\r\n calc <= {1; {reveal_BreakIntoBlocks();} |s|;}\r\n if |s| < block_size {\r\n lemma_small_div();\r\n assert |s| / block_size == 0;\r\n assert false;\r\n }\r\n else if |s| == block_size {\r\n calc {\r\n BreakIntoBlocks(s, block_size)[i];\r\n { reveal_BreakIntoBlocks(); }\r\n [s][i];\r\n [s][0];\r\n s;\r\n s[0..|s|];\r\n s[0..block_size];\r\n s[0*block_size..1*block_size];\r\n { lemma_mul_is_mul_boogie(0, block_size); }\r\n s[i*block_size..1*block_size];\r\n { reveal_BreakIntoBlocks(); }\r\n s[i*block_size..(i+1)*block_size];\r\n }\r\n }\r\n else {\r\n calc {\r\n BreakIntoBlocks(s, block_size)[i];\r\n BreakIntoBlocks(s, block_size)[0];\r\n { reveal_BreakIntoBlocks(); }\r\n ([s[..block_size]] + BreakIntoBlocks(s[block_size..], block_size))[0];\r\n s[..block_size];\r\n s[0..block_size];\r\n s[0*block_size..1*block_size];\r\n { lemma_mul_is_mul_boogie(0, block_size); }\r\n s[i*block_size..1*block_size];\r\n { lemma_mul_is_mul_boogie(1, block_size); }\r\n s[i*block_size..(i+1)*block_size];\r\n }\r\n }\r\n }\r\n else {\r\n if |s| < block_size {\r\n lemma_small_div();\r\n assert |s| / block_size == 0;\r\n assert false;\r\n }\r\n else if |s| == block_size {\r\n calc {|s| / block_size; { reveal_BreakIntoBlocks(); } 1;}\r\n assert false;\r\n }\r\n else {\r\n calc {\r\n BreakIntoBlocks(s, block_size)[i];\r\n { reveal_BreakIntoBlocks(); }\r\n ([s[..block_size]] + BreakIntoBlocks(s[block_size..], block_size))[i];\r\n BreakIntoBlocks(s[block_size..], block_size)[i-1];\r\n { calc {\r\n (|s| - block_size) % block_size;\r\n (-block_size + |s|) % block_size;\r\n (block_size * -1 + |s|) % block_size;\r\n { lemma_mod_multiples_vanish(-1, |s|, block_size); }\r\n { lemma_mul_is_mul_boogie(block_size, -1); }\r\n |s| % block_size;\r\n 0;\r\n }\r\n calc {\r\n i-1;\r\n < |s|/block_size - 1;\r\n { lemma_hoist_over_denominator(|s|, -1, block_size); lemma_mul_is_mul_boogie(-1, block_size); }\r\n (|s| + -1 * block_size) / block_size;\r\n (|s| - block_size)/block_size;\r\n }\r\n Lemma_EqualBlockingCausesSpecificSubsequences(s[block_size..], block_size, i-1); }\r\n s[block_size..][(i-1)*block_size..(i-1+1)*block_size];\r\n s[block_size..][(i-1)*block_size..i*block_size];\r\n { lemma_mul_nonnegative(i - 1, block_size); /* dafnycc */ }\r\n s[(i-1)*block_size+block_size..i*block_size+block_size];\r\n s[(i-1)*block_size+block_size*1..i*block_size+block_size];\r\n { lemma_mul_is_commutative(i-1, block_size); }\r\n s[block_size*(i-1)+block_size*1..i*block_size+block_size];\r\n { lemma_mul_is_mul_boogie(block_size, 1); lemma_mul_is_distributive_add(block_size, i-1, 1); }\r\n s[block_size*(i-1+1)..i*block_size+block_size];\r\n s[block_size*i..i*block_size+block_size];\r\n { lemma_mul_is_commutative(i, block_size); }\r\n s[i*block_size..block_size*i+block_size];\r\n s[i*block_size..block_size*i+block_size*1];\r\n { lemma_mul_is_mul_boogie(block_size, 1); lemma_mul_is_distributive_add(block_size, i, 1); }\r\n s[i*block_size..block_size*(i+1)];\r\n { lemma_mul_is_commutative(i+1, block_size); }\r\n s[i*block_size..(i+1)*block_size];\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic method DivideSeqIntoEqualBlocks(s:seq, block_size:int) returns (r:seq>)\r\n requires 0 < block_size;\r\n requires |s| % block_size == 0;\r\n ensures r == BreakIntoBlocks(s, block_size);\r\n ensures forall i :: 0 <= i < |r| ==> |r[i]| == block_size;\r\n{\r\n Lemma_AllBlocksAreOfEqualSize(s, block_size);\r\n\r\n var num_blocks := |s| / block_size;\r\n var i := 0;\r\n r := [];\r\n\r\n Lemma_BoundariesOfSeqBlock(s, block_size);\r\n\r\n assert forall j :: 0 <= j < num_blocks ==> BlockBoundariesAreWithinSequence(j, block_size, |s|);\r\n\r\n while i < num_blocks\r\n invariant 0 <= i <= num_blocks;\r\n invariant |r| == i;\r\n invariant forall j :: 0 <= j < i ==> BlockBoundariesAreWithinSequence(j, block_size, |s|) &&\r\n r[j] == s[j*block_size .. (j+1)*block_size];\r\n {\r\n assert BlockBoundariesAreWithinSequence(i, block_size, |s|);\r\n r := r + [s[i * block_size .. (i+1) * block_size]];\r\n i := i + 1;\r\n }\r\n\r\n assert |r| == |BreakIntoBlocks(s, block_size)|;\r\n\r\n forall j | 0 <= j < num_blocks\r\n ensures r[j] == BreakIntoBlocks(s, block_size)[j];\r\n {\r\n Lemma_EqualBlockingCausesSpecificSubsequences(s, block_size, j);\r\n }\r\n}\r\n\r\nstatic function{:opaque} PadSequenceToMultiple(os:seq, block_size:int) : seq\r\n requires 0 < block_size;\r\n{\r\n if |os| % block_size == 0 then os\r\n else os + RepeatDigit(0, block_size - (|os| % block_size))\r\n}\r\n\r\nstatic function PadAndBreakIntoBlocks(os:seq, block_size:int) : seq>\r\n requires 0 < block_size;\r\n{\r\n BreakIntoBlocks(PadSequenceToMultiple(os, block_size), block_size)\r\n}\r\n\r\nstatic lemma lemma_PadSequenceToMultiple_premium_properties(os:seq, block_size:int)\r\n requires 0 < block_size;\r\n ensures var padded_len := RoundUpToMultiple(|os|, block_size);\r\n var num_blocks := padded_len / block_size;\r\n |PadSequenceToMultiple(os, block_size)| == padded_len &&\r\n padded_len % block_size == 0 &&\r\n (forall i :: 0 <= i < num_blocks ==> 0 <= block_size*i == i*block_size) &&\r\n (forall i :: 0 <= i < num_blocks ==> i*block_size == block_size*i <= (i+1)*block_size == block_size*(i+1) <= padded_len) &&\r\n (forall i :: 0 <= i < num_blocks ==> 0 <= block_size*i == i*block_size <= (i+1)*block_size == block_size*(i+1) <= padded_len);\r\n{\r\n reveal_BreakIntoBlocks();\r\n reveal_PadSequenceToMultiple();\r\n var padded_len := RoundUpToMultiple_premium(|os|, block_size);\r\n var num_blocks := padded_len / block_size;\r\n\r\n if |os| % block_size != 0 {\r\n calc {\r\n |PadSequenceToMultiple(os, block_size)|;\r\n |os + RepeatDigit(0, block_size - |os| % block_size)|;\r\n |os| + |RepeatDigit_premium(0, block_size - |os| % block_size)|;\r\n { lemma_mod_remainder_pos_specific(|os|, block_size); }\r\n |os| + block_size - |os| % block_size;\r\n }\r\n }\r\n\r\n forall i | 0 <= i < num_blocks\r\n ensures 0 <= block_size*i == i*block_size;\r\n {\r\n lemma_mul_nonnegative(block_size, i);\r\n lemma_mul_is_commutative(i, block_size);\r\n }\r\n\r\n forall i | 0 <= i < num_blocks\r\n ensures i*block_size == block_size*i <= (i+1)*block_size == block_size*(i+1) <= padded_len;\r\n {\r\n calc {\r\n i*block_size;\r\n <= { lemma_mul_inequality(i, i+1, block_size); }\r\n (i+1)*block_size;\r\n }\r\n calc {\r\n (i+1) * block_size;\r\n <= { lemma_mul_inequality(i+1, num_blocks, block_size); }\r\n num_blocks * block_size;\r\n { lemma_mul_is_commutative(num_blocks, block_size); }\r\n block_size * num_blocks;\r\n { lemma_fundamental_div_mod(padded_len, block_size); }\r\n padded_len - padded_len % block_size;\r\n padded_len;\r\n }\r\n lemma_mul_is_commutative(i, block_size);\r\n lemma_mul_is_commutative(i+1, block_size);\r\n }\r\n}\r\n\r\nstatic function PadSequenceToMultiple_premium(os:seq, block_size:int) : seq\r\n requires 0 < block_size;\r\n ensures var padded_len := RoundUpToMultiple(|os|, block_size);\r\n var num_blocks := padded_len / block_size;\r\n |PadSequenceToMultiple(os, block_size)| == padded_len &&\r\n padded_len % block_size == 0 &&\r\n (forall i :: 0 <= i < num_blocks ==> 0 <= block_size*i == i*block_size) &&\r\n (forall i :: 0 <= i < num_blocks ==> i*block_size == block_size*i <= (i+1)*block_size == block_size*(i+1) <= padded_len) &&\r\n (forall i :: 0 <= i < num_blocks ==> 0 <= block_size*i == i*block_size <= (i+1)*block_size == block_size*(i+1) <= padded_len);\r\n{\r\n lemma_PadSequenceToMultiple_premium_properties(os, block_size);\r\n PadSequenceToMultiple(os, block_size)\r\n}\r\n\r\nstatic lemma lemma_PadAndBreakIntoBlocks_premium_properties(os:seq, block_size:int)\r\n requires 0 < block_size;\r\n ensures var padded_len := RoundUpToMultiple(|os|, block_size);\r\n var num_blocks := padded_len / block_size;\r\n |PadSequenceToMultiple(os, block_size)| == padded_len &&\r\n padded_len % block_size == 0 &&\r\n |PadAndBreakIntoBlocks(os, block_size)| == num_blocks &&\r\n (forall i :: 0 <= i < num_blocks ==> |PadAndBreakIntoBlocks(os, block_size)[i]| == block_size &&\r\n BlockBoundariesAreWithinSequence(i, block_size, padded_len) &&\r\n PadAndBreakIntoBlocks(os, block_size)[i] ==\r\n PadSequenceToMultiple(os, block_size)[i*block_size..(i+1)*block_size]);\r\n{\r\n var ps := PadSequenceToMultiple_premium(os, block_size);\r\n var padded_len := |ps|;\r\n var num_blocks := padded_len / block_size;\r\n\r\n Lemma_AllBlocksAreOfEqualSize(ps, block_size);\r\n forall i | 0 <= i < num_blocks\r\n ensures PadAndBreakIntoBlocks(os, block_size)[i] == ps[i*block_size..(i+1)*block_size];\r\n {\r\n Lemma_EqualBlockingCausesSpecificSubsequences(ps, block_size, i);\r\n }\r\n}\r\n\r\nstatic function PadAndBreakIntoBlocks_premium(os:seq, block_size:int) : seq>\r\n requires 0 < block_size;\r\n ensures var padded_len := RoundUpToMultiple(|os|, block_size);\r\n var num_blocks := padded_len / block_size;\r\n |PadSequenceToMultiple(os, block_size)| == padded_len &&\r\n padded_len % block_size == 0 &&\r\n |PadAndBreakIntoBlocks(os, block_size)| == num_blocks &&\r\n (forall i :: 0 <= i < num_blocks ==> |PadAndBreakIntoBlocks(os, block_size)[i]| == block_size &&\r\n BlockBoundariesAreWithinSequence(i, block_size, padded_len) &&\r\n PadAndBreakIntoBlocks(os, block_size)[i] ==\r\n PadSequenceToMultiple(os, block_size)[i*block_size..(i+1)*block_size]);\r\n{\r\n lemma_PadAndBreakIntoBlocks_premium_properties(os, block_size);\r\n PadAndBreakIntoBlocks(os, block_size)\r\n}\r\n\r\nstatic method PadSequenceToMultiple_impl(os:seq, block_size:int) returns (ps:seq)\r\n requires 0 < block_size;\r\n ensures ps == PadSequenceToMultiple(os, block_size);\r\n{\r\n reveal_PadSequenceToMultiple();\r\n if |os| % block_size == 0 {\r\n ps := os;\r\n }\r\n else {\r\n var rs := RepeatDigit_impl(0, block_size - |os| % block_size);\r\n ps := os + rs;\r\n }\r\n}\r\n\r\nstatic method PadAndBreakIntoBlocks_impl(os:seq, block_size:int) returns (r:seq>)\r\n requires 0 < block_size;\r\n ensures r == PadAndBreakIntoBlocks_premium(os, block_size);\r\n{\r\n reveal_PadSequenceToMultiple();\r\n var ps := PadSequenceToMultiple_impl(os, block_size);\r\n assert ps == PadSequenceToMultiple_premium(os, block_size);\r\n r := DivideSeqIntoEqualBlocks(ps, block_size);\r\n}\r\n\r\nstatic lemma lemma_PadAndBreakIntoBlocksMaintainsByteSequence(os:seq, block_size:int)\r\n requires 0 < block_size;\r\n requires IsByteSeq(os);\r\n ensures forall i :: 0 <= i < |PadAndBreakIntoBlocks(os, block_size)| ==> IsByteSeq(PadAndBreakIntoBlocks(os, block_size)[i]);\r\n{\r\n reveal_BreakIntoBlocks();\r\n reveal_PadSequenceToMultiple();\r\n var ps := PadSequenceToMultiple_premium(os, block_size);\r\n var bs := BreakIntoBlocks(ps, block_size);\r\n lemma_2toX();\r\n\r\n if (|os| % block_size != 0) {\r\n forall i | 0 <= i < |ps|\r\n ensures IsByte(ps[i]);\r\n {\r\n if i >= |os| {\r\n calc {\r\n ps[i];\r\n (os + RepeatDigit(0, block_size - (|os| % block_size)))[i];\r\n RepeatDigit(0, block_size - (|os| % block_size))[i-|os|];\r\n RepeatDigit_premium(0, block_size - (|os| % block_size))[i-|os|];\r\n 0;\r\n }\r\n }\r\n }\r\n }\r\n\r\n forall i | 0 <= i < |bs|\r\n ensures IsByteSeq(bs[i]);\r\n {\r\n lemma_PadAndBreakIntoBlocks_premium_properties(os, block_size);\r\n assert BlockBoundariesAreWithinSequence(i, block_size, |ps|);\r\n assert bs[i] == ps[i*block_size..(i+1)*block_size];\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/seq_blocking.s.dfy", "content": "include \"be_sequences.s.dfy\"\r\n\r\nstatic function{:opaque} BreakIntoBlocks(os:seq, block_size:int) : seq>\r\n requires 0 < block_size;\r\n decreases |os|;\r\n{\r\n if |os| == 0 then []\r\n else if |os| < block_size then [os]\r\n else [os[..block_size]] + BreakIntoBlocks(os[block_size..], block_size)\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/seqs_and_ints.i.dfy", "content": "include \"integer_sequences.s.dfy\"\r\ninclude \"seqs_simple.i.dfy\"\r\ninclude \"repeat_digit.i.dfy\"\r\ninclude \"../Math/div.i.dfy\"\r\ninclude \"../Math/power.i.dfy\"\r\ninclude \"../Math/power2.i.dfy\"\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- This file establishes properties that relate BEDigitSeqs\r\n//- to their Int interpretation. In particular, it culminates\r\n//- in reasoning about invertibility properties: For example, there's\r\n//- only one byte sequence to represent a given int, and vice versa.\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- properties about DigitSeqToInt\r\n\r\nstatic lemma lemma_BEDigitSeqToInt_bound(pv:nat, inseq:seq)\r\n requires 0 < pv;\r\n requires IsDigitSeq(pv, inseq);\r\n decreases |inseq|;\r\n ensures |inseq|>0 ==> inseq[0] * power(pv, |inseq|-1) <= BEDigitSeqToInt(pv, inseq);\r\n ensures BEDigitSeqToInt(pv, inseq) < power(pv, |inseq|);\r\n ensures 0 <= BEDigitSeqToInt(pv, inseq);\r\n{\r\n var result := BEDigitSeqToInt(pv, inseq);\r\n reveal_BEDigitSeqToInt_private();\r\n\r\n if (inseq==[])\r\n {\r\n assert result == 0;\r\n lemma_power_positive(pv, |inseq|);\r\n }\r\n else\r\n {\r\n lemma_BEDigitSeqToInt_bound(pv, inseq[0..|inseq|-1]);\r\n\r\n if (|inseq|==1)\r\n {\r\n calc {\r\n inseq[0] * power(pv, |inseq|-1);\r\n { lemma_power_0(pv); }\r\n mul(inseq[0], 1);\r\n { lemma_mul_basics_forall(); }\r\n inseq[0];\r\n inseq[|inseq|-1];\r\n { lemma_mul_basics_forall(); }\r\n 0*pv + inseq[|inseq|-1];\r\n BEDigitSeqToInt_private(pv, [])*pv + inseq[|inseq|-1];\r\n BEDigitSeqToInt_private(pv, inseq[0..|inseq|-1])*pv + inseq[|inseq|-1];\r\n BEDigitSeqToInt_private(pv, inseq);\r\n BEDigitSeqToInt(pv, inseq);\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n inseq[0] * power(pv, |inseq|-1);\r\n { lemma_power_adds(pv, |inseq|-2, 1); }\r\n inseq[0] * (power(pv, |inseq|-2) * power(pv,1));\r\n { lemma_power_1(pv); }\r\n inseq[0] * (power(pv, |inseq|-2) * pv);\r\n { lemma_mul_is_associative_forall(); }\r\n (inseq[0] * power(pv, |inseq|-2)) * pv;\r\n (inseq[0] * power(pv, |inseq[0..|inseq|-1]|-1)) * pv;\r\n <=\r\n (inseq[0] * power(pv, |inseq[0..|inseq|-1]|-1)) * pv + inseq[|inseq|-1];\r\n (inseq[0..|inseq|-1][0] * power(pv, |inseq[0..|inseq|-1]|-1)) * pv + inseq[|inseq|-1];\r\n <= {\r\n lemma_mul_inequality(inseq[0..|inseq|-1][0] * power(pv, |inseq[0..|inseq|-1]|-1), BEDigitSeqToInt_private(pv, inseq[0..|inseq|-1]), pv);\r\n }\r\n BEDigitSeqToInt_private(pv, inseq[0..|inseq|-1])*pv + inseq[|inseq|-1];\r\n BEDigitSeqToInt_private(pv, inseq);\r\n BEDigitSeqToInt(pv, inseq);\r\n }\r\n }\r\n\r\n assert 0 <= BEDigitSeqToInt_private(pv, inseq[0..|inseq|-1]);\r\n calc {\r\n 0;\r\n <= { lemma_mul_nonnegative_forall(); }\r\n pv*BEDigitSeqToInt_private(pv, inseq[0..|inseq|-1]);\r\n { lemma_mul_is_commutative_forall(); }\r\n BEDigitSeqToInt_private(pv, inseq[0..|inseq|-1])*pv;\r\n <= BEDigitSeqToInt_private(pv, inseq[0..|inseq|-1])*pv + inseq[|inseq|-1];\r\n result;\r\n }\r\n calc {\r\n BEDigitSeqToInt_private(pv, inseq[0..|inseq|-1])+1;\r\n <= { lemma_BEDigitSeqToInt_bound(pv, inseq[0..|inseq|-1]); }\r\n power(pv, |inseq[0..|inseq|-1]|);\r\n power(pv, |inseq|-1);\r\n }\r\n lemma_mul_inequality(\r\n BEDigitSeqToInt_private(pv, inseq[0..|inseq|-1])+1,\r\n power(pv, |inseq|-1),\r\n pv);\r\n calc {\r\n result;\r\n BEDigitSeqToInt_private(pv, inseq[0..|inseq|-1])*pv + inseq[|inseq|-1];\r\n < BEDigitSeqToInt_private(pv, inseq[0..|inseq|-1])*pv + pv;\r\n { lemma_mul_basics_forall(); }\r\n BEDigitSeqToInt_private(pv, inseq[0..|inseq|-1])*pv + mul(1,pv);\r\n { lemma_mul_is_distributive_forall(); }\r\n (BEDigitSeqToInt_private(pv, inseq[0..|inseq|-1])+1)*pv;\r\n <= power(pv, |inseq|-1)*pv;\r\n { reveal_power(); lemma_mul_is_commutative_forall(); }\r\n power(pv, |inseq|-1+1);\r\n power(pv, |inseq|);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_mp_min(pv:int, mp:int, x:int)\r\n requires 10)\r\n {\r\n lemma_div_basics_forall();\r\n lemma_BEIntToDigitSeq_zero(pv, mp-1);\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_properties_inner(pv:int, mp:int, x:int)\r\n requires 10 ==> 0 < |BEIntToDigitSeq_private(pv, mp, x)|;\r\n ensures (x>0 && (mp<=0 || power(pv,mp-1)<=x)) ==> power(pv, |BEIntToDigitSeq_private(pv, mp, x)|-1) <= x;\r\n{\r\n lemma_BEIntToDigitSeq_mp_min(pv, mp, x);\r\n\r\n if (x==0)\r\n {\r\n lemma_power_positive(pv, |BEIntToDigitSeq_private(pv, mp, x)|);\r\n }\r\n else\r\n {\r\n lemma_div_pos_is_pos(x,pv);\r\n lemma_div_is_strictly_ordered_by_denominator(x,pv);\r\n calc ==> {\r\n true;\r\n { lemma_BEIntToDigitSeq_properties_inner(pv, mp-1, x/pv); }\r\n x/pv+1 <= power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|);\r\n { lemma_mul_inequality_forall(); }\r\n (x/pv+1)*pv <= power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|)*pv;\r\n { lemma_mul_is_distributive_forall(); }\r\n (x/pv)*pv+mul(1,pv) <= power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|)*pv;\r\n { lemma_mul_basics_forall(); }\r\n (x/pv)*pv + pv <= power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|)*pv;\r\n { lemma_fundamental_div_mod(x,pv); lemma_mul_is_commutative_forall(); }\r\n x - x%pv + pv <= power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|)*pv;\r\n }\r\n calc {\r\n x;\r\n < { lemma_mod_properties(); }\r\n x - x%pv + pv;\r\n <= power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|)*pv;\r\n { lemma_power_1(pv); }\r\n power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|)*power(pv, 1);\r\n { lemma_power_adds(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|, 1); }\r\n power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|+1);\r\n power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv) + [x%pv]|);\r\n { reveal_BEIntToDigitSeq_private(); }\r\n power(pv, |BEIntToDigitSeq_private(pv, mp, x)|);\r\n }\r\n\r\n reveal_BEIntToDigitSeq_private();\r\n assert 0 < |BEIntToDigitSeq_private(pv, mp, x)|;\r\n\r\n if (x>0 && (mp<=0 || power(pv,mp-1)<=x)) //- one more obligation.\r\n {\r\n if (x/pv <= 0) //- can't recurse, case I\r\n {\r\n calc ==> {\r\n true;\r\n { lemma_small_div_converse(); }\r\n 01)\r\n {\r\n calc {\r\n power(pv,mp-1);\r\n { lemma_power_adds(pv,mp-2,1); }\r\n power(pv,mp-2)*power(pv,1);\r\n >= {\r\n lemma_power_positive(pv,1);\r\n lemma_power_positive(pv,mp-2);\r\n lemma_mul_increases(power(pv,mp-2), power(pv,1));\r\n }\r\n power(pv,1);\r\n { lemma_power_1(pv); }\r\n pv;\r\n }\r\n assert false;\r\n }\r\n }\r\n mp<=1;\r\n |BEIntToDigitSeq_private(pv, mp, x)| <= 1;\r\n |BEIntToDigitSeq_private(pv, mp, x)|-1 <= 0;\r\n |BEIntToDigitSeq_private(pv, mp, x)|-1 == 0;\r\n { lemma_power_0(pv); }\r\n power(pv, |BEIntToDigitSeq_private(pv, mp, x)|-1) == 1;\r\n power(pv, |BEIntToDigitSeq_private(pv, mp, x)|-1) <= x;\r\n }\r\n }\r\n else if (mp-1>0 && power(pv,mp-1-1)>x/pv) //- can't recurse, case II\r\n {\r\n assert power(pv,mp-1)<=x;\r\n calc ==> {\r\n mp>1;\r\n power(pv,mp-2) > x/pv;\r\n { lemma_div_by_multiple(power(pv,mp-2), pv); }\r\n (power(pv,mp-2)*pv)/pv > x/pv;\r\n { lemma_power_1(pv); }\r\n (power(pv,mp-2)*power(pv,1))/pv > x/pv;\r\n { lemma_power_adds(pv,mp-2,1); }\r\n power(pv,mp-1)/pv > x/pv;\r\n {\r\n if (power(pv,mp-1) <= x)\r\n {\r\n lemma_power_positive(pv,mp-1);\r\n lemma_div_is_ordered(power(pv,mp-1), x, pv);\r\n assert false;\r\n }\r\n }\r\n power(pv,mp-1) > x;\r\n false;\r\n }\r\n }\r\n else //- can recurse\r\n {\r\n assert x/pv > 0 && (mp-1<=0 || power(pv,mp-1-1)<=x/pv);\r\n assert |BEIntToDigitSeq_private(pv, mp-1, x/pv)|-1 >= 0;\r\n\r\n calc ==> {\r\n true;\r\n { lemma_BEIntToDigitSeq_properties_inner(pv, mp-1, x/pv); }\r\n power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|-1) <= x/pv;\r\n\r\n power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|-1) <= x/pv;\r\n { lemma_mul_inequality_forall(); }\r\n power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|-1)*pv <= (x/pv)*pv;\r\n { lemma_fundamental_div_mod(x,pv); lemma_mul_is_commutative_forall(); }\r\n power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|-1)*pv <= x - x%pv;\r\n }\r\n\r\n calc {\r\n power(pv, |BEIntToDigitSeq_private(pv, mp, x)|-1);\r\n power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv) + [x%pv]|-1);\r\n power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|);\r\n power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|-1+1);\r\n { lemma_power_adds(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|-1, 1); }\r\n power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|-1)*power(pv,1);\r\n { lemma_power_1(pv); }\r\n power(pv, |BEIntToDigitSeq_private(pv, mp-1, x/pv)|-1)*pv;\r\n <= x - x%pv;\r\n <= { lemma_mod_properties(); }\r\n x;\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_when_mp_dominates_x(pv:int, mp:int, x:int)\r\n requires 1= power(pv,mp-1))\r\n {\r\n calc {\r\n x;\r\n >= { lemma_fundamental_div_mod(x,pv); lemma_mod_properties(); }\r\n pv*(x/pv);\r\n >= { lemma_mul_inequality_forall(); lemma_mul_is_commutative_forall(); } //- and contradiction hypothesis\r\n pv*power(pv,mp-1);\r\n { reveal_power(); }\r\n power(pv,mp);\r\n }\r\n }\r\n lemma_BEIntToDigitSeq_when_mp_dominates_x(pv, mp-1, x/pv);\r\n }\r\n mp-1+1;\r\n mp;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_properties(pv:int, mp:int, x:int)\r\n requires 10 ==> 0 < |BEIntToDigitSeq_private(pv, mp, x)|;\r\n ensures (x>0 && (mp<=0 || power(pv,mp-1)<=x)) ==> power(pv, |BEIntToDigitSeq_private(pv, mp, x)|-1) <= x;\r\n ensures (0<=mp && x mp == |BEIntToDigitSeq_private(pv, mp, x)|;\r\n{\r\n lemma_BEIntToDigitSeq_properties_inner(pv, mp, x);\r\n if (0<=mp && x0 ==> 0 < |BEIntToDigitSeq_private(pv, 0, x/pv)|;\r\n assert x/pv>0 ==> power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|-1) <= x/pv;\r\n\r\n if (|BEIntToDigitSeq_private(pv, 0, x/pv)|+1 < |BEIntToDigitSeq_private(pv, 0, x)|)\r\n {\r\n //- should be able to place a too-low upper bound on x.\r\n calc ==> {\r\n true;\r\n { lemma_BEIntToDigitSeq_properties_inner(pv, 0, x/pv); }\r\n x/pv < power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|);\r\n x/pv + 1 <= power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|);\r\n { lemma_mul_inequality_forall(); lemma_mul_is_commutative_forall(); }\r\n pv*(x/pv + 1) <= pv*power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|);\r\n { lemma_mul_is_distributive_forall(); }\r\n pv*(x/pv) + mul(pv,1) <= pv*power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|);\r\n { lemma_mul_basics_forall(); }\r\n pv*(x/pv) + pv <= pv*power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|);\r\n { lemma_power_1(pv); lemma_power_adds(pv, 1, |BEIntToDigitSeq_private(pv, 0, x/pv)|); }\r\n pv*(x/pv) + pv <= power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|+1);\r\n { lemma_mod_properties(); }\r\n pv*(x/pv) + x%pv < power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|+1);\r\n { lemma_fundamental_div_mod(x,pv); }\r\n x < power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|+1);\r\n }\r\n\r\n calc ==> {\r\n true;\r\n |BEIntToDigitSeq_private(pv, 0, x/pv)|+2 <= |BEIntToDigitSeq_private(pv, 0, x)|;\r\n { lemma_power_increases(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|+1, |BEIntToDigitSeq_private(pv, 0, x)|-1); }\r\n power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|+1) <= power(pv, |BEIntToDigitSeq_private(pv, 0, x)|-1);\r\n }\r\n\r\n calc {\r\n x;\r\n <\r\n power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|+1);\r\n <=\r\n power(pv, |BEIntToDigitSeq_private(pv, 0, x)|-1);\r\n <= { lemma_BEIntToDigitSeq_properties_inner(pv, 0, x); }\r\n x;\r\n }\r\n assert false;\r\n }\r\n else if (|BEIntToDigitSeq_private(pv, 0, x/pv)|+1 > |BEIntToDigitSeq_private(pv, 0, x)|)\r\n {\r\n //- should be able to place a too-high lower bound on x.\r\n if (x/pv==0)\r\n {\r\n calc {\r\n 1;\r\n 0+1;\r\n { reveal_BEIntToDigitSeq_private(); }\r\n |BEIntToDigitSeq_private(pv, 0, x/pv)|+1;\r\n > //- contradiction hypothesis\r\n |BEIntToDigitSeq_private(pv, 0, x)|;\r\n }\r\n assert |BEIntToDigitSeq_private(pv, 0, x)| == 0;\r\n assert x == 0;\r\n }\r\n else\r\n {\r\n calc ==> {\r\n true;\r\n { lemma_BEIntToDigitSeq_properties_inner(pv, 0, x/pv); }\r\n power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|-1) <= x/pv;\r\n { lemma_mul_inequality_forall(); lemma_mul_is_commutative_forall(); }\r\n pv*power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|-1) <= pv*(x/pv);\r\n { lemma_mod_properties(); }\r\n pv*power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|-1) <= pv*(x/pv) + x%pv;\r\n { lemma_fundamental_div_mod(x,pv); }\r\n pv*power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|-1) <= x;\r\n { lemma_power_1(pv); lemma_power_adds(pv, 1, |BEIntToDigitSeq_private(pv, 0, x/pv)|-1); }\r\n power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|) <= x;\r\n }\r\n\r\n calc ==> {\r\n true;\r\n |BEIntToDigitSeq_private(pv, 0, x/pv)| >= |BEIntToDigitSeq_private(pv, 0, x)|;\r\n { lemma_power_increases(pv, |BEIntToDigitSeq_private(pv, 0, x)|, |BEIntToDigitSeq_private(pv, 0, x/pv)|); }\r\n power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|) >= power(pv, |BEIntToDigitSeq_private(pv, 0, x)|);\r\n }\r\n\r\n calc {\r\n x;\r\n < { lemma_BEIntToDigitSeq_properties_inner(pv, 0, x); }\r\n pv*power(pv, |BEIntToDigitSeq_private(pv, 0, x)|);\r\n <=\r\n pv*power(pv, |BEIntToDigitSeq_private(pv, 0, x/pv)|);\r\n <= x;\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_mp_irrelevant(pv:int, mp:int, x:int)\r\n requires 1 |BEIntToDigitSeq(pv, 0, x/pv)|)\r\n {\r\n lemma_BEIntToDigitSeq_length(pv, x);\r\n assert false;\r\n }\r\n lemma_BEIntToDigitSeq_mp_irrelevant(pv, mp-1, x/pv);\r\n }\r\n BEIntToDigitSeq_private(pv, 0, x/pv) + [x%pv];\r\n { lemma_BEIntToDigitSeq_private_unbounded_mp_irrelevant(pv, x/pv, 0, -1); }\r\n BEIntToDigitSeq_private(pv, -1, x/pv) + [x%pv];\r\n BEIntToDigitSeq_private(pv, 0, x);\r\n BEIntToDigitSeq(pv, 0, x);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_shortest_form(pv:int, digitseq:seq, mp:int)\r\n requires 1)\r\n requires 1 0 0 x y == ID(4, xy)\r\n //- have: xyz==DI(0 0 x y z)\r\n //- have: DI(0 0 x y z) == DI(0 0 x y)*pv + z\r\n //- have: xyz == xy*pv + z\r\n\r\n //- want: 0 0 x y z == ID(5, xyz)\r\n //- ID(5, xyz) == ID(4, xyz/pv) + [xyz%pv]\r\n //- fundamental_div_mod, with: ...?\r\n //- == ID(4, xy) + [z]\r\n //- == 0 0 x y + [z]\r\n //- digitseq\r\n\r\n if (|digitseq|==0)\r\n {\r\n reveal_BEDigitSeqToInt_private();\r\n assert x==0;\r\n reveal_BEIntToDigitSeq_private();\r\n }\r\n else\r\n {\r\n calc ==> {\r\n true;\r\n { reveal_BEDigitSeqToInt_private(); }\r\n x == BEDigitSeqToInt_private(pv, digitseq)\r\n == BEDigitSeqToInt_private(pv, digitseq[0..|digitseq|-1])*pv + digitseq[|digitseq|-1];\r\n {\r\n lemma_BEDigitSeqToInt_bound(pv, digitseq[0..|digitseq|-1]);\r\n lemma_fundamental_div_mod_converse(\r\n x,\r\n pv,\r\n BEDigitSeqToInt_private(pv, digitseq[0..|digitseq|-1]),\r\n digitseq[|digitseq|-1]); }\r\n x/pv == BEDigitSeqToInt_private(pv, digitseq[0..|digitseq|-1])\r\n && x%pv == digitseq[|digitseq|-1];\r\n {\r\n lemma_div_pos_is_pos(x, pv);\r\n//- lemma_div_is_strictly_ordered_by_denominator(x, pv);\r\n lemma_BEDigitSeqToInt_invertibility(pv, x/pv, digitseq[0..|digitseq|-1]);\r\n }\r\n BEIntToDigitSeq(pv, |digitseq|-1, x/pv) == digitseq[0..|digitseq|-1]\r\n && x%pv == digitseq[|digitseq|-1];\r\n }\r\n\r\n calc {\r\n //- ID(5, xyz)\r\n BEIntToDigitSeq(pv, |digitseq|, x);\r\n { reveal_BEIntToDigitSeq_private(); }\r\n //- ID( 4, xyz/pv) + [xyz%pv]\r\n digitseq[0..|digitseq|-1] + [ digitseq[|digitseq|-1] ];\r\n digitseq;\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEDigitSeqToInt_invertibility_tight(pv:int, x:int, digitseq:seq)\r\n requires 10;\r\n ensures digitseq == BEIntToDigitSeq(pv, |digitseq|, x);\r\n ensures digitseq == BEIntToDigitSeq(pv, 0, x);\r\n{\r\n lemma_BEDigitSeqToInt_invertibility(pv, x, digitseq);\r\n lemma_BEIntToDigitSeq_shortest_form(pv, digitseq, 0);\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- properties about IntToDigitSeq\r\n\r\n\r\n\r\n\r\nstatic predicate IsZero(sx:seq, xi:int)\r\n requires 0<=xi<|sx|;\r\n{\r\n sx[xi]==0\r\n}\r\n\r\nstatic predicate AreEqual(sx:seq, xi:int, sy:seq, yi:int)\r\n requires 0<=xi<|sx|;\r\n requires 0<=yi<|sy|;\r\n{\r\n sx[xi]==sy[yi]\r\n}\r\n\r\nstatic lemma lemma_LeadingZeros(pv:int, short:seq, long:seq)\r\n requires 1 IsZero(long,i);\r\n requires forall i :: |long|-|short|<=i<|long| ==> AreEqual(long, i, short, i - (|long|-|short|));\r\n decreases |short|;\r\n ensures BEDigitSeqToInt(pv, short) == BEDigitSeqToInt(pv, long);\r\n{\r\n if (|short|==0)\r\n {\r\n lemma_BEIntToDigitSeq_private_zero(pv, |short|);\r\n lemma_BEIntToDigitSeq_invertibility_zero(pv, short);\r\n lemma_BEIntToDigitSeq_private_zero(pv, |long|);\r\n \r\n \r\n forall (i | 0<=i<|long|)\r\n ensures long[i]==0;\r\n {\r\n assert IsZero(long, i); //- OBSERVE trigger\r\n }\r\n assert long == BEIntToDigitSeq_private(pv, |long|, 0);\r\n lemma_BEIntToDigitSeq_invertibility_zero(pv, long);\r\n }\r\n else\r\n {\r\n var shortp := short[..|short|-1];\r\n var longp := long[..|long|-1];\r\n calc {\r\n BEDigitSeqToInt(pv, short);\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEDigitSeqToInt_private(pv, short[0..|short|-1])*pv + short[|short|-1];\r\n { lemma_vacuous_statement_about_a_sequence(short, |short|-1); }\r\n BEDigitSeqToInt_private(pv, shortp)*pv + short[|short|-1];\r\n {\r\n //- Unwrap triggers\r\n forall (i | 0<=i<|longp|-|shortp|)\r\n ensures longp[i]==0;\r\n {\r\n assert IsZero(long, i); //- OBSERVE trigger\r\n }\r\n forall (i | |longp|-|shortp|<=i<|longp|)\r\n ensures AreEqual(longp, i, shortp, i - (|longp|-|shortp|));\r\n {\r\n assert AreEqual(long, i, short, i - (|long|-|short|)); //- OBSERVE trigger\r\n }\r\n\r\n lemma_LeadingZeros(pv, shortp, longp);\r\n assert BEDigitSeqToInt(pv, shortp) == BEDigitSeqToInt(pv, longp);\r\n assert BEDigitSeqToInt_private(pv, shortp) == BEDigitSeqToInt_private(pv, longp);\r\n//- calc {\r\n//- long[|long|-1];\r\n//- long[|long|-1-(|long|-|short|)];\r\n//- short[|short|-1];\r\n//- }\r\n assert AreEqual(long, |long|-1, short, |long|-1-(|long|-|short|));\r\n assert short[|short|-1] == long[|long|-1];\r\n }\r\n BEDigitSeqToInt_private(pv, longp)*pv + long[|long|-1];\r\n { lemma_vacuous_statement_about_a_sequence(long, |long|-1); }\r\n BEDigitSeqToInt_private(pv, long[0..|long|-1])*pv + long[|long|-1];\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEDigitSeqToInt(pv, long);\r\n }\r\n }\r\n}\r\n\r\n//- the \"opposite\" of lemma_LeadingZeros; lets us prove properties\r\n//- of the sequence structure when generating extra bits (e.g. converting\r\n//- a Word32 to a 32-bit sequence).\r\nstatic lemma lemma_zero_extension(pv:int, mp:nat, x:nat, tight:seq)\r\n requires 1) returns (TM:seq)\r\n requires 10;\r\n{\r\n var ptr:=0;\r\n assert M[ptr..] == M;\r\n while (ptr<|M| && M[ptr]==0)\r\n invariant 0<=ptr<=|M|;\r\n invariant forall j :: 0<=j M[j]==0;\r\n invariant BEDigitSeqToInt(pv, M[ptr..]) == BEDigitSeqToInt(pv, M);\r\n {\r\n ptr := ptr + 1;\r\n lemma_LeadingZeros(pv, M[ptr..], M);\r\n }\r\n TM := M[ptr..];\r\n}\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_invertibility(pv:int, x:int, digitseq:seq)\r\n requires 10;\r\n\r\n var prefix := BEIntToDigitSeq_private(pv, |digitseq|-1, x/pv);\r\n var tail := [ x % pv ];\r\n var digits := prefix + tail;\r\n assert 0<|digits|;\r\n\r\n lemma_div_pos_is_pos(x,pv);\r\n if (x/pv == 0)\r\n {\r\n if (x >= pv)\r\n {\r\n lemma_div_basics(pv);\r\n lemma_div_is_ordered(pv,x,pv);\r\n assert false;\r\n }\r\n assert x < pv;\r\n\r\n var prefix2 := BEIntToDigitSeq(pv, |digitseq|-1, x/pv);\r\n assert prefix2 == BEIntToDigitSeq(pv, |digitseq|-1, 0);\r\n lemma_BEIntToDigitSeq_private_zero(pv, |digitseq|-1);\r\n lemma_BEIntToDigitSeq_invertibility_zero(pv, prefix2);\r\n assert BEDigitSeqToInt(pv, prefix2) == 0;\r\n\r\n lemma_small_mod(x, pv);\r\n assert digitseq == prefix2 + [ x ];\r\n\r\n calc {\r\n BEDigitSeqToInt_private(pv, digitseq);\r\n BEDigitSeqToInt_private(pv, digitseq[0..|digitseq|-1])*pv + digitseq[|digitseq|-1];\r\n { lemma_vacuous_statement_about_a_sequence(digitseq, |digitseq|-1); }\r\n BEDigitSeqToInt_private(pv, prefix2)*pv + digitseq[|digitseq|-1];\r\n mul(0,pv) + digitseq[|digitseq|-1];\r\n { lemma_mul_basics_forall(); }\r\n 0 + digitseq[|digitseq|-1];\r\n x;\r\n }\r\n }\r\n else\r\n {\r\n assert 00;\r\n lemma_div_is_strictly_ordered_by_denominator(x,pv);\r\n assert x/pv < x;\r\n lemma_BEIntToDigitSeq_invertibility(pv, x/pv, prefix);\r\n }\r\n x/pv;\r\n }\r\n }\r\n\r\n calc {\r\n BEDigitSeqToInt(pv, BEIntToDigitSeq(pv, |digitseq|, x));\r\n BEDigitSeqToInt(pv, BEIntToDigitSeq_private(pv, |digitseq|, x));\r\n //- { reveal_BEIntToDigitSeq_private(); }\r\n BEDigitSeqToInt(pv, BEIntToDigitSeq_private(pv, |digitseq|-1, x/pv) + [ x % pv ]);\r\n BEDigitSeqToInt(pv, prefix + tail);\r\n BEDigitSeqToInt(pv, digits);\r\n BEDigitSeqToInt_private(pv, digits[0..|digits|-1])*pv + digits[|digits|-1];\r\n {\r\n calc {\r\n digits[0..|digits|-1];\r\n BEIntToDigitSeq_private(pv, |digitseq|-1, x/pv);\r\n }\r\n }\r\n BEDigitSeqToInt_private(pv, BEIntToDigitSeq_private(pv, |digitseq|-1, x/pv))*pv + digits[|digits|-1];\r\n BEDigitSeqToInt_private(pv, BEIntToDigitSeq_private(pv, |digitseq|-1, x/pv))\r\n *pv\r\n + (x % pv);\r\n //- apply calcs proven in previous case analysis\r\n (x/pv)*pv + (x%pv);\r\n { lemma_mul_is_commutative_forall(); }\r\n pv*(x/pv) + (x%pv);\r\n { lemma_fundamental_div_mod(x,pv); }\r\n x;\r\n x;\r\n }\r\n }\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- more properties about IntToDigitSeq\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_private_unbounded_mp_irrelevant(pv:int, x:int, mp1:int, mp2:int)\r\n requires 1 0 <= BEIntToDigitSeq_private(pv,mp,x)[i] < pv;\r\n ensures IsDigitSeq(pv, BEIntToDigitSeq_private(pv,mp,x));\r\n{\r\n forall (i | 0<=i<|BEIntToDigitSeq_private(pv,mp,x)|)\r\n ensures 0 <= BEIntToDigitSeq_private(pv,mp,x)[i] < pv;\r\n {\r\n reveal_BEIntToDigitSeq_private();\r\n if (0 x then mp else x;\r\n ensures IsDigitSeq(pv, BEIntToDigitSeq(pv, mp, x));\r\n{\r\n if (x==0 && mp<=0)\r\n {\r\n reveal_BEIntToDigitSeq_private();\r\n assert BEIntToDigitSeq(pv, mp, x) == [];\r\n assert IsDigitSeq(pv, BEIntToDigitSeq(pv, mp, x));\r\n }\r\n else\r\n {\r\n reveal_BEIntToDigitSeq_private();\r\n lemma_div_pos_is_pos(x,pv);\r\n if (x>0)\r\n {\r\n lemma_div_decreases(x,pv);\r\n lemma_IsDigitSeq_BEIntToDigitSeq(pv, mp-1, x/pv);\r\n calc {\r\n BEIntToDigitSeq(pv, mp, x);\r\n BEIntToDigitSeq_private(pv, mp-1, x/pv) + [ x % pv ];\r\n }\r\n lemma_mod_properties();\r\n }\r\n else\r\n {\r\n lemma_BEIntToDigitSeq_private_zero(pv, mp);\r\n }\r\n }\r\n}\r\n\r\n//- The converse of this lemma is lemma_BEDigitSeqToInt_invertibility\r\nstatic lemma lemma_BEInt_decoding_general(pv:int, mp:int, x:int)\r\n requires 1 x then mp else x;\r\n ensures IsDigitSeq(pv, BEIntToDigitSeq(pv, mp, x));\r\n ensures BEDigitSeqToInt(pv, BEIntToDigitSeq(pv, mp, x)) == x;\r\n{\r\n lemma_IsDigitSeq_BEIntToDigitSeq(pv, mp, x);\r\n\r\n if (x==0)\r\n {\r\n if (mp<=0)\r\n {\r\n calc {\r\n BEDigitSeqToInt(pv, BEIntToDigitSeq(pv, mp, x));\r\n { reveal_BEIntToDigitSeq_private(); }\r\n BEDigitSeqToInt(pv, []);\r\n { reveal_BEDigitSeqToInt_private(); }\r\n 0;\r\n x;\r\n }\r\n assert BEDigitSeqToInt(pv, BEIntToDigitSeq(pv, mp, x)) == x;\r\n }\r\n else\r\n {\r\n lemma_BEIntToDigitSeq_private_zero(pv, mp);\r\n lemma_BEIntToDigitSeq_private_zero(pv, mp-1);\r\n lemma_BEIntToDigitSeq_invertibility_zero(pv, BEIntToDigitSeq(pv, mp, 0));\r\n lemma_BEIntToDigitSeq_invertibility_zero(pv, BEIntToDigitSeq(pv, mp-1, 0));\r\n }\r\n }\r\n else\r\n {\r\n var digits := BEIntToDigitSeq_private(pv, mp-1, x/pv) + [ x % pv ];\r\n lemma_div_decreases(x,pv);\r\n lemma_div_pos_is_pos(x,pv);\r\n lemma_IsDigitSeq_BEIntToDigitSeq(pv, mp-1, x/pv);\r\n calc {\r\n BEDigitSeqToInt(pv, BEIntToDigitSeq(pv, mp, x));\r\n { reveal_BEIntToDigitSeq_private(); }\r\n BEDigitSeqToInt(pv, digits);\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEDigitSeqToInt_private(pv, digits[0..|digits|-1])*pv + digits[|digits|-1];\r\n { assert digits[|digits|-1] == x%pv; }\r\n BEDigitSeqToInt_private(pv, digits[0..|digits|-1])*pv + x%pv;\r\n { assert digits[0..|digits|-1] == digits[..|digits|-1]; }\r\n BEDigitSeqToInt_private(pv, digits[..|digits|-1])*pv + x%pv;\r\n {\r\n calc {\r\n BEDigitSeqToInt_private(pv, digits[..|digits|-1]);\r\n { assert BEIntToDigitSeq(pv, mp-1, x/pv) == digits[..|digits|-1]; }\r\n BEDigitSeqToInt_private(pv, BEIntToDigitSeq(pv, mp-1, x/pv));\r\n BEDigitSeqToInt(pv, BEIntToDigitSeq(pv, mp-1, x/pv));\r\n { lemma_BEInt_decoding_general(pv, mp-1, x/pv); }\r\n x/pv;\r\n }\r\n }\r\n (x/pv)*pv + x%pv;\r\n { lemma_mul_is_commutative_forall(); lemma_fundamental_div_mod(x,pv); }\r\n x;\r\n }\r\n }\r\n}\r\n\r\n\r\nstatic lemma lemma_BEIntToByteSeq_decoding(x:int)\r\n requires 0<=x;\r\n decreases x;\r\n ensures IsDigitSeq(power2(8), BEIntToByteSeq(x));\r\n ensures x == BEByteSeqToInt(BEIntToByteSeq(x));\r\n{\r\n lemma_2toX();\r\n lemma_BEInt_decoding_general(power2(8), 0, x);\r\n}\r\n\r\nstatic lemma lemma_BEIntToBitSeq_decoding(x:int)\r\n requires 0<=x;\r\n decreases x;\r\n ensures IsDigitSeq(power2(1), BEWordToBitSeq(x));\r\n ensures x == BEBitSeqToInt(BEWordToBitSeq(x));\r\n{\r\n reveal_power2();\r\n lemma_2toX();\r\n lemma_BEInt_decoding_general(power2(1), 32, x);\r\n}\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_private_form(pv:int, i:int)\r\n requires 1)\r\n requires IsWordSeq(inseq);\r\n ensures 0 <= BEWordSeqToInt(inseq);\r\n ensures BEWordSeqToInt(inseq) < power2(32*|inseq|);\r\n{\r\n lemma_BEDigitSeqToInt_bound(power2(32), inseq);\r\n calc {\r\n BEWordSeqToInt(inseq);\r\n <\r\n power(power2(32), |inseq|);\r\n { lemma_power2_is_power_2(32); }\r\n power(power(2,32), |inseq|);\r\n { lemma_power_multiplies(2,32,|inseq|); }\r\n //-[dafnycc] power(2,mul(32, |inseq|));\r\n { lemma_power2_is_power_2(mul(32, |inseq|)); }\r\n power2(mul(32, |inseq|));\r\n { lemma_mul_is_mul_boogie(32, |inseq|); }\r\n power2(32*|inseq|);\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEByteSeqToInt_bound(inseq:seq)\r\n requires IsByteSeq(inseq);\r\n ensures 0 <= BEByteSeqToInt(inseq);\r\n ensures BEByteSeqToInt(inseq) < power2(8*|inseq|);\r\n{\r\n lemma_BEDigitSeqToInt_bound(power2(8), inseq);\r\n calc {\r\n BEByteSeqToInt(inseq);\r\n <\r\n power(power2(8), |inseq|);\r\n { lemma_power2_is_power_2(8); }\r\n power(power(2,8), |inseq|);\r\n { lemma_power_multiplies(2,8,|inseq|); }\r\n //-[dafnycc] power(2,mul(8, |inseq|));\r\n { lemma_power2_is_power_2(mul(8, |inseq|)); }\r\n power2(mul(8, |inseq|));\r\n { lemma_mul_is_mul_boogie(8, |inseq|); }\r\n power2(8*|inseq|);\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEDigitSeq_extract(pv:int, inseq:seq, i:nat)\r\n requires 1, i:nat)\r\n requires IsWordSeq(inseq);\r\n requires i < |inseq|;\r\n ensures inseq[|inseq|-1-i] == (BEWordSeqToInt(inseq) / power2(32*i)) % power2(32);\r\n{\r\n lemma_2toX();\r\n lemma_BEDigitSeq_extract(power2(32), inseq, i);\r\n calc {\r\n power(power2(32),i);\r\n { lemma_power2_is_power_2(32); }\r\n power(power(2,32),i);\r\n { lemma_power_multiplies(2,32,i); }\r\n //-[dafnycc] power(2,mul(32,i));\r\n { lemma_power2_is_power_2(mul(32,i)); }\r\n power2(mul(32,i));\r\n { lemma_mul_is_mul_boogie(32,i); }\r\n power2(32*i);\r\n }\r\n}\r\n\r\n\r\n//-static lemma lemma_BEDigitSeqToInt_lower_bound(pv:nat, inseq:seq, i:nat)\r\n//- requires 0 < pv;\r\n//- requires IsDigitSeq(pv, inseq);\r\n//- requires i<|inseq|;\r\n//- ensures inseq[|inseq|-1-i] * power(pv, i) <= BEDigitSeqToInt(pv, inseq);\r\n//- decreases |inseq|;\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/seqs_canonical.i.dfy", "content": "include \"seqs_and_ints.i.dfy\"\r\n\r\n//- Reason about the lengths of sequences with no preceding zeros\r\n\r\nstatic predicate IsCanonicalDigitSeq(pv:nat, inseq:seq)\r\n{\r\n IsDigitSeq(pv, inseq)\r\n && (|inseq|>0 ==> inseq[0]!=0)\r\n}\r\n\r\nstatic lemma lemma_CanonicalLengthBound(pv:nat, inseq:seq, l:nat)\r\n requires IsCanonicalDigitSeq(pv, inseq);\r\n requires BEDigitSeqToInt(pv, inseq) < power(pv, l);\r\n ensures |inseq| <= l;\r\n{\r\n if (|inseq|>0)\r\n {\r\n if (l < |inseq|)\r\n {\r\n calc {\r\n power(pv, l);\r\n <= { lemma_power_increases(pv, l, |inseq|-1); }\r\n power(pv, |inseq|-1);\r\n <= { lemma_power_positive(pv, |inseq|-1);\r\n lemma_mul_increases(inseq[0], power(pv, |inseq|-1)); }\r\n inseq[0] * power(pv, |inseq|-1);\r\n <= { lemma_BEDigitSeqToInt_bound(pv, inseq); }\r\n BEDigitSeqToInt(pv, inseq);\r\n <\r\n power(pv,l);\r\n }\r\n }\r\n }\r\n\r\n}\r\n\r\nlemma lemma_CanonicalLength_inherit(pv:int, A:seq, B:seq, l:nat)\r\n requires 1, i:int)\r\n \r\n requires 1) : int\r\n decreases |digits|;\r\n{\r\n if (digits==[]) then\r\n 0\r\n else\r\n LEDigitSeqToInt_private(place_value, digits[1..])*place_value + digits[0]\r\n}\r\n\r\nstatic function LEDigitSeqToInt(place_value:int, digits:seq) : int\r\n requires IsDigitSeq(place_value, digits);\r\n{\r\n LEDigitSeqToInt_private(place_value, digits)\r\n}\r\n\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- Reverse\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic lemma{:dafnycc_conservative_seq_triggers} lemma_Reverse(os:seq, rs:seq)\r\n requires rs == Reverse(os);\r\n ensures |os| == |rs|;\r\n ensures forall i :: 0<=i<|os| ==> os[i] == rs[|rs|-1-i];\r\n decreases |os|;\r\n{\r\n reveal_Reverse();\r\n if (os==[])\r\n {\r\n }\r\n else\r\n {\r\n var sos := os[0..|os|-1];\r\n lemma_Reverse(sos, Reverse(sos));\r\n forall (i | 0<=i<|os|)\r\n ensures os[i] == rs[|rs|-1-i];\r\n {\r\n if (i==|os|-1)\r\n {\r\n }\r\n else\r\n {\r\n calc {\r\n os[i];\r\n sos[i];\r\n Reverse(sos)[|Reverse(sos)|-1-i];\r\n rs[|rs|-1-i];\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_Reverse_symmetry(os:seq, rs:seq)\r\n requires os == Reverse(rs);\r\n ensures rs == Reverse(os);\r\n{\r\n lemma_Reverse(os, Reverse(os));\r\n assert |os| == |Reverse(os)|;\r\n assert forall i :: 0<=i<|os| ==> os[i] == Reverse(os)[|Reverse(os)|-1-i];\r\n\r\n lemma_Reverse(rs, Reverse(rs));\r\n assert |rs| == |Reverse(rs)|;\r\n assert forall i :: 0<=i<|rs| ==> rs[i] == Reverse(rs)[|Reverse(rs)|-1-i];\r\n\r\n assert |Reverse(os)| == |os| == |Reverse(rs)| == |rs|;\r\n forall (i | 0<=i<|rs|)\r\n ensures Reverse(os)[i] == rs[i];\r\n {\r\n }\r\n}\r\n\r\nstatic method{:dafnycc_conservative_seq_triggers} ReverseDigitSeq(ghost pv:int, ds:seq) returns (rs:seq)\r\n requires 1\r\n ds[0..ptr][i] == os1[0..ptr][i];\r\n }\r\n os1[0..ptr];\r\n os1[0..|os1|-1];\r\n }\r\n }\r\n [os1[|os1|-1]] + Reverse(os1[0..|os1|-1]);\r\n Reverse(os1);\r\n }\r\n\r\n ptr := ptr + 1;\r\n }\r\n\r\n assert ds[0..ptr] == ds;\r\n lemma_Reverse(ds, rs);\r\n lemma_ReverseDigitSeq_helper(pv, ds, ptr, rs);\r\n}\r\n\r\nstatic lemma lemma_ReverseDigitSeq_helper(pv:int, ds:seq, ptr:int, rs:seq)\r\n requires 0<= ptr <= |ds|;\r\n requires ds[0..ptr] == ds;\r\n requires 1 0<=rs[i], rs:seq)\r\n requires 1, rs:seq)\r\n requires 1 ds[i] == rs[|rs|-1-i];\r\n decreases |ds|;\r\n ensures BEDigitSeqToInt(pv, ds) == LEDigitSeqToInt(pv, rs);\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n reveal_LEDigitSeqToInt_private();\r\n if (|ds|!=0)\r\n {\r\n lemma_Reverse_converts_endianness_inner(pv, ds[0..|ds|-1], rs[1..]);\r\n }\r\n}\r\n\r\nstatic lemma lemma_Reverse_converts_endianness(pv:int, ds:seq, rs:seq)\r\n requires 1, j:int)\r\n requires 0<=j<|intseq|;\r\n ensures intseq[0..j]==intseq[..j];\r\n{\r\n}\r\n\r\nstatic lemma lemma_painful_statement_about_a_sequence(intseq:seq)\r\n ensures intseq==intseq[..|intseq|];\r\n{\r\n}\r\n\r\nstatic lemma lemma_obvious_statement_about_a_sequence(boolseq:seq, j:int)\r\n requires 0<=j<|boolseq|-1;\r\n ensures boolseq[1..][j] == boolseq[j+1];\r\n{\r\n}\r\n\r\nstatic lemma lemma_obvious_statement_about_a_sequence_int(intseq:seq, j:int)\r\n requires 0<=j<|intseq|-1;\r\n ensures intseq[1..][j] == intseq[j+1];\r\n{\r\n}\r\n\r\nstatic lemma lemma_straightforward_statement_about_a_sequence(intseq:seq, j:int)\r\n requires 0<=j<|intseq|;\r\n ensures intseq[..j] + intseq[j..] == intseq;\r\n{\r\n}\r\n\r\nstatic lemma lemma_sequence_reduction(s:seq, b:nat)\r\n requires 0, b:seq, c:seq)\r\n ensures (a+b)+c == a+(b+c);\r\n{\r\n}\r\n\r\n\r\nstatic lemma lemma_subseq_concatenation(s: seq, left: int, middle: int, right: int)\r\n requires 0 <= left <= middle <= right <= |s|;\r\n ensures s[left..right] == s[left..middle] + s[middle..right];\r\n{\r\n}\r\n\r\nstatic lemma lemma_seq_equality(a:seq, b:seq, len:int)\r\n requires |a| == |b| == len;\r\n requires forall i {:trigger a[i]}{:trigger b[i]} :: 0 <= i < len ==> a[i] == b[i];\r\n ensures a == b;\r\n{\r\n assert forall i :: 0 <= i < len ==> a[i] == b[i];\r\n}\r\n\r\nstatic lemma lemma_seq_suffix(s: seq, prefix_length: int, index: int)\r\n requires 0 <= prefix_length <= index < |s|;\r\n ensures s[index] == s[prefix_length..][index - prefix_length];\r\n{\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/seqs_transforms.i.dfy", "content": "include \"integer_sequences.s.dfy\"\r\ninclude \"../Math/div.i.dfy\"\r\ninclude \"../Math/power.i.dfy\"\r\ninclude \"../Math/power2.i.dfy\"\r\ninclude \"seqs_simple.i.dfy\"\r\ninclude \"seqs_and_ints.i.dfy\"\r\ninclude \"repeat_digit.i.dfy\"\r\ninclude \"../../Drivers/CPU/assembly.i.dfy\"\r\ninclude \"arrays.i.dfy\"\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- This file is focused on methods and lemmas that relate sequences of\r\n//- different digit place values, eg Bit and Byte sequences.\r\n//- It builds on seqs_and_ints, which establishes more fundamental lemmas\r\n//- about the meanings of digit sequences.\r\n\r\nstatic lemma lemma_power2_8_and_32()\r\n ensures power2(8)*power2(8)*power2(8)*power2(8) == power2(32);\r\n{\r\n lemma_mul_is_associative_forall();\r\n lemma_power2_adds(8,8);\r\n lemma_power2_adds(16,16);\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nstatic lemma lemma_BEByteSeqToInt_unpack_four(m:seq, prefix:seq)\r\n requires IsByteSeq(m);\r\n requires 4<=|m|;\r\n requires IsByteSeq(prefix);\r\n requires prefix + m[|m|-4..] == m;\r\n ensures BEByteSeqToInt(m) == BEByteSeqToInt(prefix)*power2(32)\r\n + (((m[|m|-4])*power2(8) + m[|m|-3])*power2(8) + m[|m|-2])*power2(8) + m[|m|-1];\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_mul_basics_forall();\r\n assert m[0..|m|-4] == prefix;\r\n calc {\r\n BEByteSeqToInt(m);\r\n BEDigitSeqToInt(power2(8), m);\r\n BEDigitSeqToInt_private(power2(8), m);\r\n BEDigitSeqToInt_private(power2(8), m);\r\n BEDigitSeqToInt_private(power2(8), m[0..|m|-1])*power2(8) + m[|m|-1];\r\n (BEDigitSeqToInt_private(power2(8), m[0..|m|-1][0..|m[0..|m|-1]|-1])*power2(8) + m[0..|m|-1][|m[0..|m|-1]|-1])*power2(8) + m[|m|-1];\r\n { lemma_sequence_reduction(m, |m|-1); }\r\n (BEDigitSeqToInt_private(power2(8), m[0..|m|-2])*power2(8) + m[|m|-2])*power2(8) + m[|m|-1];\r\n ((BEDigitSeqToInt_private(power2(8), m[0..|m|-2][0..|m[0..|m|-2]|-1])*power2(8) + m[0..|m|-2][|m[0..|m|-2]|-1])*power2(8) + m[|m|-2])*power2(8) + m[|m|-1];\r\n { lemma_sequence_reduction(m, |m|-2); }\r\n ((BEDigitSeqToInt_private(power2(8), m[0..|m|-3])*power2(8) + m[|m|-3])*power2(8) + m[|m|-2])*power2(8) + m[|m|-1];\r\n (((BEDigitSeqToInt_private(power2(8), m[0..|m|-3][0..|m[0..|m|-3]|-1])*power2(8) + m[0..|m|-3][|m[0..|m|-3]|-1])*power2(8) + m[|m|-3])*power2(8) + m[|m|-2])*power2(8) + m[|m|-1];\r\n { lemma_sequence_reduction(m, |m|-3); }\r\n (((BEDigitSeqToInt_private(power2(8), m[0..|m|-4])*power2(8) + m[|m|-4])*power2(8) + m[|m|-3])*power2(8) + m[|m|-2])*power2(8) + m[|m|-1];\r\n {\r\n lemma_mul_is_distributive_forall();\r\n lemma_mul_is_commutative_forall();\r\n lemma_mul_is_associative_forall();\r\n }\r\n BEDigitSeqToInt_private(power2(8), prefix)*(power2(8)*power2(8)*power2(8)*power2(8)) + (((m[|m|-4])*power2(8) + m[|m|-3])*power2(8) + m[|m|-2])*power2(8) + m[|m|-1];\r\n BEByteSeqToInt(prefix)*(power2(8)*power2(8)*power2(8)*power2(8)) + (((m[|m|-4])*power2(8) + m[|m|-3])*power2(8) + m[|m|-2])*power2(8) + m[|m|-1];\r\n { lemma_power2_8_and_32(); }\r\n BEByteSeqToInt(prefix)*power2(32) + (((m[|m|-4])*power2(8) + m[|m|-3])*power2(8) + m[|m|-2])*power2(8) + m[|m|-1];\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEByteSeqToInt_strip_four(m:seq, prefix:seq, suffix:seq)\r\n requires IsByteSeq(m);\r\n requires IsByteSeq(prefix);\r\n requires IsByteSeq(suffix);\r\n requires 4<=|m|;\r\n requires prefix == m[0..|m|-4];\r\n requires suffix == m[|m|-4..];\r\n ensures BEByteSeqToInt(m) == BEByteSeqToInt(prefix) * power2(32) + BEByteSeqToInt(suffix);\r\n ensures 0 <= BEByteSeqToInt(suffix) < power2(32);\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_mul_basics_forall();\r\n lemma_BEByteSeqToInt_unpack_four(m, prefix);\r\n calc {\r\n BEByteSeqToInt(suffix);\r\n BEDigitSeqToInt_private(power2(8), suffix);\r\n BEDigitSeqToInt_private(power2(8), suffix[0..|suffix|-1])*power2(8) + suffix[|suffix|-1];\r\n (BEDigitSeqToInt_private(power2(8), suffix[0..|suffix|-1][0..|suffix[0..|suffix|-1]|-1])*power2(8) + suffix[0..|suffix|-1][|suffix[0..|suffix|-1]|-1])*power2(8) + suffix[|suffix|-1];\r\n { lemma_sequence_reduction(suffix, |suffix|-1); }\r\n (BEDigitSeqToInt_private(power2(8), suffix[0..|suffix|-2])*power2(8) + suffix[|suffix|-2])*power2(8) + suffix[|suffix|-1];\r\n ((BEDigitSeqToInt_private(power2(8), suffix[0..|suffix|-2][0..|suffix[0..|suffix|-2]|-1])*power2(8) + suffix[0..|suffix|-2][|suffix[0..|suffix|-2]|-1])*power2(8) + suffix[|suffix|-2])*power2(8) + suffix[|suffix|-1];\r\n { lemma_sequence_reduction(suffix, |suffix|-2); }\r\n ((BEDigitSeqToInt_private(power2(8), suffix[0..|suffix|-3])*power2(8) + suffix[|suffix|-3])*power2(8) + suffix[|suffix|-2])*power2(8) + suffix[|suffix|-1];\r\n (((BEDigitSeqToInt_private(power2(8), suffix[0..|suffix|-3][0..|suffix[0..|suffix|-3]|-1])*power2(8) + suffix[0..|suffix|-3][|suffix[0..|suffix|-3]|-1])*power2(8) + suffix[|suffix|-3])*power2(8) + suffix[|suffix|-2])*power2(8) + suffix[|suffix|-1];\r\n { lemma_sequence_reduction(suffix, |suffix|-3); }\r\n (((BEDigitSeqToInt_private(power2(8), suffix[0..|suffix|-4])*power2(8) + suffix[|suffix|-4])*power2(8) + suffix[|suffix|-3])*power2(8) + suffix[|suffix|-2])*power2(8) + suffix[|suffix|-1];\r\n (((BEDigitSeqToInt_private(power2(8), [])*power2(8) + suffix[0])*power2(8) + suffix[1])*power2(8) + suffix[2])*power2(8) + suffix[3];\r\n ((suffix[0]*power2(8) + suffix[1])*power2(8) + suffix[2])*power2(8) + suffix[3];\r\n (((m[|m|-4])*power2(8) + m[|m|-3])*power2(8) + m[|m|-2])*power2(8) + m[|m|-1];\r\n }\r\n\r\n lemma_mul_nonnegative_forall();\r\n assert 0 <= BEByteSeqToInt(suffix);\r\n calc {\r\n (m[|m|-4])*power2(8);\r\n <= { lemma_mul_inequality(m[|m|-4], power2(8)-1, power2(8)); }\r\n (power2(8)-1)*power2(8);\r\n { lemma_mul_is_distributive_forall(); }\r\n power2(8)*power2(8) - mul(1,power2(8));\r\n power2(8)*power2(8) - power2(8);\r\n }\r\n calc {\r\n ((m[|m|-4])*power2(8) + m[|m|-3])*power2(8);\r\n <= { lemma_mul_inequality(((m[|m|-4])*power2(8) + m[|m|-3]), (power2(8)*power2(8) - power2(8) + m[|m|-3]), power2(8)); }\r\n (power2(8)*power2(8) - power2(8) + m[|m|-3])*power2(8);\r\n <= { lemma_mul_inequality((power2(8)*power2(8) - power2(8) + m[|m|-3]), (power2(8)*power2(8)-1), power2(8)); }\r\n (power2(8)*power2(8)-1)*power2(8);\r\n { lemma_mul_is_distributive_forall(); }\r\n (power2(8)*power2(8))*power2(8) - mul(1,power2(8));\r\n (power2(8)*power2(8))*power2(8) - power2(8);\r\n }\r\n calc {\r\n (((m[|m|-4])*power2(8) + m[|m|-3])*power2(8) + m[|m|-2])*power2(8);\r\n <= { lemma_mul_inequality((((m[|m|-4])*power2(8) + m[|m|-3])*power2(8) + m[|m|-2]), ((power2(8)*power2(8))*power2(8) - power2(8) + m[|m|-2]), power2(8)); }\r\n ((power2(8)*power2(8))*power2(8) - power2(8) + m[|m|-2])*power2(8);\r\n <= { lemma_mul_inequality(((power2(8)*power2(8))*power2(8) - power2(8) + m[|m|-2]), ((power2(8)*power2(8))*power2(8) - 1), power2(8)); }\r\n ((power2(8)*power2(8))*power2(8) - 1)*power2(8);\r\n { lemma_mul_is_distributive_forall(); }\r\n ((power2(8)*power2(8))*power2(8))*power2(8) - mul(1,power2(8));\r\n ((power2(8)*power2(8))*power2(8))*power2(8) - power2(8);\r\n }\r\n calc {\r\n BEByteSeqToInt(suffix);\r\n (((m[|m|-4])*power2(8) + m[|m|-3])*power2(8) + m[|m|-2])*power2(8) + m[|m|-1];\r\n <=\r\n ((power2(8)*power2(8))*power2(8))*power2(8) - 1;\r\n { lemma_power2_adds(8,8); }\r\n (power2(16)*power2(8))*power2(8) - 1;\r\n { lemma_power2_adds(16,8); }\r\n power2(24)*power2(8) - 1;\r\n { lemma_power2_adds(24,8); }\r\n power2(32) - 1;\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_produces_DigitSeq(pv:int, mp:int, x:int)\r\n requires 1 x then mp else x;\r\n{\r\n reveal_BEIntToDigitSeq_private();\r\n\r\n if (10) //- prove decreases\r\n {\r\n lemma_div_decreases(x,pv);\r\n }\r\n else\r\n {\r\n lemma_small_div();\r\n }\r\n\r\n forall (i | 0<=i<|BEIntToDigitSeq(pv, mp, x)|)\r\n ensures 0 <= BEIntToDigitSeq(pv, mp, x)[i] < pv;\r\n {\r\n if (i<|BEIntToDigitSeq(pv, mp, x)|-1)\r\n {\r\n lemma_BEIntToDigitSeq_produces_DigitSeq(pv, mp-1, x/pv);\r\n }\r\n else\r\n {\r\n lemma_mod_properties();\r\n }\r\n }\r\n assert IsDigitSeq(pv, BEIntToDigitSeq(pv, mp, x));\r\n//- BEIntToDigitSeq_private(pv, mp-1, x/pv) + [ x % pv ]\r\n }\r\n else\r\n {\r\n assert IsDigitSeq(pv, BEIntToDigitSeq(pv, mp, x));\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_private_properties(pv:int, mp:int, x:int)\r\n requires 1 0 <= BEIntToDigitSeq_private(pv,mp,x)[i] < pv;\r\n ensures IsDigitSeq(pv, BEIntToDigitSeq_private(pv,mp,x));\r\n{\r\n reveal_BEIntToDigitSeq_private();\r\n\r\n if (mp==0)\r\n {\r\n lemma_power_0(pv);\r\n assert x == 0;\r\n assert BEIntToDigitSeq_private(pv,mp,x) == [];\r\n }\r\n else\r\n {\r\n assert pv!=0;\r\n assert mp>0;\r\n calc {\r\n BEIntToDigitSeq_private(pv,mp,x);\r\n BEIntToDigitSeq_private(pv, mp-1, x/pv) + [ x % pv ];\r\n }\r\n if (x/pv >= power(pv,mp-1))\r\n {\r\n calc {\r\n x;\r\n >= { lemma_remainder_lower(x, pv); }\r\n (x/pv)*pv;\r\n >= { lemma_mul_inequality(power(pv,mp-1), x/pv, pv); }\r\n power(pv,mp-1)*pv;\r\n { reveal_power(); lemma_mul_is_commutative_forall(); }\r\n power(pv,mp);\r\n }\r\n assert false;\r\n }\r\n lemma_div_pos_is_pos(x,pv);\r\n lemma_BEIntToDigitSeq_private_properties(pv, mp-1, x/pv);\r\n assert |BEIntToDigitSeq_private(pv,mp,x)| == mp;\r\n forall (i | 0<=i, outbits:nat, scale:nat, inbits:nat)\r\n requires IsDigitSeq(power2(inbits), inseq);\r\n requires 0 {\r\n true;\r\n { lemma_fundamental_div_mod(v, power2(outbits*delta)); }\r\n v == power2(outbits*delta)*(v/power2(outbits*delta)) + v%power2(outbits*delta);\r\n v/power2(outbits) == (power2(outbits*delta)*(v/power2(outbits*delta)) + v%power2(outbits*delta))/power2(outbits);\r\n v/d == (a + b)/d;\r\n {\r\n calc {\r\n d*((a+b)/d);\r\n d*((a+b)/d) - R;\r\n { lemma_dividing_sums(a, b, d, R); }\r\n d*(a/d) + d*(b/d);\r\n { lemma_mul_is_distributive_forall(); }\r\n d*(a/d + b/d);\r\n }\r\n lemma_mul_one_to_one_pos(d, (a+b)/d, a/d+b/d);\r\n }\r\n v/d == a/d + b/d;\r\n v/d == a/d + left;\r\n }\r\n calc {\r\n a/d;\r\n (power2(outbits*delta)*(v/power2(outbits*delta))) / d;\r\n //- another application of lemma_adding_one_outbits\r\n ((d*power2(outbits*(delta-1)))*(v/power2(outbits*delta))) / d;\r\n { lemma_mul_is_associative_forall(); }\r\n (d*(power2(outbits*(delta-1))*(v/power2(outbits*delta)))) / d;\r\n { lemma_mul_is_commutative_forall(); }\r\n ((power2(outbits*(delta-1))*(v/power2(outbits*delta)))*d) / d;\r\n {\r\n lemma_div_pos_is_pos(v, power2(outbits*delta));\r\n lemma_mul_nonnegative_forall();\r\n assert 0<=power2(outbits*(delta-1))*(v/power2(outbits*delta));\r\n assert 0= power2(outbits*(count-1)))\r\n {\r\n calc ==> {\r\n v/power2(outbits) >= power2(outbits*(count-1));\r\n { lemma_mul_inequality(power2(outbits*(count-1)), v/power2(outbits), power2(outbits)); }\r\n (v/power2(outbits))*power2(outbits) >= power2(outbits*(count-1))*power2(outbits);\r\n { lemma_power2_adds(outbits*(count-1), outbits); }\r\n (v/power2(outbits))*power2(outbits) >= power2(outbits*(count-1)+outbits);\r\n { lemma_mul_is_distributive_forall(); }\r\n (v/power2(outbits))*power2(outbits) >= power2((outbits*count-mul(outbits,1))+outbits);\r\n { lemma_mul_basics_forall(); }\r\n (v/power2(outbits))*power2(outbits) >= power2(outbits*count);\r\n { lemma_mod_properties(); }\r\n (v/power2(outbits))*power2(outbits) + v%power2(outbits) >= power2(outbits*count);\r\n {\r\n lemma_fundamental_div_mod(v, power2(outbits));\r\n lemma_mul_is_commutative_forall();\r\n }\r\n v >= power2(outbits*count);\r\n }\r\n }\r\n assert v/power2(outbits) < power2(outbits*(count-1));\r\n lemma_BEIntToDigitSeq_private_chop_proper(outbits, count-1, delta-1, v/power2(outbits));\r\n }\r\n BEIntToDigitSeq_private(power2(outbits), count-1, v/power2(outbits));\r\n }\r\n\r\n BEIntToDigitSeq_private(power2(outbits), count-1, v/power2(outbits)) + [ v % power2(outbits) ];\r\n { reveal_BEIntToDigitSeq_private(); }\r\n BEIntToDigitSeq_private(power2(outbits), count, v);\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEIntToDigitSeq_private_chop(outbits:nat, count:nat, delta:nat, v:int)\r\n requires 0, headseq:seq, tailseq:seq, outbits:nat, scale:nat, inbits:nat)\r\n requires IsDigitSeq(power2(inbits), inseq);\r\n requires IsDigitSeq(power2(inbits), headseq);\r\n requires IsDigitSeq(power2(inbits), tailseq);\r\n requires inseq == headseq + tailseq;\r\n requires |tailseq| == 1;\r\n requires 0 {\r\n true;\r\n { lemma_BEDigitSeqToInt_bound(power2(inbits), inseq[0..|inseq|-1]); }\r\n 0 <= BEDigitSeqToInt_private(power2(inbits), inseq[0..|inseq|-1]) < power(power2(inbits), |inseq[0..|inseq|-1]|);\r\n 0 <= BEDigitSeqToInt_private(power2(inbits), inseq[0..|inseq|-1]) < power(power2(inbits), |inseq|-1);\r\n 0 <= BEDigitSeqToInt_private(power2(inbits), inseq[0..|inseq|-1]) <= power(power2(inbits), |inseq|-1)-1;\r\n { lemma_mul_inequality_forall(); }\r\n mul(0,power2(inbits)) <= mul(BEDigitSeqToInt_private(power2(inbits), inseq[0..|inseq|-1]),power2(inbits))\r\n <= mul(power(power2(inbits), |inseq|-1)-1, power2(inbits));\r\n { lemma_mul_basics_forall(); }\r\n 0 <= mul(BEDigitSeqToInt_private(power2(inbits), inseq[0..|inseq|-1]),power2(inbits))\r\n <= mul(power(power2(inbits), |inseq|-1)-1, power2(inbits));\r\n 0 <= mul(BEDigitSeqToInt_private(power2(inbits), inseq[0..|inseq|-1]),power2(inbits))\r\n <= mul(power(power2(inbits), |inseq|-1) - 1, power2(inbits));\r\n { lemma_mul_is_distributive_forall(); }\r\n 0 <= mul(BEDigitSeqToInt_private(power2(inbits), inseq[0..|inseq|-1]),power2(inbits))\r\n <= mul(power(power2(inbits), |inseq|-1), power2(inbits))-mul(1,power2(inbits));\r\n { lemma_mul_basics_forall(); }\r\n 0 <= mul(BEDigitSeqToInt_private(power2(inbits), inseq[0..|inseq|-1]),power2(inbits))\r\n <= mul(power(power2(inbits), |inseq|-1), power2(inbits))-power2(inbits);\r\n 0 <= mul(BEDigitSeqToInt_private(power2(inbits), inseq[0..|inseq|-1]),power2(inbits)) + inseq[|inseq|-1]\r\n <= mul(power(power2(inbits), |inseq|-1), power2(inbits))-power2(inbits) + inseq[|inseq|-1];\r\n 0 <= bigv < mul(power(power2(inbits), |inseq|-1), power2(inbits))-power2(inbits) + power2(inbits);\r\n 0 <= bigv < mul(power(power2(inbits), |inseq|-1), power2(inbits));\r\n { lemma_power_1(power2(inbits)); }\r\n 0 <= bigv < mul(power(power2(inbits), |inseq|-1), power(power2(inbits), 1));\r\n { lemma_power_adds(power2(inbits), |inseq|-1, 1); }\r\n 0 <= bigv < power(power2(inbits), |inseq|-1+1);\r\n { lemma_power2_is_power_2(inbits); }\r\n 0 <= bigv < power(power(2, inbits), |inseq|-1+1);\r\n 0 <= bigv < power(power(2, inbits), |inseq|);\r\n { lemma_power_multiplies(2, inbits, |inseq|); }\r\n 0 <= bigv < power(2, inbits*|inseq|);\r\n { lemma_power2_is_power_2(inbits*|inseq|); }\r\n 0 <= bigv < power2(inbits*|inseq|);\r\n { lemma_mul_is_commutative_forall(); }\r\n 0 <= bigv < power2(|inseq|*inbits);\r\n 0 <= bigv < power2(|inseq|*(outbits*scale));\r\n { lemma_mul_is_commutative_forall(); lemma_mul_is_associative_forall(); }\r\n 0 <= bigv < power2(outbits*(|inseq|*scale));\r\n }\r\n\r\n calc {\r\n BEIntToDigitSeq(power2(outbits), |headseq|*scale, BEDigitSeqToInt(power2(inbits), headseq))\r\n + BEIntToDigitSeq(power2(outbits), |tailseq|*scale, BEDigitSeqToInt(power2(inbits), tailseq));\r\n BEIntToDigitSeq_private(power2(outbits), |headseq|*scale, BEDigitSeqToInt_private(power2(inbits), headseq))\r\n + BEIntToDigitSeq_private(power2(outbits), |tailseq|*scale, BEDigitSeqToInt_private(power2(inbits), tailseq));\r\n {\r\n assert |headseq| == |inseq|-1;\r\n assert |tailseq|==1;\r\n lemma_mul_basics(scale);\r\n assert |tailseq|*scale == scale;\r\n }\r\n BEIntToDigitSeq_private(power2(outbits), (|inseq|-1)*scale, BEDigitSeqToInt_private(power2(inbits), headseq))\r\n + BEIntToDigitSeq_private(power2(outbits), scale, BEDigitSeqToInt_private(power2(inbits), tailseq));\r\n {\r\n assert headseq == inseq[0..|inseq|-1];\r\n }\r\n BEIntToDigitSeq_private(power2(outbits), (|inseq|-1)*scale, bigv/power2(inbits))\r\n + BEIntToDigitSeq_private(power2(outbits), scale, bigv % power2(inbits));\r\n BEIntToDigitSeq_private(power2(outbits), (|inseq|-1)*scale, bigv/power2(inbits))\r\n + BEIntToDigitSeq_private(power2(outbits), scale, bigv % power2(inbits));\r\n BEIntToDigitSeq_private(power2(outbits), (|inseq|-1)*scale, bigv/(power2(outbits*scale)))\r\n + BEIntToDigitSeq_private(power2(outbits), scale, bigv % (power2(outbits*scale)));\r\n {\r\n calc {\r\n (|inseq|-1)*scale;\r\n { lemma_mul_is_distributive_forall(); }\r\n |inseq|*scale-mul(1,scale);\r\n { lemma_mul_basics_forall(); }\r\n |inseq|*scale-scale;\r\n }\r\n }\r\n BEIntToDigitSeq_private(power2(outbits), |inseq|*scale-scale, bigv/power2(outbits*scale))\r\n + BEIntToDigitSeq_private(power2(outbits), scale, bigv%power2(outbits*scale));\r\n {\r\n lemma_mul_nonnegative(|inseq|,scale);\r\n assert bigv < power2(outbits*(|inseq|*scale));\r\n lemma_mul_increases(|inseq|,scale);\r\n assert scale <= |inseq|*scale;\r\n lemma_BEIntToDigitSeq_private_chop_proper(outbits, |inseq|*scale, scale, bigv);\r\n }\r\n BEIntToDigitSeq_private(power2(outbits), |inseq|*scale, bigv);\r\n BEIntToDigitSeq_private(power2(outbits), |inseq|*scale,\r\n BEDigitSeqToInt_private(power2(inbits), inseq[0..|inseq|-1])*power2(inbits) + inseq[|inseq|-1]);\r\n //- expand defn BEIntToDigitSeq\r\n BEIntToDigitSeq(power2(outbits), |inseq|*scale,\r\n BEDigitSeqToInt_private(power2(inbits), inseq[0..|inseq|-1])*power2(inbits) + inseq[|inseq|-1]);\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEIntToDigitSeq(power2(outbits), |inseq|*scale, BEDigitSeqToInt(power2(inbits), inseq));\r\n }\r\n}\r\n\r\nstatic lemma lemma_SeqTransformChop(inseq:seq, headseq:seq, tailseq:seq, outbits:nat, scale:nat, inbits:nat)\r\n requires IsDigitSeq(power2(inbits), inseq);\r\n requires IsDigitSeq(power2(inbits), headseq);\r\n requires IsDigitSeq(power2(inbits), tailseq);\r\n requires inseq == headseq + tailseq;\r\n requires 0, b:seq, c:seq)\r\n//- requires a == b + c;\r\n//- ensures a[|b|..] == c;\r\n//-{\r\n//-}\r\n\r\nstatic lemma lemma_SeqTransformChopOne(inseq:seq, head:int, tailseq:seq, outbits:nat, scale:nat, inbits:nat)\r\n requires IsDigitSeq(power2(inbits), inseq);\r\n requires 0 <= head < power2(inbits);\r\n requires IsDigitSeq(power2(inbits), tailseq);\r\n requires inseq == [head] + tailseq;\r\n requires 0, headseq:seq, tailseq:seq)\r\n requires IsWordSeq(inseq);\r\n requires IsWordSeq(headseq);\r\n requires IsWordSeq(tailseq);\r\n requires inseq == headseq + tailseq;\r\n ensures BEWordSeqToBitSeq(headseq) + BEWordSeqToBitSeq(tailseq) == BEWordSeqToBitSeq(inseq);\r\n{\r\n lemma_mul_is_mul_boogie(1, 32);\r\n lemma_mul_is_mul_boogie(|inseq|, 32);\r\n lemma_mul_is_mul_boogie(|headseq|, 32);\r\n lemma_mul_is_mul_boogie(|tailseq|, 32);\r\n lemma_SeqTransformChop(inseq, headseq, tailseq, 1, 32, 32);\r\n}\r\n\r\nstatic lemma lemma_WordSeqToBitSeqChopOne(inseq:seq, head:int, tailseq:seq)\r\n requires IsWordSeq(inseq);\r\n requires Word32(head);\r\n requires IsWordSeq(tailseq);\r\n requires inseq == [head] + tailseq;\r\n ensures BEWordToBitSeq(head) + BEWordSeqToBitSeq(tailseq) == BEWordSeqToBitSeq(inseq);\r\n{\r\n lemma_mul_is_mul_boogie(1, 32);\r\n lemma_mul_is_mul_boogie(|inseq|, 32);\r\n lemma_mul_is_mul_boogie(|tailseq|, 32);\r\n lemma_SeqTransformChopOne(inseq, head, tailseq, 1, 32, 32);\r\n}\r\n\r\nstatic lemma lemma_WordSeqToBitSeqChopHead(inseq:seq)\r\n requires IsWordSeq(inseq);\r\n requires |inseq| > 0;\r\n ensures BEWordToBitSeq(inseq[0]) + BEWordSeqToBitSeq(inseq[1..]) == BEWordSeqToBitSeq(inseq);\r\n{\r\n lemma_WordSeqToBitSeqChopOne(inseq, inseq[0], inseq[1..]);\r\n}\r\n\r\nstatic lemma lemma_SeqTransformContentsTail(inseq:seq, tailseq:seq, outbits:nat, scale:nat, inbits:nat)\r\n requires IsDigitSeq(power2(inbits), inseq);\r\n requires 0<|inseq|;\r\n requires IsDigitSeq(power2(inbits), tailseq);\r\n requires inseq[|inseq|-1..] == tailseq;\r\n requires 0, truncseq:seq, outbits:nat, scale:nat, inbits:nat)\r\n requires IsDigitSeq(power2(inbits), inseq);\r\n requires 0<|inseq|;\r\n requires IsDigitSeq(power2(inbits), truncseq);\r\n requires inseq[..|inseq|-1] == truncseq;\r\n requires 0)\r\n ensures IsByteSeq(byteseq) ==> IsBitSeq(BEByteSeqToBitSeq(byteseq));\r\n ensures IsByteSeq(byteseq) ==> |BEByteSeqToBitSeq(byteseq)| == |byteseq|*8;\r\n{\r\n if (IsByteSeq(byteseq))\r\n {\r\n lemma_mul_is_mul_boogie(1,8);\r\n lemma_SeqTransform_structure(byteseq, 1, 8, 8);\r\n lemma_mul_is_mul_boogie(|byteseq|,8);\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEWordSeqToByteSeq_ensures(wordseq:seq)\r\n ensures IsWordSeq(wordseq) ==> IsByteSeq(BEWordSeqToByteSeq(wordseq));\r\n ensures IsWordSeq(wordseq) ==> |BEWordSeqToByteSeq(wordseq)| == |wordseq|*4;\r\n{\r\n if (IsWordSeq(wordseq))\r\n {\r\n lemma_mul_is_mul_boogie(8,4);\r\n lemma_SeqTransform_structure(wordseq, 8, 4, 32);\r\n lemma_mul_is_mul_boogie(|wordseq|,4);\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEWordSeqToBitSeq_ensures(wordseq:seq)\r\n ensures IsWordSeq(wordseq) ==> IsBitSeq(BEWordSeqToBitSeq(wordseq));\r\n ensures IsWordSeq(wordseq) ==> |BEWordSeqToBitSeq(wordseq)| == |wordseq|*32;\r\n{\r\n if (IsWordSeq(wordseq))\r\n {\r\n lemma_mul_is_mul_boogie(1,32);\r\n lemma_SeqTransform_structure(wordseq, 1, 32, 32);\r\n lemma_mul_is_mul_boogie(|wordseq|,32);\r\n }\r\n}\r\n\r\nstatic lemma lemma_concat_preserves_IsByteSeq(x:seq, y:seq)\r\n requires IsByteSeq(x);\r\n requires IsByteSeq(y);\r\n ensures IsByteSeq(x + y);\r\n{\r\n}\r\n\r\nstatic lemma lemma_BEByteSeqToBitSeq_BEWordSeqToByteSeq(wordseq:seq)\r\n requires IsWordSeq(wordseq);\r\n ensures IsByteSeq(BEWordSeqToByteSeq(wordseq));\r\n ensures BEByteSeqToBitSeq(BEWordSeqToByteSeq(wordseq)) == BEWordSeqToBitSeq(wordseq);\r\n{\r\n var wordvalue := BEDigitSeqToInt(power2(32), wordseq);\r\n lemma_BEDigitSeqToInt_bound(power2(32), wordseq);\r\n var byteseq := BEIntToDigitSeq(power2(8), |wordseq|*4, wordvalue);\r\n\r\n assert byteseq == BEWordSeqToByteSeq(wordseq);\r\n lemma_power2_nonzero_bigger_than_one();\r\n\r\n calc {\r\n BEDigitSeqToInt(power2(32), wordseq);\r\n < { lemma_BEDigitSeqToInt_bound(power2(32), wordseq); }\r\n power(power2(32), |wordseq|);\r\n {\r\n lemma_mul_is_mul_boogie(8, 4);\r\n lemma_pull_out_powers_of_2(8, 4, |wordseq|);\r\n lemma_mul_is_mul_boogie(4, |wordseq|);\r\n }\r\n power(power2(8), |wordseq|*4);\r\n }\r\n lemma_BEIntToDigitSeq_private_properties(power2(8), |wordseq|*4, BEDigitSeqToInt(power2(32), wordseq));\r\n assert IsByteSeq(byteseq);\r\n\r\n var bytevalue := BEDigitSeqToInt(power2(8), byteseq);\r\n var bitseq := BEIntToDigitSeq(power2(1), |byteseq|*8, bytevalue);\r\n\r\n\r\n lemma_mul_is_mul_boogie(|wordseq|,4);\r\n calc {\r\n BEWordSeqToByteSeq(wordseq);\r\n BEIntToDigitSeq(power2(8), |wordseq|*4, wordvalue);\r\n }\r\n\r\n lemma_mul_is_mul_boogie(8,4);\r\n lemma_SeqTransform_structure(wordseq, 8, 4, 32);\r\n assert |byteseq| == |wordseq|*4;\r\n assert |byteseq|*8 == |wordseq|*32;\r\n\r\n calc {\r\n bytevalue;\r\n BEDigitSeqToInt(power2(8), byteseq);\r\n {\r\n lemma_2toX();\r\n lemma_BEIntToDigitSeq_invertibility(power2(8), wordvalue, byteseq);\r\n }\r\n wordvalue;\r\n }\r\n\r\n calc {\r\n BEByteSeqToBitSeq(BEWordSeqToByteSeq(wordseq));\r\n BEByteSeqToBitSeq(byteseq);\r\n BEIntToDigitSeq(power2(1), |byteseq|*8, BEDigitSeqToInt(power2(8), byteseq));\r\n BEIntToDigitSeq(power2(1), |byteseq|*8, bytevalue);\r\n\r\n BEIntToDigitSeq(power2(1), |wordseq|*32, wordvalue);\r\n BEWordSeqToBitSeq(wordseq);\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEIntToWordSeq_decomposition(data:seq, i:int)\r\n requires IsWordSeq(data);\r\n requires 0<=i<|data|*32;\r\n decreases |data|;\r\n ensures |BEIntToDigitSeq(2, 32, data[i/32])| == 32;\r\n ensures |BEIntToDigitSeq(2, |data|*32, BEDigitSeqToInt(power2(32), data))| == |data| * 32;\r\n ensures BEIntToDigitSeq(2, 32, data[i/32])[i%32]\r\n == BEIntToDigitSeq(2, |data|*32, BEDigitSeqToInt(power2(32), data))[i];\r\n{\r\n lemma_2toX();\r\n lemma_BEDigitSeqToInt_bound(power2(32), data);\r\n calc {\r\n power(power2(32), |data|);\r\n { lemma_power2_is_power_2(32); }\r\n power(power(2,32), |data|);\r\n { lemma_power_multiplies(2, 32, |data|); }\r\n power(2, mul(32,|data|));\r\n { lemma_mul_is_mul_boogie(32,|data|); }\r\n power(2, |data|*32);\r\n }\r\n lemma_power2_is_power_2(32);\r\n assert data[i/32] < power(2,32);\r\n calc {\r\n 32;\r\n { lemma_BEIntToDigitSeq_private_properties(2, 32, data[i/32]); }\r\n |BEIntToDigitSeq(2, 32, data[i/32])|;\r\n }\r\n assert BEDigitSeqToInt(power2(32), data) < power(power2(32), |data|);\r\n calc {\r\n |data|*32;\r\n { lemma_BEIntToDigitSeq_private_properties(2, |data|*32, BEDigitSeqToInt(power2(32), data)); }\r\n |BEIntToDigitSeq(2, |data|*32, BEDigitSeqToInt(power2(32), data))|;\r\n }\r\n\r\n lemma_power2_1_is_2();\r\n\r\n assert 0<|data|;\r\n if (|data|*32-32 <= i)\r\n {\r\n //- i points into last word. Collapse away front of sequence.\r\n var tailseq := data[|data|-1..];\r\n\r\n lemma_mul_is_mul_boogie(1, 32);\r\n lemma_SeqTransform_structure(tailseq, 1, 32, 32);\r\n lemma_mul_is_mul_boogie(|tailseq|,32);\r\n assert |tailseq| == 1;\r\n assert IsDigitSeq(power2(32), tailseq);\r\n\r\n calc {\r\n BEIntToDigitSeq(2, 32, data[i/32]);\r\n BEIntToDigitSeq(2, 32, tailseq[0]);\r\n { lemma_mul_basics_forall(); }\r\n BEIntToDigitSeq(2, 32, mul(0,power2(32)) + tailseq[0]);\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEIntToDigitSeq(2, 32, mul(BEDigitSeqToInt_private(power2(32), []),power2(32)) + tailseq[0]);\r\n { assert [] == tailseq[0..|tailseq|-1]; }\r\n BEIntToDigitSeq(2, 32,\r\n BEDigitSeqToInt_private(power2(32), tailseq[0..|tailseq|-1])*power2(32) + tailseq[|tailseq|-1] );\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEIntToDigitSeq(2, 32, BEDigitSeqToInt_private(power2(32), tailseq));\r\n BEIntToDigitSeq(2, 32, BEDigitSeqToInt(power2(32), tailseq));\r\n }\r\n\r\n calc {\r\n BEIntToDigitSeq(2, 32, data[i/32])[i%32];\r\n BEIntToDigitSeq(2, 32, BEDigitSeqToInt(power2(32), tailseq))[i%32];\r\n BEIntToDigitSeq(2, 32, BEDigitSeqToInt(power2(32), tailseq))[i-(|data|-1)*32];\r\n {\r\n lemma_mul_basics_forall();\r\n lemma_SeqTransformContentsTail(data, tailseq, 1, 32, 32);\r\n lemma_mul_is_mul_boogie(|data|,32);\r\n lemma_mul_is_mul_boogie(|data|-1,32);\r\n }\r\n BEIntToDigitSeq(2, |data|*32, BEDigitSeqToInt(power2(32), data))[(|data|-1)*32..][i-(|data|-1)*32];\r\n\r\n BEIntToDigitSeq(2, |data|*32, BEDigitSeqToInt(power2(32), data))[i];\r\n\r\n }\r\n }\r\n else\r\n {\r\n //- i doesn't point to last word; strip it off and recurse.\r\n //- i points to last word\r\n var truncseq := data[0..|data|-1];\r\n\r\n calc {\r\n BEIntToDigitSeq(2, 32, data[i/32])[i%32];\r\n BEIntToDigitSeq(2, 32, truncseq[i/32])[i%32];\r\n { lemma_BEIntToWordSeq_decomposition(truncseq, i); }\r\n BEIntToDigitSeq(2, |truncseq|*32, BEDigitSeqToInt(power2(32), truncseq))[i];\r\n {\r\n lemma_mul_basics_forall();\r\n lemma_SeqTransformContentsLeft(data, truncseq, 1, 32, 32);\r\n lemma_mul_is_mul_boogie(|truncseq|,32);\r\n lemma_mul_is_mul_boogie(|data|,32);\r\n }\r\n BEIntToDigitSeq(2, |data|*32, BEDigitSeqToInt(power2(32), data))[..(|data|-1)*32][i];\r\n BEIntToDigitSeq(2, |data|*32, BEDigitSeqToInt(power2(32), data))[i];\r\n }\r\n }\r\n}\r\n\r\n//- converse of lemma_BEWordSeqToInt_BEIntToByteSeq\r\nstatic lemma lemma_BEIntToByteSeq_BEWordSeqToInt(byteseq:seq, wordseq:seq)\r\n requires IsByteSeq(byteseq);\r\n requires IsWordSeq(wordseq);\r\n requires BEByteSeqToInt(byteseq) == BEWordSeqToInt(wordseq);\r\n requires |byteseq| == |wordseq|*4;\r\n ensures BEWordSeqToByteSeq(wordseq) == byteseq;\r\n{\r\n lemma_2toX();\r\n var intvalue := BEByteSeqToInt(byteseq);\r\n lemma_BEDigitSeqToInt_bound(power2(8), byteseq);\r\n assert 0<=intvalue;\r\n\r\n lemma_BEDigitSeqToInt_invertibility(power2(8), intvalue, byteseq);\r\n assert byteseq == BEIntToDigitSeq(power2(8), |byteseq|, intvalue);\r\n\r\n lemma_BEDigitSeqToInt_invertibility(power2(32), intvalue, wordseq);\r\n assert wordseq == BEIntToDigitSeq(power2(32), |wordseq|, intvalue);\r\n\r\n calc {\r\n BEWordSeqToByteSeq(wordseq);\r\n BEIntToDigitSeq(power2(8), |wordseq|*4, BEDigitSeqToInt(power2(32), wordseq));\r\n BEIntToDigitSeq(power2(8), |byteseq|, BEDigitSeqToInt(power2(32), wordseq));\r\n BEIntToDigitSeq(power2(8), |byteseq|, BEDigitSeqToInt(power2(8), byteseq));\r\n BEIntToDigitSeq(power2(8), |byteseq|, intvalue);\r\n byteseq;\r\n }\r\n}\r\n\r\n//- converse of lemma_BEIntToByteSeq_BEWordSeqToInt\r\nstatic lemma lemma_BEWordSeqToInt_BEIntToByteSeq(byteseq:seq, wordseq:seq)\r\n requires IsByteSeq(byteseq);\r\n requires IsWordSeq(wordseq);\r\n requires BEWordSeqToByteSeq(wordseq) == byteseq;\r\n requires |byteseq| == |wordseq|*4;\r\n ensures BEByteSeqToInt(byteseq) == BEWordSeqToInt(wordseq);\r\n{\r\n lemma_2toX();\r\n lemma_BEDigitSeqToInt_bound(power2(32), wordseq);\r\n calc {\r\n BEByteSeqToInt(byteseq);\r\n BEByteSeqToInt(BEWordSeqToByteSeq(wordseq));\r\n BEDigitSeqToInt(power2(8), BEWordSeqToByteSeq(wordseq));\r\n BEDigitSeqToInt(power2(8),\r\n BEIntToDigitSeq(power2(8), |wordseq|*4, BEDigitSeqToInt(power2(32), wordseq)));\r\n { lemma_BEInt_decoding_general(power2(8), |byteseq|, BEDigitSeqToInt(power2(32), wordseq)); }\r\n BEDigitSeqToInt(power2(32), wordseq);\r\n BEWordSeqToInt(wordseq);\r\n }\r\n}\r\n\r\nstatic lemma BEByteSeqToWordSeq_base1(bs:seq, ws:seq)\r\n requires |bs|==1;\r\n requires IsByteSeq(bs);\r\n requires ws == [bs[0]];\r\n ensures IsWordSeq(ws);\r\n ensures BEWordSeqToInt(ws) == BEByteSeqToInt(bs);\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_mul_basics_forall();\r\n lemma_power2_increases(8,32);\r\n lemma_2toX();\r\n calc {\r\n BEWordSeqToInt(ws);\r\n BEDigitSeqToInt(power2(32), ws[0..0])*power2(32) + ws[0];\r\n BEDigitSeqToInt(power2(8), bs[0..0])*power2(8) + bs[0];\r\n BEByteSeqToInt(bs);\r\n }\r\n}\r\n\r\nstatic lemma BEByteSeqToWordSeq_base2(bs:seq, ws:seq)\r\n requires |bs|==2;\r\n requires IsByteSeq(bs);\r\n requires ws == [bs[0] * 256 + bs[1]];\r\n ensures IsWordSeq(ws);\r\n ensures BEWordSeqToInt(ws) == BEByteSeqToInt(bs);\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_mul_basics_forall();\r\n lemma_power2_increases(8,32);\r\n lemma_2toX();\r\n calc {\r\n BEWordSeqToInt(ws);\r\n BEDigitSeqToInt(power2(32), ws[0..0])*power2(32) + ws[0];\r\n bs[0] * 256 + bs[1];\r\n { lemma_mul_is_mul_boogie(bs[0], power2(8)); }\r\n bs[0] * power2(8) + bs[1];\r\n (BEDigitSeqToInt_private(power2(8), bs[0..0])*power2(8) + bs[0])*power2(8)+bs[1];\r\n { lemma_sequence_reduction(bs, 1); }\r\n BEDigitSeqToInt(power2(8), bs[0..1])*power2(8) + bs[1];\r\n BEByteSeqToInt(bs);\r\n }\r\n}\r\n\r\nstatic lemma BEByteSeqToWordSeq_base3(bs:seq, ws:seq)\r\n requires |bs|==3;\r\n requires IsByteSeq(bs);\r\n requires ws == [bs[0] * 256*256 + bs[1] * 256 + bs[2]];\r\n ensures IsWordSeq(ws);\r\n ensures BEWordSeqToInt(ws) == BEByteSeqToInt(bs);\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_mul_basics_forall();\r\n lemma_power2_increases(8,32);\r\n lemma_2toX();\r\n calc {\r\n BEWordSeqToInt(ws);\r\n BEDigitSeqToInt(power2(32), ws[0..0])*power2(32) + ws[0];\r\n bs[0] * 256*256 + bs[1] * 256 + bs[2];\r\n (bs[0] * 256 + bs[1]) * 256 + bs[2];\r\n {\r\n lemma_mul_is_mul_boogie(bs[0], power2(8));\r\n lemma_mul_is_mul_boogie(bs[0] * power2(8) + bs[1], power2(8));\r\n }\r\n (bs[0] * power2(8) + bs[1]) * power2(8) + bs[2];\r\n ((BEDigitSeqToInt_private(power2(8), bs[0..0])*power2(8) + bs[0])*power2(8)+bs[1])*power2(8) + bs[2];\r\n (BEDigitSeqToInt_private(power2(8), bs[0..1])*power2(8)+bs[1])*power2(8) + bs[2];\r\n { lemma_sequence_reduction(bs, 2); }\r\n BEDigitSeqToInt_private(power2(8), bs[0..2])*power2(8) + bs[2];\r\n//- BEDigitSeqToInt_private(power2(8), bs);\r\n//- BEDigitSeqToInt(power2(8), bs);\r\n BEByteSeqToInt(bs);\r\n }\r\n}\r\n\r\nstatic lemma BEByteSeqToWordSeq_base4(bs:seq, ws:seq)\r\n requires |bs|==4;\r\n requires IsByteSeq(bs);\r\n requires ws == [bs[0] * 256*256*256 + bs[1] * 256*256 + bs[2] * 256 + bs[3]];\r\n ensures IsWordSeq(ws);\r\n ensures BEWordSeqToInt(ws) == BEByteSeqToInt(bs);\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_mul_basics_forall();\r\n lemma_power2_increases(8,32);\r\n lemma_2toX();\r\n calc {\r\n BEWordSeqToInt(ws);\r\n BEDigitSeqToInt(power2(32), ws[0..0])*power2(32) + ws[0];\r\n bs[0] * 256*256*256 + bs[1] * 256*256 + bs[2] * 256 + bs[3];\r\n ((bs[0] * 256 + bs[1]) * 256 + bs[2]) * 256 + bs[3];\r\n {\r\n lemma_mul_is_mul_boogie(bs[0], power2(8));\r\n lemma_mul_is_mul_boogie(bs[0] * power2(8) + bs[1], power2(8));\r\n lemma_mul_is_mul_boogie((bs[0] * power2(8) + bs[1]) * power2(8) + bs[2], power2(8));\r\n }\r\n ((bs[0] * power2(8) + bs[1]) * power2(8) + bs[2])*power2(8) + bs[3];\r\n\r\n (((bs[0])*power2(8) + bs[1])*power2(8) + bs[2])*power2(8) + bs[3];\r\n (((bs[|bs|-4])*power2(8) + bs[|bs|-3])*power2(8) + bs[|bs|-2])*power2(8) + bs[|bs|-1];\r\n BEByteSeqToInt([])*power2(32)\r\n + (((bs[|bs|-4])*power2(8) + bs[|bs|-3])*power2(8) + bs[|bs|-2])*power2(8) + bs[|bs|-1];\r\n { lemma_BEByteSeqToInt_unpack_four(bs, []); }\r\n BEByteSeqToInt(bs);\r\n }\r\n}\r\n\r\nstatic predicate BEByteSeqToWordSeq_base_props(bs:seq, ws:seq, padbytes:seq)\r\n requires IsByteSeq(bs);\r\n{\r\n IsWordSeq(ws)\r\n && (|bs|>0 ==> |ws|>0)\r\n && |ws| == (|bs|+3)/4\r\n && BEByteSeqToInt(bs) == BEWordSeqToInt(ws)\r\n && |BEWordSeqToByteSeq(ws)| >= |bs|\r\n && padbytes == SequenceOfZeros(|ws|*4 - |bs|)\r\n && IsByteSeq(padbytes)\r\n && BEWordSeqToByteSeq(ws) == padbytes + bs\r\n && ((|bs|%4)==0 ==> BEWordSeqToByteSeq(ws) == bs)\r\n && |ws|<=1\r\n}\r\n\r\nstatic method BEByteSeqToWordSeq_base(bs:seq) returns (ws:seq, ghost padbytes:seq)\r\n//- decreases |bs|;\r\n requires IsByteSeq(bs);\r\n requires |bs|<=4;\r\n ensures BEByteSeqToWordSeq_base_props(bs, ws, padbytes);\r\n//- ensures IsWordSeq(ws);\r\n//- ensures |bs|>0 ==> |ws|>0;\r\n//- ensures |ws| == (|bs|+3)/4;\r\n//- ensures BEByteSeqToInt(bs) == BEWordSeqToInt(ws);\r\n//- ensures |BEWordSeqToByteSeq(ws)| >= |bs|;\r\n//- ensures padbytes == SequenceOfZeros(|ws|*4 - |bs|);\r\n//- ensures IsByteSeq(padbytes);\r\n//- ensures BEWordSeqToByteSeq(ws) == padbytes + bs;\r\n//- ensures (|bs|%4)==0 ==> BEWordSeqToByteSeq(ws) == bs;\r\n//- ensures |ws|<=1;\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_mul_basics_forall();\r\n lemma_power2_increases(8,32);\r\n lemma_2toX();\r\n\r\n if (|bs|==0) {\r\n ws := [];\r\n } else if (|bs|==1) {\r\n ws := [bs[0]];\r\n BEByteSeqToWordSeq_base1(bs, ws);\r\n } else if (|bs|==2) {\r\n ws := [bs[0] * 256 + bs[1]];\r\n BEByteSeqToWordSeq_base2(bs, ws);\r\n } else if (|bs|==3) {\r\n ws := [bs[0] * 256*256 + bs[1] * 256 + bs[2]];\r\n BEByteSeqToWordSeq_base3(bs, ws);\r\n } else if (|bs|==4) {\r\n ws := [bs[0] * 256*256*256 + bs[1] * 256*256 + bs[2] * 256 + bs[3]];\r\n BEByteSeqToWordSeq_base4(bs, ws);\r\n } else {\r\n assert false;\r\n ws := []; //- dafnycc\r\n }\r\n\r\n padbytes := SequenceOfZeros(|ws|*4 - |bs|);\r\n lemma_BEByteSeqToWordSeq_impl_helper(bs, ws, padbytes);\r\n}\r\n\r\n\r\n\r\nstatic lemma lemma_BEByteSeqToWordSeq_base_empty(bs:seq) returns (ws:seq, padbytes:seq)\r\n requires IsByteSeq(bs);\r\n requires |bs|==0;\r\n ensures BEByteSeqToWordSeq_base_props(bs, ws, padbytes);\r\n{\r\n ws := [];\r\n padbytes := [];\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_BEWordSeqToByteSeq_ensures(ws);\r\n}\r\n\r\nstatic method BEByteSeqToWordSeq_base_arrays(ba:array, a_off:nat, a_len:nat, ghost bs:seq) returns (wv:int, ghost ws:seq, ghost padbytes:seq)\r\n decreases |bs|;\r\n requires ba!=null;\r\n requires a_off+a_len <= ba.Length;\r\n requires ba[a_off..a_off+a_len]==bs;\r\n requires IsByteSeq(bs);\r\n requires |bs|<=4;\r\n ensures IsWordSeq(ws);\r\n ensures |bs|>0 ==> |ws|>0;\r\n ensures |bs|>0 ==> ws==[wv];\r\n ensures |ws| == (|bs|+3)/4;\r\n ensures BEByteSeqToInt(bs) == BEWordSeqToInt(ws);\r\n ensures |BEWordSeqToByteSeq(ws)| >= |bs|;\r\n ensures padbytes == SequenceOfZeros(|ws|*4 - |bs|);\r\n ensures IsByteSeq(padbytes);\r\n ensures BEWordSeqToByteSeq(ws) == padbytes + bs;\r\n ensures (|bs|%4)==0 ==> BEWordSeqToByteSeq(ws) == bs;\r\n ensures |ws|<=1;\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_mul_basics_forall();\r\n lemma_power2_increases(8,32);\r\n lemma_2toX();\r\n\r\n if (a_len==0) {\r\n wv := 0;\r\n ws := [];\r\n } else if (a_len==1) {\r\n wv := ba[a_off+0];\r\n ws := [wv];\r\n BEByteSeqToWordSeq_base1(bs, ws);\r\n } else if (a_len==2) {\r\n wv := ba[a_off+0] * 256 + ba[a_off+1];\r\n ws := [wv];\r\n BEByteSeqToWordSeq_base2(bs, ws);\r\n } else if (a_len==3) {\r\n wv := ba[a_off+0] * 256*256 + ba[a_off+1] * 256 + ba[a_off+2];\r\n ws := [wv];\r\n BEByteSeqToWordSeq_base3(bs, ws);\r\n } else if (a_len==4) {\r\n wv := ba[a_off+0] * 256*256*256 + ba[a_off+1] * 256*256 + ba[a_off+2] * 256 + ba[a_off+3];\r\n ws := [wv];\r\n BEByteSeqToWordSeq_base4(bs, ws);\r\n } else {\r\n assert false;\r\n wv := 0; //- dafnycc\r\n ws := []; //- dafnycc\r\n }\r\n\r\n padbytes := SequenceOfZeros(|ws|*4 - |bs|);\r\n lemma_BEByteSeqToWordSeq_impl_helper(bs, ws, padbytes);\r\n}\r\n\r\nstatic lemma lemma_BEByteSeqToWordSeq_impl_helper(bs:seq, ws:seq, padbytes:seq)\r\n requires IsByteSeq(bs);\r\n requires IsWordSeq(ws);\r\n requires IsByteSeq(padbytes);\r\n requires |bs| <= |ws|*4;\r\n requires |ws| == (|bs|+3)/4;\r\n requires BEWordSeqToInt(ws) == BEByteSeqToInt(bs);\r\n requires padbytes == SequenceOfZeros(|ws|*4 - |bs|);\r\n ensures |BEWordSeqToByteSeq(ws)| >= |bs|;\r\n ensures BEWordSeqToByteSeq(ws) == padbytes + bs;\r\n ensures (|bs|%4)==0 ==> BEWordSeqToByteSeq(ws) == bs;\r\n{\r\n lemma_2toX();\r\n lemma_BEWordSeqToByteSeq_ensures(ws);\r\n assert |BEWordSeqToByteSeq(ws)| == |padbytes| + |bs|;\r\n ghost var padded_bs := padbytes + bs;\r\n\r\n calc {\r\n BEByteSeqToInt(padded_bs);\r\n { lemma_LeadingZeros(power2(8), bs, padded_bs); }\r\n BEByteSeqToInt(bs);\r\n BEWordSeqToInt(ws);\r\n }\r\n lemma_BEIntToByteSeq_BEWordSeqToInt(padded_bs, ws);\r\n assert BEWordSeqToByteSeq(ws) == padded_bs;\r\n assert BEWordSeqToByteSeq(ws) == padbytes + bs;\r\n\r\n \r\n \r\n if (|bs|%4==0)\r\n {\r\n lemma_round_down(|bs|, 3, 4);\r\n calc {\r\n |bs|;\r\n mul(4,div((|bs|+3),4));\r\n mul(4,(|bs|+3)/4);\r\n { assert |ws| == (|bs|+3)/4; }\r\n mul(4,|ws|);\r\n { lemma_mul_is_mul_boogie(4, |ws|); }\r\n 4*|ws|;\r\n }\r\n lemma_BEIntToByteSeq_BEWordSeqToInt(bs, ws);\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEByteSeqToInt_BEWordSeqToInt_concatenation(bsa:seq, bsb:seq, wsa:seq, wsb:seq)\r\n requires IsByteSeq(bsa);\r\n requires IsByteSeq(bsb);\r\n requires IsWordSeq(wsa);\r\n requires IsWordSeq(wsb);\r\n//- requires |bsa| == |wsa|*4;\r\n requires |bsb| == |wsb|*4;\r\n requires BEByteSeqToInt(bsa)==BEWordSeqToInt(wsa);\r\n requires BEByteSeqToInt(bsb)==BEWordSeqToInt(wsb);\r\n decreases |wsb|;\r\n ensures BEByteSeqToInt(bsa + bsb)==BEWordSeqToInt(wsa+wsb);\r\n{\r\n if (|wsb|==0)\r\n {\r\n assert bsa + bsb == bsa;\r\n assert wsa + wsb == wsa;\r\n }\r\n else\r\n {\r\n reveal_BEDigitSeqToInt_private();\r\n\r\n var sub_bsb := bsb[..|bsb|-4];\r\n var tail_bsb := bsb[|bsb|-4..];\r\n assert sub_bsb + tail_bsb == bsb;\r\n\r\n var sub_wsb := wsb[..|wsb|-1];\r\n var tail_wsb := wsb[|wsb|-1..];\r\n assert sub_wsb + tail_wsb == wsb;\r\n\r\n lemma_BEByteSeqToInt_strip_four(bsb, sub_bsb, tail_bsb);\r\n assert BEByteSeqToInt(bsb) ==\r\n BEByteSeqToInt(sub_bsb)*power2(32) + BEByteSeqToInt(tail_bsb);\r\n assert 0 <= BEByteSeqToInt(tail_bsb) < power2(32);\r\n lemma_fundamental_div_mod_converse(BEByteSeqToInt(bsb), power2(32),\r\n BEByteSeqToInt(sub_bsb), BEByteSeqToInt(tail_bsb));\r\n\r\n calc {\r\n BEWordSeqToInt(tail_wsb);\r\n BEDigitSeqToInt_private(power2(32), tail_wsb[0..|tail_wsb|-1])*power2(32) + tail_wsb[|tail_wsb|-1];\r\n BEDigitSeqToInt_private(power2(32), [])*power2(32) + tail_wsb[|tail_wsb|-1];\r\n { lemma_mul_basics_forall(); }\r\n tail_wsb[|tail_wsb|-1];\r\n tail_wsb[0];\r\n }\r\n assert 0 <= BEWordSeqToInt(tail_wsb) < power2(32);\r\n calc {\r\n BEWordSeqToInt(wsb);\r\n BEDigitSeqToInt_private(power2(32), wsb[0..|wsb|-1])*power2(32) + wsb[|wsb|-1];\r\n { lemma_vacuous_statement_about_a_sequence(wsb, |wsb|-1); }\r\n BEDigitSeqToInt_private(power2(32), sub_wsb)*power2(32) + wsb[|wsb|-1];\r\n BEDigitSeqToInt_private(power2(32), sub_wsb)*power2(32) + tail_wsb[0];\r\n BEWordSeqToInt(sub_wsb)*power2(32) + tail_wsb[0];\r\n BEWordSeqToInt(sub_wsb)*power2(32) + BEWordSeqToInt(tail_wsb);\r\n }\r\n lemma_fundamental_div_mod_converse(BEWordSeqToInt(wsb), power2(32),\r\n BEWordSeqToInt(sub_wsb), BEWordSeqToInt(tail_wsb));\r\n\r\n assert BEByteSeqToInt(sub_bsb)==BEWordSeqToInt(sub_wsb);\r\n assert BEByteSeqToInt(tail_bsb)==BEWordSeqToInt(tail_wsb);\r\n\r\n calc {\r\n BEByteSeqToInt(bsa+bsb);\r\n BEByteSeqToInt(bsa+bsb);\r\n BEByteSeqToInt(bsa+(sub_bsb+tail_bsb));\r\n { lemma_seq_concatenation_associative(bsa, sub_bsb, tail_bsb); }\r\n //-{ assert bsa+(sub_bsb+tail_bsb) == (bsa+sub_bsb)+tail_bsb; }\r\n BEByteSeqToInt((bsa+sub_bsb)+tail_bsb);\r\n {\r\n lemma_BEByteSeqToInt_strip_four(\r\n (bsa+sub_bsb)+tail_bsb,\r\n bsa+sub_bsb,\r\n tail_bsb);\r\n }\r\n BEByteSeqToInt(bsa+sub_bsb)*power2(32) + BEByteSeqToInt(tail_bsb);\r\n {\r\n assert BEByteSeqToInt(sub_bsb)==BEWordSeqToInt(sub_wsb);\r\n lemma_BEByteSeqToInt_BEWordSeqToInt_concatenation(bsa, sub_bsb, wsa, sub_wsb);\r\n }\r\n BEWordSeqToInt(wsa+sub_wsb)*power2(32) + BEByteSeqToInt(tail_bsb);\r\n {\r\n assert BEByteSeqToInt(tail_bsb)==BEWordSeqToInt(tail_wsb);\r\n lemma_mul_basics_forall();\r\n calc {\r\n BEByteSeqToInt([]);\r\n 0;\r\n BEWordSeqToInt([]);\r\n }\r\n lemma_BEByteSeqToInt_BEWordSeqToInt_concatenation(tail_bsb, [], tail_wsb, []);\r\n }\r\n BEWordSeqToInt(wsa+sub_wsb)*power2(32) + BEWordSeqToInt(tail_wsb);\r\n {\r\n reveal_BEDigitSeqToInt_private();\r\n var digits := (wsa+sub_wsb)+tail_wsb;\r\n assert digits[0..|digits|-1] == (wsa+sub_wsb);\r\n assert digits[|digits|-1..] == tail_wsb;\r\n calc {\r\n digits[|digits|-1];\r\n tail_wsb[0];\r\n { lemma_mul_basics_forall(); }\r\n mul(0,power2(32)) + tail_wsb[0];\r\n BEDigitSeqToInt_private(power2(32), [])*power2(32) + tail_wsb[0];\r\n BEDigitSeqToInt_private(power2(32), tail_wsb[0..|tail_wsb|-1])*power2(32) + tail_wsb[0];\r\n BEDigitSeqToInt_private(power2(32), tail_wsb[0..|tail_wsb|-1])*power2(32) + tail_wsb[|tail_wsb|-1];\r\n BEDigitSeqToInt_private(power2(32), tail_wsb);\r\n BEWordSeqToInt(tail_wsb);\r\n }\r\n calc {\r\n BEWordSeqToInt((wsa+sub_wsb)+tail_wsb);\r\n BEDigitSeqToInt_private(power2(32), (wsa+sub_wsb))*power2(32) + tail_wsb[0];\r\n BEWordSeqToInt(wsa+sub_wsb)*power2(32) + BEWordSeqToInt(tail_wsb);\r\n }\r\n assert IsWordSeq((wsa+sub_wsb)+tail_wsb);\r\n }\r\n BEWordSeqToInt((wsa+sub_wsb)+tail_wsb);\r\n { lemma_seq_concatenation_associative(wsa,sub_wsb,tail_wsb); }\r\n BEWordSeqToInt(wsa+(sub_wsb+tail_wsb));\r\n BEWordSeqToInt(wsa+wsb);\r\n }\r\n }\r\n}\r\n\r\nstatic predicate BEByteSeqToWordSeq_loop_invariants(\r\n bs:seq, ptr:int, ws:seq)\r\n requires IsByteSeq(bs);\r\n requires |bs|>0;\r\n requires ptr <= |bs|;\r\n{\r\n ptr>0\r\n && IsWordSeq(ws)\r\n && |bs[ptr..]| <= |ws|*4\r\n && |ws| == (|bs[ptr..]|+3)/4\r\n && BEWordSeqToInt(ws) == BEByteSeqToInt(bs[ptr..])\r\n && (|bs|-ptr) % 4 == 0\r\n && |bs[ptr..]| == mul(|ws|,4)\r\n}\r\n\r\nstatic lemma lemma_BEByteSeqToWordSeq_iterative_loop(\r\n bs:seq, prefix_bs:seq, prefix_word:seq,\r\n ptr:int, ws:seq, ptr':int, ws':seq)\r\n\r\n requires IsByteSeq(bs);\r\n requires |bs|>0;\r\n requires ptr <= |bs|;\r\n requires IsWordSeq(prefix_word);\r\n requires |prefix_word|==1;\r\n requires IsByteSeq(prefix_bs);\r\n requires ptr > 4;\r\n requires prefix_bs == bs[ptr-4..ptr];\r\n requires BEByteSeqToInt(prefix_bs) == BEWordSeqToInt(prefix_word);\r\n\r\n requires BEByteSeqToWordSeq_loop_invariants(bs, ptr, ws);\r\n\r\n requires ptr' == ptr - 4;\r\n requires ws' == prefix_word + ws;\r\n\r\n ensures BEByteSeqToWordSeq_loop_invariants(bs, ptr', ws');\r\n{\r\n calc {\r\n BEWordSeqToInt(ws');\r\n BEWordSeqToInt(prefix_word + ws);\r\n {\r\n lemma_mul_is_mul_boogie(|ws|,4);\r\n assert |bs[ptr..]| == |ws|*4;\r\n lemma_BEByteSeqToInt_BEWordSeqToInt_concatenation(\r\n prefix_bs, bs[ptr..], prefix_word, ws);\r\n }\r\n BEByteSeqToInt(prefix_bs + bs[ptr..]);\r\n BEByteSeqToInt(prefix_bs + bs[ptr..]);\r\n BEByteSeqToInt(bs[ptr-4..ptr] + bs[ptr..]);\r\n { assert bs[ptr-4..ptr] + bs[ptr..] == bs[ptr-4..]; }\r\n BEByteSeqToInt(bs[ptr-4..]);\r\n }\r\n\r\n calc {\r\n (|bs| - ptr') % 4;\r\n (|bs| - (ptr-4)) % 4;\r\n (|bs| - ptr + 4) % 4;\r\n mod(|bs| - ptr + 4, 4);\r\n { lemma_mul_basics_forall(); lemma_mod_multiples_vanish(1, |bs|-ptr, 4); }\r\n mod(|bs| - ptr, 4);\r\n (|bs| - ptr) % 4;\r\n 0;\r\n }\r\n//- assert |ws|+1 == |ws'|;\r\n calc {\r\n |bs[ptr'..]|;\r\n |bs[ptr..]|+4;\r\n { lemma_mul_basics_forall(); }\r\n mul(|ws|,4)+mul(1,4);\r\n { lemma_mul_is_distributive_forall(); }\r\n mul(|ws|+1,4);\r\n mul(|ws'|,4);\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEByteSeqToWordSeq_loop_invariants_initial(bs:seq, ptr:int, ws:seq)\r\n requires |bs|==ptr;\r\n requires |ws|==0;\r\n requires IsByteSeq(bs);\r\n requires |bs|>0;\r\n ensures BEByteSeqToWordSeq_loop_invariants(bs, ptr, ws);\r\n{\r\n calc {\r\n true;\r\n { reveal_BEDigitSeqToInt_private();\r\n calc {\r\n BEWordSeqToInt(ws);\r\n BEWordSeqToInt([]);\r\n 0;\r\n BEByteSeqToInt([]);\r\n BEByteSeqToInt(bs[ptr..]);\r\n }\r\n }\r\n BEWordSeqToInt(ws) == BEByteSeqToInt(bs[ptr..]);\r\n { lemma_mul_basics(4); }\r\n BEByteSeqToWordSeq_loop_invariants(bs, ptr, ws);\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEByteSeqToWordSeq_impl_final(bs:seq, ws:seq, padbytes:seq, ptr:int, old_ws:seq, prefix_bs:seq, prefix_word:seq)\r\n requires IsByteSeq(bs);\r\n requires IsByteSeq(prefix_bs);\r\n requires IsWordSeq(ws);\r\n requires IsWordSeq(prefix_word);\r\n requires 0 < ptr <= 4;\r\n requires (|bs|-ptr) % 4 == 0;\r\n requires ptr <= |bs|;\r\n requires BEByteSeqToWordSeq_loop_invariants(bs, ptr, old_ws);\r\n requires |old_ws| == (|bs[ptr..]|+3)/4;\r\n requires ws == prefix_word + old_ws;\r\n requires prefix_bs == bs[0..ptr];\r\n requires BEByteSeqToWordSeq_base_props(prefix_bs, prefix_word, padbytes);\r\n ensures |ws| == (|bs|+3)/4;\r\n ensures BEByteSeqToInt(bs) == BEWordSeqToInt(ws);\r\n ensures |BEWordSeqToByteSeq(ws)| >= |bs|;\r\n ensures padbytes == SequenceOfZeros(|ws|*4 - |bs|);\r\n ensures BEWordSeqToByteSeq(ws) == padbytes + bs;\r\n ensures (|bs|%4)==0 ==> BEWordSeqToByteSeq(ws) == bs;\r\n{\r\n calc {\r\n |ws|;\r\n |prefix_word| + |old_ws|;\r\n |prefix_word| + (|bs[ptr..]|+3)/4;\r\n {\r\n assert BEByteSeqToWordSeq_base_props(prefix_bs, prefix_word, padbytes);\r\n assert |prefix_word| == (|prefix_bs|+3)/4;\r\n assert prefix_bs == bs[0..ptr];\r\n }\r\n (|bs[0..ptr]|+3)/4 + (|bs[ptr..]|+3)/4;\r\n (ptr+3)/4 + (|bs|-ptr+3)/4;\r\n 1 + (|bs|-ptr)/4;\r\n (|bs|+3)/4;\r\n (|bs[0..]|+3)/4;\r\n }\r\n\r\n lemma_mul_is_mul_boogie(|old_ws|,4);\r\n assert |bs[ptr..]| == |old_ws|*4;\r\n lemma_BEByteSeqToInt_BEWordSeqToInt_concatenation(\r\n prefix_bs, bs[ptr..], prefix_word, old_ws);\r\n assert bs[0..ptr] + bs[ptr..] == bs[0..] + [] == bs;\r\n\r\n assert BEWordSeqToInt(ws) == BEByteSeqToInt(bs);\r\n calc {\r\n padbytes;\r\n SequenceOfZeros(|prefix_word|*4 - |bs[0..ptr]|);\r\n calc {\r\n |bs[0..ptr]|;\r\n ptr;\r\n |bs|-(|bs|-ptr);\r\n { assert (|bs|-ptr) % 4 == 0 ; }\r\n |bs|-((|bs|-ptr+3)/4)*4;\r\n |bs|-((|bs[ptr..]|+3)/4)*4;\r\n |bs|-|old_ws|*4;\r\n }\r\n SequenceOfZeros(|prefix_word|*4 + |old_ws|*4 - |bs|);\r\n SequenceOfZeros((|prefix_word| + |old_ws|)*4 - |bs|);\r\n SequenceOfZeros(|ws|*4 - |bs|);\r\n }\r\n lemma_BEByteSeqToWordSeq_impl_helper(bs, ws, padbytes);\r\n}\r\n\r\nstatic lemma lemma_WordsBytesEquivalence(bs:seq, ws:seq)\r\n requires IsByteSeq(bs);\r\n requires IsWordSeq(ws);\r\n requires BEByteSeqToInt(bs) == BEWordSeqToInt(ws);\r\n requires (|bs|%4)==0;\r\n requires |ws|*4==|bs|;\r\n ensures BEWordSeqToByteSeq(ws) == bs;\r\n ensures BEByteSeqToWordSeq(bs) == ws;\r\n{\r\n lemma_2toX();\r\n lemma_BEDigitSeqToInt_bound(power2(8), bs);\r\n lemma_BEDigitSeqToInt_bound(power2(32), ws);\r\n lemma_BEDigitSeqToInt_invertibility(power2(8), BEByteSeqToInt(bs), bs);\r\n lemma_BEDigitSeqToInt_invertibility(power2(32), BEWordSeqToInt(ws), ws);\r\n}\r\n\r\nstatic method BEByteSeqToWordSeq_impl(bs:seq) returns (ws:seq, ghost padbytes:seq)\r\n//- decreases |bs|;\r\n requires IsByteSeq(bs);\r\n ensures IsWordSeq(ws);\r\n ensures |bs|>0 ==> |ws|>0;\r\n ensures |ws| == (|bs|+3)/4;\r\n ensures BEByteSeqToInt(bs) == BEWordSeqToInt(ws);\r\n ensures |BEWordSeqToByteSeq(ws)| >= |bs|;\r\n ensures padbytes == SequenceOfZeros(|ws|*4 - |bs|);\r\n ensures IsByteSeq(padbytes);\r\n ensures BEWordSeqToByteSeq(ws) == padbytes + bs;\r\n ensures (|bs|%4)==0 ==> BEWordSeqToByteSeq(ws) == bs;\r\n ensures (|bs|%4)==0 ==> BEByteSeqToWordSeq(bs) == ws;\r\n{\r\n lemma_mul_basics_forall();\r\n lemma_power2_increases(8,32);\r\n lemma_2toX();\r\n\r\n if (|bs|==0)\r\n {\r\n ws,padbytes := BEByteSeqToWordSeq_base([]);\r\n }\r\n else\r\n {\r\n ws := [];\r\n var prefix_bs;\r\n var prefix_word;\r\n ghost var old_ws;\r\n ghost var old_ptr;\r\n var ptr := |bs|;\r\n lemma_BEByteSeqToWordSeq_loop_invariants_initial(bs, ptr, ws);\r\n while (ptr > 4)\r\n invariant ptr <= |bs|;\r\n invariant BEByteSeqToWordSeq_loop_invariants(bs, ptr, ws);\r\n {\r\n prefix_bs := bs[ptr-4..ptr];\r\n prefix_word,padbytes := BEByteSeqToWordSeq_base(prefix_bs);\r\n old_ws := ws;\r\n old_ptr := ptr;\r\n ws := prefix_word + ws;\r\n\r\n ghost var old_ptr2 := ptr;\r\n ptr := ptr - 4;\r\n lemma_BEByteSeqToWordSeq_iterative_loop(\r\n bs, prefix_bs, prefix_word, old_ptr2, old_ws, ptr, ws);\r\n }\r\n assert {:split_here} true;\r\n prefix_bs := bs[0..ptr];\r\n prefix_word,padbytes := BEByteSeqToWordSeq_base(prefix_bs);\r\n old_ws := ws;\r\n assert |old_ws| == (|bs[ptr..]|+3)/4;\r\n ws := prefix_word + ws;\r\n\r\n lemma_BEByteSeqToWordSeq_impl_final(bs, ws, padbytes, ptr, old_ws, prefix_bs, prefix_word);\r\n }\r\n if ((|bs|%4)==0) {\r\n lemma_WordsBytesEquivalence(bs, ws);\r\n }\r\n}\r\n\r\nstatic method BEByteSeqToWordSeq_impl_arrays(ba:array, ghost bs:seq) returns (wa:array, ghost ws:seq, ghost padbytes:seq)\r\n requires ba!=null;\r\n requires ba[..]==bs;\r\n requires IsByteSeq(bs);\r\n ensures wa!=null;\r\n ensures wa[..]==ws;\r\n ensures IsWordSeq(ws);\r\n ensures |bs|>0 ==> |ws|>0;\r\n ensures |ws| == (|bs|+3)/4;\r\n ensures BEByteSeqToInt(bs) == BEWordSeqToInt(ws);\r\n ensures |BEWordSeqToByteSeq(ws)| >= |bs|;\r\n ensures padbytes == SequenceOfZeros(|ws|*4 - |bs|);\r\n ensures IsByteSeq(padbytes);\r\n ensures BEWordSeqToByteSeq(ws) == padbytes + bs;\r\n ensures (|bs|%4)==0 ==> BEWordSeqToByteSeq(ws) == bs;\r\n ensures fresh(wa);\r\n{\r\n if (ba.Length==0)\r\n {\r\n wa := new int[0];\r\n ws,padbytes := lemma_BEByteSeqToWordSeq_base_empty([]);\r\n }\r\n else\r\n {\r\n wa := new int[(ba.Length+3)/4];\r\n var ptr := ba.Length;\r\n var wptr := wa.Length;\r\n ws := wa[..wa.Length-wptr];\r\n var wv:int;\r\n ghost var prefix_bs;\r\n ghost var prefix_word;\r\n ghost var old_ws;\r\n ghost var old_ptr;\r\n\r\n assert |bs|==ptr;\r\n lemma_BEByteSeqToWordSeq_loop_invariants_initial(bs, ptr, ws);\r\n while (ptr > 4)\r\n invariant ptr <= |bs|;\r\n invariant BEByteSeqToWordSeq_loop_invariants(bs, ptr, ws);\r\n invariant wptr == (ptr+3)/4;\r\n invariant wa[wptr..] == ws;\r\n {\r\n prefix_bs := bs[ptr-4..ptr];\r\n wv,prefix_word,padbytes := BEByteSeqToWordSeq_base_arrays(ba, ptr-4, 4, prefix_bs);\r\n old_ws := ws;\r\n old_ptr := ptr;\r\n ws := prefix_word + ws;\r\n wptr := wptr - 1;\r\n wa[wptr] := wv;\r\n\r\n ghost var old_ptr2 := ptr;\r\n ptr := ptr - 4;\r\n\r\n lemma_BEByteSeqToWordSeq_iterative_loop(\r\n bs, prefix_bs, prefix_word, old_ptr2, old_ws, ptr, ws);\r\n }\r\n prefix_bs := bs[0..ptr];\r\n wv,prefix_word,padbytes := BEByteSeqToWordSeq_base_arrays(ba, 0, ptr, prefix_bs);\r\n if (ptr>0)\r\n {\r\n old_ws := ws;\r\n\r\n wa[0] := wv;\r\n ws := wa[..wa.Length];\r\n assert wv == prefix_word[0]; //- OBSERVE\r\n \r\n forall (i | 0<=i) returns (bs:seq)\r\n requires IsWordSeq(ws);\r\n decreases |ws|;\r\n ensures IsByteSeq(bs);\r\n ensures |bs| == |ws|*4;\r\n ensures BEByteSeqToInt(bs) == BEWordSeqToInt(ws);\r\n ensures BEWordSeqToByteSeq(ws) == bs;\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_2toX();\r\n lemma_mul_basics_forall();\r\n\r\n if (|ws|==0) {\r\n bs := [];\r\n//- calc {\r\n//- BEByteSeqToInt(bs);\r\n//- 0;\r\n//- BEWordSeqToInt(ws);\r\n//- }\r\n } else if (|ws|==1) {\r\n var i := ws[0];\r\n bs := [ i / 16777216, (i / 65536) % 256, (i / 256) % 256, i % 256 ];\r\n\r\n calc {\r\n i;\r\n { lemma_fundamental_div_mod(i, 256); lemma_mul_is_commutative_forall(); }\r\n mul(div(i,256),256) + mod(i, 256);\r\n { lemma_fundamental_div_mod(div(i,256), 256); lemma_mul_is_commutative_forall(); }\r\n mul(mul(div(div(i,256),256),256) + mod(div(i,256),256),256) + mod(i, 256);\r\n { lemma_div_denominator_forall(); }\r\n mul(mul(div(i,mul(256,256)),256) + mod(div(i,256),256),256) + mod(i, 256);\r\n { lemma_mul_is_mul_boogie(256, 256); }\r\n mul(mul(div(i,65536),256) + mod(div(i,256),256),256) + mod(i, 256);\r\n { lemma_fundamental_div_mod(div(i,65536), 256); lemma_mul_is_commutative_forall(); }\r\n mul(mul(mul(div(div(i,65536),256),256) + mod(div(i,65536),256),256) + mod(div(i,256),256),256) + mod(i, 256);\r\n { lemma_div_denominator_forall(); }\r\n mul(mul(mul(div(i,mul(65536,256)),256) + mod(div(i,65536),256),256) + mod(div(i,256),256),256) + mod(i, 256);\r\n { lemma_mul_is_mul_boogie(65536, 256); }\r\n mul(mul(mul(div(i,16777216),256) + mod(div(i,65536),256),256) + mod(div(i,256),256),256) + mod(i, 256);\r\n mul(mul(mul(div(i,16777216),power2(8)) + mod(div(i,65536),256),power2(8)) + mod(div(i,256),256),power2(8)) + mod(i, 256);\r\n mul(mul(mul(i/16777216,power2(8)) + mod(i/65536,256),power2(8)) + mod(i/256,256),power2(8)) + mod(i, 256);\r\n mul(mul(mul(i/16777216,power2(8)) + (i/65536)%256,power2(8)) + (i/256)%256,power2(8)) + i%256;\r\n }\r\n\r\n calc {\r\n BEByteSeqToInt(bs);\r\n { lemma_BEByteSeqToInt_unpack_four(bs, []); }\r\n BEByteSeqToInt([])*power2(32)\r\n + (((bs[|bs|-4])*power2(8) + bs[|bs|-3])*power2(8) + bs[|bs|-2])*power2(8) + bs[|bs|-1];\r\n (((bs[0])*power2(8) + bs[1])*power2(8) + bs[2])*power2(8) + bs[3];\r\n mul(mul(mul(bs[0],power2(8)) + bs[1],power2(8)) + bs[2],power2(8)) + bs[3];\r\n mul(mul(mul(i/16777216,power2(8)) + (i/65536)%256,power2(8)) + (i/256)%256,power2(8)) + i%256;\r\n i;\r\n BEDigitSeqToInt(power2(32), ws[0..0])*power2(32) + ws[0];\r\n BEWordSeqToInt(ws);\r\n }\r\n } else {\r\n var prefix_words := ws[0..|ws|-1];\r\n var suffix_words := ws[|ws|-1..];\r\n var prefix_bytes := BEWordSeqToByteSeq_impl(prefix_words);\r\n var suffix_bytes := BEWordSeqToByteSeq_impl(suffix_words);\r\n bs := prefix_bytes + suffix_bytes;\r\n\r\n calc {\r\n BEByteSeqToInt(bs);\r\n { lemma_BEByteSeqToInt_strip_four(bs, prefix_bytes, suffix_bytes); }\r\n BEByteSeqToInt(prefix_bytes) * power2(32) + BEByteSeqToInt(suffix_bytes);\r\n BEWordSeqToInt(prefix_words) * power2(32) + BEWordSeqToInt(suffix_words);\r\n BEWordSeqToInt(prefix_words) * power2(32) + (BEDigitSeqToInt(power2(32), suffix_words[0..0])*power2(32) + suffix_words[0]);\r\n BEDigitSeqToInt(power2(32), ws[0..|ws|-1])*power2(32) + ws[|ws|-1];\r\n BEWordSeqToInt(ws);\r\n }\r\n }\r\n lemma_BEIntToByteSeq_BEWordSeqToInt(bs, ws);\r\n}\r\n\r\nstatic predicate BEWordSeqToByteSeq_iterative_loop_invariant(ws:seq, bs:seq, ptr:int)\r\n requires IsWordSeq(ws);\r\n{\r\n 0 <= ptr <= |ws|\r\n && IsByteSeq(bs)\r\n && |bs| == mul(|ws[ptr..]|,4)\r\n && BEByteSeqToInt(bs) == BEWordSeqToInt(ws[ptr..])\r\n}\r\n\r\nstatic function method SplitOneWord(i:int) : seq\r\n requires Word32(i);\r\n{\r\n [ i / 16777216, (i / 65536) % 256, (i / 256) % 256, i % 256 ]\r\n}\r\n\r\nstatic lemma lemma_BEWordSeqToByteSeq_iterative_loop(ws:seq, bs:seq, ptr:int, bs':seq, ptr':int)\r\n requires IsWordSeq(ws);\r\n requires BEWordSeqToByteSeq_iterative_loop_invariant(ws, bs, ptr);\r\n requires ptr > 0;\r\n requires ptr' == ptr - 1;\r\n requires bs' == SplitOneWord(ws[ptr']) + bs;\r\n ensures BEWordSeqToByteSeq_iterative_loop_invariant(ws, bs', ptr');\r\n{\r\n lemma_2toX();\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_mul_basics_forall();\r\n\r\n var i := ws[ptr'];\r\n var newbytes := SplitOneWord(ws[ptr']);\r\n\r\n\r\n calc {\r\n i;\r\n { lemma_fundamental_div_mod(i, 256); lemma_mul_is_commutative_forall(); }\r\n mul(div(i,256),256) + mod(i, 256);\r\n { lemma_fundamental_div_mod(div(i,256), 256); lemma_mul_is_commutative_forall(); }\r\n mul(mul(div(div(i,256),256),256) + mod(div(i,256),256),256) + mod(i, 256);\r\n { lemma_div_denominator_forall(); }\r\n mul(mul(div(i,mul(256,256)),256) + mod(div(i,256),256),256) + mod(i, 256);\r\n { lemma_mul_is_mul_boogie(256, 256); }\r\n mul(mul(div(i,65536),256) + mod(div(i,256),256),256) + mod(i, 256);\r\n { lemma_fundamental_div_mod(div(i,65536), 256); lemma_mul_is_commutative_forall(); }\r\n mul(mul(mul(div(div(i,65536),256),256) + mod(div(i,65536),256),256) + mod(div(i,256),256),256) + mod(i, 256);\r\n { lemma_div_denominator_forall(); }\r\n mul(mul(mul(div(i,mul(65536,256)),256) + mod(div(i,65536),256),256) + mod(div(i,256),256),256) + mod(i, 256);\r\n { lemma_mul_is_mul_boogie(65536, 256); }\r\n mul(mul(mul(div(i,16777216),256) + mod(div(i,65536),256),256) + mod(div(i,256),256),256) + mod(i, 256);\r\n mul(mul(mul(div(i,16777216),power2(8)) + mod(div(i,65536),256),power2(8)) + mod(div(i,256),256),power2(8)) + mod(i, 256);\r\n mul(mul(mul(i/16777216,power2(8)) + mod(i/65536,256),power2(8)) + mod(i/256,256),power2(8)) + mod(i, 256);\r\n mul(mul(mul(i/16777216,power2(8)) + (i/65536)%256,power2(8)) + (i/256)%256,power2(8)) + i%256;\r\n }\r\n\r\n var nbs := newbytes;\r\n var ows := ws[ptr..];\r\n var nws := [ws[ptr']];\r\n calc {\r\n BEByteSeqToInt(nbs);\r\n { lemma_BEByteSeqToInt_unpack_four(nbs, []); }\r\n BEByteSeqToInt([])*power2(32)\r\n + (((nbs[|nbs|-4])*power2(8) + nbs[|nbs|-3])*power2(8) + nbs[|nbs|-2])*power2(8) + nbs[|nbs|-1];\r\n (((nbs[0])*power2(8) + nbs[1])*power2(8) + nbs[2])*power2(8) + nbs[3];\r\n mul(mul(mul(nbs[0],power2(8)) + nbs[1],power2(8)) + nbs[2],power2(8)) + nbs[3];\r\n mul(mul(mul(i/16777216,power2(8)) + (i/65536)%256,power2(8)) + (i/256)%256,power2(8)) + i%256;\r\n i;\r\n BEDigitSeqToInt(power2(32), nws[0..0])*power2(32) + nws[0];\r\n BEWordSeqToInt(nws);\r\n }\r\n\r\n calc {\r\n |bs'|;\r\n |bs| + 4;\r\n mul(|ws[ptr..]|,4) + 4;\r\n mul(|ws[ptr'..]|-1,4) + 4;\r\n { lemma_mul_is_distributive_forall(); }\r\n mul(|ws[ptr'..]|,4)+ mul(-1,4) + 4;\r\n { lemma_mul_is_mul_boogie(-1,4); }\r\n mul(|ws[ptr'..]|,4);\r\n }\r\n calc {\r\n BEByteSeqToInt(bs');\r\n BEByteSeqToInt(newbytes+bs);\r\n {\r\n lemma_mul_is_mul_boogie(|ows|,4);\r\n lemma_BEByteSeqToInt_BEWordSeqToInt_concatenation(\r\n newbytes, bs, nws, ows);\r\n }\r\n BEWordSeqToInt(nws+ows);\r\n BEWordSeqToInt([ws[ptr']] + ws[ptr..]);\r\n { assert [ws[ptr']] + ws[ptr..] == ws[ptr'..]; }\r\n BEWordSeqToInt(ws[ptr'..]);\r\n }\r\n}\r\n\r\nstatic method BEWordSeqToByteSeq_impl(ws:seq) returns (bs:seq)\r\n requires IsWordSeq(ws);\r\n decreases |ws|;\r\n ensures IsByteSeq(bs);\r\n ensures |bs| == |ws|*4;\r\n ensures BEByteSeqToInt(bs) == BEWordSeqToInt(ws);\r\n ensures BEWordSeqToByteSeq(ws) == bs;\r\n ensures BEByteSeqToWordSeq(bs) == ws;\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_mul_basics_forall();\r\n lemma_power2_increases(8,32);\r\n lemma_2toX();\r\n\r\n if (|ws|==0)\r\n {\r\n bs := [];\r\n assert BEByteSeqToInt(bs) == BEWordSeqToInt(ws);\r\n assert |bs| == |ws|*4;\r\n }\r\n else\r\n {\r\n bs := [];\r\n ghost var old_bs;\r\n ghost var old_ptr;\r\n var ptr := |ws|;\r\n calc {\r\n |bs|;\r\n 0;\r\n { lemma_mul_basics_forall(); }\r\n |ws[ptr..]|*4;\r\n }\r\n while (ptr > 0)\r\n invariant BEWordSeqToByteSeq_iterative_loop_invariant(ws, bs, ptr);\r\n {\r\n old_bs := bs;\r\n old_ptr := ptr;\r\n\r\n ptr := ptr - 1;\r\n var i := ws[ptr];\r\n bs := SplitOneWord(ws[ptr]) + bs;\r\n\r\n lemma_BEWordSeqToByteSeq_iterative_loop(ws, old_bs, old_ptr, bs, ptr);\r\n }\r\n assert ptr==0;\r\n assert ws == ws[0..];\r\n assert ws == ws[0..];\r\n assert BEByteSeqToInt(bs) == BEWordSeqToInt(ws);\r\n }\r\n lemma_mul_is_mul_boogie(|ws|,4);\r\n assert |bs| == |ws|*4;\r\n lemma_BEIntToByteSeq_BEWordSeqToInt(bs, ws);\r\n lemma_WordsBytesEquivalence(bs, ws);\r\n}\r\n\r\n//-lemma lemma_NSeqIntConcatMultiplePreservesIsDigitSeq(place_value:int, seqs:seq>)\r\n//- requires forall i :: 0 <= i < |seqs| ==> IsDigitSeq(place_value, seqs[i]);\r\n//- ensures IsDigitSeq(place_value, NSeqIntConcatMultiple(seqs));\r\n//- decreases |seqs|;\r\n//-{\r\n//- reveal_NSeqIntConcatMultiple();\r\n//- if |seqs| > 0 {\r\n//- lemma_NSeqIntConcatMultiplePreservesIsDigitSeq(place_value, seqs[1..]);\r\n//- lemma_concat_preserves_IsDigitSeq(place_value, seqs[0], NSeqIntConcatMultiple(seqs[1..]));\r\n//- }\r\n//-}\r\n\r\nstatic lemma lemma_concat_preserves_IsDigitSeq(place_value:int, x:seq, y:seq)\r\n requires IsDigitSeq(place_value, x);\r\n requires IsDigitSeq(place_value, y);\r\n ensures IsDigitSeq(place_value, x + y);\r\n{\r\n}\r\n\r\nstatic lemma lemma_BEByteSeqToBitSeq_selection(bs:seq, len:int)\r\n requires IsByteSeq(bs);\r\n requires 0 <= len <= |bs|;\r\n ensures |BEByteSeqToBitSeq(bs)| >= len*8;\r\n ensures BEByteSeqToBitSeq(bs)[..len*8] == BEByteSeqToBitSeq(bs[..len]);\r\n{\r\n lemma_BEByteSeqToBitSeq_ensures(bs);\r\n calc {\r\n |BEByteSeqToBitSeq(bs)[..len*8]|;\r\n len*8;\r\n { lemma_BEByteSeqToBitSeq_ensures(bs[..len]); }\r\n |BEByteSeqToBitSeq(bs[..len])|;\r\n }\r\n forall (i | 0<=i<|BEByteSeqToBitSeq(bs)[..len*8]|)\r\n ensures BEByteSeqToBitSeq(bs)[..len*8][i] == BEByteSeqToBitSeq(bs[..len])[i];\r\n {\r\n lemma_mul_is_mul_boogie(1,8);\r\n var headbs := bs[..len];\r\n var tailbs := bs[len..];\r\n\r\n calc {\r\n BEByteSeqToBitSeq(headbs) + BEByteSeqToBitSeq(tailbs);\r\n BEIntToDigitSeq(power2(1), |headbs|*8, BEDigitSeqToInt(power2(8), headbs))\r\n + BEIntToDigitSeq(power2(1), |tailbs|*8, BEDigitSeqToInt(power2(8), tailbs));\r\n {\r\n lemma_SeqTransformChop(bs, headbs, tailbs, 1, 8, 8);\r\n lemma_mul_is_mul_boogie(|headbs|,8);\r\n lemma_mul_is_mul_boogie(|tailbs|,8);\r\n lemma_mul_is_mul_boogie(|bs|,8);\r\n }\r\n BEIntToDigitSeq(power2(1), |bs|*8, BEDigitSeqToInt(power2(8), bs));\r\n BEByteSeqToBitSeq(bs);\r\n }\r\n calc {\r\n BEByteSeqToBitSeq(bs)[..len*8][i];\r\n BEByteSeqToBitSeq(bs)[i];\r\n BEByteSeqToBitSeq(headbs)[i];\r\n BEByteSeqToBitSeq(bs[..len])[i];\r\n }\r\n }\r\n}\r\n\r\nstatic method BEWordToFourBytes_impl(x:int) returns (bytes:seq)\r\n requires Word32(x);\r\n ensures bytes == BEWordToFourBytes(x);\r\n ensures IsByteSeq(bytes);\r\n ensures |bytes| == 4;\r\n ensures BEByteSeqToInt(bytes) == x;\r\n{\r\n bytes := BEWordSeqToByteSeq_impl([x]);\r\n calc {\r\n x;\r\n { lemma_mul_basics_forall(); }\r\n mul(0,power2(32)) + [x][|[x]|-1];\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEDigitSeqToInt_private(power2(32), [])*power2(32)+ [x][|[x]|-1];\r\n { assert [] == [x][0..|[x]|-1]; }\r\n BEDigitSeqToInt_private(power2(32), [x][0..|[x]|-1])*power2(32)+ [x][|[x]|-1];\r\n { reveal_BEDigitSeqToInt_private(); }\r\n BEDigitSeqToInt_private(power2(32), [x]);\r\n BEDigitSeqToInt(power2(32), [x]);\r\n BEDigitSeqToInt(power2(8), bytes);\r\n }\r\n\r\n lemma_2toX();\r\n lemma_BEDigitSeqToInt_invertibility(power2(8), x, bytes);\r\n}\r\n\r\nstatic lemma lemma_BEWordToFourBytesUnique(a:int, b:int)\r\n requires Word32(a);\r\n requires Word32(b);\r\n requires BEWordToFourBytes(a) == BEWordToFourBytes(b);\r\n ensures a == b;\r\n{\r\n lemma_2toX();\r\n calc {\r\n power(power2(8), 4);\r\n { lemma_power2_is_power_2(8); }\r\n power(power(2, 8), 4);\r\n { lemma_power_multiplies(2,8,4); }\r\n power(2, mul(8, 4));\r\n { lemma_mul_is_mul_boogie(8,4); }\r\n power(2, 32);\r\n { lemma_power2_is_power_2(32); }\r\n power2(32);\r\n }\r\n assert power(power2(8), 4) == power2(32);\r\n lemma_BEIntToDigitSeq_private_properties(power2(8), 4, a);\r\n lemma_BEIntToDigitSeq_private_properties(power2(8), 4, b);\r\n lemma_BEIntToDigitSeq_invertibility(power2(8), a, BEWordToFourBytes(a));\r\n lemma_BEIntToDigitSeq_invertibility(power2(8), b, BEWordToFourBytes(b));\r\n}\r\n\r\nstatic lemma lemma_BEWordToFourBytes_literal(x:int)\r\n requires 0<=x, n:int)\r\n requires 0 < n <= |s|;\r\n ensures s[0..n][0..n-1] == s[0..n-1];\r\n{\r\n assert |s[0..n][0..n-1]| == n-1;\r\n forall i | 0 <= i < n - 1\r\n ensures s[0..n][0..n-1][i] == s[0..n-1][i];\r\n {\r\n calc {\r\n s[0..n][0..n-1][i];\r\n s[0..n][i];\r\n s[0..n-1][i];\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEFourBytesToWordIsWord(bs:seq)\r\n requires IsByteSeqOfLen(bs, 4);\r\n ensures Word32(BEByteSeqToInt(bs));\r\n{\r\n lemma_BEByteSeqToInt_bound(bs);\r\n calc {\r\n BEByteSeqToInt(bs);\r\n < power2(8*|bs|);\r\n <= power2(8*4);\r\n == power2(32);\r\n }\r\n}\r\n\r\nstatic method BEFourBytesToWord_impl(bs:seq) returns (ret:int)\r\n requires IsByteSeqOfLen(bs, 4);\r\n ensures ret == BEByteSeqToInt(bs);\r\n ensures Word32(ret);\r\n{\r\n var ws, padbytes := BEByteSeqToWordSeq_impl(bs);\r\n ret := ws[0];\r\n reveal_BEDigitSeqToInt_private();\r\n calc {\r\n BEWordSeqToInt(ws);\r\n BEDigitSeqToInt_private(power2(32), ws[0..|ws|-1])*power2(32) + ws[0];\r\n { assert |ws|==1; assert ws[0..|ws|-1] == ws[0..0] == []; }\r\n BEDigitSeqToInt_private(power2(32), [])*power2(32) + ws[0];\r\n { lemma_mul_is_mul_boogie(0, power2(32)); }\r\n 0*power2(32) + ws[0];\r\n }\r\n lemma_BEFourBytesToWordIsWord(bs);\r\n}\r\n\r\nstatic lemma lemma_ValueOfFourByteSeq(s:seq)\r\n requires IsByteSeqOfLen(s, 4);\r\n ensures BEByteSeqToInt(s) == 0x1000000 * s[0] + 0x10000 * s[1] + 0x100 * s[2] + s[3];\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n\r\n calc {\r\n BEByteSeqToInt(s);\r\n BEDigitSeqToInt_private(power2(8), s);\r\n BEDigitSeqToInt_private(power2(8), s[0..3])*power2(8) + s[3];\r\n { lemma_AllButLastOfPrefixIsPrefix(s, 3); }\r\n (BEDigitSeqToInt_private(power2(8), s[0..2])*power2(8) + s[2])*power2(8) + s[3];\r\n { lemma_AllButLastOfPrefixIsPrefix(s, 2); }\r\n ((BEDigitSeqToInt_private(power2(8), s[0..1])*power2(8) + s[1])*power2(8) + s[2])*power2(8) + s[3];\r\n { lemma_AllButLastOfPrefixIsPrefix(s, 1); }\r\n (((BEDigitSeqToInt_private(power2(8), s[0..0])*power2(8) + s[0])*power2(8) + s[1])*power2(8) + s[2])*power2(8) + s[3];\r\n (((BEDigitSeqToInt_private(power2(8), [])*power2(8) + s[0])*power2(8) + s[1])*power2(8) + s[2])*power2(8) + s[3];\r\n { lemma_mul_is_mul_boogie(0, power2(8)); }\r\n (((0*power2(8) + s[0])*power2(8) + s[1])*power2(8) + s[2])*power2(8) + s[3];\r\n ((s[0]*power2(8) + s[1])*power2(8) + s[2])*power2(8) + s[3];\r\n { lemma_mul_is_commutative_forall(); }\r\n power2(8)*(power2(8)*(power2(8)*s[0] + s[1]) + s[2]) + s[3];\r\n { lemma_mul_is_distributive_add(power2(8), power2(8)*s[0], s[1]); }\r\n power2(8)*(power2(8)*(power2(8)*s[0]) + power2(8)*s[1] + s[2]) + s[3];\r\n { lemma_mul_is_distributive_add(power2(8), power2(8)*(power2(8)*s[0]) + power2(8)*s[1], s[2]); }\r\n power2(8)*(power2(8)*(power2(8)*s[0]) + power2(8)*s[1]) + power2(8)*s[2] + s[3];\r\n { lemma_mul_is_distributive_add(power2(8), power2(8)*(power2(8)*s[0]), power2(8)*s[1]); }\r\n power2(8)*(power2(8)*(power2(8)*s[0])) + power2(8)*(power2(8)*s[1]) + power2(8)*s[2] + s[3];\r\n { lemma_mul_is_associative_forall(); }\r\n power2(8)*power2(8)*power2(8)*s[0] + power2(8)*power2(8)*s[1] + power2(8)*s[2] + s[3];\r\n { lemma_power2_adds(8, 8); }\r\n power2(16)*power2(8)*s[0] + power2(16)*s[1] + power2(8)*s[2] + s[3];\r\n { lemma_power2_adds(16, 8); }\r\n power2(24)*s[0] + power2(16)*s[1] + power2(8)*s[2] + s[3];\r\n { lemma_2to32();\r\n lemma_mul_is_mul_boogie(0x1000000, s[0]);\r\n lemma_mul_is_mul_boogie(0x10000, s[1]);\r\n lemma_mul_is_mul_boogie(0x100, s[2]); }\r\n 0x1000000 * s[0] + 0x10000 * s[1] + 0x100 * s[2] + s[3];\r\n }\r\n}\r\n\r\nstatic lemma lemma_ValueOfFourByteSeqSpecific(s:seq, n:int)\r\n requires IsByteSeqOfLen(s, 4);\r\n requires n == 0x1000000 * s[0] + 0x10000 * s[1] + 0x100 * s[2] + s[3];\r\n ensures BEByteSeqToInt(s) == n;\r\n{\r\n lemma_ValueOfFourByteSeq(s);\r\n}\r\n\r\n\r\nstatic lemma lemma_BEIntToDigitSeqProducesRightSizedDigits(place_value:int, min_places:int, v:int)\r\n requires 1) : seq\r\n requires IsByteSeq(bs);\r\n requires |bs|%4==0;\r\n//- ensures IsWordSeq(BEByteSeqToWordSeq(bs));\r\n//- ensures BEWordSeqToByteSeq(BEByteSeqToWordSeq(bs)) == bs;\r\n{\r\n BEIntToDigitSeq(power2(32), |bs|/4, BEDigitSeqToInt(power2(8), bs))\r\n}\r\n\r\nstatic function TailPad4(bs:seq) : seq\r\n{\r\n bs+RepeatDigit(0, ((|bs|+3)/4)*4-|bs|)\r\n}\r\n\r\nstatic lemma lemma_BEByteSeqToWordSeqTailPadding_constructive_form(ws:seq, bs:seq, pad_len:nat)\r\n requires IsWordSeq(ws);\r\n requires IsByteSeq(bs);\r\n requires |ws| == (|bs| + 3) / 4;\r\n requires pad_len == ((|bs|+3)/4)*4-|bs|;\r\n requires BEWordSeqToByteSeq(ws) == bs + RepeatDigit(0, pad_len);\r\n ensures IsByteSeq(TailPad4(bs));\r\n ensures |TailPad4(bs)|%4 == 0;\r\n ensures ws == BEByteSeqToWordSeq(TailPad4(bs));\r\n{\r\n lemma_2toX();\r\n\r\n assert TailPad4(bs) == bs+RepeatDigit_premium(0, ((|bs|+3)/4)*4-|bs|); //- OBSERVE\r\n\r\n var padsize := |TailPad4(bs)| - |bs|;\r\n var wx := BEWordSeqToInt(ws);\r\n var bx := BEByteSeqToInt(TailPad4(bs));\r\n var L8 := 8;\r\n\r\n lemma_mul_nonnegative(L8, |TailPad4(bs)|);\r\n lemma_BEDigitSeqToInt_bound(power2(8), TailPad4(bs));\r\n assert 0 <= bx;\r\n calc {\r\n bx;\r\n BEDigitSeqToInt(power2(8), TailPad4(bs));\r\n <\r\n power(power2(8), |TailPad4(bs)|);\r\n { lemma_power2_is_power_2(8); }\r\n power(power(2,8), |TailPad4(bs)|);\r\n { lemma_power_multiplies(2,8,|TailPad4(bs)|); }\r\n power(2,L8*|TailPad4(bs)|);\r\n { lemma_power2_is_power_2(L8*|TailPad4(bs)|); }\r\n power2(L8*|TailPad4(bs)|);\r\n }\r\n assert bx < power2(L8*|TailPad4(bs)|);\r\n lemma_BEIntToDigitSeq_private_chop(8, |TailPad4(bs)|, padsize, bx);\r\n lemma_mul_nonnegative(L8, padsize);\r\n assert BEIntToDigitSeq_private(power2(8), |bs|, bx/power2(L8*padsize))\r\n + BEIntToDigitSeq_private(power2(8), padsize, bx%power2(L8*padsize))\r\n == BEIntToDigitSeq_private(power2(8), |TailPad4(bs)|, bx);\r\n\r\n calc {\r\n wx;\r\n BEWordSeqToInt(ws);\r\n { lemma_BEWordSeqToInt_BEIntToByteSeq(BEWordSeqToByteSeq(ws), ws); }\r\n BEByteSeqToInt(BEWordSeqToByteSeq(ws));\r\n BEByteSeqToInt(bs + RepeatDigit(0, pad_len));\r\n BEByteSeqToInt(TailPad4(bs));\r\n bx;\r\n }\r\n\r\n assert wx == bx;\r\n\r\n calc {\r\n ws;\r\n { lemma_BEDigitSeqToInt_invertibility(power2(32), wx, ws); }\r\n BEIntToDigitSeq(power2(32), |ws|, wx);\r\n BEIntToDigitSeq(power2(32), |ws|, bx);\r\n { assert |ws| == |TailPad4(bs)|/4; }\r\n BEIntToDigitSeq(power2(32), |TailPad4(bs)|/4, bx);\r\n BEIntToDigitSeq(power2(32), |TailPad4(bs)|/4, BEDigitSeqToInt(power2(8), TailPad4(bs)));\r\n BEByteSeqToWordSeq(TailPad4(bs));\r\n }\r\n}\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n//\r\n\r\n\r\n//\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nstatic lemma lemma_BEByteSeqToWordSeqTailPadding_bit_equivalence(bs:seq, ws:seq, padded_bs:seq, padding:seq, ghost_padding:seq)\r\n requires IsByteSeq(bs);\r\n requires IsWordSeq(ws);\r\n requires IsByteSeq(padded_bs);\r\n requires IsByteSeq(padding);\r\n requires padded_bs == bs + padding;\r\n requires ghost_padding + padded_bs == BEWordSeqToByteSeq(ws);\r\n requires ghost_padding == [];\r\n ensures |bs|*8 <= |BEWordSeqToBitSeq(ws)|;\r\n ensures BEByteSeqToBitSeq(bs) == BEWordSeqToBitSeq(ws)[..|bs|*8];\r\n{\r\n var padding_len := |padding|;\r\n calc {\r\n BEWordSeqToBitSeq(ws);\r\n { lemma_BEByteSeqToBitSeq_BEWordSeqToByteSeq(ws); }\r\n BEByteSeqToBitSeq(BEWordSeqToByteSeq(ws));\r\n BEByteSeqToBitSeq(ghost_padding + padded_bs);\r\n { assert ghost_padding + padded_bs == padded_bs; /* OBSERVE */ }\r\n BEByteSeqToBitSeq(padded_bs);\r\n }\r\n\r\n calc {\r\n |BEWordSeqToBitSeq(ws)|;\r\n { lemma_BEWordSeqToBitSeq_ensures(ws); }\r\n 32*|ws|;\r\n 8*(4*|ws|);\r\n { lemma_BEWordSeqToByteSeq_ensures(ws); }\r\n 8*(|BEWordSeqToByteSeq(ws)|);\r\n 8*(|ghost_padding|+|padded_bs|);\r\n 8*|padded_bs|;\r\n >=\r\n 8*|bs|;\r\n }\r\n\r\n var head := padded_bs[..|padded_bs|-padding_len];\r\n var tail := padded_bs[|padded_bs|-padding_len..];\r\n calc {\r\n BEByteSeqToBitSeq(bs);\r\n BEByteSeqToBitSeq(padded_bs[..|padded_bs|-padding_len]);\r\n BEByteSeqToBitSeq(head);\r\n BEByteSeqToBitSeq(head)[..|BEByteSeqToBitSeq(head)|];\r\n (BEByteSeqToBitSeq(head) + BEByteSeqToBitSeq(tail))[..|BEByteSeqToBitSeq(head)|];\r\n {\r\n assert padded_bs == head + tail;\r\n calc {\r\n BEByteSeqToBitSeq(head) + BEByteSeqToBitSeq(tail);\r\n { lemma_mul_is_mul_boogie(|head|,8); }\r\n { lemma_mul_is_mul_boogie(|tail|,8); }\r\n BEIntToDigitSeq(power2(1), mul(|head|,8), BEDigitSeqToInt(power2(8), head))\r\n + BEIntToDigitSeq(power2(1), mul(|tail|,8), BEDigitSeqToInt(power2(8), tail));\r\n {\r\n lemma_mul_basics_forall();\r\n lemma_SeqTransformChop(padded_bs, head, tail, 1, 8, 8);\r\n }\r\n BEIntToDigitSeq(power2(1), mul(|padded_bs|,8), BEDigitSeqToInt(power2(8), padded_bs));\r\n { lemma_mul_is_mul_boogie(|padded_bs|,8); }\r\n BEByteSeqToBitSeq(padded_bs);\r\n }\r\n }\r\n BEByteSeqToBitSeq(padded_bs)[..|BEByteSeqToBitSeq(head)|];\r\n { lemma_BEByteSeqToBitSeq_ensures(head); }\r\n BEByteSeqToBitSeq(padded_bs)[..|head|*8];\r\n BEByteSeqToBitSeq(padded_bs)[..|bs|*8];\r\n BEWordSeqToBitSeq(ws)[..|bs|*8];\r\n }\r\n}\r\n\r\nstatic lemma lemma_BEByteSeqToWordSeqTailPadding_more(\r\n bs:seq, ws_len:int, padding_len:int, padding:seq, padded_bs:seq, ws:seq, ghost_padding:seq)\r\n requires IsByteSeq(bs);\r\n requires ws_len == (|bs|-1)/4+1;\r\n requires padding_len == ws_len*4 - |bs|;\r\n requires padding == RepeatDigit_premium(0, padding_len);\r\n requires IsWordSeq(bs);\r\n requires IsByteSeq(padded_bs);\r\n requires padded_bs == bs + padding;\r\n requires IsWordSeq(ws);\r\n requires |padded_bs|>0 ==> |ws|>0;\r\n requires |ws| == (|padded_bs|+3)/4;\r\n requires BEByteSeqToInt(padded_bs) == BEWordSeqToInt(ws);\r\n requires |BEWordSeqToByteSeq(ws)| >= |padded_bs|;\r\n requires ghost_padding == SequenceOfZeros(|ws|*4 - |padded_bs|);\r\n requires IsByteSeq(ghost_padding);\r\n requires BEWordSeqToByteSeq(ws) == ghost_padding + padded_bs;\r\n requires (|padded_bs|%4)==0 ==> BEWordSeqToByteSeq(ws) == padded_bs;\r\n\r\n ensures ghost_padding==[];\r\n ensures |padded_bs|%4 == 0;\r\n ensures BEWordSeqToByteSeq(ws) == padded_bs;\r\n{\r\n calc {\r\n |ghost_padding|;\r\n |SequenceOfZeros(|ws|*4 - |padded_bs|)|;\r\n |ws|*4 - |padded_bs|;\r\n ((|padded_bs|+3)/4)*4 - |padded_bs|;\r\n 0;\r\n }\r\n assert ghost_padding == [];\r\n\r\n calc {\r\n |padded_bs|%4;\r\n |bs + padding|%4;\r\n (|bs| + |padding|)%4;\r\n (|bs| + padding_len)%4;\r\n (|bs| + ws_len*4 - |bs|)%4;\r\n (ws_len*4)%4;\r\n 0;\r\n }\r\n assert BEWordSeqToByteSeq(ws) == padded_bs;\r\n\r\n calc {\r\n BEWordSeqToByteSeq(ws);\r\n ghost_padding + padded_bs;\r\n padded_bs;\r\n bs + padding;\r\n { lemma_SequenceOfZeros_is_RepeatDigit(padding_len); }\r\n bs + RepeatDigit(0, padding_len);\r\n }\r\n}\r\n\r\nstatic method BEByteSeqToWordSeqTailPadding(bs:seq) returns (ws:seq)\r\n requires IsByteSeq(bs);\r\n ensures IsWordSeq(ws);\r\n ensures |bs| > 0 ==> |ws| > 0;\r\n ensures |ws| == (|bs| + 3) / 4;\r\n ensures |bs|*8 <= |BEWordSeqToBitSeq(ws)|;\r\n ensures BEByteSeqToBitSeq(bs) == BEWordSeqToBitSeq(ws)[..|bs|*8];\r\n ensures IsByteSeq(TailPad4(bs));\r\n ensures |TailPad4(bs)|%4==0;\r\n ensures ws == BEByteSeqToWordSeq(TailPad4(bs));\r\n{\r\n lemma_2toX();\r\n var ws_len := (|bs|-1)/4+1;\r\n var padding_len := ws_len*4 - |bs|;\r\n var padding := SequenceOfZerosIterative(padding_len);\r\n var padded_bs := bs + padding;\r\n ghost var ghost_padding;\r\n ws,ghost_padding := BEByteSeqToWordSeq_impl(padded_bs);\r\n\r\n lemma_SequenceOfZeros_is_RepeatDigit(padding_len);\r\n lemma_BEByteSeqToWordSeqTailPadding_more(bs, ws_len, padding_len, padding, padded_bs, ws, ghost_padding);\r\n lemma_BEByteSeqToWordSeqTailPadding_bit_equivalence(bs, ws, padded_bs, padding, ghost_padding);\r\n lemma_BEByteSeqToWordSeqTailPadding_constructive_form(ws, bs, padding_len);\r\n}\r\n\r\nstatic method BEByteSeqToWordSeqTailPadding_arrays(ba:array, ghost bs:seq) returns (wa:array, ghost ws:seq)\r\n requires ba!=null;\r\n requires ba[..]==bs;\r\n requires IsByteSeq(bs);\r\n ensures wa!=null;\r\n ensures wa[..]==ws;\r\n ensures IsWordSeq(ws);\r\n ensures |bs| > 0 ==> |ws| > 0;\r\n ensures |ws| == (|bs| + 3) / 4;\r\n ensures |bs|*8 <= |BEWordSeqToBitSeq(ws)|;\r\n ensures BEByteSeqToBitSeq(bs) == BEWordSeqToBitSeq(ws)[..|bs|*8];\r\n ensures IsByteSeq(TailPad4(bs));\r\n ensures |TailPad4(bs)|%4==0;\r\n ensures ws == BEByteSeqToWordSeq(TailPad4(bs));\r\n{\r\n lemma_2toX();\r\n var ws_len := (ba.Length-1)/4+1;\r\n var padding_len := ws_len*4 - ba.Length;\r\n\r\n ghost var padding := RepeatDigit_premium(0, padding_len);\r\n ghost var padded_bs := bs + padding;\r\n\r\n var padded_ba := new int[ba.Length + padding_len];\r\n ArrayCpy(padded_ba, 0, ba, 0, ba.Length);\r\n calc {\r\n padded_ba[..ba.Length];\r\n padded_ba[0..ba.Length];\r\n ba[0..ba.Length];\r\n ba[..];\r\n bs;\r\n }\r\n ghost var first_ba_seq := padded_ba[..];\r\n assert forall k :: 0<=k first_ba_seq[k] == ba[k];\r\n ArraySet(padded_ba, ba.Length, padding_len, 0);\r\n assert forall i :: 0<=i padded_ba[i]==first_ba_seq[i];\r\n\r\n Lemma_RepeatDigitProperties(0, padding_len);\r\n assert |padded_ba[ba.Length..]|==|RepeatDigit_premium(0, padding_len)|;\r\n assert padded_ba[ba.Length..]==RepeatDigit_premium(0, padding_len);\r\n \r\n ghost var ghost_padding;\r\n assert padded_ba.Length == |padded_ba[..]| == |padded_bs|;\r\n forall (k | 0<=k)\r\n requires IsWordSeq(ws);\r\n ensures IsBitSeq(BEWordSeqToBitSeq(ws));\r\n ensures BEBitSeqToInt(BEWordSeqToBitSeq(ws)) == BEWordSeqToInt(ws);\r\n{\r\n lemma_BEWordSeqToBitSeq_ensures(ws);\r\n calc {\r\n BEBitSeqToInt(BEWordSeqToBitSeq(ws));\r\n BEBitSeqToInt(BEIntToDigitSeq(power2(1), |ws|*32, BEDigitSeqToInt(power2(32), ws)));\r\n BEDigitSeqToInt(power2(1), BEIntToDigitSeq(power2(1), |ws|*32, BEDigitSeqToInt(power2(32), ws)));\r\n { reveal_power2();\r\n lemma_BEDigitSeqToInt_bound(power2(32), ws);\r\n lemma_BEIntToDigitSeq_invertibility(power2(1),\r\n BEDigitSeqToInt(power2(32), ws),\r\n BEIntToDigitSeq(power2(1), |ws|*32, BEDigitSeqToInt(power2(32), ws))); }\r\n BEDigitSeqToInt(power2(32), ws);\r\n BEWordSeqToInt(ws);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/Util/word_bits.i.dfy", "content": "include \"integer_sequences_premium.i.dfy\"\r\ninclude \"../../Drivers/CPU/assembly_premium.i.dfy\"\r\ninclude \"../Math/bit_vector_lemmas_premium.i.dfy\"\r\n\r\n\r\n//-------------------------------------------------------------------------\r\n\r\nstatic lemma lemma_LeftShiftOfOneProperties(e: int)\r\n requires 0 <= e < 32;\r\n ensures Word32(1) && Word32(e);\r\n ensures |BEWordToBitSeq(LeftShift(1, e))| == 32;\r\n ensures BEWordToBitSeq(LeftShift(1, e)) == SequenceOfZeros(31-e) + [1] + SequenceOfZeros(e);\r\n ensures forall i :: 0 <= i < 32 ==> BEWordToBitSeq(LeftShift(1, e))[i] == if i == 31 - e then 1 else 0;\r\n{\r\n lemma_2toX();\r\n reveal_power2();\r\n calc {\r\n BEWordToBitSeq(LeftShift(1, e));\r\n BEWordToBitSeq(Asm_LeftShift(1, e));\r\n { lemma_SequenceOfZerosIsRepeatDigitZero(e); }\r\n BEWordToBitSeq(1)[e..] + SequenceOfZeros(e);\r\n calc {\r\n BEWordToBitSeq(1);\r\n BEIntToDigitSeq(power2(1), 32, 1);\r\n {\r\n reveal_BEIntToDigitSeq_private();\r\n lemma_small_div();\r\n lemma_small_mod(1, 2);\r\n }\r\n BEIntToDigitSeq(power2(1), 31, 0) + [1];\r\n { lemma_BEIntToDigitSeq_private_zero(power2(1), 31); }\r\n SequenceOfZeros(31) + [1];\r\n }\r\n (SequenceOfZeros(31) + [1])[e..] + SequenceOfZeros(e);\r\n (SequenceOfZeros(e) + SequenceOfZeros(31-e) + [1])[e..] + SequenceOfZeros(e);\r\n SequenceOfZeros(31-e) + [1] + SequenceOfZeros(e);\r\n }\r\n\r\n forall i | 0 <= i < 32\r\n ensures BEWordToBitSeq(LeftShift(1, e))[i] == if i == 31 - e then 1 else 0;\r\n {\r\n if i < 31-e\r\n {\r\n calc {\r\n BEWordToBitSeq(LeftShift(1, e))[i];\r\n (SequenceOfZeros(31-e) + [1] + SequenceOfZeros(e))[i];\r\n (SequenceOfZeros(i+1) + SequenceOfZeros(31-e-i-1) + [1] + SequenceOfZeros(e))[i];\r\n 0; \r\n }\r\n }\r\n else if i > 31-e {\r\n calc {\r\n BEWordToBitSeq(LeftShift(1, e))[i];\r\n (SequenceOfZeros(31-e) + [1] + SequenceOfZeros(e))[i];\r\n (SequenceOfZeros(31-e) + [1] + SequenceOfZeros(i-(31-e)) + SequenceOfZeros(31-i))[i];\r\n 0; \r\n }\r\n }\r\n }\r\n}\r\n\r\nstatic lemma lemma_bits_of_power2(bs:seq, c:nat)\r\n requires bs == [1] + SequenceOfZeros(c);\r\n ensures IsBitSeq(bs);\r\n ensures BEBitSeqToInt(bs) == power2(c);\r\n decreases c;\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_power2_1_is_2();\r\n var L2 := 2;\r\n if (|bs|==1)\r\n {\r\n calc {\r\n BEBitSeqToInt(bs);\r\n BEDigitSeqToInt_private(power2(1), bs);\r\n BEDigitSeqToInt_private(power2(1), [])*L2 + 1;\r\n { lemma_mul_basics_forall(); }\r\n 1;\r\n { lemma_power2_0_is_1(); }\r\n power2(c);\r\n }\r\n }\r\n else\r\n {\r\n var sm := [1] + SequenceOfZeros(c-1);\r\n assert bs[0..|bs|-1] == sm;\r\n assert bs[|bs|-1] == 0;\r\n calc {\r\n BEBitSeqToInt(bs);\r\n BEDigitSeqToInt_private(power2(1), bs);\r\n BEDigitSeqToInt_private(power2(1), sm)*L2 + 0;\r\n { lemma_bits_of_power2(sm, c-1); }\r\n power2(c-1)*L2;\r\n { reveal_power2(); lemma_mul_is_mul_boogie(power2(c-1),L2); }\r\n power2(c);\r\n }\r\n \r\n }\r\n}\r\n\r\nstatic lemma lemma_ComputePower2_is_power2(e:int, p2:int)\r\n requires 0 <= e < 32;\r\n requires Word32(p2);\r\n requires BEWordToBitSeq(p2) == SequenceOfZeros(31-e) + [1] + SequenceOfZeros(e);\r\n ensures p2 == power2(e);\r\n{\r\n var normal_form := [1] + SequenceOfZeros(e);\r\n lemma_power2_1_is_2();\r\n var input_string := SequenceOfZeros(31-e) + normal_form;\r\n\r\n calc {\r\n p2;\r\n BEBitSeqToInt(BEWordToBitSeq_premium(p2));\r\n { assert input_string == SequenceOfZeros(31-e) + [1] + SequenceOfZeros(e); }\r\n BEBitSeqToInt(input_string);\r\n BEBitSeqToInt(SequenceOfZeros(31-e) + normal_form);\r\n { lemma_LeadingZeros(2, normal_form, SequenceOfZeros(31-e) + normal_form); }\r\n BEBitSeqToInt(normal_form);\r\n { lemma_bits_of_power2(normal_form, e); }\r\n power2(e);\r\n }\r\n}\r\n\r\nstatic function method ComputePower2(e:int) : int\r\n requires 0 <= e < 32;\r\n ensures Word32(1) && Word32(e);\r\n ensures |BEWordToBitSeq(ComputePower2(e))| == 32;\r\n ensures BEWordToBitSeq(ComputePower2(e)) == SequenceOfZeros(31-e) + [1] + SequenceOfZeros(e);\r\n ensures forall i :: 0 <= i < 32 ==> BEWordToBitSeq(ComputePower2(e))[i] == if i == 31 - e then 1 else 0;\r\n ensures ComputePower2(e) == power2(e);\r\n{\r\n lemma_LeftShiftOfOneProperties(e);\r\n lemma_ComputePower2_is_power2(e, Asm_LeftShift(1, e));\r\n Asm_LeftShift(1, e)\r\n}\r\n\r\n//-------------------------------------------------------------------------\r\n\r\n//-static function power2minus1_word(e:nat) : seq\r\n//- requires 0 <= e <= 32;\r\n//-{\r\n//- SequenceOfZeros(32-e) + RepeatDigit_premium(1, e)\r\n//-}\r\n//-\r\n//-static lemma lemma_bits_of_power2minus1_word(bs:seq, e:nat)\r\n//- requires 0 <= e < 32;\r\n//- ensures Word32(1) && Word32(e);\r\n//- ensures |BEWordToBitSeq(power2minus1_word(e))| == 32;\r\n//- ensures forall i :: 0 <= i < 32 ==> BEWordToBitSeq(power2minus1_word(e))[i] == if i < 32-e then 0 else 1;\r\n//-{\r\n//-}\r\n\r\nstatic lemma lemma_bits_of_power2minus1(bs:seq, c:nat)\r\n requires bs == RepeatDigit_premium(1, c);\r\n ensures IsBitSeq(bs);\r\n ensures BEBitSeqToInt(bs) == power2(c)-1;\r\n decreases c;\r\n{\r\n reveal_BEDigitSeqToInt_private();\r\n lemma_power2_0_is_1();\r\n lemma_power2_1_is_2();\r\n var L2 := 2;\r\n if (|bs|==0)\r\n {\r\n calc {\r\n BEBitSeqToInt(bs);\r\n BEDigitSeqToInt_private(power2(1), bs);\r\n 0;\r\n power2(c)-1;\r\n }\r\n }\r\n else\r\n {\r\n var sm := RepeatDigit(1, c-1);\r\n assert bs[0..|bs|-1] == sm;\r\n assert bs[|bs|-1] == 1;\r\n calc {\r\n BEBitSeqToInt(bs);\r\n BEDigitSeqToInt_private(power2(1), bs);\r\n BEDigitSeqToInt_private(power2(1), sm)*L2 + 1;\r\n { lemma_bits_of_power2minus1(sm, c-1); }\r\n (power2(c-1) - 1)*L2 + 1;\r\n { lemma_mul_is_mul_boogie(power2(c-1)-1,L2); }\r\n power2(c-1)*2 - 1;\r\n { reveal_power2(); }\r\n power2(c) - 1;\r\n }\r\n \r\n }\r\n}\r\n\r\nstatic lemma lemma_ComputePower2Minus1(e:int, p2m1:int)\r\n requires 0 <= e <= 32;\r\n requires p2m1 == power2(e)-1;\r\n ensures Word32(p2m1);\r\n ensures |BEWordToBitSeq_premium(p2m1)| == 32;\r\n ensures BEWordToBitSeq(p2m1) == RepeatDigit_premium(0, 32-e) + RepeatDigit_premium(1, e);\r\n ensures forall i :: 0 <= i < 32 ==> BEWordToBitSeq(p2m1)[i] == if i < 32-e then 0 else 1;\r\n{\r\n lemma_power2_1_is_2();\r\n lemma_2toX();\r\n lemma_power2_increases(e, 32);\r\n //-assert p2m1 < power2(32);\r\n\r\n var tight := RepeatDigit_premium(1, e);\r\n lemma_bits_of_power2minus1(tight, e);\r\n assert BEBitSeqToInt(tight) == power2(e)-1;\r\n lemma_BEDigitSeqToInt_invertibility(2, p2m1, tight);\r\n assert BEIntToDigitSeq(2, e, p2m1) == tight;\r\n lemma_BEIntToDigitSeq_properties(2, 0, p2m1);\r\n if (e > |BEIntToDigitSeq_private(2, 0, p2m1)|)\r\n {\r\n calc {\r\n power2(e);\r\n > { lemma_power2_strictly_increases(|BEIntToDigitSeq_private(2, 0, p2m1)|, e); }\r\n power2(|BEIntToDigitSeq_private(2, 0, p2m1)|);\r\n { lemma_power2_is_power_2(|BEIntToDigitSeq_private(2, 0, p2m1)|); }\r\n power(2, |BEIntToDigitSeq_private(2, 0, p2m1)|);\r\n >=\r\n p2m1 + 1;\r\n power2(e);\r\n }\r\n }\r\n assert e <= |BEIntToDigitSeq(2, 0, p2m1)|;\r\n lemma_BEIntToDigitSeq_mp_irrelevant(2, e, p2m1);\r\n assert BEIntToDigitSeq(2, 0, p2m1) == tight;\r\n calc {\r\n BEWordToBitSeq(p2m1);\r\n BEIntToDigitSeq(2, 32, p2m1);\r\n { lemma_zero_extension(2, 32, p2m1, tight); }\r\n RepeatDigit_premium(0, 32-|tight|) + tight;\r\n RepeatDigit_premium(0, 32-e) + tight;\r\n }\r\n}\r\n\r\nstatic function method ComputePower2Minus1_mostly(e:int) : int\r\n requires 0 <= e < 32;\r\n ensures Word32(1) && Word32(e);\r\n ensures |BEWordToBitSeq(ComputePower2Minus1_mostly(e))| == 32;\r\n ensures BEWordToBitSeq(ComputePower2Minus1_mostly(e)) == SequenceOfZeros(32-e) + RepeatDigit(1, e);\r\n ensures forall i :: 0 <= i < 32 ==> BEWordToBitSeq(ComputePower2Minus1_mostly(e))[i] == if i < 32-e then 0 else 1;\r\n ensures ComputePower2Minus1_mostly(e) == power2(e)-1;\r\n{\r\n lemma_2toX();\r\n lemma_ComputePower2Minus1(e, ComputePower2(e)-1);\r\n ComputePower2(e)-1\r\n}\r\n\r\nstatic lemma lemma_0xffffffff_is_2to32minus1()\r\n ensures 0xffffffff == power2(32)-1;\r\n{\r\n lemma_2toX();\r\n}\r\n\r\nstatic function method ComputePower2Minus1(e:int) : int\r\n requires 0 <= e < 32;\r\n ensures Word32(1) && Word32(e);\r\n ensures |BEWordToBitSeq(ComputePower2Minus1(e))| == 32;\r\n ensures BEWordToBitSeq(ComputePower2Minus1(e)) == SequenceOfZeros(32-e) + RepeatDigit(1, e);\r\n ensures forall i :: 0 <= i < 32 ==> BEWordToBitSeq(ComputePower2Minus1(e))[i] == if i < 32-e then 0 else 1;\r\n ensures ComputePower2Minus1(e) == power2(e)-1;\r\n{\r\n lemma_0xffffffff_is_2to32minus1();\r\n if (e==32) then 0xffffffff else ComputePower2Minus1_mostly(e)\r\n}\r\n\r\n//-------------------------------------------------------------------------\r\n\r\nstatic function GetWordBit(x: int, b: int) : int\r\n requires Word32(x);\r\n requires 0 <= b < 32;\r\n ensures IsBit(GetWordBit(x, b));\r\n{\r\n BEWordToBitSeq_premium(x)[b]\r\n}\r\n\r\nstatic method UpdateBitOfWord(x: int, pos: int, value: int) returns (y: int)\r\n requires Word32(x);\r\n requires 0 <= pos < 32;\r\n requires IsBit(value);\r\n ensures Word32(y);\r\n ensures |BEWordToBitSeq(x)| == |BEWordToBitSeq(y)| == 32;\r\n ensures BEWordToBitSeq(y)[pos] == value;\r\n ensures forall i {:trigger BEWordToBitSeq(x)[i]}{:trigger BEWordToBitSeq(y)[i]} ::\r\n 0 <= i < 32 && i != pos ==> BEWordToBitSeq(y)[i] == BEWordToBitSeq(x)[i];\r\n{\r\n if value == 1\r\n {\r\n var y := Asm_BitwiseOr(x, ComputePower2(31-pos));\r\n forall i | 0 <= i < 32 && i != pos\r\n ensures BEWordToBitSeq(y)[i] == BEWordToBitSeq(x)[i];\r\n {\r\n calc {\r\n BEWordToBitSeq(y)[i];\r\n if BEWordToBitSeq(x)[i] == 1 || BEWordToBitSeq(ComputePower2(31-pos))[i] == 1 then 1 else 0;\r\n if BEWordToBitSeq(x)[i] == 1 || false then 1 else 0;\r\n if BEWordToBitSeq(x)[i] == 1 then 1 else 0;\r\n { reveal_power2(); }\r\n BEWordToBitSeq_premium(x)[i];\r\n BEWordToBitSeq(x)[i];\r\n }\r\n }\r\n return y;\r\n }\r\n else\r\n {\r\n var y := Asm_BitwiseAnd(x, Asm_BitwiseNot(ComputePower2(31-pos)));\r\n forall i | 0 <= i < 32 && i != pos\r\n ensures BEWordToBitSeq(y)[i] == BEWordToBitSeq(x)[i];\r\n {\r\n calc {\r\n BEWordToBitSeq(y)[i];\r\n if BEWordToBitSeq(x)[i] == 1 && BEWordToBitSeq(Asm_BitwiseNot(ComputePower2(31-pos)))[i] == 1 then 1 else 0;\r\n if BEWordToBitSeq(x)[i] == 1 && BEWordToBitSeq(ComputePower2(31-pos))[i] == 0 then 1 else 0;\r\n if BEWordToBitSeq(x)[i] == 1 then 1 else 0;\r\n { reveal_power2(); }\r\n BEWordToBitSeq_premium(x)[i];\r\n BEWordToBitSeq(x)[i];\r\n }\r\n }\r\n return y;\r\n }\r\n}\r\n\r\n//-------------------------------------------------------------------------\r\n\r\nstatic method TruncateToByte(Value:int)\r\n returns (NewValue: int)\r\n requires Word32(Value);\r\n ensures IsByte(NewValue);\r\n ensures Word32(0xff);\r\n ensures NewValue == Asm_BitwiseAnd(Value, 0xff); //- Help SymDiff out\r\n{\r\n lemma_2toX();\r\n lemma_and_with_ff_premium();\r\n\r\n NewValue := Asm_BitwiseAnd(Value, 0xff);\r\n}\r\n\r\nstatic method TruncateToWord16(Value:int)\r\n returns (NewValue: int)\r\n requires Word32(Value);\r\n ensures Word16(NewValue);\r\n ensures Word32(0xffff);\r\n ensures NewValue == Asm_BitwiseAnd(Value, 0xffff); //- Help SymDiff out\r\n{\r\n lemma_2toX();\r\n lemma_and_with_ffff_premium();\r\n\r\n NewValue := Asm_BitwiseAnd(Value, 0xffff);\r\n}\r\n" }, { "path": "ironclad-apps/src/Dafny/Libraries/base.s.dfy", "content": "static function{:imported} unroll(i:int):bool { true }\r\nstatic function Trigger(i:int):bool { true }\r\nstatic function sizeof(a:A):int\r\n\r\n" }, { "path": "ironclad-apps/src/DafnyTestDriver/DafnyTestDriver/App.config", "content": "\r\n\r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/DafnyTestDriver/DafnyTestDriver/DafnyTestDriver.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {069C5421-5138-4F5C-BA5D-A2AFE201CFBF}\r\n Exe\r\n Properties\r\n ConsoleApplication1\r\n ConsoleApplication1\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/src/DafnyTestDriver/DafnyTestDriver/Program.cs", "content": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\nusing System.Numerics;\r\n\r\nnamespace ConsoleApplication1\r\n{\r\n class Program\r\n {\r\n \r\n static void Main(string[] args)\r\n {\r\n Console.WriteLine(\"Hiya, world!\");\r\n @__default prog = new __default();\r\n BigInteger @result;\r\n prog.Main(out @result);\r\n }\r\n \r\n }\r\n}\r\n" }, { "path": "ironclad-apps/src/DafnyTestDriver/DafnyTestDriver/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n \r\n\r\n\r\n[assembly: AssemblyTitle(\"ConsoleApplication1\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"ConsoleApplication1\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n \r\n \r\n\r\n[assembly: ComVisible(false)]\r\n\r\n\r\n[assembly: Guid(\"837486e7-41bf-4b80-be6b-013696ddd61d\")]\r\n\r\n\r\n//\r\n\r\n \r\n\r\n\r\n//\r\n \r\n\r\n\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/src/DafnyTestDriver/DafnyTestDriver/assembly.cs", "content": "using System.Numerics;\r\nusing System.Diagnostics;\r\nusing System.Text;\r\n\r\n public partial class @__default\r\n {\r\n public static BigInteger @asm__BitwiseXor(BigInteger a, BigInteger b)\r\n {\r\n return a ^ b;\r\n }\r\n public static BigInteger @asm__BitwiseAnd(BigInteger a, BigInteger b)\r\n {\r\n return a & b;\r\n }\r\n public static BigInteger @asm__BitwiseOr(BigInteger a, BigInteger b)\r\n {\r\n return a | b;\r\n }\r\n public static BigInteger @asm__LeftShift(BigInteger a, BigInteger b)\r\n {\r\n BigInteger mask = 1; \r\n mask = mask << 32;\r\n mask -= 1;\r\n return mask & (a << (int)b);\r\n }\r\n public static BigInteger @asm__RightShift(BigInteger a, BigInteger b)\r\n {\r\n return a >> (int)b;\r\n }\r\n public static BigInteger @asm__BitwiseNot(BigInteger a)\r\n {\r\n return ~a;\r\n }\r\n public static BigInteger @asm__RotateRight(BigInteger a, BigInteger b)\r\n {\r\n BigInteger mask = 1; \r\n mask = mask << 32;\r\n mask -= 1;\r\n int amount = (int)b;\r\n return mask & ((a >> amount) | (a << (32 - amount)));\r\n }\r\n public static BigInteger @asm__RotateLeft(BigInteger a, BigInteger b)\r\n {\r\n BigInteger mask = 1; \r\n mask = mask << 32;\r\n mask -= 1;\r\n int amount = (int)b;\r\n return mask & ((a << amount) | (a >> (32 - amount)));\r\n }\r\n\r\n static BigInteger two = 2;\r\n static BigInteger pow32 = BigInteger.Pow(two, 32);\r\n\r\n static void Word32(BigInteger a)\r\n {\r\n Debug.Assert(0 <= a);\r\n Debug.Assert(a < pow32);\r\n }\r\n public static BigInteger @asm__Add(BigInteger a, BigInteger b)\r\n {\r\n Word32(a);\r\n Word32(b);\r\n profiler.ProfileTally(1000, 1); \r\n\r\n BigInteger result = (a + b) % pow32;\r\n Debug.Assert(((a + b) - (a+b >= pow32 ? pow32 : 0)).Equals(result));\r\n return result;\r\n }\r\n public static BigInteger @asm__Sub(BigInteger a, BigInteger b)\r\n {\r\n Word32(a);\r\n Word32(b);\r\n profiler.ProfileTally(1001, 1);\r\n BigInteger result = (a - b + pow32) % pow32;\r\n Debug.Assert((a - b + ((b>a) ? pow32 : 0)).Equals(result));\r\n return result;\r\n }\r\n public static void @method__Mul(BigInteger a, BigInteger b, out BigInteger hi, out BigInteger lo)\r\n {\r\n Word32(a);\r\n Word32(b);\r\n profiler.ProfileTally(1002, 1);\r\n @asm__Mul64(a, b, out hi, out lo);\r\n }\r\n public static void @asm__Mul64(BigInteger a, BigInteger b, out BigInteger hi, out BigInteger lo)\r\n {\r\n Word32(a);\r\n Word32(b);\r\n profiler.ProfileTally(1003, 1);\r\n BigInteger pow64 = 2;\r\n pow64 = BigInteger.Pow(pow64, 64);\r\n BigInteger product = (a * b) % pow64;\r\n hi = product / pow32;\r\n lo = product % pow32;\r\n Debug.Assert((hi * pow32 + lo).Equals(a * b));\r\n }\r\n public static BigInteger @asm__Mul(BigInteger a, BigInteger b)\r\n {\r\n Word32(a);\r\n Word32(b);\r\n profiler.ProfileTally(1004, 1);\r\n BigInteger hi, lo;\r\n @method__Mul(a, b, out hi, out lo);\r\n return lo;\r\n }\r\n public static BigInteger @asm__Div(BigInteger a, BigInteger b)\r\n {\r\n Word32(a);\r\n Word32(b);\r\n profiler.ProfileTally(1005, 1);\r\n return BigInteger.Divide(a,b);\r\n }\r\n public static BigInteger @asm__Mod(BigInteger a, BigInteger b)\r\n {\r\n Word32(a);\r\n Word32(b);\r\n profiler.ProfileTally(1006, 1);\r\n return BigInteger.Remainder(a,b);\r\n }\r\n public static void @method__DivMod(BigInteger zero/*?*/, BigInteger a, BigInteger b, out BigInteger div, out BigInteger mod)\r\n {\r\n Word32(a);\r\n Word32(b);\r\n div = BigInteger.DivRem(a, b, out mod);\r\n Debug.Assert((b * div + mod).Equals(a));\r\n }\r\n public static void @asm__Rdtsc(out BigInteger hi, out BigInteger lo)\r\n {\r\n \r\n hi = 0;\r\n lo = 0;\r\n }\r\n public void @asm__declassify__result(BigInteger @concrete, out BigInteger @pub__result)\r\n {\r\n @pub__result = @concrete;\r\n }\r\n public static void @GetBootloaderArgWord(BigInteger @index, out BigInteger @result)\r\n {\r\n @result = 0;\r\n }\r\n System.Random rng = new System.Random();\r\n\r\n public void display_seq(BigInteger[] x)\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n\r\n foreach (BigInteger xs in x)\r\n {\r\n sb.Append(string.Format(\"{0,2:X2}\", (int)xs));\r\n }\r\n System.Console.WriteLine(sb.ToString());\r\n }\r\n public void @get__random(BigInteger countb, out Dafny.Sequence @result)\r\n {\r\n int counti = (int)countb;\r\n \r\n BigInteger[] bary = new BigInteger[counti];\r\n for (int i=0; i(bary);\r\n display_seq(bary);\r\n }\r\n public static void InitK__SHA256__0__to__10(BigInteger[] @result)\r\n {\r\n Debug.Assert(false);\r\n @result = null;\r\n }\r\n public static void @ComputeWsForBlockStep2__SHA256(BigInteger[] @M, BigInteger @words, BigInteger[] @H, BigInteger[] @W, BigInteger[] @Ks, BigInteger @num__blocks, BigInteger @currentBlock)\r\n {\r\n Debug.Assert(false);\r\n }\r\n public static void debug__print(BigInteger m1, BigInteger m2)\r\n {\r\n System.Console.WriteLine(string.Format(\"debug_print {0,2:X} {1,8:X}\", (int) m1, (int) m2));\r\n }\r\n }\r\n" }, { "path": "ironclad-apps/src/DafnyTestDriver/DafnyTestDriver/debug.cs", "content": "using System.Numerics;\r\n\r\npublic partial class @__default\r\n{\r\n\r\n public static BigInteger BIFake(int val, int count)\r\n {\r\n if (count == 1)\r\n {\r\n return val;\r\n }\r\n else\r\n {\r\n return BIFake(val, count - 1) * BigInteger.Pow(2,32) + val;\r\n }\r\n }\r\n\r\n\r\n\r\n//\r\n//\r\n//\r\n////\r\n//\r\n//\r\n//\r\n//\r\n//\r\n////\r\n//\r\n//\r\n//\r\n//\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/DafnyTestDriver/DafnyTestDriver/profile.cs", "content": "using System;\r\nusing System.IO;\r\nusing System.Numerics;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\n\r\npublic class Profiler\r\n{\r\n Dictionary labels;\r\n Dictionary profileMap;\r\n Stopwatch stopwatch;\r\n StreamWriter tw;\r\n\r\n public Profiler(StreamWriter tw)\r\n {\r\n this.tw = tw;\r\n labels = new Dictionary();\r\n labels[1] = \"TestDigits\";\r\n labels[2] = \"BigNatSub\";\r\n labels[3] = \"BigNatModExpCalls\";\r\n labels[4] = \"BigNatModExpWhileLoops\";\r\n labels[5] = \"BigNatDivCalls\";\r\n labels[6] = \"BigNatDivWhileLoops\";\r\n labels[1000] = \"Add\";\r\n labels[1001] = \"Sub\";\r\n labels[1002] = \"method_Mul\";\r\n labels[1003] = \"Mul64\";\r\n labels[1004] = \"Mul\";\r\n labels[1005] = \"Div\";\r\n labels[1006] = \"Mod\";\r\n ResetTally();\r\n }\r\n public void ResetTally()\r\n {\r\n profileMap = new Dictionary();\r\n stopwatch = new Stopwatch();\r\n stopwatch.Start();\r\n }\r\n public void ProfileTally(int category, int value)\r\n {\r\n if (!profileMap.ContainsKey(category))\r\n {\r\n profileMap[category] = 0;\r\n }\r\n profileMap[category] += value;\r\n }\r\n public void DisplayTally()\r\n {\r\n stopwatch.Stop();\r\n TimeSpan elapsed = stopwatch.Elapsed;\r\n foreach (int key in profileMap.Keys)\r\n {\r\n tw.WriteLine(\r\n String.Format(\"{0}: {1}\", labels[key], profileMap[key]));\r\n }\r\n tw.WriteLine(\"ElapsedTime: \" + elapsed);\r\n tw.WriteLine();\r\n tw.FlushAsync();\r\n }\r\n\r\n}\r\n\r\npublic partial class @__default\r\n{\r\n static Profiler profiler = new Profiler(new StreamWriter(\"profiler.txt\"));\r\n public static void ResetTally()\r\n {\r\n profiler.ResetTally();\r\n }\r\n public static void ProfileTally(BigInteger _category, BigInteger _value)\r\n {\r\n profiler.ProfileTally((int) _category, (int) _value);\r\n }\r\n public static void DisplayTally()\r\n {\r\n profiler.DisplayTally();\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/src/DafnyTestDriver/DafnyTestDriver.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 12.00\r\n# Visual Studio 2012\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"DafnyTestDriver\", \"DafnyTestDriver\\DafnyTestDriver.csproj\", \"{069C5421-5138-4F5C-BA5D-A2AFE201CFBF}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Any CPU = Debug|Any CPU\r\n\t\tRelease|Any CPU = Release|Any CPU\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{069C5421-5138-4F5C-BA5D-A2AFE201CFBF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{069C5421-5138-4F5C-BA5D-A2AFE201CFBF}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{069C5421-5138-4F5C-BA5D-A2AFE201CFBF}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{069C5421-5138-4F5C-BA5D-A2AFE201CFBF}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "ironclad-apps/src/Trusted/DafnySpec/Seq.s.dfy", "content": "include \"../../Dafny/Libraries/base.s.dfy\"\r\n\r\n//- Trusted sequence definitions (used in trusted specifications)\r\n\r\ndatatype Seq = Seq_Nil() | Seq_Cons(hd:A, tl:Seq);\r\n\r\nfunction{:opaque} Seq_Length(s:Seq):int\r\n ensures Seq_Length(s) >= 0;\r\n{\r\n if s.Seq_Cons? then 1 + Seq_Length(s.tl) else 0\r\n}\r\n\r\nfunction Seq_Empty():Seq { Seq_Nil() }\r\n\r\nfunction{:opaque} Seq_Singleton(a:A):Seq { Seq_Cons(a, Seq_Nil()) }\r\n\r\nfunction{:opaque} Seq_Build(s:Seq, a:A):Seq\r\n{\r\n if s.Seq_Cons? then Seq_Cons(s.hd, Seq_Build(s.tl, a)) else Seq_Singleton(a)\r\n}\r\n\r\nfunction Seq_Dummy():A\r\n\r\nfunction{:opaque} Seq_Index(s:Seq, k:int):A\r\n{\r\n if s.Seq_Cons? then\r\n if k == 0 then s.hd\r\n else Seq_Index(s.tl, k - 1)\r\n else Seq_Dummy()\r\n}\r\n\r\n\r\n\r\n\r\nfunction Seq_Equal(s0:Seq, s1:Seq):bool { s0 == s1 }\r\n\r\nfunction{:opaque} Seq_Append(s0:Seq, s1:Seq):Seq\r\n{\r\n if s0.Seq_Cons? then Seq_Cons(s0.hd, Seq_Append(s0.tl, s1)) else s1\r\n}\r\n\r\nfunction{:opaque} Seq_Update(s:Seq, k:int, a:A):Seq\r\n{\r\n if s.Seq_Cons? then\r\n if k == 0 then Seq_Cons(a, s.tl)\r\n else Seq_Cons(s.hd, Seq_Update(s.tl, k - 1, a))\r\n else s\r\n}\r\n\r\nfunction{:opaque} Seq_Take(s:Seq, n:int):Seq\r\n{\r\n if s.Seq_Cons? && n > 0 then Seq_Cons(s.hd, Seq_Take(s.tl, n - 1)) else Seq_Nil()\r\n}\r\n\r\nfunction{:opaque} Seq_Drop(s:Seq, n:int):Seq\r\n{\r\n if s.Seq_Cons? && n > 0 then Seq_Drop(s.tl, n - 1) else s\r\n}\r\n\r\nlemma Seq_Seq(s:Seq)\r\n ensures 0 <= sizeof(s);\r\n ensures s.Seq_Nil? != s.Seq_Cons?;\r\n ensures{:typearg \"A\"} s.Seq_Nil? <==> s == Seq_Nil();\r\n ensures s.Seq_Cons? ==> Seq_Cons(s.hd, s.tl) == s;\r\n ensures s.Seq_Cons? ==> 0 <= sizeof(s.tl) < sizeof(s);\r\n{\r\n}\r\n\r\nlemma Seq_Cons_All()\r\n ensures forall s:Seq :: s.Seq_Nil? != s.Seq_Cons?;\r\n ensures{:typearg \"A\"} forall s:Seq :: s.Seq_Nil? <==> s == Seq_Nil();\r\n ensures forall hd:A, tl:Seq :: Seq_Cons(hd, tl).Seq_Cons?;\r\n ensures forall hd:A, tl:Seq :: Seq_Cons(hd, tl).hd == hd;\r\n ensures forall hd:A, tl:Seq :: Seq_Cons(hd, tl).tl == tl;\r\n{\r\n}\r\n\r\n\r\n\r\n\r\n//\r\n\r\n\r\n\r\n\r\n\r\n\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/AddPerf/AppRequirements.ifc.stitch", "content": "//-private-import dafny_assembly_s;\r\n//-private-import dafny_be_sequences_s;\r\n//-private-import dafny_bytes_and_words_s;\r\n//-Xrivate-import dafny_Digest_s;\r\n//-Xrivate-import dafny_GCD_s;\r\n//-Xrivate-import dafny_hmac_common_s;\r\n//-private-import dafny_integer_sequences_s;\r\n//-Xrivate-import dafny_io_mem_s;\r\n//-Xrivate-import dafny_KeyGen_s;\r\n//-Xrivate-import dafny_MillerRabin_s;\r\n//-Xrivate-import dafny_power_s;\r\n//-Xrivate-import dafny_RandomNumberGen_s;\r\n//-Xrivate-import dafny_RandomTracing_s;\r\n//-Xrivate-import dafny_rfc4251_s;\r\n//-Xrivate-import dafny_round_s;\r\n//-Xrivate-import dafny_RSASpec_s;\r\n//-Xrivate-import dafny_seq_blocking_s;\r\n//-Xrivate-import dafny_sha_common_s;\r\n//-Xrivate-import dafny_sha1_s;\r\n//-Xrivate-import dafny_sha256_s;\r\n//-Xrivate-import dafny_tpm_device_s;\r\n// requires fun_TPM__valid($ghost_TPM);\r\n// requires fun_TPM__satisfies__integrity__policy($ghost_TPM);\r\n// requires $ghost_IoMemPerm is Null;\r\n// modifies $ghost_TPM;\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/AppLoader/AppRequirements.ifc.stitch", "content": "//-private-import dafny_assembly_s;\r\n//-private-import dafny_base_s;\r\n//-private-import dafny_be_sequences_s;\r\n//-private-import dafny_bytes_and_words_s;\r\n//-private-import dafny_DafnyPrelude;\r\n//-private-import dafny_hmac_common_s;\r\n//-private-import dafny_integer_sequences_s;\r\n//-private-import dafny_io_mem_s;\r\n//-private-import dafny_power_s;\r\n//-private-import dafny_power2_s;\r\n//-private-import dafny_relational_s;\r\n//-private-import dafny_round_s;\r\n//-private-import dafny_seq_blocking_s;\r\n//-private-import dafny_Seq_s;\r\n//-private-import dafny_sha_common_s;\r\n//-private-import dafny_sha1_s;\r\n//-private-import dafny_tpm_device_s;\r\n requires fun_TPM__valid($ghost_TPM);\r\n requires fun_TPM__satisfies__integrity__policy($ghost_TPM);\r\n requires $ghost_IoMemPerm is Null;\r\n modifies $ghost_TPM;\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/AppLoaderContract.ifc.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface AppLoaderContract\r\n{\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//-\r\n//- This function defines the contract between AppLoader and the App it launches\r\n//- AppLoader must, effectively, ensure it, while the app gets to assume it\r\n//-\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n\r\nfunction AppLoaderContractGeneric(\r\n core_id:int,\r\n init:bool,\r\n r:regs,\r\n core_state:core_state,\r\n initState:InitStateMachine,\r\n mem:mem,\r\n code_mem:mem,\r\n io:IOState,\r\n app_entry:int,\r\n app_code_base:int,\r\n code_word_seq:Seq___int\r\n ):bool\r\n{\r\n app_code_base == r.regs[EAX]\r\n && app_entry == r.regs[EBX]\r\n && Aligned(app_code_base) \r\n && app_code_base mod 0x10000 == 0\r\n && app_code_base <= app_entry && app_entry < app_code_base + 0x100000 //- Code must be < 1MB\r\n && ?memLo <= app_code_base + 0x101000 //- Usable memory starts at the end of the code + 1K\r\n && ?memHi >= app_code_base + 123*1024*1024 \r\n && ?memHi == 0x08000000 \r\n && (forall i:int::{memAddr(i)}{mem.dom[i]} \r\n app_code_base + 0x101000 <= i && i < ?memHi <==> mem.dom[i]) //- App expects 123 MB of memory\r\n && r.regs[ESP] == add(app_code_base, 123*1024*1024) //- Stack starts at the very top\r\n && (forall k:int::{memAddr(k)} ?memLo <= k && k < ?memHi ==> memAddr(k))\r\n && ValidPrePagingState(core_state.cregs[CR0])\r\n && core_state.seg_regs[SS].descriptor.segBase == 0 && \r\n core_state.seg_regs[SS].descriptor.segType == ?SegmentDescriptorTypeData\r\n && core_state.seg_regs[DS].descriptor.segBase == 0 && \r\n core_state.seg_regs[DS].descriptor.segType == ?SegmentDescriptorTypeData\r\n && core_id == 0 //- Must be run on the bootstrap processor\r\n && !init\r\n\r\n && (forall j:int :: 0 <= j && j < 256*1024 ==> \r\n fun_Seq__Index___int(code_word_seq, j) == code_mem.map[app_code_base + j*4])\r\n\r\n //- App loader knows its constants by now, but the app we launch doesn't\r\n#ifndef AppLoader\r\n && initState is EntryPoint\r\n && ?CodeBase == app_code_base //- New definition, since app is linked at a different base\r\n#endif\r\n\r\n //- Trusted code has not yet done anything to the PCI configuration\r\n && (forall s:int::{PciConfigState#PciState(_pci#IOState(io))[s]} 0 <= s && s < 65536 ==> io._pci.PciConfigState[s] == 0) // TODO: fix triggering\r\n\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/AppLoaderContract.imp.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation AppLoaderContract \r\n{\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/AssemblySpec.ifc.basm", "content": "//-\r\n//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface AssemblySpec\r\n{\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- ASSEMBLY LANGUAGE DEFINITIONS\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//- Decide whether conditional jumps will be taken (true) or not taken (false), depending on condition and efl:\r\nfunction Je (efl:int):bool;\r\nfunction Jne(efl:int):bool;\r\nfunction Jbe(efl:int):bool;\r\nfunction Jb (efl:int):bool;\r\nfunction Jae(efl:int):bool;\r\nfunction Ja (efl:int):bool;\r\n\r\n//- Is the carry flag (CF) set?\r\nfunction Cf (efl:int):bool;\r\n\r\n//- invariant: word(r) for each register r\r\n//- To maintain invariant, simply check word(exp) for each assignment r := exp\r\n\r\n//- invariant: word(r) for each word w in memory\r\n//- To maintain invariant, simply check word(exp) for each store of exp to memory\r\n\r\nconst EAX:int := 0;\r\nconst ECX:int := 1;\r\nconst EDX:int := 2;\r\nconst EBX:int := 3;\r\nconst ESI:int := 4;\r\nconst EDI:int := 5;\r\nconst EBP:int := 6;\r\nconst ESP:int := 7;\r\n//- fictitious temporary registers for microinstructions:\r\nconst TMP1:int := 0 - 1;\r\nconst TMP2:int := 0 - 2;\r\nfunction RegOk(r:int):bool { EAX <= r && r <= ESP }\r\n\r\n//- Ordering chosen based on Table 4-1 in the Intel Manual\r\n//- Actual values have no impact; just need to be distinct (and consecutive for SegRegOk to work)\r\nconst ES:int := 0;\r\nconst CS:int := 1;\r\nconst SS:int := 2;\r\nconst DS:int := 3;\r\nconst FS:int := 4;\r\nconst GS:int := 5;\r\nfunction SegRegOk(r:int):bool { ES <= r && r <= GS }\r\n\r\nconst CR0:int := 0;\r\nconst CR3:int := 1;\r\nconst CR4:int := 2;\r\nfunction CtrlRegOk(r:int):bool { CR0 <= r && r <= CR4 }\r\n\r\ntype mem_opn = MConst(_mconst:int) | MReg(_mreg:int, _moffset:int) | MIndex(_mbase:int, _mscale:int, _mindex:int, _moff:int);\r\ntype opn = OConst(_const:int) | OReg(_reg:int);\r\ntype opn_mem = OMem(_ptr:mem_opn); // TODO: get rid of this\r\n\r\n//- TLB holds cached PTEs. \r\n//- The label represents the possibility that the processor implements multiple TLBs (e.g., code and data)\r\n//- We model the TLB as an infinitely large cache. \r\n//- A nondeterministic process updates the TLB, so when the page structures in memory change, \r\n//- the TLBs may or may not reflect the new value. Once the TLB is invalidated, we immediately\r\n//- populate it with the current value in memory, representing the fact that the next access will\r\n//- force the processor to go to memory to learn the correct mapping.\r\n//- DTLB holds cached PDEs\r\n//- The activeLabels select the {D}TLB that will be used for the next memory option\r\n//- We havoc them on every operation, so there are no guarantees as to which one will be used\r\n// TODO: MUST HAVOC {D}TLB_activeLabels !!!! <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\ntype TLB_label;\r\ntype DTLB_label;\r\ntype paging_caches = paging_caches(TLB:[int][TLB_label]PageEntry, DTLB:[int][DTLB_label]PageEntry,\r\n TLB_activeLabel:TLB_label, DTLB_activeLabel:DTLB_label);\r\n\r\n//- GDT Base: Addr in mem where Global Descriptor Table (GDT) starts. Len = # seg descriptors in GDT\r\ntype GDT_regs = GDT_regs(GDT_base:int, GDT_len:int); \r\n\r\n//- state shared among cores\r\n// TODO: move these to the proper files\r\n//- These types deliberately omit linear constructors; the programmer cannot construct them directly\r\ntype VgaEvent;\r\ntype VgaState = VgaState(VgaEvents:[int]VgaEvent, VgaNextEvent:int);\r\ntype KeyboardState = KeyboardState(KeyboardEvents:[int]int, KeyboardAvailable:int, KeyboardDone:int);\r\ntype IomState = IomState(IomMem:[int]int, IomFrozen:bool, IoMmuState:[int]int, IoMmuEnabled:bool, DevEnabled:bool);\r\n//type IOQueue = IOQueue(Events:[int]int, Count:int);\r\ntype PciState = PciState(PciConfigId:int, PciConfigOffset:int, PciConfigState:[int]int);\r\ntype IOState = IOState(_vga:VgaState, _keyboard:KeyboardState, _iom:IomState, _pci:PciState, _inCtr:int, _outCtr:int);\r\n\r\n//- mem.map[i] = data at address i, if PhysPtrOk(i)\r\ntype mem = mem(map:[int]int, dom:[int]bool); //- no linear constructors\r\nfunction mem_update(mem:mem, ptr:int, val:int):mem { mem(mem.map[ptr := val], mem.dom) }\r\n\r\n//- core-local state\r\ntype regs = regs(_regs:[int]int, _efl:int); //- no linear constructors\r\ntype core_state = core_state(_cregs:[int]int, _gdt_regs:GDT_regs, _seg_regs:[int]SegmentRegister, _caches:paging_caches); //- no linear constructors\r\nfunction .regs(r:regs):[int]int { r._regs }\r\nfunction .efl(r:regs):int { r._efl }\r\nfunction .cregs(c:core_state):[int]int { c._cregs }\r\nfunction .gdt_regs(c:core_state):GDT_regs { c._gdt_regs }\r\nfunction .seg_regs(c:core_state):[int]SegmentRegister { c._seg_regs }\r\nfunction .caches(c:core_state):paging_caches { c._caches }\r\n\r\ntype SerialPortState = SerialPortState(Mode:SerialPortMode, In:SerialPortQueue, Out:SerialPortQueue);\r\ntype SerialPortQueue = SerialPortQueue(Events:[int]int, Available:int, Done:int);\r\ntype SerialPortMode = SerialPortMode(DLAB:bool);\r\n//readonly var $serialState:SerialPortState;\r\n//readonly var $randomSource:[int]int;\r\n//readonly var $global_sample_index:int;\r\n\r\nfunction PhysPtrOk(mem:mem, ptr:int):bool\r\n{ \r\n mem.dom[ptr]\r\n && Aligned(ptr)\r\n}\r\n\r\nfunction EvalMemOpn(r:regs, m:mem_opn):int\r\n{\r\n if m is MConst then m._mconst\r\n else if m is MReg then r.regs[m._mreg] + m._moffset\r\n else r.regs[m._mbase] + m._mscale * r.regs[m._mindex] + m._moff\r\n}\r\n\r\nfunction EvalMemOpnOk(m:mem_opn):bool\r\n{\r\n if m is MConst then true\r\n else if m is MReg then RegOk(m._mreg)\r\n else RegOk(m._mbase) && RegOk(m._mindex)\r\n}\r\n\r\nfunction Eval(r:regs, o:opn):int\r\n{\r\n if o is OConst then o._const\r\n else r.regs[o._reg]\r\n}\r\n\r\nfunction EvalPtr(r:regs, o:opn_mem):int { EvalMemOpn(r, o._ptr) }\r\nfunction EvalPtrOk(o:opn_mem):bool { EvalMemOpnOk(o._ptr) }\r\n\r\nfunction EvalViaSegment(r:regs, c:core_state, m:mem, segment_index:int, o:opn_mem):int\r\n{\r\n // REVIEW: Eventually, should update ?System to depend on CPL!\r\n LogicalLoad(c.seg_regs[segment_index], paging_enabled(c), m, \r\n c.caches.TLB, c.caches.TLB_activeLabel, ?System, EvalPtr(r, o)).<>\r\n //m.map[EvalPtr(r, o)]\r\n}\r\n\r\nfunction SrcOkViaSegment(r:regs, c:core_state, m:mem, segment_index:int, o:opn_mem):bool\r\n{\r\n //PhysPtrOk(EvalPtr(r, o))\r\n // REVIEW: Eventually, should update ?System to depend on CPL!\r\n EvalPtrOk(o)\r\n && LogicalLoad(c.seg_regs[segment_index], paging_enabled(c), m,\r\n c.caches.TLB, c.caches.TLB_activeLabel, ?System, EvalPtr(r, o)) != <>()\r\n}\r\n\r\nfunction DstOkViaSegment(r:regs, c:core_state, m:mem, segment_index:int, o:opn_mem):bool\r\n{ \r\n // REVIEW: Eventually, should update ?System to depend on CPL!\r\n (forall $val:int ::\r\n EvalPtrOk(o)\r\n && LogicalStore(c.seg_regs[segment_index], paging_enabled(c), m,\r\n c.caches.TLB, c.caches.TLB_activeLabel,\r\n ?System, EvalPtr(r, o), $val) != <>())\r\n}\r\n\r\nfunction EvalMem(r:regs, c:core_state, m:mem, o:opn_mem):int\r\n{\r\n EvalViaSegment(r, c, m, DS, o)\r\n}\r\n\r\nfunction SrcOk(o:opn):bool\r\n{\r\n if o is OConst then word(o._const)\r\n else RegOk(o._reg)\r\n}\r\n\r\nfunction DstOk(o:opn):bool { o is OReg && RegOk(o._reg) }\r\n\r\n//- By default, everyone uses DS\r\nfunction MemSrcOk(r:regs, c:core_state, m:mem, o:opn_mem):bool\r\n{\r\n SrcOkViaSegment(r, c, m, DS, o)\r\n}\r\n\r\nfunction MemDstOk(r:regs, c:core_state, m:mem, o:opn_mem):bool\r\n{ \r\n DstOkViaSegment(r, c, m, DS, o)\r\n}\r\n\r\n//- Where is the instruction that follows Eip?\r\n//- (This equals Eip + sizeof(instruction at Eip).)\r\nfunction NextEip(Eip:int):int;\r\n\r\nfunction Efl_Cmp(_efl:int, x:int, y:int):int;\r\nfunction Efl_Add(_efl:int, x:int, y:int):int;\r\nfunction Efl_Sub(_efl:int, x:int, y:int):int;\r\nfunction Efl_Mul(_efl:int, x:int, y:int):int;\r\nfunction Efl_Div(_efl:int, x:int, y:int):int;\r\nfunction Efl_Not(_efl:int, x:int):int;\r\nfunction Efl_And(_efl:int, x:int, y:int):int;\r\nfunction Efl_Or(_efl:int, x:int, y:int):int;\r\nfunction Efl_Xor(_efl:int, x:int, y:int):int;\r\nfunction Efl_Shl(_efl:int, x:int, y:int):int;\r\nfunction Efl_Shr(_efl:int, x:int, y:int):int;\r\nfunction Efl_Rol(_efl:int, x:int, y:int):int;\r\nfunction Efl_Ror(_efl:int, x:int, y:int):int;\r\n\r\n//- Entirely ghost update\r\nfunction InOutUpdate(io:IOState):IOState\r\n{\r\n IOState(\r\n io._vga,\r\n io._keyboard,\r\n io._iom,\r\n io._pci,\r\n io._inCtr + 1,\r\n io._outCtr + 1\r\n )\r\n}\r\n\r\n//- Entirely ghost update\r\nfunction OutUpdate(io:IOState):IOState\r\n{\r\n IOState(\r\n io._vga,\r\n io._keyboard,\r\n io._iom,\r\n io._pci,\r\n io._inCtr,\r\n io._outCtr+1\r\n )\r\n}\r\n\r\nfunction VgaUpdate(io:IOState, vga:VgaState):IOState\r\n{\r\n IOState(\r\n vga,\r\n io._keyboard,\r\n io._iom,\r\n io._pci,\r\n io._inCtr,\r\n io._outCtr\r\n )\r\n}\r\n\r\nfunction KeyboardUpdate(io:IOState, keyboard:KeyboardState):IOState\r\n{\r\n IOState(\r\n io._vga,\r\n keyboard,\r\n io._iom,\r\n io._pci,\r\n io._inCtr,\r\n io._outCtr\r\n )\r\n}\r\n\r\nfunction IomUpdate(io:IOState, iom:IomState):IOState\r\n{\r\n IOState(\r\n io._vga,\r\n io._keyboard,\r\n iom,\r\n io._pci,\r\n io._inCtr,\r\n io._outCtr\r\n )\r\n}\r\n\r\nfunction PciUpdate(io:IOState, pci:PciState):IOState\r\n{\r\n IOState(\r\n io._vga,\r\n io._keyboard,\r\n io._iom,\r\n pci,\r\n io._inCtr,\r\n io._outCtr\r\n )\r\n}\r\n\r\nfunction MemUpdate1ViaSegment(r:regs, c:core_state, m:mem, segment_index:int, dst:opn_mem, v:int):mem\r\n{\r\n // REVIEW: Eventually, should update ?System to depend on CPL!\r\n LogicalStore(c.seg_regs[segment_index], paging_enabled(c), m,\r\n c.caches.TLB, c.caches.TLB_activeLabel, ?System, EvalPtr(r, dst), v).<>\r\n}\r\n\r\nfunction MemUpdate1(r:regs, c:core_state, m:mem, dst:opn_mem, v:int):mem\r\n{\r\n MemUpdate1ViaSegment(r, c, m, DS, dst, v)\r\n}\r\n\r\nfunction StackUpdate1(r:regs, c:core_state, m:mem, dst:opn_mem, v:int):mem\r\n{\r\n MemUpdate1ViaSegment(r, c, m, SS, dst, v)\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- GHOST OPERATIONS\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\natomic ghost procedure memEmpty() returns(linear m:mem);\r\n ensures (forall i:int::{m.dom[i]} !m.dom[i]);\r\n\r\natomic ghost procedure memTransfer(linear src:mem, linear dst:mem, b:[int]bool)\r\n returns(linear _src:mem, linear _dst:mem);\r\n requires (forall i:int::b[i] ==> src.dom[i]);\r\n ensures (forall i:int::{b[i]}{_src.dom[i]}{TV(i)} TV(i) ==> (_src.dom[i] <==> src.dom[i] && !b[i]));\r\n ensures (forall i:int::{b[i]}{_dst.dom[i]}{TV(i)} TV(i) ==> ( _dst.dom[i] <==> dst.dom[i] || b[i]));\r\n ensures _src.map == src.map;\r\n ensures (forall i:int::{b[i]}{_dst.map[i]}{TV(i)} TV(i) ==> ( _dst.map[i] == (if b[i] then src else dst).map[i]));\r\n\r\natomic ghost procedure memDisjoint(const linear m1:mem, const linear m2:mem);\r\n ensures (forall i:int::{m1.dom[i]} {m2.dom[i]} !m1.dom[i] || !m2.dom[i]);\r\n\r\natomic ghost procedure memDomIsMemAddr(const linear m:mem, i:int);\r\n requires m.dom[i];\r\n ensures memAddr(i);\r\n\r\n// REVIEW\r\natomic procedure instr_DropTempRegs(my r:regs, _regs:[int]int) returns(my _r:regs);\r\n requires (forall i:int :: RegOk(i) ==> _regs[i] == r.regs[i]);\r\n ensures _r.regs == _regs;\r\n ensures _r.efl == r.efl;\r\n\r\ntype InitStateMachine = EntryPoint() | StaticsEnabled();\r\n\r\n//- Proving the code is where we expect enables access to static variables\r\n//- in the code segment of the 64K of protected memory\r\natomic ghost procedure enableStatics(linear initState:InitStateMachine) returns (linear _initState:InitStateMachine, linear static_mem:mem);\r\n#ifdef AppLoader\r\n requires ?CodeBase == 0x300000;\r\n#else\r\n requires ?CodeBase == 0x340000;\r\n#endif\r\n requires initState is EntryPoint;\r\n ensures _initState is StaticsEnabled;\r\n ensures (forall i:int::{memAddr(i)}{static_mem.dom[i]} memAddr(i) && !memAddrMain(i) ==> static_mem.dom[i]); \r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- INSTRUCTIONS\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\natomic procedure instr_Mov(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n ensures _r.regs == r.regs[x := Eval(r, y)];\r\n ensures _r.efl == r.efl;\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_Add(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n ensures _r.regs == r.regs[x := wrap32(r.regs[x] + Eval(r, y))];\r\n ensures _r.efl == Efl_Add(r.efl, r.regs[x], Eval(r, y));\r\n ensures word(_r.regs[x]);\r\n\r\n//- Add with carry (ADC)\r\natomic procedure instr_AddCarry(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n ensures let carry:int := if Cf(r.efl) then 1 else 0 in\r\n _r.regs == r.regs[x := wrap32(r.regs[x] + Eval(r, y) + carry)] &&\r\n _r.efl == Efl_Add(r.efl, r.regs[x] + carry, Eval(r, y));\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_Sub(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n ensures _r.regs == r.regs[x := wrap32(r.regs[x] - Eval(r, y))];\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_AddNoFlags(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n ensures _r.regs == r.regs[x := wrap32(r.regs[x] + Eval(r, y))];\r\n ensures _r.efl == r.efl;\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_SubNoFlags(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n ensures _r.regs == r.regs[x := wrap32(r.regs[x] - Eval(r, y))];\r\n ensures _r.efl == r.efl;\r\n ensures word(_r.regs[x]);\r\n\r\n//- run-time overflow checked\r\natomic procedure instr_AddChecked(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n ensures _r.regs == r.regs[x := r.regs[x] + Eval(r, y)];\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_SubChecked(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n ensures _r.regs == r.regs[x := r.regs[x] - Eval(r, y)];\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_Mul(my r:regs, y:opn) returns(my _r:regs);\r\n ensures (exists hi:int :: _r.regs == r.regs[EDX := hi][EAX := wrap32(Mult(r.regs[EAX], Eval(r, y)))]);\r\n ensures word(_r.regs[EAX]) && word(_r.regs[EDX]);\r\n\r\natomic procedure instr_Mul64(my r:regs, y:opn) returns(my _r:regs);\r\n ensures _r.regs == r.regs\r\n [EDX := Div(Mult(r.regs[EAX], Eval(r, y)), 0x100000000)]\r\n [EAX := wrap32(Mult(r.regs[EAX], Eval(r, y)))];\r\n ensures word(_r.regs[EAX]) && word(_r.regs[EDX]);\r\n\r\n//- run-time overflow checked\r\natomic procedure instr_MulChecked(my r:regs, y:opn) returns(my _r:regs);\r\n ensures (exists hi:int :: _r.regs == r.regs[EDX := hi][EAX := Mult(r.regs[EAX], Eval(r, y))]);\r\n ensures word(_r.regs[EAX]) && word(_r.regs[EDX]);\r\n\r\n//- Note: we only support 32-bit division, so the upper 32 bits EDX must be 0\r\n//- EDX <- remainder EAX mod y\r\n//- EAX <- quotient EAX div y\r\natomic procedure instr_Div(my r:regs, y:opn) returns(my _r:regs);\r\n requires r.regs[EDX] == 0;\r\n requires Eval(r, y) != 0;\r\n ensures _r.regs == r.regs\r\n [EDX := r.regs[EAX] mod Eval(r, y)]\r\n [EAX := r.regs[EAX] div Eval(r, y)];\r\n ensures word(_r.regs[EAX]) && word(_r.regs[EDX]);\r\n\r\natomic procedure instr_Not(my r:regs, x:int) returns(my _r:regs);\r\n ensures _r.regs == r.regs[x := neg(r.regs[x])];\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_And(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n ensures _r.regs == r.regs[x := and(r.regs[x], Eval(r, y))];\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_Or(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n ensures _r.regs == r.regs[x := or(r.regs[x], Eval(r, y))];\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_Xor(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n ensures _r.regs == r.regs[x := xor(r.regs[x], Eval(r, y))];\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_Shl(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n requires Eval(r, y) < 32;\r\n ensures _r.regs == r.regs[x := shl(r.regs[x], Eval(r, y))];\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_Shr(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n requires Eval(r, y) < 32;\r\n ensures _r.regs == r.regs[x := shr(r.regs[x], Eval(r, y))];\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_Rol(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n requires Eval(r, y) < 32;\r\n ensures _r.regs == r.regs[x := rol(r.regs[x], Eval(r, y))];\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_Ror(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n requires Eval(r, y) < 32;\r\n ensures _r.regs == r.regs[x := ror(r.regs[x], Eval(r, y))];\r\n ensures word(_r.regs[x]);\r\n\r\n//- Sticks the carry flag (CF) in a register (see SETC instruction)\r\natomic procedure instr_GetCf(my r:regs, x:int) returns(my _r:regs);\r\n requires r.regs[x] < 256; //- Instruction only writes a byte, so this simplifies the ensures\r\n ensures _r.regs == r.regs[x := if Cf(r.efl) then 1 else 0]; \r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_Cmp(my r:regs, x:int, y:opn) returns(my _r:regs);\r\n ensures _r.regs == r.regs;\r\n ensures _r.efl == Efl_Cmp(r.efl, r.regs[x], Eval(r, y));\r\n\r\n// Compare EAX with Mem[ptr]. If equal, Mem[ptr] := val. Otherwise M[ptr] is stored in EAX.\r\n//atomic procedure instr_Cmpxchg(linear s:state, ptr:opn, val:opn) returns (linear _s:state);\r\n// requires DstOk(ptr);\r\n// requires SrcOk(val);\r\n// modifies regs, efl;\r\n// ensures word(_s._cores[me]._regs[EAX]);\r\n// ensures _s == let _efl:int := Efl_Cmp(s._cores[me]._efl, s._cores[me]._regs[EAX], EvalMem(r, c, s, ptr)) in\r\n// if s._cores[me]._regs[EAX] == EvalMem(r, c, s, ptr)\r\n// then InsUpdate1(me, s, ptr, Eval(r, val), _efl)\r\n// else InsUpdate1(me, s, OReg(EAX), EvalMem(r, c, s, ptr), _efl);\r\n\r\natomic procedure instr_Load(my r:regs, const my c:core_state, const linear m:mem, x:int, y:opn_mem)\r\n returns(my _r:regs);\r\n requires MemSrcOk(r, c, m, y);\r\n ensures _r.regs == r.regs[x := EvalMem(r, c, m, y)];\r\n ensures _r.efl == r.efl;\r\n ensures word(_r.regs[x]);\r\n\r\natomic procedure instr_Store(const my r:regs, const my c:core_state, linear m:mem, x:opn_mem, y:opn)\r\n returns(linear _m:mem);\r\n requires MemDstOk(r, c, m, x);\r\n ensures _m == MemUpdate1(r, c, m, x, Eval(r, y));\r\n ensures word(EvalMem(r, c, _m, x));\r\n\r\natomic procedure instr_LoadStack(my r:regs, const my c:core_state, const linear m:mem, x:int, y:opn_mem)\r\n returns(my _r:regs);\r\n requires SrcOkViaSegment(r, c, m, SS, y);\r\n ensures _r.regs == r.regs[x := EvalViaSegment(r, c, m, SS, y)];\r\n ensures _r.efl == r.efl;\r\n\r\natomic procedure instr_StoreStack(const my r:regs, const my c:core_state, linear m:mem, x:opn_mem, y:opn)\r\n returns(linear _m:mem);\r\n requires DstOkViaSegment(r, c, m, SS, x);\r\n ensures _m == StackUpdate1(r, c, m, x, Eval(r, y));\r\n\r\natomic procedure instr_Lea(my r:regs, x:int, y:opn_mem) returns(my _r:regs);\r\n requires word(EvalPtr(r, y));\r\n ensures _r.regs == r.regs[x := EvalPtr(r, y)];\r\n ensures _r.efl == r.efl;\r\n\r\natomic procedure instr_LeaUnchecked(my r:regs, x:int, y:opn_mem) returns(my _r:regs);\r\n ensures (exists v:int :: _r.regs == old(r.regs)[x := v]);\r\n ensures _r.efl == r.efl;\r\n\r\n// REVIEW: add more general support for signed arithmetic?\r\natomic procedure instr_LeaSignedIndex(my r:regs, x:int, base:int, scale:int, index:int, offset:opn)\r\n returns(my _r:regs);\r\n requires scale == 1 || scale == 2 || scale == 4 || scale == 8;\r\n requires word(r.regs[base] + scale * asSigned(r.regs[index]) + Eval(r, offset));\r\n ensures _r.regs == r.regs[x := r.regs[base] + scale * asSigned(r.regs[index]) + Eval(r, offset)];\r\n ensures _r.efl == r.efl;\r\n\r\n//// TODO: the Ro instructions need to segment/page map!\r\n//// read and zero-extend 8 bits\r\n//atomic procedure instr_RoLoadU8(linear s:state, x:int, y:opn_mem) returns(linear _s:state);\r\n// requires DstOk(x);\r\n// requires inRo(EvalPtr(r, y), 1);\r\n// ensures word(regs[x]);\r\n// ensures _s == InsUpdate1(me, s, x, roU8(EvalPtr(r, y)), s._cores[me]._efl);\r\n//\r\n//// read and sign-extend 8 bits\r\n//atomic procedure instr_RoLoadS8(linear s:state, x:int, y:opn_mem) returns(linear _s:state);\r\n// requires DstOk(x);\r\n// requires inRo(EvalPtr(r, y), 1);\r\n// ensures word(regs[x]);\r\n// ensures (exists v:int:: asSigned(v) == roS8(EvalPtr(r, y))\r\n// && _s == InsUpdate1(me, s, x, v, s._cores[me]._efl));\r\n//\r\n//// read and zero-extend 16 bits\r\n//atomic procedure instr_RoLoadU16(linear s:state, x:int, y:opn_mem) returns(linear _s:state);\r\n// requires DstOk(x);\r\n// requires inRo(EvalPtr(r, y), 2);\r\n// ensures word(regs[x]);\r\n// ensures _s == InsUpdate1(me, s, x, roU16(EvalPtr(r, y)), s._cores[me]._efl);\r\n//\r\n//// read and sign-extend 16 bits\r\n//atomic procedure instr_RoLoadS16(linear s:state, x:int, y:opn_mem) returns(linear _s:state);\r\n// requires DstOk(x);\r\n// requires inRo(EvalPtr(r, y), 2);\r\n// ensures word(regs[x]);\r\n// ensures (exists v:int:: asSigned(v) == roS16(EvalPtr(r, y))\r\n// && _s == InsUpdate1(me, s, x, v, s._cores[me]._efl));\r\n//\r\n//atomic procedure instr_RoLoad32(linear s:state, x:int, y:opn_mem) returns(linear _s:state);\r\n// requires DstOk(x);\r\n// requires inRo(EvalPtr(r, y), 4);\r\n// ensures word(regs[x]);\r\n// ensures _s == InsUpdate1(me, s, x, ro32(EvalPtr(r, y)), s._cores[me]._efl);\r\n\r\n//- Used to check linearity in translation of \"if(Jcc(r.efl)) { goto L; }\" and procedure calls\r\natomic procedure boogie_CheckJcc(const my r:regs);\r\natomic procedure boogie_CheckCall(const my r:regs);\r\n\r\nfunction ReturnToCaller(r:regs):ReturnTo { \r\n#ifdef x64\r\n ReturnToAddr64(r.regs[TMP1], r.regs[TMP2])\r\n#else\r\n ReturnToAddr32(r.regs[TMP1])\r\n#endif\r\n}\r\n\r\n//- Read eip of next instruction (used to model call instruction)\r\n//- A call instruction consists of:\r\n//- - esp := SubNoFlags(esp, 4) for x86 or esp := SubNoFlags(esp, 8) for x64\r\n//- - TMP1 := MovNextEip()\r\n//- - StoreStack(esp, TMP1)\r\n//- - Boogie call to the procedure\r\n//- In x64 keep track of both words of RIP\r\n#ifdef x64\r\n atomic procedure instr_MovNextEip64(my r:regs, x:int, y:int) returns(my _r:regs);\r\n ensures (exists nextEipLow:int, nextEipHigh:int :: _r.regs == r.regs[x := nextEipLow][y := nextEipHigh]);\r\n ensures _r.efl == r.efl;\r\n#else\r\n atomic procedure instr_MovNextEip32(my r:regs, x:int) returns(my _r:regs);\r\n ensures (exists nextEip:int :: _r.regs == r.regs[x := nextEip]);\r\n ensures _r.efl == r.efl;\r\n#endif\r\n\r\n//- A return instruction consists of:\r\n//- - TMP1 := LoadStack(esp)\r\n//- - esp := AddNoFlags(esp, 4)\r\n//- - Ret()\r\n//- - Boogie return\r\n//- Ret requires that the procedure returns to whoever called it\r\n//- (i.e. call/return is last-in, first-out). It does not\r\n//- require that the stack pointer be the same as before.\r\n#ifdef x64\r\natomic procedure instr_Ret(const my r:regs);\r\n requires RET == ReturnToAddr64(r.regs[TMP1], r.regs[TMP2]);\r\n#else\r\n atomic procedure instr_Ret(const my r:regs);\r\n requires RET == ReturnToAddr32(r.regs[TMP1]);\r\n#endif\r\n\r\n// An iret instruction consists of a call to IRet, which\r\n// models popping the 3 words eip, cs, eflags.\r\n// Example:\r\n// call $State := instr_IRet($State); return;\r\n// Needs to discuss the effect on CS, in particular, that the shadow descriptor is updated from memory\r\n// Also, someone needs to care about CS for that matter and this to be sound\r\n//atomic procedure instr_IRet(linear s:state) returns(linear _s:state);\r\n// requires MemSrcOk(r, c, s, OMem(MReg(ESP, 0)));\r\n// requires MemSrcOk(r, c, s, OMem(MReg(ESP, 4)));\r\n// requires MemSrcOk(r, c, s, OMem(MReg(ESP, 8)));\r\n// requires RET == ReturnToInterrupted(\r\n// EvalMem(r, c, s, OMem(MReg(ESP, 0))),\r\n// EvalMem(r, c, s, OMem(MReg(ESP, 4))),\r\n// EvalMem(r, c, s, OMem(MReg(ESP, 8))));\r\n// ensures _s == InsUpdate1(me, \r\n// s,\r\n// OReg(ESP),\r\n// s._cores[me]._regs[ESP]+12,\r\n// s._cores[me]._efl);\r\n\r\n//- Read time-stamp counter (cycle counter)\r\natomic procedure instr_Rdtsc(my r:regs) returns(my _r:regs);\r\n ensures (exists t1:int, t2:int :: word(t1) && word(t2) && _r.regs == r.regs[EAX := t1][EDX := t2]);\r\n ensures _r.efl == r.efl;\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- Declassification\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nfunction declassified(lg:int, rg:int, l:int, r:int):bool;\r\nfunction fun_declassified(lg:int, rg:int, l:int, r:int):bool { declassified(lg, rg, l, r) } //- Dafny-friendly name\r\n\r\n//- Convert a declassified word into a public word\r\natomic procedure declassify(my r:regs, x:int, g:int) returns (my _r:regs);\r\n requires relation(declassified(left(g), right(g), left(r.regs[x]), right(r.regs[x])));\r\n ensures _r.regs == r.regs[x := g];\r\n ensures public(_r.regs[x]);\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- SEGMENTS AND PAGES\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\ntype SegmentDescriptor = SegmentDescriptor(segBase:int, segType:int);\r\ntype SegmentRegister = SegmentRegister(index:int, descriptor:SegmentDescriptor);\r\n\r\nconst ?SegmentDescriptorSize:int := 8;\r\nconst ?SegmentDescriptorTypeData:int := 2;\r\nconst ?SegmentDescriptorTypeCode:int := 8;\r\n\r\nfunction ValidSegmentDescriptor(descriptor:SegmentDescriptor):bool\r\n{\r\n (descriptor.segType == ?SegmentDescriptorTypeData && word(descriptor.segBase))\r\n || descriptor.segType == ?SegmentDescriptorTypeCode\r\n}\r\n\r\nfunction SegmentDescriptorWord0(descriptor:SegmentDescriptor):int\r\n{\r\n or(shl(descriptor.segBase, 16), 0xffff)\r\n}\r\n\r\n// TODO: Bit-field manipulation \r\nfunction SegmentDescriptorWord1(descriptor:SegmentDescriptor):int\r\n{\r\n or( and(descriptor.segBase, 0xff000000), //- Upper 8 bits of base are upper 8 bits of the word\r\n or( shr(and(descriptor.segBase, 0x00ff0000),16), //- Next 8 bits of base are the lower 8 bits of the word\r\n //- Middle 16 bits of the word are the following flags:\r\n //- G = 1, D/B = 1, L = 0, AVL = 0, SegLimit = 0xf, P=1, DPL=00, S=1 (1=code/data,0=system), Type=0x2=Data\r\n shl(or(0xCF90, descriptor.segType), 8) //- 0xCF90 = binary 1100111110010000\r\n )\r\n )\r\n}\r\n\r\nfunction ValidSegmentSelector(register:int, index:int):bool\r\n{\r\n register == shl(index, 3) //- Sets TI bit to 0 for GDT, and RPL to 0\r\n}\r\n\r\n//function ValidSegmentRegister(register:SegmentRegister):bool\r\n//{\r\n// ValidSegmentDescriptor(register.descriptor)\r\n//}\r\n\r\nfunction ValidGdtDescriptor(gdt_regs:GDT_regs, index:int, descriptor:SegmentDescriptor, mem:mem):bool\r\n{\r\n 0 < index && index < gdt_regs.GDT_len\r\n && ValidSegmentDescriptor(descriptor)\r\n && SegmentDescriptorWord0(descriptor) == mem.map[gdt_regs.GDT_base + index * ?SegmentDescriptorSize]\r\n && SegmentDescriptorWord1(descriptor) == mem.map[gdt_regs.GDT_base + index * ?SegmentDescriptorSize + 4] \r\n}\r\n\r\n//- Sample usage:\r\n//- call core := instr_ActivateDataSelector(r, core, state, index, descriptor, eax, DS);\r\natomic procedure instr_ActivateDataSelector(const my r:regs, my c:core_state, const linear m:mem,\r\n index:int, descriptor:SegmentDescriptor, srcRegister:int, dstRegister:int)\r\n returns(my _c:core_state);\r\n requires ValidSegmentSelector(r.regs[srcRegister], index);\r\n requires ValidGdtDescriptor(c.gdt_regs, index, descriptor, m);\r\n requires descriptor.segType == ?SegmentDescriptorTypeData;\r\n requires SegRegOk(dstRegister) && dstRegister != CS;\r\n //ensures ValidSegmentRegister(SegmentRegister(index, descriptor));\r\n ensures _c == core_state(c.cregs, c.gdt_regs,\r\n c.seg_regs[dstRegister := SegmentRegister(index, descriptor)], c.caches);\r\n // c[_seg_regs := c._seg_regs[dstRegister := SegmentRegister(index, descriptor)] );\r\n\r\n//// Copies the value in a data segment selector into an ordinary register\r\n//atomic procedure instr_ReadDataSelector(linear s:state, srcRegister:int, dstRegister:int)\r\n// returns (linear _s:state);\r\n// requires SegRegOk(srcRegister) && srcRegister != CS;\r\n// ensures regs == old(regs)[dstRegister := ???];\r\n// ensures core_state == old(core_state);\r\n////[ckh] TODO: correct srcRegister: ensures _s == InsUpdate1(me, s, dstRegister, s._cores[me]._regs[srcRegister], s._cores[me]._efl);\r\n\r\n// Not sure what you would use this for, since you activate CS via a task switch or a jump, etc, not via mov eax cs\r\n//procedure ActivateCodeSelector($index:int, $descriptor:SegmentDescriptor, $srcRegister:int);\r\n// requires ValidSegmentSelector($srcRegister, $index);\r\n// requires ValidGdtDescriptor(s._cores[me]._gdt_regs, $index, $descriptor, $Mem);\r\n// requires $descriptor.segType == ?SegmentDescriptorTypeCode;\r\n// modifies $Cs;\r\n// ensures $Cs == SegmentRegister($index, $descriptor);\r\n// ensures ValidSegmentRegister($Cs);\r\n \r\n// procedure FetchSelector($register:SegmentRegister) returns ($index:int);\r\n\r\nfunction GdtParamsWord0(base:int, len:int):int\r\n{\r\n or(shl(base, 16), len * ?SegmentDescriptorSize)\r\n}\r\n\r\nfunction GdtParamsWord1(base:int, len:int):int\r\n{\r\n shr(base, 16)\r\n}\r\n\r\n//- len is specified in number of GDT entries, even though Intel expects it in bytes\r\n// TODO: break into micro-instructions\r\natomic procedure instr_LoadGDT(const my r:regs, my c:core_state, const linear m:mem, base:int, len:int, addr:opn_mem)\r\n returns(my _c:core_state);\r\n requires 0 <= len && len < 8192;\r\n requires word(base);\r\n requires base >= ?memLo && base + len * ?SegmentDescriptorSize <= ?memHi;\r\n requires PhysPtrOk(m, EvalPtr(r, addr)) && PhysPtrOk(m, EvalPtr(r, addr) + 4);\r\n requires GdtParamsWord0(base, len) == m.map[EvalPtr(r, addr)];\r\n requires GdtParamsWord1(base, len) == m.map[EvalPtr(r, addr) + 4];\r\n ensures _c == core_state(c.cregs, GDT_regs(base, len), c.seg_regs, c.caches);\r\n\r\n//-///////////////////////////////////////////////////////////////////////////////\r\n//- Protected Memory\r\n//- Note that Intel refers to a general pointer value as a \"logical\" address\r\n//- Segmentation transforms logical addresses into \"linear\" addresses,\r\n//- and paging (if enabled) transforms linear addresses into physical addresses\r\n//-///////////////////////////////////////////////////////////////////////////////\r\n\r\nconst ?User:bool := true;\r\nconst ?System:bool := false;\r\nconst ?Write:bool := true;\r\nconst ?Read:bool := false;\r\nconst ?Present:bool := true;\r\nconst ?Absent:bool := false;\r\n\r\n//- Base should be the full ptr value (including lower 12 bits of 0s)\r\ntype PageEntry = PageEntry(base:int, user:bool, write:bool, present:bool);\r\n\r\n// If you add a field, need to update the ensures clause of EnablePaging\r\n//type CR0 = CR0(PE:bool, PG:bool, WP:bool); // Protection enabled, Paging Enabled\r\n\r\ntype <>;\r\ntype <>; //- Creates a ternary bool value. Allows us to require Foo() != NULL, and then ensure Foo() == true\r\ntype <>;\r\ntype <>;\r\n\r\n//- Relevant CR0 bit positions\r\nconst ?CR0_paging_enabled:int := 31;\r\nconst ?CR0_write_protect:int := 16;\r\nconst ?CR0_protection_enabled:int := 0;\r\n\r\nfunction paging_enabled(c:core_state):bool\r\n{\r\n GetBit(?CR0_paging_enabled, c.cregs[CR0])\r\n}\r\n\r\n//- Requires protection is enabled, paging isn't\r\nfunction ValidPrePagingState(CR0:int):bool\r\n{\r\n GetBit(?CR0_protection_enabled, CR0)\r\n && !GetBit(?CR0_paging_enabled, CR0)\r\n && !GetBit(?CR0_write_protect, CR0) //- Supervisor can write to any page\r\n}\r\n\r\n//- Ensures that you can only write modified versions of existing CR0 values\r\nfunction fresh_CR0_val(val:int):bool;\r\n\r\natomic procedure instr_ReadCR0(my r:regs, const my c:core_state, dstReg:int) returns(my _r:regs);\r\n ensures fresh_CR0_val(r.regs[dstReg]);\r\n ensures _r.regs == r.regs[dstReg := c.cregs[CR0]]; //- modifies efl\r\n ensures word(_r.regs[dstReg]);\r\n\r\n//- Currently, only allowed to use this to enable paging\r\natomic procedure instr_WriteCR0(my r:regs, my c:core_state, newCR0:opn)\r\n returns(my _r:regs, my _c:core_state);\r\n requires word(Eval(r, newCR0));\r\n requires ValidPrePagingState(c.cregs[CR0]);\r\n requires (exists x:int :: { fresh_CR0_val(x) }\r\n (Eval(r, newCR0) == SetBit(?CR0_paging_enabled, x)) && fresh_CR0_val(x));\r\n ensures _r.regs == r.regs; //- modifies efl\r\n ensures _c == core_state(c.cregs[CR0 := SetBit(?CR0_paging_enabled, c.cregs[CR0])],\r\n c.gdt_regs, c.seg_regs, c.caches);\r\n\r\n//-/////////////////////////////////////////////////////\r\n//- Protected memory load\r\n//-/////////////////////////////////////////////////////\r\n\r\nfunction LogicalLoad(segReg:SegmentRegister, cr0_pg:bool, mem:mem, TLB:[int][TLB_label]PageEntry, cacheLabel:TLB_label, user:bool, ptr:int): <> \r\n{\r\n let linear_addr:int := SegmentMap(segReg, ptr) in\r\n LinearLoad(cr0_pg, mem, linear_addr, user, TLB, cacheLabel)\r\n\r\n// if SegmentMap(segReg, ptr) != <>() &&\r\n// LinearLoad($CR0.PG, s._mem, SegmentMap(segReg, ptr).<>, user, $TLB, $TLB_activeLabel) != <>()\r\n// then\r\n// LinearLoad($CR0.PG, s._mem, SegmentMap(segReg, ptr).<>, user, $TLB, $TLB_activeLabel);\r\n// else \r\n// <>()\r\n}\r\n\r\n//// REVIEW: Is a single $TLB_activeLabel sufficient? What if there's an implied instruction load via a different label? \r\n//// Read a word from segmented memory\r\n//// REVIEW: Should we restructure so the PhysLoad is done on the result of paging application in the ensures below?\r\n\r\nfunction LogicalStore(segReg:SegmentRegister, cr0_pg:bool, mem:mem, TLB:[int][TLB_label]PageEntry, cacheLabel:TLB_label, user:bool, ptr:int, val:int):<>\r\n{\r\n let linear_addr:int := SegmentMap(segReg, ptr) in\r\n LinearStore(cr0_pg, mem, linear_addr, user, TLB, cacheLabel, val)\r\n}\r\n\r\nfunction SegmentMap(segReg:SegmentRegister, ptr:int):int\r\n{\r\n segReg.descriptor.segBase + ptr\r\n// if ValidSegmentRegister($segReg) then\r\n// <>($segReg.descriptor.segBase + $ptr)\r\n// else\r\n// <>()\r\n}\r\n\r\nfunction LinearLoad(pagingEnabled:bool, mem:mem, ptr:int, user:bool, TLB:[int][TLB_label]PageEntry, cacheLabel:TLB_label):<>\r\n{\r\n if pagingEnabled then\r\n let <> memAddr:int := PageMap(ptr, user, ?Read, TLB, cacheLabel) in\r\n LoadPhysical(mem, memAddr)\r\n else\r\n LoadPhysical(mem, ptr)\r\n}\r\n\r\nfunction LinearStore(pagingEnabled:bool, mem:mem, ptr:int, user:bool, TLB:[int][TLB_label]PageEntry, cacheLabel:TLB_label, val:int):<>\r\n{\r\n if pagingEnabled then\r\n let <> memAddr:int := PageMap(ptr, user, ?Write, TLB, cacheLabel) in\r\n StorePhysical(mem, memAddr, val)\r\n else\r\n StorePhysical(mem, ptr, val)\r\n}\r\n\r\nfunction PageMap(ptr:int, user:bool, write:bool, TLB:[int][TLB_label]PageEntry, cacheLabel:TLB_label):<>\r\n{\r\n let cpte:PageEntry := TLB[PageNumber(ptr)][cacheLabel] in\r\n if cpte.present\r\n && (user == ?System || !write || cpte.write == ?Write)\r\n && (user == ?System || cpte.user == ?User)\r\n then\r\n <>(or(cpte.base, PhysOffset(ptr)))\r\n else\r\n <>()\r\n}\r\n\r\n//- The top 20 bits (bits 31:12) of the memory address are used to index into the TLB\r\nfunction PageNumber(ptr:int):int\r\n{\r\n shr(ptr, 12)\r\n}\r\n\r\n//- The top 10 bits (bits 31:22) of the memory address are used to index into the PDE cache \r\nfunction PteNumber(ptr:int):int\r\n{\r\n shr(ptr, 22)\r\n}\r\n\r\nfunction IsUser(CPL:int):bool\r\n{\r\n CPL == 3\r\n}\r\n\r\n//-/////////////////////////////////////////////////////\r\n//- TLB updates\r\n//-/////////////////////////////////////////////////////\r\n\r\n// TODO: Must call this to model processor's unpredictable behavior w.r.t. paging caches <<<<<<<<<<<<<<<<<<<<<<<<\r\n//-atomic procedure instr_HavocPagingCaches(linear m:mem, c:core_state) returns(linear _m:mem);\r\n//- requires c == core_state;\r\n//- requires paging_enabled(s._cores[me]) ==>\r\n//- (forall $ptr:int, $dlabel:DTLB_label :: \r\n//- word($ptr) ==> DTLBIsFreshWrtMemOneEntry(c._cregs[CR3], c._caches.DTLB, $dlabel, m, $ptr) != <>());\r\n//- requires paging_enabled(s._cores[me]) ==>\r\n//- (forall $ptr:int, $dlabel:DTLB_label, $label:TLB_label :: \r\n//- word($ptr) ==> TLBIsFreshWrtDTLBOneEntry(c._cregs[CR3], c._caches.DTLB, $dlabel, c._caches.TLB, $label, m, $ptr) != <>());\r\n//- modifies core_state;\r\n//- ensures paging_enabled(s._cores[me]) ==>\r\n//- core_state == core_state(c._cregs, c._gdt_regs, c._seg_regs,\r\n//- paging_caches(_s._cores[me]._ext._caches.TLB, _s._cores[me]._ext._caches.DTLB,\r\n//- c._caches.TLB_activeLabel, c._caches.DTLB_activeLabel));\r\n//- ensures paging_enabled(s._cores[me]) ==>\r\n//- (forall $ptr:int, $dlabel:DTLB_label ::\r\n//- _s._cores[me]._ext._caches.DTLB[PteNumber($ptr)][$dlabel] == c._caches.DTLB[PteNumber($ptr)][$dlabel] ||\r\n//- (word($ptr) ==> DTLBIsFreshWrtMemOneEntry(c._cregs[CR3], _s._cores[me]._ext._caches.DTLB, $dlabel, m, $ptr).<>));\r\n//- ensures paging_enabled(s._cores[me]) ==>\r\n//- (forall $ptr:int, $label:TLB_label, $dlabel:DTLB_label :: \r\n//- _s._cores[me]._ext._caches.TLB[PageNumber($ptr)][$label] == c._caches.TLB[PageNumber($ptr)][$label] ||\r\n//- (word($ptr) ==> TLBIsFreshWrtDTLBOneEntry(c._cregs[CR3], c._caches.DTLB, $dlabel,\r\n//- _s._cores[me]._ext._caches.TLB, $label, m, $ptr).<>));\r\n//-\r\n//-atomic procedure instr_WriteCR3(linear m:mem, newCR3:opn) returns(linear _m:mem);\r\n//- requires ValidCR3(Eval(r, newCR3));\r\n//- requires DTLBsAreFreshWrtMem(Eval(r, newCR3), core_state._caches.DTLB, m) != <>();\r\n//- requires TLBsAreFreshWrtMem(Eval(r, newCR3), core_state._caches.TLB, m) != <>();\r\n//- modifies efl, core_state;\r\n//- ensures core_state == (let c:core_state := old(core_state) in // Everything is the same, except CR3 and the TLB and DTLB\r\n//- core_state(c._cregs[CR3 := Eval(r, newCR3)], c._gdt_regs, c._seg_regs,\r\n//- paging_caches(_s._cores[me]._ext._caches.TLB, _s._cores[me]._ext._caches.DTLB,\r\n//- c._caches.TLB_activeLabel, c._caches.DTLB_activeLabel)));\r\n//- ensures DTLBsAreFreshWrtMem(Eval(r, newCR3), _s._cores[me]._ext._caches.DTLB, m) == <>(true);\r\n//- ensures TLBsAreFreshWrtMem(Eval(r, newCR3), _s._cores[me]._ext._caches.TLB, m) == <>(true);\r\n//-\r\n//-// Specifies the INVLPG instruction\r\n//-atomic procedure instr_InvalidatePagingCaches(linear m:mem, ptr:opn_mem) returns(linear _m:mem);\r\n//- requires word(EvalPtr(regs, ptr));\r\n//- requires DTLBsAreFreshWrtMem(core_state._cregs[CR3], core_state._caches.DTLB, m) != <>();\r\n//- requires TLBsAreFreshWrtMemOneEntry(core_state._cregs[CR3], core_state._caches.TLB, m, EvalPtr(regs, ptr)) != <>();\r\n//- modifies efl, core_state;\r\n//- ensures core_state == (let c:core_state := old(core_state) in // Everything is the same, except the TLB and DTLB\r\n//- core_state(c._cregs, c._gdt_regs, c._seg_regs,\r\n//- paging_caches(_s._cores[me]._ext._caches.TLB, _s._cores[me]._ext._caches.DTLB,\r\n//- c._caches.TLB_activeLabel, c._caches.DTLB_activeLabel)));\r\n//- ensures DTLBsAreFreshWrtMem(old(core_state)._cregs[CR3], _s._cores[me]._ext._caches.DTLB, m) == <>(true);\r\n//- ensures TLBsAreFreshWrtMemOneEntry(old(core_state)._cregs[CR3], _s._cores[me]._ext._caches.TLB, m, EvalPtr(r, ptr)) == <>(true);\r\n\r\nfunction DTLBsAreFreshWrtMem(CR3:int, DTLB:[int][DTLB_label]PageEntry, mem:mem):<>\r\n{\r\n if (forall ptr:int :: {DTLBsAreFreshWrtMemOneEntry(CR3, DTLB, mem, ptr)} {DTLB[PteNumber(ptr)]}\r\n word(ptr) ==> DTLBsAreFreshWrtMemOneEntry(CR3, DTLB, mem, ptr) != <>())\r\n then\r\n <>((forall ptr:int :: {DTLBsAreFreshWrtMemOneEntry(CR3, DTLB, mem, ptr)}\r\n word(ptr) ==> DTLBsAreFreshWrtMemOneEntry(CR3, DTLB, mem, ptr) == <>(true)))\r\n else\r\n <>()\r\n}\r\n\r\nfunction TLBsAreFreshWrtMem(CR3:int, TLB:[int][TLB_label]PageEntry, mem:mem):<>\r\n{\r\n if (forall ptr:int :: {TLB[PageNumber(ptr)]}\r\n word(ptr) ==> TLBsAreFreshWrtMemOneEntry(CR3, TLB, mem, ptr) != <>())\r\n then\r\n <>((forall ptr:int :: {TLB[PageNumber(ptr)]}\r\n word(ptr) ==> TLBsAreFreshWrtMemOneEntry(CR3, TLB, mem, ptr) == <>(true)))\r\n else\r\n <>()\r\n}\r\n\r\nfunction DTLBsAreFreshWrtMemOneEntry(CR3:int, DTLB:[int][DTLB_label]PageEntry, mem:mem, ptr:int):<>\r\n{\r\n if (forall x:DTLB_label :: {DTLBIsFreshWrtMemOneEntry(CR3, DTLB, x, mem, ptr)} {DTLB[PteNumber(ptr)][x]}\r\n DTLBIsFreshWrtMemOneEntry(CR3, DTLB, x, mem, ptr) != <>()) then\r\n <>((forall y:DTLB_label :: {DTLBIsFreshWrtMemOneEntry(CR3, DTLB, y, mem, ptr)} {DTLB[PteNumber(ptr)][y]}\r\n DTLBIsFreshWrtMemOneEntry(CR3, DTLB, y, mem, ptr) == <>(true)))\r\n else\r\n <>()\r\n}\r\n\r\nfunction TLBsAreFreshWrtMemOneEntry(CR3:int, TLB:[int][TLB_label]PageEntry, mem:mem, ptr:int):<>\r\n{\r\n if (forall x:TLB_label :: {TLB[PageNumber(ptr)][x]}\r\n TLBIsFreshWrtMemOneEntry(CR3, TLB, x, mem, ptr) != <>()) then\r\n <>((forall y:TLB_label :: {TLB[PageNumber(ptr)][y]}\r\n TLBIsFreshWrtMemOneEntry(CR3, TLB, y, mem, ptr) == <>(true)))\r\n else\r\n <>()\r\n}\r\n\r\nfunction DTLBIsFreshWrtMemOneEntry(CR3:int, DTLB:[int][DTLB_label]PageEntry, dlabel:DTLB_label, mem:mem, ptr:int):<>\r\n{\r\n let <> pdeWord:int := LoadPhysical(mem, PDEaddr(CR3, ptr)) in\r\n <>(PageEntryToWord(DTLB[PteNumber(ptr)][dlabel]) == pdeWord)\r\n}\r\n\r\nfunction TLBIsFreshWrtMemOneEntry(CR3:int, TLB:[int][TLB_label]PageEntry, label:TLB_label, mem:mem, ptr:int):<>\r\n{\r\n let <> pdeWord:int := LoadPhysical(mem, PDEaddr(CR3, ptr)) in\r\n let <> pde:PageEntry := WordToPageEntry(pdeWord) in\r\n TLBIsFreshWrtMemOneEntryHelper(TLB, label, mem, ptr, pde)\r\n}\r\n\r\nfunction TLBIsFreshWrtDTLBOneEntry(CR3:int, DTLB:[int][DTLB_label]PageEntry, dlabel:DTLB_label, TLB:[int][TLB_label]PageEntry, label:TLB_label, mem:mem, ptr:int):<>\r\n{\r\n let cpde:PageEntry := DTLB[PteNumber(ptr)][dlabel] in\r\n if cpde.present then\r\n TLBIsFreshWrtMemOneEntryHelper(TLB, label, mem, ptr, cpde)\r\n else\r\n <>()\r\n}\r\n\r\n//- This one expects that you've already retrieved the PDE in some fashion\r\nfunction TLBIsFreshWrtMemOneEntryHelper(TLB:[int][TLB_label]PageEntry, label:TLB_label, mem:mem, ptr:int, pde:PageEntry):<>\r\n{\r\n if pde.present then\r\n let <> pteWord:int := LoadPhysical(mem, PTEaddr(pde, ptr)) in\r\n let <> pte:PageEntry := WordToPageEntry(pteWord) in\r\n <>(TLB[PageNumber(ptr)][label] == CombinePerms(pte, pde))\r\n else\r\n <>(TLB[PageNumber(ptr)][label] == PageEntry(0, false, false, ?Absent)) //- All we care about is the absent bit\r\n}\r\n\r\nfunction CombinePerms(pte:PageEntry, pde:PageEntry):PageEntry\r\n{\r\n PageEntry(pte.base, pte.user && pde.user, pte.write && pde.write, pte.present)\r\n}\r\n\r\n//- size in bytes\r\nconst ?sizeofPDE:int := 4;\r\nconst ?sizeofPTE:int := 4;\r\n\r\nfunction PDEaddr(CR3:int, ptr:int):int\r\n{\r\n PageDirectoryBase(CR3) + mul(PageDirectoryOffset(ptr), ?sizeofPDE)\r\n}\r\n\r\nfunction PTEaddr(pde:PageEntry, ptr:int):int\r\n{\r\n pde.base + mul(PageTableOffset(ptr), ?sizeofPTE)\r\n}\r\n\r\n//-/////////////////////////////////////////////////////\r\n//- Functions that split a memory pointer into various \r\n//- offsets into the hierachical paging structures\r\n//-/////////////////////////////////////////////////////\r\n\r\nfunction PageEntryBase(ptr:int):int\r\n{\r\n ClearLSBs(12, ptr)\r\n}\r\n\r\nfunction PageDirectoryBase(CR3:int):int\r\n{\r\n PageEntryBase(CR3)\r\n}\r\n\r\n//- Top 10 bits index into the list of PDEs\r\nfunction PageDirectoryOffset(ptr:int):int\r\n{\r\n SelectLSBs(10, shr(ptr, 22)) //- Note that with 32 bits, the selectLSBs is actually a NO-OP. \r\n}\r\n\r\n//- Next 10 bits index into the list of PTEs pointed at by the PDE selected above\r\nfunction PageTableOffset(ptr:int):int\r\n{\r\n SelectLSBs(10, shr(ptr, 12))\r\n}\r\n\r\n//- Final 12 bits are an index into the physical 4096-byte page frame pointed at by the PTE selected above\r\nfunction PhysOffset(ptr:int):int\r\n{\r\n SelectLSBs(12, ptr)\r\n}\r\n\r\nconst ?PagingPATbitPos:int := 7;\r\nconst ?PagingPCDbitPos:int := 4;\r\nconst ?PagingPWTbitPos:int := 3;\r\nconst ?PagingUserBitPos:int := 2;\r\nconst ?PagingWriteBitPos:int := 1;\r\nconst ?PagingPresentBitPos:int := 0;\r\n\r\nfunction ValidCR3(cr3:int):bool\r\n{\r\n //- We require that PCD=0 and PWT=0\r\n GetBit(?PagingPCDbitPos, cr3) == false\r\n && GetBit(?PagingPWTbitPos, cr3) == false \r\n}\r\n\r\n//- Actual memory layout of a page entry\r\nfunction PageEntryToWord(pe:PageEntry):int\r\n{\r\n ClearBit(?PagingPATbitPos, //- Must be 0 for PDE. For PTE, it's the PAT bit. // REVIEW: This affects the memory type used. Is 0 okay?\r\n ClearBit(?PagingPCDbitPos, //- PCD\r\n ClearBit(?PagingPWTbitPos, //- PWT\r\n AssignBit(?PagingUserBitPos, pe.user,\r\n AssignBit(?PagingWriteBitPos, pe.write, \r\n AssignBit(?PagingPresentBitPos, pe.present,\r\n pe.base))))))\r\n}\r\n\r\nfunction WordToPageEntry(word:int):<>\r\n{\r\n if !GetBit(?PagingPATbitPos, word)\r\n && !GetBit(?PagingPCDbitPos, word)\r\n && !GetBit(?PagingPWTbitPos, word)\r\n then\r\n <>(PageEntry(\r\n ClearLSBs(12, word), \r\n GetBit(?PagingUserBitPos, word), \r\n GetBit(?PagingWriteBitPos, word), \r\n GetBit(?PagingPresentBitPos, word)))\r\n else\r\n <>()\r\n}\r\n\r\nfunction GetBit (i:int, val:int):bool { and(val, shl(1, i)) != 0 }\r\nfunction SetBit (i:int, val:int):int { or(val, shl(1, i)) }\r\nfunction ClearBit (i:int, val:int):int { and(val, neg(shl(1, i))) }\r\nfunction AssignBit(i:int, bit:bool, val:int):int { if bit then SetBit(i, val) else ClearBit(i, val) }\r\n//- Clears the lower amount bits of val\r\nfunction ClearLSBs (amount:int, val:int):int { and(val, neg(sub(shl(1, amount), 1))) }\r\n//- Clears all but the lower amount bits of val\r\nfunction SelectLSBs(amount:int, val:int):int { and(val, sub(shl(1, amount), 1)) }\r\n\r\n//-////////////////////////////////////////////////////////////\r\n//- Functions that represent direct access to physical memory \r\n//-////////////////////////////////////////////////////////////\r\n\r\nfunction LoadPhysical(mem:mem, ptr:int):<>\r\n{\r\n if PhysPtrOk(mem, ptr) then <>(mem.map[ptr])\r\n else <>()\r\n}\r\n\r\n// REVIEW: Should this require word($val)? \r\n// It appears all of the callers ensure it, but that seems brittle\r\nfunction StorePhysical(mem:mem, ptr:int, val:int):<>\r\n{\r\n if PhysPtrOk(mem, ptr) then <>(mem_update(mem, ptr, val))\r\n else <>()\r\n}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/AssemblySpec.imp.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\n//-\r\nmodule implementation AssemblySpec\r\n{\r\n\r\nimplementation memEmpty() returns(linear m:mem) {}\r\nimplementation memTransfer(linear src:mem, linear dst:mem, b:[int]bool) returns(linear _src:mem, linear _dst:mem) {}\r\nimplementation memDisjoint(const linear m1:mem, const linear m2:mem) {}\r\nimplementation memDomIsMemAddr(const linear m:mem, i:int) {}\r\nimplementation enableStatics(linear initState:InitStateMachine) returns (linear _initState:InitStateMachine, linear static_mem:mem) {}\r\nimplementation declassify(my r:regs, x:int, g:int) returns (my _r:regs) {}\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/Assembly_axioms.bpl", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- ASSEMBLY LANGUAGE\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//-///// Flag Handling ////////////\r\n\r\naxiom (forall f:int, x:int, y:int::{Je (Efl_Cmp(f, x, y))} Je (Efl_Cmp(f, x, y)) == (x == y));\r\naxiom (forall f:int, x:int, y:int::{Jne(Efl_Cmp(f, x, y))} Jne(Efl_Cmp(f, x, y)) == (x != y));\r\naxiom (forall f:int, x:int, y:int::{Jbe(Efl_Cmp(f, x, y))} Jbe(Efl_Cmp(f, x, y)) == (x <= y));\r\naxiom (forall f:int, x:int, y:int::{Jb (Efl_Cmp(f, x, y))} Jb (Efl_Cmp(f, x, y)) == (x < y));\r\naxiom (forall f:int, x:int, y:int::{Jae(Efl_Cmp(f, x, y))} Jae(Efl_Cmp(f, x, y)) == (x >= y));\r\naxiom (forall f:int, x:int, y:int::{Ja (Efl_Cmp(f, x, y))} Ja (Efl_Cmp(f, x, y)) == (x > y));\r\n\r\naxiom (forall f:int, x:int, y:int::{Cf (Efl_Add(f, x, y))} Cf (Efl_Add(f, x, y)) == (x + y >= WORD_HI));\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/BaseSpec.ifc.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface BaseSpec\r\n{\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- TRIGGERS\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//- Triggers for quantifiers\r\n//- We could use a single trigger for all values; the distinction between the\r\n//- various triggers below is just to help the prover run fast.\r\n\r\n//- TV is a trigger for values in general, including addresses.\r\nfunction{:expand false} TV(val:int):bool { true }\r\n\r\n//- TO is a trigger specifically for word offsets from addresses, where\r\n//- word offset n is byte offset 4 * n.\r\nfunction{:expand false} TO(wordOffset:int):bool { true }\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- WORDS\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//- i1 <= x < i2\r\nfunction between(i1:int, i2:int, x:int):bool { i1 <= x && x < i2 }\r\n\r\n//- valid 32-bit unsigned words\r\n//- word(i) <==> 0 <= i < 2^32\r\nconst WORD_HI:int; //- 2^32\r\nfunction word(val:int):bool { 0 <= val && val < WORD_HI }\r\natomic ghost procedure reveal_WORD_HI();\r\n ensures WORD_HI == 4294967296;\r\n\r\nfunction wrap32(val:int):int;\r\natomic ghost procedure reveal_wrap32(val:int);\r\n ensures wrap32(val) == val mod WORD_HI;\r\n\r\n//- converts 2's complement 32-bit val into signed integer\r\nfunction asSigned(val:int) returns(int);\r\n\r\nfunction{:expand false} add(i1:int, i2:int):int { i1 + i2 }\r\nfunction{:expand false} sub(i1:int, i2:int):int { i1 - i2 }\r\nfunction{:expand false} mul(i1:int, i2:int):int { i1 * i2 }\r\nfunction{:expand false} _div(i1:int, i2:int):int { i1 div i2 }\r\nfunction{:expand false} _mod(i1:int, i2:int):int { i1 mod i2 }\r\nfunction{:expand false} le(i1:int, i2:int):bool { i1 <= i2 }\r\nfunction{:expand false} lt(i1:int, i2:int):bool { i1 < i2 }\r\nfunction{:expand false} ge(i1:int, i2:int):bool { i1 >= i2 }\r\nfunction{:expand false} gt(i1:int, i2:int):bool { i1 > i2 }\r\nfunction neg (x:int):int;\r\nfunction and (x:int, y:int):int;\r\nfunction or (x:int, y:int):int;\r\nfunction xor (x:int, y:int):int;\r\nfunction shl (x:int, y:int):int;\r\nfunction shr (x:int, y:int):int;\r\nfunction rol (x:int, y:int):int;\r\nfunction ror (x:int, y:int):int;\r\n\r\nfunction int_bit(n:int, index:int):bool;\r\natomic ghost procedure reveal_int_bit(n:int, index:int);\r\n ensures int_bit(n, index) == (if (index > 0) then int_bit(n div 2, index - 1) else n mod 2 != 0);\r\n\r\natomic ghost procedure axiom_neg(x:int);\r\n ensures word(x) ==> word(neg(x));\r\n ensures (forall i:int::{int_bit(neg(x), i)} 0 <= i && i < 32 ==> int_bit(neg(x), i) == !int_bit(x, i));\r\natomic ghost procedure axiom_and(x:int, y:int);\r\n ensures word(x) && word(y) ==> word(and(x, y));\r\n ensures (forall i:int::{int_bit(and(x, y), i)} 0 <= i && i < 32 ==> int_bit(and(x, y), i) == (int_bit(x, i) && int_bit(y, i)));\r\natomic ghost procedure axiom_or (x:int, y:int);\r\n ensures word(x) && word(y) ==> word(or (x, y));\r\n ensures (forall i:int::{int_bit(or (x, y), i)} 0 <= i && i < 32 ==> int_bit(or (x, y), i) == (int_bit(x, i) || int_bit(y, i)));\r\natomic ghost procedure axiom_xor(x:int, y:int);\r\n ensures word(x) && word(y) ==> word(xor(x, y));\r\n ensures (forall i:int::{int_bit(xor(x, y), i)} 0 <= i && i < 32 ==> int_bit(xor(x, y), i) == (int_bit(x, i) != int_bit(y, i)));\r\natomic ghost procedure axiom_shl(x:int, y:int);\r\n ensures word(x) && word(y) ==> word(shl(x, y));\r\n ensures (forall i:int::{int_bit(shl(x, y), i)} 0 <= i && i < 32 ==> int_bit(shl(x, y), i) == (i - y >= 0 && int_bit(x, i - y)));\r\natomic ghost procedure axiom_shr(x:int, y:int);\r\n ensures word(x) && word(y) ==> word(shr(x, y));\r\n ensures (forall i:int::{int_bit(shr(x, y), i)} 0 <= i && i < 32 ==> int_bit(shr(x, y), i) == (i + y < 32 && int_bit(x, i + y)));\r\natomic ghost procedure axiom_rol(x:int, y:int);\r\n ensures word(x) && word(y) ==> word(rol(x, y));\r\n ensures (forall i:int::{int_bit(rol(x, y), i)} 0 <= i && i < 32 ==> int_bit(rol(x, y), i) == int_bit(x, (i - y) mod 32));\r\natomic ghost procedure axiom_ror(x:int, y:int);\r\n ensures word(x) && word(y) ==> word(ror(x, y));\r\n ensures (forall i:int::{int_bit(ror(x, y), i)} 0 <= i && i < 32 ==> int_bit(ror(x, y), i) == int_bit(x, (i + y) mod 32));\r\n\r\n//- null value(s)\r\nconst NULL:int := 0;\r\n\r\nfunction{:expand false} TVM(a:int, b:int):bool { true }\r\nfunction Mult(a:int, b:int):int;\r\nfunction implementation{TVM(a, b)} Mult(a:int, b:int):int { a * b }\r\n\r\nfunction{:expand false} TVD(a:int, b:int):bool { true }\r\nfunction Div(a:int, b:int):int;\r\nfunction implementation{TVD(a, b)} Div(a:int, b:int):int { a div b }\r\n\r\nfunction{:expand false} TVM3(a:int, b1:int, b2:int):bool { true }\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- PROCEDURES\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//- Where must the called procedure return to?\r\n//- (called procedure must return to RET:ReturnTo that was implicitly passed into the procedure)\r\ntype ReturnTo;\r\n//- Return to return address $eip via \"ret\" instruction\r\n#ifdef x64\r\n function ReturnToAddr64($eip_low:int, $eip_high:int) returns(ReturnTo);\r\n#else\r\n function ReturnToAddr32($eip:int) returns(ReturnTo);\r\n#endif\r\n//- Return to stack (eip, cs, eflags, ...) at $esp\r\nfunction ReturnToInterrupted($eip:int, $cs:int, $efl:int) returns(ReturnTo);\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- INITIALIZATION\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n// REVIEW: if we had a better way to initialize this to false, we could move it out of the spec\r\nvar init:bool;\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- LINEARITY\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n// TODO: when we start using linear maps, we probably won't need this:\r\natomic ghost procedure new_linear_int() returns(linear i:int);\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/BaseSpec.imp.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation BaseSpec\r\n{\r\n implementation reveal_WORD_HI() {}\r\n implementation reveal_wrap32(val:int) {}\r\n implementation reveal_int_bit(n:int, index:int) {}\r\n implementation axiom_neg(x:int) {}\r\n implementation axiom_and(x:int, y:int) {}\r\n implementation axiom_or (x:int, y:int) {}\r\n implementation axiom_xor(x:int, y:int) {}\r\n implementation axiom_shl(x:int, y:int) {}\r\n implementation axiom_shr(x:int, y:int) {}\r\n implementation axiom_rol(x:int, y:int) {}\r\n implementation axiom_ror(x:int, y:int) {}\r\n implementation new_linear_int() returns(i:int) {}\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/Base_axioms.bpl", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- WORDS\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\naxiom WORD_HI >= 100; // REVIEW: should we go ahead and set WORD_HI to exactly 2^32?\r\n\r\n// REVIEW: one would hope that this axiom is derivable from\r\n// Mult(a, b) == a * b, using b = b1 + b2, but Z3 couldn't seem to do it yet:\r\naxiom (forall a:int, b1:int, b2:int::{TVM3(a, b1, b2)} Mult(a, b1 + b2) == a * (b1 + b2));\r\n\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/BenchmarkApp/AppRequirements.ifc.stitch", "content": "//-private-import dafny_assembly_s;\r\n//-private-import dafny_be_sequences_s;\r\n//-private-import dafny_bytes_and_words_s;\r\n//-private-import dafny_Digest_s;\r\n//-private-import dafny_GCD_s;\r\n//-private-import dafny_hmac_common_s;\r\n//-private-import dafny_integer_sequences_s;\r\n//-private-import dafny_io_mem_s;\r\n//-private-import dafny_KeyGen_s;\r\n//-private-import dafny_MillerRabin_s;\r\n//-private-import dafny_power_s;\r\n//-private-import dafny_RandomNumberGen_s;\r\n//-private-import dafny_RandomTracing_s;\r\n//-private-import dafny_rfc4251_s;\r\n//-private-import dafny_round_s;\r\n//-private-import dafny_RSASpec_s;\r\n//-private-import dafny_seq_blocking_s;\r\n//-private-import dafny_sha_common_s;\r\n//-private-import dafny_sha1_s;\r\n//-private-import dafny_sha256_s;\r\n//-private-import dafny_tpm_device_s;\r\n requires fun_TPM__valid($ghost_TPM);\r\n requires fun_TPM__satisfies__integrity__policy($ghost_TPM);\r\n requires $ghost_IoMemPerm is Null;\r\n modifies $ghost_TPM;\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/BenchmarkService/AppRequirements.ifc.stitch", "content": "//-private-import dafny_assembly_s;\r\n//-private-import dafny_be_sequences_s;\r\n//-private-import dafny_bytes_and_words_s;\r\n//-private-import dafny_Digest_s;\r\n//-private-import dafny_GCD_s;\r\n//-private-import dafny_hmac_common_s;\r\n//-private-import dafny_integer_sequences_s;\r\n//-private-import dafny_io_mem_s;\r\n//-private-import dafny_KeyGen_s;\r\n//-private-import dafny_MillerRabin_s;\r\n//-private-import dafny_power_s;\r\n//-private-import dafny_RandomNumberGen_s;\r\n//-private-import dafny_RandomTracing_s;\r\n//-private-import dafny_seq_blocking_s;\r\n//-private-import dafny_sha_common_s;\r\n//-private-import dafny_sha1_s;\r\n//-private-import dafny_sha256_s;\r\n//-private-import dafny_tpm_device_s;\r\n//-private-import dafny_round_s;\r\n requires fun_TPM__valid($ghost_TPM);\r\n requires fun_TPM__satisfies__integrity__policy($ghost_TPM);\r\n requires $ghost_IoMemPerm is Null;\r\n modifies $ghost_TPM;\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/BitVector_axioms.bpl", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\n//module BitVectorSpec\r\n//{\r\n\r\n//- Bit vector definitions, exposing native bit-vector support\r\n\r\nfunction {:bvbuiltin \"bvadd\"} $add(x:bv32, y:bv32) returns(bv32);\r\nfunction {:bvbuiltin \"bvsub\"} $sub(x:bv32, y:bv32) returns(bv32);\r\nfunction {:bvbuiltin \"bvmul\"} $mul(x:bv32, y:bv32) returns(bv32);\r\nfunction {:bvbuiltin \"bvudiv\"} $div(x:bv32, y:bv32) returns(bv32);\r\nfunction {:bvbuiltin \"bvurem\"} $mod(x:bv32, y:bv32) returns(bv32);\r\nfunction {:bvbuiltin \"bvand\"} $and(x:bv32, y:bv32) returns(bv32);\r\nfunction {:bvbuiltin \"bvor\"} $or (x:bv32, y:bv32) returns(bv32);\r\nfunction {:bvbuiltin \"bvxor\"} $xor(x:bv32, y:bv32) returns(bv32);\r\nfunction {:bvbuiltin \"bvlshr\"} $shr(x:bv32, y:bv32) returns(bv32);\r\nfunction {:bvbuiltin \"bvshl\"} $shl(x:bv32, y:bv32) returns(bv32);\r\nfunction {:bvbuiltin \"bvnot\"} $neg(x:bv32) returns(bv32);\r\nfunction {:bvbuiltin \"bvule\"} $le (x:bv32, y:bv32) returns(bool);\r\nfunction {:bvbuiltin \"bvult\"} $lt (x:bv32, y:bv32) returns(bool);\r\nfunction {:bvbuiltin \"bvuge\"} $ge (x:bv32, y:bv32) returns(bool);\r\nfunction {:bvbuiltin \"bvugt\"} $gt (x:bv32, y:bv32) returns(bool);\r\n\r\nfunction{:expand false} TBV(b:bv32) returns(bool) { true }\r\n\r\n//- meaning undefined if !word(i)\r\nfunction B(i:int) returns(bv32);\r\nfunction I(b:bv32) returns(int);\r\n\r\n//}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/DafnyCCTest/AppRequirements.ifc.stitch", "content": "" }, { "path": "ironclad-apps/src/Trusted/Spec/DiffPriv/AppRequirements.ifc.stitch", "content": "//-private-import dafny_assembly_s;\r\n//-private-import dafny_be_sequences_s;\r\n//-private-import dafny_bytes_and_words_s;\r\n//-private-import dafny_Digest_s;\r\n//-private-import dafny_GCD_s;\r\n//-private-import dafny_hmac_common_s;\r\n//-private-import dafny_integer_sequences_s;\r\n//-private-import dafny_io_mem_s;\r\n//-private-import dafny_KeyGen_s;\r\n//-private-import dafny_MillerRabin_s;\r\n//-private-import dafny_power_s;\r\n//-private-import dafny_RandomNumberGen_s;\r\n//-private-import dafny_RandomTracing_s;\r\n//-private-import dafny_rfc4251_s;\r\n//-private-import dafny_round_s;\r\n//-private-import dafny_RSASpec_s;\r\n//-private-import dafny_seq_blocking_s;\r\n//-private-import dafny_sha_common_s;\r\n//-private-import dafny_sha1_s;\r\n//-private-import dafny_sha256_s;\r\n//-private-import dafny_tpm_device_s;\r\n//-private-import dafny_CommonState_s;\r\n//-private-import dafny_DiffPriv_s;\r\n//-private-import dafny_StateMachine_s;\r\n//-private-import dafny_Database_s;\r\n//-private-import dafny_Mapper_s;\r\n//-private-import dafny_Math_s;\r\n//-private-import dafny_Noise_s;\r\n//-private-import dafny_SumReducer_s;\r\n requires fun_TPM__valid($ghost_TPM);\r\n requires fun_TPM__satisfies__integrity__policy($ghost_TPM);\r\n requires $ghost_IoMemPerm is Null;\r\n requires TPM#CommonStateMachine_ctor($ghost_current_common_state) == $ghost_TPM;\r\n requires !initialized#CommonStateMachine_ctor($ghost_current_common_state);\r\n requires !initialized#DiffPrivStateMachine_ctor($ghost_current_diffpriv_state);\r\n modifies $ghost_TPM;\r\n modifies $ghost_current_common_state;\r\n modifies $ghost_current_diffpriv_state;\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/Entry.ifc.basm.stitch", "content": "#line 1 Entry.ifc.basm.stitch\r\n//\r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n//\r\n\r\n//readonly var $ghost_sample_index:int;\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n//\r\n// This procedure is the entry point from the boot loader/SKINIT\r\n//\r\n//////////////////////////////////////////////////////////////////////////////\r\n// \r\n// After an SKINIT (see Section 15.27 in AMD's Volume 2: System Programming): \r\n// - eax points to the beginning of the SL\r\n// - At the beginning of the code, there is a 16-bit pointer to our entry point,\r\n// followed by a 16-bit length field that indicates the end of our code and static data\r\n// - esp points at eax + 64K\r\n// - CS and SS are set to full, flat mappings\r\n\r\n#ifdef AppLoader\r\nprocedure LoaderEntryPoint(\r\n my r:regs,\r\n my core_state:core_state,\r\n linear initState:InitStateMachine,\r\n linear mem:mem,\r\n linear io:IOState,\r\n linear dev_states:DEV_StateMachines,\r\n $sl_len:int, $cpu_info:int);\r\n requires initState is EntryPoint;\r\n requires ?CodeBase == r.regs[EAX];\r\n requires Aligned(?CodeBase) && ?CodeBase mod 0x10000 == 0; // SLB must be 64K aligned\r\n // Spec says $sl_len <= 65535 = 64K-1, but we have a more stringent requirement \r\n // Assembler must guarantee the SL is only 35K, to allow 8K for stack and heap use\r\n requires ?memLo == ?CodeBase + 58*1024; // Usable memory between end of the SL and the end of the SLB\r\n requires (forall i:int::{memAddr(i)}{mem.dom[i]} \r\n ?memLo <= i && i < ?CodeBase + 0x10000 <==> mem.dom[i]); // Can only access the 64K of SKINIT-protected memory\r\n requires r.regs[ESP] == add(?CodeBase, 0x10000);\r\n requires ValidPrePagingState(core_state.cregs[CR0]);\r\n requires core_state.seg_regs[SS].descriptor.segBase == 0 && \r\n core_state.seg_regs[SS].descriptor.segType == ?SegmentDescriptorTypeData;\r\n requires ?memHi == 0x08000000; // Eventually, DEV permits 128 MB, but note mem.dom above is restricted to 64K initially\r\n requires (forall i:int::{memAddr(i)} ?memLo <= i && i < ?memHi ==> memAddr(i));\r\n requires me == 0; // Must be run on the bootstrap processor\r\n requires !init;\r\n\r\n // Trusted code has not yet done anything to the PCI configuration\r\n requires (forall i:int::{PciConfigState#PciState(_pci#IOState(io))[i]} io._pci.PciConfigState[i] == 0); // TODO: fix triggering\r\n\r\n // Trusted code has not yet configured any of the DEVs beyond what SKINIT provides\r\n requires (forall i:int::{ dev_states.states[i] } dev_states.states[i] is Init); \r\n\r\n // Same number of IO events initially\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n\r\n // Initialize ghost TPM state\r\n requires fun_TPM__valid($ghost_TPM);\r\n requires fun_TPM__satisfies__integrity__policy($ghost_TPM);\r\n requires $ghost_IoMemPerm is Null;\r\n requires fun_Seq__Equal___Seq___int(PCR_19#TPM_build($ghost_TPM), fun_Seq__Empty___Seq___int());\r\n\r\n modifies init;\r\n modifies $commonVars, $gcVars, $Time;\r\n modifies $IdtMem, $IdtMemOk, $IdtOk;\r\n modifies $TimerSeq, $TimerFreq, $PicSeq;\r\n modifies ptMem;\r\n modifies $ghost_IoMemPerm;\r\n modifies $ghost_TPM;\r\n#endif\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n//\r\n// This procedure is the entry point for normal apps launched via AppLoader\r\n// WARNING: DO NOT ADD ANY REQUIREMENTS TO THIS PROCEDURE!!!\r\n// If you have general requirements, add them to AppLoaderContract.ifc.basm.\r\n//\r\n//////////////////////////////////////////////////////////////////////////////\r\n#ifndef AppLoader\r\nprocedure AppEntryPoint(\r\n my r:regs,\r\n my core_state:core_state,\r\n linear initState:InitStateMachine,\r\n linear mem:mem,\r\n linear code_mem:mem,\r\n linear io:IOState,\r\n app_entry:int,\r\n app_code_base:int,\r\n code_word_seq:Seq___int\r\n );\r\n requires AppLoaderContractGeneric(me, init, r, core_state, initState, mem, code_mem, io, app_entry, app_code_base, code_word_seq);\r\n\r\n // Same number of IO events initially. Must be here instead of AppLoaderContract, since we can't use public in functions\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n\r\n\r\n//- SENTINEL_APP_SPECIFIC_GOES_HERE\r\n\r\n modifies init;\r\n modifies $commonVars, $gcVars, $Time;\r\n modifies $IdtMem, $IdtMemOk, $IdtOk;\r\n modifies $TimerSeq, $TimerFreq, $PicSeq;\r\n modifies ptMem;\r\n modifies $ghost_IoMemPerm;\r\n ensures false;\r\n\r\n#endif\r\n\r\n\r\n\r\n// TODO add this interrupt handler here to allow reasoning about syscalls and preemption of user-mode code.\r\n/*\r\nprocedure InterruptHandler(linear s:state, $_stackState:[int]StackState, $ebp:int, $esp:int, $eip:int) returns(linear statics:mem, linear io:IOState);\r\n requires word(eax) && word(ebx) && word(ecx) && word(edx) && word(esi) && word(edi) && word(ebp) && word(esp);\r\n requires isStack($S) && $StackState[$S] == StackRunning;\r\n \r\n requires SpRequire($S, esp, 12);\r\n requires $_stackState == $StackState\r\n [$S := StackInterrupted(eax, ebx, ecx, edx, esi, edi, ebp, esp + 12, $Mem[esp], $Mem[esp + 4], $Mem[esp + 8])]\r\n [?InterruptStack := StackRunning];\r\n requires (StackStateTag($StackState[?InterruptStack]) == ?STACK_YIELDED ==>\r\n $RET == ReturnToAddr($eip)\r\n && $StackState[?InterruptStack] == StackYielded($ebp, $esp, $eip));\r\n// modifies eax, ebx, ecx, edx, esi, edi, ebp, esp;\r\n modifies $commonVars, $gcVars, $Time, core, $part, mems, $sepVars;\r\n// modifies StackCheck;\r\n ensures StackCheckInv(?InterruptStack, StackCheck);\r\n ensures (StackStateTag($StackState[?InterruptStack]) == ?STACK_YIELDED ==>\r\n NucleusInv(?InterruptStack, $_stackState, $toAbs, $AbsMem, $commonVars, $gcVars, state, core, $part, mems, $sepVars, $StacksFrames, $IoMmuEnabled, $PciConfigState, $ioVars)\r\n && ebp == $ebp\r\n && esp == $esp);\r\n*/\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/ExtendedAssembly.ifc.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface ExtendedAssembly\r\n{\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//-\r\n//- The AppLoader calls this instruction to jump into the real code\r\n//-\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n#ifdef AppLoader\r\natomic procedure instr_Launch(\r\n my r:regs,\r\n my core_state:core_state,\r\n linear initState:InitStateMachine,\r\n linear mem:mem,\r\n linear code_mem:mem,\r\n linear io:IOState,\r\n app_entry:int,\r\n app_code_base:int,\r\n code_word_seq:Seq___int\r\n );\r\n requires AppLoaderContractGeneric(me, init, r, core_state, initState, mem, code_mem, io, app_entry, app_code_base, code_word_seq);\r\n\r\n //- Same number of IO events initially. Must be here instead of AppLoaderContract, since we can't use public in functions\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n\r\n //- PCR19 must have been extended with SHA1([app_code_base, app_entry] + app_code_words)\r\n //- Other apps don't need to know this is what we put in PCR 19\r\n requires (let hash_input:Seq___int := fun_BEWordSeqToBitSeq(\r\n fun_Seq__Append___int(fun_Seq__Build___int(fun_Seq__Build___int(fun_Seq__Empty___int(), app_code_base), app_entry), code_word_seq)) in \r\n //fun_Seq__Length___int(hash_input) < fun_power2(64) && (fun_IsBitSeq(hash_input))) && \r\n fun_Seq__Equal___Seq___int((PCR_19#TPM_build($ghost_TPM)), fun_Seq__Build___Seq___int(fun_Seq__Empty___Seq___int(), fun_BEWordSeqToByteSeq(fun_SHA1(hash_input)))));\r\n\r\n ensures false;\r\n#endif\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/ExtendedAssembly.imp.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation ExtendedAssembly\r\n{\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/IntSpec.ifc.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface IntSpec\r\n{\r\n\r\n//- Bit vector definitions, hiding native bit-vector support\r\n\r\nfunction $add(x:bv32, y:bv32) returns(bv32);\r\nfunction $sub(x:bv32, y:bv32) returns(bv32);\r\nfunction $mul(x:bv32, y:bv32) returns(bv32);\r\nfunction $div(x:bv32, y:bv32) returns(bv32);\r\nfunction $mod(x:bv32, y:bv32) returns(bv32);\r\nfunction $and(x:bv32, y:bv32) returns(bv32);\r\nfunction $or (x:bv32, y:bv32) returns(bv32);\r\nfunction $xor(x:bv32, y:bv32) returns(bv32);\r\nfunction $shr(x:bv32, y:bv32) returns(bv32);\r\nfunction $shl(x:bv32, y:bv32) returns(bv32);\r\nfunction $neg(x:bv32) returns(bv32);\r\nfunction $le (x:bv32, y:bv32) returns(bool);\r\nfunction $lt (x:bv32, y:bv32) returns(bool);\r\nfunction $ge (x:bv32, y:bv32) returns(bool);\r\nfunction $gt (x:bv32, y:bv32) returns(bool);\r\n\r\nfunction{:expand false} TBV(b:bv32) returns(bool) { true }\r\n\r\n//- meaning undefined if !word(i)\r\nfunction B(i:int) returns(bv32);\r\nfunction I(b:bv32) returns(int);\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/IntSpec.imp.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation IntSpec {}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/IntSpec_axioms.bpl", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\n//- Axioms about bit vectors\r\n\r\naxiom I(1bv32) == 1;\r\n\r\naxiom (forall i1:int, i2:int::{B(i1),B(i2)} word(i1) && word(i2) ==> (i1 == i2 <==> B(i1) == B(i2)));\r\naxiom (forall b1:bv32, b2:bv32::{I(b1),I(b2)} b1 == b2 <==> I(b1) == I(b2));\r\n\r\naxiom (forall b:bv32::{I(b)} word(I(b)));\r\naxiom (forall b:bv32::{B(I(b))} B(I(b)) == b);\r\naxiom (forall i:int::{I(B(i))} word(i) ==> I(B(i)) == i);\r\n\r\naxiom (forall i1:int, i2:int::{add(i1, i2)} word(i1) && word(i2) && word(add(i1, i2)) ==> add(i1, i2) == I($add(B(i1), B(i2))));\r\naxiom (forall i1:int, i2:int::{sub(i1, i2)} word(i1) && word(i2) && word(sub(i1, i2)) ==> sub(i1, i2) == I($sub(B(i1), B(i2))));\r\naxiom (forall i1:int, i2:int::{mul(i1, i2)} word(i1) && word(i2) && word(mul(i1, i2)) ==> mul(i1, i2) == I($mul(B(i1), B(i2))));\r\naxiom (forall i1:int, i2:int::{_div(i1, i2)} word(i1) && word(i2) && word(_div(i1, i2)) ==> _div(i1, i2) == I($div(B(i1), B(i2))));\r\naxiom (forall i1:int, i2:int::{_mod(i1, i2)} word(i1) && word(i2) && word(_mod(i1, i2)) ==> _mod(i1, i2) == I($mod(B(i1), B(i2))));\r\naxiom (forall i1:int, i2:int::{le(i1, i2)} word(i1) && word(i2) ==> le(i1, i2) == $le(B(i1), B(i2)) );\r\naxiom (forall i1:int, i2:int::{lt(i1, i2)} word(i1) && word(i2) ==> lt(i1, i2) == $lt(B(i1), B(i2)) );\r\naxiom (forall i1:int, i2:int::{ge(i1, i2)} word(i1) && word(i2) ==> ge(i1, i2) == $ge(B(i1), B(i2)) );\r\naxiom (forall i1:int, i2:int::{gt(i1, i2)} word(i1) && word(i2) ==> gt(i1, i2) == $gt(B(i1), B(i2)) );\r\n\r\naxiom (forall i1:int, i2:int::{and(i1, i2)} and(i1, i2) == I($and(B(i1), B(i2))) );\r\naxiom (forall i1:int, i2:int::{or(i1, i2)} or (i1, i2) == I($or (B(i1), B(i2))) );\r\naxiom (forall i1:int, i2:int::{xor(i1, i2)} xor(i1, i2) == I($xor(B(i1), B(i2))) );\r\naxiom (forall i1:int, i2:int::{shl(i1, i2)} shl(i1, i2) == I($shl(B(i1), B(i2))) );\r\naxiom (forall i1:int, i2:int::{shr(i1, i2)} shr(i1, i2) == I($shr(B(i1), B(i2))) );\r\naxiom (forall i:int::{neg(i)} neg(i) == I($neg(B(i))));\r\n\r\naxiom (forall i:int::{Aligned(i)} word(i) ==> Aligned(i) == ($and(B(i), 3bv32) == 0bv32));\r\n\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/InterruptsSpec.ifc.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface InterruptsSpec\r\n{\r\n\r\nconst ?FatalHandler:int; //- Handler for fatal machine exceptions (must halt machine)\r\nconst ?ErrorHandler:int; //- Handler for expected traps/faults (with error codes)\r\nconst ?FaultHandler:int; //- Handler for expected traps/faults (without error codes)\r\nconst ?InterruptHandler:int; //- Handler for interrupts\r\n\r\n//- Interrupt table layout:\r\n//- 0: divide error --> FaultHandler\r\n//- 4: overflow --> FaultHandler\r\n//- 13: general protection --> ErrorHandler\r\n//- 14: page fault --> ErrorHandler\r\n//- 1-3, 5-12, 15-31 --> FatalHandler\r\n//- 32-255 --> InterruptHandler\r\n//- Table contains 256 entries.\r\n//- Each entry is an 8 byte \"interrupt gate\" (which guarantees that exceptions are disabled upon entry):\r\n//- 0: bits 31..16 = handler[31..16]\r\n//- bits 15...0 = 0x8e00 (P=1, DPL=0, D=1)\r\n//- 4: bits 31..16 = codeSegmentSelector\r\n//- bits 15...0 = handler[15...0]\r\n\r\nconst ?NIdt:int := 256;\r\nfunction IsHandlerForEntry($entry:int, $handler:int) returns(bool)\r\n{\r\n $handler == ?FatalHandler\r\n//- ($handler == ?FaultHandler && ($entry == 0 || between(3, 5, $entry)))\r\n//- || ($handler == ?ErrorHandler && ($entry == 13 || $entry == 14))\r\n//- || ($handler == ?FatalHandler && (between(1, 3, $entry) || between(5, 13, $entry) || between(15, 32, $entry)))\r\n//- || ($handler == ?InterruptHandler && between(32, ?NIdt, $entry))\r\n}\r\n\r\n// REVIEW: don't hard-code the segment selector here...\r\nconst ?CodeSegmentSelector:int := 0x20; // (set by boot loader)\r\nconst ?Mask16Hi:int := 0xffff0000;\r\nconst ?Mask16Lo:int := 0x0000ffff;\r\nconst ?IdtWord4Lo:int := 0x8e00;\r\nfunction IdtWord0(handler:int) returns(int) { or(shl(?CodeSegmentSelector, 16), and(handler, ?Mask16Lo)) }\r\nfunction IdtWord4(handler:int) returns(int) { or(and(handler, ?Mask16Hi), ?IdtWord4Lo) }\r\n\r\n//- Verification should ensure that:\r\n//- - no instruction in the Nucleus can cause a fault.\r\n//- - interrupts are always disabled in the Nucleus.\r\n//- However, it's conceivable that we could get an NMI on some hardware.\r\n//- Therefore, it seems safest to verify that the interrupt table is\r\n//- always valid, even when running Nucleus code.\r\n//- To ensure this, we reserve special memory for the interrupt table,\r\n//- and verify that only valid entries are stored there.\r\n\r\nreadonly var $IdtMem:[int]int;\r\nreadonly var $IdtMemOk:[int]bool;\r\nconst ?idtLo:int;\r\nconst ?idtHi:int := ?idtLo + ?NIdt * 8;\r\n\r\n//// Write a word to the interrupt table\r\n//atomic procedure instr_IdtStore(linear s:state, entry:int, offset:int, handler:int, ptr:opn_mem, val:opn)\r\n// returns(linear _s:state);\r\n// requires 0 <= entry && entry < ?NIdt;\r\n// requires (offset == 0 && Eval(r, val) == IdtWord0(handler)) || (offset == 4 && Eval(r, val) == IdtWord4(handler));\r\n// requires IsHandlerForEntry(entry, handler);\r\n// requires ptr is OMem;\r\n// requires EvalPtr(r, ptr) == ?idtLo + 8 * entry + offset;\r\n// modifies $IdtMem, $IdtMemOk;\r\n// ensures $IdtMem == old($IdtMem)[EvalPtr(r, ptr) := Eval(r, val)];\r\n// ensures $IdtMemOk == old($IdtMemOk)[EvalPtr(r, ptr) := true];\r\n// ensures _s == InsUpdate0(me, s, s._cores[me]._efl);\r\n\r\nfunction IdtMemOk($IdtMemOk:[int]bool) returns(bool)\r\n{\r\n (forall i:int::{TV(i)} TV(i) ==> 0 <= i && i < ?NIdt ==>\r\n $IdtMemOk[?idtLo + 8 * i] && $IdtMemOk[?idtLo + 8 * i + 4])\r\n}\r\n\r\nreadonly var $IdtOk:bool;\r\n\r\n//// LIDT instruction. Loads IDT register from memory.\r\n//// $ptr + 0: 0...15: limit (size in bytes - 1)\r\n//// 16..31: addr[0...15]\r\n//// $ptr + 4: 0...15: addr[16..31]\r\n//// TODO: break into micro-instructions\r\n//atomic procedure instr_Lidt(linear s:state, ptr:opn_mem) returns(linear _s:state);\r\n// requires memAddr(EvalPtr(r, ptr)) && memAddr(EvalPtr(r, ptr) + 4);\r\n// requires Aligned(EvalPtr(r, ptr));\r\n// requires s._mem[EvalPtr(r, ptr)] == or(shl(?idtLo, 16), ?idtHi - ?idtLo - 1);\r\n// requires s._mem[EvalPtr(r, ptr) + 4] == shr(?idtLo, 16);\r\n// requires IdtMemOk($IdtMemOk);\r\n// modifies $IdtOk;\r\n// ensures $IdtOk;\r\n// ensures _s == InsUpdate0(me, s, s._cores[me]._efl);\r\n\r\n//- Legacy programmable interrupt controller\r\n//- (VirtualPC doesn't have much APIC support yet, so use legacy PIC)\r\n//- command sequence:\r\n//- control word, interrupt vector spec, master/secondary spec, mode spec, eoi, eoi, eoi, eoi, ...\r\n//- (eoi = end of interrupt)\r\nreadonly var $PicSeq:[int]int; // which steps in the command sequence have we completed?\r\n\r\nfunction PicOk($PicSeq:[int]int) returns(bool)\r\n{\r\n $PicSeq[0] >= 5 && $PicSeq[1] >= 5\r\n}\r\n\r\n//atomic procedure instr_PicOut8(linear s:state, pic:int, offset:int, seq:int) returns(linear _s:state);\r\n// requires (pic == 0 && s._cores[me]._regs[EDX] == 32 + offset) || (pic == 1 && s._cores[me]._regs[EDX] == 160 + offset);\r\n// requires offset == 0 || offset == 1;\r\n// requires (seq == 0 || seq == $PicSeq[pic] + 1);\r\n// requires\r\n// // edge triggered, cascaded PICs, send 4 command words:\r\n// (seq == 0 && offset == 0 && s._cores[me]._regs[EAX] == 17)\r\n// // use interrupt vectors 112..119 and 120..127:\r\n// || (seq == 1 && offset == 1 && pic == 0 && s._cores[me]._regs[EAX] == 112)\r\n// || (seq == 1 && offset == 1 && pic == 1 && s._cores[me]._regs[EAX] == 120)\r\n// // 4 ==> connect slave to IRQ2, 2 ==> slave ID 2:\r\n// || (seq == 2 && offset == 1 && pic == 0 && s._cores[me]._regs[EAX] == 4)\r\n// || (seq == 2 && offset == 1 && pic == 1 && s._cores[me]._regs[EAX] == 2)\r\n// // Non-buffered, normal EOI, x86 mode:\r\n// || (seq == 3 && offset == 1 && s._cores[me]._regs[EAX] == 1)\r\n// // for now, only allow timer interrupts (vector 0 on pic 0):\r\n// || (seq == 4 && offset == 1 && pic == 0 && s._cores[me]._regs[EAX] == 254)\r\n// || (seq == 4 && offset == 1 && pic == 1 && s._cores[me]._regs[EAX] == 255)\r\n// // send eoi:\r\n// || (seq >= 5 && offset == 0 && s._cores[me]._regs[EAX] == 32)\r\n// ;\r\n// modifies $PicSeq;\r\n// ensures $PicSeq == old($PicSeq)[pic := seq];\r\n// ensures _s == InsUpdate0(me, s, s._cores[me]._efl);\r\n\r\n//- Legacy programmer interval timer\r\n//- (using timer0 only)\r\nreadonly var $TimerSeq:int; //- which step in the initialization have we completed?\r\nreadonly var $TimerFreq:int;\r\n\r\nfunction TimerOk($TimerSeq:int) returns(bool) { $TimerSeq == 2 }\r\n\r\n//atomic procedure instr_PitModeOut8(linear s:state, freq:int) returns(linear _s:state);\r\n// requires s._cores[me]._regs[EAX] == 48; // one-shot 16-bit mode\r\n// modifies $TimerSeq, $TimerFreq;\r\n// ensures $TimerSeq == 0;\r\n// ensures $TimerFreq == freq;\r\n// ensures _s == InsUpdate0(me, s, s._cores[me]._efl);\r\n//\r\n//atomic procedure instr_PitFreqOut8(linear s:state) returns(linear _s:state);\r\n// requires 0 <= $TimerSeq && $TimerSeq < 2;\r\n// requires $TimerSeq == 0 ==> s._cores[me]._regs[EAX] == $TimerFreq; // al == bits 0-7 of $freq\r\n// requires $TimerSeq == 1 ==> s._cores[me]._regs[EAX] == shr($TimerFreq, 8); // al == bits 8-15 of $freq\r\n// modifies $TimerSeq;\r\n// ensures $TimerSeq == old($TimerSeq) + 1;\r\n// ensures _s == InsUpdate0(me, s, s._cores[me]._efl);\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/InterruptsSpec.imp.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation InterruptsSpec {}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/IoSpec.ifc.basm", "content": "//-\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface IoSpec\r\n{\r\n\r\n//- We model input and output as unbounded streams of input events or output events.\r\n\r\nfunction VgaTextStore($ptr:int, $val:int) returns(VgaEvent);\r\n\r\nconst ?VgaTextLo:int := 0xb8000;\r\nconst ?VgaTextHi:int := 0xb9f40;\r\nfunction vgaAddr2(i:int) returns (bool) {?VgaTextLo <= i && i <= ?VgaTextHi - 2}\r\n\r\natomic procedure instr_VgaTextStore16(const my r:regs, linear io:IOState, ptr:opn_mem, val:opn)\r\n returns(linear _io:IOState);\r\n requires SrcOk(val);\r\n requires vgaAddr2(EvalPtr(r, ptr));\r\n requires public(ptr);\r\n requires public(val);\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n ensures _io == OutUpdate(VgaUpdate(io,\r\n VgaState(\r\n io._vga.VgaEvents[io._vga.VgaNextEvent := VgaTextStore(EvalPtr(r, ptr), Eval(r, val))],\r\n io._vga.VgaNextEvent + 1\r\n )));\r\n\r\n//- For diagnostics, allow arbitrary writes to the first line of the screen.\r\n//- (If no diagnostics are needed, this can be disabled.)\r\n// TODO: Disable for Oakland!\r\natomic procedure instr_VgaDebugStore16(const my r:regs, ptr:opn_mem, val:opn);\r\n requires SrcOk(val);\r\n requires vgaAddr2(EvalPtr(r, ptr));\r\n requires ?VgaTextLo <= EvalPtr(r, ptr) && EvalPtr(r, ptr) <= ?VgaTextLo + 158;\r\n\r\natomic procedure instr_KeyboardStatusIn8(my r:regs, linear io:IOState) returns(my _r:regs, linear _io:IOState);\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n ensures (exists eax_val:int, available:int::\r\n _r.regs == r.regs[EAX := eax_val]\r\n && _r.efl == r.efl\r\n && _io == InOutUpdate(\r\n KeyboardUpdate(io,\r\n KeyboardState(\r\n io._keyboard.KeyboardEvents,\r\n available,\r\n io._keyboard.KeyboardDone)))\r\n && (and(eax_val, 1) == 0 ==> available == io._keyboard.KeyboardDone)\r\n && (and(eax_val, 1) != 0 ==> available > io._keyboard.KeyboardDone));\r\n ensures public(_r.regs[EAX]);\r\n\r\natomic procedure instr_KeyboardDataIn8(my r:regs, linear io:IOState) returns(my _r:regs, linear _io:IOState);\r\n requires io._keyboard.KeyboardAvailable > io._keyboard.KeyboardDone;\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n ensures (exists eax_val:int::\r\n _r.regs == r.regs[EAX := eax_val]\r\n && _r.efl == r.efl\r\n && _io == InOutUpdate(\r\n KeyboardUpdate(io,\r\n KeyboardState(\r\n io._keyboard.KeyboardEvents,\r\n io._keyboard.KeyboardAvailable,\r\n io._keyboard.KeyboardDone+1)))\r\n && and(eax_val, 255) == io._keyboard.KeyboardEvents[io._keyboard.KeyboardDone]);\r\n ensures public(_r.regs[EAX]);\r\n\r\n//function ValidBaudRateLSB(a:int):bool\r\n//{\r\n// a == 0x01 || a == 0x03 || a == 0x06 || a == 0x0c || a == 0x10 || a == 0x18 || a == 0x20 || a == 0x3a || a == 0x40 || a == 0x60 || a == 0xc0\r\n// || a == 0x80 || a == 0x00 || a == 0x17\r\n//}\r\n//\r\n//function ValidBaudRateMSB(a:int):bool\r\n//{\r\n// a == 0x00 || a == 0x01 || a == 0x03 || a == 0x04 || a == 0x09\r\n//}\r\n//\r\n//// line status register\r\n//function IsLSR(d:int):bool\r\n//{\r\n// d == 0x3fd\r\n//}\r\n//\r\n//// transmit/receive buffer\r\n//function IsTRB(d:int):bool\r\n//{\r\n// d == 0x3f8\r\n//}\r\n//\r\n//function ValidSerialConfig(regs:[int]int, mode:SerialPortMode):bool\r\n//{\r\n// (regs[EDX] == 0x3f8 ==> (mode.DLAB == true && ValidBaudRateLSB(regs[EAX])))\r\n// || (regs[EDX] == 0x3f9 ==> (mode.DLAB == true ==> ValidBaudRateMSB(regs[EAX])))\r\n// || regs[EDX] == 0x3fa \r\n// || regs[EDX] == 0x3fb \r\n// || regs[EDX] == 0x3fc\r\n//}\r\n\r\n//- Interface for serial port output; used for debugging underspecified code,\r\n//- e.g., the network driver\r\n// TODO: Disable serial for Oakland submission\r\n\r\nfunction serialPortConfigged():bool;\r\n\r\n//- For more info, see http://www.lammertbies.nl/comm/info/RS-232_io.html\r\natomic procedure instr_SerialDbgConfigOut(const my r:regs);\r\n requires 0x3f8 <= r.regs[EDX] && r.regs[EDX] <= 0x3ff; //- Must be in I/O range for COM1 \r\n ensures serialPortConfigged();\r\n\r\natomic procedure instr_SerialDbgStatusOut8(my r:regs) returns(my _r:regs);\r\n requires r.regs[EDX] == 0x3fd; //- LSR = line status register\r\n ensures (exists eax_val:int :: _r.regs == r.regs[EAX := eax_val]);\r\n\r\natomic procedure instr_SerialDbgDataOut8(const my r:regs);\r\n requires r.regs[EDX] == 0x3f8;\r\n\r\n\r\n//[ckh] How is p related to $serialState?\r\n//atomic procedure instr_SerialDbgConfig(const my r:regs, p:SerialPortState);\r\n// requires ValidSerialConfig(r.regs, p.Mode);\r\n// modifies $serialState;\r\n// ensures (exists mode:bool::\r\n// $serialState == SerialPortState(SerialPortMode(mode), p.In, p.Out)\r\n// && (r.regs[EAX] == 0x80 && r.regs[EDX] == 0x3fb ==> mode == true)\r\n// && (r.regs[EAX] != 0x80 && r.regs[EDX] == 0x3fb ==> mode == false)\r\n// && (r.regs[EDX] != 0x3fb ==> mode == p.Mode.DLAB));\r\n//\r\n//atomic procedure instr_SerialDbgDataOut8(const my r:regs, p:SerialPortState);\r\n// requires IsTRB(r.regs[EDX]) && p.Mode.DLAB == false;\r\n// requires p.Out.Available > p.Out.Done;\r\n// modifies $serialState;\r\n// ensures $serialState == SerialPortState(p.Mode, p.In, SerialPortQueue(p.Out.Events, p.Out.Available, p.Out.Done+1));\r\n// ensures and(r.regs[EAX], 255) == $serialState.Out.Events[$serialState.Out.Done];\r\n//\r\n//atomic procedure instr_SerialDbgStatusOut8(my r:regs, p:SerialPortState) returns(my _r:regs);\r\n// requires IsLSR(r.regs[EDX]);\r\n// modifies $serialState;\r\n// ensures (exists eax_val:int, available:int::\r\n// _r.regs == r.regs[EAX := eax_val]\r\n// && $serialState == SerialPortState(p.Mode, p.In, SerialPortQueue(p.Out.Events, available, p.Out.Done))\r\n// && (and(eax_val, 0x20) == 0 ==> available == p.Out.Done)\r\n// && (and(eax_val, 0x20) != 0 ==> available > p.Out.Done));\r\n//\r\n//atomic procedure instr_SerialDbgDataIn8(my r:regs, p:SerialPortState) returns(my _r:regs);\r\n// requires IsTRB(r.regs[EDX]) && p.Mode.DLAB == false;\r\n// requires p.In.Available > p.In.Done;\r\n// modifies $serialState;\r\n// ensures (exists eax_val:int::\r\n// _r.regs == r.regs[EAX := eax_val]\r\n// && $serialState == SerialPortState(p.Mode, SerialPortQueue(p.In.Events, p.In.Available, p.In.Done+1), p.Out)\r\n// && (and(eax_val, 255) == $serialState.In.Events[$serialState.In.Done]));\r\n//\r\n//atomic procedure instr_SerialDbgStatusIn8(my r:regs, p:SerialPortState) returns(my _r:regs);\r\n// requires IsLSR(r.regs[EDX]);\r\n// modifies $serialState;\r\n// ensures (exists eax_val:int, available:int::\r\n// _r.regs == r.regs[EAX := eax_val]\r\n// && $serialState == SerialPortState(p.Mode, SerialPortQueue(p.In.Events, available, p.In.Done), p.Out)\r\n// && (and(eax_val, 0x1) == 0 ==> available == p.In.Done)\r\n// && (and(eax_val, 0x1) != 0 ==> available > p.In.Done));\r\n\r\n//function SampleCall (source:[int]int, indexOld:int, index:int, retval:int ) : bool\r\n//{\r\n// (retval == source[indexOld])\r\n// && (index == indexOld+1)\r\n//}\r\n//\r\n//function OneOneMap (M:[int]int) : bool\r\n//{\r\n// (forall x:int, y:int :: word(x) && word(y) ==> M[x] == M[y] ==> x == y)\r\n//}\r\n\r\n//// This instruction should be connected to Intel Rdrand instruction in Ivy Bridge processors \r\n//atomic procedure instr_SampleIn32(linear s:state, M:[int]int) returns(linear _s:state);\r\n// requires OneOneMap(M);\r\n// modifies $global_sample_index;\r\n// ensures (exists eax:int ::\r\n// _s == InsUpdate1(me, s, OReg(EAX), eax, s._cores[me]._efl)\r\n// && SampleCall ($randomSource, old($global_sample_index), $global_sample_index, eax));\r\n\r\n//// ACPI tables\r\n//const ?RsdpPtr:int;\r\n//const ?RsdpExists:bool;\r\n//const ?RsdtPtr:int;\r\n//const ?RsdtCount:int;\r\n//const ?DmarPtr:int;\r\n//const ?DmarExists:bool;\r\n//const ?DmarLen:int;\r\n//const ?DrhdPtr:[int]int;\r\n//const ?DrhdCount:int;\r\n//const ?DrhdRegs:[int]int;\r\n//\r\n//const ?RoBiosLo:int := 0xE0000;\r\n//const ?RoBiosHi:int := 0x100000;\r\n//function inBiosRo(i:int) returns(bool) { ?RoBiosLo <= i && i < ?RoBiosHi }\r\n//\r\n//function ByteSum(ptr:int, end:int) returns(int);\r\n//\r\n//function MatchesRsdp(ptr:int) returns(bool)\r\n//{\r\n// ro32(ptr + 0) == 0x20445352 // \"RSD \"\r\n// && ro32(ptr + 4) == 0x20525450 // \"PTR \"\r\n// && and(ByteSum(ptr, ptr + 20), 255) == 0\r\n//}\r\n//\r\n//function MatchesDmar(ptr:int) returns(bool)\r\n//{\r\n// ro32(ptr + 0) == 0x52414d44 // \"DMAR\"\r\n//}\r\n//\r\n//function MatchesDrhd(ptr:int) returns(bool)\r\n//{\r\n// roU16(ptr) == 0\r\n//}\r\n//\r\n//function MaybeDrhd(ptr:int, entry:int) returns(bool)\r\n//{\r\n// ?DrhdPtr[entry] == ptr\r\n// && inRo(ptr + 0, 2)\r\n// && inRo(ptr + 2, 2)\r\n// && ptr + roU16(ptr + 2) <= ?DmarPtr + ?DmarLen\r\n//}\r\n//\r\n//function DrhdInv(ptr:int, entry:int) returns(bool)\r\n//{\r\n// inRo(ptr + 8, 4)\r\n// && inRo(ptr + 12, 4)\r\n// && (ro32(ptr + 12) == 0 ==> ?DrhdRegs[entry] == ro32(?DrhdPtr[entry] + 8))\r\n//}\r\n//\r\n//atomic ghost procedure rsdpExists($ptr:int, $entry:int);\r\n// requires $ptr == ?RoBiosLo + 16 * $entry;\r\n// requires inBiosRo($ptr);\r\n// requires MatchesRsdp($ptr);\r\n// requires (forall j:int::{TV(j)} TV(j) && j < $entry && inBiosRo(?RoBiosLo + 16 * j)\r\n// ==> !MatchesRsdp(?RoBiosLo + 16 * j));\r\n// ensures ?RsdpExists;\r\n// ensures ?RsdpPtr == $ptr;\r\n//\r\n//atomic ghost procedure dmarExists($ptr:int, $entry:int);\r\n// requires $ptr == ro32(?RsdtPtr + 36 + 4 * $entry);\r\n// requires ?RsdpExists;\r\n// requires 0 <= $entry && $entry < ?RsdtCount;\r\n// requires MatchesDmar($ptr);\r\n// requires (forall j:int::{TV(j)} TV(j) && 0 <= j && j < ?RsdtCount && $entry != j\r\n// ==> !MatchesDmar(ro32(?RsdtPtr + 36 + 4 * j)));\r\n// ensures ?DmarExists;\r\n// ensures ?DmarPtr == $ptr;\r\n//\r\n//atomic ghost procedure drhdExists($ptr:int, $entry:int);\r\n// requires MaybeDrhd($ptr, $entry);\r\n// requires $ptr < ?DmarPtr + ?DmarLen;\r\n// requires MatchesDrhd($ptr);\r\n// ensures ?DrhdPtr[$entry] == $ptr;\r\n// ensures MaybeDrhd($ptr + roU16($ptr + 2), $entry + 1);\r\n// ensures DrhdInv($ptr, $entry);\r\n//\r\n//atomic ghost procedure drhdEnd($ptr:int, $entry:int);\r\n// requires MaybeDrhd($ptr, $entry);\r\n// requires $ptr == ?DmarPtr + ?DmarLen || !MatchesDrhd($ptr);\r\n// ensures ?DrhdCount == $entry;\r\n//\r\n//// IOMMU, DMA\r\n//\r\n//// Note: iom and dma must be contiguous (?iomHi == ?dmaLo),\r\n//// because iom contains the byte[] header for the dma region\r\n//const ?iomLo:int;\r\n//const ?iomHi:int := ?iomLo + 65536;\r\n//const ?dmaLo:int;\r\n//const ?dmaHi:int := ?dmaLo + 18 * 1024 * 1024;\r\n//\r\n//function iomAddr(i:int) returns (bool) {?iomLo <= i && i < ?iomHi}\r\n\r\n//// TODO: Disable Iom* instructions for Oakland\r\n//atomic procedure instr_IomStore(linear s:state, ptr:opn_mem, val:opn) returns(linear _s:state);\r\n// requires iomAddr(EvalPtr(r, ptr));\r\n// requires Aligned(EvalPtr(r, ptr));\r\n// requires word(Eval(r, val));\r\n// requires !s._io._iom.IomFrozen;\r\n// ensures _s == IomUpdate(s,\r\n// IomState(\r\n// s._io._iom.IomMem[EvalPtr(r, ptr) := Eval(r, val)],\r\n// s._io._iom.IomFrozen,\r\n// s._io._iom.IoMmuState,\r\n// s._io._iom.IoMmuEnabled,\r\n// s._io._iom.DevEnabled\r\n// ));\r\n//\r\n//atomic procedure instr_IomRegLoad(entry:int, val:int, ptr:opn_mem);\r\n// requires EvalPtr(r, ptr) == ?DrhdRegs[entry] + 28\r\n// || EvalPtr(r, ptr) == ?DrhdRegs[entry] + 0\r\n// || EvalPtr(r, ptr) == ?DrhdRegs[entry] + 8\r\n// || EvalPtr(r, ptr) == ?DrhdRegs[entry] + 12;\r\n// modifies regs;\r\n// ensures word(Eval(r, val));\r\n// ensures (exists v:int :: regs == r.regs[val := v]);\r\n//\r\n//// TODO: invalidate context-cache and IOTLB?\r\n//atomic procedure instr_IomRegStore(linear s:state, entry:int, ptr:opn_mem, val:opn) returns(linear _s:state);\r\n// requires (s._io._iom.IoMmuState[entry] == 0 && EvalPtr(r, ptr) == ?DrhdRegs[entry] + 32 && IoRootTable(s._io._iom.IomMem, Eval(r, val)))\r\n// || (s._io._iom.IoMmuState[entry] == 1 && EvalPtr(r, ptr) == ?DrhdRegs[entry] + 36 && Eval(r, val) == 0)\r\n// || (s._io._iom.IoMmuState[entry] == 2 && EvalPtr(r, ptr) == ?DrhdRegs[entry] + 24 && Eval(r, val) == shl(1, 30))\r\n// || (s._io._iom.IoMmuState[entry] == 3 && EvalPtr(r, ptr) == ?DrhdRegs[entry] + 24 && Eval(r, val) == shl(1, 31));\r\n// ensures _s == IomUpdate(s,\r\n// IomState(\r\n// s._io._iom.IomMem,\r\n// true,\r\n// s._io._iom.IoMmuState[entry := 1 + s._io._iom.IoMmuState[entry]],\r\n// s._io._iom.IoMmuEnabled,\r\n// s._io._iom.DevEnabled\r\n// ));\r\n//\r\n//atomic procedure instr_ghost_IomEnabled(linear s:state) returns (linear _s:state);\r\n// requires (forall i:int::{s._io._iom.IoMmuState[i]} 0 <= i && i < ?DrhdCount ==> s._io._iom.IoMmuState[i] == 4);\r\n// requires false; // $IomMem[?dmaLo - 8] == ?BYTE_VECTOR_VTABLE; // byte[].VTable\r\n// requires s._io._iom.IomMem[?dmaLo - 4] == ?dmaHi - ?dmaLo; // byte[].Length\r\n// // REVIEW we often casually spec that a bunch of operations keep EFL\r\n// // constant. We should probably check or let it vary nondeterministically.\r\n// ensures _s == IomUpdate(s,\r\n// IomState(\r\n// s._io._iom.IomMem,\r\n// s._io._iom.IomFrozen,\r\n// s._io._iom.IoMmuState,\r\n// true,\r\n// s._io._iom.DevEnabled\r\n// ));\r\n\r\n//// Does physical page n fit inside dma area? If so, we can map it.\r\n//function IsDmaPage(ptr:int) returns(bool)\r\n//{\r\n// and(ptr, 4095) == 0\r\n// && ?dmaLo <= ptr && ptr + 4096 <= ?dmaHi\r\n//}\r\n//\r\n//function IoPageTableEntry(w0:int, w1:int) returns(bool)\r\n//{\r\n// w1 == 0 && (w0 == 0 || IsDmaPage(w0 - 3))\r\n//}\r\n//\r\n//function{:expand false} IoPageTable($IomMem:[int]int, ptr:int) returns(bool)\r\n//{\r\n// and(ptr, 4095) == 0\r\n// && (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 512 ==>\r\n// IoPageTableEntry($IomMem[ptr + 8 * i], $IomMem[ptr + 8 * i + 4]))\r\n//}\r\n//\r\n//function IoPageDirEntry($IomMem:[int]int, w0:int, w1:int) returns(bool)\r\n//{\r\n// w1 == 0 && (w0 == 0 || IoPageTable($IomMem, w0 - 3))\r\n//}\r\n//\r\n//function{:expand false} IoPageDir($IomMem:[int]int, ptr:int) returns(bool)\r\n//{\r\n// and(ptr, 4095) == 0\r\n// && (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 512 ==>\r\n// IoPageDirEntry($IomMem, $IomMem[ptr + 8 * i], $IomMem[ptr + 8 * i + 4]))\r\n//}\r\n//\r\n//function{:expand false} IoPageDirStub($IomMem:[int]int, ptr:int) returns(bool)\r\n//{\r\n// and(ptr, 4095) == 0\r\n// && $IomMem[ptr + 4] == 0\r\n// && (forall i:int::{TV(i)} TV(i) && 1 <= i && i < 512 ==>\r\n// $IomMem[ptr + 8 * i] == 0 && $IomMem[ptr + 8 * i + 4] == 0)\r\n//}\r\n//\r\n//function IoContextEntry($IomMem:[int]int, w0:int, w1:int, w2:int, w3:int) returns(bool)\r\n//{\r\n// w3 == 0 && w2 == 258 && w1 == 0\r\n// && IoPageDirStub($IomMem, w0 - 3)\r\n// && IoPageDirStub($IomMem, $IomMem[w0 - 3] - 3)\r\n// && IoPageDir($IomMem, $IomMem[$IomMem[w0 - 3] - 3] - 3)\r\n//}\r\n//\r\n//function{:expand false} IoContextTable($IomMem:[int]int, ptr:int) returns(bool)\r\n//{\r\n// and(ptr, 4095) == 0\r\n// && (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 256 ==>\r\n// IoContextEntry($IomMem,\r\n// $IomMem[ptr + 16 * i + 0],\r\n// $IomMem[ptr + 16 * i + 4],\r\n// $IomMem[ptr + 16 * i + 8],\r\n// $IomMem[ptr + 16 * i + 12]))\r\n//}\r\n//\r\n//function IoRootEntry($IomMem:[int]int, w0:int, w1:int, w2:int, w3:int) returns(bool)\r\n//{\r\n// w3 == 0 && w2 == 0 && w1 == 0 && IoContextTable($IomMem, w0 - 1)\r\n//}\r\n//\r\n//function{:expand false} IoRootTable($IomMem:[int]int, ptr:int) returns(bool)\r\n//{\r\n// and(ptr, 4095) == 0\r\n// && (forall i:int::{TV(i)} TV(i) && 0 <= i && i < 256 ==>\r\n// IoRootEntry($IomMem,\r\n// $IomMem[ptr + 16 * i + 0],\r\n// $IomMem[ptr + 16 * i + 4],\r\n// $IomMem[ptr + 16 * i + 8],\r\n// $IomMem[ptr + 16 * i + 12]))\r\n//}\r\n\r\n\r\n//- PCI\r\n\r\n//- The 16-bit value BusNumber||DeviceNumber||FunctionNumber\r\nfunction IsValidPciId(id:int) returns(bool) {\r\n 0 <= id && id < 65536\r\n}\r\nfunction IsValidPciOffset(o:int) returns(bool) {\r\n 0 <= o && o < 256 && (o mod 4 == 0)\r\n}\r\n\r\n//- Note: these three functions record the fact that some read/load/store\r\n//- occured at some time. We could make them more precise by recording the\r\n//- exact time (or some sequence number).\r\nfunction PciConfigReadResult(id:int, offset:int, val:int) returns(bool);\r\nfunction PciMemLoaded(id:int, ptr:int, val:int) returns(bool);\r\nfunction PciMemStored(id:int, ptr:int, val:int) returns(bool);\r\n\r\nfunction PciMemAddr(id:int) returns(int);\r\nfunction PciMemSize(id:int) returns(int);\r\n\r\nfunction PciDeviceAtId(id:int) returns(bool); //- Is there actually a device present at id?\r\nfunction PciSupportsCapabilityList(id:int) returns (bool);\r\nfunction PciCapabilityPtr(id:int, index:int) returns (int); //- Returns a pointer to the index-th capability for ID\r\nfunction PciCapabilityID(id:int, index:int) returns (int); //- ID of the index-th capability\r\n\r\nfunction SafePciMemRegion(addr:int, size:int) returns(bool)\r\n{\r\n word(addr) && \r\n addr >= 0xC0000000 && //- We designate the upper regions of memory for memory-mapped PCI-configuration registers\r\n ((addr + size) < 0xFED40000 || addr >= 0xFED45000) //- Don't clobber the TPM's memory mapping\r\n}\r\n\r\n//- $PciConfigState[id] in {0,1,2,3,4}\r\n//- 0 ==> start state\r\n//- 1 ==> memory space disabled\r\n//- 2 ==> BAR set to 0xffffffff\r\n//- 3 ==> BAR set to address\r\n//- 4 ==> memory space enabled\r\n\r\nfunction PciVendorId(config0:int) returns(int) { and(config0, 65535) }\r\nfunction PciHeaderType(config12:int) returns(int) { and(shr(config12, 16), 255) }\r\n\r\natomic procedure instr_PciConfigAddrOut32(const my r:regs, linear io:IOState, id:int, offset:int)\r\n returns(linear _io:IOState);\r\n requires r.regs[EAX] == or(or(shl(id, 8), offset), 0x80000000);\r\n requires r.regs[EDX] == 0xcf8;\r\n requires public(id); //- Secret values should have no effect on our id/address choices (which devices may see)\r\n requires public(offset); \r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n requires IsValidPciId(id);\r\n requires IsValidPciOffset(offset);\r\n ensures _io == OutUpdate(PciUpdate(io, PciState(id, offset, io._pci.PciConfigState)));\r\n\r\natomic procedure instr_PciConfigDataIn32(my r:regs, linear io:IOState, id:int, offset:int)\r\n returns(my _r:regs, linear _io:IOState);\r\n requires id == io._pci.PciConfigId;\r\n requires offset == io._pci.PciConfigOffset;\r\n requires r.regs[EDX] == 0xcfc;\r\n requires public(id); //- Secret values should have no effect on our id/address choices (which devices may see)\r\n requires public(offset); // REVIEW: Is this redundant with the checks on PciConfigAddrOut32 above?\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n requires IsValidPciId(id);\r\n requires IsValidPciOffset(offset);\r\n ensures (exists eax_val:int :: \r\n _io == InOutUpdate(io) //- Since addr we read is publicly visible, this is both an In and Out event\r\n && _r.regs == r.regs[EAX := eax_val]\r\n && _r.efl == r.efl\r\n && PciConfigReadResult(id, offset, eax_val)\r\n && (offset == 0 ==> (eax_val == 0xFFFFFFFF <==> !PciDeviceAtId(id))) //- Bus master must return Fs if you ask for offset 0 of a non-present device\r\n && (PciDeviceAtId(id) ==>\r\n (offset == 4 ==> PciSupportsCapabilityList(id) == GetBit(20, eax_val))\r\n && (offset == 0x34 && PciSupportsCapabilityList(id) ==> \r\n PciCapabilityPtr(id, 0) == SelectLSBs(8, eax_val) && IsValidPciOffset(PciCapabilityPtr(id, 0)))\r\n && (forall cap_index:int :: \r\n PciCapabilityPtr(id, cap_index) == offset && offset != 0 ==>\r\n ( PciCapabilityID(id, cap_index) == SelectLSBs(8, eax_val)\r\n && PciCapabilityPtr(id, cap_index+1) == shr(SelectLSBs(16, eax_val), 8)\r\n && IsValidPciOffset(PciCapabilityPtr(id, cap_index+1))))\r\n )\r\n && (io._pci.PciConfigState[id] == 0 && offset == 16 && and(eax_val, 15) == 0 ==> PciMemAddr(id) == eax_val)\r\n && (io._pci.PciConfigState[id] == 2 && offset == 16 ==> PciMemSize(id) == 1 + neg(eax_val))\r\n && word(eax_val) && word(PciMemSize(id)));\r\n ensures public(_r.regs[EAX]);\r\n\r\n//- If a device doesn't exist, then it doesn't support capabilities\r\natomic ghost procedure non_existent_devices(id:int);\r\n requires !PciDeviceAtId(id);\r\n ensures !PciSupportsCapabilityList(id);\r\n\r\n//- Once you reach a NULL pointer, there are no interesting IDs remaining\r\natomic ghost procedure cap_list_termination(id:int, cap_index:int);\r\n requires PciCapabilityPtr(id, cap_index) == 0;\r\n ensures (forall other_cap_index:int :: {PciCapabilityID(id, other_cap_index)} \r\n other_cap_index >= cap_index ==> PciCapabilityID(id, other_cap_index) == 0);\r\n\r\natomic procedure instr_PciConfigDataOut32(const my r:regs, linear io:IOState, id:int, offset:int,\r\n config0:int, config4:int, config12:int, config16:int) returns(linear _io:IOState);\r\n requires id == io._pci.PciConfigId;\r\n requires offset == io._pci.PciConfigOffset;\r\n requires r.regs[EDX] == 0xcfc;\r\n requires public(id); //- Secret values should have no effect on our id/address choices (which devices may see)\r\n requires public(offset); // REVIEW: Is this redundant with the checks on PciConfigAddrOut32 above?\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n requires IsValidPciId(id);\r\n requires IsValidPciOffset(offset);\r\n requires and(id, 7) == 0; //- support only function 0 for now\r\n requires PciConfigReadResult(id, 0, config0);\r\n requires PciConfigReadResult(id, 4, config4);\r\n requires PciConfigReadResult(id, 12, config12);\r\n requires PciConfigReadResult(id, 16, config16);\r\n requires PciVendorId(config0) != 65535;\r\n requires PciHeaderType(config12) == 0;\r\n requires io._pci.PciConfigState[id] == 0 ==> offset == 4 && r.regs[EAX] == and(config4, 0xfffffffd);\r\n requires io._pci.PciConfigState[id] == 1 ==> offset == 16 && r.regs[EAX] == 0xffffffff;\r\n requires io._pci.PciConfigState[id] == 2 ==> offset == 16 && r.regs[EAX] == PciMemAddr(id) && SafePciMemRegion(PciMemAddr(id), PciMemSize(id));\r\n requires io._pci.PciConfigState[id] == 3 ==> offset == 4 && r.regs[EAX] == or(config4, 2);\r\n requires io._pci.PciConfigState[id] != 4;\r\n ensures (exists _pci_config:int, _pci_config_offset:int::\r\n _io == OutUpdate(PciUpdate(\r\n io,\r\n PciState(\r\n _pci_config,\r\n _pci_config_offset,\r\n io._pci.PciConfigState[id := 1 + io._pci.PciConfigState[id]]\r\n ))));\r\n\r\natomic procedure instr_PciMemLoad32(my r:regs, linear io:IOState, id:int, dst:int, ptr:opn_mem)\r\n returns(my _r:regs, linear _io:IOState);\r\n //requires io._iom.IoMmuEnabled;\r\n requires io._pci.PciConfigState[id] == 4;\r\n requires PciMemAddr(id) <= EvalPtr(r, ptr) && EvalPtr(r, ptr) + 4 <= PciMemAddr(id) + PciMemSize(id);\r\n requires public(id); //- Secret values should have no effect on our id choices (which devices may see)\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n requires public(EvalPtr(r, ptr)); //- Secret vals shouldn't affect addr we read on bus\r\n ensures PciMemLoaded(id, EvalPtr(r, ptr), _r.regs[dst]);\r\n ensures word(_r.regs[dst]);\r\n ensures (exists v:int:: //- Since addr we read is publicly visible, this is both an In and Out event\r\n _io == InOutUpdate(io)\r\n && _r.regs == r.regs[dst := v]\r\n && _r.efl == r.efl\r\n && word(v)\r\n );\r\n ensures public(_r.regs[dst]);\r\n\r\natomic procedure instr_PciMemStore32(const my r:regs, linear io:IOState, id:int, ptr:opn_mem, src:opn)\r\n returns(linear _io:IOState);\r\n //requires io._iom.IoMmuEnabled;\r\n requires io._pci.PciConfigState[id] == 4;\r\n requires PciMemAddr(id) <= EvalPtr(r, ptr) && EvalPtr(r, ptr) + 4 <= PciMemAddr(id) + PciMemSize(id);\r\n requires word(Eval(r, src));\r\n requires public(id); //- Secret values should have no effect on our id choices (which devices may see)\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n requires public(EvalPtr(r, ptr)); //- Secret vals shouldn't affect addr we read on bus\r\n requires public(Eval(r, src)); //- nor the value itself\r\n ensures PciMemStored(id, EvalPtr(r, ptr), Eval(r, src));\r\n ensures _io == OutUpdate(io);\r\n\r\n//- Device memory is a region where devices can freely read and write, so we can't assume anything about its contents \r\nconst ?devMemLo:int := 0x08000000; //- 128 MB up\r\nconst ?devMemHi:int := 0xF0000000; \r\n//const ?devMemHi:int := ?devMemLo + 64 * 1024 * 1024; // 64 MB // TODO: Restore if we enable DEV\r\nconst ?wordsPerPacket:int := 1500 div 4;\r\n\r\natomic procedure instr_DeviceLoad(my r:regs, linear io:IOState, dst:int, ptr:opn_mem)\r\n returns(my _r:regs, linear _io:IOState);\r\n //requires io._iom.DevEnabled; // TODO: Restore if we enable the DEV\r\n requires ?devMemLo <= EvalPtr(r, ptr) && EvalPtr(r, ptr) + 4 <= ?devMemHi;\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n requires public(EvalPtr(r, ptr)); //- Secret vals shouldn't affect addr we read on bus\r\n ensures (exists v:int:: //- Since addr we read is publicly visible, this is both an In and Out event\r\n _io == InOutUpdate(io)\r\n && _r.regs == r.regs[dst := v]\r\n && _r.efl == r.efl\r\n && word(v));\r\n ensures public(_r.regs[dst]);\r\n\r\natomic procedure instr_DeviceStore(const my r:regs, linear io:IOState, ptr:opn_mem, src:opn) returns(linear _io:IOState);\r\n requires ?devMemLo <= EvalPtr(r, ptr) && EvalPtr(r, ptr) + 4 <= ?devMemHi;\r\n// requires SrcOk(src); // not needed, checked by boogieasm\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n requires public(EvalPtr(r, ptr)); //- Secret vals shouldn't affect addr we read on bus\r\n requires public(Eval(r, src)); //- nor the value itself\r\n ensures _io == OutUpdate(io);\r\n\r\n\r\n//-////////////////////////////////////////////////////////////////\r\n//- Device Exclusion Vector (DEV) Configuration\r\n//-////////////////////////////////////////////////////////////////\r\n\r\nconst ?DEVLo:int := ?CodeBase + 60*1024; //- Must be 4K aligned\r\nconst ?DEVHi:int := ?CodeBase + 64*1024; //- 4K at the top of our 64K located at ?CodeBase\r\n\r\n//- Is this the capability portion of the DEV's PCI config space?\r\nfunction DEV_PciCapabilityAt(id:int, dev_offset:int) : bool\r\n{\r\n dev_offset != 0\r\n && PciSupportsCapabilityList(id)\r\n && (exists cap_index:int :: {TV(cap_index)} TV(cap_index)\r\n && 0 <= cap_index \r\n && PciCapabilityPtr(id, cap_index) == dev_offset //- The offset points at some PCI capability\r\n && PciCapabilityID(id, cap_index) == 0x0f) //- The capability is the DEV capability (AMD vol2, Table 15-16)\r\n}\r\n\r\n//- According to the spec, a PCI capability ID is vendor agnostic,\r\n//- so finding the DEV capability ID should suffice \r\nfunction Is_DEV_PCI_config(id:int) : bool\r\n{\r\n (exists offset:int :: {TV(offset)} TV(offset) && DEV_PciCapabilityAt(id, offset))\r\n}\r\n\r\n//- Are we addressing the DEV_OP register in the DEV's capability block?\r\nfunction DEV_Op(id:int, dev_offset:int, write_offset:int) : bool\r\n{\r\n DEV_PciCapabilityAt(id, dev_offset) && write_offset == dev_offset + 4\r\n}\r\n\r\n//- Are we addressing the DEV_DATA register in the DEV's capability block?\r\nfunction DEV_Data(id:int, dev_offset:int, write_offset:int) : bool\r\n{\r\n DEV_PciCapabilityAt(id, dev_offset) && write_offset == dev_offset + 8\r\n}\r\n\r\n//- Has the memory for the DEV been configured properly, i.e., in the right location and with all 1s to block all access?\r\nfunction ValidDEV(dev_mem:mem) : bool\r\n{\r\n (forall i:int :: dev_mem.dom[i] <==> (?DEVLo <= i && i < ?DEVHi)) \r\n && (forall i:int :: PhysPtrOk(dev_mem, i) ==> \r\n if ?DEVLo <= i && i < ?DEVLo + 96 then dev_mem.map[i] == 0 else dev_mem.map[i] == 0xFFFFFFFF) \r\n //- First 96 bytes of DEV cover the first 3MB of memory (up to the base of our code). \r\n //- Allow device access so things like legacy VGA will work\r\n}\r\n\r\n//- How many DEV_MAP registers does this DEV support?\r\nfunction num_DEV_map_regs(id:int) returns(int);\r\n\r\n//-/////////////////////////////////////////////////////\r\n//- PCI data writes that advance us through the \r\n//- DEV configuration state machine defined below\r\n//-/////////////////////////////////////////////////////\r\nfunction DEV_OpBaseLo(id:int, dev_offset:int, write_offset:int, val:int) : bool\r\n{\r\n DEV_Op(id, dev_offset, write_offset) && val == 0x000\r\n}\r\n\r\nfunction DEV_OpBaseHi(id:int, dev_offset:int, write_offset:int, val:int) : bool\r\n{\r\n DEV_Op(id, dev_offset, write_offset) && val == 0x100 \r\n}\r\n\r\nfunction DEV_OpMap(id:int, dev_offset:int, write_offset:int, val:int, map_index:int) : bool\r\n{\r\n DEV_Op(id, dev_offset, write_offset) && val == (0x200 + map_index)\r\n}\r\n\r\nfunction DEV_OpCap(id:int, dev_offset:int, write_offset:int, val:int) : bool\r\n{\r\n DEV_Op(id, dev_offset, write_offset) && val == 0x300\r\n}\r\n\r\nfunction DEV_OpCtrl(id:int, dev_offset:int, write_offset:int, val:int) : bool\r\n{\r\n DEV_Op(id, dev_offset, write_offset) && val == 0x400\r\n}\r\n\r\nfunction DEV_DataBaseLo(id:int, dev_offset:int, write_offset:int, val:int) : bool\r\n{\r\n DEV_Data(id, dev_offset, write_offset) \r\n && val == ?CodeBase + 60*1024 + 1 //- Bit 0 = 1 ==> Valid. Size = 0 ==> DEV covers 4 GB. Address must be ?CodeBase+60K\r\n}\r\n\r\nfunction DEV_DataBaseHi(id:int, dev_offset:int, write_offset:int, val:int) : bool\r\n{\r\n DEV_Data(id, dev_offset, write_offset) && val == 0 //- Only using 32-bit addressing\r\n}\r\n\r\nfunction DEV_DataMap(id:int, dev_offset:int, write_offset:int, val:int) : bool\r\n{\r\n DEV_Data(id, dev_offset, write_offset) && val == 0 //- Only using 32-bit addressing\r\n}\r\n\r\nfunction DEV_DataCtrl(id:int, dev_offset:int, write_offset:int, val:int) : bool\r\n{\r\n DEV_Data(id, dev_offset, write_offset)\r\n && val == 0x31 //- Enabled bits: [0]=DEV enable, [4]=Invalidate DEV cache, [5]=Keep existing 64K SKINIT protection\r\n //- Disabled bits: [6]=>Host bridge probes processor cache when reading DEV\r\n}\r\n\r\n//- Must not have any linear constructors! \r\ntype DEV_StateMachines = States(states:[int]DEV_StateMachine); //- States of all north bridges\r\ntype DEV_StateMachine = \r\n Init() \r\n | MemApproved() \r\n | SetOpBaseLo() \r\n | SetDataBaseLo() \r\n | SetOpBaseHi() \r\n | SetDataBaseHi() \r\n | SetOpCap() \r\n | GotDataCap() \r\n | SetOpMap(o_map_index:int)\r\n | SetDataMap(d_map_index:int)\r\n | SetOpCtrl() \r\n | SetDataCtrl() \r\n | Complete() \r\n | Invalid();\r\n\r\ntype DEV_PCI_op = DEV_Read(rval:int) | DEV_Write(wval:int);\r\n\r\nfunction DEV_AdvanceStateMachine(op:DEV_PCI_op, DEV_state:DEV_StateMachine, id:int, dev_offset:int, write_offset:int) : DEV_StateMachine\r\n{\r\n if op is DEV_Write then\r\n if DEV_state is MemApproved && DEV_OpBaseLo (id, dev_offset, write_offset, op.wval) then\r\n SetOpBaseLo()\r\n else if DEV_state is SetOpBaseLo && DEV_DataBaseLo(id, dev_offset, write_offset, op.wval) then\r\n SetDataBaseLo()\r\n else if DEV_state is SetDataBaseLo && DEV_OpBaseHi (id, dev_offset, write_offset, op.wval) then\r\n SetOpBaseHi()\r\n else if DEV_state is SetOpBaseHi && DEV_DataBaseHi(id, dev_offset, write_offset, op.wval) then\r\n SetDataBaseHi()\r\n else if DEV_state is SetDataBaseHi && DEV_OpCap (id, dev_offset, write_offset, op.wval) then\r\n SetOpCap()\r\n else if DEV_state is GotDataCap && DEV_OpCtrl (id, dev_offset, write_offset, op.wval) && num_DEV_map_regs(id) == 0 then\r\n SetOpCtrl() //- If there are no maps, go directly to ctrl configuration. \r\n else if DEV_state is GotDataCap && DEV_OpMap (id, dev_offset, write_offset, op.wval, 0) then\r\n SetOpMap(0) //- If there are maps, we need to configure each one.\r\n else if DEV_state is SetOpMap && DEV_DataMap (id, dev_offset, write_offset, op.wval) then\r\n SetDataMap(DEV_state.o_map_index)\r\n else if DEV_state is SetDataMap then\r\n if DEV_state.d_map_index + 1 < num_DEV_map_regs(id) && DEV_OpMap (id, dev_offset, write_offset, op.wval, DEV_state.d_map_index+1) then\r\n SetOpMap(DEV_state.d_map_index + 1) //- Progress to the next map\r\n else if DEV_state.d_map_index + 1 >= num_DEV_map_regs(id) && DEV_OpCtrl(id, dev_offset, write_offset, op.wval) then\r\n SetOpCtrl() //- We've set all the maps, so we can set the ctrl reg\r\n else \r\n Invalid()\r\n else if DEV_state is SetOpCtrl && DEV_DataCtrl (id, dev_offset, write_offset, op.wval) then\r\n SetDataCtrl()\r\n else\r\n Invalid()\r\n else //- read_op\r\n if DEV_state is SetDataCtrl && DEV_Data(id, dev_offset, write_offset) then //- Valid read op\r\n if !GetBit(4, op.rval) then //- Cache invalidation completed\r\n Complete()\r\n else \r\n SetDataCtrl() //- Cache invalidation still in progress, so stay in the same state\r\n else if DEV_state is SetOpCap && DEV_Data(id, dev_offset, write_offset) then\r\n GotDataCap()\r\n else \r\n Invalid()\r\n\r\n}\r\n\r\n//- To start the DEV state machine, you must prove that the memory in dev_mem\r\n//- constitutes a well-formed (for our purposes) DEV bit-vector. It consumes\r\n//- the linear token for dev_mem, which prevents future loads/store to the memory region.\r\natomic ghost procedure begin_DEV_enablement(linear DEV_states:DEV_StateMachines, linear dev_mem:mem) returns (linear _DEV_states:DEV_StateMachines);\r\n requires ?CodeBase == 0x300000; //- Format of the DEV spec expects this\r\n requires (forall i:int::{ DEV_states.states[i] } DEV_states.states[i] is Init); \r\n requires ValidDEV(dev_mem);\r\n ensures (forall i:int::{ _DEV_states.states[i] } _DEV_states.states[i] is MemApproved); \r\n\r\natomic procedure instr_DEV_PciConfigDataIn32(my r:regs, linear io:IOState, linear DEV_states:DEV_StateMachines, id:int, dev_offset:int, offset:int)\r\n returns(my _r:regs, linear _io:IOState, linear _DEV_states:DEV_StateMachines);\r\n requires id == io._pci.PciConfigId;\r\n requires offset == io._pci.PciConfigOffset;\r\n requires r.regs[EDX] == 0xcfc;\r\n requires IsValidPciId(id);\r\n requires IsValidPciOffset(offset);\r\n requires (forall read_val:int :: DEV_AdvanceStateMachine(DEV_Read(read_val), DEV_states.states[id], id, dev_offset, offset) != Invalid());\r\n requires public(id); //- Secret values should have no effect on our id/address choices (which devices may see)\r\n requires public(offset); // REVIEW: Is this redundant with the checks on PciConfigAddrOut32 above?\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n ensures _DEV_states == States(DEV_states.states[id := DEV_AdvanceStateMachine(DEV_Read(_r.regs[EAX]), DEV_states.states[id], id, dev_offset, offset)]);\r\n ensures (exists eax_val:int :: //- Since addr we read is publicly visible, this is both an In and Out event\r\n _io == InOutUpdate(io)\r\n && _r.regs == r.regs[EAX := eax_val]\r\n && _r.efl == r.efl\r\n && (_DEV_states.states[id] is GotDataCap ==> num_DEV_map_regs(id) == SelectLSBs(8, shr(eax_val, 16)))\r\n && word(eax_val)); \r\n ensures public(_r.regs[EAX]);\r\n\r\n\r\natomic procedure instr_DEV_PciConfigDataOut32(const my r:regs, linear io:IOState, linear DEV_states:DEV_StateMachines, id:int, dev_offset:int, offset:int)\r\n returns(linear _io:IOState, linear _DEV_states:DEV_StateMachines);\r\n requires id == io._pci.PciConfigId;\r\n requires offset == io._pci.PciConfigOffset;\r\n requires r.regs[EDX] == 0xcfc;\r\n requires DEV_AdvanceStateMachine(DEV_Write(r.regs[EAX]), DEV_states.states[id], id, dev_offset, offset) != Invalid();\r\n requires public(id); //- Secret values should have no effect on our id/address choices (which devices may see)\r\n requires public(offset); // REVIEW: Is this redundant with the checks on PciConfigAddrOut32 above?\r\n requires public(io._inCtr);\r\n requires public(io._outCtr);\r\n ensures _DEV_states == States(DEV_states.states[id := DEV_AdvanceStateMachine(DEV_Write(r.regs[EAX]), DEV_states.states[id], id, dev_offset, offset)]);\r\n ensures (exists _pci_config:int, _pci_config_offset:int::\r\n _io == OutUpdate(PciUpdate(\r\n io,\r\n PciState(\r\n _pci_config,\r\n _pci_config_offset,\r\n io._pci.PciConfigState\r\n ))));\r\n\r\natomic ghost procedure complete_DEV_enablement(linear DEV_states:DEV_StateMachines) returns (linear new_mem:mem);\r\n requires (forall i:int :: IsValidPciId(i) ==> (Is_DEV_PCI_config(i) ==> DEV_states.states[i] is Complete)); \r\n ensures (forall i:int ::{ new_mem.dom[i] } {TV(i)} new_mem.dom[i] <==> TV(i) && ?CodeBase + 64*1024 <= i && i < 128*1024*1024); //- Top=base+64K DEV covers 128MB total // TODO: Need to fix triggers here!\r\n\r\n\r\n//-////////////////////////////////////////////////////////////////\r\n//- Generic Dafny interface for reading/writing device memory \r\n//-////////////////////////////////////////////////////////////////\r\n\r\ntype IoMemPerm_t = Null() | IoReadAddr(r_addr:int, r_val:int) | IoWriteAddr(w_addr:int, w_val:int);\r\nreadonly var $ghost_IoMemPerm:IoMemPerm_t;\r\n\r\n// REVIEW: Add relational requirements here or handle at the points where\r\n// we dole out the IoMemPerms?\r\natomic procedure instr_IoMemAddrRead(my r:regs, dst:int, ptr:opn_mem)\r\n returns(my _r:regs);\r\n requires $ghost_IoMemPerm is IoReadAddr;\r\n requires $ghost_IoMemPerm.r_addr == EvalPtr(r, ptr);\r\n modifies $ghost_IoMemPerm;\r\n ensures $ghost_IoMemPerm is Null;\r\n ensures _r.regs == r.regs[dst := old($ghost_IoMemPerm).r_val];\r\n ensures _r.efl == r.efl;\r\n ensures word(_r.regs[dst]);\r\n\r\natomic procedure instr_IoMemAddrWrite(const my r:regs, ptr:opn_mem, src:opn);\r\n requires $ghost_IoMemPerm is IoWriteAddr;\r\n requires $ghost_IoMemPerm.w_addr == EvalPtr(r, ptr);\r\n requires $ghost_IoMemPerm.w_val == Eval(r, src);\r\n modifies $ghost_IoMemPerm;\r\n ensures $ghost_IoMemPerm is Null;\r\n\r\n} //- End of module\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/IoSpec.imp.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\n//-\r\n//- seed 1\r\nmodule implementation IoSpec\r\n{\r\n\r\n//implementation rsdpExists($ptr:int, $entry:int) { }\r\n//\r\n//implementation dmarExists($ptr:int, $entry:int) { }\r\n//\r\n//implementation drhdExists($ptr:int, $entry:int) { }\r\n//\r\n//implementation drhdEnd($ptr:int, $entry:int) { }\r\n\r\nimplementation non_existent_devices(id:int) { }\r\n\r\nimplementation cap_list_termination(id:int, cap_index:int) { }\r\n\r\nimplementation begin_DEV_enablement(linear DEV_states:DEV_StateMachines, linear dev_mem:mem) returns (linear _DEV_states:DEV_StateMachines) { }\r\n\r\nimplementation complete_DEV_enablement(linear DEV_states:DEV_StateMachines) returns (linear new_mem:mem) { }\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/IoTypesSpec.ifc.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface IoTypesSpec\r\n{\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/IoTypesSpec.imp.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation IoTypesSpec {}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/Io_axioms.bpl", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\n//// REVIEW: Why is the bound inclusive?\r\n//axiom (forall i:int,size:int::{inRo(i,size)} ?RoBiosLo <= i && i + size <= ?RoBiosHi ==> inRo(i,size));\r\n//\r\n//axiom (forall ptr:int::{ByteSum(ptr, ptr)} ByteSum(ptr, ptr) == 0);\r\n//axiom (forall ptr:int,end:int::{ByteSum(ptr, end)} ptr <= end ==> ByteSum(ptr, end + 1) == ByteSum(ptr, end) + roU8(end));\r\n//\r\n//axiom ?RsdpExists ==>\r\n// ?RsdtPtr == ro32(?RsdpPtr + 16)\r\n// && inRo(?RsdtPtr + 4, 4)\r\n// && 36 + 4 * ?RsdtCount == ro32(?RsdtPtr + 4)\r\n// && ?RsdtCount >= 0\r\n// && word(?RsdtPtr) && word(?RsdtPtr + 36 + 4 * ?RsdtCount)\r\n// && (forall i:int::{TV(i)} TV(i) && 0 <= i && i < ?RsdtCount ==>\r\n// inRo( ?RsdtPtr + 36 + 4 * i, 4)\r\n// && inRo(ro32(?RsdtPtr + 36 + 4 * i), 4));\r\n//\r\n//axiom ?DmarExists ==>\r\n// inRo(?DmarPtr + 4, 4)\r\n// && ?DmarLen == ro32(?DmarPtr + 4)\r\n// && ?DmarLen >= 48\r\n// && word(?DmarPtr) && word(?DmarPtr + ?DmarLen)\r\n// && MaybeDrhd(?DmarPtr + 48, 0);\r\n//\r\n////axiom word(?BYTE_VECTOR_VTABLE);\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/MachineStateSpec.ifc.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface MachineStateSpec\r\n{\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/MachineStateSpec.imp.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation MachineStateSpec {}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/MemorySpec.ifc.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface MemorySpec\r\n{\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- MEMORY ADDRESSES\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//- Aligned(i) <==> i is a multiple of 4\r\nfunction Aligned(i:int) returns(bool);\r\n\r\natomic ghost procedure reveal_Aligned(val:int);\r\n ensures Aligned(val) == (val mod 4 == 0);\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- MAIN MEMORY\r\n//-////////////////////////////////////////////////////////////////////////////\r\nconst ?CodeBase:int; \r\nconst ?memLo: int;\r\nconst ?memHi: int;\r\nfunction memAddr(i:int) returns (bool);\r\nfunction memAddrMain(i:int) returns (bool) {?memLo <= i && i < ?memHi}\r\nfunction memAddrMainEx(i:int) returns (bool) {?memLo <= i && i <= ?memHi} // TODO: remove\r\n\r\natomic ghost procedure memAddrBounds(i:int);\r\n ensures memAddr(i) ==> 4 <= i && i + 4 < WORD_HI; //- require 4 bytes on either end to help push/pop\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- STATIC DATA MEMORY\r\n//-////////////////////////////////////////////////////////////////////////////\r\nfunction StaticAddrToId(i:int):int; //- each static variable has an id within a module\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- READ-ONLY MEMORY\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nfunction roS8(ptr:int) returns(int);\r\nfunction roU8(ptr:int) returns(int);\r\nfunction roS16(ptr:int) returns(int);\r\nfunction roU16(ptr:int) returns(int);\r\nfunction ro32(ptr:int) returns(int);\r\n\r\nfunction inRo(ptr:int, size:int) returns(bool);\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// GC MEMORY\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\n// valid gc-controlled addresses (must be disjoint from null values)\r\n// warning: because of interior pointers, ?gcHi must be a 32-bit word\r\n// (it can equal 2^32 - 1, but not 2^32)\r\n//const ?gcLo:int := ?memLo + 0x110000 + 0x402000 + 8 * 65536;\r\n//const ?gcHi:int := ?memHi;\r\n//function gcAddr(i:int) returns (bool) {?gcLo <= i && i < ?gcHi}\r\n//function gcAddrEx(i:int) returns (bool) {?gcLo <= i && i <= ?gcHi}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/MemorySpec.imp.basm", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule implementation MemorySpec\r\n{\r\n implementation memAddrBounds(i:int) {}\r\n implementation reveal_Aligned(val:int) {}\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/Memory_axioms.bpl", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//- GC-CONTROLLED MEMORY\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n//- Aligned(i) <==> i is a multiple of 4\r\naxiom (forall i:int, j:int::{TV(i), TO(j)} TV(i) && TO(j) ==> Aligned(i) == Aligned(i + 4 * j));\r\n\r\naxiom NULL < ?memLo;\r\n\r\naxiom ?memLo <= ?memHi;\r\naxiom ?memHi < WORD_HI;\r\n\r\naxiom Aligned(?memLo);\r\naxiom Aligned(?memHi);\r\n\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/Notary/AppRequirements.ifc.stitch", "content": "//-private-import dafny_assembly_s;\r\n//-private-import dafny_be_sequences_s;\r\n//-private-import dafny_bytes_and_words_s;\r\n//-private-import dafny_Digest_s;\r\n//-private-import dafny_GCD_s;\r\n//-private-import dafny_hmac_common_s;\r\n//-private-import dafny_integer_sequences_s;\r\n//-private-import dafny_io_mem_s;\r\n//-private-import dafny_KeyGen_s;\r\n//-private-import dafny_MillerRabin_s;\r\n//-private-import dafny_power_s;\r\n//-private-import dafny_RandomNumberGen_s;\r\n//-private-import dafny_RandomTracing_s;\r\n//-private-import dafny_rfc4251_s;\r\n//-private-import dafny_round_s;\r\n//-private-import dafny_RSASpec_s;\r\n//-private-import dafny_seq_blocking_s;\r\n//-private-import dafny_sha_common_s;\r\n//-private-import dafny_sha1_s;\r\n//-private-import dafny_sha256_s;\r\n//-private-import dafny_tpm_device_s;\r\n//-private-import dafny_CommonState_s;\r\n//-private-import dafny_Notary_s;\r\n//-private-import dafny_StateMachine_s;\r\n\r\n requires fun_TPM__valid($ghost_TPM);\r\n requires fun_TPM__satisfies__integrity__policy($ghost_TPM);\r\n requires $ghost_IoMemPerm is Null;\r\n requires TPM#CommonStateMachine_ctor($ghost_current_common_state) == $ghost_TPM;\r\n requires !initialized#CommonStateMachine_ctor($ghost_current_common_state);\r\n requires !initialized#NotaryStateMachine_ctor($ghost_current_notary_state);\r\n modifies $ghost_TPM;\r\n modifies $ghost_current_common_state;\r\n modifies $ghost_current_notary_state;\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/NucleusInvCopying.bpl", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\n//- The Nucleus defines and establishes NucleusInv, which is abstract to managed code.\r\nfunction NucleusInv($S:int, $StackState:[int]StackState, $toAbs:[int]int, $AbsMem:[int][int]int,\r\n CurrentStack:int, $gcSlice:[int]int, BF:int, BT:int, HeapLo:int, Fi:int, Fk:int, Fl:int, Ti:int, Tj:int, Tk:int, Tl:int,\r\n $Mem:[int]int, stk:[int]int, $dMem:[int]int, $pciMem:[int]int, $tMems:[int][int]int, $fMems:[int][int]int, $gcMem:[int]int,\r\n SLo:int, DLo:int, PciLo:int, TLo:int, FLo:int, GcLo:int, GcHi:int,\r\n $FrameCounts:[int]int, $FrameAddrs:[int][int]int, $FrameLayouts:[int][int]$FrameLayout,\r\n $FrameSlices:[int][int]int, $FrameAbss:[int][int][int]int, $FrameOffsets:[int][int]int,\r\n $IoMmuEnabled:bool, $PciConfigState:[int]int, DmaAddr:int\r\n ) returns(bool);\r\n\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/Overflow.ifc.basm", "content": "//-private-import BaseSpec;\r\n//-private-import MemorySpec;\r\n//-private-import IoTypesSpec;\r\n//-private-import MachineStateSpec;\r\n//-private-import AssemblySpec;\r\n//-private-import InterruptsSpec;\r\n//-private-import IoSpec;\r\n//-\r\n//-\r\n//-\r\n//-private-import Partition;\r\n//-private-import Core;\r\n//-private-import LogicalAddressing;\r\n//-private-import Stacks;\r\n//-private-import Instructions;\r\n//-private-import Separation;\r\n//-private-import Util;\r\n//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\nmodule interface Overflow\r\n modifies state;\r\n{\r\n\r\n//- Handler for arithmetic overflow (always fatal)\r\nprocedure Overflow(my r:regs, my c:core_state);\r\n ensures false;\r\n\r\n}\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/PassHash/AppRequirements.ifc.stitch", "content": "//-private-import dafny_assembly_s;\r\n//-private-import dafny_be_sequences_s;\r\n//-private-import dafny_bytes_and_words_s;\r\n//-private-import dafny_Digest_s;\r\n//-private-import dafny_GCD_s;\r\n//-private-import dafny_hmac_common_s;\r\n//-private-import dafny_integer_sequences_s;\r\n//-private-import dafny_io_mem_s;\r\n//-private-import dafny_KeyGen_s;\r\n//-private-import dafny_MillerRabin_s;\r\n//-private-import dafny_power_s;\r\n//-private-import dafny_RandomNumberGen_s;\r\n//-private-import dafny_RandomTracing_s;\r\n//-private-import dafny_seq_blocking_s;\r\n//-private-import dafny_sha_common_s;\r\n//-private-import dafny_sha1_s;\r\n//-private-import dafny_sha256_s;\r\n//-private-import dafny_tpm_device_s;\r\n//-private-import dafny_round_s;\r\n//-private-import dafny_PassHash_s;\r\n//-private-import dafny_StateMachine_s;\r\n requires fun_TPM__valid($ghost_TPM);\r\n requires fun_TPM__satisfies__integrity__policy($ghost_TPM);\r\n requires $ghost_IoMemPerm is Null;\r\n requires TPM#StateMachine_ctor($ghost_current_state) == $ghost_TPM;\r\n requires !initialized#StateMachine_ctor($ghost_current_state);\r\n modifies $ghost_TPM;\r\n modifies $ghost_current_state;\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/TPMTest/AppRequirements.ifc.stitch", "content": " requires fun_TPM__valid($ghost_TPM);\r\n requires fun_TPM__satisfies__integrity__policy($ghost_TPM);\r\n requires $ghost_IoMemPerm is Null;\r\n modifies $ghost_TPM;\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/TrInc/AppRequirements.ifc.stitch", "content": "//-private-import dafny_assembly_s;\r\n//-private-import dafny_be_sequences_s;\r\n//-private-import dafny_bytes_and_words_s;\r\n//-private-import dafny_Digest_s;\r\n//-private-import dafny_GCD_s;\r\n//-private-import dafny_hmac_common_s;\r\n//-private-import dafny_integer_sequences_s;\r\n//-private-import dafny_io_mem_s;\r\n//-private-import dafny_KeyGen_s;\r\n//-private-import dafny_MillerRabin_s;\r\n//-private-import dafny_power_s;\r\n//-private-import dafny_RandomNumberGen_s;\r\n//-private-import dafny_RandomTracing_s;\r\n//-private-import dafny_rfc4251_s;\r\n//-private-import dafny_round_s;\r\n//-private-import dafny_RSASpec_s;\r\n//-private-import dafny_seq_blocking_s;\r\n//-private-import dafny_sha_common_s;\r\n//-private-import dafny_sha1_s;\r\n//-private-import dafny_sha256_s;\r\n//-private-import dafny_tpm_device_s;\r\n//-private-import dafny_CommonState_s;\r\n//-private-import dafny_TrInc_s;\r\n//-private-import dafny_StateMachine_s;\r\n requires fun_TPM__valid($ghost_TPM);\r\n requires fun_TPM__satisfies__integrity__policy($ghost_TPM);\r\n requires $ghost_IoMemPerm is Null;\r\n requires TPM#CommonStateMachine_ctor($ghost_current_common_state) == $ghost_TPM;\r\n requires !initialized#CommonStateMachine_ctor($ghost_current_common_state);\r\n requires !initialized#TrIncStateMachine_ctor($ghost_current_trinc_state);\r\n modifies $ghost_TPM;\r\n modifies $ghost_current_common_state;\r\n modifies $ghost_current_trinc_state;\r\n" }, { "path": "ironclad-apps/src/Trusted/Spec/Word_axioms.bpl", "content": "//-\r\n//- Copyright (c) Microsoft Corporation. All rights reserved.\r\n//-\r\n\r\n//- Axioms about words\r\n\r\naxiom WORD_HI == 4294967296;\r\n\r\n" }, { "path": "ironclad-apps/tools/Beat/ast.fs", "content": "type id = string\r\ntype loc = string * int\r\ntype bigint = Microsoft.FSharp.Math.bigint\r\n\r\ntype btyp =\r\n| BInt | BBool | BReal\r\n| BArray of btyp list * btyp\r\n| BNamedType of id\r\n\r\ntype field_op = BFieldNative | BFieldFun | BFieldDotFun\r\n\r\ntype buop = \r\n| BNot | BNeg | BOld | BInOutOp\r\n| BField of string * (string * string * field_op) option\r\n| BIs of string\r\n\r\ntype bbop =\r\n| BEquiv | BImply | BAnd | BOr\r\n| BEq | BNe | BLt | BGt | BLe | BGe\r\n| BAdd | BSub | BMul | BDiv | BMod | BRealDiv\r\n| BAddChecked | BSubChecked\r\n| BFieldUpdate of string * string option\r\n\r\ntype bquant =\r\n| BForall | BExists | BLambda\r\n\r\ntype lin_const = LinConst | LinVar | LinInOut\r\ntype lin_scope = LinMy | LinOur\r\ntype linearity = Lin of lin_const * lin_scope | Non\r\ntype bformal = id * btyp\r\ntype bpformal = id * btyp * linearity\r\n\r\ntype bexp =\r\n| BLoc of loc * bexp\r\n| BVar of id\r\n| BIntConst of bigint\r\n| BRealConst of string\r\n| BBv32 of bigint\r\n| BBoolConst of bool\r\n| BUop of buop * bexp\r\n| BBop of bbop * bexp * bexp\r\n| BQuant of bquant * bformal list * bexp list list * bexp\r\n| BSubscript of bexp * bexp list\r\n| BUpdate of bexp * bexp list * bexp\r\n| BApply of id * bexp list\r\n| BCond of bexp * bexp * bexp\r\n\r\ntype bformal_typ =\r\n| BFormalType of btyp\r\n| BFormalAlias of bexp\r\n\r\ntype bformal_var = id * bformal_typ * linearity\r\ntype bformal_fun = id * btyp * bexp option\r\n\r\ntype ret_kind = BRet | BIRet | BEmbellishRet\r\n\r\ntype par_call = id * bexp list\r\ntype bstmt =\r\n| BLocalDecl of id * bformal_typ * linearity * bexp option\r\n| BLabel of id\r\n| BGoto of id\r\n| BAssign of bexp * bexp\r\n| BGroup of bblock\r\n| BIf of bexp * bblock * bblock option\r\n| BWhile of bexp * (loc * bexp) list * bblock\r\n| BForallGhost of bformal list * bexp list list * bexp * bblock\r\n| BAssume of bexp\r\n| BAssert of bexp * bool\r\n| BSplit\r\n| BYield of bexp\r\n| BHavoc of bexp\r\n| BCall of bexp list * id * bexp list * par_call list\r\n| BReturn of ret_kind\r\nand bblock = (loc * bstmt) list\r\n\r\ntype bspec =\r\n| BRequires of bexp\r\n| BEnsures of bexp\r\n| BModifies of bexp list\r\n| BInOut of bpformal list\r\n\r\ntype proc_atomicity = Atomic | Yields | Stable\r\ntype proc_ghost = PGhost | PReal\r\ntype proc_kind = Procedure of proc_ghost * proc_atomicity | Implementation | Instruction\r\n\r\ntype battr = string\r\n\r\ntype fun_decl = id * bformal_fun list * btyp * bexp option * battr option * bexp list list option\r\ntype proc_decl = id * bformal_var list * bpformal list * (loc * bspec) list * bblock option * proc_kind\r\n\r\ntype readwrite = Readonly | ReadWrite\r\ntype bdecl =\r\n| BGlobalDecl of id * btyp * linearity * readwrite\r\n| BGlobalStaticDecl of id * id\r\n| BStaticDecl of id\r\n| BConstDecl of id * btyp * bexp option\r\n| BAxiomDecl of bexp\r\n| BTypeDecl of id * (id list * (linearity * id * bpformal list) list) option\r\n| BFunDecl of fun_decl\r\n| BProcDecl of proc_decl\r\n\r\ntype bdecls = (loc * bdecl) list\r\ntype _module = {mName:id; mIsImpl:bool; mImports:id list; mModifies:id list; mYields:id list; mDecls:(loc * bdecl) list}\r\n\r\n" }, { "path": "ironclad-apps/tools/Beat/beat.vim", "content": "\" Vim syntax file\r\n\" Language: Beat\r\n\" Maintainer: Bryan Parno\r\n\" Last Change: April 2, 2013\r\n\" Version: 1\r\n\r\n\" Use the following lines in your .vimrc file to make use of this file:\r\n\" \" Syntax coloring for Beat/Boogie\r\n\" au BufRead,BufNewFile *.beat set filetype=beat\r\n\" au BufRead,BufNewFile *.bpl set filetype=beat\r\n\" \"au! Syntax beat source $VIM/beat.vim\r\n\r\n\r\nif exists(\"b:current_syntax\") \r\n finish\r\nendif\r\n\r\nsyn case match\r\n\r\nsyn keyword bDecl function procedure implementation atomic module returns instruction\r\nsyn keyword bCond if then else\r\nsyn keyword bRepeat while \r\nsyn keyword bPreReqs requires invariant\r\nsyn keyword bProof ensures modifies assert \r\nsyn keyword bCommentTodo TODO REVIEW contained\r\nsyn keyword bConst const type linear var\r\n\r\n\r\nsyn match bLineComment \"\\/\\/.*\" contains=@Spell,bCommentTodo\r\nsyn region bComment\t start=\"/\\*\" end=\"\\*/\" contains=@Spell,bCommentTodo\r\nsyn match bNumber \"-\\=\\<\\d\\+L\\=\\>\\|0[xX][0-9a-fA-F]\\+\\>\"\r\nsyn match bType \":[a-zA-Z_[\\]]\\+[0-9a-zA-Z_[\\]]\\+\"\r\nsyn match bTrigger \"::\\(\\_[\\t ]*{.\\{-}}\\)\\+\"\r\n\r\nhi def link bDecl PreCondit\r\nhi def link bCond Conditional\r\nhi def link bRepeat Repeat\r\nhi def link bProof Macro\r\nhi def link bType Type\r\nhi def link bComment Comment\r\nhi def link bLineComment Comment\r\nhi def link bCommentTodo Todo\r\nhi def link bConst Keyword\r\nhi def link bNumber Number\r\nhi def link bTrigger Debug\r\nhi def link bPreReqs Underlined\r\n\r\nlet b:current_syntax = \"beat\"\r\n" }, { "path": "ironclad-apps/tools/Beat/lex.fsl", "content": "{\r\nopen Lexing;;\r\nopen Parse;;\r\nopen Parse_util;;\r\nopen Microsoft.FSharp.Compatibility.OCaml.Big_int;;\r\n\r\nlet macros = ref (Map.empty:Map)\r\n\r\nlet pushed_tokens = ref ([]:token list)\r\n\r\nlet rec get_token token_fun buf =\r\n match !pushed_tokens with\r\n | [] ->\r\n (\r\n let token = token_fun buf in\r\n match token with\r\n | Parse.UID x | Parse.LID x | Parse.DUID x | Parse.DLID x | Parse.QUID x | Parse.QLID x ->\r\n (\r\n match Map.tryFind x !macros with\r\n | Some l -> pushed_tokens := l @ !pushed_tokens; get_token token_fun buf\r\n | None -> token\r\n )\r\n | _ -> token\r\n )\r\n | h::t -> pushed_tokens := t; h\r\n}\r\n\r\nrule comment = parse\r\n| \"*/\" { () }\r\n| \"*)\" { () }\r\n| \"/*\" { comment lexbuf ; comment lexbuf }\r\n| \"(*\" { comment lexbuf ; comment lexbuf }\r\n| \"\\n\\r\" { incr line; comment lexbuf }\r\n| \"\\r\\n\" { incr line; comment lexbuf }\r\n| ['\\n''\\r'] { incr line; comment lexbuf }\r\n| _ { comment lexbuf }\r\nand preprocess_skip deep = parse\r\n| \"#else\" { if deep then preprocess_skip deep lexbuf else () }\r\n| \"#endif\" { () }\r\n| \"#ifdef\" { preprocess_skip true lexbuf; preprocess_skip deep lexbuf }\r\n| \"#ifndef\" { preprocess_skip true lexbuf; preprocess_skip deep lexbuf }\r\n| \"\\n\\r\" { incr line; preprocess_skip deep lexbuf }\r\n| \"\\r\\n\" { incr line; preprocess_skip deep lexbuf }\r\n| ['\\n''\\r'] { incr line; preprocess_skip deep lexbuf }\r\n| _ { preprocess_skip deep lexbuf }\r\nand macro_def = parse\r\n| [' ']+[^'\\n''\\r']* { lexeme lexbuf }\r\n| \"\" { \"\" }\r\nand token = parse\r\n| \"\\n\\r\" { incr line; token lexbuf }\r\n| \"\\r\\n\" { incr line; token lexbuf }\r\n| ['\\n''\\r'] { incr line; token lexbuf }\r\n| [' ''\\t'] { token lexbuf }\r\n| \"//\"[^'\\n''\\r']* { token lexbuf }\r\n| \"#line\"[' '][^'\\n''\\r']* { token lexbuf }\r\n| \"/*\" { comment lexbuf ; token lexbuf }\r\n| \"(*\" { comment lexbuf ; token lexbuf }\r\n| \"#ifdef\"[' ']+['A'-'Z''a'-'z''0'-'9''_''$''?']+\r\n{\r\n let s = lexeme lexbuf in\r\n let x = s.Substring(\"#ifdef\".Length).Trim() in\r\n if Map.contains x !macros then token lexbuf else (preprocess_skip false lexbuf ; token lexbuf)\r\n}\r\n| \"#ifndef\"[' ']+['A'-'Z''a'-'z''0'-'9''_''$''?']+\r\n{\r\n let s = lexeme lexbuf in\r\n let x = s.Substring(\"#ifndef\".Length).Trim() in\r\n if not (Map.contains x !macros) then token lexbuf else (preprocess_skip false lexbuf ; token lexbuf)\r\n}\r\n| \"#else\" { preprocess_skip false lexbuf ; token lexbuf }\r\n| \"#endif\" { token lexbuf }\r\n| \"#define\"[' ']+['A'-'Z''a'-'z''0'-'9''_''$''?']+\r\n{\r\n let s = lexeme lexbuf in\r\n let x = s.Substring(\"#define\".Length).Trim() in\r\n let def = macro_def lexbuf in\r\n let buf = Lexing.from_string def in\r\n let rec f l =\r\n match get_token token buf with\r\n | EOF -> l\r\n | t -> f (t::l) in\r\n macros := Map.add x (List.rev (f [])) !macros;\r\n token lexbuf\r\n}\r\n| \":\" { COLON (!file, !line) }\r\n| \";\" { SEMI (!file, !line) }\r\n| \"(\" { LPAREN }\r\n| \")\" { RPAREN }\r\n| \"[\" { LBRACKET }\r\n| \"]\" { RBRACKET }\r\n| \"{\" { LBRACE (!file, !line) }\r\n| \"}\" { RBRACE (!file, !line) }\r\n| \"<\" { LT }\r\n| \">\" { GT }\r\n| \"|\" { BAR }\r\n| \"=\" { EQ }\r\n| \"+\" { PLUS }\r\n| \"-\" { MINUS }\r\n| \"*\" { STAR }\r\n| \"/\" { SLASH }\r\n| \"!\" { BANG }\r\n| \"#\" { HASH }\r\n| \"^\" { CARET }\r\n| \"?\" { QUESTION }\r\n| \",\" { COMMA }\r\n| \".\" { DOT }\r\n| \"_\" { UNDERSCORE }\r\n| \"'\" { SQUOTE }\r\n| \"`\" { BQUOTE }\r\n| \"@\" { AT }\r\n| \"$\" { DOLLAR }\r\n| \"mod\" { MOD }\r\n| \"div\" { DIV }\r\n| \"&\" { AMP }\r\n| \"&&&\" { AMPAMPAMP }\r\n| \"\\\\\" { BACKSLASH }\r\n| \"++\" { PLUSPLUS }\r\n| \"->\" { RARROW }\r\n| \"<-\" { LARROW }\r\n| \"-o\" { RLOL }\r\n| \"=>\" { REQARROW }\r\n| \":=\" { COLONEQ (!file, !line) }\r\n| \"<=\" { LE }\r\n| \">=\" { GE }\r\n| \"==\" { EQEQ (!file, !line) }\r\n| \"!=\" { NE }\r\n| \"&&\" { AMPAMP (!file, !line) }\r\n| \"||\" { BARBAR (!file, !line) }\r\n| \"::\" { COLONCOLON }\r\n| \">>\" { GTGT }\r\n| \"<<\" { LTLT }\r\n| \"==>\" { EQEQGT (!file, !line) }\r\n| \"<==>\" { LTEQEQGT (!file, !line) }\r\n| \"const\" { CONST (!file, !line) }\r\n| \"readonly\" { READONLY (!file, !line) }\r\n| \"function\" { FUNCTION (!file, !line) }\r\n| \"returns\" { RETURNS (!file, !line) }\r\n| \"type\" { TYPE (!file, !line) }\r\n| \"axiom\" { AXIOM (!file, !line) }\r\n| \"procedure\" { PROCEDURE (!file, !line) }\r\n| \"implementation\" { IMPLEMENTATION (!file, !line) }\r\n| \"instruction\" { INSTRUCTION (!file, !line) }\r\n| \"requires\" { REQUIRES (!file, !line) }\r\n| \"ensures\" { ENSURES (!file, !line) }\r\n| \"modifies\" { MODIFIES (!file, !line) }\r\n| \"invariant\" { INVARIANT (!file, !line) }\r\n| \"assume\" { ASSUME (!file, !line) }\r\n| \"assert\" { ASSERT (!file, !line) }\r\n| \"goto\" { GOTO (!file, !line) }\r\n| \"call\" { CALL (!file, !line) }\r\n| \"forall\" { FORALL (!file, !line) }\r\n| \"exists\" { EXISTS (!file, !line) }\r\n| \"lambda\" { LAMBDA (!file, !line) }\r\n| \"old\" { OLD }\r\n| \"fun\" { FUN }\r\n| \"int\" { INT }\r\n| \"real\" { REAL }\r\n| \"bool\" { BOOL }\r\n| \"null\" { NULL }\r\n| \"true\" { LITBOOL true }\r\n| \"false\" { LITBOOL false }\r\n| \"is\" { IS }\r\n| \"let\" { LET (!file, !line) }\r\n| \"in\" { IN }\r\n| \"inout\" { INOUT (!file, !line) }\r\n| \"var\" { VAR (!file, !line) }\r\n| \"if\" { IF (!file, !line) }\r\n| \"then\" { THEN (!file, !line) }\r\n| \"else\" { ELSE (!file, !line) }\r\n| \"while\" { WHILE (!file, !line) }\r\n| \"return\" { RETURN (!file, !line) }\r\n| \"ireturn\" { IRETURN (!file, !line) }\r\n| \"Return\" { RRETURN (!file, !line) }\r\n| \"yield\" { YIELD (!file, !line) }\r\n| \"linear\" { LINEAR }\r\n| \":split_here\" { SPLIT }\r\n| \"my\" { MY }\r\n| \"module\" { MODULE (!file, !line) }\r\n| \"interface\" { INTERFACE (!file, !line) }\r\n| \"import\" { IMPORT (!file, !line) }\r\n| \"atomic\" { ATOMIC }\r\n| \"stable\" { STABLE }\r\n| \"ghost\" { GHOST }\r\n| \"static\" { STATIC (!file, !line) }\r\n(*\r\n| \"eax\" { EAX }\r\n| \"ebx\" { EBX }\r\n| \"ecx\" { ECX }\r\n| \"edx\" { EDX }\r\n| \"esi\" { ESI }\r\n| \"edi\" { EDI }\r\n| \"ebp\" { EBP }\r\n| \"esp\" { ESP }\r\n*)\r\n| \"0x\"['0'-'9''a'-'f''A'-'F']+ {\r\n let s = lexeme lexbuf in\r\n let s = String.sub s 2 (String.length s - 2) in\r\n let rec explode (n:int) s = if n = String.length s then [] else (String.get s n)::(explode (n+1) s) in\r\n let digits = List.map (Char.code << Char.lowercase) (explode 0 s) in\r\n let rec hex digits n =\r\n match digits with\r\n | [] -> n\r\n | h::t ->\r\n let d = if h >= (Char.code 'a') then h - (Char.code 'a') + 10 else h - (Char.code '0') in\r\n hex t (add_int_big_int d (mult_int_big_int 16 n)) in\r\n LITINT (hex digits zero_big_int)\r\n }\r\n| ['0'-'9']+ { LITINT (big_int_of_string(lexeme lexbuf)) }\r\n| ['0'-'9']+['.']['0'-'9']+ { LITREAL (lexeme lexbuf) }\r\n| ['0'-'9']+\"bv32\" { let s = lexeme lexbuf in LITBV32 (big_int_of_string(s.Substring(0, s.Length - 4))) }\r\n| ['_']*['A'-'Z']['#''_''a'-'z''A'-'Z''0'-'9']* { UID ((lexeme lexbuf)) }\r\n| ['_']*['a'-'z']['#''_''a'-'z''A'-'Z''0'-'9']* { LID ((lexeme lexbuf)) }\r\n| '?'['_']*['A'-'Z']['#''_''a'-'z''A'-'Z''0'-'9']* { QUID ((lexeme lexbuf)) }\r\n| '?'['_']*['a'-'z']['#''_''a'-'z''A'-'Z''0'-'9']* { QLID ((lexeme lexbuf)) }\r\n| '$'['_']*['A'-'Z']['#''_''a'-'z''A'-'Z''0'-'9']* { DUID ((lexeme lexbuf)) }\r\n| '$'['_']*['a'-'z']['#''_''a'-'z''A'-'Z''0'-'9']* { DLID ((lexeme lexbuf)) }\r\n| ['_']+['#''_''0'-'9']* { LID ((lexeme lexbuf)) }\r\n| eof { EOF }\r\n| '\\000' { EOF }\r\n| _ { parse_err (\"cannot parse character: \\\"\" ^ (lexeme lexbuf) ^ \"\\\"\" ^ \"\\n(ascii code \" ^ (string_of_int (Char.code (String.get (lexeme lexbuf) 0))) ^ \")\") }\r\n\r\n" }, { "path": "ironclad-apps/tools/Beat/main.fs", "content": "open Ast\r\nopen Parse\r\nopen Parse_util\r\nopen Microsoft.FSharp.Compatibility.OCaml.Big_int;;\r\n\r\nexception LocErr of loc * exn\r\n\r\nlet print_and_exit = ref false\r\nlet print_nonghost_and_exit = ref false\r\n\r\nlet Map_containsKey (x:'a) (m:Map<'a,'b>) = match m.TryFind x with None -> false | Some _ -> true\r\nlet Map_ofList (l:('k * 'a) list):Map<'k,'a> = List.fold (fun m (k, a) -> Map.add k a m) Map.empty l\r\nlet Map_toList (m:Map<'k,'a>):('k * 'a) list = Map.fold (fun k a l -> (k, a)::l) m []\r\nlet Map_cardinal (m:Map<'k,'a>):int = List.length (Map_toList m)\r\nlet Set_ofList (l:'a list):Set<'a> = List.fold (fun s a -> Set.add a s) Set.empty l\r\nlet Set_toList (s:Set<'a>):'a list = Set.fold (fun l a -> a::l) [] s\r\nlet Set_difference (s1:Set<'a>) (s2:Set<'a>) = Set.fold (fun s a -> Set.remove a s) s1 s2\r\n\r\nexception InternalError of string\r\n\r\nlet multi_add (k:'k) (a:'a) (m:Map<'k,'a list>) =\r\n match m.TryFind(k) with\r\n | None -> m.Add(k, [a])\r\n | Some l -> m.Add(k, a::l)\r\n\r\ntype env =\r\n {\r\n global_decls:Map;\r\n global_static_decls:Map;\r\n const_decls:Map;\r\n type_decls:Map;\r\n fun_decls:Map;\r\n proc_decls:Map;\r\n }\r\n\r\nlet build_env decls:env =\r\n List.fold_left\r\n (fun env (l, decl) ->\r\n match decl with\r\n | BGlobalDecl (x, t, _, _) -> {env with global_decls = env.global_decls.Add(x, t)}\r\n | BGlobalStaticDecl (x, mem) -> {env with global_static_decls = env.global_static_decls.Add(x, mem)}\r\n | BConstDecl (x, t, e) -> {env with const_decls = env.const_decls.Add(x, (t, e))}\r\n | BTypeDecl (x, t) -> {env with type_decls = env.type_decls.Add(x, t)}\r\n | BFunDecl ((x, _, _, _, _, _) as d) -> {env with fun_decls = env.fun_decls.Add(x, (l, d))}\r\n | BProcDecl ((x, _, _, _, _, _) as d) when not (Map_containsKey x env.proc_decls) ->\r\n {env with proc_decls = env.proc_decls.Add(x, (l, d))}\r\n | BProcDecl ((x, _, _, _, _, _) as d) -> env\r\n | _ -> env)\r\n {global_decls = Map.empty;\r\n global_static_decls = Map.empty;\r\n const_decls = Map.empty;\r\n type_decls = Map.empty;\r\n fun_decls = Map.empty;\r\n proc_decls = Map.empty;\r\n }\r\n decls\r\n\r\nlet extra_proc_invariants = ref (Map.empty:Map)\r\nlet extra_proc_modifies = ref (Map.empty:Map)\r\n\r\nlet find_constructor (env:env) (xt:id) (xc:id):(linearity * bpformal list) =\r\n match Map.tryFind xt env.type_decls with\r\n | None -> err (\"cannot find declaration of type \" + xt)\r\n | Some None -> err (\"cannot find case \" + xc + \" in type \" + xt)\r\n | Some (Some (_, cases)) ->\r\n (\r\n let cases = List.map (fun (lin, x, fs) -> (x, (lin, fs))) cases in\r\n if not (List.mem_assoc xc cases) then err (\"cannot find case \" + xc + \" in type \" + xt) else\r\n List.assoc xc cases\r\n )\r\n\r\nlet static_addr (x:id):id = \"?ADDR__\" + x\r\n\r\n(*****************************************************************************)\r\n\r\nlet rec map_exp (f:bexp -> bexp option) (e:bexp):bexp =\r\n match (f e) with\r\n | Some e -> e\r\n | None ->\r\n (\r\n let r = map_exp f in\r\n match e with\r\n | BLoc (l, e) -> BLoc (l, r e)\r\n | BVar x -> BVar x\r\n | BIntConst _ -> e\r\n | BRealConst _ -> e\r\n | BBv32 _ -> e\r\n | BBoolConst _ -> e\r\n | BUop (op, e) -> BUop (op, r e)\r\n | BBop (op, e1, e2) -> BBop (op, r e1, r e2)\r\n | BQuant (q, fs, ts, e) -> BQuant (q, fs, List.map (List.map r) ts, r e)\r\n | BSubscript (e, es) -> BSubscript (r e, List.map r es)\r\n | BUpdate (e, es, ee) -> BUpdate (r e, List.map r es, r ee)\r\n | BApply (x, es) -> BApply (x, List.map r es)\r\n | BCond (e1, e2, e3) -> BCond (r e1, r e2, r e3)\r\n )\r\n\r\nlet rec map_stmt (fe:bexp -> bexp) (fs:bstmt -> bstmt option) (l:loc, s:bstmt):(loc * bstmt) =\r\n match fs s with\r\n | Some s -> (l, s)\r\n | None ->\r\n (\r\n match s with\r\n | BLocalDecl (x, t, lin, None) -> (l, s)\r\n | BLocalDecl (x, t, lin, Some e) -> (l, BLocalDecl (x, t, lin, Some (fe e)))\r\n | BLabel x -> (l, s)\r\n | BGoto x -> (l, s)\r\n | BAssign (x, e) -> (l, BAssign (x, fe e))\r\n | BGroup b -> (l, BGroup (map_block fe fs b))\r\n | BIf (e, b1, None) -> (l, BIf (fe e, map_block fe fs b1, None))\r\n | BIf (e, b1, Some b2) -> (l, BIf (fe e, map_block fe fs b1, Some (map_block fe fs b2)))\r\n | BWhile (e, invs, b) ->\r\n (l, BWhile (\r\n fe e,\r\n List.map (fun (l, e) -> (l, fe e)) invs,\r\n map_block fe fs b))\r\n | BForallGhost (xs, ts, e, b) ->\r\n (l, BForallGhost (xs, List.map (List.map fe) ts, fe e, map_block fe fs b))\r\n | BAssume e -> (l, BAssume (fe e))\r\n | BAssert (e, inv) -> (l, BAssert (fe e, inv))\r\n | BSplit -> (l, BSplit)\r\n | BYield e -> (l, BYield (fe e))\r\n | BHavoc e -> (l, BHavoc (fe e))\r\n | BCall (xs, f, es, pars) ->\r\n (l, BCall (xs, f, List.map (fe) es, List.map (fun (x, es) -> (x, List.map fe es)) pars))\r\n | BReturn _ -> (l, s)\r\n )\r\nand map_block (fe:bexp -> bexp) (fs:bstmt -> bstmt option) (b:bblock):bblock = List.map (map_stmt fe fs) b\r\n\r\nlet map_spec (fe:bexp -> bexp) (l:loc, s:bspec):(loc * bspec) =\r\n match s with\r\n | BRequires e -> (l, BRequires (fe e))\r\n | BEnsures e -> (l, BEnsures (fe e))\r\n | BModifies es -> (l, BModifies (List.map fe es))\r\n | BInOut _ -> (l, s)\r\n\r\n// TODO: make more robust?\r\nlet rename_formal_funs (fs:bformal_fun list) (m:Map):(bformal_fun list * Map) =\r\n let m = List.fold (fun m (x, _, _) -> Map.add x (BVar (x + \"__BEAT\")) m) m fs in\r\n let fs = List.map (fun (x, t, e) -> (x + \"__BEAT\", t, e)) fs in\r\n (fs, m)\r\n\r\nlet rename_formals (fs:bformal list) (m:Map):(bformal list * Map) =\r\n let (fs, m) = rename_formal_funs (List.map (fun (x, t) -> (x, t, None)) fs) m in\r\n (List.map (fun (x, t, _) -> (x, t)) fs, m)\r\n\r\nlet subst_id (m:Map) (x:id):id =\r\n if (m.ContainsKey(x)) then\r\n match m.[x] with\r\n | BVar y -> y\r\n | _ -> err (\"internal substitution error: \" + x)\r\n else x\r\n\r\nlet rec subst_exp (m:Map) (e:bexp):bexp =\r\n map_exp\r\n (fun e ->\r\n match e with\r\n | BVar x when m.ContainsKey(x) -> Some (m.[x])\r\n | BQuant (q, fs, ts, e) ->\r\n let (fs, m) = rename_formals fs m in\r\n Some (BQuant (q, fs, List.map (List.map (subst_exp m)) ts, subst_exp m e))\r\n | _ -> None)\r\n e\r\n\r\nlet rec subst_stmt (m:Map) (l:loc, s:bstmt):(loc * bstmt) =\r\n map_stmt\r\n (subst_exp m)\r\n (fun s ->\r\n match s with\r\n | BAssign (x, e) ->\r\n Some (BAssign (subst_exp m x, subst_exp m e))\r\n | BCall (xs, f, es, pars) ->\r\n Some\r\n (BCall (List.map (subst_exp m) xs, f, List.map (subst_exp m) es,\r\n List.map (fun (x, es) -> (x, List.map (subst_exp m) es)) pars))\r\n | _ -> None)\r\n (l, s)\r\n\r\nlet subst_block (m:Map) (b:bblock):bblock = List.map (subst_stmt m) b\r\n\r\nlet subst_spec (m:Map) (l:loc, s:bspec):(loc * bspec) =\r\n map_spec (subst_exp m) (l, s)\r\n\r\n(*****************************************************************************)\r\n\r\nlet regs_id = \"r\"\r\nlet regs_arr = BUop (BField (\"regs\", None), BVar regs_id)\r\nlet reg_efl = BUop (BField (\"efl\", None), BVar regs_id)\r\nlet all_regs = [\"eax\"; \"ebx\"; \"ecx\"; \"edx\"; \"esi\"; \"edi\"; \"esp\"; \"ebp\"]\r\nlet id_is_reg (x:id) =\r\n match x with \"eax\" | \"ebx\" | \"ecx\" | \"edx\" | \"esi\" | \"edi\" | \"ebp\" | \"esp\" -> true | _ -> false\r\n\r\ntype procKind = PIns | PInline | PProc\r\n\r\nlet proc_kind (x:id):procKind =\r\n let rec f i =\r\n match x.[i] with\r\n | '_' -> f (i + 1)\r\n | c when System.Char.IsLower(c) -> PInline\r\n | c when System.Char.IsUpper(c) -> PProc\r\n | _ -> err (\"bad procedure name: \" + x) in\r\n if x.StartsWith(\"instr_\") then PIns else f 0\r\n\r\n(*\r\nlet get_op f =\r\n match f with\r\n | \"Add\" | \"AddChecked\" -> BAdd\r\n | \"Sub\" | \"SubChecked\" -> BSub\r\n | _ -> err (\"unsupported memory operation: \" + f) in\r\n*)\r\n\r\nlet expand_deep_conjuncts = ref true;\r\n\r\nlet rec list_of_conjuncts (env:env) (depth:int) ((fBase, lBase):loc) ((f, l):loc) (e:bexp):(loc * bexp) list =\r\n let lb = if lBase = l && fBase.EndsWith(f) then (fBase, lBase) else (fBase + \"(\" + (string lBase) + \") --> \" + f, l) in\r\n match e with\r\n | (BApply (\"&&&\", [ee])) -> list_of_conjuncts env (depth + 1) (fBase, lBase) (f, l) ee\r\n | _ ->\r\n (\r\n if depth = 0 then [(lb, e)] else\r\n let f0 = list_of_conjuncts env (depth - 0) lb in\r\n let f1 = list_of_conjuncts env (depth - 1) lb in\r\n match e with\r\n | BLoc (lAnd, BBop (BAnd, e1, e2)) ->\r\n (f0 lb e1) @ (f1 lAnd e2)\r\n | BApply (x, es) when env.fun_decls.ContainsKey(x) ->\r\n (\r\n let (lf, (_, fs, _, ee, _, _)) = env.fun_decls.[x] in\r\n match ee with\r\n | None -> [(lb, e)]\r\n | Some ee ->\r\n let m = List.map2 (fun (x, _, _) e -> (x, e)) fs es in\r\n let s = new Map(m)\r\n f0 lf (subst_exp s ee)\r\n )\r\n | BBop (BImply, e1, e2) when !expand_deep_conjuncts ->\r\n List.map (fun (l, e) -> (l, BBop (BImply, e1, e))) (f0 lb e2)\r\n | BCond (e1, e2, e3) when !expand_deep_conjuncts ->\r\n f0 lb (BLoc (lb, BBop (BAnd, BBop(BImply, e1, e2), BBop(BImply, BUop(BNot, e1), e3))))\r\n | BQuant (q, fs, ts, e) when !expand_deep_conjuncts ->\r\n List.map (fun (l, e) -> (l, BQuant (q, fs, ts, e))) (f0 lb e)\r\n | _ -> [(lb, e)]\r\n )\r\n\r\nlet rec expand_conjuncts_stmt (env:env) (depth:int) (l:loc, s:bstmt):(loc * bstmt) list =\r\n let f = expand_conjuncts_block env depth in\r\n match s with\r\n | BIf (e, b1, b2) -> [(l, BIf (e, f b1, match b2 with None -> None | Some b2 -> Some (f b2)))]\r\n | BWhile (e, invs, b) ->\r\n let invs = List.flatten (List.map (fun (l, e) -> list_of_conjuncts env depth l l e) invs) in\r\n [(l, BWhile (e, invs, f b))]\r\n | BAssert (e, inv) -> List.map (fun (l, e) -> (l, BAssert (e, inv))) (list_of_conjuncts env depth l l e)\r\n | _ -> [(l, s)]\r\nand expand_conjuncts_block (env:env) (depth:int) (b:bblock):bblock =\r\n List.flatten (List.map (expand_conjuncts_stmt env depth) b)\r\n\r\nlet expand_conjuncts_spec (env:env) (depth:int) (l:loc, s:bspec):(loc * bspec) list =\r\n match s with\r\n | BRequires e -> List.map (fun (l, e) -> (l, BRequires e)) (list_of_conjuncts env depth l l e)\r\n | BEnsures e -> List.map (fun (l, e) -> (l, BEnsures e)) (list_of_conjuncts env depth l l e)\r\n | _ -> [(l, s)]\r\n\r\nlet expand_conjuncts_decl (env:env) (depth:int) (l:loc, d:bdecl):(loc * bdecl) =\r\n match d with\r\n | BProcDecl (x, ps, rets, specs, b, p) ->\r\n (l, BProcDecl (x, ps, rets,\r\n List.flatten (List.map (expand_conjuncts_spec env depth) specs),\r\n (match b with None -> None | Some b -> Some (expand_conjuncts_block env depth b)),\r\n p))\r\n | _-> (l, d)\r\n\r\nlet expand_conjuncts_decls (env:env) (depth:int) = List.map (expand_conjuncts_decl env depth)\r\n\r\n\r\n(*\r\nlet expand_apply_decl (env:env) (l:loc, d:bdecl):(loc * bdecl) =\r\n let rec fe e =\r\n match e with\r\n | BApply (x, es) when x.StartsWith(\"&\") && x.Length > 1 ->\r\n (\r\n match Map.tryFind (x.Substring(1)) env.fun_decls with\r\n | Some (_, (_, fs, _, Some ef, _, _)) ->\r\n let m = List.map2 (fun (xf, _, _) ea -> (xf, ea)) fs es in\r\n Some (BApply (\"&\", [map_exp fe (subst_exp (Map_ofList m) ef)]))\r\n | _ -> err (\"could not find definition for function instantiation \" + x)\r\n )\r\n | _ -> None\r\n in\r\n match d with\r\n | BProcDecl (x, ps, rets, specs, b, p) ->\r\n (l, BProcDecl (x, ps, rets,\r\n (List.map (map_spec (map_exp fe)) specs),\r\n (match b with None -> None | Some b -> Some (map_block (map_exp fe) (fun s -> None) b)),\r\n p))\r\n | _-> (l, d)\r\n\r\nlet expand_apply_decls (env:env) = List.map (expand_apply_decl env)\r\n*)\r\n\r\n(*****************************************************************************)\r\n\r\nlet rec sep_list (sep:string) (l:string list) =\r\n match l with\r\n | [] -> \"\"\r\n | [x] -> x\r\n | h::t -> h + sep + (sep_list sep t)\r\n\r\nlet rec string_of_btyp t =\r\n match t with\r\n | BInt -> \"int\"\r\n | BBool -> \"bool\"\r\n | BReal -> \"real\"\r\n | BArray (ts, t) -> \"[\" + (sep_list \",\" (List.map string_of_btyp ts)) + \"]\" + (string_of_btyp t)\r\n | BNamedType x -> x\r\n\r\nlet string_of_buop op =\r\n match op with\r\n | BNot -> \"!\"\r\n | BNeg -> \"-\"\r\n | BOld -> \"old\"\r\n | _ -> \"<<>>\"\r\n\r\nlet string_of_bbop op =\r\n match op with\r\n | BEquiv -> \"<==>\"\r\n | BImply -> \"==>\"\r\n | BAnd -> \"&&\"\r\n | BOr -> \"||\"\r\n | BEq -> \"==\"\r\n | BNe -> \"!=\"\r\n | BLt -> \"<\"\r\n | BGt -> \">\"\r\n | BLe -> \"<=\"\r\n | BGe -> \">=\"\r\n | BAdd -> \"+\"\r\n | BSub -> \"-\"\r\n | BMul -> \"*\"\r\n | BDiv -> \" div \"\r\n | BMod -> \" mod \"\r\n | BRealDiv -> \" / \"\r\n | BAddChecked -> \"$+\"\r\n | BSubChecked -> \"$-\"\r\n | _ -> \"<<>>\"\r\n\r\nlet string_of_bquant q =\r\n match q with\r\n | BForall -> \"forall\"\r\n | BExists -> \"exists\"\r\n | BLambda -> \"lambda\"\r\n\r\nlet string_of_linearity (l:linearity) =\r\n match l with\r\n | Lin (LinVar, LinOur) -> \"linear \"\r\n | Lin (LinVar, LinMy) -> \"my \"\r\n | Lin (LinConst, LinOur) -> \"const linear \"\r\n | Lin (LinConst, LinMy) -> \"const my \"\r\n | Lin (LinInOut, LinOur) -> \"inout linear \"\r\n | Lin (LinInOut, LinMy) -> \"inout my \"\r\n | Non -> \"\"\r\n\r\nlet string_of_bformal (x, t) = x + \":\" + (string_of_btyp t)\r\nlet string_of_bpformal (x, t, lin) = (string_of_linearity lin) + x + \":\" + (string_of_btyp t)\r\nlet string_of_bformal_fun (x, t, _) = x + \":\" + (string_of_btyp t)\r\n\r\nlet string_of_bformal_var (x, t) =\r\n match t with\r\n | BFormalType t -> x + \":\" + (string_of_btyp t)\r\n | BFormalAlias t -> (\"<<>>\")\r\n\r\nlet string_of_bpformal_var (x, t, lin) = (string_of_linearity lin) + (string_of_bformal_var (x, t))\r\n\r\nlet prec_of_uop op = match op with | BNot -> 50 | BNeg -> 50 | BOld -> 99 | _ -> 99\r\nlet prec_of_bop op =\r\n match op with\r\n | BEquiv -> 10 | BImply -> 10\r\n | BAnd -> 15 | BOr -> 15\r\n | BEq -> 20 | BNe -> 20 | BLt -> 20 | BGt -> 20 | BLe -> 20 | BGe -> 20\r\n | BAdd -> 30 | BSub -> 30 | BAddChecked -> 30 | BSubChecked -> 30\r\n | BMul -> 35 | BDiv -> 35 | BMod -> 35 | BRealDiv -> 35\r\n | _ -> 99\r\n\r\nlet can_eval_op op =\r\n match op with\r\n | BAdd\r\n | BSub\r\n | BMul\r\n | BDiv -> true\r\n | _ -> false\r\n\r\n//-evaluates integers only\r\nlet eval_op op (i1:bigint) (i2:bigint) =\r\n match op with\r\n | BAdd -> i1 + i2\r\n | BSub -> i1 - i2\r\n | BMul -> i1 * i2\r\n | BDiv -> i1 / i2\r\n | _ -> raise (InternalError(\"eval_op does not expect this operator\"))\r\n\r\n//-evaluates integer constants only \r\nlet rec eval_constants_in_bexp e =\r\n match e with\r\n | BBop (op, e1, e2) when (can_eval_op op) ->\r\n let e1' = eval_constants_in_bexp e1 in\r\n let e2' = eval_constants_in_bexp e2 in\r\n (match e1', e2' with\r\n //do not reduce 0-1 etc\r\n | (BIntConst i1), (BIntConst i2) when not (i1 = 0I && op = BSub) -> BIntConst (eval_op op i1 i2)\r\n | _ -> BBop(op, e1', e2')\r\n )\r\n | _ -> e\r\n\r\nlet rec multiline_string_of_bexp (multiline:bool) (prec:int) (e:bexp):string =\r\n let string_of_bexp = multiline_string_of_bexp multiline in\r\n let e' = eval_constants_in_bexp e in\r\n let loc_string (f, i) = \"/*LOC*//*LOC:\" + f + \",\" + (string i) + \"*/\" in\r\n let bbop s op e1 e2 =\r\n let ep = prec_of_bop op in\r\n let (epLeft, epRight) =\r\n match op with\r\n | BAdd | BSub | BMul | BDiv | BMod | BRealDiv | BAddChecked | BSubChecked -> (ep, ep + 1)\r\n | _ -> (ep + 1, ep + 1)\r\n ((string_of_bexp epLeft e1) + s + (string_of_bbop op) + (string_of_bexp epRight e2), ep)\r\n let (s, ePrec) =\r\n match e' with\r\n | BVar x -> (x, 99)\r\n | BIntConst i -> (string i, 99)\r\n | BRealConst r -> (r, 99)\r\n | BBv32 i -> ((string i) + \"bv32\", 99)\r\n | BBoolConst true -> (\"true\", 99)\r\n | BBoolConst false -> (\"false\", 99)\r\n | BUop (BField (x, Some (_, xc, BFieldNative)), e) -> (x + \"#\" + xc + \"(\" + (string_of_bexp 5 e) + \")\", 99)\r\n | BUop (BField (x, Some (_, xc, BFieldFun)), e) -> (xc + \"__\" + x + \"(\" + (string_of_bexp 5 e) + \")\", 99)\r\n | BUop (BField (x, _), e) -> (\"(\" + (string_of_bexp 5 e) + \".\" + x + \")\", 99)\r\n | BUop (BNeg, e) -> (\"(-\" + (string_of_bexp ((prec_of_uop BNot) + 1) e) + \")\", 99)\r\n | BUop (BIs x, e) -> (\"(\" + (string_of_bexp 5 e) + \" is \" + x + \")\", 99)\r\n | BUop (op, e) -> let ep = prec_of_uop op in ((string_of_buop op) + (string_of_bexp (ep + 1) e), ep)\r\n | BBop (BFieldUpdate (xf, Some xc), e1, e2) ->\r\n (xc + \"_update__\" + xf + \"(\" + (string_of_bexp 5 e1) + \",\" + (string_of_bexp 5 e2) + \")\", 99)\r\n | BBop (BFieldUpdate (xf, None), e1, e2) -> (\"<<>>\", 99)\r\n | BLoc (l, (BBop (op, e1, e2))) when multiline -> bbop (loc_string l) op e1 e2\r\n | BBop (op, e1, e2) -> bbop \"\" op e1 e2\r\n | BQuant (q, fs, ts, e) ->\r\n ( (string_of_bquant q) + \" \"\r\n + (sep_list \",\" (List.map string_of_bformal fs))\r\n + \"::\"\r\n + (sep_list \"\" (List.map (fun t -> \"{\"+ (sep_list \",\" (List.map (string_of_bexp 5) t)) + \"}\") ts))\r\n + (string_of_bexp 6 e),\r\n (-5)\r\n )\r\n | BSubscript (e, es) -> ((string_of_bexp 90 e) + \"[\" + (sep_list \",\" (List.map (string_of_bexp 5) es)) + \"]\", 40)\r\n | BUpdate (e, es, ee) -> ((string_of_bexp 90 e) + \"[\" + (sep_list \",\" (List.map (string_of_bexp 90) es)) + \":=\" + (string_of_bexp 90 ee) + \"]\", 40)\r\n | BApply (\"&&&\", [ee]) -> (string_of_bexp prec ee, prec)\r\n | BApply (\"static\", [emem; BApply (x, _)]) ->\r\n (string_of_bexp prec (BSubscript (BUop (BField (\"map\", Some (\"mem\", \"mem\", BFieldNative)), emem), [BVar (static_addr x)])), prec)\r\n | BApply (x, es) -> (x + \"(\" + (sep_list \",\" (List.map (string_of_bexp 5) es)) + \")\", 90)\r\n | BCond (e1, e2, e3) -> (\"if \" + (string_of_bexp 90 e1) + \" then \" + (string_of_bexp 90 e2) + \" else \" + (string_of_bexp 90 e3), 0)\r\n | BLoc (l, e) when multiline -> (loc_string l + (string_of_bexp prec e), 0)\r\n | BLoc ((f, i), e) -> (string_of_bexp prec e, 0)\r\n in if prec <= ePrec then s else \"(\" + s + \")\"\r\n\r\ntype print_state =\r\n {\r\n print_out:System.IO.TextWriter;\r\n indent:string;\r\n cur_loc:loc ref;\r\n }\r\n member this.PrintLine (s:string) =\r\n if s.Trim() = \"\" && (!print_and_exit || !print_nonghost_and_exit) then () else\r\n let ss = s.Split ([|\"/*LOC*/\"|], System.StringSplitOptions.None) in\r\n this.print_out.Write (this.indent)\r\n let newline () =\r\n let (f, i) = !this.cur_loc in (this.cur_loc := (f, i + 1));\r\n this.print_out.WriteLine () in\r\n for s in ss do\r\n (\r\n if s.StartsWith(\"/*LOC:\") then\r\n let i1 = \"/*LOC:\".Length in\r\n let i2 = s.IndexOf(\",\") in\r\n let i3 = i2 + (\",\".Length) in\r\n let i4 = s.IndexOf(\"*/\") in\r\n let i5 = i4 + (\"*/\".Length) in\r\n let f = s.Substring(i1, i2 - i1) in\r\n let i = System.Int32.Parse(s.Substring(i3, i4 - i3)) in\r\n let rest = s.Substring(i5) in\r\n let (cf, ci) = !this.cur_loc in\r\n if f = cf && i <= ci then\r\n this.print_out.Write (rest)\r\n else\r\n newline ();\r\n this.SetLoc (f, i);\r\n this.print_out.Write (\" \" + rest)\r\n else\r\n this.print_out.Write (s)\r\n );\r\n newline ()\r\n member this.SetLoc (((f, i) as l):loc) =\r\n if (!print_and_exit || !print_nonghost_and_exit) then this.cur_loc := l else\r\n let (cf, ci) as cl = !this.cur_loc in\r\n if l = cl then ()\r\n else if f <> cf || i < ci || i > ci + 8 then this.cur_loc := l; this.print_out.WriteLine (\"#line \" + (string i) + \" \" + f)\r\n else this.PrintLine \"\"; this.SetLoc l\r\n\r\nlet rec print_bstmt (state:print_state) (l:loc, s) =\r\n let () = state.SetLoc l in\r\n let p:(string -> unit) = state.PrintLine in\r\n let string_of_bexp = multiline_string_of_bexp true\r\n let fcall x es = x + \"(\" + (sep_list \",\" (List.map (string_of_bexp 5) es)) + \")\" in\r\n let fpars pars = String.concat \"\" (List.map (fun (x, es) -> \" | \" + fcall x es) pars) in\r\n match s with\r\n | BLocalDecl (x, t, lin, None) -> p ((string_of_linearity lin) + \"var \" + (string_of_bformal_var (x, t)) + \";\")\r\n | BLocalDecl (x, t, lin, Some e) -> p ((string_of_linearity lin) + \"var \" + (string_of_bformal_var (x, t)) + \"=\" + (string_of_bexp 0 e) + \";\")\r\n | BLabel x -> p (x + \":\")\r\n | BGoto x -> p (\"goto \" + x + \";\")\r\n | BAssign (x, e) -> p ((string_of_bexp (-5) x) + \":=\" + (string_of_bexp 0 e) + \";\")\r\n | BGroup b -> print_bblock_s state \"{:\" \":}\" b\r\n | BIf (e, b1, b2) ->\r\n (\r\n p (\"if(\" + (string_of_bexp 0 e) + \")\");\r\n print_bblock state b1;\r\n (match b2 with None -> () | Some b -> print_bblock state b)\r\n )\r\n | BWhile (e, invs, b) ->\r\n (\r\n p (\"while(\" + (string_of_bexp 0 e) + \")\");\r\n List.iter (fun (l:loc, e) -> state.SetLoc l; p (\"invariant \" + (string_of_bexp 0 e))) invs;\r\n print_bblock state b\r\n )\r\n | BForallGhost (fs, ts, e, b) ->\r\n (\r\n p (\"forall \" + (sep_list \",\" (List.map string_of_bformal fs)) + \"::\"\r\n + (sep_list \"\" (List.map (fun t -> \"{\" + (sep_list \",\" (List.map (string_of_bexp 5) t)) + \"}\") ts))\r\n + (string_of_bexp 6 e));\r\n print_bblock state b\r\n )\r\n | BAssume e -> p (\"assume \" + (string_of_bexp 0 e) + \";\")\r\n | BAssert (e, inv) -> p ((if inv then \"invariant \" else \"assert \") + (string_of_bexp 0 e) + \";\")\r\n | BSplit -> p (\"assert {:split_here} true;\")\r\n | BYield e -> p (\"yield \" + (string_of_bexp 0 e) + \";\")\r\n | BHavoc e -> p (\"havoc \" + (string_of_bexp (-5) e) + \";\")\r\n | BCall (xs, f, es, []) when f.StartsWith(\"construct##\") ->\r\n let f = f.Substring(\"construct##\".Length) in\r\n p (\"let \" + (sep_list \",\" (List.map (string_of_bexp (-5)) xs)) + \":=\" + (fcall f es) + \";\")\r\n | BCall (es, f, xs, []) when f.StartsWith(\"destruct##\") ->\r\n let f = f.Substring(\"destruct##\".Length) in\r\n p (\"let \" + (fcall f es) + \":=\" + (sep_list \",\" (List.map (string_of_bexp (-5)) xs)) + \";\")\r\n | BCall ([], f, es, pars) -> p (\"call \" + (fcall f es) + (fpars pars) + \";\")\r\n | BCall (xs, f, es, pars) -> p (\"call \" + (sep_list \",\" (List.map (string_of_bexp (-5)) xs)) + \":=\" + (fcall f es) + (fpars pars) + \";\")\r\n | BReturn BRet -> p \"return;\"\r\n | BReturn BIRet -> p \"ireturn;\"\r\n | BReturn BEmbellishRet -> p \"Return;\"\r\nand print_bblock (state:print_state) b = print_bblock_s state \"{\" \"}\" b\r\nand print_bblock_s (state:print_state) sl sr b =\r\n state.PrintLine sl;\r\n List.iter (print_bstmt {state with indent = \" \" + state.indent}) b;\r\n state.PrintLine sr\r\n\r\nlet print_bspec (state:print_state) (l:loc, s) =\r\n let () = state.SetLoc l in\r\n let p:(string -> unit) = state.PrintLine in\r\n let string_of_bexp = multiline_string_of_bexp true\r\n match s with\r\n | BRequires e -> p (\"requires \" + (string_of_bexp 0 e) + \";\")\r\n | BEnsures e -> p (\"ensures \" + (string_of_bexp 0 e) + \";\")\r\n | BModifies [] | BInOut [] -> ()\r\n | BModifies es -> p (\"modifies \" + (sep_list \",\" (List.map (string_of_bexp (-99) ) es)) + \";\")\r\n | BInOut fs -> p (\"inout \" + (sep_list \",\" (List.map string_of_bpformal fs)) + \";\")\r\n\r\nlet string_of_procimpl p =\r\n let gs g = match g with PReal -> \"\" | PGhost -> \"ghost \" in\r\n match p with\r\n | Procedure (g, Yields) -> (gs g) + \"procedure\"\r\n | Procedure (g, Atomic) -> \"atomic \" + (gs g) + \"procedure\"\r\n | Procedure (g, Stable) -> \"stable \" + (gs g) + \"procedure\"\r\n | Implementation -> \"implementation\"\r\n | Instruction -> \"instruction\"\r\n\r\nlet string_of_readwrite rw = match rw with Readonly -> \"readonly \" | ReadWrite -> \"\"\r\n\r\nlet print_bdecl (state:print_state) (l:loc, decl) =\r\n let () = state.SetLoc l in\r\n let p:(string -> unit) = state.PrintLine in\r\n let string_of_bexp = multiline_string_of_bexp true\r\n match decl with\r\n | BGlobalDecl (x, t, l, rw) -> p ((string_of_readwrite rw) + (string_of_linearity l) + \"var \" + x + \":\" + (string_of_btyp t) + \";\")\r\n | BGlobalStaticDecl (x, mem) -> p (\"var \" + x + \" @ \" + mem + \";\")\r\n | BConstDecl (x, t, e_opt) ->\r\n let init = (match e_opt with None -> \"\" | Some e -> \" := \" + (string_of_bexp 0 e)) in\r\n p (\"const \" + x + \":\" + (string_of_btyp t) + init + \";\")\r\n | BStaticDecl x -> p (\"static \" + x + \";\")\r\n | BAxiomDecl e -> p (\"axiom \" + (string_of_bexp 0 e) + \";\")\r\n | BTypeDecl (x, None) -> p (\"type \" + x + \";\")\r\n | BTypeDecl (x, Some (_, cs)) ->\r\n p (\"type{:overload} \" + x + \" = \"\r\n + (String.concat \" | \" (List.map (fun (lin, x, fs) -> (string_of_linearity lin) + x + \"(\" + (String.concat \",\" (List.map string_of_bpformal fs)) + \")\") cs)) + \";\")\r\n | BFunDecl (x, ps, t, e, a, ts_opt) ->\r\n (\r\n let attr = match a with None -> \"\" | Some s -> \"{\" + s + \"}\" in\r\n let impl =\r\n match ts_opt with\r\n | None -> \"\"\r\n | Some ts ->\r\n \" implementation\" + (sep_list \"\" (List.map (fun t ->\r\n \"{\"+ (sep_list \",\" (List.map (string_of_bexp 5) t)) + \"}\") ts)) in\r\n let r = \":\" + (string_of_btyp t) + (match e with None -> \";\" | _ -> \"\") in\r\n p (\"function\" + attr + impl + \" \" + x + \"(\" + (sep_list \",\" (List.map string_of_bformal_fun ps)) + \")\" + r);\r\n (match e with\r\n None -> ()\r\n | Some e ->\r\n (\r\n p (\"{\");\r\n p (\" \" + (string_of_bexp 0 e));\r\n p (\"}\")\r\n )\r\n )\r\n )\r\n | BProcDecl (x, ps, rets, specs, b, pi) ->\r\n (\r\n let r = (match rets with _::_ -> (\"returns(\" + (sep_list \",\" (List.map string_of_bpformal rets)) + \")\") | _ -> \"\") in\r\n let semi = (match b with None -> \";\" | _ -> \"\") in\r\n p ((string_of_procimpl pi) + \" \" + x + \"(\" + (sep_list \",\" (List.map string_of_bpformal_var ps)) + \")\" + r + semi)\r\n List.iter (print_bspec state) specs;\r\n (match b with None -> () | Some b -> print_bblock state b)\r\n )\r\n\r\nlet print_module (state:print_state) (m:_module):unit =\r\n state.PrintLine (\"module \" + (if m.mIsImpl then \"implementation\" else \"interface\") + \" \" + m.mName);\r\n (if List.length m.mImports > 0 then state.PrintLine (\" import \" + (String.concat \", \" (m.mImports)) + \";\"));\r\n (if List.length m.mModifies > 0 then state.PrintLine (\" modifies \" + (String.concat \", \" (m.mModifies)) + \";\"));\r\n (if List.length m.mYields > 0 then state.PrintLine (\" yield \" + (String.concat \", \" (m.mYields)) + \";\"));\r\n //state.PrintLine \"{\"; // HACK: omit braces to enable file concatenation\r\n List.iter (print_bdecl state) m.mDecls;\r\n //state.PrintLine \"}\"\r\n\r\nlet string_of_bexp = multiline_string_of_bexp false\r\n\r\n(*****************************************************************************)\r\n\r\nlet expand_opaque_decl (l:loc, d:bdecl):(loc * bdecl) list =\r\n try\r\n (\r\n match d with\r\n | BFunDecl (x, ps, t, Some e, Some a, None) when a = \":opaque\" ->\r\n // function{:opaque} f(x:tx):tr { e }\r\n // ==>\r\n // function T___BEAT_f(x:tx):bool { true }\r\n // function f(x:tx):tr;\r\n // function implementation{T___BEAT_f(x)} f(x:tx):tr { e }\r\n // atomic ghost procedure reveal_f() ensures (forall x:tx::{f(x)} f(x) == e);\r\n // { forall x:t::{f(x)} f(x) == e {assert T___BEAT_f(x);} }\r\n let xtrig = \"T___BEAT_\" + x in\r\n let args = List.map (fun (xf, _, _) -> BVar xf) ps in\r\n let ps_bformal = List.map (fun (xf, tf, _) -> (xf, tf)) ps in\r\n let ftrig = BFunDecl (xtrig, ps, BBool, Some (BBoolConst true), None, None) in\r\n let fdecl = BFunDecl (x, ps, t, None, None, None) in\r\n let fimpl = BFunDecl (x, ps, t, Some e, None, Some [[BApply (xtrig, args)]]) in\r\n let fapp = BApply (x, args) in\r\n let eq = BBop (BEq, fapp, e) in\r\n let ens = BEnsures (BQuant (BForall, ps_bformal, [[fapp]], eq)) in\r\n let s_assert = BAssert (BApply (xtrig, args), false) in\r\n let s_forall = BForallGhost (ps_bformal, [[fapp]], eq, [(l, s_assert)]) in\r\n let pk = Procedure (PGhost, Atomic) in\r\n let preveal = BProcDecl (\"reveal_\" + x, [], [], [(l, ens)], Some [(l, s_forall)], pk) in\r\n [(l, ftrig); (l, fdecl); (l, fimpl); (l, preveal)]\r\n | _ -> [(l, d)]\r\n ) with e -> raise (LocErr (l, e))\r\n\r\nlet expand_opaque_decls ds = List.collect expand_opaque_decl ds\r\n\r\n(*****************************************************************************)\r\n\r\ntype senv = Map //- map function name to function return type\r\ntype cenv = Map //- map type name to constructor names and field names\r\nlet do_compile = ref false\r\n\r\nlet add_summary_env (decls:bdecl list) (senv:senv) (cenv:cenv):(senv * cenv) =\r\n List.fold\r\n (fun (senv, cenv) d ->\r\n match d with\r\n | BGlobalDecl (x, t, _, _) -> (Map.add x t senv, cenv)\r\n | BTypeDecl (xt, Some (_, cases)) ->\r\n (\r\n let senv =\r\n List.fold (fun senv (_, xc, ps) ->\r\n let senv = Map.add (\"##\" + xc) (BNamedType xt) senv in\r\n List.fold (fun senv (xf, tf, _) -> Map.add (xf + \"#\" + xc) tf senv) senv ps)\r\n senv\r\n cases in\r\n let cenv = Map.add xt (List.map (fun (_, xc, ps) -> (xc, List.map (fun (xf, _, _) -> xf) ps)) cases) cenv in\r\n (senv, cenv)\r\n )\r\n | BFunDecl (x, _, ret, _, _, _) -> (Map.add (\"##\" + x) ret senv, cenv)\r\n | _ -> (senv, cenv))\r\n (senv, cenv)\r\n decls\r\n\r\nlet summary_env (decls:bdecl list):(senv * cenv) = add_summary_env decls Map.empty Map.empty\r\n\r\n(*****************************************************************************)\r\n\r\n//- replace f with this.f for each f in this's datatype\r\nlet expand_this_decl (cenv:cenv) (l:loc, d:bdecl):(loc * bdecl) =\r\n try\r\n (\r\n let this_subst (t:btyp) =\r\n match t with\r\n | BNamedType xt ->\r\n (\r\n match Map.tryFind xt cenv with\r\n | Some cs ->\r\n let fields = List.collect (fun (xc, fs) -> List.map (fun xf -> (xc, xf)) fs) cs in\r\n List.fold\r\n (fun m (xc, xf) -> Map.add xf (BUop (BField (xf, Some (xt, xc, BFieldNative)), BVar \"this\")) m)\r\n Map.empty\r\n fields\r\n | None -> err (\"could not find fields of type \" + xt)\r\n )\r\n | _ -> err (\"'this' parameter must be a datatype\")\r\n in\r\n match d with\r\n | BFunDecl (xfun, ps, tret, Some e, a, ts) when List.exists (fun (x, _, _) -> x = \"this\") ps ->\r\n let (_, t, _) = List.find (fun (x, _, _) -> x = \"this\") ps in\r\n let e = subst_exp (this_subst t) e\r\n (l, BFunDecl (xfun, ps, tret, Some e, a, ts))\r\n | BProcDecl (xp, ps, rs, specs, b_opt, pk) ->\r\n (\r\n let var_ps = List.choose (fun (x, tf, _) ->\r\n match tf with BFormalType t -> Some (x, t) | _ -> None) ps in\r\n let inouts = List.collect (fun (_, s) -> match s with BInOut es -> es | _ -> []) specs in\r\n let var_rs = List.map (fun (x, t, _) -> (x, t)) (inouts @ rs) in\r\n let vars = var_ps @ var_rs in\r\n if (List.mem_assoc \"this\" vars) then\r\n let subst_map = this_subst (List.assoc \"this\" vars) in\r\n let specs = List.map (subst_spec subst_map) specs in\r\n let b_opt = match b_opt with None -> None | Some b -> Some (subst_block subst_map b) in\r\n (l, BProcDecl (xp, ps, rs, specs, b_opt, pk))\r\n else (l, BProcDecl (xp, ps, rs, specs, b_opt, pk))\r\n )\r\n | _ -> (l, d)\r\n ) with e -> raise (LocErr (l, e))\r\n\r\nlet expand_this_decls (cenv:cenv) ds = List.map (expand_this_decl cenv) ds\r\n\r\n(*****************************************************************************)\r\n\r\nlet rec expand_overload_exp (senv:senv) (cenv:cenv) (e:bexp):bexp =\r\n fst (expand_overload_exp_typ senv cenv e)\r\nand expand_overload_exp_typ (senv:senv) (cenv:cenv) (e:bexp):(bexp * btyp option) =\r\n let fe = expand_overload_exp senv cenv in\r\n let ft = expand_overload_exp_typ senv cenv in\r\n match e with\r\n | BLoc (l, e1) -> let (e1, t) = ft e1 in (BLoc (l, e1), t)\r\n | BVar x -> (e, Map.tryFind x senv)\r\n | BIntConst _ -> (e, None)\r\n | BRealConst _ -> (e, None)\r\n | BBv32 _ -> (e, None)\r\n | BBoolConst _ -> (e, None)\r\n// | BBitVectorConst _ -> (e, None)\r\n | BUop (BOld, e1) -> let (e1, t) = ft e1 in (BUop (BOld, e1), t)\r\n | BUop (BField (xf, _), e1) ->\r\n (\r\n match ft e1 with\r\n | (e1, Some (BNamedType xt)) ->\r\n (\r\n let app () =\r\n (\r\n match (Map.tryFind (\"##\" + xt + \"__\" + xf) senv, Map.tryFind (\"##.\" + xf) senv) with\r\n | (None, None) -> (BUop (BField (xf, None), e1), None) // unknown\r\n | (Some tr, None) -> (BUop (BField (xf, Some (xt, xt, BFieldFun)), e1), Some tr)\r\n | (_, Some tr) -> (BUop (BField (xf, Some (xt, xt, BFieldDotFun)), e1), Some tr)\r\n ) in\r\n match Map.tryFind xt cenv with\r\n | None -> app ()\r\n | Some cases ->\r\n (\r\n // record selector\r\n let fields = List.map (fun (xc, fs) -> List.map (fun xf -> (xc, xf)) fs) cases in\r\n let fields = List.flatten fields in\r\n match List.filter (fun (xc, _xf) -> xf = _xf) fields with\r\n | [(xc, _)] -> \r\n let selector = xf + \"#\" + xc in\r\n (BUop (BField (xf, Some (xt, xc, BFieldNative)), e1), Map.tryFind selector senv)\r\n | _ -> app ()\r\n )\r\n )\r\n// | (BVar x1, None) -> ft (BVar (x1 + \"#\" + xf)) // module component\r\n | (e1, t) -> (BUop (BField (xf, None), e1), None)\r\n )\r\n | BUop (op, e1) -> (BUop (op, fe e1), None)\r\n | BBop (BFieldUpdate (xf, _), e1, e2) ->\r\n (\r\n match ft e1 with\r\n | (e1, Some ((BNamedType xt) as t)) ->\r\n (\r\n match Map.tryFind xt cenv with\r\n | None -> err (\"no type found for field update \" + xf)\r\n | Some cases ->\r\n (\r\n let fields = List.map (fun (xc, fs) -> List.map (fun xf -> (xc, xf)) fs) cases in\r\n let fields = List.flatten fields in\r\n match List.filter (fun (xc, _xf) -> xf = _xf) fields with\r\n | [(xc, _)] -> (BBop (BFieldUpdate (xf, Some xc), e1, fe e2), Some t)\r\n | _ -> err (\"field \" + xf + \" not found in type \" + xt)\r\n )\r\n )\r\n | _ -> err (\"no type found for field update \" + xf)\r\n )\r\n | BBop (op, e1, e2) -> (BBop (op, fe e1, fe e2), None)\r\n | BCond (e1, e2, e3) -> let (e2, t) = ft e2 in (BCond (fe e1, e2, fe e3), t)\r\n | BQuant (q, xs, ts, ev) ->\r\n (\r\n let senv = List.fold (fun senv (x, t) -> Map.add x t senv) senv xs in\r\n let fe = expand_overload_exp senv cenv in\r\n (BQuant (q, xs, List.map (List.map fe) ts, fe ev), None)\r\n )\r\n | BSubscript (ea, es) ->\r\n (\r\n match ft ea with\r\n | (ea, Some (BArray (_, t))) -> (BSubscript (ea, List.map fe es), Some t)\r\n | (ea, Some (BNamedType xt)) ->\r\n let (bf, t) =\r\n match (Map.tryFind (\"map#\" + xt) senv, Map.tryFind (\"##\" + xt + \"__map\") senv) with\r\n | (Some (BArray (_, t)), _) -> (BFieldNative, Some t)\r\n | (_, Some (BArray (_, t))) -> (BFieldFun, Some t)\r\n | _ -> (BFieldNative, None) in\r\n (BSubscript (BUop (BField (\"map\", Some (xt, xt, bf)), ea), List.map fe es), t)\r\n | (ea, _) -> (BSubscript (ea, List.map fe es), None)\r\n )\r\n | BUpdate (ea, es, ev) ->\r\n (\r\n match ft ea with\r\n | (ea, ((Some (BNamedType xt)) as t)) -> (BApply (xt + \"_update\", [ea] @ (List.map fe es) @ [fe ev]), t)\r\n | (ea, t) -> (BUpdate (ea, List.map fe es, fe ev), t)\r\n )\r\n | BApply (\"sizeof\", [e1]) ->\r\n (\r\n let (e1, t1_opt) = ft e1 in\r\n match t1_opt with\r\n | Some (BNamedType xt1) ->\r\n (BApply (\"sizeof##\" + xt1, [fe e1]), Some BInt)\r\n | _ -> err (\"in sizeof, no datatype found for expression\")\r\n )\r\n | BApply (x, es) -> (BApply (x, List.map fe es), Map.tryFind (\"##\" + x) senv)\r\n\r\nlet rec expand_overload_stmt (senv:senv) (cenv:cenv) (s:bstmt):bstmt =\r\n let fe = expand_overload_exp senv cenv in\r\n let fb = expand_overload_block senv cenv in\r\n let ft t = match t with BFormalAlias e -> BFormalAlias (fe e) | _ -> t in\r\n match s with\r\n | BLocalDecl (x, t, lin, None) -> BLocalDecl (x, ft t, lin, None)\r\n | BLocalDecl (x, t, lin, Some e) -> BLocalDecl (x, ft t, lin, Some (fe e))\r\n | BLabel _ -> s\r\n | BGoto _ -> s\r\n | BAssign (x, e) -> BAssign (fe x, fe e)\r\n | BGroup b -> BGroup (fb b)\r\n | BIf (e, b1, b2_opt) ->\r\n BIf (fe e, fb b1, match b2_opt with None -> None | Some b2 -> Some (fb b2))\r\n | BWhile (e, invs, b) ->\r\n BWhile (fe e, List.map (fun (l, e) -> (l, fe e)) invs, fb b)\r\n | BForallGhost (fs, ts, e, b) ->\r\n let senv = List.fold (fun senv (x, t) -> Map.add x t senv) senv fs in\r\n let fe = expand_overload_exp senv cenv in\r\n let fb = expand_overload_block senv cenv in\r\n BForallGhost (fs, List.map (List.map fe) ts, fe e, fb b)\r\n | BAssume e -> BAssume (fe e)\r\n | BAssert (e, inv) -> BAssert (fe e, inv)\r\n | BSplit -> BSplit\r\n | BYield e -> BYield (fe e)\r\n | BHavoc e -> BHavoc (fe e)\r\n | BCall (xs, id, es, pars) ->\r\n BCall (List.map fe xs, id, List.map fe es, List.map (fun (x, es) -> (x, List.map fe es)) pars)\r\n | BReturn _ -> s\r\nand expand_overload_block (senv:senv) (cenv:cenv) (b:bblock):bblock =\r\n let senv =\r\n List.fold\r\n (fun senv (l, s) ->\r\n try\r\n (\r\n match s with BLocalDecl (x, BFormalType t, _, _) -> Map.add x t senv | _ -> senv\r\n ) with e -> raise (LocErr (l, e)))\r\n senv\r\n b\r\n in\r\n List.map (fun (l, s) -> (l, expand_overload_stmt senv cenv s)) b\r\n\r\nlet expand_overload_spec (senv:senv) (senv_ret:senv) (cenv:cenv) ((l:loc), (s:bspec)):(loc * bspec) list =\r\n try\r\n (\r\n match s with\r\n | BRequires e -> [(l, BRequires (expand_overload_exp senv cenv e))]\r\n | BEnsures e -> [(l, BEnsures (expand_overload_exp senv_ret cenv e))]\r\n | BModifies es -> []\r\n | BInOut _ -> []\r\n ) with e -> raise (LocErr (l, e))\r\n\r\ntype id_path = id list //- path is a list of ids: x.y.z = [x; y; z]\r\nlet expand_overload_specs (proc:id) (env:env) (senv:senv) (senv_ret:senv) (cenv:cenv) (gmap:Map) (specs:(loc * bspec) list):(loc * bspec) list =\r\n let rec preserved_paths (get_children:id_path -> id list) (paths:id_path list):id_path list =\r\n //- given list of paths that do change, compute paths that don't change\r\n let indexed_paths =\r\n List.fold (fun m path -> match path with [] -> m | h::t -> multi_add h t m) Map.empty paths in\r\n let indexed_paths = Map_toList indexed_paths in\r\n let children = Set_ofList (get_children []) in\r\n let mod_children = Set_ofList (List.map fst indexed_paths) in\r\n let preserved_children = Set_toList (Set_difference children mod_children) in\r\n let preserved_child_paths = List.map (fun x -> [x]) preserved_children in\r\n let preserved_subpaths ((x:id), (subpaths:id_path list)) =\r\n if List.exists (fun p -> p = []) subpaths then [] else // \"modifies x\" ==> preserve nothing from x\r\n let g (p:id_path):id list = get_children (x::p) in\r\n List.map (fun p -> x::p) (preserved_paths g subpaths) in\r\n preserved_child_paths @ (List.collect preserved_subpaths indexed_paths)\r\n let modified_vars (paths:id_path list):id list =\r\n List.collect (fun path -> match path with [] -> [] | x::_ -> [x]) paths in\r\n let rec path_of_exp (e:bexp):id_path =\r\n match e with\r\n | BVar x -> [x]\r\n | BUop (BField (x, _), e) -> (path_of_exp e) @ [x]\r\n | BSubscript (e, [BVar x]) when id_is_reg (x.ToLower()) -> (path_of_exp e) @ [\"[]\" + x]\r\n | _ -> err (\"unexpected modifies: \" + (string_of_bexp 0 e))\r\n let rec add_suffix (p:id_path) (e:bexp):bexp =\r\n match p with\r\n | [] -> e\r\n | x::xs when x.StartsWith(\"[]\") -> add_suffix xs (BSubscript (e, [BVar (x.Substring(\"[]\".Length))]))\r\n | x::xs -> add_suffix xs (BUop (BField (x, None), e))\r\n in\r\n let get_children (p:id_path) =\r\n match p with\r\n | [] -> []\r\n | x::xs ->\r\n (\r\n let (_, t) = expand_overload_exp_typ senv cenv (add_suffix xs (BVar x)) in\r\n match t with\r\n | (Some (BArray ([BInt], BInt))) -> List.map (fun (r:string) -> \"[]\" + (r.ToUpper())) all_regs\r\n | (Some (BNamedType \"regs\")) -> [\"regs\"; \"efl\"] // REVIEW: should this be hard-wired?\r\n | (Some (BNamedType xt)) ->\r\n (\r\n match Map.tryFind xt env.type_decls with\r\n | Some (Some ([], [(_, _, fs)])) -> List.map (fun (xf, _, _) -> xf) fs\r\n | Some (Some (fs, _)) -> fs\r\n | _ -> []\r\n )\r\n | _ -> []\r\n )\r\n in\r\n let mods =\r\n List.collect (fun (l, s) ->\r\n match s with BModifies es -> List.map (fun e -> (l, subst_exp gmap e)) es | _ -> []) specs in\r\n let (static_mods, mods) = List.partition (fun e ->\r\n match e with (_, BApply (\"static\", _)) -> true | _ -> false) mods in\r\n //- datatype variables:\r\n let locs_paths = List.map (fun (l, e) -> (l, path_of_exp e)) mods in\r\n let paths = List.map snd locs_paths in\r\n let loc_map = Map_ofList (List.map (fun (l, p) -> (List.hd p, l)) locs_paths) in\r\n let preserved = preserved_paths get_children paths in\r\n let mod_vars = Set_toList (Set_ofList (modified_vars paths)) in\r\n let modified = List.map (fun x -> (loc_map.[x], BModifies [BVar x])) mod_vars in\r\n let ensures_loc (ls:string, li) e = (ls + \" (ensures \" + (string_of_bexp 0 e) + \"))\", li) in\r\n let ensure p =\r\n match p with\r\n | [] -> err \"internal error: expand_overload_specs\"\r\n | x::xs ->\r\n let e = BBop (BEq, add_suffix xs (BVar x), add_suffix xs (BUop (BOld, BVar x))) in\r\n (ensures_loc (loc_map.[x]) e, expand_overload_exp senv cenv e)\r\n in\r\n let preserves = List.map ensure preserved in\r\n //- static variables:\r\n let static_mods = List.choose (fun (l, e) ->\r\n match e with (BApply (\"static\", [BVar mem; BApply (x, _)])) -> Some (mem, (l, x)) | _ -> None) static_mods in\r\n let static_mod_xs = Set_toList (Set_ofList (List.map fst static_mods)) in\r\n let static_mod_ls = List.map (fun mem -> (fst (List.assoc mem static_mods), mem)) static_mod_xs in\r\n let mod_vars = (List.map (fun (l, mem) -> mem) static_mod_ls) @ mod_vars in\r\n let modified = (List.map (fun (l, mem) -> (l, BModifies [BVar mem])) static_mod_ls) @ modified in\r\n let preserves_static =\r\n List.map (fun (l, mem) ->\r\n let xs = List.choose (fun (m, (_, x)) -> if m = mem then Some x else None) static_mods in\r\n let i = \"i\" in\r\n let mem_map = BUop (BField (\"map\", Some (\"mem\", \"mem\", BFieldNative)), BVar mem) in\r\n let mem_i = BSubscript (mem_map, [BVar i]) in\r\n let disjunct =\r\n List.fold_left\r\n (fun disjunct x -> BBop (BOr, disjunct, BBop (BEq, BVar i, BVar (static_addr x))))\r\n (BBop (BEq, mem_i, BUop (BOld, mem_i)))\r\n xs in\r\n (l, BQuant (BForall, [(i, BInt)], [[mem_i]], disjunct)))\r\n static_mod_ls in\r\n //- put everything together:\r\n let preserves = preserves_static @ preserves in\r\n let ensured = List.map (fun (l, e) -> (l, BEnsures e)) preserves in\r\n (if List.length preserves > 0 then extra_proc_invariants := Map.add proc preserves !extra_proc_invariants);\r\n (if List.length mod_vars > 0 then extra_proc_modifies := Map.add proc mod_vars !extra_proc_modifies);\r\n modified @ ensured @ (List.collect (expand_overload_spec senv senv_ret cenv) specs)\r\n\r\nlet expand_overload_decl (env:env) (senv:senv) (cenv:cenv) (gmap:Map) (d:bdecl):bdecl =\r\n match d with\r\n | BAxiomDecl e -> BAxiomDecl (expand_overload_exp senv cenv e)\r\n// | BInvariantDecl e -> BInvariantDecl (expand_overload_exp senv cenv e)\r\n | BFunDecl (id, ps, ret, Some e, a, ts) ->\r\n (\r\n let senv = List.fold (fun senv (x, t, _) -> Map.add x t senv) senv ps in\r\n let f_ts ts = List.map (fun t -> List.map (expand_overload_exp senv cenv) t) ts in\r\n let ts = match ts with None -> None | Some ts -> Some (f_ts ts) in\r\n BFunDecl (id, ps, ret, Some (expand_overload_exp senv cenv e), a, ts)\r\n )\r\n | BProcDecl (id, ps, rets, specs, b_opt, proc) ->\r\n (\r\n let pspecs =\r\n match Map.tryFind id env.proc_decls\r\n with Some (_, (_, _, _, pspecs, _, _)) -> pspecs | None -> specs in\r\n let inouts = List.collect (fun (_, s) -> match s with BInOut io -> io | _ -> []) pspecs in\r\n let senv = List.fold (fun senv (x, t, _) -> Map.add x t senv) senv inouts in\r\n let senv = List.fold (fun senv (x, t, _) -> match t with BFormalType t -> Map.add x t senv | _ -> senv) senv ps in\r\n let senv_ret = List.fold (fun senv (x, t, _) -> Map.add x t senv) senv rets in\r\n let specs = expand_overload_specs id env senv senv_ret cenv gmap specs in\r\n let b_opt =\r\n match b_opt with None -> None | Some b -> Some (expand_overload_block senv_ret cenv b) in\r\n BProcDecl (id, ps, rets, specs, b_opt, proc)\r\n )\r\n | d -> d\r\n\r\n(*****************************************************************************)\r\n\r\nlet exp_get_smem (e:bexp):bexp option =\r\n match e with\r\n | BSubscript (BUop (BField (\"map\", Some (\"mem\", \"mem\", BFieldNative)), e), [eptr]) -> Some e\r\n | _ -> None\r\n\r\nlet bcall xs p es = BCall (xs, p, es, [])\r\n\r\nlet exp_get_mem (e:bexp):(bexp * (loc -> bblock) * (loc -> bexp -> bblock) * (loc -> id -> bblock) * (loc -> bexp -> bblock)) option =\r\n let stack_ptr eptr =\r\n let sload = fun l -> [] in\r\n let sstore = fun l e -> [] in\r\n let sLoad = fun l dest -> [(l, bcall [BVar dest] \"SLoad\" [eptr])] in\r\n let sStore = fun l e -> [(l, bcall [] \"SStore\" [eptr; e])] in\r\n Some (eptr, sload, sstore, sLoad, sStore) in\r\n let rec _datatype_ptr is_shared arr eptr =\r\n match arr with\r\n | BVar x ->\r\n (\r\n let sload = fun l -> [] in\r\n let sstore = fun l e -> [] in\r\n let sLoad = fun l dest -> [(l, bcall [BVar dest] \"Load\" [arr; eptr])] in\r\n let sStore = fun l e -> [(l, bcall [] \"Store\" [BUop (BInOutOp, arr); eptr; e])] in\r\n (None, Some (eptr, sload, sstore, sLoad, sStore))\r\n )\r\n | _ -> (None, None)\r\n in\r\n let rec datatype_ptr is_shared arr eptr =\r\n let part_map_of e id =\r\n BSubscript (BUop (BField (\"vars\", Some (\"partition\", \"partition\", BFieldNative)), e), [id]) in\r\n let rec assign_rhs yt path eRead =\r\n match path with\r\n | [] -> BBop (BFieldUpdate (\"part\", Some yt), eRead, BVar \"BEAT__partition\")\r\n | (None, xf, xt, bf)::t ->\r\n let rhs = assign_rhs yt t (BUop (BField (xf, Some (xt, xt, bf)), eRead)) in\r\n BBop (BFieldUpdate (xf, Some xt), eRead, rhs)\r\n | (Some ei, xf, xt, bf)::t ->\r\n let ef = BUop (BField (xf, Some (xt, xt, bf)), eRead) in\r\n let rhs = assign_rhs yt t (BSubscript (ef, [ei])) in\r\n BBop (BFieldUpdate (xf, Some xt), eRead, BUpdate (ef, [ei], rhs))\r\n in\r\n match arr with\r\n // REVIEW: should we automatically treat any global var x as shared?\r\n | BApply (\"Shared\", [edata]) -> datatype_ptr true edata eptr\r\n | BVar x when is_shared ->\r\n (\r\n // call part_load(x__id, eptr);\r\n let id = BVar (x + \"__id\") in\r\n let lin = BVar \"BEAT__linear\" in\r\n let sload = fun l -> [(l, bcall [] \"part_load\" [id; eptr])] in\r\n let sstore = fun l e ->\r\n [ (l, BAssign (lin, id));\r\n (l, bcall [lin] \"part_store_shared\" [lin; eptr; e]);\r\n (l, BAssign (id, lin))] in\r\n let sLoad = fun l dest -> (sload l) @ [(l, bcall [BVar dest] \"Load\" [eptr])] in\r\n let sStore = fun l e -> (sstore l e) @ [(l, bcall [] \"Store\" [eptr; e])] in\r\n (Some (part_map_of (BVar \"$part\") id, [(None, x, \"\", BFieldFun)]), Some (eptr, sload, sstore, sLoad, sStore))\r\n )\r\n | BVar x ->\r\n (\r\n // call partition_load(x__id, my_part, $part.vars[me], eptr);\r\n // call part_load(me, eptr);\r\n let id = BVar (x + \"__id\") in\r\n let part = BVar \"my_part\" in\r\n let part_map = part_map_of (BVar \"$part\") (BVar \"me\") in\r\n let sload = fun l ->\r\n [ (l, bcall [] \"partition_load\" [id; part; part_map; eptr]);\r\n (l, bcall [] \"part_load\" [BVar \"me\"; eptr])] in\r\n let sstore = fun l e -> [(l, bcall [part] \"partition_store\" [id; part; part_map; eptr; e])] in\r\n let sLoad = fun l dest -> (sload l) @ [(l, bcall [BVar dest] \"Load\" [eptr])] in\r\n let sStore = fun l e -> (sstore l e) @ [(l, bcall [] \"Store\" [eptr; e])] in\r\n (Some (part_map_of part id, [(None, x, \"\", BFieldFun)]), Some (eptr, sload, sstore, sLoad, sStore))\r\n )\r\n | BUop (BField (xf, Some (xt, _, bf)), edata) ->\r\n (\r\n match datatype_ptr is_shared edata eptr with\r\n | (Some (parent_map, path), Some (_, sload, sstore, sLoad, sStore)) ->\r\n // call partition_load(xt__xf__id, edata.part, parent_map, eptr);\r\n let id = BVar (xt + \"__\" + xf + \"__id\") in\r\n let part = BUop (BField (\"part\", Some (xt, xt, bf)), edata) in\r\n let root = let (_, x, _, _) = List.hd path in BVar x in\r\n let sload = fun l -> (l, bcall [] \"partition_load\" [id; part; parent_map; eptr])::(sload l) in\r\n let sstore = (fun l e ->\r\n (l, bcall [BVar \"BEAT__partition\"] \"partition_store\" [id; part; parent_map; eptr; e])::\r\n (l, BAssign (root, assign_rhs xt (List.tl path) root))::\r\n (sstore l e)) in\r\n let sLoad = fun l dest -> (sload l) @ [(l, bcall [BVar dest] \"Load\" [eptr])] in\r\n let sStore = fun l e -> (sstore l e) @ [(l, bcall [] \"Store\" [eptr; e])] in\r\n (Some (part_map_of part id, path @ [(None, xf, xt, bf)]), Some (eptr, sload, sstore, sLoad, sStore))\r\n | _ -> (None, None)\r\n )\r\n | BSubscript (BUop (BField (\"map\", Some (xt, _, bf)), edata), [ei]) ->\r\n (\r\n match datatype_ptr is_shared edata eptr with\r\n | (Some (parent_map, path), Some (_, sload, sstore, sLoad, sStore)) ->\r\n // call partition_load(ei, edata.part, parent_map, eptr);\r\n let part = BUop (BField (\"part\", Some (xt, xt, bf)), edata) in\r\n let root = let (_, x, _, _) = List.hd path in BVar x in\r\n let sload = fun l -> (l, bcall [] \"partition_load\" [ei; part; parent_map; eptr])::(sload l) in\r\n let sstore = (fun l e ->\r\n (l, bcall [BVar \"BEAT__partition\"] \"partition_store\" [ei; part; parent_map; eptr; e])::\r\n (l, BAssign (root, assign_rhs xt (List.tl path) root))::\r\n (sstore l e)) in\r\n let sLoad = fun l dest -> (sload l) @ [(l, bcall [BVar dest] \"Load\" [eptr])] in\r\n let sStore = fun l e -> (sstore l e) @ [(l, bcall [] \"Store\" [eptr; e])] in\r\n (Some (part_map_of part ei, path @ [(Some ei, \"map\", xt, bf)]), Some (eptr, sload, sstore, sLoad, sStore))\r\n | _ -> (None, None)\r\n )\r\n | _ -> (None, None)\r\n in\r\n match e with\r\n | BSubscript (BUop (BField (\"map\", Some (\"mem\", _, BFieldNative)), edata), [eptr]) ->\r\n snd (_datatype_ptr false edata eptr)\r\n | BSubscript (BUop (BField (\"map\", Some (\"finite_map\", _, BFieldNative)), BUop (BField (\"stk\", Some (\"mems\", _, _)), BVar _)), [eptr]) ->\r\n stack_ptr eptr\r\n | BSubscript (BUop (BField (\"map\", Some (\"finite_map\", _, BFieldNative)), edata), [eptr]) ->\r\n snd (datatype_ptr false edata eptr)\r\n | BVar x when x.StartsWith(\"$beat__stackvar__\") ->\r\n let x2 = x.Substring(\"$beat__stackvar__\".Length) in\r\n let xi = x2.Substring(0, x2.IndexOf(\"_esp__\")) in\r\n stack_ptr (BBop (BAdd, BVar \"esp\", BIntConst (big_int_of_string xi)))\r\n //correct, but slower:\r\n //let edata = BUop (BField (\"stk\", Some (\"mems\", BFieldFun)), BVar \"$mem\") in\r\n //let eptr = BBop (BAdd, BVar \"esp\", BIntConst (big_int_of_string xi)) in\r\n //snd (datatype_ptr false edata eptr)\r\n | BUop (BField (xf, Some (xt, _, BFieldFun)), e) ->\r\n let eptr = BVar (static_addr xf) in\r\n let id = BVar (\"?Id\" + xf) in\r\n let sload = fun l -> [(l, bcall [] (\"loadInt_\" + xt) [id; eptr])] in\r\n let sstore = fun l e -> [(l, bcall [] (\"storeInt_\" + xt) [id; eptr; e])] in\r\n let sLoad = fun l dest -> (sload l) @ [(l, bcall [BVar dest] \"Load\" [eptr])] in\r\n let sStore = fun l e -> (sstore l e) @ [(l, bcall [] \"Store\" [eptr; e])] in\r\n Some (eptr, sload, sstore, sLoad, sStore)\r\n | BApply (\"static\", [emem; BApply (x, _)]) ->\r\n let eptr = BVar (static_addr x) in\r\n let sload = fun l -> [] in\r\n let sstore = fun l e -> [] in\r\n let sLoad = fun l dest -> [(l, bcall [BVar dest] \"Load\" [emem; eptr])] in\r\n let sStore = fun l e -> [(l, bcall [] \"Store\" [emem; eptr; e])] in\r\n Some (eptr, sload, sstore, sLoad, sStore)\r\n | _ -> None\r\n\r\nlet exp_is_reg (e:bexp) =\r\n match e with BVar x when id_is_reg x -> true | _ -> false\r\n\r\n// REVIEW: this may pull in non-const variables\r\nlet exp_is_const (e:bexp) =\r\n match e with BIntConst _ -> true | BVar x when not (id_is_reg x) -> true | _ -> false\r\n\r\nlet exp_is_mem (e:bexp) = match exp_get_mem e with Some _ -> true | None -> false\r\n\r\nlet exp_is_reg_or_const (e:bexp) = (exp_is_reg e) || (exp_is_const e)\r\nlet exp_is_reg_mem_or_const (e:bexp) = (exp_is_reg e) || (exp_is_const e) || (exp_is_mem e)\r\n\r\nlet exps_for_x86_mem (e1:bexp) (e2:bexp):bool =\r\n ((exp_is_reg e1) && (exp_is_reg_mem_or_const e2))\r\n || ((exp_is_reg e2) && (exp_is_reg_mem_or_const e1))\r\n || ((exp_is_const e2) && (exp_is_reg_mem_or_const e1))\r\n\r\n//let opn_of_exp (l:loc) (e:bexp):bexp * (loc * bstmt) list =\r\n// match exp_get_mem e with\r\n// | Some (eptr, mLoad, _, _, _) -> (BApply (\"OpnMem\", [eptr]), mLoad l)\r\n// | None -> (BApply (\"OpnReg\", [e]), [])\r\n\r\nlet negate_comparison_op (op:bbop):bbop =\r\n match op with\r\n | BEq -> BNe\r\n | BNe -> BEq\r\n | BLt -> BGe\r\n | BGt -> BLe\r\n | BLe -> BGt\r\n | BGe -> BLt\r\n | _ -> err \"conditional expression must be a comparison expression\"\r\n\r\nlet flip_comparison_op (op:bbop):bbop =\r\n match op with\r\n | BEq -> BEq\r\n | BNe -> BNe\r\n | BLt -> BGt\r\n | BGt -> BLt\r\n | BLe -> BGe\r\n | BGe -> BLe\r\n | _ -> err \"conditional expression must be a comparison expression\"\r\n\r\nlet get_comparison_exp (polarity:bool) (e:bexp):(bbop * bexp * bexp) =\r\n let reorder (op, e1, e2) =\r\n let may_be_const e = match e with BIntConst _ -> true | BVar x when x.StartsWith(\"?\") -> true | _ -> false in // HACK\r\n if may_be_const e2 || (exp_is_reg_or_const e2 && not (exp_is_const e1)) then (op, e1, e2)\r\n else (flip_comparison_op op, e2, e1) // move consts to right, memory ops to left\r\n in\r\n match (polarity, e) with\r\n | (true, BBop (op, e1, e2)) -> reorder (op, e1, e2)\r\n | (false, BBop (op, e1, e2)) -> reorder (negate_comparison_op op, e1, e2)\r\n | _ -> err \"conditional expression must be a comparison expression\"\r\n\r\nlet new_label:unit->id =\r\n let nextLabel = ref 0 in\r\n fun () -> incr nextLabel; \"__L\" + (string !nextLabel)\r\n\r\nlet add_local (locals:(id * (bformal_typ * linearity)) list ref) (x:id) (t:bformal_typ) (lin:linearity):unit =\r\n if not (List.mem_assoc x !locals) then locals := (x, (t, lin))::(!locals);\r\n\r\n(*\r\nlet tmp_var (i:int):id = \"__tmp\" + (string i)\r\n\r\nlet get_tmp_var (locals:(id * bformal_typ) list ref) (i:int):id =\r\n let x = tmp_var i in\r\n add_local locals x (BFormalType BInt);\r\n x\r\n*)\r\n\r\nlet global_param_name (f:id) (p:id) = \"__\" + f + \"$\" + p\r\n\r\nlet ghost_subst_map (ds:(loc * bdecl) list):Map =\r\n List.fold (fun m (l, d) ->\r\n match d with\r\n | BGlobalStaticDecl (x, mem) -> m.Add(x, BApply (\"static\", [BVar mem; BApply (x, [])]))\r\n | BFunDecl (x, _, _, Some e, _, _) when x.StartsWith(\"__Beat_\") ->\r\n (\r\n let x = x.Substring(\"__Beat_\".Length) in\r\n if x.StartsWith(\"define_\") then m.Add(x.Substring(\"define_\".Length), e)\r\n else if x.StartsWith(\"defineD_\") then m.Add(\"$\" + x.Substring(\"defineD_\".Length), e)\r\n else if x.StartsWith(\"defineQ_\") then m.Add(\"?\" + x.Substring(\"defineQ_\".Length), e)\r\n else err (\"unknown Beat definition: \" + x)\r\n )\r\n | _ -> m)\r\n (List.fold\r\n (fun m r -> m.Add(r, BSubscript(regs_arr, [BVar (r.ToUpper())])))\r\n (Map.add \"efl\" (reg_efl) Map.empty)\r\n all_regs)\r\n ds\r\n\r\nlet static_subst_map (ds:(loc * bdecl) list):Map =\r\n List.fold (fun m (l, d) ->\r\n match d with\r\n | BGlobalStaticDecl (x, mem) -> m.Add(x, BApply (\"static\", [BVar mem; BApply (x, [])]))\r\n | _ -> m)\r\n Map.empty\r\n ds\r\n\r\nlet rec compile_exp (locals:(id * (bformal_typ * linearity)) list ref) (l:loc) (dest:id) (temp:int) (e:bexp):(loc * bstmt) list =\r\n let er () = err (\"cannot compile assignment \" + dest + \" := \" + (string_of_bexp 0 e) + \" at line \" + (string l)) in\r\n match e with\r\n | BLoc (l, e) -> compile_exp locals l dest temp e\r\n | BIntConst i -> [(l, BAssign (BVar dest, e))]\r\n | BBop (op, ((BVar x1) as e1), e2) when dest = x1 && exps_for_x86_mem e1 e2 ->\r\n ( match op with\r\n | BAdd -> [(l, bcall [BVar dest] \"Add\" [e1; e2])]\r\n | BSub -> [(l, bcall [BVar dest] \"Sub\" [e1; e2])]\r\n | BAddChecked -> [(l, bcall [BVar dest] \"AddChecked\" [e1; e2])]\r\n | BSubChecked -> [(l, bcall [BVar dest] \"SubChecked\" [e1; e2])]\r\n | _ -> er ()\r\n )\r\n | BBop (op, e1, e2) -> er ()\r\n | _ ->\r\n (\r\n match (e, exp_get_mem e) with\r\n | (_, Some (_, _, _, mLoad, _)) -> mLoad l dest\r\n | (BVar x, None) -> if dest = x then [] else [(l, BAssign (BVar dest, e))]\r\n | _ -> er ()\r\n )\r\n\r\nlet compile_comparison (polarity:bool) (locals:(id * (bformal_typ * linearity)) list ref) (l:loc) (e:bexp):(bexp * (loc * bstmt) list) =\r\n let f op e1 e2 ss =\r\n let jop =\r\n match op with\r\n | BEq -> \"Je\" | BNe -> \"Jne\" | BLt -> \"Jb\" | BGt -> \"Ja\" | BLe -> \"Jbe\" | BGe -> \"Jae\"\r\n | _ -> err (\"unsupported comparison at line \" + (string l)) in\r\n// let ((o1, ss1), (o2, ss2)) = (opn_of_exp l e1, opn_of_exp l e2) in\r\n let is_stack = match e1 with BVar x when x.StartsWith(\"$beat__stackvar__\") -> true | _ -> false in\r\n let cmp_ins = if exp_is_reg e1 then \"Cmp\" else if is_stack then \"SCmpLoad\" else \"CmpLoad\" in\r\n (BApply (jop, [BVar \"efl\"]), ss @ [(l, bcall [] cmp_ins [e1; e2])]) in\r\n let (op, e1, e2) = get_comparison_exp polarity e in\r\n if (exps_for_x86_mem e1 e2) then (f op e1 e2 [])\r\n else err (\"unsupported comparison operands at line \" + (string l))\r\n\r\nlet rec compile_stmt (env:env) (pk:proc_kind) (locals:(id * (bformal_typ * linearity)) list ref) (l:loc, s:bstmt):(loc * bstmt) list =\r\n try compile_stmt_inner env pk locals (l, s)\r\n with e -> raise (LocErr (l, e))\r\nand compile_stmt_inner (env:env) (pk:proc_kind) (locals:(id * (bformal_typ * linearity)) list ref) (l:loc, s:bstmt):(loc * bstmt) list =\r\n let is_ghost = match pk with (Procedure (PGhost, _)) -> true | _ -> false in\r\n let dot_name xdata xf = xdata + \"___BEAT_\" + xf in\r\n let unpack unpacks xdata xt xc =\r\n if List.mem_assoc xdata !unpacks then () else\r\n let (_, fs) = find_constructor env xt xc in\r\n let xfs = List.map (fun (xf, _, _) -> BVar (dot_name xdata xf)) fs in\r\n let s1 = BCall (xfs, \"destruct##\" + xc, [BVar xdata], []) in\r\n let s2 = BCall ([BVar xdata], \"construct##\" + xc, xfs, []) in\r\n unpacks := (xdata, (s1, s2))::!unpacks;\r\n List.iter (fun (xf, t, lin) ->\r\n add_local locals (dot_name xdata xf) (BFormalType t) lin) fs\r\n in\r\n let rec inout_exp (unpacks:(id * (bstmt * bstmt)) list ref) (e:bexp):id =\r\n match e with\r\n | BVar x -> x\r\n | BUop (BField (xf, Some (xt, xc, _)), edata) ->\r\n (\r\n let xdata = inout_exp unpacks edata in\r\n unpack unpacks xdata xt xc;\r\n dot_name xdata xf\r\n )\r\n | BUop (BField (xf, None), _) -> err (\"cannot determine type of field access \" + xf + \" in expression \" + (string_of_bexp 0 e))\r\n | _ -> err (\"expected variable or field access in 'inout' argument\")\r\n in\r\n let unpack_stmts unpacks =\r\n let ss1 = List.map (fun (_, (s1, _)) -> (l, s1)) (List.rev !unpacks) in\r\n let ss2 = List.map (fun (_, (_, s2)) -> (l, s2)) !unpacks in\r\n (ss1, ss2)\r\n match s with\r\n | BLocalDecl (x, t, lin, None) -> add_local locals x t lin; []\r\n | BLocalDecl (x, t, lin, Some e) -> add_local locals x t lin; compile_stmt env pk locals (l, BAssign (BVar x, e))\r\n | BLabel x -> [(l, s)]\r\n | BGoto x -> [(l, s)]\r\n | BAssign (BVar x, e) when not (id_is_reg x) -> [(l, s)]\r\n | BAssign (BVar x, e) ->\r\n (\r\n let ss = compile_exp locals l x 0 e\r\n match ss with [(_, ((BCall _) as s))] -> compile_stmt env pk locals (l, s) | _ -> ss\r\n )\r\n | BAssign ((BUop (BField (xf, Some (xt, xc, BFieldNative)), e1)) as lhs, e2) ->\r\n (\r\n let (lin, _) = find_constructor env xt xc in\r\n match lin with\r\n | Non -> compile_stmt env pk locals (l, BAssign (e1, BBop (BFieldUpdate (xf, Some xt), e1, e2)))\r\n | Lin _ ->\r\n (\r\n let unpacks = ref ([]:(id * (bstmt * bstmt)) list) in\r\n let xlhs = BVar (inout_exp unpacks lhs) in\r\n let (ss1, ss2) = unpack_stmts unpacks in\r\n ss1 @ [(l, BAssign (xlhs, e2))] @ ss2\r\n )\r\n )\r\n | BAssign ((BUop (BField _, _)) as lhs, e) | BAssign ((BApply (\"static\", _)) as lhs, e) ->\r\n (\r\n match exp_get_mem lhs with\r\n | Some (_, _, _, _, store) -> store l e\r\n | _ -> [(l, s)]\r\n )\r\n | BAssign (BSubscript (x1, x2), e) ->\r\n compile_stmt env pk locals (l, BAssign (x1, BUpdate (x1, x2, e)))\r\n | BAssign (x, e) -> [(l, s)]\r\n | BGroup b -> [(l, BGroup (compile_block env pk locals b))]\r\n | BIf (BApply (_, [BVar \"efl\"]), [(lg, BGoto target)], None) -> [(l, s)]\r\n | BIf (e, [(lg, BGoto target)], None) ->\r\n (\r\n let (eb, ss) = compile_comparison true locals l e in\r\n ( ss @\r\n [(l, BIf (eb, [(lg, BGoto target)], None))]\r\n )\r\n )\r\n | BIf (e, b1, None) when is_ghost ->\r\n (\r\n [(l, BIf (e, compile_block env pk locals b1, None))]\r\n )\r\n | BIf (e, b1, Some b2) when is_ghost ->\r\n (\r\n [ (l, BIf (e, compile_block env pk locals b1, None));\r\n (l, BIf (BUop (BNot, e), compile_block env pk locals b2, None))]\r\n )\r\n | BIf (e, b1, None) ->\r\n (\r\n let (eb, ss) = compile_comparison false locals l e in\r\n let l1 = new_label () in\r\n ( ss @\r\n [(l, BIf (eb, [(l, BGoto l1)], None))] @\r\n (compile_block env pk locals b1) @\r\n [(l, BLabel l1)]\r\n )\r\n )\r\n | BIf (e, b1, Some b2) ->\r\n (\r\n let (eb, ss) = compile_comparison false locals l e in\r\n let l1 = new_label () in\r\n let l2 = new_label () in\r\n ( ss @\r\n [(l, BIf (eb, [(l, BGoto l1)], None))] @\r\n (compile_block env pk locals b1) @\r\n [(l, BGoto l2)] @\r\n [(l, BLabel l1)] @\r\n (compile_block env pk locals b2) @\r\n [(l, BLabel l2)]\r\n )\r\n )\r\n | BWhile (e, invs, b) ->\r\n (\r\n let (eb, ss) = compile_comparison false locals l e in\r\n let l1 = new_label () in\r\n let l2 = new_label () in\r\n ( [(l, BLabel l1)] @\r\n (List.map (fun (l, e) -> (l, BAssert (e, true))) invs) @\r\n ss @\r\n [(l, BIf (eb, [(l, BGoto l2)], None))] @\r\n (compile_block env pk locals b) @\r\n [(l, BGoto l1)] @\r\n [(l, BLabel l2)]\r\n )\r\n )\r\n | BForallGhost (fs, ts, e, b) -> [(l, s)]\r\n | BAssume e -> [(l, s)]\r\n | BAssert (e, inv) -> [(l, s)]\r\n | BSplit -> [(l, s)]\r\n | BYield _ -> [(l, s)]\r\n | BHavoc e -> [(l, s)]\r\n(*\r\n | BCall ([x], p, [e1; (BUop (BField _, _)) as rhs]) when proc_kind p = PIns ->\r\n (\r\n match exp_get_mem rhs with\r\n | Some (eptr, load, _, _, _) ->\r\n (\r\n let call = BCall ([x], p + \"Load\", [e1; BApply (\"OpnMem\", [eptr])]) in\r\n (load l) @ [(l, call)]\r\n )\r\n | _ -> [(l, s)]\r\n )\r\n | BCall ([(BUop (BField _, _)) as lhs], p, [lhs2; e2]) when proc_kind p = PIns && lhs = lhs2 ->\r\n (\r\n match exp_get_mem lhs with\r\n | Some (eptr, load, store, _, _) ->\r\n (\r\n let e = BBop (get_op p, lhs, e2) in\r\n let call = BCall ([], p + \"Store\", [BApply (\"OpnMem\", [eptr]); e2]) in\r\n (load l) @ (store l e) @ [(l, call)]\r\n )\r\n | _ -> [(l, s)]\r\n )\r\n | BCall (xs, p, es, pars) ->\r\n // TODO: clean up or eliminate?\r\n if not (env.proc_decls.ContainsKey p) then [(l, BCall (xs, p, es, pars))] else\r\n let (_, (_, ps, rets, specs, b, _)) = env.proc_decls.[p] in\r\n let ps = List.filter (fun (_, t, _) -> match t with BFormalType _ -> true | _ -> false) ps in\r\n [(l, BCall (xs, p, es, pars))]\r\n*)\r\n | BCall (xs, p, es, pars) when env.proc_decls.ContainsKey(p) ->\r\n // call p(inout x.f)\r\n // ==>\r\n // linear var tmp_xf:tf\r\n // let tx(...,tmp_xf,...) := x;\r\n // call p(inout tmp_xf)\r\n // let x := tx(...,tmp_xf,...);\r\n let (_, (_, proc_fs, _, _, _, _)) = env.proc_decls.[p] in\r\n let unpacks = ref ([]:(id * (bstmt * bstmt)) list) in\r\n let arg proc_f e =\r\n match (proc_f, e) with\r\n | ((_, _, Lin (LinInOut, _)), BUop (BInOutOp, ei)) -> BUop (BInOutOp, BVar (inout_exp unpacks ei))\r\n | ((x, _, _), BUop (BInOutOp, ei)) -> err (\"inout argument passed to non-inout parameter \" + x)\r\n | ((x, _, Lin (LinInOut, _)), _) -> err (\"argument to inout parameter \" + x + \" must be marked inout\")\r\n | ((_, _, Lin (LinConst, _)), _) -> BVar (inout_exp unpacks e)\r\n | _ -> e in\r\n let (n_proc_fs, n_es) = (List.length proc_fs, List.length es) in\r\n if n_proc_fs <> n_es then err (\"proc: \" + p + \" expected \" + (string n_proc_fs) + \" arguments, found \" + (string n_es)) else\r\n let es = List.map2 arg proc_fs es in\r\n let (ss1, ss2) = unpack_stmts unpacks in\r\n ss1 @ [(l, BCall (xs, p, es, pars))] @ ss2\r\n | BCall (xs, p, es, pars) -> [(l, s)]\r\n | BReturn _ -> [(l, s)]\r\n\r\nand embellish_stmts (env:env) (b:bblock):bblock =\r\n let embellish = embellish_stmts env in\r\n let get_instruction p =\r\n match Map.tryFind p env.proc_decls with\r\n | Some (_, (_, ps, rets, specs, Some b, Instruction)) -> Some (ps, rets, specs, b)\r\n | _ -> None\r\n let build_instruction l xs p args =\r\n match get_instruction p with\r\n | Some (ps, rets, specs, b) ->\r\n (\r\n if List.length args != List.length ps then err (\"wrong number of arguments to \" + p) else\r\n if List.length xs != List.length rets then err (\"wrong number of return values from \" + p) else\r\n let resultMap =\r\n List.collect (fun (_, s) ->\r\n match s with\r\n | BEnsures (BApply (\"Output\", [BVar x; e])) -> [(x, (false, e))]\r\n | BEnsures (BApply (\"InputOutput\", [BVar x; e])) -> [(x, (true, e))]\r\n | _ -> [])\r\n specs in\r\n let resultMap = Map_ofList resultMap in\r\n let substs =\r\n List.map2 (fun (x, ft, _) e ->\r\n let app f args = BApply (f, args) in\r\n let reg (r:string) = BVar (r.ToUpper()) in\r\n let (ft, e) =\r\n match (ft, exp_get_mem e) with\r\n | (BFormalType (BNamedType \"opn\"), Some (eptr, _, _, _, _))\r\n | (BFormalType (BNamedType \"opn_mem_of_int\"), Some (eptr, _, _, _, _)) ->\r\n (BFormalType (BNamedType \"opn_mem_of_int\"), eptr)\r\n | _ -> (ft, e)\r\n in\r\n match (ft, e) with\r\n | (BFormalType (BNamedType \"reg\"), BVar r) when id_is_reg r -> (x, reg r)\r\n | (BFormalType (BNamedType \"opn\"), BVar r) when id_is_reg r -> (x, app \"OReg\" [reg r])\r\n | (BFormalType (BNamedType \"opn\"), BVar xc) -> (x, app \"OConst\" [e])\r\n | (BFormalType (BNamedType \"opn\"), BIntConst _ ) -> (x, app \"OConst\" [e])\r\n | (BFormalType (BNamedType \"opn_mem_of_int\"), BBop (BAdd, BBop (BAdd, BVar r1, BBop (BMul, scale, BVar r2)), off))\r\n when id_is_reg r1 && id_is_reg r2 ->\r\n (x, app \"OMem\" [app \"MIndex\" [reg r1; scale; reg r2; off]])\r\n | (BFormalType (BNamedType \"opn_mem_of_int\"), BBop (BAdd, BVar r1, BBop (BMul, scale, BVar r2)))\r\n when id_is_reg r1 && id_is_reg r2 ->\r\n (x, app \"OMem\" [app \"MIndex\" [reg r1; scale; reg r2; BIntConst zero_big_int]])\r\n | (BFormalType (BNamedType \"opn_mem_of_int\"), BBop (BAdd, BVar r1, BVar r2))\r\n when id_is_reg r1 && id_is_reg r2 ->\r\n (x, app \"OMem\" [app \"MIndex\" [reg r1; BIntConst unit_big_int; reg r2; BIntConst zero_big_int]])\r\n | (BFormalType (BNamedType \"opn_mem_of_int\"), BBop (BAdd, BVar r, off)) when id_is_reg r ->\r\n (x, app \"OMem\" [app \"MReg\" [reg r; off]])\r\n | (BFormalType (BNamedType \"opn_mem_of_int\"), BVar r) when id_is_reg r ->\r\n (x, app \"OMem\" [app \"MReg\" [reg r; BIntConst zero_big_int]])\r\n | (BFormalType (BNamedType \"opn_mem_of_int\"), BVar xc) ->\r\n (x, app \"OMem\" [app \"MConst\" [BVar xc]])\r\n // TODO: more cases\r\n | _ -> (x, e))\r\n (ps @ (List.map (fun (x, t, l) -> (x, BFormalType t, l)) rets))\r\n (args @ xs) in\r\n let substs = Map_ofList substs in\r\n let coercions =\r\n List.map2 (fun (x, _, _) e ->\r\n match (Map.tryFind x resultMap, exp_get_mem e) with\r\n | (_, None) -> []\r\n | (None, Some (_, sLoad, _, _, _)) -> sLoad l\r\n | (Some (false, ev), Some (_, _, sStore, _, _)) -> sStore l (subst_exp substs ev)\r\n | (Some (true, ev), Some (_, sLoad, sStore, _, _)) -> (sLoad l) @ (sStore l (subst_exp substs ev)))\r\n ps\r\n args in\r\n (List.flatten coercions) @ (List.map (fun (_, s) -> (l, s)) (subst_block substs b))\r\n )\r\n | None -> err (\"Could not find instruction declaration for \" + p)\r\n in\r\n let group_h l ss h t = (l, BGroup (ss @ [h]))::(embellish t) in\r\n match b with\r\n | [] -> []\r\n | (l, BCall (xs, p, args, []))::t when not (get_instruction p = None) ->\r\n (build_instruction l xs p args) @ (embellish t)\r\n | ((l, BCall (_, x, _, _)) as h)::t when (proc_kind x = PProc) ->\r\n group_h l (build_instruction l [] \"Call\" []) h t\r\n | (l, BReturn BRet)::t -> group_h l (build_instruction l [] \"Ret\" []) (l, BReturn BRet) t\r\n | (l, BReturn BIRet)::t -> group_h l (build_instruction l [] \"IRet\" []) (l, BReturn BIRet) t\r\n | (l, BReturn BEmbellishRet)::t ->\r\n group_h l (build_instruction l [] \"Ret\" []) (l, BReturn BRet) t\r\n | (l, BAssign (BVar x, e))::t when (id_is_reg x) -> embellish ((l, bcall [BVar x] \"Mov\" [e])::t)\r\n | h::t -> h::(embellish t)\r\n\r\nand compile_block (env:env) (pk:proc_kind) (locals:(id * (bformal_typ * linearity)) list ref) (b:bblock):bblock =\r\n let b = List.flatten (List.map (compile_stmt env pk locals) b) in\r\n b\r\n\r\nlet rec aliases_block (m:Map) (mptr:Map) (mInvs:(loc * bexp) list) (b:bblock):bblock =\r\n match b with\r\n | [] -> []\r\n | (l, BLocalDecl (x, BFormalAlias (BVar y), _, None))::ss -> aliases_block (m.Add(x, BVar y)) mptr mInvs ss\r\n | (l, BLocalDecl (x, BFormalAlias (BVar y), _, Some e))::ss ->\r\n (l, BAssign (BVar y, subst_exp m e))::(aliases_block (m.Add(x, BVar y)) mptr mInvs ss)\r\n | (l, BLocalDecl (x, BFormalAlias y, lin, e_opt))::ss ->\r\n (\r\n match (exp_get_mem y, exp_get_smem y) with\r\n | (Some ((BBop (BAdd, BVar \"esp\", BIntConst i)) as eptr, _, _, _, sStore), Some e_smem) ->\r\n (\r\n let xx = \"$beat__stackvar__\" + (string i) + \"_esp__\" + x in\r\n let mm = m.Add(x, BVar xx) in\r\n let mptr = mptr.Add(x, y) in\r\n let mInvs = (l, BBop (BEq, BVar xx, y))::mInvs in\r\n let decl e = BLocalDecl (xx, BFormalType BInt, lin, Some e) in\r\n let ss = aliases_block mm mptr mInvs ss in\r\n match e_opt with\r\n | None -> (l, decl (BSubscript (BUop (BField (\"map\", Some (\"mem\", \"mem\", BFieldNative)), e_smem), [eptr])))::ss\r\n | Some e -> (l, decl e)::(subst_block m (sStore l e)) @ ss\r\n )\r\n | _ -> err (\"unexpected alias: \" + x)\r\n )\r\n | ((l, BAssign (BVar x, e)) as s)::ss when m.ContainsKey(x) ->\r\n (\r\n match (m.[x], exp_get_mem m.[x]) with\r\n | (BVar y, Some (eptr, _, _, _, store)) ->\r\n let assign = (l, BAssign (BVar y, subst_exp m e)) in\r\n assign::(subst_block m (store l e)) @ (aliases_block m mptr mInvs ss)\r\n | _ -> (subst_stmt m s)::(aliases_block m mptr mInvs ss)\r\n )\r\n(*\r\n | ((l, BCall ([x], f, [e1; BVar x2])) as s)::ss when proc_kind f = PIns && m.ContainsKey(x2) ->\r\n (\r\n match (m.[x2], exp_get_mem m.[x2]) with\r\n | (BVar y, Some (eptr, load, _, _, _)) ->\r\n (\r\n let call = BCall ([x], f + \"Load\", [subst_exp m e1; BApply (\"OpnMem\", [eptr])]) in\r\n (load l) @ (l, call)::(aliases_block m mptr mInvs ss)\r\n )\r\n | _ -> (subst_stmt m s)::(aliases_block m mptr mInvs ss)\r\n )\r\n | ((l, BCall ([BVar x], f, [BVar x1; e2])) as s)::ss when proc_kind f = PIns && m.ContainsKey(x) && x = x1 ->\r\n (\r\n match (m.[x], exp_get_mem m.[x]) with\r\n | (BVar y, Some (eptr, load, store, _, _)) ->\r\n (\r\n let e = subst_exp m (BBop (get_op f, BVar x1, e2)) in\r\n let call = BCall ([], f + \"Store\", [BApply (\"OpnMem\", [eptr]); subst_exp m e2]) in\r\n let assign = BAssign (BVar y, e) in\r\n (load l) @ (store l e) @ (l, call)::(l, assign)::(aliases_block m mptr mInvs ss)\r\n )\r\n | _ -> (subst_stmt m s)::(aliases_block m mptr mInvs ss)\r\n )\r\n*)\r\n | ((l, BCall ([BVar x], f, _, _)) as s)::ss when m.ContainsKey(x) ->\r\n (\r\n match (m.[x], exp_get_mem m.[x]) with\r\n | (BVar y, Some (eptr, _, _, _, _)) ->\r\n (\r\n let assign = BAssign (BVar y, mptr.[x]) in\r\n (subst_stmt m s)::(subst_stmt m (l, assign))::(aliases_block m mptr mInvs ss)\r\n )\r\n | _ -> (subst_stmt m s)::(aliases_block m mptr mInvs ss)\r\n )\r\n | (l, BIf (e, s1, None))::ss ->\r\n (l, BIf (subst_exp m e, aliases_block m mptr mInvs s1, None))::(aliases_block m mptr mInvs ss)\r\n | (l, BIf (e, s1, Some s2))::ss ->\r\n (l, BIf (subst_exp m e, aliases_block m mptr mInvs s1, Some (aliases_block m mptr mInvs s2)))\r\n ::(aliases_block m mptr mInvs ss)\r\n | (l, BWhile (e, invs, s))::ss ->\r\n let invs = List.map (fun (l, e) -> (l, subst_exp m e)) invs in\r\n (l, BWhile (subst_exp m e, mInvs @ invs, aliases_block m mptr mInvs s))::(aliases_block m mptr mInvs ss)\r\n | ((_, BLabel _) as s1)::((l, BAssert (_, true)) as s2)::ss ->\r\n (s1::(List.map (fun (l, e) -> (l, BAssert (e, true))) mInvs)) @ (aliases_block m mptr mInvs (s2::ss))\r\n | s::ss -> (subst_stmt m s)::(aliases_block m mptr mInvs ss)\r\n\r\n//- Replace missing function arguments with defaults\r\nlet fun_defaults_exp (env:env) (e:bexp):bexp =\r\n map_exp\r\n (fun e ->\r\n match e with\r\n | BApply (x, es) when env.fun_decls.ContainsKey(x) ->\r\n let (_, (_, ps, _, _, _, _)) = env.fun_decls.[x] in\r\n let arg_err s = err (s + \"; expected: \" + (sep_list \", \" (List.map string_of_bformal_fun ps)) + \" found: \" + (sep_list \", \" (List.map (string_of_bexp (-5)) es))) in\r\n let rec f ps es =\r\n match (ps, es) with\r\n | ([], []) -> []\r\n | ([], _) -> arg_err (\"too many arguments to \" + x)\r\n | ((_, _, None)::_, []) -> arg_err (\"missing arguments to \" + x)\r\n | ((_, _, Some e)::ps, []) -> e::(f ps es)\r\n | (_::ps, e::es) -> e::(f ps es) in\r\n Some (BApply (x, f ps es))\r\n | _ -> None)\r\n e\r\n\r\nlet compile_decl (env:env) (gmap:Map) (static_map:Map) (modify:bexp list ref) (l:loc, d:bdecl):(loc * bdecl) list =\r\n try\r\n (\r\n match d with\r\n | BGlobalDecl _ -> [(l, d)]\r\n | BGlobalStaticDecl (x, mem) -> [(l, BStaticDecl x)]\r\n | BStaticDecl _ -> [(l, d)]\r\n | BConstDecl (x, t, Some e) -> [(l, BConstDecl (x, t, Some (subst_exp gmap e)))]\r\n | BConstDecl _ -> [(l, d)]\r\n | BAxiomDecl e -> [(l, BAxiomDecl (subst_exp gmap e))]\r\n | BTypeDecl (xt, Some (_, cs)) ->\r\n (\r\n let get (_, xc, fs) =\r\n List.map (fun (xf, tf, _) ->\r\n let x1 = \"___x1\" in\r\n let e = BUop (BField (xf, Some (xt, xc, BFieldNative)), BVar x1) in\r\n (l, BFunDecl (xc + \"__\" + xf, [(x1, BNamedType xt, None)], tf, Some e, None, None)))\r\n fs in\r\n let update (_, xc, fs) =\r\n List.map (fun (xf, tf, _) ->\r\n let x1 = \"___x1\" in\r\n let x2 = \"___x2\" in\r\n let args =\r\n List.map (fun (_xf, _, _) ->\r\n if xf = _xf then BVar x2 else BUop (BField (_xf, Some (xt, xc, BFieldNative)), BVar x1))\r\n fs in\r\n let e = BApply (xc, args) in\r\n let t = BNamedType xt in\r\n (l, BFunDecl (xc + \"_update__\" + xf, [(x1, t, None); (x2, tf, None)], t, Some e, None, None)))\r\n fs in\r\n [(l, d)] @ (List.collect get cs) @ (List.collect update cs)\r\n )\r\n | BTypeDecl _ -> [(l, d)]\r\n | BFunDecl (x, fs, t, e_opt, attrs, ts_opt) ->\r\n let (fs, gmap) = rename_formal_funs fs gmap in\r\n let subst e = subst_exp gmap (subst_exp static_map e) in\r\n let e_opt = match e_opt with None -> None | Some e -> Some (subst e) in\r\n let ts_opt = match ts_opt with None -> None | Some ts -> Some (List.map (List.map subst) ts) in\r\n [(l, BFunDecl (x, fs, t, e_opt, attrs, ts_opt))]\r\n | BProcDecl (x, ps, rets, specs, None, p) ->\r\n let specs = List.map (map_spec (fun_defaults_exp env)) specs in\r\n let specs = List.map (subst_spec gmap) specs in\r\n [(l, BProcDecl (x, ps, rets, specs, None, p))]\r\n | BProcDecl (x, ps, rets, specs, Some b, p) ->\r\n let (_, (_, _, _, _, _, pk)) = env.proc_decls.[x] in\r\n let is_ghost = match pk with (Procedure (PGhost, _)) -> true | _ -> false in\r\n let b = map_block (fun_defaults_exp env) (fun s -> None) b in\r\n let specs = List.map (map_spec (fun_defaults_exp env)) specs in\r\n let (gps_rev, aps_rev) =\r\n List.fold_left\r\n (fun (gps, aps) (x, t, lin) ->\r\n match t with\r\n | BFormalType _ -> ((x, t, lin)::gps, aps)\r\n | BFormalAlias (BVar t) -> (gps, (x, t, lin)::aps)\r\n | _ -> err (\"non-register alias not supported: \" + x))\r\n ([], [])\r\n ps in\r\n let (gps, aps) = (List.rev gps_rev, List.rev aps_rev) in\r\n let m = new Map(List.map (fun (xp, xa, _) -> (xp, BVar xa)) aps) in\r\n let specs = List.map (subst_spec m) specs in\r\n let b = subst_block m b in\r\n let locals = ref ([]:(id * (bformal_typ * linearity)) list) in\r\n let invs = match Map.tryFind x !extra_proc_invariants with None -> [] | Some invs -> invs in\r\n let b = subst_block static_map b in\r\n let b = aliases_block Map.empty Map.empty invs b in\r\n let b = compile_block env pk locals b in\r\n let b = if is_ghost then b else embellish_stmts env b in\r\n let bLocals = !locals in\r\n let bLocals = List.map (fun (x, (t, lin)) -> (l, BLocalDecl (x, t, lin, None))) bLocals in\r\n let mSpec = (l, BModifies (!modify)) in\r\n let specs = List.map (subst_spec gmap) specs in\r\n let b = subst_block gmap b in\r\n [(l, BProcDecl (x, gps, rets, mSpec::specs, Some (bLocals @ b), p))]\r\n ) with e -> raise (LocErr (l, e))\r\n\r\nlet compile_decls (env:env) (gmap:Map) (static_map:Map) ds =\r\n List.collect (compile_decl env gmap static_map (ref ([]:bexp list))) ds\r\n\r\n(*****************************************************************************)\r\n\r\n// REVIEW: compared to inout parameters, this is a bit of a hack (more like dynamic scope)\r\nlet expand_inout_decl (env:env) (l:loc, d:bdecl):(loc * bdecl) =\r\n // procedure p() inout x:t; requires r(x); ensures e(x, old(...x...));\r\n // ==> procedure p(old__x) returns(x); requires r(old__x); ensures e(x, old(...old__x...));\r\n // procedure p(inout x:t) requires r(x); ensures e(x, old(...x...));\r\n // ==> procedure p(old__x) returns(x); requires r(old__x); ensures e(x, old(...old__x...));\r\n try\r\n (\r\n let does_modify xp specs x =\r\n (match Map.tryFind xp !extra_proc_modifies with None -> false | Some xs -> List.mem x xs)\r\n || List.exists (fun (_, d) ->\r\n match d with\r\n | BModifies es -> List.exists (fun e -> e = BVar x) es\r\n | _ -> false)\r\n specs in\r\n match d with\r\n | BProcDecl (xp, ps, rets, specs, b_opt, pk) when Map_containsKey xp env.proc_decls ->\r\n (\r\n let old m x = if m then x + \"__BEAT__old\" else x in\r\n let (_, (_, _, _, pspecs, _, _)) = env.proc_decls.[xp] in\r\n let inouts = List.collect (fun (l, s) -> match s with BInOut io -> io | _ -> []) pspecs in\r\n let inouts_mod = List.map (fun (x, t, l) -> ((x, t, l), does_modify xp pspecs x)) inouts in\r\n let inouts_ret = List.choose (fun (f, m) -> if m then Some f else None) inouts_mod in\r\n let inouts_ps = List.map (fun ((x, t, lin), m) ->\r\n let lin = (match (m, lin) with (false, Lin (_, scope)) -> (Lin (LinConst, scope)) | _ -> lin) in\r\n (old m x, BFormalType t, lin)) inouts_mod in\r\n let ps_inouts = List.choose (fun (x, ft, l) ->\r\n match (l, ft) with (Lin (LinInOut, scope), BFormalType t) -> Some (x, t, Lin (LinVar, scope)) | _ -> None) ps in\r\n let ps_inouts_mod = List.map (fun p -> (p, true)) ps_inouts in\r\n let ps = List.map (fun (x, t, l) ->\r\n match l with Lin (LinInOut, scope) -> (old true x, t, Lin (LinVar, scope)) | _ -> (x, t, l)) ps in\r\n let ps = inouts_ps @ ps in\r\n let rets = inouts_ret @ ps_inouts @ rets in\r\n let oldMap = Map_ofList (List.map (fun ((x, _, _), m) -> (x, BVar (old m x))) (inouts_mod @ ps_inouts_mod)) in\r\n let fe = fun e ->\r\n match e with BUop (BOld, ee) -> Some (BUop (BOld, subst_exp oldMap ee)) | _ -> None in\r\n let fs = fun s ->\r\n match s with\r\n | BCall (rs, xc, args, pars) ->\r\n let io_rets = List.choose (fun ea -> match ea with BUop (BInOutOp, e) -> Some e | _ -> None) args in\r\n let rec fe_arg e = map_exp (fun ea -> match ea with BUop (BInOutOp, e) -> Some (fe_arg e) | _ -> None) e in\r\n let args = List.map fe_arg args in\r\n let rs = List.map fe_arg (io_rets @ rs) in\r\n let (rs, args) =\r\n if Map_containsKey xc env.proc_decls then\r\n let (_, (_, _, _, c_specs, _, _)) = env.proc_decls.[xc] in\r\n let c_inouts = List.collect (fun (_, s) -> match s with BInOut io -> io | _ -> []) c_specs in\r\n let xs = List.map (fun (x, _, _) -> x) c_inouts in\r\n let xs_ret = List.choose (fun (x, _, l) ->\r\n if does_modify xc c_specs x then Some x else None) c_inouts in\r\n let x2es = List.map (fun x -> BVar x) in\r\n (((x2es xs_ret) @ rs), ((x2es xs) @ args))\r\n else\r\n (rs, args)\r\n in\r\n Some\r\n (BCall\r\n (List.map (map_exp fe) rs,\r\n xc,\r\n List.map (map_exp fe) args,\r\n List.map (fun (x, es) -> (x, List.map (map_exp fe) es)) pars))\r\n | _ -> None\r\n let specs =\r\n List.collect (fun (l, d) ->\r\n match d with\r\n | BRequires e -> [(l, BRequires (subst_exp oldMap e))]\r\n | BEnsures e -> [(l, BEnsures (map_exp fe e))]\r\n | BModifies _ -> [(l, d)]\r\n | BInOut _ -> []\r\n )\r\n specs in\r\n let xinouts = List.map (fun (x, _, _) -> x) inouts in\r\n let fmod = List.filter (fun e -> match e with BVar x -> not (List.mem x xinouts) | _ -> true) in\r\n let specs = List.map (fun (l, d) ->\r\n (l, match d with BModifies xs -> BModifies (fmod xs) | _ -> d)) specs in\r\n let b_opt =\r\n match b_opt with\r\n | None -> None\r\n | Some b ->\r\n let rec f b =\r\n match b with\r\n | (l, ((BLocalDecl _) as s))::t -> (l, s)::(f t)\r\n | t -> (List.map (fun (x, _, _) -> (l, BAssign (BVar x, BVar (old true x)))) (inouts_ret @ ps_inouts)) @ t\r\n in\r\n Some (map_block (map_exp fe) fs (f b)) in\r\n // TODO: initialize x from old__x\r\n (l, BProcDecl (xp, ps, rets, specs, b_opt, pk))\r\n )\r\n | _ -> (l, d)\r\n ) with e -> raise (LocErr (l, e))\r\n\r\nlet expand_inout_decls (env:env) ds = List.map (expand_inout_decl env) ds\r\n\r\n(*****************************************************************************)\r\n\r\nlet is_ghost_proc (env:env) (x:string):bool =\r\n match Map.tryFind x env.proc_decls with\r\n | Some (_, (_, _, _, _, _, Procedure (g, _))) -> g = PGhost\r\n | Some (_, (_, _, _, _, _, Instruction)) -> false\r\n | None when x.StartsWith(\"reveal_\") -> true\r\n | _ -> err (\"could not find declaration of procedure \" + x)\r\n\r\nlet rec remove_ghost_stmt (env:env) (xs:id list ref) (l:loc, s) =\r\n let rs = remove_ghost_stmt env xs in\r\n let rb = remove_ghost_block env xs in\r\n match s with\r\n | BLocalDecl (x, BFormalType _, lin, _) -> []\r\n | BLocalDecl (x, BFormalAlias _, lin, _) -> xs := x::!xs; [(l, s)]\r\n | BLabel x -> [(l, s)]\r\n | BGoto x -> [(l, s)]\r\n | BAssign (BVar x, _) when List.mem x !xs -> [(l, s)]\r\n | BAssign (_, _) -> []\r\n | BGroup b -> rb b\r\n | BIf (e, b1, None) -> [(l, BIf (e, rb b1, None))]\r\n | BIf (e, b1, Some b2) -> [(l, BIf (e, rb b1, Some (rb b2)))]\r\n | BWhile (e, invs, b) -> [(l, BWhile (e, [], rb b))]\r\n | BForallGhost (fs, ts, e, b) -> []\r\n | BAssume e -> []\r\n | BAssert (e, inv) -> []\r\n | BSplit -> []\r\n | BYield e -> []\r\n | BHavoc e -> []\r\n | BCall (_, f, _, []) when f.StartsWith(\"construct##\") -> []\r\n | BCall (_, f, _, []) when f.StartsWith(\"destruct##\") -> []\r\n | BCall (_, f, _, _) -> if is_ghost_proc env f then [] else [(l, s)]\r\n | BReturn _ -> [(l, s)]\r\nand remove_ghost_block (env:env) (xs:id list ref) b = List.collect (remove_ghost_stmt env xs) b\r\n\r\nlet remove_ghost_decl (env:env) (l:loc, d:bdecl):(loc * bdecl) list =\r\n try\r\n (\r\n match d with\r\n | BGlobalDecl _ -> []\r\n | BGlobalStaticDecl _ -> [(l, d)]\r\n | BStaticDecl _ -> [(l, d)]\r\n | BConstDecl _ -> []\r\n | BAxiomDecl _ -> []\r\n | BTypeDecl _ -> [(l, d)]\r\n | BFunDecl _ -> []\r\n | BProcDecl (x, fs, rs, _, b_opt, pk) ->\r\n if is_ghost_proc env x then [] else\r\n let xs = ref [] in\r\n let b_opt = match b_opt with None -> None | Some b -> Some (remove_ghost_block env xs b) in\r\n [(l, BProcDecl (x, fs, rs, [], b_opt, pk))]\r\n ) with e -> raise (LocErr (l, e))\r\n\r\nlet remove_ghost_decls (env:env) ds = List.collect (remove_ghost_decl env) ds\r\n\r\n(*****************************************************************************)\r\n\r\nlet expand_depth = ref 0\r\nlet in_file = ref (None:string option)\r\nlet include_files = ref ([]:string list)\r\n\r\n(* Each command-line argument is the name of a lemma *)\r\nlet args =\r\n [ \r\n (\"-expand\" , Arg.Int (fun i -> expand_depth := i) , \"Expand formula definitions (for better error messages)\")\r\n (\"-i\" , Arg.String (fun s -> include_files := s::(!include_files)), \"Include file\")\r\n (\"-in\" , Arg.String (fun s -> in_file := Some s), \"Input file\")\r\n (\"-def\" , Arg.String (fun s -> Lex.macros := Map.add s [] !Lex.macros), \"Define a macro (as an empty string) for use by ifdef/ifndef\")\r\n (\"-printAndExit\", Arg.Set print_and_exit, \"Pretty-print the input file and then exit\")\r\n (\"-printNonghostAndExit\", Arg.Set print_nonghost_and_exit, \"Pretty-print the input file, omitting ghost code, and then exit\")\r\n ]\r\n\r\nlet main (argv) =\r\n let print_error_loc (file, line) = print_endline (\"error near line \" + (string line) + \" of file \" + file) in\r\n let print_error_prefix () = print_error_loc (!file, !line) in\r\n let rec print_error e =\r\n match e with\r\n | LocErr (l, e) -> print_error_loc l; print_error e\r\n | Err s -> (print_endline \"error:\"; print_endline s; exit 1)\r\n | ParseErr x -> (print_error_prefix (); print_endline x; exit 1)\r\n | :? System.ArgumentException as x -> (print_error_prefix (); print_endline (x.ToString ()); exit 1)\r\n | Failure x -> (print_error_prefix (); print_endline x; exit 1)\r\n | x -> (print_endline (x.ToString ()); exit 1)\r\n try\r\n (\r\n let cmd_args = System.Environment.GetCommandLineArgs () in\r\n Arg.parse_argv (ref 0) cmd_args args (fun _ -> ()) \"error parsing arguments\";\r\n\r\n let lex_token = Lex.get_token Lex.token in\r\n let parse_file name =\r\n file := name;\r\n line := 1;\r\n Parse.start lex_token (Lexing.from_channel (open_in name)) in\r\n let includes = List.map parse_file (List.rev !include_files) in\r\n let includes = List.map (fun m -> m.mDecls) includes in\r\n\r\n let {mName = mName; mIsImpl = isImpl; mImports = imports; mModifies = modifies; mYields = yields; mDecls = p} =\r\n match !in_file with\r\n | None ->\r\n (\r\n file := \"\";\r\n line := 1;\r\n Parse.start lex_token (Lexing.from_channel stdin)\r\n )\r\n | Some name ->\r\n (\r\n file := name;\r\n line := 1;\r\n Parse.start lex_token (Lexing.from_channel (open_in name))\r\n ) in\r\n\r\n let includes2 = List.flatten includes in\r\n\r\n if (!print_and_exit || !print_nonghost_and_exit) then\r\n let env = build_env (includes2 @ p) in\r\n let p = if !print_nonghost_and_exit then remove_ghost_decls env p else p in\r\n print_module\r\n { print_out = System.Console.Out; indent = \"\"; cur_loc = ref (\"\", 1); }\r\n {mName = mName; mIsImpl = isImpl; mImports = imports; mModifies = modifies; mYields = yields; mDecls = p};\r\n else\r\n\r\n let includes2 = expand_opaque_decls includes2 in\r\n let env = build_env (includes2 @ p) in\r\n let gmap = ghost_subst_map (includes2 @ p) in\r\n let static_map = static_subst_map (includes2 @ p) in\r\n let (senv, cenv) = summary_env (List.map snd (includes2 @ p)) in\r\n let p = expand_this_decls cenv p in\r\n let p = expand_conjuncts_decls env 0 p in\r\n let _ = List.map (fun (l, d) ->\r\n try (l, expand_overload_decl env senv cenv gmap d) with e -> raise (LocErr (l, e))) includes2 in\r\n let p = List.map (fun (l, d) ->\r\n try (l, expand_overload_decl env senv cenv gmap d) with e -> raise (LocErr (l, e))) p in\r\n let p = compile_decls env gmap static_map p in\r\n let p = expand_opaque_decls p in\r\n let p = expand_inout_decls env p in\r\n let p = List.filter (fun (_, d) -> match d with BProcDecl (_, _, _, _, _, Instruction) -> false | _ -> true) p in\r\n print_module\r\n { print_out = System.Console.Out; indent = \"\"; cur_loc = ref (\"\", 1); }\r\n {mName = mName; mIsImpl = isImpl; mImports = imports; mModifies = modifies; mYields = yields; mDecls = p};\r\n ()\r\n (* print_program inlines p; *)\r\n )\r\n with e -> print_error e\r\n;;\r\n\r\nlet () = main (System.Environment.GetCommandLineArgs ())\r\n\r\n\r\n" }, { "path": "ironclad-apps/tools/Beat/makefile", "content": "#\r\n# Copyright (c) 2007 Microsoft Corporation. All rights reserved.\r\n#\r\n\r\nBUILD = ..\\fsharp\r\nFSC = $(BUILD)\\fsc -g\r\nFSLEX = $(BUILD)\\fslex\r\nFSYACC = $(BUILD)\\fsyacc\r\nSRC = .\r\n\r\nBEAT_SOURCES = \\\r\n\t$(SRC)\\ast.fs \\\r\n\t$(SRC)\\parse_util.fs \\\r\n\t$(OBJ)\\parse.fs \\\r\n\t$(OBJ)\\lex.fs \\\r\n\t$(SRC)\\main.fs \\\r\n\r\nbeat: $(OBJ) $(BIN) $(BIN)\\beat.exe\r\n\r\n$(OBJ):\r\n\tmd $(OBJ)\r\n\r\n$(BIN):\r\n\tmd $(BIN)\r\n\r\n$(OBJ)\\lex.fsi $(OBJ)\\lex.fs: $(OBJ) $(SRC)\\lex.fsl\r\n\t$(FSLEX) $(SRC)\\lex.fsl -o $(OBJ)\\lex.fs\r\n\r\n$(OBJ)\\parse.fsi $(OBJ)\\parse.fs: $(OBJ) $(SRC)\\parse.fsy\r\n\t$(FSYACC) -v $(SRC)\\parse.fsy -o $(OBJ)\\parse.fs\r\n\r\n$(BIN)\\beat.exe: $(BEAT_SOURCES)\r\n\t$(FSC) --standalone --mlcompatibility -O $(BEAT_SOURCES) -o $(BIN)\\beat.exe -r FSharp.PowerPack.dll\r\n\r\n\r\n" }, { "path": "ironclad-apps/tools/Beat/makefile.fs", "content": "#light\r\nmodule MakeBeat\r\n\r\nopen Def\r\n\r\nlet env = Def.env.Cd @\"tools\\beat\"\r\n\r\nlet obj = Def.obj +/ @\"beat\"\r\nlet bin = Def.bin +/ @\"beat\"\r\n\r\nenv.Dep \"all\" <| [bin+/\"beat.exe\"] <| fun () -> ()\r\nenv.Dep obj <| [] <| fun () -> env.Mkdir obj\r\nenv.Dep bin <| [] <| fun () -> env.Mkdir bin\r\n\r\nenv.Fslex (obj+/\"lex.fs\") [obj] [] [\"lex.fsl\"]\r\nenv.Fsyacc (obj+/\"parse.fs\") [obj] [] [\"parse.fsy\"]\r\nenv.Fsc (bin+/\"beat.exe\") [bin]\r\n (split \"--standalone --mlcompatibility -O -r FSharp.PowerPack.dll\")\r\n [\"ast.fs\"; \"parse_util.fs\"; obj+/\"parse.fs\"; obj+/\"lex.fs\"; \"main.fs\"]\r\n\r\n" }, { "path": "ironclad-apps/tools/Beat/nubuild-manifest.txt", "content": "dependency ast.fs\ndependency lex.fsl\ndependency main.fs\ndependency makefile\ndependency makefile.fs\ndependency parse.fsy\ndependency parse_util.fs\noutput beat.exe\n\n" }, { "path": "ironclad-apps/tools/Beat/parse.fsy", "content": "%{\r\n\r\nopen Ast;;\r\nopen Parse_util;;\r\nopen Microsoft.FSharp.Compatibility.OCaml.Big_int;;\r\n\r\nlet rec type_id (t:btyp):id =\r\n match t with\r\n | BInt -> \"int\"\r\n | BBool -> \"bool\"\r\n | BReal -> \"real\"\r\n | BArray (t1s, t2) -> \"__ARR1_\" + (String.concat \"_\" (List.map type_id t1s)) + \"__ARR2_\" + (type_id t2) + \"__ARR3_\"\r\n | BNamedType x -> \"__NAME_\" + x\r\nlet option_type_id (t:btyp):id = \"__OPTION_\" + (type_id t)\r\n\r\n%}\r\n\r\n%start start\r\n%type <_module> start\r\n\r\n%token UID\r\n%token LID\r\n%token DUID\r\n%token DLID\r\n%token QUID\r\n%token QLID\r\n%token IF THEN ELSE WHILE RETURN IRETURN RRETURN VAR LBRACE RBRACE SEMI\r\n%token LITINT\r\n%token LITREAL\r\n%token LITBV32\r\n%token LITBOOL\r\n%token COLON\r\n%token LPAREN RPAREN LBRACKET RBRACKET\r\n%token LT GT BAR EQ BANG QUESTION COMMA RARROW LARROW LE GE NE\r\n%token PLUS MINUS STAR SLASH\r\n%token AMPAMP BARBAR LET LTEQEQGT EQEQGT EQEQ\r\n%token PLUSPLUS HASH CARET LTLT GTGT\r\n%token RLOL BACKSLASH AT DOLLAR DIV MOD SQUOTE BQUOTE\r\n%token REQARROW\r\n%token COLONEQ\r\n%token FUN\r\n%token UNDERSCORE\r\n%token DOT\r\n%token INT REAL BOOL\r\n%token NULL\r\n%token AMP AMPAMPAMP\r\n%token IS IN LINEAR SPLIT MY ATOMIC STABLE GHOST\r\n%token CONST READONLY FUNCTION RETURNS TYPE AXIOM PROCEDURE IMPLEMENTATION INSTRUCTION MODULE STATIC INTERFACE IMPORT\r\n%token REQUIRES ENSURES MODIFIES INVARIANT ASSUME ASSERT GOTO CALL INOUT YIELD\r\n%token FORALL EXISTS LAMBDA\r\n%token OLD COLONCOLON\r\n%token EAX EBX ECX EDX ESI EDI EBP ESP\r\n\r\n%token EOF\r\n\r\n/* Precedence declarations. */\r\n\r\n%right AMPAMPAMP\r\n%right LET IN IF THEN ELSE\r\n%left LTEQEQGT\r\n%right EQEQGT\r\n%left AMPAMP BARBAR\r\n%left LT GT LE GE EQEQ NE IS\r\n%left PLUS MINUS\r\n%left STAR SLASH DIV MOD\r\n%right BANG\r\n%left LPAREN RPAREN LBRACKET RBRACKET DOT\r\n\r\n%%\r\n\r\nstart:\r\n| MODULE INTERFACE AnyId Modifies Yields LBRACE Decls RBRACE EOF { {mName = $3; mIsImpl = false; mImports = []; mModifies = $4; mYields = $5; mDecls = $7} }\r\n| MODULE IMPLEMENTATION AnyId Imports LBRACE Decls RBRACE EOF { {mName = $3; mIsImpl = true; mImports = $4; mModifies = []; mYields = []; mDecls = $6} }\r\n| MODULE INTERFACE AnyId Modifies Yields Decls EOF { {mName = $3; mIsImpl = false; mImports = []; mModifies = $4; mYields = $5; mDecls = $6} }\r\n| MODULE IMPLEMENTATION AnyId Imports Decls EOF { {mName = $3; mIsImpl = true; mImports = $4; mModifies = []; mYields = []; mDecls = $5} }\r\n| Decls EOF { {mName = \"\"; mIsImpl = true; mImports = []; mModifies = []; mYields = []; mDecls = $1} }\r\n\r\nID\r\n : LID { $1 }\r\n | UID { $1 }\r\n\r\nType\r\n : INT { BInt }\r\n | BOOL { BBool }\r\n | REAL { BReal }\r\n | LBRACKET Types RBRACKET Type { BArray ($2, $4) }\r\n | AnyId { BNamedType $1 }\r\n | LTLT Type GTGT { BNamedType (option_type_id $2) }\r\n\r\nTypes\r\n : Type { [$1] }\r\n | Type COMMA Types { $1::$3 }\r\n\r\nTriggers\r\n : { [] }\r\n | LBRACE Exps RBRACE Triggers { $2::$4 }\r\n\r\nExp\r\n : LPAREN Exp RPAREN { $2 }\r\n | IF Exp THEN Exp ELSE Exp { BLoc ($1, BCond ($2, $4, $6)) }\r\n | LET Formal COLONEQ Exp IN Exp { BLoc ($1, BSubscript (BQuant (BLambda, [$2], [], $6), [$4])) }\r\n | Exp LTEQEQGT Exp { BLoc ($2, BBop (BEquiv, $1, $3)) }\r\n | Exp EQEQGT Exp { BLoc ($2, BBop (BImply, $1, $3)) }\r\n | Exp AMPAMP Exp { BLoc ($2, BBop (BAnd, $1, $3)) } /* TODO: this should match the Boogie grammar better */\r\n | Exp BARBAR Exp { BLoc ($2, BBop (BOr, $1, $3)) }\r\n | Exp EQEQ Exp { BBop (BEq, $1, $3) }\r\n | Exp NE Exp { BBop (BNe, $1, $3) }\r\n | Exp LT Exp { BBop (BLt, $1, $3) }\r\n | Exp GT Exp { BBop (BGt, $1, $3) }\r\n | Exp LE Exp { BBop (BLe, $1, $3) }\r\n | Exp GE Exp { BBop (BGe, $1, $3) }\r\n | Exp PLUS Exp { BBop (BAdd, $1, $3) }\r\n | Exp MINUS Exp { BBop (BSub, $1, $3) }\r\n | Exp STAR Exp { BBop (BMul, $1, $3) }\r\n | Exp SLASH Exp { BBop (BRealDiv, $1, $3) }\r\n | Exp DIV Exp { BBop (BDiv, $1, $3) }\r\n | Exp MOD Exp { BBop (BMod, $1, $3) }\r\n | Exp IS AnyId { BUop (BIs $3, $1) }\r\n | LPAREN MINUS Exp RPAREN { BUop (BNeg, $3) }\r\n | BANG Exp { BUop (BNot, $2) }\r\n | LPAREN FORALL Formals COLONCOLON Triggers Exp RPAREN { BLoc ($2, BQuant (BForall, $3, $5, $6)) }\r\n | LPAREN EXISTS Formals COLONCOLON Triggers Exp RPAREN { BLoc ($2, BQuant (BExists, $3, $5, $6)) }\r\n | LPAREN LAMBDA Formals COLONCOLON Exp RPAREN { BLoc ($2, BQuant (BLambda, $3, [], $5)) }\r\n | Exp LBRACKET Exps RBRACKET { BSubscript ($1, $3) }\r\n | Exp LBRACKET Exps COLONEQ Exp RBRACKET { BUpdate ($1, $3, $5) }\r\n | Exp DOT AnyId { BUop (BField ($3, None), $1) }\r\n | Exp DOT LPAREN AnyId COLONEQ Exp RPAREN { BBop (BFieldUpdate ($4, None), $1, $6) }\r\n | LET LTLT Type GTGT Formal COLONEQ Exp IN Exp\r\n {\r\n let (x, tx) = $5 in\r\n let o = option_type_id $3 in\r\n let ox = option_type_id tx in\r\n BLoc ($1,\r\n BCond (BUop (BIs (ox + \"_None\"), $7), BApply (o + \"_None\", []),\r\n BSubscript (BQuant (BLambda, [$5], [], $9), [BUop (BField (ox + \"_Value\", None), $7)])))\r\n }\r\n | LTLT Type GTGT LPAREN Exp RPAREN { let o = option_type_id $2 in BApply (o + \"_Some\", [$5]) }\r\n | LTLT Type GTGT LPAREN RPAREN { let o = option_type_id $2 in BApply (o + \"_None\", []) }\r\n | Exp DOT LTLT Type GTGT { let o = option_type_id $4 in BUop(BField (o + \"_Value\", None), $1) }\r\n | LITINT { BIntConst $1 }\r\n | LITREAL { BRealConst $1 }\r\n | LITBV32 { BBv32 $1 }\r\n | LITBOOL { BBoolConst $1 }\r\n | OLD LPAREN Exp RPAREN { BUop (BOld, $3) }\r\n | AnyId LPAREN Exps RPAREN { BApply ($1, $3) }\r\n | REAL LPAREN Exp RPAREN { BApply (\"real\", [$3]) }\r\n | INT LPAREN Exp RPAREN { BApply (\"int\", [$3]) }\r\n | AMP ID { BVar (\"?ADDR__\" + $2) }\r\n | AMPAMPAMP Exp { BApply (\"&&&\", [$2]) }\r\n | UID { BVar $1 }\r\n | LID { BVar $1 }\r\n | DUID { BVar $1 }\r\n | DLID { BVar $1 }\r\n | QUID { BVar $1 }\r\n | QLID { BVar $1 }\r\nExps\r\n : { [] }\r\n | Exp { [$1] }\r\n | Exp COMMA Exps { $1::$3 }\r\nCallExp\r\n : Exp { $1 }\r\n | INOUT Exp { BUop (BInOutOp, $2) }\r\nCallExps\r\n : { [] }\r\n | CallExp { [$1] }\r\n | CallExp COMMA CallExps { $1::$3 }\r\nLhsExps\r\n : { [] }\r\n | AnyId { (BVar $1)::[] }\r\n | AnyId DOT AnyId { (BUop (BField ($3, None), BVar $1))::[] }\r\n | LPAREN Exp RPAREN { [$2] }\r\n | AnyId COMMA LhsExps { (BVar $1)::$3 }\r\n | AnyId DOT AnyId COMMA LhsExps { (BUop (BField ($3, None), BVar $1))::$5 }\r\n | LPAREN Exp RPAREN COMMA LhsExps { $2::$5 }\r\nAnyId\r\n : UID { $1 }\r\n | LID { $1 }\r\n | DUID { $1 }\r\n | DLID { $1 }\r\n | QUID { $1 }\r\n | QLID { $1 }\r\n | UNDERSCORE { \"_\" }\r\nAnyIds\r\n : { [] }\r\n | AnyId { [$1] }\r\n | AnyId COMMA AnyIds { $1::$3 }\r\nFunDeclId\r\n : AnyId { $1 }\r\n | DOT AnyId { \".\" ^ $2 }\r\n\r\nLoopInvs\r\n : { [] }\r\n | INVARIANT Exp SEMI LoopInvs { ($1, $2)::$4 }\r\n\r\nLinearity\r\n : { Non }\r\n | LINEAR { Lin (LinVar, LinOur) }\r\n | MY { Lin (LinVar, LinMy) }\r\n\r\nBFormalTyp\r\n : COLON Type { BFormalType $2 }\r\n | AT Exp { BFormalAlias $2 }\r\n\r\nParCalls\r\n : { [] }\r\n | BAR LID LPAREN Exps RPAREN ParCalls { ($2, $4)::$6 }\r\nStmt\r\n : ID COLON { ($2, BLabel $1) }\r\n | GOTO ID SEMI { ($1, BGoto $2) }\r\n | Linearity VAR AnyId BFormalTyp SEMI { ($2, BLocalDecl ($3, $4, $1, None)) }\r\n | Linearity VAR AnyId BFormalTyp COLONEQ Exp SEMI { ($2, BLocalDecl ($3, $4, $1, Some $6)) }\r\n | LBRACE COLON Stmts COLON RBRACE { ($2, BGroup $3) }\r\n | IF LPAREN Exp RPAREN Block { ($1, BIf ($3, $5, None)) }\r\n | IF LPAREN Exp RPAREN Block ELSE Block { ($1, BIf ($3, $5, Some $7)) }\r\n | WHILE LPAREN Exp RPAREN LoopInvs Block { ($1, BWhile ($3, $5, $6)) }\r\n | FORALL Formals COLONCOLON Triggers Exp Block { ($1, BForallGhost ($2, $4, $5, $6)) }\r\n | ASSUME Exp SEMI { ($1, BAssume $2) }\r\n | ASSERT Exp SEMI { ($1, BAssert ($2, false)) }\r\n | ASSERT LBRACE SPLIT RBRACE LITBOOL SEMI { ($1, if $5 then BSplit else parse_err \"Must use: assert {:split_here} true;\" ) }\r\n | YIELD Exp SEMI { ($1, BYield $2) }\r\n | INVARIANT Exp SEMI { ($1, BAssert ($2, true)) }\r\n | Exp COLONEQ Exp SEMI { ($2, BAssign ($1, $3)) }\r\n | LET AnyId COLONEQ AnyId LPAREN Exps RPAREN SEMI { ($3, BCall ([BVar $2], \"construct##\" ^ $4, $6, [])) }\r\n | LET AnyId LPAREN LhsExps RPAREN COLONEQ Exp SEMI { ($6, BCall ($4, \"destruct##\" ^ $2, [$7], [])) }\r\n | CALL AnyId LPAREN CallExps RPAREN ParCalls SEMI { ($1, BCall ([], $2, $4, $6)) }\r\n | CALL LhsExps COLONEQ AnyId LPAREN CallExps RPAREN ParCalls SEMI { ($1, BCall ($2, $4, $6, $8)) }\r\n | RETURN SEMI { ($1, BReturn BRet) }\r\n | IRETURN SEMI { ($1, BReturn BIRet) }\r\n | RRETURN SEMI { ($1, BReturn BEmbellishRet) }\r\n\r\nStmts\r\n : { [] }\r\n | Stmt Stmts { $1::$2 }\r\n\r\nBlock\r\n : LBRACE Stmts RBRACE { $2 }\r\n\r\nFormalVar\r\n : AnyId COLON Type { ($1, BFormalType $3, Non) }\r\n | LINEAR AnyId COLON Type { ($2, BFormalType $4, Lin (LinVar, LinOur)) }\r\n | MY AnyId COLON Type { ($2, BFormalType $4, Lin (LinVar, LinMy)) }\r\n | CONST LINEAR AnyId COLON Type { ($3, BFormalType $5, Lin (LinConst, LinOur)) }\r\n | CONST MY AnyId COLON Type { ($3, BFormalType $5, Lin (LinConst, LinMy)) }\r\n | INOUT LINEAR AnyId COLON Type { ($3, BFormalType $5, Lin (LinInOut, LinOur)) }\r\n | INOUT MY AnyId COLON Type { ($3, BFormalType $5, Lin (LinInOut, LinMy)) }\r\n | AnyId AT Exp { ($1, BFormalAlias $3, Non) }\r\nFormalVars\r\n : { [] }\r\n | FormalVar { [$1] }\r\n | FormalVar COMMA FormalVars { $1::$3 }\r\n\r\nFormal\r\n : AnyId COLON Type { ($1, $3) }\r\nFormals\r\n : { [] }\r\n | Formal { [$1] }\r\n | Formal COMMA Formals { $1::$3 }\r\n\r\nPFormal\r\n : AnyId COLON Type { ($1, $3, Non) }\r\n | LINEAR AnyId COLON Type { ($2, $4, Lin (LinVar, LinOur)) }\r\n | MY AnyId COLON Type { ($2, $4, Lin (LinVar, LinMy)) }\r\nPFormals\r\n : { [] }\r\n | PFormal { [$1] }\r\n | PFormal COMMA PFormals { $1::$3 }\r\n\r\nFormalFun\r\n : AnyId COLON Type { ($1, $3, None) }\r\n | AnyId COLON Type COLONEQ Exp { ($1, $3, Some $5) }\r\nFormalFuns\r\n : { [] }\r\n | FormalFun { [$1] }\r\n | FormalFun COMMA FormalFuns { $1::$3 }\r\n\r\nSpec\r\n : REQUIRES Exp SEMI { ($1, BRequires $2) }\r\n | ENSURES Exp SEMI { ($1, BEnsures $2) }\r\n | MODIFIES Exps SEMI { ($1, BModifies $2) }\r\n | INOUT PFormals SEMI { ($1, BInOut $2) }\r\nSpecs\r\n : { [] }\r\n | Spec Specs { $1::$2 }\r\n\r\nReturns\r\n : { [] }\r\n | RETURNS LPAREN PFormals RPAREN { $3 }\r\n | RETURNS LPAREN PFormals RPAREN SEMI { $3 }\r\n\r\nTypeCase\r\n : AnyId LPAREN PFormals RPAREN { (Non, $1, $3) }\r\n | MY AnyId LPAREN PFormals RPAREN { (Lin (LinVar, LinMy), $2, $4) }\r\n | LINEAR AnyId LPAREN PFormals RPAREN { (Lin (LinVar, LinOur), $2, $4) }\r\nTypeCases\r\n : { [] }\r\n | TypeCase { [$1] }\r\n | TypeCase BAR TypeCases { $1::$3 }\r\n\r\nAttr\r\n : { None }\r\n | LBRACE COLON AnyId RBRACE { Some (\":\" + $3) }\r\n | LBRACE COLON AnyId LITBOOL RBRACE { Some (\":\" + $3 + \" \" + (if $4 then \"true\" else \"false\")) }\r\n\r\nGhostOpt: { PReal } | GHOST { PGhost }\r\nProcKind\r\n : GhostOpt PROCEDURE { ($2, Procedure ($1, Yields)) }\r\n | ATOMIC GhostOpt PROCEDURE { ($3, Procedure ($2, Atomic)) }\r\n | STABLE GhostOpt PROCEDURE { ($3, Procedure ($2, Stable)) }\r\n | IMPLEMENTATION { ($1, Implementation) }\r\n | INSTRUCTION { ($1, Instruction) }\r\n\r\nFunRet\r\n : RETURNS LPAREN Type RPAREN { $3 }\r\n | RETURNS LPAREN AnyId COLON Type RPAREN { $5 }\r\n | COLON Type { $2 }\r\n\r\nDecl\r\n : Linearity VAR AnyId COLON Type SEMI { ($2, BGlobalDecl ($3, $5, $1, ReadWrite)) }\r\n | READONLY VAR AnyId COLON Type SEMI { ($2, BGlobalDecl ($3, $5, Non, Readonly)) }\r\n | Linearity VAR AnyId AT AnyId SEMI { ($2, BGlobalStaticDecl ($3, $5)) }\r\n | CONST AnyId COLON Type SEMI { ($1, BConstDecl ($2, $4, None)) }\r\n | CONST AnyId COLON Type COLONEQ Exp SEMI { ($1, BConstDecl ($2, $4, Some $6)) }\r\n | STATIC UID SEMI { ($1, BStaticDecl $2) }\r\n | ProcKind AnyId LPAREN FormalVars RPAREN SEMI Returns Specs\r\n { (fst $1, BProcDecl ($2, $4, $7, $8, None, snd $1)) }\r\n | ProcKind AnyId LPAREN FormalVars RPAREN Returns Specs\r\n { (fst $1, BProcDecl ($2, $4, $6, $7, None, snd $1)) }\r\n | ProcKind AnyId LPAREN FormalVars RPAREN Returns Specs Block\r\n { (fst $1, BProcDecl ($2, $4, $6, $7, Some $8, snd $1)) }\r\n | FUNCTION Attr FunDeclId LPAREN FormalFuns RPAREN FunRet LBRACE Exp RBRACE { ($1, BFunDecl ($3, $5, $7, Some $9, $2, None)) }\r\n | FUNCTION Attr FunDeclId LPAREN FormalFuns RPAREN FunRet SEMI { ($1, BFunDecl ($3, $5, $7, None, $2, None)) }\r\n | FUNCTION IMPLEMENTATION Triggers FunDeclId LPAREN FormalFuns RPAREN FunRet LBRACE Exp RBRACE\r\n { ($1, BFunDecl ($4, $6, $8, Some $10, None, Some $3)) }\r\n | TYPE AnyId SEMI { ($1, BTypeDecl ($2, None)) }\r\n | TYPE AnyId EQ TypeCases SEMI { ($1, BTypeDecl ($2, Some ([], $4))) }\r\n | LINEAR LPAREN AnyIds RPAREN TYPE AnyId EQ TypeCases SEMI { ($5, BTypeDecl ($6, Some ($3, $8))) }\r\n | TYPE LTLT Type GTGT SEMI { let o = option_type_id $3 in ($1, BTypeDecl (o, Some ([], [(Non, o + \"_None\", []); (Non, o + \"_Some\", [(o + \"_Value\", $3, Non)])]))) }\r\n | AXIOM Exp SEMI { ($1, BAxiomDecl $2) }\r\nDecls\r\n : { [] }\r\n | Decl Decls { $1::$2 }\r\n\r\nModifies\r\n : { [] }\r\n | MODIFIES AnyIds SEMI Modifies { $2 @ $4 }\r\n\r\nYields\r\n : { [] }\r\n | YIELD AnyIds SEMI Yields { $2 @ $4 }\r\n\r\nImports\r\n : { [] }\r\n | IMPORT AnyIds SEMI Imports { $2 @ $4 }\r\n\r\n\r\n" }, { "path": "ironclad-apps/tools/Beat/parse_util.fs", "content": "open Ast;;\r\n\r\nexception Err of string\r\nexception ParseErr of string\r\nlet err (s:string):'a = raise (Err s)\r\nlet parse_err (s:string):'a = raise (ParseErr s)\r\nlet file = ref \"\";;\r\nlet line = ref 1;;\r\n" }, { "path": "ironclad-apps/tools/BoogieAsm/SymdiffMerge.cs", "content": "using System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Linq;\r\n\r\n//- Add custom mutual summaries to symdiff-generated bpl file (by changing mutual summary function bodies)\r\n//- Add custom mutual preconditions to symdiff-generated bpl files (by adding requires clauses to Check procedures)\r\n\r\nclass SymdiffMerge\r\n{\r\n public static int Main(string[] args)\r\n {\r\n try\r\n {\r\n switch(args[0])\r\n {\r\n case \"-config\":\r\n new SymdiffMerge().Config(args[1], args[2]);\r\n return 0;\r\n case \"-merge\":\r\n {\r\n string axiomWhitelist = (args.Length > 4 && args[3] == \"-axiomWhitelist\") ? args[4] : null;\r\n new SymdiffMerge().Merge(args[1], args[2], axiomWhitelist);\r\n return 0;\r\n }\r\n default:\r\n throw new Exception(\"unexpected argument \" + args[0]);\r\n }\r\n }\r\n catch (Exception e)\r\n {\r\n Console.Error.WriteLine(e);\r\n return -1;\r\n }\r\n }\r\n\r\n Dictionary> preconditions = new Dictionary>();\r\n Dictionary> postconditions = new Dictionary>();\r\n Dictionary> postconditionVars = new Dictionary>();\r\n const string funPrefix = \"function {:inline true} \";\r\n\r\n public List FunVars(string line)\r\n {\r\n string parms = line.Substring(line.IndexOf('(') + 1);\r\n parms = parms.Substring(0, parms.IndexOf(')'));\r\n return new List(parms.Split(new char[] { ',' }))\r\n .ConvertAll(s => s.Substring(0, s.IndexOf(':')).Trim());\r\n }\r\n\r\n public void ReadMutualSummaries(string msfile)\r\n {\r\n bool inFun = false;\r\n List data = null;\r\n foreach (string line in File.ReadAllLines(msfile))\r\n {\r\n bool isPre = line.StartsWith(funPrefix + \"MP$\");\r\n bool isPost = line.StartsWith(funPrefix + \"MS$\");\r\n if (isPre || isPost)\r\n {\r\n inFun = true;\r\n data = new List();\r\n string f = line.Substring(0, line.IndexOf('(')).Substring(funPrefix.Length);\r\n (isPre ? preconditions : postconditions).Add(f, data);\r\n if (!isPre) { postconditionVars.Add(f, FunVars(line)); }\r\n }\r\n if (inFun)\r\n {\r\n data.Add(line);\r\n }\r\n if (line.StartsWith(\"}\"))\r\n {\r\n inFun = false;\r\n }\r\n }\r\n }\r\n\r\n public void Config(string msfile, string configfile)\r\n {\r\n ReadMutualSummaries(msfile);\r\n foreach (string line in File.ReadAllLines(configfile))\r\n {\r\n if (line.StartsWith(\"procedure:\"))\r\n {\r\n string name = line.Substring(line.IndexOf('(') + 1);\r\n name = name.Substring(0, name.IndexOf(')'));\r\n name = \"MS$\" + name.Replace(\", \", \"$\");\r\n if (postconditions.ContainsKey(name))\r\n {\r\n Console.WriteLine(line);\r\n }\r\n }\r\n else\r\n {\r\n Console.WriteLine(line);\r\n }\r\n }\r\n }\r\n\r\n public void Merge(string msfile, string mergefile, string axiomWhitelistFile)\r\n {\r\n Dictionary axiomWhitelist = (axiomWhitelistFile == null) ? null :\r\n new List(File.ReadAllLines(axiomWhitelistFile)).ToDictionary(x => x);\r\n Dictionary alreadyPrintedAxiom = new Dictionary();\r\n\r\n ReadMutualSummaries(msfile);\r\n bool inFun = false;\r\n foreach (string _line in File.ReadAllLines(mergefile))\r\n {\r\n string line = _line;\r\n string lineTrim = line.Trim();\r\n if (line.StartsWith(funPrefix + \"MS$\"))\r\n {\r\n //- Write mutual summary (mutual postcondition):\r\n inFun = true;\r\n string funPost = line.Substring(0, line.IndexOf('(')).Substring(funPrefix.Length);\r\n if (postconditions.ContainsKey(funPost))\r\n {\r\n \r\n \r\n \r\n \r\n List symdiffVars = FunVars(line);\r\n List ourVars = postconditionVars[funPost];\r\n string lambdasBegin = \"\";\r\n string lambdasEnd = \"\";\r\n foreach (string ourVar in ourVars)\r\n {\r\n if (ourVar.StartsWith(\"v1_u.out_\") && !symdiffVars.Contains(ourVar))\r\n {\r\n string x = ourVar.Substring(\"v1_u.out_\".Length);\r\n if (line.Contains(\"v1_u.in_\" + x + \":\"))\r\n {\r\n if (line.Contains(\"v1_u.in_old_\" + x + \":\"))\r\n {\r\n line = line.Replace(\"v1_u.in_\" + x + \":\", \"v1_u.out_\" + x + \":\");\r\n line = line.Replace(\"v2_u.in_\" + x + \":\", \"v2_u.out_\" + x + \":\");\r\n line = line.Replace(\"v1_u.in_old_\" + x + \":\", \"v1_u.in_\" + x + \":\");\r\n line = line.Replace(\"v2_u.in_old_\" + x + \":\", \"v2_u.in_\" + x + \":\");\r\n }\r\n else\r\n {\r\n string decl = line.Substring(line.IndexOf(\"v1_u.in_\" + x + \":\"));\r\n decl = decl.Substring(0, decl.IndexOf(','));\r\n string lb1 = \"(lambda \" + decl.Replace(\"v1_u.in_\", \"v1_u.out_\") + \"::(\";\r\n string le1 = \"))[\" + \"v1_u.in_\" + x + \"]\";\r\n string lb2 = lb1.Replace(\"v1_u.\", \"v2_u.\");\r\n string le2 = le1.Replace(\"v1_u.\", \"v2_u.\");\r\n lambdasBegin = lb1 + lb2 + lambdasBegin;\r\n lambdasEnd = lambdasEnd + le2 + le1;\r\n line = line.Replace(\"{:inline true}\", \"\"); \r\n }\r\n }\r\n }\r\n }\r\n\r\n //- Write mutual summary body\r\n Console.WriteLine(line);\r\n List linesPost = postconditions[funPost];\r\n for (int i = 1; i < linesPost.Count; i++)\r\n {\r\n if (linesPost[i] == \"}\" && lambdasEnd != \"\")\r\n {\r\n Console.WriteLine(lambdasEnd);\r\n }\r\n Console.WriteLine(linesPost[i]);\r\n if (linesPost[i] == \"{\" && lambdasBegin != \"\")\r\n {\r\n Console.WriteLine(lambdasBegin);\r\n }\r\n }\r\n }\r\n }\r\n\r\n // Avoid duplicate linear collectors until Boogie collector problem is fixed\r\n if (line.Contains(\"v1_u.OurCollector\"))\r\n {\r\n line = line.Replace(\"{:linear \\\"our\\\"}\", \"\");\r\n }\r\n\r\n //- Try to improve performance by suppressing axioms that aren't needed\r\n bool suppressAxiom = axiomWhitelist != null\r\n && line.StartsWith(\"axiom \")\r\n && !axiomWhitelist.ContainsKey(line);\r\n suppressAxiom = suppressAxiom || alreadyPrintedAxiom.ContainsKey(line);\r\n\r\n if (!inFun && !suppressAxiom)\r\n {\r\n Console.WriteLine(line);\r\n if (line.StartsWith(\"axiom \"))\r\n {\r\n alreadyPrintedAxiom.Add(line, line);\r\n }\r\n }\r\n\r\n string constPrefix = \"const v1_u.\";\r\n if (lineTrim.StartsWith(constPrefix))\r\n {\r\n string x = lineTrim.Substring(constPrefix.Length);\r\n x = x.Substring(0, x.IndexOf(':'));\r\n Console.WriteLine(\"axiom v1_u.\" + x + \" == v2_u.\" + x + \";\");\r\n }\r\n\r\n string mpPrefix = \"procedure MP_Check_\";\r\n string msPrefix = \"procedure MS_Check_\";\r\n if (lineTrim.StartsWith(mpPrefix) || lineTrim.StartsWith(msPrefix))\r\n {\r\n //- Write mutual precondition:\r\n bool isMp = lineTrim.StartsWith(mpPrefix);\r\n string funPost = lineTrim.Substring(0, lineTrim.IndexOf('('));\r\n string s = lineTrim.Substring((isMp ? mpPrefix : msPrefix).Length);\r\n int v2i = s.IndexOf(\"v2_u.\");\r\n int lparen = s.IndexOf('(');\r\n string v1 = s.Substring(0, v2i - 2);\r\n string v2 = s.Substring(v2i, lparen - v2i);\r\n string funPre = \"MP$\" + v1 + \"$\" + v2;\r\n if (preconditions.ContainsKey(funPre))\r\n {\r\n Console.WriteLine(isMp ? \" requires\" : \" free requires\");\r\n List linesPre = preconditions[funPre];\r\n for (int i = 2; i < linesPre.Count - 1; i++) Console.WriteLine(\" \" + linesPre[i]);\r\n Console.WriteLine(\" ;\");\r\n }\r\n }\r\n if (line.StartsWith(\"}\"))\r\n {\r\n inFun = false;\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/BoogieAsm/ast.fs", "content": "open Microsoft.FSharp.Math\r\n\r\ntype loc = string * int\r\n\r\ntype reg = string\r\ntype id = string\r\ntype attr = string\r\n\r\ntype typ =\r\n| TInt\r\n| TBool\r\n| TReal\r\n| TName of id\r\n| TMap of typ * typ\r\n\r\ntype lin_const = LinConst | LinVar\r\ntype lin_scope = LinMy | LinOur\r\ntype linearity = Lin of lin_const * lin_scope | Non\r\ntype formal = id * typ\r\ntype pformal = id * typ * linearity\r\n\r\ntype op =\r\n| Bop of string\r\n| Uop of string\r\n| Subscript\r\n| Update\r\n| Cond\r\n\r\ntype quant = Forall | Exists | Lambda\r\n\r\ntype exp =\r\n| EVar of id\r\n| EInt of bigint\r\n| EReal of string\r\n| EBv32 of bigint\r\n| EBool of bool\r\n| EOp of op * exp list\r\n| EApply of id * exp list\r\n| EQuant of quant * formal list * exp list list * exp\r\n\r\nlet eAdd (e1:exp) (e2:exp):exp = EOp (Bop \"+\", [e1; e2])\r\nlet eMul (e1:exp) (e2:exp):exp = EOp (Bop \"*\", [e1; e2])\r\n\r\ntype is_relation = IsRel | NotRel\r\ntype is_invariant = IsInv of is_relation | NotInv\r\ntype par_call = id * exp list\r\ntype stmt =\r\n| SLabel of id\r\n| SGoto of id\r\n| SReturn\r\n| SIReturn\r\n| SYield of exp\r\n| SAssert of is_invariant * exp\r\n| SSplit\r\n| SAssign of id * exp\r\n| SIfJcc of id * id * id\r\n| SGroup of (loc * stmt) list\r\n| SIfGhost of exp * (loc * stmt) list\r\n| SForallGhost of formal list * exp list list * exp * formal list * (loc * stmt) list\r\n| SExistsGhost of formal list * exp list list * exp\r\n| SInline of id list * id * exp list * par_call list\r\n| SCall of id list * id * exp list\r\n\r\ntype spec =\r\n| Requires of is_relation * exp\r\n| Ensures of is_relation * exp\r\n| Modifies of id list\r\ntype proc_atomicity = Atomic | Yields | Stable\r\ntype proc_ghost = PGhost | PReal\r\ntype proc_kind = Procedure of proc_ghost * proc_atomicity | Implementation\r\ntype inline_kind = Outline | Inline\r\ntype fun_decl = id * formal list option * typ option * exp option * attr option * exp list list option\r\ntype proc_decl = id * proc_kind * inline_kind * pformal list * pformal list * (loc * spec) list * (pformal list * (loc * stmt) list) option\r\n\r\ntype readwrite = Readonly | ReadWrite\r\ntype decl =\r\n| DType of id * bool * bool * (linearity * id * pformal list) list option\r\n| DStatic of id\r\n| DStaticGhost of id * typ * linearity * readwrite\r\n| DFunDecl of fun_decl\r\n| DProc of proc_decl\r\n\r\ntype _module = {mName:id; mIsImpl:bool; mModifies:id list; mYields:id list; mDecls:(loc * decl) list}\r\n\r\n" }, { "path": "ironclad-apps/tools/BoogieAsm/emit_bpl.fs", "content": "open Ast\r\nopen Parse\r\nopen Parse_util\r\nopen Microsoft.FSharp.Math\r\n\r\nlet symdiff = ref false\r\nlet symdiff_allow = ref false\r\nlet symdiff_lin_decls = ref ([\"me\"]) // symdiff doesn't handle linear variables yet\r\nlet symdiff_invariant = ref (\"\", (([]:string list), ([]:(string * string) list)))\r\nlet symdiff_proc = ref (\"\", (fun loop -> \"\"))\r\nlet symdiff_globals = ref ([]:pformal list)\r\nlet symdiff_consts = ref ([]:string list)\r\nlet symdiff_rets = ref ([]:string list)\r\nlet symdiff_params = ref ([]:string list)\r\nlet symdiff_locals = ref ([]:string list)\r\nlet symdiff_writer = ref (null:System.IO.TextWriter)\r\nlet symdiff_proc_mods = ref ([]:(string * pformal list) list)\r\nlet symdiff_proc_local_clones = ref ([]:(string * int ref) list)\r\nlet symdiff_proc_global_clones = ref ([]:(string * int ref) list)\r\nlet symdiff_current_exp_scope = ref ([]:string list)\r\n\r\nlet rec sep_list (sep:string) (l:string list) =\r\n match l with\r\n | [] -> \"\"\r\n | [x] -> x\r\n | h::t -> h + sep + (sep_list sep t)\r\n\r\nlet rec string_of_typ (t:typ):string =\r\n match t with\r\n | TInt -> \"int\"\r\n | TBool -> \"bool\"\r\n | TReal -> \"real\"\r\n | TName x -> x\r\n | TMap (t1, t2) -> \"[\" + (string_of_typ t1) + \"]\" + (string_of_typ t2)\r\n\r\nlet string_of_lin_param (l:linearity):string =\r\n match (!symdiff, l) with\r\n | (false, Lin (LinVar, LinOur)) -> \"{:linear_in \\\"our\\\"}\"\r\n | (false, Lin (LinConst, LinOur)) -> \"{:linear \\\"our\\\"}\"\r\n | (false, Lin (LinVar, LinMy)) -> \"{:linear_in \\\"my\\\"}\"\r\n | (false, Lin (LinConst, LinMy)) -> \"{:linear \\\"my\\\"}\"\r\n | _ -> \"\"\r\nlet string_of_lin_var (l:linearity):string =\r\n match (!symdiff, l) with\r\n | (false, Lin (_, LinOur)) -> \"{:linear \\\"our\\\"}\"\r\n | (false, Lin (_, LinMy)) -> \"{:linear \\\"my\\\"}\"\r\n | _ -> \"\"\r\nlet string_of_quant (q:quant):string = match q with Forall -> \"forall\" | Exists -> \"exists\" | Lambda -> \"lambda\"\r\nlet string_of_formal ((x, t):formal) = x + \":\" + (string_of_typ t)\r\nlet string_of_pformal_param ((x, t, l):pformal) = (string_of_lin_param l) + x + \":\" + (string_of_typ t)\r\nlet string_of_pformal_var ((x, t, l):pformal) = (string_of_lin_var l) + x + \":\" + (string_of_typ t)\r\nlet string_of_formals (fs:formal list) = String.concat \",\" (List.map string_of_formal fs)\r\nlet string_of_pformals_param (fs:pformal list) = String.concat \",\" (List.map string_of_pformal_param fs)\r\nlet string_of_pformals_var (fs:pformal list) = String.concat \",\" (List.map string_of_pformal_var fs)\r\n\r\ntype rel = NoRel | RelPre of bool | RelPost of bool\r\ntype side = Outside | Left | Right\r\n\r\nlet rec string_of_exp_r ((r:rel), (side:side)) (e:exp):string =\r\n let symdiff_nonglobal x = (List.mem x !symdiff_rets) || (List.mem x !symdiff_params) || (List.mem x !symdiff_locals) in\r\n let symdiff_const x = List.mem x !symdiff_consts in\r\n let pre loop n x =\r\n \"v\" + n + \"_u.\"\r\n + ( if symdiff_nonglobal x then\r\n (if loop then \"in_\" else \"\") + x\r\n else if symdiff_const x then x\r\n else \"\" + x + \"_old\") in\r\n let post loop n x =\r\n \"v\" + n + \"_u.\"\r\n + ( if symdiff_nonglobal x then\r\n (if loop then (if List.mem x !symdiff_params then \"in_\" else \"out_\") else \"\") + x\r\n else if symdiff_const x then x\r\n else \"\" + x + \"_\")\r\n let is_datatype_field (x:id) = x.Contains(\"#\") && x.IndexOf('#') == x.LastIndexOf('#') in\r\n match (r, side, e) with\r\n | (_, _, EVar x) when List.mem x !symdiff_current_exp_scope -> \"(\" + x + \")\"\r\n | ((RelPre _ | RelPost _), Outside, EVar x) -> err (\"variable \" + x + \" must appear inside left or right expression\")\r\n | (NoRel, _, EOp (Uop (\"left\" | \"right\"), _)) -> err (\"'left' and 'right' can only be used inside a relation expression\")\r\n | (_, (Outside | Left), EOp (Uop \"left\", [e0])) -> string_of_exp_r (r, Left) e0\r\n | (_, (Outside | Right), EOp (Uop \"right\", [e0])) -> string_of_exp_r (r, Right) e0\r\n | (_, (Left | Right), EOp (Uop (\"left\" | \"right\"), _)) -> err (\"'left' appears inside 'right', or vice-versa\")\r\n | (RelPre loop, Left, EVar x) -> \"(\" + (pre loop \"1\" x) + \")\"\r\n | (RelPre loop, Right, EVar x) -> \"(\" + (pre loop \"2\" x) + \")\"\r\n | (RelPost loop, Left, EVar x) -> \"(\" + (post loop \"1\" x) + \")\"\r\n | (RelPost loop, Right, EVar x) -> \"(\" + (post loop \"2\" x) + \")\"\r\n | (RelPost loop, Left, EOp (Uop \"old\", [EVar x])) -> \"(v1_u.\" + x + \"_old)\"\r\n | (RelPost loop, Right, EOp (Uop \"old\", [EVar x])) -> \"(v2_u.\" + x + \"_old)\"\r\n | ((RelPre _ | RelPost _), _, EApply (x, es)) when not (is_datatype_field x) ->\r\n \"(v2_u.\" + x + \"(\" + (string_of_exps (r, side) es) + \"))\"\r\n | _ -> string_of_exp_norel (r, side) e\r\nand string_of_exp_norel (r:rel * side) (e:exp):string =\r\n let s =\r\n match e with\r\n | EVar x -> x\r\n | EInt i -> string i\r\n | EReal r -> r\r\n | EBv32 i -> (string i) + \"bv32\"\r\n | EBool true -> \"true\"\r\n | EBool false -> \"false\"\r\n | EOp (Bop op, [e1; e2]) -> (string_of_exp_r r e1) + op + (string_of_exp_r r e2)\r\n | EOp (Uop \"relation\", _) -> err \"'relation' and 'public' can only be used around an entire 'requires', 'ensures', or 'invariant'\"\r\n | EOp (Uop (\"left\" | \"right\"), _) -> err \"internal error: left/right\"\r\n | EOp (Uop op, [e1]) -> op + (string_of_exp_r r e1)\r\n | EOp (Subscript, [e1; e2]) -> (string_of_exp_r r e1) + \"[\" + (string_of_exp_r r e2) + \"]\"\r\n | EOp (Update, [e1; e2; e3]) -> (string_of_exp_r r e1) + \"[\" + (string_of_exp_r r e2) + \":=\" + (string_of_exp_r r e3) + \"]\"\r\n | EOp (Cond, [e1; e2; e3]) -> \"if \" + (string_of_exp_r r e1) + \" then \" + (string_of_exp_r r e2) + \" else \" + (string_of_exp_r r e3)\r\n | EOp _ -> err \"internal error: EOp\"\r\n | EApply (x, es) -> x + \"(\" + (string_of_exps r es) + \")\"\r\n | EQuant (_, [], _, e) -> string_of_exp_r r e\r\n | EQuant (q, fs, ts, e) ->\r\n (\r\n let save_scope = !symdiff_current_exp_scope in\r\n symdiff_current_exp_scope := (List.map fst fs) @ !symdiff_current_exp_scope;\r\n let rhs = (string_of_triggers r ts) + (string_of_exp_r r e) in\r\n symdiff_current_exp_scope := save_scope;\r\n (string_of_quant q) + \" \" + (string_of_formals fs) + \"::\" + rhs\r\n )\r\n in \"(\" + s + \")\"\r\nand string_of_exps (r:rel * side) (es:exp list):string = String.concat \",\" (List.map (string_of_exp_r r) es)\r\nand string_of_trigger (r:rel * side) (t:exp list):string = \"{\" + (string_of_exps r t) + \"}\"\r\nand string_of_triggers (r:rel * side) (ts:exp list list):string = String.concat \"\" (List.map (string_of_trigger r) ts)\r\nlet string_of_exp = string_of_exp_r (NoRel, Outside)\r\nlet string_of_exp_ignore_rel (r:is_relation) (e:exp):string = match r with IsRel -> \"true\" | NotRel -> string_of_exp e\r\n\r\nlet string_of_outs (xs:id list):string = match xs with [] -> \"\" | _ -> (String.concat \",\" xs) + \" := \"\r\n\r\nlet dummyCounter = ref 0;\r\n\r\nlet string_of_stmt (s:stmt):string =\r\n match s with\r\n | SLabel l -> l + \":\"\r\n | SGoto l -> \"goto \" + l + \";\"\r\n | SGroup _ -> \"\"\r\n | SIfJcc (x, cond, l) -> \"call boogie_CheckJcc(me, RET, \" + x + \"); if (\" + cond + \"(.efl(\" + x + \"))) { goto \" + l + \"; }\"\r\n | SIfGhost (e, b) -> \"if (\" + (string_of_exp e) + \")\"\r\n | SForallGhost _ -> \"if (*)\"\r\n | SExistsGhost _ -> \"if (*)\"\r\n | SAssert (NotInv, e) -> \"assert \" + (string_of_exp e) + \";\"\r\n | SAssert (IsInv r, e) -> \"assert \" + (string_of_exp_ignore_rel r e) + \";\"\r\n | SSplit -> \"assert {:split_here} true;\"\r\n | SYield e -> incr dummyCounter; \"yield; assert \" + (string_of_exp e) + \"; #DUMMY_LABEL\" + (string !dummyCounter) + \":\"\r\n | SAssign (x, e) -> x + \" := \" + (string_of_exp e) + \";\"\r\n | SInline (xs, p, es, pars) ->\r\n let f x es = x + \"(\" + (String.concat \",\" (\"me\"::\"RET\"::(List.map (string_of_exp) es))) + \")\" in\r\n \"call \" + (string_of_outs xs) + (f p es)\r\n + (String.concat \"\" (List.map (fun (x, es) -> \" | \" + f x es) pars)) + \";\"\r\n | SCall (xs, p, es) ->\r\n let xr = List.hd xs in\r\n \"call boogie_CheckCall(me, RET, \" + xr + \"); \"\r\n + \"call \" + (string_of_outs xs) + p\r\n + \"(\" + (String.concat \",\" (\"me\"::\"ReturnToCaller(\" + xr + \")\"::(List.map (string_of_exp) es))) + \");\"\r\n | SReturn -> \"return;\"\r\n | SIReturn -> \"return;\"\r\n\r\nlet string_of_spec (s:spec):string =\r\n match s with\r\n | Requires (r, e) -> \"requires \" + (string_of_exp_ignore_rel r e) + \";\"\r\n | Ensures (r, e) -> \"ensures \" + (string_of_exp_ignore_rel r e) + \";\"\r\n | Modifies xs -> \"modifies \" + (String.concat \",\" xs) + \";\"\r\n\r\nlet string_of_attrs (a:attr option):string = match a with None -> \"\" | Some s -> \"{:\" + s + \"}\"\r\n\r\ntype print_state =\r\n {\r\n all_vars:id list;\r\n all_typedefs:id list;\r\n all_procs:(id * proc_decl) list;\r\n publics:(loc * decl) list;\r\n print_out:System.IO.TextWriter;\r\n cur_loc:loc ref;\r\n cur_indent:string ref;\r\n }\r\n member this.PrintLine (s:string) =\r\n let (f, i) = !this.cur_loc in (this.cur_loc := (f, i + 1));\r\n this.print_out.WriteLine (!this.cur_indent + s)\r\n member this.Indent () = this.cur_indent := \" \" + !this.cur_indent\r\n member this.Unindent () = this.cur_indent := (!this.cur_indent).Substring(2)\r\n member this.SetLoc (((f, i) as l):loc) =\r\n let (cf, ci) as cl = !this.cur_loc in\r\n if l = cl then ()\r\n else if f <> cf || i < ci || i > ci + 8 then this.cur_loc := l; this.print_out.WriteLine (\"#line \" + (string i) + \" \" + f)\r\n else this.PrintLine \"\"; this.SetLoc l\r\n\r\nlet string_of_proc_kind (pk:proc_kind):string =\r\n match pk with\r\n | Procedure (_, Atomic) -> \"procedure\"\r\n | Procedure (_, Yields) | Procedure (_, Stable) -> \"procedure\" // TODO: \"procedure{:yields}\"\r\n | Implementation -> \"implementation\"\r\n\r\nlet rename_var xs x = if List.mem x xs then \"#RENAME#\" + x else x in\r\nlet rename_formals xs fs = List.map (fun (x, t) -> (rename_var xs x, t)) fs in\r\nlet rec rename_exp xs e =\r\n let rs = List.map (rename_exp xs) in\r\n match e with\r\n | EVar x -> EVar (rename_var xs x)\r\n | EInt _ | EReal _ | EBv32 _ | EBool _ -> e\r\n | EOp (op, es) -> EOp (op, rs es)\r\n | EApply (x, es) -> EApply (x, rs es)\r\n | EQuant (q, fs, ts, e) ->\r\n let xs = (List.map fst fs) @ xs in\r\n let rs = List.map (rename_exp xs) in\r\n EQuant (q, rename_formals xs fs, List.map rs ts, rename_exp xs e) in\r\n\r\nlet rec symdiff_emit_linearity (state:print_state):unit =\r\n let assumes = List.mapi (fun i s -> \"###symdiff_linearity[\" + s + \"] == \" + (string i)) !symdiff_lin_decls in\r\n let terms = sep_list \" && \" assumes in\r\n state.PrintLine (\"assume (exists ###symdiff_linearity:[int]int::\" + terms + \");\")\r\n\r\nlet symdiff_write_fun (loop:bool) (impl:bool) (pre:string list) (post:string list):unit =\r\n if pre = [] && post = [] then () else\r\n let s_loop = if loop then \"_loop_\" + (fst !symdiff_invariant) else \"\" in\r\n let s_pre = String.concat \"\" (List.map (fun s -> \" && \" + s) pre) in\r\n let s_post = String.concat \"\" (List.map (fun s -> \" && \" + s) post) in\r\n let write_decl s =\r\n (!symdiff_writer).WriteLine(\r\n \"function {:inline true} \" + s\r\n + \"$v1_u.\" + (fst !symdiff_proc) + s_loop\r\n + \"$v2_u.\" + (fst !symdiff_proc) + s_loop\r\n + \"(\" + (snd !symdiff_proc loop) + \"):bool\")\r\n in\r\n write_decl \"MP\";\r\n (!symdiff_writer).WriteLine(\"{\");\r\n (!symdiff_writer).WriteLine(\" true\" + s_pre);\r\n (!symdiff_writer).WriteLine(\"}\");\r\n // warning: this does not handle recursion\r\n write_decl \"MS\";\r\n (!symdiff_writer).WriteLine(\"{\")\r\n (!symdiff_writer).WriteLine(\" (true\" + s_pre + \")\");\r\n (!symdiff_writer).WriteLine(\" ==> (true\" + s_post + \")\");\r\n (!symdiff_writer).WriteLine(\"}\");\r\n (!symdiff_writer).WriteLine()\r\n\r\n// NOTE: Since we're providing symdiff with two copies of the same code,\r\n// we can restrict programs to the special case where a call in the\r\n// left program must match the same call in the right program (not\r\n// another call to the same procedure).\r\n// To encode this for SymDiff, rename the called procedure at each call site\r\n// so that different call sites in a procedure are distinguished.\r\nlet symdiff_clone_call (state:print_state) (p:string):string =\r\n if not (List.mem_assoc p state.all_procs) then p else \r\n let (_, _, _, _, _, specs, _) = List.assoc p state.all_procs in\r\n let rels = List.filter (fun (_, spec) ->\r\n match spec with Requires (IsRel, _) | Ensures (IsRel, _) -> true | _ -> false) specs in\r\n if rels = [] then p else\r\n let get_int_ref l =\r\n if not (List.mem_assoc p !l) then l := (p, ref 0)::!l;\r\n List.assoc p !l in\r\n let (li, gi) = (get_int_ref symdiff_proc_local_clones, get_int_ref symdiff_proc_global_clones) in\r\n incr li;\r\n if !li > !gi then gi := !li;\r\n \"#clone\" + (string !li) + \"#\" + p\r\n\r\nlet rec emit_stmt (rec_context:string * pformal list) (state:print_state) (l:loc, s:stmt):unit =\r\n state.SetLoc l;\r\n (match (rec_context, s) with\r\n | ((xp, (x0, _, _)::xs), SInline (_, xc, e0::es, _)) when xp = xc ->\r\n // inductive call to self; check termination\r\n let se0 = string_of_exp e0 in\r\n state.PrintLine (\"assert 0 <= \" + se0 + \" && \" + se0 + \" < \" + x0 + \";\")\r\n | (_, SAssert (NotInv, e)) when !symdiff -> state.PrintLine (\"assume \" + (string_of_exp e) + \";\")\r\n | _ -> ()\r\n );\r\n let s_clone =\r\n (\r\n match (!symdiff, s) with\r\n | (true, SInline (xs, p, es, pars)) -> SInline (xs, symdiff_clone_call state p, es, pars)\r\n | (true, SCall (xs, p, es)) -> SCall (xs, symdiff_clone_call state p, es)\r\n | _ -> s\r\n ) in\r\n state.PrintLine (string_of_stmt s_clone);\r\n (match s with\r\n | SAssert (IsInv IsRel, e) when !symdiff -> \r\n symdiff_invariant :=\r\n (fst !symdiff_invariant,\r\n ((fst (snd !symdiff_invariant)),\r\n (string_of_exp_r (RelPre true, Outside) e, string_of_exp_r (RelPost true, Outside) e)::(snd (snd !symdiff_invariant))))\r\n | SAssert (IsInv NotRel, e) when !symdiff ->\r\n symdiff_invariant := (fst !symdiff_invariant,\r\n (((string_of_exp e)::(fst (snd !symdiff_invariant))), snd (snd !symdiff_invariant)))\r\n | SAssert (IsInv _, _) -> ()\r\n | SSplit -> ()\r\n | _ when !symdiff && (snd !symdiff_invariant <> ([], [])) ->\r\n symdiff_write_fun true false\r\n (List.map fst (snd (snd !symdiff_invariant)))\r\n (List.map snd (snd (snd !symdiff_invariant)));\r\n List.iter (fun x -> state.PrintLine (\"assert \" + x + \" == \" + x + \";\")) !symdiff_params; // tell symdiff not to prune loop procedure's parameter list\r\n List.iter (fun s -> state.PrintLine (\"assume \" + s + \";\")) (fst (snd !symdiff_invariant));\r\n List.iter (fun x -> state.PrintLine (x + \" := \" + x + \";\")) !symdiff_locals; // tell symdiff not to prune loop procedure's parameter list\r\n symdiff_invariant := (\"\", ([], []))\r\n | _ -> ()\r\n );\r\n (match s with\r\n | SGroup b -> List.iter (emit_stmt rec_context state) b\r\n | SIfGhost (e, b) ->\r\n (\r\n state.PrintLine \"{\";\r\n state.Indent ();\r\n List.iter (emit_stmt rec_context state) b;\r\n state.Unindent ();\r\n state.PrintLine \"}\"\r\n )\r\n | SForallGhost (fs, ts, e, _, b) ->\r\n (\r\n state.PrintLine \"{\";\r\n state.Indent ();\r\n List.iter (fun (x, _) -> state.PrintLine (\"havoc \" + x + \";\")) fs;\r\n // need some constants or havoc'd variables; declare at top level? as locals?\r\n List.iter (emit_stmt rec_context state) b;\r\n state.PrintLine (\"assert \" + (string_of_exp e) + \";\");\r\n state.PrintLine (\"assume false;\"); // in one branch, prove assertion, then block (assume false)\r\n state.Unindent ();\r\n state.PrintLine \"}\"\r\n // in other branch, assume what was asserted, but quantify over all variables\r\n state.PrintLine (\"assume \" + (string_of_exp (rename_exp [] (EQuant (Forall, fs, ts, e)))) + \";\");\r\n )\r\n | SExistsGhost (fs, ts, e) ->\r\n (\r\n state.PrintLine \"{\";\r\n state.Indent ();\r\n state.PrintLine (\"assert \" + (string_of_exp (rename_exp [] (EQuant (Exists, fs, ts, e)))) + \";\");\r\n state.PrintLine (\"assume false;\"); // in one branch, prove assertion, then block (assume false)\r\n state.Unindent ();\r\n state.PrintLine \"}\"\r\n List.iter (fun (x, _) -> state.PrintLine (\"havoc \" + x + \";\")) fs;\r\n // in other branch, assume what was asserted, but for newly havoc'd variables\r\n state.PrintLine (\"assume \" + (string_of_exp e) + \";\")\r\n )\r\n //| SAssert (EOp (Uop \"!\", [EBool false])) when !symdiff -> symdiff_emit_linearity state // HACK\r\n | SLabel x when !symdiff -> symdiff_invariant := (x, ([], []))\r\n | _ -> ())\r\n\r\nlet rec emit_stmt_decl (forall_vars:id list) (state:print_state) (l:loc, s:stmt):unit =\r\n // HACK: we don't yet support duplicate variable names across forall statements,\r\n // so just declare all the variables together, and rely on Boogie to flag duplicates as errors\r\n let check_assign x = if List.mem x forall_vars then err (\"cannot assign to readonly variable \" + x) in\r\n match s with\r\n | SLabel _ | SGoto _ | SReturn | SIReturn | SIfJcc _ -> () // illegal in ghost code\r\n | SYield _ | SAssert _ | SSplit -> ()\r\n | SAssign (x, _) -> check_assign x\r\n | SInline (xs, _, _, _) | SCall (xs, _, _) -> List.iter check_assign xs\r\n | SGroup b -> List.iter (emit_stmt_decl forall_vars state) b\r\n | SIfGhost (_, b) -> List.iter (emit_stmt_decl forall_vars state) b\r\n | SForallGhost (fs, _, _, fa_vars, b) ->\r\n (\r\n List.iter\r\n (fun (x, t) -> state.PrintLine (\"var \" + x + \":\" + (string_of_typ t) + \";\"))\r\n (fs @ fa_vars);\r\n List.iter (emit_stmt_decl ((List.map fst fs) @ forall_vars) state) b\r\n )\r\n | SExistsGhost (fs, _, _) ->\r\n (\r\n List.iter\r\n (fun (x, t) -> state.PrintLine (\"var \" + x + \":\" + (string_of_typ t) + \";\"))\r\n fs\r\n )\r\n\r\nlet rec collect_forall_vars (l:loc, s:stmt):formal list =\r\n match s with\r\n | SLabel _ | SGoto _ | SReturn | SIReturn | SIfJcc _ -> []\r\n | SYield _ | SAssert _ | SSplit -> []\r\n | SAssign (x, _) -> []\r\n | SInline (xs, _, _, _) | SCall (xs, _, _) -> []\r\n | SGroup b -> List.collect collect_forall_vars b\r\n | SIfGhost (_, b) -> List.collect collect_forall_vars b\r\n | SForallGhost (fs, _, _, vars, b) -> vars @ (List.collect collect_forall_vars b)\r\n | SExistsGhost (fs, _, _) -> []\r\n\r\nlet emit_spec (state:print_state) (l:loc, s:spec):unit =\r\n state.SetLoc l;\r\n state.PrintLine (string_of_spec s)\r\n\r\n// Rather than raising an error for non-terminating functions, we rewrite\r\n// non-terminating functions to be terminating: non-terminating calls (calls that\r\n// fail to decrease the termination metric or produce a negative termination metric)\r\n// simply return unspecified dummy values.\r\nlet rewrite_recursive_fun (state:print_state) (x:string) (fs:formal list) (t:typ) (e:exp):exp =\r\n let emitted = ref false in\r\n let call_rec_fun (args:exp list):exp =\r\n let name = \"##rec##\" + x in\r\n match (fs, args) with\r\n | ((x0, TInt)::_, _::_) ->\r\n (\r\n if not (!emitted) then\r\n (\r\n let app = name + \"(##d, \" + (sep_list \",\" (List.map fst fs)) + \")\" in\r\n let app0 = x + \"(\" + (sep_list \",\" (List.map fst fs)) + \")\" in\r\n state.PrintLine (\"function \" + name + \"(##d:int, \" + (string_of_formals fs) + \"):\" + (string_of_typ t) + \";\");\r\n state.PrintLine (\"axiom (forall ##d:int, \" + (string_of_formals fs) + \"::{\" + app\r\n + \"} 0 <= \" + x0 + \" && \" + x0 + \" < ##d ==> \" + app + \" == \" + app0 + \");\");\r\n emitted := true\r\n );\r\n EApply (name, (EVar x0)::args)\r\n )\r\n | _ -> err (\"recursive function \" + x + \" must have a decreasing, nonnegative integer first argument\")\r\n in\r\n let rec r e =\r\n match e with\r\n | EVar _ | EInt _ | EReal _ | EBv32 _ | EBool _ -> e\r\n | EOp (op, es) -> EOp (op, List.map r es)\r\n | EApply (y, es) when x = y -> call_rec_fun (List.map r es)\r\n | EApply (y, es) -> EApply (y, List.map r es)\r\n | EQuant (q, qfs, ts, e) -> EQuant (q, qfs, List.map (List.map r) ts, r e)\r\n in\r\n r e\r\n\r\nlet rec emit_decl (state:print_state) (l:loc, d:decl):unit =\r\n state.SetLoc l;\r\n match d with\r\n | DType (x, _, _, None) ->\r\n (\r\n (if not (List.mem x state.all_typedefs) then state.PrintLine (\"type \" + x + \";\"));\r\n state.PrintLine (\"function sizeof##\" + x + \"(x:\" + x + \"):int;\")\r\n )\r\n | DType (x, overload, impl, Some cs) ->\r\n state.PrintLine (\"type{:datatype} \" + x + \";\");\r\n (if not impl then state.PrintLine (\"function sizeof##\" + x + \"(x:\" + x + \"):int;\"));\r\n state.PrintLine (\"axiom (forall x:\" + x + \"::{sizeof##\" + x + \"(x)} sizeof##\" + x + \"(x) >= 0);\");\r\n List.iter\r\n (fun (lin, c, fs) ->\r\n let ffs = List.map (fun (fx, ft, fl) -> (fx, ft)) fs in\r\n state.PrintLine (\"function{:constructor} \" + c + \"(\" + (string_of_formals ffs) + \"):\" + x + \";\");\r\n (match lin with\r\n | Non -> ()\r\n | Lin (LinConst, _) -> err (\"in type \" + x + \", linear constructor cannot be declared const\")\r\n | _ ->\r\n let sfs = string_of_pformals_param fs in\r\n let sfs_out = string_of_pformals_var fs in\r\n let sc = (string_of_lin_var lin) + \"#x:\" + x in\r\n let sc_out = (string_of_lin_param lin) + \"#x:\" + x in\r\n let sis = \"is#\" + c + \"(#x);\" in\r\n let ens = \" ensures #x == \" + c + \"(\" + (String.concat \",\" (List.map fst ffs)) + \");\" in\r\n state.PrintLine (\"procedure construct##\" + c + \"(#me:int, #r:ReturnTo, \" + sfs + \") returns(\" + sc + \");\" + ens);\r\n state.PrintLine (\"procedure destruct##\" + c + \"(#me:int, #r:ReturnTo, \" + sc_out + \") returns(\" + sfs_out + \"); requires \" + sis + ens));\r\n (List.iter (fun (fx, ft, fl) ->\r\n (match (lin, fl) with\r\n | (_, Lin (LinConst, _)) -> err (\"in type \" + x + \", linear field cannot be declared const\")\r\n | (Lin (_, LinOur), Lin (_, LinMy)) -> err (\"in type \" + x + \", linear constructor cannot contain 'my' field\")\r\n | _ -> ());\r\n match ft with\r\n | TInt | TBool | TReal | TMap _ -> ()\r\n | TName xft ->\r\n let subsize = \"sizeof##\" + xft + \"(\" + fx + \"#\" + c + \"(x))\" in\r\n state.PrintLine (\"axiom (forall x:\" + x + \"::{\" + subsize + \"} is#\" + c + \"(x) ==> \" + subsize + \" < sizeof##\" + x + \"(x));\"))\r\n fs);\r\n if not overload then\r\n List.iter\r\n (fun (fx, ft, _) -> state.PrintLine (\"function{:inline true} .\" + fx + \"(x:\" + x + \"):\" + (string_of_typ ft) + \" { \" + fx + \"#\" + c + \"(x) }\"))\r\n fs)\r\n cs\r\n | DStatic x ->\r\n let a = \"?ADDR__\" + x in\r\n let id = \"#ID__\" + x in\r\n state.PrintLine (\"const \" + a + \":int;\");\r\n state.PrintLine (\"const unique \" + id + \":int;\");\r\n state.PrintLine (\"axiom StaticAddrToId(\" + a + \") == \" + id + \";\");\r\n state.PrintLine (\"axiom Aligned(\" + a + \");\");\r\n state.PrintLine (\"axiom word(\" + a + \");\");\r\n state.PrintLine (\"axiom ge(\" + a + \", 4096);\");\r\n state.PrintLine (\"axiom memAddr(\" + a + \");\");\r\n state.PrintLine (\"axiom !memAddrMain(\" + a + \");\")\r\n | DStaticGhost (x, t, lin, _) ->\r\n (if (!symdiff && lin <> Non) then symdiff_lin_decls := x::!symdiff_lin_decls);\r\n state.PrintLine (\"var \" + (string_of_lin_var lin) + x + \":\" + (string_of_typ t) + \";\")\r\n | DFunDecl (x, None, Some t, e_opt, None, None) ->\r\n (\r\n state.PrintLine (\"const \" + x + \":\" + (string_of_typ t) + \";\")\r\n match e_opt with None -> () | Some e -> state.PrintLine (\"axiom \" + x + \" == \" + (string_of_exp e) + \";\")\r\n )\r\n | DFunDecl (x, Some fs, Some t, e_opt, a, None) ->\r\n let e_opt = (match e_opt with None -> None | Some e -> Some (rewrite_recursive_fun state x fs t e)) in\r\n state.PrintLine (\"function \" + (string_of_attrs a) + x + \"(\" + (string_of_formals fs) + \") returns(\" + (string_of_typ t) + \")\");\r\n state.PrintLine (match e_opt with None -> \";\" | Some e -> \"{ \" + (string_of_exp e) + \"}\")\r\n | DFunDecl (x, Some fs, Some t, Some e, None, Some ts) ->\r\n (\r\n let e = rewrite_recursive_fun state x fs t e in\r\n let forall = (match fs with [] -> \"\" | _ -> \"forall \" + (string_of_formals fs) + \"::\" + (string_of_triggers (NoRel, Outside) ts)) in\r\n state.PrintLine\r\n (\"axiom (\" + forall\r\n + x + \"(\" + (String.concat \",\" (List.map fst fs)) + \") == \" + (string_of_exp e) + \");\");\r\n )\r\n | DFunDecl (x, _, _, _, _, _) -> err (\"internal error: const/function \" + x)\r\n | DProc (x, pk, ik, fs, rs, specs, b_opt) ->\r\n (\r\n let rec_context = (x, fs) in\r\n let x2 = \"##verify##\" + x in\r\n let specs =\r\n match pk with\r\n | Procedure (_, Atomic) | Implementation -> specs\r\n | Procedure (_, Yields) | Procedure (_, Stable) -> (l, Modifies state.all_vars)::specs in\r\n let fs = (\"me\", TInt, Lin (LinConst, LinOur))::(\"RET\", TName \"ReturnTo\", Non)::fs in\r\n let impl_fs = List.map (fun (x, t, l) -> (x, t, Non)) fs in // Boogie only allows \"linear\" on proc, not impl\r\n let impl_rs = List.map (fun (x, t, _) -> (x, t, Non)) rs in\r\n let symdiff_mods =\r\n if not !symdiff then [] else\r\n match pk with\r\n | Procedure _ ->\r\n let mods = List.collect (fun s -> match s with (_, Modifies xs) -> xs | _ -> []) specs in\r\n let globs = List.map (fun (x, t, lin) -> (x, (t, lin))) !symdiff_globals in\r\n let mods = List.map (fun x -> \r\n (if not (List.mem_assoc x globs) then err (\"Found \" + x + \" in a modifies clause. Cannot find in global variables.\")); \r\n let (t, lin) = List.assoc x globs in (x, t, lin)) mods in\r\n symdiff_proc_mods := (x, mods)::!symdiff_proc_mods;\r\n mods\r\n | Implementation _ -> List.assoc x !symdiff_proc_mods in\r\n (if !symdiff then\r\n symdiff_invariant := (\"\", ([], []));\r\n symdiff_proc_local_clones := [];\r\n let pfdecl n pre suf (x, t, _) = \"v\" + n + \"_u.\" + pre + x + suf + \": \" + (string_of_typ t) in\r\n let local_vars = match b_opt with None -> [] | Some (vars, _) -> vars in\r\n let ins loop n = List.map (pfdecl n (if loop then \"in_\" else \"\") \"\") fs in\r\n let outs_ins loop n = List.map (pfdecl n \"in_\" \"\") rs in\r\n let outs loop n = List.map (pfdecl n (if loop then \"out_\" else \"\") \"\") rs in\r\n let locals is_out n =\r\n List.map (pfdecl n (if is_out then \"out_\" else \"in_\") \"\") local_vars in\r\n let globals is_out n =\r\n List.map (pfdecl n \"\" (if is_out then \"_\" else \"_old\"))\r\n (if is_out then symdiff_mods else !symdiff_globals) in\r\n let vars loop n =\r\n if loop then\r\n (ins loop n) @ (outs_ins loop n) @ (locals false n) @ (globals false n) @ (globals true n)\r\n @ (outs loop n) @ (locals true n)\r\n else (ins loop n) @ (globals false n) @ (globals true n) @ (outs loop n) in\r\n let vars12 loop = (vars loop \"1\") @ (vars loop \"2\") in\r\n let f_vars loop = sep_list \", \" (vars12 loop) in\r\n symdiff_proc := (x, f_vars);\r\n symdiff_rets := List.map (fun (x, _, _) -> x) rs;\r\n symdiff_params := List.map (fun (x, _, _) -> x) fs;\r\n symdiff_locals := List.map (fun (x, _, _) -> x) local_vars;\r\n let pres = List.collect (fun s ->\r\n match s with (_, Requires (IsRel, e)) -> [string_of_exp_r (RelPre false, Outside) e] | _ -> []) specs in\r\n let posts = List.collect (fun s ->\r\n match s with (_, Ensures (IsRel, e)) -> [string_of_exp_r (RelPost false, Outside) e] | _ -> []) specs in\r\n symdiff_proc := (x, f_vars);\r\n (match pk with Implementation -> () | Procedure _ -> symdiff_write_fun false false pres posts);\r\n symdiff_proc := (x2, f_vars);\r\n (match pk with\r\n | Implementation -> ()\r\n | Procedure _ ->\r\n let req_strings = List.collect (fun s ->\r\n match s with (_, Requires (r, e)) -> [\" && \" + (string_of_exp_ignore_rel r e)] | _ -> []) specs in\r\n state.PrintLine (\"procedure #symdiff_proc_reqs##\" + x2 + \"(\" + (string_of_pformals_var fs) + \");\");\r\n state.PrintLine (\" ensures true \" + (String.concat \"\" req_strings) + \";\");\r\n symdiff_write_fun false true pres posts)\r\n );\r\n let f x pk p_fs p_rs b_opt =\r\n let rets = match p_rs with [] -> \"\" | _ -> \"returns(\" + (string_of_pformals_var p_rs) + \")\" in\r\n let semi = match pk with Procedure _ -> \";\" | Implementation -> \"\" in \r\n state.PrintLine ((string_of_proc_kind pk) + \" \" + x + \"(\" + (string_of_pformals_param p_fs) + \")\" + rets + semi);\r\n state.Indent ();\r\n List.iter (emit_spec state) (match pk with Procedure _ -> specs | Implementation -> []);\r\n state.Unindent ();\r\n (match b_opt with\r\n | None -> ()\r\n | Some (vars, b) ->\r\n (\r\n state.PrintLine \"{\";\r\n state.Indent ();\r\n List.iter (fun (x, t, l) ->\r\n state.PrintLine (\"var \" + (string_of_lin_var l) + x + \":\" + (string_of_typ t) + \";\")) vars;\r\n List.iter (emit_stmt_decl [] state) b;\r\n (if !symdiff then\r\n state.PrintLine (\"call #symdiff_proc_reqs##\" + x2 + \"(\" + (String.concat \",\" (List.map (fun (x, _, _) -> x) p_fs)) + \");\");\r\n List.iter (fun (x, _, _) -> state.PrintLine(x + \" := \" + x + \";\")) symdiff_mods; // make sure symdiff reports modified variables in predictable order (TODO: get /doModSetAnalysis completely turned off)\r\n () // symdiff_emit_linearity state\r\n );\r\n List.iter (emit_stmt rec_context state) b;\r\n state.Unindent ();\r\n state.PrintLine \"}\"\r\n )) in\r\n ( match (b_opt, pk) with\r\n | (None, Procedure _) ->\r\n f x pk fs rs None;\r\n f x2 pk fs rs None\r\n | (None, Implementation) -> err \"implementation must have body\"\r\n | (Some _, Procedure _) ->\r\n f x pk fs rs None;\r\n f x2 pk fs rs None;\r\n f x2 Implementation impl_fs impl_rs b_opt\r\n | (Some _, Implementation) ->\r\n f x2 Implementation impl_fs impl_rs b_opt);\r\n state.PrintLine \"\"\r\n )\r\n\r\nlet emit_module (state:print_state) (m:_module):unit =\r\n try\r\n List.iter (emit_decl state) m.mDecls\r\n with Err s -> let (f, l) = !state.cur_loc in err (\"error near location \" + f + \" line \" + (string l) + \": \" + s);\r\n if !symdiff then\r\n // generate clone procedure declarations\r\n List.iter (fun (p, count) ->\r\n let (_, pk, ik, fs, rs, specs, ts) = List.assoc p state.all_procs in\r\n for i = 1 to !count do\r\n let pc = \"#clone\" + (string i) + \"#\" + p in\r\n let d = DProc (pc, pk, ik, fs, rs, specs, ts) in\r\n emit_decl state ((\"clone\", 0), d)\r\n )\r\n !symdiff_proc_global_clones\r\n\r\nlet emit_entry_point (state:print_state):unit =\r\n // call all interface procedures from a dummy entry point\r\n let vars = List.collect (fun (_, d) -> match d with DStaticGhost (x, _, _, _) -> [x] | _ -> []) state.publics in\r\n let mods = \"modifies \" + (String.concat \",\" vars) + \";\" in\r\n state.PrintLine \"procedure{:yields} ###DummyCallTarget();\";\r\n let procs =\r\n List.fold_left\r\n (fun procs (loc, d) ->\r\n match d with\r\n | DProc (xp, Procedure (_, atomicity), ik, fs, rs, specs, _) ->\r\n (\r\n state.SetLoc(loc);\r\n let fs = (\"me\", TInt, Lin (LinConst, LinOur))::(\"RET\", TName \"ReturnTo\", Non)::fs in\r\n let attr = match atomicity with Atomic -> \"\" | _ -> \"{:verify false}\" in\r\n state.PrintLine (\"procedure{:yields}\" + attr + \" ###Dummy#\" + xp + \"()\");\r\n state.Indent ();\r\n state.PrintLine mods;\r\n state.Unindent ();\r\n state.PrintLine \"{\";\r\n state.Indent ();\r\n List.iter\r\n (fun (x, t, lin) ->\r\n state.PrintLine (\"var\" + (string_of_lin_var lin) + \" \" + x + \":\" + (string_of_typ t) + \";\"))\r\n (fs @ rs);\r\n state.SetLoc(loc);\r\n List.iter\r\n (fun (_, s) ->\r\n match (atomicity, s) with\r\n | (Atomic, Requires (r, e)) -> state.PrintLine (\"assume \" + (string_of_exp_ignore_rel r e) + \";\")\r\n | _ -> ())\r\n specs;\r\n let stable = match atomicity with Stable -> \"###DummyEntryPoint() | \" | _ -> \"\" in\r\n let args = String.concat \",\" (List.map (fun (x, _, _) -> x) fs) in\r\n let rets = String.concat \",\" (List.map (fun (x, _, _) -> x) rs) in\r\n let rets = rets + (if List.length rs = 0 then \"\" else \" := \") in\r\n state.SetLoc(loc);\r\n state.PrintLine (\"free call \" + stable + rets + \"##verify##\" + xp + \"(\" + args + \");\");\r\n state.Unindent ();\r\n state.PrintLine \"}\";\r\n (xp, atomicity)::procs\r\n )\r\n | _ -> procs)\r\n []\r\n state.publics\r\n if procs.Length > 0 then\r\n state.SetLoc((\"fake entry point\", 1));\r\n state.PrintLine \"procedure{:entrypoint}{:verify false} ###DummyEntryPoint()\";\r\n state.PrintLine mods;\r\n state.PrintLine \"{\";\r\n state.Indent ();\r\n state.PrintLine (\"###loop: goto \" + (String.concat \",\" (List.map fst procs)) + \";\");\r\n List.iter\r\n (fun (xp, atomicity) -> state.PrintLine (xp + \": async call ###Dummy#\" + xp + \"(); goto ###loop;\"))\r\n (List.rev procs);\r\n state.Unindent ();\r\n state.PrintLine \"}\"\r\n\r\n" }, { "path": "ironclad-apps/tools/BoogieAsm/lex.fsl", "content": "{\r\nopen Lexing;;\r\nopen Parse;;\r\nopen Parse_util;;\r\nopen Microsoft.FSharp.Compatibility.OCaml.Big_int;;\r\n\r\nlet macros = ref (Map.empty:Map)\r\n\r\n}\r\n\r\nrule comment = parse\r\n| \"*/\" { () }\r\n| \"*)\" { () }\r\n| \"/*\" { comment lexbuf ; comment lexbuf }\r\n| \"(*\" { comment lexbuf ; comment lexbuf }\r\n| \"\\n\\r\" { incr line; comment lexbuf }\r\n| \"\\r\\n\" { incr line; comment lexbuf }\r\n| ['\\n''\\r'] { incr line; comment lexbuf }\r\n| _ { comment lexbuf }\r\nand preprocess_skip deep = parse\r\n| \"#else\" { if deep then preprocess_skip deep lexbuf else () }\r\n| \"#endif\" { () }\r\n| \"#ifdef\" { preprocess_skip true lexbuf; preprocess_skip deep lexbuf }\r\n| \"#ifndef\" { preprocess_skip true lexbuf; preprocess_skip deep lexbuf }\r\n| \"\\n\\r\" { incr line; preprocess_skip deep lexbuf }\r\n| \"\\r\\n\" { incr line; preprocess_skip deep lexbuf }\r\n| ['\\n''\\r'] { incr line; preprocess_skip deep lexbuf }\r\n| _ { preprocess_skip deep lexbuf }\r\nand file_name = parse\r\n| [' ']*[^' ''\\n''\\r']+[^'\\n''\\r']* { file := (lexeme lexbuf).Trim() ; token lexbuf }\r\n| [^'\\n''\\r']* { token lexbuf }\r\nand line_number = parse\r\n| ['0'-'9']+ { line := int_of_string(lexeme lexbuf) - 1 ; file_name lexbuf }\r\nand token = parse\r\n| \"\\n\\r\" { incr line; token lexbuf }\r\n| \"\\r\\n\" { incr line; token lexbuf }\r\n| ['\\n''\\r'] { incr line; token lexbuf }\r\n| [' ''\\t'] { token lexbuf }\r\n| \"//\"[^'\\n''\\r']* { token lexbuf }\r\n| \"#line\"[' ']* { line_number lexbuf }\r\n| \"/*\" { comment lexbuf ; token lexbuf }\r\n| \"(*\" { comment lexbuf ; token lexbuf }\r\n| \"#ifdef\"[' ']+['A'-'Z''a'-'z''0'-'9''_''$''?']+\r\n{\r\n let s = lexeme lexbuf in\r\n let x = s.Substring(\"#ifdef\".Length).Trim() in\r\n if Map.contains x !macros then token lexbuf else (preprocess_skip false lexbuf ; token lexbuf)\r\n}\r\n| \"#ifndef\"[' ']+['A'-'Z''a'-'z''0'-'9''_''$''?']+\r\n{\r\n let s = lexeme lexbuf in\r\n let x = s.Substring(\"#ifndef\".Length).Trim() in\r\n if not (Map.contains x !macros) then token lexbuf else (preprocess_skip false lexbuf ; token lexbuf)\r\n}\r\n| \"#else\" { preprocess_skip false lexbuf ; token lexbuf }\r\n| \"#endif\" { token lexbuf }\r\n| \":\" { COLON (!file, !line) }\r\n| \";\" { SEMI }\r\n| \"(\" { LPAREN }\r\n| \")\" { RPAREN }\r\n| \"[\" { LBRACKET }\r\n| \"]\" { RBRACKET }\r\n| \"{\" { LBRACE (!file, !line) }\r\n| \"}\" { RBRACE (!file, !line) }\r\n| \"<\" { LT }\r\n| \">\" { GT }\r\n| \"=\" { EQ }\r\n| \"+\" { PLUS }\r\n| \"-\" { MINUS }\r\n| \"*\" { STAR }\r\n| \"/\" { SLASH }\r\n| \"!\" { BANG }\r\n| \"mod\" { MOD }\r\n| \"div\" { DIV }\r\n| \",\" { COMMA }\r\n| \"|\" { BAR }\r\n| \".\" { DOT }\r\n| \"#\" { HASH }\r\n| \":=\" { COLONEQ (!file, !line) }\r\n| \"<=\" { LE }\r\n| \">=\" { GE }\r\n| \"==\" { EQEQ }\r\n| \"!=\" { NE }\r\n| \"&&\" { AMPAMP }\r\n| \"||\" { BARBAR }\r\n| \"::\" { COLONCOLON }\r\n| \">>\" { GTGT }\r\n| \"<<\" { LTLT }\r\n| \"==>\" { EQEQGT }\r\n| \"<==>\" { LTEQEQGT }\r\n| \"type\" { TYPE (!file, !line) }\r\n| \"const\" { CONST (!file, !line) }\r\n| \"readonly\" { READONLY (!file, !line) }\r\n| \"function\" { FUNCTION (!file, !line) }\r\n| \"returns\" { RETURNS (!file, !line) }\r\n| \"axiom\" { AXIOM (!file, !line) }\r\n| \"procedure\" { PROCEDURE (!file, !line) }\r\n| \"implementation\" { IMPLEMENTATION (!file, !line) }\r\n| \"requires\" { REQUIRES (!file, !line) }\r\n| \"ensures\" { ENSURES (!file, !line) }\r\n| \"modifies\" { MODIFIES (!file, !line) }\r\n| \"invariant\" { INVARIANT (!file, !line) }\r\n| \"assert\" { ASSERT (!file, !line) }\r\n| \"havoc\" { HAVOC }\r\n| \"goto\" { GOTO (!file, !line) }\r\n| \"call\" { CALL (!file, !line) }\r\n| \"forall\" { FORALL (!file, !line) }\r\n| \"exists\" { EXISTS (!file, !line) }\r\n| \"lambda\" { LAMBDA (!file, !line) }\r\n| \"old\" { OLD }\r\n| \"left\" { LEFT }\r\n| \"right\" { RIGHT }\r\n| \"relation\" { RELATION }\r\n| \"public\" { PUBLIC }\r\n| \"int\" { INT }\r\n| \"real\" { REAL }\r\n| \"bool\" { BOOL }\r\n| \"true\" { LITBOOL true }\r\n| \"false\" { LITBOOL false }\r\n| \"is\" { IS }\r\n| \"let\" { LET }\r\n| \"in\" { IN }\r\n| \"var\" { VAR (!file, !line) }\r\n| \"if\" { IF (!file, !line) }\r\n| \"then\" { THEN }\r\n| \"else\" { ELSE }\r\n| \"return\" { RETURN (!file, !line) }\r\n| \"ireturn\" { IRETURN (!file, !line) }\r\n| \"yield\" { YIELD (!file, !line) }\r\n| \"linear\" { LINEAR }\r\n| \":split_here\" { SPLIT }\r\n| \"my\" { MY }\r\n| \"static\" { STATIC (!file, !line) }\r\n| \"module\" { MODULE (!file, !line) }\r\n| \"interface\" { INTERFACE (!file, !line) }\r\n| \"import\" { IMPORT (!file, !line) }\r\n| \"atomic\" { ATOMIC }\r\n| \"stable\" { STABLE }\r\n| \"ghost\" { GHOST }\r\n| \"CS\" { SEGNAME (lexeme lexbuf) }\r\n| \"DS\" { SEGNAME (lexeme lexbuf) }\r\n| \"SS\" { SEGNAME (lexeme lexbuf) }\r\n| \"ES\" { SEGNAME (lexeme lexbuf) }\r\n| \"FS\" { SEGNAME (lexeme lexbuf) }\r\n| \"GS\" { SEGNAME (lexeme lexbuf) }\r\n| \"EAX\" { REGNAME (lexeme lexbuf) }\r\n| \"EBX\" { REGNAME (lexeme lexbuf) }\r\n| \"ECX\" { REGNAME (lexeme lexbuf) }\r\n| \"EDX\" { REGNAME (lexeme lexbuf) }\r\n| \"ESI\" { REGNAME (lexeme lexbuf) }\r\n| \"EDI\" { REGNAME (lexeme lexbuf) }\r\n| \"EBP\" { REGNAME (lexeme lexbuf) }\r\n| \"ESP\" { REGNAME (lexeme lexbuf) }\r\n| \"0x\"['0'-'9''a'-'f''A'-'F']+ {\r\n let s = lexeme lexbuf in\r\n let s = String.sub s 2 (String.length s - 2) in\r\n let rec explode (n:int) s = if n = String.length s then [] else (String.get s n)::(explode (n+1) s) in\r\n let digits = List.map (Char.code << Char.lowercase) (explode 0 s) in\r\n let rec hex digits n =\r\n match digits with\r\n | [] -> n\r\n | h::t ->\r\n let d = if h >= (Char.code 'a') then h - (Char.code 'a') + 10 else h - (Char.code '0') in\r\n hex t (add_int_big_int d (mult_int_big_int 16 n)) in\r\n LITINT (hex digits zero_big_int)\r\n }\r\n| ['0'-'9']+ { LITINT (big_int_of_string(lexeme lexbuf)) }\r\n| ['0'-'9']+['.']['0'-'9']+ { LITREAL (lexeme lexbuf) }\r\n| ['0'-'9']+\"bv32\" { let s = lexeme lexbuf in LITBV32 (big_int_of_string(s.Substring(0, s.Length - 4))) }\r\n| ['_']*['A'-'Z']['_''a'-'z''A'-'Z''0'-'9']* { UID ((lexeme lexbuf).Replace(\"_old\", \"__old\")) }\r\n| ['_']*['a'-'z']['_''a'-'z''A'-'Z''0'-'9']* { LID ((lexeme lexbuf).Replace(\"_old\", \"__old\")) }\r\n| '?'['_']*['A'-'Z']['_''a'-'z''A'-'Z''0'-'9']* { QUID ((lexeme lexbuf).Replace(\"_old\", \"__old\")) }\r\n| '?'['_']*['a'-'z']['_''a'-'z''A'-'Z''0'-'9']* { QLID ((lexeme lexbuf).Replace(\"_old\", \"__old\")) }\r\n| '$'['_']*['A'-'Z']['_''a'-'z''A'-'Z''0'-'9']* { DUID ((lexeme lexbuf).Replace(\"_old\", \"__old\")) }\r\n| '$'['_']*['a'-'z']['_''a'-'z''A'-'Z''0'-'9']* { DLID ((lexeme lexbuf).Replace(\"_old\", \"__old\")) }\r\n| ['_']+['_''0'-'9']* { LID ((lexeme lexbuf).Replace(\"_old\", \"__old\")) }\r\n| eof { EOF }\r\n| '\\000' { EOF }\r\n| _ { parse_err (\"cannot parse character: \\\"\" ^ (lexeme lexbuf) ^ \"\\\"\" ^ \"\\n(ascii code \" ^ (string_of_int (Char.code (String.get (lexeme lexbuf) 0))) ^ \")\") }\r\n\r\n" }, { "path": "ironclad-apps/tools/BoogieAsm/main.fs", "content": "open Ast\r\nopen Parse\r\nopen Parse_util\r\nopen Emit_bpl\r\nopen Microsoft.FSharp.Math\r\n\r\nlet check_concurrent = ref false\r\n\r\nlet proc_name (s:string) = \"_?\" + s\r\nlet const_name (s:string) = \"?_\" + s\r\nlet label (ctxt:string) (s:string) = ctxt ^ \"$\" ^ s\r\n\r\nlet sym = ref 0\r\nlet gensym () = incr sym; \"$$\" ^ (string_of_int !sym)\r\n\r\nlet list_remove x l = List.filter (fun y -> x <> y) l\r\n\r\ntype width = W8 | W16 | W32\r\nlet string_of_width w = match w with W8 -> \"byte\" | W16 -> \"word\" | W32 -> \"dword\"\r\n\r\ntype con = string\r\ntype operand =\r\n| OConst of con\r\n| OReg of reg\r\n| OTmpReg of reg\r\n| OSelector of string\r\n| OConstPtr of con\r\n| OOffset of reg * con\r\n| OIndex of reg * con * reg * con\r\n| OExp of bigint option\r\n\r\ntype varMap = (id * operand) list\r\ntype insCtxt = string * varMap\r\ntype inlineMap = InlineMap of (string * (operand list -> inlineMap * insCtxt * (loc * stmt) list)) list\r\ntype inlinePreMap = (string * (operand list -> insCtxt * (loc * stmt) list)) list\r\n\r\nlet is_32bit_bigint i = BigInt.Zero <= i && i < (BigInt.Parse \"4294967296\")\r\nlet is_32bit_bigint_signed i = (BigInt.Parse \"-4294967296\") <= i && i < (BigInt.Parse \"4294967296\")\r\n\r\nlet x64 = ref false //32-bit by default\r\n\r\nlet const_of_exp (e:exp):con =\r\n match e with\r\n | EInt i when is_32bit_bigint i -> i.ToString()\r\n | EVar x -> const_name x\r\n | _ -> err \"unexpected constant\"\r\n\r\nlet const_of_exp_signed (e:exp):con =\r\n match e with\r\n | EInt i when is_32bit_bigint_signed i -> i.ToString()\r\n | EOp (Uop \"-\", [EInt i]) when is_32bit_bigint_signed (-i) -> (-i).ToString()\r\n | _ -> const_of_exp e\r\n\r\nlet operand_of_exp (varMap:varMap) (e:exp):operand =\r\n match e with\r\n | EApply (\"OConst\", [c]) -> OConst (const_of_exp c)\r\n | EApply (\"OReg\", [EVar x]) when x.StartsWith(\"TMP\") -> OTmpReg x\r\n | EApply (\"OReg\", [EVar x]) -> OReg x\r\n | EApply (\"OMem\", [EApply (\"MConst\", [c])]) -> OConstPtr (const_of_exp c)\r\n | EApply (\"OMem\", [EApply (\"MReg\", [EVar x; c])]) -> OOffset (x, const_of_exp_signed c)\r\n | EApply (\"OMem\", [EApply (\"MIndex\", [EVar xb; EInt i; EVar xi; c])])\r\n when (match i.ToString() with \"1\" | \"2\" | \"4\" | \"8\" -> true | _ -> false) ->\r\n OIndex (xb, i.ToString(), xi, const_of_exp_signed c)\r\n | EVar x when List.mem_assoc x varMap -> List.assoc x varMap\r\n | EVar (\"EAX\" | \"EBX\" | \"ECX\" | \"EDX\" | \"ESI\" | \"EDI\" | \"EBP\" | \"ESP\" as x) -> OReg x\r\n | EVar x when x.StartsWith(\"TMP\") -> OTmpReg x\r\n | EVar (\"CS\" | \"DS\" | \"ES\" | \"FS\" | \"GS\" | \"SS\" as x) -> OSelector x\r\n | EInt i -> OExp (Some i)\r\n | _ -> OExp None\r\n\r\nlet rec free_vars_exp (scopeVars:string list) (e:exp):string list =\r\n match e with\r\n | EVar x -> if (List.mem x scopeVars) then [] else [x]\r\n | EInt _ | EReal _ | EBv32 _ | EBool _ -> []\r\n | EOp (_, es) -> List.collect (free_vars_exp scopeVars) es\r\n | EApply (_, es) -> List.collect (free_vars_exp scopeVars) es\r\n | EQuant (_, xs, ts, e) -> List.collect (free_vars_exp ((List.map fst xs) @ scopeVars)) (e::(List.concat ts))\r\n\r\nlet check_module (included:_module list) (ifc:_module) (imp:_module) =\r\n let allDs = (List.collect (fun m -> m.mDecls) (imp::ifc::included)) in\r\n let pubDs = (List.collect (fun m -> m.mDecls) (ifc::included)) in\r\n let procMap =\r\n List.collect\r\n (fun (_, d) -> match d with DProc ((x, Procedure (g, a), _, _, _, specs, _) as p) -> [(x, ((g, a), specs))] | _ -> [])\r\n allDs in\r\n let includeNames = List.map (fun i -> i.mName) included in\r\n let ds = ifc.mDecls @ imp.mDecls in\r\n let allVars = List.collect (fun (_, d) -> match d with DStaticGhost (x, _, _, _) -> [x] | _ -> []) allDs in\r\n let allRwVars = List.collect (fun (_, d) -> match d with DStaticGhost (x, _, _, ReadWrite) -> [x] | _ -> []) allDs in\r\n let declVars = List.collect (fun (_, d) -> match d with DStaticGhost (x, _, _, _) -> [x] | _ -> []) ds in\r\n let implVars = List.collect (fun (_, d) -> match d with DStaticGhost (x, _, _, _) -> [x] | _ -> []) imp.mDecls in\r\n let ifcProcs = List.collect (fun (_, d) -> match d with DProc (x, _, _, _, _, _, _) -> [x] | _ -> []) ifc.mDecls in\r\n let pubProcs = List.collect (fun (_, d) -> match d with DProc (x, _, _, _, _, _, _) -> [x] | _ -> []) pubDs in\r\n // check that all procedures have implementations\r\n let mProcDecls = List.collect (fun (_, d) -> match d with DProc (x, _, _, _, _, _, _) -> [x] | _ -> []) (imp.mDecls @ ifc.mDecls) in\r\n let mProcDefs = List.collect (fun (_, d) -> match d with DProc (x, _, _, _, _, _, Some _) -> [x] | _ -> []) (imp.mDecls @ ifc.mDecls) in\r\n List.iter (fun x -> if (not (List.mem x mProcDefs)) then err (\"module \" + ifc.mName + \" does not implement procedure \" + x)) mProcDecls;\r\n // check that untrusted modules do not declare built-in instructions\r\n List.iter (fun (x:string) -> if x.StartsWith(\"instr_\") then err (\"untrusted module \" + ifc.mName + \" cannot declare instruction \" + x)) mProcDecls;\r\n // check that imported module list matches included list\r\n// TODO consult Chris about synchronization between include/import\r\n// I think we're delegating all this responsibility to build system anyway.\r\n// List.iter (fun x -> if not (List.mem x imp.mImports) then err (\"included module \" + x + \" must be imported\")) includeNames;\r\n// List.iter (fun x -> if not (List.mem x includeNames) then err (\"imported module \" + x + \" must be included\")) imp.mImports;\r\n // check each procedure\r\n List.iter\r\n (fun ((locF, locL), d) ->\r\n match d with\r\n | DProc (xp, _, ik, ps, rs, specs, b_opt) ->\r\n (\r\n try\r\n (\r\n let check_spec spec =\r\n match spec with\r\n | (_, Requires (IsRel, _)) | (_, Ensures (IsRel, _)) when not !symdiff_allow ->\r\n err \"'relation' expression only allowed when using -symdiffok flag or -symdiffms option\"\r\n | _ -> ()\r\n in\r\n List.iter check_spec specs;\r\n let proc_decl = try List.assoc xp procMap with :? System.Collections.Generic.KeyNotFoundException as x -> err (\"procedure \" + xp + \" not found\") in\r\n let ((ghost, atomicity), dspecs) = proc_decl in\r\n let procRel = List.exists (fun spec ->\r\n match spec with (_, Ensures (IsRel, _)) -> true | (_, Requires (IsRel, _)) -> true | _ -> false) dspecs in\r\n let locals = ps @ rs @ (match b_opt with None -> [] | Some (ls, _) -> ls) in\r\n let local_xs = List.map (fun (x, _, _) -> x) locals in\r\n // public variables in yield statements must be declared in module yields\r\n let check_yield e =\r\n List.iter\r\n (fun x ->\r\n match (List.mem x allVars, List.mem x implVars, List.mem x ifc.mModifies, List.mem x ifc.mYields) with\r\n | (false, _, _, _) -> () // not a variable (is a constant, or an invalid variable that will cause a Boogie error)\r\n | (true, true, false, _) -> () // private variable; no one else is allowed to modify x\r\n | (true, _, _, true) -> () // variable declared in yields\r\n | (true, _, _, false) -> err (\"variable \" + x + \" occurs in yield, must be declared in module yields\"))\r\n (free_vars_exp local_xs e) in\r\n // if any assigned variables are in the module's modifies list, check that the assignment is in public atomic action\r\n let check_assign forallScope x =\r\n match forallScope with\r\n | Some fa_xs -> if not (List.mem x fa_xs) then err (\"cannot assign to variable \" + x + \" inside forall statement\") else ()\r\n | None ->\r\n (\r\n if List.mem x local_xs then () else\r\n match (List.mem x allVars, List.mem x allRwVars, List.mem x declVars, List.mem x ifc.mModifies, atomicity, List.mem xp ifcProcs) with\r\n | (false, _, _, _, _, _) -> err (\"in procedure \" + xp + \", cannot find declaration of variable \" + x)\r\n | (true, false, _, _, _, _) -> err (\"procedure \" + xp + \" assigns to readonly variable \" + x)\r\n | (true, true, false, false, _, _) -> err (\"procedure \" + xp + \" assigns to \" + x + \" without declaring \" + x + \" in module modifies\")\r\n | (true, true, true, false, _, _) -> () // private variable; no one else is allowed to yield on x (REVIEW: require List.mem x implVars here for clarity?)\r\n | (true, true, _, true, Atomic, true) -> () // assignment is publicized via public atomic procedure\r\n | (true, true, _, true, _, true) -> err (\"procedure \" + xp + \" must be atomic to assign to variable \" + x)\r\n | (true, true, _, true, _, false) -> err (\"procedure \" + xp + \" must be declared in module interface to assign to variable \" + x)\r\n )\r\n in\r\n let check_call is_inline ghost forallScope (xc:id) =\r\n if xc.StartsWith(\"construct##\") || xc.StartsWith(\"destruct##\") then () else\r\n try\r\n let ((gc, ac), specs) = List.assoc xc procMap in\r\n List.iter (fun (_, s) ->\r\n match (forallScope, s) with\r\n | (Some _, Modifies _) -> err \"forall statement cannot call procedure with modifies clause\"\r\n | (_, Requires (IsRel, _)) when not !symdiff_allow -> err \"call to procedure with relational requires only allowed when using -symdiffok flag or -symdiffms option\"\r\n | (_, Requires (IsRel, _)) when not procRel -> err \"call to procedure with relational requires only allowed from procedure with relational requires or relational ensures (hint: try adding 'ensures public(true);')\"\r\n | _ -> ())\r\n specs;\r\n if xp = xc then\r\n (\r\n match (ghost, is_inline, ps) with\r\n | (PGhost, true, _::_) -> ()\r\n | _ -> err (\"recursive procedures must be ghost, inline, with a decreasing, non-negative first parameter: \" + xc)\r\n );\r\n (match (atomicity, ac) with\r\n | (Atomic, Yields) | (Atomic, Stable) -> err (\"atomic procedure \" + xp + \" cannot call non-atomic procedure \" + xc)\r\n | _ -> ());\r\n (match (ghost, gc) with\r\n | (PGhost, PReal) -> err (\"cannot call non-ghost procedure \" + xc + \" in ghost context\")\r\n | (PGhost, PGhost) | (PReal, _) -> ())\r\n with :? System.Collections.Generic.KeyNotFoundException as x -> err (\"procedure \" + xc + \" not found\") in\r\n let check_par forallScope xc (xpar, _) =\r\n try\r\n let ((_, ac), _) = List.assoc xc procMap in\r\n let ((gpar, apar), specs) = List.assoc xpar procMap in\r\n List.iter (fun s ->\r\n match (forallScope, s) with (Some _, (_, Modifies _)) -> err \"forall statement cannot call procedure with modifies clause\" | _ -> ()) specs;\r\n if xp = xc then err (\"recursive parallel calls not allowed: \" + xc);\r\n match (ac, apar, gpar) with\r\n // All parallel call targets must be stable\r\n // All parallel call targets except for first must be ghost\r\n | (Atomic, _, _) | (Yields, _, _) -> err (\"target of parallel call \" + xc + \" must be declared 'stable'\")\r\n | (Stable, Atomic, _) | (Stable, Yields, _) -> err (\"target of parallel call \" + xpar + \" must be declared 'stable'\")\r\n | (Stable, Stable, PReal) -> err (\"target of parallel call \" + xpar + \" must be declared 'ghost'\")\r\n | (Stable, Stable, PGhost) -> ()\r\n with :? System.Collections.Generic.KeyNotFoundException as x -> err (\"procedure \" + xc + \" or \" + xpar + \" not found\") in\r\n // if specifications must be stable, check that variables are declared in yields\r\n (if atomicity = Stable then\r\n List.iter (fun (_, s) -> match s with Requires (_, e) | Ensures (_, e) -> check_yield e | _ -> ()) specs\r\n else ());\r\n // check all statements\r\n let rec check_stmt ghost forallScope =\r\n (fun ((locF, locL), stmt) ->\r\n try\r\n (\r\n (match (stmt, ik) with ((SReturn | SIReturn), Inline) -> err \"return not allowed in inline procedure\" | _ -> ());\r\n match stmt with\r\n | SLabel _ | SGoto _ | SReturn | SIReturn | SIfJcc _ ->\r\n (match ghost with PReal -> () | PGhost -> err (\"illegal control construct in ghost context\"))\r\n | SGroup b -> List.iter (check_stmt ghost forallScope) b\r\n | SIfGhost (_, b) -> List.iter (check_stmt PGhost forallScope) b\r\n // REVIEW: we allow forall bodies to read (but not write) linear variables\r\n | SForallGhost (_, _, _, fVars, b) -> List.iter (check_stmt PGhost (Some (List.map fst fVars))) b\r\n | SExistsGhost (_, _, _) -> ()\r\n | SAssert _ -> ()\r\n | SSplit -> ()\r\n | SYield _ when atomicity = Atomic -> err (\"procedure \" + xp + \" cannot be declared atomic because it contains a yield statement\")\r\n | SYield _ when ghost = PGhost -> err (\"yield cannot appear in ghost context\")\r\n | SYield e -> check_yield e\r\n | SAssign (x, _) -> check_assign forallScope x\r\n | SInline (xs, target, _, pars) ->\r\n check_call true ghost forallScope target;\r\n List.iter (check_assign forallScope) xs;\r\n List.iter (check_par forallScope target) pars\r\n | SCall _ when ghost = PGhost -> err (\"call to non-inline procedure cannot appear in ghost context\")\r\n | SCall (xs, target, _) -> check_call false ghost forallScope target; List.iter (check_assign forallScope) xs\r\n ) with Err s -> err (\"In procedure \" + xp + \" (\" + locF + \" line \" + (string locL) + \"):\" + System.Environment.NewLine + s))\r\n in\r\n let check_stmts b =\r\n let rec body_end b =\r\n match b with\r\n | (_, SGroup b)::_ -> body_end (List.rev b)\r\n | (_, (SReturn | SIReturn | SGoto _))::_ -> ()\r\n | _ -> err \"body must end with return or goto\"\r\n in\r\n (match ik with Inline -> () | Outline -> body_end (List.rev b));\r\n List.iter (check_stmt ghost None) b\r\n in\r\n (match b_opt with None -> () | Some (_, stmts) -> check_stmts stmts)\r\n ) with Err s -> err (\"In procedure \" + xp + \" (\" + locF + \" line \" + (string locL) + \"):\" + System.Environment.NewLine + s)\r\n )\r\n | _ -> ())\r\n ds;\r\n ()\r\n\r\nlet rec applied_funs_exp (maskVars:string list) (e:exp):string list =\r\n let f = applied_funs_exp maskVars in\r\n match e with\r\n | EVar _ | EInt _ | EReal _ | EBv32 _ | EBool _ -> []\r\n | EOp (_, es) -> List.collect f es\r\n | EApply (x, es) ->\r\n let x = x + \"(...)\" in\r\n (if (List.mem x maskVars) then [] else [x]) @ (List.collect f es)\r\n | EQuant (_, _, ts, e) -> List.collect f (e::(List.concat ts))\r\n\r\n// Returns list of declarations that e depends on\r\nlet rec link_check_exp (scopeVars:string list) (e:exp):string list =\r\n (free_vars_exp scopeVars e) @ (applied_funs_exp scopeVars e)\r\n\r\nlet rec stmt_calls (_, stmt:stmt):string list =\r\n match stmt with\r\n | SLabel _ | SGoto _ | SReturn | SIReturn | SIfJcc _ | SAssert _ | SSplit | SYield _ | SAssign _ | SExistsGhost _ -> []\r\n | SGroup b -> List.collect stmt_calls b\r\n | SIfGhost (_, b) -> List.collect stmt_calls b\r\n | SForallGhost (_, _, _, _, b) -> List.collect stmt_calls b\r\n | SInline (_, target, _, pars) -> [target] @ (List.map fst pars)\r\n | SCall (_, target, _) -> [target]\r\n\r\nlet link_check_module (scopeVars:string list) (mIntf:_module, mImpl:_module):string list =\r\n let intf = mIntf.mDecls in\r\n let impl = mImpl.mDecls in\r\n let check_decl (_, d:decl):string list * (string * string list) list =\r\n let pid (x:string):string = x + \"(..);\" in\r\n let fid (ps_opt:formal list option) (x:string):string =\r\n match ps_opt with None -> x | Some _ -> x + \"(...)\" in\r\n let param_ids (ps_opt:formal list option):id list =\r\n match ps_opt with None -> [] | Some ps -> List.map fst ps in\r\n match d with\r\n | DFunDecl (x, ps_opt, _, None, _, _) -> ([fid ps_opt x], [])\r\n | DFunDecl (x, ps_opt, _, Some e, _, Some _) ->\r\n ([], [(fid ps_opt x, link_check_exp ((x + \"(...)\")::(param_ids ps_opt) @ scopeVars) e)])\r\n | DFunDecl (x, ps_opt, _, Some e, _, None) ->\r\n ([fid ps_opt x], [(fid ps_opt x, link_check_exp ((x + \"(...)\")::(param_ids ps_opt) @ scopeVars) e)])\r\n | DType (xt, _, _, None) -> ([(\"sizeof##\" + xt + \"(...)\")], [])\r\n | DType (xt, overload, impl, Some cs) ->\r\n // Note: we use sizeof##'s checking to check for correct definition of xt (e.g. to check that xt not defined more than once)\r\n // TODO: check that xc not declared twice?\r\n ((if impl then [] else [\"sizeof##\" + xt + \"(...)\"]) @ (List.collect (fun (_, xc, fs) ->\r\n (xc + \"(...)\")::(pid (\"construct##\" + xc))::(pid (\"destruct##\" + xc))::(\"is#\" + xc + \"(...)\")\r\n ::(List.collect (fun (xf, _, _) ->\r\n (if overload then [] else [\".\" + xf + \"(...)\"]) @ [xf + \"#\" + xc + \"(...)\"]) fs)) cs),\r\n [(\"sizeof##\" + xt + \"(...)\"), []])\r\n | DStatic x -> ([\"?ADDR__\" + x], [])\r\n | DStaticGhost _ -> ([], [])\r\n | DProc (x, _, _, _, _, _, None) -> ([pid x], [])\r\n | DProc (x, Implementation, _, _, _, _, Some (_, b)) ->\r\n ([], [(pid x, List.filter (fun y -> not (List.mem y ((pid x)::scopeVars))) (List.map pid (List.collect stmt_calls b)))])\r\n | DProc (x, Procedure _, _, _, _, _, Some (_, b)) ->\r\n ([pid x], [(pid x, List.filter (fun y -> not (List.mem y ((pid x)::scopeVars))) (List.map pid (List.collect stmt_calls b)))])\r\n let pubs = List.map check_decl intf in\r\n let prvs = List.map check_decl impl in\r\n let (pub_decls, pub_defs) = (List.collect fst pubs, List.collect snd pubs) in\r\n let (prv_decls, prv_defs) = (List.collect fst prvs, List.collect snd prvs) in\r\n let decls = pub_decls @ prv_decls in\r\n List.iter (fun d -> if List.mem d scopeVars then err (d ^ \" declared more than once\")) decls;\r\n let defs = pub_defs @ prv_defs in\r\n let undefs = List.filter (fun d -> not (List.mem_assoc d defs)) decls in\r\n let rec check_defs (ds:(string * string list) list):unit =\r\n // move definitions with no unresolved dependencies to front\r\n //System.Console.WriteLine(); List.iter (fun ds -> System.Console.WriteLine(\"\" + (fst ds) + \" --> \" + (String.concat \",\" (snd ds)))) ds;\r\n let (defs_ready, defs_wait) = List.partition (fun (x, deps) -> List.isEmpty deps) ds in\r\n match (defs_ready @ defs_wait) with\r\n | [] -> ()\r\n | (d,[])::_ when not (List.mem d decls) -> err (d ^ \" not declared in current module\")\r\n | (d,[])::ds when (List.mem_assoc d ds) -> err (d ^ \" defined more than once\")\r\n | (d,[])::ds -> check_defs (List.map (fun (d2,deps) -> (d2, list_remove d deps)) ds)\r\n | (d1,(d2::_))::_ -> err (d1 ^ \" can't find dependency \" ^ d2 ^ \" (or these are circularly defined). This in module \" ^ mIntf.mName)\r\n in\r\n let () = check_defs ((List.map (fun d -> (d, [])) undefs) @ defs) in\r\n pub_decls @ scopeVars\r\n\r\nlet link_check_modules (ms:(_module * _module) list):unit =\r\n // check that all module names are unique\r\n List.iter\r\n (fun ({mName = ifName; mIsImpl = ifImpl}, {mName = imName; mIsImpl = imImpl}) ->\r\n if ifName <> imName then err (\"module interface and implementation have different names: \" + ifName + \", \" + imName) else\r\n if ifImpl then err (\"expected module interface, found implementation: \" + ifName) else\r\n if not imImpl then err (\"expected module implementation, found interface: \" + imName) else\r\n if (List.length (List.filter (fun ({mName = x}, _) -> ifName = x) ms) <> 1)\r\n then err (\"more than one module named \" + ifName))\r\n ms;\r\n // For each variable x modified by xM, check that anyone yielding on x imports xM\r\n // For each variable x declared in xM but not modified by xM, check that no one yields on x\r\n List.iter\r\n (fun ({mName = xM; mModifies = xMods; mDecls = xDs}, _) ->\r\n List.iter\r\n (fun ({mName = yM; mYields = yYields}, {mName=_ (* mImports = yImports*) }) ->\r\n List.iter (fun (_, d) ->\r\n match d with\r\n | DStaticGhost (x, _, _, _) ->\r\n (\r\n if List.mem x yYields && not (List.mem x xMods) then\r\n err (\"module \" + yM + \" yields on non-exported variable \" + x)\r\n )\r\n | _ -> ())\r\n xDs;\r\n List.iter (fun x ->\r\n// if List.mem x yYields && not (List.mem xM (yM::yImports)) then\r\n// This branch has no yield (concurrency) support, and the import\r\n// behavior has changed, so for now, we disallow all yields on the\r\n// grounds that we can't check the import sanity.\r\n if List.mem x yYields && true then\r\n err (\"module \" + yM + \" must import \" + xM + \" to yield on variable \" + x))\r\n xMods)\r\n ms)\r\n ms;\r\n // check that definitions are well founded\r\n let _ = List.fold link_check_module [] ms in\r\n ()\r\n\r\nlet sw_reg (w:width) (r:reg): string =\r\n match (w, r) with\r\n | (W32, \"EAX\") -> \"eax\"\r\n | (W32, \"EBX\") -> \"ebx\"\r\n | (W32, \"ECX\") -> \"ecx\"\r\n | (W32, \"EDX\") -> \"edx\"\r\n | (W32, \"ESI\") -> \"esi\"\r\n | (W32, \"EDI\") -> \"edi\"\r\n | (W32, \"EBP\") -> \"ebp\"\r\n | (W32, \"ESP\") -> \"esp\"\r\n | (W16, \"EAX\") -> \"ax\"\r\n | (W16, \"EBX\") -> \"bx\"\r\n | (W16, \"ECX\") -> \"cx\"\r\n | (W16, \"EDX\") -> \"dx\"\r\n | (W8, \"EAX\") -> \"al\"\r\n | (W8, \"EBX\") -> \"bl\"\r\n | (W8, \"ECX\") -> \"cl\"\r\n | (W8, \"EDX\") -> \"dl\"\r\n | _ -> err \"unexpected register\"\r\nlet s_reg (r:reg): string = sw_reg W32 r\r\n\r\nlet seg_reg (r:reg): string =\r\n match r with\r\n// | \"CS\" -> \"cs\"\r\n | \"DS\" -> \"ds\"\r\n | \"SS\" -> \"ss\"\r\n | \"FS\" -> \"fs\"\r\n | \"GS\" -> \"gs\"\r\n | _ -> err \"unexpected segment register\"\r\n\r\nlet simple_w_operand (w:width) (o:operand): string =\r\n match (w, o) with\r\n | (W32, OConst i) -> i\r\n | (_, OReg r) -> sw_reg w r\r\n | _ -> err \"unexpected operand\"\r\nlet simple_operand (o:operand): string = simple_w_operand W32 o\r\n\r\nlet src_operand (ctxt:string) (o:operand): string =\r\n match o with\r\n | OConst i -> i\r\n | OReg r -> s_reg r\r\n | _ -> err \"unexpected operand\"\r\n\r\nlet r_operand (o:operand): string =\r\n match o with\r\n | OReg r -> s_reg r\r\n | _ -> err \"unexpected reg operand\"\r\n\r\nlet addr_operand (o:operand): string =\r\n match o with\r\n (* TODO: check offset and scale *)\r\n (* TODO: 1-byte and 2-byte mems *)\r\n | OConstPtr i -> i\r\n | OOffset (r, i) -> (s_reg r) ^ \" + \" ^ (i)\r\n | OIndex (rb, s, rs, i) -> (s_reg rb) ^ \" + \" ^ (s) ^ \" * \" ^ (s_reg rs) ^ \" + \" ^ (i)\r\n | _ -> err \"unexpected addr operand\"\r\n\r\nlet mem_operand (width:width) (o:operand): string = (string_of_width width) ^ \" ptr [\" ^ (addr_operand o) ^ \"]\"\r\n\r\nlet src_mem_operand (ctxt:string) (width:width) (o:operand): string =\r\n match o with\r\n | OConst _ | OReg _ -> src_operand ctxt o\r\n | OConstPtr _ | OOffset _ | OIndex _ -> mem_operand width o\r\n | _ -> err \"unexpected src_mem operand\"\r\n\r\nlet dest_mem_operand (ctxt:string) (width:width) (o:operand): string =\r\n match o with\r\n | OReg r -> s_reg r\r\n | OConstPtr _ | OOffset _ | OIndex _ -> mem_operand width o\r\n | _ -> err \"unexpected dest_mem operand\"\r\n\r\nlet s_pair (s1:string) (s2:string): string = s1 ^ \", \" ^ s2\r\n\r\nlet bin_operands (ctxt:string) (args:operand list): string =\r\n match args with\r\n | [_; OReg r1; o2] -> s_pair (s_reg r1) (src_operand ctxt o2)\r\n | _ -> err \"unexpected bin operands\"\r\n\r\nlet bin_lock (args:operand list): string =\r\n match args with\r\n | _ when not !check_concurrent -> \"\"\r\n | [_; OReg r1; _] -> \"\"\r\n | _ -> \"lock \"\r\n\r\nlet shift_operands (ctxt:string) (args:operand list): string =\r\n match args with\r\n | [_; OReg r1; OConst i] -> s_pair (s_reg r1) i\r\n | [_; OReg r1; OReg Ecx] -> s_pair (s_reg r1) \"cl\"\r\n | _ -> err \"unexpected shift operands\"\r\n\r\nlet mul_operands (ctxt:string) (args:operand list): string =\r\n (* TODO: operand o3 cannot be a constant *)\r\n match args with\r\n | ([_; o3]) -> src_operand ctxt o3\r\n | _ -> err \"unexpected mul operands\"\r\n\r\nlet div_operands (ctxt:string) (args:operand list): string =\r\n (* TODO: operand o3 cannot be a constant *)\r\n match args with\r\n | [_; o3] -> r_operand o3\r\n | _ -> err \"unexpected div operands\"\r\n\r\nlet unary_operands1 (ctxt:string) (args:operand list): string =\r\n match args with\r\n | [_; o1] -> (dest_mem_operand ctxt W32 o1)\r\n | _ -> err \"unexpected unary operands\"\r\n\r\nlet unary_operands_small (args:operand list): string =\r\n match args with\r\n | [_; OReg r1] -> (sw_reg W8 r1)\r\n | _ -> err \"unexpected small unary operands\"\r\n\r\nlet unary_lock (args:operand list): string =\r\n match args with\r\n | _ when not !check_concurrent -> \"\"\r\n | [_; OReg r1] -> \"\"\r\n | _ -> \"lock \"\r\n\r\nlet lea_operands (ctxt:string) (args:operand list): string =\r\n match args with\r\n | [_; OReg rd; o2] -> s_pair (s_reg rd) (mem_operand W32 o2)\r\n | _ -> err \"unexpected lea operands\"\r\n\r\nlet lea_signed_index_operands (ctxt:string) (args:operand list): string =\r\n match args with\r\n | [_; OReg rd; OReg r1; OExp (Some c1); OReg r2; OConst c2] ->\r\n s_pair (s_reg rd) (\"dword ptr [\" ^ (s_reg r1) ^ \" + \" ^ (c1.ToString()) ^ \" * \" ^ (s_reg r2) ^ \" + \" ^ c2 ^ \"]\")\r\n | _ -> err \"unexpected lea_signed operands\"\r\n\r\nlet load_operands (ctxt:string) (width:width) (args:operand list): string =\r\n match args with\r\n | [_; _; _; OReg rd; o2] -> s_pair (s_reg rd) (mem_operand width o2)\r\n | _ -> err \"unexpected load operands\"\r\n\r\nlet iom_reg_load_operands (ctxt:string) (width:width) (args:operand list): string =\r\n match args with\r\n | [OExp _; OReg rd; o2] -> s_pair (s_reg rd) (mem_operand width o2)\r\n | _ -> err \"unexpected iom_reg_load operands\"\r\n\r\nlet store_operands (ctxt:string) (width:width) (args:operand list): string =\r\n match args with\r\n | [_; _; _; o1; o2] -> s_pair (mem_operand width o1) (simple_w_operand width o2)\r\n | _ -> err \"unexpected store operands\"\r\n\r\nlet idt_store_operands (ctxt:string) (width:width) (args:operand list): string =\r\n match args with\r\n | [OExp _; OExp _; OExp _; o1; o2] -> s_pair (mem_operand width o1) (simple_w_operand width o2)\r\n | _ -> err \"unexpected idt store operands\"\r\n\r\nlet iom_reg_store_operands (ctxt:string) (width:width) (args:operand list): string =\r\n match args with\r\n | [OExp _; o1; o2] -> s_pair (mem_operand width o1) (simple_w_operand width o2)\r\n | _ -> err \"unexpected iom_reg_store operands\"\r\n\r\nlet lidt_operands (ctxt:string) (args:operand list): string =\r\n match args with\r\n | [o] -> \"fword ptr [\" ^ (addr_operand o) ^ \"]\"\r\n | _ -> err \"unexpected lidt operands\"\r\n\r\nlet cmp_operands (ctxt:string) (args:operand list): string =\r\n match args with\r\n (* TODO: o1 cannot be OConst *)\r\n (* TODO: support more cases ? *)\r\n | [_; OReg r1; o2] -> s_pair (s_reg r1) (src_mem_operand ctxt W32 o2)\r\n | [_; o1; OReg r2] -> s_pair (src_mem_operand ctxt W32 o1) (s_reg r2)\r\n | [_; o1; (OConst c2) as o2] -> s_pair (src_mem_operand ctxt W32 o1) (src_operand ctxt o2)\r\n | _ -> err \"unexpected cmp operands\"\r\n\r\nlet cmpxchg_operands (ctxt:string) (args:operand list): string =\r\n match args with\r\n | [o1; OReg r2] -> s_pair (mem_operand W32 o1) (s_reg r2)\r\n | _ -> err \"unexpected operands\"\r\n\r\nlet launch_operands (ctxt:string) (args:operand list): string =\r\n match args with\r\n | [_;_;_;_;_;_;_;_;_] -> \"ebx\" //(s_reg r)\r\n | _ -> err \"unexpected launch operands\"\r\n\r\nlet print_ins (ctxt:string) (i:string) (args:operand list): unit =\r\n let bin s = print_endline (\" \" ^ (bin_lock args) ^ s ^ \" \" ^ (bin_operands ctxt args)) in\r\n let check_over () = print_endline \" jc _?Overflow\" in\r\n // Note: when check_concurrent is true, instructions with multiple memory accesses must be marked \"lock\"\r\n // (currently, these are just the bin_operands and unary_operands instructions whose destination is memory, plus cmpxchg)\r\n match i with\r\n | \"DropTempRegs\" -> ()\r\n | \"Mov\" -> bin \"mov\"\r\n | \"Not\" -> print_endline (\" \" ^ (unary_lock args) ^ \"not \" ^ (unary_operands1 ctxt args))\r\n | \"Add\" -> bin \"add\"\r\n | \"AddCarry\" -> bin \"adc\"\r\n | \"AddChecked\" -> bin \"add\"; check_over ()\r\n | \"Sub\" -> bin \"sub\"\r\n | \"SubChecked\" -> bin \"sub\"; check_over ()\r\n | \"Mul\" -> print_endline (\" mul \" ^ (mul_operands ctxt args))\r\n | \"Mul64\" -> print_endline (\" mul \" ^ (mul_operands ctxt args))\r\n | \"MulChecked\" -> print_endline (\" mul \" ^ (mul_operands ctxt args)); check_over ()\r\n | \"Div\" -> print_endline (\" div \" ^ (div_operands ctxt args))\r\n | \"And\" -> bin \"and\"\r\n | \"Or\" -> bin \"or\"\r\n | \"Xor\" -> bin \"xor\"\r\n | \"Shl\" -> print_endline (\" shl \" ^ (shift_operands ctxt args))\r\n | \"Shr\" -> print_endline (\" shr \" ^ (shift_operands ctxt args))\r\n | \"Rol\" -> print_endline (\" rol \" ^ (shift_operands ctxt args))\r\n | \"Ror\" -> print_endline (\" ror \" ^ (shift_operands ctxt args))\r\n | \"GetCf\" -> print_endline (\" \" ^ (unary_lock args) ^ \"setc \" ^ (unary_operands_small args))\r\n | \"Cmp\" -> print_endline (\" cmp \" ^ (cmp_operands ctxt args))\r\n// TODO | \"Cmpxchg\" -> print_endline (\" lock cmpxchg \" ^ (cmpxchg_operands ctxt args))\r\n | \"KeyboardDataIn8\" -> print_endline \" in al, 060h\"\r\n | \"KeyboardStatusIn8\" -> print_endline \" in al, 064h\"\r\n | \"SerialDbgConfigOut\" -> print_endline \" out dx, al\"\r\n | \"SerialDbgDataOut8\" -> print_endline \" out dx, al\"\r\n | \"SerialDbgStatusOut8\" -> print_endline \" in al, dx\"\r\n(*\r\n | \"SerialDbgDataIn8\" -> print_endline \" in al, dx\"\r\n | \"SerialDbgStatusIn8\" -> print_endline \" in al, dx\"\r\n | \"SampleIn32\" -> print_endline (\" rdrand eax\")\r\n | \"PicOut8\" -> print_endline \" out dx, al\"\r\n | \"PitModeOut8\" -> print_endline \" out 43h, al\"\r\n | \"PitFreqOut8\" -> print_endline \" out 40h, al\"\r\n*)\r\n | \"PciConfigAddrOut32\" -> print_endline \" out dx, eax\"\r\n | \"PciConfigDataOut32\" -> print_endline \" out dx, eax\"\r\n | \"PciConfigDataIn32\" -> print_endline \" in eax, dx\"\r\n | \"DEV_PciConfigDataOut32\" -> print_endline \" out dx, eax\"\r\n | \"DEV_PciConfigDataIn32\" -> print_endline \" in eax, dx\"\r\n(*\r\n | \"RoLoadU8\" ->\r\n print_endline (\" movzx \" ^ (load_operands ctxt W8 args))\r\n | \"RoLoadS8\" ->\r\n print_endline (\" movsx \" ^ (load_operands ctxt W8 args))\r\n | \"RoLoadU16\" ->\r\n print_endline (\" movzx \" ^ (load_operands ctxt W16 args))\r\n | \"RoLoadS16\" ->\r\n print_endline (\" movsx \" ^ (load_operands ctxt W16 args))\r\n | \"RoLoad32\"\r\n | \"SectionLoad\" ->\r\n*)\r\n | \"Load\" -> print_endline (\" mov \" ^ (load_operands ctxt W32 args))\r\n// | \"IomRegLoad\" | \"PciMemLoad32\" ->\r\n// print_endline (\" mov \" ^ (iom_reg_load_operands ctxt W32 args))\r\n | \"VgaTextStore16\" -> print_endline (\" mov \" ^ (store_operands ctxt W16 ((OExp None)::args)))\r\n | \"VgaDebugStore16\" -> print_endline (\" mov \" ^ (store_operands ctxt W16 ((OExp None)::(OExp None)::args)))\r\n(*\r\n | \"IdtStore\" ->\r\n print_endline (\" mov \" ^ (idt_store_operands ctxt W32 args))\r\n | \"IomRegStore\" | \"PciMemStore32\" ->\r\n print_endline (\" mov \" ^ (iom_reg_store_operands ctxt W32 args))\r\n*)\r\n | \"Store\" -> print_endline (\" mov \" ^ (store_operands ctxt W32 args))\r\n //| \"SectionStore\" | \"IomStore\" ->\r\n | \"ghost_IomEnabled\" -> print_endline \" ; instr_ghost_IomEnabled\" // TODO: this is not an instruction\r\n// | \"Lidt\" -> print_endline (\" lidt \" ^ (lidt_operands ctxt args))\r\n | \"Lea\" -> print_endline (\" lea \" ^ (lea_operands ctxt args))\r\n | \"LeaUnchecked\" -> print_endline (\" lea \" ^ (lea_operands ctxt args))\r\n | \"LeaSignedIndex\" -> print_endline (\" lea \" ^ (lea_signed_index_operands ctxt args))\r\n | \"Rdtsc\" -> print_endline (\" rdtsc\")\r\n | \"Launch\" -> print_endline (\" jmp \" ^ (launch_operands ctxt args))\r\n | _ ->\r\n (\r\n let load32 o1 o2 = print_endline (\" mov \" ^ (s_pair (r_operand o1) (mem_operand W32 o2))) in\r\n let store32 o1 o2 = print_endline (\" mov \" ^ (s_pair (mem_operand W32 o1) (simple_w_operand W32 o2))) in\r\n let load8 o1 o2 = print_endline (\" movzx \" ^ (s_pair (r_operand o1) (mem_operand W8 o2))) in\r\n let store8 o1 o2 = print_endline (\" mov \" ^ (s_pair (mem_operand W8 o1) (simple_w_operand W8 o2))) in \r\n match (i, args) with\r\n | (\"DeviceLoad\", [_; _; o1; o2]) -> load32 o1 o2\r\n | (\"DeviceStore\", [_; _; o1; o2 ]) -> store32 o1 o2\r\n | (\"PciMemLoad32\", [_; _; _; o1; o2]) -> load32 o1 o2\r\n | (\"PciMemStore32\", [_; _; _; o1; o2]) -> store32 o1 o2\r\n | (\"ActivateDataSelector\", [_; _; _; OExp _; OExp _; OReg r; OSelector s]) ->\r\n print_endline (\" mov \" ^ (s_pair (seg_reg s) (sw_reg W16 r)))\r\n | (\"LoadGDT\", [_; _; _; OExp _; OExp _; o]) ->\r\n print_endline (\" lgdt fword ptr [\" ^ (addr_operand o) ^ \"]\")\r\n | (\"ReadCR0\", [_; _; OReg r]) -> print_endline (\" mov \" ^ (s_reg r) ^ \", cr0\")\r\n | (\"WriteCR0\", [_; _; OReg r]) -> print_endline (\" mov cr0, \" ^ (s_reg r) )\r\n | (\"WriteCR3\", [_; _; OReg r]) -> print_endline (\" mov cr3, \" ^ (s_reg r) ) \r\n | (\"IoMemAddrRead\", [_;o1;o2]) -> load8 o1 o2\r\n | (\"IoMemAddrWrite\", [_;o1;o2]) -> store8 o1 o2\r\n | _ -> err (\"instruction \" ^ i ^ \" : unsupported instruction or operands\")\r\n )\r\n\r\nlet print_ins_group (inss:(string * string * operand list) list): unit =\r\n let inss = List.map (fun (c, i:string, a) ->\r\n if not (i.StartsWith(\"instr_\")) then err (\"unsupported instruction: \" + i) else\r\n (c, i.Substring(\"instr_\".Length), a)) inss in\r\n match inss with\r\n | [(ctxt, i, args)] -> print_ins ctxt i args\r\n | [(_, \"SubNoFlags\", [_; OReg \"ESP\"; OConst \"4\"]);\r\n (_, \"StoreStack\", [_; _; _; OOffset (\"ESP\", \"0\"); OReg r])] ->\r\n print_endline (\" push \" ^ (s_reg r))\r\n | [(_, \"Load\", [_; _; _; OTmpReg \"TMP1\"; omem]);\r\n (_, \"Sub\", [_; OReg r; OTmpReg \"TMP1\"])] ->\r\n // TODO: check for yields\r\n print_endline (\" sub \" ^ (s_reg r) ^ \", \" ^ (mem_operand W32 omem))\r\n | [(_, \"Load\", [_; _; _; OTmpReg \"TMP1\"; omem]);\r\n (ctxt, \"Cmp\", [_; OTmpReg \"TMP1\"; (OReg _ | OConst _) as o2])] ->\r\n print_endline (\" cmp \" ^ (mem_operand W32 omem) ^ \", \" ^ (src_operand ctxt o2))\r\n | _ -> err (\"unrecognized instruction group: \" ^ (String.concat \", \" (List.map (fun (_, i, _) -> i) inss)))\r\n\r\nlet rec print_stmt_group (stmts:(insCtxt * loc * stmt) list): unit =\r\n let rec get_ins_group stmts =\r\n match stmts with\r\n | [] -> []\r\n | ((ctxt, varMap), l, SInline (_, p, args, []))::tl ->\r\n (ctxt, p, (List.map (operand_of_exp varMap) args))::(get_ins_group tl)\r\n | (_, l, _)::_ -> err (\"unrecognized instruction at location \" ^ (string l))\r\n let print_yielded stmts =\r\n match stmts with\r\n | [] -> ()\r\n | [((ctxt, _), _, SGoto l)] ->\r\n print_endline (\" jmp \" ^ (label ctxt l))\r\n | [ins1; ins2; ins3; ins4; (_, l, SReturn)] ->\r\n (\r\n match get_ins_group [ins1; ins2; ins3; ins4] with\r\n | [(_, \"instr_LoadStack\", [_; _; _; OTmpReg \"TMP1\"; OOffset (\"ESP\", \"0\")]);\r\n (_, \"instr_AddNoFlags\", [_; OReg \"ESP\"; OConst \"4\"]);\r\n (_, \"instr_Ret\", _);\r\n (_, \"instr_DropTempRegs\", _)] when not !x64 ->\r\n print_endline \" ret\"\r\n | inss -> err (\"at location \" ^ (string l) ^ \": incorrect (32-bit) ret: \" ^ (String.concat \", \" (List.map (fun (_, i, _) -> i) inss)))\r\n )\r\n\r\n | [ins1; ins2; ins3; ins4; ins5; (_, l, SReturn)] ->\r\n (\r\n match get_ins_group [ins1; ins2; ins3; ins4; ins5] with\r\n //64 bit return\r\n | [(_, \"instr_LoadStack\", [_; _; _; OTmpReg \"TMP1\"; OOffset (\"ESP\", \"0\")]);\r\n (_, \"instr_LoadStack\", [_; _; _; OTmpReg \"TMP2\"; OOffset (\"ESP\", \"4\")]);\r\n (_, \"instr_AddNoFlags\", [_; OReg \"ESP\"; OConst \"8\"]);\r\n (_, \"instr_Ret\", _);\r\n (_, \"instr_DropTempRegs\", _)] when !x64 ->\r\n print_endline \" ret\"\r\n | inss -> err (\"at location \" ^ (string l) ^ \": incorrect (64-bit) ret: \" ^ (String.concat \", \" (List.map (fun (_, i, _) -> i) inss)))\r\n )\r\n\r\n// TODO: | [(_, _, SInline (\"instr_IRet\", [])); (_, _, SIReturn)] -> print_endline \" iretd\"\r\n | [((ctxt, _), _, SIfJcc (_, jcc, l))] ->\r\n (\r\n // REVIEW: maybe redesign the AST rather than matching on strings?\r\n match jcc with\r\n | \"Je\" | \"Jne\" | \"Jbe\" | \"Jb\" | \"Jae\" | \"Ja\" ->\r\n print_endline (\" \" ^ (jcc.ToLower ()) ^ \" \" ^ (label ctxt l))\r\n | _ -> err (\"unexpected conditional jump: \" + jcc)\r\n )\r\n | [ins1; ins2; ins3; (_, l, SCall (_, p, _))] ->\r\n (\r\n match get_ins_group [ins1; ins2; ins3] with\r\n | [(_, \"instr_SubNoFlags\", [_; OReg \"ESP\"; OConst \"4\"]);\r\n (_, \"instr_MovNextEip32\", [_; OTmpReg \"TMP1\"]);\r\n (_, \"instr_StoreStack\", [_; _; _; OOffset (\"ESP\", \"0\"); OTmpReg \"TMP1\"]);\r\n ] when not !x64 ->\r\n print_endline (\" call \" ^ (proc_name p))\r\n | inss -> err (\"at location \" ^ (string l) ^ \": incorrect (32-bit) call: \" ^ (String.concat \", \" (List.map (fun (_, i, _) -> i) inss)))\r\n )\r\n\r\n //64 bit call\r\n | [ins1; ins2; ins3; ins4; (_, l, SCall (_, p, _))] ->\r\n (\r\n match get_ins_group [ins1; ins2; ins3; ins4] with\r\n | [(_, \"instr_SubNoFlags\", [_; OReg \"ESP\"; OConst \"8\"]);\r\n (_, \"instr_MovNextEip64\", [_; OTmpReg \"TMP1\"; OTmpReg \"TMP2\"]);\r\n (_, \"instr_StoreStack\", [_; _; _; OOffset (\"ESP\", \"0\"); OTmpReg \"TMP1\"]);\r\n (_, \"instr_StoreStack\", [_; _; _; OOffset (\"ESP\", \"4\"); OTmpReg \"TMP2\"]);\r\n ] when !x64 ->\r\n print_endline (\" call \" ^ (proc_name p))\r\n | inss -> err (\"at location \" ^ (string l) ^ \": incorrect (64-bit) call: \" ^ (String.concat \", \" (List.map (fun (_, i, _) -> i) inss)))\r\n )\r\n\r\n | (_, l, _)::_ ->\r\n try print_ins_group (get_ins_group stmts)\r\n with Err e -> err (\"at location \" ^ (string l) ^ \": \" ^ (string e))\r\n in\r\n match stmts with\r\n | [] -> ()\r\n | [((ctxt, _), _, SLabel l)] -> print_endline (\" \" ^ label ctxt l ^ \":\")\r\n | (_, _, SYield _)::tl -> print_yielded tl\r\n | _ when not !check_concurrent -> print_yielded stmts\r\n | (_, l, _)::_ -> err (\"missing yield before instruction at location \" ^ (string l))\r\n\r\n// expand all inline procedure calls, and eliminate ghost operations\r\nlet rec expand_inline_calls (ic:insCtxt) (InlineMap inlines) (l:loc, s:stmt):(insCtxt * loc * stmt) list list =\r\n match s with\r\n | SLabel _ | SGoto _ | SReturn | SIReturn | SYield _ | SIfJcc _ | SCall _ -> [[(ic, l, s)]]\r\n | SAssert _ | SSplit | SAssign _ | SIfGhost _ | SForallGhost _ | SExistsGhost _ -> []\r\n | SGroup b -> [List.concat (List.collect (expand_inline_calls ic (InlineMap inlines)) b)]\r\n | SInline (_, p, _, []) when p.StartsWith(\"instr_\") -> [[(ic, l, s)]]\r\n | SInline (_, p, _, []) when p.StartsWith(\"construct##\") -> []\r\n | SInline (_, p, _, []) when p.StartsWith(\"destruct##\") -> []\r\n | SInline (_, p, args, _) ->\r\n let (_, varMap) = ic in\r\n let (inline_inlines, inline_ic, stmts) =\r\n try List.assoc p inlines (List.map (operand_of_exp varMap) args)\r\n with :? System.Collections.Generic.KeyNotFoundException as x ->\r\n err (\"at location \" ^ (string l) ^ \": procedure \" ^ p ^ \" not found\")\r\n in\r\n List.collect (expand_inline_calls inline_ic inline_inlines) stmts\r\n\r\nlet print_decl (inlines:inlineMap) (_, d:decl): unit =\r\n match d with\r\n | DType _ -> ()\r\n | DFunDecl (x, None, _, Some (EInt i), None, _) when BigInt.Zero <= i && i < (BigInt.Parse \"4294967296\") ->\r\n print_endline (\"?_\" ^ x ^ \" EQU \" ^ ((string)i))\r\n | DFunDecl _ -> ()\r\n | DStatic x ->\r\n print_endline \".data\";\r\n print_endline \"align 4\";\r\n print_endline (\"?_?ADDR__\" ^ x ^ \" DD 0\")\r\n | DStaticGhost _ -> ()\r\n | DProc (p, pk, Inline, ps, _, _, Some (_, b)) -> ()\r\n | DProc (p, _, Outline, _, _, _, Some (_, b)) ->\r\n print_endline \".code\";\r\n print_endline \"align 16\";\r\n print_endline ((proc_name p) ^ \" proc\");\r\n let stmts = List.collect (expand_inline_calls (p, []) inlines) b in\r\n List.iter print_stmt_group stmts;\r\n print_endline ((proc_name p) ^ \" endp\")\r\n | DProc (_, _, _, _, _, _, None) -> ()\r\n\r\n#nowarn \"40\"\r\nlet rec print_modules (ghost_procs:string list) (InlineMap inlines) (p:(_module * _module) list): unit =\r\n let find_all_procs (_, d:decl) =\r\n match d with\r\n | DType _ | DFunDecl _ | DStatic _ | DStaticGhost _ -> []\r\n | DProc (x, pk, _, _, _, _, _) -> [x]\r\n let find_ghost_procs (_, d:decl) =\r\n match d with\r\n | DType _ | DFunDecl _ | DStatic _ | DStaticGhost _ -> []\r\n | DProc (x, pk, _, _, _, _, _) -> (match pk with Implementation -> [] | Procedure (PReal, _) -> [] | Procedure (PGhost, _) -> [x])\r\n let add_inline (ghost_procs:string list) (_, d:decl):inlinePreMap =\r\n match d with\r\n | DType _ | DFunDecl _ | DStatic _ | DStaticGhost _ -> []\r\n | DProc (_, _, _, _, _, _, None) -> []\r\n | DProc (p, pk, inlining, ps, _, _, Some (_, b)) ->\r\n [(p, fun args ->\r\n match inlining with\r\n | Inline ->\r\n let ctxt = gensym () in\r\n let varMap = List.zip (List.map (fun (x, _, _) -> x) ps) args in\r\n let stmts = if List.mem p ghost_procs then [] else b in\r\n ((ctxt, varMap), stmts)\r\n | Outline -> err (\"cannot inline \" ^ p))]\r\n in\r\n match p with\r\n | [] -> ()\r\n | (intf, impl)::ms ->\r\n let intf_procs = List.collect find_all_procs intf.mDecls in\r\n let intf_ghost_procs = (List.collect find_ghost_procs intf.mDecls) @ ghost_procs in\r\n let impl_ghost_procs = (List.collect find_ghost_procs impl.mDecls) @ intf_ghost_procs in\r\n let inft_pre_inlines = List.collect (add_inline intf_ghost_procs) intf.mDecls in\r\n let impl_pre_inlines = List.collect (add_inline impl_ghost_procs) impl.mDecls in\r\n let pre_inlines = inft_pre_inlines @ impl_pre_inlines in\r\n let rec lazy_impl_inlines = lazy (List.map (fun (x, f) ->\r\n (x, fun args -> let (ic, ss) = f args in (InlineMap (lazy_impl_inlines.Force() @ inlines), ic, ss))) pre_inlines) in\r\n let impl_inlines = lazy_impl_inlines.Force() in\r\n let intf_inlines = List.filter (fun (x, _) -> List.mem x intf_procs) impl_inlines in\r\n print_endline (\";; BEGIN_MODULE: \" + impl.mName);\r\n List.iter (print_decl (InlineMap (intf_inlines @ inlines))) intf.mDecls;\r\n List.iter (print_decl (InlineMap (impl_inlines @ inlines))) impl.mDecls;\r\n print_endline (\";; END_MODULE: \" + impl.mName);\r\n print_modules intf_ghost_procs (InlineMap (intf_inlines @ inlines)) ms\r\n\r\nlet rec print_program (inlines:inlineMap) (p:(_module * _module) list): unit =\r\n //if not !x64 then (\r\n print_endline \".686p\";\r\n print_endline \".model flat\";\r\n //);\r\n print_modules [] inlines p;\r\n print_endline \"end\";\r\n ()\r\n\r\n(* Each command-line argument is the name of a module *)\r\n(* Each module M must contain two files: M_i.bpl and M.bpl *)\r\nlet main (argv) =\r\n let print_error_prefix () = print_endline (\"error near line \" + (string !line) + \" of file \" + !file) in\r\n try\r\n (\r\n let mods_rev = ref ([]:(bool * string) list) in\r\n let link = ref false in\r\n let outfile = ref (None:string option) in\r\n let symdiff_file = ref (None:string option) in\r\n let distinctLinearInts = ref false in\r\n let add_mod (trusted:bool) (s:string) = mods_rev := (trusted, s)::(!mods_rev) in \r\n Arg.parse_argv (ref 0) argv\r\n [\r\n (\"-trusted\" , Arg.String (add_mod true), \"Trusted module\");\r\n (\"-verify\" , Arg.Clear link , \"Verify single module\");\r\n (\"-link\" , Arg.Set link , \"Link modules together and generate code\");\r\n (\"-symdiffok\" , Arg.Set symdiff_allow, \"Allow relational specifications for symdiff\");\r\n (\"-symdiffms\" , Arg.String (fun s -> symdiff_allow := true; symdiff := true; symdiff_file := Some s), \"Generate symdiff mutual summary file for relational checks\");\r\n (\"-distinctLinearInts\", Arg.Set distinctLinearInts, \"Use axioms ensuring distinctness of linear integers (sound, but may be slow)\");\r\n (\"-out\" , Arg.String (fun s -> outfile := Some s) , \"Specify output file\");\r\n (\"-def\" , Arg.String (fun s -> Lex.macros := Map.add s [] !Lex.macros), \"Define a macro (as an empty string) for use by ifdef/ifndef\");\r\n (\"-x64\" , Arg.Set x64 , \"Compile 64 bit binaries\");\r\n ]\r\n (add_mod false)\r\n \"error parsing arguments\";\r\n let mods = List.rev (!mods_rev) in\r\n let parse_file comment name =\r\n print_endline (comment + \"parsing \" + name);\r\n file := name;\r\n line := 1;\r\n Parse.start Lex.token (Lexing.from_channel (open_in name)) in\r\n if !link then\r\n let (_, modIfcs, modImps) = List.foldBack (fun (_, x) (b, l1, l2) ->\r\n (not b, (if b then l1 else x::l1), (if b then x::l2 else l2))) mods (true, [], []) in\r\n let modIfcImps = List.combine modIfcs modImps in\r\n let modules = List.map (fun (xIfc, xImp) -> (parse_file \";;\" xIfc, parse_file \";;\" xImp)) modIfcImps in\r\n link_check_modules modules;\r\n print_program (InlineMap []) modules\r\n else\r\n (match !symdiff_file with None -> () | Some s -> symdiff_writer := ((new System.IO.StreamWriter(new System.IO.FileStream(s, System.IO.FileMode.Create))):>System.IO.TextWriter));\r\n let stream =\r\n match !outfile with\r\n | None -> System.Console.Out\r\n | Some s -> (new System.IO.StreamWriter(new System.IO.FileStream(s, System.IO.FileMode.Create))):>System.IO.TextWriter in\r\n if (!distinctLinearInts) then\r\n (\r\n stream.WriteLine (\"function {:builtin \\\"MapConst\\\"} MapConstBool(bool) : [int]bool;\");\r\n stream.WriteLine (\"function {:inline} {:linear \\\"our\\\"} LinearIntDistinctness(x:int) : [int]bool { MapConstBool(false)[x := true] }\")\r\n );\r\n let xms_rev =\r\n List.fold\r\n (fun xms_rev (_, x:string) ->\r\n if x.StartsWith(\"/trustedBoogie:\") then\r\n let x = x.Substring(\"/trustedBoogie:\".Length) in\r\n let f = new System.IO.StreamReader(new System.IO.FileStream(x, System.IO.FileMode.Open, System.IO.FileAccess.Read)) in\r\n stream.WriteLine (\"#line 1 \" + x);\r\n stream.WriteLine (f.ReadToEnd());\r\n f.Close ();\r\n xms_rev\r\n else\r\n let m = parse_file \"//\" x in\r\n (x, m)::xms_rev)\r\n []\r\n mods in\r\n let ms_rev = List.map snd xms_rev in\r\n (match ms_rev with\r\n | [] -> ()\r\n | {mIsImpl = false}::_ -> ()\r\n | ({mName = imName; mIsImpl = true} as m)::({mName = ifName; mIsImpl = false} as i)::ifs when imName = ifName ->\r\n check_module (List.rev ifs) i m\r\n | _ -> err \"expected last file to be interface, or last two files to be interface/implementation\");\r\n stream.WriteLine (\"#line 1 fake entry point\");\r\n let publics = List.collect (fun m -> if m.mIsImpl then [] else m.mDecls) ms_rev in\r\n let impls = List.collect (fun m -> if m.mIsImpl then m.mDecls else []) ms_rev in\r\n let all_vars = List.collect (fun (_, d) -> match d with DStaticGhost (x, _, _, _) -> [x] | _ -> []) publics in\r\n let all_typedefs = List.collect (fun (_, d) -> match d with DType (x, _, _, Some _) -> [x] | _ -> []) impls in\r\n let all_procs = List.collect (fun (_, d) ->\r\n match d with DProc ((x, Procedure _, _, _, _, _, _) as p) -> [(x, p)] | _ -> []) (publics @ impls) in\r\n let ctxt x =\r\n {\r\n all_vars = (if !check_concurrent then all_vars else []);\r\n all_typedefs = all_typedefs;\r\n all_procs = all_procs;\r\n publics = publics;\r\n print_out = stream;\r\n cur_loc = ref (x, 1);\r\n cur_indent = ref \"\";\r\n } in\r\n// TODO: (if not !symdiff then emit_entry_point { print_out = stream; cur_loc = ref (\"fake entry point\", 1); cur_indent = ref \"\"; } publics);\r\n stream.WriteLine(\"function {:linear \\\"our\\\"} OurCollector(x:[int]bool):[int]bool { x }\");\r\n List.iter (fun (x, m) ->\r\n (if !symdiff then\r\n symdiff_globals := (List.collect (fun (_, d) ->\r\n match d with DStaticGhost (x, t, lin, _) -> [(x, t, lin)] | _ -> []) (List.collect (fun m -> m.mDecls) (List.rev ms_rev)));\r\n symdiff_consts := (List.collect (fun (_, d) ->\r\n match d with DFunDecl (x, None, _, _, _, _) -> [x] | _ -> []) (List.collect (fun m -> m.mDecls) (List.rev ms_rev))));\r\n stream.WriteLine (\"#line 1 \" + x);\r\n emit_module (ctxt x) m)\r\n (List.rev xms_rev);\r\n (if !symdiff then (!symdiff_writer).Close ());\r\n stream.Close ()\r\n )\r\n with\r\n | (Err s) as x -> (print_endline \"error:\"; print_endline s; print_endline (x.ToString ()); exit 1)\r\n | ParseErr x -> (print_error_prefix (); print_endline x; exit 1)\r\n | :? System.ArgumentException as x -> (print_error_prefix (); print_endline (x.ToString ()); exit 1)\r\n | Failure x -> (print_error_prefix (); print_endline x; exit 1)\r\n | x -> (print_endline (x.ToString ()); exit 1)\r\n;;\r\n\r\n(* TODO: check that procedure implementations are correctly placed and not duplicated? *)\r\n(* TODO: check that no procedures are recursive, even if they aren't used (e.g. readField) *)\r\n\r\nlet () = main (System.Environment.GetCommandLineArgs ())\r\n\r\n" }, { "path": "ironclad-apps/tools/BoogieAsm/makefile", "content": "#\r\n# Copyright (c) 2007 Microsoft Corporation. All rights reserved.\r\n#\r\n\r\nBUILD = ..\\fsharp\r\nFSC = $(BUILD)\\fsc -g\r\nFSLEX = $(BUILD)\\fslex\r\nFSYACC = $(BUILD)\\fsyacc\r\nCORE = .\r\n\r\nCSC = %SystemRoot%\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe\r\nCSC0 = ..\\..\\..\\base\\build-private\\v4.0.30319\\csc.exe\r\nCSC1 = ..\\..\\..\\base\\build-private\\v4.0.30319-Windows8.1\\csc.exe\r\n\r\nSRC = \\\r\n\t$(CORE)\\ast.fs \\\r\n\t$(CORE)\\parse_util.fs \\\r\n\t$(OBJ)\\parse.fs \\\r\n\t$(OBJ)\\lex.fs \\\r\n\t$(CORE)\\emit_bpl.fs \\\r\n\t$(CORE)\\main.fs \\\r\n\r\nall: $(OBJ) $(BIN) $(BIN)\\boogieasm.exe $(BIN)\\symdiffmerge.exe\r\n\r\n$(OBJ):\r\n\tmd $(OBJ)\r\n\r\n$(BIN):\r\n\tmd $(BIN)\r\n\r\n$(OBJ)\\lex.fsi $(OBJ)\\lex.fs: $(CORE)\\lex.fsl\r\n\t$(FSLEX) $(CORE)\\lex.fsl -o $(OBJ)\\lex.fs\r\n\r\n$(OBJ)\\parse.fsi $(OBJ)\\parse.fs: $(CORE)\\parse.fsy\r\n\t$(FSYACC) -v $(CORE)\\parse.fsy -o $(OBJ)\\parse.fs\r\n\r\n$(BIN)\\boogieasm.exe: $(SRC)\r\n\t$(FSC) --standalone --mlcompatibility -O $(SRC) -o $(BIN)\\boogieasm.exe -r FSharp.PowerPack.dll\r\n\r\n$(BIN)\\symdiffmerge.exe: SymdiffMerge.cs\r\n\tif exist $(CSC). ($(CSC) /debug+ /out:$(BIN)\\symdiffmerge.exe SymdiffMerge.cs.) else ($(CSC0) /debug+ /out:$(BIN)\\dafnycc.exe SymdiffMerge.cs.)\r\n\r\nclean:\r\n\tdel /q $(BIN)\\boogieasm.exe\r\n\tdel /q $(OBJ)\\*.fs\r\n" }, { "path": "ironclad-apps/tools/BoogieAsm/makefile.fs", "content": "#light\r\nmodule MakeBoogieAsm\r\n\r\nopen Def\r\n\r\nlet env = Def.env.Cd @\"tools\\boogieasm\"\r\n\r\nlet obj = Def.obj +/ @\"boogieasm\"\r\nlet bin = Def.bin +/ @\"boogieasm\"\r\n\r\nenv.Dep \"all\" <| [bin+/\"boogieasm.exe\"] <| fun () -> ()\r\nenv.Dep obj <| [] <| fun () -> env.Mkdir obj\r\nenv.Dep bin <| [] <| fun () -> env.Mkdir bin\r\n\r\nenv.Fslex (obj+/\"lex.fs\") [obj] [] [\"lex.fsl\"]\r\nenv.Fsyacc (obj+/\"parse.fs\") [obj] [] [\"parse.fsy\"]\r\nenv.Fsc (bin+/\"boogieasm.exe\") [bin]\r\n (split \"--standalone --mlcompatibility -O -r FSharp.PowerPack.dll\")\r\n [\"ast.fs\"; \"parse_util.fs\"; obj+/\"parse.fs\"; obj+/\"lex.fs\"; \"main.fs\"]\r\n\r\n" }, { "path": "ironclad-apps/tools/BoogieAsm/nubuild-manifest.txt", "content": "dependency ast.fs\ndependency emit_bpl.fs\ndependency lex.fsl\ndependency main.fs\ndependency makefile\ndependency makefile.fs\ndependency parse.fsy\ndependency parse_util.fs\ndependency SymdiffMerge.cs\noutput boogieasm.exe\noutput symdiffmerge.exe\n" }, { "path": "ironclad-apps/tools/BoogieAsm/parse.fsy", "content": "%{\r\n\r\nopen Ast;;\r\nopen Parse_util;;\r\nopen Microsoft.FSharp.Math;;\r\n\r\nlet rec type_id (t:typ):id =\r\n match t with\r\n | TInt -> \"int\"\r\n | TBool -> \"bool\"\r\n | TReal -> \"real\"\r\n | TMap (t1, t2) -> \"__ARR1_\" + (type_id t1) + \"__ARR2_\" + (type_id t2) + \"__ARR3_\"\r\n | TName x -> \"__NAME_\" + x\r\nlet option_type_id (t:typ):id = \"__OPTION_\" + (type_id t)\r\n\r\nlet maybe_relation (e:exp):(is_relation * exp) =\r\n match e with EOp ((Uop \"relation\"), [e1]) -> (IsRel, e1) | _ -> (NotRel, e)\r\n\r\n%}\r\n\r\n%start start\r\n%type <_module> start\r\n\r\n%token UID\r\n%token LID\r\n%token DUID\r\n%token DLID\r\n%token QUID\r\n%token QLID\r\n%token SEGNAME\r\n%token REGNAME\r\n%token LITINT\r\n%token LITREAL\r\n%token LITBV32\r\n%token LITBOOL\r\n%token SEMI LPAREN RPAREN LBRACKET RBRACKET BAR DOT HASH\r\n%token LT GT EQ BANG COMMA LE GE EQEQ NE PLUS MINUS STAR SLASH DIV MOD AMPAMP BARBAR INT REAL BOOL\r\n%token HAVOC OLD COLONCOLON EQEQGT LTEQEQGT LTLT GTGT\r\n%token LEFT RIGHT RELATION PUBLIC\r\n%token EAX EBX ECX EDX ESI EDI EBP ESP\r\n%token OPNREG OPNMEM IS THEN ELSE LET IN LINEAR SPLIT MY ATOMIC STABLE GHOST\r\n%token TYPE VAR CONST READONLY FUNCTION AXIOM PROCEDURE IMPLEMENTATION STATIC MODULE INTERFACE IMPORT\r\n%token CALL RETURN IRETURN IF GOTO ASSERT INVARIANT COLON COLONEQ YIELD LBRACE RBRACE\r\n%token RETURNS REQUIRES ENSURES MODIFIES\r\n%token FORALL EXISTS LAMBDA\r\n\r\n%token EOF\r\n\r\n/* Precedence declarations. */\r\n\r\n%right LET IN IF THEN ELSE\r\n%left LTEQEQGT\r\n%right EQEQGT\r\n%left AMPAMP BARBAR\r\n%left LT GT LE GE EQEQ NE IS\r\n%left PLUS MINUS\r\n%left STAR SLASH DIV MOD\r\n%right BANG\r\n%left LPAREN RPAREN LBRACKET RBRACKET DOT\r\n\r\n%%\r\n\r\nstart:\r\n| MODULE INTERFACE AnyId Imports Modifies Yields LBRACE Decls RBRACE EOF { {mName = $3; mIsImpl = false; mModifies = $5; mYields = $6; mDecls = $8} }\r\n| MODULE IMPLEMENTATION AnyId LBRACE Decls RBRACE EOF { {mName = $3; mIsImpl = true; mModifies = []; mYields = []; mDecls = $5} }\r\n| MODULE INTERFACE AnyId Imports Modifies Yields Decls EOF { {mName = $3; mIsImpl = false; mModifies = $5; mYields = $6; mDecls = $7} }\r\n| MODULE IMPLEMENTATION AnyId Decls EOF { {mName = $3; mIsImpl = true; mModifies = []; mYields = []; mDecls = $4} }\r\n\r\nID\r\n : LID { $1 }\r\n | UID { $1 }\r\n\r\nType\r\n : INT { TInt }\r\n | BOOL { TBool }\r\n | REAL { TReal }\r\n | LBRACKET Type RBRACKET Type { TMap ($2, $4) }\r\n | AnyId { TName $1 }\r\n | LTLT Type GTGT { TName (option_type_id $2) }\r\n\r\nTriggers\r\n : { [] }\r\n | LBRACE Exps RBRACE Triggers { $2::$4 }\r\n\r\nExp\r\n : LPAREN Exp RPAREN { $2 }\r\n | IF Exp THEN Exp ELSE Exp { EOp (Cond, [$2; $4; $6]) }\r\n | LET Formal COLONEQ Exp IN Exp { EOp (Subscript, [EQuant (Lambda, [$2], [], $6); $4]) }\r\n | Exp LTEQEQGT Exp { EOp (Bop \"<==>\", [$1; $3]) }\r\n | Exp EQEQGT Exp { EOp (Bop \"==>\", [$1; $3]) }\r\n | Exp AMPAMP Exp { EOp (Bop \"&&\", [$1; $3]) }\r\n | Exp BARBAR Exp { EOp (Bop \"||\", [$1; $3]) }\r\n | Exp EQEQ Exp { EOp (Bop \"==\", [$1; $3]) }\r\n | Exp NE Exp { EOp (Bop \"!=\", [$1; $3]) }\r\n | Exp LT Exp { EOp (Bop \"<\", [$1; $3]) }\r\n | Exp GT Exp { EOp (Bop \">\", [$1; $3]) }\r\n | Exp LE Exp { EOp (Bop \"<=\", [$1; $3]) }\r\n | Exp GE Exp { EOp (Bop \">=\", [$1; $3]) }\r\n | Exp PLUS Exp { EOp (Bop \"+\", [$1; $3]) }\r\n | Exp MINUS Exp { EOp (Bop \"-\", [$1; $3]) }\r\n | Exp STAR Exp { EOp (Bop \"*\", [$1; $3]) }\r\n | Exp SLASH Exp { EOp (Bop \"/\", [$1; $3]) }\r\n | Exp DIV Exp { EOp (Bop \" div \", [$1; $3]) }\r\n | Exp MOD Exp { EOp (Bop \" mod \", [$1; $3]) }\r\n | Exp IS AnyId { EApply (\"is#\" + $3, [$1]) }\r\n | LPAREN MINUS Exp RPAREN { EOp (Uop \"-\", [$3]) }\r\n | BANG Exp { EOp (Uop \"!\", [$2]) }\r\n | LPAREN FORALL Formals COLONCOLON Triggers Exp RPAREN { EQuant (Forall, $3, $5, $6) }\r\n | LPAREN EXISTS Formals COLONCOLON Triggers Exp RPAREN { EQuant (Exists, $3, $5, $6) }\r\n | LPAREN LAMBDA Formals COLONCOLON Exp RPAREN { EQuant (Lambda, $3, [], $5) }\r\n | Exp LBRACKET Exp RBRACKET { EOp (Subscript, [$1; $3]) }\r\n | Exp LBRACKET Exp COLONEQ Exp RBRACKET { EOp (Update, [$1; $3; $5]) }\r\n | Exp DOT AnyId { EApply (\".\" + $3, [$1]) }\r\n | LET LTLT Type GTGT Formal COLONEQ Exp IN Exp\r\n {\r\n let (x, tx) = $5 in\r\n let o = option_type_id $3 in\r\n let ox = option_type_id tx in\r\n EOp (Cond, [EApply (\"is#\" + ox + \"_None\", [$7]); EApply (o + \"_None\", []);\r\n EOp (Subscript, [EQuant (Lambda, [$5], [], $9); EApply (\".\" + ox + \"_Value\", [$7])])])\r\n }\r\n | LTLT Type GTGT LPAREN Exp RPAREN { let o = option_type_id $2 in EApply (o + \"_Some\", [$5]) }\r\n | LTLT Type GTGT LPAREN RPAREN { let o = option_type_id $2 in EApply (o + \"_None\", []) }\r\n | Exp DOT LTLT Type GTGT { let o = option_type_id $4 in EApply (\".\" + o + \"_Value\", [$1]) }\r\n | LITINT { EInt $1 }\r\n | LITREAL { EReal $1 }\r\n | LITBV32 { EBv32 $1 }\r\n | LITBOOL { EBool $1 }\r\n | OLD LPAREN Exp RPAREN { EOp (Uop \"old\", [$3]) }\r\n | LEFT LPAREN Exp RPAREN { EOp (Uop \"left\", [$3]) }\r\n | RIGHT LPAREN Exp RPAREN { EOp (Uop \"right\", [$3]) }\r\n | RELATION LPAREN Exp RPAREN { EOp (Uop \"relation\", [$3]) }\r\n | PUBLIC LPAREN Exp RPAREN { EOp (Uop \"relation\", [EOp (Bop \"==\", [EOp (Uop \"left\", [$3]); EOp (Uop \"right\", [$3])])]) } \r\n | AnyId LPAREN Exps RPAREN { EApply ($1, $3) }\r\n | AnyId HASH AnyId LPAREN Exps RPAREN { EApply ($1 + \"#\" + $3, $5) }\r\n | AnyId HASH HASH AnyId LPAREN Exps RPAREN { EApply ($1 + \"##\" + $4, $6) }\r\n | REAL LPAREN Exp RPAREN { EOp (Uop \"real\", [$3]) }\r\n | INT LPAREN Exp RPAREN { EOp (Uop \"int\", [$3]) }\r\n | AnyId { EVar $1 }\r\n | SEGNAME { EVar $1 }\r\n | REGNAME { EVar $1 }\r\nExps\r\n : { [] }\r\n | Exp { [$1] }\r\n | Exp COMMA Exps { $1::$3 }\r\nAnyId\r\n : ID { $1 }\r\n | DUID { $1 }\r\n | DLID { $1 }\r\n | QUID { $1 }\r\n | QLID { $1 }\r\nAnyIds\r\n : { [] }\r\n | AnyId { [$1] }\r\n | AnyId COMMA AnyIds { $1::$3 }\r\nFunDeclId\r\n : AnyId { $1 }\r\n | DOT AnyId { \".\" ^ $2 }\r\n\r\nParCalls\r\n : { [] }\r\n | BAR LID LPAREN Exps RPAREN ParCalls { ($2, $4)::$6 }\r\nStmt\r\n : ID COLON { ($2, SLabel $1) }\r\n | GOTO ID SEMI { ($1, SGoto $2) }\r\n | RETURN SEMI { ($1, SReturn) }\r\n | IRETURN SEMI { ($1, SIReturn) }\r\n | LBRACE COLON Block COLON RBRACE { ($2, SGroup $3) }\r\n | IF LPAREN Exp RPAREN LBRACE Block RBRACE\r\n {\r\n match ($3, $6) with\r\n | (EApply (f, [EApply (\".efl\", [EVar x])]), [(_, SGoto l)]) -> ($1, SIfJcc (x, f, l))\r\n | _ -> ($1, SIfGhost ($3, $6))\r\n }\r\n | FORALL LocalFormals COLONCOLON Triggers Exp LBRACE ProcDecls Block RBRACE\r\n {\r\n let decls = List.map (fun (x, t, lin) ->\r\n match lin with Non -> (x, t) | Lin _ -> err \"cannot declare linear variable in forall statement\") $7 in\r\n ($1, SForallGhost ($2, $4, $5, decls, $8))\r\n }\r\n | EXISTS LocalFormals COLONCOLON Triggers Exp SEMI { ($1, SExistsGhost ($2, $4, $5)) }\r\n | INVARIANT Exp SEMI { ($1, let (r, e) = maybe_relation $2 in SAssert (IsInv r, e)) }\r\n | ASSERT Exp SEMI { ($1, SAssert (NotInv, $2)) }\r\n | ASSERT LBRACE SPLIT RBRACE LITBOOL SEMI { ($1, if $5 then SSplit else parse_err \"Must use: assert {:split_here} true;\" ) }\r\n | YIELD Exp SEMI { ($1, SYield $2) }\r\n | AnyId COLONEQ Exp SEMI { ($2, SAssign ($1, $3)) }\r\n | LET AnyId COLONEQ AnyId LPAREN Exps RPAREN SEMI { ($3, SInline ([$2], \"construct##\" ^ $4, $6, [])) }\r\n | LET AnyId LPAREN AnyIds RPAREN COLONEQ Exp SEMI { ($6, SInline ($4, \"destruct##\" ^ $2, [$7], [])) }\r\n | CALL LID LPAREN Exps RPAREN ParCalls SEMI { ($1, SInline ([], $2, $4, $6)) }\r\n | CALL AnyIds COLONEQ LID LPAREN Exps RPAREN ParCalls SEMI { ($1, SInline ($2, $4, $6, $8)) }\r\n | CALL UID LPAREN Exps RPAREN SEMI { ($1, SCall ([], $2, $4)) }\r\n | CALL AnyIds COLONEQ UID LPAREN Exps RPAREN SEMI { ($1, SCall ($2, $4, $6)) }\r\n\r\nBlock\r\n : { [] }\r\n | Stmt Block { $1::$2 }\r\n\r\nProcDecls\r\n : { [] }\r\n | VAR AnyId COLON Type SEMI ProcDecls { ($2, $4, Non)::$6 }\r\n | LINEAR VAR AnyId COLON Type SEMI ProcDecls { ($3, $5, Lin (LinVar, LinOur))::$7 }\r\n | MY VAR AnyId COLON Type SEMI ProcDecls { ($3, $5, Lin (LinVar, LinMy))::$7 }\r\n\r\nFormal\r\n : AnyId COLON Type { ($1, $3) }\r\nFormals\r\n : { [] }\r\n | Formal { [$1] }\r\n | Formal COMMA Formals { $1::$3 }\r\n\r\nLocalFormal\r\n : AnyId COLON Type { ($1, $3) }\r\nLocalFormals\r\n : { [] }\r\n | LocalFormal { [$1] }\r\n | LocalFormal COMMA LocalFormals { $1::$3 }\r\n\r\nProcFormal\r\n : AnyId COLON Type { ($1, $3, Non) }\r\n | LINEAR AnyId COLON Type { ($2, $4, Lin (LinVar, LinOur)) }\r\n | MY AnyId COLON Type { ($2, $4, Lin (LinVar, LinMy)) }\r\n | CONST LINEAR AnyId COLON Type { ($3, $5, Lin (LinConst, LinOur)) }\r\n | CONST MY AnyId COLON Type { ($3, $5, Lin (LinConst, LinMy)) }\r\nProcFormals\r\n : { [] }\r\n | ProcFormal { [$1] }\r\n | ProcFormal COMMA ProcFormals { $1::$3 }\r\n\r\nSpec\r\n : REQUIRES Exp SEMI { ($1, let (r, e) = maybe_relation $2 in Requires (r, e)) }\r\n | ENSURES Exp SEMI { ($1, let (r, e) = maybe_relation $2 in Ensures (r, e)) }\r\n | MODIFIES AnyIds SEMI { ($1, Modifies $2) }\r\nSpecs\r\n : { [] }\r\n | Spec Specs { $1::$2 }\r\n\r\nTypeCase\r\n : AnyId LPAREN ProcFormals RPAREN { (Non, $1, $3) }\r\n | MY AnyId LPAREN ProcFormals RPAREN { (Lin (LinVar, LinMy), $2, $4) }\r\n | LINEAR AnyId LPAREN ProcFormals RPAREN { (Lin (LinVar, LinOur), $2, $4) }\r\nTypeCases\r\n : { [] }\r\n | TypeCase { [$1] }\r\n | TypeCase BAR TypeCases { $1::$3 }\r\n\r\nAnyIdExp: AnyId { $1 } | LPAREN AnyIdExp RPAREN { $2 }\r\nAnyIdExps\r\n : { [] }\r\n | AnyIdExp { [$1] }\r\n | AnyIdExp COMMA AnyIdExps { $1::$3 }\r\nAnyIdLists\r\n : { ([], \"\") }\r\n | LPAREN AnyIdExps RPAREN AnyIdLists { ($2 @ (fst $4), \"(\" + (String.concat \",\" $2) + \")\" + (snd $4)) }\r\nFunAttr\r\n : { None }\r\n | LBRACE COLON ID LITBOOL RBRACE { assrt ($3 = \"expand\" || $3 = \"never_pattern\"); Some ($3 + \" \" + (if $4 then \"true\" else \"false\")) }\r\nGhostOpt: { PReal } | GHOST { PGhost }\r\nProcOrImpl\r\n : GhostOpt PROCEDURE { ($2, Procedure ($1, Yields)) }\r\n | ATOMIC GhostOpt PROCEDURE { ($3, Procedure ($2, Atomic)) }\r\n | STABLE GhostOpt PROCEDURE { ($3, Procedure ($2, Stable)) }\r\n | IMPLEMENTATION { ($1, Implementation) }\r\nProcRet\r\n : { [] }\r\n | RETURNS LPAREN ProcFormals RPAREN { $3 }\r\nFunRet\r\n : RETURNS LPAREN Type RPAREN { $3 }\r\n | RETURNS LPAREN AnyId COLON Type RPAREN { $5 }\r\n | COLON Type { $2 }\r\nDecl\r\n : TYPE AnyId SEMI { ($1, DType ($2, false, false, None)) }\r\n | TYPE AnyId EQ TypeCases SEMI { ($1, DType ($2, false, false, Some $4)) }\r\n | TYPE LBRACE COLON ID RBRACE AnyId EQ TypeCases SEMI { assrt ($4 = \"overload\"); ($1, DType ($6, true, false, Some $8)) }\r\n | TYPE LTLT Type GTGT SEMI { let o = option_type_id $3 in ($1, DType (o, false, false, Some [(Non, o + \"_None\", []); (Non, o + \"_Some\", [(o + \"_Value\", $3, Non)])])) }\r\n | TYPE IMPLEMENTATION AnyId EQ TypeCases SEMI { ($1, DType ($3, false, true, Some $5)) }\r\n | TYPE IMPLEMENTATION LBRACE COLON ID RBRACE AnyId EQ TypeCases SEMI { assrt ($5 = \"overload\"); ($1, DType ($7, true, true, Some $9)) }\r\n | VAR AnyId COLON Type SEMI { ($1, DStaticGhost ($2, $4, Non, ReadWrite)) }\r\n | READONLY VAR AnyId COLON Type SEMI { ($1, DStaticGhost ($3, $5, Non, Readonly)) }\r\n | LINEAR VAR AnyId COLON Type SEMI { ($2, DStaticGhost ($3, $5, Lin (LinVar, LinOur), ReadWrite)) }\r\n | STATIC AnyId SEMI { ($1, DStatic $2) }\r\n | ProcOrImpl LID LPAREN ProcFormals RPAREN ProcRet SEMI Specs\r\n { assrt (match $1 with (_, Procedure _) -> true | _ -> false); (fst $1, DProc ($2, snd $1, Inline, $4, $6, $8, None)) }\r\n | ProcOrImpl UID LPAREN ProcFormals RPAREN ProcRet SEMI Specs\r\n { assrt (match $1 with (_, Procedure _) -> true | _ -> false); (fst $1, DProc ($2, snd $1, Outline, $4, $6, $8, None)) }\r\n | ProcOrImpl LID LPAREN ProcFormals RPAREN ProcRet Specs LBRACE ProcDecls Block RBRACE\r\n { (fst $1, DProc ($2, snd $1, Inline, $4, $6, $7, Some ($9, $10))) }\r\n | ProcOrImpl UID LPAREN ProcFormals RPAREN ProcRet Specs LBRACE ProcDecls Block RBRACE\r\n { (fst $1, DProc ($2, snd $1, Outline, $4, $6, $7, Some ($9, $10))) }\r\n | CONST AnyId COLON Type SEMI\r\n { ($1, DFunDecl ($2, None, Some $4, None, None, None)) }\r\n | CONST AnyId COLON Type COLONEQ Exp SEMI\r\n { ($1, DFunDecl ($2, None, Some $4, Some $6, None, None)) }\r\n | CONST SEGNAME COLON Type COLONEQ Exp SEMI\r\n { ($1, DFunDecl ($2, None, Some $4, Some $6, None, None)) }\r\n | CONST REGNAME COLON Type COLONEQ Exp SEMI\r\n { ($1, DFunDecl ($2, None, Some $4, Some $6, None, None)) }\r\n | FUNCTION FunAttr FunDeclId LPAREN Formals RPAREN FunRet LBRACE Exp RBRACE\r\n { ($1, DFunDecl ($3, Some $5, Some $7, Some $9, $2, None)) }\r\n | FUNCTION FunAttr FunDeclId LPAREN Formals RPAREN FunRet SEMI\r\n { ($1, DFunDecl ($3, Some $5, Some $7, None, $2, None)) }\r\n | FUNCTION IMPLEMENTATION Triggers FunDeclId LPAREN Formals RPAREN FunRet LBRACE Exp RBRACE\r\n { ($1, DFunDecl ($4, Some $6, Some $8, Some $10, None, Some $3)) }\r\n\r\nDecls\r\n : { [] }\r\n | Decl Decls { $1::$2 }\r\n\r\nModifies\r\n : { [] }\r\n | MODIFIES AnyIdExps SEMI Modifies { $2 @ $4 }\r\n\r\nYields\r\n : { [] }\r\n | YIELD AnyIdExps SEMI Yields { $2 @ $4 }\r\n\r\nImports\r\n : { [] }\r\n | IMPORT AnyIdExps SEMI Imports { $2 @ $4 }\r\n\r\n\r\n" }, { "path": "ironclad-apps/tools/BoogieAsm/parse_util.fs", "content": "open Ast;;\r\n\r\nexception Err of string\r\nexception ParseErr of string\r\nlet err (s:string):'a = raise (Err s)\r\nlet parse_err (s:string):'a = raise (ParseErr s)\r\nlet assrt b = if b then () else err \"assert failure\"\r\nlet line = ref 1;;\r\nlet file = ref \"\";;\r\nlet parse_require b = if b then () else parse_err \"parse requirement violated\"\r\n" }, { "path": "ironclad-apps/tools/Dafny/BVD.exe.config", "content": "\r\n\r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/tools/Dafny/Boogie.vshost.exe.manifest", "content": "\r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n" }, { "path": "ironclad-apps/tools/Dafny/Dafny.exe.config", "content": "\r\n\r\n\r\n" }, { "path": "ironclad-apps/tools/Dafny/Dafny.vshost.exe.config", "content": "\r\n\r\n\r\n" }, { "path": "ironclad-apps/tools/Dafny/Dafny.vshost.exe.manifest", "content": "\r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n" }, { "path": "ironclad-apps/tools/Dafny/DafnyPrelude.bpl", "content": "// Dafny prelude\r\n// Created 9 February 2008 by Rustan Leino.\r\n// Converted to Boogie 2 on 28 June 2008.\r\n// Edited sequence axioms 20 October 2009 by Alex Summers.\r\n// Modified 2014 by Dan Rosen.\r\n// Copyright (c) 2008-2014, Microsoft.\r\n\r\nconst $$Language$Dafny: bool; // To be recognizable to the ModelViewer as\r\naxiom $$Language$Dafny; // coming from a Dafny program.\r\n\r\n// ---------------------------------------------------------------\r\n// -- Types ------------------------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\ntype Ty;\r\n\r\nconst unique TBool : Ty;\r\nconst unique TChar : Ty;\r\nconst unique TInt : Ty;\r\nconst unique TNat : Ty;\r\nconst unique TReal : Ty;\r\nfunction TSet(Ty) : Ty;\r\nfunction TMultiSet(Ty) : Ty;\r\nfunction TSeq(Ty) : Ty;\r\nfunction TMap(Ty, Ty) : Ty;\r\n\r\nfunction Inv0_TSet(Ty) : Ty;\r\naxiom (forall t: Ty :: { TSet(t) } Inv0_TSet(TSet(t)) == t);\r\nfunction Inv0_TSeq(Ty) : Ty;\r\naxiom (forall t: Ty :: { TSeq(t) } Inv0_TSeq(TSeq(t)) == t);\r\nfunction Inv0_TMultiSet(Ty) : Ty;\r\naxiom (forall t: Ty :: { TMultiSet(t) } Inv0_TMultiSet(TMultiSet(t)) == t);\r\nfunction Inv0_TMap(Ty) : Ty;\r\nfunction Inv1_TMap(Ty) : Ty;\r\naxiom (forall t, u: Ty :: { TMap(t,u) } Inv0_TMap(TMap(t,u)) == t);\r\naxiom (forall t, u: Ty :: { TMap(t,u) } Inv1_TMap(TMap(t,u)) == u);\r\n\r\n// -- Classes and Datatypes --\r\n\r\n// -- Type Tags --\r\ntype TyTag;\r\nfunction Tag(Ty) : TyTag;\r\n\r\nconst unique TagBool : TyTag;\r\nconst unique TagChar : TyTag;\r\nconst unique TagInt : TyTag;\r\nconst unique TagNat : TyTag;\r\nconst unique TagReal : TyTag;\r\nconst unique TagSet : TyTag;\r\nconst unique TagMultiSet : TyTag;\r\nconst unique TagSeq : TyTag;\r\nconst unique TagMap : TyTag;\r\nconst unique TagClass : TyTag;\r\n\r\naxiom Tag(TBool) == TagBool;\r\naxiom Tag(TChar) == TagChar;\r\naxiom Tag(TInt) == TagInt;\r\naxiom Tag(TNat) == TagNat;\r\naxiom Tag(TReal) == TagReal;\r\naxiom (forall t: Ty :: { TSet(t) } Tag(TSet(t)) == TagSet);\r\naxiom (forall t: Ty :: { TMultiSet(t) } Tag(TMultiSet(t)) == TagMultiSet);\r\naxiom (forall t: Ty :: { TSeq(t) } Tag(TSeq(t)) == TagSeq);\r\naxiom (forall t, u: Ty :: { TMap(t,u) } Tag(TMap(t,u)) == TagMap);\r\n\r\n// ---------------------------------------------------------------\r\n// -- Literals ---------------------------------------------------\r\n// ---------------------------------------------------------------\r\nfunction {:identity} LitInt(x: int): int { x }\r\naxiom (forall x: int :: { $Box(LitInt(x)) } $Box(LitInt(x)) == Lit($Box(x)) );\r\nfunction {:identity} LitReal(x: real): real { x }\r\naxiom (forall x: real :: { $Box(LitReal(x)) } $Box(LitReal(x)) == Lit($Box(x)) );\r\nfunction {:identity} Lit(x: T): T { x }\r\naxiom (forall x: T :: { $Box(Lit(x)) } $Box(Lit(x)) == Lit($Box(x)) );\r\n\r\n// ---------------------------------------------------------------\r\n// -- Characters -------------------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\ntype char;\r\nfunction char#FromInt(int): char;\r\nfunction char#ToInt(char): int; // inverse of char#FromInt\r\naxiom (forall ch: char ::\r\n { char#ToInt(ch) } \r\n char#FromInt(char#ToInt(ch)) == ch);\r\naxiom (forall n: int ::\r\n { char#FromInt(n) }\r\n 0 <= n && n < 65536 ==> char#ToInt(char#FromInt(n)) == n);\r\n\r\n// ---------------------------------------------------------------\r\n// -- References -------------------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\ntype ref;\r\nconst null: ref;\r\n\r\n// ---------------------------------------------------------------\r\n// -- Boxing and unboxing ----------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\ntype Box;\r\nconst $ArbitraryBoxValue: Box;\r\n\r\nfunction $Box(T): Box;\r\nfunction $Unbox(Box): T;\r\n\r\naxiom (forall x : T :: { $Box(x) } $Unbox($Box(x)) == x);\r\n\r\naxiom (forall bx : Box ::\r\n { $IsBox(bx, TInt) }\r\n ( $IsBox(bx, TInt) ==> $Box($Unbox(bx) : int) == bx && $Is($Unbox(bx) : int, TInt)));\r\naxiom (forall bx : Box ::\r\n { $IsBox(bx, TNat) }\r\n ( $IsBox(bx, TNat) ==> $Box($Unbox(bx) : int) == bx && $Is($Unbox(bx) : int, TNat)));\r\naxiom (forall bx : Box ::\r\n { $IsBox(bx, TReal) }\r\n ( $IsBox(bx, TReal) ==> $Box($Unbox(bx) : real) == bx && $Is($Unbox(bx) : real, TReal)));\r\naxiom (forall bx : Box ::\r\n { $IsBox(bx, TBool) }\r\n ( $IsBox(bx, TBool) ==> $Box($Unbox(bx) : bool) == bx && $Is($Unbox(bx) : bool, TBool)));\r\naxiom (forall bx : Box ::\r\n { $IsBox(bx, TChar) }\r\n ( $IsBox(bx, TChar) ==> $Box($Unbox(bx) : char) == bx && $Is($Unbox(bx) : char, TChar)));\r\naxiom (forall bx : Box, t : Ty ::\r\n { $IsBox(bx, TSet(t)) }\r\n ( $IsBox(bx, TSet(t)) ==> $Box($Unbox(bx) : Set Box) == bx && $Is($Unbox(bx) : Set Box, TSet(t))));\r\naxiom (forall bx : Box, t : Ty ::\r\n { $IsBox(bx, TMultiSet(t)) }\r\n ( $IsBox(bx, TMultiSet(t)) ==> $Box($Unbox(bx) : MultiSet Box) == bx && $Is($Unbox(bx) : MultiSet Box, TMultiSet(t))));\r\naxiom (forall bx : Box, t : Ty ::\r\n { $IsBox(bx, TSeq(t)) }\r\n ( $IsBox(bx, TSeq(t)) ==> $Box($Unbox(bx) : Seq Box) == bx && $Is($Unbox(bx) : Seq Box, TSeq(t))));\r\naxiom (forall bx : Box, s : Ty, t : Ty ::\r\n { $IsBox(bx, TMap(s, t)) }\r\n ( $IsBox(bx, TMap(s, t)) ==> $Box($Unbox(bx) : Map Box Box) == bx && $Is($Unbox(bx) : Map Box Box, TMap(s, t))));\r\n\r\naxiom (forall v : T, t : Ty ::\r\n { $IsBox($Box(v), t) }\r\n ( $IsBox($Box(v), t) <==> $Is(v,t) ));\r\naxiom (forall v : T, t : Ty, h : Heap ::\r\n { $IsAllocBox($Box(v), t, h) }\r\n ( $IsAllocBox($Box(v), t, h) <==> $IsAlloc(v,t,h) ));\r\n\r\n// The following functions and axioms are used to obtain a $Box($Unbox(_)) wrapper around\r\n// certain expressions. Note that it assumes any booleans (or, indeed, values of any type) contained\r\n// in the (multi)set are canonical (which is the case for any (multi)set that occurs in an execution of\r\n// a Dafny program).\r\n// The role of the parameter 'dummy' in the following is (an unfortunately clumsy construction\r\n// whose only purpose is) simply to tell Boogie how to instantiate the type parameter 'T'.\r\n\r\n/*\r\nfunction $IsGoodSet_Extended(s: Set Box, dummy: T): bool;\r\naxiom (forall ss: Set Box, dummy: T, bx: Box :: { $IsGoodSet_Extended(ss, dummy), ss[bx] }\r\n $IsGoodSet_Extended(ss, dummy) ==> ss[bx] ==> bx == $Box($Unbox(bx): T));\r\nfunction $IsGoodMultiSet_Extended(ms: MultiSet Box, dummy: T): bool;\r\naxiom (forall ms: MultiSet Box, dummy: T, bx: Box :: { $IsGoodMultiSet_Extended(ms, dummy), ms[bx] }\r\n $IsGoodMultiSet_Extended(ms, dummy) ==> 0 < ms[bx] ==> bx == $Box($Unbox(bx): T));\r\n */\r\n\r\n// ---------------------------------------------------------------\r\n// -- Is and IsAlloc ---------------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\n// Type-argument to $Is is the /representation type/,\r\n// the second value argument to $Is is the actual type.\r\nfunction $Is(T,Ty): bool; // no heap for now\r\nfunction $IsAlloc(T,Ty,Heap): bool;\r\n\r\n// Corresponding entries for boxes...\r\n// This could probably be solved by having Box also inhabit Ty\r\nfunction $IsBox(T,Ty): bool;\r\nfunction $IsAllocBox(T,Ty,Heap): bool;\r\n\r\naxiom(forall v : int :: { $Is(v,TInt) } $Is(v,TInt));\r\naxiom(forall v : int :: { $Is(v,TNat) } $Is(v,TNat) <==> v >= 0);\r\naxiom(forall v : real :: { $Is(v,TReal) } $Is(v,TReal));\r\naxiom(forall v : bool :: { $Is(v,TBool) } $Is(v,TBool));\r\naxiom(forall v : char :: { $Is(v,TChar) } $Is(v,TChar));\r\n\r\naxiom(forall h : Heap, v : int :: { $IsAlloc(v,TInt,h) } $IsAlloc(v,TInt,h));\r\naxiom(forall h : Heap, v : int :: { $IsAlloc(v,TNat,h) } $IsAlloc(v,TNat,h));\r\naxiom(forall h : Heap, v : real :: { $IsAlloc(v,TReal,h) } $IsAlloc(v,TReal,h));\r\naxiom(forall h : Heap, v : bool :: { $IsAlloc(v,TBool,h) } $IsAlloc(v,TBool,h));\r\naxiom(forall h : Heap, v : char :: { $IsAlloc(v,TChar,h) } $IsAlloc(v,TChar,h));\r\n\r\naxiom (forall v: Set Box, t0: Ty :: { $Is(v, TSet(t0)) }\r\n $Is(v, TSet(t0)) <==>\r\n (forall bx: Box :: { v[bx] }\r\n v[bx] ==> $IsBox(bx, t0)));\r\naxiom (forall v: MultiSet Box, t0: Ty :: { $Is(v, TMultiSet(t0)) }\r\n $Is(v, TMultiSet(t0)) <==>\r\n (forall bx: Box :: { v[bx] }\r\n 0 < v[bx] ==> $IsBox(bx, t0)));\r\naxiom (forall v: MultiSet Box, t0: Ty :: { $Is(v, TMultiSet(t0)) }\r\n $Is(v, TMultiSet(t0)) ==> $IsGoodMultiSet(v));\r\naxiom (forall v: Seq Box, t0: Ty :: { $Is(v, TSeq(t0)) }\r\n $Is(v, TSeq(t0)) <==>\r\n (forall i : int :: { Seq#Index(v, i) }\r\n 0 <= i && i < Seq#Length(v) ==>\r\n\t$IsBox(Seq#Index(v, i), t0)));\r\naxiom (forall v: Set Box, t0: Ty, h: Heap :: { $IsAlloc(v, TSet(t0), h) }\r\n $IsAlloc(v, TSet(t0), h) <==>\r\n (forall bx: Box :: { v[bx] }\r\n v[bx] ==> $IsAllocBox(bx, t0, h)));\r\naxiom (forall v: MultiSet Box, t0: Ty, h: Heap :: { $IsAlloc(v, TMultiSet(t0), h) }\r\n $IsAlloc(v, TMultiSet(t0), h) <==>\r\n (forall bx: Box :: { v[bx] }\r\n 0 < v[bx] ==> $IsAllocBox(bx, t0, h)));\r\naxiom (forall v: Seq Box, t0: Ty, h: Heap :: { $IsAlloc(v, TSeq(t0), h) }\r\n $IsAlloc(v, TSeq(t0), h) <==>\r\n (forall i : int :: { Seq#Index(v, i) }\r\n 0 <= i && i < Seq#Length(v) ==>\r\n\t$IsAllocBox(Seq#Index(v, i), t0, h)));\r\n\r\naxiom (forall v: Map Box Box, t0: Ty, t1: Ty ::\r\n { $Is(v, TMap(t0, t1)) }\r\n $Is(v, TMap(t0, t1))\r\n <==> (forall bx: Box ::\r\n { Map#Elements(v)[bx] } { Map#Domain(v)[bx] }\r\n Map#Domain(v)[bx] ==>\r\n $IsBox(Map#Elements(v)[bx], t1) &&\r\n $IsBox(bx, t0)));\r\naxiom (forall v: Map Box Box, t0: Ty, t1: Ty, h: Heap ::\r\n { $IsAlloc(v, TMap(t0, t1), h) }\r\n $IsAlloc(v, TMap(t0, t1), h)\r\n <==> (forall bx: Box ::\r\n { Map#Elements(v)[bx] } { Map#Domain(v)[bx] }\r\n Map#Domain(v)[bx] ==>\r\n $IsAllocBox(Map#Elements(v)[bx], t1, h) &&\r\n $IsAllocBox(bx, t0, h)));\r\n\r\n// ---------------------------------------------------------------\r\n// -- Encoding of type names -------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\ntype ClassName;\r\nconst unique class._System.int: ClassName;\r\nconst unique class._System.bool: ClassName;\r\nconst unique class._System.set: ClassName;\r\nconst unique class._System.seq: ClassName;\r\nconst unique class._System.multiset: ClassName;\r\n\r\nfunction /*{:never_pattern true}*/ dtype(ref): Ty; // changed from ClassName to Ty\r\n\r\nfunction TypeTuple(a: ClassName, b: ClassName): ClassName;\r\nfunction TypeTupleCar(ClassName): ClassName;\r\nfunction TypeTupleCdr(ClassName): ClassName;\r\n// TypeTuple is injective in both arguments:\r\naxiom (forall a: ClassName, b: ClassName :: { TypeTuple(a,b) }\r\n TypeTupleCar(TypeTuple(a,b)) == a &&\r\n TypeTupleCdr(TypeTuple(a,b)) == b);\r\n\r\n// -- Function handles -------------------------------------------\r\n\r\ntype HandleType;\r\n\r\n// ---------------------------------------------------------------\r\n// -- Datatypes --------------------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\ntype DatatypeType;\r\n\r\ntype DtCtorId;\r\nfunction DatatypeCtorId(DatatypeType): DtCtorId;\r\n\r\nfunction DtRank(DatatypeType): int;\r\nfunction BoxRank(Box): int;\r\n\r\naxiom (forall d: DatatypeType :: {BoxRank($Box(d))} BoxRank($Box(d)) == DtRank(d));\r\n\r\n// ---------------------------------------------------------------\r\n// -- Axiom contexts ---------------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\n// used to make sure function axioms are not used while their consistency is being checked\r\nconst $ModuleContextHeight: int;\r\nconst $FunctionContextHeight: int;\r\n\r\n// ---------------------------------------------------------------\r\n// -- Layers of function encodings -------------------------------\r\n// ---------------------------------------------------------------\r\n\r\ntype LayerType;\r\nconst $LZ: LayerType;\r\nfunction $LS(LayerType): LayerType;\r\n\r\nfunction AtLayer([LayerType]A, LayerType): A;\r\naxiom (forall f : [LayerType]A, ly : LayerType :: { AtLayer(f,ly) } AtLayer(f,ly) == f[ly]);\r\naxiom (forall f : [LayerType]A, ly : LayerType :: { AtLayer(f,$LS(ly)) } AtLayer(f,$LS(ly)) == AtLayer(f,ly));\r\n\r\n// ---------------------------------------------------------------\r\n// -- Fields -----------------------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\ntype Field alpha;\r\n\r\nfunction FDim(Field T): int;\r\n\r\nfunction IndexField(int): Field Box;\r\naxiom (forall i: int :: { IndexField(i) } FDim(IndexField(i)) == 1);\r\nfunction IndexField_Inverse(Field T): int;\r\naxiom (forall i: int :: { IndexField(i) } IndexField_Inverse(IndexField(i)) == i);\r\n\r\nfunction MultiIndexField(Field Box, int): Field Box;\r\naxiom (forall f: Field Box, i: int :: { MultiIndexField(f,i) } FDim(MultiIndexField(f,i)) == FDim(f) + 1);\r\nfunction MultiIndexField_Inverse0(Field T): Field T;\r\nfunction MultiIndexField_Inverse1(Field T): int;\r\naxiom (forall f: Field Box, i: int :: { MultiIndexField(f,i) }\r\n MultiIndexField_Inverse0(MultiIndexField(f,i)) == f &&\r\n MultiIndexField_Inverse1(MultiIndexField(f,i)) == i);\r\n\r\nfunction DeclType(Field T): ClassName;\r\n\r\ntype NameFamily;\r\nfunction DeclName(Field T): NameFamily;\r\nfunction FieldOfDecl(ClassName, NameFamily): Field alpha;\r\naxiom (forall cl : ClassName, nm: NameFamily ::\r\n {FieldOfDecl(cl, nm): Field T}\r\n DeclType(FieldOfDecl(cl, nm): Field T) == cl && DeclName(FieldOfDecl(cl, nm): Field T) == nm);\r\n\r\nfunction $IsGhostField(Field T): bool;\r\n\r\n// ---------------------------------------------------------------\r\n// -- Allocatedness and Heap Succession --------------------------\r\n// ---------------------------------------------------------------\r\n\r\n\r\n// $IsAlloc and $IsAllocBox are monotonic\r\n\r\naxiom(forall h, k : Heap, v : T, t : Ty ::\r\n { $HeapSucc(h, k), $IsAlloc(v, t, h) }\r\n $HeapSucc(h, k) ==> $IsAlloc(v, t, h) ==> $IsAlloc(v, t, k));\r\naxiom(forall h, k : Heap, bx : Box, t : Ty ::\r\n { $HeapSucc(h, k), $IsAllocBox(bx, t, h) }\r\n $HeapSucc(h, k) ==> $IsAllocBox(bx, t, h) ==> $IsAllocBox(bx, t, k));\r\n\r\n// No axioms for $Is and $IsBox since they don't talk about the heap.\r\n\r\nconst unique alloc: Field bool;\r\naxiom FDim(alloc) == 0 && !$IsGhostField(alloc); // treat as non-ghost field, because it cannot be changed by ghost code\r\n\r\n// ---------------------------------------------------------------\r\n// -- Arrays -----------------------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\nfunction _System.array.Length(a: ref): int;\r\naxiom (forall o: ref :: 0 <= _System.array.Length(o));\r\n\r\n// ---------------------------------------------------------------\r\n// -- Reals ------------------------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\nfunction Int(x: real): int { int(x) }\r\nfunction Real(x: int): real { real(x) }\r\naxiom (forall i: int :: { Int(Real(i)) } Int(Real(i)) == i);\r\n\r\nfunction {:inline true} _System.real.Trunc(x: real): int { Int(x) }\r\n\r\n// ---------------------------------------------------------------\r\n// -- The heap ---------------------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\ntype Heap = [ref,Field alpha]alpha;\r\nfunction {:inline true} read(H:Heap, r:ref, f:Field alpha): alpha { H[r, f] }\r\nfunction {:inline true} update(H:Heap, r:ref, f:Field alpha, v:alpha): Heap { H[r,f := v] }\r\n\r\nfunction $IsGoodHeap(Heap): bool;\r\nvar $Heap: Heap where $IsGoodHeap($Heap);\r\n\r\nfunction $HeapSucc(Heap, Heap): bool;\r\naxiom (forall h: Heap, r: ref, f: Field alpha, x: alpha :: { update(h, r, f, x) }\r\n $IsGoodHeap(update(h, r, f, x)) ==>\r\n $HeapSucc(h, update(h, r, f, x)));\r\naxiom (forall a,b,c: Heap :: { $HeapSucc(a,b), $HeapSucc(b,c) }\r\n $HeapSucc(a,b) && $HeapSucc(b,c) ==> $HeapSucc(a,c));\r\naxiom (forall h: Heap, k: Heap :: { $HeapSucc(h,k) }\r\n $HeapSucc(h,k) ==> (forall o: ref :: { read(k, o, alloc) } read(h, o, alloc) ==> read(k, o, alloc)));\r\n\r\nfunction $HeapSuccGhost(Heap, Heap): bool;\r\naxiom (forall h: Heap, k: Heap :: { $HeapSuccGhost(h,k) }\r\n $HeapSuccGhost(h,k) ==>\r\n $HeapSucc(h,k) &&\r\n (forall o: ref, f: Field alpha :: { read(k, o, f) }\r\n !$IsGhostField(f) ==> read(h, o, f) == read(k, o, f)));\r\n\r\n// ---------------------------------------------------------------\r\n// -- Non-determinism --------------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\ntype TickType;\r\nvar $Tick: TickType;\r\n\r\n// ---------------------------------------------------------------\r\n// -- Useful macros ----------------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\n// havoc everything in $Heap, except {this}+rds+nw\r\nprocedure $YieldHavoc(this: ref, rds: Set Box, nw: Set Box);\r\n modifies $Heap;\r\n ensures (forall $o: ref, $f: Field alpha :: { read($Heap, $o, $f) }\r\n $o != null && read(old($Heap), $o, alloc) ==>\r\n $o == this || rds[$Box($o)] || nw[$Box($o)] ==>\r\n read($Heap, $o, $f) == read(old($Heap), $o, $f));\r\n ensures $HeapSucc(old($Heap), $Heap);\r\n\r\n// havoc everything in $Heap, except rds-modi-{this}\r\nprocedure $IterHavoc0(this: ref, rds: Set Box, modi: Set Box);\r\n modifies $Heap;\r\n ensures (forall $o: ref, $f: Field alpha :: { read($Heap, $o, $f) }\r\n $o != null && read(old($Heap), $o, alloc) ==>\r\n rds[$Box($o)] && !modi[$Box($o)] && $o != this ==>\r\n read($Heap, $o, $f) == read(old($Heap), $o, $f));\r\n ensures $HeapSucc(old($Heap), $Heap);\r\n\r\n// havoc $Heap at {this}+modi+nw\r\nprocedure $IterHavoc1(this: ref, modi: Set Box, nw: Set Box);\r\n modifies $Heap;\r\n ensures (forall $o: ref, $f: Field alpha :: { read($Heap, $o, $f) }\r\n $o != null && read(old($Heap), $o, alloc) ==>\r\n read($Heap, $o, $f) == read(old($Heap), $o, $f) ||\r\n $o == this || modi[$Box($o)] || nw[$Box($o)]);\r\n ensures $HeapSucc(old($Heap), $Heap);\r\n\r\nprocedure $IterCollectNewObjects(prevHeap: Heap, newHeap: Heap, this: ref, NW: Field (Set Box))\r\n returns (s: Set Box);\r\n ensures (forall bx: Box :: { s[bx] } s[bx] <==>\r\n read(newHeap, this, NW)[bx] ||\r\n ($Unbox(bx) != null && !read(prevHeap, $Unbox(bx):ref, alloc) && read(newHeap, $Unbox(bx):ref, alloc)));\r\n\r\n// ---------------------------------------------------------------\r\n// -- Axiomatizations --------------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\n// ---------------------------------------------------------------\r\n// -- Axiomatization of sets -------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\ntype Set T = [T]bool;\r\n\r\nfunction Set#Card(Set T): int;\r\naxiom (forall s: Set T :: { Set#Card(s) } 0 <= Set#Card(s));\r\n\r\nfunction Set#Empty(): Set T;\r\naxiom (forall o: T :: { Set#Empty()[o] } !Set#Empty()[o]);\r\naxiom (forall s: Set T :: { Set#Card(s) }\r\n (Set#Card(s) == 0 <==> s == Set#Empty()) &&\r\n (Set#Card(s) != 0 ==> (exists x: T :: s[x])));\r\n\r\n// the empty set could be of anything\r\n//axiom (forall t: Ty :: { $Is(Set#Empty() : [T]bool, TSet(t)) } $Is(Set#Empty() : [T]bool, TSet(t)));\r\n\r\nfunction Set#Singleton(T): Set T;\r\naxiom (forall r: T :: { Set#Singleton(r) } Set#Singleton(r)[r]);\r\naxiom (forall r: T, o: T :: { Set#Singleton(r)[o] } Set#Singleton(r)[o] <==> r == o);\r\naxiom (forall r: T :: { Set#Card(Set#Singleton(r)) } Set#Card(Set#Singleton(r)) == 1);\r\n\r\nfunction Set#UnionOne(Set T, T): Set T;\r\naxiom (forall a: Set T, x: T, o: T :: { Set#UnionOne(a,x)[o] }\r\n Set#UnionOne(a,x)[o] <==> o == x || a[o]);\r\naxiom (forall a: Set T, x: T :: { Set#UnionOne(a, x) }\r\n Set#UnionOne(a, x)[x]);\r\naxiom (forall a: Set T, x: T, y: T :: { Set#UnionOne(a, x), a[y] }\r\n a[y] ==> Set#UnionOne(a, x)[y]);\r\naxiom (forall a: Set T, x: T :: { Set#Card(Set#UnionOne(a, x)) }\r\n a[x] ==> Set#Card(Set#UnionOne(a, x)) == Set#Card(a));\r\naxiom (forall a: Set T, x: T :: { Set#Card(Set#UnionOne(a, x)) }\r\n !a[x] ==> Set#Card(Set#UnionOne(a, x)) == Set#Card(a) + 1);\r\n\r\nfunction Set#Union(Set T, Set T): Set T;\r\naxiom (forall a: Set T, b: Set T, o: T :: { Set#Union(a,b)[o] }\r\n Set#Union(a,b)[o] <==> a[o] || b[o]);\r\naxiom (forall a, b: Set T, y: T :: { Set#Union(a, b), a[y] }\r\n a[y] ==> Set#Union(a, b)[y]);\r\naxiom (forall a, b: Set T, y: T :: { Set#Union(a, b), b[y] }\r\n b[y] ==> Set#Union(a, b)[y]);\r\naxiom (forall a, b: Set T :: { Set#Union(a, b) }\r\n Set#Disjoint(a, b) ==>\r\n Set#Difference(Set#Union(a, b), a) == b &&\r\n Set#Difference(Set#Union(a, b), b) == a);\r\n// Follows from the general union axiom, but might be still worth including, because disjoint union is a common case:\r\n// axiom (forall a, b: Set T :: { Set#Card(Set#Union(a, b)) }\r\n// Set#Disjoint(a, b) ==>\r\n// Set#Card(Set#Union(a, b)) == Set#Card(a) + Set#Card(b));\r\n\r\nfunction Set#Intersection(Set T, Set T): Set T;\r\naxiom (forall a: Set T, b: Set T, o: T :: { Set#Intersection(a,b)[o] }\r\n Set#Intersection(a,b)[o] <==> a[o] && b[o]);\r\n\r\naxiom (forall a, b: Set T :: { Set#Union(Set#Union(a, b), b) }\r\n Set#Union(Set#Union(a, b), b) == Set#Union(a, b));\r\naxiom (forall a, b: Set T :: { Set#Union(a, Set#Union(a, b)) }\r\n Set#Union(a, Set#Union(a, b)) == Set#Union(a, b));\r\naxiom (forall a, b: Set T :: { Set#Intersection(Set#Intersection(a, b), b) }\r\n Set#Intersection(Set#Intersection(a, b), b) == Set#Intersection(a, b));\r\naxiom (forall a, b: Set T :: { Set#Intersection(a, Set#Intersection(a, b)) }\r\n Set#Intersection(a, Set#Intersection(a, b)) == Set#Intersection(a, b));\r\naxiom (forall a, b: Set T :: { Set#Card(Set#Union(a, b)) }{ Set#Card(Set#Intersection(a, b)) }\r\n Set#Card(Set#Union(a, b)) + Set#Card(Set#Intersection(a, b)) == Set#Card(a) + Set#Card(b));\r\n\r\nfunction Set#Difference(Set T, Set T): Set T;\r\naxiom (forall a: Set T, b: Set T, o: T :: { Set#Difference(a,b)[o] }\r\n Set#Difference(a,b)[o] <==> a[o] && !b[o]);\r\naxiom (forall a, b: Set T, y: T :: { Set#Difference(a, b), b[y] }\r\n b[y] ==> !Set#Difference(a, b)[y] );\r\naxiom (forall a, b: Set T ::\r\n { Set#Card(Set#Difference(a, b)) }\r\n Set#Card(Set#Difference(a, b)) + Set#Card(Set#Difference(b, a))\r\n + Set#Card(Set#Intersection(a, b))\r\n == Set#Card(Set#Union(a, b)) &&\r\n Set#Card(Set#Difference(a, b)) == Set#Card(a) - Set#Card(Set#Intersection(a, b)));\r\n\r\nfunction Set#Subset(Set T, Set T): bool;\r\naxiom(forall a: Set T, b: Set T :: { Set#Subset(a,b) }\r\n Set#Subset(a,b) <==> (forall o: T :: {a[o]} {b[o]} a[o] ==> b[o]));\r\n// axiom(forall a: Set T, b: Set T ::\r\n// { Set#Subset(a,b), Set#Card(a), Set#Card(b) } // very restrictive trigger\r\n// Set#Subset(a,b) ==> Set#Card(a) <= Set#Card(b));\r\n\r\n\r\nfunction Set#Equal(Set T, Set T): bool;\r\naxiom(forall a: Set T, b: Set T :: { Set#Equal(a,b) }\r\n Set#Equal(a,b) <==> (forall o: T :: {a[o]} {b[o]} a[o] <==> b[o]));\r\naxiom(forall a: Set T, b: Set T :: { Set#Equal(a,b) } // extensionality axiom for sets\r\n Set#Equal(a,b) ==> a == b);\r\n\r\nfunction Set#Disjoint(Set T, Set T): bool;\r\naxiom (forall a: Set T, b: Set T :: { Set#Disjoint(a,b) }\r\n Set#Disjoint(a,b) <==> (forall o: T :: {a[o]} {b[o]} !a[o] || !b[o]));\r\n\r\n// ---------------------------------------------------------------\r\n// -- Axiomatization of multisets --------------------------------\r\n// ---------------------------------------------------------------\r\n\r\nfunction Math#min(a: int, b: int): int;\r\naxiom (forall a: int, b: int :: { Math#min(a, b) } a <= b <==> Math#min(a, b) == a);\r\naxiom (forall a: int, b: int :: { Math#min(a, b) } b <= a <==> Math#min(a, b) == b);\r\naxiom (forall a: int, b: int :: { Math#min(a, b) } Math#min(a, b) == a || Math#min(a, b) == b);\r\n\r\nfunction Math#clip(a: int): int;\r\naxiom (forall a: int :: { Math#clip(a) } 0 <= a ==> Math#clip(a) == a);\r\naxiom (forall a: int :: { Math#clip(a) } a < 0 ==> Math#clip(a) == 0);\r\n\r\ntype MultiSet T = [T]int;\r\n\r\nfunction $IsGoodMultiSet(ms: MultiSet T): bool;\r\n// ints are non-negative, used after havocing, and for conversion from sequences to multisets.\r\naxiom (forall ms: MultiSet T :: { $IsGoodMultiSet(ms) }\r\n $IsGoodMultiSet(ms) <==>\r\n (forall bx: T :: { ms[bx] } 0 <= ms[bx] && ms[bx] <= MultiSet#Card(ms)));\r\n\r\nfunction MultiSet#Card(MultiSet T): int;\r\naxiom (forall s: MultiSet T :: { MultiSet#Card(s) } 0 <= MultiSet#Card(s));\r\naxiom (forall s: MultiSet T, x: T, n: int :: { MultiSet#Card(s[x := n]) }\r\n 0 <= n ==> MultiSet#Card(s[x := n]) == MultiSet#Card(s) - s[x] + n);\r\n\r\nfunction MultiSet#Empty(): MultiSet T;\r\naxiom (forall o: T :: { MultiSet#Empty()[o] } MultiSet#Empty()[o] == 0);\r\naxiom (forall s: MultiSet T :: { MultiSet#Card(s) }\r\n (MultiSet#Card(s) == 0 <==> s == MultiSet#Empty()) &&\r\n (MultiSet#Card(s) != 0 ==> (exists x: T :: 0 < s[x])));\r\n\r\nfunction MultiSet#Singleton(T): MultiSet T;\r\naxiom (forall r: T, o: T :: { MultiSet#Singleton(r)[o] } (MultiSet#Singleton(r)[o] == 1 <==> r == o) &&\r\n (MultiSet#Singleton(r)[o] == 0 <==> r != o));\r\naxiom (forall r: T :: { MultiSet#Singleton(r) } MultiSet#Singleton(r) == MultiSet#UnionOne(MultiSet#Empty(), r));\r\n\r\nfunction MultiSet#UnionOne(MultiSet T, T): MultiSet T;\r\n// pure containment axiom (in the original multiset or is the added element)\r\naxiom (forall a: MultiSet T, x: T, o: T :: { MultiSet#UnionOne(a,x)[o] }\r\n 0 < MultiSet#UnionOne(a,x)[o] <==> o == x || 0 < a[o]);\r\n// union-ing increases count by one\r\naxiom (forall a: MultiSet T, x: T :: { MultiSet#UnionOne(a, x) }\r\n MultiSet#UnionOne(a, x)[x] == a[x] + 1);\r\n// non-decreasing\r\naxiom (forall a: MultiSet T, x: T, y: T :: { MultiSet#UnionOne(a, x), a[y] }\r\n 0 < a[y] ==> 0 < MultiSet#UnionOne(a, x)[y]);\r\n// other elements unchanged\r\naxiom (forall a: MultiSet T, x: T, y: T :: { MultiSet#UnionOne(a, x), a[y] }\r\n x != y ==> a[y] == MultiSet#UnionOne(a, x)[y]);\r\naxiom (forall a: MultiSet T, x: T :: { MultiSet#Card(MultiSet#UnionOne(a, x)) }\r\n MultiSet#Card(MultiSet#UnionOne(a, x)) == MultiSet#Card(a) + 1);\r\n\r\n\r\nfunction MultiSet#Union(MultiSet T, MultiSet T): MultiSet T;\r\n// union-ing is the sum of the contents\r\naxiom (forall a: MultiSet T, b: MultiSet T, o: T :: { MultiSet#Union(a,b)[o] }\r\n MultiSet#Union(a,b)[o] == a[o] + b[o]);\r\naxiom (forall a: MultiSet T, b: MultiSet T :: { MultiSet#Card(MultiSet#Union(a,b)) }\r\n MultiSet#Card(MultiSet#Union(a,b)) == MultiSet#Card(a) + MultiSet#Card(b));\r\n\r\nfunction MultiSet#Intersection(MultiSet T, MultiSet T): MultiSet T;\r\naxiom (forall a: MultiSet T, b: MultiSet T, o: T :: { MultiSet#Intersection(a,b)[o] }\r\n MultiSet#Intersection(a,b)[o] == Math#min(a[o], b[o]));\r\n\r\n// left and right pseudo-idempotence\r\naxiom (forall a, b: MultiSet T :: { MultiSet#Intersection(MultiSet#Intersection(a, b), b) }\r\n MultiSet#Intersection(MultiSet#Intersection(a, b), b) == MultiSet#Intersection(a, b));\r\naxiom (forall a, b: MultiSet T :: { MultiSet#Intersection(a, MultiSet#Intersection(a, b)) }\r\n MultiSet#Intersection(a, MultiSet#Intersection(a, b)) == MultiSet#Intersection(a, b));\r\n\r\n// multiset difference, a - b. clip() makes it positive.\r\nfunction MultiSet#Difference(MultiSet T, MultiSet T): MultiSet T;\r\naxiom (forall a: MultiSet T, b: MultiSet T, o: T :: { MultiSet#Difference(a,b)[o] }\r\n MultiSet#Difference(a,b)[o] == Math#clip(a[o] - b[o]));\r\naxiom (forall a, b: MultiSet T, y: T :: { MultiSet#Difference(a, b), b[y], a[y] }\r\n a[y] <= b[y] ==> MultiSet#Difference(a, b)[y] == 0 );\r\naxiom (forall a, b: MultiSet T ::\r\n { MultiSet#Card(MultiSet#Difference(a, b)) }\r\n MultiSet#Card(MultiSet#Difference(a, b)) + MultiSet#Card(MultiSet#Difference(b, a))\r\n + 2 * MultiSet#Card(MultiSet#Intersection(a, b))\r\n == MultiSet#Card(MultiSet#Union(a, b)) &&\r\n MultiSet#Card(MultiSet#Difference(a, b)) == MultiSet#Card(a) - MultiSet#Card(MultiSet#Intersection(a, b)));\r\n\r\n// multiset subset means a must have at most as many of each element as b\r\nfunction MultiSet#Subset(MultiSet T, MultiSet T): bool;\r\naxiom(forall a: MultiSet T, b: MultiSet T :: { MultiSet#Subset(a,b) }\r\n MultiSet#Subset(a,b) <==> (forall o: T :: {a[o]} {b[o]} a[o] <= b[o]));\r\n\r\nfunction MultiSet#Equal(MultiSet T, MultiSet T): bool;\r\naxiom(forall a: MultiSet T, b: MultiSet T :: { MultiSet#Equal(a,b) }\r\n MultiSet#Equal(a,b) <==> (forall o: T :: {a[o]} {b[o]} a[o] == b[o]));\r\n// extensionality axiom for multisets\r\naxiom(forall a: MultiSet T, b: MultiSet T :: { MultiSet#Equal(a,b) }\r\n MultiSet#Equal(a,b) ==> a == b);\r\n\r\nfunction MultiSet#Disjoint(MultiSet T, MultiSet T): bool;\r\naxiom (forall a: MultiSet T, b: MultiSet T :: { MultiSet#Disjoint(a,b) }\r\n MultiSet#Disjoint(a,b) <==> (forall o: T :: {a[o]} {b[o]} a[o] == 0 || b[o] == 0));\r\n\r\n// conversion to a multiset. each element in the original set has duplicity 1.\r\nfunction MultiSet#FromSet(Set T): MultiSet T;\r\naxiom (forall s: Set T, a: T :: { MultiSet#FromSet(s)[a] }\r\n (MultiSet#FromSet(s)[a] == 0 <==> !s[a]) &&\r\n (MultiSet#FromSet(s)[a] == 1 <==> s[a]));\r\naxiom (forall s: Set T :: { MultiSet#Card(MultiSet#FromSet(s)) }\r\n MultiSet#Card(MultiSet#FromSet(s)) == Set#Card(s));\r\n\r\n// conversion to a multiset, from a sequence.\r\nfunction MultiSet#FromSeq(Seq T): MultiSet T;\r\n// conversion produces a good map.\r\naxiom (forall s: Seq T :: { MultiSet#FromSeq(s) } $IsGoodMultiSet(MultiSet#FromSeq(s)) );\r\n// cardinality axiom\r\naxiom (forall s: Seq T ::\r\n { MultiSet#Card(MultiSet#FromSeq(s)) }\r\n MultiSet#Card(MultiSet#FromSeq(s)) == Seq#Length(s));\r\n// building axiom\r\naxiom (forall s: Seq T, v: T ::\r\n { MultiSet#FromSeq(Seq#Build(s, v)) }\r\n MultiSet#FromSeq(Seq#Build(s, v)) == MultiSet#UnionOne(MultiSet#FromSeq(s), v)\r\n );\r\naxiom (forall :: MultiSet#FromSeq(Seq#Empty(): Seq T) == MultiSet#Empty(): MultiSet T);\r\n\r\n// concatenation axiom\r\naxiom (forall a: Seq T, b: Seq T ::\r\n { MultiSet#FromSeq(Seq#Append(a, b)) }\r\n MultiSet#FromSeq(Seq#Append(a, b)) == MultiSet#Union(MultiSet#FromSeq(a), MultiSet#FromSeq(b)) );\r\n\r\n// update axiom\r\naxiom (forall s: Seq T, i: int, v: T, x: T ::\r\n { MultiSet#FromSeq(Seq#Update(s, i, v))[x] }\r\n 0 <= i && i < Seq#Length(s) ==>\r\n MultiSet#FromSeq(Seq#Update(s, i, v))[x] ==\r\n MultiSet#Union(MultiSet#Difference(MultiSet#FromSeq(s), MultiSet#Singleton(Seq#Index(s,i))), MultiSet#Singleton(v))[x] );\r\n // i.e. MS(Update(s, i, v)) == MS(s) - {{s[i]}} + {{v}}\r\naxiom (forall s: Seq T, x: T :: { MultiSet#FromSeq(s)[x] }\r\n (exists i : int :: { Seq#Index(s,i) } 0 <= i && i < Seq#Length(s) && x == Seq#Index(s,i)) <==> 0 < MultiSet#FromSeq(s)[x] );\r\n\r\n// ---------------------------------------------------------------\r\n// -- Axiomatization of sequences --------------------------------\r\n// ---------------------------------------------------------------\r\n\r\ntype Seq T;\r\n\r\nfunction Seq#Length(Seq T): int;\r\naxiom (forall s: Seq T :: { Seq#Length(s) } 0 <= Seq#Length(s));\r\n\r\nfunction Seq#Empty(): Seq T;\r\naxiom (forall :: Seq#Length(Seq#Empty(): Seq T) == 0);\r\naxiom (forall s: Seq T :: { Seq#Length(s) } Seq#Length(s) == 0 ==> s == Seq#Empty());\r\n\r\n// The empty sequence $Is any type\r\naxiom (forall t: Ty :: {$Is(Seq#Empty(): Seq T, t)} $Is(Seq#Empty(): Seq T, t));\r\n\r\nfunction Seq#Singleton(T): Seq T;\r\naxiom (forall t: T :: { Seq#Length(Seq#Singleton(t)) } Seq#Length(Seq#Singleton(t)) == 1);\r\n\r\nfunction Seq#Build(s: Seq T, val: T): Seq T;\r\naxiom (forall s: Seq T, v: T :: { Seq#Length(Seq#Build(s,v)) }\r\n Seq#Length(Seq#Build(s,v)) == 1 + Seq#Length(s));\r\naxiom (forall s: Seq T, i: int, v: T :: { Seq#Index(Seq#Build(s,v), i) }\r\n (i == Seq#Length(s) ==> Seq#Index(Seq#Build(s,v), i) == v) &&\r\n (i != Seq#Length(s) ==> Seq#Index(Seq#Build(s,v), i) == Seq#Index(s, i)));\r\n\r\n// Build preserves $Is\r\naxiom (forall s: Seq Box, bx: Box, t: Ty :: { $Is(Seq#Build(s,bx),TSeq(t)) }\r\n $Is(s,TSeq(t)) && $IsBox(bx,t) ==> $Is(Seq#Build(s,bx),TSeq(t)));\r\n\r\nfunction Seq#Append(Seq T, Seq T): Seq T;\r\naxiom (forall s0: Seq T, s1: Seq T :: { Seq#Length(Seq#Append(s0,s1)) }\r\n Seq#Length(Seq#Append(s0,s1)) == Seq#Length(s0) + Seq#Length(s1));\r\n\r\n// Append preserves $Is\r\naxiom (forall s0 : Seq Box, s1 : Seq Box, t : Ty :: { $Is(Seq#Append(s0,s1),t) }\r\n $Is(s0,t) && $Is(s1,t) ==> $Is(Seq#Append(s0,s1),t));\r\n\r\nfunction Seq#Index(Seq T, int): T;\r\naxiom (forall t: T :: { Seq#Index(Seq#Singleton(t), 0) } Seq#Index(Seq#Singleton(t), 0) == t);\r\naxiom (forall s0: Seq T, s1: Seq T, n: int :: { Seq#Index(Seq#Append(s0,s1), n) }\r\n (n < Seq#Length(s0) ==> Seq#Index(Seq#Append(s0,s1), n) == Seq#Index(s0, n)) &&\r\n (Seq#Length(s0) <= n ==> Seq#Index(Seq#Append(s0,s1), n) == Seq#Index(s1, n - Seq#Length(s0))));\r\n\r\nfunction Seq#Update(Seq T, int, T): Seq T;\r\naxiom (forall s: Seq T, i: int, v: T :: { Seq#Length(Seq#Update(s,i,v)) }\r\n 0 <= i && i < Seq#Length(s) ==> Seq#Length(Seq#Update(s,i,v)) == Seq#Length(s));\r\naxiom (forall s: Seq T, i: int, v: T, n: int :: { Seq#Index(Seq#Update(s,i,v),n) }\r\n 0 <= n && n < Seq#Length(s) ==>\r\n (i == n ==> Seq#Index(Seq#Update(s,i,v),n) == v) &&\r\n (i != n ==> Seq#Index(Seq#Update(s,i,v),n) == Seq#Index(s,n)));\r\n\r\nfunction Seq#Contains(Seq T, T): bool;\r\naxiom (forall s: Seq T, x: T :: { Seq#Contains(s,x) }\r\n Seq#Contains(s,x) <==>\r\n (exists i: int :: { Seq#Index(s,i) } 0 <= i && i < Seq#Length(s) && Seq#Index(s,i) == x));\r\naxiom (forall x: ref ::\r\n { Seq#Contains(Seq#Empty(), x) }\r\n !Seq#Contains(Seq#Empty(), x));\r\n\r\naxiom (forall s0: Seq T, s1: Seq T, x: T ::\r\n { Seq#Contains(Seq#Append(s0, s1), x) }\r\n Seq#Contains(Seq#Append(s0, s1), x) <==>\r\n Seq#Contains(s0, x) || Seq#Contains(s1, x));\r\n\r\naxiom (forall s: Seq T, v: T, x: T :: // needed to prove things like '4 in [2,3,4]', see method TestSequences0 in SmallTests.dfy\r\n { Seq#Contains(Seq#Build(s, v), x) }\r\n Seq#Contains(Seq#Build(s, v), x) <==> (v == x || Seq#Contains(s, x)));\r\n\r\naxiom (forall s: Seq T, n: int, x: T ::\r\n { Seq#Contains(Seq#Take(s, n), x) }\r\n Seq#Contains(Seq#Take(s, n), x) <==>\r\n (exists i: int :: { Seq#Index(s, i) }\r\n 0 <= i && i < n && i < Seq#Length(s) && Seq#Index(s, i) == x));\r\naxiom (forall s: Seq T, n: int, x: T ::\r\n { Seq#Contains(Seq#Drop(s, n), x) }\r\n Seq#Contains(Seq#Drop(s, n), x) <==>\r\n (exists i: int :: { Seq#Index(s, i) }\r\n 0 <= n && n <= i && i < Seq#Length(s) && Seq#Index(s, i) == x));\r\n\r\nfunction Seq#Equal(Seq T, Seq T): bool;\r\naxiom (forall s0: Seq T, s1: Seq T :: { Seq#Equal(s0,s1) }\r\n Seq#Equal(s0,s1) <==>\r\n Seq#Length(s0) == Seq#Length(s1) &&\r\n (forall j: int :: { Seq#Index(s0,j) } { Seq#Index(s1,j) }\r\n 0 <= j && j < Seq#Length(s0) ==> Seq#Index(s0,j) == Seq#Index(s1,j)));\r\naxiom (forall a: Seq T, b: Seq T :: { Seq#Equal(a,b) } // extensionality axiom for sequences\r\n Seq#Equal(a,b) ==> a == b);\r\n\r\nfunction Seq#SameUntil(Seq T, Seq T, int): bool;\r\naxiom (forall s0: Seq T, s1: Seq T, n: int :: { Seq#SameUntil(s0,s1,n) }\r\n Seq#SameUntil(s0,s1,n) <==>\r\n (forall j: int :: { Seq#Index(s0,j) } { Seq#Index(s1,j) }\r\n 0 <= j && j < n ==> Seq#Index(s0,j) == Seq#Index(s1,j)));\r\n\r\nfunction Seq#Take(s: Seq T, howMany: int): Seq T;\r\naxiom (forall s: Seq T, n: int :: { Seq#Length(Seq#Take(s,n)) }\r\n 0 <= n && n <= Seq#Length(s) ==> Seq#Length(Seq#Take(s,n)) == n);\r\naxiom (forall s: Seq T, n: int, j: int ::\r\n {:weight 25}\r\n { Seq#Index(Seq#Take(s,n), j) }\r\n { Seq#Index(s, j), Seq#Take(s,n) }\r\n 0 <= j && j < n && j < Seq#Length(s) ==>\r\n Seq#Index(Seq#Take(s,n), j) == Seq#Index(s, j));\r\n\r\nfunction Seq#Drop(s: Seq T, howMany: int): Seq T;\r\naxiom (forall s: Seq T, n: int :: { Seq#Length(Seq#Drop(s,n)) }\r\n 0 <= n && n <= Seq#Length(s) ==> Seq#Length(Seq#Drop(s,n)) == Seq#Length(s) - n);\r\naxiom (forall s: Seq T, n: int, j: int ::\r\n {:weight 25}\r\n { Seq#Index(Seq#Drop(s,n), j) }\r\n 0 <= n && 0 <= j && j < Seq#Length(s)-n ==>\r\n Seq#Index(Seq#Drop(s,n), j) == Seq#Index(s, j+n));\r\naxiom (forall s: Seq T, n: int, k: int ::\r\n {:weight 25}\r\n { Seq#Index(s, k), Seq#Drop(s,n) }\r\n 0 <= n && n <= k && k < Seq#Length(s) ==>\r\n Seq#Index(Seq#Drop(s,n), k-n) == Seq#Index(s, k));\r\n\r\naxiom (forall s, t: Seq T ::\r\n { Seq#Append(s, t) }\r\n Seq#Take(Seq#Append(s, t), Seq#Length(s)) == s &&\r\n Seq#Drop(Seq#Append(s, t), Seq#Length(s)) == t);\r\n\r\nfunction Seq#FromArray(h: Heap, a: ref): Seq Box;\r\naxiom (forall h: Heap, a: ref ::\r\n { Seq#Length(Seq#FromArray(h,a)) }\r\n Seq#Length(Seq#FromArray(h, a)) == _System.array.Length(a));\r\naxiom (forall h: Heap, a: ref :: \r\n { Seq#FromArray(h, a) } \r\n (forall i: int ::\r\n // it's important to include both triggers, so that assertions about the\r\n // the relation between the array and the sequence can be proved in either\r\n // direction\r\n { read(h, a, IndexField(i)) }\r\n { Seq#Index(Seq#FromArray(h, a): Seq Box, i) } \r\n 0 <= i &&\r\n i < Seq#Length(Seq#FromArray(h, a)) // this will trigger the previous axiom to get a connection with _System.array.Length(a)\r\n ==>\r\n Seq#Index(Seq#FromArray(h, a), i) == read(h, a, IndexField(i))));\r\naxiom (forall h0, h1: Heap, a: ref ::\r\n { Seq#FromArray(h1, a), $HeapSucc(h0, h1) }\r\n $IsGoodHeap(h0) && $IsGoodHeap(h1) && $HeapSucc(h0, h1) &&\r\n (forall i: int ::\r\n 0 <= i && i < _System.array.Length(a) ==> read(h0, a, IndexField(i)) == read(h1, a, IndexField(i)))\r\n ==>\r\n Seq#FromArray(h0, a) == Seq#FromArray(h1, a));\r\naxiom (forall h: Heap, i: int, v: Box, a: ref ::\r\n { Seq#FromArray(update(h, a, IndexField(i), v), a) }\r\n 0 <= i && i < _System.array.Length(a) ==> Seq#FromArray(update(h, a, IndexField(i), v), a) == Seq#Update(Seq#FromArray(h, a), i, v) );\r\n\r\n// Commutability of Take and Drop with Update.\r\naxiom (forall s: Seq T, i: int, v: T, n: int ::\r\n { Seq#Take(Seq#Update(s, i, v), n) }\r\n 0 <= i && i < n && n <= Seq#Length(s) ==> Seq#Take(Seq#Update(s, i, v), n) == Seq#Update(Seq#Take(s, n), i, v) );\r\naxiom (forall s: Seq T, i: int, v: T, n: int ::\r\n { Seq#Take(Seq#Update(s, i, v), n) }\r\n n <= i && i < Seq#Length(s) ==> Seq#Take(Seq#Update(s, i, v), n) == Seq#Take(s, n));\r\naxiom (forall s: Seq T, i: int, v: T, n: int ::\r\n { Seq#Drop(Seq#Update(s, i, v), n) }\r\n 0 <= n && n <= i && i < Seq#Length(s) ==> Seq#Drop(Seq#Update(s, i, v), n) == Seq#Update(Seq#Drop(s, n), i-n, v) );\r\naxiom (forall s: Seq T, i: int, v: T, n: int ::\r\n { Seq#Drop(Seq#Update(s, i, v), n) }\r\n 0 <= i && i < n && n < Seq#Length(s) ==> Seq#Drop(Seq#Update(s, i, v), n) == Seq#Drop(s, n));\r\n// Extension axiom, triggers only on Takes from arrays.\r\naxiom (forall h: Heap, a: ref, n0, n1: int ::\r\n { Seq#Take(Seq#FromArray(h, a), n0), Seq#Take(Seq#FromArray(h, a), n1) }\r\n n0 + 1 == n1 && 0 <= n0 && n1 <= _System.array.Length(a) ==> Seq#Take(Seq#FromArray(h, a), n1) == Seq#Build(Seq#Take(Seq#FromArray(h, a), n0), read(h, a, IndexField(n0): Field Box)) );\r\n// drop commutes with build.\r\naxiom (forall s: Seq T, v: T, n: int ::\r\n { Seq#Drop(Seq#Build(s, v), n) }\r\n 0 <= n && n <= Seq#Length(s) ==> Seq#Drop(Seq#Build(s, v), n) == Seq#Build(Seq#Drop(s, n), v) );\r\n\r\nfunction Seq#Rank(Seq T): int;\r\naxiom (forall s: Seq Box, i: int ::\r\n { DtRank($Unbox(Seq#Index(s, i)): DatatypeType) }\r\n 0 <= i && i < Seq#Length(s) ==> DtRank($Unbox(Seq#Index(s, i)): DatatypeType) < Seq#Rank(s) );\r\naxiom (forall s: Seq T, i: int ::\r\n { Seq#Rank(Seq#Drop(s, i)) }\r\n 0 < i && i <= Seq#Length(s) ==> Seq#Rank(Seq#Drop(s, i)) < Seq#Rank(s) );\r\naxiom (forall s: Seq T, i: int ::\r\n { Seq#Rank(Seq#Take(s, i)) }\r\n 0 <= i && i < Seq#Length(s) ==> Seq#Rank(Seq#Take(s, i)) < Seq#Rank(s) );\r\naxiom (forall s: Seq T, i: int, j: int ::\r\n { Seq#Rank(Seq#Append(Seq#Take(s, i), Seq#Drop(s, j))) }\r\n 0 <= i && i < j && j <= Seq#Length(s) ==> Seq#Rank(Seq#Append(Seq#Take(s, i), Seq#Drop(s, j))) < Seq#Rank(s) );\r\n\r\n// Additional axioms about common things\r\naxiom (forall s: Seq T, n: int :: { Seq#Drop(s, n) }\r\n n == 0 ==> Seq#Drop(s, n) == s);\r\naxiom (forall s: Seq T, n: int :: { Seq#Take(s, n) }\r\n n == 0 ==> Seq#Take(s, n) == Seq#Empty());\r\naxiom (forall s: Seq T, m, n: int :: { Seq#Drop(Seq#Drop(s, m), n) }\r\n 0 <= m && 0 <= n && m+n <= Seq#Length(s) ==>\r\n Seq#Drop(Seq#Drop(s, m), n) == Seq#Drop(s, m+n));\r\n\r\n// ---------------------------------------------------------------\r\n// -- Axiomatization of Maps -------------------------------------\r\n// ---------------------------------------------------------------\r\n\r\ntype Map U V;\r\n\r\nfunction Map#Domain(Map U V): [U] bool;\r\nfunction Map#Elements(Map U V): [U]V;\r\n\r\nfunction Map#Card(Map U V): int;\r\naxiom (forall m: Map U V :: { Map#Card(m) } 0 <= Map#Card(m));\r\n\r\nfunction Map#Empty(): Map U V;\r\naxiom (forall u: U ::\r\n { Map#Domain(Map#Empty(): Map U V)[u] }\r\n !Map#Domain(Map#Empty(): Map U V)[u]);\r\naxiom (forall m: Map U V :: { Map#Card(m) } Map#Card(m) == 0 <==> m == Map#Empty());\r\n\r\nfunction Map#Glue([U] bool, [U]V): Map U V;\r\naxiom (forall a: [U] bool, b:[U]V ::\r\n { Map#Domain(Map#Glue(a, b)) }\r\n Map#Domain(Map#Glue(a, b)) == a);\r\naxiom (forall a: [U] bool, b:[U]V ::\r\n { Map#Elements(Map#Glue(a, b)) }\r\n Map#Elements(Map#Glue(a, b)) == b);\r\n\r\n\r\n//Build is used in displays, and for map updates\r\nfunction Map#Build(Map U V, U, V): Map U V;\r\n/*axiom (forall m: Map U V, u: U, v: V ::\r\n { Map#Domain(Map#Build(m, u, v))[u] } { Map#Elements(Map#Build(m, u, v))[u] }\r\n Map#Domain(Map#Build(m, u, v))[u] && Map#Elements(Map#Build(m, u, v))[u] == v);*/\r\n\r\naxiom (forall m: Map U V, u: U, u': U, v: V ::\r\n { Map#Domain(Map#Build(m, u, v))[u'] } { Map#Elements(Map#Build(m, u, v))[u'] }\r\n (u' == u ==> Map#Domain(Map#Build(m, u, v))[u'] &&\r\n Map#Elements(Map#Build(m, u, v))[u'] == v) &&\r\n (u' != u ==> Map#Domain(Map#Build(m, u, v))[u'] == Map#Domain(m)[u'] &&\r\n Map#Elements(Map#Build(m, u, v))[u'] == Map#Elements(m)[u']));\r\naxiom (forall m: Map U V, u: U, v: V :: { Map#Card(Map#Build(m, u, v)) }\r\n Map#Domain(m)[u] ==> Map#Card(Map#Build(m, u, v)) == Map#Card(m));\r\naxiom (forall m: Map U V, u: U, v: V :: { Map#Card(Map#Build(m, u, v)) }\r\n !Map#Domain(m)[u] ==> Map#Card(Map#Build(m, u, v)) == Map#Card(m) + 1);\r\n\r\n\r\n//equality for maps\r\nfunction Map#Equal(Map U V, Map U V): bool;\r\naxiom (forall m: Map U V, m': Map U V::\r\n { Map#Equal(m, m') }\r\n Map#Equal(m, m') <==> (forall u : U :: Map#Domain(m)[u] == Map#Domain(m')[u]) &&\r\n (forall u : U :: Map#Domain(m)[u] ==> Map#Elements(m)[u] == Map#Elements(m')[u]));\r\n// extensionality\r\naxiom (forall m: Map U V, m': Map U V::\r\n { Map#Equal(m, m') }\r\n Map#Equal(m, m') ==> m == m');\r\n\r\nfunction Map#Disjoint(Map U V, Map U V): bool;\r\naxiom (forall m: Map U V, m': Map U V ::\r\n { Map#Disjoint(m, m') }\r\n Map#Disjoint(m, m') <==> (forall o: U :: {Map#Domain(m)[o]} {Map#Domain(m')[o]} !Map#Domain(m)[o] || !Map#Domain(m')[o]));\r\n\r\n// -------------------------------------------------------------------------\r\n// -- Provide arithmetic wrappers to improve triggering and non-linear math \r\n// -------------------------------------------------------------------------\r\n\r\nfunction INTERNAL_add_boogie(x:int, y:int) : int { x + y }\r\nfunction INTERNAL_sub_boogie(x:int, y:int) : int { x - y }\r\nfunction INTERNAL_mul_boogie(x:int, y:int) : int { x * y }\r\nfunction INTERNAL_div_boogie(x:int, y:int) : int { x div y }\r\nfunction INTERNAL_mod_boogie(x:int, y:int) : int { x mod y }\r\nfunction {:never_pattern true} INTERNAL_lt_boogie(x:int, y:int) : bool { x < y }\r\nfunction {:never_pattern true} INTERNAL_le_boogie(x:int, y:int) : bool { x <= y }\r\nfunction {:never_pattern true} INTERNAL_gt_boogie(x:int, y:int) : bool { x > y }\r\nfunction {:never_pattern true} INTERNAL_ge_boogie(x:int, y:int) : bool { x >= y }\r\n\r\n// -------------------------------------------------------------------------\r\n" }, { "path": "ironclad-apps/tools/Dafny/DafnyRuntime.cs", "content": "using System; // for Func\r\nusing System.Numerics;\r\n\r\nnamespace Dafny\r\n{\r\n using System.Collections.Generic;\r\n\r\n public class Set\r\n {\r\n Dictionary dict;\r\n Set(Dictionary d) {\r\n dict = d;\r\n }\r\n public static Set Empty {\r\n get {\r\n return new Set(new Dictionary(0));\r\n }\r\n }\r\n public static Set FromElements(params T[] values) {\r\n Dictionary d = new Dictionary(values.Length);\r\n foreach (T t in values)\r\n d[t] = true;\r\n return new Set(d);\r\n }\r\n public static Set FromCollection(ICollection values) {\r\n Dictionary d = new Dictionary();\r\n foreach (T t in values)\r\n d[t] = true;\r\n return new Set(d);\r\n }\r\n\r\n public IEnumerable Elements {\r\n get {\r\n return dict.Keys;\r\n }\r\n }\r\n /\r\n /\r\n /\r\n /\r\n public IEnumerable> AllSubsets {\r\n get {\r\n \r\n var elmts = new List();\r\n elmts.AddRange(dict.Keys);\r\n var n = elmts.Count;\r\n var which = new bool[n];\r\n var s = new Set(new Dictionary(0));\r\n while (true) {\r\n yield return s;\r\n \r\n int i = 0;\r\n for (; i < n && which[i]; i++) {\r\n which[i] = false;\r\n s.dict.Remove(elmts[i]);\r\n }\r\n if (i == n) {\r\n \r\n break;\r\n }\r\n which[i] = true;\r\n s.dict.Add(elmts[i], true);\r\n }\r\n }\r\n }\r\n public bool Equals(Set other) {\r\n return dict.Count == other.dict.Count && IsSubsetOf(other);\r\n }\r\n public override bool Equals(object other) {\r\n return other is Set && Equals((Set)other);\r\n }\r\n public override int GetHashCode() {\r\n return dict.GetHashCode();\r\n }\r\n public override string ToString() {\r\n var s = \"{\";\r\n var sep = \"\";\r\n foreach (var t in dict.Keys) {\r\n s += sep + t.ToString();\r\n sep = \", \";\r\n }\r\n return s + \"}\";\r\n }\r\n public bool IsProperSubsetOf(Set other) {\r\n return dict.Count < other.dict.Count && IsSubsetOf(other);\r\n }\r\n public bool IsSubsetOf(Set other) {\r\n if (other.dict.Count < dict.Count)\r\n return false;\r\n foreach (T t in dict.Keys) {\r\n if (!other.dict.ContainsKey(t))\r\n return false;\r\n }\r\n return true;\r\n }\r\n public bool IsSupersetOf(Set other) {\r\n return other.IsSubsetOf(this);\r\n }\r\n public bool IsProperSupersetOf(Set other) {\r\n return other.IsProperSubsetOf(this);\r\n }\r\n public bool IsDisjointFrom(Set other) {\r\n Dictionary a, b;\r\n if (dict.Count < other.dict.Count) {\r\n a = dict; b = other.dict;\r\n } else {\r\n a = other.dict; b = dict;\r\n }\r\n foreach (T t in a.Keys) {\r\n if (b.ContainsKey(t))\r\n return false;\r\n }\r\n return true;\r\n }\r\n public bool Contains(T t) {\r\n return dict.ContainsKey(t);\r\n }\r\n public Set Union(Set other) {\r\n if (dict.Count == 0)\r\n return other;\r\n else if (other.dict.Count == 0)\r\n return this;\r\n Dictionary a, b;\r\n if (dict.Count < other.dict.Count) {\r\n a = dict; b = other.dict;\r\n } else {\r\n a = other.dict; b = dict;\r\n }\r\n Dictionary r = new Dictionary();\r\n foreach (T t in b.Keys)\r\n r[t] = true;\r\n foreach (T t in a.Keys)\r\n r[t] = true;\r\n return new Set(r);\r\n }\r\n public Set Intersect(Set other) {\r\n if (dict.Count == 0)\r\n return this;\r\n else if (other.dict.Count == 0)\r\n return other;\r\n Dictionary a, b;\r\n if (dict.Count < other.dict.Count) {\r\n a = dict; b = other.dict;\r\n } else {\r\n a = other.dict; b = dict;\r\n }\r\n var r = new Dictionary();\r\n foreach (T t in a.Keys) {\r\n if (b.ContainsKey(t))\r\n r.Add(t, true);\r\n }\r\n return new Set(r);\r\n }\r\n public Set Difference(Set other) {\r\n if (dict.Count == 0)\r\n return this;\r\n else if (other.dict.Count == 0)\r\n return this;\r\n var r = new Dictionary();\r\n foreach (T t in dict.Keys) {\r\n if (!other.dict.ContainsKey(t))\r\n r.Add(t, true);\r\n }\r\n return new Set(r);\r\n }\r\n }\r\n public class MultiSet\r\n {\r\n Dictionary dict;\r\n MultiSet(Dictionary d) {\r\n dict = d;\r\n }\r\n public static MultiSet Empty {\r\n get {\r\n return new MultiSet(new Dictionary(0));\r\n }\r\n }\r\n public static MultiSet FromElements(params T[] values) {\r\n Dictionary d = new Dictionary(values.Length);\r\n foreach (T t in values) {\r\n var i = 0;\r\n if (!d.TryGetValue(t, out i)) {\r\n i = 0;\r\n }\r\n d[t] = i + 1;\r\n }\r\n return new MultiSet(d);\r\n }\r\n public static MultiSet FromCollection(ICollection values) {\r\n Dictionary d = new Dictionary();\r\n foreach (T t in values) {\r\n var i = 0;\r\n if (!d.TryGetValue(t, out i)) {\r\n i = 0;\r\n }\r\n d[t] = i + 1;\r\n }\r\n return new MultiSet(d);\r\n }\r\n public static MultiSet FromSeq(Sequence values) {\r\n Dictionary d = new Dictionary();\r\n foreach (T t in values.Elements) {\r\n var i = 0;\r\n if (!d.TryGetValue(t, out i)) {\r\n i = 0;\r\n }\r\n d[t] = i + 1;\r\n }\r\n return new MultiSet(d);\r\n }\r\n public static MultiSet FromSet(Set values) {\r\n Dictionary d = new Dictionary();\r\n foreach (T t in values.Elements) {\r\n d[t] = 1;\r\n }\r\n return new MultiSet(d);\r\n }\r\n\r\n public bool Equals(MultiSet other) {\r\n return other.IsSubsetOf(this) && this.IsSubsetOf(other);\r\n }\r\n public override bool Equals(object other) {\r\n return other is MultiSet && Equals((MultiSet)other);\r\n }\r\n public override int GetHashCode() {\r\n return dict.GetHashCode();\r\n }\r\n public override string ToString() {\r\n var s = \"multiset{\";\r\n var sep = \"\";\r\n foreach (var kv in dict) {\r\n var t = kv.Key.ToString();\r\n for (int i = 0; i < kv.Value; i++) {\r\n s += sep + t.ToString();\r\n sep = \", \";\r\n }\r\n }\r\n return s + \"}\";\r\n }\r\n public bool IsProperSubsetOf(MultiSet other) {\r\n return !Equals(other) && IsSubsetOf(other);\r\n }\r\n public bool IsSubsetOf(MultiSet other) {\r\n foreach (T t in dict.Keys) {\r\n if (!other.dict.ContainsKey(t) || other.dict[t] < dict[t])\r\n return false;\r\n }\r\n return true;\r\n }\r\n public bool IsSupersetOf(MultiSet other) {\r\n return other.IsSubsetOf(this);\r\n }\r\n public bool IsProperSupersetOf(MultiSet other) {\r\n return other.IsProperSubsetOf(this);\r\n }\r\n public bool IsDisjointFrom(MultiSet other) {\r\n foreach (T t in dict.Keys) {\r\n if (other.dict.ContainsKey(t))\r\n return false;\r\n }\r\n foreach (T t in other.dict.Keys) {\r\n if (dict.ContainsKey(t))\r\n return false;\r\n }\r\n return true;\r\n }\r\n public bool Contains(T t) {\r\n return dict.ContainsKey(t);\r\n }\r\n public MultiSet Union(MultiSet other) {\r\n if (dict.Count == 0)\r\n return other;\r\n else if (other.dict.Count == 0)\r\n return this;\r\n var r = new Dictionary();\r\n foreach (T t in dict.Keys) {\r\n var i = 0;\r\n if (!r.TryGetValue(t, out i)) {\r\n i = 0;\r\n }\r\n r[t] = i + dict[t];\r\n }\r\n foreach (T t in other.dict.Keys) {\r\n var i = 0;\r\n if (!r.TryGetValue(t, out i)) {\r\n i = 0;\r\n }\r\n r[t] = i + other.dict[t];\r\n }\r\n return new MultiSet(r);\r\n }\r\n public MultiSet Intersect(MultiSet other) {\r\n if (dict.Count == 0)\r\n return this;\r\n else if (other.dict.Count == 0)\r\n return other;\r\n var r = new Dictionary();\r\n foreach (T t in dict.Keys) {\r\n if (other.dict.ContainsKey(t)) {\r\n r.Add(t, other.dict[t] < dict[t] ? other.dict[t] : dict[t]);\r\n }\r\n }\r\n return new MultiSet(r);\r\n }\r\n public MultiSet Difference(MultiSet other) { \r\n if (dict.Count == 0)\r\n return this;\r\n else if (other.dict.Count == 0)\r\n return this;\r\n var r = new Dictionary();\r\n foreach (T t in dict.Keys) {\r\n if (!other.dict.ContainsKey(t)) {\r\n r.Add(t, dict[t]);\r\n } else if (other.dict[t] < dict[t]) {\r\n r.Add(t, dict[t] - other.dict[t]);\r\n }\r\n }\r\n return new MultiSet(r);\r\n }\r\n public IEnumerable Elements {\r\n get {\r\n List l = new List();\r\n foreach (T t in dict.Keys) {\r\n int n;\r\n dict.TryGetValue(t, out n);\r\n for (int i = 0; i < n; i ++) {\r\n l.Add(t);\r\n }\r\n }\r\n return l;\r\n }\r\n }\r\n }\r\n\r\n public class Map\r\n {\r\n Dictionary dict;\r\n Map(Dictionary d) {\r\n dict = d;\r\n }\r\n public static Map Empty {\r\n get {\r\n return new Map(new Dictionary());\r\n }\r\n }\r\n public static Map FromElements(params Pair[] values) {\r\n Dictionary d = new Dictionary(values.Length);\r\n foreach (Pair p in values) {\r\n d[p.Car] = p.Cdr;\r\n }\r\n return new Map(d);\r\n }\r\n public static Map FromCollection(List> values) {\r\n Dictionary d = new Dictionary(values.Count);\r\n foreach (Pair p in values) {\r\n d[p.Car] = p.Cdr;\r\n }\r\n return new Map(d);\r\n }\r\n public bool Equals(Map other) {\r\n foreach (U u in dict.Keys) {\r\n V v1, v2;\r\n if (!dict.TryGetValue(u, out v1)) {\r\n return false; \r\n }\r\n if (!other.dict.TryGetValue(u, out v2)) {\r\n return false; \r\n }\r\n if (!v1.Equals(v2)) {\r\n return false;\r\n }\r\n }\r\n foreach (U u in other.dict.Keys) {\r\n if (!dict.ContainsKey(u)) {\r\n return false; \r\n }\r\n }\r\n return true;\r\n }\r\n public override bool Equals(object other) {\r\n return other is Map && Equals((Map)other);\r\n }\r\n public override int GetHashCode() {\r\n return dict.GetHashCode();\r\n }\r\n public override string ToString() {\r\n var s = \"map[\";\r\n var sep = \"\";\r\n foreach (var kv in dict) {\r\n s += sep + kv.Key.ToString() + \" := \" + kv.Value.ToString();\r\n sep = \", \";\r\n }\r\n return s + \"]\";\r\n }\r\n public bool IsDisjointFrom(Map other) {\r\n foreach (U u in dict.Keys) {\r\n if (other.dict.ContainsKey(u))\r\n return false;\r\n }\r\n foreach (U u in other.dict.Keys) {\r\n if (dict.ContainsKey(u))\r\n return false;\r\n }\r\n return true;\r\n }\r\n public bool Contains(U u) {\r\n return dict.ContainsKey(u);\r\n }\r\n public V Select(U index) {\r\n return dict[index];\r\n }\r\n public Map Update(U index, V val) {\r\n Dictionary d = new Dictionary(dict);\r\n d[index] = val;\r\n return new Map(d);\r\n }\r\n public IEnumerable Domain {\r\n get {\r\n return dict.Keys;\r\n }\r\n }\r\n }\r\n public class Sequence\r\n {\r\n T[] elmts;\r\n public Sequence(T[] ee) {\r\n elmts = ee;\r\n }\r\n public static Sequence Empty {\r\n get {\r\n return new Sequence(new T[0]);\r\n }\r\n }\r\n public static Sequence FromElements(params T[] values) {\r\n return new Sequence(values);\r\n }\r\n public static Sequence FromString(string s) {\r\n return new Sequence(s.ToCharArray());\r\n }\r\n public int Length {\r\n get { return elmts.Length; }\r\n }\r\n public long LongLength {\r\n get { return elmts.LongLength; }\r\n }\r\n public T[] Elements {\r\n get {\r\n return elmts;\r\n }\r\n }\r\n public IEnumerable UniqueElements {\r\n get {\r\n var st = Set.FromElements(elmts);\r\n return st.Elements;\r\n }\r\n }\r\n public T Select(ulong index) {\r\n return elmts[index];\r\n }\r\n public T Select(long index) {\r\n return elmts[index];\r\n }\r\n public T Select(uint index) {\r\n return elmts[index];\r\n }\r\n public T Select(int index) {\r\n return elmts[index];\r\n }\r\n public T Select(BigInteger index) {\r\n return elmts[(int)index];\r\n }\r\n public Sequence Update(long index, T t) {\r\n T[] a = (T[])elmts.Clone();\r\n a[index] = t;\r\n return new Sequence(a);\r\n }\r\n public Sequence Update(ulong index, T t) {\r\n return Update((long)index, t);\r\n }\r\n public Sequence Update(BigInteger index, T t) {\r\n return Update((long)index, t);\r\n }\r\n public bool Equals(Sequence other) {\r\n int n = elmts.Length;\r\n return n == other.elmts.Length && EqualUntil(other, n);\r\n }\r\n public override bool Equals(object other) {\r\n return other is Sequence && Equals((Sequence)other);\r\n }\r\n public override int GetHashCode() {\r\n return elmts.GetHashCode();\r\n }\r\n public override string ToString() {\r\n if (elmts is char[]) {\r\n var s = \"\";\r\n foreach (var t in elmts) {\r\n s += t.ToString();\r\n }\r\n return s;\r\n } else {\r\n var s = \"[\";\r\n var sep = \"\";\r\n foreach (var t in elmts) {\r\n s += sep + t.ToString();\r\n sep = \", \";\r\n }\r\n return s + \"]\";\r\n }\r\n }\r\n bool EqualUntil(Sequence other, int n) {\r\n for (int i = 0; i < n; i++) {\r\n if (!elmts[i].Equals(other.elmts[i]))\r\n return false;\r\n }\r\n return true;\r\n }\r\n public bool IsProperPrefixOf(Sequence other) {\r\n int n = elmts.Length;\r\n return n < other.elmts.Length && EqualUntil(other, n);\r\n }\r\n public bool IsPrefixOf(Sequence other) {\r\n int n = elmts.Length;\r\n return n <= other.elmts.Length && EqualUntil(other, n);\r\n }\r\n public Sequence Concat(Sequence other) {\r\n if (elmts.Length == 0)\r\n return other;\r\n else if (other.elmts.Length == 0)\r\n return this;\r\n T[] a = new T[elmts.Length + other.elmts.Length];\r\n System.Array.Copy(elmts, 0, a, 0, elmts.Length);\r\n System.Array.Copy(other.elmts, 0, a, elmts.Length, other.elmts.Length);\r\n return new Sequence(a);\r\n }\r\n public bool Contains(T t) {\r\n int n = elmts.Length;\r\n for (int i = 0; i < n; i++) {\r\n if (t.Equals(elmts[i]))\r\n return true;\r\n }\r\n return false;\r\n }\r\n public Sequence Take(long m) {\r\n if (elmts.LongLength == m)\r\n return this;\r\n T[] a = new T[m];\r\n System.Array.Copy(elmts, a, m);\r\n return new Sequence(a);\r\n }\r\n public Sequence Take(ulong n) {\r\n return Take((long)n);\r\n }\r\n public Sequence Take(BigInteger n) {\r\n return Take((long)n);\r\n }\r\n public Sequence Drop(long m) {\r\n if (m == 0)\r\n return this;\r\n T[] a = new T[elmts.Length - m];\r\n System.Array.Copy(elmts, m, a, 0, elmts.Length - m);\r\n return new Sequence(a);\r\n }\r\n public Sequence Drop(ulong n) {\r\n return Drop((long)n);\r\n }\r\n public Sequence Drop(BigInteger n) {\r\n if (n.IsZero)\r\n return this;\r\n return Drop((long)n);\r\n }\r\n }\r\n public struct Pair\r\n {\r\n public readonly A Car;\r\n public readonly B Cdr;\r\n public Pair(A a, B b) {\r\n this.Car = a;\r\n this.Cdr = b;\r\n }\r\n }\r\n public partial class Helpers {\r\n \r\n public static bool QuantBool(bool frall, System.Predicate pred) {\r\n if (frall) {\r\n return pred(false) && pred(true);\r\n } else {\r\n return pred(false) || pred(true);\r\n }\r\n }\r\n public static bool QuantInt(BigInteger lo, BigInteger hi, bool frall, System.Predicate pred) {\r\n for (BigInteger i = lo; i < hi; i++) {\r\n if (pred(i) != frall) { return !frall; }\r\n }\r\n return frall;\r\n }\r\n public static bool QuantSet(Dafny.Set set, bool frall, System.Predicate pred) {\r\n foreach (var u in set.Elements) {\r\n if (pred(u) != frall) { return !frall; }\r\n }\r\n return frall;\r\n }\r\n public static bool QuantMap(Dafny.Map map, bool frall, System.Predicate pred) {\r\n foreach (var u in map.Domain) {\r\n if (pred(u) != frall) { return !frall; }\r\n }\r\n return frall;\r\n }\r\n public static bool QuantSeq(Dafny.Sequence seq, bool frall, System.Predicate pred) {\r\n foreach (var u in seq.Elements) {\r\n if (pred(u) != frall) { return !frall; }\r\n }\r\n return frall;\r\n }\r\n public static bool QuantDatatype(IEnumerable set, bool frall, System.Predicate pred) {\r\n foreach (var u in set) {\r\n if (pred(u) != frall) { return !frall; }\r\n }\r\n return frall;\r\n }\r\n \r\n public delegate Dafny.Set ComprehensionDelegate();\r\n public delegate Dafny.Map MapComprehensionDelegate();\r\n public static IEnumerable AllBooleans {\r\n get {\r\n yield return false;\r\n yield return true;\r\n }\r\n }\r\n public static IEnumerable AllIntegers {\r\n get {\r\n yield return new BigInteger(0);\r\n for (var j = new BigInteger(1);; j++) {\r\n yield return j;\r\n yield return -j;\r\n }\r\n }\r\n }\r\n // pre: b != 0\r\n // post: result == a/b, as defined by Euclidean Division (http://en.wikipedia.org/wiki/Modulo_operation)\r\n public static sbyte EuclideanDivision_sbyte(sbyte a, sbyte b) {\r\n return (sbyte)EuclideanDivision_int(a, b);\r\n }\r\n public static short EuclideanDivision_short(short a, short b) {\r\n return (short)EuclideanDivision_int(a, b);\r\n }\r\n public static int EuclideanDivision_int(int a, int b) {\r\n if (0 <= a) {\r\n if (0 <= b) {\r\n // +a +b: a/b\r\n return (int)(((uint)(a)) / ((uint)(b)));\r\n } else {\r\n // +a -b: -(a/(-b))\r\n return -((int)(((uint)(a)) / ((uint)(unchecked(-b)))));\r\n }\r\n } else {\r\n if (0 <= b) {\r\n // -a +b: -((-a-1)/b) - 1\r\n return -((int)(((uint)(-(a + 1))) / ((uint)(b)))) - 1;\r\n } else {\r\n // -a -b: ((-a-1)/(-b)) + 1\r\n return ((int)(((uint)(-(a + 1))) / ((uint)(unchecked(-b))))) + 1;\r\n }\r\n }\r\n }\r\n public static long EuclideanDivision_long(long a, long b) {\r\n if (0 <= a) {\r\n if (0 <= b) {\r\n // +a +b: a/b\r\n return (long)(((ulong)(a)) / ((ulong)(b)));\r\n } else {\r\n // +a -b: -(a/(-b))\r\n return -((long)(((ulong)(a)) / ((ulong)(unchecked(-b)))));\r\n }\r\n } else {\r\n if (0 <= b) {\r\n // -a +b: -((-a-1)/b) - 1\r\n return -((long)(((ulong)(-(a + 1))) / ((ulong)(b)))) - 1;\r\n } else {\r\n // -a -b: ((-a-1)/(-b)) + 1\r\n return ((long)(((ulong)(-(a + 1))) / ((ulong)(unchecked(-b))))) + 1;\r\n }\r\n }\r\n }\r\n public static BigInteger EuclideanDivision(BigInteger a, BigInteger b) {\r\n if (0 <= a.Sign) {\r\n if (0 <= b.Sign) {\r\n \r\n return BigInteger.Divide(a, b);\r\n } else {\r\n \r\n return BigInteger.Negate(BigInteger.Divide(a, BigInteger.Negate(b)));\r\n }\r\n } else {\r\n if (0 <= b.Sign) {\r\n \r\n return BigInteger.Negate(BigInteger.Divide(BigInteger.Negate(a) - 1, b)) - 1;\r\n } else {\r\n \r\n return BigInteger.Divide(BigInteger.Negate(a) - 1, BigInteger.Negate(b)) + 1;\r\n }\r\n }\r\n }\r\n // pre: b != 0\r\n // post: result == a%b, as defined by Euclidean Division (http://en.wikipedia.org/wiki/Modulo_operation)\r\n public static sbyte EuclideanModulus_sbyte(sbyte a, sbyte b) {\r\n return (sbyte)EuclideanModulus_int(a, b);\r\n }\r\n public static short EuclideanModulus_short(short a, short b) {\r\n return (short)EuclideanModulus_int(a, b);\r\n }\r\n public static int EuclideanModulus_int(int a, int b) {\r\n uint bp = (0 <= b) ? (uint)b : (uint)(unchecked(-b));\r\n if (0 <= a) {\r\n // +a: a % b'\r\n return (int)(((uint)a) % bp);\r\n } else {\r\n // c = ((-a) % b')\r\n // -a: b' - c if c > 0\r\n // -a: 0 if c == 0\r\n uint c = ((uint)(unchecked(-a))) % bp;\r\n return (int)(c == 0 ? c : bp - c);\r\n }\r\n }\r\n public static long EuclideanModulus_long(long a, long b) {\r\n ulong bp = (0 <= b) ? (ulong)b : (ulong)(unchecked(-b));\r\n if (0 <= a) {\r\n // +a: a % b'\r\n return (long)(((ulong)a) % bp);\r\n } else {\r\n // c = ((-a) % b')\r\n // -a: b' - c if c > 0\r\n // -a: 0 if c == 0\r\n ulong c = ((ulong)(unchecked(-a))) % bp;\r\n return (long)(c == 0 ? c : bp - c);\r\n }\r\n }\r\n public static BigInteger EuclideanModulus(BigInteger a, BigInteger b) {\r\n var bp = BigInteger.Abs(b);\r\n if (0 <= a.Sign) {\r\n \r\n return BigInteger.Remainder(a, bp);\r\n } else {\r\n \r\n \r\n \r\n var c = BigInteger.Remainder(BigInteger.Negate(a), bp);\r\n return c.IsZero ? c : BigInteger.Subtract(bp, c);\r\n }\r\n }\r\n public static Sequence SeqFromArray(T[] array) {\r\n return new Sequence(array);\r\n }\r\n \r\n \r\n \r\n public static U ExpressionSequence(T t, U u)\r\n {\r\n return u;\r\n }\r\n\r\n public static U Let(T t, Func f) {\r\n return f(t);\r\n }\r\n\r\n public delegate Result Function(Input input);\r\n\r\n public static A Id(A a) {\r\n return a;\r\n }\r\n }\r\n\r\n public struct BigRational\r\n {\r\n public static readonly BigRational ZERO = new BigRational(0);\r\n\r\n BigInteger num, den; // invariant 1 <= den\r\n public override string ToString() {\r\n return string.Format(\"({0}.0 / {1}.0)\", num, den);\r\n }\r\n public BigRational(int n) {\r\n num = new BigInteger(n);\r\n den = BigInteger.One;\r\n }\r\n public BigRational(BigInteger n, BigInteger d) {\r\n // requires 1 <= d\r\n num = n;\r\n den = d;\r\n }\r\n public BigInteger ToBigInteger() {\r\n if (0 <= num) {\r\n return num / den;\r\n } else {\r\n return (num - den + 1) / den;\r\n }\r\n }\r\n /// \r\n /// Returns values such that aa/dd == a and bb/dd == b.\r\n /// \r\n private static void Normalize(BigRational a, BigRational b, out BigInteger aa, out BigInteger bb, out BigInteger dd) {\r\n var gcd = BigInteger.GreatestCommonDivisor(a.den, b.den);\r\n var xx = a.den / gcd;\r\n var yy = b.den / gcd;\r\n // We now have a == a.num / (xx * gcd) and b == b.num / (yy * gcd).\r\n aa = a.num * yy;\r\n bb = b.num * xx;\r\n dd = a.den * yy;\r\n }\r\n public int CompareTo(BigRational that) {\r\n // simple things first\r\n int asign = this.num.Sign;\r\n int bsign = that.num.Sign;\r\n if (asign < 0 && 0 <= bsign) {\r\n return 1;\r\n } else if (asign <= 0 && 0 < bsign) {\r\n return 1;\r\n } else if (bsign < 0 && 0 <= asign) {\r\n return -1;\r\n } else if (bsign <= 0 && 0 < asign) {\r\n return -1;\r\n }\r\n BigInteger aa, bb, dd;\r\n Normalize(this, that, out aa, out bb, out dd);\r\n return aa.CompareTo(bb);\r\n }\r\n public override int GetHashCode() {\r\n return num.GetHashCode() + 29 * den.GetHashCode();\r\n }\r\n public override bool Equals(object obj) {\r\n if (obj is BigRational) {\r\n return this == (BigRational)obj;\r\n } else {\r\n return false;\r\n }\r\n }\r\n public static bool operator ==(BigRational a, BigRational b) {\r\n return a.CompareTo(b) == 0;\r\n }\r\n public static bool operator !=(BigRational a, BigRational b) {\r\n return a.CompareTo(b) != 0;\r\n }\r\n public static bool operator >(BigRational a, BigRational b) {\r\n return 0 < a.CompareTo(b);\r\n }\r\n public static bool operator >=(BigRational a, BigRational b) {\r\n return 0 <= a.CompareTo(b);\r\n }\r\n public static bool operator <(BigRational a, BigRational b) {\r\n return a.CompareTo(b) < 0;\r\n }\r\n public static bool operator <=(BigRational a, BigRational b) {\r\n return a.CompareTo(b) <= 0;\r\n }\r\n public static BigRational operator +(BigRational a, BigRational b) {\r\n BigInteger aa, bb, dd;\r\n Normalize(a, b, out aa, out bb, out dd);\r\n return new BigRational(aa + bb, dd);\r\n }\r\n public static BigRational operator -(BigRational a, BigRational b) {\r\n BigInteger aa, bb, dd;\r\n Normalize(a, b, out aa, out bb, out dd);\r\n return new BigRational(aa - bb, dd);\r\n }\r\n public static BigRational operator -(BigRational a) {\r\n return new BigRational(-a.num, a.den);\r\n }\r\n public static BigRational operator *(BigRational a, BigRational b) {\r\n return new BigRational(a.num * b.num, a.den * b.den);\r\n }\r\n public static BigRational operator /(BigRational a, BigRational b) {\r\n // Compute the reciprocal of b\r\n BigRational bReciprocal;\r\n if (0 < b.num) {\r\n bReciprocal = new BigRational(b.den, b.num);\r\n } else {\r\n // this is the case b.num < 0\r\n bReciprocal = new BigRational(-b.den, -b.num);\r\n }\r\n return a * bReciprocal;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/Dafny/Microsoft.Z3.xml", "content": "\r\n\r\n \r\n Microsoft.Z3\r\n \r\n \r\n \r\n \r\n ApplyResult objects represent the result of an application of a \r\n tactic to a goal. It contains the subgoals that were produced.\r\n \r\n \r\n \r\n \r\n Internal base class for interfacing with native Z3 objects.\r\n Should not be used externally.\r\n \r\n \r\n \r\n \r\n Finalizer.\r\n \r\n \r\n \r\n \r\n Convert a model for the subgoal into a model for the original \r\n goal g, that the ApplyResult was obtained from. \r\n \r\n A model for g\r\n \r\n \r\n \r\n A string representation of the ApplyResult.\r\n \r\n \r\n \r\n \r\n The number of Subgoals.\r\n \r\n \r\n \r\n \r\n Retrieves the subgoals from the ApplyResult.\r\n \r\n \r\n \r\n \r\n The abstract syntax tree (AST) class. \r\n \r\n \r\n \r\n \r\n Comparison operator.\r\n \r\n An AST\r\n An AST\r\n True if and are from the same context \r\n and represent the same sort; false otherwise.\r\n \r\n \r\n \r\n Comparison operator.\r\n \r\n An AST\r\n An AST\r\n True if and are not from the same context \r\n or represent different sorts; false otherwise.\r\n \r\n \r\n \r\n Object comparison.\r\n \r\n \r\n \r\n \r\n Object Comparison.\r\n \r\n Another AST\r\n Negative if the object should be sorted before , positive if after else zero.\r\n \r\n \r\n \r\n The AST's hash code.\r\n \r\n A hash code\r\n \r\n \r\n \r\n Translates (copies) the AST to the Context .\r\n \r\n A context\r\n A copy of the AST which is associated with \r\n \r\n \r\n \r\n A string representation of the AST.\r\n \r\n \r\n \r\n \r\n A string representation of the AST in s-expression notation.\r\n \r\n \r\n \r\n \r\n A unique identifier for the AST (unique among all ASTs).\r\n \r\n \r\n \r\n \r\n The kind of the AST.\r\n \r\n \r\n \r\n \r\n Indicates whether the AST is an Expr\r\n \r\n \r\n \r\n \r\n Indicates whether the AST is a BoundVariable\r\n \r\n \r\n \r\n \r\n Indicates whether the AST is a Quantifier\r\n \r\n \r\n \r\n \r\n Indicates whether the AST is a Sort\r\n \r\n \r\n \r\n \r\n Indicates whether the AST is a FunctionDeclaration\r\n \r\n \r\n \r\n \r\n Map from AST to AST\r\n \r\n \r\n \r\n \r\n Checks whether the map contains the key .\r\n \r\n An AST\r\n True if is a key in the map, false otherwise.\r\n \r\n \r\n \r\n Finds the value associated with the key .\r\n \r\n \r\n This function signs an error when is not a key in the map.\r\n \r\n An AST \r\n \r\n \r\n \r\n Stores or replaces a new key/value pair in the map.\r\n \r\n The key AST\r\n The value AST\r\n \r\n \r\n \r\n Erases the key from the map.\r\n \r\n An AST\r\n \r\n \r\n \r\n Removes all keys from the map.\r\n \r\n \r\n \r\n \r\n Retrieves a string representation of the map. \r\n \r\n \r\n \r\n \r\n The size of the map\r\n \r\n \r\n \r\n \r\n The keys stored in the map.\r\n \r\n \r\n \r\n \r\n Vectors of ASTs.\r\n \r\n \r\n \r\n \r\n Resize the vector to .\r\n \r\n The new size of the vector.\r\n \r\n \r\n \r\n Add the AST to the back of the vector. The size\r\n is increased by 1.\r\n \r\n An AST\r\n \r\n \r\n \r\n Translates all ASTs in the vector to .\r\n \r\n A context\r\n A new ASTVector\r\n \r\n \r\n \r\n Retrieves a string representation of the vector. \r\n \r\n \r\n \r\n \r\n The size of the vector\r\n \r\n \r\n \r\n \r\n Retrieves the i-th object in the vector.\r\n \r\n May throw an IndexOutOfBoundsException when is out of range.\r\n Index\r\n An AST\r\n \r\n \r\n \r\n Constructors are used for datatype sorts.\r\n \r\n \r\n \r\n \r\n Destructor.\r\n \r\n \r\n \r\n \r\n The number of fields of the constructor.\r\n \r\n \r\n \r\n \r\n The function declaration of the constructor.\r\n \r\n \r\n \r\n \r\n The function declaration of the tester.\r\n \r\n \r\n \r\n \r\n The function declarations of the accessors\r\n \r\n \r\n \r\n \r\n Lists of constructors\r\n \r\n \r\n \r\n \r\n Destructor.\r\n \r\n \r\n \r\n Z3_lbool\r\n \r\n \r\n Z3_symbol_kind\r\n \r\n \r\n Z3_parameter_kind\r\n \r\n \r\n Z3_sort_kind\r\n \r\n \r\n Z3_ast_kind\r\n \r\n \r\n Z3_decl_kind\r\n \r\n \r\n Z3_ast_print_mode\r\n \r\n \r\n Z3_error_code\r\n \r\n \r\n Z3_goal_prec\r\n \r\n \r\n \r\n Expressions are terms. \r\n \r\n \r\n \r\n \r\n Returns a simplified version of the expression.\r\n \r\n A set of parameters to configure the simplifier\r\n \r\n \r\n \r\n \r\n Update the arguments of the expression using the arguments \r\n The number of new arguments should coincide with the current number of arguments.\r\n \r\n \r\n \r\n \r\n Substitute every occurrence of from[i] in the expression with to[i], for i smaller than num_exprs.\r\n \r\n \r\n The result is the new expression. The arrays from and to must have size num_exprs.\r\n For every i smaller than num_exprs, we must have that \r\n sort of from[i] must be equal to sort of to[i].\r\n \r\n \r\n \r\n \r\n Substitute every occurrence of from in the expression with to.\r\n \r\n \r\n \r\n \r\n \r\n Substitute the free variables in the expression with the expressions in \r\n \r\n \r\n For every i smaller than num_exprs, the variable with de-Bruijn index i is replaced with term to[i].\r\n \r\n \r\n \r\n \r\n Translates (copies) the term to the Context .\r\n \r\n A context\r\n A copy of the term which is associated with \r\n \r\n \r\n \r\n Returns a string representation of the expression.\r\n \r\n \r\n \r\n Constructor for Expr \r\n \r\n \r\n Constructor for Expr \r\n \r\n \r\n \r\n The function declaration of the function that is applied in this expression.\r\n \r\n \r\n \r\n \r\n Indicates whether the expression is the true or false expression\r\n or something else (Z3_L_UNDEF).\r\n \r\n \r\n \r\n \r\n The number of arguments of the expression.\r\n \r\n \r\n \r\n \r\n The arguments of the expression.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a numeral\r\n \r\n \r\n \r\n \r\n Indicates whether the term is well-sorted.\r\n \r\n True if the term is well-sorted, false otherwise.\r\n \r\n \r\n \r\n The Sort of the term.\r\n \r\n \r\n \r\n \r\n Indicates whether the term represents a constant.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an integer numeral.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a real numeral.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an algebraic number\r\n \r\n \r\n \r\n \r\n Indicates whether the term has Boolean sort.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is the constant true.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is the constant false.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an equality predicate.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an n-ary distinct predicate (every argument is mutually distinct).\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a ternary if-then-else term\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an n-ary conjunction\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an n-ary disjunction\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an if-and-only-if (Boolean equivalence, binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an exclusive or\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a negation\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an implication\r\n \r\n \r\n \r\n \r\n Indicates whether the term is of integer sort.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is of sort real.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an arithmetic numeral.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a less-than-or-equal\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a greater-than-or-equal\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a less-than\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a greater-than\r\n \r\n \r\n \r\n \r\n Indicates whether the term is addition (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is subtraction (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a unary minus\r\n \r\n \r\n \r\n \r\n Indicates whether the term is multiplication (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is division (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is integer division (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is remainder (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is modulus (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a coercion of integer to real (unary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a coercion of real to integer (unary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a check that tests whether a real is integral (unary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is of an array sort.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an array store. \r\n \r\n It satisfies select(store(a,i,v),j) = if i = j then v else select(a,j). \r\n Array store takes at least 3 arguments. \r\n \r\n \r\n \r\n Indicates whether the term is an array select.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a constant array.\r\n \r\n For example, select(const(v),i) = v holds for every v and i. The function is unary.\r\n \r\n \r\n \r\n Indicates whether the term is a default array.\r\n \r\n For example default(const(v)) = v. The function is unary.\r\n \r\n \r\n \r\n Indicates whether the term is an array map.\r\n \r\n It satisfies map[f](a1,..,a_n)[i] = f(a1[i],...,a_n[i]) for every i.\r\n \r\n \r\n \r\n Indicates whether the term is an as-array term.\r\n \r\n An as-array term is n array value that behaves as the function graph of the \r\n function passed as parameter.\r\n \r\n \r\n \r\n Indicates whether the term is set union\r\n \r\n \r\n \r\n \r\n Indicates whether the term is set intersection\r\n \r\n \r\n \r\n \r\n Indicates whether the term is set difference\r\n \r\n \r\n \r\n \r\n Indicates whether the term is set complement\r\n \r\n \r\n \r\n \r\n Indicates whether the term is set subset\r\n \r\n \r\n \r\n \r\n Indicates whether the terms is of bit-vector sort.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector numeral\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a one-bit bit-vector with value one\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a one-bit bit-vector with value zero\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector unary minus\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector addition (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector subtraction (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector multiplication (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector signed division (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector unsigned division (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector signed remainder (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector unsigned remainder (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector signed modulus\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector signed division by zero\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector unsigned division by zero\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector signed remainder by zero\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector unsigned remainder by zero\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector signed modulus by zero\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an unsigned bit-vector less-than-or-equal\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a signed bit-vector less-than-or-equal\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an unsigned bit-vector greater-than-or-equal\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a signed bit-vector greater-than-or-equal\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an unsigned bit-vector less-than\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a signed bit-vector less-than\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an unsigned bit-vector greater-than\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a signed bit-vector greater-than\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-wise AND\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-wise OR\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-wise NOT\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-wise XOR\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-wise NAND\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-wise NOR\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-wise XNOR\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector concatenation (binary)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector sign extension\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector zero extension\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector extraction\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector repetition\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector reduce OR\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector reduce AND\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector comparison\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector shift left\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector logical shift right\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector arithmetic shift left\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector rotate left\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector rotate right\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector rotate left (extended)\r\n \r\n Similar to Z3_OP_ROTATE_LEFT, but it is a binary operator instead of a parametric one.\r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector rotate right (extended)\r\n \r\n Similar to Z3_OP_ROTATE_RIGHT, but it is a binary operator instead of a parametric one.\r\n \r\n \r\n \r\n Indicates whether the term is a coercion from integer to bit-vector\r\n \r\n This function is not supported by the decision procedures. Only the most \r\n rudimentary simplification rules are applied to this function.\r\n \r\n \r\n \r\n Indicates whether the term is a coercion from bit-vector to integer\r\n \r\n This function is not supported by the decision procedures. Only the most \r\n rudimentary simplification rules are applied to this function.\r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector carry\r\n \r\n Compute the carry bit in a full-adder. The meaning is given by the \r\n equivalence (carry l1 l2 l3) <=> (or (and l1 l2) (and l1 l3) (and l2 l3)))\r\n \r\n \r\n \r\n Indicates whether the term is a bit-vector ternary XOR\r\n \r\n The meaning is given by the equivalence (xor3 l1 l2 l3) <=> (xor (xor l1 l2) l3)\r\n \r\n \r\n \r\n Indicates whether the term is a label (used by the Boogie Verification condition generator).\r\n \r\n The label has two parameters, a string and a Boolean polarity. It takes one argument, a formula.\r\n \r\n \r\n \r\n Indicates whether the term is a label literal (used by the Boogie Verification condition generator). \r\n \r\n A label literal has a set of string parameters. It takes no arguments.\r\n \r\n \r\n \r\n Indicates whether the term is a binary equivalence modulo namings. \r\n \r\n This binary predicate is used in proof terms.\r\n It captures equisatisfiability and equivalence modulo renamings.\r\n \r\n \r\n \r\n Indicates whether the term is a Proof for the expression 'true'.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for a fact asserted by the user.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for a fact (tagged as goal) asserted by the user.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is proof via modus ponens\r\n \r\n \r\n Given a proof for p and a proof for (implies p q), produces a proof for q.\r\n T1: p\r\n T2: (implies p q)\r\n [mp T1 T2]: q\r\n The second antecedents may also be a proof for (iff p q).\r\n \r\n \r\n \r\n Indicates whether the term is a proof for (R t t), where R is a reflexive relation.\r\n \r\n This proof object has no antecedents. \r\n The only reflexive relations that are used are \r\n equivalence modulo namings, equality and equivalence.\r\n That is, R is either '~', '=' or 'iff'.\r\n \r\n \r\n \r\n Indicates whether the term is proof by symmetricity of a relation\r\n \r\n \r\n Given an symmetric relation R and a proof for (R t s), produces a proof for (R s t).\r\n T1: (R t s)\r\n [symmetry T1]: (R s t)\r\n T1 is the antecedent of this proof object.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof by transitivity of a relation\r\n \r\n \r\n Given a transitive relation R, and proofs for (R t s) and (R s u), produces a proof \r\n for (R t u). \r\n T1: (R t s)\r\n T2: (R s u)\r\n [trans T1 T2]: (R t u)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof by condensed transitivity of a relation\r\n \r\n \r\n Condensed transitivity proof. This proof object is only used if the parameter PROOF_MODE is 1.\r\n It combines several symmetry and transitivity proofs. \r\n Example:\r\n T1: (R a b)\r\n T2: (R c b)\r\n T3: (R c d)\r\n [trans* T1 T2 T3]: (R a d) \r\n R must be a symmetric and transitive relation.\r\n \r\n Assuming that this proof object is a proof for (R s t), then\r\n a proof checker must check if it is possible to prove (R s t)\r\n using the antecedents, symmetry and transitivity. That is, \r\n if there is a path from s to t, if we view every\r\n antecedent (R a b) as an edge between a and b.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a monotonicity proof object.\r\n \r\n \r\n T1: (R t_1 s_1)\r\n ...\r\n Tn: (R t_n s_n)\r\n [monotonicity T1 ... Tn]: (R (f t_1 ... t_n) (f s_1 ... s_n)) \r\n Remark: if t_i == s_i, then the antecedent Ti is suppressed.\r\n That is, reflexivity proofs are supressed to save space.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a quant-intro proof \r\n \r\n \r\n Given a proof for (~ p q), produces a proof for (~ (forall (x) p) (forall (x) q)).\r\n T1: (~ p q)\r\n [quant-intro T1]: (~ (forall (x) p) (forall (x) q))\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a distributivity proof object. \r\n \r\n \r\n Given that f (= or) distributes over g (= and), produces a proof for\r\n (= (f a (g c d))\r\n (g (f a c) (f a d)))\r\n If f and g are associative, this proof also justifies the following equality:\r\n (= (f (g a b) (g c d))\r\n (g (f a c) (f a d) (f b c) (f b d)))\r\n where each f and g can have arbitrary number of arguments.\r\n \r\n This proof object has no antecedents.\r\n Remark. This rule is used by the CNF conversion pass and \r\n instantiated by f = or, and g = and.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof by elimination of AND\r\n \r\n \r\n Given a proof for (and l_1 ... l_n), produces a proof for l_i\r\n T1: (and l_1 ... l_n)\r\n [and-elim T1]: l_i\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof by eliminiation of not-or\r\n \r\n \r\n Given a proof for (not (or l_1 ... l_n)), produces a proof for (not l_i).\r\n T1: (not (or l_1 ... l_n))\r\n [not-or-elim T1]: (not l_i) \r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof by rewriting\r\n \r\n \r\n A proof for a local rewriting step (= t s).\r\n The head function symbol of t is interpreted.\r\n \r\n This proof object has no antecedents.\r\n The conclusion of a rewrite rule is either an equality (= t s), \r\n an equivalence (iff t s), or equi-satisfiability (~ t s).\r\n Remark: if f is bool, then = is iff.\r\n \r\n Examples:\r\n (= (+ x 0) x)\r\n (= (+ x 1 2) (+ 3 x))\r\n (iff (or x false) x) \r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof by rewriting\r\n \r\n \r\n A proof for rewriting an expression t into an expression s.\r\n This proof object is used if the parameter PROOF_MODE is 1.\r\n This proof object can have n antecedents.\r\n The antecedents are proofs for equalities used as substitution rules.\r\n The object is also used in a few cases if the parameter PROOF_MODE is 2.\r\n The cases are:\r\n - When applying contextual simplification (CONTEXT_SIMPLIFIER=true)\r\n - When converting bit-vectors to Booleans (BIT2BOOL=true)\r\n - When pulling ite expression up (PULL_CHEAP_ITE_TREES=true)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for pulling quantifiers out.\r\n \r\n \r\n A proof for (iff (f (forall (x) q(x)) r) (forall (x) (f (q x) r))). This proof object has no antecedents.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for pulling quantifiers out.\r\n \r\n \r\n A proof for (iff P Q) where Q is in prenex normal form. \r\n This proof object is only used if the parameter PROOF_MODE is 1. \r\n This proof object has no antecedents\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for pushing quantifiers in.\r\n \r\n \r\n A proof for:\r\n (iff (forall (x_1 ... x_m) (and p_1[x_1 ... x_m] ... p_n[x_1 ... x_m]))\r\n (and (forall (x_1 ... x_m) p_1[x_1 ... x_m])\r\n ... \r\n (forall (x_1 ... x_m) p_n[x_1 ... x_m]))) \r\n This proof object has no antecedents\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for elimination of unused variables.\r\n \r\n \r\n A proof for (iff (forall (x_1 ... x_n y_1 ... y_m) p[x_1 ... x_n])\r\n (forall (x_1 ... x_n) p[x_1 ... x_n])) \r\n \r\n It is used to justify the elimination of unused variables.\r\n This proof object has no antecedents.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for destructive equality resolution\r\n \r\n \r\n A proof for destructive equality resolution:\r\n (iff (forall (x) (or (not (= x t)) P[x])) P[t])\r\n if x does not occur in t.\r\n \r\n This proof object has no antecedents.\r\n \r\n Several variables can be eliminated simultaneously.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for quantifier instantiation\r\n \r\n \r\n A proof of (or (not (forall (x) (P x))) (P a))\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a hypthesis marker.\r\n \r\n Mark a hypothesis in a natural deduction style proof.\r\n \r\n \r\n \r\n Indicates whether the term is a proof by lemma\r\n \r\n \r\n T1: false\r\n [lemma T1]: (or (not l_1) ... (not l_n))\r\n \r\n This proof object has one antecedent: a hypothetical proof for false.\r\n It converts the proof in a proof for (or (not l_1) ... (not l_n)),\r\n when T1 contains the hypotheses: l_1, ..., l_n.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof by unit resolution\r\n \r\n \r\n T1: (or l_1 ... l_n l_1' ... l_m')\r\n T2: (not l_1)\r\n ...\r\n T(n+1): (not l_n)\r\n [unit-resolution T1 ... T(n+1)]: (or l_1' ... l_m')\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof by iff-true\r\n \r\n \r\n T1: p\r\n [iff-true T1]: (iff p true)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof by iff-false\r\n \r\n \r\n T1: (not p)\r\n [iff-false T1]: (iff p false)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof by commutativity\r\n \r\n \r\n [comm]: (= (f a b) (f b a))\r\n \r\n f is a commutative operator.\r\n \r\n This proof object has no antecedents.\r\n Remark: if f is bool, then = is iff.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for Tseitin-like axioms\r\n \r\n \r\n Proof object used to justify Tseitin's like axioms:\r\n \r\n (or (not (and p q)) p)\r\n (or (not (and p q)) q)\r\n (or (not (and p q r)) p)\r\n (or (not (and p q r)) q)\r\n (or (not (and p q r)) r)\r\n ...\r\n (or (and p q) (not p) (not q))\r\n (or (not (or p q)) p q)\r\n (or (or p q) (not p))\r\n (or (or p q) (not q))\r\n (or (not (iff p q)) (not p) q)\r\n (or (not (iff p q)) p (not q))\r\n (or (iff p q) (not p) (not q))\r\n (or (iff p q) p q)\r\n (or (not (ite a b c)) (not a) b)\r\n (or (not (ite a b c)) a c)\r\n (or (ite a b c) (not a) (not b))\r\n (or (ite a b c) a (not c))\r\n (or (not (not a)) (not a))\r\n (or (not a) a)\r\n \r\n This proof object has no antecedents.\r\n Note: all axioms are propositional tautologies.\r\n Note also that 'and' and 'or' can take multiple arguments.\r\n You can recover the propositional tautologies by\r\n unfolding the Boolean connectives in the axioms a small\r\n bounded number of steps (=3).\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for introduction of a name\r\n \r\n \r\n Introduces a name for a formula/term.\r\n Suppose e is an expression with free variables x, and def-intro\r\n introduces the name n(x). The possible cases are:\r\n \r\n When e is of Boolean type:\r\n [def-intro]: (and (or n (not e)) (or (not n) e))\r\n \r\n or:\r\n [def-intro]: (or (not n) e)\r\n when e only occurs positively.\r\n \r\n When e is of the form (ite cond th el):\r\n [def-intro]: (and (or (not cond) (= n th)) (or cond (= n el)))\r\n \r\n Otherwise:\r\n [def-intro]: (= n e) \r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for application of a definition\r\n \r\n \r\n [apply-def T1]: F ~ n\r\n F is 'equivalent' to n, given that T1 is a proof that\r\n n is a name for F.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof iff-oeq\r\n \r\n \r\n T1: (iff p q)\r\n [iff~ T1]: (~ p q)\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for a positive NNF step\r\n \r\n \r\n Proof for a (positive) NNF step. Example:\r\n \r\n T1: (not s_1) ~ r_1\r\n T2: (not s_2) ~ r_2\r\n T3: s_1 ~ r_1'\r\n T4: s_2 ~ r_2'\r\n [nnf-pos T1 T2 T3 T4]: (~ (iff s_1 s_2)\r\n (and (or r_1 r_2') (or r_1' r_2)))\r\n \r\n The negation normal form steps NNF_POS and NNF_NEG are used in the following cases:\r\n (a) When creating the NNF of a positive force quantifier.\r\n The quantifier is retained (unless the bound variables are eliminated).\r\n Example\r\n T1: q ~ q_new \r\n [nnf-pos T1]: (~ (forall (x T) q) (forall (x T) q_new))\r\n \r\n (b) When recursively creating NNF over Boolean formulas, where the top-level\r\n connective is changed during NNF conversion. The relevant Boolean connectives\r\n for NNF_POS are 'implies', 'iff', 'xor', 'ite'.\r\n NNF_NEG furthermore handles the case where negation is pushed\r\n over Boolean connectives 'and' and 'or'.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for a negative NNF step\r\n \r\n \r\n Proof for a (negative) NNF step. Examples:\r\n \r\n T1: (not s_1) ~ r_1\r\n ...\r\n Tn: (not s_n) ~ r_n\r\n [nnf-neg T1 ... Tn]: (not (and s_1 ... s_n)) ~ (or r_1 ... r_n)\r\n and\r\n T1: (not s_1) ~ r_1\r\n ...\r\n Tn: (not s_n) ~ r_n\r\n [nnf-neg T1 ... Tn]: (not (or s_1 ... s_n)) ~ (and r_1 ... r_n)\r\n and\r\n T1: (not s_1) ~ r_1\r\n T2: (not s_2) ~ r_2\r\n T3: s_1 ~ r_1'\r\n T4: s_2 ~ r_2'\r\n [nnf-neg T1 T2 T3 T4]: (~ (not (iff s_1 s_2))\r\n (and (or r_1 r_2) (or r_1' r_2')))\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for (~ P Q) here Q is in negation normal form.\r\n \r\n \r\n A proof for (~ P Q) where Q is in negation normal form.\r\n \r\n This proof object is only used if the parameter PROOF_MODE is 1. \r\n \r\n This proof object may have n antecedents. Each antecedent is a PR_DEF_INTRO.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for (~ P Q) where Q is in conjunctive normal form.\r\n \r\n \r\n A proof for (~ P Q) where Q is in conjunctive normal form.\r\n This proof object is only used if the parameter PROOF_MODE is 1. \r\n This proof object may have n antecedents. Each antecedent is a PR_DEF_INTRO. \r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for a Skolemization step\r\n \r\n \r\n Proof for: \r\n \r\n [sk]: (~ (not (forall x (p x y))) (not (p (sk y) y)))\r\n [sk]: (~ (exists x (p x y)) (p (sk y) y))\r\n \r\n This proof object has no antecedents.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof by modus ponens for equi-satisfiability.\r\n \r\n \r\n Modus ponens style rule for equi-satisfiability.\r\n T1: p\r\n T2: (~ p q)\r\n [mp~ T1 T2]: q \r\n \r\n \r\n \r\n \r\n Indicates whether the term is a proof for theory lemma\r\n \r\n \r\n Generic proof for theory lemmas.\r\n \r\n The theory lemma function comes with one or more parameters.\r\n The first parameter indicates the name of the theory.\r\n For the theory of arithmetic, additional parameters provide hints for\r\n checking the theory lemma. \r\n The hints for arithmetic are:\r\n - farkas - followed by rational coefficients. Multiply the coefficients to the\r\n inequalities in the lemma, add the (negated) inequalities and obtain a contradiction.\r\n - triangle-eq - Indicates a lemma related to the equivalence: \r\n (iff (= t1 t2) (and (<= t1 t2) (<= t2 t1)))\r\n - gcd-test - Indicates an integer linear arithmetic lemma that uses a gcd test.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is of an array sort.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an relation store\r\n \r\n \r\n Insert a record into a relation.\r\n The function takes n+1 arguments, where the first argument is the relation and the remaining n elements \r\n correspond to the n columns of the relation.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an empty relation\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a test for the emptiness of a relation\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a relational join\r\n \r\n \r\n \r\n \r\n Indicates whether the term is the union or convex hull of two relations. \r\n \r\n The function takes two arguments.\r\n \r\n \r\n \r\n Indicates whether the term is the widening of two relations\r\n \r\n The function takes two arguments.\r\n \r\n \r\n \r\n Indicates whether the term is a projection of columns (provided as numbers in the parameters).\r\n \r\n The function takes one argument.\r\n \r\n \r\n \r\n Indicates whether the term is a relation filter\r\n \r\n \r\n Filter (restrict) a relation with respect to a predicate.\r\n The first argument is a relation. \r\n The second argument is a predicate with free de-Brujin indices\r\n corresponding to the columns of the relation.\r\n So the first column in the relation has index 0.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is an intersection of a relation with the negation of another.\r\n \r\n \r\n Intersect the first relation with respect to negation\r\n of the second relation (the function takes two arguments).\r\n Logically, the specification can be described by a function\r\n \r\n target = filter_by_negation(pos, neg, columns)\r\n \r\n where columns are pairs c1, d1, .., cN, dN of columns from pos and neg, such that\r\n target are elements in x in pos, such that there is no y in neg that agrees with\r\n x on the columns c1, d1, .., cN, dN.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is the renaming of a column in a relation\r\n \r\n \r\n The function takes one argument.\r\n The parameters contain the renaming as a cycle.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is the complement of a relation\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a relational select\r\n \r\n \r\n Check if a record is an element of the relation.\r\n The function takes n+1 arguments, where the first argument is a relation,\r\n and the remaining n arguments correspond to a record.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a relational clone (copy)\r\n \r\n \r\n Create a fresh copy (clone) of a relation. \r\n The function is logically the identity, but\r\n in the context of a register machine allows \r\n for terms of kind \r\n to perform destructive updates to the first argument.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is of an array sort.\r\n \r\n \r\n \r\n \r\n Indicates whether the term is a less than predicate over a finite domain.\r\n \r\n \r\n \r\n \r\n The de-Burijn index of a bound variable.\r\n \r\n \r\n Bound variables are indexed by de-Bruijn indices. It is perhaps easiest to explain\r\n the meaning of de-Bruijn indices by indicating the compilation process from\r\n non-de-Bruijn formulas to de-Bruijn format.\r\n \r\n abs(forall (x1) phi) = forall (x1) abs1(phi, x1, 0)\r\n abs(forall (x1, x2) phi) = abs(forall (x1) abs(forall (x2) phi))\r\n abs1(x, x, n) = b_n\r\n abs1(y, x, n) = y\r\n abs1(f(t1,...,tn), x, n) = f(abs1(t1,x,n), ..., abs1(tn,x,n))\r\n abs1(forall (x1) phi, x, n) = forall (x1) (abs1(phi, x, n+1))\r\n \r\n The last line is significant: the index of a bound variable is different depending\r\n on the scope in which it appears. The deeper x appears, the higher is its\r\n index.\r\n \r\n \r\n \r\n \r\n Boolean expressions\r\n \r\n \r\n \r\n Constructor for BoolExpr \r\n \r\n \r\n Constructor for BoolExpr \r\n \r\n \r\n \r\n Arithmetic expressions (int/real)\r\n \r\n \r\n \r\n Constructor for ArithExpr \r\n \r\n \r\n \r\n Int expressions\r\n \r\n \r\n \r\n Constructor for IntExpr \r\n \r\n \r\n \r\n Real expressions\r\n \r\n \r\n \r\n Constructor for RealExpr \r\n \r\n \r\n \r\n Bit-vector expressions\r\n \r\n \r\n \r\n Constructor for BitVecExpr \r\n \r\n \r\n \r\n The size of the sort of a bit-vector term.\r\n \r\n \r\n \r\n \r\n Array expressions\r\n \r\n \r\n \r\n Constructor for ArrayExpr \r\n \r\n \r\n \r\n Datatype expressions\r\n \r\n \r\n \r\n Constructor for DatatypeExpr \r\n \r\n \r\n \r\n Object for managing fixedpoints\r\n \r\n \r\n \r\n \r\n Assert a constraint (or multiple) into the fixedpoint solver.\r\n \r\n \r\n \r\n \r\n Register predicate as recursive relation.\r\n \r\n \r\n \r\n \r\n Add rule into the fixedpoint solver.\r\n \r\n \r\n \r\n \r\n Add table fact to the fixedpoint solver.\r\n \r\n \r\n \r\n \r\n Query the fixedpoint solver.\r\n A query is a conjunction of constraints. The constraints may include the recursively defined relations.\r\n The query is satisfiable if there is an instance of the query variables and a derivation for it.\r\n The query is unsatisfiable if there are no derivations satisfying the query variables. \r\n \r\n \r\n \r\n \r\n Query the fixedpoint solver.\r\n A query is an array of relations.\r\n The query is satisfiable if there is an instance of some relation that is non-empty.\r\n The query is unsatisfiable if there are no derivations satisfying any of the relations.\r\n \r\n \r\n \r\n \r\n Retrieve satisfying instance or instances of solver, \r\n or definitions for the recursive predicates that show unsatisfiability.\r\n \r\n \r\n \r\n \r\n Retrieve explanation why fixedpoint engine returned status Unknown.\r\n \r\n \r\n \r\n \r\n Retrieve internal string representation of fixedpoint object.\r\n \r\n \r\n \r\n \r\n Instrument the Datalog engine on which table representation to use for recursive predicate.\r\n \r\n \r\n \r\n \r\n Convert benchmark given as set of axioms, rules and queries to a string.\r\n \r\n \r\n \r\n \r\n Function declarations. \r\n \r\n \r\n \r\n \r\n Comparison operator.\r\n \r\n True if and share the same context and are equal, false otherwise.\r\n \r\n \r\n \r\n Comparison operator.\r\n \r\n True if and do not share the same context or are not equal, false otherwise.\r\n \r\n \r\n \r\n Object comparison.\r\n \r\n \r\n \r\n \r\n A hash code.\r\n \r\n \r\n \r\n \r\n A string representations of the function declaration.\r\n \r\n \r\n \r\n \r\n Create expression that applies function to arguments.\r\n \r\n \r\n \r\n \r\n \r\n \r\n Returns a unique identifier for the function declaration.\r\n \r\n \r\n \r\n \r\n The arity of the function declaration\r\n \r\n \r\n \r\n \r\n The size of the domain of the function declaration\r\n \r\n \r\n \r\n \r\n \r\n The domain of the function declaration\r\n \r\n \r\n \r\n \r\n The range of the function declaration\r\n \r\n \r\n \r\n \r\n The kind of the function declaration.\r\n \r\n \r\n \r\n \r\n The name of the function declaration\r\n \r\n \r\n \r\n \r\n The number of parameters of the function declaration\r\n \r\n \r\n \r\n \r\n The parameters of the function declaration\r\n \r\n \r\n \r\n \r\n Create expression that applies function to arguments.\r\n \r\n \r\n \r\n \r\n \r\n \r\n Function declarations can have Parameters associated with them. \r\n \r\n \r\n \r\n The int value of the parameter.\r\n \r\n \r\n The double value of the parameter.\r\n \r\n \r\n The Symbol value of the parameter.\r\n \r\n \r\n The Sort value of the parameter.\r\n \r\n \r\n The AST value of the parameter.\r\n \r\n \r\n The FunctionDeclaration value of the parameter.\r\n \r\n \r\n The rational string value of the parameter.\r\n \r\n \r\n \r\n The kind of the parameter.\r\n \r\n \r\n \r\n \r\n A function interpretation is represented as a finite map and an 'else' value.\r\n Each entry in the finite map represents the value of a function given a set of arguments. \r\n \r\n \r\n \r\n \r\n A string representation of the function interpretation.\r\n \r\n \r\n \r\n \r\n The number of entries in the function interpretation.\r\n \r\n \r\n \r\n \r\n The entries in the function interpretation\r\n \r\n \r\n \r\n \r\n The (symbolic) `else' value of the function interpretation.\r\n \r\n \r\n \r\n \r\n The arity of the function interpretation\r\n \r\n \r\n \r\n \r\n An Entry object represents an element in the finite map used to encode\r\n a function interpretation.\r\n \r\n \r\n \r\n \r\n A string representation of the function entry.\r\n \r\n \r\n \r\n \r\n Return the (symbolic) value of this entry.\r\n \r\n \r\n \r\n \r\n The number of arguments of the entry.\r\n \r\n \r\n \r\n \r\n The arguments of the function entry.\r\n \r\n \r\n \r\n \r\n A goal (aka problem). A goal is essentially a set\r\n of formulas, that can be solved and/or transformed using\r\n tactics and solvers.\r\n \r\n \r\n \r\n \r\n Adds the to the given goal. \r\n \r\n \r\n \r\n \r\n Erases all formulas from the given goal.\r\n \r\n \r\n \r\n \r\n Translates (copies) the Goal to the target Context .\r\n \r\n \r\n \r\n \r\n Simplifies the goal.\r\n \r\n Essentially invokes the `simplify' tactic on the goal.\r\n \r\n \r\n \r\n Goal to string conversion.\r\n \r\n A string representation of the Goal.\r\n \r\n \r\n \r\n The precision of the goal. \r\n \r\n \r\n Goals can be transformed using over and under approximations.\r\n An under approximation is applied when the objective is to find a model for a given goal.\r\n An over approximation is applied when the objective is to find a proof for a given goal.\r\n \r\n \r\n \r\n \r\n Indicates whether the goal is precise.\r\n \r\n \r\n \r\n \r\n Indicates whether the goal is an under-approximation.\r\n \r\n \r\n \r\n \r\n Indicates whether the goal is an over-approximation.\r\n \r\n \r\n \r\n \r\n Indicates whether the goal is garbage (i.e., the product of over- and under-approximations).\r\n \r\n \r\n \r\n \r\n Indicates whether the goal contains `false'.\r\n \r\n \r\n \r\n \r\n The depth of the goal.\r\n \r\n \r\n This tracks how many transformations were applied to it.\r\n \r\n \r\n \r\n \r\n The number of formulas in the goal.\r\n \r\n \r\n \r\n \r\n The formulas in the goal.\r\n \r\n \r\n \r\n \r\n The number of formulas, subformulas and terms in the goal.\r\n \r\n \r\n \r\n \r\n Indicates whether the goal is empty, and it is precise or the product of an under approximation.\r\n \r\n \r\n \r\n \r\n Indicates whether the goal contains `false', and it is precise or the product of an over approximation.\r\n \r\n \r\n \r\n \r\n A Model contains interpretations (assignments) of constants and functions. \r\n \r\n \r\n \r\n \r\n Retrieves the interpretation (the assignment) of in the model. \r\n \r\n A Constant\r\n An expression if the constant has an interpretation in the model, null otherwise.\r\n \r\n \r\n \r\n Retrieves the interpretation (the assignment) of in the model. \r\n \r\n A function declaration of zero arity\r\n An expression if the function has an interpretation in the model, null otherwise. \r\n \r\n \r\n \r\n Retrieves the interpretation (the assignment) of a non-constant in the model. \r\n \r\n A function declaration of non-zero arity\r\n A FunctionInterpretation if the function has an interpretation in the model, null otherwise. \r\n \r\n \r\n \r\n Evaluates the expression in the current model.\r\n \r\n \r\n This function may fail if contains quantifiers, \r\n is partial (MODEL_PARTIAL enabled), or if is not well-sorted.\r\n In this case a ModelEvaluationFailedException is thrown.\r\n \r\n An expression\r\n \r\n When this flag is enabled, a model value will be assigned to any constant \r\n or function that does not have an interpretation in the model.\r\n \r\n The evaluation of in the model. \r\n \r\n \r\n \r\n Alias for Eval.\r\n \r\n \r\n \r\n \r\n The finite set of distinct values that represent the interpretation for sort .\r\n \r\n \r\n An uninterpreted sort\r\n An array of expressions, where each is an element of the universe of \r\n \r\n \r\n \r\n Conversion of models to strings. \r\n \r\n A string representation of the model.\r\n \r\n \r\n \r\n The number of constants that have an interpretation in the model.\r\n \r\n \r\n \r\n \r\n The function declarations of the constants in the model.\r\n \r\n \r\n \r\n \r\n The number of function interpretations in the model.\r\n \r\n \r\n \r\n \r\n The function declarations of the function interpretations in the model.\r\n \r\n \r\n \r\n \r\n All symbols that have an interpretation in the model.\r\n \r\n \r\n \r\n \r\n The number of uninterpreted sorts that the model has an interpretation for.\r\n \r\n \r\n \r\n \r\n The uninterpreted sorts that the model has an interpretation for. \r\n \r\n \r\n Z3 also provides an intepretation for uninterpreted sorts used in a formula.\r\n The interpretation for a sort is a finite set of distinct values. We say this finite set is\r\n the \"universe\" of the sort.\r\n \r\n \r\n \r\n \r\n \r\n \r\n A ModelEvaluationFailedException is thrown when an expression cannot be evaluated by the model.\r\n \r\n \r\n \r\n \r\n The exception base class for error reporting from Z3\r\n \r\n \r\n \r\n \r\n Constructor.\r\n \r\n \r\n \r\n \r\n Constructor.\r\n \r\n \r\n \r\n \r\n Constructor.\r\n \r\n \r\n \r\n \r\n An exception that is thrown when model evaluation fails.\r\n \r\n \r\n \r\n \r\n Integer Numerals\r\n \r\n \r\n \r\n \r\n Returns a string representation of the numeral.\r\n \r\n \r\n \r\n \r\n Retrieve the 64-bit unsigned integer value.\r\n \r\n \r\n \r\n \r\n Retrieve the int value.\r\n \r\n \r\n \r\n \r\n Retrieve the 64-bit int value.\r\n \r\n \r\n \r\n \r\n Retrieve the int value.\r\n \r\n \r\n \r\n \r\n Retrieve the BigInteger value.\r\n \r\n \r\n \r\n \r\n Rational Numerals\r\n \r\n \r\n \r\n \r\n Returns a string representation in decimal notation.\r\n \r\n The result has at most decimal places. \r\n \r\n \r\n \r\n Returns a string representation of the numeral.\r\n \r\n \r\n \r\n \r\n The numerator of a rational numeral.\r\n \r\n \r\n \r\n \r\n The denominator of a rational numeral.\r\n \r\n \r\n \r\n \r\n Converts the numerator of the rational to a BigInteger\r\n \r\n \r\n \r\n \r\n Converts the denominator of the rational to a BigInteger\r\n \r\n \r\n \r\n \r\n Bit-vector numerals\r\n \r\n \r\n \r\n \r\n Returns a string representation of the numeral.\r\n \r\n \r\n \r\n \r\n Retrieve the 64-bit unsigned integer value.\r\n \r\n \r\n \r\n \r\n Retrieve the int value.\r\n \r\n \r\n \r\n \r\n Retrieve the 64-bit int value.\r\n \r\n \r\n \r\n \r\n Retrieve the int value.\r\n \r\n \r\n \r\n \r\n Retrieve the BigInteger value.\r\n \r\n \r\n \r\n \r\n Algebraic numbers\r\n \r\n \r\n \r\n \r\n Return a upper bound for a given real algebraic number. \r\n The interval isolating the number is smaller than 1/10^. \r\n \r\n \r\n the precision of the result\r\n A numeral Expr of sort Real\r\n \r\n \r\n \r\n Return a lower bound for the given real algebraic number. \r\n The interval isolating the number is smaller than 1/10^. \r\n \r\n \r\n \r\n A numeral Expr of sort Real\r\n \r\n \r\n \r\n Returns a string representation in decimal notation.\r\n \r\n The result has at most decimal places. \r\n \r\n \r\n \r\n A ParameterSet represents a configuration in the form of Symbol/value pairs.\r\n \r\n \r\n \r\n \r\n Adds a parameter setting.\r\n \r\n \r\n \r\n \r\n Adds a parameter setting.\r\n \r\n \r\n \r\n \r\n Adds a parameter setting.\r\n \r\n \r\n \r\n \r\n Adds a parameter setting.\r\n \r\n \r\n \r\n \r\n Adds a parameter setting.\r\n \r\n \r\n \r\n \r\n Adds a parameter setting.\r\n \r\n \r\n \r\n \r\n Adds a parameter setting.\r\n \r\n \r\n \r\n \r\n Adds a parameter setting.\r\n \r\n \r\n \r\n \r\n A string representation of the parameter set.\r\n \r\n \r\n \r\n \r\n Patterns comprise a list of terms. The list should be\r\n non-empty. If the list comprises of more than one term, it is\r\n also called a multi-pattern.\r\n \r\n \r\n \r\n \r\n A string representation of the pattern.\r\n \r\n \r\n \r\n \r\n The number of terms in the pattern.\r\n \r\n \r\n \r\n \r\n The terms in the pattern.\r\n \r\n \r\n \r\n \r\n Objects of this class track statistical information about solvers. \r\n \r\n \r\n \r\n \r\n A string representation of the statistical data.\r\n \r\n \r\n \r\n \r\n The number of statistical data.\r\n \r\n \r\n \r\n \r\n The data entries.\r\n \r\n \r\n \r\n \r\n The statistical counters.\r\n \r\n \r\n \r\n \r\n The value of a particular statistical counter.\r\n \r\n Returns null if the key is unknown.\r\n \r\n \r\n \r\n Statistical data is organized into pairs of [Key, Entry], where every\r\n Entry is either a DoubleEntry or a UIntEntry\r\n \r\n \r\n \r\n \r\n The key of the entry.\r\n \r\n \r\n \r\n \r\n The string representation of the Entry.\r\n \r\n \r\n \r\n \r\n The uint-value of the entry.\r\n \r\n \r\n \r\n \r\n The double-value of the entry.\r\n \r\n \r\n \r\n \r\n True if the entry is uint-valued.\r\n \r\n \r\n \r\n \r\n True if the entry is double-valued.\r\n \r\n \r\n \r\n \r\n The string representation of the the entry's value.\r\n \r\n \r\n \r\n \r\n Status values.\r\n \r\n \r\n \r\n \r\n Used to signify an unsatisfiable status.\r\n \r\n \r\n \r\n \r\n Used to signify an unknown status.\r\n \r\n \r\n \r\n \r\n Used to signify a satisfiable status.\r\n \r\n \r\n \r\n \r\n The main interaction with Z3 happens via the Context.\r\n \r\n \r\n \r\n \r\n Constructor.\r\n \r\n \r\n \r\n \r\n Constructor.\r\n \r\n \r\n \r\n \r\n Creates a new symbol using an integer.\r\n \r\n \r\n Not all integers can be passed to this function.\r\n The legal range of unsigned integers is 0 to 2^30-1.\r\n \r\n \r\n \r\n \r\n Create a symbol using a string.\r\n \r\n \r\n \r\n \r\n Create an array of symbols.\r\n \r\n \r\n \r\n \r\n Create a new Boolean sort.\r\n \r\n \r\n \r\n \r\n Create a new uninterpreted sort.\r\n \r\n \r\n \r\n \r\n Create a new uninterpreted sort.\r\n \r\n \r\n \r\n \r\n Create a new integer sort.\r\n \r\n \r\n \r\n \r\n Create a real sort.\r\n \r\n \r\n \r\n \r\n Create a new bit-vector sort.\r\n \r\n \r\n \r\n \r\n Create a new array sort.\r\n \r\n \r\n \r\n \r\n Create a new tuple sort.\r\n \r\n \r\n \r\n \r\n Create a new enumeration sort.\r\n \r\n \r\n \r\n \r\n Create a new enumeration sort.\r\n \r\n \r\n \r\n \r\n Create a new list sort.\r\n \r\n \r\n \r\n \r\n Create a new list sort.\r\n \r\n \r\n \r\n \r\n Create a new finite domain sort.\r\n \r\n \r\n \r\n \r\n Create a new finite domain sort.\r\n \r\n \r\n \r\n \r\n Create a datatype constructor.\r\n \r\n constructor name\r\n name of recognizer function.\r\n names of the constructor fields.\r\n field sorts, 0 if the field sort refers to a recursive sort.\r\n reference to datatype sort that is an argument to the constructor; \r\n if the corresponding sort reference is 0, then the value in sort_refs should be an index \r\n referring to one of the recursive datatypes that is declared.\r\n \r\n \r\n \r\n Create a datatype constructor.\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Create a new datatype sort.\r\n \r\n \r\n \r\n \r\n Create a new datatype sort.\r\n \r\n \r\n \r\n \r\n Create mutually recursive datatypes.\r\n \r\n names of datatype sorts\r\n list of constructors, one list per sort.\r\n \r\n \r\n \r\n Create mutually recursive data-types.\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Creates a new function declaration.\r\n \r\n \r\n \r\n \r\n Creates a new function declaration.\r\n \r\n \r\n \r\n \r\n Creates a new function declaration.\r\n \r\n \r\n \r\n \r\n Creates a new function declaration.\r\n \r\n \r\n \r\n \r\n Creates a fresh function declaration with a name prefixed with .\r\n \r\n \r\n \r\n \r\n \r\n \r\n Creates a new constant function declaration.\r\n \r\n \r\n \r\n \r\n Creates a new constant function declaration.\r\n \r\n \r\n \r\n \r\n Creates a fresh constant function declaration with a name prefixed with .\r\n \r\n \r\n \r\n \r\n \r\n \r\n Creates a new bound variable.\r\n \r\n The de-Bruijn index of the variable\r\n The sort of the variable\r\n \r\n \r\n \r\n Create a quantifier pattern.\r\n \r\n \r\n \r\n \r\n Creates a new Constant of sort and named .\r\n \r\n \r\n \r\n \r\n Creates a new Constant of sort and named .\r\n \r\n \r\n \r\n \r\n Creates a fresh Constant of sort and a \r\n name prefixed with .\r\n \r\n \r\n \r\n \r\n Creates a fresh constant from the FuncDecl .\r\n \r\n A decl of a 0-arity function\r\n \r\n \r\n \r\n Create a Boolean constant.\r\n \r\n \r\n \r\n \r\n Create a Boolean constant.\r\n \r\n \r\n \r\n \r\n Creates an integer constant.\r\n \r\n \r\n \r\n \r\n Creates an integer constant.\r\n \r\n \r\n \r\n \r\n Creates a real constant.\r\n \r\n \r\n \r\n \r\n Creates a real constant.\r\n \r\n \r\n \r\n \r\n Creates a bit-vector constant.\r\n \r\n \r\n \r\n \r\n Creates a bit-vector constant.\r\n \r\n \r\n \r\n \r\n Create a new function application.\r\n \r\n \r\n \r\n \r\n The true Term.\r\n \r\n \r\n \r\n \r\n The false Term.\r\n \r\n \r\n \r\n \r\n Creates a Boolean value.\r\n \r\n \r\n \r\n \r\n Creates the equality = .\r\n \r\n \r\n \r\n \r\n Creates a distinct term.\r\n \r\n \r\n \r\n \r\n Mk an expression representing not(a).\r\n \r\n \r\n \r\n \r\n Create an expression representing an if-then-else: ite(t1, t2, t3).\r\n \r\n An expression with Boolean sort\r\n An expression \r\n An expression with the same sort as \r\n \r\n \r\n \r\n Create an expression representing t1 iff t2.\r\n \r\n \r\n \r\n \r\n Create an expression representing t1 -> t2.\r\n \r\n \r\n \r\n \r\n Create an expression representing t1 xor t2.\r\n \r\n \r\n \r\n \r\n Create an expression representing t[0] and t[1] and ....\r\n \r\n \r\n \r\n \r\n Create an expression representing t[0] or t[1] or ....\r\n \r\n \r\n \r\n \r\n Create an expression representing t[0] + t[1] + ....\r\n \r\n \r\n \r\n \r\n Create an expression representing t[0] * t[1] * ....\r\n \r\n \r\n \r\n \r\n Create an expression representing t[0] - t[1] - ....\r\n \r\n \r\n \r\n \r\n Create an expression representing -t.\r\n \r\n \r\n \r\n \r\n Create an expression representing t1 / t2.\r\n \r\n \r\n \r\n \r\n Create an expression representing t1 mod t2.\r\n \r\n The arguments must have int type.\r\n \r\n \r\n \r\n Create an expression representing t1 rem t2.\r\n \r\n The arguments must have int type.\r\n \r\n \r\n \r\n Create an expression representing t1 ^ t2.\r\n \r\n \r\n \r\n \r\n Create an expression representing t1 < t2\r\n \r\n \r\n \r\n \r\n Create an expression representing t1 <= t2\r\n \r\n \r\n \r\n \r\n Create an expression representing t1 > t2\r\n \r\n \r\n \r\n \r\n Create an expression representing t1 >= t2\r\n \r\n \r\n \r\n \r\n Coerce an integer to a real.\r\n \r\n \r\n There is also a converse operation exposed. It follows the semantics prescribed by the SMT-LIB standard.\r\n \r\n You can take the floor of a real by creating an auxiliary integer Term k and\r\n and asserting MakeInt2Real(k) <= t1 < MkInt2Real(k)+1.\r\n The argument must be of integer sort.\r\n \r\n \r\n \r\n \r\n Coerce a real to an integer.\r\n \r\n \r\n The semantics of this function follows the SMT-LIB standard for the function to_int.\r\n The argument must be of real sort.\r\n \r\n \r\n \r\n \r\n Creates an expression that checks whether a real number is an integer.\r\n \r\n \r\n \r\n \r\n Bitwise negation.\r\n \r\n The argument must have a bit-vector sort.\r\n \r\n \r\n \r\n Take conjunction of bits in a vector, return vector of length 1.\r\n \r\n The argument must have a bit-vector sort.\r\n \r\n \r\n \r\n Take disjunction of bits in a vector, return vector of length 1.\r\n \r\n The argument must have a bit-vector sort.\r\n \r\n \r\n \r\n Bitwise conjunction.\r\n \r\n The arguments must have a bit-vector sort.\r\n \r\n \r\n \r\n Bitwise disjunction.\r\n \r\n The arguments must have a bit-vector sort.\r\n \r\n \r\n \r\n Bitwise XOR.\r\n \r\n The arguments must have a bit-vector sort.\r\n \r\n \r\n \r\n Bitwise NAND.\r\n \r\n The arguments must have a bit-vector sort.\r\n \r\n \r\n \r\n Bitwise NOR.\r\n \r\n The arguments must have a bit-vector sort.\r\n \r\n \r\n \r\n Bitwise XNOR.\r\n \r\n The arguments must have a bit-vector sort.\r\n \r\n \r\n \r\n Standard two's complement unary minus.\r\n \r\n The arguments must have a bit-vector sort.\r\n \r\n \r\n \r\n Two's complement addition.\r\n \r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n Two's complement subtraction.\r\n \r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n Two's complement multiplication.\r\n \r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n Unsigned division.\r\n \r\n \r\n It is defined as the floor of t1/t2 if \\c t2 is\r\n different from zero. If t2 is zero, then the result\r\n is undefined.\r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Signed division.\r\n \r\n \r\n It is defined in the following way:\r\n \r\n - The \\c floor of t1/t2 if \\c t2 is different from zero, and t1*t2 >= 0.\r\n \r\n - The \\c ceiling of t1/t2 if \\c t2 is different from zero, and t1*t2 < 0.\r\n \r\n If t2 is zero, then the result is undefined.\r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Unsigned remainder.\r\n \r\n \r\n It is defined as t1 - (t1 /u t2) * t2, where /u represents unsigned division. \r\n If t2 is zero, then the result is undefined.\r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Signed remainder.\r\n \r\n \r\n It is defined as t1 - (t1 /s t2) * t2, where /s represents signed division.\r\n The most significant bit (sign) of the result is equal to the most significant bit of \\c t1.\r\n \r\n If t2 is zero, then the result is undefined.\r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Two's complement signed remainder (sign follows divisor).\r\n \r\n \r\n If t2 is zero, then the result is undefined.\r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Unsigned less-than\r\n \r\n \r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Two's complement signed less-than\r\n \r\n \r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Unsigned less-than or equal to.\r\n \r\n \r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Two's complement signed less-than or equal to.\r\n \r\n \r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Unsigned greater than or equal to.\r\n \r\n \r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Two's complement signed greater than or equal to.\r\n \r\n \r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Unsigned greater-than.\r\n \r\n \r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Two's complement signed greater-than.\r\n \r\n \r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Bit-vector concatenation.\r\n \r\n \r\n The arguments must have a bit-vector sort.\r\n \r\n \r\n The result is a bit-vector of size n1+n2, where n1 (n2) \r\n is the size of t1 (t2).\r\n \r\n \r\n \r\n \r\n Bit-vector extraction.\r\n \r\n \r\n Extract the bits down to from a bitvector of\r\n size m to yield a new bitvector of size n, where \r\n n = high - low + 1.\r\n The argument must have a bit-vector sort.\r\n \r\n \r\n \r\n \r\n Bit-vector sign extension.\r\n \r\n \r\n Sign-extends the given bit-vector to the (signed) equivalent bitvector of\r\n size m+i, where \\c m is the size of the given bit-vector.\r\n The argument must have a bit-vector sort.\r\n \r\n \r\n \r\n \r\n Bit-vector zero extension.\r\n \r\n \r\n Extend the given bit-vector with zeros to the (unsigned) equivalent\r\n bitvector of size m+i, where \\c m is the size of the\r\n given bit-vector.\r\n The argument must have a bit-vector sort.\r\n \r\n \r\n \r\n \r\n Bit-vector repetition.\r\n \r\n \r\n The argument must have a bit-vector sort.\r\n \r\n \r\n \r\n \r\n Shift left.\r\n \r\n \r\n It is equivalent to multiplication by 2^x where \\c x is the value of .\r\n \r\n NB. The semantics of shift operations varies between environments. This \r\n definition does not necessarily capture directly the semantics of the \r\n programming language or assembly architecture you are modeling.\r\n \r\n The arguments must have a bit-vector sort.\r\n \r\n \r\n \r\n \r\n Logical shift right\r\n \r\n \r\n It is equivalent to unsigned division by 2^x where \\c x is the value of .\r\n \r\n NB. The semantics of shift operations varies between environments. This \r\n definition does not necessarily capture directly the semantics of the \r\n programming language or assembly architecture you are modeling.\r\n \r\n The arguments must have a bit-vector sort.\r\n \r\n \r\n \r\n \r\n Arithmetic shift right\r\n \r\n \r\n It is like logical shift right except that the most significant\r\n bits of the result always copy the most significant bit of the\r\n second argument.\r\n \r\n NB. The semantics of shift operations varies between environments. This \r\n definition does not necessarily capture directly the semantics of the \r\n programming language or assembly architecture you are modeling.\r\n \r\n The arguments must have a bit-vector sort.\r\n \r\n \r\n \r\n \r\n Rotate Left.\r\n \r\n \r\n Rotate bits of \\c t to the left \\c i times.\r\n The argument must have a bit-vector sort.\r\n \r\n \r\n \r\n \r\n Rotate Right.\r\n \r\n \r\n Rotate bits of \\c t to the right \\c i times.\r\n The argument must have a bit-vector sort.\r\n \r\n \r\n \r\n \r\n Rotate Left.\r\n \r\n \r\n Rotate bits of to the left times.\r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Rotate Right.\r\n \r\n \r\n Rotate bits of to the right times.\r\n The arguments must have the same bit-vector sort.\r\n \r\n \r\n \r\n \r\n Create an bit bit-vector from the integer argument .\r\n \r\n \r\n NB. This function is essentially treated as uninterpreted. \r\n So you cannot expect Z3 to precisely reflect the semantics of this function\r\n when solving constraints with this function.\r\n \r\n The argument must be of integer sort.\r\n \r\n \r\n \r\n \r\n Create an integer from the bit-vector argument .\r\n \r\n \r\n If \\c is_signed is false, then the bit-vector \\c t1 is treated as unsigned. \r\n So the result is non-negative and in the range [0..2^N-1], where \r\n N are the number of bits in .\r\n If \\c is_signed is true, \\c t1 is treated as a signed bit-vector.\r\n \r\n NB. This function is essentially treated as uninterpreted. \r\n So you cannot expect Z3 to precisely reflect the semantics of this function\r\n when solving constraints with this function.\r\n \r\n The argument must be of bit-vector sort.\r\n \r\n \r\n \r\n \r\n Create a predicate that checks that the bit-wise addition does not overflow.\r\n \r\n \r\n The arguments must be of bit-vector sort.\r\n \r\n \r\n \r\n \r\n Create a predicate that checks that the bit-wise addition does not underflow.\r\n \r\n \r\n The arguments must be of bit-vector sort.\r\n \r\n \r\n \r\n \r\n Create a predicate that checks that the bit-wise subtraction does not overflow.\r\n \r\n \r\n The arguments must be of bit-vector sort.\r\n \r\n \r\n \r\n \r\n Create a predicate that checks that the bit-wise subtraction does not underflow.\r\n \r\n \r\n The arguments must be of bit-vector sort.\r\n \r\n \r\n \r\n \r\n Create a predicate that checks that the bit-wise signed division does not overflow.\r\n \r\n \r\n The arguments must be of bit-vector sort.\r\n \r\n \r\n \r\n \r\n Create a predicate that checks that the bit-wise negation does not overflow.\r\n \r\n \r\n The arguments must be of bit-vector sort.\r\n \r\n \r\n \r\n \r\n Create a predicate that checks that the bit-wise multiplication does not overflow.\r\n \r\n \r\n The arguments must be of bit-vector sort.\r\n \r\n \r\n \r\n \r\n Create a predicate that checks that the bit-wise multiplication does not underflow.\r\n \r\n \r\n The arguments must be of bit-vector sort.\r\n \r\n \r\n \r\n \r\n Create an array constant.\r\n \r\n \r\n \r\n \r\n Create an array constant.\r\n \r\n \r\n \r\n \r\n Array read. \r\n \r\n \r\n The argument a is the array and i is the index \r\n of the array that gets read. \r\n \r\n The node a must have an array sort [domain -> range], \r\n and i must have the sort domain.\r\n The sort of the result is range.\r\n \r\n \r\n \r\n \r\n \r\n \r\n Array update. \r\n \r\n \r\n The node a must have an array sort [domain -> range], \r\n i must have sort domain,\r\n v must have sort range. The sort of the result is [domain -> range].\r\n The semantics of this function is given by the theory of arrays described in the SMT-LIB\r\n standard. See http://smtlib.org for more details.\r\n The result of this function is an array that is equal to a \r\n (with respect to select)\r\n on all indices except for i, where it maps to v \r\n (and the select of a with \r\n respect to i may be a different value).\r\n \r\n \r\n \r\n \r\n \r\n \r\n Create a constant array.\r\n \r\n \r\n The resulting term is an array, such that a selecton an arbitrary index \r\n produces the value v.\r\n \r\n \r\n \r\n \r\n \r\n \r\n Maps f on the argument arrays.\r\n \r\n \r\n Eeach element of args must be of an array sort [domain_i -> range_i].\r\n The function declaration f must have type range_1 .. range_n -> range.\r\n v must have sort range. The sort of the result is [domain_i -> range].\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Access the array default value.\r\n \r\n \r\n Produces the default range value, for arrays that can be represented as \r\n finite maps with a default range value. \r\n \r\n \r\n \r\n \r\n Create a set type.\r\n \r\n \r\n \r\n \r\n Create an empty set.\r\n \r\n \r\n \r\n \r\n Create the full set.\r\n \r\n \r\n \r\n \r\n Add an element to the set.\r\n \r\n \r\n \r\n \r\n Remove an element from a set.\r\n \r\n \r\n \r\n \r\n Take the union of a list of sets.\r\n \r\n \r\n \r\n \r\n Take the intersection of a list of sets.\r\n \r\n \r\n \r\n \r\n Take the difference between two sets.\r\n \r\n \r\n \r\n \r\n Take the complement of a set.\r\n \r\n \r\n \r\n \r\n Check for set membership.\r\n \r\n \r\n \r\n \r\n Check for subsetness of sets.\r\n \r\n \r\n \r\n \r\n Create a Term of a given sort. \r\n \r\n A string representing the Term value in decimal notation. If the given sort is a real, then the Term can be a rational, that is, a string of the form [num]* / [num]*.\r\n The sort of the numeral. In the current implementation, the given sort can be an int, real, or bit-vectors of arbitrary size. \r\n A Term with value and sort \r\n \r\n \r\n \r\n Create a Term of a given sort. This function can be use to create numerals that fit in a machine integer.\r\n It is slightly faster than MakeNumeral since it is not necessary to parse a string. \r\n \r\n Value of the numeral\r\n Sort of the numeral\r\n A Term with value and type \r\n \r\n \r\n \r\n Create a Term of a given sort. This function can be use to create numerals that fit in a machine integer.\r\n It is slightly faster than MakeNumeral since it is not necessary to parse a string. \r\n \r\n Value of the numeral\r\n Sort of the numeral\r\n A Term with value and type \r\n \r\n \r\n \r\n Create a Term of a given sort. This function can be use to create numerals that fit in a machine integer.\r\n It is slightly faster than MakeNumeral since it is not necessary to parse a string. \r\n \r\n Value of the numeral\r\n Sort of the numeral\r\n A Term with value and type \r\n \r\n \r\n \r\n Create a Term of a given sort. This function can be use to create numerals that fit in a machine integer.\r\n It is slightly faster than MakeNumeral since it is not necessary to parse a string. \r\n \r\n Value of the numeral\r\n Sort of the numeral\r\n A Term with value and type \r\n \r\n \r\n \r\n Create a real from a fraction.\r\n \r\n numerator of rational.\r\n denominator of rational.\r\n A Term with value / and sort Real\r\n \r\n \r\n \r\n \r\n Create a real numeral.\r\n \r\n A string representing the Term value in decimal notation.\r\n A Term with value and sort Real\r\n \r\n \r\n \r\n Create a real numeral.\r\n \r\n value of the numeral. \r\n A Term with value and sort Real\r\n \r\n \r\n \r\n Create a real numeral.\r\n \r\n value of the numeral. \r\n A Term with value and sort Real\r\n \r\n \r\n \r\n Create a real numeral.\r\n \r\n value of the numeral. \r\n A Term with value and sort Real\r\n \r\n \r\n \r\n Create a real numeral.\r\n \r\n value of the numeral. \r\n A Term with value and sort Real\r\n \r\n \r\n \r\n Create an integer numeral.\r\n \r\n A string representing the Term value in decimal notation.\r\n \r\n \r\n \r\n Create an integer numeral.\r\n \r\n value of the numeral. \r\n A Term with value and sort Integer\r\n \r\n \r\n \r\n Create an integer numeral.\r\n \r\n value of the numeral. \r\n A Term with value and sort Integer\r\n \r\n \r\n \r\n Create an integer numeral.\r\n \r\n value of the numeral. \r\n A Term with value and sort Integer\r\n \r\n \r\n \r\n Create an integer numeral.\r\n \r\n value of the numeral. \r\n A Term with value and sort Integer\r\n \r\n \r\n \r\n Create a bit-vector numeral.\r\n \r\n A string representing the value in decimal notation.\r\n the size of the bit-vector\r\n \r\n \r\n \r\n Create a bit-vector numeral.\r\n \r\n value of the numeral. \r\n the size of the bit-vector\r\n \r\n \r\n \r\n Create a bit-vector numeral.\r\n \r\n value of the numeral. \r\n the size of the bit-vector\r\n \r\n \r\n \r\n Create a bit-vector numeral.\r\n \r\n value of the numeral.\r\n /// the size of the bit-vector\r\n \r\n \r\n \r\n Create a bit-vector numeral.\r\n \r\n value of the numeral.\r\n the size of the bit-vector\r\n \r\n \r\n \r\n Create a universal Quantifier.\r\n \r\n \r\n Creates a forall formula, where is the weight, \r\n is an array of patterns, is an array\r\n with the sorts of the bound variables, is an array with the\r\n 'names' of the bound variables, and is the body of the\r\n quantifier. Quantifiers are associated with weights indicating\r\n the importance of using the quantifier during instantiation. \r\n \r\n the sorts of the bound variables.\r\n names of the bound variables\r\n the body of the quantifier.\r\n quantifiers are associated with weights indicating the importance of using the quantifier during instantiation. By default, pass the weight 0.\r\n array containing the patterns created using MkPattern.\r\n array containing the anti-patterns created using MkPattern.\r\n optional symbol to track quantifier.\r\n optional symbol to track skolem constants.\r\n \r\n \r\n \r\n Create a universal Quantifier.\r\n \r\n \r\n \r\n \r\n Create an existential Quantifier.\r\n \r\n \r\n \r\n \r\n \r\n Create an existential Quantifier.\r\n \r\n \r\n \r\n \r\n Create a Quantifier.\r\n \r\n \r\n \r\n \r\n Create a Quantifier.\r\n \r\n \r\n \r\n \r\n Convert a benchmark into an SMT-LIB formatted string.\r\n \r\n Name of the benchmark. The argument is optional.\r\n The benchmark logic. \r\n The status string (sat, unsat, or unknown)\r\n Other attributes, such as source, difficulty or category.\r\n Auxiliary assumptions.\r\n Formula to be checked for consistency in conjunction with assumptions.\r\n A string representation of the benchmark.\r\n \r\n \r\n \r\n Parse the given string using the SMT-LIB parser. \r\n \r\n \r\n The symbol table of the parser can be initialized using the given sorts and declarations. \r\n The symbols in the arrays and \r\n don't need to match the names of the sorts and declarations in the arrays \r\n and . This is a useful feature since we can use arbitrary names to \r\n reference sorts and declarations.\r\n \r\n \r\n \r\n \r\n Parse the given file using the SMT-LIB parser. \r\n \r\n \r\n \r\n \r\n \r\n Parse the given string using the SMT-LIB2 parser. \r\n \r\n \r\n A conjunction of assertions in the scope (up to push/pop) at the end of the string.\r\n \r\n \r\n \r\n Parse the given file using the SMT-LIB2 parser. \r\n \r\n \r\n \r\n \r\n \r\n Parse the given string using the Z3 native parser. \r\n \r\n A conjunction of asserts made in .\r\n \r\n \r\n \r\n Parse the given file using the Z3 native parser. \r\n \r\n A conjunction of asserts made in the file.\r\n \r\n \r\n \r\n Creates a new Goal.\r\n \r\n \r\n Note that the Context must have been created with proof generation support if \r\n is set to true here.\r\n \r\n Indicates whether model generation should be enabled.\r\n Indicates whether unsat core generation should be enabled.\r\n Indicates whether proof generation should be enabled. \r\n \r\n \r\n \r\n Creates a new ParameterSet.\r\n \r\n \r\n \r\n \r\n Returns a string containing a description of the tactic with the given name.\r\n \r\n \r\n \r\n \r\n Creates a new Tactic.\r\n \r\n \r\n \r\n \r\n Create a tactic that applies to a Goal and\r\n then to every subgoal produced by .\r\n \r\n \r\n \r\n \r\n Create a tactic that applies to a Goal and\r\n then to every subgoal produced by . \r\n \r\n \r\n Shorthand for AndThen.\r\n \r\n \r\n \r\n \r\n Create a tactic that first applies to a Goal and\r\n if it fails then returns the result of applied to the Goal.\r\n \r\n \r\n \r\n \r\n Create a tactic that applies to a goal for milliseconds. \r\n \r\n \r\n If does not terminate within milliseconds, then it fails.\r\n \r\n \r\n \r\n \r\n Create a tactic that applies to a given goal if the probe \r\n evaluates to true. \r\n \r\n \r\n If evaluates to false, then the new tactic behaves like the skip tactic. \r\n \r\n \r\n \r\n \r\n Create a tactic that applies to a given goal if the probe \r\n evaluates to true and otherwise.\r\n \r\n \r\n \r\n \r\n Create a tactic that keeps applying until the goal is not \r\n modified anymore or the maximum number of iterations is reached.\r\n \r\n \r\n \r\n \r\n Create a tactic that just returns the given goal.\r\n \r\n \r\n \r\n \r\n Create a tactic always fails.\r\n \r\n \r\n \r\n \r\n Create a tactic that fails if the probe evaluates to false.\r\n \r\n \r\n \r\n \r\n Create a tactic that fails if the goal is not triviall satisfiable (i.e., empty)\r\n or trivially unsatisfiable (i.e., contains `false').\r\n \r\n \r\n \r\n \r\n Create a tactic that applies using the given set of parameters .\r\n \r\n \r\n \r\n \r\n Create a tactic that applies using the given set of parameters .\r\n \r\n Alias for UsingParams\r\n \r\n \r\n \r\n Create a tactic that applies the given tactics in parallel.\r\n \r\n \r\n \r\n \r\n Create a tactic that applies to a given goal and then \r\n to every subgoal produced by . The subgoals are processed in parallel.\r\n \r\n \r\n \r\n \r\n Interrupt the execution of a Z3 procedure. \r\n \r\n This procedure can be used to interrupt: solvers, simplifiers and tactics.\r\n \r\n \r\n \r\n Returns a string containing a description of the probe with the given name.\r\n \r\n \r\n \r\n \r\n Creates a new Probe.\r\n \r\n \r\n \r\n \r\n Create a probe that always evaluates to .\r\n \r\n \r\n \r\n \r\n Create a probe that evaluates to \"true\" when the value returned by \r\n is less than the value returned by \r\n \r\n \r\n \r\n \r\n Create a probe that evaluates to \"true\" when the value returned by \r\n is greater than the value returned by \r\n \r\n \r\n \r\n \r\n Create a probe that evaluates to \"true\" when the value returned by \r\n is less than or equal the value returned by \r\n \r\n \r\n \r\n \r\n Create a probe that evaluates to \"true\" when the value returned by \r\n is greater than or equal the value returned by \r\n \r\n \r\n \r\n \r\n Create a probe that evaluates to \"true\" when the value returned by \r\n is equal to the value returned by \r\n \r\n \r\n \r\n \r\n Create a probe that evaluates to \"true\" when the value \r\n and evaluate to \"true\".\r\n \r\n \r\n \r\n \r\n Create a probe that evaluates to \"true\" when the value \r\n or evaluate to \"true\".\r\n \r\n \r\n \r\n \r\n Create a probe that evaluates to \"true\" when the value \r\n does not evaluate to \"true\".\r\n \r\n \r\n \r\n \r\n Creates a new (incremental) solver. \r\n \r\n \r\n This solver also uses a set of builtin tactics for handling the first \r\n check-sat command, and check-sat commands that take more than a given \r\n number of milliseconds to be solved. \r\n \r\n \r\n \r\n \r\n Creates a new (incremental) solver.\r\n \r\n \r\n \r\n \r\n \r\n Creates a new (incremental) solver. \r\n \r\n \r\n \r\n \r\n Creates a solver that is implemented using the given tactic.\r\n \r\n \r\n The solver supports the commands Push and Pop, but it\r\n will always solve each check from scratch.\r\n \r\n \r\n \r\n \r\n Create a Fixedpoint context.\r\n \r\n \r\n \r\n \r\n Return a string describing all available parameters to Expr.Simplify.\r\n \r\n \r\n \r\n \r\n Enable/disable printing of warning messages to the console.\r\n \r\n Note that this function is static and effects the behaviour of \r\n all contexts globally.\r\n \r\n \r\n \r\n Update a mutable configuration parameter.\r\n \r\n \r\n The list of all configuration parameters can be obtained using the Z3 executable:\r\n z3.exe -ini?\r\n Only a few configuration parameters are mutable once the context is created.\r\n An exception is thrown when trying to modify an immutable parameter.\r\n \r\n \r\n \r\n \r\n \r\n Get a configuration parameter.\r\n \r\n \r\n Returns null if the parameter value does not exist.\r\n \r\n \r\n \r\n \r\n \r\n Finalizer.\r\n \r\n \r\n \r\n \r\n Disposes of the context.\r\n \r\n \r\n \r\n \r\n Retrieves the Boolean sort of the context.\r\n \r\n \r\n \r\n \r\n Retrieves the Integer sort of the context.\r\n \r\n \r\n \r\n \r\n Retrieves the Real sort of the context.\r\n \r\n \r\n \r\n \r\n Selects the format used for pretty-printing expressions.\r\n \r\n \r\n The default mode for pretty printing expressions is to produce\r\n SMT-LIB style output where common subexpressions are printed \r\n at each occurrence. The mode is called Z3_PRINT_SMTLIB_FULL.\r\n To print shared common subexpressions only once, \r\n use the Z3_PRINT_LOW_LEVEL mode.\r\n To print in way that conforms to SMT-LIB standards and uses let\r\n expressions to share common sub-expressions use Z3_PRINT_SMTLIB_COMPLIANT.\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n The number of SMTLIB formulas parsed by the last call to ParseSMTLIBString or ParseSMTLIBFile.\r\n \r\n \r\n \r\n \r\n The formulas parsed by the last call to ParseSMTLIBString or ParseSMTLIBFile.\r\n \r\n \r\n \r\n \r\n The number of SMTLIB assumptions parsed by the last call to ParseSMTLIBString or ParseSMTLIBFile.\r\n \r\n \r\n \r\n \r\n The assumptions parsed by the last call to ParseSMTLIBString or ParseSMTLIBFile.\r\n \r\n \r\n \r\n \r\n The number of SMTLIB declarations parsed by the last call to ParseSMTLIBString or ParseSMTLIBFile.\r\n \r\n \r\n \r\n \r\n The declarations parsed by the last call to ParseSMTLIBString or ParseSMTLIBFile.\r\n \r\n \r\n \r\n \r\n The number of SMTLIB sorts parsed by the last call to ParseSMTLIBString or ParseSMTLIBFile.\r\n \r\n \r\n \r\n \r\n The declarations parsed by the last call to ParseSMTLIBString or ParseSMTLIBFile.\r\n \r\n \r\n \r\n \r\n The number of supported tactics.\r\n \r\n \r\n \r\n \r\n The names of all supported tactics.\r\n \r\n \r\n \r\n \r\n The number of supported Probes.\r\n \r\n \r\n \r\n \r\n The names of all supported Probes.\r\n \r\n \r\n \r\n \r\n Probes are used to inspect a goal (aka problem) and collect information that may be used to decide\r\n which solver and/or preprocessing step will be used.\r\n The complete list of probes may be obtained using the procedures Context.NumProbes\r\n and Context.ProbeNames.\r\n It may also be obtained using the command (help-tactics) in the SMT 2.0 front-end.\r\n \r\n \r\n \r\n \r\n Execute the probe over the goal. \r\n \r\n A probe always produce a double value.\r\n \"Boolean\" probes return 0.0 for false, and a value different from 0.0 for true.\r\n \r\n \r\n \r\n Apply the probe to a goal.\r\n \r\n \r\n \r\n \r\n Solvers.\r\n \r\n \r\n \r\n \r\n Creates a backtracking point.\r\n \r\n \r\n \r\n \r\n \r\n Backtracks backtracking points.\r\n \r\n Note that an exception is thrown if is not smaller than NumScopes\r\n \r\n \r\n \r\n \r\n Resets the Solver.\r\n \r\n This removes all assertions from the solver.\r\n \r\n \r\n \r\n Assert a constraint (or multiple) into the solver.\r\n \r\n \r\n \r\n \r\n Checks whether the assertions in the solver are consistent or not.\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n A string representation of the solver.\r\n \r\n \r\n \r\n \r\n A string that describes all available solver parameters.\r\n \r\n \r\n \r\n \r\n Sets the solver parameters.\r\n \r\n \r\n \r\n \r\n The current number of backtracking points (scopes).\r\n \r\n \r\n \r\n \r\n \r\n \r\n The number of assertions in the solver.\r\n \r\n \r\n \r\n \r\n The set of asserted formulas.\r\n \r\n \r\n \r\n \r\n The model of the last Check.\r\n \r\n \r\n The result is null if Check was not invoked before,\r\n if its results was not SATISFIABLE, or if model production is not enabled.\r\n \r\n \r\n \r\n \r\n The proof of the last Check.\r\n \r\n \r\n The result is null if Check was not invoked before,\r\n if its results was not UNSATISFIABLE, or if proof production is disabled.\r\n \r\n \r\n \r\n \r\n The unsat core of the last Check.\r\n \r\n \r\n The unsat core is a subset of Assertions\r\n The result is empty if Check was not invoked before,\r\n if its results was not UNSATISFIABLE, or if core production is disabled.\r\n \r\n \r\n \r\n \r\n A brief justification of why the last call to Check returned UNKNOWN.\r\n \r\n \r\n \r\n \r\n Solver statistics.\r\n \r\n \r\n \r\n \r\n Tactics are the basic building block for creating custom solvers for specific problem domains.\r\n The complete list of tactics may be obtained using Context.NumTactics \r\n and Context.TacticNames.\r\n It may also be obtained using the command (help-tactics) in the SMT 2.0 front-end.\r\n \r\n \r\n \r\n \r\n Execute the tactic over the goal. \r\n \r\n \r\n \r\n \r\n A string containing a description of parameters accepted by the tactic.\r\n \r\n \r\n \r\n \r\n Apply the tactic to a goal.\r\n \r\n \r\n \r\n \r\n Creates a solver that is implemented using the given tactic.\r\n \r\n \r\n \r\n \r\n \r\n Interaction logging for Z3.\r\n \r\n \r\n Note that this is a global, static log and if multiple Context \r\n objects are created, it logs the interaction with all of them.\r\n \r\n \r\n \r\n \r\n Open an interaction log file.\r\n \r\n the name of the file to open\r\n True if opening the log file succeeds, false otherwise.\r\n \r\n \r\n \r\n Closes the interaction log.\r\n \r\n \r\n \r\n \r\n Appends the user-provided string to the interaction log.\r\n \r\n \r\n \r\n \r\n Checks whether the interaction log is opened.\r\n \r\n True if the interaction log is open, false otherwise.\r\n \r\n \r\n \r\n Quantifier expressions.\r\n \r\n \r\n \r\n \r\n Indicates whether the quantifier is universal.\r\n \r\n \r\n \r\n \r\n Indicates whether the quantifier is existential.\r\n \r\n \r\n \r\n \r\n The weight of the quantifier.\r\n \r\n \r\n \r\n \r\n The number of patterns.\r\n \r\n \r\n \r\n \r\n The patterns.\r\n \r\n \r\n \r\n \r\n The number of no-patterns.\r\n \r\n \r\n \r\n \r\n The no-patterns.\r\n \r\n \r\n \r\n \r\n The number of bound variables.\r\n \r\n \r\n \r\n \r\n The symbols for the bound variables.\r\n \r\n \r\n \r\n \r\n The sorts of the bound variables.\r\n \r\n \r\n \r\n \r\n The body of the quantifier.\r\n \r\n \r\n \r\n \r\n The Sort class implements type information for ASTs.\r\n \r\n \r\n \r\n \r\n Comparison operator.\r\n \r\n A Sort\r\n A Sort\r\n True if and are from the same context \r\n and represent the same sort; false otherwise.\r\n \r\n \r\n \r\n Comparison operator.\r\n \r\n A Sort\r\n A Sort\r\n True if and are not from the same context \r\n or represent different sorts; false otherwise.\r\n \r\n \r\n \r\n Equality operator for objects of type Sort.\r\n \r\n \r\n \r\n \r\n \r\n \r\n Hash code generation for Sorts\r\n \r\n A hash code\r\n \r\n \r\n \r\n A string representation of the sort.\r\n \r\n \r\n \r\n \r\n Sort constructor\r\n \r\n \r\n \r\n \r\n Returns a unique identifier for the sort.\r\n \r\n \r\n \r\n \r\n The kind of the sort.\r\n \r\n \r\n \r\n \r\n The name of the sort\r\n \r\n \r\n \r\n \r\n A Boolean sort.\r\n \r\n \r\n \r\n \r\n An arithmetic sort, i.e., Int or Real.\r\n \r\n \r\n \r\n \r\n An Integer sort\r\n \r\n \r\n \r\n \r\n A real sort\r\n \r\n \r\n \r\n \r\n Bit-vector sorts.\r\n \r\n \r\n \r\n \r\n The size of the bit-vector sort.\r\n \r\n \r\n \r\n \r\n Array sorts.\r\n \r\n \r\n \r\n \r\n The domain of the array sort.\r\n \r\n \r\n \r\n \r\n The range of the array sort.\r\n \r\n \r\n \r\n \r\n Datatype sorts.\r\n \r\n \r\n \r\n \r\n The number of constructors of the datatype sort.\r\n \r\n \r\n \r\n \r\n The constructors.\r\n \r\n \r\n \r\n \r\n The recognizers.\r\n \r\n \r\n \r\n \r\n The constructor accessors.\r\n \r\n \r\n \r\n \r\n Uninterpreted Sorts\r\n \r\n \r\n \r\n \r\n Tuple sorts.\r\n \r\n \r\n \r\n \r\n The constructor function of the tuple.\r\n \r\n \r\n \r\n \r\n The number of fields in the tuple.\r\n \r\n \r\n \r\n \r\n The field declarations.\r\n \r\n \r\n \r\n \r\n Enumeration sorts.\r\n \r\n \r\n \r\n \r\n The function declarations of the constants in the enumeration.\r\n \r\n \r\n \r\n \r\n The constants in the enumeration.\r\n \r\n \r\n \r\n \r\n The test predicates for the constants in the enumeration.\r\n \r\n \r\n \r\n \r\n List sorts.\r\n \r\n \r\n \r\n \r\n The declaration of the nil function of this list sort.\r\n \r\n \r\n \r\n \r\n The empty list.\r\n \r\n \r\n \r\n \r\n The declaration of the isNil function of this list sort.\r\n \r\n \r\n \r\n \r\n The declaration of the cons function of this list sort.\r\n \r\n \r\n \r\n \r\n The declaration of the isCons function of this list sort.\r\n \r\n \r\n \r\n \r\n \r\n The declaration of the head function of this list sort.\r\n \r\n \r\n \r\n \r\n The declaration of the tail function of this list sort.\r\n \r\n \r\n \r\n \r\n Relation sorts.\r\n \r\n \r\n \r\n \r\n The arity of the relation sort.\r\n \r\n \r\n \r\n \r\n The sorts of the columns of the relation sort.\r\n \r\n \r\n \r\n \r\n Finite domain sorts.\r\n \r\n \r\n \r\n \r\n The size of the finite domain sort.\r\n \r\n \r\n \r\n \r\n Set sorts.\r\n \r\n \r\n \r\n \r\n Symbols are used to name several term and type constructors.\r\n \r\n \r\n \r\n \r\n Indicates whether the symbol is of Int kind\r\n \r\n \r\n \r\n \r\n Indicates whether the symbol is of string kind.\r\n \r\n \r\n \r\n \r\n A string representation of the symbol.\r\n \r\n \r\n \r\n \r\n Symbol constructor\r\n \r\n \r\n \r\n \r\n The kind of the symbol (int or string)\r\n \r\n \r\n \r\n \r\n Numbered symbols\r\n \r\n \r\n \r\n \r\n The int value of the symbol.\r\n \r\n Throws an exception if the symbol is not of int kind. \r\n \r\n \r\n \r\n Named symbols\r\n \r\n \r\n \r\n \r\n The string value of the symbol.\r\n \r\n Throws an exception if the symbol is not of string kind.\r\n \r\n \r\n \r\n Version information.\r\n \r\n Note that this class is static.\r\n \r\n \r\n \r\n A string representation of the version information.\r\n \r\n \r\n \r\n \r\n The major version\r\n \r\n \r\n \r\n \r\n The minor version\r\n \r\n \r\n \r\n \r\n The build version\r\n \r\n \r\n \r\n \r\n The revision\r\n \r\n \r\n \r\n\r\n" }, { "path": "ironclad-apps/tools/Dafny/PrepareBoogieZip.bat", "content": "@echo off\nsetlocal\n\nset DEST_DIR=export\n\nif exist %DEST_DIR% del /q %DEST_DIR%\\*\nif not exist %DEST_DIR% mkdir %DEST_DIR%\n\nfor %%f in (\n AbsInt.dll AbsInt.pdb\n Basetypes.dll Basetypes.pdb\n Boogie.exe Boogie.pdb\n BVD.exe BVD.pdb\n CodeContractsExtender.dll CodeContractsExtender.pdb\n Core.dll Core.pdb\n Doomed.dll Doomed.pdb\n Graph.dll Graph.pdb\n Houdini.dll Houdini.pdb\n Model.dll Model.pdb\n ParserHelper.dll ParserHelper.pdb\n Predication.dll Predication.pdb\n Provers.SMTLib.dll Provers.SMTLib.pdb\n UnivBackPred2.smt UnivBackPred2.smt2\n VCExpr.dll VCExpr.pdb\n VCGeneration.dll VCGeneration.pdb\n) do (\n copy %%f %DEST_DIR%\n)\n\nxcopy /E /I /Y CodeContracts \"%DEST_DIR%/CodeContracts\"\n\necho Done. Now, manually put the contents of the %DEST_DIR% directory into Boogie.zip\n" }, { "path": "ironclad-apps/tools/Dafny/PrepareDafnyZip.bat", "content": "@echo off\nsetlocal\n\nset DEST_DIR=export\n\nif exist %DEST_DIR% del /q %DEST_DIR%\\*\nif not exist %DEST_DIR% mkdir %DEST_DIR%\n\nfor %%f in (\n AbsInt.dll AbsInt.pdb\n Basetypes.dll Basetypes.pdb\n CodeContractsExtender.dll CodeContractsExtender.pdb\n Concurrency.dll Concurrency.pdb\n Core.dll Core.pdb\n Dafny.exe Dafny.pdb\n DafnyPipeline.dll DafnyPipeline.pdb\n DafnyPrelude.bpl DafnyRuntime.cs\n Doomed.dll Doomed.pdb\n ExecutionEngine.dll ExecutionEngine.pdb\n Graph.dll Graph.pdb\n Houdini.dll Houdini.pdb\n Model.dll Model.pdb\n ModelViewer.dll ModelViewer.pdb\n ParserHelper.dll ParserHelper.pdb\n Provers.SMTLib.dll Provers.SMTLib.pdb\n VCExpr.dll VCExpr.pdb\n VCGeneration.dll VCGeneration.pdb\n DafnyLanguageService.vsix\n) do (\n copy %%f %DEST_DIR%\n)\n\nxcopy /E /I /Y CodeContracts \"%DEST_DIR%\\CodeContracts\"\n\nfor %%d in (\n Util Util\\emacs Util\\vim Util\\latex\n) do (\n if not exist %DEST_DIR%\\%%d mkdir %DEST_DIR%\\%%d\n)\nfor %%f in (\n Util\\emacs\\dafny-mode.el\n Util\\vim\\dafny.vim\n Util\\latex\\dafny.sty\n) do (\n copy ..\\%%f %DEST_DIR%\\%%f\n)\n\necho Done. Now, manually put the contents of the %DEST_DIR% directory into Dafny.zip\n" }, { "path": "ironclad-apps/tools/Dafny/README", "content": "\nWhen upgrading to a new version of Boogie, it's important to increase the \nstack size it uses, since some of Boogie's internals use way too much for\nsome of our DafnyCC-generated files.\n\nYou can accomplish this using a Visual Studio Command Prompt and the command:\n\n editbin /stack:268435456 Boogie.exe\n\nwhich gives it a 256 MB stack.\n\n\n" }, { "path": "ironclad-apps/tools/Dafny/extension.vsixmanifest", "content": "\r\n \r\n \r\n DafnyMenu\r\n This is a menu for interacting with Dafny.\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/tools/DafnyCC/.gitignore", "content": "*.suo\n" }, { "path": "ironclad-apps/tools/DafnyCC/Analyze.cs", "content": "using System;\r\nusing System.Linq;\r\nusing System.Collections.Generic;\r\nusing System.Collections.ObjectModel;\r\nusing Microsoft.Dafny;\r\nusing Bpl = Microsoft.Boogie;\r\nusing System.Numerics;\r\n\r\npublic class Set\r\n{\r\n private bool full; \r\n private Dictionary map = new Dictionary(); \r\n\r\n public Set(bool full = false)\r\n {\r\n this.full = full;\r\n }\r\n\r\n public Set(Set s)\r\n {\r\n this.full = s.full;\r\n this.map = new Dictionary(s.map);\r\n }\r\n\r\n public Set(IEnumerable elems)\r\n {\r\n this.full = false;\r\n this.map = elems.ToDictionary(a => a);\r\n }\r\n\r\n public bool Contains(A a) { return full || map.ContainsKey(a); }\r\n\r\n public void Add(A a)\r\n {\r\n if (!full) map[a] = a;\r\n }\r\n\r\n public bool IntersectFrom(Set s)\r\n {\r\n if (s.full)\r\n {\r\n return false;\r\n }\r\n else if (full)\r\n {\r\n full = false;\r\n map = new Dictionary(s.map);\r\n return true;\r\n }\r\n else\r\n {\r\n List toRemove = map.Keys.Where(a => !s.Contains(a)).ToList();\r\n toRemove.ForEach(a => map.Remove(a));\r\n return toRemove.Count > 0;\r\n }\r\n }\r\n\r\n public override bool Equals(object o)\r\n {\r\n Set s = o as Set;\r\n return s != null && full == s.full && map.Count == s.map.Count\r\n && map.Keys.ToList().TrueForAll(s.map.ContainsKey);\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return full ? \"*\" : String.Join(\" \", map.Keys);\r\n }\r\n\r\n public override int GetHashCode()\r\n {\r\n return map.GetHashCode();\r\n }\r\n}\r\n\r\npublic abstract class Analyze\r\n{\r\n protected List inVars;\r\n protected List outVars;\r\n protected List stmts;\r\n protected Dictionary labels = new Dictionary();\r\n protected List> preds = new List>();\r\n protected List> succs = new List>();\r\n protected List> liveVars = new List>(); //- set of live vars before each stmt; also record distance to next use\r\n protected List> defVars = new List>(); //- set of definitely-defined vars after each stmt\r\n\r\n public Analyze(List inVars, List outVars, List stmts)\r\n {\r\n this.inVars = inVars;\r\n this.outVars = outVars;\r\n this.stmts = stmts;\r\n ComputeControl();\r\n ComputeLiveVars();\r\n ComputeDefVars();\r\n }\r\n\r\n void ComputeControl()\r\n {\r\n for (int i = 0; i < stmts.Count; i++)\r\n {\r\n RtlLabel label = stmts[i] as RtlLabel;\r\n if (label != null)\r\n {\r\n labels.Add(label.label, i);\r\n }\r\n }\r\n stmts.ForEach(_ => preds.Add(new List()));\r\n for (int i = 0; i < stmts.Count; i++)\r\n {\r\n RtlJump jump = stmts[i] as RtlJump;\r\n RtlReturn ret = stmts[i] as RtlReturn;\r\n List succs_i = new List();\r\n succs.Add(succs_i);\r\n if (jump != null)\r\n {\r\n int target = labels[jump.label];\r\n succs[i].Add(target);\r\n preds[target].Add(i);\r\n }\r\n if (ret == null && i + 1 < stmts.Count && (jump == null || jump.cond != null))\r\n {\r\n succs[i].Add(i + 1);\r\n preds[i + 1].Add(i);\r\n }\r\n }\r\n }\r\n\r\n void Dataflow(bool forward, bool addAll, Action init, Func work)\r\n {\r\n bool[] workSet = new bool[stmts.Count];\r\n Stack workList = new Stack();\r\n for (int i = 0; i < stmts.Count; i++)\r\n {\r\n if (i == 0 || addAll)\r\n {\r\n workSet[i] = true;\r\n workList.Push((forward && addAll) ? (stmts.Count - i - 1) : i);\r\n }\r\n init(i);\r\n }\r\n while (workList.Count != 0)\r\n {\r\n int i = workList.Pop();\r\n workSet[i] = false;\r\n bool changed = work(i, stmts[i]);\r\n if (changed)\r\n {\r\n foreach (int p in (forward ? succs : preds)[i])\r\n {\r\n if (!workSet[p])\r\n {\r\n workSet[p] = true;\r\n workList.Push(p);\r\n }\r\n }\r\n }\r\n }\r\n }\r\n\r\n void ComputeLiveVars()\r\n {\r\n Func work = (i, stmt) =>\r\n {\r\n bool changed = false;\r\n List uses = stmt.Uses();\r\n List defs = stmt.Defs();\r\n Dictionary live = liveVars[i];\r\n Action addLiveVar = (x, dist) =>\r\n {\r\n bool contains = live.ContainsKey(x);\r\n if (!contains || (contains && dist < live[x]))\r\n {\r\n changed = true;\r\n live[x] = dist;\r\n }\r\n };\r\n uses.ForEach(x => addLiveVar(x, 0));\r\n if (stmt is RtlReturn)\r\n {\r\n foreach (string x in outVars)\r\n {\r\n if (!defs.Contains(x))\r\n {\r\n addLiveVar(x, 1);\r\n }\r\n }\r\n }\r\n foreach (int s in succs[i])\r\n {\r\n foreach (var keyVal in liveVars[s])\r\n {\r\n string x = keyVal.Key;\r\n if (!defs.Contains(x))\r\n {\r\n addLiveVar(x, keyVal.Value + 1);\r\n }\r\n }\r\n }\r\n return changed;\r\n };\r\n Dataflow(false, true, i => { liveVars.Add(new Dictionary()); }, work);\r\n }\r\n\r\n void ComputeDefVars()\r\n {\r\n Func work = (i, stmt) =>\r\n {\r\n List defs = stmt.Defs();\r\n Set def = new Set(i == 0 ? new Set(inVars) : defVars[i]);\r\n List ps = preds[i];\r\n preds[i].ForEach(p => def.IntersectFrom(defVars[p]));\r\n defs.ForEach(x => def.Add(x));\r\n bool changed = !def.Equals(defVars[i]);\r\n defVars[i] = def;\r\n return changed;\r\n };\r\n //- null set represents all variables\r\n Dataflow(true, false, i => { defVars.Add(new Set(true)); }, work);\r\n }\r\n}\r\n\r\npublic class Optimize: Analyze\r\n{\r\n bool[] liveStmts;\r\n\r\n public Optimize(List inVars, List outVars, List stmts):\r\n base(inVars, outVars, stmts)\r\n {\r\n ComputeLiveStmts();\r\n }\r\n\r\n void ComputeLiveStmts()\r\n {\r\n liveStmts = new bool[stmts.Count];\r\n Stack workList = new Stack();\r\n liveStmts[0] = true;\r\n workList.Push(0);\r\n while (workList.Count != 0)\r\n {\r\n int i = workList.Pop();\r\n foreach (int s in succs[i])\r\n {\r\n if (!liveStmts[s])\r\n {\r\n liveStmts[s] = true;\r\n workList.Push(s);\r\n }\r\n }\r\n }\r\n }\r\n\r\n public List Run()\r\n {\r\n //- eliminate dead code\r\n return stmts.Where((_, i) => liveStmts[i]).ToList();\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/DafnyCC/CompileMethod.cs", "content": "using System;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Collections.Generic;\r\nusing System.Collections.ObjectModel;\r\nusing Microsoft.Dafny;\r\nusing Bpl = Microsoft.Boogie;\r\nusing Type = Microsoft.Dafny.Type;\r\nusing System.Numerics;\r\n\r\npublic class CompileMethod: CompileMethodGhost\r\n{\r\n public readonly DafnyCC dafnycc;\r\n Dictionary jumpOps = new Dictionary();\r\n Dictionary jumpOpsNot = new Dictionary();\r\n RegAlloc alloc;\r\n List whileEnd = new List();\r\n List instructionProcArgs = null;\r\n \r\n public int IPSize;\r\n\r\n public CompileMethod(DafnySpec dafnySpec, Method method, TypeApply typeApply,\r\n TextWriter writer, TextWriter iwriter, string moduleName, List imports):\r\n base(dafnySpec, method, typeApply, writer, iwriter, moduleName, imports)\r\n {\r\n dafnycc = (DafnyCC)dafnySpec;\r\n IPSize = dafnycc.IPSize;\r\n\r\n jumpOps.Add(\"Eq\", \"==\");\r\n jumpOps.Add(\"Neq\", \"!=\");\r\n jumpOps.Add(\"Lt\", \"<\");\r\n jumpOps.Add(\"Gt\", \">\");\r\n jumpOps.Add(\"Le\", \"<=\");\r\n jumpOps.Add(\"Ge\", \">=\");\r\n\r\n jumpOpsNot.Add(\"Eq\", \"!=\");\r\n jumpOpsNot.Add(\"Neq\", \"==\");\r\n jumpOpsNot.Add(\"Lt\", \">=\");\r\n jumpOpsNot.Add(\"Gt\", \"<=\");\r\n jumpOpsNot.Add(\"Le\", \">\");\r\n jumpOpsNot.Add(\"Ge\", \"<\");\r\n }\r\n\r\n public static string ProcName(bool isGhost, string x) { return DafnyCC.ProcName(isGhost, x); }\r\n\r\n string NewLabel()\r\n {\r\n return \"L\" + (tempCount++);\r\n }\r\n\r\n public RtlVar AsVarOrTemp(Expression exp)\r\n {\r\n RtlVar var = AsVar(exp);\r\n if (var == null)\r\n {\r\n var = TempVar(exp.Type);\r\n AddExpression(var, exp);\r\n }\r\n return var;\r\n }\r\n\r\n BigInteger? AsInt(Expression exp)\r\n {\r\n exp = GetExp(exp);\r\n LiteralExpr literal = exp as LiteralExpr;\r\n BinaryExpr binary = exp as BinaryExpr;\r\n if (literal != null)\r\n {\r\n if (literal.Value == null)\r\n {\r\n throw new Exception(\"unexpected null literal\");\r\n \r\n }\r\n else if (literal.Value is bool)\r\n {\r\n return new BigInteger(((bool)(literal.Value)) ? 1 : 0);\r\n }\r\n else\r\n {\r\n return (BigInteger)(literal.Value);\r\n }\r\n }\r\n else if (binary != null)\r\n {\r\n BigInteger? i1 = AsInt(binary.E0);\r\n BigInteger? i2 = AsInt(binary.E1);\r\n if (i1 != null && i2 != null)\r\n {\r\n switch (binary.Op)\r\n {\r\n case BinaryExpr.Opcode.Add: return i1 + i2;\r\n case BinaryExpr.Opcode.Sub: return i1 - i2;\r\n case BinaryExpr.Opcode.Mul: return i1 * i2;\r\n }\r\n }\r\n return null;\r\n }\r\n else\r\n {\r\n return null;\r\n }\r\n }\r\n\r\n RtlExp AsSimple(Expression exp)\r\n {\r\n exp = GetExp(exp);\r\n RtlVar var = AsVar(exp);\r\n BigInteger? i = AsInt(exp);\r\n if (var != null)\r\n {\r\n return var;\r\n }\r\n else if (i != null)\r\n {\r\n return new RtlInt((BigInteger)i);\r\n }\r\n else\r\n {\r\n return null;\r\n }\r\n }\r\n\r\n RtlExp AsSimpleOrTemp(Expression exp)\r\n {\r\n RtlExp re = AsSimple(exp);\r\n if (re == null)\r\n {\r\n RtlVar var = TempVar(exp.Type);\r\n AddExpression(var, exp);\r\n re = var;\r\n }\r\n return re;\r\n }\r\n\r\n //- group stmts[startIndex..stmts.Count-1] into single statement\r\n public void GroupStatements(int startIndex)\r\n {\r\n List group = new List();\r\n while (stmts.Count > startIndex)\r\n {\r\n group.Add(stmts[startIndex]);\r\n stmts.RemoveAt(startIndex);\r\n }\r\n stmts.Add(new RtlStmtGroup(group));\r\n }\r\n\r\n void Move(RtlVar dest, RtlExp src, bool isPtr)\r\n {\r\n RtlVar src_var = src as RtlVar;\r\n string comment = \"move:: \" + dest + \" := \" + src + \" // isPtr = \" + isPtr;\r\n if (!dest.isGhost)\r\n {\r\n if (src is RtlMem)\r\n {\r\n throw new Exception(\"internal error: Move RtlMem\"); \r\n }\r\n string ins = \"instr_Mov\";\r\n stmts.Add(new RtlInst(ins, new RtlVar[] { dest }, new RtlVar[0], new RtlExp[] { src }, false)\r\n .WithComment(comment));\r\n }\r\n if (dest.isGhost || isPtr)\r\n {\r\n stmts.Add(new RtlInst(null, new RtlVar[] { dest }, new RtlVar[0], new RtlExp[] { src }, true)\r\n .WithComment(comment));\r\n }\r\n if (isPtr && src_var != null)\r\n {\r\n RtlVar dest_abs = new RtlVar(dest.x + \"__abs\", dest.isGhost, dest.type);\r\n RtlVar src_abs = new RtlVar(src_var.x + \"__abs\", src_var.isGhost, src_var.type);\r\n stmts.Add(new RtlInst(null, new RtlVar[] { dest_abs }, new RtlVar[0], new RtlExp[] { src_abs }, true)\r\n .WithComment(comment));\r\n }\r\n }\r\n\r\n\r\n\r\n\r\n\r\n\r\n void Label(string label, bool loop = false)\r\n {\r\n stmts.Add(new RtlLabel(label, loop).WithComment(\"label:: \" + label + \" // isLoop = \" + loop));\r\n }\r\n\r\n void JumpIfHasType(string label, RtlVar e0, string constructor, Type targetType, bool jumpIf)\r\n {\r\n int start = stmts.Count;\r\n string targetTag = \"Tag_\" + TypeString(AppType(targetType)) + \"_\" + constructor;\r\n RtlVar objTag = TempVar(Type.Int);\r\n stmts.Add(new RtlStmtComputed(\r\n s => \"call r, mems := loadTag_\" + TypeString(AppType(targetType))\r\n + \"(r, core_state, stk, statics, io, mems, $commonVars, \"\r\n + \"$gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \"\r\n + s.args[0] + \", \" + new RtlMem(s.args[1].e, \"4\").AsOperand() + \", \"\r\n + e0 + \", \" + e0 + \"__abs, \" + RegAlloc.Reg(s.args[1].ToString()) + \");\",\r\n new List { new RtlArg(false, true, objTag), new RtlArg(true, false, e0) }, false)\r\n .WithComment(\"datatype_isConstructor:: \" + targetTag));\r\n GroupStatements(start);\r\n Jump(label, new RtlBinary(\r\n (jumpIf ? \"==\" : \"!=\"), objTag, new RtlLiteral(\"OConst(\" + targetTag + \")\")));\r\n }\r\n\r\n void Jump(string label, RtlBinary e = null)\r\n {\r\n if (e != null)\r\n {\r\n RtlInt ri0 = e.e0 as RtlInt;\r\n RtlInt ri1 = e.e1 as RtlInt;\r\n if (ri0 != null && ri1 != null)\r\n {\r\n //- would be illegal x86 instruction, so optimize away\r\n var i0 = ri0.i;\r\n var i1 = ri1.i;\r\n bool b;\r\n switch (e.op)\r\n {\r\n case \"==\": b = i0 == i1; break;\r\n case \"!=\": b = i0 != i1; break;\r\n case \"<\": b = i0 < i1; break;\r\n case \"<=\": b = i0 <= i1; break;\r\n case \">\": b = i0 > i1; break;\r\n case \">=\": b = i0 >= i1; break;\r\n default: throw new Exception(\"not implemented: \" + e.op);\r\n }\r\n if (!b)\r\n {\r\n return; //- branch not taken\r\n }\r\n e = null; //- branch taken\r\n }\r\n else if (ri0 != null)\r\n {\r\n //- would be illegal x86 instruction, so swap operands\r\n string op;\r\n switch (e.op)\r\n {\r\n case \"==\": op = \"==\"; break;\r\n case \"!=\": op = \"!=\"; break;\r\n case \"<\": op = \">\"; break;\r\n case \"<=\": op = \">=\"; break;\r\n case \">\": op = \"<\"; break;\r\n case \">=\": op = \"<=\"; break;\r\n default: throw new Exception(\"not implemented: \" + e.op);\r\n }\r\n e = new RtlBinary(op, e.e1, e.e0);\r\n }\r\n }\r\n stmts.Add(new RtlJump(label, e).WithComment(\"jump_to_label:: \" + label + \" condition = \" + e));\r\n }\r\n\r\n void Jump(string label, Expression exp, bool jumpIf = true)\r\n {\r\n exp = GetExp(exp);\r\n RtlExp e = AsSimple(exp);\r\n BinaryExpr binary = exp as BinaryExpr;\r\n UnaryExpr unary = exp as UnaryExpr;\r\n MemberSelectExpr memberSelect = exp as MemberSelectExpr;\r\n if (e != null)\r\n {\r\n Jump(label, new RtlBinary(jumpIf ? \"!=\" : \"==\", e, new RtlInt(0)));\r\n }\r\n else if (binary != null && jumpOps.ContainsKey(binary.Op.ToString()))\r\n {\r\n Type t = AppType(binary.E0.Type);\r\n UserDefinedType ut = t as UserDefinedType;\r\n if (!t.Equals(AppType(binary.E1.Type)))\r\n {\r\n throw new Exception(\"not supported: comparison of values with different types\");\r\n }\r\n else if (t is SeqType && (binary.Op == BinaryExpr.Opcode.Eq || binary.Op == BinaryExpr.Opcode.Neq))\r\n {\r\n var tmp = TempVar(Type.Bool);\r\n var m = dafnySpec.GetSeqMethod(AppType(t), \"seq_Equal\");\r\n AddCall(new List { tmp }, false, true, m.Item1,\r\n new List { null, null },\r\n new List { binary.E0, binary.E1 },\r\n m.Item1.Outs, m.Item2);\r\n jumpIf = (jumpIf == (binary.Op == BinaryExpr.Opcode.Eq));\r\n Jump(label, new RtlBinary(jumpIf ? \"!=\" : \"==\", tmp, new RtlInt(0)));\r\n }\r\n else if (t is IntType || t is BoolType || (ut != null && ut.Name == \"array\"))\r\n {\r\n RtlExp e0 = AsSimpleOrTemp(binary.E0);\r\n RtlExp e1 = AsSimpleOrTemp(binary.E1);\r\n Jump(label, new RtlBinary(\r\n (jumpIf ? jumpOps : jumpOpsNot)[binary.Op.ToString()], e0, e1));\r\n }\r\n else\r\n {\r\n throw new Exception(\"not supported: comparison of values of type \" + t);\r\n }\r\n }\r\n else if (binary != null && binary.Op == BinaryExpr.Opcode.Iff && jumpIf)\r\n {\r\n Jump(label, DafnySpec.MakeBinaryExpr(BinaryExpr.Opcode.Or, BinaryExpr.ResolvedOpcode.Or, Type.Bool,\r\n DafnySpec.MakeBinaryExpr(BinaryExpr.Opcode.And, BinaryExpr.ResolvedOpcode.And, Type.Bool, binary.E0, binary.E1),\r\n DafnySpec.MakeBinaryExpr(BinaryExpr.Opcode.And, BinaryExpr.ResolvedOpcode.And, Type.Bool,\r\n new UnaryOpExpr(binary.tok, UnaryOpExpr.Opcode.Not, binary.E0),\r\n new UnaryOpExpr(binary.tok, UnaryOpExpr.Opcode.Not, binary.E1))), jumpIf);\r\n }\r\n else if (binary != null && binary.Op == BinaryExpr.Opcode.Imp)\r\n {\r\n Jump(label, DafnySpec.MakeBinaryExpr(BinaryExpr.Opcode.Or, BinaryExpr.ResolvedOpcode.Or, Type.Bool,\r\n new UnaryOpExpr(binary.tok, UnaryOpExpr.Opcode.Not, binary.E0), binary.E1), jumpIf);\r\n }\r\n else if (binary != null && (\r\n (binary.Op == BinaryExpr.Opcode.Or && jumpIf)\r\n || (binary.Op == BinaryExpr.Opcode.And && !jumpIf)))\r\n {\r\n Jump(label, binary.E0, jumpIf);\r\n Jump(label, binary.E1, jumpIf);\r\n }\r\n else if (binary != null && (\r\n (binary.Op == BinaryExpr.Opcode.Or && !jumpIf)\r\n || (binary.Op == BinaryExpr.Opcode.And && jumpIf)))\r\n {\r\n string skip = NewLabel();\r\n Jump(skip, binary.E0, !jumpIf);\r\n Jump(label, binary.E1, jumpIf);\r\n Label(skip);\r\n } \r\n else if (unary != null && unary is UnaryOpExpr && ((UnaryOpExpr)unary).Op == UnaryOpExpr.Opcode.Not)\r\n {\r\n Jump(label, unary.E, !jumpIf);\r\n }\r\n else if (memberSelect != null && memberSelect.Member is Field && memberSelect.MemberName.EndsWith(\"?\"))\r\n {\r\n string constructor = memberSelect.MemberName.Substring(0, memberSelect.MemberName.Length - 1);\r\n RtlVar e0 = AsVarOrTemp(memberSelect.Obj);\r\n JumpIfHasType(label, e0, constructor, memberSelect.Obj.Type, jumpIf);\r\n }\r\n else\r\n {\r\n RtlVar tmp = TempVar(exp.Type);\r\n AddExpression(tmp, exp);\r\n Jump(label, new RtlBinary(jumpIf ? \"!=\" : \"==\", tmp, new RtlInt(0)));\r\n }\r\n }\r\n\r\n void ArrayLength(RtlVar dest, RtlExp eArr)\r\n {\r\n string abs = eArr + \"__abs\";\r\n int start = stmts.Count;\r\n stmts.Add(new RtlStmtComputed(\r\n s => \"call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, \"\r\n + \"$gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \"\r\n + s.args[0] + \", \" + new RtlMem(s.args[1].e, new RtlInt(4)).AsOperand() + \", \"\r\n + \"(0 - 1), \" + abs + \", \" + RegAlloc.Reg(s.args[1].ToString()) + \");\",\r\n new List { new RtlArg(false, true, dest), new RtlArg(true, false, eArr) }, false)\r\n .WithComment(\"loadArrayElement\"));\r\n GroupStatements(start);\r\n }\r\n\r\n string BinaryInstOp(BinaryExpr.Opcode op)\r\n {\r\n string wrapped_op = \"instr_\" + op.ToString();\r\n switch (op)\r\n {\r\n case BinaryExpr.Opcode.Add:\r\n case BinaryExpr.Opcode.Sub:\r\n case BinaryExpr.Opcode.Mul:\r\n return wrapped_op + \"Checked\";\r\n default:\r\n return wrapped_op;\r\n }\r\n }\r\n\r\n void AddBoolViaJump(RtlVar dest, Expression exp)\r\n {\r\n //- dest = 0\r\n //- if (e1 == e2) goto skip\r\n //- dest = 1\r\n //- skip:\r\n Move(dest, new RtlInt(0), false);\r\n string skip = NewLabel();\r\n Jump(skip, exp, false);\r\n Move(dest, new RtlInt(1), false);\r\n Label(skip);\r\n }\r\n\r\n void AddBinary(RtlVar dest, string op, Expression exp0, Expression exp1,\r\n List pinRegs = null, string envIn = null, string envOut = null)\r\n {\r\n exp0 = GetExp(exp0);\r\n exp1 = GetExp(exp1);\r\n RtlVar x0 = AsVar(exp0);\r\n RtlVar x1 = AsVar(exp1);\r\n RtlExp e1 = AsSimple(exp1);\r\n if (x0 == null)\r\n {\r\n RtlVar tmp = TempVar(exp0.Type);\r\n AddExpression(tmp, exp0);\r\n x0 = tmp;\r\n }\r\n else if (x0.getName() != dest.getName())\r\n {\r\n if ((x1 != null && x1.getName() != dest.getName()) || (x1 == null && e1 != null))\r\n {\r\n //- a := b - c;\r\n //- ==>\r\n //- a := b;\r\n //- a := a - c;\r\n Move(dest, x0, false);\r\n x0 = dest;\r\n }\r\n else\r\n {\r\n //- a := b - a;\r\n //- ==>\r\n //- tmp := b;\r\n //- tmp := tmp - a;\r\n //- a := tmp;\r\n RtlVar tmp = TempVar(exp0.Type);\r\n Move(tmp, x0, false);\r\n x0 = tmp;\r\n }\r\n }\r\n if (e1 == null)\r\n {\r\n RtlVar tmp = TempVar(exp1.Type);\r\n AddExpression(tmp, exp1);\r\n e1 = tmp;\r\n }\r\n var inst = new RtlInst(\r\n op,\r\n new RtlVar[0],\r\n new RtlVar[] { x0 },\r\n new RtlExp[] { e1 },\r\n false, envIn, envOut);\r\n if (pinRegs != null)\r\n {\r\n for (int i = 0; i < 2; i++)\r\n {\r\n inst.args[i].pinReg = pinRegs[i];\r\n }\r\n }\r\n stmts.Add(inst.WithComment(\"binary_assignment:: \" + dest + \" := \" + op + \"(\" + x0 + \", \" + x1 + \")\"));\r\n if (x0.getName() != dest.getName())\r\n {\r\n Move(dest, x0, false);\r\n }\r\n }\r\n\r\n SeqTree AddBuildSequenceRec(Expression exp, List> flatExps)\r\n {\r\n BinaryExpr binary = exp as BinaryExpr;\r\n SeqDisplayExpr seqDisplay = exp as SeqDisplayExpr;\r\n if (seqDisplay != null)\r\n {\r\n foreach (Expression ei in seqDisplay.Elements)\r\n {\r\n flatExps.Add(Tuple.Create(false, ei));\r\n }\r\n return new SeqTree(null, null, seqDisplay.Elements.Count);\r\n }\r\n else if (binary != null && binary.ResolvedOp == BinaryExpr.ResolvedOpcode.Concat)\r\n {\r\n var s0 = AddBuildSequenceRec(binary.E0, flatExps);\r\n var s1 = AddBuildSequenceRec(binary.E1, flatExps);\r\n return new SeqTree(s0, s1, -1);\r\n }\r\n else\r\n {\r\n //- leaf of the append tree (assumed to be a sequence)\r\n flatExps.Add(Tuple.Create(true, exp));\r\n return null;\r\n }\r\n }\r\n\r\n void AddBuildSequence(RtlVar dest, Expression exp)\r\n {\r\n List> flatExps = new List>();\r\n var tree = AddBuildSequenceRec(exp, flatExps);\r\n \r\n var m = dafnycc.GetSeqBuildMethod(AppType(exp.Type), tree, flatExps.ConvertAll(x => x.Item1));\r\n AddCall(new List { dest }, false, true, m.Item1, flatExps.ConvertAll(x => x.Item2), m.Item1.Outs, m.Item2);\r\n }\r\n\r\n void AddFieldSelect(RtlVar dest, RtlVar obj, Type objType, string fieldName, Type fieldType, RtlExp expGhost)\r\n {\r\n string typeAndField = TypeString(AppType(objType)) + \"_\" + fieldName;\r\n string abs = obj + \"__abs\";\r\n string offset = \"Offset_\" + typeAndField;\r\n int start = stmts.Count;\r\n stmts.Add(new RtlStmtComputed(\r\n s => \"call r, mems := loadField_\" + typeAndField\r\n + \"(r, core_state, stk, statics, io, mems, $commonVars, \"\r\n + \"$gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \"\r\n + s.args[0] + \", \" + new RtlMem(s.args[1].e, offset).AsOperand() + \", \"\r\n + obj + \", \" + abs + \", \" + RegAlloc.Reg(s.args[1].ToString()) + \");\",\r\n new List { new RtlArg(false, true, dest), new RtlArg(true, false, obj) }, false)\r\n .WithComment(\"datatype_loadField:: \" + fieldName));\r\n GroupStatements(start);\r\n if (IsPtrType(AppType(fieldType)))\r\n {\r\n RtlVar dest_abs = new RtlVar(dest + \"__abs\", dest.isGhost, dest.type);\r\n RtlExp src_abs = new RtlLiteral(\"$absMem[\" + abs + \"][\" + offset + \" div 4 + 1]\");\r\n stmts.Add(new RtlInst(null, new RtlVar[] { dest }, new RtlVar[0], new RtlExp[] { expGhost }, true));\r\n stmts.Add(new RtlInst(null, new RtlVar[] { dest_abs }, new RtlVar[0], new RtlExp[] { src_abs }, true));\r\n }\r\n }\r\n\r\n public void AddMatch(RtlVar dest, Expression src, List cases,\r\n Func bodyExp, Func> bodyStmts)\r\n where Case:MatchCase\r\n {\r\n //- match src { case c1(ps1) => s1 ... cn(psn) => sn }\r\n //- -->\r\n //- var x := src;\r\n //- if x is c1 { var ps1 := ...x.f1...; s1 } else\r\n //- if x is c2 { var ps2 := ...x.f2...; s2 } else\r\n //- { var ps3 := ...x.f3...; s3 }\r\n string end = NewLabel();\r\n RtlVar x = TempVar(src.Type);\r\n AddExpression(x, src);\r\n for (int k = 0; k < cases.Count; k++)\r\n {\r\n Case c = cases[k];\r\n bool isLast = (k == cases.Count - 1);\r\n string skip = NewLabel();\r\n if (!isLast)\r\n {\r\n JumpIfHasType(skip, x, c.Ctor.Name, src.Type, false);\r\n }\r\n var oldRenamer = PushRename();\r\n for (int i = 0; i < c.Arguments.Count; i++)\r\n {\r\n var a = c.Arguments[i];\r\n var f = c.Ctor.Formals[i];\r\n AddVarDecl(a.Name, a.Type, a.IsGhost);\r\n RtlExp ghostExp = new RtlLiteral(\"(\" + f.Name + \"#\" + c.Ctor.Name + \"(\" + x + \"))\");\r\n if (a.IsGhost)\r\n {\r\n MoveGhost(AsVar(a), ghostExp);\r\n }\r\n else\r\n {\r\n AddFieldSelect(AsVar(a), x, src.Type, f.Name, f.Type, ghostExp);\r\n }\r\n }\r\n if (bodyExp != null)\r\n {\r\n AddExpression(dest, bodyExp(c));\r\n }\r\n if (bodyStmts != null)\r\n {\r\n bodyStmts(c).ForEach(AddStatement);\r\n }\r\n if (!isLast)\r\n {\r\n Jump(end);\r\n Label(skip);\r\n }\r\n PopRename(oldRenamer);\r\n }\r\n Label(end);\r\n }\r\n\r\n void AddExpression(RtlVar dest, Expression exp)\r\n {\r\n Util.Assert(!isPrinting);\r\n Util.Assert(!dest.isGhost);\r\n exp = GetExp(exp);\r\n Util.DebugWriteLine(\"exp: \" + exp.GetType());\r\n StmtExpr stmtExpr = exp as StmtExpr;\r\n RtlVar var = AsVar(exp);\r\n BigInteger? intExp = AsInt(exp);\r\n BinaryExpr binary = exp as BinaryExpr;\r\n UnaryExpr unary = exp as UnaryExpr;\r\n ITEExpr ite = exp as ITEExpr;\r\n LetExpr letExp = exp as LetExpr;\r\n MatchExpr matchExp = exp as MatchExpr;\r\n FunctionCallExpr funCall = exp as FunctionCallExpr;\r\n DatatypeValue dataVal = exp as DatatypeValue;\r\n MemberSelectExpr memberSelect = exp as MemberSelectExpr;\r\n SeqSelectExpr seqSelect = exp as SeqSelectExpr;\r\n SeqUpdateExpr seqUpdate = exp as SeqUpdateExpr;\r\n SeqDisplayExpr seqDisplay = exp as SeqDisplayExpr;\r\n\r\n if (stmtExpr != null)\r\n {\r\n \r\n if (stmtExprEnabled)\r\n {\r\n if (ignoreStmtExpr == 0)\r\n {\r\n AddGhostStatement(stmtExpr.S, null);\r\n }\r\n AddExpression(dest, stmtExpr.E);\r\n return;\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented: cannot handle statement expression here\");\r\n }\r\n }\r\n\r\n if (var != null)\r\n {\r\n Util.DebugWriteLine(\"dest = \" + dest + \" var = \" + var);\r\n Move(dest, var, IsPtrType(AppType(exp.Type)));\r\n }\r\n else if (intExp != null)\r\n {\r\n Move(dest, new RtlInt((BigInteger)intExp), false);\r\n }\r\n else if (binary != null)\r\n {\r\n switch (binary.ResolvedOp)\r\n {\r\n case BinaryExpr.ResolvedOpcode.Concat:\r\n {\r\n AddBuildSequence(dest, exp);\r\n return;\r\n }\r\n }\r\n if (IsPtrType(AppType(binary.E0.Type)) || IsPtrType(AppType(binary.E1.Type)))\r\n {\r\n throw new Exception(\"binary operators only implemented for integer and bool types\");\r\n }\r\n if (jumpOps.ContainsKey(binary.Op.ToString()))\r\n {\r\n AddBoolViaJump(dest, exp);\r\n }\r\n else\r\n {\r\n switch (binary.Op)\r\n {\r\n case BinaryExpr.Opcode.And:\r\n case BinaryExpr.Opcode.Or:\r\n case BinaryExpr.Opcode.Imp:\r\n case BinaryExpr.Opcode.Iff:\r\n AddBoolViaJump(dest, exp);\r\n break;\r\n case BinaryExpr.Opcode.Mul:\r\n case BinaryExpr.Opcode.Div:\r\n case BinaryExpr.Opcode.Mod:\r\n {\r\n bool nonlinear = !(IsConstant(binary.E0) || IsConstant(binary.E1));\r\n bool isDivMod = (binary.Op == BinaryExpr.Opcode.Div || binary.Op == BinaryExpr.Opcode.Mod);\r\n string sop = isDivMod ? \"DivMod\" : binary.Op.ToString();\r\n var m = dafnySpec.FindMethod((nonlinear ? \"Method_\" : \"method_\") + sop);\r\n //Expression zero = new LiteralExpr(binary.tok, 0); \r\n AddCallInstruction(\r\n (binary.Op == BinaryExpr.Opcode.Mod) ? new List { dest, TempVar(Type.Int) } :\r\n new List { TempVar(Type.Int), dest },\r\n m.Ins, DafnySpec.SimpleSanitizedName(m),\r\n isDivMod ? new List { null, binary.E0, binary.E1 } :\r\n new List { binary.E0, binary.E1 },\r\n m.Attributes,\r\n isDivMod ? new List { new RtlInt(0), null, null } : null);\r\n break;\r\n }\r\n default:\r\n AddBinary(dest, BinaryInstOp(binary.Op), binary.E0, binary.E1);\r\n break;\r\n }\r\n }\r\n }\r\n else if (unary != null && unary is UnaryOpExpr && ((UnaryOpExpr)unary).Op == UnaryOpExpr.Opcode.Not)\r\n {\r\n AddBoolViaJump(dest, exp);\r\n } \r\n else if (unary != null && unary is UnaryOpExpr && ((UnaryOpExpr)unary).Op == UnaryOpExpr.Opcode.Cardinality)\r\n {\r\n var m = dafnySpec.GetSeqMethod(AppType(unary.E.Type), \"seq_Length\");\r\n AddCall(new List { dest }, false, false, m.Item1, new List { unary.E },\r\n m.Item1.Outs, m.Item2);\r\n }\r\n else if (ite != null)\r\n {\r\n //- if (!e) goto skip1\r\n //- then-body\r\n //- goto skip2\r\n //- skip1:\r\n //- else-body\r\n //- skip2:\r\n string skip1 = NewLabel();\r\n Jump(skip1, ite.Test, false);\r\n AddExpression(dest, ite.Thn);\r\n string skip2 = NewLabel();\r\n Jump(skip2);\r\n Label(skip1);\r\n AddExpression(dest, ite.Els);\r\n Label(skip2);\r\n }\r\n else if (letExp != null)\r\n {\r\n if (!letExp.Exact)\r\n {\r\n throw new Exception(\"not implemented: LetExpr: \" + letExp);\r\n }\r\n for (int i = 0; i < letExp.LHSs.Count; i++)\r\n {\r\n var lhs = letExp.LHSs[i];\r\n var rhs = letExp.RHSs[i];\r\n string name = GhostVar(lhs.Var.Name);\r\n if (allVars.Keys.Contains(name))\r\n {\r\n AddRename(lhs.Var.Name);\r\n name = GhostVar(lhs.Var.Name);\r\n }\r\n RtlVar lhsVar = new RtlVar(name, lhs.Var.IsGhost, AppType(lhs.Var.Type));\r\n allVars.Add(name, lhsVar);\r\n AddExpression(lhsVar, rhs);\r\n }\r\n AddExpression(dest, letExp.Body);\r\n }\r\n else if (matchExp != null)\r\n {\r\n if (matchExp.MissingCases.Count != 0)\r\n {\r\n throw new Exception(\"not implemented: MatchExpr with missing cases: \" + matchExp);\r\n }\r\n AddMatch(dest, matchExp.Source, matchExp.Cases, c => c.Body, null);\r\n }\r\n else if (funCall != null)\r\n {\r\n if (Attributes.Contains(funCall.Function.Attributes, \"dafnycc_inline\"))\r\n {\r\n TypeApply app = dafnySpec.Compile_Function(funCall.Function,\r\n funCall.TypeArgumentSubstitutions.ToDictionary(p => p.Key, p => AppType(p.Value)));\r\n string funName = FunName(SimpleName(app.AppName()));\r\n Dictionary substMap = new Dictionary();\r\n for (int i = 0; i < funCall.Function.Formals.Count; i++)\r\n {\r\n substMap.Add(funCall.Function.Formals[i], funCall.Args[i]);\r\n }\r\n Translator.Substituter subst = new Translator.Substituter(null, substMap, new Dictionary(), null);\r\n Expression body = subst.Substitute(funCall.Function.Body);\r\n AddExpression(dest, body);\r\n List rtlArgs = funCall.Args.ConvertAll(e => GhostExpression(e));\r\n stmts.Add(new RtlAssert(new RtlBinary(\"==\", dest, new RtlApply(funName, rtlArgs))));\r\n return;\r\n }\r\n string name = SimpleName(funCall.Function.Name);\r\n switch (name)\r\n {\r\n case \"and\":\r\n case \"or\":\r\n case \"xor\":\r\n {\r\n string op = \"instr_\" + Char.ToUpper(name[0]) + name.Substring(1);\r\n AddBinary(dest, op, funCall.Args[0], funCall.Args[1]);\r\n break;\r\n }\r\n default:\r\n {\r\n TypeApply app = dafnySpec.Compile_Function(funCall.Function,\r\n funCall.TypeArgumentSubstitutions.ToDictionary(p => p.Key, p => AppType(p.Value)));\r\n AddCall(new List { dest }, false, DafnySpec.IsHeapFunction(funCall.Function),\r\n funCall.Function, funCall.Args,\r\n new List { new Formal(funCall.tok, \"__result\", funCall.Type, false, false) }, app);\r\n SymdiffLinearityPoint();\r\n break;\r\n }\r\n }\r\n }\r\n else if (dataVal != null)\r\n {\r\n List args = new List { dataVal }.Concat(dataVal.Arguments).ToList();\r\n List ins = new List { new Formal(dataVal.tok, \"data\", AppType(dataVal.Type), true, true) }\r\n .Concat(dataVal.Ctor.Formals).ToList();\r\n string name = dafnySpec.Compile_Constructor(dataVal.Type, dataVal.Ctor.Name,\r\n dataVal.InferredTypeArgs, typeApply.typeArgs).AppName();\r\n AddCall(new List { dest }, false, true, ins, \"Alloc_\" + name, args,\r\n new List { new Formal(dataVal.tok, \"ret\", AppType(dataVal.Type), false, false) });\r\n } \r\n else if (memberSelect != null && memberSelect.Member is Field && memberSelect.MemberName.EndsWith(\"?\"))\r\n {\r\n AddBoolViaJump(dest, exp);\r\n } \r\n else if (memberSelect != null && memberSelect.Member is Field && DafnySpec.IsArrayType(AppType(memberSelect.Obj.Type))\r\n && memberSelect.MemberName == \"Length\")\r\n {\r\n RtlVar eArr = AsVarOrTemp(memberSelect.Obj);\r\n ArrayLength(dest, eArr);\r\n } \r\n else if (memberSelect != null && memberSelect.Member is Field && !memberSelect.Member.IsStatic && AppType(memberSelect.Obj.Type) is UserDefinedType\r\n && memberSelect.Member is DatatypeDestructor)\r\n {\r\n RtlVar e0 = AsVarOrTemp(memberSelect.Obj);\r\n if (minVerify)\r\n {\r\n //- run-time type check\r\n string fail = NewLabel();\r\n string ok = NewLabel();\r\n DatatypeDestructor field = (DatatypeDestructor) memberSelect.Member;\r\n JumpIfHasType(ok, e0, field.EnclosingCtor.Name, memberSelect.Obj.Type, true);\r\n Label(fail, true);\r\n Jump(fail);\r\n Label(ok, false);\r\n }\r\n AddFieldSelect(dest, e0, memberSelect.Obj.Type, memberSelect.MemberName, exp.Type, GhostExpression(exp));\r\n }\r\n else if (seqSelect != null)\r\n {\r\n if (seqSelect.SelectOne && DafnySpec.IsArrayType(AppType(seqSelect.Seq.Type)))\r\n {\r\n RtlVar eArr = AsVarOrTemp(seqSelect.Seq);\r\n RtlExp eInd = AsSimpleOrTemp(seqSelect.E0);\r\n if (minVerify)\r\n {\r\n //- run-time bounds check\r\n string fail = NewLabel();\r\n string ok = NewLabel();\r\n RtlVar eLen = TempVar(Type.Int);\r\n ArrayLength(eLen, eArr);\r\n Jump(ok, new RtlBinary(\"<\", eInd, eLen));\r\n Label(fail, true);\r\n Jump(fail);\r\n Label(ok, false);\r\n }\r\n string abs = eArr + \"__abs\";\r\n int start = stmts.Count;\r\n stmts.Add(new RtlStmtComputed(\r\n s => \"call r, mems := loadArrayElement(r, core_state, stk, statics, io, mems, $commonVars, \"\r\n + \"$gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \"\r\n + s.args[0] + \", \"\r\n + new RtlMem(s.args[1].e, new RtlInt(4), s.args[2].e, new RtlInt(8)).AsOperand() + \", \"\r\n + eInd + \", \" + abs + \", \" + RegAlloc.Reg(s.args[1].ToString()) + \");\",\r\n new List {\r\n new RtlArg(false, true, dest),\r\n new RtlArg(true, false, eArr),\r\n new RtlArg(true, false, eInd)\r\n }, false)\r\n .WithComment(\"loadArrayElement\"));\r\n GroupStatements(start);\r\n }\r\n else if (seqSelect.SelectOne)\r\n {\r\n var m = dafnySpec.GetSeqMethod(AppType(seqSelect.Seq.Type), \"seq_Index\");\r\n AddCall(new List { dest }, false, true, m.Item1, new List { seqSelect.Seq, seqSelect.E0 },\r\n m.Item1.Outs, m.Item2);\r\n }\r\n else\r\n {\r\n RtlVar seq;\r\n if (DafnySpec.IsArrayType(AppType(seqSelect.Seq.Type)))\r\n {\r\n seq = TempVar(seqSelect.Type);\r\n var m = dafnySpec.FindMethod(\"seq_FromArray\");\r\n AddCall(new List { seq }, false, true, m,\r\n new List() { seqSelect.Seq }, m.Outs);\r\n }\r\n else\r\n {\r\n seq = AsVarOrTemp(seqSelect.Seq);\r\n }\r\n if (seqSelect.E0 != null && seqSelect.E1 != null)\r\n {\r\n var m = dafnySpec.GetSeqMethod(AppType(seqSelect.Type), \"seq_TakeDrop\");\r\n AddCall(new List { dest }, false, true, m.Item1,\r\n new List { seq, null, null },\r\n new List { null, seqSelect.E0, seqSelect.E1 },\r\n m.Item1.Outs, m.Item2);\r\n }\r\n else if (seqSelect.E1 != null)\r\n {\r\n var m = dafnySpec.GetSeqMethod(AppType(seqSelect.Type), \"seq_Take\");\r\n AddCall(new List { dest }, false, true, m.Item1,\r\n new List { seq, null },\r\n new List { null, seqSelect.E1 },\r\n m.Item1.Outs, m.Item2);\r\n }\r\n else if (seqSelect.E0 != null)\r\n {\r\n var m = dafnySpec.GetSeqMethod(AppType(seqSelect.Type), \"seq_Drop\");\r\n AddCall(new List { dest }, false, true, m.Item1,\r\n new List { seq, null },\r\n new List { null, seqSelect.E0 },\r\n m.Item1.Outs, m.Item2);\r\n }\r\n else\r\n {\r\n Move(dest, seq, true);\r\n }\r\n }\r\n }\r\n else if (seqUpdate != null)\r\n {\r\n if (seqUpdate.ResolvedUpdateExpr != null) {\r\n AddExpression(dest, seqUpdate.ResolvedUpdateExpr);\r\n } else {\r\n var m = dafnySpec.GetSeqMethod(AppType(seqSelect.Seq.Type), \"seq_Update\");\r\n AddCall(new List { dest }, false, true, m.Item1,\r\n new List { seqUpdate.Seq, seqUpdate.Index, seqUpdate.Value },\r\n m.Item1.Outs, m.Item2);\r\n }\r\n }\r\n else if (seqDisplay != null)\r\n {\r\n AddBuildSequence(dest, exp);\r\n return;\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented: \" + dest + \" := \" + exp);\r\n }\r\n }\r\n\r\n void AddAssignmentRhs(RtlVar dest, AssignmentRhs rhs)\r\n {\r\n Util.DebugWriteLine(\"dest = \" + dest + \" rhs: \" + rhs.GetType());\r\n ExprRhs expRhs = rhs as ExprRhs;\r\n TypeRhs typRhs = rhs as TypeRhs;\r\n if (expRhs != null)\r\n {\r\n AddExpression(dest, expRhs.Expr);\r\n }\r\n else if (typRhs != null && DafnySpec.IsArrayType(AppType(typRhs.Type)) && typRhs.ArrayDimensions.Count == 1)\r\n {\r\n List ins = new List { new Formal(Bpl.Token.NoToken, \"count\", Type.Int, true, false) };\r\n AddCall(new List { dest }, false, true, ins, \"AllocArrayOfInt\",\r\n new List { typRhs.ArrayDimensions[0] },\r\n new List { new Formal(Bpl.Token.NoToken, \"ret\", AppType(typRhs.Type), false, false) });\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented: \" + rhs + \": \" + rhs.GetType());\r\n }\r\n }\r\n\r\n RtlExp AssignmentRhsAsSimpleOrTemp(Type t, AssignmentRhs rhs)\r\n {\r\n ExprRhs expRhs = rhs as ExprRhs;\r\n if (expRhs != null)\r\n {\r\n RtlExp re = AsSimple(expRhs.Expr);\r\n if (re != null)\r\n {\r\n return re;\r\n }\r\n }\r\n RtlVar tmp = TempVar(t);\r\n AddAssignmentRhs(tmp, rhs);\r\n return tmp;\r\n }\r\n\r\n void AssignSeqLhs(RtlVar eSeq, RtlExp eInd, RtlExp eVal)\r\n {\r\n if (minVerify)\r\n {\r\n \r\n string fail = NewLabel();\r\n string ok = NewLabel();\r\n RtlVar eLen = TempVar(Type.Int);\r\n ArrayLength(eLen, eSeq);\r\n Jump(ok, new RtlBinary(\"<\", eInd, eLen));\r\n Label(fail, true);\r\n Jump(fail);\r\n Label(ok, false);\r\n }\r\n string abs = eSeq + \"__abs\";\r\n RtlExp dest = new RtlMem(eSeq, new RtlInt(4), eInd, new RtlInt(8));\r\n int start = stmts.Count;\r\n stmts.Add(new RtlStmtComputed(\r\n s => \"call mems, $absMem := storeArrayElement(r, core_state, stk, statics, io, mems, \"\r\n + \"$commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap, \"\r\n + s.args[1].AsOperand() + \", \" + s.args[2].AsOperand() + \", \"\r\n + eInd + \", \" + eVal + \", \" + abs + \", \" + RegAlloc.Reg(s.args[0].ToString()) + \");\",\r\n new List {\r\n new RtlArg(true, false, eSeq),\r\n new RtlArg(true, false, dest), //- make sure dest, eVal are loaded before call to storeArrayElement\r\n new RtlArg(true, false, eVal) //- (otherwise, invariants fail)\r\n }, false)\r\n .WithComment(\"storeArrayElement\"));\r\n GroupStatements(start);\r\n }\r\n\r\n Tuple AssignLhs(Expression lhs)\r\n {\r\n IdentifierExpr idExp = lhs as IdentifierExpr;\r\n SeqSelectExpr seqSelect = lhs as SeqSelectExpr;\r\n if (idExp != null)\r\n {\r\n return Tuple.Create(AsVar(idExp), (Action)(() => {}));\r\n }\r\n else if (seqSelect != null && seqSelect.SelectOne && DafnySpec.IsArrayType(AppType(seqSelect.Seq.Type)))\r\n {\r\n RtlVar eSeq = AsVarOrTemp(seqSelect.Seq);\r\n RtlExp eInd = AsSimpleOrTemp(seqSelect.E0);\r\n RtlVar tmp = TempVar(lhs.Type);\r\n return Tuple.Create(tmp, (Action)(() => { AssignSeqLhs(eSeq, eInd, tmp); }));\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented: assignment to \" + lhs);\r\n }\r\n }\r\n\r\n List> InstructionAttributes(Attributes attrs)\r\n {\r\n for (; attrs.Name != \"instruction\"; attrs = attrs.Prev) {}\r\n \r\n return attrs.Args.ConvertAll(a => ((string)((StringLiteralExpr)a).Value)).ConvertAll(a => a.Contains(\"@\")\r\n ? Tuple.Create(a.Substring(0, a.IndexOf('@')), a.Substring(a.IndexOf('@') + 1))\r\n : Tuple.Create(a, (string)null));\r\n }\r\n\r\n public RtlMem AsRtlMem(Expression e)\r\n {\r\n BinaryExpr bin = e as BinaryExpr;\r\n if (bin != null && bin.Op == BinaryExpr.Opcode.Add && AsSimple(bin.E1) is RtlInt)\r\n {\r\n return new RtlMem(AsVarOrTemp(bin.E0), AsSimple(bin.E1));\r\n }\r\n else\r\n {\r\n return new RtlMem(AsVarOrTemp(e), new RtlInt(0));\r\n }\r\n }\r\n\r\n public void AddCallInstruction(List destVars, List ins, string name, List args,\r\n Attributes attrs, List rtlExps = null)\r\n {\r\n name = GhostProcName(name);\r\n var operands = InstructionAttributes(attrs);\r\n bool strictOperands = Attributes.Contains(attrs, \"strict_operands\");\r\n bool modifiesIo = Attributes.Contains(attrs, \"modifies_io\");\r\n string envArgs = \", objLayouts, $S, $toAbs, $absMem, $commonVars, $gcVars, init, stk, statics, core_state, ptMem, mems, $stacksFrames\";\r\n string envIn = modifiesIo ? \", io\" + envArgs : \"\";\r\n string envOut = modifiesIo ? \", io\" : \"\";\r\n for (int i = 0; i < args.Count; i++)\r\n {\r\n RtlExp re = (rtlExps == null) ? null : rtlExps[i];\r\n envIn += \", \" + ((re != null) ? re.ToString() : GhostExpression(args[i]).ToString());\r\n }\r\n envOut += String.Concat(destVars.Select(x => \", \" + x));\r\n if (instructionProcArgs != null)\r\n {\r\n var operandString = String.Concat(instructionProcArgs.Select(arg => \", \" + arg));\r\n stmts.Add(new RtlGhostStmtComputed(s => \"call r\" + envOut + \" := \" + name + \"(r\" + envIn + operandString + \");\", new RtlExp[0]));\r\n }\r\n else if (destVars.Count == 1 && args.Count == 2 && operands.Count == 2\r\n && operands[0].Item1 == \"inout\" && operands[1].Item1 == \"in\"\r\n && !strictOperands)\r\n {\r\n //- optimized path for binary expressions\r\n AddBinary(destVars[0], name, args[0], args[1], operands.ConvertAll(o => o.Item2), envIn, envOut);\r\n }\r\n else\r\n {\r\n List rtlArgs = new List();\r\n int kIn = 0;\r\n int kOut = 0;\r\n foreach (var opn in operands)\r\n {\r\n RtlExp re = (rtlExps == null) ? null : rtlExps[kIn];\r\n RtlArg arg;\r\n switch (opn.Item1)\r\n {\r\n case \"in\":\r\n if (strictOperands && (re == null || re is RtlInt))\r\n {\r\n var tmp = TempVar(Type.Int);\r\n if (re == null) { AddExpression(tmp, args[kIn]); }\r\n else { Move(tmp, re, false); }\r\n arg = new RtlArg(true, false, tmp);\r\n }\r\n else\r\n {\r\n arg = new RtlArg(true, false, re != null ? re : AsSimpleOrTemp(args[kIn]));\r\n }\r\n kIn++;\r\n break;\r\n case \"inout\":\r\n if (re == null) { AddExpression(destVars[kOut], args[kIn]); }\r\n else { Move(destVars[kOut], re, false); }\r\n kIn++;\r\n arg = new RtlArg(true, true, destVars[kOut++]);\r\n break;\r\n case \"out\": arg = new RtlArg(false, true, destVars[kOut++]); break;\r\n case \"mem\": arg = new RtlArg(true, false, re != null ? re : AsRtlMem(args[kIn])); kIn++; break;\r\n default: throw new Exception(\"expected 'in', 'inout', 'out', or 'mem' on instruction attributes\");\r\n }\r\n arg.pinReg = opn.Item2;\r\n rtlArgs.Add(arg);\r\n }\r\n stmts.Add(new RtlInst(name, rtlArgs, false, envIn, envOut));\r\n }\r\n }\r\n\r\n public void AddCall(List destVars, bool isGhost, bool isHeap, List ins, string name,\r\n List argVars, List args, List rets)\r\n {\r\n if (isGhost)\r\n {\r\n AddGhostCall(destVars, name, args, isHeap);\r\n return;\r\n }\r\n Util.Assert(args.Count == ins.Count);\r\n Util.Assert(args.Count == argVars.Count);\r\n Util.Assert(rets != null || destVars.Count == 1);\r\n List rtlArgs = new List();\r\n int numIntRets = (rets == null) ? 1 : rets.Count(x => !x.IsGhost && !IsPtrType(AppType(x.Type)));\r\n int numPtrRets = (rets == null) ? 1 : rets.Count(x => !x.IsGhost && IsPtrType(AppType(x.Type)));\r\n int argIntIndex = numIntRets;\r\n int argPtrIndex = numPtrRets;\r\n List argStmts = new List();\r\n for (int i = 0; i < args.Count; i++)\r\n {\r\n Util.Assert(argVars[i] != null || args[i] != null);\r\n Util.Assert(argVars[i] == null || args[i] == null);\r\n var arg = args[i];\r\n var formal = ins[i];\r\n RtlVar argVar = (argVars[i] != null) ? argVars[i] : AsVar(arg);\r\n bool isPtr = IsPtrType((argVars[i] != null) ? argVars[i].type : AppType(arg.Type));\r\n if (formal.IsGhost)\r\n {\r\n rtlArgs.Add(GhostExpression(arg));\r\n }\r\n else\r\n {\r\n if (argVar != null)\r\n {\r\n rtlArgs.Add(argVar);\r\n }\r\n else\r\n {\r\n RtlVar tmp = TempVar(args[i].Type);\r\n AddExpression(tmp, args[i]);\r\n rtlArgs.Add(tmp);\r\n }\r\n argStmts.Add(new RtlCallInOut(isPtr ? argPtrIndex : argIntIndex, false, rtlArgs[i])\r\n .WithComment(\"push argument #\" + i + \" at index \" + (isPtr ? argPtrIndex : argIntIndex)\r\n + \" isPtr = \" + isPtr + \" argument = \" + rtlArgs[i]));\r\n if (isPtr)\r\n {\r\n argPtrIndex++;\r\n }\r\n else\r\n {\r\n argIntIndex++;\r\n }\r\n }\r\n }\r\n name = ProcName(isGhost, name);\r\n if (name == procName)\r\n {\r\n throw new Exception(\"recursive calls not supported in non-ghost procedure: \" + method.Name);\r\n }\r\n stmts.AddRange(argStmts);\r\n calledMethods.Add(name);\r\n stmts.Add(new RtlCall(name, destVars, rtlArgs, isGhost)\r\n .WithComment(\"call:: \" + String.Join(\",\", destVars) + \" := \" + name\r\n + \"(\" + String.Join(\", \", rtlArgs.ToList()) + \") // isGhost = \" + isGhost));\r\n if (rets != null)\r\n {\r\n int retIntIndex = 0;\r\n int retPtrIndex = 0;\r\n Util.Assert(rets.Count == destVars.Count);\r\n for (int i = 0; i < rets.Count; i++)\r\n {\r\n Util.Assert(destVars[i] == null || destVars[i].isGhost || !rets[i].IsGhost);\r\n if (!rets[i].IsGhost)\r\n {\r\n RtlVar dest = destVars[i];\r\n if (dest == null || dest.isGhost)\r\n {\r\n dest = TempVar(rets[i].Type);\r\n }\r\n bool isPtr = IsPtrType(AppType(rets[i].Type));\r\n stmts.Add(new RtlCallInOut(isPtr ? retPtrIndex : retIntIndex, true, dest)\r\n .WithComment(\"pop return value #\" + i + \" at index \" + (isPtr ? retPtrIndex : retIntIndex)\r\n + \" into destination \" + destVars[i] + \" isPtr = \" + isPtr));\r\n if (isPtr)\r\n {\r\n retPtrIndex++;\r\n }\r\n else\r\n {\r\n retIntIndex++;\r\n }\r\n }\r\n }\r\n }\r\n else\r\n {\r\n stmts.Add(new RtlCallInOut(0, true, destVars[0])\r\n .WithComment(\"pop single return value from function into destination:: \" + destVars[0]));\r\n }\r\n }\r\n\r\n public void AddCall(List destVars, bool isGhost, bool isHeap, List ins, string name, List args, List rets)\r\n {\r\n AddCall(destVars, isGhost, isHeap, ins, name, new RtlVar[args.Count].ToList(), args, rets);\r\n }\r\n\r\n private void AddCall(List destVars, bool isGhost, bool isHeap, T target, List args, List rets) where T : MemberDecl, ICallable\r\n {\r\n AddCall(destVars, isGhost, isHeap, target.Ins, DafnySpec.SimpleSanitizedName(target), args, rets);\r\n }\r\n\r\n private void AddCall(List destVars, bool isGhost, bool isHeap, T target,\r\n List argVars, List args, List rets, TypeApply typeApply) where T : MemberDecl, ICallable\r\n {\r\n rets = rets.ConvertAll(x => new Formal(x.tok, x.Name, typeApply.AppType(x.Type), x.InParam, x.IsGhost));\r\n Method method = target as Method;\r\n Function fun = target as Function;\r\n Attributes attrs = (method != null) ? method.Attributes : (fun != null) ? fun.Attributes : null;\r\n if (Attributes.Contains(attrs, \"instruction\"))\r\n {\r\n AddCallInstruction(destVars, target.Ins, DafnySpec.SimpleSanitizedName(target), args,\r\n attrs);\r\n }\r\n else\r\n {\r\n AddCall(destVars, isGhost, isHeap, target.Ins, SimpleName(typeApply.AppName()), argVars, args, rets);\r\n }\r\n }\r\n\r\n private void AddCall(List destVars, bool isGhost, bool isHeap, T target,\r\n List args, List rets, TypeApply typeApply) where T : MemberDecl, ICallable\r\n {\r\n AddCall(destVars, isGhost, isHeap, target, new RtlVar[args.Count].ToList(), args, rets, typeApply);\r\n }\r\n\r\n void AddReturn(List rhss)\r\n {\r\n Util.Assert(!isGhost);\r\n if (rhss != null)\r\n {\r\n Util.Assert(method.Outs.Count == rhss.Count);\r\n for (int i = 0; i < method.Outs.Count; i++)\r\n {\r\n RtlVar dest = new RtlVar(GhostVar(method.Outs[i].Name, false), method.Outs[i].IsGhost, AppType(method.Outs[i].Type));\r\n AddAssignmentRhs(dest, rhss[i]);\r\n }\r\n }\r\n \r\n if (instructionProcArgs == null)\r\n {\r\n stmts.Add(new RtlReturn(method.Outs.Select(x => new RtlVar(GhostVar(x.Name), x.IsGhost, AppType(x.Type))))\r\n .WithComment(\"return\"));\r\n }\r\n }\r\n\r\n void AddVarDecl(string varName, Type t, bool isGhost)\r\n {\r\n string name = GhostVar(varName);\r\n if (allVars.Keys.Contains(name))\r\n {\r\n AddRename(varName);\r\n name = GhostVar(varName);\r\n }\r\n allVars.Add(name, new RtlVar(name, isGhost, AppType(t)));\r\n }\r\n\r\n public override void AddResolvedGhostStatement(Statement stmt, Attributes attrs)\r\n {\r\n MatchStmt matchStmt = stmt as MatchStmt;\r\n\r\n if (matchStmt != null)\r\n {\r\n \r\n if (matchStmt.MissingCases.Count != 0)\r\n {\r\n throw new Exception(\"not implemented: MatchStmt with missing cases: \" + matchStmt);\r\n }\r\n \r\n \r\n \r\n \r\n \r\n \r\n var cases = matchStmt.Cases;\r\n RtlVar x = TempVar(matchStmt.Source.Type);\r\n MoveGhost(x, GhostExpression(matchStmt.Source));\r\n foreach (MatchCaseStmt c in cases)\r\n {\r\n var oldRenamer = PushRename();\r\n for (int i = 0; i < c.Arguments.Count; i++)\r\n {\r\n var a = c.Arguments[i];\r\n var f = c.Ctor.Formals[i];\r\n AddGhostVarDecl(a.Name, a.Type, true);\r\n RtlExp ghostExp = new RtlLiteral(\"(\" + f.Name + \"#\" + c.Ctor.Name + \"(\" + x + \"))\");\r\n MoveGhost(AsVar(a), ghostExp);\r\n }\r\n stmts.Add(new RtlGhostStmtComputed(s => \"if (\" + x + \" is \" + c.Ctor.Name + \") {\",\r\n new RtlExp[] {}));\r\n Indent();\r\n c.Body.ForEach(s => AddGhostStatement(s, attrs));\r\n Unindent();\r\n stmts.Add(new RtlGhostStmtComputed(s => \"}\", new RtlExp[0]));\r\n PopRename(oldRenamer);\r\n }\r\n }\r\n else\r\n {\r\n base.AddResolvedGhostStatement(stmt, attrs);\r\n }\r\n }\r\n\r\n void AddResolvedStatement(Statement stmt)\r\n {\r\n Util.DebugWriteLine(\"stmt: \" + stmt.GetType());\r\n Util.Assert(!isGhost);\r\n Util.Assert(!stmt.IsGhost || stmt is CalcStmt);\r\n BlockStmt block = stmt as BlockStmt;\r\n IfStmt ifStmt = stmt as IfStmt;\r\n WhileStmt whileStmt = stmt as WhileStmt;\r\n BreakStmt breakStmt = stmt as BreakStmt;\r\n ReturnStmt returnStmt = stmt as ReturnStmt;\r\n AssertStmt assertStmt = stmt as AssertStmt;\r\n AssignStmt assignStmt = stmt as AssignStmt;\r\n CallStmt callStmt = stmt as CallStmt;\r\n VarDeclStmt varDecl = stmt as VarDeclStmt;\r\n MatchStmt matchStmt = stmt as MatchStmt;\r\n CalcStmt calcStmt = stmt as CalcStmt;\r\n ForallStmt forallStmt = stmt as ForallStmt;\r\n PrintStmt printStmt = stmt as PrintStmt;\r\n\r\n if (block != null)\r\n {\r\n var oldRenamer = PushRename();\r\n block.Body.ForEach(AddStatement);\r\n PopRename(oldRenamer);\r\n }\r\n else if (varDecl != null)\r\n {\r\n foreach (var varLocal in varDecl.Locals) { \r\n AddVarDecl(varLocal.Name, varLocal.Type, varLocal.IsGhost);\r\n }\r\n if (varDecl.Update != null) {\r\n Util.Assert(varDecl.Update is UpdateStmt);\r\n //Util.Assert(varDecl.Update.Lhss.Count() == 1);\r\n //AddAssignmentRhs(AsVar(varDecl.Update.Lhss[0]), ((UpdateStmt)varDecl.Update).Rhss[0]);\r\n AddStatement(varDecl.Update);\r\n }\r\n }\r\n else if (assignStmt != null)\r\n {\r\n IdentifierExpr idExp = assignStmt.Lhs as IdentifierExpr;\r\n SeqSelectExpr seqSelect = assignStmt.Lhs as SeqSelectExpr;\r\n if (idExp != null)\r\n {\r\n AddAssignmentRhs(AsVar(assignStmt.Lhs), assignStmt.Rhs);\r\n }\r\n else if (seqSelect != null && seqSelect.SelectOne && DafnySpec.IsArrayType(AppType(seqSelect.Seq.Type)))\r\n {\r\n RtlVar eSeq = AsVarOrTemp(seqSelect.Seq);\r\n RtlExp eInd = AsSimpleOrTemp(seqSelect.E0);\r\n RtlExp eVal = AssignmentRhsAsSimpleOrTemp(assignStmt.Lhs.Type, assignStmt.Rhs);\r\n AssignSeqLhs(eSeq, eInd, eVal);\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented: assignment to \" + assignStmt.Lhs);\r\n }\r\n }\r\n else if (callStmt != null)\r\n {\r\n var lhss = callStmt.Lhs.ConvertAll(AssignLhs);\r\n AddCall(lhss.ConvertAll(lhs => lhs.Item1), stmt.IsGhost, DafnySpec.IsHeapMethod(callStmt.Method),\r\n callStmt.Method, callStmt.Args, callStmt.Method.Outs, dafnySpec.Compile_Method(callStmt.Method,\r\n callStmt.MethodSelect.TypeArgumentSubstitutions().ToDictionary(p => p.Key, p => AppType(p.Value))));\r\n lhss.ForEach(lhs => lhs.Item2());\r\n SymdiffLinearityPoint();\r\n }\r\n else if (ifStmt != null)\r\n {\r\n //- if (!e) goto skip1\r\n //- then-body\r\n //- goto skip2\r\n //- skip1:\r\n //- else-body\r\n //- skip2:\r\n string skip1 = NewLabel();\r\n Jump(skip1, ifStmt.Guard, false);\r\n AddStatement(ifStmt.Thn);\r\n if (ifStmt.Els == null)\r\n {\r\n Label(skip1);\r\n }\r\n else\r\n {\r\n string skip2 = NewLabel();\r\n Jump(skip2);\r\n Label(skip1);\r\n AddStatement(ifStmt.Els);\r\n Label(skip2);\r\n }\r\n }\r\n else if (whileStmt != null)\r\n {\r\n //- goto begin\r\n //- loop:\r\n //- body\r\n //- begin:\r\n //- assert ...;\r\n //- if (e) goto loop\r\n //- end:\r\n string loop = NewLabel();\r\n string begin = NewLabel();\r\n string end = NewLabel();\r\n whileEnd.Add(end);\r\n Jump(begin);\r\n Label(loop);\r\n AddStatement(whileStmt.Body);\r\n Label(begin, true);\r\n foreach (MaybeFreeExpression mexp in whileStmt.Invariants)\r\n {\r\n Util.Assert(!mexp.IsFree);\r\n if (!minVerify)\r\n {\r\n bool old_stmtExprEnabled = stmtExprEnabled;\r\n stmtExprEnabled = false; \r\n stmts.Add(new RtlAssert(GhostExpression(mexp.E), true));\r\n stmtExprEnabled = old_stmtExprEnabled;\r\n }\r\n }\r\n SymdiffLinearityPoint();\r\n stmts.Add(new RtlLoopStart());\r\n Jump(loop, whileStmt.Guard);\r\n whileEnd.RemoveAt(whileEnd.Count - 1);\r\n Label(end);\r\n }\r\n else if (breakStmt != null && breakStmt.TargetLabel == null)\r\n {\r\n Jump(whileEnd[whileEnd.Count - breakStmt.BreakCount]);\r\n }\r\n else if (returnStmt != null)\r\n {\r\n AddReturn(returnStmt.rhss);\r\n }\r\n else if (assertStmt != null)\r\n {\r\n if (minVerify)\r\n {\r\n return;\r\n }\r\n stmts.Add(new RtlAssert(GhostExpression(assertStmt.Expr)));\r\n }\r\n else if (matchStmt != null)\r\n {\r\n if (matchStmt.MissingCases.Count != 0)\r\n {\r\n throw new Exception(\"not implemented: MatchStmt with missing cases: \" + matchStmt);\r\n }\r\n AddMatch(null, matchStmt.Source, matchStmt.Cases, null, c => c.Body);\r\n }\r\n else if (calcStmt != null)\r\n {\r\n AddGhostStatement(calcStmt, null);\r\n }\r\n else if (forallStmt != null)\r\n {\r\n AddGhostStatement(forallStmt, null);\r\n }\r\n else if (printStmt != null)\r\n {\r\n Util.Assert(printStmt.Args.Count == 1);\r\n var m = dafnySpec.FindMethod(\"print_int\");\r\n AddCall(new List(), false, true, m,\r\n new List() { printStmt.Args[0] }, m.Outs);\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented: \" + stmt);\r\n }\r\n }\r\n\r\n void AddStatement(Statement stmt)\r\n {\r\n Util.Assert(!isPrinting);\r\n if (isGhost || (stmt.IsGhost && !(stmt is CalcStmt)))\r\n {\r\n AddGhostStatement(stmt, null);\r\n return;\r\n }\r\n stmts.Add(new RtlComment(\"###LINE: \" + stmt.Tok.filename + \": \" + stmt.Tok.line));\r\n List resolved = ResolveStmt(stmt);\r\n if (resolved != null)\r\n {\r\n resolved.ForEach(AddStatement);\r\n }\r\n else\r\n {\r\n AddResolvedStatement(stmt);\r\n }\r\n }\r\n\r\n public static bool IsPtrType(Type t)\r\n {\r\n return DafnySpec.IsPtrType(t);\r\n }\r\n\r\n protected void WriteDefaultRelationalRequires(bool isRelational)\r\n {\r\n if (isRelational)\r\n {\r\n iwriter.WriteLine(\" requires public(io_old._inCtr);\");\r\n iwriter.WriteLine(\" requires public(io_old._outCtr);\");\r\n }\r\n }\r\n\r\n protected void WriteDefaultRelationalEnsures(bool isRelational)\r\n {\r\n if (isRelational)\r\n {\r\n iwriter.WriteLine(\" ensures public(io._inCtr);\");\r\n iwriter.WriteLine(\" ensures public(io._outCtr);\");\r\n }\r\n else if (dafnycc.relational)\r\n {\r\n iwriter.WriteLine(\" ensures io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\");\r\n }\r\n }\r\n\r\n protected void WriteAllVars()\r\n {\r\n allVars.Keys\r\n .Where(x => !method.Ins.Select(y => GhostVar(y.Name)).ToList().Contains(x)\r\n && !method.Outs.Select(y => GhostVar(y.Name)).ToList().Contains(x)).ToList()\r\n .ForEach(x => writer.WriteLine(\" var \" + x + \":\" + TypeString(allVars[x].type) + \";\"));\r\n allVars.Where(x => !x.Value.isGhost && IsPtrType(x.Value.type))\r\n .ToList().ForEach(x => writer.WriteLine(\" var \" + x.Key + \"__abs:int;\"));\r\n }\r\n\r\n public void CompileInstruction()\r\n {\r\n string name = GhostProcName(DafnySpec.SimpleSanitizedName(method));\r\n bool strictOperands = Attributes.Contains(method.Attributes, \"strict_operands\");\r\n List reqs = method.Req.ConvertAll(a => GhostExpression(a.E, false, false, a.Attributes)); \r\n List enss = method.Ens.ConvertAll(a => GhostExpression(a.E, false, false, a.Attributes));\r\n AddTypeWellFormed(reqs, method.Ins);\r\n AddTypeWellFormed(enss, method.Outs);\r\n\r\n List> operands = InstructionAttributes(method.Attributes);\r\n List> ins = new List>();\r\n List> outs = new List>();\r\n\r\n int kIn = 0, kOut = 0;\r\n List parms = new List();\r\n List args = new List();\r\n Func opnName = s => \"$opn_\" + DafnySpec.CleanName(s);\r\n string outRegs = \"\";\r\n List opnReqs = new List();\r\n List allPins = operands.ConvertAll(p => p.Item2).Where(p => p != null).ToList();\r\n foreach (var r in operands)\r\n {\r\n string arg;\r\n Action> opnReq = (a, f) =>\r\n {\r\n if (r.Item2 != null) { opnReqs.Add(a + \" == \" + f(r.Item2)); }\r\n else if (allPins.Count > 0) { opnReqs.Add(String.Join(\" && \", allPins.Select(pin => a + \" != \" + f(pin)))); }\r\n };\r\n switch (r.Item1)\r\n {\r\n case \"in\":\r\n arg = opnName(method.Ins[kIn].Name);\r\n parms.Add(arg + \":opn\");\r\n opnReq(arg, s => \"OReg(\" + s + \")\");\r\n ins.Add(Tuple.Create(method.Ins[kIn], \"Eval(r_old, \" + arg + \")\"));\r\n kIn++;\r\n break;\r\n case \"inout\":\r\n arg = opnName(method.Ins[kIn].Name);\r\n parms.Add(arg + \":int\");\r\n opnReq(arg, s => s);\r\n ins.Add(Tuple.Create(method.Ins[kIn], \"r_old.regs[\" + arg + \"]\"));\r\n kIn++;\r\n outs.Add(Tuple.Create(method.Outs[kOut], \"r.regs[\" + arg + \"]\"));\r\n outRegs += \"[\" + arg + \" := \" + GhostVar(method.Outs[kOut].Name) + \"]\";\r\n kOut++;\r\n break;\r\n case \"out\":\r\n arg = opnName(method.Outs[kOut].Name);\r\n parms.Add(arg + \":int\");\r\n opnReq(arg, s => s);\r\n outs.Add(Tuple.Create(method.Outs[kOut], \"r.regs[\" + arg + \"]\"));\r\n outRegs += \"[\" + arg + \" := \" + GhostVar(method.Outs[kOut].Name) + \"]\";\r\n kOut++;\r\n break;\r\n case \"mem\":\r\n arg = opnName(method.Ins[kIn].Name);\r\n parms.Add(arg + \":opn_mem\");\r\n ins.Add(Tuple.Create(method.Ins[kIn], \"EvalPtr(r_old, \" + arg + \")\"));\r\n kIn++;\r\n break;\r\n default: throw new Exception(\"expected 'in' or 'inout' or 'out' or 'mem' in attributes of method\" + method.Name);\r\n }\r\n args.Add(arg);\r\n }\r\n\r\n if (method.Body != null)\r\n {\r\n stmtExprEnabled = true;\r\n instructionProcArgs = args;\r\n foreach (var x in method.Ins.Concat(method.Outs))\r\n {\r\n string xName = GhostVar(x.Name);\r\n allVars[xName] = new RtlVar(xName, x.IsGhost, AppType(x.Type));\r\n }\r\n foreach (Statement stmt in method.Body.Body)\r\n {\r\n AddStatement(stmt);\r\n }\r\n instructionProcArgs = null;\r\n stmtExprEnabled = false;\r\n }\r\n\r\n bool isRelational = dafnycc.relational && reqs.Concat(enss).ToList().Exists(s =>\r\n s is RtlApply && (((RtlApply)s).op == \"public\" || ((RtlApply)s).op == \"relation\"));\r\n bool modifiesIo = Attributes.Contains(method.Attributes, \"modifies_io\");\r\n string envOther = \", objLayouts:[int]ObjLayout, $S:int, $toAbs:[int]int, $absMem:[int][int]int, $commonVars:commonVars, $gcVars:gcVars, init:bool, stk:mem, statics:mem, core_state:core_state, ptMem:mem, mems:mems, $stacksFrames:[int]Frames\";\r\n string nucArgs = \"objLayouts, $S, $toAbs, $absMem, $commonVars, $gcVars, me, init, stk, statics, core_state, ptMem, mems, $stacksFrames\";\r\n string envIn = modifiesIo ? \", linear io_old:IOState\" + envOther : \"\";\r\n string envOut = modifiesIo ? \", linear io:IOState\" : \"\";\r\n string pIns = String.Concat(method.Ins.Select(f => \", \" + GhostVar(f.Name) + \":\" + TypeString(f.Type)));\r\n string pOuts = String.Concat(method.Outs.Select(f => \", \" + GhostVar(f.Name) + \":\" + TypeString(f.Type)));\r\n envIn += pIns;\r\n envOut += pOuts;\r\n\r\n Util.Assert(!isPrinting);\r\n isPrinting = true;\r\n string operandList = String.Concat(parms.Select(p => \", \" + p));\r\n iwriter.WriteLine(\"atomic procedure \" + name + \"(my r_old:regs\" + envIn + operandList + \") returns(my r:regs\" + envOut + \");\");\r\n Func lets_e = (lets, e) =>\r\n !(e is RtlApply) ? lets + e :\r\n ((RtlApply)e).op == \"public\" ? \"public(\" + lets + ((RtlApply)e).args[0] + \")\" :\r\n ((RtlApply)e).op == \"relation\" ? \"relation(\" + lets + ((RtlApply)e).args[0] + \")\" :\r\n lets + e;\r\n if (strictOperands) { opnReqs.ForEach(e => iwriter.WriteLine(\" requires \" + e + \";\")); }\r\n ins.ForEach(p => iwriter.WriteLine(\" requires \" + GhostVar(p.Item1.Name) + \" == \" + p.Item2 + \";\"));\r\n reqs.ForEach(e => iwriter.WriteLine(\" requires \" + e + \";\"));\r\n if (modifiesIo) { WriteDefaultRelationalRequires(isRelational); }\r\n if (modifiesIo) { iwriter.WriteLine(\" requires NucleusInv(\" + nucArgs + \", io_old);\"); }\r\n GetStaticFieldMods().ForEach(x => iwriter.WriteLine(\" modifies \" + x + \";\"));\r\n enss.ForEach(e => iwriter.WriteLine(\" ensures \" + e + \";\"));\r\n iwriter.WriteLine(\" ensures r.regs == r_old.regs\" + outRegs + \";\");\r\n if (modifiesIo) { WriteDefaultRelationalEnsures(isRelational); }\r\n if (modifiesIo) { iwriter.WriteLine(\" ensures NucleusInv(\" + nucArgs + \", io);\"); }\r\n if (method.Body != null)\r\n {\r\n writer.WriteLine(\"implementation \" + name + \"(my r_old:regs\" + envIn + operandList + \") returns(my r:regs\" + envOut + \")\");\r\n writer.WriteLine(\"{\");\r\n WriteAllVars();\r\n writer.WriteLine(\"r := r_old;\");\r\n if (modifiesIo) { writer.WriteLine(\"io := io_old;\"); }\r\n dafnySpec.WriteLemmas(writer, this, visibleModules, method.Attributes);\r\n foreach (RtlStmt s in stmts)\r\n {\r\n writer.WriteLine(s);\r\n }\r\n\r\n writer.WriteLine(\"}\");\r\n }\r\n isPrinting = false;\r\n }\r\n\r\n public override void Compile()\r\n {\r\n Util.Assert(!isPrinting);\r\n \r\n isGhost = method is Lemma || method.IsGhost;\r\n procName = ProcName(isGhost, SimpleName(typeApply.AppName()));\r\n bool isAxiom = Attributes.Contains(method.Attributes, \"axiom\");\r\n bool isPublic = Attributes.Contains(method.Attributes, \"public\");\r\n bool isImported = Attributes.Contains(method.Attributes, \"imported\");\r\n bool isInstruction = Attributes.Contains(method.Attributes, \"instruction\");\r\n bool isHeapUnmodified = Attributes.Contains(method.Attributes, \"dafnycc_heap_unmodified\");\r\n if (isImported && method.Body == null)\r\n {\r\n return;\r\n }\r\n if (method.Body == null && method.Name.StartsWith(\"reveal_\")) \r\n {\r\n return;\r\n }\r\n if (isGhost)\r\n {\r\n if (!minVerify)\r\n {\r\n CompileGhost();\r\n }\r\n return;\r\n }\r\n if (isInstruction)\r\n {\r\n CompileInstruction();\r\n return;\r\n }\r\n\r\n List inVars = method.Ins.Where(x => !x.IsGhost).ToList().Select(x => GhostVar(x.Name)).ToList();\r\n List outVars = method.Outs.Where(x => !x.IsGhost).ToList().Select(x => GhostVar(x.Name)).ToList();\r\n List inInts = method.Ins.Where(x => !x.IsGhost && !IsPtrType(AppType(x.Type))).ToList();\r\n List outInts = method.Outs.Where(x => !x.IsGhost && !IsPtrType(AppType(x.Type))).ToList();\r\n List inPtrs = method.Ins.Where(x => !x.IsGhost && IsPtrType(AppType(x.Type))).ToList();\r\n List outPtrs = method.Outs.Where(x => !x.IsGhost && IsPtrType(AppType(x.Type))).ToList();\r\n\r\n foreach (var x in method.Ins.Concat(method.Outs))\r\n {\r\n string name = GhostVar(x.Name);\r\n allVars[name] = new RtlVar(name, x.IsGhost, AppType(x.Type));\r\n }\r\n\r\n BlockStmt body = method.Body;\r\n if (body != null)\r\n {\r\n bool lastReturn = false;\r\n stmtExprEnabled = true;\r\n foreach (Statement stmt in body.Body)\r\n {\r\n lastReturn = (stmt is ReturnStmt);\r\n AddStatement(stmt);\r\n }\r\n if (!lastReturn && !isGhost)\r\n {\r\n AddReturn(null);\r\n }\r\n stmtExprEnabled = false;\r\n \r\n stmts = new Optimize(inVars, outVars, stmts).Run();\r\n }\r\n alloc = new RegAlloc(dafnySpec, this, inVars, outVars, inInts, outInts, inPtrs, outPtrs, allVars, stmts);\r\n if (body != null)\r\n {\r\n stmts = alloc.Alloc();\r\n }\r\n else if (isAxiom)\r\n {\r\n stmts = new List { new RtlComment(\"dummy method body for axiom\"), new RtlReturn(new RtlVar[0]) };\r\n }\r\n List reqs = minVerify ? new List()\r\n : method.Req.ConvertAll(a => GhostExpression(a.E, false, true, a.Attributes));\r\n List enss = minVerify ? new List()\r\n : method.Ens.ConvertAll(a => GhostExpression(a.E, false, false, a.Attributes));\r\n AddTypeWellFormed(reqs, method.Ins);\r\n AddTypeWellFormed(enss, method.Outs);\r\n bool isRelational = dafnycc.relational && reqs.Concat(enss).ToList().Exists(s =>\r\n s is RtlApply && (((RtlApply)s).op == \"public\" || ((RtlApply)s).op == \"relation\"));\r\n \r\n \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n Util.DebugWriteLine();\r\n Func regold = s => \"r_old.regs[\" + s + \"]\";\r\n Func reg = s => \"r.regs[\" + s + \"]\";\r\n string sMemOld = \"stk_old\";\r\n string sMem = \"stk\";\r\n string parms = String.Join(\", \", method.Ins.Select(x => GhostVar(x.Name) + \":\" + TypeString(AppType(x.Type))));\r\n string rets = String.Join(\", \", method.Outs.Select(x => GhostVar(x.Name) + \":\" + TypeString(AppType(x.Type))));\r\n string memVarsOld = \"me,init,stk_old,statics_old,core_state,ptMem,mems_old\";\r\n string memVars = \"me,init,stk,statics,core_state,ptMem,mems\";\r\n int frameCount = alloc.FrameCount() + dafnycc.framePointerCount;\r\n int frameSize = frameCount * 4;\r\n int inOutSize = 4 * alloc.InsOutsCount();\r\n Func, string> f = l => (l.Count != 0) ? \", \" : \"\";\r\n\r\n List> preserveExps = new List>();\r\n for (int i = 0; i < method.Mod.Expressions.Count; i++)\r\n {\r\n Expression modExp = method.Mod.Expressions[i].E;\r\n if (!(modExp is ThisExpr))\r\n {\r\n RtlExp e = GhostExpression(modExp, false, true);\r\n preserveExps.Add(Tuple.Create(\"mod\" + i, \"(\" + e + \").arrAbs\"));\r\n }\r\n }\r\n string absExtend = isHeapUnmodified\r\n ? \"$toAbs == $toAbs_old && objLayouts == objLayouts_old\"\r\n : \"AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old)\";\r\n string preserveHeap = isHeapUnmodified\r\n ? \"heap == heap_old && $absMem == $absMem_old\"\r\n : DafnyCC.PreserveHeap(minVerify, preserveExps.ConvertAll(p => p.Item2));\r\n\r\n Util.Assert(!isPrinting);\r\n isPrinting = true;\r\n\r\n string stackPrefix = \"stack_size__DafnyCC__\";\r\n //- calculate the statck size\r\n Func g = s => (calledMethods.Count == 0) ? \"0\" : s;\r\n if (!isPublic)\r\n {\r\n iwriter.WriteLine(\"const \" + stackPrefix + procName + \":int := \" + frameSize + \" + \"\r\n + g(\"max(\" + String.Join(\", max(\", calledMethods.Select(s => stackPrefix + s + \" + \" + IPSize))\r\n + \", 0)\" + String.Join(\")\", calledMethods.Select(s => \"\"))) + \";\");\r\n iwriter.WriteLine(\"procedure \" + procName\r\n + \"(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems\"\r\n + \", $commonVars_old:commonVars, $gcVars_old:gcVars\"\r\n + \", $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap\"\r\n + f(method.Ins) + parms\r\n + \") returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems\"\r\n + \", $commonVars:commonVars, $gcVars:gcVars\"\r\n + \", $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap\"\r\n + f(method.Outs) + rets + \");\");\r\n iwriter.WriteLine(\" requires MemInv(\" + memVarsOld + \");\");\r\n iwriter.WriteLine(\" requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk_old,statics_old,core_state,ptMem,mems_old,$stacksFrames_old,io_old);\");\r\n iwriter.WriteLine(\" requires SMemRequireGcRA(\" + stackPrefix + procName + \", \"\r\n + inOutSize + \", \" + sMemOld + \", \" + regold(\"ESP\") + \", RET);\");\r\n iwriter.WriteLine(\" requires HeapInv($absMem_old, objLayouts_old, heap_old);\");\r\n WriteDefaultRelationalRequires(isRelational);\r\n\r\n\r\n\r\n\r\n\r\n foreach (var p in alloc.inInts)\r\n {\r\n int offset = alloc.InIntsOffset() - alloc.OutsOffset() + IPSize + p.Value;\r\n string val = sMemOld + \".map[\" + regold(\"ESP\") + \" + \" + offset + \"]\";\r\n iwriter.WriteLine(\" requires \" + IntEqTyped(allVars[p.Key].type, p.Key, val) + \";\");\r\n }\r\n for (int i = 0; i < inPtrs.Count; i++)\r\n {\r\n Formal x = inPtrs[i];\r\n int offset = alloc.InPtrsOffset() - alloc.OutsOffset() + IPSize + alloc.inPtrs[GhostVar(x.Name)];\r\n string loc = regold(\"ESP\") + \" + \" + offset + \" + stackGcOffset\";\r\n iwriter.WriteLine(\" requires StackAbsSlot(heap_old, $stacksFrames_old, \"\r\n + loc + \") == Abs_\"\r\n + TypeString(AppType(x.Type)) + \"(\" + GhostVar(x.Name) + \");\");\r\n if (DafnySpec.IsArrayType(AppType(x.Type)))\r\n {\r\n iwriter.WriteLine(\" requires frameGet($stacksFrames_old, \" + loc + \") == \" + GhostVar(x.Name) + \".arrAbs;\");\r\n }\r\n }\r\n reqs.ForEach(e => iwriter.WriteLine(\" requires \" + e + \";\"));\r\n iwriter.WriteLine(\" modifies $Time;\");\r\n GetStaticFieldMods().ForEach(x => iwriter.WriteLine(\" modifies \" + x + \";\"));\r\n \r\n iwriter.WriteLine(\" ensures \" + reg(\"ESP\") + \" == old(\" + regold(\"ESP\") + \") + \" + IPSize + \";\");\r\n \r\n iwriter.WriteLine(\" ensures MemInv(\" + memVars + \");\");\r\n iwriter.WriteLine(\" ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\");\r\n iwriter.WriteLine(\" ensures SMemEnsureGcF(\" + inOutSize + \", \" + sMem + \", old(\" + sMemOld + \"), \" + reg(\"ESP\") + \", old(\" + regold(\"ESP\") + \"), $stacksFrames, $stacksFrames_old);\");\r\n iwriter.WriteLine(\" ensures HeapInv($absMem, objLayouts, heap);\");\r\n iwriter.WriteLine(\" ensures \" + absExtend + \";\");\r\n iwriter.WriteLine(\" ensures \" + preserveHeap + \";\");\r\n WriteDefaultRelationalEnsures(isRelational);\r\n\r\n enss.ForEach(e => iwriter.WriteLine(\" ensures \" + e + \";\"));\r\n /*\r\n foreach (var p in retMap)\r\n {\r\n writer.WriteLine(\" ensures \" + reg(p.Value) + \" == \" + p.Key + \";\");\r\n }\r\n */\r\n foreach (var p in alloc.outInts)\r\n {\r\n int offset = IPSize + p.Value;\r\n string val = sMem + \".map[\" + regold(\"ESP\") + \" + \" + offset + \"]\";\r\n iwriter.WriteLine(\" ensures \" + IntEqTyped(allVars[p.Key].type, p.Key, val) + \";\");\r\n }\r\n for (int i = 0; i < outPtrs.Count; i++)\r\n {\r\n Formal x = outPtrs[i];\r\n int offset = IPSize + alloc.outPtrs[GhostVar(x.Name)];\r\n string loc = regold(\"ESP\") + \" + \" + offset + \" + stackGcOffset\";\r\n iwriter.WriteLine(\" ensures StackAbsSlot(heap, $stacksFrames, \"\r\n + loc + \") == Abs_\"\r\n + TypeString(AppType(x.Type)) + \"(\" + GhostVar(x.Name) + \");\");\r\n if (DafnySpec.IsArrayType(AppType(x.Type)))\r\n {\r\n iwriter.WriteLine(\" ensures frameGet($stacksFrames, \" + loc + \") == \" + GhostVar(x.Name) + \".arrAbs;\");\r\n }\r\n }\r\n }\r\n if (body != null || isAxiom)\r\n {\r\n writer.WriteLine(\"implementation \" + procName\r\n + \"(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems\"\r\n + \", $commonVars_old:commonVars, $gcVars_old:gcVars\"\r\n + \", $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap\"\r\n + f(method.Ins) + parms\r\n + \") returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems\"\r\n + \", $commonVars:commonVars, $gcVars:gcVars\"\r\n + \", $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap\"\r\n + f(method.Outs) + rets + \")\");\r\n writer.WriteLine(\"{\");\r\n writer.WriteLine(\" var $absMem_tmp:[int][int]int;\");\r\n writer.WriteLine(\" var objLayouts_tmp:[int]ObjLayout;\");\r\n writer.WriteLine(\" var heap_tmp:Heap;\");\r\n writer.WriteLine(\" var obj_tmp:int;\");\r\n writer.WriteLine(\" var val_tmp:int;\");\r\n preserveExps.ForEach(p => writer.WriteLine(\" var \" + p.Item1 + \":int;\"));\r\n WriteAllVars();\r\n dafnySpec.WriteLemmas(writer, this, visibleModules, method.Attributes);\r\n writer.WriteLine(\" r := r_old;\");\r\n writer.WriteLine(\" stk := stk_old;\");\r\n writer.WriteLine(\" statics := statics_old;\");\r\n writer.WriteLine(\" io := io_old;\");\r\n writer.WriteLine(\" mems := mems_old;\");\r\n writer.WriteLine(\" $commonVars := $commonVars_old;\");\r\n writer.WriteLine(\" $gcVars := $gcVars_old;\");\r\n writer.WriteLine(\" $toAbs := $toAbs_old;\");\r\n writer.WriteLine(\" $absMem := $absMem_old;\");\r\n writer.WriteLine(\" $stacksFrames := $stacksFrames_old;\");\r\n writer.WriteLine(\" objLayouts := objLayouts_old;\");\r\n writer.WriteLine(\" heap := heap_old;\");\r\n for (int i = 0; i < inPtrs.Count; i++)\r\n {\r\n Formal x = inPtrs[i];\r\n int offset = alloc.InPtrsOffset() - alloc.OutsOffset() + IPSize + alloc.inPtrs[GhostVar(x.Name)];\r\n writer.WriteLine(\" \" + GhostVar(x.Name) + \"__abs := frameGet($stacksFrames, \"\r\n + regold(\"ESP\") + \" + \" + offset + \" + stackGcOffset);\");\r\n }\r\n preserveExps.ForEach(p => writer.WriteLine(\" \" + p.Item1 + \" := \" + p.Item2 + \";\"));\r\n writer.WriteLine(\" assert TV(\" + reg(\"ESP\") + \");\");\r\n for (int i = 0; i < frameCount; i++)\r\n {\r\n writer.WriteLine(\" assert TO(0 - \" + (i + 1) + \");\");\r\n writer.WriteLine(\" assert TO(\" + RegAlloc.stackGcOffset / 4 + \" - \" + (i + 1) + \");\");\r\n }\r\n for (int i = frameCount; i < alloc.FrameVisibleCount(); i++)\r\n {\r\n writer.WriteLine(\" assert TO(\" + (i - frameCount) + \");\");\r\n writer.WriteLine(\" assert TO(\" + (RegAlloc.stackGcOffset / 4 + i - frameCount) + \");\");\r\n }\r\n if (frameSize != 0)\r\n {\r\n writer.WriteLine(\" call r := logical_Sub(r, ESP, OConst(\" + frameSize + \"));\");\r\n if (dafnycc.useFramePointer)\r\n {\r\n writer.WriteLine(\" call stk := logical_Store(r, core_state, stk, OMem(MReg(ESP, \" + (frameSize - 4) + \")), OReg(EBP));\");\r\n writer.WriteLine(\" call r := instr_LeaUnchecked(r, EBP, OMem(MReg(ESP, \" + (frameSize - 4) + \")));\");\r\n }\r\n }\r\n bool wasComment= false;\r\n string indent = \" \";\r\n foreach (RtlStmt s in stmts)\r\n {\r\n RtlIndent rtlIndent = s as RtlIndent;\r\n RtlLabel label = s as RtlLabel;\r\n RtlCall call = s as RtlCall;\r\n if (rtlIndent != null)\r\n {\r\n indent = rtlIndent.Positive ? indent + \" \" : indent.Substring(4);\r\n continue;\r\n }\r\n if (s is RtlReturn && frameSize != 0)\r\n {\r\n if (dafnycc.useFramePointer)\r\n {\r\n writer.WriteLine(\" call r := logical_Load(r, core_state, stk, EBP, OMem(MReg(ESP, \" + (frameSize - 4) + \")));\");\r\n }\r\n writer.WriteLine(indent + \"call r := logical_Add(r, ESP, OConst(\" + frameSize + \"));\");\r\n }\r\n /*\r\n if (call != null && call.op == \"Proc_sample\")\r\n {\r\n writer.WriteLine(indent + GhostVar(samplemap) + \" := F();\");\r\n }\r\n */\r\n if (s.comment != null)\r\n {\r\n if (!wasComment)\r\n {\r\n writer.WriteLine();\r\n }\r\n writer.WriteLine(indent + \"// \" + s.comment().Replace(Environment.NewLine, Environment.NewLine + indent));\r\n }\r\n wasComment = true;\r\n if (s.ToString() != \"\")\r\n {\r\n writer.WriteLine(indent + s.ToString().Replace(Environment.NewLine, Environment.NewLine + indent));\r\n wasComment = false;\r\n }\r\n if (call != null)\r\n {\r\n \r\n writer.WriteLine(indent + \"assert SMemInvGcF(\" + (inOutSize + 4) + \", \" + sMem + \", old(\" + sMemOld + \"), \" + reg(\"ESP\") + \" + \" + frameSize + \", old(\" + regold(\"ESP\") + \"), $stacksFrames, $stacksFrames_old);\");\r\n if (dafnycc.useFramePointer) {\r\n writer.WriteLine(indent + \"call r := instr_LeaUnchecked(r, EBP, OMem(MReg(ESP, \" + (frameSize - 4) + \")));\");\r\n }\r\n }\r\n if (label != null && label.loop)\r\n {\r\n writer.WriteLine(indent + \"invariant MemInv(\" + memVars + \");\");\r\n writer.WriteLine(indent + \"invariant NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\");\r\n writer.WriteLine(indent + \"invariant SMemInvGcF(\" + (inOutSize + 4) + \", \" + sMem + \", old(\" + sMemOld + \"), \" + reg(\"ESP\") + \" + \" + frameSize + \", old(\" + regold(\"ESP\") + \"), $stacksFrames, $stacksFrames_old);\");\r\n writer.WriteLine(indent + \"invariant HeapInv($absMem, objLayouts, heap);\");\r\n writer.WriteLine(indent + \"invariant \" + absExtend + \";\");\r\n writer.WriteLine(indent + \"invariant \" + preserveHeap + \";\");\r\n if (isRelational)\r\n {\r\n writer.WriteLine(\" invariant public(io._inCtr);\");\r\n writer.WriteLine(\" invariant public(io._outCtr);\");\r\n }\r\n else if (dafnycc.relational)\r\n {\r\n writer.WriteLine(\" invariant io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\");\r\n }\r\n\r\n }\r\n if (s is RtlLoopStart)\r\n {\r\n \r\n dafnySpec.WriteLemmas(writer, this, visibleModules, method.Attributes, true);\r\n }\r\n }\r\n writer.WriteLine(\"}\");\r\n }\r\n isPrinting = false;\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/DafnyCC/DafnyCC.cs", "content": "using System;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Collections.Generic;\r\nusing System.Collections.ObjectModel;\r\nusing Microsoft.Dafny;\r\nusing Bpl = Microsoft.Boogie;\r\nusing Type = Microsoft.Dafny.Type;\r\nusing System.Numerics;\r\n\r\npublic class DafnyCC_Options: DafnySpec_Options\r\n{\r\n public bool relational;\r\n public bool x64 = false; \r\n public bool useFramePointer = false;\r\n\r\n protected override bool ParseOption(string name, Bpl.CommandLineOptionEngine.CommandLineParseState ps)\r\n {\r\n switch (name) {\r\n case \"relational\":\r\n relational = true;\r\n return true;\r\n case \"x64\":\r\n x64 = true;\r\n return true;\r\n case \"useFramePointer\":\r\n useFramePointer = true;\r\n return true;\r\n default:\r\n break;\r\n }\r\n return base.ParseOption(name, ps);\r\n }\r\n}\r\n\r\npublic class DafnyCC: DafnySpec\r\n{\r\n TextWriter heapWriter = null;\r\n TextWriter heapIWriter = null;\r\n TextWriter checkedWriter = null;\r\n TextWriter checkedIWriter = null;\r\n TextWriter seqWriter = null;\r\n TextWriter seqIWriter = null;\r\n TextWriter mainWriter = Console.Out;\r\n public bool relational = false;\r\n\r\n public bool x64 = false;\r\n public bool useFramePointer = false;\r\n public int IPSize;\r\n public int framePointerCount = 0;\r\n\r\n public List lemmas = new List\r\n {\r\n new LemmaCall(\"Heap\", (Type)null, \"assert fun_unroll(0);\", false),\r\n new LemmaCall(\"Heap\", (Type)null, \"assert fun_unroll(1);\", false),\r\n };\r\n\r\n public List lazyLemmas = new List\r\n {\r\n \"Seq_FromArray_Length\",\r\n \"Seq_FromArray_Index\",\r\n \"Seq_FromArray_Update\",\r\n };\r\n\r\n public List seqLemmas = new List\r\n {\r\n \"Seq_Empty_ToZero\",\r\n \"Seq_Empty_FromZero\",\r\n \"Seq_Singleton_Length\",\r\n \"Seq_Build_Length\",\r\n \"Seq_Build_Index\",\r\n \"Seq_Append_Length\",\r\n \"Seq_Index_Singleton\",\r\n \"Seq_Append_Index\",\r\n \"Seq_Update_Length\",\r\n \"Seq_Index_Update\",\r\n \"Seq_Equal_Equiv\",\r\n \"Seq_Take_Length\",\r\n \"Seq_Take_Index\",\r\n \"Seq_Drop_Length\",\r\n \"Seq_Drop_Index\",\r\n \"Seq_Append_TakeDrop\",\r\n \"Seq_Append_TakeDrop_Restricted\",\r\n \"Seq_Update_CommuteTake1\",\r\n \"Seq_Update_CommuteTake2\",\r\n \"Seq_Update_CommuteDrop1\",\r\n \"Seq_Update_CommuteDrop2\",\r\n \"Seq_Build_CommuteDrop\",\r\n \"Seq_Take_Empty\",\r\n \"Seq_Drop_Empty\",\r\n };\r\n\r\n public static new void Main(string[] args)\r\n {\r\n try\r\n {\r\n Util.DebugWriteLine(\"hello\");\r\n DafnyCC_Options options = new DafnyCC_Options(); \r\n DafnyOptions.Install(options);\r\n DafnyOptions.O.AllowGlobals = true;\r\n DafnyOptions.O.Dafnycc = true;\r\n Bpl.CommandLineOptions.Clo.RunningBoogieFromCommandLine = true;\r\n if (!Bpl.CommandLineOptions.Clo.Parse(args))\r\n {\r\n throw new Exception(\"argument parse error\");\r\n }\r\n IList files = Bpl.CommandLineOptions.Clo.Files;\r\n if (files.Count == 0)\r\n {\r\n throw new Exception(\"*** Error: No input files were specified.\");\r\n }\r\n if (options.useFramePointer && options.x64)\r\n {\r\n throw new Exception(\"64-bit frame pointer not yet implemented\");\r\n }\r\n new DafnyCC().CompileCode(options, files);\r\n }\r\n catch (Exception e)\r\n {\r\n Console.OpenStandardOutput().Flush();\r\n Console.WriteLine(e);\r\n Console.Error.WriteLine(e);\r\n Environment.Exit(-1);\r\n }\r\n }\r\n\r\n public static string ProcName(bool isGhost, string x) { return (isGhost ? \"proc_\" : \"Proc_\") + CleanName(x); }\r\n\r\n public static string PreserveHeap(bool minVerify, List mods, string absMem = \"$absMem\",\r\n string absMemOld = \"$absMem_old\", string heap = \"heap\", string heap_old = \"heap_old\")\r\n {\r\n return \"(forall i:int::{\" + absMem + \"[i]}{\" + heap + \".absData[i]} \" + heap_old + \".absData[i] is AbsNone\"\r\n + \" || (\" + heap + \".absData[i] == \" + heap_old + \".absData[i]\"\r\n + \" && (\" + absMem + \"[i] == \" + absMemOld + \"[i]\"\r\n + (minVerify\r\n ? \" || \" + heap_old + \".absData[i] is Abs_ArrayOfInt\"\r\n : String.Concat(mods.Select(s => \" || i == (\" + s +\")\"))) + \")))\";\r\n }\r\n\r\n public static string PreserveHeap(bool minVerify)\r\n {\r\n return PreserveHeap(minVerify, new List());\r\n }\r\n\r\n public override void AddLemma(LemmaCall lemma)\r\n {\r\n lemmas.Add(lemma);\r\n }\r\n\r\n public override void AddMethodAsLemma(Method method)\r\n {\r\n if (lazyLemmas.Contains(method.Name))\r\n {\r\n lazyLemmas.Remove(method.Name);\r\n lemmas.Add(new LemmaCall(\"Seq\", (Type)null,\r\n \"call \" + ProcName(true, DafnySpec.SimpleSanitizedName(method)) + \"();\",\r\n Attributes.Contains(method.Attributes, \"loop_lemma\")));\r\n }\r\n }\r\n\r\n public override void WriteLemmas(TextWriter writer, CompileBase context, List visibleModules, Attributes attrs,\r\n bool loopLemmasOnly = false)\r\n {\r\n if (minVerify)\r\n {\r\n return;\r\n }\r\n if (!Attributes.Contains(attrs, \"dafnycc_no_lemmas\"))\r\n {\r\n foreach (var x in lemmas.Where(x => visibleModules.Contains(x.module)))\r\n {\r\n if (x.type != null && context.visibleElementType != null\r\n && x.type.ToString() != context.visibleElementType.ToString())\r\n {\r\n continue;\r\n }\r\n if (loopLemmasOnly && !x.loopLemma) {\r\n continue;\r\n }\r\n string line = x.stmt;\r\n if (line.Contains(\"Seq__Append__TakeDrop\"))\r\n {\r\n bool isRestricted = line.Contains(\"Seq__Append__TakeDrop__Restricted\");\r\n bool isConservative = Attributes.Contains(attrs, \"dafnycc_conservative_seq_triggers\");\r\n if (isConservative != isRestricted)\r\n {\r\n continue;\r\n }\r\n }\r\n writer.WriteLine(\" \" + line);\r\n }\r\n }\r\n }\r\n\r\n/* TODO: reduce number of imports for specs\r\n public void WriteImplementationHeader(TextWriter writer, string name, List imports)\r\n {\r\n writer.WriteLine(\"module implementation \" + name);\r\n writer.WriteLine(\" import BaseSpec, MemorySpec, IoTypesSpec, MachineStateSpec, AssemblySpec, InterruptsSpec, IoSpec, OverflowSpec;\");\r\n writer.WriteLine(\" import Core, LogicalAddressing, Util, Stacks, Partition, Separation;\");\r\n writer.WriteLine(\" import IntLemmasGc, GcMemory, Common, GcCollector;\");\r\n writer.WriteLine(\" import IntLemmasMain, IntLemmasBase, IoMain\" + String.Join(\"\", imports.Select(s => \", \" + s)) + \";\");\r\n writer.WriteLine(\"{\");\r\n }\r\n*/\r\n\r\n private void WriteAxiomAnnotations(TextWriter writer, IEnumerable axioms)\r\n {\r\n\t\tforeach (string axiom in axioms)\r\n\t\t{\r\n\t\t\twriter.WriteLine(\"//\");\r\n\t\t}\r\n }\r\n\r\n \r\n public override Tuple> ChooseOutDirWriter(string filename)\r\n {\r\n if (outDir == null)\r\n {\r\n throw new Exception(\"It would be nice to specify outDir\");\r\n }\r\n if (!outDirWriters.ContainsKey(filename))\r\n {\r\n string moduleName = ModuleNameFromFilename(filename);\r\n string baseName = Path.Combine(outDir, moduleName);\r\n TextWriter implWriter = new StreamWriter(baseName + ImpBasmExtn);\r\n TextWriter intfWriter = new StreamWriter(baseName + IfcBasmExtn);\r\n Dictionary imports = new Dictionary(StringComparer.CurrentCultureIgnoreCase);\r\n imports.Add(\"Trusted\", \"\");\r\n imports.Add(\"Checked\", \"\");\r\n imports.Add(\"Heap\", \"\");\r\n imports.Add(\"Seq\", \"\");\r\n if (moduleName != \"dafny_DafnyPrelude\")\r\n {\r\n imports.Add(\"dafny_DafnyPrelude\", \"\");\r\n imports.Add(\"DafnyAssembly\", \"\");\r\n }\r\n AddImports(imports, filename);\r\n List importModules = imports.Keys.ToList();\r\n if (outListWriter != null && moduleName != \"dafny_DafnyPrelude\")\r\n {\r\n outListWriter.WriteLine(moduleName + String.Concat(\r\n imports.Where(x => x.Value != \"\").Select(x => \" \" + x.Key)));\r\n }\r\n WriteImplementationHeader(implWriter, moduleName, importModules);\r\n\t\t\tWriteAxiomAnnotations(implWriter,\r\n\t\t\t\tnew string[] { \"Assembly\", \"Base\", \"Memory\", \"Word\", \"Io\"});\r\n\t\t\t\t\r\n\t\t\t\r\n intfWriter.WriteLine(\"module interface \" + moduleName);\r\n WriteInterfaceImports(intfWriter, GatherAllImports(importModules));\r\n intfWriter.WriteLine(\"{\");\r\n outDirWriters.Add(filename, Tuple.Create(implWriter, intfWriter, moduleName, importModules));\r\n \r\n imports.Values.Where(x => x != \"\").ToList().ForEach(x => {ChooseOutDirWriter(x);});\r\n }\r\n return outDirWriters[filename];\r\n }\r\n\r\n\r\n \r\n public override Tuple> ChooseWriter(\r\n Bpl.IToken tok, string name, TypeApply app = null)\r\n {\r\n string filename = Path.GetFullPath(tok.filename);\r\n bool trustedArg = (app != null && app.typeArgs.Count == 1 && TrustedType(app.typeArgs.Values));\r\n if (IsSeqFile(filename, true))\r\n {\r\n return Tuple.Create(trustedArg ? trustedWriter : checkedWriter,\r\n (name.StartsWith(\"lemma_Seq\") ? (trustedArg ? trustedWriter : checkedWriter)\r\n : (trustedArg ? trustedIWriter : checkedIWriter)),\r\n trustedArg ? \"Trusted\" : \"Checked\",\r\n trustedArg ? new List() : new List { \"Trusted\" });\r\n }\r\n else if (IsSeqFile(filename, false))\r\n {\r\n return Tuple.Create(seqWriter,\r\n (name.StartsWith(\"lemma_Seq\") ? seqWriter : seqIWriter),\r\n \"Seq\",\r\n new List { \"Trusted\", \"Checked\", \"Heap\" });\r\n }\r\n else\r\n {\r\n return ChooseOutDirWriter(filename);\r\n }\r\n }\r\n\r\n void CompileDatatype1Code(Type t, TypeApply app)\r\n {\r\n \r\n string dataName = app.AppName(); \r\n List ctors = compileDatatypes[app].AsDatatype.Ctors;\r\n bool isSeq = dataName.StartsWith(\"Seq_\");\r\n\r\n \r\n \r\n for (int i = 0; i < ctors.Count; i++)\r\n {\r\n heapIWriter.WriteLine(\"const Tag_\" + dataName + \"_\" + ctors[i].Name + \":int := \" + (i + 1) + \";\");\r\n }\r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n heapWriter.WriteLine(\"function HeapWordInv_\" + dataName + \"(absData:[int]AbsData, objLayout:ObjLayout, wordMem:[int]int, data:\" + dataName + \"):bool\");\r\n heapWriter.WriteLine(\"{\");\r\n heapWriter.WriteLine(\" true\");\r\n\r\n foreach (var ctor in ctors)\r\n {\r\n var ints = ctor.Formals.Where(x => !IsPtrType(app.AppType(x.Type))).ToList();\r\n var ptrs = ctor.Formals.Where(x => IsPtrType(app.AppType(x.Type))).ToList();\r\n var sorted = ints.Concat(ptrs).ToList();\r\n string ctorName = Compile_Constructor(t, ctor.Name, app.typeArgs).AppName();\r\n\r\n \r\n \r\n string wordMems = \"\";\r\n for (int i = 0; i < sorted.Count; i++)\r\n {\r\n heapIWriter.WriteLine(\"const Offset_\" + dataName + \"_\" + sorted[i].Name + \":int := \" + (8 + 4 * i) + \";\");\r\n if (IsPtrType(app.AppType(sorted[i].Type)))\r\n {\r\n wordMems += \" && absData[wordMem[\" + (3 + i) + \"]] == Abs_\"\r\n + TypeString(app.AppType(sorted[i].Type)) + \"(\" + sorted[i].Name\r\n + (isSeq ? \"_\" : \"#\") + ctorName + \"(data))\";\r\n }\r\n else\r\n {\r\n wordMems += \" && \" + CompileBase.IntEqTyped(\r\n app.AppType(sorted[i].Type),\r\n sorted[i].Name + (isSeq ? \"_\" : \"#\") + ctorName + \"(data)\",\r\n \"wordMem[\" + (3 + i) + \"]\");\r\n }\r\n }\r\n\r\n \r\n string dataIs = isSeq ? (\"is_\" + ctorName + \"(data)\") : \"data is \" + ctorName;\r\n heapWriter.WriteLine(\"&& (\" + dataIs + \" ==> objLayout == ObjLayout(\"\r\n + (3 + sorted.Count) + \", \" + (3 + ints.Count)\r\n + \") && wordMem[2] == Tag_\" + dataName + \"_\" + ctor.Name + wordMems + \")\");\r\n }\r\n\r\n heapWriter.WriteLine(\"}\");\r\n }\r\n\r\n void CompileDatatype1(Type t, TypeApply app)\r\n {\r\n \r\n string dataName = app.AppName(); \r\n List ctors = compileDatatypes[app].AsDatatype.Ctors;\r\n bool isSeq = dataName.StartsWith(\"Seq_\");\r\n bool isTrusted = isSeq ? TrustedType(app.typeArgs.Values) : TrustedType(t);\r\n\r\n CompileDatatype1Ghost(t, app,\r\n isTrusted ? trustedWriter : checkedWriter,\r\n isTrusted ? trustedIWriter : checkedIWriter);\r\n CompileDatatype1Code(t, app);\r\n }\r\n\r\n string loadTagDecl(String List, String tags)\r\n { \r\n return String.Format(@\"\r\n atomic procedure loadTag_{0}(my r_old:regs, const my core_state:core_state, const linear stk:mem, const linear statics:mem, const linear io:IOState, linear mems_old:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, x:int, y:opn_mem, data:{0}, abs:int, obj:int)\r\n returns(my r:regs, linear mems:mems);\r\n requires MemInv(me,init,stk,statics,core_state,ptMem,mems_old);\r\n requires isStack($S);\r\n requires NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems_old,$stacksFrames,io);\r\n requires HeapInv($absMem, objLayouts, heap);\r\n requires HeapAbsData(heap, abs) == Abs_{0}(data);\r\n requires HeapValue(objLayouts, true, $toAbs, obj, abs);\r\n requires EvalPtrOk(y);\r\n requires EvalPtr(r_old, y) == obj + 4;\r\n ensures mems == mems_old;\r\n ensures r.regs == r_old.regs[x := r.regs[x]];\r\n ensures {1};\", List, tags);\r\n }\r\n\r\n string allocDecl1(string list, string cons, string _cons, string Params, string args, string argRet)\r\n {\r\n return @\"\r\n procedure Proc_Alloc_\" + cons + @\"(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, data:\" + list + @\", \" + Params + @\")\r\n returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, data_out:\" + list + @\");\r\n requires MemInv(me,init,stk_old,statics_old,core_state,ptMem,mems_old);\r\n requires isStack($S);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk_old,statics_old,core_state,ptMem,mems_old,$stacksFrames_old,io_old);\r\n requires SMemRequireGcRA(256, \" + argRet + @\", stk_old, r_old.regs[ESP], RET);\r\n requires HeapInv($absMem_old, objLayouts_old, heap_old);\r\n \r\n \";\r\n }\r\n\r\n string allocDecl2(string list, string cons, string preserve, string args)\r\n {\r\n return @\"\r\n modifies $Time;\r\n ensures MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n ensures SMemEnsureGcF(4, stk, old(stk_old), r.regs[ESP], old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n ensures HeapInv($absMem, objLayouts, heap);\r\n ensures AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n ensures io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n ensures heap_old.absData[frameGet($stacksFrames, r.regs[ESP] + stackGcOffset)] is AbsNone;\r\n ensures StackAbsSlot(heap, $stacksFrames, r.regs[ESP] + stackGcOffset) == Abs_\" + list + @\"(data_out);\r\n ensures data_out == \" + cons + @\"(\" + args + @\");\r\n ensures \" + preserve + @\";\r\n \";\r\n }\r\n\r\n string allocDeclArray(int IPSize, string preserve)\r\n {\r\n return @\"\r\n const stack_size__DafnyCC__Proc_AllocArrayOfInt:int := 256;\r\n procedure Proc_AllocArrayOfInt(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, count:int)\r\n returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, data:ArrayOfInt);\r\n requires MemInv(me,init,stk_old,statics_old,core_state,ptMem,mems_old);\r\n requires isStack($S);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk_old,statics_old,core_state,ptMem,mems_old,$stacksFrames_old,io_old);\r\n requires SMemRequireGcRA(256, 4, stk_old, r_old.regs[ESP], RET);\r\n requires HeapInv($absMem_old, objLayouts_old, heap_old);\r\n requires stk_old.map[r_old.regs[ESP] + \" + IPSize + @\"] == count;\r\n modifies $Time;\r\n ensures MemInv(me,init,stk,statics,core_state,ptMem,mems);\r\n ensures NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames,io);\r\n ensures SMemEnsureGcF(4, stk, old(stk_old), r.regs[ESP], old(r_old.regs[ESP]), $stacksFrames, $stacksFrames_old);\r\n ensures HeapInv($absMem, objLayouts, heap);\r\n ensures \" + preserve + @\";\r\n ensures AbsExtend($toAbs, $toAbs_old, objLayouts, objLayouts_old);\r\n ensures io._inCtr == io_old._inCtr && io._outCtr == io_old._outCtr;\r\n ensures data.arrCount == count;\r\n ensures data.arrAbs == frameGet($stacksFrames, r.regs[ESP] + stackGcOffset);\r\n ensures heap_old.absData[data.arrAbs] is AbsNone;\r\n ensures StackAbsSlot(heap, $stacksFrames, r.regs[ESP] + stackGcOffset) == Abs_ArrayOfInt(data);\r\n \";\r\n }\r\n\r\n string loadField(string list, string dataIsCons, string tl)\r\n {\r\n return @\"\r\n atomic procedure loadField_\" + list + \"_\" + tl + @\"(my r_old:regs, const my core_state:core_state, const linear stk:mem, const linear statics:mem, const linear io:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap:Heap, x:int, y:opn_mem, data:\" + list + @\", abs:int, obj:int)\r\n returns(my r:regs, linear mems:mems);\r\n requires MemInv(me,init,stk,statics,core_state,ptMem,mems_old);\r\n requires isStack($S);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk,statics,core_state,ptMem,mems_old,$stacksFrames_old,io);\r\n requires HeapInv($absMem_old, objLayouts_old, heap);\r\n requires HeapAbsData(heap, abs) == Abs_\" + list + @\"(data);\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, obj, abs);\r\n requires \" + dataIsCons + @\";\r\n requires EvalPtrOk(y);\r\n requires EvalPtr(r_old, y) == obj + Offset_\" + list + \"_\" + tl + @\";\r\n ensures mems == mems_old;\r\n ensures r.regs == r_old.regs[x := r.regs[x]];\r\n \";\r\n }\r\n\r\n string arrayElementProperties()\r\n {\r\n return @\"\r\n atomic procedure arrayElementProperties(const my core_state:core_state, const linear stk:mem, const linear statics:mem, const linear io:IOState, const linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap:Heap, index:int, abs:int, obj:int);\r\n requires MemInv(me,init,stk,statics,core_state,ptMem,mems_old);\r\n requires isStack($S);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk,statics,core_state,ptMem,mems_old,$stacksFrames_old,io);\r\n requires HeapInv($absMem_old, objLayouts_old, heap);\r\n requires HeapAbsData(heap, abs) is Abs_ArrayOfInt;\r\n requires (0 - 1 == index) || (0 <= index && index < HeapAbsData(heap, abs).arr.arrCount);\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, obj, abs);\r\n ensures word(obj + 4 * (2 + index));\r\n ensures abs == HeapAbsData(heap, abs).arr.arrAbs;\r\n \";\r\n }\r\n\r\n string loadArrayElement()\r\n {\r\n return @\"\r\n atomic procedure loadArrayElement(my r_old:regs, const my core_state:core_state, const linear stk:mem, const linear statics:mem, const linear io:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap:Heap, x:int, y:opn_mem, index:int, abs:int, obj:int)\r\n returns(my r:regs, linear mems:mems);\r\n requires MemInv(me,init,stk,statics,core_state,ptMem,mems_old);\r\n requires isStack($S);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk,statics,core_state,ptMem,mems_old,$stacksFrames_old,io);\r\n requires HeapInv($absMem_old, objLayouts_old, heap);\r\n requires HeapAbsData(heap, abs) is Abs_ArrayOfInt;\r\n requires (0 - 1 == index) || (0 <= index && index < HeapAbsData(heap, abs).arr.arrCount);\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, obj, abs);\r\n requires EvalPtrOk(y);\r\n requires EvalPtr(r_old, y) == obj + 4 * (2 + index);\r\n ensures abs == HeapAbsData(heap, abs).arr.arrAbs;\r\n ensures mems == mems_old;\r\n ensures r.regs == r_old.regs[x := r.regs[x]];\r\n ensures r.regs[x] == if index >= 0 then fun_INTERNAL__array__elems__index($absMem_old[abs], index) else HeapAbsData(heap, abs).arr.arrCount;\r\n ensures r.efl == r_old.efl;\r\n ensures word(r.regs[x]);\r\n \";\r\n }\r\n\r\n string storeArrayElement()\r\n {\r\n return @\"\r\n atomic procedure storeArrayElement(const my r:regs, const my core_state:core_state, const linear stk:mem, const linear statics:mem, const linear io:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap:Heap, x:opn_mem, y:opn, index:int, val:int, abs:int, obj:int)\r\n returns(linear mems:mems, absMem:[int][int]int);\r\n requires MemInv(me,init,stk,statics,core_state,ptMem,mems_old);\r\n requires isStack($S);\r\n requires NucleusInv(objLayouts_old,$S,$toAbs_old,$absMem_old,$commonVars_old,$gcVars_old,me,init,stk,statics,core_state,ptMem,mems_old,$stacksFrames_old,io);\r\n requires HeapInv($absMem_old, objLayouts_old, heap);\r\n requires HeapAbsData(heap, abs) is Abs_ArrayOfInt;\r\n requires 0 <= index && index < HeapAbsData(heap, abs).arr.arrCount;\r\n requires HeapValue(objLayouts_old, true, $toAbs_old, obj, abs);\r\n requires word(val);\r\n requires EvalPtrOk(x);\r\n requires EvalPtr(r, x) == obj + 4 * (2 + index);\r\n requires SrcOk(y);\r\n requires val == Eval(r, y);\r\n ensures NucleusInv(objLayouts_old,$S,$toAbs_old,absMem,$commonVars_old,$gcVars_old,me,init,stk,statics,core_state,ptMem,mems,$stacksFrames_old,io);\r\n ensures HeapInv(absMem, objLayouts_old, heap);\r\n ensures tcb#mems(mems)==tcb#mems(mems_old);\r\n ensures pci#mems(mems)==pci#mems(mems_old);\r\n ensures frm#mems(mems)==frm#mems(mems_old);\r\n ensures dat#mems(mems)==dat#mems(mems_old);\r\n ensures abs == HeapAbsData(heap, abs).arr.arrAbs;\r\n ensures absMem == fun_INTERNAL__array__update($absMem_old, HeapAbsData(heap, abs).arr, index, val);\r\n ensures (forall i:int::{fun_INTERNAL__array__elems__index(absMem[abs], i)} i != index ==> fun_INTERNAL__array__elems__index(absMem[abs], i) == fun_INTERNAL__array__elems__index($absMem_old[abs], i));\r\n \";\r\n }\r\n\r\n string allocImpl1(string list, string con, string cons, string _cons, string Params, string args, string size, string sizeInts, string triggers, string seqLemma)\r\n {\r\n return @\"\r\n implementation Proc_Alloc_\" + cons + @\"(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, data:\" + list + @\", \" + Params + @\")\r\n returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, data_out:\" + list + @\")\r\n {\r\n var abs:int;\r\n var _mem:[int]int;\r\n var obj:int;\r\n\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n data_out := \" + _cons + \"(\" + args + @\");\r\n assert THeapInv($absMem, objLayouts, heap);\r\n \" + seqLemma + @\"\r\n\r\n assert TV(r.regs[ESP]) && \" + triggers + @\" && TO(0 - 1) && TO(0 - 2) && TO(0 - 3); \r\n call r := logical_Sub(r, ESP, OConst(12));\r\n\r\n call heap, abs := freshAbs(?gcHi, $toAbs, heap);\r\n call r := instr_Mov(r, EBP, OConst(0));\r\n\r\n call r := instr_Mov(r, ECX, OConst(\" + size + @\"));\r\n call stk := logical_Store(r, core_state, stk, OMem(MReg(ESP,4)), OReg(ECX));\r\n\r\n call r := instr_Mov(r, ECX, OConst(\" + sizeInts + @\"));\r\n call stk := logical_Store(r, core_state, stk, OMem(MReg(ESP,8)), OReg(ECX));\r\n\r\n call alignCall(r.regs[ESP]);\r\n {: call r, stk := logical_Call(r, core_state, stk);\r\n call r, stk, statics, mems, $commonVars, $gcVars, $absMem, $toAbs, objLayouts :=\r\n AllocObject(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts,\r\n abs, \" + size + \" div 4, \" + sizeInts + @\" div 4); :}\r\n\r\n call r := logical_Load(r, core_state, stk, EAX, OMem(MReg(ESP,0)));\r\n\r\n call mems, $absMem :=\r\n gcStoreField(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts,\r\n OMem(MReg(EAX, 4)), OConst(Tag_\" + list + \"_\" + con + @\"), r.regs[EAX] - 4, 2, Tag_\" + list + \"_\" + con + @\");\r\n \";\r\n }\r\n\r\n string allocImplInt(string list, string cons, string tl, string stackOffset)\r\n {\r\n return @\"\r\n call r := logical_Load(r, core_state, stk, EDX, OMem(MReg(ESP,\" + stackOffset + @\")));\r\n call mems, $absMem :=\r\n gcStoreField(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts,\r\n OMem(MReg(EAX, Offset_\" + list + \"_\" + tl + @\")), OReg(EDX), r.regs[EAX] - 4, 1 + (Offset_\" + list + \"_\" + tl + @\" div 4), r.regs[EDX]);\r\n \";\r\n }\r\n\r\n string allocImplPtr(string list, string cons, string tl, string stackOffset) \r\n {\r\n return @\"\r\n call r, mems := gcLoadStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts,\r\n EDX, OMem(MReg(ESP,\" + stackOffset + @\")), r.regs[ESP] + \" + stackOffset + @\");\r\n assert THeapValue(objLayouts, true, $toAbs, r.regs[EDX], frameGet($stacksFrames, r.regs[ESP] + \" + stackOffset + @\"));\r\n call mems, $absMem :=\r\n gcStoreField(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts,\r\n OMem(MReg(EAX, Offset_\" + list + \"_\" + tl + @\")), OReg(EDX), r.regs[EAX] - 4, 1 + (Offset_\" + list + \"_\" + tl + @\" div 4), frameGet($stacksFrames, r.regs[ESP] + \" + stackOffset + @\"));\r\n \";\r\n }\r\n\r\n string allocImpl2(string list, string cons, string destOffset)\r\n {\r\n return @\"\r\n call mems, $stacksFrames :=\r\n gcStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts,\r\n OMem(MReg(ESP, \" + destOffset + @\")), OReg(EAX), r.regs[ESP] + \" + destOffset + @\", abs);\r\n\r\n heap := Heap(heap.absData[abs := Abs_\" + list + @\"(data_out)], heap.freshAbs - 1);\r\n\r\n assert THeapInv($absMem, objLayouts, heap);\r\n call r := logical_Add(r, ESP, OConst(12));\r\n {: call r := logical_Ret(r, core_state, stk); return; :}\r\n }\r\n \";\r\n }\r\n\r\n string allocArrayImpl(int IPSize, string triggers, string destOffset)\r\n {\r\n return @\"\r\n implementation Proc_AllocArrayOfInt(my r_old:regs, const my core_state:core_state, linear stk_old:mem, linear statics_old:mem, linear io_old:IOState, linear mems_old:mems, $commonVars_old:commonVars, $gcVars_old:gcVars, $toAbs_old:[int]int, $absMem_old:[int][int]int, $stacksFrames_old:[int]Frames, objLayouts_old:[int]ObjLayout, heap_old:Heap, count:int)\r\n returns(my r:regs, linear stk:mem, linear statics:mem, linear io:IOState, linear mems:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, data:ArrayOfInt)\r\n {\r\n var abs:int;\r\n var _mem:[int]int;\r\n var obj:int;\r\n\r\n r := r_old;\r\n stk := stk_old;\r\n statics := statics_old;\r\n io := io_old;\r\n mems := mems_old;\r\n $commonVars := $commonVars_old;\r\n $gcVars := $gcVars_old;\r\n $toAbs := $toAbs_old;\r\n $absMem := $absMem_old;\r\n $stacksFrames := $stacksFrames_old;\r\n objLayouts := objLayouts_old;\r\n heap := heap_old;\r\n assert THeapInv($absMem, objLayouts, heap);\r\n\r\n assert TV(r.regs[ESP]) && \" + triggers + @\" && TO(0 - 1) && TO(0 - 2) && TO(0 - 3); \r\n call r := logical_Sub(r, ESP, OConst(12));\r\n\r\n call heap, abs := freshAbs(?gcHi, $toAbs, heap);\r\n call r := instr_Mov(r, EBP, OConst(0));\r\n\r\n call r := logical_Load(r, core_state, stk, ECX, OMem(MReg(ESP,\" + (12 + IPSize) + @\")));\r\n call r := instr_AddChecked(r, ECX, OReg(ECX));\r\n call r := instr_AddChecked(r, ECX, OReg(ECX));\r\n call r := instr_AddChecked(r, ECX, OConst(12));\r\n call stk := logical_Store(r, core_state, stk, OMem(MReg(ESP,4)), OReg(ECX));\r\n call stk := logical_Store(r, core_state, stk, OMem(MReg(ESP,8)), OReg(ECX));\r\n\r\n call alignCall(r.regs[ESP]);\r\n {: call r, stk := logical_Call(r, core_state, stk);\r\n call r, stk, statics, mems, $commonVars, $gcVars, $absMem, $toAbs, objLayouts :=\r\n AllocObject(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts,\r\n abs, count + 3, count + 3); :}\r\n call r := logical_Load(r, core_state, stk, EAX, OMem(MReg(ESP,0)));\r\n\r\n call r := logical_Load(r, core_state, stk, ECX, OMem(MReg(ESP,\" + (12 + IPSize) + @\")));\r\n call mems, $absMem :=\r\n gcStoreField(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts,\r\n OMem(MReg(EAX, 4)), OReg(ECX), r.regs[EAX] - 4, 2, count);\r\n\r\n call mems, $stacksFrames :=\r\n gcStoreStack(r, core_state, stk, statics, io, mems, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts,\r\n OMem(MReg(ESP,\" + destOffset + \")), OReg(EAX), r.regs[ESP]+\" + destOffset + @\", abs);\r\n\r\n data := ArrayOfInt(count, abs);\r\n heap := Heap(heap.absData[abs := Abs_ArrayOfInt(data)], heap.freshAbs - 1);\r\n\r\n assert THeapInv($absMem, objLayouts, heap);\r\n call r := logical_Add(r, ESP, OConst(12));\r\n {: call r := logical_Ret(r, core_state, stk); return; :}\r\n }\r\n \";\r\n }\r\n\r\n string arrayElementPropertiesImpl()\r\n {\r\n return @\"\r\n implementation arrayElementProperties(const my core_state:core_state, const linear stk:mem, const linear statics:mem, const linear io:IOState, const linear mems_old:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, index:int, abs:int, obj:int)\r\n {\r\n assert THeapInv($absMem, objLayouts, heap);\r\n assert THeapValue(objLayouts, true, $toAbs, obj, abs);\r\n call gcFieldProperties(core_state, stk, statics, io, mems_old, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts,\r\n obj - 4, 3 + index);\r\n }\r\n \";\r\n }\r\n\r\n string loadArrayElementImpl()\r\n {\r\n return @\"\r\n implementation loadArrayElement(my r_old:regs, const my core_state:core_state, const linear stk:mem, const linear statics:mem, const linear io:IOState, linear mems_old:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, x:int, y:opn_mem, index:int, abs:int, obj:int)\r\n returns(my r:regs, linear mems:mems)\r\n {\r\n assert THeapInv($absMem, objLayouts, heap);\r\n assert THeapValue(objLayouts, true, $toAbs, obj, abs);\r\n call r, mems :=\r\n gcLoadField(r_old, core_state, stk, statics, io, mems_old, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts,\r\n x, y, obj - 4, 3 + index);\r\n }\r\n \";\r\n }\r\n\r\n string storeArrayElementImpl()\r\n {\r\n return @\"\r\n implementation storeArrayElement(const my r:regs, const my core_state:core_state, const linear stk:mem, const linear statics:mem, const linear io:IOState, linear mems_old:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem_old:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, x:opn_mem, y:opn, index:int, val:int, abs:int, obj:int)\r\n returns(mems:mems, absMem:[int][int]int)\r\n {\r\n assert THeapValue(objLayouts, true, $toAbs, obj, abs);\r\n assert THeapInv($absMem_old, objLayouts, heap);\r\n call mems, absMem :=\r\n gcStoreField(r, core_state, stk, statics, io, mems_old, $commonVars, $gcVars, $absMem_old, $toAbs, $stacksFrames, objLayouts,\r\n x, y, obj - 4, 3 + index, val);\r\n assert THeapInv(absMem, objLayouts, heap);\r\n }\r\n \";\r\n }\r\n\r\n void CompileDatatype2(Type t, TypeApply app)\r\n {\r\n string dataName = app.AppName(); \r\n string suffix = dataName.Substring(((UserDefinedType)t).Name.Length);\r\n bool isSeq = dataName.StartsWith(\"Seq_\");\r\n string lemma = isSeq ? \"call proc_Seq__Cons__All\" + suffix + \"();\" : \"\";\r\n TextWriter iwriter = heapIWriter;\r\n List ctors = compileDatatypes[app].AsDatatype.Ctors;\r\n\r\n \r\n Func dataIs = c => isSeq ? (\"is_\" + c + \"(data)\") : (\"data is \" + c);\r\n string tags = String.Join(\" || \", ctors.Select(c =>\r\n \"(r.regs[x] == Tag_\" + dataName + \"_\" + c.Name + \" && \" + dataIs(\r\n Compile_Constructor(t, c.Name, app.typeArgs).AppName()) + \")\"));\r\n iwriter.WriteLine(loadTagDecl(dataName, tags));\r\n heapWriter.WriteLine(\"implementation loadTag_\" + dataName\r\n + \"(my r_old:regs, const my core_state:core_state, const linear stk:mem, const linear statics:mem, const linear io:IOState, linear mems_old:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, x:int, y:opn_mem, data:\"\r\n + dataName + \", abs:int, obj:int)\");\r\n heapWriter.WriteLine(\" returns(my r:regs, linear mems:mems)\");\r\n heapWriter.WriteLine(\"{\");\r\n heapWriter.WriteLine(\" assert THeapValue(objLayouts, true, $toAbs, obj, abs);\");\r\n heapWriter.WriteLine(\" assert THeapInv($absMem, objLayouts, heap);\");\r\n heapWriter.WriteLine(\" \" + lemma);\r\n heapWriter.WriteLine(\" call r, mems := gcLoadField(r_old, core_state, stk, statics, io, mems_old,\");\r\n heapWriter.WriteLine(\" $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts,\");\r\n heapWriter.WriteLine(\" x, y, obj - 4, 2);\");\r\n heapWriter.WriteLine(\"}\");\r\n\r\n foreach (var ctor in ctors)\r\n {\r\n var ints = ctor.Formals.Where(x => !IsPtrType(app.AppType(x.Type))).ToList();\r\n var ptrs = ctor.Formals.Where(x => IsPtrType(app.AppType(x.Type))).ToList();\r\n var sorted = ints.Concat(ptrs).ToList();\r\n string ctorName = Compile_Constructor(t, ctor.Name, app.typeArgs).AppName();\r\n string cons = isSeq ? (\"_\" + ctorName) : ctorName;\r\n\r\n \r\n string parms = String.Join(\", \", ctor.Formals.Select(\r\n c => \"arg_\" + c.Name + \":\" + TypeString(app.AppType(c.Type))));\r\n \r\n string args = String.Join(\", \", ctor.Formals.Select(c => \"arg_\" + c.Name));\r\n int argRetSize = 4 + 4 * Math.Max(ints.Count, ptrs.Count);\r\n heapIWriter.WriteLine(\"const stack_size__DafnyCC__Proc_Alloc_\" + ctorName + \":int := 256;\");\r\n iwriter.WriteLine(allocDecl1(\r\n dataName,\r\n ctorName,\r\n cons,\r\n parms,\r\n args,\r\n argRetSize.ToString()));\r\n string triggers = (IPSize == 8) ? String.Format(\"{0} && {1}\", GcTO64(1), GcTO(3)) : GcTO(1);\r\n for (int i = 0; i < ints.Count; i++)\r\n {\r\n \r\n string val = \"stk_old.map[r_old.regs[ESP] + \"\r\n + (IPSize + 4 * i) + \"]\";\r\n iwriter.WriteLine(\"requires \" + CompileBase.IntEqTyped(app.AppType(ints[i].Type), \"arg_\" + ints[i].Name, val) + \";\");\r\n triggers += String.Format(\" && {0}\", (IPSize == 8 ? StackTO64(i + 1): StackTO(i + 1)));\r\n }\r\n for (int i = 0; i < ptrs.Count; i++)\r\n {\r\n \r\n iwriter.WriteLine(\"requires StackAbsSlot(heap_old, $stacksFrames_old, r_old.regs[ESP] + \"\r\n + (IPSize + 4 + 4 * i) + \" + stackGcOffset) == Abs_\" + TypeString(app.AppType(ptrs[i].Type))\r\n + \"(arg_\" + ptrs[i].Name + \");\");\r\n triggers += String.Format(\" && {0}\", (IPSize == 8 ? GcTO64(i + 2): GcTO(i + 2)));\r\n }\r\n iwriter.WriteLine(allocDecl2(\r\n dataName,\r\n cons,\r\n PreserveHeap(minVerify),\r\n args));\r\n heapWriter.WriteLine(allocImpl1(\r\n dataName,\r\n ctor.Name,\r\n ctorName,\r\n cons,\r\n parms,\r\n args,\r\n (12 + 4 * sorted.Count).ToString(),\r\n (12 + 4 * ints.Count).ToString(),\r\n triggers,\r\n lemma));\r\n for (int i = 0; i < ints.Count; i++)\r\n {\r\n heapWriter.WriteLine(allocImplInt(\r\n dataName,\r\n ctorName,\r\n ints[i].Name,\r\n (12 + IPSize + 4 * i).ToString()));\r\n }\r\n for (int i = 0; i < ptrs.Count; i++)\r\n {\r\n heapWriter.WriteLine(allocImplPtr(\r\n dataName,\r\n ctorName,\r\n ptrs[i].Name,\r\n (RegAlloc.stackGcOffset + 16 + IPSize + 4 * i).ToString() + \"/* stackGcOffset + 16 + IPSize + \" + (4 * i) + \" */\"));\r\n }\r\n heapWriter.WriteLine(allocImpl2(\r\n dataName,\r\n ctorName,\r\n (RegAlloc.stackGcOffset + 12 + IPSize).ToString() + \"/* stackGcOffset + 12 + IPSize */\"));\r\n\r\n for (int i = 0; i < sorted.Count; i++)\r\n {\r\n var formal = sorted[i];\r\n iwriter.WriteLine(loadField(\r\n dataName,\r\n dataIs(ctorName),\r\n formal.Name));\r\n if (IsPtrType(app.AppType(formal.Type)))\r\n {\r\n \r\n \r\n iwriter.WriteLine(\"ensures HeapAbsData(heap, $absMem_old[abs][\"\r\n + (3 + i) + \"]) == Abs_\" + TypeString(app.AppType(formal.Type))\r\n + \"(\" + formal.Name + (isSeq ? \"_\" : \"#\") + ctorName + \"(data));\");\r\n iwriter.WriteLine(\"ensures HeapValue(objLayouts_old, true, $toAbs_old, r.regs[x], $absMem_old[abs][\"\r\n + (3 + i) + \"]);\");\r\n if (DafnySpec.IsArrayType(app.AppType(formal.Type)))\r\n {\r\n iwriter.WriteLine(\"ensures $absMem_old[abs][\" + (3+i) + \"] == \" + formal.Name + \"#\" + ctorName + \"(data).arrAbs;\");\r\n }\r\n }\r\n else\r\n {\r\n \r\n iwriter.WriteLine(\"ensures \" + CompileBase.IntEqTyped(\r\n app.AppType(formal.Type), formal.Name + (isSeq ? \"_\" : \"#\") + ctorName + \"(data)\", \"r.regs[x]\")\r\n + \";\");\r\n }\r\n heapWriter.WriteLine(\"implementation loadField_\" + dataName + \"_\" + formal.Name\r\n + \"(my r_old:regs, const my core_state:core_state, const linear stk:mem, const linear statics:mem, const linear io:IOState, linear mems_old:mems, $commonVars:commonVars, $gcVars:gcVars, $toAbs:[int]int, $absMem:[int][int]int, $stacksFrames:[int]Frames, objLayouts:[int]ObjLayout, heap:Heap, x:int, y:opn_mem, data:\"\r\n + dataName + \", abs:int, obj:int)\");\r\n heapWriter.WriteLine(\" returns(my r:regs, linear mems:mems)\");\r\n heapWriter.WriteLine(\"{\");\r\n heapWriter.WriteLine(\" assert THeapValue(objLayouts, true, $toAbs, obj, abs);\");\r\n heapWriter.WriteLine(\" assert THeapInv($absMem, objLayouts, heap);\");\r\n heapWriter.WriteLine(\" call r, mems := gcLoadField(r_old, core_state, stk, statics, io, mems_old, $commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts,\");\r\n heapWriter.WriteLine(\" x, y, obj - 4, \" + (3 + i) + \");\");\r\n heapWriter.WriteLine(\" assert THeapValue(objLayouts, true, $toAbs, r.regs[x], $absMem[abs][\" + (3 + i) + \"]);\");\r\n heapWriter.WriteLine(\"}\");\r\n }\r\n }\r\n }\r\n\r\n string heapDecl()\r\n {\r\n return @\"\r\n type Heap = Heap(absData:[int]AbsData, freshAbs:int);\r\n function HeapAbsData(heap:Heap, abs:int):AbsData { heap.absData[abs] }\r\n function StackAbsSlot(heap:Heap, stacksFrames:[int]Frames, ptr:int):AbsData { heap.absData[frameGet(stacksFrames, ptr)] }\r\n function HeapValue(objLayouts:[int]ObjLayout, isPtr:bool, rev:[int]int, val:int, abs:int):bool;\r\n function HeapInv(absMem:[int][int]int, objLayouts:[int]ObjLayout, heap:Heap):bool;\r\n\r\n atomic ghost procedure initHeap(absMem:[int][int]int, objLayouts:[int]ObjLayout) returns(heap:Heap);\r\n requires (forall i:int::{objLayouts[i]} objLayouts[i] == NoObjLayout());\r\n ensures HeapInv(absMem, objLayouts, heap);\r\n\r\n atomic procedure heapLoadStack(my r__BEAT__old:regs,const my core_state:core_state,const linear stk:mem,const linear statics:mem,const linear io:IOState,linear mems__BEAT__old:mems,$commonVars:commonVars,$gcVars:gcVars,$absMem:[int][int]int,$toAbs:[int]int,$stacksFrames:[int]Frames,objLayouts:[int]ObjLayout,x:int,y:opn_mem,ptr:int)\r\n returns(my r:regs,linear mems:mems);\r\n requires isStack($S);\r\n requires NucleusInv(objLayouts,$S,$toAbs,$absMem,$commonVars,$gcVars,me,init,stk,statics,core_state,ptMem,mems__BEAT__old,$stacksFrames,io);\r\n requires StackLo($S)<=ptr&&ptr objLayouts[i] == NoObjLayout())\r\n && (forall i:int::{absMem[i]}{heap.absData[i]} heap.absData[i] != AbsNone() ==> !word(i))\r\n && (forall i:int::{heap.absData[i]} i <= heap.freshAbs ==> heap.absData[i] == AbsNone())\r\n && (forall i:int::{absMem[i]}{heap.absData[i]} HeapWordInv(heap.absData, objLayouts[i], absMem[i], heap.absData[i], i))\r\n }\r\n\r\n atomic ghost procedure freshAbs(k:int, $toAbs:[int]int, heap_old:Heap) returns(heap:Heap, abs:int)\r\n requires (forall i:int::{$toAbs[i]} k <= i && i < ?gcHi ==> heap_old.freshAbs < $toAbs[i]);\r\n ensures heap == Heap(heap_old.absData, heap.freshAbs);\r\n ensures abs == heap.freshAbs;\r\n ensures abs < heap_old.freshAbs;\r\n ensures (forall i:int::{$toAbs[i]} 0 <= i && i < ?gcHi ==> abs < $toAbs[i]);\r\n {\r\n heap := Heap(heap_old.absData, heap_old.freshAbs - 1);\r\n if (k > 0)\r\n {\r\n if (heap.freshAbs >= $toAbs[k - 1])\r\n {\r\n heap := Heap(heap.absData, $toAbs[k - 1] - 1);\r\n }\r\n call heap, abs := freshAbs(k - 1, $toAbs, heap);\r\n }\r\n abs := heap.freshAbs;\r\n }\r\n\r\n implementation initHeap(absMem:[int][int]int, objLayouts:[int]ObjLayout) returns(heap:Heap)\r\n {\r\n heap := Heap((lambda i:int::AbsNone()), NO_ABS - 1);\r\n assert THeapInv(absMem, objLayouts, heap);\r\n }\r\n\r\n implementation heapLoadStack(my r__BEAT__old:regs,const my core_state:core_state,const linear stk:mem,const linear statics:mem,const linear io:IOState,linear mems__BEAT__old:mems,$commonVars:commonVars,$gcVars:gcVars,$absMem:[int][int]int,$toAbs:[int]int,$stacksFrames:[int]Frames,objLayouts:[int]ObjLayout,x:int,y:opn_mem,ptr:int)\r\n returns(my r:regs,linear mems:mems)\r\n {\r\n call r, mems := gcLoadStack(r__BEAT__old,core_state,stk,statics,io,mems__BEAT__old,$commonVars,$gcVars,$absMem,$toAbs,$stacksFrames,objLayouts,x,y,ptr);\r\n assert THeapValue(objLayouts,true,$toAbs,(r.regs)[x],Abss#Frames($stacksFrames[$S])[ptr]);\r\n }\r\n\r\n implementation heapStoreStack(const my r:regs,const my core_state:core_state,const linear stk:mem,const linear statics:mem,const linear io:IOState,linear mems__BEAT__old:mems,$commonVars:commonVars,$gcVars:gcVars,$absMem:[int][int]int,$toAbs:[int]int,$stacksFrames__BEAT__old:[int]Frames,objLayouts:[int]ObjLayout,x:opn_mem,y:opn,ptr:int,abs:int)\r\n returns(linear mems:mems,$stacksFrames:[int]Frames)\r\n {\r\n assert THeapValue(objLayouts,true,$toAbs,Eval(r,y),abs);\r\n call mems, $stacksFrames := gcStoreStack(r,core_state,stk,statics,io,mems__BEAT__old,$commonVars,$gcVars,$absMem,$toAbs,$stacksFrames__BEAT__old,objLayouts,x,y,ptr,abs);\r\n }\r\n \";\r\n }\r\n\r\n string heapWordInvArray()\r\n {\r\n return @\"\r\n function HeapWordInvArray(absData:[int]AbsData, objLayout:ObjLayout, wordMem:[int]int, data:ArrayOfInt, abs:int):bool\r\n {\r\n data.arrCount >= 0\r\n && objLayout == ObjLayout(3 + data.arrCount, 3 + data.arrCount)\r\n && wordMem[2] == data.arrCount\r\n && data.arrAbs == abs\r\n }\r\n \";\r\n }\r\n\r\n string StackTO(int offset)\r\n {\r\n return String.Format(\"TO({0})\", offset);\r\n }\r\n\r\n string StackTO64(int offset)\r\n {\r\n return String.Format(\"{0} && {1}\", StackTO(offset), StackTO(offset + 1));\r\n }\r\n\r\n string GcTO(int offset)\r\n {\r\n return String.Format(\"TO({0} + {1}) /*stackGcOffsetWord + {1} */\", RegAlloc.stackGcOffset / 4, offset);\r\n }\r\n\r\n string GcTO64(int offset)\r\n {\r\n return String.Format(\"{0} && {1}\", GcTO(offset), GcTO(offset + 1));\r\n }\r\n\r\n void CompileDatatypes()\r\n {\r\n heapIWriter.WriteLine(\" function Arr_Index(absMem:[int][int]int, arr:ArrayOfInt, i:int):int { absMem[arr.arrAbs][3 + i] }\");\r\n heapIWriter.WriteLine(\" function Arr_Length(arr:ArrayOfInt):int { if arr.arrCount >= 0 then arr.arrCount else 0 }\");\r\n heapIWriter.WriteLine(\" function fun_INTERNAL__array__elems(absMem:[int][int]int, arr:ArrayOfInt):[int]int { absMem[arr.arrAbs] }\");\r\n heapIWriter.WriteLine(\" function fun_INTERNAL__array__elems__index(arr:[int]int, k:int):int { arr[3 + k] }\");\r\n heapIWriter.WriteLine(\" function fun_INTERNAL__array__elems__update(arr:[int]int, k:int, v:int):[int]int { arr[3 + k := v] }\");\r\n heapIWriter.WriteLine(\" function fun_INTERNAL__array__update(absMem:[int][int]int, arr:ArrayOfInt, k:int, v:int):[int][int]int { absMem[arr.arrAbs := absMem[arr.arrAbs][3 + k := v]] }\");\r\n heapIWriter.WriteLine(allocDeclArray(IPSize, PreserveHeap(minVerify)));\r\n heapIWriter.WriteLine(arrayElementProperties());\r\n heapIWriter.WriteLine(loadArrayElement());\r\n heapIWriter.WriteLine(storeArrayElement());\r\n\r\n heapWriter.WriteLine(heapWordInvArray());\r\n for (int i = 0; i < compileDatatypeList.Count; i++)\r\n {\r\n \r\n var app = compileDatatypeList[i];\r\n CompileDatatype1(compileDatatypes[app], app);\r\n }\r\n\r\n \r\n heapIWriter.WriteLine(\"type AbsData = AbsNone() | Abs_ArrayOfInt(arr:ArrayOfInt) | \"\r\n + String.Join(\" | \", compileDatatypes.Select(d => d.Key.AppName())\r\n .Select(x => \"Abs_\" + x + \"(\" + x + \":\" + x + \")\")) + \";\");\r\n\r\n \r\n \r\n \r\n \r\n \r\n heapWriter.WriteLine(\"function HeapWordInv(absData:[int]AbsData, objLayout:ObjLayout, wordMem:[int]int, data:AbsData, abs:int):bool\");\r\n heapWriter.WriteLine(\"{\");\r\n heapWriter.WriteLine(\" true\");\r\n heapWriter.WriteLine(\" && (data is Abs_ArrayOfInt ==> HeapWordInvArray(absData, objLayout, wordMem, data.arr, abs))\");\r\n foreach (var d in compileDatatypes)\r\n {\r\n string name = d.Key.AppName();\r\n heapWriter.WriteLine(\" && (data is Abs_\" + name + \" ==> HeapWordInv_\"\r\n + name + \"(absData, objLayout, wordMem, data.\" + name + \"))\");\r\n }\r\n heapWriter.WriteLine(\"}\");\r\n\r\n heapIWriter.WriteLine(heapDecl());\r\n heapWriter.WriteLine(heapProcs());\r\n heapWriter.WriteLine(allocArrayImpl(IPSize,\r\n String.Format(\"{0} && {1}\", \r\n (IPSize == 8 ? StackTO64(1): StackTO(1)),\r\n (IPSize == 8 ? GcTO64(1): GcTO(1))),\r\n (RegAlloc.stackGcOffset + 12 + IPSize).ToString()));\r\n heapWriter.WriteLine(arrayElementPropertiesImpl());\r\n heapWriter.WriteLine(loadArrayElementImpl());\r\n heapWriter.WriteLine(storeArrayElementImpl());\r\n\r\n compileDatatypes.ToList().ForEach(p => CompileDatatype2(p.Value, p.Key));\r\n }\r\n\r\n public override void AddDatatypeLemmas(UserDefinedType t, TypeApply apply)\r\n {\r\n switch (t.Name)\r\n {\r\n case \"Seq\":\r\n {\r\n List lemmaApps = new List();\r\n Dictionary loopLemmas = new Dictionary();\r\n foreach (string lemmaName in seqLemmas)\r\n {\r\n Method lemma = FindMethod(lemmaName);\r\n var a = Compile_Method(lemma, apply.typeArgs);\r\n lemmaApps.Add(a);\r\n if (Attributes.Contains(lemma.Attributes, \"loop_lemma\"))\r\n {\r\n loopLemmas.Add(a.AppName(), \"\");\r\n }\r\n }\r\n \r\n Type elementType = (t.TypeArgs.Count == 1) ? t.TypeArgs[0] : null;\r\n lemmaApps.ForEach(a => lemmas.Add(new LemmaCall(\"Seq\", elementType,\r\n \"call \" + ProcName(true, SimpleName(a.AppName())) + \"();\",\r\n loopLemmas.ContainsKey(a.AppName()))));\r\n break;\r\n }\r\n }\r\n }\r\n\r\n public override CompileMethodGhost NewCompileMethod(DafnySpec dafnySpec, Method method,\r\n TypeApply typeApply, TextWriter writer, TextWriter iwriter, string moduleName, List imports)\r\n {\r\n return new CompileMethod(dafnySpec, method, typeApply, writer, iwriter, moduleName, imports);\r\n }\r\n\r\n public override void Compile_FunctionAsMethod(Function function, Dictionary typeArgs,\r\n Dictionary substArgs)\r\n {\r\n var tok = function.tok;\r\n if (Attributes.Contains(function.Attributes, \"CompiledSpec\"))\r\n {\r\n \r\n \r\n string specName = function.Name.Substring(\"CompiledSpec_\".Length);\r\n function = FindFunction(specName);\r\n }\r\n bool hidden = Attributes.Contains(function.Attributes, \"opaque\");\r\n Formal result = new Formal(function.tok, \"__result\", function.ResultType, false, function.IsGhost);\r\n string funName = function.Name;\r\n string name = FunName(DafnySpec.SimpleSanitizedName(function));\r\n FunctionCallExpr call = new FunctionCallExpr(tok, name, new ThisExpr(tok), tok,\r\n function.Formals.ConvertAll(f => (Expression)\r\n MakeIdentifierExpr(f.Name, f.Type, f.IsGhost)));\r\n call.Function = function;\r\n call.TypeArgumentSubstitutions = typeArgs;\r\n call.Type = function.ResultType;\r\n CallStmt revealCall = null;\r\n if (hidden)\r\n {\r\n var selectExpr = new MemberSelectExpr(tok, new ThisExpr(tok), \"reveal_\" + function.Name);\r\n selectExpr.Member = FindMethod(selectExpr.MemberName); // Manually resolve here\r\n selectExpr.TypeApplication = new List(); // Manually resolve here\r\n selectExpr.Type = new InferredTypeProxy(); // Manually resolve here \r\n\r\n revealCall = new CallStmt(tok, tok, new List(), selectExpr, new List());\r\n revealCall.IsGhost = true; \r\n ClassDecl cls = (ClassDecl)function.EnclosingClass;\r\n string fullName = \"#\" + function.Name + \"_FULL\";\r\n function = (Function)cls.Members.Find(m => m.Name == fullName);\r\n if (function == null)\r\n {\r\n throw new Exception(\"internal error: could not find function \" + fullName);\r\n }\r\n substArgs = new Dictionary();\r\n function.TypeArgs.ForEach(t => substArgs.Add(t.Name, t));\r\n typeArgs = typeArgs.ToDictionary(p => substArgs[p.Key.Name], p => p.Value);\r\n }\r\n Expression funBody = function.Body;\r\n BlockStmt body = null;\r\n if (funBody != null)\r\n {\r\n ReturnStmt retStmt = new ReturnStmt(tok, tok, new List() {\r\n new ExprRhs(funBody)\r\n });\r\n body = new BlockStmt(tok, tok,\r\n hidden\r\n ? (new List() { revealCall, retStmt })\r\n : (new List() { retStmt }));\r\n }\r\n List ens = new List {\r\n MakeBinaryExpr(BinaryExpr.Opcode.Eq, BinaryExpr.ResolvedOpcode.EqCommon, Type.Bool,\r\n MakeIdentifierExpr(\"__result\", function.ResultType, function.IsGhost),\r\n call)\r\n }.Concat(function.Ens).ToList();\r\n Method method = new Method(tok, funName, function.IsStatic, function.IsGhost,\r\n function.TypeArgs, function.Formals, new List { result },\r\n function.Req.ConvertAll(e => new MaybeFreeExpression(e)),\r\n new Specification(new List(), null),\r\n ens.ConvertAll(e => new MaybeFreeExpression(e)),\r\n function.Decreases,\r\n body, function.Attributes, function.SignatureEllipsis);\r\n method.EnclosingClass = function.EnclosingClass;\r\n Compile_Method(method, typeArgs);\r\n }\r\n\r\n public Tuple GetSeqBuildMethod(Type t, SeqTree tree, List elemDimensions)\r\n {\r\n \r\n \r\n if (elemDimensions.Count == 0)\r\n {\r\n return GetSeqMethod(t, \"seq_Empty\");\r\n }\r\n if (elemDimensions.Count == 2 && elemDimensions[0] && elemDimensions[1])\r\n {\r\n return GetSeqMethod(t, \"seq_Append\");\r\n }\r\n string op = \"seq_\" + SeqTree.TreeName(tree);\r\n DatatypeDecl seqDecl = FindDatatype(\"Seq\");\r\n var tok = new Bpl.Token(0, 0);\r\n tok.filename = @\"!\\Seq.dfy\";\r\n TypeApply tApp = Compile_SeqType((SeqType)t);\r\n Type dataType = new UserDefinedType(tok, \"Seq\", seqDecl, new List { ((SeqType)t).Arg });\r\n Type elemType = ((SeqType)t).Arg;\r\n Func idExpr = (x, typ) => {\r\n var e = new IdentifierExpr(tok, x);\r\n e.Type = typ;\r\n e.Var = new LocalVariable(tok, tok, x, typ, false);\r\n return e;\r\n };\r\n Func,FunctionCallExpr> seqCall = (x, args) => {\r\n var seqOp = GetSeqOperation(t, x);\r\n FunctionCallExpr callExpr = new FunctionCallExpr(\r\n tok, \"Seq_Empty\", new ThisExpr(tok), tok, args);\r\n callExpr.Function = seqOp.Item1;\r\n callExpr.TypeArgumentSubstitutions = seqOp.Item2.typeArgs;\r\n return callExpr;\r\n };\r\n Expression empty = seqCall(\"Seq_Empty\", new List {});\r\n int varCount = 0;\r\n Func resultRec = null;\r\n resultRec = (subtree) =>\r\n {\r\n if (subtree == null)\r\n {\r\n return idExpr(\"s\" + (varCount++), dataType);\r\n }\r\n if (subtree.buildCount >= 0)\r\n {\r\n Expression build = empty;\r\n for (int i = 0; i < subtree.buildCount; i++)\r\n {\r\n build = seqCall(\"Seq_Build\", new List\r\n { build, idExpr(\"a\" + (varCount++), elemType) });\r\n }\r\n return build;\r\n }\r\n else\r\n {\r\n return seqCall(\"Seq_Append\", new List\r\n { resultRec(subtree.left), resultRec(subtree.right) });\r\n }\r\n };\r\n Expression result = resultRec(tree);\r\n Expression post = seqCall(\"Seq_Equal\", new List { idExpr(\"s\", dataType), result });\r\n List stmts = new List();\r\n for (int i = elemDimensions.Count; i > 0;)\r\n {\r\n bool isFirst = (i == elemDimensions.Count);\r\n i--;\r\n if (elemDimensions[i])\r\n {\r\n if (isFirst)\r\n {\r\n \r\n stmts.Add(new AssignStmt(tok, tok, idExpr(\"s\", dataType),\r\n new ExprRhs(idExpr(\"s\" + i, dataType))));\r\n }\r\n else\r\n {\r\n // s := seq_Append(s9, s);\r\n var selectExpr = new MemberSelectExpr(tok, new ThisExpr(tok), \"seq_Append\");\r\n selectExpr.Member = FindMethod(selectExpr.MemberName); // Manually resolve here\r\n selectExpr.TypeApplication = new List() { elemType }; // Manually resolve here\r\n selectExpr.Type = new InferredTypeProxy(); // Manually resolve here\r\n \r\n CallStmt callStmt = new CallStmt(tok, tok,\r\n new List {idExpr(\"s\", dataType)},\r\n selectExpr, new List\r\n { idExpr(\"s\" + i, dataType), idExpr(\"s\", dataType) }); \r\n stmts.Add(callStmt);\r\n }\r\n }\r\n else\r\n {\r\n if (isFirst)\r\n {\r\n \r\n DatatypeValue nil = new DatatypeValue(tok, \"Seq\", \"Nil\", new List() {});\r\n nil.Type = dataType;\r\n nil.InferredTypeArgs = new List { elemType };\r\n nil.Ctor = seqDecl.Ctors[0];\r\n Util.Assert(nil.Ctor.Name == \"Seq_Nil\");\r\n stmts.Add(new AssignStmt(tok, tok, idExpr(\"s\", dataType), new ExprRhs(nil)));\r\n }\r\n // lemma_Seq_Cons(ai, s);\r\n var selectExpr = new MemberSelectExpr(tok, new ThisExpr(tok), \"lemma_Seq_Cons\"); \r\n selectExpr.Member = FindMethod(selectExpr.MemberName); // Manually resolve here\r\n selectExpr.TypeApplication = new List() { elemType }; // Manually resolve here\r\n selectExpr.Type = new InferredTypeProxy(); // Manually resolve here\r\n \r\n CallStmt callStmt = new CallStmt(tok, tok,\r\n new List {},\r\n selectExpr, new List\r\n { idExpr(\"a\" + i, elemType), idExpr(\"s\", dataType) }); \r\n callStmt.IsGhost = true;\r\n stmts.Add(callStmt);\r\n \r\n DatatypeValue cons = new DatatypeValue(tok, \"Seq\", \"Cons\", new List()\r\n { idExpr(\"a\" + i, elemType), idExpr(\"s\", dataType) });\r\n cons.Type = dataType;\r\n cons.InferredTypeArgs = new List { elemType };\r\n cons.Ctor = seqDecl.Ctors[1];\r\n Util.Assert(cons.Ctor.Name == \"Seq_Cons\");\r\n stmts.Add(new AssignStmt(tok, tok, idExpr(\"s\", dataType), new ExprRhs(cons)));\r\n }\r\n }\r\n BlockStmt body = new BlockStmt(tok, tok, stmts);\r\n List ins = new List();\r\n for (int i = 0; i < elemDimensions.Count; i++)\r\n {\r\n bool isSeq = elemDimensions[i];\r\n ins.Add(new Formal(tok, (isSeq ? \"s\" : \"a\") + i, isSeq ? dataType : elemType, true, false));\r\n }\r\n List outs = new List { new Formal(tok, \"s\", dataType, false, false) };\r\n List reqs = new List();\r\n List enss = new List { new MaybeFreeExpression(post) };\r\n Specification mods = new Specification(new List(), null);\r\n Specification decs = new Specification(new List(), null);\r\n Attributes attrs = new Attributes(\"dafnycc_conservative_seq_triggers\", new List(), null);\r\n Method m = new Method(tok, op, true, false, tApp.typeParams, ins, outs, reqs, mods, enss, decs, body, attrs, tok);\r\n m.EnclosingClass = GetSeqMethod(t, \"seq_Append\").Item1.EnclosingClass;\r\n return Tuple.Create(m, Compile_Method(m, tApp.typeArgs));\r\n }\r\n\r\n void addAxioms(TextWriter sw, IEnumerable axiomModules)\r\n {\r\n foreach (string axiomModule in axiomModules)\r\n {\r\n sw.WriteLine(String.Format(\"//\", axiomModule));\r\n }\r\n }\r\n\r\n public Dictionary CompileCodeStart(DafnyCC_Options options, IList files)\r\n {\r\n IEnumerable axioms = new string[] {\r\n \"Base_axioms\", \"Word_axioms\", \"Memory_axioms\", \"Assembly_axioms\", \"Io_axioms\" };\r\n Dictionary allModules = CompileSpecStart(options, files);\r\n\r\n relational = options.relational;\r\n x64 = options.x64;\r\n IPSize = x64 ? 8 : 4;\r\n useFramePointer = options.useFramePointer;\r\n framePointerCount = useFramePointer ? 1 : 0;\r\n\r\n heapWriter = new StreamWriter(Path.Combine(outDir, \"Heap\"+ImpBasmExtn));\r\n heapIWriter = new StreamWriter(Path.Combine(outDir, \"Heap\"+IfcBasmExtn));\r\n checkedWriter = new StreamWriter(Path.Combine(outDir, \"Checked\"+ImpBasmExtn));\r\n checkedIWriter = new StreamWriter(Path.Combine(outDir, \"Checked\"+IfcBasmExtn));\r\n\r\n List checkedImports = new List { \"Trusted\" };\r\n checkedIWriter.WriteLine(\"module interface Checked\");\r\n WriteInterfaceImports(checkedIWriter, GatherAllImports(checkedImports));\r\n checkedIWriter.WriteLine(\"{\");\r\n checkedIWriter.WriteLine(\"type ArrayOfInt = ArrayOfInt(arrCount:int, arrAbs:int);\");\r\n WriteImplementationHeader(checkedWriter, \"Checked\", new List() { \"Trusted\" });\r\n\r\n List heapImports = new List { \"Trusted\", \"Checked\" };\r\n heapIWriter.WriteLine(\"module interface Heap\");\r\n WriteInterfaceImports(heapIWriter, GatherAllImports(heapImports));\r\n addAxioms(heapWriter, axioms);\r\n heapIWriter.WriteLine(\"{\");\r\n WriteImplementationHeader(heapWriter, \"Heap\", heapImports);\r\n\r\n List seqImports = new List { \"Trusted\", \"Checked\", \"Heap\" };\r\n seqWriter = new StreamWriter(Path.Combine(outDir, \"Seq\"+ImpBasmExtn));\r\n seqIWriter = new StreamWriter(Path.Combine(outDir, \"Seq\"+IfcBasmExtn));\r\n seqIWriter.WriteLine(\"module interface Seq\");\r\n WriteInterfaceImports(seqIWriter, GatherAllImports(seqImports));\r\n seqIWriter.WriteLine(\"{\");\r\n addAxioms(seqWriter, axioms);\r\n WriteImplementationHeader(seqWriter, \"Seq\", seqImports);\r\n\r\n return allModules;\r\n }\r\n\r\n public void CompileCodeEnd(DafnyCC_Options options)\r\n {\r\n checkedIWriter.WriteLine(\"}\");\r\n checkedWriter.WriteLine(\"}\");\r\n checkedIWriter.Close();\r\n checkedWriter.Close();\r\n\r\n heapIWriter.WriteLine(\"}\");\r\n heapWriter.WriteLine(\"}\");\r\n\r\n seqIWriter.WriteLine(\"}\");\r\n seqWriter.WriteLine(\"}\");\r\n seqIWriter.Close();\r\n seqWriter.Close();\r\n\r\n if (outDir == null)\r\n {\r\n mainWriter.WriteLine(\"}\");\r\n }\r\n\r\n heapWriter.Close();\r\n heapIWriter.Close();\r\n\r\n CompileSpecEnd();\r\n }\r\n\r\n public void CompileCode(DafnyCC_Options options, IList files)\r\n {\r\n Dictionary allModules = CompileCodeStart(options, files);\r\n\r\n Program program;\r\n string errors = Microsoft.Dafny.Main.ParseCheck(\r\n allModules.Values.ToList(),\r\n \"DAFNYCC_PROGRAM\",\r\n out program);\r\n if (errors != null)\r\n {\r\n throw new Exception(errors);\r\n }\r\n Util.DebugWriteLine(program);\r\n DeclareProgram(program);\r\n CompileProgram(program);\r\n CompileDatatypes();\r\n\r\n CompileCodeEnd(options);\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/tools/DafnyCC/DafnyCC.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {5EADF212-4CF1-4883-8F35-019F9550BA0A}\r\n Exe\r\n Properties\r\n DafnyCC\r\n dafnycc\r\n v4.5\r\n 512\r\n publish\\\r\n true\r\n Disk\r\n false\r\n Foreground\r\n 7\r\n Days\r\n false\r\n false\r\n true\r\n 0\r\n 1.0.0.%2a\r\n false\r\n false\r\n true\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n DafnyCC\r\n \r\n \r\n \r\n False\r\n ..\\Dafny\\Basetypes.dll\r\n \r\n \r\n False\r\n ..\\Dafny\\Core.dll\r\n \r\n \r\n False\r\n ..\\Dafny\\DafnyPipeline.dll\r\n \r\n \r\n False\r\n ..\\Dafny\\ParserHelper.dll\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n False\r\n Microsoft .NET Framework 4.5 %28x86 and x64%29\r\n true\r\n \r\n \r\n False\r\n .NET Framework 3.5 SP1 Client Profile\r\n false\r\n \r\n \r\n False\r\n .NET Framework 3.5 SP1\r\n false\r\n \r\n \r\n \r\n \r\n CodeContractsExtender.dll\r\n Always\r\n \r\n \r\n Provers.SMTLib.dll\r\n Always\r\n \r\n \r\n VCGeneration.dll\r\n Always\r\n \r\n \r\n z3.exe\r\n Always\r\n \r\n \r\n DafnyPrelude.dfy\r\n Always\r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/tools/DafnyCC/DafnyCC.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 12.00\r\n# Visual Studio 2013\r\nVisualStudioVersion = 12.0.30501.0\r\nMinimumVisualStudioVersion = 10.0.40219.1\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"DafnyCC\", \"DafnyCC.csproj\", \"{5EADF212-4CF1-4883-8F35-019F9550BA0A}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Any CPU = Debug|Any CPU\r\n\t\tRelease|Any CPU = Release|Any CPU\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{5EADF212-4CF1-4883-8F35-019F9550BA0A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{5EADF212-4CF1-4883-8F35-019F9550BA0A}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{5EADF212-4CF1-4883-8F35-019F9550BA0A}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{5EADF212-4CF1-4883-8F35-019F9550BA0A}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "ironclad-apps/tools/DafnyCC/Makefile", "content": "#\r\n# Copyright (c) 2007 Microsoft Corporation. All rights reserved.\r\n#\r\n\r\nMSBUILD=C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\r\n\r\nBIN = ..\\..\\bin_tools\\dafnycc\r\nSRC = .\r\nSPC = ..\\DafnySpec\r\n\r\nDAFNYCC_SOURCES = \\\r\n\t$(SPC)\\Util.cs \\\r\n\t$(SPC)\\RtlGhost.cs \\\r\n\t$(SRC)\\Rtl.cs \\\r\n\t$(SRC)\\Analyze.cs \\\r\n\t$(SRC)\\RegAlloc.cs \\\r\n\t$(SPC)\\Compile.cs \\\r\n\t$(SPC)\\CompileField.cs \\\r\n\t$(SPC)\\CompileFunction.cs \\\r\n\t$(SPC)\\CompileMethodGhost.cs \\\r\n\t$(SRC)\\CompileMethod.cs \\\r\n\t$(SPC)\\DafnySpec.cs \\\r\n\t$(SRC)\\DafnyCC.cs \\\r\n\r\nall: dafnycc \r\n\r\ndafnycc: $(BIN) $(BIN)\\dafnycc.exe\r\n\r\n$(BIN):\r\n\tmd $(BIN)\r\n\r\n$(BIN)\\dafnycc.exe: $(DAFNYCC_SOURCES) DafnyCC.sln\r\n\t$(MSBUILD) DafnyCC.sln\r\n\r\n" }, { "path": "ironclad-apps/tools/DafnyCC/RegAlloc.cs", "content": "using System;\r\nusing System.Linq;\r\nusing System.Collections.Generic;\r\nusing System.Collections.ObjectModel;\r\nusing Microsoft.Dafny;\r\nusing Bpl = Microsoft.Boogie;\r\nusing System.Numerics;\r\nusing Type = Microsoft.Dafny.Type;\r\n\r\n\r\npublic class RegAlloc : Analyze\r\n{\r\n public const int stackGcOffset = 0x111000; \r\n\r\n DafnySpec dafnySpec;\r\n internal CompileMethod compileMethod;\r\n public readonly List regs;\r\n public readonly List initAssign;\r\n public readonly List retAssign;\r\n public readonly Dictionary inInts = new Dictionary();\r\n public readonly Dictionary inPtrs = new Dictionary();\r\n public readonly Dictionary outInts = new Dictionary();\r\n public readonly Dictionary outPtrs = new Dictionary();\r\n public readonly Dictionary spillInts = new Dictionary();\r\n public readonly Dictionary spillPtrs = new Dictionary();\r\n public readonly Dictionary varTypes = new Dictionary();\r\n public int callIntArgs = 0;\r\n public int callPtrArgs = 0;\r\n public int callIntRets = 0;\r\n public int callPtrRets = 0;\r\n \r\n List> assigned; \r\n\r\n public int IPSize;\r\n public int IPWords;\r\n\r\n \r\n public RegAlloc(\r\n DafnySpec dafnySpec,\r\n CompileMethod compileMethod,\r\n List inVars,\r\n List outVars,\r\n List inIntList,\r\n List outIntList,\r\n List inPtrList,\r\n List outPtrList,\r\n Dictionary allVars,\r\n List stmts):\r\n base(inVars, outVars, stmts)\r\n {\r\n this.dafnySpec = dafnySpec;\r\n this.compileMethod = compileMethod;\r\n \r\n IPSize = ((DafnyCC)dafnySpec).IPSize; \r\n IPWords = IPSize/4;\r\n\r\n if (compileMethod.dafnycc.useFramePointer)\r\n {\r\n regs = new List(new string[] { \"EAX\", \"ECX\", \"EDX\", \"EBX\", \"ESI\", \"EDI\" });\r\n }\r\n else\r\n {\r\n regs = new List(new string[] { \"EAX\", \"ECX\", \"EDX\", \"EBX\", \"ESI\", \"EDI\", \"EBP\" });\r\n }\r\n initAssign = new List(new string[regs.Count]);\r\n retAssign = new List(new string[regs.Count]);\r\n for (int i = 0; i < inIntList.Count; i++)\r\n {\r\n inInts.Add(compileMethod.GhostVar(inIntList[i].Name), 4 * i);\r\n }\r\n for (int i = 0; i < outIntList.Count; i++)\r\n {\r\n outInts.Add(compileMethod.GhostVar(outIntList[i].Name), 4 * i);\r\n }\r\n for (int i = 0; i < inPtrList.Count; i++)\r\n {\r\n string x = compileMethod.GhostVar(inPtrList[i].Name);\r\n inPtrs.Add(x, 4 * i);\r\n }\r\n for (int i = 0; i < outPtrList.Count; i++)\r\n {\r\n string x = compileMethod.GhostVar(outPtrList[i].Name);\r\n outPtrs.Add(x, 4 * i);\r\n }\r\n allVars.ToList().ForEach(p => varTypes.Add(p.Key, p.Value.type));\r\n /* for now, just use the stack for simplicity\r\n if (inVars.Count >= 1)\r\n {\r\n initAssign[regs.IndexOf(\"ECX\")] = inVars[0];\r\n }\r\n if (inVars.Count >= 2)\r\n {\r\n initAssign[regs.IndexOf(\"EDX\")] = inVars[1];\r\n }\r\n if (inVars.Count >= 3)\r\n {\r\n initAssign[regs.IndexOf(\"EBX\")] = inVars[2];\r\n }\r\n if (inVars.Count >= 4)\r\n {\r\n throw new Exception(\"not implemented: more than two arguments\");\r\n }\r\n if (outVars.Count >= 1)\r\n {\r\n retAssign[regs.IndexOf(\"EAX\")] = outVars[0];\r\n }\r\n if (outVars.Count >= 2)\r\n {\r\n retAssign[regs.IndexOf(\"ESI\")] = outVars[1];\r\n }\r\n if (outVars.Count >= 3)\r\n {\r\n throw new Exception(\"not implemented: more than two return values\");\r\n }\r\n */\r\n \r\n \r\n \r\n \r\n }\r\n\r\n public static string Reg(string s)\r\n {\r\n return \"r.regs[\" + s + \"]\";\r\n }\r\n\r\n public string TypeString(Type t)\r\n {\r\n return dafnySpec.TypeString(t);\r\n }\r\n\r\n public bool IsPtr(string x)\r\n {\r\n return CompileMethod.IsPtrType(varTypes[x]);\r\n }\r\n\r\n public bool IsArray(string x)\r\n {\r\n return DafnySpec.IsArrayType(varTypes[x]);\r\n }\r\n\r\n public int ArgsRetsCount() { return Math.Max(callIntArgs + callIntRets, callPtrArgs + callPtrRets); }\r\n public int LocalsCount() { return Math.Max(spillInts.Count, spillPtrs.Count); }\r\n public int InsOutsCount() { return Math.Max(inInts.Count + outInts.Count, inPtrs.Count + outPtrs.Count); }\r\n\r\n \r\n public int FrameCount()\r\n {\r\n return ArgsRetsCount() + LocalsCount();\r\n }\r\n\r\n \r\n public int FrameVisibleCount()\r\n {\r\n return ArgsRetsCount() + LocalsCount() + IPWords + InsOutsCount() + compileMethod.dafnycc.framePointerCount;\r\n }\r\n\r\n public int LocalsOffset() { return ArgsRetsCount() * 4; }\r\n public int OutsOffset() { return LocalsOffset() + 4 * LocalsCount() + /*return address*/ IPSize + 4 * compileMethod.dafnycc.framePointerCount; }\r\n public int InIntsOffset() { return OutsOffset() + 4 * outInts.Count; }\r\n public int InPtrsOffset() { return OutsOffset() + 4 * outPtrs.Count; }\r\n\r\n private string StackOMem(int offset) { return \"OMem(MReg(ESP, \" + offset + \"))\"; }\r\n private string StackOMemPtr(int offset) { return StackOMem(offset + stackGcOffset); }\r\n\r\n private RtlExp Spill(string x)\r\n {\r\n Func offset;\r\n var isPtr = IsPtr(x);\r\n if (inInts.ContainsKey(x)) { offset = () => InIntsOffset() + inInts[x]; }\r\n else if (outInts.ContainsKey(x)) { offset = () => OutsOffset() + outInts[x]; }\r\n else if (inPtrs.ContainsKey(x)) { offset = () => InPtrsOffset() + inPtrs[x]; }\r\n else if (outPtrs.ContainsKey(x)) { offset = () => OutsOffset() + outPtrs[x]; }\r\n else\r\n {\r\n Util.DebugWriteLine(\" *** SPILL: \" + x);\r\n var spilled = isPtr ? spillPtrs : spillInts;\r\n if (!spilled.ContainsKey(x))\r\n {\r\n spilled.Add(x, spilled.Count * 4);\r\n }\r\n offset = () => LocalsOffset() + spilled[x];\r\n }\r\n return new RtlExpComputed(e => isPtr ? StackOMemPtr(offset()) : StackOMem(offset()));\r\n }\r\n\r\n static int debugTag = 0;\r\n public List Alloc()\r\n {\r\n assigned = new List>(new List[stmts.Count]);\r\n Func slotMem = offset => \"stk.map[r.regs[ESP] + \" + offset + \"]\";\r\n Func spillLoc = e => \"EvalPtr(r, \" + e.AsOperand() + \")\";\r\n Func spillMem = e => \"stk.map[\" + spillLoc(e) + \"]\";\r\n Stack workList = new Stack();\r\n\r\n List newStmts = new List();\r\n Action move = (string dest, string src) =>\r\n {\r\n if (dest != src)\r\n {\r\n newStmts.Add(new RtlInst(\"instr_Mov\", new RtlVar[] { new RtlVar(dest, false) },\r\n new RtlVar[0], new RtlExp[] { new RtlVar(src, false) }, false)\r\n .WithComment(\"regalloc_move:: \" + dest + \" := \" + src));\r\n }\r\n };\r\n Action sLoad = (string dest, RtlExp src, string var) =>\r\n {\r\n int dbgTag = debugTag++;\r\n Util.DebugWriteLine(\"sLoad: dest = \" + dest + \" \" + dbgTag);\r\n newStmts.Add(new RtlStmtComputed((inst =>\r\n {\r\n var eDst = inst.args[0].e;\r\n string opPtr = inst.args[1].e.AsOperand();\r\n string ptr = \"EvalPtr(r, \" + opPtr + \")\";\r\n return IsPtr(var)\r\n ? \"call r, mems := heapLoadStack(r, core_state, stk, statics, io, mems, \"\r\n + \"$commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, \"\r\n + eDst + \", \" + opPtr + \", \" + ptr + \");\"\r\n + Environment.NewLine\r\n + \" \" + var + \"__abs := frameGet($stacksFrames, \" + ptr + \");\"\r\n : \"call r := logical_Load(r, core_state, stk, \" + eDst + \", \" + opPtr + \");\";\r\n }),\r\n new RtlArg[] { new RtlArg(true, false, new RtlVar(dest, false)),\r\n new RtlArg(true, false, src) }, false)\r\n .WithComment(() => \"regalloc_stack_load:: \" + dest + \" := \" + src + \" // var = \" + var + \" \" + dbgTag));\r\n };\r\n Action sStore = (RtlExp dest, string src, string var) =>\r\n {\r\n newStmts.Add(new RtlStmtComputed((inst =>\r\n {\r\n string opPtr = inst.args[0].e.AsOperand();\r\n string opVal = inst.args[1].e.AsOperand();\r\n string ptr = \"EvalPtr(r, \" + opPtr + \")\";\r\n string val = \"Eval(r, \" + opVal + \")\";\r\n return IsPtr(var)\r\n ? \"call mems, $stacksFrames := \"\r\n + \"heapStoreStack(r, core_state, stk, statics, io, mems, \"\r\n + \"$commonVars, $gcVars, $absMem, $toAbs, $stacksFrames, objLayouts, \"\r\n + opPtr + \", \" + opVal + \", \" + ptr + \", \" + var + \"__abs);\"\r\n : \"call stk := logical_Store(r, core_state, stk, \" + opPtr + \", \" + opVal + \");\";\r\n }),\r\n new RtlArg[] { new RtlArg(true, false, dest),\r\n new RtlArg(true, false, new RtlVar(src, false)) }, false)\r\n .WithComment(() => \"regalloc_stack_store:: \" + dest + \" := \" + src + \" // var = \" + var));\r\n };\r\n\r\n workList.Push(0);\r\n while (workList.Count > 0)\r\n {\r\n int i = workList.Pop();\r\n RtlStmt stmt = stmts[i];\r\n stmt.Uses().ForEach(x =>\r\n preds[i].ForEach(p =>\r\n { if (!defVars[p].Contains(x)) throw new Exception(\r\n \"variable \" + x + \" is used before it is assigned\"); }));\r\n Util.DebugWriteLine(i + \": \" + stmt);\r\n List vars = stmt.Vars();\r\n List assignment = new List((i == 0) ? initAssign :\r\n preds[i].ConvertAll(p => assigned[p]).Find(a => a != null));\r\n Util.DebugWriteLine(\" \" + String.Join(\", \", assignment));\r\n RtlInst inst = stmt as RtlInst;\r\n List> pinVars = (inst == null) ? new List>() :\r\n inst.args.Where(arg => arg.pinReg != null && arg.e is RtlVar)\r\n .Select(arg => Tuple.Create(((RtlVar)arg.e).x, arg.pinReg)).ToList();\r\n for (int r = 0; r < regs.Count; r++)\r\n {\r\n \r\n string rx = assignment[r];\r\n if (rx != null && !liveVars[i].ContainsKey(rx))\r\n {\r\n assignment[r] = null;\r\n }\r\n \r\n if (pinVars.Exists(p => p.Item1 == rx))\r\n {\r\n assignment[r] = null;\r\n }\r\n \r\n foreach (var p in pinVars)\r\n {\r\n if (p.Item2 == regs[r])\r\n {\r\n assignment[r] = p.Item1;\r\n }\r\n }\r\n }\r\n if (stmt is RtlCall)\r\n {\r\n RtlCall call = (RtlCall)stmt;\r\n if (!call.ghost)\r\n {\r\n for (int r = 0; r < regs.Count; r++)\r\n {\r\n \r\n assignment[r] = null;\r\n }\r\n /*\r\n Func shouldSkip = (RtlExp e) => ((e is RtlVar) && ((RtlVar)e).isGhost);\r\n int[] outsToReg = new int[2] { regs.IndexOf(\"EAX\"), regs.IndexOf(\"ESI\") };\r\n int[] argsToReg = new int[3] { regs.IndexOf(\"ECX\"), regs.IndexOf(\"EDX\"), regs.IndexOf(\"EBX\") };\r\n \r\n for (int r = 0; r < regs.Count; r++)\r\n {\r\n string rx = assignment[r];\r\n if (rx != null && (call.outs.Where(v => v.ToString() == rx).Count() != 0 || call.args.Where(v => v.ToString() == rx).Count() != 0))\r\n {\r\n assignment[r] = null;\r\n }\r\n }\r\n for (int idx = 0; idx < 2; idx++)\r\n {\r\n if (call.outs.Count >= idx + 1 && !shouldSkip(call.outs[idx]))\r\n {\r\n int r = outsToReg[idx];\r\n string rx = assignment[r];\r\n if (rx != null)\r\n {\r\n sStore(Spill(rx), regs[r]);\r\n }\r\n assignment[r] = call.outs[idx].ToString();\r\n }\r\n }\r\n for (int idx = 0; idx < 3; idx++)\r\n {\r\n if (call.args.Count >= idx + 1 && !shouldSkip(call.args[idx]))\r\n {\r\n int r = argsToReg[idx];\r\n string rx = assignment[r];\r\n if (rx != null)\r\n {\r\n sStore(Spill(rx), regs[r]);\r\n }\r\n assignment[r] = call.args[idx].ToString();\r\n }\r\n }\r\n */\r\n }\r\n }\r\n else if (stmt is RtlReturn)\r\n {\r\n for (int r = 0; r < regs.Count; r++)\r\n {\r\n \r\n assignment[r] = null;\r\n }\r\n }\r\n else if (inst == null || !inst.ghost)\r\n {\r\n foreach (string x in vars)\r\n {\r\n Tuple bestEvict = null; \r\n for (int r = 0; r < regs.Count; r++)\r\n {\r\n var rx = assignment[r];\r\n if (rx == x)\r\n {\r\n goto done;\r\n }\r\n if (!vars.Contains(rx))\r\n {\r\n int thisEvict = (rx == null) ? Int32.MaxValue : liveVars[i][rx];\r\n if (bestEvict == null || thisEvict > bestEvict.Item2)\r\n {\r\n \r\n bestEvict = Tuple.Create(r, thisEvict);\r\n }\r\n }\r\n }\r\n string ex = assignment[bestEvict.Item1];\r\n if (ex != null)\r\n {\r\n Spill(ex);\r\n }\r\n assignment[bestEvict.Item1] = x;\r\n done: {}\r\n }\r\n }\r\n Util.DebugWriteLine(\" vars = \" + String.Join(\", \", vars));\r\n Util.DebugWriteLine(\" preds = \" + String.Join(\", \", preds[i]));\r\n Util.DebugWriteLine(\" succs = \" + String.Join(\", \", succs[i]));\r\n Util.DebugWriteLine(\" live = \" + String.Join(\", \", liveVars[i].Keys.Select(x => Tuple.Create(x, liveVars[i][x]))));\r\n Util.DebugWriteLine(\" assign: \" + String.Join(\", \", assignment));\r\n assigned[i] = assignment;\r\n succs[i].Where(s => assigned[s] == null).ToList().ForEach(workList.Push);\r\n }\r\n for (int i = 0; i < stmts.Count; i++)\r\n {\r\n \r\n RtlJump jump = stmts[i] as RtlJump;\r\n if (jump != null && jump.cond != null)\r\n {\r\n List assignment1 = assigned[i];\r\n List assignment2 = assigned[labels[jump.label]];\r\n List condVars = jump.cond.Vars();\r\n for (int r = 0; r < regs.Count; r++)\r\n {\r\n string x1 = assignment1[r];\r\n string x2 = assignment2[r];\r\n if (x1 != null && x2 != null && condVars.Contains(x1) && x1 != x2)\r\n {\r\n assignment2[r] = null; \r\n Spill(x2);\r\n }\r\n }\r\n }\r\n }\r\n\r\n Action, Dictionary, Dictionary, Dictionary> transition =\r\n (List assignment2, Dictionary live, Dictionary liveAlt, Dictionary varToReg) =>\r\n {\r\n \r\n \r\n \r\n Util.DebugWriteLine(\"start transition\");\r\n \r\n \r\n varToReg.Keys.Where(x => x != null && !live.ContainsKey(x) && !liveAlt.ContainsKey(x)).ToList()\r\n .ForEach(x => varToReg.Remove(x));\r\n \r\n bool done;\r\n do\r\n {\r\n done = true;\r\n for (int rx = 0; rx < regs.Count; rx++)\r\n {\r\n string x = assignment2[rx];\r\n string reg = regs[rx];\r\n if (x != null && varToReg.ContainsKey(x) && varToReg[x] != reg\r\n && !varToReg.ContainsValue(reg))\r\n {\r\n Util.DebugWriteLine(\"move \" + x + \": \" + regs[rx] + \" <- \" + varToReg[x]);\r\n move(regs[rx], varToReg[x]);\r\n varToReg[x] = reg;\r\n done = false;\r\n }\r\n }\r\n } while (!done);\r\n \r\n List toSpill = new List();\r\n foreach (var current in varToReg)\r\n {\r\n string x = current.Key;\r\n int rx = regs.IndexOf(current.Value);\r\n Util.DebugWriteLine(\"current = \" + x + \" -> \" + regs[rx]);\r\n Util.DebugWriteLine(\"assign = \" + assignment2[rx] + \" -> \" + regs[rx]);\r\n if (assignment2[rx] != x && (live.ContainsKey(x) || liveAlt.ContainsKey(x)))\r\n {\r\n Util.DebugWriteLine(\"spilling \" + x + \" from \" + regs[rx]);\r\n toSpill.Add(x);\r\n sStore(Spill(x), regs[rx], x);\r\n }\r\n }\r\n toSpill.ForEach(x => varToReg.Remove(x));\r\n Util.DebugWriteLine(\"live = \" + String.Join(\", \", live));\r\n \r\n for (int rx = 0; rx < regs.Count; rx++)\r\n {\r\n string x = assignment2[rx];\r\n if (x != null && live.ContainsKey(x))\r\n {\r\n Util.DebugWriteLine(\"assign = \" + x + \" -> \" + regs[rx]);\r\n if (varToReg.ContainsKey(x))\r\n {\r\n Util.Assert(varToReg[x] == regs[rx]);\r\n }\r\n else\r\n {\r\n Util.DebugWriteLine(\"loading \" + x + \" to \" + regs[rx]);\r\n sLoad(regs[rx], Spill(x), x);\r\n Util.DebugWriteLine(\"loaded \" + x + \" to \" + regs[rx]);\r\n varToReg.Add(x, regs[rx]);\r\n }\r\n }\r\n }\r\n };\r\n\r\n Util.DebugWriteLine(\"spilled: \" + String.Join(\", \", spillInts.Keys));\r\n\r\n Action DebugWriteLine = s =>\r\n {\r\n \r\n };\r\n\r\n if (stmts.Count > 0)\r\n {\r\n transition(assigned[0], liveVars[0], liveVars[0], new Dictionary());\r\n }\r\n for (int i = 0; i < stmts.Count; i++)\r\n {\r\n \r\n \r\n \r\n List assignment = assigned[i];\r\n RtlStmt stmt = stmts[i];\r\n List vars = stmt.Vars();\r\n List uses = stmt.Uses();\r\n Dictionary varToReg = new Dictionary();\r\n Util.DebugWriteLine(i + \": \" + stmt);\r\n Util.DebugWriteLine(\" assignment: \" + String.Join(\", \", assignment));\r\n Util.DebugWriteLine(\" vars:\" + String.Join(\", \", vars));\r\n Util.DebugWriteLine(\" uses:\" + String.Join(\", \", uses));\r\n DebugWriteLine(i + \": \" + stmt.GetType() + \": \" + stmt);\r\n DebugWriteLine(\" vars = \" + String.Join(\", \", vars));\r\n DebugWriteLine(\" uses = \" + String.Join(\", \", uses));\r\n DebugWriteLine(\" preds = \" + String.Join(\", \", preds[i]));\r\n DebugWriteLine(\" succs = \" + String.Join(\", \", succs[i]));\r\n DebugWriteLine(\" live = \" + String.Join(\", \", liveVars[i].Keys.Select(x => Tuple.Create(x, liveVars[i][x]))));\r\n DebugWriteLine(\" defs = \" + String.Join(\", \", defVars[i]));\r\n DebugWriteLine(\" assign: \" + String.Join(\", \", assignment));\r\n Action transitionTarget = (int target, int altTarget) =>\r\n {\r\n Util.DebugWriteLine(\"transition from \" + i + \" to \" + target);\r\n transition(assigned[target], liveVars[target], liveVars[altTarget], varToReg);\r\n };\r\n \r\n \r\n int r;\r\n for (r = 0; r < regs.Count; r++)\r\n {\r\n string x = assignment[r];\r\n if (x != null)\r\n {\r\n varToReg.Add(x, regs[r]);\r\n }\r\n }\r\n r = 0;\r\n foreach (string x in vars)\r\n {\r\n if (varToReg.ContainsKey(x) || stmt is RtlReturn)\r\n {\r\n continue;\r\n }\r\n int rx = assignment.IndexOf(x);\r\n if (rx < 0)\r\n {\r\n rx = assignment.IndexOf(null, r);\r\n Util.Assert(rx >= 0);\r\n Util.DebugWriteLine(i + \": MOVE(1): \" + x);\r\n sLoad(regs[rx], Spill(x), x);\r\n r = rx + 1;\r\n }\r\n varToReg.Add(x, regs[rx]);\r\n }\r\n \r\n Util.DebugWriteLine(\"vars = \" + String.Join(\", \", vars));\r\n List defs = stmt.Defs();\r\n stmt = stmt.Subst(varToReg);\r\n Dictionary regToVar = new Dictionary();\r\n varToReg.ToList().ForEach(p => regToVar.Add(p.Value, p.Key));\r\n RtlJump jump = stmt as RtlJump;\r\n RtlReturn ret = stmt as RtlReturn;\r\n RtlLabel label = stmt as RtlLabel;\r\n RtlCall call = stmt as RtlCall;\r\n RtlCallInOut inOut = stmt as RtlCallInOut;\r\n if (ret != null)\r\n {\r\n Util.DebugWriteLine(\"RETURN: \" + outVars.Count);\r\n \r\n \r\n for (int rr = 0; rr < regs.Count; rr++)\r\n {\r\n string rx = assignment[rr];\r\n if (rx != null)\r\n {\r\n newStmts.Add(new RtlComment(\"spill variable \" + rx + \" from register \" + regs[rr]));\r\n sStore(Spill(rx), regs[rr], rx);\r\n }\r\n }\r\n }\r\n if (jump == null)\r\n {\r\n List spilledArgs = new List();\r\n \r\n if (inOut != null)\r\n {\r\n string reg = ((RtlVar)(inOut.args[0].e)).getName();\r\n string var = regToVar[reg];\r\n bool isPtr = IsPtr(var);\r\n int offset = 4 * inOut.index;\r\n RtlExp slot = new RtlExpComputed(e => isPtr ? StackOMemPtr(offset) : StackOMem(offset));\r\n newStmts.Add(new RtlComment(inOut.comment));\r\n if (inOut.isRet)\r\n {\r\n if (isPtr)\r\n {\r\n callPtrRets = Math.Max(callPtrRets, inOut.index + 1);\r\n }\r\n else\r\n {\r\n callIntRets = Math.Max(callIntRets, inOut.index + 1);\r\n \r\n newStmts.Add(new RtlInst(null,\r\n new RtlVar[] {new RtlVar(var, true)}, new RtlVar[0],\r\n new RtlExp[] {new RtlLiteral(\r\n CompileMethod.IntToTyped(varTypes[var], slotMem(offset)))},\r\n true));\r\n }\r\n Util.DebugWriteLine(\" var = \" + var + \" live = \" + String.Join(\",\", liveVars[i].Keys) + \" live' = \" + String.Join(\",\", liveVars[i + 1].Keys));\r\n if (i + 1 >= liveVars.Count || liveVars[i + 1].ContainsKey(var))\r\n {\r\n Util.DebugWriteLine(\"sLoad inOut: \" + reg + \" \" + slot + \" \" + var);\r\n sLoad(reg, slot, var);\r\n }\r\n }\r\n else\r\n {\r\n if (isPtr)\r\n {\r\n callPtrArgs = Math.Max(callPtrArgs, inOut.index + 1);\r\n }\r\n else\r\n {\r\n callIntArgs = Math.Max(callIntArgs, inOut.index + 1);\r\n }\r\n sStore(slot, reg, var);\r\n }\r\n }\r\n else\r\n {\r\n newStmts.Add(stmt);\r\n \r\n defs.Where(x => !IsPtr(x)).ToList()\r\n .ForEach(x => newStmts.Add(new RtlInst(null,\r\n new RtlVar[] {new RtlVar(x, true)}, new RtlVar[0],\r\n new RtlExp[] {new RtlLiteral(\r\n CompileBase.IntToTyped(varTypes[x], Reg(varToReg[x])))},\r\n true)));\r\n }\r\n \r\n Util.DebugWriteLine(\"sLoad spilled: \" + String.Join(\", \", spilledArgs.Select(arg => \"(\" + varToReg[arg] + \" <- \" + arg + \")\")));\r\n spilledArgs.ForEach(arg => sLoad(varToReg[arg], Spill(arg), arg));\r\n }\r\n if (label != null && label.loop)\r\n {\r\n List typeInvs = new List();\r\n newStmts.Add(new RtlComment(\"loop invariants\"));\r\n foreach (string x in liveVars[i].Keys)\r\n {\r\n if (defVars[i].Contains(x))\r\n {\r\n compileMethod.AddTypeWellFormed(typeInvs, x, false, varTypes[x]);\r\n string save_x = x;\r\n RtlExp loc = varToReg.ContainsKey(x) ? new RtlVar(Reg(varToReg[x]), false)\r\n : (RtlExp)new RtlExpComputed(e => spillMem(Spill(save_x)));\r\n if (IsPtr(x))\r\n {\r\n string absData = \"Abs_\" + TypeString(varTypes[x]) + \"(\" + x + \")\";\r\n if (varToReg.ContainsKey(x))\r\n {\r\n newStmts.Add(new RtlAssert(new RtlLiteral(\r\n \"HeapAbsData(heap, \" + x + \"__abs) == \" + absData), true));\r\n newStmts.Add(new RtlAssert(new RtlExpComputed(e =>\r\n \"HeapValue(objLayouts, true, $toAbs, \" + loc + \", \" + save_x + \"__abs)\"), true));\r\n if (IsArray(x))\r\n {\r\n newStmts.Add(new RtlAssert(new RtlLiteral(\r\n x + \"__abs == \" + x + \".arrAbs\"), true));\r\n }\r\n }\r\n else\r\n {\r\n newStmts.Add(new RtlAssert(new RtlExpComputed(e =>\r\n \"StackAbsSlot(heap, $stacksFrames, \" + spillLoc(Spill(save_x)) + \") == \" + absData), true));\r\n if (IsArray(x))\r\n {\r\n newStmts.Add(new RtlAssert(new RtlExpComputed(e =>\r\n \"frameGet($stacksFrames, \" + spillLoc(Spill(save_x)) + \") == \" + save_x + \".arrAbs\"), true));\r\n }\r\n }\r\n }\r\n else\r\n {\r\n newStmts.Add(new RtlAssert(CompileMethod.IntEqTyped(varTypes[x],\r\n new RtlVar(x, false),\r\n new RtlExpComputed(e => loc.ToString())), true));\r\n }\r\n }\r\n }\r\n typeInvs.ForEach(e => newStmts.Add(new RtlAssert(e, true)));\r\n }\r\n \r\n bool fallThru = (ret == null && i + 1 < stmts.Count && (jump == null || jump.cond != null));\r\n if (jump != null)\r\n {\r\n \r\n \r\n \r\n transitionTarget(labels[jump.label], fallThru ? (i + 1) : labels[jump.label]);\r\n newStmts.Add(stmt);\r\n }\r\n if (fallThru)\r\n {\r\n transitionTarget(i + 1, i + 1);\r\n }\r\n }\r\n return newStmts;\r\n }\r\n\r\n public Dictionary MakeMap(List assignment)\r\n {\r\n Dictionary map = new Dictionary();\r\n for (int i = 0; i < regs.Count; i++)\r\n {\r\n if (assignment[i] != null)\r\n {\r\n map.Add(assignment[i], regs[i]);\r\n }\r\n }\r\n return map;\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/DafnyCC/Rtl.cs", "content": "using System;\r\nusing System.Linq;\r\nusing System.Collections.Generic;\r\nusing System.Collections.ObjectModel;\r\nusing Microsoft.Dafny;\r\nusing Bpl = Microsoft.Boogie;\r\nusing System.Numerics;\r\n\r\npublic class RtlMem: RtlExp\r\n{\r\n public readonly RtlExp ptr;\r\n public readonly RtlExp scale; \r\n public readonly RtlExp index; \r\n public readonly RtlExp offset; \r\n\r\n public RtlMem(RtlExp ptr, string offset):this(ptr, new RtlLiteral(offset)) { }\r\n public RtlMem(RtlExp ptr, RtlExp offset):this(ptr, null, null, offset) { }\r\n\r\n public RtlMem(RtlExp ptr, RtlExp scale, RtlExp index, RtlExp offset)\r\n {\r\n if (index is RtlInt)\r\n {\r\n Util.Assert(scale is RtlInt && offset is RtlInt);\r\n offset = new RtlInt(((RtlInt)offset).i + ((RtlInt)scale).i * ((RtlInt)index).i);\r\n scale = null;\r\n index = null;\r\n }\r\n this.ptr = ptr;\r\n this.scale = scale;\r\n this.index = index;\r\n this.offset = offset;\r\n }\r\n\r\n public override void AddVars(List vars)\r\n {\r\n ptr.AddVars(vars);\r\n if (index != null)\r\n {\r\n index.AddVars(vars);\r\n }\r\n }\r\n\r\n public override RtlExp Subst(Dictionary map)\r\n {\r\n return new RtlMem(ptr.Subst(map), scale, (index == null) ? null : index.Subst(map), offset);\r\n }\r\n\r\n public override string ToString() { return \"INVALID_BOOGIE_CODE+RtlMem\"; }\r\n\r\n public override string AsOperand()\r\n {\r\n return (index == null)\r\n ? \"OMem(MReg(\" + ptr + \", \" + offset + \"))\"\r\n : (index is RtlInt)\r\n ? \"OMem(MReg(\" + ptr + \", \" + scale + \" * \" + index + \" + \" + offset + \"))\"\r\n : \"OMem(MIndex(\" + ptr + \", \" + scale + \", \" + index + \", \" + offset + \"))\";\r\n }\r\n}\r\n\r\npublic class RtlLoopStart: RtlStmt\r\n{\r\n public RtlLoopStart() {}\r\n public override string ToString() { return \"\"; }\r\n}\r\n\r\n\r\npublic class RtlStmtGroup: RtlStmt\r\n{\r\n public readonly ReadOnlyCollection stmts;\r\n\r\n public RtlStmtGroup(IEnumerable stmts)\r\n {\r\n this.stmts = stmts.ToList().AsReadOnly();\r\n comment = () => String.Join(Environment.NewLine + \"// \", stmts.Select(s => s.comment == null ? \"\" : s.comment()));\r\n }\r\n\r\n public override RtlStmt Subst(Dictionary map)\r\n {\r\n return new RtlStmtGroup(stmts.Select(s => s.Subst(map)));\r\n }\r\n public override void AddDefs(List vars)\r\n {\r\n stmts.ToList().ForEach(s => s.AddDefs(vars));\r\n }\r\n public override void AddUses(List vars)\r\n {\r\n stmts.ToList().ForEach(s => s.AddUses(vars));\r\n }\r\n public override string ToString()\r\n {\r\n return String.Join(Environment.NewLine, stmts.Select(s => s.ToString()));;\r\n }\r\n}\r\n\r\npublic class RtlArg\r\n{\r\n public readonly bool isIn;\r\n public readonly bool isOut;\r\n public readonly RtlExp e;\r\n public string pinReg; \r\n\r\n public RtlArg(bool isIn, bool isOut, RtlExp e, string pinReg = null)\r\n {\r\n this.isIn = isIn;\r\n this.isOut = isOut;\r\n this.e = e;\r\n this.pinReg = pinReg;\r\n }\r\n\r\n public virtual RtlArg Subst(Dictionary map)\r\n {\r\n return new RtlArg(isIn, isOut, e.Subst(map), pinReg);\r\n }\r\n\r\n public override string ToString() { return e.ToString(); }\r\n public virtual string AsOperand() { return isOut ? e.ToString() : e.AsOperand(); }\r\n}\r\n\r\npublic class RtlInst: RtlStmt\r\n{\r\n public readonly string op; \r\n public readonly ReadOnlyCollection args;\r\n public readonly bool ghost;\r\n public readonly string envIns;\r\n public readonly string envOuts;\r\n\r\n public RtlInst(string op, IEnumerable args, bool ghost, string envIns = null, string envOuts = null)\r\n {\r\n this.op = op;\r\n this.args = args.ToList().AsReadOnly();\r\n this.ghost = ghost;\r\n this.envIns = envIns;\r\n this.envOuts = envOuts;\r\n }\r\n\r\n public RtlInst(string op, IEnumerable outs, IEnumerable insOuts, IEnumerable ins, bool ghost,\r\n string envIns = null, string envOuts = null):\r\n this(op, outs.Select(x => new RtlArg(false, true, x)).Concat(\r\n insOuts.Select(x => new RtlArg(true, true, x)).Concat(\r\n ins.Select(x => new RtlArg(true, false, x)))),\r\n ghost, envIns, envOuts)\r\n {\r\n }\r\n\r\n public override void AddDefs(List vars)\r\n {\r\n if (!ghost)\r\n {\r\n args.ToList().ForEach(x => {if (x.isOut) x.e.AddVars(vars);});\r\n }\r\n }\r\n\r\n public override void AddUses(List vars)\r\n {\r\n if (!ghost)\r\n {\r\n args.ToList().ForEach(x => {if (x.isIn) x.e.AddVars(vars);});\r\n }\r\n }\r\n\r\n public override RtlStmt Subst(Dictionary map)\r\n {\r\n return ghost ? this : new RtlInst(op, args.Select(e => e.Subst(map)), ghost, envIns, envOuts).WithComment(comment);\r\n }\r\n\r\n public override string ToString()\r\n {\r\n if (op == null)\r\n {\r\n var ins = args.Where(x => x.isIn);\r\n var outs = args.Where(x => x.isOut).ToList();\r\n return String.Join(\", \", outs) + (outs.Count == 0 ? \"\" : \" := \") + String.Join(\", \", ins) + \";\";\r\n }\r\n else\r\n {\r\n return \"call r\" + envOuts + \" := \" + op + \"(r\" + envIns + \", \" + String.Join(\", \", args.Select(e => e.AsOperand())) + \");\";\r\n }\r\n }\r\n}\r\n\r\npublic class RtlCallInOut: RtlInst\r\n{\r\n public int index;\r\n public readonly bool isRet; \r\n\r\n public RtlCallInOut(int index, bool isRet, RtlExp e):\r\n base(null, new RtlArg[] { new RtlArg(!isRet, isRet, e) }, false)\r\n {\r\n this.index = index;\r\n this.isRet = isRet;\r\n }\r\n\r\n public override RtlStmt Subst(Dictionary map)\r\n {\r\n return new RtlCallInOut(index, isRet, args[0].e.Subst(map)).WithComment(comment);\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return \"INVALID_BOOGIE_CODE_RtlAssignStack;\";\r\n }\r\n}\r\n\r\npublic class RtlCall: RtlInst\r\n{\r\n public RtlCall(string op, IEnumerable outs, IEnumerable args, bool ghost):\r\n base(op, outs, new RtlVar[0], args, ghost)\r\n {\r\n }\r\n\r\n public override void AddDefs(List vars)\r\n {\r\n \r\n }\r\n\r\n public override void AddUses(List vars)\r\n {\r\n \r\n }\r\n\r\n public override RtlStmt Subst(Dictionary map)\r\n {\r\n \r\n return this;\r\n }\r\n\r\n public override string ToString()\r\n {\r\n Func,string> commaList = ss => String.Concat(ss.Select(s => \", \" + s));\r\n var ins = args.Where(x => x.isIn);\r\n var outs = args.Where(x => x.isOut).ToList();\r\n if (ghost)\r\n {\r\n return \"call \" + String.Join(\", \", outs) + (outs.Count == 0 ? \"\" : \" := \") + op + \"(\" + String.Join(\", \", ins) + \");\";\r\n }\r\n else\r\n {\r\n string inouts = \"stk, statics, io, mems, $commonVars, $gcVars, $toAbs, $absMem, $stacksFrames, objLayouts, heap\";\r\n string call_string = \"call alignCall(r.regs[ESP]);\" + System.Environment.NewLine;\r\n call_string += \"{: call r, stk := logical_Call(r, core_state, stk);\" + System.Environment.NewLine;\r\n call_string += \"call r, \" + inouts + String.Concat(outs.Select(s => \", \" + s))\r\n + \" := \" + op + \"(r, core_state, \" + inouts + String.Concat(ins.Select(s => \", \" + s)) + \"); :}\";\r\n return call_string;\r\n }\r\n }\r\n}\r\n\r\npublic class RtlStmtComputed: RtlInst\r\n{\r\n public readonly Func toString;\r\n \r\n public RtlStmtComputed(Func toString, IEnumerable args, bool ghost):\r\n base(null, args, ghost)\r\n {\r\n this.toString = toString;\r\n }\r\n\r\n public override RtlStmt Subst(Dictionary map)\r\n {\r\n \r\n return ghost ? this :\r\n new RtlStmtComputed(toString, args.Select(e => e.Subst(map)), ghost).WithComment(comment);\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return toString(this);\r\n }\r\n}\r\n\r\npublic class RtlLabel: RtlStmt\r\n{\r\n public readonly string label;\r\n public readonly bool loop; \r\n public RtlLabel(string label, bool loop = false) { this.label = label; this.loop = loop; }\r\n\r\n public override string ToString()\r\n {\r\n return label + \":\";\r\n }\r\n}\r\n\r\npublic class RtlJump: RtlStmt\r\n{\r\n public readonly string label;\r\n public readonly RtlBinary cond; \r\n public RtlJump(string label, RtlBinary cond)\r\n {\r\n this.label = label;\r\n this.cond = cond;\r\n Util.Assert(cond == null || !(cond.e0 is RtlInt && cond.e1 is RtlInt)); \r\n }\r\n\r\n public override void AddUses(List vars)\r\n {\r\n if (cond != null)\r\n {\r\n cond.AddVars(vars);\r\n }\r\n }\r\n\r\n public override RtlStmt Subst(Dictionary map)\r\n {\r\n return new RtlJump(label, (cond == null) ? null : (RtlBinary)cond.Subst(map)).WithComment(comment);\r\n }\r\n\r\n public override string ToString()\r\n {\r\n if (cond == null)\r\n {\r\n return \"goto \" + label + \";\";\r\n }\r\n else\r\n {\r\n string jop;\r\n switch (cond.op)\r\n {\r\n case \"==\": jop = \"Je\"; break;\r\n case \"!=\": jop = \"Jne\"; break;\r\n case \"<\": jop = \"Jb\"; break;\r\n case \"<=\": jop = \"Jbe\"; break;\r\n case \">\": jop = \"Ja\"; break;\r\n case \">=\": jop = \"Jae\"; break;\r\n default: throw new Exception(\"not implemented: \" + cond.op);\r\n }\r\n return \"call r := instr_Cmp(r, \" + cond.e0 + \", \" + cond.e1.AsOperand() + \"); if (\"\r\n + jop + \"(r.efl)) { goto \" + label + \"; }\";\r\n }\r\n }\r\n}\r\n\r\npublic class RtlReturn: RtlStmt\r\n{\r\n public readonly ReadOnlyCollection args;\r\n\r\n public RtlReturn(IEnumerable args)\r\n {\r\n this.args = args.ToList().AsReadOnly();\r\n }\r\n\r\n public override void AddUses(List vars)\r\n {\r\n args.ToList().ForEach(x => x.AddVars(vars));\r\n }\r\n\r\n public override RtlStmt Subst(Dictionary map)\r\n {\r\n return new RtlReturn(args.Select(e => (RtlVar)(e.Subst(map)))).WithComment(comment);\r\n }\r\n\r\n public override string ToString()\r\n {\r\n string ret = \"{: call r := logical_Ret(r, core_state, stk); return; :}\";\r\n return ret;\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/tools/DafnyCC/blueprints/Analyze.bpl", "content": "// /useArrayTheory /loopUnroll:5\r\n\r\ntype id;\r\n\r\nconst nStmts:int;\r\naxiom nStmts > 0;\r\nfunction N(i:int):bool { 0 <= i && i < nStmts }\r\n\r\nprocedure ComputeLiveVars(\r\n outVars:[id]bool,\r\n rets:[int]bool,\r\n uses:[int][id]bool,\r\n defs:[int][id]bool,\r\n pred:[int][int]bool,\r\n succ:[int][int]bool)\r\n returns(live:[int][id]bool)\r\n requires (forall i:int :: rets[i] <==> N(i) && !(exists j:int :: N(j) && succ[i][j]));\r\n requires (forall i:int, x:id :: !N(i) ==> !uses[i][x] && !defs[i][x]);\r\n requires (forall i:int, j:int :: !N(i) || !N(j) ==> !pred[i][j] && !succ[i][j]);\r\n requires (forall i:int, j:int :: N(i) && N(j) ==> pred[i][j] <==> succ[j][i]);\r\n ensures (forall i:int, x:id :: N(i) ==>\r\n live[i][x] ==\r\n ( uses[i][x]\r\n || ( !defs[i][x]\r\n && (if rets[i] then outVars[x] else\r\n (exists j:int :: N(j) && succ[i][j] && live[j][x])\r\n ))));\r\n{\r\n var work:[int]bool;\r\n var k:int;\r\n var live_k:[id]bool;\r\n\r\n work := (lambda i:int :: N(i));\r\n live := (lambda i:int :: (lambda x:id :: false));\r\n\r\n while ((exists i:int :: N(i) && work[i]))\r\n {\r\n havoc k; assume N(k) && work[k];\r\n work := work[k := false];\r\n\r\n/* cleanest solution:\r\n live_k := if rets[k] then outVars else live[k];\r\n live_k := (lambda x:id :: live_k[x] || (exists s:int :: N(k) && succ[k][s] && live[s][x]));\r\n live_k := (lambda x:id :: live_k[x] && !defs[k][x]);\r\n live_k := (lambda x:id :: live_k[x] || uses[k][x]);\r\n*/\r\n // more like actual implementation:\r\n live_k := live[k];\r\n live_k := (lambda x:id :: live_k[x] || uses[k][x]);\r\n if (rets[k])\r\n {\r\n live_k := (lambda x:id :: live_k[x] || (outVars[x] && !defs[k][x]));\r\n }\r\n live_k := (lambda x:id :: live_k[x] || (exists s:int :: N(k) && succ[k][s] && live[s][x] && !defs[k][x]));\r\n\r\n if ((exists x:id :: live_k[x] != live[k][x]))\r\n {\r\n live := live[k := live_k];\r\n work := (lambda p:int :: N(p) && (work[p] || pred[k][p]));\r\n }\r\n }\r\n}\r\n\r\nprocedure ComputeDefVars(\r\n inVars:[id]bool,\r\n uses:[int][id]bool,\r\n defs:[int][id]bool,\r\n pred:[int][int]bool,\r\n succ:[int][int]bool)\r\n returns(def:[int][id]bool)\r\n requires (forall i:int, x:id :: !N(i) ==> !uses[i][x] && !defs[i][x]);\r\n requires (forall i:int, j:int :: !N(i) || !N(j) ==> !pred[i][j] && !succ[i][j]);\r\n requires (forall i:int, j:int :: N(i) && N(j) ==> pred[i][j] <==> succ[j][i]);\r\n requires (forall j:int :: !pred[0][j]);\r\n ensures (forall x:id :: def[0][x] == (defs[0][x] || inVars[x]));\r\n ensures (forall i:int, x:id :: N(i) && i != 0 ==>\r\n def[i][x] == (defs[i][x] || (forall j:int :: N(j) && pred[i][j] ==> def[j][x])));\r\n{\r\n var work:[int]bool;\r\n var k:int;\r\n var def_k:[id]bool;\r\n\r\n work := (lambda i:int :: i == 0);\r\n def := (lambda i:int :: (lambda x:id :: N(i)));\r\n\r\n while ((exists i:int :: N(i) && work[i]))\r\n {\r\n havoc k; assume N(k) && work[k];\r\n work := work[k := false];\r\n\r\n def_k := if k == 0 then inVars else def[k];\r\n def_k := (lambda x:id :: def_k[x] && (forall p:int :: N(p) && pred[k][p] ==> def[p][x]));\r\n def_k := (lambda x:id :: def_k[x] || defs[k][x]);\r\n\r\n if ((exists x:id :: def_k[x] != def[k][x]))\r\n {\r\n def := def[k := def_k];\r\n work := (lambda p:int :: N(p) && (work[p] || succ[k][p]));\r\n }\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/tools/DafnyCC/blueprints/RegAlloc.bpl", "content": "// /useArrayTheory /loopUnroll:5\r\n\r\nconst none:id;\r\n\r\ntype reg;\r\nconst unique r0:reg;\r\nconst unique r1:reg;\r\nfunction R(r:reg):bool { r == r0 || r == r1 }\r\n//function R(r:reg):bool { true }\r\n//function R(r:reg):bool;\r\n\r\nprocedure Alloc(\r\n inVars:[id]bool,\r\n outVars:[id]bool,\r\n initAssign:[reg]id,\r\n rets:[int]bool,\r\n uses:[int][id]bool,\r\n defs:[int][id]bool,\r\n pred:[int][int]bool,\r\n succ:[int][int]bool)\r\n returns(assigned:[int][reg]id, is_assigned:[int]bool)\r\n requires (forall r:reg :: !R(r) ==> initAssign[r] == none);\r\n requires (forall r1:reg, r2:reg :: R(r1) && R(r2) && initAssign[r1] != none && initAssign[r1] == initAssign[r2] ==> r1 == r2);\r\n requires (forall i:int :: rets[i] <==> N(i) && !(exists j:int :: N(j) && succ[i][j]));\r\n requires (forall i:int, x:id :: !N(i) ==> !uses[i][x] && !defs[i][x]);\r\n requires (forall i:int :: !uses[i][none] && !defs[i][none]);\r\n requires (forall i:int, j:int :: !N(i) || !N(j) ==> !pred[i][j] && !succ[i][j]);\r\n requires (forall i:int, j:int :: N(i) && N(j) ==> pred[i][j] <==> succ[j][i]);\r\n requires (forall j:int :: !pred[0][j]);\r\n{\r\n var live:[int][id]bool;\r\n var def:[int][id]bool;\r\n var work:[int]bool;\r\n var vars_k:[id]bool;\r\n var vars_loop:[id]bool;\r\n var assign_k:[reg]id;\r\n var xvar:id;\r\n var k:int;\r\n var kp:int;\r\n var bestEvict:reg;\r\n\r\n var assigned_spill:[int][reg]bool;\r\n var card:[id]int;\r\n// var xmap:[id]reg;\r\n\r\n// call live := ComputeLiveVars(outVars, rets, uses, defs, pred, succ);\r\n// call def := ComputeDefVars(inVars, uses, defs, pred, succ);\r\n\r\n assigned := (lambda i:int :: (lambda r:reg :: none));\r\n is_assigned := (lambda i:int :: false);\r\n work := (lambda i:int :: i == 0);\r\n while ((exists i:int :: N(i) && work[i]))\r\n {\r\n havoc k; assume N(k) && work[k];\r\n work := work[k := false];\r\n\r\n assume (forall p:int, x:id :: pred[k][p] && uses[k][x] ==> def[p][x]); // variable x must be assigned before use\r\n vars_k := (lambda x:id :: defs[k][x] || uses[k][x]);\r\n\r\n // limit cardinality of vars_k\r\n// havoc xmap;\r\n// assume (forall x1:id, x2:id :: xmap[x1] == xmap[x2] ==> x1 == x2);\r\n// assume (forall x:id :: vars_k[x] ==> R(xmap[x]));\r\n havoc card;\r\n assume (forall x1:id, x2:id :: card[x1] == card[x2] ==> x1 == x2);\r\n assume (forall x:id :: vars_k[x] ==> 0 <= card[x] && card[x] < 2);\r\n assert R(r0) && R(r1);\r\n\r\n if (k == 0)\r\n {\r\n assign_k := initAssign;\r\n }\r\n else\r\n {\r\n assert (exists p:int :: pred[k][p] && is_assigned[p]);\r\n havoc kp; assume pred[k][kp] && is_assigned[kp];\r\n assign_k := assigned[kp];\r\n }\r\n assign_k := (lambda r:reg :: if assign_k[r] != none && live[k][assign_k[r]] then assign_k[r] else none);\r\n\r\n if (*) // call\r\n {\r\n assign_k := (lambda r:reg :: none);\r\n }\r\n else\r\n {\r\n vars_loop := vars_k;\r\n while ((exists x:id :: vars_loop[x]))\r\n {\r\n havoc xvar; assume vars_loop[xvar];\r\n vars_loop := vars_loop[xvar := false];\r\n if ((exists r:reg :: R(r) && assign_k[r] == xvar))\r\n {\r\n // already allocated\r\n }\r\n else\r\n {\r\n assert (exists r:reg :: R(r) && !vars_k[assign_k[r]]);\r\n havoc bestEvict; assume R(bestEvict) && !vars_k[assign_k[bestEvict]];\r\n assign_k := assign_k[bestEvict := xvar];\r\n }\r\n }\r\n }\r\n\r\n assigned := assigned[k := assign_k];\r\n is_assigned := is_assigned[k := true];\r\n work := (lambda s:int :: work[s] || (succ[k][s] && !is_assigned[s]));\r\n }\r\n\r\n // insert arbitrary spills\r\n havoc assigned_spill;\r\n assigned := (lambda i:int :: (lambda r:reg :: if assigned_spill[i][r] then none else assigned[i][r]));\r\n\r\n // TODO: generate statements, spills, etc.\r\n}\r\n" }, { "path": "ironclad-apps/tools/DafnyCC/nubuild-manifest.txt", "content": "# REVIEW: Everything in this file could be infered from the .csproj file.\n\n# Dependencies listed as References in .csproj file:\ndependency ..\\Dafny\\Basetypes.dll\ndependency ..\\Dafny\\Core.dll\ndependency ..\\Dafny\\DafnyPipeline.dll\ndependency ..\\Dafny\\ParserHelper.dll\n\n# Dependencies listed as Content in .csproj file:\ndependency ..\\Dafny\\CodeContractsExtender.dll\ndependency ..\\Dafny\\Provers.SMTLib.dll\ndependency ..\\Dafny\\VCGeneration.dll\ndependency ..\\Dafny\\z3.exe\ndependency ..\\DafnySpec\\DafnyPrelude.dfy\n\n# Outputs (References marked \"Copy Local\" in .csproj file):\noutput Basetypes.dll\noutput Core.dll\noutput DafnyPipeline.dll\noutput ParserHelper.dll\n\n# Outputs (Content marked \"Copy to Output Directory\" in .csproj file):\noutput CodeContractsExtender.dll\noutput Provers.SMTLib.dll\noutput VCGeneration.dll\noutput z3.exe\noutput DafnyPrelude.dfy\n\n# Outputs actually built by this .csproj file:\noutput dafnycc.exe\n" }, { "path": "ironclad-apps/tools/DafnySpec/.gitignore", "content": "*.suo\n" }, { "path": "ironclad-apps/tools/DafnySpec/Compile.cs", "content": "using System;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Collections.Generic;\r\nusing System.Collections.ObjectModel;\r\nusing Microsoft.Dafny;\r\nusing Bpl = Microsoft.Boogie;\r\nusing Type = Microsoft.Dafny.Type;\r\nusing System.Numerics;\r\n\r\npublic class TypeApply\r\n{\r\n public readonly DafnySpec dafnySpec;\r\n public readonly string name;\r\n public readonly List typeParams;\r\n public readonly Dictionary typeArgs;\r\n public readonly Dictionary typeSubsts;\r\n readonly string appName;\r\n readonly string appFullName;\r\n\r\n public TypeApply(DafnySpec dafnySpec, string name, List typeParams, Dictionary typeArgs)\r\n {\r\n \r\n \r\n this.dafnySpec = dafnySpec;\r\n this.name = name;\r\n this.typeParams = typeParams;\r\n this.typeArgs = new Dictionary();\r\n typeArgs.ToList().ForEach(a => this.typeArgs.Add(a.Key, ToType(a.Value)));\r\n this.typeSubsts = new Dictionary();\r\n typeArgs.ToList().ForEach(a => this.typeSubsts.Add(a.Key.Name, ToType(a.Value)));\r\n \r\n string suffix = String.Concat(typeParams.Select(p => \"___\" + dafnySpec.TypeString(typeArgs[p])));\r\n appName = name + suffix;\r\n appFullName = name + \"__FULL\" + suffix;\r\n int i = appFullName.Contains('.') ? appFullName.LastIndexOf('.') + 1 : 0;\r\n appFullName = appFullName.Insert(i, DafnySpec.CleanName(\"#\"));\r\n }\r\n\r\n static Type ToType(Type t)\r\n {\r\n return DafnySpec.ToType(t);\r\n }\r\n\r\n public Type AppType(Type t)\r\n {\r\n Util.Assert(t != null);\r\n \r\n \r\n return Resolver.SubstType(t, typeArgs);\r\n }\r\n\r\n public string AppName()\r\n {\r\n return appName;\r\n }\r\n\r\n public string AppFullName()\r\n {\r\n \r\n return appFullName;\r\n }\r\n\r\n public override bool Equals(object obj)\r\n {\r\n TypeApply that = obj as TypeApply;\r\n if (that != null && that.name == this.name && that.typeArgs.Count == this.typeArgs.Count)\r\n {\r\n Dictionary thisArgs = this.typeArgs.ToDictionary(p => p.Key.ToString(), p => p.Value);\r\n Dictionary thatArgs = that.typeArgs.ToDictionary(p => p.Key.ToString(), p => p.Value);\r\n return thatArgs.Keys.ToList().TrueForAll(x => thisArgs.ContainsKey(x) && thatArgs[x].Equals(thisArgs[x]));\r\n }\r\n return false;\r\n }\r\n\r\n public override int GetHashCode()\r\n {\r\n return name.GetHashCode() + typeArgs.Values.Sum(t => (\"\" + t.ToString()).GetHashCode());\r\n }\r\n}\r\n\r\npublic class SeqTree\r\n{\r\n public readonly SeqTree left;\r\n public readonly SeqTree right;\r\n public readonly int buildCount; \r\n public SeqTree(SeqTree left, SeqTree right, int buildCount) { this.left = left; this.right = right; this.buildCount = buildCount; }\r\n\r\n public static string TreeName(SeqTree s)\r\n {\r\n return (s == null) ? \"e\" : (s.buildCount >= 0) ? s.buildCount.ToString() :\r\n \"a_\" + TreeName(s.left) + \"_\" + TreeName(s.right);\r\n }\r\n}\r\n\r\npublic class CompileBase\r\n{\r\n public DafnySpec dafnySpec;\r\n public TypeApply typeApply;\r\n public bool isRecursive;\r\n public string procName;\r\n public string recFunName;\r\n public bool minVerify;\r\n public bool stmtExprEnabled;\r\n public int ignoreStmtExpr;\r\n public List stmts = new List();\r\n public List> recCalls = new List>();\r\n public Dictionary allVars = new Dictionary();\r\n public List> forallVars = new List>();\r\n public Dictionary renamer = new Dictionary();\r\n public int nextRename;\r\n public static bool isPrinting = false;\r\n public TextWriter writer;\r\n public TextWriter iwriter;\r\n public string moduleName;\r\n public List imports;\r\n public List visibleModules;\r\n public Type visibleElementType; \r\n public int tempCount = 0;\r\n\r\n public CompileBase(DafnySpec dafnySpec, TypeApply typeApply,\r\n TextWriter writer, TextWriter iwriter, string moduleName, List imports)\r\n {\r\n this.dafnySpec = dafnySpec;\r\n this.typeApply = typeApply;\r\n this.writer = writer;\r\n this.iwriter = iwriter;\r\n this.moduleName = moduleName;\r\n this.imports = imports;\r\n this.visibleModules = imports.Concat(new List { moduleName, \"private##\" + moduleName }).ToList();\r\n }\r\n\r\n public static string GhostProcName(string x) { return DafnySpec.GhostProcName(x); }\r\n public static string FunName(string x) { return DafnySpec.FunName(x); }\r\n public static string SimpleName(string x) { return DafnySpec.SimpleName(x); }\r\n public Type AppType(Type t) { return typeApply.AppType(t); }\r\n public string TypeString(Type t) { return dafnySpec.TypeString(t); }\r\n\r\n public string GhostVar(string x, bool allowRename = true)\r\n {\r\n return (x == \"INTERNAL_absMem\") ? \"$absMem\"\r\n : \"$ghost_\" + (allowRename && renamer.ContainsKey(x) ? renamer[x] : \"\") + DafnySpec.CleanName(x);\r\n }\r\n\r\n public string TempName()\r\n {\r\n return \"temp__\" + (tempCount++);\r\n }\r\n\r\n public void AddRename(string x)\r\n {\r\n renamer[x] = \"_\" + (nextRename++) + \"_\";\r\n }\r\n\r\n public Dictionary PushRename()\r\n {\r\n return new Dictionary(renamer);\r\n }\r\n\r\n public Dictionary PushRename(string x)\r\n {\r\n var oldRenamer = PushRename();\r\n AddRename(x);\r\n return oldRenamer;\r\n }\r\n\r\n public Dictionary PushRename(IEnumerable xs)\r\n {\r\n var oldRenamer = PushRename();\r\n xs.ToList().ForEach(AddRename);\r\n return oldRenamer;\r\n }\r\n\r\n public void PopRename(Dictionary oldRenamer)\r\n {\r\n renamer = oldRenamer;\r\n }\r\n\r\n public RtlStmt PushForall()\r\n {\r\n var dict = new Dictionary();\r\n forallVars.Add(dict);\r\n return new RtlGhostStmtComputed(s => String.Concat(dict.Values.Select(\r\n x => \"var \" + x.x + \":\" + TypeString(x.type) + \";\")),\r\n new RtlExp[0]);\r\n }\r\n\r\n public void PopForall()\r\n {\r\n forallVars.RemoveAt(forallVars.Count - 1);\r\n }\r\n\r\n public void Indent()\r\n {\r\n stmts.Add(new RtlIndent(true));\r\n }\r\n\r\n public void Unindent()\r\n {\r\n stmts.Add(new RtlIndent(false));\r\n }\r\n\r\n public static bool IsConstant(Expression e)\r\n {\r\n UnaryOpExpr unary = e as UnaryOpExpr;\r\n BinaryExpr binary = e as BinaryExpr;\r\n if (unary!= null)\r\n {\r\n return IsConstant(unary.E);\r\n }\r\n if (binary != null)\r\n {\r\n return IsConstant(binary.E0) && IsConstant(binary.E1);\r\n }\r\n return e is LiteralExpr;\r\n }\r\n\r\n public static string IntToTyped(Type t, string e)\r\n {\r\n return\r\n (t is BoolType) ? \"((\" + e + \") != 0)\" :\r\n (t is RealType) ? \"(real(\" + e + \"))\" :\r\n e;\r\n }\r\n\r\n //- Assert that et is a well-formed value of type t, represented by integer ei\r\n public static RtlExp IntEqTyped(Type t, RtlExp et, RtlExp ei)\r\n {\r\n return\r\n (t is BoolType) ?\r\n new RtlBinary(\"||\",\r\n new RtlBinary(\"&&\", et, new RtlBinary(\"==\", ei, new RtlInt(1))),\r\n new RtlBinary(\"&&\", new RtlApply(\"!\", new RtlExp[] { et }), new RtlBinary(\"==\", ei, new RtlInt(0)))) :\r\n (t is RealType) ? new RtlBinary(\"==\", et, new RtlApply(\"real\", new RtlExp[] { ei })) :\r\n new RtlBinary(\"==\", et, ei);\r\n }\r\n\r\n public static string IntEqTyped(Type t, string et, string ei)\r\n {\r\n return \"(\" + IntEqTyped(t, new RtlLiteral(et), new RtlLiteral(ei)) + \")\";\r\n }\r\n\r\n public Expression GetExp(Expression e)\r\n {\r\n Expression r = e.WasResolved() ? e.Resolved : e;\r\n ParensExpression p = e as ParensExpression;\r\n return (r != null) ? r : (p != null) ? GetExp(p.E) : e;\r\n }\r\n\r\n public RtlVar TempVar(Type t, bool declare = true)\r\n {\r\n string name = \"$ghost__\" + TempName();\r\n RtlVar ret = new RtlVar(name, false, AppType(t));\r\n if (declare)\r\n {\r\n allVars.Add(name, ret);\r\n }\r\n return ret;\r\n }\r\n\r\n public RtlVar AsVar(Expression exp)\r\n {\r\n exp = GetExp(exp);\r\n IdentifierExpr id = exp as IdentifierExpr;\r\n if (id != null)\r\n {\r\n //- We're assuming this is a local variable for the moment; otherwise we shouldn't call AppType\r\n string name = GhostVar(id.Name);\r\n RtlVar ret = new RtlVar(name, id.Var.IsGhost, AppType(id.Type));\r\n \r\n return ret;\r\n }\r\n else\r\n {\r\n return null;\r\n }\r\n }\r\n\r\n public RtlVar AsVar(BoundVar x)\r\n {\r\n string name = GhostVar(x.Name);\r\n return new RtlVar(name, x.IsGhost, AppType(x.Type));\r\n }\r\n\r\n public string Triggers(Attributes attrs, Func f)\r\n {\r\n List> triggers = new List>();\r\n for (; attrs != null; attrs = attrs.Prev)\r\n {\r\n if (attrs.Name == \"trigger\")\r\n {\r\n triggers.Add(attrs.Args.ConvertAll(a => f(a)));\r\n }\r\n }\r\n return String.Concat(triggers.Select(es => \"{\" + String.Join(\", \", es) + \"}\"));\r\n }\r\n\r\n public RtlExp GhostIfThenElse(RtlExp eTest, Func feThen, Func feElse)\r\n {\r\n if (stmtExprEnabled && ignoreStmtExpr == 0)\r\n {\r\n stmts.Add(new RtlGhostStmtComputed(s => \"if (\" + eTest + \") {\", new RtlExp[0]));\r\n Indent();\r\n }\r\n var eThen = feThen();\r\n if (stmtExprEnabled && ignoreStmtExpr == 0)\r\n {\r\n Unindent();\r\n stmts.Add(new RtlGhostStmtComputed(s => \"}\", new RtlExp[0]));\r\n stmts.Add(new RtlGhostStmtComputed(s => \"if (!(\" + eTest + \")) {\", new RtlExp[0]));\r\n Indent();\r\n }\r\n var eElse = feElse();\r\n if (stmtExprEnabled && ignoreStmtExpr == 0)\r\n {\r\n Unindent();\r\n stmts.Add(new RtlGhostStmtComputed(s => \"}\", new RtlExp[0]));\r\n }\r\n return new RtlLiteral(\"(if (\" + eTest + \") then (\"\r\n + eThen + \") else (\" + eElse + \"))\");\r\n }\r\n\r\n public RtlExp GhostLet(Microsoft.Boogie.IToken tok, List lhss, List rhss,\r\n Func body)\r\n {\r\n if (stmtExprEnabled && ignoreStmtExpr == 0)\r\n {\r\n var oldRenamer1 = PushRename();\r\n for (int i = 0; i < lhss.Count; i++)\r\n {\r\n var lhs = lhss[i];\r\n var rhs = rhss[i];\r\n AddGhostVarDecl(lhs.Name, lhs.Type, true);\r\n MoveGhost(new RtlVar(GhostVar(lhs.Name), true, AppType(lhs.Type)), rhs);\r\n }\r\n body();\r\n PopRename(oldRenamer1);\r\n }\r\n var oldRenamer2 = PushRename();\r\n lhss.ForEach(e => AddRename(e.Name));\r\n ignoreStmtExpr++; \r\n RtlExp rExp = new RtlLiteral(\"(\"\r\n + String.Concat(lhss.Zip(rhss, (lhs, rhs) =>\r\n \"let \" + GhostVar(lhs.Name) + \":\" + TypeString(AppType(lhs.Type))\r\n + \" := (\" + rhs + \") in \"))\r\n + \" (\" + body() + \"))\");\r\n ignoreStmtExpr--;\r\n PopRename(oldRenamer2);\r\n return rExp;\r\n }\r\n\r\n public RtlExp GhostExpressionRec(Expression exp, bool inRecSpec = false, bool inRequiresOrOld = false)\r\n {\r\n Util.Assert(!isPrinting);\r\n exp = GetExp(exp);\r\n StmtExpr stmtExpr = exp as StmtExpr;\r\n IdentifierExpr idExp = exp as IdentifierExpr;\r\n LiteralExpr literal = exp as LiteralExpr;\r\n BinaryExpr binary = exp as BinaryExpr;\r\n UnaryExpr unary = exp as UnaryExpr;\r\n ITEExpr ite = exp as ITEExpr;\r\n ExistsExpr existsExp = exp as ExistsExpr;\r\n ForallExpr forallExp = exp as ForallExpr;\r\n LetExpr letExp = exp as LetExpr;\r\n MatchExpr matchExp = exp as MatchExpr;\r\n OldExpr oldExp = exp as OldExpr;\r\n FunctionCallExpr funCall = exp as FunctionCallExpr;\r\n DatatypeValue dataVal = exp as DatatypeValue;\r\n MemberSelectExpr memberSelect = exp as MemberSelectExpr;\r\n SeqSelectExpr seqSelect = exp as SeqSelectExpr;\r\n SeqUpdateExpr seqUpdate = exp as SeqUpdateExpr;\r\n SeqDisplayExpr seqDisplay = exp as SeqDisplayExpr;\r\n\r\n Func G = e => GhostExpression(e, inRecSpec, inRequiresOrOld);\r\n\r\n if (stmtExpr != null)\r\n {\r\n if (stmtExprEnabled)\r\n {\r\n if (ignoreStmtExpr == 0)\r\n {\r\n AddGhostStatement(stmtExpr.S, null);\r\n }\r\n return G(stmtExpr.E);\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented: cannot handle statement expression here\");\r\n }\r\n }\r\n else if (idExp != null)\r\n {\r\n return AsVar(idExp);\r\n }\r\n else if (literal != null && literal.Value is BigInteger)\r\n {\r\n return new RtlInt((BigInteger)(literal.Value));\r\n }\r\n else if (literal != null && literal.Value is bool)\r\n {\r\n return new RtlLiteral((bool)(literal.Value) ? \"true\" : \"false\");\r\n }\r\n else if (literal != null && literal.Value == null)\r\n {\r\n return new RtlLiteral(\"ArrayOfInt(0 - 1, NO_ABS)\");\r\n }\r\n else if (literal != null && literal.Value is Microsoft.Basetypes.BigDec)\r\n {\r\n return new RtlLiteral(((Microsoft.Basetypes.BigDec)literal.Value).ToDecimalString());\r\n }\r\n else if (binary != null)\r\n {\r\n string op = null;\r\n string internalOp = null;\r\n CompileFunction compileFunction = this as CompileFunction;\r\n string thisFuncName = (compileFunction == null) ? null : compileFunction.function.Name;\r\n switch (binary.ResolvedOp)\r\n {\r\n case BinaryExpr.ResolvedOpcode.SeqEq:\r\n return new RtlApply(dafnySpec.GetSeqOperationName(AppType(binary.E0.Type), \"Seq_Equal\"),\r\n new RtlExp[] { G(binary.E0), G(binary.E1) });\r\n case BinaryExpr.ResolvedOpcode.SeqNeq:\r\n return new RtlLiteral(\"(!\" +\r\n new RtlApply(dafnySpec.GetSeqOperationName(AppType(binary.E0.Type), \"Seq_Equal\"),\r\n new RtlExp[] { G(binary.E0), G(binary.E1) }) + \")\");\r\n case BinaryExpr.ResolvedOpcode.Concat:\r\n return new RtlApply(dafnySpec.GetSeqOperationName(AppType(binary.Type), \"Seq_Append\"),\r\n new RtlExp[] { G(binary.E0), G(binary.E1) });\r\n }\r\n if (binary.Op == BinaryExpr.Opcode.Exp)\r\n {\r\n binary = new BinaryExpr(binary.tok, BinaryExpr.Opcode.Imp, binary.E0, binary.E1);\r\n }\r\n switch (binary.Op)\r\n {\r\n case BinaryExpr.Opcode.Disjoint:\r\n case BinaryExpr.Opcode.In:\r\n case BinaryExpr.Opcode.NotIn:\r\n throw new Exception(\"not implemented: binary operator '\" + BinaryExpr.OpcodeString(binary.Op) + \"'\");\r\n }\r\n if (AppType(binary.E0.Type) is IntType && AppType(binary.E1.Type) is IntType)\r\n {\r\n switch (binary.Op)\r\n {\r\n case BinaryExpr.Opcode.Le: internalOp = \"INTERNAL_le_boogie\"; break;\r\n case BinaryExpr.Opcode.Lt: internalOp = \"INTERNAL_lt_boogie\"; break;\r\n case BinaryExpr.Opcode.Ge: internalOp = \"INTERNAL_ge_boogie\"; break;\r\n case BinaryExpr.Opcode.Gt: internalOp = \"INTERNAL_gt_boogie\"; break;\r\n case BinaryExpr.Opcode.Add: internalOp = \"INTERNAL_add_boogie\"; break;\r\n case BinaryExpr.Opcode.Sub: internalOp = \"INTERNAL_sub_boogie\"; break;\r\n case BinaryExpr.Opcode.Mul:\r\n op = \"*\";\r\n if (thisFuncName != \"INTERNAL_mul\")\r\n {\r\n internalOp = FunName(\"INTERNAL__mul\");\r\n }\r\n break;\r\n case BinaryExpr.Opcode.Div:\r\n op = \"div\";\r\n if (thisFuncName != \"INTERNAL_div\")\r\n {\r\n internalOp = FunName(\"INTERNAL__div\");\r\n }\r\n break;\r\n case BinaryExpr.Opcode.Mod:\r\n op = \"mod\";\r\n if (thisFuncName != \"INTERNAL_mod\")\r\n {\r\n internalOp = FunName(\"INTERNAL__mod\");\r\n }\r\n break;\r\n default:\r\n op = BinaryExpr.OpcodeString(binary.Op);\r\n break;\r\n }\r\n }\r\n else\r\n {\r\n op = BinaryExpr.OpcodeString(binary.Op);\r\n }\r\n if (internalOp == null)\r\n {\r\n return new RtlBinary(op, G(binary.E0), G(binary.E1));\r\n }\r\n else\r\n {\r\n return new RtlApply(internalOp, new RtlExp[]\r\n { G(binary.E0), G(binary.E1) });\r\n }\r\n } else if (unary != null) {\r\n if (unary is UnaryOpExpr) {\r\n UnaryOpExpr unaryOp = (UnaryOpExpr)unary;\r\n if (unaryOp.Op == UnaryOpExpr.Opcode.Not) {\r\n return new RtlLiteral(\"(!(\" + G(unaryOp.E) + \"))\");\r\n } else if (unaryOp.Op == UnaryOpExpr.Opcode.Cardinality) {\r\n return new RtlApply(dafnySpec.GetSeqOperationName(AppType(unaryOp.E.Type), \"Seq_Length\"),\r\n new RtlExp[] { G(unaryOp.E) });\r\n } else if (unaryOp.Op == UnaryOpExpr.Opcode.Fresh) {\r\n Util.Assert(DafnySpec.IsArrayType(unaryOp.E.Type));\r\n string abs = G(unaryOp.E) + \".arrAbs\";\r\n return new RtlLiteral(\"(heap_old.absData[\" + abs + \"] is AbsNone)\");\r\n } else {\r\n throw new Exception(\"not implemented: \" + exp);\r\n }\r\n } else if (unary is ConversionExpr) {\r\n var e = (ConversionExpr)unary;\r\n var fromInt = e.E.Type.IsNumericBased(Type.NumericPersuation.Int);\r\n var toInt = e.ToType.IsNumericBased(Type.NumericPersuation.Int);\r\n if (fromInt && !toInt) {\r\n return new RtlApply(\"real\", new RtlExp[] { G(e.E) });\r\n } else if (!fromInt && toInt) {\r\n return new RtlApply(\"int\", new RtlExp[] { G(e.E) });\r\n } else {\r\n Util.Assert(fromInt == toInt);\r\n return GhostExpressionRec(e.E, inRecSpec, inRequiresOrOld);\r\n }\r\n } else {\r\n throw new Exception(\"not implemented: \" + exp);\r\n }\r\n }\r\n else if (ite != null)\r\n {\r\n return GhostIfThenElse(G(ite.Test), () => G(ite.Thn), () => G(ite.Els));\r\n }\r\n else if (funCall != null)\r\n {\r\n switch (funCall.Function.Name)\r\n {\r\n case \"left\":\r\n case \"right\":\r\n case \"relation\":\r\n case \"public\":\r\n Util.Assert(funCall.Args.Count == 1);\r\n return new RtlApply(funCall.Function.Name, new RtlExp[] { G(funCall.Args[0]) });\r\n case \"sizeof\":\r\n Util.Assert(funCall.Args.Count == 1);\r\n return new RtlApply(funCall.Function.Name + \"##\" + TypeString(AppType(funCall.Args[0].Type)),\r\n new RtlExp[] { G(funCall.Args[0]) });\r\n case \"INTERNAL_add_raw\":\r\n Util.Assert(funCall.Args.Count == 2);\r\n return new RtlBinary(\"+\", G(funCall.Args[0]), G(funCall.Args[1]));\r\n case \"INTERNAL_sub_raw\":\r\n Util.Assert(funCall.Args.Count == 2);\r\n return new RtlBinary(\"-\", G(funCall.Args[0]), G(funCall.Args[1])); \r\n }\r\n TypeApply app = dafnySpec.Compile_Function(funCall.Function,\r\n funCall.TypeArgumentSubstitutions.ToDictionary(p => p.Key, p => AppType(p.Value)));\r\n string name = FunName(SimpleName(app.AppName()));\r\n string fullName = FunName(SimpleName(app.AppFullName()));\r\n List rtlArgs = funCall.Args.Select(G).ToList();\r\n List rtlReads = funCall.Function.Reads.Where(e => e.Field != null).ToList()\r\n .ConvertAll(e => (RtlExp)new RtlVar(\r\n GhostVar(e.FieldName), e.Field.IsGhost, AppType(e.Field.Type)));\r\n rtlArgs = rtlReads.Concat(rtlArgs).ToList();\r\n if (name.EndsWith(\"__INTERNAL__HEAP\"))\r\n {\r\n name = name.Substring(0, name.Length - \"__INTERNAL__HEAP\".Length);\r\n }\r\n else if (DafnySpec.IsHeapFunction(funCall.Function))\r\n {\r\n rtlArgs.Insert(0, new RtlLiteral(inRequiresOrOld ? \"$absMem_old\" : \"$absMem\"));\r\n }\r\n if (Attributes.Contains(funCall.Function.Attributes, \"opaque\")\r\n && funCall.Function.Formals.Count + rtlReads.Count == 0)\r\n {\r\n rtlArgs.Insert(0, new RtlLiteral(\"true\"));\r\n }\r\n if (fullName == recFunName)\r\n {\r\n name = fullName;\r\n }\r\n if (name == recFunName)\r\n {\r\n recCalls.Add(new List(rtlArgs));\r\n rtlArgs.Insert(0, new RtlApply(\"decreases_\" + name, new List(rtlArgs)));\r\n rtlArgs.Insert(1, new RtlLiteral(inRecSpec ? \"__unroll\" : \"__unroll + 1\"));\r\n name = \"rec_\" + name;\r\n }\r\n return new RtlApply(name, rtlArgs);\r\n }\r\n else if (dataVal != null)\r\n {\r\n bool isSeq = dataVal.Type.TypeName(null).StartsWith(\"Seq<\");\r\n return new RtlApply((isSeq ? \"_\" : \"\") + dafnySpec.Compile_Constructor(\r\n dataVal.Type, dataVal.Ctor.Name, dataVal.InferredTypeArgs, typeApply.typeArgs).AppName(),\r\n dataVal.Arguments.Select(G));\r\n }\r\n else if (existsExp != null || forallExp != null)\r\n {\r\n QuantifierExpr qExp = (QuantifierExpr)exp;\r\n bool isForall = forallExp != null;\r\n var varTuples = qExp.BoundVars.Select(v => Tuple.Create(GhostVar(v.Name), v.IsGhost, v.Type));\r\n var oldRenamer = PushRename(qExp.BoundVars.Select(v => v.Name));\r\n var oldStmtExprEnabled = stmtExprEnabled;\r\n stmtExprEnabled = false; \r\n RtlExp rExp = new RtlLiteral((isForall ? \"(forall \" : \"(exists \")\r\n + string.Join(\", \", qExp.BoundVars.Select(v => GhostVar(v.Name) + \":\" + TypeString(AppType(v.Type))))\r\n + \" :: \" + Triggers(qExp.Attributes, G) + \" \"\r\n + GetTypeWellFormedExp(varTuples.ToList(), isForall ? \"==>\" : \"&&\", G(qExp.Term)) + \")\");\r\n stmtExprEnabled = oldStmtExprEnabled;\r\n PopRename(oldRenamer);\r\n return rExp;\r\n }\r\n else if (letExp != null)\r\n {\r\n List rhss;\r\n if (letExp.Exact)\r\n {\r\n rhss = letExp.RHSs.ConvertAll(e => G(e));\r\n }\r\n else if (letExp.LHSs.Count == 1 && LiteralExpr.IsTrue(letExp.RHSs[0]) && AppType(letExp.LHSs[0].Var.Type) is IntType)\r\n {\r\n rhss = new List { new RtlLiteral(\"0\") };\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented: LetExpr: \" + letExp);\r\n }\r\n return GhostLet(exp.tok, letExp.LHSs.ConvertAll(lhs => lhs.Var), rhss, () => G(letExp.Body));\r\n }\r\n else if (matchExp != null)\r\n {\r\n if (matchExp.MissingCases.Count != 0)\r\n {\r\n throw new Exception(\"not implemented: MatchExpr with missing cases: \" + matchExp);\r\n }\r\n //- match src case c1(ps1) => e1 ... cn(psn) => en\r\n //- -->\r\n //- let x := src in\r\n //- if x is c1 then let ps1 := ...x.f1... in e1 else\r\n //- if x is c2 then let ps2 := ...x.f2... in e2 else\r\n //- let ps3 := ...x.f3... in e3\r\n var src = G(matchExp.Source);\r\n var cases = matchExp.Cases;\r\n string x = TempName();\r\n Func body = null;\r\n for (int i = cases.Count; i > 0; )\r\n {\r\n i--;\r\n MatchCaseExpr c = cases[i];\r\n Func> cRhss = () => c.Ctor.Formals.ConvertAll(f => (RtlExp)new RtlLiteral(\"(\"\r\n + f.Name + \"#\" + c.Ctor.Name + \"(\" + GhostVar(x) + \"))\"));\r\n Func ec = () => GhostLet(exp.tok, c.Arguments, cRhss(), () => G(c.Body));\r\n if (body == null)\r\n {\r\n body = ec;\r\n }\r\n else\r\n {\r\n var prevBody = body;\r\n body = () => GhostIfThenElse(new RtlLiteral(\"(\" + GhostVar(x) + \" is \" + c.Ctor.Name + \")\"),\r\n ec, prevBody);\r\n }\r\n }\r\n return GhostLet(exp.tok, new List { new BoundVar(exp.tok, x, matchExp.Source.Type) },\r\n new List { src }, body);\r\n }\r\n else if (oldExp != null)\r\n {\r\n return new RtlLiteral(\"old(\" + GhostExpression(oldExp.E, inRecSpec, true) + \")\");\r\n } \r\n else if (memberSelect != null && memberSelect.MemberName.EndsWith(\"?\"))\r\n {\r\n string constructor = memberSelect.MemberName.Substring(0, memberSelect.MemberName.Length - 1);\r\n constructor = dafnySpec.Compile_Constructor(memberSelect.Obj.Type, constructor, null, typeApply.typeArgs).AppName();\r\n bool isSeq = memberSelect.Obj.Type.TypeName(null).StartsWith(\"Seq<\");\r\n return isSeq\r\n ? new RtlLiteral(\"is_\" + constructor + \"(\" + G(memberSelect.Obj) + \")\")\r\n : new RtlLiteral(\"((\" + G(memberSelect.Obj) + \") is \" + constructor + \")\");\r\n } \r\n else if (memberSelect != null && memberSelect.Member is Field && !memberSelect.Member.IsStatic && AppType(memberSelect.Obj.Type) is UserDefinedType\r\n && memberSelect.Member is DatatypeDestructor)\r\n {\r\n DatatypeDestructor field = (DatatypeDestructor) memberSelect.Member;\r\n string constructor = dafnySpec.Compile_Constructor(memberSelect.Obj.Type,\r\n field.EnclosingCtor.Name, null, typeApply.typeArgs).AppName();\r\n bool isSeq = memberSelect.Obj.Type.TypeName(null).StartsWith(\"Seq<\");\r\n return new RtlLiteral(\"(\" + memberSelect.MemberName + (isSeq ? \"_\" : \"#\") + constructor\r\n + \"(\" + G(memberSelect.Obj) + \"))\");\r\n }\r\n else if (memberSelect != null && memberSelect.Member is Field && DafnySpec.IsArrayType(AppType(memberSelect.Obj.Type))\r\n && memberSelect.MemberName == \"Length\")\r\n {\r\n return new RtlLiteral(\"(Arr_Length(\" + G(memberSelect.Obj) + \"))\");\r\n } \r\n else if (memberSelect != null && memberSelect.Member is Field && memberSelect.Obj is ImplicitThisExpr)\r\n {\r\n //- we don't support objects yet, so interpret this as a global variable\r\n return new RtlVar(GhostVar(memberSelect.MemberName), true, memberSelect.Type);\r\n }\r\n else if (seqSelect != null)\r\n {\r\n if (seqSelect.SelectOne && DafnySpec.IsArrayType(AppType(seqSelect.Seq.Type)))\r\n {\r\n return new RtlExpComputed(e => \"fun_INTERNAL__array__elems__index(\"\r\n + (inRequiresOrOld ? \"$absMem_old\" : \"$absMem\") + \"[\" + e.args[0] + \".arrAbs], (\"\r\n + e.args[1] + \"))\", new RtlExp[] { G(seqSelect.Seq), G(seqSelect.E0) });\r\n }\r\n else if (seqSelect.SelectOne)\r\n {\r\n return new RtlApply(dafnySpec.GetSeqOperationName(AppType(seqSelect.Seq.Type), \"Seq_Index\"),\r\n new RtlExp[] { G(seqSelect.Seq), G(seqSelect.E0) });\r\n }\r\n else\r\n {\r\n RtlExp seq = G(seqSelect.Seq);\r\n if (DafnySpec.IsArrayType(AppType(seqSelect.Seq.Type)))\r\n {\r\n seq = new RtlApply(FunName(\"Seq__FromArray\"), new RtlExp[] {\r\n new RtlLiteral(inRequiresOrOld ? \"$absMem_old\" : \"$absMem\"), seq });\r\n }\r\n if (seqSelect.E1 != null)\r\n {\r\n seq = new RtlApply(dafnySpec.GetSeqOperationName(AppType(seqSelect.Type), \"Seq_Take\"),\r\n new RtlExp[] { seq, G(seqSelect.E1) });\r\n }\r\n if (seqSelect.E0 != null)\r\n {\r\n seq = new RtlApply(dafnySpec.GetSeqOperationName(AppType(seqSelect.Type), \"Seq_Drop\"),\r\n new RtlExp[] { seq, G(seqSelect.E0) });\r\n }\r\n return seq;\r\n }\r\n }\r\n else if (seqUpdate != null)\r\n {\r\n if (seqUpdate.ResolvedUpdateExpr != null) {\r\n return GhostExpressionRec(seqUpdate.ResolvedUpdateExpr, inRecSpec, inRequiresOrOld); \r\n } \r\n return new RtlApply(dafnySpec.GetSeqOperationName(AppType(seqUpdate.Seq.Type), \"Seq_Update\"),\r\n new RtlExp[] { G(seqUpdate.Seq), G(seqUpdate.Index), G(seqUpdate.Value) });\r\n }\r\n else if (seqDisplay != null)\r\n {\r\n RtlExp seq = new RtlApply(dafnySpec.GetSeqOperationName(AppType(seqDisplay.Type), \"Seq_Empty\"), new RtlExp[0]);\r\n foreach (Expression ei in seqDisplay.Elements)\r\n {\r\n seq = new RtlApply(dafnySpec.GetSeqOperationName(AppType(seqDisplay.Type), \"Seq_Build\"),\r\n new RtlExp[] { seq, G(ei) });\r\n }\r\n return seq;\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented: \" + exp);\r\n }\r\n }\r\n\r\n public RtlExp GhostExpression(Expression exp, bool inRecSpec = false, bool inRequiresOrOld = false,\r\n Attributes attrs = null)\r\n {\r\n Type oldDefault = StartTypeArg(attrs);\r\n var e = GhostExpressionRec(exp, inRecSpec, inRequiresOrOld);\r\n DafnySpec.defaultPolyType = oldDefault;\r\n return e;\r\n }\r\n\r\n public string DecreasesExp(ICallable target)\r\n {\r\n Util.Assert(!isPrinting);\r\n Expression decrease;\r\n if (target.Decreases.Expressions.Count == 0 && target.Ins.Count > 0)\r\n {\r\n decrease = DafnySpec.MakeIdentifierExpr(target.Ins[0].Name, target.Ins[0].Type,\r\n target.Ins[0].IsGhost);\r\n }\r\n else if (target.Decreases.Expressions.Count == 1)\r\n {\r\n decrease = target.Decreases.Expressions[0];\r\n }\r\n else if (target.Decreases.Expressions.Count > 1)\r\n {\r\n \r\n decrease = target.Decreases.Expressions[0];\r\n \r\n }\r\n else\r\n {\r\n throw new Exception(\"recursive methods must have at least one parameter or supply a decreases clause\");\r\n }\r\n Type decreaseType = AppType(decrease.Type);\r\n if (decreaseType.AsDatatype != null)\r\n {\r\n return \"sizeof##\" + TypeString(decreaseType) + \"(\" + GhostExpression(decrease) + \")\";\r\n }\r\n else if (decreaseType is SeqType)\r\n {\r\n return new RtlApply(dafnySpec.GetSeqOperationName(decreaseType, \"Seq_Length\"),\r\n new RtlExp[] { GhostExpression(decrease) }).ToString();\r\n }\r\n else if (decreaseType.Equals(Type.Int))\r\n {\r\n return GhostExpression(decrease).ToString();\r\n }\r\n else\r\n {\r\n throw new Exception(\"decreases clauses must be an integer or datatype\");\r\n }\r\n }\r\n\r\n public void AddTypeWellFormed(List specs, RtlExp exp, bool isGhost, Type t, List recs)\r\n {\r\n UserDefinedType ut = t as UserDefinedType;\r\n if (minVerify && !isGhost && t is IntType)\r\n {\r\n specs.Add(new RtlApply(\"word\", new RtlExp[] { exp }));\r\n return;\r\n }\r\n if (t is NatType)\r\n {\r\n specs.Add(new RtlBinary(\">=\", exp, new RtlInt(0)));\r\n }\r\n if (ut != null && ut.AsDatatype != null\r\n && recs.TrueForAll(r => ut.Name != r.Name) \r\n )\r\n {\r\n recs.Add(ut);\r\n foreach (var ctor in ut.AsDatatype.Ctors)\r\n {\r\n List cspecs = new List();\r\n foreach (var f in ctor.Formals)\r\n {\r\n AddTypeWellFormed(cspecs, new RtlLiteral(f.Name + \"#\" + ctor.Name + \"(\" + exp + \")\"),\r\n isGhost, f.Type, recs);\r\n }\r\n foreach (var spec in cspecs)\r\n {\r\n specs.Add(new RtlLiteral(\"((\" + exp + \") is \" + ctor.Name + \" ==> (\" + spec + \"))\"));\r\n }\r\n }\r\n recs.RemoveAt(recs.Count - 1);\r\n }\r\n }\r\n\r\n public void AddTypeWellFormed(List specs, string name, bool isGhost, Type t)\r\n {\r\n AddTypeWellFormed(specs, new RtlVar(name, isGhost, t), isGhost, t, new List());\r\n }\r\n\r\n public void AddTypeWellFormed(List specs, List formals)\r\n {\r\n formals.ForEach(f => AddTypeWellFormed(specs, GhostVar(f.Name), f.IsGhost, f.Type));\r\n }\r\n\r\n public List GetTypeWellFormed(List> vars)\r\n {\r\n List exps = new List();\r\n vars.ForEach(x => AddTypeWellFormed(exps, x.Item1, x.Item2, x.Item3));\r\n return exps;\r\n }\r\n\r\n public RtlExp GetTypeWellFormedExp(List> vars, string op, RtlExp rhs)\r\n {\r\n var exps = GetTypeWellFormed(vars);\r\n foreach(var e in exps)\r\n {\r\n rhs = new RtlBinary(op, e, rhs);\r\n }\r\n return rhs;\r\n }\r\n\r\n public void SymdiffLinearityPoint()\r\n {\r\n stmts.Add(new RtlAssert(new RtlLiteral(\"!false\"))); \r\n }\r\n\r\n public void AddGhostCall(List destVars, string name, List args, bool isHeap)\r\n {\r\n List rtlArgs = args.ConvertAll(e => GhostExpression(e));\r\n name = GhostProcName(name);\r\n if (isHeap)\r\n {\r\n rtlArgs.Insert(0, new RtlLiteral(\"$absMem\"));\r\n }\r\n if (name == procName)\r\n {\r\n isRecursive = true;\r\n rtlArgs.Insert(0, new RtlApply(\"decreases_\" + name, new List(rtlArgs)));\r\n name = \"rec_\" + name;\r\n }\r\n stmts.Add(new RtlGhostCall(name, destVars, rtlArgs)\r\n .WithComment(\"call:: \" + String.Join(\",\", destVars) + \" := \" + name\r\n + \"(\" + String.Join(\", \", rtlArgs.ToList()) + \") // isGhost = \" + true));\r\n }\r\n\r\n private void AddGhostCall(List destVars, List args, TypeApply typeApply, bool isHeap)\r\n {\r\n AddGhostCall(destVars, SimpleName(typeApply.AppName()), args, isHeap);\r\n }\r\n\r\n public void AddGhostVarDecl(string varName, Type t, bool isGhost)\r\n {\r\n string name = GhostVar(varName);\r\n if (allVars.ContainsKey(name) || forallVars.Exists(d => d.ContainsKey(name)))\r\n {\r\n AddRename(varName);\r\n name = GhostVar(varName);\r\n }\r\n var dict = (forallVars.Count == 0) ? allVars : forallVars[forallVars.Count - 1];\r\n dict.Add(name, new RtlVar(name, isGhost, AppType(t)));\r\n }\r\n\r\n public void MoveGhost(RtlVar destVar, RtlExp rhs)\r\n {\r\n stmts.Add(new RtlGhostMove(new RtlVar[] { destVar }, new RtlExp[] { rhs }));\r\n }\r\n\r\n public virtual void AddResolvedGhostStatement(Statement stmt, Attributes attrs)\r\n {\r\n BlockStmt block = stmt as BlockStmt;\r\n IfStmt ifStmt = stmt as IfStmt;\r\n AssertStmt assertStmt = stmt as AssertStmt;\r\n AssignStmt assignStmt = stmt as AssignStmt;\r\n CallStmt callStmt = stmt as CallStmt;\r\n VarDeclStmt varDecl = stmt as VarDeclStmt;\r\n CalcStmt calcStmt = stmt as CalcStmt;\r\n ForallStmt forallStmt = stmt as ForallStmt;\r\n AssignSuchThatStmt existsStmt = stmt as AssignSuchThatStmt;\r\n\r\n if (block != null)\r\n {\r\n var oldRenamer = PushRename();\r\n block.Body.ForEach(s => AddGhostStatement(s, attrs));\r\n PopRename(oldRenamer);\r\n }\r\n else if (varDecl != null)\r\n {\r\n foreach (var varLocal in varDecl.Locals) { \r\n AddGhostVarDecl(varLocal.Name, varLocal.Type, varLocal.IsGhost);\r\n }\r\n\r\n if (varDecl.Update != null) { \r\n Util.Assert(varDecl.Update is UpdateStmt || varDecl.Update is AssignSuchThatStmt);\r\n AddGhostStatement((Statement)varDecl.Update, attrs);\r\n //Util.Assert(varDecl.Update.Lhss.Count() == 1);\r\n //var destVar = AsVar(varDecl.Update.Lhss[0]);\r\n //Util.Assert(destVar != null);\r\n //ExprRhs expRhs = ((UpdateStmt)varDecl.Update).Rhss[0] as ExprRhs;\r\n //if (expRhs != null) { \r\n // stmts.Add(new RtlGhostMove(new RtlVar[] { destVar },\r\n // new RtlExp[] { GhostExpression(expRhs.Expr) }));\r\n //} else {\r\n // throw new Exception(\"not implemented: \" + ((UpdateStmt)varDecl.Update).Rhss[0]);\r\n //}\r\n }\r\n }\r\n else if (minVerify)\r\n {\r\n return;\r\n }\r\n else if (assignStmt != null)\r\n {\r\n ExprRhs expRhs = assignStmt.Rhs as ExprRhs;\r\n if (expRhs != null)\r\n {\r\n MemberSelectExpr memberSelect = assignStmt.Lhs as MemberSelectExpr;\r\n RtlVar destVar;\r\n if (memberSelect != null && memberSelect.Member is Field)\r\n {\r\n // assume that this is a global variable; we don't support objects yet\r\n destVar = new RtlVar(GhostVar(memberSelect.MemberName), true, memberSelect.Type);\r\n }\r\n else\r\n {\r\n destVar = AsVar(assignStmt.Lhs);\r\n Util.Assert(destVar != null);\r\n }\r\n stmts.Add(new RtlGhostMove(new RtlVar[] { destVar },\r\n new RtlExp[] { GhostExpression(expRhs.Expr) }));\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented: \" + assignStmt.Rhs);\r\n }\r\n }\r\n else if (callStmt != null)\r\n {\r\n var extraTypeargs = GetTypeArgs(attrs);\r\n var extraTypeargsDict = extraTypeargs.Select((t,index) => Tuple.Create(new TypeParameter(callStmt.Tok, \"Fake\" + index),t)).ToDictionary(tuple => tuple.Item1, tuple => tuple.Item2);\r\n var subst = callStmt.MethodSelect.TypeArgumentSubstitutions().Concat(extraTypeargsDict);\r\n\r\n AddGhostCall(callStmt.Lhs.ConvertAll(AsVar), callStmt.Args,\r\n dafnySpec.Compile_Method((Method)callStmt.MethodSelect.Member,\r\n subst.ToDictionary(p => p.Key, p => AppType(p.Value)),\r\n extraTypeargsDict.Keys.ToList()),\r\n DafnySpec.IsHeapMethod((Method)callStmt.MethodSelect.Member));\r\n SymdiffLinearityPoint();\r\n }\r\n else if (ifStmt != null)\r\n {\r\n stmts.Add(new RtlGhostStmtComputed(s => \"if (\" + s.args[0] + \") {\",\r\n new RtlExp[] { GhostExpression(ifStmt.Guard) }));\r\n Indent();\r\n AddGhostStatement(ifStmt.Thn, attrs);\r\n Unindent();\r\n stmts.Add(new RtlGhostStmtComputed(s => \"}\", new RtlExp[0]));\r\n if (ifStmt.Els != null)\r\n {\r\n stmts.Add(new RtlGhostStmtComputed(s => \"if (\" + s.args[0] + \") {\",\r\n new RtlExp[] {\r\n GhostExpression(new UnaryOpExpr(Bpl.Token.NoToken, UnaryOpExpr.Opcode.Not, ifStmt.Guard)) }));\r\n Indent();\r\n AddGhostStatement(ifStmt.Els, attrs);\r\n Unindent();\r\n stmts.Add(new RtlGhostStmtComputed(s => \"}\", new RtlExp[0]));\r\n }\r\n }\r\n else if (assertStmt != null)\r\n {\r\n stmts.Add(new RtlAssert(GhostExpression(assertStmt.Expr)));\r\n }\r\n else if (forallStmt != null)\r\n {\r\n var oldRenamer = PushRename(forallStmt.BoundVars.Select(v => v.Name));\r\n RtlExp ens = new RtlLiteral(\"true\");\r\n foreach (var e in forallStmt.Ens)\r\n {\r\n ens = new RtlBinary(\"&&\", ens, GhostExpression(e.E));\r\n }\r\n RtlExp range = (forallStmt.Range == null) ? new RtlLiteral(\"true\")\r\n : GhostExpression(forallStmt.Range);\r\n List wellFormed = GetTypeWellFormed(forallStmt.BoundVars.\r\n Select(x => Tuple.Create(GhostVar(x.Name), x.IsGhost, x.Type)).ToList());\r\n wellFormed.ForEach(e => range = new RtlBinary(\"&&\", e, range));\r\n ens = new RtlBinary(\"==>\", range, ens);\r\n string vars = String.Join(\", \", forallStmt.BoundVars.Select(x => GhostVar(x.Name) + \":\" +\r\n TypeString(AppType(x.Type))));\r\n stmts.Add(new RtlGhostStmtComputed(s => \"forall \" + vars + \"::(\" + s.args[0] + \")\",\r\n new List { ens }));\r\n stmts.Add(new RtlGhostStmtComputed(s => \"{\", new RtlExp[0]));\r\n Indent();\r\n stmts.Add(PushForall());\r\n stmts.Add(new RtlGhostStmtComputed(s => \"if (\" + s.args[0] + \")\",\r\n new List { range }));\r\n stmts.Add(new RtlGhostStmtComputed(s => \"{\", new RtlExp[0]));\r\n Indent();\r\n AddGhostStatement(forallStmt.Body, attrs);\r\n foreach (var e in forallStmt.Ens)\r\n {\r\n stmts.Add(new RtlAssert(GhostExpression(e.E)));\r\n }\r\n PopForall();\r\n Unindent();\r\n stmts.Add(new RtlGhostStmtComputed(s => \"}\", new RtlExp[0]));\r\n Unindent();\r\n stmts.Add(new RtlGhostStmtComputed(s => \"}\", new RtlExp[0]));\r\n PopRename(oldRenamer);\r\n }\r\n else if (existsStmt != null)\r\n {\r\n List assigns = new List();\r\n List tmps = new List();\r\n List> varTuples = new List>();\r\n var oldRenamer = PushRename();\r\n foreach (var lhs in existsStmt.Lhss)\r\n {\r\n IdentifierExpr idExp = lhs.Resolved as IdentifierExpr;\r\n RtlVar origVar = AsVar(lhs);\r\n AddRename(idExp.Name);\r\n RtlVar renameVar = AsVar(lhs);\r\n tmps.Add(renameVar);\r\n varTuples.Add(Tuple.Create(renameVar.ToString(), true, idExp.Type));\r\n assigns.Add(new RtlGhostMove(new RtlVar[] { origVar },\r\n new RtlExp[] { renameVar }));\r\n }\r\n string vars = String.Join(\", \", tmps.Select(x => x.getName() + \":\" + TypeString(AppType(x.type))));\r\n stmts.Add(new RtlGhostStmtComputed(s => \"exists \" + vars + \"::(\" + s.args[0] + \");\",\r\n new List {\r\n GetTypeWellFormedExp(varTuples.ToList(), \"&&\", GhostExpression(existsStmt.Expr)) }));\r\n stmts.AddRange(assigns);\r\n PopRename(oldRenamer);\r\n }\r\n else if (calcStmt != null)\r\n {\r\n Util.Assert(calcStmt.Steps.Count == calcStmt.Hints.Count);\r\n CalcStmt.BinaryCalcOp binOp = calcStmt.Op as CalcStmt.BinaryCalcOp;\r\n bool isImply = binOp != null && binOp.Op == BinaryExpr.Opcode.Imp && calcStmt.Steps.Count > 0;\r\n if (isImply)\r\n {\r\n stmts.Add(new RtlGhostStmtComputed(s => \"if (\" + s.args[0] + \")\",\r\n new RtlExp[] { GhostExpression(CalcStmt.Lhs(calcStmt.Steps[0])) }));\r\n stmts.Add(new RtlGhostStmtComputed(s => \"{\", new RtlExp[0]));\r\n Indent();\r\n }\r\n var stepCount = calcStmt.Hints.Last().Body.Count == 0 ? calcStmt.Steps.Count - 1 : calcStmt.Steps.Count;\r\n for (int i = 0; i < stepCount; i++)\r\n {\r\n if (calcStmt.Hints[i] == null)\r\n {\r\n stmts.Add(new RtlAssert(GhostExpression(calcStmt.Steps[i])));\r\n }\r\n else\r\n {\r\n stmts.Add(new RtlGhostStmtComputed(s => \"forall::(\" + s.args[0] + \")\",\r\n new List { GhostExpression(calcStmt.Steps[i]) }));\r\n stmts.Add(new RtlGhostStmtComputed(s => \"{\", new RtlExp[0]));\r\n Indent();\r\n var dict = new Dictionary();\r\n stmts.Add(new RtlGhostStmtComputed(s => String.Concat(dict.Values.Select(\r\n x => \"var \" + x.x + \":\" + TypeString(x.type) + \";\")),\r\n new RtlExp[0]));\r\n forallVars.Add(dict);\r\n AddGhostStatement(calcStmt.Hints[i], attrs);\r\n forallVars.RemoveAt(forallVars.Count - 1);\r\n Unindent();\r\n stmts.Add(new RtlGhostStmtComputed(s => \"}\", new RtlExp[0]));\r\n }\r\n }\r\n if (isImply)\r\n {\r\n Unindent();\r\n stmts.Add(new RtlGhostStmtComputed(s => \"}\", new RtlExp[0]));\r\n }\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented in ghost methods: \" + stmt);\r\n }\r\n }\r\n\r\n public List ResolveStmt(Statement s)\r\n {\r\n /*\r\n ConcreteSyntaxStatement concrete = s as ConcreteSyntaxStatement;\r\n if (concrete != null && concrete.ResolvedStatements != null)\r\n {\r\n return concrete.ResolvedStatements;\r\n }\r\n */\r\n UpdateStmt update = s as UpdateStmt;\r\n if (update != null && update.ResolvedStatements != null)\r\n {\r\n return update.ResolvedStatements;\r\n }\r\n return null;\r\n }\r\n\r\n public List GetTypeArgs(Attributes attrs)\r\n { \r\n var args = Attributes.FindExpressions(attrs, \"typearg\");\r\n var types = new List();\r\n foreach (var arg in args ?? new List()) \r\n { \r\n string s = (string)(((StringLiteralExpr)arg).Value);\r\n switch (s)\r\n {\r\n case \"int\": types.Add(Type.Int) ; break;\r\n case \"bool\": types.Add(Type.Bool); break;\r\n case \"real\": types.Add(Type.Real); break;\r\n default:\r\n if (typeApply.typeSubsts.ContainsKey(s))\r\n {\r\n types.Add(typeApply.typeSubsts[s]);\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented: StartTypeArg: \" + s);\r\n }\r\n break;\r\n }\r\n \r\n }\r\n return types;\r\n }\r\n\r\n public Type StartTypeArg(Attributes attrs)\r\n {\r\n Type prev = DafnySpec.defaultPolyType;\r\n \r\n for (var a = attrs; a != null; a = a.Prev)\r\n {\r\n if (a.Name == \"typearg\")\r\n {\r\n string s = (string)(((StringLiteralExpr)a.Args[0]).Value);\r\n switch (s)\r\n {\r\n case \"int\": DafnySpec.defaultPolyType = Type.Int; break;\r\n case \"bool\": DafnySpec.defaultPolyType = Type.Bool; break;\r\n case \"real\": DafnySpec.defaultPolyType = Type.Real; break;\r\n default:\r\n if (typeApply.typeSubsts.ContainsKey(s))\r\n {\r\n DafnySpec.defaultPolyType = typeApply.typeSubsts[s];\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented: StartTypeArg: \" + s);\r\n }\r\n break;\r\n }\r\n break;\r\n }\r\n }\r\n return prev;\r\n }\r\n\r\n public void AddGhostStatement(Statement stmt, Attributes attribs)\r\n {\r\n Util.Assert(!isPrinting);\r\n stmts.Add(new RtlComment(\"###LINE: \" + stmt.Tok.filename + \": \" + stmt.Tok.line));\r\n List resolved = ResolveStmt(stmt);\r\n if (resolved != null)\r\n {\r\n UpdateStmt u = stmt as UpdateStmt;\r\n if (u != null)\r\n {\r\n Type oldDefault = StartTypeArg(u.Rhss[0].Attributes);\r\n resolved.ForEach(s => AddGhostStatement(s, u.Rhss[0].Attributes));\r\n DafnySpec.defaultPolyType = oldDefault;\r\n }\r\n else\r\n {\r\n resolved.ForEach(s => AddGhostStatement(s, attribs));\r\n }\r\n }\r\n else\r\n {\r\n AddResolvedGhostStatement(stmt, attribs);\r\n }\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/tools/DafnySpec/CompileField.cs", "content": "using System;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Collections.Generic;\r\nusing System.Collections.ObjectModel;\r\nusing Microsoft.Dafny;\r\nusing Bpl = Microsoft.Boogie;\r\nusing Type = Microsoft.Dafny.Type;\r\nusing System.Numerics;\r\n\r\npublic class CompileField\r\n{\r\n DafnySpec dafnySpec;\r\n Field field;\r\n TextWriter iwriter;\r\n\r\n public CompileField(DafnySpec dafnySpec, Field field, TextWriter iwriter)\r\n {\r\n this.dafnySpec = dafnySpec;\r\n this.field = field;\r\n this.iwriter = iwriter;\r\n }\r\n\r\n public void Compile()\r\n {\r\n if (Attributes.Contains(field.Attributes, \"imported\"))\r\n {\r\n //- do nothing\r\n }\r\n else if (field.IsGhost)\r\n {\r\n string rw = Attributes.Contains(field.Attributes, \"readonly\") ? \"readonly \" : \"\";\r\n iwriter.WriteLine(rw + \"var \" + \"$ghost_\" + DafnySpec.CleanName(field.Name) + \":\"\r\n + dafnySpec.TypeString(field.Type) + \";\");\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented: non-ghost global variables\");\r\n }\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/tools/DafnySpec/CompileFunction.cs", "content": "using System;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Collections.Generic;\r\nusing System.Collections.ObjectModel;\r\nusing Microsoft.Dafny;\r\nusing Bpl = Microsoft.Boogie;\r\nusing Type = Microsoft.Dafny.Type;\r\nusing System.Numerics;\r\n\r\npublic class CompileFunction: CompileBase\r\n{\r\n public Function function;\r\n\r\n public CompileFunction(DafnySpec dafnySpec, Function function, TypeApply typeApply,\r\n TextWriter writer, TextWriter iwriter, string moduleName, List imports):\r\n base(dafnySpec, typeApply, writer, iwriter, moduleName, imports)\r\n {\r\n this.function = function;\r\n }\r\n\r\n public void Compile()\r\n {\r\n Util.Assert(!isPrinting);\r\n string name = FunName(DafnySpec.SimpleName(typeApply.AppName()));\r\n string fullName = FunName(DafnySpec.SimpleName(typeApply.AppFullName()));\r\n bool isAxiom = Attributes.Contains(function.Attributes, \"axiom\");\r\n bool isPrivate = Attributes.Contains(function.Attributes, \"private\");\r\n bool hidden = Attributes.Contains(function.Attributes, \"opaque\");\r\n bool isHeap = DafnySpec.IsHeapFunction(function);\r\n List heapParams = isHeap ? new List { \"$absMem:[int][int]int\" } : new List();\r\n List heapArgs = isHeap ? new List { \"$absMem\" } : new List();\r\n var formals = function.Formals;\r\n var reads = function.Reads.Where(e => e.Field != null).ToList().ConvertAll(e =>\r\n new Formal(e.tok, e.FieldName, e.Field.Type, true, e.Field.IsGhost));\r\n formals = reads.Concat(formals).ToList();\r\n if (hidden && formals.Count == 0)\r\n {\r\n formals = new List { new Formal(function.tok, \"___dummy\", Type.Bool, true, true) };\r\n }\r\n if (hidden && !function.Name.EndsWith(\"_FULL\"))\r\n {\r\n ClassDecl cls = (ClassDecl)function.EnclosingClass;\r\n Function full = (Function)cls.Members.Find(m => m.Name == \"#\" + function.Name + \"_FULL\");\r\n dafnySpec.Compile_Function(full, typeApply.typeArgs);\r\n }\r\n bool isFull = hidden && function.Name.EndsWith(\"_FULL\");\r\n string unfullName = isFull ? name.Substring(0, name.Length - \"__FULL\".Length)\r\n .Replace(\"#\", \"\").Replace(\"____HASH\", \"\") : null;\r\n \r\n string argsNoRec = String.Join(\", \", heapArgs.Concat(formals.Select(f => GhostVar(f.Name))));\r\n List reqsNoRec = minVerify ? new List() : function.Req.ConvertAll(e => GhostExpression(e, true));\r\n List enssNoRec = minVerify ? new List() : function.Ens.ConvertAll(e => GhostExpression(e, true));\r\n AddTypeWellFormed(reqsNoRec, formals);\r\n AddTypeWellFormed(enssNoRec, name + \"(\" + argsNoRec + \")\", function.IsGhost, function.ResultType);\r\n if (function.Body != null && !minVerify)\r\n {\r\n \r\n recFunName = name;\r\n stmtExprEnabled = true;\r\n GhostExpression(function.Body);\r\n function.IsRecursive = recCalls.Count != 0;\r\n stmtExprEnabled = false;\r\n stmts = new List();\r\n recCalls = new List>();\r\n recFunName = null;\r\n \r\n }\r\n if (function.IsRecursive)\r\n {\r\n recFunName = name;\r\n }\r\n stmts = new List();\r\n stmtExprEnabled = true;\r\n var bodyDecls = PushForall();\r\n RtlExp body = (function.Body == null || minVerify) ? null : GhostExpression(function.Body);\r\n List bodyStmts = stmts;\r\n PopForall();\r\n stmtExprEnabled = false;\r\n stmts = new List();\r\n string parms = String.Join(\", \", heapParams.Concat(\r\n formals.Select(f => GhostVar(f.Name) + \":\" + TypeString(AppType(f.Type)))));\r\n string args = String.Join(\", \", heapArgs.Concat(\r\n formals.Select(f => GhostVar(f.Name))));\r\n string sep = (heapArgs.Count + formals.Count != 0) ? \", \" : \"\";\r\n string ret = TypeString(AppType(function.ResultType));\r\n string recName = \"rec_\" + name;\r\n string decreases = null;\r\n List reqs = minVerify ? new List() : function.Req.ConvertAll(e => GhostExpression(e, true));\r\n List enss = minVerify ? new List() : function.Ens.ConvertAll(e => GhostExpression(e, true));\r\n AddTypeWellFormed(reqs, formals);\r\n AddTypeWellFormed(enss, name + \"(\" + args + \")\", function.IsGhost, function.ResultType);\r\n string reqConjunct = \"(true\" + String.Concat(reqs.Select(e => \" && (\" + e + \")\")) + \")\";\r\n string ensConjunct = \"(true\" + String.Concat(enss.Select(e => \" && (\" + e + \")\")) + \")\";\r\n Util.Assert(!isPrinting);\r\n if (function.IsRecursive && function.Body != null && !minVerify)\r\n {\r\n decreases = DecreasesExp(function);\r\n }\r\n List enssRec = null;\r\n if (function.IsRecursive && (!hidden || isFull) && body != null && !minVerify)\r\n {\r\n enssRec = function.Ens.ConvertAll(e => GhostExpression(e, true));\r\n }\r\n isPrinting = true;\r\n var fiWriter = isPrivate ? writer : iwriter;\r\n if (function.IsRecursive && function.Body != null && !minVerify)\r\n {\r\n iwriter.WriteLine(\"function decreases0_\" + name + \"(\" + parms + \"):int { \" + decreases + \" }\");\r\n iwriter.WriteLine(\"function decreases_\" + name + \"(\" + parms + \"):int { if decreases0_\"\r\n + name + \"(\" + args + \") < 0 then 0 else 1 + decreases0_\" + name + \"(\" + args + \") }\");\r\n iwriter.WriteLine(\"function \" + recName + \"(__decreases:int, __unroll:int\" + sep + parms\r\n + \"):\" + ret + \";\");\r\n fiWriter.WriteLine(\"function implementation{\" + FunName(\"unroll\") + \"(__unroll), \"\r\n + recName + \"(__decreases, __unroll\" + sep + args + \")} \"\r\n + recName + \"(__decreases:int, __unroll:int\" + sep + parms + \"):\" + ret);\r\n fiWriter.WriteLine(\"{\");\r\n fiWriter.WriteLine(\" \" + body.ToString());\r\n fiWriter.WriteLine(\"}\");\r\n }\r\n iwriter.WriteLine(\"function \" + name + \"(\" + parms + \"):\" + ret + \";\");\r\n if (hidden && !isFull && !minVerify)\r\n {\r\n iwriter.WriteLine(\"function unhide_\" + name + \"(\" + parms + \"):bool { true }\");\r\n fiWriter.WriteLine(\"function implementation{unhide_\" + name + \"(\" + args + \")} \"\r\n + name + \"(\" + parms + \"):\" + ret);\r\n fiWriter.WriteLine(\"{\");\r\n fiWriter.WriteLine(\" \" + fullName + \"(\" + args + \")\");\r\n fiWriter.WriteLine(\"}\");\r\n iwriter.WriteLine(\"atomic ghost procedure \"\r\n + GhostProcName(\"reveal__\" + DafnySpec.SimpleName(typeApply.AppName())) + \"();\");\r\n string forall = \"forall \" + parms + \"::\" + name + \"(\" + args + \") == \"\r\n + fullName + \"(\" + args +\")\";\r\n iwriter.WriteLine(\" ensures (\" + forall + \");\");\r\n writer.WriteLine(\"implementation \"\r\n + GhostProcName(\"reveal__\" + DafnySpec.SimpleName(typeApply.AppName())) + \"()\");\r\n writer.WriteLine(\"{\");\r\n writer.WriteLine(\" \" + forall);\r\n writer.WriteLine(\" {\");\r\n writer.WriteLine(\" assert unhide_\" + name + \"(\" + args + \");\");\r\n writer.WriteLine(\" }\");\r\n writer.WriteLine(\"}\");\r\n }\r\n if (body != null && (!hidden || isFull))\r\n {\r\n fiWriter.WriteLine(\"function implementation{\" + name + \"(\" + args + \")\" + \"} \" + name\r\n + \"(\" + parms + \"):\" + ret);\r\n fiWriter.WriteLine(\"{\");\r\n if (function.IsRecursive)\r\n {\r\n fiWriter.WriteLine(\" \" + recName + \"(decreases_\" + name + \"(\" + args + \"), 0\" + sep + args + \")\");\r\n }\r\n else\r\n {\r\n fiWriter.WriteLine(\" \" + body.ToString());\r\n }\r\n fiWriter.WriteLine(\"}\");\r\n }\r\n if (function.IsRecursive && (!hidden || isFull) && body != null && !minVerify)\r\n {\r\n AddTypeWellFormed(enssRec, recName + \"(__decreases, __unroll\" + sep + args + \")\",\r\n function.IsGhost, function.ResultType);\r\n string ensRecConjunct = \"(true\" + String.Concat(enssRec.Select(e => \" && (\" + e + \")\")) + \")\";\r\n iwriter.WriteLine(\"atomic ghost procedure lemma_unroll2_\" + recName\r\n + \"(__decreases:int, __unroll:int, __unroll2:int\" + sep + parms + \");\");\r\n iwriter.WriteLine(\" requires __decreases == decreases_\" + name + \"(\" + args + \");\");\r\n iwriter.WriteLine(\" ensures \" + reqConjunct + \" ==> \" + ensRecConjunct + \" && \"\r\n + recName + \"(__decreases, __unroll\" + sep + args + \") == \"\r\n + recName + \"(__decreases, __unroll2\" + sep + args + \");\");\r\n \r\n writer.WriteLine(\"implementation lemma_unroll2_\" + recName\r\n + \"(__decreases:int, __unroll:int, __unroll2:int\" + sep + parms + \")\");\r\n writer.WriteLine(\"{\");\r\n writer.WriteLine(\" \" + bodyDecls);\r\n writer.WriteLine(\" assert fun_unroll(__unroll) && fun_unroll(__unroll2);\");\r\n dafnySpec.WriteLemmas(writer, this, visibleModules, function.Attributes);\r\n writer.WriteLine(\" if (\" + reqConjunct + \")\");\r\n writer.WriteLine(\" {\");\r\n bodyStmts.ForEach(s => writer.WriteLine(\" \" + s));\r\n writer.WriteLine(\" }\");\r\n foreach (List recArgs in recCalls)\r\n {\r\n string rec_args = String.Join(\", \", recArgs);\r\n string rec_decrease = \"decreases_\" + name + \"(\" + rec_args + \")\";\r\n writer.WriteLine(\" if (0 <= \" + rec_decrease + \" && \" + rec_decrease + \" < __decreases)\");\r\n writer.WriteLine(\" {\");\r\n writer.WriteLine(\" call lemma_unroll2_\" + recName + \"(\" + rec_decrease\r\n + \", __unroll + 1, __unroll2 + 1\" + sep + rec_args + \");\");\r\n writer.WriteLine(\" }\");\r\n }\r\n writer.WriteLine(\"}\");\r\n string unroll_args = \"decreases_\" + name + \"(\" + args + \"), __unroll\";\r\n string unroll_args0 = \"decreases_\" + name + \"(\" + args + \"), 0\";\r\n string unroll = recName + \"(\" + unroll_args + sep + args + \")\";\r\n string unroll0 = recName + \"(\" + unroll_args0 + sep + args + \")\";\r\n\r\n \r\n var lwriter = isPrivate ? writer : iwriter;\r\n string recForall = \"forall __unroll:int\" + sep + parms + \"::\"\r\n + \"{fun_unroll(__unroll), \" + unroll + \"} \"\r\n + reqConjunct + \" ==> fun_unroll(__unroll) ==> \" + unroll + \" == \" + body;\r\n lwriter.WriteLine(\"atomic ghost procedure lemma_unroll_\" + recName + \"();\");\r\n lwriter.WriteLine(\" ensures (\" + recForall + \");\");\r\n writer.WriteLine(\"implementation lemma_unroll_\" + recName + \"()\");\r\n writer.WriteLine(\"{\");\r\n dafnySpec.WriteLemmas(writer, this, visibleModules, function.Attributes);\r\n writer.WriteLine(\" \" + recForall);\r\n writer.WriteLine(\" {\");\r\n writer.WriteLine(\" \" + bodyDecls);\r\n writer.WriteLine(\" if (\" + reqConjunct + \")\");\r\n writer.WriteLine(\" {\");\r\n bodyStmts.ForEach(s => writer.WriteLine(\" \" + s));\r\n writer.WriteLine(\" }\");\r\n writer.WriteLine(\" }\");\r\n writer.WriteLine(\"}\");\r\n dafnySpec.AddLemma(new LemmaCall((isPrivate ? \"private##\" : \"\") + moduleName,\r\n visibleElementType,\r\n \"call lemma_unroll_\" + recName + \"();\",\r\n false));\r\n\r\n Func forall = s => \"forall __unroll:int\" + sep + parms + \"::\"\r\n + \"{\" + s + unroll + \"} \"\r\n + \"{fun_unroll__all(__unroll), \" + unroll + \"} \"\r\n + reqConjunct + \" ==> \" + unroll + \" == \" + name + \"(\" + args + \") && \" + ensConjunct;\r\n iwriter.WriteLine(\"atomic ghost procedure lemma_unroll_\" + name + \"();\");\r\n iwriter.WriteLine(\" ensures (\" + forall(unroll0 + \", \") + \");\");\r\n writer.WriteLine(\"implementation lemma_unroll_\" + name + \"()\");\r\n writer.WriteLine(\"{\");\r\n dafnySpec.WriteLemmas(writer, this, visibleModules, function.Attributes);\r\n writer.WriteLine(\" \" + forall(\"\"));\r\n writer.WriteLine(\" {\");\r\n writer.WriteLine(\" call lemma_unroll2_\" + recName + \"(\"\r\n + unroll_args + \", 0\" + sep + args + \");\");\r\n writer.WriteLine(\" if (\" + reqConjunct + \")\");\r\n writer.WriteLine(\" {\");\r\n enss.ForEach(e => writer.WriteLine(\" assert \" + e + \";\"));\r\n writer.WriteLine(\" }\");\r\n writer.WriteLine(\" }\");\r\n writer.WriteLine(\"}\");\r\n dafnySpec.AddLemma(new LemmaCall(moduleName, visibleElementType,\r\n \"call lemma_unroll_\" + name + \"();\", false));\r\n }\r\n else if (enssNoRec.Count > 0 && !minVerify)\r\n {\r\n string reqConjunctNoRec = \"(true\" + String.Concat(reqsNoRec.Select(e => \" && (\" + e + \")\")) + \")\";\r\n string ensConjunctNoRec = \"(true\" + String.Concat(enssNoRec.Select(e => \" && (\" + e + \")\")) + \")\";\r\n iwriter.WriteLine(\"function trigger_\" + name + \"(\" + parms + \"):bool { true }\");\r\n iwriter.WriteLine(\"atomic ghost procedure lemma_fun_ensures_\" + name + \"();\");\r\n string forallNoRec = \"forall \" + parms\r\n + \"::{\" + name + \"(\" + argsNoRec + \")}\"\r\n + (isFull ? (\"{\" + unfullName + \"(\" + argsNoRec + \")}\") : \"\")\r\n + \"{trigger_\" + name + \"(\" + argsNoRec + \")}\"\r\n + \"trigger_\" + name + \"(\" + argsNoRec + \") ==> \"\r\n + reqConjunctNoRec + \" ==> \" + ensConjunctNoRec;\r\n iwriter.WriteLine(\" ensures (\" + forallNoRec + \");\");\r\n if (body != null || hidden || isAxiom)\r\n {\r\n writer.WriteLine(\"implementation lemma_fun_ensures_\" + name + \"()\");\r\n writer.WriteLine(\"{\");\r\n dafnySpec.WriteLemmas(writer, this, visibleModules, function.Attributes);\r\n writer.WriteLine(\" \" + forallNoRec);\r\n writer.WriteLine(\" {\");\r\n writer.WriteLine(\" \" + bodyDecls);\r\n writer.WriteLine(\" if (\" + reqConjunct + \")\");\r\n writer.WriteLine(\" {\");\r\n if (isAxiom)\r\n {\r\n writer.WriteLine(\" // dummy lemma body for axiom\");\r\n }\r\n else\r\n {\r\n bodyStmts.ForEach(s => writer.WriteLine(\" \" + s));\r\n }\r\n writer.WriteLine(\" }\");\r\n if (hidden && !isFull)\r\n {\r\n writer.WriteLine(\" assert unhide_\" + name + \"(\" + argsNoRec + \");\");\r\n }\r\n if (hidden && isFull)\r\n {\r\n writer.WriteLine(\" assert unhide_\" + unfullName + \"(\" + argsNoRec + \");\");\r\n }\r\n writer.WriteLine(\" if (\" + reqConjunct + \")\");\r\n writer.WriteLine(\" {\");\r\n enssNoRec.ForEach(e => writer.WriteLine(\" assert \" + e + \";\"));\r\n writer.WriteLine(\" }\");\r\n writer.WriteLine(\" }\");\r\n writer.WriteLine(\"}\");\r\n }\r\n dafnySpec.AddLemma(new LemmaCall(moduleName, visibleElementType,\r\n \"call lemma_fun_ensures_\" + name + \"();\", false));\r\n }\r\n isPrinting = false;\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/DafnySpec/CompileMethodGhost.cs", "content": "using System;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Collections.Generic;\r\nusing System.Collections.ObjectModel;\r\nusing Microsoft.Dafny;\r\nusing Bpl = Microsoft.Boogie;\r\nusing Type = Microsoft.Dafny.Type;\r\nusing System.Numerics;\r\n\r\npublic class CompileMethodGhost: CompileBase\r\n{\r\n protected Method method;\r\n protected bool isGhost;\r\n protected List calledMethods = new List();\r\n\r\n public CompileMethodGhost(DafnySpec dafnySpec, Method method, TypeApply typeApply,\r\n TextWriter writer, TextWriter iwriter, string moduleName, List imports):\r\n base(dafnySpec, typeApply, writer, iwriter, moduleName, imports)\r\n {\r\n this.method = method;\r\n }\r\n\r\n public List GetStaticFieldMods()\r\n {\r\n return (method.Mod.Expressions.Exists(e => e.E is ThisExpr && e.FieldName == null))\r\n ? dafnySpec.allStaticFields.ConvertAll(x => GhostVar(x))\r\n : method.Mod.Expressions.Where(e => e.E is ThisExpr).Select(e => GhostVar(e.FieldName)).ToList();\r\n }\r\n\r\n public void CompileGhost(string name, string parms, string rets, string req, Action printBody)\r\n {\r\n List reqs = method.Req.ConvertAll(a => GhostExpression(a.E, false, false, a.Attributes)); \r\n List enss = method.Ens.ConvertAll(a => GhostExpression(a.E, false, false, a.Attributes));\r\n AddTypeWellFormed(reqs, method.Ins);\r\n AddTypeWellFormed(enss, method.Outs);\r\n Util.Assert(!isPrinting);\r\n isPrinting = true;\r\n iwriter.WriteLine(\"atomic ghost procedure \" + name + \"(\" + parms + \") returns(\" + rets + \");\");\r\n if (req != null)\r\n {\r\n iwriter.WriteLine(\" requires \" + req + \";\");\r\n }\r\n reqs.ForEach(e => iwriter.WriteLine(\" requires \" + e + \";\"));\r\n enss.ForEach(e => iwriter.WriteLine(\" ensures \" + e + \";\"));\r\n GetStaticFieldMods().ForEach(x => iwriter.WriteLine(\" modifies \" + x + \";\"));\r\n if (printBody != null)\r\n {\r\n writer.WriteLine(\"implementation \" + name + \"(\" + parms + \") returns(\" + rets + \")\");\r\n writer.WriteLine(\"{\");\r\n allVars.Keys\r\n .Where(x => !method.Ins.Select(y => GhostVar(y.Name)).ToList().Contains(x)\r\n && !method.Outs.Select(y => GhostVar(y.Name)).ToList().Contains(x)).ToList()\r\n .ForEach(x => writer.WriteLine(\" var \" + x + \":\" + TypeString(allVars[x].type) + \";\"));\r\n dafnySpec.WriteLemmas(writer, this, visibleModules, method.Attributes);\r\n printBody();\r\n writer.WriteLine(\"}\");\r\n }\r\n isPrinting = false;\r\n }\r\n\r\n public void CompileGhost()\r\n {\r\n bool isAxiom = Attributes.Contains(method.Attributes, \"axiom\");\r\n bool isHeap = DafnySpec.IsHeapMethod(method);\r\n BlockStmt body = method.Body;\r\n List heapParams = isHeap ? new List { \"$absMem:[int][int]int\" } : new List();\r\n List heapArgs = isHeap ? new List { \"$absMem\" } : new List();\r\n string parms = String.Join(\", \", heapParams.Concat(\r\n method.Ins.Select(x => GhostVar(x.Name) + \":\" + TypeString(AppType(x.Type)))));\r\n string rets = String.Join(\", \", method.Outs.Select(x => GhostVar(x.Name) + \":\" + TypeString(AppType(x.Type))));\r\n if (body != null)\r\n {\r\n foreach (Statement stmt in body.Body)\r\n {\r\n AddGhostStatement(stmt, null);\r\n }\r\n Action printStmts = () =>\r\n {\r\n string indent = \" \";\r\n foreach (RtlStmt s in stmts)\r\n {\r\n RtlIndent rtlIndent = s as RtlIndent;\r\n if (rtlIndent != null)\r\n {\r\n indent = rtlIndent.Positive ? indent + \" \" : indent.Substring(4);\r\n continue;\r\n }\r\n if (s.comment != null)\r\n {\r\n writer.WriteLine(indent + \"// \" + s.comment().Replace(Environment.NewLine, Environment.NewLine + indent));\r\n }\r\n if (s.ToString() != \"\")\r\n {\r\n writer.WriteLine(indent + s.ToString().Replace(Environment.NewLine, Environment.NewLine + indent));\r\n }\r\n }\r\n };\r\n if (isRecursive)\r\n {\r\n Util.Assert(!isPrinting);\r\n string decreases = DecreasesExp(method);\r\n isPrinting = true;\r\n iwriter.WriteLine(\"function decreases_\" + procName + \"(\" + parms + \"):int { \" + decreases + \" }\");\r\n isPrinting = false;\r\n string applyDecrease = \"decreases_\" + procName + \"(\"\r\n + String.Join(\", \", heapArgs.Concat(method.Ins.Select(x => GhostVar(x.Name)))) + \")\";\r\n string sep = (method.Ins.Count + heapArgs.Count == 0) ? \"\" : \", \";\r\n CompileGhost(\"rec_\" + procName, \"__decreases:int\" + sep + parms, rets,\r\n \"__decreases == \" + applyDecrease, printStmts);\r\n CompileGhost(procName, parms, rets, null, () =>\r\n {\r\n writer.WriteLine(\" call \" + String.Join(\", \", method.Outs.Select(x => GhostVar(x.Name)))\r\n + (method.Outs.Count == 0 ? \"\" : \" := \") + \"rec_\" + procName + \"(\" + applyDecrease\r\n + String.Concat(heapArgs.Concat(method.Ins.Select(x => GhostVar(x.Name)))\r\n .Select(x => \", \" + x)) + \");\");\r\n });\r\n }\r\n else\r\n {\r\n CompileGhost(procName, parms, rets, null, printStmts);\r\n }\r\n }\r\n else if (isAxiom)\r\n {\r\n CompileGhost(procName, parms, rets, null, () => writer.WriteLine(\" // dummy method body for axiom\"));\r\n }\r\n else\r\n {\r\n CompileGhost(procName, parms, rets, null, null);\r\n }\r\n }\r\n\r\n public virtual void Compile()\r\n {\r\n Util.Assert(!isPrinting);\r\n \r\n isGhost = method is Lemma || method.IsGhost;\r\n bool isImported = Attributes.Contains(method.Attributes, \"imported\");\r\n bool isAxiom = Attributes.Contains(method.Attributes, \"axiom\");\r\n if (isImported && method.Body == null)\r\n {\r\n return;\r\n }\r\n if (!isGhost)\r\n {\r\n throw new Exception(\"only ghost methods can appear in specifications\");\r\n }\r\n procName = GhostProcName(SimpleName(typeApply.AppName()));\r\n if (method.Body == null && method.Name.StartsWith(\"reveal_\")) \r\n {\r\n return;\r\n }\r\n CompileGhost();\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/DafnySpec/DafnyPrelude.dfy", "content": "///////////////////////////////////////////////////////////////////\r\n\r\n///////////////////////////////////////////////////////////////////\r\n\r\n\r\n \r\n\r\n///////////////////////////////////////////////////////////////////\r\n\r\nstatic function INTERNAL_mul(x:int, y:int) : int { x * y } // Formerly anonymous function\r\n\r\n\r\n\r\n\r\n\r\n\r\n//\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nstatic function INTERNAL_mod(x:int, m:int) : int { x % m } // Formerly anonymous function\r\n\r\n\r\n\r\n \r\n\r\n\r\n\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nstatic function INTERNAL_div(x:int, m:int) : int { x / m } // Formerly anonymous function\r\n \r\n\r\n\r\n\r\n\r\n \r\n\r\n\r\n\r\n\r\n\r\n\r\n//\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n \r\n\r\n\r\n//\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nfunction dummy_seqs(i:seq, b:seq, ii:seq>, bb:seq>):bool\r\n\r\n\r\n\r\n\r\n\r\n" }, { "path": "ironclad-apps/tools/DafnySpec/DafnySpec.cs", "content": "using System;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Collections.Generic;\r\nusing System.Collections.ObjectModel;\r\nusing Microsoft.Dafny;\r\nusing Bpl = Microsoft.Boogie;\r\nusing Type = Microsoft.Dafny.Type;\r\nusing System.Numerics;\r\n\r\npublic class DafnySpec_Options: DafnyOptions\r\n{\r\n public string outDir;\r\n public bool minVerify = false;\r\n\r\n protected override bool ParseOption(string name, Bpl.CommandLineOptionEngine.CommandLineParseState ps)\r\n {\r\n switch (name) {\r\n case \"outdir\":\r\n if (ps.ConfirmArgumentCount(1))\r\n {\r\n outDir = ps.args[ps.i];\r\n }\r\n return true;\r\n case \"minVerify\":\r\n minVerify = true;\r\n return true;\r\n default:\r\n break;\r\n }\r\n return base.ParseOption(name, ps);\r\n }\r\n}\r\n\r\npublic class LemmaCall\r\n{\r\n public readonly string module;\r\n public readonly Type type;\r\n public readonly string stmt;\r\n public readonly bool loopLemma;\r\n\r\n public LemmaCall(string module, Type type, string stmt, bool loopLemma)\r\n {\r\n this.module = module;\r\n this.type = type;\r\n this.stmt = stmt;\r\n this.loopLemma = loopLemma;\r\n }\r\n}\r\n\r\npublic class NonglobalVariable \r\n{\r\n public static string CompilerizeName(string s) \r\n {\r\n return s.Replace(\"_\", \"__\");\r\n }\r\n\r\n}\r\n\r\npublic class DafnySpec\r\n{\r\n public const string ImpBasmExtn = \".imp.basm\";\r\n public const string IfcBasmExtn = \".ifc.basm\";\r\n\r\n protected TextWriter trustedWriter = null;\r\n protected TextWriter trustedIWriter = null;\r\n protected string outDir = null;\r\n protected TextWriter outListWriter = null;\r\n public bool minVerify = false;\r\n protected Dictionary> fileImports = new Dictionary>();\r\n protected Dictionary compileMethods = new Dictionary();\r\n protected Dictionary compileFunctions = new Dictionary();\r\n protected Dictionary compileDatatypes = new Dictionary();\r\n protected List compileDatatypeList = new List();\r\n protected Dictionary allMethods = new Dictionary();\r\n protected Dictionary allFunctions = new Dictionary();\r\n protected Dictionary allDatatypes = new Dictionary();\r\n public List allStaticFields = new List();\r\n public static Type defaultDefaultPolyType = Type.Int;\r\n public static Type defaultPolyType = defaultDefaultPolyType; // HACK\r\n protected Dictionary>> outDirWriters =\r\n new Dictionary>>(StringComparer.CurrentCultureIgnoreCase);\r\n\r\n public static void Main(string[] args)\r\n {\r\n try\r\n {\r\n Util.DebugWriteLine(\"hello\");\r\n DafnySpec_Options options = new DafnySpec_Options();\r\n DafnyOptions.Install(options);\r\n Bpl.CommandLineOptions.Clo.RunningBoogieFromCommandLine = true;\r\n if (!Bpl.CommandLineOptions.Clo.Parse(args))\r\n {\r\n throw new Exception(\"argument parse error\");\r\n }\r\n IList files = Bpl.CommandLineOptions.Clo.Files;\r\n if (files.Count == 0)\r\n {\r\n throw new Exception(\"*** Error: No input files were specified.\");\r\n }\r\n new DafnySpec().CompileSpec(options, files);\r\n }\r\n catch (Exception e)\r\n {\r\n Console.OpenStandardOutput().Flush();\r\n Console.WriteLine(e);\r\n Console.Error.WriteLine(e);\r\n Environment.Exit(-1);\r\n }\r\n }\r\n\r\n public static string CleanName(string x)\r\n {\r\n return x.Replace(\"'\", \"___PRIME_\").Replace(\"#\", \"___HASH_\");\r\n }\r\n\r\n public static string GhostProcName(string x) { return \"proc_\" + CleanName(x); }\r\n public static string FunName(string x) { return \"fun_\" + CleanName(x); }\r\n public static string SimpleName(string x) { return x.Contains('.') ? x.Substring(x.LastIndexOf('.') + 1) : x; }\r\n\r\n public static string SanitizedName(MemberDecl m) \r\n {\r\n return /* m.EnclosingClass.FullSanitizedName + \".\" + */ NonglobalVariable.CompilerizeName(m.Name.Replace(\"#\", \"&\")).Replace(\"&\", \"#\");\r\n }\r\n\r\n public static string SimpleSanitizedName(MemberDecl m) { return SimpleName(SanitizedName(m)); }\r\n\r\n public static bool IsArrayType(Type t)\r\n {\r\n return t is UserDefinedType && ((UserDefinedType)t).Name == \"array\";\r\n }\r\n\r\n public static bool IsHeapFunction(Function f)\r\n {\r\n // TODO: use f.Reads?\r\n return Attributes.Contains(f.Attributes, \"heap\")\r\n || f.Formals.Exists(p => IsArrayType(p.Type)) || IsArrayType(f.ResultType);\r\n }\r\n\r\n public static bool IsHeapMethod(Method m)\r\n {\r\n return Attributes.Contains(m.Attributes, \"heap\")\r\n || !m.IsGhost\r\n || m.Ins.Exists(p => IsArrayType(p.Type))\r\n || m.Outs.Exists(p => IsArrayType(p.Type));\r\n }\r\n\r\n public static bool IsPtrType(Type t)\r\n {\r\n return !(t is BoolType) && !(t is IntType) && !(t is NatType) && !(t is RealType);\r\n }\r\n\r\n public static IdentifierExpr MakeIdentifierExpr(string name, Type type, bool isGhost)\r\n {\r\n Util.Assert(type != null);\r\n IdentifierExpr id = new IdentifierExpr(Bpl.Token.NoToken, name);\r\n id.Type = type;\r\n id.Var = new LocalVariable(Bpl.Token.NoToken, Bpl.Token.NoToken, name, type, isGhost);\r\n return id;\r\n }\r\n\r\n public static BinaryExpr MakeBinaryExpr(BinaryExpr.Opcode op,\r\n BinaryExpr.ResolvedOpcode rop, Type t, Expression e0, Expression e1)\r\n {\r\n Util.Assert(t != null && e0.Type != null && e1.Type != null);\r\n BinaryExpr e = new BinaryExpr(e0.tok, op, e0, e1);\r\n e.ResolvedOp = rop;\r\n e.Type = t;\r\n return e;\r\n }\r\n\r\n public static Type ToType(Type t)\r\n {\r\n TypeProxy proxy = t as TypeProxy;\r\n if (proxy != null && proxy.T == null)\r\n {\r\n Util.Assert(false); // Dafny appears to be doing sane type resolution now\r\n return defaultPolyType; //- pick arbitrary type\r\n }\r\n if (proxy != null)\r\n {\r\n return ToType(proxy.T);\r\n }\r\n return t;\r\n }\r\n\r\n public string TypeString(Type t)\r\n {\r\n t = ToType(t);\r\n MapType mt = t as MapType;\r\n UserDefinedType ut = t as UserDefinedType;\r\n SeqType seq = t as SeqType;\r\n\r\n if (t is BoolType)\r\n {\r\n return \"bool\";\r\n }\r\n else if (t is IntType)\r\n {\r\n return \"int\";\r\n }\r\n else if (t is RealType)\r\n {\r\n return \"real\";\r\n }\r\n else if (mt != null)\r\n { \r\n return \"[\" + TypeString(mt.Domain) + \"]\" + TypeString(mt.Range);\r\n }\r\n else if (ut != null && ut.AsDatatype != null)\r\n {\r\n return Compile_Datatype(ut).AppName();\r\n }\r\n else if (ut != null && ut.Name == \"array\")\r\n {\r\n if (!(ToType(ut.TypeArgs[0]) is IntType) || ToType(ut.TypeArgs[0]) is NatType)\r\n {\r\n throw new Exception(\"not implemented: arrays of non-int types: \" + ToType(ut.TypeArgs[0]));\r\n }\r\n return \"ArrayOfInt\";\r\n }\r\n else if (ut != null && ut.Name == \"INTERNAL_AbsMem\")\r\n {\r\n return \"[int][int]int\";\r\n }\r\n else if (ut != null && ut.Name == \"INTERNAL_ArrayElems\")\r\n {\r\n return \"[int]int\";\r\n }\r\n else if (ut != null && !ut.IsTypeParameter)\r\n {\r\n return ut.Name;\r\n }\r\n else if (seq != null)\r\n {\r\n return Compile_SeqType(seq).AppName();\r\n }\r\n else\r\n {\r\n throw new Exception(\"not implemented: \" + t + \": \" + t.GetType());\r\n }\r\n }\r\n\r\n public Method FindMethod(string name)\r\n {\r\n if (allMethods.ContainsKey(name))\r\n {\r\n return allMethods[name];\r\n }\r\n else\r\n {\r\n throw new Exception(\"could not find method \" + name);\r\n }\r\n }\r\n\r\n public Function FindFunction(string name)\r\n {\r\n if (allFunctions.ContainsKey(name))\r\n {\r\n return allFunctions[name];\r\n }\r\n else\r\n {\r\n throw new Exception(\"could not find function \" + name);\r\n }\r\n }\r\n\r\n public DatatypeDecl FindDatatype(string name)\r\n {\r\n if (allDatatypes.ContainsKey(name))\r\n {\r\n return allDatatypes[name];\r\n }\r\n else\r\n {\r\n throw new Exception(\"could not find datatype \" + name);\r\n }\r\n }\r\n\r\n public virtual void AddLemma(LemmaCall lemma)\r\n {\r\n }\r\n\r\n public virtual void AddMethodAsLemma(Method method)\r\n {\r\n }\r\n\r\n public virtual void WriteLemmas(TextWriter writer, CompileBase context, List visibleModules, Attributes attrs,\r\n bool loopLemmasOnly = false)\r\n {\r\n }\r\n\r\n // This emits way overkill, as it doesn't exploit import inheritance.\r\n // But it's autogenerated code, so we don't care, I guess. --jonh\r\n public void WriteInterfaceImports(TextWriter writer, IEnumerable importList)\r\n {\r\n foreach (string module in importList)\r\n {\r\n\t\t\tstring importWord = \"//private-import\";\r\n writer.WriteLine(\" \"+importWord+\" \"+module+\";\");\r\n }\r\n }\r\n\r\n public IEnumerable GatherAllImports(List imports)\r\n {\r\n IEnumerable stockImports = new string[] {\r\n \"BaseSpec\", \"MemorySpec\", \"IoTypesSpec\", \"MachineStateSpec\", \"AssemblySpec\", \"InterruptsSpec\", \"IoSpec\", \"Overflow\",\r\n \"Core\", \"LogicalAddressing\", \"Util\", \"Stacks\", \"Partition\", \"Instructions\", \"Separation\",\r\n \"IntLemmasGc\", \"SimpleGcMemory\", \"SimpleCommon\", \"SimpleCollector\",\r\n \"IntLemmasMain\", \"IntLemmasBase\", \"IoMain\"\r\n };\r\n return stockImports.Concat(imports);\r\n }\r\n\r\n public void WriteImplementationHeader(TextWriter writer, string name, List imports)\r\n {\r\n writer.WriteLine(\"module implementation \" + name);\r\n WriteInterfaceImports(writer, GatherAllImports(imports));\r\n writer.WriteLine(\"{\");\r\n }\r\n\r\n // TODO: this should be based on attributes, not based on the name\r\n public bool IsSeqFile(string filename, bool spec)\r\n {\r\n return filename.EndsWith(spec ? @\"\\Seq.s.dfy\" : @\"\\Seq.dfy\");\r\n }\r\n\r\n // TODO: this should be based on attributes, not based on the name\r\n public bool IsSpecFile(string filename)\r\n {\r\n return filename.EndsWith(@\".s.dfy\");\r\n }\r\n\r\n public string ModuleNameFromFilename(string filename)\r\n {\r\n string suffix = Path.GetFileNameWithoutExtension(filename).Replace(\"-\", \"_\").Replace(\".\", \"_\");\r\n return \"dafny_\" + suffix;\r\n }\r\n\r\n public void AddImports(Dictionary imports, string filename)\r\n {\r\n Dictionary myImports;\r\n if (!fileImports.ContainsKey(filename))\r\n {\r\n myImports = new Dictionary(StringComparer.CurrentCultureIgnoreCase);\r\n StreamReader reader = new StreamReader(filename);\r\n while (true)\r\n {\r\n string line = reader.ReadLine();\r\n if (line == null)\r\n {\r\n reader.Close();\r\n break;\r\n }\r\n string[] tokens = line.Trim().Split(' ');\r\n if (tokens.Length >= 2 && tokens[0] == \"include\" && tokens[1].StartsWith(\"\\\"\")\r\n && tokens[1].EndsWith(\"\\\"\"))\r\n {\r\n string imp = tokens[1].Substring(1, tokens[1].Length - 2).Replace('/', '\\\\');\r\n if (filename.EndsWith(\".s.dfy\") && imp.EndsWith(\".i.dfy\"))\r\n {\r\n throw new Exception(\"specification \" + filename + \" includes implementation \" + imp);\r\n }\r\n if (!Path.IsPathRooted(imp))\r\n {\r\n imp = Path.Combine(Path.GetDirectoryName(filename), imp);\r\n }\r\n imp = new FileInfo(imp).FullName;\r\n AddImports(myImports, imp);\r\n string moduleName = ModuleNameFromFilename(imp);\r\n if (!myImports.ContainsKey(moduleName))\r\n {\r\n myImports.Add(moduleName, imp);\r\n }\r\n }\r\n }\r\n fileImports.Add(filename, myImports);\r\n }\r\n myImports = fileImports[filename];\r\n foreach (var p in myImports)\r\n {\r\n if (!imports.ContainsKey(p.Key))\r\n {\r\n imports.Add(p.Key, p.Value);\r\n }\r\n }\r\n }\r\n\r\n public virtual Tuple> ChooseOutDirWriter(string filename)\r\n {\r\n if (!outDirWriters.ContainsKey(filename))\r\n {\r\n string moduleName = ModuleNameFromFilename(filename);\r\n string baseName = Path.Combine(outDir, moduleName);\r\n TextWriter implWriter = new StreamWriter(baseName + ImpBasmExtn);\r\n TextWriter intfWriter = new StreamWriter(baseName + IfcBasmExtn);\r\n Dictionary imports = new Dictionary(StringComparer.CurrentCultureIgnoreCase);\r\n imports.Add(\"Trusted\", \"\");\r\n if (moduleName != \"dafny_DafnyPrelude\")\r\n {\r\n imports.Add(\"dafny_DafnyPrelude\", \"\");\r\n\t\t\t\tif (moduleName.EndsWith(\"_i\"))\r\n\t\t\t\t{\r\n\t\t\t\t\timports.Add(\"DafnyAssembly\", \"\");\r\n\t\t\t\t}\r\n }\r\n AddImports(imports, filename);\r\n List importModules = imports.Keys.ToList();\r\n if (outListWriter != null && moduleName != \"dafny_DafnyPrelude\")\r\n {\r\n outListWriter.WriteLine(moduleName + String.Concat(\r\n imports.Where(x => x.Value != \"\").Select(x => \" \" + x.Key)));\r\n }\r\n WriteImplementationHeader(implWriter, moduleName, importModules);\r\n\t\t\tWriteInterfaceImports(intfWriter, GatherAllImports(importModules));\r\n intfWriter.WriteLine(\"module interface \" + moduleName);\r\n intfWriter.WriteLine(\"{\");\r\n outDirWriters.Add(filename, Tuple.Create(implWriter, intfWriter, moduleName, importModules));\r\n //- make sure each import gets a file:\r\n imports.Values.Where(x => x != \"\").ToList().ForEach(x => {ChooseOutDirWriter(x);});\r\n }\r\n return outDirWriters[filename];\r\n }\r\n\r\n public bool TrustedType(Type t)\r\n {\r\n SeqType seq = t as SeqType;\r\n UserDefinedType ut = t as UserDefinedType;\r\n if (seq != null)\r\n {\r\n return TrustedType(seq.Arg);\r\n }\r\n else if (ut != null)\r\n {\r\n return IsSpecFile(ut.AsDatatype.tok.filename) && TrustedType(ut.TypeArgs);\r\n }\r\n else\r\n {\r\n return true;\r\n }\r\n }\r\n\r\n public bool TrustedType(IEnumerable ts)\r\n {\r\n return ts.ToList().TrueForAll(t => TrustedType(t));\r\n }\r\n\r\n public virtual Tuple> ChooseWriter(\r\n Bpl.IToken tok, string name, TypeApply app = null)\r\n {\r\n string filename = Path.GetFullPath(tok.filename);\r\n if (app != null && !TrustedType(app.typeArgs.Values))\r\n {\r\n throw new Exception(\"specification cannot refer to untrusted type: \" + name);\r\n }\r\n if (IsSeqFile(filename, true))\r\n {\r\n return Tuple.Create(trustedWriter,\r\n (name.StartsWith(\"lemma_Seq\") ? trustedWriter : trustedIWriter),\r\n \"Trusted\",\r\n new List());\r\n }\r\n else\r\n {\r\n return ChooseOutDirWriter(filename);\r\n }\r\n }\r\n\r\n public void CompileDatatype1Ghost(Type t, TypeApply app, TextWriter writer, TextWriter iwriter)\r\n {\r\n // type List = Nil() | Cons(hd:int, tl:List);\r\n string dataName = app.AppName(); // List\r\n List ctors = compileDatatypes[app].AsDatatype.Ctors;\r\n bool isSeq = dataName.StartsWith(\"Seq_\");\r\n if (isSeq)\r\n {\r\n iwriter.WriteLine(\"type \" + dataName + \";\");\r\n }\r\n (isSeq ? writer : iwriter).WriteLine(\r\n \"type \" + (isSeq ? \"implementation\" : \"\") + \"{:overload} \" + dataName + \" = \"\r\n + String.Join(\" | \", ctors.Select(c => Compile_Constructor(t, c.Name, app.typeArgs).AppName() + \"(\"\r\n + String.Join(\", \", c.Formals.Select(f => f.Name + \":\" + TypeString(app.AppType(f.Type))))\r\n + \")\")) + \";\");\r\n\r\n if (isSeq)\r\n {\r\n foreach (var c in ctors)\r\n {\r\n string cName = Compile_Constructor(t, c.Name, app.typeArgs).AppName();\r\n string args = String.Join(\", \", c.Formals.Select(f => f.Name));\r\n string parms = String.Join(\", \", c.Formals.Select(f => f.Name + \":\" \r\n + TypeString(app.AppType(f.Type))));\r\n iwriter.WriteLine(\"function _\" + cName + \"(\" + parms + \"):\" + dataName + \";\");\r\n writer.WriteLine(\"function implementation _\" + cName + \"(\" + parms + \"):\"\r\n + dataName + \" { \" + cName + \"(\" + args + \") }\");\r\n foreach (var f in c.Formals)\r\n {\r\n string tName = TypeString(app.AppType(f.Type));\r\n iwriter.WriteLine(\"function \" + f.Name + \"_\" + cName + \"(x:\" + dataName\r\n + \"):\" + tName + \";\");\r\n writer.WriteLine(\"function implementation \" + f.Name + \"_\" + cName + \"(x:\" + dataName\r\n + \"):\" + tName + \" { \" + f.Name + \"#\" + cName + \"(x) }\");\r\n }\r\n iwriter.WriteLine(\"function is_\" + cName + \"(x:\" + dataName + \"):bool;\");\r\n writer.WriteLine(\"function implementation is_\" + cName + \"(x:\" + dataName\r\n + \"):bool { x is \" + cName + \" }\");\r\n }\r\n }\r\n }\r\n\r\n const string baseDecls = @\"\r\n function fun_unroll(i:int):bool { true }\r\n function fun_unroll__all(i:int):bool { true }\r\n function fun_word__32(i:int):bool { word(i) }\r\n\r\n function INTERNAL_add_boogie(x:int, y:int) : int { x + y }\r\n function INTERNAL_sub_boogie(x:int, y:int) : int { x - y }\r\n function{:never_pattern true} INTERNAL_lt_boogie(x:int, y:int) : bool { x < y }\r\n function{:never_pattern true} INTERNAL_le_boogie(x:int, y:int) : bool { x <= y }\r\n function{:never_pattern true} INTERNAL_gt_boogie(x:int, y:int) : bool { x > y }\r\n function{:never_pattern true} INTERNAL_ge_boogie(x:int, y:int) : bool { x >= y }\r\n \";\r\n\r\n void CompileDatatypesGhost()\r\n {\r\n for (int i = 0; i < compileDatatypeList.Count; i++)\r\n {\r\n // note that compileDatatypes may get extended during loop\r\n var app = compileDatatypeList[i];\r\n CompileDatatype1Ghost(compileDatatypes[app], app, trustedWriter, trustedIWriter);\r\n }\r\n }\r\n\r\n public virtual CompileMethodGhost NewCompileMethod(DafnySpec dafnySpec, Method method,\r\n TypeApply typeApply, TextWriter writer, TextWriter iwriter, string moduleName, List imports)\r\n {\r\n return new CompileMethodGhost(dafnySpec, method, typeApply, writer, iwriter, moduleName, imports);\r\n }\r\n\r\n public TypeApply Compile_Method(Method method, Dictionary typeArgs, List extraTypeParams = null)\r\n {\r\n Dictionary substArgs = new Dictionary();\r\n var fullTypeArgs = method.TypeArgs.Concat(extraTypeParams ?? new List()).ToList();\r\n fullTypeArgs.ForEach(t => substArgs.Add(t.Name, t));\r\n typeArgs = typeArgs.ToDictionary(p => substArgs[p.Key.Name], p => p.Value);\r\n TypeApply apply = new TypeApply(this, DafnySpec.SanitizedName(method), fullTypeArgs, typeArgs);\r\n //Console.Error.WriteLine(\"Compile_Method: \" + method + \" :: \" + method.GetType() + \" \" + String.Join(\",\", typeArgs));\r\n if (!compileMethods.ContainsKey(apply))\r\n {\r\n //Console.Error.WriteLine(\"Compile_Method# \" + method + \" :: \" + method.GetType() + \" \" + String.Join(\",\", typeArgs));\r\n compileMethods.Add(apply, apply);\r\n var tok = method.tok;\r\n var writers = ChooseWriter(tok, method.Name, apply);\r\n CompileMethodGhost compile = NewCompileMethod(this, method, apply,\r\n writers.Item1, writers.Item2, writers.Item3, writers.Item4);\r\n if (writers.Item3 == \"Seq\" && typeArgs.Count == 1)\r\n {\r\n compile.visibleElementType = new List(apply.typeArgs.Values)[0];\r\n }\r\n compile.minVerify = minVerify;\r\n try\r\n {\r\n compile.Compile();\r\n }\r\n catch(Exception e)\r\n {\r\n throw new Exception(\"while compiling method \" + method.Name, e);\r\n }\r\n }\r\n return apply;\r\n }\r\n\r\n public virtual void Compile_FunctionAsMethod(Function function, Dictionary typeArgs,\r\n Dictionary substArgs)\r\n {\r\n }\r\n\r\n public TypeApply Compile_Function(Function function, Dictionary typeArgs)\r\n {\r\n Dictionary substArgs = new Dictionary();\r\n function.TypeArgs.ForEach(t => substArgs.Add(t.Name, t));\r\n typeArgs = typeArgs.ToDictionary(p => substArgs[p.Key.Name], p => p.Value);\r\n TypeApply apply = new TypeApply(this, DafnySpec.SanitizedName(function), function.TypeArgs, typeArgs);\r\n if (!compileFunctions.ContainsKey(apply))\r\n {\r\n compileFunctions.Add(apply, apply);\r\n var tok = function.tok;\r\n //Console.Error.WriteLine(\"function: \" + function + \" :: \" + function.GetType());\r\n //Console.Error.WriteLine(\" \" + function.Body);\r\n //Console.Error.WriteLine(\" \" + function.IsRecursive + \" \" + function.IsGhost);\r\n var writers = ChooseWriter(tok, function.Name, apply);\r\n if (!Attributes.Contains(function.Attributes, \"imported\"))\r\n {\r\n try\r\n {\r\n var compile = new CompileFunction(this, function, apply, writers.Item1, writers.Item2,\r\n writers.Item3, writers.Item4);\r\n if (writers.Item3 == \"Seq\" && typeArgs.Count == 1)\r\n {\r\n compile.visibleElementType = new List(apply.typeArgs.Values)[0];\r\n }\r\n compile.minVerify = minVerify;\r\n compile.Compile();\r\n }\r\n catch(Exception e)\r\n {\r\n throw new Exception(\"while compiling function \" + function.Name, e);\r\n }\r\n }\r\n else\r\n {\r\n // imported\r\n if (function.Ens.Count > 0)\r\n {\r\n string name = FunName(SimpleName(apply.AppName()));\r\n AddLemma(new LemmaCall(writers.Item3, (Type)null,\r\n \"call lemma_fun_ensures_\" + name + \"();\", false));\r\n }\r\n }\r\n bool hidden = Attributes.Contains(function.Attributes, \"opaque\");\r\n bool isFull = function.Name.Contains(\"#\") && function.Name.EndsWith(\"_FULL\");\r\n if (!function.IsGhost && !isFull && !IsSpecFile(function.tok.filename))\r\n {\r\n Compile_FunctionAsMethod(function, typeArgs, substArgs);\r\n }\r\n }\r\n return apply;\r\n }\r\n\r\n public virtual void AddDatatypeLemmas(UserDefinedType t, TypeApply apply)\r\n {\r\n }\r\n\r\n public TypeApply Compile_Datatype(UserDefinedType t)\r\n {\r\n Dictionary subst = new Dictionary();\r\n for (int i = 0; i < t.TypeArgs.Count; i++)\r\n {\r\n subst.Add(t.AsDatatype.TypeArgs[i], t.TypeArgs[i]);\r\n }\r\n TypeApply apply = new TypeApply(this, t.Name, t.AsDatatype.TypeArgs, subst);\r\n if ( !compileDatatypes.ContainsKey(apply)\r\n && !Attributes.Contains(t.AsDatatype.Attributes, \"imported\"))\r\n {\r\n compileDatatypes.Add(apply, t);\r\n compileDatatypeList.Add(apply);\r\n AddDatatypeLemmas(t, apply);\r\n }\r\n return apply;\r\n }\r\n\r\n public TypeApply Compile_Constructor(Type t, string constructor, List dataTypeArgs,\r\n Dictionary typeArgs)\r\n {\r\n UserDefinedType ut = (UserDefinedType) t;\r\n if (dataTypeArgs == null)\r\n {\r\n dataTypeArgs = ut.TypeArgs;\r\n }\r\n Util.Assert(ut.AsDatatype.TypeArgs.Count == dataTypeArgs.Count);\r\n Dictionary typeMap = new Dictionary();\r\n for (int i = 0; i < dataTypeArgs.Count; i++)\r\n {\r\n typeMap.Add(ut.AsDatatype.TypeArgs[i],\r\n Resolver.SubstType(dataTypeArgs[i], typeArgs));\r\n }\r\n return new TypeApply(this, constructor, ut.AsDatatype.TypeArgs, typeMap);\r\n }\r\n\r\n // REVIEW: is this receiving the correct typeArgs?\r\n public TypeApply Compile_Constructor(Type t, string constructor, Dictionary typeArgs)\r\n {\r\n UserDefinedType ut = (UserDefinedType) t;\r\n Dictionary substArgs = new Dictionary();\r\n ut.AsDatatype.TypeArgs.ForEach(tt => substArgs.Add(tt.Name, tt));\r\n typeArgs = typeArgs.ToDictionary(p => substArgs[p.Key.Name], p => p.Value);\r\n return new TypeApply(this, constructor, ut.AsDatatype.TypeArgs, typeArgs);\r\n }\r\n\r\n public TypeApply Compile_SeqType(SeqType t)\r\n {\r\n Dictionary typeArgs = new Dictionary();\r\n DatatypeDecl decl = FindDatatype(\"Seq\");\r\n return Compile_Datatype(new UserDefinedType(Bpl.Token.NoToken, \"Seq\", decl, new List { t.Arg }));\r\n }\r\n\r\n public Tuple GetSeqOperation(Type t, string op)\r\n {\r\n Function f = FindFunction(op);\r\n TypeApply tApp = Compile_SeqType((SeqType)t);\r\n return Tuple.Create(f, Compile_Function(f, tApp.typeArgs));\r\n }\r\n\r\n public string GetSeqOperationName(Type t, string op)\r\n {\r\n TypeApply tApp = Compile_SeqType((SeqType)t);\r\n TypeApply fApp = Compile_Function(FindFunction(op), tApp.typeArgs);\r\n return FunName(SimpleName(GetSeqOperation(t, op).Item2.AppName()));\r\n }\r\n\r\n public Tuple GetSeqMethod(Type t, string op)\r\n {\r\n Method m = FindMethod(op);\r\n TypeApply tApp = Compile_SeqType((SeqType)t);\r\n return Tuple.Create(m, Compile_Method(m, tApp.typeArgs));\r\n }\r\n\r\n public Dictionary CompileSpecStart(DafnySpec_Options options, IList files)\r\n {\r\n minVerify = options.minVerify;\r\n outDir = options.outDir;\r\n outListWriter = new StreamWriter(Path.Combine(outDir, \"dafny_modules.txt\"));\r\n\r\n trustedWriter = new StreamWriter(Path.Combine(outDir, \"Trusted\"+ImpBasmExtn));\r\n trustedIWriter = new StreamWriter(Path.Combine(outDir, \"Trusted\"+IfcBasmExtn));\r\n WriteInterfaceImports(trustedIWriter, GatherAllImports(new List()));\r\n trustedIWriter.WriteLine(\"module interface Trusted\");\r\n trustedIWriter.WriteLine(\"{\");\r\n trustedIWriter.WriteLine(baseDecls);\r\n WriteImplementationHeader(trustedWriter, \"Trusted\", new List());\r\n\r\n Dictionary allModules = new Dictionary(StringComparer.CurrentCultureIgnoreCase);\r\n foreach (string file in files)\r\n {\r\n string filename = new FileInfo(file).FullName;\r\n string moduleName = ModuleNameFromFilename(filename);\r\n if (!allModules.ContainsKey(moduleName))\r\n {\r\n AddImports(allModules, filename);\r\n allModules.Add(moduleName, filename);\r\n }\r\n }\r\n return allModules;\r\n }\r\n\r\n public void CompileSpecEnd()\r\n {\r\n trustedIWriter.WriteLine(\"}\");\r\n trustedWriter.WriteLine(\"}\");\r\n trustedIWriter.Close();\r\n trustedWriter.Close();\r\n\r\n foreach (var writers in outDirWriters.Values)\r\n {\r\n writers.Item1.WriteLine(\"}\");\r\n writers.Item1.Close();\r\n writers.Item2.WriteLine(\"}\");\r\n writers.Item2.Close();\r\n }\r\n if (outListWriter != null)\r\n {\r\n outListWriter.Close();\r\n }\r\n }\r\n\r\n public void DeclareProgram(Program program)\r\n {\r\n foreach (ModuleDefinition mod in program.Modules)\r\n {\r\n foreach (TopLevelDecl top in mod.TopLevelDecls)\r\n {\r\n ClassDecl cls = top as ClassDecl;\r\n DatatypeDecl dataDecl = top as DatatypeDecl;\r\n if (cls != null)\r\n {\r\n foreach (MemberDecl member in cls.Members)\r\n {\r\n Method method = member as Method;\r\n Function function = member as Function;\r\n if (method != null && !allMethods.ContainsKey(method.Name))\r\n {\r\n allMethods[method.Name] = method;\r\n }\r\n if (function != null && !allFunctions.ContainsKey(function.Name))\r\n {\r\n allFunctions[function.Name] = function;\r\n }\r\n }\r\n }\r\n if (dataDecl != null && !allDatatypes.ContainsKey(dataDecl.Name))\r\n {\r\n allDatatypes[dataDecl.Name] = dataDecl;\r\n }\r\n }\r\n }\r\n }\r\n\r\n public void CompileProgram(Program program)\r\n {\r\n foreach (ModuleDefinition mod in program.Modules)\r\n {\r\n Util.DebugWriteLine(\"module: \" + mod.Name + \" \" + mod.GetType());\r\n \r\n //Console.WriteLine(\"type Tri = Triple(Pwd:int, Salt:int, Key:int);\");\r\n //Console.WriteLine(\"type Map = MapCons(Domain:[Tri]bool, Range:[Tri]int);\");\r\n //Console.WriteLine(\"var $ghost_Hashed:Map;\");\r\n\r\n foreach (TopLevelDecl top in mod.TopLevelDecls)\r\n {\r\n Util.DebugWriteLine(\"top-decl: \" + top.Name + \" \" + top.GetType());\r\n ClassDecl cls = top as ClassDecl;\r\n \r\n if (cls != null)\r\n {\r\n foreach (MemberDecl member in cls.Members)\r\n {\r\n //Console.Error.WriteLine(\"declaration: \" + member + \" :: \" + member.GetType());\r\n Util.DebugWriteLine(\"member-decl: \" + member.Name + \" \" + member.GetType());\r\n Field field = member as Field;\r\n Method method = member as Method;\r\n Function function = member as Function;\r\n if (field != null && !allStaticFields.Contains(field.Name))\r\n {\r\n allStaticFields.Add(field.Name);\r\n if (!field.IsGhost)\r\n {\r\n throw new Exception(\"not implemented: non-ghost fields: \" + field.Name);\r\n }\r\n var writers = ChooseWriter(field.tok, field.Name);\r\n new CompileField(this, field, writers.Item2).Compile();\r\n }\r\n if (method != null && method.TypeArgs.Count == 0)\r\n {\r\n if (method.Body == null)\r\n {\r\n //Console.Error.WriteLine(\"declaration: \" + member + \" :: \" + member.GetType());\r\n }\r\n Compile_Method(method, new Dictionary());\r\n AddMethodAsLemma(method);\r\n }\r\n else if (function != null && function.TypeArgs.Count == 0)\r\n {\r\n Compile_Function(function, new Dictionary());\r\n }\r\n else\r\n {\r\n //Console.Error.WriteLine(\"skipping declaration: \" + member + \" :: \" + member.GetType());\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n\r\n public void CompileSequenceSpecs()\r\n {\r\n Compile_Function(FindFunction(\"dummy_seqs\"), new Dictionary());\r\n List seqFunctions = allFunctions.Values.Where(f => IsSeqFile(f.tok.filename, true)).ToList();\r\n List seqMethods = allMethods.Values.Where(m => IsSeqFile(m.tok.filename, true)).ToList();\r\n\r\n for (int i = 0; i < compileDatatypeList.Count; i++)\r\n {\r\n //- note that compileDatatypes may get extended during loop\r\n var app = compileDatatypeList[i];\r\n string dataName = app.AppName(); // List\r\n List ctors = compileDatatypes[app].AsDatatype.Ctors;\r\n bool isSeq = dataName.StartsWith(\"Seq_\");\r\n if (isSeq)\r\n {\r\n seqFunctions.ForEach(f => Compile_Function(f, app.typeArgs));\r\n seqMethods.ForEach(m => Compile_Method(m, app.typeArgs));\r\n }\r\n }\r\n }\r\n\r\n public void CompileSpec(DafnySpec_Options options, IList files)\r\n {\r\n Dictionary allModules = CompileSpecStart(options, files);\r\n\r\n Program program;\r\n string errors = Microsoft.Dafny.Main.ParseCheck(\r\n allModules.Values.ToList(),\r\n \"DAFNYCC_PROGRAM\",\r\n out program);\r\n if (errors != null)\r\n {\r\n throw new Exception(errors);\r\n }\r\n Util.DebugWriteLine(program);\r\n DeclareProgram(program);\r\n CompileProgram(program);\r\n CompileDatatypesGhost();\r\n CompileSequenceSpecs();\r\n files.ToList().ForEach(f => ChooseOutDirWriter(f)); //- make sure even empty modules get written\r\n\r\n CompileSpecEnd();\r\n }\r\n}\r\n\r\n" }, { "path": "ironclad-apps/tools/DafnySpec/DafnySpec.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {D2031609-BC52-4F67-8560-6D8F07C38497}\r\n Exe\r\n Properties\r\n DafnySpec\r\n dafnyspec\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {be5e53dc-b929-4031-b85b-71138ad363cf}\r\n DafnySpecAst\r\n \r\n \r\n {0c1e9d4f-6aae-455c-b5c7-5de6063ca99e}\r\n Parser\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/tools/DafnySpec/DafnySpec.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 12.00\r\n# Visual Studio 2013\r\nVisualStudioVersion = 12.0.30501.0\r\nMinimumVisualStudioVersion = 10.0.40219.1\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"DafnySpec\", \"DafnySpec.csproj\", \"{D2031609-BC52-4F67-8560-6D8F07C38497}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"DafnySpecAst\", \"DafnySpecAst\\DafnySpecAst.csproj\", \"{BE5E53DC-B929-4031-B85B-71138AD363CF}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"Parser\", \"Parser\\Parser.csproj\", \"{0C1E9D4F-6AAE-455C-B5C7-5DE6063CA99E}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Any CPU = Debug|Any CPU\r\n\t\tRelease|Any CPU = Release|Any CPU\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{D2031609-BC52-4F67-8560-6D8F07C38497}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{D2031609-BC52-4F67-8560-6D8F07C38497}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{D2031609-BC52-4F67-8560-6D8F07C38497}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{D2031609-BC52-4F67-8560-6D8F07C38497}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{BE5E53DC-B929-4031-B85B-71138AD363CF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{BE5E53DC-B929-4031-B85B-71138AD363CF}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{BE5E53DC-B929-4031-B85B-71138AD363CF}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{BE5E53DC-B929-4031-B85B-71138AD363CF}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{0C1E9D4F-6AAE-455C-B5C7-5DE6063CA99E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{0C1E9D4F-6AAE-455C-B5C7-5DE6063CA99E}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{0C1E9D4F-6AAE-455C-B5C7-5DE6063CA99E}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{0C1E9D4F-6AAE-455C-B5C7-5DE6063CA99E}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "ironclad-apps/tools/DafnySpec/DafnySpecAst/DafnySpecAst.cs", "content": "using System;\nusing System.IO;\nusing System.Collections.Generic;\nusing System.Collections.ObjectModel;\nusing Microsoft.Dafny;\nusing Bpl = Microsoft.Boogie;\n\nnamespace Microsoft.Boogie\n{\n\npublic interface IToken\n{\n string filename { get; }\n int line { get; }\n}\n\npublic class Token: IToken\n{\n public static Token NoToken = new Token(\"nofile\", 0);\n\n string _filename;\n int _line;\n\n public Token(string filename, int line) { this._filename = filename; this._line = line; }\n\n public string filename { get { return _filename; } }\n public int line { get { return _line; } }\n}\n\n}\n\nnamespace Microsoft.Basetypes\n{\n public class BigDec\n {\n string s;\n internal BigDec(string s) { this.s = s; }\n public static BigDec FromString(string s) { return new BigDec(s); }\n public override string ToString() { return s; }\n public string ToDecimalString() { return s; }\n }\n}\n\nnamespace Microsoft.Dafny\n{\nusing Token = Bpl.Token;\n\npublic class Attributes\n{\n public string Name;\n public List Args;\n public Attributes Prev;\n\n public Attributes(string Name, List Args, Attributes Prev) { this.Name = Name; this.Args = Args; this.Prev = Prev; }\n\n public static void Resolve(Resolver resolver, Attributes attrs)\n {\n if (attrs != null)\n {\n for (int i = 0; i < attrs.Args.Count; i++) {\n attrs.Args[i] = attrs.Args[i].Resolve(resolver, null);\n } \n Resolve(resolver, attrs.Prev);\n }\n }\n\n public static bool Contains(Attributes attrs, string name)\n {\n return attrs != null && (attrs.Name == name || Contains(attrs.Prev, name));\n }\n\n public static List FindExpressions(Attributes attrs, string nm) \n {\n for (; attrs != null; attrs = attrs.Prev) {\n if (attrs.Name == nm) {\n return attrs.Args;\n }\n }\n return null;\n }\n}\n\npublic abstract class Type\n{\n public static IntType Int = new IntType();\n public static NatType Nat = new NatType();\n public static RealType Real = new RealType();\n public static BoolType Bool = new BoolType();\n\n public enum NumericPersuation { Int, Real }\n\n public bool IsNumericBased(NumericPersuation p) {\n return (this is IntType && p == NumericPersuation.Int)\n || (this is RealType && p == NumericPersuation.Real);\n }\n\n public abstract string TypeName(object o);\n public virtual DatatypeDecl AsDatatype { get { return null; } }\n\n public override abstract bool Equals(Object o);\n public override int GetHashCode() { return 0; }\n public abstract Type Subst(Dictionary map);\n public virtual void Resolve(Resolver resolver) {}\n}\n\npublic class TypeParameter\n{\n public string Name;\n\n public TypeParameter(string Name) { this.Name = Name; }\n public TypeParameter(Token tok, string Name) { this.Name = Name; }\n\n public override bool Equals(object other)\n {\n TypeParameter that = other as TypeParameter;\n return that != null && that.Name == this.Name;\n }\n\n public override int GetHashCode() { return Name.GetHashCode(); }\n}\n\npublic class TypeProxy: Type\n{\n public Type T;\n\n public TypeProxy(Type T) { this.T = T; }\n\n public override bool Equals(Object o) { return T.Equals(o); }\n public override int GetHashCode() { return T.GetHashCode(); }\n public override string TypeName(object o) { return T.TypeName(o); }\n public override Type Subst(Dictionary map) { return new TypeProxy(T.Subst(map)); }\n}\n\npublic class IntType: Type\n{\n public override bool Equals(Object o) { return o is IntType && !(o is NatType); }\n public override int GetHashCode() { return 0; }\n public override string TypeName(object o) { return \"int\"; }\n public override Type Subst(Dictionary map) { return this; }\n}\n\npublic class NatType: IntType\n{\n public override bool Equals(Object o) { return o is NatType; }\n public override int GetHashCode() { return 0; }\n public override string TypeName(object o) { return \"nat\"; }\n public override Type Subst(Dictionary map) { return this; }\n}\n\npublic class RealType: Type\n{\n public override bool Equals(Object o) { return o is RealType; }\n public override int GetHashCode() { return 0; }\n public override string TypeName(object o) { return \"real\"; }\n public override Type Subst(Dictionary map) { return this; }\n}\n\npublic class BoolType: Type\n{\n public override bool Equals(Object o) { return o is BoolType; }\n public override int GetHashCode() { return 0; }\n public override string TypeName(object o) { return \"bool\"; }\n public override Type Subst(Dictionary map) { return this; }\n}\n\npublic class SeqType: Type\n{\n public Type Arg;\n\n public SeqType(Type Arg) { this.Arg = Arg; }\n\n public override bool Equals(Object o) { SeqType that = o as SeqType; return that != null && Arg.Equals(that.Arg); }\n public override int GetHashCode() { return Arg.GetHashCode(); }\n public override string TypeName(object o) { return \"seq<\" + Arg.TypeName(o) + \">\"; }\n public override Type Subst(Dictionary map) { return new SeqType(Arg.Subst(map)); }\n public override void Resolve(Resolver resolver) { Arg.Resolve(resolver); }\n}\n\npublic class MapType: Type\n{\n public Type Domain;\n public Type Range;\n\n public MapType(Type Domain, Type Range) { this.Domain = Domain; this.Range = Range; }\n\n public override bool Equals(Object o) { MapType that = o as MapType; return that != null && Domain.Equals(that.Domain) && Range.Equals(that.Range); }\n public override int GetHashCode() { return Range.GetHashCode(); }\n public override string TypeName(object o) { return \"map<\" + Domain.TypeName(o) + \",\" + Range.TypeName(o) + \">\"; }\n public override Type Subst(Dictionary map) { return new MapType(Domain.Subst(map), Range.Subst(map)); }\n public override void Resolve(Resolver resolver) { Domain.Resolve(resolver); Range.Resolve(resolver); }\n}\n\npublic class UserDefinedType: Type\n{\n DatatypeDecl datatype;\n public string Name;\n public Attributes Attributes;\n public List TypeArgs;\n public bool IsTypeParameter;\n\n public UserDefinedType(Token tok, string name, DatatypeDecl decl, List typeArgs,\n bool IsTypeParameter, Attributes Attributes)\n {\n this.datatype = decl;\n this.Name = name;\n this.Attributes = Attributes;\n this.TypeArgs = typeArgs;\n this.IsTypeParameter = IsTypeParameter;\n }\n\n public UserDefinedType(Token tok, string name, DatatypeDecl decl, List typeArgs)\n :this(tok, name, decl, typeArgs, false, null)\n {\n }\n\n internal UserDefinedType(string name)\n :this(Token.NoToken, name, null, null, true, null)\n {\n }\n\n public override string TypeName(object o)\n {\n if (TypeArgs == null) { return Name; }\n string[] args = new string[TypeArgs.Count];\n for (int i = 0; i < args.Length; i++) args[i] = TypeArgs[i].TypeName(o);\n return Name + \"<\" + String.Join(\",\", args) + \">\";\n }\n\n public override DatatypeDecl AsDatatype { get { return datatype; } }\n\n public override bool Equals(Object o)\n {\n UserDefinedType that = o as UserDefinedType;\n if (that == null || Name != that.Name || IsTypeParameter != that.IsTypeParameter || TypeArgs.Count != that.TypeArgs.Count) { return false; }\n for (int i = 0; i < TypeArgs.Count; i++) { if (!TypeArgs[i].Equals(that.TypeArgs[i])) { return false; } }\n return true;\n }\n\n public override int GetHashCode() { return Name.GetHashCode(); }\n\n public override Type Subst(Dictionary map)\n {\n if (IsTypeParameter && map.ContainsKey(new TypeParameter(Name)))\n {\n return map[new TypeParameter(Name)];\n }\n else\n {\n List typeArgs = new List();\n foreach (Type t in TypeArgs) { typeArgs.Add(t.Subst(map)); }\n return new UserDefinedType(Token.NoToken, Name, datatype, typeArgs, IsTypeParameter, Attributes);\n }\n }\n\n public override void Resolve(Resolver resolver)\n {\n if (resolver.typeParams.ContainsKey(Name))\n {\n IsTypeParameter = true;\n }\n else\n {\n datatype = resolver.Find(resolver.datatypes, Name);\n }\n if (TypeArgs != null)\n {\n foreach (Type arg in TypeArgs) { arg.Resolve(resolver); }\n }\n }\n}\n\npublic class BoundVar\n{\n public string Name;\n public Type Type;\n public bool IsGhost;\n\n public BoundVar(Token tok, string name, Type Type)\n {\n this.Name = name;\n this.Type = Type;\n }\n\n public void Resolve(Resolver resolver, Type t)\n {\n if (this.Type == null) { this.Type = t; }\n Type.Resolve(resolver);\n this.IsGhost = resolver.IsGhost();\n }\n}\n\npublic class Formal\n{\n public string Name;\n public Type Type;\n public bool IsGhost;\n\n public Formal(string name, Type type, bool IsGhost) { this.Name = name; this.Type = type; this.IsGhost = IsGhost; }\n\n public Formal(Token tok, string name, Type type, bool b1, bool b2)\n {\n if (b1 != b2) { throw new Exception(\"internal error\"); }\n this.Name = name;\n this.Type = type;\n this.IsGhost = b1;\n }\n\n public void Resolve(Resolver resolver)\n {\n Type.Resolve(resolver);\n IsGhost = IsGhost || resolver.IsGhost();\n }\n}\n\npublic class Expression\n{\n public Token tok = Token.NoToken;\n public Type Type;\n public Expression Resolved;\n\n public bool WasResolved() { return false; }\n public virtual Expression Resolve(Resolver resolver, Type t) { Type = (Type == null) ? t : Type; return this; }\n}\n\npublic class IdentifierExpr: Expression\n{\n public string Name;\n public LocalVariable Var;\n\n public IdentifierExpr(Token tok, string name)\n {\n this.Name = name;\n }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n VarDecl VarDecl = resolver.Var(Name);\n \n if (VarDecl == null)\n {\n if (resolver.fields.ContainsKey(Name))\n {\n MemberSelectExpr ret = new MemberSelectExpr(new ImplicitThisExpr(), Name);\n ret.Member = resolver.fields[Name];\n ret.Type = resolver.fields[Name].Type;\n return ret;\n }\n else if (resolver.constructors.ContainsKey(Name))\n {\n DatatypeCtor ctor = resolver.constructors[Name];\n DatatypeValue ret = new DatatypeValue(new List(), ctor, new List(),\n new UserDefinedType(Token.NoToken, ctor.datatype.Name, ctor.datatype, new List()));\n return ret;\n }\n else\n {\n throw new Exception(\"cannot find variable/field/constructor named \" + Name);\n }\n }\n else\n {\n Var = new LocalVariable(tok, tok, Name, VarDecl.Type, VarDecl.IsGhost);\n resolver.CollectVar(Name);\n }\n Type = Var.Type;\n return this;\n }\n}\n\npublic class ThisExpr: Expression\n{\n}\n\npublic class ImplicitThisExpr: Expression\n{\n public ImplicitThisExpr() { this.Type = Type.Bool; } // HACK\n}\n\npublic class ParensExpression: Expression\n{\n public Expression E;\n private ParensExpression() {} // never created\n}\n\npublic abstract class StmtExpr: Expression\n{\n public abstract Statement S { get; }\n public Expression E;\n}\n\npublic class StmtExprCall: StmtExpr\n{\n string Name;\n List Args;\n CallStmt call;\n public override Statement S { get { return call; } }\n\n public StmtExprCall(string Name, List Args, Expression E) { this.Name = Name; this.Args = Args; this.E = E; }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n Method method = resolver.Find(resolver.methods, Name);\n for (int i = 0; i < Args.Count; i++) { Args[i] = Args[i].Resolve(resolver, method.Formals[i].Type); }\n call = new CallStmt(Args, new Dictionary(), method);\n E = E.Resolve(resolver, t);\n Type = E.Type;\n return this;\n }\n}\n\npublic delegate LiteralExpr MakeBigInt(string i);\n\npublic class LiteralExpr: Expression\n{\n public object Value;\n\n public LiteralExpr(object Value) { this.Value = Value; }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n Type =\n Value is bool ? (Type)Type.Bool :\n Value is Microsoft.Basetypes.BigDec ? (Type)Type.Real :\n (Type)Type.Int;\n return this;\n }\n\n public static bool IsTrue(Expression e)\n {\n LiteralExpr lit = e as LiteralExpr;\n return lit != null && lit.Value is bool && ((bool)lit.Value);\n }\n\n public static MakeBigInt MakeBigInt;\n}\n\npublic class StringLiteralExpr : LiteralExpr\n{\n public StringLiteralExpr(string s) : base(s) {}\n}\n\n\npublic class UnaryExpr: Expression\n{\n}\n\npublic class UnaryOpExpr: UnaryExpr\n{\n public enum Opcode { Not, Cardinality, Fresh }\n\n public Opcode Op;\n public Expression E;\n\n public UnaryOpExpr(Token tok, Opcode op, Expression e)\n {\n this.Op = op;\n this.E = e;\n }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n switch (Op)\n {\n case Opcode.Not: E = E.Resolve(resolver, Type.Bool); Type = Type.Bool; break;\n case Opcode.Cardinality: E = E.Resolve(resolver, null); Type = Type.Int; break;\n case Opcode.Fresh: E = E.Resolve(resolver, Type.Bool); Type = Type.Bool; break;\n }\n\n return this;\n }\n}\n\npublic class ConversionExpr : UnaryExpr\n{\n public Type ToType;\n public Expression E;\n\n public ConversionExpr(Type ToType, Expression Input)\n {\n this.ToType = ToType;\n this.E = Input;\n }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n this.Type = ToType;\n this.E = this.E.Resolve(resolver, t);\n return this;\n }\n}\n\npublic class BinaryExpr: Expression\n{\n public enum Opcode {\n None,\n Iff, Imp, Exp, And, Or, In, NotIn, Disjoint,\n Eq, Neq, Le, Lt, Ge, Gt,\n Add, Sub, Mul, Div, Mod,\n }\n public enum ResolvedOpcode { None, SeqEq, SeqNeq, Concat }\n\n public Opcode Op = Opcode.None;\n public ResolvedOpcode ResolvedOp = ResolvedOpcode.None;\n public Expression E0;\n public Expression E1;\n\n public BinaryExpr(Token tok, Opcode op, Expression e0, Expression e1)\n {\n this.Op = op;\n this.E0 = e0;\n this.E1 = e1;\n }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n Type t0 = null;\n Type t1 = null;\n switch (Op)\n {\n case Opcode.Iff: case Opcode.Imp: case Opcode.Exp: case Opcode.And: case Opcode.Or:\n t0 = Type.Bool;\n t1 = Type.Bool;\n Type = Type.Bool;\n break;\n case Opcode.Eq: case Opcode.Neq: Type = Type.Bool; break;\n case Opcode.Le: case Opcode.Lt: case Opcode.Ge: case Opcode.Gt:\n t0 = Type.Int;\n t1 = Type.Int;\n Type = Type.Bool;\n break;\n case Opcode.Sub: case Opcode.Mul: case Opcode.Div: case Opcode.Mod:\n t0 = Type.Int;\n t1 = Type.Int;\n Type = Type.Int;\n break;\n }\n switch (Op)\n {\n case Opcode.Eq: case Opcode.Neq: case Opcode.Le: case Opcode.Lt: case Opcode.Ge: case Opcode.Gt:\n //- ((a < b) < c) < d\n //- -->\n //- ((a < b) < c) && c < d\n BinaryExpr B0 = E0 as BinaryExpr;\n if (B0 != null)\n {\n switch (B0.Op)\n {\n case Opcode.Eq: case Opcode.Neq: case Opcode.Le: case Opcode.Lt: case Opcode.Ge: case Opcode.Gt:\n Expression _e0 = B0;\n Expression _e1 = new BinaryExpr(tok, Op, B0.E1, E1);\n Expression _e = new BinaryExpr(tok, Opcode.And, _e0, _e1);\n return _e.Resolve(resolver, Type.Bool);\n }\n }\n break;\n }\n E0 = E0.Resolve(resolver, t0);\n E1 = E1.Resolve(resolver, t1);\n if (E0.Type == null) { E0 = E0.Resolve(resolver, E1.Type); } // HACK\n if (E1.Type == null) { E1 = E1.Resolve(resolver, E0.Type); } // HACK\n switch (Op)\n {\n case Opcode.Add:\n if (E0.Type is SeqType) { ResolvedOp = ResolvedOpcode.Concat; Type = E0.Type; }\n else if (E0.Type is RealType) { Type = E0.Type; }\n else { Type = Type.Int; }\n break;\n case Opcode.Sub: case Opcode.Mul: case Opcode.Div:\n if (E0.Type is RealType) { Type = E0.Type; }\n break;\n case Opcode.Eq: if (E0.Type is SeqType) { ResolvedOp = ResolvedOpcode.SeqEq; } break;\n case Opcode.Neq: if (E0.Type is SeqType) { ResolvedOp = ResolvedOpcode.SeqNeq; } break;\n }\n return this;\n }\n\n public static string OpcodeString(Opcode Op)\n {\n switch (Op)\n {\n case Opcode.Iff: return \"<==>\";\n case Opcode.Imp: return \"==>\";\n case Opcode.Exp: return \"<==\";\n case Opcode.And: return \"&&\";\n case Opcode.Or: return \"||\";\n case Opcode.In: return null;\n case Opcode.NotIn: return null;\n case Opcode.Disjoint: return null;\n case Opcode.Eq: return \"==\";\n case Opcode.Neq: return \"!=\";\n case Opcode.Le: return \"<=\";\n case Opcode.Lt: return \"<\";\n case Opcode.Ge: return \">=\";\n case Opcode.Gt: return \">\";\n case Opcode.Add: return \"+\";\n case Opcode.Sub: return \"-\";\n case Opcode.Mul: return \"*\";\n case Opcode.Div: return \"/\";\n case Opcode.Mod: return \"%\";\n }\n return null;\n }\n}\n\npublic class ITEExpr: Expression\n{\n public Expression Test;\n public Expression Thn;\n public Expression Els;\n\n public ITEExpr(Expression Test, Expression Thn, Expression Els) { this.Test = Test; this.Thn = Thn; this.Els = Els; }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n Test = Test.Resolve(resolver, Type.Bool);\n Thn = Thn.Resolve(resolver, t);\n Els = Els.Resolve(resolver, t);\n if (Thn.Type == null) { Thn = Thn.Resolve(resolver, Els.Type); } // HACK\n if (Els.Type == null) { Els = Els.Resolve(resolver, Thn.Type); } // HACK\n Type = Thn.Type;\n return this;\n }\n}\n\npublic abstract class QuantifierExpr: Expression\n{\n public List BoundVars;\n public Attributes Attributes;\n public Expression Term;\n\n public QuantifierExpr(List BoundVars, Attributes Attributes, Expression Term)\n {\n this.BoundVars = BoundVars;\n this.Attributes = Attributes;\n this.Term = Term;\n }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n foreach (BoundVar x in BoundVars)\n {\n //- \"Infer\" missing types as int. If we're wrong, type checking will fail and the\n //- programmer will have to supply an explicit type. \n // TODO: should we implement real type inference?\n Type tx = (x.Type != null) ? x.Type : Type.Int;\n x.Resolve(resolver, tx);\n resolver.PushVar(x);\n }\n Attributes.Resolve(resolver, Attributes);\n Term = Term.Resolve(resolver, Type.Bool);\n foreach (BoundVar x in BoundVars) { resolver.PopVar(x.Name); }\n Type = Type.Bool;\n return this;\n }\n}\n\npublic class ExistsExpr: QuantifierExpr\n{\n public ExistsExpr(List BoundVars, Attributes Attributes, Expression Term): base(BoundVars, Attributes, Term) {}\n}\n\npublic class ForallExpr: QuantifierExpr\n{\n public ForallExpr(List BoundVars, Attributes Attributes, Expression Term): base(BoundVars, Attributes, Term) {}\n}\n\npublic class Lhs\n{\n}\n\npublic class LetExpr: Expression\n{\n public bool tryToEliminate;\n public bool Exact;\n public List LHSs;\n public List RHSs;\n public Expression Body;\n\n public LetExpr(bool Exact, List LHSs, List RHSs, Expression Body)\n {\n this.Exact = Exact;\n this.LHSs = LHSs;\n this.RHSs = RHSs;\n this.Body = Body;\n }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n resolver.PushVarCollect();\n for (int i = 0; i < RHSs.Count; i++)\n {\n RHSs[i] = RHSs[i].Resolve(resolver, LHSs[i].Var.Type);\n LHSs[i].Var.Resolve(resolver, RHSs[i].Type);\n resolver.PushVar(LHSs[i].Var);\n }\n Body = Body.Resolve(resolver, t);\n for (int i = 0; i < RHSs.Count; i++)\n {\n resolver.PopVar(LHSs[i].Var.Name);\n }\n Type = Body.Type;\n Dictionary neededVars = resolver.PopVarCollect();\n bool needed = false;\n foreach (ExprLhs lhs in LHSs)\n {\n if (neededVars.ContainsKey(lhs.Var.Name)) { needed = true; }\n }\n if (tryToEliminate && !needed) { return Body; }\n return this;\n }\n}\n\npublic class MatchCaseExpr\n{\n public string name;\n public DatatypeCtor Ctor;\n public List Arguments;\n public Expression Body;\n\n public MatchCaseExpr(string name, List Arguments, Expression Body) { this.name = name; this.Arguments = Arguments; this.Body = Body; }\n\n public void Resolve(Resolver resolver, DatatypeDecl data, Type t)\n {\n foreach (DatatypeCtor ctor in data.Ctors)\n {\n if (ctor.Name == name)\n {\n Ctor = ctor;\n for (int i = 0; i < Arguments.Count; i++)\n {\n Arguments[i].Resolve(resolver, ctor.Formals[i].Type);\n resolver.PushVar(Arguments[i]);\n }\n Body = Body.Resolve(resolver, t);\n for (int i = 0; i < Arguments.Count; i++) { resolver.PopVar(Arguments[i].Name); }\n }\n }\n }\n}\n\npublic class MatchExpr: Expression\n{\n public Expression Source;\n public List Cases;\n public List MissingCases;\n\n public MatchExpr(Expression Source, List Cases) { this.Source = Source; this.Cases = Cases; this.MissingCases = new List(); }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n Type = t;\n Source = Source.Resolve(resolver, null);\n DatatypeDecl data = resolver.Find(resolver.datatypes, Source.Type.AsDatatype.Name);\n foreach (MatchCaseExpr c in Cases) { c.Resolve(resolver, data, t); t = c.Body.Type; Type = t; }\n return this;\n }\n}\n\npublic class OldExpr: Expression\n{\n public Expression E;\n\n public OldExpr(Expression E) { this.E = E; }\n public override Expression Resolve(Resolver resolver, Type t) { E = E.Resolve(resolver, t); Type = E.Type; return this; }\n}\n\npublic class FunctionCallExpr: Expression\n{\n public string name;\n public List typeArgs;\n public Function Function;\n public Dictionary TypeArgumentSubstitutions;\n public List Args;\n\n public FunctionCallExpr(string name, List typeArgs, List Args)\n {\n this.name = name;\n this.typeArgs = typeArgs;\n this.Args = Args;\n }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n List typeParams = null;\n List formals = null;\n Expression ret = this;\n List parentParams =\n (resolver.currentFunction != null) ? resolver.currentFunction.TypeArgs :\n (resolver.currentMethod != null) ? resolver.currentMethod.TypeArgs :\n null;\n if (parentParams != null)\n {\n typeArgs = new List();\n foreach (TypeParameter p in parentParams) { typeArgs.Add(new UserDefinedType(p.Name)); } // HACK\n }\n if (resolver.functions.ContainsKey(name))\n {\n Function = resolver.functions[name];\n if (Function == resolver.currentFunction) { Function.IsRecursive = true; } // TODO: mutual recursion\n typeParams = Function.TypeArgs;\n formals = Function.Formals;\n Type = Function.ResultType;\n }\n else if (resolver.constructors.ContainsKey(name))\n {\n DatatypeCtor ctor = resolver.constructors[name];\n DatatypeDecl data = ctor.datatype;\n typeParams = data.TypeArgs;\n formals = ctor.Formals;\n Type = new UserDefinedType(Token.NoToken, data.Name, data, typeArgs);\n ret = new DatatypeValue(typeArgs, ctor, Args, Type);\n }\n else if (name == \"IntToReal\")\n {\n Function = new Function(name);\n formals = new List(new Formal[] { new Formal(\"x\", Type.Int, true) });\n Type = Type.Real;\n }\n else if (name == \"RealToInt\")\n {\n Function = new Function(name);\n formals = new List(new Formal[] { new Formal(\"x\", Type.Real, true) });\n Type = Type.Int;\n }\n else\n {\n throw new Exception(\"function not found: \" + name);\n }\n // HACK: since Dafny has no syntax for explicit function type arguments, and we have no type inference, use heuristic for typeArgs:\n TypeArgumentSubstitutions = new Dictionary();\n for (int i = 0; i < typeArgs.Count; i++)\n {\n TypeArgumentSubstitutions.Add(typeParams[i], typeArgs[i]);\n typeArgs[i].Resolve(resolver);\n }\n //foreach (Formal f in formals) { f.Resolve(resolver); }\n for (int i = 0; i < Args.Count; i++)\n {\n Args[i] = Args[i].Resolve(resolver, formals[i].Type);\n }\n return ret;\n }\n}\n\npublic class DatatypeValue: Expression\n{\n public List InferredTypeArgs;\n public DatatypeCtor Ctor;\n public List Arguments;\n\n public DatatypeValue(List InferredTypeArgs, DatatypeCtor Ctor, List Arguments, Type t)\n {\n this.InferredTypeArgs = InferredTypeArgs;\n this.Ctor = Ctor;\n this.Arguments = Arguments;\n this.Type = t;\n }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n for (int i = 0; i < Arguments.Count; i++) { Arguments[i] = Arguments[i].Resolve(resolver, Ctor.Formals[i].Type); }\n return this;\n }\n}\n\npublic class LocalVariable {\n public String Name;\n public Type Type;\n public bool IsGhost;\n \n public LocalVariable(Token Tok, Token EndTok, String Name, Type Type, bool IsGhost) {\n this.Name = Name;\n this.Type = Type;\n this.IsGhost = IsGhost;\n }\n\n}\n\npublic class MemberSelectExpr: Expression\n{\n public Expression Obj;\n public string MemberName;\n public MemberDecl Member;\n internal Dictionary TypeArgumentSubst;\n\n public MemberSelectExpr(Expression Obj, string FieldName) { this.Obj = Obj; this.MemberName = FieldName; }\n \n public MemberSelectExpr(Method Method, Dictionary TypeArgumentSubstitutions) { this.Member = Method; this.TypeArgumentSubst = TypeArgumentSubstitutions; }\n\n public Dictionary TypeArgumentSubstitutions() \n {\n return TypeArgumentSubst;\n }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n Obj = Obj.Resolve(resolver, null);\n DatatypeDecl data = Obj.Type.AsDatatype;\n if (MemberName.EndsWith(\"?\"))\n {\n Type = Type.Bool;\n }\n else if (data != null)\n {\n foreach (DatatypeCtor ctor in data.Ctors)\n {\n foreach (Formal f in ctor.Formals)\n {\n if (f.Name == MemberName)\n {\n Member = new DatatypeDestructor(ctor, Obj.tok, null, f.Name, f.IsGhost, f.Type);\n Type = f.Type;\n }\n }\n }\n }\n return this;\n }\n}\n\npublic class SeqSelectExpr: Expression\n{\n public bool SelectOne;\n public Expression Seq;\n public Expression E0;\n public Expression E1;\n\n public SeqSelectExpr(bool SelectOne, Expression Seq, Expression E0, Expression E1) { this.SelectOne = SelectOne; this.Seq = Seq; this.E0 = E0; this.E1 = E1; }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n Seq = Seq.Resolve(resolver, null);\n if (E0 != null) { E0 = E0.Resolve(resolver, Type.Int); }\n if (E1 != null) { E1 = E1.Resolve(resolver, Type.Int); }\n Type = SelectOne ? ((SeqType)Seq.Type).Arg : Seq.Type;\n return this;\n }\n}\n\npublic class SeqUpdateExpr: Expression\n{\n public Expression Seq;\n public Expression Index;\n public Expression Value;\n public Expression ResolvedUpdateExpr = null;\n\n public SeqUpdateExpr(Expression Seq, Expression Index, Expression Value) { this.Seq = Seq; this.Index = Index; this.Value = Value; }\n\n static int xCount = 0;\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n Seq = Seq.Resolve(resolver, null);\n if (Seq.Type is SeqType)\n {\n Index = Index.Resolve(resolver, Type.Int);\n Value = Value.Resolve(resolver, ((SeqType)Seq.Type).Arg);\n Type = Seq.Type;\n return this;\n }\n else\n {\n UserDefinedType ut = (UserDefinedType)(Seq.Type);\n string name = ((IdentifierExpr)Index).Name;\n foreach (DatatypeCtor ctor in ut.AsDatatype.Ctors)\n {\n foreach (Formal formal in ctor.Formals)\n {\n if (formal.Name == name)\n {\n //- Seq[name := Value]\n //- -->\n //- let x := Seq in ctor(x.f1, ..., Value, ..., x.fn)\n IdentifierExpr x = new IdentifierExpr(tok, \"#UPDATE##\" + (xCount++));\n List args = new List(); // args = (x.f1, ..., Value, ..., x.fn)\n foreach (Formal f in ctor.Formals)\n {\n Expression arg = (f.Name == name) ? Value : new MemberSelectExpr(x, f.Name);\n args.Add(arg);\n }\n Expression body = new DatatypeValue(ut.TypeArgs, ctor, args, ut);\n Expression ret = new LetExpr(true,\n new List(new ExprLhs[] { new ExprLhs(new BoundVar(tok, x.Name, Seq.Type)) }),\n new List(new Expression[] { Seq }),\n body);\n return ret.Resolve(resolver, Seq.Type);\n }\n }\n }\n throw new Exception(\"field update selector not found: \" + name);\n }\n }\n}\n\npublic class SeqDisplayExpr: Expression\n{\n public List Elements;\n\n public SeqDisplayExpr(List Elements) { this.Elements = Elements; }\n\n public override Expression Resolve(Resolver resolver, Type t)\n {\n SeqType tSeq = t as SeqType;\n for (int i = 0; i < Elements.Count; i++) { Elements[i] = Elements[i].Resolve(resolver, tSeq == null ? null : tSeq.Arg); }\n Type = (Elements.Count == 0) ? t : new SeqType(Elements[0].Type);\n return this;\n }\n}\n\npublic class ExprLhs\n{\n public BoundVar Var;\n public ExprLhs(BoundVar Var) { this.Var = Var; }\n}\n\npublic class ExprRhs\n{\n public Expression Expr;\n public ExprRhs(Expression Expr) { this.Expr = Expr; }\n}\n\npublic class SpecExpression\n{\n public Attributes Attributes;\n public Expression E;\n\n public SpecExpression(Attributes Attributes, Expression E) { this.Attributes = Attributes; this.E = E; }\n public void Resolve(Resolver resolver)\n {\n Attributes.Resolve(resolver, Attributes);\n E = E.Resolve(resolver, Type.Bool);\n }\n}\n\npublic class FrameExpression\n{\n public Token tok;\n public Expression E = new ThisExpr();\n public string FieldName;\n public Field Field;\n\n public FrameExpression(string FieldName) { this.FieldName = FieldName; }\n public void Resolve(Resolver resolver) { Field = resolver.Find(resolver.fields, FieldName); }\n}\n\npublic class Statement\n{\n public Token Tok = Token.NoToken;\n}\n\npublic class BlockStmt: Statement\n{\n public List Body;\n\n public BlockStmt() { Body = new List(); }\n}\n\npublic class VarDeclStmt: Statement\n{\n public List Locals;\n public object Update;\n public bool IsGhost;\n\n //public VarDeclStmt(string name, Type type, bool isGhost) { this.Name = name; this.Type = type; this.IsGhost = isGhost; }\n //public VarDeclStmt(Token tok1, Token tok2, string name, Type type, bool isGhost): this(name, type, isGhost) {}\n}\n\ninternal class VarDecl\n{\n public string Name;\n public Type Type;\n public bool IsGhost;\n\n public VarDecl(string name, Type type, bool isGhost) { this.Name = name; this.Type = type; this.IsGhost = isGhost; }\n public VarDecl(Token tok1, Token tok2, string name, Type type, bool isGhost): this(name, type, isGhost) {}\n}\n\npublic class IfStmt: Statement\n{\n public Expression Guard;\n public Statement Thn;\n public Statement Els;\n}\n\npublic class AssertStmt: Statement\n{\n public Expression Expr;\n}\n\npublic class AssignStmt: Statement\n{\n public Expression Lhs;\n public ExprRhs Rhs;\n}\n\npublic class CallStmt: Statement\n{\n public List Lhs;\n public List Args;\n public MemberSelectExpr MethodSelect;\n\n internal CallStmt(List Args, Dictionary TypeArgumentSubstitutions, Method Method)\n {\n this.Lhs = new List();\n this.Args = Args;\n this.MethodSelect = new MemberSelectExpr(Method, TypeArgumentSubstitutions);\n }\n}\n\npublic class CalcStmt: Statement\n{\n public class BinaryCalcOp\n {\n public BinaryExpr.Opcode Op;\n }\n\n public List Steps;\n public List Hints;\n public BinaryCalcOp Op;\n\n public static Expression Lhs(Expression e) { return null; }\n}\n\npublic class ForallStmt: Statement\n{\n public List BoundVars;\n public List Ens;\n public Expression Range;\n public Statement Body;\n}\n\npublic class AssignSuchThatStmt: Statement\n{\n public List Lhss;\n public Expression Expr;\n}\n\npublic class UpdateStmtRhs\n{\n public Attributes Attributes;\n}\n\npublic class ConcreteSyntaxStatement: Statement\n{\n public List ResolvedStatements;\n}\n\npublic class UpdateStmt: Statement\n{\n public List Rhss;\n public List ResolvedStatements;\n}\n\npublic class Mod\n{\n public List Expressions;\n public Mod(List Expressions) { this.Expressions = Expressions; }\n}\n\npublic class Decreases\n{\n public List Expressions;\n public Decreases(List Expressions) { this.Expressions = Expressions; }\n public void Resolve(Resolver resolver)\n {\n for (int i = 0; i < Expressions.Count; i++)\n {\n Expressions[i] = Expressions[i].Resolve(resolver, Type.Int);\n if (Expressions[i].Type is NatType) { Expressions[i].Type = Type.Int; } // HACK\n }\n }\n}\n\npublic interface ICallable\n{\n Decreases Decreases { get; }\n List Ins { get; }\n}\n\npublic class MemberDecl\n{\n public Token tok;\n public Attributes Attributes;\n public string Name;\n public bool IsGhost;\n public bool IsStatic = false;\n\n public MemberDecl(Token tok, Attributes Attributes, string Name, bool IsGhost)\n {\n this.tok = tok;\n this.Attributes = Attributes;\n this.Name = Name;\n this.IsGhost = IsGhost;\n }\n\n}\n\npublic class Field: MemberDecl\n{\n public Type Type;\n\n public Field(Token tok, Attributes Attributes, string Name, bool IsGhost, Type Type)\n :base(tok, Attributes, Name, IsGhost)\n {\n this.Type = Type;\n }\n\n //internal VarDeclStmt AsVarDecl() { return new VarDeclStmt(Name, Type, IsGhost); }\n}\n\npublic class Function: MemberDecl, ICallable\n{\n public ClassDecl EnclosingClass;\n public List TypeArgs;\n public List Formals;\n public Type ResultType;\n public List Req;\n public List Ens;\n Decreases decreases;\n public Expression Body;\n\n public List Reads = new List(); // TODO\n public bool IsRecursive;\n\n internal Function(string Name): base(Token.NoToken, null, Name, true) {}\n\n public Function(Token tok, Attributes Attributes, string Name, bool IsGhost,\n List TypeArgs, List Formals, Type ResultType,\n List Req, List Ens, Decreases decreases, Expression Body)\n :base(tok, Attributes, Name, IsGhost)\n {\n this.EnclosingClass = ClassDecl.TheClass;\n this.TypeArgs = TypeArgs;\n this.Formals = new List();\n foreach (Formal f in Formals) { this.Formals.Add(new Formal(f.Name, f.Type, f.IsGhost || IsGhost)); }\n this.ResultType = ResultType;\n this.Req = Req;\n this.Ens = Ens;\n this.decreases = decreases;\n this.Body = Body;\n }\n\n public Decreases Decreases { get { return decreases; } }\n public List Ins { get { return Formals; } }\n}\n\npublic class Method: MemberDecl, ICallable\n{\n Decreases decreases;\n\n public List TypeArgs;\n public List Formals;\n public List Outs;\n public List Req;\n public List Ens;\n public Mod Mod;\n public BlockStmt Body;\n\n public Method(Token tok, Attributes Attributes, string Name, bool IsGhost,\n List TypeArgs, List Formals, List Outs,\n List Req, List Ens, Mod Mod, Decreases decreases, BlockStmt Body)\n :base(tok, Attributes, Name, IsGhost)\n {\n this.TypeArgs = TypeArgs;\n this.Formals = new List();\n foreach (Formal f in Formals) { this.Formals.Add(new Formal(f.Name, f.Type, f.IsGhost || IsGhost)); }\n this.Outs = new List();\n foreach (Formal f in Outs) { this.Outs.Add(new Formal(f.Name, f.Type, f.IsGhost || IsGhost)); }\n this.Req = Req;\n this.Ens = Ens;\n this.Mod = Mod;\n this.decreases = decreases;\n this.Body = Body;\n }\n\n public Decreases Decreases { get { return decreases; } }\n public List Ins { get { return Formals; } }\n}\n\nabstract public class Lemma: Method\n{\n public Lemma(Token tok, Attributes Attributes, string Name, bool IsGhost,\n List TypeArgs, List Formals, List Outs,\n List Req, List Ens, Mod Mod, Decreases decreases, BlockStmt Body)\n :base(tok, Attributes, Name, IsGhost, TypeArgs, Formals, Outs, Req, Ens, Mod, decreases, Body)\n {\n }\n}\n\npublic class TopLevelDecl\n{\n public Token tok;\n public Attributes Attributes;\n public string Name;\n}\n\npublic class DatatypeCtor\n{\n public DatatypeDecl datatype;\n public string Name;\n public List Formals;\n public DatatypeCtor(string Name, List Formals) { this.Name = Name; this.Formals = Formals; }\n}\n\npublic class DatatypeDestructor : Field\n{ \n public DatatypeCtor EnclosingCtor;\n\n public DatatypeDestructor(DatatypeCtor EnclosingCtor, Token tok, Attributes Attributes, string Name, bool IsGhost, Type Type)\n : base(tok, Attributes, Name, IsGhost, Type) { this.EnclosingCtor = EnclosingCtor; }\n}\n\npublic class DatatypeDecl: TopLevelDecl\n{\n public List TypeArgs;\n public List Ctors;\n\n public DatatypeDecl(Token tok, string name, Attributes attrs, List TypeArgs, List Ctors)\n {\n this.tok = tok;\n this.Name = name;\n this.Attributes = attrs;\n this.TypeArgs = TypeArgs;\n this.Ctors = Ctors;\n }\n}\n\npublic class ClassDecl: TopLevelDecl\n{\n public static ClassDecl TheClass = new ClassDecl();\n\n public List Members = new List();\n}\n\npublic class ModuleDefinition\n{\n public string Name;\n public List TopLevelDecls;\n public ModuleDefinition(string Name, List TopLevelDecls) { this.Name = Name; this.TopLevelDecls = TopLevelDecls; }\n}\n\npublic class Program\n{\n public List Modules;\n public Program(List Modules) { this.Modules = Modules; }\n\n public static List MakeList(IEnumerable e) { return new List(e); }\n}\n\npublic class Resolver\n{\n public A Find(Dictionary dict, string key)\n {\n if (!dict.ContainsKey(key)) { throw new Exception(\"could not find: \" + key); }\n else return dict[key];\n }\n public Dictionary datatypes = new Dictionary();\n public Dictionary constructors = new Dictionary();\n public Dictionary fields = new Dictionary();\n public Dictionary functions = new Dictionary();\n public Dictionary methods = new Dictionary();\n public Function currentFunction;\n public Method currentMethod;\n\n public Dictionary typeParams = new Dictionary();\n Dictionary> vars = new Dictionary>();\n int ghost;\n List> collectVars = new List>();\n\n public Resolver(Program program)\n {\n foreach (ModuleDefinition module in program.Modules)\n {\n foreach (TopLevelDecl decl in module.TopLevelDecls)\n {\n DatatypeDecl data = decl as DatatypeDecl;\n if (data != null)\n {\n datatypes.Add(data.Name, data);\n foreach (DatatypeCtor ctor in data.Ctors)\n {\n constructors.Add(ctor.Name, ctor);\n ctor.datatype = data;\n }\n }\n }\n }\n foreach (MemberDecl member in ClassDecl.TheClass.Members)\n {\n Field field = member as Field;\n Function fun = member as Function;\n Method method = member as Method;\n if (field != null) { fields.Add(field.Name, field); }\n if (fun != null) { functions.Add(fun.Name, fun); }\n if (method != null) { methods.Add(method.Name, method); }\n }\n }\n\n List varList(string x)\n {\n if (!vars.ContainsKey(x)) { vars.Add(x, new List()); }\n return vars[x];\n }\n\n public void PushTypeParam(TypeParameter p) { typeParams.Add(p.Name, p); }\n public void PopTypeParam(TypeParameter p) { typeParams.Remove(p.Name); }\n\n public void PushVar(string x, Type t, bool isGhost) { varList(x).Add(new VarDecl(x, t, isGhost)); }\n public void PushVar(BoundVar x) { PushVar(x.Name, x.Type, x.IsGhost); }\n public void PopVar(string x) { vars[x].RemoveAt(vars[x].Count - 1); }\n internal VarDecl Var(string x) { return vars.ContainsKey(x) && vars[x].Count > 0 ? vars[x][vars[x].Count - 1] : null; }\n\n public void PushGhost() { ghost++; }\n public void PopGhost() { ghost--; }\n public bool IsGhost() { return ghost != 0; }\n\n public void PushVarCollect() { collectVars.Add(new Dictionary()); }\n public Dictionary PopVarCollect() { Dictionary r = collectVars[collectVars.Count - 1]; collectVars.RemoveAt(collectVars.Count - 1); return r; }\n public void CollectVar(string x) { foreach (Dictionary d in collectVars) { d[x] = true; } }\n\n public static Type SubstType(Type t, Dictionary map)\n {\n return t.Subst(map);\n }\n}\n\n}\n\n" }, { "path": "ironclad-apps/tools/DafnySpec/DafnySpecAst/DafnySpecAst.csproj", "content": "\n\n \n \n Debug\n AnyCPU\n {BE5E53DC-B929-4031-B85B-71138AD363CF}\n Library\n Properties\n DafnySpecAst\n DafnySpecAst\n v3.5\n 512\n \n \n \n true\n full\n false\n ..\\bin\\\n DEBUG;TRACE\n prompt\n 4\n \n \n pdbonly\n true\n ..\\bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/DafnySpec/DafnySpecAst/nubuild-manifest.txt", "content": "# This file only exists because NuBuild requires that it be here.\n# You could argue that this is a bug in NuBuild.\n" }, { "path": "ironclad-apps/tools/DafnySpec/Makefile", "content": "#\r\n# Copyright (c) 2007 Microsoft Corporation. All rights reserved.\r\n#\r\n\r\nBUILD = ..\\..\\build\r\nMSBUILD=C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\r\n#FSC = $(BUILD)\\fsc -g\r\n#FSLEX = $(BUILD)\\fslex\r\n#FSYACC = $(BUILD)\\fsyacc\r\n#OLD_CSC = ..\\..\\..\\base\\build\\csc.exe\r\n#CSC = %SystemRoot%\\Microsoft.NET\\Framework\\v4.0.30319\\csc.exe\r\n#CSC0 = ..\\..\\..\\base\\build-private\\v4.0.30319\\csc.exe\r\n#CSC1 = ..\\..\\..\\base\\build-private\\v4.0.30319-Windows8.1\\csc.exe\r\nOBJ = ..\\..\\obj_tools\\dafnyspec\r\nBIN = ..\\..\\bin_tools\\dafnyspec\r\nSRC = .\r\n\r\nDAFNYSPEC_SOURCES = \\\r\n\t$(SRC)\\Util.cs \\\r\n\t$(SRC)\\RtlGhost.cs \\\r\n\t$(SRC)\\Compile.cs \\\r\n\t$(SRC)\\CompileField.cs \\\r\n\t$(SRC)\\CompileFunction.cs \\\r\n\t$(SRC)\\CompileMethodGhost.cs \\\r\n\t$(SRC)\\ParseMain.cs \\\r\n\t$(SRC)\\DafnySpec.cs \\\r\n\r\nPARSER_SOURCES = \\\r\n\t$(SRC)\\parse_util.fs \\\r\n\t$(SRC)\\parser.fs \\\r\n\r\nREFS = /r:System.Numerics.dll /r:dafnyspecast.dll /r:$(BIN)\\parser.dll\r\n\r\nall: dafnyspec\r\n\r\ndafnyspec: $(OBJ) $(BIN) $(BIN)\\dafnyspec.exe\r\n\r\n$(OBJ):\r\n\tmd $(OBJ)\r\n\r\n$(BIN):\r\n\tmd $(BIN)\r\n\r\n$(BIN)\\dafnyspec.exe: $(DAFNYSPEC_SOURCES) $(SRC)\\DafnySpecAst.cs $(PARSER_SOURCES) $(SRC)\\lex.fsl $(SRC)\\parse.fsy\r\n\t$(MSBUILD) DafnySpec.sln\r\n\r\n#$(BIN)\\dafnyspecast.dll: $(SRC)\\DafnySpecAst.cs\r\n#\t$(OLD_CSC) /debug+ /target:library /out:$(BIN)\\dafnyspecast.dll\t$(SRC)\\DafnySpecAst.cs\r\n#\r\n#$(OBJ)\\lex.fsi $(OBJ)\\lex.fs: $(SRC)\\lex.fsl\r\n#\t$(FSLEX) $(SRC)\\lex.fsl -o $(OBJ)\\lex.fs\r\n#\r\n#$(OBJ)\\parse.fsi $(OBJ)\\parse.fs: $(SRC)\\parse.fsy\r\n#\t$(FSYACC) -v $(SRC)\\parse.fsy -o $(OBJ)\\parse.fs\r\n#\r\n#$(BIN)\\parser.dll: $(PARSER_SOURCES) $(BIN)\\dafnyspecast.dll\r\n#\t$(FSC) --standalone --mlcompatibility --target:library -O $(PARSER_SOURCES) -o $(BIN)\\parser.dll -r FSharp.PowerPack.dll -r $(BIN)\\dafnyspecast.dll\r\n#\r\n#$(BIN)\\dafnyspec.exe: $(DAFNYSPEC_SOURCES) $(BIN)\\dafnyspecast.dll $(BIN)\\parser.dll\r\n#\tif exist $(CSC). ($(CSC) /debug+ /out:$(BIN)\\dafnyspec.exe /lib:$(BIN) $(DAFNYSPEC_SOURCES) $(REFS).) else ($(CSC0) /debug+ /out:$(BIN)\\dafnyspec.exe /lib:$(BIN) $(DAFNYSPEC_SOURCES) $(REFS).)\r\n#\r\n" }, { "path": "ironclad-apps/tools/DafnySpec/ParseMain.cs", "content": "using System;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Collections.Generic;\r\nusing System.Collections.ObjectModel;\r\nusing System.Numerics;\r\nusing Microsoft.Boogie;\r\nusing Microsoft.Dafny;\r\n\r\nnamespace Microsoft.Boogie\r\n{\r\n\r\npublic class CommandLineOptionEngine\r\n{\r\n public class CommandLineParseState\r\n {\r\n public List args;\r\n public int i;\r\n public bool ConfirmArgumentCount(int n)\r\n {\r\n return (i++) + n <= args.Count;\r\n }\r\n }\r\n}\r\n\r\npublic class CommandLineOptions\r\n{\r\n public static CommandLineOptions Clo = new CommandLineOptions();\r\n\r\n public bool RunningBoogieFromCommandLine;\r\n public List Files = new List();\r\n\r\n protected virtual bool ParseOption(string name, CommandLineOptionEngine.CommandLineParseState ps)\r\n {\r\n return false;\r\n }\r\n\r\n public bool Parse(string[] args)\r\n {\r\n CommandLineOptionEngine.CommandLineParseState ps = new CommandLineOptionEngine.CommandLineParseState();\r\n Func replaceAt = (s, i, c) => s.Substring(0, i) + c + s.Substring(i + 1);\r\n ps.args = new List(args)\r\n .ConvertAll(s => s.StartsWith(\"/\") && s.Contains(\":\") ? replaceAt(s, s.IndexOf(':'), '*') : s)\r\n .SelectMany(s => s.Split(new char[] {'*'})).ToList();\r\n ps.i = 0;\r\n for (ps.i = 0; ps.i < ps.args.Count; ps.i++)\r\n {\r\n string name = ps.args[ps.i];\r\n if (name.StartsWith(\"-\") || name.StartsWith(\"/\"))\r\n {\r\n if (!Clo.ParseOption(name.Substring(1), ps))\r\n {\r\n throw new Exception(\"unknown command-line switch: \" + name);\r\n }\r\n }\r\n else\r\n {\r\n Files.Add(new FileInfo(ps.args[ps.i]).FullName);\r\n }\r\n }\r\n return true;\r\n }\r\n}\r\n\r\n}\r\n\r\nnamespace Microsoft.Dafny\r\n{\r\n\r\npublic class DafnyOptions: CommandLineOptions\r\n{\r\n public static void Install(DafnyOptions options)\r\n {\r\n Clo = options;\r\n }\r\n}\r\n\r\nclass AutoReq\r\n{\r\n Resolver resolver;\r\n Dictionary doneFunctions = new Dictionary();\r\n Dictionary doneMethods = new Dictionary();\r\n\r\n internal AutoReq(Resolver resolver)\r\n {\r\n this.resolver = resolver;\r\n }\r\n\r\n internal void ReqFunction(Function fun)\r\n {\r\n if (!doneFunctions.ContainsKey(fun.Name))\r\n {\r\n doneFunctions.Add(fun.Name, \"\");\r\n if (Attributes.Contains(fun.Attributes, \"autoReq\"))\r\n {\r\n if (Attributes.Contains(fun.Attributes, \"opaque\") && !fun.Name.EndsWith(\"_FULL\"))\r\n {\r\n var new_reqs = new List();\r\n Function full = (Function)ClassDecl.TheClass.Members.Find(\r\n m => m.Name == \"#\" + fun.Name + \"_FULL\");\r\n ReqFunction(full);\r\n fun.Req.Clear();\r\n fun.Req.AddRange(full.Req);\r\n }\r\n else\r\n {\r\n List auto_reqs = new List();\r\n foreach (Expression req in fun.Req)\r\n {\r\n auto_reqs.AddRange(GenerateAutoReqs(req, fun));\r\n }\r\n fun.Req.InsertRange(0, auto_reqs);\r\n if (fun.Body != null)\r\n {\r\n auto_reqs = GenerateAutoReqs(fun.Body, fun);\r\n fun.Req.AddRange(auto_reqs);\r\n }\r\n }\r\n }\r\n }\r\n }\r\n\r\n internal void ReqMethod(Method method)\r\n {\r\n if (!doneMethods.ContainsKey(method.Name))\r\n {\r\n doneMethods.Add(method.Name, \"\");\r\n if (Attributes.Contains(method.Attributes, \"autoReq\"))\r\n {\r\n List auto_reqs = new List();\r\n foreach (SpecExpression req in method.Req)\r\n {\r\n List local_auto_reqs = GenerateAutoReqs(req.E, null);\r\n foreach (Expression local_auto_req in local_auto_reqs)\r\n {\r\n auto_reqs.Add(new SpecExpression(null, local_auto_req));\r\n }\r\n }\r\n method.Req.InsertRange(0, auto_reqs);\r\n }\r\n }\r\n }\r\n\r\n Expression Andify(List exprs)\r\n {\r\n Expression ret = null;\r\n foreach (var expr in exprs)\r\n {\r\n ret = (ret == null) ? expr : new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.And, ret, expr);\r\n ret.Type = Type.Bool;\r\n }\r\n return ret != null ? ret : new LiteralExpr(true);\r\n }\r\n\r\n List GatherReqs(Function fun, List args)\r\n {\r\n List translated_f_reqs = new List();\r\n if (fun.Req.Count > 0)\r\n {\r\n List> substs = fun.Formals.Zip(args, (f, arg) =>\r\n Tuple.Create(new BoundVar(Token.NoToken, f.Name, f.Type), arg)).ToList();\r\n substs = substs.Where(p => !(p.Item2 is IdentifierExpr) || ((IdentifierExpr)p.Item2).Name != p.Item1.Name).ToList();\r\n List lhss = substs.ConvertAll(p => new ExprLhs(p.Item1));\r\n foreach (var req in fun.Req)\r\n {\r\n var letExpr = new LetExpr(true, lhss, substs.ConvertAll(p => p.Item2), req);\r\n letExpr.tryToEliminate = true;\r\n translated_f_reqs.Add(letExpr);\r\n }\r\n }\r\n return translated_f_reqs;\r\n }\r\n\r\n List GenerateAutoReqs(Expression expr, Function parent)\r\n {\r\n List reqs = new List();\r\n Func> generateAutoReqs = e => GenerateAutoReqs(e, parent);\r\n if (expr is LiteralExpr)\r\n {\r\n }\r\n else if (expr is ThisExpr)\r\n {\r\n }\r\n else if (expr is IdentifierExpr)\r\n {\r\n }\r\n else if (expr is SeqDisplayExpr)\r\n {\r\n SeqDisplayExpr e = (SeqDisplayExpr)expr;\r\n foreach (var elt in e.Elements)\r\n {\r\n reqs.AddRange(generateAutoReqs(elt));\r\n }\r\n }\r\n else if (expr is MemberSelectExpr && ((MemberSelectExpr)expr).Member is Field)\r\n {\r\n MemberSelectExpr e = (MemberSelectExpr)expr;\r\n reqs.AddRange(generateAutoReqs(e.Obj));\r\n }\r\n else if (expr is SeqSelectExpr)\r\n {\r\n SeqSelectExpr e = (SeqSelectExpr)expr;\r\n reqs.AddRange(generateAutoReqs(e.Seq));\r\n if (e.E0 != null)\r\n {\r\n reqs.AddRange(generateAutoReqs(e.E0));\r\n }\r\n if (e.E1 != null)\r\n {\r\n reqs.AddRange(generateAutoReqs(e.E1));\r\n }\r\n }\r\n else if (expr is SeqUpdateExpr)\r\n {\r\n SeqUpdateExpr e = (SeqUpdateExpr)expr;\r\n reqs.AddRange(generateAutoReqs(e.Seq));\r\n reqs.AddRange(generateAutoReqs(e.Index));\r\n reqs.AddRange(generateAutoReqs(e.Value));\r\n }\r\n else if (expr is FunctionCallExpr)\r\n {\r\n FunctionCallExpr e = (FunctionCallExpr)expr;\r\n foreach (var arg in e.Args)\r\n {\r\n reqs.AddRange(generateAutoReqs(arg));\r\n }\r\n if (parent == null || parent.Name != e.name)\r\n {\r\n ReqFunction(e.Function);\r\n reqs.AddRange(GatherReqs(e.Function, e.Args));\r\n }\r\n }\r\n else if (expr is DatatypeValue)\r\n { \r\n DatatypeValue dtv = (DatatypeValue)expr;\r\n for (int i = 0; i < dtv.Arguments.Count; i++)\r\n {\r\n Expression arg = dtv.Arguments[i];\r\n reqs.AddRange(generateAutoReqs(arg));\r\n }\r\n }\r\n else if (expr is OldExpr)\r\n {\r\n }\r\n else if (expr is MatchExpr)\r\n {\r\n MatchExpr e = (MatchExpr)expr;\r\n reqs.AddRange(generateAutoReqs(e.Source));\r\n List newMatches = new List();\r\n foreach (MatchCaseExpr caseExpr in e.Cases)\r\n {\r\n MatchCaseExpr c = new MatchCaseExpr(caseExpr.name, caseExpr.Arguments, Andify(generateAutoReqs(caseExpr.Body)));\r\n newMatches.Add(c);\r\n }\r\n reqs.Add(new MatchExpr(e.Source, newMatches));\r\n }\r\n else if (expr is UnaryOpExpr)\r\n {\r\n UnaryOpExpr e = (UnaryOpExpr)expr;\r\n Expression arg = e.E; \r\n reqs.AddRange(generateAutoReqs(arg));\r\n }\r\n else if (expr is BinaryExpr)\r\n {\r\n BinaryExpr e = (BinaryExpr)expr;\r\n switch (e.Op)\r\n {\r\n case BinaryExpr.Opcode.Imp:\r\n case BinaryExpr.Opcode.And:\r\n reqs.AddRange(generateAutoReqs(e.E0));\r\n foreach (var req in generateAutoReqs(e.E1))\r\n {\r\n reqs.Add(new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Imp, e.E0, req));\r\n }\r\n break;\r\n case BinaryExpr.Opcode.Or:\r\n reqs.AddRange(generateAutoReqs(e.E0));\r\n foreach (var req in generateAutoReqs(e.E1))\r\n {\r\n reqs.Add(new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Imp,\r\n new UnaryOpExpr(Token.NoToken, UnaryOpExpr.Opcode.Not, e.E0), req));\r\n }\r\n break;\r\n default:\r\n reqs.AddRange(generateAutoReqs(e.E0));\r\n reqs.AddRange(generateAutoReqs(e.E1));\r\n break;\r\n }\r\n }\r\n else if (expr is LetExpr)\r\n {\r\n var e = (LetExpr)expr;\r\n if (e.Exact)\r\n {\r\n foreach (var rhs in e.RHSs)\r\n {\r\n reqs.AddRange(generateAutoReqs(rhs));\r\n }\r\n var new_reqs = generateAutoReqs(e.Body);\r\n if (new_reqs.Count > 0)\r\n {\r\n reqs.Add(new LetExpr(e.Exact, e.LHSs, e.RHSs, Andify(new_reqs)));\r\n }\r\n }\r\n }\r\n else if (expr is QuantifierExpr)\r\n {\r\n QuantifierExpr e = (QuantifierExpr)expr;\r\n var auto_reqs = generateAutoReqs(e.Term);\r\n if (auto_reqs.Count > 0)\r\n {\r\n Expression allReqsSatisfied = Andify(auto_reqs);\r\n Expression allReqsSatisfiedAndTerm = new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.And, allReqsSatisfied, e.Term);\r\n e.Term = allReqsSatisfiedAndTerm;\r\n }\r\n }\r\n else if (expr is StmtExpr)\r\n {\r\n var e = (StmtExpr)expr;\r\n reqs.AddRange(generateAutoReqs(e.E));\r\n }\r\n else if (expr is ITEExpr)\r\n {\r\n ITEExpr e = (ITEExpr)expr;\r\n reqs.AddRange(generateAutoReqs(e.Test));\r\n reqs.Add(new ITEExpr(e.Test, Andify(generateAutoReqs(e.Thn)), Andify(generateAutoReqs(e.Els))));\r\n }\r\n return reqs;\r\n }\r\n}\r\n\r\npublic class Main\r\n{\r\n public static void Resolve(Resolver resolver, Program program)\r\n {\r\n try\r\n {\r\n foreach (ModuleDefinition module in program.Modules)\r\n {\r\n foreach (TopLevelDecl decl in module.TopLevelDecls)\r\n {\r\n DatatypeDecl data = decl as DatatypeDecl;\r\n if (data != null)\r\n {\r\n foreach (var ctor in data.Ctors)\r\n {\r\n resolver.PushGhost();\r\n data.TypeArgs.ForEach(p => resolver.PushTypeParam(p));\r\n ctor.Formals.ForEach(f => f.Resolve(resolver));\r\n data.TypeArgs.ForEach(p => resolver.PopTypeParam(p));\r\n resolver.PopGhost();\r\n }\r\n }\r\n }\r\n }\r\n foreach (MemberDecl member in ClassDecl.TheClass.Members)\r\n {\r\n Field field = member as Field;\r\n Function fun = member as Function;\r\n Method method = member as Method;\r\n if (field != null)\r\n {\r\n if (field.IsGhost) { resolver.PushGhost(); }\r\n field.Type.Resolve(resolver);\r\n if (field.IsGhost) { resolver.PopGhost(); }\r\n }\r\n if (fun != null)\r\n {\r\n resolver.currentFunction = fun;\r\n resolver.PushGhost();\r\n fun.TypeArgs.ForEach(p => resolver.PushTypeParam(p));\r\n fun.Formals.ForEach(x => { x.Resolve(resolver); });\r\n fun.ResultType.Resolve(resolver);\r\n fun.TypeArgs.ForEach(p => resolver.PopTypeParam(p));\r\n resolver.PopGhost();\r\n resolver.currentFunction = null;\r\n }\r\n if (method != null)\r\n {\r\n resolver.currentMethod = method;\r\n if (method.IsGhost) { resolver.PushGhost(); }\r\n method.TypeArgs.ForEach(p => resolver.PushTypeParam(p));\r\n method.Formals.ForEach(x => { x.Resolve(resolver); });\r\n method.Outs.ForEach(x => { x.Resolve(resolver); });\r\n method.TypeArgs.ForEach(p => resolver.PopTypeParam(p));\r\n if (method.IsGhost) { resolver.PopGhost(); }\r\n resolver.currentMethod = null;\r\n }\r\n }\r\n foreach (MemberDecl member in ClassDecl.TheClass.Members)\r\n {\r\n Function fun = member as Function;\r\n Method method = member as Method;\r\n if (fun != null)\r\n {\r\n resolver.currentFunction = fun;\r\n resolver.PushGhost();\r\n fun.TypeArgs.ForEach(p => resolver.PushTypeParam(p));\r\n fun.Formals.ForEach(x => { resolver.PushVar(x.Name, x.Type, true); });\r\n fun.ResultType.Resolve(resolver);\r\n fun.Req = fun.Req.ConvertAll(e => e.Resolve(resolver, Type.Bool));\r\n fun.Ens = fun.Ens.ConvertAll(e => e.Resolve(resolver, Type.Bool));\r\n fun.Decreases.Resolve(resolver);\r\n if (fun.Body != null) { fun.Body = fun.Body.Resolve(resolver, fun.ResultType); }\r\n if (fun.IsRecursive && fun.Decreases.Expressions.Count == 0)\r\n {\r\n fun.Decreases.Expressions.Add(new IdentifierExpr(Token.NoToken, fun.Formals[0].Name));\r\n fun.Decreases.Resolve(resolver);\r\n }\r\n fun.Formals.ForEach(x => resolver.PopVar(x.Name));\r\n fun.TypeArgs.ForEach(p => resolver.PopTypeParam(p));\r\n resolver.PopGhost();\r\n resolver.currentFunction = null;\r\n }\r\n if (method != null)\r\n {\r\n resolver.currentMethod = method;\r\n if (method.IsGhost) { resolver.PushGhost(); }\r\n method.TypeArgs.ForEach(p => resolver.PushTypeParam(p));\r\n method.Formals.ForEach(x => { resolver.PushVar(x.Name, x.Type, true); });\r\n method.Req.ForEach(e => e.Resolve(resolver));\r\n method.Outs.ForEach(x => { resolver.PushVar(x.Name, x.Type, true); });\r\n method.Ens.ForEach(e => e.Resolve(resolver));\r\n method.Decreases.Resolve(resolver);\r\n method.Outs.ForEach(x => resolver.PopVar(x.Name));\r\n method.Formals.ForEach(x => resolver.PopVar(x.Name));\r\n method.TypeArgs.ForEach(p => resolver.PopTypeParam(p));\r\n if (method.IsGhost) { resolver.PopGhost(); }\r\n resolver.currentMethod = null;\r\n }\r\n }\r\n }\r\n catch (Exception e)\r\n {\r\n string ctxt =\r\n (resolver.currentMethod != null) ? \"in method \" + resolver.currentMethod.Name + \": \":\r\n (resolver.currentFunction != null) ? \"in function \" + resolver.currentFunction.Name + \": \":\r\n \"\";\r\n throw new Exception(ctxt, e);\r\n }\r\n }\r\n\r\n public static string ParseCheck(List modules, string name, out Program program)\r\n {\r\n LiteralExpr.MakeBigInt = new MakeBigInt(s => new LiteralExpr(BigInteger.Parse(s)));\r\n program = new Program(modules.ConvertAll(m => new ModuleDefinition(m, Parser.parse(m))));\r\n\r\n Resolver resolver = new Resolver(program);\r\n Resolve(resolver, program);\r\n\r\n List fullFunctions = new List();\r\n foreach (MemberDecl member in ClassDecl.TheClass.Members)\r\n {\r\n Function fun = member as Function;\r\n if (fun != null && Attributes.Contains(fun.Attributes, \"opaque\"))\r\n {\r\n Function full = new Function(fun.tok, fun.Attributes, \"#\" + fun.Name + \"_FULL\",\r\n fun.IsGhost, fun.TypeArgs, fun.Formals, fun.ResultType, fun.Req, fun.Ens,\r\n fun.Decreases, fun.Body);\r\n full.IsRecursive = fun.IsRecursive;\r\n fun.Body = null;\r\n fullFunctions.Add(full);\r\n }\r\n }\r\n ClassDecl.TheClass.Members.AddRange(fullFunctions);\r\n\r\n AutoReq autoReq = new AutoReq(resolver);\r\n foreach (MemberDecl member in ClassDecl.TheClass.Members)\r\n {\r\n Function fun = member as Function;\r\n Method method = member as Method;\r\n if (fun != null) { autoReq.ReqFunction(fun); }\r\n if (method != null) { autoReq.ReqMethod(method);}\r\n }\r\n\r\n Resolve(resolver, program);\r\n\r\n return null;\r\n }\r\n}\r\n\r\n}\r\n\r\n" }, { "path": "ironclad-apps/tools/DafnySpec/Parser/Parser.csproj", "content": "\n\n \n \n Debug\n AnyCPU\n {0C1E9D4F-6AAE-455C-B5C7-5DE6063CA99E}\n Library\n Properties\n Parser\n Parser\n v4.5\n 512\n \n \n true\n full\n false\n bin\\Debug\\\n DEBUG;TRACE\n prompt\n 4\n \n \n pdbonly\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n {be5e53dc-b929-4031-b85b-71138ad363cf}\n DafnySpecAst\n \n \n \n \n \n \n \n \n $(SolutionDir)\\..\\fsharp\\fslex $(SolutionDir)\\Parser\\lex.fsl -o lex.fs\n$(SolutionDir)\\..\\fsharp\\fsyacc -v $(SolutionDir)\\Parser\\parse.fsy -o parse.fs\n$(SolutionDir)\\..\\fsharp\\fsc -g --standalone --mlcompatibility --target:library -O $(SolutionDir)\\Parser\\parse_util.fs parse.fs lex.fs $(SolutionDir)\\Parser\\parser.fs -o parser.dll -r $(SolutionDir)\\..\\fsharp\\FSharp.PowerPack.dll -r dafnyspecast.dll\n\n \n \n" }, { "path": "ironclad-apps/tools/DafnySpec/Parser/ReadMe.txt", "content": "The real purpose of this project is to run its post-build event, which creates\nparser.dll. The build system, however, will first create a bogus parser.dll\nwith nothing of import in it. The post-build event will then overwrite this\nwith the real parser.dll.\n\nIdeally, we'd replace this with an actual F# project that would build\nparser.dll directly. However, we're currently using specific F# tooling\n(it's checked into the repository), but non-specific (whatever the user has\non their machine) C# and msbuild tooling. So this dance is to use the\nspecific F# binaries in the non-specific build environment.\n" }, { "path": "ironclad-apps/tools/DafnySpec/Parser/lex.fsl", "content": "{\nopen Lexing;;\nopen Parse;;\nopen Parse_util;;\nopen Microsoft.FSharp.Compatibility.OCaml.Big_int;;\n\nlet macros = ref (Map.empty:Map)\nlet cur_loc ():Microsoft.Boogie.Token = new Microsoft.Boogie.Token(!file, !line)\n\n}\n\nrule comment = parse\n| \"*/\" { () }\n| \"*)\" { () }\n| \"/*\" { comment lexbuf ; comment lexbuf }\n| \"(*\" { comment lexbuf ; comment lexbuf }\n| \"\\n\\r\" { incr line; comment lexbuf }\n| \"\\r\\n\" { incr line; comment lexbuf }\n| ['\\n''\\r'] { incr line; comment lexbuf }\n| _ { comment lexbuf }\nand preprocess_skip deep = parse\n| \"#else\" { if deep then preprocess_skip deep lexbuf else () }\n| \"#endif\" { () }\n| \"#ifdef\" { preprocess_skip true lexbuf; preprocess_skip deep lexbuf }\n| \"#ifndef\" { preprocess_skip true lexbuf; preprocess_skip deep lexbuf }\n| \"\\n\\r\" { incr line; preprocess_skip deep lexbuf }\n| \"\\r\\n\" { incr line; preprocess_skip deep lexbuf }\n| ['\\n''\\r'] { incr line; preprocess_skip deep lexbuf }\n| _ { preprocess_skip deep lexbuf }\nand file_name = parse\n| [' ']*[^' ''\\n''\\r']+[^'\\n''\\r']* { file := (lexeme lexbuf).Trim() ; token lexbuf }\n| [^'\\n''\\r']* { token lexbuf }\nand line_number = parse\n| ['0'-'9']+ { line := int_of_string(lexeme lexbuf) - 1 ; file_name lexbuf }\nand token = parse\n| \"\\n\\r\" { incr line; token lexbuf }\n| \"\\r\\n\" { incr line; token lexbuf }\n| ['\\n''\\r'] { incr line; token lexbuf }\n| [' ''\\t'] { token lexbuf }\n| \"//\"[^'\\n''\\r']* { token lexbuf }\n| \"#line\"[' ']* { line_number lexbuf }\n| \"/*call_lemma:*/\" { CALL_LEMMA }\n| \"/*\" { comment lexbuf ; token lexbuf }\n| \"(*\" { comment lexbuf ; token lexbuf }\n| \"#ifdef\"[' ']+['A'-'Z''a'-'z''0'-'9''_''$''?']+\n{\n let s = lexeme lexbuf in\n let x = s.Substring(\"#ifdef\".Length).Trim() in\n if Map.contains x !macros then token lexbuf else (preprocess_skip false lexbuf ; token lexbuf)\n}\n| \"#ifndef\"[' ']+['A'-'Z''a'-'z''0'-'9''_''$''?']+\n{\n let s = lexeme lexbuf in\n let x = s.Substring(\"#ifndef\".Length).Trim() in\n if not (Map.contains x !macros) then token lexbuf else (preprocess_skip false lexbuf ; token lexbuf)\n}\n| \"#else\" { preprocess_skip false lexbuf ; token lexbuf }\n| \"#endif\" { token lexbuf }\n| \":\" { COLON (cur_loc ()) }\n| \";\" { SEMI }\n| \"(\" { LPAREN }\n| \")\" { RPAREN }\n| \"[\" { LBRACKET }\n| \"]\" { RBRACKET }\n| \"{\" { LBRACE (cur_loc ()) }\n| \"}\" { RBRACE (cur_loc ()) }\n| \"<\" { LT }\n| \">\" { GT }\n| \"=\" { EQ }\n| \"+\" { PLUS }\n| \"-\" { MINUS }\n| \"*\" { STAR }\n| \"!\" { BANG }\n| \"?\" { QUESTION }\n| \"%\" { MOD }\n| \"/\" { DIV }\n| \",\" { COMMA }\n| \"|\" { BAR }\n| \"#\" { HASH }\n| \"`\" { TICK }\n| \".\" { DOT }\n| \"..\" { DOTDOT }\n| \":=\" { COLONEQ (cur_loc ()) }\n| \"<=\" { LE }\n| \">=\" { GE }\n| \"==\" { EQEQ }\n| \"!=\" { NE }\n| \"&&\" { AMPAMP }\n| \"||\" { BARBAR }\n| \":|\" { COLONBAR }\n| \"::\" { COLONCOLON }\n| \"=>\" { EQGT }\n| \"==>\" { EQEQGT }\n| \"<==\" { LTEQEQ }\n| \"<==>\" { LTEQEQGT }\n| \"type\" { TYPE (cur_loc ()) }\n//| \"const\" { CONST (cur_loc ()) }\n//| \"readonly\" { READONLY (cur_loc ()) }\n| \"datatype\" { DATATYPE (cur_loc ()) }\n| \"function\" { FUNCTION (cur_loc ()) }\n| \"predicate\" { PREDICATE (cur_loc ()) }\n| \"method\" { METHOD (cur_loc ()) }\n| \"lemma\" { LEMMA (cur_loc ()) }\n| \"returns\" { RETURNS (cur_loc ()) }\n//| \"axiom\" { AXIOM (cur_loc ()) }\n//| \"procedure\" { PROCEDURE (cur_loc ()) }\n//| \"implementation\" { IMPLEMENTATION (cur_loc ()) }\n| \"requires\" { REQUIRES (cur_loc ()) }\n| \"ensures\" { ENSURES (cur_loc ()) }\n| \"modifies\" { MODIFIES (cur_loc ()) }\n| \"decreases\" { DECREASES (cur_loc ()) }\n| \"invariant\" { INVARIANT (cur_loc ()) }\n| \"assert\" { ASSERT (cur_loc ()) }\n//| \"havoc\" { HAVOC }\n| \"goto\" { GOTO (cur_loc ()) }\n| \"call\" { CALL (cur_loc ()) }\n| \"forall\" { FORALL (cur_loc ()) }\n| \"exists\" { EXISTS (cur_loc ()) }\n//| \"lambda\" { LAMBDA (cur_loc ()) }\n| \"old\" { OLD }\n//| \"left\" { LEFT }\n//| \"right\" { RIGHT }\n//| \"relation\" { RELATION }\n//| \"public\" { PUBLIC }\n| \"int\" { INT }\n| \"nat\" { NAT }\n| \"real\" { REAL }\n| \"bool\" { BOOL }\n| \"seq\" { SEQ }\n| \"true\" { LITBOOL true }\n| \"false\" { LITBOOL false }\n| \"this\" { THIS }\n//| \"is\" { IS }\n//| \"let\" { LET }\n| \"in\" { IN }\n| \"match\" { MATCH }\n| \"case\" { CASE }\n| \"var\" { VAR (cur_loc ()) }\n| \"if\" { IF (cur_loc ()) }\n| \"then\" { THEN }\n| \"else\" { ELSE }\n| \"return\" { RETURN (cur_loc ()) }\n//| \"ireturn\" { IRETURN (cur_loc ()) }\n//| \"yield\" { YIELD (cur_loc ()) }\n//| \"linear\" { LINEAR }\n//| \"my\" { MY }\n| \"static\" { STATIC (cur_loc ()) }\n//| \"module\" { MODULE (cur_loc ()) }\n//| \"interface\" { INTERFACE (cur_loc ()) }\n//| \"import\" { IMPORT (cur_loc ()) }\n| \"include\" { INCLUDE (cur_loc ()) }\n//| \"atomic\" { ATOMIC }\n//| \"stable\" { STABLE }\n| \"ghost\" { GHOST }\n| \"0x\"['0'-'9''a'-'f''A'-'F']+ {\n let s = lexeme lexbuf in\n let s = String.sub s 2 (String.length s - 2) in\n let rec explode (n:int) s = if n = String.length s then [] else (String.get s n)::(explode (n+1) s) in\n let digits = List.map (Char.code << Char.lowercase) (explode 0 s) in\n let rec hex digits n =\n match digits with\n | [] -> n\n | h::t ->\n let d = if h >= (Char.code 'a') then h - (Char.code 'a') + 10 else h - (Char.code '0') in\n hex t (add_int_big_int d (mult_int_big_int 16 n)) in\n LITINT (hex digits zero_big_int)\n }\n| ['0'-'9']+ { LITINT (big_int_of_string(lexeme lexbuf)) }\n| ['0'-'9']+['.']['0'-'9']+ { LITREAL (lexeme lexbuf) }\n| ['0'-'9']+\"bv32\" { let s = lexeme lexbuf in LITBV32 (big_int_of_string(s.Substring(0, s.Length - 4))) }\n| ['_']*['A'-'Z']['_''a'-'z''A'-'Z''0'-'9''\\'']* { UID ((lexeme lexbuf)) }\n| ['_']*['a'-'z']['_''a'-'z''A'-'Z''0'-'9''\\'']* { LID ((lexeme lexbuf)) }\n| ['_']+['_''0'-'9''\\'']* { LID ((lexeme lexbuf)) }\n| ['\"'][^'\"']*['\"'] { LITSTRING (let s = lexeme lexbuf in s.Substring(1, s.Length - 2)) }\n| eof { EOF }\n| '\\000' { EOF }\n| _ { parse_err (\"cannot parse character: \\\"\" ^ (lexeme lexbuf) ^ \"\\\"\" ^ \"\\n(ascii code \" ^ (string_of_int (Char.code (String.get (lexeme lexbuf) 0))) ^ \")\") }\n\n" }, { "path": "ironclad-apps/tools/DafnySpec/Parser/nubuild-manifest.txt", "content": "# Project's PostBuildEvent uses FSharp tools:\ndependency ..\\..\\fsharp\\fslex.exe\ndependency ..\\..\\fsharp\\fsyacc.exe\ndependency ..\\..\\fsharp\\fsc.exe\ndependency ..\\..\\fsharp\\FSharp.Core.dll\ndependency ..\\..\\fsharp\\FSharp.Compiler.dll\n\n# Project's PostBuildEvent takes the following inputs to create the output:\ndependency lex.fsl\ndependency parse.fsy\ndependency parse_util.fs\ndependency parser.fs\ndependency ..\\..\\fsharp\\FSharp.PowerPack.dll\n\n# We don't list parser.dll as an output here because the project file already believes it is creating it.\n" }, { "path": "ironclad-apps/tools/DafnySpec/Parser/parse.fsy", "content": "%{\n\nopen Microsoft.Dafny;;\nopen Microsoft.Boogie;;\nopen Parse_util;;\nopen Microsoft.FSharp.Math;;\nopen Microsoft.FSharp.Compatibility.OCaml.Big_int;;\n\ntype decl = TopDecl of TopLevelDecl | MemDecl of MemberDecl | EmptyDecl\nlet processDecls (ds:decl list) =\n List.collect (fun d ->\n match d with\n | TopDecl t -> [t]\n | MemDecl m -> ClassDecl.TheClass.Members.Add(m); []\n | EmptyDecl -> [])\n ds\n\ntype spec = Requires of Attributes * Expression | Ensures of Attributes * Expression | Modifies of string list | Decreases of Expression\nlet processSpecs (ss:spec list) =\n ( List.collect (fun s -> match s with Requires (a, e) -> [(a, e)] | _ -> []) ss,\n List.collect (fun s -> match s with Ensures (a, e) -> [(a, e)] | _ -> []) ss,\n List.collect (fun s -> match s with Modifies xs -> xs | _ -> []) ss,\n List.collect (fun s -> match s with Decreases e -> [e] | _ -> []) ss)\n\nlet colonExpSeq (src:Expression) (idxs:Expression list):Expression =\n let rec f l n =\n match l with\n | [] -> []\n | h::t ->\n let m = new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Add, n, h) :> Expression in\n (n, m)::(f t m)\n in\n let zero = LiteralExpr.MakeBigInt.Invoke(\"0\") :> Expression in\n let subseqs = List.map (fun (i1, i2) -> new SeqSelectExpr(false, src, i1, i2) :> Expression) (f idxs zero) in\n new SeqDisplayExpr(toList subseqs) :> Expression\n\nlet underscores = ref 0;\nlet renameBv (x:string):string = match x with \"_\" -> incr underscores; x + (string !underscores) | _ -> x\n%}\n\n%start start\n%type start\n\n%token UID\n%token LID\n%token DUID\n%token DLID\n%token QUID\n%token QLID\n%token SEGNAME\n%token REGNAME\n%token LITINT\n%token LITREAL\n%token LITBV32\n%token LITBOOL\n%token LITSTRING\n%token SEMI LPAREN RPAREN LBRACKET RBRACKET BAR DOT HASH\n%token LT GT EQ BANG QUESTION COMMA LE GE EQEQ NE PLUS MINUS STAR DIV MOD AMPAMP BARBAR INT NAT REAL BOOL SEQ\n%token HAVOC OLD DOTDOT COLONBAR COLONCOLON EQGT EQEQGT LTEQEQ LTEQEQGT\n%token LEFT RIGHT RELATION PUBLIC CALL_LEMMA\n%token EAX EBX ECX EDX ESI EDI EBP ESP\n%token OPNREG OPNMEM IS THEN ELSE LET IN MATCH CASE LINEAR MY ATOMIC STABLE GHOST THIS TICK\n%token TYPE VAR CONST READONLY DATATYPE FUNCTION PREDICATE METHOD LEMMA AXIOM PROCEDURE IMPLEMENTATION STATIC MODULE INTERFACE IMPORT INCLUDE\n%token CALL RETURN IRETURN IF GOTO ASSERT INVARIANT COLON COLONEQ YIELD LBRACE RBRACE\n%token RETURNS REQUIRES ENSURES MODIFIES DECREASES\n%token FORALL EXISTS LAMBDA\n\n%token EOF\n\n/* Precedence declarations. */\n\n%right LET IN IF THEN ELSE FORALL EXISTS COLONCOLON MATCH CASE EQGT\n%left LTEQEQGT\n%right EQEQGT LTEQEQ\n%left AMPAMP BARBAR\n%left LT GT LE GE EQEQ NE IS\n%left PLUS MINUS\n%left STAR DIV MOD\n%right BANG\n%left LPAREN RPAREN LBRACKET RBRACKET DOT\n\n%%\n\n//start: INT EOF { [] }\nstart: Decls EOF { (ClassDecl.TheClass :> TopLevelDecl)::(processDecls $1) }\n\nId\n : LID { $1 }\n | UID { $1 }\nIds\n : { [] }\n | Id { [$1] }\n | Id COMMA Ids { $1::$3 }\n\nAttrArgs\n : { [] }\n | Exp { [$1] }\n | Exp COMMA AttrArgs { $1::$3 }\n\nAttrs\n : { null }\n | LBRACE COLON Id AttrArgs RBRACE Attrs { new Attributes($3, toList $4, $6) }\n\nType\n : INT { Type.Int :> Type }\n | NAT { Type.Nat :> Type }\n | REAL { Type.Real :> Type }\n | BOOL { Type.Bool :> Type }\n | SEQ LT Type GT { new SeqType($3) :> Type }\n | Id { new UserDefinedType(Token.NoToken, $1, null, toList []) :> Type }\n | Id LT Types GT { new UserDefinedType(Token.NoToken, $1, null, toList $3) :> Type }\n\nTypes\n : { [] }\n | Type { [$1] }\n | Type COMMA Types { $1::$3 }\n\nBoundVar\n : Id { new BoundVar(Token.NoToken, renameBv $1, null) }\n | Id COLON Type { new BoundVar(Token.NoToken, renameBv $1, $3) }\nBoundVars\n : { [] }\n | BoundVar { [$1] }\n | BoundVar COMMA BoundVars { $1::$3 }\n\nFormal\n : Id COLON Type { new Formal($1, $3, false) }\n | GHOST Id COLON Type { new Formal($2, $4, true) }\nFormals\n : { [] }\n | Formal { [$1] }\n | Formal COMMA Formals { $1::$3 }\n\nCase\n : CASE Id EQGT Exp1 { new MatchCaseExpr($2, toList [], $4) }\n | CASE Id LPAREN BoundVars RPAREN EQGT Exp1 { new MatchCaseExpr($2, toList $4, $7) }\nCases\n : { [] }\n | Case Cases { $1::$2 }\n\nColonExpList\n : COLON Exp1 { [$2] }\n | COLON Exp1 ColonExpList { $2::$3 }\n\nExp\n : Exp2 { $1 }\n | CALL_LEMMA Id LPAREN Exps RPAREN SEMI Exp { new StmtExprCall($2, toList $4, $7) :> Expression }\n | VAR BoundVars COLONEQ Exps SEMI Exp\n {\n new LetExpr (true, toList (List.map (fun x -> new ExprLhs(x)) $2), toList $4, $6) :> Expression\n }\n | VAR BoundVars COLONBAR Exps SEMI Exp\n {\n new LetExpr (false, toList (List.map (fun x -> new ExprLhs(x)) $2), toList $4, $6) :> Expression\n }\n\nExp2\n : Exp1 { $1 }\n | MATCH Exp1 Cases { new MatchExpr($2, toList $3) :> Expression }\n\nExp1\n : LPAREN Exp RPAREN { $2 }\n | IF Exp1 THEN Exp1 ELSE Exp1 { new ITEExpr($2, $4, $6) :> Expression }\n | Exp1 LTEQEQGT Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Iff, $1, $3) :> Expression }\n | Exp1 EQEQGT Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Imp, $1, $3) :> Expression }\n//TODO: check precedence, associativity | Exp1 LTEQEQ Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Exp1, $1, $3) :> Expression }\n | Exp1 AMPAMP Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.And, $1, $3) :> Expression }\n | Exp1 BARBAR Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Or, $1, $3) :> Expression }\n | Exp1 EQEQ Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Eq, $1, $3) :> Expression }\n | Exp1 NE Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Neq, $1, $3) :> Expression }\n | Exp1 LT Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Lt, $1, $3) :> Expression }\n | Exp1 GT Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Gt, $1, $3) :> Expression }\n | Exp1 LE Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Le, $1, $3) :> Expression }\n | Exp1 GE Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Ge, $1, $3) :> Expression }\n | Exp1 PLUS Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Add, $1, $3) :> Expression }\n | Exp1 MINUS Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Sub, $1, $3) :> Expression }\n | Exp1 STAR Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Mul, $1, $3) :> Expression }\n | Exp1 DIV Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Div, $1, $3) :> Expression }\n | Exp1 MOD Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Mod, $1, $3) :> Expression }\n | MINUS Exp1 { new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Sub, (LiteralExpr.MakeBigInt.Invoke(\"0\") :> Expression), $2) :> Expression }\n | BANG Exp1 { new UnaryOpExpr(Token.NoToken, UnaryOpExpr.Opcode.Not, $2) :> Expression }\n | FORALL BoundVars Attrs COLONCOLON Exp1 { new ForallExpr(toList $2, $3, $5) :> Expression }\n | EXISTS BoundVars Attrs COLONCOLON Exp1 { new ExistsExpr(toList $2, $3, $5) :> Expression }\n | FORALL BoundVars Attrs BAR Exp1 COLONCOLON Exp1 { new ForallExpr(toList $2, $3, new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Imp, $5, $7)) :> Expression }\n | EXISTS BoundVars Attrs BAR Exp1 COLONCOLON Exp1 { new ExistsExpr(toList $2, $3, new BinaryExpr(Token.NoToken, BinaryExpr.Opcode.Imp, $5, $7)) :> Expression }\n | Exp1 LBRACKET Exp1 RBRACKET { new SeqSelectExpr(true, $1, $3, null) :> Expression }\n | Exp1 LBRACKET DOTDOT Exp1 RBRACKET { new SeqSelectExpr(false, $1, null, $4) :> Expression }\n | Exp1 LBRACKET Exp1 DOTDOT RBRACKET { new SeqSelectExpr(false, $1, $3, null) :> Expression }\n | Exp1 LBRACKET Exp1 DOTDOT Exp1 RBRACKET { new SeqSelectExpr(false, $1, $3, $5) :> Expression }\n | Exp1 LBRACKET Exp1 COLONEQ Exp1 RBRACKET { new SeqUpdateExpr($1, $3, $5) :> Expression }\n | Exp1 LBRACKET Exp1 ColonExpList RBRACKET { colonExpSeq $1 ($3::$4) }\n | LBRACKET Exps RBRACKET { new SeqDisplayExpr(toList $2) :> Expression }\n | BAR Exp1 BAR { new UnaryOpExpr(Token.NoToken, UnaryOpExpr.Opcode.Cardinality, $2); :> Expression }\n | Exp1 DOT Id { new MemberSelectExpr($1, $3) :> Expression }\n | Exp1 DOT Id QUESTION { new MemberSelectExpr($1, $3 + \"?\") :> Expression }\n | LITBOOL { new LiteralExpr($1) :> Expression }\n | LITINT { LiteralExpr.MakeBigInt.Invoke(string_of_big_int $1) :> Expression }\n | LITREAL { new LiteralExpr(Microsoft.Basetypes.BigDec.FromString($1)) :> Expression }\n | OLD LPAREN Exp1 RPAREN { new OldExpr($3) :> Expression }\n | Id LPAREN Exps RPAREN { new FunctionCallExpr($1, toList [], toList $3) :> Expression }\n | REAL LPAREN Exp RPAREN { new ConversionExpr(new RealType(), $3) :> Expression }\n | INT LPAREN Exp RPAREN { new ConversionExpr(new IntType(), $3) :> Expression }\n | Id { new IdentifierExpr(Token.NoToken, $1) :> Expression }\n | LITSTRING { new StringLiteralExpr($1) :> Expression }\nExps\n : { [] }\n | Exp { [$1] }\n | Exp COMMA Exps { $1::$3 }\n\nStmt\n : Exp2 SEMI { () }\n | ASSERT Exp2 SEMI { () }\n | BlockStmt { () }\n\nStmts\n : { () }\n | Stmt Stmts { () }\n\nBlockStmt: LBRACE Stmts RBRACE { () }\nBlockStmtOpt: { null } | BlockStmt { new BlockStmt() }\n\nMod: THIS TICK Id { $3 }\nMods\n : { [] }\n | Mod { [$1] }\n | Mod COMMA Mods { $1::$3 }\n\nSpec\n : REQUIRES Attrs Exp1 SEMI { Requires ($2, $3) }\n | ENSURES Attrs Exp1 SEMI { Ensures ($2, $3) }\n | MODIFIES Mods SEMI { Modifies $2 }\n | DECREASES Exp1 SEMI { Decreases $2 }\nSpecs\n : { [] }\n | Spec Specs { $1::$2 }\n\nStaticOpt: { () } | STATIC { () }\nGhostOpt: { false } | GHOST { true }\nMethodGhost\n : METHOD { ($1, false) }\n | GHOST METHOD { ($2, true) }\n | LEMMA { ($1, true) }\nFunctionGhost\n : FUNCTION { ($1, true) }\n | FUNCTION METHOD { ($1, false) }\n\nBodyOpt: { null } | LBRACE Exp RBRACE { $2 }\n\nTypeCase\n : Id { new DatatypeCtor($1, toList []) }\n | Id LPAREN Formals RPAREN { new DatatypeCtor($1, toList $3) }\nTypeCases\n : { [] }\n | TypeCase { [$1] }\n | TypeCase BAR TypeCases { $1::$3 }\n\nTypeParamsOpt\n : { [] }\n | LT Ids GT { List.map (fun t -> new TypeParameter(t)) $2 }\nReturnsOpt\n : { [] }\n | RETURNS LPAREN Formals RPAREN { $3 }\n\nSemiOpt: { () } | SEMI { () }\n\nDecl\n : DATATYPE Attrs Id TypeParamsOpt EQ TypeCases SemiOpt { TopDecl(new DatatypeDecl($1, $3, $2, toList $4, toList $6)) }\n | StaticOpt GhostOpt VAR Attrs Id COLON Type SEMI { MemDecl(new Field($3, $4, $5, $2, $7)) }\n | StaticOpt PREDICATE Attrs Id TypeParamsOpt LPAREN Formals RPAREN Specs BodyOpt\n {\n let (reqs, enss, mods, decs) = processSpecs $9 in\n let reqs = List.map snd reqs in\n let enss = List.map snd enss in\n MemDecl(new Function($2, $3, $4, true, toList $5, toList $7, Type.Bool, toList reqs, toList enss, new Decreases(toList decs), $10))\n }\n | StaticOpt FunctionGhost Attrs Id TypeParamsOpt LPAREN Formals RPAREN COLON Type Specs BodyOpt\n {\n let (reqs, enss, mods, decs) = processSpecs $11 in\n let reqs = List.map snd reqs in\n let enss = List.map snd enss in\n MemDecl(new Function(fst $2, $3, $4, snd $2, toList $5, toList $7, $10, toList reqs, toList enss, new Decreases(toList decs), $12))\n }\n | StaticOpt MethodGhost Attrs Id TypeParamsOpt LPAREN Formals RPAREN ReturnsOpt Specs BlockStmtOpt\n {\n let (reqs, enss, mods, decs) = processSpecs $10 in\n let reqs = List.map (fun (a, e) -> new SpecExpression(a, e)) reqs in\n let enss = List.map (fun (a, e) -> new SpecExpression(a, e)) enss in\n let md = new Mod(toList (List.map (fun x -> new FrameExpression(x)) mods)) in\n MemDecl(new Method(fst $2, $3, $4, snd $2, toList $5, toList $7, toList $9, toList reqs, toList enss, md, new Decreases(toList decs), $11))\n }\n | INCLUDE LITSTRING { EmptyDecl }\n\nDecls\n : { [] }\n | Decl Decls { $1::$2 }\n\n/*\nStmt\n | RETURN SEMI { ($1, SReturn) }\n | LBRACE COLON Block COLON RBRACE { ($2, SGroup $3) }\n | IF LPAREN Exp RPAREN LBRACE Block RBRACE\n {\n match ($3, $6) with\n | (EApply (f, [EApply (\".efl\", [EVar x])]), [(_, SGoto l)]) -> ($1, SIfJcc (x, f, l))\n | _ -> ($1, SIfGhost ($3, $6))\n }\n | FORALL LocalFormals COLONCOLON Triggers Exp LBRACE ProcDecls Block RBRACE\n {\n let decls = List.map (fun (x, t, lin) ->\n match lin with Non -> (x, t) | Lin _ -> err \"cannot declare linear variable in forall statement\") $7 in\n ($1, SForallGhost ($2, $4, $5, decls, $8))\n }\n | EXISTS LocalFormals COLONCOLON Triggers Exp SEMI { ($1, SExistsGhost ($2, $4, $5)) }\n | ASSERT Exp SEMI { ($1, SAssert (NotInv, $2)) }\n | Id COLONEQ Exp SEMI { ($2, SAssign ($1, $3)) }\n\nDecl\n | VAR Id COLON Type SEMI { ($1, DStaticGhost ($2, $4, Non, ReadWrite)) }\n | CONST Id COLON Type SEMI\n { ($1, DFunDecl ($2, None, Some $4, None, None, None)) }\n | CONST Id COLON Type COLONEQ Exp SEMI\n { ($1, DFunDecl ($2, None, Some $4, Some $6, None, None)) }\n | CONST SEGNAME COLON Type COLONEQ Exp SEMI\n { ($1, DFunDecl ($2, None, Some $4, Some $6, None, None)) }\n | CONST REGNAME COLON Type COLONEQ Exp SEMI\n { ($1, DFunDecl ($2, None, Some $4, Some $6, None, None)) }\n*/\n\n\n" }, { "path": "ironclad-apps/tools/DafnySpec/Parser/parse_util.fs", "content": "open System.Collections.Generic;\nopen Microsoft.Boogie\nopen Microsoft.Dafny\n\ntype loc = Token\nexception Err of string\nexception ParseErr of string\nlet err (s:string):'a = raise (Err s)\nlet parse_err (s:string):'a = raise (ParseErr s)\nlet assrt b = if b then () else err \"assert failure\"\nlet line = ref 1;;\nlet file = ref \"\";;\nlet parse_require b = if b then () else parse_err \"parse requirement violated\"\nlet toList (l:'a list):List<'a> = Program.MakeList(l :> IEnumerable<'a>)\n" }, { "path": "ironclad-apps/tools/DafnySpec/Parser/parser.fs", "content": "open Parse\nopen Parse_util\nopen System.Collections.Generic;\nopen Microsoft.Dafny\n\nlet parse (filename:string):List =\n let print_error_prefix () = print_endline (\"error near line \" + (string !line) + \" of file \" + !file) in\n try\n (\n file := filename;\n line := 1;\n toList (Parse.start Lex.token (Lexing.from_channel (open_in filename)))\n )\n with\n | (Err s) as x -> (print_endline \"error:\"; print_endline s; print_endline (x.ToString ()); exit 1)\n | ParseErr x -> (print_error_prefix (); print_endline x; exit 1)\n | :? System.ArgumentException as x -> (print_error_prefix (); print_endline (x.ToString ()); exit 1)\n | Failure x -> (print_error_prefix (); print_endline x; exit 1)\n | x -> (print_endline (x.ToString ()); exit 1)\n;;\n\n\n" }, { "path": "ironclad-apps/tools/DafnySpec/RtlGhost.cs", "content": "using System;\r\nusing System.Linq;\r\nusing System.Collections.Generic;\r\nusing System.Collections.ObjectModel;\r\nusing Microsoft.Dafny;\r\nusing Bpl = Microsoft.Boogie;\r\nusing System.Numerics;\r\n\r\npublic abstract class RtlExp\r\n{\r\n public List Vars()\r\n {\r\n var vars = new List();\r\n AddVars(vars);\r\n return vars;\r\n }\r\n\r\n public virtual RtlExp Subst(Dictionary map)\r\n {\r\n Util.Assert(Vars().Count == 0);\r\n return this;\r\n }\r\n\r\n public virtual void AddVars(List vars) {}\r\n public virtual string AsOperand() { return ToString(); }\r\n}\r\n\r\npublic class RtlLiteral: RtlExp\r\n{\r\n public readonly string str;\r\n public RtlLiteral(string s) { this.str = s; }\r\n\r\n public override void AddVars(List vars) {}\r\n public override RtlExp Subst(Dictionary map) { return this; }\r\n \r\n public override string ToString()\r\n {\r\n return str;\r\n }\r\n}\r\n\r\npublic class RtlVar: RtlExp\r\n{\r\n public readonly string x;\r\n public readonly bool isGhost;\r\n public readonly Microsoft.Dafny.Type type; //- used to declare local ghost variables; may be null if no declaration required\r\n public RtlVar(string x, bool isGhost, Microsoft.Dafny.Type t = null) { this.x = x; this.isGhost = isGhost; this.type = t; }\r\n public string getName() { return x; }\r\n //- no register allocation for ghost variables\r\n public override void AddVars(List vars)\r\n {\r\n if (!isGhost)\r\n {\r\n vars.Add(x);\r\n }\r\n }\r\n public override string ToString()\r\n {\r\n return x;\r\n }\r\n public override string AsOperand()\r\n {\r\n return isGhost ? x.ToString() : (\"OReg(\" + x + \")\");\r\n }\r\n\r\n public override RtlExp Subst(Dictionary map)\r\n {\r\n return map.ContainsKey(x) ? new RtlVar(map[x], this.isGhost, this.type) : this;\r\n }\r\n}\r\n\r\npublic class RtlInt: RtlExp\r\n{\r\n public readonly BigInteger i;\r\n public RtlInt(int i) { this.i = new BigInteger(i); }\r\n public RtlInt(BigInteger i) { this.i = i; }\r\n public override string ToString() { return i.ToString(); }\r\n public override string AsOperand() { return \"OConst(\" + i + \")\"; }\r\n}\r\n\r\npublic class RtlBinary: RtlExp\r\n{\r\n public readonly string op;\r\n public readonly RtlExp e0;\r\n public readonly RtlExp e1;\r\n public RtlBinary(string op, RtlExp e0, RtlExp e1)\r\n {\r\n this.op = op;\r\n this.e0 = e0;\r\n this.e1 = e1;\r\n }\r\n\r\n public override void AddVars(List vars)\r\n {\r\n e0.AddVars(vars);\r\n e1.AddVars(vars);\r\n }\r\n\r\n public override RtlExp Subst(Dictionary map)\r\n {\r\n return new RtlBinary(op, e0.Subst(map), e1.Subst(map));\r\n }\r\n\r\n public override string ToString()\r\n {\r\n Func f = e => (e is RtlVar || e is RtlInt) ? e.ToString() : \"(\" + e + \")\";\r\n return f(e0) + \" \" + op + \" \" + f(e1);\r\n }\r\n}\r\n\r\npublic class RtlApply: RtlExp\r\n{\r\n public readonly string op;\r\n public readonly ReadOnlyCollection args;\r\n public RtlApply(string op, IEnumerable args)\r\n {\r\n this.op = op;\r\n this.args = args.ToList().AsReadOnly();\r\n }\r\n\r\n public override void AddVars(List vars)\r\n {\r\n args.ToList().ForEach(e => e.AddVars(vars));\r\n }\r\n\r\n public override RtlExp Subst(Dictionary map)\r\n {\r\n return new RtlApply(op, args.Select(e => e.Subst(map)));\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return op + \"(\" + String.Join(\", \", args.Select(e => e.ToString())) + \")\";\r\n }\r\n}\r\n\r\npublic class RtlExpComputed: RtlExp\r\n{\r\n public readonly ReadOnlyCollection args;\r\n public readonly Func toString;\r\n \r\n public RtlExpComputed(Func toString, IEnumerable args = null)\r\n {\r\n this.toString = toString;\r\n this.args = ((args == null) ? new List() : args.ToList()).AsReadOnly();\r\n }\r\n\r\n public override void AddVars(List vars)\r\n {\r\n args.ToList().ForEach(e => e.AddVars(vars));\r\n }\r\n\r\n public override RtlExp Subst(Dictionary map)\r\n {\r\n return new RtlExpComputed(toString, args.Select(e => e.Subst(map)));\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return toString(this);\r\n }\r\n}\r\n\r\npublic abstract class RtlStmt\r\n{\r\n public Func comment;\r\n\r\n public RtlStmt WithComment(string comment) { this.comment = () => comment; return this; }\r\n public RtlStmt WithComment(Func comment) { this.comment = comment; return this; }\r\n\r\n public List Defs()\r\n {\r\n var vars = new List();\r\n AddDefs(vars);\r\n return vars;\r\n }\r\n\r\n public List Uses()\r\n {\r\n var vars = new List();\r\n AddUses(vars);\r\n return vars;\r\n }\r\n\r\n public List Vars()\r\n {\r\n var vars = new List();\r\n AddDefs(vars);\r\n AddUses(vars);\r\n return vars;\r\n }\r\n\r\n public virtual RtlStmt Subst(Dictionary map)\r\n {\r\n Util.Assert(Vars().Count == 0);\r\n return this;\r\n }\r\n public virtual void AddDefs(List vars) {}\r\n public virtual void AddUses(List vars) {}\r\n}\r\n\r\npublic class RtlComment: RtlStmt\r\n{\r\n public RtlComment(string comment)\r\n {\r\n this.comment = () => comment;\r\n }\r\n\r\n public RtlComment(Func comment)\r\n {\r\n this.comment = comment;\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return \"\";\r\n }\r\n}\r\n\r\npublic class RtlIndent: RtlStmt\r\n{\r\n public bool Positive;\r\n\r\n public RtlIndent(bool Positive)\r\n {\r\n this.Positive = Positive;\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return \"\";\r\n }\r\n}\r\n\r\npublic class RtlGhostMove: RtlStmt\r\n{\r\n public readonly ReadOnlyCollection outs;\r\n public readonly ReadOnlyCollection ins;\r\n\r\n public RtlGhostMove(IEnumerable outs, IEnumerable ins)\r\n {\r\n this.outs = outs.ToList().AsReadOnly();\r\n this.ins = ins.ToList().AsReadOnly();\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return String.Join(\", \", outs) + (outs.Count == 0 ? \"\" : \" := \") + String.Join(\", \", ins) + \";\";\r\n }\r\n}\r\n\r\npublic class RtlGhostCall: RtlGhostMove\r\n{\r\n public readonly string op;\r\n\r\n public RtlGhostCall(string op, IEnumerable outs, IEnumerable args):\r\n base(outs, args)\r\n {\r\n this.op = op;\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return \"call \" + String.Join(\", \", outs) + (outs.Count == 0 ? \"\" : \" := \") + op + \"(\" + String.Join(\", \", ins) + \");\";\r\n }\r\n}\r\n\r\npublic class RtlGhostStmtComputed: RtlStmt\r\n{\r\n public readonly Func toString;\r\n public readonly ReadOnlyCollection args;\r\n\r\n public RtlGhostStmtComputed(Func toString, IEnumerable args)\r\n {\r\n this.toString = toString;\r\n this.args = args.ToList().AsReadOnly();\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return toString(this);\r\n }\r\n}\r\n\r\npublic class RtlAssert: RtlStmt\r\n{\r\n public readonly bool isLoop;\r\n public readonly RtlExp e; //- ghost expression, does not count as a use\r\n public RtlAssert(RtlExp e, bool isLoop = false) { this.e = e; this.isLoop = isLoop; }\r\n\r\n public override RtlStmt Subst(Dictionary map)\r\n {\r\n return this;\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return (isLoop ? \"invariant \" : \"assert \") + e + \";\";\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/DafnySpec/Util.cs", "content": "using System;\r\nusing System.Linq;\r\nusing System.Collections.Generic;\r\nusing System.Collections.ObjectModel;\r\nusing Microsoft.Dafny;\r\nusing Bpl = Microsoft.Boogie;\r\nusing System.Numerics;\r\n\r\npublic class Util\r\n{\r\n public static void Assert(bool b)\r\n {\r\n if (!b)\r\n {\r\n throw new Exception();\r\n }\r\n }\r\n\r\n public static void DebugWriteLine()\r\n {\r\n DebugWriteLine(\"\");\r\n }\r\n\r\n public static void DebugWriteLine(object o)\r\n {\r\n\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/DafnySpec/nubuild-manifest.txt", "content": "# This file only exists because NuBuild requires that it be here.\n# You could argue that this is a bug in NuBuild.\n" }, { "path": "ironclad-apps/tools/LineCount/lex.fsl", "content": "{\r\nopen Lexing;;\r\nopen Parse_util;;\r\n}\r\n\r\nrule comment = parse\r\n| \"*/\" { () }\r\n| \"*)\" { () }\r\n| \"/*\" { comment lexbuf ; comment lexbuf }\r\n| \"(*\" { comment lexbuf ; comment lexbuf }\r\n| \"\\n\\r\" { incr line; comment lexbuf }\r\n| \"\\r\\n\" { incr line; comment lexbuf }\r\n| ['\\n''\\r'] { incr line; comment lexbuf }\r\n| _ { comment lexbuf }\r\nand token = parse\r\n| \"\\n\\r\" { end_line (); incr line; token lexbuf }\r\n| \"\\r\\n\" { end_line (); incr line; token lexbuf }\r\n| ['\\n''\\r'] { end_line (); incr line; token lexbuf }\r\n| [' ''\\t'] { token lexbuf }\r\n| \"//\"[^'\\n''\\r']* { token lexbuf }\r\n| \"/*\" { comment lexbuf ; token lexbuf }\r\n| \"(*\" { comment lexbuf ; token lexbuf }\r\n| ['\"'][^'\"''\\n''\\r']*['\"'] { token lexbuf }\r\n| eof { EOF }\r\n| '\\000' { EOF }\r\n| _ { content_on_line := true; token lexbuf }\r\n" }, { "path": "ironclad-apps/tools/LineCount/main.fs", "content": "open Parse_util\r\n\r\nlet main (argv) =\r\n let total = ref 0;\r\n let mods_rev = ref ([]:string list) in\r\n let add_mod (s:string) = mods_rev := s::(!mods_rev) in \r\n Arg.parse_argv (ref 0) argv\r\n [\r\n ]\r\n add_mod\r\n \"error parsing arguments\";\r\n let mods = List.rev (!mods_rev) in\r\n let parse_file name =\r\n file := name;\r\n line := 1;\r\n count := 0;\r\n let lexbuf = (Lexing.from_channel (open_in name));\r\n let _ = Lex.token lexbuf in\r\n print_endline (string (!count) ^ \" \" ^ name);\r\n total := !total + !count\r\n List.iter parse_file mods;\r\n print_endline (string (!total));\r\n;;\r\n\r\nlet () = main (System.Environment.GetCommandLineArgs ())\r\n\r\n" }, { "path": "ironclad-apps/tools/LineCount/makefile", "content": "#\r\n# Copyright (c) 2007 Microsoft Corporation. All rights reserved.\r\n#\r\n\r\nBUILD = ..\\..\\build\r\nFSC = $(BUILD)\\fsc -g\r\nFSLEX = $(BUILD)\\fslex\r\nOBJ = ..\\..\\obj_tools\\linecount\r\nBIN = ..\\..\\bin_tools\\linecount\r\nCORE = .\r\n\r\nSRC = \\\r\n\t$(CORE)\\parse_util.fs \\\r\n\t$(OBJ)\\lex.fs \\\r\n\t$(CORE)\\main.fs \\\r\n\r\nall: $(OBJ) $(BIN) $(BIN)\\linecount.exe\r\n\r\n$(OBJ):\r\n\tmd $(OBJ)\r\n\r\n$(BIN):\r\n\tmd $(BIN)\r\n\r\n$(OBJ)\\lex.fsi $(OBJ)\\lex.fs: $(CORE)\\lex.fsl\r\n\t$(FSLEX) $(CORE)\\lex.fsl -o $(OBJ)\\lex.fs\r\n\r\n$(BIN)\\linecount.exe: $(SRC)\r\n\t$(FSC) --standalone --mlcompatibility -O $(SRC) -o $(BIN)\\linecount.exe -r FSharp.PowerPack.dll\r\n\r\nclean:\r\n\tdel /q $(BIN)\\linecount.exe\r\n\tdel /q $(OBJ)\\*.fs\r\n" }, { "path": "ironclad-apps/tools/LineCount/parse_util.fs", "content": "exception Err of string\r\nexception ParseErr of string\r\nlet err (s:string):'a = raise (Err s)\r\nlet parse_err (s:string):'a = raise (ParseErr s)\r\nlet assrt b = if b then () else err \"assert failure\"\r\nlet line = ref 1;;\r\nlet file = ref \"\";;\r\nlet count = ref 0;;\r\nlet content_on_line = ref false;\r\nlet parse_require b = if b then () else parse_err \"parse requirement violated\"\r\n\r\nlet end_line () =\r\n if (!content_on_line) then incr count;\r\n content_on_line := false\r\n\r\ntype token = EOF\r\n" }, { "path": "ironclad-apps/tools/NuBuild/.gitignore", "content": "*.suo\r\n" }, { "path": "ironclad-apps/tools/NuBuild/AzureManager/App.config", "content": "\n\n \n \n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/AzureManager/AzureAccount.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace AzureManager\n{\n using System;\n using System.Globalization;\n using System.Security.Cryptography.X509Certificates;\n using Microsoft.WindowsAzure;\n using Microsoft.WindowsAzure.Management.Compute;\n using Microsoft.WindowsAzure.Management.Compute.Models;\n using Microsoft.WindowsAzure.Management.Storage;\n using Microsoft.WindowsAzure.Management.Storage.Models;\n\n /// \n /// Representation of an Azure Account Subscription.\n /// \n public class AzureAccount\n {\n /// \n /// Credentials associated with this Azure account.\n /// \n private SubscriptionCloudCredentials credentials;\n\n /// \n /// ComputeManagementClient for managing Azure compute resources.\n /// \n private ComputeManagementClient computeManager;\n\n /// \n /// StorageManagementClient for managing Azure storage resources.\n /// \n private StorageManagementClient storageManager;\n\n /// \n /// Initializes a new instance of the AzureAccount class.\n /// \n /// Subscription ID of the Azure account.\n /// X509 certificate used for authentication.\n public AzureAccount(string subscriptionId, X509Certificate2 cert)\n {\n this.credentials = new CertificateCloudCredentials(subscriptionId, cert);\n\n this.computeManager = CloudContext.Clients.CreateComputeManagementClient(this.credentials);\n this.storageManager = CloudContext.Clients.CreateStorageManagementClient(this.credentials);\n }\n\n /// \n /// Gets the service information for the specified service.\n /// \n /// Name of the service to query.\n /// A HostedServiceGetDetailedResponse object containing the information.\n public HostedServiceGetDetailedResponse GetServiceInformation(string serviceName)\n {\n HostedServiceGetDetailedResponse service;\n service = this.computeManager.HostedServices.GetDetailed(serviceName);\n\n return service;\n }\n\n /// \n /// Creates a service specification (configuration?) entry in Azure's database.\n /// This reserves the (Azure-unique) DNS prefix name used to access the service.\n /// \n /// \n /// Note that this does not deploy and start the service.\n /// \n /// Name of the cloud service.\n /// Geographical region where the service should be hosted.\n public void CreateServiceSpecification(string serviceName, string location)\n {\n // Required: Label, ServiceName.\n // One Required (but not both): AffinityGroup, Location.\n // Optional: Description, ExtendedProperties,\n HostedServiceCreateParameters parameters = new HostedServiceCreateParameters();\n parameters.Label = serviceName;\n parameters.ServiceName = serviceName;\n parameters.Location = location;\n\n this.computeManager.HostedServices.Create(parameters);\n }\n\n /// \n /// Deletes the specified service deployment.\n /// \n /// Name of the service\n /// Environment for this deployment (e.g. Production or Staging).\n public void DeleteDeployment(string serviceName, DeploymentSlot deploymentSlot)\n {\n this.computeManager.Deployments.DeleteBySlot(serviceName, deploymentSlot);\n }\n\n /// \n /// Deploys a service.\n /// \n /// \n /// Note that the service specification must already have been created.\n /// \n /// Name of the service.\n /// Name of this deployment.\n /// Environment for this deployment (e.g. Production or Staging).\n /// Deployment configuration information (i.e. .cscfg file contents).\n /// URI for blob containing package (i.e. .cspkg) file contents.\n /// Whether to start the deployment immediately after it is created.\n public void DeployService(\n string serviceName,\n string deploymentName,\n DeploymentSlot deploymentSlot,\n string configuration,\n Uri packageBlob,\n bool startImmediately = true)\n {\n // Required: Configuration, Label, Name, PackageUri.\n // Optional: ExtendedProperties, ExtensionConfiguration, StartDeployment, TreatWarningsAsError.\n DeploymentCreateParameters parameters = new DeploymentCreateParameters();\n parameters.Configuration = configuration; // Contents of .cscfg file.\n parameters.Label = serviceName; // Name for hosted service. Does not need to match serviceName.\n parameters.Name = deploymentName; // Unique name for this particular deployment.\n parameters.PackageUri = packageBlob; // URI for blob containing .cspkg file.\n parameters.StartDeployment = startImmediately; // Whether to start the deployment immediately after it is created.\n\n this.computeManager.Deployments.Create(serviceName, deploymentSlot, parameters);\n }\n\n /// \n /// Gets the connection string for the given storage account.\n /// \n /// A storage account name.\n /// The connection string for the given storage account.\n public string GetConnectionStringForStorageAccount(string storageAccountName)\n {\n // This makes a call to the Azure infrastructure to get the keys.\n // REVIEW: Check status code of the response?\n StorageAccountGetKeysResponse keys = this.storageManager.StorageAccounts.GetKeys(storageAccountName);\n\n string connectionString = string.Format(\n CultureInfo.InvariantCulture,\n \"DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1}\",\n storageAccountName,\n keys.PrimaryKey);\n\n return connectionString;\n }\n\n /// \n /// Procedure for testing random things.\n /// \n public void TestSomething()\n {\n HostedServiceListResponse response;\n response = this.computeManager.HostedServices.List();\n Console.WriteLine(\"List of hosted services:\");\n foreach (HostedServiceListResponse.HostedService service in response.HostedServices)\n {\n Console.WriteLine(\"\\n{0}\\n\", service.ServiceName);\n\n // Note: The HostedServiceListResponse.HostedService class\n // contains many of the same properties as the\n // HostedServiceGetDetailedResponse class.\n }\n }\n\n /// \n /// Displays all the deployments in a given service.\n /// \n /// \n /// This is an alternative way to access the deployments.\n /// HostedServiceGetDetailedResponse.Deployment is another.\n /// \n /// The service to query.\n public void ShowDeployments(string serviceName)\n {\n DeploymentGetResponse response;\n\n try\n {\n response = this.computeManager.Deployments.GetBySlot(serviceName, DeploymentSlot.Production);\n Console.WriteLine(\"Production Deployment\");\n Console.WriteLine(\"Label = {0}\", response.Label);\n }\n catch (Microsoft.WindowsAzure.CloudException except)\n {\n Console.WriteLine(\"Show Deployment Exception: {0}\", except.ErrorMessage);\n }\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/AzureManager/AzureManager.csproj", "content": "\n\n \n \n Debug\n AnyCPU\n {8ADB4B14-715D-4CE1-BFD2-E7D65007CE5C}\n Exe\n Properties\n AzureManager\n AzureManager\n v4.5\n 512\n \n \n AnyCPU\n true\n full\n false\n ..\\..\\..\\bin_tools\\NuBuild\\\n DEBUG;TRACE\n prompt\n 4\n \n \n AnyCPU\n pdbonly\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n ..\\References\\Microsoft.Threading.Tasks.dll\n \n \n ..\\References\\Microsoft.WindowsAzure.Common.dll\n \n \n ..\\References\\Microsoft.WindowsAzure.Common.NetFramework.dll\n \n \n False\n ..\\References\\Microsoft.WindowsAzure.Management.Compute.dll\n \n \n ..\\References\\Microsoft.WindowsAzure.Management.Storage.dll\n \n \n False\n ..\\References\\Microsoft.WindowsAzure.Storage.dll\n \n \n \r\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n CustomDictionary.xml\n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/AzureManager/Program.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace AzureManager\n{\n using System;\n using System.Collections.Specialized;\r\n using System.Configuration;\r\n using System.IO;\n using System.Security.Cryptography.X509Certificates;\n using Microsoft.WindowsAzure.Management.Compute.Models;\n using Microsoft.WindowsAzure.Storage;\n using Microsoft.WindowsAzure.Storage.Blob;\n\n /// \n /// Program to manage Azure cloud resources used by NuBuild.\n /// \n public class Program\n {\n /// \n /// Name of our service (hard-wired).\n /// \n private const string NuBuildServiceName = \"NuBuildExecutionService\";\n\n /// \n /// Name of the deployment package blob we use for the \"start\" and\n /// \"upload\" commands (hard-wired).\n /// \n private const string NuBuildServicePackageName = \"NuBuildExecutionEngine\";\n\n /// \n /// Default package file name used by \"deploy\" and \"upload\" commands.\n /// Can be overridden by command line argument.\n /// \n private const string DefaultPackageFilename = \"NuBuildExecutionService.cspkg\";\n\n /// \n /// Default configuration file name used by the \"deploy\" command\n /// Can be overridden by command line argument.\n /// \n private const string DefaultConfigurationFilename = \"ServiceConfiguration.Cloud.cscfg\";\n\n /// \n /// Default number of service instances to \"start\".\n /// Can be overridden by command line argument.\n /// \n private const int DefaultInstanceCount = 10;\n\n /// \n /// Main program entry point.\n /// \n /// The parameter is unused.\n private static void Main(string[] args)\n {\n Console.WriteLine();\n\n // Set some defaults.\n string packageFilename = DefaultPackageFilename;\n string configurationFilename = DefaultConfigurationFilename;\n int instanceCount = DefaultInstanceCount;\n string command = \"status\";\n\n // Parse command line arguments.\n if (args.Length > 0)\n {\n command = args[0].ToLower();\n\n if (args.Length > 1)\n {\n if (command == \"start\")\n {\n if (!int.TryParse(args[1], out instanceCount))\n {\n Usage(-1);\n }\n }\n else\n {\n packageFilename = args[1];\n }\n\n if (args.Length > 2)\n {\n configurationFilename = args[2];\n }\n }\n }\n\n // Get our Azure account information.\n AzureAccount azureAccount = GetOurAzureAccount();\n\n // Perform user requested action.\n CloudBlockBlob packageBlob;\n switch (command)\n {\n case \"create\":\n azureAccount.CreateServiceSpecification(NuBuildServiceName, \"West US\");\n break;\n\n case \"deploy\":\n // Upload our package (.cspkg file) to a blob.\n // We name the blob after the package filename.\n string blobName = Path.GetFileNameWithoutExtension(packageFilename);\n packageBlob = GetPackageBlob(azureAccount, blobName);\n packageBlob.UploadFromFile(packageFilename, System.IO.FileMode.Open);\n\n // Create a new deployment using the desired package blob.\n // TODO: Provide an unique name for each deployment?\n // REVIEW: Upload to \"Staging\" slot instead?\n string configuration = File.ReadAllText(configurationFilename);\n azureAccount.DeployService(NuBuildServiceName, \"Production\", DeploymentSlot.Production, configuration, packageBlob.Uri, startImmediately: true);\n\n Console.WriteLine(\"Issued deployment request\");\n break;\n\n case \"start\":\n // Create a new deployment using a hard-coded configuration and a previously uploaded blob.\n ServiceConfiguration config = new ServiceConfiguration(\n NuBuildServiceName,\n \"4\",\n \"*\",\n \"2014-06.2.4\",\n \"CloudExecutionWorker\",\n instanceCount);\n packageBlob = GetPackageBlob(azureAccount, NuBuildServicePackageName);\n azureAccount.DeployService(NuBuildServiceName, \"Production\", DeploymentSlot.Production, config.ToXml(), packageBlob.Uri, startImmediately: true);\n\n Console.WriteLine(\"Issued deployment request\");\n break;\n\n case \"status\":\n HostedServiceGetDetailedResponse serviceInfo = azureAccount.GetServiceInformation(NuBuildServiceName);\n DisplayServiceInformation(serviceInfo);\n break;\n\n case \"stop\":\n // Delete the Azure deployment.\n // This stops the currently running service, but leaves the\n // configuration for this service in the Azure database.\n azureAccount.DeleteDeployment(NuBuildServiceName, DeploymentSlot.Production);\n break;\n\n case \"test\":\n ////azureAccount.TestSomething();\n\n ServiceConfiguration testConfig = new ServiceConfiguration(NuBuildServiceName, \"4\", \"*\", \"2014-06.2.4\", \"CloudExecutionWorker\", 42);\n Console.WriteLine(testConfig.ToXml());\n break;\n\n case \"upload\":\n // Upload our package (.cspkg file) to a blob.\n packageBlob = GetPackageBlob(azureAccount, NuBuildServicePackageName);\n packageBlob.UploadFromFile(packageFilename, System.IO.FileMode.Open);\n Console.WriteLine(\"Uploaded package\");\n break;\n\n case \"/?\":\n case \"help\":\n Usage(0);\n break;\n\n default:\n Usage(-1);\n break;\n }\n }\n\n /// \n /// Display a (hopefully) helpful usage message to the user,\n /// and exit the process.\n /// \n /// Process exit code to use.\n private static void Usage(int exitcode)\n {\n Console.WriteLine(\"Usage: AzureManager [create | deploy [package file [config file]] |\");\n Console.WriteLine(\" start [instances] | status | stop |\");\n Console.WriteLine(\" upload [package file]]\");\n Console.WriteLine();\n Console.WriteLine(\" where\");\n Console.WriteLine(\" instances Number of service instances to start.\");\n Console.WriteLine(\" (default: {0})\", DefaultInstanceCount);\n Console.WriteLine(\" package file Package file to deploy.\");\n Console.WriteLine(\" (default: .\\\\{0})\", DefaultPackageFilename);\n Console.WriteLine(\" config file Configuration file for deployment.\");\n Console.WriteLine(\" (default: .\\\\{0})\", DefaultConfigurationFilename);\n Console.WriteLine();\n Console.WriteLine(\" Commands:\");\n Console.WriteLine(\" create Create a new service configuration (using hard-wired info).\");\n Console.WriteLine(\" deploy Deploy using the given package and configuration\");\n Console.WriteLine(\" (overwrites existing hard-wired package blob).\");\n Console.WriteLine(\" start Start the given number of instances of an existing package\");\n Console.WriteLine(\" named '{0}'.\", NuBuildServicePackageName);\n Console.WriteLine(\" status Display the current service and deployment status.\");\n Console.WriteLine(\" stop Stop the current deployment of the service.\");\n Console.WriteLine(\" upload Upload the given package file to hard-wired package blob\");\n Console.WriteLine(\" named '{0}'.\", NuBuildServicePackageName);\n Environment.Exit(exitcode);\n }\n\n /// \n /// Gets our Azure account.\n /// \n /// An Azure account.\n private static AzureAccount GetOurAzureAccount()\n {\n string subscriptionId = null;\r\n string certBase64Encoded = null;\r\n\r\n NameValueCollection appSettings = ConfigurationManager.AppSettings;\r\n if (appSettings != null)\r\n {\r\n subscriptionId = appSettings[\"Subscription Id\"];\r\n certBase64Encoded = appSettings[\"Certificate (Base 64 Encoded)\"];\r\n }\r\n\r\n if (string.IsNullOrEmpty(subscriptionId))\r\n {\r\n throw new ConfigurationException(\"Subscription Id setting missing from your AzureManager.exe.config file!\");\r\n }\r\n\r\n if (string.IsNullOrEmpty(certBase64Encoded))\r\n {\r\n throw new ConfigurationException(\"Certificate setting missing from your AzureManager.exe.config file!\");\r\n }\r\n\r\n byte[] cert = Convert.FromBase64String(certBase64Encoded);\n X509Certificate2 x509Cert = new X509Certificate2(cert);\n AzureAccount azureAccount = new AzureAccount(subscriptionId, x509Cert);\n\n return azureAccount;\n }\n\n /// \n /// Writes selected fields of the give HostedServiceGetDetailedResponse\n /// object out to the console.\n /// \n /// \n /// The HostedServiceGetDetailedResponse object to display.\n /// \n private static void DisplayServiceInformation(HostedServiceGetDetailedResponse service)\n {\n Console.WriteLine(\"Service Name {0}:\", service.ServiceName);\n\n Console.WriteLine(\" Date Created = {0}\", service.Properties.DateCreated);\n Console.WriteLine(\" Date Last Modified = {0}\", service.Properties.DateLastModified);\n Console.WriteLine(\" Description = {0}\", service.Properties.Description);\n Console.WriteLine(\" Label = {0}\", service.Properties.Label);\n Console.WriteLine(\" Location = {0}\", service.Properties.Location);\n Console.WriteLine(\" Status = {0}\", service.Properties.Status);\n\n#if false\n foreach(string size in service.ComputeCapabilities.VirtualMachinesRoleSizes)\n {\n Console.WriteLine(\"VM Role Size = {0}\", size);\n }\n\n Console.WriteLine(\"URI = {0}\", service.Uri);\n#endif\n\n if (service.Deployments.Count == 0)\n {\n Console.WriteLine(\" No current deployments!\");\n }\n\n foreach (HostedServiceGetDetailedResponse.Deployment deployment in service.Deployments)\n {\n Console.WriteLine();\n Console.WriteLine(\" Deployment Name {0}:\", deployment.Name);\n Console.WriteLine(\" Created = {0}\", deployment.CreatedTime);\n Console.WriteLine(\" Label = {0}\", deployment.Label);\n Console.WriteLine(\" Slot = {0}\", deployment.DeploymentSlot);\n Console.WriteLine(\" Status = {0}\", deployment.Status);\n Console.WriteLine(\" Instances = {0}\", deployment.RoleInstances.Count);\n ////Console.WriteLine(deployment.Configuration);\n }\n }\n\n /// \n /// Uploads the given file to the specified Azure blob.\n /// \n /// Azure account to use.\n /// Name of the blob to upload to.\n /// A reference to the CloudBlockBlob.\n private static CloudBlockBlob GetPackageBlob(AzureAccount azureAccount, string blobName)\n {\n // Get connection string for our storage account.\n // TODO: Remove hard-coded storage account name.\n const string StorageAccountName = \"ironcladstoretest\";\n string connectionString = azureAccount.GetConnectionStringForStorageAccount(StorageAccountName);\n\n ////Console.WriteLine(\"Using connection string \" + connectionString);\n\n // Use our storage account connection string to get our CloudStorageAccount.\n CloudStorageAccount storageAccount = CloudStorageAccount.Parse(connectionString);\n\n ////Console.WriteLine(\"Storage account URI = {0}\", storageAccount.BlobEndpoint.AbsoluteUri);\n\n // Use our CloudStorageAccount to create a CloudBlobClient.\n CloudBlobClient blobClient = storageAccount.CreateCloudBlobClient();\n\n ////Console.WriteLine(\"Blob base URI = {0}\", blobClient.BaseUri);\n\n // Find or create our \"packages\" blob storage container.\n CloudBlobContainer container = blobClient.GetContainerReference(\"packages\");\n container.CreateIfNotExists(BlobContainerPublicAccessType.Container);\n\n // Get the package blob we want to deploy.\n // This is a 'cspkg' file stored as a blob.\n CloudBlockBlob packageBlob = container.GetBlockBlobReference(blobName);\n return packageBlob;\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/AzureManager/Properties/AssemblyInfo.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nusing System.Reflection;\nusing System.Runtime.CompilerServices;\nusing System.Runtime.InteropServices;\n\n// General Information about an assembly is controlled through the following \n// set of attributes. Change these attribute values to modify the information\n// associated with an assembly.\n[assembly: AssemblyTitle(\"AzureManager\")]\n[assembly: AssemblyDescription(\"\")]\n[assembly: AssemblyConfiguration(\"\")]\n[assembly: AssemblyCompany(\"\")]\n[assembly: AssemblyProduct(\"AzureManager\")]\n[assembly: AssemblyCopyright(\"Copyright © 2015\")]\n[assembly: AssemblyTrademark(\"\")]\n[assembly: AssemblyCulture(\"\")]\n\n// Setting ComVisible to false makes the types in this assembly not visible \n// to COM components. If you need to access a type in this assembly from \n// COM, set the ComVisible attribute to true on that type.\n[assembly: ComVisible(false)]\n\n// The following GUID is for the ID of the typelib if this project is exposed to COM\n[assembly: Guid(\"067c0004-c47f-4a37-b93d-009d5718b965\")]\n\n// Version information for an assembly consists of the following four values:\n//\n// Major Version\n// Minor Version \n// Build Number\n// Revision\n//\n// You can specify all the values or you can default the Build and Revision Numbers \n// by using the '*' as shown below:\n// [assembly: AssemblyVersion(\"1.0.*\")]\n[assembly: AssemblyVersion(\"1.0.0.0\")]\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\n" }, { "path": "ironclad-apps/tools/NuBuild/AzureManager/ServiceConfiguration.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace AzureManager\n{\n using System;\n using System.Diagnostics;\n using System.Globalization;\n using System.IO;\n using System.Text;\n using System.Xml;\n\n /// \n /// \n /// Representation of the \"service configuration\" (.cscfg) file contents\n /// used for Azure deployments.\n /// \n /// \n /// \n /// \n /// Format is defined by the \"Azure Service Configuration Schema\".\n /// See .\n /// This class implements only the small subset of the schema that we use.\n /// \n /// \n /// This is the format of the \"Configuration\" member of various\n /// deployment-related classes (DeploymentChangeConfigurationParameters,\n /// DeploymentCreateParameters, DeploymentUpgradeParameters,\n /// HostedServiceGetDetailedResponse.Deployment, etc).\n /// \n /// \n /// Note that this is separate from the \"Azure Service Definition Schema\"\n /// (.csdef file) used to create the service proper.\n /// \n /// \n public class ServiceConfiguration\n {\n /// \n /// XML namespace for this object.\n /// \n public const string XmlNamespace = \"http://schemas.microsoft.com/ServiceHosting/2008/10/ServiceConfiguration\";\n\n /// \n /// XML element name for this object.\n /// \n public const string XmlTag = \"ServiceConfiguration\";\n\n /// \n /// XML attribute name for our service name field.\n /// \n private const string XmlServiceNameAttribute = \"serviceName\";\n\n /// \n /// XML attribute name for our OS family field.\n /// \n private const string XmlOSFamilyAttribute = \"osFamily\";\n\n /// \n /// XML attribute name for our OS version field.\n /// \n private const string XmlOSVersionAttribute = \"osVersion\";\n\n /// \n /// XML attribute name for our schema version field.\n /// \n private const string XmlSchemaVersionAttribute = \"schemaVersion\";\n\n /// \n /// XML element name for our role field.\n /// \n private const string XmlRoleElement = \"Role\";\n\n /// \n /// XML attribute name for our role name field.\n /// \n private const string XmlRoleNameAttribute = \"name\";\n\n // Note we don't currently support the \"vmName\" attribute.\n\n /// \n /// XML element name for our instances field.\n /// \n private const string XmlInstancesElement = \"Instances\";\n\n /// \n /// XML element name for our instance count field.\n /// \n private const string XmlInstanceCountAttribute = \"count\";\n\n /// \n /// XML element name for our configuration settings field.\n /// \n /// \n /// Note we don't currently support any configuration settings.\n /// \n private const string XmlConfigurationSettingsElement = \"ConfigurationSettings\";\n\n // Note we don't currently support any certificates.\n\n // Note we don't currently support the NetworkConfiguration element.\n\n /// \n /// Name of the service.\n /// \n private string serviceName;\n\n /// \n /// OS Family.\n /// \n private string osFamily;\n\n /// \n /// OS Version.\n /// \n private string osVersion;\n\n /// \n /// Schema Version.\n /// \n private string schemaVersion;\n\n /// \n /// Name of the role.\n /// \n private string roleName;\n\n /// \n /// Count of the number of role instances.\n /// \n private int instanceCount;\n\n /// \n /// Initializes a new instance of the ServiceConfiguration class.\n /// \n /// Name of the cloud service.\n /// Guest OS that will run on role instances in the cloud service.\n /// Version of the Guest OS that will run on role instances in the cloud service.\n /// Version of the Service Configuration schema.\n /// Name of the role.\n /// Number of instances to deploy for this role.\n public ServiceConfiguration(\n string serviceName,\n string osFamily,\n string osVersion,\n string schemaVersion,\n string roleName,\n int instanceCount)\n {\n this.serviceName = serviceName;\n this.osFamily = osFamily;\n this.osVersion = osVersion;\n this.schemaVersion = schemaVersion;\n this.roleName = roleName;\n this.instanceCount = instanceCount;\n }\n\n /// \n /// Gets the service name.\n /// \n public string ServiceName\n {\n get { return this.serviceName; }\n }\n\n /// \n /// Gets the OS Family.\n /// \n public string OsFamily\n {\n get { return this.osFamily; }\n }\n\n /// \n /// Gets the OS Version.\n /// \n public string OsVersion\n {\n get { return this.osVersion; }\n }\n\n /// \n /// Gets the Schema Version.\n /// \n public string SchemaVersion\n {\n get { return this.schemaVersion; }\n }\n\n /// \n /// Gets the name of the role.\n /// \n public string RoleName\n {\n get { return this.roleName; }\n }\n\n /// \n /// Gets the number of instances.\n /// \n public int InstanceCount\n {\n get { return this.instanceCount; }\n }\n\n /// \n /// Creates a ServiceConfiguration from an XML representation.\n /// \n /// \n /// A string containing an XML document representing a request.\n /// \n /// \n /// A new request corresponding to the XML representation read.\n /// \n public static ServiceConfiguration FromXml(string xs)\n {\n XmlReader xr = XmlReader.Create(new StringReader(xs));\n while (xr.Read())\n {\n if (xr.NodeType == XmlNodeType.Element)\n {\n break;\n }\n }\n\n return ReadXml(xr);\n }\n\n /// \n /// Helper function to read an XML element (not a full document)\n /// representing an Azure Service Configuration.\n /// \n /// \n /// Note that the XmlReader is expected to be positioned in the XML\n /// document such that the current node is a request element.\n /// \n /// The XmlReader object to read from.\n /// \n /// A new request corresponding to the XML representation read.\n /// \n public static ServiceConfiguration ReadXml(XmlReader xr)\n {\n Debug.Assert(xr.Name.Equals(ServiceConfiguration.XmlTag), \"Invalid call\");\n\n string serviceName = xr.GetAttribute(ServiceConfiguration.XmlServiceNameAttribute);\n string osFamily = xr.GetAttribute(ServiceConfiguration.XmlOSFamilyAttribute);\n string osVersion = xr.GetAttribute(ServiceConfiguration.XmlOSVersionAttribute);\n string schemaVersion = xr.GetAttribute(ServiceConfiguration.XmlSchemaVersionAttribute);\n\n string roleName = string.Empty;\n int instanceCount = 0;\n\n while (xr.Read())\n {\n if (xr.NodeType == XmlNodeType.Element)\n {\n switch (xr.Name)\n {\n case XmlRoleElement:\n roleName = xr.GetAttribute(ServiceConfiguration.XmlRoleNameAttribute);\n break;\n\n case XmlInstancesElement:\n string temp = xr.GetAttribute(ServiceConfiguration.XmlInstanceCountAttribute);\n instanceCount = int.Parse(temp);\n break;\n\n case XmlConfigurationSettingsElement:\n break;\n }\n }\n else if (xr.NodeType == XmlNodeType.EndElement)\n {\n if (xr.Name.Equals(ServiceConfiguration.XmlTag))\n {\n break; // All done.\n }\n }\n }\n\n // REVIEW: Sanity check elements here?\n return new ServiceConfiguration(\n serviceName,\n osFamily,\n osVersion,\n schemaVersion,\n roleName,\n instanceCount);\n }\n\n /// \n /// Creates an XML document representing this cloud execution request.\n /// \n /// \n /// A string containing an XML document representing this request.\n /// \n public string ToXml()\n {\n StringBuilder sb = new StringBuilder();\n XmlWriterSettings settings = new XmlWriterSettings();\n settings.Indent = true;\n ////settings.OmitXmlDeclaration = true;\n XmlWriter xw = XmlWriter.Create(sb, settings);\n xw.WriteStartDocument();\n this.WriteXml(xw);\n xw.Close();\n return sb.ToString();\n }\n\n /// \n /// Helper function to write an XML element (not a full document)\n /// representing this result record.\n /// \n /// The XmlWriter object to write to.\n public void WriteXml(XmlWriter xw)\n {\n // Start writing the element for this object.\n xw.WriteStartElement(XmlTag, ServiceConfiguration.XmlNamespace);\n xw.WriteAttributeString(ServiceConfiguration.XmlServiceNameAttribute, this.serviceName);\n xw.WriteAttributeString(ServiceConfiguration.XmlOSFamilyAttribute, this.osFamily);\n xw.WriteAttributeString(ServiceConfiguration.XmlOSVersionAttribute, this.osVersion);\n xw.WriteAttributeString(ServiceConfiguration.XmlSchemaVersionAttribute, this.schemaVersion);\n\n // Start writing the Role element.\n xw.WriteStartElement(ServiceConfiguration.XmlRoleElement);\n xw.WriteAttributeString(ServiceConfiguration.XmlRoleNameAttribute, this.roleName);\n\n // Write the Instances element.\n xw.WriteStartElement(ServiceConfiguration.XmlInstancesElement);\n xw.WriteAttributeString(ServiceConfiguration.XmlInstanceCountAttribute, this.instanceCount.ToString(CultureInfo.InvariantCulture));\n xw.WriteEndElement();\n\n // Write the ConfigurationSettings element.\n xw.WriteElementString(ServiceConfiguration.XmlConfigurationSettingsElement, string.Empty);\n\n // Finish writing the Role element.\n xw.WriteEndElement();\n\n // Finish writing the element for this object.\n xw.WriteEndElement();\n }\n\n /// \n /// Gets a string representation of this instance.\n /// Primarily intended as a debugging aid.\n /// \n /// A string representation of this instance.\n public override string ToString()\n {\n StringBuilder output = new StringBuilder();\n\n output.AppendFormat(\"Service Name: {0}\", this.serviceName);\n output.AppendLine();\n output.AppendFormat(\"OS Family: {0}\", this.osFamily);\n output.AppendLine();\n output.AppendFormat(\"OS Version: {0}\", this.osVersion);\n output.AppendLine();\n output.AppendFormat(\"Schema Version: {0}\", this.schemaVersion);\n output.AppendLine();\n output.AppendFormat(\"Role Name: {0}\", this.roleName);\n output.AppendLine();\n output.AppendFormat(\"Number of Instances: {0}\", this.instanceCount);\n output.AppendLine();\n\n return output.ToString();\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/CloudExecutionEngine/App.config", "content": "\n\n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/CloudExecutionEngine/CloudExecutionEngine.csproj", "content": "\n\n \n \n Debug\n AnyCPU\n {2668E334-0B79-4023-A621-2D1433CE7C9E}\n Exe\n Properties\n CloudExecutionEngineStandalone\n CloudExecutionEngine\n v4.5\n 512\n \n \n AnyCPU\n true\n full\n false\n bin\\Debug\\\n DEBUG;TRACE\n prompt\n 4\n \n \n AnyCPU\n pdbonly\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n False\n ..\\References\\Microsoft.WindowsAzure.Storage.dll\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n {4f3de22c-cae9-408b-aa54-10dcd7e12f09}\n CloudExecutionWorker\n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/CloudExecutionEngine/Program.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace CloudExecutionEngineStandalone\n{\n using System;\n using System.Collections.Generic;\n using System.IO;\n using CloudExecutionWorker;\n\n /// \n /// Representation of the Cloud Execution Engine.\n /// \n internal class Program\n {\n /// \n /// Run executable requests posted to the requests queue.\n /// \n /// The parameter is unused.\n public static void Main(string[] args)\n {\n CloudExecutionEngine engine = new CloudExecutionEngine();\n engine.Run();\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/CloudExecutionEngine/Properties/AssemblyInfo.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nusing System.Reflection;\nusing System.Runtime.CompilerServices;\nusing System.Runtime.InteropServices;\n\n// General Information about an assembly is controlled through the following \n// set of attributes. Change these attribute values to modify the information\n// associated with an assembly.\n[assembly: AssemblyTitle(\"CloudExecutionEngine\")]\n[assembly: AssemblyDescription(\"\")]\n[assembly: AssemblyConfiguration(\"\")]\n[assembly: AssemblyCompany(\"\")]\n[assembly: AssemblyProduct(\"CloudExecutionEngine\")]\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\n[assembly: AssemblyTrademark(\"\")]\n[assembly: AssemblyCulture(\"\")]\n\n// Setting ComVisible to false makes the types in this assembly not visible \n// to COM components. If you need to access a type in this assembly from \n// COM, set the ComVisible attribute to true on that type.\n[assembly: ComVisible(false)]\n\n// The following GUID is for the ID of the typelib if this project is exposed to COM\n[assembly: Guid(\"5ff7c12f-584f-4104-8e04-8f6f63873a02\")]\n\n// Version information for an assembly consists of the following four values:\n//\n// Major Version\n// Minor Version \n// Build Number\n// Revision\n//\n// You can specify all the values or you can default the Build and Revision Numbers \n// by using the '*' as shown below:\n// [assembly: AssemblyVersion(\"1.0.*\")]\n[assembly: AssemblyVersion(\"1.0.0.0\")]\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\n" }, { "path": "ironclad-apps/tools/NuBuild/CloudExecutionWorker/CloudExecutionEngine.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace CloudExecutionWorker\n{\n using System;\n using System.Collections.Generic;\n using System.IO;\n using NuBuild;\n\n /// \n /// Representation of the Cloud Execution Engine.\n /// \n public class CloudExecutionEngine\n {\n /// \n /// Root directory path.\n /// \n private string virtualIronRoot;\n\n /// \n /// Cloud implementation of the item cache.\n /// Used to explicitly store things in the cloud.\n /// \n private ItemCacheCloud cloudCache;\n\n /// \n /// Multiplexed cloud/local implementation of the item cache.\n /// \n private IItemCache multiplexedItemCache;\n\n /// \n /// Main queue of client execution requests.\n /// \n private CloudExecutionQueue mainQueue;\n\n /// \n /// Whether to continue servicing the queue requests.\n /// \n private bool keepSwimming;\n\n /// \n /// Initializes a new instance of the CloudExecutionEngine class.\n /// \n public CloudExecutionEngine()\n {\n // Establish various infrastructure.\n // TODO: Clean this up.\n this.virtualIronRoot = Directory.GetCurrentDirectory();\n string localCacheDirectory = Path.Combine(this.virtualIronRoot, \"nucache\");\n this.cloudCache = new ItemCacheCloud();\n this.multiplexedItemCache = new ItemCacheMultiplexer(\n new ItemCacheLocal(localCacheDirectory),\n this.cloudCache,\n null);\n\n Console.WriteLine(\"Accessing execution queue.\");\n this.mainQueue = new CloudExecutionQueue();\r\n }\n\n /// \n /// Runs the execution engine, which eternally processes execution\n /// requests posted to the main queue.\n /// \n public void Run()\n {\n this.keepSwimming = true;\n\n while (this.keepSwimming)\n {\n // Pull request off queue.\n Console.WriteLine(\"Waiting for new work request.\");\n CloudExecutionRequest executionRequest = this.mainQueue.GetRequest(block: true);\n if (!this.keepSwimming)\n {\n // Exit without deleting request from queue.\n // Request will become visible again after timeout expires.\n break;\n }\n\n // TODO: For now, we immediately delete the requests we take.\n // Eventually we'll want to leave the request invisible until\n // some timeout expires so that other engines can pick it up\n // if we crash.\n this.mainQueue.DeleteRequest(executionRequest);\n\n Console.WriteLine(\"Received request with ID {0}.\", executionRequest.Identifier);\n\n // Make a progress report to soothe nervous users.\r\n CloudExecutionReport statusUpdate = new CloudExecutionReport(\r\n executionRequest.Identifier,\r\n CloudExecutionReport.StatusCode.InProgress,\r\n 0,\r\n null,\r\n null,\r\n 0,\r\n null);\r\n\r\n // Submit progress report.\r\n this.mainQueue.SubmitReport(statusUpdate, executionRequest.ReportQueue);\r\n\r\n // Do the requested operation.\r\n CloudExecutionReport report = null;\r\n switch (executionRequest.RequestedOperation)\r\n {\r\n case CloudExecutionRequest.Operation.RunExecutable:\r\n report = this.RunAnExecutable(executionRequest);\r\n break;\r\n\r\n case CloudExecutionRequest.Operation.CommitSuicide:\r\n this.keepSwimming = false;\r\n goto case CloudExecutionRequest.Operation.None;\r\n\r\n case CloudExecutionRequest.Operation.DeleteQueue:\r\n this.mainQueue.DeleteQueue(executionRequest.ReportQueue);\r\n goto case CloudExecutionRequest.Operation.None;\r\n\r\n case CloudExecutionRequest.Operation.None:\r\n report = new CloudExecutionReport(\r\n executionRequest.Identifier,\r\n CloudExecutionReport.StatusCode.Completed);\r\n break;\r\n\r\n default:\r\n // ToDo: This should probably be treated as an error.\r\n goto case CloudExecutionRequest.Operation.None;\r\n }\r\n\r\n // Submit report.\r\n this.mainQueue.SubmitReport(report, executionRequest.ReportQueue);\r\n }\r\n }\r\n\r\n /// \r\n /// Stops the execution engine.\r\n /// \r\n public void Stop()\r\n {\r\n this.keepSwimming = false;\r\n }\r\n\r\n /// \r\n /// Run the requested executable and produce a report of the results.\r\n /// \r\n /// The execution request.\r\n /// A report of the results.\r\n private CloudExecutionReport RunAnExecutable(CloudExecutionRequest executionRequest)\r\n {\r\n // REVIEW: How/whether to use this.\r\n BuildObject diagnosticsBase = new BuildObject(Path.Combine(\"nuobj\", \"diagnostics\", \"process\"));\r\n\r\n // Prep working directory with input files and output dirs.\n // TODO: The below will throw cache exceptions if something\n // isn't there (they should all be though). Need to catch\n // these and fail the execution request when this happens.\n WorkingDirectory workingDirectory = new WorkingDirectory(this.virtualIronRoot);\n foreach (BuildObjectValuePointer inputFile in executionRequest.InputFileMappings)\n {\n // REVIEW: How to determine cache container here.\n ItemCacheContainer container = ItemCacheContainer.Sources;\n if (this.multiplexedItemCache.GetItemSize(container, inputFile.ObjectHash) == -1)\n {\n container = ItemCacheContainer.Objects;\n }\n\n // TODO: Move path/directory manipulation code into\n // WorkingDirectory and/or ItemCache.\n string inputFilePath = workingDirectory.PathTo(inputFile.RelativePath);\n Directory.CreateDirectory(Path.GetDirectoryName(inputFilePath)); // REVIEW: Still neeeded?\n this.multiplexedItemCache.FetchItemToFile(\n container,\n inputFile.ObjectHash,\n inputFilePath);\n }\n\n foreach (BuildObject outputFile in executionRequest.OutputFiles)\n {\n workingDirectory.CreateDirectoryFor(outputFile);\n }\n\n // Run executable.\n ProcessInvoker pinv = new ProcessInvoker(\n workingDirectory,\n executionRequest.Executable,\n new string[] { executionRequest.Arguments },\n diagnosticsBase,\n null, // This is captureStdout. TODO: Should cleanup how this is used in ProcessInvoker.\n null); // This is dbgText. REVIEW: How/whether to use this.\n\n // When ProcessInvoker's constructor returns, the process has\n // finished running.\n Console.WriteLine(\"Request {0} completed in {1} seconds.\", executionRequest.Identifier, pinv.CpuTime);\n\n // Store output files in the (cloud) item cache, and create a\n // list of the mappings.\n List outputFileMappings = new List();\n foreach (BuildObject outFile in executionRequest.OutputFiles)\n {\n if (File.Exists(workingDirectory.PathTo(outFile)))\n {\n string fileHash = Util.hashFilesystemPath(workingDirectory.PathTo(outFile));\n Util.Assert(!string.IsNullOrEmpty(fileHash));\n\n // Note we explicitly write to the cloud cache here.\n this.cloudCache.StoreItemFromFile(ItemCacheContainer.Objects, fileHash, workingDirectory.PathTo(outFile));\n outputFileMappings.Add(new BuildObjectValuePointer(fileHash, outFile.getRelativePath()));\n }\n }\n\n // Collect the results into a report.\n CloudExecutionReport report = new CloudExecutionReport(\n executionRequest.Identifier,\n CloudExecutionReport.StatusCode.Completed,\r\n pinv.ExitCode,\n pinv.GetStdout(),\n pinv.GetStderr(),\n pinv.CpuTime,\n outputFileMappings);\n\n return report;\r\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/CloudExecutionWorker/CloudExecutionWorker.csproj", "content": "\n\n \n Debug\n AnyCPU\n 8.0.30703\n 2.0\n {4F3DE22C-CAE9-408B-AA54-10DCD7E12F09}\n Library\n Properties\n CloudExecutionWorker\n CloudExecutionWorker\n v4.5\n 512\n Worker\n \n \n true\n full\n false\n bin\\Debug\\\n DEBUG;TRACE\n prompt\n 4\n \n \n pdbonly\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n True\n \n \n False\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n Designer\n \n \n \n \n {4d7220c0-3caa-4659-9f16-a564db3ccc1b}\n NuBuild\n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/CloudExecutionWorker/Properties/AssemblyInfo.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nusing System.Reflection;\nusing System.Runtime.CompilerServices;\nusing System.Runtime.InteropServices;\n\n// General Information about an assembly is controlled through the following \n// set of attributes. Change these attribute values to modify the information\n// associated with an assembly.\n[assembly: AssemblyTitle(\"CloudExecutionWorker\")]\n[assembly: AssemblyDescription(\"\")]\n[assembly: AssemblyConfiguration(\"\")]\n[assembly: AssemblyCompany(\"\")]\n[assembly: AssemblyProduct(\"CloudExecutionWorker\")]\n[assembly: AssemblyCopyright(\"Copyright © 2015\")]\n[assembly: AssemblyTrademark(\"\")]\n[assembly: AssemblyCulture(\"\")]\n\n// Setting ComVisible to false makes the types in this assembly not visible \n// to COM components. If you need to access a type in this assembly from \n// COM, set the ComVisible attribute to true on that type.\n[assembly: ComVisible(false)]\n\n// The following GUID is for the ID of the typelib if this project is exposed to COM\n[assembly: Guid(\"4143a7eb-b9aa-4dfb-87ac-1b961e44a2e7\")]\n\n// Version information for an assembly consists of the following four values:\n//\n// Major Version\n// Minor Version \n// Build Number\n// Revision\n//\n// You can specify all the values or you can default the Build and Revision Numbers \n// by using the '*' as shown below:\n// [assembly: AssemblyVersion(\"1.0.*\")]\n[assembly: AssemblyVersion(\"1.0.0.0\")]\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\n" }, { "path": "ironclad-apps/tools/NuBuild/CloudExecutionWorker/WorkerRole.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace CloudExecutionWorker\n{\n using System;\n using System.Diagnostics;\n using System.Net;\n using Microsoft.WindowsAzure;\n using Microsoft.WindowsAzure.Diagnostics;\n using Microsoft.WindowsAzure.ServiceRuntime;\n\n /// \n /// Our worker role.\n /// This is what Azure knows how to interact with.\n /// \n /// \n /// For information on handling configuration changes\n /// .\n /// \n public class WorkerRole : RoleEntryPoint\n {\n /// \n /// Our CloudExecutionEngine that does the real work.\n /// \n private CloudExecutionEngine engine;\n\n /// \n /// Azure calls this method to do the main work.\n /// If this method returns, Azure will recycle this role instance.\n /// \n public override void Run()\n {\n Trace.TraceInformation(\"CloudExecutionWorker entry point called\");\n\n this.engine = new CloudExecutionEngine();\n\n // TODO: Multi-thread this.\n this.engine.Run();\n }\n\n /// \n /// Called when this role instance is brought online by Azure.\n /// \n /// \n /// Whether Azure should proceed with calling our Run method.\n /// \n public override bool OnStart()\n {\n // Set the maximum number of concurrent connections.\n //// ServicePointManager.DefaultConnectionLimit = 12;\n\n return base.OnStart();\n }\n\n /// \n /// Called after this role instance has been taken offline by Azure\n /// but before the process exits.\n /// \n public override void OnStop()\n {\n this.engine.Stop();\n\n base.OnStop();\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/CloudExecutionWorker/app.config", "content": "\n\n \n \n \n \n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/CloudQueueTool/App.config", "content": "\n\n \n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/CloudQueueTool/CloudQueueTool.csproj", "content": "\r\n\n \n \n Debug\n AnyCPU\n {DD7B4AD9-1EB0-47BF-B4C2-5BC1CA85D242}\n Exe\n Properties\n CloudQueueTool\n CloudQueueTool\n v4.5\n 512\n \n \n AnyCPU\n true\n full\n false\n bin\\Debug\\\n DEBUG;TRACE\n prompt\n 4\n \n \n AnyCPU\n pdbonly\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n False\n ..\\References\\Microsoft.WindowsAzure.Storage.dll\n \n \n \r\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/CloudQueueTool/Program.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace CloudQueueTool\n{\n using System;\n using System.Collections.Generic;\n using System.Configuration;\r\n using System.IO;\n using Microsoft.WindowsAzure.Storage;\n using Microsoft.WindowsAzure.Storage.Queue;\n\n /// \n /// Cloud queue management program.\n /// \n internal class Program\n {\n /// \n /// Acts upon command line arguments.\n /// \n /// Command line arguments.\n private static void Main(string[] args)\r\n {\n // Create our CloudQueueClient object.\r\n // REVIEW: Hard-coded connection string index \"Ironclad\".\r\n string connectionString = null;\r\n ConnectionStringSettings settings = ConfigurationManager.ConnectionStrings[\"Ironclad\"];\r\n if (settings != null)\r\n {\r\n connectionString = settings.ConnectionString;\r\n }\r\n\n if (string.IsNullOrEmpty(connectionString))\r\n {\n throw new ConfigurationException(\"Azure connection string missing from your .exe.config file!\");\r\n }\n\n CloudStorageAccount storageAccount = CloudStorageAccount.Parse(connectionString);\r\n\r\n CloudQueueClient queueClient = storageAccount.CreateCloudQueueClient();\r\n\r\n switch (args.Length)\r\n {\r\n case 0:\r\n Status(queueClient.ListQueues());\r\n break;\r\n\n case 2:\r\n {\n CloudQueue queue = queueClient.GetQueueReference(args[1]);\n if (!queue.Exists())\n {\n Console.WriteLine(\"No such queue '{0}'\", args[1]);\n return;\n }\n\n queue.FetchAttributes();\n\n switch (args[0])\n {\n case \"clear\":\n case \"Clear\":\n queue.Clear();\n Console.WriteLine(\"Queue '{0}' cleared.\", queue.Name);\n break;\n\n case \"peek\":\n case \"Peek\":\n int numberToPeekAt = (queue.ApproximateMessageCount != null) ? (int)queue.ApproximateMessageCount : 0;\n Console.WriteLine(\"Queue '{0}' contains {1} messages:\", queue.Name, numberToPeekAt);\n if (numberToPeekAt != 0)\n {\n // Peek API only allows a maximum of 32 messages to be peeked at.\r\n numberToPeekAt = Math.Min(numberToPeekAt, 32);\r\n\r\n foreach (CloudQueueMessage message in queue.PeekMessages(numberToPeekAt))\n {\n Console.WriteLine(\r\n \"\\t{0} {1} {2}\",\r\n message.Id,\n message.InsertionTime,\n message.ExpirationTime);\n }\n }\n\n break;\n\r\n case \"status\":\r\n case \"Status\":\r\n Status(new CloudQueue[]{queue});\r\n break;\r\n\r\n default:\r\n Usage();\r\n break;\r\n }\r\n }\r\n break;\r\n\r\n default:\r\n Usage();\r\n break;\r\n }\r\n }\r\n\r\n private static void Status(IEnumerable queues)\r\n {\r\n foreach (CloudQueue queue in queues)\r\n {\r\n queue.FetchAttributes();\r\n Console.WriteLine(\"Queue '{0}' contains about {1} messages.\", queue.Name, queue.ApproximateMessageCount);\r\n }\n }\n\r\n private static void Usage()\r\n {\r\n Console.WriteLine(\"Usage: CloudQueueTool [ ]\");\r\n Console.WriteLine(\"\\t = Clear | Peek | Status\");\r\n Console.WriteLine(\"\\t = reports | requests\");\r\n Console.WriteLine();\r\n Console.WriteLine(\"If given no arguments, CloudQueueTool returns the status of all queues.\");\r\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/CloudQueueTool/Properties/AssemblyInfo.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nusing System.Reflection;\r\nusing System.Runtime.CompilerServices;\nusing System.Runtime.InteropServices;\n\n// General Information about an assembly is controlled through the following \n// set of attributes. Change these attribute values to modify the information\n// associated with an assembly.\n[assembly: AssemblyTitle(\"CloudQueueTool\")]\n[assembly: AssemblyDescription(\"\")]\n[assembly: AssemblyConfiguration(\"\")]\n[assembly: AssemblyCompany(\"\")]\n[assembly: AssemblyProduct(\"CloudQueueTool\")]\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\n[assembly: AssemblyTrademark(\"\")]\n[assembly: AssemblyCulture(\"\")]\n\n// Setting ComVisible to false makes the types in this assembly not visible \n// to COM components. If you need to access a type in this assembly from \n// COM, set the ComVisible attribute to true on that type.\n[assembly: ComVisible(false)]\n\n// The following GUID is for the ID of the typelib if this project is exposed to COM\n[assembly: Guid(\"0321a4d8-87f1-4467-b44a-b5e355a614b9\")]\n\n// Version information for an assembly consists of the following four values:\n//\n// Major Version\n// Minor Version \n// Build Number\n// Revision\n//\n// You can specify all the values or you can default the Build and Revision Numbers \n// by using the '*' as shown below:\n// [assembly: AssemblyVersion(\"1.0.*\")]\n[assembly: AssemblyVersion(\"1.0.0.0\")]\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\n" }, { "path": "ironclad-apps/tools/NuBuild/CustomDictionary.xml", "content": "\n\n \n \n asynchronicity \n cscfg \n csdef \n cspkg \n cpu \n Dafny \n filesystem \n ifc \n Ironfleet \n munged \n nuobj \n rejectable \n src \n obj \n \n \n \n \n Nu \n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild/ItemCacheTool/App.config", "content": "\n\n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/ItemCacheTool/CacheState.cs", "content": "//--\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\n\nnamespace ItemCacheTool\n{\n using System;\n using System.Collections.Generic;\n using System.IO;\n using System.Linq;\n using System.Text;\n using System.Threading.Tasks;\n using NuBuild;\n\n public class CacheState\n {\n private ItemCacheCloud cloudCache;\n\n private ItemCacheLocal localCache;\n\n public CacheState()\n {\n this.cloudCache = new ItemCacheCloud();\n this.localCache = new ItemCacheLocal(\n Path.Combine(GetDefaultIronRoot(), \"nucache\"));\n }\n\n public ItemCacheCloud GetCloudCache\n {\n get { return this.cloudCache; }\n }\n\n public ItemCacheLocal GetLocalCache\n {\n get { return this.localCache; }\n }\n\n public IItemCache[] GetAllCaches\n {\n get { return new IItemCache[] { this.cloudCache, this.localCache }; }\n }\n\n public ItemCacheContainer[] GetAllContainers\n {\n get { return (ItemCacheContainer[])Enum.GetValues(typeof(ItemCacheContainer)); }\n }\n\n public IItemCache[] ParseCacheName(string input)\n {\n if (input == \"*\")\n {\n return this.GetAllCaches;\n }\n\n if (string.Equals(input, \"cloud\", StringComparison.CurrentCultureIgnoreCase))\n {\n return new IItemCache[] { this.cloudCache };\n }\n\n if (string.Equals(input, \"local\", StringComparison.CurrentCultureIgnoreCase))\n {\n return new IItemCache[] { this.localCache };\n }\n\n return null;\n }\n\n public ItemCacheContainer[] ParseContainerName(string input)\n {\n ItemCacheContainer container;\n\n if (input == \"*\")\n {\n return this.GetAllContainers;\n }\n\n if (Enum.TryParse(input, true, out container))\n {\n if (Enum.IsDefined(typeof(ItemCacheContainer), container))\n {\n return new ItemCacheContainer[] { container };\n }\n }\n\n return null;\n }\n\n /// \r\n /// Gets the default iron root path.\r\n /// \r\n /// String containing the default iron root path.\r\n private static string GetDefaultIronRoot()\n {\n string assyUri = System.Reflection.Assembly.GetExecutingAssembly().CodeBase;\n string assyPath = new Uri(assyUri).LocalPath;\n string exepath = Path.GetDirectoryName(assyPath);\n exepath = Path.GetFullPath(exepath);\n string[] parts = exepath.Split(new char[] { '\\\\' });\n int ironIndex = Array.IndexOf(parts, \"iron\");\n string rc = string.Join(\"\\\\\", parts.Take(ironIndex + 1));\n return rc;\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/ItemCacheTool/ItemCacheTool.csproj", "content": "\n\n \n \n Debug\n AnyCPU\n {9A231EB8-BDA1-4304-93A1-20457C00D7D9}\n Exe\n Properties\n ItemCacheTool\n ItemCacheTool\n v4.5\n 512\n \n \n AnyCPU\n true\n full\n false\n bin\\Debug\\\n DEBUG;TRACE\n prompt\n 4\n AllRules.ruleset\n \n \n AnyCPU\n pdbonly\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n False\n ..\\References\\Microsoft.WindowsAzure.Storage.dll\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n {4d7220c0-3caa-4659-9f16-a564db3ccc1b}\n NuBuild\n \n \n \n \n CustomDictionary.xml\n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/ItemCacheTool/Program.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace ItemCacheTool\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n using Microsoft.WindowsAzure.Storage;\r\n using Microsoft.WindowsAzure.Storage.Blob;\r\n using NuBuild;\r\n\r\n /// \r\n /// Representation of the ItemCacheTool program.\r\n /// \r\n public static class Program\r\n {\r\n /// \r\n /// Program entry point.\r\n /// \r\n /// Command line arguments.\r\n private static void Main(string[] args)\r\n {\r\n CacheState caches = new CacheState();\r\n string query;\r\n IItemCache[] queriedCaches;\r\n ItemCacheContainer[] queriedContainers;\r\n string queriedItems;\r\n DateTimeOffset queriedDate;\r\n\r\n // -\r\n // Default values.\r\n // This corresponds to \"status * *\".\r\n // -\r\n query = \"status\";\r\n queriedCaches = caches.GetAllCaches;\r\n queriedContainers = caches.GetAllContainers;\r\n queriedItems = string.Empty;\r\n queriedDate = DateTimeOffset.MinValue;\r\n\r\n // -\r\n // Parse arguments.\r\n // -\r\n if (args.Length != 0)\r\n {\r\n if (args.Length != 3)\r\n {\r\n if (args.Length == 4)\r\n {\r\n if (!DateTimeOffset.TryParse(args[3], out queriedDate))\r\n {\r\n queriedItems = args[3];\r\n }\r\n }\r\n else\r\n {\r\n Usage(caches);\r\n return;\r\n }\r\n }\r\n\r\n query = args[0];\r\n queriedCaches = caches.ParseCacheName(args[1]);\r\n queriedContainers = caches.ParseContainerName(args[2]);\r\n\r\n if ((queriedCaches == null) || (queriedContainers == null))\r\n {\r\n Usage(caches);\r\n return;\r\n }\r\n }\r\n\r\n // -\r\n // Process request.\r\n // -\r\n switch (query)\r\n {\r\n case \"list\":\r\n case \"List\":\r\n {\r\n CacheStatus(queriedCaches, queriedContainers, true);\r\n break;\r\n }\r\n\r\n case \"compare\":\r\n case \"Compare\":\r\n {\r\n if (queriedCaches.Length < 2)\r\n {\r\n Console.WriteLine(\"Error: can't compare fewer than two caches!\");\r\n Usage(caches);\r\n return;\r\n }\r\n\r\n CompareCacheContainers(queriedCaches, queriedContainers);\r\n break;\r\n }\r\n\r\n case \"status\":\r\n case \"Status\":\r\n {\r\n CacheStatus(queriedCaches, queriedContainers, false);\r\n break;\r\n }\r\n\r\n case \"delete\":\r\n case \"Delete\":\r\n {\r\n if (args.Length < 4)\r\n {\r\n Console.WriteLine(\"Error: missing argument. Need date earlier than or specific item(s) to delete.\");\r\n Usage(caches);\r\n return;\r\n }\r\n\r\n if (queriedDate == DateTimeOffset.MinValue)\r\n {\r\n DeleteItems(queriedCaches, queriedContainers, queriedItems);\r\n }\r\n else\r\n {\r\n DeleteItems(queriedCaches, queriedContainers, queriedDate);\r\n }\r\n\r\n break;\r\n }\r\n\r\n case \"check\":\r\n case \"Check\":\r\n {\r\n CheckResults(queriedCaches, false);\r\n break;\r\n }\r\n\r\n case \"cleanup\":\r\n case \"Cleanup\":\r\n {\r\n CheckResults(queriedCaches, true);\r\n break;\r\n }\r\n\r\n case \"dump\":\r\n case \"Dump\":\r\n {\r\n DumpItems(queriedCaches, queriedContainers, queriedItems);\r\n break;\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Prints a user-friendly message explaining how to use the program.\r\n /// \r\n /// The caches the program is using.\r\n private static void Usage(CacheState caches)\r\n {\r\n string containers = string.Empty;\r\n foreach (ItemCacheContainer container in caches.GetAllContainers)\r\n {\r\n containers += container.ToString() + \" | \";\r\n }\r\n\r\n containers += \" *\";\r\n\r\n Console.WriteLine(\"Usage: ItemCacheTool [ | ]\");\r\n Console.WriteLine(\"\\t = Check | Cleanup | Compare | Delete | List | Status\");\r\n Console.WriteLine(\"\\t = Cloud | Local | *\");\r\n Console.WriteLine(\"\\t = {0}\", containers);\r\n Console.WriteLine(\"\\t [ | ] = specifies item(s) to delete.\");\r\n }\r\n\r\n /// \r\n /// Provides a status report of the number of items in the specified\r\n /// cache containers, and optionally a list of those items.\r\n /// \r\n /// Caches to examine.\r\n /// Containers in those caches to examine.\r\n /// Whether to list the cache contents.\r\n private static void CacheStatus(\r\n IItemCache[] queriedCaches,\r\n ItemCacheContainer[] queriedContainers,\r\n bool listContents)\r\n {\r\n string lineTerminator = \".\";\r\n if (listContents)\r\n {\r\n lineTerminator = \":\";\r\n }\r\n\r\n foreach (IItemCache cache in queriedCaches)\r\n {\r\n foreach (ItemCacheContainer container in queriedContainers)\r\n {\r\n HashSet items = cache.GetItemsInContainer(container);\r\n Console.WriteLine(\"{0} cache {1} container holds {2} items{3}\", cache.Name, container.ToString(), items.Count, lineTerminator);\r\n if (listContents)\r\n {\r\n foreach (string item in items)\r\n {\r\n ////Console.WriteLine(\"Item: {0}, Date:{1}\", item, cache.GetItemLastModifiedTime(container, item));\r\n Console.WriteLine(item);\r\n }\r\n\r\n Console.WriteLine();\r\n }\r\n }\r\n\r\n Console.WriteLine();\r\n }\r\n }\r\n\r\n /// \r\n /// Compares the contents of two caches.\r\n /// \r\n /// Caches to compare.\r\n /// Containers in those caches to compare.\r\n private static void CompareCacheContainers(\r\n IItemCache[] queriedCaches,\r\n ItemCacheContainer[] queriedContainers)\r\n {\r\n foreach (ItemCacheContainer container in queriedContainers)\r\n {\r\n IItemCache cacheA = queriedCaches[0];\r\n IItemCache cacheB = queriedCaches[1];\r\n\r\n HashSet cacheAItems = cacheA.GetItemsInContainer(container);\r\n HashSet cacheBItems = cacheB.GetItemsInContainer(container);\r\n\r\n Console.WriteLine(\"There are {0} items in the {1} cache {2} container.\", cacheAItems.Count, cacheA.Name, container.ToString());\r\n Console.WriteLine(\"There are {0} items in the {1} cache {2} container.\", cacheBItems.Count, cacheB.Name, container.ToString());\r\n\r\n HashSet syncedItems = new HashSet(cacheAItems);\r\n syncedItems.IntersectWith(cacheBItems);\r\n Console.WriteLine(\"There are {0} items present in both cache's {1} container.\", syncedItems.Count, container);\r\n Console.WriteLine();\r\n }\r\n }\r\n\r\n /// \r\n /// Deletes the given items from the given caches and containers.\r\n /// \r\n /// Caches to look in.\r\n /// Containers to look in.\r\n /// Items to delete.\r\n private static void DeleteItems(\r\n IItemCache[] queriedCaches,\r\n ItemCacheContainer[] queriedContainers,\r\n string queriedItems)\r\n {\r\n if (queriedItems == \"*\")\r\n {\r\n if (!DeleteItemsConfirmation())\r\n {\r\n return;\r\n }\r\n }\r\n\r\n foreach (IItemCache cache in queriedCaches)\r\n {\r\n foreach (ItemCacheContainer container in queriedContainers)\r\n {\r\n if (queriedItems == \"*\")\r\n {\r\n HashSet items = cache.GetItemsInContainer(container);\r\n foreach (string item in items)\r\n {\r\n cache.DeleteItem(container, item);\r\n }\r\n }\r\n else\r\n {\r\n cache.DeleteItem(container, queriedItems);\r\n }\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Deletes the items from the given caches and containers\r\n /// that have an earlier last modified time than the given one.\r\n /// \r\n /// Caches to look in.\r\n /// Containers to look in.\r\n /// Date to compare against.\r\n private static void DeleteItems(\r\n IItemCache[] queriedCaches,\r\n ItemCacheContainer[] queriedContainers,\r\n DateTimeOffset queriedDate)\r\n {\r\n if (!DeleteItemsConfirmation())\r\n {\r\n return;\r\n }\r\n\r\n foreach (IItemCache cache in queriedCaches)\r\n {\r\n foreach (ItemCacheContainer container in queriedContainers)\r\n {\r\n HashSet items = cache.GetItemsInContainer(container);\r\n foreach (string item in items)\r\n {\r\n DateTimeOffset? lastModified = cache.GetItemLastModifiedTime(container, item);\r\n if (lastModified.HasValue && (lastModified.Value.CompareTo(queriedDate) < 0))\r\n {\r\n cache.DeleteItem(container, item);\r\n }\r\n }\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Asks the user for confirmation that deleting a large number of cache items is okay.\r\n /// \r\n /// True if deletion is okay, false otherwise.\r\n private static bool DeleteItemsConfirmation()\r\n {\r\n string input;\r\n string annoyingConfirmationString = \"Yes I mean to do this!\";\r\n\r\n Console.WriteLine(\"You are about to delete a potentially large number of cache items!\");\r\n Console.WriteLine(\"To proceed, please enter '{0}':\", annoyingConfirmationString);\r\n input = Console.ReadLine();\r\n if (input != annoyingConfirmationString)\r\n {\r\n Console.WriteLine(\"Your input didn't match. Exiting without deleting anything.\");\r\n return false;\r\n }\r\n\r\n return true;\r\n }\r\n\r\n /// \r\n /// Dumps the given items from the given caches and containers.\r\n /// \r\n /// Caches to look in.\r\n /// Containers to look in.\r\n /// Items to dump.\r\n private static void DumpItems(\r\n IItemCache[] queriedCaches,\r\n ItemCacheContainer[] queriedContainers,\r\n string queriedItems)\r\n {\r\n foreach (IItemCache cache in queriedCaches)\r\n {\r\n foreach (ItemCacheContainer container in queriedContainers)\r\n {\r\n if (queriedItems == \"*\")\r\n {\r\n HashSet items = cache.GetItemsInContainer(container);\r\n foreach (string item in items)\r\n {\r\n DumpItem(cache, container, item);\r\n }\r\n }\r\n else\r\n {\r\n DumpItem(cache, container, queriedItems);\r\n }\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Dumps the given item from the given cache and container.\r\n /// \r\n /// Cache to look in.\r\n /// Container to look in.\r\n /// Item to dump.\r\n private static void DumpItem(IItemCache cache, ItemCacheContainer container, string item)\r\n {\r\n#if true\r\n byte[] content = cache.FetchItem(container, item);\r\n if (content != null)\r\n {\r\n BinaryWriter writer = new BinaryWriter(Console.OpenStandardOutput());\r\n writer.Write(content);\r\n writer.Close();\r\n }\r\n#endif\r\n#if false\r\n ResultSummaryRecord record = FetchRecord(cache, container, item);\r\n if (record != null)\r\n {\r\n Console.WriteLine();\r\n Console.WriteLine(\"IsVerificationTimeout = {0}\", record.IsVerificationTimeout);\r\n Console.WriteLine(\"IsFailure = {0}\", record.IsFailure);\r\n }\r\n else\r\n {\r\n Console.WriteLine();\r\n Console.WriteLine(\"FetchRecord failed for {0}\", item);\r\n }\r\n#endif\r\n }\r\n\r\n /// \r\n /// Checks the given cache(s) Results and FailedResults for goodness.\r\n /// \r\n /// Caches to check.\r\n /// Whether to cleanup after bad cache entries.\r\n private static void CheckResults(\r\n IItemCache[] queriedCaches,\r\n bool cleanup)\r\n {\r\n // We can do this for Local, Cloud, or both.\r\n foreach (IItemCache cache in queriedCaches)\r\n {\r\n // We have one Objects container for objects referenced by\r\n // results in both the Results and FailedResults containers.\r\n HashSet objects = cache.GetItemsInContainer(ItemCacheContainer.Objects);\r\n\r\n // Likewise, we have only one Sources container.\r\n // REVIEW: Should a \"source\" ever show up as a verb result?\r\n HashSet sources = cache.GetItemsInContainer(ItemCacheContainer.Sources);\r\n\r\n // We initialize the orphanedObjects set to all objects and\r\n // then remove objects from the set when we find them listed\r\n // in a result (stored in either Results or FailedResults).\r\n HashSet orphanedObjects = cache.GetItemsInContainer(ItemCacheContainer.Objects);\r\n\r\n // We check both successful and failed results.\r\n foreach (ItemCacheContainer resultsContainer in new ItemCacheContainer[] { ItemCacheContainer.Results, ItemCacheContainer.FailedResults })\r\n {\r\n HashSet parseErrors = new HashSet();\r\n\r\n // Misfiled results (i.e. failures in Results container or\r\n // non-failures in FailedResults container).\r\n HashSet misfiledResults = new HashSet();\r\n\r\n // Results that are missing one or more ouput objects.\r\n HashSet resultsMissingOutputs = new HashSet();\r\n\r\n HashSet missingOutputHashes = new HashSet();\r\n HashSet missingOutputPaths = new HashSet();\r\n int timeouts = 0;\r\n int failures = 0;\r\n int missing = 0;\r\n\r\n HashSet results = cache.GetItemsInContainer(resultsContainer);\r\n foreach (string result in results)\r\n {\r\n ResultSummaryRecord record = FetchRecord(cache, resultsContainer, result);\r\n if (record == null)\r\n {\r\n Console.WriteLine(\"Parse error in {0}.\", result);\r\n parseErrors.Add(result);\r\n }\r\n else\r\n {\r\n if (record.IsFailure)\r\n {\r\n if (resultsContainer == ItemCacheContainer.Results)\r\n {\r\n // We shouldn't have any failures in Results!\r\n misfiledResults.Add(result);\r\n }\r\n\r\n if (record.IsVerificationTimeout)\r\n {\r\n ////Console.WriteLine(\"Timeout in {0}.\", result);\r\n timeouts++;\r\n }\r\n else\r\n {\r\n ////Console.WriteLine(\"Failure in {0}.\", result);\r\n failures++;\r\n }\r\n }\r\n else if (resultsContainer == ItemCacheContainer.FailedResults)\r\n {\r\n // We should only have failures in FailedResults!\r\n misfiledResults.Add(result);\r\n }\r\n\r\n // Verify each output is in the cache.\r\n bool hasMissingOuputs = false;\r\n foreach (BuildObjectValuePointer output in record.Outputs)\r\n {\r\n if (objects.Contains(output.ObjectHash))\r\n {\r\n // Output present in object cache.\r\n // Remove it from orphaned objects list.\r\n orphanedObjects.Remove(output.ObjectHash);\r\n }\r\n else if (sources.Contains(output.ObjectHash))\r\n {\r\n // Output present in sources cache.\r\n Console.WriteLine(\"Has 'source' file listed as an output: {0}!\", result);\r\n }\r\n else\r\n {\r\n // Output missing from both object and sources caches.\r\n hasMissingOuputs = true;\r\n missingOutputHashes.Add(output.ObjectHash);\r\n missingOutputPaths.Add(output.RelativePath);\r\n missing++;\r\n Console.WriteLine(\"Missing Output Listed in {0}, Object {1} ({2}).\", result, output.ObjectHash, output.RelativePath);\r\n }\r\n }\r\n\r\n if (hasMissingOuputs)\r\n {\r\n resultsMissingOutputs.Add(result);\r\n }\r\n }\r\n }\r\n\r\n Console.WriteLine();\r\n Console.WriteLine(\"Checked {0} results in {1} cache {2} container:\", results.Count, cache.Name, resultsContainer.ToString());\r\n Console.WriteLine(\"Corrupted (parsing errors or otherwise unreadable): {0}\", parseErrors.Count);\r\n Console.WriteLine(\"Filed in wrong container: {0}\", misfiledResults.Count);\r\n Console.WriteLine(\"Timeouts: {0}, Other failures: {1}, Total failures: {2}\", timeouts, failures, timeouts + failures);\r\n Console.WriteLine(\"Missing at least one output object: {0}\", resultsMissingOutputs.Count);\r\n Console.WriteLine(\"Total missing output objects: {0}, Unique contents: {1}, Unique paths: {2}\", missing, missingOutputHashes.Count, missingOutputPaths.Count);\r\n Console.WriteLine();\r\n\r\n if (cleanup)\r\n {\r\n if (misfiledResults.Count != 0)\r\n {\r\n Console.Write(\"Deleting misfiled results...\");\r\n foreach (string misfiledResult in misfiledResults)\r\n {\r\n cache.DeleteItem(resultsContainer, misfiledResult);\r\n }\r\n\r\n Console.WriteLine(\"Done.\");\r\n }\r\n\r\n if (resultsMissingOutputs.Count != 0)\r\n {\r\n Console.Write(\"Deleting results with missing outputs...\");\r\n foreach (string resultMissingOutputs in resultsMissingOutputs)\r\n {\r\n cache.DeleteItem(resultsContainer, resultMissingOutputs);\r\n }\r\n\r\n Console.WriteLine(\"Done.\");\r\n }\r\n\r\n Console.WriteLine();\r\n }\r\n }\r\n\r\n // REVIEW: in at least one instance, we cache an intermediate\r\n // object that isn't referenced by a result. That instance is\r\n // DafnyIncludes.ExpandDafny(), which is called from\r\n // DafnyCompileOneVerb. This is to allow cloud execution of the\r\n // process invoke part of the verb's execution (with the dafny\r\n // expansion happening in the verb's getWorker() method). Since\r\n // ExpandDafny() is a work-around for a Dafny issue, it's not\r\n // clear whether we should further accommodate this in the build\r\n // system (i.e. by making ExpandDafny its own verb) or not.\r\n // At any rate, having orphaned objects is not necessarily bad.\r\n Console.WriteLine(\"Orphaned objects not listed in any result: {0}\", orphanedObjects.Count);\r\n\r\n if (cleanup)\r\n {\r\n Console.WriteLine();\r\n\r\n if (orphanedObjects.Count != 0)\r\n {\r\n Console.Write(\"Deleting orphaned objects...\");\r\n foreach (string orphanedObject in orphanedObjects)\r\n {\r\n cache.DeleteItem(ItemCacheContainer.Objects, orphanedObject);\r\n }\r\n\r\n Console.WriteLine(\"Done.\");\r\n }\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Retrieves the requested result from the given cache.\r\n /// \r\n /// Cache to query.\r\n /// Container to query.\r\n /// Result to get.\r\n /// The requested ResultSummaryRecord, or null if not found.\r\n private static ResultSummaryRecord FetchRecord(IItemCache cache, ItemCacheContainer container, string itemHash)\r\n {\r\n byte[] result = cache.FetchItem(container, itemHash);\r\n\r\n if (result != null)\r\n {\r\n MemoryStream resultStream = new MemoryStream(result);\r\n try\r\n {\r\n using (StreamReader inReader = new StreamReader(resultStream))\r\n {\r\n string xmlSummary = inReader.ReadToEnd();\r\n ResultSummaryRecord record = ResultSummaryRecord.FromXml(xmlSummary);\r\n if (record == null)\r\n {\r\n Console.WriteLine(\"FromXml failed for {0}\", itemHash);\r\n }\r\n\r\n return record;\r\n }\r\n }\r\n catch (System.Xml.XmlException ex)\r\n {\r\n Console.WriteLine(\"Malformed xml in {0}: {1}\", itemHash, ex.ToString());\r\n return null;\r\n }\r\n finally\r\n {\r\n resultStream.Dispose();\r\n }\r\n }\r\n else\r\n {\r\n Console.WriteLine(\"FetchItem failed for {0}\", itemHash);\r\n return null;\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/ItemCacheTool/Properties/AssemblyInfo.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nusing System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n// General Information about an assembly is controlled through the following \r\n// set of attributes. Change these attribute values to modify the information\r\n// associated with an assembly.\r\n[assembly: AssemblyTitle(\"ItemCacheTool\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"ItemCacheTool\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n// Setting ComVisible to false makes the types in this assembly not visible \r\n// to COM components. If you need to access a type in this assembly from \r\n// COM, set the ComVisible attribute to true on that type.\r\n[assembly: ComVisible(false)]\r\n\r\n// The following GUID is for the ID of the typelib if this project is exposed to COM\r\n[assembly: Guid(\"47dce4f0-18af-4c9e-b177-4ae324563ed6\")]\r\n\r\n// Version information for an assembly consists of the following four values:\r\n//\r\n// Major Version\r\n// Minor Version \r\n// Build Number\r\n// Revision\r\n//\r\n// You can specify all the values or you can default the Build and Revision Numbers \r\n// by using the '*' as shown below:\r\n// [assembly: AssemblyVersion(\"1.0.*\")]\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/.gitignore", "content": "*.user\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/AbstractId.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class AbstractId\r\n {\r\n private const int MASTER_VERSION = 3; // Bump this to invalidate every verb in all caches.\r\n\r\n private string verbName;\r\n private int version;\r\n private string abstractOnly;\r\n\r\n // PoundDefines should appear in both abstract and concrete descriptions:\r\n // abstract because we run one verb with multiple poundDefine configurations,\r\n // and concrete because the variation appears only in this parameter to the\r\n // verb, not in any input file contents.\r\n private PoundDefines poundDefines;\r\n private string concrete;\r\n\r\n public AbstractId(string verbName, int version, string abstractOnly, PoundDefines poundDefines = null, string concrete = null)\r\n {\r\n this.verbName = verbName;\r\n this.version = version + MASTER_VERSION;\r\n this.abstractOnly = abstractOnly;\r\n this.poundDefines = poundDefines == null ? PoundDefines.empty() : poundDefines;\r\n this.concrete = concrete;\r\n }\r\n\r\n public override bool Equals(object obj)\r\n {\r\n AbstractId other = obj as AbstractId;\r\n if (other != null)\r\n {\r\n return this.verbName == other.verbName\r\n && this.version == other.version\r\n && this.abstractOnly == other.abstractOnly\r\n && this.poundDefines.Equals(other.poundDefines)\r\n && this.concrete == other.concrete;\r\n }\r\n else\r\n {\r\n return false;\r\n }\r\n }\r\n\r\n public override int GetHashCode()\r\n {\r\n return this.ToString().GetHashCode();\r\n }\r\n\r\n public override string ToString()\r\n {\r\n if (this.concrete == null)\r\n {\r\n return string.Format(\"{0}(#{1},{2},{3})\", this.verbName, this.version, this.abstractOnly, this.poundDefines.getAbstractIdString());\r\n }\r\n else\r\n {\r\n return string.Format(\"{0}(#{1},{2},{3},{4})\", this.verbName, this.version, this.abstractOnly, this.poundDefines.getAbstractIdString(), this.concrete);\r\n }\r\n }\r\n\r\n public int CompareTo(object other)\r\n {\r\n return this.ToString().CompareTo(((AbstractId)other).ToString());\r\n }\r\n\r\n public string getConcreteId()\r\n {\r\n // The entire purpose of this class is to avoid encoding the input filename in a verb's concrete identity,\r\n // instead encoding it via the input's hash. That enables two verbs to have the same hash when they have\r\n // the same configuration, and hence converge -- we can reuse the outputs.\r\n // Except that the design is presently flawed: they'd have the same output contents, but not the same\r\n // output locations. Until we work that out, I'm neutering this convergence opportunity to preserve\r\n // soundness. (--jonh)\r\n return this.ToString();\r\n\r\n ////if (this.concrete == null) {\r\n //// return string.Format(\"{0}(#{1},{2})\", this.verbName, this.version, this.poundDefines);\r\n ////} else {\r\n //// return string.Format(\"{0}(#{1},{2},{3})\", this.verbName, this.version, this.poundDefines, this.concrete);\r\n ////}\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/AnnotationScanner.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Text.RegularExpressions;\r\n\r\n internal class AnnotationScanner\r\n {\r\n private BuildObject inputObject;\r\n private List annotations;\r\n private bool complete;\r\n\r\n // Constructor for emitting new/code-assembled annotations.\r\n public AnnotationScanner()\r\n {\r\n this.inputObject = null;\r\n this.annotations = new List();\r\n this.complete = false;\r\n }\r\n\r\n public AnnotationScanner(BuildObject inputObject)\r\n {\r\n this.inputObject = inputObject;\r\n this.annotations = new List();\r\n Regex re = new Regex(\"]*)/>\");\r\n using (TextReader tr = BuildEngine.theEngine.Repository.OpenRead(inputObject))\r\n {\r\n while (true)\r\n {\r\n string line = tr.ReadLine();\r\n if (line == null)\r\n {\r\n break;\r\n }\r\n\r\n Match match = re.Match(line);\r\n if (match.Success)\r\n {\r\n string[] arguments = match.Groups[1].ToString().Split(null).Where(s => s.Length > 0).ToArray();\r\n this.annotations.Add(arguments);\r\n }\r\n }\r\n }\r\n\r\n this.complete = true;\r\n }\r\n\r\n public void addAnnotation(string[] annotation)\r\n {\r\n Util.Assert(!this.complete);\r\n this.annotations.Add(annotation);\r\n }\r\n\r\n public string emit(string commentToken)\r\n {\r\n this.complete = true;\r\n StringBuilder sb = new StringBuilder();\r\n foreach (string[] annotation in this.annotations)\r\n {\r\n sb.AppendLine(commentToken + \"\");\r\n }\r\n\r\n return sb.ToString();\r\n }\r\n\r\n public IEnumerable getAnnotations(string label)\r\n {\r\n return this.annotations.Where(sa => sa[0].Equals(label));\r\n }\r\n\r\n // Look for 0 or 1 instance of a single-valued annotation.\r\n public string getTheAnnotation(string label, string defaultValue)\r\n {\r\n IEnumerable anns = this.getAnnotations(label);\r\n if (anns.Count() == 0)\r\n {\r\n return defaultValue;\r\n }\r\n\r\n string[] ann = anns.First();\r\n if (ann.Length != 2)\r\n {\r\n throw new SourceConfigurationError(\r\n string.Format(\r\n \"Annotation {0} in file {1} should have exactly one argument\",\r\n ann[0],\r\n this.inputObject.getRelativePath()));\r\n }\r\n\r\n return ann[1];\r\n }\r\n\r\n internal static void transferAnnotations(WorkingDirectory workingDirectory, BuildObject source, BuildObject dest, string commentToken)\r\n {\r\n new AnnotationScanner(source).injectAnnotations(workingDirectory, dest, commentToken);\r\n }\r\n\r\n // REVIEW: Make this private?\r\n internal void injectAnnotations(WorkingDirectory workingDirectory, BuildObject dest, string commentToken)\r\n {\r\n string annotations = this.emit(commentToken);\r\n\r\n // REVIEW: Improve upon this round-about way of prepending to a file?\r\n string destStr = File.ReadAllText(workingDirectory.PathTo(dest));\r\n File.Delete(workingDirectory.PathTo(dest));\r\n File.WriteAllText(workingDirectory.PathTo(dest), annotations + destStr);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/App.config", "content": "\r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/AsmRewriterVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n internal class AsmRewriterVerb : Verb, IProcessInvokeAsyncVerb, IAsmProducer\r\n {\r\n public const string WASM_EXTN = \".wasm\";\r\n private const int version = 1;\r\n\r\n private BoogieAsmLinkVerb asmVerb;\r\n private AbstractId abstractId;\r\n private BuildObject asmFileOut;\r\n private BuildObject asmFileIn;\r\n private BuildObject pythonScript;\r\n\r\n public AsmRewriterVerb(BoogieAsmLinkVerb asmVerb)\r\n {\r\n this.asmVerb = asmVerb;\r\n this.asmFileIn = asmVerb.getAsmFile();\r\n this.asmFileOut = this.asmFileIn.makeOutputObject(WASM_EXTN);\r\n\r\n this.abstractId = new AbstractId(this.GetType().Name, version, this.asmFileOut.ToString());\r\n this.pythonScript = new SourcePath(\"tools\\\\scripts\\\\build-standalone-asm.py\", SourcePath.SourceType.Tools);\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public BuildObject getAsmFile()\r\n {\r\n return this.asmFileOut;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n return new List() { this.asmFileIn, this.pythonScript };\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new List() { this.asmVerb };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() { this.getAsmFile() };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n List args = new List() { this.pythonScript.getRelativePath(), this.asmFileIn.getRelativePath() };\r\n string python_exe = @\"C:\\Python27\\pythonw.exe\";\r\n\r\n if (!File.Exists(python_exe))\r\n {\r\n throw new FileNotFoundException(\"Missing python executable: \" + python_exe + \". Try installing from: https://www.python.org/\");\r\n }\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n python_exe,\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n getDiagnosticsBase(),\r\n allowAbsoluteExe: true,\r\n captureStdout: this.asmFileOut);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n return disposition;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BackgroundWorker.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Threading;\r\n using System.Threading.Tasks;\r\n\r\n /// \r\n /// Type of procedure that the background worker thread runs.\r\n /// \r\n /// Some argument.\r\n /// Another argument.\r\n public delegate void BackgroundWorkerProcedure(object argument1, object argument2);\r\n\r\n /// \r\n /// Represents a single background worker thread that sequentially performs\r\n /// the work added to its queue.\r\n /// \r\n /// \r\n /// This class is not related to System.ComponentModel.BackgroundWorker,\r\n /// which provides different functionality.\r\n /// \r\n public class BackgroundWorker : IDisposable\r\n {\r\n /// \r\n /// Thread that performs the background work.\r\n /// \r\n private Thread workerThread;\r\n\r\n /// \r\n /// Queue of work for background worker to perform.\r\n /// \r\n private Queue workQueue;\r\n\r\n /// \r\n /// Lock protecting the work queue.\r\n /// \r\n private Mutex workQueueLock;\r\n\r\n /// \r\n /// Event that is signalled when new items are placed on the workQueue.\r\n /// \r\n private AutoResetEvent workQueueHasNewWork;\r\n\r\n /// \r\n /// Count of work items queued to this BackgroundWorker.\r\n /// \r\n private volatile uint workItemsQueued;\r\n\r\n /// \r\n /// Count of work item procedures performed by this BackgroundWorker.\r\n /// \r\n private volatile uint workItemsPerformed;\r\n\r\n /// \r\n /// Count of work item procedures known to have failed.\r\n /// \r\n private volatile uint workItemsFailed;\r\n\r\n /// \r\n /// Flag indicating whether or not the worker thread should exit.\r\n /// \r\n private volatile bool ourWorkIsNotDone;\r\n\r\n /// \r\n /// Flag indicating whether or not Dispose has already been called.\r\n /// \r\n private bool disposed;\r\n\r\n /// \r\n /// Initializes a new instance of the BackgroundWorker class.\r\n /// \r\n public BackgroundWorker()\r\n {\r\n this.workQueue = new Queue();\r\n this.workQueueLock = new Mutex();\r\n this.workQueueHasNewWork = new AutoResetEvent(false);\r\n this.workItemsQueued = 0;\r\n this.workItemsPerformed = 0;\r\n this.workItemsFailed = 0;\r\n this.ourWorkIsNotDone = true;\r\n this.disposed = false;\r\n\r\n this.workerThread = new Thread(new ThreadStart(this.WorkerThreadMain));\r\n\r\n // REVIEW: Start worker thread only after the first item is queued?\r\n this.workerThread.Start();\r\n }\r\n\r\n /// \r\n /// Gets the count of work items queued to this BackgroundWorker.\r\n /// \r\n public uint GetWorkItemsQueued\r\n {\r\n get { return this.workItemsQueued; }\r\n }\r\n\r\n /// \r\n /// Gets the count of work item procedures performed by this\r\n /// BackgroundWorker.\r\n /// \r\n public uint GetWorkItemsPerformed\r\n {\r\n get { return this.workItemsPerformed; }\r\n }\r\n\r\n /// \r\n /// Gets the count of work item procedures known to have failed.\r\n /// \r\n public uint GetWorkItemsFailed\r\n {\r\n get { return this.workItemsFailed; }\r\n }\r\n\r\n /// \r\n /// Adds new work to the background worker's work queue.\r\n /// \r\n /// \r\n /// Procedure the background worker will run.\r\n /// \r\n /// First argument for procedure.\r\n /// Second argument for procedure.\r\n public void QueueWork(BackgroundWorkerProcedure procedure, object argument1, object argument2)\r\n {\r\n BackgroundWorkerQueueItem workItem = new BackgroundWorkerQueueItem(procedure, argument1, argument2);\r\n\r\n this.workQueueLock.WaitOne();\r\n this.workQueue.Enqueue(workItem);\r\n this.workItemsQueued++;\r\n this.workQueueLock.ReleaseMutex();\r\n\r\n this.workQueueHasNewWork.Set();\r\n }\r\n\r\n /// \r\n /// Tells the worker thread to stop running after completing the\r\n /// currently queued work items.\r\n /// \r\n public void StopWork()\r\n {\r\n this.QueueWork(this.StopWorkerThread, null, null);\r\n }\r\n\r\n /// \r\n /// Wait for the worker thread to exit after a StopWork request.\r\n /// \r\n /// \r\n /// This routine is primarily for making sure the worker thread has\r\n /// completed operation before collecting stats from it\r\n /// (i.e. calling 'GetWorkItemsPerformed'). Since we don't mark our\r\n /// worker thread as a \"background\" thread, the process will not exit\r\n /// until after our thread exits. So this method is not needed for the\r\n /// purpose of keeping the main thread and thus process alive until the\r\n /// worker thread is done.\r\n /// \r\n public void WaitForCompletion()\r\n {\r\n this.workerThread.Join();\r\n }\r\n\r\n /// \r\n /// Releases resources.\r\n /// \r\n public void Dispose()\r\n {\r\n this.Dispose(true);\r\n GC.SuppressFinalize(this);\r\n }\r\n\r\n /// \r\n /// Releases unmanaged and (optionally) managed resources.\r\n /// \r\n /// Whether or not to release managed resources.\r\n protected virtual void Dispose(bool disposing)\r\n {\r\n if (this.disposed)\r\n {\r\n return;\r\n }\r\n\r\n if (disposing)\r\n {\r\n this.workQueueLock.Dispose();\r\n this.workQueueHasNewWork.Dispose();\r\n }\r\n\r\n this.disposed = true;\r\n }\r\n\r\n /// \r\n /// Special BackgroundWorkerProcedure for stopping the worker thread.\r\n /// \r\n /// \r\n /// Note that this procedure ends up being counted in the statistics\r\n /// we keep about the number of work items queued/performed.\r\n /// \r\n /// The parameter is not used.\r\n /// The parameter is not used.\r\n private void StopWorkerThread(\r\n object unused1,\r\n object unused2)\r\n {\r\n this.ourWorkIsNotDone = false;\r\n }\r\n\r\n /// \r\n /// Procedure performed by the background worker thread.\r\n /// \r\n [System.Diagnostics.CodeAnalysis.SuppressMessage(\"Microsoft.Design\", \"CA1031:DoNotCatchGeneralExceptionTypes\", Justification = \"We really do want to catch all exceptions in this case\")]\r\n private void WorkerThreadMain()\r\n {\r\n List toDoList = new List();\r\n\r\n // -\r\n // Run until we're told to stop.\r\n // -\r\n while (this.ourWorkIsNotDone)\r\n {\r\n // -\r\n // Wait for new work to be added to the queue.\r\n // -\r\n if (this.workQueueHasNewWork.WaitOne())\r\n {\r\n toDoList.Clear();\r\n\r\n // -\r\n // Pull all queued work items off the global work queue\r\n // (while holding the lock), and place them on our\r\n // thread-local toDoList.\r\n // -\r\n this.workQueueLock.WaitOne();\r\n\r\n while (this.workQueue.Count > 0)\r\n {\r\n toDoList.Add(this.workQueue.Dequeue());\r\n }\r\n\r\n this.workQueueLock.ReleaseMutex();\r\n\r\n // -\r\n // Do the requested work.\r\n // -\r\n foreach (BackgroundWorkerQueueItem workItem in toDoList)\r\n {\r\n try\r\n {\r\n workItem.Procedure(workItem.Argument1, workItem.Argument2);\r\n this.workItemsPerformed++;\r\n }\r\n catch\r\n {\r\n // -\r\n // Swallow all errors caused by the work item.\r\n // But count how often this happens.\r\n // -\r\n this.workItemsFailed++;\r\n }\r\n }\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Represents a work item on the background worker's work queue.\r\n /// \r\n private class BackgroundWorkerQueueItem\r\n {\r\n /// \r\n /// The procedure the background worker runs.\r\n /// \r\n private BackgroundWorkerProcedure procedure;\r\n\r\n /// \r\n /// The first argument to pass to the procedure.\r\n /// \r\n private object argument1;\r\n\r\n /// \r\n /// The second argument to pass to the procedure.\r\n /// \r\n private object argument2;\r\n\r\n /// \r\n /// Initializes a new instance of the BackgroundWorkerQueueItem class.\r\n /// \r\n /// Procedure to run.\r\n /// First argument for procedure.\r\n /// Second argument for procedure.\r\n public BackgroundWorkerQueueItem(\r\n BackgroundWorkerProcedure procedure,\r\n object argument1,\r\n object argument2)\r\n {\r\n this.procedure = procedure;\r\n this.argument1 = argument1;\r\n this.argument2 = argument2;\r\n }\r\n\r\n /// \r\n /// Gets the procedure the background worker runs.\r\n /// \r\n public BackgroundWorkerProcedure Procedure\r\n {\r\n get { return this.procedure; }\r\n }\r\n\r\n /// \r\n /// Gets the first argument to pass to the procedure.\r\n /// \r\n public object Argument1\r\n {\r\n get { return this.argument1; }\r\n }\r\n\r\n /// \r\n /// Gets the second argument to pass to the procedure.\r\n /// \r\n public object Argument2\r\n {\r\n get { return this.argument2; }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BasmObligationIncludes.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n\r\n internal class BasmObligationIncludes\r\n : IIncludeFactory\r\n {\r\n private IIncludePathContext includePathSearcher;\r\n private BeatIncludes directIncludes;\r\n\r\n public BasmObligationIncludes(IIncludePathContext includePathSearcher)\r\n {\r\n this.includePathSearcher = includePathSearcher;\r\n this.directIncludes = new BeatIncludes(includePathSearcher);\r\n }\r\n\r\n public IEnumerable getIncludes(BuildObject beatsrc)\r\n {\r\n IHasher hasher = BuildEngine.theEngine.getHasher();\r\n OrderPreservingSet includes = new OrderPreservingSet();\r\n\r\n BuildObject ifcFile = hasher.search(this.includePathSearcher, beatsrc.getFileNameWithoutExtension(), ModPart.Ifc);\r\n BuildObject impFile = hasher.search(this.includePathSearcher, beatsrc.getFileNameWithoutExtension(), ModPart.Imp);\r\n\r\n Util.Assert(ifcFile.Equals(beatsrc) || impFile.Equals(beatsrc));\r\n includes.AddRange(this.directIncludes.getBasmIncludes(ifcFile));\r\n includes.AddRange(this.directIncludes.getBasmIncludes(impFile));\r\n return includes;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BasmTransitiveDepsVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class BasmTransitiveDepsVerb\r\n : TransitiveDepsVerb\r\n {\r\n private IContextGeneratingVerb contextVerb;\r\n\r\n public BasmTransitiveDepsVerb(IContextGeneratingVerb contextVerb, BuildObject input)\r\n : base(input)\r\n {\r\n this.contextVerb = contextVerb;\r\n }\r\n\r\n protected override TransitiveDepsVerb factory(BuildObject obj)\r\n {\r\n return new BasmTransitiveDepsVerb(this.contextVerb, obj);\r\n }\r\n\r\n protected override void extendDeps(List deps)\r\n {\r\n deps.Add(this.contextVerb.getContextOutput());\r\n }\r\n\r\n protected override IIncludeFactory getIncludeFactory()\r\n {\r\n ContextContents context = (ContextContents)\r\n BuildEngine.theEngine.Repository.FetchVirtual(this.contextVerb.getContextOutput());\r\n return new BasmObligationIncludes(context.Context);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BatchVerifyVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class BatchVerifyVerb\r\n : Verb, IObligationsProducer\r\n {\r\n private const string BATCH_EXTN = \".batch\";\r\n private const int version = 1;\r\n\r\n private BuildObject outputObject;\r\n private HashSet producers;\r\n private AbstractId abstractId;\r\n private BatchMode mode; // REVIEW: Never used?\r\n private List deps;\r\n\r\n public BatchVerifyVerb(SourcePath batch_file, BatchMode mode, VerificationRequest verificationRequest, DafnyCCVerb.FramePointerMode useFramePointer)\r\n {\r\n this.mode = mode;\r\n\r\n this.producers = new HashSet();\r\n foreach (string line in File.ReadAllLines(IronRootDirectory.PathTo(batch_file)))\r\n {\r\n if (line.Equals(\"\") || line[0] == '#')\r\n {\r\n continue;\r\n }\r\n\r\n SourcePath src = new SourcePath(line);\r\n switch (mode)\r\n {\r\n case BatchMode.DAFNY:\r\n if (verificationRequest.verifyMode != VerificationRequest.VerifyMode.Verify)\r\n {\r\n throw new UserError(\"BatchVerify DAFNY only supports full verification (but maybe we should add selective?)\");\r\n }\r\n\r\n this.producers.Add(new DafnyVerifyTreeVerb(src));\r\n break;\r\n case BatchMode.APP:\r\n this.producers.Add(new IroncladAppVerb(src, IroncladAppVerb.TARGET.BARE_METAL, useFramePointer, verificationRequest));\r\n break;\r\n default:\r\n throw new Exception(\"Unknown batch file type\");\r\n }\r\n }\r\n\r\n string parameters = mode.ToString() + \",\" + verificationRequest.ToString();\r\n this.outputObject = batch_file.makeLabeledOutputObject(parameters, BATCH_EXTN + VerificationObligationList.VOL_EXTN);\r\n this.abstractId = new AbstractId(this.GetType().Name, version, batch_file.ToString(), concrete: parameters);\r\n }\r\n\r\n public BatchVerifyVerb(BuildObject batch_label, HashSet producers, BatchMode mode)\r\n {\r\n this.mode = mode;\r\n this.producers = producers;\r\n\r\n this.outputObject = batch_label.makeOutputObject(BATCH_EXTN + VerificationObligationList.VOL_EXTN);\r\n this.abstractId = new AbstractId(this.GetType().Name, version, batch_label.ToString(), concrete: mode.ToString());\r\n }\r\n\r\n public enum BatchMode\r\n {\r\n DAFNY,\r\n APP\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public BuildObject getObligationSet()\r\n {\r\n return this.outputObject;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n if (this.deps == null)\r\n {\r\n this.deps = new List();\r\n foreach (IObligationsProducer producer in this.producers)\r\n {\r\n this.deps.Add(producer.getObligationSet());\r\n }\r\n }\r\n\r\n ddisp = DependencyDisposition.Complete;\r\n return this.deps;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n // Pass this request upstream to expose upstream verbs.\r\n HashSet upstreamVerbs = new HashSet();\r\n foreach (IVerb producer in this.producers)\r\n {\r\n upstreamVerbs.UnionWith(producer.getVerbs());\r\n upstreamVerbs.Add(producer);\r\n }\r\n\r\n return upstreamVerbs;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new HashSet() { this.outputObject };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // Coallesce the VerificationObligationLists from each producer into a single result set\r\n IEnumerable master = new HashSet();\r\n foreach (IObligationsProducer producer in this.producers)\r\n {\r\n VerificationObligationList vol = VerificationObligationList.fetch(producer.getObligationSet());\r\n master = master.Union(vol.getVerificationObligations());\r\n }\r\n\r\n VerificationObligationList myVOL = new VerificationObligationList(master);\r\n myVOL.store(workingDirectory, this.outputObject);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BeatExtensions.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Text;\r\n\r\n public enum ModPart\r\n {\r\n Ifc,\r\n Imp,\r\n Unknown\r\n }\r\n\r\n public static class ModPartExtensions\r\n {\r\n public const string ModPartIfc = \".ifc\";\r\n public const string ModPartImp = \".imp\";\r\n public const string ModPartUnknown = \".unk\";\r\n\r\n public static string ExtnStr(this ModPart modPart)\r\n {\r\n switch (modPart)\r\n {\r\n case ModPart.Ifc: return ModPartIfc;\r\n case ModPart.Imp: return ModPartImp;\r\n case ModPart.Unknown: return ModPartUnknown;\r\n default: return null;\r\n }\r\n }\r\n }\r\n\r\n internal class BeatExtensions\r\n {\r\n public const string BEAT_EXTN = \".beat\";\r\n public const string BEATIFC_EXTN = \".ifc.beat\";\r\n public const string BEATIMP_EXTN = \".imp.beat\";\r\n\r\n public static ModPart whichPart(string filenameOrExtn)\r\n {\r\n string modPartStr = \".\" + filenameOrExtn.Split('.')[1];\r\n switch (modPartStr)\r\n {\r\n case ModPartExtensions.ModPartIfc: return ModPart.Ifc;\r\n case ModPartExtensions.ModPartImp: return ModPart.Imp;\r\n default: return ModPart.Unknown;\r\n }\r\n }\r\n\r\n public static BuildObject makeOutputObject(BuildObject input, string typeExtn)\r\n {\r\n return makeLabeledOutputObject(input, null, typeExtn);\r\n }\r\n\r\n internal static BuildObject makeLabeledOutputObject(BuildObject input, string appLabel, string typeExtn)\r\n {\r\n ModPart part = whichPart(input);\r\n if (part == ModPart.Unknown)\r\n {\r\n // Input must be a raw boogie file.\r\n Util.Assert(input.getExtension().EndsWith(BoogieVerb.BPL_EXTN));\r\n return input.makeLabeledOutputObject(appLabel, typeExtn);\r\n }\r\n else\r\n {\r\n return input.makeLabeledOutputObject(appLabel, part.ExtnStr() + typeExtn);\r\n }\r\n }\r\n\r\n public static ModPart whichPart(BuildObject obj)\r\n {\r\n return whichPart(obj.getExtension());\r\n }\r\n\r\n private static IEnumerable getBeatFlavoredShallowIncludesLabeled(\r\n IContextGeneratingVerb contextVerb, BuildObject rootObj)\r\n {\r\n ContextContents context = (ContextContents)\r\n BuildEngine.theEngine.Repository.FetchVirtual(contextVerb.getContextOutput());\r\n BeatIncludes includes = new BeatIncludes(context.Context);\r\n OrderPreservingSet result = new OrderPreservingSet(\r\n includes.getLabeledIncludes(rootObj));\r\n\r\n if (BeatExtensions.whichPart(rootObj) == ModPart.Imp)\r\n {\r\n BuildObject rootIfc = context.Context.search(rootObj.getFileNameWithoutExtension(), ModPart.Ifc);\r\n result.Add(new BeatIncludes.LabeledInclude(BeatIncludes.ImportFilter.ForBeatOrBasm, rootIfc));\r\n }\r\n\r\n return result;\r\n }\r\n\r\n public static IEnumerable getBeatFlavoredShallowIncludes(\r\n IContextGeneratingVerb contextVerb, BuildObject rootObj, BeatIncludes.ImportFilter importFilter)\r\n {\r\n return getBeatFlavoredShallowIncludesLabeled(contextVerb, rootObj)\r\n .Where(li => importFilter == BeatIncludes.ImportFilter.ForBasmOnly\r\n || li.importFilter == BeatIncludes.ImportFilter.ForBeatOrBasm)\r\n .Select(li => li.buildObject);\r\n }\r\n\r\n public static void propagatePrivateImports(\r\n WorkingDirectory workingDirectory,\r\n IContextGeneratingVerb contextVerb,\r\n BuildObject srcobj,\r\n BuildObject dstobj)\r\n {\r\n // Rewrite basm output to propagate any import statements from the beat file.\r\n // TODO this step really should be a beat function, not part of the build system.\r\n IEnumerable beatImports =\r\n getBeatFlavoredShallowIncludesLabeled(contextVerb, srcobj);\r\n StringBuilder sb = new StringBuilder();\r\n foreach (BeatIncludes.LabeledInclude li in beatImports)\r\n {\r\n sb.Append(\"//-\");\r\n sb.Append(li.importFilter == BeatIncludes.ImportFilter.ForBasmOnly\r\n ? \"private-basmonly-import\" : \"private-import\");\r\n sb.Append(\" \");\r\n sb.Append(li.buildObject.getFileNameWithoutExtension());\r\n sb.AppendLine(\";\");\r\n }\r\n\r\n // REVIEW: Improve upon this round-about way of prepending to a file?\r\n string beatOutput = File.ReadAllText(workingDirectory.PathTo(dstobj));\r\n File.Delete(workingDirectory.PathTo(dstobj));\r\n File.WriteAllText(workingDirectory.PathTo(dstobj), sb.ToString() + beatOutput);\r\n }\r\n\r\n // This used to use a BeatTransitiveDepsVerb, but we're going with shallow dependencies at the moment.\r\n // We may want to restore that behavior later, if we can get some sane transitive dep tree worked out for\r\n // Verve code.\r\n // The returned list belongs to the caller to .Add() to as desired.\r\n // TODO this really needs to be factored to supply the actual Beat-flavored references separately\r\n // from the auxiliary deps (transitive dep objects and context dep objects), so we don't have\r\n // client code trying to filter back out the part it wants. Brittle.\r\n public static OrderPreservingSet getBeatFlavoredShallowDependencies(\r\n IContextGeneratingVerb contextVerb, BuildObject rootObj, out DependencyDisposition ddisp, BeatIncludes.ImportFilter filter)\r\n {\r\n OrderPreservingSet result = new OrderPreservingSet();\r\n result.Add(contextVerb.getContextOutput());\r\n try\r\n {\r\n result.AddRange(getBeatFlavoredShallowIncludes(contextVerb, rootObj, filter));\r\n ddisp = DependencyDisposition.Complete;\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n ddisp = DependencyDisposition.Incomplete;\r\n }\r\n catch (ObjectFailedException)\r\n {\r\n ddisp = DependencyDisposition.Failed;\r\n }\r\n\r\n result.Add(rootObj); // root really needs to go at the end of the list.\r\n return result;\r\n }\r\n\r\n public static BasmTransitiveDepsVerb getBasmFlavoredTransitiveDepVerb(IContextGeneratingVerb context, BuildObject rootObj)\r\n {\r\n return new BasmTransitiveDepsVerb(context, rootObj);\r\n }\r\n\r\n // The list belongs to the caller to .Add() to as desired.\r\n public static OrderPreservingSet getBasmFlavoredTransitiveDependencies(IContextGeneratingVerb context, BuildObject rootObj, out DependencyDisposition ddisp)\r\n {\r\n OrderPreservingSet result = new OrderPreservingSet();\r\n TransitiveDepsVerb depsVerb = getBasmFlavoredTransitiveDepVerb(context, rootObj);\r\n result.Add(depsVerb.depsObj());\r\n result.AddRange(depsVerb.getAvailableDeps(out ddisp));\r\n\r\n // NB add root object at end of list, to keep it in definition-dependency order.\r\n result.Add(rootObj);\r\n return result;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BeatIncludes.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Text.RegularExpressions;\r\n\r\n internal class BeatIncludes\r\n {\r\n private static CachedHash fetchModuleCaches\r\n = new CachedHash(delegate(IIncludePathContext context)\r\n {\r\n return new FetchModuleCache(context);\r\n });\r\n\r\n private IIncludePathContext includePathSearcher;\r\n\r\n public BeatIncludes(IIncludePathContext includePathSearcher)\r\n {\r\n this.includePathSearcher = includePathSearcher;\r\n }\r\n\r\n public enum ImportFilter\r\n {\r\n ForBeatOrBasm,\r\n ForBasmOnly\r\n }\r\n\r\n public static List parseLabeledIncludes(IIncludePathContext context, BuildObject beatsrc)\r\n {\r\n ////Logger.WriteLine(\"parseLabeledIncludes \" + beatsrc.getRelativePath() + \" context \" + context.GetHashCode());\r\n\r\n List outlist = new List();\r\n ////Regex re = new Regex(\"^\\\\s*import\\\\s*([^\\\\s,]*(,\\\\s*[^\\\\s,]*)*)\\\\s*;\");\r\n // TODO allow commented-out imports until Beat accepts (ignores) them in ifcs files.\r\n Regex import_re = new Regex(\"^[\\\\s/-]*private-import\\\\s*([^\\\\s,]*(,\\\\s*[^\\\\s,]*)*)\\\\s*;\");\r\n Regex basmonly_re = new Regex(\"^[\\\\s/-]*private-basmonly-import\\\\s*([^\\\\s,]*(,\\\\s*[^\\\\s,]*)*)\\\\s*;\");\r\n FetchModuleCache fmcache = fetchModuleCaches.get(context);\r\n using (TextReader tr = BuildEngine.theEngine.Repository.OpenRead(beatsrc))\r\n {\r\n while (true)\r\n {\r\n string line = tr.ReadLine();\r\n if (line == null)\r\n {\r\n break;\r\n }\r\n\r\n Match match = import_re.Match(line);\r\n if (match.Success)\r\n {\r\n outlist.Add(new LabeledInclude(ImportFilter.ForBeatOrBasm, fmcache.get(match.Groups[1].ToString())));\r\n }\r\n\r\n match = basmonly_re.Match(line);\r\n if (match.Success)\r\n {\r\n outlist.Add(new LabeledInclude(ImportFilter.ForBasmOnly, fmcache.get(match.Groups[1].ToString())));\r\n }\r\n }\r\n\r\n ////Logger.WriteLine(string.Format(\"{0} includes {1} things\", dfysource.getFilesystemPath(), outlist.Count));\r\n return outlist;\r\n }\r\n }\r\n\r\n public List getLabeledIncludes(BuildObject beatsrc)\r\n {\r\n ////return caches.get(includePathSearcher).get(beatsrc);\r\n return this.computeLabeledIncludes(beatsrc);\r\n }\r\n\r\n public IEnumerable getBasmIncludes(BuildObject beatsrc)\r\n {\r\n return this.computeLabeledIncludes(beatsrc).Select(li => li.buildObject);\r\n }\r\n\r\n protected List computeLabeledIncludes(BuildObject beatsrc)\r\n {\r\n return BuildEngine.theEngine.getHasher().getParsedIncludes(this.includePathSearcher, beatsrc);\r\n }\r\n\r\n private BuildObject fetchModule(string module)\r\n {\r\n ////Logger.WriteLine(\"fetchmodule \" + module + \" ctx \" + includePathSearcher.GetHashCode());\r\n string includedModule = module.Trim();\r\n BuildObject path = this.includePathSearcher.search(includedModule);\r\n if (path == null)\r\n {\r\n throw new SourceConfigurationError(\r\n string.Format(\r\n \"Cannot find module {0} in search path {1}\",\r\n includedModule,\r\n this.includePathSearcher));\r\n }\r\n\r\n return path;\r\n }\r\n\r\n public class LabeledInclude\r\n {\r\n public ImportFilter importFilter;\r\n public BuildObject buildObject;\r\n\r\n public LabeledInclude(ImportFilter importFilter, BuildObject buildObject)\r\n {\r\n this.importFilter = importFilter;\r\n this.buildObject = buildObject;\r\n }\r\n }\r\n\r\n private class FetchModuleCache\r\n {\r\n private CachedHash cache;\r\n private BeatIncludes beatIncludes;\r\n\r\n public FetchModuleCache(IIncludePathContext context)\r\n {\r\n this.beatIncludes = new BeatIncludes(context);\r\n this.cache = new CachedHash(this.fetchModule);\r\n }\r\n\r\n public BuildObject get(string module)\r\n {\r\n return this.cache.get(module);\r\n }\r\n\r\n private BuildObject fetchModule(string module)\r\n {\r\n return this.beatIncludes.fetchModule(module);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BeatVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class BeatVerb\r\n : Verb, IProcessInvokeAsyncVerb\r\n {\r\n private const int version = 34;\r\n\r\n private static NmakeVerb beatBuildExecutableVerb = new NmakeVerb(new SourcePath(\"tools\\\\Beat\\\\makefile\", SourcePath.SourceType.Tools));\r\n\r\n private IContextGeneratingVerb contextVerb;\r\n private BuildObject beatobj;\r\n private string appLabel;\r\n private AbstractId abstractId;\r\n\r\n public BeatVerb(IContextGeneratingVerb contextVerb, BuildObject beatobj, string appLabel)\r\n {\r\n this.contextVerb = contextVerb;\r\n this.beatobj = beatobj;\r\n this.appLabel = appLabel;\r\n this.abstractId = new AbstractId(this.GetType().Name, version, beatobj.ToString(), contextVerb.getPoundDefines(), concrete: appLabel);\r\n }\r\n\r\n public static bool isBeat(BuildObject obj)\r\n {\r\n return obj.getExtension().Equals(BeatExtensions.BEATIFC_EXTN)\r\n || obj.getExtension().Equals(BeatExtensions.BEATIMP_EXTN);\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n OrderPreservingSet deps = BeatExtensions.getBeatFlavoredShallowDependencies(\r\n this.contextVerb, this.beatobj, out ddisp, BeatIncludes.ImportFilter.ForBeatOrBasm);\r\n deps.Add(this.getBeatExecutable());\r\n return deps;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new IVerb[] { this.contextVerb, beatBuildExecutableVerb };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { this.outputFile() };\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public BuildObject getBeatExecutable()\r\n {\r\n // Whaaat? Why doesn't beatBuildExecutableVerb.getOutputPath() already end with beat.exe!? Weirdly,\r\n // nope, its getOutputPath() is a directory.\r\n return new BuildObject(Path.Combine(beatBuildExecutableVerb.getOutputPath().getRelativePath(), \"beat.exe\"));\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // \"beat $BUILD_DEFS -out $out.tmp -in $in $incls\"\r\n List args = new List();\r\n args.Add(\"-in\");\r\n args.Add(this.beatobj.getRelativePath());\r\n\r\n IEnumerable beatImports =\r\n BeatExtensions.getBeatFlavoredShallowIncludes(this.contextVerb, this.beatobj, BeatIncludes.ImportFilter.ForBeatOrBasm);\r\n foreach (BuildObject ifcObj in beatImports.Where(obj => !obj.Equals(this.beatobj)))\r\n {\r\n Util.Assert(!ifcObj.getRelativePath().Contains(\".imp\")); // Erk, don't feed imp files as includes!\r\n args.Add(\"-i\");\r\n args.Add(ifcObj.getRelativePath());\r\n }\r\n\r\n args.AddRange(this.contextVerb.getPoundDefines().ToDefArgs());\r\n\r\n string dbgText = string.Format(\r\n \"rem verb {0}{1}\",\r\n this,\r\n System.Environment.NewLine);\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n this.getBeatExecutable().getRelativePath(),\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n captureStdout: this.outputFile(),\r\n failureBase: getDiagnosticsBase(),\r\n dbgText: dbgText);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n if (disposition is Fresh)\r\n {\r\n BeatExtensions.propagatePrivateImports(workingDirectory, this.contextVerb, this.beatobj, this.outputFile());\r\n\r\n // And then propagate the NuBuild annotations, too.\r\n AnnotationScanner.transferAnnotations(\r\n workingDirectory,\r\n this.beatobj,\r\n this.outputFile(),\r\n BoogieAsmDepBase.CommentSymbol);\r\n }\r\n\r\n return disposition;\r\n }\r\n\r\n private BuildObject outputFile()\r\n {\r\n string outputAppLabel = (this.appLabel == null ? string.Empty : this.appLabel) + this.contextVerb.getPoundDefines().ToString();\r\n string extn = this.beatobj.getExtension().Equals(BeatExtensions.BEATIFC_EXTN) ? BoogieAsmVerifyVerb.BASMIFC_EXTN : BoogieAsmVerifyVerb.BASMIMP_EXTN;\r\n return this.beatobj.makeLabeledOutputObject(outputAppLabel, extn);\r\n }\r\n\r\n private string getModuleNameForObj(BuildObject obj)\r\n {\r\n return obj.getFileNameWithoutExtension();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BoogieAsmDepBase.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal abstract class BoogieAsmDepBase\r\n : Verb\r\n {\r\n public const string BASM_EXTN = \".basm\";\r\n public const string BASMIFC_EXTN = \".ifc.basm\";\r\n public const string BASMIMP_EXTN = \".imp.basm\";\r\n public const string CommentSymbol = \"//\";\r\n\r\n protected static NmakeVerb boogieAsmBuildExecutableVerb = new NmakeVerb(new SourcePath(\"tools\\\\BoogieAsm\\\\makefile\", SourcePath.SourceType.Tools));\r\n\r\n protected IContextGeneratingVerb context;\r\n protected BuildObject basmInput;\r\n protected BuildObject upstreamObj;\r\n\r\n private const int version = 20;\r\n private AbstractId abstractId = null;\r\n\r\n public BoogieAsmDepBase(IContextGeneratingVerb context, BuildObject input)\r\n {\r\n this.context = context;\r\n this.upstreamObj = input;\r\n this.basmInput = computeBasmInput(context.getPoundDefines(), input);\r\n }\r\n\r\n public static bool isBasm(BuildObject obj)\r\n {\r\n return obj.getExtension().Equals(BASMIFC_EXTN)\r\n || obj.getExtension().Equals(BASMIMP_EXTN);\r\n }\r\n\r\n public abstract BuildObject outputFile();\r\n\r\n protected abstract int getVersion();\r\n\r\n protected abstract bool includeAllImps();\r\n\r\n protected virtual string getExtraAbstractID()\r\n {\r\n return string.Empty;\r\n }\r\n\r\n protected static BuildObject getBoogieasmExecutable()\r\n {\r\n return new BuildObject(Path.Combine(boogieAsmBuildExecutableVerb.getOutputPath().getRelativePath(), \"boogieasm.exe\"));\r\n }\r\n\r\n protected virtual IEnumerable getExtraDeps(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n return new BuildObject[] { };\r\n }\r\n\r\n public static BuildObject computeBasmInput(PoundDefines poundDefines, BuildObject upstreamObj)\r\n {\r\n if (BoogieAsmDepBase.isBasm(upstreamObj))\r\n {\r\n // We'll be reading upstreamObj directly. Don't makeOutputObject,\r\n // because it may well be a source file.\r\n return upstreamObj;\r\n }\r\n\r\n return BeatExtensions.makeLabeledOutputObject(upstreamObj, poundDefines.ToString(), BASM_EXTN);\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { outputFile() };\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n if (this.abstractId == null)\r\n {\r\n this.abstractId = new AbstractId(this.GetType().Name, getVersion() + version, this.upstreamObj.ToString(), context.getPoundDefines(), getExtraAbstractID());\r\n }\r\n\r\n return abstractId;\r\n }\r\n\r\n internal class BasmModuleAccumulator\r\n {\r\n private IContextGeneratingVerb _contextGenVerb;\r\n private HashSet _mutableVerbSet;\r\n private OrderPreservingSet _basmModules; // these are the bits we want to pass in as Execute() arguments\r\n private HashSet _auxiliaryDeps; // these plus modules are the deps we need to wait on. We need these to get the right .tdeps.\r\n private IIncludePathContext context;\r\n private DependencyDisposition _ddisp;\r\n\r\n public IEnumerable verbs\r\n {\r\n get { return _mutableVerbSet; }\r\n }\r\n\r\n public IEnumerable basmModules\r\n {\r\n get { return _basmModules; }\r\n }\r\n\r\n public IEnumerable getDeps()\r\n {\r\n return _auxiliaryDeps.Concat(_basmModules);\r\n }\r\n\r\n public DependencyDisposition ddisp\r\n {\r\n get { return _ddisp; }\r\n }\r\n\r\n public BasmModuleAccumulator(IContextGeneratingVerb contextGenVerb, BuildObject upstreamObj, bool linkMode)\r\n {\r\n this._contextGenVerb = contextGenVerb;\r\n this._mutableVerbSet = new HashSet();\r\n\r\n // NB preserve module definition-dependency order.\r\n this._basmModules = new OrderPreservingSet();\r\n this._auxiliaryDeps = new HashSet();\r\n _ddisp = DependencyDisposition.Complete;\r\n\r\n ////try\r\n ////{\r\n _mutableVerbSet.Add(contextGenVerb);\r\n _auxiliaryDeps.UnionWith(contextGenVerb.getOutputs());\r\n\r\n context = contextGenVerb.fetchIfAvailable(ref _ddisp);\r\n\r\n if (context != null)\r\n {\r\n OrderPreservingSet deps;\r\n if (!linkMode)\r\n {\r\n deps = BeatExtensions.getBeatFlavoredShallowDependencies(\r\n contextGenVerb, upstreamObj, out _ddisp, BeatIncludes.ImportFilter.ForBasmOnly);\r\n }\r\n else\r\n {\r\n deps = BeatExtensions.getBasmFlavoredTransitiveDependencies(contextGenVerb, upstreamObj, out _ddisp);\r\n _mutableVerbSet.Add(BeatExtensions.getBasmFlavoredTransitiveDepVerb(_contextGenVerb, upstreamObj));\r\n }\r\n\r\n // REVIEW: The following two variables are unused. Remove?\r\n string targetModName = upstreamObj.getFileNameWithoutExtension();\r\n ModPart targetModPart = BeatExtensions.whichPart(upstreamObj);\r\n\r\n // NB security policy note: When verifying X.imp, we must be sure to supply X.ifc\r\n // to BoogieAsm, so that we know that we're actually verifying the promises\r\n // that other modules are relying on when they say \"X\" (which is how X got on\r\n // the verification obligation list). That property happens automatically here,\r\n // because we make a list of modules (ignoring ifc/imp part), such as {A,B,X},\r\n // and include *every* .ifc. If we're verifying X.imp, a conditional test\r\n // includes it at the time we consider module X.\r\n\r\n foreach (BuildObject dep in deps)\r\n {\r\n string depExtn = dep.getExtension();\r\n if (depExtn == null\r\n || depExtn.EndsWith(TransitiveDepsVerb.TDEP_EXTN)\r\n || depExtn.EndsWith(ContextGeneratingVerb.CONTEXT_EXTN))\r\n {\r\n _auxiliaryDeps.Add(dep);\r\n }\r\n else\r\n {\r\n Util.Assert(depExtn.Equals(BeatExtensions.BEATIFC_EXTN)\r\n || depExtn.Equals(BeatExtensions.BEATIMP_EXTN)\r\n || depExtn.Equals(BASMIFC_EXTN)\r\n || depExtn.Equals(BASMIMP_EXTN)); // Burned too many times by this silly filter-out strategy.\r\n string modName = dep.getFileNameWithoutExtension();\r\n ModPart modPart = BeatExtensions.whichPart(dep);\r\n getBasmModule(modName, ModPart.Ifc);\r\n if ((dep.Equals(upstreamObj) && modPart == ModPart.Imp) || linkMode)\r\n {\r\n getBasmModule(modName, ModPart.Imp);\r\n }\r\n }\r\n }\r\n }\r\n\r\n ////}\r\n ////catch (ObjNotReadyException)\r\n ////{\r\n //// // oh, we don't even have the context object yet.\r\n //// _ddisp = DependencyDisposition.Incomplete;\r\n ////}\r\n ////catch (ObjFailedException)\r\n ////{\r\n //// _ddisp = DependencyDisposition.Failed;\r\n ////}\r\n }\r\n\r\n private BuildObject maybeBeat(BuildObject obj, HashSet mutableVerbSet)\r\n {\r\n BuildObject result = obj;\r\n if (BeatVerb.isBeat(obj))\r\n {\r\n BeatVerb beatVerb = new BeatVerb(_contextGenVerb, obj, appLabel: null);\r\n IEnumerable beatOuts = beatVerb.getOutputs();\r\n Util.Assert(beatOuts.Count() == 1);\r\n mutableVerbSet.Add(beatVerb);\r\n result = beatVerb.getOutputs().First();\r\n }\r\n else\r\n {\r\n // No, this thing should already be ready to consume.\r\n ////mutableVerbSet.Add(new BoogieAsmVerifyVerb(context, obj));\r\n }\r\n\r\n Util.Assert(BoogieAsmVerifyVerb.isBasm(result));\r\n return result;\r\n }\r\n\r\n private void getBasmModule(string modName, ModPart modPart)\r\n {\r\n ////Logger.WriteLine(string.Format(\"context {0} modName {1} modPart {2}\", context, modName, modPart));\r\n ////BuildObject ifcObj = context.search(modName, modPart);\r\n BuildObject ifcObj = BuildEngine.theEngine.getHasher().search(context, modName, modPart);\r\n if (ifcObj == null)\r\n {\r\n Util.Assert(false); // I'm not sure this case even occur anymore, since we guard the foreach on incomplete deps.\r\n _ddisp = _ddisp.combine(DependencyDisposition.Incomplete);\r\n }\r\n else\r\n {\r\n ifcObj = maybeBeat(ifcObj, _mutableVerbSet);\r\n _basmModules.Add(ifcObj);\r\n }\r\n }\r\n }\r\n\r\n protected IEnumerable getBoogieVerbs(VerificationRequest verificationRequest)\r\n {\r\n if (verificationRequest.verifyMode == VerificationRequest.VerifyMode.NoVerify)\r\n {\r\n return new BoogieVerb[] { };\r\n }\r\n\r\n BoogieAsmDepBase.BasmModuleAccumulator acc = new BoogieAsmDepBase.BasmModuleAccumulator(context, upstreamObj, includeAllImps());\r\n List basmModules = new List(acc.basmModules.Where(mod => !mod.IsTrusted));\r\n\r\n OrderPreservingSet normal_Boogie = new OrderPreservingSet();\r\n OrderPreservingSet SymDiff_Boogie = new OrderPreservingSet();\r\n\r\n foreach (BuildObject basmModule in basmModules)\r\n {\r\n if (verificationRequest.verifyMode == VerificationRequest.VerifyMode.SelectiveVerify\r\n && !verificationRequest.selectiveVerifyModuleNames.Contains(basmModule.getFileNameWithoutExtension()))\r\n {\r\n continue;\r\n }\r\n\r\n normal_Boogie.Add(new BoogieVerb(context, basmModule, symdiff: VerificationRequest.SymDiffMode.NoSymDiff));\r\n\r\n if (verificationRequest.getSymDiffMode() == VerificationRequest.SymDiffMode.UseSymDiff\r\n && BoogieAsmVerifyVerb.needs_symdiff(basmModule))\r\n {\r\n SymDiff_Boogie.Add(new BoogieVerb(context, basmModule, symdiff: VerificationRequest.SymDiffMode.UseSymDiff));\r\n }\r\n }\r\n\r\n return SymDiff_Boogie.Union(normal_Boogie);\r\n }\r\n\r\n protected IEnumerable getVerifyishVerbs()\r\n {\r\n // All the available things that make Beat or Basm ...\r\n BasmModuleAccumulator acc = new BasmModuleAccumulator(context, upstreamObj, includeAllImps());\r\n\r\n // Plus the transitive deps.\r\n IEnumerable extraDeps = new IVerb[] { context, boogieAsmBuildExecutableVerb };\r\n return acc.verbs.Concat(extraDeps).Concat(context.getVerbs());\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n BasmModuleAccumulator acc = new BasmModuleAccumulator(context, upstreamObj, includeAllImps());\r\n IEnumerable result = acc.getDeps();\r\n DependencyDisposition ddisp_extra;\r\n IEnumerable result_extra = getExtraDeps(out ddisp_extra);\r\n ddisp = acc.ddisp.combine(ddisp_extra);\r\n return result.Concat(result_extra).Concat(new[] { getBoogieasmExecutable() });\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BoogieAsmLinkVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class BoogieAsmLinkVerb\r\n : BoogieAsmWorkerBase, IAsmProducer\r\n {\r\n public BoogieAsmLinkVerb(IContextGeneratingVerb context, BuildObject input)\r\n : base(context, input)\r\n {\r\n }\r\n\r\n public BuildObject getAsmFile()\r\n {\r\n return basmInput.makeOutputObject(MasmVerb.MASM_EXTN);\r\n }\r\n\r\n public override BuildObject outputFile()\r\n {\r\n return this.getAsmFile();\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return getVerifyishVerbs();\r\n }\r\n\r\n protected override int getVersion()\r\n {\r\n return 23;\r\n }\r\n\r\n protected override string getAction()\r\n {\r\n return \"-link\";\r\n }\r\n\r\n protected override bool outFlagWorks()\r\n {\r\n return false;\r\n }\r\n\r\n protected override bool includeAllImps()\r\n {\r\n return true;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BoogieAsmVerificationObligationListVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n // NB we generate the obligation list in a seperate verb from the actual BoogieAsm -link step\r\n // because the latter is quite slow, and the former frees up a bunch of downstream\r\n // parallelism.\r\n internal class BoogieAsmVerificationObligationListVerb\r\n : BoogieAsmDepBase, IObligationsProducer\r\n {\r\n private BuildObject obligations;\r\n private VerificationRequest verificationRequest;\r\n\r\n public BoogieAsmVerificationObligationListVerb(IContextGeneratingVerb context, BuildObject input, VerificationRequest verificationRequest)\r\n : base(context, input)\r\n {\r\n this.verificationRequest = verificationRequest;\r\n obligations = input.makeOutputObject(BASM_EXTN + VerificationObligationList.VOL_EXTN);\r\n }\r\n\r\n public BuildObject getObligationSet()\r\n {\r\n return obligations;\r\n }\r\n\r\n public override BuildObject outputFile()\r\n {\r\n return obligations;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n IEnumerable result = getVerifyishVerbs();\r\n IEnumerable boogieVerbs = new List();\r\n try\r\n {\r\n boogieVerbs = getBoogieVerbs(verificationRequest);\r\n ////Logger.Out.WriteLine(\"Successfully retrieved the Boogie verbs.\");\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n ////Logger.Out.WriteLine(\"Caught an exception: \" + e);\r\n }\r\n\r\n return result.Concat(boogieVerbs);\r\n }\r\n\r\n public IEnumerable getObligationSatisfyingVerbs()\r\n {\r\n return getBoogieVerbs(verificationRequest);\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n IEnumerable verificationResults = getBoogieVerbs(verificationRequest)\r\n .Select(boogie_verb => boogie_verb.getOutputFile());\r\n VerificationObligationList vol = new VerificationObligationList(verificationResults);\r\n vol.store(workingDirectory, this.obligations);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n\r\n protected override int getVersion()\r\n {\r\n return 5;\r\n }\r\n\r\n protected override bool includeAllImps()\r\n {\r\n return true;\r\n }\r\n\r\n protected override string getExtraAbstractID()\r\n {\r\n return verificationRequest.ToString();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BoogieAsmVerifyVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n internal class BoogieAsmVerifyVerb\r\n : BoogieAsmWorkerBase\r\n {\r\n public const string MUTUAL_SUMMARY_EXTN = \".ms\";\r\n public const string SYMDIFF_EXTN = \".symdiff\";\r\n public const string SYMDIFF_DIR_EXTN = \".dir\";\r\n private const string AddBoogieAxiomAnnotation = \"AddBoogieAxiom\";\r\n private const string BasmEnableSymdiffAnnotation = \"BasmEnableSymdiff\";\r\n\r\n private bool buildSymDiffMutualSummary;\r\n private bool enableSymdiff = false;\r\n private string dirName;\r\n\r\n public BoogieAsmVerifyVerb(IContextGeneratingVerb context, BuildObject input, bool buildSymDiffMutualSummary)\r\n : base(context, input)\r\n {\r\n this.buildSymDiffMutualSummary = buildSymDiffMutualSummary;\r\n this.enableSymdiff = BoogieAsmVerifyVerb.needs_symdiff(basmInput);\r\n }\r\n\r\n public static bool needs_symdiff(BuildObject basm)\r\n {\r\n AnnotationScanner annotations = new AnnotationScanner(basm);\r\n bool symdiff = false;\r\n foreach (string[] ann in annotations.getAnnotations(BasmEnableSymdiffAnnotation))\r\n {\r\n if (ann.Length != 2\r\n || !ann[1].Equals(\"true\"))\r\n {\r\n throw new SourceConfigurationError(\"Expected \" + BasmEnableSymdiffAnnotation + \" to have argument 'true'.\");\r\n }\r\n\r\n symdiff = true;\r\n }\r\n\r\n return symdiff;\r\n }\r\n\r\n public override BuildObject outputFile()\r\n {\r\n if (buildSymDiffMutualSummary)\r\n {\r\n // SymDiff files need to go into their own directory\r\n BuildObject normalName = BeatExtensions.makeOutputObject(basmInput, SYMDIFF_EXTN);\r\n dirName = normalName.getFileName() + SYMDIFF_DIR_EXTN;\r\n BuildObject dirExtendedName = new BuildObject(Path.Combine(normalName.getDirPath(), dirName, normalName.getFileName()));\r\n\r\n return dirExtendedName;\r\n }\r\n else\r\n {\r\n return BeatExtensions.makeOutputObject(basmInput, BoogieVerb.BPL_EXTN);\r\n }\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n // Hey BJP: why do we have BoogieAsmLink here offering boogie verbs? I guess because it's safe and hint-y?\r\n return getVerifyishVerbs();\r\n }\r\n\r\n public BuildObject getMutualSummary()\r\n {\r\n // SymDiff files need to go into their own directory.\r\n BuildObject normalName = BeatExtensions.makeOutputObject(basmInput, MUTUAL_SUMMARY_EXTN);\r\n BuildObject dirExtendedName = new BuildObject(Path.Combine(normalName.getDirPath(), dirName, normalName.getFileName()));\r\n return dirExtendedName;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n List outputs = new List { outputFile() };\r\n if (buildSymDiffMutualSummary)\r\n {\r\n outputs.Add(getMutualSummary());\r\n }\r\n\r\n return outputs;\r\n }\r\n\r\n protected override IEnumerable getExtraDeps(out DependencyDisposition ddisp)\r\n {\r\n try\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n return getTrustedBoogieAxioms();\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n // All the basms aren't here yet, so we can't scan them. Don't sweat it;\r\n // those deps are already being called for.\r\n ddisp = DependencyDisposition.Incomplete;\r\n return new BuildObject[] { };\r\n }\r\n catch (ObjectFailedException)\r\n {\r\n ddisp = DependencyDisposition.Failed;\r\n return new BuildObject[] { };\r\n }\r\n }\r\n\r\n protected override void extendArgs(List args)\r\n { \r\n if (!buildSymDiffMutualSummary && enableSymdiff)\r\n {\r\n args.Add(\"-symdiffok\");\r\n }\r\n else if (buildSymDiffMutualSummary)\r\n {\r\n args.Add(\"-symdiffms\");\r\n args.Add(getMutualSummary().getRelativePath());\r\n }\r\n\r\n ////foreach (SourcePath includedAxiom in getTrustedBoogieAxioms(acc.basmModules))\r\n foreach (SourcePath includedAxiom in getTrustedBoogieAxioms())\r\n {\r\n if (!includedAxiom.IsTrusted)\r\n {\r\n throw new SourceConfigurationError(AddBoogieAxiomAnnotation + \" annotation points at untrusted file \" + includedAxiom.ToString());\r\n }\r\n\r\n // SECURITY POLICY: you can only include trusted things labeled \"_axioms.bpl\".\r\n if (!includedAxiom.getExtension().Equals(BoogieVerb.BPL_EXTN)\r\n || !includedAxiom.getFileNameWithoutExtension().EndsWith(\"_axioms\"))\r\n {\r\n throw new SourceConfigurationError(AddBoogieAxiomAnnotation + \" annotation points at file that isn't a Boogie axioms file: \" + includedAxiom.ToString());\r\n }\r\n\r\n args.Add(\"/trustedBoogie:\" + includedAxiom.getRelativePath());\r\n }\r\n }\r\n\r\n protected override void postprocess(WorkingDirectory workingDirectory)\r\n {\r\n AnnotationScanner.transferAnnotations(workingDirectory, basmInput, outputFile(), BoogieVerb.CommentSymbol);\r\n }\r\n\r\n protected override int getVersion()\r\n {\r\n return 20;\r\n }\r\n\r\n protected override string getAction()\r\n {\r\n return \"-verify\";\r\n }\r\n\r\n protected override bool outFlagWorks()\r\n {\r\n return true;\r\n }\r\n\r\n protected override bool includeAllImps()\r\n {\r\n return false;\r\n }\r\n\r\n protected override string getExtraAbstractID()\r\n {\r\n return buildSymDiffMutualSummary ? \", relational\" : \", functional\";\r\n }\r\n\r\n private IEnumerable getTrustedBoogieAxioms()\r\n {\r\n OrderPreservingSet result = new OrderPreservingSet();\r\n AnnotationScanner anns = new AnnotationScanner(basmInput);\r\n foreach (string[] annotation in anns.getAnnotations(AddBoogieAxiomAnnotation))\r\n {\r\n string module = annotation[1];\r\n SourcePath trustedPath = new SourcePath(Path.Combine(\r\n BuildEngine.theEngine.getSrcRoot(),\r\n BuildEngine.VerveTrustedSpecDir,\r\n module + BoogieVerb.BPL_EXTN));\r\n result.Add(trustedPath);\r\n }\r\n\r\n return result;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BoogieAsmWorkerBase.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n\r\n internal abstract class BoogieAsmWorkerBase\r\n : BoogieAsmDepBase, IProcessInvokeAsyncVerb\r\n {\r\n public BoogieAsmWorkerBase(IContextGeneratingVerb context, BuildObject input)\r\n : base(context, input)\r\n {\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n List args = new List();\r\n //// args.add(BUILD_DEFS\r\n //// args.add(boogieasm_flags)\r\n args.Add(getAction());\r\n BuildObject captureStdout = null;\r\n if (outFlagWorks())\r\n {\r\n args.Add(\"-out\");\r\n args.Add(outputFile().getRelativePath());\r\n }\r\n else\r\n {\r\n captureStdout = outputFile();\r\n }\r\n\r\n BasmModuleAccumulator acc = new BasmModuleAccumulator(context, upstreamObj, includeAllImps());\r\n Util.Assert(acc.ddisp == DependencyDisposition.Complete);\r\n args.AddRange(acc.basmModules.Select(module => module.getRelativePath()));\r\n args.AddRange(context.getPoundDefines().ToDefArgs());\r\n extendArgs(args);\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n getBoogieasmExecutable().getRelativePath(),\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n getDiagnosticsBase(),\r\n captureStdout: captureStdout);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n postprocess(workingDirectory);\r\n return disposition;\r\n }\r\n\r\n protected abstract string getAction();\r\n\r\n protected abstract bool outFlagWorks(); // Weird that it works for -verify but not -link!\r\n\r\n protected virtual void extendArgs(List args)\r\n {\r\n }\r\n\r\n protected virtual void postprocess(WorkingDirectory workingDirectory)\r\n {\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BoogieVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\n using System.Linq;\r\n\r\n internal class BoogieVerb\r\n : VerificationResultVerb, IProcessInvokeAsyncVerb\r\n {\r\n public const string BPL_EXTN = \".bpl\";\r\n public const string CommentSymbol = \"//-\";\r\n\r\n private const int version = 17;\r\n private const string AddBoogieFlagAnnotation = \"AddBoogieFlag\";\r\n\r\n // SECURITY POLICY: we only allow checked files to specify the flags below.\r\n // Otherwise, one might thing it reasonable to specify \"/noVerify:1\" or something.\r\n private static readonly string[] validFlagsAnyValue = { \"/restartProver\", \"/timeLimit\", \"/trace\" };\r\n private static readonly string[] validFlagsSpecificValues = { \"/proverOpt:OPTIMIZE_FOR_BV=true\", \"/z3opt:NL_ARITH=false\" };\r\n private static SourcePath boogieExecutable;\r\n\r\n private BuildObject bplInput;\r\n private AbstractId abstractId;\r\n private IEnumerable upstreamVerbs;\r\n private int timeLimit = 3600;\r\n\r\n public BoogieVerb(IContextGeneratingVerb context, BuildObject bplInput, VerificationRequest.SymDiffMode symdiff)\r\n {\r\n if (bplInput.getExtension().Equals(BPL_EXTN))\r\n {\r\n this.bplInput = bplInput;\r\n upstreamVerbs = new List();\r\n // TODO this will probably break, since we don't know where this bplInput came from. Maybe that's okay, since the verb had to already exist to reach this point.\r\n }\r\n else if (symdiff == VerificationRequest.SymDiffMode.NoSymDiff)\r\n {\r\n IVerb boogieAsmVerb = new BoogieAsmVerifyVerb(context, bplInput, false);\r\n this.bplInput = boogieAsmVerb.getOutputs().First();\r\n upstreamVerbs = new IVerb[] { boogieAsmVerb };\r\n }\r\n else\r\n {\r\n IVerb workerVerb;\r\n SymDiffEngine.BuildPipeline(context, bplInput, out this.bplInput, out workerVerb);\r\n upstreamVerbs = new IVerb[] { workerVerb };\r\n }\r\n\r\n this.abstractId = new AbstractId(\r\n this.GetType().Name,\r\n version,\r\n bplInput.ToString(),\r\n concrete: symdiff.ToString());\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n List result = new List() { bplInput };\r\n result.Add(getBoogieExecutable());\r\n result.AddRange(getBoogieExecutableDependencies());\r\n return result;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return upstreamVerbs;\r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n return BeatExtensions.makeOutputObject(bplInput, BPL_EXTN + VerificationResultVerb.VERIFICATION_RESULT_EXTN);\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { getOutputFile() };\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return abstractId;\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n if (false)\r\n {\r\n#pragma warning disable 162\r\n File.WriteAllText(workingDirectory.PathTo(getOutputFile()), \"Verification disabled temporarily for debugging\");\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n#pragma warning restore 162\r\n }\r\n\r\n List args = new List();\r\n args.Add(\"/noinfer\");\r\n args.Add(\"/typeEncoding:m\");\r\n args.Add(\"/z3opt:ARITH_RANDOM_SEED=1\");\r\n args.Add(\"/timeLimit:\" + timeLimit);\r\n args.AddRange(getFlags());\r\n args.Add(bplInput.getRelativePath());\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n getBoogieExecutable().getRelativePath(),\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsOkay,\r\n getDiagnosticsBase(),\r\n allowCloudExecution: true,\r\n returnStandardOut: true,\r\n returnStandardError: true);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n VerificationResult vr = new VerificationResult(\r\n bplInput.getRelativePath(),\r\n cpuTimeSeconds,\r\n stdout,\r\n stderr,\r\n new VerificationResultBoogieParser());\r\n vr.addBasicPresentation();\r\n vr.toXmlFile(workingDirectory.PathTo(getOutputFile()));\r\n setWasRejectableFailure(vr.wasOnlyTimeouts());\r\n return disposition;\r\n }\r\n\r\n protected override BuildObject getSource()\r\n {\r\n return bplInput;\r\n }\r\n\r\n private static SourcePath getBoogieExecutable()\r\n {\r\n // TODO this should eventually be a BuildObject from *building* the executable.\r\n if (BoogieVerb.boogieExecutable == null)\r\n {\r\n BoogieVerb.boogieExecutable = new SourcePath(\"tools\\\\Dafny\\\\Boogie.exe\", SourcePath.SourceType.Tools);\r\n }\r\n\r\n return BoogieVerb.boogieExecutable;\r\n }\r\n\r\n private static IEnumerable getBoogieExecutableDependencies()\r\n {\r\n List exeDepends = new List();\r\n\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\AbsInt.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\BaseTypes.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\CodeContractsExtender.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Concurrency.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Core.dll\", SourcePath.SourceType.Tools)); \r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Doomed.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\ExecutionEngine.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Graph.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Model.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\msvcp100.dll\", SourcePath.SourceType.Tools)); // Needed by z3.\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\msvcr100.dll\", SourcePath.SourceType.Tools)); // Needed by z3.\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\ParserHelper.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Predication.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Provers.SMTLib.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\VCExpr.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\VCGeneration.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\vcomp100.dll\", SourcePath.SourceType.Tools)); // Needed by z3.\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\z3.exe\", SourcePath.SourceType.Tools));\r\n\r\n return exeDepends;\r\n }\r\n\r\n private IEnumerable getFlags()\r\n {\r\n List flags = new List();\r\n foreach (string[] ann in new AnnotationScanner(bplInput).getAnnotations(AddBoogieFlagAnnotation))\r\n {\r\n if (ann.Count() != 2)\r\n {\r\n throw new SourceConfigurationError(bplInput + \" has malformed annotation: \" + string.Join(\" \", ann));\r\n }\r\n\r\n string flag = ann[1];\r\n string[] flagParts = flag.Split(new char[] { ':' }, 2);\r\n if (validFlagsAnyValue.Contains(flagParts[0]))\r\n {\r\n flags.Add(flag);\r\n }\r\n else if (validFlagsSpecificValues.Contains(flag))\r\n {\r\n flags.Add(flag);\r\n }\r\n else\r\n {\r\n throw new SourceConfigurationError(bplInput + \" contains disallowed flag \" + flag);\r\n }\r\n\r\n if (flagParts[0].Equals(\"/timeLimit\"))\r\n {\r\n Util.Assert(flagParts.Count() == 2);\r\n timeLimit = Int32.Parse(flagParts[1]);\r\n }\r\n }\r\n\r\n return flags;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BootableAppVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n // Needs to:\r\n // 1) Build the bootloader into pxeloader\r\n // 2) Build two IroncladApps: Loader and specified app\r\n // Do this via a Batch\r\n // 3) Create a boot.ini\r\n\r\n internal class BootableAppVerb\r\n : Verb\r\n {\r\n ////public const string BOOT_EXTN = \".ini\";\r\n public const string LOADER_DFY = \"src\\\\Dafny\\\\Apps\\\\AppLoader\\\\Main.i.dfy\";\r\n private const int version = 4;\r\n\r\n private SourcePath dfyroot; // REVIEW: Never used?\r\n private AbstractId abstractId;\r\n private VerificationRequest verificationRequest;\r\n\r\n // Dependencies\r\n private BuildObject bootloader = new SourcePath(\"obj\\\\Checked\\\\BootLoader\\\\pxe-loader\", SourcePath.SourceType.PrebakedObjExpediency);\r\n\r\n // Outputs\r\n private BuildObject bootIniFile;\r\n private BuildObject loaderCopy;\r\n private BuildObject bootloaderCopy;\r\n private BuildObject appExecutableCopy;\r\n\r\n // Intermediate verbs\r\n private IroncladAppVerb loaderVerb;\r\n private IroncladAppVerb appVerb;\r\n private BatchVerifyVerb batchVerb;\r\n private VerificationResultSummaryVerb batchSummaryVerb;\r\n\r\n public BootableAppVerb(SourcePath dfyroot, DafnyCCVerb.FramePointerMode useFramePointer, VerificationRequest verificationRequest)\r\n {\r\n this.dfyroot = dfyroot;\r\n this.verificationRequest = verificationRequest;\r\n string concreteId = verificationRequest.ToString() + \",\" + useFramePointer.ToString();\r\n this.abstractId = new AbstractId(this.GetType().Name, version, dfyroot.ToString(), concrete: concreteId);\r\n\r\n string targetDirectory = Path.Combine(\r\n BuildEngine.theEngine.getObjRoot(),\r\n dfyroot.getDirPath(),\r\n \"bootable-\" + verificationRequest.ToString());\r\n this.bootIniFile = new BuildObject(Path.Combine(targetDirectory, \"safeos\\\\boot.ini\"));\r\n\r\n // TODO: Create the bootloader verb.\r\n\r\n this.loaderVerb = new IroncladAppVerb(new SourcePath(LOADER_DFY), IroncladAppVerb.TARGET.BARE_METAL, useFramePointer, verificationRequest);\r\n this.appVerb = new IroncladAppVerb(dfyroot, IroncladAppVerb.TARGET.BARE_METAL, useFramePointer, verificationRequest);\r\n\r\n this.batchVerb = new BatchVerifyVerb(dfyroot, new HashSet() { this.appVerb, this.loaderVerb }, BatchVerifyVerb.BatchMode.APP);\r\n this.batchSummaryVerb = new VerificationResultSummaryVerb(this.batchVerb);\r\n\r\n this.loaderCopy = new BuildObject(Path.Combine(targetDirectory, this.targetExecutableName(this.loaderVerb)));\r\n this.bootloaderCopy = new BuildObject(Path.Combine(targetDirectory, this.bootloader.getFileName()));\r\n this.appExecutableCopy = new BuildObject(Path.Combine(targetDirectory, this.targetExecutableName(this.appVerb)));\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n List result = new List();\r\n result.Add(this.bootloader); // TODO: Replace with the bootloader verbs's output.\r\n result.Add(this.loaderVerb.getExe());\r\n result.Add(this.appVerb.getExe());\r\n\r\n result.AddRange(this.batchSummaryVerb.getOutputs());\r\n\r\n ddisp = DependencyDisposition.Complete;\r\n return result;\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n if (this.verificationRequest.isComplete())\r\n {\r\n VerificationResult vr = VerificationResult.fromXmlFile(this.batchSummaryVerb.getOutputFile());\r\n\r\n if (!vr.pass)\r\n {\r\n Util.Assert(false); // Should never get here, since Ironclad app should fail before producing a verified exe.\r\n return new VerbSyncWorker(workingDirectory, new Failed());\r\n }\r\n }\r\n\r\n // Copy the AppLoader binary and the bootloader into the same directory as the app's binary, so the pxe-loader can find them.\r\n // REVIEW: Not clear this is doing the right thing with shift to WorkingDirectory.\r\n File.Copy(workingDirectory.PathTo(this.loaderVerb.getExe()), workingDirectory.PathTo(this.loaderCopy), true);\r\n File.Copy(workingDirectory.PathTo(this.appVerb.getExe()), workingDirectory.PathTo(this.appExecutableCopy), true);\r\n File.Copy(workingDirectory.PathTo(this.bootloader), workingDirectory.PathTo(this.bootloaderCopy), true);\r\n\r\n this.writeBootFile(workingDirectory);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n List result = new List();\r\n ////result.Add(bootloaderVerb); // TODO when we're building the bootloader as part of NuBuild.\r\n result.Add(this.batchSummaryVerb);\r\n result.Add(this.appVerb);\r\n result.Add(this.loaderVerb);\r\n\r\n return result;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { this.bootIniFile, this.loaderCopy, this.bootloaderCopy, this.appExecutableCopy };\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override Presentation getPresentation()\r\n {\r\n return this.batchSummaryVerb.getPresentation();\r\n }\r\n\r\n private string targetExecutableName(IroncladAppVerb fromVerb)\r\n {\r\n // It's okay that we're saving an unverified binary to a .exe extension, because it's\r\n // getting placed inside targetDirectory, which is labeled \"bootable-unverified.\"\r\n return fromVerb.getAppLabel() + IroncladAppVerb.TRUSTED_EXE_EXTN;\r\n }\r\n\r\n // TODO: Rename obj to something meaningful. Is it a boot file?\r\n private string mkBootFileEntry(WorkingDirectory workingDirectory, BuildObject obj)\r\n {\r\n return string.Format(\"Size={0} Path=/{1}\", new FileInfo(workingDirectory.PathTo(obj)).Length, obj.getFileName());\r\n }\r\n\r\n private void writeBootFile(WorkingDirectory workingDirectory)\r\n {\r\n List lines = new List();\r\n\r\n lines.Add(this.mkBootFileEntry(workingDirectory, this.loaderCopy));\r\n lines.Add(this.mkBootFileEntry(workingDirectory, this.appExecutableCopy));\r\n\r\n File.WriteAllLines(workingDirectory.PathTo(this.bootIniFile), lines);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BuildEngine.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.IO;\r\n\r\n internal class BuildEngine\r\n {\r\n public const string VerveTrustedSpecDir = \"Trusted\\\\Spec\";\r\n\r\n private static BuildEngine _theEngine = new BuildEngine();\r\n\r\n private PathNormalizer pathNormalizer;\r\n private SourcePathIncludeContext vervePathContext;\r\n private string ironRoot;\r\n private Hasher hasher;\r\n private Repository repository;\r\n private CloudExecutionQueue cloudExecutionQueue;\r\n private string cloudReportQueueName;\r\n private ItemCacheCloud cloudItemCache;\r\n private IItemCache itemCache;\r\n private string localCacheLocation = \"nucache\";\r\n\r\n public BuildEngine()\r\n {\r\n this.pathNormalizer = new PathNormalizer();\r\n this.hasher = new Hasher();\r\n }\r\n\r\n public static BuildEngine theEngine\r\n {\r\n get { return _theEngine; }\r\n }\r\n\r\n internal Repository Repository\r\n {\r\n get { return this.repository; }\r\n set { this.repository = value; }\r\n }\r\n\r\n internal CloudExecutionQueue CloudExecutionQueue\r\n {\r\n get { return this.cloudExecutionQueue; }\r\n set { this.cloudExecutionQueue = value; }\r\n }\r\n\r\n internal string CloudReportQueueName\r\n {\r\n get { return this.cloudReportQueueName; }\r\n set { this.cloudReportQueueName = value; }\r\n }\r\n\r\n internal ItemCacheCloud CloudCache\r\n {\r\n get { return this.cloudItemCache; }\r\n set { this.cloudItemCache = value; }\r\n }\r\n\r\n internal IItemCache ItemCache\r\n {\r\n get { return this.itemCache; }\r\n set { this.itemCache = value; }\r\n }\r\n\r\n public SourcePathIncludeContext getVervePathContext()\r\n {\r\n if (this.vervePathContext == null)\r\n {\r\n Util.Assert(this.ironRoot != null);\r\n this.vervePathContext = new SourcePathIncludeContext();\r\n this.vervePathContext.addDirectory(VerveTrustedSpecDir);\r\n this.vervePathContext.addDirectory(\"Checked\\\\Nucleus\\\\Base\");\r\n this.vervePathContext.addDirectory(\"Checked\\\\Nucleus\\\\GC\");\r\n this.vervePathContext.addDirectory(\"Checked\\\\Nucleus\\\\Devices\");\r\n this.vervePathContext.addDirectory(\"Checked\\\\Nucleus\\\\Main\");\r\n\r\n this.vervePathContext.addDstExtension(BeatExtensions.BEATIFC_EXTN);\r\n this.vervePathContext.addDstExtension(BeatExtensions.BEATIMP_EXTN);\r\n this.vervePathContext.addDstExtension(BoogieAsmVerifyVerb.BASMIFC_EXTN);\r\n this.vervePathContext.addDstExtension(BoogieAsmVerifyVerb.BASMIMP_EXTN);\r\n }\r\n\r\n return this.vervePathContext;\r\n }\r\n\r\n public IContextGeneratingVerb getVerveContextVerb(PoundDefines poundDefines)\r\n {\r\n return new StaticContextVerb(this.getVervePathContext(), \"Verve\", poundDefines);\r\n }\r\n\r\n ////public TransitiveIncludesCache getDafnyIncludeCache()\r\n ////{\r\n //// return dafnyIncludeCache;\r\n ////}\r\n\r\n ////public TransitiveIncludesCache getBeatIncludeCache(IIncludePathContext context)\r\n ////{\r\n //// if (!contextToCache.ContainsKey(context))\r\n //// {\r\n //// contextToCache[context] = new TransitiveIncludesCache(new BeatIncludes(context));\r\n //// }\r\n //// return contextToCache[context];\r\n ////}\r\n\r\n public string getIronRoot()\r\n {\r\n return this.ironRoot;\r\n }\r\n\r\n internal void setIronRoot(string ironRoot)\r\n {\r\n this.ironRoot = this.pathNormalizer.normalizeAbsolutePath(ironRoot);\r\n }\r\n\r\n // Normalize the case of an ironRoot-relative path to the case present in the filesystem.\r\n internal string normalizeIronPath(string ironRelPath)\r\n {\r\n string abspath = this.pathNormalizer.normalizeAbsolutePath(Path.GetFullPath(Path.Combine(this.ironRoot, ironRelPath)));\r\n Util.Assert(abspath.StartsWith(this.ironRoot));\r\n return abspath.Substring(this.ironRoot.Length);\r\n }\r\n\r\n internal string getObjRoot()\r\n {\r\n return \"nuobj\";\r\n }\r\n\r\n internal string getSrcRoot()\r\n {\r\n return \"src\";\r\n }\r\n\r\n internal string getVirtualRoot()\r\n {\r\n return this.getObjRoot() + \"\\\\virtual\"; // Should never exist in filesystem!\r\n }\r\n\r\n internal string getToolsRoot()\r\n {\r\n return \"tools\";\r\n }\r\n\r\n internal string getBinToolsRoot()\r\n {\r\n return \"bin_tools\";\r\n }\r\n\r\n internal void setLocalCache(string path)\r\n {\r\n this.localCacheLocation = path;\r\n }\r\n\r\n internal string getLocalCache()\r\n {\r\n return this.localCacheLocation;\r\n }\r\n\r\n internal IHasher getHasher()\r\n {\r\n return this.hasher;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BuildObject.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Xml;\r\n\r\n /// \r\n /// An abstract identifier for \"nouns\" (i.e. the things that verbs operate\r\n /// on -- both verb outputs and dependencies are BuildObjects).\r\n /// \r\n /// \r\n /// Note that sometimes the code and/or comments about the code refer to\r\n /// BuildObjects as if they are the concrete thing that they identify as\r\n /// opposed to just being the abstract identifier for that thing. This is\r\n /// probably okay, as there should be just one concrete instance of any\r\n /// particular abstract build object during a given run of the system.\r\n /// \r\n public class BuildObject\r\n {\r\n /// \r\n /// The XML element name for this object.\r\n /// \r\n public const string XmlTag = \"BuildObject\";\r\n\r\n /// \r\n /// Path to this object as stored in the local filesystem, relative to\r\n /// the IronRoot (i.e. begins with \"src\", \"obj\", etc.).\r\n /// \r\n /// \r\n /// This string is expected to be normalized to have consistent casing.\r\n /// \r\n protected string path;\r\n\r\n /// \r\n /// Whether this object is considered \"trusted\" for verification\r\n /// purposes.\r\n /// \r\n private bool isTrusted;\r\n\r\n /// \r\n /// The filename of this object, without the file extension.\r\n /// \r\n private string filenameWithoutExtension;\r\n\r\n /// \r\n /// The filename extension for this object.\r\n /// \r\n private string filenameExtension;\r\n\r\n /// \r\n /// Initializes a new instance of the BuildObject class.\r\n /// \r\n /// \r\n /// Relative path to this object in the local filesystem.\r\n /// \r\n /// \r\n /// Whether this object is considered \"trusted\" for verification\r\n /// purposes.\r\n /// \r\n public BuildObject(string path, bool isTrusted = false)\r\n {\r\n // ToDo: Fix VSSolutionVerb and/or IronfleetTestDriver.sln to work in \"src\" tree without hitting below Assert. Then re-instate below Assert.\r\n ////Util.Assert(!path.StartsWith(BuildEngine.theEngine.getSrcRoot(), StringComparison.OrdinalIgnoreCase));\r\n this.path = BuildEngine.theEngine.normalizeIronPath(path);\r\n this.isTrusted = isTrusted;\r\n }\r\n\r\n /// \r\n /// Initializes a new instance of the BuildObject class.\r\n /// \r\n /// \r\n /// Relative path to this object in the local filesystem.\r\n /// \r\n protected BuildObject(string path)\r\n {\r\n this.path = BuildEngine.theEngine.normalizeIronPath(path);\r\n }\r\n\r\n /// \r\n /// Gets or sets a value indicating whether this object is considered\r\n /// \"trusted\" for verification purposes.\r\n /// \r\n /// \r\n /// REVIEW: Giving build objects properties like this is dangerous,\r\n /// as they are supposed to be just abstract ids. Two equivalent\r\n /// (per Equals() below) build objects could be created, and should\r\n /// reference the same bag of bits, yet have different properties!\r\n /// \r\n public bool IsTrusted\r\n {\r\n get { return this.isTrusted; }\r\n protected set { this.isTrusted = value; }\r\n }\r\n\r\n /// \r\n /// Gets the relative path for this instance.\r\n /// \r\n /// \r\n /// TODO: Replace this with a property (\"RelativePath\"?) that is\r\n /// public get and protected set. And change this.path from\r\n /// protected to private.\r\n /// \r\n /// The relative path for this instance.\r\n public string getRelativePath()\r\n {\r\n return this.path;\r\n }\r\n\r\n /// \r\n /// Returns a string that represents this instance.\r\n /// \r\n /// A string that represents this instance.\r\n public override string ToString()\r\n {\r\n return this.path;\r\n }\r\n\r\n /// \r\n /// Gets the directory information for this instance.\r\n /// \r\n /// The directory information for this instance.\r\n public string getDirPath()\r\n {\r\n return Path.GetDirectoryName(this.path);\r\n }\r\n\r\n /// \r\n /// Gets the file name and extension for this instance.\r\n /// \r\n /// The file name and extension for this instance.\r\n public string getFileName()\r\n {\r\n return Path.GetFileName(this.path);\r\n }\r\n\r\n /// \r\n /// Gets the file name (sans extension) for this instance.\r\n /// \r\n /// The file name (sans extension) for this instance.\r\n public string getFileNameWithoutExtension()\r\n {\r\n this.splitExtension();\r\n return this.filenameWithoutExtension;\r\n }\r\n\r\n /// \r\n /// Gets the file extension for this instance.\r\n /// \r\n /// The file extension for this instance.\r\n public string getExtension()\r\n {\r\n this.splitExtension();\r\n return this.filenameExtension;\r\n }\r\n\r\n /// \r\n /// Determines whether this instance and another specified BuildObject\r\n /// object have the same value (identity?). Really, the same path.\r\n /// \r\n /// The object to compare to this instance.\r\n /// \r\n /// True if the given object is equivalent to this instance,\r\n /// false otherwise.\r\n /// \r\n public override bool Equals(object obj)\r\n {\r\n BuildObject other = obj as BuildObject;\r\n if (other != null)\r\n {\r\n return this.path.Equals(other.path, StringComparison.Ordinal);\r\n }\r\n else\r\n {\r\n return false;\r\n }\r\n }\r\n\r\n /// \r\n /// Returns the hash code for this instance.\r\n /// \r\n /// \r\n /// Note that equivalent (as in .Equals returns true) instances\r\n /// will have the same hash code.\r\n /// \r\n /// The hash code for this instance.\r\n public override int GetHashCode()\r\n {\r\n return this.path.GetHashCode();\r\n }\r\n\r\n /// \r\n /// Creates a new instance based on this one, but with the given\r\n /// extension, and guaranteed to be in the obj directory.\r\n /// \r\n /// Extension to give new instance.\r\n /// A new instance.\r\n public BuildObject makeOutputObject(string extension)\r\n {\r\n return new BuildObject(this.mashedPathname(BuildEngine.theEngine.getObjRoot(), extension));\r\n }\r\n\r\n /// \r\n /// Creates a new instance based on this one, but for the given\r\n /// appLabel (REVIEW: what does this mean?), with the given\r\n /// extension, and guaranteed to be in the obj directory.\r\n /// \r\n /// The app label to use.\r\n /// Extension to give new instance.\r\n /// A new instance.\r\n public BuildObject makeLabeledOutputObject(string appLabel, string extension)\r\n {\r\n string appSpecificPrefix =\r\n appLabel == null\r\n ? BuildEngine.theEngine.getObjRoot()\r\n : Path.Combine(BuildEngine.theEngine.getObjRoot(), appLabel);\r\n\r\n // REVIEW: Ordinal vs. OrdinalIgnoreCase.\r\n if (this.path.StartsWith(appSpecificPrefix, StringComparison.OrdinalIgnoreCase))\r\n {\r\n // Input is already in the correct subtree; don't nest subtrees.\r\n return this.makeOutputObject(extension);\r\n }\r\n else\r\n {\r\n // Input is coming from elsewhere; give it a parallel location under app-specific subtree.\r\n return new BuildObject(this.mashedPathname(appSpecificPrefix, extension));\r\n }\r\n }\r\n\r\n /// \r\n /// Creates a new VirtualBuildObject based on this instance, but with\r\n /// a path modified to be virtual and have the given extension.\r\n /// \r\n /// \r\n /// Filename extension to give the new object.\r\n /// \r\n /// A new VirtualBuildObject.\r\n public BuildObject makeVirtualObject(string extension)\r\n {\r\n return new VirtualBuildObject(this.mashedPathname(BuildEngine.theEngine.getVirtualRoot(), extension));\r\n }\r\n\r\n /// \r\n /// Helper function to read an XML element (not a full document)\r\n /// representing a BuildObject.\r\n /// \r\n /// \r\n /// Note that the XmlReader is expected to be positioned in the XML\r\n /// document such that the current node is a BuildObject element.\r\n /// \r\n /// The XmlReader object to read from.\r\n /// \r\n /// A new BuildObject corresponding to the XML representation read.\r\n /// \r\n public static BuildObject ReadXml(XmlReader xr)\r\n {\r\n Util.Assert(xr.Name.Equals(XmlTag));\r\n string relativePath = xr.ReadElementContentAsString();\r\n return new BuildObject(relativePath);\r\n }\r\n\r\n /// \r\n /// Helper function to write an XML element (not a full document)\r\n /// representing this BuildObject.\r\n /// \r\n /// The XmlWriter object to write to.\r\n public void WriteXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(XmlTag);\r\n xw.WriteString(this.path);\r\n xw.WriteEndElement();\r\n }\r\n\r\n /// \r\n /// Splits the filename of this object into its separate base and\r\n /// extension components.\r\n /// \r\n private void splitExtension()\r\n {\r\n if (this.filenameWithoutExtension == null)\r\n {\r\n string filename = this.getFileName();\r\n int dot = filename.IndexOf('.');\r\n if (dot < 0)\r\n {\r\n this.filenameWithoutExtension = filename;\r\n this.filenameExtension = null;\r\n }\r\n else\r\n {\r\n this.filenameExtension = filename.Substring(dot);\r\n\r\n // TODO: This is a (possibly brittle) workaround for dfy .s\r\n // and .i, which aren't part of the file type, they're part\r\n // of the name. Sorta.\r\n if (DafnyTransformBaseVerb.DAFNY_LONG_EXTNS.Contains(this.filenameExtension))\r\n {\r\n dot += 2;\r\n this.filenameExtension = filename.Substring(dot);\r\n }\r\n\r\n this.filenameWithoutExtension = filename.Substring(0, dot);\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Combines the provided root path and extension with this\r\n /// instance's relative path and munged (for DafnySpec/CC) filename.\r\n /// \r\n /// The desired root path.\r\n /// The desired extension.\r\n /// A combined pathname.\r\n private string mashedPathname(string root, string extension)\r\n {\r\n string filename = this.getFileNameWithoutExtension();\r\n\r\n // Remap dafny filenames so resulting objects have correctly-parsed extns.\r\n filename = Util.dafnySpecMungeName(filename);\r\n\r\n return Path.Combine(root, this.getDirRelativeToSrcOrObj(), filename + extension);\r\n }\r\n\r\n /// \r\n /// Strips off the initial 'src\\' or 'obj\\' from the path.\r\n /// \r\n /// \r\n /// The directory containing this object, relative to the source or\r\n /// object directory.\r\n /// \r\n private string getDirRelativeToSrcOrObj()\r\n {\r\n string dirname = this.getDirPath();\r\n int slash = dirname.IndexOf('\\\\');\r\n Util.Assert(slash >= 0);\r\n return dirname.Substring(slash + 1);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/BuildObjectValuePointer.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Xml;\r\n\r\n /// \r\n /// Mapping between a BuildObject (an abstract identifier) and the hash\r\n /// value of the build object's contents (concrete identifier) for this run.\r\n /// REVIEW: Come up with a better name for this?\r\n /// \r\n public class BuildObjectValuePointer\r\n {\r\n /// \r\n /// The XML element name for this object.\r\n /// \r\n public const string XmlTag = \"BuildObjectValuePointer\";\r\n\r\n /// \r\n /// The XML attribute name for the ObjectHash value.\r\n /// \r\n private const string XmlObjectHashAttribute = \"ObjectHash\";\r\n\r\n /// \r\n /// The XML attribute name for the RelativePath value.\r\n /// \r\n private const string XmlRelativePathAttribute = \"RelativePath\";\r\n\r\n /// \r\n /// Hash of the contents referenced by the build object.\r\n /// \r\n private string objectHash;\r\n\r\n /// \r\n /// Path to the build object, relative to the IronRoot.\r\n /// \r\n private string relativePath;\r\n\r\n /// \r\n /// Initializes a new instance of the BuildObjectValuePointer class.\r\n /// \r\n /// \r\n /// Hash of the contents referenced by the build object.\r\n /// \r\n /// \r\n /// Path to the build object, relative to the IronRoot.\r\n /// \r\n public BuildObjectValuePointer(string objectHash, string relativePath)\r\n {\r\n this.objectHash = objectHash;\r\n this.relativePath = relativePath;\r\n }\r\n\r\n /// \r\n /// Gets the hash of the contents referenced by the build object.\r\n /// \r\n public string ObjectHash\r\n {\r\n get { return this.objectHash; }\r\n }\r\n\r\n /// \r\n /// Gets the path to the build object, relative to the IronRoot.\r\n /// \r\n public string RelativePath\r\n {\r\n get { return this.relativePath; } \r\n }\r\n\r\n /// \r\n /// Helper function to read an XML element (not a full document)\r\n /// representing a BuildObjectValuePointer.\r\n /// \r\n /// \r\n /// Note that the XmlReader is expected to be positioned in the XML\r\n /// document such that the current node is a BuildObjectValuePointer\r\n /// element.\r\n /// \r\n /// The XmlReader object to read from.\r\n /// \r\n /// A new BuildObjectValuePointer corresponding to the XML\r\n /// representation read.\r\n /// \r\n public static BuildObjectValuePointer ReadXml(XmlReader xr)\r\n {\r\n Util.Assert(xr.Name.Equals(XmlTag));\r\n string objectHash = xr.GetAttribute(XmlObjectHashAttribute);\r\n string relativePath = xr.GetAttribute(XmlRelativePathAttribute);\r\n return new BuildObjectValuePointer(objectHash, relativePath);\r\n }\r\n\r\n /// \r\n /// Helper function to write an XML element (not a full document)\r\n /// representing this BuildObjectValuePointer.\r\n /// \r\n /// The XmlWriter object to write to.\r\n public void WriteXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(XmlTag);\r\n xw.WriteAttributeString(XmlObjectHashAttribute, this.objectHash);\r\n xw.WriteAttributeString(XmlRelativePathAttribute, this.relativePath);\r\n xw.WriteEndElement();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/CachedHash.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class CachedHash\r\n {\r\n private Dictionary hashCache;\r\n private HashFunc hashFunc;\r\n private FailureBehavior failureBehavior;\r\n private CachabilityTestFunc cachabilityTest;\r\n\r\n public CachedHash(\r\n HashFunc hashFunc,\r\n FailureBehavior failureBehavior = FailureBehavior.AssertFailures,\r\n CachabilityTestFunc cachabilityTest = null)\r\n {\r\n this.hashCache = new Dictionary();\r\n this.hashFunc = hashFunc;\r\n this.failureBehavior = failureBehavior;\r\n this.cachabilityTest = cachabilityTest;\r\n }\r\n\r\n public delegate ValueType HashFunc(HashedObjectType hashObj);\r\n\r\n public delegate bool CachabilityTestFunc(ValueType value);\r\n\r\n public enum FailureBehavior\r\n {\r\n IgnoreFailures,\r\n AssertFailures\r\n }\r\n\r\n public ValueType get(HashedObjectType hashObj)\r\n {\r\n if (!this.hashCache.ContainsKey(hashObj))\r\n {\r\n ValueType value = this.hashFunc(hashObj);\r\n if (value == null)\r\n {\r\n Util.Assert(this.failureBehavior == FailureBehavior.IgnoreFailures);\r\n return value;\r\n }\r\n else if (this.cachabilityTest != null && !this.cachabilityTest(value))\r\n {\r\n return value;\r\n }\r\n else\r\n {\r\n this.hashCache[hashObj] = value;\r\n }\r\n }\r\n\r\n return this.hashCache[hashObj];\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/CloudExecutionQueue.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n using System;\n using System.Collections.Generic;\n using System.Configuration;\n using System.IO;\n using System.Threading;\n using Microsoft.WindowsAzure.Storage;\n using Microsoft.WindowsAzure.Storage.Queue;\n\n /// \n /// Represents the queue used to make requests of cloud execution engines.\n /// \n public class CloudExecutionQueue\n {\n // Note that queue names must be all lowercase.\n // See http://msdn.microsoft.com/en-us/library/dd179349.aspx.\n\n /// \n /// Maximum interval to wait between polls of the request queue.\n /// In milliseconds.\n /// \n /// \n /// REVIEW: Is 30 seconds a reasonable cap?\n /// \n private const int RequestQueuePollIntervalCap = 30000;\n\n /// \n /// Name of the request queue.\n /// \n private const string RequestQueueName = \"requests\";\n\n /// \n /// Name of the default report queue.\r\n /// \n private const string ReportQueueName = \"reports\";\n\n /// \n /// Expiration time for request/report queue entries.\r\n /// Most queue entries should be picked up almost immediately,\r\n /// this is to prevent orphaned entries from hanging around \"forever\".\r\n /// \r\n private readonly TimeSpan queueEntryTtl;\r\n\r\n /// \r\n /// Azure storage account we're using.\n /// \n private CloudStorageAccount storageAccount;\n\n /// \n /// Cloud queue client for working with cloud queues.\n /// \n private CloudQueueClient queueClient;\n\n /// \n /// Queue to hold execution requests.\n /// \n private CloudQueue requestQueue;\n\n /// \n /// Queue to hold execution reports.\n /// \n private CloudQueue clientReportQueue;\r\n\r\n /// \r\n /// Cache of current request's report queue.\r\n /// \r\n private CloudQueue cachedServerReportQueue;\r\n\r\n /// \r\n /// Name of the cached report queue.\r\n /// \r\n private string cachedServerReportQueueName;\r\n\n /// \n /// Waiters for execution reports.\n /// \n private Dictionary reportWaiters;\n\n /// \n /// Lock for the reportWaiters dictionary.\n /// \n private Mutex reportWaitersLock;\n\n /// \n /// Event that is signaled (i.e. set) if we have active waiters for execution reports.\r\n /// \r\n private ManualResetEvent haveReportWaiters;\r\n\r\n /// \r\n /// Thread that monitors the report queue.\n /// \n private Thread monitoringThread;\n\n /// \n /// Initializes a new instance of the CloudExecutionQueue class.\n /// \n /// \r\n /// This is the constructor for servers.\r\n /// \r\n public CloudExecutionQueue()\r\n {\n // Work-around for running this code in CloudExecutionEngine. TODO: Clean this up!\n // The BuildEngine.theEngine.getIronRoot() call needs to work for BuildObject code to function properly.\n if (BuildEngine.theEngine.getIronRoot() == null)\n {\n BuildEngine.theEngine.setIronRoot(Directory.GetCurrentDirectory());\n }\n\n this.queueEntryTtl = new TimeSpan(0, 30, 0); // 30 minutes.\r\n\r\n // Create our CloudStorageAccount object.\r\n // REVIEW: Hard-coded connection string index \"Ironclad\".\r\n string connectionString = null;\r\n ConnectionStringSettings settings = ConfigurationManager.ConnectionStrings[\"Ironclad\"];\r\n if (settings != null)\r\n {\r\n connectionString = settings.ConnectionString;\r\n }\r\n\r\n if (string.IsNullOrEmpty(connectionString))\r\n {\r\n throw new ConfigurationException(\"Azure connection string missing from your NuBuild.exe.config file!\");\r\n }\r\n\r\n this.storageAccount = CloudStorageAccount.Parse(connectionString);\r\n\n this.queueClient = this.storageAccount.CreateCloudQueueClient();\n\n this.requestQueue = this.queueClient.GetQueueReference(CloudExecutionQueue.RequestQueueName);\n this.requestQueue.CreateIfNotExists();\n }\r\n\n /// \r\n /// Initializes a new instance of the CloudExecutionQueue class.\r\n /// \r\n /// \r\n /// This is the constructor for clients (does extra stuff).\r\n /// \r\n /// Name of the report queue this client is using.\r\n public CloudExecutionQueue(string reportQueueName)\r\n : this()\r\n {\r\n if (string.IsNullOrEmpty(reportQueueName))\r\n {\r\n // Use default shared report queue if none is specified.\r\n reportQueueName = CloudExecutionQueue.ReportQueueName;\r\n }\r\n else\r\n {\n // Schedule auto-deletion of our private report queue.\r\n // We do this by setting the initial invisibility of a delete queue request.\r\n // This will auto-clean up our private report queue if we exit unexpectedly.\r\n CloudExecutionRequest deleteQueueRequest = new CloudExecutionRequest(\r\n reportQueueName,\r\n reportQueueName,\r\n CloudExecutionRequest.Operation.DeleteQueue,\r\n null,\r\n null,\r\n null,\r\n null\r\n );\r\n CloudQueueMessage deleteQueueMessage = new CloudQueueMessage(deleteQueueRequest.ToXml());\r\n this.requestQueue.AddMessage(deleteQueueMessage, new TimeSpan(12, 0, 0), new TimeSpan(4, 0, 0));\r\n }\r\n\r\n this.clientReportQueue = this.queueClient.GetQueueReference(reportQueueName);\r\n this.clientReportQueue.CreateIfNotExists();\r\n\r\n this.reportWaiters = new Dictionary();\n this.reportWaitersLock = new Mutex();\n this.haveReportWaiters = new ManualResetEvent(false);\r\n\n this.monitoringThread = new Thread(new ThreadStart(this.MonitorReportQueue));\n this.monitoringThread.IsBackground = true;\n this.monitoringThread.Name = \"Report Queue Monitor\";\r\n this.monitoringThread.Start();\r\n }\n\r\n /// \r\n /// Deletes the specified queue.\r\n /// \r\n /// Name of the queue to delete.\r\n public void DeleteQueue(string queueName)\r\n {\r\n CloudQueue goner = this.queueClient.GetQueueReference(queueName);\r\n goner.DeleteIfExists();\r\n }\n\n /// \n /// Submits a request for cloud execution.\n /// \n /// \n /// The CloudExecutionRequest detailing this request.\n /// \n public void SubmitRequest(CloudExecutionRequest request)\n {\n CloudQueueMessage message = new CloudQueueMessage(request.ToXml());\n this.requestQueue.AddMessage(message, this.queueEntryTtl);\r\n }\n\n /// \n /// Gets the next request from the request queue.\n /// \n /// Whether to block.\n /// Next request on the queue.\n public CloudExecutionRequest GetRequest(bool block = false)\n {\n int pollInterval = 1000; // In milliseconds.\n\n CloudQueueMessage message = null;\n while ((message = this.requestQueue.GetMessage()) == null)\n {\n if (block)\n {\n Thread.Sleep(pollInterval);\n\n // Increase poll interval if we're below the cap.\n if (pollInterval < RequestQueuePollIntervalCap)\n {\n // Increase by 1/10th of a second each time.\n // This will take 14.5s to reach a 2s interval.\n pollInterval += 100;\n }\n\n continue;\n }\n else\n {\n return null;\n }\n }\n\n ////Console.WriteLine(message.AsString);\n\n CloudExecutionRequest request = CloudExecutionRequest.FromMessage(message);\n\n return request;\n }\n\n /// \n /// Deletes a request from the queue.\n /// Used by reader to indicate request completion.\n /// \n /// Request to delete.\n public void DeleteRequest(CloudExecutionRequest request)\n {\n CloudQueueMessage message = request.Message;\n this.requestQueue.DeleteMessage(message);\n }\n\n /// \n /// Submits a report of cloud execution for processing by the submitter.\n /// \n /// Report to submit.\r\n /// Name of the report queue to submit to.\r\n public void SubmitReport(CloudExecutionReport report, string reportQueueName)\r\n {\r\n // Check to see if we need to update the cached report queue.\r\n if (reportQueueName != this.cachedServerReportQueueName)\r\n {\r\n this.cachedServerReportQueue = this.queueClient.GetQueueReference(reportQueueName);\r\n this.cachedServerReportQueue.CreateIfNotExists();\r\n this.cachedServerReportQueueName = reportQueueName;\r\n }\r\n\r\n CloudQueueMessage message = new CloudQueueMessage(report.ToXml());\n this.cachedServerReportQueue.AddMessage(message, this.queueEntryTtl);\r\n }\n\n /// \n /// Gets the requested execution report off of the queue.\n /// \n /// Report to retrieve.\n /// Count of remaining waiters after our report arrives.\r\n /// The execution report in question.\n public CloudExecutionReport GetReport(string reportIdentifier, out int numberOfOtherWaiters)\r\n {\n CloudExecutionWaiter waiter = new CloudExecutionWaiter();\n\n // Add the desired report to the dictionary under lock.\n this.reportWaitersLock.WaitOne();\n this.reportWaiters.Add(reportIdentifier, waiter);\n this.haveReportWaiters.Set();\r\n this.reportWaitersLock.ReleaseMutex();\n\n // Wait for report to arrive, and then return it.\n return waiter.WaitForReport(out numberOfOtherWaiters);\r\n }\n\n /// \n /// Procedure performed by the report queue monitoring thread.\n /// \n private void MonitorReportQueue()\n {\n const int MaxBatchSize = 32; // Maximum allowed by API.\r\n TimeSpan invisibleTime = new TimeSpan(0, 0, 2); // Two seconds.\r\n TimeSpan pollInterval = new TimeSpan(0, 0, 1); // One second.\r\n\r\n List messages;\r\n bool anyForUs;\r\n\n while (true)\n {\n // Don't bother doing anything if we don't have any active waiters.\r\n this.haveReportWaiters.WaitOne();\r\n\n // Get a new batch of messages.\r\n // No other queue readers will see these until the invisibleTime expires.\r\n messages = new List(this.clientReportQueue.GetMessages(MaxBatchSize, invisibleTime));\r\n anyForUs = false;\r\n\n foreach (CloudQueueMessage message in messages)\r\n {\r\n CloudExecutionReport report = CloudExecutionReport.FromMessage(message);\n\n // Lookup the waiter for this report under lock.\n CloudExecutionWaiter waiter;\n int remainingWaitersCount = 0;\r\n this.reportWaitersLock.WaitOne();\n bool foundWaiter = this.reportWaiters.TryGetValue(report.Identifier, out waiter);\n if (foundWaiter && report.Status == CloudExecutionReport.StatusCode.Completed)\r\n {\n this.reportWaiters.Remove(report.Identifier);\n remainingWaitersCount = this.reportWaiters.Count;\r\n if (remainingWaitersCount == 0)\r\n {\r\n // We don't have anyone else waiting for a report.\r\n this.haveReportWaiters.Reset();\r\n }\r\n }\n\n this.reportWaitersLock.ReleaseMutex();\n\n if (foundWaiter)\n {\n // We delete the report from the queue right away,\r\n // as nobody else should ever be interested in it.\r\n this.clientReportQueue.DeleteMessage(message);\r\n anyForUs = true;\r\n\r\n switch (report.Status)\r\n {\r\n case CloudExecutionReport.StatusCode.Completed:\r\n waiter.GiveReportToWaiter(report, remainingWaitersCount);\r\n break;\r\n\n case CloudExecutionReport.StatusCode.InProgress:\r\n Console.WriteLine(\"Node '{0}' reports request '{1}' is in progress.\", report.ProcessingNode, report.Identifier);\r\n break;\r\n\r\n default:\r\n // REVIEW: Or just Assert here? This should never happen.\r\n Console.WriteLine(\"Node '{0}' reports strange status '{1}' for request '{2}'.\", report.ProcessingNode, report.Status, report.Identifier);\r\n break;\r\n }\r\n }\r\n }\n\n if ((messages.Count != 0) && !anyForUs)\r\n {\r\n // Give other client(s) a chance to get their messages.\r\n Thread.Sleep(invisibleTime + pollInterval + pollInterval);\r\n }\r\n else\r\n {\r\n Thread.Sleep(pollInterval);\r\n }\r\n }\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/CloudExecutionReport.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n using System;\n using System.Collections.Generic;\n using System.Globalization;\n using System.IO;\n using System.Text;\n using System.Xml;\n using Microsoft.WindowsAzure.Storage.Queue;\n\n /// \n /// Message that is put on the cloud \"reports\" queue to inform a cloud\r\n /// execution engine client of the status of its request.\r\n /// \n public class CloudExecutionReport\n {\n /// \n /// XML element name for this object.\n /// \n public const string XmlTag = \"CloudExecutionReport\";\n\n /// \n /// Version of this object we create by default.\n /// \n private const int Version = 1;\n\n /// \n /// XML element name for our version field.\n /// \n private const string XmlVersionAttribute = \"Version\";\n\n /// \n /// XML element name for our identifier field.\n /// \n private const string XmlIdentifierElement = \"Identifier\";\n\n /// \n /// XML element name for our status field.\r\n /// \r\n private const string XmlStatusElement = \"Status\";\r\n\r\n /// \r\n /// XML element name for our processingNode field.\r\n /// \r\n private const string XmlProcessingNodeElement = \"ProcessingNode\";\r\n\r\n /// \r\n /// XML element name for our exitCode field.\n /// \n private const string XmlExitCodeElement = \"ExitCode\";\n\n /// \n /// XML element name for our standardOutput field.\n /// \n private const string XmlStandardOutputElement = \"StandardOutput\";\n\n /// \n /// XML element name for our standardError field.\n /// \n private const string XmlStandardErrorElement = \"StandardError\";\n\n /// \n /// XML element name for our cpuTime field.\n /// \n private const string XmlCpuTimeElement = \"CpuTime\";\n\n /// \n /// XML element name for our outputFileMappings field.\n /// \n private const string XmlOutputFileMappingsElement = \"OutputFileMappings\";\n\n /// \n /// Queued message this instance was created from (if it was).\n /// \n private CloudQueueMessage message;\n\n /// \n /// Version of this object instance.\n /// \n private int version;\n\n /// \n /// Request identifier this report is in response to.\n /// \n private string identifier;\n\n /// \n /// Status of request being conveyed by this report.\r\n /// \r\n private StatusCode status;\r\n\r\n /// \r\n /// Name of the node that produced this report.\r\n /// \r\n private string processingNode;\r\n\r\n /// \r\n /// Exit code returned from the process after execution.\n /// \n private int exitCode;\n\n /// \n /// Standard out from the process.\n /// \n private string standardOutput;\n\n /// \n /// Standard error from the process.\n /// \n private string standardError;\n\n /// \n /// CPU time used by the process.\n /// \n private double cpuTime;\n\n /// \n /// Collection of output files resulting from this execution,\n /// represented by both their item cache identifier and\n /// their relative path.\n /// \n private List outputFileMappings;\n\n /// \n /// Initializes a new instance of the CloudExecutionReport class.\n /// \n /// Unique ID for this instance.\n /// Status of the request.\r\n /// Exit code from the process.\n /// \n /// Standard output from the process execution.\n /// \n /// \n /// Standard error from the process execution.\n /// \n /// CPU time used by the process.\n /// \n /// Output files generated by this process execution.\n /// \n public CloudExecutionReport(\n string identifier,\n StatusCode status,\r\n int exitCode,\n string standardOutput,\n string standardError,\n double cpuTime,\n List outputFileMappings)\n : this(\n CloudExecutionReport.Version,\n identifier,\n status,\r\n Environment.MachineName, // REVIEW: Probably insecure (from user settable environment variable?). Do we care?\r\n exitCode,\n standardOutput,\n standardError,\n cpuTime,\n outputFileMappings)\n {\n }\n\n /// \n /// Initializes a new instance of the CloudExecutionReport class.\n /// \n /// Unique ID for this instance.\r\n /// Status of the request.\r\n public CloudExecutionReport(\r\n string identifier,\r\n StatusCode status)\r\n : this(\r\n CloudExecutionReport.Version,\r\n identifier,\r\n status,\r\n Environment.MachineName,\r\n 0,\r\n null,\r\n null,\r\n 0,\r\n null)\r\n {\r\n }\r\n\r\n /// \r\n /// Initializes a new instance of the CloudExecutionReport class.\r\n /// \r\n /// Version of this class instance.\n /// Unique ID for this instance.\n /// Status of the request.\r\n /// Name of node producing this report.\r\n /// Exit code from the process.\n /// \n /// Standard output from the process execution.\n /// \n /// \n /// Standard error from the process execution.\n /// \n /// CPU time used by the process.\n /// \n /// Output files generated by this process execution.\n /// \n private CloudExecutionReport(\n int version,\n string identifier,\n StatusCode status,\r\n string processingNode,\r\n int exitCode,\n string standardOutput,\n string standardError,\n double cpuTime,\n List outputFileMappings)\n {\n this.version = version;\n this.identifier = identifier;\n this.status = status;\r\n this.processingNode = processingNode;\r\n this.exitCode = exitCode;\n this.standardOutput = standardOutput;\n this.standardError = standardError;\n this.cpuTime = cpuTime;\n this.outputFileMappings = outputFileMappings;\n }\n\n /// \n /// Definition of Status field values.\r\n /// \r\n public enum StatusCode : int\r\n {\r\n /// \r\n /// The request was processed to completion and all other fields are meaningful.\r\n /// Note: this does NOT mean the request completed successfully.\r\n /// \r\n Completed,\r\n\r\n /// \r\n /// The request was aborted.\r\n /// \r\n Aborted,\r\n\r\n /// \r\n /// The request is in progress.\r\n /// \r\n InProgress\r\n }\r\n\r\n /// \r\n /// Gets the CloudQueueMessage this instance was derived from (if any).\n /// \n public CloudQueueMessage Message\n {\n get { return this.message; }\n }\n\n /// \n /// Gets the unique identifier for the request this report is in response to.\r\n /// \n public string Identifier\n {\n get { return this.identifier; }\n }\n\n /// \n /// Gets the current status of the request.\r\n /// \r\n public StatusCode Status\r\n {\r\n get { return this.status; }\r\n }\r\n\r\n /// \r\n /// Gets the name of processing node that produced this report.\r\n /// \r\n public string ProcessingNode\r\n {\r\n get { return this.processingNode; }\r\n }\r\n\r\n /// \r\n /// Gets the exit code returned from the process after execution.\n /// \n public int ExitCode\n {\n get { return this.exitCode; }\n }\n\n /// \n /// Gets the standard output from the process.\n /// \n public string StandardOutput\n {\n get { return this.standardOutput; }\n }\n\n /// \n /// Gets the standard error output from the process.\n /// \n public string StandardError\n {\n get { return this.standardError; }\n }\n\n /// \n /// Gets the CPU time used by the process execution.\n /// \n public double CpuTime\n {\n get { return this.cpuTime; }\n }\n\n /// \n /// Gets the collection of files generated by the process execution.\n /// \n public IEnumerable OutputFileMappings\n {\n get { return this.outputFileMappings; }\n }\n\n /// \n /// Creates a CloudExecutionReport from a CloudQueueMessage\n /// representation.\n /// \n /// \n /// A CloudQueueMessage containing an XML document representing a\n /// CloudExecutionReport.\n /// \n /// \n /// A new report corresponding to the XML representation contained in\r\n /// the message.\n /// \n public static CloudExecutionReport FromMessage(CloudQueueMessage message)\n {\n CloudExecutionReport report = CloudExecutionReport.FromXml(message.AsString);\r\n report.message = message;\r\n\n return report;\r\n }\n\n /// \n /// Creates a CloudExecutionReport from an XML representation.\n /// \n /// \n /// A string containing an XML document representing a report.\r\n /// \n /// \n /// A new report corresponding to the XML representation read.\r\n /// \n public static CloudExecutionReport FromXml(string xs)\n {\n XmlReader xr = XmlReader.Create(new StringReader(xs));\n while (xr.Read())\n {\n if (xr.NodeType == XmlNodeType.Element)\n {\n break;\n }\n }\n\n return ReadXml(xr);\n }\n\n /// \n /// Helper function to read an XML element (not a full document)\n /// representing a cloud execution report.\r\n /// \n /// \n /// Note that the XmlReader is expected to be positioned in the XML\n /// document such that the current node is a report element.\r\n /// \n /// The XmlReader object to read from.\n /// \n /// A new report corresponding to the XML representation read.\r\n /// \n public static CloudExecutionReport ReadXml(XmlReader xr)\n {\n Util.Assert(xr.Name.Equals(CloudExecutionReport.XmlTag));\n\n string versionText = xr.GetAttribute(CloudExecutionReport.XmlVersionAttribute);\n int version = int.Parse(versionText, CultureInfo.InvariantCulture);\n\n string identifier = string.Empty;\n StatusCode status = StatusCode.Completed;\r\n string processingNode = \"Unknown Benevolence\";\r\n int exitCode = 0;\n string standardOutput = string.Empty;\n string standardError = string.Empty;\n double cpuTime = 0;\n bool inOutputFileMappings = false;\n List outputFileMappings = new List();\n List outputFiles = new List();\n while (xr.Read())\n {\n if (xr.NodeType == XmlNodeType.Element)\n {\n switch (xr.Name)\n {\n case XmlIdentifierElement:\n identifier = xr.ReadElementContentAsString();\n break;\n\n case XmlStatusElement:\r\n status = (StatusCode)Enum.Parse(typeof(StatusCode), xr.ReadElementContentAsString());\r\n break;\r\n\r\n case XmlProcessingNodeElement:\r\n processingNode = xr.ReadElementContentAsString();\r\n break;\r\n\r\n case XmlExitCodeElement:\n exitCode = xr.ReadElementContentAsInt();\n break;\n\n case XmlStandardOutputElement:\n standardOutput = xr.ReadElementContentAsString();\n break;\n\n case XmlStandardErrorElement:\n standardError = xr.ReadElementContentAsString();\n break;\n\n case XmlCpuTimeElement:\n cpuTime = xr.ReadElementContentAsDouble();\n break;\n\n case XmlOutputFileMappingsElement:\n inOutputFileMappings = true;\n break;\n\n case BuildObjectValuePointer.XmlTag:\n Util.Assert(inOutputFileMappings);\n outputFileMappings.Add(BuildObjectValuePointer.ReadXml(xr));\n break;\n }\n }\n else if (xr.NodeType == XmlNodeType.EndElement)\n {\n if (xr.Name.Equals(CloudExecutionReport.XmlTag))\n {\n break; // All done.\n }\n\n switch (xr.Name)\n {\n case XmlOutputFileMappingsElement:\n inOutputFileMappings = false;\n break;\n }\n }\n }\n\n // REVIEW: Require element presence? Sanity check things here?\n return new CloudExecutionReport(\n version,\n identifier,\n status,\r\n processingNode,\r\n exitCode,\n standardOutput,\n standardError,\n cpuTime,\n outputFileMappings);\n }\n\n /// \n /// Creates an XML document representing this cloud execution report.\r\n /// \n /// \n /// A string containing an XML document representing this report.\r\n /// \n public string ToXml()\n {\n StringBuilder sb = new StringBuilder();\n XmlWriterSettings settings = new XmlWriterSettings();\n settings.Indent = true;\n XmlWriter xw = XmlWriter.Create(sb, settings);\n xw.WriteStartDocument();\n this.WriteXml(xw);\n xw.Close();\n return sb.ToString();\n }\n\n /// \n /// Helper function to write an XML element (not a full document)\n /// representing this result record.\n /// \n /// The XmlWriter object to write to.\n public void WriteXml(XmlWriter xw)\n {\n // Start writing the element for this object.\n xw.WriteStartElement(XmlTag);\n xw.WriteAttributeString(XmlVersionAttribute, this.version.ToString(CultureInfo.InvariantCulture));\r\n\n // Write the Identifier element.\r\n xw.WriteElementString(XmlIdentifierElement, this.identifier);\r\n\r\n // Write the Status element.\r\n xw.WriteElementString(XmlStatusElement, this.status.ToString());\r\n\n // Write the ProcessingNode element.\r\n xw.WriteElementString(XmlProcessingNodeElement, this.processingNode);\r\n\r\n if (this.status == StatusCode.Completed)\r\n {\r\n // Write the ExitCode element.\n xw.WriteElementString(XmlExitCodeElement, this.exitCode.ToString(CultureInfo.InvariantCulture));\n\n // Write the Standard Output element.\n xw.WriteElementString(XmlStandardOutputElement, this.standardOutput);\n\n // Write the Standard Error element.\n xw.WriteElementString(XmlStandardErrorElement, this.standardError);\n\n // Write the CPU Time element.\n xw.WriteElementString(XmlCpuTimeElement, this.cpuTime.ToString(CultureInfo.InvariantCulture));\n\n // Write the OutputFileMappings element.\n xw.WriteStartElement(XmlOutputFileMappingsElement);\n foreach (BuildObjectValuePointer outputFile in this.outputFileMappings)\n {\n outputFile.WriteXml(xw);\n }\n\n xw.WriteEndElement();\n }\r\n\n // Finish writing the element for this object.\n xw.WriteEndElement();\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/CloudExecutionRequest.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n using System;\n using System.Collections.Generic;\n using System.Globalization;\n using System.IO;\n using System.Text;\n using System.Xml;\n using Microsoft.WindowsAzure.Storage.Queue;\n\n /// \n /// Message that is put on the cloud \"requests\" queue to ask a cloud\n /// execution engine to do some work on the requester's behalf.\n /// \n public class CloudExecutionRequest\n {\n /// \n /// XML element name for this object.\n /// \n public const string XmlTag = \"CloudExecutionRequest\";\n\n /// \n /// Version of this object we create by default.\n /// \n private const int Version = 2;\r\n\n /// \n /// XML element name for our version field.\n /// \n private const string XmlVersionAttribute = \"Version\";\n\n /// \n /// XML element name for our reportQueue field.\r\n /// \r\n private const string XmlReportQueueElement = \"ReportQueue\";\r\n\r\n /// \r\n /// XML element name for our identifier field.\n /// \n private const string XmlIdentifierElement = \"Identifier\";\n\n /// \n /// XML element name for our operation field.\r\n /// \r\n private const string XmlOperationElement = \"Operation\";\r\n\r\n /// \r\n /// XML element name for our executable field.\n /// \n private const string XmlExecutableElement = \"Executable\";\n\n /// \n /// XML element name for our arguments field.\n /// \n private const string XmlArgumentsElement = \"Arguments\";\n\n /// \n /// XML element name for our inputFileMappings field.\n /// \n private const string XmlInputFileMappingsElement = \"InputFileMappings\";\n\n /// \n /// XML element name for our outputFiles field.\n /// \n private const string XmlOutputFilesElement = \"OutputFiles\";\n\n /// \n /// Queued message this instance was created from (if it was).\n /// \n private CloudQueueMessage message;\n\n /// \n /// Version of this object instance.\n /// \n private int version;\n\n /// \n /// Queue on which to add the report of the disposition of this request.\r\n /// \r\n private string reportQueue;\r\n\r\n /// \r\n /// Unique identifier for this request.\n /// \n private string identifier;\n\n /// \n /// Operation to perform.\r\n /// \r\n private Operation operation;\r\n\r\n /// \r\n /// Executable to be run.\n /// \n private string executable;\n\n /// \n /// Arguments to the executable.\n /// \n private string arguments;\n\n /// \n /// Collection of input files required for this execution,\n /// represented by both their item cache identifier and\n /// their relative path.\n /// \n private List inputFileMappings;\n\n /// \n /// Collection of expected output files from this execution.\n /// \n private IEnumerable outputFiles;\n\n /// \n /// Initializes a new instance of the CloudExecutionRequest class.\n /// \n /// \r\n /// Queue on which to add the report of the disposition of this request.\r\n /// \r\n /// Unique ID for this instance.\n /// Operation to perform.\r\n /// Executable to be run.\n /// Arguments to the executable.\n /// \n /// Input files required for this execution.\n /// \n /// Expected output files.\n public CloudExecutionRequest(\n string reportQueue,\r\n string identifier,\n Operation operation,\r\n string executable,\n string arguments,\n List inputFileMappings,\n IEnumerable outputFiles)\n : this(\n CloudExecutionRequest.Version,\n reportQueue,\r\n identifier,\n operation,\r\n executable,\n arguments,\n inputFileMappings,\n outputFiles)\n {\n // REVIEW: Use different random string generator for identifier?\n }\n\n /// \n /// Initializes a new instance of the CloudExecutionRequest class.\n /// \n /// Version of this class instance.\n /// \r\n /// Queue on which to add the report of the disposition of this request.\r\n /// \r\n /// Unique ID for this instance.\n /// Operation to perform.\r\n /// Executable to be run.\n /// Arguments to the executable.\n /// \n /// Input files required for this execution.\n /// \n /// Expected output files.\n private CloudExecutionRequest(\n int version,\n string reportQueue,\r\n string identifier,\n Operation operation,\r\n string executable,\n string arguments,\n List inputFileMappings,\n IEnumerable outputFiles)\n {\n this.version = version;\n this.reportQueue = reportQueue;\r\n this.identifier = identifier;\n this.operation = operation;\r\n this.executable = executable;\n this.arguments = arguments;\n this.inputFileMappings = inputFileMappings;\n this.outputFiles = outputFiles;\n }\n\n /// \n /// Various types of operation that can be requested.\r\n /// \r\n public enum Operation : int\r\n {\r\n /// \r\n /// Don't do anything (no-op).\r\n /// \r\n None,\r\n\r\n /// \r\n /// Run the specified executable.\r\n /// \r\n RunExecutable,\r\n\r\n /// \r\n /// Delete the specified report queue.\r\n /// \r\n DeleteQueue,\r\n\r\n /// \r\n /// Exit (and thus quit handling requests).\r\n /// \r\n CommitSuicide,\r\n }\r\n\r\n /// \r\n /// Gets the CloudQueueMessage this instance was derived from (if any).\n /// \n public CloudQueueMessage Message\n {\n get { return this.message; }\n }\n\n /// \n /// Gets the queue on which to report the disposition of this request.\r\n /// \r\n public string ReportQueue\r\n {\r\n get { return this.reportQueue; }\r\n }\r\n\r\n /// \r\n /// Gets the unique identifier for this request.\n /// \n public string Identifier\n {\n get { return this.identifier; }\n }\n\n /// \n /// Gets the operation to perform.\r\n /// \r\n public Operation RequestedOperation\r\n {\r\n get { return this.operation; }\r\n }\r\n\r\n /// \r\n /// Gets the executable to run.\n /// \n public string Executable\n {\n get { return this.executable; }\n }\n\n /// \n /// Gets the arguments to the executable.\n /// \n public string Arguments\n {\n get { return this.arguments; }\n }\n\n /// \n /// Gets the collection of files needed as input to the execution,\n /// as both BuildObjects and as their cached hash values.\n /// \n public IEnumerable InputFileMappings\n {\n get { return this.inputFileMappings; }\n }\n\n /// \n /// Gets the collection of potential output files from this execution,\n /// as BuildObjects.\n /// \n public IEnumerable OutputFiles\n {\n get { return this.outputFiles; }\n }\n\n /// \n /// Creates a CloudExecutionRequest from a CloudQueueMessage\n /// representation.\n /// \n /// \n /// A CloudQueueMessage containing an XML document representing a\n /// CloudExecutionRequest.\n /// \n /// \n /// A new request corresponding to the XML representation contained in\n /// the message.\n /// \n public static CloudExecutionRequest FromMessage(CloudQueueMessage message)\n {\n CloudExecutionRequest request = CloudExecutionRequest.FromXml(message.AsString);\n request.message = message;\n\n return request;\n }\n\n /// \n /// Creates a CloudExecutionRequest from an XML representation.\n /// \n /// \n /// A string containing an XML document representing a request.\n /// \n /// \n /// A new request corresponding to the XML representation read.\n /// \n public static CloudExecutionRequest FromXml(string xs)\n {\n XmlReader xr = XmlReader.Create(new StringReader(xs));\n while (xr.Read())\n {\n if (xr.NodeType == XmlNodeType.Element)\n {\n break;\n }\n }\n\n return ReadXml(xr);\n }\n\n /// \n /// Helper function to read an XML element (not a full document)\n /// representing a cloud execution request.\n /// \n /// \n /// Note that the XmlReader is expected to be positioned in the XML\n /// document such that the current node is a request element.\n /// \n /// The XmlReader object to read from.\n /// \n /// A new request corresponding to the XML representation read.\n /// \n public static CloudExecutionRequest ReadXml(XmlReader xr)\n {\n Util.Assert(xr.Name.Equals(CloudExecutionRequest.XmlTag));\n\n string versionText = xr.GetAttribute(CloudExecutionRequest.XmlVersionAttribute);\n int version = int.Parse(versionText, CultureInfo.InvariantCulture);\n\n string reportQueue = \"reports\";\r\n string identifier = string.Empty;\n Operation operation = Operation.RunExecutable;\r\n string executable = string.Empty;\n string arguments = string.Empty;\n bool inInputFileMappings = false;\n List inputFileMappings = new List();\n bool inOutputFiles = false;\n List outputFiles = new List();\n while (xr.Read())\n {\n if (xr.NodeType == XmlNodeType.Element)\n {\n switch (xr.Name)\n {\n case XmlReportQueueElement:\r\n reportQueue = xr.ReadElementContentAsString();\r\n break;\r\n\r\n case XmlIdentifierElement:\n identifier = xr.ReadElementContentAsString();\n break;\n\n case XmlOperationElement:\r\n operation = (Operation)Enum.Parse(typeof(Operation), xr.ReadElementContentAsString());\r\n break;\r\n\r\n case XmlExecutableElement:\n executable = xr.ReadElementContentAsString();\n break;\n\n case XmlArgumentsElement:\n arguments = xr.ReadElementContentAsString();\n break;\n\n case XmlInputFileMappingsElement:\n inInputFileMappings = true;\n break;\n\n case BuildObjectValuePointer.XmlTag:\n Util.Assert(inInputFileMappings);\n inputFileMappings.Add(BuildObjectValuePointer.ReadXml(xr));\n break;\n\n case XmlOutputFilesElement:\n inOutputFiles = true;\n break;\n\n case BuildObject.XmlTag:\n Util.Assert(inOutputFiles);\n outputFiles.Add(BuildObject.ReadXml(xr));\n break;\n }\n }\n else if (xr.NodeType == XmlNodeType.EndElement)\n {\n if (xr.Name.Equals(CloudExecutionRequest.XmlTag))\n {\n break; // All done.\n }\n\n switch (xr.Name)\n {\n case XmlInputFileMappingsElement:\n inInputFileMappings = false;\n break;\n\n case XmlOutputFilesElement:\n inOutputFiles = false;\n break;\n }\n }\n }\n\n // REVIEW: Require presence of (some/all) elements? Sanity check things here?\n return new CloudExecutionRequest(\n version,\n reportQueue,\r\n identifier,\n operation,\r\n executable,\n arguments,\n inputFileMappings,\n outputFiles);\n }\n\n /// \n /// Creates an XML document representing this cloud execution request.\n /// \n /// \n /// A string containing an XML document representing this request.\n /// \n public string ToXml()\n {\n StringBuilder sb = new StringBuilder();\n XmlWriterSettings settings = new XmlWriterSettings();\n settings.Indent = true;\n XmlWriter xw = XmlWriter.Create(sb, settings);\n xw.WriteStartDocument();\n this.WriteXml(xw);\n xw.Close();\n return sb.ToString();\n }\n\n /// \n /// Helper function to write an XML element (not a full document)\n /// representing this result record.\n /// \n /// The XmlWriter object to write to.\n public void WriteXml(XmlWriter xw)\n {\n // Start writing the element for this object.\n xw.WriteStartElement(XmlTag);\n xw.WriteAttributeString(CloudExecutionRequest.XmlVersionAttribute, this.version.ToString(CultureInfo.InvariantCulture));\n\n // Write the ReportQueue element.\r\n xw.WriteElementString(XmlReportQueueElement, this.reportQueue);\r\n\r\n // Optionally write the Identifier element.\n if (!string.IsNullOrEmpty(this.identifier))\n {\n xw.WriteElementString(CloudExecutionRequest.XmlIdentifierElement, this.identifier);\n }\n\n // Write the Operation element.\r\n xw.WriteElementString(XmlOperationElement, this.operation.ToString());\r\n\r\n if (this.operation == Operation.RunExecutable)\r\n {\r\n // Write the Executable element.\n xw.WriteElementString(XmlExecutableElement, this.executable);\n\n // Write the Arguments element.\n xw.WriteElementString(XmlArgumentsElement, this.arguments);\n\n // Write the InputFileMappings element.\n xw.WriteStartElement(XmlInputFileMappingsElement);\n foreach (BuildObjectValuePointer inputFile in this.inputFileMappings)\n {\n inputFile.WriteXml(xw);\n }\n\n xw.WriteEndElement();\n\n // Write the OutputFiles element.\n xw.WriteStartElement(XmlOutputFilesElement);\n foreach (BuildObject outputFile in this.outputFiles)\n {\n outputFile.WriteXml(xw);\n }\n\n xw.WriteEndElement();\n }\r\n\n // Finish writing the element for this object.\n xw.WriteEndElement();\n }\n\n /// \n /// Gets a string representation of this instance.\n /// Primarily intended as a debugging aid.\n /// \n /// A string representation of this instance.\n public override string ToString()\n {\n StringBuilder output = new StringBuilder();\n\n output.AppendFormat(\"Version: {0}\", this.version);\n output.AppendLine();\n output.AppendFormat(\"Report Queue: {0}\", this.reportQueue);\r\n output.AppendLine();\r\n output.AppendFormat(\"Identifier: {0}\", this.identifier);\n output.AppendLine();\n output.AppendFormat(\"Operation: {0}\", this.operation);\r\n output.AppendLine();\r\n output.AppendFormat(\"Executable: {0}\", this.executable);\n output.AppendLine();\n output.AppendFormat(\"Arguments: {0}\", this.arguments);\n output.AppendLine();\n\n output.AppendFormat(\"InputFileMappings ({0} files):\", this.inputFileMappings.Count);\n output.AppendLine();\n#if false\n foreach (BuildObjectValuePointer mapping in this.inputFileMappings)\n {\n output.AppendFormat(\"{0} = {1}\", mapping.RelativePath, mapping.ObjectHash);\n output.AppendLine();\n }\n#endif\n\n output.AppendLine(\"OutputFiles:\");\n foreach (BuildObject file in this.outputFiles)\n {\n output.AppendLine(file.getRelativePath());\n }\n\n return output.ToString();\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/CloudExecutionWaiter.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n using System;\n using System.Threading;\n\n /// \n /// Represents a thread waiting for a particular cloud execution report.\n /// \n internal class CloudExecutionWaiter\n {\n /// \n /// Event that is signalled when a new report is ready.\n /// \n private AutoResetEvent reportIsReady;\n\n /// \n /// Execution report that just arrived.\n /// \n private CloudExecutionReport executionReport;\n\n /// \n /// Count of other waiters.\r\n /// \r\n private int otherWaitersCount;\r\n\r\n /// \r\n /// Initializes a new instance of the CloudExecutionWaiter class.\n /// \n public CloudExecutionWaiter()\n {\n this.reportIsReady = new AutoResetEvent(false);\n }\n\n /// \n /// Wait for an execution report to arrive.\n /// \n /// Count of other report waiters.\r\n /// An execution report.\n public CloudExecutionReport WaitForReport(out int numberOfOtherWaiters)\r\n {\n this.reportIsReady.WaitOne();\n\r\n numberOfOtherWaiters = this.otherWaitersCount;\r\n return this.executionReport;\n }\n\n /// \n /// Give an execution report to this waiter.\n /// \n /// The execution report to give.\n /// Count of other report waiters.\r\n public void GiveReportToWaiter(CloudExecutionReport executionReport, int numberOfOtherWaiters)\r\n {\n this.executionReport = executionReport;\n this.otherWaitersCount = numberOfOtherWaiters;\r\n this.reportIsReady.Set();\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/CloudSubmitter.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n using System;\n using System.Collections.Generic;\n using System.Diagnostics;\n using System.IO;\n using System.Text;\n\n /// \n /// Submits requests for verb execution to remote cloud worker pool.\n /// \n internal class CloudSubmitter : IProcessInvoker\n {\n /// \n /// Whether to always emit diagnostic output.\n /// \n private const bool AlwaysEmitDiagnostics = true;\n\n /// \n /// The CPU time used by the process, in seconds.\n /// \n private double cpuTime;\n\n /// \n /// The exit code returned by the process.\n /// \n private int exitCode;\n\n /// \n /// Where standard out is collected by default.\n /// \n private string stdout;\n\n /// \n /// Where standard error is collected.\n /// \n private string stderr;\n\n /// \n /// The private working directory for the process we invoke.\n /// \n private WorkingDirectory workingDirectory;\n\n /// \n /// Initializes a new instance of the CloudSubmitter class.\n /// \n /// \n /// Unique identifier for this request.\n /// \n /// \n /// Working directory the process is started in.\n /// \n /// \n /// List of input files expected by the process.\n /// \n /// \n /// List of potential output files generated by the process.\n /// \n /// Executable to run.\n /// \n /// Command line arguments to provide to the executable.\n /// \n /// Not sure what this is -- some debugging/diagnostic thing.\n /// Where to (optionally) store the captured standard out.\n /// Debugging text for something or another.\n public CloudSubmitter(\n string requestIdentifier,\n WorkingDirectory workingDirectory,\n IEnumerable inputFiles,\n IEnumerable outputFiles,\n string executable,\n string[] args,\n BuildObject failureBase,\n BuildObject captureStdout = null,\n string dbgText = null)\n {\n // Catch bad verb authors before they hurt themselves.\n Util.Assert(!executable.Contains(\":\")); // Hey, this looks like an absolute path! Use .getRelativePath(); it makes your output more stable.\n foreach (string arg in args)\n {\n // Pardon my distasteful heuristic to avoid flagging /flag:value args.\n Util.Assert(arg.Length < 2 || arg[1] != ':'); // Hey, this looks like an absolute path! Use .getRelativePath() to tolerate crossing machine boundaries.\n }\n\n // Stash away things we'll want to remember later.\n this.workingDirectory = workingDirectory;\n\n // Create list of input file mappings.\n // REVIEW: We're not running on the main thread at this point. Are below calls all thread-safe?\n List inputFileMappings = new List();\n foreach (BuildObject file in inputFiles)\n {\n string fileHash = BuildEngine.theEngine.Repository.GetHash(file);\n Util.Assert(!string.IsNullOrEmpty(fileHash));\n inputFileMappings.Add(new BuildObjectValuePointer(fileHash, file.getRelativePath()));\n\n // Ensure that the input files are in the cloud cache.\n // REVIEW: best way to determine this is a source file?\n ItemCacheContainer container;\n if (file is SourcePath)\n {\n container = ItemCacheContainer.Sources;\n }\n else\n {\n container = ItemCacheContainer.Objects;\n }\n\n ItemCacheMultiplexer multiplexedCache = BuildEngine.theEngine.ItemCache as ItemCacheMultiplexer;\n Util.Assert(multiplexedCache != null);\n multiplexedCache.SyncItemToCloud(container, fileHash);\n }\n\n // Prepare cloud execution request for submission.\n string arguments = string.Join(\" \", args);\n CloudExecutionRequest request = new CloudExecutionRequest(\n BuildEngine.theEngine.CloudReportQueueName,\r\n requestIdentifier,\n CloudExecutionRequest.Operation.RunExecutable,\r\n executable,\n arguments,\n inputFileMappings,\n outputFiles);\n BuildEngine.theEngine.CloudExecutionQueue.SubmitRequest(request);\n\n // Wait for remote execution to finish.\n int requestsOutstanding;\r\n Console.WriteLine(\"Waiting on remote execution report for request '{0}'.\", requestIdentifier);\r\n CloudExecutionReport executionReport = BuildEngine.theEngine.CloudExecutionQueue.GetReport(requestIdentifier, out requestsOutstanding);\r\n Console.WriteLine(\"Received remote execution report for request '{0}'. {1} others still outstanding.\", requestIdentifier, requestsOutstanding);\r\n\n // Record what we got back.\n this.exitCode = executionReport.ExitCode;\n this.stdout = executionReport.StandardOutput;\n this.stderr = executionReport.StandardError;\n this.cpuTime = executionReport.CpuTime;\n\n // Copy output files from cloud cache back to local working dir.\n // REVIEW: This is just to set things up as expected for the\n // Scheduler's recordResult routine. Could re-architect this to\n // be more efficient for the remote execution case.\n foreach (BuildObjectValuePointer outputFileMapping in executionReport.OutputFileMappings)\n {\n BuildEngine.theEngine.CloudCache.FetchItemToFile(\n ItemCacheContainer.Objects,\n outputFileMapping.ObjectHash,\n workingDirectory.PathTo(outputFileMapping.RelativePath));\n }\n }\n\n /// \n /// Gets the exit code returned by the process.\n /// \n public int ExitCode\n {\n get { return this.exitCode; }\n }\n\n /// \n /// Gets the CPU time used by the process, in seconds.\n /// \n public double CpuTime\n {\n get { return this.cpuTime; }\n }\n\n /// \n /// Gets the process's standard output in the default case.\n /// Does not return the standard output if it is redirected to a file\r\n /// (i.e. if captureStdout is non-null).\r\n /// \n /// The process's standard output.\n public string GetStdout()\n {\n return this.stdout;\n }\n\n /// \n /// Gets the process's standard error output..\n /// \n /// The process's standard error output.\n public string GetStderr()\n {\n return this.stderr;\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/ConcatContext.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class ConcatContext\r\n : IncludePathContext\r\n {\r\n private List contexts;\r\n private string descr;\r\n \r\n public ConcatContext(IEnumerable contexts)\r\n {\r\n this.contexts = new List(contexts);\r\n this.descr = \"Context(\" + string.Join(\",\", this.contexts) + \")\";\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return this.descr;\r\n }\r\n\r\n public override BuildObject search(string basename, ModPart modPart = ModPart.Ifc)\r\n {\r\n foreach (IIncludePathContext context in this.contexts)\r\n {\r\n BuildObject obj = context.search(basename, modPart);\r\n if (obj != null)\r\n {\r\n return obj;\r\n }\r\n }\r\n\r\n return null;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/ConcatContextVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n internal class ConcatContextVerb\r\n : ContextGeneratingVerb\r\n {\r\n private List parents;\r\n\r\n public ConcatContextVerb(IEnumerable parents, PoundDefines poundDefines)\r\n : base(\"Cat(\" + string.Join(\",\", parents) + \")\", poundDefines)\r\n {\r\n this.parents = new List(parents);\r\n }\r\n\r\n public ConcatContextVerb(IContextGeneratingVerb parentA, IContextGeneratingVerb parentB, PoundDefines poundDefines)\r\n : this(new IContextGeneratingVerb[] { parentA, parentB }, poundDefines)\r\n {\r\n }\r\n\r\n public ConcatContextVerb(IContextGeneratingVerb parentA, IContextGeneratingVerb parentB, IContextGeneratingVerb parentC, PoundDefines poundDefines)\r\n : this(new IContextGeneratingVerb[] { parentA, parentB, parentC }, poundDefines)\r\n {\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n return this.parents.Select(parent => parent.getContextOutput());\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return this.parents;\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n IEnumerable contexts = this.parents.Select(parent =>\r\n ((ContextContents)BuildEngine.theEngine.Repository.FetchVirtual(parent.getContextOutput())).Context);\r\n ConcatContext context = new ConcatContext(contexts);\r\n ContextContents contents = new ContextContents(context);\r\n BuildEngine.theEngine.Repository.StoreVirtual(this.getContextOutput(), new Fresh(), contents);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/ContextContents.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class ContextContents\r\n : VirtualContents\r\n {\r\n private IIncludePathContext context;\r\n\r\n public ContextContents(IIncludePathContext context)\r\n {\r\n this.context = context;\r\n }\r\n\r\n public IIncludePathContext Context\r\n {\r\n get { return this.context; }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/ContextGeneratingVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n internal abstract class ContextGeneratingVerb\r\n : Verb, IContextGeneratingVerb\r\n {\r\n public const string CONTEXT_EXTN = \".ctxt\"; // Virtual, so it shouldn't appear in filesystem.\r\n private int version = 1;\r\n\r\n private string nickname;\r\n private PoundDefines poundDefines;\r\n private BuildObject outputObj;\r\n\r\n /// NB nickname will need to be unique over a run; it's used as the verb AbstractIdentifier, and\r\n /// hence hash identity in caches.\r\n public ContextGeneratingVerb(string nickname, PoundDefines poundDefines)\r\n {\r\n this.nickname = nickname;\r\n this.poundDefines = poundDefines;\r\n }\r\n\r\n public PoundDefines getPoundDefines()\r\n {\r\n return this.poundDefines;\r\n }\r\n\r\n public string getContextIdentifier()\r\n {\r\n return this.nickname;\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return new AbstractId(this.GetType().Name, this.version, this.getContextIdentifier());\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { this.getContextOutput() };\r\n }\r\n\r\n public BuildObject getContextOutput()\r\n {\r\n if (this.outputObj == null)\r\n {\r\n this.outputObj = new VirtualBuildObject(\r\n Path.Combine(BuildEngine.theEngine.getVirtualRoot(), Util.mungeClean(this.getAbstractIdentifier().ToString()) + CONTEXT_EXTN));\r\n }\r\n\r\n return this.outputObj;\r\n }\r\n }\r\n\r\n internal static class ContextGeneratingVerbExtensions\r\n {\r\n internal static IIncludePathContext fetchIfAvailable(this IContextGeneratingVerb verb, ref DependencyDisposition ddisp)\r\n {\r\n try\r\n {\r\n return ((ContextContents)\r\n BuildEngine.theEngine.Repository.FetchVirtual(verb.getContextOutput())).Context;\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n // Oh, we don't even have the context object yet.\r\n ddisp = ddisp.combine(DependencyDisposition.Incomplete);\r\n }\r\n catch (ObjectFailedException)\r\n {\r\n ddisp = ddisp.combine(DependencyDisposition.Failed);\r\n }\r\n\r\n return null;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/CustomManifestParser.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Text;\r\n\r\n internal class CustomManifestParser\r\n {\r\n private HashSet dependencies = new HashSet();\r\n private HashSet outputs = new HashSet();\r\n\r\n public CustomManifestParser(SourcePath basePath)\r\n {\r\n this.parseCustomManifest(basePath);\r\n }\r\n\r\n public IEnumerable getDependencies()\r\n {\r\n return this.dependencies;\r\n }\r\n\r\n public IEnumerable getOutputs()\r\n {\r\n return this.outputs;\r\n }\r\n\r\n private void parseCustomManifest(SourcePath basePath)\r\n {\r\n SourcePath manifest = basePath.getNewSourcePath(\"nubuild-manifest.txt\");\r\n this.dependencies.Add(manifest);\r\n\r\n using (StreamReader stream = new StreamReader(IronRootDirectory.PathTo(manifest)))\r\n {\r\n string origline;\r\n\r\n while ((origline = stream.ReadLine()) != null)\r\n {\r\n string line = origline.Trim();\r\n\r\n if (line.Length == 0)\r\n {\r\n continue;\r\n }\r\n\r\n if (line.Substring(0, 1) == \"#\")\r\n {\r\n continue;\r\n }\r\n\r\n string[] parts = line.Split();\r\n\r\n if (parts.Length != 2)\r\n {\r\n throw new UserError(string.Format(\"{0}: badly formed manifest line {1}\", IronRootDirectory.PathTo(manifest), origline));\r\n }\r\n\r\n if (\"output\".Equals(parts[0]))\r\n {\r\n this.outputs.Add(new BuildObject(Path.Combine(basePath.getDirPath(), parts[1])));\r\n }\r\n else if (\"dependency\".Equals(parts[0]))\r\n {\r\n this.dependencies.Add(basePath.getNewSourcePath(parts[1]));\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DafnyCCVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\n using System.Linq;\r\n\r\n internal class DafnyCCVerb\r\n : DafnyTransformBaseVerb\r\n {\r\n private AbstractId abstractId;\r\n private FramePointerMode useFramePointer;\r\n private VSSolutionVerb dafnyCCBuildExecutableVerb;\r\n\r\n public DafnyCCVerb(SourcePath dfyroot, string appLabel, FramePointerMode useFramePointer)\r\n : base(dfyroot, appLabel)\r\n {\r\n this.useFramePointer = useFramePointer;\r\n this.abstractId = new AbstractId(this.GetType().Name, this.getVersion() + version, dfyroot.ToString(), concrete: useFramePointer.ToString());\r\n this.dafnyCCBuildExecutableVerb = new VSSolutionVerb(new SourcePath(\"tools\\\\DafnyCC\\\\DafnyCC.sln\", SourcePath.SourceType.Tools));\r\n }\r\n\r\n public enum FramePointerMode\r\n {\r\n UseFramePointer,\r\n NoFramePointer\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return base.getVerbs().Concat(new[] { this.dafnyCCBuildExecutableVerb });\r\n }\r\n \r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n // This is merely an assert double-check that we didn't let a spec generated\r\n // by DafnyCC slip through to be used in the BoogieAsmVerify step.\r\n internal static void AssertSmellsImplementy(BuildObject obj)\r\n {\r\n string fn = obj.getFileNameWithoutExtension();\r\n Util.Assert(fn.EndsWith(\"_\" + DafnyTransformBaseVerb.DAFNY_I_SUFFIX)\r\n || fn.EndsWith(\"_\" + DafnyTransformBaseVerb.DAFNY_C_SUFFIX)\r\n || fn.Equals(\"Checked\")\r\n || fn.Equals(\"Heap\")\r\n || fn.Equals(\"Seq\"));\r\n }\r\n \r\n protected override int getVersion()\r\n {\r\n return 18;\r\n }\r\n\r\n protected override BuildObject getExecutable()\r\n {\r\n return new BuildObject(Path.Combine(this.dafnyCCBuildExecutableVerb.getOutputPath().getRelativePath(), \"dafnycc.exe\"));\r\n }\r\n\r\n protected override IEnumerable getExtraDependencies()\r\n {\r\n string exePath = this.dafnyCCBuildExecutableVerb.getOutputPath().getRelativePath();\r\n\r\n // REVIEW: Should we extract the dafnycc.exe dependencies from the project file instead of listing them manually?\r\n // REVIEW: What about Graph.dll? Not needed?\r\n return new BuildObject[] {\r\n new BuildObject(Path.Combine(exePath, \"Basetypes.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"CodeContractsExtender.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"Core.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"DafnyPipeline.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"ParserHelper.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"Provers.SMTLib.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"VCGeneration.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"z3.exe\")),\r\n getDafnyPrelude()\r\n };\r\n }\r\n\r\n protected override IEnumerable getRootArgs()\r\n {\r\n DependencyDisposition ddisp;\r\n IEnumerable result = getAllDafnyModules(out ddisp);\r\n Util.Assert(ddisp == DependencyDisposition.Complete);\r\n return result;\r\n }\r\n\r\n protected override IEnumerable getExtraSpecialOutputs()\r\n {\r\n // Work around some undesirable behavior presently in DafnyCC:\r\n // We can't pass DafnyPrelude on the command line (getRootArgs) to DafnyCC,\r\n // yet it emits a dafny_DafnyPrelude file that we want to account for in the output.\r\n return new string[] { \"Checked\", \"Heap\", \"Seq\" }; ////, \"dafny_DafnyPrelude\" };\r\n }\r\n\r\n protected override void addExtraArgs(List args)\r\n {\r\n args.Add(\"/relational\");\r\n if (this.useFramePointer == FramePointerMode.UseFramePointer)\r\n {\r\n args.Add(\"/useFramePointer\");\r\n }\r\n }\r\n\r\n protected override IEnumerable getRoots()\r\n {\r\n return new SourcePath[]\r\n {\r\n new SourcePath(\"src\\\\Trusted\\\\DafnySpec\\\\Seq.s.dfy\"),\r\n new SourcePath(\"src\\\\Checked\\\\Libraries\\\\DafnyCC\\\\Seq.dfy\"),\r\n dfyroot\r\n };\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DafnyCompileOneVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n\r\n /// \r\n /// Verb to compile Dafny source code to CSharp target.\r\n /// \r\n internal class DafnyCompileOneVerb : Verb, IProcessInvokeAsyncVerb\r\n {\r\n private const int Version = 10;\r\n\r\n private const string IntermediateSourceFilename = \"ExpandedSource.dfy\";\r\n private const string CSharpExt = \".cs\";\r\n private readonly SourcePath input;\r\n private readonly BuildObject output;\r\n private readonly AbstractId abstractId;\r\n private readonly IVerb[] verbs;\r\n private readonly DafnyTransitiveDepsVerb transitiveDepsVerb;\r\n private List dependencies;\r\n private SourcePath expandedSource;\r\n\r\n public DafnyCompileOneVerb(SourcePath input)\r\n {\r\n if (input == null)\r\n {\r\n throw new ArgumentNullException(\"input\");\r\n }\r\n\r\n this.abstractId = new AbstractId(GetType().Name, Version, input.ToString());\r\n this.input = input;\r\n this.output = input.makeOutputObject(CSharpExt);\r\n this.transitiveDepsVerb = new DafnyTransitiveDepsVerb(input);\r\n this.verbs = new IVerb[] { this.transitiveDepsVerb };\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n if (this.dependencies == null)\r\n {\r\n DependencyDisposition dd;\r\n var dependencies = new List();\r\n\r\n // This method's implementation is dependent upon transitiveDepsVerb being the only element of verbs.\r\n Trace.Assert(this.verbs.Length == 1 && this.verbs[0] is DafnyTransitiveDepsVerb);\r\n dependencies.AddRange(this.transitiveDepsVerb.getAvailableDeps(out dd));\r\n dependencies.AddRange(DafnyExecutableDependencies.getDafnyExecutableDependencies());\r\n if (dd != DependencyDisposition.Complete)\r\n {\r\n ddisp = dd;\r\n\r\n // Dependency resolution isn't complete yet and we don't want to cache the incomplete list.\r\n return dependencies;\r\n }\r\n\r\n this.dependencies = dependencies;\r\n }\r\n\r\n Trace.Assert(this.dependencies != null);\r\n ddisp = DependencyDisposition.Complete;\r\n return this.dependencies;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return this.verbs;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new[] { this.output };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // First expand our Dafny source file to inline all its includes.\r\n this.expandedSource = this.input.getNewSourcePath(\"ExpandedSource.dfy\");\r\n DafnyIncludes dafnyIncludes = new DafnyIncludes();\r\n dafnyIncludes.ExpandDafny(workingDirectory, this.input, this.expandedSource);\r\n\r\n // Call Dafny.exe to compile Dafny source to CSharp target.\r\n var args = new[] { \"/noVerify\", \"/spillTargetCode:1\", \"/compile:2\", \"/ironDafny\", this.expandedSource.getRelativePath() };\r\n Console.WriteLine(\"expanded source: \" + this.expandedSource.getRelativePath());\r\n ////Logger.WriteLine(\"arguments: \" + String.Join(\" \", args));\r\n return\r\n new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n DafnyExecutableDependencies.getDafnyExecutable().getRelativePath(),\r\n args,\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n getDiagnosticsBase(),\r\n returnStandardOut: true, // REVIEW: Doesn't appear to be needed.\r\n returnStandardError: true, // REVIEW: Doesn't appear to be needed.\r\n allowCloudExecution: true);\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n var dis = disposition;\r\n\r\n string cSharpPath = Path.ChangeExtension(workingDirectory.PathTo(this.expandedSource), CSharpExt);\r\n if (!File.Exists(cSharpPath))\r\n {\r\n // Dafny has a bug where compilation fails but result code is still 0.\r\n dis = new Failed();\r\n }\r\n\r\n if (dis is Fresh)\r\n {\r\n this.RewriteCSharpFile(cSharpPath, workingDirectory.PathTo(this.output));\r\n }\r\n\r\n return dis;\r\n }\r\n\r\n private void RewriteCSharpFile(string inputPath, string outputPath)\r\n {\r\n using (TextWriter writer = new StreamWriter(outputPath))\r\n {\r\n // Compile a list of namespaces that require edits\r\n var namespaces = new Dictionary();\r\n using (TextReader reader = new StreamReader(inputPath))\r\n {\r\n string line; \r\n System.Text.RegularExpressions.Regex pattern = new System.Text.RegularExpressions.Regex(\"namespace @_(\\\\d+)_([\\\\w_]+) {\", System.Text.RegularExpressions.RegexOptions.Compiled);\r\n\r\n while ((line = reader.ReadLine()) != null)\r\n {\r\n var result = pattern.Match(line);\r\n if (result.Success) \r\n {\r\n string old_name = \"_\" + result.Groups[1] + \"_\" + result.Groups[2];\r\n string new_name = \"_\" + result.Groups[2];\r\n namespaces.Add(old_name, new_name);\r\n }\r\n }\r\n }\r\n\r\n using (TextReader reader = new StreamReader(inputPath))\r\n {\r\n string line;\r\n while ((line = reader.ReadLine()) != null)\r\n {\r\n line = line.Replace(IntermediateSourceFilename, this.input.getFileName());\r\n line = line.Replace(\"public class @__default {\", \"public partial class @__default {\");\r\n line = line.Replace(\"@#\", \"@\");\r\n\r\n // Temporary work-around. ToDo: Remove this after Dafny is fixed.\r\n line = line.Replace(\"public class \", \"public partial class \");\r\n\r\n // Another temporary work-around. ToDo: Figure out better solution.\r\n line = line.Replace(\"@_default_Main\", \"@IronfleetMain\");\r\n\r\n // Find a more efficient approach?\r\n foreach (KeyValuePair entry in namespaces) \r\n {\r\n line = line.Replace(entry.Key, entry.Value);\r\n }\r\n\r\n writer.WriteLine(line);\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DafnyExecutableDependencies.cs", "content": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace NuBuild\r\n{\r\n class DafnyExecutableDependencies\r\n {\r\n private static SourcePath dafnyExecutable;\r\n\r\n public static SourcePath getDafnyExecutable()\r\n {\r\n // TODO this should eventually be a BuildObject from *building* the executable.\r\n if (dafnyExecutable == null)\r\n {\r\n dafnyExecutable = new SourcePath(\"tools\\\\Dafny\\\\Dafny.exe\", SourcePath.SourceType.Tools);\r\n }\r\n\r\n return dafnyExecutable;\r\n }\r\n\r\n\r\n public static IEnumerable getDafnyExecutableDependencies()\r\n {\r\n List exeDepends = new List();\r\n\r\n exeDepends.Add(getDafnyExecutable());\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\AbsInt.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\BaseTypes.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\CodeContractsExtender.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Concurrency.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Core.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Dafny.exe.config\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\DafnyPipeline.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\DafnyPrelude.bpl\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Doomed.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\ExecutionEngine.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Graph.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Model.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\msvcp100.dll\", SourcePath.SourceType.Tools)); // Needed by z3.\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\msvcr100.dll\", SourcePath.SourceType.Tools)); // Needed by z3.\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\ParserHelper.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Provers.SMTLib.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\VCExpr.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\VCGeneration.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\vcomp100.dll\", SourcePath.SourceType.Tools)); // Needed by z3.\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\DafnyRuntime.cs\", SourcePath.SourceType.Tools)); // Needed for compilation\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\z3.exe\", SourcePath.SourceType.Tools));\r\n\r\n return exeDepends;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DafnyExtensions.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n internal class DafnyExtensions\r\n {\r\n public static HashSet getForestDependencies(IEnumerable roots, out DependencyDisposition ddisp)\r\n {\r\n HashSet result = new HashSet();\r\n ddisp = DependencyDisposition.Complete;\r\n foreach (BuildObject dfysource in roots)\r\n {\r\n TransitiveDepsVerb depsVerb = new DafnyTransitiveDepsVerb(dfysource);\r\n DependencyDisposition localDDisp;\r\n result.UnionWith(depsVerb.getAvailableDeps(out localDDisp));\r\n ddisp = ddisp.combine(localDDisp);\r\n result.Add(dfysource); // TransitiveDeps *exclude* the root, so we need to add that in, too.\r\n }\r\n\r\n return result;\r\n }\r\n\r\n public static IEnumerable getForestVerbs(IEnumerable roots)\r\n {\r\n return roots.Select(root => new DafnyTransitiveDepsVerb(root));\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DafnyIncludes.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Text.RegularExpressions;\r\n\r\n /// \r\n /// Extractor of Dafny include file names (and related functionality).\r\n /// \r\n internal class DafnyIncludes\r\n : IIncludeFactory\r\n {\r\n /// \r\n /// Regular expression matching Dafny include lines.\r\n /// \r\n private Regex includeRegex;\r\n\r\n /// \r\n /// Temporary working directory used by ExpandDafny method.\r\n /// \r\n private WorkingDirectory workingDirectory;\r\n\r\n /// \r\n /// TextWriter used by ExpandDafny method.\r\n /// \r\n private TextWriter outputWriter;\r\n\r\n /// \r\n /// Set of include files already visited.\r\n /// Used by ExpandDafny method.\r\n /// \r\n private HashSet visited;\r\n\r\n /// \r\n /// Initializes a new instance of the DafnyIncludes class.\r\n /// \r\n public DafnyIncludes()\r\n {\r\n this.includeRegex = new Regex(\"^\\\\s*include\\\\s*\\\"(.*)\\\"\");\r\n }\r\n\r\n /// \r\n /// Gets a list of the include files included in the given Dafny source file.\r\n /// \r\n /// Source file to extract include file names from.\r\n /// List of include file BuildObjects.\r\n public IEnumerable getIncludes(BuildObject dfysource)\r\n {\r\n List outlist = new List();\r\n using (TextReader tr = BuildEngine.theEngine.Repository.OpenRead(dfysource))\r\n {\r\n while (true)\r\n {\r\n string line = tr.ReadLine();\r\n if (line == null)\r\n {\r\n break;\r\n }\r\n\r\n Match match = this.includeRegex.Match(line);\r\n int count = 0;\r\n while (match.Success)\r\n {\r\n string includedPath = match.Groups[1].ToString();\r\n string gluedPath = Path.Combine(dfysource.getDirPath(), includedPath);\r\n SourcePath sp = new SourcePath(gluedPath);\r\n outlist.Add(sp);\r\n count += 1;\r\n match = match.NextMatch(); // That would be unexpected!\r\n }\r\n\r\n Util.Assert(count <= 1);\r\n }\r\n }\r\n\r\n ////Logger.WriteLine(String.Format(\"{0} includes {1} things\", dfysource.getFilesystemPath(), outlist.Count));\r\n return outlist;\r\n }\r\n\r\n /// \r\n /// Expand a dafny source file to include all of its includes inline.\r\n /// \r\n /// Temporary working directory to use.\r\n /// Source build object.\r\n /// Where to create build object for expanded source file.\r\n public void ExpandDafny(WorkingDirectory workingDirectory, SourcePath input, SourcePath output)\r\n {\r\n // Prepare the output stream.\r\n using (TextWriter outWriter = new StreamWriter(workingDirectory.PathTo(output)))\r\n {\r\n // Stash away a few things for use by our recursive helper function.\r\n this.workingDirectory = workingDirectory;\r\n this.outputWriter = outWriter;\r\n this.visited = new HashSet();\r\n\r\n // Recursively expand the initial Dafny source file to inline all of its includes.\r\n this.ExpandDafnyRecurse(input);\r\n }\r\n\r\n // Cache the output file in the Repository.\r\n BuildEngine.theEngine.Repository.Store(workingDirectory, output, new Fresh());\r\n }\r\n\r\n /// \r\n /// Helper function for ExpandDafny method.\r\n /// \r\n /// Next include file to visit.\r\n /// True if the given file wasn't already included, false otherwise.\r\n private bool ExpandDafnyRecurse(SourcePath input)\r\n {\r\n // Only visit each unique include file once.\r\n // Note that SourcePaths (like all BuildObjects) have normalized file paths.\r\n string inputPath = input.getRelativePath();\r\n if (this.visited.Contains(inputPath))\r\n {\r\n return false;\r\n }\r\n else\r\n {\r\n this.visited.Add(inputPath);\r\n }\r\n\r\n using (TextReader reader = new StreamReader(this.workingDirectory.PathTo(input)))\r\n {\r\n while (true)\r\n {\r\n string line = reader.ReadLine();\r\n if (line == null)\r\n {\r\n return true;\r\n }\r\n\r\n Match match = this.includeRegex.Match(line);\r\n if (match.Success)\r\n {\r\n // This is an \"include\" line. Find the included object.\r\n string includedPath = match.Groups[1].ToString();\r\n string gluedPath = Path.Combine(input.getDirPath(), includedPath);\r\n SourcePath nextInclude = new SourcePath(gluedPath);\r\n string nextPath = nextInclude.getRelativePath();\r\n\r\n // Recurse on the new include file.\r\n this.outputWriter.WriteLine(\"//- Begin include {0} (from {1})\", nextPath, inputPath);\r\n if (!this.ExpandDafnyRecurse(nextInclude))\r\n {\r\n this.outputWriter.WriteLine(\"//- Already included {0}\", nextPath);\r\n }\r\n\r\n this.outputWriter.WriteLine(\"//- End include {0} (from {1})\", nextPath, inputPath);\r\n }\r\n else\r\n {\r\n // This isn't an \"include\" line. Write it to our output.\r\n this.outputWriter.WriteLine(line);\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DafnySpecVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class DafnySpecVerb\r\n : DafnyTransformBaseVerb\r\n {\r\n private AbstractId abstractId;\r\n private VSSolutionVerb dafnySpecBuildExecutableVerb;\r\n\r\n public DafnySpecVerb(SourcePath dfyroot, string appLabel)\r\n : base(dfyroot, appLabel)\r\n {\r\n this.abstractId = new AbstractId(this.GetType().Name, this.getVersion() + version, dfyroot.ToString());\r\n this.dafnySpecBuildExecutableVerb = new VSSolutionVerb(new SourcePath(\"tools\\\\DafnySpec\\\\DafnySpec.sln\", SourcePath.SourceType.Tools));\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return base.getVerbs().Concat(new[] { this.dafnySpecBuildExecutableVerb });\r\n }\r\n\r\n protected override int getVersion()\r\n {\r\n return 15;\r\n }\r\n\r\n protected override BuildObject getExecutable()\r\n {\r\n return new BuildObject(Path.Combine(this.dafnySpecBuildExecutableVerb.getOutputPath().getRelativePath(), \"dafnyspec.exe\"));\r\n }\r\n\r\n protected override IEnumerable getExtraDependencies()\r\n {\r\n string exePath = this.dafnySpecBuildExecutableVerb.getOutputPath().getRelativePath();\r\n\r\n // REVIEW: Should we extract the dafnyspec.exe dependencies from the project file instead of listing them manually?\r\n return new BuildObject[] {\r\n new BuildObject(Path.Combine(exePath, \"DafnySpecAst.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"Parser.dll\")),\r\n };\r\n }\r\n\r\n protected override IEnumerable getRoots()\r\n {\r\n // TODO why doesn't DafnyCC require DafnyPreludePath?\r\n return new SourcePath[] { this.getDafnyPrelude(), this.getSeqSpec(), dfyroot };\r\n }\r\n\r\n protected override bool transformFilterAccepts(BuildObject dfysource)\r\n {\r\n string fn = dfysource.getFileNameWithoutExtension();\r\n if (fn.EndsWith(\".\" + DafnyTransformBaseVerb.DAFNY_S_SUFFIX))\r\n {\r\n return true;\r\n }\r\n else\r\n {\r\n Util.Assert(fn.EndsWith(\".\" + DafnyTransformBaseVerb.DAFNY_I_SUFFIX) || fn.EndsWith(\".\" + DafnyTransformBaseVerb.DAFNY_C_SUFFIX) || dfysource.Equals(this.getDafnyPrelude()));\r\n return false;\r\n }\r\n }\r\n\r\n protected override IEnumerable getRootArgs()\r\n {\r\n OrderPreservingSet specFiles = new OrderPreservingSet();\r\n specFiles.Add(this.getDafnyPrelude());\r\n specFiles.Add(this.getSeqSpec());\r\n DependencyDisposition ddisp;\r\n foreach (SourcePath src in this.getAllDafnyModules(out ddisp))\r\n {\r\n if (this.transformFilterAccepts(src))\r\n {\r\n specFiles.Add(src);\r\n }\r\n }\r\n\r\n return specFiles;\r\n }\r\n\r\n private SourcePath getSeqSpec()\r\n {\r\n return new SourcePath(\"src\\\\Trusted\\\\DafnySpec\\\\Seq.s.dfy\");\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DafnyTransformBaseVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal abstract class DafnyTransformBaseVerb\r\n : Verb, IProcessInvokeAsyncVerb\r\n {\r\n public const char DAFNY_S_SUFFIX = 's'; // a trusted specification file\r\n public const char DAFNY_C_SUFFIX = 'c'; // a checked specification file\r\n public const char DAFNY_I_SUFFIX = 'i'; // a checked implementation file\r\n public static readonly char[] DAFNY_SUFFIXES = { DAFNY_S_SUFFIX, DAFNY_C_SUFFIX, DAFNY_I_SUFFIX }; // REVIEW: Never used?\r\n public static readonly string[] DAFNY_LONG_EXTNS =\r\n {\r\n \".\" + DAFNY_S_SUFFIX + DafnyVerifyOneVerb.DAFNY_EXTN,\r\n \".\" + DAFNY_C_SUFFIX + DafnyVerifyOneVerb.DAFNY_EXTN,\r\n \".\" + DAFNY_I_SUFFIX + DafnyVerifyOneVerb.DAFNY_EXTN\r\n };\r\n\r\n protected const int version = 15;\r\n protected const string DAFNY_PRELUDE_DIRECTORY = \"tools\\\\DafnySpec\";\r\n protected const string DAFNY_PRELUDE_FILENAME = \"DafnyPrelude.dfy\";\r\n\r\n protected SourcePath dfyroot;\r\n protected string appLabel;\r\n\r\n public DafnyTransformBaseVerb(SourcePath dfyroot, string appLabel)\r\n {\r\n this.dfyroot = dfyroot;\r\n this.appLabel = appLabel;\r\n\r\n // REVIEW: This is never used by anything. Remove?\r\n IEnumerable roots = this.getRoots().Select(obj => obj.ToString());\r\n }\r\n\r\n private delegate void Tacker(BuildObject dfysource, string filename);\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n HashSet result = DafnyExtensions.getForestDependencies(this.getRoots(), out ddisp);\r\n result.Add(this.getExecutable());\r\n result.UnionWith(this.getExtraDependencies());\r\n return result;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return DafnyExtensions.getForestVerbs(this.getRoots());\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n List outputs = new List();\r\n foreach (InOutMapping mapping in this.getInOutMappings())\r\n {\r\n if (mapping.dfysource == null\r\n || mapping.dfysource.Equals(this.getDafnyPrelude())\r\n || this.transformFilterAccepts(mapping.dfysource))\r\n {\r\n outputs.Add(mapping.basmIfc);\r\n outputs.Add(mapping.basmImp);\r\n }\r\n }\r\n\r\n outputs.Add(new BuildObject(Path.Combine(\r\n this.getDestPath(), \"dafny_modules.txt\")));\r\n return outputs;\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n BuildObject absDestPath = this.getAbsDestPath();\r\n ////Directory.Delete(vfs.ToPath(absDestPath), true); // This verb should be the only one writing here, so let's keep it tidy.\r\n Directory.CreateDirectory(workingDirectory.PathTo(absDestPath)); // REVIEW: Shouldn't PrepareForVerb already do this?\r\n string dafnyccExecutable = this.getExecutable().getRelativePath();\r\n\r\n List args = new List();\r\n args.AddRange(this.getRootArgs().Select(sp => sp.getRelativePath()));\r\n args.Add(\"/outdir:\" + this.getDestPath());\r\n this.addExtraArgs(args);\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n dafnyccExecutable,\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n getDiagnosticsBase());\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n if (disposition is Failed)\r\n {\r\n return disposition;\r\n }\r\n\r\n HashSet createdFiles = new HashSet(Directory.GetFiles(workingDirectory.PathTo(this.getAbsDestPath())).Select(path => Path.GetFileName(path)));\r\n HashSet expectedFiles = new HashSet(this.getOutputs().Select(obj => obj.getFileName()));\r\n\r\n // DafnyCC/DafnySpec process a big batch of files together. Did we correctly understand what it did?\r\n if (!createdFiles.SetEquals(expectedFiles))\r\n {\r\n // REVIEW: These are never used by anything. Remove?\r\n bool dummy = createdFiles.SetEquals(expectedFiles);\r\n int missing = expectedFiles.Except(createdFiles).Count();\r\n int extra = createdFiles.Except(expectedFiles).Count();\r\n\r\n string msg = \"Missing files: \" + string.Join(\",\", expectedFiles.Except(createdFiles)) + \"\\n\" +\r\n \" Extra files: \" + string.Join(\",\", createdFiles.Except(expectedFiles));\r\n return new Failed(msg);\r\n }\r\n\r\n // Propagate the NuBuild annotations.\r\n foreach (InOutMapping mapping in this.getInOutMappings())\r\n {\r\n if (mapping.dfysource != null\r\n && this.transformFilterAccepts(mapping.dfysource))\r\n {\r\n AnnotationScanner.transferAnnotations(\r\n workingDirectory, mapping.dfysource, mapping.basmIfc, BoogieAsmDepBase.CommentSymbol);\r\n AnnotationScanner.transferAnnotations(\r\n workingDirectory, mapping.dfysource, mapping.basmImp, BoogieAsmDepBase.CommentSymbol);\r\n }\r\n }\r\n\r\n return new Fresh();\r\n }\r\n\r\n protected abstract int getVersion();\r\n\r\n protected abstract BuildObject getExecutable();\r\n\r\n // getRoots is the set of dafny files from which we explore to\r\n // discover the set of dependencies. We use the same transitive\r\n // closure to compute the set of allDafnyModules, which tell\r\n // us what output files to expect.\r\n protected abstract IEnumerable getRoots();\r\n\r\n // roots -> dependencies\r\n // roots -> allDafnyModules -> getRootArgs\r\n\r\n // getRootArgs is the set of dafny files we hand to the executable.\r\n // In the DafnyCC case, it's the transitive closure (allDafnyModules),\r\n // in the DafnySpec case, it's the roots only. Weird. And there are\r\n // weird exceptions in both cases.\r\n protected abstract IEnumerable getRootArgs();\r\n\r\n protected virtual IEnumerable getExtraDependencies()\r\n {\r\n return new BuildObject[] { };\r\n }\r\n\r\n protected virtual IEnumerable getExtraSpecialOutputs()\r\n {\r\n return new string[] { };\r\n }\r\n\r\n protected virtual void addExtraArgs(List args)\r\n {\r\n }\r\n\r\n protected virtual bool transformFilterAccepts(BuildObject dfysource)\r\n {\r\n return true;\r\n }\r\n\r\n protected virtual IEnumerable getAllDafnyModules(out DependencyDisposition ddisp)\r\n {\r\n HashSet result = DafnyExtensions.getForestDependencies(this.getRoots(), out ddisp);\r\n\r\n // Now we assert that all Dafny inputs are actually SourcePaths.\r\n HashSet rc = new HashSet();\r\n foreach (BuildObject obj in result)\r\n {\r\n if (obj.getExtension().EndsWith(DafnyVerifyOneVerb.DAFNY_EXTN))\r\n {\r\n rc.Add((SourcePath)obj);\r\n }\r\n else\r\n {\r\n Util.Assert(obj.getExtension().EndsWith(TransitiveDepsVerb.TDEP_EXTN));\r\n // Discard it.\r\n }\r\n }\r\n\r\n return rc;\r\n }\r\n\r\n protected SourcePath getDafnyPrelude()\r\n {\r\n return new SourcePath(Path.Combine(DAFNY_PRELUDE_DIRECTORY, DAFNY_PRELUDE_FILENAME), SourcePath.SourceType.Tools);\r\n }\r\n\r\n private string getDestPath()\r\n {\r\n // This logic duplicates BuildObject.makeLabeledOutputObject; the interface isn't tidily\r\n // factored for reuse yet.\r\n string path = this.GetType().Name;\r\n if (this.appLabel != null)\r\n {\r\n path = Path.Combine(this.appLabel, path);\r\n }\r\n\r\n path = Path.Combine(BuildEngine.theEngine.getObjRoot(), path);\r\n return path;\r\n }\r\n\r\n private BuildObject basmOutputForDafnyModule(string modulename, string extn)\r\n {\r\n bool isTrusted =\r\n (modulename.EndsWith(\"_\" + DAFNY_S_SUFFIX)\r\n || modulename.Equals(\"Trusted\"))\r\n && BeatExtensions.whichPart(extn) == ModPart.Imp;\r\n return new BuildObject(Path.Combine(this.getDestPath(), modulename + extn), isTrusted: isTrusted);\r\n }\r\n\r\n private BuildObject getAbsDestPath()\r\n {\r\n return new BuildObject(this.getDestPath());\r\n }\r\n\r\n private List getInOutMappings()\r\n {\r\n List mapping = new List();\r\n Tacker tack = delegate(BuildObject dfysource, string filename)\r\n {\r\n mapping.Add(new InOutMapping(\r\n dfysource,\r\n this.basmOutputForDafnyModule(filename, BoogieAsmVerifyVerb.BASMIFC_EXTN),\r\n this.basmOutputForDafnyModule(filename, BoogieAsmVerifyVerb.BASMIMP_EXTN)));\r\n };\r\n\r\n DependencyDisposition ddispDummy;\r\n foreach (SourcePath dfy in this.getAllDafnyModules(out ddispDummy))\r\n {\r\n // Trim off \".dfy\" but not \".s\" or \".i\".\r\n string dfyname = dfy.getFileName();\r\n Util.Assert(dfyname.EndsWith(\".dfy\"));\r\n string basename = dfyname.Substring(0, dfyname.Length - 4);\r\n Util.Assert(basename.Equals(dfy.getFileNameWithoutExtension())); // TODO delete prior lines.\r\n\r\n basename = Util.dafnySpecMungeName(basename);\r\n if ((this is DafnyCCVerb)\r\n && (basename.Equals(\"Seq\") || basename.Equals(\"Seq_s\")))\r\n { // TODO undesirable workaround -- DafnyCC doesn't want 'seq.dfy' in its output list, but DafnySpec does...?\r\n continue;\r\n }\r\n\r\n tack(dfy, \"dafny_\" + basename);\r\n }\r\n\r\n tack(null, \"Trusted\"); // DafnyCC doesn't really want this, but meh, it emits it, so we account for it.\r\n foreach (string basename in this.getExtraSpecialOutputs())\r\n {\r\n tack(null, basename);\r\n }\r\n\r\n return mapping;\r\n }\r\n\r\n private class InOutMapping\r\n {\r\n public readonly BuildObject dfysource; // null --> outputs come from bowels of DafnySpec/DafnyCC.\r\n public readonly BuildObject basmIfc;\r\n public readonly BuildObject basmImp;\r\n\r\n public InOutMapping(BuildObject dfysource, BuildObject basmIfc, BuildObject basmImp)\r\n {\r\n this.dfysource = dfysource;\r\n this.basmIfc = basmIfc;\r\n this.basmImp = basmImp;\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DafnyTransitiveDepsVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class DafnyTransitiveDepsVerb\r\n : TransitiveDepsVerb\r\n {\r\n public DafnyTransitiveDepsVerb(BuildObject input)\r\n : base(input)\r\n {\r\n }\r\n\r\n protected override TransitiveDepsVerb factory(BuildObject obj)\r\n {\r\n return new DafnyTransitiveDepsVerb(obj);\r\n }\r\n\r\n protected override IIncludeFactory getIncludeFactory()\r\n {\r\n return new DafnyIncludes();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DafnyVerifyOneVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class DafnyVerifyOneVerb\r\n : VerificationResultVerb, IProcessInvokeAsyncVerb\r\n {\r\n public const string DAFNY_EXTN = \".dfy\";\r\n private const int version = 18;\r\n private const string ADDDAFNYFLAG_LABEL = \"AddDafnyFlag\";\r\n\r\n private SourcePath dfysource;\r\n private AbstractId abstractId;\r\n\r\n public DafnyVerifyOneVerb(SourcePath dfysource)\r\n {\r\n this.dfysource = dfysource;\r\n this.abstractId = new AbstractId(this.GetType().Name, version, dfysource.ToString()); \r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n TransitiveDepsVerb depsVerb = this.getTransitiveDepsVerb();\r\n HashSet result = depsVerb.getAvailableDeps(out ddisp);\r\n result.UnionWith(DafnyExecutableDependencies.getDafnyExecutableDependencies());\r\n return result;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new IVerb[0]; // All inputs are sources.\r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n return this.dfysource.makeOutputObject(\".dfy.v\");\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new[] { this.getOutputFile() };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n List arguments = new List(); \r\n arguments.Add(\"/noNLarith\");\r\n arguments.Add(\"/allowGlobals\");\r\n arguments.Add(\"/dafnycc\");\r arguments.Add(\"/z3opt:ARITH_RANDOM_SEED=1\");\r\n arguments.Add(\"/z3opt:NL_ARITH=false\");\r\n arguments.Add(\"/compile:0\");\r\n arguments.Add(\"/timeLimit:30\");\r\n arguments.Add(\"/noCheating:1\");\r\n \r\n foreach (string[] ann in new AnnotationScanner(this.dfysource).getAnnotations(ADDDAFNYFLAG_LABEL))\r\n {\r\n if (ann.Length != 2)\r\n {\r\n throw new SourceConfigurationError(\"Expected exactly 1 argument to \" + ADDDAFNYFLAG_LABEL);\r\n }\r\n if (ann[1].StartsWith(\"/z3opt:NL_ARITH=true\")) {\r\n arguments.Remove(\"/noNLarith\");\r\n }\r\n\r\n arguments.Add(ann[1]);\r\n }\r\n\r\n arguments.Add(this.dfysource.getRelativePath());\r\n Logger.WriteLine(\"arguments: \" + string.Join(\" \", arguments));\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n DafnyExecutableDependencies.getDafnyExecutable().getRelativePath(),\r\n arguments.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsOkay,\r\n getDiagnosticsBase(),\r\n returnStandardOut: true,\r\n returnStandardError: true,\r\n allowCloudExecution: true);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n VerificationResult vr = new VerificationResult(\r\n this.dfysource.getRelativePath(),\r\n cpuTimeSeconds,\r\n stdout,\r\n stderr,\r\n new VerificationResultDafnyParser());\r\n vr.addBasicPresentation();\r\n vr.toXmlFile(workingDirectory.PathTo(this.getOutputFile()));\r\n this.setWasRejectableFailure(!vr.pass);\r\n return disposition;\r\n }\r\n\r\n public IEnumerable getDirectIncludes()\r\n {\r\n // By the time this method is called by VerbToposorter,\r\n // this verb is scheduled for execution, and hence its deps\r\n // are complete. So all of these lookups should succeed.\r\n // (wait, does that follow?)\r\n return this.getTransitiveDepsVerb().getShallowIncludes();\r\n }\r\n\r\n protected override BuildObject getSource()\r\n {\r\n return this.dfysource;\r\n }\r\n\r\n private TransitiveDepsVerb getTransitiveDepsVerb()\r\n {\r\n return new DafnyTransitiveDepsVerb(this.dfysource);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DafnyVerifyTreeVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n internal class DafnyVerifyTreeVerb\r\n : Verb, IObligationsProducer\r\n {\r\n private const int version = 30;\r\n\r\n private const string DFYTREE_EXTN = \".dfytree\";\r\n\r\n private SourcePath displayRoot; // used only in labeling the output\r\n private BuildObject obligations;\r\n private AbstractId abstractId;\r\n\r\n public DafnyVerifyTreeVerb(SourcePath root)\r\n {\r\n this.displayRoot = root;\r\n this.obligations = root.makeOutputObject(DFYTREE_EXTN + VerificationObligationList.VOL_EXTN);\r\n this.abstractId = new AbstractId(this.GetType().Name, version, root.ToString());\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public BuildObject getObligationSet()\r\n {\r\n return this.obligations;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n HashSet availableDeps = this.getAvailableDeps(out ddisp);\r\n\r\n List true_deps = new List();\r\n foreach (BuildObject dep in availableDeps)\r\n {\r\n if (dep.getExtension().EndsWith(DafnyVerifyOneVerb.DAFNY_EXTN))\r\n {\r\n true_deps.Add(this.mkVerificationObject(dep));\r\n }\r\n else\r\n {\r\n true_deps.Add(dep);\r\n }\r\n }\r\n\r\n return true_deps;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n // TODO cast below assumes dafny files are always source files.\r\n // That's easy enough to remedy in DafnyVerifyOneVerb ctor, but for\r\n // now, we continue assuming it. \r\n // This will matter if we ever auto-generate a Dafny file.\r\n DependencyDisposition ddispDummy;\r\n IEnumerable result = this.getDafnyDependencies(out ddispDummy)\r\n .Select(dfysource => new DafnyVerifyOneVerb((SourcePath)dfysource))\r\n .Concat(new List() { new DafnyTransitiveDepsVerb(this.displayRoot) });\r\n\r\n return result;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new HashSet() { this.obligations };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n IEnumerable verificationResults = this.getVerbs()\r\n .Where(verb => verb is VerificationResultVerb)\r\n .Select(dfy_one => ((VerificationResultVerb)dfy_one).getOutputFile());\r\n VerificationObligationList vol = new VerificationObligationList(verificationResults);\r\n vol.store(workingDirectory, this.obligations);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n\r\n private BuildObject mkVerificationObject(BuildObject dfysource)\r\n {\r\n return dfysource.makeOutputObject(DafnyVerifyOneVerb.DAFNY_EXTN + VerificationResultVerb.VERIFICATION_RESULT_EXTN);\r\n }\r\n\r\n private HashSet getAvailableDeps(out DependencyDisposition ddisp)\r\n {\r\n TransitiveDepsVerb depsVerb = new DafnyTransitiveDepsVerb(this.displayRoot);\r\n HashSet availableDeps = depsVerb.getAvailableDeps(out ddisp);\r\n availableDeps.Add(this.displayRoot); // TransitiveDeps *exclude* the root, so we need to add that in, too.\r\n return availableDeps;\r\n }\r\n\r\n private IEnumerable getDafnyDependencies(out DependencyDisposition ddisp)\r\n {\r\n HashSet result = this.getAvailableDeps(out ddisp);\r\n return result.Where(dep => dep.getExtension().EndsWith(DafnyVerifyOneVerb.DAFNY_EXTN));\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DbgFileCopySpeedTest.cs", "content": "namespace NuBuild\r\n{\r\n using System;\r\n using System.IO;\r\n\r\n internal class DbgFileCopySpeedTest\r\n {\r\n public static void thing()\r\n {\r\n Directory.SetCurrentDirectory(\"c:\\\\users\\\\howell\\\\verve2\\\\iron\");\r\n Directory.CreateDirectory(\"dummy\");\r\n Directory.CreateDirectory(\"dummy\\\\Results\");\r\n Directory.CreateDirectory(\"dummy\\\\Objects\");\r\n Directory.CreateDirectory(\"dummy\\\\Sources\");\r\n foreach (string path in Directory.EnumerateFiles(\"nucache\", \"*\", SearchOption.AllDirectories))\r\n {\r\n string fn = path.Substring(path.IndexOf(\"nucache\") + 8);\r\n string source = Path.Combine(\"nucache\", fn);\r\n string dest = Path.Combine(\"dummy\", fn);\r\n ////Logger.WriteLine(\"Copy \" + source + \" to \" + dest);\r\n ////File.Copy(source, dest);\r\n\r\n File.Delete(dest);\r\n using (FileStream outStream = File.OpenWrite(dest))\r\n {\r\n bool dummy = File.Exists(source);\r\n using (Stream inStream = File.OpenRead(source))\r\n {\r\n inStream.CopyTo(outStream);\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DbgHashSpeedTest.cs", "content": "namespace NuBuild\r\n{\r\n using System;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class DbgHashSpeedTest\r\n {\r\n public static void thing()\r\n {\r\n Directory.SetCurrentDirectory(\"c:\\\\users\\\\howell\\\\verve2\\\\iron\");\r\n string[] theFiles = File.ReadAllLines(\"hashlist\");\r\n Logger.WriteLine(\"I found \" + theFiles.Count() + \" files\");\r\n\r\n foreach (string file in theFiles)\r\n {\r\n string s = Util.hashFilesystemPath(file);\r\n Logger.WriteLine(s);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DbgVerbCounter.cs", "content": "namespace NuBuild\r\n{\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\n // I used this class to determine how much effort we were wasting\r\n // re-computing verb.getDependencies.\r\n internal class DbgVerbCounter\r\n {\r\n public enum DbgVerbCondition { DVWake, DVDepsIncomplete, DVDepsStale, DVDepsNonstale, DVTotal }\r\n private Dictionary, int> dbgCounts = new Dictionary, int>();\r\n\r\n public void dbgDisplayCounts()\r\n {\r\n List> keys = new List>(dbgCounts.Keys);\r\n keys.Sort();\r\n foreach (Tuple key in keys)\r\n {\r\n Logger.WriteLine(string.Format(\"{0:20}: {1}\", key, dbgCounts[key]));\r\n }\r\n }\r\n\r\n public void consider(IVerb verb, DbgVerbCondition cond)\r\n {\r\n consider_inner(new Tuple(verb, cond));\r\n consider_inner(new Tuple(verb, DbgVerbCondition.DVTotal));\r\n }\r\n\r\n private void consider_inner(Tuple key)\r\n {\r\n if (!dbgCounts.ContainsKey(key))\r\n {\r\n dbgCounts[key] = 0;\r\n }\r\n\r\n dbgCounts[key] += 1;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DependencyCache.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class DependencyCache\r\n {\r\n private Dictionary theCache;\r\n private int dbgQueries = 0;\r\n private int dbgMisses = 0;\r\n\r\n public DependencyCache()\r\n {\r\n this.theCache = new Dictionary();\r\n }\r\n\r\n public IEnumerable getDependencies(IVerb verb, out DependencyDisposition ddisp)\r\n {\r\n this.dbgQueries += 1;\r\n DependencyResult result;\r\n bool present = this.theCache.TryGetValue(verb, out result);\r\n if (!present)\r\n {\r\n this.dbgMisses += 1;\r\n result = new DependencyResult();\r\n result.deps = verb.getDependencies(out result.ddisp);\r\n if (result.ddisp != DependencyDisposition.Incomplete)\r\n {\r\n // Can't cache incomplete results, since they may change upon\r\n // later inspection.\r\n this.theCache[verb] = result;\r\n }\r\n }\r\n\r\n ddisp = result.ddisp;\r\n return result.deps;\r\n }\r\n\r\n public void dbgPrintStats()\r\n {\r\n Logger.WriteLine(string.Format(\r\n \"DependencyCache queries {0} misses {1}\", this.dbgQueries, this.dbgMisses));\r\n }\r\n\r\n private class DependencyResult\r\n {\r\n public IEnumerable deps;\r\n public DependencyDisposition ddisp;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/DependencyDisposition.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n public enum DependencyDisposition\r\n {\r\n Complete,\r\n Incomplete,\r\n Failed // Something failed upstream\r\n }\r\n\r\n public static class DependencyDispositionExtensions\r\n {\r\n public static DependencyDisposition combine(this DependencyDisposition a, DependencyDisposition b)\r\n {\r\n if (a == DependencyDisposition.Failed || b == DependencyDisposition.Failed)\r\n {\r\n return DependencyDisposition.Failed;\r\n }\r\n\r\n if (a == DependencyDisposition.Incomplete || b == DependencyDisposition.Incomplete)\r\n {\r\n return DependencyDisposition.Incomplete;\r\n }\r\n\r\n return DependencyDisposition.Complete;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/Disposition.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Xml;\r\n\r\n internal class Disposition\r\n {\r\n public const string _xml_tag = \"Disposition\";\r\n private const string _xml_value_attr = \"Value\";\r\n\r\n public static Disposition readXml(XmlReader xr)\r\n {\r\n Util.Assert(xr.Name.Equals(_xml_tag));\r\n string value = xr.GetAttribute(_xml_value_attr);\r\n if (value.Equals(Fresh.Value))\r\n {\r\n return new Fresh();\r\n }\r\n else if (value.Equals(Failed.Value))\r\n {\r\n return Failed.readXml(xr);\r\n }\r\n else\r\n {\r\n throw new Exception(\"Invalid disposition value \" + value);\r\n }\r\n }\r\n\r\n public virtual IEnumerable getMessages()\r\n {\r\n return new string[0];\r\n }\r\n\r\n public virtual void writeXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(_xml_tag);\r\n xw.WriteAttributeString(_xml_value_attr, ToString());\r\n this.writeXmlExtend(xw);\r\n xw.WriteEndElement();\r\n }\r\n\r\n protected virtual void writeXmlExtend(XmlWriter xw)\r\n {\r\n }\r\n }\r\n\r\n internal class Stale : Disposition\r\n {\r\n public const string Value = \"Stale\";\r\n\r\n public override string ToString()\r\n {\r\n return Value;\r\n }\r\n }\r\n\r\n internal class Fresh : Disposition\r\n {\r\n public const string Value = \"Fresh\";\r\n\r\n public override string ToString()\r\n {\r\n return Value;\r\n }\r\n }\r\n\r\n /// \r\n /// Failed represents a PERMANENT failure. Any non-Stale disposition is recorded\r\n /// permanently in the build cache (including the globally-shared build cache!),\r\n /// preventing that particular verb from ever being tried again. Only record a\r\n /// Failed disposition if repeating the verb is guaranteed to fail again the same way.\r\n /// \r\n internal class Failed : Disposition\r\n {\r\n public const string Value = \"Failed\";\r\n private const string _xml_MessageTag = \"Message\";\r\n\r\n private List messages;\r\n\r\n public Failed(string msg = null)\r\n {\r\n this.messages = new List();\r\n if (msg != null)\r\n {\r\n this.AddError(msg);\r\n }\r\n }\r\n\r\n public Failed(IEnumerable messages)\r\n {\r\n this.messages = new List(messages);\r\n }\r\n\r\n public static new Disposition readXml(XmlReader xr)\r\n {\r\n List messages = new List();\r\n if (!xr.IsEmptyElement)\r\n {\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n if (xr.Name.Equals(_xml_MessageTag))\r\n {\r\n messages.Add(xr.ReadElementContentAsString());\r\n }\r\n else\r\n {\r\n throw new Exception(\"Unrecognized Disposition::Failed tag \" + xr.Name);\r\n }\r\n }\r\n else if (xr.NodeType == XmlNodeType.EndElement)\r\n {\r\n Util.Assert(xr.Name.Equals(Disposition._xml_tag));\r\n break;\r\n }\r\n }\r\n }\r\n\r\n Failed f = new Failed();\r\n f.messages = messages;\r\n return f;\r\n }\r\n\r\n public void AddError(string msg)\r\n {\r\n this.messages.Add(msg);\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return Failed.Value;\r\n }\r\n\r\n public override IEnumerable getMessages()\r\n {\r\n return this.messages;\r\n }\r\n\r\n protected override void writeXmlExtend(XmlWriter xw)\r\n {\r\n foreach (string message in this.messages)\r\n {\r\n xw.WriteStartElement(_xml_MessageTag);\r\n xw.WriteString(message);\r\n xw.WriteEndElement();\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/EntryStitcherVerb.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n using System;\n using System.Collections.Generic;\n using System.IO;\n using System.Linq;\n\n internal class EntryStitcherVerb\n : Verb\n {\n private const int version = 10;\n private const string SENTINEL_APP_SPECIFIC_GOES_HERE = \"//- SENTINEL_APP_SPECIFIC_GOES_HERE\";\n\n private string appLabel;\n private IContextGeneratingVerb context; // Label our abstractIdentifier\n private BeatVerb mainBeatVerb;\n private SourcePath genericStitch;\n private SourcePath appSpecificStitch;\n\n private BuildObject dafnyMainImpInput;\n private BuildObject dafnyMainIfcInput;\n private SourcePath entryImpInput;\n\n public EntryStitcherVerb(IContextGeneratingVerb context, string appLabel)\n {\n this.appLabel = appLabel;\n this.context = context;\n this.entryImpInput = new SourcePath(\"src\\\\Checked\\\\Nucleus\\\\Main\\\\Entry.imp.beat\");\n SourcePath mainBeatSrc = new SourcePath(\"src\\\\Checked\\\\Nucleus\\\\Main\\\\Main.ifc.beat\");\n this.mainBeatVerb = new BeatVerb(context, mainBeatSrc, appLabel);\n this.genericStitch = new SourcePath(\"src\\\\Trusted\\\\Spec\\\\Entry.ifc.basm.stitch\");\n this.appSpecificStitch = new SourcePath(string.Format(\"src\\\\Trusted\\\\Spec\\\\{0}\\\\AppRequirements.ifc.stitch\", appLabel));\n }\n\n public override AbstractId getAbstractIdentifier()\n {\n return new AbstractId(this.GetType().Name, version, this.genericStitch.ToString(), concrete: this.appLabel);\n }\n\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\n {\n ddisp = DependencyDisposition.Complete;\n\n OrderPreservingSet deps = new OrderPreservingSet();\n\n // Things we need to stitch the interface:\n deps.Add(this.genericStitch);\n deps.Add(this.appSpecificStitch);\n deps.AddRange(this.mainBeatVerb.getOutputs());\n\n // Things we need to stitch the imports into the imp file:\n deps.Add(this.entryImpInput);\n deps.Add(this.context.getContextOutput());\n IIncludePathContext pathContext = this.context.fetchIfAvailable(ref ddisp);\n if (pathContext != null)\n {\n this.dafnyMainIfcInput = pathContext.search(\"dafny_Main_i\", ModPart.Ifc);\n Util.Assert(this.dafnyMainIfcInput != null);\n deps.Add(this.dafnyMainIfcInput);\n this.dafnyMainImpInput = pathContext.search(\"dafny_Main_i\", ModPart.Ifc);\n Util.Assert(this.dafnyMainImpInput != null);\n deps.Add(this.dafnyMainImpInput);\n }\n\n return deps;\n }\n\n public override IEnumerable getVerbs()\n {\n return new IVerb[] { this.mainBeatVerb, this.context };\n }\n\n public override IEnumerable getOutputs()\n {\n return new BuildObject[] { this.getIfcOutput(), this.getEntryImpOutput() };\n }\n\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\n {\n // Mimic this line from src\\Checked\\Nucleus\\Main\\build.ps1:\n // _cat -out $OBJ\\EntryCP_i.bpl -in $OBJ\\MainCP_i.bpl,$SPEC_OBJ\\EntryCP_i.bpl\n // TODO: eliminate this special-case workaround.\n try\n {\n // This is the trusted bit, creating the stitched ifc file.\n ////IEnumerable ifcImports = extractImportStatements(dafnyMainIfcInput);\n string[] mainLines = File.ReadAllLines(workingDirectory.PathTo(this.mainBeatVerb.getOutputs().First()));\n string[] entryLines = File.ReadAllLines(workingDirectory.PathTo(this.genericStitch));\n int sentinel_index = Array.IndexOf(entryLines, SENTINEL_APP_SPECIFIC_GOES_HERE);\n if (sentinel_index < 0)\n {\n throw new UserError(\"Sentinel string missing in \" + this.genericStitch);\n }\n\n IEnumerable entryPrologue = entryLines.Take(sentinel_index + 1);\n IEnumerable entryEpilogue = entryLines.Skip(sentinel_index + 1);\n string[] appSpecificLines = File.ReadAllLines(workingDirectory.PathTo(this.appSpecificStitch));\n ////File.WriteAllLines(getIfcOutput().getFilesystemPath(), ifcImports.Concat(mainLines.Concat(entryLines)));\n File.WriteAllLines(\n workingDirectory.PathTo(this.getIfcOutput()),\n mainLines.Concat(entryPrologue).Concat(appSpecificLines).Concat(entryEpilogue));\n\n // Here's some (at least untrusted) workaround, snarfing and repurposing the\n // import list from dafny_Main_i up to Entry.imp.\n IEnumerable impImports = extractImportStatements(workingDirectory, this.dafnyMainImpInput);\n string[] intext = File.ReadAllLines(workingDirectory.PathTo(this.entryImpInput));\n File.WriteAllLines(workingDirectory.PathTo(this.getEntryImpOutput()), impImports.Concat(intext));\n\n return new VerbSyncWorker(workingDirectory, new Fresh());\n }\n catch (IOException ex)\n {\n return new VerbSyncWorker(workingDirectory, new Failed(ex.ToString()));\n }\n }\n\n // We also have to stitch the imp, to borrow the private-import list from dafny_Main.\n internal BuildObject getEntryImpOutput()\n {\n return new SourcePath(\"src\\\\Checked\\\\Nucleus\\\\Main\\\\EntryStitched.x\").makeLabeledOutputObject(this.appLabel, BeatExtensions.BEATIMP_EXTN);\n }\n\n private static IEnumerable extractImportStatements(WorkingDirectory workingDirectory, BuildObject obj)\n {\n // Well, it might be nice to use BeatExtensions.propagatePrivateImports, but that requires\n // a context to interpret the input imports. We don't really want to cons up yet ANOTHER\n // intermediate context, so here's a temporary workaround. Caution; may be brittle.\n IEnumerable imports = File.ReadAllLines(workingDirectory.PathTo(obj))\n .Where(line => line.Contains(\"private-import\"));\n\n // Note that dafny_Main_i didn't really expect us to steal its\n // imports, so it hasn't conditioned the Checked and Trusted imports to be beat-resistant.\n imports = imports.Select(\n line => line.Contains(\"Checked\") || line.Contains(\"Trusted\")\n ? line.Replace(\"private-import\", \"private-basmonly-import\")\n : line);\n return imports;\n }\n\n private BuildObject getIfcOutput()\n {\n // TODO will probably require parameterization per app\n return new SourcePath(\"src\\\\Trusted\\\\Spec\\\\EntryStitched.x\").makeLabeledOutputObject(this.appLabel, BoogieAsmVerifyVerb.BASMIFC_EXTN);\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/Hasher.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n /// \r\n /// Strange mixture of hash-related functionality and a\r\n /// mapping from build objects to the verbs that created them?\r\n /// Actually, looks like everything here would more appropriately be elsewhere.\r\n /// DONE: Move outputToVerbMap to Scheduler.\r\n /// DONE: Move marshalledFilesystemPaths to Repository.\r\n /// TODO: Move contextResolutionCache to boogie/asm something or other.\r\n /// TODO: Move parsedIncludesCache to BeatIncludes?\r\n /// \r\n internal class Hasher : IHasher\r\n {\r\n private CachedHash, BuildObject> contextResolutionCache;\r\n\r\n private CachedHash, List> parsedIncludesCache;\r\n\r\n public Hasher()\r\n {\r\n this.contextResolutionCache = new CachedHash, BuildObject>(\r\n delegate(Tuple key)\r\n {\r\n return key.Item1.search(key.Item2, key.Item3);\r\n });\r\n\r\n this.parsedIncludesCache = new CachedHash, List>(\r\n delegate(Tuple key)\r\n {\r\n return BeatIncludes.parseLabeledIncludes(key.Item1, key.Item2);\r\n });\r\n }\r\n\r\n public BuildObject search(IIncludePathContext context, string modName, ModPart modPart)\r\n {\r\n return this.contextResolutionCache.get(new Tuple(context, modName, modPart));\r\n }\r\n\r\n public List getParsedIncludes(IIncludePathContext context, BuildObject beatsrc)\r\n {\r\n return this.parsedIncludesCache.get(new Tuple(context, beatsrc));\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IAsmProducer.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal interface IAsmProducer : IVerb\r\n {\r\n BuildObject getAsmFile();\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IContextGeneratingVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal interface IContextGeneratingVerb\r\n : IVerb\r\n {\r\n string getContextIdentifier();\r\n\r\n PoundDefines getPoundDefines();\r\n\r\n BuildObject getContextOutput();\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IHasher.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n /// \r\n /// REVIEW: Why is this an interface?\r\n /// \r\n internal interface IHasher\r\n {\r\n BuildObject search(IIncludePathContext context, string modName, ModPart modPart);\r\n\r\n List getParsedIncludes(IIncludePathContext context, BuildObject beatsrc);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IIncludeFactory.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal interface IIncludeFactory\r\n {\r\n IEnumerable getIncludes(BuildObject path);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IIncludePathContext.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal interface IIncludePathContext\r\n {\r\n BuildObject search(string basename, ModPart modPart = ModPart.Ifc);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IItemCache.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n /// \r\n /// Enumeration of the containers in the item cache.\r\n /// \r\n /// \r\n /// Important: The names of the values in the enumeration below become the\r\n /// actual names of the item cache containers. For the Azure blob backing\r\n /// store, this means they must be a valid DNS name (i.e. may ONLY be\r\n /// comprised of letters, numbers and the dash ('-') character).\r\n /// \r\n public enum ItemCacheContainer\r\n {\r\n /// \r\n /// Item cache container for source files.\r\n /// \r\n Sources = 0,\r\n\r\n /// \r\n /// Item cache container for object files.\r\n /// \r\n Objects = 1,\r\n\r\n /// \r\n /// Item cache container for (successful) result records.\r\n /// \r\n Results = 2,\r\n\r\n /// \r\n /// Item cache container for unsuccessful result records.\r\n /// \r\n FailedResults = 3\r\n }\r\n\r\n /// \r\n /// Definition of the interface to the item cache.\r\n /// \r\n public interface IItemCache\r\n {\r\n /// \r\n /// Gets a human-readable name for this item cache implementation.\r\n /// \r\n string Name\r\n {\r\n get;\r\n }\r\n\r\n /// \r\n /// Copies the given item from the cache to a new byte array.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A byte array containing a copy of the item.\r\n byte[] FetchItem(\r\n ItemCacheContainer container,\r\n string itemHash);\r\n\r\n /// \r\n /// Copies the given item from the cache to the given location in the\r\n /// local file system.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// \r\n /// Location in the local file system to copy the item.\r\n /// \r\n void FetchItemToFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemDestinationPath);\r\n\r\n /// \r\n /// Copies the given byte array to the desired cache item.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// Byte array containing the item.\r\n void StoreItem(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n byte[] contents);\r\n\r\n /// \r\n /// Copies the given file from the local file system into the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// \r\n /// Location in the local file system from which to source the item.\r\n /// \r\n void StoreItemFromFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemSourcePath);\r\n\r\n /// \r\n /// Deletes an item from the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n void DeleteItem(\r\n ItemCacheContainer container,\r\n string itemHash);\r\n\r\n /// \r\n /// Gets a HashSet containing the hash keys of all the items in the\r\n /// given container.\r\n /// \r\n /// Identifier for the cache container.\r\n /// A HashSet containing the hash keys.\r\n HashSet GetItemsInContainer(\r\n ItemCacheContainer container);\r\n\r\n /// \r\n /// Gets the size of the item.\r\n /// Returns -1 if the item is absent.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// Size of the item in bytes, or -1 if item is absent.\r\n long GetItemSize(\r\n ItemCacheContainer container,\r\n string itemHash);\r\n\r\n /// \r\n /// Gets the last-modified time of the item.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A DateTimeOffset containing the item's last-modified time.\r\n DateTimeOffset? GetItemLastModifiedTime(\r\n ItemCacheContainer container,\r\n string itemHash);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IObligationsProducer.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n \r\n internal interface IObligationsProducer : IVerb\r\n {\r\n BuildObject getObligationSet();\r\n\r\n ////BuildObject getIdentifier();\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IProcessInvokeAsyncVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n /// \r\n /// Interface that verbs which use ProcessInvokeAsyncWorker as their\r\n /// VerbWorker must provide (for callbacks from same).\r\n /// \r\n internal interface IProcessInvokeAsyncVerb : IVerb\r\n {\r\n /// \r\n /// Records the CPU time used by the async worker process.\r\n /// \r\n /// The CPU time used.\r\n void RecordProcessInvokeCpuTime(double cpuTimeSeconds);\r\n\r\n /// \r\n /// Performs any required post-processing and/or cleanup of the\r\n /// results of the async worker process.\r\n /// \r\n /// \r\n /// The private working directory the verb executed in.\r\n /// \r\n /// \r\n /// CPU time used by async process.\r\n /// \r\n /// \r\n /// Standard out from async process (if requested).\r\n /// \r\n /// \r\n /// Standard error from async process (if requested).\r\n /// \r\n /// \r\n /// The disposition of the async process.\r\n /// \r\n /// \r\n /// The ultimate disposition of the worker activity.\r\n /// \r\n Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IProcessInvoker.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n /// \n /// Definition of the interface to local and cloud process invokers.\n /// \n internal interface IProcessInvoker\n {\n /// \n /// Gets the exit code returned by the process.\n /// \n int ExitCode { get; }\n\n /// \n /// Gets the CPU time used by the process, in seconds.\n /// \n double CpuTime { get; }\n\n /// \n /// Gets the process's standard output in the default case.\n /// Does not return the standard output if it is redirected to a file (i.e. if CaptureStdout is non-null).\n /// \n /// The process's standard output.\n string GetStdout();\n\n /// \n /// Gets the process's standard error output.\n /// \n /// The process's standard error output.\n string GetStderr();\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IRejectable.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n \r\n internal interface IRejectable\r\n {\r\n bool resultWasRejectableFailure();\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Xml;\r\n\r\n /// \r\n /// Definition of the interface to Verbs.\r\n /// \r\n internal interface IVerb\r\n : IComparable\r\n {\r\n /// \r\n /// Gets a possibly-incomplete list of things we depend on.\r\n /// \r\n /// \r\n /// When the list is complete, it should cover every BuildObject\r\n /// this verb can see when running its worker's methods.\r\n /// That means that it's not safe, for example, to say\r\n /// \"I only depend on my .exe and DafnyTransitiveDepsVerb(root).obj()\".\r\n /// One might think so, since the Freshness of the latter implies that\r\n /// every object this verb needs is Fresh, but that doesn't convey\r\n /// what BuildObjects need to (potentially) be transmitted remotely for\r\n /// running the verb's worker's methods on a remote machine.\r\n /// \r\n /// It should also cover any buildObjects needed to complete the list.\r\n /// That is, if the verb depends on a .tdep, and that .tdep is incomplete,\r\n /// the list should include that .tdep's partial dependency list, so\r\n /// the scheduler can figure out how to get it done.\r\n /// \r\n /// The returned DependencyDisposition.\r\n /// \r\n /// A collection of build objects this verb depends upon.\r\n /// \r\n IEnumerable getDependencies(out DependencyDisposition ddisp);\r\n \r\n /// \r\n /// Gets a list of the verbs that can build the dependencies visible to\r\n /// getDependencies. May return an incomplete list if getDependencies\r\n /// is incomplete.\r\n /// \r\n /// \r\n /// A collection of verbs that can build this verb's dependencies.\r\n /// \r\n IEnumerable getVerbs();\r\n \r\n /// \r\n /// Gets a list of the build objects this verb generates upon successful\r\n /// execution.\r\n /// \r\n /// \r\n /// getOutputs is only meaningful once getDependencies indicates\r\n /// a complete disposition. The set of outputs doesn't change.\r\n /// \r\n /// A collection of build objects built by this verb.\r\n IEnumerable getOutputs();\r\n\r\n /// \r\n /// Gets the list of BuildObjects this verb generates containing\r\n /// diagnostic information. Diagnostics are never used as inputs\r\n /// by other verbs; they are only for the user's inspection.\r\n /// TODO: Rename to getDiagnosticOutputs().\r\n /// \r\n /// The collection of diagnostic BuildObjects.\r\n IEnumerable getFailureOutputs();\r\n\r\n /// \r\n /// Gets an identifier that describes the verb up to differences in\r\n /// input.\r\n /// \r\n /// \r\n /// This method must always be evaluable.\r\n /// Example:\r\n /// DafnyVerifyOneVerb(SourcePath(\"src\\\\foo\\\\bar.dfy\"))\r\n /// \r\n /// A unique identifier for the abstract verb.\r\n AbstractId getAbstractIdentifier();\r\n\r\n /// \r\n /// Gets a worker for this verb that performs this verb's work.\r\n /// \r\n /// \r\n /// Working directory to use for this verb's execution.\r\n /// \r\n /// A worker for this verb instance.\r\n IVerbWorker getWorker(WorkingDirectory workingDirectory);\r\n\r\n /// \r\n /// Gets a structured form of output UI for informing the user what\r\n /// happened.\r\n /// \r\n /// Something to present to the user.\r\n Presentation getPresentation();\r\n\r\n /// \r\n /// Gets a structured form of output UI for informing the user what is\r\n /// currently happening.\r\n /// \r\n /// \r\n /// The disposition of this verb's worker.\r\n /// \r\n /// Something to present to the user.\r\n Presentation getRealtimePresentation(Disposition disposition);\r\n\r\n /// \r\n /// Writes an XML representation of this verb's CPU usage using the\r\n /// provided XmlWriter.\r\n /// \r\n /// \r\n /// The XmlWriter to use to write the XML.\r\n /// \r\n void writeTimingXml(XmlWriter xmlWriter);\r\n\r\n /// \r\n /// Writes an XML representation of this verb's internal state\r\n /// (for debugging purposes) using the provided XmlWriter.\r\n /// \r\n /// \r\n /// The XmlWriter to use to write the XML.\r\n /// \r\n void writeDebugXml(XmlWriter xmlWriter);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IVerbWorker.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n /// \n /// Enumeration of the verb worker types: synchronous and asynchronous.\n /// \n /// \n /// REVIEW: Couldn't this just be a boolean?\n /// \n internal enum VerbWorkerType\n {\n /// \r\n /// The worker runs synchronously.\r\n /// \r\n Sync,\r\n\r\n /// \r\n /// The worker runs asynchronously.\r\n /// \r\n Async\r\n }\n\n /// \n /// Enumeration of the ways to treat process exit codes.\n /// \n /// \n /// REVIEW: Couldn't this just be a boolean?\n /// \n internal enum ProcessExitCodeHandling\n {\n /// \n /// Treat non-zero return codes as the process reporting a failure.\n /// \n NonzeroIsFailure,\n\n /// \n /// Ignore non-zero return codes from the process.\n /// \n NonzeroIsOkay\n }\n\n /// \n /// Definition of the interface to Verb workers.\n /// \n /// \n /// The scheduler's VerbRunner component uses this interface to\n /// run verbs (both synchronous and asynchronous verbs).\n /// \n internal interface IVerbWorker\n {\n /// \n /// Indicates whether this work needs to be scheduled asynchronously.\n /// If it returns Sync, the runAsync method will not be called.\n /// \n /// Sync for synchronous verbs, Async otherwise.\n VerbWorkerType IsSync();\n\n /// \n /// Gets the private working directory this verb executes in.\n /// \n /// The directory this verb executes in.\n WorkingDirectory GetWorkingDirectory();\n\n /// \n /// Performs the slow, asynchronous work.\n /// \n /// \n /// Does not run on the main thread, so should not access caches\n /// (or do anything else that expects to be synchronous).\n /// \n void RunAsync();\n\n /// \n /// Performs the completion work for Async workers, and is called\n /// after the runAsync method returns. For Sync workers, it performs\n /// all the work not done by the getWorker call.\n /// \n /// \n /// This method runs synchronously on the main thread. REVIEW: Not true\n /// for Async workers! It runs under lock, but on separate thread.\n /// It can tidy up the state after async work, and store results\n /// in the Repository.\n /// This method must not return the Stale Disposition; once completed\n /// a verb is either Fresh or Failed.\n /// \n /// The disposition of this verb's worker's work.\n Disposition Complete();\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IVerificationResultParser.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal interface IVerificationResultParser\r\n {\r\n void parseOutput(\r\n string s,\r\n out int parseFailures,\r\n out int verificationFailures,\r\n out int timeouts);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IncludePathContext.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal abstract class IncludePathContext\r\n : IIncludePathContext\r\n {\r\n public abstract BuildObject search(string basename, ModPart modPart = ModPart.Ifc);\r\n\r\n public override int GetHashCode()\r\n {\r\n return ToString().GetHashCode();\r\n }\r\n\r\n public override bool Equals(object obj)\r\n {\r\n return ToString().Equals(obj.ToString());\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IronRootDirectory.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n using System;\n using System.IO;\n\n /// \n /// A directory tree in the local filesystem to fetch sources from.\n /// Used to identify and isolate accesses to things under iron root.\n /// \n internal static class IronRootDirectory\n {\n /// \n /// Gets the absolute path to the given build object under IronRoot.\n /// \n /// A build object.\n /// The absolute path to the build object.\n public static string PathTo(BuildObject obj)\n {\n return Path.Combine(BuildEngine.theEngine.getIronRoot(), obj.getRelativePath());\n }\n\n /// \n /// Gets the absolute path corresponding to the given relative path under IronRoot.\n /// \n /// Relative path to convert.\n /// The absolute path corresponding to the given relative path.\n public static string PathTo(string relativePath)\n {\n return Path.Combine(BuildEngine.theEngine.getIronRoot(), relativePath);\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IroncladAppVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class IroncladAppVerb\r\n : Verb, IObligationsProducer\r\n {\r\n public const string TRUSTED_EXE_EXTN = \".exe\";\r\n public const string UNVERIFIED_SENTINEL_EXTENSION = \".usentinel\";\r\n private const int version = 5;\r\n\r\n ////public enum VerifyMode { Verify, NoVerify };\r\n ////public enum SymDiffMode { UseSymDiff, NoSymDiff };\r\n\r\n private SourcePath dfyroot; // REVIEW: Never used?\r\n private AbstractId abstractId;\r\n private DafnySpecVerb dafnyspecVerb;\r\n private DafnyCCVerb dafnyccVerb;\r\n private EntryStitcherVerb stitcherVerb;\r\n private VerificationResultSummaryVerb verifyResultsVerb;\r\n private LinkerVerb linkerVerb;\r\n private PoundDefines poundDefines;\r\n private VerificationRequest verificationRequest;\r\n private string appLabel;\r\n\r\n private BuildObject srcObject;\r\n private BuildObject exeObject;\r\n private BuildObject outputObject;\r\n\r\n public IroncladAppVerb(SourcePath dfyroot, TARGET target, DafnyCCVerb.FramePointerMode framePointerMode, VerificationRequest verificationRequest)\r\n {\r\n this.dfyroot = dfyroot;\r\n\r\n // TODO this is the only #define we support just yet, so I'm stuffing it in here.\r\n // We'll need to plumb more carefully when we want to add x64.\r\n if (dfyroot.getDirPath().Split(Path.DirectorySeparatorChar).Last().Equals(\"AppLoader\"))\r\n {\r\n this.poundDefines = new PoundDefines(new string[] { \"AppLoader\" });\r\n }\r\n else\r\n {\r\n this.poundDefines = PoundDefines.empty();\r\n }\r\n\r\n this.verificationRequest = verificationRequest;\r\n this.abstractId = new AbstractId(\r\n this.GetType().Name,\r\n version,\r\n dfyroot.ToString(),\r\n this.poundDefines,\r\n concrete: string.Format(\r\n \"{0},{1},{2}\",\r\n target,\r\n framePointerMode.ToString(),\r\n verificationRequest.ToString()));\r\n this.appLabel = dfyroot.getDirPath().Split(Path.DirectorySeparatorChar).Last();\r\n this.dafnyspecVerb = new DafnySpecVerb(dfyroot, this.appLabel);\r\n this.dafnyccVerb = new DafnyCCVerb(dfyroot, this.appLabel, framePointerMode);\r\n\r\n bool isLoader = dfyroot.getRelativePath().Equals(BootableAppVerb.LOADER_DFY);\r\n\r\n // NB we keep dafnyccVerb as the lowest-priority context, so that our hand-written\r\n // beat impls will override its output.\r\n IContextGeneratingVerb contextWithDafny = new ConcatContextVerb(\r\n BuildEngine.theEngine.getVerveContextVerb(this.poundDefines),\r\n new VerbOutputsContextVerb(this.dafnyspecVerb, false),\r\n new VerbOutputsContextVerb(this.dafnyccVerb, true),\r\n this.poundDefines);\r\n this.stitcherVerb = new EntryStitcherVerb(contextWithDafny, this.appLabel);\r\n IContextGeneratingVerb contextWithDafnyAndEntry = new ConcatContextVerb(\r\n new VerbOutputsContextVerb(this.stitcherVerb, false),\r\n contextWithDafny,\r\n this.poundDefines);\r\n\r\n BuildObject entryImpObj = this.stitcherVerb.getEntryImpOutput();\r\n BoogieAsmLinkVerb entryVerb = new BoogieAsmLinkVerb(contextWithDafnyAndEntry, entryImpObj);\r\n if (target == TARGET.BARE_METAL)\r\n {\r\n MasmVerb masmVerb = new MasmVerb(entryVerb);\r\n this.linkerVerb = new LinkerVerb(masmVerb, isLoader);\r\n }\r\n else if (target == TARGET.WINDOWS)\r\n { // Rewrite the asm that comes out of entryVerb before linking it\r\n AsmRewriterVerb rewriter = new AsmRewriterVerb(entryVerb);\r\n MasmVerb masmVerb = new MasmVerb(rewriter);\r\n this.linkerVerb = new WinLinkerVerb(masmVerb, isLoader);\r\n }\r\n\r\n BoogieAsmVerificationObligationListVerb bavolVerb =\r\n new BoogieAsmVerificationObligationListVerb(contextWithDafnyAndEntry, entryImpObj, verificationRequest);\r\n\r\n this.verifyResultsVerb = new VerificationResultSummaryVerb(bavolVerb);\r\n\r\n this.srcObject = this.linkerVerb.getUntrustedExe();\r\n if (verificationRequest.isComplete())\r\n {\r\n this.exeObject = dfyroot.makeOutputObject(TRUSTED_EXE_EXTN);\r\n this.outputObject = this.exeObject;\r\n }\r\n else\r\n {\r\n this.exeObject = this.srcObject;\r\n this.outputObject = dfyroot.makeVirtualObject(UNVERIFIED_SENTINEL_EXTENSION);\r\n }\r\n }\r\n\r\n public enum TARGET\r\n {\r\n BARE_METAL,\r\n WINDOWS\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n List result = new List();\r\n result.Add(this.srcObject);\r\n\r\n result.Add(this.verifyResultsVerb.getOutputFile());\r\n\r\n ddisp = DependencyDisposition.Complete;\r\n\r\n return result;\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n if (this.verificationRequest.isComplete())\r\n {\r\n // If the verification succeeded, then we convert the untrusted exe into a trusted exe (via a copy).\r\n VerificationResult vr = VerificationResult.fromXmlFile(this.verifyResultsVerb.getOutputFile());\r\n\r\n if (!vr.pass)\r\n {\r\n return new VerbSyncWorker(workingDirectory, new Failed());\r\n }\r\n\r\n File.Copy(workingDirectory.PathTo(this.srcObject), workingDirectory.PathTo(this.outputObject), true); // True => Overwrite\r\n }\r\n else\r\n {\r\n UnverifiedSentinelVirtualContents contents = new UnverifiedSentinelVirtualContents();\r\n BuildEngine.theEngine.Repository.StoreVirtual(this.outputObject, new Fresh(), contents);\r\n }\r\n\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n List result = new List();\r\n result.Add(this.dafnyccVerb);\r\n result.Add(this.stitcherVerb);\r\n result.Add(this.linkerVerb);\r\n result.Add(this.verifyResultsVerb);\r\n result.AddRange(this.verifyResultsVerb.getVerbs()); // Sleazy.\r\n return result;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { this.outputObject };\r\n }\r\n\r\n public BuildObject getObligationSet()\r\n {\r\n return this.verifyResultsVerb.getObligationSet();\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public BuildObject getExe()\r\n {\r\n return this.exeObject;\r\n }\r\n\r\n public override Presentation getPresentation()\r\n {\r\n return this.verifyResultsVerb.getPresentation();\r\n }\r\n\r\n public string getAppLabel()\r\n {\r\n return this.appLabel;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/IronfleetAppVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n /// \r\n /// Verb to build an Ironfleet application.\r\n /// This is a top-level verb.\r\n /// \r\n internal class IronfleetAppVerb : Verb, IObligationsProducer\r\n {\r\n private const int Version = 7;\r\n private const string UnverifiedExeExt = \".unverified.exe\";\r\n private const string VerifiedExeExt = \".exe\";\r\n private readonly BuildObject input;\r\n private readonly BuildObject exeOutput;\r\n private readonly List otherOutputs;\r\n private readonly AbstractId abstractId;\r\n private readonly VerificationResultSummaryVerb verifyVerb;\r\n private readonly VSSolutionVerb buildVerb;\r\n private readonly IVerb[] verbs;\r\n private List dependencies;\r\n\r\n /// \r\n /// Initializes a new instance of the IronfleetAppVerb class.\r\n /// \r\n /// Main dafny file for the application.\r\n public IronfleetAppVerb(SourcePath input, VerificationRequest verificationRequest, bool releaseBuild = false)\r\n {\r\n if (input == null)\r\n {\r\n throw new ArgumentNullException(\"input\");\r\n }\r\n\r\n this.abstractId = new AbstractId(GetType().Name, Version, input.ToString() + verificationRequest.ToString());\r\n this.input = input;\r\n this.buildVerb = new VSSolutionVerb(new SourcePath(@\"src\\IronfleetTestDriver\\IronfleetTestDriver.sln\"), input, releaseBuild);\r\n\r\n if (verificationRequest.verifyMode == VerificationRequest.VerifyMode.NoVerify)\r\n {\r\n this.exeOutput = this.input.makeOutputObject(UnverifiedExeExt);\r\n this.verifyVerb = null;\r\n this.verbs = new IVerb[] { this.buildVerb };\r\n }\r\n else\r\n {\r\n this.exeOutput = this.input.makeOutputObject(VerifiedExeExt);\r\n this.verifyVerb = new VerificationResultSummaryVerb(new DafnyVerifyTreeVerb(input));\r\n this.verbs = new IVerb[] { this.verifyVerb, this.buildVerb };\r\n }\r\n\r\n this.otherOutputs = new List();\r\n var ohs = this.buildVerb.getOutputs().ToList();\r\n ohs.RemoveAll(o => o.getExtension() == \".exe\");\r\n foreach (var o in ohs)\r\n {\r\n this.otherOutputs.Add(RelocateBuildObjectToExeDirectory(o));\r\n }\r\n }\r\n\r\n private BuildObject RelocateBuildObjectToExeDirectory(BuildObject sourceOb)\r\n {\r\n return new BuildObject(exeOutput.getDirPath() + \"\\\\\" + sourceOb.getFileName());\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n if (this.dependencies == null)\r\n {\r\n var dependencies = new List();\r\n\r\n // Select and append results returned from verb.getDependencies() to dependencies.\r\n // If the dependency disposition is ever reported as not complete, we reflect this through to the caller.\r\n dependencies.AddRange(this.verbs.SelectMany(verb => verb.getOutputs()));\r\n this.dependencies = dependencies;\r\n }\r\n\r\n Trace.Assert(this.dependencies != null);\r\n ddisp = DependencyDisposition.Complete;\r\n return this.dependencies;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return this.verbs;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n var result = new List { this.exeOutput };\r\n result.AddRange(this.otherOutputs);\r\n return result;\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n Disposition disposition = new Fresh();\r\n\r\n if (this.verifyVerb != null)\r\n {\r\n VerificationResult verificationResult = VerificationResult.fromXmlFile(this.verifyVerb.getOutputs().Single());\r\n if (!verificationResult.pass)\r\n {\r\n disposition = new Failed();\r\n }\r\n }\r\n\r\n if (!(disposition is Failed))\r\n {\r\n foreach (var o in this.buildVerb.getOutputs())\r\n {\r\n if (o.getExtension() == \".exe\")\r\n {\r\n File.Copy(workingDirectory.PathTo(o), workingDirectory.PathTo(this.exeOutput), overwrite: true);\r\n }\r\n else\r\n {\r\n var dest = this.RelocateBuildObjectToExeDirectory(o);\r\n File.Copy(\r\n workingDirectory.PathTo(o),\r\n workingDirectory.PathTo(dest),\r\n overwrite: true);\r\n }\r\n }\r\n }\r\n\r\n return new VerbSyncWorker(workingDirectory, disposition);\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n { \r\n return disposition;\r\n }\r\n\r\n public BuildObject getObligationSet()\r\n {\r\n return this.verifyVerb.getObligationSet();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/ItemCacheCloud.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Configuration;\r\n using System.Globalization;\r\n using System.IO;\r\n using Microsoft.WindowsAzure.Storage;\r\n using Microsoft.WindowsAzure.Storage.Blob;\r\n\r\n /// \r\n /// An implementation of the item cache that uses Azure blobs as the\r\n /// backing store.\r\n /// \r\n public class ItemCacheCloud : IItemCache\r\n {\r\n /// \r\n /// Azure storage account we're using.\r\n /// \r\n private readonly CloudStorageAccount storageAccount;\r\n\r\n /// \r\n /// Blob client object for working with blobs.\r\n /// \r\n private readonly CloudBlobClient blobClient;\r\n\r\n /// \r\n /// Array of blob containers corresponding to item cache containers.\r\n /// \r\n private readonly CloudBlobContainer[] cloudContainers;\r\n\r\n /// \r\n /// Initializes a new instance of the ItemCacheCloud class.\r\n /// \r\n public ItemCacheCloud()\r\n {\r\n // -\r\n // Create our CloudStorageAccount object.\r\n // REVIEW: Hard-coded connection string index \"Ironclad\".\r\n // -\r\n string connectionString = null;\r\n ConnectionStringSettings settings = ConfigurationManager.ConnectionStrings[\"Ironclad\"];\r\n if (settings != null)\r\n {\r\n connectionString = settings.ConnectionString;\r\n }\r\n\r\n if (string.IsNullOrEmpty(connectionString))\r\n {\r\n throw new ConfigurationException(\"Azure connection string missing from your NuBuild.exe.config file!\");\r\n }\r\n\r\n this.storageAccount = CloudStorageAccount.Parse(connectionString);\r\n\r\n // -\r\n // Create our CloudBlobClient object.\r\n // -\r\n this.blobClient = this.storageAccount.CreateCloudBlobClient();\r\n\r\n // -\r\n // Set up the blob storage containers.\r\n // -\r\n Array containers = Enum.GetValues(typeof(ItemCacheContainer));\r\n this.cloudContainers = new CloudBlobContainer[containers.Length];\r\n foreach (ItemCacheContainer container in containers)\r\n {\r\n CloudBlobContainer cloudContainer = this.blobClient.GetContainerReference(container.ToString().ToLower(CultureInfo.InvariantCulture));\r\n cloudContainer.CreateIfNotExists();\r\n this.cloudContainers[(int)container] = cloudContainer;\r\n }\r\n }\r\n\r\n /// \r\n /// Gets a human-readable name for this item cache implementation.\r\n /// \r\n public string Name\r\n {\r\n get { return \"Cloud\"; }\r\n }\r\n\r\n /// \r\n /// Copies the given item from the cache to a new byte array.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A byte array containing a copy of the item.\r\n public byte[] FetchItem(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n if (!cloudBlob.Exists())\r\n {\r\n return null;\r\n }\r\n\r\n using (MemoryStream memoryStream = new MemoryStream())\r\n {\r\n cloudBlob.DownloadToStream(memoryStream);\r\n return memoryStream.ToArray();\r\n }\r\n }\r\n\r\n /// \r\n /// Copies the given item from the cache to the given location in the\r\n /// local file system.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// \r\n /// Location in the local file system to copy the item.\r\n /// \r\n public void FetchItemToFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemDestinationPath)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n try\r\n {\r\n cloudBlob.DownloadToFile(localFilesystemDestinationPath, FileMode.Create);\r\n }\r\n catch (Microsoft.WindowsAzure.Storage.StorageException)\r\n {\r\n throw new ObjectMissingFromCacheException(itemHash, \"Item missing from cloud cache.\");\r\n }\r\n }\r\n\r\n /// \r\n /// Copies the given byte array to the desired cache item.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// \r\n /// Byte array containing the item.\r\n /// \r\n public void StoreItem(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n byte[] contents)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n cloudBlob.UploadFromByteArray(contents, 0, contents.Length);\r\n }\r\n\r\n /// \r\n /// Copies the given file from the local file system into the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// \r\n /// Location in the local file system from which to source the item.\r\n /// \r\n public void StoreItemFromFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemSourcePath)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n cloudBlob.UploadFromFile(localFilesystemSourcePath, FileMode.Open);\r\n }\r\n\r\n /// \r\n /// Deletes an item from the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n public void DeleteItem(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n cloudBlob.DeleteIfExists();\r\n }\r\n\r\n /// \r\n /// Gets a HashSet containing the hash keys of all the items in the\r\n /// given container.\r\n /// \r\n /// Identifier for the cache container.\r\n /// A HashSet containing the hash keys.\r\n public HashSet GetItemsInContainer(ItemCacheContainer container)\r\n {\r\n HashSet itemHashes = new HashSet();\r\n\r\n foreach (CloudBlockBlob item in this.cloudContainers[(int)container].ListBlobs(null, true))\r\n {\r\n itemHashes.Add(item.Name);\r\n }\r\n\r\n return itemHashes;\r\n }\r\n\r\n /// \r\n /// Gets the size of the item.\r\n /// Returns -1 if the item is absent.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// Size of the item in bytes, or -1 if item is absent.\r\n public long GetItemSize(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n if (cloudBlob.Exists())\r\n {\r\n return cloudBlob.Properties.Length;\r\n }\r\n\r\n return -1;\r\n }\r\n\r\n /// \r\n /// Gets the last-modified time of the item.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A DateTimeOffset containing the item's last-modified time.\r\n public DateTimeOffset? GetItemLastModifiedTime(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n if (cloudBlob.Exists())\r\n {\r\n return cloudBlob.Properties.LastModified;\r\n }\r\n\r\n return null;\r\n }\r\n\r\n /// \r\n /// Checks whether the specified item exists in the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// \r\n /// True if the specified item is in the cache, false otherwise.\r\n /// \r\n public bool ItemExists(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n return cloudBlob.Exists();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/ItemCacheLocal.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Threading;\r\n\r\n /// \r\n /// An implementation of the item cache that uses the local file system\r\n /// as the backing store.\r\n /// \r\n public class ItemCacheLocal : IItemCache\r\n {\r\n /// \r\n /// Array of local file system paths corresponding to item cache\r\n /// containers.\r\n /// \r\n private readonly string[] localPaths;\r\n\r\n /// \r\n /// Lock protecting local file system state from concurrent accesses.\r\n /// \r\n private object cacheLock;\r\n\r\n /// \r\n /// Initializes a new instance of the ItemCacheLocal class.\r\n /// \r\n /// \r\n /// Generates local path names corresponding to the various item cache\r\n /// containers, and creates local directories for each, if they don't\r\n /// already exit.\r\n /// \r\n /// Root of the local cache.\r\n public ItemCacheLocal(string localCacheDirectory)\r\n {\r\n // -\r\n // Set up the local \"container\" directories and paths to them.\r\n // -\r\n Array containers = Enum.GetValues(typeof(ItemCacheContainer));\r\n this.localPaths = new string[containers.Length];\r\n foreach (ItemCacheContainer container in containers)\r\n {\r\n string directory = Path.Combine(\r\n localCacheDirectory,\r\n container.ToString());\r\n\r\n this.localPaths[(int)container] = directory;\r\n Directory.CreateDirectory(directory);\r\n }\r\n\r\n this.cacheLock = new object();\r\n }\r\n\r\n /// \r\n /// Gets a human-readable name for this item cache implementation.\r\n /// \r\n public string Name\r\n {\r\n get { return \"Local\"; }\r\n }\r\n\r\n /// \r\n /// Copies the given item from the cache to a new byte array.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A byte array containing a copy of the item.\r\n public byte[] FetchItem(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n string itemPath = this.ItemPath(container, itemHash);\r\n\r\n lock (this.cacheLock)\r\n {\r\n if (!File.Exists(itemPath))\r\n {\r\n return null;\r\n }\r\n\r\n return File.ReadAllBytes(itemPath);\r\n }\r\n }\r\n\r\n /// \r\n /// Copies the given item from the cache to the given location in the\r\n /// local file system.\r\n /// \r\n /// \r\n /// This method is a performance optimization over getting a readable\r\n /// stream for the item and copying it to a local file using CopyTo().\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// \r\n /// Location in the local file system to copy the item.\r\n /// \r\n public void FetchItemToFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemDestinationPath)\r\n {\r\n lock (this.cacheLock)\r\n {\r\n try\r\n {\r\n Directory.CreateDirectory(Path.GetDirectoryName(localFilesystemDestinationPath));\r\n File.Copy(this.ItemPath(container, itemHash), localFilesystemDestinationPath, true);\r\n }\r\n catch (FileNotFoundException)\r\n {\r\n throw new ObjectMissingFromCacheException(itemHash, \"Item missing from local cache.\");\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Copies the given byte array to the desired cache item.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// \r\n /// Byte array containing the item.\r\n /// \r\n public void StoreItem(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n byte[] contents)\r\n {\r\n string itemPath = this.ItemPath(container, itemHash);\r\n lock (this.cacheLock)\r\n {\r\n File.Delete(itemPath);\r\n File.WriteAllBytes(itemPath, contents);\r\n }\r\n }\r\n\r\n /// \r\n /// Copies the given file from the local file system into the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// \r\n /// Location in the local file system from which to source the item.\r\n /// \r\n public void StoreItemFromFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemSourcePath)\r\n {\r\n string itemPath = this.ItemPath(container, itemHash);\r\n lock (this.cacheLock)\r\n {\r\n File.Delete(itemPath);\r\n File.Copy(localFilesystemSourcePath, itemPath);\r\n }\r\n }\r\n\r\n /// \r\n /// Gets a HashSet containing the hash keys of all the items in the\r\n /// given container.\r\n /// \r\n /// Identifier for the cache container.\r\n /// A HashSet containing the hash keys.\r\n public HashSet GetItemsInContainer(ItemCacheContainer container)\r\n {\r\n HashSet itemHashes = new HashSet();\r\n\r\n foreach (string filename in Directory.EnumerateFiles(this.localPaths[(int)container]))\r\n {\r\n itemHashes.Add(Path.GetFileName(filename));\r\n }\r\n\r\n return itemHashes;\r\n }\r\n\r\n /// \r\n /// Deletes an item from the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n public void DeleteItem(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n lock (this.cacheLock)\r\n {\r\n File.Delete(this.ItemPath(container, itemHash));\r\n }\r\n }\r\n\r\n /// \r\n /// Gets the size of the item.\r\n /// Returns -1 if the item is absent.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// Size of the item in bytes, or -1 if item is absent.\r\n public long GetItemSize(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n lock (this.cacheLock)\r\n {\r\n FileInfo fileInfo = new FileInfo(this.ItemPath(container, itemHash));\r\n if (fileInfo.Exists)\r\n {\r\n return fileInfo.Length;\r\n }\r\n\r\n return -1;\r\n }\r\n }\r\n\r\n /// \r\n /// Gets the last-modified time of the item.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A DateTimeOffset containing the item's last-modified time.\r\n public DateTimeOffset? GetItemLastModifiedTime(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n lock (this.cacheLock)\r\n {\r\n FileInfo fileInfo = new FileInfo(this.ItemPath(container, itemHash));\r\n if (fileInfo.Exists)\r\n {\r\n return fileInfo.CreationTimeUtc;\r\n }\r\n\r\n return null;\r\n }\r\n }\r\n\r\n /// \r\n /// Gets the local path name for the given item.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// Path for the item.\r\n private string ItemPath(ItemCacheContainer container, string itemHash)\r\n {\r\n return Path.Combine(\r\n this.localPaths[(int)container],\r\n itemHash);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/ItemCacheMultiplexer.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n /// \r\n /// An implementation of the item cache that multiplexes two other\r\n /// backing store implementations together.\r\n /// \r\n public class ItemCacheMultiplexer : IItemCache\r\n {\r\n /// \r\n /// The maximum size of items to upload to the cloud.\r\n /// \r\n private const long MaxUploadSizeThreshold = 50 * (1 << 20);\r\n\r\n /// \r\n /// The underlying local item cache implementation.\r\n /// \r\n private readonly ItemCacheLocal localCache;\r\n\r\n /// \r\n /// The underlying cloud item cache implementation.\r\n /// \r\n private readonly ItemCacheCloud cloudCache;\r\n\r\n /// \r\n /// A worker thread and queue for performing background work.\r\n /// \r\n /// \r\n /// While this is currently private to the multiplexer,\r\n /// the BackgroundWorker code is generic and could be used\r\n /// for other purposes. If that happens, we should move this\r\n /// to the main build engine.\r\n /// \r\n private readonly BackgroundWorker backgroundWorker;\r\n\r\n /// \r\n /// Initializes a new instance of the ItemCacheMultiplexer class.\r\n /// \r\n /// A local cache instance.\r\n /// A cloud cache instance.\r\n /// A background worker instance.\r\n public ItemCacheMultiplexer(\r\n ItemCacheLocal localCache,\r\n ItemCacheCloud cloudCache,\r\n BackgroundWorker backgroundWorker)\r\n {\r\n this.localCache = localCache;\r\n this.cloudCache = cloudCache;\r\n this.backgroundWorker = backgroundWorker;\r\n }\r\n\r\n /// \r\n /// Gets a human-readable name for this item cache implementation.\r\n /// \r\n public string Name\r\n {\r\n get { return \"Multiplexer\"; }\r\n }\r\n\r\n /// \r\n /// Copies the given item from the cache to a new byte array.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A byte array containing a copy of the item.\r\n public byte[] FetchItem(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n byte[] contents;\r\n\r\n contents = this.localCache.FetchItem(container, itemHash);\r\n if (contents == null)\r\n {\r\n contents = this.cloudCache.FetchItem(container, itemHash);\r\n if (contents == null)\r\n {\r\n return null;\r\n }\r\n\r\n this.localCache.StoreItem(container, itemHash, contents);\r\n }\r\n else\r\n {\r\n // -\r\n // Schedule cloud push on successful local read.\r\n // REVIEW: Is this rare optimization really worth it?\r\n // -\r\n this.QueueItemForCloudSync(container, itemHash);\r\n }\r\n\r\n return contents;\r\n }\r\n\r\n /// \r\n /// Copies the given item from the cache to the given location in the\r\n /// local file system.\r\n /// \r\n /// \r\n /// As with GetReadableStreamForItem, we first try locally and only\r\n /// go to the cloud if needed.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// \r\n /// Location in the local file system to copy the item.\r\n /// \r\n public void FetchItemToFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemDestinationPath)\r\n {\r\n try\r\n {\r\n this.localCache.FetchItemToFile(container, itemHash, localFilesystemDestinationPath);\r\n\r\n // -\r\n // Schedule cloud push on successful local read.\r\n // REVIEW: Is this rare optimization really worth it?\r\n // -\r\n this.QueueItemForCloudSync(container, itemHash);\r\n }\r\n catch (ObjectMissingFromCacheException)\r\n {\r\n // -\r\n // If it is missing locally, try to retrieve it from the cloud.\r\n // Note we stash a copy in the local cache prior to copying it\r\n // to the desired local file.\r\n // -\r\n byte[] temp = this.cloudCache.FetchItem(container, itemHash);\r\n if (temp == null)\r\n {\r\n throw new ObjectMissingFromCacheException(itemHash, \"Item missing from multiplexed cache.\");\r\n }\r\n\r\n this.localCache.StoreItem(container, itemHash, temp);\r\n this.localCache.FetchItemToFile(container, itemHash, localFilesystemDestinationPath);\r\n }\r\n }\r\n\r\n /// \r\n /// Copies the given byte array to the desired cache item.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// Byte array containing the item.\r\n public void StoreItem(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n byte[] contents)\r\n {\r\n this.localCache.StoreItem(container, itemHash, contents);\r\n this.QueueItemForCloudSync(container, itemHash);\r\n }\r\n\r\n /// \r\n /// Copies the given file from the local file system into the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// \r\n /// Location in the local file system from which to source the item.\r\n /// \r\n public void StoreItemFromFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemSourcePath)\r\n {\r\n this.localCache.StoreItemFromFile(container, itemHash, localFilesystemSourcePath);\r\n this.QueueItemForCloudSync(container, itemHash);\r\n }\r\n\r\n /// \r\n /// Deletes an item from the cache.\r\n /// \r\n /// \r\n /// Note that our cache sync code (CheckForAndOrUploadMissingItem)\r\n /// will fail if given an item to sync, and that item is subsequently\r\n /// deleted from the local cache before the sync code gets around to\r\n /// syncing it. This method is really only intended for cache\r\n /// management purposes and not for general use. If that changes,\r\n /// the cache sync code should change as well.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n public void DeleteItem(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n this.localCache.DeleteItem(container, itemHash);\r\n this.cloudCache.DeleteItem(container, itemHash);\r\n }\r\n\r\n /// \r\n /// Gets a HashSet containing the hash keys of all the items in the\r\n /// given container.\r\n /// \r\n /// Identifier for the cache container.\r\n /// A HashSet containing the hash keys.\r\n public HashSet GetItemsInContainer(ItemCacheContainer container)\r\n {\r\n // -\r\n // REVIEW: What to return here? Both caches contents? Nothing?\r\n // -\r\n return new HashSet();\r\n }\r\n\r\n /// \r\n /// Gets the size of the item.\r\n /// Returns -1 if the item is absent.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// Size of the item in bytes, or -1 if item is absent.\r\n public long GetItemSize(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n long size = this.localCache.GetItemSize(container, itemHash);\r\n if (size == -1)\r\n {\r\n size = this.cloudCache.GetItemSize(container, itemHash);\r\n }\r\n\r\n return size;\r\n }\r\n\r\n /// \r\n /// Gets the last-modified time of the item.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A DateTimeOffset containing the item's last-modified time.\r\n public DateTimeOffset? GetItemLastModifiedTime(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n DateTimeOffset? modifiedTime = this.localCache.GetItemLastModifiedTime(container, itemHash);\r\n if (modifiedTime == null)\r\n {\r\n modifiedTime = this.cloudCache.GetItemLastModifiedTime(container, itemHash);\r\n }\r\n\r\n return modifiedTime;\r\n }\r\n\r\n /// \r\n /// Public API for private CheckForAndOrUploadMissingItem method.\r\n /// \r\n /// \r\n /// Identifier for the item's cache container.\r\n /// \r\n /// Hash key for the item.\r\n public void SyncItemToCloud(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n this.CheckForAndOrUploadMissingItem(container, itemHash);\r\n }\r\n\r\n /// \r\n /// Queue the given item for asynchronous cloud cache synchronization.\r\n /// \r\n /// \r\n /// Identifier for the item's cache container.\r\n /// \r\n /// Hash key for the item.\r\n private void QueueItemForCloudSync(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n if (this.backgroundWorker != null)\r\n {\r\n this.backgroundWorker.QueueWork(this.CheckForAndOrUploadMissingItem, container, itemHash);\r\n }\r\n }\r\n\r\n /// \r\n /// Check if the given item is already present in the cloud cache,\r\n /// and if not, upload the local cache item to the cloud.\r\n /// \r\n /// \r\n /// Identifier for the item's cache container.\r\n /// \r\n /// Hash key for the item.\r\n private void CheckForAndOrUploadMissingItem(\r\n object containerObject,\r\n object itemHashObject)\r\n {\r\n ItemCacheContainer container = (ItemCacheContainer)containerObject;\r\n string itemHash = (string)itemHashObject;\r\n\r\n if (this.localCache.GetItemSize(container, itemHash) > MaxUploadSizeThreshold)\r\n {\r\n Logger.WriteLine(string.Format(\r\n \"Warning: skipping upload of {0} because it's really big. Compress?\",\r\n itemHash));\r\n return;\r\n }\r\n\r\n // -\r\n // Check if the item is already present in the cloud cache.\r\n // TODO present doesn't mean we don't want to overwrite it (eg when\r\n // replacing a Failed verification result with a succeeding one.)\r\n // -\r\n if (this.cloudCache.ItemExists(container, itemHash))\r\n {\r\n return;\r\n }\r\n\r\n // -\r\n // The item is missing from the cloud cache. Upload it.\r\n // -\r\n byte[] temp = this.localCache.FetchItem(container, itemHash);\r\n if (temp == null)\r\n {\r\n // This should never happen barring a serious logic error.\r\n throw new ObjectMissingFromCacheException(itemHash, \"Can't upload non-existant cache item!\");\r\n }\r\n\r\n this.cloudCache.StoreItem(container, itemHash, temp);\r\n }\r\n\r\n#if false\r\n /// \r\n /// A wrapper for a stream that queues up a cloud cache sync after it is\r\n /// closed.\r\n /// \r\n /// \r\n /// REVIEW: a lot of boilerplate code just to hook one call. Better way to do this?\r\n /// \r\n private class MultiplexerWrappedStream : Stream\r\n {\r\n /// \r\n /// Flag indicating whether or not Dispose has already been called.\r\n /// \r\n private bool disposed;\r\n\r\n /// \r\n /// Stream we are wrapping.\r\n /// \r\n private Stream stream;\r\n\r\n /// \r\n /// Item cache multiplexer that holds the item behind the stream.\r\n /// \r\n private ItemCacheMultiplexer multiplexer;\r\n\r\n /// \r\n /// Item cache container for the item behind the stream.\r\n /// \r\n private ItemCacheContainer container;\r\n\r\n /// \r\n /// Item cache hash for the item behind the stream.\r\n /// \r\n private string itemHash;\r\n\r\n /// \r\n /// Initializes a new instance of the MultiplexerWrappedStream\r\n /// class.\r\n /// \r\n /// A stream to wrap.\r\n /// \r\n /// The multiplexer cache instance owning item.\r\n /// \r\n /// \r\n /// The container for the item in the multiplexer cache.\r\n /// \r\n /// \r\n /// The hash for the item in the multiplexer cache.\r\n /// \r\n public MultiplexerWrappedStream(\r\n Stream stream,\r\n ItemCacheMultiplexer multiplexer,\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n this.stream = stream;\r\n this.multiplexer = multiplexer;\r\n this.container = container;\r\n this.itemHash = itemHash;\r\n }\r\n\r\n /// \r\n /// Gets a value indicating whether the current steam supports\r\n /// reading.\r\n /// \r\n public override bool CanRead\r\n {\r\n get { return this.stream.CanRead; }\r\n }\r\n\r\n /// \r\n /// Gets a value indicating whether the current stream supports\r\n /// seeking.\r\n /// \r\n public override bool CanSeek\r\n {\r\n get { return this.stream.CanSeek; }\r\n }\r\n\r\n /// \r\n /// Gets a value indicating whether the current stream supports\r\n /// writing.\r\n /// \r\n public override bool CanWrite\r\n {\r\n get { return this.stream.CanWrite; }\r\n }\r\n\r\n /// \r\n /// Gets the length in bytes of the stream.\r\n /// \r\n public override long Length\r\n {\r\n get { return this.stream.Length; }\r\n }\r\n\r\n /// \r\n /// Gets or sets the position within the current stream.\r\n /// \r\n public override long Position\r\n {\r\n get\r\n {\r\n return this.stream.Position;\r\n }\r\n\r\n set\r\n {\r\n this.stream.Position = value;\r\n }\r\n }\r\n\r\n /// \r\n /// Reads a sequence of bytes from the current stream and advances\r\n /// the position within the stream by the number of bytes read.\r\n /// \r\n /// \r\n /// An array of bytes. When this method returns, the buffer\r\n /// contains the specified byte array with the values between\r\n /// offset and (offset + count - 1) replaced by the bytes read from\r\n /// the current source.\r\n /// \r\n /// \r\n /// The zero-based byte offset in buffer at which to begin storing\r\n /// the data read from the current stream.\r\n /// \r\n /// \r\n /// The maximum number of bytes to be read from the current stream.\r\n /// \r\n /// \r\n /// The total number of bytes read into the buffer. This can be\r\n /// less than the number of bytes requested if that many bytes are\r\n /// not currently available, or zero (0) if the end of the stream\r\n /// has been reached.\r\n /// \r\n public override int Read(byte[] buffer, int offset, int count)\r\n {\r\n return this.stream.Read(buffer, offset, count);\r\n }\r\n\r\n /// \r\n /// Writes a sequence of bytes to the current stream and advances\r\n /// the position within this stream by the number of bytes written.\r\n /// \r\n /// \r\n /// An array of bytes. This method copies count bytes from buffer\r\n /// to the current stream.\r\n /// \r\n /// \r\n /// The zero-based offset in buffer at which to begin copying bytes\r\n /// to the current stream.\r\n /// \r\n /// \r\n /// The number of bytes to be written to the current stream.\r\n /// \r\n public override void Write(byte[] buffer, int offset, int count)\r\n {\r\n this.stream.Write(buffer, offset, count);\r\n }\r\n\r\n /// \r\n /// Clears all buffers for this stream and causes any buffered data\r\n /// to be written to the underlying device.\r\n /// \r\n public override void Flush()\r\n {\r\n this.stream.Flush();\r\n }\r\n\r\n /// \r\n /// Sets the position within the current stream.\r\n /// \r\n /// \r\n /// A byte offset relative to the origin parameter.\r\n /// \r\n /// \r\n /// A value of type SeekOrigin indicating the reference point used\r\n /// to obtain the new position.\r\n /// \r\n /// The new position within the\r\n public override long Seek(long offset, SeekOrigin origin)\r\n {\r\n return this.stream.Seek(offset, origin);\r\n }\r\n\r\n /// \r\n /// Sets the length of the current stream.\r\n /// \r\n /// \r\n /// Desired length of the current stream in bytes.\r\n /// \r\n public override void SetLength(long value)\r\n {\r\n this.stream.SetLength(value);\r\n }\r\n\r\n /// \r\n /// Releases unmanaged and (optionally) managed resources.\r\n /// \r\n /// \r\n /// Whether or not to release managed resources.\r\n /// \r\n protected override void Dispose(bool disposing)\r\n {\r\n if (this.disposed)\r\n {\r\n return;\r\n }\r\n\r\n if (disposing)\r\n {\r\n this.stream.Dispose();\r\n this.multiplexer.QueueItemForCloudSync(this.container, this.itemHash);\r\n }\r\n\r\n this.disposed = true;\r\n base.Dispose(disposing);\r\n }\r\n }\r\n#endif\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/Job.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n using System;\n using System.ComponentModel;\n using System.Diagnostics;\n using System.Diagnostics.CodeAnalysis;\n using System.Globalization;\n using System.Runtime.InteropServices;\n using Microsoft.Win32.SafeHandles;\n\n /// \r\n /// Represents a Windows Job Object.\r\n /// \r\n /// \r\n /// This class is only used by ProcessInvoker, so it could be private to that class.\r\n /// \r\n [SuppressMessage(\"StyleCop.CSharp.ReadabilityRules\", \"SA1121:UseBuiltInTypeAlias\", Justification = \"UInt* is more appropriate for system programming\")]\n internal class Job : IDisposable\n {\n /// \r\n /// Handle to the native Windows job object.\r\n /// \r\n private SafeFileHandle jobObjectHandle;\n\n /// \r\n /// Flag indicating whether or not Dispose has already been called.\r\n /// \r\n private bool disposed;\n\n /// \r\n /// Initializes a new instance of the Job class.\r\n /// \r\n public Job()\n {\n this.jobObjectHandle = NativeMethods.CreateJobObject(IntPtr.Zero, null);\n if (this.jobObjectHandle.IsInvalid)\n {\n // Note that the parameterless Win32Exception constructor calls Marshal.GetLastWin32Error internally.\n throw new Win32Exception();\n }\n\n // -\n // Set up this job object so that any processes assigned to it will\n // be terminated when it is closed (since this job object will be\n // closed automatically when the owning process exits, all assigned\n // processes will also be closed when the owning process exists).\n // -\n // Note that to set the JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE flag,\n // the call to SetInformationJobObject must be of JobObjectInfoClass\n // ExtendedLimitInformation, even though the flag is in the simpler\n // BasicLimitInformation structure contained in the former.\n // -\n NativeMethods.JOBOBJECT_EXTENDED_LIMIT_INFORMATION info = new NativeMethods.JOBOBJECT_EXTENDED_LIMIT_INFORMATION();\n int infoSize = Marshal.SizeOf(typeof(NativeMethods.JOBOBJECT_EXTENDED_LIMIT_INFORMATION));\n\n info.BasicLimitInformation.LimitFlags =\n NativeMethods.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;\n\n IntPtr infoPtr = Marshal.AllocHGlobal(infoSize);\n\n try\n {\n Marshal.StructureToPtr(info, infoPtr, false);\n\n if (!NativeMethods.SetInformationJobObject(\n this.jobObjectHandle,\n NativeMethods.JOBOBJECTINFOCLASS.ExtendedLimitInformation,\n infoPtr,\n (UInt32)infoSize))\n {\n // Note that the parameterless Win32Exception constructor calls Marshal.GetLastWin32Error internally.\n throw new Win32Exception();\n }\n }\n finally\n {\n Marshal.FreeHGlobal(infoPtr);\n }\n }\n\n /// \r\n /// Adds the given process to the job object.\r\n /// \r\n /// Process to add.\r\n /// True if successful, false otherwise.\r\n public bool AddProcess(Process process)\n {\n return NativeMethods.AssignProcessToJobObject(this.jobObjectHandle, process.Handle);\n }\n\n /// \r\n /// Gets the total CPU consumed by all processes associated with this job object.\r\n /// \r\n /// Total CPU time.\r\n public TimeSpan GetCpuTime()\n {\n UInt64 totalCpuTime = 0;\n NativeMethods.JOBOBJECT_BASIC_ACCOUNTING_INFORMATION basicAccountingInfo;\n\n basicAccountingInfo = this.GetBasicAccountingInformation();\n totalCpuTime = basicAccountingInfo.TotalKernelTime + basicAccountingInfo.TotalUserTime;\n\n return new TimeSpan((long)totalCpuTime);\n }\n\n /// \r\n /// Terminates all processes currently associated with this job object.\r\n /// \r\n /// Exit code to be used by all processes and threads.\r\n /// True if successful, false otherwise.\r\n public bool Terminate(UInt32 exitCode)\n {\n return NativeMethods.TerminateJobObject(this.jobObjectHandle, exitCode);\n }\n\n /// \r\n /// Closes this Job object.\r\n /// \r\n public void Close()\n {\n this.jobObjectHandle.Close();\n }\n\n /// \r\n /// Releases resources.\r\n /// \r\n public void Dispose()\n {\n this.Dispose(true);\n GC.SuppressFinalize(this);\n }\n\n /// \r\n /// Releases unmanaged and (optionally) managed resources.\r\n /// \r\n /// Whether or not to release managed resources.\r\n private void Dispose(bool disposing)\n {\n if (this.disposed)\n {\n return;\n }\n\n if (disposing)\n {\n this.jobObjectHandle.Dispose();\n }\n\n this.disposed = true;\n }\n\n /// \r\n /// Gets a struct containing the basic accounting information for the job object.\r\n /// \r\n /// A JOBOBJECT_BASIC_ACCOUNTING_INFORMATION structure.\r\n private NativeMethods.JOBOBJECT_BASIC_ACCOUNTING_INFORMATION GetBasicAccountingInformation()\n {\n NativeMethods.JOBOBJECT_BASIC_ACCOUNTING_INFORMATION info;\n int infoSize = Marshal.SizeOf(typeof(NativeMethods.JOBOBJECT_BASIC_ACCOUNTING_INFORMATION));\n IntPtr infoPtr = Marshal.AllocHGlobal(infoSize);\n\n try\n {\n if (!NativeMethods.QueryInformationJobObject(\n this.jobObjectHandle,\n NativeMethods.JOBOBJECTINFOCLASS.BasicAccountingInformation,\n infoPtr,\n (UInt32)infoSize,\n IntPtr.Zero))\n {\n // Note that the parameterless Win32Exception constructor calls Marshal.GetLastWin32Error internally.\n throw new Win32Exception();\n }\n\n info = (NativeMethods.JOBOBJECT_BASIC_ACCOUNTING_INFORMATION)Marshal.PtrToStructure(infoPtr, typeof(NativeMethods.JOBOBJECT_BASIC_ACCOUNTING_INFORMATION));\n }\n finally\n {\n Marshal.FreeHGlobal(infoPtr);\n }\n\n return info;\n }\n\n /// \r\n /// Represents the native Windows API for accessing job objects.\r\n /// \r\n [SuppressMessage(\"StyleCop.CSharp.NamingRules\", \"SA1310:FieldNamesMustNotContainUnderscore\", Justification = \"Part of Windows API\")]\n [SuppressMessage(\"StyleCop.CSharp.DocumentationRules\", \"SA1600:ElementsMustBeDocumented\", Justification = \"Part of Windows API\")]\n [SuppressMessage(\"StyleCop.CSharp.DocumentationRules\", \"SA1602:EnumerationItemsMustBeDocumented\", Justification = \"Part of Windows API\")]\n private static class NativeMethods\n {\n public const UInt32 JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 0x2000;\n\n public enum JOBOBJECTINFOCLASS\n {\n BasicAccountingInformation = 1,\n BasicLimitInformation = 2,\n ExtendedLimitInformation = 9\n }\n\n [DllImport(\"kernel32.dll\", CharSet = CharSet.Unicode)]\n public static extern SafeFileHandle CreateJobObject(IntPtr jobAttributes, string name);\n\n [DllImport(\"kernel32.dll\")]\n [return: MarshalAs(UnmanagedType.Bool)]\n public static extern bool AssignProcessToJobObject(SafeHandle jobHandle, IntPtr processHandle);\n\n [DllImport(\"kernel32.dll\")]\n [return: MarshalAs(UnmanagedType.Bool)]\n public static extern bool SetInformationJobObject(SafeHandle jobHandle, JOBOBJECTINFOCLASS infoClass, IntPtr info, UInt32 infoLength);\n\n [DllImport(\"kernel32.dll\")]\n [return: MarshalAs(UnmanagedType.Bool)]\n public static extern bool QueryInformationJobObject(SafeHandle jobHandle, JOBOBJECTINFOCLASS infoClass, IntPtr info, UInt32 infoLength, IntPtr returnLength);\n\n [DllImport(\"kernel32.dll\")]\n [return: MarshalAs(UnmanagedType.Bool)]\n public static extern bool TerminateJobObject(SafeHandle job, UInt32 exitCode);\n\n [StructLayout(LayoutKind.Sequential, Pack = 8)]\n public struct JOBOBJECT_BASIC_LIMIT_INFORMATION\n {\n public UInt64 PerProcessUserTimeLimit;\n public UInt64 PerJobUserTimeLimit;\n public UInt32 LimitFlags;\n public UIntPtr MinimumWorkingSetSize;\n public UIntPtr MaximumWorkingSetSize;\n public UInt32 ActiveProcessLimit;\n public UIntPtr Affinity;\n public UInt32 PriorityClass;\n public UInt32 SchedulingClass;\n }\n\n [StructLayout(LayoutKind.Sequential)]\n public struct IO_COUNTERS\n {\n public UInt64 ReadOperationCount;\n public UInt64 WriteOperationCount;\n public UInt64 OtherOperationCount;\n public UInt64 ReadTransferCount;\n public UInt64 WriteTransferCount;\n public UInt64 OtherTransferCount;\n }\n\n [StructLayout(LayoutKind.Sequential)]\n public struct JOBOBJECT_EXTENDED_LIMIT_INFORMATION\n {\n public JOBOBJECT_BASIC_LIMIT_INFORMATION BasicLimitInformation;\n public IO_COUNTERS IoInfo;\n public UIntPtr ProcessMemoryLimit;\n public UIntPtr JobMemoryLimit;\n public UIntPtr PeakProcessMemoryLimit;\n public UIntPtr PeakJobMemoryUsed;\n }\n\n [StructLayout(LayoutKind.Sequential)]\n public struct JOBOBJECT_BASIC_ACCOUNTING_INFORMATION\n {\n public UInt64 TotalUserTime;\n public UInt64 TotalKernelTime;\n public UInt64 ThisPeriodTotalUserTime;\n public UInt64 ThisPeriodTotalKernelTime;\n public UInt32 TotalPageFaultCount;\n public UInt32 TotalProcesses;\n public UInt32 ActiveProcesses;\n public UInt32 TotalTerminatedProcesses;\n }\n }\n }\n}" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/LinkerVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class LinkerVerb : Verb, IProcessInvokeAsyncVerb\r\n {\r\n public const string UNTRUSTED_EXE_EXTN = \".uexe\";\r\n\r\n protected BuildObject outputObject;\r\n protected BuildObject objFile;\r\n\r\n protected long maxExeSize;\r\n protected string entryPoint;\r\n protected int baseAddr;\r\n\r\n private const int version = 4;\r\n private bool isLoader;\r\n private MasmVerb masmVerb;\r\n private AbstractId abstractId;\r\n\r\n public LinkerVerb(MasmVerb masmVerb, bool isLoader)\r\n {\r\n this.masmVerb = masmVerb;\r\n this.isLoader = isLoader;\r\n this.objFile = masmVerb.getObj();\r\n\r\n this.abstractId = new AbstractId(this.GetType().Name, version + this.getVersion(), this.objFile.ToString(), concrete: isLoader ? \"Loader\" : \"NonLoader\");\r\n this.outputObject = this.objFile.makeOutputObject(this.outputExtension());\r\n\r\n // Default settings for the apps.\r\n this.maxExeSize = 1 * 1024 * 1024; // 1 MB.\r\n this.entryPoint = \"?AppEntryPoint\";\r\n this.baseAddr = 0x340000;\r\n\r\n if (this.isLoader)\r\n {\r\n // Override the settings above with loader-specific values.\r\n this.maxExeSize = 58 * 1024; // 58 KB\r\n this.entryPoint = \"?LoaderEntryPoint\";\r\n this.baseAddr = 0x300000;\r\n }\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public BuildObject getUntrustedExe()\r\n {\r\n return this.outputObject;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n List basic = new List() { this.getLinkerExe(), this.objFile };\r\n basic.AddRange(this.getExtraDependencies());\r\n return basic;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new List() { this.masmVerb };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() { this.getUntrustedExe() }.Union(this.getExtraOutputs());\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n List args = new List() { \"/LARGEADDRESSAWARE\", \"/driver\", \"/fixed\", \"/subsystem:native\", \"/nodefaultlib\" };\r\n args.Add(this.objFile.getRelativePath());\r\n args.Add(\"/out:\" + this.outputObject.getRelativePath());\r\n args.Add(\"/entry:\" + this.entryPoint);\r\n args.Add(\"/base:\" + this.baseAddr);\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n this.getLinkerExe().getRelativePath(),\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n this.getDiagnosticsBase());\r\n }\r\n\r\n public virtual Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n if (!(disposition is Failed))\r\n {\r\n // Check that the executable isn't too large.\r\n long exeSize = new FileInfo(workingDirectory.PathTo(this.outputObject)).Length;\r\n\r\n if (exeSize > this.maxExeSize)\r\n {\r\n return new Failed(\"Executable too big\");\r\n }\r\n }\r\n\r\n return disposition;\r\n }\r\n\r\n protected virtual int getVersion()\r\n {\r\n // REVIEW: Is this right? There is a private version field in this object.\r\n return 0;\r\n }\r\n\r\n protected virtual string outputExtension()\r\n {\r\n return UNTRUSTED_EXE_EXTN;\r\n }\r\n\r\n protected virtual BuildObject getLinkerExe()\r\n {\r\n return new SourcePath(\"tools\\\\Assembler\\\\link-base.exe\", SourcePath.SourceType.Tools);\r\n }\r\n\r\n protected virtual IEnumerable getExtraDependencies()\r\n {\r\n List extraDepends = new List();\r\n\r\n extraDepends.Add(new SourcePath(\"tools\\\\Assembler\\\\mspdb80.dll\", SourcePath.SourceType.Tools));\r\n\r\n return extraDepends;\r\n }\r\n \r\n protected virtual IEnumerable getExtraOutputs()\r\n {\r\n return new List();\r\n }\r\n\r\n protected virtual bool runLinker(BuildObject asmFile, string linkerExecutable, string entryPoint, int baseAddr, long maxExeSize = -1)\r\n {\r\n return true;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/Logger.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.IO;\r\n\r\n /// \r\n /// Utility for writing log messages simultaneously to the console and\r\n /// a log file.\r\n /// \r\n internal class Logger\r\n {\r\n /// \r\n /// The log file.\r\n /// \r\n private static StreamWriter log;\r\n\r\n /// \r\n /// Writes a message to both the log file and the console.\r\n /// \r\n /// Message to write.\r\n public static void Write(string msg)\r\n {\r\n OpenLog();\r\n log.Write(msg);\r\n log.Flush();\r\n System.Console.Write(msg);\r\n }\r\n\r\n /// \r\n /// Writes a message and the newline string to both the log file\r\n /// and the console.\r\n /// \r\n /// Message to write.\r\n public static void WriteLine(string msg)\r\n {\r\n Write(msg + System.Environment.NewLine);\r\n }\r\n\r\n /// \r\n /// Opens the log file (if it isn't already open).\r\n /// \r\n private static void OpenLog()\r\n {\r\n if (log == null)\r\n {\r\n log = new StreamWriter(\"nubuild.log\");\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/MasmVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class MasmVerb : Verb, IProcessInvokeAsyncVerb\r\n {\r\n public const string MASM_EXTN = \".asm\";\r\n public const string OBJ_EXTN = \".obj\";\r\n private const int version = 4;\r\n\r\n private IAsmProducer asmVerb;\r\n private AbstractId abstractId;\r\n private BuildObject outputObject;\r\n private BuildObject asmFile;\r\n\r\n public MasmVerb(IAsmProducer asmVerb)\r\n {\r\n this.asmVerb = asmVerb;\r\n this.asmFile = asmVerb.getAsmFile();\r\n\r\n this.abstractId = new AbstractId(this.GetType().Name, version, this.asmFile.ToString());\r\n this.outputObject = this.asmFile.makeOutputObject(OBJ_EXTN);\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public BuildObject getObj()\r\n {\r\n return this.outputObject;\r\n }\r\n\r\n public BuildObject getLis()\r\n {\r\n return this.asmFile.makeOutputObject(\".lis\");\r\n }\r\n\r\n ////public BuildObject getMap() { return this.asmFile.makeOutputObject(\".map\"); }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n return new List() { this.getMasmExe(), this.asmVerb.getAsmFile() };\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new List() { this.asmVerb };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() {\r\n this.getObj(),\r\n this.getLis(),\r\n //// this.getMap()\r\n };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n List args = new List() { \"/Cp\", \"/c\", \"/Zd\", \"/Zf\", \"/Zi\" };\r\n args.Add(\"/Fo\" + this.getObj().getRelativePath());\r\n args.Add(\"/Fl\" + this.getLis().getRelativePath());\r\n ////args.Add(\"/Fm\" + getMap().getRelativePath());\r\n // TODO: \"/I$SPEC_INCLUDE_DIR\" \r\n args.Add(this.asmFile.getRelativePath());\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n this.getMasmExe().getRelativePath(),\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n this.getDiagnosticsBase());\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n return disposition;\r\n }\r\n\r\n private BuildObject getMasmExe()\r\n {\r\n return new SourcePath(\"tools\\\\Assembler\\\\ml.exe\", SourcePath.SourceType.Tools);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/NMakeVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Collections.Specialized;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class NmakeVerb\r\n : Verb, IProcessInvokeAsyncVerb\r\n {\r\n private const int version = 7;\r\n private static SourcePath nmakeExecutable;\r\n\r\n private SourcePath makefile;\r\n private CustomManifestParser customManifest;\r\n private AbstractId abstractId;\r\n private string outputPath;\r\n private string outputPathSuffix;\r\n\r\n public NmakeVerb(SourcePath makefile)\r\n {\r\n this.makefile = makefile;\r\n this.abstractId = new AbstractId(this.GetType().Name, version, this.makefile.ToString());\r\n\r\n // Generate output path.\r\n this.outputPath = \".\";\r\n int depth = this.makefile.getDirPath().Split(@\"\\/\".ToCharArray(), StringSplitOptions.RemoveEmptyEntries).Length;\r\n for (int i = 0; i < depth; i++)\r\n {\r\n this.outputPath = Path.Combine(this.outputPath, \"..\");\r\n }\r\n\r\n this.outputPathSuffix = Path.Combine(BuildEngine.theEngine.getObjRoot(), this.makefile.getDirPath());\r\n this.outputPath = Path.Combine(this.outputPath, this.outputPathSuffix);\r\n this.customManifest = new CustomManifestParser(this.makefile);\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n return this.customManifest.getDependencies().Union(new List() { getNmakeExecutable() });\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new IVerb[] { };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return from output in this.customManifest.getOutputs() select new BuildObject(Path.Combine(BuildEngine.theEngine.getObjRoot(), output.getRelativePath()));\r\n }\r\n\r\n public BuildObject getOutputPath()\r\n {\r\n return new BuildObject(this.outputPathSuffix);\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // Scrub the \"makeflags\" environment variable from our environment\r\n // so we don't pass it down to our worker process. Some users may\r\n // have things there that conflict with our usage.\r\n Process myProcess = System.Diagnostics.Process.GetCurrentProcess();\r\n StringDictionary environmentVariables = myProcess.StartInfo.EnvironmentVariables;\r\n environmentVariables.Remove(\"MAKEFLAGS\");\r\n\r\n List args = new List();\r\n args.Add(string.Format(\"OBJ={0}\\\\obj\", workingDirectory.PathTo(this.outputPathSuffix)));\r\n args.Add(string.Format(\"BIN={0}\", workingDirectory.PathTo(this.outputPathSuffix)));\r\n args.Add(\"-f\");\r\n args.Add(workingDirectory.PathTo(this.makefile));\r\n\r\n // TODO: Remove reliance on workingDirOverride, which currently hides dependency issues and other problems.\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n getNmakeExecutable().getRelativePath(), ////\"c:/Program Files (x86)/Microsoft Visual Studio 12.0/VC/bin/nmake.exe\",\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n workingDirOverride: IronRootDirectory.PathTo(this.makefile.getDirPath()),\r\n failureBase: getDiagnosticsBase(),\r\n //allowAbsoluteExe: true,\r\n allowAbsoluteArgs: true);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n return disposition;\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n private static SourcePath getNmakeExecutable()\r\n {\r\n // TODO this should eventually be a BuildObject from *building* the executable.\r\n if (nmakeExecutable == null)\r\n {\r\n nmakeExecutable = new SourcePath(\"tools\\\\nmake\\\\nmake.exe\", SourcePath.SourceType.Tools);\r\n }\r\n\r\n return nmakeExecutable;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/NuBuild.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {4D7220C0-3CAA-4659-9F16-A564DB3CCC1B}\r\n Exe\r\n Properties\r\n NuBuild\r\n NuBuild\r\n v4.5\r\n 512\r\n false\r\n publish\\\r\n true\r\n Disk\r\n false\r\n Foreground\r\n 7\r\n Days\r\n false\r\n false\r\n true\r\n 0\r\n 1.0.0.%2a\r\n false\r\n true\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n ..\\..\\..\\bin_tools\\NuBuild\\\r\n TRACE;DEBUG\r\n prompt\r\n 4\r\n AllRules.ruleset\r\n false\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n False\r\n ..\\References\\Microsoft.WindowsAzure.Storage.dll\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n False\r\n \r\n \r\n Code\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Code\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n False\r\n Microsoft .NET Framework 4.5 %28x86 and x64%29\r\n true\r\n \r\n \r\n False\r\n .NET Framework 3.5 SP1 Client Profile\r\n false\r\n \r\n \r\n False\r\n .NET Framework 3.5 SP1\r\n false\r\n \r\n \r\n \r\n \r\n CustomDictionary.xml\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/ObjectFailedException.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n using System;\n\n internal class ObjectFailedException : Exception\n {\n public ObjectFailedException(BuildObject obj, Failed failed)\n : base(obj.ToString() + \": \" + failed.ToString())\n {\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/ObjectMissingFromCacheException.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class ObjectMissingFromCacheException : Exception\r\n {\r\n private string itemHash;\r\n\r\n public ObjectMissingFromCacheException(string itemHash, string msg)\r\n : base(string.Format(\"item {0} missing from cache: {1}\", itemHash, msg))\r\n {\r\n this.itemHash = itemHash;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/ObjectNotReadyException.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n using System;\n\n internal class ObjectNotReadyException : Exception\n {\n public ObjectNotReadyException(BuildObject obj)\n : base(obj.ToString())\n {\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/OrderPreservingSet.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n /// \r\n /// Representation of an order-preserving set.\r\n /// \r\n /// \r\n /// Inspired by ICollection example at \r\n /// .\r\n /// \r\n /// Type of objects in the set.\r\n internal class OrderPreservingSet\r\n : ICollection\r\n {\r\n private readonly HashSet membership;\r\n private readonly List order;\r\n\r\n public OrderPreservingSet()\r\n : this(EqualityComparer.Default)\r\n {\r\n }\r\n\r\n public OrderPreservingSet(IEqualityComparer comparer)\r\n {\r\n this.membership = new HashSet(comparer);\r\n this.order = new List();\r\n }\r\n\r\n public OrderPreservingSet(IEnumerable initialContents)\r\n : this()\r\n {\r\n this.AddRange(initialContents);\r\n }\r\n\r\n public int Count\r\n {\r\n get { return this.membership.Count(); }\r\n }\r\n\r\n int ICollection.Count\r\n {\r\n get { return this.membership.Count; }\r\n }\r\n\r\n // TODO I don't know what this property is for.\r\n bool ICollection.IsReadOnly\r\n {\r\n get { return false; }\r\n }\r\n\r\n public void Add(T item)\r\n {\r\n if (!this.membership.Contains(item))\r\n {\r\n this.membership.Add(item);\r\n this.order.Add(item);\r\n }\r\n }\r\n\r\n void ICollection.Add(T item)\r\n {\r\n this.Add(item);\r\n }\r\n\r\n public void AddRange(IEnumerable range)\r\n {\r\n foreach (T obj in range)\r\n {\r\n this.Add(obj);\r\n }\r\n }\r\n\r\n void ICollection.Clear()\r\n {\r\n this.membership.Clear();\r\n this.order.Clear();\r\n }\r\n\r\n bool ICollection.Contains(T item)\r\n {\r\n return this.membership.Contains(item);\r\n }\r\n\r\n void ICollection.CopyTo(T[] array, int arrayIndex)\r\n {\r\n this.order.CopyTo(array, arrayIndex);\r\n }\r\n\r\n IEnumerator IEnumerable.GetEnumerator()\r\n {\r\n return this.order.GetEnumerator();\r\n }\r\n\r\n System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator()\r\n {\r\n return this.order.GetEnumerator();\r\n }\r\n\r\n bool ICollection.Remove(T item)\r\n {\r\n this.membership.Remove(item);\r\n return this.order.Remove(item);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/PathNormalizer.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.Globalization;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class PathNormalizer\r\n {\r\n private Dictionary cache;\r\n private char[] directorySeparators;\r\n\r\n public PathNormalizer()\r\n {\r\n this.cache = new Dictionary();\r\n this.directorySeparators = new char[] { Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar };\r\n }\r\n\r\n public static string dbg_normalizePath_nocache(string requestPath, bool presumedDirectory)\r\n {\r\n return PathNormalizer.normalizePath_nocache(requestPath, presumedDirectory);\r\n }\r\n\r\n // Normalize the case of an absolute path to the case present in the filesystem.\r\n public string normalizeAbsolutePath(string absPath)\r\n {\r\n string dotdotfreepath = this.cleanDotDots(absPath);\r\n if (!Path.IsPathRooted(dotdotfreepath))\r\n {\r\n throw new ArgumentException(\"Requires absolute path\");\r\n }\r\n\r\n return this.normalizePath(dotdotfreepath, false);\r\n }\r\n\r\n private static string normalizePath_nocache(string requestPath, bool presumedDirectory)\r\n {\r\n try\r\n {\r\n string rc;\r\n string childName = Path.GetFileName(requestPath);\r\n if (string.IsNullOrEmpty(childName))\r\n {\r\n // absPath was a \"root\" (MSDOS drive letter)\r\n // by fiat, drive letters are uppercase.\r\n rc = requestPath.ToUpper(CultureInfo.InvariantCulture) + Path.DirectorySeparatorChar;\r\n }\r\n else\r\n {\r\n string parentPath = Path.GetDirectoryName(requestPath);\r\n\r\n // Recurse to handle parent prefix:\r\n string normalizedParent = normalizePath_nocache(parentPath, true);\r\n\r\n DirectoryInfo parentDirectoryInfo = new DirectoryInfo(normalizedParent);\r\n FileSystemInfo[] childrenFileSystemInfos = null;\r\n string normalizedPath;\r\n try\r\n {\r\n childrenFileSystemInfos = parentDirectoryInfo.GetFileSystemInfos(childName);\r\n }\r\n catch (System.IO.DirectoryNotFoundException)\r\n {\r\n // Fall through and assume we're to create it.\r\n }\r\n\r\n if (childrenFileSystemInfos == null || childrenFileSystemInfos.Length == 0)\r\n {\r\n // Looks like a nonexistent path. I guess the caller gets to decide the\r\n // capitalization. NB this is fraught with danger, since we're not actually\r\n // creating the path in the filesystem, so someone else might try to create\r\n // a path with a different capitalization. However, if we memorize our\r\n // results, we should end up canonicalizing to the first capitalization\r\n // we see.\r\n normalizedPath = Path.Combine(normalizedParent, childName);\r\n\r\n // Unfortunately, we can't tell whether we should add a path separator here!\r\n if (presumedDirectory)\r\n {\r\n normalizedPath += Path.DirectorySeparatorChar;\r\n }\r\n }\r\n else\r\n {\r\n FileSystemInfo childFileSystemInfo = childrenFileSystemInfos.First();\r\n\r\n // Since we passed a normalized path into DirectoryInfo, we'll get\r\n // the normalized path back out, plus the filesystem's idea of the\r\n // child name's case.\r\n normalizedPath = childFileSystemInfo.FullName;\r\n if ((childFileSystemInfo.Attributes & FileAttributes.Directory) == FileAttributes.Directory)\r\n {\r\n normalizedPath += Path.DirectorySeparatorChar;\r\n }\r\n }\r\n\r\n rc = normalizedPath;\r\n }\r\n\r\n ////Logger.WriteLine(string.Format(\"{0}\\n => {1}\", requestPath, rc));\r\n return rc;\r\n }\r\n catch (Exception ex)\r\n {\r\n Trace.TraceError(ex.Message);\r\n throw new ArgumentException(\"invalid path\");\r\n }\r\n }\r\n\r\n // Invariant: input is an absolute path, free of ..s, lowercased, with\r\n // normalized path separators.\r\n // Based on suggestions in http://stackoverflow.com/questions/1214513/normalize-directory-names-in-c-sharp.\r\n private string normalizePath(string requestPath, bool presumedDirectory)\r\n {\r\n string lowerPath = requestPath.ToLower(CultureInfo.InvariantCulture);\r\n if (this.cache.ContainsKey(lowerPath))\r\n {\r\n return this.cache[lowerPath];\r\n }\r\n\r\n string rc = PathNormalizer.normalizePath_nocache(requestPath, presumedDirectory);\r\n this.cache[lowerPath] = rc;\r\n return rc;\r\n }\r\n\r\n private string cleanDotDots(string path)\r\n {\r\n string[] parts = path.Split(this.directorySeparators);\r\n List outParts = new List();\r\n for (int i = 0; i < parts.Length; i++)\r\n {\r\n if (parts[i].Equals(string.Empty))\r\n {\r\n // Null path segment: foo//bar.\r\n continue;\r\n }\r\n else if (parts[i].Equals(\".\"))\r\n {\r\n // Semantically-null segment.\r\n continue;\r\n }\r\n else if (parts[i].Equals(\"..\"))\r\n {\r\n outParts.RemoveAt(outParts.Count() - 1);\r\n }\r\n else\r\n {\r\n outParts.Add(parts[i]);\r\n }\r\n }\r\n\r\n return string.Join(Path.DirectorySeparatorChar.ToString(), outParts.ToArray());\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/PoundDefines.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class PoundDefines\r\n {\r\n private List definedSymbols;\r\n private string descr;\r\n\r\n public PoundDefines(IEnumerable definedSymbols)\r\n {\r\n this.definedSymbols = new List(definedSymbols);\r\n this.definedSymbols.Sort();\r\n\r\n // NB the null list gets a *null* ToString, which is interpreted as no appLabel.\r\n this.descr = this.definedSymbols.Count == 0 ? null : \"#\" + string.Join(\",\", this.definedSymbols);\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return this.descr;\r\n }\r\n\r\n public string getAbstractIdString()\r\n {\r\n return this.descr == null ? string.Empty : \", \" + this.descr;\r\n }\r\n\r\n public override int GetHashCode()\r\n {\r\n return this.descr.GetHashCode();\r\n }\r\n\r\n public override bool Equals(object obj)\r\n {\r\n PoundDefines other = obj as PoundDefines;\r\n if (other != null)\r\n {\r\n return (this.descr == null && other.descr == null)\r\n || (this.descr != null && this.descr.Equals(other.descr));\r\n }\r\n else\r\n {\r\n return false;\r\n }\r\n }\r\n\r\n internal static string toAppLabel(PoundDefines poundDefines)\r\n {\r\n return poundDefines == null ? null : poundDefines.ToString();\r\n }\r\n\r\n internal static PoundDefines empty()\r\n {\r\n return new PoundDefines(new string[] { });\r\n }\r\n\r\n internal IEnumerable ToDefArgs()\r\n {\r\n List args = new List();\r\n foreach (string symbol in this.definedSymbols)\r\n {\r\n args.Add(\"-def\");\r\n args.Add(symbol);\r\n }\r\n\r\n return args;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/Presentater.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Text;\r\n\r\n /// \r\n /// TODO: Rename this (and the file) to IPresentater, or maybe IPresenter.\r\n /// REVIEW: These all just emit strings. Wouldn't a simple table suffice?\r\n /// \r\n internal interface Presentater\r\n {\r\n void startHeader();\r\n\r\n void endHeader();\r\n\r\n void startLine();\r\n\r\n void endLine();\r\n\r\n void startSpacer();\r\n\r\n void endSpacer();\r\n\r\n void startColor(string colorName);\r\n\r\n void endColor();\r\n\r\n void startBullet();\r\n\r\n void endBullet();\r\n\r\n void startPre();\r\n\r\n void endPre();\r\n\r\n void doText(string text);\r\n }\r\n\r\n public class HTMLPresentater : Presentater\r\n {\r\n private StringBuilder document;\r\n\r\n public HTMLPresentater()\r\n {\r\n this.document = new StringBuilder();\r\n this.document.Append(\"\\n\\n\");\r\n }\r\n\r\n public override string ToString()\r\n {\r\n this.document.Append(\"\\n\\n\");\r\n return this.document.ToString();\r\n }\r\n\r\n public void startHeader()\r\n {\r\n this.document.Append(\"

\");\r\n }\r\n\r\n public void endHeader()\r\n {\r\n this.document.Append(\"

\");\r\n }\r\n\r\n public void startLine()\r\n {\r\n this.document.Append(\"
\");\r\n }\r\n\r\n public void endLine()\r\n {\r\n this.document.Append(\"
\\n\");\r\n }\r\n\r\n public void startSpacer()\r\n {\r\n this.document.Append(\"

\\n\");\r\n }\r\n\r\n public void endSpacer()\r\n {\r\n this.document.Append(\"

\\n\");\r\n }\r\n\r\n public void startColor(string colorName)\r\n {\r\n string htmlColor;\r\n switch (colorName)\r\n {\r\n case Presentation.RED:\r\n htmlColor = \"red\";\r\n break;\r\n case Presentation.GREEN:\r\n htmlColor = \"green\";\r\n break;\r\n default: htmlColor = \"black\";\r\n break;\r\n }\r\n\r\n this.document.Append(\"\");\r\n }\r\n\r\n public void endColor()\r\n {\r\n this.document.Append(\"\");\r\n }\r\n\r\n public void startBullet()\r\n {\r\n this.document.Append(\"
  • \");\r\n }\r\n\r\n public void endBullet()\r\n {\r\n this.document.Append(\"
    • \\n\");\r\n }\r\n\r\n public void startPre()\r\n {\r\n this.document.Append(\"
    \");\r\n        }\r\n\r\n        public void endPre()\r\n        {\r\n            this.document.Append(\"
    \\n\");\r\n }\r\n\r\n public void doText(string text)\r\n {\r\n this.document.Append(text);\r\n }\r\n }\r\n\r\n /// \r\n /// Appears to be a \"Presentater\" that uses \"ANSI escape sequences\" to\r\n /// produce colored output on console terminals that support it.\r\n /// \r\n /// \r\n /// \r\n /// \"ANSI escape sequences\" is probably the most common name for these\r\n /// things, although it is technically a misnomer, as ANSI withdrew the\r\n /// ANSI X3.64 spec in 1997. The real spec is ECMA-48, aka ISO/IEC 6429.\r\n /// See     .\r\n /// \r\n /// \r\n /// Windows cmd.exe doesn't implement this spec. So only those folks\r\n /// using alternative shells will get easily-readable output from this.\r\n /// \r\n /// \r\n public class ASCIIPresentater : Presentater\r\n {\r\n // REVIEW: These don't appear to properly follow the ECMA-48 spec.\r\n // All of these commands are of type \"Select Graphic Rendition\" or SGR.\r\n // In the spec, this is covered in section 8.3.117. \r\n // The 0 code is supposed to cancel the effect of any preceding SGR,\r\n // i.e. \"\\x1b[0m\" should cancel everything. Thus the following stop\r\n // codes don't just stop what their start codes started (and are overly\r\n // verbose). A universal stop code would suffice for this usage.\r\n // Notes on codes used below:\r\n // 0 = cancel the effect of any preceding SGR.\r\n // 1 = bold.\r\n // 32 = green display (i.e. text).\r\n // 37 = white display (i.e. text).\r\n // 39 = default display (i.e. text) color.\r\n // 40 = black background.\r\n // 41 = red background.\r\n // 43 = yellow background.\r\n // 49 = default background color.\r\n private static ColorEnum Red = new ColorEnum(\"\\x1b[01;41m\", \"\\x1b[0;49m\");\r\n private static ColorEnum Green = new ColorEnum(\"\\x1b[01;32m\", \"\\x1b[0;0m\");\r\n private static ColorEnum BlackBackground = new ColorEnum(\"\\x1b[01;40m\", \"\\x1b[0;49m\");\r\n private static ColorEnum YellowBackground = new ColorEnum(\"\\x1b[01;43m\", \"\\x1b[0;49m\");\r\n private static ColorEnum BoldWhite = new ColorEnum(\"\\x1b[01;37m\", \"\\x1b[0;39m\");\r\n private static ColorEnum WhiteOnBlack = ColorEnum.join(BlackBackground, BoldWhite);\r\n private static ColorEnum Ordinary = new ColorEnum(string.Empty, string.Empty);\r\n\r\n private StringBuilder document;\r\n private ColorEnum colorEnum;\r\n\r\n public ASCIIPresentater()\r\n {\r\n this.document = new StringBuilder();\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return this.document.ToString();\r\n }\r\n\r\n public void startHeader()\r\n {\r\n this.document.Append(WhiteOnBlack.start);\r\n }\r\n\r\n public void endHeader()\r\n {\r\n this.document.Append(WhiteOnBlack.stop + \"\\n\");\r\n }\r\n\r\n public void startLine()\r\n {\r\n }\r\n\r\n public void endLine()\r\n {\r\n this.document.Append(\"\\n\");\r\n }\r\n\r\n public void startSpacer()\r\n {\r\n }\r\n\r\n public void endSpacer()\r\n {\r\n this.document.Append(\"\\n\");\r\n }\r\n\r\n public void startColor(string colorName)\r\n {\r\n Util.Assert(this.colorEnum == null);\r\n switch (colorName)\r\n {\r\n case Presentation.RED:\r\n this.colorEnum = Red;\r\n break;\r\n case Presentation.GREEN:\r\n this.colorEnum = Green;\r\n break;\r\n default:\r\n this.colorEnum = Ordinary;\r\n break;\r\n }\r\n\r\n this.document.Append(this.colorEnum.start);\r\n }\r\n\r\n public void endColor()\r\n {\r\n this.document.Append(this.colorEnum.stop);\r\n this.colorEnum = null;\r\n }\r\n\r\n public void startBullet()\r\n {\r\n this.document.Append(\" * \");\r\n }\r\n\r\n public void endBullet()\r\n {\r\n this.document.Append(\"\\n\");\r\n }\r\n\r\n public void startPre()\r\n {\r\n }\r\n\r\n public void endPre()\r\n {\r\n if (!this.document.ToString().EndsWith(\"\\n\"))\r\n {\r\n this.document.Append(\"\\n\");\r\n }\r\n }\r\n\r\n public void doText(string text)\r\n {\r\n this.document.Append(text);\r\n }\r\n\r\n /// \r\n /// Definition of the start and stop sequences for a color.\r\n /// \r\n /// \r\n /// REVIEW: This class is not needed, as there is only one stop sequence.\r\n /// \r\n private class ColorEnum\r\n {\r\n public string start;\r\n public string stop;\r\n\r\n public ColorEnum(string start, string stop)\r\n {\r\n this.start = start;\r\n this.stop = stop;\r\n }\r\n\r\n public static ColorEnum join(ColorEnum a, ColorEnum b)\r\n {\r\n return new ColorEnum(a.start + b.start, b.stop + a.stop);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/Presentation.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.IO;\r\n using System.Text;\r\n using System.Xml;\r\n\r\n internal class Presentation : XmlFiller\r\n {\r\n // Completed representation.\r\n private string xmls;\r\n\r\n public const string _xml_tag = \"Presentation\";\r\n public const string HEADER = \"Header\";\r\n public const string LINE = \"Line\";\r\n public const string SPACER = \"Spacer\";\r\n public const string COLOR = \"Color\";\r\n public const string BULLET = \"Bullet\";\r\n public const string PRE = \"Pre\";\r\n\r\n public const string RED = \"red\";\r\n public const string GREEN = \"green\";\r\n\r\n public const string _xml_ColorValue_attr = \"Value\";\r\n\r\n public Presentation(string xmls)\r\n {\r\n this.xmls = xmls;\r\n }\r\n\r\n public static Presentation fromXml(XmlReader xr)\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n using (XmlWriter xw = XmlWriter.Create(sb))\r\n {\r\n xw.WriteStartDocument();\r\n xw.WriteNode(xr, false);\r\n xw.WriteEndDocument();\r\n xw.Close();\r\n }\r\n\r\n return new Presentation(sb.ToString());\r\n }\r\n\r\n public void fillXml(XmlWriter xw)\r\n {\r\n using (XmlReader xr = XmlReader.Create(new StringReader(this.xmls)))\r\n {\r\n xr.ReadToFollowing(_xml_tag);\r\n xw.WriteNode(xr, false);\r\n }\r\n }\r\n\r\n public void format(Presentater p)\r\n {\r\n using (XmlReader xr = XmlReader.Create(new StringReader(this.xmls)))\r\n {\r\n xr.ReadToFollowing(_xml_tag);\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n switch (xr.Name)\r\n {\r\n case HEADER:\r\n p.startHeader();\r\n break;\r\n case LINE:\r\n p.startLine();\r\n break;\r\n case SPACER:\r\n p.startSpacer();\r\n break;\r\n case COLOR:\r\n p.startColor(xr.GetAttribute(_xml_ColorValue_attr));\r\n break;\r\n case BULLET:\r\n p.startBullet();\r\n break;\r\n case PRE:\r\n p.startPre();\r\n break;\r\n default:\r\n Util.Assert(false);\r\n break;\r\n }\r\n }\r\n else if (xr.NodeType == XmlNodeType.EndElement)\r\n {\r\n switch (xr.Name)\r\n {\r\n case _xml_tag:\r\n break;\r\n case HEADER:\r\n p.endHeader();\r\n break;\r\n case LINE:\r\n p.endLine();\r\n break;\r\n case SPACER:\r\n p.endSpacer();\r\n break;\r\n case COLOR:\r\n p.endColor();\r\n break;\r\n case BULLET:\r\n p.endBullet();\r\n break;\r\n case PRE:\r\n p.endPre();\r\n break;\r\n default:\r\n Util.Assert(false);\r\n break;\r\n }\r\n }\r\n else if (xr.NodeType == XmlNodeType.Text)\r\n {\r\n p.doText(xr.Value);\r\n }\r\n }\r\n }\r\n }\r\n\r\n internal static string abbreviateLines(string m)\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n int count = 0;\r\n const int limit = 20;\r\n using (StringReader sr = new StringReader(m))\r\n {\r\n string line;\r\n while ((line = sr.ReadLine()) != null)\r\n {\r\n if (count == limit)\r\n {\r\n sb.AppendLine(\"[...error messages truncated. See failure log.]\");\r\n break;\r\n }\r\n\r\n sb.AppendLine(line);\r\n count += 1;\r\n }\r\n }\r\n\r\n return sb.ToString();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/PresentationBuilder.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Text;\r\n using System.Xml;\r\n\r\n internal class PresentationBuilder\r\n {\r\n // Build-up interface.\r\n private StringBuilder sb;\r\n private XmlWriter xw;\r\n\r\n public PresentationBuilder()\r\n {\r\n this.sb = new StringBuilder();\r\n\r\n // Notice no indentation, to avoid mungling text.\r\n this.xw = XmlWriter.Create(this.sb);\r\n this.xw.WriteStartDocument();\r\n this.xw.WriteStartElement(Presentation._xml_tag);\r\n }\r\n\r\n public Presentation fix()\r\n {\r\n this.xw.WriteEndElement();\r\n this.xw.WriteEndDocument();\r\n this.xw.Close();\r\n return new Presentation(this.sb.ToString());\r\n }\r\n\r\n public void text(string s)\r\n {\r\n this.xw.WriteString(s);\r\n }\r\n\r\n public void color(string color, string s)\r\n {\r\n this.xw.WriteStartElement(Presentation.COLOR);\r\n this.xw.WriteAttributeString(Presentation._xml_ColorValue_attr, color);\r\n this.text(s);\r\n this.xw.WriteEndElement();\r\n }\r\n\r\n public void header(string s)\r\n {\r\n this.simpleTag(Presentation.HEADER, s);\r\n }\r\n\r\n public void line(string s)\r\n {\r\n this.simpleTag(Presentation.LINE, s);\r\n }\r\n\r\n public void spacer()\r\n {\r\n this.simpleTag(Presentation.SPACER, string.Empty);\r\n }\r\n\r\n public void bullet(string s)\r\n {\r\n this.simpleTag(Presentation.BULLET, s);\r\n }\r\n\r\n public void pre(string s)\r\n {\r\n this.simpleTag(Presentation.PRE, s);\r\n }\r\n\r\n public void startHeader()\r\n {\r\n this.xw.WriteStartElement(Presentation.HEADER);\r\n }\r\n\r\n public void endHeader()\r\n {\r\n this.xw.WriteEndElement();\r\n }\r\n\r\n public void startLine()\r\n {\r\n this.xw.WriteStartElement(Presentation.LINE);\r\n }\r\n\r\n public void endLine()\r\n {\r\n this.xw.WriteEndElement();\r\n }\r\n\r\n public void startBullet()\r\n {\r\n this.xw.WriteStartElement(Presentation.BULLET);\r\n }\r\n\r\n public void endBullet()\r\n {\r\n this.xw.WriteEndElement();\r\n }\r\n\r\n private void simpleTag(string tag, string s)\r\n {\r\n this.xw.WriteStartElement(tag);\r\n this.text(s);\r\n this.xw.WriteEndElement();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/ProcessInvokeAsyncWorker.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n /// \r\n /// Representation of an asynchronous verb worker.\r\n /// \r\n internal class ProcessInvokeAsyncWorker : IVerbWorker\r\n {\r\n /// \r\n /// The private working directory for this worker to work in.\r\n /// \r\n private WorkingDirectory workingDirectory;\r\n\r\n /// \r\n /// The verb whose worker this is.\r\n /// \r\n private IProcessInvokeAsyncVerb verb;\r\n\r\n /// \r\n /// The executable to run.\r\n /// \r\n private string executable;\r\n\r\n /// \r\n /// The command line arguments to provide to the executable.\r\n /// \r\n private string[] args;\r\n\r\n /// \r\n /// How to handle the exit code from running the executable.\r\n /// \r\n private ProcessExitCodeHandling exitCodeHandling;\r\n\r\n /// \r\n /// Where to (optionally) collect diagnostics.\r\n /// \r\n private BuildObject failureBase;\r\n\r\n /// \r\n /// Where to capture standard out (I think).\r\n /// \r\n private BuildObject captureStdout;\r\n\r\n /// \r\n /// Debugging text for something or another.\r\n /// \r\n private string dbgText;\r\n\r\n /// \r\n /// Whether to allow an absolute (rather than relative) file path to the executable.\r\n /// \r\n private bool allowAbsoluteExe;\r\n\r\n /// \r\n /// Whether to allow absolute (rather than relative) file paths as arguments.\r\n /// \r\n private bool allowAbsoluteArgs;\r\n\r\n /// \r\n /// The working directory to use.\r\n /// \r\n private string workingDirOverride;\r\n\r\n /// \r\n /// Whether to return the standard output from the process in the Complete call.\r\n /// \r\n private bool returnStandardOut;\r\n\r\n /// \r\n /// Whether to return the error output from the process in the Complete call.\r\n /// \r\n private bool returnStandardError;\r\n\r\n /// \r\n /// The IProcessInvoker (either a ProcessInvoker or a CloudSubmitter) instance we use to run this executable (either locally or in the cloud).\r\n /// \r\n private IProcessInvoker pinv;\r\n\r\n /// \r\n /// Whether to run the executable in the cloud.\r\n /// \r\n private bool useCloudExecution;\r\n\r\n /// \r\n /// List of input files needed by the executable.\r\n /// \r\n private List inputFiles;\r\n\r\n /// \r\n /// List of output files produced by the executable.\r\n /// \r\n private List outputFiles;\r\n\r\n /// \r\n /// Initializes a new instance of the ProcessInvokeAsyncWorker class.\r\n /// \r\n /// The private working directory for this worker to work in.\r\n /// The verb whose worker this is.\r\n /// The executable to run.\r\n /// The command line arguments to provide to the executable.\r\n /// How to handle the return code from running the executable.\r\n /// Not sure what this is -- some debugging/diagnostic thing.\r\n /// Where to capture standard out (I think).\r\n /// Debugging text for something or another.\r\n /// Whether to allow an absolute (rather than relative) file path to the executable.\r\n /// Whether to allow absolute (rather than relative) file paths as arguments.\r\n /// The working directory to use.\r\n /// Whether to return the standard output of the process.\r\n /// Whether to return the standard error output of the process.\r\n /// Whether to allow this worker to run the executable in the cloud.\r\n /// \r\n /// TODO: executable should be a BuildObject, like every other dependency.\r\n /// \r\n public ProcessInvokeAsyncWorker(\r\n WorkingDirectory workingDirectory,\r\n IProcessInvokeAsyncVerb verb,\r\n string executable,\r\n string[] args,\r\n ProcessExitCodeHandling exitCodeHandling,\r\n BuildObject failureBase,\r\n BuildObject captureStdout = null,\r\n string dbgText = null,\r\n bool allowAbsoluteExe = false,\r\n bool allowAbsoluteArgs = false,\r\n string workingDirOverride = null,\r\n bool returnStandardOut = false,\r\n bool returnStandardError = false,\r\n bool allowCloudExecution = false)\r\n {\r\n this.workingDirectory = workingDirectory;\r\n this.verb = verb;\r\n this.executable = executable;\r\n this.args = args;\r\n this.exitCodeHandling = exitCodeHandling;\r\n this.failureBase = failureBase;\r\n this.captureStdout = captureStdout;\r\n this.dbgText = dbgText;\r\n this.allowAbsoluteExe = allowAbsoluteExe;\r\n this.allowAbsoluteArgs = allowAbsoluteArgs;\r\n this.workingDirOverride = workingDirOverride;\r\n this.returnStandardOut = returnStandardOut;\r\n this.returnStandardError = returnStandardError;\r\n\r\n if (allowCloudExecution)\r\n {\r\n // Verbs cannot allow cloud execution if they allow absolute paths to exes or args.\r\n Util.Assert(!this.allowAbsoluteExe);\r\n Util.Assert(!this.allowAbsoluteArgs);\r\n Util.Assert(this.workingDirOverride == null);\r\n\r\n if (BuildEngine.theEngine.CloudExecutionQueue != null)\r\n {\r\n // We're good to go for cloud execution.\r\n this.useCloudExecution = true;\r\n\r\n // REVIEW: If there are other things we should do on the main thread prior to CloudSubmitter invocation, we should do them here.\r\n this.inputFiles = this.GetInputFiles();\r\n this.outputFiles = new List(this.verb.getOutputs());\r\n this.outputFiles.AddRange(this.verb.getFailureOutputs());\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Indicates whether this work needs to be scheduled asynchronously.\r\n /// Since this is the asynchronous implementation, always returns Async.\r\n /// \r\n /// Always returns Async.\r\n public VerbWorkerType IsSync()\r\n {\r\n return VerbWorkerType.Async;\r\n }\r\n\r\n /// \r\n /// Gets the private working directory this verb executes in.\r\n /// \r\n /// The directory this verb executes in.\r\n public WorkingDirectory GetWorkingDirectory()\r\n {\r\n return this.workingDirectory;\r\n }\r\n\r\n /// \r\n /// Performs the slow, asynchronous work.\r\n /// \r\n /// \r\n /// Does not run on the main thread, so should not access caches\r\n /// (or do anything else that expects to be synchronous).\r\n /// When this returns, the work is expected to have completed.\r\n /// \r\n public void RunAsync()\r\n {\r\n if (this.useCloudExecution)\r\n {\r\n // REVIEW: Would prefer to use the verb's input hash value as the request identifier below.\r\n this.pinv = new CloudSubmitter(\r\n Path.GetRandomFileName(),\r\n this.workingDirectory,\r\n this.inputFiles,\r\n this.outputFiles,\r\n this.executable,\r\n this.args,\r\n this.failureBase,\r\n this.captureStdout,\r\n this.dbgText);\r\n }\r\n else\r\n {\r\n this.pinv = new ProcessInvoker(\r\n this.workingDirectory,\r\n this.executable,\r\n this.args,\r\n this.failureBase,\r\n this.captureStdout,\r\n this.dbgText,\r\n this.allowAbsoluteExe,\r\n this.allowAbsoluteArgs,\r\n this.workingDirOverride);\r\n }\r\n }\r\n\r\n /// \r\n /// Performs the completion work for Async workers, and is called\r\n /// after the runAsync method returns. Returns the ultimate\r\n /// disposition of the activity.\r\n /// \r\n /// \r\n /// This method runs synchronously on the main thread.\r\n /// It can tidy up the state after async work, and store results\r\n /// in the Repository.\r\n /// Thou shalt not return Stale.\r\n /// \r\n /// The disposition of this verb's worker's work.\r\n public Disposition Complete()\r\n {\r\n this.verb.RecordProcessInvokeCpuTime(this.pinv.CpuTime);\r\n\r\n string stdout = null;\r\n if (this.returnStandardOut)\r\n {\r\n stdout = this.pinv.GetStdout();\r\n }\r\n\r\n string stderr = null;\r\n if (this.returnStandardError)\r\n {\r\n stderr = this.pinv.GetStderr();\r\n }\r\n\r\n Disposition disposition;\r\n if (this.exitCodeHandling == ProcessExitCodeHandling.NonzeroIsOkay || this.pinv.ExitCode == 0)\r\n {\r\n disposition = new Fresh();\r\n }\r\n else\r\n {\r\n // Sheesh. Some tools emit error messages to stdout.\r\n // REVIEW: Provide full command line here rather than just executable (like old version did)?\r\n Failed f = new Failed(this.pinv.GetStdout() + this.pinv.GetStderr());\r\n f.AddError(\"Executable: \" + this.executable + \"\\n\");\r\n disposition = f;\r\n }\r\n\r\n return this.verb.Complete(this.workingDirectory, this.pinv.CpuTime, stdout, stderr, disposition);\r\n }\r\n\r\n /// \r\n /// Gets the input files needed for verb execution.\r\n /// \r\n /// List of the verb's input files.\r\n private List GetInputFiles()\r\n {\r\n DependencyDisposition ddisp;\r\n List inputFiles = new List();\r\n\r\n foreach (BuildObject input in this.verb.getDependencies(out ddisp))\r\n {\r\n if (!(input is VirtualBuildObject))\r\n {\r\n inputFiles.Add(input);\r\n }\r\n }\r\n\r\n return inputFiles;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/ProcessInvoker.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Text;\r\n\r\n /// \r\n /// Represents the invoker of processes that do the work of a verb worker.\r\n /// \r\n public class ProcessInvoker : IProcessInvoker\r\n {\r\n /// \r\n /// Whether to always emit diagnostic output.\r\n /// \r\n private const bool AlwaysEmitDiagnostics = true;\r\n\r\n /// \r\n /// The CPU time used by the process, in seconds.\r\n /// \r\n private double cpuTime;\r\n\r\n /// \r\n /// The exit code returned by the process.\r\n /// \r\n private int exitCode;\r\n\r\n /// \r\n /// The stream used to collect standard out to a file (if requested).\r\n /// \r\n private StreamWriter stdoutFile;\r\n\r\n /// \r\n /// The temporary file in which to store standard out (if requested).\r\n /// \r\n private BuildObject tmpStdout;\r\n\r\n /// \r\n /// Where standard out is collected by default.\r\n /// \r\n private StringBuilder stdout;\r\n\r\n /// \r\n /// Where standard error is collected.\r\n /// \r\n private StringBuilder stderr;\r\n\r\n /// \r\n /// The private working directory for the process we invoke.\r\n /// \r\n private WorkingDirectory workingDirectory;\r\n\r\n /// \r\n /// Initializes a new instance of the ProcessInvoker class.\r\n /// \r\n /// The working directory the process is started in.\r\n /// The executable to run.\r\n /// The command line arguments to provide to the executable.\r\n /// Not sure what this is -- some debugging/diagnostic thing.\r\n /// Where to (optionally) capture standard out.\r\n /// Debugging text for something or another.\r\n /// Whether to allow an absolute (rather than relative) file path to the executable.\r\n /// Whether to allow absolute (rather than relative) file paths as arguments.\r\n /// The working directory to use.\r\n public ProcessInvoker(\r\n WorkingDirectory workingDirectory,\r\n string executable,\r\n string[] args,\r\n BuildObject failureBase,\r\n BuildObject captureStdout = null,\r\n string dbgText = null,\r\n bool allowAbsoluteExe = false,\r\n bool allowAbsoluteArgs = false,\r\n string workingDirOverride = null)\r\n {\r\n // Catch bad verb authors before they hurt themselves.\r\n Util.Assert(allowAbsoluteExe || !executable.Contains(\":\")); // Hey, this looks like an absolute path! Use .getRelativePath(); it makes your output more stable.\r\n foreach (string arg in args)\r\n {\r\n // Pardon my distasteful heuristic to avoid flagging /flag:value args.\r\n Util.Assert(allowAbsoluteArgs || arg.Length < 2 || arg[1] != ':'); // Hey, this looks like an absolute path! Use .getRelativePath() to tolerate crossing machine boundaries.\r\n }\r\n\r\n this.workingDirectory = workingDirectory;\r\n this.stdout = new StringBuilder();\r\n this.stderr = new StringBuilder();\r\n\r\n using (Job job = new Job())\r\n {\r\n using (Process proc = new Process())\r\n {\r\n if (allowAbsoluteExe)\r\n {\r\n proc.StartInfo.FileName = executable;\r\n }\r\n else\r\n {\r\n // TODO: *All* async verbs need to list their executable (and all the libs it depends upon) as dependencies.\r\n proc.StartInfo.FileName = workingDirectory.PathTo(executable);\r\n }\r\n\r\n // TODO Is there a better way to escape the args to avoid problems with spaces?\r\n proc.StartInfo.Arguments = string.Join(\" \", args);\r\n proc.StartInfo.WorkingDirectory = workingDirOverride == null ? workingDirectory.Root : workingDirOverride;\r\n proc.StartInfo.RedirectStandardOutput = true;\r\n\r\n // REVIEW: Maybe we should always capture stdout in a StringBuilder and just write it out to a file afterwards if requested?\r\n if (captureStdout != null)\r\n {\r\n this.tmpStdout = new BuildObject(captureStdout.getRelativePath() + \".tmp\");\r\n this.stdoutFile = new StreamWriter(workingDirectory.PathTo(this.tmpStdout));\r\n proc.OutputDataReceived += new DataReceivedEventHandler(this.StdoutRedirectHandler);\r\n }\r\n else\r\n {\r\n // Collect stdout here for diagnostics.\r\n proc.OutputDataReceived += new DataReceivedEventHandler(this.StdoutHandler);\r\n }\r\n\r\n proc.StartInfo.RedirectStandardError = true;\r\n proc.ErrorDataReceived += new DataReceivedEventHandler(this.StderrHandler);\r\n proc.StartInfo.UseShellExecute = false;\r\n\r\n string commandLine = proc.StartInfo.FileName + \" \" + proc.StartInfo.Arguments;\r\n if (failureBase != null && AlwaysEmitDiagnostics)\r\n {\r\n // In diagnostic mode, we emit the command line twice, once ahead in case Boogie decides\r\n // to run away and never come back.\r\n BuildObject failureBatObj = failureBase.makeOutputObject(\".bat\");\r\n workingDirectory.CreateDirectoryFor(failureBatObj);\r\n File.WriteAllText(workingDirectory.PathTo(failureBatObj), commandLine);\r\n }\r\n\r\n proc.Start();\r\n job.AddProcess(proc);\r\n proc.BeginOutputReadLine();\r\n proc.BeginErrorReadLine();\r\n proc.WaitForExit();\r\n\r\n this.cpuTime = job.GetCpuTime().TotalSeconds;\r\n\r\n this.exitCode = proc.ExitCode;\r\n if (this.stdoutFile != null)\r\n {\r\n this.stdoutFile.Close();\r\n }\r\n\r\n if (failureBase != null && AlwaysEmitDiagnostics)\r\n {\r\n workingDirectory.CreateDirectoryFor(failureBase);\r\n File.WriteAllText(workingDirectory.PathTo(failureBase.makeOutputObject(\".bat\")), commandLine);\r\n File.WriteAllText(workingDirectory.PathTo(failureBase.makeOutputObject(\".txt\")), dbgText);\r\n File.WriteAllText(workingDirectory.PathTo(failureBase.makeOutputObject(\".stdout\")), this.GetStdoutString());\r\n File.WriteAllText(workingDirectory.PathTo(failureBase.makeOutputObject(\".stderr\")), this.GetStderr());\r\n }\r\n }\r\n }\r\n\r\n // REVIEW: Add Delete, Exists and Move methods to WorkingDirectory class?\r\n if (this.tmpStdout != null && File.Exists(workingDirectory.PathTo(this.tmpStdout)))\r\n {\r\n // REVIEW: Nothing should be here. Bother with the delete?\r\n File.Delete(workingDirectory.PathTo(captureStdout));\r\n File.Move(workingDirectory.PathTo(this.tmpStdout), workingDirectory.PathTo(captureStdout));\r\n this.tmpStdout = null;\r\n }\r\n }\r\n\r\n /// \r\n /// Gets the exit code returned by the process.\r\n /// \r\n public int ExitCode\r\n {\r\n get { return this.exitCode; }\r\n }\r\n\r\n /// \r\n /// Gets the CPU time used by the process, in seconds.\r\n /// \r\n public double CpuTime\r\n {\r\n get { return this.cpuTime; }\r\n }\r\n\r\n /// \r\n /// Gets the process's standard output in the default case.\r\n /// Does not return the standard output if it is redirected to a file (i.e. if CaptureStdout is non-null).\r\n /// \r\n /// The process's standard output.\r\n public string GetStdout()\r\n {\r\n return this.stdout.ToString();\r\n }\r\n\r\n /// \r\n /// Gets the process's standard error output..\r\n /// \r\n /// The process's standard error output.\r\n public string GetStderr()\r\n {\r\n return this.stderr.ToString();\r\n }\r\n\r\n /// \r\n /// Gets the process's standard output, regardless of whether it was redirected to a file.\r\n /// \r\n /// The process's standard output.\r\n private string GetStdoutString()\r\n {\r\n if (this.tmpStdout != null)\r\n {\r\n return File.ReadAllText(this.workingDirectory.PathTo(this.tmpStdout));\r\n }\r\n else\r\n {\r\n return this.GetStdout();\r\n }\r\n }\r\n\r\n /// \r\n /// Alternate handler for the OutputDataReceived event.\r\n /// Stores the data in the previously specified file.\r\n /// \r\n /// The parameter is not used.\r\n /// Contains a line of characters read from the process's standard out.\r\n private void StdoutRedirectHandler(object sendingProcess, DataReceivedEventArgs dataLine)\r\n {\r\n this.stdoutFile.WriteLine(dataLine.Data);\r\n }\r\n\r\n /// \r\n /// Default handler for the OutputDataReceived event.\r\n /// Stores the data in a local StringBuilder instance.\r\n /// \r\n /// The parameter is not used.\r\n /// Contains a line of characters read from the process's standard out.\r\n private void StdoutHandler(object sendingProcess, DataReceivedEventArgs dataLine)\r\n {\r\n // REVIEW: Can't we use AppendLine here instead?\r\n this.stdout.Append(dataLine.Data + \"\\n\");\r\n }\r\n\r\n /// \r\n /// Handler for the ErrorDataReceived event.\r\n /// Stores the data in a local StringBuilder instance.\r\n /// \r\n /// The parameter is not used.\r\n /// Contains a line of characters read from the process's standard error.\r\n private void StderrHandler(object sendingProcess, DataReceivedEventArgs dataLine)\r\n {\r\n // REVIEW: Can't we use AppendLine here instead?\r\n this.stderr.Append(dataLine.Data + \"\\n\");\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/Program.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n\r\n internal class Program\r\n {\r\n private bool useCloudExecution;\r\n private bool useCloudCache;\r\n private BackgroundWorker backgroundWorker;\r\n private string[] args;\r\n private VerificationRequest verificationRequest = new VerificationRequest();\r\n\r\n public Program()\r\n {\r\n this.useCloudExecution = false;\r\n this.useCloudCache = true;\r\n this.backgroundWorker = new BackgroundWorker();\r\n }\r\n\r\n static void Main(string[] args)\r\n {\r\n new Program().main(args);\r\n ////DbgHashSpeedTest.thing();\r\n ////DbgFileCopySpeedTest.thing();\r\n }\r\n\r\n void usage(string msg)\r\n {\r\n Logger.WriteLine(msg);\r\n Logger.WriteLine(string.Format(\r\n \"Usage: {0} [opts] [Verb Target]*\",\r\n System.AppDomain.CurrentDomain.FriendlyName));\r\n throw new UserError(\"Invalid options\");\r\n }\r\n\r\n string ironRoot;\r\n int jobParallelism = 1;\r\n List verbs = new List();\r\n string html_output = null;\r\n IroncladAppVerb.TARGET target_platform = IroncladAppVerb.TARGET.BARE_METAL;\r\n DafnyCCVerb.FramePointerMode useFramePointer = DafnyCCVerb.FramePointerMode.NoFramePointer;\r\n\r\n private bool releaseBuild = true;\r\n\r\n int argi;\r\n\r\n string takeArg(string expectedThing)\r\n {\r\n if (argi >= args.Count())\r\n {\r\n usage(\"Expected \" + expectedThing);\r\n }\r\n\r\n string rc = args[argi];\r\n argi += 1;\r\n return rc;\r\n }\r\n\r\n SourcePath conditionSourcePath(string path)\r\n {\r\n return new SourcePath(path);\r\n }\r\n\r\n void fixIronRoot()\r\n {\r\n if (ironRoot == null)\r\n {\r\n ironRoot = getDefaultIronRoot();\r\n if (ironRoot == null)\r\n {\r\n usage(\"--ironRoot not specified and cannot infer ironRoot\");\r\n }\r\n }\r\n\r\n BuildEngine.theEngine.setIronRoot(ironRoot);\r\n }\r\n\r\n void parseArgs(string[] args)\r\n {\r\n this.args = args;\r\n argi = 0;\r\n while (argi < args.Count())\r\n {\r\n string next = takeArg(\"option or verb\"); // Should always succeed due to while condition.\r\n if (next.StartsWith(\"-\"))\r\n {\r\n if (next.Equals(\"--ironRoot\"))\r\n {\r\n if (this.ironRoot != null)\r\n {\r\n usage(\"ironRoot set after use\");\r\n }\r\n\r\n this.ironRoot = takeArg(\"value for ironRoot\");\r\n }\r\n else if (next.Equals(\"-j\") || next.Equals(\"--jobs\"))\r\n {\r\n this.jobParallelism = Int32.Parse(takeArg(\"value for jobs\"));\r\n }\r\n else if (next.Equals(\"--localcache\"))\r\n {\r\n BuildEngine.theEngine.setLocalCache(takeArg(\"path for localcache\"));\r\n }\r\n else if (next.ToLower().Equals(\"--cloudcache\"))\r\n {\r\n this.useCloudCache = true;\r\n }\r\n else if (next.ToLower().Equals(\"--no-cloudcache\"))\r\n {\r\n this.useCloudCache = false;\r\n }\r\n else if (next.Equals(\"--cloudexecution\"))\r\n {\r\n this.useCloudExecution = true;\r\n }\r\n else if (next.ToLower().Equals(\"--verify\"))\r\n {\r\n this.verificationRequest.verifyMode = VerificationRequest.VerifyMode.Verify;\r\n }\r\n else if (next.ToLower().Equals(\"--no-verify\"))\r\n {\r\n this.verificationRequest.verifyMode = VerificationRequest.VerifyMode.NoVerify;\r\n }\r\n else if (next.ToLower().Equals(\"--no-symdiff\"))\r\n {\r\n this.verificationRequest.verifyMode = VerificationRequest.VerifyMode.NoSymDiff;\r\n }\r\n else if (next.ToLower().Equals(\"--verify-select\"))\r\n {\r\n this.verificationRequest.verifyMode = VerificationRequest.VerifyMode.SelectiveVerify;\r\n this.verificationRequest.selectiveVerifyModuleNames.Add(takeArg(\"filename for selective-verify\"));\r\n }\r\n else if (next.ToLower().Equals(\"--html\"))\r\n {\r\n this.html_output = takeArg(\"filename for html report\");\r\n }\r\n else if (next.ToLower().Equals(\"--windows\"))\r\n {\r\n this.target_platform = IroncladAppVerb.TARGET.WINDOWS;\r\n }\r\n else if (next.ToLower().Equals(\"--useframepointer\"))\r\n {\r\n this.useFramePointer = DafnyCCVerb.FramePointerMode.UseFramePointer;\r\n }\r\n else if (next.ToLower().Equals(\"--debug\"))\r\n {\r\n this.releaseBuild = false;\r\n }\r\n else\r\n {\r\n usage(\"unrecognized option \" + next);\r\n }\r\n }\r\n else\r\n {\r\n string verb = next;\r\n string target = takeArg(\"verb-target\");\r\n\r\n fixIronRoot();\r\n if (verb.Equals(\"DafnyVerifyTree\"))\r\n {\r\n verbs.Add(new VerificationResultSummaryVerb(new DafnyVerifyTreeVerb(conditionSourcePath(target))));\r\n }\r\n else if (verb.Equals(\"BatchDafny\"))\r\n {\r\n if (!target.EndsWith(\".batch\"))\r\n {\r\n usage(\"Batching expects a .batch file containing a list of .dfy files\");\r\n }\r\n\r\n verbs.Add(new VerificationResultSummaryVerb(new BatchVerifyVerb(conditionSourcePath(target), BatchVerifyVerb.BatchMode.DAFNY, this.verificationRequest, useFramePointer)));\r\n }\r\n else if (verb.Equals(\"BatchApps\"))\r\n {\r\n if (!target.EndsWith(\".batch\"))\r\n {\r\n usage(\"Batching expects a .batch file containing a list of .dfy files\");\r\n }\r\n\r\n verbs.Add(new VerificationResultSummaryVerb(new BatchVerifyVerb(conditionSourcePath(target), BatchVerifyVerb.BatchMode.APP, this.verificationRequest, useFramePointer)));\r\n }\r\n else if (verb.Equals(\"Beat\"))\r\n {\r\n verbs.Add(new BeatVerb(BuildEngine.theEngine.getVerveContextVerb(PoundDefines.empty()), conditionSourcePath(target), appLabel: null));\r\n }\r\n else if (verb.Equals(\"Boogie\"))\r\n {\r\n verbs.Add(new BoogieVerb(BuildEngine.theEngine.getVerveContextVerb(PoundDefines.empty()), conditionSourcePath(target), symdiff: this.verificationRequest.getSymDiffMode()));\r\n }\r\n else if (verb.Equals(\"IroncladApp\"))\r\n {\r\n verbs.Add(new IroncladAppVerb(conditionSourcePath(target), target_platform, this.useFramePointer, this.verificationRequest));\r\n }\r\n else if (verb.Equals(\"IronfleetApp\"))\r\n {\r\n verbs.Add(new IronfleetAppVerb(conditionSourcePath(target), this.verificationRequest, this.releaseBuild));\r\n }\r\n else if (verb.Equals(\"DafnyCompileOne\"))\r\n {\r\n verbs.Add(new DafnyCompileOneVerb(conditionSourcePath(target)));\r\n }\r\n else if (verb.Equals(\"VSSolution\"))\r\n {\r\n verbs.Add(new VSSolutionVerb(new SourcePath(target, SourcePath.SourceType.Tools)));\r\n }\r\n else if (verb.Equals(\"nmake\"))\r\n {\r\n verbs.Add(new NmakeVerb(new SourcePath(target, SourcePath.SourceType.Tools)));\r\n }\r\n else if (verb.Equals(\"BootableApp\"))\r\n {\r\n verbs.Add(new BootableAppVerb(conditionSourcePath(target), this.useFramePointer, this.verificationRequest));\r\n }\r\n else\r\n {\r\n usage(\"Unknown verb \" + verb);\r\n }\r\n }\r\n }\r\n\r\n fixIronRoot();\r\n }\r\n\r\n private IItemCache GetItemCache()\r\n {\r\n string localCacheDirectory = Path.Combine(\r\n BuildEngine.theEngine.getIronRoot(),\r\n BuildEngine.theEngine.getLocalCache());\r\n\r\n if (this.useCloudCache)\r\n {\r\n try\r\n {\r\n BuildEngine.theEngine.CloudCache = new ItemCacheCloud();\r\n\r\n return new ItemCacheMultiplexer(\r\n new ItemCacheLocal(localCacheDirectory),\r\n BuildEngine.theEngine.CloudCache,\r\n this.backgroundWorker);\r\n }\r\n catch (Microsoft.WindowsAzure.Storage.StorageException)\r\n {\r\n // -\r\n // This will handle the case of being disconnected\r\n // at NuBuild launch time.\r\n // -\r\n Logger.WriteLine(\"Failed to create multiplexed cloud cache -- falling back to just local cache.\");\r\n }\r\n }\r\n\r\n return new ItemCacheLocal(localCacheDirectory);\r\n }\r\n\r\n const string IRONROOT_sentinel = \"IRONROOT.sentinel\";\r\n\r\n string getAssemblyPath()\r\n {\r\n string assyUri = System.Reflection.Assembly.GetExecutingAssembly().CodeBase;\r\n string assyPath = new Uri(assyUri).LocalPath;\r\n return assyPath;\r\n }\r\n\r\n string getDefaultIronRoot()\r\n {\r\n string exepath = Path.GetDirectoryName(getAssemblyPath());\r\n exepath = Path.GetFullPath(exepath);\r\n string[] parts = exepath.Split(new char[] { '\\\\' });\r\n for (int i = parts.Length; i > 0; i--)\r\n {\r\n string proposal = string.Join(\"\\\\\", parts.Take(i));\r\n if (File.Exists(Path.Combine(proposal, IRONROOT_sentinel)))\r\n {\r\n return proposal;\r\n }\r\n }\r\n\r\n return null;\r\n }\r\n\r\n void logNubuildInvocation(string[] args)\r\n {\r\n Logger.WriteLine(string.Format(\"{0} {1}\",\r\n getAssemblyPath(),\r\n string.Join(\" \", args)));\r\n }\r\n\r\n // NB this file is found in the default ironroot, since we\r\n // grab it before we parse your --ironroot argument.\r\n private const string NUBUILD_CONFIG = \"nubuild.config\";\r\n\r\n private IEnumerable fetchConfigArgs()\r\n {\r\n string config_path =\r\n Path.Combine(getDefaultIronRoot(), NUBUILD_CONFIG);\r\n if (!File.Exists(config_path))\r\n {\r\n return new string[] { };\r\n }\r\n\r\n List config_args = new List();\r\n foreach (string line in File.ReadAllLines(config_path))\r\n {\r\n foreach (string word in line.Trim().Split(new char[] { ' ' }))\r\n {\r\n config_args.Add(word);\r\n }\r\n }\r\n\r\n return config_args;\r\n }\r\n\r\n void main(string[] cmdline_args)\r\n {\r\n string[] all_args = fetchConfigArgs().Concat(cmdline_args).ToArray();\r\n logNubuildInvocation(all_args);\r\n try\r\n {\r\n parseArgs(all_args);\r\n }\r\n catch (UserError err)\r\n {\r\n usage(err.Message);\r\n }\r\n\r\n BuildEngine.theEngine.ItemCache = GetItemCache();\r\n BuildEngine.theEngine.Repository = new Repository(BuildEngine.theEngine.ItemCache);\r\n if (this.useCloudExecution)\r\n {\r\n if (!this.useCloudCache)\r\n {\r\n usage(\"Cloud Execution requires Cloud Cache!\");\r\n }\r\n\r\n BuildEngine.theEngine.CloudReportQueueName = Path.GetRandomFileName().Substring(0, 8);\r\n BuildEngine.theEngine.CloudExecutionQueue = new CloudExecutionQueue(BuildEngine.theEngine.CloudReportQueueName);\r\n Logger.WriteLine(\"Using cloud report queue name: \" + BuildEngine.theEngine.CloudReportQueueName);\r\n }\r\n\r\n Scheduler scheduler = new Scheduler(jobParallelism);\r\n\r\n scheduler.addTargetVerbs(verbs);\r\n\r\n ////try\r\n ////{\r\n scheduler.parallelSchedule();\r\n ////}\r\n ////catch (Exception ex)\r\n ////{\r\n //// scheduler.dbgDisplayCounts();\r\n //// throw;\r\n ////}\r\n\r\n IEnumerable targets = scheduler.getTargets();\r\n\r\n BuildObject outputTarget = null;\r\n if (targets.Count() > 0)\r\n {\r\n outputTarget = targets.First();\r\n }\r\n else\r\n {\r\n Logger.WriteLine(\"No targets requested.\");\r\n }\r\n\r\n if (targets.Count() > 1)\r\n {\r\n // TODO need a better story for relaying failure results. Right now\r\n // they get stuck in the results cache, but don't appear where we\r\n // can find them. Emit to a log, or to files in nuobj?\r\n Logger.WriteLine(\"Multiple targets build. First result follows.\");\r\n }\r\n\r\n if (outputTarget != null)\r\n {\r\n Disposition d = scheduler.getObjectDisposition(outputTarget);\r\n if (d is Fresh)\r\n {\r\n ASCIIPresentater ascii = new ASCIIPresentater();\r\n IVerb verb = scheduler.getParent(outputTarget);\r\n verb.getPresentation().format(ascii);\r\n Logger.Write(ascii.ToString());\r\n\r\n if (this.html_output != null)\r\n {\r\n HTMLPresentater html = new HTMLPresentater();\r\n verb.getPresentation().format(html);\r\n\r\n try\r\n {\r\n using (StreamWriter sw = new StreamWriter(this.html_output))\r\n {\r\n sw.Write(html.ToString());\r\n }\r\n }\r\n catch (Exception e)\r\n {\r\n Logger.WriteLine(\"Failed to write html output to file: \" + html_output);\r\n Logger.WriteLine(\"Exception was: \" + e);\r\n }\r\n }\r\n }\r\n else\r\n {\r\n Logger.WriteLine(\"Build failed.\");\r\n foreach (string msg in d.getMessages())\r\n {\r\n Logger.Write(msg);\r\n }\r\n }\r\n }\r\n else if (targets.Count() == 0)\r\n {\r\n Logger.WriteLine(\"No targets requested.\");\r\n }\r\n else\r\n {\r\n Logger.WriteLine(\"Multiple targets built. Look for results in nuobj/.\");\r\n }\r\n\r\n // -\r\n // We have to explicitly ask the BackgroundWorker thread to exit\r\n // as it will prevent the process from exiting until it does.\r\n // -\r\n this.backgroundWorker.StopWork();\r\n\r\n // -\r\n // Report what the background worker accomplished during this run.\r\n // -\r\n this.backgroundWorker.WaitForCompletion();\r\n Logger.WriteLine(string.Format(\"Background Worker completed {0} work items out of {1} queued.\",\r\n this.backgroundWorker.GetWorkItemsPerformed,\r\n this.backgroundWorker.GetWorkItemsQueued));\r\n if (this.backgroundWorker.GetWorkItemsFailed != 0)\r\n {\r\n Logger.WriteLine(string.Format(\r\n \"{0} work item procedures failed (threw an exception).\",\r\n this.backgroundWorker.GetWorkItemsFailed));\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n// General Information about an assembly is controlled through the following \r\n// set of attributes. Change these attribute values to modify the information\r\n// associated with an assembly.\r\n[assembly: AssemblyTitle(\"NuBuild\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"NuBuild\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n// Setting ComVisible to false makes the types in this assembly not visible \r\n// to COM components. If you need to access a type in this assembly from \r\n// COM, set the ComVisible attribute to true on that type.\r\n[assembly: ComVisible(false)]\r\n\r\n// The following GUID is for the ID of the typelib if this project is exposed to COM\r\n[assembly: Guid(\"1855bc44-97d2-41da-89fc-dae901580a54\")]\r\n\r\n// Version information for an assembly consists of the following four values:\r\n//\r\n// Major Version\r\n// Minor Version \r\n// Build Number\r\n// Revision\r\n//\r\n// You can specify all the values or you can default the Build and Revision Numbers \r\n// by using the '*' as shown below:\r\n// [assembly: AssemblyVersion(\"1.0.*\")]\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/Repository.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n using System;\n using System.Collections.Generic;\n using System.IO;\n using System.Linq;\n using System.Text;\n\n /// \n /// Tracker of BuildObjects, in their various forms.\n /// For virtual build objects, also provides the content store.\n /// \n /// \n /// There is only one instance of this class in the system.\n /// This class includes functionality from the old ResultCache and\n /// NuObjContents classes.\n /// Old NuObjContents comment:\n /// This class keeps track of the data we've stored into nuobj/.\n /// The invariant is that we never read data out of nuobj/ if it's\n /// not data we put there ourselves this execution (perhaps by\n /// fetching it from the cache). Data from the cache is safe,\n /// because it is tracked by concreteIdentifier. But data in\n /// nuobj/ may be stale, leading us to build the wrong thing.\n /// (A wrong thing would be correctly labeled, so it won't poison\n /// the cache, but it wouldn't be the output the user asked for.)\n /// \n internal class Repository\n {\n /// \n /// Collection of information about build objects.\n /// \n private Dictionary entries;\n\n /// \n /// Record of the verbs for which we've already added the\n /// output objects resulting from their (cached) execution.\n /// \n /// \n /// This avoids re-adding the entire set if we ask for another object\n /// in the same verb's output list. Note that this ignores the hash\n /// value of the verb; it assumes that the hash values don't change\n /// across a run of this process.\n /// \n private HashSet alreadyAddedVerbs;\n\n /// \n /// The item cache we're using.\n /// \n private IItemCache itemCache;\n\n /// \n /// Initializes a new instance of the Repository class.\n /// \n /// The item cache we're using.\n public Repository(IItemCache itemCache)\n {\n this.itemCache = itemCache;\n\n this.entries = new Dictionary();\n this.alreadyAddedVerbs = new HashSet();\n }\n\n /// \n /// Reads a build object from the local filesystem and stores it in the\n /// cache.\n /// \n /// \n /// Private directory for verb execution.\n /// \n /// The build object to store in the cache.\n /// \n /// Disposition of verb which created this object (if known).\n /// \n /// A BuildObjectValuePointer describing the object.\n public BuildObjectValuePointer Store(WorkingDirectory workingDirectory, BuildObject obj, Disposition disposition)\n {\n string contentHash = Util.hashFilesystemPath(workingDirectory.PathTo(obj));\n this.itemCache.StoreItemFromFile(ItemCacheContainer.Objects, contentHash, workingDirectory.PathTo(obj));\n this.Add(obj, disposition, contentHash, null);\n\n return new BuildObjectValuePointer(contentHash, obj.getRelativePath());\n }\n\n /// \n /// Fetches a build object and stores it in the local filesystem.\n /// \n /// \n /// Directory under which to store the fetched object.\n /// \n /// The object to fetch.\n public void Fetch(WorkingDirectory workingDirectory, BuildObject obj)\n {\n RepositoryEntry entry = this.FetchFresh(obj);\n\n // REVIEW: best way to determine this is a source file?\n ItemCacheContainer container;\n if (obj is SourcePath)\n {\n container = ItemCacheContainer.Sources;\n }\n else\n {\n container = ItemCacheContainer.Objects;\n }\n\n this.itemCache.FetchItemToFile(container, entry.Hash, workingDirectory.PathTo(obj));\n }\n\n /// \n /// Gets a readable stream for the given build object contents.\n /// \n /// The object in question.\n /// An open, readable stream to the contents.\n public TextReader OpenRead(BuildObject obj)\n {\n RepositoryEntry entry = this.FetchFresh(obj);\n\n // REVIEW: best way to determine this is a source file?\n ItemCacheContainer container;\n if (obj is SourcePath)\n {\n container = ItemCacheContainer.Sources;\n }\n else\n {\n container = ItemCacheContainer.Objects;\n }\n\n byte[] contents = this.itemCache.FetchItem(container, entry.Hash);\n MemoryStream stream = new MemoryStream(contents, false);\n return new StreamReader(stream);\n }\n\n /// \n /// Stores a result record in the cache.\n /// \n /// \n /// Item cache hash key to store result under.\n /// \n /// The result record to store.\n public void StoreResult(string inputHash, ResultSummaryRecord result)\n {\n ItemCacheContainer container;\r\n if (result.IsVerificationTimeout || (result.Disposition is Failed))\r\n {\r\n container = ItemCacheContainer.FailedResults;\r\n }\r\n else\r\n {\r\n container = ItemCacheContainer.Results;\r\n }\r\n\r\n using (MemoryStream outStream = new MemoryStream())\n {\n using (StreamWriter outWriter = new StreamWriter(outStream))\n {\n outWriter.Write(result.ToXml());\n }\n\n this.itemCache.StoreItem(container, inputHash, outStream.ToArray());\r\n }\n }\n\n /// \n /// Fetches a result record from the cache.\n /// \n /// \n /// Item cache hash key the result is stored under.\n /// \n /// \r\n /// Whether to return cached failures as well as successes.\r\n /// \r\n /// \n /// The result record requested if available, otherwise returns a\n /// summary record with Stale disposition.\n /// \n public ResultSummaryRecord FetchResult(string inputHash, bool includeFailedResults = false)\r\n {\n byte[] result = this.itemCache.FetchItem(ItemCacheContainer.Results, inputHash);\n if ((result == null) && includeFailedResults)\r\n {\r\n result = this.itemCache.FetchItem(ItemCacheContainer.FailedResults, inputHash);\r\n }\r\n\r\n if (result != null)\n {\n MemoryStream resultStream = new MemoryStream(result);\n try\n {\n using (StreamReader inReader = new StreamReader(resultStream))\n {\n string xmlSummary = inReader.ReadToEnd();\n return ResultSummaryRecord.FromXml(xmlSummary);\n }\n }\n catch (System.Xml.XmlException ex)\n {\n throw new ObjectMissingFromCacheException(inputHash, \"Malformed xml: \" + ex.ToString());\n }\n finally\n {\n resultStream.Dispose();\n }\n }\n else\n {\n return new ResultSummaryRecord(new Stale(), new BuildObjectValuePointer[] { }, false);\n }\n }\n\n /// \n /// Add information about a virtual object to the Repository,\n /// including its contents.\n /// \n /// The object in question.\n /// \n /// Disposition of the verb which created this object.\n /// \n /// Contents of the object.\n public void StoreVirtual(BuildObject obj, Disposition disposition, VirtualContents contents)\n {\n Util.Assert(obj is VirtualBuildObject);\n this.Add(obj, disposition, null, contents);\n }\n\n /// \n /// Retrieves the virtual content referenced by the given build object.\n /// \n /// The object in question.\n /// The virtual contents of the object.\n public VirtualContents FetchVirtual(BuildObject obj)\n {\n return this.FetchFresh(obj).VirtualContents;\n }\n\n /// \n /// Gets the disposition of the verb that generated a build object.\n /// \n /// The object in question.\n /// Disposition of the object.\n public Disposition GetDisposition(BuildObject obj)\n {\n RepositoryEntry value = this.GetValue(obj);\n if (value != null)\n {\n return value.Disposition;\n }\n\n return new Stale();\n }\n\n /// \n /// Gets the hash of an object registered with this Repository.\n /// \n /// The object in question.\n /// \n /// The hash of the object (if known), otherwise null.\n /// \n public string GetHash(BuildObject obj)\n {\n string hash = null;\n\n RepositoryEntry value = this.GetValue(obj);\n if (value != null)\n {\n if (value.Disposition is Failed)\n {\n hash = null;\n }\n else if (obj is VirtualBuildObject)\n {\n hash = \"virtual\";\n }\n else\n {\n hash = value.Hash;\n }\n }\n\n return hash;\n }\n\n /// \n /// Adds the output objects from a cached verb execution to the\n /// repository, and ensures they are present in the item cache.\n /// \n /// The verb whose outputs to add.\n /// \n /// The result summary record of the verb execution.\n /// \n /// \n /// Call only when output objects are known to be cached\n /// (i.e. because FetchResult returned non-Stale).\n /// REVIEW: This function probably shouldn't be in this file.\n /// It does something similar for cached verb results that\n /// the scheduler's recordResult method does for new verb\n /// executions. Move this there and/or refactor?\n /// \n public void AddVerbResults(IVerb verb, ResultSummaryRecord resultRecord)\n {\n if (this.alreadyAddedVerbs.Contains(verb))\n {\n // We only need to add a cached verb execution's outputs once.\n return;\n }\n\n Disposition disposition = resultRecord.Disposition;\n\n // REVIEW: In the below, some of these IEnumerables should be\n // HashSets, and the HashSet should be a simple List.\n\n // Create a collection of the potential outputs.\n IEnumerable outputs = verb.getOutputs();\n IEnumerable failureOutputs = verb.getFailureOutputs();\n outputs = outputs.Concat(failureOutputs);\n Dictionary potentialOutputs = new Dictionary();\n foreach (BuildObject obj in outputs)\n {\n potentialOutputs.Add(obj.getRelativePath(), obj);\n }\n\n // Compare the actual outputs with the potential outputs,\n // and add the actual ones to the repository.\n HashSet recorded = new HashSet();\n foreach (BuildObjectValuePointer actualOutput in resultRecord.Outputs)\n {\n if (potentialOutputs.ContainsKey(actualOutput.RelativePath))\n {\n BuildObject obj = potentialOutputs[actualOutput.RelativePath];\n // TODO: Verify that the object exists in the item cache!\n this.AddObject(obj, disposition, actualOutput.ObjectHash);\n recorded.Add(obj);\n\n // Store a copy of this verb output as a file in the real nuobj directory.\n Util.Assert(actualOutput.RelativePath.StartsWith(BuildEngine.theEngine.getObjRoot(), StringComparison.Ordinal));\n this.itemCache.FetchItemToFile(ItemCacheContainer.Objects, actualOutput.ObjectHash, IronRootDirectory.PathTo(actualOutput.RelativePath));\r\n }\n else\n {\n // Complain if we find interloping outputs.\n throw new Exception(\"Distressing: some actual verb outputs aren't in the verb's list of potential outputs\");\n }\n }\n\n // Create a collection of missing outputs.\n IEnumerable unrecorded = outputs.Except(recorded).Except(failureOutputs);\n\n // For non-Failed verb runs, complain if all expected outputs don't\n // show up in the actual outputs.\n Util.Assert(unrecorded.Count() == 0 || disposition is Failed);\n\n // For cached verb runs with permanent failures (i.e. disposition\n // is Failed), we want to mark all of the expected outputs as Failed\n // even if no corresponding actual output was produced during the\n // failed verb run.\n foreach (BuildObject obj in unrecorded)\n {\n this.AddObject(obj, disposition, null);\n }\n\n // Remember that we've already added this verb's outputs.\n this.alreadyAddedVerbs.Add(verb);\n }\n\n /// \n /// Add information about an object to the Repository.\n /// The object path must be under the object root.\n /// \n /// The object in question.\n /// \n /// Disposition of the verb which created this object.\n /// \n /// Hash of the object's contents.\n public void AddObject(BuildObject obj, Disposition disposition, string hash)\n {\n Util.Assert(obj.getRelativePath().StartsWith(BuildEngine.theEngine.getObjRoot(), StringComparison.Ordinal));\n this.Add(obj, disposition, hash, null);\n }\n\n /// \n /// Gets the number of entries in this repository, for debugging.\n /// \n /// Number of objects recorded in this repository.\n internal int DbgCacheSize()\n {\n return this.entries.Count();\n }\n\n /// \n /// Fetches information about the given object in this repository.\n /// \n /// The object to fetch.\n /// Information about the object.\n private RepositoryEntry FetchFresh(BuildObject obj)\n {\n RepositoryEntry value = this.GetValue(obj);\n if (value == null)\n {\n throw new ObjectNotReadyException(obj);\n }\n\n if (value.Disposition is Failed)\n {\n throw new ObjectFailedException(obj, (Failed)value.Disposition);\n }\n\n Util.Assert(value.Disposition is Fresh); // This isn't really a 'not ready' condition; we shouldn't be here. REVIEW: What is meant by this comment?\n return value;\n }\n\n /// \n /// Gets information about an object in this repository.\n /// Will add missing source objects to the repository as needed.\n /// \n /// The object to look up.\n /// Information about the object.\n /// \n /// Returns null if obj isn't in this run's cache.\n /// Cannot return value.disposition==Stale, I guess?\n /// \n private RepositoryEntry GetValue(BuildObject obj)\n {\n if (this.entries.ContainsKey(obj))\n {\n return this.entries[obj];\n }\n else\r\n {\r\n SourcePath src = obj as SourcePath;\r\n if (src != null)\r\n {\n // Special case to get local source files into the\n // repository (and the item cache).\n // REVIEW: Should we require that source files are explicitly added?\n try\n {\n // Complain if someone uses tabs or non-CRLF line endings in a source file.\r\n // Visual Studio is pretty insistent on using tabs in solution (.sln) files, so we let it.\r\n if ((src.Type == SourcePath.SourceType.Src) && (src.getExtension() != \".sln\"))\r\n {\r\n if (!Util.CheckSourceFileForBadCharacters(IronRootDirectory.PathTo(obj)))\r\n {\r\n throw new SourceConfigurationError(\"Bad characters (tabs?) or non-CRLF line endings in source file \" + obj.getRelativePath());\r\n }\r\n }\r\n\r\n string hash = Util.hashFilesystemPath(IronRootDirectory.PathTo(obj));\n this.itemCache.StoreItemFromFile(ItemCacheContainer.Sources, hash, IronRootDirectory.PathTo(obj));\n this.Add(obj, new Fresh(), hash, null);\n }\n catch (IOException)\n {\n throw new SourceConfigurationError(\"Cannot find source path \" + obj.getRelativePath());\n }\n\n return this.entries[obj];\n }\n else\n {\n return null;\n }\n }\n }\r\n\n /// \n /// Add information about an object to the Repository.\n /// \n /// The object to add.\n /// \n /// Disposition of the verb which created this object.\n /// \n /// Hash of the object's contents.\n /// Contents of the object (if virtual).\n private void Add(BuildObject obj, Disposition disposition, string hash, VirtualContents contents)\n {\n // Every object in the repository should either have a hash value\n // or virtual contents, but not both.\n Util.Assert((string.IsNullOrEmpty(hash) && contents != null) ||\n (!string.IsNullOrEmpty(hash) && (contents == null)));\n\n // Check to see if the object is already in this repository.\n if (this.entries.ContainsKey(obj))\n {\n // We shouldn't be adding conflicting information for\n // the same object during the same build run.\n RepositoryEntry entry = this.entries[obj];\n Util.Assert(entry.Disposition.GetType() == disposition.GetType());\n Util.Assert(entry.Hash.Equals(hash, StringComparison.Ordinal));\n Util.Assert(entry.VirtualContents == contents);\n\n // Don't replace existing entry with equivalent.\n return;\n }\n\n this.entries[obj] = new RepositoryEntry(disposition, hash, contents);\n }\n\n /// \n /// Information we keep about build objects in our collection.\n /// \n private class RepositoryEntry\n {\n /// \n /// Disposition of the verb that created this object.\n /// \n private Disposition disposition;\n\n /// \n /// Hash of the object's contents (if non-virtual).\n /// \n private string hash;\n\n /// \n /// For objects not stored in the item cache or the filesystem,\n /// here's the computed value.\n /// \n private VirtualContents virtualContents;\n\n /// \n /// Initializes a new instance of the RepositoryEntry class.\n /// \n /// \n /// Disposition of the verb that created this object.\n /// \n /// Hash of the object's contents.\n /// \n /// Computed value of the object (if virtual, null otherwise).\n /// \n public RepositoryEntry(Disposition disposition, string hash, VirtualContents virtualContents)\n {\n this.hash = hash;\n this.disposition = disposition;\n this.virtualContents = virtualContents;\n }\n\n /// \n /// Gets the hash of the object's contents.\n /// \n public string Hash\n {\n get { return this.hash; }\n }\n\n /// \n /// Gets the disposition of the verb that created this object.\n /// \n public Disposition Disposition\n {\n get { return this.disposition; }\n }\n\n /// \n /// Gets the computed value of the object (if a virtual object,\n /// returns null otherwise).\n /// \n public VirtualContents VirtualContents\n {\n get { return this.virtualContents; }\n }\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/ResultSummaryRecord.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Text;\r\n using System.Xml;\r\n\r\n /// \r\n /// Representation of the result of a particular verb's execution.\r\n /// \r\n public class ResultSummaryRecord\r\n {\r\n /// \r\n /// The XML element name for this object.\r\n /// \r\n public const string XmlTag = \"ResultSummaryRecord\";\r\n\r\n /// \r\n /// The XML attribute name for the IsVerificationTimeout value.\r\n /// \r\n public const string XmlIsVerificationTimeoutAttribute = \"IsVerificationTimeout\";\r\n\r\n /// \r\n /// The verb whose execution this is the result of.\r\n /// \r\n private IVerb verb;\r\n\r\n /// \r\n /// The disposition of the verb execution.\r\n /// \r\n private Disposition disposition;\r\n\r\n /// \r\n /// Whether this result is a rejectable failure.\r\n /// \r\n private bool isRejectableFailure;\r\n\r\n /// \r\n /// The build objects that were produced by this verb execution.\r\n /// \r\n private List outputs;\r\n\r\n /// \r\n /// Initializes a new instance of the ResultSummaryRecord class.\r\n /// \r\n /// \r\n /// The verb whose execution this is the result of.\r\n /// \r\n /// \r\n /// The disposition of the verb execution.\r\n /// \r\n /// \r\n /// The build objects that were produced by this verb execution.\r\n /// \r\n internal ResultSummaryRecord(\r\n IVerb verb,\r\n Disposition disposition,\r\n IEnumerable outputs)\r\n : this(verb, disposition, outputs, false)\r\n {\r\n }\r\n\r\n /// \r\n /// Initializes a new instance of the ResultSummaryRecord class.\r\n /// \r\n /// \r\n /// The disposition of the verb execution.\r\n /// \r\n /// \r\n /// The build objects that were produced by this verb execution.\r\n /// \r\n /// \r\n /// Whether this result is a verification timeout.\r\n /// \r\n internal ResultSummaryRecord(\r\n Disposition disposition,\r\n IEnumerable outputs,\r\n bool isVerificationTimeout)\r\n : this(null, disposition, outputs, isVerificationTimeout)\r\n {\r\n }\r\n\r\n /// \r\n /// Initializes a new instance of the ResultSummaryRecord class.\r\n /// \r\n /// \r\n /// The verb whose execution this is the result of.\r\n /// \r\n /// \r\n /// The disposition of the verb execution.\r\n /// \r\n /// \r\n /// The build objects that were produced by this verb execution.\r\n /// \r\n /// \r\n /// Whether this result is a rejectable failure.\r\n /// \r\n internal ResultSummaryRecord(\r\n IVerb verb,\r\n Disposition disposition,\r\n IEnumerable outputs,\r\n bool isRejectableFailure)\r\n {\r\n this.verb = verb;\r\n this.disposition = disposition;\r\n this.outputs = new List(outputs);\r\n this.isRejectableFailure = isRejectableFailure;\r\n\r\n IRejectable rejectableVerb = verb as IRejectable;\r\n if (rejectableVerb != null)\r\n {\r\n this.isRejectableFailure = rejectableVerb.resultWasRejectableFailure();\r\n }\r\n }\r\n\r\n /// \r\n /// Gets a value indicating whether this result is a failure of\r\n /// some sort (includes verification timeouts).\r\n /// \r\n public bool IsFailure\r\n {\r\n get { return this.isRejectableFailure || (this.disposition is Failed); }\r\n }\r\n\r\n /// \r\n /// Gets a value indicating whether this result is a verification\r\n /// timeout.\r\n /// \r\n public bool IsVerificationTimeout\r\n {\r\n get { return this.isRejectableFailure; }\r\n }\r\n\r\n /// \r\n /// Gets the build objects that were produced by this verb execution.\r\n /// \r\n public IEnumerable Outputs\r\n {\r\n get { return this.outputs; }\r\n }\r\n\r\n /// \r\n /// Gets the disposition of the verb execution.\r\n /// \r\n internal Disposition Disposition\r\n {\r\n get { return this.disposition; }\r\n }\r\n\r\n /// \r\n /// Creates a result record from an XML representation.\r\n /// \r\n /// \r\n /// A string containing an XML document representing this result record.\r\n /// \r\n /// \r\n /// A new result record corresponding to the XML representation read.\r\n /// \r\n public static ResultSummaryRecord FromXml(string xs)\r\n {\r\n XmlReader xr = XmlReader.Create(new StringReader(xs));\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n break;\r\n }\r\n }\r\n\r\n return ReadXml(xr);\r\n }\r\n\r\n /// \r\n /// Helper function to read an XML element (not a full document)\r\n /// representing a result record.\r\n /// \r\n /// \r\n /// Note that the XmlReader is expected to be positioned in the XML\r\n /// document such that the current node is a result record element.\r\n /// \r\n /// The XmlReader object to read from.\r\n /// \r\n /// A new result record corresponding to the XML representation read.\r\n /// \r\n public static ResultSummaryRecord ReadXml(XmlReader xr)\r\n {\r\n Util.Assert(xr.Name.Equals(ResultSummaryRecord.XmlTag));\r\n\r\n bool isVerificationTimeout = false;\r\n bool.TryParse(\r\n xr.GetAttribute(XmlIsVerificationTimeoutAttribute), out isVerificationTimeout);\r\n\r\n xr.ReadToFollowing(Disposition._xml_tag);\r\n Disposition d = Disposition.readXml(xr);\r\n\r\n List lbovp = new List();\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.EndElement)\r\n {\r\n Util.Assert(xr.Name.Equals(ResultSummaryRecord.XmlTag));\r\n break;\r\n }\r\n else if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n if (xr.Name.Equals(BuildObjectValuePointer.XmlTag))\r\n {\r\n lbovp.Add(BuildObjectValuePointer.ReadXml(xr));\r\n }\r\n else\r\n {\r\n throw new Exception(\"Unknown xml tag \" + xr.Name);\r\n }\r\n }\r\n }\r\n\r\n return new ResultSummaryRecord(d, lbovp, isVerificationTimeout);\r\n }\r\n\r\n /// \r\n /// Creates an XML document representing this result record.\r\n /// \r\n /// \r\n /// A string containing an XML document representing this result record.\r\n /// \r\n public string ToXml()\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n XmlWriterSettings settings = new XmlWriterSettings();\r\n settings.Indent = true;\r\n XmlWriter xw = XmlWriter.Create(sb, settings);\r\n xw.WriteStartDocument();\r\n this.WriteXml(xw);\r\n xw.Close();\r\n return sb.ToString();\r\n }\r\n\r\n /// \r\n /// Helper function to write an XML element (not a full document)\r\n /// representing this result record.\r\n /// \r\n /// The XmlWriter object to write to.\r\n public void WriteXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(XmlTag);\r\n xw.WriteAttributeString(\r\n ResultSummaryRecord.XmlIsVerificationTimeoutAttribute,\r\n this.isRejectableFailure.ToString());\r\n\r\n if (this.verb != null)\r\n {\r\n this.verb.writeTimingXml(xw);\r\n this.verb.writeDebugXml(xw);\r\n }\r\n\r\n this.disposition.writeXml(xw);\r\n\r\n foreach (BuildObjectValuePointer bovp in this.outputs)\r\n {\r\n bovp.WriteXml(xw);\r\n }\r\n\r\n xw.WriteEndElement();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/Scheduler.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Security.Cryptography;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n\r\n /// \r\n /// Mechanism for determining which verbs need to be run and in what order.\r\n /// \r\n internal class Scheduler\r\n {\r\n /// \r\n /// Whether to produce conditional debug output in the scheduler and\r\n /// some of its components.\r\n /// \r\n internal const bool Debug = false;\r\n\r\n /// \r\n /// Where to write scheduler progress information (for debugging).\r\n /// \r\n private const string DbgProgressFileName = \"nubuild.progress\";\r\n\r\n /// \r\n /// REVIEW: Not used. Remove?\r\n /// \r\n private const string DispositionFileExtension = \".disp\";\r\n\r\n /// \r\n /// The second-order verb sorter we use.\r\n /// \r\n private VerbToposorter verbToposorter;\r\n\r\n /// \r\n /// Collection of initial output targets.\r\n /// \r\n private HashSet targets;\r\n\r\n /// \r\n /// Waiting verb tracker?\r\n /// \r\n private WaitIndex waitIndex;\r\n\r\n /// \r\n /// Tracker of build objects.\r\n /// \r\n private Repository repository;\r\n\r\n /// \r\n /// The component of the scheduler that runs verbs for us.\r\n /// \r\n private VerbRunner verbRunner;\r\n\r\n /// \r\n /// Count of verbs submitted to the verbRunner for running during\r\n /// this round?\r\n /// \r\n private int submittedCount;\r\n\r\n /// \r\n /// Map of build objects to the verb that creates them.\r\n /// \r\n private Dictionary outputToVerbMap;\r\n\r\n /// \r\n /// Verbs in the outputToVerbMap.\r\n /// REVIEW: These verbs should be equivalent to those in\r\n /// outputToVerbMap.Values. Worth keeping this separate HashSet\r\n /// for performance reasons?\r\n /// \r\n private HashSet knownVerbs;\r\n\r\n /// \r\n /// Cache of verb dependencies.\r\n /// \r\n private DependencyCache depCache;\r\n\r\n /// \r\n /// Verbs that have been submitted for execution or failed,\r\n /// and need not be further considered.\r\n /// \r\n private HashSet resolvedVerbs;\r\n\r\n /// \r\n /// Verbs that have been completed, and hence can't contribute\r\n /// to resolving any pending dependencies.\r\n /// (If it's resolved and not completed, it must be submitted\r\n /// for asynchronous execution.)\r\n /// \r\n private HashSet completedVerbs;\r\n\r\n /// \r\n /// Our general strategy is to record the outcome of every verb in\r\n /// a persistent result cache, and then to evaluate each downstream\r\n /// BuildObject by querying that cache. But when one verb fails,\r\n /// it may make the downstream verb unable to even compute its input\r\n /// set, and hence its concreteIdentifier (the key to a persistent\r\n /// cache). If we don't record the outcome somehow, we'll loop\r\n /// forever trying to learn the outcome of the downstream failure.\r\n /// So we record it here in-process, keyed by abstractIdentifier\r\n /// (which is assumed to be stable over a single run of NuBuild).\r\n /// Invariant: all values in this dictionary are Faileds. (We store\r\n /// them because they might (someday) propagate information about\r\n /// what failed for an error message.)\r\n /// \r\n private Dictionary unrecordableFailures;\r\n\r\n /// \r\n /// Whether to reject cached failures, apparently.\r\n /// Value comes from a command-line argument.\r\n /// \r\n private bool rejectCachedFailures;\r\n\r\n /// \r\n /// Verbs that are (still) required to be run to build our target(s).\r\n /// Verbs are removed from this collection as they are completed.\r\n /// \r\n private HashSet requiredVerbs;\r\n\r\n /// \r\n /// Verbs to look at on next pass through parallelSchedule's main loop?\r\n /// Serves as a method for passing a collection of verbs between\r\n /// parallelSchedule and disposeCurrentVerbs.\r\n /// \r\n private HashSet nextVerbs;\r\n\r\n ////private DbgVerbCounter dbgVerbCounter = new DbgVerbCounter();\r\n\r\n /// \r\n /// Initializes a new instance of the Scheduler class.\r\n /// \r\n /// \r\n /// Degree of parallel execution to allow.\r\n /// \r\n /// \r\n /// Whether to reject cached failures.\r\n /// \r\n public Scheduler(int jobParallelism)\r\n {\r\n this.targets = new HashSet();\r\n this.waitIndex = new WaitIndex();\r\n this.repository = BuildEngine.theEngine.Repository;\r\n this.unrecordableFailures = new Dictionary();\r\n this.verbToposorter = new VerbToposorter();\r\n this.verbRunner = new VerbRunner(this.verbToposorter, jobParallelism);\r\n this.resolvedVerbs = new HashSet();\r\n this.completedVerbs = new HashSet();\r\n this.outputToVerbMap = new Dictionary();\r\n this.knownVerbs = new HashSet();\r\n this.depCache = new DependencyCache();\r\n this.rejectCachedFailures = true; // this is now permanent. The code path for caching Failure results has rotted.\r\n }\r\n\r\n /// \r\n /// Adds one or more build objects to our collection of targets.\r\n /// \r\n /// \r\n /// REVIEW: Make this private (or inline into addVerbTargets)?\r\n /// \r\n /// Build objects to add.\r\n public void addTargets(IEnumerable newTargets)\r\n {\r\n this.targets.UnionWith(newTargets);\r\n }\r\n\r\n /// \r\n /// Schedules the verbs for execution.\r\n /// This is the top-level method driving the build.\r\n /// \r\n public void parallelSchedule()\r\n {\r\n // Convert our collection of initial targets into a\r\n // collection of verbs we need to run to create them.\r\n this.requiredVerbs = new HashSet();\r\n foreach (BuildObject target in this.targets)\r\n {\r\n this.requiredVerbs.Add(this.getParent(target));\r\n }\r\n\r\n // The set of verbs we're evaluating now.\r\n HashSet currentVerbs = new HashSet(this.requiredVerbs);\r\n\r\n // A set into which we accumulate verbs to evaluate on the next pass.\r\n this.nextVerbs = new HashSet();\r\n\r\n // Loop until we've run all the verbs we need to run.\r\n while (this.requiredVerbs.Count() > 0)\r\n {\r\n this.disposeCurrentVerbs(currentVerbs);\r\n currentVerbs = null; // Just to be obvious.\r\n\r\n // Okay, now we wait around for some deps to finish, freeing up new targets.\r\n while (this.nextVerbs.Count() == 0 && this.requiredVerbs.Count() > 0)\r\n {\r\n this.Say(string.Format(\"scheduler waits, having submitted {0} verbs\", this.submittedCount));\r\n ////Util.Assert(submittedCount > 0); // False because we might be waiting for other stuff to complete.\r\n\r\n List taskCompletions;\r\n taskCompletions = this.verbRunner.scheduleAndWait(this);\r\n this.Say(\"received \" + taskCompletions.Count() + \" taskCompletions\");\r\n\r\n Util.Assert(this.requiredVerbs.Count() == 0 || taskCompletions.Count() > 0);\r\n this.processTaskCompletions(taskCompletions);\r\n\r\n currentVerbs = this.nextVerbs;\r\n this.nextVerbs = new HashSet();\r\n if (currentVerbs.Count() > 0 || this.requiredVerbs.Count() == 0)\r\n {\r\n // Hey, something changed that we could reschedule on,\r\n // or we're actually all done.\r\n break;\r\n }\r\n\r\n // Hmm, we've got no opportunity to schedule new stuff,\r\n // so the VerbRunner better not return empty-handed the\r\n // next time through.\r\n // We've got an assert taskCompletions.Count()>0 to check\r\n // for that.\r\n this.Say(\"Scheduler waiting for more results.\");\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Display various debugging information.\r\n /// \r\n public void dbgDisplayCounts()\r\n {\r\n ////dbgVerbCounter.dbgDisplayCounts();\r\n this.depCache.dbgPrintStats();\r\n }\r\n\r\n /// \r\n /// Display various debugging information.\r\n /// \r\n internal void dbgDumpWaitIndex()\r\n {\r\n this.waitIndex.dbgDisplayIndex(this);\r\n }\r\n\r\n /// \r\n /// Determine the status of a verb (for debugging purposes).\r\n /// \r\n /// Verb being examined.\r\n /// A string containing the verb's current status.\r\n internal string dbgGetVerbStatus(IVerb verb)\r\n {\r\n if (this.completedVerbs.Contains(verb))\r\n {\r\n return \"completed\";\r\n }\r\n\r\n if (this.resolvedVerbs.Contains(verb))\r\n {\r\n return \"submitted\";\r\n }\r\n\r\n return \"pending\";\r\n }\r\n\r\n /// \r\n /// Adds a verb to the mapping of build objects to the verb which\r\n /// creates them.\r\n /// \r\n /// \r\n /// TODO: Make this private.\r\n /// \r\n /// The verb to add.\r\n internal void addVerb(IVerb verb)\r\n {\r\n if (!this.knownVerbs.Add(verb))\r\n {\r\n // We've already added this verb.\r\n return;\r\n }\r\n\r\n // Add all verb outputs to the output-to-verb map.\r\n foreach (BuildObject obj in verb.getOutputs())\r\n {\r\n if (this.outputToVerbMap.ContainsKey(obj))\r\n {\r\n Util.Assert(this.outputToVerbMap[obj].Equals(verb));\r\n }\r\n else\r\n {\r\n this.outputToVerbMap[obj] = verb;\r\n }\r\n }\r\n\r\n // Recursively add all the verbs this verb is dependent upon,\r\n // so that we have a complete index of outputs back to the\r\n // verbs that generate them.\r\n foreach (IVerb dependentVerb in verb.getVerbs())\r\n {\r\n this.addVerb(dependentVerb);\r\n }\r\n }\r\n\r\n /// \r\n /// Adds a collection of verbs (or rather their outputs) as\r\n /// targets for this build.\r\n /// \r\n /// A list of verbs to run.\r\n internal void addTargetVerbs(List verbs)\r\n {\r\n foreach (IVerb verb in verbs)\r\n {\r\n this.addVerb(verb);\r\n this.addTargets(verb.getOutputs());\r\n }\r\n }\r\n\r\n /// \r\n /// Gets a list of target objects for this build.\r\n /// \r\n /// A list of target objects for this build.\r\n internal IEnumerable getTargets()\r\n {\r\n return this.targets;\r\n }\r\n\r\n /// \r\n /// Gets the verb that created the given object.\r\n /// \r\n /// \r\n /// Would like to rename this to \"GetCreator\" or \"GetCreatorVerb\"\r\n /// as it seems strange to call something a parent when it is a\r\n /// completely different object type, but the terminology seems\r\n /// to be widely used in the system.\r\n /// \r\n /// The object in question.\r\n /// The verb that creates the given object.\r\n internal IVerb getParent(BuildObject obj)\r\n {\r\n IVerb result;\r\n this.outputToVerbMap.TryGetValue(obj, out result);\r\n return result;\r\n }\r\n\r\n /// \r\n /// Gets the disposition of the verb that created the given object.\r\n /// \r\n /// The object in question.\r\n /// The disposition of the verb that created the given object.\r\n internal Disposition getObjectDisposition(BuildObject obj)\r\n {\r\n return this.repository.GetDisposition(obj);\r\n }\r\n\r\n /// \r\n /// Updates the \"progress\" output file with current status information.\r\n /// \r\n /// \r\n /// Count of verbs currently able to be run.\r\n /// \r\n /// \r\n /// Count of verbs currently running.\r\n /// \r\n internal void dbgUpdateProgress(int runnableVerbsCount, int runningVerbsCount)\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n sb.AppendLine(\"completedVerbs: \" + this.completedVerbs.Count());\r\n sb.AppendLine(\"resolvedVerbs: \" + this.resolvedVerbs.Count());\r\n sb.AppendLine(\"runnableVerbs: \" + runnableVerbsCount);\r\n sb.AppendLine(\"runningVerbs: \" + runningVerbsCount);\r\n sb.AppendLine(\"waitingVerbs: \" + this.waitIndex.Count());\r\n File.WriteAllText(DbgProgressFileName, sb.ToString());\r\n }\r\n\r\n /// \r\n /// Computes a concrete identifier for a verb operation and its\r\n /// specific inputs.\r\n /// \r\n /// The verb to compute the hash for.\r\n /// \r\n /// Whether to assert if we can't compute the hash.\r\n /// \r\n /// \r\n /// A concrete identifier for a verb operation and its specific inputs.\r\n /// \r\n private string computeInputHash(IVerb verb, bool assertHashAvailable)\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n sb.Append(verb.getAbstractIdentifier().getConcreteId());\r\n DependencyDisposition ddisp;\r\n foreach (BuildObject obj in this.depCache.getDependencies(verb, out ddisp))\r\n {\r\n sb.Append(\",\");\r\n string hash = this.repository.GetHash(obj);\r\n Util.Assert(!assertHashAvailable || (hash != null));\r\n sb.Append(hash);\r\n }\r\n\r\n if (ddisp == DependencyDisposition.Failed)\r\n {\r\n // This happens when we're trying to markFailed,\r\n // but the upstream has failed and we can't compute\r\n // our dependencies. In that case, markFailed\r\n // settles for noting the failure in-process,\r\n // but not caching the result. (Okay, since this\r\n // failure propagation is cheap to rediscover.)\r\n Util.Assert(!assertHashAvailable);\r\n return null;\r\n }\r\n\r\n Util.Assert(ddisp == DependencyDisposition.Complete);\r\n string rc = Util.hashString(sb.ToString());\r\n return rc;\r\n }\r\n\r\n /// \r\n /// Finds some verbs that could possibly complete in the future and help\r\n /// resolve one of these dependencies.\r\n /// \r\n /// A list of unresolved dependencies.\r\n /// \r\n /// A list of verbs that could possibly create one or more of the\r\n /// missing dependencies.\r\n /// \r\n private List robustDiscoverReadyDeps(IEnumerable staleDeps)\r\n {\r\n List newParents = new List();\r\n foreach (BuildObject dep in staleDeps)\r\n {\r\n IVerb parent = this.getParent(dep);\r\n if (parent != null)\r\n {\r\n if (this.completedVerbs.Contains(parent))\r\n {\r\n // Wait, if the parent is completed, why is the child a stale dependency?\r\n Util.Assert(false);\r\n }\r\n\r\n newParents.Add(parent);\r\n }\r\n }\r\n\r\n return newParents;\r\n }\r\n\r\n /// \r\n /// Push each potential target somewhere else: replace it with its\r\n /// dependencies, or mark its outputs failed, or mark it runnable and\r\n /// give it to the verb runner.\r\n /// \r\n /// Set of verbs to process.\r\n private void disposeCurrentVerbs(HashSet currentVerbs)\r\n {\r\n this.submittedCount = 0;\r\n this.Say(\"disposeCurrentVerbs\");\r\n while (currentVerbs.Count() > 0)\r\n {\r\n foreach (IVerb verb in currentVerbs)\r\n {\r\n this.Say(\"disposeCurrentVerbs considering \" + verb);\r\n ////dbgVerbCounter.consider(verb, DbgVerbCounter.DbgVerbCondition.DVWake);\r\n\r\n if (this.resolvedVerbs.Contains(verb))\r\n {\r\n // Enthusiastic wakeup?\r\n continue;\r\n }\r\n\r\n if (this.waitIndex.isWaiting(verb))\r\n {\r\n // He's already waiting for something else.\r\n continue;\r\n }\r\n\r\n DependencyDisposition ddisp;\r\n List knownDeps = new List(this.depCache.getDependencies(verb, out ddisp));\r\n\r\n List staleDeps = new List();\r\n List failedDeps = new List();\r\n foreach (BuildObject dep in knownDeps)\r\n {\r\n Disposition disp = this.repository.GetDisposition(dep);\r\n if (disp is Stale)\r\n {\r\n staleDeps.Add(dep);\r\n }\r\n else if (disp is Failed)\r\n {\r\n failedDeps.Add(dep);\r\n }\r\n }\r\n\r\n if (staleDeps.Count() > 0 || ddisp == DependencyDisposition.Incomplete)\r\n {\r\n // Some inputs aren't yet available, so we can prompt one of those verbs\r\n // instead, and wake this one up when those are done.\r\n Util.Assert(staleDeps.Count() > 0);\r\n\r\n// REVIEW: Clean this up post SOSP.\r\n#if false\r\n List newParents = this.robustDiscoverReadyDeps(staleDeps);\r\n if (newParents.Count() == 0)\r\n {\r\n this.reexamineVerb(verb);\r\n newParents = this.robustDiscoverReadyDeps(staleDeps);\r\n Util.Assert(newParents.Count() > 0);\r\n }\r\n#else\r\n this.reexamineVerb(verb);\r\n List newParents = this.robustDiscoverReadyDeps(staleDeps);\r\n Util.Assert(newParents.Count() > 0);\r\n#endif\r\n\r\n this.nextVerbs.UnionWith(newParents);\r\n this.Say(\r\n string.Format(\r\n \"disposeCurrentVerbs waits {0} dependent on {1} liberating {2}\",\r\n verb,\r\n string.Join(\",\", staleDeps),\r\n string.Join(\",\", newParents)));\r\n this.waitIndex.insert(verb, staleDeps);\r\n }\r\n else if (ddisp == DependencyDisposition.Failed || failedDeps.Count() > 0)\r\n {\r\n this.Say(string.Format(\"disposeCurrentVerbs marks {0} failed\", verb));\r\n this.markFailed(verb);\r\n this.resolvedVerbs.Add(verb);\r\n ////dbgVerbCounter.consider(verb, DbgVerbCounter.DbgVerbCondition.DVDepsNonstale);\r\n }\r\n else\r\n {\r\n // All inputs are available, so we can compute concrete identifier\r\n // to retrieve from cache...\r\n string inputHash = this.computeInputHash(verb, true);\r\n Util.Assert(inputHash != null);\r\n\r\n if (!this.fetchFromCache(verb, inputHash))\r\n {\r\n ////if (verb is BoogieAsmVerificationObligationListVerb) { System.Environment.Exit(0); }\r\n this.Say(string.Format(\"disposeCurrentVerbs submits {0}\", verb));\r\n\r\n // Or if it's not in cache, we can execute.\r\n // Verb's inputs are ready, and output is stale: mark verb runnable.\r\n ////Say(string.Format(\" {0} submitted\", verb));\r\n this.verbRunner.submitVerb(verb);\r\n this.submittedCount += 1;\r\n }\r\n\r\n this.resolvedVerbs.Add(verb);\r\n ////dbgVerbCounter.consider(verb, DbgVerbCounter.DbgVerbCondition.DVDepsNonstale);\r\n }\r\n }\r\n\r\n // We've disposed all the current verbs. But maybe we found some more\r\n // we can pop loose right now.\r\n currentVerbs = this.nextVerbs;\r\n this.nextVerbs = new HashSet();\r\n }\r\n }\r\n\r\n /// \r\n /// Checks the cache for a previous execution of this verb operating on\r\n /// the same inputs; updates our state with the cached results if so.\r\n /// \r\n /// The verb to check for prior execution.\r\n /// \r\n /// An identifier for this verb operating on a specific set of inputs.\r\n /// \r\n /// \r\n /// True if usable previous execution was found, false otherwise.\r\n /// \r\n private bool fetchFromCache(IVerb verb, string inputHash)\r\n {\r\n try\r\n {\r\n ResultSummaryRecord summary = this.repository.FetchResult(inputHash);\r\n if (summary.Disposition is Stale)\r\n {\r\n return false;\r\n }\r\n\r\n // REVIEW: Since we aren't asking FetchResult to return failures,\r\n // this check is no longer needed. Or at least it won't be once\r\n // the \"Results\" cache is cleared of all existing failure records.\r\n if (this.rejectCachedFailures\r\n && (summary.Disposition is Failed || summary.IsVerificationTimeout))\r\n {\r\n Logger.WriteLine(string.Format(\r\n \"NOTE: rejecting failure from cache {0}\", verb));\r\n return false;\r\n }\r\n\r\n this.Say(string.Format(\"disposeCurrentVerbs pulls {0} from cache\", verb));\r\n\r\n // Hey, this verb is already computed! Nothing to do.\r\n // Add the verb execution's results to the repository.\r\n this.repository.AddVerbResults(verb, summary);\r\n\r\n this.verbIsComplete(verb, summary.Disposition);\r\n\r\n return true;\r\n }\r\n catch (ObjectMissingFromCacheException ex)\r\n {\r\n Logger.WriteLine(string.Format(\r\n \"WARNING: expected object {0} missing from cache; discarding cached result {1}\",\r\n ex,\r\n verb));\r\n return false;\r\n }\r\n }\r\n\r\n /// \r\n /// Reexamines a verb to see if it now knows more regarding what other\r\n /// verbs need to run first in order to create its dependencies.\r\n /// \r\n /// The verb to reexamine.\r\n private void reexamineVerb(IVerb verb)\r\n {\r\n foreach (IVerb parentVerb in verb.getVerbs())\r\n {\r\n this.addVerb(parentVerb);\r\n }\r\n }\r\n\r\n /// \r\n /// Processes task completion messages.\r\n /// \r\n /// \r\n /// A list of task completion messages.\r\n /// \r\n private void processTaskCompletions(List taskCompletions)\r\n {\r\n foreach (VerbRunner.TaskCompletion tc in taskCompletions)\r\n {\r\n // We may record a Failure if the verb didn't output\r\n // everything it promised to.\r\n Disposition recordedDisposition = this.recordResult(tc);\r\n\r\n this.Say(string.Format(\" {0} completed with disposition {1}\", tc.verb, tc.disposition));\r\n }\r\n\r\n // Waking process may have shaken some verbs loose for us to evaluate next time around.\r\n }\r\n\r\n /// \r\n /// Conditionally debug print a message.\r\n /// \r\n /// The message to print.\r\n private void Say(string s)\r\n {\r\n if (Debug)\r\n {\r\n#pragma warning disable 162\r\n Logger.WriteLine(\"[sched] \" + s);\r\n#pragma warning restore 162\r\n }\r\n }\r\n\r\n /// \r\n /// Logs output regarding a verb's execution disposition.\r\n /// \r\n /// The verb in question.\r\n /// Disposition of the verb execution.\r\n private void emitRealtimeReport(IVerb verb, Disposition disposition)\r\n {\r\n Presentation pr = verb.getRealtimePresentation(disposition);\r\n ASCIIPresentater ascii = new ASCIIPresentater();\r\n pr.format(ascii);\r\n Logger.Write(ascii.ToString());\r\n }\r\n\r\n /// \r\n /// Mark a verb as completed, and adjust our schedule accordingly.\r\n /// \r\n /// The verb that completed.\r\n /// The disposition of the verb's execution.\r\n private void verbIsComplete(IVerb verb, Disposition disp)\r\n {\r\n ////Say(string.Format(\" {0} is complete: {1}\", verb, dbgDisposition));\r\n ////if (disp is Failed)\r\n ////{\r\n //// // Failures can be hard to debug, since they don't leave any\r\n //// // output in nuobj/. So report these even if they aren't\r\n //// // built this run.\r\n //// emitRealtimeReport(verb, disp);\r\n ////}\r\n\r\n // Invariant: all of this verb's objs are non-Stale.\r\n foreach (BuildObject obj in verb.getOutputs())\r\n {\r\n ////Say(string.Format(\" waking {0}\", obj));\r\n IEnumerable wokenSet = this.waitIndex.awaken(obj);\r\n ////foreach (IVerb wokenVerb in wokenSet)\r\n ////{\r\n //// //Say(string.Format(\" {0} woken\", wokenVerb));\r\n ////}\r\n this.nextVerbs.UnionWith(wokenSet);\r\n }\r\n\r\n this.emitRealtimeReport(verb, disp);\r\n\r\n this.requiredVerbs.Remove(verb);\r\n this.completedVerbs.Add(verb);\r\n }\r\n\r\n /// \r\n /// Record how each output of a task appeared.\r\n /// \r\n /// The task completion notification.\r\n /// Overall result of the verb execution.\r\n private Disposition recordResult(VerbRunner.TaskCompletion completion)\r\n {\r\n WorkingDirectory workingDirectory = completion.workingDirectory;\r\n IVerb verb = completion.verb;\r\n Disposition executionDisposition = completion.disposition;\r\n\r\n List outputs = new List();\r\n List missingOutputs = new List();\r\n IEnumerable expectedOutputs = verb.getOutputs();\r\n\r\n if (executionDisposition is Failed)\r\n {\r\n expectedOutputs = expectedOutputs.Concat(verb.getFailureOutputs());\r\n }\r\n\r\n bool hasVirtualOutputs = false;\r\n foreach (BuildObject outobj in expectedOutputs)\r\n {\r\n if (!(outobj is VirtualBuildObject))\r\n {\r\n // For expected file outputs, check for existence in working directory.\r\n // REVIEW: Add method to WorkingDirectory which does this?\r\n if (File.Exists(workingDirectory.PathTo(outobj)))\r\n {\r\n // Try to catch accidental case mismatches that would burn us when we\r\n // try to fetch the file back in.\r\n ////string fsname = PathNormalizer.dbg_normalizePath_nocache(outobj.deprecatedGetFilesystemPath(), false);\r\n ////Util.Assert(Path.GetFileName(fsname).Equals(outobj.getFileName()));\r\n // REVIEW: Do we need to worry about case mismatches anymore? See comments above.\r\n outputs.Add(this.repository.Store(workingDirectory, outobj, executionDisposition));\r\n\r\n // Store a copy of this verb output as a file in the real nuobj directory.\r\n Util.Assert(outobj.getRelativePath().StartsWith(BuildEngine.theEngine.getObjRoot(), StringComparison.Ordinal));\r\n string nuobjPath = IronRootDirectory.PathTo(outobj);\r\n Directory.CreateDirectory(Path.GetDirectoryName(nuobjPath));\r\n File.Copy(workingDirectory.PathTo(outobj), nuobjPath, true);\r\n }\r\n else\r\n {\r\n missingOutputs.Add(string.Format(\"Missing expected output {0}\", outobj.getRelativePath()));\r\n }\r\n }\r\n else\r\n {\r\n hasVirtualOutputs = true;\r\n if (this.repository.GetDisposition(outobj) is Fresh)\r\n {\r\n // Nothing to cache; virtual objects only survive in the Repository, the in-process store.\r\n }\r\n else\r\n {\r\n missingOutputs.Add(string.Format(\"Missing expected virtual {0}\", outobj.getRelativePath()));\r\n }\r\n }\r\n }\r\n\r\n if (!(executionDisposition is Failed) && missingOutputs.Count() > 0)\r\n {\r\n executionDisposition = new Failed(missingOutputs);\r\n }\r\n\r\n ResultSummaryRecord summary = new ResultSummaryRecord(verb, executionDisposition, outputs);\r\n string inputHash = this.computeInputHash(verb, true);\r\n Util.Assert(inputHash != null);\r\n if (!hasVirtualOutputs)\r\n {\r\n this.repository.StoreResult(inputHash, summary);\r\n }\r\n else\r\n {\r\n this.Say(\"Not caching verb persistently: \" + verb);\r\n }\r\n\r\n this.verbIsComplete(verb, executionDisposition);\r\n return executionDisposition;\r\n }\r\n\r\n /// \r\n /// Mark a verb as having failed.\r\n /// \r\n /// The verb that failed.\r\n private void markFailed(IVerb verb)\r\n {\r\n // At least one of verb's inputs has a permanent failure, so we didn't\r\n // even try to execute it.\r\n Disposition disposition = new Failed(\"upstream failure\");\r\n ResultSummaryRecord summary = new ResultSummaryRecord(verb, disposition, new BuildObjectValuePointer[] { });\r\n\r\n // NB never store upstream failures to the persistent cache, because\r\n // they depend on our knowledge this run that the upstream verb failed.\r\n // If, in another run, the verb or its inputs are modified, produce the\r\n // same outputs, but returns success, we'll be stuck pulling this\r\n // upstream failure out of cache but calling this verb a failure.\r\n ////string inputHash = computeInputHash(verb, false);\r\n ////if (inputHash != null)\r\n ////{\r\n //// Util.Assert(false);\r\n //// // \"Upstream failures\" will never have a computable inputHash, because their inputs\r\n //// // can't be considered known. Even if the upstream verb wrote something to disk,\r\n //// // what if the upstream verb changes to no longer fail but still emit the same thing?\r\n //// // We wouldn't want to conclude that, because the inputs hadn't changed, this\r\n //// // verb still had an upstream failure.\r\n //// repository.StoreResult(inputHash, summary);\r\n ////}\r\n ////else\r\n ////{\r\n this.unrecordableFailures[verb] = disposition;\r\n ////}\r\n\r\n // Mark all the verb's outputs as Failed in the repository.\r\n foreach (BuildObject obj in verb.getOutputs())\r\n {\r\n if (obj is VirtualBuildObject)\r\n {\r\n this.repository.StoreVirtual(obj, disposition, null);\r\n }\r\n else\r\n {\r\n this.repository.AddObject(obj, disposition, null);\r\n }\r\n }\r\n\r\n this.verbIsComplete(verb, disposition);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/SourceConfigurationError.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class SourceConfigurationError : Exception\r\n {\r\n public SourceConfigurationError(string msg)\r\n : base(msg)\r\n {\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/SourcePath.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.IO;\r\n\r\n /// \r\n /// Representation of a source BuildObject.\r\n /// These are things which we expect to pre-exist, instead of built by us.\r\n /// \r\n internal class SourcePath\r\n : BuildObject\r\n {\r\n /// \r\n /// The type of \"source\" this is.\r\n /// \r\n private SourceType sourceType;\r\n\r\n /// \r\n /// Initializes a new instance of the SourcePath class.\r\n /// \r\n /// \r\n /// Relative path to this object in the local filesystem.\r\n /// \r\n /// \r\n /// The type of \"source\" this is.\r\n /// \r\n public SourcePath(string inpath, SourceType sourceType = SourceType.Src)\r\n : base(inpath)\r\n {\r\n // Sanity checks.\r\n this.checkPrefix(sourceType, SourceType.Src, BuildEngine.theEngine.getSrcRoot());\r\n this.checkPrefix(sourceType, SourceType.Tools, BuildEngine.theEngine.getToolsRoot());\r\n this.checkPrefix(sourceType, SourceType.BinTools, BuildEngine.theEngine.getBinToolsRoot());\r\n this.checkPrefix(sourceType, SourceType.PrebakedObjExpediency, \"obj\"); // TODO remove.\r\n\r\n this.sourceType = sourceType;\r\n this.IsTrusted = getRelativePath().StartsWith(\r\n Path.Combine(BuildEngine.theEngine.getSrcRoot(), BuildEngine.VerveTrustedSpecDir), StringComparison.OrdinalIgnoreCase);\r\n }\r\n\r\n /// \r\n /// Various types of \"sources\".\r\n /// \r\n public enum SourceType\r\n {\r\n /// \r\n /// Source file.\r\n /// \r\n Src,\r\n\r\n /// \r\n /// Tools (executables usually) that we don't build ourselves.\r\n /// \r\n Tools,\r\n\r\n /// \r\n /// Tools that we could build ourselves.\r\n /// Probably don't really want this in the long run,\r\n /// since we can build these.\r\n /// \r\n BinTools,\r\n\r\n /// \r\n /// Special purpose expediency.\r\n /// Used to point at bootloader, until we can get an nmake verb working. TODO remove.\r\n /// \r\n PrebakedObjExpediency\r\n }\r\n\r\n /// \r\n /// Gets the source type of this instance.\r\n /// \r\n public SourceType Type\r\n {\r\n get { return this.sourceType; }\r\n }\r\n\r\n /// \r\n /// Creates a new SourcePath, where the source type is the same as this\r\n /// SourcePath's, and the path is relative to the directory containing\r\n /// this SourcePath.\r\n /// \r\n /// \r\n /// REVIEW: This should be renamed to MakeNewSourcePath to correspond\r\n /// with BuildObject\r\n /// \r\n /// Relative path to the new object.\r\n /// The new SourcePath.\r\n public SourcePath getNewSourcePath(string inpath)\r\n {\r\n return new SourcePath(Path.Combine(getDirPath(), inpath), this.sourceType);\r\n }\r\n\r\n /// \r\n /// Checks that the path prefix for this object is reasonable for the\r\n /// given source type.\r\n /// \r\n /// The given source type.\r\n /// \r\n /// Source type the prefix parameter matches.\r\n /// \r\n /// \r\n /// Prefix that paths of the matchType parameter should have.\r\n /// \r\n private void checkPrefix(SourceType givenType, SourceType matchType, string prefix)\r\n {\r\n if (givenType == matchType)\r\n {\r\n if (!path.StartsWith(prefix, StringComparison.OrdinalIgnoreCase))\r\n {\r\n throw new UserError(string.Format(\r\n \"Source path {0} should begin with {1}\",\r\n this.path,\r\n prefix));\r\n }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/SourcePathIncludeContext.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n // This context looks for files in a set of source path locations.\r\n internal class SourcePathIncludeContext\r\n : IncludePathContext\r\n {\r\n private List directories;\r\n private List dstExtensions;\r\n private string _descr;\r\n\r\n public SourcePathIncludeContext()\r\n {\r\n this.directories = new List();\r\n this.dstExtensions = new List();\r\n }\r\n\r\n public override string ToString()\r\n {\r\n if (this._descr == null)\r\n {\r\n this._descr = \"{\" + string.Join(\",\", this.directories.Select(d => d.directory)) + \"}; {\"\r\n + string.Join(\",\", this.dstExtensions) + \"}\";\r\n }\r\n\r\n return this._descr;\r\n }\r\n\r\n // Add a directory path relative to ironRoot.\r\n public void addDirectory(string directory)\r\n {\r\n Util.Assert(this._descr == null);\r\n this.directories.Add(new DirectoryRecord(directory));\r\n }\r\n\r\n public void addDstExtension(string extension)\r\n {\r\n Util.Assert(this._descr == null);\r\n this.dstExtensions.Add(extension);\r\n }\r\n\r\n public override BuildObject search(string basename, ModPart modPart)\r\n {\r\n List results = new List();\r\n\r\n foreach (string extension in this.dstExtensions.Where(extn => BeatExtensions.whichPart(extn) == modPart))\r\n {\r\n string filename = basename + extension;\r\n foreach (DirectoryRecord directoryRecord in this.directories)\r\n {\r\n if (directoryRecord.Contains(filename))\r\n {\r\n string proposed = Path.Combine(\r\n BuildEngine.theEngine.getIronRoot(),\r\n BuildEngine.theEngine.getSrcRoot(),\r\n directoryRecord.directory,\r\n basename + extension);\r\n ////Logger.WriteLine(\"SourcePathIncludeContext Trying \" + proposed);\r\n ////Util.Assert(File.Exists(proposed));\r\n results.Add(new SourcePath(proposed));\r\n }\r\n }\r\n }\r\n\r\n if (results.Count() == 0)\r\n {\r\n return null;\r\n }\r\n else if (results.Count() > 1)\r\n {\r\n throw new SourceConfigurationError(string.Format(\r\n \"Reference {0} matches {1} paths: {2}\",\r\n basename,\r\n results.Count(),\r\n string.Join(\",\", results)));\r\n }\r\n else\r\n {\r\n return results.First();\r\n }\r\n }\r\n\r\n private class DirectoryRecord\r\n {\r\n private readonly string _directory;\r\n private readonly HashSet _files;\r\n\r\n public DirectoryRecord(string directory)\r\n {\r\n this._directory = directory;\r\n string absDir = Path.Combine(\r\n BuildEngine.theEngine.getIronRoot(),\r\n BuildEngine.theEngine.getSrcRoot(),\r\n this._directory);\r\n this._files = new HashSet(Directory.EnumerateFiles(absDir)\r\n .Select(path => Path.GetFileName(path)));\r\n }\r\n\r\n public string directory\r\n {\r\n get { return this._directory; }\r\n }\r\n\r\n public bool Contains(string file)\r\n {\r\n return this._files.Contains(file);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/StaticContextVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n // Recipient needs to accept IContextGeneratingVerbs, but we don't need\r\n // any dependencies to produce this (static) context. So this is a simple,\r\n // non-dependent verb that just spews a ContextContents.\r\n internal class StaticContextVerb\r\n : ContextGeneratingVerb\r\n {\r\n private IIncludePathContext _context;\r\n\r\n public StaticContextVerb(IIncludePathContext context, string nickname, PoundDefines poundDefines)\r\n : base(nickname, poundDefines)\r\n {\r\n this._context = context;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n return new BuildObject[] { };\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new IVerb[] { };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n ContextContents contents = new ContextContents(this._context);\r\n BuildEngine.theEngine.Repository.StoreVirtual(this.getContextOutput(), new Fresh(), contents);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/SymDiffBaseVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n internal abstract class SymDiffBaseVerb : Verb, IProcessInvokeAsyncVerb\r\n {\r\n private const int version = 10;\r\n \r\n public abstract IEnumerable getInputFiles();\r\n\r\n public abstract BuildObject getOutputFile();\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n\r\n List deps = new List(this.getInputFiles());\r\n deps.Add(getSymDiffExecutable());\r\n deps.AddRange(getSymDiffExecutableDependencies());\r\n\r\n // REVIEW: Probably need to add SymDiffExecutable's dependencies too.\r\n return deps;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() { this.getOutputFile() };\r\n }\r\n\r\n public virtual void preprocess(WorkingDirectory workingDirectory) { }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n List args = this.getArgs();\r\n\r\n preprocess(workingDirectory);\r\n\r\n // We use workingDirOverride flag here to change the path that the\r\n // process starts in to one that is still in our workingDirectory.\r\n // So this isn't so bad. It would be better if NuBuild would only\r\n // let us supply a relative path here, however.\r\n string overrideDir = null;\r\n if (this.getWorkingDir() != null)\r\n {\r\n overrideDir = workingDirectory.PathTo(this.getWorkingDir());\r\n }\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n getSymDiffExecutable().getRelativePath(),\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n getDiagnosticsBase(),\r\n workingDirOverride: overrideDir,\r\n returnStandardOut: true);\r\n }\r\n\r\n public virtual Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n return disposition;\r\n }\r\n\r\n protected static SourcePath getSymDiffExecutable()\r\n {\r\n return new SourcePath(\"tools\\\\SymDiff\\\\SymDiff.exe\", SourcePath.SourceType.Tools);\r\n }\r\n\r\n protected static IEnumerable getSymDiffExecutableDependencies()\r\n {\r\n List exeDepends = new List();\r\n\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\Basetypes.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\Core.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\CodeContractsExtender.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\Graph.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\ParserHelper.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\Provers.SMTLib.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\VCGeneration.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\z3.exe\", SourcePath.SourceType.Tools));\r\n\r\n return exeDepends;\r\n }\r\n\r\n protected abstract List getArgs();\r\n\r\n protected virtual string getWorkingDir()\r\n {\r\n return getOutputFile().getDirPath();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/SymDiffCombineVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n internal class SymDiffCombineVerb : SymDiffBaseVerb, IProcessInvokeAsyncVerb\r\n {\r\n public const string MERGED_FILE_NAME = \"mergedProgSingle.bpl\";\r\n\r\n private const int version = 3;\r\n\r\n private AbstractId abstractId;\r\n private SymDiffExtractVerb left;\r\n private SymDiffExtractVerb right;\r\n private SymDiffMergeConfigVerb merger;\r\n\r\n private BuildObject outputFile;\r\n\r\n public SymDiffCombineVerb(SymDiffExtractVerb left, SymDiffExtractVerb right, SymDiffMergeConfigVerb merger)\r\n {\r\n this.left = left;\r\n this.right = right;\r\n this.merger = merger;\r\n\r\n // Naming one of the files should be sufficient to uniquely identify the combiner.\r\n this.abstractId = new AbstractId(this.GetType().Name, version, left.getOutputFile().ToString());\r\n ////abstractId = String.Format(\"{0}(#{1},{2},{3},{4})\",\r\n //// this.GetType().Name,\r\n //// version,\r\n //// left.getOutputFile(),\r\n //// right.getOutputFile(),\r\n //// merger.getOutputFile());\r\n this.outputFile = this.mkOutputFile();\r\n }\r\n\r\n public override IEnumerable getInputFiles()\r\n {\r\n return new List() { this.left.getOutputFile(), this.right.getOutputFile(), this.merger.getOutputFile() };\r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n return this.outputFile;\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new List() { this.left, this.right, this.merger };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() { this.getOutputFile() };\r\n }\r\n \r\n\r\n protected override List getArgs()\r\n {\r\n List args = new List();\r\n args.Add(\"-allInOne\");\r\n args.Add(this.left.getOutputFile().getFileName());\r\n args.Add(this.right.getOutputFile().getFileName());\r\n args.Add(this.merger.getOutputFile().getFileName());\r\n ////args.Add(left.getOutputFile().getRelativePath());\r\n ////args.Add(right.getOutputFile().getRelativePath());\r\n ////args.Add(merger.getOutputFile().getRelativePath());\r\n\r\n List extra_args = new List() { \"-asserts\", \"-freeContracts\", \"-usemutual\", \"-sound\", \"-dontUseHoudiniForMS\", \"-checkMutualPrecondNonTerminating\" };\r\n args.AddRange(extra_args);\r\n\r\n return args;\r\n }\r\n\r\n private BuildObject mkOutputFile()\r\n {\r\n // SymDiff always uses the same file name in the working directory.\r\n return new BuildObject(Path.Combine(this.left.getOutputFile().getDirPath(), MERGED_FILE_NAME));\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/SymDiffEngine.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class SymDiffEngine\r\n {\r\n public static void BuildPipeline(IContextGeneratingVerb context, BuildObject input, out BuildObject bplFile, out IVerb workerVerb)\r\n {\r\n BoogieAsmVerifyVerb basmVerb = new BoogieAsmVerifyVerb(context, input, true);\r\n SymDiffExtractVerb left = new SymDiffExtractVerb(basmVerb, SymDiffExtractVerb.Mode.LEFT);\r\n SymDiffExtractVerb right = new SymDiffExtractVerb(basmVerb, SymDiffExtractVerb.Mode.RIGHT);\r\n SymDiffInferVerb infer = new SymDiffInferVerb(left, right);\r\n SymDiffMergeConfigVerb mergeConfig = new SymDiffMergeConfigVerb(basmVerb, infer);\r\n SymDiffCombineVerb combiner = new SymDiffCombineVerb(left, right, mergeConfig);\r\n SymDiffMergeVerb merger = new SymDiffMergeVerb(basmVerb, combiner);\r\n\r\n bplFile = merger.getOutputFile();\r\n workerVerb = merger;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/SymDiffExtractVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n internal class SymDiffExtractVerb : SymDiffBaseVerb\r\n {\r\n public const string UNROLLED_EXTN = \"_u\";\r\n public const string LEFT_FILE = \"v1\";\r\n public const string RIGHT_FILE = \"v2\";\r\n\r\n private const int version = 5;\r\n\r\n private AbstractId abstractId;\r\n private BoogieAsmVerifyVerb basmVerb;\r\n private BuildObject basmIn;\r\n private Mode mode;\r\n\r\n public SymDiffExtractVerb(BoogieAsmVerifyVerb basmVerb, Mode mode)\r\n {\r\n this.basmVerb = basmVerb;\r\n this.basmIn = basmVerb.outputFile();\r\n this.mode = mode;\r\n\r\n this.abstractId = new AbstractId(this.GetType().Name, version, this.basmIn.ToString(), concrete: mode.ToString());\r\n }\r\n\r\n public enum Mode\r\n {\r\n LEFT, RIGHT\r\n }\r\n\r\n public override IEnumerable getInputFiles()\r\n {\r\n return new List() { this.basmIn };\r\n }\r\n\r\n public string getFileName() {\r\n switch (mode) {\r\n case Mode.LEFT:\r\n return LEFT_FILE;\r\n case Mode.RIGHT:\r\n return RIGHT_FILE;\r\n default:\r\n throw new Exception(\"Unexpected mode for SymDiffExtractVerb\");\r\n }\r\n }\r\n\r\n private BuildObject getTmpInputFile()\r\n {\r\n return new BuildObject(Path.Combine(basmIn.getDirPath(), getFileName() + BoogieVerb.BPL_EXTN)); \r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n return new BuildObject(Path.Combine(this.basmIn.getDirPath(), getFileName() + UNROLLED_EXTN + BoogieVerb.BPL_EXTN));\r\n ////return basmIn.makeOutputObject(extension + BoogieVerb.BPL_EXTN); \r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new List() { this.basmVerb };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() { this.getOutputFile() };\r\n }\r\n \r\n public override void preprocess(WorkingDirectory workingDirectory) {\r\n base.preprocess(workingDirectory);\r\n File.Copy(workingDirectory.PathTo(basmIn), workingDirectory.PathTo(getTmpInputFile()), true);\r\n }\r\n\r\n protected override List getArgs()\r\n {\r\n List args = new List();\r\n args.Add(\"-extractLoops\");\r\n args.Add(getTmpInputFile().getFileName());\r\n args.Add(getOutputFile().getFileName());\r\n\r\n return args;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/SymDiffInferVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n internal class SymDiffInferVerb : SymDiffBaseVerb, IProcessInvokeAsyncVerb\r\n {\r\n public const string CONFIG = \".partial_config\";\r\n\r\n private const int version = 6;\r\n\r\n private AbstractId abstractId;\r\n private SymDiffExtractVerb left;\r\n private SymDiffExtractVerb right;\r\n\r\n public SymDiffInferVerb(SymDiffExtractVerb left, SymDiffExtractVerb right)\r\n {\r\n this.left = left;\r\n this.right = right;\r\n\r\n this.abstractId = new AbstractId(this.GetType().Name, version, left.getOutputFile().ToString().ToString()); // Left should suffice to uniquely ID.\r\n }\r\n\r\n public override IEnumerable getInputFiles()\r\n {\r\n return new List() { this.left.getOutputFile(), this.right.getOutputFile() };\r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n // Choice of left/right doesn't matter here, since we're dropping the extension.\r\n return this.left.getOutputFile().makeOutputObject(CONFIG);\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new List() { this.left, this.right };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() { this.getOutputFile() };\r\n }\r\n\r\n public override Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n if (!(disposition is Failed))\r\n {\r\n File.WriteAllText(workingDirectory.PathTo(this.getOutputFile()), stdout);\r\n }\r\n\r\n return disposition;\r\n }\r\n\r\n protected override List getArgs()\r\n {\r\n List args = new List();\r\n args.Add(\"-inferConfig\");\r\n args.Add(this.left.getOutputFile().getFileName());\r\n args.Add(this.right.getOutputFile().getFileName());\r\n\r\n return args;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/SymDiffMergeBaseVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal abstract class SymDiffMergeBaseVerb : Verb, IProcessInvokeAsyncVerb\r\n {\r\n private const int version = 3;\r\n\r\n private static NmakeVerb boogieAsmBuildExecutableVerb = new NmakeVerb(new SourcePath(\"tools\\\\BoogieAsm\\\\makefile\", SourcePath.SourceType.Tools));\r\n\r\n public abstract BuildObject getOutputFile();\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n\r\n List deps = new List(this.getInputFiles());\r\n deps.Add(getSymDiffMergeExecutable());\r\n\r\n // REVIEW: Probably need to add SymDiffMergeExecutable's dependencies too.\r\n return deps;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new[] { boogieAsmBuildExecutableVerb };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() { this.getOutputFile() };\r\n }\r\n\r\n protected string getWorkingDir() { return getOutputFile().getDirPath(); }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n List args = this.getArgs();\r\n\r\n // We use workingDirOverride flag here to change the path that the\r\n // process starts in to one that is still in our workingDirectory.\r\n // So this isn't so bad. It would be better if NuBuild would only\r\n // let us supply a relative path here, however.\r\n string overrideDir = null;\r\n if (this.getWorkingDir() != null)\r\n {\r\n overrideDir = workingDirectory.PathTo(this.getWorkingDir());\r\n }\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n this.getSymDiffMergeExecutable().getRelativePath(),\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n getDiagnosticsBase(),\r\n captureStdout: this.getOutputFile(),\r\n workingDirOverride:overrideDir);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n return disposition;\r\n }\r\n\r\n protected abstract IEnumerable getInputFiles();\r\n\r\n protected abstract List getArgs();\r\n \r\n private BuildObject getSymDiffMergeExecutable()\r\n {\r\n return new BuildObject(Path.Combine(boogieAsmBuildExecutableVerb.getOutputPath().getRelativePath(), \"symdiffmerge.exe\"));\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/SymDiffMergeConfigVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n internal class SymDiffMergeConfigVerb : SymDiffMergeBaseVerb, IProcessInvokeAsyncVerb\r\n {\r\n public const string CONFIG_EXTN = \".config\";\r\n private const int version = 7;\r\n\r\n private AbstractId abstractId;\r\n private BoogieAsmVerifyVerb basmVerb;\r\n private BuildObject mutualSummary;\r\n private SymDiffInferVerb inferVerb;\r\n private BuildObject inferredConfig;\r\n private BuildObject output;\r\n\r\n public SymDiffMergeConfigVerb(BoogieAsmVerifyVerb basmVerb, SymDiffInferVerb inferVerb)\r\n {\r\n this.basmVerb = basmVerb;\r\n this.mutualSummary = basmVerb.getMutualSummary();\r\n this.inferVerb = inferVerb;\r\n this.inferredConfig = inferVerb.getOutputFile();\r\n\r\n this.abstractId = new AbstractId(this.GetType().Name, version, this.inferredConfig.ToString()); // One should suffice for uniqueness: String.Format(\"{0},{1}\", mutualSummary,inferredConfig));\r\n this.output = this.basmVerb.outputFile().makeOutputObject(CONFIG_EXTN);\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n return this.output;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return base.getVerbs().Concat(new List() { this.basmVerb, this.inferVerb });\r\n }\r\n\r\n protected override IEnumerable getInputFiles()\r\n {\r\n return new List() { this.mutualSummary, this.inferredConfig };\r\n }\r\n\r\n protected override List getArgs()\r\n {\r\n List args = new List();\r\n args.Add(\"-config\");\r\n args.Add(this.mutualSummary.getFileName());\r\n args.Add(this.inferredConfig.getFileName());\r\n return args;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/SymDiffMergeVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n internal class SymDiffMergeVerb : SymDiffMergeBaseVerb, IProcessInvokeAsyncVerb\r\n {\r\n public const string MERGED_EXTN = \".merge\";\r\n private const int version = 8;\r\n\r\n private AbstractId abstractId;\r\n private BoogieAsmVerifyVerb basmVerb;\r\n private BuildObject mutualSummary;\r\n private SymDiffCombineVerb combiner;\r\n private BuildObject output;\r\n\r\n public SymDiffMergeVerb(BoogieAsmVerifyVerb basmVerb, SymDiffCombineVerb combiner)\r\n {\r\n this.basmVerb = basmVerb;\r\n this.mutualSummary = basmVerb.getMutualSummary();\r\n this.combiner = combiner;\r\n\r\n this.abstractId = new AbstractId(this.GetType().Name, version, this.combiner.getOutputFile().ToString()); // String.Format(\"{0},{1}\", One should suffice for uniqueness: mutualSummary, combiner.getOutputFile()));\r\n this.output = this.basmVerb.outputFile().makeOutputObject(MERGED_EXTN + BoogieVerb.BPL_EXTN);\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n return this.output;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return base.getVerbs().Concat(new List() { this.basmVerb, this.combiner });\r\n }\r\n\r\n protected override IEnumerable getInputFiles()\r\n {\r\n return new List() { this.mutualSummary, this.combiner.getOutputFile() };\r\n }\r\n\r\n protected override List getArgs()\r\n {\r\n List args = new List();\r\n args.Add(\"-merge\");\r\n args.Add(this.mutualSummary.getFileName());\r\n args.Add(this.combiner.getOutputFile().getFileName());\r\n return args;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/TransitiveDepsContents.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n\r\n internal class TransitiveDepsContents : VirtualContents\r\n {\r\n OrderPreservingSet _shallowDeps, _transitiveDeps;\r\n\r\n public IEnumerable shallowDeps\r\n {\r\n get { return this._shallowDeps; }\r\n }\r\n\r\n public IEnumerable transitiveDeps\r\n {\r\n get { return this._transitiveDeps; }\r\n }\r\n\r\n public TransitiveDepsContents(OrderPreservingSet shallowDeps, OrderPreservingSet transitiveDeps)\r\n {\r\n this._shallowDeps = shallowDeps;\r\n this._transitiveDeps = transitiveDeps;\r\n }\r\n\r\n ////public override string getConcreteSummary()\r\n ////{\r\n //// return \"(\" + String.Join(\",\", transitiveDeps) + \")\";\r\n ////}\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/TransitiveDepsVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n internal abstract class TransitiveDepsVerb\r\n : Verb\r\n {\r\n public const string TDEP_EXTN = \".tdep\";\r\n private const int version = 3;\r\n\r\n private BuildObject obj;\r\n private BuildObject _depsObj;\r\n\r\n protected TransitiveDepsVerb(BuildObject obj)\r\n {\r\n this.obj = obj;\r\n this._depsObj = obj.makeVirtualObject(BeatExtensions.whichPart(obj).ExtnStr() + TDEP_EXTN);\r\n }\r\n\r\n public BuildObject depsObj()\r\n {\r\n return this._depsObj;\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return new AbstractId(this.GetType().Name, version, this.obj.getRelativePath());\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { this.depsObj() };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n OrderPreservingSet shallowDeps = new OrderPreservingSet();\r\n OrderPreservingSet transitiveDeps = new OrderPreservingSet();\r\n\r\n IEnumerable includes = this.getIncludeFactory().getIncludes(this.obj);\r\n foreach (BuildObject child in includes)\r\n {\r\n shallowDeps.Add(child);\r\n transitiveDeps.AddRange(this.factory(child).getTransitiveIncludes());\r\n transitiveDeps.Add(child);\r\n }\r\n\r\n VirtualContents contents = new TransitiveDepsContents(shallowDeps, transitiveDeps);\r\n BuildEngine.theEngine.Repository.StoreVirtual(this.depsObj(), new Fresh(), contents);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n\r\n // Available only after this verb is Fresh.\r\n // These are called the \"transitive includes\" because from this point of view, these aren't\r\n // dependencies, they're the included files. The caller may be using them to describe\r\n // his dependencies, though.\r\n public IEnumerable getTransitiveIncludes()\r\n {\r\n TransitiveDepsContents contents =\r\n (TransitiveDepsContents)BuildEngine.theEngine.Repository.FetchVirtual(this.depsObj());\r\n return contents.transitiveDeps;\r\n }\r\n\r\n public IEnumerable getShallowIncludes()\r\n {\r\n TransitiveDepsContents contents =\r\n (TransitiveDepsContents)BuildEngine.theEngine.Repository.FetchVirtual(this.depsObj());\r\n return contents.shallowDeps;\r\n }\r\n\r\n // This is a helper method for the downstream verb's getDependencies().\r\n // It emits this verb's output token so that if this verb is\r\n // not yeat Fresh, the scheduler will strive to get this verb Executed,\r\n // plus if this verb is Fresh, tacks on all of the deps computed by\r\n // this verb.\r\n // The returned HashSet belongs to the caller, who is free\r\n // to stuff more into it.\r\n public HashSet getAvailableDeps(out DependencyDisposition ddisp)\r\n {\r\n HashSet result = new HashSet();\r\n result.Add(this.depsObj());\r\n\r\n try\r\n {\r\n result.UnionWith(this.getTransitiveIncludes());\r\n result.Add(this.obj); // Add this last, since BoogieAsmLinkVerb appears to depend on this ordering\r\n ddisp = DependencyDisposition.Complete;\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n ddisp = DependencyDisposition.Incomplete;\r\n }\r\n catch (ObjectFailedException)\r\n {\r\n ddisp = DependencyDisposition.Failed;\r\n }\r\n\r\n return result;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n try\r\n {\r\n IEnumerable includes = this.getIncludeFactory().getIncludes(this.obj);\r\n\r\n // NB evaluating eagerly so we can catch the exception here rather\r\n // than hide it in a lazy evaluation later.\r\n List result = new List(includes.Select(parent => this.factory(parent)));\r\n return result;\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n }\r\n catch (SourceConfigurationError except)\r\n {\r\n throw new SourceConfigurationError(except.Message + \" which is included by \" + this.obj.getRelativePath());\r\n }\r\n\r\n return new IVerb[] { };\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n // NB we'll either return the singleton list {obj} if obj isn't yet available,\r\n // or we'll return the entire list of deps on obj's parents.\r\n List deps = new List();\r\n this.extendDeps(deps);\r\n deps.Add(this.obj);\r\n\r\n try\r\n {\r\n IEnumerable includes = this.getIncludeFactory().getIncludes(this.obj);\r\n if (includes.Contains(this.obj))\r\n {\r\n throw new SourceConfigurationError(\"Include loop starting at \" + this.obj);\r\n }\r\n\r\n deps.AddRange(includes.Select(parent => this.factory(parent).depsObj()));\r\n ddisp = DependencyDisposition.Complete;\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n ddisp = DependencyDisposition.Incomplete;\r\n }\r\n catch (ObjectFailedException)\r\n {\r\n ddisp = DependencyDisposition.Failed;\r\n }\r\n\r\n return deps;\r\n }\r\n\r\n protected virtual void extendDeps(List deps)\r\n {\r\n }\r\n\r\n protected abstract TransitiveDepsVerb factory(BuildObject obj);\r\n\r\n protected abstract IIncludeFactory getIncludeFactory();\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/UnverifiedSentinelVirtualContents.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class UnverifiedSentinelVirtualContents\r\n : VirtualContents\r\n {\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/UserError.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class UserError : Exception\r\n {\r\n public UserError(string msg)\r\n : base(msg)\r\n {\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/Util.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Runtime.Remoting.Metadata.W3cXsd2001;\r\n using System.Security.Cryptography;\r\n using System.Text;\r\n using System.Threading;\r\n\r\n /// \r\n /// General Utility Functions.\r\n /// \r\n public class Util\r\n {\r\n // Win32 MAX_PATH is 260 according to Internets.\r\n private const int MAX_MUNGED_LENGTH = 150;\r\n\r\n public static string hashString(string input)\r\n {\r\n byte[] buffer = new byte[input.Length * sizeof(char)];\r\n System.Buffer.BlockCopy(input.ToCharArray(), 0, buffer, 0, buffer.Length);\r\n SHA256Managed hasher = new SHA256Managed();\r\n byte[] rawHash = hasher.ComputeHash(buffer);\r\n return new SoapHexBinary(rawHash).ToString();\r\n }\r\n\r\n public static string hashFilesystemPath(string filesystemPath)\r\n {\r\n ////Logger.WriteLine(\"Hashing \" + filesystemPath);\r\n using (FileStream stream = File.OpenRead(filesystemPath))\r\n {\r\n SHA256 sha = new SHA256Managed();\r\n byte[] rawHash = sha.ComputeHash(stream);\r\n string rc = new SoapHexBinary(rawHash).ToString();\r\n ////Logger.WriteLine(\"fresh hash of \" + obj.getFilesystemPath() + \" yields \" + rc);\r\n return rc;\r\n }\r\n }\r\n\r\n public static string mungeClean(string s)\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n bool lastIsLetter = false;\r\n foreach (char c in s)\r\n {\r\n if (char.IsLetter(c) || char.IsNumber(c))\r\n {\r\n sb.Append(c);\r\n lastIsLetter = true;\r\n }\r\n else\r\n {\r\n if (lastIsLetter)\r\n {\r\n sb.Append('-');\r\n }\r\n\r\n lastIsLetter = false;\r\n }\r\n }\r\n\r\n if (sb.Length > MAX_MUNGED_LENGTH)\r\n {\r\n string originalPathHash = Util.hashString(sb.ToString());\r\n int additionsLength = originalPathHash.Length + 3;\r\n sb.Remove(MAX_MUNGED_LENGTH - additionsLength, sb.Length - (MAX_MUNGED_LENGTH - additionsLength));\r\n sb.Append(\"...\");\r\n sb.Append(originalPathHash);\r\n }\r\n\r\n return sb.ToString();\r\n }\r\n\r\n // Replace characters in a filename the same way DafnySpec/DafnyCC does.\r\n public static string dafnySpecMungeName(string s)\r\n {\r\n return s.Replace('.', '_').Replace('-', '_');\r\n }\r\n\r\n // Returns null if s doesn't end with eold.\r\n public static string replaceExtension(string s, string eold, string enew)\r\n {\r\n if (s.EndsWith(eold))\r\n {\r\n return s.Substring(0, s.Length - eold.Length) + enew;\r\n }\r\n else\r\n {\r\n return null;\r\n }\r\n }\r\n\r\n /// \r\n /// Check an ASCII encoded file for the presence of bad characters\r\n /// and character combinations. What we consider bad:\r\n /// - Tab characters.\r\n /// - Carraige returns not followed by a line feed.\r\n /// - Line feeds not preceeded by a carraige return.\r\n /// \r\n /// File to check.\r\n /// True if no bad characters found. False otherwise.\r\n public static bool CheckSourceFileForBadCharacters(string sourcePath)\r\n {\r\n const int HT = 0x09; // Horizontal tab.\r\n const int LF = 0x0a; // Line feed.\r\n const int CR = 0x0d; // Carraige return.\r\n\r\n using (StreamReader reader = new StreamReader(sourcePath))\r\n {\r\n int octet;\r\n\r\n // REVIEW: Sanity check reader.CurrentEncoding here?\r\n while ((octet = reader.Read()) > 0)\r\n {\r\n switch (octet)\r\n {\r\n case CR:\r\n if (reader.Read() != LF)\r\n {\r\n return false;\r\n }\r\n\r\n break;\r\n\r\n case LF:\r\n case HT:\r\n return false;\r\n }\r\n }\r\n }\r\n\r\n return true;\r\n }\r\n\r\n public static void Assert(bool condition)\r\n {\r\n if (!condition)\r\n {\r\n Logger.WriteLine(\"Assert failure.\");\r\n Debug.Assert(condition);\r\n\r\n for (int loop = 10; loop > 0; loop--)\r\n {\r\n Logger.WriteLine(\"Something broke in assert. Attach a debugger to debug.\");\r\n Logger.WriteLine(string.Format(\"You have {0} seconds to comply.\", loop * 10));\r\n Debugger.Break();\r\n Thread.Sleep(10000);\r\n }\r\n\r\n Environment.Exit(-1);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VSProjectParser.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Xml;\r\n\r\n /// \r\n /// Mechanism for parsing Visual Studio project Files.\r\n /// Determines project dependencies and outputs.\r\n /// \r\n internal class VSProjectParser\r\n {\r\n private SourcePath projectFile;\r\n private HashSet dependencies = new HashSet();\r\n private HashSet outputs = new HashSet();\r\n private string outputType = null;\r\n private string assemblyName = null;\r\n ////private string outputPath = null;\r\n\r\n /// \r\n /// Initializes a new instance of the VSProjectParser class.\r\n /// \r\n /// Visual Studio project file to parse.\r\n public VSProjectParser(SourcePath projectFile)\r\n {\r\n this.projectFile = projectFile;\r\n this.Parse();\r\n\r\n CustomManifestParser cm = new CustomManifestParser(this.projectFile);\r\n this.dependencies.UnionWith(cm.getDependencies());\r\n this.outputs.UnionWith(cm.getOutputs());\r\n }\r\n\r\n public IEnumerable getDependencies()\r\n {\r\n return this.dependencies;\r\n }\r\n\r\n public IEnumerable getOutputs()\r\n {\r\n return this.outputs;\r\n }\r\n\r\n private void Parse()\r\n {\r\n this.dependencies.Add(this.projectFile);\r\n\r\n using (XmlTextReader reader = new XmlTextReader(IronRootDirectory.PathTo(this.projectFile)))\r\n {\r\n while (reader.Read())\r\n {\r\n if (reader.NodeType == XmlNodeType.Element)\r\n {\r\n if (string.Compare(reader.Name, \"Compile\") == 0)\r\n {\r\n this.dependencies.Add(this.projectFile.getNewSourcePath(reader.GetAttribute(\"Include\")));\r\n }\r\n else if (string.Compare(reader.Name, \"PropertyGroup\") == 0)\r\n {\r\n this.ParseOutput(reader);\r\n }\r\n }\r\n }\r\n\r\n reader.Close();\r\n }\r\n\r\n if (this.outputType != null && this.assemblyName != null) //// && outputPath != null)\r\n {\r\n string path = Path.Combine(this.projectFile.getDirPath(), string.Format(\"{0}.{1}\", this.assemblyName, this.OutputTypeToExtension(this.outputType)));\r\n ////Console.WriteLine(\"{0}: generating {1}\", this.projectFile.getRelativePath(), path);\r\n this.outputs.Add(new BuildObject(path));\r\n }\r\n else\r\n {\r\n throw new UserError(string.Format(\"Project {0} doesn't seem to have output specification in the expected format\", this.projectFile.getRelativePath()));\r\n }\r\n }\r\n\r\n private void ValidateConsistentOption(string optionName, string oldValue, string newValue)\r\n {\r\n if (oldValue == null)\r\n {\r\n return;\r\n }\r\n\r\n if (!oldValue.Equals(newValue))\r\n {\r\n throw new UserError(\r\n string.Format(\r\n \"Values for {0} not consistent across all build configurations in {1} ({2} vs {3})\",\r\n optionName,\r\n this.projectFile.getRelativePath(),\r\n oldValue,\r\n newValue));\r\n }\r\n }\r\n\r\n private void ParseOutput(XmlTextReader reader)\r\n {\r\n string lastElement = null;\r\n\r\n while (reader.Read())\r\n {\r\n if (reader.NodeType == XmlNodeType.EndElement)\r\n {\r\n lastElement = null;\r\n\r\n if (\"PropertyGroup\".Equals(reader.Name))\r\n {\r\n break;\r\n }\r\n }\r\n\r\n if (reader.NodeType == XmlNodeType.Element)\r\n {\r\n lastElement = reader.Name;\r\n }\r\n\r\n if (reader.NodeType == XmlNodeType.Text && lastElement != null)\r\n {\r\n string val = reader.Value;\r\n\r\n ////if (\"OutputPath\".Equals(lastElement))\r\n ////{\r\n //// validateConsistentOption(\"OutputPath\", outputPath, val);\r\n //// outputPath = val;\r\n ////}\r\n if (\"AssemblyName\".Equals(lastElement))\r\n {\r\n this.ValidateConsistentOption(\"AssemblyName\", this.assemblyName, val);\r\n this.assemblyName = val;\r\n }\r\n\r\n if (\"OutputType\".Equals(lastElement))\r\n {\r\n this.ValidateConsistentOption(\"OutputType\", this.outputType, val);\r\n this.outputType = val;\r\n }\r\n }\r\n }\r\n }\r\n\r\n private string OutputTypeToExtension(string outputType)\r\n {\r\n switch (outputType)\r\n {\r\n case \"Exe\":\r\n return \"exe\";\r\n case \"Library\":\r\n return \"dll\";\r\n default:\r\n throw new SourceConfigurationError(\"VSProjectParser doesn't know how to canonicalize \" + outputType);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VSSolutionParser.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Text.RegularExpressions;\r\n\r\n internal class VSSolutionParser\r\n {\r\n private SourcePath solutionFile;\r\n private List dependencies = new List();\r\n private List outputs = new List();\r\n\r\n public VSSolutionParser(SourcePath solutionFile)\r\n {\r\n this.solutionFile = solutionFile;\r\n this.Parse();\r\n }\r\n\r\n public IEnumerable getDependencies()\r\n {\r\n return this.dependencies;\r\n }\r\n\r\n public IEnumerable getOutputs()\r\n {\r\n return this.outputs;\r\n }\r\n\r\n private void Parse()\r\n {\r\n this.dependencies.Add(this.solutionFile);\r\n\r\n using (StreamReader stream = new StreamReader(IronRootDirectory.PathTo(this.solutionFile)))\r\n {\r\n Regex regex = new Regex(@\"Project\\([\\S]+\\)[\\s]+=[\\s]+([^$]*)\", RegexOptions.IgnoreCase);\r\n string line;\r\n\r\n while ((line = stream.ReadLine()) != null)\r\n {\r\n MatchCollection matches = regex.Matches(line);\r\n\r\n if (matches.Count > 0)\r\n {\r\n SourcePath projFile = this.solutionFile.getNewSourcePath(matches[0].Groups[1].Value.Split(\"\\\", \".ToCharArray())[5]);\r\n ////Console.WriteLine(String.Format(\"Found project file {0}\", projFile.getFilesystemPath()));\r\n VSProjectParser proj = new VSProjectParser(projFile);\r\n this.dependencies.AddRange(proj.getDependencies());\r\n this.outputs.AddRange(proj.getOutputs());\r\n }\r\n }\r\n\r\n stream.Close();\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VSSolutionVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n /// \r\n /// Verb to build a Visual Studio solution.\r\n /// \r\n internal class VSSolutionVerb\r\n : Verb, IProcessInvokeAsyncVerb\r\n {\r\n private const int Version = 5;\r\n\r\n private readonly SourcePath solutionFile;\r\n private readonly AbstractId abstractId;\r\n private readonly VSSolutionParser solutionParser;\r\n private readonly string outputPathSuffix;\r\n private readonly DafnyCompileOneVerb dafnyCompileOneVerb;\r\n\r\n private readonly bool releaseBuild;\r\n\r\n /// \r\n /// Initializes a new instance of the VSSolutionVerb class.\r\n /// \r\n /// Solution file to build.\r\n /// Optional dafny-derived-CSharp dependency.\r\n public VSSolutionVerb(SourcePath solutionFile, SourcePath optionalDafnyInput = null, bool releaseBuild = false)\r\n {\r\n this.solutionFile = solutionFile;\r\n this.abstractId = new AbstractId(this.GetType().Name, VSSolutionVerb.Version, this.solutionFile.ToString());\r\n this.releaseBuild = releaseBuild;\r\n\r\n // Parse the solution file (and project files contained in the solution).\r\n this.solutionParser = new VSSolutionParser(this.solutionFile);\r\n\r\n this.outputPathSuffix = Path.Combine(BuildEngine.theEngine.getObjRoot(), this.solutionFile.getDirPath());\r\n\r\n if (optionalDafnyInput != null)\r\n {\r\n this.dafnyCompileOneVerb = new DafnyCompileOneVerb(optionalDafnyInput);\r\n }\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n List dependencies = new List(this.solutionParser.getDependencies());\r\n if (this.dafnyCompileOneVerb != null)\r\n {\r\n dependencies.AddRange(this.dafnyCompileOneVerb.getOutputs());\r\n }\r\n\r\n return dependencies;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n if (this.dafnyCompileOneVerb != null)\r\n {\r\n return new IVerb[] { this.dafnyCompileOneVerb };\r\n } else {\r\n return new IVerb[] {};\r\n }\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n // Note that since we override the solution output directory in our\r\n // getWorker() below, we also need to override the output paths\r\n // coming from the solution parser.\r\n return from output in this.solutionParser.getOutputs() select new BuildObject(Path.Combine(this.outputPathSuffix, output.getFileName()));\r\n }\r\n\r\n public BuildObject getOutputPath()\r\n {\r\n return new BuildObject(this.outputPathSuffix);\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // If we were given an optional dafny input, let this build know about the resulting verb's output.\r\n // Note: this is deliberately written to break if someone changes DafnyCompileOneVerb to have multiple outputs.\r\n if (this.dafnyCompileOneVerb != null)\r\n {\r\n File.Copy(\r\n workingDirectory.PathTo(this.dafnyCompileOneVerb.getOutputs().Single()),\r\n Path.Combine(workingDirectory.PathTo(this.outputPathSuffix), \"DafnyDerivedInput.cs\"));\r\n }\r\n\r\n List args = new List();\r\n args.Add(string.Format(\"/p:OutDir={0}\", workingDirectory.PathTo(this.outputPathSuffix)));\r\n args.Add(string.Format(\"/p:Configuration={0}\", this.releaseBuild ? \"Release\" : \"Debug\"));\r\n ////args.Add(\"/fileLogger\"); // Uncomment to log MSBuild execution.\r\n args.Add(workingDirectory.PathTo(this.solutionFile));\r\n\r\n // TODO: Fix absolute path to MSBuild.exe (at least use %SystemRoot%)!\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n \"c:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe\",\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n failureBase: getDiagnosticsBase(),\r\n allowAbsoluteExe: true,\r\n allowAbsoluteArgs: true);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n return disposition;\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/Verb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Xml;\r\n\r\n internal abstract class Verb\r\n : IVerb\r\n {\r\n public override bool Equals(object obj)\r\n {\r\n IVerb other = obj as IVerb;\r\n if (other != null)\r\n {\r\n return this.getAbstractIdentifier().Equals(other.getAbstractIdentifier());\r\n }\r\n else\r\n {\r\n return false;\r\n }\r\n }\r\n\r\n public override int GetHashCode()\r\n {\r\n return this.getAbstractIdentifier().GetHashCode();\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return this.getAbstractIdentifier().ToString();\r\n }\r\n\r\n public int CompareTo(object other)\r\n {\r\n return this.getAbstractIdentifier().CompareTo(((IVerb)other).getAbstractIdentifier());\r\n }\r\n\r\n public abstract IEnumerable getDependencies(out DependencyDisposition ddisp);\r\n\r\n public abstract IEnumerable getVerbs();\r\n\r\n public abstract IEnumerable getOutputs();\r\n\r\n public virtual BuildObject getDiagnosticsBase()\r\n {\r\n return new BuildObject(Path.Combine(\r\n BuildEngine.theEngine.getObjRoot(), \"diagnostics\", Util.mungeClean(this.getAbstractIdentifier().ToString())));\r\n }\r\n\r\n public virtual IEnumerable getFailureOutputs()\r\n {\r\n return new BuildObject[]\r\n {\r\n this.getDiagnosticsBase().makeOutputObject(\".bat\"),\r\n this.getDiagnosticsBase().makeOutputObject(\".stdout\"),\r\n this.getDiagnosticsBase().makeOutputObject(\".stderr\"),\r\n };\r\n }\r\n\r\n public abstract IVerbWorker getWorker(WorkingDirectory workingDirectory);\r\n\r\n // Called by tool when this is the top-level output, it has generated a Fresh\r\n // result, and we want to print that result on the display.\r\n public virtual Presentation getPresentation()\r\n {\r\n PresentationBuilder pr = new PresentationBuilder();\r\n pr.line(\"Okay.\");\r\n return pr.fix();\r\n }\r\n\r\n // Called by tool when we want a short (one-line)\r\n // summary for showing in-progress results.\r\n public virtual Presentation getRealtimePresentation(Disposition d)\r\n {\r\n PresentationBuilder pr = new PresentationBuilder();\r\n pr.startLine();\r\n pr.color(\r\n d is Fresh ? Presentation.GREEN : Presentation.RED,\r\n this.ToString() + \" \" + d.ToString());\r\n pr.endLine();\r\n if (d is Failed)\r\n {\r\n // This isn't a verification failure, a tool itself broke.\r\n // Provide that report.\r\n foreach (string m in d.getMessages())\r\n {\r\n pr.pre(Presentation.abbreviateLines(m));\r\n }\r\n }\r\n\r\n return pr.fix();\r\n }\r\n\r\n ////////////////////////////////////////////////////\r\n\r\n // Handy helper for verbs using ProcessInvoker.\r\n private bool cpuTimeSecondsValid = false;\r\n private double cpuTimeSeconds;\r\n\r\n public virtual void RecordProcessInvokeCpuTime(double cpuTimeSeconds)\r\n {\r\n this.cpuTimeSeconds = cpuTimeSeconds;\r\n this.cpuTimeSecondsValid = true;\r\n }\r\n\r\n public static string XML_SubprocessTiming = \"SubprocessTiming\";\r\n public static string XML_SubprocessTiming_Valid_Attr = \"Valid\";\r\n public static string XML_SubprocessTiming_CPUTimeSeconds_Attr = \"CPUTimeSeconds\";\r\n\r\n public void writeTimingXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(XML_SubprocessTiming);\r\n xw.WriteAttributeString(XML_SubprocessTiming_Valid_Attr, this.cpuTimeSecondsValid.ToString());\r\n if (this.cpuTimeSecondsValid)\r\n {\r\n xw.WriteAttributeString(XML_SubprocessTiming_CPUTimeSeconds_Attr, this.cpuTimeSeconds.ToString());\r\n }\r\n\r\n xw.WriteEndElement();\r\n }\r\n\r\n ////////////////////////////////////////////////////\r\n\r\n public abstract AbstractId getAbstractIdentifier();\r\n\r\n public static string XML_DebugVerb = \"DebugVerb\";\r\n public static string XML_DebugVerb_Value_Attr = \"value\";\r\n\r\n public static string XML_DebugDep = \"DebugDep\";\r\n public static string XML_DebugDep_Name_Attr = \"name\";\r\n public static string XML_DebugDep_Hash_Attr = \"hash\";\r\n\r\n public void writeDebugXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(XML_DebugVerb);\r\n xw.WriteAttributeString(XML_DebugVerb_Value_Attr, this.getAbstractIdentifier().ToString());\r\n xw.WriteEndElement();\r\n\r\n DependencyDisposition ddisp;\r\n foreach (BuildObject obj in this.getDependencies(out ddisp))\r\n {\r\n xw.WriteStartElement(XML_DebugDep);\r\n xw.WriteAttributeString(XML_DebugDep_Name_Attr, obj.getRelativePath());\r\n if (!(obj is VirtualBuildObject))\r\n {\r\n string hash = BuildEngine.theEngine.Repository.GetHash(obj);\r\n if (string.IsNullOrEmpty(hash))\r\n {\r\n // REVIEW: Can this happen? Do something else here?\r\n hash = \"unknown\";\r\n }\r\n\r\n xw.WriteAttributeString(\r\n XML_DebugDep_Hash_Attr,\r\n hash);\r\n }\r\n\r\n xw.WriteEndElement();\r\n }\r\n\r\n Util.Assert(ddisp == DependencyDisposition.Complete);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VerbOutputsContext.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class VerbOutputsContext\r\n : IncludePathContext\r\n {\r\n private IVerb sourceVerb;\r\n private string descr;\r\n private HashSet dafnyOutputs;\r\n private bool assertSuspiciousDafnyImpls;\r\n\r\n public VerbOutputsContext(IVerb sourceVerb, bool assertSuspiciousDafnyImpls)\r\n {\r\n this.sourceVerb = sourceVerb;\r\n this.descr = \"VerbOutputs(\" + sourceVerb + \")\";\r\n this.assertSuspiciousDafnyImpls = assertSuspiciousDafnyImpls;\r\n }\r\n\r\n private HashSet DafnyOutputs\r\n {\r\n get\r\n {\r\n if (this.dafnyOutputs == null)\r\n {\r\n this.dafnyOutputs = new HashSet(this.sourceVerb.getOutputs());\r\n }\r\n\r\n return this.dafnyOutputs;\r\n }\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return this.descr;\r\n }\r\n\r\n public override BuildObject search(string basename, ModPart modPart)\r\n {\r\n // Kinda linear.\r\n ////Logger.WriteLine(\"Looking for \" + basename);\r\n foreach (BuildObject obj in this.DafnyOutputs)\r\n {\r\n if (BeatExtensions.whichPart(obj) != modPart)\r\n {\r\n continue;\r\n }\r\n\r\n ////Logger.WriteLine(\" trying \" + obj.getFileNameWithoutExtension() + \" from \" + obj);\r\n\r\n if (string.Equals(obj.getFileNameWithoutExtension(), basename, StringComparison.OrdinalIgnoreCase))\r\n {\r\n if (this.assertSuspiciousDafnyImpls)\r\n {\r\n DafnyCCVerb.AssertSmellsImplementy(obj);\r\n }\r\n\r\n return obj;\r\n }\r\n }\r\n\r\n return null;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VerbOutputsContextVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n /// \r\n /// This verb waits for a parent verb to complete, then emits\r\n /// a ContextContents that searches the parent verb's results.\r\n /// \r\n internal class VerbOutputsContextVerb\r\n : ContextGeneratingVerb\r\n {\r\n private IVerb parent;\r\n private bool assertSuspiciousDafnyImpls;\r\n\r\n public VerbOutputsContextVerb(IVerb parent, bool assertSuspiciousDafnyImpls)\r\n : base(parent.getAbstractIdentifier().ToString(), null)\r\n {\r\n this.parent = parent;\r\n this.assertSuspiciousDafnyImpls = assertSuspiciousDafnyImpls;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n\r\n // I really don't care how many outputs the parent has; any one will\r\n // link me to the parent.\r\n IEnumerable result = this.parent.getOutputs();\r\n Util.Assert(result.Count() > 0);\r\n return result;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new IVerb[] { this.parent };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n VerbOutputsContext context = new VerbOutputsContext(this.parent, this.assertSuspiciousDafnyImpls);\r\n ContextContents contents = new ContextContents(context);\r\n BuildEngine.theEngine.Repository.StoreVirtual(this.getContextOutput(), new Fresh(), contents);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VerbRunner.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n using System.Collections.Generic;\n using System.IO;\n using System.Linq;\n using System.Threading;\n\n /// \n /// Infrastructure for performing VerbWorker work, possibly asynchronously.\n /// Conceptually, this is the part of the scheduler that runs verbs.\n /// \n /// \n /// There is only one instance of this class in the system.\n /// \n internal class VerbRunner\n {\n /// \n /// Whether or not to run in a special debugging mode where everything\n /// is run on a single thread (including any 'async' work).\n /// \n /// \n /// Without this, JonH reported problems: \"Breaking and examining\n /// variables on a second thread seems to send VS into fits\".\n /// \n private const bool DebugOneThread = false;\n\n /// \n /// A sorter of verbs (special case for DafnyVerifyOneVerb only?).\n /// \n private VerbToposorter verbToposorter;\n\n /// \n /// Event used to signal the completion of some (possibly asynchronous)\n /// work.\n /// \n private ManualResetEvent completionEvent;\n\n /// \n /// Lock protecting the runnableVerbs and startedVerbs collections.\n /// \n private ReaderWriterLock verbStateLock;\n\n /// \n /// Verbs that have been submitted, but have not yet started to run.\n /// \n private HashSet runnableVerbs;\n\n /// \n /// Verbs that have started to run (and may or may not have\n /// completed; once added we never remove them from this collection).\n /// \n private HashSet startedVerbs;\n\n /// \n /// Degree of asynchronicity to allow (i.e. number of async threads).\n /// \n private int jobParallelism;\n\n /// \n /// Lock protecting the taskCompletions list.\n /// \n private ReaderWriterLock taskCompletionsLock;\n\n /// \n /// Tasks that have completed running, but not yet processed.\n /// \n private List taskCompletions;\n\n /// \n /// Number of currently running tasks.\n /// \n private int runningTasks;\n\n /// \n /// Initializes a new instance of the VerbRunner class.\n /// \n /// The verb sorter to use.\n /// Degree of parallelism to allow.\n public VerbRunner(VerbToposorter verbToposorter, int jobParallelism)\n {\n this.verbToposorter = verbToposorter;\n this.jobParallelism = jobParallelism;\n this.completionEvent = new ManualResetEvent(true);\n\n this.verbStateLock = new ReaderWriterLock();\n this.runnableVerbs = new HashSet();\n this.startedVerbs = new HashSet();\n\n this.taskCompletionsLock = new ReaderWriterLock();\n this.taskCompletions = new List();\n\n this.runningTasks = 0;\n }\n\n /// \n /// Submits a verb for execution.\n /// \n /// The verb to submit.\n public void submitVerb(IVerb verb)\n {\n this.verbStateLock.AcquireWriterLock(Timeout.Infinite);\n\n // If lock contention were an issue, we could accumulate these\n // on a thread-local collection, then batch them into runnableVerbs\n // during the lock inside scheduleAndWait.\n if (!this.startedVerbs.Contains(verb))\n {\n this.runnableVerbs.Add(verb);\n }\n\n this.verbStateLock.ReleaseLock();\n }\n\n /// \n /// Called by the scheduler to run the verbs which can be run.\n /// \n /// \n /// The scheduler calling us (for debugging).\n /// \n /// A list of tasks (verb runs) that have completed.\n public List scheduleAndWait(Scheduler dbgScheduler)\n {\n while (true)\n {\n List taskCompletionBatch;\n\n // Loop until something gets done.\n while (true)\n {\n this.dbgUpdateProgress(dbgScheduler);\n\n this.taskCompletionsLock.AcquireWriterLock(Timeout.Infinite);\n taskCompletionBatch = this.taskCompletions;\n this.taskCompletions = new List();\n this.completionEvent.Reset();\n this.taskCompletionsLock.ReleaseLock();\n\n bool canProcessCompletedTask = taskCompletionBatch.Count() > 0;\n bool canStartNewTask = (this.runnableVerbs.Count() > 0) && (this.jobParallelism > this.runningTasks);\n if (!(canProcessCompletedTask || canStartNewTask))\n {\n // Nothing will change until a running task finishes. Snooze.\n if (this.runningTasks == 0)\n {\n dbgScheduler.dbgDumpWaitIndex();\n Util.Assert(false);\n }\n\n this.completionEvent.WaitOne();\n continue;\n }\n\n break;\n }\n\n int numCompletedTasks = taskCompletionBatch.Count();\n Say(string.Format(\"marking {0} tasks completing; runningTasks now {1}\", numCompletedTasks, this.runningTasks));\n this.runningTasks -= numCompletedTasks;\n\n int idleTasks = this.jobParallelism - this.runningTasks;\n\n if (idleTasks > 0)\n {\n this.verbStateLock.AcquireWriterLock(Timeout.Infinite);\n\n List runnableVerbsBatch = new List(this.runnableVerbs);\n Say(\"AsyncRunner toposorting \" + runnableVerbsBatch.Count() + \" verbs\");\n runnableVerbsBatch.Sort(this.verbToposorter);\n\n ////Logger.WriteLine(string.Format(\"verbToposorter({0}) yields:\", runnableVerbsBatch.Count));\n ////foreach (IVerb verb in runnableVerbsBatch)\n ////{\n //// Logger.WriteLine(\" \" + verb.ToString() + \" @ \"+ this.verbToposorter.getDepth(verb));\n ////}\n\n for (int i = 0; i < idleTasks && i < runnableVerbsBatch.Count(); i++)\n {\n IVerb verb = runnableVerbsBatch[i];\n this.startTask(verb);\n this.runnableVerbs.Remove(verb);\n this.startedVerbs.Add(verb);\n }\n\n this.verbStateLock.ReleaseLock();\n }\n\n if (taskCompletionBatch.Count() > 0 || this.runningTasks == 0)\n {\n // Something actually got done, so the caller could meaningfully schedule more work.\n return taskCompletionBatch;\n }\n }\n }\n\n /// \n /// Writes debugging output to the logger.\n /// \n /// The message to write.\n private static void Say(string msg)\n {\n if (Scheduler.Debug)\n {\n#pragma warning disable 162\n Logger.WriteLine(\"[async] \" + msg);\n#pragma warning restore 162\n }\n }\n\n /// \n /// Reports current progress to the scheduler.\n /// \n /// The scheduler.\n private void dbgUpdateProgress(Scheduler dbgScheduler)\n {\n dbgScheduler.dbgUpdateProgress(this.runnableVerbs.Count(), this.runningTasks);\n }\n\n /// \n /// Starts a task (i.e. runs a verb).\n /// \n /// The verb to run.\n private void startTask(IVerb verb)\n {\n this.runningTasks += 1;\n\n // We execute the verb in a private build tree (WorkingDirectory).\n WorkingDirectory workingDirectory = new WorkingDirectory(BuildEngine.theEngine.getIronRoot());\n\n // Note that we call PrepareForVerb prior to the verb's getWorker\n // method as the getWorker call might do some of the work directly.\n // REVIEW: We might want to change our contract with getWorker to\n // disallow it from touching files in the working directory (so we\n // don't have to prep the working dir in the remote execution case).\n this.PrepareForVerb(workingDirectory, verb);\n\n IVerbWorker worker = verb.getWorker(workingDirectory);\n if (worker.IsSync() == VerbWorkerType.Sync)\n {\n this.completeTask(verb, worker);\n }\n else\n {\n AsyncVerbTask task = new AsyncVerbTask(this, worker, verb);\n Say(string.Format(\"scheduling {0}\", verb));\n#pragma warning disable 162\n if (DebugOneThread)\n {\n task.Run();\n }\n else\n {\n new Thread(new ThreadStart(task.Run)).Start();\n }\n#pragma warning restore 162\n }\n }\n\n /// \n /// Prepares the working directory tree for a verb's execution.\n /// \n /// The verb whose execution we're preparing for.\n private void PrepareForVerb(WorkingDirectory workingDirectory, IVerb verb)\n {\n // Debugging aide: write out the abstract id for this verb.\n File.WriteAllText(workingDirectory.PathTo(\"Debug.txt\"), verb.getAbstractIdentifier().ToString());\n\n Repository repository = BuildEngine.theEngine.Repository;\n\n // Copy all verb inputs from the item cache to here.\n DependencyDisposition ddisp;\n foreach (BuildObject input in verb.getDependencies(out ddisp))\n {\n if (!(input is VirtualBuildObject))\n {\n workingDirectory.CreateDirectoryFor(input); // REVIEW: No longer needed?\n repository.Fetch(workingDirectory, input);\n }\n }\n\n // Ensures that the directory tree for each of the verb's outputs exists.\n foreach (BuildObject output in verb.getOutputs())\n {\n workingDirectory.CreateDirectoryFor(output);\n }\n }\n\n /// \n /// Completes a task (verb run).\n /// \n /// \n /// Note that for Async verb workers, this method runs on a separate thread.\n /// \n /// The verb which was run.\n /// The verb's worker.\n private void completeTask(IVerb verb, IVerbWorker worker)\n {\n this.taskCompletionsLock.AcquireWriterLock(Timeout.Infinite);\n Disposition disp = worker.Complete();\n TaskCompletion tc = new TaskCompletion(worker.GetWorkingDirectory(), verb, disp);\n this.taskCompletions.Add(tc);\n this.completionEvent.Set();\n this.taskCompletionsLock.ReleaseWriterLock();\n }\n\n /// \n /// Represents a completed task.\n /// Ties a Disposition to the Verb instance which created it.\n /// \n /// \n /// REVIEW: Keep the entire worker instead of just the working dir?\n /// Might want to run worker.Complete on main thread after pulling this\n /// off the task completions list instead of on separate thread prior to\n /// putting it on the task completions list.\n /// \n public class TaskCompletion\n {\n /// \n /// The directory the verb executed in.\n /// \n public WorkingDirectory workingDirectory;\n\n /// \n /// The verb whose completion this instance describes.\n /// \n public IVerb verb;\n\n /// \n /// The disposition of this task.\n /// \n public Disposition disposition;\n\n /// \n /// Initializes a new instance of the TaskCompletion class.\n /// \n /// \n /// The private working directory the task executed in.\n /// \n /// \n /// The verb whose completion this instance describes.\n /// \n /// \n /// The disposition of this task.\n /// \n public TaskCompletion(WorkingDirectory workingDirectory, IVerb verb, Disposition disposition)\n {\n this.workingDirectory = workingDirectory;\n this.verb = verb;\n this.disposition = disposition;\n }\n }\n\n /// \n /// Representation of an asynchronous task.\n /// \n /// \n /// REVIEW: Do we need this class? It is 1:1 with the worker.\n /// \n private class AsyncVerbTask\n {\n /// \n /// The verb-running part of the scheduler.\n /// \n private VerbRunner runner;\n\n /// \n /// The worker of this verb task.\n /// \n private IVerbWorker worker;\n\n /// \n /// The verb associated with this task/worker.\n /// \n /// \n /// Don't call any methods on this guy while on async thread!\n /// It's just here to carry back to the TaskCompletion on the main thread.\n /// \n private IVerb verb;\n\n /// \n /// Initializes a new instance of the AsyncVerbTask class.\n /// \n /// \n /// The verb running part of the scheduler.\n /// \n /// \n /// The worker of this verb task.\n /// \n /// \n /// The verb associated with this task/worker.\n /// \n public AsyncVerbTask(VerbRunner runner, IVerbWorker worker, IVerb verb)\n {\n this.runner = runner;\n this.worker = worker;\n this.verb = verb;\n }\n\n /// \n /// Runs the task.\n /// \n /// \n /// Note that this method runs on a separate thread.\n /// Only make thread-safe calls from here.\n /// \n public void Run()\n {\n Say(string.Format(\"launching {0}\", this.verb));\n Logger.WriteLine(string.Format(\"{0} launched\", this.verb));\n this.worker.RunAsync();\n this.runner.completeTask(this.verb, this.worker);\n Say(string.Format(\"completed {0}\", this.verb));\n }\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VerbSyncWorker.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n /// \r\n /// Representation of a synchronous verb worker.\r\n /// \r\n internal class VerbSyncWorker : IVerbWorker\r\n {\r\n /// \r\n /// The private working directory for this worker to work in.\r\n /// \r\n private WorkingDirectory workingDirectory;\r\n\r\n /// \r\n /// The disposition of this activity.\r\n /// \r\n private Disposition result;\r\n\r\n /// \r\n /// Initializes a new instance of the VerbSyncWorker class.\r\n /// \r\n /// \r\n /// The private working directory for this worker to work in.\r\n /// \r\n /// The Disposition to return on complete.\r\n public VerbSyncWorker(WorkingDirectory workingDirectory, Disposition result)\r\n {\r\n this.workingDirectory = workingDirectory;\r\n this.result = result;\r\n }\r\n\r\n /// \r\n /// Indicates whether this work needs to be scheduled asynchronously.\r\n /// Since this is the synchronous implementation, always returns Sync.\r\n /// \r\n /// Always returns Sync.\r\n public virtual VerbWorkerType IsSync()\r\n {\r\n return VerbWorkerType.Sync;\r\n }\r\n\r\n /// \r\n /// Gets the private working directory this verb executes in.\r\n /// \r\n /// The directory this verb executes in.\r\n public WorkingDirectory GetWorkingDirectory()\r\n {\r\n return this.workingDirectory;\r\n }\r\n\r\n /// \r\n /// Performs the asynchronous work for this worker, which for a\r\n /// synchronous worker like this one, should not exist. Therefore,\r\n /// this implementation just asserts.\r\n /// \r\n /// \r\n /// Shouldn't ever be called, since our IsSync returns Sync.\r\n /// \r\n public void RunAsync()\r\n { \r\n Util.Assert(false);\r\n }\r\n\r\n /// \r\n /// Performs the work of this synchronous worker (or whatever isn't\r\n /// done in the constructor at least).\r\n /// Returns the ultimate disposition of the activity.\r\n /// \r\n /// \r\n /// Thou shalt not return Stale.\r\n /// \r\n /// The disposition of this worker's work.\r\n public virtual Disposition Complete()\r\n {\r\n return this.result;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VerbToposorter.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n /// \r\n /// Mechanism for ordering verbs topologically.\r\n /// Used by the Scheduler and related components.\r\n /// \r\n internal class VerbToposorter\r\n : IComparer\r\n {\r\n /// \r\n /// Mapping of verbs to their verb depth.\r\n /// \r\n private Dictionary verbDepth;\r\n\r\n /// \r\n /// Initializes a new instance of the \r\n /// class.\r\n /// \r\n public VerbToposorter()\r\n {\r\n this.verbDepth = new Dictionary();\r\n }\r\n\r\n /// \r\n /// Compares two verbs topologically.\r\n /// \r\n /// \r\n /// This is the IComparer.Compare method.\r\n /// \r\n /// One verb to compare.\r\n /// The other verb to compare.\r\n /// \r\n /// A signed integer that indicates the relative values of x and y,\r\n /// see IComparer.Compare interface.\r\n /// \r\n public int Compare(IVerb x, IVerb y)\r\n {\r\n int rc;\r\n int c0 = this.GetDepth(x) - this.GetDepth(y);\r\n if (c0 != 0)\r\n {\r\n rc = c0;\r\n }\r\n else\r\n {\r\n // Break depth ties alphabetically.\r\n rc = x.ToString().CompareTo(y.ToString());\r\n }\r\n\r\n ////Logger.WriteLine(String.Format(\"Compare({0},{1})=={2}\", x, y, rc));\r\n return rc;\r\n }\r\n\r\n /// \r\n /// Gets the \"depth\" (dependency order) of a verb.\r\n /// \r\n /// The verb in question.\r\n /// The verb depth.\r\n private int GetDepth(IVerb verb)\r\n {\r\n if (this.verbDepth.ContainsKey(verb))\r\n {\r\n return this.verbDepth[verb];\r\n }\r\n\r\n int depth;\r\n DafnyVerifyOneVerb vone = verb as DafnyVerifyOneVerb;\r\n if (vone != null)\r\n {\r\n int deepestParent = -1;\r\n foreach (SourcePath sourcePath in vone.getDirectIncludes())\r\n {\r\n IVerb parent = new DafnyVerifyOneVerb(sourcePath);\r\n int parentDepth = this.GetDepth(parent);\r\n deepestParent = Math.Max(deepestParent, parentDepth);\r\n }\r\n\r\n depth = deepestParent + 1;\r\n }\r\n else\r\n {\r\n // Right now we only care about ordering the DafnyVerifyOneVerbs\r\n // wrt one another. Other verbs will be constrained by build\r\n // dependency anyway.\r\n depth = 0;\r\n }\r\n\r\n this.verbDepth[verb] = depth;\r\n return depth;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VerificationMessage.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Xml;\r\n\r\n internal class VerificationMessage\r\n {\r\n public const string _xml_tag = \"VerificationMessage\";\r\n private const string _xml_message_sourcefile_attr = \"SourceFile\";\r\n\r\n private string sourceLabel;\r\n private string message;\r\n\r\n public VerificationMessage(string sourceLabel, string message)\r\n {\r\n this.sourceLabel = sourceLabel;\r\n this.message = message;\r\n }\r\n\r\n public string SourceLabel\r\n {\r\n get { return this.sourceLabel; }\r\n }\r\n\r\n public string Message\r\n {\r\n get { return this.message; }\r\n }\r\n\r\n public static VerificationMessage ReadXml(XmlReader xr)\r\n {\r\n Util.Assert(xr.Name.Equals(VerificationMessage._xml_tag));\r\n string relSourcePath = xr.GetAttribute(VerificationMessage._xml_message_sourcefile_attr);\r\n string message = xr.ReadElementContentAsString();\r\n return new VerificationMessage(relSourcePath, message);\r\n }\r\n\r\n public void WriteXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(VerificationMessage._xml_tag);\r\n xw.WriteAttributeString(VerificationMessage._xml_message_sourcefile_attr, this.sourceLabel);\r\n xw.WriteString(this.message);\r\n xw.WriteEndElement();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VerificationObligationList.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n\r\n internal class VerificationObligationList\r\n {\r\n public const string VOL_EXTN = \".vol\"; // VOL = Verification Object List\r\n\r\n private readonly List verificationObligations;\r\n private bool complete;\r\n\r\n public VerificationObligationList()\r\n {\r\n this.verificationObligations = new List();\r\n }\r\n\r\n public VerificationObligationList(IEnumerable data)\r\n {\r\n this.verificationObligations = new List(data);\r\n this.complete = true;\r\n }\r\n\r\n public static VerificationObligationList fetch(BuildObject obj)\r\n {\r\n VerificationObligationList vol = new VerificationObligationList();\r\n using (TextReader sr = BuildEngine.theEngine.Repository.OpenRead(obj))\r\n {\r\n string line;\r\n while ((line = sr.ReadLine()) != null)\r\n {\r\n Util.Assert(!line.StartsWith(BuildEngine.theEngine.getSrcRoot())); // unimplemented\r\n Util.Assert(!line.StartsWith(BuildEngine.theEngine.getVirtualRoot())); // nonsense\r\n vol.Add(new BuildObject(line));\r\n }\r\n }\r\n\r\n vol.complete = true;\r\n return vol;\r\n }\r\n\r\n public void Add(BuildObject obj)\r\n {\r\n Util.Assert(!this.complete);\r\n this.verificationObligations.Add(obj);\r\n }\r\n\r\n public IEnumerable getVerificationObligations()\r\n {\r\n Util.Assert(this.complete);\r\n return this.verificationObligations;\r\n }\r\n\r\n public void store(WorkingDirectory workingDirectory, BuildObject location)\r\n {\r\n this.complete = true;\r\n string[] lines = this.verificationObligations.Select(vo => vo.getRelativePath()).ToArray();\r\n File.WriteAllLines(workingDirectory.PathTo(location), lines);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VerificationRequest.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class VerificationRequest\r\n {\r\n public VerifyMode verifyMode;\r\n public List selectiveVerifyModuleNames;\r\n\r\n public VerificationRequest()\r\n {\r\n this.verifyMode = VerifyMode.Verify;\r\n this.selectiveVerifyModuleNames = new List();\r\n }\r\n\r\n public enum VerifyMode\r\n {\r\n Verify,\r\n NoSymDiff,\r\n SelectiveVerify,\r\n NoVerify\r\n }\r\n\r\n public enum SymDiffMode\r\n {\r\n UseSymDiff,\r\n NoSymDiff\r\n }\r\n\r\n public bool isComplete()\r\n {\r\n return this.verifyMode == VerifyMode.Verify;\r\n }\r\n\r\n public override string ToString()\r\n {\r\n if (this.verifyMode == VerifyMode.SelectiveVerify)\r\n {\r\n return this.verifyMode.ToString() + \"(\" + string.Join(\",\", this.selectiveVerifyModuleNames) + \")\";\r\n }\r\n else\r\n {\r\n return this.verifyMode.ToString();\r\n }\r\n }\r\n\r\n public SymDiffMode getSymDiffMode()\r\n {\r\n return this.verifyMode == VerifyMode.Verify ? SymDiffMode.UseSymDiff : SymDiffMode.NoSymDiff;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VerificationResult.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Text.RegularExpressions;\r\n using System.Xml;\r\n\r\n internal class VerificationResult\r\n{\r\n\tpublic const string _VERIFICATION_RESULT_PLACEHOLDER = \"_VERIFICATION_RESULT_PLACEHOLDER\";\r\n\r\n public const string _xml_tag = \"VerificationResult\";\r\n\r\n private const string _xml_sourcePath_attr = \"SourcePath\";\r\n private const string _xml_outcome_attr = \"Outcome\";\r\n private const string _xml_parseFailures_attr = \"ParseFailures\";\r\n private const string _xml_verificationFailures_attr = \"VerificationFailures\";\r\n private const string _xml_timeouts_attr = \"Timeouts\";\r\n private const string _xml_cputime_attr = \"CPUTime\";\r\n private const string _xml_message_tag = \"Message\";\r\n private const string _xml_message_sourcefile_attr = \"SourceFile\";\r\n\r\n private const string PASS = \"pass\";\r\n private const string FAIL = \"fail\";\r\n\r\n private static Regex whitespace = new Regex(\"^\\\\s*$\");\r\n\r\n private string _sourceLabel;\r\n private bool _pass;\r\n private double _cpuTime;\r\n private int _parseFailures;\r\n private int _verificationFailures;\r\n private int _timeouts;\r\n private List messages;\r\n private Presentation _presentation;\r\n\r\n public VerificationResult(string sourceLabel, double cpuTime, string stdout, string stderr, IVerificationResultParser parser)\r\n {\r\n this._sourceLabel = sourceLabel;\r\n this._cpuTime = cpuTime;\r\n this.messages = new List();\r\n\r\n // REVIEW: Switch from whitespace Regex to string.IsNullOrWhiteSpace()?\r\n if (!whitespace.Match(stdout).Success)\r\n {\r\n this.messages.Add(new VerificationMessage(sourceLabel, stdout));\r\n }\r\n\r\n if (!whitespace.Match(stderr).Success)\r\n {\r\n this.messages.Add(new VerificationMessage(sourceLabel, stderr));\r\n }\r\n\r\n this._parseFailures = 0;\r\n this._verificationFailures = 0;\r\n this._timeouts = 0;\r\n parser.parseOutput(stdout + stderr, out this._parseFailures, out this._verificationFailures, out this._timeouts);\r\n this._pass = this._parseFailures == 0 && this._verificationFailures == 0 && this._timeouts == 0;\r\n }\r\n\r\n public VerificationResult(string sourceLabel, bool pass, double cpuTime, int parseFailures, int verificationFailures, int timeouts, IEnumerable messages)\r\n {\r\n this._sourceLabel = sourceLabel;\r\n this._pass = pass;\r\n this._cpuTime = cpuTime;\r\n this._parseFailures = parseFailures;\r\n this._verificationFailures = verificationFailures;\r\n this._timeouts = timeouts;\r\n this.messages = new List(messages);\r\n }\r\n\r\n private VerificationResult()\r\n {\r\n }\r\n\r\n public string sourceLabel\r\n {\r\n get { return this._sourceLabel; }\r\n }\r\n\r\n public bool pass\r\n {\r\n get { return this._pass; }\r\n }\r\n\r\n public double cpuTime\r\n {\r\n get { return this._cpuTime; }\r\n }\r\n\r\n public int parseFailures\r\n {\r\n get { return this._parseFailures; }\r\n }\r\n\r\n public int verificationFailures\r\n {\r\n get { return this._verificationFailures; }\r\n }\r\n\r\n public int timeouts\r\n {\r\n get { return this._timeouts; }\r\n }\r\n\r\n public Presentation presentation\r\n {\r\n get { return this._presentation; }\r\n }\r\n\r\n public static VerificationResult fromXmlFile(BuildObject obj)\r\n {\r\n using (TextReader ins = BuildEngine.theEngine.Repository.OpenRead(obj))\r\n {\r\n XmlReader xr = XmlReader.Create(ins);\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n break;\r\n }\r\n }\r\n\r\n return readXml(xr);\r\n }\r\n }\r\n\r\n public static VerificationResult readXml(XmlReader xr)\r\n {\r\n Util.Assert(xr.Name.Equals(_xml_tag));\r\n VerificationResult rc = new VerificationResult();\r\n rc._sourceLabel = xr.GetAttribute(_xml_sourcePath_attr);\r\n string outcome = xr.GetAttribute(_xml_outcome_attr);\r\n if (outcome.Equals(PASS))\r\n {\r\n rc._pass = true;\r\n }\r\n else if (outcome.Equals(FAIL))\r\n {\r\n rc._pass = false;\r\n }\r\n else\r\n {\r\n throw new Exception(\"Invalid outcome value \" + outcome);\r\n }\r\n\r\n rc._cpuTime = Double.Parse(xr.GetAttribute(_xml_cputime_attr));\r\n rc._parseFailures = Int32.Parse(xr.GetAttribute(_xml_parseFailures_attr));\r\n rc._verificationFailures = Int32.Parse(xr.GetAttribute(_xml_verificationFailures_attr));\r\n rc._timeouts = Int32.Parse(xr.GetAttribute(_xml_timeouts_attr));\r\n rc.messages = new List();\r\n\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.EndElement)\r\n {\r\n Util.Assert(xr.Name.Equals(_xml_tag));\r\n break;\r\n }\r\n else if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n if (xr.Name.Equals(VerificationMessage._xml_tag))\r\n {\r\n rc.messages.Add(VerificationMessage.ReadXml(xr));\r\n }\r\n else if (xr.Name.Equals(Presentation._xml_tag))\r\n {\r\n rc._presentation = Presentation.fromXml(xr.ReadSubtree());\r\n }\r\n else\r\n {\r\n throw new Exception(\"Unknown xml tag \" + xr.Name);\r\n }\r\n }\r\n }\r\n\r\n return rc;\r\n }\r\n\r\n public IEnumerable getMessages()\r\n {\r\n return this.messages;\r\n }\r\n\r\n public void addXmlFiller(Presentation presentation)\r\n {\r\n this._presentation = presentation;\r\n }\r\n\r\n public void toXmlFile(string path)\r\n {\r\n File.Delete(path);\r\n using (FileStream s = File.OpenWrite(path))\r\n {\r\n XmlWriterSettings settings = new XmlWriterSettings();\r\n settings.Indent = true;\r\n XmlWriter xw = XmlWriter.Create(s, settings);\r\n xw.WriteStartDocument();\r\n this.writeXml(xw);\r\n xw.Close();\r\n }\r\n }\r\n\r\n public void writeXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(_xml_tag);\r\n xw.WriteAttributeString(_xml_sourcePath_attr, this._sourceLabel);\r\n xw.WriteAttributeString(_xml_outcome_attr, this._pass ? PASS : FAIL);\r\n xw.WriteAttributeString(_xml_cputime_attr, this._cpuTime.ToString());\r\n xw.WriteAttributeString(_xml_parseFailures_attr, this._parseFailures.ToString());\r\n xw.WriteAttributeString(_xml_verificationFailures_attr, this._verificationFailures.ToString());\r\n xw.WriteAttributeString(_xml_timeouts_attr, this._timeouts.ToString());\r\n foreach (VerificationMessage message in this.messages)\r\n {\r\n message.WriteXml(xw);\r\n }\r\n\r\n if (this._presentation != null)\r\n {\r\n this._presentation.fillXml(xw); // TODO we don't know yet how to parse this stuff back in.\r\n }\r\n\r\n xw.WriteEndElement();\r\n }\r\n\r\n public void addBasicPresentation()\r\n {\r\n PresentationBuilder pr = new PresentationBuilder();\r\n\r\n int any_failures = this.parseFailures + this.verificationFailures + this.timeouts;\r\n string overall_status = any_failures > 0 ? \"Fail\" : \"Success\";\r\n\r\n pr.pre(_VERIFICATION_RESULT_PLACEHOLDER+\"\\n\");\r\n pr.spacer();\r\n pr.startHeader();\r\n pr.color(any_failures == 0 ? Presentation.GREEN : Presentation.RED, \"Overall status: \" + overall_status);\r\n pr.endHeader();\r\n pr.line(\r\n string.Format(\r\n \"{0} parse failures, {1} verification failures, {2} timeouts\",\r\n this._parseFailures,\r\n this._verificationFailures,\r\n this._timeouts));\r\n pr.spacer();\r\n\r\n foreach (VerificationMessage message in this.messages)\r\n {\r\n pr.pre(message.Message);\r\n }\r\n\r\n Presentation pres = pr.fix();\r\n this.addXmlFiller(pres);\r\n }\r\n\r\n internal bool wasOnlyTimeouts()\r\n {\r\n return this.verificationFailures == 0 && this.timeouts > 0;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VerificationResultBoogieParser.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Text.RegularExpressions;\r\n\r\n internal class VerificationResultBoogieParser : IVerificationResultParser\r\n {\r\n private static Regex dispositionTimeoutsRegex = new Regex(\"Boogie program verifier finished with (\\\\d*) verified, (\\\\d*) errors*, (\\\\d) time outs*\");\r\n private static Regex dispositionNoTimeoutsRegex = new Regex(\"Boogie program verifier finished with (\\\\d*) verified, (\\\\d*) errors*\");\r\n private static Regex dispositionParseErrorRegex = new Regex(\"Error opening file\");\r\n private static Regex dispositionParseError2Regex = new Regex(\"(\\\\d*) parse errors detected in\");\r\n private static Regex dispositionParseError3Regex = new Regex(\"(\\\\d*) type checking errors detected in\");\r\n private static Regex dispositionParseError4Regex = new Regex(\"(\\\\d*) name resolution errors detected in\");\r\n private static Regex dispositionProverDiedRegex = new Regex(\"Prover error: Prover died\");\r\n\r\n public void parseOutput(string output, out int parseFailures, out int verificationFailures, out int timeouts)\r\n {\r\n parseFailures = 0;\r\n verificationFailures = 0;\r\n timeouts = 0;\r\n\r\n Match match = dispositionTimeoutsRegex.Match(output);\r\n if (match.Success)\r\n {\r\n ////int succeeding_methods = Int32.Parse(m.Groups[1].ToString());\r\n verificationFailures = Int32.Parse(match.Groups[2].ToString());\r\n timeouts = Int32.Parse(match.Groups[3].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionNoTimeoutsRegex.Match(output);\r\n if (match.Success)\r\n {\r\n ////int succeeding_methods = Int32.Parse(m.Groups[1].ToString());\r\n verificationFailures = Int32.Parse(match.Groups[2].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionParseErrorRegex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = 1;\r\n return;\r\n }\r\n\r\n match = dispositionParseError2Regex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = Int32.Parse(match.Groups[1].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionParseError3Regex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = Int32.Parse(match.Groups[1].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionParseError4Regex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = Int32.Parse(match.Groups[1].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionProverDiedRegex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = 1;\r\n return;\r\n }\r\n\r\n parseFailures = 1;\r\n ////throw new Exception(\"Unable to parse Dafny output\");\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VerificationResultDafnyParser.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Text.RegularExpressions;\r\n\r\n internal class VerificationResultDafnyParser : IVerificationResultParser\r\n {\r\n private static Regex dispositionTimeoutsRegex = new Regex(\"Dafny program verifier finished with (\\\\d*) verified, (\\\\d*) errors*, (\\\\d) time outs*\");\r\n private static Regex dispositionNoTimeoutsRegex = new Regex(\"Dafny program verifier finished with (\\\\d*) verified, (\\\\d*) errors*\");\r\n private static Regex dispositionParseErrorRegex = new Regex(\"Error opening file\");\r\n private static Regex dispositionParseError2Regex = new Regex(\"(\\\\d*) parse errors detected in\");\r\n private static Regex dispositionParseError3Regex = new Regex(\"(\\\\d*) resolution/type errors detected in\");\r\n private static Regex dispositionProverDiedRegex = new Regex(\"Prover error: Prover died\");\r\n\r\n public void parseOutput(string output, out int parseFailures, out int verificationFailures, out int timeouts)\r\n {\r\n parseFailures = 0;\r\n verificationFailures = 0;\r\n timeouts = 0;\r\n\r\n Match match = dispositionTimeoutsRegex.Match(output);\r\n if (match.Success)\r\n {\r\n ////int succeeding_methods = Int32.Parse(m.Groups[1].ToString());\r\n verificationFailures = Int32.Parse(match.Groups[2].ToString());\r\n timeouts = Int32.Parse(match.Groups[3].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionNoTimeoutsRegex.Match(output);\r\n if (match.Success)\r\n {\r\n ////int succeeding_methods = Int32.Parse(m.Groups[1].ToString());\r\n verificationFailures = Int32.Parse(match.Groups[2].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionParseErrorRegex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = 1;\r\n return;\r\n }\r\n\r\n match = dispositionParseError2Regex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = Int32.Parse(match.Groups[1].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionParseError3Regex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = Int32.Parse(match.Groups[1].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionProverDiedRegex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = 1;\r\n return;\r\n }\r\n\r\n parseFailures = 1;\r\n Logger.WriteLine(\"NuBuild WARNING: unexpected Dafny error message; lumping into parse errors.\");\r\n ////throw new Exception(\"Unable to parse Dafny output\");\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VerificationResultSummaryVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\n internal class VerificationResultSummaryVerb\r\n : VerificationResultVerb ////, IObligationsProducer\r\n {\r\n private const string SUMMARY_EXTN = \".summary\";\r\n private const int version = 4;\r\n\r\n private BuildObject outputObject;\r\n private IObligationsProducer producer;\r\n private IEnumerable verificationResults;\r\n private AbstractId abstractId;\r\n\r\n public VerificationResultSummaryVerb(IObligationsProducer producer) \r\n {\r\n this.producer = producer;\r\n BuildObject id = producer.getObligationSet(); ////producer.getIdentifier();\r\n this.outputObject = id.makeOutputObject(id.getExtension() + SUMMARY_EXTN);\r\n this.abstractId = new AbstractId(this.GetType().Name, version, id.ToString());\r\n this.verificationResults = null;\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n BuildObject obligations = this.producer.getObligationSet();\r\n HashSet deps = new HashSet();\r\n deps.Add(obligations);\r\n\r\n try\r\n {\r\n VerificationObligationList vol = VerificationObligationList.fetch(obligations);\r\n this.verificationResults = vol.getVerificationObligations();\r\n deps.UnionWith(this.verificationResults);\r\n ddisp = DependencyDisposition.Complete;\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n ddisp = DependencyDisposition.Incomplete;\r\n }\r\n catch (ObjectFailedException)\r\n {\r\n ddisp = DependencyDisposition.Failed;\r\n }\r\n\r\n return deps;\r\n }\r\n\r\n public override IEnumerable getVerbs() \r\n {\r\n IEnumerable verbs = new IVerb[] { this.producer };\r\n\r\n verbs = verbs.Union(this.producer.getVerbs());\r\n return verbs;\r\n\r\n // VerificationResultSummaryVerb depends on objects mentioned by producer,\r\n // but the necessary verbs haven't been mentioned. Is it sufficient for\r\n // the upstream guy (BoogieAsmVerificationObligationList) to ... hopefully ...\r\n // mention them? (Hopefully because he might only be incompletely queried,\r\n // since he's not actually dependent on the verbs he's advertising.)\r\n // Maybe we should provide a way for his complete() method to push the\r\n // verbs into the cache.\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new HashSet() { this.outputObject };\r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n return this.outputObject;\r\n }\r\n\r\n public BuildObject getObligationSet()\r\n {\r\n return this.producer.getObligationSet();\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // Read and aggregate all the input results.\r\n int parseFailures = 0;\r\n int verificationFailures = 0;\r\n int timeouts = 0;\r\n int filesWithParseFailures = 0;\r\n int filesWithVerificationFailures = 0;\r\n int filesWithTimeouts = 0;\r\n int passCount = 0;\r\n int failCount = 0;\r\n double cpuTime = 0;\r\n List failMessages = new List();\r\n List results = new List();\r\n\r\n // REVIEW: Why pull out the enumerator this way?\r\n IEnumerable verificationResultsEnumerator = this.verificationResults;\r\n foreach (BuildObject verificationResult in verificationResultsEnumerator)\r\n {\r\n VerificationResult vr = VerificationResult.fromXmlFile(verificationResult);\r\n results.Add(vr);\r\n if (vr == null)\r\n {\r\n return new VerbSyncWorker(\r\n workingDirectory,\r\n new Failed(\"Build system broke: missing VerificationResult for \" + verificationResult));\r\n }\r\n\r\n if (vr.pass)\r\n {\r\n passCount += 1;\r\n }\r\n else\r\n {\r\n failCount += 1;\r\n failMessages.AddRange(vr.getMessages());\r\n }\r\n\r\n parseFailures += vr.parseFailures;\r\n verificationFailures += vr.verificationFailures;\r\n timeouts += vr.timeouts;\r\n filesWithParseFailures += vr.parseFailures > 0 ? 1 : 0;\r\n filesWithVerificationFailures += vr.verificationFailures > 0 ? 1 : 0;\r\n filesWithTimeouts += vr.timeouts > 0 ? 1 : 0;\r\n ////Logger.WriteLine(\"Synthesizing cpuTime from \" + verificationResult);\r\n cpuTime += vr.cpuTime;\r\n }\r\n\r\n bool allPass = failCount == 0;\r\n\r\n PresentationBuilder pr = new PresentationBuilder();\r\n\r\n int any_failures = parseFailures + verificationFailures + timeouts;\r\n string overall_status = any_failures > 0 ? \"Fail\" : \"Success\";\r\n\r\n pr.pre(VerificationResult._VERIFICATION_RESULT_PLACEHOLDER+\"\\n\");\r\n pr.spacer();\r\n pr.startHeader();\r\n pr.color(this.colorByFailureCount(any_failures), \"Overall status: \" + overall_status);\r\n pr.endHeader();\r\n pr.line(\"Count of files with failures: \" + failCount);\r\n pr.startBullet();\r\n pr.color(this.colorByFailureCount(filesWithParseFailures), \"Files with parse failures: \" + filesWithParseFailures.ToString());\r\n pr.endBullet();\r\n pr.startBullet();\r\n pr.color(this.colorByFailureCount(filesWithVerificationFailures), \"Files with verification failures: \" + filesWithVerificationFailures.ToString());\r\n pr.endBullet();\r\n pr.startBullet();\r\n pr.color(this.colorByFailureCount(filesWithTimeouts), \"Files with timeouts: \" + filesWithTimeouts.ToString());\r\n pr.endBullet();\r\n\r\n pr.spacer();\r\n pr.header(string.Format(\"Total processing time: {0:0.0}s {1}\", cpuTime, new TimeSpan((long)(cpuTime * 10000000L))));\r\n int top_n = 10;\r\n pr.header(string.Format(\"Slowest {0} verifications:\", top_n));\r\n\r\n results.Sort(this.ByCpuTimeDecreasing);\r\n foreach (VerificationResult slowResult in results.Take(top_n))\r\n {\r\n pr.startBullet();\r\n pr.color(\r\n this.colorByFailureCount(slowResult.pass ? 0 : 1),\r\n string.Format(\"{0,6:##0.0}s {1}\", slowResult.cpuTime, slowResult.sourceLabel));\r\n pr.endBullet();\r\n }\r\n\r\n foreach (VerificationMessage message in failMessages)\r\n {\r\n pr.spacer();\r\n pr.header(\"Failure with \" + message.SourceLabel);\r\n pr.pre(message.Message);\r\n }\r\n\r\n Presentation pres = pr.fix();\r\n\r\n VerificationResult outvr = new VerificationResult(\"summary\", allPass, cpuTime, parseFailures, verificationFailures, timeouts, failMessages);\r\n outvr.addXmlFiller(pres);\r\n outvr.toXmlFile(workingDirectory.PathTo(this.outputObject));\r\n this.setWasRejectableFailure(!outvr.pass);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n \r\n public override Presentation getRealtimePresentation(Disposition d)\r\n {\r\n if (d is Failed)\r\n {\r\n return base.getRealtimePresentation(d);\r\n }\r\n\r\n VerificationResult vr = VerificationResult.fromXmlFile(this.outputObject);\r\n PresentationBuilder pr = new PresentationBuilder();\r\n pr.startLine();\r\n pr.color(\r\n vr.pass ? Presentation.GREEN : Presentation.RED,\r\n string.Format(\r\n \"{0} {1} {2,1:0.0}s\",\r\n this.getAbstractIdentifier(),\r\n vr.pass ? \"Success\" : \"Fail\",\r\n vr.cpuTime));\r\n pr.endLine();\r\n if (!vr.pass)\r\n {\r\n foreach (VerificationMessage msg in vr.getMessages())\r\n {\r\n pr.pre(msg.Message);\r\n }\r\n }\r\n\r\n return pr.fix();\r\n } \r\n\r\n public override Presentation getPresentation()\r\n {\r\n VerificationResult vr = VerificationResult.fromXmlFile(this.outputObject);\r\n return vr.presentation;\r\n }\r\n\r\n protected override BuildObject getSource()\r\n {\r\n return this.producer.getObligationSet();\r\n }\r\n\r\n private int ByCpuTimeDecreasing(VerificationResult va, VerificationResult vb)\r\n {\r\n return -(va.cpuTime.CompareTo(vb.cpuTime));\r\n }\r\n\r\n private string colorByFailureCount(int count)\r\n {\r\n return count == 0 ? Presentation.GREEN : Presentation.RED;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VerificationResultVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal abstract class VerificationResultVerb\r\n : Verb, IRejectable\r\n {\r\n public const string VERIFICATION_RESULT_EXTN = \".v\";\r\n\r\n private bool dbgWasVerificationTimeoutRecorded;\r\n private bool wasRejectableFailure;\r\n\r\n public abstract BuildObject getOutputFile();\r\n\r\n public override Presentation getRealtimePresentation(Disposition d)\r\n {\r\n if (d is Failed)\r\n {\r\n return base.getRealtimePresentation(d);\r\n }\r\n\r\n VerificationResult vr = VerificationResult.fromXmlFile(this.getOutputFile());\r\n PresentationBuilder pr = new PresentationBuilder();\r\n pr.startLine();\r\n pr.color(\r\n vr.pass ? Presentation.GREEN : Presentation.RED,\r\n string.Format(\r\n \"{0} {1} {2,5:0.0}s\",\r\n ////getSource().getRelativePath(),\r\n this.getAbstractIdentifier(),\r\n vr.pass ? \"Success\" : \"Fail\",\r\n vr.cpuTime));\r\n pr.endLine();\r\n if (!vr.pass)\r\n {\r\n foreach (VerificationMessage msg in vr.getMessages())\r\n {\r\n pr.pre(msg.Message);\r\n }\r\n }\r\n\r\n return pr.fix();\r\n }\r\n\r\n public override Presentation getPresentation()\r\n {\r\n VerificationResult vr = VerificationResult.fromXmlFile(this.getOutputFile());\r\n return vr.presentation;\r\n }\r\n\r\n public bool resultWasRejectableFailure()\r\n {\r\n Util.Assert(this.dbgWasVerificationTimeoutRecorded);\r\n return this.wasRejectableFailure;\r\n }\r\n\r\n protected abstract BuildObject getSource();\r\n\r\n protected void setWasRejectableFailure(bool value)\r\n {\r\n this.dbgWasVerificationTimeoutRecorded = true;\r\n this.wasRejectableFailure = value;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VirtualBuildObject.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n /// \r\n /// Representation of a virtual BuildObject.\r\n /// A VirtualBuildObject is never actually stored in the filesystem;\r\n /// it is only materialized inside the process. It's used for results\r\n /// that are easy to compute, but which still need to be established\r\n /// in dependency order. Instances: transitive deps, contexts.\r\n /// \r\n internal class VirtualBuildObject\r\n : BuildObject\r\n {\r\n /// \r\n /// Initializes a new instance of the VirtualBuildObject class.\r\n /// \r\n /// Virtual path name of the object.\r\n public VirtualBuildObject(string inpath)\r\n : base(inpath)\r\n {\r\n Util.Assert(inpath.StartsWith(BuildEngine.theEngine.getVirtualRoot(), StringComparison.OrdinalIgnoreCase));\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/VirtualContents.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n /// \r\n /// This class is perfectly named; it contains nothing.\r\n /// Serves solely as a base class for other derived classes.\r\n /// \r\n internal class VirtualContents\r\n {\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/WaitIndex.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n /// \r\n /// Used by the Scheduler to track waiting verbs and their dependencies.\r\n /// \r\n internal class WaitIndex\r\n {\r\n private Dictionary waitingVerbs;\r\n private Dictionary> fwdDeps;\r\n\r\n public WaitIndex()\r\n {\r\n this.waitingVerbs = new Dictionary();\r\n this.fwdDeps = new Dictionary>();\r\n }\r\n\r\n public int Count()\r\n {\r\n return this.waitingVerbs.Count;\r\n }\r\n\r\n public void dbgDisplayIndex(Scheduler dbgScheduler)\r\n {\r\n List waitRecords = new List(this.waitingVerbs.Values);\r\n for (int i = 0; i < waitRecords.Count(); i++)\r\n {\r\n WaitRecord wr = waitRecords[i];\r\n List depNums = new List();\r\n List unknownDeps = new List();\r\n List unscheduledDeps = new List();\r\n foreach (BuildObject dep in wr.knownDeps)\r\n {\r\n IVerb depOnVerb = dbgScheduler.getParent(dep);\r\n if (depOnVerb == null)\r\n {\r\n unknownDeps.Add(dep);\r\n }\r\n else if (!this.waitingVerbs.ContainsKey(depOnVerb))\r\n {\r\n unscheduledDeps.Add(\r\n string.Format(\r\n \"{0} waiting on {1} {2}\",\r\n dep,\r\n depOnVerb,\r\n dbgScheduler.dbgGetVerbStatus(depOnVerb)));\r\n }\r\n else\r\n {\r\n WaitRecord depWr = this.waitingVerbs[depOnVerb];\r\n depNums.Add(waitRecords.IndexOf(depWr));\r\n }\r\n }\r\n\r\n Logger.WriteLine(\r\n string.Format(\r\n \"{0}. {1} waits on ({2}), {3} unknown, {4} unscheduled\",\r\n i,\r\n wr.verb,\r\n string.Join(\",\", depNums),\r\n unknownDeps.Count(),\r\n unscheduledDeps.Count()));\r\n\r\n this.dbgPreview(\"Unknown\", unknownDeps.Select(it => it.ToString()), 3);\r\n this.dbgPreview(\"Unscheduled\", unscheduledDeps, 20);\r\n }\r\n }\r\n\r\n internal void insert(IVerb verb, IEnumerable knownDeps)\r\n {\r\n // Insert one fwd pointer for each obj verb is already known to\r\n // depend upon. The fact that this verb is waiting implies that\r\n // one of these deps is stale here and needs built/fetched.\r\n WaitRecord waitRecord = new WaitRecord(verb, knownDeps);\r\n foreach (BuildObject dep in knownDeps)\r\n {\r\n if (!this.fwdDeps.ContainsKey(dep))\r\n {\r\n this.fwdDeps.Add(dep, new HashSet());\r\n }\r\n\r\n this.fwdDeps[dep].Add(waitRecord);\r\n }\r\n\r\n this.waitingVerbs.Add(verb, waitRecord);\r\n this.Say(\"sleeps \" + verb);\r\n }\r\n\r\n // Remove any verb with obj in its dependency set.\r\n internal IEnumerable awaken(BuildObject obj)\r\n {\r\n this.Say(\"awaken \" + obj);\r\n HashSet wokenRecords;\r\n HashSet result = new HashSet();\r\n if (this.fwdDeps.ContainsKey(obj))\r\n {\r\n wokenRecords = this.fwdDeps[obj];\r\n this.fwdDeps.Remove(obj);\r\n\r\n // Remove all the other index pointers for each removed verb.\r\n foreach (WaitRecord waitRecord in wokenRecords)\r\n {\r\n foreach (BuildObject dep in waitRecord.knownDeps)\r\n {\r\n if (this.fwdDeps.ContainsKey(dep))\r\n {\r\n this.fwdDeps[dep].Remove(waitRecord);\r\n }\r\n }\r\n\r\n result.Add(waitRecord.verb);\r\n this.waitingVerbs.Remove(waitRecord.verb);\r\n this.Say(\" wakes \" + waitRecord.verb);\r\n }\r\n }\r\n else\r\n {\r\n result = new HashSet();\r\n }\r\n\r\n return result;\r\n }\r\n\r\n internal bool isWaiting(IVerb verb)\r\n {\r\n return this.waitingVerbs.ContainsKey(verb);\r\n }\r\n\r\n private void dbgPreview(string s, IEnumerable items, int max)\r\n {\r\n int i = 0;\r\n foreach (string o in items)\r\n {\r\n Logger.WriteLine(\r\n string.Format(\r\n \" {0} {1}/{2} {3}\",\r\n s,\r\n i,\r\n items.Count(),\r\n o));\r\n i += 1;\r\n if (i == max)\r\n {\r\n break;\r\n }\r\n }\r\n }\r\n \r\n private void Say(string msg)\r\n {\r\n ////Logger.WriteLine(\"[wtidx] \" + msg);\r\n }\r\n\r\n private class WaitRecord\r\n {\r\n public IVerb verb;\r\n public IEnumerable knownDeps;\r\n\r\n public WaitRecord(IVerb verb, IEnumerable knownDeps)\r\n {\r\n this.verb = verb;\r\n this.knownDeps = knownDeps;\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/WinLinkerVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n internal class WinLinkerVerb : LinkerVerb\r\n {\r\n public const string WIN_APP_EXE_EXTN = \".winapp\";\r\n private const int version = 6;\r\n\r\n public WinLinkerVerb(MasmVerb masmVerb, bool isLoader) : base(masmVerb, isLoader)\r\n {\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // TODO: We shouldn't be using absolute paths to any of these things.\r\n // Change this to allow VS and SDKs to be installed anywhere.\r\n string linker = @\"C:\\Program Files (x86)\\Microsoft Visual Studio 12.0\\VC\\bin\\link.exe\";\r\n string vc_lib_dir = @\"C:\\Program Files (x86)\\Microsoft Visual Studio 12.0\\VC\\lib\";\r\n string sdk_dir = @\"C:\\Program Files (x86)\\Windows Kits\\8.1\\Lib\\winv6.3\\um\\x86\";\r\n string kernel_lib = @\"C:\\Program Files (x86)\\Windows Kits\\8.1\\Lib\\winv6.3\\um\\x86\\kernel32.Lib\";\r\n\r\n string standalone_support_lib = getStandaloneLib().getRelativePath();\r\n SourcePath zero1 = new SourcePath(\"tools\\\\scripts\\\\zero.obj\", SourcePath.SourceType.Tools);\r\n SourcePath zero2 = new SourcePath(\"tools\\\\scripts\\\\zero2.obj\", SourcePath.SourceType.Tools);\r\n\r\n // TODO: Fail more gracefully? Or better yet, move these into iron/tools.\r\n if (!Directory.Exists(vc_lib_dir))\r\n {\r\n throw new FileNotFoundException(\"Missing Visual C++ library directory: \" + vc_lib_dir);\r\n }\r\n\r\n if (!Directory.Exists(sdk_dir) || !File.Exists(kernel_lib))\r\n {\r\n throw new FileNotFoundException(\"Missing Windows SDK libraries: \" + sdk_dir + \", \" + kernel_lib + @\". Try installing the Windows SDK from: \\\\research\\Root\\Products\\Developers\\Windows Driver Kit 8.1\");\r\n }\r\n\r\n // TODO: Unpack/generate these automatically.\r\n // TODO: Brian, we're really not going to want to cache these big, empty sources. Or compress? All big (>10MB) files.\r\n // are mostly zeros.\r\n if (!File.Exists(IronRootDirectory.PathTo(zero1)) || !File.Exists(IronRootDirectory.PathTo(zero2)))\r\n {\r\n throw new FileNotFoundException(\"Missing object files of zeroes: \" + zero1 + \", \" + zero2 + \". Try running: tools\\\\scripts\\\\build-standalone-init.sh\");\r\n }\r\n\r\n List args = new List() { \"/DEBUG\", \"/subsystem:console\", \"/LARGEADDRESSAWARE\", \"/fixed\" };\r\n args.Add(objFile.getRelativePath());\r\n args.Add(zero1.getRelativePath());\r\n args.Add(zero2.getRelativePath());\r\n args.Add(standalone_support_lib);\r\n args.Add(@\"\"\"\" + kernel_lib + @\"\"\"\");\r\n args.Add(\"\\\"/libpath:\" + vc_lib_dir + '\"');\r\n args.Add(\"\\\"/libpath:\" + sdk_dir + '\"');\r\n args.Add(\"/out:\" + outputObject.getRelativePath());\r\n args.Add(\"/entry:\" + this.entryPoint);\r\n args.Add(\"/base:\" + this.baseAddr);\r\n args.Add(\"/PDB:\" + this.getPdb());\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n linker,\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n getDiagnosticsBase(),\r\n allowAbsoluteExe: true,\r\n allowAbsoluteArgs: true);\r\n }\r\n\r\n public override Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n // No cleanup to do.\r\n return disposition;\r\n }\r\n\r\n // TODO: We should build this!\r\n protected static SourcePath getStandaloneLib()\r\n {\r\n return new SourcePath(\"tools\\\\standalone\\\\Debug\\\\StandAloneSupport.lib\", SourcePath.SourceType.Tools);\r\n }\r\n\r\n protected override IEnumerable getExtraOutputs()\r\n {\r\n List outputs = new List();\r\n outputs.Add(this.getPdb());\r\n return outputs;\r\n }\r\n\r\n protected override string outputExtension()\r\n {\r\n return WIN_APP_EXE_EXTN + LinkerVerb.UNTRUSTED_EXE_EXTN;\r\n }\r\n\r\n protected override int getVersion()\r\n {\r\n return version;\r\n }\r\n\r\n protected override IEnumerable getExtraDependencies()\r\n {\r\n return new List() { getStandaloneLib() };\r\n }\r\n\r\n private BuildObject getPdb()\r\n {\r\n return objFile.makeOutputObject(\".pdb\");\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/WorkingDirectory.cs", "content": "//--\n// \n// Copyright (c) Microsoft Corporation. All rights reserved.\n// \n//--\n\nnamespace NuBuild\n{\n using System;\n using System.Collections.Generic;\n using System.IO;\n\n /// \n /// A directory tree in the local filesystem for a verb to operate upon.\n /// Verbs should not access files outside of this directory tree.\n /// \n public class WorkingDirectory\n {\n /// \n /// Absolute path to this working directory on the local system.\n /// \n private string path;\n\n /// \n /// Initializes a new instance of the WorkingDirectory class.\n /// \n /// \n /// Absolute path to the \"iron\" directory on the local system.\n /// \n public WorkingDirectory(string ironroot)\n {\n // REVIEW: Have \"nutemp\" hard-wired here, or passed in?\n this.path = Path.Combine(ironroot, \"nutemp\", Path.GetRandomFileName());\n Directory.CreateDirectory(this.path);\n }\n\n /// \n /// Gets the absolute path to the root of this working directory on the local system.\n /// \n public string Root\n {\n get { return this.path; }\n }\n\n /// \n /// Gets the absolute path to the given build object in this working directory.\n /// \n /// A build object.\n /// The absolute path to the build object.\n public string PathTo(BuildObject obj)\n {\n return Path.Combine(this.path, obj.getRelativePath());\n }\n\n /// \n /// Gets the absolute path corresponding to the given relative path in this working directory.\n /// \n /// Relative path to convert.\n /// The absolute path corresponding to the given relative path.\n public string PathTo(string relativePath)\n {\n return Path.Combine(this.path, relativePath);\n }\n\n /// \n /// Creates the directory in the local filesystem that corresponds\n /// to this instance.\n /// \n /// A build object.\n public void CreateDirectoryFor(BuildObject obj)\n {\n Directory.CreateDirectory(Path.Combine(this.path, obj.getDirPath()));\n }\n\n /// \n /// Gets a collection of the build objects in this directory.\n /// \n /// \n /// REVIEW: Return a collection of BuildObjectValuePointers instead?\n /// \n /// A collection of build objects.\n public IEnumerable GetContents()\n {\n List contents = new List();\n\n foreach (string fileName in Directory.EnumerateFiles(this.path))\n {\n contents.Add(new BuildObject(fileName));\n }\n\n return contents;\n }\n }\n}\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild/XmlFiller.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Xml;\r\n\r\n /// \r\n /// REVIEW: Does this need to be an interface?\r\n /// TODO: Rename to IXmlFiller if we need to keep this.\r\n /// \r\n internal interface XmlFiller\r\n {\r\n void fillXml(XmlWriter xml);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuild.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 12.00\r\n# Visual Studio 2013\r\nVisualStudioVersion = 12.0.31101.0\r\nMinimumVisualStudioVersion = 10.0.40219.1\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"NuBuild\", \"NuBuild\\NuBuild.csproj\", \"{4D7220C0-3CAA-4659-9F16-A564DB3CCC1B}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"ItemCacheTool\", \"ItemCacheTool\\ItemCacheTool.csproj\", \"{9A231EB8-BDA1-4304-93A1-20457C00D7D9}\"\r\nEndProject\r\nProject(\"{2150E333-8FDC-42A3-9474-1A3956D46DE8}\") = \"Solution Items\", \"Solution Items\", \"{43E97C4F-FD2F-49AD-B29A-DEACC270D91B}\"\r\n\tProjectSection(SolutionItems) = preProject\r\n\t\tSettings.StyleCop = Settings.StyleCop\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"CloudExecutionEngine\", \"CloudExecutionEngine\\CloudExecutionEngine.csproj\", \"{2668E334-0B79-4023-A621-2D1433CE7C9E}\"\r\n\tProjectSection(ProjectDependencies) = postProject\r\n\t\t{4F3DE22C-CAE9-408B-AA54-10DCD7E12F09} = {4F3DE22C-CAE9-408B-AA54-10DCD7E12F09}\r\n\tEndProjectSection\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"CloudQueueTool\", \"CloudQueueTool\\CloudQueueTool.csproj\", \"{DD7B4AD9-1EB0-47BF-B4C2-5BC1CA85D242}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"AzureManager\", \"AzureManager\\AzureManager.csproj\", \"{8ADB4B14-715D-4CE1-BFD2-E7D65007CE5C}\"\r\nEndProject\r\nProject(\"{CC5FD16D-436D-48AD-A40C-5A424C6E3E79}\") = \"NuBuildExecutionService\", \"NuBuildExecutionService\\NuBuildExecutionService.ccproj\", \"{697EA8B8-1846-4628-AB27-066BEC899EC2}\"\r\nEndProject\r\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"CloudExecutionWorker\", \"CloudExecutionWorker\\CloudExecutionWorker.csproj\", \"{4F3DE22C-CAE9-408B-AA54-10DCD7E12F09}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDebug|Any CPU = Debug|Any CPU\r\n\t\tRelease|Any CPU = Release|Any CPU\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{4D7220C0-3CAA-4659-9F16-A564DB3CCC1B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{4D7220C0-3CAA-4659-9F16-A564DB3CCC1B}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{4D7220C0-3CAA-4659-9F16-A564DB3CCC1B}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{4D7220C0-3CAA-4659-9F16-A564DB3CCC1B}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{9A231EB8-BDA1-4304-93A1-20457C00D7D9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{9A231EB8-BDA1-4304-93A1-20457C00D7D9}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{9A231EB8-BDA1-4304-93A1-20457C00D7D9}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{9A231EB8-BDA1-4304-93A1-20457C00D7D9}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{2668E334-0B79-4023-A621-2D1433CE7C9E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{2668E334-0B79-4023-A621-2D1433CE7C9E}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{2668E334-0B79-4023-A621-2D1433CE7C9E}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{2668E334-0B79-4023-A621-2D1433CE7C9E}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{DD7B4AD9-1EB0-47BF-B4C2-5BC1CA85D242}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{DD7B4AD9-1EB0-47BF-B4C2-5BC1CA85D242}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{DD7B4AD9-1EB0-47BF-B4C2-5BC1CA85D242}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{DD7B4AD9-1EB0-47BF-B4C2-5BC1CA85D242}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{8ADB4B14-715D-4CE1-BFD2-E7D65007CE5C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{8ADB4B14-715D-4CE1-BFD2-E7D65007CE5C}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{8ADB4B14-715D-4CE1-BFD2-E7D65007CE5C}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{8ADB4B14-715D-4CE1-BFD2-E7D65007CE5C}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{697EA8B8-1846-4628-AB27-066BEC899EC2}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{697EA8B8-1846-4628-AB27-066BEC899EC2}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{697EA8B8-1846-4628-AB27-066BEC899EC2}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{697EA8B8-1846-4628-AB27-066BEC899EC2}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\t\t{4F3DE22C-CAE9-408B-AA54-10DCD7E12F09}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\r\n\t\t{4F3DE22C-CAE9-408B-AA54-10DCD7E12F09}.Debug|Any CPU.Build.0 = Debug|Any CPU\r\n\t\t{4F3DE22C-CAE9-408B-AA54-10DCD7E12F09}.Release|Any CPU.ActiveCfg = Release|Any CPU\r\n\t\t{4F3DE22C-CAE9-408B-AA54-10DCD7E12F09}.Release|Any CPU.Build.0 = Release|Any CPU\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuildExecutionService/.gitignore", "content": "*.ccproj.user\n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuildExecutionService/CloudExecutionWorkerContent/diagnostics.wadcfg", "content": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuildExecutionService/NuBuildExecutionService.ccproj", "content": "\n\n \n \n Debug\n AnyCPU\n 2.5\n 697ea8b8-1846-4628-ab27-066bec899ec2\n Library\n Properties\n NuBuildExecutionService\n NuBuildExecutionService\n False\n NuBuildExecutionService\n True\n False\n \n \n true\n full\n false\n bin\\Debug\\\n DEBUG;TRACE\n prompt\n 4\n \n \n pdbonly\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n \n \n \n \n \n \n CloudExecutionWorker\n {4f3de22c-cae9-408b-aa54-10dcd7e12f09}\n True\n Worker\n CloudExecutionWorker\n True\n \n \n \n \n \n \n \n Content\n \n \n \n \n 10.0\n $(MSBuildExtensionsPath)\\Microsoft\\VisualStudio\\v$(VisualStudioVersion)\\Windows Azure Tools\\2.5\\\n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuildExecutionService/ServiceConfiguration.Cloud.cscfg", "content": "\n\n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuildExecutionService/ServiceConfiguration.Local.cscfg", "content": "\n\n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/NuBuildExecutionService/ServiceDefinition.csdef", "content": "\n\n \n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild/References/Microsoft.Threading.Tasks.xml", "content": "\n\n \n Microsoft.Threading.Tasks\n \n \n \n \n Provides extension methods for threading-related types.\n \n \n \n Cancels the after the specified duration.\n The CancellationTokenSource.\n The due time in milliseconds for the source to be canceled.\n \n \n Cancels the after the specified duration.\n The CancellationTokenSource.\n The due time for the source to be canceled.\n \n \n Gets an awaiter used to await this .\n The task to await.\n An awaiter instance.\n \n \n Gets an awaiter used to await this .\n Specifies the type of data returned by the task.\n The task to await.\n An awaiter instance.\n \n \n Creates and configures an awaitable object for awaiting the specified task.\n The task to be awaited.\n \n true to automatic marshag back to the original call site's current SynchronizationContext\n or TaskScheduler; otherwise, false.\n \n The instance to be awaited.\n \n \n Creates and configures an awaitable object for awaiting the specified task.\n The task to be awaited.\n \n true to automatic marshag back to the original call site's current SynchronizationContext\n or TaskScheduler; otherwise, false.\n \n The instance to be awaited.\n \n \n Event handler for progress reports.\n Specifies the type of data for the progress report.\n The sender of the report.\n The reported value.\n \n \n \n Provides an IProgress{T} that invokes callbacks for each reported progress value.\n \n Specifies the type of the progress report value.\n \n Any handler provided to the constructor or event handlers registered with\n the event are invoked through a \n instance captured\n when the instance is constructed. If there is no current SynchronizationContext\n at the time of construction, the callbacks will be invoked on the ThreadPool.\n \n \n \n The synchronization context captured upon construction. This will never be null.\n \n \n The handler specified to the constructor. This may be null.\n \n \n A cached delegate used to post invocation to the synchronization context.\n \n \n Initializes the .\n \n \n Initializes the with the specified callback.\n \n A handler to invoke for each reported progress value. This handler will be invoked\n in addition to any delegates registered with the event.\n \n The is null (Nothing in Visual Basic).\n \n \n Reports a progress change.\n The value of the updated progress.\n \n \n Reports a progress change.\n The value of the updated progress.\n \n \n Invokes the action and event callbacks.\n The progress value.\n \n \n Raised for each reported progress value.\n \n Handlers registered with this event will be invoked on the \n captured when the instance was constructed.\n \n \n \n Holds static values for .\n This avoids one static instance per type T.\n \n \n A default synchronization context that targets the ThreadPool.\n \n \n Throws the exception on the ThreadPool.\n The exception to propagate.\n The target context on which to propagate the exception. Null to use the ThreadPool.\n \n \n Copies the exception's stack trace so its stack trace isn't overwritten.\n The exception to prepare.\n \n \n Provides an awaitable object that allows for configured awaits on .\n This type is intended for compiler use only.\n \n \n The task being awaited.\n \n \n Initializes the .\n The awaitable .\n \n true to attempt to marshal the continuation back to the original context captured; otherwise, false.\n \n \n \n Gets an awaiter for this awaitable.\n The awaiter.\n \n \n Provides an awaiter for a .\n This type is intended for compiler use only.\n \n \n The task being awaited.\n \n \n Whether to attempt marshaling back to the original context.\n \n \n Initializes the .\n The to await.\n \n true to attempt to marshal the continuation back to the original context captured\n when BeginAwait is called; otherwise, false.\n \n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Ends the await on the completed .\n The result of the completed .\n The awaiter was not properly initialized.\n The task was not yet completed.\n The task was canceled.\n The task completed in a Faulted state.\n \n \n Gets whether the task being awaited is completed.\n This property is intended for compiler user rather than use directly in code.\n The awaiter was not properly initialized.\n \n \n Provides an awaitable object that allows for configured awaits on .\n This type is intended for compiler use only.\n \n \n The underlying awaitable on whose logic this awaitable relies.\n \n \n Initializes the .\n The awaitable .\n \n true to attempt to marshal the continuation back to the original context captured; otherwise, false.\n \n \n \n Gets an awaiter for this awaitable.\n The awaiter.\n \n \n Provides an awaiter for a .\n This type is intended for compiler use only.\n \n \n The task being awaited.\n \n \n Whether to attempt marshaling back to the original context.\n \n \n Initializes the .\n The awaitable .\n \n true to attempt to marshal the continuation back to the original context captured; otherwise, false.\n \n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Ends the await on the completed .\n The result of the completed .\n The awaiter was not properly initialized.\n The task was not yet completed.\n The task was canceled.\n The task completed in a Faulted state.\n \n \n Gets whether the task being awaited is completed.\n This property is intended for compiler user rather than use directly in code.\n The awaiter was not properly initialized.\n \n \n Provides an awaiter for awaiting a .\n This type is intended for compiler use only.\n \n \n The default value to use for continueOnCapturedContext.\n \n \n Error message for GetAwaiter.\n \n \n The task being awaited.\n \n \n Initializes the .\n The to be awaited.\n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Ends the await on the completed .\n The awaiter was not properly initialized.\n The task was not yet completed.\n The task was canceled.\n The task completed in a Faulted state.\n \n \n \n Fast checks for the end of an await operation to determine whether more needs to be done\n prior to completing the await.\n \n The awaited task.\n \n \n Handles validations on tasks that aren't successfully completed.\n The awaited task.\n \n \n Throws an exception to handle a task that completed in a state other than RanToCompletion.\n \n \n Schedules the continuation onto the associated with this .\n The awaited task.\n The action to invoke when the await operation completes.\n Whether to capture and marshal back to the current context.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Invokes the delegate in a try/catch that will propagate the exception asynchronously on the ThreadPool.\n \n \n \n Copies the exception's stack trace so its stack trace isn't overwritten.\n The exception to prepare.\n \n \n Gets whether the task being awaited is completed.\n This property is intended for compiler user rather than use directly in code.\n The awaiter was not properly initialized.\n \n \n Whether the current thread is appropriate for inlining the await continuation.\n \n \n Provides an awaiter for awaiting a .\n This type is intended for compiler use only.\n \n \n The task being awaited.\n \n \n Initializes the .\n The to be awaited.\n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Ends the await on the completed .\n The result of the completed .\n The awaiter was not properly initialized.\n The task was not yet completed.\n The task was canceled.\n The task completed in a Faulted state.\n \n \n Gets whether the task being awaited is completed.\n This property is intended for compiler user rather than use directly in code.\n The awaiter was not properly initialized.\n \n \n Provides an awaitable context for switching into a target environment.\n This type is intended for compiler use only.\n \n \n Gets an awaiter for this .\n An awaiter for this awaitable.\n This method is intended for compiler user rather than use directly in code.\n \n \n Provides an awaiter that switches into a target environment.\n This type is intended for compiler use only.\n \n \n A completed task.\n \n \n Posts the back to the current context.\n The action to invoke asynchronously.\n The awaiter was not properly initialized.\n \n \n Posts the back to the current context.\n The action to invoke asynchronously.\n The awaiter was not properly initialized.\n \n \n Ends the await operation.\n \n \n Gets whether a yield is not required.\n This property is intended for compiler user rather than use directly in code.\n \n \n Provides methods for creating and manipulating tasks.\n \n \n Creates a task that runs the specified action.\n The action to execute asynchronously.\n A task that represents the completion of the action.\n The argument is null.\n \n \n Creates a task that runs the specified action.\n The action to execute.\n The CancellationToken to use to request cancellation of this task.\n A task that represents the completion of the action.\n The argument is null.\n \n \n Creates a task that runs the specified function.\n The function to execute asynchronously.\n A task that represents the completion of the action.\n The argument is null.\n \n \n Creates a task that runs the specified function.\n The action to execute.\n The CancellationToken to use to cancel the task.\n A task that represents the completion of the action.\n The argument is null.\n \n \n Creates a task that runs the specified function.\n The action to execute asynchronously.\n A task that represents the completion of the action.\n The argument is null.\n \n \n Creates a task that runs the specified function.\n The function to execute.\n The CancellationToken to use to request cancellation of this task.\n A task that represents the completion of the function.\n The argument is null.\n \n \n Creates a task that runs the specified function.\n The function to execute asynchronously.\n A task that represents the completion of the action.\n The argument is null.\n \n \n Creates a task that runs the specified function.\n The action to execute.\n The CancellationToken to use to cancel the task.\n A task that represents the completion of the action.\n The argument is null.\n \n \n Starts a Task that will complete after the specified due time.\n The delay in milliseconds before the returned task completes.\n The timed Task.\n \n The argument must be non-negative or -1 and less than or equal to Int32.MaxValue.\n \n \n \n Starts a Task that will complete after the specified due time.\n The delay before the returned task completes.\n The timed Task.\n \n The argument must be non-negative or -1 and less than or equal to Int32.MaxValue.\n \n \n \n Starts a Task that will complete after the specified due time.\n The delay before the returned task completes.\n A CancellationToken that may be used to cancel the task before the due time occurs.\n The timed Task.\n \n The argument must be non-negative or -1 and less than or equal to Int32.MaxValue.\n \n \n \n Starts a Task that will complete after the specified due time.\n The delay in milliseconds before the returned task completes.\n A CancellationToken that may be used to cancel the task before the due time occurs.\n The timed Task.\n \n The argument must be non-negative or -1 and less than or equal to Int32.MaxValue.\n \n \n \n An already completed task.\n \n \n Creates a Task that will complete only when all of the provided collection of Tasks has completed.\n The Tasks to monitor for completion.\n A Task that represents the completion of all of the provided tasks.\n \n If any of the provided Tasks faults, the returned Task will also fault, and its Exception will contain information\n about all of the faulted tasks. If no Tasks fault but one or more Tasks is canceled, the returned\n Task will also be canceled.\n \n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete only when all of the provided collection of Tasks has completed.\n The Tasks to monitor for completion.\n A Task that represents the completion of all of the provided tasks.\n \n If any of the provided Tasks faults, the returned Task will also fault, and its Exception will contain information\n about all of the faulted tasks. If no Tasks fault but one or more Tasks is canceled, the returned\n Task will also be canceled.\n \n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete only when all of the provided collection of Tasks has completed.\n The Tasks to monitor for completion.\n A Task that represents the completion of all of the provided tasks.\n \n If any of the provided Tasks faults, the returned Task will also fault, and its Exception will contain information\n about all of the faulted tasks. If no Tasks fault but one or more Tasks is canceled, the returned\n Task will also be canceled.\n \n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete only when all of the provided collection of Tasks has completed.\n The Tasks to monitor for completion.\n A Task that represents the completion of all of the provided tasks.\n \n If any of the provided Tasks faults, the returned Task will also fault, and its Exception will contain information\n about all of the faulted tasks. If no Tasks fault but one or more Tasks is canceled, the returned\n Task will also be canceled.\n \n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete only when all of the provided collection of Tasks has completed.\n The Tasks to monitor for completion.\n \n A callback invoked when all of the tasks complete successfully in the RanToCompletion state.\n This callback is responsible for storing the results into the TaskCompletionSource.\n \n A Task that represents the completion of all of the provided tasks.\n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete when any of the tasks in the provided collection completes.\n The Tasks to be monitored.\n \n A Task that represents the completion of any of the provided Tasks. The completed Task is this Task's result.\n \n Any Tasks that fault will need to have their exceptions observed elsewhere.\n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete when any of the tasks in the provided collection completes.\n The Tasks to be monitored.\n \n A Task that represents the completion of any of the provided Tasks. The completed Task is this Task's result.\n \n Any Tasks that fault will need to have their exceptions observed elsewhere.\n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete when any of the tasks in the provided collection completes.\n The Tasks to be monitored.\n \n A Task that represents the completion of any of the provided Tasks. The completed Task is this Task's result.\n \n Any Tasks that fault will need to have their exceptions observed elsewhere.\n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete when any of the tasks in the provided collection completes.\n The Tasks to be monitored.\n \n A Task that represents the completion of any of the provided Tasks. The completed Task is this Task's result.\n \n Any Tasks that fault will need to have their exceptions observed elsewhere.\n The argument is null.\n The argument contains a null reference.\n \n \n Creates an already completed from the specified result.\n The result from which to create the completed task.\n The completed task.\n \n \n Creates an awaitable that asynchronously yields back to the current context when awaited.\n \n A context that, when awaited, will asynchronously transition back into the current context.\n If SynchronizationContext.Current is non-null, that is treated as the current context.\n Otherwise, TaskScheduler.Current is treated as the current context.\n \n \n \n Adds the target exception to the list, initializing the list if it's null.\n The list to which to add the exception and initialize if the list is null.\n The exception to add, and unwrap if it's an aggregate.\n \n \n Returns a canceled task.\n The cancellation token.\n The canceled task.\n \n \n Returns a canceled task.\n Specifies the type of the result.\n The cancellation token.\n The canceled task.\n \n \n \n Completes the Task if the user state matches the TaskCompletionSource.\n \n Specifies the type of data returned by the Task.\n The TaskCompletionSource.\n The completion event arguments.\n Whether we require the tcs to match the e.UserState.\n A function that gets the result with which to complete the task.\n An action used to unregister work when the operaiton completes.\n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild/References/Microsoft.WindowsAzure.Common.NetFramework.xml", "content": "\n\n \n Microsoft.WindowsAzure.Common.NetFramework\n \n \n \n \n Credentials using a management certificate to authorize requests.\n \n \n \n \n Initializes a new instance of the CertificateCloudCredentials\n class.\n \n The Subscription ID.\n \n The management certificate.\n \n \n \n \n Attempt to create certificate credentials from a collection of\n settings.\n \n The settings to use.\n \n CertificateCloudCredentials is created, null otherwise.\n \n \n \n \n Initialize a ServiceClient instance to process credentials.\n \n Type of ServiceClient.\n The ServiceClient.\n \n This will add a certificate to the shared root WebRequestHandler in\n the ServiceClient's HttpClient handler pipeline.\n \n \n \n \n Apply the credentials to the HTTP request.\n \n The HTTP request.\n Cancellation token.\n \n Task that will complete when processing has completed.\n \n \n \n \n Gets subscription ID which uniquely identifies Windows Azure \n subscription. The subscription ID forms part of the URI for \n every call that you make to the Service Management API.\n \n \n \n \n The Windows Azure Service Management API use mutual authentication\n of management certificates over SSL to ensure that a request made\n to the service is secure. No anonymous requests are allowed.\n \n \n \n \n Cloud credentials provider for .NET Framework clients.\n \n \n \n \n Creates a new credentials instance if the appropriate settings for\n this provider are present and valid.\n \n Dictionary of configuration settings.\n Returns a new instance if the provider supports the\n provided settings.\n \n \n \n Computes SHA256 hash from key and data using HMACSHA256.\n \n Key to use as hash salt.\n Data to hash.\n Hash value.\n \n \n \n Initializes the settings.\n \n \n \n \n Checks whether the given exception represents an exception throws\n for a missing setting.\n \n Exception\n True for the missing setting exception.\n \n \n \n Gets a setting with the given name.\n \n Setting name.\n Setting value or null if such setting does not exist.\n \n \n \n Gets setting's value from the given provider.\n \n Provider name.\n Setting name\n Method to obtain given setting.\n Setting value, or null if not found.\n \n \n \n Gets a configuration setting from the service runtime.\n \n Setting name.\n Setting value or null if not found.\n \n \n \n Loads and returns the latest available version of the service \n runtime assembly.\n \n Loaded assembly, if any.\n \n \n \n Gets the setting defined in the Windows Azure configuration file.\n \n Setting name.\n Setting value.\n \n \n \n Gets an assembly path from the GAC given a partial name.\n \n An assembly partial name. May not be null.\n \n The assembly path if found; otherwise null;\n \n \n \n \n Registers cloud configuration providers with the common runtime\n that require the .NET framework.\n \n \n \n \n A strongly-typed resource class, for looking up localized strings, etc.\n \n \n \n \n Returns the cached ResourceManager instance used by this class.\n \n \n \n \n Overrides the current thread's CurrentUICulture property for all\n resource lookups using this strongly typed resource class.\n \n \n \n \n Looks up a localized string similar to {0} requires a {1} in its HTTP pipeline to work with client certificates..\n \n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild/References/Microsoft.WindowsAzure.Common.xml", "content": "\n\n \n Microsoft.WindowsAzure.Common\n \n \n \n \n Helper class used for deserialization of OLEDB Connection Strings.\n \n \n \n \n Defines an interface for setting parsers.\n \n \n \n \n Parses the setting.\n \n Setting to parse.\n Dictionary representation of the setting.\n \n \n \n Gets the setting name.\n \n \n \n \n Deserializes OLEDB Connection String.\n \n OLEDB Connection String.\n Dictionary representation of the Connection String.\n \n \n \n Gets the setting name.\n \n \n \n \n Class for token based credentials associated with a particular subscription.\n \n \n \n \n Base class for credentials associated with a particular subscription.\n \n \n \n \n The CloudCredentials class is the base class for providing credentials\n to access Windows Azure services.\n \n \n \n \n Initialize a ServiceClient instance to process credentials.\n \n Type of ServiceClient.\n The ServiceClient.\n \n \n \n Apply the credentials to the HTTP request.\n \n The HTTP request.\n Cancellation token.\n \n Task that will complete when processing has completed.\n \n \n \n \n Gets subscription ID which uniquely identifies Windows Azure \n subscription. The subscription ID forms part of the URI for \n every call that you make to the Service Management API.\n \n \n \n \n Gets an empty subscription Id.\n \n \n \n \n Class for token based credentials associated with a particular subscription.\n \n \n \n \n Initializes a new instance of the \n class with subscription ID.\n \n The Subscription ID.\n Valid JSON Web Token (JWT).\n \n \n \n Initializes a new instance of the \n class without subscription ID.\n \n Valid JSON Web Token (JWT).\n \n \n \n Attempt to create token credentials from a collection of\n settings.\n \n The settings to use.\n \n TokenCloudCredentials is created, null otherwise.\n \n \n \n \n Apply the credentials to the HTTP request.\n \n The HTTP request.\n Cancellation token.\n \n Task that will complete when processing has completed.\n \n \n \n \n Gets subscription ID which uniquely identifies Windows Azure \n subscription. The subscription ID forms part of the URI for \n every call that you make to the Service Management API.\n \n \n \n \n Gets or sets secure token used to authenticate against Windows Azure API. \n No anonymous requests are allowed.\n \n \n \n \n Representation of the error object from the server.\n \n \n \n \n Parsed error message.\n \n \n \n \n Parsed error code.\n \n \n \n \n Original error body\n \n \n \n \n Base class used to describe HTTP requests and responses associated with\n error conditions.\n \n \n \n \n Initializes a new instance of the CloudHttpErrorInfo class.\n \n \n \n \n Add the HTTP message headers to the error info.\n \n Collection of HTTP header.\n \n \n \n Gets or sets the contents of the HTTP message.\n \n \n \n \n Gets the collection of HTTP headers.\n \n \n \n \n Gets or sets the HTTP message version.\n \n \n \n \n Describes HTTP requests associated with error conditions.\n \n \n \n \n Initializes a new instance of the CloudHttpRequestErrorInfo class.\n \n \n \n \n Creates a new CloudHttpRequestErrorInfo from a HttpRequestMessage.\n \n The request message.\n A CloudHttpRequestErrorInfo instance.\n \n \n \n Creates a new CloudHttpRequestErrorInfo from a HttpRequestMessage.\n \n The request message.\n \n The request content, which may be passed separately if the request\n has already been disposed.\n \n A CloudHttpRequestErrorInfo instance.\n \n \n \n Gets or sets the HTTP method used by the HTTP request message.\n \n \n \n \n Gets or sets the Uri used for the HTTP request.\n \n \n \n \n Gets a set of properties for the HTTP request.\n \n \n \n \n Describes HTTP responses associated with error conditions.\n \n \n \n \n Initializes a new instance of the CloudHttpResponseErrorInfo class.\n \n \n \n \n Creates a new CloudHttpResponseErrorInfo from a HttpResponseMessage.\n \n The response message.\n A CloudHttpResponseErrorInfo instance.\n \n \n \n Creates a new CloudHttpResponseErrorInfo from a HttpResponseMessage.\n \n The response message.\n \n The response content, which may be passed separately if the\n response has already been disposed.\n \n A CloudHttpResponseErrorInfo instance.\n \n \n \n Gets or sets the status code of the HTTP response.\n \n \n \n \n Gets or sets the reason phrase which typically is sent by servers together\n with the status code.\n \n \n \n \n Provides cryptography functionality to libraries.\n \n \n \n \n Computes a Hash-based Message Authentication Code (HMAC) \n by using the SHA256 hash function.\n \n The key to use in the hash algorithm.\n The input to compute the hash code\n for.\n Returns the computed hash code.\n \n \n \n Extensions for manipulating HTTP requests and responses.\n \n \n \n \n Get the HTTP message content as a string.\n \n The HTTP content.\n The HTTP message content as a string.\n \n \n \n Get the content headers for an HTTP request.\n \n The request message.\n The content headers.\n \n \n \n Get the content headers for an HTTP response.\n \n The response message.\n The content headers.\n \n \n \n Get a standard string representation of an HTTP request.\n \n The request message.\n String representation of the request.\n \n \n \n Get a standard string representation of an HTTP request.\n \n The request message.\n String representation of the request.\n \n \n \n Append an HTTP request.\n \n The StringBuilder.\n The request message.\n \n \n \n Append an HTTP request.\n \n The StringBuilder.\n The request message.\n \n \n \n Append the components of an HTTP request.\n \n The StringBuilder.\n The request method.\n The request URI.\n The request HTTP version.\n The request headers.\n The request content headers.\n The request properties.\n The request content.\n \n \n \n Get a standard string representation of an HTTP response.\n \n The response message.\n String representation of the response.\n \n \n \n Get a standard string representation of an HTTP response.\n \n The response message.\n String representation of the response.\n \n \n \n Append an HTTP response.\n \n The StringBuilder.\n The response message.\n \n \n \n Append an HTTP response.\n \n The StringBuilder.\n The response message.\n \n \n \n Append the components of an HTTP response.\n \n The StringBuilder.\n The response status code.\n The response reason phrase.\n The response HTTP version.\n The response headers.\n The response content headers.\n The response content.\n \n \n \n Append HTTP headers.\n \n The StringBuilder.\n The HTTP headers.\n \n \n \n Helper class used for deserialization of JSON formatted Connection Strings.\n \n \n \n \n Deserializes JSON formatted Connection String.\n \n JSON formatted Connection String.\n Dictionary representation of the Connection String.\n \n \n \n Gets the setting name.\n \n \n \n \n Wrapper class for HttpMessageHandler that prevents InnerHandler from\n being disposed.\n \n \n \n \n Initializes a new instance of the class from HttpMessageHandler.\n \n InnerHandler to wrap.\n \n \n \n Overrides Dispose of the base class to prevent disposal of the InnerHandler.\n \n If set to true indicates the method is being called from Dispose().\n \n \n \n Parser helper.\n \n \n \n \n Checks if content is possibly an XML.\n \n String to check.\n If set to true will validate entire XML for validity \n otherwise will just check the first character.\n True is content is possibly an XML otherwise false.\n \n \n \n Checks if content is possibly a JSON.\n \n String to check.\n If set to true will validate entire JSON for validity \n otherwise will just check the first character.\n True is content is possibly an JSON otherwise false.\n \n \n \n Returns first non whitespace character\n \n Text to search in\n Non whitespace or default char\n \n \n \n Static type conversion utility methods.\n \n \n \n \n Converts an array of 8-bit unsigned integers to its equivalent \n string representation that is encoded with base-64 digits.\n \n An array of 8-bit unsigned integers.\n The string representation, in base 64, of the contents of \n value.\n \n \n \n Decodes all the bytes in the specified byte array into a string.\n \n The byte array containing the sequence of bytes \n to decode.\n A string that contains the results of decoding the \n specified sequence of bytes.\n \n \n \n Converts the specified string, which encodes binary data as base-64\n digits, to a UTF8-encoded string.\n \n The base 64-encoded string to convert.\n Returns a string.\n \n \n \n Uses Uri::TryCreate method to safely attempt to parse a \n string value and return its Uri representation. Supports\n relative Uris.\n \n The Uri string.\n Returns a new Uri instance or null.\n \n \n \n Convert a TimeSpan into an 8601 formatted string.\n \n The timespan to convert.\n The TimeSpan in 8601 format.\n \n \n \n Convert a string from ISO 8601 format to a TimeSpan instance.\n \n Value to parse.\n The resulting timespan.\n \n \n \n Concatenates parts of the Uri together ensuring that\n any duplicate '/' characters are removed.\n \n Parts of the Uri to be combined.\n Concatenated Uri\n \n \n \n A standard service response including an HTTP status code and request\n ID.\n \n \n \n \n Gets or sets the standard HTTP status code from the REST API \n operations for the Service Management API.\n \n \n \n \n Gets or sets the value that uniquely identifies a request \n made against the service.\n \n \n \n \n The status of the asynchronous request.\n \n \n \n \n The asynchronous request is in progress.\n \n \n \n \n The asynchronous request succeeded.\n \n \n \n \n The asynchronous request failed.\n \n \n \n \n The response body contains the status of the specified\n asynchronous operation, indicating whether it has succeeded, is i\n progress, or has failed. Note that this status is distinct from the\n HTTP status code returned for the Get Operation Status operation\n itself. If the asynchronous operation succeeded, the response body\n includes the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request, and also includes error\n information regarding the failure.\n \n \n \n \n If the asynchronous operation failed, the response body includes\n the HTTP status code for the failed request, and also includes\n error information regarding the failure.\n \n \n \n \n The HTTP status code for the asynchronous request.\n \n \n \n \n The request ID of the asynchronous request. This value is returned\n in the x-ms-request-id response header of the asynchronous request.\n \n \n \n \n The status of the asynchronous request.\n \n \n \n \n If the asynchronous operation failed, the response body includes\n the HTTP status code for the failed request, and also includes\n error information regarding the failure.\n \n \n \n \n Initializes a new instance of the ErrorDetails class.\n \n \n \n \n The management service error code returned if the asynchronous\n request failed.\n \n \n \n \n The management service error message returned if the\n asynchronous request failed.\n \n \n \n \n JSON formatter for PATCH syntax.\n \n Value to patch.\n \n \n \n Implicit operator that converts T to Patchable T.\n \n Object to convert.\n Converted object.\n \n \n \n Implicit operator that converts Patchable T to T.\n \n Object to convert.\n Converted object.\n \n \n \n Sets operation to SET and returns instance of the object.\n \n Value to patch.\n Instance of the object.\n \n \n \n Returns formatted PATCH script.\n \n Formatted PATCH script.\n \n \n \n Gets the patch value.\n \n \n \n \n Gets a value indicating whether the value is set.\n \n \n \n \n Parameter attribute used with OData filters.\n \n \n \n \n Initializes a new instance of the class.\n \n Property name to use in the filter.\n \n \n \n Initializes a new instance of the class.\n \n Property name to use in the filter.\n Format of the value.\n \n \n \n Property name to use in the filter.\n \n \n \n \n Format of the value.\n \n \n \n \n Handles OData filter generation.\n \n \n \n \n Generates an OData filter from a specified Linq expression.\n \n Filter type\n Entity to use for filter generation\n \n \n \n \n Expression visitor class that generates OData style $filter parameter.\n \n \n \n \n \n Visits binary expression !foo.\n \n Node to visit.\n Original node.\n \n \n \n Visits conditional expression foo == true ? bar : fee. Throws NotSupportedException.\n \n Node to visit.\n Throws NotSupportedException.\n \n \n \n Visits new object expression like new DateTime().\n \n Node to visit.\n Original node.\n \n \n \n Visits constants like 'a' or 123.\n \n Node to visit.\n Original node.\n \n \n \n Visits object members like p.Foo or dateTime.Hour.\n \n Node to visit.\n Original node.\n \n \n \n Visits method calls like Contains, StartsWith, etc. Methods that are not supported will throw an exception.\n \n Node to visit.\n Original node.\n \n \n \n Appends 'eq true' to Boolean unary operators.\n \n \n \n \n Helper method to print constant.\n \n Object to print.\n \n \n \n Helper method to generate property name.\n \n Property to examine.\n Property name or value specified in the FilterParameterAttribute.\n \n \n \n Helper method to retrieve format from the FilterParameterAttribute.\n \n Property to examine.\n Format from FilterParameterAttribute or null.\n \n \n \n A cloud credentials provider.\n \n \n \n \n Creates a new credentials instance if the appropriate settings for\n this provider are present and valid.\n \n Dictionary of configuration settings.\n Returns a new instance if the provider supports the\n provided settings.\n \n \n \n Defines cryptographic methods.\n \n \n \n \n Computes SHA256 hash from key and data.\n \n Key to use as hash salt.\n Data to hash.\n Hash value.\n \n \n \n Provides tracing utilities that insight into all aspects of client\n operations via implementations of the ICloudTracingInterceptor\n interface. All tracing is global.\n \n \n The utilities in the internal Tracing class provide helpers for\n notifying the active trace listeners of changes.\n \n \n \n \n The collection of tracing interceptors to notify.\n \n \n \n \n A read-only, thread-safe collection of tracing interceptors. Since\n List is only thread-safe for reads (and adding/removing tracing\n interceptors isn't a very common operation), we simply replace the\n entire collection of interceptors so any enumeration of the list\n in progress on a different thread will not be affected by the\n change.\n \n \n \n \n Lock used to synchronize mutation of the tracing interceptors.\n \n \n \n \n Initializes a new instance of the CloudTracing class.\n \n \n \n \n Add a tracing interceptor to be notified of changes.\n \n The tracing interceptor.\n \n \n \n Remove a tracing interceptor from change notifications.\n \n The tracing interceptor.\n \n True if the tracing interceptor was found and removed; false\n otherwise.\n \n \n \n \n Gets or sets a value indicating whether tracing is enabled.\n Tracing can be disabled for performance.\n \n \n \n \n Gets a sequence of the tracing interceptors to notify of changes.\n \n \n \n \n Http retry handler.\n \n \n \n \n Initializes a new instance of the class. Sets \n default retry policty base on Exponential Backoff.\n \n \n \n \n Initializes a new instance of the class. Sets \n the default retry policty base on Exponential Backoff.\n \n Inner http handler.\n \n \n \n Initializes a new instance of the class. \n \n Retry policy to use.\n Inner http handler.\n \n \n \n Sends an HTTP request to the inner handler to send to the server as an asynchronous\n operation. Retries request if needed based on Retry Policy.\n \n The HTTP request message to send to the server.\n A cancellation token to cancel operation.\n Returns System.Threading.Tasks.Task<TResult>. The \n task object representing the asynchronous operation.\n \n \n \n Gets or sets retry policy.\n \n \n \n \n An instance of a callback delegate that will be invoked whenever a retry condition is encountered.\n \n \n \n \n Creates a new credentials instance of type T using the set of\n registered cloud credentials providers and provided settings.\n \n The requested minimum type of cloud credentials\n for successful credential use.\n Dictionary of configuration settings.\n Provides a value indicating whether to\n throw if the minimum requested credentials type cannot be found.\n Defaults to true.\n Returns a new instance of the first provider that supports\n the provided settings.\n \n \n \n The base ServiceClient class used to call REST services.\n \n Type of the ServiceClient.\n \n \n \n Gets the Platform's IHttpTransportHandlerProvider which gives the\n default HttpHandler for sending web requests.\n \n \n \n \n A value indicating whether or not the ServiceClient has already\n been disposed.\n \n \n \n \n Reference to the delegated handler of our handler (so we can\n maintain a proper reference count).\n \n \n \n \n Reference to our HTTP handler (which is the start of our HTTP\n pipeline).\n \n \n \n \n Initializes static members of the ServiceClient class.\n \n \n \n \n Initializes a new instance of the ServiceClient class.\n \n \n \n \n Initializes a new instance of the ServiceClient class.\n \n The http client.\n \n \n \n Initializes HttpClient.\n \n Http message handler to use with Http client.\n \n \n \n Create the HTTP client.\n \n The HTTP client.\n \n \n \n Dispose the ServiceClient.\n \n \n \n \n Clone the service client.\n \n The client to clone.\n \n \n \n Clone HttpClient properties.\n \n The client to clone.\n The client to copy into.\n \n \n \n Extend the ServiceClient with a new handler.\n \n The new client that will extend.\n The handler to extend with.\n The extended client.\n \n \n \n Gets the HttpClient used for making HTTP requests.\n \n \n \n \n Gets a reference to our HTTP handler (which is the start of our\n HTTP pipeline).\n \n \n \n \n Gets the UserAgent collection which can be augmented with custom\n user agent strings.\n \n \n \n \n Interface used to represent resource groupings of ServiceClient \n operations.\n \n Type of the ServiceClient.\n \n \n \n Gets a reference to the ServiceClient.\n \n \n \n \n The CloudClients class provides a common location for service client\n discovery. It can be accessed via CloudContext.Clients. The\n Microsoft.WindowsAzure namespace should be imported when used because\n CloudClients is intended to be the target of extension methods by each\n service client.\n \n \n All service client libraries should add CreateXYZClient() extension\n methods on static classes declared in the Microsoft.WindowsAzure\n namespace. This will allow any library loaded in a project to be\n easily discovered via CloudContext.Clients without developers having to\n figure out which namespaces to import, etc. You may also add extension\n methods that create \n \n This class is used as a static class (internal constructor) but not declared\n as such so it can be the target of extension methods.\n \n \n \n \n Initializes a new instance of the CloudClients class.\n \n \n \n \n Utilities for easily retrieving configuration settings across a variety\n of platform appropriate sources.\n \n \n \n \n Initializes static members of the class.\n Initializes platform-specific cloud configuration and credentials\n providers.\n \n \n \n \n Registers a cloud credentials provider with the configuration\n runtime.\n \n Instance of a cloud credentials provider.\n \n \n \n Creates a new credentials instance of type T using the set of\n registered cloud credentials providers.\n \n The requested minimum type of cloud credentials\n for successful credential use.\n Dictionary of configuration settings.\n Returns a new instance of the first provider that supports\n the provided settings.\n \n \n \n A platform specific configuration provider. There is no standard\n configuration support in the Portable Class Libraries BCL.\n \n \n \n \n Initializes a new instance of the CloudConfiguration class.\n \n \n \n \n Get the value of a configuration setting from a platform specific\n configuration source.\n \n The name of the setting.\n The value of the setting, or null if not found.\n \n \n \n Get connection info that can be used to instantiate type T by\n searching for configuration settings of the form\n Namespace.Type.format. If no connection info is found for the\n type, we will search for connection info for all of its base types.\n \n \n The type to obtain connection info for.\n \n \n Connection info used to instantiate the given type or null if no\n connection info is found.\n \n \n You can get insight into the connection info search by checking\n the tracing output.\n \n \n \n \n Get named connection info that can be used to instantiate a type by\n searching for configuration settings of the format\n Namespace.Type.Name.format. If no connection info is found for the\n type, we will search for connection info for all of its base types.\n \n \n The type to obtain connection info for.\n \n The name of the connection info.\n \n Connection info used to instantiate the given type or null if no\n connection info is found.\n \n \n You can get insight into the connection info search by checking\n the tracing output.\n \n \n \n \n Get connection info that can be used to instantiate a type by\n searching for configuration settings of the form\n Namespace.Type.format. If no connection info is found for the\n type, we will search for connection info for all of its base types.\n \n \n The type to obtain connection info for.\n \n \n Connection info used to instantiate the given type or null if no\n connection info is found.\n \n \n You can get insight into the connection info search by checking\n the tracing output.\n \n \n \n \n Get named connection info that can be used to instantiate a type by\n searching for configuration settings of the format\n Namespace.Type.Name.format. If no connection info is found for\n the type, we will search for connection info for all of its base\n types.\n \n \n The type to obtain connection info for.\n \n The name of the connection info.\n \n Connection info used to instantiate the given type or null if\n no connection string is found.\n \n \n You can get insight into the connection info search by checking\n the tracing output.\n \n \n \n \n Get connection info that can be used to instantiate a type by\n searching for configuration settings of the format\n Namespace.Type[.Name].format If no settings are found for the\n type, we will search for connection info for all of its base types.\n \n \n The type to obtain connection info for.\n \n Optional value for named settings.\n \n Name of the config setting item where the setting was found.\n \n \n Value of the config setting item where the setting was found.\n \n \n Connection info used to instantiate the given type or null if\n no connection info is found.\n \n \n You can get insight into the connection info search by checking\n the tracing output.\n \n \n \n \n Parse a connection string.\n \n The connection string.\n \n A dictionary of the setting names and values from the connection\n string.\n \n \n \n \n Parse a JSON settings file.\n \n The JSON settings.\n \n A dictionary of the setting names and values from the JSON\n settings.\n \n \n \n \n Gets a platform specific configuration provider. There is no\n standard configuration support in the Portable Class Libraries BCL.\n \n \n \n \n Gets the tracing utilities used to provide insight into all aspects\n of client operations.\n \n \n \n \n The CloudContext class is your primary entry point for getting started\n with Windows Azure client libraries. CloudContext.Clients contains\n helpful methods to create any of the clients currently referenced in\n your project (be sure to import the Microsoft.WindowsAzure namespace so\n you import its extension methods). CloudContext.Configuration allows\n you to easily retrieve configuration settings across a variety of \n platform appropriate sources.\n \n \n The CloudContext class is static to make it easier to use, but all\n other classes should be instances so they can be targeted by extension\n methods given the layered approach of our client libraries.\n \n \n \n \n Initializes static members of the class.\n \n \n \n \n Gets an object providing a common location for service client\n discovery. The Microsoft.WindowsAzure namespace should be imported\n when used because CloudClients is intended to be the target of\n extension methods by each service client library.\n \n \n \n \n Gets utilities for easily retrieving configuration settings across\n a variety of platform appropriate sources.\n \n \n \n \n Parse connection strings.\n \n \n The following simplified grammar was obtained from the specification\n \"[MS-OLEDBSTR]: OLEDB Connection String Structure\". Refer to the spec\n for full details. We support case-insensitive keys and multiple\n occurrences of the same key, but not multiple values for keys (i.e.,\n the CompoundValue nonterminal in the spec's grammar).\n \n ws := [ \\t]*\n semi := ;\n eq := =\n esc-eq := ==\n dq := \"\n sq := '\n esc-dq := \"\"\n esc-sq := ''\n key-start: (==)|[^ \\t;]\n key-body: (==)[^;]*\n key-end: (==)|[^ \\t;]\n lit-start: [^ \\t'\";=]\n lit-body: [^;]\n lit-end: [^ \\t;]\n sq-lit: ''|[^']\n dq-lit: \"\"|[^\"]\n \n ConnectionString :=\n (ConnectionStringClause semi)* (ConnectionStringClause semi?)?\n \n ConnectionStringClause :=\n KeyValuePair | ws\n \n KeyValuePair :=\n ws Key ws eq ws Value ws\n \n Key :=\n key-start (key-body* key-end)?\n \n Value :=\n (lit-start (lit-body* lit-end)?)?\n | sq sq-lit* sq\n | dq dq-lit* dq \n \n \n \n \n Parses the connection string into a collection of key/value pairs.\n \n Connection string.\n Parsed connection string.\n \n \n \n Initializes a new instance of the class.\n \n Value to parse.\n \n \n \n Parses the string.\n \n A collection of key=value pairs.\n \n \n \n Generates an invalid connection string exception with the detailed \n error message.\n \n Position of the error.\n Short error formatting string.\n Optional arguments for the error string.\n Exception with the requested message.\n \n \n \n Skips whitespaces at the current position.\n \n \n \n \n Extracts key at the current position.\n \n Key.\n \n \n \n Extracts the string until the given quotation mark.\n \n Quotation mark terminating the string.\n String.\n \n \n \n Skips specified operator.\n \n Operator character.\n \n \n \n Extracts key's value.\n \n Key's value.\n \n \n \n State of the parser.\n \n \n \n \n Wrapper class that provides manual reference count functionality\n \n Type to wrap around. Must be disposable.\n \n \n \n Platform-specific interface enabling cloud configuration support.\n \n \n \n \n Registers platform-specific cloud configuration providers with the\n common runtime.\n \n \n \n \n Exception thrown for any invalid response.\n \n \n \n \n Initializes a new instance of the CloudException class.\n \n The exception message.\n \n \n \n Initializes a new instance of the CloudException class.\n \n The exception message.\n Inner exception.\n \n \n \n Create a CloudException from a failed response.\n \n The HTTP request.\n The HTTP request content.\n The HTTP response.\n The HTTP response content.\n Optional inner exception.\n A CloudException representing the failure.\n \n \n \n Create a CloudException from a failed response.\n This method is obsolete. Use Create without defaultTo parameter.\n \n The HTTP request.\n The HTTP request content.\n The HTTP response.\n The HTTP response content.\n The content type to default to if none of the types matches.\n Optional inner exception.\n A CloudException representing the failure.\n \n \n \n Create a CloudException from a failed response sending XML content.\n This method is obsolete. Use Create without defaultTo parameter.\n \n The HTTP request.\n The HTTP request content.\n The HTTP response.\n The HTTP response content.\n Optional inner exception.\n A CloudException representing the failure.\n \n \n \n Create a CloudException from a failed response sending JSON content.\n This method is obsolete. Use Create without defaultTo parameter.\n \n The HTTP request.\n The HTTP request content.\n The HTTP response.\n The HTTP response content.\n Optional inner exception.\n A CloudException representing the failure.\n \n \n \n Parse the response content as either an XML or JSON error message.\n \n The response content.\n \n An object containing the parsed error code and message.\n \n \n \n \n Parse the response content as an XML error message.\n \n The response content.\n \n An object containing the parsed error code and message.\n \n \n \n \n Parse the response content as an JSON error message.\n \n The response content.\n \n An object containing the parsed error code and message.\n \n \n \n \n Gets the error message returned from the server.\n \n \n This is included by default in the Message property.\n \n \n \n \n Gets the error code returned from the server.\n \n \n This is included by default in the Message property.\n \n \n \n \n Gets the request identifier.\n \n \n \n \n Gets the routing request identifier.\n \n \n \n \n Gets information about the associated HTTP request.\n \n \n \n \n Gets information about the associated HTTP response.\n \n \n \n \n Internal extensions.\n \n \n \n \n Create an ArgumentException for empty parameters.\n \n The parameter name.\n The ArgumentException.\n \n \n \n Get the assembly version of a service client.\n \n Type of the service client.\n The service client.\n The assembly version of the client.\n \n \n \n Get the HTTP pipeline formed from the ancestors of the starting\n handler.\n \n The starting handler.\n The HTTP pipeline.\n \n \n \n Get the HTTP pipeline for the given service client.\n \n Type of the service client.\n The service client.\n The client's HTTP pipeline.\n \n \n \n Add a handler to the end of the client's HTTP pipeline.\n \n Type of the service client.\n The service client.\n The handler to add.\n \n \n \n Sets retry policy for the client.\n \n Service client type.\n Service client.\n Retry policy to set.\n \n \n \n Helper extension methods used by tracing providers.\n \n \n \n \n Returns string representation of a HttpRequestMessage.\n \n Request to format.\n Formatted string.\n \n \n \n Returns string representation of a HttpResponseMessage.\n \n Response to format.\n Formatted string.\n \n \n \n Converts given dictionary into a log string.\n \n The dictionary key type\n The dictionary value type\n The dictionary collection object\n The log string\n \n \n \n The ICloudTracingInterceptor provides useful information about cloud\n operations. Interception is global and a tracing interceptor can be\n added via CloudContext.Configuration.Tracing.AddTracingInterceptor.\n \n \n \n \n Trace information.\n \n The information to trace.\n \n \n \n Probe configuration for the value of a setting.\n \n The configuration source.\n The name of the setting.\n The value of the setting in the source.\n \n \n \n Enter a method.\n \n Method invocation identifier.\n The instance with the method.\n Name of the method.\n Method parameters.\n \n \n \n Send an HTTP request.\n \n Method invocation identifier.\n The request about to be sent.\n \n \n \n Receive an HTTP response.\n \n Method invocation identifier.\n The response instance.\n \n \n \n Raise an error.\n \n Method invocation identifier.\n The error.\n \n \n \n Exit a method. Note: Exit will not be called in the event of an\n error.\n \n Method invocation identifier.\n Method return value.\n \n \n \n A strongly-typed resource class, for looking up localized strings, etc.\n \n \n \n \n Returns the cached ResourceManager instance used by this class.\n \n \n \n \n Overrides the current thread's CurrentUICulture property for all\n resource lookups using this strongly typed resource class.\n \n \n \n \n Looks up a localized string similar to Value cannot be empty.\n Parameter name: {0}.\n \n \n \n \n Looks up a localized string similar to The specified argument {0} cannot be greater than its ceiling value of {1}..\n \n \n \n \n Looks up a localized string similar to The specified argument {0} cannot be initialized with a negative value..\n \n \n \n \n Looks up a localized string similar to Failed to convert parameter {0} value '{1}' to type {2}..\n \n \n \n \n Looks up a localized string similar to {3} Failed to create {0} from connection settings {1} = "{2}"..\n \n \n \n \n Looks up a localized string similar to No connection settings found for type {0}. Enable tracing for more information..\n \n \n \n \n Looks up a localized string similar to No credentials of type '{0}' could be initialized from the provided settings..\n \n \n \n \n Looks up a localized string similar to Parameter {0} is required..\n \n \n \n \n Looks up a localized string similar to Default retry strategy for technology {0}, named '{1}', is not defined..\n \n \n \n \n Looks up a localized string similar to Default retry strategy for technology {0} was not not defined, and there is no overall default strategy..\n \n \n \n \n Looks up a localized string similar to Retry handler is not present in the HttpClient handler stack..\n \n \n \n \n Looks up a localized string similar to The RetryManager is already set..\n \n \n \n \n Looks up a localized string similar to The default RetryManager has not been set. Set it by invoking the RetryManager.SetDefault static method, or if you are using declarative configuration, you can invoke the RetryPolicyFactory.CreateDefault() method to automatically create the retry manager from the configuration file..\n \n \n \n \n Looks up a localized string similar to Response status code indicates server error: {0} ({1})..\n \n \n \n \n Looks up a localized string similar to The action has exceeded its defined retry limit..\n \n \n \n \n Looks up a localized string similar to The retry strategy with name '{0}' cannot be found..\n \n \n \n \n Looks up a localized string similar to The specified string argument {0} must not be empty..\n \n \n \n \n Looks up a localized string similar to The specified argument '{0}' cannot return a null task when invoked..\n \n \n \n \n Looks up a localized string similar to The specified argument '{0}' must return a scheduled task (also known as "hot" task) when invoked..\n \n \n \n \n Handles the execution and retries of the user-initiated task.\n \n The result type of the user-initiated task.\n \n \n \n Provides a wrapper for a non-generic and calls into the pipeline\n to retry only the generic version of the .\n \n \n \n \n Wraps the non-generic into a generic .\n \n The task to wrap.\n A that wraps the non-generic .\n \n \n \n Default Http error detection strategy based on Http Status Code.\n \n \n \n \n Defines an interface that must be implemented by custom components responsible for detecting specific transient conditions.\n \n \n \n \n Determines whether the specified exception represents a transient failure that can be compensated by a retry.\n \n The exception object to be verified.\n true if the specified exception is considered as transient; otherwise, false.\n \n \n \n Returns true if status code in HttpRequestExceptionWithStatus exception is greater \n than or equal to 500 and not NotImplemented (501) or HttpVersionNotSupported (505).\n \n Exception to check against.\n True if exception is transient otherwise false.\n \n \n \n A retry strategy with backoff parameters for calculating the exponential delay between retries.\n \n \n \n \n Represents a retry strategy that determines the number of retry attempts and the interval between retries.\n \n \n \n \n Represents the default number of retry attempts.\n \n \n \n \n Represents the default amount of time used when calculating a random delta in the exponential delay between retries.\n \n \n \n \n Represents the default maximum amount of time used when calculating the exponential delay between retries.\n \n \n \n \n Represents the default minimum amount of time used when calculating the exponential delay between retries.\n \n \n \n \n Represents the default interval between retries.\n \n \n \n \n Represents the default time increment between retry attempts in the progressive delay policy.\n \n \n \n \n Represents the default flag indicating whether the first retry attempt will be made immediately,\n whereas subsequent retries will remain subject to the retry interval.\n \n \n \n \n Initializes a new instance of the class. \n \n The name of the retry strategy.\n true to immediately retry in the first attempt; otherwise, false. The subsequent retries will remain subject to the configured retry interval.\n \n \n \n Returns the corresponding ShouldRetry delegate.\n \n The ShouldRetry delegate.\n \n \n \n Returns a default policy that performs no retries, but invokes the action only once.\n \n \n \n \n Returns a default policy that implements a fixed retry interval configured with the and parameters.\n The default retry policy treats all caught exceptions as transient errors.\n \n \n \n \n Returns a default policy that implements a progressive retry interval configured with the , , and parameters.\n The default retry policy treats all caught exceptions as transient errors.\n \n \n \n \n Returns a default policy that implements a random exponential retry interval configured with the , , , and parameters.\n The default retry policy treats all caught exceptions as transient errors.\n \n \n \n \n Gets or sets a value indicating whether the first retry attempt will be made immediately,\n whereas subsequent retries will remain subject to the retry interval.\n \n \n \n \n Gets the name of the retry strategy.\n \n \n \n \n Initializes a new instance of the class. \n \n \n \n \n Initializes a new instance of the class with the specified retry settings.\n \n The maximum number of retry attempts.\n The minimum backoff time\n The maximum backoff time.\n The value that will be used to calculate a random delta in the exponential delay between retries.\n \n \n \n Initializes a new instance of the class with the specified name and retry settings.\n \n The name of the retry strategy.\n The maximum number of retry attempts.\n The minimum backoff time\n The maximum backoff time.\n The value that will be used to calculate a random delta in the exponential delay between retries.\n \n \n \n Initializes a new instance of the class with the specified name, retry settings, and fast retry option.\n \n The name of the retry strategy.\n The maximum number of retry attempts.\n The minimum backoff time\n The maximum backoff time.\n The value that will be used to calculate a random delta in the exponential delay between retries.\n true to immediately retry in the first attempt; otherwise, false. The subsequent retries will remain subject to the configured retry interval.\n \n \n \n Returns the corresponding ShouldRetry delegate.\n \n The ShouldRetry delegate.\n \n \n \n Represents a retry strategy with a specified number of retry attempts and a default, fixed time interval between retries.\n \n \n \n \n Initializes a new instance of the class. \n \n \n \n \n Initializes a new instance of the class with the specified number of retry attempts. \n \n The number of retry attempts.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and time interval. \n \n The number of retry attempts.\n The time interval between retries.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts, time interval, and retry strategy. \n \n The retry strategy name.\n The number of retry attempts.\n The time interval between retries.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts, time interval, retry strategy, and fast start option. \n \n The retry strategy name.\n The number of retry attempts.\n The time interval between retries.\n true to immediately retry in the first attempt; otherwise, false. The subsequent retries will remain subject to the configured retry interval.\n \n \n \n Returns the corresponding ShouldRetry delegate.\n \n The ShouldRetry delegate.\n \n \n \n Implements the common guard methods.\n \n \n \n \n Checks a string argument to ensure that it isn't null or empty.\n \n The argument value to check.\n The name of the argument.\n The return value should be ignored. It is intended to be used only when validating arguments during instance creation (for example, when calling the base constructor).\n \n \n \n Checks an argument to ensure that it isn't null.\n \n The argument value to check.\n The name of the argument.\n The return value should be ignored. It is intended to be used only when validating arguments during instance creation (for example, when calling the base constructor).\n \n \n \n Checks an argument to ensure that its 32-bit signed value isn't negative.\n \n The value of the argument.\n The name of the argument for diagnostic purposes.\n \n \n \n Checks an argument to ensure that its 64-bit signed value isn't negative.\n \n The value of the argument.\n The name of the argument for diagnostic purposes.\n \n \n \n Checks an argument to ensure that its value doesn't exceed the specified ceiling baseline.\n \n The value of the argument.\n The ceiling value of the argument.\n The name of the argument for diagnostic purposes.\n \n \n \n Inherits HttpRequestException adding HttpStatusCode to the exception.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class\n with a specific message that describes the current exception.\n \n A message that describes the current exception.\n \n \n \n Initializes a new instance of the class\n with a specific message that describes the current exception and an inner\n exception.\n \n A message that describes the current exception.\n The inner exception.\n \n \n \n Http status code.\n \n \n \n \n A retry strategy with a specified number of retry attempts and an incremental time interval between retries.\n \n \n \n \n Initializes a new instance of the class. \n \n \n \n \n Initializes a new instance of the class with the specified retry settings.\n \n The number of retry attempts.\n The initial interval that will apply for the first retry.\n The incremental time value that will be used to calculate the progressive delay between retries.\n \n \n \n Initializes a new instance of the class with the specified name and retry settings.\n \n The retry strategy name.\n The number of retry attempts.\n The initial interval that will apply for the first retry.\n The incremental time value that will be used to calculate the progressive delay between retries.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts, time interval, retry strategy, and fast start option. \n \n The retry strategy name.\n The number of retry attempts.\n The initial interval that will apply for the first retry.\n The incremental time value that will be used to calculate the progressive delay between retries.\n true to immediately retry in the first attempt; otherwise, false. The subsequent retries will remain subject to the configured retry interval.\n \n \n \n Returns the corresponding ShouldRetry delegate.\n \n The ShouldRetry delegate.\n \n \n \n Contains information that is required for the event.\n \n \n \n \n Initializes a new instance of the class.\n \n The current retry attempt count.\n The delay that indicates how long the current thread will be suspended before the next iteration is invoked.\n The exception that caused the retry conditions to occur.\n \n \n \n Gets the current retry count.\n \n \n \n \n Gets the delay that indicates how long the current thread will be suspended before the next iteration is invoked.\n \n \n \n \n Gets the exception that caused the retry conditions to occur.\n \n \n \n \n The special type of exception that provides managed exit from a retry loop. The user code can use this\n exception to notify the retry policy that no further retry attempts are required.\n \n \n \n \n Initializes a new instance of the class with a default error message.\n \n \n \n \n Initializes a new instance of the class with a specified error message.\n \n The message that describes the error.\n \n \n \n Initializes a new instance of the class with a reference to the inner exception\n that is the cause of this exception.\n \n The exception that is the cause of the current exception.\n \n \n \n Initializes a new instance of the class with a specified error message and inner exception.\n \n The message that describes the error.\n The exception that is the cause of the current exception.\n \n \n \n Provides the entry point to the retry functionality.\n \n \n \n \n Sets the specified retry manager as the default retry manager.\n \n The retry manager.\n true to throw an exception if the manager is already set; otherwise, false. Defaults to .\n The singleton is already set and is true.\n \n \n \n Initializes a new instance of the class.\n \n The complete set of retry strategies.\n \n \n \n Initializes a new instance of the class with the specified retry strategies and default retry strategy name.\n \n The complete set of retry strategies.\n The default retry strategy.\n \n \n \n Initializes a new instance of the class with the specified retry strategies and defaults.\n \n The complete set of retry strategies.\n The default retry strategy.\n The names of the default strategies for different technologies.\n \n \n \n Returns a retry policy with the specified error detection strategy and the default retry strategy defined in the configuration. \n \n The type that implements the interface that is responsible for detecting transient conditions.\n A new retry policy with the specified error detection strategy and the default retry strategy defined in the configuration.\n \n \n \n Returns a retry policy with the specified error detection strategy and retry strategy.\n \n The type that implements the interface that is responsible for detecting transient conditions.\n The retry strategy name, as defined in the configuration.\n A new retry policy with the specified error detection strategy and the default retry strategy defined in the configuration.\n \n \n \n Returns the default retry strategy defined in the configuration.\n \n The retry strategy that matches the default strategy.\n \n \n \n Returns the retry strategy that matches the specified name.\n \n The retry strategy name.\n The retry strategy that matches the specified name.\n \n \n \n Returns the retry strategy for the specified technology.\n \n The techonolgy to get the default retry strategy for.\n The retry strategy for the specified technology.\n \n \n \n Gets the default for the application.\n \n You can update the default retry manager by calling the method.\n \n \n \n Gets or sets the default retry strategy name.\n \n \n \n \n Provides the base implementation of the retry mechanism for unreliable actions and transient conditions.\n \n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and parameters defining the progressive delay between retries.\n \n The that is responsible for detecting transient conditions.\n The strategy to use for this retry policy.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and default fixed time interval between retries.\n \n The that is responsible for detecting transient conditions.\n The number of retry attempts.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and fixed time interval between retries.\n \n The that is responsible for detecting transient conditions.\n The number of retry attempts.\n The interval between retries.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and backoff parameters for calculating the exponential delay between retries.\n \n The that is responsible for detecting transient conditions.\n The number of retry attempts.\n The minimum backoff time.\n The maximum backoff time.\n The time value that will be used to calculate a random delta in the exponential delay between retries.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and parameters defining the progressive delay between retries.\n \n The that is responsible for detecting transient conditions.\n The number of retry attempts.\n The initial interval that will apply for the first retry.\n The incremental time value that will be used to calculate the progressive delay between retries.\n \n \n \n Repetitively executes the specified action while it satisfies the current retry policy.\n \n A delegate that represents the executable action that doesn't return any results.\n \n \n \n Repetitively executes the specified action while it satisfies the current retry policy.\n \n The type of result expected from the executable action.\n A delegate that represents the executable action that returns the result of type .\n The result from the action.\n \n \n \n Repetitively executes the specified asynchronous task while it satisfies the current retry policy.\n \n A function that returns a started task (also known as \"hot\" task).\n \n A task that will run to completion if the original task completes successfully (either the\n first time or after retrying transient failures). If the task fails with a non-transient error or\n the retry limit is reached, the returned task will transition to a faulted state and the exception must be observed.\n \n \n \n \n Repetitively executes the specified asynchronous task while it satisfies the current retry policy.\n \n A function that returns a started task (also known as \"hot\" task).\n The token used to cancel the retry operation. This token does not cancel the execution of the asynchronous task.\n \n Returns a task that will run to completion if the original task completes successfully (either the\n first time or after retrying transient failures). If the task fails with a non-transient error or\n the retry limit is reached, the returned task will transition to a faulted state and the exception must be observed.\n \n \n \n \n Repeatedly executes the specified asynchronous task while it satisfies the current retry policy.\n \n A function that returns a started task (also known as \"hot\" task).\n \n Returns a task that will run to completion if the original task completes successfully (either the\n first time or after retrying transient failures). If the task fails with a non-transient error or\n the retry limit is reached, the returned task will transition to a faulted state and the exception must be observed.\n \n \n \n \n Repeatedly executes the specified asynchronous task while it satisfies the current retry policy.\n \n A function that returns a started task (also known as \"hot\" task).\n The token used to cancel the retry operation. This token does not cancel the execution of the asynchronous task.\n \n Returns a task that will run to completion if the original task completes successfully (either the\n first time or after retrying transient failures). If the task fails with a non-transient error or\n the retry limit is reached, the returned task will transition to a faulted state and the exception must be observed.\n \n \n \n \n Notifies the subscribers whenever a retry condition is encountered.\n \n The current retry attempt count.\n The exception that caused the retry conditions to occur.\n The delay that indicates how long the current thread will be suspended before the next iteration is invoked.\n \n \n \n Returns a default policy that performs no retries, but invokes the action only once.\n \n \n \n \n Returns a default policy that implements a fixed retry interval configured with the default retry strategy.\n The default retry policy treats all caught exceptions as transient errors.\n \n \n \n \n Returns a default policy that implements a progressive retry interval configured with the default retry strategy.\n The default retry policy treats all caught exceptions as transient errors.\n \n \n \n \n Returns a default policy that implements a random exponential retry interval configured with the default retry strategy.\n The default retry policy treats all caught exceptions as transient errors.\n \n \n \n \n An instance of a callback delegate that will be invoked whenever a retry condition is encountered.\n \n \n \n \n Gets the retry strategy.\n \n \n \n \n Gets the instance of the error detection strategy.\n \n \n \n \n Implements a strategy that ignores any transient errors.\n \n \n \n \n Always returns false.\n \n The exception.\n Always false.\n \n \n \n Implements a strategy that treats all exceptions as transient errors.\n \n \n \n \n Always returns true.\n \n The exception.\n Always true.\n \n \n \n Provides a generic version of the class.\n \n The type that implements the interface that is responsible for detecting transient conditions.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and parameters defining the progressive delay between retries.\n \n The strategy to use for this retry policy.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and the default fixed time interval between retries.\n \n The number of retry attempts.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and a fixed time interval between retries.\n \n The number of retry attempts.\n The interval between retries.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and backoff parameters for calculating the exponential delay between retries.\n \n The number of retry attempts.\n The minimum backoff time.\n The maximum backoff time.\n The time value that will be used to calculate a random delta in the exponential delay between retries.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and parameters defining the progressive delay between retries.\n \n The number of retry attempts.\n The initial interval that will apply for the first retry.\n The incremental time value that will be used to calculate the progressive delay between retries.\n \n \n \n Defines a callback delegate that will be invoked whenever a retry condition is encountered.\n \n The current retry attempt count.\n The exception that caused the retry conditions to occur.\n The delay that indicates how long the current thread will be suspended before the next iteration is invoked.\n if a retry is allowed; otherwise, .\n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild/References/Microsoft.WindowsAzure.Management.Compute.xml", "content": "\n\n \n Microsoft.WindowsAzure.Management.Compute\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n The request ID for the request you wish to track. The request ID is\n returned in the x-ms-request-id response header for every request.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets the API version.\n \n \n \n \n Gets the URI used as the base for all cloud service requests.\n \n \n \n \n Gets subscription credentials which uniquely identify Microsoft\n Azure subscription. The subscription ID forms part of the URI for\n every service call.\n \n \n \n \n Gets or sets the initial timeout for Long Running Operations.\n \n \n \n \n Gets or sets the retry timeout for Long Running Operations.\n \n \n \n \n The Service Management API includes operations for managing the\n deployments in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n hosted services beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx\n for more information)\n \n \n \n \n The Compute Management API includes operations for managing the\n load balancers for your subscription.\n \n \n \n \n Operations for determining the version of the Azure Guest Operating\n System on which your service is running. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684169.aspx\n for more information)\n \n \n \n \n Operations for managing service certificates for your subscription.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee795178.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n disks in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157188.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n virtual machine extensions in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n virtual machines in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the OS\n images in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157175.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n virtual machine templates in your subscription.\n \n \n \n \n Initializes a new instance of the ComputeManagementClient class.\n \n \n \n \n Initializes a new instance of the ComputeManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n Required. Gets the URI used as the base for all cloud service\n requests.\n \n \n \n \n Initializes a new instance of the ComputeManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n \n \n Initializes a new instance of the ComputeManagementClient class.\n \n \n The Http client\n \n \n \n \n Initializes a new instance of the ComputeManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n Required. Gets the URI used as the base for all cloud service\n requests.\n \n \n The Http client\n \n \n \n \n Initializes a new instance of the ComputeManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n The Http client\n \n \n \n \n Clones properties from current instance to another\n ComputeManagementClient instance\n \n \n Instance of ComputeManagementClient to clone to\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n Required. The request ID for the request you wish to track. The\n request ID is returned in the x-ms-request-id response header for\n every request.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Parse enum values for type CertificateFormat.\n \n \n The value to parse.\n \n \n The enum value.\n \n \n \n \n Convert an enum of type CertificateFormat to a string.\n \n \n The value to convert to a string.\n \n \n The enum value as a string.\n \n \n \n \n Parse enum values for type LoadBalancerProbeTransportProtocol.\n \n \n The value to parse.\n \n \n The enum value.\n \n \n \n \n Convert an enum of type LoadBalancerProbeTransportProtocol to a\n string.\n \n \n The value to convert to a string.\n \n \n The enum value as a string.\n \n \n \n \n Gets the API version.\n \n \n \n \n Gets the URI used as the base for all cloud service requests.\n \n \n \n \n Gets subscription credentials which uniquely identify Microsoft\n Azure subscription. The subscription ID forms part of the URI for\n every service call.\n \n \n \n \n Gets or sets the initial timeout for Long Running Operations.\n \n \n \n \n Gets or sets the retry timeout for Long Running Operations.\n \n \n \n \n The Service Management API includes operations for managing the\n deployments in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n hosted services beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx\n for more information)\n \n \n \n \n The Compute Management API includes operations for managing the\n load balancers for your subscription.\n \n \n \n \n Operations for determining the version of the Azure Guest Operating\n System on which your service is running. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684169.aspx\n for more information)\n \n \n \n \n Operations for managing service certificates for your subscription.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee795178.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n disks in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157188.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n virtual machine extensions in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n virtual machines in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the OS\n images in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157175.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n virtual machine templates in your subscription.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IComputeManagementClient.\n \n \n Required. The request ID for the request you wish to track. The\n request ID is returned in the x-ms-request-id response header for\n every request.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IComputeManagementClient.\n \n \n Required. The request ID for the request you wish to track. The\n request ID is returned in the x-ms-request-id response header for\n every request.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Service Management API includes operations for managing the\n deployments in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx for\n more information)\n \n \n \n \n The Service Management API includes operations for managing the\n deployments in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx for\n more information)\n \n \n \n \n The Begin Changing Deployment Configuration By Name operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n The cloud service to change deployment configuration for.\n \n \n The deployment to change configuration for.\n \n \n Parameters supplied to the Begin Changing Configuration Deployment\n By Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Changing Deployment Configuration By Slot operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n The cloud service to change deployment configuration for.\n \n \n The slot to change deployment configuration for.\n \n \n Parameters supplied to the Begin Changing Configuration Deployment\n By Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Deployment operation uploads a new service\n package and creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n The cloud service to create a deployment for.\n \n \n The slot to create a deployment for.\n \n \n Parameters supplied to the Begin Creating Deployment operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Name operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n Specifies that the source blob for the disk should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Slot operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of the deployment slot.\n \n \n The parameters to delete the role.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of the deployment.\n \n \n The parameters to delete the role.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Name operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Slot operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Name operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Slot operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Swapping Deployment operation initiates a virtual IP\n address swap between the staging and production deployment\n environments for a service. If the service is currently running in\n the staging environment, it will be swapped to the production\n environment. If it is running in the production environment, it\n will be swapped to staging. For more information on this type of\n upgrade, see Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n Parameters supplied to the Begin Swapping Deployment operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Name operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Begin Updating Deployment Status By\n Deployment Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Slot operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n The deployment slot.\n \n \n Parameters supplied to the Begin Updating Deployment Status By\n Deployment Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Name operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n The cloud service to upgrade.\n \n \n The deployment to upgrade.\n \n \n Parameters supplied to the Begin Upgrading Deployment By Name\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Slot operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.This\n operation is an asynchronous operation. To determine whether the\n request has been processed, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n The cloud service to upgrade.\n \n \n The slot to upgrade.\n \n \n Parameters supplied to the Begin Upgrading Deployment By Slot\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Name operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Begin Walking Upgrade Domain By\n Deployment Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Slot operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n Parameters supplied to the Begin Walking Upgrade Domain By\n Deployment Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Change Deployment Configuration By Name operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n The cloud service to change deployment configuration for.\n \n \n The deployment to change configuration for.\n \n \n Parameters supplied to the Change ConfigurationDeployment By Name\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Change Deployment Configuration By Slot operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n The cloud service to change deployment configuration for.\n \n \n The slot to change deployment configuration for.\n \n \n Parameters supplied to the Change Configuration Deployment By Slot\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Deployment operation uploads a new service package and\n creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n The cloud service to create a deployment for.\n \n \n The slot to create a deployment for.\n \n \n Parameters supplied to the Create Deployment operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Name operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n Specifies that the source blob for the disk should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Slot operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of the deployment.\n \n \n The parameters to delete the role.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes the role instances from\n a deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of the deployment slot.\n \n \n The parameters to delete the role.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Deployment By Name operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of the deployment.\n \n \n Cancellation token.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Deployment By Slot operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n Cancellation token.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Package By Name operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Get Package By Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Package By Slot operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n Parameters supplied to the Get Package By Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Reboot Role Instance By Deployment Name operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reboot Role Instance By Deployment Slot operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Name operation requests a\n reimage of a role instance that is running in a deployment.This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Slot operation requests a\n reimage of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Name operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Rollback Update Or Upgrade By Deployment\n Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Slot operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n The deployment slot.\n \n \n Parameters supplied to the Rollback Update Or Upgrade By Deployment\n Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Swap Deployment operation initiates a virtual IP address swap\n between the staging and production deployment environments for a\n service. If the service is currently running in the staging\n environment, it will be swapped to the production environment. If\n it is running in the production environment, it will be swapped to\n staging. For more information on this type of upgrade, see\n Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n Parameters supplied to the Swap Deployment operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Name operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Update Deployment Status By Deployment\n Name operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Slot operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n The deployment slot.\n \n \n Parameters supplied to the Update Deployment Status By Deployment\n Slot operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Name operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n The cloud service to upgrade.\n \n \n The deployment to upgrade.\n \n \n Parameters supplied to the Upgrade Deployment By Name operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Slot operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n The cloud service to upgrade.\n \n \n The slot to upgrade.\n \n \n Parameters supplied to the Upgrade Deployment By Slot operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Name operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Walk Upgrade Domain By Deployment Name\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Slot operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n Parameters supplied to the Walk Upgrade Domain By Deployment Slot\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Initializes a new instance of the DeploymentOperations class.\n \n \n Reference to the service client.\n \n \n \n \n The Begin Changing Deployment Configuration By Name operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The deployment to change configuration for.\n \n \n Required. Parameters supplied to the Begin Changing Configuration\n Deployment By Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Changing Deployment Configuration By Slot operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The slot to change deployment configuration for.\n \n \n Required. Parameters supplied to the Begin Changing Configuration\n Deployment By Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Deployment operation uploads a new service\n package and creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n Required. The cloud service to create a deployment for.\n \n \n Required. The slot to create a deployment for.\n \n \n Required. Parameters supplied to the Begin Creating Deployment\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Name operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Slot operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment slot.\n \n \n Required. The parameters to delete the role.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n Required. The parameters to delete the role.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Name operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Slot operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Name operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Slot operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Swapping Deployment operation initiates a virtual IP\n address swap between the staging and production deployment\n environments for a service. If the service is currently running in\n the staging environment, it will be swapped to the production\n environment. If it is running in the production environment, it\n will be swapped to staging. For more information on this type of\n upgrade, see Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. Parameters supplied to the Begin Swapping Deployment\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Name operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Updating Deployment\n Status By Deployment Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Slot operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Begin Updating Deployment\n Status By Deployment Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Name operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The deployment to upgrade.\n \n \n Required. Parameters supplied to the Begin Upgrading Deployment By\n Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Slot operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.This\n operation is an asynchronous operation. To determine whether the\n request has been processed, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The slot to upgrade.\n \n \n Required. Parameters supplied to the Begin Upgrading Deployment By\n Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Name operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Walking Upgrade Domain\n By Deployment Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Slot operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Begin Walking Upgrade Domain\n By Deployment Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Change Deployment Configuration By Name operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The deployment to change configuration for.\n \n \n Required. Parameters supplied to the Change ConfigurationDeployment\n By Name operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Change Deployment Configuration By Slot operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The slot to change deployment configuration for.\n \n \n Required. Parameters supplied to the Change Configuration\n Deployment By Slot operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Deployment operation uploads a new service package and\n creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n Required. The cloud service to create a deployment for.\n \n \n Required. The slot to create a deployment for.\n \n \n Required. Parameters supplied to the Create Deployment operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Name operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Slot operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n Required. The parameters to delete the role.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes the role instances from\n a deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment slot.\n \n \n Required. The parameters to delete the role.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Deployment By Name operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n Cancellation token.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Deployment By Slot operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Cancellation token.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Package By Name operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Get Package By Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Package By Slot operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Get Package By Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Reboot Role Instance By Deployment Name operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reboot Role Instance By Deployment Slot operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Name operation requests a\n reimage of a role instance that is running in a deployment.This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Slot operation requests a\n reimage of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Name operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Rollback Update Or Upgrade By\n Deployment Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Slot operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Rollback Update Or Upgrade By\n Deployment Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Swap Deployment operation initiates a virtual IP address swap\n between the staging and production deployment environments for a\n service. If the service is currently running in the staging\n environment, it will be swapped to the production environment. If\n it is running in the production environment, it will be swapped to\n staging. For more information on this type of upgrade, see\n Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. Parameters supplied to the Swap Deployment operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Name operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Update Deployment Status By\n Deployment Name operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Slot operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Update Deployment Status By\n Deployment Slot operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Name operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The deployment to upgrade.\n \n \n Required. Parameters supplied to the Upgrade Deployment By Name\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Slot operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The slot to upgrade.\n \n \n Required. Parameters supplied to the Upgrade Deployment By Slot\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Name operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Walk Upgrade Domain By\n Deployment Name operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Slot operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Walk Upgrade Domain By\n Deployment Slot operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Begin Changing Deployment Configuration By Name operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The deployment to change configuration for.\n \n \n Required. Parameters supplied to the Begin Changing Configuration\n Deployment By Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Changing Deployment Configuration By Name operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The deployment to change configuration for.\n \n \n Required. Parameters supplied to the Begin Changing Configuration\n Deployment By Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Changing Deployment Configuration By Slot operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The slot to change deployment configuration for.\n \n \n Required. Parameters supplied to the Begin Changing Configuration\n Deployment By Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Changing Deployment Configuration By Slot operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The slot to change deployment configuration for.\n \n \n Required. Parameters supplied to the Begin Changing Configuration\n Deployment By Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Deployment operation uploads a new service\n package and creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to create a deployment for.\n \n \n Required. The slot to create a deployment for.\n \n \n Required. Parameters supplied to the Begin Creating Deployment\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Deployment operation uploads a new service\n package and creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to create a deployment for.\n \n \n Required. The slot to create a deployment for.\n \n \n Required. Parameters supplied to the Begin Creating Deployment\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Name operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Name operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Slot operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Slot operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment slot.\n \n \n Required. The parameters to delete the role.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment slot.\n \n \n Required. The parameters to delete the role.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n Required. The parameters to delete the role.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n Required. The parameters to delete the role.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Name operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Name operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Slot operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Slot operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Name operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Name operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Slot operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Slot operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Swapping Deployment operation initiates a virtual IP\n address swap between the staging and production deployment\n environments for a service. If the service is currently running in\n the staging environment, it will be swapped to the production\n environment. If it is running in the production environment, it\n will be swapped to staging. For more information on this type of\n upgrade, see Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. Parameters supplied to the Begin Swapping Deployment\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Swapping Deployment operation initiates a virtual IP\n address swap between the staging and production deployment\n environments for a service. If the service is currently running in\n the staging environment, it will be swapped to the production\n environment. If it is running in the production environment, it\n will be swapped to staging. For more information on this type of\n upgrade, see Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. Parameters supplied to the Begin Swapping Deployment\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Name operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Updating Deployment\n Status By Deployment Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Name operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Updating Deployment\n Status By Deployment Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Slot operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Begin Updating Deployment\n Status By Deployment Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Slot operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Begin Updating Deployment\n Status By Deployment Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Name operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The deployment to upgrade.\n \n \n Required. Parameters supplied to the Begin Upgrading Deployment By\n Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Name operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The deployment to upgrade.\n \n \n Required. Parameters supplied to the Begin Upgrading Deployment By\n Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Slot operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.This\n operation is an asynchronous operation. To determine whether the\n request has been processed, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The slot to upgrade.\n \n \n Required. Parameters supplied to the Begin Upgrading Deployment By\n Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Slot operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.This\n operation is an asynchronous operation. To determine whether the\n request has been processed, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The slot to upgrade.\n \n \n Required. Parameters supplied to the Begin Upgrading Deployment By\n Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Name operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Walking Upgrade Domain\n By Deployment Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Name operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Walking Upgrade Domain\n By Deployment Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Slot operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Begin Walking Upgrade Domain\n By Deployment Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Slot operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Begin Walking Upgrade Domain\n By Deployment Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Change Deployment Configuration By Name operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The deployment to change configuration for.\n \n \n Required. Parameters supplied to the Change ConfigurationDeployment\n By Name operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Change Deployment Configuration By Name operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The deployment to change configuration for.\n \n \n Required. Parameters supplied to the Change ConfigurationDeployment\n By Name operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Change Deployment Configuration By Slot operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The slot to change deployment configuration for.\n \n \n Required. Parameters supplied to the Change Configuration\n Deployment By Slot operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Change Deployment Configuration By Slot operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The slot to change deployment configuration for.\n \n \n Required. Parameters supplied to the Change Configuration\n Deployment By Slot operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Deployment operation uploads a new service package and\n creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to create a deployment for.\n \n \n Required. The slot to create a deployment for.\n \n \n Required. Parameters supplied to the Create Deployment operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Deployment operation uploads a new service package and\n creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to create a deployment for.\n \n \n Required. The slot to create a deployment for.\n \n \n Required. Parameters supplied to the Create Deployment operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Name operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Name operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Slot operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Slot operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n Required. The parameters to delete the role.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n Required. The parameters to delete the role.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes the role instances from\n a deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment slot.\n \n \n Required. The parameters to delete the role.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes the role instances from\n a deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment slot.\n \n \n Required. The parameters to delete the role.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Deployment By Name operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Deployment By Name operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Deployment By Slot operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Deployment By Slot operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Package By Name operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Get Package By Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Package By Name operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Get Package By Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Package By Slot operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Get Package By Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Package By Slot operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Get Package By Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Reboot Role Instance By Deployment Name operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reboot Role Instance By Deployment Name operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reboot Role Instance By Deployment Slot operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reboot Role Instance By Deployment Slot operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Name operation requests a\n reimage of a role instance that is running in a deployment.This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Name operation requests a\n reimage of a role instance that is running in a deployment.This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Slot operation requests a\n reimage of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Slot operation requests a\n reimage of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Name operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Rollback Update Or Upgrade By\n Deployment Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Name operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Rollback Update Or Upgrade By\n Deployment Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Slot operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Rollback Update Or Upgrade By\n Deployment Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Slot operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Rollback Update Or Upgrade By\n Deployment Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Swap Deployment operation initiates a virtual IP address swap\n between the staging and production deployment environments for a\n service. If the service is currently running in the staging\n environment, it will be swapped to the production environment. If\n it is running in the production environment, it will be swapped to\n staging. For more information on this type of upgrade, see\n Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. Parameters supplied to the Swap Deployment operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Swap Deployment operation initiates a virtual IP address swap\n between the staging and production deployment environments for a\n service. If the service is currently running in the staging\n environment, it will be swapped to the production environment. If\n it is running in the production environment, it will be swapped to\n staging. For more information on this type of upgrade, see\n Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. Parameters supplied to the Swap Deployment operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Name operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Update Deployment Status By\n Deployment Name operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Name operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Update Deployment Status By\n Deployment Name operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Slot operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Update Deployment Status By\n Deployment Slot operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Slot operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Update Deployment Status By\n Deployment Slot operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Name operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The deployment to upgrade.\n \n \n Required. Parameters supplied to the Upgrade Deployment By Name\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Name operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The deployment to upgrade.\n \n \n Required. Parameters supplied to the Upgrade Deployment By Name\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Slot operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The slot to upgrade.\n \n \n Required. Parameters supplied to the Upgrade Deployment By Slot\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Slot operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The slot to upgrade.\n \n \n Required. Parameters supplied to the Upgrade Deployment By Slot\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Name operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Walk Upgrade Domain By\n Deployment Name operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Name operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Walk Upgrade Domain By\n Deployment Name operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Slot operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Walk Upgrade Domain By\n Deployment Slot operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Slot operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Walk Upgrade Domain By\n Deployment Slot operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Service Management API includes operations for managing the hosted\n services beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx for\n more information)\n \n \n \n \n The Service Management API includes operations for managing the hosted\n services beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx for\n more information)\n \n \n \n \n The Add Extension operation adds an available extension to your\n cloud service. In Azure, a process can run as an extension of a\n cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Parameters supplied to the Add Extension operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Begin Adding Extension operation adds an available extension to\n your cloud service. In Azure, a process can run as an extension of\n a cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Parameters supplied to the Begin Adding Extension operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting All Hosted Service operation deletes the\n specified cloud service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Extension operation deletes the specified\n extension from a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The identifier that was assigned to the extension when it was added\n to the cloud service\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Check Hosted Service Name Availability operation checks for the\n availability of the specified cloud service name. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154116.aspx\n for more information)\n \n \n The cloud service name that you would like to use.\n \n \n Cancellation token.\n \n \n The Check Hosted Service Name Availability operation response.\n \n \n \n \n The Create Hosted Service operation creates a new cloud service in\n Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441304.aspx\n for more information)\n \n \n Parameters supplied to the Create Hosted Service operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete All Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Extension operation deletes the specified extension from\n a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The identifier that was assigned to the extension when it was added\n to the cloud service\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Hosted Service Properties operation retrieves system\n properties for the specified cloud service. These properties\n include the service name and service type; and the name of the\n affinity group to which the service belongs, or its location if it\n is not part of an affinity group. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Cancellation token.\n \n \n The Get Hosted Service operation response.\n \n \n \n \n The Get Detailed Hosted Service Properties operation retrieves\n system properties for the specified cloud service. These\n properties include the service name and service type; the name of\n the affinity group to which the service belongs, or its location\n if it is not part of an affinity group; and information on the\n deployments of the service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Cancellation token.\n \n \n The detailed Get Hosted Service operation response.\n \n \n \n \n The Get Extension operation retrieves information about a specified\n extension that was added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169557.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The identifier that was assigned to the extension when it was added\n to the cloud service\n \n \n Cancellation token.\n \n \n The Get Extension operation response.\n \n \n \n \n The List Hosted Services operation lists the cloud services\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460781.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Hosted Service operation response.\n \n \n \n \n The List Available Extensions operation lists the extensions that\n are available to add to your cloud service. In Windows Azure, a\n process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169559.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The List Extensions operation lists all of the extensions that were\n added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169561.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Cancellation token.\n \n \n The List Extensions operation response.\n \n \n \n \n The List Extension Versions operation lists the versions of an\n extension that are available to add to a cloud service. In Azure,\n a process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495437.aspx\n for more information)\n \n \n The provider namespace.\n \n \n The extension type name.\n \n \n Cancellation token.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The Update Hosted Service operation can update the label or\n description of a cloud service in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441303.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Parameters supplied to the Update Hosted Service operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Initializes a new instance of the HostedServiceOperations class.\n \n \n Reference to the service client.\n \n \n \n \n The Add Extension operation adds an available extension to your\n cloud service. In Azure, a process can run as an extension of a\n cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Add Extension operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Begin Adding Extension operation adds an available extension to\n your cloud service. In Azure, a process can run as an extension of\n a cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Begin Adding Extension\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting All Hosted Service operation deletes the\n specified cloud service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Extension operation deletes the specified\n extension from a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Check Hosted Service Name Availability operation checks for the\n availability of the specified cloud service name. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154116.aspx\n for more information)\n \n \n Required. The cloud service name that you would like to use.\n \n \n Cancellation token.\n \n \n The Check Hosted Service Name Availability operation response.\n \n \n \n \n The Create Hosted Service operation creates a new cloud service in\n Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441304.aspx\n for more information)\n \n \n Required. Parameters supplied to the Create Hosted Service\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete All Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Extension operation deletes the specified extension from\n a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Hosted Service Properties operation retrieves system\n properties for the specified cloud service. These properties\n include the service name and service type; and the name of the\n affinity group to which the service belongs, or its location if it\n is not part of an affinity group. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Cancellation token.\n \n \n The Get Hosted Service operation response.\n \n \n \n \n The Get Detailed Hosted Service Properties operation retrieves\n system properties for the specified cloud service. These\n properties include the service name and service type; the name of\n the affinity group to which the service belongs, or its location\n if it is not part of an affinity group; and information on the\n deployments of the service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Cancellation token.\n \n \n The detailed Get Hosted Service operation response.\n \n \n \n \n The Get Extension operation retrieves information about a specified\n extension that was added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169557.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n Cancellation token.\n \n \n The Get Extension operation response.\n \n \n \n \n The List Hosted Services operation lists the cloud services\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460781.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Hosted Service operation response.\n \n \n \n \n The List Available Extensions operation lists the extensions that\n are available to add to your cloud service. In Windows Azure, a\n process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169559.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The List Extensions operation lists all of the extensions that were\n added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169561.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Cancellation token.\n \n \n The List Extensions operation response.\n \n \n \n \n The List Extension Versions operation lists the versions of an\n extension that are available to add to a cloud service. In Azure,\n a process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495437.aspx\n for more information)\n \n \n Required. The provider namespace.\n \n \n Required. The extension type name.\n \n \n Cancellation token.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The Update Hosted Service operation can update the label or\n description of a cloud service in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441303.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Update Hosted Service\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Add Extension operation adds an available extension to your\n cloud service. In Azure, a process can run as an extension of a\n cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Add Extension operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Add Extension operation adds an available extension to your\n cloud service. In Azure, a process can run as an extension of a\n cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Add Extension operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Begin Adding Extension operation adds an available extension to\n your cloud service. In Azure, a process can run as an extension of\n a cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Begin Adding Extension\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Adding Extension operation adds an available extension to\n your cloud service. In Azure, a process can run as an extension of\n a cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Begin Adding Extension\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting All Hosted Service operation deletes the\n specified cloud service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting All Hosted Service operation deletes the\n specified cloud service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Extension operation deletes the specified\n extension from a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Extension operation deletes the specified\n extension from a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Check Hosted Service Name Availability operation checks for the\n availability of the specified cloud service name. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154116.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The cloud service name that you would like to use.\n \n \n The Check Hosted Service Name Availability operation response.\n \n \n \n \n The Check Hosted Service Name Availability operation checks for the\n availability of the specified cloud service name. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154116.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The cloud service name that you would like to use.\n \n \n The Check Hosted Service Name Availability operation response.\n \n \n \n \n The Create Hosted Service operation creates a new cloud service in\n Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441304.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. Parameters supplied to the Create Hosted Service\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Hosted Service operation creates a new cloud service in\n Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441304.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. Parameters supplied to the Create Hosted Service\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete All Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete All Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Extension operation deletes the specified extension from\n a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Extension operation deletes the specified extension from\n a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Hosted Service Properties operation retrieves system\n properties for the specified cloud service. These properties\n include the service name and service type; and the name of the\n affinity group to which the service belongs, or its location if it\n is not part of an affinity group. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The Get Hosted Service operation response.\n \n \n \n \n The Get Hosted Service Properties operation retrieves system\n properties for the specified cloud service. These properties\n include the service name and service type; and the name of the\n affinity group to which the service belongs, or its location if it\n is not part of an affinity group. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The Get Hosted Service operation response.\n \n \n \n \n The Get Detailed Hosted Service Properties operation retrieves\n system properties for the specified cloud service. These\n properties include the service name and service type; the name of\n the affinity group to which the service belongs, or its location\n if it is not part of an affinity group; and information on the\n deployments of the service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The detailed Get Hosted Service operation response.\n \n \n \n \n The Get Detailed Hosted Service Properties operation retrieves\n system properties for the specified cloud service. These\n properties include the service name and service type; the name of\n the affinity group to which the service belongs, or its location\n if it is not part of an affinity group; and information on the\n deployments of the service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The detailed Get Hosted Service operation response.\n \n \n \n \n The Get Extension operation retrieves information about a specified\n extension that was added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169557.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n The Get Extension operation response.\n \n \n \n \n The Get Extension operation retrieves information about a specified\n extension that was added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169557.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n The Get Extension operation response.\n \n \n \n \n The List Hosted Services operation lists the cloud services\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460781.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n The List Hosted Service operation response.\n \n \n \n \n The List Hosted Services operation lists the cloud services\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460781.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n The List Hosted Service operation response.\n \n \n \n \n The List Available Extensions operation lists the extensions that\n are available to add to your cloud service. In Windows Azure, a\n process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169559.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The List Available Extensions operation lists the extensions that\n are available to add to your cloud service. In Windows Azure, a\n process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169559.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The List Extensions operation lists all of the extensions that were\n added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169561.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The List Extensions operation response.\n \n \n \n \n The List Extensions operation lists all of the extensions that were\n added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169561.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The List Extensions operation response.\n \n \n \n \n The List Extension Versions operation lists the versions of an\n extension that are available to add to a cloud service. In Azure,\n a process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495437.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The provider namespace.\n \n \n Required. The extension type name.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The List Extension Versions operation lists the versions of an\n extension that are available to add to a cloud service. In Azure,\n a process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495437.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The provider namespace.\n \n \n Required. The extension type name.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The Update Hosted Service operation can update the label or\n description of a cloud service in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441303.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Update Hosted Service\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Update Hosted Service operation can update the label or\n description of a cloud service in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441303.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Update Hosted Service\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Compute Management API includes operations for managing the load\n balancers for your subscription.\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n The name of the service.\n \n \n The name of the deployment.\n \n \n Parameters supplied to the Create Load Balancer operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n The name of the service.\n \n \n The name of the deployment.\n \n \n The name of the load balancer.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n The name of the service.\n \n \n The name of the deployment.\n \n \n Parameters supplied to the Create Load Balancer operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n The name of the service.\n \n \n The name of the deployment.\n \n \n The name of the load balancer.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Operations for determining the version of the Azure Guest Operating\n System on which your service is running. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684169.aspx for\n more information)\n \n \n \n \n The List Operating Systems operation lists the versions of the\n guest operating system that are currently available in Windows\n Azure. The 2010-10-28 version of List Operating Systems also\n indicates what family an operating system version belongs to.\n Currently Azure supports two operating system families: the Azure\n guest operating system that is substantially compatible with\n Windows Server 2008 SP2, and the Azure guest operating system that\n is substantially compatible with Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684168.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Operating Systems operation response.\n \n \n \n \n The List OS Families operation lists the guest operating system\n families available in Azure, and also lists the operating system\n versions available for each family. Currently Azure supports two\n operating system families: the Azure guest operating system that\n is substantially compatible with Windows Server 2008 SP2, and the\n Azure guest operating system that is substantially compatible with\n Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441291.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Operating System Families operation response.\n \n \n \n \n Operations for managing service certificates for your subscription.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee795178.aspx for\n more information)\n \n \n \n \n The Begin Creating Service Certificate operation adds a certificate\n to a hosted service. This operation is an asynchronous operation.\n To determine whether the management service has finished\n processing the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n The DNS prefix name of your service.\n \n \n Parameters supplied to the Begin Creating Service Certificate\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Parameters supplied to the Begin Deleting Service Certificate\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Service Certificate operation adds a certificate to a\n hosted service. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n The DNS prefix name of your service.\n \n \n Parameters supplied to the Create Service Certificate operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Parameters supplied to the Delete Service Certificate operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Service Certificate operation returns the public data for\n the specified X.509 certificate associated with a hosted service.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460792.aspx\n for more information)\n \n \n Parameters supplied to the Get Service Certificate operation.\n \n \n Cancellation token.\n \n \n The Get Service Certificate operation response.\n \n \n \n \n The List Service Certificates operation lists all of the service\n certificates associated with the specified hosted service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154105.aspx\n for more information)\n \n \n The DNS prefix name of your hosted service.\n \n \n Cancellation token.\n \n \n The List Service Certificates operation response.\n \n \n \n \n The Service Management API includes operations for managing the disks\n in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157188.aspx for\n more information)\n \n \n \n \n The Begin Deleting Data Disk operation removes the specified data\n disk from a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of the deployment.\n \n \n The name of the role to delete the data disk from.\n \n \n The logical unit number of the disk.\n \n \n Specifies that the source blob for the disk should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Data Disk operation adds a data disk to a virtual\n machine. There are three ways to create the data disk using the\n Add Data Disk operation. Option 1 - Attach an empty data disk to\n the role by specifying the disk label and location of the disk\n image. Do not include the DiskName and SourceMediaLink elements in\n the request body. Include the MediaLink element and reference a\n blob that is in the same geographical region as the role. You can\n also omit the MediaLink element. In this usage, Azure will create\n the data disk in the storage account configured as default for the\n role. Option 2 - Attach an existing data disk that is in the image\n repository. Do not include the DiskName and SourceMediaLink\n elements in the request body. Specify the data disk to use by\n including the DiskName element. Note: If included the in the\n response body, the MediaLink and LogicalDiskSizeInGB elements are\n ignored. Option 3 - Specify the location of a blob in your storage\n account that contain a disk image to use. Include the\n SourceMediaLink element. Note: If the MediaLink element\n isincluded, it is ignored. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157199.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of the deployment.\n \n \n The name of the role to add the data disk to.\n \n \n Parameters supplied to the Create Virtual Machine Data Disk\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Parameters supplied to the Create Virtual Machine Disk operation.\n \n \n Cancellation token.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Delete Data Disk operation removes the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of the deployment.\n \n \n The name of the role to delete the data disk from.\n \n \n The logical unit number of the disk.\n \n \n Specifies that the source blob for the disk should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Disk operation deletes the specified data or operating\n system disk from your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157200.aspx\n for more information)\n \n \n The name of the disk to delete.\n \n \n Specifies that the source blob for the disk should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Data Disk operation retrieves the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157180.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of the deployment.\n \n \n The name of the role.\n \n \n The logical unit number of the disk.\n \n \n Cancellation token.\n \n \n The Get Data Disk operation response.\n \n \n \n \n The Get Disk operation retrieves a disk from the user image\n repository. The disk can be an operating system disk or a data\n disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n The name of the disk.\n \n \n Cancellation token.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The List Disks operation retrieves a list of the disks in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157176.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Disks operation response.\n \n \n \n \n The Update Data Disk operation updates the specified data disk\n attached to the specified virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157190.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of the deployment.\n \n \n The name of the role to add the data disk to.\n \n \n The logical unit number of the disk.\n \n \n Parameters supplied to the Update Virtual Machine Data Disk\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Add Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n The name of the disk being updated.\n \n \n Parameters supplied to the Update Virtual Machine Disk operation.\n \n \n Cancellation token.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Service Management API includes operations for managing the virtual\n machine extensions in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx for\n more information)\n \n \n \n \n The List Resource Extensions operation lists the resource\n extensions that are available to add to a Virtual Machine. In\n Azure, a process can run as a resource extension of a Virtual\n Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495441.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n The List Resource Extension Versions operation lists the versions\n of a resource extension that are available to add to a Virtual\n Machine. In Azure, a process can run as a resource extension of a\n Virtual Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495440.aspx\n for more information)\n \n \n The name of the publisher.\n \n \n The name of the extension.\n \n \n Cancellation token.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n The Service Management API includes operations for managing the virtual\n machines in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx for\n more information)\n \n \n \n \n The Begin Capturing Role operation creates a copy of the operating\n system virtual hard disk (VHD) that is deployed in the virtual\n machine, saves the VHD copy in the same storage location as the\n operating system VHD, and registers the copy as an image in your\n image gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to restart.\n \n \n Parameters supplied to the Begin Capturing Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Begin capturing role as VM template.\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to restart.\n \n \n Parameters supplied to the Capture Virtual Machine operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Role operation adds a virtual machine to an\n existing deployment. You can refer to the OSDisk in the Add Role\n operation in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Begin Creating Virtual Machine operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Virtual Machine Deployment operation provisions\n a virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n The name of your service.\n \n \n Parameters supplied to the Begin Creating Virtual Machine\n Deployment operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Role operation deletes the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to delete.\n \n \n Specifies that the source blob(s) for the virtual machine should\n also be deleted from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Restarting role operation restarts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to restart.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to shutdown.\n \n \n The parameters for the shutdown vm operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Shutting Down Roles operation stops the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469421.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters to pass to the Begin Shutting Down Roles operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Role operation starts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to start.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Roles operation starts the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469419.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters to pass to the Begin Starting Roles operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Role operation adds a virtual machine to an\n existing deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of your virtual machine.\n \n \n Parameters supplied to the Begin Updating Virtual Machine operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469417.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Begin Updating Load Balanced Endpoint\n Set operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Capture Role operation creates a copy of the operating system\n virtual hard disk (VHD) that is deployed in the virtual machine,\n saves the VHD copy in the same storage location as the operating\n system VHD, and registers the copy as an image in your image\n gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to restart.\n \n \n Parameters supplied to the Capture Virtual Machine operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Capture role as VM template.\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to restart.\n \n \n Parameters supplied to the Capture Virtual Machine operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Role operation adds a virtual machine to an existing\n deployment. You can refer to the OSDisk in the Add Role operation\n in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Create Virtual Machine operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Virtual Machine Deployment operation provisions a\n virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n The name of your service.\n \n \n Parameters supplied to the Create Virtual Machine Deployment\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role operation deletes the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to delete.\n \n \n Specifies that the source blob(s) for the virtual machine should\n also be deleted from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Role operation retrieves information about the specified\n virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157193.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine.\n \n \n Cancellation token.\n \n \n The Get Virtual Machine operation response.\n \n \n \n \n The Download RDP file operation retrieves the Remote Desktop\n Protocol configuration file from the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157183.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine.\n \n \n Cancellation token.\n \n \n The Download RDP file operation response.\n \n \n \n \n The Restart role operation restarts the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to restart.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to shutdown.\n \n \n The parameters for the shutdown virtual machine operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Roles operation stops the specified set of virtual\n machines.\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters to pass to the Shutdown Roles operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Role operation starts the specified virtual machine.\n (see http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to start.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Roles operation starts the specified set of virtual\n machines.\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters to pass to the Start Roles operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Role operation adds a virtual machine to an existing\n deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of your virtual machine.\n \n \n Parameters supplied to the Update Virtual Machine operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole.\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Update Load Balanced Endpoint Set\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Service Management API includes operations for managing the OS\n images in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157175.aspx for\n more information)\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n The name of the virtual machine image to share.\n \n \n The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n The name of the virtual machine image to replicate. Note: The OS\n Image Name should be the user OS Image, not the published name of\n the OS Image.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create OS Image operation adds an operating system image that\n is stored in a storage account and is available from the image\n repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157192.aspx\n for more information)\n \n \n Parameters supplied to the Create Virtual Machine Image operation.\n \n \n Cancellation token.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n The Delete OS Image operation deletes the specified OS image from\n your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157203.aspx\n for more information)\n \n \n The name of the image to delete.\n \n \n Specifies that the source blob for the image should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get OS Image operation retrieves the details for an operating\n system image from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n The name of the OS image to retrieve.\n \n \n Cancellation token.\n \n \n A virtual machine image associated with your subscription.\n \n \n \n \n Gets OS Image's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n The name of the virtual machine image to replicate.\n \n \n Cancellation token.\n \n \n The Get Details OS Images operation response.\n \n \n \n \n The List OS Images operation retrieves a list of the operating\n system images from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List OS Images operation response.\n \n \n \n \n Replicate an OS image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n The name of the virtual machine OS image to replicate.\n \n \n Parameters supplied to the Replicate Virtual Machine Image\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n The name of the virtual machine image to share.\n \n \n The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n The name of the virtual machine image to replicate. Note: The OS\n Image Name should be the user OS Image, not the published name of\n the OS Image.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update OS Image operation updates an OS image that in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157198.aspx\n for more information)\n \n \n The name of the virtual machine image to be updated.\n \n \n Parameters supplied to the Update Virtual Machine Image operation.\n \n \n Cancellation token.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n The Service Management API includes operations for managing the virtual\n machine templates in your subscription.\n \n \n \n \n The Begin Deleting Virtual Machine Image operation deletes the\n specified virtual machine image.\n \n \n The name of the virtual machine image to delete.\n \n \n Specifies that the source blob for the image should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n The name of the virtual machine image to share.\n \n \n The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n The name of the virtual machine image to replicate. Note: The VM\n Image Name should be the user VM Image, not the published name of\n the VM Image.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Virtual Machine Image operation deletes the specified\n virtual machine image.\n \n \n The name of the virtual machine image to delete.\n \n \n Specifies that the source blob for the image should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets VMImage's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n The name of the virtual machine image to replicate.\n \n \n Cancellation token.\n \n \n The Get Details VM Images operation response.\n \n \n \n \n The List Virtual Machine Images operation retrieves a list of the\n virtual machine images.\n \n \n Cancellation token.\n \n \n The List VM Images operation response.\n \n \n \n \n Replicate an VM image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n The name of the virtual machine image to replicate.\n \n \n Parameters supplied to the Replicate Virtual Machine Image\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n The name of the virtual machine image to share.\n \n \n The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n The name of the virtual machine image to replicate. Note: The VM\n Image Name should be the user VM Image, not the published name of\n the VM Image.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update VM Image operation updates a VM image that in your image\n repository.\n \n \n The name of the virtual machine image to be updated.\n \n \n Parameters supplied to the Update Virtual Machine Image operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Compute Management API includes operations for managing the load\n balancers for your subscription.\n \n \n \n \n Initializes a new instance of the LoadBalancerOperations class.\n \n \n Reference to the service client.\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. Parameters supplied to the Create Load Balancer operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the load balancer.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. Parameters supplied to the Create Load Balancer operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the load balancer.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. Parameters supplied to the Create Load Balancer operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. Parameters supplied to the Create Load Balancer operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the load balancer.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the load balancer.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. Parameters supplied to the Create Load Balancer operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. Parameters supplied to the Create Load Balancer operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the load balancer.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the load balancer.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n An access control rule for a public endpoint.\n \n \n \n \n Initializes a new instance of the AccessControlListRule class.\n \n \n \n \n Optional. The action allowed by this Access Control List Rule.\n \n \n \n \n Optional. The description for this Access Control List Rule.\n \n \n \n \n Optional. The order of application for this Access Control List\n Rule.\n \n \n \n \n Optional. The remote subnet that is granted access for this Access\n Control List Rule.\n \n \n \n \n The service certificate format. Azure supports the pfx and cer file\n formats.\n \n \n \n \n Algorithm that was used to hash a service certificate.\n \n \n \n \n The compute capabilities.\n \n \n \n \n Initializes a new instance of the ComputeCapabilities class.\n \n \n \n \n Optional. Role sizes support for IaaS deployments.\n \n \n \n \n Optional. Role sizes support for PaaS deployments.\n \n \n \n \n Objects that provide system or application data.\n \n \n \n \n Initializes a new instance of the ConfigurationSet class.\n \n \n \n \n Optional. Specifies the string representing the administrator\n password to use for the virtual machine. If the VM will be created\n from a 'Specialized' VM image, the password is not required.\n \n \n \n \n Optional. Specifies the name that is used to rename the default\n administrator account. If the VM will be created from a\n 'Specialized' VM image, the user name is not required.\n \n \n \n \n Optional. Specifies the computer name for the virtual machine. If\n the computer name is not specified, a name is created based on the\n name of the role. Computer names must be 1 to 15 characters in\n length. This element is only used with the\n WindowsProvisioningConfiguration set.\n \n \n \n \n Optional. Specifies the configuration type for the configuration\n set.\n \n \n \n \n Optional. Optional. Provides base64 encoded custom data to be\n passed to VM.\n \n \n \n \n Optional. Specifies whether or not SSH authentication is disabled\n for the password. This element is only used with the\n LinuxProvisioningConfiguration set. By default this value is set\n to true.\n \n \n \n \n Optional. Contains properties that specify a domain to which the\n virtual machine will be joined. This element is only used with the\n WindowsProvisioningConfiguration set.\n \n \n \n \n Optional. Specifies whether automatic updates are enabled for the\n virtual machine. This element is only used with the\n WindowsProvisioningConfiguration set. The default value is false.\n \n \n \n \n Optional. Specifies the host name for the VM. Host names are ASCII\n character strings 1 to 64 characters in length. This element is\n only used with the LinuxProvisioningConfiguration set.\n \n \n \n \n Optional. Contains a collection of external endpoints for the\n virtual machine. This element is only used with the\n NetworkConfigurationSet type.\n \n \n \n \n Optional. Optional. A set of public IPs. Currently, only one\n additional public IP per role is supported in an IaaS deployment.\n The IP address is in addition to the default VIP for the\n deployment.\n \n \n \n \n Optional. Specifies whether password should be reset the first time\n the administrator logs in.\n \n \n \n \n Optional. Specifies the SSH public keys and key pairs to populate\n in the image during provisioning. This element is only used with\n the LinuxProvisioningConfiguration set.\n \n \n \n \n Optional. Specifies a Customer Address, i.e. an IP address assigned\n to a VM in a VNet's SubNet. For example: 10.0.0.4.\n \n \n \n \n Optional. Contains a list of service certificates with which to\n provision to the new role. This element is only used with the\n WindowsProvisioningConfiguration set.\n \n \n \n \n Optional. The list of Virtual Network subnet names that the\n deployment belongs to. This element is only used with the\n NetworkConfigurationSet type.\n \n \n \n \n Optional. Specifies the time zone for the virtual machine. This\n element is only used with the WindowsProvisioningConfiguration\n set. For a complete list of supported time zone entries, you can\n refer to the values listed in the registry entry\n HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\n NT\\\\CurrentVersion\\\\Time Zones on a computer running Windows 7,\n Windows Server 2008, and Windows Server 2008 R2 or you can use the\n tzutil command-line tool to list the valid time. The tzutil tool\n is installed by default on Windows 7, Windows Server 2008, and\n Windows Server 2008 R2.\n \n \n \n \n Optional. Specifies the name of a user to be created in the sudoer\n group of the virtual machine. User names are ASCII character\n strings 1 to 32 characters in length. This element is only used\n with the LinuxProvisioningConfiguration set.\n \n \n \n \n Optional. Specifies the password for user name. Passwords are ASCII\n character strings 6 to 72 characters in length. This element is\n only used with the LinuxProvisioningConfiguration set.\n \n \n \n \n Optional. Configures the Windows Remote Management service on the\n virtual machine, which enables remote Windows PowerShell.\n \n \n \n \n An additional public IP that will be created for the role. The\n public IP will be an additional IP for the role. The role\n continues to be addressable via the default deployment VIP.\n \n \n \n \n Initializes a new instance of the PublicIP class.\n \n \n \n \n Optional. The name of the public IP.\n \n \n \n \n Specifies the configuration type for the configuration set.\n \n \n \n \n The data disk configuration.\n \n \n \n \n Initializes a new instance of the\n DataDiskConfigurationUpdateParameters class.\n \n \n \n \n Optional. Optional. Host caching option for a data disk within the\n VM Image. 'ReadOnly', 'ReadWrite', or 'None'.If this parameter is\n specified you must also specify the Name for the\n DataDiskConfiguration you want to change.\n \n \n \n \n Optional. Optional. LUN for the data disk. LUNs must not conflict\n with other Data Disks in the VM Image. If this parameter is\n specified you must also specify the Name for the\n DataDiskConfiguration you want to change.\n \n \n \n \n Optional. Optional if not changing any data disk configurations.\n Name of an existing DataDiskConfiguration. The name cannot be\n changed, this is just to identify the disk for changing other\n properties.\n \n \n \n \n Objects that are used to create a data disk for a virtual machine.\n \n \n \n \n Initializes a new instance of the DataVirtualHardDisk class.\n \n \n \n \n Optional. Specifies the platform caching behavior of the data disk\n blob for read/write efficiency. The default value is ReadOnly.\n \n \n \n \n Optional. Specifies the friendly name of the VHD used to create the\n data disk for the virtual machine.\n \n \n \n \n Optional. Specifies the size, in GB, of an empty VHD to be attached\n to the virtual machine. The VHD can be created as part of an\n attached disk or created as a virtual machine call by specifying\n the value for this property. Azure creates the empty VHD based on\n the size preference and attaches the newly created VHD to the\n virtual machine.\n \n \n \n \n Optional. Specifies the Logical Unit Number (LUN) for the data\n disk. The LUN specifies the slot in which the data drive appears\n when mounted for usage by the virtual machine. This element is\n only listed when more than one data disk is attached to a virtual\n machine.\n \n \n \n \n Optional. Optional. If the disk that is being added is already\n registered in the subscription or the VHD for the disk already\n exists in blob storage, this element is ignored. If a VHD file\n does not exist in blob storage, this element defines the location\n of the new VHD that is created when the new disk is added.Example:\n http://example.blob.core.windows.net/disks/mydatadisk.vhd\n \n \n \n \n Optional. Specifies the name of the VHD used to create the data\n disk for the virtual machine.\n \n \n \n \n Optional. Optional. If the disk that is being added is already\n registered in the subscription or the VHD for the disk does not\n exist in blob storage, this element is ignored. If the VHD file\n exists in blob storage, this element defines the path to the VHD\n and a disk is registered from it and attached to the virtual\n machine.\n \n \n \n \n Parameters supplied to the Change Configuration Deployment operation.\n \n \n \n \n Initializes a new instance of the\n DeploymentChangeConfigurationParameters class.\n \n \n \n \n Required. The encoded service configuration file for the deployment.\n \n \n \n \n Optional. Represents the name of an extended deployment property.\n Each extended property must have a defined name and a value. You\n can have a maximum of 25 extended property name/value pairs. The\n maximum length of the name element is 64 characters, only\n alphanumeric characters and underscores are valid in the name, and\n the name must start with a letter. Attempting to use other\n characters, starting the name with a non-letter character, or\n entering a name that is identical to that of another extended\n property owned by the same hosted service will result in a status\n code 400 (Bad Request) error.\n \n \n \n \n Optional. Represents an extension that is added to the cloud\n service. In Azure, a process can run as an extension of a cloud\n service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n must add an extension to the cloud service by using Add Extension\n before it can be added to the deployment.\n \n \n \n \n Optional. The Change Configuration Deployment mode. Possible values\n are: Auto and Manual. If not specified, the default value is Auto.\n If set to Manual, WalkUpgradeDomain must be called to apply the\n update. If set to Auto, the update is automatically applied to\n each update domain for the service.\n \n \n \n \n Optional. Indicates whether to treat package validation warnings as\n errors. The default value is false. If set to true, the Created\n Deployment operation fails if there are validation warnings on the\n service package.\n \n \n \n \n Parameters supplied to the Create Deployment operation.\n \n \n \n \n Initializes a new instance of the DeploymentCreateParameters class.\n \n \n \n \n Required. The service configuration file for the deployment.\n \n \n \n \n Optional. Represents the name of an extended deployment property.\n Each extended property must have a defined name and a value. You\n can have a maximum of 25 extended property name/value pairs. The\n maximum length of the name element is 64 characters, only\n alphanumeric characters and underscores are valid in the name, and\n the name must start with a letter. Attempting to use other\n characters, starting the name with a non-letter character, or\n entering a name that is identical to that of another extended\n property owned by the same hosted service will result in a status\n code 400 (Bad Request) error.\n \n \n \n \n Optional. Represents an extension that is added to the cloud\n service. In Azure, a process can run as an extension of a cloud\n service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n must add an extension to the cloud service by using Add Extension\n before it can be added to the deployment.\n \n \n \n \n Required. A name for the hosted service. The name can be up to 100\n characters in length. It is recommended that the label be unique\n within the subscription. The name can be used identify the hosted\n service for your tracking purposes.\n \n \n \n \n Required. The name for the deployment. The deployment name must be\n unique among other deployments for the cloud service.\n \n \n \n \n Required. A URL that refers to the location of the service package\n in the Blob service. The service package can be located either in\n a storage account beneath the same subscription or a Shared Access\n Signature (SAS) URI from any storage account. For more info about\n Shared Access Signatures, see Delegating Access with a Shared\n Access Signature (REST API) at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee395415.aspx.\n \n \n \n \n Optional. Indicates whether to start the deployment immediately\n after it is created. The default value is false. If false, the\n service model is still deployed to the virtual machines but the\n code is not run immediately. Instead, the service is Suspended\n until you call Update Deployment Status and set the status\n toRunning, at which time the service will be started. A deployed\n service still incurs charges, even if it is suspended.\n \n \n \n \n Optional. Indicates whether to treat package validation warnings as\n errors. The default value is false. If set to true, the Created\n Deployment operation fails if there are validation warnings on the\n service package.\n \n \n \n \n Parameters supplied to the delete role instance by deployment name\n operation.\n \n \n \n \n Initializes a new instance of the\n DeploymentDeleteRoleInstanceParameters class.\n \n \n \n \n Optional.\n \n \n \n \n Parameters supplied to the Get Package operation.\n \n \n \n \n Initializes a new instance of the DeploymentGetPackageParameters\n class.\n \n \n \n \n Required. Specifies the URI of the container to which the packages\n will be saved.\n \n \n \n \n Optional. Specifies whether an existing package in the storage\n container should be overwritten.\n \n \n \n \n A deployment that exists in the cloud service.\n \n \n \n \n Initializes a new instance of the DeploymentGetResponse class.\n \n \n \n \n Optional. The configuration file of the deployment.\n \n \n \n \n Optional. The time that the deployment was created.\n \n \n \n \n Optional. The deployment environment in which this deployment is\n running.\n \n \n \n \n Optional. The custom DNS settings that are specified for deployment.\n \n \n \n \n Optional. Represents the name of an extended cloud service\n property. Each extended property must have a defined name and a\n value. You can have a maximum of 50 extended property name and\n value pairs. The maximum length of the name element is 64\n characters, only alphanumeric characters and underscores are valid\n in the name, and it must start with a letter. Attempting to use\n other characters, starting with a non-letter character, or\n entering a name that is identical to that of another extended\n property owned by the same service will result in a status code\n 400 (Bad Request) error. Each extended property value has a\n maximum length of 255 characters.\n \n \n \n \n Optional. Represents an extension that is added to the cloud\n service.\n \n \n \n \n Optional. The user-supplied name of the deployment. This name can\n be used identify the deployment for tracking purposes.\n \n \n \n \n Optional. The last time that the deployment was modified.\n \n \n \n \n Optional. Optional. A list of internal load balancers that each\n provide load balancing on a private VIP. It's created when a name\n is assigned in the list here.\n \n \n \n \n Optional. Indicates whether the deployment is locked for new write\n operations because an existing operation is updating the\n deployment.\n \n \n \n \n Optional.\n \n \n \n \n Optional. Specifies information about when the virtual machine has\n been started and stopped.\n \n \n \n \n Optional. The unique identifier for this deployment.\n \n \n \n \n Optional. The name of the Reserved IP that the deployment belongs\n to.\n \n \n \n \n Optional. The list of role instances in the deployment.\n \n \n \n \n Optional. The list of roles in the deployment.\n \n \n \n \n Optional. Indicates whether the Rollback Update Or Upgrade\n operation is allowed at this time.\n \n \n \n \n Optional. The version of the Azure SDK that was used to generate\n the .cspkg that created this deployment. The first two numerical\n components of the returned version represent the version of the\n SDK used to create the package.\n \n \n \n \n Optional. The status of the deployment.\n \n \n \n \n Optional. The number of upgrade domains available to this cloud\n service.\n \n \n \n \n Optional. Information about an update occurring on the deployment.\n \n \n \n \n Optional. The URL used to access the hosted service. For example,\n if the service name is MyService you could access the access the\n service by calling: http://MyService.cloudapp.net.\n \n \n \n \n Optional. The virtual IP addresses that are specified for the\n deployment.\n \n \n \n \n Optional. The name of the Virtual Network that the virtual machine\n connects to.\n \n \n \n \n Parameters supplied to the Rollback Update Or Upgrade operation.\n \n \n \n \n Initializes a new instance of the\n DeploymentRollbackUpdateOrUpgradeParameters class.\n \n \n \n \n Optional. Specifies whether the rollback should proceed even when\n it will cause local data to be lost from some role instances. True\n if the rollback should proceed; otherwise false.\n \n \n \n \n Required. Specifies whether the rollback should proceed\n automatically.\n \n \n \n \n The deployment environment in which this deployment is running.\n \n \n \n \n The status of the deployment.\n \n \n \n \n Parameters supplied to the Swap Deployment operation.\n \n \n \n \n Initializes a new instance of the DeploymentSwapParameters class.\n \n \n \n \n Optional. The optional name of the production deployment.\n \n \n \n \n Required. The name of the source deployment.\n \n \n \n \n Parameters supplied to the Update Deployment Status operation.\n \n \n \n \n Initializes a new instance of the DeploymentUpdateStatusParameters\n class.\n \n \n \n \n Required. The new status of the deployment.\n \n \n \n \n Parameters supplied to the Upgrade Deployment operation.\n \n \n \n \n Initializes a new instance of the DeploymentUpgradeParameters class.\n \n \n \n \n Required. The service configuration file for the deployment.\n \n \n \n \n Optional. Represents the name of an extended deployment property.\n Each extended property must have a defined name and a value. You\n can have a maximum of 25 extended property name/value pairs. The\n maximum length of the name element is 64 characters, only\n alphanumeric characters and underscores are valid in the name, and\n the name must start with a letter. Attempting to use other\n characters, starting the name with a non-letter character, or\n entering a name that is identical to that of another extended\n property owned by the same hosted service will result in a status\n code 400 (Bad Request) error.\n \n \n \n \n Optional. Represents an extension that is added to the cloud\n service. In Azure, a process can run as an extension of a cloud\n service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n must add an extension to the cloud service by using Add Extension\n before it can be added to the deployment.\n \n \n \n \n Required. Specifies whether the rollback should proceed even when\n it will cause local data to be lost from some role instances.\n \n \n \n \n Required. A name for the hosted service. The name can be up to 100\n characters in length. It is recommended that the label be unique\n within the subscription. The name can be used identify the hosted\n service for your tracking purposes.\n \n \n \n \n Required. The type of update to initiate. Role instances are\n allocated to update domains when the service is deployed. Updates\n can be initiated manually in each update domain or initiated\n automatically in all update domains. Possible values are Auto or\n Manual. If not specified, the default value is Auto. If set to\n Manual, WalkUpgradeDomain must be called to apply the update. If\n set to Auto, the update is automatically applied to each update\n domain in sequence.\n \n \n \n \n Required. A URL that refers to the location of the service package\n in the Blob service. The service package can be located either in\n a storage account beneath the same subscription or a Shared Access\n Signature (SAS) URI from any storage account. For more information\n about Shared Access Signatures, see Delegating Access with a\n Shared Access Signature (REST API) at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee395415.aspx.\n \n \n \n \n Optional. The name of the specific role instance to update.\n \n \n \n \n The type of the upgrade.\n \n \n \n \n Parameters supplied to the Walk Upgrade Domain operation.\n \n \n \n \n Initializes a new instance of the\n DeploymentWalkUpgradeDomainParameters class.\n \n \n \n \n Required. An integer value that identifies the update domain to\n update. Update domains are identified with a zero-based index: the\n first update domain has an ID of 0, the second has an ID of 1, and\n so on.\n \n \n \n \n Information about a DNS Server in the virtual network.\n \n \n \n \n Initializes a new instance of the DnsServer class.\n \n \n \n \n Optional. The DNS server address.\n \n \n \n \n Optional. The name of the DNS server.\n \n \n \n \n The custom DNS settings that are specified for the deployment.\n \n \n \n \n Initializes a new instance of the DnsSettings class.\n \n \n \n \n Optional. Contains a collection of objects that define the DNS\n server settings.\n \n \n \n \n Specifies the values to use to join the virtual machine to the domain.\n \n \n \n \n Initializes a new instance of the DomainJoinCredentials class.\n \n \n \n \n Optional. Specifies the name of the domain used to authenticate an\n account. The value is a fully qualified DNS domain. If the domains\n name is not specified, Username must specify the user principal\n name (UPN) format (user@fully-qualified-DNS-domain) or the\n fully-qualified-DNS-domain\\\\username format. Example: example.com.\n \n \n \n \n Required. Specifies the password to use to join the domain.\n \n \n \n \n Required. Specifies a user name in the domain that can be used to\n join the domain.\n \n \n \n \n The configuration needed to provision the machine in the domain.\n \n \n \n \n Initializes a new instance of the DomainJoinProvisioning class.\n \n \n \n \n Optional. The account info for joining the domain.\n \n \n \n \n Contains properties that specify a domain to which the virtual machine\n will be joined. This element is only used with the\n WindowsProvisioningConfiguration set.\n \n \n \n \n Initializes a new instance of the DomainJoinSettings class.\n \n \n \n \n Optional. Specifies the values to use to join the virtual machine\n to the domain.\n \n \n \n \n Optional. Specifies the domain to join.\n \n \n \n \n Optional. Specifies the Lightweight Directory Access Protocol\n (LDAP) X 500-distinguished name of the organizational unit (OU) in\n which the computer account is created. This account is in Active\n Directory on a domain controller in the domain to which the\n computer is being joined. Example:\n OU=MyOu,OU=MyParentOu,DC=example.com,DC=MyCompany,DC=com.\n \n \n \n \n Optional. Additional information for domain join provisioning.\n \n \n \n \n The set of access control rules for the endpoint.\n \n \n \n \n Initializes a new instance of the EndpointAcl class.\n \n \n \n \n Optional. The set of access control rules for the endpoint.\n \n \n \n \n Represents an extension that is added to the cloud service.\n \n \n \n \n Initializes a new instance of the ExtensionConfiguration class.\n \n \n \n \n Optional. Specifies a list of extensions that are applied to all\n roles in a deployment.\n \n \n \n \n Optional. Specifies a list of extensions that are applied to\n specific roles in a deployment.\n \n \n \n \n Represents an extension that is to be deployed to a role in a cloud\n service.\n \n \n \n \n Initializes a new instance of the Extension class.\n \n \n \n \n Required. The identifier of the extension. The identifier is\n created when the extension is added to the cloud service. You\n can find the ID of an extension that was added to a cloud\n service by using List Extensions.\n \n \n \n \n Specifies a list of extensions that are applied to specific roles\n in a deployment.\n \n \n \n \n Initializes a new instance of the NamedRole class.\n \n \n \n \n Required. Represents an extension that is to be deployed to a\n role in a cloud service.\n \n \n \n \n Required. Specifies the name of the role.\n \n \n \n \n The configuration for the virtual IP address (VIP) this load balancer\n provides.\n \n \n \n \n Initializes a new instance of the FrontendIPConfiguration class.\n \n \n \n \n Optional. If the deployment exists inside a virtual network, a\n specific address from the load balancer subnet can be specified.\n The VIP for the load balancer will then be this specific IP\n address. If a static virtual network IP address is provided, the\n SubnetName element of the load balancer must be specified as well.\n If the deployment exists outside of a virtual network, no static\n virtual network IP address can be specified.\n \n \n \n \n Optional. If the deployment exists inside a virtual network, a\n subnet of that virtual network must be specified for the load\n balancer. The VIP managed by the load balancer will then be an IP\n address out of this subnet. If the deployment exists outside of a\n virtual network, no subnet can be specified and the private VIP\n will be an IP address from the general private address pool.\n \n \n \n \n Optional. The type of the VIP provided by this load balancer.\n Currently, only 'Private' is supported. This will create load\n balancing services on a private VIP.\n \n \n \n \n The type of the VIP provided by this load balancer. Currently, only\n 'Private' is supported. This will create load balancing services on a\n private VIP.\n \n \n \n \n This object encapsulates a localized status message from the Guest\n Agent.\n \n \n \n \n Initializes a new instance of the GuestAgentFormattedMessage class.\n \n \n \n \n Optional. Language code. Eg. \"en-US\".\n \n \n \n \n Optional. A string containing a message about the status of the\n Guest Agent or Resource Extension.\n \n \n \n \n The guest agent message.\n \n \n \n \n Initializes a new instance of the GuestAgentMessage class.\n \n \n \n \n Optional. The message resource ID.\n \n \n \n \n Optional. The guest agent message parameter list.\n \n \n \n \n Optional. This object contains status information of the Guest Agent\n installed on a RoleInstance. Guest Agent can be installed on a role\n instance by setting \"ProvisionGuestAgent\" to true in Create Deployment\n or Add Role API calls. Version header: Required to be \"2014-04-01\" or\n later.\n \n \n \n \n Initializes a new instance of the GuestAgentStatus class.\n \n \n \n \n Optional. Integer. Status code from the result of applying the GA\n settings.\n \n \n \n \n Optional. This object encapsulates a formatted localized status\n message from the Guest Agent.\n \n \n \n \n Optional. Version of the Guest Agent installed on the role instance.\n \n \n \n \n Optional. This object encapsulates a localized status message from\n the Guest Agent.\n \n \n \n \n Optional. Protocol version used by the Guest Agent for status\n reporting.\n \n \n \n \n Optional. The guest agent status, which can be: \"Ready\" or\n \"NotReady\".\n \n \n \n \n Optional. UTC time at which the status was reported.\n \n \n \n \n The guest agent status, which can be: \"Ready\" or \"NotReady\".\n \n \n \n \n Parameters supplied to the Add Extension operation.\n \n \n \n \n Initializes a new instance of the\n HostedServiceAddExtensionParameters class.\n \n \n \n \n Required. The identifier of the extension.\n \n \n \n \n Optional. The private configuration that is defined using the\n schema returned by the List Available Extensions operation.\n \n \n \n \n Optional. The provider namespace of the extension. The provider\n namespace for Azure extensions is\n Microsoft.Windows.Azure.Extensions.\n \n \n \n \n Optional. The public configuration that is defined using the schema\n returned by the List Available Extensions operation.\n \n \n \n \n Optional. The thumbprint of the certificate that is used to encrypt\n the configuration specified in PrivateConfiguration. If this\n element is not specified, a certificate may be automatically\n generated and added to the cloud service.\n \n \n \n \n Optional. The thumbprint algorithm of the certificate that is used\n to encrypt the configuration specified in PrivateConfiguration.\n \n \n \n \n Required. The type of the extension.\n \n \n \n \n Optional. Specifies the version of the extension. If this element\n is not specified or an asterisk (*) is used as the value, the\n latest version of the extension is used. If the value is specified\n with a major version number and an asterisk as the minor version\n number (X.*), the latest minor version of the specified major\n version is selected. If a major version number and a minor version\n number are specified (X.Y), the specific extension version is\n selected. If a version is specified, an auto-upgrade is performed\n on the role instance.\n \n \n \n \n The Check Hosted Service Name Availability operation response.\n \n \n \n \n Initializes a new instance of the\n HostedServiceCheckNameAvailabilityResponse class.\n \n \n \n \n Optional. Indicates whether the name is available for you to use.\n The operation returns false for reserved or profane words.\n \n \n \n \n Optional. Describes why the name cannot be used to create the cloud\n service.\n \n \n \n \n Parameters supplied to the Create Hosted Service operation.\n \n \n \n \n Initializes a new instance of the HostedServiceCreateParameters\n class.\n \n \n \n \n Optional. The name of an existing affinity group associated with\n this subscription. Required if Location is not specified. This\n name is a GUID and can be retrieved by examining the name element\n of the response body returned by the List Affinity Groups\n operation. Specify either Location or AffinityGroup, but not both.\n To list available affinity groups, use the List Affinity Groups\n operation.\n \n \n \n \n Optional. A description for the cloud service. The description can\n be up to 1024 characters in length.\n \n \n \n \n Optional. Represents the name of an extended cloud service\n property. Each extended property must have a defined name and a\n value. You can have a maximum of 50 extended property name and\n value pairs. The maximum length of the name element is 64\n characters, only alphanumeric characters and underscores are valid\n in the name, and it must start with a letter. Attempting to use\n other characters, starting with a non-letter character, or\n entering a name that is identical to that of another extended\n property owned by the same service will result in a status code\n 400 (Bad Request) error. Each extended property value has a\n maximum length of 255 characters.\n \n \n \n \n Required. A name for the cloud service. The name can be up to 100\n characters in length. The name can be used to identify the storage\n account for your tracking purposes.\n \n \n \n \n Optional. The location where the cloud service will be created.\n Required if AffinityGroup is not specified. Specify either\n Location or AffinityGroup, but not both. To list available\n locations, use the List Locations operation.\n \n \n \n \n Required. A name for the cloud service that is unique within Azure.\n This name is the DNS prefix name and can be used to access the\n service.\n \n \n \n \n The detailed Get Hosted Service operation response.\n \n \n \n \n The Get Hosted Service operation response.\n \n \n \n \n Initializes a new instance of the HostedServiceGetResponse class.\n \n \n \n \n Optional. The compute capabilities in this hosted service.\n \n \n \n \n Optional. The properties that are assigned to the cloud service.\n \n \n \n \n Optional. The name of the cloud service. This name is the DNS\n prefix name and can be used to access the cloud service. For\n example, if the cloud service name is MyService you could access\n the access the cloud service by calling:\n http://MyService.cloudapp.net.\n \n \n \n \n Optional. The Service Management API request URI used to perform\n Get Hosted Service Properties requests against the cloud service.\n \n \n \n \n Initializes a new instance of the HostedServiceGetDetailedResponse\n class.\n \n \n \n \n Optional. The deployments that exist in the cloud service.\n \n \n \n \n A deployment that exists in the cloud service.\n \n \n \n \n Initializes a new instance of the Deployment class.\n \n \n \n \n Optional. The configuration file of the deployment.\n \n \n \n \n Optional. The time that the deployment was created.\n \n \n \n \n Optional. The deployment environment in which this deployment\n is running.\n \n \n \n \n Optional. The custom DNS settings that are specified for the\n deployment.\n \n \n \n \n Optional. Represents the name of an extended cloud service\n property. Each extended property must have a defined name and\n a value. You can have a maximum of 50 extended property name\n and value pairs. The maximum length of the name element is 64\n characters, only alphanumeric characters and underscores are\n valid in the name, and it must start with a letter. Attempting\n to use other characters, starting with a non-letter character,\n or entering a name that is identical to that of another\n extended property owned by the same service will result in a\n status code 400 (Bad Request) error. Each extended property\n value has a maximum length of 255 characters.\n \n \n \n \n Optional. The user-supplied name of the deployment. This name\n can be used identify the deployment for your tracking purposes.\n \n \n \n \n Optional. The last time that the deployment was modified.\n \n \n \n \n Optional. Indicates whether the deployment is locked for new\n write operations because an existing operation is updating the\n deployment.\n \n \n \n \n Optional. The name of the deployment.\n \n \n \n \n Optional. Specifies information about when the virtual machine\n has been started and stopped.\n \n \n \n \n Optional. The unique identifier for this deployment.\n \n \n \n \n Optional. The list of role instances in the deployment.\n \n \n \n \n Optional. The list of roles in the deployment.\n \n \n \n \n Optional. Indicates whether the Rollback Update Or Upgrade\n operation is allowed at this time.\n \n \n \n \n Optional. The version of the Azure SDK that was used to\n generate the .cspkg that created this deployment. The first\n two numerical components of the returned version represent the\n version of the SDK used to create the package.\n \n \n \n \n Optional. The status of the deployment.\n \n \n \n \n Optional. The number of upgrade domains available to this cloud\n service.\n \n \n \n \n Optional. Specifies information about an update occurring on\n the deployment.\n \n \n \n \n Optional. The URL used to access the hosted service. For\n example, if the service name is MyService you could access the\n access the service by calling: http://MyService.cloudapp.net.\n \n \n \n \n Optional. The virtual IP addresses that are specified for\n thedeployment.\n \n \n \n \n Optional. The name of the Virtual Network that the virtual\n machine connects to.\n \n \n \n \n The Get Extension operation response.\n \n \n \n \n Initializes a new instance of the HostedServiceGetExtensionResponse\n class.\n \n \n \n \n Optional. The identifier of the extension.\n \n \n \n \n Optional. The provider namespace of the extension. The provider\n namespace for Azure extensions is\n Microsoft.Windows.Azure.Extensions.\n \n \n \n \n Optional. The public configuration that is defined using the schema\n returned by the List Available Extensions operation.\n \n \n \n \n Optional. The thumbprint of the certificate that is used to encrypt\n the configuration specified in PrivateConfiguration. If this\n element is not specified, a certificate may be automatically\n generated and added to the cloud service.\n \n \n \n \n Optional. The thumbprint algorithm of the certificate that is used\n toencrypt the configuration specified in PrivateConfiguration.\n \n \n \n \n Required. The type of the extension.\n \n \n \n \n Optional. The version of the extension.\n \n \n \n \n The List Available Extensions operation response.\n \n \n \n \n Initializes a new instance of the\n HostedServiceListAvailableExtensionsResponse class.\n \n \n \n \n Gets the sequence of ExtensionImages.\n \n \n \n \n Gets the sequence of ExtensionImages.\n \n \n \n \n Optional. The extensions that are available to add to your cloud\n service.\n \n \n \n \n An extension available to add to your cloud service.\n \n \n \n \n Initializes a new instance of the ExtensionImage class.\n \n \n \n \n Optional. Indicates whether this version of extension blocks\n the role upon failure.\n \n \n \n \n Optional. The description of the extension.\n \n \n \n \n Optional. URI string pointing to the EULA (End User License\n Agreement) of this version of extension. This is optionally\n specified by the third-party publishing the extension instead\n of Azure, at the time of extension creation or update.\n \n \n \n \n Optional. URI string pointing to the homepage of this version\n of extension. This is optionally specified by the third-party\n publishing the extension instead of Azure, at the time of\n extension creation or update.\n \n \n \n \n Optional. The type of resource that supports the extension.\n This value can be WebRole, WorkerRole, or WebRole|WorkerRole.\n \n \n \n \n Optional. Boolean property indicating whether the extension\n accepts JSON or XML based configuration. If this property is\n 'true' then the extension accepts JSON based configuration. If\n this property is 'false' the extension accepts XML based\n configuration.\n \n \n \n \n Optional. The label that is used to identify the extension.\n \n \n \n \n Optional. URI string pointing to the privacy document of this\n version of extension. This is optionally specified by the\n third-party publishing the extension instead of Azure, at the\n time of extension creation or update.\n \n \n \n \n Optional. The schema of the private configuration.\n \n \n \n \n Optional. The provider namespace of the extension. The provider\n namespace for Azure extensions is\n Microsoft.Windows.Azure.Extensions.\n \n \n \n \n Optional. The schema of the public configuration.\n \n \n \n \n Optional. Indicates whether this version of extension has been\n replicated to all regions or not. If true, then the given\n extension version can be used in creating or updating\n deployments. Otherwise, the given extension version might\n cause failure in creating or updating deployments. The typical\n time is 20 minutes for a newly-registered or newly-updated\n extension to replicate completely by Azure.\n \n \n \n \n Optional. A sample configuration file for the resource\n extension.\n \n \n \n \n Optional. The thumbprint algorithm of the certificate that is\n used for encryption.\n \n \n \n \n Required. The type of the extension.\n \n \n \n \n Optional. The version of the extension.\n \n \n \n \n The List Extensions operation response.\n \n \n \n \n Initializes a new instance of the\n HostedServiceListExtensionsResponse class.\n \n \n \n \n Gets the sequence of Extensions.\n \n \n \n \n Gets the sequence of Extensions.\n \n \n \n \n Optional. The extensions that were added to a cloud service.\n \n \n \n \n An extension that was added to a cloud service.\n \n \n \n \n Initializes a new instance of the Extension class.\n \n \n \n \n Optional. The identifier of the extension.\n \n \n \n \n Optional. The provider namespace of the extension. The provider\n namespace for Azure extensions is\n Microsoft.Windows.Azure.Extensions.\n \n \n \n \n Optional. The public configuration that is defined using the\n schema returned by the List Extensions operation.\n \n \n \n \n Optional. The thumbprint of the certificate that is used to\n encrypt the configuration specified in PrivateConfiguration.\n If this element is not specified, a certificate may be\n automatically generated and added to the cloud service.\n \n \n \n \n Optional. The thumbprint algorithm of the certificate that is\n used to encrypt the configuration specified in\n PrivateConfiguration.\n \n \n \n \n Required. The type of the extension.\n \n \n \n \n Optional. The version of the extension.\n \n \n \n \n The List Hosted Service operation response.\n \n \n \n \n Initializes a new instance of the HostedServiceListResponse class.\n \n \n \n \n Gets the sequence of HostedServices.\n \n \n \n \n Gets the sequence of HostedServices.\n \n \n \n \n Optional. The hosted services associated with your subscription.\n \n \n \n \n A hosted service associated with your subscription.\n \n \n \n \n Initializes a new instance of the HostedService class.\n \n \n \n \n Optional. The compute capabilities in this hosted service.\n \n \n \n \n Optional. The properties that are assigned to the cloud service.\n \n \n \n \n Optional. The name of the cloud service. This name is the DNS\n prefix name and can be used to access the cloud service. For\n example, if the cloud service name is MyService you could\n access the cloud service by calling:\n http://MyService.cloudapp.net.\n \n \n \n \n Optional. The Service Management API request URI used to\n perform List Hosted Service Properties requests against the\n cloud service.\n \n \n \n \n The properties that are assigned to the cloud service.\n \n \n \n \n Initializes a new instance of the HostedServiceProperties class.\n \n \n \n \n Optional. The affinity group with which this cloud service is\n associated, if any. If the service is associated with an affinity\n group, the Location element is not returned.\n \n \n \n \n Optional. The date that the cloud service was created, in\n [4DigitYear]-[2DigitMonth]-[2DigitDay]T[2DigitHour]:[2DigitMinute]:[2DigitSecond]Z\n format. The date 2011-05-11T16:15:26Z is an example that could be\n returned by the DateCreated or DateLastModified elements.\n \n \n \n \n Optional. The date that the cloud service was last updated, in\n [4DigitYear]-[2DigitMonth]-[2DigitDay]T[2DigitHour]:[2DigitMinute]:[2DigitSecond]Z\n format. The date 2011-05-11T16:15:26Z is an example that could be\n returned by the DateCreated or DateLastModified elements.\n \n \n \n \n Optional. The description for the cloud service.\n \n \n \n \n Optional. Represents the name of an extended cloud service\n property. Each extended property must have a defined name and a\n value. You can have a maximum of 50 extended property name and\n value pairs. The maximum length of the name element is 64\n characters, only alphanumeric characters and underscores are valid\n in the name, and it must start with a letter. Attempting to use\n other characters, starting with a non-letter character, or\n entering a name that is identical to that of another extended\n property owned by the same service will result in a status code\n 400 (Bad Request) error. Each extended property value has a\n maximum length of 255 characters.\n \n \n \n \n Optional. The user-supplied name of the cloud service. This name\n can be used identify the service for your tracking purposes.\n \n \n \n \n Optional. The geo-location of the cloud service in Windows Azure,\n if the service is not associated with an affinity group. If a\n location has been specified, the AffinityGroup element is not\n returned.\n \n \n \n \n Optional. The status of the cloud service.\n \n \n \n \n The status of the cloud service.\n \n \n \n \n Parameters supplied to the Update Hosted Service operation.\n \n \n \n \n Initializes a new instance of the HostedServiceUpdateParameters\n class.\n \n \n \n \n Optional. A description for the cloud service. The description may\n be up to 1024 characters in length. You must specify a value for\n at least one of Label or Description.\n \n \n \n \n Optional. Represents the name of an extended cloud service\n property. Each extended property must have a defined name and a\n value. You can have a maximum of 50 extended property name and\n value pairs. The maximum length of the name element is 64\n characters, only alphanumeric characters and underscores are valid\n in the name, and it must start with a letter. Attempting to use\n other characters, starting with a non-letter character, or\n entering a name that is identical to that of another extended\n property owned by the same service will result in a status code\n 400 (Bad Request) error. Each extended property value has a\n maximum length of 255 characters.\n \n \n \n \n Optional. A name for the cloud service. The name may be up to 100\n characters in length. You must specify a value for at least one of\n Label or Description. It is recommended that the label be unique\n within the subscription. The name can be used identify the service\n for your tracking purposes.\n \n \n \n \n Objects that provide input endpoint details.\n \n \n \n \n Initializes a new instance of the InputEndpoint class.\n \n \n \n \n Optional. Specifies whether direct server return is enabled for the\n endpoint.\n \n \n \n \n Optional. Specifies the list of access control rules for the\n endpoint.\n \n \n \n \n Optional. Specifies a name for a set of load-balanced endpoints.\n Specifying this name in multiple endpoints adds them all to the\n set. This element is only listed for Virtual Machine deployments.\n \n \n \n \n Optional. Optional. Specify the name of an internal load balancer\n if this endpoint shall not be exposed on the default load balancer.\n \n \n \n \n Optional. Contains properties that specify the endpoint settings\n which the Azure load balancer uses to monitor the availability of\n this virtual machine before forwarding traffic to the endpoint.\n \n \n \n \n Optional. Specifies the internal port on which the virtual machine\n is listening to serve the endpoint. This element is only listed\n for Virtual Machine deployments.\n \n \n \n \n Optional. Specifies the name for the external endpoint. This\n element is only listed for Virtual Machine deployments.\n \n \n \n \n Optional. The size of the role instance.\n \n \n \n \n Optional. Specifies the transport protocol for the endpoint.\n \n \n \n \n Optional. The virtual IP address of the role instance.\n \n \n \n \n Specifies the transport protocol for an endpoint.\n \n \n \n \n Objects that provide instance endpoint details.\n \n \n \n \n Initializes a new instance of the InstanceEndpoint class.\n \n \n \n \n Optional. Specifies the internal port on which the virtual machine\n is listening to serve the endpoint. This element is only listed\n for Virtual Machine deployments.\n \n \n \n \n Optional. Specifies the name for the external endpoint. This\n element is only listed for Virtual Machine deployments.\n \n \n \n \n Optional. The external port of the role instance endpoint.\n \n \n \n \n Optional. Specifies the transport protocol for the endpoint.\n \n \n \n \n Optional. The Virtual IP of the role endpoint.\n \n \n \n \n A list of internal load balancers that each provide load balancing on a\n private VIP.\n \n \n \n \n Initializes a new instance of the LoadBalancer class.\n \n \n \n \n Optional. The configuration for the virtual IP address (VIP) this\n load balancer provides.\n \n \n \n \n Optional. The name of the load balancer.\n \n \n \n \n Parameters supplied to the Create Load Balancer operation.\n \n \n \n \n Initializes a new instance of the LoadBalancerCreateParameters\n class.\n \n \n \n \n Optional. The configuration for the virtual IP address (VIP) this\n load balancer provides.\n \n \n \n \n Optional. Name of the load balancer.\n \n \n \n \n Contains properties that specify the endpoint settings which the Azure\n load balancer uses to monitor the availability of this virtual machine\n before forwarding traffic to the endpoint.\n \n \n \n \n Initializes a new instance of the LoadBalancerProbe class.\n \n \n \n \n Optional. Specifies the interval for the load balancer probe in\n seconds. The minimum value is 5 seconds. If not specified, the\n default is 15 seconds.\n \n \n \n \n Optional. Specifies the relative path name to inspect to determine\n the virtual machine availability status. If Protocol is set to\n TCP, this value must be NULL.\n \n \n \n \n Optional. Specifies the port to use to inspect the virtual machine\n availability status.\n \n \n \n \n Optional. Specifies the protocol to use to inspect the virtual\n machine availability status.\n \n \n \n \n Optional. Specifies the timeout for the load balancer probe in\n seconds. The minimum value is 11 seconds. If not specified, the\n default is 31 seconds.\n \n \n \n \n Specifies the protocol to use when inspecting the virtual machine\n availability status.\n \n \n \n \n Describes an operating system family.\n \n \n \n \n The List Operating System Families operation response.\n \n \n \n \n Initializes a new instance of the\n OperatingSystemListFamiliesResponse class.\n \n \n \n \n Gets the sequence of OperatingSystemFamilies.\n \n \n \n \n Gets the sequence of OperatingSystemFamilies.\n \n \n \n \n Optional. The operating system families that are valid for your\n subscription.\n \n \n \n \n An operating system that is valid for your subscription.\n \n \n \n \n Initializes a new instance of the OperatingSystem class.\n \n \n \n \n Optional. Indicates whether this operating system version is\n currently active for running a service. If an operating system\n version is active, you can manually configure your service to\n run on that version. An operating system version may be\n inactive for one of two reasons: 1. It is not yet active as it\n is in the process of being rolled out to Azure data centers.\n If your service is configured to use auto-upgrade, it will be\n upgraded to the new operating system version during the\n rollout. If you are manually configuring your operating system\n version, you can upgrade to the latest version once it becomes\n active. 2. It is no longer supported for running a service. In\n this case you will either need to manually configure your\n service to run on a newer version, or configure your service\n to use auto-upgrade to manage operating system upgrades.\n \n \n \n \n Optional. Indicates whether this operating system version is\n the default version for a service that has not otherwise\n specified a particular version. The default operating system\n version is applied to services that are configured for\n auto-upgrade. An operating system family has exactly one\n default operating system version at any given time, for which\n the IsDefault element is set to true; for all other versions,\n IsDefault is set to false.\n \n \n \n \n Optional. The label of the operating system version.\n \n \n \n \n Optional. The operating system version. This value corresponds\n to the configuration value for specifying that your service is\n to run on a particular version of the Azure guest operating\n system. See Configuring Settings for the Windows Azure Guest\n OS for additional details.\n \n \n \n \n An operating system family that is valid for your subscription.\n \n \n \n \n Initializes a new instance of the OperatingSystemFamily class.\n \n \n \n \n Optional. The label of the operating system family.\n \n \n \n \n Optional. Indicates which operating system family this version\n belongs to. A value of 1 corresponds to the Azure guest\n operating system that is substantially compatible with Windows\n Server 2008 SP2. A value of 2 corresponds to the Azure guest\n operating system that is substantially compatible with Windows\n Server 2008 R2.\n \n \n \n \n Optional. The available operating systems in your subscription\n belonging to this family.\n \n \n \n \n The List Operating Systems operation response.\n \n \n \n \n Initializes a new instance of the OperatingSystemListResponse class.\n \n \n \n \n Gets the sequence of OperatingSystems.\n \n \n \n \n Gets the sequence of OperatingSystems.\n \n \n \n \n Optional. The operating systems that are valid for your\n subscription.\n \n \n \n \n An operating system that is valid for your subscription.\n \n \n \n \n Initializes a new instance of the OperatingSystem class.\n \n \n \n \n Optional. Indicates which operating system family this version\n belongs to. A value of 1 corresponds to the Azure guest\n operating system that is substantially compatible with Windows\n Server 2008 SP2. A value of 2 corresponds to the Azure guest\n operating system that is substantially compatible with Windows\n Server 2008 R2.\n \n \n \n \n Optional. The label of the operating system family.\n \n \n \n \n Optional. Indicates whether this operating system version is\n currently active for running a service. If an operating system\n version is active, you can manually configure your service to\n run on that version. An operating system version may be\n inactive for one of two reasons: 1. It is not yet active as it\n is in the process of being rolled out to Azure data centers.\n If your service is configured to use auto-upgrade, it will be\n upgraded to the new operating system version during the\n rollout. If you are manually configuring your operating system\n version, you can upgrade to the latest version once it becomes\n active. 2. It is no longer supported for running a service. In\n this case you will either need to manually configure your\n service to run on a newer version, or configure your service\n to use auto-upgrade to manage operating system upgrades.\n \n \n \n \n Optional. Indicates whether this operating system version is\n the default version for a service that has not otherwise\n specified a particular version. The default operating system\n version is applied to services that are configured for\n auto-upgrade. An operating system family has exactly one\n default operating system version at any given time, for which\n the IsDefault element is set to true; for all other versions,\n IsDefault is set to false.\n \n \n \n \n Optional. The label of the operating system version.\n \n \n \n \n Optional. The operating system version. This value corresponds\n to the configuration value for specifying that your service is\n to run on a particular version of the Azure guest operating\n system. See Configuring Settings for the Windows Azure Guest\n OS for additional details.\n \n \n \n \n The OS disk configuration.\n \n \n \n \n Initializes a new instance of the\n OSDiskConfigurationUpdateParameters class.\n \n \n \n \n Optional. Specifies the platform caching behavior of the operating\n system disk blob for read/write efficiency.\n \n \n \n \n The parameters Azure uses to create the operating system disk for the\n virtual machine.\n \n \n \n \n Initializes a new instance of the OSVirtualHardDisk class.\n \n \n \n \n Optional. Specifies the platform caching behavior of the operating\n system disk blob for read/write efficiency.\n \n \n \n \n Optional. Specifies the friendly name of an operating system image\n in the image repository.\n \n \n \n \n Optional. Specifies the location of the operating system disk in\n Azure storage.\n \n \n \n \n Optional. Specifies the name of an operating system image in the\n image repository.\n \n \n \n \n Optional. The operating system running in the virtual machine.\n \n \n \n \n Optional. Specifies the name of the source image that was used to\n provision the virtual machine.\n \n \n \n \n Contains information about when the virtual machine has been started\n and stopped.\n \n \n \n \n Initializes a new instance of the PersistentVMDowntime class.\n \n \n \n \n Optional. The time that the virtual machine was stopped.\n \n \n \n \n Optional. The time that the virtual machine was started.\n \n \n \n \n Optional. The status of the virtual machine.\n \n \n \n \n Specifies the action that is performed after the capture operation\n finishes.\n \n \n \n \n Causes the virtual machine to be deleted after the image has been\n captured\n \n \n \n \n Causes the virtual machine to be redeployed after the image is\n captured by using the specified information in\n ProvisioningConfiguration.\n \n \n \n \n The status information of the settings passed to the Resource Extension.\n \n \n \n \n Initializes a new instance of the\n ResourceExtensionConfigurationStatus class.\n \n \n \n \n Optional. Integer status code from the result of applying the\n configuration settings.\n \n \n \n \n Optional. UTC time at which the configuration was applied.\n \n \n \n \n Optional. This object encapsulates a formatted localized status\n message.\n \n \n \n \n Optional. This object encapsulates a localized status message.\n \n \n \n \n Optional. Name of the settings passed to the Resource Extension.\n \n \n \n \n Optional. Operation executed by the Resource Extension for the\n settings passed to it.\n \n \n \n \n Optional. The status of the resourse extension, containing values\n like Transitioning, Error, Success, or Warning.\n \n \n \n \n Optional. List of substatus objects which contain additional status\n information reported by the Resource Extension.\n \n \n \n \n Optional. UTC time at which the status was reported.\n \n \n \n \n The status of the resource extension configuration, containing values\n like Transitioning, Error, Success, or Warning.\n \n \n \n \n Specifies the key, value, and type of the parameter.\n \n \n \n \n Initializes a new instance of the ResourceExtensionParameterValue\n class.\n \n \n \n \n Optional. The key of the parameter.\n \n \n \n \n Optional. Optional. Public | Private. If this value is set to\n Private, the parameter will not be returned by Get Deployment. You\n can only specify one public parameter and one private parameter\n for a maximum of two parameters.\n \n \n \n \n Optional. The value of the parameter.\n \n \n \n \n Specifies the properties of a resource extension that should be\n installed on the Virtual Machine.\n \n \n \n \n Initializes a new instance of the ResourceExtensionReference class.\n \n \n \n \n Optional. Specifies the name of the resource extension. You can use\n List Resource Extensions to find the names of available resource\n extensions.\n \n \n \n \n Optional. Specifies the name of the publisher who created the\n resource extension. You can use List Resource Extensions to find\n the publisher name of a resource extension.\n \n \n \n \n Optional. Specifies the reference name of the resource extension.\n \n \n \n \n Optional. Contains a collection of parameters that are passed to\n the resource extension when it is installed.\n \n \n \n \n Optional. Specifies the state of the resource extension.Possible\n values are: Enable | Disable. The default value is Enable.\n \n \n \n \n Optional. Specifies the version of the resource extension. You can\n use List Resource Extension Versions to find the version of the\n resource extension.\n \n \n \n \n Optional. The status information of a specific Resource Extension.\n \n \n \n \n Initializes a new instance of the ResourceExtensionStatus class.\n \n \n \n \n Optional. Status code sent by the Resource Extension.\n \n \n \n \n Optional. This object encapsulates the extension setting status for\n the Resource Extension.\n \n \n \n \n Optional. This object encapsulates a formatted localized status\n message from the Resource Extension.\n \n \n \n \n Optional. Name of the Resource Extension.\n \n \n \n \n Optional. This object encapsulates a localized status message from\n the Guest Agent.\n \n \n \n \n Optional. The resource extension status, which can be \"Installing\",\n \"Ready\", \"NotReady\", or \"Unresponsive\".\n \n \n \n \n Optional. Version of the Resource Extension.\n \n \n \n \n The resource extension status, which can be \"Installing\", \"Ready\",\n \"NotReady\", or \"Unresponsive\".\n \n \n \n \n A substatus object containing additional status information reported by\n the Resource Extension.\n \n \n \n \n Initializes a new instance of the ResourceExtensionSubStatus class.\n \n \n \n \n Optional. Integer status code from the result of applying the\n substatus settings.\n \n \n \n \n Optional. This object encapsulates a formatted localized status\n message.\n \n \n \n \n Optional. This object encapsulates a localized status message.\n \n \n \n \n Optional. A name for the substatus.\n \n \n \n \n Optional. The resource extension substatus, containing values like\n Transitioning, Error, Success, or Warning.\n \n \n \n \n The resource extension substatus, containing values like Transitioning,\n Error, Success, or Warning.\n \n \n \n \n Details of a role in a deployment.\n \n \n \n \n Initializes a new instance of the Role class.\n \n \n \n \n Optional. The name of the role.\n \n \n \n \n Optional. A collection of values that represents system or\n application configuration settings.\n \n \n \n \n Optional. Contains the parameters Azure uses to create a data disk\n for a virtual machine.\n \n \n \n \n Optional. The read-only thumbprint of the certificate that is used\n with the HTTPS listener for WinRM.\n \n \n \n \n Optional. The friendly name for the role.\n \n \n \n \n Optional. Storage location where the VM Image VHDs should be\n copied, for published VM Images.\n \n \n \n \n Optional. The version of the operating system on which the role\n instances are running.\n \n \n \n \n Optional. Contains the parameters Azure uses to create the\n operating system disk for the virtual machine.\n \n \n \n \n Optional. Indicates whether the WindowsAzureGuestAgent service is\n installed on the Virtual Machine. To run a resource extension in a\n Virtual Machine, this service must be installed.\n \n \n \n \n Optional. Contains a collection of resource extensions that are to\n be installed on the Virtual Machine. This element is used if\n ProvisionGuestAgent is set to true.\n \n \n \n \n Optional. The name of the role.\n \n \n \n \n Optional. The size of the role instance.\n \n \n \n \n Optional. Specifies the type of the role. This element is only\n listed for Virtual Machine deployments, and by default is\n PersistentVMRole.\n \n \n \n \n Optional. Optional. The name of the VMImage from which this Role is\n to be created. If the OSDisk in the VMImage was Specialized, then\n no WindowsProvisioningConfigurationSet or\n LinuxProvisioningConfigurationSet should be provided. No\n OSVirtualHardDisk or DataVirtualHardDisk should be specified when\n using this argument.\n \n \n \n \n Details of a specific role instance.\n \n \n \n \n Initializes a new instance of the RoleInstance class.\n \n \n \n \n Optional. Guest Agent Status.\n \n \n \n \n Optional. The DNS host name of the service in which the role\n instance is running. This element is only listed for Virtual\n Machine deployments.\n \n \n \n \n Optional. The list of instance endpoints for the role.\n \n \n \n \n Optional. An error code that can be provided to Windows Azure\n support to assist in resolution of errors. This field will\n typically be empty.\n \n \n \n \n Optional. The fault domain that this role instance belongs to. Role\n instances that are part of the same fault domain may all be\n vulnerable to the failure of the same piece of shared hardware.\n \n \n \n \n Optional. The name of the specific role instance, if an instance of\n the role is running.\n \n \n \n \n Optional. The size of the role instance.\n \n \n \n \n Optional. The instance state, returned as a string that, when\n present, provides a snapshot of the state of the virtual machine\n at the time the operation was called.\n \n \n \n \n Optional. The current status of this instance.\n \n \n \n \n Optional. The update domain that this role instance belongs to.\n During an Upgrade Deployment, all roles in the same update domain\n are updated at the same time.\n \n \n \n \n Optional. The IP address of the role instance (DIP).\n \n \n \n \n Optional. The running state of the role instance.\n \n \n \n \n Optional. Optional. A set of public IPs. Currently, only one\n additional public IP per role is supported in an IaaS deployment.\n The IP address is in addition to the default VIP for the\n deployment.\n \n \n \n \n Optional. The thumbprint of the RDP server certificate (in Windows)\n or SSH server certificate (in Linux). The thumbprint is only used\n for Virtual Machines that have been created from an image.\n \n \n \n \n Optional. Resource Extension Status List.\n \n \n \n \n Optional. The name of the role.\n \n \n \n \n An additional public IP that will be created for the role. The\n public IP will be an additional IP for the role. The role\n continues to be addressable via the default deployment VIP.\n \n \n \n \n Initializes a new instance of the PublicIP class.\n \n \n \n \n Optional. The address of the public IP.\n \n \n \n \n Optional. The name of the public IP.\n \n \n \n \n The running state of the role instance.\n \n \n \n \n The current status of a role instance.\n \n \n \n \n The role state is currently unknown. The state should automatically\n be resolved once the role state is detected, so no action is\n required.\n \n \n \n \n The host agent is currently creating resources for the Virtual\n Machine.\n \n \n \n \n The host agent is starting the Virtual Machine.\n \n \n \n \n Azure is creating resources for the role.\n \n \n \n \n Azure is starting the role.\n \n \n \n \n The role instance has started and is ready to be used.\n \n \n \n \n The role instance is unavailable for requests. This state is\n usually generated while the role is being created or stopped.\n \n \n \n \n Azure is stopping the role.\n \n \n \n \n The host agent is stopping the Virtual Machine. This status also\n indicates that the role has already been stopped.\n \n \n \n \n The Virtual Machine is being deleted by the host agent.\n \n \n \n \n The Virtual Machine is not running. This is the final state of the\n shutdown process, and no other status messages should be received\n after StoppedVM.\n \n \n \n \n The role has unexpectedly stopped or has failed to start. This\n status indicates that there is a problem with the role that is\n causing it to crash or is preventing it from starting, which must\n be corrected before the role can be started. The\n InstanceStateDetails and InstanceErrorCode fields can hold\n information about the role error that caused this state, which may\n be useful for identifying and debugging the problem.\n \n \n \n \n The role has continually crashed after being started by Azure. This\n status indicates that there is a problem with the role that\n prevents it from starting, and may be generated after the\n StartingRole and ReadyRole statuses are received. The problem in\n the role must be found and corrected before the role can be\n started. The InstanceStateDetails and InstanceErrorCode fields can\n hold information about the role error that caused this state,\n which may be useful for identifying and debugging the problem.\n \n \n \n \n The role has continually failed to start. This status indicates\n that there is a problem with the role that prevents it from\n starting, and may be generated after the process returns\n StartingRole. The problem in the role must be found and corrected\n before the role can be started. The InstanceStateDetails and\n InstanceErrorCode fields can hold information about the role error\n that caused this state, which may be useful for identifying and\n debugging the problem.\n \n \n \n \n An Azure or container error is preventing the Virtual Machine from\n starting. This status is generated by Azure, and does not indicate\n an error with the role. It may be generated after the StartingRole\n state.\n \n \n \n \n The role has timed out before receiving a status message and is not\n responding to requests.\n \n \n \n \n The rollback proceeds without further user input.\n \n \n \n \n You must call the Walk Upgrade Domain operation to apply the\n rollback to each upgrade domain.\n \n \n \n \n Parameters supplied to the Create Service Certificate operation.\n \n \n \n \n Initializes a new instance of the\n ServiceCertificateCreateParameters class.\n \n \n \n \n Required. The service certificate format. Azure supports the pfx\n and cer file formats.\n \n \n \n \n Required. The pfx or cer file.\n \n \n \n \n Optional. The password for a pfx certificate. A cer certificate\n does not require a password.\n \n \n \n \n Parameters supplied to the Delete Service Certificate operation.\n \n \n \n \n Initializes a new instance of the\n ServiceCertificateDeleteParameters class.\n \n \n \n \n Required. The DNS prefix name of your service.\n \n \n \n \n Required. The hexadecimal representation of the thumbprint.\n \n \n \n \n Required. The algorithm for the certificate's thumbprint.\n \n \n \n \n Parameters supplied to the Get Service Certificate operation.\n \n \n \n \n Initializes a new instance of the ServiceCertificateGetParameters\n class.\n \n \n \n \n Required. The DNS prefix name of your service.\n \n \n \n \n Required. The hexadecimal representation of the thumbprint.\n \n \n \n \n Required. The algorithm for the certificate's thumbprint.\n \n \n \n \n The Get Service Certificate operation response.\n \n \n \n \n Initializes a new instance of the ServiceCertificateGetResponse\n class.\n \n \n \n \n Optional. The public portion of the X.509 service certificate as a\n form of the cer file.\n \n \n \n \n The List Service Certificates operation response.\n \n \n \n \n Initializes a new instance of the ServiceCertificateListResponse\n class.\n \n \n \n \n Gets the sequence of Certificates.\n \n \n \n \n Gets the sequence of Certificates.\n \n \n \n \n Optional. The service certificates that are valid for your\n subscription.\n \n \n \n \n A service certificate that is valid for your subscription.\n \n \n \n \n Initializes a new instance of the Certificate class.\n \n \n \n \n Optional. The Service Management API request URI used to\n perform Get Service Certificate requests against the\n certificate store.\n \n \n \n \n Optional. The public part of the service certificate as a cer\n file.\n \n \n \n \n Optional. The X509 certificate thumb print property of the\n service certificate.\n \n \n \n \n Optional. The algorithm that was used to hash the service\n certificate. Currently SHA-1 is the only supported algorithm.\n \n \n \n \n Contains an SSH key pair to be installed on the virtual machine.\n \n \n \n \n Initializes a new instance of the SshSettingKeyPair class.\n \n \n \n \n Required. Specifies the SHA1 fingerprint of an X509 certificate\n associated with the hosted service that includes the SSH key pair.\n \n \n \n \n Required. Specifies the full path of a file on the virtual machine\n which stores the SSH private key. The file is overwritten when\n multiple keys are written to it. The SSH public key is stored in\n the same directory and has the same name as the private key file\n with .pub suffix. Example: /home/user/.ssh/id_rsa.\n \n \n \n \n Specifies a public key in the SSH settings.\n \n \n \n \n Initializes a new instance of the SshSettingPublicKey class.\n \n \n \n \n Required. Specifies the SHA1 fingerprint of an X509 certificate\n associated with the hosted service that includes the SSH public\n key.\n \n \n \n \n Required. Specifies the full path of a file on the virtual machine\n which stores the SSH public key. If the file already exists, the\n specified key is appended to the file. Example:\n /home/user/.ssh/authorized_keys.\n \n \n \n \n Specifies the SSH public keys and key pairs to populate in the image\n during provisioning. This element is only used with the\n LinuxProvisioningConfiguration set.\n \n \n \n \n Initializes a new instance of the SshSettings class.\n \n \n \n \n Optional. Specifies the collection of SSH key pairs.\n \n \n \n \n Optional. Specifies the collection of SSH public keys.\n \n \n \n \n Service certificates with which to provision the new virtual machine.\n Stored certificate settings reference certificates that already exist\n in the Azure hosted service. Prior to configuring the stored\n certificates for the virtual machine, you must call the Add Service\n Certificate operation or add the certificate via the Azure Management\n portal.\n \n \n \n \n Initializes a new instance of the StoredCertificateSettings class.\n \n \n \n \n Required. Specifies the name of the certificate store from which to\n retrieve certificates. For example, \"My\".\n \n \n \n \n Required. Specifies the thumbprint of the certificate to be\n provisioned. The thumbprint must specify an existing service\n certificate.\n \n \n \n \n The current state of the upgrade.\n \n \n \n \n Contains upgrade details of the deployment.\n \n \n \n \n Initializes a new instance of the UpgradeStatus class.\n \n \n \n \n Optional. An integer value that identifies the current upgrade\n domain. Upgrade domains are identified with a zero-based index:\n the first upgrade domain has an ID of 0, the second has an ID of\n 1, and so on.\n \n \n \n \n Optional. The current state of the upgrade. Possible values are\n Before and During\n \n \n \n \n Optional. The type of the upgrade. Possible values are Auto and\n Manual.\n \n \n \n \n Specifies the platform caching behavior of the data disk blob for\n read/write efficiency.\n \n \n \n \n The virtual IP address of the deployment.\n \n \n \n \n Initializes a new instance of the VirtualIPAddress class.\n \n \n \n \n Optional. The virtual IP address of the deployment.\n \n \n \n \n Optional. Indicates whether the IP address is DNS programmed.\n \n \n \n \n Optional. The name of the virtual IP.\n \n \n \n \n Parameters supplied to the Capture Virtual Machine operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineCaptureOSImageParameters class.\n \n \n \n \n Required. Specifies the action that is performed after the capture\n operation finishes. Possible values are: Delete - this value\n causes the virtual machine to be deleted after the image has been\n captured; or Reprovision - this value causes the virtual machine\n to be redeployed after the image is captured by using the\n specified information in ProvisioningConfiguration.\n \n \n \n \n Optional. Provides information to be used to redeploy the virtual\n machine after the image has been captured. This element is only\n used when the PostCaptureAction is set to Reprovision.\n \n \n \n \n Required. Specifies the friendly name of the captured image. This\n is the value that appears in the Name column for the image in the\n Azure Management Portal.\n \n \n \n \n Required. Specifies the image name of the captured image.\n \n \n \n \n The Virtual Machine Template Capture Role operation response.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineCaptureVMImageParameters class.\n \n \n \n \n Optional. Required. Must be set to CaptureRoleOperation.\n \n \n \n \n Optional. Required. The OS state: Generalized | Specialized.\n \n \n \n \n Optional. Required. The VM Template Label.\n \n \n \n \n Optional. Required. The VM Template Name.\n \n \n \n \n Parameters supplied to the Create Virtual Machine Deployment operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineCreateDeploymentParameters class.\n \n \n \n \n Required. Specifies the environment in which to deploy the virtual\n machine. Possible values are: Staging or Production.\n \n \n \n \n Optional. Contains a list of DNS servers to associate with the\n machine.\n \n \n \n \n Required. A name for the hosted service. The name can be up to 100\n characters in length. It is recommended that the label be unique\n within the subscription. The name can be used identify the hosted\n service for tracking purposes.\n \n \n \n \n Optional. A list of internal load balancers that each provide load\n balancing on a private VIP.\n \n \n \n \n Required. A name for the deployment. The deployment name must be\n unique among other deployments for the hosted service.\n \n \n \n \n Optional. Optional. Specifies the name of an existing reserved IP\n to which the deployment will belong. Reserved IPs are created by\n calling the Create Reserved IP operation.\n \n \n \n \n Required. Contains the provisioning details for the new virtual\n machine deployment.\n \n \n \n \n Optional. Specifies the name of an existing virtual network to\n which the deployment will belong. Virtual networks are created by\n calling the Set Network Configuration operation.\n \n \n \n \n Parameters supplied to the Create Virtual Machine operation.\n \n \n \n \n Initializes a new instance of the VirtualMachineCreateParameters\n class.\n \n \n \n \n Optional. Specifies the name of an availability set to which to add\n the virtual machine. This value controls the virtual machine\n allocation in the Azure environment. Virtual machines specified in\n the same availability set are allocated to different nodes to\n maximize availability.\n \n \n \n \n Optional. Contains the collection of configuration sets that\n contain system and application configuration settings.\n \n \n \n \n Optional. Contains the parameters Azure used to create the data\n disk for the virtual machine.\n \n \n \n \n Optional. Location where VMImage VHDs should be copied, for\n published VMImages.\n \n \n \n \n Optional. Contains the parameters Azure used to create the\n operating system disk for the virtual machine.\n \n \n \n \n Optional. Indicates whether the WindowsAzureGuestAgent service is\n installed on the Virtual Machine. To run a resource extension in a\n Virtual Machine, this service must be installed.\n \n \n \n \n Optional. Contains a collection of resource extensions that are to\n be installed on the Virtual Machine. This element is used if\n ProvisionGuestAgent is set to true.\n \n \n \n \n Required. Specifies the name for the virtual machine. The name must\n be unique within the deployment.\n \n \n \n \n Optional. The size of the virtual machine.\n \n \n \n \n Optional. Name of the VMImage from which this Role is to be\n created. If the OSDisk in the VMImage was Specialized, then no\n WindowsProvisioningConfigurationSet or\n LinuxProvisioningConfigurationSet should be provided. No\n OSVirtualHardDisk or DataVirtualHardDisk should be specified when\n using this argument.\n \n \n \n \n Parameters supplied to the Create Virtual Machine Data Disk operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineDataDiskCreateParameters class.\n \n \n \n \n Required. Specifies the platform caching behavior of data disk blob\n for read/write efficiency. The default vault is ReadOnly. Possible\n values are: None, ReadOnly, or ReadWrite. Warning: Setting this\n property impacts the consistency of the disk.\n \n \n \n \n Optional. Specifies the description of the data disk. When you\n attach a disk, either by directly referencing a media using the\n MediaLink element or specifying the target disk size, you can use\n the DiskLabel element to customize the name property of the target\n data disk.\n \n \n \n \n Optional. Specifies the size, in GB, of an empty disk to be\n attached to the role. The disk can be created as part of disk\n attach or create VM role call by specifying the value for this\n property. Azure creates the empty disk based on size preference\n and attaches the newly created disk to the Role.\n \n \n \n \n Optional. Specifies the Logical Unit Number (LUN) for the disk. The\n LUN specifies the slot in which the data drive appears when\n mounted for usage by the virtual machine. Valid LUN values are 0\n through 15.\n \n \n \n \n Required. Specifies the location of the blob in Azure storage where\n the media for the disk is located. The blob location must belong\n to the storage account in the subscription specified by the\n SubscriptionId value in the operation call. Example:\n http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Optional. Specifies the name of the disk. Azure uses the specified\n disk to create the data disk for the machine and populates this\n field with the disk name.\n \n \n \n \n Optional. Specifies the location of a blob in account storage which\n is mounted as a data disk when the virtual machine is created.\n \n \n \n \n The Get Data Disk operation response.\n \n \n \n \n Initializes a new instance of the VirtualMachineDataDiskGetResponse\n class.\n \n \n \n \n Optional. The current value of the platform caching behavior of\n data disk blob for read/write efficiency. Possible values are:\n None, ReadOnly, or ReadWrite.\n \n \n \n \n Optional. The description of the data disk.\n \n \n \n \n Optional. The size, in GB, of the data disk.\n \n \n \n \n Optional. The Logical Unit Number (LUN) for the disk. The LUN\n specifies the slot in which the data drive appears when mounted\n for usage by the virtual machine.\n \n \n \n \n Optional. The location of the physical blob backing the data disk.\n The blob location is in the storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n \n \n \n \n Optional. The name of the data disk.\n \n \n \n \n Parameters supplied to the Update Virtual Machine Data Disk operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineDataDiskUpdateParameters class.\n \n \n \n \n Required. Specifies the platform caching behavior of data disk blob\n for read/write efficiency. The default vault is ReadOnly. Possible\n values are: None, ReadOnly, or ReadWrite. Warning: Setting this\n property impacts the consistency of the disk.\n \n \n \n \n Optional. Specifies the description of the data disk. When you\n attach a disk, either by directly referencing a media using the\n MediaLink element or specifying the target disk size, you can use\n the DiskLabel element to customize the name property of the target\n data disk.\n \n \n \n \n Optional. Specifies the size, in GB, of an empty disk to be\n attached to the role. The disk can be created as part of disk\n attach or create VM role call by specifying the value for this\n property. Azure creates the empty disk based on size preference\n and attaches the newly created disk to the Role.\n \n \n \n \n Optional. Specifies the Logical Unit Number (LUN) for the disk. The\n LUN specifies the slot in which the data drive appears when\n mounted for usage by the virtual machine. Valid LUN values are 0\n through 15.\n \n \n \n \n Required. Specifies the location of the blob in Azure blob store\n where the media for the disk is located. The blob location must\n belong to the storage account in the subscription specified by the\n SubscriptionId value in the operation call. Example:\n http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Optional. Specifies the name of the disk. Azure uses the specified\n disk to create the data disk for the machine and populates this\n field with the disk name.\n \n \n \n \n Parameters supplied to the Create Virtual Disk Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineDiskCreateParameters class.\n \n \n \n \n Required. Specifies the friendly name of the disk.\n \n \n \n \n Required. Specifies the location of the blob in Azure storage. The\n blob location must belong to a storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n Example: http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Required. Specifies a name for the disk. Azure uses the name to\n identify the disk when creating virtual machines from the disk.\n \n \n \n \n Optional. The operating system type of the disk. Possible values\n are: Linux or Windows.\n \n \n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineDiskCreateResponse\n class.\n \n \n \n \n Optional. The affinity group in which the disk is located. The\n AffinityGroup value is derived from storage account that contains\n the blob in which the media is located. If the storage account\n does not belong to an affinity group the value is NULL.\n \n \n \n \n Optional. Specifies whether the comtained image is a premium image\n \n \n \n \n Optional. The friendly name of the disk\n \n \n \n \n Optional. The geo-location in which the disk is located. The\n Location value is derived from storage account that contains the\n blob in which the disk is located. If the storage account belongs\n to an affinity group the value is NULL.\n \n \n \n \n Optional. The size, in GB, of the disk.\n \n \n \n \n Optional. The location of the blob in the blob store in which the\n media for the disk is located. The blob location belongs to a\n storage account in the subscription specified by the\n SubscriptionId value in the operation call. Example:\n http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Optional. The name of the disk. This is the name that is used when\n creating one or more virtual machines using the disk.\n \n \n \n \n Optional. The Operating System type for the disk.\n \n \n \n \n Optional. The name of the OS Image from which the disk was created.\n This property is populated automatically when a disk is created\n from an OS image by calling the Add Role, Create Deployment, or\n Provision Disk operations.\n \n \n \n \n Optional. Contains properties that specify a virtual machine that\n is currently using the disk. A disk cannot be deleted as long as\n it is attached to a virtual machine.\n \n \n \n \n Contains properties that specify a virtual machine that currently\n using the disk. A disk cannot be deleted as long as it is attached\n to a virtual machine.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineDiskUsageDetails class.\n \n \n \n \n Optional. The deployment in which the disk is being used.\n \n \n \n \n Optional. The hosted service in which the disk is being used.\n \n \n \n \n Optional. The virtual machine that the disk is attached to.\n \n \n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineDiskGetResponse\n class.\n \n \n \n \n Optional. The affinity group in which the disk is located. The\n AffinityGroup value is derived from storage account that contains\n the blob in which the media is located. If the storage account\n does not belong to an affinity group the value is NULL.\n \n \n \n \n Optional. Specifies whether the disk is known to be corrupt.\n \n \n \n \n Optional. Specifies whether or not the disk contains a premium\n virtual machine image.\n \n \n \n \n Optional. The friendly name of the disk.\n \n \n \n \n Optional. The geo-location in which the disk is located. The\n Location value is derived from storage account that contains the\n blob in which the disk is located. If the storage account belongs\n to an affinity group the value is NULL.\n \n \n \n \n Optional. The size, in GB, of the disk.\n \n \n \n \n Optional. The location of the blob in the blob store in which the\n media for the disk is located. The blob location belongs to a\n storage account in the subscription specified by the\n SubscriptionId value in the operation call. Example:\n http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Optional. The name of the disk. This is the name that is used when\n creating one or more virtual machines using the disk.\n \n \n \n \n Optional. The operating system type of the OS image. Possible\n Values are: Linux, Windows, or NULL.\n \n \n \n \n Optional. The name of the OS Image from which the disk was created.\n This property is populated automatically when a disk is created\n from an OS image by calling the Add Role, Create Deployment, or\n Provision Disk operations.\n \n \n \n \n Optional. Contains properties that specify a virtual machine that\n is currently using the disk. A disk cannot be deleted as long as\n it is attached to a virtual machine.\n \n \n \n \n Contains properties that specify a virtual machine that currently\n using the disk. A disk cannot be deleted as long as it is attached\n to a virtual machine.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineDiskUsageDetails class.\n \n \n \n \n Optional. The deployment in which the disk is being used.\n \n \n \n \n Optional. The hosted service in which the disk is being used.\n \n \n \n \n Optional. The virtual machine that the disk is attached to.\n \n \n \n \n The List Disks operation response.\n \n \n \n \n Initializes a new instance of the VirtualMachineDiskListResponse\n class.\n \n \n \n \n Gets the sequence of Disks.\n \n \n \n \n Gets the sequence of Disks.\n \n \n \n \n Optional. The virtual machine disks associated with your\n subscription.\n \n \n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineDisk class.\n \n \n \n \n Optional. The affinity group in which the disk is located. The\n AffinityGroup value is derived from storage account that\n contains the blob in which the media is located. If the\n storage account does not belong to an affinity group the value\n is NULL.\n \n \n \n \n Optional. Specifies thether the disk is known to be corrupt.\n \n \n \n \n Optional. Specifies whether or not the disk contains a premium\n virtual machine image.\n \n \n \n \n Optional. The friendly name of the disk.\n \n \n \n \n Optional. The geo-location in which the disk is located. The\n Location value is derived from storage account that contains\n the blob in which the disk is located. If the storage account\n belongs to an affinity group the value is NULL.\n \n \n \n \n Optional. The size, in GB, of the disk.\n \n \n \n \n Optional. The location of the blob in the blob store in which\n the media for the disk is located. The blob location belongs\n to a storage account in the subscription specified by the\n SubscriptionId value in the operation call. Example:\n http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Optional. The name of the disk. This is the name that is used\n when creating one or more virtual machines using the disk.\n \n \n \n \n Optional. The operating system type of the OS image. Possible\n Values are: Linux, Windows, or NULL.\n \n \n \n \n Optional. The name of the OS Image from which the disk was\n created. This property is populated automatically when a disk\n is created from an OS image by calling the Add Role, Create\n Deployment, or Provision Disk operations.\n \n \n \n \n Optional. Contains properties that specify a virtual machine\n that currently using the disk. A disk cannot be deleted as\n long as it is attached to a virtual machine.\n \n \n \n \n Contains properties that specify a virtual machine that currently\n using the disk. A disk cannot be deleted as long as it is attached\n to a virtual machine.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineDiskUsageDetails class.\n \n \n \n \n Optional. The deployment in which the disk is being used.\n \n \n \n \n Optional. The hosted service in which the disk is being used.\n \n \n \n \n Optional. The virtual machine that the disk is attached to.\n \n \n \n \n Parameters supplied to the Update Virtual Disk Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineDiskUpdateParameters class.\n \n \n \n \n Optional. Specifies whether the disk contains an operating system.\n Note: Only a disk with an operating system installed can be\n mounted as OS Drive.\n \n \n \n \n Required. Specifies the friendly name of the disk.\n \n \n \n \n Optional. Specifies the location of the blob in Azure storage. The\n blob location must belong to a storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n Example: http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Required. Specifies a name for the disk. Azure uses the name to\n identify the disk when creating virtual machines from the disk.\n \n \n \n \n Optional. The operating system type of the disk. Possible values\n are: Linux or Windows.\n \n \n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineDiskUpdateResponse\n class.\n \n \n \n \n Optional. The affinity group in which the disk is located. The\n AffinityGroup value is derived from storage account that contains\n the blob in which the media is located. If the storage account\n does not belong to an affinity group the value is NULL.\n \n \n \n \n Optional. Specifies whether the contained image is a premium image.\n \n \n \n \n Optional. The friendly name of the disk\n \n \n \n \n Optional. The geo-location in which the disk is located. The\n Location value is derived from storage account that contains the\n blob in which the disk is located. If the storage account belongs\n to an affinity group the value is NULL.\n \n \n \n \n Optional. The size, in GB, of the disk.\n \n \n \n \n Optional. The location of the blob in the blob store in which the\n media for the disk is located. The blob location belongs to a\n storage account in the subscription specified by the\n SubscriptionId value in the operation call. Example:\n http://example.blob.core.windows.net/disks/mydisk.vhd\n \n \n \n \n Optional. The name of the disk. This is the name that is used when\n creating one or more virtual machines using the disk.\n \n \n \n \n Optional. The Operating System type for the disk.\n \n \n \n \n The List Resource Extensions operation response.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineExtensionListResponse class.\n \n \n \n \n Gets the sequence of ResourceExtensions.\n \n \n \n \n Gets the sequence of ResourceExtensions.\n \n \n \n \n Optional. The extensions that are available to add to your cloud\n service.\n \n \n \n \n An extension available to add to your virtual machine.\n \n \n \n \n Initializes a new instance of the ResourceExtension class.\n \n \n \n \n Optional. The description of the extension.\n \n \n \n \n Optional. URI string pointing to the EULA (End User License\n Agreement) of this version of extension. This is optionally\n specified by the third-party publishing the extension instead\n of Azure, at the time of extension creation or update.\n \n \n \n \n Optional. URI string pointing to the homepage of this version\n of extension. This is optionally specified by the third-party\n publishing the extension instead of Azure, at the time of\n extension creation or update.\n \n \n \n \n Optional. Indicates whether the extension accepts JSON or XML\n based configuration. If this property is 'true' the extension\n accepts JSON based configuration. If this property is 'false'\n the extension accepts XML based configuration.\n \n \n \n \n Optional. The label that is used to identify the extension.\n \n \n \n \n Optional. The name of the extension.\n \n \n \n \n Optional. URI string pointing to the privacy document of this\n version of extension. This is optionally specified by the\n third-party publishing the extension instead of Azure, at the\n time of extension creation or update.\n \n \n \n \n Optional. The base64-encoded schema of the private\n configuration.\n \n \n \n \n Optional. The base64-encoded schema of the public configuration.\n \n \n \n \n Optional. The provider namespace of the extension. The provider\n namespace for Azure extensions is Microsoft.Compute.\n \n \n \n \n Optional. Indicates whether this version of extension has been\n replicated to all regions or not. If true, then the given\n extension version can be used in creating or updating\n deployments. Otherwise, the given extension version might\n cause failure in creating or updating deployments. The typical\n time is 20 minutes for a newly-registered or newly-updated\n extension to replicate completely by Azure.\n \n \n \n \n Optional. A sample configuration file for the resource\n extension.\n \n \n \n \n Optional. The version of the extension.\n \n \n \n \n The Download RDP file operation response.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineGetRemoteDesktopFileResponse class.\n \n \n \n \n Required. A Remote Desktop Protocol (.rdp) file that can be used to\n establish a remote desktop session to the virtual machine\n \n \n \n \n The Get Virtual Machine operation response.\n \n \n \n \n Initializes a new instance of the VirtualMachineGetResponse class.\n \n \n \n \n Optional. The name of the availability set the virtual machine\n belongs to. This value controls the virtual machine allocation in\n the Windows Azure environment. Virtual machines specified in the\n same availability set are allocated to different nodes to maximize\n availability.\n \n \n \n \n Optional. Contains the collection of configuration sets that\n contain system and application configuration settings.\n \n \n \n \n Optional. Contains the parameters Azure used to create the data\n disk for the virtual machine.\n \n \n \n \n Optional. The read-only thumbprint of the certificate that is used\n with the HTTPS listener for WinRM.\n \n \n \n \n Optional. The version of the operating system on which the role\n instances are running.\n \n \n \n \n Optional. Contains the parameters Azure used to create the\n operating system disk for the virtual machine.\n \n \n \n \n Optional. The name for the virtual machine. The name is unique\n within Azure.\n \n \n \n \n Optional. The size of the virtual machine.\n \n \n \n \n Optional. The type of the role for the virtual machine. The only\n supported value is PersistentVMRole.\n \n \n \n \n Parameters supplied to the Create Virtual Machine Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineOSImageCreateParameters class.\n \n \n \n \n Optional. Specifies the description of the OS image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a string,\n but it is recommended that the value be a URL that points to a\n EULA.\n \n \n \n \n Optional. Specifies the URI to the icon that is displayed for the\n image in the Management Portal.\n \n \n \n \n Optional. Specifies a value that can be used to group OS images.\n \n \n \n \n Required. Indicates if the image contains software or associated\n services that will incur charges above the core price for the\n virtual machine.\n \n \n \n \n Required. Specifies the friendly name of the image.\n \n \n \n \n Optional. Specifies the language of the image. The Language element\n is only available using version 2013-03-01 or higher.\n \n \n \n \n Required. Specifies the location of the blob in Azure storage. The\n blob location must belong to a storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n Example: http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Required. Specifies a name that Azure uses to identify the image\n when creating one or more virtual machines.\n \n \n \n \n Required. The operating system type of the OS image. Possible\n values are: Linux or Windows.\n \n \n \n \n Optional. Specifies the URI that points to a document that contains\n the privacy policy related to the OS image.\n \n \n \n \n Optional. Specifies the date when the OS image was added to the\n image repository.\n \n \n \n \n Optional. Specifies the size to use for the virtual machine that is\n created from the OS image.\n \n \n \n \n Required. Specifies whether the image should appear in the image\n gallery.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal. The\n SmallIconUri element is only available using version 2013-03-01 or\n higher.\n \n \n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineOSImageCreateResponse class.\n \n \n \n \n Optional. The repository classification of the image. All user\n images have the category User.\n \n \n \n \n Optional. Specifies the description of the OS image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a string,\n but it is recommended that the value be a URL that points to a\n EULA.\n \n \n \n \n Optional. Specifies the URI to the icon that is displayed for the\n image in the Management Portal.\n \n \n \n \n Optional. Specifies a value that can be used to group OS images.\n \n \n \n \n Optional. Indicates if the image contains software or associated\n services that will incur charges above the core price for the\n virtual machine.\n \n \n \n \n Optional. Specifies the friendly name of the image.\n \n \n \n \n Optional. Specifies the language of the image. The Language element\n is only available using version 2013-03-01 or higher.\n \n \n \n \n Optional. The geo-location in which this media is located. The\n Location value is derived from storage account that contains the\n blob in which the media is located. If the storage account belongs\n to an affinity group the value is NULL. If the version is set to\n 2012-08-01 or later, the locations are returned for platform\n images; otherwise, this value is NULL for platform images.\n \n \n \n \n Optional. The size, in GB, of the image.\n \n \n \n \n Optional. Specifies the location of the blob in Azure storage. The\n blob location must belong to a storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n Example: http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Optional. Specifies a name that Azure uses to identify the image\n when creating one or more virtual machines.\n \n \n \n \n Optional. The operating system type of the OS image. Possible\n values are: Linux or Windows.\n \n \n \n \n Optional. Specifies the URI that points to a document that contains\n the privacy policy related to the OS image.\n \n \n \n \n Optional. Specifies the date when the OS image was added to the\n image repository.\n \n \n \n \n Optional. Specifies the name of the publisher of the image.\n \n \n \n \n Optional. Specifies the size to use for the virtual machine that is\n created from the OS image.\n \n \n \n \n Optional. Specifies whether the image should appear in the image\n gallery.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal. The\n SmallIconUri element is only available using version 2013-03-01 or\n higher.\n \n \n \n \n The Get Details OS Images operation response.\n \n \n \n \n A virtual machine image associated with your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineOSImageGetResponse\n class.\n \n \n \n \n Optional. The affinity in which the media is located. The\n AffinityGroup value is derived from storage account that contains\n the blob in which the media is located. If the storage account\n does not belong to an affinity group the value is NULL and the\n element is not displayed in the response. This value is NULL for\n platform images.\n \n \n \n \n Optional. The repository classification of the image. All user\n images have the category User.\n \n \n \n \n Optional. Specifies the description of the image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a string,\n but it is recommended that the value be a URL that points to a\n EULA.\n \n \n \n \n Optional. Provides the URI to the icon for this Operating System\n Image.\n \n \n \n \n Optional. Specifies a value that can be used to group images.\n \n \n \n \n Optional. Indicates whether the image contains software or\n associated services that will incur charges above the core price\n for the virtual machine. For additional details, see the\n PricingDetailLink element.\n \n \n \n \n Optional. An identifier for the image.\n \n \n \n \n Optional. Specifies the language of the image. The Language element\n is only available using version 2013-03-01 or higher.\n \n \n \n \n Optional. The geo-location in which this media is located. The\n Location value is derived from storage account that contains the\n blob in which the media is located. If the storage account belongs\n to an affinity group the value is NULL. If the version is set to\n 2012-08-01 or later, the locations are returned for platform\n images; otherwise, this value is NULL for platform images.\n \n \n \n \n Optional. The size, in GB, of the image.\n \n \n \n \n Optional. The location of the blob in Azure storage. The blob\n location belongs to a storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n Example: http://example.blob.core.windows.net/disks/myimage.vhd.\n \n \n \n \n Optional. The name of the operating system image. This is the name\n that is used when creating one or more virtual machines using the\n image.\n \n \n \n \n Optional. The operating system type of the OS image. Possible\n values are: Linux or Windows.\n \n \n \n \n Optional. Specifies the URI that points to a document that contains\n the privacy policy related to the image.\n \n \n \n \n Optional. Specifies the date when the image was added to the image\n repository.\n \n \n \n \n Optional. The name of the publisher of this OS Image in Azure.\n \n \n \n \n Optional. Specifies the size to use for the virtual machine that is\n created from the OS image.\n \n \n \n \n Optional. Indicates whether the image should be shown in the Azure\n portal.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal. The\n SmallIconUri element is only available using version 2013-03-01 or\n higher.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineOSImageGetDetailsResponse class.\n \n \n \n \n Optional. The indicator of whether the image is corrupted or not.\n \n \n \n \n Optional. The replication progress information of VM images.\n \n \n \n \n The replication progress information of VM images.\n \n \n \n \n Initializes a new instance of the ReplicationProgressElement\n class.\n \n \n \n \n Optional. The location of the replication of VM image.\n \n \n \n \n Optional. The progress of the replication of VM image.\n \n \n \n \n The List OS Images operation response.\n \n \n \n \n Initializes a new instance of the VirtualMachineOSImageListResponse\n class.\n \n \n \n \n Gets the sequence of Images.\n \n \n \n \n Gets the sequence of Images.\n \n \n \n \n Optional. The virtual machine images associated with your\n subscription.\n \n \n \n \n A virtual machine image associated with your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineOSImage class.\n \n \n \n \n Optional. The affinity in which the media is located. The\n AffinityGroup value is derived from storage account that\n contains the blob in which the media is located. If the\n storage account does not belong to an affinity group the value\n is NULL and the element is not displayed in the response.\n This value is NULL for platform images.\n \n \n \n \n Optional. The repository classification of the image. All user\n images have the category User.\n \n \n \n \n Optional. Specifies the description of the image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a\n string, but it is recommended that the value be a URL that\n points to a EULA.\n \n \n \n \n Optional. Specifies a value that can be used to group images.\n \n \n \n \n Optional. Indicates whether the image contains software or\n associated services that will incur charges above the core\n price for the virtual machine. For additional details, see the\n PricingDetailLink element.\n \n \n \n \n Optional. An identifier for the image.\n \n \n \n \n Optional. Specifies the language of the image. The Language\n element is only available using version 2013-03-01 or higher.\n \n \n \n \n Optional. The geo-location in which this media is located. The\n Location value is derived from storage account that contains\n the blob in which the media is located. If the storage account\n belongs to an affinity group the value is NULL. If the\n version is set to 2012-08-01 or later, the locations are\n returned for platform images; otherwise, this value is NULL\n for platform images.\n \n \n \n \n Optional. The size, in GB, of the image.\n \n \n \n \n Optional. The location of the blob in Azure storage. The blob\n location belongs to a storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n Example:\n http://example.blob.core.windows.net/disks/myimage.vhd\n \n \n \n \n Optional. The name of the operating system image. This is the\n name that is used when creating one or more virtual machines\n using the image.\n \n \n \n \n Optional. The operating system type of the OS image. Possible\n values are: Linux, Windows.\n \n \n \n \n Optional. Specifies a URL for an image with IsPremium set to\n true, which contains the pricing details for a virtual machine\n that is created from the image. The PricingDetailLink element\n is only available using version 2012-12-01 or higher.\n \n \n \n \n Optional. Specifies the URI that points to a document that\n contains the privacy policy related to the image.\n \n \n \n \n Optional. Specifies the date when the image was added to the\n image repository.\n \n \n \n \n Optional. The name of the publisher of this OS Image in Azure.\n \n \n \n \n Optional. Specifies the size to use for the virtual machine\n that is created from the OS image.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal.\n The SmallIconUri element is only available using version\n 2013-03-01 or higher.\n \n \n \n \n Known values for the operating system type of the OS in a virtual\n machine image.\n \n \n \n \n Parameters supplied to the Replicate Virtual Machine Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineOSImageReplicateParameters class.\n \n \n \n \n Optional. The replication target regional locations.Note: The\n regions in the request body are not additive. If an OS Image has\n already been replicated to Regions A, B, and C, and a request is\n made to replicate to Regions A and D, the VM Image will remain in\n Region A, will be replicated in Region D, and will be unreplicated\n from Regions B and C.\n \n \n \n \n The response body contains the published name of the image.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineOSImageReplicateResponse class.\n \n \n \n \n Optional. The published name of the image.\n \n \n \n \n Specifies the permission type for sharing.\n \n \n \n \n Parameters supplied to the Update Virtual Machine Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineOSImageUpdateParameters class.\n \n \n \n \n Optional. Specifies the description of the OS image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a string,\n but it is recommended that the value be a URL that points to a\n EULA.\n \n \n \n \n Optional. Specifies the URI to the icon that is displayed for the\n image in the Management Portal.\n \n \n \n \n Optional. Specifies a value that can be used to group OS images.\n \n \n \n \n Optional. Indicates if the image contains software or associated\n services that will incur charges above the core price for the\n virtual machine.\n \n \n \n \n Required. Specifies the friendly name of the image to be updated.\n You cannot use this operation to update images provided by the\n Azure platform.\n \n \n \n \n Optional. Specifies the language of the image. The Language element\n is only available using version 2013-03-01 or higher.\n \n \n \n \n Optional. Specifies the URI that points to a document that contains\n the privacy policy related to the OS image.\n \n \n \n \n Optional. Specifies the date when the OS image was added to the\n image repository.\n \n \n \n \n Optional. Specifies the size to use for the virtual machine that is\n created from the OS image.\n \n \n \n \n Optional. When published, should this image show up in the windows\n azure image gallery or not. True by default.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal. The\n SmallIconUri element is only available using version 2013-03-01 or\n higher.\n \n \n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineOSImageUpdateResponse class.\n \n \n \n \n Optional. The repository classification of the image. All user\n images have the category User.\n \n \n \n \n Optional. Specifies the description of the OS image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a string,\n but it is recommended that the value be a URL that points to a\n EULA.\n \n \n \n \n Optional. Specifies the URI to the icon that is displayed for the\n image in the Management Portal.\n \n \n \n \n Optional. Specifies a value that can be used to group OS images.\n \n \n \n \n Optional. Indicates if the image contains software or associated\n services that will incur charges above the core price for the\n virtual machine.\n \n \n \n \n Optional. Specifies the friendly name of the image.\n \n \n \n \n Optional. Specifies the language of the image. The Language element\n is only available using version 2013-03-01 or higher.\n \n \n \n \n Optional. The geo-location in which this media is located. The\n Location value is derived from storage account that contains the\n blob in which the media is located. If the storage account belongs\n to an affinity group the value is NULL. If the version is set to\n 2012-08-01 or later, the locations are returned for platform\n images; otherwise, this value is NULL for platform images.\n \n \n \n \n Optional. The size, in GB, of the image.\n \n \n \n \n Optional. Specifies the location of the blob in Azure storage. The\n blob location must belong to a storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n Example: http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Optional. Specifies a name that Azure uses to identify the image\n when creating one or more virtual machines.\n \n \n \n \n Optional. The operating system type of the OS image. Possible\n values are: Linux or Windows.\n \n \n \n \n Optional. Specifies the URI that points to a document that contains\n the privacy policy related to the OS image.\n \n \n \n \n Optional. Specifies the date when the OS image was added to the\n image repository.\n \n \n \n \n Optional. Specifies the name of the publisher of the image.\n \n \n \n \n Optional. Specifies the size to use for the virtual machine that is\n created from the OS image.\n \n \n \n \n Optional. Specifies whether the image should appear in the image\n gallery.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal. The\n SmallIconUri element is only available using version 2013-03-01 or\n higher.\n \n \n \n \n The size of a virtual machine.\n \n \n \n \n The type of the role for the virtual machine.\n \n \n \n \n The parameters required for shutting down the virtual machine.\n \n \n \n \n Initializes a new instance of the VirtualMachineShutdownParameters\n class.\n \n \n \n \n Optional. The state of the virtual machine after shutdown (Stopped\n or StoppedDeallocated).\n \n \n \n \n Parameters for the shutdown roles operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineShutdownRolesParameters class.\n \n \n \n \n Optional. The state of the roles after shutdown. Possible values\n include Stopped or StoppedDeallocated.\n \n \n \n \n Optional. The set of roles to shut down.\n \n \n \n \n Parameters for the Start Roles operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineStartRolesParameters class.\n \n \n \n \n Optional. The set of roles to shut down.\n \n \n \n \n The set of parameters required to update a load balanced endpoint set.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineUpdateLoadBalancedSetParameters class.\n \n \n \n \n Optional. A list of load balanced InputEndpoints to update.\n \n \n \n \n The modeled external endpoint for a persistent VM role.\n \n \n \n \n Initializes a new instance of the InputEndpoint class.\n \n \n \n \n Optional. A Boolean specifying whether this endpoint uses\n Direct Server Return\n \n \n \n \n Required. Specifies whether this endpoint is part of shared\n LoadBalanced endpoint and served by multiple role instances.\n If not specified a BadRequest error will be returned. It must\n also be in use by the deployment (at least one role in the\n deployment must have an endpoint whose\n LoadBalancedEndpointSetName matches this) otherwise a\n BadRequest error will be returned.\n \n \n \n \n Optional. Optional. Specify the name of an internal load\n balancer if this endpoint shall not be exposed on the default\n load balancer.\n \n \n \n \n Optional. This represents an endpoint setting which platform\n load balancer must monitor to detect the availability of this\n role before forwarding traffic to this endpoint. If not\n specified the probe settings (if any) from the existing load\n balanced endpoint definition will be retained.\n \n \n \n \n Optional. Specifies the internal port on which a service\n running inside the VM is listening to serve this endpoint.\n WARNING: If specified then ALL the endpoints of this LB set on\n all the roles will be updated to have THIS local port. To keep\n unique local ports on each role for a load balanced endpoint\n specify this as 0 (zero) and if you need to change those use\n UpdateRole. In case of port conflict with a local port (or\n probe port) on a role a BadRequestwill be returned.\n \n \n \n \n Optional. The name of the InputEndpoint. The name is ignored\n if specified\n \n \n \n \n Optional. An integer specifying the public port for this\n endpoint. Allowed values are between 1 and 65535 inclusive. A\n unqiue Port and Protocol combination must be specified for\n each InputEndpoint in the list.\n \n \n \n \n Optional. Specifies the transport protocol for the endpoint.\n \n \n \n \n Optional. A collection of access control rules which control\n the external network traffic reaching to this endpoint. NOTES:\n (1) To remove the ACLs from a load-balanced endpoint just omit\n this element. (2) ACLs are set as specified. There is no merge\n done with existing ACLs.\n \n \n \n \n Optional. The virtual IP address of the endpoint.\n \n \n \n \n Parameters supplied to the Update Virtual Machine operation.\n \n \n \n \n Initializes a new instance of the VirtualMachineUpdateParameters\n class.\n \n \n \n \n Optional. Specifies the name of an availability set to which to add\n the virtual machine. This value controls the virtual machine\n allocation in the Azure environment. Virtual machines specified in\n the same availability set are allocated to different nodes to\n maximize availability.\n \n \n \n \n Optional. Contains the collection of configuration sets that\n contain system and application configuration settings.\n \n \n \n \n Optional. Contains the parameters Azure used to create the data\n disk for the virtual machine.\n \n \n \n \n Optional. Specifies the friendly name for the virtual machine.\n \n \n \n \n Required. Contains the parameters Azure used to create the\n operating system disk for the virtual machine.\n \n \n \n \n Optional. Indicates whether the WindowsAzureGuestAgent service is\n installed on the Virtual Machine. To run a resource extension in a\n Virtual Machine, this service must be installed.\n \n \n \n \n Optional. Contains a collection of resource extensions that are to\n be installed on the Virtual Machine. This element is used if\n ProvisionGuestAgent is set to true.\n \n \n \n \n Required. Specifies the name for the virtual machine. The name must\n be unique within the deployment.\n \n \n \n \n Optional. The size of the virtual machine.\n \n \n \n \n The Get Details VM Images operation response.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineVMImageGetDetailsResponse class.\n \n \n \n \n Optional. The affinity group name of the virtual machine image.\n \n \n \n \n Optional. The classification of the virtual machine image.\n \n \n \n \n Optional. The date when the virtual machine image was created.\n \n \n \n \n Optional. The data disk configurations.\n \n \n \n \n Optional. The deployment name of the virtual machine image.\n \n \n \n \n Optional. The description of the virtual machine image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a string,\n but it is recommended that the value be a URL that points to a\n EULA.\n \n \n \n \n Optional. Provides the URI to the icon for this Operating System\n Image.\n \n \n \n \n Optional. The image family of the virtual machine image.\n \n \n \n \n Optional. The indicator of whether the image is corrupted or not.\n \n \n \n \n Optional. The indicator of whether the virtual machine image is\n premium.\n \n \n \n \n Optional. An identifier for the virtual machine image.\n \n \n \n \n Optional. The language of the virtual machine image.\n \n \n \n \n Optional. The location name of the virtual machine image.\n \n \n \n \n Optional. The date when the virtual machine image was created.\n \n \n \n \n Optional. The name of the virtual machine image.\n \n \n \n \n Optional. The OS disk configuration.\n \n \n \n \n Optional. Specifies the URI that points to the pricing detail.\n \n \n \n \n Optional. Specifies the URI that points to a document that contains\n the privacy policy related to the image.\n \n \n \n \n Optional. Specifies the date when the image was added to the image\n repository.\n \n \n \n \n Optional. The publisher name of the VM image.\n \n \n \n \n Optional. The name of the publisher of this VM Image in Azure.\n \n \n \n \n Optional. The recommended size of the virtual machine image.\n \n \n \n \n Optional. The replication progress information of VM images.\n \n \n \n \n Optional. The role name of the virtual machine image.\n \n \n \n \n Optional. The service name of the virtual machine image.\n \n \n \n \n Optional. The sharing status of the VM image.\n \n \n \n \n Optional. Specifies whether to show in Gui.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal.\n \n \n \n \n The replication progress information of VM images.\n \n \n \n \n Initializes a new instance of the ReplicationProgressElement\n class.\n \n \n \n \n Optional. The location of the replication of VM image.\n \n \n \n \n Optional. The progress of the replication of VM image.\n \n \n \n \n The List VM Images operation response.\n \n \n \n \n Initializes a new instance of the VirtualMachineVMImageListResponse\n class.\n \n \n \n \n Gets the sequence of VMImages.\n \n \n \n \n Gets the sequence of VMImages.\n \n \n \n \n Optional. The virtual machine images associated with your\n subscription.\n \n \n \n \n The data disk configuration.\n \n \n \n \n Initializes a new instance of the DataDiskConfiguration class.\n \n \n \n \n Optional. Specifies the platform caching behavior of the data\n disk blob for read/write efficiency. The default vault is\n ReadOnly.\n \n \n \n \n Optional. Specifies the size, in GB, of an empty VHD to be\n attached to the virtual machine. The VHD can be created as\n part of disk attach or create virtual machine calls by\n specifying the value for this property. Azure creates the\n empty VHD based on size preference and attaches the newly\n created VHD to the virtual machine.\n \n \n \n \n Optional. Specifies the Logical Unit Number (LUN) for the data\n disk. The LUN specifies the slot in which the data drive\n appears when mounted for usage by the virtual machine. This\n element is only listed when more than one data disk is\n attached to a virtual machine.\n \n \n \n \n Optional. Specifies the location of the disk in Windows Azure\n storage.\n \n \n \n \n Optional. Specifies the name of the VHD to use to create the\n data disk for the virtual machine.\n \n \n \n \n The OS disk configuration.\n \n \n \n \n Initializes a new instance of the OSDiskConfiguration class.\n \n \n \n \n Optional. Specifies the platform caching behavior of the\n operating system disk blob for read/write efficiency.\n \n \n \n \n Optional. Specifies the size, in GB, of an empty VHD to be\n attached to the virtual machine. The VHD can be created as\n part of disk attach or create virtual machine calls by\n specifying the value for this property. Azure creates the\n empty VHD based on size preference and attaches the newly\n created VHD to the virtual machine.\n \n \n \n \n Optional. Specifies the location of the disk in Windows Azure\n storage.\n \n \n \n \n Optional. Specifies the name of an operating system image in\n the image repository.\n \n \n \n \n Optional. The operating system running in the virtual machine.\n \n \n \n \n Optional. The operating system state in the virtual machine.\n \n \n \n \n A virtual machine image associated with your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineVMImage class.\n \n \n \n \n Optional. The affinity group name of the virtual machine image.\n \n \n \n \n Optional. The classification of the virtual machine image.\n \n \n \n \n Optional. The date when the virtual machine image was created.\n \n \n \n \n Optional. The data disk configurations.\n \n \n \n \n Optional. The deployment name of the virtual machine image.\n \n \n \n \n Optional. The description of the virtual machine image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a\n string, but it is recommended that the value be a URL that\n points to a EULA.\n \n \n \n \n Optional. Provides the URI to the icon for this Operating\n System Image.\n \n \n \n \n Optional. The image family of the virtual machine image.\n \n \n \n \n Optional. The indicator of whether the virtual machine image is\n premium.\n \n \n \n \n Optional. An identifier for the virtual machine image.\n \n \n \n \n Optional. The language of the virtual machine image.\n \n \n \n \n Optional. The location name of the virtual machine image.\n \n \n \n \n Optional. The date when the virtual machine image was created.\n \n \n \n \n Optional. The name of the virtual machine image.\n \n \n \n \n Optional. The OS disk configuration.\n \n \n \n \n Optional. Specifies the URI that points to the pricing detail.\n \n \n \n \n Optional. Specifies the URI that points to a document that\n contains the privacy policy related to the image.\n \n \n \n \n Optional. Specifies the date when the image was added to the\n image repository.\n \n \n \n \n Optional. The name of the publisher of this VM Image in Azure.\n \n \n \n \n Optional. The recommended size of the virtual machine image.\n \n \n \n \n Optional. The role name of the virtual machine image.\n \n \n \n \n Optional. The service name of the virtual machine image.\n \n \n \n \n Optional. Specifies whether to show in Gui.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal.\n \n \n \n \n Parameters supplied to the Replicate Virtual Machine Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineVMImageReplicateParameters class.\n \n \n \n \n Optional. The replication target regional locations.Note: The\n regions in the request body are not additive. If a VM Image has\n already been replicated to Regions A, B, and C, and a request is\n made to replicate to Regions A and D, the VM Image will remain in\n Region A, will be replicated in Region D, and will be unreplicated\n from Regions B and C.\n \n \n \n \n The response body contains the published name of the image.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineVMImageReplicateResponse class.\n \n \n \n \n Optional. The published name of the image.\n \n \n \n \n Specifies the permission type for sharing.\n \n \n \n \n Parameters supplied to the Update Virtual Machine Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineVMImageUpdateParameters class.\n \n \n \n \n Optional. Optional. The Data Disk Configurations.\n \n \n \n \n Optional. Specifies the description of the OS image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a string,\n but it is recommended that the value be a URL that points to a\n EULA.\n \n \n \n \n Optional. Specifies the URI to the icon that is displayed for the\n image in the Management Portal.\n \n \n \n \n Optional. Specifies a value that can be used to group OS images.\n \n \n \n \n Required. Specifies the friendly name of the image to be updated.\n You cannot use this operation to update images provided by the\n Azure platform.\n \n \n \n \n Optional. Specifies the language of the image.\n \n \n \n \n Optional. Optional. The OS Disk Configuration.\n \n \n \n \n Optional. Specifies the URI that points to a document that contains\n the privacy policy related to the OS image.\n \n \n \n \n Optional. Specifies the date when the OS image was added to the\n image repository.\n \n \n \n \n Optional. Specifies the size to use for the virtual machine that is\n created from the OS image.\n \n \n \n \n Optional. Optional. True or False.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal.\n \n \n \n \n Specifies the type of listener for enabling remote Windows PowerShell.\n \n \n \n \n Contains the type and certificate information for the listener.\n \n \n \n \n Initializes a new instance of the WindowsRemoteManagementListener\n class.\n \n \n \n \n Optional. Specifies the certificate thumbprint for the secure\n connection. If Type is Https then this value is an optional value\n that is set to the thumbprint of the service certificate that is\n used to provision the WinRM HTTPS listener. If this value is not\n specified, a self-signed certificate is generated and used for the\n virtual machine.\n \n \n \n \n Required. Specifies the type of listener. This value can be Http or\n Https. The value is case sensitive.\n \n \n \n \n Configures the Windows Remote Management service on the virtual\n machine, which enables remote Windows PowerShell.\n \n \n \n \n Initializes a new instance of the WindowsRemoteManagementSettings\n class.\n \n \n \n \n Optional. Contains a collection of information for enabling remote\n Windows PowerShell.\n \n \n \n \n Operations for determining the version of the Azure Guest Operating\n System on which your service is running. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684169.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the OperatingSystemOperations class.\n \n \n Reference to the service client.\n \n \n \n \n The List Operating Systems operation lists the versions of the\n guest operating system that are currently available in Windows\n Azure. The 2010-10-28 version of List Operating Systems also\n indicates what family an operating system version belongs to.\n Currently Azure supports two operating system families: the Azure\n guest operating system that is substantially compatible with\n Windows Server 2008 SP2, and the Azure guest operating system that\n is substantially compatible with Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684168.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Operating Systems operation response.\n \n \n \n \n The List OS Families operation lists the guest operating system\n families available in Azure, and also lists the operating system\n versions available for each family. Currently Azure supports two\n operating system families: the Azure guest operating system that\n is substantially compatible with Windows Server 2008 SP2, and the\n Azure guest operating system that is substantially compatible with\n Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441291.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Operating System Families operation response.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The List Operating Systems operation lists the versions of the\n guest operating system that are currently available in Windows\n Azure. The 2010-10-28 version of List Operating Systems also\n indicates what family an operating system version belongs to.\n Currently Azure supports two operating system families: the Azure\n guest operating system that is substantially compatible with\n Windows Server 2008 SP2, and the Azure guest operating system that\n is substantially compatible with Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684168.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IOperatingSystemOperations.\n \n \n The List Operating Systems operation response.\n \n \n \n \n The List Operating Systems operation lists the versions of the\n guest operating system that are currently available in Windows\n Azure. The 2010-10-28 version of List Operating Systems also\n indicates what family an operating system version belongs to.\n Currently Azure supports two operating system families: the Azure\n guest operating system that is substantially compatible with\n Windows Server 2008 SP2, and the Azure guest operating system that\n is substantially compatible with Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684168.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IOperatingSystemOperations.\n \n \n The List Operating Systems operation response.\n \n \n \n \n The List OS Families operation lists the guest operating system\n families available in Azure, and also lists the operating system\n versions available for each family. Currently Azure supports two\n operating system families: the Azure guest operating system that\n is substantially compatible with Windows Server 2008 SP2, and the\n Azure guest operating system that is substantially compatible with\n Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441291.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IOperatingSystemOperations.\n \n \n The List Operating System Families operation response.\n \n \n \n \n The List OS Families operation lists the guest operating system\n families available in Azure, and also lists the operating system\n versions available for each family. Currently Azure supports two\n operating system families: the Azure guest operating system that\n is substantially compatible with Windows Server 2008 SP2, and the\n Azure guest operating system that is substantially compatible with\n Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441291.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IOperatingSystemOperations.\n \n \n The List Operating System Families operation response.\n \n \n \n \n Operations for managing service certificates for your subscription.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee795178.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the ServiceCertificateOperations\n class.\n \n \n Reference to the service client.\n \n \n \n \n The Begin Creating Service Certificate operation adds a certificate\n to a hosted service. This operation is an asynchronous operation.\n To determine whether the management service has finished\n processing the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n Required. The DNS prefix name of your service.\n \n \n Required. Parameters supplied to the Begin Creating Service\n Certificate operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Required. Parameters supplied to the Begin Deleting Service\n Certificate operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Service Certificate operation adds a certificate to a\n hosted service. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n Required. The DNS prefix name of your service.\n \n \n Required. Parameters supplied to the Create Service Certificate\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Required. Parameters supplied to the Delete Service Certificate\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Service Certificate operation returns the public data for\n the specified X.509 certificate associated with a hosted service.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460792.aspx\n for more information)\n \n \n Required. Parameters supplied to the Get Service Certificate\n operation.\n \n \n Cancellation token.\n \n \n The Get Service Certificate operation response.\n \n \n \n \n The List Service Certificates operation lists all of the service\n certificates associated with the specified hosted service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154105.aspx\n for more information)\n \n \n Required. The DNS prefix name of your hosted service.\n \n \n Cancellation token.\n \n \n The List Service Certificates operation response.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Begin Creating Service Certificate operation adds a certificate\n to a hosted service. This operation is an asynchronous operation.\n To determine whether the management service has finished\n processing the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. The DNS prefix name of your service.\n \n \n Required. Parameters supplied to the Begin Creating Service\n Certificate operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Service Certificate operation adds a certificate\n to a hosted service. This operation is an asynchronous operation.\n To determine whether the management service has finished\n processing the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. The DNS prefix name of your service.\n \n \n Required. Parameters supplied to the Begin Creating Service\n Certificate operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. Parameters supplied to the Begin Deleting Service\n Certificate operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. Parameters supplied to the Begin Deleting Service\n Certificate operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Service Certificate operation adds a certificate to a\n hosted service. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. The DNS prefix name of your service.\n \n \n Required. Parameters supplied to the Create Service Certificate\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Service Certificate operation adds a certificate to a\n hosted service. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. The DNS prefix name of your service.\n \n \n Required. Parameters supplied to the Create Service Certificate\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. Parameters supplied to the Delete Service Certificate\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. Parameters supplied to the Delete Service Certificate\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Service Certificate operation returns the public data for\n the specified X.509 certificate associated with a hosted service.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460792.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. Parameters supplied to the Get Service Certificate\n operation.\n \n \n The Get Service Certificate operation response.\n \n \n \n \n The Get Service Certificate operation returns the public data for\n the specified X.509 certificate associated with a hosted service.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460792.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. Parameters supplied to the Get Service Certificate\n operation.\n \n \n The Get Service Certificate operation response.\n \n \n \n \n The List Service Certificates operation lists all of the service\n certificates associated with the specified hosted service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154105.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. The DNS prefix name of your hosted service.\n \n \n The List Service Certificates operation response.\n \n \n \n \n The List Service Certificates operation lists all of the service\n certificates associated with the specified hosted service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154105.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. The DNS prefix name of your hosted service.\n \n \n The List Service Certificates operation response.\n \n \n \n \n The Service Management API includes operations for managing the disks\n in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157188.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the VirtualMachineDiskOperations\n class.\n \n \n Reference to the service client.\n \n \n \n \n The Begin Deleting Data Disk operation removes the specified data\n disk from a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to delete the data disk from.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Data Disk operation adds a data disk to a virtual\n machine. There are three ways to create the data disk using the\n Add Data Disk operation. Option 1 - Attach an empty data disk to\n the role by specifying the disk label and location of the disk\n image. Do not include the DiskName and SourceMediaLink elements in\n the request body. Include the MediaLink element and reference a\n blob that is in the same geographical region as the role. You can\n also omit the MediaLink element. In this usage, Azure will create\n the data disk in the storage account configured as default for the\n role. Option 2 - Attach an existing data disk that is in the image\n repository. Do not include the DiskName and SourceMediaLink\n elements in the request body. Specify the data disk to use by\n including the DiskName element. Note: If included the in the\n response body, the MediaLink and LogicalDiskSizeInGB elements are\n ignored. Option 3 - Specify the location of a blob in your storage\n account that contain a disk image to use. Include the\n SourceMediaLink element. Note: If the MediaLink element\n isincluded, it is ignored. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157199.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to add the data disk to.\n \n \n Required. Parameters supplied to the Create Virtual Machine Data\n Disk operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Required. Parameters supplied to the Create Virtual Machine Disk\n operation.\n \n \n Cancellation token.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Delete Data Disk operation removes the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to delete the data disk from.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Disk operation deletes the specified data or operating\n system disk from your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157200.aspx\n for more information)\n \n \n Required. The name of the disk to delete.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Data Disk operation retrieves the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157180.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role.\n \n \n Required. The logical unit number of the disk.\n \n \n Cancellation token.\n \n \n The Get Data Disk operation response.\n \n \n \n \n The Get Disk operation retrieves a disk from the user image\n repository. The disk can be an operating system disk or a data\n disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Required. The name of the disk.\n \n \n Cancellation token.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The List Disks operation retrieves a list of the disks in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157176.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Disks operation response.\n \n \n \n \n The Update Data Disk operation updates the specified data disk\n attached to the specified virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157190.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to add the data disk to.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Parameters supplied to the Update Virtual Machine Data\n Disk operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Add Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Required. The name of the disk being updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Disk\n operation.\n \n \n Cancellation token.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Begin Deleting Data Disk operation removes the specified data\n disk from a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to delete the data disk from.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Data Disk operation removes the specified data\n disk from a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to delete the data disk from.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Data Disk operation adds a data disk to a virtual\n machine. There are three ways to create the data disk using the\n Add Data Disk operation. Option 1 - Attach an empty data disk to\n the role by specifying the disk label and location of the disk\n image. Do not include the DiskName and SourceMediaLink elements in\n the request body. Include the MediaLink element and reference a\n blob that is in the same geographical region as the role. You can\n also omit the MediaLink element. In this usage, Azure will create\n the data disk in the storage account configured as default for the\n role. Option 2 - Attach an existing data disk that is in the image\n repository. Do not include the DiskName and SourceMediaLink\n elements in the request body. Specify the data disk to use by\n including the DiskName element. Note: If included the in the\n response body, the MediaLink and LogicalDiskSizeInGB elements are\n ignored. Option 3 - Specify the location of a blob in your storage\n account that contain a disk image to use. Include the\n SourceMediaLink element. Note: If the MediaLink element\n isincluded, it is ignored. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157199.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to add the data disk to.\n \n \n Required. Parameters supplied to the Create Virtual Machine Data\n Disk operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Data Disk operation adds a data disk to a virtual\n machine. There are three ways to create the data disk using the\n Add Data Disk operation. Option 1 - Attach an empty data disk to\n the role by specifying the disk label and location of the disk\n image. Do not include the DiskName and SourceMediaLink elements in\n the request body. Include the MediaLink element and reference a\n blob that is in the same geographical region as the role. You can\n also omit the MediaLink element. In this usage, Azure will create\n the data disk in the storage account configured as default for the\n role. Option 2 - Attach an existing data disk that is in the image\n repository. Do not include the DiskName and SourceMediaLink\n elements in the request body. Specify the data disk to use by\n including the DiskName element. Note: If included the in the\n response body, the MediaLink and LogicalDiskSizeInGB elements are\n ignored. Option 3 - Specify the location of a blob in your storage\n account that contain a disk image to use. Include the\n SourceMediaLink element. Note: If the MediaLink element\n isincluded, it is ignored. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157199.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to add the data disk to.\n \n \n Required. Parameters supplied to the Create Virtual Machine Data\n Disk operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. Parameters supplied to the Create Virtual Machine Disk\n operation.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Create Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. Parameters supplied to the Create Virtual Machine Disk\n operation.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Delete Data Disk operation removes the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to delete the data disk from.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Data Disk operation removes the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to delete the data disk from.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Disk operation deletes the specified data or operating\n system disk from your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157200.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of the disk to delete.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Disk operation deletes the specified data or operating\n system disk from your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157200.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of the disk to delete.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Data Disk operation retrieves the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157180.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role.\n \n \n Required. The logical unit number of the disk.\n \n \n The Get Data Disk operation response.\n \n \n \n \n The Get Data Disk operation retrieves the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157180.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role.\n \n \n Required. The logical unit number of the disk.\n \n \n The Get Data Disk operation response.\n \n \n \n \n The Get Disk operation retrieves a disk from the user image\n repository. The disk can be an operating system disk or a data\n disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of the disk.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Get Disk operation retrieves a disk from the user image\n repository. The disk can be an operating system disk or a data\n disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of the disk.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The List Disks operation retrieves a list of the disks in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157176.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n The List Disks operation response.\n \n \n \n \n The List Disks operation retrieves a list of the disks in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157176.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n The List Disks operation response.\n \n \n \n \n The Update Data Disk operation updates the specified data disk\n attached to the specified virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157190.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to add the data disk to.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Parameters supplied to the Update Virtual Machine Data\n Disk operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Update Data Disk operation updates the specified data disk\n attached to the specified virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157190.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to add the data disk to.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Parameters supplied to the Update Virtual Machine Data\n Disk operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Add Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of the disk being updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Disk\n operation.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Add Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of the disk being updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Disk\n operation.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Service Management API includes operations for managing the virtual\n machine extensions in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the VirtualMachineExtensionOperations\n class.\n \n \n Reference to the service client.\n \n \n \n \n The List Resource Extensions operation lists the resource\n extensions that are available to add to a Virtual Machine. In\n Azure, a process can run as a resource extension of a Virtual\n Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495441.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n The List Resource Extension Versions operation lists the versions\n of a resource extension that are available to add to a Virtual\n Machine. In Azure, a process can run as a resource extension of a\n Virtual Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495440.aspx\n for more information)\n \n \n Required. The name of the publisher.\n \n \n Required. The name of the extension.\n \n \n Cancellation token.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The List Resource Extensions operation lists the resource\n extensions that are available to add to a Virtual Machine. In\n Azure, a process can run as a resource extension of a Virtual\n Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495441.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineExtensionOperations.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n The List Resource Extensions operation lists the resource\n extensions that are available to add to a Virtual Machine. In\n Azure, a process can run as a resource extension of a Virtual\n Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495441.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineExtensionOperations.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n The List Resource Extension Versions operation lists the versions\n of a resource extension that are available to add to a Virtual\n Machine. In Azure, a process can run as a resource extension of a\n Virtual Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495440.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineExtensionOperations.\n \n \n Required. The name of the publisher.\n \n \n Required. The name of the extension.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n The List Resource Extension Versions operation lists the versions\n of a resource extension that are available to add to a Virtual\n Machine. In Azure, a process can run as a resource extension of a\n Virtual Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495440.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineExtensionOperations.\n \n \n Required. The name of the publisher.\n \n \n Required. The name of the extension.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n The Service Management API includes operations for managing the virtual\n machines in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the VirtualMachineOperations class.\n \n \n Reference to the service client.\n \n \n \n \n The Begin Capturing Role operation creates a copy of the operating\n system virtual hard disk (VHD) that is deployed in the virtual\n machine, saves the VHD copy in the same storage location as the\n operating system VHD, and registers the copy as an image in your\n image gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Begin Capturing Virtual\n Machine operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Begin capturing role as VM template.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Role operation adds a virtual machine to an\n existing deployment. You can refer to the OSDisk in the Add Role\n operation in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Creating Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Virtual Machine Deployment operation provisions\n a virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. Parameters supplied to the Begin Creating Virtual Machine\n Deployment operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Role operation deletes the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to delete.\n \n \n Required. Specifies that the source blob(s) for the virtual machine\n should also be deleted from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Restarting role operation restarts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to shutdown.\n \n \n Required. The parameters for the shutdown vm operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Shutting Down Roles operation stops the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469421.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Begin Shutting Down Roles\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Role operation starts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to start.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Roles operation starts the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469419.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Begin Starting Roles operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Role operation adds a virtual machine to an\n existing deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your virtual machine.\n \n \n Required. Parameters supplied to the Begin Updating Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469417.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Updating Load Balanced\n Endpoint Set operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Capture Role operation creates a copy of the operating system\n virtual hard disk (VHD) that is deployed in the virtual machine,\n saves the VHD copy in the same storage location as the operating\n system VHD, and registers the copy as an image in your image\n gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Capture role as VM template.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Role operation adds a virtual machine to an existing\n deployment. You can refer to the OSDisk in the Add Role operation\n in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Create Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Virtual Machine Deployment operation provisions a\n virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. Parameters supplied to the Create Virtual Machine\n Deployment operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role operation deletes the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to delete.\n \n \n Required. Specifies that the source blob(s) for the virtual machine\n should also be deleted from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Role operation retrieves information about the specified\n virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157193.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine.\n \n \n Cancellation token.\n \n \n The Get Virtual Machine operation response.\n \n \n \n \n The Download RDP file operation retrieves the Remote Desktop\n Protocol configuration file from the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157183.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine.\n \n \n Cancellation token.\n \n \n The Download RDP file operation response.\n \n \n \n \n The Restart role operation restarts the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to shutdown.\n \n \n Required. The parameters for the shutdown virtual machine operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Roles operation stops the specified set of virtual\n machines.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Shutdown Roles operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Role operation starts the specified virtual machine.\n (see http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to start.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Roles operation starts the specified set of virtual\n machines.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Start Roles operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Role operation adds a virtual machine to an existing\n deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your virtual machine.\n \n \n Required. Parameters supplied to the Update Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Update Load Balanced Endpoint\n Set operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Begin Capturing Role operation creates a copy of the operating\n system virtual hard disk (VHD) that is deployed in the virtual\n machine, saves the VHD copy in the same storage location as the\n operating system VHD, and registers the copy as an image in your\n image gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Begin Capturing Virtual\n Machine operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Capturing Role operation creates a copy of the operating\n system virtual hard disk (VHD) that is deployed in the virtual\n machine, saves the VHD copy in the same storage location as the\n operating system VHD, and registers the copy as an image in your\n image gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Begin Capturing Virtual\n Machine operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Begin capturing role as VM template.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Begin capturing role as VM template.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Role operation adds a virtual machine to an\n existing deployment. You can refer to the OSDisk in the Add Role\n operation in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Creating Virtual Machine\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Role operation adds a virtual machine to an\n existing deployment. You can refer to the OSDisk in the Add Role\n operation in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Creating Virtual Machine\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Virtual Machine Deployment operation provisions\n a virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. Parameters supplied to the Begin Creating Virtual Machine\n Deployment operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Virtual Machine Deployment operation provisions\n a virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. Parameters supplied to the Begin Creating Virtual Machine\n Deployment operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Role operation deletes the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to delete.\n \n \n Required. Specifies that the source blob(s) for the virtual machine\n should also be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Role operation deletes the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to delete.\n \n \n Required. Specifies that the source blob(s) for the virtual machine\n should also be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Restarting role operation restarts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Restarting role operation restarts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to shutdown.\n \n \n Required. The parameters for the shutdown vm operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to shutdown.\n \n \n Required. The parameters for the shutdown vm operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Shutting Down Roles operation stops the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469421.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Begin Shutting Down Roles\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Shutting Down Roles operation stops the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469421.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Begin Shutting Down Roles\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Role operation starts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to start.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Role operation starts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to start.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Roles operation starts the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469419.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Begin Starting Roles operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Roles operation starts the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469419.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Begin Starting Roles operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Role operation adds a virtual machine to an\n existing deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your virtual machine.\n \n \n Required. Parameters supplied to the Begin Updating Virtual Machine\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Role operation adds a virtual machine to an\n existing deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your virtual machine.\n \n \n Required. Parameters supplied to the Begin Updating Virtual Machine\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469417.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Updating Load Balanced\n Endpoint Set operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469417.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Updating Load Balanced\n Endpoint Set operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Capture Role operation creates a copy of the operating system\n virtual hard disk (VHD) that is deployed in the virtual machine,\n saves the VHD copy in the same storage location as the operating\n system VHD, and registers the copy as an image in your image\n gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Capture Role operation creates a copy of the operating system\n virtual hard disk (VHD) that is deployed in the virtual machine,\n saves the VHD copy in the same storage location as the operating\n system VHD, and registers the copy as an image in your image\n gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Capture role as VM template.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Capture role as VM template.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Role operation adds a virtual machine to an existing\n deployment. You can refer to the OSDisk in the Add Role operation\n in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Create Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Role operation adds a virtual machine to an existing\n deployment. You can refer to the OSDisk in the Add Role operation\n in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Create Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Virtual Machine Deployment operation provisions a\n virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. Parameters supplied to the Create Virtual Machine\n Deployment operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Virtual Machine Deployment operation provisions a\n virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. Parameters supplied to the Create Virtual Machine\n Deployment operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role operation deletes the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to delete.\n \n \n Required. Specifies that the source blob(s) for the virtual machine\n should also be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role operation deletes the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to delete.\n \n \n Required. Specifies that the source blob(s) for the virtual machine\n should also be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Role operation retrieves information about the specified\n virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157193.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine.\n \n \n The Get Virtual Machine operation response.\n \n \n \n \n The Get Role operation retrieves information about the specified\n virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157193.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine.\n \n \n The Get Virtual Machine operation response.\n \n \n \n \n The Download RDP file operation retrieves the Remote Desktop\n Protocol configuration file from the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157183.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine.\n \n \n The Download RDP file operation response.\n \n \n \n \n The Download RDP file operation retrieves the Remote Desktop\n Protocol configuration file from the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157183.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine.\n \n \n The Download RDP file operation response.\n \n \n \n \n The Restart role operation restarts the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Restart role operation restarts the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to shutdown.\n \n \n Required. The parameters for the shutdown virtual machine operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to shutdown.\n \n \n Required. The parameters for the shutdown virtual machine operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Roles operation stops the specified set of virtual\n machines.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Shutdown Roles operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Roles operation stops the specified set of virtual\n machines.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Shutdown Roles operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Role operation starts the specified virtual machine.\n (see http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to start.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Role operation starts the specified virtual machine.\n (see http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to start.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Roles operation starts the specified set of virtual\n machines.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Start Roles operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Roles operation starts the specified set of virtual\n machines.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Start Roles operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Role operation adds a virtual machine to an existing\n deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your virtual machine.\n \n \n Required. Parameters supplied to the Update Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Role operation adds a virtual machine to an existing\n deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your virtual machine.\n \n \n Required. Parameters supplied to the Update Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Update Load Balanced Endpoint\n Set operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Update Load Balanced Endpoint\n Set operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Service Management API includes operations for managing the OS\n images in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157175.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the VirtualMachineOSImageOperations\n class.\n \n \n Reference to the service client.\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The OS Image Name should be the user OS Image, not the published\n name of the OS Image.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create OS Image operation adds an operating system image that\n is stored in a storage account and is available from the image\n repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157192.aspx\n for more information)\n \n \n Required. Parameters supplied to the Create Virtual Machine Image\n operation.\n \n \n Cancellation token.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n The Delete OS Image operation deletes the specified OS image from\n your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157203.aspx\n for more information)\n \n \n Required. The name of the image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get OS Image operation retrieves the details for an operating\n system image from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n Required. The name of the OS image to retrieve.\n \n \n Cancellation token.\n \n \n A virtual machine image associated with your subscription.\n \n \n \n \n Gets OS Image's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n Cancellation token.\n \n \n The Get Details OS Images operation response.\n \n \n \n \n The List OS Images operation retrieves a list of the operating\n system images from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List OS Images operation response.\n \n \n \n \n Replicate an OS image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine OS image to replicate.\n \n \n Required. Parameters supplied to the Replicate Virtual Machine\n Image operation.\n \n \n Cancellation token.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The OS Image Name should be the user OS Image, not the published\n name of the OS Image.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update OS Image operation updates an OS image that in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157198.aspx\n for more information)\n \n \n Required. The name of the virtual machine image to be updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Image\n operation.\n \n \n Cancellation token.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The OS Image Name should be the user OS Image, not the published\n name of the OS Image.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The OS Image Name should be the user OS Image, not the published\n name of the OS Image.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create OS Image operation adds an operating system image that\n is stored in a storage account and is available from the image\n repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157192.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. Parameters supplied to the Create Virtual Machine Image\n operation.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n The Create OS Image operation adds an operating system image that\n is stored in a storage account and is available from the image\n repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157192.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. Parameters supplied to the Create Virtual Machine Image\n operation.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n The Delete OS Image operation deletes the specified OS image from\n your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157203.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete OS Image operation deletes the specified OS image from\n your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157203.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get OS Image operation retrieves the details for an operating\n system image from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the OS image to retrieve.\n \n \n A virtual machine image associated with your subscription.\n \n \n \n \n The Get OS Image operation retrieves the details for an operating\n system image from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the OS image to retrieve.\n \n \n A virtual machine image associated with your subscription.\n \n \n \n \n Gets OS Image's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n The Get Details OS Images operation response.\n \n \n \n \n Gets OS Image's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n The Get Details OS Images operation response.\n \n \n \n \n The List OS Images operation retrieves a list of the operating\n system images from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n The List OS Images operation response.\n \n \n \n \n The List OS Images operation retrieves a list of the operating\n system images from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n The List OS Images operation response.\n \n \n \n \n Replicate an OS image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine OS image to replicate.\n \n \n Required. Parameters supplied to the Replicate Virtual Machine\n Image operation.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Replicate an OS image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine OS image to replicate.\n \n \n Required. Parameters supplied to the Replicate Virtual Machine\n Image operation.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The OS Image Name should be the user OS Image, not the published\n name of the OS Image.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The OS Image Name should be the user OS Image, not the published\n name of the OS Image.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update OS Image operation updates an OS image that in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157198.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to be updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Image\n operation.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n The Update OS Image operation updates an OS image that in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157198.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to be updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Image\n operation.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n The Service Management API includes operations for managing the virtual\n machine templates in your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineVMImageOperations\n class.\n \n \n Reference to the service client.\n \n \n \n \n The Begin Deleting Virtual Machine Image operation deletes the\n specified virtual machine image.\n \n \n Required. The name of the virtual machine image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The VM Image Name should be the user VM Image, not the published\n name of the VM Image.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Virtual Machine Image operation deletes the specified\n virtual machine image.\n \n \n Required. The name of the virtual machine image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets VMImage's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n Cancellation token.\n \n \n The Get Details VM Images operation response.\n \n \n \n \n The List Virtual Machine Images operation retrieves a list of the\n virtual machine images.\n \n \n Cancellation token.\n \n \n The List VM Images operation response.\n \n \n \n \n Replicate an VM image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n Required. Parameters supplied to the Replicate Virtual Machine\n Image operation.\n \n \n Cancellation token.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The VM Image Name should be the user VM Image, not the published\n name of the VM Image.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update VM Image operation updates a VM image that in your image\n repository.\n \n \n Required. The name of the virtual machine image to be updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Image\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Begin Deleting Virtual Machine Image operation deletes the\n specified virtual machine image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Virtual Machine Image operation deletes the\n specified virtual machine image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The VM Image Name should be the user VM Image, not the published\n name of the VM Image.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The VM Image Name should be the user VM Image, not the published\n name of the VM Image.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Virtual Machine Image operation deletes the specified\n virtual machine image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Virtual Machine Image operation deletes the specified\n virtual machine image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets VMImage's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n The Get Details VM Images operation response.\n \n \n \n \n Gets VMImage's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n The Get Details VM Images operation response.\n \n \n \n \n The List Virtual Machine Images operation retrieves a list of the\n virtual machine images.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n The List VM Images operation response.\n \n \n \n \n The List Virtual Machine Images operation retrieves a list of the\n virtual machine images.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n The List VM Images operation response.\n \n \n \n \n Replicate an VM image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n Required. Parameters supplied to the Replicate Virtual Machine\n Image operation.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Replicate an VM image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n Required. Parameters supplied to the Replicate Virtual Machine\n Image operation.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The VM Image Name should be the user VM Image, not the published\n name of the VM Image.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The VM Image Name should be the user VM Image, not the published\n name of the VM Image.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update VM Image operation updates a VM image that in your image\n repository.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to be updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Image\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Update VM Image operation updates a VM image that in your image\n repository.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to be updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Image\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild/References/Microsoft.WindowsAzure.Management.Storage.xml", "content": "\n\n \n Microsoft.WindowsAzure.Management.Storage\n \n \n \n \n The Service Management API includes operations for managing the storage\n accounts beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460790.aspx for\n more information)\n \n \n \n \n The Begin Creating Storage Account operation creates a new storage\n account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Parameters supplied to the Begin Creating Storage Account operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Check Name Availability operation checks if a storage account\n name is available for use in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154125.aspx\n for more information)\n \n \n The desired storage account name to check for availability.\n \n \n Cancellation token.\n \n \n The response to a storage account check name availability request.\n \n \n \n \n The Create Storage Account operation creates a new storage account\n in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Parameters supplied to the Create Storage Account operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Storage Account operation deletes the specified storage\n account from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264517.aspx\n for more information)\n \n \n The name of the storage account to be deleted.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Storage Account Properties operation returns system\n properties for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460802.aspx\n for more information)\n \n \n Name of the storage account to get properties for.\n \n \n Cancellation token.\n \n \n The Get Storage Account Properties operation response.\n \n \n \n \n The Get Storage Keys operation returns the primary and secondary\n access keys for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460785.aspx\n for more information)\n \n \n The name of the desired storage account.\n \n \n Cancellation token.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The List Storage Accounts operation lists the storage accounts\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460787.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Storage Accounts operation response.\n \n \n \n \n The Regenerate Keys operation regenerates the primary or secondary\n access key for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460795.aspx\n for more information)\n \n \n Parameters supplied to the Regenerate Keys operation.\n \n \n Cancellation token.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The Update Storage Account operation updates the label and the\n description, and enables or disables the geo-replication status\n for a storage account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264516.aspx\n for more information)\n \n \n Name of the storage account to update.\n \n \n Parameters supplied to the Update Storage Account operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n The request ID for the request you wish to track. The request ID is\n returned in the x-ms-request-id response header for every request.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets the API version.\n \n \n \n \n Gets the URI used as the base for all cloud service requests.\n \n \n \n \n Gets subscription credentials which uniquely identify Microsoft\n Azure subscription. The subscription ID forms part of the URI for\n every service call.\n \n \n \n \n Gets or sets the initial timeout for Long Running Operations.\n \n \n \n \n Gets or sets the retry timeout for Long Running Operations.\n \n \n \n \n The Service Management API includes operations for managing the\n storage accounts beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460790.aspx\n for more information)\n \n \n \n \n The response to a storage account check name availability request.\n \n \n \n \n Initializes a new instance of the CheckNameAvailabilityResponse\n class.\n \n \n \n \n Optional. The result of the availability request indicating if the\n name is available.\n \n \n \n \n Optional. The reason for unavailability, if the requested name is\n unavailable.\n \n \n \n \n The geographical region in which a storage account exists.\n \n \n \n \n Indicates whether the storage region is available.\n \n \n \n \n A Storage Service associated with your subscription.\n \n \n \n \n Initializes a new instance of the StorageAccount class.\n \n \n \n \n Optional. Represents the name of an extended storage account\n property. Each extended property must have both a defined name and\n a value. You can have a maximum of 50 extended property name/value\n pairs. The maximum length of the Name element is 64 characters,\n only alphanumeric characters and underscores are valid in the\n Name, and the name must start with a letter. Attempting to use\n other characters, starting the Name with a non-letter character,\n or entering a name that is identical to that of another extended\n property owned by the same storage account, will result in a\n status code 400 (Bad Request) error. Each extended property value\n has a maximum length of 255 characters.\n \n \n \n \n Optional. The name of the storage account. This name is the DNS\n prefix name and can be used to access blobs, queues, and tables in\n the storage account. For example, if the service name is\n MyStorageAccount, you could access the blob containers by calling:\n http://MyStorageAccount.blob.core.windows.net/mycontainer/.\n \n \n \n \n Optional. Details about the storage account.\n \n \n \n \n Optional. The Service Management API request URI used to perform\n Get Storage Account Properties requests against the storage\n account.\n \n \n \n \n Parameters supplied to the Create Storage Account operation.\n \n \n \n \n Initializes a new instance of the StorageAccountCreateParameters\n class.\n \n \n \n \n Optional. The name of an existing affinity group in the specified\n subscription. Required if Location is not specified. You can\n include either a Location or AffinityGroup element in the request\n body, but not both. To list available affinity groups, use the\n List Affinity Groups operation.\n \n \n \n \n Optional. A description for the storage account. The description\n may be up to 1024 characters in length.\n \n \n \n \n Optional. Represents the name of an extended storage account\n property. Each extended property must have a defined name and a\n value. You can have a maximum of 50 extended property name/value\n pairs. The maximum length of the Name element is 64 characters,\n only alphanumeric characters and underscores are valid in the\n Name, and the name must start with a letter. Attempting to use\n other characters, starting the Name with a non-letter character,\n or entering a name that is identical to that of another extended\n property owned by the same storage account will result in a status\n code 400 (Bad Request) error. Each extended property value has a\n maximum length of 255 characters.\n \n \n \n \n Optional. Specifies whether the storage account is created with\n geo-replication enabled. If the element is not included in the\n request body, the default value is true. If set to true, the data\n in the storage account is replicated across more than one\n geographic location to enable resilience in the face of\n catastrophic service loss.\n \n \n \n \n Required. A name for the storage account, specified as\n abase64-encoded string. The name may be up to 100 characters in\n length. The name can be used identify the storage account for your\n tracking purposes.\n \n \n \n \n Optional. The location where the storage account is created.\n Required if AffinityGroup is not specified. You can include either\n a Location or AffinityGroup element in the request body, but not\n both. To list available locations, use the List Locations\n operation.\n \n \n \n \n Required. A name for the storage account, unique within Azure.\n Storage account names must be between 3 and 24 characters in\n length, and must use numbers and lower-case letters only. This\n name is the DNS prefix name and can be used to access blobs,\n queues, and tables in the storage account. For example:\n http://ServiceName.blob.core.windows.net/mycontainer/.\n \n \n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n Initializes a new instance of the StorageAccountGetKeysResponse\n class.\n \n \n \n \n Optional. The primary access key for the storage account.\n \n \n \n \n Optional. The secondary access key for the storage account.\n \n \n \n \n Optional. The Service Management API request URI used to perform\n Get Storage Account Properties requests against the storage\n account.\n \n \n \n \n The Get Storage Account Properties operation response.\n \n \n \n \n Initializes a new instance of the StorageAccountGetResponse class.\n \n \n \n \n Optional. The requested storage account.\n \n \n \n \n The List Storage Accounts operation response.\n \n \n \n \n Initializes a new instance of the StorageAccountListResponse class.\n \n \n \n \n Gets the sequence of StorageAccounts.\n \n \n \n \n Gets the sequence of StorageAccounts.\n \n \n \n \n Optional. The requested storage accounts.\n \n \n \n \n Details about a storage account.\n \n \n \n \n Initializes a new instance of the StorageAccountProperties class.\n \n \n \n \n Optional. The affinity group with which this storage account is\n associated.\n \n \n \n \n Optional. The user-supplied description of the storage account.\n \n \n \n \n Optional. The URLs that are used to perform a retrieval of a public\n blob, queue, or table object.\n \n \n \n \n Optional. Indicates the primary geographical region in which the\n storage account exists at this time.\n \n \n \n \n Optional. Indicates whether geo-replication is\n enabled.Geo-replication means data in the storage account is\n replicated across more than one geographic location so as to\n enable resilience in the face of catastrophic service loss.\n \n \n \n \n Optional. Indicates the geographical region in which the storage\n account is being replicated. The GeoSecondaryRegion element is not\n returned if geo-replication is \"off\" for this account.\n \n \n \n \n Optional. The user-supplied name of the storage account, returned\n as a base-64 encoded string. This name can be used identify the\n storage account for your tracking purposes.\n \n \n \n \n Optional. A timestamp that indicates the most recent instance of a\n failover to the secondary region. In the case of multiple\n failovers, only the latest failover date and time is maintained.\n The format of the returned timestamp is:\n [4DigitYear]-[2DigitMonth]-[2DigitDay]T[2DigitMinute]:[2DigitSecond]:[7DigitsOfPrecision]Z.\n LastGeoFailoverTime is not returned if there has not been an\n instance of a failover.\n \n \n \n \n Optional. The geo-location specified when the storage account was\n created. This property is only returned if the storage account is\n not associated with an affinity group.\n \n \n \n \n Optional. The status of the storage account at the time the\n operation was called.\n \n \n \n \n Optional. Indicates whether the primary storage region is available.\n \n \n \n \n Optional. Indicates whether the secondary storage region is\n available.\n \n \n \n \n Parameters supplied to the Regenerate Keys operation.\n \n \n \n \n Initializes a new instance of the\n StorageAccountRegenerateKeysParameters class.\n \n \n \n \n Required. Specifies which key to regenerate.\n \n \n \n \n Required. The name of the desired storage account.\n \n \n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n Initializes a new instance of the\n StorageAccountRegenerateKeysResponse class.\n \n \n \n \n Optional. The primary access key for the storage account.\n \n \n \n \n Optional. The secondary access key for the storage account.\n \n \n \n \n Optional. The Service Management API request URI used to perform\n Get Storage Account Properties requests against the storage\n account.\n \n \n \n \n The status of the storage account at the time the operation was called.\n \n \n \n \n The Storage Account has been created.\n \n \n \n \n The Storage Account is being created.\n \n \n \n \n The DNS name for the storage account is being propagated.\n \n \n \n \n The Storage Account is being deleted.\n \n \n \n \n Parameters supplied to the Update Storage Account operation.\n \n \n \n \n Initializes a new instance of the StorageAccountUpdateParameters\n class.\n \n \n \n \n Optional.\n \n \n \n \n Optional. Represents the name of an extended storage account\n property. Each extended property must have a defined name and a\n value. You can have a maximum of 50 extended property name/value\n pairs. The maximum length of the Name element is 64 characters,\n only alphanumeric characters and underscores are valid in the\n Name, and the name must start with a letter. Attempting to use\n other characters, starting the Name with a non-letter character,\n or entering a name that is identical to that of another extended\n property owned by the same storage account will result in a status\n code 400 (Bad Request) error. Each extended property value has a\n maximum length of 255 characters. You can delete an extended\n property by setting the value to NULL.\n \n \n \n \n Optional. Indicates whether geo-replication is enabled on the\n specified storage account. If set to true, the data in the storage\n account is replicated across more than one geographic location so\n as to enable resiliency in the face of catastrophic service loss.\n If the element is not included in the request body, the current\n value is left unchanged. Important: If you have enabled\n geo-replication, you can elect to disable it by setting this\n element to false. When disabled, your data is no longer replicated\n to a secondary data center and any data in the secondary location\n will be removed. Enabling geo-replication once it has been\n disabled will result in the storage account being billed for\n replicating the current copy of data to the secondary data center.\n After the existing copy of the data is replicated to the secondary\n data center, updates are geo-replicated at no additional charge.\n \n \n \n \n Optional. A name for the storage account, base64-encoded. The name\n may be up to 100 characters in length. The name can be used\n identify the storage account for your tracking purposes.\n \n \n \n \n Describes the type of a storage key.\n \n \n \n \n The Service Management API includes operations for managing the storage\n accounts beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460790.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the StorageAccountOperations class.\n \n \n Reference to the service client.\n \n \n \n \n The Begin Creating Storage Account operation creates a new storage\n account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Required. Parameters supplied to the Begin Creating Storage Account\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Check Name Availability operation checks if a storage account\n name is available for use in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154125.aspx\n for more information)\n \n \n Required. The desired storage account name to check for\n availability.\n \n \n Cancellation token.\n \n \n The response to a storage account check name availability request.\n \n \n \n \n The Create Storage Account operation creates a new storage account\n in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Required. Parameters supplied to the Create Storage Account\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Storage Account operation deletes the specified storage\n account from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264517.aspx\n for more information)\n \n \n Required. The name of the storage account to be deleted.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Storage Account Properties operation returns system\n properties for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460802.aspx\n for more information)\n \n \n Required. Name of the storage account to get properties for.\n \n \n Cancellation token.\n \n \n The Get Storage Account Properties operation response.\n \n \n \n \n The Get Storage Keys operation returns the primary and secondary\n access keys for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460785.aspx\n for more information)\n \n \n Required. The name of the desired storage account.\n \n \n Cancellation token.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The List Storage Accounts operation lists the storage accounts\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460787.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Storage Accounts operation response.\n \n \n \n \n The Regenerate Keys operation regenerates the primary or secondary\n access key for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460795.aspx\n for more information)\n \n \n Required. Parameters supplied to the Regenerate Keys operation.\n \n \n Cancellation token.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The Update Storage Account operation updates the label and the\n description, and enables or disables the geo-replication status\n for a storage account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264516.aspx\n for more information)\n \n \n Required. Name of the storage account to update.\n \n \n Required. Parameters supplied to the Update Storage Account\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Storage.StorageManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Begin Creating Storage Account operation creates a new storage\n account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Parameters supplied to the Begin Creating Storage Account\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Storage Account operation creates a new storage\n account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Parameters supplied to the Begin Creating Storage Account\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Check Name Availability operation checks if a storage account\n name is available for use in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154125.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. The desired storage account name to check for\n availability.\n \n \n The response to a storage account check name availability request.\n \n \n \n \n The Check Name Availability operation checks if a storage account\n name is available for use in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154125.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. The desired storage account name to check for\n availability.\n \n \n The response to a storage account check name availability request.\n \n \n \n \n The Create Storage Account operation creates a new storage account\n in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Parameters supplied to the Create Storage Account\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Storage Account operation creates a new storage account\n in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Parameters supplied to the Create Storage Account\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Storage Account operation deletes the specified storage\n account from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264517.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. The name of the storage account to be deleted.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Storage Account operation deletes the specified storage\n account from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264517.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. The name of the storage account to be deleted.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Storage Account Properties operation returns system\n properties for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460802.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Name of the storage account to get properties for.\n \n \n The Get Storage Account Properties operation response.\n \n \n \n \n The Get Storage Account Properties operation returns system\n properties for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460802.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Name of the storage account to get properties for.\n \n \n The Get Storage Account Properties operation response.\n \n \n \n \n The Get Storage Keys operation returns the primary and secondary\n access keys for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460785.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. The name of the desired storage account.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The Get Storage Keys operation returns the primary and secondary\n access keys for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460785.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. The name of the desired storage account.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The List Storage Accounts operation lists the storage accounts\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460787.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n The List Storage Accounts operation response.\n \n \n \n \n The List Storage Accounts operation lists the storage accounts\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460787.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n The List Storage Accounts operation response.\n \n \n \n \n The Regenerate Keys operation regenerates the primary or secondary\n access key for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460795.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Parameters supplied to the Regenerate Keys operation.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The Regenerate Keys operation regenerates the primary or secondary\n access key for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460795.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Parameters supplied to the Regenerate Keys operation.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The Update Storage Account operation updates the label and the\n description, and enables or disables the geo-replication status\n for a storage account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264516.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Name of the storage account to update.\n \n \n Required. Parameters supplied to the Update Storage Account\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Update Storage Account operation updates the label and the\n description, and enables or disables the geo-replication status\n for a storage account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264516.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Name of the storage account to update.\n \n \n Required. Parameters supplied to the Update Storage Account\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the StorageManagementClient class.\n \n \n \n \n Initializes a new instance of the StorageManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n Required. Gets the URI used as the base for all cloud service\n requests.\n \n \n \n \n Initializes a new instance of the StorageManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n \n \n Initializes a new instance of the StorageManagementClient class.\n \n \n The Http client\n \n \n \n \n Initializes a new instance of the StorageManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n Required. Gets the URI used as the base for all cloud service\n requests.\n \n \n The Http client\n \n \n \n \n Initializes a new instance of the StorageManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n The Http client\n \n \n \n \n Clones properties from current instance to another\n StorageManagementClient instance\n \n \n Instance of StorageManagementClient to clone to\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n Required. The request ID for the request you wish to track. The\n request ID is returned in the x-ms-request-id response header for\n every request.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets the API version.\n \n \n \n \n Gets the URI used as the base for all cloud service requests.\n \n \n \n \n Gets subscription credentials which uniquely identify Microsoft\n Azure subscription. The subscription ID forms part of the URI for\n every service call.\n \n \n \n \n Gets or sets the initial timeout for Long Running Operations.\n \n \n \n \n Gets or sets the retry timeout for Long Running Operations.\n \n \n \n \n The Service Management API includes operations for managing the\n storage accounts beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460790.aspx\n for more information)\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageManagementClient.\n \n \n Required. The request ID for the request you wish to track. The\n request ID is returned in the x-ms-request-id response header for\n every request.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageManagementClient.\n \n \n Required. The request ID for the request you wish to track. The\n request ID is returned in the x-ms-request-id response header for\n every request.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild/References/Microsoft.WindowsAzure.Storage.xml", "content": "\n\n \n Microsoft.WindowsAzure.Storage\n \n \n \n \n Represents the status of an asynchronous operation and provides support for cancellation.\n \n \n \n \n Cancels the asynchronous operation.\n \n \n \n \n Represents a handler that signs HTTP requests.\n \n \n \n \n Signs the specified HTTP request so it can be authenticated by the Windows Azure storage services.\n \n The HTTP request to sign.\n An object for tracking the current operation.\n \n \n \n Represents a handler that signs HTTP requests with no authentication information.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Signs the specified HTTP request with no authentication information.\n \n The HTTP request to sign.\n An object for tracking the current operation.\n \n \n \n Represents a handler that signs HTTP requests with a shared key.\n \n \n \n \n Initializes a new instance of the class.\n \n A canonicalizer that converts HTTP request data into a standard form appropriate for signing.\n A object providing credentials for the request.\n The name of the storage account that the HTTP request will access.\n \n \n \n Signs the specified HTTP request with a shared key.\n \n The HTTP request to sign.\n An object for tracking the current operation.\n \n \n \n Represents a handler that signs HTTP requests with a shared key.\n \n \n \n \n Initializes a new instance of the class.\n \n A canonicalizer that converts HTTP request data into a standard form appropriate for signing.\n A object providing credentials for the request.\n The name of the storage account that the HTTP request will access.\n \n \n \n Signs the specified HTTP request with a shared key.\n \n The HTTP request to sign.\n An object for tracking the current operation.\n \n \n \n Initializes a new instance of the BlobReadStreamBase class.\n \n Blob reference to read from\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n An object for tracking the current operation.\n \n \n \n Sets the position within the current stream.\n \n A byte offset relative to the origin parameter.\n A value of type SeekOrigin indicating the reference\n point used to obtain the new position.\n The new position within the current stream.\n Seeking in a BlobReadStream disables MD5 validation.\n \n \n \n This operation is not supported in BlobReadStreamBase.\n \n Not used.\n \n \n \n This operation is not supported in BlobReadStreamBase.\n \n Not used.\n Not used.\n Not used.\n \n \n \n This operation is a no-op in BlobReadStreamBase.\n \n \n \n \n Read as much as we can from the internal buffer\n \n The buffer to read the data into.\n The byte offset in buffer at which to begin writing\n data read from the stream.\n The maximum number of bytes to read.\n Number of bytes read from the stream.\n \n \n \n Calculates the number of bytes to read from the blob.\n \n Number of bytes to read.\n \n \n \n Updates the blob MD5 with newly downloaded content.\n \n The buffer to read the data from.\n The byte offset in buffer at which to begin reading data.\n The maximum number of bytes to read.\n \n \n \n Releases the blob resources used by the Stream.\n \n true to release both managed and unmanaged resources; false to release only unmanaged resources.\n \n \n \n Gets a value indicating whether the current stream supports reading.\n \n \n \n \n Gets a value indicating whether the current stream supports seeking.\n \n \n \n \n Gets a value indicating whether the current stream supports writing.\n \n \n \n \n Gets or sets the position within the current stream.\n \n \n \n \n Gets the length in bytes of the stream.\n \n The length in bytes of the stream.\n \n \n \n Initializes a new instance of the BlobReadStream class.\n \n Blob reference to read from\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n An object for tracking the current operation.\n \n \n \n Reads a sequence of bytes from the current stream and advances the\n position within the stream by the number of bytes read.\n \n The buffer to read the data into.\n The byte offset in buffer at which to begin writing\n data read from the stream.\n The maximum number of bytes to read.\n The total number of bytes read into the buffer. This can be\n less than the number of bytes requested if that many bytes are not\n currently available, or zero (0) if the end of the stream has been reached.\n \n \n \n Begins an asynchronous read operation.\n \n The buffer to read the data into.\n The byte offset in buffer at which to begin writing\n data read from the stream.\n The maximum number of bytes to read.\n An optional asynchronous callback, to be called when the read is complete.\n A user-provided object that distinguishes this particular asynchronous read request from other requests.\n An IAsyncResult that represents the asynchronous read, which could still be pending.\n \n \n \n Waits for the pending asynchronous read to complete.\n \n The reference to the pending asynchronous request to finish.\n The total number of bytes read into the buffer. This can be\n less than the number of bytes requested if that many bytes are not\n currently available, or zero (0) if the end of the stream has been reached.\n \n \n \n Dispatches an async read operation that either reads from the cache or makes a call to\n the server.\n \n The reference to the pending asynchronous request to finish.\n The buffer to read the data into.\n The byte offset in buffer at which to begin writing\n data read from the stream.\n The maximum number of bytes to read.\n \n \n \n Called when the asynchronous DownloadRangeToStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Dispatches a sync read operation that either reads from the cache or makes a call to\n the server.\n \n The buffer to read the data into.\n The byte offset in buffer at which to begin writing\n data read from the stream.\n The maximum number of bytes to read.\n Number of bytes read from the stream.\n \n \n \n Represents a stream for writing to a blob.\n \n \n \n \n Clears all buffers for this stream, causes any buffered data to be written to the underlying blob, and commits the blob.\n \n \n \n \n Begins an asynchronous commit operation.\n \n An optional asynchronous callback, to be called when the commit is complete.\n A user-provided object that distinguishes this particular asynchronous commit request from other requests.\n An ICancellableAsyncResult that represents the asynchronous commit, which could still be pending.\n \n \n \n Waits for the pending asynchronous commit to complete.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Begins an asynchronous flush operation.\n \n An optional asynchronous callback, to be called when the flush is complete.\n A user-provided object that distinguishes this particular asynchronous flush request from other requests.\n An ICancellableAsyncResult that represents the asynchronous flush, which could still be pending.\n \n \n \n Waits for the pending asynchronous flush to complete.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Initializes a new instance of the BlobWriteStreamBase class.\n \n The service client. \n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n An object for tracking the current operation.\n \n \n \n Initializes a new instance of the BlobWriteStreamBase class for a block blob.\n \n Blob reference to write to.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n An object for tracking the current operation.\n \n \n \n Initializes a new instance of the BlobWriteStreamBase class for a page blob.\n \n Blob reference to write to.\n Size of the page blob.\n Use true if the page blob is newly created, false otherwise.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n An object for tracking the current operation.\n \n \n \n This operation is not supported in BlobWriteStreamBase.\n \n Not used.\n Not used.\n Not used.\n \n \n \n Calculates the new position within the current stream for a Seek operation.\n \n A byte offset relative to the origin parameter.\n A value of type SeekOrigin indicating the reference\n point used to obtain the new position.\n The new position within the current stream.\n \n \n \n This operation is not supported in BlobWriteStreamBase.\n \n Not used.\n \n \n \n Generates a new block ID to be used for PutBlock.\n \n Base64 encoded block ID\n \n \n \n Releases the blob resources used by the Stream.\n \n true to release both managed and unmanaged resources; false to release only unmanaged resources.\n \n \n \n Gets a value indicating whether the current stream supports reading.\n \n \n \n \n Gets a value indicating whether the current stream supports seeking.\n \n \n \n \n Gets a value indicating whether the current stream supports writing.\n \n \n \n \n Gets the length in bytes of the stream.\n \n \n \n \n Gets or sets the position within the current stream.\n \n \n \n \n Initializes a new instance of the BlobWriteStream class for a block blob.\n \n Blob reference to write to.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n An object for tracking the current operation.\n \n \n \n Initializes a new instance of the BlobWriteStream class for a page blob.\n \n Blob reference to write to.\n Size of the page blob.\n Use true if the page blob is newly created, false otherwise.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n An object for tracking the current operation.\n \n \n \n Sets the position within the current stream.\n \n A byte offset relative to the origin parameter.\n A value of type SeekOrigin indicating the reference\n point used to obtain the new position.\n The new position within the current stream.\n \n \n \n Writes a sequence of bytes to the current stream and advances the current\n position within this stream by the number of bytes written.\n \n An array of bytes. This method copies count bytes from\n buffer to the current stream. \n The zero-based byte offset in buffer at which to begin\n copying bytes to the current stream.\n The number of bytes to be written to the current stream.\n \n \n \n Begins an asynchronous write operation.\n \n An array of bytes. This method copies count bytes from\n buffer to the current stream. \n The zero-based byte offset in buffer at which to begin\n copying bytes to the current stream.\n The number of bytes to be written to the current stream.\n An optional asynchronous callback, to be called when the write is complete.\n A user-provided object that distinguishes this particular asynchronous write request from other requests.\n An IAsyncResult that represents the asynchronous write, which could still be pending.\n \n \n \n Waits for the pending asynchronous write to complete.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Clears all buffers for this stream and causes any buffered data to be written to the underlying blob.\n \n \n \n \n Begins an asynchronous flush operation.\n \n An optional asynchronous callback, to be called when the flush is complete.\n A user-provided object that distinguishes this particular asynchronous flush request from other requests.\n An ICancellableAsyncResult that represents the asynchronous flush, which could still be pending.\n \n \n \n Waits for the pending asynchronous flush to complete.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Called when noPendingWritesEvent is signalled indicating that there are no outstanding write requests.\n \n An object containing information to be used by the callback method each time it executes. \n true if the WaitHandle timed out; false if it was signaled.\n \n \n \n Releases the blob resources used by the Stream.\n \n true to release both managed and unmanaged resources; false to release only unmanaged resources.\n \n \n \n Clears all buffers for this stream, causes any buffered data to be written to the underlying blob, and commits the blob.\n \n \n \n \n Begins an asynchronous commit operation.\n \n An optional asynchronous callback, to be called when the commit is complete.\n A user-provided object that distinguishes this particular asynchronous commit request from other requests.\n An ICancellableAsyncResult that represents the asynchronous commit, which could still be pending.\n \n \n \n Waits for the pending asynchronous commit to complete.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Called when the pending flush operation completes so that we can continue with the commit.\n \n The result of the asynchronous operation.\n \n \n \n Called when the block blob commit operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Called when the page blob commit operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Dispatches a write operation.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Starts an asynchronous PutBlock operation as soon as the parallel\n operation semaphore becomes available.\n \n Data to be uploaded\n Block ID\n MD5 hash of the data to be uploaded\n The reference to the pending asynchronous request to finish.\n \n \n \n Called when the asynchronous PutBlock operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Starts an asynchronous WritePages operation as soon as the parallel\n operation semaphore becomes available.\n \n Data to be uploaded\n Offset within the page blob\n MD5 hash of the data to be uploaded\n The reference to the pending asynchronous request to finish.\n \n \n \n Called when the asynchronous WritePages operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Provides a client-side logical representation of the Windows Azure Blob service. This client is used to configure and execute requests against the Blob service.\n \n The service client encapsulates the base URI for the Blob service. If the service client will be used for authenticated access, \n it also encapsulates the credentials for accessing the storage account.\n \n Provides a client-side logical representation of the Windows Azure Blob service. This client is used to configure and execute requests against the Blob service.\n \n The service client encapsulates the base URI for the Blob service. If the service client will be used for authenticated access, it also encapsulates \n the credentials for accessing the storage account.\n \n \n \n Returns an enumerable collection of containers whose names \n begin with the specified prefix and that are retrieved lazily.\n \n The container name prefix.\n A value that indicates whether to return container metadata with the listing.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n An enumerable collection of containers that are retrieved lazily.\n \n \n \n Returns a result segment containing a collection of objects.\n \n A returned by a previous listing operation.\n A result segment of containers.\n \n \n \n Returns a result segment containing a collection of objects.\n \n The container name prefix.\n A returned by a previous listing operation.\n A result segment of containers.\n \n \n \n Returns a result segment containing a collection of containers whose names begin with the specified prefix.\n \n The container name prefix.\n A value that indicates whether to return container metadata with the listing.\n A non-negative integer value that indicates the maximum number of results to be returned \n in the result segment, up to the per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A returned by a previous listing operation.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A result segment of containers.\n \n \n \n Returns a result segment containing a collection of containers\n whose names begin with the specified prefix.\n \n The container name prefix.\n A value that indicates whether to return container metadata with the listing.\n A non-negative integer value that indicates the maximum number of results to be returned \n in the result segment, up to the per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A result segment of containers.\n \n \n \n Begins an asynchronous request to return a result segment containing a collection of containers.\n \n A continuation token returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to return a result segment containing a collection of containers.\n \n The container name prefix.\n A continuation token returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to return a result segment containing a collection of containers\n whose names begin with the specified prefix.\n \n The container name prefix.\n A value that indicates whether to return container metadata with the listing.\n A non-negative integer value that indicates the maximum number of results to be returned \n in the result segment, up to the per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return a result segment containing a collection of containers.\n \n An that references the pending asynchronous operation.\n A result segment of containers.\n \n \n \n Returns a task that performs an asynchronous request to return a result segment containing a collection of containers.\n \n A continuation token returned by a previous listing operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to return a result segment containing a collection of containers.\n \n A continuation token returned by a previous listing operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to return a result segment containing a collection of containers.\n \n The container name prefix.\n A continuation token returned by a previous listing operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to return a result segment containing a collection of containers.\n \n The container name prefix.\n A continuation token returned by a previous listing operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to return a result segment containing a collection of containers.\n \n The container name prefix.\n A value that indicates whether to return container metadata with the listing.\n A non-negative integer value that indicates the maximum number of results to be returned \n in the result segment, up to the per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to return a result segment containing a collection of containers.\n \n The container name prefix.\n A value that indicates whether to return container metadata with the listing.\n A non-negative integer value that indicates the maximum number of results to be returned \n in the result segment, up to the per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns an enumerable collection of the blobs in the container that are retrieved lazily.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An enumerable collection of objects that implement and are retrieved lazily.\n \n \n \n Returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix, including the container name.\n A returned by a previous listing operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix, including the container name.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A result segment containing objects that implement .\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix, including the container name.\n A returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix, including the container name.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n An that references the pending asynchronous operation.\n A result segment containing objects that implement .\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix, including the container name.\n A returned by a previous listing operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n A returned by a previous listing operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets a reference to a blob from the service.\n \n The URI of the blob. The service assumes this is the URI for the blob in the primary location.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An object of type containing a reference to the blob.\n \n \n \n Gets a reference to a blob from the service.\n \n The URI of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies any additional options for the request.\n An object that represents the context for the current operation.\n An object of type containing a reference to the blob.\n \n \n \n Begins an asynchronous operation to get a reference to a blob from the service.\n \n The URI of the blob. The service assumes this is the URI for the blob in the primary location.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get a reference to a blob from the service.\n \n The URI of the blob. The service assumes this is the URI for the blob in the primary location.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get a reference to a blob from the service.\n \n The URI of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies any additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get a reference to a blob from the service.\n \n An that references the pending asynchronous operation.\n A reference to the blob.\n \n \n \n Returns a task that gets a reference to a blob from the service.\n \n The URI of the blob. The service assumes this is the URI for the blob in the primary location.\n A object that represents the current operation.\n \n \n \n Returns a task that gets a reference to a blob from the service.\n \n The URI of the blob. The service assumes this is the URI for the blob in the primary location.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a object that gets a reference to a blob from the service.\n \n The URI of the blob. The service assumes this is the URI for the blob in the primary location.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that gets a reference to a blob from the service.\n \n The URI of the blob. The service assumes this is the URI for the blob in the primary location.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that gets a reference to a blob from the service.\n \n The URI of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n An object that specifies any additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that gets a reference to a blob from the service.\n \n The URI of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n An object that specifies any additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Core implementation for the ListContainers method.\n \n The container prefix.\n The details included.\n The continuation token.\n A non-negative integer value that indicates the maximum number of results to be returned \n in the result segment, up to the per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A object that specifies additional options for the request.\n A that lists the containers.\n \n \n \n Implements the FetchAttributes method. The attributes are updated immediately.\n \n The URI of the blob.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that fetches the attributes.\n \n \n \n Begins an asynchronous operation to get the properties of the blob service.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get the properties of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get the properties of the blob service.\n \n An that references the pending asynchronous operation.\n The blob service properties.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the blob service.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the blob service.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the properties of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The blob service properties.\n \n \n \n Begins an asynchronous operation to set the properties of the blob service.\n \n The blob service properties.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to set the properties of the blob service.\n \n The blob service properties.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to set the properties of the blob service.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that gets the properties of the blob service.\n \n The blob service properties.\n A object that represents the current operation.\n \n \n \n Returns a task that gets the properties of the blob service.\n \n The blob service properties.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that gets the properties of the blob service.\n \n The blob service properties.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that gets the properties of the blob service.\n \n The blob service properties.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets the properties of the blob service.\n \n The blob service properties.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to get the stats of the blob service.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get the stats of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get the stats of the blob service.\n \n An that references the pending asynchronous operation.\n The blob service stats.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the blob service.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the blob service.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the stats of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The blob service stats.\n \n \n \n Stores the default delimiter.\n \n \n \n \n Stores the parallelism factor.\n \n \n \n \n Default is 32 MB.\n \n \n \n \n The default server and client timeout interval.\n \n \n \n \n Max execution time across all potential retries.\n \n \n \n \n Initializes a new instance of the class using the specified Blob service endpoint\n and anonymous credentials.\n \n The Blob service endpoint to use to create the client.\n \n \n \n Initializes a new instance of the class using the specified Blob service endpoint\n and account credentials.\n \n The Blob service endpoint to use to create the client.\n The account credentials.\n \n \n \n Initializes a new instance of the class using the specified Blob service endpoint\n and account credentials.\n \n The Blob service endpoint to use to create the client.\n The account credentials.\n \n \n \n Returns a reference to the root container for this service client.\n \n A reference to the root container.\n \n \n \n Returns a reference to a object with the specified name.\n \n The name of the container, or an absolute URI to the container.\n A reference to a container.\n \n \n \n Parses the user prefix.\n \n The prefix.\n Name of the container.\n The listing prefix.\n \n \n \n Gets or sets the authentication scheme to use to sign HTTP requests.\n \n \n \n \n Gets the authentication handler used to sign HTTP requests.\n \n The authentication handler.\n \n \n \n Gets or sets a buffer manager that implements the interface, \n specifying a buffer pool for use with operations against the Blob service client.\n \n \n \n \n Gets the account credentials used to create the Blob service client.\n \n The account credentials.\n \n \n \n Gets the base URI for the Blob service client, at the primary location.\n \n The base URI used to construct the Blob service client, at the primary location.\n \n \n \n Gets the Blob service endpoints for all locations.\n \n An object of type containing Blob service URIs for all locations.\n \n \n \n Gets or sets the default retry policy for requests made via the Blob service client.\n \n The retry policy.\n \n \n \n Gets or sets the default location mode for requests made via the Blob service client.\n \n The location mode.\n \n \n \n Gets or sets the default server and client timeout for requests made via the Blob service client.\n \n The server and client timeout interval.\n \n \n \n Gets or sets the maximum execution time across all potential retries.\n \n The maximum execution time across all potential retries.\n \n \n \n Gets or sets the default delimiter that may be used to create a virtual directory structure of blobs.\n \n The default delimiter.\n \n \n \n Gets or sets the maximum size of a blob in bytes that may be uploaded as a single blob. \n \n The maximum size of a blob, in bytes, that may be uploaded as a single blob,\n ranging from between 1 and 64 MB inclusive.\n \n \n \n Gets or sets the number of blocks that may be simultaneously uploaded when uploading a blob that is greater than \n the value specified by the property in size.\n \n The number of parallel operations that may proceed.\n \n \n \n Gets a value indicating whether the service client is used with Path style or Host style.\n \n Is true if use path style URIs; otherwise, false.\n \n \n \n Represents a container in the Windows Azure Blob service.\n \n Containers hold directories, which are encapsulated as objects, and directories hold block blobs and page blobs. Directories can also contain sub-directories.\n \n Represents a container in the Windows Azure Blob service.\n \n \n \n \n Creates the container.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object\n is used to track requests to the storage service, and to provide additional runtime information about the operation. \n \n \n \n Creates the container and specifies the level of access to the container's data.\n \n An object that specifies whether data in the container may be accessed publicly and what level of access is to be allowed.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object\n is used to track requests to the storage service, and to provide additional runtime information about the operation. \n \n \n \n Begins an asynchronous operation to create a container.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a container.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a container and specify the level of access to the container's data.\n \n An object that specifies whether data in the container may be accessed publicly and what level of access is to be allowed. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to create a container.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that creates a container.\n \n A object that represents the current operation.\n \n \n \n Returns a task that creates a container.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that creates a container.\n \n An object that specifies whether data in the container may be accessed publicly and what level of access is to be allowed.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that creates a container and specifies the level of access to the container's data.\n \n An object that specifies whether data in the container may be accessed publicly and what level of access is to be allowed. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Creates the container if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the container did not already exist and was created; otherwise false.\n \n \n \n Creates the container if it does not already exist and specifies whether the container or its blobs are publicly accessible.\n \n An object that specifies whether data in the container may be accessed publicly and what level of access is to be allowed. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the container did not already exist and was created; otherwise false.\n \n \n \n Begins an asynchronous request to create the container if it does not already exist.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to create the container if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to create the container if it does not already exist.\n \n An object that specifies whether data in the container may be accessed publicly and the level of access.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to create the container if it does not already exist.\n \n An that references the pending asynchronous operation.\n true if the container did not already exist and was created; otherwise, false.\n \n \n \n Returns a task that creates the container if it does not already exist.\n \n A object that represents the current operation.\n \n \n \n Returns a task that creates the container if it does not already exist.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that creates the container if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that creates the container if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that creates the container if it does not already exist.\n \n An object that specifies whether data in the container may be accessed publicly and the level of access.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that creates the container if it does not already exist.\n \n An object that specifies whether data in the container may be accessed publicly and the level of access.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the container.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to delete a container.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete a container.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete a container.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that deletes the container.\n \n A object that represents the current operation.\n \n \n \n Returns a task that deletes the container.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that deletes the container.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that deletes the container.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the container if it already exists.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the container did not already exist and was created; otherwise false.\n \n \n \n Begins an asynchronous request to delete the container if it already exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to delete the container if it already exists.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to delete the container if it already exists.\n \n An that references the pending asynchronous operation.\n true if the container did not already exist and was created; otherwise, false.\n \n \n \n Returns a task that deletes the container if it already exists.\n \n A object that represents the current operation.\n \n \n \n Returns a task that deletes the container if it already exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that deletes the container if it already exists.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that deletes the container if it already exists.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets a reference to a blob in this container.\n \n The name of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A reference to the blob.\n \n \n \n Begins an asynchronous operation to get a reference to a blob in this container.\n \n The name of the blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get a reference to a blob in this container.\n \n The name of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get a reference to a blob in this container.\n \n An that references the pending asynchronous operation.\n A reference to the blob.\n \n \n \n Returns a task that gets a reference to a blob in this container.\n \n The name of the blob.\n A object that represents the current operation.\n \n \n \n Returns a task that gets a reference to a blob in this container.\n \n The name of the blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that gets a reference to a blob in this container.\n \n The name of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that gets a reference to a blob in this container.\n \n The name of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns an enumerable collection of the blobs in the container that are retrieved lazily.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An enumerable collection of objects that implement and are retrieved lazily.\n \n \n \n Returns a result segment containing a collection of blob items \n in the container.\n \n A continuation token returned by a previous listing operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n A continuation token returned by a previous listing operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A result segment containing objects that implement .\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n A continuation token returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n A continuation token returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n An that references the pending asynchronous operation.\n A result segment containing objects that implement .\n \n \n \n Returns a task that returns a result segment containing a collection of blob items \n in the container.\n \n A continuation token returned by a previous listing operation.\n \n \n \n Returns a task that returns a result segment containing a collection of blob items \n in the container.\n \n A continuation token returned by a previous listing operation.\n A to observe while waiting for a task to complete.\n \n \n \n Returns a task that returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n A continuation token returned by a previous listing operation.\n \n \n \n Returns a task that returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n A continuation token returned by a previous listing operation.\n A to observe while waiting for a task to complete.\n \n \n \n Returns a task that returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets permissions for the container.\n \n The permissions to apply to the container.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous request to set permissions for the container.\n \n The permissions to apply to the container.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to set permissions for the container.\n \n The permissions to apply to the container.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to set permissions for the container.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that sets permissions for the container.\n \n The permissions to apply to the container.\n A object that represents the current operation.\n \n \n \n Returns a task that sets permissions for the container.\n \n The permissions to apply to the container.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that sets permissions for the container.\n \n The permissions to apply to the container.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that sets permissions for the container.\n \n The permissions to apply to the container.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the permissions settings for the container.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The container's permissions.\n \n \n \n Begins an asynchronous request to get the permissions settings for the container.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to get the permissions settings for the container.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to get the permissions settings for the container.\n \n An that references the pending asynchronous operation.\n The container's permissions.\n \n \n \n Returns a task that gets the permissions settings for the container.\n \n A object that represents the current operation.\n \n \n \n Returns a task that gets the permissions settings for the container.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that gets the permissions settings for the container.\n \n An object that represents the access conditions for the container. If null, no condition is used. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that gets the permissions settings for the container.\n \n An object that represents the access conditions for the container. If null, no condition is used. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Checks whether the container exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the container exists.\n \n \n \n Checks whether the container exists.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the container exists.\n \n \n \n Begins an asynchronous request to check whether the container exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check whether the container exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check whether the container exists.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to check whether the container exists.\n \n An that references the pending asynchronous operation.\n true if the container exists.\n \n \n \n Returns a task that checks whether the container exists.\n \n A object that represents the current operation.\n \n \n \n Returns a task that checks whether the container exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that checks whether the container exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that checks whether the container exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Retrieves the container's attributes.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to retrieve the container's attributes.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to retrieve the container's attributes.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to retrieve the container's attributes.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that retrieves the container's attributes.\n \n A object that represents the current operation.\n \n \n \n Returns a task that retrieves the container's attributes.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that retrieves the container's attributes.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that retrieves the container's attributes.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets the container's user-defined metadata.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to set user-defined metadata on the container.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to set user-defined metadata on the container.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous request operation to set user-defined metadata on the container.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that sets container's user-defined metadata.\n \n A object that represents the current operation.\n \n \n \n Returns a task that sets container's user-defined metadata.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that sets container's user-defined metadata.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that sets container's user-defined metadata.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Acquires a lease on this container.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n The ID of the acquired lease.\n \n \n \n Begins an asynchronous operation to acquire a lease on this container.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to acquire a lease on this container.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to acquire a lease on this container.\n \n An IAsyncResult that references the pending asynchronous operation.\n The ID of the acquired lease.\n \n \n \n Returns a task that acquires a lease on this container.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n A object that represents the current operation.\n \n \n \n Returns a task that acquires a lease on this container.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that acquires a lease on this container.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that acquires a lease on this container.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Renews a lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to renew a lease on this container.\n \n An IAsyncResult that references the pending asynchronous operation.\n \n \n \n Returns a task that renews a lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that renews a lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that renews a lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that renews a lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Changes the lease ID on this container.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the container, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n The new lease ID.\n \n \n \n Begins an asynchronous operation to change the lease on this container.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the container, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to change the lease on this container.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the container, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to change the lease on this container.\n \n An IAsyncResult that references the pending asynchronous operation.\n The new lease ID.\n \n \n \n Returns a task that changes the lease ID on this container.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the container, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that changes the lease ID on this container.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the container, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that changes the lease ID on this container.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the container, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that changes the lease ID on this container.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the container, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Releases the lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to release the lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to release the lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to release the lease on this container.\n \n An IAsyncResult that references the pending asynchronous operation.\n \n \n \n Returns a task that releases the lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that releases the lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that releases the lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that releases the lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Breaks the current lease on this container.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Begins an asynchronous operation to break the current lease on this container.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to break the current lease on this container.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to break the current lease on this container.\n \n An IAsyncResult that references the pending asynchronous operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Returns a task that breaks the current lease on this container.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n A object that represents the current operation.\n \n \n \n Returns a task that breaks the current lease on this container.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that breaks the current lease on this container.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that breaks the current lease on this container.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Generates a RESTCommand for acquiring a lease.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation. This parameter must not be null.\n A RESTCommand implementing the acquire lease operation.\n \n \n \n Generates a RESTCommand for renewing a lease.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation, including the current lease ID.\n This cannot be null.\n A RESTCommand implementing the renew lease operation.\n \n \n \n Generates a RESTCommand for changing a lease ID.\n \n The proposed new lease ID.\n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation, including the current lease ID. This cannot be null.\n A RESTCommand implementing the change lease ID operation.\n \n \n \n Generates a RESTCommand for releasing a lease.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation, including the current lease ID.\n This cannot be null.\n A RESTCommand implementing the release lease operation.\n \n \n \n Generates a RESTCommand for breaking a lease.\n \n The amount of time to allow the lease to remain, rounded down to seconds.\n If null, the break period is the remainder of the current lease, or zero for infinite leases.\n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation. Cannot be null.\n A RESTCommand implementing the break lease operation.\n \n \n \n Implementation for the Create method.\n \n A object that specifies additional options for the request.\n An object that specifies whether data in the container may be accessed publicly and the level of access. \n A that creates the container.\n \n \n \n Implementation for the Delete method.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n A that deletes the container.\n \n \n \n Implementation for the FetchAttributes method.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n A that fetches the attributes.\n \n \n \n Implementation for the Exists method.\n \n A object that specifies additional options for the request.\n If true, the command will be executed against the primary location.\n A that checks existence.\n \n \n \n Implementation for the SetMetadata method.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n A that sets the metadata.\n \n \n \n Implementation for the SetPermissions method.\n \n The permissions to set.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n A that sets the permissions.\n \n \n \n Implementation for the GetPermissions method.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n A that gets the permissions.\n \n \n \n Selects the protocol response.\n \n The protocol item.\n The parsed .\n \n \n \n Core implementation of the ListBlobs method.\n \n The blob prefix.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A object that specifies additional options for the request.\n A continuation token returned by a previous listing operation.\n A that lists the blobs.\n \n \n \n Retrieve ETag and LastModified date time from response.\n \n The response to parse.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the container.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the container.\n The account credentials.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the container.\n The account credentials.\n \n \n \n Initializes a new instance of the class.\n \n The container name.\n A client object that specifies the endpoint for the Blob service.\n \n \n \n Initializes a new instance of the class.\n \n The properties.\n The metadata.\n The container name.\n The client to be used.\n \n \n \n Parse URI for SAS (Shared Access Signature) information.\n \n The complete Uri.\n The credentials to use.\n \n \n \n Returns the canonical name for shared access.\n \n The canonical name.\n \n \n \n Returns a shared access signature for the container.\n \n The access policy for the shared access signature.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Returns a shared access signature for the container.\n \n The access policy for the shared access signature.\n A container-level access policy.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Gets a reference to a page blob in this container.\n \n The name of the blob.\n A reference to a page blob.\n \n \n \n Returns a reference to a page blob in this virtual directory.\n \n The name of the page blob.\n The snapshot timestamp, if the blob is a snapshot.\n A reference to a page blob.\n \n \n \n Gets a reference to a block blob in this container.\n \n The name of the blob.\n A reference to a block blob.\n \n \n \n Gets a reference to a block blob in this container.\n \n The name of the blob.\n The snapshot timestamp, if the blob is a snapshot.\n A reference to a block blob.\n \n \n \n Gets a reference to a virtual blob directory beneath this container.\n \n The name of the virtual blob directory.\n A reference to a virtual blob directory.\n \n \n \n Gets the service client for the container.\n \n A client object that specifies the endpoint for the Blob service.\n \n \n \n Gets the container's URI for the primary location.\n \n The absolute URI to the container, at the primary location.\n \n \n \n Gets the container's URIs for all locations.\n \n An object of type containing the container's URIs for all locations.\n \n \n \n Gets the name of the container.\n \n The container's name.\n \n \n \n Gets the container's metadata.\n \n The container's metadata.\n \n \n \n Gets the container's system properties.\n \n The container's properties.\n \n \n \n Represents a virtual directory of blobs, designated by a delimiter character.\n \n Containers, which are encapsulated as objects, hold directories, and directories hold block blobs and page blobs. Directories can also contain sub-directories.\n \n Represents a virtual directory of blobs on the client which emulates a hierarchical data store by using delimiter characters.\n \n Containers, which are encapsulated as objects, hold directories, and directories hold block blobs and page blobs. Directories can also contain sub-directories.\n \n \n \n Represents an item that may be returned by a blob listing operation.\n \n \n \n \n Gets the URI to the blob item, at the primary location.\n \n The blob item's URI.\n \n \n \n Gets the blob item's URIs for all locations.\n \n An object of type containing the blob item's URIs for all locations.\n \n \n \n Gets the blob item's parent virtual directory.\n \n The blob item's parent virtual directory.\n \n \n \n Gets the blob item's container.\n \n The blob item's container.\n \n \n \n Returns an enumerable collection of the blobs in the virtual directory that are retrieved lazily.\n \n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An enumerable collection of objects that implement and are retrieved lazily.\n \n \n \n Returns a result segment containing a collection of blob items \n in the virtual directory.\n \n A continuation token returned by a previous listing operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of blob items \n in the virtual directory.\n \n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A result segment containing objects that implement .\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of blob items \n in the virtual directory.\n \n A continuation token returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of blob items \n in the virtual directory.\n \n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return a result segment containing a collection of blob items \n in the virtual directory.\n \n An that references the pending asynchronous operation.\n A result segment containing objects that implement .\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the virtual directory.\n \n A continuation token returned by a previous listing operation. \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the virtual directory.\n \n A continuation token returned by a previous listing operation. \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the virtual directory.\n \n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the virtual directory.\n \n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Stores the parent directory.\n \n \n \n \n Initializes a new instance of the class given an address and a client.\n \n The blob directory's Uri.\n The blob directory's prefix. \n The container for the virtual directory.\n \n \n \n Gets a reference to a page blob in this virtual directory.\n \n The name of the blob.\n A reference to a page blob.\n \n \n \n Returns a reference to a page blob in this virtual directory.\n \n The name of the page blob.\n The snapshot timestamp, if the blob is a snapshot.\n A reference to a page blob.\n \n \n \n Gets a reference to a block blob in this virtual directory.\n \n The name of the blob.\n A reference to a block blob.\n \n \n \n Gets a reference to a block blob in this virtual directory.\n \n The name of the blob.\n The snapshot timestamp, if the blob is a snapshot.\n A reference to a block blob.\n \n \n \n Returns a virtual subdirectory within this virtual directory.\n \n The name of the virtual subdirectory.\n A object representing the virtual subdirectory.\n \n \n \n Gets the service client for the virtual directory.\n \n A client object that specifies the endpoint for the Windows Azure Blob service.\n \n \n \n Gets the URI that identifies the virtual directory for the primary location.\n \n The URI to the virtual directory, at the primary location.\n \n \n \n Gets the blob directory's URIs for all locations.\n \n An object of type containing the blob directory's URIs for all locations.\n \n \n \n Gets the container for the virtual directory.\n \n The container for the virtual directory.\n \n \n \n Gets the parent directory for the virtual directory.\n \n The virtual directory's parent directory.\n \n \n \n Gets the prefix.\n \n The prefix.\n \n \n \n Called when the asynchronous operation to commit the blob started by UploadFromStream finishes.\n \n The result of the asynchronous operation.\n \n \n \n Implements getting the stream without specifying a range.\n \n The blob.\n The attributes.\n The destination stream.\n The offset.\n The length.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A that gets the stream.\n \n \n \n \n Implements the FetchAttributes method. The attributes are updated immediately.\n \n The blob.\n The attributes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A that fetches the attributes.\n \n \n \n \n Implementation for the Exists method.\n \n The blob.\n The attributes.\n An object that specifies additional options for the request.\n If true, the command will be executed against the primary location.\n \n A that checks existence.\n \n \n \n \n Implementation for the SetMetadata method.\n \n The blob.\n The attributes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A that sets the metadata.\n \n \n \n \n Implementation for the SetProperties method.\n \n The blob.\n The attributes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A that sets the properties.\n \n \n \n \n Implements the DeleteBlob method.\n \n The blob.\n The attributes.\n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A that deletes the blob.\n \n \n \n \n Generates a for acquiring a lease.\n \n The blob.\n The attributes.\n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A implementing the acquire lease operation.\n \n \n \n \n Generates a for renewing a lease.\n \n The blob.\n The attributes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A implementing the renew lease operation.\n \n accessCondition\n \n \n \n Generates a for changing a lease ID.\n \n The blob.\n The attributes.\n The proposed new lease ID.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A implementing the change lease ID operation.\n \n accessCondition\n \n \n \n Generates a for releasing a lease.\n \n The blob.\n The attributes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A implementing the release lease operation.\n \n accessCondition\n \n \n \n Generates a for breaking a lease.\n \n The blob.\n The attributes.\n The amount of time to allow the lease to remain, rounded down to seconds.\n If null, the break period is the remainder of the current lease, or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A implementing the break lease operation.\n \n \n \n \n Implementation of the StartCopyFromBlob method. Result is a BlobAttributes object derived from the response headers.\n \n The blob.\n The attributes.\n The URI of the source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A that starts to copy the blob.\n \n sourceAccessCondition\n \n \n \n Implementation of the AbortCopy method. No result is produced.\n \n The blob.\n The attributes.\n The copy ID of the copy operation to abort.\n An object that represents the access conditions for the operation. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A that aborts the copy.\n \n \n \n \n Updates this blob with the given attributes at the end of a fetch attributes operation.\n \n The new attributes.\n The response.\n if set to true, blob's MD5 will not be updated.\n \n \n \n \n Retrieve ETag, LMT, and Sequence-Number from response.\n \n The attributes.\n The response to parse.\n \n \n \n Converts the source blob of a copy operation to an appropriate access URI, taking Shared Access Signature credentials into account.\n \n The source blob.\n A URI addressing the source blob, using SAS if appropriate.\n \n \n \n Represents a blob that is uploaded as a set of blocks.\n \n \n Represents a blob that is uploaded as a set of blocks.\n \n \n \n \n An interface required for Windows Azure blob types. The and classes implement the interface.\n \n \n An interface required for Windows Azure blob types. The and classes implement the interface.\n \n \n \n \n Opens a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A stream to be used for reading from the blob.\n On the object returned by this method, the method must be called exactly once for every call. Failing to end a read process before beginning another read can cause unknown behavior.\n \n \n \n Begins an asynchronous operation to open a stream for reading from the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to open a stream for reading from the blob.\n \n An that references the pending asynchronous operation.\n A stream to be used for reading from the blob.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a stream to the Windows Azure Blob Service. \n \n The stream providing the blob content. Use a seek-able stream for optimal performance.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Uploads a stream to the Windows Azure Blob Service. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a blob.\n \n The stream providing the blob content.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation. \n \n \n \n Begins an asynchronous operation to upload a stream to a blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a block blob.\n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a stream to a blob. \n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a blob.\n \n The stream providing the blob content.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a blob.\n \n The stream providing the blob content.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob.\n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob.\n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Uploads a file to the Windows Azure Blob Service. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation. \n \n \n \n Begins an asynchronous operation to upload a file to a blob. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a file to a blob. \n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Uploads the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload the contents of a byte array to a blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Downloads the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a stream.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Downloads the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a file.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Downloads the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The total number of bytes read into the buffer.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a byte array.\n \n An that references the pending asynchronous operation.\n The total number of bytes read into the buffer.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Downloads a range of bytes from a blob to a stream.\n \n The target stream.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download a range of bytes from a blob to a stream.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Downloads a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The total number of bytes read into the buffer.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n An that references the pending asynchronous operation.\n The total number of bytes read into the buffer.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Checks existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob exists.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to check existence of the blob.\n \n An that references the pending asynchronous operation.\n true if the blob exists.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Populates a blob's properties and metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to populate the blob's properties and metadata.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to populate the blob's properties and metadata.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Updates the blob's metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to update the blob's metadata.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to update the blob's metadata.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Updates the blob's properties.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to update the blob's properties.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to update the blob's properties.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Deletes the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to delete the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete the blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Deletes the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob did not already exist and was created; otherwise false.\n \n \n \n Begins an asynchronous request to delete the blob if it already exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to delete the blob if it already exists.\n \n An that references the pending asynchronous operation.\n true if the blob did not already exist and was created; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Acquires a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds.\n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The ID of the acquired lease.\n \n \n \n Begins an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds.\n A string representing the proposed lease ID for the new lease.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds.\n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to acquire a lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n The ID of the acquired lease.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds.\n A string representing the proposed lease ID for the new lease.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds.\n A string representing the proposed lease ID for the new lease.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds.\n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds.\n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Renews a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to renew a lease on this blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Changes the lease ID on this blob.\n \n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The new lease ID.\n \n \n \n Begins an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to change the lease on this blob.\n \n An that references the pending asynchronous operation.\n The new lease ID.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Releases the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to release the lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Breaks the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Begins an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to break the current lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Requests that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob.\n An object that represents the access conditions for the destination blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The copy ID associated with the copy operation. \n \n \n \n Begins an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob.\n An object that represents the access conditions for the destination blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n An that references the pending asynchronous operation.\n The copy ID associated with the copy operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob.\n An object that represents the access conditions for the destination blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob.\n An object that represents the access conditions for the destination blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Aborts an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to abort an ongoing blob copy operation.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n A container-level access policy.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n The optional header values to set for a blob accessed with this SAS.\n A shared access signature.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n The optional header values to set for a blob returned with this SAS.\n A stored access policy.\n A shared access signature.\n \n \n \n Gets the blob item's name.\n \n The blob item's name.\n \n \n \n Gets the object that represents the Blob service.\n \n A client object that specifies the Blob service endpoint.\n \n \n \n Gets or sets the number of bytes to buffer when writing to a page blob stream or\n the block size for writing to a block blob.\n \n The number of bytes to buffer or the size of a block, in bytes.\n \n \n \n Gets or sets the minimum number of bytes to buffer when reading from a blob stream.\n \n The minimum number of bytes to buffer.\n \n \n \n Gets the blob's system properties.\n \n The blob's properties.\n \n \n \n Gets the user-defined metadata for the blob.\n \n The blob's metadata, as a collection of name-value pairs.\n \n \n \n Gets the date and time that the blob snapshot was taken, if this blob is a snapshot.\n \n The blob's snapshot time if the blob is a snapshot; otherwise, null.\n \n If the blob is not a snapshot, the value of this property is null.\n \n \n \n \n Gets a value indicating whether this blob is a snapshot.\n \n true if this blob is a snapshot; otherwise, false.\n \n \n \n Gets the absolute URI to the blob, including query string information if the blob is a snapshot, at the primary location.\n \n The absolute URI to the blob, including snapshot query information if the blob is a snapshot, at the primary location.\n \n \n \n Gets the blob's URI for all locations, including query string information if the blob is a snapshot.\n \n An object of type containing the blob's URIs for all locations, \n including snapshot query information if the blob is a snapshot.\n \n \n \n Gets the state of the most recent or pending copy operation.\n \n A object containing the copy state, or null if no copy blob state exists for this blob.\n \n \n \n Gets the type of the blob.\n \n The type of the blob.\n \n \n \n Opens a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A stream to be used for reading from the blob.\n On the object returned by this method, the method must be called exactly once for every call. Failing to end a read process before beginning another read can cause unknown behavior.\n \n \n \n Begins an asynchronous operation to open a stream for reading from the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to open a stream for reading from the blob.\n \n An that references the pending asynchronous operation.\n A stream to be used for reading from the blob.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Opens a stream for writing to the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A stream to be used for writing to the blob.\n \n \n \n Begins an asynchronous operation to open a stream for writing to the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to open a stream for writing to the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to open a stream for writing to the blob.\n \n An that references the pending asynchronous operation.\n A stream to be used for writing to the blob.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a stream to a block blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Uploads a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Uploads a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a block blob.\n \n The stream providing the blob content.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a block blob.\n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a stream to a block blob. \n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a file to the Blob service. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation. \n \n \n \n Begins an asynchronous operation to upload a file to a blob. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Called when the asynchronous UploadFromStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a file to a blob. \n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload the contents of a byte array to a blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a string of text to a blob. \n \n The text to upload.\n An object that indicates the text encoding to use. If null, UTF-8 will be used.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a string of text to a blob. \n \n The text to upload.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a string of text to a blob. \n \n The text to upload.\n An object that indicates the text encoding to use. If null, UTF-8 will be used.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a string of text to a blob. \n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a string of text to a blob.\n \n The text to upload.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a string of text to a blob.\n \n The text to upload.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a string of text to a blob.\n \n The text to upload.\n An object that indicates the text encoding to use. If null, UTF-8 will be used.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a string of text to a blob.\n \n The text to upload.\n An object that indicates the text encoding to use. If null, UTF-8 will be used.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a stream.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Called when the asynchronous DownloadToStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a file.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The total number of bytes read into the buffer.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a byte array.\n \n An that references the pending asynchronous operation.\n The total number of bytes read into the buffer.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads the blob's contents as a string.\n \n An object that indicates the text encoding to use.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The contents of the blob, as a string.\n \n \n \n Begins an asynchronous operation to download the blob's contents as a string.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the blob's contents as a string.\n \n An object that indicates the text encoding to use.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Called when the asynchronous DownloadToStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the blob's contents as a string.\n \n An that references the pending asynchronous operation.\n The contents of the blob, as a string.\n \n \n \n Returns a task that performs an asynchronous operation to download the blob's contents as a string.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the blob's contents as a string.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the blob's contents as a string.\n \n An object that indicates the text encoding to use.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the blob's contents as a string.\n \n An object that indicates the text encoding to use.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download a range of bytes from a blob to a stream.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The total number of bytes read into the buffer.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Called when the asynchronous DownloadRangeToStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n An that references the pending asynchronous operation.\n The total number of bytes read into the buffer.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Checks existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob exists.\n \n \n \n Checks existence of the blob.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob exists.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to check existence of the blob.\n \n An that references the pending asynchronous operation.\n true if the blob exists.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Populates a blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to populate the blob's properties and metadata.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to populate the blob's properties and metadata.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Updates the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to update the blob's metadata.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to update the blob's metadata.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Updates the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to update the blob's properties.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to update the blob's properties.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to delete the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete the blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob did already exist and was deleted; otherwise false.\n \n \n \n Begins an asynchronous request to delete the blob if it already exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to delete the blob if it already exists.\n \n An that references the pending asynchronous operation.\n true if the blob did already exist and was deleted; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Creates a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request, or null.\n An object that represents the context for the current operation.\n A blob snapshot.\n \n \n \n Begins an asynchronous operation to create a snapshot of the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request, or null.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to create a snapshot of the blob.\n \n An that references the pending asynchronous operation.\n A blob snapshot.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Acquires a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n The ID of the acquired lease.\n \n \n \n Begins an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to acquire a lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n The ID of the acquired lease.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Renews a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to renew a lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Changes the lease ID on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n The new lease ID.\n \n \n \n Begins an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to change the lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n The new lease ID.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Releases the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to release the lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Breaks the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Begins an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to break the current lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a single block.\n \n A base64-encoded block ID that identifies the block.\n A stream that provides the data for the block.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a single block.\n \n A base64-encoded block ID that identifies the block.\n A stream that provides the data for the block.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a single block.\n \n A base64-encoded block ID that identifies the block.\n A stream that provides the data for the block.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a single block.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a single block.\n \n A base64-encoded block ID that identifies the block.\n A stream that provides the data for the block.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a single block.\n \n A base64-encoded block ID that identifies the block.\n A stream that provides the data for the block.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a single block.\n \n A base64-encoded block ID that identifies the block.\n A stream that provides the data for the block.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a single block.\n \n A base64-encoded block ID that identifies the block.\n A stream that provides the data for the block.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a list of blocks to a new or existing blob. \n \n An enumerable collection of block IDs, as base64-encoded strings.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a list of blocks to a new or existing blob. \n \n An enumerable collection of block IDs, as base64-encoded strings.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a list of blocks to a new or existing blob. \n \n An enumerable collection of block IDs, as base64-encoded strings.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a list of blocks to a new or existing blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a list of blocks to a new or existing blob. \n \n An enumerable collection of block IDs, as base64-encoded strings.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a list of blocks to a new or existing blob. \n \n An enumerable collection of block IDs, as base64-encoded strings.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a list of blocks to a new or existing blob. \n \n An enumerable collection of block IDs, as base64-encoded strings.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a list of blocks to a new or existing blob. \n \n An enumerable collection of block IDs, as base64-encoded strings.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns an enumerable collection of the blob's blocks, using the specified block list filter.\n \n One of the enumeration values that indicates whether to return \n committed blocks, uncommitted blocks, or both.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An enumerable collection of objects implementing .\n \n \n \n Begins an asynchronous operation to return an enumerable collection of the blob's blocks, \n using the specified block list filter.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return an enumerable collection of the blob's blocks, \n using the specified block list filter.\n \n One of the enumeration values that indicates whether to return \n committed blocks, uncommitted blocks, or both.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return an enumerable collection of the blob's blocks, \n using the specified block list filter.\n \n An that references the pending asynchronous operation.\n An enumerable collection of objects implementing .\n \n \n \n Returns a task that performs an asynchronous operation to return an enumerable collection of the blob's blocks, \n using the specified block list filter.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return an enumerable collection of the blob's blocks, \n using the specified block list filter.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return an enumerable collection of the blob's blocks, \n using the specified block list filter.\n \n One of the enumeration values that indicates whether to return \n committed blocks, uncommitted blocks, or both.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return an enumerable collection of the blob's blocks, \n using the specified block list filter.\n \n One of the enumeration values that indicates whether to return \n committed blocks, uncommitted blocks, or both.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Requests that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The copy ID associated with the copy operation.\n \n This method fetches the blob's ETag, last modified time, and part of the copy state.\n The copy ID and copy status fields are fetched, and the rest of the copy state is cleared.\n \n \n \n \n Requests that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The copy ID associated with the copy operation.\n \n This method fetches the blob's ETag, last modified time, and part of the copy state.\n The copy ID and copy status fields are fetched, and the rest of the copy state is cleared.\n \n \n \n \n Begins an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The source blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation. \n \n \n \n Ends an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n An that references the pending asynchronous operation.\n The copy ID associated with the copy operation.\n \n This method fetches the blob's ETag, last modified time, and part of the copy state.\n The copy ID and copy status fields are fetched, and the rest of the copy state is cleared.\n \n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Aborts an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to abort an ongoing blob copy operation.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Implementation for the CreateSnapshot method.\n \n A collection of name-value pairs defining the metadata of the snapshot, or null.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that creates the snapshot.\n If the metadata parameter is null then no metadata is associated with the request.\n \n \n \n Uploads the full blob from a seekable stream.\n \n The content stream. Must be seekable.\n Number of bytes to upload from the content stream starting at its current position.\n The content MD5.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that gets the stream.\n \n \n \n Uploads the block.\n \n The source stream.\n The block ID.\n The content MD5.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that uploads the block.\n \n \n \n Uploads the block list.\n \n The blocks to upload.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that uploads the block list.\n \n \n \n Gets the download block list.\n \n The types of blocks.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that gets the download block list.\n \n \n \n Default is 4 MB.\n \n \n \n \n Default is 4 MB.\n \n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob.\n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob.\n The account credentials.\n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob.\n The snapshot timestamp, if the blob is a snapshot.\n The account credentials.\n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob.\n The snapshot timestamp, if the blob is a snapshot.\n The account credentials.\n \n \n \n Initializes a new instance of the class using the specified blob name and\n the parent container reference.\n If snapshotTime is not null, the blob instance represents a Snapshot.\n \n Name of the blob.\n Snapshot time in case the blob is a snapshot.\n The reference to the parent container.\n \n \n \n Initializes a new instance of the class.\n \n The attributes.\n The service client.\n \n \n \n Stores the that contains this blob.\n \n \n \n \n Stores the blob's parent .\n \n \n \n \n Stores the blob's attributes.\n \n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n A stored access policy.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n The optional header values to set for a blob accessed with this SAS.\n A shared access signature.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n The optional header values to set for a blob returned with this SAS.\n A stored access policy.\n A shared access signature.\n \n \n \n Gets the canonical name of the blob, formatted as /<account-name>/<container-name>/<blob-name>.\n If ignoreSnapshotTime is false and this blob is a snapshot, the canonical name is augmented with a\n query of the form ?snapshot=<snapshot-time>.\n This is used by both Shared Access and Copy blob operations.\n \n Indicates if the snapshot time is ignored.\n The canonical name of the blob.\n \n \n \n Parse URI for SAS (Shared Access Signature) and snapshot information.\n \n The complete Uri.\n The credentials to use.\n \n \n \n Gets the object that represents the Blob service.\n \n A client object that specifies the Blob service endpoint.\n \n \n \n Gets or sets the block size for writing to a block blob.\n \n The size of a block, in bytes, ranging from between 16 KB and 4 MB inclusive.\n \n \n \n Gets or sets the minimum number of bytes to buffer when reading from a blob stream.\n \n The minimum number of bytes to buffer, being at least 16KB.\n \n \n \n Gets the blob's system properties.\n \n The blob's properties.\n \n \n \n Gets the user-defined metadata for the blob.\n \n The blob's metadata, as a collection of name-value pairs.\n \n \n \n Gets the blob's URI for the primary location.\n \n The absolute URI to the blob, at the primary location.\n \n \n \n Gets the block blob's URIs for all locations.\n \n An object of type containing the block blob's URIs for all locations.\n \n \n \n Gets the date and time that the blob snapshot was taken, if this blob is a snapshot.\n \n The blob's snapshot time, if the blob is a snapshot. If the blob is not a snapshot, the value of this property is null.\n \n \n \n Gets a value indicating whether this blob is a snapshot.\n \n true if this blob is a snapshot; otherwise, false.\n \n \n \n Gets the absolute URI to the blob, including query string information if the blob is a snapshot.\n \n The absolute URI to the blob, including snapshot query information if the blob is a snapshot.\n \n \n \n Gets the block blob's URI for all locations, including query string information if the blob is a snapshot.\n \n An object of type containing the block blob's URIs for all locations, \n including snapshot query information if the blob is a snapshot.\n \n \n \n Gets the state of the most recent or pending copy operation.\n \n A object containing the copy state, or null if no copy blob state exists for this blob.\n \n \n \n Gets the type of the blob.\n \n The type of the blob.\n \n \n \n Gets the blob's name.\n \n The blob's name.\n \n \n \n Gets a object representing the blob's container.\n \n The blob's container.\n \n \n \n Gets the object representing the\n virtual parent directory for the blob.\n \n The blob's virtual parent directory.\n \n \n \n Represents a Windows Azure page blob.\n \n \n Represents a Windows Azure page blob.\n \n \n \n \n Opens a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A stream to be used for reading from the blob.\n On the object returned by this method, the method must be called exactly once for every call. Failing to end a read process before beginning another read can cause unknown behavior.\n \n \n \n Begins an asynchronous operation to open a stream for reading from the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to open a stream for reading from the blob.\n \n An that references the pending asynchronous operation.\n A stream to be used for reading from the blob.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Opens a stream for writing to the blob.\n \n The size of the page blob, in bytes. The size must be a multiple of 512. If null, the page blob must already exist.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A stream to be used for writing to the blob.\n \n \n \n Begins an asynchronous operation to open a stream for writing to the blob.\n \n The size of the page blob, in bytes. The size must be a multiple of 512. If null, the page blob must already exist.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to open a stream for writing to the blob.\n \n The size of the page blob, in bytes. The size must be a multiple of 512. If null, the page blob must already exist.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to open a stream for writing to the blob.\n \n An that references the pending asynchronous operation.\n A stream to be used for writing to the blob.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n The size of the page blob, in bytes. The size must be a multiple of 512. If null, the page blob must already exist.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n The size of the page blob, in bytes. The size must be a multiple of 512. If null, the page blob must already exist.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n The size of the page blob, in bytes. The size must be a multiple of 512. If null, the page blob must already exist.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n The size of the page blob, in bytes. The size must be a multiple of 512. If null, the page blob must already exist.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a stream.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Called when the asynchronous DownloadToStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a file.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The total number of bytes read into the buffer.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a byte array.\n \n An that references the pending asynchronous operation.\n The total number of bytes read into the buffer.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download a range of bytes from a blob to a stream.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The total number of bytes read into the buffer.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Called when the asynchronous DownloadRangeToStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n An that references the pending asynchronous operation.\n The total number of bytes read into the buffer.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a stream to a page blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Uploads a stream to a page blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Uploads a stream to a page blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a page blob.\n \n The stream providing the blob content.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a page blob.\n \n The stream providing the blob content.\n Specifies the number of bytes from the Stream source to upload from the start position.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n Specifies the number of bytes from the Stream source to upload from the start position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n Specifies the number of bytes from the Stream source to upload from the start position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a stream to a page blob. \n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a file to the Windows Azure Blob Service. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation. \n \n \n \n Begins an asynchronous operation to upload a file to a blob. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Called when the asynchronous UploadFromStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a file to a blob. \n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload the contents of a byte array to a blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Creates a page blob.\n \n The maximum size of the page blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to create a page blob.\n \n The maximum size of the page blob, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a page blob.\n \n The maximum size of the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to create a page blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a page blob.\n \n The maximum size of the blob, in bytes.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a page blob.\n \n The maximum size of the blob, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a page blob.\n \n The maximum size of the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a page blob.\n \n The maximum size of the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Resizes the page blob to the specified size.\n \n The size of the page blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to resize the page blob to the specified size.\n \n The size of the page blob, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to resize the page blob to the specified size.\n \n The size of the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to resize the page blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to resize the page blob to the specified size.\n \n The size of the blob, in bytes.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to resize the page blob to the specified size.\n \n The size of the blob, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to resize the page blob to the specified size.\n \n The size of the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to resize the page blob to the specified size.\n \n The size of the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets the page blob's sequence number.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if is equal to .\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to set the page blob's sequence number.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if is equal to .\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to set the page blob's sequence number.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if is equal to .\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to set the page blob's sequence number.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the page blob's sequence number.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if is equal to .\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the page blob's sequence number.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if is equal to .\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the page blob's sequence number.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if is equal to .\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the page blob's sequence number.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if is equal to .\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Checks existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob exists.\n \n \n \n Checks existence of the blob.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob exists.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to check existence of the blob.\n \n An that references the pending asynchronous operation.\n true if the blob exists.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Populates a blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to populate the blob's properties and metadata.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to populate the blob's properties and metadata.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets a collection of valid page ranges and their starting and ending bytes.\n \n The starting offset of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n The length of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An enumerable collection of page ranges.\n \n \n \n Begins an asynchronous operation to return a collection of valid page ranges and their starting and ending bytes.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a collection of valid page ranges and their starting and ending bytes.\n \n The starting offset of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n The length of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return a collection of valid page ranges and their starting and ending bytes.\n \n An that references the pending asynchronous operation.\n An enumerable collection of page ranges.\n \n \n \n Returns a task that performs an asynchronous operation to return a collection of page ranges and their starting and ending bytes.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a collection of page ranges and their starting and ending bytes.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a collection of page ranges and their starting and ending bytes.\n \n The starting offset of the data range, in bytes. Must be a multiple of 512.\n The length of the data range, in bytes. Must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a collection of page ranges and their starting and ending bytes.\n \n The starting offset of the data range, in bytes. Must be a multiple of 512.\n The length of the data range, in bytes. Must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Updates the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to update the blob's metadata.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to update the blob's metadata.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Updates the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to update the blob's properties.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to update the blob's properties.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to delete the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete the blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob did already exist and was deleted; otherwise false.\n \n \n \n Begins an asynchronous request to delete the blob if it already exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to delete the blob if it already exists.\n \n An that references the pending asynchronous operation.\n true if the blob did already exist and was deleted; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Creates a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request, or null.\n An object that represents the context for the current operation.\n A blob snapshot.\n \n \n \n Begins an asynchronous operation to create a snapshot of the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request, or null.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to create a snapshot of the blob.\n \n An that references the pending asynchronous operation.\n A blob snapshot.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Acquires a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n The ID of the acquired lease.\n \n \n \n Begins an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to acquire a lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n The ID of the acquired lease.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Renews a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to renew a lease on this blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Changes the lease ID on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n The new lease ID.\n \n \n \n Begins an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to change the lease on this blob.\n \n An that references the pending asynchronous operation.\n The new lease ID.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Releases the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to release the lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Breaks the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Begins an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to break the current lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Writes pages to a page blob.\n \n A stream providing the page data.\n The offset at which to begin writing, in bytes. The offset must be a multiple of 512.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to write pages to a page blob.\n \n A stream providing the page data.\n The offset at which to begin writing, in bytes. The offset must be a multiple of 512.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to write pages to a page blob.\n \n A stream providing the page data.\n The offset at which to begin writing, in bytes. The offset must be a multiple of 512.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to write pages to a page blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to write pages to a page blob.\n \n A stream providing the page data.\n The offset at which to begin writing, in bytes. The offset must be a multiple of 512.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to write pages to a page blob.\n \n A stream providing the page data.\n The offset at which to begin writing, in bytes. The offset must be a multiple of 512.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to write pages to a page blob.\n \n A stream providing the page data.\n The offset at which to begin writing, in bytes. The offset must be a multiple of 512.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to write pages to a page blob.\n \n A stream providing the page data.\n The offset at which to begin writing, in bytes. The offset must be a multiple of 512.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Clears pages from a page blob.\n \n The offset at which to begin clearing pages, in bytes. The offset must be a multiple of 512.\n The length of the data range to be cleared, in bytes. The length must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to clear pages from a page blob.\n \n The offset at which to begin clearing pages, in bytes. The offset must be a multiple of 512.\n The length of the data range to be cleared, in bytes. The length must be a multiple of 512.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to clear pages from a page blob.\n \n The offset at which to begin clearing pages, in bytes. The offset must be a multiple of 512.\n The length of the data range to be cleared, in bytes. The length must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to clear pages from a page blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear pages from a page blob.\n \n The offset at which to begin clearing pages, in bytes. The offset must be a multiple of 512.\n The length of the data range to be cleared, in bytes. The length must be a multiple of 512.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear pages from a page blob.\n \n The offset at which to begin clearing pages, in bytes. The offset must be a multiple of 512.\n The length of the data range to be cleared, in bytes. The length must be a multiple of 512.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear pages from a page blob.\n \n The offset at which to begin clearing pages, in bytes. The offset must be a multiple of 512.\n The length of the data range to be cleared, in bytes. The length must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear pages from a page blob.\n \n The offset at which to begin clearing pages, in bytes. The offset must be a multiple of 512.\n The length of the data range to be cleared, in bytes. The length must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Requests that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The copy ID associated with the copy operation.\n \n This method fetches the blob's ETag, last modified time, and part of the copy state.\n The copy ID and copy status fields are fetched, and the rest of the copy state is cleared.\n \n \n \n \n Requests that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The copy ID associated with the copy operation.\n \n This method fetches the blob's ETag, last modified time, and part of the copy state.\n The copy ID and copy status fields are fetched, and the rest of the copy state is cleared.\n \n \n \n \n Begins an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The source blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n An that references the pending asynchronous operation.\n The copy ID associated with the copy operation.\n \n This method fetches the blob's ETag, last modified time, and part of the copy state.\n The copy ID and copy status fields are fetched, and the rest of the copy state is cleared.\n \n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Aborts an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to abort an ongoing blob copy operation.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Implements the Create method.\n \n The size in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that creates the blob.\n \n \n \n Implementation for the Resize method.\n \n The size in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that sets the metadata.\n \n \n \n Implementation for the SetSequenceNumber method.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if this operation is an increment action.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that sets the sequence number.\n \n \n \n Implementation for the CreateSnapshot method.\n \n A collection of name-value pairs defining the metadata of the snapshot, or null.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that creates the snapshot.\n If the metadata parameter is null then no metadata is associated with the request.\n \n \n \n Gets the page ranges impl.\n \n The starting offset of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n The length of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A for getting the page ranges.\n \n \n \n Implementation method for the WritePage methods.\n \n The page data.\n The start offset. \n The content MD5.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that writes the pages.\n \n \n \n Implementation method for the ClearPage methods.\n \n The start offset. Must be multiples of 512.\n Length of the data range to be cleared. Must be multiples of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that writes the pages.\n \n \n \n Default is 4 MB.\n \n \n \n \n Default is 4 MB.\n \n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob.\n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob.\n The account credentials.\n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob.\n The snapshot timestamp, if the blob is a snapshot.\n The account credentials.\n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob. The service assumes this is the URI for the blob in the primary location.\n The snapshot timestamp, if the blob is a snapshot.\n The account credentials.\n \n \n \n Initializes a new instance of the class using the specified blob name and\n the parent container reference.\n If snapshotTime is not null, the blob instance represents a Snapshot.\n \n Name of the blob.\n Snapshot time in case the blob is a snapshot.\n The reference to the parent container.\n \n \n \n Initializes a new instance of the class.\n \n The attributes.\n The service client.\n \n \n \n Stores the that contains this blob.\n \n \n \n \n Stores the blob's parent .\n \n \n \n \n Stores the blob's attributes.\n \n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n A stored access policy.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n The optional header values to set for a blob accessed with this SAS.\n A shared access signature.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n The optional header values to set for a blob returned with this SAS.\n A stored access policy.\n A shared access signature.\n \n \n \n Gets the canonical name of the blob, formatted as /<account-name>/<container-name>/<blob-name>.\n If ignoreSnapshotTime is false and this blob is a snapshot, the canonical name is augmented with a\n query of the form ?snapshot=<snapshot-time>.\n This is used by both Shared Access and Copy blob operations.\n \n Indicates if the snapshot time is ignored.\n The canonical name of the blob.\n \n \n \n Parse URI for SAS (Shared Access Signature) and snapshot information.\n \n The complete Uri.\n The credentials to use.\n \n \n \n Gets the object that represents the Blob service.\n \n A client object that specifies the Blob service endpoint.\n \n \n \n Gets or sets the number of bytes to buffer when writing to a page blob stream.\n \n The number of bytes to buffer, ranging from between 512 bytes and 4 MB inclusive.\n \n \n \n Gets or sets the minimum number of bytes to buffer when reading from a blob stream.\n \n The minimum number of bytes to buffer, being at least 16KB.\n \n \n \n Gets the blob's system properties.\n \n The blob's properties.\n \n \n \n Gets the user-defined metadata for the blob.\n \n The blob's metadata, as a collection of name-value pairs.\n \n \n \n Gets the blob's URI for the primary location.\n \n The absolute URI to the blob, at the primary location.\n \n \n \n Gets the page blob's URIs for all locations.\n \n An object of type containing the page blob's URIs for all locations.\n \n \n \n Gets the date and time that the blob snapshot was taken, if this blob is a snapshot.\n \n The blob's snapshot time, if the blob is a snapshot. If the blob is not a snapshot, the value of this property is null.\n \n \n \n Gets a value indicating whether this blob is a snapshot.\n \n true if this blob is a snapshot; otherwise, false.\n \n \n \n Gets the absolute URI to the blob, including query string information if the blob is a snapshot.\n \n The absolute URI to the blob, including snapshot query information if the blob is a snapshot.\n \n \n \n Gets the page blob's URI for all locations, including query string information if the blob is a snapshot.\n \n An object of type containing the page blob's URIs for all locations, \n including snapshot query information if the blob is a snapshot.\n \n \n \n Gets the state of the most recent or pending copy operation.\n \n A object containing the copy state, or null if no copy blob state exists for this blob.\n \n \n \n Gets the type of the blob.\n \n The type of the blob.\n \n \n \n Gets the blob's name.\n \n The blob's name.\n \n \n \n Gets a object representing the blob's container.\n \n The blob's container.\n \n \n \n Gets the object representing the\n virtual parent directory for the blob.\n \n The blob's virtual parent directory.\n \n \n \n Provides a set of methods for parsing a response containing blob data from the Blob service.\n \n \n \n \n Gets the request ID from the response.\n \n The web response.\n A unique value associated with the request.\n \n \n \n Gets the blob's properties from the response.\n \n The web response.\n The blob's properties.\n \n \n \n Extracts the lease status from a web response.\n \n The web response.\n A enumeration from the web response.\n If the appropriate header is not present, a status of is returned.\n The header contains an unrecognized value.\n \n \n \n Extracts the lease state from a web response.\n \n The web response.\n A enumeration from the web response.\n If the appropriate header is not present, a status of is returned.\n The header contains an unrecognized value.\n \n \n \n Extracts the lease duration from a web response.\n \n The web response.\n A enumeration from the web response.\n If the appropriate header is not present, a status of is returned.\n The header contains an unrecognized value.\n \n \n \n Extracts the lease ID header from a web response.\n \n The web response.\n The lease ID.\n \n \n \n Extracts the remaining lease time from a web response.\n \n The web response.\n The remaining lease time, in seconds.\n \n \n \n Gets the user-defined metadata.\n \n The response from server.\n A of the metadata.\n \n \n \n Extracts a object from the headers of a web response.\n \n The HTTP web response.\n A object, or null if the web response does not contain a copy status.\n \n \n \n Gets the snapshot timestamp from the response.\n \n The web response.\n The snapshot timestamp.\n \n \n \n Reads service properties from a stream.\n \n The stream from which to read the service properties.\n The service properties stored in the stream.\n \n \n \n Reads service stats from a stream.\n \n The stream from which to read the service stats.\n The service stats stored in the stream.\n \n \n \n Gets a from a string.\n \n The lease status string.\n A enumeration.\n If a null or empty string is supplied, a status of is returned.\n The string contains an unrecognized value.\n \n \n \n Gets a from a string.\n \n The lease state string.\n A enumeration.\n If a null or empty string is supplied, a status of is returned.\n The string contains an unrecognized value.\n \n \n \n Gets a from a string.\n \n The lease duration string.\n A enumeration.\n If a null or empty string is supplied, a status of is returned.\n The string contains an unrecognized value.\n \n \n \n Builds a object from the given strings containing formatted copy information.\n \n The copy status, as a string.\n The copy ID.\n The source URI of the copy, as a string.\n A string formatted as progressBytes/TotalBytes.\n The copy completion time, as a string, or null.\n The copy status description, if any.\n A object populated from the given strings.\n \n \n \n A factory class for constructing a web request to manage blobs in the Blob service.\n \n \n \n \n Creates a web request to get the properties of the Blob service.\n \n The absolute URI to the Blob service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to get the Blob service properties.\n \n \n \n \n Creates a web request to set the properties of the Blob service.\n \n The absolute URI to the Blob service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to set the Blob service properties.\n \n \n \n \n Creates a web request to get the stats of the Blob service.\n \n The absolute URI to the Blob service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to get the Blob service stats.\n \n \n \n \n Writes Blob service properties to a stream, formatted in XML.\n \n The service properties to format and write to the stream.\n The stream to which the formatted properties are to be written.\n \n \n \n Constructs a web request to create a new block blob or page blob, or to update the content \n of an existing block blob. \n \n The absolute URI to the blob.\n The server timeout interval.\n The properties to set for the blob.\n The type of the blob.\n For a page blob, the size of the blob. This parameter is ignored\n for block blobs.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Adds the snapshot.\n \n An object of type that contains additional parameters to add to the URI query string.\n The snapshot version, if the blob is a snapshot.\n \n \n \n Constructs a web request to return the list of valid page ranges for a page blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The snapshot timestamp, if the blob is a snapshot.\n The starting offset of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n The length of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n The access condition to apply to the request.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Adds the Range Header for Blob Service Operations.\n \n Request\n Starting byte of the range\n Number of bytes in the range\n \n \n \n Constructs a web request to return the blob's system properties.\n \n The absolute URI to the blob.\n The server timeout interval.\n The snapshot timestamp, if the blob is a snapshot.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Constructs a web request to set system properties for a blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The blob's properties.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to resize a page blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The new blob size, if the blob is a page blob. Set this parameter to null to keep the existing blob size.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to set a page blob's sequence number.\n \n The absolute URI to the blob.\n The server timeout interval.\n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if this operation is an increment action.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to return the user-defined metadata for the blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The snapshot timestamp, if the blob is a snapshot.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Constructs a web request to set user-defined metadata for the blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Adds user-defined metadata to the request as one or more name-value pairs.\n \n The web request.\n The user-defined metadata.\n \n \n \n Adds user-defined metadata to the request as a single name-value pair.\n \n The web request.\n The metadata name.\n The metadata value.\n \n \n \n Constructs a web request to delete a blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The snapshot timestamp, if the blob is a snapshot.\n A set of options indicating whether to delete only blobs, only snapshots, or both.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to create a snapshot of a blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to use to acquire, renew, change, release or break the lease for the blob.\n \n The absolute URI to the blob.\n The server timeout interval, in seconds.\n The lease action to perform.\n A lease ID to propose for the result of an acquire or change operation,\n or null if no ID is proposed for an acquire operation. This should be null for renew, release, and break operations.\n The lease duration, in seconds, for acquire operations.\n If this is -1 then an infinite duration is specified. This should be null for renew, change, release, and break operations.\n The amount of time to wait, in seconds, after a break operation before the lease is broken.\n If this is null then the default time is used. This should be null for acquire, renew, change, and release operations.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Adds a proposed lease id to a request.\n \n The request.\n The proposed lease id.\n \n \n \n Adds a lease duration to a request.\n \n The request.\n The lease duration.\n \n \n \n Adds a lease break period to a request.\n \n The request.\n The lease break period.\n \n \n \n Adds a lease action to a request.\n \n The request.\n The lease action.\n \n \n \n Constructs a web request to write a block to a block blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The block ID for this block.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to create or update a blob by committing a block list.\n \n The absolute URI to the blob.\n The server timeout interval.\n The properties to set for the blob.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Constructs a web request to return the list of blocks for a block blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The snapshot timestamp, if the blob is a snapshot.\n The types of blocks to include in the list: committed, uncommitted, or both.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to write or clear a range of pages in a page blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The page range, defined by an object of type .\n A value of type , indicating the operation to perform on the page blob.\n The to apply to the request.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Generates a web request to copy a blob.\n \n The absolute URI to the destination blob.\n The server timeout interval.\n The absolute URI to the source blob, including any necessary authentication parameters.\n The access condition to apply to the source blob.\n The access condition to apply to the destination blob.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to abort a copy operation.\n \n The absolute URI to the blob.\n The server timeout interval.\n The ID string of the copy operation to be aborted.\n The access condition to apply to the request. Only lease conditions are supported for this operation.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Constructs a web request to get the blob's content, properties, and metadata.\n \n The absolute URI to the blob.\n The server timeout interval.\n The snapshot version, if the blob is a snapshot.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Constructs a web request to return a specified range of the blob's content, together with its properties and metadata.\n \n The absolute URI to the blob.\n The server timeout interval, in seconds.\n The snapshot version, if the blob is a snapshot.\n The byte offset at which to begin returning content.\n The number of bytes to return, or null to return all bytes through the end of the blob.\n If set to true, request an MD5 header for the specified range.\n The access condition to apply to the request.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Provides a set of methods for parsing container responses from the Blob service.\n \n \n \n \n Gets the request ID from the response.\n \n The web response.\n A unique value associated with the request.\n \n \n \n Gets the container's properties from the response.\n \n The web response.\n The container's attributes.\n \n \n \n Gets the user-defined metadata.\n \n The response from server.\n A of the metadata.\n \n \n \n Gets the ACL for the container from the response.\n \n The web response.\n A value indicating the public access level for the container.\n \n \n \n Reads the share access policies from a stream in XML.\n \n The stream of XML policies.\n The permissions object to which the policies are to be written.\n \n \n \n Converts the ACL string to a object.\n \n The string to convert.\n The resulting object.\n \n \n \n A factory class for constructing a web request to manage containers in the Blob service.\n \n \n \n \n Constructs a web request to create a new container.\n \n The absolute URI to the container.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to create a new container.\n \n The absolute URI to the container.\n The server timeout interval.\n An object for tracking the current operation.\n An object that specifies whether data in the container may be accessed publicly and the level of access. \n A web request to use to perform the operation.\n \n \n \n Constructs a web request to delete the container and all of the blobs within it.\n \n The absolute URI to the container.\n The server timeout interval.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to return the user-defined metadata for this container.\n \n The absolute URI to the container.\n The server timeout interval.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to return the properties and user-defined metadata for this container.\n \n The absolute URI to the container.\n The server timeout interval.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to set user-defined metadata for the container.\n \n The absolute URI to the container.\n The server timeout interval.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to use to acquire, renew, change, release or break the lease for the container.\n \n The absolute URI to the container.\n The server timeout interval, in seconds.\n The lease action to perform.\n A lease ID to propose for the result of an acquire or change operation,\n or null if no ID is proposed for an acquire operation. This should be null for renew, release, and break operations.\n The lease duration, in seconds, for acquire operations.\n If this is -1 then an infinite duration is specified. This should be null for renew, change, release, and break operations.\n The amount of time to wait, in seconds, after a break operation before the lease is broken.\n If this is null then the default time is used. This should be null for acquire, renew, change, and release operations.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Adds user-defined metadata to the request as one or more name-value pairs.\n \n The web request.\n The user-defined metadata.\n \n \n \n Adds user-defined metadata to the request as a single name-value pair.\n \n The web request.\n The metadata name.\n The metadata value.\n \n \n \n Constructs a web request to return a listing of all containers in this storage account.\n \n The absolute URI for the account.\n The server timeout interval.\n A set of parameters for the listing operation.\n Additional details to return with the listing.\n An object for tracking the current operation.\n A web request for the specified operation.\n \n \n \n Constructs a web request to return the ACL for a container.\n \n The absolute URI to the container.\n The server timeout interval.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to set the ACL for a container.\n \n The absolute URI to the container.\n The server timeout interval.\n The type of public access to allow for the container.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to return a listing of all blobs in the container.\n \n The absolute URI to the container.\n The server timeout interval.\n A set of parameters for the listing operation.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Gets the container Uri query builder.\n \n A for the container.\n \n \n \n This class represents a queue in the Windows Azure Queue service.\n \n \n This class represents a queue in the Windows Azure Queue service.\n \n \n \n \n Creates the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous operation to create a queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to create a queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Creates the queue if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n true if the queue did not already exist and was created; otherwise false.\n \n \n \n Begins an asynchronous request to create the queue if it does not already exist.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to create the queue if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to create the queue if it does not already exist.\n \n An that references the pending asynchronous operation.\n true if the queue did not already exist and was created; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous request to create the queue if it does not already exist.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to create the queue if it does not already exist.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to create the queue if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to create the queue if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the queue if it already exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n true if the queue did not already exist and was created; otherwise false.\n \n \n \n Begins an asynchronous request to delete the queue if it already exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to delete the queue if it already exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to delete the queue if it already exists.\n \n An that references the pending asynchronous operation.\n true if the queue did not already exist and was created; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous request to delete the queue if it already exists.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the queue if it already exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the queue if it already exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the queue if it already exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous operation to delete a queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete a queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete a queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets permissions for the queue.\n \n The permissions to apply to the queue.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous request to set permissions for the queue.\n \n The permissions to apply to the queue.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to set permissions for the queue.\n \n The permissions to apply to the queue.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to set permissions for the queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous request to set permissions for the queue.\n \n The permissions to apply to the queue.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to set permissions for the queue.\n \n The permissions to apply to the queue.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to set permissions for the queue.\n \n The permissions to apply to the queue.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to set permissions for the queue.\n \n The permissions to apply to the queue.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the permissions settings for the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The queue's permissions.\n \n \n \n Begins an asynchronous request to get the permissions settings for the queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to get the permissions settings for the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to get the permissions settings for the queue.\n \n An that references the pending asynchronous operation.\n The queue's permissions.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Checks existence of the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n true if the queue exists.\n \n \n \n Checks existence of the queue.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n true if the queue exists.\n \n \n \n Begins an asynchronous request to check existence of the queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check existence of the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check existence of the queue.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to check existence of the queue.\n \n An that references the pending asynchronous operation.\n true if the queue exists.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets the queue's user-defined metadata.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous operation to set user-defined metadata on the queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to set user-defined metadata on the queue.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous request operation to set user-defined metadata on the queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to set user-defined metadata on the queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set user-defined metadata on the queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set user-defined metadata on the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set user-defined metadata on the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Fetches the queue's attributes.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous operation to fetch the queue's attributes.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to fetch the queue's attributes.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to fetch a queue's attributes.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to fetch the queue's attributes.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to fetch the queue's attributes.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to fetch the queue's attributes.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to fetch the queue's attributes.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Adds a message to the queue.\n \n The message to add.\n The maximum time to allow the message to be in the queue, or null.\n The length of time from now during which the message will be invisible.\n If null then the message will be visible immediately.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to add a message to the queue.\n \n The message to add.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to add a message to the queue.\n \n The message to add.\n The maximum time to allow the message to be in the queue, or null.\n The length of time from now during which the message will be invisible.\n If null then the message will be visible immediately. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to add a message to the queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to add a message to the queue.\n \n The message to add.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to add a message to the queue.\n \n The message to add.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to add a message to the queue.\n \n The message to add.\n The maximum time to allow the message to be in the queue, or null.\n The length of time from now during which the message will be invisible.\n If null then the message will be visible immediately.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to add a message to the queue.\n \n The message to add.\n The maximum time to allow the message to be in the queue, or null.\n The length of time from now during which the message will be invisible.\n If null then the message will be visible immediately.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Updates the visibility timeout and optionally the content of a message.\n \n The message to update.\n The visibility timeout interval.\n Flags of values that specifies which parts of the message are to be updated.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to update the visibility timeout and optionally the content of a message.\n \n The message to update.\n The visibility timeout interval.\n An EnumSet of values that specifies which parts of the message are to be updated.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to update the visibility timeout and optionally the content of a message.\n \n The message to update.\n The visibility timeout interval.\n An EnumSet of values that specifies which parts of the message are to be updated.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to add a message to the queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the visibility timeout and optionally the content of a message.\n \n The message to update.\n The visibility timeout interval.\n An EnumSet of values that specifies which parts of the message are to be updated.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the visibility timeout and optionally the content of a message.\n \n The message to update.\n The visibility timeout interval.\n An EnumSet of values that specifies which parts of the message are to be updated.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the visibility timeout and optionally the content of a message.\n \n The message to update.\n The visibility timeout interval.\n An EnumSet of values that specifies which parts of the message are to be updated.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the visibility timeout and optionally the content of a message.\n \n The message to update.\n The visibility timeout interval.\n An EnumSet of values that specifies which parts of the message are to be updated.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes a message.\n \n A message.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Deletes the specified message from the queue.\n \n The message ID.\n The pop receipt value.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous operation to delete a message.\n \n A message.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete a message.\n \n A message.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete a message.\n \n The message ID.\n The pop receipt value.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete a message.\n \n The message ID.\n The pop receipt value.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete a message.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n A message.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n A message.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n A message.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n A message.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n The message ID.\n The pop receipt value.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n The message ID.\n The pop receipt value.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n The message ID.\n The pop receipt value.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n The message ID.\n The pop receipt value.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the specified number of messages from the queue using the specified request options and \n operation context. This operation marks the retrieved messages as invisible in the queue for the default \n visibility timeout period. \n \n The number of messages to retrieve.\n The visibility timeout interval.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n An enumerable collection of messages.\n \n \n \n Begins an asynchronous operation to get messages from the queue.\n \n The number of messages to retrieve.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get the specified number of messages from the queue using the \n specified request options and operation context. This operation marks the retrieved messages as invisible in the \n queue for the default visibility timeout period.\n \n The number of messages to retrieve.\n The visibility timeout interval.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get messages from the queue.\n \n An that references the pending asynchronous operation.\n An enumerable collection of messages.\n \n \n \n Returns a task that performs an asynchronous operation to get messages from the queue.\n \n The number of messages to retrieve.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get messages from the queue.\n \n The number of messages to retrieve.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the specified number of messages from the queue using the \n specified request options and operation context. This operation marks the retrieved messages as invisible in the \n queue for the default visibility timeout period.\n \n The number of messages to retrieve.\n The visibility timeout interval.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the specified number of messages from the queue using the \n specified request options and operation context. This operation marks the retrieved messages as invisible in the \n queue for the default visibility timeout period.\n \n The number of messages to retrieve.\n The visibility timeout interval.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets a message from the queue using the default request options. This operation marks the retrieved message as invisible in the queue for the default visibility timeout period. \n \n The visibility timeout interval.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n A message.\n \n \n \n Begins an asynchronous operation to get a single message from the queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get a single message from the queue, and specifies how long the message should be \n reserved before it becomes visible, and therefore available for deletion.\n \n The visibility timeout interval.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get a single message from the queue.\n \n An that references the pending asynchronous operation.\n A message.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue, and specifies how long the message should be \n reserved before it becomes visible, and therefore available for deletion.\n \n The visibility timeout interval.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue, and specifies how long the message should be \n reserved before it becomes visible, and therefore available for deletion.\n \n The visibility timeout interval.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Peeks a message from the queue, using the specified request options and operation context. A peek request retrieves a message from the queue without changing its visibility. \n \n The number of messages to peek.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n An enumerable collection of messages.\n \n \n \n Begins an asynchronous operation to peek messages from the queue.\n \n The number of messages to peek.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to peek messages from the queue.\n \n The number of messages to peek.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to peek messages from the queue.\n \n An that references the pending asynchronous operation.\n An enumerable collection of messages.\n \n \n \n Returns a task that performs an asynchronous operation to peek messages from the queue.\n \n The number of messages to peek.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to peek messages from the queue.\n \n The number of messages to peek.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to peek messages from the queue.\n \n The number of messages to peek.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to peek messages from the queue.\n \n The number of messages to peek.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Peeks a single message from the queue. A peek request retrieves a message from the queue without changing its visibility.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n A message.\n \n \n \n Begins an asynchronous operation to get a single message from the queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to peek a single message from the queue.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to peek a single message from the queue.\n \n An that references the pending asynchronous operation.\n A message.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Clears all messages from the queue.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous operation to clear all messages from the queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to clear all messages from the queue.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to clear all messages from the queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear all messages from the queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear all messages from the queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear all messages from the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear all messages from the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Ends an asynchronous operation to clear all messages from the queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Implementation for the ClearMessages method.\n \n A object that specifies additional options for the request.\n A that gets the permissions.\n \n \n \n Implementation for the Create method.\n \n A object that specifies additional options for the request.\n A that creates the queue.\n \n \n \n Implementation for the Delete method.\n \n A object that specifies additional options for the request.\n A that deletes the queue.\n \n \n \n Implementation for the FetchAttributes method.\n \n A object that specifies additional options for the request.\n A that fetches the attributes.\n \n \n \n Implementation for the Exists method.\n \n A object that specifies additional options for the request.\n If true, the command will be executed against the primary location.\n A that checks existence.\n \n \n \n Implementation for the SetMetadata method.\n \n A object that specifies additional options for the request.\n A that sets the metadata.\n \n \n \n Implementation for the SetPermissions method.\n \n The permissions to set.\n A object that specifies additional options for the request.\n A that sets the permissions.\n \n \n \n Implementation for the GetPermissions method.\n \n A object that specifies additional options for the request.\n A that gets the permissions.\n \n \n \n Implementation for the AddMessageImpl method.\n \n A queue message.\n A value indicating the message time-to-live.\n The visibility delay for the message.\n A object that specifies additional options for the request.\n A that sets the permissions.\n \n \n \n Implementation for the UpdateMessage method.\n \n A queue message.\n The visibility timeout for the message.\n Indicates whether to update the visibility delay, message contents, or both.\n A object that specifies additional options for the request.\n A that sets the permissions.\n \n \n \n Implementation for the DeleteMessage method.\n \n The message ID.\n The pop receipt value.\n A object that specifies additional options for the request.\n A that deletes the queue.\n \n \n \n Implementation for the GetPermissions method.\n \n The number of messages to retrieve.\n The visibility timeout interval.\n A object that specifies additional options for the request.\n A that gets the permissions.\n \n \n \n Implementation for the PeekMessages method.\n \n The number of messages to retrieve.\n A object that specifies additional options for the request.\n A that gets the permissions.\n \n \n \n Gets the ApproximateMessageCount and metadata from response.\n \n The web response.\n \n \n \n Update the message pop receipt and next visible time.\n \n The Cloud Queue Message.\n The web response.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the queue.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the queue.\n The account credentials.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the queue.\n The account credentials.\n \n \n \n Initializes a new instance of the class.\n \n The queue name.\n A client object that specifies the endpoint for the queue service.\n \n \n \n Uri for the messages.\n \n \n \n \n Gets the Uri for general message operations.\n \n \n \n \n Gets the individual message address.\n \n The message id.\n The URI of the message.\n \n \n \n Parse URI for SAS (Shared Access Signature) information.\n \n The complete Uri.\n The credentials to use.\n \n \n \n Returns the canonical name for shared access.\n \n The canonical name.\n \n \n \n Selects the get message response.\n \n The protocol message.\n The parsed message.\n \n \n \n Selects the peek message response.\n \n The protocol message.\n The parsed message.\n \n \n \n Returns a shared access signature for the queue.\n \n The access policy for the shared access signature.\n A queue-level access policy.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Gets the service client for the queue.\n \n A client object that specifies the endpoint for the queue service.\n \n \n \n Gets the queue's URI for the primary location.\n \n The absolute URI to the queue, at the primary location.\n \n \n \n Gets the queue's URIs for all locations.\n \n An object of type containing the queue's URIs for all locations.\n \n \n \n Gets the name of the queue.\n \n The queue's name.\n \n \n \n Gets the approximate message count for the queue.\n \n The approximate message count.\n \n \n \n Gets or sets a value indicating whether to apply base64 encoding when adding or retrieving messages.\n \n True to encode messages; otherwise, false. The default value is true.\n \n \n \n Gets the queue's metadata.\n \n The queue's metadata.\n \n \n \n Provides a client-side logical representation of the Windows Azure Queue service. This client is used to configure and execute requests against the Queue service.\n \n The service client encapsulates the base URI for the Queue service. If the service client will be used for authenticated access, it also encapsulates the credentials for accessing the storage account.\n \n Provides a client-side logical representation of the Windows Azure Queue service. This client is used to configure and execute requests against the Queue service.\n \n The service client encapsulates the base URI for the Queue service. If the service client will be used for authenticated access, it also encapsulates the credentials for accessing the storage account.\n \n \n \n Returns an enumerable collection of the queues in the storage account whose names begin with the specified prefix and that are retrieved lazily.\n \n The queue name prefix.\n An enumeration value that indicates which details to include in the listing.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n An enumerable collection of objects that implement and are retrieved lazily.\n \n \n \n Returns a result segment containing a collection of queues in the storage account.\n \n A continuation token returned by a previous listing operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of queues in the storage account.\n \n The queue name prefix.\n A continuation token returned by a previous listing operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of queues in the storage account.\n \n The queue name prefix.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n An object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of queues in the storage account.\n \n The queue name prefix.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n An object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n A result segment.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of queue items.\n \n A returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of queue items.\n \n The queue name prefix.\n A returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of queue items.\n \n The queue name prefix.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n An object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return a result segment containing a collection of queue items.\n \n An that references the pending asynchronous operation.\n A queue result segment.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of queue items.\n \n A returned by a previous listing operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of queue items.\n \n A returned by a previous listing operation. \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of queue items.\n \n The queue name prefix. \n A returned by a previous listing operation. \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of queue items.\n \n The queue name prefix. \n A returned by a previous listing operation. \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of queue items.\n \n The queue name prefix.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of queue items.\n \n The queue name prefix.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Core implementation of the ListQueues method.\n \n The queue name prefix.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A enumeration describing which items to include in the listing.\n An object that specifies additional options for the request.\n The continuation token.\n A that lists the queues.\n \n \n \n Begins an asynchronous operation to get the properties of the queue service.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get the properties of the queue service.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get the properties of the queue service.\n \n The result returned from a prior call to .\n A object containing the queue service properties.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the queue service.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the queue service.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the queue service.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the queue service.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the properties of the queue service.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n The queue service properties.\n \n \n \n Begins an asynchronous operation to set the properties of the queue service.\n \n The queue service properties.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to set the properties of the queue service.\n \n The queue service properties.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to set the properties of the queue service.\n \n The result returned from a prior call to .\n \n \n \n Returns a task that performs an asynchronous operation to set the properties of the queue service.\n \n The queue service properties.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the properties of the queue service.\n \n The queue service properties.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the properties of the queue service.\n \n The queue service properties.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the properties of the queue service.\n \n The queue service properties.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets the properties of the queue service.\n \n The queue service properties.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous operation to get the stats of the queue service.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get the stats of the queue service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get the stats of the queue service.\n \n An that references the pending asynchronous operation.\n The queue service stats.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the queue service.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the queue service.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the queue service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the queue service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the stats of the queue service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The queue service stats.\n \n \n \n The default server and client timeout interval.\n \n \n \n \n Max execution time across all potential retries.\n \n \n \n \n Initializes a new instance of the class using the specified queue service endpoint\n and anonymous credentials.\n \n The queue service endpoint to use to create the client.\n \n \n \n Initializes a new instance of the class using the specified queue service endpoint\n and account credentials.\n \n The queue service endpoint to use to create the client.\n The account credentials.\n \n \n \n Initializes a new instance of the class using the specified Queue service endpoint\n and account credentials.\n \n The Queue service endpoint to use to create the client.\n The account credentials.\n \n \n \n Returns a reference to a object with the specified name.\n \n The name of the queue, or an absolute URI to the queue.\n A reference to a queue.\n \n \n \n Gets or sets the authentication scheme to use to sign HTTP requests.\n \n \n \n \n Gets the authentication handler used to sign HTTP requests.\n \n The authentication handler.\n \n \n \n Gets or sets a buffer manager that implements the interface, \n specifying a buffer pool for use with operations against the Queue service client.\n \n \n \n \n Gets the account credentials used to create the queue service client.\n \n The account credentials.\n \n \n \n Gets the base URI for the Queue service client, at the primary location.\n \n The base URI used to construct the Queue service client, at the primary location.\n \n \n \n Gets the Queue service endpoints for all locations.\n \n An object of type containing Queue service URIs for all locations.\n \n \n \n Gets or sets the default retry policy for requests made via the Queue service client.\n \n The retry policy.\n \n \n \n Gets or sets the default location mode for requests made via the Queue service client.\n \n The location mode.\n \n \n \n Gets or sets the default server and client timeout for requests made via the Queue service client.\n \n The server and client timeout interval.\n \n \n \n Gets or sets the maximum execution time across all potential retries.\n \n The maximum execution time across all potential retries.\n \n \n \n Gets a value indicating whether the service client is used with Path style or Host style.\n \n Is true if use path style URIs; otherwise, false.\n \n \n \n Represents a message in the Windows Azure Queue service.\n \n \n Represents a message in the Windows Azure Queue service.\n \n \n \n \n The maximum message size in bytes.\n \n \n \n \n The maximum number of messages that can be peeked at a time.\n \n \n \n \n Initializes a new instance of the class with the given byte array.\n \n The content of the message as a byte array.\n \n \n \n Sets the content of this message.\n \n The new message content.\n \n \n \n The maximum amount of time a message is kept in the queue.\n \n \n \n \n Custom UTF8Encoder to throw exception in case of invalid bytes.\n \n \n \n \n Initializes a new instance of the class with the given byte array.\n \n \n \n \n Initializes a new instance of the class with the given string.\n \n The content of the message as a string of text.\n \n \n \n Initializes a new instance of the class with the given message ID and pop receipt.\n \n The message ID.\n The pop receipt token.\n \n \n \n Initializes a new instance of the class with the given Base64 encoded string.\n This method is only used internally.\n \n The text string.\n Whether the string is Base64 encoded.\n \n \n \n Gets the content of the message for transfer (internal use only).\n \n Indicates if the message should be encoded.\n The message content as a string.\n \n \n \n Sets the content of this message.\n \n The new message content.\n \n \n \n Gets the maximum message size in bytes.\n \n The maximum message size in bytes.\n \n \n \n Gets the maximum amount of time a message is kept in the queue.\n \n The maximum amount of time a message is kept in the queue.\n \n \n \n Gets the maximum number of messages that can be peeked at a time.\n \n The maximum number of messages that can be peeked at a time.\n \n \n \n Gets the content of the message as a byte array.\n \n The content of the message as a byte array.\n \n \n \n Gets the message ID.\n \n The message ID.\n \n \n \n Gets the message's pop receipt.\n \n The pop receipt value.\n \n \n \n Gets the time that the message was added to the queue.\n \n The time that the message was added to the queue.\n \n \n \n Gets the time that the message expires.\n \n The time that the message expires.\n \n \n \n Gets the time that the message will next be visible.\n \n The time that the message will next be visible.\n \n \n \n Gets the content of the message, as a string.\n \n The message content.\n \n \n \n Gets the number of times this message has been dequeued.\n \n The number of times this message has been dequeued.\n \n \n \n Gets message type that indicates if the RawString is the original message string or Base64 encoding of the original binary data.\n \n \n \n \n Gets or sets the original message string or Base64 encoding of the original binary data.\n \n The original message string.\n \n \n \n Provides a set of methods for parsing a response containing queue data from the Queue service.\n \n \n \n \n Gets the request ID from the response.\n \n The web response.\n A unique value associated with the request.\n \n \n \n Gets the approximate message count for the queue.\n \n The web response.\n The approximate count for the queue.\n \n \n \n Gets the user-defined metadata.\n \n The response from server.\n An object of type containing the metadata.\n \n \n \n Extracts the pop receipt from a web response header.\n \n The web response.\n The pop receipt stored in the header of the response.\n \n \n \n Extracts the next visibility time from a web response header.\n \n The web response.\n The time of next visibility stored in the header of the response.\n \n \n \n Reads service properties from a stream.\n \n The stream from which to read the service properties.\n The service properties stored in the stream.\n \n \n \n Reads service stats from a stream.\n \n The stream from which to read the service stats.\n The service stats stored in the stream.\n \n \n \n Reads the share access policies from a stream in XML.\n \n The stream of XML policies.\n The permissions object to which the policies are to be written.\n \n \n \n A factory class for constructing a web request to manage queues in the Queue service.\n \n \n \n \n Creates a web request to get the properties of the Queue service.\n \n The absolute URI to the Queue service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to get the Queue service properties.\n \n \n \n \n Creates a web request to set the properties of the Queue service.\n \n The absolute URI to the Queue service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to set the Queue service properties.\n \n \n \n \n Creates a web request to get the stats of the Queue service.\n \n The absolute URI to the Queue service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to get the Queue service stats.\n \n \n \n \n Writes Queue service properties to a stream, formatted in XML.\n \n The service properties to format and write to the stream.\n The stream to which the formatted properties are to be written.\n \n \n \n Constructs a web request to create a new queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to delete the queue and all of the messages within it.\n \n The absolute URI to the queue.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to clear all messages in the queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to return the user-defined metadata for this queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to set user-defined metadata for the queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Adds user-defined metadata to the request as one or more name-value pairs.\n \n The web request.\n The user-defined metadata.\n \n \n \n Adds user-defined metadata to the request as a single name-value pair.\n \n The web request.\n The metadata name.\n The metadata value.\n \n \n \n Constructs a web request to return a listing of all queues in this storage account.\n \n The absolute URI for the account.\n The server timeout interval.\n A set of parameters for the listing operation.\n Additional details to return with the listing.\n An object for tracking the current operation.\n A web request for the specified operation.\n \n \n \n Constructs a web request to return the ACL for a queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to set the ACL for a queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to add a message for a queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n The message time-to-live, in seconds.\n The visibility timeout, in seconds.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Constructs a web request to update a message.\n \n The absolute URI to the message to update.\n The server timeout interval, in seconds.\n The pop receipt of the message.\n The length of time from now during which the message will be invisible, in seconds.\n An object for tracking the current operation.\n A web request for the update operation.\n \n \n \n Constructs a web request to update a message.\n \n The absolute URI to the message to update.\n The server timeout interval, in seconds.\n The pop receipt of the message.\n An object for tracking the current operation.\n A web request for the update operation.\n \n \n \n Constructs a web request to get messages for a queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n The number of messages.\n The visibility timeout.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Constructs a web request to peeks messages for a queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n The number of messages.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Represents a Windows Azure table.\n \n \n Represents a Windows Azure table.\n \n \n \n \n Executes the operation on a table, using the specified and . \n \n A object that represents the operation to perform.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A containing the result of executing the operation on the table.\n \n \n \n Begins an asynchronous table operation.\n \n A object that represents the operation to perform.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous table operation using the specified and .\n \n A object that represents the operation to perform.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous table operation.\n \n An that references the pending asynchronous operation.\n A containing the result executing the operation on the table.\n \n \n \n Returns a task that performs an asynchronous table operation using the specified and .\n \n A object that represents the operation to perform.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous table operation using the specified and .\n \n A object that represents the operation to perform.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous table operation using the specified and .\n \n A object that represents the operation to perform.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous table operation using the specified and .\n \n A object that represents the operation to perform.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Executes a batch operation on a table as an atomic operation, using the specified and .\n \n The object representing the operations to execute on the table.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n An enumerable collection of objects that contains the results, in order, of each operation in the on the table.\n \n \n \n Begins an asynchronous operation to execute a batch of operations on a table.\n \n The object representing the operations to execute on the table.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to execute a batch of operations on a table, using the specified and .\n \n The object representing the operations to execute on the table.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous batch of operations on a table.\n \n An that references the pending asynchronous operation.\n A enumerable collection of type that contains the results, in order, of each operation in the on the table.\n \n \n \n Returns a task that performs an asynchronous operation to execute a batch of operations on a table, using the specified and .\n \n The object representing the operations to execute on the table.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a batch of operations on a table, using the specified and .\n \n The object representing the operations to execute on the table.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a batch of operations on a table, using the specified and .\n \n The object representing the operations to execute on the table.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a batch of operations on a table, using the specified and .\n \n The object representing the operations to execute on the table.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Executes a query on a table, using the specified and .\n \n A representing the query to execute.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n An enumerable collection of objects, representing table entities returned by the query.\n \n \n \n Executes a query in segmented mode with the specified continuation token, , and .\n \n A representing the query to execute.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A object containing the results of executing the query.\n \n \n \n Begins an asynchronous segmented query operation using the specified continuation token.\n \n A representing the query to execute.\n A object representing a continuation token from the server when the operation returns a partial result.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to query a table in segmented mode using the specified continuation token, , and .\n \n A representing the query to execute.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous segmented query operation. \n \n An that references the pending asynchronous operation.\n A object containing the results of executing the query.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token, , and .\n \n A representing the query to execute.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token, , and .\n \n A representing the query to execute.\n A object representing a continuation token from the server when the operation returns a partial result.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token, , and .\n \n A representing the query to execute.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token, , and .\n \n A representing the query to execute.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Executes a query on a table, using the specified and , applying the to the result.\n \n A representing the query to execute.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n An enumerable collection, containing the projection into type TResult, of the results of executing the query.\n \n \n \n Executes a query in segmented mode with the specified continuation token, , and .\n \n A representing the query to execute.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A object containing the results of executing the query.\n \n \n \n Begins an asynchronous segmented query operation using the specified continuation token.\n \n A representing the query to execute.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n A factory method that creates a query that can be modified using LINQ. The query may be subsequently executed using one of the execution methods available for , \n such as , , or .\n \n The entity type of the query.\n A object, specialized for type TElement, that may subsequently be executed.\n \n The namespace includes extension methods for the object, \n including , , and . To use these methods, include a using\n statement that references the namespace.\n \n \n \n \n Executes a query on a table, using the specified and .\n \n The entity type of the query.\n A TableQuery instance specifying the table to query and the query parameters to use, specialized for a type T implementing TableEntity.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n An enumerable collection, specialized for type TElement, of the results of executing the query.\n \n \n \n Queries a table in segmented mode using the specified continuation token, , and .\n \n The entity type of the query.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A , specialized for type TElement, containing the results of executing the query.\n \n \n \n Begins an asynchronous operation to query a table in segmented mode, using the specified continuation token.\n \n The entity type of the query.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n A object representing a continuation token from the server when the operation returns a partial result.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to query a table in segmented mode using the specified continuation token and .\n \n The entity type of the query.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous segmented table query operation.\n \n The type of the results to be returned. Can be the entity type specified in the Begin or the result type of the resolver\n An that references the pending asynchronous operation.\n A containing the results of executing the query.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token and .\n \n The entity type of the query.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token and .\n \n The entity type of the query.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n A object representing a continuation token from the server when the operation returns a partial result.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token and .\n \n The entity type of the query.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token and .\n \n The entity type of the query.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Executes a query, using the specified and , applying the to the result.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n An enumerable collection, containing the projection into type TResult, of the results of executing the query.\n \n \n \n Executes a query in segmented mode with the specified continuation token, using the specified and , applying the to the results.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A containing the projection into type TResult of the results of executing the query. \n \n \n \n Begins an asynchronous operation to query a table in segmented mode, using the specified and continuation token.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous segmented table query operation.\n \n The entity type of the query.\n The type into which the will project the query results.\n An that references the pending asynchronous operation.\n A containing the projection into type TResult of the results of executing the query. \n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Creates a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n \n \n \n Begins an asynchronous operation to create a table.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to create a table.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a table.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a table.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Creates the table if it does not already exist.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n true if table was created; otherwise, false.\n \n \n \n Begins an asynchronous operation to create a table if it does not already exist.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a table if it does not already exist.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to determine whether a table exists.\n \n An that references the pending asynchronous operation.\n true if table exists; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous operation to create a table if it does not already exist.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a table if it does not already exist.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a table if it does not already exist.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a table if it does not already exist.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n \n \n \n Begins an asynchronous operation to delete a table.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete a table.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a table.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a table.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the table if it exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n true if the table was deleted; otherwise, false.\n \n \n \n Begins an asynchronous operation to delete the table if it exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete the table if it exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete the table if it exists.\n \n An that references the pending asynchronous operation.\n true if the table was deleted; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous operation to delete the table if it exists.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the table if it exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the table if it exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the table if it exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Checks whether the table exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n true if table exists; otherwise, false.\n \n \n \n Checks whether the table exists.\n \n If true, the command will be executed against the primary location.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n true if table exists; otherwise, false.\n \n \n \n Begins an asynchronous operation to determine whether a table exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to determine whether a table exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to determine whether a table exists.\n \n If true, the command will be executed against the primary location.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to determine whether a table exists.\n \n An that references the pending asynchronous operation.\n true if table exists; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous operation to determine whether a table exists.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to determine whether a table exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to determine whether a table exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to determine whether a table exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the permissions settings for the table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The table's permissions.\n \n \n \n Begins an asynchronous request to get the permissions settings for the table.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to get the permissions settings for the table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to get the permissions settings for the table.\n \n An that references the pending asynchronous operation.\n The table's permissions.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the table.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the table.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets the permissions settings for the table.\n \n A object that represents the permissions to set.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n \n \n \n Begins an asynchronous request to set permissions for the table.\n \n The permissions to apply to the table.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to set permissions for the table.\n \n The permissions to apply to the table.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to get the permissions settings for the table.\n \n An that references the pending asynchronous operation. \n \n \n \n Returns a task that performs an asynchronous request to set permissions for the table.\n \n The permissions to apply to the table.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to set permissions for the table.\n \n The permissions to apply to the table.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to set permissions for the table.\n \n The permissions to apply to the table.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to set permissions for the table.\n \n The permissions to apply to the table.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the table.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the table.\n The account credentials.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the table.\n The account credentials.\n \n \n \n Initializes a new instance of the class.\n \n The table name.\n The client.\n \n \n \n Returns a shared access signature for the table.\n \n The access policy for the shared access signature.\n An access policy identifier.\n The start partition key, or null.\n The start row key, or null.\n The end partition key, or null.\n The end row key, or null.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n Thrown if the current credentials don't support creating a shared access signature.\n \n \n \n Returns the name of the table.\n \n The name of the table.\n \n \n \n Parse URI for SAS (Shared Access Signature) information.\n \n The complete Uri.\n The credentials to use.\n \n \n \n Gets the canonical name of the table, formatted as /<account-name>/<table-name>.\n \n The canonical name of the table.\n \n \n \n Gets the object that represents the Table service.\n \n A client object that specifies the Table service endpoint.\n \n \n \n Gets the table name.\n \n The table name.\n \n \n \n Gets the table's URI for the primary location.\n \n The absolute URI to the table, at the primary location.\n \n \n \n Gets the table's URIs for all locations.\n \n An object of type containing the table's URIs for all locations.\n \n \n \n Provides a client-side logical representation of the Windows Azure Table Service. This client is used to configure and execute requests against the Table Service.\n \n The service client encapsulates the base URI for the Table service. If the service client will be used for authenticated access, it also encapsulates the credentials for accessing the storage account. \n \n Provides a client-side logical representation of the Windows Azure Table service. This client is used to configure and execute requests against the Table service.\n \n The CloudTableClient object encapsulates the base URI for the Table service. If the service client will be used for authenticated access, \n it also encapsulates the credentials for accessing the storage account. \n \n \n \n Returns an enumerable collection of tables, which are retrieved lazily, that begin with the specified prefix.\n \n The table name prefix.\n A object that specifies additional options for the request.\n An object that provides information on how the operation executed.\n An enumerable collection of tables that are retrieved lazily.\n \n \n \n Returns an enumerable collection of tables in the storage account.\n \n A returned by a previous listing operation.\n An enumerable collection of tables.\n \n \n \n Returns an enumerable collection of tables, which are retrieved lazily, that begin with the specified prefix.\n \n The table name prefix.\n A returned by a previous listing operation.\n An enumerable collection of tables that are retrieved lazily.\n \n \n \n Returns an enumerable collection of tables that begin with the specified prefix and that are retrieved lazily.\n \n The table name prefix.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A returned by a previous listing operation.\n A object that specifies additional options for the request.\n An object that provides information on how the operation executed.\n An enumerable collection of tables that are retrieved lazily.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of tables \n in the storage account.\n \n A returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n The table name prefix.\n A returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n The table name prefix.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A returned by a previous listing operation.\n The server timeout, maximum execution time, and retry policies for the operation.\n An object that provides information on how the operation executed.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return a result segment containing a collection \n of tables. \n \n An that references the pending asynchronous operation.\n A result segment containing tables.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n A returned by a previous listing operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n A returned by a previous listing operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n The table name prefix.\n A returned by a previous listing operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n The table name prefix.\n A returned by a previous listing operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n The table name prefix.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A returned by a previous listing operation.\n The server timeout, maximum execution time, and retry policies for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n The table name prefix.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A returned by a previous listing operation.\n The server timeout, maximum execution time, and retry policies for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the service properties for the Table service.\n \n A object that specifies additional options for the request.\n An object that provides information on how the operation executed.\n The table service properties as a object.\n \n \n \n Begins an asynchronous operation to get the service properties of the Table service.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get the service properties of the Table service.\n \n A object that specifies additional options for the request.\n An object that provides information on how the operation executed.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get the service properties of the Table service.\n \n The result returned from a prior call to .\n The table service properties.\n \n \n \n Returns a task that performs an asynchronous operation to get the service properties of the Table service.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the service properties of the Table service.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the service properties of the Table service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the service properties of the Table service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets the service properties of the Table service.\n \n The table service properties.\n A object that specifies additional options for the request.\n An object that provides information on how the operation executed.\n \n \n \n Begins an asynchronous operation to set the service properties of the Table service.\n \n The table service properties.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to set the service properties of the Table service.\n \n The table service properties.\n A object that specifies additional options for the request.\n An object that provides information on how the operation executed.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to set the service properties of the Table service.\n \n The result returned from a prior call to \n \n \n \n Returns a task that performs an asynchronous operation to set the service properties of the Table service.\n \n The table service properties.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the service properties of the Table service.\n \n The table service properties.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the service properties of the Table service.\n \n The table service properties.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the service properties of the Table service.\n \n The table service properties.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Begins an asynchronous operation to get the stats of the table service.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get the stats of the table service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get the stats of the table service.\n \n An that references the pending asynchronous operation.\n The table service stats.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the table service.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the table service.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the table service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the table service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the stats of the table service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The table service stats.\n \n \n \n Creates a new object for performing operations against the Table service.\n \n A service context to use for performing operations against the Table service.\n \n \n \n The default server and client timeout interval.\n \n \n \n \n Max execution time across all potential retries.\n \n \n \n \n Initializes a new instance of the class using the specified Table service endpoint\n and anonymous credentials.\n \n The Table service endpoint to use to create the client.\n \n \n \n Initializes a new instance of the class using the specified Table service endpoint\n and storage account credentials.\n \n The Table service endpoint to use to create the client.\n The storage account credentials.\n \n \n \n Initializes a new instance of the class using the specified Blob service endpoint\n and account credentials.\n \n The Table service endpoint to use to create the client.\n The storage account credentials.\n \n \n \n Gets a reference to the specified table.\n \n The name of the table.\n A object.\n \n \n \n Gets or sets the authentication scheme to use to sign HTTP requests.\n \n Note that if you are using the legacy Table service API, which is based on WCF Data Services, the authentication scheme used by the TableServiceContext object will always be Shared Key Lite, regardless of the value of this property. \n \n \n \n Gets the authentication handler used to sign HTTP requests.\n \n The authentication handler.\n \n \n \n Gets or sets a buffer manager that implements the interface, \n specifying a buffer pool for use with operations against the Table service client.\n \n \n \n \n Gets the storage account credentials used to create the Table service client.\n \n The storage account credentials.\n \n \n \n Gets the base URI for the Table service client, at the primary location.\n \n The base URI used to construct the Table service client, at the primary location.\n \n \n \n Gets the Table service endpoints for all locations.\n \n An object of type containing Table service URIs for all locations.\n \n \n \n Gets or sets the default retry policy for requests made via the Table service client.\n \n The retry policy.\n \n \n \n Gets or sets the default location mode for requests made via the Table service client.\n \n The location mode.\n \n \n \n Gets or sets the default server and client timeout for requests.\n \n The server and client timeout interval.\n \n \n \n Gets or sets the maximum execution time across all potential retries.\n \n The maximum execution time across all potential retries.\n \n \n \n Gets and sets the that is used for any table accessed with this object.\n \n The TablePayloadFormat to use.\n \n \n \n Gets a value indicating whether the service client is used with Path style or Host style.\n \n Is true if use path style URIs; otherwise, false.\n \n \n \n Gets the associated account name for the client.\n \n The account name.\n \n \n \n Represents a custom attribute that can be used to ignore entity properties during serialization/de-serialization.\n \n \n \n \n Represents a batch operation on a table.\n \n \n Represents a batch operation on a table.\n \n A batch operation is a collection of table operations which are executed by the Storage Service REST API as a single atomic operation, by invoking an \n Entity Group Transaction.A batch operation may contain up to 100 individual \n table operations, with the requirement that each operation entity must have same partition key. A batch with a retrieve operation cannot contain any other operations. \n Note that the total payload of a batch operation is limited to 4MB.\n \n \n \n Inserts a into the batch that retrieves an entity based on its row key and partition key. The entity will be deserialized into the specified class type which extends .\n \n The class of type for the entity to retrieve.\n A string containing the partition key of the entity to retrieve.\n A string containing the row key of the entity to retrieve. \n \n \n \n Adds a table operation to retrieve an entity of the specified class type with the specified partition key and row key to the batch operation.\n \n The return type which the specified will resolve the given entity to.\n A string containing the partition key of the entity to retrieve.\n A string containing the row key of the entity to retrieve.\n The implementation to project the entity to retrieve as a particular type in the result.\n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Adds a to the that deletes the specified entity from a table.\n \n The entity to be deleted from the table.\n \n \n \n Adds a to the that inserts the specified entity into a table.\n \n The entity to be inserted into the table.\n \n \n \n Adds a object that inserts the specified entity into the table as part of the batch operation.\n \n The entity to be inserted into the table.\n true if the message payload should be returned in the response to the insert operation;otherwise, false.\n \n \n \n Adds a to the that inserts the specified entity into a table if the entity does not exist; if the entity does exist then its contents are merged with the provided entity.\n \n The entity whose contents are being inserted or merged.\n \n \n \n Adds a to the that inserts the specified entity into a table if the entity does not exist; if the entity does exist then its contents are replaced with the provided entity.\n \n The entity whose contents are being inserted or replaced.\n \n \n \n Adds a to the that merges the contents of the specified entity with the existing entity in a table.\n \n The entity whose contents are being merged.\n \n \n \n Adds a to the that replaces the contents of the specified entity in a table.\n \n The entity whose contents are being replaced.\n \n \n \n Adds a to the that retrieves an entity with the specified partition key and row key.\n \n A string containing the partition key of the entity to retrieve.\n A string containing the row key of the entity to retrieve.\n \n \n \n Returns the zero-based index of the first occurrence of the specified item, or -1 if the does not contain the item.\n \n The item to search for.\n The zero-based index of the first occurrence of item within the , if found; otherwise, –1.\n \n \n \n Inserts a into the at the specified index.\n \n The index at which to insert the .\n The item to insert.\n \n \n \n Removes the at the specified index from the .\n \n The index of the to remove from the .\n \n \n \n Adds the to the .\n \n The item to add to the .\n \n \n \n Clears all objects from the .\n \n \n \n \n Returns true if this contains the specified element.\n \n The item to search for.\n true if the item is contained in the ; false, otherwise.\n \n \n \n Copies all the elements of the to the specified one-dimensional array starting at the specified destination array index. \n \n The one-dimensional array that is the destination of the elements copied from the .\n The index in the destination array at which copying begins.\n \n \n \n Removes the specified item from the .\n \n The item to remove.\n true if the item was successfully removed; false, otherwise.\n \n \n \n Returns an for the .\n \n An enumerable collection of items.\n \n \n \n Returns an .\n \n An for the .\n \n \n \n Gets or sets the item at the specified index.\n \n The index at which to get or set the item.\n The item at the specified index.\n \n \n \n Gets the number of operations in this .\n \n The number of operations in the .\n \n \n \n Gets a value indicating whether the is read-only.\n \n true if the is read-only; false, otherwise.\n \n \n \n Represents a single table operation.\n \n \n Represents a single table operation.\n \n \n \n \n Creates a new table operation that retrieves the contents of\n the given entity in a table.\n \n The class of type for the entity to retrieve.\n A string containing the partition key of the entity to retrieve.\n A string containing the row key of the entity to retrieve. \n The object.\n \n \n \n Creates a new table operation that retrieves the contents of\n the given entity in a table.\n \n The return type which the specified will resolve the given entity to.\n A string containing the partition key of the entity to retrieve.\n A string containing the row key of the entity to retrieve.\n The implementation to project the entity to retrieve as a particular type in the result.\n The object.\n \n \n \n Creates a new instance of the class given the\n entity to operate on and the type of operation that is being\n performed.\n \n The entity on which the operation is being performed.\n The type of operation.\n \n \n \n Creates a new table operation that deletes the given entity\n from a table.\n \n The entity to be deleted from the table.\n The object.\n \n \n \n Creates a new table operation that inserts the given entity\n into a table.\n \n The entity to be inserted into the table.\n The object.\n \n \n \n Creates a new table operation that inserts the given entity\n into a table.\n \n The entity to be inserted into the table.\n true if the message payload should be returned in the response to the insert operation. false otherwise.\n The table operation.\n \n \n \n Creates a new table operation that inserts the given entity\n into a table if the entity does not exist; if the entity does\n exist then its contents are merged with the provided entity.\n \n The entity whose contents are being inserted\n or merged.\n The object.\n \n \n \n Creates a new table operation that inserts the given entity\n into a table if the entity does not exist; if the entity does\n exist then its contents are replaced with the provided entity.\n \n The entity whose contents are being inserted\n or replaced.\n The object.\n \n \n \n Creates a new table operation that merges the contents of\n the given entity with the existing entity in a table.\n \n The entity whose contents are being merged.\n The object.\n \n \n \n Creates a new table operation that replaces the contents of\n the given entity in a table.\n \n The entity whose contents are being replaced.\n The object.\n \n \n \n Creates a new table operation that replaces the contents of\n the given entity in a table.\n \n The partition key of the entity to be replaced.\n The row key of the entity to be replaced.\n The object.\n \n \n \n Gets the entity that is being operated upon.\n \n \n \n \n Gets the type of operation.\n \n \n \n \n Gets or sets the value that represents whether the message payload should be returned in the response.\n \n \n \n \n Represents a query against a Windows Azure table.\n \n A class which implements .\n \n Represents a query against a specified table.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Executes a query on a table, using the specified and .\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n An enumerable collection, specialized for type TElement, of the results of executing the query. \n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to execute a query and return the results as a result segment.\n \n The reference to the pending asynchronous request to finish.\n A result segment containing objects of type .\n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n A of object that represents the current operation.\n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null./// A to observe while waiting for a task to complete.\n A of object that represents the current operation.\n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n An object for tracking the current operation.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n A of object that represents the current operation.\n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n An object for tracking the current operation.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n A to observe while waiting for a task to complete.\n A of object that represents the current operation.\n \n \n \n Queries a table in segmented mode using the specified continuation token, , and .\n \n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A , specialized for type TElement, containing the results of executing the query.\n \n \n \n Returns an enumerator that iterates through the .\n \n An for the .\n \n \n \n Generates a property filter condition string for the string value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A string containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the boolean value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A bool containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the binary value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A byte array containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value, formatted as the specified .\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A string containing the value to compare with the property.\n The to format the value as.\n A string containing the formatted filter condition.\n \n \n \n Creates a filter condition using the specified logical operator on two filter conditions.\n \n A string containing the first formatted filter condition.\n A string containing Operators.AND or Operators.OR.\n A string containing the second formatted filter condition.\n A string containing the combined filter expression.\n \n \n \n Defines the property names of the table entity properties to return when the table query is executed. \n \n The select clause is optional on a table query, used to limit the table properties returned from the server. By default, a query will return all properties from the table entity.\n A list of string objects containing the property names of the table entity properties to return when the query is executed.\n A instance set with the table entity properties to return.\n \n \n \n Defines the upper bound for the number of entities the query returns.\n \n The maximum number of entities for the table query to return.\n A instance set with the number of entities to return.\n \n \n \n Defines a filter expression for the table query. Only entities that satisfy the specified filter expression will be returned by the query. \n \n Setting a filter expression is optional; by default, all entities in the table are returned if no filter expression is specified in the table query.\n A string containing the filter expression to apply to the table query.\n A instance set with the filter on entities to return.\n \n \n \n Gets the type of the element(s) that are returned when the expression tree is executed.\n \n \n \n \n Gets the expression tree.\n \n \n \n \n Gets the query provider that is associated with this data source.\n \n \n \n \n Gets or sets the number of entities the query returns specified in the table query. \n \n The maximum number of entities for the table query to return.\n \n \n \n Gets or sets the filter expression to use in the table query.\n \n A string containing the filter expression to use in the query.\n \n \n \n Gets or sets the property names of the table entity properties to return when the table query is executed.\n \n A list of strings containing the property names of the table entity properties to return when the query is executed.\n \n \n \n Represents a query against a specified table.\n \n The class aggregates and encodes the query parameters to pass with the request when the query is executed. \n To execute the query, call the executeQuery or executeQuerySegmented method of the class. \n \n \n \n Represents a query against a specified table.\n \n A instance aggregates the query parameters to use when the query is executed. One of the executeQuery or executeQuerySegmented methods \n of must be called to execute the query. The parameters are encoded and passed to the server when the table query is executed.\n \n \n \n Specifies the names of the entity properties to return when the query is executed against the table. \n \n The Project clause is optional on a query, used to limit the properties returned from the server. By default, a query will return all properties from the entity.\n The entity type of the query. \n The entity instance to project off of.\n A list of string objects containing the names of the entity properties to return when the query is executed.\n A instance set with the entity properties to return.\n \n \n \n Generates a property filter condition string for the string value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A string containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the boolean value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A bool containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the binary value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A byte array containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value, formatted as the specified .\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A string containing the value to compare with the property.\n The to format the value as.\n A string containing the formatted filter condition.\n \n \n \n Creates a filter condition using the specified logical operator on two filter conditions.\n \n A string containing the first formatted filter condition.\n A string containing Operators.AND or Operators.OR.\n A string containing the second formatted filter condition.\n A string containing the combined filter expression.\n \n \n \n Defines the property names of the table entity properties to return when the table query is executed. \n \n The select clause is optional on a table query, used to limit the table properties returned from the server. By default, a query will return all properties from the table entity.\n A list of string objects containing the property names of the table entity properties to return when the query is executed.\n A instance set with the table entity properties to return.\n \n \n \n Defines the upper bound for the number of entities the query returns.\n \n The maximum number of entities for the table query to return.\n A instance set with the number of entities to return.\n \n \n \n Defines a filter expression for the table query. Only entities that satisfy the specified filter expression will be returned by the query. \n \n Setting a filter expression is optional; by default, all entities in the table are returned if no filter expression is specified in the table query.\n A string containing the filter expression to apply to the table query.\n A instance set with the filter on entities to return.\n \n \n \n Gets or sets the number of entities the table query will return. \n \n The maximum number of entities for the table query to return.\n \n \n \n Gets or sets the filter expression to use in the table query.\n \n A string containing the filter expression to use in the query.\n \n \n \n Gets or sets the property names of the table entity properties to return when the table query is executed.\n \n A list of strings containing the property names of the table entity properties to return when the query is executed.\n \n \n \n Represents the default EDM entity container for table storage.\n \n \n \n \n Initializes a new instance of the EdmEntityContainer class and sets the model and entity set. The name and namespace should not matter since we look for default entity container.\n \n Sets the data model that will be used for table transactions. \n \n \n \n Searches for an entity set with the given name in this entity container and creates a new set if no such set exists.\n \n The name of the element being found.\n The requested element, or the new element created if no such element exists.\n \n \n \n Represents a data model that will be used by OData for table transactions.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Searches for a type with the given name in this model and creates a new type if no such type exists.\n \n The qualified name of the type being found.\n The requested type, or the new type created if no such type exists.\n \n \n \n Create a new type with the standard set of properties(PK, RK and TimeStamp).\n \n Namespace the entity belongs to.\n Name of the entity.\n The EdmEntityType created.\n \n \n \n Searches for a type with the given name in this model. Returns true if such a type is found, otherwise returns false.\n \n The qualified name of the type being found.\n true if the type is found; otherwise, false.\n \n \n \n Represents a object for use with the Windows Azure Table service.\n \n The class does not support concurrent queries or requests.\n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Callback on DataContext object sending request.\n \n The sender.\n The instance containing the event data. \n \n \n \n Saves changes, using the retry policy specified for the service context.\n \n A that represents the result of the operation.\n \n \n \n Saves changes, using the retry policy specified for the service context.\n \n Additional options for saving changes.\n \n \n A that represents the result of the operation.\n \n \n \n Begins an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n Additional options for saving changes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n Additional options for saving changes.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n \n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to save changes.\n \n An that references the pending asynchronous operation.\n A that represents the result of the operation.\n \n \n \n Returns a object that performs an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n A object that represents the current operation.\n \n \n \n Returns a object that performs an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a object that performs an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n Additional options for saving changes.\n A object that represents the current operation.\n \n \n \n Returns a object that performs an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n Additional options for saving changes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a object that performs an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n Additional options for saving changes.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a object that performs an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n Additional options for saving changes.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Releases all resources used by the TableServiceContext.\n \n \n \n \n Releases the unmanaged resources used by the TableServiceContext and optionally releases the managed resources.\n \n true to release both managed and unmanaged resources; false to release only unmanaged resources.\n \n \n \n Gets the object that represents the Table service.\n \n A client object that specifies the Table service endpoint.\n \n \n \n Gets the authentication handler used to sign HTTP requests.\n \n The authentication handler.\n \n \n \n Represents an entity in the Windows Azure Table service.\n \n \n \n \n Initializes a new instance of the class.\n \n The partition key.\n The row key.\n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets or sets the timestamp for the entity.\n \n The entity's timestamp.\n \n \n \n Gets or sets the partition key of a table entity.\n \n The partition key.\n \n \n \n Gets or sets the row key of a table entity.\n \n The row key.\n \n \n \n Provides a set of extensions for the Table service.\n \n \n \n \n Converts the query into a object that supports \n additional operations like retries.\n \n The type of the element.\n The query.\n A object that represents the runtime context of the Table service.\n The converted query.\n \n \n \n A class for constructing a query against the Table service.\n \n The type of the element. \n \n \n \n Initializes a new instance of the class.\n \n An object that implements .\n A object.\n \n \n \n Expands the specified path.\n \n The path to expand.\n A new query with the expanded path.\n \n \n \n Returns an enumerator that iterates through the collection.\n \n \n A that can be used to iterate through the collection.\n \n \n \n \n Executes the request with any specified options.\n \n An object of type .\n An object for tracking the current operation.\n An enumerable collection, specialized for type TElement, of the results of executing the query.\n \n \n \n Executes a segmented query against the Table service.\n \n The continuation token.\n The request options.\n An object for tracking the current operation.\n A result segment containing objects of type .\n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to execute a query and return the results as a result segment.\n \n The reference to the pending asynchronous request to finish.\n A result segment containing objects of type .\n \n \n \n Returns a task that performs an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the table service context.\n \n \n An object of type .\n \n \n \n \n Stores the wrapped .\n \n \n \n \n Gets the type of the element(s) that are returned when the expression tree associated with this \n instance of is executed.\n \n \n A that represents the type of the element(s) that are returned when the expression tree associated with this object is executed.\n \n \n \n \n Gets the expression tree that is associated with the instance of .\n \n \n The that is associated with this instance of .\n \n \n \n \n Gets the query provider that is associated with this data source.\n \n \n The that is associated with this data source.\n \n \n \n \n A factory class for constructing a web request to manage tables in the Table service.\n \n \n \n \n Creates a web request to get the properties of the Table service.\n \n The absolute URI to the Table service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to get the Table service properties.\n \n \n \n \n Creates a web request to set the properties of the Table service.\n \n The absolute URI to the Table service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to set the Table service properties.\n \n \n \n \n Creates a web request to get the stats of the Table service.\n \n The absolute URI to the Table service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to get the Table service stats.\n \n \n \n \n Writes Table service properties to a stream, formatted in XML.\n \n The service properties to format and write to the stream.\n The stream to which the formatted properties are to be written.\n \n \n \n Constructs a web request to return the ACL for a table.\n \n The absolute URI to the table.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Constructs a web request to set the ACL for a table.\n \n The absolute URI to the table.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Provides a set of methods for parsing a response stream from the Table service.\n \n \n \n \n Gets the request ID from the response.\n \n The web response.\n A unique value associated with the request.\n \n \n \n Reads service properties from a stream.\n \n The stream from which to read the service properties.\n The service properties stored in the stream.\n \n \n \n Reads service stats from a stream.\n \n The stream from which to read the service stats.\n The service stats stored in the stream.\n \n \n \n Reads the share access policies from a stream in XML.\n \n The stream of XML policies.\n The permissions object to which the policies are to be written.\n \n \n \n Gets the table continuation from response.\n \n The response.\n The continuation.\n \n \n \n Translates the data service exception.\n \n The exception.\n The request result.\n The delegate used to parse the error to get extended error information.\n \n The translated exception.\n \n \n \n \n Look for an inner exception of type T. \n \n The exception.\n The found exception or null.\n \n \n \n Applies the continuation to query.\n \n The continuation token.\n The local query.\n The modified query.\n \n \n \n Gets the query take count.\n \n The type of the element.\n The query.\n The default value.\n \n The take count of the query, if any.\n \n \n \n \n Gets the table continuation from response.\n \n The response.\n The continuation.\n \n \n \n Copies the headers and properties from a request into a different request.\n \n The request to copy into.\n The request to copy from.\n \n \n \n Gets an ETag from a response.\n \n The web response.\n A quoted ETag string.\n \n \n \n Gets the user-defined metadata.\n \n The response from server.\n A of the metadata.\n \n \n \n Gets the metadata or properties.\n \n The response from server.\n The prefix for all the headers.\n A of the headers with the prefix.\n \n \n \n Converts a string to UTC time.\n \n The string to convert.\n A UTC representation of the string.\n \n \n \n Reads service properties from a stream.\n \n The stream from which to read the service properties.\n The service properties stored in the stream.\n \n \n \n Reads service stats from a stream.\n \n The stream from which to read the service stats.\n The service stats stored in the stream.\n \n \n \n Reads a collection of shared access policies from the specified object.\n \n A collection of shared access policies to be filled.\n A policy response object for reading the stream.\n The type of policy to read.\n \n \n \n Creates the web request.\n \n The HTTP method.\n The request URI.\n The timeout.\n An object of type , containing additional parameters to add to the URI query string.\n An object for tracking the current operation.\n \n A web request for performing the operation.\n \n \n \n \n Creates the specified URI.\n \n The URI to create.\n The timeout.\n The builder.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Constructs a web request to return the ACL for a cloud resource.\n \n The absolute URI to the resource.\n The server timeout interval.\n An optional query builder to use.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to set the ACL for a cloud resource.\n \n The absolute URI to the resource.\n The server timeout interval.\n An optional query builder to use.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Gets the properties.\n \n The URI to query.\n The timeout.\n The builder.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Gets the metadata.\n \n The blob Uri.\n The timeout.\n The builder.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Sets the metadata.\n \n The blob Uri.\n The timeout.\n The builder.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Adds the metadata.\n \n The request.\n The metadata.\n \n \n \n Adds the metadata.\n \n The request.\n The metadata name.\n The metadata value.\n \n \n \n Deletes the specified URI.\n \n The URI of the resource to delete.\n The timeout.\n The builder.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Creates a web request to get the properties of the service.\n \n The absolute URI to the service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval.\n An object for tracking the current operation.\n \n A web request to get the service properties.\n \n \n \n \n Creates a web request to set the properties of the service.\n \n The absolute URI to the service.\n The builder.\n The server timeout interval.\n An object for tracking the current operation.\n \n A web request to set the service properties.\n \n \n \n \n Creates a web request to get the stats of the service.\n \n The absolute URI to the service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval.\n An object for tracking the current operation.\n \n A web request to get the service stats.\n \n \n \n \n Generates a query builder for building service requests.\n \n A for building service requests.\n \n \n \n Adds the lease id.\n \n The request.\n The lease id.\n \n \n \n Adds an optional header to a request.\n \n The web request.\n The metadata name.\n The metadata value.\n \n \n \n Adds an optional header to a request.\n \n The web request.\n The header name.\n The header value.\n \n \n \n Adds an optional header to a request.\n \n The web request.\n The header name.\n The header value.\n \n \n \n Applies the lease condition to the web request.\n \n The request to be modified.\n Access condition to be added to the request.\n \n \n \n Applies the sequence number condition to the web request.\n \n The request to be modified.\n Access condition to be added to the request.\n \n \n \n Applies the condition to the web request.\n \n The request to be modified.\n Access condition to be added to the request.\n \n \n \n Applies the condition for a source blob to the web request.\n \n The request to be modified.\n Access condition to be added to the request.\n \n \n \n Creates a well-formatted log entry so that logs can be easily parsed\n \n An object that represents the context for the current operation.\n A composite format string.\n An object array that contains zero or more objects to format.\n Log entry that contains common log prefix and a copy of format in which the format items have been replaced by the string representation of the corresponding objects in args.\n \n \n \n Determines if the current operation context allows for a specific level of log entry.\n \n Level of the log entry.\n An object that represents the context for the current operation.\n true if the entry should be logged; otherwise false.\n \n \n \n Represents a canonicalizer that converts HTTP request data into a standard form appropriate for signing.\n For detailed information on how to authenticate a request, \n see Authentication for the Windows Azure Storage Services.\n \n \n \n \n Converts the specified HTTP request data into a standard form appropriate for signing.\n \n The HTTP request that needs to be signed.\n The name of the storage account that the HTTP request will access.\n The canonicalized string containing the HTTP request data in a standard form appropriate for signing.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets the authorization scheme used for canonicalization.\n \n The authorization scheme used for canonicalization.\n Authentication for the Windows Azure Storage Services\n \n \n \n Represents a canonicalizer that converts HTTP request data into a standard form appropriate for signing via \n the Shared Key authentication scheme for the Blob or Queue service.\n \n Authentication for the Windows Azure Storage Services\n \n \n \n Converts the specified HTTP request data into a standard form appropriate for signing.\n \n The HTTP request that needs to be signed.\n The name of the storage account that the HTTP request will access.\n The canonicalized string containing the HTTP request data in a standard form appropriate for signing.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets a static instance of the object.\n \n The static instance of the class.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets the authorization scheme used for canonicalization.\n \n The authorization scheme used for canonicalization.\n Authentication for the Windows Azure Storage Services\n \n \n \n Represents a canonicalizer that converts HTTP request data into a standard form appropriate for signing via \n the Shared Key Lite authentication scheme for the Blob or Queue service.\n \n Authentication for the Windows Azure Storage Services\n \n \n \n Converts the specified HTTP request data into a standard form appropriate for signing.\n \n The HTTP request that needs to be signed.\n The name of the storage account that the HTTP request will access.\n The canonicalized string containing the HTTP request data in a standard form appropriate for signing.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets a static instance of the object.\n \n The static instance of the class.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets the authorization scheme used for canonicalization.\n \n The authorization scheme used for canonicalization.\n Authentication for the Windows Azure Storage Services\n \n \n \n Represents a canonicalizer that converts HTTP request data into a standard form appropriate for signing via \n the Shared Key Lite authentication scheme for the Table service.\n \n Authentication for the Windows Azure Storage Services\n \n \n \n Converts the specified HTTP request data into a standard form appropriate for signing.\n \n The HTTP request that needs to be signed.\n The name of the storage account that the HTTP request will access.\n The canonicalized string containing the HTTP request data in a standard form appropriate for signing.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets a static instance of the object.\n \n The static instance of the class.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets the authorization scheme used for canonicalization.\n \n The authorization scheme used for canonicalization.\n Authentication for the Windows Azure Storage Services\n \n \n \n Represents a canonicalizer that converts HTTP request data into a standard form appropriate for signing via \n the Shared Key authentication scheme for the Table service.\n \n Authentication for the Windows Azure Storage Services\n \n \n \n Converts the specified HTTP request data into a standard form appropriate for signing.\n \n The HTTP request that needs to be signed.\n The name of the storage account that the HTTP request will access.\n The canonicalized string containing the HTTP request data in a standard form appropriate for signing.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets a static instance of the object.\n \n The static instance of the class.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets the authorization scheme used for canonicalization.\n \n The authorization scheme used for canonicalization.\n Authentication for the Windows Azure Storage Services\n \n \n \n Helper class to allow an APM Method to be executed with a given timeout in milliseconds\n \n \n \n \n Helper class to convert an APM method to a Task method.\n \n \n \n \n This class provides asynchronous semaphore functionality (based on Stephen Toub's blog).\n \n \n \n \n Creates and initializes a new asynchronous copy operation.\n \n The source stream.\n The destination stream.\n An ExecutionState used to coordinate copy operation.\n Size of read and write buffers used to move data.\n Boolean value indicating whether the MD-5 should be calculated.\n An object that represents the state for the current operation.\n \n \n \n Begins a stream copy operation.\n \n Callback delegate\n Number of bytes to copy from source stream to destination stream. Cannot be passed with a value for maxLength.\n Maximum length of the source stream. Cannot be passed with a value for copyLength.\n \n \n \n Aborts an ongoing copy operation.\n \n \n \n \n Cleans up references. To end a copy operation, use Abort().\n \n \n \n \n Synchronizes Read and Write operations, and handles exceptions.\n \n Read/Write operation or null if first run.\n \n \n \n Helper method for EndOpWithCatch(IAsyncResult). Begins/Ends Read and Write Stream operations.\n Should only be called by EndOpWithCatch(IAsyncResult) since it assumes we are inside the lock.\n \n Read/Write operation or null if first run.\n \n \n \n Callback for timeout timer. Aborts the AsyncStreamCopier operation if a timeout occurs.\n \n AsyncStreamCopier operation.\n True if the timer has timed out, false otherwise.\n \n \n \n Aborts the AsyncStreamCopier operation.\n \n AsyncStreamCopier operation.\n True if aborted due to a time out, or false for a general cancellation.\n \n \n \n Terminates and cleans up the AsyncStreamCopier.\n \n \n \n \n Helper method for this.SignalCompletion()\n Should only be called by this.SignalCompletion()\n \n \n \n \n Determines whether the next operation should begin or halt due to an exception or cancellation.\n \n True to continue, false to halt.\n \n \n \n Waits for a read operation to end and updates the AsyncStreamCopier state.\n \n \n \n \n Waits for a write operation to end and updates the AsyncStreamCopier state.\n \n \n \n \n If a read operation has completed with data, swaps the read/write buffers and resets their corresponding counts.\n This must be called inside a lock as it could lead to undefined behavior if multiple unsynchronized callers simultaneously called in.\n \n Number of bytes to write, or negative if no read operation has completed.\n \n \n \n Determines the number of bytes that should be read from the source in the next BeginRead operation.\n Should only be called when no outstanding read operations exist.\n \n Number of bytes to read.\n \n \n \n Determines whether no more data can be read from the source Stream.\n \n True if at the end, false otherwise.\n \n \n \n Determines whether the current read buffer contains data ready to be written.\n \n True if read buffer is full, false otherwise.\n \n \n \n Represents an operation that supports cancellation. Used by\n ICancellableAsyncResult implementations throughout the library.\n Also used by AsyncExtensions as a bridge between CancellationToken\n and the ICancellableAsyncResult returned by an APM method call.\n \n \n \n \n The class is provides the helper functions to do FISMA compliant MD5.\n \n \n \n \n Cryptographic service provider.\n \n \n \n \n Access to the private keys is not required and the user interface can be bypassed.\n \n \n \n \n ALG_ID value that identifies the hash algorithm to use.\n \n \n \n \n The hash value or message hash for the hash object specified by hashHandle. \n \n \n \n \n The address to which the function copies a handle to the new hash object. Has to be released by calling the CryptDestroyHash function after we are finished using the hash object.\n \n \n \n \n A handle to a CSP created by a call to CryptAcquireContext.\n \n \n \n \n Whether this object has been torn down or not.\n \n \n \n \n Initializes a new instance of NativeMD5.\n \n \n \n \n Finalizes an instance of the NativeMD5 class, unhooking it from all events.\n \n \n \n \n Initializes an implementation of the NativeMD5 class.\n \n \n \n \n Routes data written to the object into the hash algorithm for computing the hash.\n \n The input to compute the hash code for.\n The offset into the byte array from which to begin using data.\n The number of bytes in the byte array to use as data.\n \n \n \n Finalizes the hash computation after the last data is processed by the cryptographic stream object.\n \n The computed hash code.\n \n \n \n Releases the unmanaged resources used by the NativeMD5.\n \n true to release both managed and unmanaged resources; false to release only unmanaged resources.\n \n \n \n Validates the status returned by all the crypto functions and throws exception per the return code.\n \n The boolean status returned by the crypto functions.\n \n \n \n Represents the async result returned by operations that do not directly\n call into the Executor.\n \n Async operation's result type\n \n \n \n Represents the async result returned by a storage command.\n \n \n \n \n The callback provided by the user.\n \n \n \n \n The state for the callback.\n \n \n \n \n Indicates whether a task is completed.\n \n \n \n \n Indicates whether task completed synchronously.\n \n \n \n \n The event for blocking on this task's completion.\n \n \n \n \n Initializes a new instance of the StorageCommandAsyncResult class.\n \n The callback method to be used on completion.\n The state for the callback.\n \n \n \n We implement the dispose only to allow the explicit closing of the event.\n \n \n \n \n Releases unmanaged and - optionally - managed resources.\n \n Set to true to release both managed and unmanaged resources; false to release only unmanaged resources.\n \n \n \n Provides the lazy initialization of the WaitHandle (based on Joe Duffy's blog).\n \n The WaitHandle to use for waiting on completion.\n \n \n \n Called on completion of the async operation to notify the user\n (Based on Joe Duffy's lockless design).\n \n \n \n \n Blocks the calling thread until the async operation is completed.\n \n \n \n \n Updates the CompletedSynchronously flag with another asynchronous operation result.\n \n Set to true if the last operation was completed synchronously; false if it was completed asynchronously.\n \n \n \n Gets A user-defined object that contains information about the asynchronous operation.\n \n \n \n \n Gets a System.Threading.WaitHandle that is used to wait for an asynchronous operation to complete.\n \n \n \n \n Gets a value indicating whether the asynchronous operation completed synchronously.\n \n \n \n \n Gets a value indicating whether the asynchronous operation has completed.\n \n \n \n \n Initializes a new instance of the StorageAsyncResult class.\n \n The callback method to be used on completion.\n The state for the callback.\n \n \n \n Called on completion of the async operation to notify the user\n \n Exception that was caught by the caller.\n \n \n \n Blocks the calling thread until the async operation is completed and throws\n any stored exceptions.\n \n \n \n \n Represents a set of access conditions to be used for operations against the storage services. \n \n \n \n \n Time for IfModifiedSince.\n \n \n \n \n Time for IfUnmodifiedSince.\n \n \n \n \n Constructs an empty access condition.\n \n An empty access condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if the resource's ETag value\n matches the specified ETag value.\n \n The ETag value that must be matched.\n An AccessCondition object that represents the If-Match condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if the resource has been\n modified since the specified time.\n \n The time since which the resource must have been modified in order for the operation to proceed.\n An AccessCondition object that represents the If-Modified-Since condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if the resource's ETag value\n does not match the specified ETag value.\n \n The ETag value that must be matched, or \"*\".\n An AccessCondition object that represents the If-None-Match condition.\n \n If \"*\" is specified as the parameter then this condition requires that the resource does not exist.\n \n \n \n \n Constructs an access condition such that an operation will be performed only if the resource has not been\n modified since the specified time.\n \n The time since which the resource must not have been modified in order for the operation to proceed.\n An AccessCondition object that represents the If-Unmodified-Since condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if resource's current sequence\n number is less than or equal to the specified value.\n \n The value that the current sequence number of the resource must be less than or equal to.\n An AccessCondition object that represents the If-Sequence-Number-LE condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if resource's current sequence\n number is less than the specified value.\n \n The value that the current sequence number of the resource must be less than.\n An AccessCondition object that represents the If-Sequence-Number-LT condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if resource's current sequence\n number is equal to the specified value.\n \n The value that the current sequence number of the resource must be equal to.\n An AccessCondition object that represents the If-Sequence-Number-EQ condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if the lease ID on the\n resource matches the specified lease ID.\n \n The lease ID that must match the lease ID of the resource.\n An AccessCondition object that represents the lease condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if the resource's ETag value\n matches the specified ETag value and the lease ID on the resource matches the lease ID specified in\n the given access condition.\n \n An AccessCondition object that represents the lease condition.\n The ETag value that must be matched.\n An AccessCondition object that represents the If-Match and the lease conditions.\n \n \n \n Gets or sets an ETag value that must match the ETag of the specified resource.\n \n A string containing an ETag value, or \"*\" to match any ETag. If null, no condition exists.\n \n \n \n Gets or sets an ETag value that must not match the ETag of the specified resource.\n \n A string containing an ETag value, or \"*\" to match any ETag. If null, no condition exists.\n \n \n \n Gets or sets a time that must be before the last modification of a resource.\n \n A DateTimeOffset in UTC, or null if no condition exists.\n \n \n \n Gets or sets a time that must not be before the last modification of a resource.\n \n A DateTimeOffset in UTC, or null if no condition exists.\n \n \n \n Gets or sets a sequence number that the current sequence number of a page blob must be less than or equal to in order for the operation to proceed.\n \n A sequence number, or null if no condition exists.\n This condition only applies to page blobs.\n \n \n \n Gets or sets a sequence number that the current sequence number of a page blob must be less than in order for the operation to proceed.\n \n A sequence number, or null if no condition exists.\n This condition only applies to page blobs.\n \n \n \n Gets or sets a sequence number that the current sequence number of a page blob must be equal to in order for the operation to proceed.\n \n A sequence number, or null if no condition exists.\n This condition only applies to page blobs.\n \n \n \n Gets or sets a lease ID that must match the lease on a resource.\n \n A lease ID, or null if no condition exists.\n \n \n \n Determines whether the access condition is one of the four conditional headers.\n \n true if the access condition is a conditional header; otherwise, false.\n \n \n \n Specifies the authentication scheme used to sign HTTP requests.\n \n \n \n \n Signs HTTP requests using the Shared Key Lite authentication scheme.\n \n \n \n \n Signs HTTP requests using the Shared Key authentication scheme.\n \n \n \n \n Represents a Windows Azure Storage account.\n \n \n \n \n The setting name for using the development storage.\n \n \n \n \n The setting name for specifying a development storage proxy Uri.\n \n \n \n \n The setting name for using the default storage endpoints with the specified protocol.\n \n \n \n \n The setting name for the account name.\n \n \n \n \n The setting name for the account key name.\n \n \n \n \n The setting name for the account key.\n \n \n \n \n The setting name for a custom blob storage endpoint.\n \n \n \n \n The setting name for a custom queue endpoint.\n \n \n \n \n The setting name for a custom table storage endpoint.\n \n \n \n \n The setting name for a custom storage endpoint suffix.\n \n \n \n \n The setting name for a shared access key.\n \n \n \n \n The default account name for the development storage.\n \n \n \n \n The default account key for the development storage.\n \n \n \n \n The credentials string used to test for the development storage credentials.\n \n \n \n \n The suffix appended to account in order to access secondary location for read only access.\n \n \n \n \n The default storage service hostname suffix.\n \n \n \n \n The default blob storage DNS hostname prefix.\n \n \n \n \n The root queue DNS name prefix.\n \n \n \n \n The root table storage DNS name prefix.\n \n \n \n \n The FISMA compliance default value.\n \n \n \n \n Validator for the UseDevelopmentStorage setting. Must be \"true\".\n \n \n \n \n Validator for the DevelopmentStorageProxyUri setting. Must be a valid Uri.\n \n \n \n \n Validator for the DefaultEndpointsProtocol setting. Must be either \"http\" or \"https\".\n \n \n \n \n Validator for the AccountName setting. No restrictions.\n \n \n \n \n Validator for the AccountKey setting. No restrictions.\n \n \n \n \n Validator for the AccountKey setting. Must be a valid base64 string.\n \n \n \n \n Validator for the BlobEndpoint setting. Must be a valid Uri.\n \n \n \n \n Validator for the QueueEndpoint setting. Must be a valid Uri.\n \n \n \n \n Validator for the TableEndpoint setting. Must be a valid Uri.\n \n \n \n \n Validator for the EndpointSuffix setting. Must be a valid Uri.\n \n \n \n \n Validator for the SharedAccessSignature setting. No restrictions.\n \n \n \n \n Singleton instance for the development storage account.\n \n \n \n \n Initializes a new instance of the class using the specified\n account credentials and service endpoints.\n \n The account credentials.\n The Blob service endpoint.\n The Queue service endpoint.\n The Table service endpoint.\n \n \n \n Initializes a new instance of the class using the specified\n account credentials and service endpoints.\n \n The account credentials.\n The Blob service endpoint.\n The Queue service endpoint.\n The Table service endpoint.\n \n \n \n Initializes a new instance of the class using the specified\n account credentials and the default service endpoints. \n \n An object of type that \n specifies the account name and account key for the storage account.\n True to use HTTPS to connect to storage service endpoints; otherwise, false.\n \n \n \n Initializes a new instance of the class using the specified\n account credentials and the default service endpoints. \n \n An object of type that \n specifies the account name and account key for the storage account.\n The DNS endpoint suffix for all storage services, e.g. \"core.windows.net\".\n True to use HTTPS to connect to storage service endpoints; otherwise, false.\n \n \n \n Parses a connection string and returns a created\n from the connection string.\n \n A valid connection string.\n Thrown if is null or empty.\n Thrown if is not a valid connection string.\n Thrown if cannot be parsed.\n A object constructed from the values provided in the connection string.\n \n \n \n Indicates whether a connection string can be parsed to return a object.\n \n The connection string to parse.\n A object to hold the instance returned if\n the connection string can be parsed.\n true if the connection string was successfully parsed; otherwise, false.\n \n \n \n Creates the Table service client.\n \n A client object that specifies the Table service endpoint.\n \n \n \n Creates the Queue service client.\n \n A client object that specifies the Queue service endpoint.\n \n \n \n Creates the Blob service client.\n \n A client object that specifies the Blob service endpoint.\n \n \n \n Returns a connection string for this storage account, without sensitive data.\n \n A connection string.\n \n \n \n Returns a connection string for the storage account, optionally with sensitive data.\n \n True to include sensitive data in the string; otherwise, false.\n A connection string.\n \n \n \n Returns a with development storage credentials using the specified proxy Uri.\n \n The proxy endpoint to use.\n The new .\n \n \n \n Internal implementation of Parse/TryParse.\n \n The string to parse.\n The to return.\n A callback for reporting errors.\n If true, the parse was successful. Otherwise, false.\n \n \n \n Tokenizes input and stores name value pairs.\n \n The string to parse.\n Error reporting delegate.\n Tokenized collection.\n \n \n \n Encapsulates a validation rule for an enumeration based account setting.\n \n The name of the setting.\n A list of valid values for the setting.\n An representing the enumeration constraint.\n \n \n \n Encapsulates a validation rule using a func.\n \n The name of the setting.\n A func that determines if the value is valid.\n An representing the constraint.\n \n \n \n Determines whether the specified setting value is a valid base64 string.\n \n The setting value.\n true if the specified setting value is a valid base64 string; otherwise, false.\n \n \n \n Validation function that validates Uris.\n \n Value to validate.\n true if the specified setting value is a valid Uri; otherwise, false.\n \n \n \n Validation function that validates a domain name.\n \n Value to validate.\n true if the specified setting value is a valid domain; otherwise, false.\n \n \n \n Settings filter that requires all specified settings be present and valid.\n \n A list of settings that must be present.\n The remaining settings or null if the filter's requirement is not satisfied.\n \n \n \n Settings filter that removes optional values.\n \n A list of settings that are optional.\n The remaining settings or null if the filter's requirement is not satisfied.\n \n \n \n Settings filter that ensures that at least one setting is present.\n \n A list of settings of which one must be present.\n The remaining settings or null if the filter's requirement is not satisfied.\n \n \n \n Settings filter that ensures that a valid combination of credentials is present.\n \n The remaining settings or null if the filter's requirement is not satisfied.\n \n \n \n Tests to see if a given list of settings matches a set of filters exactly.\n \n The settings to check.\n A list of filters to check.\n \n If any filter returns null, false.\n If there are any settings left over after all filters are processed, false.\n Otherwise true.\n \n \n \n \n Gets a StorageCredentials object corresponding to whatever credentials are supplied in the given settings.\n \n The settings to check.\n The StorageCredentials object specified in the settings.\n \n \n \n Gets the default blob endpoint using specified settings.\n \n The settings to use.\n The default blob endpoint.\n \n \n \n Gets the default blob endpoint using the specified protocol and account name.\n \n The protocol to use.\n The name of the storage account.\n The Endpoint DNS suffix; use null for default.\n The default blob endpoint.\n \n \n \n Gets the default queue endpoint using the specified settings.\n \n The settings.\n The default queue endpoint.\n \n \n \n Gets the default queue endpoint using the specified protocol and account name.\n \n The protocol to use.\n The name of the storage account.\n The Endpoint DNS suffix; use null for default.\n The default queue endpoint.\n \n \n \n Gets the default table endpoint using the specified settings.\n \n The settings.\n The default table endpoint.\n \n \n \n Gets the default table endpoint using the specified protocol and account name.\n \n The protocol to use.\n The name of the storage account.\n The Endpoint DNS suffix; use null for default.\n The default table endpoint.\n \n \n \n Gets or sets a value indicating whether the FISMA MD5 setting will be used.\n \n false to use the FISMA MD5 setting; true to use the .NET default implementation.\n \n \n \n Gets a object that references the development storage account.\n \n A reference to the development storage account.\n \n \n \n Indicates whether this account is a development storage account.\n \n \n \n \n The storage service hostname suffix set by the user, if any.\n \n \n \n \n The connection string parsed into settings.\n \n \n \n \n True if the user used a constructor that auto-generates endpoints.\n \n \n \n \n Gets the primary endpoint for the Blob service, as configured for the storage account.\n \n The primary Blob service endpoint.\n \n \n \n Gets the primary endpoint for the Queue service, as configured for the storage account.\n \n The primary Queue service endpoint.\n \n \n \n Gets the primary endpoint for the Table service, as configured for the storage account.\n \n The primary Table service endpoint.\n \n \n \n Gets the endpoints for the Blob service, as configured for the storage account.\n \n An object of type containing the endpoints for the Blob service.\n \n \n \n Gets the endpoints for the Queue service, as configured for the storage account.\n \n An object of type containing the endpoints for the Queue service.\n \n \n \n Gets the endpoints for the Table service, as configured for the storage account.\n \n An object of type containing the endpoints for the Table service.\n \n \n \n Gets the credentials used to create this object.\n \n The credentials used to create the object.\n \n \n \n Specifies that the method will make one or more requests to the storage service. \n \n \n \n \n An interface that allows clients to provide a buffer manager to a given service client. This interface is patterned after\n the System.ServiceModel.Channels.BufferManager class.\n \n \n \n \n Returns a buffer to the pool.\n \n A reference to the buffer being returned.\n Buffer reference cannot be null.\n Length of buffer does not match the pool's buffer length property.\n \n \n \n Gets a buffer of at least the specified size from the pool.\n \n The size, in bytes, of the requested buffer.\n The value specified for cannot be less than zero.\n A byte array that is the requested size of the buffer.\n \n \n \n Gets the size, in bytes, of the buffers managed by the given pool. Note that the buffer manager must return buffers of the exact size requested by the client.\n \n The size, in bytes, of the buffers managed by the given pool.\n \n \n \n An interface required for continuation token types.\n \n The , , \n and classes implement the interface.\n \n \n \n Gets the location that the token applies to.\n \n The location that the token applies to.\n \n \n \n An interface required for request option types.\n \n The , , and classes implement the interface.\n \n \n \n Gets or sets the retry policy for the request.\n \n The retry policy delegate.\n \n \n \n Gets or sets the location mode of the request.\n \n The location mode of the request.\n \n \n \n Gets or sets the server timeout for the request. \n \n The client and server timeout interval for the request.\n \n \n \n Gets or sets the maximum execution time across all potential retries.\n \n The maximum execution time across all potential retries.\n \n \n \n Specifies what messages to output to the log.\n \n \n \n \n Output no tracing and debugging messages.\n \n \n \n \n Output error-handling messages.\n \n \n \n \n Output warnings and error-handling messages.\n \n \n \n \n Output informational messages, warnings, and error-handling messages.\n \n \n \n \n Output all debugging and tracing messages.\n \n \n \n \n Represents the context for a request operation against the storage service, and provides additional runtime information about its execution.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets or sets additional headers on the request, for example, for proxy or logging information.\n \n A object containing additional header information.\n \n \n \n Gets or sets the client request ID.\n \n The client request ID.\n \n \n \n Gets or sets the default logging level to be used for subsequently created instances of the class.\n \n A value of type that specifies which events are logged by default by instances of the .\n \n \n \n Gets or sets the logging level to be used for an instance of the class.\n \n A value of type that specifies which events are logged by the .\n \n \n \n Occurs immediately before a request is signed.\n \n \n \n \n Occurs when a response is received from the server.\n \n \n \n \n Gets or sets the start time of the operation.\n \n The start time of the operation.\n \n \n \n Gets or sets the end time of the operation.\n \n The end time of the operation.\n \n \n \n Gets or sets the set of request results that the current operation has created.\n \n An object that contains objects that represent the request results created by the current operation.\n \n \n \n Gets the last request result encountered for the operation.\n \n A object that represents the last request result.\n \n \n \n Provides information and event data that is associated with a request event.\n \n \n \n \n Initializes a new instance of the class by using the specified parameter.\n \n The object.\n \n \n \n Gets the request information associated with this event.\n \n The request information associated with this event.\n \n \n \n Gets the HTTP request associated with this event.\n \n The HTTP request associated with this event.\n \n \n \n Gets the HTTP response associated with this event.\n \n The HTTP response associated with this event.\n \n \n \n Represents the result of a physical request.\n \n \n \n \n Translates the specified message into a object.\n \n The message to translate.\n The translated .\n \n \n \n Generates a serializable RequestResult from its XML representation.\n \n The stream from which the RequestResult is deserialized.\n \n \n \n Converts a serializable RequestResult into its XML representation.\n \n The stream to which the RequestResult is serialized.\n \n \n \n Gets or sets the HTTP status code for the request.\n \n The HTTP status code for the request.\n \n \n \n Gets the HTTP status message for the request.\n \n The HTTP status message for the request.\n \n \n \n Gets the service request ID for this request.\n \n The service request ID for this request.\n \n \n \n Gets the content-MD5 value for the request. \n \n The content-MD5 value for the request.\n \n \n \n Gets the ETag value of the request.\n \n The ETag value of the request.\n \n \n \n Gets the request date.\n \n The request date.\n \n \n \n Gets the location that the request was sent to.\n \n The location that the request was sent to.\n \n \n \n Gets the extended error information.\n \n The extended error information.\n \n \n \n Gets or sets the exception.\n \n The exception.\n \n \n \n Gets the start time of the operation.\n \n The start time of the operation.\n \n \n \n Gets the end time of the operation.\n \n The end time of the operation.\n \n \n \n Represents a result segment that was retrieved from the total set of possible results.\n \n The type of the element.\n \n \n \n Stores the continuation token used to retrieve the next segment of results.\n \n \n \n \n Initializes a new instance of the ResultSegment class.\n \n The result.\n \n \n \n Gets an enumerable collection of results.\n \n An enumerable collection of results.\n \n \n \n Gets a continuation token to use to retrieve the next set of results with a subsequent call to the operation.\n \n The continuation token.\n \n \n \n Represents an exception thrown by the Windows Azure storage service.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class using the specified error message.\n \n The message that describes the error.\n \n \n \n Initializes a new instance of the class with a specified error message and a reference to the inner exception that generated this exception.\n \n The exception error message.\n The inner exception.\n \n \n \n Initializes a new instance of the class with serialized data.\n \n The that contains contextual information about the source or destination.\n The object that holds serialized object data for the exception being thrown.\n This constructor is called during de-serialization to reconstitute the exception object transmitted over a stream.\n \n \n \n Populates a object with the data needed to serialize the target object.\n \n The destination context for this serialization.\n The object to populate with data.\n \n \n \n Initializes a new instance of the class by using the specified parameters.\n \n The request result.\n The exception message.\n The inner exception.\n \n \n \n Translates the specified exception into a .\n \n The exception to translate.\n The request result.\n The storage exception.\n An exception of type .\n \n \n \n Translates the specified exception into a storage exception.\n \n The exception to translate.\n The request result.\n The delegate used to parse the error to get extended error information.\n The storage exception.\n \n \n \n Translates the specified exception into a storage exception.\n \n The exception to translate.\n The request result.\n The delegate used to parse the error to get extended error information.\n The error stream that contains the error information.\n The storage exception.\n \n \n \n Tries to translate the specified exception into a storage exception.\n \n The exception to translate.\n The request result.\n The delegate used to parse the error to get extended error information.\n The storage exception or null.\n \n \n \n Translates the specified exception into a storage exception.\n \n The exception to translate.\n The request result.\n The delegate used to parse the error to get extended error information.\n The storage exception.\n \n \n \n Populate the RequestResult.\n \n The request result.\n The web response.\n \n \n \n Represents an exception thrown by the Windows Azure storage client library. \n \n A string that represents the exception.\n \n \n \n Gets the object for this object.\n \n The object for this object.\n \n \n \n Represents extended error information returned by the Windows Azure storage services.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets the error details from stream.\n \n The input stream.\n The error details.\n \n \n \n Gets the error details from the stream using OData library.\n \n The input stream.\n The web response.\n The response Content-Type.\n The error details.\n \n \n \n Gets the error details from the stream using OData library.\n \n The input stream.\n The web response headers.\n The response Content-Type.\n The error details.\n \n \n \n Parses the error details from the stream using OData library.\n \n The IODataResponseMessage to parse.\n The error details.\n \n \n \n Generates a serializable object from its XML representation.\n \n The stream from which the object is deserialized.\n \n \n \n Converts a serializable object into its XML representation.\n \n The stream to which the object is serialized.\n \n \n \n Gets the storage service error code.\n \n The storage service error code.\n \n \n \n Gets the storage service error message.\n \n The storage service error message.\n \n \n \n Gets additional error details.\n \n The additional error details.\n \n \n \n Represents a storage service location.\n \n \n \n \n Primary storage service location.\n \n \n \n \n Secondary storage service location.\n \n \n \n \n Contains the URIs for both the primary and secondary locations of a Windows Azure Storage resource.\n \n \n \n \n Initializes a new instance of the class using the primary endpoint for the storage account.\n \n The URI for the primary endpoint.\n \n \n \n Initializes a new instance of the class using the primary and secondary endpoints for the storage account.\n \n The URI for the primary endpoint.\n The URI for the secondary endpoint.\n \n \n \n Returns the URI for the storage account endpoint at the specified location.\n \n The primary or secondary location for the storage account.\n The of the specified location.\n \n \n \n Returns a that represents this instance.\n \n \n A that represents this instance.\n \n \n \n \n Returns a hash code for this instance.\n \n \n A hash code for this instance, suitable for use in hashing algorithms and data structures like a hash table. \n \n \n \n \n Determines whether the specified is equal to this instance.\n \n The to compare with this instance.\n true if the specified is equal to this instance; otherwise, false.\n \n \n \n Indicates whether the current object is equal to another object of the same type.\n \n An object to compare with this object.\n true if the current object is equal to the parameter; otherwise, false.\n \n \n \n The endpoint for the primary location for the storage account.\n \n \n The URI for the primary endpoint.\n \n \n \n \n The endpoint for the secondary location for the storage account.\n \n \n The URI for the secondary endpoint.\n \n \n \n \n Represents a set of credentials used to authenticate access to a Windows Azure storage account.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class with the specified account name and key value.\n \n A string that represents the name of the storage account.\n A string that represents the Base64-encoded account access key.\n \n \n \n Initializes a new instance of the class with the specified account name and key value.\n \n A string that represents the name of the storage account.\n An array of bytes that represent the account access key.\n \n \n \n Initializes a new instance of the class with the specified account name, key value, and key name.\n \n A string that represents the name of the storage account.\n A string that represents the Base64-encoded account access key.\n A string that represents the name of the key.\n \n \n \n Initializes a new instance of the class with the specified account name, key value, and key name.\n \n A string that represents the name of the storage account.\n An array of bytes that represent the account access key.\n A string that represents the name of the key.\n \n \n \n Initializes a new instance of the class with the specified shared access signature token.\n \n A string representing the shared access signature token.\n \n \n \n Updates the key value for the credentials.\n \n The key value, as a Base64-encoded string, to update.\n \n \n \n Updates the key value for the credentials.\n \n The key value, as an array of bytes, to update.\n \n \n \n Updates the key value and key name for the credentials.\n \n The key value, as a Base64-encoded string, to update.\n The key name to update.\n \n \n \n Updates the key value and key name for the credentials.\n \n The key value, as an array of bytes, to update.\n The key name to update.\n \n \n \n Updates the shared access signature (SAS) token value for storage credentials created with a shared access signature.\n \n A string that specifies the SAS token value to update.\n \n \n \n Returns the account key for the credentials.\n \n An array of bytes that contains the key.\n \n \n \n Transforms a resource URI into a shared access signature URI, by appending a shared access token.\n \n A object that represents the resource URI to be transformed.\n A object that represents the signature, including the resource URI and the shared access token.\n \n \n \n Transforms a resource URI into a shared access signature URI, by appending a shared access token.\n \n A object that represents the resource URI to be transformed.\n A object that represents the signature, including the resource URI and the shared access token.\n \n \n \n Exports the value of the account access key to a Base64-encoded string.\n \n The account access key.\n \n \n \n Determines whether an other object is equal to this one by comparing their SAS tokens, account names, key names, and key values.\n \n The object to compare to this one.\n true if the two objects are equal; otherwise, false.\n \n \n \n Gets the associated shared access signature token for the credentials.\n \n The shared access signature token.\n \n \n \n Gets the associated account name for the credentials.\n \n The account name.\n \n \n \n Gets the associated key name for the credentials.\n \n The key name.\n \n \n \n Gets a value indicating whether the credentials are for anonymous access.\n \n true if the credentials are for anonymous access; otherwise, false.\n \n \n \n Gets a value indicating whether the credentials are a shared access signature token.\n \n true if the credentials are a shared access signature token; otherwise, false.\n \n \n \n Gets a value indicating whether the credentials are a shared key.\n \n true if the credentials are a shared key; otherwise, false.\n \n \n \n Represents a canonicalized string used in authenticating a request against the azure service.\n \n \n \n \n Stores the internal that holds the canonicalized string.\n \n \n \n \n Initializes a new instance of the class.\n \n The first canonicalized element to start the string with.\n \n \n \n Initializes a new instance of the class.\n \n The first canonicalized element to start the string with.\n The starting size of the string.\n \n \n \n Append additional canonicalized element to the string.\n \n An additional canonicalized element to append to the string.\n \n \n \n Converts the value of this instance to a string.\n \n A string whose value is the same as this instance.\n \n \n \n This class provides MemoryStream-like behavior but uses a list of buffers rather than a single buffer.\n \n \n \n \n The default small buffer size.\n \n \n \n \n The size of each buffer.\n \n \n \n \n The underlying buffer blocks for the stream.\n \n \n \n \n The currently used length.\n \n \n \n \n The total capacity of the stream.\n \n \n \n \n The current position.\n \n \n \n \n A reference to the IBufferManager for the stream to use to acquire and return buffers.\n \n \n \n \n Initializes a new instance of the MultiBufferMemoryStream class with provided IBufferManager.\n \n A reference to the IBufferManager for the stream to use to acquire and return buffers. May be null.\n The Buffer size to use for each block, default is 64 KB. Note this parameter is disregarded when a IBufferManager is specified.\n \n \n \n Reads a block of bytes from the current stream and writes the data to a buffer.\n \n When this method returns, the buffer contains the specified byte array with the values between offset and (offset + count - 1) replaced by the bytes read from the current source.\n The zero-based byte offset in buffer at which to begin storing the data read from the current stream.\n The maximum number of bytes to be read.\n The total number of bytes read into the buffer. This can be less than the number of bytes requested if that many bytes are not currently available, or zero if the end of the stream has been reached.\n \n \n \n Begins an asynchronous read operation.\n \n When this method returns, the buffer contains the specified byte array with the values between offset and (offset + count - 1) replaced by the bytes read from the current source.\n The zero-based byte offset in buffer at which to begin storing the data read from the current stream.\n The maximum number of bytes to be read.\n An optional asynchronous callback, to be called when the read is complete.\n A user-provided object that distinguishes this particular asynchronous read request from other requests.\n An IAsyncResult that represents the asynchronous read, which could still be pending.\n \n \n \n Waits for the pending asynchronous read to complete.\n \n The reference to the pending asynchronous request to finish.\n The total number of bytes read into the buffer. This can be less than the number of bytes requested if that many bytes are not currently available, or zero if the end of the stream has been reached.\n \n \n \n Sets the position within the current stream.\n \n A byte offset relative to the origin parameter.\n A value of type System.IO.SeekOrigin indicating the reference point used to obtain the new position.\n The new position within the current stream.\n Thrown if is invalid for SeekOrigin.\n \n \n \n Sets the length of the current stream to the specified value. (pre-allocating the bufferBlocks).\n \n The desired length of the current stream in bytes.\n If the is negative.\n \n \n \n Writes a block of bytes to the current stream using data read from a buffer.\n \n The buffer to write data from.\n The zero-based byte offset in buffer at which to begin copying bytes to the current stream.\n The number of bytes to write. \n \n \n \n Begins an asynchronous write operation.\n \n The buffer to write data from.\n The zero-based byte offset in buffer at which to begin copying bytes to the current stream.\n The number of bytes to write.\n An optional asynchronous callback, to be called when the write is complete.\n A user-provided object that distinguishes this particular asynchronous write request from other requests.\n An IAsyncResult that represents the asynchronous write, which could still be pending.\n \n \n \n Ends an asynchronous write operation.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Does not perform any operation as it's an in-memory stream.\n \n \n \n \n Reads the bytes from the current stream and writes them to another stream. However, this method eliminates copying the data into a temporary buffer by directly writing to the destination stream.\n \n The stream to which the contents of the current stream will be copied.\n DateTime indicating the expiry time.\n \n \n \n Begins an asynchronous fast-copy operation.\n \n The stream to which the contents of the current stream will be copied.\n DateTime indicating the expiry time.\n An optional asynchronous callback, to be called when the copy is complete.\n A user-provided object that distinguishes this particular asynchronous copy request from other requests.\n An IAsyncResult that represents the asynchronous copy, which could still be pending.\n \n \n \n Initiates a write operation for the next buffer in line.\n \n Internal StorageAsyncResult that represents the asynchronous copy.\n \n \n \n Callback method to be called when the corresponding write operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous copy operation.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Computes the hash value for this stream.\n \n String representation of the computed hash value.\n \n \n \n Ensures that the amount of bufferBlocks is greater than or equal to the required size. \n Does not trim the size.\n \n The required size.\n If the is negative.\n \n \n \n Adds another block to the underlying bufferBlocks.\n \n \n \n \n Copies the specified amount of data from internal buffers to the buffer and advances the position.\n \n An array of bytes. When this method returns, the buffer contains the specified byte array with the values \n between offset and (offset + count - 1) replaced by the bytes read from the current source.\n The zero-based byte offset in buffer at which to begin storing the data read from the current stream.\n The maximum number of bytes to be read from the current stream.\n The total number of bytes read into the buffer. This can be less than the number of bytes requested \n if that many bytes are not currently available, or zero (0) if the end of the stream has been reached.\n \n \n \n \n Writes a sequence of bytes to the current stream and advances the current position within this stream by the number of bytes written.\n (Requires the stream to be of sufficient size for writing).\n \n An array of bytes. This method copies count bytes from buffer to the current stream.\n The zero-based byte offset in buffer at which to begin copying bytes to the current stream.\n The number of bytes to be written to the current stream.\n \n \n \n Advances the current position of the stream and adjust the offset and remainder based on the amount completed.\n \n The current offset in the external buffer.\n The amount of data left to process.\n The amount of data processed.\n \n \n \n Advances the current position of the stream and adjust the remainder based on the amount completed.\n \n The amount of data left to process.\n The amount of data processed.\n \n \n \n Calculate the block for the current position.\n \n \n \n \n Gets a value indicating whether the current stream supports reading.\n \n Is true if the stream supports reading; otherwise, false.\n \n \n \n Gets a value indicating whether the current stream supports seeking.\n \n Is true if the stream supports seeking; otherwise, false.\n \n \n \n Gets a value indicating whether the current stream supports writing.\n \n Is true if the stream supports writing; otherwise, false.\n \n \n \n Gets the currently written length.\n \n \n \n \n Represents the current position in the stream.\n \n Thrown if position is outside the stream size\n \n \n \n A NullTaskReturn type.\n \n \n \n \n Represents a no-return from a task.\n \n \n \n \n Prevents a default instance of the class from being created.\n \n \n \n \n Provides a standard set of errors that could be thrown from the client library.\n \n \n \n \n This class provides APM Read/Write overrides for memory stream to improve performance.\n \n \n \n \n Initializes a new instance of the SyncMemoryStream class with an expandable capacity initialized to zero.\n \n \n \n \n Initializes a new non-resizable instance of the SyncMemoryStream class based on the specified byte array. \n \n The array of unsigned bytes from which to create the current stream.\n \n \n \n Initializes a new non-resizable instance of the SyncMemoryStream class based on the specified region (index) of a byte array. \n \n The array of unsigned bytes from which to create the current stream.\n The index into buffer at which the stream begins.\n \n \n \n Initializes a new non-resizable instance of the SyncMemoryStream class based on the specified region (index) of a byte array. \n \n The array of unsigned bytes from which to create the current stream.\n The index into buffer at which the stream begins.\n The length of the stream in bytes.\n \n \n \n Begins an asynchronous read operation.\n \n When this method returns, the buffer contains the specified byte array with the values between offset and (offset + count - 1) replaced by the bytes read from the current source.\n The zero-based byte offset in buffer at which to begin storing the data read from the current stream.\n The maximum number of bytes to be read.\n An optional asynchronous callback, to be called when the read is complete.\n A user-provided object that distinguishes this particular asynchronous read request from other requests.\n An IAsyncResult that represents the asynchronous read, which could still be pending.\n \n \n \n Waits for the pending asynchronous read to complete.\n \n The reference to the pending asynchronous request to finish.\n The total number of bytes read into the buffer. This can be less than the number of bytes requested if that many bytes are not currently available, or zero if the end of the stream has been reached.\n \n \n \n Begins an asynchronous write operation.\n \n The buffer to write data from.\n The zero-based byte offset in buffer at which to begin copying bytes to the current stream.\n The number of bytes to write.\n An optional asynchronous callback, to be called when the write is complete.\n A user-provided object that distinguishes this particular asynchronous write request from other requests.\n An IAsyncResult that represents the asynchronous write, which could still be pending.\n \n \n \n Ends an asynchronous write operation.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n A convenience class for constructing URI query strings.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class that contains elements copied from the specified .\n \n The whose elements are copied to the new .\n \n \n \n Stores the query parameters.\n \n \n \n \n Add the value with URI escaping.\n \n The query name.\n The query value.\n \n \n \n Returns a containing the URI.\n \n \n A containing the URI.\n \n \n \n \n Adds a query parameter to a URI.\n \n The original URI, including any existing query parameters.\n The URI with the new query parameter appended.\n \n \n \n Adds a query parameter to a URI.\n \n The original URI, including any existing query parameters.\n The URI with the new query parameter appended.\n \n \n \n Contains helper methods for implementing shared access signatures.\n \n \n \n \n Get the complete query builder for creating the Shared Access Signature query.\n \n The shared access policy to hash.\n The optional header values to set for a blob returned with this SAS.\n An optional identifier for the policy.\n Either \"b\" for blobs or \"c\" for containers.\n The signature to use.\n The name of the key used to create the signature, or null if the key is implicit.\n The finished query builder.\n \n \n \n Get the complete query builder for creating the Shared Access Signature query.\n \n The shared access policy to hash.\n An optional identifier for the policy.\n The signature to use.\n The name of the key used to create the signature, or null if the key is implicit.\n The finished query builder.\n \n \n \n Get the complete query builder for creating the Shared Access Signature query.\n \n The shared access policy to hash.\n The name of the table associated with this shared access signature.\n An optional identifier for the policy.\n The start partition key, or null.\n The start row key, or null.\n The end partition key, or null.\n The end row key, or null.\n The signature to use.\n The name of the key used to create the signature, or null if the key is implicit.\n The finished query builder.\n \n \n \n Converts the specified value to either a string representation or .\n \n The value to convert.\n A string representing the specified value.\n \n \n \n Converts the specified value to either a string representation or null.\n \n The value to convert.\n A string representing the specified value.\n \n \n \n Escapes and adds the specified name/value pair to the query builder if it is not null.\n \n The builder to add the value to.\n The name of the pair.\n The value to be escaped.\n \n \n \n Parses the query.\n \n The query parameters.\n A boolean that represents whether SignedResource is part of Sas or not. True for blobs, False for Queues and Tables.\n \n \n \n Get the signature hash embedded inside the Shared Access Signature.\n \n The shared access policy to hash.\n An optional identifier for the policy.\n The canonical resource string, unescaped.\n The key value retrieved as an atomic operation used for signing.\n The signed hash.\n \n \n \n Get the signature hash embedded inside the Shared Access Signature.\n \n The shared access policy to hash.\n An optional identifier for the policy.\n The start partition key, or null.\n The start row key, or null.\n The end partition key, or null.\n The end row key, or null.\n The canonical resource string, unescaped.\n The key value retrieved as an atomic operation used for signing.\n The signed hash.\n \n \n \n Get the signature hash embedded inside the Shared Access Signature.\n \n The shared access policy to hash.\n The optional header values to set for a blob returned with this SAS.\n An optional identifier for the policy.\n The canonical resource string, unescaped.\n The key value retrieved as an atomic operation used for signing.\n The signed hash.\n \n \n \n Gets the value of the x-ms-date or Date header.\n \n The request where the value is read from.\n The value of the x-ms-date or Date header.\n \n \n \n Appends the value of the Content-Length header to the specified canonicalized string.\n \n The canonicalized string where the value is appended.\n The request where the value is read from.\n \n \n \n Appends the value of the Date header (or, optionally, the x-ms-date header) to the specified canonicalized string.\n \n The canonicalized string where the value is appended.\n The request where the value is read from.\n true if the value of the x-ms-date header can be used and is preferred; otherwise, false.\n \n \n \n Appends the values of the x-ms-* headers to the specified canonicalized string.\n \n The canonicalized string where the values are appended.\n The request where the values are read from.\n \n \n \n Gets the canonicalized header value to use for the specified date/time or null if it does not have a value.\n \n The date/time.\n The canonicalized header value to use for the specified date/time or null if it does not have a value.\n \n \n \n In case of path style, this method will strip off -secondary from absolute path and replace it with account name.\n \n The resource URI.\n The name of the storage account.\n Absolute path with no -secondary suffix.\n \n \n \n Gets the canonicalized resource string for the specified URI.\n \n The resource URI.\n The name of the storage account.\n true when using the Shared Key Lite authentication scheme or the table service; otherwise, false.\n The canonicalized resource string.\n \n \n \n Determines which location can the listing command target by looking at the\n continuation token.\n \n Continuation token\n Location mode\n \n \n \n Create an ExecutionState object that can be used for pre-request operations\n such as buffering user's data.\n \n Request options\n Temporary ExecutionState object\n \n \n \n Returns the larger of two time spans.\n \n The first of two time spans to compare.\n The second of two time spans to compare.\n Parameter or , whichever is larger.\n \n \n \n Gets the first header value or null if no header values exist.\n \n The type of header objects contained in the enumerable.\n An enumerable that contains header values.\n The first header value or null if no header values exist.\n \n \n \n Throws an exception if the string is empty or null.\n \n The name of the parameter.\n The value of the parameter.\n Thrown if value is empty.\n Thrown if value is null.\n \n \n \n Throw an exception if the value is null.\n \n The name of the parameter.\n The value of the parameter.\n Thrown if value is null.\n \n \n \n Throw an exception indicating argument is out of range.\n \n The name of the parameter.\n The value of the parameter.\n \n \n \n Throw an exception if the argument is out of bounds.\n \n The type of the value.\n The name of the parameter.\n The value of the parameter.\n The minimum value for the parameter.\n The maximum value for the parameter.\n \n \n \n Throw an exception if the argument is out of bounds.\n \n The type of the value.\n The name of the parameter.\n The value of the parameter.\n The minimum value for the parameter.\n \n \n \n Checks that the given timeout in within allowed bounds.\n \n The timeout to check.\n The timeout is not within allowed bounds.\n \n \n \n Combines AssertNotNullOrEmpty and AssertInBounds for convenience.\n \n The name of the parameter.\n Turns on or off null/empty checking.\n The value of the parameter.\n The maximum size of value.\n \n \n \n Rounds up to seconds.\n \n The time span.\n The time rounded to seconds.\n \n \n \n List of ports used for path style addressing.\n \n \n \n \n Determines if a URI requires path style addressing.\n \n The URI to check.\n Returns true if the Uri uses path style addressing; otherwise, false.\n \n \n \n Read the value of an element in the XML.\n \n The name of the element whose value is retrieved.\n A reader that provides access to XML data.\n A string representation of the element's value.\n \n \n \n Returns an enumerable collection of results that is retrieved lazily.\n \n The type of ResultSegment like Blob, Container, Queue and Table.\n The segment generator.\n >A non-negative integer value that indicates the maximum number of results to be returned \n in the result segment, up to the per-operation limit of 5000.\n \n \n \n \n Applies the request optimizations such as disabling buffering and 100 continue.\n \n The request to be modified.\n The length of the content, -1 if the content length is not settable.\n \n \n \n Increments the counter by one and thus sets the state of the event to non-signaled, causing threads to block.\n \n \n \n \n Decrements the counter by one. If the counter reaches zero, sets the state of the event to signaled, allowing one or more waiting threads to proceed.\n \n \n \n \n Blocks the current thread until the CounterEvent is set.\n \n \n \n \n Blocks the current thread until the CounterEvent is set, using a 32-bit signed integer to measure the timeout.\n \n The number of milliseconds to wait, or Infinite(-1) to wait indefinitely.\n true if the CounterEvent was set; otherwise, false.\n \n \n \n Releases all resources used by the current instance of the CounterEvent class.\n \n \n \n \n Gets a WaitHandle that is used to wait for the event to be set.\n \n A WaitHandle that is used to wait for the event to be set.\n \n \n \n Provides helper functions for http request/response processing. \n \n \n \n \n Parse the http query string.\n \n Http query string.\n \n \n \n \n Converts the DateTimeOffset object to an Http string of form: Sun, 28 Jan 2008 12:11:37 GMT.\n \n The DateTimeOffset object to convert to an Http string.\n String of form: Sun, 28 Jan 2008 12:11:37 GMT.\n \n \n \n Try to get the value of the specified header name.\n \n The Http web response from which to get the header value.\n The name of the header whose value is to be retrieved.\n The default value for the header that is returned if we can't get the actual header value.\n A string representing the header value.\n \n \n \n Wrapper class for MD5.\n \n \n \n \n Calculates an on-going hash using the input byte array.\n \n The input array used for calculating the hash.\n The offset in the input buffer to calculate from.\n The number of bytes to use from input.\n \n \n \n Retrieves the string representation of the hash. (Completes the creation of the hash).\n \n String representation of the computed hash value.\n \n \n \n Contains methods for dealing with navigation.\n \n \n \n \n The name of the root container.\n \n \n \n \n Used in address parsing.\n \n \n \n \n Used in address parsing.\n \n \n \n \n Used in address parsing.\n \n \n \n \n Used to split string on slash.\n \n \n \n \n Used to split hostname.\n \n \n \n \n Retrieves the container part of a storage Uri, or \"$root\" if the container is implicit.\n \n The blob address.\n If set to true use path style Uris.\n Name of the container.\n \n The trailing slash is always removed.\n \n GetContainerName(new Uri(\"http://test.blob.core.windows.net/mycontainer/myfolder/myblob\")) will return \"mycontainer\"\n GetContainerName(new Uri(\"http://test.blob.core.windows.net/mycontainer/\")) will return \"mycontainer\"\n GetContainerName(new Uri(\"http://test.blob.core.windows.net/myblob\")) will return \"$root\"\n GetContainerName(new Uri(\"http://test.blob.core.windows.net/\")) will throw ArgumentException\n \n \n \n \n \n Retrieves the blob part of a storage Uri.\n \n The blob address.\n If set to true use path style Uris.\n The name of the blob.\n \n \n \n Retrieves the complete container address from a storage Uri\n Example GetContainerAddress(new Uri(\"http://test.blob.core.windows.net/mycontainer/myfolder/myblob\"))\n will return http://test.blob.core.windows.net/mycontainer.\n \n The blob address.\n True to use path style Uris.\n Uri of the container.\n \n \n \n Retrieves the parent name from a storage Uri.\n \n The blob address.\n The delimiter.\n If set to true use path style Uris.\n The name of the parent.\n \n Adds the trailing delimiter as the prefix returned by the storage REST api always contains the delimiter.\n \n \n GetParentName(new Uri(\"http://test.blob.core.windows.net/mycontainer/myfolder/myblob\", \"/\")) will return \"/mycontainer/myfolder/\"\n GetParentName(new Uri(\"http://test.blob.core.windows.net/mycontainer/myfolder|myblob\", \"|\") will return \"/mycontainer/myfolder|\"\n GetParentName(new Uri(\"http://test.blob.core.windows.net/mycontainer/myblob\", \"/\") will return \"/mycontainer/\"\n GetParentName(new Uri(\"http://test.blob.core.windows.net/mycontainer/\", \"/\") will return \"/mycontainer/\"\n \n \n \n \n Gets the service client base address.\n \n The address Uri.\n The use path style Uris.\n The base address of the client.\n \n GetServiceClientBaseAddress(\"http://testaccount.blob.core.windows.net/testcontainer/blob1\") \n returns \"http://testaccount.blob.core.windows.net\"\n \n \n \n \n Gets the service client base address.\n \n The address Uri.\n The use path style Uris.\n The base address of the client.\n \n GetServiceClientBaseAddress(\"http://testaccount.blob.core.windows.net/testcontainer/blob1\") \n returns \"http://testaccount.blob.core.windows.net\"\n \n \n \n \n Appends a path to a list of URIs correctly using \"/\" as separator.\n \n The base URI.\n The relative or absolute URI.\n The list of appended URIs.\n \n \n \n Appends a path to a list of URIs correctly using \"/\" as separator.\n \n The base URI.\n The relative or absolute URI.\n The separator.\n The list of appended URIs.\n \n \n \n Append a relative path to a URI, handling trailing slashes appropriately.\n \n The base URI.\n The relative or absolute URI.\n The appended Uri.\n \n \n \n Append a relative path to a URI, handling trailing slashes appropriately.\n \n The base URI.\n The relative or absolute URI.\n The separator.\n The appended Uri.\n \n \n \n Get container name from address for styles of paths\n Example: http://test.blob.core.windows.net/container/blob => container\n http://127.0.0.1:10000/test/container/blob => container.\n \n The container Uri.\n If set to true use path style Uris.\n The container name.\n \n \n \n Similar to getting container name from Uri.\n \n The queue Uri.\n If set to true use path style Uris.\n The queue name.\n \n \n \n Extracts a table name from the table's Uri.\n \n The queue Uri.\n If set to true use path style Uris.\n The queue name.\n \n \n \n Retrieve the container address and address.\n \n The blob address.\n True to use path style Uris.\n Name of the container.\n The container URI.\n true when the container is an explicit container. false, otherwise. \n \n \n \n Retrieve the container name and the blob name from a blob address.\n \n The blob address.\n If set to true use path style Uris.\n The resulting container name.\n The resulting blob name.\n A bool representing whether the blob is in an explicit container or not.\n \n \n \n Parses the snapshot time.\n \n The snapshot time.\n The parsed snapshot time.\n \n \n \n Parse Uri for SAS (Shared access signature) information.\n \n The complete Uri.\n The credentials to use.\n The parsed snapshot.\n The blob URI without credentials or snapshot info\n address\n \n Validate that no other query parameters are passed in.\n Any SAS information will be recorded as corresponding credentials instance.\n If credentials is passed in and it does not match the SAS information found, an\n exception will be thrown.\n Otherwise a new client is created based on SAS information or as anonymous credentials.\n \n \n \n \n Parse Uri for SAS (Shared access signature) information.\n \n The complete Uri.\n The credentials to use.\n The parsed snapshot.\n The blob URI without credentials or snapshot info\n address\n \n Validate that no other query parameters are passed in.\n Any SAS information will be recorded as corresponding credentials instance.\n If credentials is passed in and it does not match the SAS information found, an\n exception will be thrown.\n Otherwise a new client is created based on SAS information or as anonymous credentials.\n \n \n \n \n Parse Uri for SAS (Shared access signature) information.\n \n The complete Uri.\n The credentials to use.\n \n Validate that no other query parameters are passed in.\n Any SAS information will be recorded as corresponding credentials instance.\n If credentials is passed in and it does not match the SAS information found, an\n exception will be thrown.\n Otherwise a new client is created based on SAS information or as anonymous credentials.\n \n \n \n \n Parse Uri for SAS (Shared access signature) information.\n \n The complete Uri.\n The credentials to use.\n \n Validate that no other query parameters are passed in.\n Any SAS information will be recorded as corresponding credentials instance.\n If credentials is passed in and it does not match the SAS information found, an\n exception will be thrown.\n Otherwise a new client is created based on SAS information or as anonymous credentials.\n \n \n \n \n Represents a canonicalized string used in authenticating a request against the azure service.\n \n \n \n \n Provides properties to keep track of Md5 hash / Length of a stream as it is being copied.\n \n \n \n \n Provides stream helper methods that allow us to copy streams and measure the stream size.\n \n \n \n \n Reads synchronously the specified content of the stream and writes it to the given output stream.\n \n The origin stream.\n The destination stream. \n Number of bytes to copy from source stream to destination stream. Cannot be passed with a value for maxLength.\n Maximum length of the stream to write. \n true to calculate the MD5 hash.\n A boolean indicating whether the write happens synchronously.\n An object that stores state of the operation.\n State of the stream copy.\n stream\n \n \n \n Asynchronously reads the entire content of the stream and writes it to the given output stream.\n \n The result type of the ExecutionState\n The origin stream.\n The destination stream.\n Number of bytes to copy from source stream to destination stream. Cannot be passed with a value for maxLength.\n Maximum length of the source stream. Cannot be passed with a value for copyLength.\n Bool value indicating whether the Md5 should be calculated.\n An object that stores state of the operation.\n State of the stream copy.\n The action taken when the execution is completed.\n \n \n \n Represents a retry policy that performs a specified number of retries, using a randomized exponential back off scheme to determine the interval between retries. \n \n \n \n \n Represents a retry policy.\n \n \n \n \n Represents a retry policy.\n \n \n \n \n Generates a new retry policy for the current request attempt.\n \n An object that represents the retry policy for the current request attempt. \n \n \n \n Determines whether the operation should be retried and the interval until the next retry.\n \n The number of retries for the given operation. A value of zero signifies this is the first error encountered.\n The status code for the last operation.\n An object that represents the last exception encountered.\n The interval to wait until the next retry.\n An object for tracking the current operation.\n true if the operation should be retried; otherwise, false.\n \n \n \n Determines whether the operation should be retried and the interval until the next retry.\n \n A object that indicates the number of retries, the results of the last request, and whether the next retry should happen in the primary or secondary location, and specifies the location mode.\n An object for tracking the current operation.\n A object that indicates the location mode, and whether the next retry should happen in the primary or secondary location. If null, the operation will not be retried.\n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class using the specified delta and maximum number of retries.\n \n The back off interval between retries.\n The maximum number of retry attempts.\n \n \n \n Determines whether the operation should be retried and the interval until the next retry.\n \n The number of retries for the given operation. A value of zero signifies this is the first error encountered.\n The status code for the last operation.\n An object that represents the last exception encountered.\n The interval to wait until the next retry.\n An object for tracking the current operation.\n true if the operation should be retried; otherwise, false.\n \n \n \n Determines whether the operation should be retried and the interval until the next retry.\n \n A object that indicates the number of retries, the results of the last request, and whether the next retry should happen in the primary or secondary location, and specifies the location mode.\n An object for tracking the current operation.\n A object that indicates the location mode, and whether the next retry should happen in the primary or secondary location. If null, the operation will not be retried.\n \n \n \n Generates a new retry policy for the current request attempt.\n \n An object that represents the retry policy for the current request attempt.\n \n \n \n Represents a retry policy that performs a specified number of retries, using a specified fixed time interval between retries.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class using the specified delta and maximum number of retries.\n \n The back off interval between retries.\n The maximum number of retry attempts.\n \n \n \n Determines whether the operation should be retried and the interval until the next retry.\n \n The number of retries for the given operation. A value of zero signifies this is the first error encountered.\n The status code for the last operation.\n An object that represents the last exception encountered.\n The interval to wait until the next retry.\n An object for tracking the current operation.\n true if the operation should be retried; otherwise, false.\n \n \n \n Determines whether the operation should be retried and the interval until the next retry.\n \n A object that indicates the number of retries, the results of the last request, and whether the next retry should happen in the primary or secondary location, and specifies the location mode.\n An object for tracking the current operation.\n A object that indicates the location mode, and whether the next retry should happen in the primary or secondary location. If null, the operation will not be retried.\n \n \n \n Generates a new retry policy for the current request attempt.\n \n An object that represents the retry policy for the current request attempt. \n \n \n \n Specifies the location mode used to decide which location the request should be sent to.\n \n \n \n \n Requests should always be sent to the primary location.\n \n \n \n \n Requests should always be sent to the primary location first. If the request fails, it should be sent to the secondary location.\n \n \n \n \n Requests should always be sent to the secondary location.\n \n \n \n \n Requests should always be sent to the secondary location first. If the request fails, it should be sent to the primary location.\n \n \n \n \n Represents a retry policy that performs no retries.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Determines if the operation should be retried and how long to wait until the next retry. \n \n The number of retries for the given operation. A value of zero signifies this is the first error encountered.\n The status code for the last operation.\n An object that represents the last exception encountered.\n The interval to wait until the next retry.\n An object for tracking the current operation.\n true if the operation should be retried; otherwise, false.\n \n \n \n Generates a new retry policy for the current request attempt.\n \n An object that represents the retry policy for the current request attempt.\n \n \n \n Represents the context for one or more retries of a request made against the Windows Azure storage services,\n including the number of retries made for the request, the results of the last request, and the storage location and location mode for subsequent retries.\n \n \n \n \n Returns a string that represents the current instance.\n \n A string that represents the current instance.\n \n \n \n Gets the target location for the next retry.\n \n The target location for the next retry.\n \n \n \n Gets the location mode for subsequent retries.\n \n The location mode for subsequent retries.\n \n \n \n Gets the number of retries for the given operation.\n \n The number of retries for the given operation.\n \n \n \n Gets the results of the last request.\n \n A object that represents the results of the last request.\n \n \n \n Specifies parameters for the next retry of a request to be made against the Windows Azure storage services,\n including the target location and location mode for the next retry and the interval until the next retry.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class.\n \n The object that was passed in to the retry policy.\n \n \n \n Returns a string that represents the current instance.\n \n A string that represents the current instance.\n \n \n \n Gets or sets the target location for the next retry.\n \n The target location for the next retry.\n \n \n \n Gets or sets the location mode for subsequent retries.\n \n The location mode for subsequent retries.\n \n \n \n Gets the interval until the next retry.\n \n The interval until the next retry.\n \n \n \n Verifies that the blob is not a snapshot.\n \n \n \n \n Gets the blob's system properties.\n \n The blob's properties.\n \n \n \n Gets the user-defined metadata for the blob.\n \n The blob's metadata, as a collection of name-value pairs.\n \n \n \n Gets the blob's URI for the primary location.\n \n The absolute URI to the blob, at the primary location.\n \n \n \n Gets the list of URIs for all locations.\n \n The list of URIs for all locations.\n \n \n \n Gets the date and time that the blob snapshot was taken, if this blob is a snapshot.\n \n The blob's snapshot time if the blob is a snapshot; otherwise, null.\n \n If the blob is not a snapshot, the value of this property is null.\n \n \n \n \n Gets the state of the most recent or pending copy operation.\n \n A object containing the copy state, or null if no copy blob state exists for this blob.\n \n \n \n Represents the permissions for a container.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets or sets the public access setting for the container.\n \n The public access setting for the container.\n \n \n \n Gets the set of shared access policies for the container.\n \n The set of shared access policies for the container.\n \n \n \n Represents the system properties for a container.\n \n \n \n \n Gets the ETag value for the container.\n \n The container's quoted ETag value.\n \n \n \n Gets the container's last-modified time.\n \n The container's last-modified time.\n \n \n \n Gets the container's lease status.\n \n A object that indicates the container's lease status.\n \n \n \n Gets the container's lease state.\n \n A object that indicates the container's lease state.\n \n \n \n Gets the container's lease duration.\n \n A object that indicates the container's lease duration.\n \n \n \n Specifies the level of public access that is allowed on the container.\n \n \n \n \n No public access. Only the account owner can read resources in this container.\n \n \n \n \n Container-level public access. Anonymous clients can read container and blob data.\n \n \n \n \n Blob-level public access. Anonymous clients can read blob data within this container, but not container data.\n \n \n \n \n Represents a continuation token for listing operations. \n \n continuation tokens are used in methods that return a object, such as .\n \n \n \n Gets an XML representation of an object.\n \n \n An that describes the XML representation of the object that is produced by the method and consumed by the method.\n \n \n \n \n Generates a serializable continuation token from its XML representation.\n \n The stream from which the continuation token is deserialized.\n \n \n \n Converts a serializable continuation token into its XML representation.\n \n The stream to which the continuation token is serialized.\n \n \n \n Gets or sets the version for continuing results for enumeration operations.\n \n The version.\n \n \n \n Gets or sets the type element (blob, queue, table) for continuing results for enumeration operations.\n \n The type element.\n \n \n \n Gets or sets the next marker for continuing results for enumeration operations.\n \n The next marker.\n \n \n \n Gets or sets the storage location that the continuation token applies to.\n \n The storage location that the continuation token applies to.\n \n \n \n Specifies which items to include when listing a set of blobs.\n \n \n \n \n List only committed blobs, and do not return blob metadata.\n \n \n \n \n List committed blobs and blob snapshots.\n \n \n \n \n Retrieve blob metadata for each blob returned in the listing.\n \n \n \n \n List committed and uncommitted blobs.\n \n \n \n \n Include copy properties in the listing.\n \n \n \n \n List all available committed blobs, uncommitted blobs, and snapshots, and return all metadata and copy status for those blobs.\n \n \n \n \n Represents the system properties for a blob.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class based on an existing instance.\n \n The set of properties to clone.\n Lease-related properties will not be cloned, because a lease associated with the base blob is not copied to the snapshot.\n \n \n \n Gets or sets the cache-control value stored for the blob.\n \n The blob's cache-control value.\n \n \n \n Gets or sets the content-disposition value stored for the blob.\n \n The blob's content-disposition value.\n \n If this property has not been set for the blob, it returns null.\n \n \n \n \n Gets or sets the content-encoding value stored for the blob.\n \n The blob's content-encoding value.\n \n If this property has not been set for the blob, it returns null.\n \n \n \n \n Gets or sets the content-language value stored for the blob.\n \n The blob's content-language value.\n \n If this property has not been set for the blob, it returns null.\n \n \n \n \n Gets the size of the blob, in bytes.\n \n The blob's size in bytes.\n \n \n \n Gets or sets the content-MD5 value stored for the blob.\n \n The blob's content-MD5 hash.\n \n \n \n Gets or sets the content-type value stored for the blob.\n \n The blob's content-type value.\n \n If this property has not been set for the blob, it returns null.\n \n \n \n \n Gets the blob's ETag value.\n \n The blob's ETag value.\n \n \n \n Gets the the last-modified time for the blob, expressed as a UTC value.\n \n The blob's last-modified time, in UTC format.\n \n \n \n Gets the type of the blob.\n \n A object that indicates the type of the blob.\n \n \n \n Gets the blob's lease status.\n \n A object that indicates the blob's lease status.\n \n \n \n Gets the blob's lease state.\n \n A object that indicates the blob's lease state.\n \n \n \n Gets the blob's lease duration.\n \n A object that indicates the blob's lease duration.\n \n \n \n If the blob is a page blob, gets the blob's current sequence number.\n \n The blob's current sequence number.\n \n \n \n Represents a set of timeout and retry policy options that may be specified for a request against the Blob service.\n \n \n \n \n Stores the parallelism factor.\n \n \n \n \n Default is 32 MB.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Clones an instance of BlobRequestOptions so that we can apply defaults.\n \n BlobRequestOptions instance to be cloned.\n \n \n \n Gets or sets the absolute expiry time across all potential retries for the request. \n \n \n \n \n Gets or sets the retry policy.\n \n The retry policy.\n \n \n \n Gets or sets the location mode of the request.\n \n The location mode of the request.\n \n \n \n Gets or sets the server timeout interval for the request.\n \n The server timeout interval for the request.\n \n \n \n Gets or sets the maximum execution time across all potential retries for the request. \n \n A representing the maximum execution time for retries for the request.\n \n \n \n Gets or sets the number of blocks that may be simultaneously uploaded when uploading a blob that is greater than \n the value specified by the property in size.\n \n The number of parallel operations that may proceed.\n \n \n \n Gets or sets the maximum size of a blob in bytes that may be uploaded as a single blob. \n \n The maximum size of a blob, in bytes, that may be uploaded as a single blob,\n ranging from between 1 and 64 MB inclusive.\n \n \n \n Gets or sets a value to calculate and send/validate content MD5 for transactions.\n \n Use true to calculate and send/validate content MD5 for transactions; otherwise, false. \n \n \n \n Gets or sets a value to indicate that an MD5 hash will be calculated and stored when uploading a blob.\n \n Use true to calculate and store an MD5 hash when uploading a blob; otherwise, false.\n \n \n \n Gets or sets a value to indicate that MD5 validation will be disabled when downloading blobs.\n \n Use true to disable MD5 validation; false to enable MD5 validation.\n \n \n \n Represents a segment of results, with continuation information for pagination scenarios.\n \n \n \n \n Gets an enumerable collection of results.\n \n An enumerable collection of results.\n \n \n \n Gets the continuation token used to retrieve the next segment of results. Returns null if there are no more results.\n \n The continuation token.\n \n \n \n The type of a blob.\n \n \n \n \n Not specified.\n \n \n \n \n A page blob.\n \n \n \n \n A block blob.\n \n \n \n \n Indicates whether to list only committed blocks, only uncommitted blocks, or all blocks.\n \n \n \n \n Committed blocks.\n \n \n \n \n Uncommitted blocks.\n \n \n \n \n Both committed and uncommitted blocks.\n \n \n \n \n Indicates which block lists should be searched to find a specified block. \n \n \n \n \n Search the committed block list only.\n \n \n \n \n Search the uncommitted block list only.\n \n \n \n \n Search the uncommitted block list first, and if the block is not found there, search \n the committed block list.\n \n \n \n \n Specifies which details to include when listing the containers in this storage account.\n \n \n \n \n No additional details.\n \n \n \n \n Retrieve container metadata.\n \n \n \n \n Retrieve all available details.\n \n \n \n \n Represents a segment of results and contains continuation and pagination information.\n \n \n \n \n Gets an enumerable collection of results.\n \n An enumerable collection of results.\n \n \n \n Gets the continuation token used to retrieve the next segment of results.\n \n The continuation token.\n \n \n \n Represents the attributes of a copy operation.\n \n \n \n \n Gets the ID of the copy operation.\n \n A copy ID string.\n \n \n \n Gets the time the copy operation completed, and indicates whether completion was due to a successful copy, the cancelling of the operation, or a failure.\n \n A containing the completion time, or null if the operation has not completed.\n \n \n \n Gets the status of the copy operation.\n \n A enumeration indicating the status of the operation.\n \n \n \n Gets the source URI of a copy operation.\n \n A indicating the source of a copy operation, or null.\n \n \n \n Gets the number of bytes copied in the operation so far.\n \n The number of bytes copied in the operation so far, or null.\n \n \n \n Gets the total number of bytes in the source of the copy.\n \n The number of bytes in the source, or null.\n \n \n \n Gets the description of the current status, if any.\n \n A status description string, or null.\n \n \n \n Represents the status of a copy blob operation.\n \n \n \n \n The copy status is invalid.\n \n \n \n \n The copy operation is pending.\n \n \n \n \n The copy operation succeeded.\n \n \n \n \n The copy operation has been aborted.\n \n \n \n \n The copy operation encountered an error.\n \n \n \n \n The set of options describing delete operation.\n \n \n \n \n Delete blobs but not snapshots.\n \n \n \n \n Delete the blob and its snapshots.\n \n \n \n \n Delete the blob's snapshots only.\n \n \n \n \n Describes actions that can be performed on a lease.\n \n \n \n \n Acquire the lease.\n \n \n \n \n Renew the lease.\n \n \n \n \n Release the lease.\n \n \n \n \n Break the lease.\n \n \n \n \n Change the lease ID.\n \n \n \n \n The lease duration of a resource.\n \n \n \n \n The lease duration is not specified.\n \n \n \n \n The lease duration is finite.\n \n \n \n \n The lease duration is infinite.\n \n \n \n \n The lease state of a resource.\n \n \n \n \n The lease state is not specified.\n \n \n \n \n The lease is in the Available state.\n \n \n \n \n The lease is in the Leased state.\n \n \n \n \n The lease is in the Expired state.\n \n \n \n \n The lease is in the Breaking state.\n \n \n \n \n The lease is in the Broken state.\n \n \n \n \n The lease status of a resource.\n \n \n \n \n The lease status is not specified.\n \n \n \n \n The resource is locked.\n \n \n \n \n The resource is available to be locked.\n \n \n \n \n Represents a block retrieved from the blob's block list.\n \n \n \n \n Gets the name of the block.\n \n The block name.\n \n \n \n Gets the size of block in bytes.\n \n The block size.\n \n \n \n Gets a value indicating whether or not the block has been committed.\n \n True if the block has been committed; otherwise, false.\n \n \n \n Represents a range of pages in a page blob.\n \n \n \n \n Initializes a new instance of the class.\n \n The starting offset.\n The ending offset.\n \n \n \n Returns the content of the page range as a string.\n \n The content of the page range.\n \n \n \n Gets the starting offset of the page range.\n \n The starting offset.\n \n \n \n Gets the ending offset of the page range.\n \n The ending offset.\n \n \n \n Describes actions that can be performed on a page blob sequence number.\n \n \n \n \n Sets the sequence number to be the higher of the value included with the request and the value currently stored for the blob.\n \n \n \n \n Sets the sequence number to the value included with the request.\n \n \n \n \n Increments the value of the sequence number by 1.\n \n \n \n \n Represents the optional headers that can be returned with blobs accessed using SAS.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class based on an existing instance.\n \n The set of to clone.\n \n \n \n Gets or sets the cache-control header returned with the blob.\n \n The cache-control value.\n \n \n \n Gets or sets the content-disposition header returned with the blob.\n \n The content-disposition value.\n \n \n \n Gets or sets the content-encoding header returned with the blob.\n \n The content-encoding value.\n \n \n \n Gets or sets the content-language header returned with the blob.\n \n The content-language value.\n \n \n \n Gets or sets the content-type header returned with the blob.\n \n The content-type value.\n \n \n \n Specifies the set of possible permissions for a shared access policy.\n \n \n \n \n No shared access granted.\n \n \n \n \n Read access granted.\n \n \n \n \n Write access granted.\n \n \n \n \n Delete access granted for blobs.\n \n \n \n \n List access granted.\n \n \n \n \n Represents the collection of shared access policies defined for a container.\n \n \n \n \n Adds the specified key and value to the collection of shared access policies.\n \n The key of the value to add.\n The value to add the collection of shared access policies.\n \n \n \n Determines whether the collection of shared access policies contains the specified key.\n \n The key to locate in the collection of shared access policies.\n true if the collection of shared access policies contains an element with the specified key; otherwise, false.\n \n \n \n Removes the value with the specified key from the shared access policies collection.\n \n The key of the item to remove.\n true if the element is successfully found and removed; otherwise, false. This method returns false if the key is not found.\n \n \n \n Gets the item associated with the specified key. \n \n The key of the value to get.\n The item to get.\n The item associated with the specified key, if the key is found; otherwise, the default value for the type.\n \n \n \n Adds the specified key/ value, stored in a , to the collection of shared access policies.\n \n The object, containing a key/ value pair, to add to the shared access policies collection.\n \n \n \n Removes all keys and values from the shared access collection.\n \n \n \n \n Determines whether the collection of shared access policies contains the key and value in the specified object.\n \n A object containing the key and value to search for.\n true if the shared access policies collection contains the specified key/value; otherwise, false.\n \n \n \n Copies each key/ value pair in the shared access policies collection to a compatible one-dimensional array, starting at the specified index of the target array.\n \n The one-dimensional array of objects that is the destination of the elements copied from the shared access policies collection.\n The zero-based index in at which copying begins.\n \n \n \n Removes the value, specified in the object, from the shared access policies collection.\n \n The object, containing a key and value, to remove from the shared access policies collection.\n true if the item was successfully removed; otherwise, false.\n \n \n \n Returns an enumerator that iterates through the collection of shared access policies.\n \n An of type .\n \n \n \n Returns an enumerator that iterates through the collection of shared access policies.\n \n An object that can be used to iterate through the collection of shared access policies.\n \n \n \n Gets a collection containing the keys in the shared access policies collection.\n \n A collection containing the keys in the of shared access policies collection.\n \n \n \n Gets a collection containing the values in the shared access policies collection.\n \n A collection of items in the shared access policies collection.\n \n \n \n Gets or sets the item associated with the specified key.\n \n The key of the value to get or set.\n The item associated with the specified key, or null if key is not in the shared access policies collection.\n \n \n \n Gets the number of key/ value pairs contained in the shared access policies collection.\n \n The number of key/ value pairs contained in the shared access policies collection.\n \n \n \n Gets a value indicating whether the collection of shared access policies is read-only. \n \n true if the collection of shared access policies is read-only; otherwise, false.\n \n \n \n Represents a shared access policy, which specifies the start time, expiry time, \n and permissions for a shared access signature.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Converts the permissions specified for the shared access policy to a string.\n \n The shared access permissions.\n The shared access permissions in string format.\n \n \n \n Constructs a object from a permissions string.\n \n The shared access permissions in string format.\n A set of shared access permissions.\n \n \n \n Gets or sets the start time for a shared access signature associated with this shared access policy.\n \n The shared access start time.\n \n \n \n Gets or sets the expiry time for a shared access signature associated with this shared access policy.\n \n The shared access expiry time.\n \n \n \n Gets or sets the permissions for a shared access signature associated with this shared access policy.\n \n The permissions.\n \n \n \n Parses the response XML from an operation to set the access policy for a container.\n \n \n \n \n Parses the response XML from an operation to set the access policy for a cloud object.\n \n The policy type to be filled.\n \n \n \n Provides a base class that is used internally to parse XML streams from storage service operations.\n \n The type to be parsed.\n \n \n \n Indicates that all parsable objects have been consumed. This field is reserved and should not be used.\n \n \n \n \n Stores any objects that have not yet been parsed. This field is reserved and should not be used.\n \n \n \n \n The reader used for parsing. This field is reserved and should not be used.\n \n \n \n \n The IEnumerator over the parsed content.\n \n \n \n \n Used to make sure that parsing is only done once, since a stream is not re-entrant.\n \n \n \n \n Initializes a new instance of the ResponseParsingBase class.\n \n The stream to be parsed.\n \n \n \n Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources. \n \n \n \n \n Parses the XML response. This method is reserved and should not be used.\n \n A collection of enumerable objects.\n \n \n \n Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources, and optional\n managed resources.\n \n True to release both managed and unmanaged resources; otherwise, false.\n \n \n \n This method is reserved and should not be used.\n \n True when the object is consumable.\n \n \n \n Parses the XML and close.\n \n A list of parsed results.\n \n \n \n Gets the parsable objects. This method is reserved and should not be used.\n \n The objects to parse.\n \n \n \n Initializes a new instance of the AccessPolicyResponseBase class.\n \n The stream to be parsed.\n \n \n \n Parses the current element.\n \n The shared access policy element to parse.\n The shared access policy.\n \n \n \n Parses the response XML from a Set Container ACL operation to retrieve container-level access policy data.\n \n A list of enumerable key-value pairs.\n \n \n \n Gets an enumerable collection of container-level access policy identifiers.\n \n An enumerable collection of container-level access policy identifiers.\n \n \n \n Initializes a new instance of the BlobAccessPolicyResponse class.\n \n The stream to be parsed.\n \n \n \n Parses the current element.\n \n The shared access policy element to parse.\n The shared access policy.\n \n \n \n Represents a container item returned in the XML response for a container listing operation.\n \n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets the user-defined metadata for the container.\n \n The container's metadata, as a collection of name-value pairs.\n \n \n \n Gets the container's system properties.\n \n The container's properties.\n \n \n \n Gets the name of the container.\n \n The container's name.\n \n \n \n Gets the container's URI.\n \n The absolute URI to the container.\n \n \n \n Provides error code strings that are specific to the Blob service.\n \n \n \n \n Error code that may be returned when a block ID is invalid.\n \n \n \n \n Error code that may be returned when a blob with the specified address cannot be found.\n \n \n \n \n Error code that may be returned when a client attempts to create a blob that already exists.\n \n \n \n \n Error code that may be returned when the specified block or blob is invalid.\n \n \n \n \n Error code that may be returned when a block list is invalid.\n \n \n \n \n The specified container was not found.\n \n \n \n \n The specified container already exists.\n \n \n \n \n The specified container is disabled.\n \n \n \n \n The specified container is being deleted.\n \n \n \n \n Error code that may be returned when there is currently no lease on the blob.\n \n \n \n \n Error code that may be returned when there is currently no lease on the container.\n \n \n \n \n Error code that may be returned when a lease ID was specified, but the lease has expired.\n \n \n \n \n Error code that may be returned when the lease ID specified did not match the lease ID for the blob.\n \n \n \n \n Error code that may be returned when the lease ID specified did not match the lease ID for the container.\n \n \n \n \n Error code that may be returned when there is currently a lease on the resource and no lease ID was specified in the request.\n \n \n \n \n Error code that may be returned when there is currently no lease on the resource.\n \n \n \n \n Error code that may be returned when the lease ID specified did not match the lease ID.\n \n \n \n \n Error code that may be returned when there is already a lease present.\n \n \n \n \n Error code that may be returned when the lease has already been broken and cannot be broken again.\n \n \n \n \n Error code that may be returned when the lease ID matched, but the lease has been broken explicitly and cannot be renewed.\n \n \n \n \n Error code that may be returned when the lease ID matched, but the lease is breaking and cannot be acquired.\n \n \n \n \n Error code that may be returned when the lease ID matched, but the lease is breaking and cannot be changed.\n \n \n \n \n Error code that may be returned when the copy ID specified in an Abort Copy operation does not match the current pending copy ID.\n \n \n \n \n Error code that may be returned when an Abort Copy operation is called when there is no pending copy.\n \n \n \n \n Error code that may be returned when an attempt to modify the destination of a pending copy is made.\n \n \n \n \n Error code that may be returned when the source of a copy cannot be accessed.\n \n \n \n \n Error code that may be returned when the destination of a copy operation has a lease of fixed duration.\n \n \n \n \n Provides a set of parameters for a blob listing operation.\n \n \n \n \n Represents the listing context for enumeration operations.\n \n \n \n \n Initializes a new instance of the class.\n \n The resource name prefix.\n The maximum number of resources to return in a single operation, up to the per-operation limit of 5000.\n \n \n \n Gets or sets the Prefix value.\n \n The Prefix value.\n \n \n \n Gets or sets the MaxResults value.\n \n The MaxResults value.\n \n \n \n Gets or sets the Marker value.\n \n The Marker value.\n \n \n \n Initializes a new instance of the class.\n \n The blob prefix.\n The maximum number of results to return.\n The blob delimiter.\n The include parameter.\n \n \n \n Gets or sets the delimiter for a blob listing operation.\n \n The delimiter to use to traverse the virtual hierarchy of blobs.\n \n The delimiter parameter enables the caller to traverse the blob namespace by using a user-configured delimiter. \n Using this parameter, it is possible to traverse a virtual hierarchy of blobs as though it were a file system. \n \n \n \n \n Gets or sets the details for the listing operation, which indicates the types of data to include in the \n response.\n \n The details to include in the listing operation.\n \n The include parameter specifies that the response should include one or more of the following subsets: snapshots,\n metadata, uncommitted blobs.\n \n \n \n \n Provides a set of helper methods for constructing a request against the Blob service.\n \n \n \n \n Converts the date time to snapshot string.\n \n The date time.\n The converted string.\n \n \n \n Writes a collection of shared access policies to the specified stream in XML format.\n \n A collection of shared access policies.\n An output stream.\n \n \n \n Writes the body of the block list to the specified stream in XML format.\n \n An enumerable collection of objects.\n The stream to which the block list is written.\n \n \n \n Provides methods for parsing the response from an operation to return a block list.\n \n \n \n \n Initializes a new instance of the class.\n \n The stream to be parsed.\n \n \n \n Reads a block item for block listing.\n \n Whether we are currently listing committed blocks or not\n Block listing entry\n \n \n \n Parses the XML response returned by an operation to retrieve a list of blocks.\n \n An enumerable collection of objects.\n \n \n \n Gets an enumerable collection of objects from the response.\n \n An enumerable collection of objects.\n \n \n \n Provides methods for parsing the response from an operation to get a range of pages for a page blob.\n \n \n \n \n Initializes a new instance of the class.\n \n The stream of page ranges to be parsed.\n \n \n \n Reads a page range.\n \n Page range entry\n \n \n \n Parses the XML response for an operation to get a range of pages for a page blob.\n \n An enumerable collection of objects.\n \n \n \n Gets an enumerable collection of objects from the response.\n \n An enumerable collection of objects.\n \n \n \n Represents an item that may be returned by a blob listing operation.\n \n \n \n \n Represents a blob item returned in the XML response for a blob listing operation.\n \n \n \n \n Initializes a new instance of the class.\n \n The name of the blob.\n The blob's attributes.\n \n \n \n Stores the blob item's attributes.\n \n \n \n \n Gets the name of the blob item.\n \n The name of the blob item.\n \n \n \n Gets the blob item's system properties.\n \n The blob item's properties.\n \n \n \n Gets the user-defined metadata for the blob item.\n \n The blob item's metadata, as a collection of name-value pairs.\n \n \n \n Gets the blob item's URI.\n \n The absolute URI to the blob item.\n \n \n \n Gets the date and time that the blob snapshot was taken, if this blob is a snapshot.\n \n The blob's snapshot time if the blob is a snapshot; otherwise, null.\n \n If the blob is not a snapshot, the value of this property is null.\n \n \n \n \n Gets the state of the most recent or pending copy operation.\n \n A object containing the copy state, or null if no copy blob state exists for this blob.\n \n \n \n Represents the blob name prefix that is returned in the XML response for a blob listing operation.\n \n \n \n \n Gets the blob name prefix.\n \n The blob name prefix.\n \n \n \n Provides methods for parsing the response from a blob listing operation.\n \n \n \n \n Stores the blob prefix.\n \n \n \n \n Signals when the blob prefix can be consumed.\n \n \n \n \n Stores the marker.\n \n \n \n \n Signals when the marker can be consumed.\n \n \n \n \n Stores the blob delimiter.\n \n \n \n \n Signals when the blob delimiter can be consumed.\n \n \n \n \n Stores the max results.\n \n \n \n \n Signals when the max results can be consumed.\n \n \n \n \n Stores the next marker.\n \n \n \n \n Signals when the next marker can be consumed.\n \n \n \n \n Initializes a new instance of the class.\n \n The stream to be parsed.\n \n \n \n Parses a blob entry in a blob listing response.\n \n Blob listing entry\n \n \n \n Parses a blob prefix entry in a blob listing response.\n \n Blob listing entry\n \n \n \n Parses the response XML for a blob listing operation.\n \n An enumerable collection of objects that implement .\n \n \n \n Gets the listing context from the XML response.\n \n A set of parameters for the listing operation.\n \n \n \n Gets an enumerable collection of objects that implement from the response.\n \n An enumerable collection of objects that implement .\n \n \n \n Gets the Prefix value provided for the listing operation from the XML response.\n \n The Prefix value.\n \n \n \n Gets the Marker value provided for the listing operation from the XML response.\n \n The Marker value.\n \n \n \n Gets the Delimiter value provided for the listing operation from the XML response.\n \n The Delimiter value.\n \n \n \n Gets the MaxResults value provided for the listing operation from the XML response.\n \n The MaxResults value.\n \n \n \n Gets the NextMarker value from the XML response, if the listing was not complete.\n \n The NextMarker value.\n \n \n \n Provides methods for parsing the response from a container listing operation.\n \n \n \n \n Stores the container prefix.\n \n \n \n \n Signals when the container prefix can be consumed.\n \n \n \n \n Stores the marker.\n \n \n \n \n Signals when the marker can be consumed.\n \n \n \n \n Stores the max results.\n \n \n \n \n Signals when the max results can be consumed.\n \n \n \n \n Stores the next marker.\n \n \n \n \n Signals when the next marker can be consumed.\n \n \n \n \n Initializes a new instance of the class.\n \n The stream to be parsed.\n \n \n \n Reads a container entry completely including its properties and metadata.\n \n Container listing entry\n \n \n \n Parses the response XML for a container listing operation.\n \n An enumerable collection of objects.\n \n \n \n Gets the listing context from the XML response.\n \n A set of parameters for the listing operation.\n \n \n \n Gets an enumerable collection of objects from the response.\n \n An enumerable collection of objects.\n \n \n \n Gets the Prefix value provided for the listing operation from the XML response.\n \n The Prefix value.\n \n \n \n Gets the Marker value provided for the listing operation from the XML response.\n \n The Marker value.\n \n \n \n Gets the MaxResults value provided for the listing operation from the XML response.\n \n The MaxResults value.\n \n \n \n Gets the NextMarker value from the XML response, if the listing was not complete.\n \n The NextMarker value.\n \n \n \n Describes actions that may be used for writing to a page blob or clearing a set of pages.\n \n \n \n \n Update the page with new data.\n \n \n \n \n Clear the page.\n \n \n \n \n Represents a block in a block list.\n \n \n \n \n Initializes a new instance of the class.\n \n The block ID.\n One of the enumeration values that specifies in which block lists to search for the block.\n \n \n \n Gets the block ID.\n \n The block ID.\n \n \n \n Gets a value that indicates which block lists to search for the block.\n \n One of the enumeration values that specifies in which block lists to search for the block.\n \n \n \n Enumeration controlling the options for updating queue messages.\n \n \n \n \n Update the message visibility timeout.\n \n \n \n \n Update the message content.\n \n \n \n \n Represents a continuation token returned by the Queue service.\n \n continuation tokens are used in methods that return a object, such as . \n \n \n \n Gets an XML representation of an object.\n \n \n An that describes the XML representation of the object that is produced by the method and consumed by the method.\n \n \n \n \n Generates a serializable continuation token from its XML representation.\n \n The stream from which the continuation token is deserialized.\n \n \n \n Converts a serializable continuation token into its XML representation.\n \n The stream to which the continuation token is serialized.\n \n \n \n Gets or sets the version for continuing results for CloudQueue enumeration operations.\n \n The version.\n \n \n \n Gets or sets the type element (blob, queue, table) for continuing results for CloudQueue enumeration operations.\n \n The type element.\n \n \n \n Gets or sets the NextMarker for continuing results for CloudQueue enumeration operations.\n \n The next marker.\n \n \n \n Gets or sets the storage location that the continuation token applies to.\n \n The storage location that the continuation token applies to.\n \n \n \n Enum for Queue message type.\n Internal use only. \n \n \n \n \n Indicates the message object stores the raw text string.\n \n \n \n \n Indicates the message object stores the Base64-Encoded representation of the raw data. \n \n \n \n \n Represents a set of timeout and retry policy options that may be specified for a request against the Queue service.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Clones an instance of QueueRequestOptions so that we can apply defaults.\n \n QueueRequestOptions instance to be cloned.\n \n \n \n Gets or sets the absolute expiry time across all potential retries for the request. \n \n \n \n \n Gets or sets the retry policy for the request.\n \n The retry policy delegate.\n \n \n \n Gets or sets the location mode of the request.\n \n The location mode of the request.\n \n \n \n Gets or sets the server timeout for the request. \n \n The client and server timeout interval for the request.\n \n \n \n Gets or sets the maximum execution time across all potential retries for the request. \n \n A representing the maximum execution time for retries for the request.\n \n \n \n Represents a segment of results, with continuation information for pagination scenarios.\n \n \n \n \n Gets an enumerable collection of results.\n \n An enumerable collection of results.\n \n \n \n Gets the continuation token used to retrieve the next segment of results. Returns null if there are no more results.\n \n The continuation token.\n \n \n \n Specifies the set of possible permissions for a shared access queue policy.\n \n \n \n \n No shared access granted.\n \n \n \n \n Permission to peek messages and get queue metadata granted.\n \n \n \n \n Permission to add messages granted.\n \n \n \n \n Permissions to update messages granted.\n \n \n \n \n Permission to get and delete messages granted.\n \n \n \n \n Represents the collection of shared access policies defined for a queue.\n \n \n \n \n Adds the specified key and value to the collection of shared access policies.\n \n The key of the value to add.\n The value to add the collection of shared access policies.\n \n \n \n Determines whether the collection of shared access policies contains the specified key.\n \n The key to locate in the collection of shared access policies.\n true if the collection of shared access policies contains an element with the specified key; otherwise, false.\n \n \n \n Removes the value with the specified key from the shared access policies collection.\n \n The key of the item to remove.\n true if the element is successfully found and removed; otherwise, false. This method returns false if the key is not found.\n \n \n \n Gets the item associated with the specified key. \n \n The key of the value to get.\n The item to get.\n The item associated with the specified key, if the key is found; otherwise, the default value for the type.\n \n \n \n Adds the specified key/ value, stored in a , to the collection of shared access policies.\n \n The object, containing a key/ value pair, to add to the shared access policies collection.\n \n \n \n Removes all keys and values from the shared access collection.\n \n \n \n \n Determines whether the collection of shared access policies contains the key and value in the specified object.\n \n A object containing the key and value to search for.\n true if the shared access policies collection contains the specified key/value; otherwise, false.\n \n \n \n Copies each key/ value pair in the shared access policies collection to a compatible one-dimensional array, starting at the specified index of the target array.\n \n The one-dimensional array of objects that is the destination of the elements copied from the shared access policies collection.\n The zero-based index in at which copying begins.\n \n \n \n Removes the value, specified in the object, from the shared access policies collection.\n \n The object, containing a key and value, to remove from the shared access policies collection.\n true if the item was successfully removed; otherwise, false.\n \n \n \n Returns an enumerator that iterates through the collection of shared access policies.\n \n An of type .\n \n \n \n Returns an enumerator that iterates through the collection of shared access policies.\n \n An object that can be used to iterate through the collection of shared access policies.\n \n \n \n Gets a collection containing the keys in the shared access policies collection.\n \n A collection containing the keys in the of shared access policies collection.\n \n \n \n Gets a collection containing the values in the shared access policies collection.\n \n A collection of items in the shared access policies collection.\n \n \n \n Gets or sets the item associated with the specified key.\n \n The key of the value to get or set.\n The item associated with the specified key, or null if key is not in the shared access policies collection.\n \n \n \n Gets the number of key/ value pairs contained in the shared access policies collection.\n \n The number of key/ value pairs contained in the shared access policies collection.\n \n \n \n Gets a value indicating whether the collection of shared access policies is read-only. \n \n true if the collection of shared access policies is read-only; otherwise, false.\n \n \n \n Represents a shared access policy for a queue, which specifies the start time, expiry time, \n and permissions for a shared access signature.\n \n \n \n \n Initializes a new instance of the SharedAccessQueuePolicy class.\n \n \n \n \n Converts the permissions specified for the shared access policy to a string.\n \n The shared access permissions.\n The shared access permissions in string format.\n \n \n \n Constructs a object from a permissions string.\n \n The shared access permissions in string format.\n A set of shared access permissions.\n \n \n \n Gets or sets the start time for a shared access signature associated with this shared access policy.\n \n The shared access start time.\n \n \n \n Gets or sets the expiry time for a shared access signature associated with this shared access policy.\n \n The shared access expiry time.\n \n \n \n Gets or sets the permissions for a shared access signature associated with this shared access policy.\n \n The permissions.\n \n \n \n Provides methods for parsing the response from an operation to get messages from a queue.\n \n \n \n \n Initializes a new instance of the class.\n \n The stream of messages to parse.\n \n \n \n Parses a message entry in a queue get messages response.\n \n Message entry\n \n \n \n Parses the XML response returned by an operation to get messages from a queue.\n \n An enumerable collection of objects.\n \n \n \n Gets an enumerable collection of objects from the response.\n \n An enumerable collection of objects.\n \n \n \n Provides methods for parsing the response from a queue listing operation.\n \n \n \n \n Stores the container prefix.\n \n \n \n \n Signals when the container prefix can be consumed.\n \n \n \n \n Stores the marker.\n \n \n \n \n Signals when the marker can be consumed.\n \n \n \n \n Stores the max results.\n \n \n \n \n Signals when the max results can be consumed.\n \n \n \n \n Stores the next marker.\n \n \n \n \n Signals when the next marker can be consumed.\n \n \n \n \n Initializes a new instance of the class.\n \n The stream to be parsed.\n \n \n \n Parses a queue entry in a queue listing response.\n \n Queue listing entry\n \n \n \n Parses the response XML for a queue listing operation.\n \n An enumerable collection of objects.\n \n \n \n Gets the listing context from the XML response.\n \n A set of parameters for the listing operation.\n \n \n \n Gets an enumerable collection of objects from the response.\n \n An enumerable collection of objects.\n \n \n \n Gets the Prefix value provided for the listing operation from the XML response.\n \n The Prefix value.\n \n \n \n Gets the Marker value provided for the listing operation from the XML response.\n \n The Marker value.\n \n \n \n Gets the MaxResults value provided for the listing operation from the XML response.\n \n The MaxResults value.\n \n \n \n Gets the NextMarker value from the XML response, if the listing was not complete.\n \n The NextMarker value.\n \n \n \n Parses the response XML from an operation to set the access policy for a queue.\n \n \n \n \n Initializes a new instance of the QueueAccessPolicyResponse class.\n \n The stream to be parsed.\n \n \n \n Parses the current element.\n \n The shared access policy element to parse.\n The shared access policy.\n \n \n \n Represents a queue item returned in the XML response for a queue listing operation.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class.\n \n The name of the queue.\n The Uri of the queue.\n The queue's metadata.\n \n \n \n Gets the user-defined metadata for the queue.\n \n The queue's metadata, as a collection of name-value pairs.\n \n \n \n Gets the name of the queue.\n \n The queue's name.\n \n \n \n Gets the queue's URI.\n \n The absolute URI to the queue.\n \n \n \n Provides error code strings that are specific to the Queue service.\n \n \n \n \n Error code that may be returned when the specified queue was not found.\n \n \n \n \n Error code that may be returned when the specified queue is disabled.\n \n \n \n \n Error code that may be returned when the specified queue already exists.\n \n \n \n \n Error code that may be returned when the specified queue is not empty.\n \n \n \n \n Error code that may be returned when the specified queue is being deleted.\n \n \n \n \n Error code that may be returned when the specified pop receipt does not match.\n \n \n \n \n Error code that may be returned when one or more request parameters are invalid.\n \n \n \n \n Error code that may be returned when the specified message was not found.\n \n \n \n \n Error code that may be returned when the specified message is too large.\n \n \n \n \n Error code that may be returned when the specified marker is invalid.\n \n \n \n \n Provides a set of parameters for a queue listing operation.\n \n \n \n \n Initializes a new instance of the class.\n \n The queue prefix.\n The maximum number of results to return.\n The include parameter.\n \n \n \n Gets or sets the details for the listing operation, which indicates the types of data to include in the \n response.\n \n The details to include in the listing operation.\n \n \n \n Specifies which details to include when listing the queues in this storage account.\n \n \n \n \n No additional details.\n \n \n \n \n Retrieve queue metadata.\n \n \n \n \n Retrieve all available details.\n \n \n \n \n Represents a message retrieved from a queue.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets the message expiration time.\n \n The message expiration time.\n \n \n \n Gets the message ID.\n \n The message ID.\n \n \n \n Gets the time the message was added to the queue.\n \n The message insertion time.\n \n \n \n Gets the time the message is next visible.\n \n The time the message is next visible.\n \n \n \n Gets the pop receipt for the message.\n \n The message's pop receipt.\n \n \n \n Gets the text of the message.\n \n The message text.\n \n \n \n Gets the number of times this message has been dequeued.\n \n The dequeue count.\n \n \n \n Represents the permissions for a queue.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets the set of shared access policies for the queue.\n \n The set of shared access policies for the queue.\n \n \n \n Provides a set of helper methods for constructing a request against the Queue service.\n \n \n \n \n Writes a collection of shared access policies to the specified stream in XML format.\n \n A collection of shared access policies.\n An output stream.\n \n \n \n Writes a message to the specified stream in XML format.\n \n The message body.\n An output stream.\n \n \n \n Gets or sets the number of entities the table query will return. \n \n The maximum number of entities for the table query to return.\n \n \n \n Gets or sets the filter expression to use in the table query.\n \n A string containing the filter expression to use in the query.\n \n \n \n Gets or sets the property names of the table entity properties to return when the table query is executed.\n \n A list of strings containing the property names of the table entity properties to return when the query is executed.\n \n \n \n Provides a set of extension methods for objects of type .\n \n \n \n \n Specifies a set of on the query.\n \n The entity type of the query.\n A query that implements .\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n A object with the specified request options set.\n \n \n \n \n Specifies an for the query.\n \n The entity type of the query.\n A query that implements .\n An object for tracking the current operation.\n A object with the specified operation context.\n \n \n \n \n Specifies an entity resolver for the query.\n \n The entity type of the query.\n The type of the resolver.\n A query that implements .\n The entity resolver, of type .\n A with the specified resolver.\n \n \n \n \n Specifies that a query be returned as a object.\n \n The entity type of the query.\n A query that implements .\n An object of type .\n \n \n \n \n A type which allows callers direct access to the property map of the entity. This class eliminates the use of reflection for serialization and deserialization.\n \n \n \n \n An interface required for table entity types. The interface declares getter and setter methods for the mandatory entity properties, and \n and methods for serialization and de-serialization of all entity properties using a property dictionary. Create classes implementing to customize property \n storage, retrieval, serialization and de-serialization, and to provide additional custom logic for a table entity.\n \n The storage client library includes two implementations of that provide for simple property access and serialization:\n implements and provides a simple property dictionary to store and retrieve properties. Use a for simple access \n to entity properties when only a subset of properties are returned (for example, by a select clause in a query), or for scenarios where your query can return multiple entity types \n with different properties. You can also use this type to perform bulk table updates of heterogeneous entities without losing property information.\n is an implementation of that uses reflection-based serialization and de-serialization behavior in its and methods. \n -derived classes with methods that follow a convention for types and naming are serialized and deserialized automatically. -derived classes must also provide a get-able and set-able public\n property of a type that is supported by the Windows Azure Table service.\n \n \n \n Populates the entity's properties from the data values in the dictionary. \n \n The dictionary of string property names to data values to deserialize and store in this table entity instance.\n An object used to track the execution of the operation.\n \n \n \n Serializes the of property names mapped to data values from the entity instance.\n \n An object used to track the execution of the operation.\n A dictionary of property names to data typed values created by serializing this table entity instance.\n \n \n \n Gets or sets the entity's partition key.\n \n The entity's partition key.\n \n \n \n Gets or sets the entity's row key.\n \n The entity's row key.\n \n \n \n Gets or sets the entity's timestamp.\n \n The entity's timestamp. The property is populated by the Windows Azure Table Service.\n \n \n \n Gets or sets the entity's current ETag. Set this value to '*'\n in order to blindly overwrite an entity as part of an update\n operation.\n \n The entity's timestamp.\n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class with the specified partition key and row key.\n \n The partition key value for the entity.\n The row key value for the entity.\n \n \n \n Initializes a new instance of the class with the entity's partition key, row key, ETag (if available/required), and properties.\n \n The entity's partition key.\n The entity's row key.\n The entity's current ETag.\n The entity's properties, indexed by property name.\n \n \n \n Initializes a new instance of the class with the entity's partition key, row key, timestamp, ETag (if available/required), and properties.\n \n The entity's partition key.\n The entity's row key.\n The timestamp for this entity as returned by Windows Azure.\n The entity's current ETag; set to null to ignore the ETag during subsequent update operations.\n An containing a map of property names to data typed values to store in the new .\n \n \n \n Deserializes this instance using the specified of property names to values of type .\n \n A collection containing the of string property names mapped to values of type to store in this instance.\n An object used to track the execution of the operation.\n \n \n \n Serializes the of property names mapped to values of type from this instance.\n \n An object used to track the execution of the operation.\n A collection containing the map of string property names to values of type stored in this instance.\n \n \n \n Gets or sets the properties in the table entity, indexed by property name.\n \n The entity properties.\n \n \n \n Gets or sets the entity's partition key.\n \n The entity partition key.\n \n \n \n Gets or sets the entity's row key.\n \n The entity row key.\n \n \n \n Gets or sets the entity's timestamp.\n \n The entity timestamp.\n \n \n \n Gets or sets the entity's current ETag. Set this value to '*' to blindly overwrite an entity as part of an update operation.\n \n The entity ETag.\n \n \n \n Gets or sets the entity's property, given the name of the property.\n \n The name of the property.\n The property.\n \n \n \n Enumeration containing the types of values that can be stored in\n a table entity property.\n \n \n \n \n Represents fixed- or variable-length character data.\n \n \n \n \n Represents fixed- or variable-length binary data.\n \n \n \n \n Represents the mathematical concept of binary-valued logic.\n \n \n \n \n Represents date and time.\n \n \n \n \n Represents a floating point number with 15 digits precision that can represent values with approximate range of +/- 2.23e -308 through +/- 1.79e +308.\n \n \n \n \n Represents a 16-byte (128-bit) unique identifier value.\n \n \n \n \n Represents a signed 32-bit integer value.\n \n \n \n \n Represents a signed 64-bit integer value.\n \n \n \n \n Class for storing information about a single property in an entity in a table.\n \n \n \n \n Creates a new object that represents the specified offset value.\n \n The value for the new .\n A new of the offset type.\n \n \n \n Creates a new object that represents the specified byte array.\n \n The value for the new .\n A new of the byte array.\n \n \n \n Creates a new object that represents the specified value.\n \n The value for the new .\n A new of the type.\n \n \n \n Creates a new object that represents the specified value.\n \n The value for the new .\n A new of the type.\n \n \n \n Creates a new object that represents the specified value.\n \n The value for the new .\n A new of the type.\n \n \n \n Creates a new object that represents the specified value.\n \n The value for the new .\n A new of the type.\n \n \n \n Creates a new object that represents the specified value.\n \n The value for the new .\n A new of the type.\n \n \n \n Creates a new object that represents the specified value.\n \n The value for the new .\n A new of the type.\n \n \n \n Initializes a new instance of the class by using the\n byte array value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the EntityProperty class given the\n EdmType of the property (the value must be set by a public\n constructor).\n \n \n \n \n Compares the given object (which is probably an )\n for equality with this object.\n \n The other object.\n true if the objects are equivalent; false otherwise.\n \n \n \n Compares the given object (which is probably an )\n for equality with this object.\n \n The other object.\n true if the objects are equivalent; false otherwise.\n \n \n \n Gets the hash code for this entity property.\n \n The hash code for the entity property.\n \n \n \n Creates an from the object.\n \n The value of the object.\n The reference to the object created.\n \n \n \n Ensures that the given type matches the type of this entity\n property; throws an exception if the types do not match.\n \n \n \n \n Gets the as a generic object.\n \n \n \n \n Gets the of this object.\n \n The of this object.\n \n \n \n Gets or sets the byte array value of this object.\n An exception will be thrown if you attempt to set this property to anything other than an byte array.\n \n The byte array value of this object.\n \n \n \n Gets or sets the value of this object.\n An exception will be thrown if you attempt to set this property to anything other than an Object.\n \n The value of this object.\n \n \n \n Gets or sets the offset value of this object.\n An exception will be thrown if you attempt to set this property to anything other than a object.\n \n The offset value of this object.\n \n \n \n Gets or sets the value of this object.\n An exception will be thrown if you attempt to set this property to anything other than a object.\n \n The value of this object.\n \n \n \n Gets or sets the value of this object.\n An exception will be thrown if you attempt to set this property to anything other than a object.\n \n The value of this object.\n \n \n \n Gets or sets the value of this object.\n An exception will be thrown if you attempt to set this property to anything other than an Object.\n \n The value of this object.\n \n \n \n Gets or sets the value of this object.\n An exception will be thrown if you attempt to set this property to anything other than an Object.\n \n The value of this object.\n \n \n \n Gets or sets the value of this object.\n An exception will be thrown if you attempt to set this property to anything other than a object.\n \n The value of this object.\n \n \n \n Returns a delegate for resolving entities.\n \n The type into which the query results are projected.\n The partition key.\n The row key.\n The timestamp.\n A dictionary of properties.\n The ETag.\n \n \n \n \n Defines the set of comparison operators that may be used for constructing queries.\n \n \n \n \n Represents the Equal operator.\n \n \n \n \n Represents the Not Equal operator.\n \n \n \n \n Represents the Greater Than operator.\n \n \n \n \n Represents the Greater Than or Equal operator.\n \n \n \n \n Represents the Less Than operator.\n \n \n \n \n Represents the Less Than or Equal operator.\n \n \n \n \n Specifies the set of possible permissions for a shared access table policy.\n \n \n \n \n No shared access granted.\n \n \n \n \n Permission to query entities granted.\n \n \n \n \n Permission to add entities granted.\n \n \n \n \n Permission to modify entities granted.\n \n \n \n \n Permission to delete entities granted.\n \n \n \n \n Represents the collection of shared access policies defined for a table.\n \n \n \n \n Adds the specified key and value to the collection of shared access policies.\n \n The key of the value to add.\n The value to add to the collection of shared access policies.\n \n \n \n Determines whether the collection of shared access policies contains the specified key.\n \n The key to locate in the collection of shared access policies.\n true if the collection of shared access policies contains an element with the specified key; otherwise, false.\n \n \n \n Removes the value with the specified key from the shared access policies collection.\n \n The key of the item to remove.\n true if the element is successfully found and removed; otherwise, false. This method returns false if the key is not found.\n \n \n \n Gets the item associated with the specified key. \n \n The key of the value to get.\n The item to get.\n The item associated with the specified key, if the key is found; otherwise, the default value for the type.\n \n \n \n Adds the specified key/ value, stored in a , to the collection of shared access policies.\n \n The object, containing a key/ value pair, to add to the shared access policies collection.\n \n \n \n Removes all keys and values from the shared access collection.\n \n \n \n \n Determines whether the collection of shared access policies contains the key and value in the specified object.\n \n A object containing the key and value to search for.\n true if the shared access policies collection contains the specified key/value; otherwise, false.\n \n \n \n Copies each key/ value pair in the shared access policies collection to a compatible one-dimensional array, starting at the specified index of the target array.\n \n The one-dimensional array of objects that is the destination of the elements copied from the shared access policies collection.\n The zero-based index in at which copying begins.\n \n \n \n Removes the value, specified in the object, from the shared access policies collection.\n \n The object, containing a key and value, to remove from the shared access policies collection.\n true if the item was successfully removed; otherwise, false.\n \n \n \n Returns an enumerator that iterates through the collection of shared access policies.\n \n An of type .\n \n \n \n Returns an enumerator that iterates through the collection of shared access policies.\n \n An object that can be used to iterate through the collection of shared access policies.\n \n \n \n Gets a collection containing the keys in the shared access policies collection.\n \n A collection containing the keys in the of shared access policies collection.\n \n \n \n Gets a collection containing the values in the shared access policies collection.\n \n A collection of items in the shared access policies collection.\n \n \n \n Gets or sets the item associated with the specified key.\n \n The key of the value to get or set.\n The item associated with the specified key, or null if key is not in the shared access policies collection.\n \n \n \n Gets the number of key/ value pairs contained in the shared access policies collection.\n \n The number of key/ value pairs contained in the shared access policies collection.\n \n \n \n Gets a value indicating whether the collection of shared access policies is read-only. \n \n true if the collection of shared access policies is read-only; otherwise, false.\n \n \n \n Represents a shared access policy, which specifies the start time, expiry time, \n and permissions for a shared access signature.\n \n \n \n \n Initializes a new instance of the SharedAccessTablePolicy class.\n \n \n \n \n Converts the permissions specified for the shared access policy to a string.\n \n The shared access permissions.\n The shared access permissions in string format.\n \n \n \n Constructs a object from a permissions string.\n \n The shared access permissions in string format.\n A set of shared access permissions.\n \n \n \n Gets or sets the start time for a shared access signature associated with this shared access policy.\n \n The shared access start time.\n \n \n \n Gets or sets the expiry time for a shared access signature associated with this shared access policy.\n \n The shared access expiry time.\n \n \n \n Gets or sets the permissions for a shared access signature associated with this shared access policy.\n \n The permissions.\n \n \n \n Represents a continuation token for listing operations. \n \n A method that may return a partial set of results via a object also returns a continuation token, \n which can be used in a subsequent call to return the next set of available results. \n \n \n \n Gets an XML representation of an object.\n \n \n An that describes the XML representation of the object that is produced by the method and consumed by the method.\n \n \n \n \n Generates a serializable continuation token from its XML representation.\n \n The stream from which the continuation token is deserialized.\n \n \n \n Converts a serializable continuation token into its XML representation.\n \n The stream to which the continuation token is serialized.\n \n \n \n Gets or sets the version for continuing results for enumeration operations.\n \n The version.\n \n \n \n Gets or sets the type element (blob, queue, table) for continuing results for enumeration operations.\n \n The type element.\n \n \n \n Gets or sets the next partition key for enumeration operations.\n \n The next partition key.\n \n \n \n Gets or sets the next row key for enumeration operations.\n \n The next row key.\n \n \n \n Gets or sets the next table name for enumeration operations.\n \n The name of the next table.\n \n \n \n Gets or sets the storage location that the continuation token applies to.\n \n The storage location that the continuation token applies to.\n \n \n \n Represents the base object type for a table entity in the Table service.\n \n provides a base implementation for the interface that provides and methods that by default serialize and \n deserialize all properties via reflection. A table entity class may extend this class and override the and methods to provide customized or better performing serialization logic.\n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class with the specified partition key and row key.\n \n The partition key of the to be initialized.\n The row key of the to be initialized.\n \n \n \n Deserializes this instance using the specified of property names to data typed values. \n \n The map of string property names to data values to deserialize and store in this table entity instance.\n An object used to track the execution of the operation.\n \n \n \n Deserializes a custom entity instance using the specified of property names to data typed values. \n \n Custom entity instance being deserialized.\n The map of string property names to data values to deserialize and store in this entity instance.\n An object used to track the execution of the operation. \n \n \n \n Serializes the of property names mapped to data values from this instance.\n \n An object used to track the execution of the operation.\n A map of property names to data typed values created by serializing this table entity instance.\n \n \n \n Create a of objects for all the properties of the specified entity object.\n \n The entity object to serialize.\n An object used to track the execution of the operation.\n A of objects for all the properties of the specified entity object.\n \n \n \n Determines if the given property should be skipped based on its name, if it exposes a public getter and setter, and if the IgnoreAttribute is not defined.\n \n The PropertyInfo of the property to check\n An object used to track the execution of the operation.\n True if the property should be skipped, false otherwise. \n \n \n \n Compiles a ReadAction for the given type\n \n The type to compile for\n A ReadAction that deserializes the given entity type.\n \n \n \n Compiles a WriteFunc for the given type\n \n The type to compile for\n A WriteFunc that serializes the given entity type.\n \n \n \n Generates a Conditional Expression that will retrieve the given entity value by type and set it into the current property. \n \n The entity type\n The property to deserialize into\n An Expression that represents the entity instance\n An Expression that represents the current EntityProperty expression\n \n \n \n \n Gets the EntityProperty from the dictionary, or returns null. Similar to IDictionary.TryGetValue with logging support.\n \n The key value\n The Dictionary instance\n The operationContext to log to.\n \n \n \n \n Gets or sets the entity's partition key.\n \n The partition key of the entity.\n \n \n \n Gets or sets the entity's row key.\n \n The row key of the entity.\n \n \n \n Gets or sets the entity's timestamp.\n \n The timestamp of the entity.\n \n \n \n Gets or sets the entity's current ETag. Set this value to '*' in order to blindly overwrite an entity as part of an update operation.\n \n The ETag of the entity.\n \n \n \n Disables the ability to dynamically generate read and write lambdas at runtime. Setting this to false will clear out the static cache shared across all type instances that derive from TableEntity.\n \n \n \n \n This entities compiled Write Func\n \n \n \n \n This entities compiled Read Action\n \n \n \n \n Gets or sets the status of the property resolver cache for the . \n \n The property resolver cache caches known entity types and their respective property resolver dictionaries when entities are deserialized and the payload does not include JSON metadata. For most scenarios, disabling the property resolver cache is not recommended due to its effect on performance. \n \n \n \n \n \n Enumeration containing the types of operations that can be\n performed by a .\n \n \n \n \n Represents an insert operation.\n \n \n \n \n Represents a delete operation.\n \n \n \n \n Represents a replace operation.\n \n \n \n \n Represents a merge operation.\n \n \n \n \n Represents an insert or replace operation.\n \n \n \n \n Represents an insert or merge operation.\n \n \n \n \n Represents a retrieve operation.\n \n \n \n \n Defines the set of Boolean operators for constructing queries.\n \n \n \n \n Represents the And operator.\n \n \n \n \n Represents the Not operator.\n \n \n \n \n Represents the Or operator.\n \n \n \n \n Describes the payload formats supported for Tables.\n \n \n \n \n Use AtomPub.\n \n \n \n \n Use JSON with full metadata.\n \n \n \n \n Use JSON with minimal metadata.\n \n \n \n \n Use JSON with no metadata.\n \n \n \n \n Represents the permissions for a table.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets the set of shared access policies for the container.\n \n The set of shared access policies for the container.\n \n \n \n Represents a segment of results and contains continuation token information.\n \n The type of the result that the segment contains.\n \n \n \n Stores the continuation token used to retrieve the next segment of results.\n \n \n \n \n Initializes a new instance of the class.\n \n The result.\n \n \n \n Returns an enumerator that iterates through the .\n \n An enumerator that iterates through the .\n \n \n \n Gets an enumerable collection of results.\n \n An enumerable collection of results. \n \n \n \n Gets a continuation token to use to retrieve the next set of results with a subsequent call to the operation.\n \n The continuation token.\n \n \n \n Represents a set of timeout and retry policy options that may be specified for a request against the Table service.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class with the specified .\n \n The request options used to initialize this instance of the class.\n \n \n \n Gets or sets the absolute expiry time across all potential retries for the request. \n \n \n \n \n Gets or sets the retry policy for the request.\n \n The retry policy delegate.\n \n \n \n Gets or sets the location mode of the request.\n \n The location mode of the request.\n \n \n \n Gets or sets the server timeout for the request. \n \n The client and server timeout interval for the request.\n \n \n \n Gets or sets the maximum execution time for all potential retries for the request.\n \n A representing the maximum execution time for retries for the request.\n \n \n \n Gets or sets the that will be used for the request.\n \n The TablePayloadFormat to use.\n \n \n \n Gets or sets the delegate that is used to get the for an entity property given the partition key, row key, and the property name. \n \n \n \n \n Represents the result of a table operation.\n \n The class encapsulates the HTTP response and any table entity results returned by the Storage Service REST API operation called for a particular .\n \n \n \n Gets or sets the result returned by the as an .\n \n The result of the table operation as an .\n \n \n \n Gets or sets the HTTP status code returned by a request.\n \n The HTTP status code returned by a request.\n \n \n \n Gets or sets the ETag returned with the request results.\n \n The ETag returned with the request results.\n \n \n \n Represents a segment of results, with continuation information for pagination scenarios.\n \n \n \n \n Initializes a new instance of the class.\n \n The result.\n \n \n \n Stores the continuation token used to retrieve the next segment of results or null if there are no more results.\n \n \n \n \n Returns an enumerator that iterates through the segment of results. \n \n An enumerator that iterates through the segment of results.\n \n \n \n Gets an enumerable collection of results.\n \n An enumerable collection of results.\n \n \n \n Gets the continuation token used to retrieve the next segment of results. Returns null if there are no more results.\n \n The continuation token.\n \n \n \n Internal table service entity for creating tables.\n \n \n \n \n Stores the table name.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class with the specified name.\n \n The name of the table.\n \n \n \n Determines whether the specified is equal to this instance.\n \n The to compare with this instance.\n \n Returns true if the specified is equal to this instance; otherwise, false.\n \n \n The parameter is null.\n \n \n \n \n Returns a hash code for this instance.\n \n \n A hash code for this instance, suitable for use in hashing algorithms and data structures like a hash table. \n \n \n \n \n Gets or sets the table name.\n \n The name of the table.\n \n \n \n Parses the response XML from an operation to set the access policy for a table.\n \n \n \n \n Initializes a new instance of the TableAccessPolicyResponse class.\n \n The stream to be parsed.\n \n \n \n Parses the current element.\n \n The shared access policy element to parse.\n The shared access policy.\n \n \n \n A set of constants used in operations against the Table service.\n \n \n \n \n Stores the header prefix for continuation information.\n \n \n \n \n Stores the header suffix for the next partition key.\n \n \n \n \n Stores the header suffix for the next row key.\n \n \n \n \n Stores the table suffix for the next table name.\n \n \n \n \n Stores the maximum results the table service can return.\n \n \n \n \n The maximum size of a string property for the table service in bytes.\n \n \n \n \n The maximum size of a string property for the table service in bytes.\n \n \n \n \n The maximum size of a string property for the table service in chars.\n \n \n \n \n The name of the special table used to store tables.\n \n \n \n \n The name of the partition key property.\n \n \n \n \n The name of the row key property.\n \n \n \n \n The name of the Timestamp property.\n \n \n \n \n The name of the ETag property.\n \n \n \n \n The name of the property that stores the table name.\n \n \n \n \n The query filter clause name.\n \n \n \n \n The query top clause name.\n \n \n \n \n The query select clause name.\n \n \n \n \n The minimum DateTime supported.\n \n \n \n \n Provides error code strings that are specific to the Windows Azure Table service.\n \n \n \n \n The request uses X-HTTP-Method with an HTTP verb other than POST.\n \n \n \n \n The specified X-HTTP-Method is invalid.\n \n \n \n \n More than one X-HTTP-Method is specified.\n \n \n \n \n The specified table has no properties.\n \n \n \n \n A property is specified more than once.\n \n \n \n \n The specified table has no such property.\n \n \n \n \n A duplicate key property was specified.\n \n \n \n \n The specified table already exists.\n \n \n \n \n The specified table was not found.\n \n \n \n \n The specified entity was not found.\n \n \n \n \n The specified entity already exists.\n \n \n \n \n The partition key was not specified.\n \n \n \n \n One or more specified operators are invalid.\n \n \n \n \n The specified update condition was not satisfied.\n \n \n \n \n All properties must have values.\n \n \n \n \n The partition key property cannot be updated.\n \n \n \n \n The entity contains more properties than allowed.\n \n \n \n \n The entity is larger than the maximum size permitted.\n \n \n \n \n The property value is larger than the maximum size permitted.\n \n \n \n \n One or more value types are invalid.\n \n \n \n \n The specified table is being deleted.\n \n \n \n \n The Table service server is out of memory.\n \n \n \n \n The type of the primary key property is invalid.\n \n \n \n \n The property name exceeds the maximum allowed length.\n \n \n \n \n The property name is invalid.\n \n \n \n \n Batch operations are not supported for this operation type.\n \n \n \n \n JSON format is not supported.\n \n \n \n \n The specified method is not allowed.\n \n \n \n \n The specified operation is not yet implemented.\n \n \n \n \n Provides a set of helper methods for constructing a request against the Table service.\n \n \n \n \n Writes a collection of shared access policies to the specified stream in XML format.\n \n A collection of shared access policies.\n An output stream.\n \n \n \n Contains storage constants.\n \n \n \n \n Constant for the max value of ParallelOperationThreadCount for Block Blobs.\n \n \n \n \n Maximum number of shared access policy identifiers supported by server.\n \n \n \n \n Default Write Block Size used by Blob stream.\n \n \n \n \n The maximum size of a blob before it must be separated into blocks.\n \n \n \n \n The maximum size of a single block.\n \n \n \n \n The maximum size of a range get operation that returns content MD5.\n \n \n \n \n The maximum number of blocks.\n \n \n \n \n The maximum size of a blob with blocks.\n \n \n \n \n Default size of buffer for unknown sized requests.\n \n \n \n \n Common name to be used for all loggers.\n \n \n \n \n The size of a page in a PageBlob.\n \n \n \n \n A constant representing a kilo-byte (Non-SI version).\n \n \n \n \n A constant representing a megabyte (Non-SI version).\n \n \n \n \n A constant representing a megabyte (Non-SI version).\n \n \n \n \n XML element for committed blocks.\n \n \n \n \n XML element for uncommitted blocks.\n \n \n \n \n XML element for blocks.\n \n \n \n \n XML element for names.\n \n \n \n \n XML element for sizes.\n \n \n \n \n XML element for block lists.\n \n \n \n \n XML element for queue message lists.\n \n \n \n \n XML element for queue messages.\n \n \n \n \n XML element for message IDs.\n \n \n \n \n XML element for insertion times.\n \n \n \n \n XML element for expiration times.\n \n \n \n \n XML element for pop receipts.\n \n \n \n \n XML element for the time next visible fields.\n \n \n \n \n XML element for message texts.\n \n \n \n \n XML element for dequeue counts.\n \n \n \n \n XML element for page ranges.\n \n \n \n \n XML element for page list elements.\n \n \n \n \n XML element for page range start elements.\n \n \n \n \n XML element for page range end elements.\n \n \n \n \n XML element for delimiters.\n \n \n \n \n XML element for blob prefixes.\n \n \n \n \n XML element for content type fields.\n \n \n \n \n XML element for content type fields.\n \n \n \n \n XML element for content encoding fields.\n \n \n \n \n XML element for content language fields.\n \n \n \n \n XML element for content length fields.\n \n \n \n \n XML element for content MD5 fields.\n \n \n \n \n XML element for enumeration results.\n \n \n \n \n XML element for service endpoint.\n \n \n \n \n XML element for container name.\n \n \n \n \n XML element for blobs.\n \n \n \n \n XML element for prefixes.\n \n \n \n \n XML element for maximum results.\n \n \n \n \n XML element for markers.\n \n \n \n \n XML element for the next marker.\n \n \n \n \n XML element for the ETag.\n \n \n \n \n XML element for the last modified date.\n \n \n \n \n XML element for the Url.\n \n \n \n \n XML element for blobs.\n \n \n \n \n XML element for copy ID.\n \n \n \n \n XML element for copy status.\n \n \n \n \n XML element for copy source.\n \n \n \n \n XML element for copy progress.\n \n \n \n \n XML element for copy completion time.\n \n \n \n \n XML element for copy status description.\n \n \n \n \n Constant signaling a page blob.\n \n \n \n \n Constant signaling a block blob.\n \n \n \n \n Constant signaling the blob is locked.\n \n \n \n \n Constant signaling the blob is unlocked.\n \n \n \n \n Constant signaling the resource is available for leasing.\n \n \n \n \n Constant signaling the resource is leased.\n \n \n \n \n Constant signaling the resource's lease has expired.\n \n \n \n \n Constant signaling the resource's lease is breaking.\n \n \n \n \n Constant signaling the resource's lease is broken.\n \n \n \n \n Constant signaling the resource's lease is infinite.\n \n \n \n \n Constant signaling the resource's lease is fixed (finite).\n \n \n \n \n Constant for a pending copy.\n \n \n \n \n Constant for a successful copy.\n \n \n \n \n Constant for an aborted copy.\n \n \n \n \n Constant for a failed copy.\n \n \n \n \n Constant for unavailable geo-replication status.\n \n \n \n \n Constant for live geo-replication status.\n \n \n \n \n Constant for bootstrap geo-replication status.\n \n \n \n \n XML element for blob types.\n \n \n \n \n XML element for the lease status.\n \n \n \n \n XML element for the lease status.\n \n \n \n \n XML element for the lease status.\n \n \n \n \n XML element for snapshots.\n \n \n \n \n XML element for containers.\n \n \n \n \n XML element for a container.\n \n \n \n \n XML element for queues.\n \n \n \n \n Version 2 of the XML element for the queue name.\n \n \n \n \n XML element for the queue.\n \n \n \n \n XML element for properties.\n \n \n \n \n XML element for the metadata.\n \n \n \n \n XML element for an invalid metadata name.\n \n \n \n \n XML element for maximum results.\n \n \n \n \n XML element for committed blocks.\n \n \n \n \n XML element for uncommitted blocks.\n \n \n \n \n XML element for the latest.\n \n \n \n \n XML element for signed identifiers.\n \n \n \n \n XML element for a signed identifier.\n \n \n \n \n XML element for access policies.\n \n \n \n \n XML attribute for IDs.\n \n \n \n \n XML element for the start time of an access policy.\n \n \n \n \n XML element for the end of an access policy.\n \n \n \n \n XML element for the permissions of an access policy.\n \n \n \n \n The URI path component to access the messages in a queue.\n \n \n \n \n XML element for exception details.\n \n \n \n \n XML root element for errors.\n \n \n \n \n XML element for error codes.\n \n \n \n \n XML element for error codes returned by the preview tenants.\n \n \n \n \n XML element for error messages.\n \n \n \n \n XML element for error messages.\n \n \n \n \n XML element for exception messages.\n \n \n \n \n XML element for stack traces.\n \n \n \n \n Namespace of the entity container.\n \n \n \n \n Name of the entity container.\n \n \n \n \n Name of the entity set.\n \n \n \n \n Namespace name for primitive types.\n \n \n \n \n Default namespace name for Tables. \n \n \n \n \n Default name for Tables. \n \n \n \n \n Header value to set Accept to XML.\n \n \n \n \n Header value to set Accept to AtomPub.\n \n \n \n \n Header value to set Accept to JsonLight.\n \n \n \n \n Header value to set Accept to JsonFullMetadata.\n \n \n \n \n Header value to set Accept to JsonNoMetadata.\n \n \n \n \n Header value to set Content-Type to AtomPub.\n \n \n \n \n Header value to set Content-Type to JSON.\n \n \n \n \n The prefix used in all ETags.\n \n \n \n \n Default client side timeout for all service clients.\n \n \n \n \n Default server side timeout for all service clients.\n \n \n \n \n Maximum Retry Policy back-off\n \n \n \n \n Maximum allowed timeout for any request.\n \n \n \n \n Constants for HTTP headers.\n \n \n \n \n Specifies the value to use for UserAgent header.\n \n \n \n \n Specifies the value to use for UserAgent header.\n \n \n \n \n Master Windows Azure Storage header prefix.\n \n \n \n \n True Header.\n \n \n \n \n False Header.\n \n \n \n \n Header prefix for properties.\n \n \n \n \n Header prefix for metadata.\n \n \n \n \n Header that specifies content length.\n \n \n \n \n Header that specifies content language.\n \n \n \n \n Header that specifies the ETag value for the resource.\n \n \n \n \n Header for data ranges.\n \n \n \n \n Header for range content MD5.\n \n \n \n \n Header for storage version.\n \n \n \n \n Header for copy source.\n \n \n \n \n Header for the If-Match condition.\n \n \n \n \n Header for the If-Modified-Since condition.\n \n \n \n \n Header for the If-None-Match condition.\n \n \n \n \n Header for the If-Unmodified-Since condition.\n \n \n \n \n Header for the If-Sequence-Number-LE condition.\n \n \n \n \n Header for the If-Sequence-Number-LT condition.\n \n \n \n \n Header for the If-Sequence-Number-EQ condition.\n \n \n \n \n Header for the blob type.\n \n \n \n \n Header for snapshots.\n \n \n \n \n Header to delete snapshots.\n \n \n \n \n Header that specifies approximate message count of a queue.\n \n \n \n \n Header that specifies blob caching control.\n \n \n \n \n Response header that specifies the blob content disposition.\n \n \n \n \n Request header that specifies the blob content disposition.\n \n \n \n \n Header that specifies blob content encoding.\n \n \n \n \n Header that specifies blob content language.\n \n \n \n \n Header that specifies blob content MD5.\n \n \n \n \n Header that specifies blob content type.\n \n \n \n \n Header that specifies blob content length.\n \n \n \n \n Header that specifies blob sequence number.\n \n \n \n \n Header that specifies sequence number action.\n \n \n \n \n Header that specifies lease ID.\n \n \n \n \n Header that specifies lease status.\n \n \n \n \n Header that specifies lease status.\n \n \n \n \n Header that specifies page write mode.\n \n \n \n \n Header that specifies the date.\n \n \n \n \n Header indicating the request ID.\n \n \n \n \n Header indicating the client request ID.\n \n \n \n \n Header that specifies public access to blobs.\n \n \n \n \n Format string for specifying ranges.\n \n \n \n \n Current storage version header value.\n Every time this version changes, assembly version needs to be updated as well.\n \n \n \n \n Specifies the page blob type.\n \n \n \n \n Specifies the block blob type.\n \n \n \n \n Specifies only snapshots are to be included.\n \n \n \n \n Specifies snapshots are to be included.\n \n \n \n \n Header that specifies the pop receipt for a message.\n \n \n \n \n Header that specifies the next visible time for a message.\n \n \n \n \n Header that specifies whether to peek-only.\n \n \n \n \n Header that specifies whether data in the container may be accessed publicly and what level of access is to be allowed.\n \n \n \n \n Header that specifies the lease action to perform.\n \n \n \n \n Header that specifies the proposed lease ID for a leasing operation.\n \n \n \n \n Header that specifies the duration of a lease.\n \n \n \n \n Header that specifies the break period of a lease.\n \n \n \n \n Header that specifies the remaining lease time.\n \n \n \n \n Header that specifies the key name for explicit keys.\n \n \n \n \n Header that specifies the copy ID.\n \n \n \n \n Header that specifies the copy last modified time.\n \n \n \n \n Header that specifies the copy status.\n \n \n \n \n Header that specifies the copy progress.\n \n \n \n \n Header that specifies a copy error message.\n \n \n \n \n Header that specifies the copy action.\n \n \n \n \n The value of the copy action header that signifies an abort operation.\n \n \n \n \n Header that specifies the Accept type for the response payload.\n \n \n \n \n Header that specifies the Content type for the request payload.\n \n \n \n \n Specifies the value to use for UserAgent header.\n \n \n \n \n Specifies the comment to use for UserAgent header.\n \n \n \n \n Constants for query strings.\n \n \n \n \n Query component for snapshot time.\n \n \n \n \n Query component for the signed SAS start time.\n \n \n \n \n Query component for the signed SAS expiry time.\n \n \n \n \n Query component for the signed SAS resource.\n \n \n \n \n Query component for the SAS table name.\n \n \n \n \n Query component for the signed SAS permissions.\n \n \n \n \n Query component for the SAS start partition key.\n \n \n \n \n Query component for the SAS start row key.\n \n \n \n \n Query component for the SAS end partition key.\n \n \n \n \n Query component for the SAS end row key.\n \n \n \n \n Query component for the signed SAS identifier.\n \n \n \n \n Query component for the signing SAS key.\n \n \n \n \n Query component for the signed SAS version.\n \n \n \n \n Query component for SAS signature.\n \n \n \n \n Query component for SAS cache control.\n \n \n \n \n Query component for SAS content type.\n \n \n \n \n Query component for SAS content encoding.\n \n \n \n \n Query component for SAS content language.\n \n \n \n \n Query component for SAS content disposition.\n \n \n \n \n Query component for message time-to-live.\n \n \n \n \n Query component for message visibility timeout.\n \n \n \n \n Query component for the number of messages.\n \n \n \n \n Query component for message pop receipt.\n \n \n \n \n Query component for resource type.\n \n \n \n \n Query component for the operation (component) to access.\n \n \n \n \n Query component for the copy ID.\n \n \n \n \n Constants for Result Continuations\n \n \n \n \n Top Element for Continuation Tokens\n \n \n \n \n XML element for the next marker.\n \n \n \n \n XML element for the next partition key.\n \n \n \n \n XML element for the next row key.\n \n \n \n \n XML element for the next table name.\n \n \n \n \n XML element for the target location.\n \n \n \n \n XML element for the token version.\n \n \n \n \n Stores the current token version value.\n \n \n \n \n XML element for the token type.\n \n \n \n \n Specifies the blob continuation token type.\n \n \n \n \n Specifies the queue continuation token type.\n \n \n \n \n Specifies the table continuation token type.\n \n \n \n \n HTTP methods that are supported by CORS.\n \n \n \n \n Represents no HTTP method in a CORS rule.\n \n \n \n \n Represents the GET HTTP method in a CORS rule.\n \n \n \n \n Represents the HEAD HTTP method in a CORS rule.\n \n \n \n \n Represents the POST HTTP method in a CORS rule.\n \n \n \n \n Represents the PUT HTTP method in a CORS rule.\n \n \n \n \n Represents the DELETE HTTP method in a CORS rule.\n \n \n \n \n Represents the TRACE HTTP method in a CORS rule.\n \n \n \n \n Represents the OPTIONS HTTP method in a CORS rule.\n \n \n \n \n Represents the CONNECT HTTP method in a CORS rule.\n \n \n \n \n Represents the MERGE HTTP method in a CORS rule.\n \n \n \n \n Class representing the service properties pertaining to CORS.\n \n \n \n \n Constructs a CORS Properties object.\n \n \n \n \n Gets or sets CORS rules. The order of the list corresponds to precedence of rules. \n \n A collection containing CORS rules, limited to 5.\n \n \n \n Class representing the service properties pertaining to CORS.\n \n \n \n \n Gets or sets domain names allowed via CORS.\n \n A collection of strings containing the allowed domain names, limited to 64.\n \n \n \n Gets or sets response headers that should be exposed to client via CORS.\n \n A collection of strings containing exposed headers, limited to 64 defined headers and two prefixed headers.\n \n \n \n Gets or sets headers allowed to be part of the CORS request.\n \n A collection of strings containing allowed headers, limited to 64 defined headers and two prefixed headers.\n \n \n \n Gets or sets the HTTP methods permitted to execute for this origin.\n \n The allowed HTTP methods.\n \n \n \n Gets or sets the length of time in seconds that a preflight response should be cached by browser.\n \n The maximum number of seconds to cache the response.\n \n \n \n Class representing the geo-replication stats.\n \n \n \n \n The name of the status XML element.\n \n \n \n \n The name of the last sync time XML element.\n \n \n \n \n Initializes a new instance of the GeoReplicationStats class.\n \n \n \n \n Gets a from a string.\n \n The geo-replication status string.\n A enumeration.\n The string contains an unrecognized value.\n \n \n \n Constructs a GeoReplicationStats object from an XML element.\n \n The XML element.\n A GeoReplicationStats object containing the properties in the element.\n \n \n \n Gets or sets the status of geo-replication.\n \n The status of geo-replication.\n \n \n \n Gets or sets the last synchronization time.\n \n The last synchronization time.\n All primary writes preceding this value are guaranteed to be available for read operations. Primary writes following this point in time may or may not be available for reads.\n \n \n \n Enumeration representing the state of geo-replication in a service.\n \n \n \n \n Status of geo-replication is unavailable.\n \n \n \n \n Geo-replication is live.\n \n \n \n \n Data is being bootstrapped from primary to secondary.\n \n \n \n \n Enumeration representing the state of logging in a service.\n \n \n \n \n Logging is disabled.\n \n \n \n \n Log read operations.\n \n \n \n \n Log write operations.\n \n \n \n \n Log delete operations.\n \n \n \n \n Log all operations.\n \n \n \n \n Class representing the service properties pertaining to logging.\n \n \n \n \n Gets or sets the version of the analytics service.\n \n A string identifying the version of the service.\n \n \n \n Gets or sets the state of logging.\n \n A combination of flags describing the operations that are logged.\n \n \n \n Gets or sets the logging retention policy.\n \n The number of days to retain the logs.\n \n \n \n Enumeration representing the state of metrics collection in a service.\n \n \n \n \n Metrics collection is disabled.\n \n \n \n \n Service-level metrics collection is enabled.\n \n \n \n \n Service-level and API metrics collection are enabled.\n \n \n \n \n Class representing the service properties pertaining to metrics.\n \n \n \n \n Gets or sets the version of the analytics service.\n \n A string identifying the version of the service.\n \n \n \n Gets or sets the state of metrics collection.\n \n A value indicating which metrics to collect, if any.\n \n \n \n Gets or sets the logging retention policy.\n \n The number of days to retain the logs.\n \n \n \n Writes a collection of shared access policies to the specified stream in XML format.\n \n A collection of shared access policies.\n An output stream.\n A delegate that writes a policy to an XML writer.\n The type of policy to write.\n \n \n \n Gets the request id.\n \n The response from server.\n The request ID.\n \n \n \n Reads a collection of shared access policies from the specified object.\n \n A collection of shared access policies to be filled.\n A policy response object for reading the stream.\n The type of policy to read.\n \n \n \n Parses the metadata.\n \n The reader.\n A of metadata.\n \n Precondition: reader at <Metadata>\n Postcondition: reader after </Metadata> (<Metadata/> consumed)\n \n \n \n \n Class representing a set of properties pertaining to a cloud storage service.\n \n \n \n \n The name of the root XML element.\n \n \n \n \n The name of the logging XML element.\n \n \n \n \n The name of the metrics XML element.\n \n \n \n \n The name of the CORS XML element.\n \n \n \n \n The name of the minute metrics XML element.\n \n \n \n \n The name of the version XML element.\n \n \n \n \n The name of the delete operation XML element.\n \n \n \n \n The name of the read operation XML element.\n \n \n \n \n The name of the write operation XML element.\n \n \n \n \n The name of the retention policy XML element.\n \n \n \n \n The name of the enabled XML element.\n \n \n \n \n The name of the days XML element.\n \n \n \n \n The name of the include APIs XML element.\n \n \n \n \n The name of the default service version XML element.\n \n \n \n \n The name of the CORS Rule XML element.\n \n \n \n \n The name of the Allowed Origin XML element.\n \n \n \n \n The name of the Allowed Method XML element.\n \n \n \n \n The name of the Maximum Age XML element.\n \n \n \n \n The name of the Exposed Headers XML element.\n \n \n \n \n The name of the Allowed Headers XML element.\n \n \n \n \n Initializes a new instance of the ServiceProperties class.\n \n \n \n \n Constructs a ServiceProperties object from an XML document received from the service.\n \n The XML document.\n A ServiceProperties object containing the properties in the XML document.\n \n \n \n Converts these properties into XML for communicating with the service.\n \n An XML document containing the service properties.\n \n \n \n Generates XML representing the given retention policy.\n \n The number of days to retain, or null if the policy is disabled.\n An XML retention policy element.\n \n \n \n Generates XML representing the given metrics properties.\n \n The metrics properties.\n The XML name for these metrics.\n An XML metrics element.\n \n \n \n Generates XML representing the given logging properties.\n \n The logging properties.\n An XML logging element.\n \n \n \n Generates XML representing the given CORS properties.\n \n The CORS properties.\n An XML logging element.\n \n \n \n Constructs a LoggingProperties object from an XML element.\n \n The XML element.\n A LoggingProperties object containing the properties in the element.\n \n \n \n Constructs a MetricsProperties object from an XML element.\n \n The XML element.\n A MetricsProperties object containing the properties in the element.\n \n \n \n Constructs a CorsProperties object from an XML element.\n \n The XML element.\n A CorsProperties object containing the properties in the element.\n \n \n \n Constructs a retention policy (number of days) from an XML element.\n \n The XML element.\n The number of days to retain, or null if retention is disabled.\n \n \n \n Writes service properties to a stream, formatted in XML.\n \n The stream to which the formatted properties are to be written.\n \n \n \n Gets or sets the logging properties.\n \n The logging properties.\n \n \n \n Gets or sets the hour metrics properties.\n \n The metrics properties.\n \n \n \n Gets or sets the hour metrics properties.\n \n The metrics properties.\n \n \n \n Gets or sets the Cross Origin Resource Sharing (CORS) properties.\n \n The CORS properties.\n \n \n \n Gets or sets the minute metrics properties.\n \n The minute metrics properties.\n \n \n \n Gets or sets the default service version.\n \n The default service version identifier.\n \n \n \n Class representing a set of stats pertaining to a cloud storage service.\n \n \n \n \n The name of the root XML element.\n \n \n \n \n The name of the geo-replication XML element.\n \n \n \n \n Initializes a new instance of the ServiceStats class.\n \n \n \n \n Constructs a ServiceStats object from an XML document received from the service.\n \n The XML document.\n A ServiceStats object containing the properties in the XML document.\n \n \n \n Gets or sets the geo-replication stats.\n \n The geo-replication stats.\n \n \n \n Provides error code strings that are common to all storage services.\n \n \n \n \n The specified HTTP verb is not supported.\n \n \n \n \n The Content-Length header is required for this request.\n \n \n \n \n A required header was missing.\n \n \n \n \n A required XML node was missing.\n \n \n \n \n One or more header values are not supported.\n \n \n \n \n One or more XML nodes are not supported.\n \n \n \n \n One or more header values are invalid.\n \n \n \n \n One or more XML node values are invalid.\n \n \n \n \n A required query parameter is missing.\n \n \n \n \n One or more query parameters is not supported.\n \n \n \n \n One or more query parameters are invalid.\n \n \n \n \n One or more query parameters are out of range.\n \n \n \n \n The URI is invalid.\n \n \n \n \n The HTTP verb is invalid.\n \n \n \n \n The metadata key is empty.\n \n \n \n \n The request body is too large.\n \n \n \n \n The specified XML document is invalid.\n \n \n \n \n An internal error occurred.\n \n \n \n \n Authentication failed.\n \n \n \n \n The specified MD5 hash does not match the server value.\n \n \n \n \n The specified MD5 hash is invalid.\n \n \n \n \n The input is out of range.\n \n \n \n \n The input is invalid.\n \n \n \n \n The operation timed out.\n \n \n \n \n The specified resource was not found.\n \n \n \n \n The specified metadata is invalid.\n \n \n \n \n The specified metadata is too large.\n \n \n \n \n The specified condition was not met.\n \n \n \n \n The specified range is invalid.\n \n \n \n \n The specified container was not found.\n \n \n \n \n The specified container already exists.\n \n \n \n \n The specified container is disabled.\n \n \n \n \n The specified container is being deleted.\n \n \n \n \n The server is busy.\n \n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild/Settings.StyleCop", "content": "\n \n \n .\n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild/makefile", "content": "\r\nMSBUILD=C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\r\n#MSBUILD=C:/Windows/Microsoft.NET/Framework/v4.0.30319/MSBuild.exe\r\n\r\n#BIN = ../../bin_tools/NuBuild\r\n#\t\r\n#NUBUILD_SOURCES = $(wildcard NuBuild/*.cs) NuBuild/NuBuild.csproj\r\n#\r\n#all: $(BIN)/NuBuild.exe\r\n#\r\n#$(BIN)/NuBuild.exe: $(NUBUILD_SOURCES) NuBuild.sln\r\n#\t$(MSBUILD) NuBuild.sln\r\n\r\nall: me\r\n\r\nme: \r\n\techo hi\r\n\t$(MSBUILD) NuBuild.sln\r\n\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/.gitignore", "content": "*.suo\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/AzureManager/App.config", "content": "\n\n \n \n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild2/AzureManager/AzureAccount.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace AzureManager\r\n{\r\n using System;\r\n using System.Globalization;\r\n using System.Security.Cryptography.X509Certificates;\r\n using Microsoft.WindowsAzure;\r\n using Microsoft.WindowsAzure.Management.Compute;\r\n using Microsoft.WindowsAzure.Management.Compute.Models;\r\n using Microsoft.WindowsAzure.Management.Storage;\r\n using Microsoft.WindowsAzure.Management.Storage.Models;\r\n\r\n /// \r\n /// Representation of an Azure Account Subscription.\r\n /// \r\n public class AzureAccount\r\n {\r\n /// \r\n /// Credentials associated with this Azure account.\r\n /// \r\n private SubscriptionCloudCredentials credentials;\r\n\r\n /// \r\n /// ComputeManagementClient for managing Azure compute resources.\r\n /// \r\n private ComputeManagementClient computeManager;\r\n\r\n /// \r\n /// StorageManagementClient for managing Azure storage resources.\r\n /// \r\n private StorageManagementClient storageManager;\r\n\r\n /// \r\n /// Initializes a new instance of the AzureAccount class.\r\n /// \r\n /// Subscription ID of the Azure account.\r\n /// X509 certificate used for authentication.\r\n public AzureAccount(string subscriptionId, X509Certificate2 cert)\r\n {\r\n this.credentials = new CertificateCloudCredentials(subscriptionId, cert);\r\n\r\n this.computeManager = CloudContext.Clients.CreateComputeManagementClient(this.credentials);\r\n this.storageManager = CloudContext.Clients.CreateStorageManagementClient(this.credentials);\r\n }\r\n\r\n /// \r\n /// Gets the service information for the specified service.\r\n /// \r\n /// Name of the service to query.\r\n /// A HostedServiceGetDetailedResponse object containing the information.\r\n public HostedServiceGetDetailedResponse GetServiceInformation(string serviceName)\r\n {\r\n HostedServiceGetDetailedResponse service;\r\n service = this.computeManager.HostedServices.GetDetailed(serviceName);\r\n\r\n return service;\r\n }\r\n\r\n /// \r\n /// Creates a service specification (configuration?) entry in Azure's database.\r\n /// This reserves the (Azure-unique) DNS prefix name used to access the service.\r\n /// \r\n /// \r\n /// Note that this does not deploy and start the service.\r\n /// \r\n /// Name of the cloud service.\r\n /// Geographical region where the service should be hosted.\r\n public void CreateServiceSpecification(string serviceName, string location)\r\n {\r\n // Required: Label, ServiceName.\r\n // One Required (but not both): AffinityGroup, Location.\r\n // Optional: Description, ExtendedProperties,\r\n HostedServiceCreateParameters parameters = new HostedServiceCreateParameters();\r\n parameters.Label = serviceName;\r\n parameters.ServiceName = serviceName;\r\n parameters.Location = location;\r\n\r\n this.computeManager.HostedServices.Create(parameters);\r\n }\r\n\r\n /// \r\n /// Deletes the specified service deployment.\r\n /// \r\n /// Name of the service\r\n /// Environment for this deployment (e.g. Production or Staging).\r\n public void DeleteDeployment(string serviceName, DeploymentSlot deploymentSlot)\r\n {\r\n this.computeManager.Deployments.DeleteBySlot(serviceName, deploymentSlot);\r\n }\r\n\r\n /// \r\n /// Deploys a service.\r\n /// \r\n /// \r\n /// Note that the service specification must already have been created.\r\n /// \r\n /// Name of the service.\r\n /// Name of this deployment.\r\n /// Environment for this deployment (e.g. Production or Staging).\r\n /// Deployment configuration information (i.e. .cscfg file contents).\r\n /// URI for blob containing package (i.e. .cspkg) file contents.\r\n /// Whether to start the deployment immediately after it is created.\r\n public void DeployService(\r\n string serviceName,\r\n string deploymentName,\r\n DeploymentSlot deploymentSlot,\r\n string configuration,\r\n Uri packageBlob,\r\n bool startImmediately = true)\r\n {\r\n // Required: Configuration, Label, Name, PackageUri.\r\n // Optional: ExtendedProperties, ExtensionConfiguration, StartDeployment, TreatWarningsAsError.\r\n DeploymentCreateParameters parameters = new DeploymentCreateParameters();\r\n parameters.Configuration = configuration; // Contents of .cscfg file.\r\n parameters.Label = serviceName; // Name for hosted service. Does not need to match serviceName.\r\n parameters.Name = deploymentName; // Unique name for this particular deployment.\r\n parameters.PackageUri = packageBlob; // URI for blob containing .cspkg file.\r\n parameters.StartDeployment = startImmediately; // Whether to start the deployment immediately after it is created.\r\n\r\n this.computeManager.Deployments.Create(serviceName, deploymentSlot, parameters);\r\n }\r\n\r\n /// \r\n /// Gets the connection string for the given storage account.\r\n /// \r\n /// A storage account name.\r\n /// The connection string for the given storage account.\r\n public string GetConnectionStringForStorageAccount(string storageAccountName)\r\n {\r\n // This makes a call to the Azure infrastructure to get the keys.\r\n // REVIEW: Check status code of the response?\r\n StorageAccountGetKeysResponse keys = this.storageManager.StorageAccounts.GetKeys(storageAccountName);\r\n\r\n string connectionString = string.Format(\r\n CultureInfo.InvariantCulture,\r\n \"DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1}\",\r\n storageAccountName,\r\n keys.PrimaryKey);\r\n\r\n return connectionString;\r\n }\r\n\r\n /// \r\n /// Procedure for testing random things.\r\n /// \r\n public void TestSomething()\r\n {\r\n HostedServiceListResponse response;\r\n response = this.computeManager.HostedServices.List();\r\n Console.WriteLine(\"List of hosted services:\");\r\n foreach (HostedServiceListResponse.HostedService service in response.HostedServices)\r\n {\r\n Console.WriteLine(\"\\n{0}\\n\", service.ServiceName);\r\n\r\n // Note: The HostedServiceListResponse.HostedService class\r\n // contains many of the same properties as the\r\n // HostedServiceGetDetailedResponse class.\r\n }\r\n }\r\n\r\n /// \r\n /// Displays all the deployments in a given service.\r\n /// \r\n /// \r\n /// This is an alternative way to access the deployments.\r\n /// HostedServiceGetDetailedResponse.Deployment is another.\r\n /// \r\n /// The service to query.\r\n public void ShowDeployments(string serviceName)\r\n {\r\n DeploymentGetResponse response;\r\n\r\n try\r\n {\r\n response = this.computeManager.Deployments.GetBySlot(serviceName, DeploymentSlot.Production);\r\n Console.WriteLine(\"Production Deployment\");\r\n Console.WriteLine(\"Label = {0}\", response.Label);\r\n }\r\n catch (Microsoft.WindowsAzure.CloudException except)\r\n {\r\n Console.WriteLine(\"Show Deployment Exception: {0}\", except.ErrorMessage);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/AzureManager/AzureManager.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {8ADB4B14-715D-4CE1-BFD2-E7D65007CE5C}\r\n Exe\r\n Properties\r\n AzureManager\r\n AzureManager\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n ..\\..\\..\\bin_tools\\NuBuild\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n ..\\References\\Microsoft.Threading.Tasks.dll\r\n \r\n \r\n ..\\References\\Microsoft.WindowsAzure.Common.dll\r\n \r\n \r\n ..\\References\\Microsoft.WindowsAzure.Common.NetFramework.dll\r\n \r\n \r\n False\r\n ..\\References\\Microsoft.WindowsAzure.Management.Compute.dll\r\n \r\n \r\n ..\\References\\Microsoft.WindowsAzure.Management.Storage.dll\r\n \r\n \r\n False\r\n ..\\References\\Microsoft.WindowsAzure.Storage.dll\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n CustomDictionary.xml\r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/tools/NuBuild2/AzureManager/Program.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace AzureManager\r\n{\r\n using System;\r\n using System.Collections.Specialized;\r\n using System.Configuration;\r\n using System.IO;\r\n using System.Security.Cryptography.X509Certificates;\r\n using Microsoft.WindowsAzure.Management.Compute.Models;\r\n using Microsoft.WindowsAzure.Storage;\r\n using Microsoft.WindowsAzure.Storage.Blob;\r\n\r\n /// \r\n /// Program to manage Azure cloud resources used by NuBuild.\r\n /// \r\n public class Program\r\n {\r\n /// \r\n /// Name of our service (hard-wired).\r\n /// \r\n private const string NuBuildServiceName = \"NuBuildExecutionService\";\r\n\r\n /// \r\n /// Name of the deployment package blob we use for the \"start\" and\r\n /// \"upload\" commands (hard-wired).\r\n /// \r\n private const string NuBuildServicePackageName = \"NuBuildExecutionEngine\";\r\n\r\n /// \r\n /// Default package file name used by \"deploy\" and \"upload\" commands.\r\n /// Can be overridden by command line argument.\r\n /// \r\n private const string DefaultPackageFilename = \"NuBuildExecutionService.cspkg\";\r\n\r\n /// \r\n /// Default configuration file name used by the \"deploy\" command\r\n /// Can be overridden by command line argument.\r\n /// \r\n private const string DefaultConfigurationFilename = \"ServiceConfiguration.Cloud.cscfg\";\r\n\r\n /// \r\n /// Default number of service instances to \"start\".\r\n /// Can be overridden by command line argument.\r\n /// \r\n private const int DefaultInstanceCount = 10;\r\n\r\n /// \r\n /// Main program entry point.\r\n /// \r\n /// The parameter is unused.\r\n private static void Main(string[] args)\r\n {\r\n Console.WriteLine();\r\n\r\n // Set some defaults.\r\n string packageFilename = DefaultPackageFilename;\r\n string configurationFilename = DefaultConfigurationFilename;\r\n int instanceCount = DefaultInstanceCount;\r\n string command = \"status\";\r\n\r\n // Parse command line arguments.\r\n if (args.Length > 0)\r\n {\r\n command = args[0].ToLower();\r\n\r\n if (args.Length > 1)\r\n {\r\n if (command == \"start\")\r\n {\r\n if (!int.TryParse(args[1], out instanceCount))\r\n {\r\n Usage(-1);\r\n }\r\n }\r\n else\r\n {\r\n packageFilename = args[1];\r\n }\r\n\r\n if (args.Length > 2)\r\n {\r\n configurationFilename = args[2];\r\n }\r\n }\r\n }\r\n\r\n // Get our Azure account information.\r\n AzureAccount azureAccount = GetOurAzureAccount();\r\n\r\n // Perform user requested action.\r\n CloudBlockBlob packageBlob;\r\n switch (command)\r\n {\r\n case \"create\":\r\n azureAccount.CreateServiceSpecification(NuBuildServiceName, \"West US\");\r\n break;\r\n\r\n case \"deploy\":\r\n // Upload our package (.cspkg file) to a blob.\r\n // We name the blob after the package filename.\r\n string blobName = Path.GetFileNameWithoutExtension(packageFilename);\r\n packageBlob = GetPackageBlob(azureAccount, blobName);\r\n packageBlob.UploadFromFile(packageFilename, System.IO.FileMode.Open);\r\n\r\n // Create a new deployment using the desired package blob.\r\n // TODO: Provide an unique name for each deployment?\r\n // REVIEW: Upload to \"Staging\" slot instead?\r\n string configuration = File.ReadAllText(configurationFilename);\r\n azureAccount.DeployService(NuBuildServiceName, \"Production\", DeploymentSlot.Production, configuration, packageBlob.Uri, startImmediately: true);\r\n\r\n Console.WriteLine(\"Issued deployment request\");\r\n break;\r\n\r\n case \"start\":\r\n // Create a new deployment using a hard-coded configuration and a previously uploaded blob.\r\n ServiceConfiguration config = new ServiceConfiguration(\r\n NuBuildServiceName,\r\n \"4\",\r\n \"*\",\r\n \"2014-06.2.4\",\r\n \"CloudExecutionWorker\",\r\n instanceCount);\r\n packageBlob = GetPackageBlob(azureAccount, NuBuildServicePackageName);\r\n azureAccount.DeployService(NuBuildServiceName, \"Production\", DeploymentSlot.Production, config.ToXml(), packageBlob.Uri, startImmediately: true);\r\n\r\n Console.WriteLine(\"Issued deployment request\");\r\n break;\r\n\r\n case \"status\":\r\n HostedServiceGetDetailedResponse serviceInfo = azureAccount.GetServiceInformation(NuBuildServiceName);\r\n DisplayServiceInformation(serviceInfo);\r\n break;\r\n\r\n case \"stop\":\r\n // Delete the Azure deployment.\r\n // This stops the currently running service, but leaves the\r\n // configuration for this service in the Azure database.\r\n azureAccount.DeleteDeployment(NuBuildServiceName, DeploymentSlot.Production);\r\n break;\r\n\r\n case \"test\":\r\n ////azureAccount.TestSomething();\r\n\r\n ServiceConfiguration testConfig = new ServiceConfiguration(NuBuildServiceName, \"4\", \"*\", \"2014-06.2.4\", \"CloudExecutionWorker\", 42);\r\n Console.WriteLine(testConfig.ToXml());\r\n break;\r\n\r\n case \"upload\":\r\n // Upload our package (.cspkg file) to a blob.\r\n packageBlob = GetPackageBlob(azureAccount, NuBuildServicePackageName);\r\n packageBlob.UploadFromFile(packageFilename, System.IO.FileMode.Open);\r\n Console.WriteLine(\"Uploaded package\");\r\n break;\r\n\r\n case \"/?\":\r\n case \"help\":\r\n Usage(0);\r\n break;\r\n\r\n default:\r\n Usage(-1);\r\n break;\r\n }\r\n }\r\n\r\n /// \r\n /// Display a (hopefully) helpful usage message to the user,\r\n /// and exit the process.\r\n /// \r\n /// Process exit code to use.\r\n private static void Usage(int exitcode)\r\n {\r\n Console.WriteLine(\"Usage: AzureManager [create | deploy [package file [config file]] |\");\r\n Console.WriteLine(\" start [instances] | status | stop |\");\r\n Console.WriteLine(\" upload [package file]]\");\r\n Console.WriteLine();\r\n Console.WriteLine(\" where\");\r\n Console.WriteLine(\" instances Number of service instances to start.\");\r\n Console.WriteLine(\" (default: {0})\", DefaultInstanceCount);\r\n Console.WriteLine(\" package file Package file to deploy.\");\r\n Console.WriteLine(\" (default: .\\\\{0})\", DefaultPackageFilename);\r\n Console.WriteLine(\" config file Configuration file for deployment.\");\r\n Console.WriteLine(\" (default: .\\\\{0})\", DefaultConfigurationFilename);\r\n Console.WriteLine();\r\n Console.WriteLine(\" Commands:\");\r\n Console.WriteLine(\" create Create a new service configuration (using hard-wired info).\");\r\n Console.WriteLine(\" deploy Deploy using the given package and configuration\");\r\n Console.WriteLine(\" (overwrites existing hard-wired package blob).\");\r\n Console.WriteLine(\" start Start the given number of instances of an existing package\");\r\n Console.WriteLine(\" named '{0}'.\", NuBuildServicePackageName);\r\n Console.WriteLine(\" status Display the current service and deployment status.\");\r\n Console.WriteLine(\" stop Stop the current deployment of the service.\");\r\n Console.WriteLine(\" upload Upload the given package file to hard-wired package blob\");\r\n Console.WriteLine(\" named '{0}'.\", NuBuildServicePackageName);\r\n Environment.Exit(exitcode);\r\n }\r\n\r\n /// \r\n /// Gets our Azure account.\r\n /// \r\n /// An Azure account.\r\n private static AzureAccount GetOurAzureAccount()\r\n {\r\n string subscriptionId = null;\r\n string certBase64Encoded = null;\r\n\r\n NameValueCollection appSettings = ConfigurationManager.AppSettings;\r\n if (appSettings != null)\r\n {\r\n subscriptionId = appSettings[\"Subscription Id\"];\r\n certBase64Encoded = appSettings[\"Certificate (Base 64 Encoded)\"];\r\n }\r\n\r\n if (string.IsNullOrEmpty(subscriptionId))\r\n {\r\n throw new ConfigurationException(\"Subscription Id setting missing from your AzureManager.exe.config file!\");\r\n }\r\n\r\n if (string.IsNullOrEmpty(certBase64Encoded))\r\n {\r\n throw new ConfigurationException(\"Certificate setting missing from your AzureManager.exe.config file!\");\r\n }\r\n\r\n byte[] cert = Convert.FromBase64String(certBase64Encoded);\r\n X509Certificate2 x509Cert = new X509Certificate2(cert);\r\n AzureAccount azureAccount = new AzureAccount(subscriptionId, x509Cert);\r\n\r\n return azureAccount;\r\n }\r\n\r\n /// \r\n /// Writes selected fields of the give HostedServiceGetDetailedResponse\r\n /// object out to the console.\r\n /// \r\n /// \r\n /// The HostedServiceGetDetailedResponse object to display.\r\n /// \r\n private static void DisplayServiceInformation(HostedServiceGetDetailedResponse service)\r\n {\r\n Console.WriteLine(\"Service Name {0}:\", service.ServiceName);\r\n\r\n Console.WriteLine(\" Date Created = {0}\", service.Properties.DateCreated);\r\n Console.WriteLine(\" Date Last Modified = {0}\", service.Properties.DateLastModified);\r\n Console.WriteLine(\" Description = {0}\", service.Properties.Description);\r\n Console.WriteLine(\" Label = {0}\", service.Properties.Label);\r\n Console.WriteLine(\" Location = {0}\", service.Properties.Location);\r\n Console.WriteLine(\" Status = {0}\", service.Properties.Status);\r\n\r\n#if false\r\n foreach(string size in service.ComputeCapabilities.VirtualMachinesRoleSizes)\r\n {\r\n Console.WriteLine(\"VM Role Size = {0}\", size);\r\n }\r\n\r\n Console.WriteLine(\"URI = {0}\", service.Uri);\r\n#endif\r\n\r\n if (service.Deployments.Count == 0)\r\n {\r\n Console.WriteLine(\" No current deployments!\");\r\n }\r\n\r\n foreach (HostedServiceGetDetailedResponse.Deployment deployment in service.Deployments)\r\n {\r\n Console.WriteLine();\r\n Console.WriteLine(\" Deployment Name {0}:\", deployment.Name);\r\n Console.WriteLine(\" Created = {0}\", deployment.CreatedTime);\r\n Console.WriteLine(\" Label = {0}\", deployment.Label);\r\n Console.WriteLine(\" Slot = {0}\", deployment.DeploymentSlot);\r\n Console.WriteLine(\" Status = {0}\", deployment.Status);\r\n Console.WriteLine(\" Instances = {0}\", deployment.RoleInstances.Count);\r\n ////Console.WriteLine(deployment.Configuration);\r\n }\r\n }\r\n\r\n /// \r\n /// Uploads the given file to the specified Azure blob.\r\n /// \r\n /// Azure account to use.\r\n /// Name of the blob to upload to.\r\n /// A reference to the CloudBlockBlob.\r\n private static CloudBlockBlob GetPackageBlob(AzureAccount azureAccount, string blobName)\r\n {\r\n // Get connection string for our storage account.\r\n // TODO: Remove hard-coded storage account name.\r\n const string StorageAccountName = \"ironcladstoretest\";\r\n string connectionString = azureAccount.GetConnectionStringForStorageAccount(StorageAccountName);\r\n\r\n ////Console.WriteLine(\"Using connection string \" + connectionString);\r\n\r\n // Use our storage account connection string to get our CloudStorageAccount.\r\n CloudStorageAccount storageAccount = CloudStorageAccount.Parse(connectionString);\r\n\r\n ////Console.WriteLine(\"Storage account URI = {0}\", storageAccount.BlobEndpoint.AbsoluteUri);\r\n\r\n // Use our CloudStorageAccount to create a CloudBlobClient.\r\n CloudBlobClient blobClient = storageAccount.CreateCloudBlobClient();\r\n\r\n ////Console.WriteLine(\"Blob base URI = {0}\", blobClient.BaseUri);\r\n\r\n // Find or create our \"packages\" blob storage container.\r\n CloudBlobContainer container = blobClient.GetContainerReference(\"packages\");\r\n container.CreateIfNotExists(BlobContainerPublicAccessType.Container);\r\n\r\n // Get the package blob we want to deploy.\r\n // This is a 'cspkg' file stored as a blob.\r\n CloudBlockBlob packageBlob = container.GetBlockBlobReference(blobName);\r\n return packageBlob;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/AzureManager/Properties/AssemblyInfo.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nusing System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n// General Information about an assembly is controlled through the following \r\n// set of attributes. Change these attribute values to modify the information\r\n// associated with an assembly.\r\n[assembly: AssemblyTitle(\"AzureManager\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"AzureManager\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2015\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n// Setting ComVisible to false makes the types in this assembly not visible \r\n// to COM components. If you need to access a type in this assembly from \r\n// COM, set the ComVisible attribute to true on that type.\r\n[assembly: ComVisible(false)]\r\n\r\n// The following GUID is for the ID of the typelib if this project is exposed to COM\r\n[assembly: Guid(\"067c0004-c47f-4a37-b93d-009d5718b965\")]\r\n\r\n// Version information for an assembly consists of the following four values:\r\n//\r\n// Major Version\r\n// Minor Version \r\n// Build Number\r\n// Revision\r\n//\r\n// You can specify all the values or you can default the Build and Revision Numbers \r\n// by using the '*' as shown below:\r\n// [assembly: AssemblyVersion(\"1.0.*\")]\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/AzureManager/ServiceConfiguration.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace AzureManager\r\n{\r\n using System;\r\n using System.Diagnostics;\r\n using System.Globalization;\r\n using System.IO;\r\n using System.Text;\r\n using System.Xml;\r\n\r\n /// \r\n /// \r\n /// Representation of the \"service configuration\" (.cscfg) file contents\r\n /// used for Azure deployments.\r\n /// \r\n /// \r\n /// \r\n /// \r\n /// Format is defined by the \"Azure Service Configuration Schema\".\r\n /// See .\r\n /// This class implements only the small subset of the schema that we use.\r\n /// \r\n /// \r\n /// This is the format of the \"Configuration\" member of various\r\n /// deployment-related classes (DeploymentChangeConfigurationParameters,\r\n /// DeploymentCreateParameters, DeploymentUpgradeParameters,\r\n /// HostedServiceGetDetailedResponse.Deployment, etc).\r\n /// \r\n /// \r\n /// Note that this is separate from the \"Azure Service Definition Schema\"\r\n /// (.csdef file) used to create the service proper.\r\n /// \r\n /// \r\n public class ServiceConfiguration\r\n {\r\n /// \r\n /// XML namespace for this object.\r\n /// \r\n public const string XmlNamespace = \"http://schemas.microsoft.com/ServiceHosting/2008/10/ServiceConfiguration\";\r\n\r\n /// \r\n /// XML element name for this object.\r\n /// \r\n public const string XmlTag = \"ServiceConfiguration\";\r\n\r\n /// \r\n /// XML attribute name for our service name field.\r\n /// \r\n private const string XmlServiceNameAttribute = \"serviceName\";\r\n\r\n /// \r\n /// XML attribute name for our OS family field.\r\n /// \r\n private const string XmlOSFamilyAttribute = \"osFamily\";\r\n\r\n /// \r\n /// XML attribute name for our OS version field.\r\n /// \r\n private const string XmlOSVersionAttribute = \"osVersion\";\r\n\r\n /// \r\n /// XML attribute name for our schema version field.\r\n /// \r\n private const string XmlSchemaVersionAttribute = \"schemaVersion\";\r\n\r\n /// \r\n /// XML element name for our role field.\r\n /// \r\n private const string XmlRoleElement = \"Role\";\r\n\r\n /// \r\n /// XML attribute name for our role name field.\r\n /// \r\n private const string XmlRoleNameAttribute = \"name\";\r\n\r\n // Note we don't currently support the \"vmName\" attribute.\r\n\r\n /// \r\n /// XML element name for our instances field.\r\n /// \r\n private const string XmlInstancesElement = \"Instances\";\r\n\r\n /// \r\n /// XML element name for our instance count field.\r\n /// \r\n private const string XmlInstanceCountAttribute = \"count\";\r\n\r\n /// \r\n /// XML element name for our configuration settings field.\r\n /// \r\n /// \r\n /// Note we don't currently support any configuration settings.\r\n /// \r\n private const string XmlConfigurationSettingsElement = \"ConfigurationSettings\";\r\n\r\n // Note we don't currently support any certificates.\r\n\r\n // Note we don't currently support the NetworkConfiguration element.\r\n\r\n /// \r\n /// Name of the service.\r\n /// \r\n private string serviceName;\r\n\r\n /// \r\n /// OS Family.\r\n /// \r\n private string osFamily;\r\n\r\n /// \r\n /// OS Version.\r\n /// \r\n private string osVersion;\r\n\r\n /// \r\n /// Schema Version.\r\n /// \r\n private string schemaVersion;\r\n\r\n /// \r\n /// Name of the role.\r\n /// \r\n private string roleName;\r\n\r\n /// \r\n /// Count of the number of role instances.\r\n /// \r\n private int instanceCount;\r\n\r\n /// \r\n /// Initializes a new instance of the ServiceConfiguration class.\r\n /// \r\n /// Name of the cloud service.\r\n /// Guest OS that will run on role instances in the cloud service.\r\n /// Version of the Guest OS that will run on role instances in the cloud service.\r\n /// Version of the Service Configuration schema.\r\n /// Name of the role.\r\n /// Number of instances to deploy for this role.\r\n public ServiceConfiguration(\r\n string serviceName,\r\n string osFamily,\r\n string osVersion,\r\n string schemaVersion,\r\n string roleName,\r\n int instanceCount)\r\n {\r\n this.serviceName = serviceName;\r\n this.osFamily = osFamily;\r\n this.osVersion = osVersion;\r\n this.schemaVersion = schemaVersion;\r\n this.roleName = roleName;\r\n this.instanceCount = instanceCount;\r\n }\r\n\r\n /// \r\n /// Gets the service name.\r\n /// \r\n public string ServiceName\r\n {\r\n get { return this.serviceName; }\r\n }\r\n\r\n /// \r\n /// Gets the OS Family.\r\n /// \r\n public string OsFamily\r\n {\r\n get { return this.osFamily; }\r\n }\r\n\r\n /// \r\n /// Gets the OS Version.\r\n /// \r\n public string OsVersion\r\n {\r\n get { return this.osVersion; }\r\n }\r\n\r\n /// \r\n /// Gets the Schema Version.\r\n /// \r\n public string SchemaVersion\r\n {\r\n get { return this.schemaVersion; }\r\n }\r\n\r\n /// \r\n /// Gets the name of the role.\r\n /// \r\n public string RoleName\r\n {\r\n get { return this.roleName; }\r\n }\r\n\r\n /// \r\n /// Gets the number of instances.\r\n /// \r\n public int InstanceCount\r\n {\r\n get { return this.instanceCount; }\r\n }\r\n\r\n /// \r\n /// Creates a ServiceConfiguration from an XML representation.\r\n /// \r\n /// \r\n /// A string containing an XML document representing a request.\r\n /// \r\n /// \r\n /// A new request corresponding to the XML representation read.\r\n /// \r\n public static ServiceConfiguration FromXml(string xs)\r\n {\r\n XmlReader xr = XmlReader.Create(new StringReader(xs));\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n break;\r\n }\r\n }\r\n\r\n return ReadXml(xr);\r\n }\r\n\r\n /// \r\n /// Helper function to read an XML element (not a full document)\r\n /// representing an Azure Service Configuration.\r\n /// \r\n /// \r\n /// Note that the XmlReader is expected to be positioned in the XML\r\n /// document such that the current node is a request element.\r\n /// \r\n /// The XmlReader object to read from.\r\n /// \r\n /// A new request corresponding to the XML representation read.\r\n /// \r\n public static ServiceConfiguration ReadXml(XmlReader xr)\r\n {\r\n Debug.Assert(xr.Name.Equals(ServiceConfiguration.XmlTag), \"Invalid call\");\r\n\r\n string serviceName = xr.GetAttribute(ServiceConfiguration.XmlServiceNameAttribute);\r\n string osFamily = xr.GetAttribute(ServiceConfiguration.XmlOSFamilyAttribute);\r\n string osVersion = xr.GetAttribute(ServiceConfiguration.XmlOSVersionAttribute);\r\n string schemaVersion = xr.GetAttribute(ServiceConfiguration.XmlSchemaVersionAttribute);\r\n\r\n string roleName = string.Empty;\r\n int instanceCount = 0;\r\n\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n switch (xr.Name)\r\n {\r\n case XmlRoleElement:\r\n roleName = xr.GetAttribute(ServiceConfiguration.XmlRoleNameAttribute);\r\n break;\r\n\r\n case XmlInstancesElement:\r\n string temp = xr.GetAttribute(ServiceConfiguration.XmlInstanceCountAttribute);\r\n instanceCount = int.Parse(temp);\r\n break;\r\n\r\n case XmlConfigurationSettingsElement:\r\n break;\r\n }\r\n }\r\n else if (xr.NodeType == XmlNodeType.EndElement)\r\n {\r\n if (xr.Name.Equals(ServiceConfiguration.XmlTag))\r\n {\r\n break; // All done.\r\n }\r\n }\r\n }\r\n\r\n // REVIEW: Sanity check elements here?\r\n return new ServiceConfiguration(\r\n serviceName,\r\n osFamily,\r\n osVersion,\r\n schemaVersion,\r\n roleName,\r\n instanceCount);\r\n }\r\n\r\n /// \r\n /// Creates an XML document representing this cloud execution request.\r\n /// \r\n /// \r\n /// A string containing an XML document representing this request.\r\n /// \r\n public string ToXml()\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n XmlWriterSettings settings = new XmlWriterSettings();\r\n settings.Indent = true;\r\n ////settings.OmitXmlDeclaration = true;\r\n XmlWriter xw = XmlWriter.Create(sb, settings);\r\n xw.WriteStartDocument();\r\n this.WriteXml(xw);\r\n xw.Close();\r\n return sb.ToString();\r\n }\r\n\r\n /// \r\n /// Helper function to write an XML element (not a full document)\r\n /// representing this result record.\r\n /// \r\n /// The XmlWriter object to write to.\r\n public void WriteXml(XmlWriter xw)\r\n {\r\n // Start writing the element for this object.\r\n xw.WriteStartElement(XmlTag, ServiceConfiguration.XmlNamespace);\r\n xw.WriteAttributeString(ServiceConfiguration.XmlServiceNameAttribute, this.serviceName);\r\n xw.WriteAttributeString(ServiceConfiguration.XmlOSFamilyAttribute, this.osFamily);\r\n xw.WriteAttributeString(ServiceConfiguration.XmlOSVersionAttribute, this.osVersion);\r\n xw.WriteAttributeString(ServiceConfiguration.XmlSchemaVersionAttribute, this.schemaVersion);\r\n\r\n // Start writing the Role element.\r\n xw.WriteStartElement(ServiceConfiguration.XmlRoleElement);\r\n xw.WriteAttributeString(ServiceConfiguration.XmlRoleNameAttribute, this.roleName);\r\n\r\n // Write the Instances element.\r\n xw.WriteStartElement(ServiceConfiguration.XmlInstancesElement);\r\n xw.WriteAttributeString(ServiceConfiguration.XmlInstanceCountAttribute, this.instanceCount.ToString(CultureInfo.InvariantCulture));\r\n xw.WriteEndElement();\r\n\r\n // Write the ConfigurationSettings element.\r\n xw.WriteElementString(ServiceConfiguration.XmlConfigurationSettingsElement, string.Empty);\r\n\r\n // Finish writing the Role element.\r\n xw.WriteEndElement();\r\n\r\n // Finish writing the element for this object.\r\n xw.WriteEndElement();\r\n }\r\n\r\n /// \r\n /// Gets a string representation of this instance.\r\n /// Primarily intended as a debugging aid.\r\n /// \r\n /// A string representation of this instance.\r\n public override string ToString()\r\n {\r\n StringBuilder output = new StringBuilder();\r\n\r\n output.AppendFormat(\"Service Name: {0}\", this.serviceName);\r\n output.AppendLine();\r\n output.AppendFormat(\"OS Family: {0}\", this.osFamily);\r\n output.AppendLine();\r\n output.AppendFormat(\"OS Version: {0}\", this.osVersion);\r\n output.AppendLine();\r\n output.AppendFormat(\"Schema Version: {0}\", this.schemaVersion);\r\n output.AppendLine();\r\n output.AppendFormat(\"Role Name: {0}\", this.roleName);\r\n output.AppendLine();\r\n output.AppendFormat(\"Number of Instances: {0}\", this.instanceCount);\r\n output.AppendLine();\r\n\r\n return output.ToString();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/CloudExecutionEngine/App.config", "content": "\n\n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild2/CloudExecutionEngine/CloudExecutionEngine.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {2668E334-0B79-4023-A621-2D1433CE7C9E}\r\n Exe\r\n Properties\r\n CloudExecutionEngineStandalone\r\n CloudExecutionEngine\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n False\r\n ..\\References\\Microsoft.WindowsAzure.Storage.dll\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {4f3de22c-cae9-408b-aa54-10dcd7e12f09}\r\n CloudExecutionWorker\r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/tools/NuBuild2/CloudExecutionEngine/Program.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace CloudExecutionEngineStandalone\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using CloudExecutionWorker;\r\n\r\n /// \r\n /// Representation of the Cloud Execution Engine.\r\n /// \r\n internal class Program\r\n {\r\n /// \r\n /// Run executable requests posted to the requests queue.\r\n /// \r\n /// The parameter is unused.\r\n public static void Main(string[] args)\r\n {\r\n CloudExecutionEngine engine = new CloudExecutionEngine();\r\n engine.Run();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/CloudExecutionEngine/Properties/AssemblyInfo.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nusing System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n// General Information about an assembly is controlled through the following \r\n// set of attributes. Change these attribute values to modify the information\r\n// associated with an assembly.\r\n[assembly: AssemblyTitle(\"CloudExecutionEngine\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"CloudExecutionEngine\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n// Setting ComVisible to false makes the types in this assembly not visible \r\n// to COM components. If you need to access a type in this assembly from \r\n// COM, set the ComVisible attribute to true on that type.\r\n[assembly: ComVisible(false)]\r\n\r\n// The following GUID is for the ID of the typelib if this project is exposed to COM\r\n[assembly: Guid(\"5ff7c12f-584f-4104-8e04-8f6f63873a02\")]\r\n\r\n// Version information for an assembly consists of the following four values:\r\n//\r\n// Major Version\r\n// Minor Version \r\n// Build Number\r\n// Revision\r\n//\r\n// You can specify all the values or you can default the Build and Revision Numbers \r\n// by using the '*' as shown below:\r\n// [assembly: AssemblyVersion(\"1.0.*\")]\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/CloudExecutionWorker/CloudExecutionEngine.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace CloudExecutionWorker\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using NuBuild;\r\n\r\n /// \r\n /// Representation of the Cloud Execution Engine.\r\n /// \r\n public class CloudExecutionEngine\r\n {\r\n /// \r\n /// Root directory path.\r\n /// \r\n private string virtualIronRoot;\r\n\r\n /// \r\n /// Cloud implementation of the item cache.\r\n /// Used to explicitly store things in the cloud.\r\n /// \r\n private ItemCacheCloud cloudCache;\r\n\r\n /// \r\n /// Multiplexed cloud/local implementation of the item cache.\r\n /// \r\n private IItemCache multiplexedItemCache;\r\n\r\n /// \r\n /// Main queue of client execution requests.\r\n /// \r\n private CloudExecutionQueue mainQueue;\r\n\r\n /// \r\n /// Whether to continue servicing the queue requests.\r\n /// \r\n private bool keepSwimming;\r\n\r\n /// \r\n /// Initializes a new instance of the CloudExecutionEngine class.\r\n /// \r\n public CloudExecutionEngine()\r\n {\r\n // Establish various infrastructure.\r\n // TODO: Clean this up.\r\n this.virtualIronRoot = Directory.GetCurrentDirectory();\r\n string localCacheDirectory = Path.Combine(this.virtualIronRoot, \"nucache\");\r\n this.cloudCache = new ItemCacheCloud();\r\n this.multiplexedItemCache = new ItemCacheMultiplexer(\r\n new ItemCacheLocal(localCacheDirectory),\r\n this.cloudCache,\r\n null);\r\n\r\n Console.WriteLine(\"Accessing execution queue.\");\r\n this.mainQueue = new CloudExecutionQueue();\r\n }\r\n\r\n /// \r\n /// Runs the execution engine, which eternally processes execution\r\n /// requests posted to the main queue.\r\n /// \r\n public void Run()\r\n {\r\n this.keepSwimming = true;\r\n\r\n while (this.keepSwimming)\r\n {\r\n // Pull request off queue.\r\n Console.WriteLine(\"Waiting for new work request.\");\r\n CloudExecutionRequest executionRequest = this.mainQueue.GetRequest(block: true);\r\n if (!this.keepSwimming)\r\n {\r\n // Exit without deleting request from queue.\r\n // Request will become visible again after timeout expires.\r\n break;\r\n }\r\n\r\n // TODO: For now, we immediately delete the requests we take.\r\n // Eventually we'll want to leave the request invisible until\r\n // some timeout expires so that other engines can pick it up\r\n // if we crash.\r\n this.mainQueue.DeleteRequest(executionRequest);\r\n\r\n Console.WriteLine(\"Received request with ID {0}.\", executionRequest.Identifier);\r\n\r\n // Make a progress report to soothe nervous users.\r\n CloudExecutionReport statusUpdate = new CloudExecutionReport(\r\n executionRequest.Identifier,\r\n CloudExecutionReport.StatusCode.InProgress,\r\n 0,\r\n null,\r\n null,\r\n 0,\r\n null);\r\n\r\n // Submit progress report.\r\n this.mainQueue.SubmitReport(statusUpdate, executionRequest.ReportQueue);\r\n\r\n // Do the requested operation.\r\n CloudExecutionReport report = null;\r\n switch (executionRequest.RequestedOperation)\r\n {\r\n case CloudExecutionRequest.Operation.RunExecutable:\r\n report = this.RunAnExecutable(executionRequest);\r\n break;\r\n\r\n case CloudExecutionRequest.Operation.CommitSuicide:\r\n this.keepSwimming = false;\r\n goto case CloudExecutionRequest.Operation.None;\r\n\r\n case CloudExecutionRequest.Operation.DeleteQueue:\r\n this.mainQueue.DeleteQueue(executionRequest.ReportQueue);\r\n goto case CloudExecutionRequest.Operation.None;\r\n\r\n case CloudExecutionRequest.Operation.None:\r\n report = new CloudExecutionReport(\r\n executionRequest.Identifier,\r\n CloudExecutionReport.StatusCode.Completed);\r\n break;\r\n\r\n default:\r\n // ToDo: This should probably be treated as an error.\r\n goto case CloudExecutionRequest.Operation.None;\r\n }\r\n\r\n // Submit report.\r\n this.mainQueue.SubmitReport(report, executionRequest.ReportQueue);\r\n }\r\n }\r\n\r\n /// \r\n /// Stops the execution engine.\r\n /// \r\n public void Stop()\r\n {\r\n this.keepSwimming = false;\r\n }\r\n\r\n /// \r\n /// Run the requested executable and produce a report of the results.\r\n /// \r\n /// The execution request.\r\n /// A report of the results.\r\n private CloudExecutionReport RunAnExecutable(CloudExecutionRequest executionRequest)\r\n {\r\n // REVIEW: How/whether to use this.\r\n BuildObject diagnosticsBase = new BuildObject(Path.Combine(\"nuobj\", \"diagnostics\", \"process\"));\r\n\r\n // Prep working directory with input files and output dirs.\r\n // TODO: The below will throw cache exceptions if something\r\n // isn't there (they should all be though). Need to catch\r\n // these and fail the execution request when this happens.\r\n WorkingDirectory workingDirectory = new WorkingDirectory(this.virtualIronRoot);\r\n foreach (BuildObjectValuePointer inputFile in executionRequest.InputFileMappings)\r\n {\r\n // REVIEW: How to determine cache container here.\r\n ItemCacheContainer container = ItemCacheContainer.Sources;\r\n if (this.multiplexedItemCache.GetItemSize(container, inputFile.ObjectHash) == -1)\r\n {\r\n container = ItemCacheContainer.Objects;\r\n }\r\n\r\n // TODO: Move path/directory manipulation code into\r\n // WorkingDirectory and/or ItemCache.\r\n string inputFilePath = workingDirectory.PathTo(inputFile.RelativePath);\r\n Directory.CreateDirectory(Path.GetDirectoryName(inputFilePath)); // REVIEW: Still neeeded?\r\n this.multiplexedItemCache.FetchItemToFile(\r\n container,\r\n inputFile.ObjectHash,\r\n inputFilePath);\r\n }\r\n\r\n foreach (BuildObject outputFile in executionRequest.OutputFiles)\r\n {\r\n workingDirectory.CreateDirectoryFor(outputFile);\r\n }\r\n\r\n // Run executable.\r\n ProcessInvoker pinv = new ProcessInvoker(\r\n workingDirectory,\r\n executionRequest.Executable,\r\n new string[] { executionRequest.Arguments },\r\n diagnosticsBase,\r\n null, // This is captureStdout. TODO: Should cleanup how this is used in ProcessInvoker.\r\n null); // This is dbgText. REVIEW: How/whether to use this.\r\n\r\n // When ProcessInvoker's constructor returns, the process has\r\n // finished running.\r\n Console.WriteLine(\"Request {0} completed in {1} seconds.\", executionRequest.Identifier, pinv.CpuTime);\r\n\r\n // Store output files in the (cloud) item cache, and create a\r\n // list of the mappings.\r\n List outputFileMappings = new List();\r\n foreach (BuildObject outFile in executionRequest.OutputFiles)\r\n {\r\n if (File.Exists(workingDirectory.PathTo(outFile)))\r\n {\r\n string fileHash = Util.hashFilesystemPath(workingDirectory.PathTo(outFile));\r\n Util.Assert(!string.IsNullOrEmpty(fileHash));\r\n\r\n // Note we explicitly write to the cloud cache here.\r\n this.cloudCache.StoreItemFromFile(ItemCacheContainer.Objects, fileHash, workingDirectory.PathTo(outFile));\r\n outputFileMappings.Add(new BuildObjectValuePointer(fileHash, outFile.getRelativePath()));\r\n }\r\n }\r\n\r\n // Collect the results into a report.\r\n CloudExecutionReport report = new CloudExecutionReport(\r\n executionRequest.Identifier,\r\n CloudExecutionReport.StatusCode.Completed,\r\n pinv.ExitCode,\r\n pinv.GetStdout(),\r\n pinv.GetStderr(),\r\n pinv.CpuTime,\r\n outputFileMappings);\r\n\r\n return report;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/CloudExecutionWorker/CloudExecutionWorker.csproj", "content": "\r\n\r\n \r\n Debug\r\n AnyCPU\r\n 8.0.30703\r\n 2.0\r\n {4F3DE22C-CAE9-408B-AA54-10DCD7E12F09}\r\n Library\r\n Properties\r\n CloudExecutionWorker\r\n CloudExecutionWorker\r\n v4.5\r\n 512\r\n Worker\r\n \r\n \r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n True\r\n \r\n \r\n False\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Designer\r\n \r\n \r\n \r\n \r\n {4d7220c0-3caa-4659-9f16-a564db3ccc1b}\r\n NuBuild\r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/tools/NuBuild2/CloudExecutionWorker/Properties/AssemblyInfo.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nusing System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n// General Information about an assembly is controlled through the following \r\n// set of attributes. Change these attribute values to modify the information\r\n// associated with an assembly.\r\n[assembly: AssemblyTitle(\"CloudExecutionWorker\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"CloudExecutionWorker\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2015\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n// Setting ComVisible to false makes the types in this assembly not visible \r\n// to COM components. If you need to access a type in this assembly from \r\n// COM, set the ComVisible attribute to true on that type.\r\n[assembly: ComVisible(false)]\r\n\r\n// The following GUID is for the ID of the typelib if this project is exposed to COM\r\n[assembly: Guid(\"4143a7eb-b9aa-4dfb-87ac-1b961e44a2e7\")]\r\n\r\n// Version information for an assembly consists of the following four values:\r\n//\r\n// Major Version\r\n// Minor Version \r\n// Build Number\r\n// Revision\r\n//\r\n// You can specify all the values or you can default the Build and Revision Numbers \r\n// by using the '*' as shown below:\r\n// [assembly: AssemblyVersion(\"1.0.*\")]\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/CloudExecutionWorker/WorkerRole.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace CloudExecutionWorker\r\n{\r\n using System;\r\n using System.Diagnostics;\r\n using System.Net;\r\n using Microsoft.WindowsAzure;\r\n using Microsoft.WindowsAzure.Diagnostics;\r\n using Microsoft.WindowsAzure.ServiceRuntime;\r\n\r\n /// \r\n /// Our worker role.\r\n /// This is what Azure knows how to interact with.\r\n /// \r\n /// \r\n /// For information on handling configuration changes\r\n /// .\r\n /// \r\n public class WorkerRole : RoleEntryPoint\r\n {\r\n /// \r\n /// Our CloudExecutionEngine that does the real work.\r\n /// \r\n private CloudExecutionEngine engine;\r\n\r\n /// \r\n /// Azure calls this method to do the main work.\r\n /// If this method returns, Azure will recycle this role instance.\r\n /// \r\n public override void Run()\r\n {\r\n Trace.TraceInformation(\"CloudExecutionWorker entry point called\");\r\n\r\n this.engine = new CloudExecutionEngine();\r\n\r\n // TODO: Multi-thread this.\r\n this.engine.Run();\r\n }\r\n\r\n /// \r\n /// Called when this role instance is brought online by Azure.\r\n /// \r\n /// \r\n /// Whether Azure should proceed with calling our Run method.\r\n /// \r\n public override bool OnStart()\r\n {\r\n // Set the maximum number of concurrent connections.\r\n //// ServicePointManager.DefaultConnectionLimit = 12;\r\n\r\n return base.OnStart();\r\n }\r\n\r\n /// \r\n /// Called after this role instance has been taken offline by Azure\r\n /// but before the process exits.\r\n /// \r\n public override void OnStop()\r\n {\r\n this.engine.Stop();\r\n\r\n base.OnStop();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/CloudExecutionWorker/app.config", "content": "\n\n \n \n \n \n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild2/CloudQueueTool/App.config", "content": "\n\n \n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild2/CloudQueueTool/CloudQueueTool.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {DD7B4AD9-1EB0-47BF-B4C2-5BC1CA85D242}\r\n Exe\r\n Properties\r\n CloudQueueTool\r\n CloudQueueTool\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n False\r\n ..\\References\\Microsoft.WindowsAzure.Storage.dll\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/tools/NuBuild2/CloudQueueTool/Program.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace CloudQueueTool\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Configuration;\r\n using System.IO;\r\n using Microsoft.WindowsAzure.Storage;\r\n using Microsoft.WindowsAzure.Storage.Queue;\r\n\r\n /// \r\n /// Cloud queue management program.\r\n /// \r\n internal class Program\r\n {\r\n /// \r\n /// Acts upon command line arguments.\r\n /// \r\n /// Command line arguments.\r\n private static void Main(string[] args)\r\n {\r\n // Create our CloudQueueClient object.\r\n // REVIEW: Hard-coded connection string index \"Ironclad\".\r\n string connectionString = null;\r\n ConnectionStringSettings settings = ConfigurationManager.ConnectionStrings[\"Ironclad\"];\r\n if (settings != null)\r\n {\r\n connectionString = settings.ConnectionString;\r\n }\r\n\r\n if (string.IsNullOrEmpty(connectionString))\r\n {\r\n throw new ConfigurationException(\"Azure connection string missing from your .exe.config file!\");\r\n }\r\n\r\n CloudStorageAccount storageAccount = CloudStorageAccount.Parse(connectionString);\r\n\r\n CloudQueueClient queueClient = storageAccount.CreateCloudQueueClient();\r\n\r\n switch (args.Length)\r\n {\r\n case 0:\r\n Status(queueClient.ListQueues());\r\n break;\r\n \r\n case 2:\r\n {\r\n CloudQueue queue = queueClient.GetQueueReference(args[1]);\r\n if (!queue.Exists())\r\n {\r\n Console.WriteLine(\"No such queue '{0}'\", args[1]);\r\n return;\r\n }\r\n\r\n queue.FetchAttributes();\r\n\r\n switch (args[0])\r\n {\r\n case \"clear\":\r\n case \"Clear\":\r\n queue.Clear();\r\n Console.WriteLine(\"Queue '{0}' cleared.\", queue.Name);\r\n break;\r\n\r\n case \"peek\":\r\n case \"Peek\":\r\n int numberToPeekAt = (queue.ApproximateMessageCount != null) ? (int)queue.ApproximateMessageCount : 0;\r\n Console.WriteLine(\"Queue '{0}' contains {1} messages:\", queue.Name, numberToPeekAt);\r\n if (numberToPeekAt != 0)\r\n {\r\n // Peek API only allows a maximum of 32 messages to be peeked at.\r\n numberToPeekAt = Math.Min(numberToPeekAt, 32);\r\n\r\n foreach (CloudQueueMessage message in queue.PeekMessages(numberToPeekAt))\r\n {\r\n Console.WriteLine(\r\n \"\\t{0} {1} {2}\",\r\n message.Id,\r\n message.InsertionTime,\r\n message.ExpirationTime);\r\n }\r\n }\r\n\r\n break;\r\n\r\n case \"status\":\r\n case \"Status\":\r\n Status(new CloudQueue[]{queue});\r\n break;\r\n\r\n default:\r\n Usage();\r\n break;\r\n }\r\n }\r\n break;\r\n\r\n default:\r\n Usage();\r\n break;\r\n }\r\n }\r\n\r\n private static void Status(IEnumerable queues)\r\n {\r\n foreach (CloudQueue queue in queues)\r\n {\r\n queue.FetchAttributes();\r\n Console.WriteLine(\"Queue '{0}' contains about {1} messages.\", queue.Name, queue.ApproximateMessageCount);\r\n }\r\n }\r\n\r\n private static void Usage()\r\n {\r\n Console.WriteLine(\"Usage: CloudQueueTool [ ]\");\r\n Console.WriteLine(\"\\t = Clear | Peek | Status\");\r\n Console.WriteLine(\"\\t = reports | requests\");\r\n Console.WriteLine();\r\n Console.WriteLine(\"If given no arguments, CloudQueueTool returns the status of all queues.\");\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/CloudQueueTool/Properties/AssemblyInfo.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nusing System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n// General Information about an assembly is controlled through the following \r\n// set of attributes. Change these attribute values to modify the information\r\n// associated with an assembly.\r\n[assembly: AssemblyTitle(\"CloudQueueTool\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"CloudQueueTool\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n// Setting ComVisible to false makes the types in this assembly not visible \r\n// to COM components. If you need to access a type in this assembly from \r\n// COM, set the ComVisible attribute to true on that type.\r\n[assembly: ComVisible(false)]\r\n\r\n// The following GUID is for the ID of the typelib if this project is exposed to COM\r\n[assembly: Guid(\"0321a4d8-87f1-4467-b44a-b5e355a614b9\")]\r\n\r\n// Version information for an assembly consists of the following four values:\r\n//\r\n// Major Version\r\n// Minor Version \r\n// Build Number\r\n// Revision\r\n//\r\n// You can specify all the values or you can default the Build and Revision Numbers \r\n// by using the '*' as shown below:\r\n// [assembly: AssemblyVersion(\"1.0.*\")]\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/CustomDictionary.xml", "content": "\n\n \n \n asynchronicity \n cscfg \n csdef \n cspkg \n cpu \n Dafny \n filesystem \n ifc \n Ironfleet \n munged \n nuobj \n rejectable \n src \n obj \n \n \n \n \n Nu \n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild2/ItemCacheTool/App.config", "content": "\n\n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild2/ItemCacheTool/CacheState.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace ItemCacheTool\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n using NuBuild;\r\n\r\n public class CacheState\r\n {\r\n private ItemCacheCloud cloudCache;\r\n\r\n private ItemCacheLocal localCache;\r\n\r\n public CacheState()\r\n {\r\n this.cloudCache = new ItemCacheCloud();\r\n this.localCache = new ItemCacheLocal(\r\n Path.Combine(GetDefaultIronRoot(), \"nucache\"));\r\n }\r\n\r\n public ItemCacheCloud GetCloudCache\r\n {\r\n get { return this.cloudCache; }\r\n }\r\n\r\n public ItemCacheLocal GetLocalCache\r\n {\r\n get { return this.localCache; }\r\n }\r\n\r\n public IItemCache[] GetAllCaches\r\n {\r\n get { return new IItemCache[] { this.cloudCache, this.localCache }; }\r\n }\r\n\r\n public ItemCacheContainer[] GetAllContainers\r\n {\r\n get { return (ItemCacheContainer[])Enum.GetValues(typeof(ItemCacheContainer)); }\r\n }\r\n\r\n public IItemCache[] ParseCacheName(string input)\r\n {\r\n if (input == \"*\")\r\n {\r\n return this.GetAllCaches;\r\n }\r\n\r\n if (string.Equals(input, \"cloud\", StringComparison.CurrentCultureIgnoreCase))\r\n {\r\n return new IItemCache[] { this.cloudCache };\r\n }\r\n\r\n if (string.Equals(input, \"local\", StringComparison.CurrentCultureIgnoreCase))\r\n {\r\n return new IItemCache[] { this.localCache };\r\n }\r\n\r\n return null;\r\n }\r\n\r\n public ItemCacheContainer[] ParseContainerName(string input)\r\n {\r\n ItemCacheContainer container;\r\n\r\n if (input == \"*\")\r\n {\r\n return this.GetAllContainers;\r\n }\r\n\r\n if (Enum.TryParse(input, true, out container))\r\n {\r\n if (Enum.IsDefined(typeof(ItemCacheContainer), container))\r\n {\r\n return new ItemCacheContainer[] { container };\r\n }\r\n }\r\n\r\n return null;\r\n }\r\n\r\n /// \r\n /// Gets the default iron root path.\r\n /// \r\n /// String containing the default iron root path.\r\n private static string GetDefaultIronRoot()\r\n {\r\n string assyUri = System.Reflection.Assembly.GetExecutingAssembly().CodeBase;\r\n string assyPath = new Uri(assyUri).LocalPath;\r\n string exepath = Path.GetDirectoryName(assyPath);\r\n exepath = Path.GetFullPath(exepath);\r\n string[] parts = exepath.Split(new char[] { '\\\\' });\r\n int ironIndex = Array.IndexOf(parts, \"iron\");\r\n string rc = string.Join(\"\\\\\", parts.Take(ironIndex + 1));\r\n return rc;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/ItemCacheTool/ItemCacheTool.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {9A231EB8-BDA1-4304-93A1-20457C00D7D9}\r\n Exe\r\n Properties\r\n ItemCacheTool\r\n ItemCacheTool\r\n v4.5\r\n 512\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n bin\\Debug\\\r\n DEBUG;TRACE\r\n prompt\r\n 4\r\n AllRules.ruleset\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n False\r\n ..\\References\\Microsoft.WindowsAzure.Storage.dll\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n {4d7220c0-3caa-4659-9f16-a564db3ccc1b}\r\n NuBuild\r\n \r\n \r\n \r\n \r\n CustomDictionary.xml\r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/tools/NuBuild2/ItemCacheTool/Program.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace ItemCacheTool\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n using Microsoft.WindowsAzure.Storage;\r\n using Microsoft.WindowsAzure.Storage.Blob;\r\n using NuBuild;\r\n\r\n /// \r\n /// Representation of the ItemCacheTool program.\r\n /// \r\n public static class Program\r\n {\r\n /// \r\n /// Program entry point.\r\n /// \r\n /// Command line arguments.\r\n private static void Main(string[] args)\r\n {\r\n CacheState caches = new CacheState();\r\n string query;\r\n IItemCache[] queriedCaches;\r\n ItemCacheContainer[] queriedContainers;\r\n string queriedItems;\r\n DateTimeOffset queriedDate;\r\n\r\n // -\r\n // Default values.\r\n // This corresponds to \"status * *\".\r\n // -\r\n query = \"status\";\r\n queriedCaches = caches.GetAllCaches;\r\n queriedContainers = caches.GetAllContainers;\r\n queriedItems = string.Empty;\r\n queriedDate = DateTimeOffset.MinValue;\r\n\r\n // -\r\n // Parse arguments.\r\n // -\r\n if (args.Length != 0)\r\n {\r\n if (args.Length != 3)\r\n {\r\n if (args.Length == 4)\r\n {\r\n if (!DateTimeOffset.TryParse(args[3], out queriedDate))\r\n {\r\n queriedItems = args[3];\r\n }\r\n }\r\n else\r\n {\r\n Usage(caches);\r\n return;\r\n }\r\n }\r\n\r\n query = args[0];\r\n queriedCaches = caches.ParseCacheName(args[1]);\r\n queriedContainers = caches.ParseContainerName(args[2]);\r\n\r\n if ((queriedCaches == null) || (queriedContainers == null))\r\n {\r\n Usage(caches);\r\n return;\r\n }\r\n }\r\n\r\n // -\r\n // Process request.\r\n // -\r\n switch (query)\r\n {\r\n case \"list\":\r\n case \"List\":\r\n {\r\n CacheStatus(queriedCaches, queriedContainers, true);\r\n break;\r\n }\r\n\r\n case \"compare\":\r\n case \"Compare\":\r\n {\r\n if (queriedCaches.Length < 2)\r\n {\r\n Console.WriteLine(\"Error: can't compare fewer than two caches!\");\r\n Usage(caches);\r\n return;\r\n }\r\n\r\n CompareCacheContainers(queriedCaches, queriedContainers);\r\n break;\r\n }\r\n\r\n case \"status\":\r\n case \"Status\":\r\n {\r\n CacheStatus(queriedCaches, queriedContainers, false);\r\n break;\r\n }\r\n\r\n case \"delete\":\r\n case \"Delete\":\r\n {\r\n if (args.Length < 4)\r\n {\r\n Console.WriteLine(\"Error: missing argument. Need date earlier than or specific item(s) to delete.\");\r\n Usage(caches);\r\n return;\r\n }\r\n\r\n if (queriedDate == DateTimeOffset.MinValue)\r\n {\r\n DeleteItems(queriedCaches, queriedContainers, queriedItems);\r\n }\r\n else\r\n {\r\n DeleteItems(queriedCaches, queriedContainers, queriedDate);\r\n }\r\n\r\n break;\r\n }\r\n\r\n case \"check\":\r\n case \"Check\":\r\n {\r\n CheckResults(queriedCaches, false);\r\n break;\r\n }\r\n\r\n case \"cleanup\":\r\n case \"Cleanup\":\r\n {\r\n CheckResults(queriedCaches, true);\r\n break;\r\n }\r\n\r\n case \"dump\":\r\n case \"Dump\":\r\n {\r\n DumpItems(queriedCaches, queriedContainers, queriedItems);\r\n break;\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Prints a user-friendly message explaining how to use the program.\r\n /// \r\n /// The caches the program is using.\r\n private static void Usage(CacheState caches)\r\n {\r\n string containers = string.Empty;\r\n foreach (ItemCacheContainer container in caches.GetAllContainers)\r\n {\r\n containers += container.ToString() + \" | \";\r\n }\r\n\r\n containers += \" *\";\r\n\r\n Console.WriteLine(\"Usage: ItemCacheTool [ | ]\");\r\n Console.WriteLine(\"\\t = Check | Cleanup | Compare | Delete | List | Status\");\r\n Console.WriteLine(\"\\t = Cloud | Local | *\");\r\n Console.WriteLine(\"\\t = {0}\", containers);\r\n Console.WriteLine(\"\\t [ | ] = specifies item(s) to delete.\");\r\n }\r\n\r\n /// \r\n /// Provides a status report of the number of items in the specified\r\n /// cache containers, and optionally a list of those items.\r\n /// \r\n /// Caches to examine.\r\n /// Containers in those caches to examine.\r\n /// Whether to list the cache contents.\r\n private static void CacheStatus(\r\n IItemCache[] queriedCaches,\r\n ItemCacheContainer[] queriedContainers,\r\n bool listContents)\r\n {\r\n string lineTerminator = \".\";\r\n if (listContents)\r\n {\r\n lineTerminator = \":\";\r\n }\r\n\r\n foreach (IItemCache cache in queriedCaches)\r\n {\r\n foreach (ItemCacheContainer container in queriedContainers)\r\n {\r\n HashSet items = cache.GetItemsInContainer(container);\r\n Console.WriteLine(\"{0} cache {1} container holds {2} items{3}\", cache.Name, container.ToString(), items.Count, lineTerminator);\r\n if (listContents)\r\n {\r\n foreach (string item in items)\r\n {\r\n ////Console.WriteLine(\"Item: {0}, Date:{1}\", item, cache.GetItemLastModifiedTime(container, item));\r\n Console.WriteLine(item);\r\n }\r\n\r\n Console.WriteLine();\r\n }\r\n }\r\n\r\n Console.WriteLine();\r\n }\r\n }\r\n\r\n /// \r\n /// Compares the contents of two caches.\r\n /// \r\n /// Caches to compare.\r\n /// Containers in those caches to compare.\r\n private static void CompareCacheContainers(\r\n IItemCache[] queriedCaches,\r\n ItemCacheContainer[] queriedContainers)\r\n {\r\n foreach (ItemCacheContainer container in queriedContainers)\r\n {\r\n IItemCache cacheA = queriedCaches[0];\r\n IItemCache cacheB = queriedCaches[1];\r\n\r\n HashSet cacheAItems = cacheA.GetItemsInContainer(container);\r\n HashSet cacheBItems = cacheB.GetItemsInContainer(container);\r\n\r\n Console.WriteLine(\"There are {0} items in the {1} cache {2} container.\", cacheAItems.Count, cacheA.Name, container.ToString());\r\n Console.WriteLine(\"There are {0} items in the {1} cache {2} container.\", cacheBItems.Count, cacheB.Name, container.ToString());\r\n\r\n HashSet syncedItems = new HashSet(cacheAItems);\r\n syncedItems.IntersectWith(cacheBItems);\r\n Console.WriteLine(\"There are {0} items present in both cache's {1} container.\", syncedItems.Count, container);\r\n Console.WriteLine();\r\n }\r\n }\r\n\r\n /// \r\n /// Deletes the given items from the given caches and containers.\r\n /// \r\n /// Caches to look in.\r\n /// Containers to look in.\r\n /// Items to delete.\r\n private static void DeleteItems(\r\n IItemCache[] queriedCaches,\r\n ItemCacheContainer[] queriedContainers,\r\n string queriedItems)\r\n {\r\n if (queriedItems == \"*\")\r\n {\r\n if (!DeleteItemsConfirmation())\r\n {\r\n return;\r\n }\r\n }\r\n\r\n foreach (IItemCache cache in queriedCaches)\r\n {\r\n foreach (ItemCacheContainer container in queriedContainers)\r\n {\r\n if (queriedItems == \"*\")\r\n {\r\n HashSet items = cache.GetItemsInContainer(container);\r\n foreach (string item in items)\r\n {\r\n cache.DeleteItem(container, item);\r\n }\r\n }\r\n else\r\n {\r\n cache.DeleteItem(container, queriedItems);\r\n }\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Deletes the items from the given caches and containers\r\n /// that have an earlier last modified time than the given one.\r\n /// \r\n /// Caches to look in.\r\n /// Containers to look in.\r\n /// Date to compare against.\r\n private static void DeleteItems(\r\n IItemCache[] queriedCaches,\r\n ItemCacheContainer[] queriedContainers,\r\n DateTimeOffset queriedDate)\r\n {\r\n if (!DeleteItemsConfirmation())\r\n {\r\n return;\r\n }\r\n\r\n foreach (IItemCache cache in queriedCaches)\r\n {\r\n foreach (ItemCacheContainer container in queriedContainers)\r\n {\r\n HashSet items = cache.GetItemsInContainer(container);\r\n foreach (string item in items)\r\n {\r\n DateTimeOffset? lastModified = cache.GetItemLastModifiedTime(container, item);\r\n if (lastModified.HasValue && (lastModified.Value.CompareTo(queriedDate) < 0))\r\n {\r\n cache.DeleteItem(container, item);\r\n }\r\n }\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Asks the user for confirmation that deleting a large number of cache items is okay.\r\n /// \r\n /// True if deletion is okay, false otherwise.\r\n private static bool DeleteItemsConfirmation()\r\n {\r\n string input;\r\n string annoyingConfirmationString = \"Yes I mean to do this!\";\r\n\r\n Console.WriteLine(\"You are about to delete a potentially large number of cache items!\");\r\n Console.WriteLine(\"To proceed, please enter '{0}':\", annoyingConfirmationString);\r\n input = Console.ReadLine();\r\n if (input != annoyingConfirmationString)\r\n {\r\n Console.WriteLine(\"Your input didn't match. Exiting without deleting anything.\");\r\n return false;\r\n }\r\n\r\n return true;\r\n }\r\n\r\n /// \r\n /// Dumps the given items from the given caches and containers.\r\n /// \r\n /// Caches to look in.\r\n /// Containers to look in.\r\n /// Items to dump.\r\n private static void DumpItems(\r\n IItemCache[] queriedCaches,\r\n ItemCacheContainer[] queriedContainers,\r\n string queriedItems)\r\n {\r\n foreach (IItemCache cache in queriedCaches)\r\n {\r\n foreach (ItemCacheContainer container in queriedContainers)\r\n {\r\n if (queriedItems == \"*\")\r\n {\r\n HashSet items = cache.GetItemsInContainer(container);\r\n foreach (string item in items)\r\n {\r\n DumpItem(cache, container, item);\r\n }\r\n }\r\n else\r\n {\r\n DumpItem(cache, container, queriedItems);\r\n }\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Dumps the given item from the given cache and container.\r\n /// \r\n /// Cache to look in.\r\n /// Container to look in.\r\n /// Item to dump.\r\n private static void DumpItem(IItemCache cache, ItemCacheContainer container, string item)\r\n {\r\n#if true\r\n byte[] content = cache.FetchItem(container, item);\r\n if (content != null)\r\n {\r\n BinaryWriter writer = new BinaryWriter(Console.OpenStandardOutput());\r\n writer.Write(content);\r\n writer.Close();\r\n }\r\n#endif\r\n#if false\r\n ResultSummaryRecord record = FetchRecord(cache, container, item);\r\n if (record != null)\r\n {\r\n Console.WriteLine();\r\n Console.WriteLine(\"IsVerificationTimeout = {0}\", record.IsVerificationTimeout);\r\n Console.WriteLine(\"IsFailure = {0}\", record.IsFailure);\r\n }\r\n else\r\n {\r\n Console.WriteLine();\r\n Console.WriteLine(\"FetchRecord failed for {0}\", item);\r\n }\r\n#endif\r\n }\r\n\r\n /// \r\n /// Checks the given cache(s) Results and FailedResults for goodness.\r\n /// \r\n /// Caches to check.\r\n /// Whether to cleanup after bad cache entries.\r\n private static void CheckResults(\r\n IItemCache[] queriedCaches,\r\n bool cleanup)\r\n {\r\n // We can do this for Local, Cloud, or both.\r\n foreach (IItemCache cache in queriedCaches)\r\n {\r\n // We have one Objects container for objects referenced by\r\n // results in both the Results and FailedResults containers.\r\n HashSet objects = cache.GetItemsInContainer(ItemCacheContainer.Objects);\r\n\r\n // Likewise, we have only one Sources container.\r\n // REVIEW: Should a \"source\" ever show up as a verb result?\r\n HashSet sources = cache.GetItemsInContainer(ItemCacheContainer.Sources);\r\n\r\n // We initialize the orphanedObjects set to all objects and\r\n // then remove objects from the set when we find them listed\r\n // in a result (stored in either Results or FailedResults).\r\n HashSet orphanedObjects = cache.GetItemsInContainer(ItemCacheContainer.Objects);\r\n\r\n // We check both successful and failed results.\r\n foreach (ItemCacheContainer resultsContainer in new ItemCacheContainer[] { ItemCacheContainer.Results, ItemCacheContainer.FailedResults })\r\n {\r\n HashSet parseErrors = new HashSet();\r\n\r\n // Misfiled results (i.e. failures in Results container or\r\n // non-failures in FailedResults container).\r\n HashSet misfiledResults = new HashSet();\r\n\r\n // Results that are missing one or more ouput objects.\r\n HashSet resultsMissingOutputs = new HashSet();\r\n\r\n HashSet missingOutputHashes = new HashSet();\r\n HashSet missingOutputPaths = new HashSet();\r\n int timeouts = 0;\r\n int failures = 0;\r\n int missing = 0;\r\n\r\n HashSet results = cache.GetItemsInContainer(resultsContainer);\r\n foreach (string result in results)\r\n {\r\n ResultSummaryRecord record = FetchRecord(cache, resultsContainer, result);\r\n if (record == null)\r\n {\r\n Console.WriteLine(\"Parse error in {0}.\", result);\r\n parseErrors.Add(result);\r\n }\r\n else\r\n {\r\n if (record.IsFailure)\r\n {\r\n if (resultsContainer == ItemCacheContainer.Results)\r\n {\r\n // We shouldn't have any failures in Results!\r\n misfiledResults.Add(result);\r\n }\r\n\r\n if (record.IsVerificationTimeout)\r\n {\r\n ////Console.WriteLine(\"Timeout in {0}.\", result);\r\n timeouts++;\r\n }\r\n else\r\n {\r\n ////Console.WriteLine(\"Failure in {0}.\", result);\r\n failures++;\r\n }\r\n }\r\n else if (resultsContainer == ItemCacheContainer.FailedResults)\r\n {\r\n // We should only have failures in FailedResults!\r\n misfiledResults.Add(result);\r\n }\r\n\r\n // Verify each output is in the cache.\r\n bool hasMissingOuputs = false;\r\n foreach (BuildObjectValuePointer output in record.Outputs)\r\n {\r\n if (objects.Contains(output.ObjectHash))\r\n {\r\n // Output present in object cache.\r\n // Remove it from orphaned objects list.\r\n orphanedObjects.Remove(output.ObjectHash);\r\n }\r\n else if (sources.Contains(output.ObjectHash))\r\n {\r\n // Output present in sources cache.\r\n Console.WriteLine(\"Has 'source' file listed as an output: {0}!\", result);\r\n }\r\n else\r\n {\r\n // Output missing from both object and sources caches.\r\n hasMissingOuputs = true;\r\n missingOutputHashes.Add(output.ObjectHash);\r\n missingOutputPaths.Add(output.RelativePath);\r\n missing++;\r\n Console.WriteLine(\"Missing Output Listed in {0}, Object {1} ({2}).\", result, output.ObjectHash, output.RelativePath);\r\n }\r\n }\r\n\r\n if (hasMissingOuputs)\r\n {\r\n resultsMissingOutputs.Add(result);\r\n }\r\n }\r\n }\r\n\r\n Console.WriteLine();\r\n Console.WriteLine(\"Checked {0} results in {1} cache {2} container:\", results.Count, cache.Name, resultsContainer.ToString());\r\n Console.WriteLine(\"Corrupted (parsing errors or otherwise unreadable): {0}\", parseErrors.Count);\r\n Console.WriteLine(\"Filed in wrong container: {0}\", misfiledResults.Count);\r\n Console.WriteLine(\"Timeouts: {0}, Other failures: {1}, Total failures: {2}\", timeouts, failures, timeouts + failures);\r\n Console.WriteLine(\"Missing at least one output object: {0}\", resultsMissingOutputs.Count);\r\n Console.WriteLine(\"Total missing output objects: {0}, Unique contents: {1}, Unique paths: {2}\", missing, missingOutputHashes.Count, missingOutputPaths.Count);\r\n Console.WriteLine();\r\n\r\n if (cleanup)\r\n {\r\n if (misfiledResults.Count != 0)\r\n {\r\n Console.Write(\"Deleting misfiled results...\");\r\n foreach (string misfiledResult in misfiledResults)\r\n {\r\n cache.DeleteItem(resultsContainer, misfiledResult);\r\n }\r\n\r\n Console.WriteLine(\"Done.\");\r\n }\r\n\r\n if (resultsMissingOutputs.Count != 0)\r\n {\r\n Console.Write(\"Deleting results with missing outputs...\");\r\n foreach (string resultMissingOutputs in resultsMissingOutputs)\r\n {\r\n cache.DeleteItem(resultsContainer, resultMissingOutputs);\r\n }\r\n\r\n Console.WriteLine(\"Done.\");\r\n }\r\n\r\n Console.WriteLine();\r\n }\r\n }\r\n\r\n // REVIEW: in at least one instance, we cache an intermediate\r\n // object that isn't referenced by a result. That instance is\r\n // DafnyIncludes.ExpandDafny(), which is called from\r\n // DafnyCompileOneVerb. This is to allow cloud execution of the\r\n // process invoke part of the verb's execution (with the dafny\r\n // expansion happening in the verb's getWorker() method). Since\r\n // ExpandDafny() is a work-around for a Dafny issue, it's not\r\n // clear whether we should further accommodate this in the build\r\n // system (i.e. by making ExpandDafny its own verb) or not.\r\n // At any rate, having orphaned objects is not necessarily bad.\r\n Console.WriteLine(\"Orphaned objects not listed in any result: {0}\", orphanedObjects.Count);\r\n\r\n if (cleanup)\r\n {\r\n Console.WriteLine();\r\n\r\n if (orphanedObjects.Count != 0)\r\n {\r\n Console.Write(\"Deleting orphaned objects...\");\r\n foreach (string orphanedObject in orphanedObjects)\r\n {\r\n cache.DeleteItem(ItemCacheContainer.Objects, orphanedObject);\r\n }\r\n\r\n Console.WriteLine(\"Done.\");\r\n }\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Retrieves the requested result from the given cache.\r\n /// \r\n /// Cache to query.\r\n /// Container to query.\r\n /// Result to get.\r\n /// The requested ResultSummaryRecord, or null if not found.\r\n private static ResultSummaryRecord FetchRecord(IItemCache cache, ItemCacheContainer container, string itemHash)\r\n {\r\n byte[] result = cache.FetchItem(container, itemHash);\r\n\r\n if (result != null)\r\n {\r\n MemoryStream resultStream = new MemoryStream(result);\r\n try\r\n {\r\n using (StreamReader inReader = new StreamReader(resultStream))\r\n {\r\n string xmlSummary = inReader.ReadToEnd();\r\n ResultSummaryRecord record = ResultSummaryRecord.FromXml(xmlSummary);\r\n if (record == null)\r\n {\r\n Console.WriteLine(\"FromXml failed for {0}\", itemHash);\r\n }\r\n\r\n return record;\r\n }\r\n }\r\n catch (System.Xml.XmlException ex)\r\n {\r\n Console.WriteLine(\"Malformed xml in {0}: {1}\", itemHash, ex.ToString());\r\n return null;\r\n }\r\n finally\r\n {\r\n resultStream.Dispose();\r\n }\r\n }\r\n else\r\n {\r\n Console.WriteLine(\"FetchItem failed for {0}\", itemHash);\r\n return null;\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/ItemCacheTool/Properties/AssemblyInfo.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nusing System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n// General Information about an assembly is controlled through the following \r\n// set of attributes. Change these attribute values to modify the information\r\n// associated with an assembly.\r\n[assembly: AssemblyTitle(\"ItemCacheTool\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"ItemCacheTool\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n// Setting ComVisible to false makes the types in this assembly not visible \r\n// to COM components. If you need to access a type in this assembly from \r\n// COM, set the ComVisible attribute to true on that type.\r\n[assembly: ComVisible(false)]\r\n\r\n// The following GUID is for the ID of the typelib if this project is exposed to COM\r\n[assembly: Guid(\"47dce4f0-18af-4c9e-b177-4ae324563ed6\")]\r\n\r\n// Version information for an assembly consists of the following four values:\r\n//\r\n// Major Version\r\n// Minor Version \r\n// Build Number\r\n// Revision\r\n//\r\n// You can specify all the values or you can default the Build and Revision Numbers \r\n// by using the '*' as shown below:\r\n// [assembly: AssemblyVersion(\"1.0.*\")]\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/.gitignore", "content": "*.user\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/AbstractId.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class AbstractId\r\n {\r\n private const int MASTER_VERSION = 3; // Bump this to invalidate every verb in all caches.\r\n\r\n private string verbName;\r\n private int version;\r\n private string abstractOnly;\r\n\r\n // PoundDefines should appear in both abstract and concrete descriptions:\r\n // abstract because we run one verb with multiple poundDefine configurations,\r\n // and concrete because the variation appears only in this parameter to the\r\n // verb, not in any input file contents.\r\n private PoundDefines poundDefines;\r\n private string concrete;\r\n\r\n public AbstractId(string verbName, int version, string abstractOnly, PoundDefines poundDefines = null, string concrete = null)\r\n {\r\n this.verbName = verbName;\r\n this.version = version + MASTER_VERSION;\r\n this.abstractOnly = abstractOnly;\r\n this.poundDefines = poundDefines == null ? PoundDefines.empty() : poundDefines;\r\n this.concrete = concrete;\r\n }\r\n\r\n public override bool Equals(object obj)\r\n {\r\n AbstractId other = obj as AbstractId;\r\n if (other != null)\r\n {\r\n return this.verbName == other.verbName\r\n && this.version == other.version\r\n && this.abstractOnly == other.abstractOnly\r\n && this.poundDefines.Equals(other.poundDefines)\r\n && this.concrete == other.concrete;\r\n }\r\n else\r\n {\r\n return false;\r\n }\r\n }\r\n\r\n public override int GetHashCode()\r\n {\r\n return this.ToString().GetHashCode();\r\n }\r\n\r\n public override string ToString()\r\n {\r\n if (this.concrete == null)\r\n {\r\n return string.Format(\"{0}(#{1},{2},{3})\", this.verbName, this.version, this.abstractOnly, this.poundDefines.getAbstractIdString());\r\n }\r\n else\r\n {\r\n return string.Format(\"{0}(#{1},{2},{3},{4})\", this.verbName, this.version, this.abstractOnly, this.poundDefines.getAbstractIdString(), this.concrete);\r\n }\r\n }\r\n\r\n public int CompareTo(object other)\r\n {\r\n return this.ToString().CompareTo(((AbstractId)other).ToString());\r\n }\r\n\r\n public string getConcreteId()\r\n {\r\n // The entire purpose of this class is to avoid encoding the input filename in a verb's concrete identity,\r\n // instead encoding it via the input's hash. That enables two verbs to have the same hash when they have\r\n // the same configuration, and hence converge -- we can reuse the outputs.\r\n // Except that the design is presently flawed: they'd have the same output contents, but not the same\r\n // output locations. Until we work that out, I'm neutering this convergence opportunity to preserve\r\n // soundness. (--jonh)\r\n return this.ToString();\r\n\r\n ////if (this.concrete == null) {\r\n //// return string.Format(\"{0}(#{1},{2})\", this.verbName, this.version, this.poundDefines);\r\n ////} else {\r\n //// return string.Format(\"{0}(#{1},{2},{3})\", this.verbName, this.version, this.poundDefines, this.concrete);\r\n ////}\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/AnnotationScanner.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Text.RegularExpressions;\r\n\r\n internal class AnnotationScanner\r\n {\r\n private BuildObject inputObject;\r\n private List annotations;\r\n private bool complete;\r\n\r\n // Constructor for emitting new/code-assembled annotations.\r\n public AnnotationScanner()\r\n {\r\n this.inputObject = null;\r\n this.annotations = new List();\r\n this.complete = false;\r\n }\r\n\r\n public AnnotationScanner(BuildObject inputObject)\r\n {\r\n this.inputObject = inputObject;\r\n this.annotations = new List();\r\n Regex re = new Regex(\"]*)/>\");\r\n using (TextReader tr = BuildEngine.theEngine.Repository.OpenRead(inputObject))\r\n {\r\n while (true)\r\n {\r\n string line = tr.ReadLine();\r\n if (line == null)\r\n {\r\n break;\r\n }\r\n\r\n Match match = re.Match(line);\r\n if (match.Success)\r\n {\r\n string[] arguments = match.Groups[1].ToString().Split(null).Where(s => s.Length > 0).ToArray();\r\n this.annotations.Add(arguments);\r\n }\r\n }\r\n }\r\n\r\n this.complete = true;\r\n }\r\n\r\n public void addAnnotation(string[] annotation)\r\n {\r\n Util.Assert(!this.complete);\r\n this.annotations.Add(annotation);\r\n }\r\n\r\n public string emit(string commentToken)\r\n {\r\n this.complete = true;\r\n StringBuilder sb = new StringBuilder();\r\n foreach (string[] annotation in this.annotations)\r\n {\r\n sb.AppendLine(commentToken + \"\");\r\n }\r\n\r\n return sb.ToString();\r\n }\r\n\r\n public IEnumerable getAnnotations(string label)\r\n {\r\n return this.annotations.Where(sa => sa[0].Equals(label));\r\n }\r\n\r\n // Look for 0 or 1 instance of a single-valued annotation.\r\n public string getTheAnnotation(string label, string defaultValue)\r\n {\r\n IEnumerable anns = this.getAnnotations(label);\r\n if (anns.Count() == 0)\r\n {\r\n return defaultValue;\r\n }\r\n\r\n string[] ann = anns.First();\r\n if (ann.Length != 2)\r\n {\r\n throw new SourceConfigurationError(\r\n string.Format(\r\n \"Annotation {0} in file {1} should have exactly one argument\",\r\n ann[0],\r\n this.inputObject.getRelativePath()));\r\n }\r\n\r\n return ann[1];\r\n }\r\n\r\n internal static void transferAnnotations(WorkingDirectory workingDirectory, BuildObject source, BuildObject dest, string commentToken)\r\n {\r\n new AnnotationScanner(source).injectAnnotations(workingDirectory, dest, commentToken);\r\n }\r\n\r\n // REVIEW: Make this private?\r\n internal void injectAnnotations(WorkingDirectory workingDirectory, BuildObject dest, string commentToken)\r\n {\r\n string annotations = this.emit(commentToken);\r\n\r\n // REVIEW: Improve upon this round-about way of prepending to a file?\r\n string destStr = File.ReadAllText(workingDirectory.PathTo(dest));\r\n File.Delete(workingDirectory.PathTo(dest));\r\n File.WriteAllText(workingDirectory.PathTo(dest), annotations + destStr);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/App.config", "content": "\r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/AsmRewriterVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n internal class AsmRewriterVerb : Verb, IProcessInvokeAsyncVerb, IAsmProducer\r\n {\r\n public const string WASM_EXTN = \".wasm\";\r\n private const int version = 1;\r\n\r\n private BoogieAsmLinkVerb asmVerb;\r\n private AbstractId abstractId;\r\n private BuildObject asmFileOut;\r\n private BuildObject asmFileIn;\r\n private BuildObject pythonScript;\r\n\r\n public AsmRewriterVerb(BoogieAsmLinkVerb asmVerb)\r\n {\r\n this.asmVerb = asmVerb;\r\n this.asmFileIn = asmVerb.getAsmFile();\r\n this.asmFileOut = this.asmFileIn.makeOutputObject(WASM_EXTN);\r\n\r\n this.abstractId = new AbstractId(this.GetType().Name, version, this.asmFileOut.ToString());\r\n this.pythonScript = new SourcePath(\"tools\\\\scripts\\\\build-standalone-asm.py\", SourcePath.SourceType.Tools);\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public BuildObject getAsmFile()\r\n {\r\n return this.asmFileOut;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n return new List() { this.asmFileIn, this.pythonScript };\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new List() { this.asmVerb };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() { this.getAsmFile() };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n List args = new List() { this.pythonScript.getRelativePath(), this.asmFileIn.getRelativePath() };\r\n string python_exe = @\"C:\\Python27\\pythonw.exe\";\r\n\r\n if (!File.Exists(python_exe))\r\n {\r\n throw new FileNotFoundException(\"Missing python executable: \" + python_exe + \". Try installing from: https://www.python.org/\");\r\n }\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n python_exe,\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n getDiagnosticsBase(),\r\n allowAbsoluteExe: true,\r\n captureStdout: this.asmFileOut);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n return disposition;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BackgroundWorker.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Threading;\r\n using System.Threading.Tasks;\r\n\r\n /// \r\n /// Type of procedure that the background worker thread runs.\r\n /// \r\n /// Some argument.\r\n /// Another argument.\r\n public delegate void BackgroundWorkerProcedure(object argument1, object argument2);\r\n\r\n /// \r\n /// Represents a single background worker thread that sequentially performs\r\n /// the work added to its queue.\r\n /// \r\n /// \r\n /// This class is not related to System.ComponentModel.BackgroundWorker,\r\n /// which provides different functionality.\r\n /// \r\n public class BackgroundWorker : IDisposable\r\n {\r\n /// \r\n /// Thread that performs the background work.\r\n /// \r\n private Thread workerThread;\r\n\r\n /// \r\n /// Queue of work for background worker to perform.\r\n /// \r\n private Queue workQueue;\r\n\r\n /// \r\n /// Lock protecting the work queue.\r\n /// \r\n private Mutex workQueueLock;\r\n\r\n /// \r\n /// Event that is signalled when new items are placed on the workQueue.\r\n /// \r\n private AutoResetEvent workQueueHasNewWork;\r\n\r\n /// \r\n /// Count of work items queued to this BackgroundWorker.\r\n /// \r\n private volatile uint workItemsQueued;\r\n\r\n /// \r\n /// Count of work item procedures performed by this BackgroundWorker.\r\n /// \r\n private volatile uint workItemsPerformed;\r\n\r\n /// \r\n /// Count of work item procedures known to have failed.\r\n /// \r\n private volatile uint workItemsFailed;\r\n\r\n /// \r\n /// Flag indicating whether or not the worker thread should exit.\r\n /// \r\n private volatile bool ourWorkIsNotDone;\r\n\r\n /// \r\n /// Flag indicating whether or not Dispose has already been called.\r\n /// \r\n private bool disposed;\r\n\r\n /// \r\n /// Initializes a new instance of the BackgroundWorker class.\r\n /// \r\n public BackgroundWorker()\r\n {\r\n this.workQueue = new Queue();\r\n this.workQueueLock = new Mutex();\r\n this.workQueueHasNewWork = new AutoResetEvent(false);\r\n this.workItemsQueued = 0;\r\n this.workItemsPerformed = 0;\r\n this.workItemsFailed = 0;\r\n this.ourWorkIsNotDone = true;\r\n this.disposed = false;\r\n\r\n this.workerThread = new Thread(new ThreadStart(this.WorkerThreadMain));\r\n\r\n // REVIEW: Start worker thread only after the first item is queued?\r\n this.workerThread.Start();\r\n }\r\n\r\n /// \r\n /// Gets the count of work items queued to this BackgroundWorker.\r\n /// \r\n public uint GetWorkItemsQueued\r\n {\r\n get { return this.workItemsQueued; }\r\n }\r\n\r\n /// \r\n /// Gets the count of work item procedures performed by this\r\n /// BackgroundWorker.\r\n /// \r\n public uint GetWorkItemsPerformed\r\n {\r\n get { return this.workItemsPerformed; }\r\n }\r\n\r\n /// \r\n /// Gets the count of work item procedures known to have failed.\r\n /// \r\n public uint GetWorkItemsFailed\r\n {\r\n get { return this.workItemsFailed; }\r\n }\r\n\r\n /// \r\n /// Adds new work to the background worker's work queue.\r\n /// \r\n /// \r\n /// Procedure the background worker will run.\r\n /// \r\n /// First argument for procedure.\r\n /// Second argument for procedure.\r\n public void QueueWork(BackgroundWorkerProcedure procedure, object argument1, object argument2)\r\n {\r\n BackgroundWorkerQueueItem workItem = new BackgroundWorkerQueueItem(procedure, argument1, argument2);\r\n\r\n this.workQueueLock.WaitOne();\r\n this.workQueue.Enqueue(workItem);\r\n this.workItemsQueued++;\r\n this.workQueueLock.ReleaseMutex();\r\n\r\n this.workQueueHasNewWork.Set();\r\n }\r\n\r\n /// \r\n /// Tells the worker thread to stop running after completing the\r\n /// currently queued work items.\r\n /// \r\n public void StopWork()\r\n {\r\n this.QueueWork(this.StopWorkerThread, null, null);\r\n }\r\n\r\n /// \r\n /// Wait for the worker thread to exit after a StopWork request.\r\n /// \r\n /// \r\n /// This routine is primarily for making sure the worker thread has\r\n /// completed operation before collecting stats from it\r\n /// (i.e. calling 'GetWorkItemsPerformed'). Since we don't mark our\r\n /// worker thread as a \"background\" thread, the process will not exit\r\n /// until after our thread exits. So this method is not needed for the\r\n /// purpose of keeping the main thread and thus process alive until the\r\n /// worker thread is done.\r\n /// \r\n public void WaitForCompletion()\r\n {\r\n this.workerThread.Join();\r\n }\r\n\r\n /// \r\n /// Releases resources.\r\n /// \r\n public void Dispose()\r\n {\r\n this.Dispose(true);\r\n GC.SuppressFinalize(this);\r\n }\r\n\r\n /// \r\n /// Releases unmanaged and (optionally) managed resources.\r\n /// \r\n /// Whether or not to release managed resources.\r\n protected virtual void Dispose(bool disposing)\r\n {\r\n if (this.disposed)\r\n {\r\n return;\r\n }\r\n\r\n if (disposing)\r\n {\r\n this.workQueueLock.Dispose();\r\n this.workQueueHasNewWork.Dispose();\r\n }\r\n\r\n this.disposed = true;\r\n }\r\n\r\n /// \r\n /// Special BackgroundWorkerProcedure for stopping the worker thread.\r\n /// \r\n /// \r\n /// Note that this procedure ends up being counted in the statistics\r\n /// we keep about the number of work items queued/performed.\r\n /// \r\n /// The parameter is not used.\r\n /// The parameter is not used.\r\n private void StopWorkerThread(\r\n object unused1,\r\n object unused2)\r\n {\r\n this.ourWorkIsNotDone = false;\r\n }\r\n\r\n /// \r\n /// Procedure performed by the background worker thread.\r\n /// \r\n [System.Diagnostics.CodeAnalysis.SuppressMessage(\"Microsoft.Design\", \"CA1031:DoNotCatchGeneralExceptionTypes\", Justification = \"We really do want to catch all exceptions in this case\")]\r\n private void WorkerThreadMain()\r\n {\r\n List toDoList = new List();\r\n\r\n // -\r\n // Run until we're told to stop.\r\n // -\r\n while (this.ourWorkIsNotDone)\r\n {\r\n // -\r\n // Wait for new work to be added to the queue.\r\n // -\r\n if (this.workQueueHasNewWork.WaitOne())\r\n {\r\n toDoList.Clear();\r\n\r\n // -\r\n // Pull all queued work items off the global work queue\r\n // (while holding the lock), and place them on our\r\n // thread-local toDoList.\r\n // -\r\n this.workQueueLock.WaitOne();\r\n\r\n while (this.workQueue.Count > 0)\r\n {\r\n toDoList.Add(this.workQueue.Dequeue());\r\n }\r\n\r\n this.workQueueLock.ReleaseMutex();\r\n\r\n // -\r\n // Do the requested work.\r\n // -\r\n foreach (BackgroundWorkerQueueItem workItem in toDoList)\r\n {\r\n try\r\n {\r\n workItem.Procedure(workItem.Argument1, workItem.Argument2);\r\n this.workItemsPerformed++;\r\n }\r\n catch\r\n {\r\n // -\r\n // Swallow all errors caused by the work item.\r\n // But count how often this happens.\r\n // -\r\n this.workItemsFailed++;\r\n }\r\n }\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Represents a work item on the background worker's work queue.\r\n /// \r\n private class BackgroundWorkerQueueItem\r\n {\r\n /// \r\n /// The procedure the background worker runs.\r\n /// \r\n private BackgroundWorkerProcedure procedure;\r\n\r\n /// \r\n /// The first argument to pass to the procedure.\r\n /// \r\n private object argument1;\r\n\r\n /// \r\n /// The second argument to pass to the procedure.\r\n /// \r\n private object argument2;\r\n\r\n /// \r\n /// Initializes a new instance of the BackgroundWorkerQueueItem class.\r\n /// \r\n /// Procedure to run.\r\n /// First argument for procedure.\r\n /// Second argument for procedure.\r\n public BackgroundWorkerQueueItem(\r\n BackgroundWorkerProcedure procedure,\r\n object argument1,\r\n object argument2)\r\n {\r\n this.procedure = procedure;\r\n this.argument1 = argument1;\r\n this.argument2 = argument2;\r\n }\r\n\r\n /// \r\n /// Gets the procedure the background worker runs.\r\n /// \r\n public BackgroundWorkerProcedure Procedure\r\n {\r\n get { return this.procedure; }\r\n }\r\n\r\n /// \r\n /// Gets the first argument to pass to the procedure.\r\n /// \r\n public object Argument1\r\n {\r\n get { return this.argument1; }\r\n }\r\n\r\n /// \r\n /// Gets the second argument to pass to the procedure.\r\n /// \r\n public object Argument2\r\n {\r\n get { return this.argument2; }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BasmObligationIncludes.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n\r\n internal class BasmObligationIncludes\r\n : IIncludeFactory\r\n {\r\n private IIncludePathContext includePathSearcher;\r\n private BeatIncludes directIncludes;\r\n\r\n public BasmObligationIncludes(IIncludePathContext includePathSearcher)\r\n {\r\n this.includePathSearcher = includePathSearcher;\r\n this.directIncludes = new BeatIncludes(includePathSearcher);\r\n }\r\n\r\n public IEnumerable getIncludes(BuildObject beatsrc)\r\n {\r\n IHasher hasher = BuildEngine.theEngine.getHasher();\r\n OrderPreservingSet includes = new OrderPreservingSet();\r\n\r\n BuildObject ifcFile = hasher.search(this.includePathSearcher, beatsrc.getFileNameWithoutExtension(), ModPart.Ifc);\r\n BuildObject impFile = hasher.search(this.includePathSearcher, beatsrc.getFileNameWithoutExtension(), ModPart.Imp);\r\n\r\n Util.Assert(ifcFile.Equals(beatsrc) || impFile.Equals(beatsrc));\r\n includes.AddRange(this.directIncludes.getBasmIncludes(ifcFile));\r\n includes.AddRange(this.directIncludes.getBasmIncludes(impFile));\r\n return includes;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BasmTransitiveDepsVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class BasmTransitiveDepsVerb\r\n : TransitiveDepsVerb\r\n {\r\n private IContextGeneratingVerb contextVerb;\r\n\r\n public BasmTransitiveDepsVerb(IContextGeneratingVerb contextVerb, BuildObject input)\r\n : base(input)\r\n {\r\n this.contextVerb = contextVerb;\r\n }\r\n\r\n protected override TransitiveDepsVerb factory(BuildObject obj)\r\n {\r\n return new BasmTransitiveDepsVerb(this.contextVerb, obj);\r\n }\r\n\r\n protected override void extendDeps(List deps)\r\n {\r\n deps.Add(this.contextVerb.getContextOutput());\r\n }\r\n\r\n protected override IIncludeFactory getIncludeFactory()\r\n {\r\n ContextContents context = (ContextContents)\r\n BuildEngine.theEngine.Repository.FetchVirtual(this.contextVerb.getContextOutput());\r\n return new BasmObligationIncludes(context.Context);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BatchVerifyVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class BatchVerifyVerb\r\n : Verb, IObligationsProducer\r\n {\r\n private const string BATCH_EXTN = \".batch\";\r\n private const int version = 1;\r\n\r\n private BuildObject outputObject;\r\n private HashSet producers;\r\n private AbstractId abstractId;\r\n private BatchMode mode; // REVIEW: Never used?\r\n private List deps;\r\n\r\n public BatchVerifyVerb(SourcePath batch_file, BatchMode mode, VerificationRequest verificationRequest, DafnyCCVerb.FramePointerMode useFramePointer)\r\n {\r\n this.mode = mode;\r\n\r\n this.producers = new HashSet();\r\n foreach (string line in File.ReadAllLines(IronRootDirectory.PathTo(batch_file)))\r\n {\r\n if (line.Equals(\"\") || line[0] == '#')\r\n {\r\n continue;\r\n }\r\n\r\n SourcePath src = new SourcePath(line);\r\n switch (mode)\r\n {\r\n case BatchMode.DAFNY:\r\n if (verificationRequest.verifyMode != VerificationRequest.VerifyMode.Verify)\r\n {\r\n throw new UserError(\"BatchVerify DAFNY only supports full verification (but maybe we should add selective?)\");\r\n }\r\n\r\n this.producers.Add(new DafnyVerifyTreeVerb(src));\r\n break;\r\n case BatchMode.APP:\r\n this.producers.Add(new IroncladAppVerb(src, IroncladAppVerb.TARGET.BARE_METAL, useFramePointer, verificationRequest));\r\n break;\r\n default:\r\n throw new Exception(\"Unknown batch file type\");\r\n }\r\n }\r\n\r\n string parameters = mode.ToString() + \",\" + verificationRequest.ToString();\r\n this.outputObject = batch_file.makeLabeledOutputObject(parameters, BATCH_EXTN + VerificationObligationList.VOL_EXTN);\r\n this.abstractId = new AbstractId(this.GetType().Name, version, batch_file.ToString(), concrete: parameters);\r\n }\r\n\r\n public BatchVerifyVerb(BuildObject batch_label, HashSet producers, BatchMode mode)\r\n {\r\n this.mode = mode;\r\n this.producers = producers;\r\n\r\n this.outputObject = batch_label.makeOutputObject(BATCH_EXTN + VerificationObligationList.VOL_EXTN);\r\n this.abstractId = new AbstractId(this.GetType().Name, version, batch_label.ToString(), concrete: mode.ToString());\r\n }\r\n\r\n public enum BatchMode\r\n {\r\n DAFNY,\r\n APP\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public BuildObject getObligationSet()\r\n {\r\n return this.outputObject;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n if (this.deps == null)\r\n {\r\n this.deps = new List();\r\n foreach (IObligationsProducer producer in this.producers)\r\n {\r\n this.deps.Add(producer.getObligationSet());\r\n }\r\n }\r\n\r\n ddisp = DependencyDisposition.Complete;\r\n return this.deps;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n // Pass this request upstream to expose upstream verbs.\r\n HashSet upstreamVerbs = new HashSet();\r\n foreach (IVerb producer in this.producers)\r\n {\r\n upstreamVerbs.UnionWith(producer.getVerbs());\r\n upstreamVerbs.Add(producer);\r\n }\r\n\r\n return upstreamVerbs;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new HashSet() { this.outputObject };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // Coallesce the VerificationObligationLists from each producer into a single result set\r\n IEnumerable master = new HashSet();\r\n foreach (IObligationsProducer producer in this.producers)\r\n {\r\n VerificationObligationList vol = VerificationObligationList.fetch(producer.getObligationSet());\r\n master = master.Union(vol.getVerificationObligations());\r\n }\r\n\r\n VerificationObligationList myVOL = new VerificationObligationList(master);\r\n myVOL.store(workingDirectory, this.outputObject);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BeatExtensions.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Text;\r\n\r\n public enum ModPart\r\n {\r\n Ifc,\r\n Imp,\r\n Unknown\r\n }\r\n\r\n public static class ModPartExtensions\r\n {\r\n public const string ModPartIfc = \".ifc\";\r\n public const string ModPartImp = \".imp\";\r\n public const string ModPartUnknown = \".unk\";\r\n\r\n public static string ExtnStr(this ModPart modPart)\r\n {\r\n switch (modPart)\r\n {\r\n case ModPart.Ifc: return ModPartIfc;\r\n case ModPart.Imp: return ModPartImp;\r\n case ModPart.Unknown: return ModPartUnknown;\r\n default: return null;\r\n }\r\n }\r\n }\r\n\r\n internal class BeatExtensions\r\n {\r\n public const string BEAT_EXTN = \".beat\";\r\n public const string BEATIFC_EXTN = \".ifc.beat\";\r\n public const string BEATIMP_EXTN = \".imp.beat\";\r\n\r\n public static ModPart whichPart(string filenameOrExtn)\r\n {\r\n string modPartStr = \".\" + filenameOrExtn.Split('.')[1];\r\n switch (modPartStr)\r\n {\r\n case ModPartExtensions.ModPartIfc: return ModPart.Ifc;\r\n case ModPartExtensions.ModPartImp: return ModPart.Imp;\r\n default: return ModPart.Unknown;\r\n }\r\n }\r\n\r\n public static BuildObject makeOutputObject(BuildObject input, string typeExtn)\r\n {\r\n return makeLabeledOutputObject(input, null, typeExtn);\r\n }\r\n\r\n internal static BuildObject makeLabeledOutputObject(BuildObject input, string appLabel, string typeExtn)\r\n {\r\n ModPart part = whichPart(input);\r\n if (part == ModPart.Unknown)\r\n {\r\n // Input must be a raw boogie file.\r\n Util.Assert(input.getExtension().EndsWith(BoogieVerb.BPL_EXTN));\r\n return input.makeLabeledOutputObject(appLabel, typeExtn);\r\n }\r\n else\r\n {\r\n return input.makeLabeledOutputObject(appLabel, part.ExtnStr() + typeExtn);\r\n }\r\n }\r\n\r\n public static ModPart whichPart(BuildObject obj)\r\n {\r\n return whichPart(obj.getExtension());\r\n }\r\n\r\n private static IEnumerable getBeatFlavoredShallowIncludesLabeled(\r\n IContextGeneratingVerb contextVerb, BuildObject rootObj)\r\n {\r\n ContextContents context = (ContextContents)\r\n BuildEngine.theEngine.Repository.FetchVirtual(contextVerb.getContextOutput());\r\n BeatIncludes includes = new BeatIncludes(context.Context);\r\n OrderPreservingSet result = new OrderPreservingSet(\r\n includes.getLabeledIncludes(rootObj));\r\n\r\n if (BeatExtensions.whichPart(rootObj) == ModPart.Imp)\r\n {\r\n BuildObject rootIfc = context.Context.search(rootObj.getFileNameWithoutExtension(), ModPart.Ifc);\r\n result.Add(new BeatIncludes.LabeledInclude(BeatIncludes.ImportFilter.ForBeatOrBasm, rootIfc));\r\n }\r\n\r\n return result;\r\n }\r\n\r\n public static IEnumerable getBeatFlavoredShallowIncludes(\r\n IContextGeneratingVerb contextVerb, BuildObject rootObj, BeatIncludes.ImportFilter importFilter)\r\n {\r\n return getBeatFlavoredShallowIncludesLabeled(contextVerb, rootObj)\r\n .Where(li => importFilter == BeatIncludes.ImportFilter.ForBasmOnly\r\n || li.importFilter == BeatIncludes.ImportFilter.ForBeatOrBasm)\r\n .Select(li => li.buildObject);\r\n }\r\n\r\n public static void propagatePrivateImports(\r\n WorkingDirectory workingDirectory,\r\n IContextGeneratingVerb contextVerb,\r\n BuildObject srcobj,\r\n BuildObject dstobj)\r\n {\r\n // Rewrite basm output to propagate any import statements from the beat file.\r\n // TODO this step really should be a beat function, not part of the build system.\r\n IEnumerable beatImports =\r\n getBeatFlavoredShallowIncludesLabeled(contextVerb, srcobj);\r\n StringBuilder sb = new StringBuilder();\r\n foreach (BeatIncludes.LabeledInclude li in beatImports)\r\n {\r\n sb.Append(\"//-\");\r\n sb.Append(li.importFilter == BeatIncludes.ImportFilter.ForBasmOnly\r\n ? \"private-basmonly-import\" : \"private-import\");\r\n sb.Append(\" \");\r\n sb.Append(li.buildObject.getFileNameWithoutExtension());\r\n sb.AppendLine(\";\");\r\n }\r\n\r\n // REVIEW: Improve upon this round-about way of prepending to a file?\r\n string beatOutput = File.ReadAllText(workingDirectory.PathTo(dstobj));\r\n File.Delete(workingDirectory.PathTo(dstobj));\r\n File.WriteAllText(workingDirectory.PathTo(dstobj), sb.ToString() + beatOutput);\r\n }\r\n\r\n // This used to use a BeatTransitiveDepsVerb, but we're going with shallow dependencies at the moment.\r\n // We may want to restore that behavior later, if we can get some sane transitive dep tree worked out for\r\n // Verve code.\r\n // The returned list belongs to the caller to .Add() to as desired.\r\n // TODO this really needs to be factored to supply the actual Beat-flavored references separately\r\n // from the auxiliary deps (transitive dep objects and context dep objects), so we don't have\r\n // client code trying to filter back out the part it wants. Brittle.\r\n public static OrderPreservingSet getBeatFlavoredShallowDependencies(\r\n IContextGeneratingVerb contextVerb, BuildObject rootObj, out DependencyDisposition ddisp, BeatIncludes.ImportFilter filter)\r\n {\r\n OrderPreservingSet result = new OrderPreservingSet();\r\n result.Add(contextVerb.getContextOutput());\r\n try\r\n {\r\n result.AddRange(getBeatFlavoredShallowIncludes(contextVerb, rootObj, filter));\r\n ddisp = DependencyDisposition.Complete;\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n ddisp = DependencyDisposition.Incomplete;\r\n }\r\n catch (ObjectFailedException)\r\n {\r\n ddisp = DependencyDisposition.Failed;\r\n }\r\n\r\n result.Add(rootObj); // root really needs to go at the end of the list.\r\n return result;\r\n }\r\n\r\n public static BasmTransitiveDepsVerb getBasmFlavoredTransitiveDepVerb(IContextGeneratingVerb context, BuildObject rootObj)\r\n {\r\n return new BasmTransitiveDepsVerb(context, rootObj);\r\n }\r\n\r\n // The list belongs to the caller to .Add() to as desired.\r\n public static OrderPreservingSet getBasmFlavoredTransitiveDependencies(IContextGeneratingVerb context, BuildObject rootObj, out DependencyDisposition ddisp)\r\n {\r\n OrderPreservingSet result = new OrderPreservingSet();\r\n TransitiveDepsVerb depsVerb = getBasmFlavoredTransitiveDepVerb(context, rootObj);\r\n result.Add(depsVerb.depsObj());\r\n result.AddRange(depsVerb.getAvailableDeps(out ddisp));\r\n\r\n // NB add root object at end of list, to keep it in definition-dependency order.\r\n result.Add(rootObj);\r\n return result;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BeatIncludes.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Text.RegularExpressions;\r\n\r\n internal class BeatIncludes\r\n {\r\n private static CachedHash fetchModuleCaches\r\n = new CachedHash(delegate(IIncludePathContext context)\r\n {\r\n return new FetchModuleCache(context);\r\n });\r\n\r\n private IIncludePathContext includePathSearcher;\r\n\r\n public BeatIncludes(IIncludePathContext includePathSearcher)\r\n {\r\n this.includePathSearcher = includePathSearcher;\r\n }\r\n\r\n public enum ImportFilter\r\n {\r\n ForBeatOrBasm,\r\n ForBasmOnly\r\n }\r\n\r\n public static List parseLabeledIncludes(IIncludePathContext context, BuildObject beatsrc)\r\n {\r\n ////Logger.WriteLine(\"parseLabeledIncludes \" + beatsrc.getRelativePath() + \" context \" + context.GetHashCode());\r\n\r\n List outlist = new List();\r\n ////Regex re = new Regex(\"^\\\\s*import\\\\s*([^\\\\s,]*(,\\\\s*[^\\\\s,]*)*)\\\\s*;\");\r\n // TODO allow commented-out imports until Beat accepts (ignores) them in ifcs files.\r\n Regex import_re = new Regex(\"^[\\\\s/-]*private-import\\\\s*([^\\\\s,]*(,\\\\s*[^\\\\s,]*)*)\\\\s*;\");\r\n Regex basmonly_re = new Regex(\"^[\\\\s/-]*private-basmonly-import\\\\s*([^\\\\s,]*(,\\\\s*[^\\\\s,]*)*)\\\\s*;\");\r\n FetchModuleCache fmcache = fetchModuleCaches.get(context);\r\n using (TextReader tr = BuildEngine.theEngine.Repository.OpenRead(beatsrc))\r\n {\r\n while (true)\r\n {\r\n string line = tr.ReadLine();\r\n if (line == null)\r\n {\r\n break;\r\n }\r\n\r\n Match match = import_re.Match(line);\r\n if (match.Success)\r\n {\r\n outlist.Add(new LabeledInclude(ImportFilter.ForBeatOrBasm, fmcache.get(match.Groups[1].ToString())));\r\n }\r\n\r\n match = basmonly_re.Match(line);\r\n if (match.Success)\r\n {\r\n outlist.Add(new LabeledInclude(ImportFilter.ForBasmOnly, fmcache.get(match.Groups[1].ToString())));\r\n }\r\n }\r\n\r\n ////Logger.WriteLine(string.Format(\"{0} includes {1} things\", dfysource.getFilesystemPath(), outlist.Count));\r\n return outlist;\r\n }\r\n }\r\n\r\n public List getLabeledIncludes(BuildObject beatsrc)\r\n {\r\n ////return caches.get(includePathSearcher).get(beatsrc);\r\n return this.computeLabeledIncludes(beatsrc);\r\n }\r\n\r\n public IEnumerable getBasmIncludes(BuildObject beatsrc)\r\n {\r\n return this.computeLabeledIncludes(beatsrc).Select(li => li.buildObject);\r\n }\r\n\r\n protected List computeLabeledIncludes(BuildObject beatsrc)\r\n {\r\n return BuildEngine.theEngine.getHasher().getParsedIncludes(this.includePathSearcher, beatsrc);\r\n }\r\n\r\n private BuildObject fetchModule(string module)\r\n {\r\n ////Logger.WriteLine(\"fetchmodule \" + module + \" ctx \" + includePathSearcher.GetHashCode());\r\n string includedModule = module.Trim();\r\n BuildObject path = this.includePathSearcher.search(includedModule);\r\n if (path == null)\r\n {\r\n throw new SourceConfigurationError(\r\n string.Format(\r\n \"Cannot find module {0} in search path {1}\",\r\n includedModule,\r\n this.includePathSearcher));\r\n }\r\n\r\n return path;\r\n }\r\n\r\n public class LabeledInclude\r\n {\r\n public ImportFilter importFilter;\r\n public BuildObject buildObject;\r\n\r\n public LabeledInclude(ImportFilter importFilter, BuildObject buildObject)\r\n {\r\n this.importFilter = importFilter;\r\n this.buildObject = buildObject;\r\n }\r\n }\r\n\r\n private class FetchModuleCache\r\n {\r\n private CachedHash cache;\r\n private BeatIncludes beatIncludes;\r\n\r\n public FetchModuleCache(IIncludePathContext context)\r\n {\r\n this.beatIncludes = new BeatIncludes(context);\r\n this.cache = new CachedHash(this.fetchModule);\r\n }\r\n\r\n public BuildObject get(string module)\r\n {\r\n return this.cache.get(module);\r\n }\r\n\r\n private BuildObject fetchModule(string module)\r\n {\r\n return this.beatIncludes.fetchModule(module);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BeatVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class BeatVerb\r\n : Verb, IProcessInvokeAsyncVerb\r\n {\r\n private const int version = 34;\r\n\r\n private static NmakeVerb beatBuildExecutableVerb = new NmakeVerb(new SourcePath(\"tools\\\\Beat\\\\makefile\", SourcePath.SourceType.Tools));\r\n\r\n private IContextGeneratingVerb contextVerb;\r\n private BuildObject beatobj;\r\n private string appLabel;\r\n private AbstractId abstractId;\r\n\r\n public BeatVerb(IContextGeneratingVerb contextVerb, BuildObject beatobj, string appLabel)\r\n {\r\n this.contextVerb = contextVerb;\r\n this.beatobj = beatobj;\r\n this.appLabel = appLabel;\r\n this.abstractId = new AbstractId(this.GetType().Name, version, beatobj.ToString(), contextVerb.getPoundDefines(), concrete: appLabel);\r\n }\r\n\r\n public static bool isBeat(BuildObject obj)\r\n {\r\n return obj.getExtension().Equals(BeatExtensions.BEATIFC_EXTN)\r\n || obj.getExtension().Equals(BeatExtensions.BEATIMP_EXTN);\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n OrderPreservingSet deps = BeatExtensions.getBeatFlavoredShallowDependencies(\r\n this.contextVerb, this.beatobj, out ddisp, BeatIncludes.ImportFilter.ForBeatOrBasm);\r\n deps.Add(this.getBeatExecutable());\r\n return deps;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new IVerb[] { this.contextVerb, beatBuildExecutableVerb };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { this.outputFile() };\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public BuildObject getBeatExecutable()\r\n {\r\n // Whaaat? Why doesn't beatBuildExecutableVerb.getOutputPath() already end with beat.exe!? Weirdly,\r\n // nope, its getOutputPath() is a directory.\r\n return new BuildObject(Path.Combine(beatBuildExecutableVerb.getOutputPath().getRelativePath(), \"beat.exe\"));\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // \"beat $BUILD_DEFS -out $out.tmp -in $in $incls\"\r\n List args = new List();\r\n args.Add(\"-in\");\r\n args.Add(this.beatobj.getRelativePath());\r\n\r\n IEnumerable beatImports =\r\n BeatExtensions.getBeatFlavoredShallowIncludes(this.contextVerb, this.beatobj, BeatIncludes.ImportFilter.ForBeatOrBasm);\r\n foreach (BuildObject ifcObj in beatImports.Where(obj => !obj.Equals(this.beatobj)))\r\n {\r\n Util.Assert(!ifcObj.getRelativePath().Contains(\".imp\")); // Erk, don't feed imp files as includes!\r\n args.Add(\"-i\");\r\n args.Add(ifcObj.getRelativePath());\r\n }\r\n\r\n args.AddRange(this.contextVerb.getPoundDefines().ToDefArgs());\r\n\r\n string dbgText = string.Format(\r\n \"rem verb {0}{1}\",\r\n this,\r\n System.Environment.NewLine);\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n this.getBeatExecutable().getRelativePath(),\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n captureStdout: this.outputFile(),\r\n failureBase: getDiagnosticsBase(),\r\n dbgText: dbgText);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n if (disposition is Fresh)\r\n {\r\n BeatExtensions.propagatePrivateImports(workingDirectory, this.contextVerb, this.beatobj, this.outputFile());\r\n\r\n // And then propagate the NuBuild annotations, too.\r\n AnnotationScanner.transferAnnotations(\r\n workingDirectory,\r\n this.beatobj,\r\n this.outputFile(),\r\n BoogieAsmDepBase.CommentSymbol);\r\n }\r\n\r\n return disposition;\r\n }\r\n\r\n private BuildObject outputFile()\r\n {\r\n string outputAppLabel = (this.appLabel == null ? string.Empty : this.appLabel) + this.contextVerb.getPoundDefines().ToString();\r\n string extn = this.beatobj.getExtension().Equals(BeatExtensions.BEATIFC_EXTN) ? BoogieAsmVerifyVerb.BASMIFC_EXTN : BoogieAsmVerifyVerb.BASMIMP_EXTN;\r\n return this.beatobj.makeLabeledOutputObject(outputAppLabel, extn);\r\n }\r\n\r\n private string getModuleNameForObj(BuildObject obj)\r\n {\r\n return obj.getFileNameWithoutExtension();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BoogieAsmDepBase.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal abstract class BoogieAsmDepBase\r\n : Verb\r\n {\r\n public const string BASM_EXTN = \".basm\";\r\n public const string BASMIFC_EXTN = \".ifc.basm\";\r\n public const string BASMIMP_EXTN = \".imp.basm\";\r\n public const string CommentSymbol = \"//\";\r\n\r\n protected static NmakeVerb boogieAsmBuildExecutableVerb = new NmakeVerb(new SourcePath(\"tools\\\\BoogieAsm\\\\makefile\", SourcePath.SourceType.Tools));\r\n\r\n protected IContextGeneratingVerb context;\r\n protected BuildObject basmInput;\r\n protected BuildObject upstreamObj;\r\n\r\n private const int version = 20;\r\n private AbstractId abstractId = null;\r\n\r\n public BoogieAsmDepBase(IContextGeneratingVerb context, BuildObject input)\r\n {\r\n this.context = context;\r\n this.upstreamObj = input;\r\n this.basmInput = computeBasmInput(context.getPoundDefines(), input);\r\n }\r\n\r\n public static bool isBasm(BuildObject obj)\r\n {\r\n return obj.getExtension().Equals(BASMIFC_EXTN)\r\n || obj.getExtension().Equals(BASMIMP_EXTN);\r\n }\r\n\r\n public abstract BuildObject outputFile();\r\n\r\n protected abstract int getVersion();\r\n\r\n protected abstract bool includeAllImps();\r\n\r\n protected virtual string getExtraAbstractID()\r\n {\r\n return string.Empty;\r\n }\r\n\r\n protected static BuildObject getBoogieasmExecutable()\r\n {\r\n return new BuildObject(Path.Combine(boogieAsmBuildExecutableVerb.getOutputPath().getRelativePath(), \"boogieasm.exe\"));\r\n }\r\n\r\n protected virtual IEnumerable getExtraDeps(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n return new BuildObject[] { };\r\n }\r\n\r\n public static BuildObject computeBasmInput(PoundDefines poundDefines, BuildObject upstreamObj)\r\n {\r\n if (BoogieAsmDepBase.isBasm(upstreamObj))\r\n {\r\n // We'll be reading upstreamObj directly. Don't makeOutputObject,\r\n // because it may well be a source file.\r\n return upstreamObj;\r\n }\r\n\r\n return BeatExtensions.makeLabeledOutputObject(upstreamObj, poundDefines.ToString(), BASM_EXTN);\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { outputFile() };\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n if (this.abstractId == null)\r\n {\r\n this.abstractId = new AbstractId(this.GetType().Name, getVersion() + version, this.upstreamObj.ToString(), context.getPoundDefines(), getExtraAbstractID());\r\n }\r\n\r\n return abstractId;\r\n }\r\n\r\n internal class BasmModuleAccumulator\r\n {\r\n private IContextGeneratingVerb _contextGenVerb;\r\n private HashSet _mutableVerbSet;\r\n private OrderPreservingSet _basmModules; // these are the bits we want to pass in as Execute() arguments\r\n private HashSet _auxiliaryDeps; // these plus modules are the deps we need to wait on. We need these to get the right .tdeps.\r\n private IIncludePathContext context;\r\n private DependencyDisposition _ddisp;\r\n\r\n public IEnumerable verbs\r\n {\r\n get { return _mutableVerbSet; }\r\n }\r\n\r\n public IEnumerable basmModules\r\n {\r\n get { return _basmModules; }\r\n }\r\n\r\n public IEnumerable getDeps()\r\n {\r\n return _auxiliaryDeps.Concat(_basmModules);\r\n }\r\n\r\n public DependencyDisposition ddisp\r\n {\r\n get { return _ddisp; }\r\n }\r\n\r\n public BasmModuleAccumulator(IContextGeneratingVerb contextGenVerb, BuildObject upstreamObj, bool linkMode)\r\n {\r\n this._contextGenVerb = contextGenVerb;\r\n this._mutableVerbSet = new HashSet();\r\n\r\n // NB preserve module definition-dependency order.\r\n this._basmModules = new OrderPreservingSet();\r\n this._auxiliaryDeps = new HashSet();\r\n _ddisp = DependencyDisposition.Complete;\r\n\r\n ////try\r\n ////{\r\n _mutableVerbSet.Add(contextGenVerb);\r\n _auxiliaryDeps.UnionWith(contextGenVerb.getOutputs());\r\n\r\n context = contextGenVerb.fetchIfAvailable(ref _ddisp);\r\n\r\n if (context != null)\r\n {\r\n OrderPreservingSet deps;\r\n if (!linkMode)\r\n {\r\n deps = BeatExtensions.getBeatFlavoredShallowDependencies(\r\n contextGenVerb, upstreamObj, out _ddisp, BeatIncludes.ImportFilter.ForBasmOnly);\r\n }\r\n else\r\n {\r\n deps = BeatExtensions.getBasmFlavoredTransitiveDependencies(contextGenVerb, upstreamObj, out _ddisp);\r\n _mutableVerbSet.Add(BeatExtensions.getBasmFlavoredTransitiveDepVerb(_contextGenVerb, upstreamObj));\r\n }\r\n\r\n // REVIEW: The following two variables are unused. Remove?\r\n string targetModName = upstreamObj.getFileNameWithoutExtension();\r\n ModPart targetModPart = BeatExtensions.whichPart(upstreamObj);\r\n\r\n // NB security policy note: When verifying X.imp, we must be sure to supply X.ifc\r\n // to BoogieAsm, so that we know that we're actually verifying the promises\r\n // that other modules are relying on when they say \"X\" (which is how X got on\r\n // the verification obligation list). That property happens automatically here,\r\n // because we make a list of modules (ignoring ifc/imp part), such as {A,B,X},\r\n // and include *every* .ifc. If we're verifying X.imp, a conditional test\r\n // includes it at the time we consider module X.\r\n\r\n foreach (BuildObject dep in deps)\r\n {\r\n string depExtn = dep.getExtension();\r\n if (depExtn == null\r\n || depExtn.EndsWith(TransitiveDepsVerb.TDEP_EXTN)\r\n || depExtn.EndsWith(ContextGeneratingVerb.CONTEXT_EXTN))\r\n {\r\n _auxiliaryDeps.Add(dep);\r\n }\r\n else\r\n {\r\n Util.Assert(depExtn.Equals(BeatExtensions.BEATIFC_EXTN)\r\n || depExtn.Equals(BeatExtensions.BEATIMP_EXTN)\r\n || depExtn.Equals(BASMIFC_EXTN)\r\n || depExtn.Equals(BASMIMP_EXTN)); // Burned too many times by this silly filter-out strategy.\r\n string modName = dep.getFileNameWithoutExtension();\r\n ModPart modPart = BeatExtensions.whichPart(dep);\r\n getBasmModule(modName, ModPart.Ifc);\r\n if ((dep.Equals(upstreamObj) && modPart == ModPart.Imp) || linkMode)\r\n {\r\n getBasmModule(modName, ModPart.Imp);\r\n }\r\n }\r\n }\r\n }\r\n\r\n ////}\r\n ////catch (ObjNotReadyException)\r\n ////{\r\n //// // oh, we don't even have the context object yet.\r\n //// _ddisp = DependencyDisposition.Incomplete;\r\n ////}\r\n ////catch (ObjFailedException)\r\n ////{\r\n //// _ddisp = DependencyDisposition.Failed;\r\n ////}\r\n }\r\n\r\n private BuildObject maybeBeat(BuildObject obj, HashSet mutableVerbSet)\r\n {\r\n BuildObject result = obj;\r\n if (BeatVerb.isBeat(obj))\r\n {\r\n BeatVerb beatVerb = new BeatVerb(_contextGenVerb, obj, appLabel: null);\r\n IEnumerable beatOuts = beatVerb.getOutputs();\r\n Util.Assert(beatOuts.Count() == 1);\r\n mutableVerbSet.Add(beatVerb);\r\n result = beatVerb.getOutputs().First();\r\n }\r\n else\r\n {\r\n // No, this thing should already be ready to consume.\r\n ////mutableVerbSet.Add(new BoogieAsmVerifyVerb(context, obj));\r\n }\r\n\r\n Util.Assert(BoogieAsmVerifyVerb.isBasm(result));\r\n return result;\r\n }\r\n\r\n private void getBasmModule(string modName, ModPart modPart)\r\n {\r\n ////Logger.WriteLine(string.Format(\"context {0} modName {1} modPart {2}\", context, modName, modPart));\r\n ////BuildObject ifcObj = context.search(modName, modPart);\r\n BuildObject ifcObj = BuildEngine.theEngine.getHasher().search(context, modName, modPart);\r\n if (ifcObj == null)\r\n {\r\n Util.Assert(false); // I'm not sure this case even occur anymore, since we guard the foreach on incomplete deps.\r\n _ddisp = _ddisp.combine(DependencyDisposition.Incomplete);\r\n }\r\n else\r\n {\r\n ifcObj = maybeBeat(ifcObj, _mutableVerbSet);\r\n _basmModules.Add(ifcObj);\r\n }\r\n }\r\n }\r\n\r\n protected IEnumerable getBoogieVerbs(VerificationRequest verificationRequest)\r\n {\r\n if (verificationRequest.verifyMode == VerificationRequest.VerifyMode.NoVerify)\r\n {\r\n return new BoogieVerb[] { };\r\n }\r\n\r\n BoogieAsmDepBase.BasmModuleAccumulator acc = new BoogieAsmDepBase.BasmModuleAccumulator(context, upstreamObj, includeAllImps());\r\n List basmModules = new List(acc.basmModules.Where(mod => !mod.IsTrusted));\r\n\r\n OrderPreservingSet normal_Boogie = new OrderPreservingSet();\r\n OrderPreservingSet SymDiff_Boogie = new OrderPreservingSet();\r\n\r\n foreach (BuildObject basmModule in basmModules)\r\n {\r\n if (verificationRequest.verifyMode == VerificationRequest.VerifyMode.SelectiveVerify\r\n && !verificationRequest.selectiveVerifyModuleNames.Contains(basmModule.getFileNameWithoutExtension()))\r\n {\r\n continue;\r\n }\r\n\r\n normal_Boogie.Add(new BoogieVerb(context, basmModule, symdiff: VerificationRequest.SymDiffMode.NoSymDiff));\r\n\r\n if (verificationRequest.getSymDiffMode() == VerificationRequest.SymDiffMode.UseSymDiff\r\n && BoogieAsmVerifyVerb.needs_symdiff(basmModule))\r\n {\r\n SymDiff_Boogie.Add(new BoogieVerb(context, basmModule, symdiff: VerificationRequest.SymDiffMode.UseSymDiff));\r\n }\r\n }\r\n\r\n return SymDiff_Boogie.Union(normal_Boogie);\r\n }\r\n\r\n protected IEnumerable getVerifyishVerbs()\r\n {\r\n // All the available things that make Beat or Basm ...\r\n BasmModuleAccumulator acc = new BasmModuleAccumulator(context, upstreamObj, includeAllImps());\r\n\r\n // Plus the transitive deps.\r\n IEnumerable extraDeps = new IVerb[] { context, boogieAsmBuildExecutableVerb };\r\n return acc.verbs.Concat(extraDeps).Concat(context.getVerbs());\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n BasmModuleAccumulator acc = new BasmModuleAccumulator(context, upstreamObj, includeAllImps());\r\n IEnumerable result = acc.getDeps();\r\n DependencyDisposition ddisp_extra;\r\n IEnumerable result_extra = getExtraDeps(out ddisp_extra);\r\n ddisp = acc.ddisp.combine(ddisp_extra);\r\n return result.Concat(result_extra).Concat(new[] { getBoogieasmExecutable() });\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BoogieAsmLinkVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class BoogieAsmLinkVerb\r\n : BoogieAsmWorkerBase, IAsmProducer\r\n {\r\n public BoogieAsmLinkVerb(IContextGeneratingVerb context, BuildObject input)\r\n : base(context, input)\r\n {\r\n }\r\n\r\n public BuildObject getAsmFile()\r\n {\r\n return basmInput.makeOutputObject(MasmVerb.MASM_EXTN);\r\n }\r\n\r\n public override BuildObject outputFile()\r\n {\r\n return this.getAsmFile();\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n // Hey BJP: why do we have BoogieAsmLink here offering boogie verbs? I guess because it's safe and hint-y? // Dunno. Let's try without it.\r\n ////return getBoogieVerbs().Concat(getVerifyishVerbs());\r\n return getVerifyishVerbs();\r\n }\r\n\r\n protected override int getVersion()\r\n {\r\n return 23;\r\n }\r\n\r\n protected override string getAction()\r\n {\r\n return \"-link\";\r\n }\r\n\r\n protected override bool outFlagWorks()\r\n {\r\n return false;\r\n }\r\n\r\n protected override bool includeAllImps()\r\n {\r\n return true;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BoogieAsmVerificationObligationListVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n // NB we generate the obligation list in a seperate verb from the actual BoogieAsm -link step\r\n // because the latter is quite slow, and the former frees up a bunch of downstream\r\n // parallelism.\r\n internal class BoogieAsmVerificationObligationListVerb\r\n : BoogieAsmDepBase, IObligationsProducer\r\n {\r\n private BuildObject obligations;\r\n private VerificationRequest verificationRequest;\r\n\r\n public BoogieAsmVerificationObligationListVerb(IContextGeneratingVerb context, BuildObject input, VerificationRequest verificationRequest)\r\n : base(context, input)\r\n {\r\n this.verificationRequest = verificationRequest;\r\n obligations = input.makeOutputObject(BASM_EXTN + VerificationObligationList.VOL_EXTN);\r\n }\r\n\r\n public BuildObject getObligationSet()\r\n {\r\n return obligations;\r\n }\r\n\r\n public override BuildObject outputFile()\r\n {\r\n return obligations;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n IEnumerable result = getVerifyishVerbs();\r\n IEnumerable boogieVerbs = new List();\r\n try\r\n {\r\n boogieVerbs = getBoogieVerbs(verificationRequest);\r\n ////Logger.Out.WriteLine(\"Successfully retrieved the Boogie verbs.\");\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n ////Logger.Out.WriteLine(\"Caught an exception: \" + e);\r\n }\r\n\r\n return result.Concat(boogieVerbs);\r\n }\r\n\r\n public IEnumerable getObligationSatisfyingVerbs()\r\n {\r\n return getBoogieVerbs(verificationRequest);\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n IEnumerable verificationResults = getBoogieVerbs(verificationRequest)\r\n .Select(boogie_verb => boogie_verb.getOutputFile());\r\n VerificationObligationList vol = new VerificationObligationList(verificationResults);\r\n vol.store(workingDirectory, this.obligations);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n\r\n protected override int getVersion()\r\n {\r\n return 5;\r\n }\r\n\r\n protected override bool includeAllImps()\r\n {\r\n return true;\r\n }\r\n\r\n protected override string getExtraAbstractID()\r\n {\r\n return verificationRequest.ToString();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BoogieAsmVerifyVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n internal class BoogieAsmVerifyVerb\r\n : BoogieAsmWorkerBase\r\n {\r\n public const string MUTUAL_SUMMARY_EXTN = \".ms\";\r\n public const string SYMDIFF_EXTN = \".symdiff\";\r\n public const string SYMDIFF_DIR_EXTN = \".dir\";\r\n private const string AddBoogieAxiomAnnotation = \"AddBoogieAxiom\";\r\n private const string BasmEnableSymdiffAnnotation = \"BasmEnableSymdiff\";\r\n\r\n private bool buildSymDiffMutualSummary;\r\n private bool enableSymdiff = false;\r\n private string dirName;\r\n\r\n public BoogieAsmVerifyVerb(IContextGeneratingVerb context, BuildObject input, bool buildSymDiffMutualSummary)\r\n : base(context, input)\r\n {\r\n this.buildSymDiffMutualSummary = buildSymDiffMutualSummary;\r\n this.enableSymdiff = BoogieAsmVerifyVerb.needs_symdiff(basmInput);\r\n }\r\n\r\n public static bool needs_symdiff(BuildObject basm)\r\n {\r\n AnnotationScanner annotations = new AnnotationScanner(basm);\r\n bool symdiff = false;\r\n foreach (string[] ann in annotations.getAnnotations(BasmEnableSymdiffAnnotation))\r\n {\r\n if (ann.Length != 2\r\n || !ann[1].Equals(\"true\"))\r\n {\r\n throw new SourceConfigurationError(\"Expected \" + BasmEnableSymdiffAnnotation + \" to have argument 'true'.\");\r\n }\r\n\r\n symdiff = true;\r\n }\r\n\r\n return symdiff;\r\n }\r\n\r\n public override BuildObject outputFile()\r\n {\r\n if (buildSymDiffMutualSummary)\r\n {\r\n // SymDiff files need to go into their own directory\r\n BuildObject normalName = BeatExtensions.makeOutputObject(basmInput, SYMDIFF_EXTN);\r\n dirName = normalName.getFileName() + SYMDIFF_DIR_EXTN;\r\n BuildObject dirExtendedName = new BuildObject(Path.Combine(normalName.getDirPath(), dirName, normalName.getFileName()));\r\n\r\n return dirExtendedName;\r\n }\r\n else\r\n {\r\n return BeatExtensions.makeOutputObject(basmInput, BoogieVerb.BPL_EXTN);\r\n }\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n // Hey BJP: why do we have BoogieAsmLink here offering boogie verbs? I guess because it's safe and hint-y?\r\n return getVerifyishVerbs();\r\n }\r\n\r\n public BuildObject getMutualSummary()\r\n {\r\n // SymDiff files need to go into their own directory.\r\n BuildObject normalName = BeatExtensions.makeOutputObject(basmInput, MUTUAL_SUMMARY_EXTN);\r\n BuildObject dirExtendedName = new BuildObject(Path.Combine(normalName.getDirPath(), dirName, normalName.getFileName()));\r\n return dirExtendedName;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n List outputs = new List { outputFile() };\r\n if (buildSymDiffMutualSummary)\r\n {\r\n outputs.Add(getMutualSummary());\r\n }\r\n\r\n return outputs;\r\n }\r\n\r\n protected override IEnumerable getExtraDeps(out DependencyDisposition ddisp)\r\n {\r\n try\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n return getTrustedBoogieAxioms();\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n // All the basms aren't here yet, so we can't scan them. Don't sweat it;\r\n // those deps are already being called for.\r\n ddisp = DependencyDisposition.Incomplete;\r\n return new BuildObject[] { };\r\n }\r\n catch (ObjectFailedException)\r\n {\r\n ddisp = DependencyDisposition.Failed;\r\n return new BuildObject[] { };\r\n }\r\n }\r\n\r\n protected override void extendArgs(List args)\r\n { \r\n if (!buildSymDiffMutualSummary && enableSymdiff)\r\n {\r\n args.Add(\"-symdiffok\");\r\n }\r\n else if (buildSymDiffMutualSummary)\r\n {\r\n args.Add(\"-symdiffms\");\r\n args.Add(getMutualSummary().getRelativePath());\r\n }\r\n\r\n ////foreach (SourcePath includedAxiom in getTrustedBoogieAxioms(acc.basmModules))\r\n foreach (SourcePath includedAxiom in getTrustedBoogieAxioms())\r\n {\r\n if (!includedAxiom.IsTrusted)\r\n {\r\n throw new SourceConfigurationError(AddBoogieAxiomAnnotation + \" annotation points at untrusted file \" + includedAxiom.ToString());\r\n }\r\n\r\n // SECURITY POLICY: you can only include trusted things labeled \"_axioms.bpl\".\r\n if (!includedAxiom.getExtension().Equals(BoogieVerb.BPL_EXTN)\r\n || !includedAxiom.getFileNameWithoutExtension().EndsWith(\"_axioms\"))\r\n {\r\n throw new SourceConfigurationError(AddBoogieAxiomAnnotation + \" annotation points at file that isn't a Boogie axioms file: \" + includedAxiom.ToString());\r\n }\r\n\r\n args.Add(\"/trustedBoogie:\" + includedAxiom.getRelativePath());\r\n }\r\n }\r\n\r\n protected override void postprocess(WorkingDirectory workingDirectory)\r\n {\r\n AnnotationScanner.transferAnnotations(workingDirectory, basmInput, outputFile(), BoogieVerb.CommentSymbol);\r\n }\r\n\r\n protected override int getVersion()\r\n {\r\n return 20;\r\n }\r\n\r\n protected override string getAction()\r\n {\r\n return \"-verify\";\r\n }\r\n\r\n protected override bool outFlagWorks()\r\n {\r\n return true;\r\n }\r\n\r\n protected override bool includeAllImps()\r\n {\r\n return false;\r\n }\r\n\r\n protected override string getExtraAbstractID()\r\n {\r\n return buildSymDiffMutualSummary ? \", relational\" : \", functional\";\r\n }\r\n\r\n private IEnumerable getTrustedBoogieAxioms()\r\n {\r\n OrderPreservingSet result = new OrderPreservingSet();\r\n AnnotationScanner anns = new AnnotationScanner(basmInput);\r\n foreach (string[] annotation in anns.getAnnotations(AddBoogieAxiomAnnotation))\r\n {\r\n string module = annotation[1];\r\n SourcePath trustedPath = new SourcePath(Path.Combine(\r\n BuildEngine.theEngine.getSrcRoot(),\r\n BuildEngine.VerveTrustedSpecDir,\r\n module + BoogieVerb.BPL_EXTN));\r\n result.Add(trustedPath);\r\n }\r\n\r\n return result;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BoogieAsmWorkerBase.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n\r\n internal abstract class BoogieAsmWorkerBase\r\n : BoogieAsmDepBase, IProcessInvokeAsyncVerb\r\n {\r\n public BoogieAsmWorkerBase(IContextGeneratingVerb context, BuildObject input)\r\n : base(context, input)\r\n {\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n List args = new List();\r\n //// args.add(BUILD_DEFS\r\n //// args.add(boogieasm_flags)\r\n args.Add(getAction());\r\n BuildObject captureStdout = null;\r\n if (outFlagWorks())\r\n {\r\n args.Add(\"-out\");\r\n args.Add(outputFile().getRelativePath());\r\n }\r\n else\r\n {\r\n captureStdout = outputFile();\r\n }\r\n\r\n BasmModuleAccumulator acc = new BasmModuleAccumulator(context, upstreamObj, includeAllImps());\r\n Util.Assert(acc.ddisp == DependencyDisposition.Complete);\r\n args.AddRange(acc.basmModules.Select(module => module.getRelativePath()));\r\n args.AddRange(context.getPoundDefines().ToDefArgs());\r\n extendArgs(args);\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n getBoogieasmExecutable().getRelativePath(),\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n getDiagnosticsBase(),\r\n captureStdout: captureStdout);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n postprocess(workingDirectory);\r\n return disposition;\r\n }\r\n\r\n protected abstract string getAction();\r\n\r\n protected abstract bool outFlagWorks(); // Weird that it works for -verify but not -link!\r\n\r\n protected virtual void extendArgs(List args)\r\n {\r\n }\r\n\r\n protected virtual void postprocess(WorkingDirectory workingDirectory)\r\n {\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BoogieVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\n using System.Linq;\r\n\r\n internal class BoogieVerb\r\n : VerificationResultVerb, IProcessInvokeAsyncVerb\r\n {\r\n public const string BPL_EXTN = \".bpl\";\r\n public const string CommentSymbol = \"//-\";\r\n\r\n private const int version = 17;\r\n private const string AddBoogieFlagAnnotation = \"AddBoogieFlag\";\r\n\r\n // SECURITY POLICY: we only allow checked files to specify the flags below.\r\n // Otherwise, one might thing it reasonable to specify \"/noVerify:1\" or something.\r\n private static readonly string[] validFlagsAnyValue = { \"/restartProver\", \"/timeLimit\", \"/trace\" };\r\n private static readonly string[] validFlagsSpecificValues = { \"/proverOpt:OPTIMIZE_FOR_BV=true\", \"/z3opt:NL_ARITH=false\" };\r\n private static SourcePath boogieExecutable;\r\n\r\n private BuildObject bplInput;\r\n private AbstractId abstractId;\r\n private IEnumerable upstreamVerbs;\r\n private int timeLimit = 300;\r\n\r\n public BoogieVerb(IContextGeneratingVerb context, BuildObject bplInput, VerificationRequest.SymDiffMode symdiff)\r\n {\r\n if (bplInput.getExtension().Equals(BPL_EXTN))\r\n {\r\n this.bplInput = bplInput;\r\n upstreamVerbs = new List();\r\n // TODO this will probably break, since we don't know where this bplInput came from. Maybe that's okay, since the verb had to already exist to reach this point.\r\n }\r\n else if (symdiff == VerificationRequest.SymDiffMode.NoSymDiff)\r\n {\r\n IVerb boogieAsmVerb = new BoogieAsmVerifyVerb(context, bplInput, false);\r\n this.bplInput = boogieAsmVerb.getOutputs().First();\r\n upstreamVerbs = new IVerb[] { boogieAsmVerb };\r\n }\r\n else\r\n {\r\n IVerb workerVerb;\r\n SymDiffEngine.BuildPipeline(context, bplInput, out this.bplInput, out workerVerb);\r\n upstreamVerbs = new IVerb[] { workerVerb };\r\n }\r\n\r\n this.abstractId = new AbstractId(\r\n this.GetType().Name,\r\n version,\r\n bplInput.ToString(),\r\n concrete: symdiff.ToString());\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n List result = new List() { bplInput };\r\n result.Add(getBoogieExecutable());\r\n result.AddRange(getBoogieExecutableDependencies());\r\n return result;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return upstreamVerbs;\r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n return BeatExtensions.makeOutputObject(bplInput, BPL_EXTN + VerificationResultVerb.VERIFICATION_RESULT_EXTN);\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { getOutputFile() };\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return abstractId;\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n if (false)\r\n {\r\n#pragma warning disable 162\r\n File.WriteAllText(workingDirectory.PathTo(getOutputFile()), \"Verification disabled temporarily for debugging\");\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n#pragma warning restore 162\r\n }\r\n\r\n List args = new List();\r\n args.Add(\"/noinfer\");\r\n args.Add(\"/typeEncoding:m\");\r\n args.Add(\"/z3opt:ARITH_RANDOM_SEED=1\");\r\n args.Add(\"/timeLimit:\" + timeLimit);\r\n args.AddRange(getFlags());\r\n args.Add(bplInput.getRelativePath());\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n getBoogieExecutable().getRelativePath(),\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsOkay,\r\n getDiagnosticsBase(),\r\n allowCloudExecution: true,\r\n returnStandardOut: true,\r\n returnStandardError: true);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n VerificationResult vr = new VerificationResult(\r\n bplInput.getRelativePath(),\r\n cpuTimeSeconds,\r\n stdout,\r\n stderr,\r\n new VerificationResultBoogieParser());\r\n vr.addBasicPresentation();\r\n vr.toXmlFile(workingDirectory.PathTo(getOutputFile()));\r\n setWasRejectableFailure(vr.wasOnlyTimeouts());\r\n return disposition;\r\n }\r\n\r\n protected override BuildObject getSource()\r\n {\r\n return bplInput;\r\n }\r\n\r\n private static SourcePath getBoogieExecutable()\r\n {\r\n // TODO this should eventually be a BuildObject from *building* the executable.\r\n if (BoogieVerb.boogieExecutable == null)\r\n {\r\n BoogieVerb.boogieExecutable = new SourcePath(\"tools\\\\Dafny\\\\Boogie.exe\", SourcePath.SourceType.Tools);\r\n }\r\n\r\n return BoogieVerb.boogieExecutable;\r\n }\r\n\r\n private static IEnumerable getBoogieExecutableDependencies()\r\n {\r\n List exeDepends = new List();\r\n\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\AbsInt.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\BaseTypes.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\CodeContractsExtender.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Concurrency.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Core.dll\", SourcePath.SourceType.Tools)); \r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Doomed.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\ExecutionEngine.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Graph.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Model.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\msvcp100.dll\", SourcePath.SourceType.Tools)); // Needed by z3.\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\msvcr100.dll\", SourcePath.SourceType.Tools)); // Needed by z3.\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\ParserHelper.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Predication.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Provers.SMTLib.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\VCExpr.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\VCGeneration.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\vcomp100.dll\", SourcePath.SourceType.Tools)); // Needed by z3.\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\z3.exe\", SourcePath.SourceType.Tools));\r\n\r\n return exeDepends;\r\n }\r\n\r\n private IEnumerable getFlags()\r\n {\r\n List flags = new List();\r\n foreach (string[] ann in new AnnotationScanner(bplInput).getAnnotations(AddBoogieFlagAnnotation))\r\n {\r\n if (ann.Count() != 2)\r\n {\r\n throw new SourceConfigurationError(bplInput + \" has malformed annotation: \" + string.Join(\" \", ann));\r\n }\r\n\r\n string flag = ann[1];\r\n string[] flagParts = flag.Split(new char[] { ':' }, 2);\r\n if (validFlagsAnyValue.Contains(flagParts[0]))\r\n {\r\n flags.Add(flag);\r\n }\r\n else if (validFlagsSpecificValues.Contains(flag))\r\n {\r\n flags.Add(flag);\r\n }\r\n else\r\n {\r\n throw new SourceConfigurationError(bplInput + \" contains disallowed flag \" + flag);\r\n }\r\n\r\n if (flagParts[0].Equals(\"/timeLimit\"))\r\n {\r\n Util.Assert(flagParts.Count() == 2);\r\n timeLimit = Int32.Parse(flagParts[1]);\r\n }\r\n }\r\n\r\n return flags;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BootableAppVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n // Needs to:\r\n // 1) Build the bootloader into pxeloader\r\n // 2) Build two IroncladApps: Loader and specified app\r\n // Do this via a Batch\r\n // 3) Create a boot.ini\r\n\r\n internal class BootableAppVerb\r\n : Verb\r\n {\r\n ////public const string BOOT_EXTN = \".ini\";\r\n public const string LOADER_DFY = \"src\\\\Dafny\\\\Apps\\\\AppLoader\\\\Main.i.dfy\";\r\n private const int version = 4;\r\n\r\n private SourcePath dfyroot; // REVIEW: Never used?\r\n private AbstractId abstractId;\r\n private VerificationRequest verificationRequest;\r\n\r\n // Dependencies\r\n ////BuildObject bootloader = new BuildObject(\"obj\\\\Trusted\\\\BootLoader\\\\pxe-loader\"); // TODO: Build this with the NMake verb!\r\n private BuildObject bootloader = new SourcePath(\"obj\\\\Trusted\\\\BootLoader\\\\pxe-loader\", SourcePath.SourceType.PrebakedObjExpediency);\r\n\r\n // Outputs\r\n private BuildObject bootIniFile;\r\n private BuildObject loaderCopy;\r\n private BuildObject bootloaderCopy;\r\n private BuildObject appExecutableCopy;\r\n\r\n // Intermediate verbs\r\n private IroncladAppVerb loaderVerb;\r\n private IroncladAppVerb appVerb;\r\n private BatchVerifyVerb batchVerb;\r\n private VerificationResultSummaryVerb batchSummaryVerb;\r\n\r\n public BootableAppVerb(SourcePath dfyroot, DafnyCCVerb.FramePointerMode useFramePointer, VerificationRequest verificationRequest)\r\n {\r\n this.dfyroot = dfyroot;\r\n this.verificationRequest = verificationRequest;\r\n string concreteId = verificationRequest.ToString() + \",\" + useFramePointer.ToString();\r\n this.abstractId = new AbstractId(this.GetType().Name, version, dfyroot.ToString(), concrete: concreteId);\r\n\r\n string targetDirectory = Path.Combine(\r\n BuildEngine.theEngine.getObjRoot(),\r\n dfyroot.getDirPath(),\r\n \"bootable-\" + verificationRequest.ToString());\r\n this.bootIniFile = new BuildObject(Path.Combine(targetDirectory, \"safeos\\\\boot.ini\"));\r\n\r\n // TODO: Create the bootloader verb.\r\n\r\n this.loaderVerb = new IroncladAppVerb(new SourcePath(LOADER_DFY), IroncladAppVerb.TARGET.BARE_METAL, useFramePointer, verificationRequest);\r\n this.appVerb = new IroncladAppVerb(dfyroot, IroncladAppVerb.TARGET.BARE_METAL, useFramePointer, verificationRequest);\r\n\r\n this.batchVerb = new BatchVerifyVerb(dfyroot, new HashSet() { this.appVerb, this.loaderVerb }, BatchVerifyVerb.BatchMode.APP);\r\n this.batchSummaryVerb = new VerificationResultSummaryVerb(this.batchVerb);\r\n\r\n this.loaderCopy = new BuildObject(Path.Combine(targetDirectory, this.targetExecutableName(this.loaderVerb)));\r\n this.bootloaderCopy = new BuildObject(Path.Combine(targetDirectory, this.bootloader.getFileName()));\r\n this.appExecutableCopy = new BuildObject(Path.Combine(targetDirectory, this.targetExecutableName(this.appVerb)));\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n List result = new List();\r\n ////result.Add(this.bootloader); // TODO: Replace with the bootloader verbs's output.\r\n result.Add(this.loaderVerb.getExe());\r\n result.Add(this.appVerb.getExe());\r\n\r\n result.AddRange(this.batchSummaryVerb.getOutputs());\r\n\r\n ddisp = DependencyDisposition.Complete;\r\n return result;\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n if (this.verificationRequest.isComplete())\r\n {\r\n VerificationResult vr = VerificationResult.fromXmlFile(this.batchSummaryVerb.getOutputFile());\r\n\r\n if (!vr.pass)\r\n {\r\n Util.Assert(false); // Should never get here, since Ironclad app should fail before producing a verified exe.\r\n return new VerbSyncWorker(workingDirectory, new Failed());\r\n }\r\n }\r\n\r\n // Copy the AppLoader binary and the bootloader into the same directory as the app's binary, so the pxe-loader can find them.\r\n // REVIEW: Not clear this is doing the right thing with shift to WorkingDirectory.\r\n File.Copy(workingDirectory.PathTo(this.loaderVerb.getExe()), workingDirectory.PathTo(this.loaderCopy), true);\r\n File.Copy(workingDirectory.PathTo(this.appVerb.getExe()), workingDirectory.PathTo(this.appExecutableCopy), true);\r\n File.Copy(workingDirectory.PathTo(this.bootloader), workingDirectory.PathTo(this.bootloaderCopy), true);\r\n\r\n this.writeBootFile(workingDirectory);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n List result = new List();\r\n ////result.Add(bootloaderVerb); // TODO when we're building the bootloader as part of NuBuild.\r\n result.Add(this.batchSummaryVerb);\r\n result.Add(this.appVerb);\r\n result.Add(this.loaderVerb);\r\n\r\n return result;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { this.bootIniFile, this.loaderCopy, this.bootloaderCopy };\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override Presentation getPresentation()\r\n {\r\n return this.batchSummaryVerb.getPresentation();\r\n }\r\n\r\n private string targetExecutableName(IroncladAppVerb fromVerb)\r\n {\r\n // It's okay that we're saving an unverified binary to a .exe extension, because it's\r\n // getting placed inside targetDirectory, which is labeled \"bootable-unverified.\"\r\n return fromVerb.getAppLabel() + IroncladAppVerb.TRUSTED_EXE_EXTN;\r\n }\r\n\r\n // TODO: Rename obj to something meaningful. Is it a boot file?\r\n private string mkBootFileEntry(WorkingDirectory workingDirectory, BuildObject obj)\r\n {\r\n return string.Format(\"Size={0} Path=/{1}\", new FileInfo(workingDirectory.PathTo(obj)).Length, obj.getFileName());\r\n }\r\n\r\n private void writeBootFile(WorkingDirectory workingDirectory)\r\n {\r\n List lines = new List();\r\n\r\n lines.Add(this.mkBootFileEntry(workingDirectory, this.loaderCopy));\r\n lines.Add(this.mkBootFileEntry(workingDirectory, this.appExecutableCopy));\r\n\r\n File.WriteAllLines(workingDirectory.PathTo(this.bootIniFile), lines);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BuildEngine.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.IO;\r\n\r\n internal class BuildEngine\r\n {\r\n public const string VerveTrustedSpecDir = \"Trusted\\\\Spec\";\r\n\r\n private static BuildEngine _theEngine = new BuildEngine();\r\n\r\n private PathNormalizer pathNormalizer;\r\n private SourcePathIncludeContext vervePathContext;\r\n private string ironRoot;\r\n private Hasher hasher;\r\n private Repository repository;\r\n private CloudExecutionQueue cloudExecutionQueue;\r\n private string cloudReportQueueName;\r\n private ItemCacheCloud cloudItemCache;\r\n private IItemCache itemCache;\r\n private string localCacheLocation = \"nucache\";\r\n\r\n public BuildEngine()\r\n {\r\n this.pathNormalizer = new PathNormalizer();\r\n this.hasher = new Hasher();\r\n }\r\n\r\n public static BuildEngine theEngine\r\n {\r\n get { return _theEngine; }\r\n }\r\n\r\n internal Repository Repository\r\n {\r\n get { return this.repository; }\r\n set { this.repository = value; }\r\n }\r\n\r\n internal CloudExecutionQueue CloudExecutionQueue\r\n {\r\n get { return this.cloudExecutionQueue; }\r\n set { this.cloudExecutionQueue = value; }\r\n }\r\n\r\n internal string CloudReportQueueName\r\n {\r\n get { return this.cloudReportQueueName; }\r\n set { this.cloudReportQueueName = value; }\r\n }\r\n\r\n internal ItemCacheCloud CloudCache\r\n {\r\n get { return this.cloudItemCache; }\r\n set { this.cloudItemCache = value; }\r\n }\r\n\r\n internal IItemCache ItemCache\r\n {\r\n get { return this.itemCache; }\r\n set { this.itemCache = value; }\r\n }\r\n\r\n public SourcePathIncludeContext getVervePathContext()\r\n {\r\n if (this.vervePathContext == null)\r\n {\r\n Util.Assert(this.ironRoot != null);\r\n this.vervePathContext = new SourcePathIncludeContext();\r\n this.vervePathContext.addDirectory(VerveTrustedSpecDir);\r\n this.vervePathContext.addDirectory(\"Checked\\\\Nucleus\\\\Base\");\r\n this.vervePathContext.addDirectory(\"Checked\\\\Nucleus\\\\GC\");\r\n this.vervePathContext.addDirectory(\"Checked\\\\Nucleus\\\\Devices\");\r\n this.vervePathContext.addDirectory(\"Checked\\\\Nucleus\\\\Main\");\r\n\r\n this.vervePathContext.addDstExtension(BeatExtensions.BEATIFC_EXTN);\r\n this.vervePathContext.addDstExtension(BeatExtensions.BEATIMP_EXTN);\r\n this.vervePathContext.addDstExtension(BoogieAsmVerifyVerb.BASMIFC_EXTN);\r\n this.vervePathContext.addDstExtension(BoogieAsmVerifyVerb.BASMIMP_EXTN);\r\n }\r\n\r\n return this.vervePathContext;\r\n }\r\n\r\n public IContextGeneratingVerb getVerveContextVerb(PoundDefines poundDefines)\r\n {\r\n return new StaticContextVerb(this.getVervePathContext(), \"Verve\", poundDefines);\r\n }\r\n\r\n ////public TransitiveIncludesCache getDafnyIncludeCache()\r\n ////{\r\n //// return dafnyIncludeCache;\r\n ////}\r\n\r\n ////public TransitiveIncludesCache getBeatIncludeCache(IIncludePathContext context)\r\n ////{\r\n //// if (!contextToCache.ContainsKey(context))\r\n //// {\r\n //// contextToCache[context] = new TransitiveIncludesCache(new BeatIncludes(context));\r\n //// }\r\n //// return contextToCache[context];\r\n ////}\r\n\r\n public string getIronRoot()\r\n {\r\n return this.ironRoot;\r\n }\r\n\r\n internal void setIronRoot(string ironRoot)\r\n {\r\n this.ironRoot = this.pathNormalizer.normalizeAbsolutePath(ironRoot);\r\n }\r\n\r\n // Normalize the case of an ironRoot-relative path to the case present in the filesystem.\r\n internal string normalizeIronPath(string ironRelPath)\r\n {\r\n string abspath = this.pathNormalizer.normalizeAbsolutePath(Path.GetFullPath(Path.Combine(this.ironRoot, ironRelPath)));\r\n Util.Assert(abspath.StartsWith(this.ironRoot));\r\n return abspath.Substring(this.ironRoot.Length);\r\n }\r\n\r\n internal string getObjRoot()\r\n {\r\n return \"nuobj\";\r\n }\r\n\r\n internal string getSrcRoot()\r\n {\r\n return \"src\";\r\n }\r\n\r\n internal string getVirtualRoot()\r\n {\r\n return this.getObjRoot() + \"\\\\virtual\"; // Should never exist in filesystem!\r\n }\r\n\r\n internal string getToolsRoot()\r\n {\r\n return \"tools\";\r\n }\r\n\r\n internal string getBinToolsRoot()\r\n {\r\n return \"bin_tools\";\r\n }\r\n\r\n internal void setLocalCache(string path)\r\n {\r\n this.localCacheLocation = path;\r\n }\r\n\r\n internal string getLocalCache()\r\n {\r\n return this.localCacheLocation;\r\n }\r\n\r\n internal IHasher getHasher()\r\n {\r\n return this.hasher;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BuildObject.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Xml;\r\n\r\n /// \r\n /// An abstract identifier for \"nouns\" (i.e. the things that verbs operate\r\n /// on -- both verb outputs and dependencies are BuildObjects).\r\n /// \r\n /// \r\n /// Note that sometimes the code and/or comments about the code refer to\r\n /// BuildObjects as if they are the concrete thing that they identify as\r\n /// opposed to just being the abstract identifier for that thing. This is\r\n /// probably okay, as there should be just one concrete instance of any\r\n /// particular abstract build object during a given run of the system.\r\n /// \r\n public class BuildObject\r\n {\r\n /// \r\n /// The XML element name for this object.\r\n /// \r\n public const string XmlTag = \"BuildObject\";\r\n\r\n /// \r\n /// Path to this object as stored in the local filesystem, relative to\r\n /// the IronRoot (i.e. begins with \"src\", \"obj\", etc.).\r\n /// \r\n /// \r\n /// This string is expected to be normalized to have consistent casing.\r\n /// \r\n protected string path;\r\n\r\n /// \r\n /// Whether this object is considered \"trusted\" for verification\r\n /// purposes.\r\n /// \r\n private bool isTrusted;\r\n\r\n /// \r\n /// The filename of this object, without the file extension.\r\n /// \r\n private string filenameWithoutExtension;\r\n\r\n /// \r\n /// The filename extension for this object.\r\n /// \r\n private string filenameExtension;\r\n\r\n /// \r\n /// Initializes a new instance of the BuildObject class.\r\n /// \r\n /// \r\n /// Relative path to this object in the local filesystem.\r\n /// \r\n /// \r\n /// Whether this object is considered \"trusted\" for verification\r\n /// purposes.\r\n /// \r\n public BuildObject(string path, bool isTrusted = false)\r\n {\r\n // ToDo: Fix VSSolutionVerb and/or IronfleetTestDriver.sln to work in \"src\" tree without hitting below Assert. Then re-instate below Assert.\r\n ////Util.Assert(!path.StartsWith(BuildEngine.theEngine.getSrcRoot(), StringComparison.OrdinalIgnoreCase));\r\n this.path = BuildEngine.theEngine.normalizeIronPath(path);\r\n this.isTrusted = isTrusted;\r\n }\r\n\r\n /// \r\n /// Initializes a new instance of the BuildObject class.\r\n /// \r\n /// \r\n /// Relative path to this object in the local filesystem.\r\n /// \r\n protected BuildObject(string path)\r\n {\r\n this.path = BuildEngine.theEngine.normalizeIronPath(path);\r\n }\r\n\r\n /// \r\n /// Gets or sets a value indicating whether this object is considered\r\n /// \"trusted\" for verification purposes.\r\n /// \r\n /// \r\n /// REVIEW: Giving build objects properties like this is dangerous,\r\n /// as they are supposed to be just abstract ids. Two equivalent\r\n /// (per Equals() below) build objects could be created, and should\r\n /// reference the same bag of bits, yet have different properties!\r\n /// \r\n public bool IsTrusted\r\n {\r\n get { return this.isTrusted; }\r\n protected set { this.isTrusted = value; }\r\n }\r\n\r\n /// \r\n /// Gets the relative path for this instance.\r\n /// \r\n /// \r\n /// TODO: Replace this with a property (\"RelativePath\"?) that is\r\n /// public get and protected set. And change this.path from\r\n /// protected to private.\r\n /// \r\n /// The relative path for this instance.\r\n public string getRelativePath()\r\n {\r\n return this.path;\r\n }\r\n\r\n /// \r\n /// Returns a string that represents this instance.\r\n /// \r\n /// A string that represents this instance.\r\n public override string ToString()\r\n {\r\n return this.path;\r\n }\r\n\r\n /// \r\n /// Gets the directory information for this instance.\r\n /// \r\n /// The directory information for this instance.\r\n public string getDirPath()\r\n {\r\n return Path.GetDirectoryName(this.path);\r\n }\r\n\r\n /// \r\n /// Gets the file name and extension for this instance.\r\n /// \r\n /// The file name and extension for this instance.\r\n public string getFileName()\r\n {\r\n return Path.GetFileName(this.path);\r\n }\r\n\r\n /// \r\n /// Gets the file name (sans extension) for this instance.\r\n /// \r\n /// The file name (sans extension) for this instance.\r\n public string getFileNameWithoutExtension()\r\n {\r\n this.splitExtension();\r\n return this.filenameWithoutExtension;\r\n }\r\n\r\n /// \r\n /// Gets the file extension for this instance.\r\n /// \r\n /// The file extension for this instance.\r\n public string getExtension()\r\n {\r\n this.splitExtension();\r\n return this.filenameExtension;\r\n }\r\n\r\n /// \r\n /// Determines whether this instance and another specified BuildObject\r\n /// object have the same value (identity?). Really, the same path.\r\n /// \r\n /// The object to compare to this instance.\r\n /// \r\n /// True if the given object is equivalent to this instance,\r\n /// false otherwise.\r\n /// \r\n public override bool Equals(object obj)\r\n {\r\n BuildObject other = obj as BuildObject;\r\n if (other != null)\r\n {\r\n return this.path.Equals(other.path, StringComparison.Ordinal);\r\n }\r\n else\r\n {\r\n return false;\r\n }\r\n }\r\n\r\n /// \r\n /// Returns the hash code for this instance.\r\n /// \r\n /// \r\n /// Note that equivalent (as in .Equals returns true) instances\r\n /// will have the same hash code.\r\n /// \r\n /// The hash code for this instance.\r\n public override int GetHashCode()\r\n {\r\n return this.path.GetHashCode();\r\n }\r\n\r\n /// \r\n /// Creates a new instance based on this one, but with the given\r\n /// extension, and guaranteed to be in the obj directory.\r\n /// \r\n /// Extension to give new instance.\r\n /// A new instance.\r\n public BuildObject makeOutputObject(string extension)\r\n {\r\n return new BuildObject(this.mashedPathname(BuildEngine.theEngine.getObjRoot(), extension));\r\n }\r\n\r\n /// \r\n /// Creates a new instance based on this one, but for the given\r\n /// appLabel (REVIEW: what does this mean?), with the given\r\n /// extension, and guaranteed to be in the obj directory.\r\n /// \r\n /// The app label to use.\r\n /// Extension to give new instance.\r\n /// A new instance.\r\n public BuildObject makeLabeledOutputObject(string appLabel, string extension)\r\n {\r\n string appSpecificPrefix =\r\n appLabel == null\r\n ? BuildEngine.theEngine.getObjRoot()\r\n : Path.Combine(BuildEngine.theEngine.getObjRoot(), appLabel);\r\n\r\n // REVIEW: Ordinal vs. OrdinalIgnoreCase.\r\n if (this.path.StartsWith(appSpecificPrefix, StringComparison.OrdinalIgnoreCase))\r\n {\r\n // Input is already in the correct subtree; don't nest subtrees.\r\n return this.makeOutputObject(extension);\r\n }\r\n else\r\n {\r\n // Input is coming from elsewhere; give it a parallel location under app-specific subtree.\r\n return new BuildObject(this.mashedPathname(appSpecificPrefix, extension));\r\n }\r\n }\r\n\r\n /// \r\n /// Creates a new VirtualBuildObject based on this instance, but with\r\n /// a path modified to be virtual and have the given extension.\r\n /// \r\n /// \r\n /// Filename extension to give the new object.\r\n /// \r\n /// A new VirtualBuildObject.\r\n public BuildObject makeVirtualObject(string extension)\r\n {\r\n return new VirtualBuildObject(this.mashedPathname(BuildEngine.theEngine.getVirtualRoot(), extension));\r\n }\r\n\r\n /// \r\n /// Helper function to read an XML element (not a full document)\r\n /// representing a BuildObject.\r\n /// \r\n /// \r\n /// Note that the XmlReader is expected to be positioned in the XML\r\n /// document such that the current node is a BuildObject element.\r\n /// \r\n /// The XmlReader object to read from.\r\n /// \r\n /// A new BuildObject corresponding to the XML representation read.\r\n /// \r\n public static BuildObject ReadXml(XmlReader xr)\r\n {\r\n Util.Assert(xr.Name.Equals(XmlTag));\r\n string relativePath = xr.ReadElementContentAsString();\r\n return new BuildObject(relativePath);\r\n }\r\n\r\n /// \r\n /// Helper function to write an XML element (not a full document)\r\n /// representing this BuildObject.\r\n /// \r\n /// The XmlWriter object to write to.\r\n public void WriteXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(XmlTag);\r\n xw.WriteString(this.path);\r\n xw.WriteEndElement();\r\n }\r\n\r\n /// \r\n /// Splits the filename of this object into its separate base and\r\n /// extension components.\r\n /// \r\n private void splitExtension()\r\n {\r\n if (this.filenameWithoutExtension == null)\r\n {\r\n string filename = this.getFileName();\r\n int dot = filename.IndexOf('.');\r\n if (dot < 0)\r\n {\r\n this.filenameWithoutExtension = filename;\r\n this.filenameExtension = null;\r\n }\r\n else\r\n {\r\n this.filenameExtension = filename.Substring(dot);\r\n\r\n // TODO: This is a (possibly brittle) workaround for dfy .s\r\n // and .i, which aren't part of the file type, they're part\r\n // of the name. Sorta.\r\n if (DafnyTransformBaseVerb.DAFNY_LONG_EXTNS.Contains(this.filenameExtension))\r\n {\r\n dot += 2;\r\n this.filenameExtension = filename.Substring(dot);\r\n }\r\n\r\n this.filenameWithoutExtension = filename.Substring(0, dot);\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Combines the provided root path and extension with this\r\n /// instance's relative path and munged (for DafnySpec/CC) filename.\r\n /// \r\n /// The desired root path.\r\n /// The desired extension.\r\n /// A combined pathname.\r\n private string mashedPathname(string root, string extension)\r\n {\r\n string filename = this.getFileNameWithoutExtension();\r\n\r\n // Remap dafny filenames so resulting objects have correctly-parsed extns.\r\n filename = Util.dafnySpecMungeName(filename);\r\n\r\n return Path.Combine(root, this.getDirRelativeToSrcOrObj(), filename + extension);\r\n }\r\n\r\n /// \r\n /// Strips off the initial 'src\\' or 'obj\\' from the path.\r\n /// \r\n /// \r\n /// The directory containing this object, relative to the source or\r\n /// object directory.\r\n /// \r\n private string getDirRelativeToSrcOrObj()\r\n {\r\n string dirname = this.getDirPath();\r\n int slash = dirname.IndexOf('\\\\');\r\n Util.Assert(slash >= 0);\r\n return dirname.Substring(slash + 1);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/BuildObjectValuePointer.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Xml;\r\n\r\n /// \r\n /// Mapping between a BuildObject (an abstract identifier) and the hash\r\n /// value of the build object's contents (concrete identifier) for this run.\r\n /// REVIEW: Come up with a better name for this?\r\n /// \r\n public class BuildObjectValuePointer\r\n {\r\n /// \r\n /// The XML element name for this object.\r\n /// \r\n public const string XmlTag = \"BuildObjectValuePointer\";\r\n\r\n /// \r\n /// The XML attribute name for the ObjectHash value.\r\n /// \r\n private const string XmlObjectHashAttribute = \"ObjectHash\";\r\n\r\n /// \r\n /// The XML attribute name for the RelativePath value.\r\n /// \r\n private const string XmlRelativePathAttribute = \"RelativePath\";\r\n\r\n /// \r\n /// Hash of the contents referenced by the build object.\r\n /// \r\n private string objectHash;\r\n\r\n /// \r\n /// Path to the build object, relative to the IronRoot.\r\n /// \r\n private string relativePath;\r\n\r\n /// \r\n /// Initializes a new instance of the BuildObjectValuePointer class.\r\n /// \r\n /// \r\n /// Hash of the contents referenced by the build object.\r\n /// \r\n /// \r\n /// Path to the build object, relative to the IronRoot.\r\n /// \r\n public BuildObjectValuePointer(string objectHash, string relativePath)\r\n {\r\n this.objectHash = objectHash;\r\n this.relativePath = relativePath;\r\n }\r\n\r\n /// \r\n /// Gets the hash of the contents referenced by the build object.\r\n /// \r\n public string ObjectHash\r\n {\r\n get { return this.objectHash; }\r\n }\r\n\r\n /// \r\n /// Gets the path to the build object, relative to the IronRoot.\r\n /// \r\n public string RelativePath\r\n {\r\n get { return this.relativePath; } \r\n }\r\n\r\n /// \r\n /// Helper function to read an XML element (not a full document)\r\n /// representing a BuildObjectValuePointer.\r\n /// \r\n /// \r\n /// Note that the XmlReader is expected to be positioned in the XML\r\n /// document such that the current node is a BuildObjectValuePointer\r\n /// element.\r\n /// \r\n /// The XmlReader object to read from.\r\n /// \r\n /// A new BuildObjectValuePointer corresponding to the XML\r\n /// representation read.\r\n /// \r\n public static BuildObjectValuePointer ReadXml(XmlReader xr)\r\n {\r\n Util.Assert(xr.Name.Equals(XmlTag));\r\n string objectHash = xr.GetAttribute(XmlObjectHashAttribute);\r\n string relativePath = xr.GetAttribute(XmlRelativePathAttribute);\r\n return new BuildObjectValuePointer(objectHash, relativePath);\r\n }\r\n\r\n /// \r\n /// Helper function to write an XML element (not a full document)\r\n /// representing this BuildObjectValuePointer.\r\n /// \r\n /// The XmlWriter object to write to.\r\n public void WriteXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(XmlTag);\r\n xw.WriteAttributeString(XmlObjectHashAttribute, this.objectHash);\r\n xw.WriteAttributeString(XmlRelativePathAttribute, this.relativePath);\r\n xw.WriteEndElement();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/CachedHash.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class CachedHash\r\n {\r\n private Dictionary hashCache;\r\n private HashFunc hashFunc;\r\n private FailureBehavior failureBehavior;\r\n private CachabilityTestFunc cachabilityTest;\r\n\r\n public CachedHash(\r\n HashFunc hashFunc,\r\n FailureBehavior failureBehavior = FailureBehavior.AssertFailures,\r\n CachabilityTestFunc cachabilityTest = null)\r\n {\r\n this.hashCache = new Dictionary();\r\n this.hashFunc = hashFunc;\r\n this.failureBehavior = failureBehavior;\r\n this.cachabilityTest = cachabilityTest;\r\n }\r\n\r\n public delegate ValueType HashFunc(HashedObjectType hashObj);\r\n\r\n public delegate bool CachabilityTestFunc(ValueType value);\r\n\r\n public enum FailureBehavior\r\n {\r\n IgnoreFailures,\r\n AssertFailures\r\n }\r\n\r\n public ValueType get(HashedObjectType hashObj)\r\n {\r\n if (!this.hashCache.ContainsKey(hashObj))\r\n {\r\n ValueType value = this.hashFunc(hashObj);\r\n if (value == null)\r\n {\r\n Util.Assert(this.failureBehavior == FailureBehavior.IgnoreFailures);\r\n return value;\r\n }\r\n else if (this.cachabilityTest != null && !this.cachabilityTest(value))\r\n {\r\n return value;\r\n }\r\n else\r\n {\r\n this.hashCache[hashObj] = value;\r\n }\r\n }\r\n\r\n return this.hashCache[hashObj];\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/CloudExecutionQueue.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Configuration;\r\n using System.IO;\r\n using System.Threading;\r\n using Microsoft.WindowsAzure.Storage;\r\n using Microsoft.WindowsAzure.Storage.Queue;\r\n\r\n /// \r\n /// Represents the queue used to make requests of cloud execution engines.\r\n /// \r\n public class CloudExecutionQueue\r\n {\r\n // Note that queue names must be all lowercase.\r\n // See http://msdn.microsoft.com/en-us/library/dd179349.aspx.\r\n\r\n /// \r\n /// Maximum interval to wait between polls of the request queue.\r\n /// In milliseconds.\r\n /// \r\n /// \r\n /// REVIEW: Is 30 seconds a reasonable cap?\r\n /// \r\n private const int RequestQueuePollIntervalCap = 30000;\r\n\r\n /// \r\n /// Name of the request queue.\r\n /// \r\n private const string RequestQueueName = \"requests\";\r\n\r\n /// \r\n /// Name of the default report queue.\r\n /// \r\n private const string ReportQueueName = \"reports\";\r\n\r\n /// \r\n /// Expiration time for request/report queue entries.\r\n /// Most queue entries should be picked up almost immediately,\r\n /// this is to prevent orphaned entries from hanging around \"forever\".\r\n /// \r\n private readonly TimeSpan queueEntryTtl;\r\n\r\n /// \r\n /// Azure storage account we're using.\r\n /// \r\n private CloudStorageAccount storageAccount;\r\n\r\n /// \r\n /// Cloud queue client for working with cloud queues.\r\n /// \r\n private CloudQueueClient queueClient;\r\n\r\n /// \r\n /// Queue to hold execution requests.\r\n /// \r\n private CloudQueue requestQueue;\r\n\r\n /// \r\n /// Queue to hold execution reports.\r\n /// \r\n private CloudQueue clientReportQueue;\r\n\r\n /// \r\n /// Cache of current request's report queue.\r\n /// \r\n private CloudQueue cachedServerReportQueue;\r\n\r\n /// \r\n /// Name of the cached report queue.\r\n /// \r\n private string cachedServerReportQueueName;\r\n\r\n /// \r\n /// Waiters for execution reports.\r\n /// \r\n private Dictionary reportWaiters;\r\n\r\n /// \r\n /// Lock for the reportWaiters dictionary.\r\n /// \r\n private Mutex reportWaitersLock;\r\n\r\n /// \r\n /// Event that is signaled (i.e. set) if we have active waiters for execution reports.\r\n /// \r\n private ManualResetEvent haveReportWaiters;\r\n\r\n /// \r\n /// Thread that monitors the report queue.\r\n /// \r\n private Thread monitoringThread;\r\n\r\n /// \r\n /// Initializes a new instance of the CloudExecutionQueue class.\r\n /// \r\n /// \r\n /// This is the constructor for servers.\r\n /// \r\n public CloudExecutionQueue()\r\n {\r\n // Work-around for running this code in CloudExecutionEngine. TODO: Clean this up!\r\n // The BuildEngine.theEngine.getIronRoot() call needs to work for BuildObject code to function properly.\r\n if (BuildEngine.theEngine.getIronRoot() == null)\r\n {\r\n BuildEngine.theEngine.setIronRoot(Directory.GetCurrentDirectory());\r\n }\r\n\r\n this.queueEntryTtl = new TimeSpan(0, 30, 0); // 30 minutes.\r\n\r\n // Create our CloudStorageAccount object.\r\n // REVIEW: Hard-coded connection string index \"Ironclad\".\r\n string connectionString = null;\r\n ConnectionStringSettings settings = ConfigurationManager.ConnectionStrings[\"Ironclad\"];\r\n if (settings != null)\r\n {\r\n connectionString = settings.ConnectionString;\r\n }\r\n\r\n if (string.IsNullOrEmpty(connectionString))\r\n {\r\n throw new ConfigurationException(\"Azure connection string missing from your NuBuild.exe.config file!\");\r\n }\r\n\r\n this.storageAccount = CloudStorageAccount.Parse(connectionString);\r\n\r\n this.queueClient = this.storageAccount.CreateCloudQueueClient();\r\n\r\n this.requestQueue = this.queueClient.GetQueueReference(CloudExecutionQueue.RequestQueueName);\r\n this.requestQueue.CreateIfNotExists();\r\n }\r\n\r\n /// \r\n /// Initializes a new instance of the CloudExecutionQueue class.\r\n /// \r\n /// \r\n /// This is the constructor for clients (does extra stuff).\r\n /// \r\n /// Name of the report queue this client is using.\r\n public CloudExecutionQueue(string reportQueueName)\r\n : this()\r\n {\r\n if (string.IsNullOrEmpty(reportQueueName))\r\n {\r\n // Use default shared report queue if none is specified.\r\n reportQueueName = CloudExecutionQueue.ReportQueueName;\r\n }\r\n else\r\n {\r\n // Schedule auto-deletion of our private report queue.\r\n // We do this by setting the initial invisibility of a delete queue request.\r\n // This will auto-clean up our private report queue if we exit unexpectedly.\r\n CloudExecutionRequest deleteQueueRequest = new CloudExecutionRequest(\r\n reportQueueName,\r\n reportQueueName,\r\n CloudExecutionRequest.Operation.DeleteQueue,\r\n null,\r\n null,\r\n null,\r\n null\r\n );\r\n CloudQueueMessage deleteQueueMessage = new CloudQueueMessage(deleteQueueRequest.ToXml());\r\n this.requestQueue.AddMessage(deleteQueueMessage, new TimeSpan(12, 0, 0), new TimeSpan(4, 0, 0));\r\n }\r\n\r\n this.clientReportQueue = this.queueClient.GetQueueReference(reportQueueName);\r\n this.clientReportQueue.CreateIfNotExists();\r\n\r\n this.reportWaiters = new Dictionary();\r\n this.reportWaitersLock = new Mutex();\r\n this.haveReportWaiters = new ManualResetEvent(false);\r\n\r\n this.monitoringThread = new Thread(new ThreadStart(this.MonitorReportQueue));\r\n this.monitoringThread.IsBackground = true;\r\n this.monitoringThread.Name = \"Report Queue Monitor\";\r\n this.monitoringThread.Start();\r\n }\r\n\r\n /// \r\n /// Deletes the specified queue.\r\n /// \r\n /// Name of the queue to delete.\r\n public void DeleteQueue(string queueName)\r\n {\r\n CloudQueue goner = this.queueClient.GetQueueReference(queueName);\r\n goner.DeleteIfExists();\r\n }\r\n\r\n /// \r\n /// Submits a request for cloud execution.\r\n /// \r\n /// \r\n /// The CloudExecutionRequest detailing this request.\r\n /// \r\n public void SubmitRequest(CloudExecutionRequest request)\r\n {\r\n CloudQueueMessage message = new CloudQueueMessage(request.ToXml());\r\n this.requestQueue.AddMessage(message, this.queueEntryTtl);\r\n }\r\n\r\n /// \r\n /// Gets the next request from the request queue.\r\n /// \r\n /// Whether to block.\r\n /// Next request on the queue.\r\n public CloudExecutionRequest GetRequest(bool block = false)\r\n {\r\n int pollInterval = 1000; // In milliseconds.\r\n\r\n CloudQueueMessage message = null;\r\n while ((message = this.requestQueue.GetMessage()) == null)\r\n {\r\n if (block)\r\n {\r\n Thread.Sleep(pollInterval);\r\n\r\n // Increase poll interval if we're below the cap.\r\n if (pollInterval < RequestQueuePollIntervalCap)\r\n {\r\n // Increase by 1/10th of a second each time.\r\n // This will take 14.5s to reach a 2s interval.\r\n pollInterval += 100;\r\n }\r\n\r\n continue;\r\n }\r\n else\r\n {\r\n return null;\r\n }\r\n }\r\n\r\n ////Console.WriteLine(message.AsString);\r\n\r\n CloudExecutionRequest request = CloudExecutionRequest.FromMessage(message);\r\n\r\n return request;\r\n }\r\n\r\n /// \r\n /// Deletes a request from the queue.\r\n /// Used by reader to indicate request completion.\r\n /// \r\n /// Request to delete.\r\n public void DeleteRequest(CloudExecutionRequest request)\r\n {\r\n CloudQueueMessage message = request.Message;\r\n this.requestQueue.DeleteMessage(message);\r\n }\r\n\r\n /// \r\n /// Submits a report of cloud execution for processing by the submitter.\r\n /// \r\n /// Report to submit.\r\n /// Name of the report queue to submit to.\r\n public void SubmitReport(CloudExecutionReport report, string reportQueueName)\r\n {\r\n // Check to see if we need to update the cached report queue.\r\n if (reportQueueName != this.cachedServerReportQueueName)\r\n {\r\n this.cachedServerReportQueue = this.queueClient.GetQueueReference(reportQueueName);\r\n this.cachedServerReportQueue.CreateIfNotExists();\r\n this.cachedServerReportQueueName = reportQueueName;\r\n }\r\n\r\n CloudQueueMessage message = new CloudQueueMessage(report.ToXml());\r\n this.cachedServerReportQueue.AddMessage(message, this.queueEntryTtl);\r\n }\r\n\r\n /// \r\n /// Gets the requested execution report off of the queue.\r\n /// \r\n /// Report to retrieve.\r\n /// Count of remaining waiters after our report arrives.\r\n /// The execution report in question.\r\n public CloudExecutionReport GetReport(string reportIdentifier, out int numberOfOtherWaiters)\r\n {\r\n CloudExecutionWaiter waiter = new CloudExecutionWaiter();\r\n\r\n // Add the desired report to the dictionary under lock.\r\n this.reportWaitersLock.WaitOne();\r\n this.reportWaiters.Add(reportIdentifier, waiter);\r\n this.haveReportWaiters.Set();\r\n this.reportWaitersLock.ReleaseMutex();\r\n\r\n // Wait for report to arrive, and then return it.\r\n return waiter.WaitForReport(out numberOfOtherWaiters);\r\n }\r\n\r\n /// \r\n /// Procedure performed by the report queue monitoring thread.\r\n /// \r\n private void MonitorReportQueue()\r\n {\r\n const int MaxBatchSize = 32; // Maximum allowed by API.\r\n TimeSpan invisibleTime = new TimeSpan(0, 0, 2); // Two seconds.\r\n TimeSpan pollInterval = new TimeSpan(0, 0, 1); // One second.\r\n\r\n List messages;\r\n bool anyForUs;\r\n\r\n while (true)\r\n {\r\n // Don't bother doing anything if we don't have any active waiters.\r\n this.haveReportWaiters.WaitOne();\r\n\r\n // Get a new batch of messages.\r\n // No other queue readers will see these until the invisibleTime expires.\r\n messages = new List(this.clientReportQueue.GetMessages(MaxBatchSize, invisibleTime));\r\n anyForUs = false;\r\n\r\n foreach (CloudQueueMessage message in messages)\r\n {\r\n CloudExecutionReport report = CloudExecutionReport.FromMessage(message);\r\n\r\n // Lookup the waiter for this report under lock.\r\n CloudExecutionWaiter waiter;\r\n int remainingWaitersCount = 0;\r\n this.reportWaitersLock.WaitOne();\r\n bool foundWaiter = this.reportWaiters.TryGetValue(report.Identifier, out waiter);\r\n if (foundWaiter && report.Status == CloudExecutionReport.StatusCode.Completed)\r\n {\r\n this.reportWaiters.Remove(report.Identifier);\r\n remainingWaitersCount = this.reportWaiters.Count;\r\n if (remainingWaitersCount == 0)\r\n {\r\n // We don't have anyone else waiting for a report.\r\n this.haveReportWaiters.Reset();\r\n }\r\n }\r\n\r\n this.reportWaitersLock.ReleaseMutex();\r\n\r\n if (foundWaiter)\r\n {\r\n // We delete the report from the queue right away,\r\n // as nobody else should ever be interested in it.\r\n this.clientReportQueue.DeleteMessage(message);\r\n anyForUs = true;\r\n\r\n switch (report.Status)\r\n {\r\n case CloudExecutionReport.StatusCode.Completed:\r\n waiter.GiveReportToWaiter(report, remainingWaitersCount);\r\n break;\r\n\r\n case CloudExecutionReport.StatusCode.InProgress:\r\n Console.WriteLine(\"Node '{0}' reports request '{1}' is in progress.\", report.ProcessingNode, report.Identifier);\r\n break;\r\n\r\n default:\r\n // REVIEW: Or just Assert here? This should never happen.\r\n Console.WriteLine(\"Node '{0}' reports strange status '{1}' for request '{2}'.\", report.ProcessingNode, report.Status, report.Identifier);\r\n break;\r\n }\r\n }\r\n }\r\n\r\n if ((messages.Count != 0) && !anyForUs)\r\n {\r\n // Give other client(s) a chance to get their messages.\r\n Thread.Sleep(invisibleTime + pollInterval + pollInterval);\r\n }\r\n else\r\n {\r\n Thread.Sleep(pollInterval);\r\n }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/CloudExecutionReport.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Globalization;\r\n using System.IO;\r\n using System.Text;\r\n using System.Xml;\r\n using Microsoft.WindowsAzure.Storage.Queue;\r\n\r\n /// \r\n /// Message that is put on the cloud \"reports\" queue to inform a cloud\r\n /// execution engine client of the status of its request.\r\n /// \r\n public class CloudExecutionReport\r\n {\r\n /// \r\n /// XML element name for this object.\r\n /// \r\n public const string XmlTag = \"CloudExecutionReport\";\r\n\r\n /// \r\n /// Version of this object we create by default.\r\n /// \r\n private const int Version = 1;\r\n\r\n /// \r\n /// XML element name for our version field.\r\n /// \r\n private const string XmlVersionAttribute = \"Version\";\r\n\r\n /// \r\n /// XML element name for our identifier field.\r\n /// \r\n private const string XmlIdentifierElement = \"Identifier\";\r\n\r\n /// \r\n /// XML element name for our status field.\r\n /// \r\n private const string XmlStatusElement = \"Status\";\r\n\r\n /// \r\n /// XML element name for our processingNode field.\r\n /// \r\n private const string XmlProcessingNodeElement = \"ProcessingNode\";\r\n\r\n /// \r\n /// XML element name for our exitCode field.\r\n /// \r\n private const string XmlExitCodeElement = \"ExitCode\";\r\n\r\n /// \r\n /// XML element name for our standardOutput field.\r\n /// \r\n private const string XmlStandardOutputElement = \"StandardOutput\";\r\n\r\n /// \r\n /// XML element name for our standardError field.\r\n /// \r\n private const string XmlStandardErrorElement = \"StandardError\";\r\n\r\n /// \r\n /// XML element name for our cpuTime field.\r\n /// \r\n private const string XmlCpuTimeElement = \"CpuTime\";\r\n\r\n /// \r\n /// XML element name for our outputFileMappings field.\r\n /// \r\n private const string XmlOutputFileMappingsElement = \"OutputFileMappings\";\r\n\r\n /// \r\n /// Queued message this instance was created from (if it was).\r\n /// \r\n private CloudQueueMessage message;\r\n\r\n /// \r\n /// Version of this object instance.\r\n /// \r\n private int version;\r\n\r\n /// \r\n /// Request identifier this report is in response to.\r\n /// \r\n private string identifier;\r\n\r\n /// \r\n /// Status of request being conveyed by this report.\r\n /// \r\n private StatusCode status;\r\n\r\n /// \r\n /// Name of the node that produced this report.\r\n /// \r\n private string processingNode;\r\n\r\n /// \r\n /// Exit code returned from the process after execution.\r\n /// \r\n private int exitCode;\r\n\r\n /// \r\n /// Standard out from the process.\r\n /// \r\n private string standardOutput;\r\n\r\n /// \r\n /// Standard error from the process.\r\n /// \r\n private string standardError;\r\n\r\n /// \r\n /// CPU time used by the process.\r\n /// \r\n private double cpuTime;\r\n\r\n /// \r\n /// Collection of output files resulting from this execution,\r\n /// represented by both their item cache identifier and\r\n /// their relative path.\r\n /// \r\n private List outputFileMappings;\r\n\r\n /// \r\n /// Initializes a new instance of the CloudExecutionReport class.\r\n /// \r\n /// Unique ID for this instance.\r\n /// Status of the request.\r\n /// Exit code from the process.\r\n /// \r\n /// Standard output from the process execution.\r\n /// \r\n /// \r\n /// Standard error from the process execution.\r\n /// \r\n /// CPU time used by the process.\r\n /// \r\n /// Output files generated by this process execution.\r\n /// \r\n public CloudExecutionReport(\r\n string identifier,\r\n StatusCode status,\r\n int exitCode,\r\n string standardOutput,\r\n string standardError,\r\n double cpuTime,\r\n List outputFileMappings)\r\n : this(\r\n CloudExecutionReport.Version,\r\n identifier,\r\n status,\r\n Environment.MachineName, // REVIEW: Probably insecure (from user settable environment variable?). Do we care?\r\n exitCode,\r\n standardOutput,\r\n standardError,\r\n cpuTime,\r\n outputFileMappings)\r\n {\r\n }\r\n\r\n /// \r\n /// Initializes a new instance of the CloudExecutionReport class.\r\n /// \r\n /// Unique ID for this instance.\r\n /// Status of the request.\r\n public CloudExecutionReport(\r\n string identifier,\r\n StatusCode status)\r\n : this(\r\n CloudExecutionReport.Version,\r\n identifier,\r\n status,\r\n Environment.MachineName,\r\n 0,\r\n null,\r\n null,\r\n 0,\r\n null)\r\n {\r\n }\r\n\r\n /// \r\n /// Initializes a new instance of the CloudExecutionReport class.\r\n /// \r\n /// Version of this class instance.\r\n /// Unique ID for this instance.\r\n /// Status of the request.\r\n /// Name of node producing this report.\r\n /// Exit code from the process.\r\n /// \r\n /// Standard output from the process execution.\r\n /// \r\n /// \r\n /// Standard error from the process execution.\r\n /// \r\n /// CPU time used by the process.\r\n /// \r\n /// Output files generated by this process execution.\r\n /// \r\n private CloudExecutionReport(\r\n int version,\r\n string identifier,\r\n StatusCode status,\r\n string processingNode,\r\n int exitCode,\r\n string standardOutput,\r\n string standardError,\r\n double cpuTime,\r\n List outputFileMappings)\r\n {\r\n this.version = version;\r\n this.identifier = identifier;\r\n this.status = status;\r\n this.processingNode = processingNode;\r\n this.exitCode = exitCode;\r\n this.standardOutput = standardOutput;\r\n this.standardError = standardError;\r\n this.cpuTime = cpuTime;\r\n this.outputFileMappings = outputFileMappings;\r\n }\r\n\r\n /// \r\n /// Definition of Status field values.\r\n /// \r\n public enum StatusCode : int\r\n {\r\n /// \r\n /// The request was processed to completion and all other fields are meaningful.\r\n /// Note: this does NOT mean the request completed successfully.\r\n /// \r\n Completed,\r\n\r\n /// \r\n /// The request was aborted.\r\n /// \r\n Aborted,\r\n\r\n /// \r\n /// The request is in progress.\r\n /// \r\n InProgress\r\n }\r\n\r\n /// \r\n /// Gets the CloudQueueMessage this instance was derived from (if any).\r\n /// \r\n public CloudQueueMessage Message\r\n {\r\n get { return this.message; }\r\n }\r\n\r\n /// \r\n /// Gets the unique identifier for the request this report is in response to.\r\n /// \r\n public string Identifier\r\n {\r\n get { return this.identifier; }\r\n }\r\n\r\n /// \r\n /// Gets the current status of the request.\r\n /// \r\n public StatusCode Status\r\n {\r\n get { return this.status; }\r\n }\r\n\r\n /// \r\n /// Gets the name of processing node that produced this report.\r\n /// \r\n public string ProcessingNode\r\n {\r\n get { return this.processingNode; }\r\n }\r\n\r\n /// \r\n /// Gets the exit code returned from the process after execution.\r\n /// \r\n public int ExitCode\r\n {\r\n get { return this.exitCode; }\r\n }\r\n\r\n /// \r\n /// Gets the standard output from the process.\r\n /// \r\n public string StandardOutput\r\n {\r\n get { return this.standardOutput; }\r\n }\r\n\r\n /// \r\n /// Gets the standard error output from the process.\r\n /// \r\n public string StandardError\r\n {\r\n get { return this.standardError; }\r\n }\r\n\r\n /// \r\n /// Gets the CPU time used by the process execution.\r\n /// \r\n public double CpuTime\r\n {\r\n get { return this.cpuTime; }\r\n }\r\n\r\n /// \r\n /// Gets the collection of files generated by the process execution.\r\n /// \r\n public IEnumerable OutputFileMappings\r\n {\r\n get { return this.outputFileMappings; }\r\n }\r\n\r\n /// \r\n /// Creates a CloudExecutionReport from a CloudQueueMessage\r\n /// representation.\r\n /// \r\n /// \r\n /// A CloudQueueMessage containing an XML document representing a\r\n /// CloudExecutionReport.\r\n /// \r\n /// \r\n /// A new report corresponding to the XML representation contained in\r\n /// the message.\r\n /// \r\n public static CloudExecutionReport FromMessage(CloudQueueMessage message)\r\n {\r\n CloudExecutionReport report = CloudExecutionReport.FromXml(message.AsString);\r\n report.message = message;\r\n\r\n return report;\r\n }\r\n\r\n /// \r\n /// Creates a CloudExecutionReport from an XML representation.\r\n /// \r\n /// \r\n /// A string containing an XML document representing a report.\r\n /// \r\n /// \r\n /// A new report corresponding to the XML representation read.\r\n /// \r\n public static CloudExecutionReport FromXml(string xs)\r\n {\r\n XmlReader xr = XmlReader.Create(new StringReader(xs));\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n break;\r\n }\r\n }\r\n\r\n return ReadXml(xr);\r\n }\r\n\r\n /// \r\n /// Helper function to read an XML element (not a full document)\r\n /// representing a cloud execution report.\r\n /// \r\n /// \r\n /// Note that the XmlReader is expected to be positioned in the XML\r\n /// document such that the current node is a report element.\r\n /// \r\n /// The XmlReader object to read from.\r\n /// \r\n /// A new report corresponding to the XML representation read.\r\n /// \r\n public static CloudExecutionReport ReadXml(XmlReader xr)\r\n {\r\n Util.Assert(xr.Name.Equals(CloudExecutionReport.XmlTag));\r\n\r\n string versionText = xr.GetAttribute(CloudExecutionReport.XmlVersionAttribute);\r\n int version = int.Parse(versionText, CultureInfo.InvariantCulture);\r\n\r\n string identifier = string.Empty;\r\n StatusCode status = StatusCode.Completed;\r\n string processingNode = \"Unknown Benevolence\";\r\n int exitCode = 0;\r\n string standardOutput = string.Empty;\r\n string standardError = string.Empty;\r\n double cpuTime = 0;\r\n bool inOutputFileMappings = false;\r\n List outputFileMappings = new List();\r\n List outputFiles = new List();\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n switch (xr.Name)\r\n {\r\n case XmlIdentifierElement:\r\n identifier = xr.ReadElementContentAsString();\r\n break;\r\n\r\n case XmlStatusElement:\r\n status = (StatusCode)Enum.Parse(typeof(StatusCode), xr.ReadElementContentAsString());\r\n break;\r\n\r\n case XmlProcessingNodeElement:\r\n processingNode = xr.ReadElementContentAsString();\r\n break;\r\n\r\n case XmlExitCodeElement:\r\n exitCode = xr.ReadElementContentAsInt();\r\n break;\r\n\r\n case XmlStandardOutputElement:\r\n standardOutput = xr.ReadElementContentAsString();\r\n break;\r\n\r\n case XmlStandardErrorElement:\r\n standardError = xr.ReadElementContentAsString();\r\n break;\r\n\r\n case XmlCpuTimeElement:\r\n cpuTime = xr.ReadElementContentAsDouble();\r\n break;\r\n\r\n case XmlOutputFileMappingsElement:\r\n inOutputFileMappings = true;\r\n break;\r\n\r\n case BuildObjectValuePointer.XmlTag:\r\n Util.Assert(inOutputFileMappings);\r\n outputFileMappings.Add(BuildObjectValuePointer.ReadXml(xr));\r\n break;\r\n }\r\n }\r\n else if (xr.NodeType == XmlNodeType.EndElement)\r\n {\r\n if (xr.Name.Equals(CloudExecutionReport.XmlTag))\r\n {\r\n break; // All done.\r\n }\r\n\r\n switch (xr.Name)\r\n {\r\n case XmlOutputFileMappingsElement:\r\n inOutputFileMappings = false;\r\n break;\r\n }\r\n }\r\n }\r\n\r\n // REVIEW: Require element presence? Sanity check things here?\r\n return new CloudExecutionReport(\r\n version,\r\n identifier,\r\n status,\r\n processingNode,\r\n exitCode,\r\n standardOutput,\r\n standardError,\r\n cpuTime,\r\n outputFileMappings);\r\n }\r\n\r\n /// \r\n /// Creates an XML document representing this cloud execution report.\r\n /// \r\n /// \r\n /// A string containing an XML document representing this report.\r\n /// \r\n public string ToXml()\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n XmlWriterSettings settings = new XmlWriterSettings();\r\n settings.Indent = true;\r\n XmlWriter xw = XmlWriter.Create(sb, settings);\r\n xw.WriteStartDocument();\r\n this.WriteXml(xw);\r\n xw.Close();\r\n return sb.ToString();\r\n }\r\n\r\n /// \r\n /// Helper function to write an XML element (not a full document)\r\n /// representing this result record.\r\n /// \r\n /// The XmlWriter object to write to.\r\n public void WriteXml(XmlWriter xw)\r\n {\r\n // Start writing the element for this object.\r\n xw.WriteStartElement(XmlTag);\r\n xw.WriteAttributeString(XmlVersionAttribute, this.version.ToString(CultureInfo.InvariantCulture));\r\n\r\n // Write the Identifier element.\r\n xw.WriteElementString(XmlIdentifierElement, this.identifier);\r\n\r\n // Write the Status element.\r\n xw.WriteElementString(XmlStatusElement, this.status.ToString());\r\n\r\n // Write the ProcessingNode element.\r\n xw.WriteElementString(XmlProcessingNodeElement, this.processingNode);\r\n\r\n if (this.status == StatusCode.Completed)\r\n {\r\n // Write the ExitCode element.\r\n xw.WriteElementString(XmlExitCodeElement, this.exitCode.ToString(CultureInfo.InvariantCulture));\r\n\r\n // Write the Standard Output element.\r\n xw.WriteElementString(XmlStandardOutputElement, this.standardOutput);\r\n\r\n // Write the Standard Error element.\r\n xw.WriteElementString(XmlStandardErrorElement, this.standardError);\r\n\r\n // Write the CPU Time element.\r\n xw.WriteElementString(XmlCpuTimeElement, this.cpuTime.ToString(CultureInfo.InvariantCulture));\r\n\r\n // Write the OutputFileMappings element.\r\n xw.WriteStartElement(XmlOutputFileMappingsElement);\r\n foreach (BuildObjectValuePointer outputFile in this.outputFileMappings)\r\n {\r\n outputFile.WriteXml(xw);\r\n }\r\n\r\n xw.WriteEndElement();\r\n }\r\n\r\n // Finish writing the element for this object.\r\n xw.WriteEndElement();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/CloudExecutionRequest.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Globalization;\r\n using System.IO;\r\n using System.Text;\r\n using System.Xml;\r\n using Microsoft.WindowsAzure.Storage.Queue;\r\n\r\n /// \r\n /// Message that is put on the cloud \"requests\" queue to ask a cloud\r\n /// execution engine to do some work on the requester's behalf.\r\n /// \r\n public class CloudExecutionRequest\r\n {\r\n /// \r\n /// XML element name for this object.\r\n /// \r\n public const string XmlTag = \"CloudExecutionRequest\";\r\n\r\n /// \r\n /// Version of this object we create by default.\r\n /// \r\n private const int Version = 2;\r\n\r\n /// \r\n /// XML element name for our version field.\r\n /// \r\n private const string XmlVersionAttribute = \"Version\";\r\n\r\n /// \r\n /// XML element name for our reportQueue field.\r\n /// \r\n private const string XmlReportQueueElement = \"ReportQueue\";\r\n\r\n /// \r\n /// XML element name for our identifier field.\r\n /// \r\n private const string XmlIdentifierElement = \"Identifier\";\r\n\r\n /// \r\n /// XML element name for our operation field.\r\n /// \r\n private const string XmlOperationElement = \"Operation\";\r\n\r\n /// \r\n /// XML element name for our executable field.\r\n /// \r\n private const string XmlExecutableElement = \"Executable\";\r\n\r\n /// \r\n /// XML element name for our arguments field.\r\n /// \r\n private const string XmlArgumentsElement = \"Arguments\";\r\n\r\n /// \r\n /// XML element name for our inputFileMappings field.\r\n /// \r\n private const string XmlInputFileMappingsElement = \"InputFileMappings\";\r\n\r\n /// \r\n /// XML element name for our outputFiles field.\r\n /// \r\n private const string XmlOutputFilesElement = \"OutputFiles\";\r\n\r\n /// \r\n /// Queued message this instance was created from (if it was).\r\n /// \r\n private CloudQueueMessage message;\r\n\r\n /// \r\n /// Version of this object instance.\r\n /// \r\n private int version;\r\n\r\n /// \r\n /// Queue on which to add the report of the disposition of this request.\r\n /// \r\n private string reportQueue;\r\n\r\n /// \r\n /// Unique identifier for this request.\r\n /// \r\n private string identifier;\r\n\r\n /// \r\n /// Operation to perform.\r\n /// \r\n private Operation operation;\r\n\r\n /// \r\n /// Executable to be run.\r\n /// \r\n private string executable;\r\n\r\n /// \r\n /// Arguments to the executable.\r\n /// \r\n private string arguments;\r\n\r\n /// \r\n /// Collection of input files required for this execution,\r\n /// represented by both their item cache identifier and\r\n /// their relative path.\r\n /// \r\n private List inputFileMappings;\r\n\r\n /// \r\n /// Collection of expected output files from this execution.\r\n /// \r\n private IEnumerable outputFiles;\r\n\r\n /// \r\n /// Initializes a new instance of the CloudExecutionRequest class.\r\n /// \r\n /// \r\n /// Queue on which to add the report of the disposition of this request.\r\n /// \r\n /// Unique ID for this instance.\r\n /// Operation to perform.\r\n /// Executable to be run.\r\n /// Arguments to the executable.\r\n /// \r\n /// Input files required for this execution.\r\n /// \r\n /// Expected output files.\r\n public CloudExecutionRequest(\r\n string reportQueue,\r\n string identifier,\r\n Operation operation,\r\n string executable,\r\n string arguments,\r\n List inputFileMappings,\r\n IEnumerable outputFiles)\r\n : this(\r\n CloudExecutionRequest.Version,\r\n reportQueue,\r\n identifier,\r\n operation,\r\n executable,\r\n arguments,\r\n inputFileMappings,\r\n outputFiles)\r\n {\r\n // REVIEW: Use different random string generator for identifier?\r\n }\r\n\r\n /// \r\n /// Initializes a new instance of the CloudExecutionRequest class.\r\n /// \r\n /// Version of this class instance.\r\n /// \r\n /// Queue on which to add the report of the disposition of this request.\r\n /// \r\n /// Unique ID for this instance.\r\n /// Operation to perform.\r\n /// Executable to be run.\r\n /// Arguments to the executable.\r\n /// \r\n /// Input files required for this execution.\r\n /// \r\n /// Expected output files.\r\n private CloudExecutionRequest(\r\n int version,\r\n string reportQueue,\r\n string identifier,\r\n Operation operation,\r\n string executable,\r\n string arguments,\r\n List inputFileMappings,\r\n IEnumerable outputFiles)\r\n {\r\n this.version = version;\r\n this.reportQueue = reportQueue;\r\n this.identifier = identifier;\r\n this.operation = operation;\r\n this.executable = executable;\r\n this.arguments = arguments;\r\n this.inputFileMappings = inputFileMappings;\r\n this.outputFiles = outputFiles;\r\n }\r\n\r\n /// \r\n /// Various types of operation that can be requested.\r\n /// \r\n public enum Operation : int\r\n {\r\n /// \r\n /// Don't do anything (no-op).\r\n /// \r\n None,\r\n\r\n /// \r\n /// Run the specified executable.\r\n /// \r\n RunExecutable,\r\n\r\n /// \r\n /// Delete the specified report queue.\r\n /// \r\n DeleteQueue,\r\n\r\n /// \r\n /// Exit (and thus quit handling requests).\r\n /// \r\n CommitSuicide,\r\n }\r\n\r\n /// \r\n /// Gets the CloudQueueMessage this instance was derived from (if any).\r\n /// \r\n public CloudQueueMessage Message\r\n {\r\n get { return this.message; }\r\n }\r\n\r\n /// \r\n /// Gets the queue on which to report the disposition of this request.\r\n /// \r\n public string ReportQueue\r\n {\r\n get { return this.reportQueue; }\r\n }\r\n\r\n /// \r\n /// Gets the unique identifier for this request.\r\n /// \r\n public string Identifier\r\n {\r\n get { return this.identifier; }\r\n }\r\n\r\n /// \r\n /// Gets the operation to perform.\r\n /// \r\n public Operation RequestedOperation\r\n {\r\n get { return this.operation; }\r\n }\r\n\r\n /// \r\n /// Gets the executable to run.\r\n /// \r\n public string Executable\r\n {\r\n get { return this.executable; }\r\n }\r\n\r\n /// \r\n /// Gets the arguments to the executable.\r\n /// \r\n public string Arguments\r\n {\r\n get { return this.arguments; }\r\n }\r\n\r\n /// \r\n /// Gets the collection of files needed as input to the execution,\r\n /// as both BuildObjects and as their cached hash values.\r\n /// \r\n public IEnumerable InputFileMappings\r\n {\r\n get { return this.inputFileMappings; }\r\n }\r\n\r\n /// \r\n /// Gets the collection of potential output files from this execution,\r\n /// as BuildObjects.\r\n /// \r\n public IEnumerable OutputFiles\r\n {\r\n get { return this.outputFiles; }\r\n }\r\n\r\n /// \r\n /// Creates a CloudExecutionRequest from a CloudQueueMessage\r\n /// representation.\r\n /// \r\n /// \r\n /// A CloudQueueMessage containing an XML document representing a\r\n /// CloudExecutionRequest.\r\n /// \r\n /// \r\n /// A new request corresponding to the XML representation contained in\r\n /// the message.\r\n /// \r\n public static CloudExecutionRequest FromMessage(CloudQueueMessage message)\r\n {\r\n CloudExecutionRequest request = CloudExecutionRequest.FromXml(message.AsString);\r\n request.message = message;\r\n\r\n return request;\r\n }\r\n\r\n /// \r\n /// Creates a CloudExecutionRequest from an XML representation.\r\n /// \r\n /// \r\n /// A string containing an XML document representing a request.\r\n /// \r\n /// \r\n /// A new request corresponding to the XML representation read.\r\n /// \r\n public static CloudExecutionRequest FromXml(string xs)\r\n {\r\n XmlReader xr = XmlReader.Create(new StringReader(xs));\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n break;\r\n }\r\n }\r\n\r\n return ReadXml(xr);\r\n }\r\n\r\n /// \r\n /// Helper function to read an XML element (not a full document)\r\n /// representing a cloud execution request.\r\n /// \r\n /// \r\n /// Note that the XmlReader is expected to be positioned in the XML\r\n /// document such that the current node is a request element.\r\n /// \r\n /// The XmlReader object to read from.\r\n /// \r\n /// A new request corresponding to the XML representation read.\r\n /// \r\n public static CloudExecutionRequest ReadXml(XmlReader xr)\r\n {\r\n Util.Assert(xr.Name.Equals(CloudExecutionRequest.XmlTag));\r\n\r\n string versionText = xr.GetAttribute(CloudExecutionRequest.XmlVersionAttribute);\r\n int version = int.Parse(versionText, CultureInfo.InvariantCulture);\r\n\r\n string reportQueue = \"reports\";\r\n string identifier = string.Empty;\r\n Operation operation = Operation.RunExecutable;\r\n string executable = string.Empty;\r\n string arguments = string.Empty;\r\n bool inInputFileMappings = false;\r\n List inputFileMappings = new List();\r\n bool inOutputFiles = false;\r\n List outputFiles = new List();\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n switch (xr.Name)\r\n {\r\n case XmlReportQueueElement:\r\n reportQueue = xr.ReadElementContentAsString();\r\n break;\r\n\r\n case XmlIdentifierElement:\r\n identifier = xr.ReadElementContentAsString();\r\n break;\r\n\r\n case XmlOperationElement:\r\n operation = (Operation)Enum.Parse(typeof(Operation), xr.ReadElementContentAsString());\r\n break;\r\n\r\n case XmlExecutableElement:\r\n executable = xr.ReadElementContentAsString();\r\n break;\r\n\r\n case XmlArgumentsElement:\r\n arguments = xr.ReadElementContentAsString();\r\n break;\r\n\r\n case XmlInputFileMappingsElement:\r\n inInputFileMappings = true;\r\n break;\r\n\r\n case BuildObjectValuePointer.XmlTag:\r\n Util.Assert(inInputFileMappings);\r\n inputFileMappings.Add(BuildObjectValuePointer.ReadXml(xr));\r\n break;\r\n\r\n case XmlOutputFilesElement:\r\n inOutputFiles = true;\r\n break;\r\n\r\n case BuildObject.XmlTag:\r\n Util.Assert(inOutputFiles);\r\n outputFiles.Add(BuildObject.ReadXml(xr));\r\n break;\r\n }\r\n }\r\n else if (xr.NodeType == XmlNodeType.EndElement)\r\n {\r\n if (xr.Name.Equals(CloudExecutionRequest.XmlTag))\r\n {\r\n break; // All done.\r\n }\r\n\r\n switch (xr.Name)\r\n {\r\n case XmlInputFileMappingsElement:\r\n inInputFileMappings = false;\r\n break;\r\n\r\n case XmlOutputFilesElement:\r\n inOutputFiles = false;\r\n break;\r\n }\r\n }\r\n }\r\n\r\n // REVIEW: Require presence of (some/all) elements? Sanity check things here?\r\n return new CloudExecutionRequest(\r\n version,\r\n reportQueue,\r\n identifier,\r\n operation,\r\n executable,\r\n arguments,\r\n inputFileMappings,\r\n outputFiles);\r\n }\r\n\r\n /// \r\n /// Creates an XML document representing this cloud execution request.\r\n /// \r\n /// \r\n /// A string containing an XML document representing this request.\r\n /// \r\n public string ToXml()\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n XmlWriterSettings settings = new XmlWriterSettings();\r\n settings.Indent = true;\r\n XmlWriter xw = XmlWriter.Create(sb, settings);\r\n xw.WriteStartDocument();\r\n this.WriteXml(xw);\r\n xw.Close();\r\n return sb.ToString();\r\n }\r\n\r\n /// \r\n /// Helper function to write an XML element (not a full document)\r\n /// representing this result record.\r\n /// \r\n /// The XmlWriter object to write to.\r\n public void WriteXml(XmlWriter xw)\r\n {\r\n // Start writing the element for this object.\r\n xw.WriteStartElement(XmlTag);\r\n xw.WriteAttributeString(CloudExecutionRequest.XmlVersionAttribute, this.version.ToString(CultureInfo.InvariantCulture));\r\n\r\n // Write the ReportQueue element.\r\n xw.WriteElementString(XmlReportQueueElement, this.reportQueue);\r\n\r\n // Optionally write the Identifier element.\r\n if (!string.IsNullOrEmpty(this.identifier))\r\n {\r\n xw.WriteElementString(CloudExecutionRequest.XmlIdentifierElement, this.identifier);\r\n }\r\n\r\n // Write the Operation element.\r\n xw.WriteElementString(XmlOperationElement, this.operation.ToString());\r\n\r\n if (this.operation == Operation.RunExecutable)\r\n {\r\n // Write the Executable element.\r\n xw.WriteElementString(XmlExecutableElement, this.executable);\r\n\r\n // Write the Arguments element.\r\n xw.WriteElementString(XmlArgumentsElement, this.arguments);\r\n\r\n // Write the InputFileMappings element.\r\n xw.WriteStartElement(XmlInputFileMappingsElement);\r\n foreach (BuildObjectValuePointer inputFile in this.inputFileMappings)\r\n {\r\n inputFile.WriteXml(xw);\r\n }\r\n\r\n xw.WriteEndElement();\r\n\r\n // Write the OutputFiles element.\r\n xw.WriteStartElement(XmlOutputFilesElement);\r\n foreach (BuildObject outputFile in this.outputFiles)\r\n {\r\n outputFile.WriteXml(xw);\r\n }\r\n\r\n xw.WriteEndElement();\r\n }\r\n\r\n // Finish writing the element for this object.\r\n xw.WriteEndElement();\r\n }\r\n\r\n /// \r\n /// Gets a string representation of this instance.\r\n /// Primarily intended as a debugging aid.\r\n /// \r\n /// A string representation of this instance.\r\n public override string ToString()\r\n {\r\n StringBuilder output = new StringBuilder();\r\n\r\n output.AppendFormat(\"Version: {0}\", this.version);\r\n output.AppendLine();\r\n output.AppendFormat(\"Report Queue: {0}\", this.reportQueue);\r\n output.AppendLine();\r\n output.AppendFormat(\"Identifier: {0}\", this.identifier);\r\n output.AppendLine();\r\n output.AppendFormat(\"Operation: {0}\", this.operation);\r\n output.AppendLine();\r\n output.AppendFormat(\"Executable: {0}\", this.executable);\r\n output.AppendLine();\r\n output.AppendFormat(\"Arguments: {0}\", this.arguments);\r\n output.AppendLine();\r\n\r\n output.AppendFormat(\"InputFileMappings ({0} files):\", this.inputFileMappings.Count);\r\n output.AppendLine();\r\n#if false\r\n foreach (BuildObjectValuePointer mapping in this.inputFileMappings)\r\n {\r\n output.AppendFormat(\"{0} = {1}\", mapping.RelativePath, mapping.ObjectHash);\r\n output.AppendLine();\r\n }\r\n#endif\r\n\r\n output.AppendLine(\"OutputFiles:\");\r\n foreach (BuildObject file in this.outputFiles)\r\n {\r\n output.AppendLine(file.getRelativePath());\r\n }\r\n\r\n return output.ToString();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/CloudExecutionWaiter.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Threading;\r\n\r\n /// \r\n /// Represents a thread waiting for a particular cloud execution report.\r\n /// \r\n internal class CloudExecutionWaiter\r\n {\r\n /// \r\n /// Event that is signalled when a new report is ready.\r\n /// \r\n private AutoResetEvent reportIsReady;\r\n\r\n /// \r\n /// Execution report that just arrived.\r\n /// \r\n private CloudExecutionReport executionReport;\r\n\r\n /// \r\n /// Count of other waiters.\r\n /// \r\n private int otherWaitersCount;\r\n\r\n /// \r\n /// Initializes a new instance of the CloudExecutionWaiter class.\r\n /// \r\n public CloudExecutionWaiter()\r\n {\r\n this.reportIsReady = new AutoResetEvent(false);\r\n }\r\n\r\n /// \r\n /// Wait for an execution report to arrive.\r\n /// \r\n /// Count of other report waiters.\r\n /// An execution report.\r\n public CloudExecutionReport WaitForReport(out int numberOfOtherWaiters)\r\n {\r\n this.reportIsReady.WaitOne();\r\n\r\n numberOfOtherWaiters = this.otherWaitersCount;\r\n return this.executionReport;\r\n }\r\n\r\n /// \r\n /// Give an execution report to this waiter.\r\n /// \r\n /// The execution report to give.\r\n /// Count of other report waiters.\r\n public void GiveReportToWaiter(CloudExecutionReport executionReport, int numberOfOtherWaiters)\r\n {\r\n this.executionReport = executionReport;\r\n this.otherWaitersCount = numberOfOtherWaiters;\r\n this.reportIsReady.Set();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/CloudSubmitter.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Text;\r\n\r\n /// \r\n /// Submits requests for verb execution to remote cloud worker pool.\r\n /// \r\n internal class CloudSubmitter : IProcessInvoker\r\n {\r\n /// \r\n /// Whether to always emit diagnostic output.\r\n /// \r\n private const bool AlwaysEmitDiagnostics = true;\r\n\r\n /// \r\n /// The CPU time used by the process, in seconds.\r\n /// \r\n private double cpuTime;\r\n\r\n /// \r\n /// The exit code returned by the process.\r\n /// \r\n private int exitCode;\r\n\r\n /// \r\n /// Where standard out is collected by default.\r\n /// \r\n private string stdout;\r\n\r\n /// \r\n /// Where standard error is collected.\r\n /// \r\n private string stderr;\r\n\r\n /// \r\n /// The private working directory for the process we invoke.\r\n /// \r\n private WorkingDirectory workingDirectory;\r\n\r\n /// \r\n /// Initializes a new instance of the CloudSubmitter class.\r\n /// \r\n /// \r\n /// Unique identifier for this request.\r\n /// \r\n /// \r\n /// Working directory the process is started in.\r\n /// \r\n /// \r\n /// List of input files expected by the process.\r\n /// \r\n /// \r\n /// List of potential output files generated by the process.\r\n /// \r\n /// Executable to run.\r\n /// \r\n /// Command line arguments to provide to the executable.\r\n /// \r\n /// Not sure what this is -- some debugging/diagnostic thing.\r\n /// Where to (optionally) store the captured standard out.\r\n /// Debugging text for something or another.\r\n public CloudSubmitter(\r\n string requestIdentifier,\r\n WorkingDirectory workingDirectory,\r\n IEnumerable inputFiles,\r\n IEnumerable outputFiles,\r\n string executable,\r\n string[] args,\r\n BuildObject failureBase,\r\n BuildObject captureStdout = null,\r\n string dbgText = null)\r\n {\r\n // Catch bad verb authors before they hurt themselves.\r\n Util.Assert(!executable.Contains(\":\")); // Hey, this looks like an absolute path! Use .getRelativePath(); it makes your output more stable.\r\n foreach (string arg in args)\r\n {\r\n // Pardon my distasteful heuristic to avoid flagging /flag:value args.\r\n Util.Assert(arg.Length < 2 || arg[1] != ':'); // Hey, this looks like an absolute path! Use .getRelativePath() to tolerate crossing machine boundaries.\r\n }\r\n\r\n // Stash away things we'll want to remember later.\r\n this.workingDirectory = workingDirectory;\r\n\r\n // Create list of input file mappings.\r\n // REVIEW: We're not running on the main thread at this point. Are below calls all thread-safe?\r\n List inputFileMappings = new List();\r\n foreach (BuildObject file in inputFiles)\r\n {\r\n string fileHash = BuildEngine.theEngine.Repository.GetHash(file);\r\n Util.Assert(!string.IsNullOrEmpty(fileHash));\r\n inputFileMappings.Add(new BuildObjectValuePointer(fileHash, file.getRelativePath()));\r\n\r\n // Ensure that the input files are in the cloud cache.\r\n // REVIEW: best way to determine this is a source file?\r\n ItemCacheContainer container;\r\n if (file is SourcePath)\r\n {\r\n container = ItemCacheContainer.Sources;\r\n }\r\n else\r\n {\r\n container = ItemCacheContainer.Objects;\r\n }\r\n\r\n ItemCacheMultiplexer multiplexedCache = BuildEngine.theEngine.ItemCache as ItemCacheMultiplexer;\r\n Util.Assert(multiplexedCache != null);\r\n multiplexedCache.SyncItemToCloud(container, fileHash);\r\n }\r\n\r\n // Prepare cloud execution request for submission.\r\n string arguments = string.Join(\" \", args);\r\n CloudExecutionRequest request = new CloudExecutionRequest(\r\n BuildEngine.theEngine.CloudReportQueueName,\r\n requestIdentifier,\r\n CloudExecutionRequest.Operation.RunExecutable,\r\n executable,\r\n arguments,\r\n inputFileMappings,\r\n outputFiles);\r\n BuildEngine.theEngine.CloudExecutionQueue.SubmitRequest(request);\r\n\r\n // Wait for remote execution to finish.\r\n int requestsOutstanding;\r\n Console.WriteLine(\"Waiting on remote execution report for request '{0}'.\", requestIdentifier);\r\n CloudExecutionReport executionReport = BuildEngine.theEngine.CloudExecutionQueue.GetReport(requestIdentifier, out requestsOutstanding);\r\n Console.WriteLine(\"Received remote execution report for request '{0}'. {1} others still outstanding.\", requestIdentifier, requestsOutstanding);\r\n\r\n // Record what we got back.\r\n this.exitCode = executionReport.ExitCode;\r\n this.stdout = executionReport.StandardOutput;\r\n this.stderr = executionReport.StandardError;\r\n this.cpuTime = executionReport.CpuTime;\r\n\r\n // Copy output files from cloud cache back to local working dir.\r\n // REVIEW: This is just to set things up as expected for the\r\n // Scheduler's recordResult routine. Could re-architect this to\r\n // be more efficient for the remote execution case.\r\n foreach (BuildObjectValuePointer outputFileMapping in executionReport.OutputFileMappings)\r\n {\r\n BuildEngine.theEngine.CloudCache.FetchItemToFile(\r\n ItemCacheContainer.Objects,\r\n outputFileMapping.ObjectHash,\r\n workingDirectory.PathTo(outputFileMapping.RelativePath));\r\n }\r\n }\r\n\r\n /// \r\n /// Gets the exit code returned by the process.\r\n /// \r\n public int ExitCode\r\n {\r\n get { return this.exitCode; }\r\n }\r\n\r\n /// \r\n /// Gets the CPU time used by the process, in seconds.\r\n /// \r\n public double CpuTime\r\n {\r\n get { return this.cpuTime; }\r\n }\r\n\r\n /// \r\n /// Gets the process's standard output in the default case.\r\n /// Does not return the standard output if it is redirected to a file\r\n /// (i.e. if captureStdout is non-null).\r\n /// \r\n /// The process's standard output.\r\n public string GetStdout()\r\n {\r\n return this.stdout;\r\n }\r\n\r\n /// \r\n /// Gets the process's standard error output..\r\n /// \r\n /// The process's standard error output.\r\n public string GetStderr()\r\n {\r\n return this.stderr;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/ConcatContext.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class ConcatContext\r\n : IncludePathContext\r\n {\r\n private List contexts;\r\n private string descr;\r\n \r\n public ConcatContext(IEnumerable contexts)\r\n {\r\n this.contexts = new List(contexts);\r\n this.descr = \"Context(\" + string.Join(\",\", this.contexts) + \")\";\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return this.descr;\r\n }\r\n\r\n public override BuildObject search(string basename, ModPart modPart = ModPart.Ifc)\r\n {\r\n foreach (IIncludePathContext context in this.contexts)\r\n {\r\n BuildObject obj = context.search(basename, modPart);\r\n if (obj != null)\r\n {\r\n return obj;\r\n }\r\n }\r\n\r\n return null;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/ConcatContextVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n internal class ConcatContextVerb\r\n : ContextGeneratingVerb\r\n {\r\n private List parents;\r\n\r\n public ConcatContextVerb(IEnumerable parents, PoundDefines poundDefines)\r\n : base(\"Cat(\" + string.Join(\",\", parents) + \")\", poundDefines)\r\n {\r\n this.parents = new List(parents);\r\n }\r\n\r\n public ConcatContextVerb(IContextGeneratingVerb parentA, IContextGeneratingVerb parentB, PoundDefines poundDefines)\r\n : this(new IContextGeneratingVerb[] { parentA, parentB }, poundDefines)\r\n {\r\n }\r\n\r\n public ConcatContextVerb(IContextGeneratingVerb parentA, IContextGeneratingVerb parentB, IContextGeneratingVerb parentC, PoundDefines poundDefines)\r\n : this(new IContextGeneratingVerb[] { parentA, parentB, parentC }, poundDefines)\r\n {\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n return this.parents.Select(parent => parent.getContextOutput());\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return this.parents;\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n IEnumerable contexts = this.parents.Select(parent =>\r\n ((ContextContents)BuildEngine.theEngine.Repository.FetchVirtual(parent.getContextOutput())).Context);\r\n ConcatContext context = new ConcatContext(contexts);\r\n ContextContents contents = new ContextContents(context);\r\n BuildEngine.theEngine.Repository.StoreVirtual(this.getContextOutput(), new Fresh(), contents);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/ContextContents.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class ContextContents\r\n : VirtualContents\r\n {\r\n private IIncludePathContext context;\r\n\r\n public ContextContents(IIncludePathContext context)\r\n {\r\n this.context = context;\r\n }\r\n\r\n public IIncludePathContext Context\r\n {\r\n get { return this.context; }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/ContextGeneratingVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n internal abstract class ContextGeneratingVerb\r\n : Verb, IContextGeneratingVerb\r\n {\r\n public const string CONTEXT_EXTN = \".ctxt\"; // Virtual, so it shouldn't appear in filesystem.\r\n private int version = 1;\r\n\r\n private string nickname;\r\n private PoundDefines poundDefines;\r\n private BuildObject outputObj;\r\n\r\n /// NB nickname will need to be unique over a run; it's used as the verb AbstractIdentifier, and\r\n /// hence hash identity in caches.\r\n public ContextGeneratingVerb(string nickname, PoundDefines poundDefines)\r\n {\r\n this.nickname = nickname;\r\n this.poundDefines = poundDefines;\r\n }\r\n\r\n public PoundDefines getPoundDefines()\r\n {\r\n return this.poundDefines;\r\n }\r\n\r\n public string getContextIdentifier()\r\n {\r\n return this.nickname;\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return new AbstractId(this.GetType().Name, this.version, this.getContextIdentifier());\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { this.getContextOutput() };\r\n }\r\n\r\n public BuildObject getContextOutput()\r\n {\r\n if (this.outputObj == null)\r\n {\r\n this.outputObj = new VirtualBuildObject(\r\n Path.Combine(BuildEngine.theEngine.getVirtualRoot(), Util.mungeClean(this.getAbstractIdentifier().ToString()) + CONTEXT_EXTN));\r\n }\r\n\r\n return this.outputObj;\r\n }\r\n }\r\n\r\n internal static class ContextGeneratingVerbExtensions\r\n {\r\n internal static IIncludePathContext fetchIfAvailable(this IContextGeneratingVerb verb, ref DependencyDisposition ddisp)\r\n {\r\n try\r\n {\r\n return ((ContextContents)\r\n BuildEngine.theEngine.Repository.FetchVirtual(verb.getContextOutput())).Context;\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n // Oh, we don't even have the context object yet.\r\n ddisp = ddisp.combine(DependencyDisposition.Incomplete);\r\n }\r\n catch (ObjectFailedException)\r\n {\r\n ddisp = ddisp.combine(DependencyDisposition.Failed);\r\n }\r\n\r\n return null;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/CustomManifestParser.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Text;\r\n\r\n internal class CustomManifestParser\r\n {\r\n private HashSet dependencies = new HashSet();\r\n private HashSet outputs = new HashSet();\r\n\r\n public CustomManifestParser(SourcePath basePath)\r\n {\r\n this.parseCustomManifest(basePath);\r\n }\r\n\r\n public IEnumerable getDependencies()\r\n {\r\n return this.dependencies;\r\n }\r\n\r\n public IEnumerable getOutputs()\r\n {\r\n return this.outputs;\r\n }\r\n\r\n private void parseCustomManifest(SourcePath basePath)\r\n {\r\n SourcePath manifest = basePath.getNewSourcePath(\"nubuild-manifest.txt\");\r\n this.dependencies.Add(manifest);\r\n\r\n using (StreamReader stream = new StreamReader(IronRootDirectory.PathTo(manifest)))\r\n {\r\n string origline;\r\n\r\n while ((origline = stream.ReadLine()) != null)\r\n {\r\n string line = origline.Trim();\r\n\r\n if (line.Length == 0)\r\n {\r\n continue;\r\n }\r\n\r\n if (line.Substring(0, 1) == \"#\")\r\n {\r\n continue;\r\n }\r\n\r\n string[] parts = line.Split();\r\n\r\n if (parts.Length != 2)\r\n {\r\n throw new UserError(string.Format(\"{0}: badly formed manifest line {1}\", IronRootDirectory.PathTo(manifest), origline));\r\n }\r\n\r\n if (\"output\".Equals(parts[0]))\r\n {\r\n this.outputs.Add(new BuildObject(Path.Combine(basePath.getDirPath(), parts[1])));\r\n }\r\n else if (\"dependency\".Equals(parts[0]))\r\n {\r\n this.dependencies.Add(basePath.getNewSourcePath(parts[1]));\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DafnyCCVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\n using System.Linq;\r\n\r\n internal class DafnyCCVerb\r\n : DafnyTransformBaseVerb\r\n {\r\n private AbstractId abstractId;\r\n private FramePointerMode useFramePointer;\r\n private VSSolutionVerb dafnyCCBuildExecutableVerb;\r\n\r\n public DafnyCCVerb(SourcePath dfyroot, string appLabel, FramePointerMode useFramePointer)\r\n : base(dfyroot, appLabel)\r\n {\r\n this.useFramePointer = useFramePointer;\r\n this.abstractId = new AbstractId(this.GetType().Name, this.getVersion() + version, dfyroot.ToString(), concrete: useFramePointer.ToString());\r\n this.dafnyCCBuildExecutableVerb = new VSSolutionVerb(new SourcePath(\"tools\\\\DafnyCC\\\\DafnyCC.sln\", SourcePath.SourceType.Tools));\r\n }\r\n\r\n public enum FramePointerMode\r\n {\r\n UseFramePointer,\r\n NoFramePointer\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return base.getVerbs().Concat(new[] { this.dafnyCCBuildExecutableVerb });\r\n }\r\n \r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n // This is merely an assert double-check that we didn't let a spec generated\r\n // by DafnyCC slip through to be used in the BoogieAsmVerify step.\r\n internal static void AssertSmellsImplementy(BuildObject obj)\r\n {\r\n string fn = obj.getFileNameWithoutExtension();\r\n Util.Assert(fn.EndsWith(\"_\" + DafnyTransformBaseVerb.DAFNY_I_SUFFIX)\r\n || fn.EndsWith(\"_\" + DafnyTransformBaseVerb.DAFNY_C_SUFFIX)\r\n || fn.Equals(\"Checked\")\r\n || fn.Equals(\"Heap\")\r\n || fn.Equals(\"Seq\"));\r\n }\r\n \r\n protected override int getVersion()\r\n {\r\n return 18;\r\n }\r\n\r\n protected override BuildObject getExecutable()\r\n {\r\n return new BuildObject(Path.Combine(this.dafnyCCBuildExecutableVerb.getOutputPath().getRelativePath(), \"dafnycc.exe\"));\r\n }\r\n\r\n protected override IEnumerable getExtraDependencies()\r\n {\r\n string exePath = this.dafnyCCBuildExecutableVerb.getOutputPath().getRelativePath();\r\n\r\n // REVIEW: Should we extract the dafnycc.exe dependencies from the project file instead of listing them manually?\r\n // REVIEW: What about Graph.dll? Not needed?\r\n return new BuildObject[] {\r\n new BuildObject(Path.Combine(exePath, \"Basetypes.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"CodeContractsExtender.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"Core.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"DafnyPipeline.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"ParserHelper.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"Provers.SMTLib.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"VCGeneration.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"z3.exe\")),\r\n getDafnyPrelude()\r\n };\r\n }\r\n\r\n protected override IEnumerable getRootArgs()\r\n {\r\n DependencyDisposition ddisp;\r\n IEnumerable result = getAllDafnyModules(out ddisp);\r\n Util.Assert(ddisp == DependencyDisposition.Complete);\r\n return result;\r\n }\r\n\r\n protected override IEnumerable getExtraSpecialOutputs()\r\n {\r\n // Work around some undesirable behavior presently in DafnyCC:\r\n // We can't pass DafnyPrelude on the command line (getRootArgs) to DafnyCC,\r\n // yet it emits a dafny_DafnyPrelude file that we want to account for in the output.\r\n return new string[] { \"Checked\", \"Heap\", \"Seq\" }; ////, \"dafny_DafnyPrelude\" };\r\n }\r\n\r\n protected override void addExtraArgs(List args)\r\n {\r\n args.Add(\"/relational\");\r\n if (this.useFramePointer == FramePointerMode.UseFramePointer)\r\n {\r\n args.Add(\"/useFramePointer\");\r\n }\r\n }\r\n\r\n protected override IEnumerable getRoots()\r\n {\r\n return new SourcePath[]\r\n {\r\n new SourcePath(\"src\\\\Trusted\\\\DafnySpec\\\\Seq.s.dfy\"),\r\n new SourcePath(\"src\\\\Checked\\\\Libraries\\\\DafnyCC\\\\Seq.dfy\"),\r\n dfyroot\r\n };\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DafnyCompileOneVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n\r\n /// \r\n /// Verb to compile Dafny source code to CSharp target.\r\n /// \r\n internal class DafnyCompileOneVerb : Verb, IProcessInvokeAsyncVerb\r\n {\r\n private const int Version = 10;\r\n\r\n private const string IntermediateSourceFilename = \"ExpandedSource.dfy\";\r\n private const string CSharpExt = \".cs\";\r\n private readonly SourcePath input;\r\n private readonly BuildObject output;\r\n private readonly AbstractId abstractId;\r\n private readonly IVerb[] verbs;\r\n private readonly DafnyTransitiveDepsVerb transitiveDepsVerb;\r\n private List dependencies;\r\n private SourcePath expandedSource;\r\n\r\n public DafnyCompileOneVerb(SourcePath input)\r\n {\r\n if (input == null)\r\n {\r\n throw new ArgumentNullException(\"input\");\r\n }\r\n\r\n this.abstractId = new AbstractId(GetType().Name, Version, input.ToString());\r\n this.input = input;\r\n this.output = input.makeOutputObject(CSharpExt);\r\n this.transitiveDepsVerb = new DafnyTransitiveDepsVerb(input);\r\n this.verbs = new IVerb[] { this.transitiveDepsVerb };\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n if (this.dependencies == null)\r\n {\r\n DependencyDisposition dd;\r\n var dependencies = new List();\r\n\r\n // This method's implementation is dependent upon transitiveDepsVerb being the only element of verbs.\r\n Trace.Assert(this.verbs.Length == 1 && this.verbs[0] is DafnyTransitiveDepsVerb);\r\n dependencies.AddRange(this.transitiveDepsVerb.getAvailableDeps(out dd));\r\n dependencies.AddRange(DafnyExecutableDependencies.getDafnyExecutableDependencies());\r\n if (dd != DependencyDisposition.Complete)\r\n {\r\n ddisp = dd;\r\n\r\n // Dependency resolution isn't complete yet and we don't want to cache the incomplete list.\r\n return dependencies;\r\n }\r\n\r\n this.dependencies = dependencies;\r\n }\r\n\r\n Trace.Assert(this.dependencies != null);\r\n ddisp = DependencyDisposition.Complete;\r\n return this.dependencies;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return this.verbs;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new[] { this.output };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // First expand our Dafny source file to inline all its includes.\r\n this.expandedSource = this.input.getNewSourcePath(\"ExpandedSource.dfy\");\r\n DafnyIncludes dafnyIncludes = new DafnyIncludes();\r\n dafnyIncludes.ExpandDafny(workingDirectory, this.input, this.expandedSource);\r\n\r\n // Call Dafny.exe to compile Dafny source to CSharp target.\r\n var args = new[] { \"/noVerify\", \"/spillTargetCode:1\", \"/compile:2\", \"/ironDafny\", this.expandedSource.getRelativePath() };\r\n Console.WriteLine(\"expanded source: \" + this.expandedSource.getRelativePath());\r\n ////Logger.WriteLine(\"arguments: \" + String.Join(\" \", args));\r\n return\r\n new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n DafnyExecutableDependencies.getDafnyExecutable().getRelativePath(),\r\n args,\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n getDiagnosticsBase(),\r\n returnStandardOut: true, // REVIEW: Doesn't appear to be needed.\r\n returnStandardError: true, // REVIEW: Doesn't appear to be needed.\r\n allowCloudExecution: true);\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n var dis = disposition;\r\n\r\n string cSharpPath = Path.ChangeExtension(workingDirectory.PathTo(this.expandedSource), CSharpExt);\r\n if (!File.Exists(cSharpPath))\r\n {\r\n // Dafny has a bug where compilation fails but result code is still 0.\r\n dis = new Failed();\r\n }\r\n\r\n if (dis is Fresh)\r\n {\r\n this.RewriteCSharpFile(cSharpPath, workingDirectory.PathTo(this.output));\r\n }\r\n\r\n return dis;\r\n }\r\n\r\n private void RewriteCSharpFile(string inputPath, string outputPath)\r\n {\r\n using (TextWriter writer = new StreamWriter(outputPath))\r\n {\r\n // Compile a list of namespaces that require edits\r\n var namespaces = new Dictionary();\r\n using (TextReader reader = new StreamReader(inputPath))\r\n {\r\n string line; \r\n System.Text.RegularExpressions.Regex pattern = new System.Text.RegularExpressions.Regex(\"namespace @_(\\\\d+)_([\\\\w_]+) {\", System.Text.RegularExpressions.RegexOptions.Compiled);\r\n\r\n while ((line = reader.ReadLine()) != null)\r\n {\r\n var result = pattern.Match(line);\r\n if (result.Success) \r\n {\r\n string old_name = \"_\" + result.Groups[1] + \"_\" + result.Groups[2];\r\n string new_name = \"_\" + result.Groups[2];\r\n namespaces.Add(old_name, new_name);\r\n }\r\n }\r\n }\r\n\r\n using (TextReader reader = new StreamReader(inputPath))\r\n {\r\n string line;\r\n while ((line = reader.ReadLine()) != null)\r\n {\r\n line = line.Replace(IntermediateSourceFilename, this.input.getFileName());\r\n line = line.Replace(\"public class @__default {\", \"public partial class @__default {\");\r\n line = line.Replace(\"@#\", \"@\");\r\n\r\n // Temporary work-around. ToDo: Remove this after Dafny is fixed.\r\n line = line.Replace(\"public class \", \"public partial class \");\r\n\r\n // Another temporary work-around. ToDo: Figure out better solution.\r\n line = line.Replace(\"@_default_Main\", \"@IronfleetMain\");\r\n\r\n // Find a more efficient approach?\r\n foreach (KeyValuePair entry in namespaces) \r\n {\r\n line = line.Replace(entry.Key, entry.Value);\r\n }\r\n\r\n writer.WriteLine(line);\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DafnyExecutableDependencies.cs", "content": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\nnamespace NuBuild\r\n{\r\n class DafnyExecutableDependencies\r\n {\r\n private static SourcePath dafnyExecutable;\r\n\r\n public static SourcePath getDafnyExecutable()\r\n {\r\n // TODO this should eventually be a BuildObject from *building* the executable.\r\n if (dafnyExecutable == null)\r\n {\r\n dafnyExecutable = new SourcePath(\"tools\\\\Dafny\\\\Dafny.exe\", SourcePath.SourceType.Tools);\r\n }\r\n\r\n return dafnyExecutable;\r\n }\r\n\r\n\r\n public static IEnumerable getDafnyExecutableDependencies()\r\n {\r\n List exeDepends = new List();\r\n\r\n exeDepends.Add(getDafnyExecutable());\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\AbsInt.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\BaseTypes.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\CodeContractsExtender.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Concurrency.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Core.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Dafny.exe.config\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\DafnyPipeline.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\DafnyPrelude.bpl\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Doomed.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\ExecutionEngine.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Graph.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Model.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\msvcp100.dll\", SourcePath.SourceType.Tools)); // Needed by z3.\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\msvcr100.dll\", SourcePath.SourceType.Tools)); // Needed by z3.\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\ParserHelper.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\Provers.SMTLib.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\VCExpr.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\VCGeneration.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\vcomp100.dll\", SourcePath.SourceType.Tools)); // Needed by z3.\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\DafnyRuntime.cs\", SourcePath.SourceType.Tools)); // Needed for compilation\r\n exeDepends.Add(new SourcePath(\"tools\\\\Dafny\\\\z3.exe\", SourcePath.SourceType.Tools));\r\n\r\n return exeDepends;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DafnyExtensions.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n internal class DafnyExtensions\r\n {\r\n public static HashSet getForestDependencies(IEnumerable roots, out DependencyDisposition ddisp)\r\n {\r\n HashSet result = new HashSet();\r\n ddisp = DependencyDisposition.Complete;\r\n foreach (BuildObject dfysource in roots)\r\n {\r\n TransitiveDepsVerb depsVerb = new DafnyTransitiveDepsVerb(dfysource);\r\n DependencyDisposition localDDisp;\r\n result.UnionWith(depsVerb.getAvailableDeps(out localDDisp));\r\n ddisp = ddisp.combine(localDDisp);\r\n result.Add(dfysource); // TransitiveDeps *exclude* the root, so we need to add that in, too.\r\n }\r\n\r\n return result;\r\n }\r\n\r\n public static IEnumerable getForestVerbs(IEnumerable roots)\r\n {\r\n return roots.Select(root => new DafnyTransitiveDepsVerb(root));\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DafnyIncludes.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Text.RegularExpressions;\r\n\r\n /// \r\n /// Extractor of Dafny include file names (and related functionality).\r\n /// \r\n internal class DafnyIncludes\r\n : IIncludeFactory\r\n {\r\n /// \r\n /// Regular expression matching Dafny include lines.\r\n /// \r\n private Regex includeRegex;\r\n\r\n /// \r\n /// Temporary working directory used by ExpandDafny method.\r\n /// \r\n private WorkingDirectory workingDirectory;\r\n\r\n /// \r\n /// TextWriter used by ExpandDafny method.\r\n /// \r\n private TextWriter outputWriter;\r\n\r\n /// \r\n /// Set of include files already visited.\r\n /// Used by ExpandDafny method.\r\n /// \r\n private HashSet visited;\r\n\r\n /// \r\n /// Initializes a new instance of the DafnyIncludes class.\r\n /// \r\n public DafnyIncludes()\r\n {\r\n this.includeRegex = new Regex(\"^\\\\s*include\\\\s*\\\"(.*)\\\"\");\r\n }\r\n\r\n /// \r\n /// Gets a list of the include files included in the given Dafny source file.\r\n /// \r\n /// Source file to extract include file names from.\r\n /// List of include file BuildObjects.\r\n public IEnumerable getIncludes(BuildObject dfysource)\r\n {\r\n List outlist = new List();\r\n using (TextReader tr = BuildEngine.theEngine.Repository.OpenRead(dfysource))\r\n {\r\n while (true)\r\n {\r\n string line = tr.ReadLine();\r\n if (line == null)\r\n {\r\n break;\r\n }\r\n\r\n Match match = this.includeRegex.Match(line);\r\n int count = 0;\r\n while (match.Success)\r\n {\r\n string includedPath = match.Groups[1].ToString();\r\n string gluedPath = Path.Combine(dfysource.getDirPath(), includedPath);\r\n SourcePath sp = new SourcePath(gluedPath);\r\n outlist.Add(sp);\r\n count += 1;\r\n match = match.NextMatch(); // That would be unexpected!\r\n }\r\n\r\n Util.Assert(count <= 1);\r\n }\r\n }\r\n\r\n ////Logger.WriteLine(String.Format(\"{0} includes {1} things\", dfysource.getFilesystemPath(), outlist.Count));\r\n return outlist;\r\n }\r\n\r\n /// \r\n /// Expand a dafny source file to include all of its includes inline.\r\n /// \r\n /// Temporary working directory to use.\r\n /// Source build object.\r\n /// Where to create build object for expanded source file.\r\n public void ExpandDafny(WorkingDirectory workingDirectory, SourcePath input, SourcePath output)\r\n {\r\n // Prepare the output stream.\r\n using (TextWriter outWriter = new StreamWriter(workingDirectory.PathTo(output)))\r\n {\r\n // Stash away a few things for use by our recursive helper function.\r\n this.workingDirectory = workingDirectory;\r\n this.outputWriter = outWriter;\r\n this.visited = new HashSet();\r\n\r\n // Recursively expand the initial Dafny source file to inline all of its includes.\r\n this.ExpandDafnyRecurse(input);\r\n }\r\n\r\n // Cache the output file in the Repository.\r\n BuildEngine.theEngine.Repository.Store(workingDirectory, output, new Fresh());\r\n }\r\n\r\n /// \r\n /// Helper function for ExpandDafny method.\r\n /// \r\n /// Next include file to visit.\r\n /// True if the given file wasn't already included, false otherwise.\r\n private bool ExpandDafnyRecurse(SourcePath input)\r\n {\r\n // Only visit each unique include file once.\r\n // Note that SourcePaths (like all BuildObjects) have normalized file paths.\r\n string inputPath = input.getRelativePath();\r\n if (this.visited.Contains(inputPath))\r\n {\r\n return false;\r\n }\r\n else\r\n {\r\n this.visited.Add(inputPath);\r\n }\r\n\r\n using (TextReader reader = new StreamReader(this.workingDirectory.PathTo(input)))\r\n {\r\n while (true)\r\n {\r\n string line = reader.ReadLine();\r\n if (line == null)\r\n {\r\n return true;\r\n }\r\n\r\n Match match = this.includeRegex.Match(line);\r\n if (match.Success)\r\n {\r\n // This is an \"include\" line. Find the included object.\r\n string includedPath = match.Groups[1].ToString();\r\n string gluedPath = Path.Combine(input.getDirPath(), includedPath);\r\n SourcePath nextInclude = new SourcePath(gluedPath);\r\n string nextPath = nextInclude.getRelativePath();\r\n\r\n // Recurse on the new include file.\r\n this.outputWriter.WriteLine(\"//- Begin include {0} (from {1})\", nextPath, inputPath);\r\n if (!this.ExpandDafnyRecurse(nextInclude))\r\n {\r\n this.outputWriter.WriteLine(\"//- Already included {0}\", nextPath);\r\n }\r\n\r\n this.outputWriter.WriteLine(\"//- End include {0} (from {1})\", nextPath, inputPath);\r\n }\r\n else\r\n {\r\n // This isn't an \"include\" line. Write it to our output.\r\n this.outputWriter.WriteLine(line);\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DafnySpecVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class DafnySpecVerb\r\n : DafnyTransformBaseVerb\r\n {\r\n private AbstractId abstractId;\r\n private VSSolutionVerb dafnySpecBuildExecutableVerb;\r\n\r\n public DafnySpecVerb(SourcePath dfyroot, string appLabel)\r\n : base(dfyroot, appLabel)\r\n {\r\n this.abstractId = new AbstractId(this.GetType().Name, this.getVersion() + version, dfyroot.ToString());\r\n this.dafnySpecBuildExecutableVerb = new VSSolutionVerb(new SourcePath(\"tools\\\\DafnySpec\\\\DafnySpec.sln\", SourcePath.SourceType.Tools));\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return base.getVerbs().Concat(new[] { this.dafnySpecBuildExecutableVerb });\r\n }\r\n\r\n protected override int getVersion()\r\n {\r\n return 15;\r\n }\r\n\r\n protected override BuildObject getExecutable()\r\n {\r\n return new BuildObject(Path.Combine(this.dafnySpecBuildExecutableVerb.getOutputPath().getRelativePath(), \"dafnyspec.exe\"));\r\n }\r\n\r\n protected override IEnumerable getExtraDependencies()\r\n {\r\n string exePath = this.dafnySpecBuildExecutableVerb.getOutputPath().getRelativePath();\r\n\r\n // REVIEW: Should we extract the dafnyspec.exe dependencies from the project file instead of listing them manually?\r\n return new BuildObject[] {\r\n new BuildObject(Path.Combine(exePath, \"DafnySpecAst.dll\")),\r\n new BuildObject(Path.Combine(exePath, \"Parser.dll\")),\r\n };\r\n }\r\n\r\n protected override IEnumerable getRoots()\r\n {\r\n // TODO why doesn't DafnyCC require DafnyPreludePath?\r\n return new SourcePath[] { this.getDafnyPrelude(), this.getSeqSpec(), dfyroot };\r\n }\r\n\r\n protected override bool transformFilterAccepts(BuildObject dfysource)\r\n {\r\n string fn = dfysource.getFileNameWithoutExtension();\r\n if (fn.EndsWith(\".\" + DafnyTransformBaseVerb.DAFNY_S_SUFFIX))\r\n {\r\n return true;\r\n }\r\n else\r\n {\r\n Util.Assert(fn.EndsWith(\".\" + DafnyTransformBaseVerb.DAFNY_I_SUFFIX) || fn.EndsWith(\".\" + DafnyTransformBaseVerb.DAFNY_C_SUFFIX) || dfysource.Equals(this.getDafnyPrelude()));\r\n return false;\r\n }\r\n }\r\n\r\n protected override IEnumerable getRootArgs()\r\n {\r\n OrderPreservingSet specFiles = new OrderPreservingSet();\r\n specFiles.Add(this.getDafnyPrelude());\r\n specFiles.Add(this.getSeqSpec());\r\n DependencyDisposition ddisp;\r\n foreach (SourcePath src in this.getAllDafnyModules(out ddisp))\r\n {\r\n if (this.transformFilterAccepts(src))\r\n {\r\n specFiles.Add(src);\r\n }\r\n }\r\n\r\n return specFiles;\r\n }\r\n\r\n private SourcePath getSeqSpec()\r\n {\r\n return new SourcePath(\"src\\\\Trusted\\\\DafnySpec\\\\Seq.s.dfy\");\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DafnyTransformBaseVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal abstract class DafnyTransformBaseVerb\r\n : Verb, IProcessInvokeAsyncVerb\r\n {\r\n public const char DAFNY_S_SUFFIX = 's'; // a trusted specification file\r\n public const char DAFNY_C_SUFFIX = 'c'; // a checked specification file\r\n public const char DAFNY_I_SUFFIX = 'i'; // a checked implementation file\r\n public static readonly char[] DAFNY_SUFFIXES = { DAFNY_S_SUFFIX, DAFNY_C_SUFFIX, DAFNY_I_SUFFIX }; // REVIEW: Never used?\r\n public static readonly string[] DAFNY_LONG_EXTNS =\r\n {\r\n \".\" + DAFNY_S_SUFFIX + DafnyVerifyOneVerb.DAFNY_EXTN,\r\n \".\" + DAFNY_C_SUFFIX + DafnyVerifyOneVerb.DAFNY_EXTN,\r\n \".\" + DAFNY_I_SUFFIX + DafnyVerifyOneVerb.DAFNY_EXTN\r\n };\r\n\r\n protected const int version = 15;\r\n protected const string DAFNY_PRELUDE_DIRECTORY = \"tools\\\\DafnySpec\";\r\n protected const string DAFNY_PRELUDE_FILENAME = \"DafnyPrelude.dfy\";\r\n\r\n protected SourcePath dfyroot;\r\n protected string appLabel;\r\n\r\n public DafnyTransformBaseVerb(SourcePath dfyroot, string appLabel)\r\n {\r\n this.dfyroot = dfyroot;\r\n this.appLabel = appLabel;\r\n\r\n // REVIEW: This is never used by anything. Remove?\r\n IEnumerable roots = this.getRoots().Select(obj => obj.ToString());\r\n }\r\n\r\n private delegate void Tacker(BuildObject dfysource, string filename);\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n HashSet result = DafnyExtensions.getForestDependencies(this.getRoots(), out ddisp);\r\n result.Add(this.getExecutable());\r\n result.UnionWith(this.getExtraDependencies());\r\n return result;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return DafnyExtensions.getForestVerbs(this.getRoots());\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n List outputs = new List();\r\n foreach (InOutMapping mapping in this.getInOutMappings())\r\n {\r\n if (mapping.dfysource == null\r\n || mapping.dfysource.Equals(this.getDafnyPrelude())\r\n || this.transformFilterAccepts(mapping.dfysource))\r\n {\r\n outputs.Add(mapping.basmIfc);\r\n outputs.Add(mapping.basmImp);\r\n }\r\n }\r\n\r\n outputs.Add(new BuildObject(Path.Combine(\r\n this.getDestPath(), \"dafny_modules.txt\")));\r\n return outputs;\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n BuildObject absDestPath = this.getAbsDestPath();\r\n ////Directory.Delete(vfs.ToPath(absDestPath), true); // This verb should be the only one writing here, so let's keep it tidy.\r\n Directory.CreateDirectory(workingDirectory.PathTo(absDestPath)); // REVIEW: Shouldn't PrepareForVerb already do this?\r\n string dafnyccExecutable = this.getExecutable().getRelativePath();\r\n\r\n List args = new List();\r\n args.AddRange(this.getRootArgs().Select(sp => sp.getRelativePath()));\r\n args.Add(\"/outdir:\" + this.getDestPath());\r\n this.addExtraArgs(args);\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n dafnyccExecutable,\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n getDiagnosticsBase());\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n if (disposition is Failed)\r\n {\r\n return disposition;\r\n }\r\n\r\n HashSet createdFiles = new HashSet(Directory.GetFiles(workingDirectory.PathTo(this.getAbsDestPath())).Select(path => Path.GetFileName(path)));\r\n HashSet expectedFiles = new HashSet(this.getOutputs().Select(obj => obj.getFileName()));\r\n\r\n // DafnyCC/DafnySpec process a big batch of files together. Did we correctly understand what it did?\r\n if (!createdFiles.SetEquals(expectedFiles))\r\n {\r\n // REVIEW: These are never used by anything. Remove?\r\n bool dummy = createdFiles.SetEquals(expectedFiles);\r\n int missing = expectedFiles.Except(createdFiles).Count();\r\n int extra = createdFiles.Except(expectedFiles).Count();\r\n\r\n string msg = \"Missing files: \" + string.Join(\",\", expectedFiles.Except(createdFiles)) + \"\\n\" +\r\n \" Extra files: \" + string.Join(\",\", createdFiles.Except(expectedFiles));\r\n return new Failed(msg);\r\n }\r\n\r\n // Propagate the NuBuild annotations.\r\n foreach (InOutMapping mapping in this.getInOutMappings())\r\n {\r\n if (mapping.dfysource != null\r\n && this.transformFilterAccepts(mapping.dfysource))\r\n {\r\n AnnotationScanner.transferAnnotations(\r\n workingDirectory, mapping.dfysource, mapping.basmIfc, BoogieAsmDepBase.CommentSymbol);\r\n AnnotationScanner.transferAnnotations(\r\n workingDirectory, mapping.dfysource, mapping.basmImp, BoogieAsmDepBase.CommentSymbol);\r\n }\r\n }\r\n\r\n return new Fresh();\r\n }\r\n\r\n protected abstract int getVersion();\r\n\r\n protected abstract BuildObject getExecutable();\r\n\r\n // getRoots is the set of dafny files from which we explore to\r\n // discover the set of dependencies. We use the same transitive\r\n // closure to compute the set of allDafnyModules, which tell\r\n // us what output files to expect.\r\n protected abstract IEnumerable getRoots();\r\n\r\n // roots -> dependencies\r\n // roots -> allDafnyModules -> getRootArgs\r\n\r\n // getRootArgs is the set of dafny files we hand to the executable.\r\n // In the DafnyCC case, it's the transitive closure (allDafnyModules),\r\n // in the DafnySpec case, it's the roots only. Weird. And there are\r\n // weird exceptions in both cases.\r\n protected abstract IEnumerable getRootArgs();\r\n\r\n protected virtual IEnumerable getExtraDependencies()\r\n {\r\n return new BuildObject[] { };\r\n }\r\n\r\n protected virtual IEnumerable getExtraSpecialOutputs()\r\n {\r\n return new string[] { };\r\n }\r\n\r\n protected virtual void addExtraArgs(List args)\r\n {\r\n }\r\n\r\n protected virtual bool transformFilterAccepts(BuildObject dfysource)\r\n {\r\n return true;\r\n }\r\n\r\n protected virtual IEnumerable getAllDafnyModules(out DependencyDisposition ddisp)\r\n {\r\n HashSet result = DafnyExtensions.getForestDependencies(this.getRoots(), out ddisp);\r\n\r\n // Now we assert that all Dafny inputs are actually SourcePaths.\r\n HashSet rc = new HashSet();\r\n foreach (BuildObject obj in result)\r\n {\r\n if (obj.getExtension().EndsWith(DafnyVerifyOneVerb.DAFNY_EXTN))\r\n {\r\n rc.Add((SourcePath)obj);\r\n }\r\n else\r\n {\r\n Util.Assert(obj.getExtension().EndsWith(TransitiveDepsVerb.TDEP_EXTN));\r\n // Discard it.\r\n }\r\n }\r\n\r\n return rc;\r\n }\r\n\r\n protected SourcePath getDafnyPrelude()\r\n {\r\n return new SourcePath(Path.Combine(DAFNY_PRELUDE_DIRECTORY, DAFNY_PRELUDE_FILENAME), SourcePath.SourceType.Tools);\r\n }\r\n\r\n private string getDestPath()\r\n {\r\n // This logic duplicates BuildObject.makeLabeledOutputObject; the interface isn't tidily\r\n // factored for reuse yet.\r\n string path = this.GetType().Name;\r\n if (this.appLabel != null)\r\n {\r\n path = Path.Combine(this.appLabel, path);\r\n }\r\n\r\n path = Path.Combine(BuildEngine.theEngine.getObjRoot(), path);\r\n return path;\r\n }\r\n\r\n private BuildObject basmOutputForDafnyModule(string modulename, string extn)\r\n {\r\n bool isTrusted =\r\n (modulename.EndsWith(\"_\" + DAFNY_S_SUFFIX)\r\n || modulename.Equals(\"Trusted\"))\r\n && BeatExtensions.whichPart(extn) == ModPart.Imp;\r\n return new BuildObject(Path.Combine(this.getDestPath(), modulename + extn), isTrusted: isTrusted);\r\n }\r\n\r\n private BuildObject getAbsDestPath()\r\n {\r\n return new BuildObject(this.getDestPath());\r\n }\r\n\r\n private List getInOutMappings()\r\n {\r\n List mapping = new List();\r\n Tacker tack = delegate(BuildObject dfysource, string filename)\r\n {\r\n mapping.Add(new InOutMapping(\r\n dfysource,\r\n this.basmOutputForDafnyModule(filename, BoogieAsmVerifyVerb.BASMIFC_EXTN),\r\n this.basmOutputForDafnyModule(filename, BoogieAsmVerifyVerb.BASMIMP_EXTN)));\r\n };\r\n\r\n DependencyDisposition ddispDummy;\r\n foreach (SourcePath dfy in this.getAllDafnyModules(out ddispDummy))\r\n {\r\n // Trim off \".dfy\" but not \".s\" or \".i\".\r\n string dfyname = dfy.getFileName();\r\n Util.Assert(dfyname.EndsWith(\".dfy\"));\r\n string basename = dfyname.Substring(0, dfyname.Length - 4);\r\n Util.Assert(basename.Equals(dfy.getFileNameWithoutExtension())); // TODO delete prior lines.\r\n\r\n basename = Util.dafnySpecMungeName(basename);\r\n if ((this is DafnyCCVerb)\r\n && (basename.Equals(\"Seq\") || basename.Equals(\"Seq_s\")))\r\n { // TODO undesirable workaround -- DafnyCC doesn't want 'seq.dfy' in its output list, but DafnySpec does...?\r\n continue;\r\n }\r\n\r\n tack(dfy, \"dafny_\" + basename);\r\n }\r\n\r\n tack(null, \"Trusted\"); // DafnyCC doesn't really want this, but meh, it emits it, so we account for it.\r\n foreach (string basename in this.getExtraSpecialOutputs())\r\n {\r\n tack(null, basename);\r\n }\r\n\r\n return mapping;\r\n }\r\n\r\n private class InOutMapping\r\n {\r\n public readonly BuildObject dfysource; // null --> outputs come from bowels of DafnySpec/DafnyCC.\r\n public readonly BuildObject basmIfc;\r\n public readonly BuildObject basmImp;\r\n\r\n public InOutMapping(BuildObject dfysource, BuildObject basmIfc, BuildObject basmImp)\r\n {\r\n this.dfysource = dfysource;\r\n this.basmIfc = basmIfc;\r\n this.basmImp = basmImp;\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DafnyTransitiveDepsVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class DafnyTransitiveDepsVerb\r\n : TransitiveDepsVerb\r\n {\r\n public DafnyTransitiveDepsVerb(BuildObject input)\r\n : base(input)\r\n {\r\n }\r\n\r\n protected override TransitiveDepsVerb factory(BuildObject obj)\r\n {\r\n return new DafnyTransitiveDepsVerb(obj);\r\n }\r\n\r\n protected override IIncludeFactory getIncludeFactory()\r\n {\r\n return new DafnyIncludes();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DafnyVerifyOneVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class DafnyVerifyOneVerb\r\n : VerificationResultVerb, IProcessInvokeAsyncVerb\r\n {\r\n public const string DAFNY_EXTN = \".dfy\";\r\n private const int version = 15;\r\n private const string ADDDAFNYFLAG_LABEL = \"AddDafnyFlag\";\r\n\r\n private SourcePath dfysource;\r\n private AbstractId abstractId;\r\n\r\n public DafnyVerifyOneVerb(SourcePath dfysource)\r\n {\r\n this.dfysource = dfysource;\r\n this.abstractId = new AbstractId(this.GetType().Name, version, dfysource.ToString()); \r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n TransitiveDepsVerb depsVerb = this.getTransitiveDepsVerb();\r\n HashSet result = depsVerb.getAvailableDeps(out ddisp);\r\n result.UnionWith(DafnyExecutableDependencies.getDafnyExecutableDependencies());\r\n return result;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new IVerb[0]; // All inputs are sources.\r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n return this.dfysource.makeOutputObject(\".dfy.v\");\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new[] { this.getOutputFile() };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n List arguments = new List();\r\n arguments.Add(\"/noNLarith\");\r\n arguments.Add(\"/allowGlobals\");\r\n arguments.Add(\"/z3opt:nlsat.randomize=false\");\r\n arguments.Add(\"/z3opt:pi.warnings=true\");\r\n arguments.Add(\"/proverWarnings:1\");\r\n arguments.Add(\"/compile:0\");\r\n arguments.Add(\"/timeLimit:30\");\r\n arguments.Add(\"/noCheating:1\");\r\n arguments.Add(\"/autoTriggers:1\");\r\n arguments.Add(\"/ironDafny\");\r\n foreach (string[] ann in new AnnotationScanner(this.dfysource).getAnnotations(ADDDAFNYFLAG_LABEL))\r\n {\r\n if (ann.Length != 2)\r\n {\r\n throw new SourceConfigurationError(\"Expected exactly 1 argument to \" + ADDDAFNYFLAG_LABEL);\r\n }\r\n\r\n arguments.Add(ann[1]);\r\n }\r\n\r\n arguments.Add(this.dfysource.getRelativePath());\r\n Logger.WriteLine(\"arguments: \" + string.Join(\" \", arguments));\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n DafnyExecutableDependencies.getDafnyExecutable().getRelativePath(),\r\n arguments.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsOkay,\r\n getDiagnosticsBase(),\r\n returnStandardOut: true,\r\n returnStandardError: true,\r\n allowCloudExecution: true);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n VerificationResult vr = new VerificationResult(\r\n this.dfysource.getRelativePath(),\r\n cpuTimeSeconds,\r\n stdout,\r\n stderr,\r\n new VerificationResultDafnyParser());\r\n vr.addBasicPresentation();\r\n vr.toXmlFile(workingDirectory.PathTo(this.getOutputFile()));\r\n this.setWasRejectableFailure(!vr.pass);\r\n return disposition;\r\n }\r\n\r\n public IEnumerable getDirectIncludes()\r\n {\r\n // By the time this method is called by VerbToposorter,\r\n // this verb is scheduled for execution, and hence its deps\r\n // are complete. So all of these lookups should succeed.\r\n // (wait, does that follow?)\r\n return this.getTransitiveDepsVerb().getShallowIncludes();\r\n }\r\n\r\n protected override BuildObject getSource()\r\n {\r\n return this.dfysource;\r\n } \r\n\r\n private TransitiveDepsVerb getTransitiveDepsVerb()\r\n {\r\n return new DafnyTransitiveDepsVerb(this.dfysource);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DafnyVerifyTreeVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n internal class DafnyVerifyTreeVerb\r\n : Verb, IObligationsProducer\r\n {\r\n private const int version = 30;\r\n\r\n private const string DFYTREE_EXTN = \".dfytree\";\r\n\r\n private SourcePath displayRoot; // used only in labeling the output\r\n private BuildObject obligations;\r\n private AbstractId abstractId;\r\n\r\n public DafnyVerifyTreeVerb(SourcePath root)\r\n {\r\n this.displayRoot = root;\r\n this.obligations = root.makeOutputObject(DFYTREE_EXTN + VerificationObligationList.VOL_EXTN);\r\n this.abstractId = new AbstractId(this.GetType().Name, version, root.ToString());\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public BuildObject getObligationSet()\r\n {\r\n return this.obligations;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n HashSet availableDeps = this.getAvailableDeps(out ddisp);\r\n\r\n List true_deps = new List();\r\n foreach (BuildObject dep in availableDeps)\r\n {\r\n if (dep.getExtension().EndsWith(DafnyVerifyOneVerb.DAFNY_EXTN))\r\n {\r\n true_deps.Add(this.mkVerificationObject(dep));\r\n }\r\n else\r\n {\r\n true_deps.Add(dep);\r\n }\r\n }\r\n\r\n return true_deps;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n // TODO cast below assumes dafny files are always source files.\r\n // That's easy enough to remedy in DafnyVerifyOneVerb ctor, but for\r\n // now, we continue assuming it. \r\n // This will matter if we ever auto-generate a Dafny file.\r\n DependencyDisposition ddispDummy;\r\n IEnumerable result = this.getDafnyDependencies(out ddispDummy)\r\n .Select(dfysource => new DafnyVerifyOneVerb((SourcePath)dfysource))\r\n .Concat(new List() { new DafnyTransitiveDepsVerb(this.displayRoot) });\r\n\r\n return result;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new HashSet() { this.obligations };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n IEnumerable verificationResults = this.getVerbs()\r\n .Where(verb => verb is VerificationResultVerb)\r\n .Select(dfy_one => ((VerificationResultVerb)dfy_one).getOutputFile());\r\n VerificationObligationList vol = new VerificationObligationList(verificationResults);\r\n vol.store(workingDirectory, this.obligations);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n\r\n private BuildObject mkVerificationObject(BuildObject dfysource)\r\n {\r\n return dfysource.makeOutputObject(DafnyVerifyOneVerb.DAFNY_EXTN + VerificationResultVerb.VERIFICATION_RESULT_EXTN);\r\n }\r\n\r\n private HashSet getAvailableDeps(out DependencyDisposition ddisp)\r\n {\r\n TransitiveDepsVerb depsVerb = new DafnyTransitiveDepsVerb(this.displayRoot);\r\n HashSet availableDeps = depsVerb.getAvailableDeps(out ddisp);\r\n availableDeps.Add(this.displayRoot); // TransitiveDeps *exclude* the root, so we need to add that in, too.\r\n return availableDeps;\r\n }\r\n\r\n private IEnumerable getDafnyDependencies(out DependencyDisposition ddisp)\r\n {\r\n HashSet result = this.getAvailableDeps(out ddisp);\r\n return result.Where(dep => dep.getExtension().EndsWith(DafnyVerifyOneVerb.DAFNY_EXTN));\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DbgFileCopySpeedTest.cs", "content": "namespace NuBuild\r\n{\r\n using System;\r\n using System.IO;\r\n\r\n internal class DbgFileCopySpeedTest\r\n {\r\n public static void thing()\r\n {\r\n Directory.SetCurrentDirectory(\"c:\\\\users\\\\howell\\\\verve2\\\\iron\");\r\n Directory.CreateDirectory(\"dummy\");\r\n Directory.CreateDirectory(\"dummy\\\\Results\");\r\n Directory.CreateDirectory(\"dummy\\\\Objects\");\r\n Directory.CreateDirectory(\"dummy\\\\Sources\");\r\n foreach (string path in Directory.EnumerateFiles(\"nucache\", \"*\", SearchOption.AllDirectories))\r\n {\r\n string fn = path.Substring(path.IndexOf(\"nucache\") + 8);\r\n string source = Path.Combine(\"nucache\", fn);\r\n string dest = Path.Combine(\"dummy\", fn);\r\n ////Logger.WriteLine(\"Copy \" + source + \" to \" + dest);\r\n ////File.Copy(source, dest);\r\n\r\n File.Delete(dest);\r\n using (FileStream outStream = File.OpenWrite(dest))\r\n {\r\n bool dummy = File.Exists(source);\r\n using (Stream inStream = File.OpenRead(source))\r\n {\r\n inStream.CopyTo(outStream);\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DbgHashSpeedTest.cs", "content": "namespace NuBuild\r\n{\r\n using System;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class DbgHashSpeedTest\r\n {\r\n public static void thing()\r\n {\r\n Directory.SetCurrentDirectory(\"c:\\\\users\\\\howell\\\\verve2\\\\iron\");\r\n string[] theFiles = File.ReadAllLines(\"hashlist\");\r\n Logger.WriteLine(\"I found \" + theFiles.Count() + \" files\");\r\n\r\n foreach (string file in theFiles)\r\n {\r\n string s = Util.hashFilesystemPath(file);\r\n Logger.WriteLine(s);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DbgVerbCounter.cs", "content": "namespace NuBuild\r\n{\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\n // I used this class to determine how much effort we were wasting\r\n // re-computing verb.getDependencies.\r\n internal class DbgVerbCounter\r\n {\r\n public enum DbgVerbCondition { DVWake, DVDepsIncomplete, DVDepsStale, DVDepsNonstale, DVTotal }\r\n private Dictionary, int> dbgCounts = new Dictionary, int>();\r\n\r\n public void dbgDisplayCounts()\r\n {\r\n List> keys = new List>(dbgCounts.Keys);\r\n keys.Sort();\r\n foreach (Tuple key in keys)\r\n {\r\n Logger.WriteLine(string.Format(\"{0:20}: {1}\", key, dbgCounts[key]));\r\n }\r\n }\r\n\r\n public void consider(IVerb verb, DbgVerbCondition cond)\r\n {\r\n consider_inner(new Tuple(verb, cond));\r\n consider_inner(new Tuple(verb, DbgVerbCondition.DVTotal));\r\n }\r\n\r\n private void consider_inner(Tuple key)\r\n {\r\n if (!dbgCounts.ContainsKey(key))\r\n {\r\n dbgCounts[key] = 0;\r\n }\r\n\r\n dbgCounts[key] += 1;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DependencyCache.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class DependencyCache\r\n {\r\n private Dictionary theCache;\r\n private int dbgQueries = 0;\r\n private int dbgMisses = 0;\r\n\r\n public DependencyCache()\r\n {\r\n this.theCache = new Dictionary();\r\n }\r\n\r\n public IEnumerable getDependencies(IVerb verb, out DependencyDisposition ddisp)\r\n {\r\n this.dbgQueries += 1;\r\n DependencyResult result;\r\n bool present = this.theCache.TryGetValue(verb, out result);\r\n if (!present)\r\n {\r\n this.dbgMisses += 1;\r\n result = new DependencyResult();\r\n result.deps = verb.getDependencies(out result.ddisp);\r\n if (result.ddisp != DependencyDisposition.Incomplete)\r\n {\r\n // Can't cache incomplete results, since they may change upon\r\n // later inspection.\r\n this.theCache[verb] = result;\r\n }\r\n }\r\n\r\n ddisp = result.ddisp;\r\n return result.deps;\r\n }\r\n\r\n public void dbgPrintStats()\r\n {\r\n Logger.WriteLine(string.Format(\r\n \"DependencyCache queries {0} misses {1}\", this.dbgQueries, this.dbgMisses));\r\n }\r\n\r\n private class DependencyResult\r\n {\r\n public IEnumerable deps;\r\n public DependencyDisposition ddisp;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/DependencyDisposition.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n public enum DependencyDisposition\r\n {\r\n Complete,\r\n Incomplete,\r\n Failed // Something failed upstream\r\n }\r\n\r\n public static class DependencyDispositionExtensions\r\n {\r\n public static DependencyDisposition combine(this DependencyDisposition a, DependencyDisposition b)\r\n {\r\n if (a == DependencyDisposition.Failed || b == DependencyDisposition.Failed)\r\n {\r\n return DependencyDisposition.Failed;\r\n }\r\n\r\n if (a == DependencyDisposition.Incomplete || b == DependencyDisposition.Incomplete)\r\n {\r\n return DependencyDisposition.Incomplete;\r\n }\r\n\r\n return DependencyDisposition.Complete;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/Disposition.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Xml;\r\n\r\n internal class Disposition\r\n {\r\n public const string _xml_tag = \"Disposition\";\r\n private const string _xml_value_attr = \"Value\";\r\n\r\n public static Disposition readXml(XmlReader xr)\r\n {\r\n Util.Assert(xr.Name.Equals(_xml_tag));\r\n string value = xr.GetAttribute(_xml_value_attr);\r\n if (value.Equals(Fresh.Value))\r\n {\r\n return new Fresh();\r\n }\r\n else if (value.Equals(Failed.Value))\r\n {\r\n return Failed.readXml(xr);\r\n }\r\n else\r\n {\r\n throw new Exception(\"Invalid disposition value \" + value);\r\n }\r\n }\r\n\r\n public virtual IEnumerable getMessages()\r\n {\r\n return new string[0];\r\n }\r\n\r\n public virtual void writeXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(_xml_tag);\r\n xw.WriteAttributeString(_xml_value_attr, ToString());\r\n this.writeXmlExtend(xw);\r\n xw.WriteEndElement();\r\n }\r\n\r\n protected virtual void writeXmlExtend(XmlWriter xw)\r\n {\r\n }\r\n }\r\n\r\n internal class Stale : Disposition\r\n {\r\n public const string Value = \"Stale\";\r\n\r\n public override string ToString()\r\n {\r\n return Value;\r\n }\r\n }\r\n\r\n internal class Fresh : Disposition\r\n {\r\n public const string Value = \"Fresh\";\r\n\r\n public override string ToString()\r\n {\r\n return Value;\r\n }\r\n }\r\n\r\n /// \r\n /// Failed represents a PERMANENT failure. Any non-Stale disposition is recorded\r\n /// permanently in the build cache (including the globally-shared build cache!),\r\n /// preventing that particular verb from ever being tried again. Only record a\r\n /// Failed disposition if repeating the verb is guaranteed to fail again the same way.\r\n /// \r\n internal class Failed : Disposition\r\n {\r\n public const string Value = \"Failed\";\r\n private const string _xml_MessageTag = \"Message\";\r\n\r\n private List messages;\r\n\r\n public Failed(string msg = null)\r\n {\r\n this.messages = new List();\r\n if (msg != null)\r\n {\r\n this.AddError(msg);\r\n }\r\n }\r\n\r\n public Failed(IEnumerable messages)\r\n {\r\n this.messages = new List(messages);\r\n }\r\n\r\n public static new Disposition readXml(XmlReader xr)\r\n {\r\n List messages = new List();\r\n if (!xr.IsEmptyElement)\r\n {\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n if (xr.Name.Equals(_xml_MessageTag))\r\n {\r\n messages.Add(xr.ReadElementContentAsString());\r\n }\r\n else\r\n {\r\n throw new Exception(\"Unrecognized Disposition::Failed tag \" + xr.Name);\r\n }\r\n }\r\n else if (xr.NodeType == XmlNodeType.EndElement)\r\n {\r\n Util.Assert(xr.Name.Equals(Disposition._xml_tag));\r\n break;\r\n }\r\n }\r\n }\r\n\r\n Failed f = new Failed();\r\n f.messages = messages;\r\n return f;\r\n }\r\n\r\n public void AddError(string msg)\r\n {\r\n this.messages.Add(msg);\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return Failed.Value;\r\n }\r\n\r\n public override IEnumerable getMessages()\r\n {\r\n return this.messages;\r\n }\r\n\r\n protected override void writeXmlExtend(XmlWriter xw)\r\n {\r\n foreach (string message in this.messages)\r\n {\r\n xw.WriteStartElement(_xml_MessageTag);\r\n xw.WriteString(message);\r\n xw.WriteEndElement();\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/EntryStitcherVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class EntryStitcherVerb\r\n : Verb\r\n {\r\n private const int version = 10;\r\n private const string SENTINEL_APP_SPECIFIC_GOES_HERE = \"//- SENTINEL_APP_SPECIFIC_GOES_HERE\";\r\n\r\n private string appLabel;\r\n private IContextGeneratingVerb context; // Label our abstractIdentifier\r\n private BeatVerb mainBeatVerb;\r\n private SourcePath genericStitch;\r\n private SourcePath appSpecificStitch;\r\n\r\n private BuildObject dafnyMainImpInput;\r\n private BuildObject dafnyMainIfcInput;\r\n private SourcePath entryImpInput;\r\n\r\n public EntryStitcherVerb(IContextGeneratingVerb context, string appLabel)\r\n {\r\n this.appLabel = appLabel;\r\n this.context = context;\r\n this.entryImpInput = new SourcePath(\"src\\\\Checked\\\\Nucleus\\\\Main\\\\Entry.imp.beat\");\r\n SourcePath mainBeatSrc = new SourcePath(\"src\\\\Checked\\\\Nucleus\\\\Main\\\\Main.ifc.beat\");\r\n this.mainBeatVerb = new BeatVerb(context, mainBeatSrc, appLabel);\r\n this.genericStitch = new SourcePath(\"src\\\\Trusted\\\\Spec\\\\Entry.ifc.basm.stitch\");\r\n this.appSpecificStitch = new SourcePath(string.Format(\"src\\\\Trusted\\\\Spec\\\\{0}\\\\AppRequirements.ifc.stitch\", appLabel));\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return new AbstractId(this.GetType().Name, version, this.genericStitch.ToString(), concrete: this.appLabel);\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n\r\n OrderPreservingSet deps = new OrderPreservingSet();\r\n\r\n // Things we need to stitch the interface:\r\n deps.Add(this.genericStitch);\r\n deps.Add(this.appSpecificStitch);\r\n deps.AddRange(this.mainBeatVerb.getOutputs());\r\n\r\n // Things we need to stitch the imports into the imp file:\r\n deps.Add(this.entryImpInput);\r\n deps.Add(this.context.getContextOutput());\r\n IIncludePathContext pathContext = this.context.fetchIfAvailable(ref ddisp);\r\n if (pathContext != null)\r\n {\r\n this.dafnyMainIfcInput = pathContext.search(\"dafny_Main_i\", ModPart.Ifc);\r\n Util.Assert(this.dafnyMainIfcInput != null);\r\n deps.Add(this.dafnyMainIfcInput);\r\n this.dafnyMainImpInput = pathContext.search(\"dafny_Main_i\", ModPart.Ifc);\r\n Util.Assert(this.dafnyMainImpInput != null);\r\n deps.Add(this.dafnyMainImpInput);\r\n }\r\n\r\n return deps;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new IVerb[] { this.mainBeatVerb, this.context };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { this.getIfcOutput(), this.getEntryImpOutput() };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // Mimic this line from src\\Checked\\Nucleus\\Main\\build.ps1:\r\n // _cat -out $OBJ\\EntryCP_i.bpl -in $OBJ\\MainCP_i.bpl,$SPEC_OBJ\\EntryCP_i.bpl\r\n // TODO: eliminate this special-case workaround.\r\n try\r\n {\r\n // This is the trusted bit, creating the stitched ifc file.\r\n ////IEnumerable ifcImports = extractImportStatements(dafnyMainIfcInput);\r\n string[] mainLines = File.ReadAllLines(workingDirectory.PathTo(this.mainBeatVerb.getOutputs().First()));\r\n string[] entryLines = File.ReadAllLines(workingDirectory.PathTo(this.genericStitch));\r\n int sentinel_index = Array.IndexOf(entryLines, SENTINEL_APP_SPECIFIC_GOES_HERE);\r\n if (sentinel_index < 0)\r\n {\r\n throw new UserError(\"Sentinel string missing in \" + this.genericStitch);\r\n }\r\n\r\n IEnumerable entryPrologue = entryLines.Take(sentinel_index + 1);\r\n IEnumerable entryEpilogue = entryLines.Skip(sentinel_index + 1);\r\n string[] appSpecificLines = File.ReadAllLines(workingDirectory.PathTo(this.appSpecificStitch));\r\n ////File.WriteAllLines(getIfcOutput().getFilesystemPath(), ifcImports.Concat(mainLines.Concat(entryLines)));\r\n File.WriteAllLines(\r\n workingDirectory.PathTo(this.getIfcOutput()),\r\n mainLines.Concat(entryPrologue).Concat(appSpecificLines).Concat(entryEpilogue));\r\n\r\n // Here's some (at least untrusted) workaround, snarfing and repurposing the\r\n // import list from dafny_Main_i up to Entry.imp.\r\n IEnumerable impImports = extractImportStatements(workingDirectory, this.dafnyMainImpInput);\r\n string[] intext = File.ReadAllLines(workingDirectory.PathTo(this.entryImpInput));\r\n File.WriteAllLines(workingDirectory.PathTo(this.getEntryImpOutput()), impImports.Concat(intext));\r\n\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n catch (IOException ex)\r\n {\r\n return new VerbSyncWorker(workingDirectory, new Failed(ex.ToString()));\r\n }\r\n }\r\n\r\n // We also have to stitch the imp, to borrow the private-import list from dafny_Main.\r\n internal BuildObject getEntryImpOutput()\r\n {\r\n return new SourcePath(\"src\\\\Checked\\\\Nucleus\\\\Main\\\\EntryStitched.x\").makeLabeledOutputObject(this.appLabel, BeatExtensions.BEATIMP_EXTN);\r\n }\r\n\r\n private static IEnumerable extractImportStatements(WorkingDirectory workingDirectory, BuildObject obj)\r\n {\r\n // Well, it might be nice to use BeatExtensions.propagatePrivateImports, but that requires\r\n // a context to interpret the input imports. We don't really want to cons up yet ANOTHER\r\n // intermediate context, so here's a temporary workaround. Caution; may be brittle.\r\n IEnumerable imports = File.ReadAllLines(workingDirectory.PathTo(obj))\r\n .Where(line => line.Contains(\"private-import\"));\r\n\r\n // Note that dafny_Main_i didn't really expect us to steal its\r\n // imports, so it hasn't conditioned the Checked and Trusted imports to be beat-resistant.\r\n imports = imports.Select(\r\n line => line.Contains(\"Checked\") || line.Contains(\"Trusted\")\r\n ? line.Replace(\"private-import\", \"private-basmonly-import\")\r\n : line);\r\n return imports;\r\n }\r\n\r\n private BuildObject getIfcOutput()\r\n {\r\n // TODO will probably require parameterization per app\r\n return new SourcePath(\"src\\\\Trusted\\\\Spec\\\\EntryStitched.x\").makeLabeledOutputObject(this.appLabel, BoogieAsmVerifyVerb.BASMIFC_EXTN);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/Hasher.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n /// \r\n /// Strange mixture of hash-related functionality and a\r\n /// mapping from build objects to the verbs that created them?\r\n /// Actually, looks like everything here would more appropriately be elsewhere.\r\n /// DONE: Move outputToVerbMap to Scheduler.\r\n /// DONE: Move marshalledFilesystemPaths to Repository.\r\n /// TODO: Move contextResolutionCache to boogie/asm something or other.\r\n /// TODO: Move parsedIncludesCache to BeatIncludes?\r\n /// \r\n internal class Hasher : IHasher\r\n {\r\n private CachedHash, BuildObject> contextResolutionCache;\r\n\r\n private CachedHash, List> parsedIncludesCache;\r\n\r\n public Hasher()\r\n {\r\n this.contextResolutionCache = new CachedHash, BuildObject>(\r\n delegate(Tuple key)\r\n {\r\n return key.Item1.search(key.Item2, key.Item3);\r\n });\r\n\r\n this.parsedIncludesCache = new CachedHash, List>(\r\n delegate(Tuple key)\r\n {\r\n return BeatIncludes.parseLabeledIncludes(key.Item1, key.Item2);\r\n });\r\n }\r\n\r\n public BuildObject search(IIncludePathContext context, string modName, ModPart modPart)\r\n {\r\n return this.contextResolutionCache.get(new Tuple(context, modName, modPart));\r\n }\r\n\r\n public List getParsedIncludes(IIncludePathContext context, BuildObject beatsrc)\r\n {\r\n return this.parsedIncludesCache.get(new Tuple(context, beatsrc));\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IAsmProducer.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal interface IAsmProducer : IVerb\r\n {\r\n BuildObject getAsmFile();\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IContextGeneratingVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal interface IContextGeneratingVerb\r\n : IVerb\r\n {\r\n string getContextIdentifier();\r\n\r\n PoundDefines getPoundDefines();\r\n\r\n BuildObject getContextOutput();\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IHasher.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n /// \r\n /// REVIEW: Why is this an interface?\r\n /// \r\n internal interface IHasher\r\n {\r\n BuildObject search(IIncludePathContext context, string modName, ModPart modPart);\r\n\r\n List getParsedIncludes(IIncludePathContext context, BuildObject beatsrc);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IIncludeFactory.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal interface IIncludeFactory\r\n {\r\n IEnumerable getIncludes(BuildObject path);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IIncludePathContext.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal interface IIncludePathContext\r\n {\r\n BuildObject search(string basename, ModPart modPart = ModPart.Ifc);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IItemCache.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n /// \r\n /// Enumeration of the containers in the item cache.\r\n /// \r\n /// \r\n /// Important: The names of the values in the enumeration below become the\r\n /// actual names of the item cache containers. For the Azure blob backing\r\n /// store, this means they must be a valid DNS name (i.e. may ONLY be\r\n /// comprised of letters, numbers and the dash ('-') character).\r\n /// \r\n public enum ItemCacheContainer\r\n {\r\n /// \r\n /// Item cache container for source files.\r\n /// \r\n Sources = 0,\r\n\r\n /// \r\n /// Item cache container for object files.\r\n /// \r\n Objects = 1,\r\n\r\n /// \r\n /// Item cache container for (successful) result records.\r\n /// \r\n Results = 2,\r\n\r\n /// \r\n /// Item cache container for unsuccessful result records.\r\n /// \r\n FailedResults = 3\r\n }\r\n\r\n /// \r\n /// Definition of the interface to the item cache.\r\n /// \r\n public interface IItemCache\r\n {\r\n /// \r\n /// Gets a human-readable name for this item cache implementation.\r\n /// \r\n string Name\r\n {\r\n get;\r\n }\r\n\r\n /// \r\n /// Copies the given item from the cache to a new byte array.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A byte array containing a copy of the item.\r\n byte[] FetchItem(\r\n ItemCacheContainer container,\r\n string itemHash);\r\n\r\n /// \r\n /// Copies the given item from the cache to the given location in the\r\n /// local file system.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// \r\n /// Location in the local file system to copy the item.\r\n /// \r\n void FetchItemToFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemDestinationPath);\r\n\r\n /// \r\n /// Copies the given byte array to the desired cache item.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// Byte array containing the item.\r\n void StoreItem(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n byte[] contents);\r\n\r\n /// \r\n /// Copies the given file from the local file system into the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// \r\n /// Location in the local file system from which to source the item.\r\n /// \r\n void StoreItemFromFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemSourcePath);\r\n\r\n /// \r\n /// Deletes an item from the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n void DeleteItem(\r\n ItemCacheContainer container,\r\n string itemHash);\r\n\r\n /// \r\n /// Gets a HashSet containing the hash keys of all the items in the\r\n /// given container.\r\n /// \r\n /// Identifier for the cache container.\r\n /// A HashSet containing the hash keys.\r\n HashSet GetItemsInContainer(\r\n ItemCacheContainer container);\r\n\r\n /// \r\n /// Gets the size of the item.\r\n /// Returns -1 if the item is absent.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// Size of the item in bytes, or -1 if item is absent.\r\n long GetItemSize(\r\n ItemCacheContainer container,\r\n string itemHash);\r\n\r\n /// \r\n /// Gets the last-modified time of the item.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A DateTimeOffset containing the item's last-modified time.\r\n DateTimeOffset? GetItemLastModifiedTime(\r\n ItemCacheContainer container,\r\n string itemHash);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IObligationsProducer.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n \r\n internal interface IObligationsProducer : IVerb\r\n {\r\n BuildObject getObligationSet();\r\n\r\n ////BuildObject getIdentifier();\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IProcessInvokeAsyncVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n /// \r\n /// Interface that verbs which use ProcessInvokeAsyncWorker as their\r\n /// VerbWorker must provide (for callbacks from same).\r\n /// \r\n internal interface IProcessInvokeAsyncVerb : IVerb\r\n {\r\n /// \r\n /// Records the CPU time used by the async worker process.\r\n /// \r\n /// The CPU time used.\r\n void RecordProcessInvokeCpuTime(double cpuTimeSeconds);\r\n\r\n /// \r\n /// Performs any required post-processing and/or cleanup of the\r\n /// results of the async worker process.\r\n /// \r\n /// \r\n /// The private working directory the verb executed in.\r\n /// \r\n /// \r\n /// CPU time used by async process.\r\n /// \r\n /// \r\n /// Standard out from async process (if requested).\r\n /// \r\n /// \r\n /// Standard error from async process (if requested).\r\n /// \r\n /// \r\n /// The disposition of the async process.\r\n /// \r\n /// \r\n /// The ultimate disposition of the worker activity.\r\n /// \r\n Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IProcessInvoker.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n /// \r\n /// Definition of the interface to local and cloud process invokers.\r\n /// \r\n internal interface IProcessInvoker\r\n {\r\n /// \r\n /// Gets the exit code returned by the process.\r\n /// \r\n int ExitCode { get; }\r\n\r\n /// \r\n /// Gets the CPU time used by the process, in seconds.\r\n /// \r\n double CpuTime { get; }\r\n\r\n /// \r\n /// Gets the process's standard output in the default case.\r\n /// Does not return the standard output if it is redirected to a file (i.e. if CaptureStdout is non-null).\r\n /// \r\n /// The process's standard output.\r\n string GetStdout();\r\n\r\n /// \r\n /// Gets the process's standard error output.\r\n /// \r\n /// The process's standard error output.\r\n string GetStderr();\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IRejectable.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n \r\n internal interface IRejectable\r\n {\r\n bool resultWasRejectableFailure();\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Xml;\r\n\r\n /// \r\n /// Definition of the interface to Verbs.\r\n /// \r\n internal interface IVerb\r\n : IComparable\r\n {\r\n /// \r\n /// Gets a possibly-incomplete list of things we depend on.\r\n /// \r\n /// \r\n /// When the list is complete, it should cover every BuildObject\r\n /// this verb can see when running its worker's methods.\r\n /// That means that it's not safe, for example, to say\r\n /// \"I only depend on my .exe and DafnyTransitiveDepsVerb(root).obj()\".\r\n /// One might think so, since the Freshness of the latter implies that\r\n /// every object this verb needs is Fresh, but that doesn't convey\r\n /// what BuildObjects need to (potentially) be transmitted remotely for\r\n /// running the verb's worker's methods on a remote machine.\r\n /// \r\n /// It should also cover any buildObjects needed to complete the list.\r\n /// That is, if the verb depends on a .tdep, and that .tdep is incomplete,\r\n /// the list should include that .tdep's partial dependency list, so\r\n /// the scheduler can figure out how to get it done.\r\n /// \r\n /// The returned DependencyDisposition.\r\n /// \r\n /// A collection of build objects this verb depends upon.\r\n /// \r\n IEnumerable getDependencies(out DependencyDisposition ddisp);\r\n \r\n /// \r\n /// Gets a list of the verbs that can build the dependencies visible to\r\n /// getDependencies. May return an incomplete list if getDependencies\r\n /// is incomplete.\r\n /// \r\n /// \r\n /// A collection of verbs that can build this verb's dependencies.\r\n /// \r\n IEnumerable getVerbs();\r\n \r\n /// \r\n /// Gets a list of the build objects this verb generates upon successful\r\n /// execution.\r\n /// \r\n /// \r\n /// getOutputs is only meaningful once getDependencies indicates\r\n /// a complete disposition. The set of outputs doesn't change.\r\n /// \r\n /// A collection of build objects built by this verb.\r\n IEnumerable getOutputs();\r\n\r\n /// \r\n /// Gets the list of BuildObjects this verb generates containing\r\n /// diagnostic information. Diagnostics are never used as inputs\r\n /// by other verbs; they are only for the user's inspection.\r\n /// TODO: Rename to getDiagnosticOutputs().\r\n /// \r\n /// The collection of diagnostic BuildObjects.\r\n IEnumerable getFailureOutputs();\r\n\r\n /// \r\n /// Gets an identifier that describes the verb up to differences in\r\n /// input.\r\n /// \r\n /// \r\n /// This method must always be evaluable.\r\n /// Example:\r\n /// DafnyVerifyOneVerb(SourcePath(\"src\\\\foo\\\\bar.dfy\"))\r\n /// \r\n /// A unique identifier for the abstract verb.\r\n AbstractId getAbstractIdentifier();\r\n\r\n /// \r\n /// Gets a worker for this verb that performs this verb's work.\r\n /// \r\n /// \r\n /// Working directory to use for this verb's execution.\r\n /// \r\n /// A worker for this verb instance.\r\n IVerbWorker getWorker(WorkingDirectory workingDirectory);\r\n\r\n /// \r\n /// Gets a structured form of output UI for informing the user what\r\n /// happened.\r\n /// \r\n /// Something to present to the user.\r\n Presentation getPresentation();\r\n\r\n /// \r\n /// Gets a structured form of output UI for informing the user what is\r\n /// currently happening.\r\n /// \r\n /// \r\n /// The disposition of this verb's worker.\r\n /// \r\n /// Something to present to the user.\r\n Presentation getRealtimePresentation(Disposition disposition);\r\n\r\n /// \r\n /// Writes an XML representation of this verb's CPU usage using the\r\n /// provided XmlWriter.\r\n /// \r\n /// \r\n /// The XmlWriter to use to write the XML.\r\n /// \r\n void writeTimingXml(XmlWriter xmlWriter);\r\n\r\n /// \r\n /// Writes an XML representation of this verb's internal state\r\n /// (for debugging purposes) using the provided XmlWriter.\r\n /// \r\n /// \r\n /// The XmlWriter to use to write the XML.\r\n /// \r\n void writeDebugXml(XmlWriter xmlWriter);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IVerbWorker.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n /// \r\n /// Enumeration of the verb worker types: synchronous and asynchronous.\r\n /// \r\n /// \r\n /// REVIEW: Couldn't this just be a boolean?\r\n /// \r\n internal enum VerbWorkerType\r\n {\r\n /// \r\n /// The worker runs synchronously.\r\n /// \r\n Sync,\r\n\r\n /// \r\n /// The worker runs asynchronously.\r\n /// \r\n Async\r\n }\r\n\r\n /// \r\n /// Enumeration of the ways to treat process exit codes.\r\n /// \r\n /// \r\n /// REVIEW: Couldn't this just be a boolean?\r\n /// \r\n internal enum ProcessExitCodeHandling\r\n {\r\n /// \r\n /// Treat non-zero return codes as the process reporting a failure.\r\n /// \r\n NonzeroIsFailure,\r\n\r\n /// \r\n /// Ignore non-zero return codes from the process.\r\n /// \r\n NonzeroIsOkay\r\n }\r\n\r\n /// \r\n /// Definition of the interface to Verb workers.\r\n /// \r\n /// \r\n /// The scheduler's VerbRunner component uses this interface to\r\n /// run verbs (both synchronous and asynchronous verbs).\r\n /// \r\n internal interface IVerbWorker\r\n {\r\n /// \r\n /// Indicates whether this work needs to be scheduled asynchronously.\r\n /// If it returns Sync, the runAsync method will not be called.\r\n /// \r\n /// Sync for synchronous verbs, Async otherwise.\r\n VerbWorkerType IsSync();\r\n\r\n /// \r\n /// Gets the private working directory this verb executes in.\r\n /// \r\n /// The directory this verb executes in.\r\n WorkingDirectory GetWorkingDirectory();\r\n\r\n /// \r\n /// Performs the slow, asynchronous work.\r\n /// \r\n /// \r\n /// Does not run on the main thread, so should not access caches\r\n /// (or do anything else that expects to be synchronous).\r\n /// \r\n void RunAsync();\r\n\r\n /// \r\n /// Performs the completion work for Async workers, and is called\r\n /// after the runAsync method returns. For Sync workers, it performs\r\n /// all the work not done by the getWorker call.\r\n /// \r\n /// \r\n /// This method runs synchronously on the main thread. REVIEW: Not true\r\n /// for Async workers! It runs under lock, but on separate thread.\r\n /// It can tidy up the state after async work, and store results\r\n /// in the Repository.\r\n /// This method must not return the Stale Disposition; once completed\r\n /// a verb is either Fresh or Failed.\r\n /// \r\n /// The disposition of this verb's worker's work.\r\n Disposition Complete();\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IVerificationResultParser.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal interface IVerificationResultParser\r\n {\r\n void parseOutput(\r\n string s,\r\n out int parseFailures,\r\n out int verificationFailures,\r\n out int timeouts);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IncludePathContext.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal abstract class IncludePathContext\r\n : IIncludePathContext\r\n {\r\n public abstract BuildObject search(string basename, ModPart modPart = ModPart.Ifc);\r\n\r\n public override int GetHashCode()\r\n {\r\n return ToString().GetHashCode();\r\n }\r\n\r\n public override bool Equals(object obj)\r\n {\r\n return ToString().Equals(obj.ToString());\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IronRootDirectory.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.IO;\r\n\r\n /// \r\n /// A directory tree in the local filesystem to fetch sources from.\r\n /// Used to identify and isolate accesses to things under iron root.\r\n /// \r\n internal static class IronRootDirectory\r\n {\r\n /// \r\n /// Gets the absolute path to the given build object under IronRoot.\r\n /// \r\n /// A build object.\r\n /// The absolute path to the build object.\r\n public static string PathTo(BuildObject obj)\r\n {\r\n return Path.Combine(BuildEngine.theEngine.getIronRoot(), obj.getRelativePath());\r\n }\r\n\r\n /// \r\n /// Gets the absolute path corresponding to the given relative path under IronRoot.\r\n /// \r\n /// Relative path to convert.\r\n /// The absolute path corresponding to the given relative path.\r\n public static string PathTo(string relativePath)\r\n {\r\n return Path.Combine(BuildEngine.theEngine.getIronRoot(), relativePath);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IroncladAppVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class IroncladAppVerb\r\n : Verb, IObligationsProducer\r\n {\r\n public const string TRUSTED_EXE_EXTN = \".exe\";\r\n public const string UNVERIFIED_SENTINEL_EXTENSION = \".usentinel\";\r\n private const int version = 5;\r\n\r\n ////public enum VerifyMode { Verify, NoVerify };\r\n ////public enum SymDiffMode { UseSymDiff, NoSymDiff };\r\n\r\n private SourcePath dfyroot; // REVIEW: Never used?\r\n private AbstractId abstractId;\r\n private DafnySpecVerb dafnyspecVerb;\r\n private DafnyCCVerb dafnyccVerb;\r\n private EntryStitcherVerb stitcherVerb;\r\n private VerificationResultSummaryVerb verifyResultsVerb;\r\n private LinkerVerb linkerVerb;\r\n private PoundDefines poundDefines;\r\n private VerificationRequest verificationRequest;\r\n private string appLabel;\r\n\r\n private BuildObject srcObject;\r\n private BuildObject exeObject;\r\n private BuildObject outputObject;\r\n\r\n public IroncladAppVerb(SourcePath dfyroot, TARGET target, DafnyCCVerb.FramePointerMode framePointerMode, VerificationRequest verificationRequest)\r\n {\r\n this.dfyroot = dfyroot;\r\n\r\n // TODO this is the only #define we support just yet, so I'm stuffing it in here.\r\n // We'll need to plumb more carefully when we want to add x64.\r\n if (dfyroot.getDirPath().Split(Path.DirectorySeparatorChar).Last().Equals(\"AppLoader\"))\r\n {\r\n this.poundDefines = new PoundDefines(new string[] { \"AppLoader\" });\r\n }\r\n else\r\n {\r\n this.poundDefines = PoundDefines.empty();\r\n }\r\n\r\n this.verificationRequest = verificationRequest;\r\n this.abstractId = new AbstractId(\r\n this.GetType().Name,\r\n version,\r\n dfyroot.ToString(),\r\n this.poundDefines,\r\n concrete: string.Format(\r\n \"{0},{1},{2}\",\r\n target,\r\n framePointerMode.ToString(),\r\n verificationRequest.ToString()));\r\n this.appLabel = dfyroot.getDirPath().Split(Path.DirectorySeparatorChar).Last();\r\n this.dafnyspecVerb = new DafnySpecVerb(dfyroot, this.appLabel);\r\n this.dafnyccVerb = new DafnyCCVerb(dfyroot, this.appLabel, framePointerMode);\r\n\r\n bool isLoader = dfyroot.getRelativePath().Equals(BootableAppVerb.LOADER_DFY);\r\n\r\n // NB we keep dafnyccVerb as the lowest-priority context, so that our hand-written\r\n // beat impls will override its output.\r\n IContextGeneratingVerb contextWithDafny = new ConcatContextVerb(\r\n BuildEngine.theEngine.getVerveContextVerb(this.poundDefines),\r\n new VerbOutputsContextVerb(this.dafnyspecVerb, false),\r\n new VerbOutputsContextVerb(this.dafnyccVerb, true),\r\n this.poundDefines);\r\n this.stitcherVerb = new EntryStitcherVerb(contextWithDafny, this.appLabel);\r\n IContextGeneratingVerb contextWithDafnyAndEntry = new ConcatContextVerb(\r\n new VerbOutputsContextVerb(this.stitcherVerb, false),\r\n contextWithDafny,\r\n this.poundDefines);\r\n\r\n BuildObject entryImpObj = this.stitcherVerb.getEntryImpOutput();\r\n BoogieAsmLinkVerb entryVerb = new BoogieAsmLinkVerb(contextWithDafnyAndEntry, entryImpObj);\r\n if (target == TARGET.BARE_METAL)\r\n {\r\n MasmVerb masmVerb = new MasmVerb(entryVerb);\r\n this.linkerVerb = new LinkerVerb(masmVerb, isLoader);\r\n }\r\n else if (target == TARGET.WINDOWS)\r\n { // Rewrite the asm that comes out of entryVerb before linking it\r\n AsmRewriterVerb rewriter = new AsmRewriterVerb(entryVerb);\r\n MasmVerb masmVerb = new MasmVerb(rewriter);\r\n this.linkerVerb = new WinLinkerVerb(masmVerb, isLoader);\r\n }\r\n\r\n BoogieAsmVerificationObligationListVerb bavolVerb =\r\n new BoogieAsmVerificationObligationListVerb(contextWithDafnyAndEntry, entryImpObj, verificationRequest);\r\n\r\n this.verifyResultsVerb = new VerificationResultSummaryVerb(bavolVerb);\r\n\r\n this.srcObject = this.linkerVerb.getUntrustedExe();\r\n if (verificationRequest.isComplete())\r\n {\r\n this.exeObject = dfyroot.makeOutputObject(TRUSTED_EXE_EXTN);\r\n this.outputObject = this.exeObject;\r\n }\r\n else\r\n {\r\n this.exeObject = this.srcObject;\r\n this.outputObject = dfyroot.makeVirtualObject(UNVERIFIED_SENTINEL_EXTENSION);\r\n }\r\n }\r\n\r\n public enum TARGET\r\n {\r\n BARE_METAL,\r\n WINDOWS\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n List result = new List();\r\n result.Add(this.srcObject);\r\n\r\n result.Add(this.verifyResultsVerb.getOutputFile());\r\n\r\n ddisp = DependencyDisposition.Complete;\r\n\r\n return result;\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n if (this.verificationRequest.isComplete())\r\n {\r\n // If the verification succeeded, then we convert the untrusted exe into a trusted exe (via a copy).\r\n VerificationResult vr = VerificationResult.fromXmlFile(this.verifyResultsVerb.getOutputFile());\r\n\r\n if (!vr.pass)\r\n {\r\n return new VerbSyncWorker(workingDirectory, new Failed());\r\n }\r\n\r\n File.Copy(workingDirectory.PathTo(this.srcObject), workingDirectory.PathTo(this.outputObject), true); // True => Overwrite\r\n }\r\n else\r\n {\r\n UnverifiedSentinelVirtualContents contents = new UnverifiedSentinelVirtualContents();\r\n BuildEngine.theEngine.Repository.StoreVirtual(this.outputObject, new Fresh(), contents);\r\n }\r\n\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n List result = new List();\r\n result.Add(this.dafnyccVerb);\r\n result.Add(this.stitcherVerb);\r\n result.Add(this.linkerVerb);\r\n result.Add(this.verifyResultsVerb);\r\n result.AddRange(this.verifyResultsVerb.getVerbs()); // Sleazy.\r\n return result;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { this.outputObject };\r\n }\r\n\r\n public BuildObject getObligationSet()\r\n {\r\n return this.verifyResultsVerb.getObligationSet();\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public BuildObject getExe()\r\n {\r\n return this.exeObject;\r\n }\r\n\r\n public override Presentation getPresentation()\r\n {\r\n return this.verifyResultsVerb.getPresentation();\r\n }\r\n\r\n public string getAppLabel()\r\n {\r\n return this.appLabel;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/IronfleetAppVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n /// \r\n /// Verb to build an Ironfleet application.\r\n /// This is a top-level verb.\r\n /// \r\n internal class IronfleetAppVerb : Verb, IObligationsProducer\r\n {\r\n private const int Version = 7;\r\n private const string UnverifiedExeExt = \".unverified.exe\";\r\n private const string VerifiedExeExt = \".exe\";\r\n private readonly BuildObject input;\r\n private readonly BuildObject exeOutput;\r\n private readonly List otherOutputs;\r\n private readonly AbstractId abstractId;\r\n private readonly VerificationResultSummaryVerb verifyVerb;\r\n private readonly VSSolutionVerb buildVerb;\r\n private readonly IVerb[] verbs;\r\n private List dependencies;\r\n\r\n /// \r\n /// Initializes a new instance of the IronfleetAppVerb class.\r\n /// \r\n /// Main dafny file for the application.\r\n public IronfleetAppVerb(SourcePath input, VerificationRequest verificationRequest, bool releaseBuild = false)\r\n {\r\n if (input == null)\r\n {\r\n throw new ArgumentNullException(\"input\");\r\n }\r\n\r\n this.abstractId = new AbstractId(GetType().Name, Version, input.ToString() + verificationRequest.ToString());\r\n this.input = input;\r\n this.buildVerb = new VSSolutionVerb(new SourcePath(@\"src\\IronfleetTestDriver\\IronfleetTestDriver.sln\"), input, releaseBuild);\r\n\r\n if (verificationRequest.verifyMode == VerificationRequest.VerifyMode.NoVerify)\r\n {\r\n this.exeOutput = this.input.makeOutputObject(UnverifiedExeExt);\r\n this.verifyVerb = null;\r\n this.verbs = new IVerb[] { this.buildVerb };\r\n }\r\n else\r\n {\r\n this.exeOutput = this.input.makeOutputObject(VerifiedExeExt);\r\n this.verifyVerb = new VerificationResultSummaryVerb(new DafnyVerifyTreeVerb(input));\r\n this.verbs = new IVerb[] { this.verifyVerb, this.buildVerb };\r\n }\r\n\r\n this.otherOutputs = new List();\r\n var ohs = this.buildVerb.getOutputs().ToList();\r\n ohs.RemoveAll(o => o.getExtension() == \".exe\");\r\n foreach (var o in ohs)\r\n {\r\n this.otherOutputs.Add(RelocateBuildObjectToExeDirectory(o));\r\n }\r\n }\r\n\r\n private BuildObject RelocateBuildObjectToExeDirectory(BuildObject sourceOb)\r\n {\r\n return new BuildObject(exeOutput.getDirPath() + \"\\\\\" + sourceOb.getFileName());\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n if (this.dependencies == null)\r\n {\r\n var dependencies = new List();\r\n\r\n // Select and append results returned from verb.getDependencies() to dependencies.\r\n // If the dependency disposition is ever reported as not complete, we reflect this through to the caller.\r\n dependencies.AddRange(this.verbs.SelectMany(verb => verb.getOutputs()));\r\n this.dependencies = dependencies;\r\n }\r\n\r\n Trace.Assert(this.dependencies != null);\r\n ddisp = DependencyDisposition.Complete;\r\n return this.dependencies;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return this.verbs;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n var result = new List { this.exeOutput };\r\n result.AddRange(this.otherOutputs);\r\n return result;\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n Disposition disposition = new Fresh();\r\n\r\n if (this.verifyVerb != null)\r\n {\r\n VerificationResult verificationResult = VerificationResult.fromXmlFile(this.verifyVerb.getOutputs().Single());\r\n if (!verificationResult.pass)\r\n {\r\n disposition = new Failed();\r\n }\r\n }\r\n\r\n if (!(disposition is Failed))\r\n {\r\n foreach (var o in this.buildVerb.getOutputs())\r\n {\r\n if (o.getExtension() == \".exe\")\r\n {\r\n File.Copy(workingDirectory.PathTo(o), workingDirectory.PathTo(this.exeOutput), overwrite: true);\r\n }\r\n else\r\n {\r\n var dest = this.RelocateBuildObjectToExeDirectory(o);\r\n File.Copy(\r\n workingDirectory.PathTo(o),\r\n workingDirectory.PathTo(dest),\r\n overwrite: true);\r\n }\r\n }\r\n }\r\n\r\n return new VerbSyncWorker(workingDirectory, disposition);\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n { \r\n return disposition;\r\n }\r\n\r\n public BuildObject getObligationSet()\r\n {\r\n return this.verifyVerb.getObligationSet();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/ItemCacheCloud.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Configuration;\r\n using System.Globalization;\r\n using System.IO;\r\n using Microsoft.WindowsAzure.Storage;\r\n using Microsoft.WindowsAzure.Storage.Blob;\r\n\r\n /// \r\n /// An implementation of the item cache that uses Azure blobs as the\r\n /// backing store.\r\n /// \r\n public class ItemCacheCloud : IItemCache\r\n {\r\n /// \r\n /// Azure storage account we're using.\r\n /// \r\n private readonly CloudStorageAccount storageAccount;\r\n\r\n /// \r\n /// Blob client object for working with blobs.\r\n /// \r\n private readonly CloudBlobClient blobClient;\r\n\r\n /// \r\n /// Array of blob containers corresponding to item cache containers.\r\n /// \r\n private readonly CloudBlobContainer[] cloudContainers;\r\n\r\n /// \r\n /// Initializes a new instance of the ItemCacheCloud class.\r\n /// \r\n public ItemCacheCloud()\r\n {\r\n // -\r\n // Create our CloudStorageAccount object.\r\n // REVIEW: Hard-coded connection string index \"Ironclad\".\r\n // -\r\n string connectionString = null;\r\n ConnectionStringSettings settings = ConfigurationManager.ConnectionStrings[\"Ironclad\"];\r\n if (settings != null)\r\n {\r\n connectionString = settings.ConnectionString;\r\n }\r\n\r\n if (string.IsNullOrEmpty(connectionString))\r\n {\r\n throw new ConfigurationException(\"Azure connection string missing from your NuBuild.exe.config file!\");\r\n }\r\n\r\n this.storageAccount = CloudStorageAccount.Parse(connectionString);\r\n\r\n // -\r\n // Create our CloudBlobClient object.\r\n // -\r\n this.blobClient = this.storageAccount.CreateCloudBlobClient();\r\n\r\n // -\r\n // Set up the blob storage containers.\r\n // -\r\n Array containers = Enum.GetValues(typeof(ItemCacheContainer));\r\n this.cloudContainers = new CloudBlobContainer[containers.Length];\r\n foreach (ItemCacheContainer container in containers)\r\n {\r\n CloudBlobContainer cloudContainer = this.blobClient.GetContainerReference(container.ToString().ToLower(CultureInfo.InvariantCulture));\r\n cloudContainer.CreateIfNotExists();\r\n this.cloudContainers[(int)container] = cloudContainer;\r\n }\r\n }\r\n\r\n /// \r\n /// Gets a human-readable name for this item cache implementation.\r\n /// \r\n public string Name\r\n {\r\n get { return \"Cloud\"; }\r\n }\r\n\r\n /// \r\n /// Copies the given item from the cache to a new byte array.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A byte array containing a copy of the item.\r\n public byte[] FetchItem(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n if (!cloudBlob.Exists())\r\n {\r\n return null;\r\n }\r\n\r\n using (MemoryStream memoryStream = new MemoryStream())\r\n {\r\n cloudBlob.DownloadToStream(memoryStream);\r\n return memoryStream.ToArray();\r\n }\r\n }\r\n\r\n /// \r\n /// Copies the given item from the cache to the given location in the\r\n /// local file system.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// \r\n /// Location in the local file system to copy the item.\r\n /// \r\n public void FetchItemToFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemDestinationPath)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n try\r\n {\r\n cloudBlob.DownloadToFile(localFilesystemDestinationPath, FileMode.Create);\r\n }\r\n catch (Microsoft.WindowsAzure.Storage.StorageException)\r\n {\r\n throw new ObjectMissingFromCacheException(itemHash, \"Item missing from cloud cache.\");\r\n }\r\n }\r\n\r\n /// \r\n /// Copies the given byte array to the desired cache item.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// \r\n /// Byte array containing the item.\r\n /// \r\n public void StoreItem(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n byte[] contents)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n cloudBlob.UploadFromByteArray(contents, 0, contents.Length);\r\n }\r\n\r\n /// \r\n /// Copies the given file from the local file system into the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// \r\n /// Location in the local file system from which to source the item.\r\n /// \r\n public void StoreItemFromFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemSourcePath)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n cloudBlob.UploadFromFile(localFilesystemSourcePath, FileMode.Open);\r\n }\r\n\r\n /// \r\n /// Deletes an item from the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n public void DeleteItem(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n cloudBlob.DeleteIfExists();\r\n }\r\n\r\n /// \r\n /// Gets a HashSet containing the hash keys of all the items in the\r\n /// given container.\r\n /// \r\n /// Identifier for the cache container.\r\n /// A HashSet containing the hash keys.\r\n public HashSet GetItemsInContainer(ItemCacheContainer container)\r\n {\r\n HashSet itemHashes = new HashSet();\r\n\r\n foreach (CloudBlockBlob item in this.cloudContainers[(int)container].ListBlobs(null, true))\r\n {\r\n itemHashes.Add(item.Name);\r\n }\r\n\r\n return itemHashes;\r\n }\r\n\r\n /// \r\n /// Gets the size of the item.\r\n /// Returns -1 if the item is absent.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// Size of the item in bytes, or -1 if item is absent.\r\n public long GetItemSize(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n if (cloudBlob.Exists())\r\n {\r\n return cloudBlob.Properties.Length;\r\n }\r\n\r\n return -1;\r\n }\r\n\r\n /// \r\n /// Gets the last-modified time of the item.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A DateTimeOffset containing the item's last-modified time.\r\n public DateTimeOffset? GetItemLastModifiedTime(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n if (cloudBlob.Exists())\r\n {\r\n return cloudBlob.Properties.LastModified;\r\n }\r\n\r\n return null;\r\n }\r\n\r\n /// \r\n /// Checks whether the specified item exists in the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// \r\n /// True if the specified item is in the cache, false otherwise.\r\n /// \r\n public bool ItemExists(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n CloudBlockBlob cloudBlob = this.cloudContainers[(int)container].GetBlockBlobReference(itemHash);\r\n return cloudBlob.Exists();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/ItemCacheLocal.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Threading;\r\n\r\n /// \r\n /// An implementation of the item cache that uses the local file system\r\n /// as the backing store.\r\n /// \r\n public class ItemCacheLocal : IItemCache\r\n {\r\n /// \r\n /// Array of local file system paths corresponding to item cache\r\n /// containers.\r\n /// \r\n private readonly string[] localPaths;\r\n\r\n /// \r\n /// Lock protecting local file system state from concurrent accesses.\r\n /// \r\n private object cacheLock;\r\n\r\n /// \r\n /// Initializes a new instance of the ItemCacheLocal class.\r\n /// \r\n /// \r\n /// Generates local path names corresponding to the various item cache\r\n /// containers, and creates local directories for each, if they don't\r\n /// already exit.\r\n /// \r\n /// Root of the local cache.\r\n public ItemCacheLocal(string localCacheDirectory)\r\n {\r\n // -\r\n // Set up the local \"container\" directories and paths to them.\r\n // -\r\n Array containers = Enum.GetValues(typeof(ItemCacheContainer));\r\n this.localPaths = new string[containers.Length];\r\n foreach (ItemCacheContainer container in containers)\r\n {\r\n string directory = Path.Combine(\r\n localCacheDirectory,\r\n container.ToString());\r\n\r\n this.localPaths[(int)container] = directory;\r\n Directory.CreateDirectory(directory);\r\n }\r\n\r\n this.cacheLock = new object();\r\n }\r\n\r\n /// \r\n /// Gets a human-readable name for this item cache implementation.\r\n /// \r\n public string Name\r\n {\r\n get { return \"Local\"; }\r\n }\r\n\r\n /// \r\n /// Copies the given item from the cache to a new byte array.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A byte array containing a copy of the item.\r\n public byte[] FetchItem(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n string itemPath = this.ItemPath(container, itemHash);\r\n\r\n lock (this.cacheLock)\r\n {\r\n if (!File.Exists(itemPath))\r\n {\r\n return null;\r\n }\r\n\r\n return File.ReadAllBytes(itemPath);\r\n }\r\n }\r\n\r\n /// \r\n /// Copies the given item from the cache to the given location in the\r\n /// local file system.\r\n /// \r\n /// \r\n /// This method is a performance optimization over getting a readable\r\n /// stream for the item and copying it to a local file using CopyTo().\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// \r\n /// Location in the local file system to copy the item.\r\n /// \r\n public void FetchItemToFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemDestinationPath)\r\n {\r\n lock (this.cacheLock)\r\n {\r\n try\r\n {\r\n Directory.CreateDirectory(Path.GetDirectoryName(localFilesystemDestinationPath));\r\n File.Copy(this.ItemPath(container, itemHash), localFilesystemDestinationPath, true);\r\n }\r\n catch (FileNotFoundException)\r\n {\r\n throw new ObjectMissingFromCacheException(itemHash, \"Item missing from local cache.\");\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Copies the given byte array to the desired cache item.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// \r\n /// Byte array containing the item.\r\n /// \r\n public void StoreItem(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n byte[] contents)\r\n {\r\n string itemPath = this.ItemPath(container, itemHash);\r\n lock (this.cacheLock)\r\n {\r\n File.Delete(itemPath);\r\n File.WriteAllBytes(itemPath, contents);\r\n }\r\n }\r\n\r\n /// \r\n /// Copies the given file from the local file system into the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// \r\n /// Location in the local file system from which to source the item.\r\n /// \r\n public void StoreItemFromFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemSourcePath)\r\n {\r\n string itemPath = this.ItemPath(container, itemHash);\r\n lock (this.cacheLock)\r\n {\r\n File.Delete(itemPath);\r\n File.Copy(localFilesystemSourcePath, itemPath);\r\n }\r\n }\r\n\r\n /// \r\n /// Gets a HashSet containing the hash keys of all the items in the\r\n /// given container.\r\n /// \r\n /// Identifier for the cache container.\r\n /// A HashSet containing the hash keys.\r\n public HashSet GetItemsInContainer(ItemCacheContainer container)\r\n {\r\n HashSet itemHashes = new HashSet();\r\n\r\n foreach (string filename in Directory.EnumerateFiles(this.localPaths[(int)container]))\r\n {\r\n itemHashes.Add(Path.GetFileName(filename));\r\n }\r\n\r\n return itemHashes;\r\n }\r\n\r\n /// \r\n /// Deletes an item from the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n public void DeleteItem(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n lock (this.cacheLock)\r\n {\r\n File.Delete(this.ItemPath(container, itemHash));\r\n }\r\n }\r\n\r\n /// \r\n /// Gets the size of the item.\r\n /// Returns -1 if the item is absent.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// Size of the item in bytes, or -1 if item is absent.\r\n public long GetItemSize(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n lock (this.cacheLock)\r\n {\r\n FileInfo fileInfo = new FileInfo(this.ItemPath(container, itemHash));\r\n if (fileInfo.Exists)\r\n {\r\n return fileInfo.Length;\r\n }\r\n\r\n return -1;\r\n }\r\n }\r\n\r\n /// \r\n /// Gets the last-modified time of the item.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A DateTimeOffset containing the item's last-modified time.\r\n public DateTimeOffset? GetItemLastModifiedTime(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n lock (this.cacheLock)\r\n {\r\n FileInfo fileInfo = new FileInfo(this.ItemPath(container, itemHash));\r\n if (fileInfo.Exists)\r\n {\r\n return fileInfo.CreationTimeUtc;\r\n }\r\n\r\n return null;\r\n }\r\n }\r\n\r\n /// \r\n /// Gets the local path name for the given item.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// Path for the item.\r\n private string ItemPath(ItemCacheContainer container, string itemHash)\r\n {\r\n return Path.Combine(\r\n this.localPaths[(int)container],\r\n itemHash);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/ItemCacheMultiplexer.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n /// \r\n /// An implementation of the item cache that multiplexes two other\r\n /// backing store implementations together.\r\n /// \r\n public class ItemCacheMultiplexer : IItemCache\r\n {\r\n /// \r\n /// The maximum size of items to upload to the cloud.\r\n /// \r\n private const long MaxUploadSizeThreshold = 50 * (1 << 20);\r\n\r\n /// \r\n /// The underlying local item cache implementation.\r\n /// \r\n private readonly ItemCacheLocal localCache;\r\n\r\n /// \r\n /// The underlying cloud item cache implementation.\r\n /// \r\n private readonly ItemCacheCloud cloudCache;\r\n\r\n /// \r\n /// A worker thread and queue for performing background work.\r\n /// \r\n /// \r\n /// While this is currently private to the multiplexer,\r\n /// the BackgroundWorker code is generic and could be used\r\n /// for other purposes. If that happens, we should move this\r\n /// to the main build engine.\r\n /// \r\n private readonly BackgroundWorker backgroundWorker;\r\n\r\n /// \r\n /// Initializes a new instance of the ItemCacheMultiplexer class.\r\n /// \r\n /// A local cache instance.\r\n /// A cloud cache instance.\r\n /// A background worker instance.\r\n public ItemCacheMultiplexer(\r\n ItemCacheLocal localCache,\r\n ItemCacheCloud cloudCache,\r\n BackgroundWorker backgroundWorker)\r\n {\r\n this.localCache = localCache;\r\n this.cloudCache = cloudCache;\r\n this.backgroundWorker = backgroundWorker;\r\n }\r\n\r\n /// \r\n /// Gets a human-readable name for this item cache implementation.\r\n /// \r\n public string Name\r\n {\r\n get { return \"Multiplexer\"; }\r\n }\r\n\r\n /// \r\n /// Copies the given item from the cache to a new byte array.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A byte array containing a copy of the item.\r\n public byte[] FetchItem(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n byte[] contents;\r\n\r\n contents = this.localCache.FetchItem(container, itemHash);\r\n if (contents == null)\r\n {\r\n contents = this.cloudCache.FetchItem(container, itemHash);\r\n if (contents == null)\r\n {\r\n return null;\r\n }\r\n\r\n this.localCache.StoreItem(container, itemHash, contents);\r\n }\r\n else\r\n {\r\n // -\r\n // Schedule cloud push on successful local read.\r\n // REVIEW: Is this rare optimization really worth it?\r\n // -\r\n this.QueueItemForCloudSync(container, itemHash);\r\n }\r\n\r\n return contents;\r\n }\r\n\r\n /// \r\n /// Copies the given item from the cache to the given location in the\r\n /// local file system.\r\n /// \r\n /// \r\n /// As with GetReadableStreamForItem, we first try locally and only\r\n /// go to the cloud if needed.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// \r\n /// Location in the local file system to copy the item.\r\n /// \r\n public void FetchItemToFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemDestinationPath)\r\n {\r\n try\r\n {\r\n this.localCache.FetchItemToFile(container, itemHash, localFilesystemDestinationPath);\r\n\r\n // -\r\n // Schedule cloud push on successful local read.\r\n // REVIEW: Is this rare optimization really worth it?\r\n // -\r\n this.QueueItemForCloudSync(container, itemHash);\r\n }\r\n catch (ObjectMissingFromCacheException)\r\n {\r\n // -\r\n // If it is missing locally, try to retrieve it from the cloud.\r\n // Note we stash a copy in the local cache prior to copying it\r\n // to the desired local file.\r\n // -\r\n byte[] temp = this.cloudCache.FetchItem(container, itemHash);\r\n if (temp == null)\r\n {\r\n throw new ObjectMissingFromCacheException(itemHash, \"Item missing from multiplexed cache.\");\r\n }\r\n\r\n this.localCache.StoreItem(container, itemHash, temp);\r\n this.localCache.FetchItemToFile(container, itemHash, localFilesystemDestinationPath);\r\n }\r\n }\r\n\r\n /// \r\n /// Copies the given byte array to the desired cache item.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// Byte array containing the item.\r\n public void StoreItem(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n byte[] contents)\r\n {\r\n this.localCache.StoreItem(container, itemHash, contents);\r\n this.QueueItemForCloudSync(container, itemHash);\r\n }\r\n\r\n /// \r\n /// Copies the given file from the local file system into the cache.\r\n /// \r\n /// \r\n /// Identifier for the cache container to hold the item.\r\n /// \r\n /// \r\n /// Hash key for the item.\r\n /// \r\n /// \r\n /// Location in the local file system from which to source the item.\r\n /// \r\n public void StoreItemFromFile(\r\n ItemCacheContainer container,\r\n string itemHash,\r\n string localFilesystemSourcePath)\r\n {\r\n this.localCache.StoreItemFromFile(container, itemHash, localFilesystemSourcePath);\r\n this.QueueItemForCloudSync(container, itemHash);\r\n }\r\n\r\n /// \r\n /// Deletes an item from the cache.\r\n /// \r\n /// \r\n /// Note that our cache sync code (CheckForAndOrUploadMissingItem)\r\n /// will fail if given an item to sync, and that item is subsequently\r\n /// deleted from the local cache before the sync code gets around to\r\n /// syncing it. This method is really only intended for cache\r\n /// management purposes and not for general use. If that changes,\r\n /// the cache sync code should change as well.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n public void DeleteItem(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n this.localCache.DeleteItem(container, itemHash);\r\n this.cloudCache.DeleteItem(container, itemHash);\r\n }\r\n\r\n /// \r\n /// Gets a HashSet containing the hash keys of all the items in the\r\n /// given container.\r\n /// \r\n /// Identifier for the cache container.\r\n /// A HashSet containing the hash keys.\r\n public HashSet GetItemsInContainer(ItemCacheContainer container)\r\n {\r\n // -\r\n // REVIEW: What to return here? Both caches contents? Nothing?\r\n // -\r\n return new HashSet();\r\n }\r\n\r\n /// \r\n /// Gets the size of the item.\r\n /// Returns -1 if the item is absent.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// Size of the item in bytes, or -1 if item is absent.\r\n public long GetItemSize(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n long size = this.localCache.GetItemSize(container, itemHash);\r\n if (size == -1)\r\n {\r\n size = this.cloudCache.GetItemSize(container, itemHash);\r\n }\r\n\r\n return size;\r\n }\r\n\r\n /// \r\n /// Gets the last-modified time of the item.\r\n /// \r\n /// \r\n /// Identifier for the cache container holding the item.\r\n /// \r\n /// \r\n /// Hash key for the desired item.\r\n /// \r\n /// A DateTimeOffset containing the item's last-modified time.\r\n public DateTimeOffset? GetItemLastModifiedTime(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n DateTimeOffset? modifiedTime = this.localCache.GetItemLastModifiedTime(container, itemHash);\r\n if (modifiedTime == null)\r\n {\r\n modifiedTime = this.cloudCache.GetItemLastModifiedTime(container, itemHash);\r\n }\r\n\r\n return modifiedTime;\r\n }\r\n\r\n /// \r\n /// Public API for private CheckForAndOrUploadMissingItem method.\r\n /// \r\n /// \r\n /// Identifier for the item's cache container.\r\n /// \r\n /// Hash key for the item.\r\n public void SyncItemToCloud(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n this.CheckForAndOrUploadMissingItem(container, itemHash);\r\n }\r\n\r\n /// \r\n /// Queue the given item for asynchronous cloud cache synchronization.\r\n /// \r\n /// \r\n /// Identifier for the item's cache container.\r\n /// \r\n /// Hash key for the item.\r\n private void QueueItemForCloudSync(\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n if (this.backgroundWorker != null)\r\n {\r\n this.backgroundWorker.QueueWork(this.CheckForAndOrUploadMissingItem, container, itemHash);\r\n }\r\n }\r\n\r\n /// \r\n /// Check if the given item is already present in the cloud cache,\r\n /// and if not, upload the local cache item to the cloud.\r\n /// \r\n /// \r\n /// Identifier for the item's cache container.\r\n /// \r\n /// Hash key for the item.\r\n private void CheckForAndOrUploadMissingItem(\r\n object containerObject,\r\n object itemHashObject)\r\n {\r\n ItemCacheContainer container = (ItemCacheContainer)containerObject;\r\n string itemHash = (string)itemHashObject;\r\n\r\n if (this.localCache.GetItemSize(container, itemHash) > MaxUploadSizeThreshold)\r\n {\r\n Logger.WriteLine(string.Format(\r\n \"Warning: skipping upload of {0} because it's really big. Compress?\",\r\n itemHash));\r\n return;\r\n }\r\n\r\n // -\r\n // Check if the item is already present in the cloud cache.\r\n // TODO present doesn't mean we don't want to overwrite it (eg when\r\n // replacing a Failed verification result with a succeeding one.)\r\n // -\r\n if (this.cloudCache.ItemExists(container, itemHash))\r\n {\r\n return;\r\n }\r\n\r\n // -\r\n // The item is missing from the cloud cache. Upload it.\r\n // -\r\n byte[] temp = this.localCache.FetchItem(container, itemHash);\r\n if (temp == null)\r\n {\r\n // This should never happen barring a serious logic error.\r\n throw new ObjectMissingFromCacheException(itemHash, \"Can't upload non-existant cache item!\");\r\n }\r\n\r\n this.cloudCache.StoreItem(container, itemHash, temp);\r\n }\r\n\r\n#if false\r\n /// \r\n /// A wrapper for a stream that queues up a cloud cache sync after it is\r\n /// closed.\r\n /// \r\n /// \r\n /// REVIEW: a lot of boilerplate code just to hook one call. Better way to do this?\r\n /// \r\n private class MultiplexerWrappedStream : Stream\r\n {\r\n /// \r\n /// Flag indicating whether or not Dispose has already been called.\r\n /// \r\n private bool disposed;\r\n\r\n /// \r\n /// Stream we are wrapping.\r\n /// \r\n private Stream stream;\r\n\r\n /// \r\n /// Item cache multiplexer that holds the item behind the stream.\r\n /// \r\n private ItemCacheMultiplexer multiplexer;\r\n\r\n /// \r\n /// Item cache container for the item behind the stream.\r\n /// \r\n private ItemCacheContainer container;\r\n\r\n /// \r\n /// Item cache hash for the item behind the stream.\r\n /// \r\n private string itemHash;\r\n\r\n /// \r\n /// Initializes a new instance of the MultiplexerWrappedStream\r\n /// class.\r\n /// \r\n /// A stream to wrap.\r\n /// \r\n /// The multiplexer cache instance owning item.\r\n /// \r\n /// \r\n /// The container for the item in the multiplexer cache.\r\n /// \r\n /// \r\n /// The hash for the item in the multiplexer cache.\r\n /// \r\n public MultiplexerWrappedStream(\r\n Stream stream,\r\n ItemCacheMultiplexer multiplexer,\r\n ItemCacheContainer container,\r\n string itemHash)\r\n {\r\n this.stream = stream;\r\n this.multiplexer = multiplexer;\r\n this.container = container;\r\n this.itemHash = itemHash;\r\n }\r\n\r\n /// \r\n /// Gets a value indicating whether the current steam supports\r\n /// reading.\r\n /// \r\n public override bool CanRead\r\n {\r\n get { return this.stream.CanRead; }\r\n }\r\n\r\n /// \r\n /// Gets a value indicating whether the current stream supports\r\n /// seeking.\r\n /// \r\n public override bool CanSeek\r\n {\r\n get { return this.stream.CanSeek; }\r\n }\r\n\r\n /// \r\n /// Gets a value indicating whether the current stream supports\r\n /// writing.\r\n /// \r\n public override bool CanWrite\r\n {\r\n get { return this.stream.CanWrite; }\r\n }\r\n\r\n /// \r\n /// Gets the length in bytes of the stream.\r\n /// \r\n public override long Length\r\n {\r\n get { return this.stream.Length; }\r\n }\r\n\r\n /// \r\n /// Gets or sets the position within the current stream.\r\n /// \r\n public override long Position\r\n {\r\n get\r\n {\r\n return this.stream.Position;\r\n }\r\n\r\n set\r\n {\r\n this.stream.Position = value;\r\n }\r\n }\r\n\r\n /// \r\n /// Reads a sequence of bytes from the current stream and advances\r\n /// the position within the stream by the number of bytes read.\r\n /// \r\n /// \r\n /// An array of bytes. When this method returns, the buffer\r\n /// contains the specified byte array with the values between\r\n /// offset and (offset + count - 1) replaced by the bytes read from\r\n /// the current source.\r\n /// \r\n /// \r\n /// The zero-based byte offset in buffer at which to begin storing\r\n /// the data read from the current stream.\r\n /// \r\n /// \r\n /// The maximum number of bytes to be read from the current stream.\r\n /// \r\n /// \r\n /// The total number of bytes read into the buffer. This can be\r\n /// less than the number of bytes requested if that many bytes are\r\n /// not currently available, or zero (0) if the end of the stream\r\n /// has been reached.\r\n /// \r\n public override int Read(byte[] buffer, int offset, int count)\r\n {\r\n return this.stream.Read(buffer, offset, count);\r\n }\r\n\r\n /// \r\n /// Writes a sequence of bytes to the current stream and advances\r\n /// the position within this stream by the number of bytes written.\r\n /// \r\n /// \r\n /// An array of bytes. This method copies count bytes from buffer\r\n /// to the current stream.\r\n /// \r\n /// \r\n /// The zero-based offset in buffer at which to begin copying bytes\r\n /// to the current stream.\r\n /// \r\n /// \r\n /// The number of bytes to be written to the current stream.\r\n /// \r\n public override void Write(byte[] buffer, int offset, int count)\r\n {\r\n this.stream.Write(buffer, offset, count);\r\n }\r\n\r\n /// \r\n /// Clears all buffers for this stream and causes any buffered data\r\n /// to be written to the underlying device.\r\n /// \r\n public override void Flush()\r\n {\r\n this.stream.Flush();\r\n }\r\n\r\n /// \r\n /// Sets the position within the current stream.\r\n /// \r\n /// \r\n /// A byte offset relative to the origin parameter.\r\n /// \r\n /// \r\n /// A value of type SeekOrigin indicating the reference point used\r\n /// to obtain the new position.\r\n /// \r\n /// The new position within the\r\n public override long Seek(long offset, SeekOrigin origin)\r\n {\r\n return this.stream.Seek(offset, origin);\r\n }\r\n\r\n /// \r\n /// Sets the length of the current stream.\r\n /// \r\n /// \r\n /// Desired length of the current stream in bytes.\r\n /// \r\n public override void SetLength(long value)\r\n {\r\n this.stream.SetLength(value);\r\n }\r\n\r\n /// \r\n /// Releases unmanaged and (optionally) managed resources.\r\n /// \r\n /// \r\n /// Whether or not to release managed resources.\r\n /// \r\n protected override void Dispose(bool disposing)\r\n {\r\n if (this.disposed)\r\n {\r\n return;\r\n }\r\n\r\n if (disposing)\r\n {\r\n this.stream.Dispose();\r\n this.multiplexer.QueueItemForCloudSync(this.container, this.itemHash);\r\n }\r\n\r\n this.disposed = true;\r\n base.Dispose(disposing);\r\n }\r\n }\r\n#endif\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/Job.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.ComponentModel;\r\n using System.Diagnostics;\r\n using System.Diagnostics.CodeAnalysis;\r\n using System.Globalization;\r\n using System.Runtime.InteropServices;\r\n using Microsoft.Win32.SafeHandles;\r\n\r\n /// \r\n /// Represents a Windows Job Object.\r\n /// \r\n /// \r\n /// This class is only used by ProcessInvoker, so it could be private to that class.\r\n /// \r\n [SuppressMessage(\"StyleCop.CSharp.ReadabilityRules\", \"SA1121:UseBuiltInTypeAlias\", Justification = \"UInt* is more appropriate for system programming\")]\r\n internal class Job : IDisposable\r\n {\r\n /// \r\n /// Handle to the native Windows job object.\r\n /// \r\n private SafeFileHandle jobObjectHandle;\r\n\r\n /// \r\n /// Flag indicating whether or not Dispose has already been called.\r\n /// \r\n private bool disposed;\r\n\r\n /// \r\n /// Initializes a new instance of the Job class.\r\n /// \r\n public Job()\r\n {\r\n this.jobObjectHandle = NativeMethods.CreateJobObject(IntPtr.Zero, null);\r\n if (this.jobObjectHandle.IsInvalid)\r\n {\r\n // Note that the parameterless Win32Exception constructor calls Marshal.GetLastWin32Error internally.\r\n throw new Win32Exception();\r\n }\r\n\r\n // -\r\n // Set up this job object so that any processes assigned to it will\r\n // be terminated when it is closed (since this job object will be\r\n // closed automatically when the owning process exits, all assigned\r\n // processes will also be closed when the owning process exists).\r\n // -\r\n // Note that to set the JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE flag,\r\n // the call to SetInformationJobObject must be of JobObjectInfoClass\r\n // ExtendedLimitInformation, even though the flag is in the simpler\r\n // BasicLimitInformation structure contained in the former.\r\n // -\r\n NativeMethods.JOBOBJECT_EXTENDED_LIMIT_INFORMATION info = new NativeMethods.JOBOBJECT_EXTENDED_LIMIT_INFORMATION();\r\n int infoSize = Marshal.SizeOf(typeof(NativeMethods.JOBOBJECT_EXTENDED_LIMIT_INFORMATION));\r\n\r\n info.BasicLimitInformation.LimitFlags =\r\n NativeMethods.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;\r\n\r\n IntPtr infoPtr = Marshal.AllocHGlobal(infoSize);\r\n\r\n try\r\n {\r\n Marshal.StructureToPtr(info, infoPtr, false);\r\n\r\n if (!NativeMethods.SetInformationJobObject(\r\n this.jobObjectHandle,\r\n NativeMethods.JOBOBJECTINFOCLASS.ExtendedLimitInformation,\r\n infoPtr,\r\n (UInt32)infoSize))\r\n {\r\n // Note that the parameterless Win32Exception constructor calls Marshal.GetLastWin32Error internally.\r\n throw new Win32Exception();\r\n }\r\n }\r\n finally\r\n {\r\n Marshal.FreeHGlobal(infoPtr);\r\n }\r\n }\r\n\r\n /// \r\n /// Adds the given process to the job object.\r\n /// \r\n /// Process to add.\r\n /// True if successful, false otherwise.\r\n public bool AddProcess(Process process)\r\n {\r\n return NativeMethods.AssignProcessToJobObject(this.jobObjectHandle, process.Handle);\r\n }\r\n\r\n /// \r\n /// Gets the total CPU consumed by all processes associated with this job object.\r\n /// \r\n /// Total CPU time.\r\n public TimeSpan GetCpuTime()\r\n {\r\n UInt64 totalCpuTime = 0;\r\n NativeMethods.JOBOBJECT_BASIC_ACCOUNTING_INFORMATION basicAccountingInfo;\r\n\r\n basicAccountingInfo = this.GetBasicAccountingInformation();\r\n totalCpuTime = basicAccountingInfo.TotalKernelTime + basicAccountingInfo.TotalUserTime;\r\n\r\n return new TimeSpan((long)totalCpuTime);\r\n }\r\n\r\n /// \r\n /// Terminates all processes currently associated with this job object.\r\n /// \r\n /// Exit code to be used by all processes and threads.\r\n /// True if successful, false otherwise.\r\n public bool Terminate(UInt32 exitCode)\r\n {\r\n return NativeMethods.TerminateJobObject(this.jobObjectHandle, exitCode);\r\n }\r\n\r\n /// \r\n /// Closes this Job object.\r\n /// \r\n public void Close()\r\n {\r\n this.jobObjectHandle.Close();\r\n }\r\n\r\n /// \r\n /// Releases resources.\r\n /// \r\n public void Dispose()\r\n {\r\n this.Dispose(true);\r\n GC.SuppressFinalize(this);\r\n }\r\n\r\n /// \r\n /// Releases unmanaged and (optionally) managed resources.\r\n /// \r\n /// Whether or not to release managed resources.\r\n private void Dispose(bool disposing)\r\n {\r\n if (this.disposed)\r\n {\r\n return;\r\n }\r\n\r\n if (disposing)\r\n {\r\n this.jobObjectHandle.Dispose();\r\n }\r\n\r\n this.disposed = true;\r\n }\r\n\r\n /// \r\n /// Gets a struct containing the basic accounting information for the job object.\r\n /// \r\n /// A JOBOBJECT_BASIC_ACCOUNTING_INFORMATION structure.\r\n private NativeMethods.JOBOBJECT_BASIC_ACCOUNTING_INFORMATION GetBasicAccountingInformation()\r\n {\r\n NativeMethods.JOBOBJECT_BASIC_ACCOUNTING_INFORMATION info;\r\n int infoSize = Marshal.SizeOf(typeof(NativeMethods.JOBOBJECT_BASIC_ACCOUNTING_INFORMATION));\r\n IntPtr infoPtr = Marshal.AllocHGlobal(infoSize);\r\n\r\n try\r\n {\r\n if (!NativeMethods.QueryInformationJobObject(\r\n this.jobObjectHandle,\r\n NativeMethods.JOBOBJECTINFOCLASS.BasicAccountingInformation,\r\n infoPtr,\r\n (UInt32)infoSize,\r\n IntPtr.Zero))\r\n {\r\n // Note that the parameterless Win32Exception constructor calls Marshal.GetLastWin32Error internally.\r\n throw new Win32Exception();\r\n }\r\n\r\n info = (NativeMethods.JOBOBJECT_BASIC_ACCOUNTING_INFORMATION)Marshal.PtrToStructure(infoPtr, typeof(NativeMethods.JOBOBJECT_BASIC_ACCOUNTING_INFORMATION));\r\n }\r\n finally\r\n {\r\n Marshal.FreeHGlobal(infoPtr);\r\n }\r\n\r\n return info;\r\n }\r\n\r\n /// \r\n /// Represents the native Windows API for accessing job objects.\r\n /// \r\n [SuppressMessage(\"StyleCop.CSharp.NamingRules\", \"SA1310:FieldNamesMustNotContainUnderscore\", Justification = \"Part of Windows API\")]\r\n [SuppressMessage(\"StyleCop.CSharp.DocumentationRules\", \"SA1600:ElementsMustBeDocumented\", Justification = \"Part of Windows API\")]\r\n [SuppressMessage(\"StyleCop.CSharp.DocumentationRules\", \"SA1602:EnumerationItemsMustBeDocumented\", Justification = \"Part of Windows API\")]\r\n private static class NativeMethods\r\n {\r\n public const UInt32 JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 0x2000;\r\n\r\n public enum JOBOBJECTINFOCLASS\r\n {\r\n BasicAccountingInformation = 1,\r\n BasicLimitInformation = 2,\r\n ExtendedLimitInformation = 9\r\n }\r\n\r\n [DllImport(\"kernel32.dll\", CharSet = CharSet.Unicode)]\r\n public static extern SafeFileHandle CreateJobObject(IntPtr jobAttributes, string name);\r\n\r\n [DllImport(\"kernel32.dll\")]\r\n [return: MarshalAs(UnmanagedType.Bool)]\r\n public static extern bool AssignProcessToJobObject(SafeHandle jobHandle, IntPtr processHandle);\r\n\r\n [DllImport(\"kernel32.dll\")]\r\n [return: MarshalAs(UnmanagedType.Bool)]\r\n public static extern bool SetInformationJobObject(SafeHandle jobHandle, JOBOBJECTINFOCLASS infoClass, IntPtr info, UInt32 infoLength);\r\n\r\n [DllImport(\"kernel32.dll\")]\r\n [return: MarshalAs(UnmanagedType.Bool)]\r\n public static extern bool QueryInformationJobObject(SafeHandle jobHandle, JOBOBJECTINFOCLASS infoClass, IntPtr info, UInt32 infoLength, IntPtr returnLength);\r\n\r\n [DllImport(\"kernel32.dll\")]\r\n [return: MarshalAs(UnmanagedType.Bool)]\r\n public static extern bool TerminateJobObject(SafeHandle job, UInt32 exitCode);\r\n\r\n [StructLayout(LayoutKind.Sequential, Pack = 8)]\r\n public struct JOBOBJECT_BASIC_LIMIT_INFORMATION\r\n {\r\n public UInt64 PerProcessUserTimeLimit;\r\n public UInt64 PerJobUserTimeLimit;\r\n public UInt32 LimitFlags;\r\n public UIntPtr MinimumWorkingSetSize;\r\n public UIntPtr MaximumWorkingSetSize;\r\n public UInt32 ActiveProcessLimit;\r\n public UIntPtr Affinity;\r\n public UInt32 PriorityClass;\r\n public UInt32 SchedulingClass;\r\n }\r\n\r\n [StructLayout(LayoutKind.Sequential)]\r\n public struct IO_COUNTERS\r\n {\r\n public UInt64 ReadOperationCount;\r\n public UInt64 WriteOperationCount;\r\n public UInt64 OtherOperationCount;\r\n public UInt64 ReadTransferCount;\r\n public UInt64 WriteTransferCount;\r\n public UInt64 OtherTransferCount;\r\n }\r\n\r\n [StructLayout(LayoutKind.Sequential)]\r\n public struct JOBOBJECT_EXTENDED_LIMIT_INFORMATION\r\n {\r\n public JOBOBJECT_BASIC_LIMIT_INFORMATION BasicLimitInformation;\r\n public IO_COUNTERS IoInfo;\r\n public UIntPtr ProcessMemoryLimit;\r\n public UIntPtr JobMemoryLimit;\r\n public UIntPtr PeakProcessMemoryLimit;\r\n public UIntPtr PeakJobMemoryUsed;\r\n }\r\n\r\n [StructLayout(LayoutKind.Sequential)]\r\n public struct JOBOBJECT_BASIC_ACCOUNTING_INFORMATION\r\n {\r\n public UInt64 TotalUserTime;\r\n public UInt64 TotalKernelTime;\r\n public UInt64 ThisPeriodTotalUserTime;\r\n public UInt64 ThisPeriodTotalKernelTime;\r\n public UInt32 TotalPageFaultCount;\r\n public UInt32 TotalProcesses;\r\n public UInt32 ActiveProcesses;\r\n public UInt32 TotalTerminatedProcesses;\r\n }\r\n }\r\n }\r\n}" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/LinkerVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class LinkerVerb : Verb, IProcessInvokeAsyncVerb\r\n {\r\n public const string UNTRUSTED_EXE_EXTN = \".uexe\";\r\n\r\n protected BuildObject outputObject;\r\n protected BuildObject objFile;\r\n\r\n protected long maxExeSize;\r\n protected string entryPoint;\r\n protected int baseAddr;\r\n\r\n private const int version = 4;\r\n private bool isLoader;\r\n private MasmVerb masmVerb;\r\n private AbstractId abstractId;\r\n\r\n public LinkerVerb(MasmVerb masmVerb, bool isLoader)\r\n {\r\n this.masmVerb = masmVerb;\r\n this.isLoader = isLoader;\r\n this.objFile = masmVerb.getObj();\r\n\r\n this.abstractId = new AbstractId(this.GetType().Name, version + this.getVersion(), this.objFile.ToString(), concrete: isLoader ? \"Loader\" : \"NonLoader\");\r\n this.outputObject = this.objFile.makeOutputObject(this.outputExtension());\r\n\r\n // Default settings for the apps.\r\n this.maxExeSize = 1 * 1024 * 1024; // 1 MB.\r\n this.entryPoint = \"?AppEntryPoint\";\r\n this.baseAddr = 0x340000;\r\n\r\n if (this.isLoader)\r\n {\r\n // Override the settings above with loader-specific values.\r\n this.maxExeSize = 58 * 1024; // 58 KB\r\n this.entryPoint = \"?LoaderEntryPoint\";\r\n this.baseAddr = 0x300000;\r\n }\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public BuildObject getUntrustedExe()\r\n {\r\n return this.outputObject;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n List basic = new List() { this.getLinkerExe(), this.objFile };\r\n basic.AddRange(this.getExtraDependencies());\r\n return basic;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new List() { this.masmVerb };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() { this.getUntrustedExe() }.Union(this.getExtraOutputs());\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n List args = new List() { \"/LARGEADDRESSAWARE\", \"/driver\", \"/fixed\", \"/subsystem:native\", \"/nodefaultlib\" };\r\n args.Add(this.objFile.getRelativePath());\r\n args.Add(\"/out:\" + this.outputObject.getRelativePath());\r\n args.Add(\"/entry:\" + this.entryPoint);\r\n args.Add(\"/base:\" + this.baseAddr);\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n this.getLinkerExe().getRelativePath(),\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n this.getDiagnosticsBase());\r\n }\r\n\r\n public virtual Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n if (!(disposition is Failed))\r\n {\r\n // Check that the executable isn't too large.\r\n long exeSize = new FileInfo(workingDirectory.PathTo(this.outputObject)).Length;\r\n\r\n if (exeSize > this.maxExeSize)\r\n {\r\n return new Failed(\"Executable too big\");\r\n }\r\n }\r\n\r\n return disposition;\r\n }\r\n\r\n protected virtual int getVersion()\r\n {\r\n // REVIEW: Is this right? There is a private version field in this object.\r\n return 0;\r\n }\r\n\r\n protected virtual string outputExtension()\r\n {\r\n return UNTRUSTED_EXE_EXTN;\r\n }\r\n\r\n protected virtual BuildObject getLinkerExe()\r\n {\r\n return new SourcePath(\"tools\\\\Assembler\\\\link-base.exe\", SourcePath.SourceType.Tools);\r\n }\r\n\r\n protected virtual IEnumerable getExtraDependencies()\r\n {\r\n List extraDepends = new List();\r\n\r\n extraDepends.Add(new SourcePath(\"tools\\\\Assembler\\\\mspdb80.dll\", SourcePath.SourceType.Tools));\r\n\r\n return extraDepends;\r\n }\r\n \r\n protected virtual IEnumerable getExtraOutputs()\r\n {\r\n return new List();\r\n }\r\n\r\n protected virtual bool runLinker(BuildObject asmFile, string linkerExecutable, string entryPoint, int baseAddr, long maxExeSize = -1)\r\n {\r\n return true;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/Logger.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.IO;\r\n\r\n /// \r\n /// Utility for writing log messages simultaneously to the console and\r\n /// a log file.\r\n /// \r\n internal class Logger\r\n {\r\n /// \r\n /// The log file.\r\n /// \r\n private static StreamWriter log;\r\n\r\n /// \r\n /// Writes a message to both the log file and the console.\r\n /// \r\n /// Message to write.\r\n public static void Write(string msg)\r\n {\r\n OpenLog();\r\n log.Write(msg);\r\n log.Flush();\r\n System.Console.Write(msg);\r\n }\r\n\r\n /// \r\n /// Writes a message and the newline string to both the log file\r\n /// and the console.\r\n /// \r\n /// Message to write.\r\n public static void WriteLine(string msg)\r\n {\r\n Write(msg + System.Environment.NewLine);\r\n }\r\n\r\n /// \r\n /// Opens the log file (if it isn't already open).\r\n /// \r\n private static void OpenLog()\r\n {\r\n if (log == null)\r\n {\r\n log = new StreamWriter(\"nubuild.log\");\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/MasmVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class MasmVerb : Verb, IProcessInvokeAsyncVerb\r\n {\r\n public const string MASM_EXTN = \".asm\";\r\n public const string OBJ_EXTN = \".obj\";\r\n private const int version = 4;\r\n\r\n private IAsmProducer asmVerb;\r\n private AbstractId abstractId;\r\n private BuildObject outputObject;\r\n private BuildObject asmFile;\r\n\r\n public MasmVerb(IAsmProducer asmVerb)\r\n {\r\n this.asmVerb = asmVerb;\r\n this.asmFile = asmVerb.getAsmFile();\r\n\r\n this.abstractId = new AbstractId(this.GetType().Name, version, this.asmFile.ToString());\r\n this.outputObject = this.asmFile.makeOutputObject(OBJ_EXTN);\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public BuildObject getObj()\r\n {\r\n return this.outputObject;\r\n }\r\n\r\n public BuildObject getLis()\r\n {\r\n return this.asmFile.makeOutputObject(\".lis\");\r\n }\r\n\r\n ////public BuildObject getMap() { return this.asmFile.makeOutputObject(\".map\"); }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n return new List() { this.getMasmExe(), this.asmVerb.getAsmFile() };\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new List() { this.asmVerb };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() {\r\n this.getObj(),\r\n this.getLis(),\r\n //// this.getMap()\r\n };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n List args = new List() { \"/Cp\", \"/c\", \"/Zd\", \"/Zf\", \"/Zi\" };\r\n args.Add(\"/Fo\" + this.getObj().getRelativePath());\r\n args.Add(\"/Fl\" + this.getLis().getRelativePath());\r\n ////args.Add(\"/Fm\" + getMap().getRelativePath());\r\n // TODO: \"/I$SPEC_INCLUDE_DIR\" \r\n args.Add(this.asmFile.getRelativePath());\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n this.getMasmExe().getRelativePath(),\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n this.getDiagnosticsBase());\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n return disposition;\r\n }\r\n\r\n private BuildObject getMasmExe()\r\n {\r\n return new SourcePath(\"tools\\\\Assembler\\\\ml.exe\", SourcePath.SourceType.Tools);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/NMakeVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Collections.Specialized;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class NmakeVerb\r\n : Verb, IProcessInvokeAsyncVerb\r\n {\r\n private const int version = 7;\r\n private static SourcePath nmakeExecutable;\r\n\r\n private SourcePath makefile;\r\n private CustomManifestParser customManifest;\r\n private AbstractId abstractId;\r\n private string outputPath;\r\n private string outputPathSuffix;\r\n\r\n public NmakeVerb(SourcePath makefile)\r\n {\r\n this.makefile = makefile;\r\n this.abstractId = new AbstractId(this.GetType().Name, version, this.makefile.ToString());\r\n\r\n // Generate output path.\r\n this.outputPath = \".\";\r\n int depth = this.makefile.getDirPath().Split(@\"\\/\".ToCharArray(), StringSplitOptions.RemoveEmptyEntries).Length;\r\n for (int i = 0; i < depth; i++)\r\n {\r\n this.outputPath = Path.Combine(this.outputPath, \"..\");\r\n }\r\n\r\n this.outputPathSuffix = Path.Combine(BuildEngine.theEngine.getObjRoot(), this.makefile.getDirPath());\r\n this.outputPath = Path.Combine(this.outputPath, this.outputPathSuffix);\r\n this.customManifest = new CustomManifestParser(this.makefile);\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n return this.customManifest.getDependencies().Union(new List() { getNmakeExecutable() });\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new IVerb[] { };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return from output in this.customManifest.getOutputs() select new BuildObject(Path.Combine(BuildEngine.theEngine.getObjRoot(), output.getRelativePath()));\r\n }\r\n\r\n public BuildObject getOutputPath()\r\n {\r\n return new BuildObject(this.outputPathSuffix);\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // Scrub the \"makeflags\" environment variable from our environment\r\n // so we don't pass it down to our worker process. Some users may\r\n // have things there that conflict with our usage.\r\n Process myProcess = System.Diagnostics.Process.GetCurrentProcess();\r\n StringDictionary environmentVariables = myProcess.StartInfo.EnvironmentVariables;\r\n environmentVariables.Remove(\"MAKEFLAGS\");\r\n\r\n List args = new List();\r\n args.Add(string.Format(\"OBJ={0}\\\\obj\", workingDirectory.PathTo(this.outputPathSuffix)));\r\n args.Add(string.Format(\"BIN={0}\", workingDirectory.PathTo(this.outputPathSuffix)));\r\n args.Add(\"-f\");\r\n args.Add(workingDirectory.PathTo(this.makefile));\r\n\r\n // TODO: Remove reliance on workingDirOverride, which currently hides dependency issues and other problems.\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n getNmakeExecutable().getRelativePath(), ////\"c:/Program Files (x86)/Microsoft Visual Studio 12.0/VC/bin/nmake.exe\",\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n workingDirOverride: IronRootDirectory.PathTo(this.makefile.getDirPath()),\r\n failureBase: getDiagnosticsBase(),\r\n //allowAbsoluteExe: true,\r\n allowAbsoluteArgs: true);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n return disposition;\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n private static SourcePath getNmakeExecutable()\r\n {\r\n // TODO this should eventually be a BuildObject from *building* the executable.\r\n if (nmakeExecutable == null)\r\n {\r\n nmakeExecutable = new SourcePath(\"tools\\\\nmake\\\\nmake.exe\", SourcePath.SourceType.Tools);\r\n }\r\n\r\n return nmakeExecutable;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/NuBuild.csproj", "content": "\r\n\r\n \r\n \r\n Debug\r\n AnyCPU\r\n {4D7220C0-3CAA-4659-9F16-A564DB3CCC1B}\r\n Exe\r\n Properties\r\n NuBuild\r\n NuBuild\r\n v4.5\r\n 512\r\n false\r\n publish\\\r\n true\r\n Disk\r\n false\r\n Foreground\r\n 7\r\n Days\r\n false\r\n false\r\n true\r\n 0\r\n 1.0.0.%2a\r\n false\r\n true\r\n \r\n \r\n AnyCPU\r\n true\r\n full\r\n false\r\n ..\\..\\..\\bin_tools\\NuBuild\\\r\n TRACE;DEBUG\r\n prompt\r\n 4\r\n AllRules.ruleset\r\n false\r\n \r\n \r\n AnyCPU\r\n pdbonly\r\n true\r\n bin\\Release\\\r\n TRACE\r\n prompt\r\n 4\r\n \r\n \r\n \r\n False\r\n ..\\References\\Microsoft.WindowsAzure.Storage.dll\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n False\r\n \r\n \r\n Code\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Code\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n False\r\n Microsoft .NET Framework 4.5 %28x86 and x64%29\r\n true\r\n \r\n \r\n False\r\n .NET Framework 3.5 SP1 Client Profile\r\n false\r\n \r\n \r\n False\r\n .NET Framework 3.5 SP1\r\n false\r\n \r\n \r\n \r\n \r\n CustomDictionary.xml\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/ObjectFailedException.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class ObjectFailedException : Exception\r\n {\r\n public ObjectFailedException(BuildObject obj, Failed failed)\r\n : base(obj.ToString() + \": \" + failed.ToString())\r\n {\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/ObjectMissingFromCacheException.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class ObjectMissingFromCacheException : Exception\r\n {\r\n private string itemHash;\r\n\r\n public ObjectMissingFromCacheException(string itemHash, string msg)\r\n : base(string.Format(\"item {0} missing from cache: {1}\", itemHash, msg))\r\n {\r\n this.itemHash = itemHash;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/ObjectNotReadyException.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class ObjectNotReadyException : Exception\r\n {\r\n public ObjectNotReadyException(BuildObject obj)\r\n : base(obj.ToString())\r\n {\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/OrderPreservingSet.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n /// \r\n /// Representation of an order-preserving set.\r\n /// \r\n /// \r\n /// Inspired by ICollection example at \r\n /// .\r\n /// \r\n /// Type of objects in the set.\r\n internal class OrderPreservingSet\r\n : ICollection\r\n {\r\n private readonly HashSet membership;\r\n private readonly List order;\r\n\r\n public OrderPreservingSet()\r\n : this(EqualityComparer.Default)\r\n {\r\n }\r\n\r\n public OrderPreservingSet(IEqualityComparer comparer)\r\n {\r\n this.membership = new HashSet(comparer);\r\n this.order = new List();\r\n }\r\n\r\n public OrderPreservingSet(IEnumerable initialContents)\r\n : this()\r\n {\r\n this.AddRange(initialContents);\r\n }\r\n\r\n public int Count\r\n {\r\n get { return this.membership.Count(); }\r\n }\r\n\r\n int ICollection.Count\r\n {\r\n get { return this.membership.Count; }\r\n }\r\n\r\n // TODO I don't know what this property is for.\r\n bool ICollection.IsReadOnly\r\n {\r\n get { return false; }\r\n }\r\n\r\n public void Add(T item)\r\n {\r\n if (!this.membership.Contains(item))\r\n {\r\n this.membership.Add(item);\r\n this.order.Add(item);\r\n }\r\n }\r\n\r\n void ICollection.Add(T item)\r\n {\r\n this.Add(item);\r\n }\r\n\r\n public void AddRange(IEnumerable range)\r\n {\r\n foreach (T obj in range)\r\n {\r\n this.Add(obj);\r\n }\r\n }\r\n\r\n void ICollection.Clear()\r\n {\r\n this.membership.Clear();\r\n this.order.Clear();\r\n }\r\n\r\n bool ICollection.Contains(T item)\r\n {\r\n return this.membership.Contains(item);\r\n }\r\n\r\n void ICollection.CopyTo(T[] array, int arrayIndex)\r\n {\r\n this.order.CopyTo(array, arrayIndex);\r\n }\r\n\r\n IEnumerator IEnumerable.GetEnumerator()\r\n {\r\n return this.order.GetEnumerator();\r\n }\r\n\r\n System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator()\r\n {\r\n return this.order.GetEnumerator();\r\n }\r\n\r\n bool ICollection.Remove(T item)\r\n {\r\n this.membership.Remove(item);\r\n return this.order.Remove(item);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/PathNormalizer.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.Globalization;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal class PathNormalizer\r\n {\r\n private Dictionary cache;\r\n private char[] directorySeparators;\r\n\r\n public PathNormalizer()\r\n {\r\n this.cache = new Dictionary();\r\n this.directorySeparators = new char[] { Path.DirectorySeparatorChar, Path.AltDirectorySeparatorChar };\r\n }\r\n\r\n public static string dbg_normalizePath_nocache(string requestPath, bool presumedDirectory)\r\n {\r\n return PathNormalizer.normalizePath_nocache(requestPath, presumedDirectory);\r\n }\r\n\r\n // Normalize the case of an absolute path to the case present in the filesystem.\r\n public string normalizeAbsolutePath(string absPath)\r\n {\r\n string dotdotfreepath = this.cleanDotDots(absPath);\r\n if (!Path.IsPathRooted(dotdotfreepath))\r\n {\r\n throw new ArgumentException(\"Requires absolute path\");\r\n }\r\n\r\n return this.normalizePath(dotdotfreepath, false);\r\n }\r\n\r\n private static string normalizePath_nocache(string requestPath, bool presumedDirectory)\r\n {\r\n try\r\n {\r\n string rc;\r\n string childName = Path.GetFileName(requestPath);\r\n if (string.IsNullOrEmpty(childName))\r\n {\r\n // absPath was a \"root\" (MSDOS drive letter)\r\n // by fiat, drive letters are uppercase.\r\n rc = requestPath.ToUpper(CultureInfo.InvariantCulture) + Path.DirectorySeparatorChar;\r\n }\r\n else\r\n {\r\n string parentPath = Path.GetDirectoryName(requestPath);\r\n\r\n // Recurse to handle parent prefix:\r\n string normalizedParent = normalizePath_nocache(parentPath, true);\r\n\r\n DirectoryInfo parentDirectoryInfo = new DirectoryInfo(normalizedParent);\r\n FileSystemInfo[] childrenFileSystemInfos = null;\r\n string normalizedPath;\r\n try\r\n {\r\n childrenFileSystemInfos = parentDirectoryInfo.GetFileSystemInfos(childName);\r\n }\r\n catch (System.IO.DirectoryNotFoundException)\r\n {\r\n // Fall through and assume we're to create it.\r\n }\r\n\r\n if (childrenFileSystemInfos == null || childrenFileSystemInfos.Length == 0)\r\n {\r\n // Looks like a nonexistent path. I guess the caller gets to decide the\r\n // capitalization. NB this is fraught with danger, since we're not actually\r\n // creating the path in the filesystem, so someone else might try to create\r\n // a path with a different capitalization. However, if we memorize our\r\n // results, we should end up canonicalizing to the first capitalization\r\n // we see.\r\n normalizedPath = Path.Combine(normalizedParent, childName);\r\n\r\n // Unfortunately, we can't tell whether we should add a path separator here!\r\n if (presumedDirectory)\r\n {\r\n normalizedPath += Path.DirectorySeparatorChar;\r\n }\r\n }\r\n else\r\n {\r\n FileSystemInfo childFileSystemInfo = childrenFileSystemInfos.First();\r\n\r\n // Since we passed a normalized path into DirectoryInfo, we'll get\r\n // the normalized path back out, plus the filesystem's idea of the\r\n // child name's case.\r\n normalizedPath = childFileSystemInfo.FullName;\r\n if ((childFileSystemInfo.Attributes & FileAttributes.Directory) == FileAttributes.Directory)\r\n {\r\n normalizedPath += Path.DirectorySeparatorChar;\r\n }\r\n }\r\n\r\n rc = normalizedPath;\r\n }\r\n\r\n ////Logger.WriteLine(string.Format(\"{0}\\n => {1}\", requestPath, rc));\r\n return rc;\r\n }\r\n catch (Exception ex)\r\n {\r\n Trace.TraceError(ex.Message);\r\n throw new ArgumentException(\"invalid path\");\r\n }\r\n }\r\n\r\n // Invariant: input is an absolute path, free of ..s, lowercased, with\r\n // normalized path separators.\r\n // Based on suggestions in http://stackoverflow.com/questions/1214513/normalize-directory-names-in-c-sharp.\r\n private string normalizePath(string requestPath, bool presumedDirectory)\r\n {\r\n string lowerPath = requestPath.ToLower(CultureInfo.InvariantCulture);\r\n if (this.cache.ContainsKey(lowerPath))\r\n {\r\n return this.cache[lowerPath];\r\n }\r\n\r\n string rc = PathNormalizer.normalizePath_nocache(requestPath, presumedDirectory);\r\n this.cache[lowerPath] = rc;\r\n return rc;\r\n }\r\n\r\n private string cleanDotDots(string path)\r\n {\r\n string[] parts = path.Split(this.directorySeparators);\r\n List outParts = new List();\r\n for (int i = 0; i < parts.Length; i++)\r\n {\r\n if (parts[i].Equals(string.Empty))\r\n {\r\n // Null path segment: foo//bar.\r\n continue;\r\n }\r\n else if (parts[i].Equals(\".\"))\r\n {\r\n // Semantically-null segment.\r\n continue;\r\n }\r\n else if (parts[i].Equals(\"..\"))\r\n {\r\n outParts.RemoveAt(outParts.Count() - 1);\r\n }\r\n else\r\n {\r\n outParts.Add(parts[i]);\r\n }\r\n }\r\n\r\n return string.Join(Path.DirectorySeparatorChar.ToString(), outParts.ToArray());\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/PoundDefines.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class PoundDefines\r\n {\r\n private List definedSymbols;\r\n private string descr;\r\n\r\n public PoundDefines(IEnumerable definedSymbols)\r\n {\r\n this.definedSymbols = new List(definedSymbols);\r\n this.definedSymbols.Sort();\r\n\r\n // NB the null list gets a *null* ToString, which is interpreted as no appLabel.\r\n this.descr = this.definedSymbols.Count == 0 ? null : \"#\" + string.Join(\",\", this.definedSymbols);\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return this.descr;\r\n }\r\n\r\n public string getAbstractIdString()\r\n {\r\n return this.descr == null ? string.Empty : \", \" + this.descr;\r\n }\r\n\r\n public override int GetHashCode()\r\n {\r\n return this.descr.GetHashCode();\r\n }\r\n\r\n public override bool Equals(object obj)\r\n {\r\n PoundDefines other = obj as PoundDefines;\r\n if (other != null)\r\n {\r\n return (this.descr == null && other.descr == null)\r\n || (this.descr != null && this.descr.Equals(other.descr));\r\n }\r\n else\r\n {\r\n return false;\r\n }\r\n }\r\n\r\n internal static string toAppLabel(PoundDefines poundDefines)\r\n {\r\n return poundDefines == null ? null : poundDefines.ToString();\r\n }\r\n\r\n internal static PoundDefines empty()\r\n {\r\n return new PoundDefines(new string[] { });\r\n }\r\n\r\n internal IEnumerable ToDefArgs()\r\n {\r\n List args = new List();\r\n foreach (string symbol in this.definedSymbols)\r\n {\r\n args.Add(\"-def\");\r\n args.Add(symbol);\r\n }\r\n\r\n return args;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/Presentater.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Text;\r\n\r\n /// \r\n /// TODO: Rename this (and the file) to IPresentater, or maybe IPresenter.\r\n /// REVIEW: These all just emit strings. Wouldn't a simple table suffice?\r\n /// \r\n internal interface Presentater\r\n {\r\n void startHeader();\r\n\r\n void endHeader();\r\n\r\n void startLine();\r\n\r\n void endLine();\r\n\r\n void startSpacer();\r\n\r\n void endSpacer();\r\n\r\n void startColor(string colorName);\r\n\r\n void endColor();\r\n\r\n void startBullet();\r\n\r\n void endBullet();\r\n\r\n void startPre();\r\n\r\n void endPre();\r\n\r\n void doText(string text);\r\n }\r\n\r\n public class HTMLPresentater : Presentater\r\n {\r\n private StringBuilder document;\r\n\r\n public HTMLPresentater()\r\n {\r\n this.document = new StringBuilder();\r\n this.document.Append(\"\\n\\n\");\r\n }\r\n\r\n public override string ToString()\r\n {\r\n this.document.Append(\"\\n\\n\");\r\n return this.document.ToString();\r\n }\r\n\r\n public void startHeader()\r\n {\r\n this.document.Append(\"

    \");\r\n }\r\n\r\n public void endHeader()\r\n {\r\n this.document.Append(\"

    \");\r\n }\r\n\r\n public void startLine()\r\n {\r\n this.document.Append(\"
    \");\r\n }\r\n\r\n public void endLine()\r\n {\r\n this.document.Append(\"
    \\n\");\r\n }\r\n\r\n public void startSpacer()\r\n {\r\n this.document.Append(\"

    \\n\");\r\n }\r\n\r\n public void endSpacer()\r\n {\r\n this.document.Append(\"

    \\n\");\r\n }\r\n\r\n public void startColor(string colorName)\r\n {\r\n string htmlColor;\r\n switch (colorName)\r\n {\r\n case Presentation.RED:\r\n htmlColor = \"red\";\r\n break;\r\n case Presentation.GREEN:\r\n htmlColor = \"green\";\r\n break;\r\n default: htmlColor = \"black\";\r\n break;\r\n }\r\n\r\n this.document.Append(\"\");\r\n }\r\n\r\n public void endColor()\r\n {\r\n this.document.Append(\"\");\r\n }\r\n\r\n public void startBullet()\r\n {\r\n this.document.Append(\"
  • \");\r\n }\r\n\r\n public void endBullet()\r\n {\r\n this.document.Append(\"
    • \\n\");\r\n }\r\n\r\n public void startPre()\r\n {\r\n this.document.Append(\"
    \");\r\n        }\r\n\r\n        public void endPre()\r\n        {\r\n            this.document.Append(\"
    \\n\");\r\n }\r\n\r\n public void doText(string text)\r\n {\r\n this.document.Append(text);\r\n }\r\n }\r\n\r\n /// \r\n /// Appears to be a \"Presentater\" that uses \"ANSI escape sequences\" to\r\n /// produce colored output on console terminals that support it.\r\n /// \r\n /// \r\n /// \r\n /// \"ANSI escape sequences\" is probably the most common name for these\r\n /// things, although it is technically a misnomer, as ANSI withdrew the\r\n /// ANSI X3.64 spec in 1997. The real spec is ECMA-48, aka ISO/IEC 6429.\r\n /// See     .\r\n /// \r\n /// \r\n /// Windows cmd.exe doesn't implement this spec. So only those folks\r\n /// using alternative shells will get easily-readable output from this.\r\n /// \r\n /// \r\n public class ASCIIPresentater : Presentater\r\n {\r\n // REVIEW: These don't appear to properly follow the ECMA-48 spec.\r\n // All of these commands are of type \"Select Graphic Rendition\" or SGR.\r\n // In the spec, this is covered in section 8.3.117. \r\n // The 0 code is supposed to cancel the effect of any preceding SGR,\r\n // i.e. \"\\x1b[0m\" should cancel everything. Thus the following stop\r\n // codes don't just stop what their start codes started (and are overly\r\n // verbose). A universal stop code would suffice for this usage.\r\n // Notes on codes used below:\r\n // 0 = cancel the effect of any preceding SGR.\r\n // 1 = bold.\r\n // 32 = green display (i.e. text).\r\n // 37 = white display (i.e. text).\r\n // 39 = default display (i.e. text) color.\r\n // 40 = black background.\r\n // 41 = red background.\r\n // 43 = yellow background.\r\n // 49 = default background color.\r\n private static ColorEnum Red = new ColorEnum(\"\\x1b[01;41m\", \"\\x1b[0;49m\");\r\n private static ColorEnum Green = new ColorEnum(\"\\x1b[01;32m\", \"\\x1b[0;0m\");\r\n private static ColorEnum BlackBackground = new ColorEnum(\"\\x1b[01;40m\", \"\\x1b[0;49m\");\r\n private static ColorEnum YellowBackground = new ColorEnum(\"\\x1b[01;43m\", \"\\x1b[0;49m\");\r\n private static ColorEnum BoldWhite = new ColorEnum(\"\\x1b[01;37m\", \"\\x1b[0;39m\");\r\n private static ColorEnum WhiteOnBlack = ColorEnum.join(BlackBackground, BoldWhite);\r\n private static ColorEnum Ordinary = new ColorEnum(string.Empty, string.Empty);\r\n\r\n private StringBuilder document;\r\n private ColorEnum colorEnum;\r\n\r\n public ASCIIPresentater()\r\n {\r\n this.document = new StringBuilder();\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return this.document.ToString();\r\n }\r\n\r\n public void startHeader()\r\n {\r\n this.document.Append(WhiteOnBlack.start);\r\n }\r\n\r\n public void endHeader()\r\n {\r\n this.document.Append(WhiteOnBlack.stop + \"\\n\");\r\n }\r\n\r\n public void startLine()\r\n {\r\n }\r\n\r\n public void endLine()\r\n {\r\n this.document.Append(\"\\n\");\r\n }\r\n\r\n public void startSpacer()\r\n {\r\n }\r\n\r\n public void endSpacer()\r\n {\r\n this.document.Append(\"\\n\");\r\n }\r\n\r\n public void startColor(string colorName)\r\n {\r\n Util.Assert(this.colorEnum == null);\r\n switch (colorName)\r\n {\r\n case Presentation.RED:\r\n this.colorEnum = Red;\r\n break;\r\n case Presentation.GREEN:\r\n this.colorEnum = Green;\r\n break;\r\n default:\r\n this.colorEnum = Ordinary;\r\n break;\r\n }\r\n\r\n this.document.Append(this.colorEnum.start);\r\n }\r\n\r\n public void endColor()\r\n {\r\n this.document.Append(this.colorEnum.stop);\r\n this.colorEnum = null;\r\n }\r\n\r\n public void startBullet()\r\n {\r\n this.document.Append(\" * \");\r\n }\r\n\r\n public void endBullet()\r\n {\r\n this.document.Append(\"\\n\");\r\n }\r\n\r\n public void startPre()\r\n {\r\n }\r\n\r\n public void endPre()\r\n {\r\n if (!this.document.ToString().EndsWith(\"\\n\"))\r\n {\r\n this.document.Append(\"\\n\");\r\n }\r\n }\r\n\r\n public void doText(string text)\r\n {\r\n this.document.Append(text);\r\n }\r\n\r\n /// \r\n /// Definition of the start and stop sequences for a color.\r\n /// \r\n /// \r\n /// REVIEW: This class is not needed, as there is only one stop sequence.\r\n /// \r\n private class ColorEnum\r\n {\r\n public string start;\r\n public string stop;\r\n\r\n public ColorEnum(string start, string stop)\r\n {\r\n this.start = start;\r\n this.stop = stop;\r\n }\r\n\r\n public static ColorEnum join(ColorEnum a, ColorEnum b)\r\n {\r\n return new ColorEnum(a.start + b.start, b.stop + a.stop);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/Presentation.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.IO;\r\n using System.Text;\r\n using System.Xml;\r\n\r\n internal class Presentation : XmlFiller\r\n {\r\n // Completed representation.\r\n private string xmls;\r\n\r\n public const string _xml_tag = \"Presentation\";\r\n public const string HEADER = \"Header\";\r\n public const string LINE = \"Line\";\r\n public const string SPACER = \"Spacer\";\r\n public const string COLOR = \"Color\";\r\n public const string BULLET = \"Bullet\";\r\n public const string PRE = \"Pre\";\r\n\r\n public const string RED = \"red\";\r\n public const string GREEN = \"green\";\r\n\r\n public const string _xml_ColorValue_attr = \"Value\";\r\n\r\n public Presentation(string xmls)\r\n {\r\n this.xmls = xmls;\r\n }\r\n\r\n public static Presentation fromXml(XmlReader xr)\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n using (XmlWriter xw = XmlWriter.Create(sb))\r\n {\r\n xw.WriteStartDocument();\r\n xw.WriteNode(xr, false);\r\n xw.WriteEndDocument();\r\n xw.Close();\r\n }\r\n\r\n return new Presentation(sb.ToString());\r\n }\r\n\r\n public void fillXml(XmlWriter xw)\r\n {\r\n using (XmlReader xr = XmlReader.Create(new StringReader(this.xmls)))\r\n {\r\n xr.ReadToFollowing(_xml_tag);\r\n xw.WriteNode(xr, false);\r\n }\r\n }\r\n\r\n public void format(Presentater p)\r\n {\r\n using (XmlReader xr = XmlReader.Create(new StringReader(this.xmls)))\r\n {\r\n xr.ReadToFollowing(_xml_tag);\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n switch (xr.Name)\r\n {\r\n case HEADER:\r\n p.startHeader();\r\n break;\r\n case LINE:\r\n p.startLine();\r\n break;\r\n case SPACER:\r\n p.startSpacer();\r\n break;\r\n case COLOR:\r\n p.startColor(xr.GetAttribute(_xml_ColorValue_attr));\r\n break;\r\n case BULLET:\r\n p.startBullet();\r\n break;\r\n case PRE:\r\n p.startPre();\r\n break;\r\n default:\r\n Util.Assert(false);\r\n break;\r\n }\r\n }\r\n else if (xr.NodeType == XmlNodeType.EndElement)\r\n {\r\n switch (xr.Name)\r\n {\r\n case _xml_tag:\r\n break;\r\n case HEADER:\r\n p.endHeader();\r\n break;\r\n case LINE:\r\n p.endLine();\r\n break;\r\n case SPACER:\r\n p.endSpacer();\r\n break;\r\n case COLOR:\r\n p.endColor();\r\n break;\r\n case BULLET:\r\n p.endBullet();\r\n break;\r\n case PRE:\r\n p.endPre();\r\n break;\r\n default:\r\n Util.Assert(false);\r\n break;\r\n }\r\n }\r\n else if (xr.NodeType == XmlNodeType.Text)\r\n {\r\n p.doText(xr.Value);\r\n }\r\n }\r\n }\r\n }\r\n\r\n internal static string abbreviateLines(string m)\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n int count = 0;\r\n const int limit = 20;\r\n using (StringReader sr = new StringReader(m))\r\n {\r\n string line;\r\n while ((line = sr.ReadLine()) != null)\r\n {\r\n if (count == limit)\r\n {\r\n sb.AppendLine(\"[...error messages truncated. See failure log.]\");\r\n break;\r\n }\r\n\r\n sb.AppendLine(line);\r\n count += 1;\r\n }\r\n }\r\n\r\n return sb.ToString();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/PresentationBuilder.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Text;\r\n using System.Xml;\r\n\r\n internal class PresentationBuilder\r\n {\r\n // Build-up interface.\r\n private StringBuilder sb;\r\n private XmlWriter xw;\r\n\r\n public PresentationBuilder()\r\n {\r\n this.sb = new StringBuilder();\r\n\r\n // Notice no indentation, to avoid mungling text.\r\n this.xw = XmlWriter.Create(this.sb);\r\n this.xw.WriteStartDocument();\r\n this.xw.WriteStartElement(Presentation._xml_tag);\r\n }\r\n\r\n public Presentation fix()\r\n {\r\n this.xw.WriteEndElement();\r\n this.xw.WriteEndDocument();\r\n this.xw.Close();\r\n return new Presentation(this.sb.ToString());\r\n }\r\n\r\n public void text(string s)\r\n {\r\n this.xw.WriteString(s);\r\n }\r\n\r\n public void color(string color, string s)\r\n {\r\n this.xw.WriteStartElement(Presentation.COLOR);\r\n this.xw.WriteAttributeString(Presentation._xml_ColorValue_attr, color);\r\n this.text(s);\r\n this.xw.WriteEndElement();\r\n }\r\n\r\n public void header(string s)\r\n {\r\n this.simpleTag(Presentation.HEADER, s);\r\n }\r\n\r\n public void line(string s)\r\n {\r\n this.simpleTag(Presentation.LINE, s);\r\n }\r\n\r\n public void spacer()\r\n {\r\n this.simpleTag(Presentation.SPACER, string.Empty);\r\n }\r\n\r\n public void bullet(string s)\r\n {\r\n this.simpleTag(Presentation.BULLET, s);\r\n }\r\n\r\n public void pre(string s)\r\n {\r\n this.simpleTag(Presentation.PRE, s);\r\n }\r\n\r\n public void startHeader()\r\n {\r\n this.xw.WriteStartElement(Presentation.HEADER);\r\n }\r\n\r\n public void endHeader()\r\n {\r\n this.xw.WriteEndElement();\r\n }\r\n\r\n public void startLine()\r\n {\r\n this.xw.WriteStartElement(Presentation.LINE);\r\n }\r\n\r\n public void endLine()\r\n {\r\n this.xw.WriteEndElement();\r\n }\r\n\r\n public void startBullet()\r\n {\r\n this.xw.WriteStartElement(Presentation.BULLET);\r\n }\r\n\r\n public void endBullet()\r\n {\r\n this.xw.WriteEndElement();\r\n }\r\n\r\n private void simpleTag(string tag, string s)\r\n {\r\n this.xw.WriteStartElement(tag);\r\n this.text(s);\r\n this.xw.WriteEndElement();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/ProcessInvokeAsyncWorker.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n /// \r\n /// Representation of an asynchronous verb worker.\r\n /// \r\n internal class ProcessInvokeAsyncWorker : IVerbWorker\r\n {\r\n /// \r\n /// The private working directory for this worker to work in.\r\n /// \r\n private WorkingDirectory workingDirectory;\r\n\r\n /// \r\n /// The verb whose worker this is.\r\n /// \r\n private IProcessInvokeAsyncVerb verb;\r\n\r\n /// \r\n /// The executable to run.\r\n /// \r\n private string executable;\r\n\r\n /// \r\n /// The command line arguments to provide to the executable.\r\n /// \r\n private string[] args;\r\n\r\n /// \r\n /// How to handle the exit code from running the executable.\r\n /// \r\n private ProcessExitCodeHandling exitCodeHandling;\r\n\r\n /// \r\n /// Where to (optionally) collect diagnostics.\r\n /// \r\n private BuildObject failureBase;\r\n\r\n /// \r\n /// Where to capture standard out (I think).\r\n /// \r\n private BuildObject captureStdout;\r\n\r\n /// \r\n /// Debugging text for something or another.\r\n /// \r\n private string dbgText;\r\n\r\n /// \r\n /// Whether to allow an absolute (rather than relative) file path to the executable.\r\n /// \r\n private bool allowAbsoluteExe;\r\n\r\n /// \r\n /// Whether to allow absolute (rather than relative) file paths as arguments.\r\n /// \r\n private bool allowAbsoluteArgs;\r\n\r\n /// \r\n /// The working directory to use.\r\n /// \r\n private string workingDirOverride;\r\n\r\n /// \r\n /// Whether to return the standard output from the process in the Complete call.\r\n /// \r\n private bool returnStandardOut;\r\n\r\n /// \r\n /// Whether to return the error output from the process in the Complete call.\r\n /// \r\n private bool returnStandardError;\r\n\r\n /// \r\n /// The IProcessInvoker (either a ProcessInvoker or a CloudSubmitter) instance we use to run this executable (either locally or in the cloud).\r\n /// \r\n private IProcessInvoker pinv;\r\n\r\n /// \r\n /// Whether to run the executable in the cloud.\r\n /// \r\n private bool useCloudExecution;\r\n\r\n /// \r\n /// List of input files needed by the executable.\r\n /// \r\n private List inputFiles;\r\n\r\n /// \r\n /// List of output files produced by the executable.\r\n /// \r\n private List outputFiles;\r\n\r\n /// \r\n /// Initializes a new instance of the ProcessInvokeAsyncWorker class.\r\n /// \r\n /// The private working directory for this worker to work in.\r\n /// The verb whose worker this is.\r\n /// The executable to run.\r\n /// The command line arguments to provide to the executable.\r\n /// How to handle the return code from running the executable.\r\n /// Not sure what this is -- some debugging/diagnostic thing.\r\n /// Where to capture standard out (I think).\r\n /// Debugging text for something or another.\r\n /// Whether to allow an absolute (rather than relative) file path to the executable.\r\n /// Whether to allow absolute (rather than relative) file paths as arguments.\r\n /// The working directory to use.\r\n /// Whether to return the standard output of the process.\r\n /// Whether to return the standard error output of the process.\r\n /// Whether to allow this worker to run the executable in the cloud.\r\n /// \r\n /// TODO: executable should be a BuildObject, like every other dependency.\r\n /// \r\n public ProcessInvokeAsyncWorker(\r\n WorkingDirectory workingDirectory,\r\n IProcessInvokeAsyncVerb verb,\r\n string executable,\r\n string[] args,\r\n ProcessExitCodeHandling exitCodeHandling,\r\n BuildObject failureBase,\r\n BuildObject captureStdout = null,\r\n string dbgText = null,\r\n bool allowAbsoluteExe = false,\r\n bool allowAbsoluteArgs = false,\r\n string workingDirOverride = null,\r\n bool returnStandardOut = false,\r\n bool returnStandardError = false,\r\n bool allowCloudExecution = false)\r\n {\r\n this.workingDirectory = workingDirectory;\r\n this.verb = verb;\r\n this.executable = executable;\r\n this.args = args;\r\n this.exitCodeHandling = exitCodeHandling;\r\n this.failureBase = failureBase;\r\n this.captureStdout = captureStdout;\r\n this.dbgText = dbgText;\r\n this.allowAbsoluteExe = allowAbsoluteExe;\r\n this.allowAbsoluteArgs = allowAbsoluteArgs;\r\n this.workingDirOverride = workingDirOverride;\r\n this.returnStandardOut = returnStandardOut;\r\n this.returnStandardError = returnStandardError;\r\n\r\n if (allowCloudExecution)\r\n {\r\n // Verbs cannot allow cloud execution if they allow absolute paths to exes or args.\r\n Util.Assert(!this.allowAbsoluteExe);\r\n Util.Assert(!this.allowAbsoluteArgs);\r\n Util.Assert(this.workingDirOverride == null);\r\n\r\n if (BuildEngine.theEngine.CloudExecutionQueue != null)\r\n {\r\n // We're good to go for cloud execution.\r\n this.useCloudExecution = true;\r\n\r\n // REVIEW: If there are other things we should do on the main thread prior to CloudSubmitter invocation, we should do them here.\r\n this.inputFiles = this.GetInputFiles();\r\n this.outputFiles = new List(this.verb.getOutputs());\r\n this.outputFiles.AddRange(this.verb.getFailureOutputs());\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Indicates whether this work needs to be scheduled asynchronously.\r\n /// Since this is the asynchronous implementation, always returns Async.\r\n /// \r\n /// Always returns Async.\r\n public VerbWorkerType IsSync()\r\n {\r\n return VerbWorkerType.Async;\r\n }\r\n\r\n /// \r\n /// Gets the private working directory this verb executes in.\r\n /// \r\n /// The directory this verb executes in.\r\n public WorkingDirectory GetWorkingDirectory()\r\n {\r\n return this.workingDirectory;\r\n }\r\n\r\n /// \r\n /// Performs the slow, asynchronous work.\r\n /// \r\n /// \r\n /// Does not run on the main thread, so should not access caches\r\n /// (or do anything else that expects to be synchronous).\r\n /// When this returns, the work is expected to have completed.\r\n /// \r\n public void RunAsync()\r\n {\r\n if (this.useCloudExecution)\r\n {\r\n // REVIEW: Would prefer to use the verb's input hash value as the request identifier below.\r\n this.pinv = new CloudSubmitter(\r\n Path.GetRandomFileName(),\r\n this.workingDirectory,\r\n this.inputFiles,\r\n this.outputFiles,\r\n this.executable,\r\n this.args,\r\n this.failureBase,\r\n this.captureStdout,\r\n this.dbgText);\r\n }\r\n else\r\n {\r\n this.pinv = new ProcessInvoker(\r\n this.workingDirectory,\r\n this.executable,\r\n this.args,\r\n this.failureBase,\r\n this.captureStdout,\r\n this.dbgText,\r\n this.allowAbsoluteExe,\r\n this.allowAbsoluteArgs,\r\n this.workingDirOverride);\r\n }\r\n }\r\n\r\n /// \r\n /// Performs the completion work for Async workers, and is called\r\n /// after the runAsync method returns. Returns the ultimate\r\n /// disposition of the activity.\r\n /// \r\n /// \r\n /// This method runs synchronously on the main thread.\r\n /// It can tidy up the state after async work, and store results\r\n /// in the Repository.\r\n /// Thou shalt not return Stale.\r\n /// \r\n /// The disposition of this verb's worker's work.\r\n public Disposition Complete()\r\n {\r\n this.verb.RecordProcessInvokeCpuTime(this.pinv.CpuTime);\r\n\r\n string stdout = null;\r\n if (this.returnStandardOut)\r\n {\r\n stdout = this.pinv.GetStdout();\r\n }\r\n\r\n string stderr = null;\r\n if (this.returnStandardError)\r\n {\r\n stderr = this.pinv.GetStderr();\r\n }\r\n\r\n Disposition disposition;\r\n if (this.exitCodeHandling == ProcessExitCodeHandling.NonzeroIsOkay || this.pinv.ExitCode == 0)\r\n {\r\n disposition = new Fresh();\r\n }\r\n else\r\n {\r\n // Sheesh. Some tools emit error messages to stdout.\r\n // REVIEW: Provide full command line here rather than just executable (like old version did)?\r\n Failed f = new Failed(this.pinv.GetStdout() + this.pinv.GetStderr());\r\n f.AddError(\"Executable: \" + this.executable + \"\\n\");\r\n disposition = f;\r\n }\r\n\r\n return this.verb.Complete(this.workingDirectory, this.pinv.CpuTime, stdout, stderr, disposition);\r\n }\r\n\r\n /// \r\n /// Gets the input files needed for verb execution.\r\n /// \r\n /// List of the verb's input files.\r\n private List GetInputFiles()\r\n {\r\n DependencyDisposition ddisp;\r\n List inputFiles = new List();\r\n\r\n foreach (BuildObject input in this.verb.getDependencies(out ddisp))\r\n {\r\n if (!(input is VirtualBuildObject))\r\n {\r\n inputFiles.Add(input);\r\n }\r\n }\r\n\r\n return inputFiles;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/ProcessInvoker.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Text;\r\n\r\n /// \r\n /// Represents the invoker of processes that do the work of a verb worker.\r\n /// \r\n public class ProcessInvoker : IProcessInvoker\r\n {\r\n /// \r\n /// Whether to always emit diagnostic output.\r\n /// \r\n private const bool AlwaysEmitDiagnostics = true;\r\n\r\n /// \r\n /// The CPU time used by the process, in seconds.\r\n /// \r\n private double cpuTime;\r\n\r\n /// \r\n /// The exit code returned by the process.\r\n /// \r\n private int exitCode;\r\n\r\n /// \r\n /// The stream used to collect standard out to a file (if requested).\r\n /// \r\n private StreamWriter stdoutFile;\r\n\r\n /// \r\n /// The temporary file in which to store standard out (if requested).\r\n /// \r\n private BuildObject tmpStdout;\r\n\r\n /// \r\n /// Where standard out is collected by default.\r\n /// \r\n private StringBuilder stdout;\r\n\r\n /// \r\n /// Where standard error is collected.\r\n /// \r\n private StringBuilder stderr;\r\n\r\n /// \r\n /// The private working directory for the process we invoke.\r\n /// \r\n private WorkingDirectory workingDirectory;\r\n\r\n /// \r\n /// Initializes a new instance of the ProcessInvoker class.\r\n /// \r\n /// The working directory the process is started in.\r\n /// The executable to run.\r\n /// The command line arguments to provide to the executable.\r\n /// Not sure what this is -- some debugging/diagnostic thing.\r\n /// Where to (optionally) capture standard out.\r\n /// Debugging text for something or another.\r\n /// Whether to allow an absolute (rather than relative) file path to the executable.\r\n /// Whether to allow absolute (rather than relative) file paths as arguments.\r\n /// The working directory to use.\r\n public ProcessInvoker(\r\n WorkingDirectory workingDirectory,\r\n string executable,\r\n string[] args,\r\n BuildObject failureBase,\r\n BuildObject captureStdout = null,\r\n string dbgText = null,\r\n bool allowAbsoluteExe = false,\r\n bool allowAbsoluteArgs = false,\r\n string workingDirOverride = null)\r\n {\r\n // Catch bad verb authors before they hurt themselves.\r\n Util.Assert(allowAbsoluteExe || !executable.Contains(\":\")); // Hey, this looks like an absolute path! Use .getRelativePath(); it makes your output more stable.\r\n foreach (string arg in args)\r\n {\r\n // Pardon my distasteful heuristic to avoid flagging /flag:value args.\r\n Util.Assert(allowAbsoluteArgs || arg.Length < 2 || arg[1] != ':'); // Hey, this looks like an absolute path! Use .getRelativePath() to tolerate crossing machine boundaries.\r\n }\r\n\r\n this.workingDirectory = workingDirectory;\r\n this.stdout = new StringBuilder();\r\n this.stderr = new StringBuilder();\r\n\r\n using (Job job = new Job())\r\n {\r\n using (Process proc = new Process())\r\n {\r\n if (allowAbsoluteExe)\r\n {\r\n proc.StartInfo.FileName = executable;\r\n }\r\n else\r\n {\r\n // TODO: *All* async verbs need to list their executable (and all the libs it depends upon) as dependencies.\r\n proc.StartInfo.FileName = workingDirectory.PathTo(executable);\r\n }\r\n\r\n // TODO Is there a better way to escape the args to avoid problems with spaces?\r\n proc.StartInfo.Arguments = string.Join(\" \", args);\r\n proc.StartInfo.WorkingDirectory = workingDirOverride == null ? workingDirectory.Root : workingDirOverride;\r\n proc.StartInfo.RedirectStandardOutput = true;\r\n\r\n // REVIEW: Maybe we should always capture stdout in a StringBuilder and just write it out to a file afterwards if requested?\r\n if (captureStdout != null)\r\n {\r\n this.tmpStdout = new BuildObject(captureStdout.getRelativePath() + \".tmp\");\r\n this.stdoutFile = new StreamWriter(workingDirectory.PathTo(this.tmpStdout));\r\n proc.OutputDataReceived += new DataReceivedEventHandler(this.StdoutRedirectHandler);\r\n }\r\n else\r\n {\r\n // Collect stdout here for diagnostics.\r\n proc.OutputDataReceived += new DataReceivedEventHandler(this.StdoutHandler);\r\n }\r\n\r\n proc.StartInfo.RedirectStandardError = true;\r\n proc.ErrorDataReceived += new DataReceivedEventHandler(this.StderrHandler);\r\n proc.StartInfo.UseShellExecute = false;\r\n\r\n string commandLine = proc.StartInfo.FileName + \" \" + proc.StartInfo.Arguments;\r\n if (failureBase != null && AlwaysEmitDiagnostics)\r\n {\r\n // In diagnostic mode, we emit the command line twice, once ahead in case Boogie decides\r\n // to run away and never come back.\r\n BuildObject failureBatObj = failureBase.makeOutputObject(\".bat\");\r\n workingDirectory.CreateDirectoryFor(failureBatObj);\r\n File.WriteAllText(workingDirectory.PathTo(failureBatObj), commandLine);\r\n }\r\n\r\n proc.Start();\r\n job.AddProcess(proc);\r\n proc.BeginOutputReadLine();\r\n proc.BeginErrorReadLine();\r\n proc.WaitForExit();\r\n\r\n this.cpuTime = job.GetCpuTime().TotalSeconds;\r\n\r\n this.exitCode = proc.ExitCode;\r\n if (this.stdoutFile != null)\r\n {\r\n this.stdoutFile.Close();\r\n }\r\n\r\n if (failureBase != null && AlwaysEmitDiagnostics)\r\n {\r\n workingDirectory.CreateDirectoryFor(failureBase);\r\n File.WriteAllText(workingDirectory.PathTo(failureBase.makeOutputObject(\".bat\")), commandLine);\r\n File.WriteAllText(workingDirectory.PathTo(failureBase.makeOutputObject(\".txt\")), dbgText);\r\n File.WriteAllText(workingDirectory.PathTo(failureBase.makeOutputObject(\".stdout\")), this.GetStdoutString());\r\n File.WriteAllText(workingDirectory.PathTo(failureBase.makeOutputObject(\".stderr\")), this.GetStderr());\r\n }\r\n }\r\n }\r\n\r\n // REVIEW: Add Delete, Exists and Move methods to WorkingDirectory class?\r\n if (this.tmpStdout != null && File.Exists(workingDirectory.PathTo(this.tmpStdout)))\r\n {\r\n // REVIEW: Nothing should be here. Bother with the delete?\r\n File.Delete(workingDirectory.PathTo(captureStdout));\r\n File.Move(workingDirectory.PathTo(this.tmpStdout), workingDirectory.PathTo(captureStdout));\r\n this.tmpStdout = null;\r\n }\r\n }\r\n\r\n /// \r\n /// Gets the exit code returned by the process.\r\n /// \r\n public int ExitCode\r\n {\r\n get { return this.exitCode; }\r\n }\r\n\r\n /// \r\n /// Gets the CPU time used by the process, in seconds.\r\n /// \r\n public double CpuTime\r\n {\r\n get { return this.cpuTime; }\r\n }\r\n\r\n /// \r\n /// Gets the process's standard output in the default case.\r\n /// Does not return the standard output if it is redirected to a file (i.e. if CaptureStdout is non-null).\r\n /// \r\n /// The process's standard output.\r\n public string GetStdout()\r\n {\r\n return this.stdout.ToString();\r\n }\r\n\r\n /// \r\n /// Gets the process's standard error output..\r\n /// \r\n /// The process's standard error output.\r\n public string GetStderr()\r\n {\r\n return this.stderr.ToString();\r\n }\r\n\r\n /// \r\n /// Gets the process's standard output, regardless of whether it was redirected to a file.\r\n /// \r\n /// The process's standard output.\r\n private string GetStdoutString()\r\n {\r\n if (this.tmpStdout != null)\r\n {\r\n return File.ReadAllText(this.workingDirectory.PathTo(this.tmpStdout));\r\n }\r\n else\r\n {\r\n return this.GetStdout();\r\n }\r\n }\r\n\r\n /// \r\n /// Alternate handler for the OutputDataReceived event.\r\n /// Stores the data in the previously specified file.\r\n /// \r\n /// The parameter is not used.\r\n /// Contains a line of characters read from the process's standard out.\r\n private void StdoutRedirectHandler(object sendingProcess, DataReceivedEventArgs dataLine)\r\n {\r\n this.stdoutFile.WriteLine(dataLine.Data);\r\n }\r\n\r\n /// \r\n /// Default handler for the OutputDataReceived event.\r\n /// Stores the data in a local StringBuilder instance.\r\n /// \r\n /// The parameter is not used.\r\n /// Contains a line of characters read from the process's standard out.\r\n private void StdoutHandler(object sendingProcess, DataReceivedEventArgs dataLine)\r\n {\r\n // REVIEW: Can't we use AppendLine here instead?\r\n this.stdout.Append(dataLine.Data + \"\\n\");\r\n }\r\n\r\n /// \r\n /// Handler for the ErrorDataReceived event.\r\n /// Stores the data in a local StringBuilder instance.\r\n /// \r\n /// The parameter is not used.\r\n /// Contains a line of characters read from the process's standard error.\r\n private void StderrHandler(object sendingProcess, DataReceivedEventArgs dataLine)\r\n {\r\n // REVIEW: Can't we use AppendLine here instead?\r\n this.stderr.Append(dataLine.Data + \"\\n\");\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/Program.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n\r\n internal class Program\r\n {\r\n private bool useCloudExecution;\r\n private bool useCloudCache;\r\n private BackgroundWorker backgroundWorker;\r\n private string[] args;\r\n private VerificationRequest verificationRequest = new VerificationRequest();\r\n\r\n public Program()\r\n {\r\n this.useCloudExecution = false;\r\n this.useCloudCache = true;\r\n this.backgroundWorker = new BackgroundWorker();\r\n }\r\n\r\n static void Main(string[] args)\r\n {\r\n new Program().main(args);\r\n ////DbgHashSpeedTest.thing();\r\n ////DbgFileCopySpeedTest.thing();\r\n }\r\n\r\n void usage(string msg)\r\n {\r\n Logger.WriteLine(msg);\r\n Logger.WriteLine(string.Format(\r\n \"Usage: {0} [opts] [Verb Target]*\",\r\n System.AppDomain.CurrentDomain.FriendlyName));\r\n throw new UserError(\"Invalid options\");\r\n }\r\n\r\n string ironRoot;\r\n int jobParallelism = 1;\r\n List verbs = new List();\r\n string html_output = null;\r\n IroncladAppVerb.TARGET target_platform = IroncladAppVerb.TARGET.BARE_METAL;\r\n DafnyCCVerb.FramePointerMode useFramePointer = DafnyCCVerb.FramePointerMode.NoFramePointer;\r\n\r\n private bool releaseBuild = true;\r\n\r\n int argi;\r\n\r\n string takeArg(string expectedThing)\r\n {\r\n if (argi >= args.Count())\r\n {\r\n usage(\"Expected \" + expectedThing);\r\n }\r\n\r\n string rc = args[argi];\r\n argi += 1;\r\n return rc;\r\n }\r\n\r\n SourcePath conditionSourcePath(string path)\r\n {\r\n return new SourcePath(path);\r\n }\r\n\r\n void fixIronRoot()\r\n {\r\n if (ironRoot == null)\r\n {\r\n ironRoot = getDefaultIronRoot();\r\n if (ironRoot == null)\r\n {\r\n usage(\"--ironRoot not specified and cannot infer ironRoot\");\r\n }\r\n }\r\n\r\n BuildEngine.theEngine.setIronRoot(ironRoot);\r\n }\r\n\r\n void parseArgs(string[] args)\r\n {\r\n this.args = args;\r\n argi = 0;\r\n while (argi < args.Count())\r\n {\r\n string next = takeArg(\"option or verb\"); // Should always succeed due to while condition.\r\n if (next.StartsWith(\"-\"))\r\n {\r\n if (next.Equals(\"--ironRoot\"))\r\n {\r\n if (this.ironRoot != null)\r\n {\r\n usage(\"ironRoot set after use\");\r\n }\r\n\r\n this.ironRoot = takeArg(\"value for ironRoot\");\r\n }\r\n else if (next.Equals(\"-j\") || next.Equals(\"--jobs\"))\r\n {\r\n this.jobParallelism = Int32.Parse(takeArg(\"value for jobs\"));\r\n }\r\n else if (next.Equals(\"--localcache\"))\r\n {\r\n BuildEngine.theEngine.setLocalCache(takeArg(\"path for localcache\"));\r\n }\r\n else if (next.ToLower().Equals(\"--cloudcache\"))\r\n {\r\n this.useCloudCache = true;\r\n }\r\n else if (next.ToLower().Equals(\"--no-cloudcache\"))\r\n {\r\n this.useCloudCache = false;\r\n }\r\n else if (next.Equals(\"--cloudexecution\"))\r\n {\r\n this.useCloudExecution = true;\r\n }\r\n else if (next.ToLower().Equals(\"--verify\"))\r\n {\r\n this.verificationRequest.verifyMode = VerificationRequest.VerifyMode.Verify;\r\n }\r\n else if (next.ToLower().Equals(\"--no-verify\"))\r\n {\r\n this.verificationRequest.verifyMode = VerificationRequest.VerifyMode.NoVerify;\r\n }\r\n else if (next.ToLower().Equals(\"--no-symdiff\"))\r\n {\r\n this.verificationRequest.verifyMode = VerificationRequest.VerifyMode.NoSymDiff;\r\n }\r\n else if (next.ToLower().Equals(\"--verify-select\"))\r\n {\r\n this.verificationRequest.verifyMode = VerificationRequest.VerifyMode.SelectiveVerify;\r\n this.verificationRequest.selectiveVerifyModuleNames.Add(takeArg(\"filename for selective-verify\"));\r\n }\r\n else if (next.ToLower().Equals(\"--html\"))\r\n {\r\n this.html_output = takeArg(\"filename for html report\");\r\n }\r\n else if (next.ToLower().Equals(\"--windows\"))\r\n {\r\n this.target_platform = IroncladAppVerb.TARGET.WINDOWS;\r\n }\r\n else if (next.ToLower().Equals(\"--useframepointer\"))\r\n {\r\n this.useFramePointer = DafnyCCVerb.FramePointerMode.UseFramePointer;\r\n }\r\n else if (next.ToLower().Equals(\"--debug\"))\r\n {\r\n this.releaseBuild = false;\r\n }\r\n else\r\n {\r\n usage(\"unrecognized option \" + next);\r\n }\r\n }\r\n else\r\n {\r\n string verb = next;\r\n string target = takeArg(\"verb-target\");\r\n\r\n fixIronRoot();\r\n if (verb.Equals(\"DafnyVerifyTree\"))\r\n {\r\n verbs.Add(new VerificationResultSummaryVerb(new DafnyVerifyTreeVerb(conditionSourcePath(target))));\r\n }\r\n else if (verb.Equals(\"BatchDafny\"))\r\n {\r\n if (!target.EndsWith(\".batch\"))\r\n {\r\n usage(\"Batching expects a .batch file containing a list of .dfy files\");\r\n }\r\n\r\n verbs.Add(new VerificationResultSummaryVerb(new BatchVerifyVerb(conditionSourcePath(target), BatchVerifyVerb.BatchMode.DAFNY, this.verificationRequest, useFramePointer)));\r\n }\r\n else if (verb.Equals(\"BatchApps\"))\r\n {\r\n if (!target.EndsWith(\".batch\"))\r\n {\r\n usage(\"Batching expects a .batch file containing a list of .dfy files\");\r\n }\r\n\r\n verbs.Add(new VerificationResultSummaryVerb(new BatchVerifyVerb(conditionSourcePath(target), BatchVerifyVerb.BatchMode.APP, this.verificationRequest, useFramePointer)));\r\n }\r\n else if (verb.Equals(\"Beat\"))\r\n {\r\n verbs.Add(new BeatVerb(BuildEngine.theEngine.getVerveContextVerb(PoundDefines.empty()), conditionSourcePath(target), appLabel: null));\r\n }\r\n else if (verb.Equals(\"Boogie\"))\r\n {\r\n verbs.Add(new BoogieVerb(BuildEngine.theEngine.getVerveContextVerb(PoundDefines.empty()), conditionSourcePath(target), symdiff: this.verificationRequest.getSymDiffMode()));\r\n }\r\n else if (verb.Equals(\"IroncladApp\"))\r\n {\r\n verbs.Add(new IroncladAppVerb(conditionSourcePath(target), target_platform, this.useFramePointer, this.verificationRequest));\r\n }\r\n else if (verb.Equals(\"IronfleetApp\"))\r\n {\r\n verbs.Add(new IronfleetAppVerb(conditionSourcePath(target), this.verificationRequest, this.releaseBuild));\r\n }\r\n else if (verb.Equals(\"DafnyCompileOne\"))\r\n {\r\n verbs.Add(new DafnyCompileOneVerb(conditionSourcePath(target)));\r\n }\r\n else if (verb.Equals(\"VSSolution\"))\r\n {\r\n verbs.Add(new VSSolutionVerb(new SourcePath(target, SourcePath.SourceType.Tools)));\r\n }\r\n else if (verb.Equals(\"nmake\"))\r\n {\r\n verbs.Add(new NmakeVerb(new SourcePath(target, SourcePath.SourceType.Tools)));\r\n }\r\n else if (verb.Equals(\"BootableApp\"))\r\n {\r\n verbs.Add(new BootableAppVerb(conditionSourcePath(target), this.useFramePointer, this.verificationRequest));\r\n }\r\n else\r\n {\r\n usage(\"Unknown verb \" + verb);\r\n }\r\n }\r\n }\r\n\r\n fixIronRoot();\r\n }\r\n\r\n private IItemCache GetItemCache()\r\n {\r\n string localCacheDirectory = Path.Combine(\r\n BuildEngine.theEngine.getIronRoot(),\r\n BuildEngine.theEngine.getLocalCache());\r\n\r\n if (this.useCloudCache)\r\n {\r\n try\r\n {\r\n BuildEngine.theEngine.CloudCache = new ItemCacheCloud();\r\n\r\n return new ItemCacheMultiplexer(\r\n new ItemCacheLocal(localCacheDirectory),\r\n BuildEngine.theEngine.CloudCache,\r\n this.backgroundWorker);\r\n }\r\n catch (Microsoft.WindowsAzure.Storage.StorageException)\r\n {\r\n // -\r\n // This will handle the case of being disconnected\r\n // at NuBuild launch time.\r\n // -\r\n Logger.WriteLine(\"Failed to create multiplexed cloud cache -- falling back to just local cache.\");\r\n }\r\n }\r\n\r\n return new ItemCacheLocal(localCacheDirectory);\r\n }\r\n\r\n const string IRONROOT_sentinel = \"IRONROOT.sentinel\";\r\n\r\n string getAssemblyPath()\r\n {\r\n string assyUri = System.Reflection.Assembly.GetExecutingAssembly().CodeBase;\r\n string assyPath = new Uri(assyUri).LocalPath;\r\n return assyPath;\r\n }\r\n\r\n string getDefaultIronRoot()\r\n {\r\n string exepath = Path.GetDirectoryName(getAssemblyPath());\r\n exepath = Path.GetFullPath(exepath);\r\n string[] parts = exepath.Split(new char[] { '\\\\' });\r\n for (int i = parts.Length; i > 0; i--)\r\n {\r\n string proposal = string.Join(\"\\\\\", parts.Take(i));\r\n if (File.Exists(Path.Combine(proposal, IRONROOT_sentinel)))\r\n {\r\n return proposal;\r\n }\r\n }\r\n\r\n return null;\r\n }\r\n\r\n void logNubuildInvocation(string[] args)\r\n {\r\n Logger.WriteLine(string.Format(\"{0} {1}\",\r\n getAssemblyPath(),\r\n string.Join(\" \", args)));\r\n }\r\n\r\n // NB this file is found in the default ironroot, since we\r\n // grab it before we parse your --ironroot argument.\r\n private const string NUBUILD_CONFIG = \"nubuild.config\";\r\n\r\n private IEnumerable fetchConfigArgs()\r\n {\r\n string config_path =\r\n Path.Combine(getDefaultIronRoot(), NUBUILD_CONFIG);\r\n if (!File.Exists(config_path))\r\n {\r\n return new string[] { };\r\n }\r\n\r\n List config_args = new List();\r\n foreach (string line in File.ReadAllLines(config_path))\r\n {\r\n foreach (string word in line.Trim().Split(new char[] { ' ' }))\r\n {\r\n config_args.Add(word);\r\n }\r\n }\r\n\r\n return config_args;\r\n }\r\n\r\n void main(string[] cmdline_args)\r\n {\r\n string[] all_args = fetchConfigArgs().Concat(cmdline_args).ToArray();\r\n logNubuildInvocation(all_args);\r\n try\r\n {\r\n parseArgs(all_args);\r\n }\r\n catch (UserError err)\r\n {\r\n usage(err.Message);\r\n }\r\n\r\n BuildEngine.theEngine.ItemCache = GetItemCache();\r\n BuildEngine.theEngine.Repository = new Repository(BuildEngine.theEngine.ItemCache);\r\n if (this.useCloudExecution)\r\n {\r\n if (!this.useCloudCache)\r\n {\r\n usage(\"Cloud Execution requires Cloud Cache!\");\r\n }\r\n\r\n BuildEngine.theEngine.CloudReportQueueName = Path.GetRandomFileName().Substring(0, 8);\r\n BuildEngine.theEngine.CloudExecutionQueue = new CloudExecutionQueue(BuildEngine.theEngine.CloudReportQueueName);\r\n Logger.WriteLine(\"Using cloud report queue name: \" + BuildEngine.theEngine.CloudReportQueueName);\r\n }\r\n\r\n Scheduler scheduler = new Scheduler(jobParallelism);\r\n\r\n scheduler.addTargetVerbs(verbs);\r\n\r\n ////try\r\n ////{\r\n scheduler.parallelSchedule();\r\n ////}\r\n ////catch (Exception ex)\r\n ////{\r\n //// scheduler.dbgDisplayCounts();\r\n //// throw;\r\n ////}\r\n\r\n IEnumerable targets = scheduler.getTargets();\r\n\r\n BuildObject outputTarget = null;\r\n if (targets.Count() > 0)\r\n {\r\n outputTarget = targets.First();\r\n }\r\n else\r\n {\r\n Logger.WriteLine(\"No targets requested.\");\r\n }\r\n\r\n if (targets.Count() > 1)\r\n {\r\n // TODO need a better story for relaying failure results. Right now\r\n // they get stuck in the results cache, but don't appear where we\r\n // can find them. Emit to a log, or to files in nuobj?\r\n Logger.WriteLine(\"Multiple targets build. First result follows.\");\r\n }\r\n\r\n if (outputTarget != null)\r\n {\r\n Disposition d = scheduler.getObjectDisposition(outputTarget);\r\n if (d is Fresh)\r\n {\r\n ASCIIPresentater ascii = new ASCIIPresentater();\r\n IVerb verb = scheduler.getParent(outputTarget);\r\n verb.getPresentation().format(ascii);\r\n Logger.Write(ascii.ToString());\r\n\r\n if (this.html_output != null)\r\n {\r\n HTMLPresentater html = new HTMLPresentater();\r\n verb.getPresentation().format(html);\r\n\r\n try\r\n {\r\n using (StreamWriter sw = new StreamWriter(this.html_output))\r\n {\r\n sw.Write(html.ToString());\r\n }\r\n }\r\n catch (Exception e)\r\n {\r\n Logger.WriteLine(\"Failed to write html output to file: \" + html_output);\r\n Logger.WriteLine(\"Exception was: \" + e);\r\n }\r\n }\r\n }\r\n else\r\n {\r\n Logger.WriteLine(\"Build failed.\");\r\n foreach (string msg in d.getMessages())\r\n {\r\n Logger.Write(msg);\r\n }\r\n }\r\n }\r\n else if (targets.Count() == 0)\r\n {\r\n Logger.WriteLine(\"No targets requested.\");\r\n }\r\n else\r\n {\r\n Logger.WriteLine(\"Multiple targets built. Look for results in nuobj/.\");\r\n }\r\n\r\n // -\r\n // We have to explicitly ask the BackgroundWorker thread to exit\r\n // as it will prevent the process from exiting until it does.\r\n // -\r\n this.backgroundWorker.StopWork();\r\n\r\n // -\r\n // Report what the background worker accomplished during this run.\r\n // -\r\n this.backgroundWorker.WaitForCompletion();\r\n Logger.WriteLine(string.Format(\"Background Worker completed {0} work items out of {1} queued.\",\r\n this.backgroundWorker.GetWorkItemsPerformed,\r\n this.backgroundWorker.GetWorkItemsQueued));\r\n if (this.backgroundWorker.GetWorkItemsFailed != 0)\r\n {\r\n Logger.WriteLine(string.Format(\r\n \"{0} work item procedures failed (threw an exception).\",\r\n this.backgroundWorker.GetWorkItemsFailed));\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r\n\r\n// General Information about an assembly is controlled through the following \r\n// set of attributes. Change these attribute values to modify the information\r\n// associated with an assembly.\r\n[assembly: AssemblyTitle(\"NuBuild\")]\r\n[assembly: AssemblyDescription(\"\")]\r\n[assembly: AssemblyConfiguration(\"\")]\r\n[assembly: AssemblyCompany(\"\")]\r\n[assembly: AssemblyProduct(\"NuBuild\")]\r\n[assembly: AssemblyCopyright(\"Copyright © 2014\")]\r\n[assembly: AssemblyTrademark(\"\")]\r\n[assembly: AssemblyCulture(\"\")]\r\n\r\n// Setting ComVisible to false makes the types in this assembly not visible \r\n// to COM components. If you need to access a type in this assembly from \r\n// COM, set the ComVisible attribute to true on that type.\r\n[assembly: ComVisible(false)]\r\n\r\n// The following GUID is for the ID of the typelib if this project is exposed to COM\r\n[assembly: Guid(\"1855bc44-97d2-41da-89fc-dae901580a54\")]\r\n\r\n// Version information for an assembly consists of the following four values:\r\n//\r\n// Major Version\r\n// Minor Version \r\n// Build Number\r\n// Revision\r\n//\r\n// You can specify all the values or you can default the Build and Revision Numbers \r\n// by using the '*' as shown below:\r\n// [assembly: AssemblyVersion(\"1.0.*\")]\r\n[assembly: AssemblyVersion(\"1.0.0.0\")]\r\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/Repository.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Text;\r\n\r\n /// \r\n /// Tracker of BuildObjects, in their various forms.\r\n /// For virtual build objects, also provides the content store.\r\n /// \r\n /// \r\n /// There is only one instance of this class in the system.\r\n /// This class includes functionality from the old ResultCache and\r\n /// NuObjContents classes.\r\n /// Old NuObjContents comment:\r\n /// This class keeps track of the data we've stored into nuobj/.\r\n /// The invariant is that we never read data out of nuobj/ if it's\r\n /// not data we put there ourselves this execution (perhaps by\r\n /// fetching it from the cache). Data from the cache is safe,\r\n /// because it is tracked by concreteIdentifier. But data in\r\n /// nuobj/ may be stale, leading us to build the wrong thing.\r\n /// (A wrong thing would be correctly labeled, so it won't poison\r\n /// the cache, but it wouldn't be the output the user asked for.)\r\n /// \r\n internal class Repository\r\n {\r\n /// \r\n /// Collection of information about build objects.\r\n /// \r\n private Dictionary entries;\r\n\r\n /// \r\n /// Record of the verbs for which we've already added the\r\n /// output objects resulting from their (cached) execution.\r\n /// \r\n /// \r\n /// This avoids re-adding the entire set if we ask for another object\r\n /// in the same verb's output list. Note that this ignores the hash\r\n /// value of the verb; it assumes that the hash values don't change\r\n /// across a run of this process.\r\n /// \r\n private HashSet alreadyAddedVerbs;\r\n\r\n /// \r\n /// The item cache we're using.\r\n /// \r\n private IItemCache itemCache;\r\n\r\n /// \r\n /// Initializes a new instance of the Repository class.\r\n /// \r\n /// The item cache we're using.\r\n public Repository(IItemCache itemCache)\r\n {\r\n this.itemCache = itemCache;\r\n\r\n this.entries = new Dictionary();\r\n this.alreadyAddedVerbs = new HashSet();\r\n }\r\n\r\n /// \r\n /// Reads a build object from the local filesystem and stores it in the\r\n /// cache.\r\n /// \r\n /// \r\n /// Private directory for verb execution.\r\n /// \r\n /// The build object to store in the cache.\r\n /// \r\n /// Disposition of verb which created this object (if known).\r\n /// \r\n /// A BuildObjectValuePointer describing the object.\r\n public BuildObjectValuePointer Store(WorkingDirectory workingDirectory, BuildObject obj, Disposition disposition)\r\n {\r\n string contentHash = Util.hashFilesystemPath(workingDirectory.PathTo(obj));\r\n this.itemCache.StoreItemFromFile(ItemCacheContainer.Objects, contentHash, workingDirectory.PathTo(obj));\r\n this.Add(obj, disposition, contentHash, null);\r\n\r\n return new BuildObjectValuePointer(contentHash, obj.getRelativePath());\r\n }\r\n\r\n /// \r\n /// Fetches a build object and stores it in the local filesystem.\r\n /// \r\n /// \r\n /// Directory under which to store the fetched object.\r\n /// \r\n /// The object to fetch.\r\n public void Fetch(WorkingDirectory workingDirectory, BuildObject obj)\r\n {\r\n RepositoryEntry entry = this.FetchFresh(obj);\r\n\r\n // REVIEW: best way to determine this is a source file?\r\n ItemCacheContainer container;\r\n if (obj is SourcePath)\r\n {\r\n container = ItemCacheContainer.Sources;\r\n }\r\n else\r\n {\r\n container = ItemCacheContainer.Objects;\r\n }\r\n\r\n this.itemCache.FetchItemToFile(container, entry.Hash, workingDirectory.PathTo(obj));\r\n }\r\n\r\n /// \r\n /// Gets a readable stream for the given build object contents.\r\n /// \r\n /// The object in question.\r\n /// An open, readable stream to the contents.\r\n public TextReader OpenRead(BuildObject obj)\r\n {\r\n RepositoryEntry entry = this.FetchFresh(obj);\r\n\r\n // REVIEW: best way to determine this is a source file?\r\n ItemCacheContainer container;\r\n if (obj is SourcePath)\r\n {\r\n container = ItemCacheContainer.Sources;\r\n }\r\n else\r\n {\r\n container = ItemCacheContainer.Objects;\r\n }\r\n\r\n byte[] contents = this.itemCache.FetchItem(container, entry.Hash);\r\n MemoryStream stream = new MemoryStream(contents, false);\r\n return new StreamReader(stream);\r\n }\r\n\r\n /// \r\n /// Stores a result record in the cache.\r\n /// \r\n /// \r\n /// Item cache hash key to store result under.\r\n /// \r\n /// The result record to store.\r\n public void StoreResult(string inputHash, ResultSummaryRecord result)\r\n {\r\n ItemCacheContainer container;\r\n if (result.IsVerificationTimeout || (result.Disposition is Failed))\r\n {\r\n container = ItemCacheContainer.FailedResults;\r\n }\r\n else\r\n {\r\n container = ItemCacheContainer.Results;\r\n }\r\n\r\n using (MemoryStream outStream = new MemoryStream())\r\n {\r\n using (StreamWriter outWriter = new StreamWriter(outStream))\r\n {\r\n outWriter.Write(result.ToXml());\r\n }\r\n\r\n this.itemCache.StoreItem(container, inputHash, outStream.ToArray());\r\n }\r\n }\r\n\r\n /// \r\n /// Fetches a result record from the cache.\r\n /// \r\n /// \r\n /// Item cache hash key the result is stored under.\r\n /// \r\n /// \r\n /// Whether to return cached failures as well as successes.\r\n /// \r\n /// \r\n /// The result record requested if available, otherwise returns a\r\n /// summary record with Stale disposition.\r\n /// \r\n public ResultSummaryRecord FetchResult(string inputHash, bool includeFailedResults = false)\r\n {\r\n byte[] result = this.itemCache.FetchItem(ItemCacheContainer.Results, inputHash);\r\n if ((result == null) && includeFailedResults)\r\n {\r\n result = this.itemCache.FetchItem(ItemCacheContainer.FailedResults, inputHash);\r\n }\r\n\r\n if (result != null)\r\n {\r\n MemoryStream resultStream = new MemoryStream(result);\r\n try\r\n {\r\n using (StreamReader inReader = new StreamReader(resultStream))\r\n {\r\n string xmlSummary = inReader.ReadToEnd();\r\n return ResultSummaryRecord.FromXml(xmlSummary);\r\n }\r\n }\r\n catch (System.Xml.XmlException ex)\r\n {\r\n throw new ObjectMissingFromCacheException(inputHash, \"Malformed xml: \" + ex.ToString());\r\n }\r\n finally\r\n {\r\n resultStream.Dispose();\r\n }\r\n }\r\n else\r\n {\r\n return new ResultSummaryRecord(new Stale(), new BuildObjectValuePointer[] { }, false);\r\n }\r\n }\r\n\r\n /// \r\n /// Add information about a virtual object to the Repository,\r\n /// including its contents.\r\n /// \r\n /// The object in question.\r\n /// \r\n /// Disposition of the verb which created this object.\r\n /// \r\n /// Contents of the object.\r\n public void StoreVirtual(BuildObject obj, Disposition disposition, VirtualContents contents)\r\n {\r\n Util.Assert(obj is VirtualBuildObject);\r\n this.Add(obj, disposition, null, contents);\r\n }\r\n\r\n /// \r\n /// Retrieves the virtual content referenced by the given build object.\r\n /// \r\n /// The object in question.\r\n /// The virtual contents of the object.\r\n public VirtualContents FetchVirtual(BuildObject obj)\r\n {\r\n return this.FetchFresh(obj).VirtualContents;\r\n }\r\n\r\n /// \r\n /// Gets the disposition of the verb that generated a build object.\r\n /// \r\n /// The object in question.\r\n /// Disposition of the object.\r\n public Disposition GetDisposition(BuildObject obj)\r\n {\r\n RepositoryEntry value = this.GetValue(obj);\r\n if (value != null)\r\n {\r\n return value.Disposition;\r\n }\r\n\r\n return new Stale();\r\n }\r\n\r\n /// \r\n /// Gets the hash of an object registered with this Repository.\r\n /// \r\n /// The object in question.\r\n /// \r\n /// The hash of the object (if known), otherwise null.\r\n /// \r\n public string GetHash(BuildObject obj)\r\n {\r\n string hash = null;\r\n\r\n RepositoryEntry value = this.GetValue(obj);\r\n if (value != null)\r\n {\r\n if (value.Disposition is Failed)\r\n {\r\n hash = null;\r\n }\r\n else if (obj is VirtualBuildObject)\r\n {\r\n hash = \"virtual\";\r\n }\r\n else\r\n {\r\n hash = value.Hash;\r\n }\r\n }\r\n\r\n return hash;\r\n }\r\n\r\n /// \r\n /// Adds the output objects from a cached verb execution to the\r\n /// repository, and ensures they are present in the item cache.\r\n /// \r\n /// The verb whose outputs to add.\r\n /// \r\n /// The result summary record of the verb execution.\r\n /// \r\n /// \r\n /// Call only when output objects are known to be cached\r\n /// (i.e. because FetchResult returned non-Stale).\r\n /// REVIEW: This function probably shouldn't be in this file.\r\n /// It does something similar for cached verb results that\r\n /// the scheduler's recordResult method does for new verb\r\n /// executions. Move this there and/or refactor?\r\n /// \r\n public void AddVerbResults(IVerb verb, ResultSummaryRecord resultRecord)\r\n {\r\n if (this.alreadyAddedVerbs.Contains(verb))\r\n {\r\n // We only need to add a cached verb execution's outputs once.\r\n return;\r\n }\r\n\r\n Disposition disposition = resultRecord.Disposition;\r\n\r\n // REVIEW: In the below, some of these IEnumerables should be\r\n // HashSets, and the HashSet should be a simple List.\r\n\r\n // Create a collection of the potential outputs.\r\n IEnumerable outputs = verb.getOutputs();\r\n IEnumerable failureOutputs = verb.getFailureOutputs();\r\n outputs = outputs.Concat(failureOutputs);\r\n Dictionary potentialOutputs = new Dictionary();\r\n foreach (BuildObject obj in outputs)\r\n {\r\n potentialOutputs.Add(obj.getRelativePath(), obj);\r\n }\r\n\r\n // Compare the actual outputs with the potential outputs,\r\n // and add the actual ones to the repository.\r\n HashSet recorded = new HashSet();\r\n foreach (BuildObjectValuePointer actualOutput in resultRecord.Outputs)\r\n {\r\n if (potentialOutputs.ContainsKey(actualOutput.RelativePath))\r\n {\r\n BuildObject obj = potentialOutputs[actualOutput.RelativePath];\r\n // TODO: Verify that the object exists in the item cache!\r\n this.AddObject(obj, disposition, actualOutput.ObjectHash);\r\n recorded.Add(obj);\r\n\r\n // Store a copy of this verb output as a file in the real nuobj directory.\r\n Util.Assert(actualOutput.RelativePath.StartsWith(BuildEngine.theEngine.getObjRoot(), StringComparison.Ordinal));\r\n this.itemCache.FetchItemToFile(ItemCacheContainer.Objects, actualOutput.ObjectHash, IronRootDirectory.PathTo(actualOutput.RelativePath));\r\n }\r\n else\r\n {\r\n // Complain if we find interloping outputs.\r\n throw new Exception(\"Distressing: some actual verb outputs aren't in the verb's list of potential outputs\");\r\n }\r\n }\r\n\r\n // Create a collection of missing outputs.\r\n IEnumerable unrecorded = outputs.Except(recorded).Except(failureOutputs);\r\n\r\n // For non-Failed verb runs, complain if all expected outputs don't\r\n // show up in the actual outputs.\r\n Util.Assert(unrecorded.Count() == 0 || disposition is Failed);\r\n\r\n // For cached verb runs with permanent failures (i.e. disposition\r\n // is Failed), we want to mark all of the expected outputs as Failed\r\n // even if no corresponding actual output was produced during the\r\n // failed verb run.\r\n foreach (BuildObject obj in unrecorded)\r\n {\r\n this.AddObject(obj, disposition, null);\r\n }\r\n\r\n // Remember that we've already added this verb's outputs.\r\n this.alreadyAddedVerbs.Add(verb);\r\n }\r\n\r\n /// \r\n /// Add information about an object to the Repository.\r\n /// The object path must be under the object root.\r\n /// \r\n /// The object in question.\r\n /// \r\n /// Disposition of the verb which created this object.\r\n /// \r\n /// Hash of the object's contents.\r\n public void AddObject(BuildObject obj, Disposition disposition, string hash)\r\n {\r\n Util.Assert(obj.getRelativePath().StartsWith(BuildEngine.theEngine.getObjRoot(), StringComparison.Ordinal));\r\n this.Add(obj, disposition, hash, null);\r\n }\r\n\r\n /// \r\n /// Gets the number of entries in this repository, for debugging.\r\n /// \r\n /// Number of objects recorded in this repository.\r\n internal int DbgCacheSize()\r\n {\r\n return this.entries.Count();\r\n }\r\n\r\n /// \r\n /// Fetches information about the given object in this repository.\r\n /// \r\n /// The object to fetch.\r\n /// Information about the object.\r\n private RepositoryEntry FetchFresh(BuildObject obj)\r\n {\r\n RepositoryEntry value = this.GetValue(obj);\r\n if (value == null)\r\n {\r\n throw new ObjectNotReadyException(obj);\r\n }\r\n\r\n if (value.Disposition is Failed)\r\n {\r\n throw new ObjectFailedException(obj, (Failed)value.Disposition);\r\n }\r\n\r\n Util.Assert(value.Disposition is Fresh); // This isn't really a 'not ready' condition; we shouldn't be here. REVIEW: What is meant by this comment?\r\n return value;\r\n }\r\n\r\n /// \r\n /// Gets information about an object in this repository.\r\n /// Will add missing source objects to the repository as needed.\r\n /// \r\n /// The object to look up.\r\n /// Information about the object.\r\n /// \r\n /// Returns null if obj isn't in this run's cache.\r\n /// Cannot return value.disposition==Stale, I guess?\r\n /// \r\n private RepositoryEntry GetValue(BuildObject obj)\r\n {\r\n if (this.entries.ContainsKey(obj))\r\n {\r\n return this.entries[obj];\r\n }\r\n else\r\n {\r\n SourcePath src = obj as SourcePath;\r\n if (src != null)\r\n {\r\n // Special case to get local source files into the\r\n // repository (and the item cache).\r\n // REVIEW: Should we require that source files are explicitly added?\r\n try\r\n {\r\n // Complain if someone uses tabs or non-CRLF line endings in a source file.\r\n // Visual Studio is pretty insistent on using tabs in solution (.sln) files, so we let it.\r\n if ((src.Type == SourcePath.SourceType.Src) && (src.getExtension() != \".sln\"))\r\n {\r\n if (!Util.CheckSourceFileForBadCharacters(IronRootDirectory.PathTo(obj)))\r\n {\r\n throw new SourceConfigurationError(\"Bad characters (tabs?) or non-CRLF line endings in source file \" + obj.getRelativePath());\r\n }\r\n }\r\n\r\n string hash = Util.hashFilesystemPath(IronRootDirectory.PathTo(obj));\r\n this.itemCache.StoreItemFromFile(ItemCacheContainer.Sources, hash, IronRootDirectory.PathTo(obj));\r\n this.Add(obj, new Fresh(), hash, null);\r\n }\r\n catch (IOException)\r\n {\r\n throw new SourceConfigurationError(\"Cannot find source path \" + obj.getRelativePath());\r\n }\r\n\r\n return this.entries[obj];\r\n }\r\n else\r\n {\r\n return null;\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Add information about an object to the Repository.\r\n /// \r\n /// The object to add.\r\n /// \r\n /// Disposition of the verb which created this object.\r\n /// \r\n /// Hash of the object's contents.\r\n /// Contents of the object (if virtual).\r\n private void Add(BuildObject obj, Disposition disposition, string hash, VirtualContents contents)\r\n {\r\n // Every object in the repository should either have a hash value\r\n // or virtual contents, but not both.\r\n Util.Assert((string.IsNullOrEmpty(hash) && contents != null) ||\r\n (!string.IsNullOrEmpty(hash) && (contents == null)));\r\n\r\n // Check to see if the object is already in this repository.\r\n if (this.entries.ContainsKey(obj))\r\n {\r\n // We shouldn't be adding conflicting information for\r\n // the same object during the same build run.\r\n RepositoryEntry entry = this.entries[obj];\r\n Util.Assert(entry.Disposition.GetType() == disposition.GetType());\r\n Util.Assert(entry.Hash.Equals(hash, StringComparison.Ordinal));\r\n Util.Assert(entry.VirtualContents == contents);\r\n\r\n // Don't replace existing entry with equivalent.\r\n return;\r\n }\r\n\r\n this.entries[obj] = new RepositoryEntry(disposition, hash, contents);\r\n }\r\n\r\n /// \r\n /// Information we keep about build objects in our collection.\r\n /// \r\n private class RepositoryEntry\r\n {\r\n /// \r\n /// Disposition of the verb that created this object.\r\n /// \r\n private Disposition disposition;\r\n\r\n /// \r\n /// Hash of the object's contents (if non-virtual).\r\n /// \r\n private string hash;\r\n\r\n /// \r\n /// For objects not stored in the item cache or the filesystem,\r\n /// here's the computed value.\r\n /// \r\n private VirtualContents virtualContents;\r\n\r\n /// \r\n /// Initializes a new instance of the RepositoryEntry class.\r\n /// \r\n /// \r\n /// Disposition of the verb that created this object.\r\n /// \r\n /// Hash of the object's contents.\r\n /// \r\n /// Computed value of the object (if virtual, null otherwise).\r\n /// \r\n public RepositoryEntry(Disposition disposition, string hash, VirtualContents virtualContents)\r\n {\r\n this.hash = hash;\r\n this.disposition = disposition;\r\n this.virtualContents = virtualContents;\r\n }\r\n\r\n /// \r\n /// Gets the hash of the object's contents.\r\n /// \r\n public string Hash\r\n {\r\n get { return this.hash; }\r\n }\r\n\r\n /// \r\n /// Gets the disposition of the verb that created this object.\r\n /// \r\n public Disposition Disposition\r\n {\r\n get { return this.disposition; }\r\n }\r\n\r\n /// \r\n /// Gets the computed value of the object (if a virtual object,\r\n /// returns null otherwise).\r\n /// \r\n public VirtualContents VirtualContents\r\n {\r\n get { return this.virtualContents; }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/ResultSummaryRecord.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Text;\r\n using System.Xml;\r\n\r\n /// \r\n /// Representation of the result of a particular verb's execution.\r\n /// \r\n public class ResultSummaryRecord\r\n {\r\n /// \r\n /// The XML element name for this object.\r\n /// \r\n public const string XmlTag = \"ResultSummaryRecord\";\r\n\r\n /// \r\n /// The XML attribute name for the IsVerificationTimeout value.\r\n /// \r\n public const string XmlIsVerificationTimeoutAttribute = \"IsVerificationTimeout\";\r\n\r\n /// \r\n /// The verb whose execution this is the result of.\r\n /// \r\n private IVerb verb;\r\n\r\n /// \r\n /// The disposition of the verb execution.\r\n /// \r\n private Disposition disposition;\r\n\r\n /// \r\n /// Whether this result is a rejectable failure.\r\n /// \r\n private bool isRejectableFailure;\r\n\r\n /// \r\n /// The build objects that were produced by this verb execution.\r\n /// \r\n private List outputs;\r\n\r\n /// \r\n /// Initializes a new instance of the ResultSummaryRecord class.\r\n /// \r\n /// \r\n /// The verb whose execution this is the result of.\r\n /// \r\n /// \r\n /// The disposition of the verb execution.\r\n /// \r\n /// \r\n /// The build objects that were produced by this verb execution.\r\n /// \r\n internal ResultSummaryRecord(\r\n IVerb verb,\r\n Disposition disposition,\r\n IEnumerable outputs)\r\n : this(verb, disposition, outputs, false)\r\n {\r\n }\r\n\r\n /// \r\n /// Initializes a new instance of the ResultSummaryRecord class.\r\n /// \r\n /// \r\n /// The disposition of the verb execution.\r\n /// \r\n /// \r\n /// The build objects that were produced by this verb execution.\r\n /// \r\n /// \r\n /// Whether this result is a verification timeout.\r\n /// \r\n internal ResultSummaryRecord(\r\n Disposition disposition,\r\n IEnumerable outputs,\r\n bool isVerificationTimeout)\r\n : this(null, disposition, outputs, isVerificationTimeout)\r\n {\r\n }\r\n\r\n /// \r\n /// Initializes a new instance of the ResultSummaryRecord class.\r\n /// \r\n /// \r\n /// The verb whose execution this is the result of.\r\n /// \r\n /// \r\n /// The disposition of the verb execution.\r\n /// \r\n /// \r\n /// The build objects that were produced by this verb execution.\r\n /// \r\n /// \r\n /// Whether this result is a rejectable failure.\r\n /// \r\n internal ResultSummaryRecord(\r\n IVerb verb,\r\n Disposition disposition,\r\n IEnumerable outputs,\r\n bool isRejectableFailure)\r\n {\r\n this.verb = verb;\r\n this.disposition = disposition;\r\n this.outputs = new List(outputs);\r\n this.isRejectableFailure = isRejectableFailure;\r\n\r\n IRejectable rejectableVerb = verb as IRejectable;\r\n if (rejectableVerb != null)\r\n {\r\n this.isRejectableFailure = rejectableVerb.resultWasRejectableFailure();\r\n }\r\n }\r\n\r\n /// \r\n /// Gets a value indicating whether this result is a failure of\r\n /// some sort (includes verification timeouts).\r\n /// \r\n public bool IsFailure\r\n {\r\n get { return this.isRejectableFailure || (this.disposition is Failed); }\r\n }\r\n\r\n /// \r\n /// Gets a value indicating whether this result is a verification\r\n /// timeout.\r\n /// \r\n public bool IsVerificationTimeout\r\n {\r\n get { return this.isRejectableFailure; }\r\n }\r\n\r\n /// \r\n /// Gets the build objects that were produced by this verb execution.\r\n /// \r\n public IEnumerable Outputs\r\n {\r\n get { return this.outputs; }\r\n }\r\n\r\n /// \r\n /// Gets the disposition of the verb execution.\r\n /// \r\n internal Disposition Disposition\r\n {\r\n get { return this.disposition; }\r\n }\r\n\r\n /// \r\n /// Creates a result record from an XML representation.\r\n /// \r\n /// \r\n /// A string containing an XML document representing this result record.\r\n /// \r\n /// \r\n /// A new result record corresponding to the XML representation read.\r\n /// \r\n public static ResultSummaryRecord FromXml(string xs)\r\n {\r\n XmlReader xr = XmlReader.Create(new StringReader(xs));\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n break;\r\n }\r\n }\r\n\r\n return ReadXml(xr);\r\n }\r\n\r\n /// \r\n /// Helper function to read an XML element (not a full document)\r\n /// representing a result record.\r\n /// \r\n /// \r\n /// Note that the XmlReader is expected to be positioned in the XML\r\n /// document such that the current node is a result record element.\r\n /// \r\n /// The XmlReader object to read from.\r\n /// \r\n /// A new result record corresponding to the XML representation read.\r\n /// \r\n public static ResultSummaryRecord ReadXml(XmlReader xr)\r\n {\r\n Util.Assert(xr.Name.Equals(ResultSummaryRecord.XmlTag));\r\n\r\n bool isVerificationTimeout = false;\r\n bool.TryParse(\r\n xr.GetAttribute(XmlIsVerificationTimeoutAttribute), out isVerificationTimeout);\r\n\r\n xr.ReadToFollowing(Disposition._xml_tag);\r\n Disposition d = Disposition.readXml(xr);\r\n\r\n List lbovp = new List();\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.EndElement)\r\n {\r\n Util.Assert(xr.Name.Equals(ResultSummaryRecord.XmlTag));\r\n break;\r\n }\r\n else if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n if (xr.Name.Equals(BuildObjectValuePointer.XmlTag))\r\n {\r\n lbovp.Add(BuildObjectValuePointer.ReadXml(xr));\r\n }\r\n else\r\n {\r\n throw new Exception(\"Unknown xml tag \" + xr.Name);\r\n }\r\n }\r\n }\r\n\r\n return new ResultSummaryRecord(d, lbovp, isVerificationTimeout);\r\n }\r\n\r\n /// \r\n /// Creates an XML document representing this result record.\r\n /// \r\n /// \r\n /// A string containing an XML document representing this result record.\r\n /// \r\n public string ToXml()\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n XmlWriterSettings settings = new XmlWriterSettings();\r\n settings.Indent = true;\r\n XmlWriter xw = XmlWriter.Create(sb, settings);\r\n xw.WriteStartDocument();\r\n this.WriteXml(xw);\r\n xw.Close();\r\n return sb.ToString();\r\n }\r\n\r\n /// \r\n /// Helper function to write an XML element (not a full document)\r\n /// representing this result record.\r\n /// \r\n /// The XmlWriter object to write to.\r\n public void WriteXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(XmlTag);\r\n xw.WriteAttributeString(\r\n ResultSummaryRecord.XmlIsVerificationTimeoutAttribute,\r\n this.isRejectableFailure.ToString());\r\n\r\n if (this.verb != null)\r\n {\r\n this.verb.writeTimingXml(xw);\r\n this.verb.writeDebugXml(xw);\r\n }\r\n\r\n this.disposition.writeXml(xw);\r\n\r\n foreach (BuildObjectValuePointer bovp in this.outputs)\r\n {\r\n bovp.WriteXml(xw);\r\n }\r\n\r\n xw.WriteEndElement();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/Scheduler.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Security.Cryptography;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n\r\n /// \r\n /// Mechanism for determining which verbs need to be run and in what order.\r\n /// \r\n internal class Scheduler\r\n {\r\n /// \r\n /// Whether to produce conditional debug output in the scheduler and\r\n /// some of its components.\r\n /// \r\n internal const bool Debug = false;\r\n\r\n /// \r\n /// Where to write scheduler progress information (for debugging).\r\n /// \r\n private const string DbgProgressFileName = \"nubuild.progress\";\r\n\r\n /// \r\n /// REVIEW: Not used. Remove?\r\n /// \r\n private const string DispositionFileExtension = \".disp\";\r\n\r\n /// \r\n /// The second-order verb sorter we use.\r\n /// \r\n private VerbToposorter verbToposorter;\r\n\r\n /// \r\n /// Collection of initial output targets.\r\n /// \r\n private HashSet targets;\r\n\r\n /// \r\n /// Waiting verb tracker?\r\n /// \r\n private WaitIndex waitIndex;\r\n\r\n /// \r\n /// Tracker of build objects.\r\n /// \r\n private Repository repository;\r\n\r\n /// \r\n /// The component of the scheduler that runs verbs for us.\r\n /// \r\n private VerbRunner verbRunner;\r\n\r\n /// \r\n /// Count of verbs submitted to the verbRunner for running during\r\n /// this round?\r\n /// \r\n private int submittedCount;\r\n\r\n /// \r\n /// Map of build objects to the verb that creates them.\r\n /// \r\n private Dictionary outputToVerbMap;\r\n\r\n /// \r\n /// Verbs in the outputToVerbMap.\r\n /// REVIEW: These verbs should be equivalent to those in\r\n /// outputToVerbMap.Values. Worth keeping this separate HashSet\r\n /// for performance reasons?\r\n /// \r\n private HashSet knownVerbs;\r\n\r\n /// \r\n /// Cache of verb dependencies.\r\n /// \r\n private DependencyCache depCache;\r\n\r\n /// \r\n /// Verbs that have been submitted for execution or failed,\r\n /// and need not be further considered.\r\n /// \r\n private HashSet resolvedVerbs;\r\n\r\n /// \r\n /// Verbs that have been completed, and hence can't contribute\r\n /// to resolving any pending dependencies.\r\n /// (If it's resolved and not completed, it must be submitted\r\n /// for asynchronous execution.)\r\n /// \r\n private HashSet completedVerbs;\r\n\r\n /// \r\n /// Our general strategy is to record the outcome of every verb in\r\n /// a persistent result cache, and then to evaluate each downstream\r\n /// BuildObject by querying that cache. But when one verb fails,\r\n /// it may make the downstream verb unable to even compute its input\r\n /// set, and hence its concreteIdentifier (the key to a persistent\r\n /// cache). If we don't record the outcome somehow, we'll loop\r\n /// forever trying to learn the outcome of the downstream failure.\r\n /// So we record it here in-process, keyed by abstractIdentifier\r\n /// (which is assumed to be stable over a single run of NuBuild).\r\n /// Invariant: all values in this dictionary are Faileds. (We store\r\n /// them because they might (someday) propagate information about\r\n /// what failed for an error message.)\r\n /// \r\n private Dictionary unrecordableFailures;\r\n\r\n /// \r\n /// Whether to reject cached failures, apparently.\r\n /// Value comes from a command-line argument.\r\n /// \r\n private bool rejectCachedFailures;\r\n\r\n /// \r\n /// Verbs that are (still) required to be run to build our target(s).\r\n /// Verbs are removed from this collection as they are completed.\r\n /// \r\n private HashSet requiredVerbs;\r\n\r\n /// \r\n /// Verbs to look at on next pass through parallelSchedule's main loop?\r\n /// Serves as a method for passing a collection of verbs between\r\n /// parallelSchedule and disposeCurrentVerbs.\r\n /// \r\n private HashSet nextVerbs;\r\n\r\n ////private DbgVerbCounter dbgVerbCounter = new DbgVerbCounter();\r\n\r\n /// \r\n /// Initializes a new instance of the Scheduler class.\r\n /// \r\n /// \r\n /// Degree of parallel execution to allow.\r\n /// \r\n /// \r\n /// Whether to reject cached failures.\r\n /// \r\n public Scheduler(int jobParallelism)\r\n {\r\n this.targets = new HashSet();\r\n this.waitIndex = new WaitIndex();\r\n this.repository = BuildEngine.theEngine.Repository;\r\n this.unrecordableFailures = new Dictionary();\r\n this.verbToposorter = new VerbToposorter();\r\n this.verbRunner = new VerbRunner(this.verbToposorter, jobParallelism);\r\n this.resolvedVerbs = new HashSet();\r\n this.completedVerbs = new HashSet();\r\n this.outputToVerbMap = new Dictionary();\r\n this.knownVerbs = new HashSet();\r\n this.depCache = new DependencyCache();\r\n this.rejectCachedFailures = true; // this is now permanent. The code path for caching Failure results has rotted.\r\n }\r\n\r\n /// \r\n /// Adds one or more build objects to our collection of targets.\r\n /// \r\n /// \r\n /// REVIEW: Make this private (or inline into addVerbTargets)?\r\n /// \r\n /// Build objects to add.\r\n public void addTargets(IEnumerable newTargets)\r\n {\r\n this.targets.UnionWith(newTargets);\r\n }\r\n\r\n /// \r\n /// Schedules the verbs for execution.\r\n /// This is the top-level method driving the build.\r\n /// \r\n public void parallelSchedule()\r\n {\r\n // Convert our collection of initial targets into a\r\n // collection of verbs we need to run to create them.\r\n this.requiredVerbs = new HashSet();\r\n foreach (BuildObject target in this.targets)\r\n {\r\n this.requiredVerbs.Add(this.getParent(target));\r\n }\r\n\r\n // The set of verbs we're evaluating now.\r\n HashSet currentVerbs = new HashSet(this.requiredVerbs);\r\n\r\n // A set into which we accumulate verbs to evaluate on the next pass.\r\n this.nextVerbs = new HashSet();\r\n\r\n // Loop until we've run all the verbs we need to run.\r\n while (this.requiredVerbs.Count() > 0)\r\n {\r\n this.disposeCurrentVerbs(currentVerbs);\r\n currentVerbs = null; // Just to be obvious.\r\n\r\n // Okay, now we wait around for some deps to finish, freeing up new targets.\r\n while (this.nextVerbs.Count() == 0 && this.requiredVerbs.Count() > 0)\r\n {\r\n this.Say(string.Format(\"scheduler waits, having submitted {0} verbs\", this.submittedCount));\r\n ////Util.Assert(submittedCount > 0); // False because we might be waiting for other stuff to complete.\r\n\r\n List taskCompletions;\r\n taskCompletions = this.verbRunner.scheduleAndWait(this);\r\n this.Say(\"received \" + taskCompletions.Count() + \" taskCompletions\");\r\n\r\n Util.Assert(this.requiredVerbs.Count() == 0 || taskCompletions.Count() > 0);\r\n this.processTaskCompletions(taskCompletions);\r\n\r\n currentVerbs = this.nextVerbs;\r\n this.nextVerbs = new HashSet();\r\n if (currentVerbs.Count() > 0 || this.requiredVerbs.Count() == 0)\r\n {\r\n // Hey, something changed that we could reschedule on,\r\n // or we're actually all done.\r\n break;\r\n }\r\n\r\n // Hmm, we've got no opportunity to schedule new stuff,\r\n // so the VerbRunner better not return empty-handed the\r\n // next time through.\r\n // We've got an assert taskCompletions.Count()>0 to check\r\n // for that.\r\n this.Say(\"Scheduler waiting for more results.\");\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Display various debugging information.\r\n /// \r\n public void dbgDisplayCounts()\r\n {\r\n ////dbgVerbCounter.dbgDisplayCounts();\r\n this.depCache.dbgPrintStats();\r\n }\r\n\r\n /// \r\n /// Display various debugging information.\r\n /// \r\n internal void dbgDumpWaitIndex()\r\n {\r\n this.waitIndex.dbgDisplayIndex(this);\r\n }\r\n\r\n /// \r\n /// Determine the status of a verb (for debugging purposes).\r\n /// \r\n /// Verb being examined.\r\n /// A string containing the verb's current status.\r\n internal string dbgGetVerbStatus(IVerb verb)\r\n {\r\n if (this.completedVerbs.Contains(verb))\r\n {\r\n return \"completed\";\r\n }\r\n\r\n if (this.resolvedVerbs.Contains(verb))\r\n {\r\n return \"submitted\";\r\n }\r\n\r\n return \"pending\";\r\n }\r\n\r\n /// \r\n /// Adds a verb to the mapping of build objects to the verb which\r\n /// creates them.\r\n /// \r\n /// \r\n /// TODO: Make this private.\r\n /// \r\n /// The verb to add.\r\n internal void addVerb(IVerb verb)\r\n {\r\n if (!this.knownVerbs.Add(verb))\r\n {\r\n // We've already added this verb.\r\n return;\r\n }\r\n\r\n // Add all verb outputs to the output-to-verb map.\r\n foreach (BuildObject obj in verb.getOutputs())\r\n {\r\n if (this.outputToVerbMap.ContainsKey(obj))\r\n {\r\n Util.Assert(this.outputToVerbMap[obj].Equals(verb));\r\n }\r\n else\r\n {\r\n this.outputToVerbMap[obj] = verb;\r\n }\r\n }\r\n\r\n // Recursively add all the verbs this verb is dependent upon,\r\n // so that we have a complete index of outputs back to the\r\n // verbs that generate them.\r\n foreach (IVerb dependentVerb in verb.getVerbs())\r\n {\r\n this.addVerb(dependentVerb);\r\n }\r\n }\r\n\r\n /// \r\n /// Adds a collection of verbs (or rather their outputs) as\r\n /// targets for this build.\r\n /// \r\n /// A list of verbs to run.\r\n internal void addTargetVerbs(List verbs)\r\n {\r\n foreach (IVerb verb in verbs)\r\n {\r\n this.addVerb(verb);\r\n this.addTargets(verb.getOutputs());\r\n }\r\n }\r\n\r\n /// \r\n /// Gets a list of target objects for this build.\r\n /// \r\n /// A list of target objects for this build.\r\n internal IEnumerable getTargets()\r\n {\r\n return this.targets;\r\n }\r\n\r\n /// \r\n /// Gets the verb that created the given object.\r\n /// \r\n /// \r\n /// Would like to rename this to \"GetCreator\" or \"GetCreatorVerb\"\r\n /// as it seems strange to call something a parent when it is a\r\n /// completely different object type, but the terminology seems\r\n /// to be widely used in the system.\r\n /// \r\n /// The object in question.\r\n /// The verb that creates the given object.\r\n internal IVerb getParent(BuildObject obj)\r\n {\r\n IVerb result;\r\n this.outputToVerbMap.TryGetValue(obj, out result);\r\n return result;\r\n }\r\n\r\n /// \r\n /// Gets the disposition of the verb that created the given object.\r\n /// \r\n /// The object in question.\r\n /// The disposition of the verb that created the given object.\r\n internal Disposition getObjectDisposition(BuildObject obj)\r\n {\r\n return this.repository.GetDisposition(obj);\r\n }\r\n\r\n /// \r\n /// Updates the \"progress\" output file with current status information.\r\n /// \r\n /// \r\n /// Count of verbs currently able to be run.\r\n /// \r\n /// \r\n /// Count of verbs currently running.\r\n /// \r\n internal void dbgUpdateProgress(int runnableVerbsCount, int runningVerbsCount)\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n sb.AppendLine(\"completedVerbs: \" + this.completedVerbs.Count());\r\n sb.AppendLine(\"resolvedVerbs: \" + this.resolvedVerbs.Count());\r\n sb.AppendLine(\"runnableVerbs: \" + runnableVerbsCount);\r\n sb.AppendLine(\"runningVerbs: \" + runningVerbsCount);\r\n sb.AppendLine(\"waitingVerbs: \" + this.waitIndex.Count());\r\n File.WriteAllText(DbgProgressFileName, sb.ToString());\r\n }\r\n\r\n /// \r\n /// Computes a concrete identifier for a verb operation and its\r\n /// specific inputs.\r\n /// \r\n /// The verb to compute the hash for.\r\n /// \r\n /// Whether to assert if we can't compute the hash.\r\n /// \r\n /// \r\n /// A concrete identifier for a verb operation and its specific inputs.\r\n /// \r\n private string computeInputHash(IVerb verb, bool assertHashAvailable)\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n sb.Append(verb.getAbstractIdentifier().getConcreteId());\r\n DependencyDisposition ddisp;\r\n foreach (BuildObject obj in this.depCache.getDependencies(verb, out ddisp))\r\n {\r\n sb.Append(\",\");\r\n string hash = this.repository.GetHash(obj);\r\n Util.Assert(!assertHashAvailable || (hash != null));\r\n sb.Append(hash);\r\n }\r\n\r\n if (ddisp == DependencyDisposition.Failed)\r\n {\r\n // This happens when we're trying to markFailed,\r\n // but the upstream has failed and we can't compute\r\n // our dependencies. In that case, markFailed\r\n // settles for noting the failure in-process,\r\n // but not caching the result. (Okay, since this\r\n // failure propagation is cheap to rediscover.)\r\n Util.Assert(!assertHashAvailable);\r\n return null;\r\n }\r\n\r\n Util.Assert(ddisp == DependencyDisposition.Complete);\r\n string rc = Util.hashString(sb.ToString());\r\n return rc;\r\n }\r\n\r\n /// \r\n /// Finds some verbs that could possibly complete in the future and help\r\n /// resolve one of these dependencies.\r\n /// \r\n /// A list of unresolved dependencies.\r\n /// \r\n /// A list of verbs that could possibly create one or more of the\r\n /// missing dependencies.\r\n /// \r\n private List robustDiscoverReadyDeps(IEnumerable staleDeps)\r\n {\r\n List newParents = new List();\r\n foreach (BuildObject dep in staleDeps)\r\n {\r\n IVerb parent = this.getParent(dep);\r\n if (parent != null)\r\n {\r\n if (this.completedVerbs.Contains(parent))\r\n {\r\n // Wait, if the parent is completed, why is the child a stale dependency?\r\n Util.Assert(false);\r\n }\r\n\r\n newParents.Add(parent);\r\n }\r\n }\r\n\r\n return newParents;\r\n }\r\n\r\n /// \r\n /// Push each potential target somewhere else: replace it with its\r\n /// dependencies, or mark its outputs failed, or mark it runnable and\r\n /// give it to the verb runner.\r\n /// \r\n /// Set of verbs to process.\r\n private void disposeCurrentVerbs(HashSet currentVerbs)\r\n {\r\n this.submittedCount = 0;\r\n this.Say(\"disposeCurrentVerbs\");\r\n while (currentVerbs.Count() > 0)\r\n {\r\n foreach (IVerb verb in currentVerbs)\r\n {\r\n this.Say(\"disposeCurrentVerbs considering \" + verb);\r\n ////dbgVerbCounter.consider(verb, DbgVerbCounter.DbgVerbCondition.DVWake);\r\n\r\n if (this.resolvedVerbs.Contains(verb))\r\n {\r\n // Enthusiastic wakeup?\r\n continue;\r\n }\r\n\r\n if (this.waitIndex.isWaiting(verb))\r\n {\r\n // He's already waiting for something else.\r\n continue;\r\n }\r\n\r\n DependencyDisposition ddisp;\r\n List knownDeps = new List(this.depCache.getDependencies(verb, out ddisp));\r\n\r\n List staleDeps = new List();\r\n List failedDeps = new List();\r\n foreach (BuildObject dep in knownDeps)\r\n {\r\n Disposition disp = this.repository.GetDisposition(dep);\r\n if (disp is Stale)\r\n {\r\n staleDeps.Add(dep);\r\n }\r\n else if (disp is Failed)\r\n {\r\n failedDeps.Add(dep);\r\n }\r\n }\r\n\r\n if (staleDeps.Count() > 0 || ddisp == DependencyDisposition.Incomplete)\r\n {\r\n // Some inputs aren't yet available, so we can prompt one of those verbs\r\n // instead, and wake this one up when those are done.\r\n Util.Assert(staleDeps.Count() > 0);\r\n\r\n// REVIEW: Clean this up post SOSP.\r\n#if false\r\n List newParents = this.robustDiscoverReadyDeps(staleDeps);\r\n if (newParents.Count() == 0)\r\n {\r\n this.reexamineVerb(verb);\r\n newParents = this.robustDiscoverReadyDeps(staleDeps);\r\n Util.Assert(newParents.Count() > 0);\r\n }\r\n#else\r\n this.reexamineVerb(verb);\r\n List newParents = this.robustDiscoverReadyDeps(staleDeps);\r\n Util.Assert(newParents.Count() > 0);\r\n#endif\r\n\r\n this.nextVerbs.UnionWith(newParents);\r\n this.Say(\r\n string.Format(\r\n \"disposeCurrentVerbs waits {0} dependent on {1} liberating {2}\",\r\n verb,\r\n string.Join(\",\", staleDeps),\r\n string.Join(\",\", newParents)));\r\n this.waitIndex.insert(verb, staleDeps);\r\n }\r\n else if (ddisp == DependencyDisposition.Failed || failedDeps.Count() > 0)\r\n {\r\n this.Say(string.Format(\"disposeCurrentVerbs marks {0} failed\", verb));\r\n this.markFailed(verb);\r\n this.resolvedVerbs.Add(verb);\r\n ////dbgVerbCounter.consider(verb, DbgVerbCounter.DbgVerbCondition.DVDepsNonstale);\r\n }\r\n else\r\n {\r\n // All inputs are available, so we can compute concrete identifier\r\n // to retrieve from cache...\r\n string inputHash = this.computeInputHash(verb, true);\r\n Util.Assert(inputHash != null);\r\n\r\n if (!this.fetchFromCache(verb, inputHash))\r\n {\r\n ////if (verb is BoogieAsmVerificationObligationListVerb) { System.Environment.Exit(0); }\r\n this.Say(string.Format(\"disposeCurrentVerbs submits {0}\", verb));\r\n\r\n // Or if it's not in cache, we can execute.\r\n // Verb's inputs are ready, and output is stale: mark verb runnable.\r\n ////Say(string.Format(\" {0} submitted\", verb));\r\n this.verbRunner.submitVerb(verb);\r\n this.submittedCount += 1;\r\n }\r\n\r\n this.resolvedVerbs.Add(verb);\r\n ////dbgVerbCounter.consider(verb, DbgVerbCounter.DbgVerbCondition.DVDepsNonstale);\r\n }\r\n }\r\n\r\n // We've disposed all the current verbs. But maybe we found some more\r\n // we can pop loose right now.\r\n currentVerbs = this.nextVerbs;\r\n this.nextVerbs = new HashSet();\r\n }\r\n }\r\n\r\n /// \r\n /// Checks the cache for a previous execution of this verb operating on\r\n /// the same inputs; updates our state with the cached results if so.\r\n /// \r\n /// The verb to check for prior execution.\r\n /// \r\n /// An identifier for this verb operating on a specific set of inputs.\r\n /// \r\n /// \r\n /// True if usable previous execution was found, false otherwise.\r\n /// \r\n private bool fetchFromCache(IVerb verb, string inputHash)\r\n {\r\n try\r\n {\r\n ResultSummaryRecord summary = this.repository.FetchResult(inputHash);\r\n if (summary.Disposition is Stale)\r\n {\r\n return false;\r\n }\r\n\r\n // REVIEW: Since we aren't asking FetchResult to return failures,\r\n // this check is no longer needed. Or at least it won't be once\r\n // the \"Results\" cache is cleared of all existing failure records.\r\n if (this.rejectCachedFailures\r\n && (summary.Disposition is Failed || summary.IsVerificationTimeout))\r\n {\r\n Logger.WriteLine(string.Format(\r\n \"NOTE: rejecting failure from cache {0}\", verb));\r\n return false;\r\n }\r\n\r\n this.Say(string.Format(\"disposeCurrentVerbs pulls {0} from cache\", verb));\r\n\r\n // Hey, this verb is already computed! Nothing to do.\r\n // Add the verb execution's results to the repository.\r\n this.repository.AddVerbResults(verb, summary);\r\n\r\n this.verbIsComplete(verb, summary.Disposition);\r\n\r\n return true;\r\n }\r\n catch (ObjectMissingFromCacheException ex)\r\n {\r\n Logger.WriteLine(string.Format(\r\n \"WARNING: expected object {0} missing from cache; discarding cached result {1}\",\r\n ex,\r\n verb));\r\n return false;\r\n }\r\n }\r\n\r\n /// \r\n /// Reexamines a verb to see if it now knows more regarding what other\r\n /// verbs need to run first in order to create its dependencies.\r\n /// \r\n /// The verb to reexamine.\r\n private void reexamineVerb(IVerb verb)\r\n {\r\n foreach (IVerb parentVerb in verb.getVerbs())\r\n {\r\n this.addVerb(parentVerb);\r\n }\r\n }\r\n\r\n /// \r\n /// Processes task completion messages.\r\n /// \r\n /// \r\n /// A list of task completion messages.\r\n /// \r\n private void processTaskCompletions(List taskCompletions)\r\n {\r\n foreach (VerbRunner.TaskCompletion tc in taskCompletions)\r\n {\r\n // We may record a Failure if the verb didn't output\r\n // everything it promised to.\r\n Disposition recordedDisposition = this.recordResult(tc);\r\n\r\n this.Say(string.Format(\" {0} completed with disposition {1}\", tc.verb, tc.disposition));\r\n }\r\n\r\n // Waking process may have shaken some verbs loose for us to evaluate next time around.\r\n }\r\n\r\n /// \r\n /// Conditionally debug print a message.\r\n /// \r\n /// The message to print.\r\n private void Say(string s)\r\n {\r\n if (Debug)\r\n {\r\n#pragma warning disable 162\r\n Logger.WriteLine(\"[sched] \" + s);\r\n#pragma warning restore 162\r\n }\r\n }\r\n\r\n /// \r\n /// Logs output regarding a verb's execution disposition.\r\n /// \r\n /// The verb in question.\r\n /// Disposition of the verb execution.\r\n private void emitRealtimeReport(IVerb verb, Disposition disposition)\r\n {\r\n Presentation pr = verb.getRealtimePresentation(disposition);\r\n ASCIIPresentater ascii = new ASCIIPresentater();\r\n pr.format(ascii);\r\n Logger.Write(ascii.ToString());\r\n }\r\n\r\n /// \r\n /// Mark a verb as completed, and adjust our schedule accordingly.\r\n /// \r\n /// The verb that completed.\r\n /// The disposition of the verb's execution.\r\n private void verbIsComplete(IVerb verb, Disposition disp)\r\n {\r\n ////Say(string.Format(\" {0} is complete: {1}\", verb, dbgDisposition));\r\n ////if (disp is Failed)\r\n ////{\r\n //// // Failures can be hard to debug, since they don't leave any\r\n //// // output in nuobj/. So report these even if they aren't\r\n //// // built this run.\r\n //// emitRealtimeReport(verb, disp);\r\n ////}\r\n\r\n // Invariant: all of this verb's objs are non-Stale.\r\n foreach (BuildObject obj in verb.getOutputs())\r\n {\r\n ////Say(string.Format(\" waking {0}\", obj));\r\n IEnumerable wokenSet = this.waitIndex.awaken(obj);\r\n ////foreach (IVerb wokenVerb in wokenSet)\r\n ////{\r\n //// //Say(string.Format(\" {0} woken\", wokenVerb));\r\n ////}\r\n this.nextVerbs.UnionWith(wokenSet);\r\n }\r\n\r\n this.emitRealtimeReport(verb, disp);\r\n\r\n this.requiredVerbs.Remove(verb);\r\n this.completedVerbs.Add(verb);\r\n }\r\n\r\n /// \r\n /// Record how each output of a task appeared.\r\n /// \r\n /// The task completion notification.\r\n /// Overall result of the verb execution.\r\n private Disposition recordResult(VerbRunner.TaskCompletion completion)\r\n {\r\n WorkingDirectory workingDirectory = completion.workingDirectory;\r\n IVerb verb = completion.verb;\r\n Disposition executionDisposition = completion.disposition;\r\n\r\n List outputs = new List();\r\n List missingOutputs = new List();\r\n IEnumerable expectedOutputs = verb.getOutputs();\r\n\r\n if (executionDisposition is Failed)\r\n {\r\n expectedOutputs = expectedOutputs.Concat(verb.getFailureOutputs());\r\n }\r\n\r\n bool hasVirtualOutputs = false;\r\n foreach (BuildObject outobj in expectedOutputs)\r\n {\r\n if (!(outobj is VirtualBuildObject))\r\n {\r\n // For expected file outputs, check for existence in working directory.\r\n // REVIEW: Add method to WorkingDirectory which does this?\r\n if (File.Exists(workingDirectory.PathTo(outobj)))\r\n {\r\n // Try to catch accidental case mismatches that would burn us when we\r\n // try to fetch the file back in.\r\n ////string fsname = PathNormalizer.dbg_normalizePath_nocache(outobj.deprecatedGetFilesystemPath(), false);\r\n ////Util.Assert(Path.GetFileName(fsname).Equals(outobj.getFileName()));\r\n // REVIEW: Do we need to worry about case mismatches anymore? See comments above.\r\n outputs.Add(this.repository.Store(workingDirectory, outobj, executionDisposition));\r\n\r\n // Store a copy of this verb output as a file in the real nuobj directory.\r\n Util.Assert(outobj.getRelativePath().StartsWith(BuildEngine.theEngine.getObjRoot(), StringComparison.Ordinal));\r\n string nuobjPath = IronRootDirectory.PathTo(outobj);\r\n Directory.CreateDirectory(Path.GetDirectoryName(nuobjPath));\r\n File.Copy(workingDirectory.PathTo(outobj), nuobjPath, true);\r\n }\r\n else\r\n {\r\n missingOutputs.Add(string.Format(\"Missing expected output {0}\", outobj.getRelativePath()));\r\n }\r\n }\r\n else\r\n {\r\n hasVirtualOutputs = true;\r\n if (this.repository.GetDisposition(outobj) is Fresh)\r\n {\r\n // Nothing to cache; virtual objects only survive in the Repository, the in-process store.\r\n }\r\n else\r\n {\r\n missingOutputs.Add(string.Format(\"Missing expected virtual {0}\", outobj.getRelativePath()));\r\n }\r\n }\r\n }\r\n\r\n if (!(executionDisposition is Failed) && missingOutputs.Count() > 0)\r\n {\r\n executionDisposition = new Failed(missingOutputs);\r\n }\r\n\r\n ResultSummaryRecord summary = new ResultSummaryRecord(verb, executionDisposition, outputs);\r\n string inputHash = this.computeInputHash(verb, true);\r\n Util.Assert(inputHash != null);\r\n if (!hasVirtualOutputs)\r\n {\r\n this.repository.StoreResult(inputHash, summary);\r\n }\r\n else\r\n {\r\n this.Say(\"Not caching verb persistently: \" + verb);\r\n }\r\n\r\n this.verbIsComplete(verb, executionDisposition);\r\n return executionDisposition;\r\n }\r\n\r\n /// \r\n /// Mark a verb as having failed.\r\n /// \r\n /// The verb that failed.\r\n private void markFailed(IVerb verb)\r\n {\r\n // At least one of verb's inputs has a permanent failure, so we didn't\r\n // even try to execute it.\r\n Disposition disposition = new Failed(\"upstream failure\");\r\n ResultSummaryRecord summary = new ResultSummaryRecord(verb, disposition, new BuildObjectValuePointer[] { });\r\n\r\n // NB never store upstream failures to the persistent cache, because\r\n // they depend on our knowledge this run that the upstream verb failed.\r\n // If, in another run, the verb or its inputs are modified, produce the\r\n // same outputs, but returns success, we'll be stuck pulling this\r\n // upstream failure out of cache but calling this verb a failure.\r\n ////string inputHash = computeInputHash(verb, false);\r\n ////if (inputHash != null)\r\n ////{\r\n //// Util.Assert(false);\r\n //// // \"Upstream failures\" will never have a computable inputHash, because their inputs\r\n //// // can't be considered known. Even if the upstream verb wrote something to disk,\r\n //// // what if the upstream verb changes to no longer fail but still emit the same thing?\r\n //// // We wouldn't want to conclude that, because the inputs hadn't changed, this\r\n //// // verb still had an upstream failure.\r\n //// repository.StoreResult(inputHash, summary);\r\n ////}\r\n ////else\r\n ////{\r\n this.unrecordableFailures[verb] = disposition;\r\n ////}\r\n\r\n // Mark all the verb's outputs as Failed in the repository.\r\n foreach (BuildObject obj in verb.getOutputs())\r\n {\r\n if (obj is VirtualBuildObject)\r\n {\r\n this.repository.StoreVirtual(obj, disposition, null);\r\n }\r\n else\r\n {\r\n this.repository.AddObject(obj, disposition, null);\r\n }\r\n }\r\n\r\n this.verbIsComplete(verb, disposition);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/SourceConfigurationError.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class SourceConfigurationError : Exception\r\n {\r\n public SourceConfigurationError(string msg)\r\n : base(msg)\r\n {\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/SourcePath.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.IO;\r\n\r\n /// \r\n /// Representation of a source BuildObject.\r\n /// These are things which we expect to pre-exist, instead of built by us.\r\n /// \r\n internal class SourcePath\r\n : BuildObject\r\n {\r\n /// \r\n /// The type of \"source\" this is.\r\n /// \r\n private SourceType sourceType;\r\n\r\n /// \r\n /// Initializes a new instance of the SourcePath class.\r\n /// \r\n /// \r\n /// Relative path to this object in the local filesystem.\r\n /// \r\n /// \r\n /// The type of \"source\" this is.\r\n /// \r\n public SourcePath(string inpath, SourceType sourceType = SourceType.Src)\r\n : base(inpath)\r\n {\r\n // Sanity checks.\r\n this.checkPrefix(sourceType, SourceType.Src, BuildEngine.theEngine.getSrcRoot());\r\n this.checkPrefix(sourceType, SourceType.Tools, BuildEngine.theEngine.getToolsRoot());\r\n this.checkPrefix(sourceType, SourceType.BinTools, BuildEngine.theEngine.getBinToolsRoot());\r\n this.checkPrefix(sourceType, SourceType.PrebakedObjExpediency, \"obj\"); // TODO remove.\r\n\r\n this.sourceType = sourceType;\r\n this.IsTrusted = getRelativePath().StartsWith(\r\n Path.Combine(BuildEngine.theEngine.getSrcRoot(), BuildEngine.VerveTrustedSpecDir), StringComparison.OrdinalIgnoreCase);\r\n }\r\n\r\n /// \r\n /// Various types of \"sources\".\r\n /// \r\n public enum SourceType\r\n {\r\n /// \r\n /// Source file.\r\n /// \r\n Src,\r\n\r\n /// \r\n /// Tools (executables usually) that we don't build ourselves.\r\n /// \r\n Tools,\r\n\r\n /// \r\n /// Tools that we could build ourselves.\r\n /// Probably don't really want this in the long run,\r\n /// since we can build these.\r\n /// \r\n BinTools,\r\n\r\n /// \r\n /// Special purpose expediency.\r\n /// Used to point at bootloader, until we can get an nmake verb working. TODO remove.\r\n /// \r\n PrebakedObjExpediency\r\n }\r\n\r\n /// \r\n /// Gets the source type of this instance.\r\n /// \r\n public SourceType Type\r\n {\r\n get { return this.sourceType; }\r\n }\r\n\r\n /// \r\n /// Creates a new SourcePath, where the source type is the same as this\r\n /// SourcePath's, and the path is relative to the directory containing\r\n /// this SourcePath.\r\n /// \r\n /// \r\n /// REVIEW: This should be renamed to MakeNewSourcePath to correspond\r\n /// with BuildObject\r\n /// \r\n /// Relative path to the new object.\r\n /// The new SourcePath.\r\n public SourcePath getNewSourcePath(string inpath)\r\n {\r\n return new SourcePath(Path.Combine(getDirPath(), inpath), this.sourceType);\r\n }\r\n\r\n /// \r\n /// Checks that the path prefix for this object is reasonable for the\r\n /// given source type.\r\n /// \r\n /// The given source type.\r\n /// \r\n /// Source type the prefix parameter matches.\r\n /// \r\n /// \r\n /// Prefix that paths of the matchType parameter should have.\r\n /// \r\n private void checkPrefix(SourceType givenType, SourceType matchType, string prefix)\r\n {\r\n if (givenType == matchType)\r\n {\r\n if (!path.StartsWith(prefix, StringComparison.OrdinalIgnoreCase))\r\n {\r\n throw new UserError(string.Format(\r\n \"Source path {0} should begin with {1}\",\r\n this.path,\r\n prefix));\r\n }\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/SourcePathIncludeContext.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n // This context looks for files in a set of source path locations.\r\n internal class SourcePathIncludeContext\r\n : IncludePathContext\r\n {\r\n private List directories;\r\n private List dstExtensions;\r\n private string _descr;\r\n\r\n public SourcePathIncludeContext()\r\n {\r\n this.directories = new List();\r\n this.dstExtensions = new List();\r\n }\r\n\r\n public override string ToString()\r\n {\r\n if (this._descr == null)\r\n {\r\n this._descr = \"{\" + string.Join(\",\", this.directories.Select(d => d.directory)) + \"}; {\"\r\n + string.Join(\",\", this.dstExtensions) + \"}\";\r\n }\r\n\r\n return this._descr;\r\n }\r\n\r\n // Add a directory path relative to ironRoot.\r\n public void addDirectory(string directory)\r\n {\r\n Util.Assert(this._descr == null);\r\n this.directories.Add(new DirectoryRecord(directory));\r\n }\r\n\r\n public void addDstExtension(string extension)\r\n {\r\n Util.Assert(this._descr == null);\r\n this.dstExtensions.Add(extension);\r\n }\r\n\r\n public override BuildObject search(string basename, ModPart modPart)\r\n {\r\n List results = new List();\r\n\r\n foreach (string extension in this.dstExtensions.Where(extn => BeatExtensions.whichPart(extn) == modPart))\r\n {\r\n string filename = basename + extension;\r\n foreach (DirectoryRecord directoryRecord in this.directories)\r\n {\r\n if (directoryRecord.Contains(filename))\r\n {\r\n string proposed = Path.Combine(\r\n BuildEngine.theEngine.getIronRoot(),\r\n BuildEngine.theEngine.getSrcRoot(),\r\n directoryRecord.directory,\r\n basename + extension);\r\n ////Logger.WriteLine(\"SourcePathIncludeContext Trying \" + proposed);\r\n ////Util.Assert(File.Exists(proposed));\r\n results.Add(new SourcePath(proposed));\r\n }\r\n }\r\n }\r\n\r\n if (results.Count() == 0)\r\n {\r\n return null;\r\n }\r\n else if (results.Count() > 1)\r\n {\r\n throw new SourceConfigurationError(string.Format(\r\n \"Reference {0} matches {1} paths: {2}\",\r\n basename,\r\n results.Count(),\r\n string.Join(\",\", results)));\r\n }\r\n else\r\n {\r\n return results.First();\r\n }\r\n }\r\n\r\n private class DirectoryRecord\r\n {\r\n private readonly string _directory;\r\n private readonly HashSet _files;\r\n\r\n public DirectoryRecord(string directory)\r\n {\r\n this._directory = directory;\r\n string absDir = Path.Combine(\r\n BuildEngine.theEngine.getIronRoot(),\r\n BuildEngine.theEngine.getSrcRoot(),\r\n this._directory);\r\n this._files = new HashSet(Directory.EnumerateFiles(absDir)\r\n .Select(path => Path.GetFileName(path)));\r\n }\r\n\r\n public string directory\r\n {\r\n get { return this._directory; }\r\n }\r\n\r\n public bool Contains(string file)\r\n {\r\n return this._files.Contains(file);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/StaticContextVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n // Recipient needs to accept IContextGeneratingVerbs, but we don't need\r\n // any dependencies to produce this (static) context. So this is a simple,\r\n // non-dependent verb that just spews a ContextContents.\r\n internal class StaticContextVerb\r\n : ContextGeneratingVerb\r\n {\r\n private IIncludePathContext _context;\r\n\r\n public StaticContextVerb(IIncludePathContext context, string nickname, PoundDefines poundDefines)\r\n : base(nickname, poundDefines)\r\n {\r\n this._context = context;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n return new BuildObject[] { };\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new IVerb[] { };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n ContextContents contents = new ContextContents(this._context);\r\n BuildEngine.theEngine.Repository.StoreVirtual(this.getContextOutput(), new Fresh(), contents);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/SymDiffBaseVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n internal abstract class SymDiffBaseVerb : Verb, IProcessInvokeAsyncVerb\r\n {\r\n private const int version = 10;\r\n \r\n public abstract IEnumerable getInputFiles();\r\n\r\n public abstract BuildObject getOutputFile();\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n\r\n List deps = new List(this.getInputFiles());\r\n deps.Add(getSymDiffExecutable());\r\n deps.AddRange(getSymDiffExecutableDependencies());\r\n\r\n // REVIEW: Probably need to add SymDiffExecutable's dependencies too.\r\n return deps;\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() { this.getOutputFile() };\r\n }\r\n\r\n public virtual void preprocess(WorkingDirectory workingDirectory) { }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n List args = this.getArgs();\r\n\r\n preprocess(workingDirectory);\r\n\r\n // We use workingDirOverride flag here to change the path that the\r\n // process starts in to one that is still in our workingDirectory.\r\n // So this isn't so bad. It would be better if NuBuild would only\r\n // let us supply a relative path here, however.\r\n string overrideDir = null;\r\n if (this.getWorkingDir() != null)\r\n {\r\n overrideDir = workingDirectory.PathTo(this.getWorkingDir());\r\n }\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n getSymDiffExecutable().getRelativePath(),\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n getDiagnosticsBase(),\r\n workingDirOverride: overrideDir,\r\n returnStandardOut: true);\r\n }\r\n\r\n public virtual Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n return disposition;\r\n }\r\n\r\n protected static SourcePath getSymDiffExecutable()\r\n {\r\n return new SourcePath(\"tools\\\\SymDiff\\\\SymDiff.exe\", SourcePath.SourceType.Tools);\r\n }\r\n\r\n protected static IEnumerable getSymDiffExecutableDependencies()\r\n {\r\n List exeDepends = new List();\r\n\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\Basetypes.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\Core.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\CodeContractsExtender.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\Graph.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\ParserHelper.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\Provers.SMTLib.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\VCGeneration.dll\", SourcePath.SourceType.Tools));\r\n exeDepends.Add(new SourcePath(\"tools\\\\SymDiff\\\\z3.exe\", SourcePath.SourceType.Tools));\r\n\r\n return exeDepends;\r\n }\r\n\r\n protected abstract List getArgs();\r\n\r\n protected virtual string getWorkingDir()\r\n {\r\n return getOutputFile().getDirPath();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/SymDiffCombineVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n internal class SymDiffCombineVerb : SymDiffBaseVerb, IProcessInvokeAsyncVerb\r\n {\r\n public const string MERGED_FILE_NAME = \"mergedProgSingle.bpl\";\r\n\r\n private const int version = 3;\r\n\r\n private AbstractId abstractId;\r\n private SymDiffExtractVerb left;\r\n private SymDiffExtractVerb right;\r\n private SymDiffMergeConfigVerb merger;\r\n\r\n private BuildObject outputFile;\r\n\r\n public SymDiffCombineVerb(SymDiffExtractVerb left, SymDiffExtractVerb right, SymDiffMergeConfigVerb merger)\r\n {\r\n this.left = left;\r\n this.right = right;\r\n this.merger = merger;\r\n\r\n // Naming one of the files should be sufficient to uniquely identify the combiner.\r\n this.abstractId = new AbstractId(this.GetType().Name, version, left.getOutputFile().ToString());\r\n ////abstractId = String.Format(\"{0}(#{1},{2},{3},{4})\",\r\n //// this.GetType().Name,\r\n //// version,\r\n //// left.getOutputFile(),\r\n //// right.getOutputFile(),\r\n //// merger.getOutputFile());\r\n this.outputFile = this.mkOutputFile();\r\n }\r\n\r\n public override IEnumerable getInputFiles()\r\n {\r\n return new List() { this.left.getOutputFile(), this.right.getOutputFile(), this.merger.getOutputFile() };\r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n return this.outputFile;\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new List() { this.left, this.right, this.merger };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() { this.getOutputFile() };\r\n }\r\n \r\n\r\n protected override List getArgs()\r\n {\r\n List args = new List();\r\n args.Add(\"-allInOne\");\r\n args.Add(this.left.getOutputFile().getFileName());\r\n args.Add(this.right.getOutputFile().getFileName());\r\n args.Add(this.merger.getOutputFile().getFileName());\r\n ////args.Add(left.getOutputFile().getRelativePath());\r\n ////args.Add(right.getOutputFile().getRelativePath());\r\n ////args.Add(merger.getOutputFile().getRelativePath());\r\n\r\n List extra_args = new List() { \"-asserts\", \"-freeContracts\", \"-usemutual\", \"-sound\", \"-dontUseHoudiniForMS\", \"-checkMutualPrecondNonTerminating\" };\r\n args.AddRange(extra_args);\r\n\r\n return args;\r\n }\r\n\r\n private BuildObject mkOutputFile()\r\n {\r\n // SymDiff always uses the same file name in the working directory.\r\n return new BuildObject(Path.Combine(this.left.getOutputFile().getDirPath(), MERGED_FILE_NAME));\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/SymDiffEngine.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class SymDiffEngine\r\n {\r\n public static void BuildPipeline(IContextGeneratingVerb context, BuildObject input, out BuildObject bplFile, out IVerb workerVerb)\r\n {\r\n BoogieAsmVerifyVerb basmVerb = new BoogieAsmVerifyVerb(context, input, true);\r\n SymDiffExtractVerb left = new SymDiffExtractVerb(basmVerb, SymDiffExtractVerb.Mode.LEFT);\r\n SymDiffExtractVerb right = new SymDiffExtractVerb(basmVerb, SymDiffExtractVerb.Mode.RIGHT);\r\n SymDiffInferVerb infer = new SymDiffInferVerb(left, right);\r\n SymDiffMergeConfigVerb mergeConfig = new SymDiffMergeConfigVerb(basmVerb, infer);\r\n SymDiffCombineVerb combiner = new SymDiffCombineVerb(left, right, mergeConfig);\r\n SymDiffMergeVerb merger = new SymDiffMergeVerb(basmVerb, combiner);\r\n\r\n bplFile = merger.getOutputFile();\r\n workerVerb = merger;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/SymDiffExtractVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n internal class SymDiffExtractVerb : SymDiffBaseVerb\r\n {\r\n public const string UNROLLED_EXTN = \"_u\";\r\n public const string LEFT_FILE = \"v1\";\r\n public const string RIGHT_FILE = \"v2\";\r\n\r\n private const int version = 5;\r\n\r\n private AbstractId abstractId;\r\n private BoogieAsmVerifyVerb basmVerb;\r\n private BuildObject basmIn;\r\n private Mode mode;\r\n\r\n public SymDiffExtractVerb(BoogieAsmVerifyVerb basmVerb, Mode mode)\r\n {\r\n this.basmVerb = basmVerb;\r\n this.basmIn = basmVerb.outputFile();\r\n this.mode = mode;\r\n\r\n this.abstractId = new AbstractId(this.GetType().Name, version, this.basmIn.ToString(), concrete: mode.ToString());\r\n }\r\n\r\n public enum Mode\r\n {\r\n LEFT, RIGHT\r\n }\r\n\r\n public override IEnumerable getInputFiles()\r\n {\r\n return new List() { this.basmIn };\r\n }\r\n\r\n public string getFileName() {\r\n switch (mode) {\r\n case Mode.LEFT:\r\n return LEFT_FILE;\r\n case Mode.RIGHT:\r\n return RIGHT_FILE;\r\n default:\r\n throw new Exception(\"Unexpected mode for SymDiffExtractVerb\");\r\n }\r\n }\r\n\r\n private BuildObject getTmpInputFile()\r\n {\r\n return new BuildObject(Path.Combine(basmIn.getDirPath(), getFileName() + BoogieVerb.BPL_EXTN)); \r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n return new BuildObject(Path.Combine(this.basmIn.getDirPath(), getFileName() + UNROLLED_EXTN + BoogieVerb.BPL_EXTN));\r\n ////return basmIn.makeOutputObject(extension + BoogieVerb.BPL_EXTN); \r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new List() { this.basmVerb };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() { this.getOutputFile() };\r\n }\r\n \r\n public override void preprocess(WorkingDirectory workingDirectory) {\r\n base.preprocess(workingDirectory);\r\n File.Copy(workingDirectory.PathTo(basmIn), workingDirectory.PathTo(getTmpInputFile()), true);\r\n }\r\n\r\n protected override List getArgs()\r\n {\r\n List args = new List();\r\n args.Add(\"-extractLoops\");\r\n args.Add(getTmpInputFile().getFileName());\r\n args.Add(getOutputFile().getFileName());\r\n\r\n return args;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/SymDiffInferVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n internal class SymDiffInferVerb : SymDiffBaseVerb, IProcessInvokeAsyncVerb\r\n {\r\n public const string CONFIG = \".partial_config\";\r\n\r\n private const int version = 6;\r\n\r\n private AbstractId abstractId;\r\n private SymDiffExtractVerb left;\r\n private SymDiffExtractVerb right;\r\n\r\n public SymDiffInferVerb(SymDiffExtractVerb left, SymDiffExtractVerb right)\r\n {\r\n this.left = left;\r\n this.right = right;\r\n\r\n this.abstractId = new AbstractId(this.GetType().Name, version, left.getOutputFile().ToString().ToString()); // Left should suffice to uniquely ID.\r\n }\r\n\r\n public override IEnumerable getInputFiles()\r\n {\r\n return new List() { this.left.getOutputFile(), this.right.getOutputFile() };\r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n // Choice of left/right doesn't matter here, since we're dropping the extension.\r\n return this.left.getOutputFile().makeOutputObject(CONFIG);\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new List() { this.left, this.right };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() { this.getOutputFile() };\r\n }\r\n\r\n public override Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n if (!(disposition is Failed))\r\n {\r\n File.WriteAllText(workingDirectory.PathTo(this.getOutputFile()), stdout);\r\n }\r\n\r\n return disposition;\r\n }\r\n\r\n protected override List getArgs()\r\n {\r\n List args = new List();\r\n args.Add(\"-inferConfig\");\r\n args.Add(this.left.getOutputFile().getFileName());\r\n args.Add(this.right.getOutputFile().getFileName());\r\n\r\n return args;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/SymDiffMergeBaseVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n internal abstract class SymDiffMergeBaseVerb : Verb, IProcessInvokeAsyncVerb\r\n {\r\n private const int version = 3;\r\n\r\n private static NmakeVerb boogieAsmBuildExecutableVerb = new NmakeVerb(new SourcePath(\"tools\\\\BoogieAsm\\\\makefile\", SourcePath.SourceType.Tools));\r\n\r\n public abstract BuildObject getOutputFile();\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n\r\n List deps = new List(this.getInputFiles());\r\n deps.Add(getSymDiffMergeExecutable());\r\n\r\n // REVIEW: Probably need to add SymDiffMergeExecutable's dependencies too.\r\n return deps;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new[] { boogieAsmBuildExecutableVerb };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new List() { this.getOutputFile() };\r\n }\r\n\r\n protected string getWorkingDir() { return getOutputFile().getDirPath(); }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n List args = this.getArgs();\r\n\r\n // We use workingDirOverride flag here to change the path that the\r\n // process starts in to one that is still in our workingDirectory.\r\n // So this isn't so bad. It would be better if NuBuild would only\r\n // let us supply a relative path here, however.\r\n string overrideDir = null;\r\n if (this.getWorkingDir() != null)\r\n {\r\n overrideDir = workingDirectory.PathTo(this.getWorkingDir());\r\n }\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n this.getSymDiffMergeExecutable().getRelativePath(),\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n getDiagnosticsBase(),\r\n captureStdout: this.getOutputFile(),\r\n workingDirOverride:overrideDir);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n return disposition;\r\n }\r\n\r\n protected abstract IEnumerable getInputFiles();\r\n\r\n protected abstract List getArgs();\r\n \r\n private BuildObject getSymDiffMergeExecutable()\r\n {\r\n return new BuildObject(Path.Combine(boogieAsmBuildExecutableVerb.getOutputPath().getRelativePath(), \"symdiffmerge.exe\"));\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/SymDiffMergeConfigVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n internal class SymDiffMergeConfigVerb : SymDiffMergeBaseVerb, IProcessInvokeAsyncVerb\r\n {\r\n public const string CONFIG_EXTN = \".config\";\r\n private const int version = 7;\r\n\r\n private AbstractId abstractId;\r\n private BoogieAsmVerifyVerb basmVerb;\r\n private BuildObject mutualSummary;\r\n private SymDiffInferVerb inferVerb;\r\n private BuildObject inferredConfig;\r\n private BuildObject output;\r\n\r\n public SymDiffMergeConfigVerb(BoogieAsmVerifyVerb basmVerb, SymDiffInferVerb inferVerb)\r\n {\r\n this.basmVerb = basmVerb;\r\n this.mutualSummary = basmVerb.getMutualSummary();\r\n this.inferVerb = inferVerb;\r\n this.inferredConfig = inferVerb.getOutputFile();\r\n\r\n this.abstractId = new AbstractId(this.GetType().Name, version, this.inferredConfig.ToString()); // One should suffice for uniqueness: String.Format(\"{0},{1}\", mutualSummary,inferredConfig));\r\n this.output = this.basmVerb.outputFile().makeOutputObject(CONFIG_EXTN);\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n return this.output;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return base.getVerbs().Concat(new List() { this.basmVerb, this.inferVerb });\r\n }\r\n\r\n protected override IEnumerable getInputFiles()\r\n {\r\n return new List() { this.mutualSummary, this.inferredConfig };\r\n }\r\n\r\n protected override List getArgs()\r\n {\r\n List args = new List();\r\n args.Add(\"-config\");\r\n args.Add(this.mutualSummary.getFileName());\r\n args.Add(this.inferredConfig.getFileName());\r\n return args;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/SymDiffMergeVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n internal class SymDiffMergeVerb : SymDiffMergeBaseVerb, IProcessInvokeAsyncVerb\r\n {\r\n public const string MERGED_EXTN = \".merge\";\r\n private const int version = 8;\r\n\r\n private AbstractId abstractId;\r\n private BoogieAsmVerifyVerb basmVerb;\r\n private BuildObject mutualSummary;\r\n private SymDiffCombineVerb combiner;\r\n private BuildObject output;\r\n\r\n public SymDiffMergeVerb(BoogieAsmVerifyVerb basmVerb, SymDiffCombineVerb combiner)\r\n {\r\n this.basmVerb = basmVerb;\r\n this.mutualSummary = basmVerb.getMutualSummary();\r\n this.combiner = combiner;\r\n\r\n this.abstractId = new AbstractId(this.GetType().Name, version, this.combiner.getOutputFile().ToString()); // String.Format(\"{0},{1}\", One should suffice for uniqueness: mutualSummary, combiner.getOutputFile()));\r\n this.output = this.basmVerb.outputFile().makeOutputObject(MERGED_EXTN + BoogieVerb.BPL_EXTN);\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n return this.output;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return base.getVerbs().Concat(new List() { this.basmVerb, this.combiner });\r\n }\r\n\r\n protected override IEnumerable getInputFiles()\r\n {\r\n return new List() { this.mutualSummary, this.combiner.getOutputFile() };\r\n }\r\n\r\n protected override List getArgs()\r\n {\r\n List args = new List();\r\n args.Add(\"-merge\");\r\n args.Add(this.mutualSummary.getFileName());\r\n args.Add(this.combiner.getOutputFile().getFileName());\r\n return args;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/ToDo.txt", "content": "** High Level Issues **\n\n- Shared remote execution results queue doesn't work well. Probably should\n switch this to a different method of returning results to the submitting\n client. Possibilities include an Azure table or per-client results queues.\n\n- Current method of cloud/local item cache synchronization is inefficient.\n\n- We need a better story for how we treat verb execution failures.\n\n- Pulling results from the cache throws (instead of failing gracefully) if a\n result is missing a referenced object. Fortunately, this doesn't seem to\n happen often (ever?).\n\n- All async verbs should list their executable (and its dependencies) as verb\n dependencies. Not clear we're there yet. Comment is in ProcessInvoker.cs.\n\n** Medium Level Issues **\n\n- Azure connection string (and other credentials for AzureManager tool) are\n hard-coded. Should read these from App Settings in the prescribed manner.\n\n- Use of arbitrary working directories is not yet supported by all verbs (for\n example, NMakeVerb uses workingDirOverride). Some efficiency improvements\n could be made if arbitrary working directories were universal.\n\n- Nothing checks to ensure that the XML representation of the various things\n we put in Azure queues (CloudExecutionRequest, CloudExecutionReport) don't\n exceed the maximum size for a queue entry. Unlikely to happen, except for\n how we currently return stdout & stderr (i.e. inline).\n\n- Nothing checks to ensure that we never exceed blob store size limitations.\n This is extremely unlikely to happen, as we are several orders below that.\n\n- ItemCacheMultiplexer treats all item cache entries as immutable -- this is\n true for objects and sources (since they're named by hashes of their contents)\n but not for results. This prevented us from overwritting bad results with\n good ones. Current solution is to cache bad results elsewhere. Good enough?\n\n- The \"ASCIIPresentater\" code for command line output implements ECMA-48 (aka\n \"ANSI Escape Sequences\") incorrectly. These also aren't supported by cmd.exe,\n so only people running NuBuild in alternate shells see the colored output.\n\n** Code Cleanup **\n\n- Cosmetic or non-functional changes:\n - Rename all methodNames to MethodNames as per StyleCop conventions.\n - Remove underscores from all private field names as per StyleCop conventions.\n - BuildObject has getRelativePath method instead of RelativePath property.\n - Rename IVerb's getFailureOutputs to getDiagnosticOutputs.\n - Presentater.cs is badly named, for multiple reasons.\n - Scheduler.cs has an addVerb method which could be private.\n - XmlFiller.cs should be IXmlFiller.cs (if we keep it at all).\n\n- Structural changes:\n - Fresh, Stale, and Failed are actual types in the type system (Disposition\n is the base class) rather than just values of Disposition. This causes\n various problems -- might want to make these just values of Disposition.\n - Hasher class contains only things that should be elsewhere.\n - CloudExecutionQueue constructor has lousy work-around for getIronRoot.\n How we determine the IronRoot (and how we manage progarm-wide state in\n general) could use some rearchitecting.\n - ProcessInvokeAsyncWorker takes the executable as a string, rather than a\n BuildObject (like all the other dependencies are).\n\n- Ugly code:\n - In propagePrivateImports in BeatExtensions.cs, a file is pre-pended to in a\n very inefficient manner.\n - DafnyTransformBaseVerb does getFileNameWithoutExtension manually?\n\n** Things Outside of NuBuild's Control **\n\n- Beat (Basm?) should be propagating import statements from the Beat file\n to the Basm output.\n\n- Beat doesn't properly ignore commented-out imports in ifcs files?\n\n- Dafny doesn't handle its include files properly, so we have to pull in all\n the include files ourselves in NuBuild (see DafnyCompileOneVerb).\n\n- DafnyCompileOneVerb RewriteCSharpFile does some stuff Dafny itself should.\n\n- DafnyTransformBaseVerb has special cases to handle weird differences between\n DafnyCC and DafnySpec.\n\n-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n\nOther ToDos:\n\n- Add source scanning capability to DafnyVerifyOneVerb.\n\n- Brittle code in BeatExtensions.cs getBeatFlavoredShallowDependencies.\n\n- Scary comment in BoogieVerb constructor.\n\n- Various issues with BootableAppVerb.cs:\n - Does this verb even work currently? Paths have broken?\n - We should build the pxe-loader, rather than include it.\n - SourceType.PrebakedObjExpediency is just to support this.\n - Other comments about bootloader.\n\n- We should build Dafny, not include a pre-built binary.\n\n- We should build nmake, not include a pre-built binary.\n\n- DafnyVerifyTreeVerb assumes all dafny files are source files (i.e. not built\n by NuBuild). An issue if we ever end up building and verifying intermediate\n dafny files.\n\n- BuildObject splitExtension has some Ironclad project file naming conventions\n built in.\n\n- EntryStitcherVerb contains a major special-case workaround.\n\n- IroncladAppVerb has a special case for pound define support.\n\n- MasmVerb should call ml.exe with with argument to include SPEC_INCLUDE_DIR?\n\n- VSSolutionVerb uses an absolute exe path for MSBuild.exe.\n\n- WinLinkerVerb uses absolute paths for various exes and libs.\n - Visual Studio and Windows SDK files mostly.\n - Also has two large files of mostly zeros that we wouldn't want to cache.\n - These don't appear to be listed as actual dependencies.\n\n- OrderPreservingSet has a comment by its author about not knowing what one of\n ICollection's methods (that it implements) is for.\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/TransitiveDepsContents.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n\r\n internal class TransitiveDepsContents : VirtualContents\r\n {\r\n OrderPreservingSet _shallowDeps, _transitiveDeps;\r\n\r\n public IEnumerable shallowDeps\r\n {\r\n get { return this._shallowDeps; }\r\n }\r\n\r\n public IEnumerable transitiveDeps\r\n {\r\n get { return this._transitiveDeps; }\r\n }\r\n\r\n public TransitiveDepsContents(OrderPreservingSet shallowDeps, OrderPreservingSet transitiveDeps)\r\n {\r\n this._shallowDeps = shallowDeps;\r\n this._transitiveDeps = transitiveDeps;\r\n }\r\n\r\n ////public override string getConcreteSummary()\r\n ////{\r\n //// return \"(\" + String.Join(\",\", transitiveDeps) + \")\";\r\n ////}\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/TransitiveDepsVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n internal abstract class TransitiveDepsVerb\r\n : Verb\r\n {\r\n public const string TDEP_EXTN = \".tdep\";\r\n private const int version = 3;\r\n\r\n private BuildObject obj;\r\n private BuildObject _depsObj;\r\n\r\n protected TransitiveDepsVerb(BuildObject obj)\r\n {\r\n this.obj = obj;\r\n this._depsObj = obj.makeVirtualObject(BeatExtensions.whichPart(obj).ExtnStr() + TDEP_EXTN);\r\n }\r\n\r\n public BuildObject depsObj()\r\n {\r\n return this._depsObj;\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return new AbstractId(this.GetType().Name, version, this.obj.getRelativePath());\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new BuildObject[] { this.depsObj() };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n OrderPreservingSet shallowDeps = new OrderPreservingSet();\r\n OrderPreservingSet transitiveDeps = new OrderPreservingSet();\r\n\r\n IEnumerable includes = this.getIncludeFactory().getIncludes(this.obj);\r\n foreach (BuildObject child in includes)\r\n {\r\n shallowDeps.Add(child);\r\n transitiveDeps.AddRange(this.factory(child).getTransitiveIncludes());\r\n transitiveDeps.Add(child);\r\n }\r\n\r\n VirtualContents contents = new TransitiveDepsContents(shallowDeps, transitiveDeps);\r\n BuildEngine.theEngine.Repository.StoreVirtual(this.depsObj(), new Fresh(), contents);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n\r\n // Available only after this verb is Fresh.\r\n // These are called the \"transitive includes\" because from this point of view, these aren't\r\n // dependencies, they're the included files. The caller may be using them to describe\r\n // his dependencies, though.\r\n public IEnumerable getTransitiveIncludes()\r\n {\r\n TransitiveDepsContents contents =\r\n (TransitiveDepsContents)BuildEngine.theEngine.Repository.FetchVirtual(this.depsObj());\r\n return contents.transitiveDeps;\r\n }\r\n\r\n public IEnumerable getShallowIncludes()\r\n {\r\n TransitiveDepsContents contents =\r\n (TransitiveDepsContents)BuildEngine.theEngine.Repository.FetchVirtual(this.depsObj());\r\n return contents.shallowDeps;\r\n }\r\n\r\n // This is a helper method for the downstream verb's getDependencies().\r\n // It emits this verb's output token so that if this verb is\r\n // not yeat Fresh, the scheduler will strive to get this verb Executed,\r\n // plus if this verb is Fresh, tacks on all of the deps computed by\r\n // this verb.\r\n // The returned HashSet belongs to the caller, who is free\r\n // to stuff more into it.\r\n public HashSet getAvailableDeps(out DependencyDisposition ddisp)\r\n {\r\n HashSet result = new HashSet();\r\n result.Add(this.depsObj());\r\n\r\n try\r\n {\r\n result.UnionWith(this.getTransitiveIncludes());\r\n result.Add(this.obj); // Add this last, since BoogieAsmLinkVerb appears to depend on this ordering\r\n ddisp = DependencyDisposition.Complete;\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n ddisp = DependencyDisposition.Incomplete;\r\n }\r\n catch (ObjectFailedException)\r\n {\r\n ddisp = DependencyDisposition.Failed;\r\n }\r\n\r\n return result;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n try\r\n {\r\n IEnumerable includes = this.getIncludeFactory().getIncludes(this.obj);\r\n\r\n // NB evaluating eagerly so we can catch the exception here rather\r\n // than hide it in a lazy evaluation later.\r\n List result = new List(includes.Select(parent => this.factory(parent)));\r\n return result;\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n }\r\n catch (SourceConfigurationError except)\r\n {\r\n throw new SourceConfigurationError(except.Message + \" which is included by \" + this.obj.getRelativePath());\r\n }\r\n\r\n return new IVerb[] { };\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n // NB we'll either return the singleton list {obj} if obj isn't yet available,\r\n // or we'll return the entire list of deps on obj's parents.\r\n List deps = new List();\r\n this.extendDeps(deps);\r\n deps.Add(this.obj);\r\n\r\n try\r\n {\r\n IEnumerable includes = this.getIncludeFactory().getIncludes(this.obj);\r\n if (includes.Contains(this.obj))\r\n {\r\n throw new SourceConfigurationError(\"Include loop starting at \" + this.obj);\r\n }\r\n\r\n deps.AddRange(includes.Select(parent => this.factory(parent).depsObj()));\r\n ddisp = DependencyDisposition.Complete;\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n ddisp = DependencyDisposition.Incomplete;\r\n }\r\n catch (ObjectFailedException)\r\n {\r\n ddisp = DependencyDisposition.Failed;\r\n }\r\n\r\n return deps;\r\n }\r\n\r\n protected virtual void extendDeps(List deps)\r\n {\r\n }\r\n\r\n protected abstract TransitiveDepsVerb factory(BuildObject obj);\r\n\r\n protected abstract IIncludeFactory getIncludeFactory();\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/UnverifiedSentinelVirtualContents.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class UnverifiedSentinelVirtualContents\r\n : VirtualContents\r\n {\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/UserError.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal class UserError : Exception\r\n {\r\n public UserError(string msg)\r\n : base(msg)\r\n {\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/Util.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Diagnostics;\r\n using System.IO;\r\n using System.Runtime.Remoting.Metadata.W3cXsd2001;\r\n using System.Security.Cryptography;\r\n using System.Text;\r\n using System.Threading;\r\n\r\n /// \r\n /// General Utility Functions.\r\n /// \r\n public class Util\r\n {\r\n // Win32 MAX_PATH is 260 according to Internets.\r\n private const int MAX_MUNGED_LENGTH = 150;\r\n\r\n public static string hashString(string input)\r\n {\r\n byte[] buffer = new byte[input.Length * sizeof(char)];\r\n System.Buffer.BlockCopy(input.ToCharArray(), 0, buffer, 0, buffer.Length);\r\n SHA256Managed hasher = new SHA256Managed();\r\n byte[] rawHash = hasher.ComputeHash(buffer);\r\n return new SoapHexBinary(rawHash).ToString();\r\n }\r\n\r\n public static string hashFilesystemPath(string filesystemPath)\r\n {\r\n ////Logger.WriteLine(\"Hashing \" + filesystemPath);\r\n using (FileStream stream = File.OpenRead(filesystemPath))\r\n {\r\n SHA256 sha = new SHA256Managed();\r\n byte[] rawHash = sha.ComputeHash(stream);\r\n string rc = new SoapHexBinary(rawHash).ToString();\r\n ////Logger.WriteLine(\"fresh hash of \" + obj.getFilesystemPath() + \" yields \" + rc);\r\n return rc;\r\n }\r\n }\r\n\r\n public static string mungeClean(string s)\r\n {\r\n StringBuilder sb = new StringBuilder();\r\n bool lastIsLetter = false;\r\n foreach (char c in s)\r\n {\r\n if (char.IsLetter(c) || char.IsNumber(c))\r\n {\r\n sb.Append(c);\r\n lastIsLetter = true;\r\n }\r\n else\r\n {\r\n if (lastIsLetter)\r\n {\r\n sb.Append('-');\r\n }\r\n\r\n lastIsLetter = false;\r\n }\r\n }\r\n\r\n if (sb.Length > MAX_MUNGED_LENGTH)\r\n {\r\n string originalPathHash = Util.hashString(sb.ToString());\r\n int additionsLength = originalPathHash.Length + 3;\r\n sb.Remove(MAX_MUNGED_LENGTH - additionsLength, sb.Length - (MAX_MUNGED_LENGTH - additionsLength));\r\n sb.Append(\"...\");\r\n sb.Append(originalPathHash);\r\n }\r\n\r\n return sb.ToString();\r\n }\r\n\r\n // Replace characters in a filename the same way DafnySpec/DafnyCC does.\r\n public static string dafnySpecMungeName(string s)\r\n {\r\n return s.Replace('.', '_').Replace('-', '_');\r\n }\r\n\r\n // Returns null if s doesn't end with eold.\r\n public static string replaceExtension(string s, string eold, string enew)\r\n {\r\n if (s.EndsWith(eold))\r\n {\r\n return s.Substring(0, s.Length - eold.Length) + enew;\r\n }\r\n else\r\n {\r\n return null;\r\n }\r\n }\r\n\r\n /// \r\n /// Check an ASCII encoded file for the presence of bad characters\r\n /// and character combinations. What we consider bad:\r\n /// - Tab characters.\r\n /// - Carraige returns not followed by a line feed.\r\n /// - Line feeds not preceeded by a carraige return.\r\n /// \r\n /// File to check.\r\n /// True if no bad characters found. False otherwise.\r\n public static bool CheckSourceFileForBadCharacters(string sourcePath)\r\n {\r\n const int HT = 0x09; // Horizontal tab.\r\n const int LF = 0x0a; // Line feed.\r\n const int CR = 0x0d; // Carraige return.\r\n\r\n using (StreamReader reader = new StreamReader(sourcePath))\r\n {\r\n int octet;\r\n\r\n // REVIEW: Sanity check reader.CurrentEncoding here?\r\n while ((octet = reader.Read()) > 0)\r\n {\r\n switch (octet)\r\n {\r\n case CR:\r\n if (reader.Read() != LF)\r\n {\r\n return false;\r\n }\r\n\r\n break;\r\n\r\n case LF:\r\n case HT:\r\n return false;\r\n }\r\n }\r\n }\r\n\r\n return true;\r\n }\r\n\r\n public static void Assert(bool condition)\r\n {\r\n if (!condition)\r\n {\r\n Logger.WriteLine(\"Assert failure.\");\r\n Debug.Assert(condition);\r\n\r\n for (int loop = 10; loop > 0; loop--)\r\n {\r\n Logger.WriteLine(\"Something broke in assert. Attach a debugger to debug.\");\r\n Logger.WriteLine(string.Format(\"You have {0} seconds to comply.\", loop * 10));\r\n Debugger.Break();\r\n Thread.Sleep(10000);\r\n }\r\n\r\n Environment.Exit(-1);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VSProjectParser.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Xml;\r\n\r\n /// \r\n /// Mechanism for parsing Visual Studio project Files.\r\n /// Determines project dependencies and outputs.\r\n /// \r\n internal class VSProjectParser\r\n {\r\n private SourcePath projectFile;\r\n private HashSet dependencies = new HashSet();\r\n private HashSet outputs = new HashSet();\r\n private string outputType = null;\r\n private string assemblyName = null;\r\n ////private string outputPath = null;\r\n\r\n /// \r\n /// Initializes a new instance of the VSProjectParser class.\r\n /// \r\n /// Visual Studio project file to parse.\r\n public VSProjectParser(SourcePath projectFile)\r\n {\r\n this.projectFile = projectFile;\r\n this.Parse();\r\n\r\n CustomManifestParser cm = new CustomManifestParser(this.projectFile);\r\n this.dependencies.UnionWith(cm.getDependencies());\r\n this.outputs.UnionWith(cm.getOutputs());\r\n }\r\n\r\n public IEnumerable getDependencies()\r\n {\r\n return this.dependencies;\r\n }\r\n\r\n public IEnumerable getOutputs()\r\n {\r\n return this.outputs;\r\n }\r\n\r\n private void Parse()\r\n {\r\n this.dependencies.Add(this.projectFile);\r\n\r\n using (XmlTextReader reader = new XmlTextReader(IronRootDirectory.PathTo(this.projectFile)))\r\n {\r\n while (reader.Read())\r\n {\r\n if (reader.NodeType == XmlNodeType.Element)\r\n {\r\n if (string.Compare(reader.Name, \"Compile\") == 0)\r\n {\r\n this.dependencies.Add(this.projectFile.getNewSourcePath(reader.GetAttribute(\"Include\")));\r\n }\r\n else if (string.Compare(reader.Name, \"PropertyGroup\") == 0)\r\n {\r\n this.ParseOutput(reader);\r\n }\r\n }\r\n }\r\n\r\n reader.Close();\r\n }\r\n\r\n if (this.outputType != null && this.assemblyName != null) //// && outputPath != null)\r\n {\r\n string path = Path.Combine(this.projectFile.getDirPath(), string.Format(\"{0}.{1}\", this.assemblyName, this.OutputTypeToExtension(this.outputType)));\r\n ////Console.WriteLine(\"{0}: generating {1}\", this.projectFile.getRelativePath(), path);\r\n this.outputs.Add(new BuildObject(path));\r\n }\r\n else\r\n {\r\n throw new UserError(string.Format(\"Project {0} doesn't seem to have output specification in the expected format\", this.projectFile.getRelativePath()));\r\n }\r\n }\r\n\r\n private void ValidateConsistentOption(string optionName, string oldValue, string newValue)\r\n {\r\n if (oldValue == null)\r\n {\r\n return;\r\n }\r\n\r\n if (!oldValue.Equals(newValue))\r\n {\r\n throw new UserError(\r\n string.Format(\r\n \"Values for {0} not consistent across all build configurations in {1} ({2} vs {3})\",\r\n optionName,\r\n this.projectFile.getRelativePath(),\r\n oldValue,\r\n newValue));\r\n }\r\n }\r\n\r\n private void ParseOutput(XmlTextReader reader)\r\n {\r\n string lastElement = null;\r\n\r\n while (reader.Read())\r\n {\r\n if (reader.NodeType == XmlNodeType.EndElement)\r\n {\r\n lastElement = null;\r\n\r\n if (\"PropertyGroup\".Equals(reader.Name))\r\n {\r\n break;\r\n }\r\n }\r\n\r\n if (reader.NodeType == XmlNodeType.Element)\r\n {\r\n lastElement = reader.Name;\r\n }\r\n\r\n if (reader.NodeType == XmlNodeType.Text && lastElement != null)\r\n {\r\n string val = reader.Value;\r\n\r\n ////if (\"OutputPath\".Equals(lastElement))\r\n ////{\r\n //// validateConsistentOption(\"OutputPath\", outputPath, val);\r\n //// outputPath = val;\r\n ////}\r\n if (\"AssemblyName\".Equals(lastElement))\r\n {\r\n this.ValidateConsistentOption(\"AssemblyName\", this.assemblyName, val);\r\n this.assemblyName = val;\r\n }\r\n\r\n if (\"OutputType\".Equals(lastElement))\r\n {\r\n this.ValidateConsistentOption(\"OutputType\", this.outputType, val);\r\n this.outputType = val;\r\n }\r\n }\r\n }\r\n }\r\n\r\n private string OutputTypeToExtension(string outputType)\r\n {\r\n switch (outputType)\r\n {\r\n case \"Exe\":\r\n return \"exe\";\r\n case \"Library\":\r\n return \"dll\";\r\n default:\r\n throw new SourceConfigurationError(\"VSProjectParser doesn't know how to canonicalize \" + outputType);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VSSolutionParser.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Text.RegularExpressions;\r\n\r\n internal class VSSolutionParser\r\n {\r\n private SourcePath solutionFile;\r\n private List dependencies = new List();\r\n private List outputs = new List();\r\n\r\n public VSSolutionParser(SourcePath solutionFile)\r\n {\r\n this.solutionFile = solutionFile;\r\n this.Parse();\r\n }\r\n\r\n public IEnumerable getDependencies()\r\n {\r\n return this.dependencies;\r\n }\r\n\r\n public IEnumerable getOutputs()\r\n {\r\n return this.outputs;\r\n }\r\n\r\n private void Parse()\r\n {\r\n this.dependencies.Add(this.solutionFile);\r\n\r\n using (StreamReader stream = new StreamReader(IronRootDirectory.PathTo(this.solutionFile)))\r\n {\r\n Regex regex = new Regex(@\"Project\\([\\S]+\\)[\\s]+=[\\s]+([^$]*)\", RegexOptions.IgnoreCase);\r\n string line;\r\n\r\n while ((line = stream.ReadLine()) != null)\r\n {\r\n MatchCollection matches = regex.Matches(line);\r\n\r\n if (matches.Count > 0)\r\n {\r\n SourcePath projFile = this.solutionFile.getNewSourcePath(matches[0].Groups[1].Value.Split(\"\\\", \".ToCharArray())[5]);\r\n ////Console.WriteLine(String.Format(\"Found project file {0}\", projFile.getFilesystemPath()));\r\n VSProjectParser proj = new VSProjectParser(projFile);\r\n this.dependencies.AddRange(proj.getDependencies());\r\n this.outputs.AddRange(proj.getOutputs());\r\n }\r\n }\r\n\r\n stream.Close();\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VSSolutionVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n\r\n /// \r\n /// Verb to build a Visual Studio solution.\r\n /// \r\n internal class VSSolutionVerb\r\n : Verb, IProcessInvokeAsyncVerb\r\n {\r\n private const int Version = 5;\r\n\r\n private readonly SourcePath solutionFile;\r\n private readonly AbstractId abstractId;\r\n private readonly VSSolutionParser solutionParser;\r\n private readonly string outputPathSuffix;\r\n private readonly DafnyCompileOneVerb dafnyCompileOneVerb;\r\n\r\n private readonly bool releaseBuild;\r\n\r\n /// \r\n /// Initializes a new instance of the VSSolutionVerb class.\r\n /// \r\n /// Solution file to build.\r\n /// Optional dafny-derived-CSharp dependency.\r\n public VSSolutionVerb(SourcePath solutionFile, SourcePath optionalDafnyInput = null, bool releaseBuild = false)\r\n {\r\n this.solutionFile = solutionFile;\r\n this.abstractId = new AbstractId(this.GetType().Name, VSSolutionVerb.Version, this.solutionFile.ToString());\r\n this.releaseBuild = releaseBuild;\r\n\r\n // Parse the solution file (and project files contained in the solution).\r\n this.solutionParser = new VSSolutionParser(this.solutionFile);\r\n\r\n this.outputPathSuffix = Path.Combine(BuildEngine.theEngine.getObjRoot(), this.solutionFile.getDirPath());\r\n\r\n if (optionalDafnyInput != null)\r\n {\r\n this.dafnyCompileOneVerb = new DafnyCompileOneVerb(optionalDafnyInput);\r\n }\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n List dependencies = new List(this.solutionParser.getDependencies());\r\n if (this.dafnyCompileOneVerb != null)\r\n {\r\n dependencies.AddRange(this.dafnyCompileOneVerb.getOutputs());\r\n }\r\n\r\n return dependencies;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new IVerb[] { this.dafnyCompileOneVerb };\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n // Note that since we override the solution output directory in our\r\n // getWorker() below, we also need to override the output paths\r\n // coming from the solution parser.\r\n return from output in this.solutionParser.getOutputs() select new BuildObject(Path.Combine(this.outputPathSuffix, output.getFileName()));\r\n }\r\n\r\n public BuildObject getOutputPath()\r\n {\r\n return new BuildObject(this.outputPathSuffix);\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // If we were given an optional dafny input, let this build know about the resulting verb's output.\r\n // Note: this is deliberately written to break if someone changes DafnyCompileOneVerb to have multiple outputs.\r\n if (this.dafnyCompileOneVerb != null)\r\n {\r\n File.Copy(\r\n workingDirectory.PathTo(this.dafnyCompileOneVerb.getOutputs().Single()),\r\n Path.Combine(workingDirectory.PathTo(this.outputPathSuffix), \"DafnyDerivedInput.cs\"));\r\n }\r\n\r\n List args = new List();\r\n args.Add(string.Format(\"/p:OutDir={0}\", workingDirectory.PathTo(this.outputPathSuffix)));\r\n args.Add(string.Format(\"/p:Configuration={0}\", this.releaseBuild ? \"Release\" : \"Debug\"));\r\n ////args.Add(\"/fileLogger\"); // Uncomment to log MSBuild execution.\r\n args.Add(workingDirectory.PathTo(this.solutionFile));\r\n\r\n // TODO: Fix absolute path to MSBuild.exe (at least use %SystemRoot%)!\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n \"c:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe\",\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n failureBase: getDiagnosticsBase(),\r\n allowAbsoluteExe: true,\r\n allowAbsoluteArgs: true);\r\n }\r\n\r\n public Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n return disposition;\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/Verb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Xml;\r\n\r\n internal abstract class Verb\r\n : IVerb\r\n {\r\n public override bool Equals(object obj)\r\n {\r\n IVerb other = obj as IVerb;\r\n if (other != null)\r\n {\r\n return this.getAbstractIdentifier().Equals(other.getAbstractIdentifier());\r\n }\r\n else\r\n {\r\n return false;\r\n }\r\n }\r\n\r\n public override int GetHashCode()\r\n {\r\n return this.getAbstractIdentifier().GetHashCode();\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return this.getAbstractIdentifier().ToString();\r\n }\r\n\r\n public int CompareTo(object other)\r\n {\r\n return this.getAbstractIdentifier().CompareTo(((IVerb)other).getAbstractIdentifier());\r\n }\r\n\r\n public abstract IEnumerable getDependencies(out DependencyDisposition ddisp);\r\n\r\n public abstract IEnumerable getVerbs();\r\n\r\n public abstract IEnumerable getOutputs();\r\n\r\n public virtual BuildObject getDiagnosticsBase()\r\n {\r\n return new BuildObject(Path.Combine(\r\n BuildEngine.theEngine.getObjRoot(), \"diagnostics\", Util.mungeClean(this.getAbstractIdentifier().ToString())));\r\n }\r\n\r\n public virtual IEnumerable getFailureOutputs()\r\n {\r\n return new BuildObject[]\r\n {\r\n this.getDiagnosticsBase().makeOutputObject(\".bat\"),\r\n this.getDiagnosticsBase().makeOutputObject(\".stdout\"),\r\n this.getDiagnosticsBase().makeOutputObject(\".stderr\"),\r\n };\r\n }\r\n\r\n public abstract IVerbWorker getWorker(WorkingDirectory workingDirectory);\r\n\r\n // Called by tool when this is the top-level output, it has generated a Fresh\r\n // result, and we want to print that result on the display.\r\n public virtual Presentation getPresentation()\r\n {\r\n PresentationBuilder pr = new PresentationBuilder();\r\n pr.line(\"Okay.\");\r\n return pr.fix();\r\n }\r\n\r\n // Called by tool when we want a short (one-line)\r\n // summary for showing in-progress results.\r\n public virtual Presentation getRealtimePresentation(Disposition d)\r\n {\r\n PresentationBuilder pr = new PresentationBuilder();\r\n pr.startLine();\r\n pr.color(\r\n d is Fresh ? Presentation.GREEN : Presentation.RED,\r\n this.ToString() + \" \" + d.ToString());\r\n pr.endLine();\r\n if (d is Failed)\r\n {\r\n // This isn't a verification failure, a tool itself broke.\r\n // Provide that report.\r\n foreach (string m in d.getMessages())\r\n {\r\n pr.pre(Presentation.abbreviateLines(m));\r\n }\r\n }\r\n\r\n return pr.fix();\r\n }\r\n\r\n ////////////////////////////////////////////////////\r\n\r\n // Handy helper for verbs using ProcessInvoker.\r\n private bool cpuTimeSecondsValid = false;\r\n private double cpuTimeSeconds;\r\n\r\n public virtual void RecordProcessInvokeCpuTime(double cpuTimeSeconds)\r\n {\r\n this.cpuTimeSeconds = cpuTimeSeconds;\r\n this.cpuTimeSecondsValid = true;\r\n }\r\n\r\n public static string XML_SubprocessTiming = \"SubprocessTiming\";\r\n public static string XML_SubprocessTiming_Valid_Attr = \"Valid\";\r\n public static string XML_SubprocessTiming_CPUTimeSeconds_Attr = \"CPUTimeSeconds\";\r\n\r\n public void writeTimingXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(XML_SubprocessTiming);\r\n xw.WriteAttributeString(XML_SubprocessTiming_Valid_Attr, this.cpuTimeSecondsValid.ToString());\r\n if (this.cpuTimeSecondsValid)\r\n {\r\n xw.WriteAttributeString(XML_SubprocessTiming_CPUTimeSeconds_Attr, this.cpuTimeSeconds.ToString());\r\n }\r\n\r\n xw.WriteEndElement();\r\n }\r\n\r\n ////////////////////////////////////////////////////\r\n\r\n public abstract AbstractId getAbstractIdentifier();\r\n\r\n public static string XML_DebugVerb = \"DebugVerb\";\r\n public static string XML_DebugVerb_Value_Attr = \"value\";\r\n\r\n public static string XML_DebugDep = \"DebugDep\";\r\n public static string XML_DebugDep_Name_Attr = \"name\";\r\n public static string XML_DebugDep_Hash_Attr = \"hash\";\r\n\r\n public void writeDebugXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(XML_DebugVerb);\r\n xw.WriteAttributeString(XML_DebugVerb_Value_Attr, this.getAbstractIdentifier().ToString());\r\n xw.WriteEndElement();\r\n\r\n DependencyDisposition ddisp;\r\n foreach (BuildObject obj in this.getDependencies(out ddisp))\r\n {\r\n xw.WriteStartElement(XML_DebugDep);\r\n xw.WriteAttributeString(XML_DebugDep_Name_Attr, obj.getRelativePath());\r\n if (!(obj is VirtualBuildObject))\r\n {\r\n string hash = BuildEngine.theEngine.Repository.GetHash(obj);\r\n if (string.IsNullOrEmpty(hash))\r\n {\r\n // REVIEW: Can this happen? Do something else here?\r\n hash = \"unknown\";\r\n }\r\n\r\n xw.WriteAttributeString(\r\n XML_DebugDep_Hash_Attr,\r\n hash);\r\n }\r\n\r\n xw.WriteEndElement();\r\n }\r\n\r\n Util.Assert(ddisp == DependencyDisposition.Complete);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VerbOutputsContext.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class VerbOutputsContext\r\n : IncludePathContext\r\n {\r\n private IVerb sourceVerb;\r\n private string descr;\r\n private HashSet dafnyOutputs;\r\n private bool assertSuspiciousDafnyImpls;\r\n\r\n public VerbOutputsContext(IVerb sourceVerb, bool assertSuspiciousDafnyImpls)\r\n {\r\n this.sourceVerb = sourceVerb;\r\n this.descr = \"VerbOutputs(\" + sourceVerb + \")\";\r\n this.assertSuspiciousDafnyImpls = assertSuspiciousDafnyImpls;\r\n }\r\n\r\n private HashSet DafnyOutputs\r\n {\r\n get\r\n {\r\n if (this.dafnyOutputs == null)\r\n {\r\n this.dafnyOutputs = new HashSet(this.sourceVerb.getOutputs());\r\n }\r\n\r\n return this.dafnyOutputs;\r\n }\r\n }\r\n\r\n public override string ToString()\r\n {\r\n return this.descr;\r\n }\r\n\r\n public override BuildObject search(string basename, ModPart modPart)\r\n {\r\n // Kinda linear.\r\n ////Logger.WriteLine(\"Looking for \" + basename);\r\n foreach (BuildObject obj in this.DafnyOutputs)\r\n {\r\n if (BeatExtensions.whichPart(obj) != modPart)\r\n {\r\n continue;\r\n }\r\n\r\n ////Logger.WriteLine(\" trying \" + obj.getFileNameWithoutExtension() + \" from \" + obj);\r\n\r\n if (string.Equals(obj.getFileNameWithoutExtension(), basename, StringComparison.OrdinalIgnoreCase))\r\n {\r\n if (this.assertSuspiciousDafnyImpls)\r\n {\r\n DafnyCCVerb.AssertSmellsImplementy(obj);\r\n }\r\n\r\n return obj;\r\n }\r\n }\r\n\r\n return null;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VerbOutputsContextVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n /// \r\n /// This verb waits for a parent verb to complete, then emits\r\n /// a ContextContents that searches the parent verb's results.\r\n /// \r\n internal class VerbOutputsContextVerb\r\n : ContextGeneratingVerb\r\n {\r\n private IVerb parent;\r\n private bool assertSuspiciousDafnyImpls;\r\n\r\n public VerbOutputsContextVerb(IVerb parent, bool assertSuspiciousDafnyImpls)\r\n : base(parent.getAbstractIdentifier().ToString(), null)\r\n {\r\n this.parent = parent;\r\n this.assertSuspiciousDafnyImpls = assertSuspiciousDafnyImpls;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n ddisp = DependencyDisposition.Complete;\r\n\r\n // I really don't care how many outputs the parent has; any one will\r\n // link me to the parent.\r\n IEnumerable result = this.parent.getOutputs();\r\n Util.Assert(result.Count() > 0);\r\n return result;\r\n }\r\n\r\n public override IEnumerable getVerbs()\r\n {\r\n return new IVerb[] { this.parent };\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n VerbOutputsContext context = new VerbOutputsContext(this.parent, this.assertSuspiciousDafnyImpls);\r\n ContextContents contents = new ContextContents(context);\r\n BuildEngine.theEngine.Repository.StoreVirtual(this.getContextOutput(), new Fresh(), contents);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VerbRunner.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Threading;\r\n\r\n /// \r\n /// Infrastructure for performing VerbWorker work, possibly asynchronously.\r\n /// Conceptually, this is the part of the scheduler that runs verbs.\r\n /// \r\n /// \r\n /// There is only one instance of this class in the system.\r\n /// \r\n internal class VerbRunner\r\n {\r\n /// \r\n /// Whether or not to run in a special debugging mode where everything\r\n /// is run on a single thread (including any 'async' work).\r\n /// \r\n /// \r\n /// Without this, JonH reported problems: \"Breaking and examining\r\n /// variables on a second thread seems to send VS into fits\".\r\n /// \r\n private const bool DebugOneThread = false;\r\n\r\n /// \r\n /// A sorter of verbs (special case for DafnyVerifyOneVerb only?).\r\n /// \r\n private VerbToposorter verbToposorter;\r\n\r\n /// \r\n /// Event used to signal the completion of some (possibly asynchronous)\r\n /// work.\r\n /// \r\n private ManualResetEvent completionEvent;\r\n\r\n /// \r\n /// Lock protecting the runnableVerbs and startedVerbs collections.\r\n /// \r\n private ReaderWriterLock verbStateLock;\r\n\r\n /// \r\n /// Verbs that have been submitted, but have not yet started to run.\r\n /// \r\n private HashSet runnableVerbs;\r\n\r\n /// \r\n /// Verbs that have started to run (and may or may not have\r\n /// completed; once added we never remove them from this collection).\r\n /// \r\n private HashSet startedVerbs;\r\n\r\n /// \r\n /// Degree of asynchronicity to allow (i.e. number of async threads).\r\n /// \r\n private int jobParallelism;\r\n\r\n /// \r\n /// Lock protecting the taskCompletions list.\r\n /// \r\n private ReaderWriterLock taskCompletionsLock;\r\n\r\n /// \r\n /// Tasks that have completed running, but not yet processed.\r\n /// \r\n private List taskCompletions;\r\n\r\n /// \r\n /// Number of currently running tasks.\r\n /// \r\n private int runningTasks;\r\n\r\n /// \r\n /// Initializes a new instance of the VerbRunner class.\r\n /// \r\n /// The verb sorter to use.\r\n /// Degree of parallelism to allow.\r\n public VerbRunner(VerbToposorter verbToposorter, int jobParallelism)\r\n {\r\n this.verbToposorter = verbToposorter;\r\n this.jobParallelism = jobParallelism;\r\n this.completionEvent = new ManualResetEvent(true);\r\n\r\n this.verbStateLock = new ReaderWriterLock();\r\n this.runnableVerbs = new HashSet();\r\n this.startedVerbs = new HashSet();\r\n\r\n this.taskCompletionsLock = new ReaderWriterLock();\r\n this.taskCompletions = new List();\r\n\r\n this.runningTasks = 0;\r\n }\r\n\r\n /// \r\n /// Submits a verb for execution.\r\n /// \r\n /// The verb to submit.\r\n public void submitVerb(IVerb verb)\r\n {\r\n this.verbStateLock.AcquireWriterLock(Timeout.Infinite);\r\n\r\n // If lock contention were an issue, we could accumulate these\r\n // on a thread-local collection, then batch them into runnableVerbs\r\n // during the lock inside scheduleAndWait.\r\n if (!this.startedVerbs.Contains(verb))\r\n {\r\n this.runnableVerbs.Add(verb);\r\n }\r\n\r\n this.verbStateLock.ReleaseLock();\r\n }\r\n\r\n /// \r\n /// Called by the scheduler to run the verbs which can be run.\r\n /// \r\n /// \r\n /// The scheduler calling us (for debugging).\r\n /// \r\n /// A list of tasks (verb runs) that have completed.\r\n public List scheduleAndWait(Scheduler dbgScheduler)\r\n {\r\n while (true)\r\n {\r\n List taskCompletionBatch;\r\n\r\n // Loop until something gets done.\r\n while (true)\r\n {\r\n this.dbgUpdateProgress(dbgScheduler);\r\n\r\n this.taskCompletionsLock.AcquireWriterLock(Timeout.Infinite);\r\n taskCompletionBatch = this.taskCompletions;\r\n this.taskCompletions = new List();\r\n this.completionEvent.Reset();\r\n this.taskCompletionsLock.ReleaseLock();\r\n\r\n bool canProcessCompletedTask = taskCompletionBatch.Count() > 0;\r\n bool canStartNewTask = (this.runnableVerbs.Count() > 0) && (this.jobParallelism > this.runningTasks);\r\n if (!(canProcessCompletedTask || canStartNewTask))\r\n {\r\n // Nothing will change until a running task finishes. Snooze.\r\n if (this.runningTasks == 0)\r\n {\r\n dbgScheduler.dbgDumpWaitIndex();\r\n Util.Assert(false);\r\n }\r\n\r\n this.completionEvent.WaitOne();\r\n continue;\r\n }\r\n\r\n break;\r\n }\r\n\r\n int numCompletedTasks = taskCompletionBatch.Count();\r\n Say(string.Format(\"marking {0} tasks completing; runningTasks now {1}\", numCompletedTasks, this.runningTasks));\r\n this.runningTasks -= numCompletedTasks;\r\n\r\n int idleTasks = this.jobParallelism - this.runningTasks;\r\n\r\n if (idleTasks > 0)\r\n {\r\n this.verbStateLock.AcquireWriterLock(Timeout.Infinite);\r\n\r\n List runnableVerbsBatch = new List(this.runnableVerbs);\r\n Say(\"AsyncRunner toposorting \" + runnableVerbsBatch.Count() + \" verbs\");\r\n runnableVerbsBatch.Sort(this.verbToposorter);\r\n\r\n ////Logger.WriteLine(string.Format(\"verbToposorter({0}) yields:\", runnableVerbsBatch.Count));\r\n ////foreach (IVerb verb in runnableVerbsBatch)\r\n ////{\r\n //// Logger.WriteLine(\" \" + verb.ToString() + \" @ \"+ this.verbToposorter.getDepth(verb));\r\n ////}\r\n\r\n for (int i = 0; i < idleTasks && i < runnableVerbsBatch.Count(); i++)\r\n {\r\n IVerb verb = runnableVerbsBatch[i];\r\n this.startTask(verb);\r\n this.runnableVerbs.Remove(verb);\r\n this.startedVerbs.Add(verb);\r\n }\r\n\r\n this.verbStateLock.ReleaseLock();\r\n }\r\n\r\n if (taskCompletionBatch.Count() > 0 || this.runningTasks == 0)\r\n {\r\n // Something actually got done, so the caller could meaningfully schedule more work.\r\n return taskCompletionBatch;\r\n }\r\n }\r\n }\r\n\r\n /// \r\n /// Writes debugging output to the logger.\r\n /// \r\n /// The message to write.\r\n private static void Say(string msg)\r\n {\r\n if (Scheduler.Debug)\r\n {\r\n#pragma warning disable 162\r\n Logger.WriteLine(\"[async] \" + msg);\r\n#pragma warning restore 162\r\n }\r\n }\r\n\r\n /// \r\n /// Reports current progress to the scheduler.\r\n /// \r\n /// The scheduler.\r\n private void dbgUpdateProgress(Scheduler dbgScheduler)\r\n {\r\n dbgScheduler.dbgUpdateProgress(this.runnableVerbs.Count(), this.runningTasks);\r\n }\r\n\r\n /// \r\n /// Starts a task (i.e. runs a verb).\r\n /// \r\n /// The verb to run.\r\n private void startTask(IVerb verb)\r\n {\r\n this.runningTasks += 1;\r\n\r\n // We execute the verb in a private build tree (WorkingDirectory).\r\n WorkingDirectory workingDirectory = new WorkingDirectory(BuildEngine.theEngine.getIronRoot());\r\n\r\n // Note that we call PrepareForVerb prior to the verb's getWorker\r\n // method as the getWorker call might do some of the work directly.\r\n // REVIEW: We might want to change our contract with getWorker to\r\n // disallow it from touching files in the working directory (so we\r\n // don't have to prep the working dir in the remote execution case).\r\n this.PrepareForVerb(workingDirectory, verb);\r\n\r\n IVerbWorker worker = verb.getWorker(workingDirectory);\r\n if (worker.IsSync() == VerbWorkerType.Sync)\r\n {\r\n this.completeTask(verb, worker);\r\n }\r\n else\r\n {\r\n AsyncVerbTask task = new AsyncVerbTask(this, worker, verb);\r\n Say(string.Format(\"scheduling {0}\", verb));\r\n#pragma warning disable 162\r\n if (DebugOneThread)\r\n {\r\n task.Run();\r\n }\r\n else\r\n {\r\n new Thread(new ThreadStart(task.Run)).Start();\r\n }\r\n#pragma warning restore 162\r\n }\r\n }\r\n\r\n /// \r\n /// Prepares the working directory tree for a verb's execution.\r\n /// \r\n /// The verb whose execution we're preparing for.\r\n private void PrepareForVerb(WorkingDirectory workingDirectory, IVerb verb)\r\n {\r\n // Debugging aide: write out the abstract id for this verb.\r\n File.WriteAllText(workingDirectory.PathTo(\"Debug.txt\"), verb.getAbstractIdentifier().ToString());\r\n\r\n Repository repository = BuildEngine.theEngine.Repository;\r\n\r\n // Copy all verb inputs from the item cache to here.\r\n DependencyDisposition ddisp;\r\n foreach (BuildObject input in verb.getDependencies(out ddisp))\r\n {\r\n if (!(input is VirtualBuildObject))\r\n {\r\n workingDirectory.CreateDirectoryFor(input); // REVIEW: No longer needed?\r\n repository.Fetch(workingDirectory, input);\r\n }\r\n }\r\n\r\n // Ensures that the directory tree for each of the verb's outputs exists.\r\n foreach (BuildObject output in verb.getOutputs())\r\n {\r\n workingDirectory.CreateDirectoryFor(output);\r\n }\r\n }\r\n\r\n /// \r\n /// Completes a task (verb run).\r\n /// \r\n /// \r\n /// Note that for Async verb workers, this method runs on a separate thread.\r\n /// \r\n /// The verb which was run.\r\n /// The verb's worker.\r\n private void completeTask(IVerb verb, IVerbWorker worker)\r\n {\r\n this.taskCompletionsLock.AcquireWriterLock(Timeout.Infinite);\r\n Disposition disp = worker.Complete();\r\n TaskCompletion tc = new TaskCompletion(worker.GetWorkingDirectory(), verb, disp);\r\n this.taskCompletions.Add(tc);\r\n this.completionEvent.Set();\r\n this.taskCompletionsLock.ReleaseWriterLock();\r\n }\r\n\r\n /// \r\n /// Represents a completed task.\r\n /// Ties a Disposition to the Verb instance which created it.\r\n /// \r\n /// \r\n /// REVIEW: Keep the entire worker instead of just the working dir?\r\n /// Might want to run worker.Complete on main thread after pulling this\r\n /// off the task completions list instead of on separate thread prior to\r\n /// putting it on the task completions list.\r\n /// \r\n public class TaskCompletion\r\n {\r\n /// \r\n /// The directory the verb executed in.\r\n /// \r\n public WorkingDirectory workingDirectory;\r\n\r\n /// \r\n /// The verb whose completion this instance describes.\r\n /// \r\n public IVerb verb;\r\n\r\n /// \r\n /// The disposition of this task.\r\n /// \r\n public Disposition disposition;\r\n\r\n /// \r\n /// Initializes a new instance of the TaskCompletion class.\r\n /// \r\n /// \r\n /// The private working directory the task executed in.\r\n /// \r\n /// \r\n /// The verb whose completion this instance describes.\r\n /// \r\n /// \r\n /// The disposition of this task.\r\n /// \r\n public TaskCompletion(WorkingDirectory workingDirectory, IVerb verb, Disposition disposition)\r\n {\r\n this.workingDirectory = workingDirectory;\r\n this.verb = verb;\r\n this.disposition = disposition;\r\n }\r\n }\r\n\r\n /// \r\n /// Representation of an asynchronous task.\r\n /// \r\n /// \r\n /// REVIEW: Do we need this class? It is 1:1 with the worker.\r\n /// \r\n private class AsyncVerbTask\r\n {\r\n /// \r\n /// The verb-running part of the scheduler.\r\n /// \r\n private VerbRunner runner;\r\n\r\n /// \r\n /// The worker of this verb task.\r\n /// \r\n private IVerbWorker worker;\r\n\r\n /// \r\n /// The verb associated with this task/worker.\r\n /// \r\n /// \r\n /// Don't call any methods on this guy while on async thread!\r\n /// It's just here to carry back to the TaskCompletion on the main thread.\r\n /// \r\n private IVerb verb;\r\n\r\n /// \r\n /// Initializes a new instance of the AsyncVerbTask class.\r\n /// \r\n /// \r\n /// The verb running part of the scheduler.\r\n /// \r\n /// \r\n /// The worker of this verb task.\r\n /// \r\n /// \r\n /// The verb associated with this task/worker.\r\n /// \r\n public AsyncVerbTask(VerbRunner runner, IVerbWorker worker, IVerb verb)\r\n {\r\n this.runner = runner;\r\n this.worker = worker;\r\n this.verb = verb;\r\n }\r\n\r\n /// \r\n /// Runs the task.\r\n /// \r\n /// \r\n /// Note that this method runs on a separate thread.\r\n /// Only make thread-safe calls from here.\r\n /// \r\n public void Run()\r\n {\r\n Say(string.Format(\"launching {0}\", this.verb));\r\n Logger.WriteLine(string.Format(\"{0} launched\", this.verb));\r\n this.worker.RunAsync();\r\n this.runner.completeTask(this.verb, this.worker);\r\n Say(string.Format(\"completed {0}\", this.verb));\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VerbSyncWorker.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n /// \r\n /// Representation of a synchronous verb worker.\r\n /// \r\n internal class VerbSyncWorker : IVerbWorker\r\n {\r\n /// \r\n /// The private working directory for this worker to work in.\r\n /// \r\n private WorkingDirectory workingDirectory;\r\n\r\n /// \r\n /// The disposition of this activity.\r\n /// \r\n private Disposition result;\r\n\r\n /// \r\n /// Initializes a new instance of the VerbSyncWorker class.\r\n /// \r\n /// \r\n /// The private working directory for this worker to work in.\r\n /// \r\n /// The Disposition to return on complete.\r\n public VerbSyncWorker(WorkingDirectory workingDirectory, Disposition result)\r\n {\r\n this.workingDirectory = workingDirectory;\r\n this.result = result;\r\n }\r\n\r\n /// \r\n /// Indicates whether this work needs to be scheduled asynchronously.\r\n /// Since this is the synchronous implementation, always returns Sync.\r\n /// \r\n /// Always returns Sync.\r\n public virtual VerbWorkerType IsSync()\r\n {\r\n return VerbWorkerType.Sync;\r\n }\r\n\r\n /// \r\n /// Gets the private working directory this verb executes in.\r\n /// \r\n /// The directory this verb executes in.\r\n public WorkingDirectory GetWorkingDirectory()\r\n {\r\n return this.workingDirectory;\r\n }\r\n\r\n /// \r\n /// Performs the asynchronous work for this worker, which for a\r\n /// synchronous worker like this one, should not exist. Therefore,\r\n /// this implementation just asserts.\r\n /// \r\n /// \r\n /// Shouldn't ever be called, since our IsSync returns Sync.\r\n /// \r\n public void RunAsync()\r\n { \r\n Util.Assert(false);\r\n }\r\n\r\n /// \r\n /// Performs the work of this synchronous worker (or whatever isn't\r\n /// done in the constructor at least).\r\n /// Returns the ultimate disposition of the activity.\r\n /// \r\n /// \r\n /// Thou shalt not return Stale.\r\n /// \r\n /// The disposition of this worker's work.\r\n public virtual Disposition Complete()\r\n {\r\n return this.result;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VerbToposorter.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n /// \r\n /// Mechanism for ordering verbs topologically.\r\n /// Used by the Scheduler and related components.\r\n /// \r\n internal class VerbToposorter\r\n : IComparer\r\n {\r\n /// \r\n /// Mapping of verbs to their verb depth.\r\n /// \r\n private Dictionary verbDepth;\r\n\r\n /// \r\n /// Initializes a new instance of the \r\n /// class.\r\n /// \r\n public VerbToposorter()\r\n {\r\n this.verbDepth = new Dictionary();\r\n }\r\n\r\n /// \r\n /// Compares two verbs topologically.\r\n /// \r\n /// \r\n /// This is the IComparer.Compare method.\r\n /// \r\n /// One verb to compare.\r\n /// The other verb to compare.\r\n /// \r\n /// A signed integer that indicates the relative values of x and y,\r\n /// see IComparer.Compare interface.\r\n /// \r\n public int Compare(IVerb x, IVerb y)\r\n {\r\n int rc;\r\n int c0 = this.GetDepth(x) - this.GetDepth(y);\r\n if (c0 != 0)\r\n {\r\n rc = c0;\r\n }\r\n else\r\n {\r\n // Break depth ties alphabetically.\r\n rc = x.ToString().CompareTo(y.ToString());\r\n }\r\n\r\n ////Logger.WriteLine(String.Format(\"Compare({0},{1})=={2}\", x, y, rc));\r\n return rc;\r\n }\r\n\r\n /// \r\n /// Gets the \"depth\" (dependency order) of a verb.\r\n /// \r\n /// The verb in question.\r\n /// The verb depth.\r\n private int GetDepth(IVerb verb)\r\n {\r\n if (this.verbDepth.ContainsKey(verb))\r\n {\r\n return this.verbDepth[verb];\r\n }\r\n\r\n int depth;\r\n DafnyVerifyOneVerb vone = verb as DafnyVerifyOneVerb;\r\n if (vone != null)\r\n {\r\n int deepestParent = -1;\r\n foreach (SourcePath sourcePath in vone.getDirectIncludes())\r\n {\r\n IVerb parent = new DafnyVerifyOneVerb(sourcePath);\r\n int parentDepth = this.GetDepth(parent);\r\n deepestParent = Math.Max(deepestParent, parentDepth);\r\n }\r\n\r\n depth = deepestParent + 1;\r\n }\r\n else\r\n {\r\n // Right now we only care about ordering the DafnyVerifyOneVerbs\r\n // wrt one another. Other verbs will be constrained by build\r\n // dependency anyway.\r\n depth = 0;\r\n }\r\n\r\n this.verbDepth[verb] = depth;\r\n return depth;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VerificationMessage.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Xml;\r\n\r\n internal class VerificationMessage\r\n {\r\n public const string _xml_tag = \"VerificationMessage\";\r\n private const string _xml_message_sourcefile_attr = \"SourceFile\";\r\n\r\n private string sourceLabel;\r\n private string message;\r\n\r\n public VerificationMessage(string sourceLabel, string message)\r\n {\r\n this.sourceLabel = sourceLabel;\r\n this.message = message;\r\n }\r\n\r\n public string SourceLabel\r\n {\r\n get { return this.sourceLabel; }\r\n }\r\n\r\n public string Message\r\n {\r\n get { return this.message; }\r\n }\r\n\r\n public static VerificationMessage ReadXml(XmlReader xr)\r\n {\r\n Util.Assert(xr.Name.Equals(VerificationMessage._xml_tag));\r\n string relSourcePath = xr.GetAttribute(VerificationMessage._xml_message_sourcefile_attr);\r\n string message = xr.ReadElementContentAsString();\r\n return new VerificationMessage(relSourcePath, message);\r\n }\r\n\r\n public void WriteXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(VerificationMessage._xml_tag);\r\n xw.WriteAttributeString(VerificationMessage._xml_message_sourcefile_attr, this.sourceLabel);\r\n xw.WriteString(this.message);\r\n xw.WriteEndElement();\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VerificationObligationList.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n using System.Linq;\r\n using System.Text;\r\n using System.Threading.Tasks;\r\n\r\n internal class VerificationObligationList\r\n {\r\n public const string VOL_EXTN = \".vol\"; // VOL = Verification Object List\r\n\r\n private readonly List verificationObligations;\r\n private bool complete;\r\n\r\n public VerificationObligationList()\r\n {\r\n this.verificationObligations = new List();\r\n }\r\n\r\n public VerificationObligationList(IEnumerable data)\r\n {\r\n this.verificationObligations = new List(data);\r\n this.complete = true;\r\n }\r\n\r\n public static VerificationObligationList fetch(BuildObject obj)\r\n {\r\n VerificationObligationList vol = new VerificationObligationList();\r\n using (TextReader sr = BuildEngine.theEngine.Repository.OpenRead(obj))\r\n {\r\n string line;\r\n while ((line = sr.ReadLine()) != null)\r\n {\r\n Util.Assert(!line.StartsWith(BuildEngine.theEngine.getSrcRoot())); // unimplemented\r\n Util.Assert(!line.StartsWith(BuildEngine.theEngine.getVirtualRoot())); // nonsense\r\n vol.Add(new BuildObject(line));\r\n }\r\n }\r\n\r\n vol.complete = true;\r\n return vol;\r\n }\r\n\r\n public void Add(BuildObject obj)\r\n {\r\n Util.Assert(!this.complete);\r\n this.verificationObligations.Add(obj);\r\n }\r\n\r\n public IEnumerable getVerificationObligations()\r\n {\r\n Util.Assert(this.complete);\r\n return this.verificationObligations;\r\n }\r\n\r\n public void store(WorkingDirectory workingDirectory, BuildObject location)\r\n {\r\n this.complete = true;\r\n string[] lines = this.verificationObligations.Select(vo => vo.getRelativePath()).ToArray();\r\n File.WriteAllLines(workingDirectory.PathTo(location), lines);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VerificationRequest.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n\r\n internal class VerificationRequest\r\n {\r\n public VerifyMode verifyMode;\r\n public List selectiveVerifyModuleNames;\r\n\r\n public VerificationRequest()\r\n {\r\n this.verifyMode = VerifyMode.Verify;\r\n this.selectiveVerifyModuleNames = new List();\r\n }\r\n\r\n public enum VerifyMode\r\n {\r\n Verify,\r\n NoSymDiff,\r\n SelectiveVerify,\r\n NoVerify\r\n }\r\n\r\n public enum SymDiffMode\r\n {\r\n UseSymDiff,\r\n NoSymDiff\r\n }\r\n\r\n public bool isComplete()\r\n {\r\n return this.verifyMode == VerifyMode.Verify;\r\n }\r\n\r\n public override string ToString()\r\n {\r\n if (this.verifyMode == VerifyMode.SelectiveVerify)\r\n {\r\n return this.verifyMode.ToString() + \"(\" + string.Join(\",\", this.selectiveVerifyModuleNames) + \")\";\r\n }\r\n else\r\n {\r\n return this.verifyMode.ToString();\r\n }\r\n }\r\n\r\n public SymDiffMode getSymDiffMode()\r\n {\r\n return this.verifyMode == VerifyMode.Verify ? SymDiffMode.UseSymDiff : SymDiffMode.NoSymDiff;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VerificationResult.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Text.RegularExpressions;\r\n using System.Xml;\r\n\r\n internal class VerificationResult\r\n{\r\n\tpublic const string _VERIFICATION_RESULT_PLACEHOLDER = \"_VERIFICATION_RESULT_PLACEHOLDER\";\r\n\r\n public const string _xml_tag = \"VerificationResult\";\r\n\r\n private const string _xml_sourcePath_attr = \"SourcePath\";\r\n private const string _xml_outcome_attr = \"Outcome\";\r\n private const string _xml_parseFailures_attr = \"ParseFailures\";\r\n private const string _xml_verificationFailures_attr = \"VerificationFailures\";\r\n private const string _xml_timeouts_attr = \"Timeouts\";\r\n private const string _xml_cputime_attr = \"CPUTime\";\r\n private const string _xml_message_tag = \"Message\";\r\n private const string _xml_message_sourcefile_attr = \"SourceFile\";\r\n\r\n private const string PASS = \"pass\";\r\n private const string FAIL = \"fail\";\r\n\r\n private static Regex whitespace = new Regex(\"^\\\\s*$\");\r\n\r\n private string _sourceLabel;\r\n private bool _pass;\r\n private double _cpuTime;\r\n private int _parseFailures;\r\n private int _verificationFailures;\r\n private int _timeouts;\r\n private List messages;\r\n private Presentation _presentation;\r\n\r\n public VerificationResult(string sourceLabel, double cpuTime, string stdout, string stderr, IVerificationResultParser parser)\r\n {\r\n this._sourceLabel = sourceLabel;\r\n this._cpuTime = cpuTime;\r\n this.messages = new List();\r\n\r\n // REVIEW: Switch from whitespace Regex to string.IsNullOrWhiteSpace()?\r\n if (!whitespace.Match(stdout).Success)\r\n {\r\n this.messages.Add(new VerificationMessage(sourceLabel, stdout));\r\n }\r\n\r\n if (!whitespace.Match(stderr).Success)\r\n {\r\n this.messages.Add(new VerificationMessage(sourceLabel, stderr));\r\n }\r\n\r\n this._parseFailures = 0;\r\n this._verificationFailures = 0;\r\n this._timeouts = 0;\r\n parser.parseOutput(stdout + stderr, out this._parseFailures, out this._verificationFailures, out this._timeouts);\r\n this._pass = this._parseFailures == 0 && this._verificationFailures == 0 && this._timeouts == 0;\r\n }\r\n\r\n public VerificationResult(string sourceLabel, bool pass, double cpuTime, int parseFailures, int verificationFailures, int timeouts, IEnumerable messages)\r\n {\r\n this._sourceLabel = sourceLabel;\r\n this._pass = pass;\r\n this._cpuTime = cpuTime;\r\n this._parseFailures = parseFailures;\r\n this._verificationFailures = verificationFailures;\r\n this._timeouts = timeouts;\r\n this.messages = new List(messages);\r\n }\r\n\r\n private VerificationResult()\r\n {\r\n }\r\n\r\n public string sourceLabel\r\n {\r\n get { return this._sourceLabel; }\r\n }\r\n\r\n public bool pass\r\n {\r\n get { return this._pass; }\r\n }\r\n\r\n public double cpuTime\r\n {\r\n get { return this._cpuTime; }\r\n }\r\n\r\n public int parseFailures\r\n {\r\n get { return this._parseFailures; }\r\n }\r\n\r\n public int verificationFailures\r\n {\r\n get { return this._verificationFailures; }\r\n }\r\n\r\n public int timeouts\r\n {\r\n get { return this._timeouts; }\r\n }\r\n\r\n public Presentation presentation\r\n {\r\n get { return this._presentation; }\r\n }\r\n\r\n public static VerificationResult fromXmlFile(BuildObject obj)\r\n {\r\n using (TextReader ins = BuildEngine.theEngine.Repository.OpenRead(obj))\r\n {\r\n XmlReader xr = XmlReader.Create(ins);\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n break;\r\n }\r\n }\r\n\r\n return readXml(xr);\r\n }\r\n }\r\n\r\n public static VerificationResult readXml(XmlReader xr)\r\n {\r\n Util.Assert(xr.Name.Equals(_xml_tag));\r\n VerificationResult rc = new VerificationResult();\r\n rc._sourceLabel = xr.GetAttribute(_xml_sourcePath_attr);\r\n string outcome = xr.GetAttribute(_xml_outcome_attr);\r\n if (outcome.Equals(PASS))\r\n {\r\n rc._pass = true;\r\n }\r\n else if (outcome.Equals(FAIL))\r\n {\r\n rc._pass = false;\r\n }\r\n else\r\n {\r\n throw new Exception(\"Invalid outcome value \" + outcome);\r\n }\r\n\r\n rc._cpuTime = Double.Parse(xr.GetAttribute(_xml_cputime_attr));\r\n rc._parseFailures = Int32.Parse(xr.GetAttribute(_xml_parseFailures_attr));\r\n rc._verificationFailures = Int32.Parse(xr.GetAttribute(_xml_verificationFailures_attr));\r\n rc._timeouts = Int32.Parse(xr.GetAttribute(_xml_timeouts_attr));\r\n rc.messages = new List();\r\n\r\n while (xr.Read())\r\n {\r\n if (xr.NodeType == XmlNodeType.EndElement)\r\n {\r\n Util.Assert(xr.Name.Equals(_xml_tag));\r\n break;\r\n }\r\n else if (xr.NodeType == XmlNodeType.Element)\r\n {\r\n if (xr.Name.Equals(VerificationMessage._xml_tag))\r\n {\r\n rc.messages.Add(VerificationMessage.ReadXml(xr));\r\n }\r\n else if (xr.Name.Equals(Presentation._xml_tag))\r\n {\r\n rc._presentation = Presentation.fromXml(xr.ReadSubtree());\r\n }\r\n else\r\n {\r\n throw new Exception(\"Unknown xml tag \" + xr.Name);\r\n }\r\n }\r\n }\r\n\r\n return rc;\r\n }\r\n\r\n public IEnumerable getMessages()\r\n {\r\n return this.messages;\r\n }\r\n\r\n public void addXmlFiller(Presentation presentation)\r\n {\r\n this._presentation = presentation;\r\n }\r\n\r\n public void toXmlFile(string path)\r\n {\r\n File.Delete(path);\r\n using (FileStream s = File.OpenWrite(path))\r\n {\r\n XmlWriterSettings settings = new XmlWriterSettings();\r\n settings.Indent = true;\r\n XmlWriter xw = XmlWriter.Create(s, settings);\r\n xw.WriteStartDocument();\r\n this.writeXml(xw);\r\n xw.Close();\r\n }\r\n }\r\n\r\n public void writeXml(XmlWriter xw)\r\n {\r\n xw.WriteStartElement(_xml_tag);\r\n xw.WriteAttributeString(_xml_sourcePath_attr, this._sourceLabel);\r\n xw.WriteAttributeString(_xml_outcome_attr, this._pass ? PASS : FAIL);\r\n xw.WriteAttributeString(_xml_cputime_attr, this._cpuTime.ToString());\r\n xw.WriteAttributeString(_xml_parseFailures_attr, this._parseFailures.ToString());\r\n xw.WriteAttributeString(_xml_verificationFailures_attr, this._verificationFailures.ToString());\r\n xw.WriteAttributeString(_xml_timeouts_attr, this._timeouts.ToString());\r\n foreach (VerificationMessage message in this.messages)\r\n {\r\n message.WriteXml(xw);\r\n }\r\n\r\n if (this._presentation != null)\r\n {\r\n this._presentation.fillXml(xw); // TODO we don't know yet how to parse this stuff back in.\r\n }\r\n\r\n xw.WriteEndElement();\r\n }\r\n\r\n public void addBasicPresentation()\r\n {\r\n PresentationBuilder pr = new PresentationBuilder();\r\n\r\n int any_failures = this.parseFailures + this.verificationFailures + this.timeouts;\r\n string overall_status = any_failures > 0 ? \"Fail\" : \"Success\";\r\n\r\n pr.pre(_VERIFICATION_RESULT_PLACEHOLDER+\"\\n\");\r\n pr.spacer();\r\n pr.startHeader();\r\n pr.color(any_failures == 0 ? Presentation.GREEN : Presentation.RED, \"Overall status: \" + overall_status);\r\n pr.endHeader();\r\n pr.line(\r\n string.Format(\r\n \"{0} parse failures, {1} verification failures, {2} timeouts\",\r\n this._parseFailures,\r\n this._verificationFailures,\r\n this._timeouts));\r\n pr.spacer();\r\n\r\n foreach (VerificationMessage message in this.messages)\r\n {\r\n pr.pre(message.Message);\r\n }\r\n\r\n Presentation pres = pr.fix();\r\n this.addXmlFiller(pres);\r\n }\r\n\r\n internal bool wasOnlyTimeouts()\r\n {\r\n return this.verificationFailures == 0 && this.timeouts > 0;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VerificationResultBoogieParser.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Text.RegularExpressions;\r\n\r\n internal class VerificationResultBoogieParser : IVerificationResultParser\r\n {\r\n private static Regex dispositionTimeoutsRegex = new Regex(\"Boogie program verifier finished with (\\\\d*) verified, (\\\\d*) errors*, (\\\\d) time outs*\");\r\n private static Regex dispositionNoTimeoutsRegex = new Regex(\"Boogie program verifier finished with (\\\\d*) verified, (\\\\d*) errors*\");\r\n private static Regex dispositionParseErrorRegex = new Regex(\"Error opening file\");\r\n private static Regex dispositionParseError2Regex = new Regex(\"(\\\\d*) parse errors detected in\");\r\n private static Regex dispositionParseError3Regex = new Regex(\"(\\\\d*) type checking errors detected in\");\r\n private static Regex dispositionParseError4Regex = new Regex(\"(\\\\d*) name resolution errors detected in\");\r\n private static Regex dispositionProverDiedRegex = new Regex(\"Prover error: Prover died\");\r\n\r\n public void parseOutput(string output, out int parseFailures, out int verificationFailures, out int timeouts)\r\n {\r\n parseFailures = 0;\r\n verificationFailures = 0;\r\n timeouts = 0;\r\n\r\n Match match = dispositionTimeoutsRegex.Match(output);\r\n if (match.Success)\r\n {\r\n ////int succeeding_methods = Int32.Parse(m.Groups[1].ToString());\r\n verificationFailures = Int32.Parse(match.Groups[2].ToString());\r\n timeouts = Int32.Parse(match.Groups[3].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionParseErrorRegex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = 1;\r\n return;\r\n }\r\n\r\n match = dispositionParseError2Regex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = Int32.Parse(match.Groups[1].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionParseError3Regex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = Int32.Parse(match.Groups[1].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionParseError4Regex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = Int32.Parse(match.Groups[1].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionProverDiedRegex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = 1;\r\n return;\r\n }\r\n\r\n match = dispositionNoTimeoutsRegex.Match(output);\r\n if (match.Success)\r\n {\r\n ////int succeeding_methods = Int32.Parse(m.Groups[1].ToString());\r\n verificationFailures = Int32.Parse(match.Groups[2].ToString());\r\n return;\r\n }\r\n\r\n parseFailures = 1;\r\n ////throw new Exception(\"Unable to parse Dafny output\");\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VerificationResultDafnyParser.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Text.RegularExpressions;\r\n\r\n internal class VerificationResultDafnyParser : IVerificationResultParser\r\n {\r\n private static Regex dispositionTimeoutsRegex = new Regex(\"Dafny program verifier finished with (\\\\d*) verified, (\\\\d*) errors*, (\\\\d) time outs*\");\r\n private static Regex dispositionNoTimeoutsRegex = new Regex(\"Dafny program verifier finished with (\\\\d*) verified, (\\\\d*) errors*\");\r\n private static Regex dispositionParseErrorRegex = new Regex(\"Error opening file\");\r\n private static Regex dispositionParseError2Regex = new Regex(\"(\\\\d*) parse errors detected in\");\r\n private static Regex dispositionParseError3Regex = new Regex(\"(\\\\d*) resolution/type errors detected in\");\r\n private static Regex dispositionProverDiedRegex = new Regex(\"Prover error: Prover died\");\r\n\r\n public void parseOutput(string output, out int parseFailures, out int verificationFailures, out int timeouts)\r\n {\r\n parseFailures = 0;\r\n verificationFailures = 0;\r\n timeouts = 0;\r\n\r\n Match match = dispositionTimeoutsRegex.Match(output);\r\n if (match.Success)\r\n {\r\n ////int succeeding_methods = Int32.Parse(m.Groups[1].ToString());\r\n verificationFailures = Int32.Parse(match.Groups[2].ToString());\r\n timeouts = Int32.Parse(match.Groups[3].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionParseErrorRegex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = 1;\r\n return;\r\n }\r\n\r\n match = dispositionParseError2Regex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = Int32.Parse(match.Groups[1].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionParseError3Regex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = Int32.Parse(match.Groups[1].ToString());\r\n return;\r\n }\r\n\r\n match = dispositionProverDiedRegex.Match(output);\r\n if (match.Success)\r\n {\r\n parseFailures = 1;\r\n return;\r\n }\r\n\r\n match = dispositionNoTimeoutsRegex.Match(output);\r\n if (match.Success)\r\n {\r\n ////int succeeding_methods = Int32.Parse(m.Groups[1].ToString());\r\n verificationFailures = Int32.Parse(match.Groups[2].ToString());\r\n return;\r\n }\r\n\r\n parseFailures = 1;\r\n Logger.WriteLine(\"NuBuild WARNING: unexpected Dafny error message; lumping into parse errors.\");\r\n ////throw new Exception(\"Unable to parse Dafny output\");\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VerificationResultSummaryVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\n\r\n internal class VerificationResultSummaryVerb\r\n : VerificationResultVerb ////, IObligationsProducer\r\n {\r\n private const string SUMMARY_EXTN = \".summary\";\r\n private const int version = 4;\r\n\r\n private BuildObject outputObject;\r\n private IObligationsProducer producer;\r\n private IEnumerable verificationResults;\r\n private AbstractId abstractId;\r\n\r\n public VerificationResultSummaryVerb(IObligationsProducer producer) \r\n {\r\n this.producer = producer;\r\n BuildObject id = producer.getObligationSet(); ////producer.getIdentifier();\r\n this.outputObject = id.makeOutputObject(id.getExtension() + SUMMARY_EXTN);\r\n this.abstractId = new AbstractId(this.GetType().Name, version, id.ToString());\r\n this.verificationResults = null;\r\n }\r\n\r\n public override AbstractId getAbstractIdentifier()\r\n {\r\n return this.abstractId;\r\n }\r\n\r\n public override IEnumerable getDependencies(out DependencyDisposition ddisp)\r\n {\r\n BuildObject obligations = this.producer.getObligationSet();\r\n HashSet deps = new HashSet();\r\n deps.Add(obligations);\r\n\r\n try\r\n {\r\n VerificationObligationList vol = VerificationObligationList.fetch(obligations);\r\n this.verificationResults = vol.getVerificationObligations();\r\n deps.UnionWith(this.verificationResults);\r\n ddisp = DependencyDisposition.Complete;\r\n }\r\n catch (ObjectNotReadyException)\r\n {\r\n ddisp = DependencyDisposition.Incomplete;\r\n }\r\n catch (ObjectFailedException)\r\n {\r\n ddisp = DependencyDisposition.Failed;\r\n }\r\n\r\n return deps;\r\n }\r\n\r\n public override IEnumerable getVerbs() \r\n {\r\n IEnumerable verbs = new IVerb[] { this.producer };\r\n\r\n verbs = verbs.Union(this.producer.getVerbs());\r\n return verbs;\r\n\r\n // VerificationResultSummaryVerb depends on objects mentioned by producer,\r\n // but the necessary verbs haven't been mentioned. Is it sufficient for\r\n // the upstream guy (BoogieAsmVerificationObligationList) to ... hopefully ...\r\n // mention them? (Hopefully because he might only be incompletely queried,\r\n // since he's not actually dependent on the verbs he's advertising.)\r\n // Maybe we should provide a way for his complete() method to push the\r\n // verbs into the cache.\r\n }\r\n\r\n public override IEnumerable getOutputs()\r\n {\r\n return new HashSet() { this.outputObject };\r\n }\r\n\r\n public override BuildObject getOutputFile()\r\n {\r\n return this.outputObject;\r\n }\r\n\r\n public BuildObject getObligationSet()\r\n {\r\n return this.producer.getObligationSet();\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // Read and aggregate all the input results.\r\n int parseFailures = 0;\r\n int verificationFailures = 0;\r\n int timeouts = 0;\r\n int filesWithParseFailures = 0;\r\n int filesWithVerificationFailures = 0;\r\n int filesWithTimeouts = 0;\r\n int passCount = 0;\r\n int failCount = 0;\r\n double cpuTime = 0;\r\n List failMessages = new List();\r\n List results = new List();\r\n\r\n // REVIEW: Why pull out the enumerator this way?\r\n IEnumerable verificationResultsEnumerator = this.verificationResults;\r\n foreach (BuildObject verificationResult in verificationResultsEnumerator)\r\n {\r\n VerificationResult vr = VerificationResult.fromXmlFile(verificationResult);\r\n results.Add(vr);\r\n if (vr == null)\r\n {\r\n return new VerbSyncWorker(\r\n workingDirectory,\r\n new Failed(\"Build system broke: missing VerificationResult for \" + verificationResult));\r\n }\r\n\r\n if (vr.pass)\r\n {\r\n passCount += 1;\r\n }\r\n else\r\n {\r\n failCount += 1;\r\n failMessages.AddRange(vr.getMessages());\r\n }\r\n\r\n parseFailures += vr.parseFailures;\r\n verificationFailures += vr.verificationFailures;\r\n timeouts += vr.timeouts;\r\n filesWithParseFailures += vr.parseFailures > 0 ? 1 : 0;\r\n filesWithVerificationFailures += vr.verificationFailures > 0 ? 1 : 0;\r\n filesWithTimeouts += vr.timeouts > 0 ? 1 : 0;\r\n ////Logger.WriteLine(\"Synthesizing cpuTime from \" + verificationResult);\r\n cpuTime += vr.cpuTime;\r\n }\r\n\r\n bool allPass = failCount == 0;\r\n\r\n PresentationBuilder pr = new PresentationBuilder();\r\n\r\n int any_failures = parseFailures + verificationFailures + timeouts;\r\n string overall_status = any_failures > 0 ? \"Fail\" : \"Success\";\r\n\r\n pr.pre(VerificationResult._VERIFICATION_RESULT_PLACEHOLDER+\"\\n\");\r\n pr.spacer();\r\n pr.startHeader();\r\n pr.color(this.colorByFailureCount(any_failures), \"Overall status: \" + overall_status);\r\n pr.endHeader();\r\n pr.line(\"Count of files with failures: \" + failCount);\r\n pr.startBullet();\r\n pr.color(this.colorByFailureCount(filesWithParseFailures), \"Files with parse failures: \" + filesWithParseFailures.ToString());\r\n pr.endBullet();\r\n pr.startBullet();\r\n pr.color(this.colorByFailureCount(filesWithVerificationFailures), \"Files with verification failures: \" + filesWithVerificationFailures.ToString());\r\n pr.endBullet();\r\n pr.startBullet();\r\n pr.color(this.colorByFailureCount(filesWithTimeouts), \"Files with timeouts: \" + filesWithTimeouts.ToString());\r\n pr.endBullet();\r\n\r\n pr.spacer();\r\n pr.header(string.Format(\"Total processing time: {0:0.0}s {1}\", cpuTime, new TimeSpan((long)(cpuTime * 10000000L))));\r\n int top_n = 10;\r\n pr.header(string.Format(\"Slowest {0} verifications:\", top_n));\r\n\r\n results.Sort(this.ByCpuTimeDecreasing);\r\n foreach (VerificationResult slowResult in results.Take(top_n))\r\n {\r\n pr.startBullet();\r\n pr.color(\r\n this.colorByFailureCount(slowResult.pass ? 0 : 1),\r\n string.Format(\"{0,6:##0.0}s {1}\", slowResult.cpuTime, slowResult.sourceLabel));\r\n pr.endBullet();\r\n }\r\n\r\n foreach (VerificationMessage message in failMessages)\r\n {\r\n pr.spacer();\r\n pr.header(\"Failure with \" + message.SourceLabel);\r\n pr.pre(message.Message);\r\n }\r\n\r\n Presentation pres = pr.fix();\r\n\r\n VerificationResult outvr = new VerificationResult(\"summary\", allPass, cpuTime, parseFailures, verificationFailures, timeouts, failMessages);\r\n outvr.addXmlFiller(pres);\r\n outvr.toXmlFile(workingDirectory.PathTo(this.outputObject));\r\n this.setWasRejectableFailure(!outvr.pass);\r\n return new VerbSyncWorker(workingDirectory, new Fresh());\r\n }\r\n \r\n public override Presentation getRealtimePresentation(Disposition d)\r\n {\r\n if (d is Failed)\r\n {\r\n return base.getRealtimePresentation(d);\r\n }\r\n\r\n VerificationResult vr = VerificationResult.fromXmlFile(this.outputObject);\r\n PresentationBuilder pr = new PresentationBuilder();\r\n pr.startLine();\r\n pr.color(\r\n vr.pass ? Presentation.GREEN : Presentation.RED,\r\n string.Format(\r\n \"{0} {1} {2,1:0.0}s\",\r\n this.getAbstractIdentifier(),\r\n vr.pass ? \"Success\" : \"Fail\",\r\n vr.cpuTime));\r\n pr.endLine();\r\n if (!vr.pass)\r\n {\r\n foreach (VerificationMessage msg in vr.getMessages())\r\n {\r\n pr.pre(msg.Message);\r\n }\r\n }\r\n\r\n return pr.fix();\r\n } \r\n\r\n public override Presentation getPresentation()\r\n {\r\n VerificationResult vr = VerificationResult.fromXmlFile(this.outputObject);\r\n return vr.presentation;\r\n }\r\n\r\n protected override BuildObject getSource()\r\n {\r\n return this.producer.getObligationSet();\r\n }\r\n\r\n private int ByCpuTimeDecreasing(VerificationResult va, VerificationResult vb)\r\n {\r\n return -(va.cpuTime.CompareTo(vb.cpuTime));\r\n }\r\n\r\n private string colorByFailureCount(int count)\r\n {\r\n return count == 0 ? Presentation.GREEN : Presentation.RED;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VerificationResultVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n internal abstract class VerificationResultVerb\r\n : Verb, IRejectable\r\n {\r\n public const string VERIFICATION_RESULT_EXTN = \".v\";\r\n\r\n private bool dbgWasVerificationTimeoutRecorded;\r\n private bool wasRejectableFailure;\r\n\r\n public abstract BuildObject getOutputFile();\r\n\r\n public override Presentation getRealtimePresentation(Disposition d)\r\n {\r\n if (d is Failed)\r\n {\r\n return base.getRealtimePresentation(d);\r\n }\r\n\r\n VerificationResult vr = VerificationResult.fromXmlFile(this.getOutputFile());\r\n PresentationBuilder pr = new PresentationBuilder();\r\n pr.startLine();\r\n pr.color(\r\n vr.pass ? Presentation.GREEN : Presentation.RED,\r\n string.Format(\r\n \"{0} {1} {2,5:0.0}s\",\r\n ////getSource().getRelativePath(),\r\n this.getAbstractIdentifier(),\r\n vr.pass ? \"Success\" : \"Fail\",\r\n vr.cpuTime));\r\n pr.endLine();\r\n if (!vr.pass)\r\n {\r\n foreach (VerificationMessage msg in vr.getMessages())\r\n {\r\n pr.pre(msg.Message);\r\n }\r\n }\r\n\r\n return pr.fix();\r\n }\r\n\r\n public override Presentation getPresentation()\r\n {\r\n VerificationResult vr = VerificationResult.fromXmlFile(this.getOutputFile());\r\n return vr.presentation;\r\n }\r\n\r\n public bool resultWasRejectableFailure()\r\n {\r\n Util.Assert(this.dbgWasVerificationTimeoutRecorded);\r\n return this.wasRejectableFailure;\r\n }\r\n\r\n protected abstract BuildObject getSource();\r\n\r\n protected void setWasRejectableFailure(bool value)\r\n {\r\n this.dbgWasVerificationTimeoutRecorded = true;\r\n this.wasRejectableFailure = value;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VirtualBuildObject.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n /// \r\n /// Representation of a virtual BuildObject.\r\n /// A VirtualBuildObject is never actually stored in the filesystem;\r\n /// it is only materialized inside the process. It's used for results\r\n /// that are easy to compute, but which still need to be established\r\n /// in dependency order. Instances: transitive deps, contexts.\r\n /// \r\n internal class VirtualBuildObject\r\n : BuildObject\r\n {\r\n /// \r\n /// Initializes a new instance of the VirtualBuildObject class.\r\n /// \r\n /// Virtual path name of the object.\r\n public VirtualBuildObject(string inpath)\r\n : base(inpath)\r\n {\r\n Util.Assert(inpath.StartsWith(BuildEngine.theEngine.getVirtualRoot(), StringComparison.OrdinalIgnoreCase));\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/VirtualContents.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n\r\n /// \r\n /// This class is perfectly named; it contains nothing.\r\n /// Serves solely as a base class for other derived classes.\r\n /// \r\n internal class VirtualContents\r\n {\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/WaitIndex.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.Linq;\r\n\r\n /// \r\n /// Used by the Scheduler to track waiting verbs and their dependencies.\r\n /// \r\n internal class WaitIndex\r\n {\r\n private Dictionary waitingVerbs;\r\n private Dictionary> fwdDeps;\r\n\r\n public WaitIndex()\r\n {\r\n this.waitingVerbs = new Dictionary();\r\n this.fwdDeps = new Dictionary>();\r\n }\r\n\r\n public int Count()\r\n {\r\n return this.waitingVerbs.Count;\r\n }\r\n\r\n public void dbgDisplayIndex(Scheduler dbgScheduler)\r\n {\r\n List waitRecords = new List(this.waitingVerbs.Values);\r\n for (int i = 0; i < waitRecords.Count(); i++)\r\n {\r\n WaitRecord wr = waitRecords[i];\r\n List depNums = new List();\r\n List unknownDeps = new List();\r\n List unscheduledDeps = new List();\r\n foreach (BuildObject dep in wr.knownDeps)\r\n {\r\n IVerb depOnVerb = dbgScheduler.getParent(dep);\r\n if (depOnVerb == null)\r\n {\r\n unknownDeps.Add(dep);\r\n }\r\n else if (!this.waitingVerbs.ContainsKey(depOnVerb))\r\n {\r\n unscheduledDeps.Add(\r\n string.Format(\r\n \"{0} waiting on {1} {2}\",\r\n dep,\r\n depOnVerb,\r\n dbgScheduler.dbgGetVerbStatus(depOnVerb)));\r\n }\r\n else\r\n {\r\n WaitRecord depWr = this.waitingVerbs[depOnVerb];\r\n depNums.Add(waitRecords.IndexOf(depWr));\r\n }\r\n }\r\n\r\n Logger.WriteLine(\r\n string.Format(\r\n \"{0}. {1} waits on ({2}), {3} unknown, {4} unscheduled\",\r\n i,\r\n wr.verb,\r\n string.Join(\",\", depNums),\r\n unknownDeps.Count(),\r\n unscheduledDeps.Count()));\r\n\r\n this.dbgPreview(\"Unknown\", unknownDeps.Select(it => it.ToString()), 3);\r\n this.dbgPreview(\"Unscheduled\", unscheduledDeps, 20);\r\n }\r\n }\r\n\r\n internal void insert(IVerb verb, IEnumerable knownDeps)\r\n {\r\n // Insert one fwd pointer for each obj verb is already known to\r\n // depend upon. The fact that this verb is waiting implies that\r\n // one of these deps is stale here and needs built/fetched.\r\n WaitRecord waitRecord = new WaitRecord(verb, knownDeps);\r\n foreach (BuildObject dep in knownDeps)\r\n {\r\n if (!this.fwdDeps.ContainsKey(dep))\r\n {\r\n this.fwdDeps.Add(dep, new HashSet());\r\n }\r\n\r\n this.fwdDeps[dep].Add(waitRecord);\r\n }\r\n\r\n this.waitingVerbs.Add(verb, waitRecord);\r\n this.Say(\"sleeps \" + verb);\r\n }\r\n\r\n // Remove any verb with obj in its dependency set.\r\n internal IEnumerable awaken(BuildObject obj)\r\n {\r\n this.Say(\"awaken \" + obj);\r\n HashSet wokenRecords;\r\n HashSet result = new HashSet();\r\n if (this.fwdDeps.ContainsKey(obj))\r\n {\r\n wokenRecords = this.fwdDeps[obj];\r\n this.fwdDeps.Remove(obj);\r\n\r\n // Remove all the other index pointers for each removed verb.\r\n foreach (WaitRecord waitRecord in wokenRecords)\r\n {\r\n foreach (BuildObject dep in waitRecord.knownDeps)\r\n {\r\n if (this.fwdDeps.ContainsKey(dep))\r\n {\r\n this.fwdDeps[dep].Remove(waitRecord);\r\n }\r\n }\r\n\r\n result.Add(waitRecord.verb);\r\n this.waitingVerbs.Remove(waitRecord.verb);\r\n this.Say(\" wakes \" + waitRecord.verb);\r\n }\r\n }\r\n else\r\n {\r\n result = new HashSet();\r\n }\r\n\r\n return result;\r\n }\r\n\r\n internal bool isWaiting(IVerb verb)\r\n {\r\n return this.waitingVerbs.ContainsKey(verb);\r\n }\r\n\r\n private void dbgPreview(string s, IEnumerable items, int max)\r\n {\r\n int i = 0;\r\n foreach (string o in items)\r\n {\r\n Logger.WriteLine(\r\n string.Format(\r\n \" {0} {1}/{2} {3}\",\r\n s,\r\n i,\r\n items.Count(),\r\n o));\r\n i += 1;\r\n if (i == max)\r\n {\r\n break;\r\n }\r\n }\r\n }\r\n \r\n private void Say(string msg)\r\n {\r\n ////Logger.WriteLine(\"[wtidx] \" + msg);\r\n }\r\n\r\n private class WaitRecord\r\n {\r\n public IVerb verb;\r\n public IEnumerable knownDeps;\r\n\r\n public WaitRecord(IVerb verb, IEnumerable knownDeps)\r\n {\r\n this.verb = verb;\r\n this.knownDeps = knownDeps;\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/WinLinkerVerb.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n internal class WinLinkerVerb : LinkerVerb\r\n {\r\n public const string WIN_APP_EXE_EXTN = \".winapp\";\r\n private const int version = 6;\r\n\r\n public WinLinkerVerb(MasmVerb masmVerb, bool isLoader) : base(masmVerb, isLoader)\r\n {\r\n }\r\n\r\n public override IVerbWorker getWorker(WorkingDirectory workingDirectory)\r\n {\r\n // TODO: We shouldn't be using absolute paths to any of these things.\r\n // Change this to allow VS and SDKs to be installed anywhere.\r\n string linker = @\"C:\\Program Files (x86)\\Microsoft Visual Studio 12.0\\VC\\bin\\link.exe\";\r\n string vc_lib_dir = @\"C:\\Program Files (x86)\\Microsoft Visual Studio 12.0\\VC\\lib\";\r\n string sdk_dir = @\"C:\\Program Files (x86)\\Windows Kits\\8.1\\Lib\\winv6.3\\um\\x86\";\r\n string kernel_lib = @\"C:\\Program Files (x86)\\Windows Kits\\8.1\\Lib\\winv6.3\\um\\x86\\kernel32.Lib\";\r\n\r\n string standalone_support_lib = getStandaloneLib().getRelativePath();\r\n SourcePath zero1 = new SourcePath(\"tools\\\\scripts\\\\zero.obj\", SourcePath.SourceType.Tools);\r\n SourcePath zero2 = new SourcePath(\"tools\\\\scripts\\\\zero2.obj\", SourcePath.SourceType.Tools);\r\n\r\n // TODO: Fail more gracefully? Or better yet, move these into iron/tools.\r\n if (!Directory.Exists(vc_lib_dir))\r\n {\r\n throw new FileNotFoundException(\"Missing Visual C++ library directory: \" + vc_lib_dir);\r\n }\r\n\r\n if (!Directory.Exists(sdk_dir) || !File.Exists(kernel_lib))\r\n {\r\n throw new FileNotFoundException(\"Missing Windows SDK libraries: \" + sdk_dir + \", \" + kernel_lib + @\". Try installing the Windows SDK from: \\\\research\\Root\\Products\\Developers\\Windows Driver Kit 8.1\");\r\n }\r\n\r\n // TODO: Unpack/generate these automatically.\r\n // TODO: Brian, we're really not going to want to cache these big, empty sources. Or compress? All big (>10MB) files.\r\n // are mostly zeros.\r\n if (!File.Exists(IronRootDirectory.PathTo(zero1)) || !File.Exists(IronRootDirectory.PathTo(zero2)))\r\n {\r\n throw new FileNotFoundException(\"Missing object files of zeroes: \" + zero1 + \", \" + zero2 + \". Try running: tools\\\\scripts\\\\build-standalone-init.sh\");\r\n }\r\n\r\n List args = new List() { \"/DEBUG\", \"/subsystem:console\", \"/LARGEADDRESSAWARE\", \"/fixed\" };\r\n args.Add(objFile.getRelativePath());\r\n args.Add(zero1.getRelativePath());\r\n args.Add(zero2.getRelativePath());\r\n args.Add(standalone_support_lib);\r\n args.Add(@\"\"\"\" + kernel_lib + @\"\"\"\");\r\n args.Add(\"\\\"/libpath:\" + vc_lib_dir + '\"');\r\n args.Add(\"\\\"/libpath:\" + sdk_dir + '\"');\r\n args.Add(\"/out:\" + outputObject.getRelativePath());\r\n args.Add(\"/entry:\" + this.entryPoint);\r\n args.Add(\"/base:\" + this.baseAddr);\r\n args.Add(\"/PDB:\" + this.getPdb());\r\n\r\n return new ProcessInvokeAsyncWorker(\r\n workingDirectory,\r\n this,\r\n linker,\r\n args.ToArray(),\r\n ProcessExitCodeHandling.NonzeroIsFailure,\r\n getDiagnosticsBase(),\r\n allowAbsoluteExe: true,\r\n allowAbsoluteArgs: true);\r\n }\r\n\r\n public override Disposition Complete(WorkingDirectory workingDirectory, double cpuTimeSeconds, string stdout, string stderr, Disposition disposition)\r\n {\r\n // No cleanup to do.\r\n return disposition;\r\n }\r\n\r\n // TODO: We should build this!\r\n protected static SourcePath getStandaloneLib()\r\n {\r\n return new SourcePath(\"tools\\\\standalone\\\\Debug\\\\StandAloneSupport.lib\", SourcePath.SourceType.Tools);\r\n }\r\n\r\n protected override IEnumerable getExtraOutputs()\r\n {\r\n List outputs = new List();\r\n outputs.Add(this.getPdb());\r\n return outputs;\r\n }\r\n\r\n protected override string outputExtension()\r\n {\r\n return WIN_APP_EXE_EXTN + LinkerVerb.UNTRUSTED_EXE_EXTN;\r\n }\r\n\r\n protected override int getVersion()\r\n {\r\n return version;\r\n }\r\n\r\n protected override IEnumerable getExtraDependencies()\r\n {\r\n return new List() { getStandaloneLib() };\r\n }\r\n\r\n private BuildObject getPdb()\r\n {\r\n return objFile.makeOutputObject(\".pdb\");\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/WorkingDirectory.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Collections.Generic;\r\n using System.IO;\r\n\r\n /// \r\n /// A directory tree in the local filesystem for a verb to operate upon.\r\n /// Verbs should not access files outside of this directory tree.\r\n /// \r\n public class WorkingDirectory\r\n {\r\n /// \r\n /// Absolute path to this working directory on the local system.\r\n /// \r\n private string path;\r\n\r\n /// \r\n /// Initializes a new instance of the WorkingDirectory class.\r\n /// \r\n /// \r\n /// Absolute path to the \"iron\" directory on the local system.\r\n /// \r\n public WorkingDirectory(string ironroot)\r\n {\r\n // REVIEW: Have \"nutemp\" hard-wired here, or passed in?\r\n this.path = Path.Combine(ironroot, \"nutemp\", Path.GetRandomFileName());\r\n Directory.CreateDirectory(this.path);\r\n }\r\n\r\n /// \r\n /// Gets the absolute path to the root of this working directory on the local system.\r\n /// \r\n public string Root\r\n {\r\n get { return this.path; }\r\n }\r\n\r\n /// \r\n /// Gets the absolute path to the given build object in this working directory.\r\n /// \r\n /// A build object.\r\n /// The absolute path to the build object.\r\n public string PathTo(BuildObject obj)\r\n {\r\n return Path.Combine(this.path, obj.getRelativePath());\r\n }\r\n\r\n /// \r\n /// Gets the absolute path corresponding to the given relative path in this working directory.\r\n /// \r\n /// Relative path to convert.\r\n /// The absolute path corresponding to the given relative path.\r\n public string PathTo(string relativePath)\r\n {\r\n return Path.Combine(this.path, relativePath);\r\n }\r\n\r\n /// \r\n /// Creates the directory in the local filesystem that corresponds\r\n /// to this instance.\r\n /// \r\n /// A build object.\r\n public void CreateDirectoryFor(BuildObject obj)\r\n {\r\n Directory.CreateDirectory(Path.Combine(this.path, obj.getDirPath()));\r\n }\r\n\r\n /// \r\n /// Gets a collection of the build objects in this directory.\r\n /// \r\n /// \r\n /// REVIEW: Return a collection of BuildObjectValuePointers instead?\r\n /// \r\n /// A collection of build objects.\r\n public IEnumerable GetContents()\r\n {\r\n List contents = new List();\r\n\r\n foreach (string fileName in Directory.EnumerateFiles(this.path))\r\n {\r\n contents.Add(new BuildObject(fileName));\r\n }\r\n\r\n return contents;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild/XmlFiller.cs", "content": "//--\r\n// \r\n// Copyright (c) Microsoft Corporation. All rights reserved.\r\n// \r\n//--\r\n\r\nnamespace NuBuild\r\n{\r\n using System;\r\n using System.Xml;\r\n\r\n /// \r\n /// REVIEW: Does this need to be an interface?\r\n /// TODO: Rename to IXmlFiller if we need to keep this.\r\n /// \r\n internal interface XmlFiller\r\n {\r\n void fillXml(XmlWriter xml);\r\n }\r\n}\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuild.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio 2013\nVisualStudioVersion = 12.0.31101.0\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"NuBuild\", \"NuBuild\\NuBuild.csproj\", \"{4D7220C0-3CAA-4659-9F16-A564DB3CCC1B}\"\nEndProject\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"ItemCacheTool\", \"ItemCacheTool\\ItemCacheTool.csproj\", \"{9A231EB8-BDA1-4304-93A1-20457C00D7D9}\"\nEndProject\nProject(\"{2150E333-8FDC-42A3-9474-1A3956D46DE8}\") = \"Solution Items\", \"Solution Items\", \"{43E97C4F-FD2F-49AD-B29A-DEACC270D91B}\"\n\tProjectSection(SolutionItems) = preProject\n\t\tSettings.StyleCop = Settings.StyleCop\n\tEndProjectSection\nEndProject\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"CloudExecutionEngine\", \"CloudExecutionEngine\\CloudExecutionEngine.csproj\", \"{2668E334-0B79-4023-A621-2D1433CE7C9E}\"\n\tProjectSection(ProjectDependencies) = postProject\n\t\t{4F3DE22C-CAE9-408B-AA54-10DCD7E12F09} = {4F3DE22C-CAE9-408B-AA54-10DCD7E12F09}\n\tEndProjectSection\nEndProject\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"CloudQueueTool\", \"CloudQueueTool\\CloudQueueTool.csproj\", \"{DD7B4AD9-1EB0-47BF-B4C2-5BC1CA85D242}\"\nEndProject\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"AzureManager\", \"AzureManager\\AzureManager.csproj\", \"{8ADB4B14-715D-4CE1-BFD2-E7D65007CE5C}\"\nEndProject\nProject(\"{CC5FD16D-436D-48AD-A40C-5A424C6E3E79}\") = \"NuBuildExecutionService\", \"NuBuildExecutionService\\NuBuildExecutionService.ccproj\", \"{697EA8B8-1846-4628-AB27-066BEC899EC2}\"\nEndProject\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"CloudExecutionWorker\", \"CloudExecutionWorker\\CloudExecutionWorker.csproj\", \"{4F3DE22C-CAE9-408B-AA54-10DCD7E12F09}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{4D7220C0-3CAA-4659-9F16-A564DB3CCC1B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{4D7220C0-3CAA-4659-9F16-A564DB3CCC1B}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{4D7220C0-3CAA-4659-9F16-A564DB3CCC1B}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{4D7220C0-3CAA-4659-9F16-A564DB3CCC1B}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{9A231EB8-BDA1-4304-93A1-20457C00D7D9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{9A231EB8-BDA1-4304-93A1-20457C00D7D9}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{9A231EB8-BDA1-4304-93A1-20457C00D7D9}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{9A231EB8-BDA1-4304-93A1-20457C00D7D9}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{2668E334-0B79-4023-A621-2D1433CE7C9E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{2668E334-0B79-4023-A621-2D1433CE7C9E}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{2668E334-0B79-4023-A621-2D1433CE7C9E}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{2668E334-0B79-4023-A621-2D1433CE7C9E}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{DD7B4AD9-1EB0-47BF-B4C2-5BC1CA85D242}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{DD7B4AD9-1EB0-47BF-B4C2-5BC1CA85D242}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{DD7B4AD9-1EB0-47BF-B4C2-5BC1CA85D242}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{DD7B4AD9-1EB0-47BF-B4C2-5BC1CA85D242}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{8ADB4B14-715D-4CE1-BFD2-E7D65007CE5C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{8ADB4B14-715D-4CE1-BFD2-E7D65007CE5C}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{8ADB4B14-715D-4CE1-BFD2-E7D65007CE5C}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{8ADB4B14-715D-4CE1-BFD2-E7D65007CE5C}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{697EA8B8-1846-4628-AB27-066BEC899EC2}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{697EA8B8-1846-4628-AB27-066BEC899EC2}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{697EA8B8-1846-4628-AB27-066BEC899EC2}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{697EA8B8-1846-4628-AB27-066BEC899EC2}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{4F3DE22C-CAE9-408B-AA54-10DCD7E12F09}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{4F3DE22C-CAE9-408B-AA54-10DCD7E12F09}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{4F3DE22C-CAE9-408B-AA54-10DCD7E12F09}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{4F3DE22C-CAE9-408B-AA54-10DCD7E12F09}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuildExecutionService/.gitignore", "content": "*.ccproj.user\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuildExecutionService/CloudExecutionWorkerContent/diagnostics.wadcfg", "content": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuildExecutionService/NuBuildExecutionService.ccproj", "content": "\n\n \n \n Debug\n AnyCPU\n 2.5\n 697ea8b8-1846-4628-ab27-066bec899ec2\n Library\n Properties\n NuBuildExecutionService\n NuBuildExecutionService\n False\n NuBuildExecutionService\n True\n False\n \n \n true\n full\n false\n bin\\Debug\\\n DEBUG;TRACE\n prompt\n 4\n \n \n pdbonly\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n \n \n \n \n \n \n CloudExecutionWorker\n {4f3de22c-cae9-408b-aa54-10dcd7e12f09}\n True\n Worker\n CloudExecutionWorker\n True\n \n \n \n \n \n \n \n Content\n \n \n \n \n 10.0\n $(MSBuildExtensionsPath)\\Microsoft\\VisualStudio\\v$(VisualStudioVersion)\\Windows Azure Tools\\2.5\\\n \n \n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuildExecutionService/ServiceConfiguration.Cloud.cscfg", "content": "\n\n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuildExecutionService/ServiceConfiguration.Local.cscfg", "content": "\n\n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuildExecutionService/ServiceDefinition.csdef", "content": "\n\n \n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild2/NuBuildExecutionService/csx/Release/roles/CloudExecutionWorker/base/x64/WaHostBootstrapper.exe.config", "content": "\n\n \n \n \n \n \n \n \n" }, { "path": "ironclad-apps/tools/NuBuild2/References/Microsoft.Threading.Tasks.xml", "content": "\n\n \n Microsoft.Threading.Tasks\n \n \n \n \n Provides extension methods for threading-related types.\n \n \n \n Cancels the after the specified duration.\n The CancellationTokenSource.\n The due time in milliseconds for the source to be canceled.\n \n \n Cancels the after the specified duration.\n The CancellationTokenSource.\n The due time for the source to be canceled.\n \n \n Gets an awaiter used to await this .\n The task to await.\n An awaiter instance.\n \n \n Gets an awaiter used to await this .\n Specifies the type of data returned by the task.\n The task to await.\n An awaiter instance.\n \n \n Creates and configures an awaitable object for awaiting the specified task.\n The task to be awaited.\n \n true to automatic marshag back to the original call site's current SynchronizationContext\n or TaskScheduler; otherwise, false.\n \n The instance to be awaited.\n \n \n Creates and configures an awaitable object for awaiting the specified task.\n The task to be awaited.\n \n true to automatic marshag back to the original call site's current SynchronizationContext\n or TaskScheduler; otherwise, false.\n \n The instance to be awaited.\n \n \n Event handler for progress reports.\n Specifies the type of data for the progress report.\n The sender of the report.\n The reported value.\n \n \n \n Provides an IProgress{T} that invokes callbacks for each reported progress value.\n \n Specifies the type of the progress report value.\n \n Any handler provided to the constructor or event handlers registered with\n the event are invoked through a \n instance captured\n when the instance is constructed. If there is no current SynchronizationContext\n at the time of construction, the callbacks will be invoked on the ThreadPool.\n \n \n \n The synchronization context captured upon construction. This will never be null.\n \n \n The handler specified to the constructor. This may be null.\n \n \n A cached delegate used to post invocation to the synchronization context.\n \n \n Initializes the .\n \n \n Initializes the with the specified callback.\n \n A handler to invoke for each reported progress value. This handler will be invoked\n in addition to any delegates registered with the event.\n \n The is null (Nothing in Visual Basic).\n \n \n Reports a progress change.\n The value of the updated progress.\n \n \n Reports a progress change.\n The value of the updated progress.\n \n \n Invokes the action and event callbacks.\n The progress value.\n \n \n Raised for each reported progress value.\n \n Handlers registered with this event will be invoked on the \n captured when the instance was constructed.\n \n \n \n Holds static values for .\n This avoids one static instance per type T.\n \n \n A default synchronization context that targets the ThreadPool.\n \n \n Throws the exception on the ThreadPool.\n The exception to propagate.\n The target context on which to propagate the exception. Null to use the ThreadPool.\n \n \n Copies the exception's stack trace so its stack trace isn't overwritten.\n The exception to prepare.\n \n \n Provides an awaitable object that allows for configured awaits on .\n This type is intended for compiler use only.\n \n \n The task being awaited.\n \n \n Initializes the .\n The awaitable .\n \n true to attempt to marshal the continuation back to the original context captured; otherwise, false.\n \n \n \n Gets an awaiter for this awaitable.\n The awaiter.\n \n \n Provides an awaiter for a .\n This type is intended for compiler use only.\n \n \n The task being awaited.\n \n \n Whether to attempt marshaling back to the original context.\n \n \n Initializes the .\n The to await.\n \n true to attempt to marshal the continuation back to the original context captured\n when BeginAwait is called; otherwise, false.\n \n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Ends the await on the completed .\n The result of the completed .\n The awaiter was not properly initialized.\n The task was not yet completed.\n The task was canceled.\n The task completed in a Faulted state.\n \n \n Gets whether the task being awaited is completed.\n This property is intended for compiler user rather than use directly in code.\n The awaiter was not properly initialized.\n \n \n Provides an awaitable object that allows for configured awaits on .\n This type is intended for compiler use only.\n \n \n The underlying awaitable on whose logic this awaitable relies.\n \n \n Initializes the .\n The awaitable .\n \n true to attempt to marshal the continuation back to the original context captured; otherwise, false.\n \n \n \n Gets an awaiter for this awaitable.\n The awaiter.\n \n \n Provides an awaiter for a .\n This type is intended for compiler use only.\n \n \n The task being awaited.\n \n \n Whether to attempt marshaling back to the original context.\n \n \n Initializes the .\n The awaitable .\n \n true to attempt to marshal the continuation back to the original context captured; otherwise, false.\n \n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Ends the await on the completed .\n The result of the completed .\n The awaiter was not properly initialized.\n The task was not yet completed.\n The task was canceled.\n The task completed in a Faulted state.\n \n \n Gets whether the task being awaited is completed.\n This property is intended for compiler user rather than use directly in code.\n The awaiter was not properly initialized.\n \n \n Provides an awaiter for awaiting a .\n This type is intended for compiler use only.\n \n \n The default value to use for continueOnCapturedContext.\n \n \n Error message for GetAwaiter.\n \n \n The task being awaited.\n \n \n Initializes the .\n The to be awaited.\n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Ends the await on the completed .\n The awaiter was not properly initialized.\n The task was not yet completed.\n The task was canceled.\n The task completed in a Faulted state.\n \n \n \n Fast checks for the end of an await operation to determine whether more needs to be done\n prior to completing the await.\n \n The awaited task.\n \n \n Handles validations on tasks that aren't successfully completed.\n The awaited task.\n \n \n Throws an exception to handle a task that completed in a state other than RanToCompletion.\n \n \n Schedules the continuation onto the associated with this .\n The awaited task.\n The action to invoke when the await operation completes.\n Whether to capture and marshal back to the current context.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Invokes the delegate in a try/catch that will propagate the exception asynchronously on the ThreadPool.\n \n \n \n Copies the exception's stack trace so its stack trace isn't overwritten.\n The exception to prepare.\n \n \n Gets whether the task being awaited is completed.\n This property is intended for compiler user rather than use directly in code.\n The awaiter was not properly initialized.\n \n \n Whether the current thread is appropriate for inlining the await continuation.\n \n \n Provides an awaiter for awaiting a .\n This type is intended for compiler use only.\n \n \n The task being awaited.\n \n \n Initializes the .\n The to be awaited.\n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Schedules the continuation onto the associated with this .\n The action to invoke when the await operation completes.\n The argument is null (Nothing in Visual Basic).\n The awaiter was not properly initialized.\n This method is intended for compiler user rather than use directly in code.\n \n \n Ends the await on the completed .\n The result of the completed .\n The awaiter was not properly initialized.\n The task was not yet completed.\n The task was canceled.\n The task completed in a Faulted state.\n \n \n Gets whether the task being awaited is completed.\n This property is intended for compiler user rather than use directly in code.\n The awaiter was not properly initialized.\n \n \n Provides an awaitable context for switching into a target environment.\n This type is intended for compiler use only.\n \n \n Gets an awaiter for this .\n An awaiter for this awaitable.\n This method is intended for compiler user rather than use directly in code.\n \n \n Provides an awaiter that switches into a target environment.\n This type is intended for compiler use only.\n \n \n A completed task.\n \n \n Posts the back to the current context.\n The action to invoke asynchronously.\n The awaiter was not properly initialized.\n \n \n Posts the back to the current context.\n The action to invoke asynchronously.\n The awaiter was not properly initialized.\n \n \n Ends the await operation.\n \n \n Gets whether a yield is not required.\n This property is intended for compiler user rather than use directly in code.\n \n \n Provides methods for creating and manipulating tasks.\n \n \n Creates a task that runs the specified action.\n The action to execute asynchronously.\n A task that represents the completion of the action.\n The argument is null.\n \n \n Creates a task that runs the specified action.\n The action to execute.\n The CancellationToken to use to request cancellation of this task.\n A task that represents the completion of the action.\n The argument is null.\n \n \n Creates a task that runs the specified function.\n The function to execute asynchronously.\n A task that represents the completion of the action.\n The argument is null.\n \n \n Creates a task that runs the specified function.\n The action to execute.\n The CancellationToken to use to cancel the task.\n A task that represents the completion of the action.\n The argument is null.\n \n \n Creates a task that runs the specified function.\n The action to execute asynchronously.\n A task that represents the completion of the action.\n The argument is null.\n \n \n Creates a task that runs the specified function.\n The function to execute.\n The CancellationToken to use to request cancellation of this task.\n A task that represents the completion of the function.\n The argument is null.\n \n \n Creates a task that runs the specified function.\n The function to execute asynchronously.\n A task that represents the completion of the action.\n The argument is null.\n \n \n Creates a task that runs the specified function.\n The action to execute.\n The CancellationToken to use to cancel the task.\n A task that represents the completion of the action.\n The argument is null.\n \n \n Starts a Task that will complete after the specified due time.\n The delay in milliseconds before the returned task completes.\n The timed Task.\n \n The argument must be non-negative or -1 and less than or equal to Int32.MaxValue.\n \n \n \n Starts a Task that will complete after the specified due time.\n The delay before the returned task completes.\n The timed Task.\n \n The argument must be non-negative or -1 and less than or equal to Int32.MaxValue.\n \n \n \n Starts a Task that will complete after the specified due time.\n The delay before the returned task completes.\n A CancellationToken that may be used to cancel the task before the due time occurs.\n The timed Task.\n \n The argument must be non-negative or -1 and less than or equal to Int32.MaxValue.\n \n \n \n Starts a Task that will complete after the specified due time.\n The delay in milliseconds before the returned task completes.\n A CancellationToken that may be used to cancel the task before the due time occurs.\n The timed Task.\n \n The argument must be non-negative or -1 and less than or equal to Int32.MaxValue.\n \n \n \n An already completed task.\n \n \n Creates a Task that will complete only when all of the provided collection of Tasks has completed.\n The Tasks to monitor for completion.\n A Task that represents the completion of all of the provided tasks.\n \n If any of the provided Tasks faults, the returned Task will also fault, and its Exception will contain information\n about all of the faulted tasks. If no Tasks fault but one or more Tasks is canceled, the returned\n Task will also be canceled.\n \n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete only when all of the provided collection of Tasks has completed.\n The Tasks to monitor for completion.\n A Task that represents the completion of all of the provided tasks.\n \n If any of the provided Tasks faults, the returned Task will also fault, and its Exception will contain information\n about all of the faulted tasks. If no Tasks fault but one or more Tasks is canceled, the returned\n Task will also be canceled.\n \n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete only when all of the provided collection of Tasks has completed.\n The Tasks to monitor for completion.\n A Task that represents the completion of all of the provided tasks.\n \n If any of the provided Tasks faults, the returned Task will also fault, and its Exception will contain information\n about all of the faulted tasks. If no Tasks fault but one or more Tasks is canceled, the returned\n Task will also be canceled.\n \n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete only when all of the provided collection of Tasks has completed.\n The Tasks to monitor for completion.\n A Task that represents the completion of all of the provided tasks.\n \n If any of the provided Tasks faults, the returned Task will also fault, and its Exception will contain information\n about all of the faulted tasks. If no Tasks fault but one or more Tasks is canceled, the returned\n Task will also be canceled.\n \n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete only when all of the provided collection of Tasks has completed.\n The Tasks to monitor for completion.\n \n A callback invoked when all of the tasks complete successfully in the RanToCompletion state.\n This callback is responsible for storing the results into the TaskCompletionSource.\n \n A Task that represents the completion of all of the provided tasks.\n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete when any of the tasks in the provided collection completes.\n The Tasks to be monitored.\n \n A Task that represents the completion of any of the provided Tasks. The completed Task is this Task's result.\n \n Any Tasks that fault will need to have their exceptions observed elsewhere.\n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete when any of the tasks in the provided collection completes.\n The Tasks to be monitored.\n \n A Task that represents the completion of any of the provided Tasks. The completed Task is this Task's result.\n \n Any Tasks that fault will need to have their exceptions observed elsewhere.\n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete when any of the tasks in the provided collection completes.\n The Tasks to be monitored.\n \n A Task that represents the completion of any of the provided Tasks. The completed Task is this Task's result.\n \n Any Tasks that fault will need to have their exceptions observed elsewhere.\n The argument is null.\n The argument contains a null reference.\n \n \n Creates a Task that will complete when any of the tasks in the provided collection completes.\n The Tasks to be monitored.\n \n A Task that represents the completion of any of the provided Tasks. The completed Task is this Task's result.\n \n Any Tasks that fault will need to have their exceptions observed elsewhere.\n The argument is null.\n The argument contains a null reference.\n \n \n Creates an already completed from the specified result.\n The result from which to create the completed task.\n The completed task.\n \n \n Creates an awaitable that asynchronously yields back to the current context when awaited.\n \n A context that, when awaited, will asynchronously transition back into the current context.\n If SynchronizationContext.Current is non-null, that is treated as the current context.\n Otherwise, TaskScheduler.Current is treated as the current context.\n \n \n \n Adds the target exception to the list, initializing the list if it's null.\n The list to which to add the exception and initialize if the list is null.\n The exception to add, and unwrap if it's an aggregate.\n \n \n Returns a canceled task.\n The cancellation token.\n The canceled task.\n \n \n Returns a canceled task.\n Specifies the type of the result.\n The cancellation token.\n The canceled task.\n \n \n \n Completes the Task if the user state matches the TaskCompletionSource.\n \n Specifies the type of data returned by the Task.\n The TaskCompletionSource.\n The completion event arguments.\n Whether we require the tcs to match the e.UserState.\n A function that gets the result with which to complete the task.\n An action used to unregister work when the operaiton completes.\n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild2/References/Microsoft.WindowsAzure.Common.NetFramework.xml", "content": "\n\n \n Microsoft.WindowsAzure.Common.NetFramework\n \n \n \n \n Credentials using a management certificate to authorize requests.\n \n \n \n \n Initializes a new instance of the CertificateCloudCredentials\n class.\n \n The Subscription ID.\n \n The management certificate.\n \n \n \n \n Attempt to create certificate credentials from a collection of\n settings.\n \n The settings to use.\n \n CertificateCloudCredentials is created, null otherwise.\n \n \n \n \n Initialize a ServiceClient instance to process credentials.\n \n Type of ServiceClient.\n The ServiceClient.\n \n This will add a certificate to the shared root WebRequestHandler in\n the ServiceClient's HttpClient handler pipeline.\n \n \n \n \n Apply the credentials to the HTTP request.\n \n The HTTP request.\n Cancellation token.\n \n Task that will complete when processing has completed.\n \n \n \n \n Gets subscription ID which uniquely identifies Windows Azure \n subscription. The subscription ID forms part of the URI for \n every call that you make to the Service Management API.\n \n \n \n \n The Windows Azure Service Management API use mutual authentication\n of management certificates over SSL to ensure that a request made\n to the service is secure. No anonymous requests are allowed.\n \n \n \n \n Cloud credentials provider for .NET Framework clients.\n \n \n \n \n Creates a new credentials instance if the appropriate settings for\n this provider are present and valid.\n \n Dictionary of configuration settings.\n Returns a new instance if the provider supports the\n provided settings.\n \n \n \n Computes SHA256 hash from key and data using HMACSHA256.\n \n Key to use as hash salt.\n Data to hash.\n Hash value.\n \n \n \n Initializes the settings.\n \n \n \n \n Checks whether the given exception represents an exception throws\n for a missing setting.\n \n Exception\n True for the missing setting exception.\n \n \n \n Gets a setting with the given name.\n \n Setting name.\n Setting value or null if such setting does not exist.\n \n \n \n Gets setting's value from the given provider.\n \n Provider name.\n Setting name\n Method to obtain given setting.\n Setting value, or null if not found.\n \n \n \n Gets a configuration setting from the service runtime.\n \n Setting name.\n Setting value or null if not found.\n \n \n \n Loads and returns the latest available version of the service \n runtime assembly.\n \n Loaded assembly, if any.\n \n \n \n Gets the setting defined in the Windows Azure configuration file.\n \n Setting name.\n Setting value.\n \n \n \n Gets an assembly path from the GAC given a partial name.\n \n An assembly partial name. May not be null.\n \n The assembly path if found; otherwise null;\n \n \n \n \n Registers cloud configuration providers with the common runtime\n that require the .NET framework.\n \n \n \n \n A strongly-typed resource class, for looking up localized strings, etc.\n \n \n \n \n Returns the cached ResourceManager instance used by this class.\n \n \n \n \n Overrides the current thread's CurrentUICulture property for all\n resource lookups using this strongly typed resource class.\n \n \n \n \n Looks up a localized string similar to {0} requires a {1} in its HTTP pipeline to work with client certificates..\n \n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild2/References/Microsoft.WindowsAzure.Common.xml", "content": "\n\n \n Microsoft.WindowsAzure.Common\n \n \n \n \n Helper class used for deserialization of OLEDB Connection Strings.\n \n \n \n \n Defines an interface for setting parsers.\n \n \n \n \n Parses the setting.\n \n Setting to parse.\n Dictionary representation of the setting.\n \n \n \n Gets the setting name.\n \n \n \n \n Deserializes OLEDB Connection String.\n \n OLEDB Connection String.\n Dictionary representation of the Connection String.\n \n \n \n Gets the setting name.\n \n \n \n \n Class for token based credentials associated with a particular subscription.\n \n \n \n \n Base class for credentials associated with a particular subscription.\n \n \n \n \n The CloudCredentials class is the base class for providing credentials\n to access Windows Azure services.\n \n \n \n \n Initialize a ServiceClient instance to process credentials.\n \n Type of ServiceClient.\n The ServiceClient.\n \n \n \n Apply the credentials to the HTTP request.\n \n The HTTP request.\n Cancellation token.\n \n Task that will complete when processing has completed.\n \n \n \n \n Gets subscription ID which uniquely identifies Windows Azure \n subscription. The subscription ID forms part of the URI for \n every call that you make to the Service Management API.\n \n \n \n \n Gets an empty subscription Id.\n \n \n \n \n Class for token based credentials associated with a particular subscription.\n \n \n \n \n Initializes a new instance of the \n class with subscription ID.\n \n The Subscription ID.\n Valid JSON Web Token (JWT).\n \n \n \n Initializes a new instance of the \n class without subscription ID.\n \n Valid JSON Web Token (JWT).\n \n \n \n Attempt to create token credentials from a collection of\n settings.\n \n The settings to use.\n \n TokenCloudCredentials is created, null otherwise.\n \n \n \n \n Apply the credentials to the HTTP request.\n \n The HTTP request.\n Cancellation token.\n \n Task that will complete when processing has completed.\n \n \n \n \n Gets subscription ID which uniquely identifies Windows Azure \n subscription. The subscription ID forms part of the URI for \n every call that you make to the Service Management API.\n \n \n \n \n Gets or sets secure token used to authenticate against Windows Azure API. \n No anonymous requests are allowed.\n \n \n \n \n Representation of the error object from the server.\n \n \n \n \n Parsed error message.\n \n \n \n \n Parsed error code.\n \n \n \n \n Original error body\n \n \n \n \n Base class used to describe HTTP requests and responses associated with\n error conditions.\n \n \n \n \n Initializes a new instance of the CloudHttpErrorInfo class.\n \n \n \n \n Add the HTTP message headers to the error info.\n \n Collection of HTTP header.\n \n \n \n Gets or sets the contents of the HTTP message.\n \n \n \n \n Gets the collection of HTTP headers.\n \n \n \n \n Gets or sets the HTTP message version.\n \n \n \n \n Describes HTTP requests associated with error conditions.\n \n \n \n \n Initializes a new instance of the CloudHttpRequestErrorInfo class.\n \n \n \n \n Creates a new CloudHttpRequestErrorInfo from a HttpRequestMessage.\n \n The request message.\n A CloudHttpRequestErrorInfo instance.\n \n \n \n Creates a new CloudHttpRequestErrorInfo from a HttpRequestMessage.\n \n The request message.\n \n The request content, which may be passed separately if the request\n has already been disposed.\n \n A CloudHttpRequestErrorInfo instance.\n \n \n \n Gets or sets the HTTP method used by the HTTP request message.\n \n \n \n \n Gets or sets the Uri used for the HTTP request.\n \n \n \n \n Gets a set of properties for the HTTP request.\n \n \n \n \n Describes HTTP responses associated with error conditions.\n \n \n \n \n Initializes a new instance of the CloudHttpResponseErrorInfo class.\n \n \n \n \n Creates a new CloudHttpResponseErrorInfo from a HttpResponseMessage.\n \n The response message.\n A CloudHttpResponseErrorInfo instance.\n \n \n \n Creates a new CloudHttpResponseErrorInfo from a HttpResponseMessage.\n \n The response message.\n \n The response content, which may be passed separately if the\n response has already been disposed.\n \n A CloudHttpResponseErrorInfo instance.\n \n \n \n Gets or sets the status code of the HTTP response.\n \n \n \n \n Gets or sets the reason phrase which typically is sent by servers together\n with the status code.\n \n \n \n \n Provides cryptography functionality to libraries.\n \n \n \n \n Computes a Hash-based Message Authentication Code (HMAC) \n by using the SHA256 hash function.\n \n The key to use in the hash algorithm.\n The input to compute the hash code\n for.\n Returns the computed hash code.\n \n \n \n Extensions for manipulating HTTP requests and responses.\n \n \n \n \n Get the HTTP message content as a string.\n \n The HTTP content.\n The HTTP message content as a string.\n \n \n \n Get the content headers for an HTTP request.\n \n The request message.\n The content headers.\n \n \n \n Get the content headers for an HTTP response.\n \n The response message.\n The content headers.\n \n \n \n Get a standard string representation of an HTTP request.\n \n The request message.\n String representation of the request.\n \n \n \n Get a standard string representation of an HTTP request.\n \n The request message.\n String representation of the request.\n \n \n \n Append an HTTP request.\n \n The StringBuilder.\n The request message.\n \n \n \n Append an HTTP request.\n \n The StringBuilder.\n The request message.\n \n \n \n Append the components of an HTTP request.\n \n The StringBuilder.\n The request method.\n The request URI.\n The request HTTP version.\n The request headers.\n The request content headers.\n The request properties.\n The request content.\n \n \n \n Get a standard string representation of an HTTP response.\n \n The response message.\n String representation of the response.\n \n \n \n Get a standard string representation of an HTTP response.\n \n The response message.\n String representation of the response.\n \n \n \n Append an HTTP response.\n \n The StringBuilder.\n The response message.\n \n \n \n Append an HTTP response.\n \n The StringBuilder.\n The response message.\n \n \n \n Append the components of an HTTP response.\n \n The StringBuilder.\n The response status code.\n The response reason phrase.\n The response HTTP version.\n The response headers.\n The response content headers.\n The response content.\n \n \n \n Append HTTP headers.\n \n The StringBuilder.\n The HTTP headers.\n \n \n \n Helper class used for deserialization of JSON formatted Connection Strings.\n \n \n \n \n Deserializes JSON formatted Connection String.\n \n JSON formatted Connection String.\n Dictionary representation of the Connection String.\n \n \n \n Gets the setting name.\n \n \n \n \n Wrapper class for HttpMessageHandler that prevents InnerHandler from\n being disposed.\n \n \n \n \n Initializes a new instance of the class from HttpMessageHandler.\n \n InnerHandler to wrap.\n \n \n \n Overrides Dispose of the base class to prevent disposal of the InnerHandler.\n \n If set to true indicates the method is being called from Dispose().\n \n \n \n Parser helper.\n \n \n \n \n Checks if content is possibly an XML.\n \n String to check.\n If set to true will validate entire XML for validity \n otherwise will just check the first character.\n True is content is possibly an XML otherwise false.\n \n \n \n Checks if content is possibly a JSON.\n \n String to check.\n If set to true will validate entire JSON for validity \n otherwise will just check the first character.\n True is content is possibly an JSON otherwise false.\n \n \n \n Returns first non whitespace character\n \n Text to search in\n Non whitespace or default char\n \n \n \n Static type conversion utility methods.\n \n \n \n \n Converts an array of 8-bit unsigned integers to its equivalent \n string representation that is encoded with base-64 digits.\n \n An array of 8-bit unsigned integers.\n The string representation, in base 64, of the contents of \n value.\n \n \n \n Decodes all the bytes in the specified byte array into a string.\n \n The byte array containing the sequence of bytes \n to decode.\n A string that contains the results of decoding the \n specified sequence of bytes.\n \n \n \n Converts the specified string, which encodes binary data as base-64\n digits, to a UTF8-encoded string.\n \n The base 64-encoded string to convert.\n Returns a string.\n \n \n \n Uses Uri::TryCreate method to safely attempt to parse a \n string value and return its Uri representation. Supports\n relative Uris.\n \n The Uri string.\n Returns a new Uri instance or null.\n \n \n \n Convert a TimeSpan into an 8601 formatted string.\n \n The timespan to convert.\n The TimeSpan in 8601 format.\n \n \n \n Convert a string from ISO 8601 format to a TimeSpan instance.\n \n Value to parse.\n The resulting timespan.\n \n \n \n Concatenates parts of the Uri together ensuring that\n any duplicate '/' characters are removed.\n \n Parts of the Uri to be combined.\n Concatenated Uri\n \n \n \n A standard service response including an HTTP status code and request\n ID.\n \n \n \n \n Gets or sets the standard HTTP status code from the REST API \n operations for the Service Management API.\n \n \n \n \n Gets or sets the value that uniquely identifies a request \n made against the service.\n \n \n \n \n The status of the asynchronous request.\n \n \n \n \n The asynchronous request is in progress.\n \n \n \n \n The asynchronous request succeeded.\n \n \n \n \n The asynchronous request failed.\n \n \n \n \n The response body contains the status of the specified\n asynchronous operation, indicating whether it has succeeded, is i\n progress, or has failed. Note that this status is distinct from the\n HTTP status code returned for the Get Operation Status operation\n itself. If the asynchronous operation succeeded, the response body\n includes the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request, and also includes error\n information regarding the failure.\n \n \n \n \n If the asynchronous operation failed, the response body includes\n the HTTP status code for the failed request, and also includes\n error information regarding the failure.\n \n \n \n \n The HTTP status code for the asynchronous request.\n \n \n \n \n The request ID of the asynchronous request. This value is returned\n in the x-ms-request-id response header of the asynchronous request.\n \n \n \n \n The status of the asynchronous request.\n \n \n \n \n If the asynchronous operation failed, the response body includes\n the HTTP status code for the failed request, and also includes\n error information regarding the failure.\n \n \n \n \n Initializes a new instance of the ErrorDetails class.\n \n \n \n \n The management service error code returned if the asynchronous\n request failed.\n \n \n \n \n The management service error message returned if the\n asynchronous request failed.\n \n \n \n \n JSON formatter for PATCH syntax.\n \n Value to patch.\n \n \n \n Implicit operator that converts T to Patchable T.\n \n Object to convert.\n Converted object.\n \n \n \n Implicit operator that converts Patchable T to T.\n \n Object to convert.\n Converted object.\n \n \n \n Sets operation to SET and returns instance of the object.\n \n Value to patch.\n Instance of the object.\n \n \n \n Returns formatted PATCH script.\n \n Formatted PATCH script.\n \n \n \n Gets the patch value.\n \n \n \n \n Gets a value indicating whether the value is set.\n \n \n \n \n Parameter attribute used with OData filters.\n \n \n \n \n Initializes a new instance of the class.\n \n Property name to use in the filter.\n \n \n \n Initializes a new instance of the class.\n \n Property name to use in the filter.\n Format of the value.\n \n \n \n Property name to use in the filter.\n \n \n \n \n Format of the value.\n \n \n \n \n Handles OData filter generation.\n \n \n \n \n Generates an OData filter from a specified Linq expression.\n \n Filter type\n Entity to use for filter generation\n \n \n \n \n Expression visitor class that generates OData style $filter parameter.\n \n \n \n \n \n Visits binary expression !foo.\n \n Node to visit.\n Original node.\n \n \n \n Visits conditional expression foo == true ? bar : fee. Throws NotSupportedException.\n \n Node to visit.\n Throws NotSupportedException.\n \n \n \n Visits new object expression like new DateTime().\n \n Node to visit.\n Original node.\n \n \n \n Visits constants like 'a' or 123.\n \n Node to visit.\n Original node.\n \n \n \n Visits object members like p.Foo or dateTime.Hour.\n \n Node to visit.\n Original node.\n \n \n \n Visits method calls like Contains, StartsWith, etc. Methods that are not supported will throw an exception.\n \n Node to visit.\n Original node.\n \n \n \n Appends 'eq true' to Boolean unary operators.\n \n \n \n \n Helper method to print constant.\n \n Object to print.\n \n \n \n Helper method to generate property name.\n \n Property to examine.\n Property name or value specified in the FilterParameterAttribute.\n \n \n \n Helper method to retrieve format from the FilterParameterAttribute.\n \n Property to examine.\n Format from FilterParameterAttribute or null.\n \n \n \n A cloud credentials provider.\n \n \n \n \n Creates a new credentials instance if the appropriate settings for\n this provider are present and valid.\n \n Dictionary of configuration settings.\n Returns a new instance if the provider supports the\n provided settings.\n \n \n \n Defines cryptographic methods.\n \n \n \n \n Computes SHA256 hash from key and data.\n \n Key to use as hash salt.\n Data to hash.\n Hash value.\n \n \n \n Provides tracing utilities that insight into all aspects of client\n operations via implementations of the ICloudTracingInterceptor\n interface. All tracing is global.\n \n \n The utilities in the internal Tracing class provide helpers for\n notifying the active trace listeners of changes.\n \n \n \n \n The collection of tracing interceptors to notify.\n \n \n \n \n A read-only, thread-safe collection of tracing interceptors. Since\n List is only thread-safe for reads (and adding/removing tracing\n interceptors isn't a very common operation), we simply replace the\n entire collection of interceptors so any enumeration of the list\n in progress on a different thread will not be affected by the\n change.\n \n \n \n \n Lock used to synchronize mutation of the tracing interceptors.\n \n \n \n \n Initializes a new instance of the CloudTracing class.\n \n \n \n \n Add a tracing interceptor to be notified of changes.\n \n The tracing interceptor.\n \n \n \n Remove a tracing interceptor from change notifications.\n \n The tracing interceptor.\n \n True if the tracing interceptor was found and removed; false\n otherwise.\n \n \n \n \n Gets or sets a value indicating whether tracing is enabled.\n Tracing can be disabled for performance.\n \n \n \n \n Gets a sequence of the tracing interceptors to notify of changes.\n \n \n \n \n Http retry handler.\n \n \n \n \n Initializes a new instance of the class. Sets \n default retry policty base on Exponential Backoff.\n \n \n \n \n Initializes a new instance of the class. Sets \n the default retry policty base on Exponential Backoff.\n \n Inner http handler.\n \n \n \n Initializes a new instance of the class. \n \n Retry policy to use.\n Inner http handler.\n \n \n \n Sends an HTTP request to the inner handler to send to the server as an asynchronous\n operation. Retries request if needed based on Retry Policy.\n \n The HTTP request message to send to the server.\n A cancellation token to cancel operation.\n Returns System.Threading.Tasks.Task<TResult>. The \n task object representing the asynchronous operation.\n \n \n \n Gets or sets retry policy.\n \n \n \n \n An instance of a callback delegate that will be invoked whenever a retry condition is encountered.\n \n \n \n \n Creates a new credentials instance of type T using the set of\n registered cloud credentials providers and provided settings.\n \n The requested minimum type of cloud credentials\n for successful credential use.\n Dictionary of configuration settings.\n Provides a value indicating whether to\n throw if the minimum requested credentials type cannot be found.\n Defaults to true.\n Returns a new instance of the first provider that supports\n the provided settings.\n \n \n \n The base ServiceClient class used to call REST services.\n \n Type of the ServiceClient.\n \n \n \n Gets the Platform's IHttpTransportHandlerProvider which gives the\n default HttpHandler for sending web requests.\n \n \n \n \n A value indicating whether or not the ServiceClient has already\n been disposed.\n \n \n \n \n Reference to the delegated handler of our handler (so we can\n maintain a proper reference count).\n \n \n \n \n Reference to our HTTP handler (which is the start of our HTTP\n pipeline).\n \n \n \n \n Initializes static members of the ServiceClient class.\n \n \n \n \n Initializes a new instance of the ServiceClient class.\n \n \n \n \n Initializes a new instance of the ServiceClient class.\n \n The http client.\n \n \n \n Initializes HttpClient.\n \n Http message handler to use with Http client.\n \n \n \n Create the HTTP client.\n \n The HTTP client.\n \n \n \n Dispose the ServiceClient.\n \n \n \n \n Clone the service client.\n \n The client to clone.\n \n \n \n Clone HttpClient properties.\n \n The client to clone.\n The client to copy into.\n \n \n \n Extend the ServiceClient with a new handler.\n \n The new client that will extend.\n The handler to extend with.\n The extended client.\n \n \n \n Gets the HttpClient used for making HTTP requests.\n \n \n \n \n Gets a reference to our HTTP handler (which is the start of our\n HTTP pipeline).\n \n \n \n \n Gets the UserAgent collection which can be augmented with custom\n user agent strings.\n \n \n \n \n Interface used to represent resource groupings of ServiceClient \n operations.\n \n Type of the ServiceClient.\n \n \n \n Gets a reference to the ServiceClient.\n \n \n \n \n The CloudClients class provides a common location for service client\n discovery. It can be accessed via CloudContext.Clients. The\n Microsoft.WindowsAzure namespace should be imported when used because\n CloudClients is intended to be the target of extension methods by each\n service client.\n \n \n All service client libraries should add CreateXYZClient() extension\n methods on static classes declared in the Microsoft.WindowsAzure\n namespace. This will allow any library loaded in a project to be\n easily discovered via CloudContext.Clients without developers having to\n figure out which namespaces to import, etc. You may also add extension\n methods that create \n \n This class is used as a static class (internal constructor) but not declared\n as such so it can be the target of extension methods.\n \n \n \n \n Initializes a new instance of the CloudClients class.\n \n \n \n \n Utilities for easily retrieving configuration settings across a variety\n of platform appropriate sources.\n \n \n \n \n Initializes static members of the class.\n Initializes platform-specific cloud configuration and credentials\n providers.\n \n \n \n \n Registers a cloud credentials provider with the configuration\n runtime.\n \n Instance of a cloud credentials provider.\n \n \n \n Creates a new credentials instance of type T using the set of\n registered cloud credentials providers.\n \n The requested minimum type of cloud credentials\n for successful credential use.\n Dictionary of configuration settings.\n Returns a new instance of the first provider that supports\n the provided settings.\n \n \n \n A platform specific configuration provider. There is no standard\n configuration support in the Portable Class Libraries BCL.\n \n \n \n \n Initializes a new instance of the CloudConfiguration class.\n \n \n \n \n Get the value of a configuration setting from a platform specific\n configuration source.\n \n The name of the setting.\n The value of the setting, or null if not found.\n \n \n \n Get connection info that can be used to instantiate type T by\n searching for configuration settings of the form\n Namespace.Type.format. If no connection info is found for the\n type, we will search for connection info for all of its base types.\n \n \n The type to obtain connection info for.\n \n \n Connection info used to instantiate the given type or null if no\n connection info is found.\n \n \n You can get insight into the connection info search by checking\n the tracing output.\n \n \n \n \n Get named connection info that can be used to instantiate a type by\n searching for configuration settings of the format\n Namespace.Type.Name.format. If no connection info is found for the\n type, we will search for connection info for all of its base types.\n \n \n The type to obtain connection info for.\n \n The name of the connection info.\n \n Connection info used to instantiate the given type or null if no\n connection info is found.\n \n \n You can get insight into the connection info search by checking\n the tracing output.\n \n \n \n \n Get connection info that can be used to instantiate a type by\n searching for configuration settings of the form\n Namespace.Type.format. If no connection info is found for the\n type, we will search for connection info for all of its base types.\n \n \n The type to obtain connection info for.\n \n \n Connection info used to instantiate the given type or null if no\n connection info is found.\n \n \n You can get insight into the connection info search by checking\n the tracing output.\n \n \n \n \n Get named connection info that can be used to instantiate a type by\n searching for configuration settings of the format\n Namespace.Type.Name.format. If no connection info is found for\n the type, we will search for connection info for all of its base\n types.\n \n \n The type to obtain connection info for.\n \n The name of the connection info.\n \n Connection info used to instantiate the given type or null if\n no connection string is found.\n \n \n You can get insight into the connection info search by checking\n the tracing output.\n \n \n \n \n Get connection info that can be used to instantiate a type by\n searching for configuration settings of the format\n Namespace.Type[.Name].format If no settings are found for the\n type, we will search for connection info for all of its base types.\n \n \n The type to obtain connection info for.\n \n Optional value for named settings.\n \n Name of the config setting item where the setting was found.\n \n \n Value of the config setting item where the setting was found.\n \n \n Connection info used to instantiate the given type or null if\n no connection info is found.\n \n \n You can get insight into the connection info search by checking\n the tracing output.\n \n \n \n \n Parse a connection string.\n \n The connection string.\n \n A dictionary of the setting names and values from the connection\n string.\n \n \n \n \n Parse a JSON settings file.\n \n The JSON settings.\n \n A dictionary of the setting names and values from the JSON\n settings.\n \n \n \n \n Gets a platform specific configuration provider. There is no\n standard configuration support in the Portable Class Libraries BCL.\n \n \n \n \n Gets the tracing utilities used to provide insight into all aspects\n of client operations.\n \n \n \n \n The CloudContext class is your primary entry point for getting started\n with Windows Azure client libraries. CloudContext.Clients contains\n helpful methods to create any of the clients currently referenced in\n your project (be sure to import the Microsoft.WindowsAzure namespace so\n you import its extension methods). CloudContext.Configuration allows\n you to easily retrieve configuration settings across a variety of \n platform appropriate sources.\n \n \n The CloudContext class is static to make it easier to use, but all\n other classes should be instances so they can be targeted by extension\n methods given the layered approach of our client libraries.\n \n \n \n \n Initializes static members of the class.\n \n \n \n \n Gets an object providing a common location for service client\n discovery. The Microsoft.WindowsAzure namespace should be imported\n when used because CloudClients is intended to be the target of\n extension methods by each service client library.\n \n \n \n \n Gets utilities for easily retrieving configuration settings across\n a variety of platform appropriate sources.\n \n \n \n \n Parse connection strings.\n \n \n The following simplified grammar was obtained from the specification\n \"[MS-OLEDBSTR]: OLEDB Connection String Structure\". Refer to the spec\n for full details. We support case-insensitive keys and multiple\n occurrences of the same key, but not multiple values for keys (i.e.,\n the CompoundValue nonterminal in the spec's grammar).\n \n ws := [ \\t]*\n semi := ;\n eq := =\n esc-eq := ==\n dq := \"\n sq := '\n esc-dq := \"\"\n esc-sq := ''\n key-start: (==)|[^ \\t;]\n key-body: (==)[^;]*\n key-end: (==)|[^ \\t;]\n lit-start: [^ \\t'\";=]\n lit-body: [^;]\n lit-end: [^ \\t;]\n sq-lit: ''|[^']\n dq-lit: \"\"|[^\"]\n \n ConnectionString :=\n (ConnectionStringClause semi)* (ConnectionStringClause semi?)?\n \n ConnectionStringClause :=\n KeyValuePair | ws\n \n KeyValuePair :=\n ws Key ws eq ws Value ws\n \n Key :=\n key-start (key-body* key-end)?\n \n Value :=\n (lit-start (lit-body* lit-end)?)?\n | sq sq-lit* sq\n | dq dq-lit* dq \n \n \n \n \n Parses the connection string into a collection of key/value pairs.\n \n Connection string.\n Parsed connection string.\n \n \n \n Initializes a new instance of the class.\n \n Value to parse.\n \n \n \n Parses the string.\n \n A collection of key=value pairs.\n \n \n \n Generates an invalid connection string exception with the detailed \n error message.\n \n Position of the error.\n Short error formatting string.\n Optional arguments for the error string.\n Exception with the requested message.\n \n \n \n Skips whitespaces at the current position.\n \n \n \n \n Extracts key at the current position.\n \n Key.\n \n \n \n Extracts the string until the given quotation mark.\n \n Quotation mark terminating the string.\n String.\n \n \n \n Skips specified operator.\n \n Operator character.\n \n \n \n Extracts key's value.\n \n Key's value.\n \n \n \n State of the parser.\n \n \n \n \n Wrapper class that provides manual reference count functionality\n \n Type to wrap around. Must be disposable.\n \n \n \n Platform-specific interface enabling cloud configuration support.\n \n \n \n \n Registers platform-specific cloud configuration providers with the\n common runtime.\n \n \n \n \n Exception thrown for any invalid response.\n \n \n \n \n Initializes a new instance of the CloudException class.\n \n The exception message.\n \n \n \n Initializes a new instance of the CloudException class.\n \n The exception message.\n Inner exception.\n \n \n \n Create a CloudException from a failed response.\n \n The HTTP request.\n The HTTP request content.\n The HTTP response.\n The HTTP response content.\n Optional inner exception.\n A CloudException representing the failure.\n \n \n \n Create a CloudException from a failed response.\n This method is obsolete. Use Create without defaultTo parameter.\n \n The HTTP request.\n The HTTP request content.\n The HTTP response.\n The HTTP response content.\n The content type to default to if none of the types matches.\n Optional inner exception.\n A CloudException representing the failure.\n \n \n \n Create a CloudException from a failed response sending XML content.\n This method is obsolete. Use Create without defaultTo parameter.\n \n The HTTP request.\n The HTTP request content.\n The HTTP response.\n The HTTP response content.\n Optional inner exception.\n A CloudException representing the failure.\n \n \n \n Create a CloudException from a failed response sending JSON content.\n This method is obsolete. Use Create without defaultTo parameter.\n \n The HTTP request.\n The HTTP request content.\n The HTTP response.\n The HTTP response content.\n Optional inner exception.\n A CloudException representing the failure.\n \n \n \n Parse the response content as either an XML or JSON error message.\n \n The response content.\n \n An object containing the parsed error code and message.\n \n \n \n \n Parse the response content as an XML error message.\n \n The response content.\n \n An object containing the parsed error code and message.\n \n \n \n \n Parse the response content as an JSON error message.\n \n The response content.\n \n An object containing the parsed error code and message.\n \n \n \n \n Gets the error message returned from the server.\n \n \n This is included by default in the Message property.\n \n \n \n \n Gets the error code returned from the server.\n \n \n This is included by default in the Message property.\n \n \n \n \n Gets the request identifier.\n \n \n \n \n Gets the routing request identifier.\n \n \n \n \n Gets information about the associated HTTP request.\n \n \n \n \n Gets information about the associated HTTP response.\n \n \n \n \n Internal extensions.\n \n \n \n \n Create an ArgumentException for empty parameters.\n \n The parameter name.\n The ArgumentException.\n \n \n \n Get the assembly version of a service client.\n \n Type of the service client.\n The service client.\n The assembly version of the client.\n \n \n \n Get the HTTP pipeline formed from the ancestors of the starting\n handler.\n \n The starting handler.\n The HTTP pipeline.\n \n \n \n Get the HTTP pipeline for the given service client.\n \n Type of the service client.\n The service client.\n The client's HTTP pipeline.\n \n \n \n Add a handler to the end of the client's HTTP pipeline.\n \n Type of the service client.\n The service client.\n The handler to add.\n \n \n \n Sets retry policy for the client.\n \n Service client type.\n Service client.\n Retry policy to set.\n \n \n \n Helper extension methods used by tracing providers.\n \n \n \n \n Returns string representation of a HttpRequestMessage.\n \n Request to format.\n Formatted string.\n \n \n \n Returns string representation of a HttpResponseMessage.\n \n Response to format.\n Formatted string.\n \n \n \n Converts given dictionary into a log string.\n \n The dictionary key type\n The dictionary value type\n The dictionary collection object\n The log string\n \n \n \n The ICloudTracingInterceptor provides useful information about cloud\n operations. Interception is global and a tracing interceptor can be\n added via CloudContext.Configuration.Tracing.AddTracingInterceptor.\n \n \n \n \n Trace information.\n \n The information to trace.\n \n \n \n Probe configuration for the value of a setting.\n \n The configuration source.\n The name of the setting.\n The value of the setting in the source.\n \n \n \n Enter a method.\n \n Method invocation identifier.\n The instance with the method.\n Name of the method.\n Method parameters.\n \n \n \n Send an HTTP request.\n \n Method invocation identifier.\n The request about to be sent.\n \n \n \n Receive an HTTP response.\n \n Method invocation identifier.\n The response instance.\n \n \n \n Raise an error.\n \n Method invocation identifier.\n The error.\n \n \n \n Exit a method. Note: Exit will not be called in the event of an\n error.\n \n Method invocation identifier.\n Method return value.\n \n \n \n A strongly-typed resource class, for looking up localized strings, etc.\n \n \n \n \n Returns the cached ResourceManager instance used by this class.\n \n \n \n \n Overrides the current thread's CurrentUICulture property for all\n resource lookups using this strongly typed resource class.\n \n \n \n \n Looks up a localized string similar to Value cannot be empty.\n Parameter name: {0}.\n \n \n \n \n Looks up a localized string similar to The specified argument {0} cannot be greater than its ceiling value of {1}..\n \n \n \n \n Looks up a localized string similar to The specified argument {0} cannot be initialized with a negative value..\n \n \n \n \n Looks up a localized string similar to Failed to convert parameter {0} value '{1}' to type {2}..\n \n \n \n \n Looks up a localized string similar to {3} Failed to create {0} from connection settings {1} = "{2}"..\n \n \n \n \n Looks up a localized string similar to No connection settings found for type {0}. Enable tracing for more information..\n \n \n \n \n Looks up a localized string similar to No credentials of type '{0}' could be initialized from the provided settings..\n \n \n \n \n Looks up a localized string similar to Parameter {0} is required..\n \n \n \n \n Looks up a localized string similar to Default retry strategy for technology {0}, named '{1}', is not defined..\n \n \n \n \n Looks up a localized string similar to Default retry strategy for technology {0} was not not defined, and there is no overall default strategy..\n \n \n \n \n Looks up a localized string similar to Retry handler is not present in the HttpClient handler stack..\n \n \n \n \n Looks up a localized string similar to The RetryManager is already set..\n \n \n \n \n Looks up a localized string similar to The default RetryManager has not been set. Set it by invoking the RetryManager.SetDefault static method, or if you are using declarative configuration, you can invoke the RetryPolicyFactory.CreateDefault() method to automatically create the retry manager from the configuration file..\n \n \n \n \n Looks up a localized string similar to Response status code indicates server error: {0} ({1})..\n \n \n \n \n Looks up a localized string similar to The action has exceeded its defined retry limit..\n \n \n \n \n Looks up a localized string similar to The retry strategy with name '{0}' cannot be found..\n \n \n \n \n Looks up a localized string similar to The specified string argument {0} must not be empty..\n \n \n \n \n Looks up a localized string similar to The specified argument '{0}' cannot return a null task when invoked..\n \n \n \n \n Looks up a localized string similar to The specified argument '{0}' must return a scheduled task (also known as "hot" task) when invoked..\n \n \n \n \n Handles the execution and retries of the user-initiated task.\n \n The result type of the user-initiated task.\n \n \n \n Provides a wrapper for a non-generic and calls into the pipeline\n to retry only the generic version of the .\n \n \n \n \n Wraps the non-generic into a generic .\n \n The task to wrap.\n A that wraps the non-generic .\n \n \n \n Default Http error detection strategy based on Http Status Code.\n \n \n \n \n Defines an interface that must be implemented by custom components responsible for detecting specific transient conditions.\n \n \n \n \n Determines whether the specified exception represents a transient failure that can be compensated by a retry.\n \n The exception object to be verified.\n true if the specified exception is considered as transient; otherwise, false.\n \n \n \n Returns true if status code in HttpRequestExceptionWithStatus exception is greater \n than or equal to 500 and not NotImplemented (501) or HttpVersionNotSupported (505).\n \n Exception to check against.\n True if exception is transient otherwise false.\n \n \n \n A retry strategy with backoff parameters for calculating the exponential delay between retries.\n \n \n \n \n Represents a retry strategy that determines the number of retry attempts and the interval between retries.\n \n \n \n \n Represents the default number of retry attempts.\n \n \n \n \n Represents the default amount of time used when calculating a random delta in the exponential delay between retries.\n \n \n \n \n Represents the default maximum amount of time used when calculating the exponential delay between retries.\n \n \n \n \n Represents the default minimum amount of time used when calculating the exponential delay between retries.\n \n \n \n \n Represents the default interval between retries.\n \n \n \n \n Represents the default time increment between retry attempts in the progressive delay policy.\n \n \n \n \n Represents the default flag indicating whether the first retry attempt will be made immediately,\n whereas subsequent retries will remain subject to the retry interval.\n \n \n \n \n Initializes a new instance of the class. \n \n The name of the retry strategy.\n true to immediately retry in the first attempt; otherwise, false. The subsequent retries will remain subject to the configured retry interval.\n \n \n \n Returns the corresponding ShouldRetry delegate.\n \n The ShouldRetry delegate.\n \n \n \n Returns a default policy that performs no retries, but invokes the action only once.\n \n \n \n \n Returns a default policy that implements a fixed retry interval configured with the and parameters.\n The default retry policy treats all caught exceptions as transient errors.\n \n \n \n \n Returns a default policy that implements a progressive retry interval configured with the , , and parameters.\n The default retry policy treats all caught exceptions as transient errors.\n \n \n \n \n Returns a default policy that implements a random exponential retry interval configured with the , , , and parameters.\n The default retry policy treats all caught exceptions as transient errors.\n \n \n \n \n Gets or sets a value indicating whether the first retry attempt will be made immediately,\n whereas subsequent retries will remain subject to the retry interval.\n \n \n \n \n Gets the name of the retry strategy.\n \n \n \n \n Initializes a new instance of the class. \n \n \n \n \n Initializes a new instance of the class with the specified retry settings.\n \n The maximum number of retry attempts.\n The minimum backoff time\n The maximum backoff time.\n The value that will be used to calculate a random delta in the exponential delay between retries.\n \n \n \n Initializes a new instance of the class with the specified name and retry settings.\n \n The name of the retry strategy.\n The maximum number of retry attempts.\n The minimum backoff time\n The maximum backoff time.\n The value that will be used to calculate a random delta in the exponential delay between retries.\n \n \n \n Initializes a new instance of the class with the specified name, retry settings, and fast retry option.\n \n The name of the retry strategy.\n The maximum number of retry attempts.\n The minimum backoff time\n The maximum backoff time.\n The value that will be used to calculate a random delta in the exponential delay between retries.\n true to immediately retry in the first attempt; otherwise, false. The subsequent retries will remain subject to the configured retry interval.\n \n \n \n Returns the corresponding ShouldRetry delegate.\n \n The ShouldRetry delegate.\n \n \n \n Represents a retry strategy with a specified number of retry attempts and a default, fixed time interval between retries.\n \n \n \n \n Initializes a new instance of the class. \n \n \n \n \n Initializes a new instance of the class with the specified number of retry attempts. \n \n The number of retry attempts.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and time interval. \n \n The number of retry attempts.\n The time interval between retries.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts, time interval, and retry strategy. \n \n The retry strategy name.\n The number of retry attempts.\n The time interval between retries.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts, time interval, retry strategy, and fast start option. \n \n The retry strategy name.\n The number of retry attempts.\n The time interval between retries.\n true to immediately retry in the first attempt; otherwise, false. The subsequent retries will remain subject to the configured retry interval.\n \n \n \n Returns the corresponding ShouldRetry delegate.\n \n The ShouldRetry delegate.\n \n \n \n Implements the common guard methods.\n \n \n \n \n Checks a string argument to ensure that it isn't null or empty.\n \n The argument value to check.\n The name of the argument.\n The return value should be ignored. It is intended to be used only when validating arguments during instance creation (for example, when calling the base constructor).\n \n \n \n Checks an argument to ensure that it isn't null.\n \n The argument value to check.\n The name of the argument.\n The return value should be ignored. It is intended to be used only when validating arguments during instance creation (for example, when calling the base constructor).\n \n \n \n Checks an argument to ensure that its 32-bit signed value isn't negative.\n \n The value of the argument.\n The name of the argument for diagnostic purposes.\n \n \n \n Checks an argument to ensure that its 64-bit signed value isn't negative.\n \n The value of the argument.\n The name of the argument for diagnostic purposes.\n \n \n \n Checks an argument to ensure that its value doesn't exceed the specified ceiling baseline.\n \n The value of the argument.\n The ceiling value of the argument.\n The name of the argument for diagnostic purposes.\n \n \n \n Inherits HttpRequestException adding HttpStatusCode to the exception.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class\n with a specific message that describes the current exception.\n \n A message that describes the current exception.\n \n \n \n Initializes a new instance of the class\n with a specific message that describes the current exception and an inner\n exception.\n \n A message that describes the current exception.\n The inner exception.\n \n \n \n Http status code.\n \n \n \n \n A retry strategy with a specified number of retry attempts and an incremental time interval between retries.\n \n \n \n \n Initializes a new instance of the class. \n \n \n \n \n Initializes a new instance of the class with the specified retry settings.\n \n The number of retry attempts.\n The initial interval that will apply for the first retry.\n The incremental time value that will be used to calculate the progressive delay between retries.\n \n \n \n Initializes a new instance of the class with the specified name and retry settings.\n \n The retry strategy name.\n The number of retry attempts.\n The initial interval that will apply for the first retry.\n The incremental time value that will be used to calculate the progressive delay between retries.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts, time interval, retry strategy, and fast start option. \n \n The retry strategy name.\n The number of retry attempts.\n The initial interval that will apply for the first retry.\n The incremental time value that will be used to calculate the progressive delay between retries.\n true to immediately retry in the first attempt; otherwise, false. The subsequent retries will remain subject to the configured retry interval.\n \n \n \n Returns the corresponding ShouldRetry delegate.\n \n The ShouldRetry delegate.\n \n \n \n Contains information that is required for the event.\n \n \n \n \n Initializes a new instance of the class.\n \n The current retry attempt count.\n The delay that indicates how long the current thread will be suspended before the next iteration is invoked.\n The exception that caused the retry conditions to occur.\n \n \n \n Gets the current retry count.\n \n \n \n \n Gets the delay that indicates how long the current thread will be suspended before the next iteration is invoked.\n \n \n \n \n Gets the exception that caused the retry conditions to occur.\n \n \n \n \n The special type of exception that provides managed exit from a retry loop. The user code can use this\n exception to notify the retry policy that no further retry attempts are required.\n \n \n \n \n Initializes a new instance of the class with a default error message.\n \n \n \n \n Initializes a new instance of the class with a specified error message.\n \n The message that describes the error.\n \n \n \n Initializes a new instance of the class with a reference to the inner exception\n that is the cause of this exception.\n \n The exception that is the cause of the current exception.\n \n \n \n Initializes a new instance of the class with a specified error message and inner exception.\n \n The message that describes the error.\n The exception that is the cause of the current exception.\n \n \n \n Provides the entry point to the retry functionality.\n \n \n \n \n Sets the specified retry manager as the default retry manager.\n \n The retry manager.\n true to throw an exception if the manager is already set; otherwise, false. Defaults to .\n The singleton is already set and is true.\n \n \n \n Initializes a new instance of the class.\n \n The complete set of retry strategies.\n \n \n \n Initializes a new instance of the class with the specified retry strategies and default retry strategy name.\n \n The complete set of retry strategies.\n The default retry strategy.\n \n \n \n Initializes a new instance of the class with the specified retry strategies and defaults.\n \n The complete set of retry strategies.\n The default retry strategy.\n The names of the default strategies for different technologies.\n \n \n \n Returns a retry policy with the specified error detection strategy and the default retry strategy defined in the configuration. \n \n The type that implements the interface that is responsible for detecting transient conditions.\n A new retry policy with the specified error detection strategy and the default retry strategy defined in the configuration.\n \n \n \n Returns a retry policy with the specified error detection strategy and retry strategy.\n \n The type that implements the interface that is responsible for detecting transient conditions.\n The retry strategy name, as defined in the configuration.\n A new retry policy with the specified error detection strategy and the default retry strategy defined in the configuration.\n \n \n \n Returns the default retry strategy defined in the configuration.\n \n The retry strategy that matches the default strategy.\n \n \n \n Returns the retry strategy that matches the specified name.\n \n The retry strategy name.\n The retry strategy that matches the specified name.\n \n \n \n Returns the retry strategy for the specified technology.\n \n The techonolgy to get the default retry strategy for.\n The retry strategy for the specified technology.\n \n \n \n Gets the default for the application.\n \n You can update the default retry manager by calling the method.\n \n \n \n Gets or sets the default retry strategy name.\n \n \n \n \n Provides the base implementation of the retry mechanism for unreliable actions and transient conditions.\n \n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and parameters defining the progressive delay between retries.\n \n The that is responsible for detecting transient conditions.\n The strategy to use for this retry policy.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and default fixed time interval between retries.\n \n The that is responsible for detecting transient conditions.\n The number of retry attempts.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and fixed time interval between retries.\n \n The that is responsible for detecting transient conditions.\n The number of retry attempts.\n The interval between retries.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and backoff parameters for calculating the exponential delay between retries.\n \n The that is responsible for detecting transient conditions.\n The number of retry attempts.\n The minimum backoff time.\n The maximum backoff time.\n The time value that will be used to calculate a random delta in the exponential delay between retries.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and parameters defining the progressive delay between retries.\n \n The that is responsible for detecting transient conditions.\n The number of retry attempts.\n The initial interval that will apply for the first retry.\n The incremental time value that will be used to calculate the progressive delay between retries.\n \n \n \n Repetitively executes the specified action while it satisfies the current retry policy.\n \n A delegate that represents the executable action that doesn't return any results.\n \n \n \n Repetitively executes the specified action while it satisfies the current retry policy.\n \n The type of result expected from the executable action.\n A delegate that represents the executable action that returns the result of type .\n The result from the action.\n \n \n \n Repetitively executes the specified asynchronous task while it satisfies the current retry policy.\n \n A function that returns a started task (also known as \"hot\" task).\n \n A task that will run to completion if the original task completes successfully (either the\n first time or after retrying transient failures). If the task fails with a non-transient error or\n the retry limit is reached, the returned task will transition to a faulted state and the exception must be observed.\n \n \n \n \n Repetitively executes the specified asynchronous task while it satisfies the current retry policy.\n \n A function that returns a started task (also known as \"hot\" task).\n The token used to cancel the retry operation. This token does not cancel the execution of the asynchronous task.\n \n Returns a task that will run to completion if the original task completes successfully (either the\n first time or after retrying transient failures). If the task fails with a non-transient error or\n the retry limit is reached, the returned task will transition to a faulted state and the exception must be observed.\n \n \n \n \n Repeatedly executes the specified asynchronous task while it satisfies the current retry policy.\n \n A function that returns a started task (also known as \"hot\" task).\n \n Returns a task that will run to completion if the original task completes successfully (either the\n first time or after retrying transient failures). If the task fails with a non-transient error or\n the retry limit is reached, the returned task will transition to a faulted state and the exception must be observed.\n \n \n \n \n Repeatedly executes the specified asynchronous task while it satisfies the current retry policy.\n \n A function that returns a started task (also known as \"hot\" task).\n The token used to cancel the retry operation. This token does not cancel the execution of the asynchronous task.\n \n Returns a task that will run to completion if the original task completes successfully (either the\n first time or after retrying transient failures). If the task fails with a non-transient error or\n the retry limit is reached, the returned task will transition to a faulted state and the exception must be observed.\n \n \n \n \n Notifies the subscribers whenever a retry condition is encountered.\n \n The current retry attempt count.\n The exception that caused the retry conditions to occur.\n The delay that indicates how long the current thread will be suspended before the next iteration is invoked.\n \n \n \n Returns a default policy that performs no retries, but invokes the action only once.\n \n \n \n \n Returns a default policy that implements a fixed retry interval configured with the default retry strategy.\n The default retry policy treats all caught exceptions as transient errors.\n \n \n \n \n Returns a default policy that implements a progressive retry interval configured with the default retry strategy.\n The default retry policy treats all caught exceptions as transient errors.\n \n \n \n \n Returns a default policy that implements a random exponential retry interval configured with the default retry strategy.\n The default retry policy treats all caught exceptions as transient errors.\n \n \n \n \n An instance of a callback delegate that will be invoked whenever a retry condition is encountered.\n \n \n \n \n Gets the retry strategy.\n \n \n \n \n Gets the instance of the error detection strategy.\n \n \n \n \n Implements a strategy that ignores any transient errors.\n \n \n \n \n Always returns false.\n \n The exception.\n Always false.\n \n \n \n Implements a strategy that treats all exceptions as transient errors.\n \n \n \n \n Always returns true.\n \n The exception.\n Always true.\n \n \n \n Provides a generic version of the class.\n \n The type that implements the interface that is responsible for detecting transient conditions.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and parameters defining the progressive delay between retries.\n \n The strategy to use for this retry policy.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and the default fixed time interval between retries.\n \n The number of retry attempts.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and a fixed time interval between retries.\n \n The number of retry attempts.\n The interval between retries.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and backoff parameters for calculating the exponential delay between retries.\n \n The number of retry attempts.\n The minimum backoff time.\n The maximum backoff time.\n The time value that will be used to calculate a random delta in the exponential delay between retries.\n \n \n \n Initializes a new instance of the class with the specified number of retry attempts and parameters defining the progressive delay between retries.\n \n The number of retry attempts.\n The initial interval that will apply for the first retry.\n The incremental time value that will be used to calculate the progressive delay between retries.\n \n \n \n Defines a callback delegate that will be invoked whenever a retry condition is encountered.\n \n The current retry attempt count.\n The exception that caused the retry conditions to occur.\n The delay that indicates how long the current thread will be suspended before the next iteration is invoked.\n if a retry is allowed; otherwise, .\n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild2/References/Microsoft.WindowsAzure.Management.Compute.xml", "content": "\n\n \n Microsoft.WindowsAzure.Management.Compute\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n The request ID for the request you wish to track. The request ID is\n returned in the x-ms-request-id response header for every request.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets the API version.\n \n \n \n \n Gets the URI used as the base for all cloud service requests.\n \n \n \n \n Gets subscription credentials which uniquely identify Microsoft\n Azure subscription. The subscription ID forms part of the URI for\n every service call.\n \n \n \n \n Gets or sets the initial timeout for Long Running Operations.\n \n \n \n \n Gets or sets the retry timeout for Long Running Operations.\n \n \n \n \n The Service Management API includes operations for managing the\n deployments in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n hosted services beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx\n for more information)\n \n \n \n \n The Compute Management API includes operations for managing the\n load balancers for your subscription.\n \n \n \n \n Operations for determining the version of the Azure Guest Operating\n System on which your service is running. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684169.aspx\n for more information)\n \n \n \n \n Operations for managing service certificates for your subscription.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee795178.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n disks in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157188.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n virtual machine extensions in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n virtual machines in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the OS\n images in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157175.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n virtual machine templates in your subscription.\n \n \n \n \n Initializes a new instance of the ComputeManagementClient class.\n \n \n \n \n Initializes a new instance of the ComputeManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n Required. Gets the URI used as the base for all cloud service\n requests.\n \n \n \n \n Initializes a new instance of the ComputeManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n \n \n Initializes a new instance of the ComputeManagementClient class.\n \n \n The Http client\n \n \n \n \n Initializes a new instance of the ComputeManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n Required. Gets the URI used as the base for all cloud service\n requests.\n \n \n The Http client\n \n \n \n \n Initializes a new instance of the ComputeManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n The Http client\n \n \n \n \n Clones properties from current instance to another\n ComputeManagementClient instance\n \n \n Instance of ComputeManagementClient to clone to\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n Required. The request ID for the request you wish to track. The\n request ID is returned in the x-ms-request-id response header for\n every request.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Parse enum values for type CertificateFormat.\n \n \n The value to parse.\n \n \n The enum value.\n \n \n \n \n Convert an enum of type CertificateFormat to a string.\n \n \n The value to convert to a string.\n \n \n The enum value as a string.\n \n \n \n \n Parse enum values for type LoadBalancerProbeTransportProtocol.\n \n \n The value to parse.\n \n \n The enum value.\n \n \n \n \n Convert an enum of type LoadBalancerProbeTransportProtocol to a\n string.\n \n \n The value to convert to a string.\n \n \n The enum value as a string.\n \n \n \n \n Gets the API version.\n \n \n \n \n Gets the URI used as the base for all cloud service requests.\n \n \n \n \n Gets subscription credentials which uniquely identify Microsoft\n Azure subscription. The subscription ID forms part of the URI for\n every service call.\n \n \n \n \n Gets or sets the initial timeout for Long Running Operations.\n \n \n \n \n Gets or sets the retry timeout for Long Running Operations.\n \n \n \n \n The Service Management API includes operations for managing the\n deployments in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n hosted services beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx\n for more information)\n \n \n \n \n The Compute Management API includes operations for managing the\n load balancers for your subscription.\n \n \n \n \n Operations for determining the version of the Azure Guest Operating\n System on which your service is running. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684169.aspx\n for more information)\n \n \n \n \n Operations for managing service certificates for your subscription.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee795178.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n disks in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157188.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n virtual machine extensions in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n virtual machines in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the OS\n images in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157175.aspx\n for more information)\n \n \n \n \n The Service Management API includes operations for managing the\n virtual machine templates in your subscription.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IComputeManagementClient.\n \n \n Required. The request ID for the request you wish to track. The\n request ID is returned in the x-ms-request-id response header for\n every request.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IComputeManagementClient.\n \n \n Required. The request ID for the request you wish to track. The\n request ID is returned in the x-ms-request-id response header for\n every request.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Service Management API includes operations for managing the\n deployments in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx for\n more information)\n \n \n \n \n The Service Management API includes operations for managing the\n deployments in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx for\n more information)\n \n \n \n \n The Begin Changing Deployment Configuration By Name operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n The cloud service to change deployment configuration for.\n \n \n The deployment to change configuration for.\n \n \n Parameters supplied to the Begin Changing Configuration Deployment\n By Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Changing Deployment Configuration By Slot operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n The cloud service to change deployment configuration for.\n \n \n The slot to change deployment configuration for.\n \n \n Parameters supplied to the Begin Changing Configuration Deployment\n By Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Deployment operation uploads a new service\n package and creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n The cloud service to create a deployment for.\n \n \n The slot to create a deployment for.\n \n \n Parameters supplied to the Begin Creating Deployment operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Name operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n Specifies that the source blob for the disk should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Slot operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of the deployment slot.\n \n \n The parameters to delete the role.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of the deployment.\n \n \n The parameters to delete the role.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Name operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Slot operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Name operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Slot operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Swapping Deployment operation initiates a virtual IP\n address swap between the staging and production deployment\n environments for a service. If the service is currently running in\n the staging environment, it will be swapped to the production\n environment. If it is running in the production environment, it\n will be swapped to staging. For more information on this type of\n upgrade, see Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n Parameters supplied to the Begin Swapping Deployment operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Name operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Begin Updating Deployment Status By\n Deployment Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Slot operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n The deployment slot.\n \n \n Parameters supplied to the Begin Updating Deployment Status By\n Deployment Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Name operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n The cloud service to upgrade.\n \n \n The deployment to upgrade.\n \n \n Parameters supplied to the Begin Upgrading Deployment By Name\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Slot operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.This\n operation is an asynchronous operation. To determine whether the\n request has been processed, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n The cloud service to upgrade.\n \n \n The slot to upgrade.\n \n \n Parameters supplied to the Begin Upgrading Deployment By Slot\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Name operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Begin Walking Upgrade Domain By\n Deployment Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Slot operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n Parameters supplied to the Begin Walking Upgrade Domain By\n Deployment Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Change Deployment Configuration By Name operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n The cloud service to change deployment configuration for.\n \n \n The deployment to change configuration for.\n \n \n Parameters supplied to the Change ConfigurationDeployment By Name\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Change Deployment Configuration By Slot operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n The cloud service to change deployment configuration for.\n \n \n The slot to change deployment configuration for.\n \n \n Parameters supplied to the Change Configuration Deployment By Slot\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Deployment operation uploads a new service package and\n creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n The cloud service to create a deployment for.\n \n \n The slot to create a deployment for.\n \n \n Parameters supplied to the Create Deployment operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Name operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n Specifies that the source blob for the disk should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Slot operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of the deployment.\n \n \n The parameters to delete the role.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes the role instances from\n a deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of the deployment slot.\n \n \n The parameters to delete the role.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Deployment By Name operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of the deployment.\n \n \n Cancellation token.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Deployment By Slot operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n Cancellation token.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Package By Name operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Get Package By Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Package By Slot operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n Parameters supplied to the Get Package By Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Reboot Role Instance By Deployment Name operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reboot Role Instance By Deployment Slot operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Name operation requests a\n reimage of a role instance that is running in a deployment.This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Slot operation requests a\n reimage of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Name operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Rollback Update Or Upgrade By Deployment\n Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Slot operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n The deployment slot.\n \n \n Parameters supplied to the Rollback Update Or Upgrade By Deployment\n Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Swap Deployment operation initiates a virtual IP address swap\n between the staging and production deployment environments for a\n service. If the service is currently running in the staging\n environment, it will be swapped to the production environment. If\n it is running in the production environment, it will be swapped to\n staging. For more information on this type of upgrade, see\n Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n Parameters supplied to the Swap Deployment operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Name operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Update Deployment Status By Deployment\n Name operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Slot operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n The cloud service to swap deployments for.\n \n \n The deployment slot.\n \n \n Parameters supplied to the Update Deployment Status By Deployment\n Slot operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Name operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n The cloud service to upgrade.\n \n \n The deployment to upgrade.\n \n \n Parameters supplied to the Upgrade Deployment By Name operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Slot operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n The cloud service to upgrade.\n \n \n The slot to upgrade.\n \n \n Parameters supplied to the Upgrade Deployment By Slot operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Name operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Walk Upgrade Domain By Deployment Name\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Slot operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The deployment slot.\n \n \n Parameters supplied to the Walk Upgrade Domain By Deployment Slot\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Initializes a new instance of the DeploymentOperations class.\n \n \n Reference to the service client.\n \n \n \n \n The Begin Changing Deployment Configuration By Name operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The deployment to change configuration for.\n \n \n Required. Parameters supplied to the Begin Changing Configuration\n Deployment By Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Changing Deployment Configuration By Slot operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The slot to change deployment configuration for.\n \n \n Required. Parameters supplied to the Begin Changing Configuration\n Deployment By Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Deployment operation uploads a new service\n package and creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n Required. The cloud service to create a deployment for.\n \n \n Required. The slot to create a deployment for.\n \n \n Required. Parameters supplied to the Begin Creating Deployment\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Name operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Slot operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment slot.\n \n \n Required. The parameters to delete the role.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n Required. The parameters to delete the role.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Name operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Slot operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Name operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Slot operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Swapping Deployment operation initiates a virtual IP\n address swap between the staging and production deployment\n environments for a service. If the service is currently running in\n the staging environment, it will be swapped to the production\n environment. If it is running in the production environment, it\n will be swapped to staging. For more information on this type of\n upgrade, see Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. Parameters supplied to the Begin Swapping Deployment\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Name operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Updating Deployment\n Status By Deployment Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Slot operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Begin Updating Deployment\n Status By Deployment Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Name operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The deployment to upgrade.\n \n \n Required. Parameters supplied to the Begin Upgrading Deployment By\n Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Slot operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.This\n operation is an asynchronous operation. To determine whether the\n request has been processed, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The slot to upgrade.\n \n \n Required. Parameters supplied to the Begin Upgrading Deployment By\n Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Name operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Walking Upgrade Domain\n By Deployment Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Slot operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Begin Walking Upgrade Domain\n By Deployment Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Change Deployment Configuration By Name operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The deployment to change configuration for.\n \n \n Required. Parameters supplied to the Change ConfigurationDeployment\n By Name operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Change Deployment Configuration By Slot operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The slot to change deployment configuration for.\n \n \n Required. Parameters supplied to the Change Configuration\n Deployment By Slot operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Deployment operation uploads a new service package and\n creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n Required. The cloud service to create a deployment for.\n \n \n Required. The slot to create a deployment for.\n \n \n Required. Parameters supplied to the Create Deployment operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Name operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Slot operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n Required. The parameters to delete the role.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes the role instances from\n a deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment slot.\n \n \n Required. The parameters to delete the role.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Deployment By Name operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n Cancellation token.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Deployment By Slot operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Cancellation token.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Package By Name operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Get Package By Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Package By Slot operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Get Package By Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Reboot Role Instance By Deployment Name operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reboot Role Instance By Deployment Slot operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Name operation requests a\n reimage of a role instance that is running in a deployment.This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Slot operation requests a\n reimage of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Name operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Rollback Update Or Upgrade By\n Deployment Name operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Slot operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Rollback Update Or Upgrade By\n Deployment Slot operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Swap Deployment operation initiates a virtual IP address swap\n between the staging and production deployment environments for a\n service. If the service is currently running in the staging\n environment, it will be swapped to the production environment. If\n it is running in the production environment, it will be swapped to\n staging. For more information on this type of upgrade, see\n Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. Parameters supplied to the Swap Deployment operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Name operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Update Deployment Status By\n Deployment Name operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Slot operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Update Deployment Status By\n Deployment Slot operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Name operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The deployment to upgrade.\n \n \n Required. Parameters supplied to the Upgrade Deployment By Name\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Slot operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The slot to upgrade.\n \n \n Required. Parameters supplied to the Upgrade Deployment By Slot\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Name operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Walk Upgrade Domain By\n Deployment Name operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Slot operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Walk Upgrade Domain By\n Deployment Slot operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Begin Changing Deployment Configuration By Name operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The deployment to change configuration for.\n \n \n Required. Parameters supplied to the Begin Changing Configuration\n Deployment By Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Changing Deployment Configuration By Name operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The deployment to change configuration for.\n \n \n Required. Parameters supplied to the Begin Changing Configuration\n Deployment By Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Changing Deployment Configuration By Slot operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The slot to change deployment configuration for.\n \n \n Required. Parameters supplied to the Begin Changing Configuration\n Deployment By Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Changing Deployment Configuration By Slot operation\n initiates a change to the deployment configuration. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The slot to change deployment configuration for.\n \n \n Required. Parameters supplied to the Begin Changing Configuration\n Deployment By Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Deployment operation uploads a new service\n package and creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to create a deployment for.\n \n \n Required. The slot to create a deployment for.\n \n \n Required. Parameters supplied to the Begin Creating Deployment\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Deployment operation uploads a new service\n package and creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to create a deployment for.\n \n \n Required. The slot to create a deployment for.\n \n \n Required. Parameters supplied to the Begin Creating Deployment\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Name operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Name operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Slot operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Deployment By Slot operation deletes the\n specified deployment. This operation is an asynchronous operation.\n To determine whether the Management service has finished\n processing the request, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment slot.\n \n \n Required. The parameters to delete the role.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment slot.\n \n \n Required. The parameters to delete the role.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n Required. The parameters to delete the role.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n Required. The parameters to delete the role.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Name operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Name operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Slot operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Rebooting Role Instance By Deployment Slot operation\n requests a reboot of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Name operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Name operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Slot operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Reimaging Role Instance By Deployment Slot operation\n requests a reimage of a role instance that is running in a\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Swapping Deployment operation initiates a virtual IP\n address swap between the staging and production deployment\n environments for a service. If the service is currently running in\n the staging environment, it will be swapped to the production\n environment. If it is running in the production environment, it\n will be swapped to staging. For more information on this type of\n upgrade, see Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. Parameters supplied to the Begin Swapping Deployment\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Swapping Deployment operation initiates a virtual IP\n address swap between the staging and production deployment\n environments for a service. If the service is currently running in\n the staging environment, it will be swapped to the production\n environment. If it is running in the production environment, it\n will be swapped to staging. For more information on this type of\n upgrade, see Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. Parameters supplied to the Begin Swapping Deployment\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Name operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Updating Deployment\n Status By Deployment Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Name operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Updating Deployment\n Status By Deployment Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Slot operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Begin Updating Deployment\n Status By Deployment Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Deployment Status By Deployment Slot operation\n initiates a change in the running status of a deployment. The\n status of a deployment can be running or suspended. This operation\n is an asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Begin Updating Deployment\n Status By Deployment Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Name operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The deployment to upgrade.\n \n \n Required. Parameters supplied to the Begin Upgrading Deployment By\n Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Name operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The deployment to upgrade.\n \n \n Required. Parameters supplied to the Begin Upgrading Deployment By\n Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Slot operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.This\n operation is an asynchronous operation. To determine whether the\n request has been processed, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The slot to upgrade.\n \n \n Required. Parameters supplied to the Begin Upgrading Deployment By\n Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Upgrading Deployment By Slot operation initiates an\n update of role instances in a deployment using the package and\n configuration that you specify. For more information about\n updating role instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.This\n operation is an asynchronous operation. To determine whether the\n request has been processed, call Get Operation Status. For more\n information on asynchronous operations, see Tracking Asynchronous\n Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The slot to upgrade.\n \n \n Required. Parameters supplied to the Begin Upgrading Deployment By\n Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Name operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Walking Upgrade Domain\n By Deployment Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Name operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Walking Upgrade Domain\n By Deployment Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Slot operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Begin Walking Upgrade Domain\n By Deployment Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Walking Upgrade Domain By Deployment Slot operation\n specifies an update domain in which a role instance must be\n updated. For more information about updating role instances, see\n Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Begin Walking Upgrade Domain\n By Deployment Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Change Deployment Configuration By Name operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The deployment to change configuration for.\n \n \n Required. Parameters supplied to the Change ConfigurationDeployment\n By Name operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Change Deployment Configuration By Name operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The deployment to change configuration for.\n \n \n Required. Parameters supplied to the Change ConfigurationDeployment\n By Name operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Change Deployment Configuration By Slot operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The slot to change deployment configuration for.\n \n \n Required. Parameters supplied to the Change Configuration\n Deployment By Slot operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Change Deployment Configuration By Slot operation initiates a\n change to the deployment configuration. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460809.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to change deployment configuration for.\n \n \n Required. The slot to change deployment configuration for.\n \n \n Required. Parameters supplied to the Change Configuration\n Deployment By Slot operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Deployment operation uploads a new service package and\n creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to create a deployment for.\n \n \n Required. The slot to create a deployment for.\n \n \n Required. Parameters supplied to the Create Deployment operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Deployment operation uploads a new service package and\n creates a new deployment in the staging or production\n environments. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460813.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to create a deployment for.\n \n \n Required. The slot to create a deployment for.\n \n \n Required. Parameters supplied to the Create Deployment operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Name operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Name operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Slot operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Deployment By Slot operation deletes the specified\n deployment. This operation is an asynchronous operation. To\n determine whether the Management service has finished processing\n the request, call Get Operation Status. For more information on\n asynchronous operations, see Tracking Asynchronous Service\n Management Requests. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460815.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n Required. The parameters to delete the role.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes a role instance from a\n deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n Required. The parameters to delete the role.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes the role instances from\n a deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment slot.\n \n \n Required. The parameters to delete the role.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role Instances operation deletes the role instances from\n a deployment in a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469418.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment slot.\n \n \n Required. The parameters to delete the role.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Deployment By Name operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Deployment By Name operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of the deployment.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Deployment By Slot operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Deployment By Slot operation returns configuration\n information, status, and system properties for a deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460804.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n A deployment that exists in the cloud service.\n \n \n \n \n The Get Package By Name operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Get Package By Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Package By Name operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Get Package By Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Package By Slot operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Get Package By Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Package By Slot operation retrieves a cloud service package\n for a deployment and stores the package files in Azure Blob\n storage. The following package files are placed in storage: the\n cloud service configuration file (.cscfg), providing configuration\n settings for the cloud service and individual roles, including the\n number of role instances; and the service package (.cspkg),\n containing the application code and the service definition file.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154121.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Get Package By Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Reboot Role Instance By Deployment Name operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reboot Role Instance By Deployment Name operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reboot Role Instance By Deployment Slot operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reboot Role Instance By Deployment Slot operation requests a\n reboot of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441298.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Name operation requests a\n reimage of a role instance that is running in a deployment.This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Name operation requests a\n reimage of a role instance that is running in a deployment.This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Slot operation requests a\n reimage of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Reimage Role Instance By Deployment Slot operation requests a\n reimage of a role instance that is running in a deployment. This\n operation is an asynchronous operation. To determine whether the\n Management service has finished processing the request, call Get\n Operation Status. For more information on asynchronous operations,\n see Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441292.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. The name of your role instance.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Name operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Rollback Update Or Upgrade By\n Deployment Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Name operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Rollback Update Or Upgrade By\n Deployment Name operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Slot operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Rollback Update Or Upgrade By\n Deployment Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Rollback Update Or Upgrade By Deployment Slot operation cancels\n an in-progress configuration update and returns the deployment to\n its state before the update was started. This operation can only\n be called when an update is in progress on the deployment. The\n deployment status can be detected by calling the Get Deployment\n operation or Get Hosted Service Properties operation and\n inspecting the RollbackAllowed element. If the value returned is\n true a rollback can be performed. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh403977.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Rollback Update Or Upgrade By\n Deployment Slot operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Swap Deployment operation initiates a virtual IP address swap\n between the staging and production deployment environments for a\n service. If the service is currently running in the staging\n environment, it will be swapped to the production environment. If\n it is running in the production environment, it will be swapped to\n staging. For more information on this type of upgrade, see\n Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. Parameters supplied to the Swap Deployment operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Swap Deployment operation initiates a virtual IP address swap\n between the staging and production deployment environments for a\n service. If the service is currently running in the staging\n environment, it will be swapped to the production environment. If\n it is running in the production environment, it will be swapped to\n staging. For more information on this type of upgrade, see\n Performing Virtual IP Swap Upgrades at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee517253.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460814.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. Parameters supplied to the Swap Deployment operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Name operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Update Deployment Status By\n Deployment Name operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Name operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Update Deployment Status By\n Deployment Name operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Slot operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Update Deployment Status By\n Deployment Slot operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Deployment Status By Deployment Slot operation initiates\n a change in the running status of a deployment. The status of a\n deployment can be running or suspended. This operation is an\n asynchronous operation. To determine whether the Management\n service has finished processing the request, call Get Operation\n Status. For more information on asynchronous operations, see\n Tracking Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460808.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to swap deployments for.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Update Deployment Status By\n Deployment Slot operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Name operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The deployment to upgrade.\n \n \n Required. Parameters supplied to the Upgrade Deployment By Name\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Name operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The deployment to upgrade.\n \n \n Required. Parameters supplied to the Upgrade Deployment By Name\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Slot operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The slot to upgrade.\n \n \n Required. Parameters supplied to the Upgrade Deployment By Slot\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Upgrade Deployment By Slot operation initiates an update of\n role instances in a deployment using the package and configuration\n that you specify. For more information about updating role\n instances, see Update an Azure Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the request has been processed, call Get Operation Status. For\n more information on asynchronous operations, see Tracking\n Asynchronous Service Management Requests at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n To perform an automatic update of a deployment, call Upgrade\n Deployment or Change Deployment Configuration with the Mode\n element set to automatic. The update proceeds from that point\n without a need for further input. You can call Get Operation\n Status to determine when the update is complete. To perform a\n manual update, first call Upgrade Deployment with the Mode element\n set to manual. Next, call Walk Upgrade Domain to update each\n domain within the deployment. You should make sure that the\n operation is complete by calling Get Operation Status before\n updating the next domain. Important: An update that adds or\n removes role instances will result in a configuration update to\n all roles that are deployed in the cloud service. Existing role\n instances need to be notified of new role instances so that all\n role instances can communicate together in the cloud service. By\n default, a cloud service is deployed with five update domains,\n which are updated one at a time during an in-place update. For\n information on modifying the number of update domains in the\n service definition file, see the Azure Service Definition Schema\n (.csdef File). To determine the update domain in which a\n particular instance is running in Windows Azure, use the\n UpdateDomain property of the RoleInstance class. See the Azure\n Managed Library Reference at\n http://msdn.microsoft.com/en-us/library/windowsazure/dd179380.aspx\n for more information. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460793.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The cloud service to upgrade.\n \n \n Required. The slot to upgrade.\n \n \n Required. Parameters supplied to the Upgrade Deployment By Slot\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Name operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Walk Upgrade Domain By\n Deployment Name operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Name operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Walk Upgrade Domain By\n Deployment Name operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Slot operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Walk Upgrade Domain By\n Deployment Slot operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Walk Upgrade Domain By Deployment Slot operation specifies an\n update domain in which a role instance must be updated. For more\n information about updating role instances, see Update an Azure\n Service at\n http://msdn.microsoft.com/en-us/library/windowsazure/hh472157.aspx.\n This operation is an asynchronous operation. To determine whether\n the Management service has finished processing the request, call\n Get Operation Status. For more information on asynchronous\n operations, see Tracking Asynchronous Service Management Requests\n at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460791.aspx.\n Prior to calling the Walk Upgrade Domain operation you must have\n called Upgrade Deployment, Change Deployment Configuration, or\n Rollback Update Or Upgrade. By default, a service is deployed with\n five update domains, which are updated one at a time during an\n in-place update. For information on modifying the number of update\n domains in the service definition file, see the Azure Service\n Definition Schema (.csdef File). To perform a manual update of\n your deployment, proceed in this order: Call Upgrade Deployment\n with the Mode element set to manual. Call Walk Upgrade Domain to\n update each domain within the deployment. Update domains must be\n updated in order. For example, begin with domain 0, proceed to\n domain 1, and so on. Important: An update that adds or removes\n role instances will result in a configuration update to all roles\n that are deployed in the cloud service. Existing role instances\n need to be notified of new role instances so that all role\n instances can communicate together in the cloud service. While an\n update is in progress, call Get Deployment to determine its\n status. If the update is in progress, Get Deployment returns an\n UpgradeStatus element that contains information about the update.\n If the update is complete, or if no update is in progress, then\n the UpgradeStatus element is null. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460800.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IDeploymentOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The deployment slot.\n \n \n Required. Parameters supplied to the Walk Upgrade Domain By\n Deployment Slot operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Service Management API includes operations for managing the hosted\n services beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx for\n more information)\n \n \n \n \n The Service Management API includes operations for managing the hosted\n services beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460812.aspx for\n more information)\n \n \n \n \n The Add Extension operation adds an available extension to your\n cloud service. In Azure, a process can run as an extension of a\n cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Parameters supplied to the Add Extension operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Begin Adding Extension operation adds an available extension to\n your cloud service. In Azure, a process can run as an extension of\n a cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Parameters supplied to the Begin Adding Extension operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting All Hosted Service operation deletes the\n specified cloud service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Extension operation deletes the specified\n extension from a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The identifier that was assigned to the extension when it was added\n to the cloud service\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Check Hosted Service Name Availability operation checks for the\n availability of the specified cloud service name. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154116.aspx\n for more information)\n \n \n The cloud service name that you would like to use.\n \n \n Cancellation token.\n \n \n The Check Hosted Service Name Availability operation response.\n \n \n \n \n The Create Hosted Service operation creates a new cloud service in\n Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441304.aspx\n for more information)\n \n \n Parameters supplied to the Create Hosted Service operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete All Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Extension operation deletes the specified extension from\n a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The identifier that was assigned to the extension when it was added\n to the cloud service\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Hosted Service Properties operation retrieves system\n properties for the specified cloud service. These properties\n include the service name and service type; and the name of the\n affinity group to which the service belongs, or its location if it\n is not part of an affinity group. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Cancellation token.\n \n \n The Get Hosted Service operation response.\n \n \n \n \n The Get Detailed Hosted Service Properties operation retrieves\n system properties for the specified cloud service. These\n properties include the service name and service type; the name of\n the affinity group to which the service belongs, or its location\n if it is not part of an affinity group; and information on the\n deployments of the service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Cancellation token.\n \n \n The detailed Get Hosted Service operation response.\n \n \n \n \n The Get Extension operation retrieves information about a specified\n extension that was added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169557.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n The identifier that was assigned to the extension when it was added\n to the cloud service\n \n \n Cancellation token.\n \n \n The Get Extension operation response.\n \n \n \n \n The List Hosted Services operation lists the cloud services\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460781.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Hosted Service operation response.\n \n \n \n \n The List Available Extensions operation lists the extensions that\n are available to add to your cloud service. In Windows Azure, a\n process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169559.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The List Extensions operation lists all of the extensions that were\n added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169561.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Cancellation token.\n \n \n The List Extensions operation response.\n \n \n \n \n The List Extension Versions operation lists the versions of an\n extension that are available to add to a cloud service. In Azure,\n a process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495437.aspx\n for more information)\n \n \n The provider namespace.\n \n \n The extension type name.\n \n \n Cancellation token.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The Update Hosted Service operation can update the label or\n description of a cloud service in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441303.aspx\n for more information)\n \n \n The name of the cloud service.\n \n \n Parameters supplied to the Update Hosted Service operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Initializes a new instance of the HostedServiceOperations class.\n \n \n Reference to the service client.\n \n \n \n \n The Add Extension operation adds an available extension to your\n cloud service. In Azure, a process can run as an extension of a\n cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Add Extension operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Begin Adding Extension operation adds an available extension to\n your cloud service. In Azure, a process can run as an extension of\n a cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Begin Adding Extension\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting All Hosted Service operation deletes the\n specified cloud service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Extension operation deletes the specified\n extension from a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Check Hosted Service Name Availability operation checks for the\n availability of the specified cloud service name. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154116.aspx\n for more information)\n \n \n Required. The cloud service name that you would like to use.\n \n \n Cancellation token.\n \n \n The Check Hosted Service Name Availability operation response.\n \n \n \n \n The Create Hosted Service operation creates a new cloud service in\n Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441304.aspx\n for more information)\n \n \n Required. Parameters supplied to the Create Hosted Service\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete All Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Extension operation deletes the specified extension from\n a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Hosted Service Properties operation retrieves system\n properties for the specified cloud service. These properties\n include the service name and service type; and the name of the\n affinity group to which the service belongs, or its location if it\n is not part of an affinity group. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Cancellation token.\n \n \n The Get Hosted Service operation response.\n \n \n \n \n The Get Detailed Hosted Service Properties operation retrieves\n system properties for the specified cloud service. These\n properties include the service name and service type; the name of\n the affinity group to which the service belongs, or its location\n if it is not part of an affinity group; and information on the\n deployments of the service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Cancellation token.\n \n \n The detailed Get Hosted Service operation response.\n \n \n \n \n The Get Extension operation retrieves information about a specified\n extension that was added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169557.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n Cancellation token.\n \n \n The Get Extension operation response.\n \n \n \n \n The List Hosted Services operation lists the cloud services\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460781.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Hosted Service operation response.\n \n \n \n \n The List Available Extensions operation lists the extensions that\n are available to add to your cloud service. In Windows Azure, a\n process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169559.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The List Extensions operation lists all of the extensions that were\n added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169561.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Cancellation token.\n \n \n The List Extensions operation response.\n \n \n \n \n The List Extension Versions operation lists the versions of an\n extension that are available to add to a cloud service. In Azure,\n a process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495437.aspx\n for more information)\n \n \n Required. The provider namespace.\n \n \n Required. The extension type name.\n \n \n Cancellation token.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The Update Hosted Service operation can update the label or\n description of a cloud service in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441303.aspx\n for more information)\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Update Hosted Service\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Add Extension operation adds an available extension to your\n cloud service. In Azure, a process can run as an extension of a\n cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Add Extension operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Add Extension operation adds an available extension to your\n cloud service. In Azure, a process can run as an extension of a\n cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Add Extension operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Begin Adding Extension operation adds an available extension to\n your cloud service. In Azure, a process can run as an extension of\n a cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Begin Adding Extension\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Adding Extension operation adds an available extension to\n your cloud service. In Azure, a process can run as an extension of\n a cloud service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n can find the available extension by using the List Available\n Extensions operation. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169558.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Begin Adding Extension\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting All Hosted Service operation deletes the\n specified cloud service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting All Hosted Service operation deletes the\n specified cloud service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Extension operation deletes the specified\n extension from a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Extension operation deletes the specified\n extension from a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Check Hosted Service Name Availability operation checks for the\n availability of the specified cloud service name. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154116.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The cloud service name that you would like to use.\n \n \n The Check Hosted Service Name Availability operation response.\n \n \n \n \n The Check Hosted Service Name Availability operation checks for the\n availability of the specified cloud service name. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154116.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The cloud service name that you would like to use.\n \n \n The Check Hosted Service Name Availability operation response.\n \n \n \n \n The Create Hosted Service operation creates a new cloud service in\n Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441304.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. Parameters supplied to the Create Hosted Service\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Hosted Service operation creates a new cloud service in\n Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441304.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. Parameters supplied to the Create Hosted Service\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete All Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete All Hosted Service operation deletes the specified cloud\n service from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441305.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Extension operation deletes the specified extension from\n a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Extension operation deletes the specified extension from\n a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169560.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Hosted Service Properties operation retrieves system\n properties for the specified cloud service. These properties\n include the service name and service type; and the name of the\n affinity group to which the service belongs, or its location if it\n is not part of an affinity group. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The Get Hosted Service operation response.\n \n \n \n \n The Get Hosted Service Properties operation retrieves system\n properties for the specified cloud service. These properties\n include the service name and service type; and the name of the\n affinity group to which the service belongs, or its location if it\n is not part of an affinity group. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The Get Hosted Service operation response.\n \n \n \n \n The Get Detailed Hosted Service Properties operation retrieves\n system properties for the specified cloud service. These\n properties include the service name and service type; the name of\n the affinity group to which the service belongs, or its location\n if it is not part of an affinity group; and information on the\n deployments of the service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The detailed Get Hosted Service operation response.\n \n \n \n \n The Get Detailed Hosted Service Properties operation retrieves\n system properties for the specified cloud service. These\n properties include the service name and service type; the name of\n the affinity group to which the service belongs, or its location\n if it is not part of an affinity group; and information on the\n deployments of the service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460806.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The detailed Get Hosted Service operation response.\n \n \n \n \n The Get Extension operation retrieves information about a specified\n extension that was added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169557.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n The Get Extension operation response.\n \n \n \n \n The Get Extension operation retrieves information about a specified\n extension that was added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169557.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. The identifier that was assigned to the extension when it\n was added to the cloud service\n \n \n The Get Extension operation response.\n \n \n \n \n The List Hosted Services operation lists the cloud services\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460781.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n The List Hosted Service operation response.\n \n \n \n \n The List Hosted Services operation lists the cloud services\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460781.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n The List Hosted Service operation response.\n \n \n \n \n The List Available Extensions operation lists the extensions that\n are available to add to your cloud service. In Windows Azure, a\n process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169559.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The List Available Extensions operation lists the extensions that\n are available to add to your cloud service. In Windows Azure, a\n process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169559.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The List Extensions operation lists all of the extensions that were\n added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169561.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The List Extensions operation response.\n \n \n \n \n The List Extensions operation lists all of the extensions that were\n added to a cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn169561.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n The List Extensions operation response.\n \n \n \n \n The List Extension Versions operation lists the versions of an\n extension that are available to add to a cloud service. In Azure,\n a process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495437.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The provider namespace.\n \n \n Required. The extension type name.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The List Extension Versions operation lists the versions of an\n extension that are available to add to a cloud service. In Azure,\n a process can run as an extension of a cloud service. For example,\n Remote Desktop Access or the Azure Diagnostics Agent can run as\n extensions to the cloud service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495437.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The provider namespace.\n \n \n Required. The extension type name.\n \n \n The List Available Extensions operation response.\n \n \n \n \n The Update Hosted Service operation can update the label or\n description of a cloud service in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441303.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Update Hosted Service\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Update Hosted Service operation can update the label or\n description of a cloud service in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441303.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IHostedServiceOperations.\n \n \n Required. The name of the cloud service.\n \n \n Required. Parameters supplied to the Update Hosted Service\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Compute Management API includes operations for managing the load\n balancers for your subscription.\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n The name of the service.\n \n \n The name of the deployment.\n \n \n Parameters supplied to the Create Load Balancer operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n The name of the service.\n \n \n The name of the deployment.\n \n \n The name of the load balancer.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n The name of the service.\n \n \n The name of the deployment.\n \n \n Parameters supplied to the Create Load Balancer operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n The name of the service.\n \n \n The name of the deployment.\n \n \n The name of the load balancer.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Operations for determining the version of the Azure Guest Operating\n System on which your service is running. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684169.aspx for\n more information)\n \n \n \n \n The List Operating Systems operation lists the versions of the\n guest operating system that are currently available in Windows\n Azure. The 2010-10-28 version of List Operating Systems also\n indicates what family an operating system version belongs to.\n Currently Azure supports two operating system families: the Azure\n guest operating system that is substantially compatible with\n Windows Server 2008 SP2, and the Azure guest operating system that\n is substantially compatible with Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684168.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Operating Systems operation response.\n \n \n \n \n The List OS Families operation lists the guest operating system\n families available in Azure, and also lists the operating system\n versions available for each family. Currently Azure supports two\n operating system families: the Azure guest operating system that\n is substantially compatible with Windows Server 2008 SP2, and the\n Azure guest operating system that is substantially compatible with\n Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441291.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Operating System Families operation response.\n \n \n \n \n Operations for managing service certificates for your subscription.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee795178.aspx for\n more information)\n \n \n \n \n The Begin Creating Service Certificate operation adds a certificate\n to a hosted service. This operation is an asynchronous operation.\n To determine whether the management service has finished\n processing the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n The DNS prefix name of your service.\n \n \n Parameters supplied to the Begin Creating Service Certificate\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Parameters supplied to the Begin Deleting Service Certificate\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Service Certificate operation adds a certificate to a\n hosted service. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n The DNS prefix name of your service.\n \n \n Parameters supplied to the Create Service Certificate operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Parameters supplied to the Delete Service Certificate operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Service Certificate operation returns the public data for\n the specified X.509 certificate associated with a hosted service.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460792.aspx\n for more information)\n \n \n Parameters supplied to the Get Service Certificate operation.\n \n \n Cancellation token.\n \n \n The Get Service Certificate operation response.\n \n \n \n \n The List Service Certificates operation lists all of the service\n certificates associated with the specified hosted service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154105.aspx\n for more information)\n \n \n The DNS prefix name of your hosted service.\n \n \n Cancellation token.\n \n \n The List Service Certificates operation response.\n \n \n \n \n The Service Management API includes operations for managing the disks\n in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157188.aspx for\n more information)\n \n \n \n \n The Begin Deleting Data Disk operation removes the specified data\n disk from a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of the deployment.\n \n \n The name of the role to delete the data disk from.\n \n \n The logical unit number of the disk.\n \n \n Specifies that the source blob for the disk should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Data Disk operation adds a data disk to a virtual\n machine. There are three ways to create the data disk using the\n Add Data Disk operation. Option 1 - Attach an empty data disk to\n the role by specifying the disk label and location of the disk\n image. Do not include the DiskName and SourceMediaLink elements in\n the request body. Include the MediaLink element and reference a\n blob that is in the same geographical region as the role. You can\n also omit the MediaLink element. In this usage, Azure will create\n the data disk in the storage account configured as default for the\n role. Option 2 - Attach an existing data disk that is in the image\n repository. Do not include the DiskName and SourceMediaLink\n elements in the request body. Specify the data disk to use by\n including the DiskName element. Note: If included the in the\n response body, the MediaLink and LogicalDiskSizeInGB elements are\n ignored. Option 3 - Specify the location of a blob in your storage\n account that contain a disk image to use. Include the\n SourceMediaLink element. Note: If the MediaLink element\n isincluded, it is ignored. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157199.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of the deployment.\n \n \n The name of the role to add the data disk to.\n \n \n Parameters supplied to the Create Virtual Machine Data Disk\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Parameters supplied to the Create Virtual Machine Disk operation.\n \n \n Cancellation token.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Delete Data Disk operation removes the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of the deployment.\n \n \n The name of the role to delete the data disk from.\n \n \n The logical unit number of the disk.\n \n \n Specifies that the source blob for the disk should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Disk operation deletes the specified data or operating\n system disk from your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157200.aspx\n for more information)\n \n \n The name of the disk to delete.\n \n \n Specifies that the source blob for the disk should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Data Disk operation retrieves the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157180.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of the deployment.\n \n \n The name of the role.\n \n \n The logical unit number of the disk.\n \n \n Cancellation token.\n \n \n The Get Data Disk operation response.\n \n \n \n \n The Get Disk operation retrieves a disk from the user image\n repository. The disk can be an operating system disk or a data\n disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n The name of the disk.\n \n \n Cancellation token.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The List Disks operation retrieves a list of the disks in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157176.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Disks operation response.\n \n \n \n \n The Update Data Disk operation updates the specified data disk\n attached to the specified virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157190.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of the deployment.\n \n \n The name of the role to add the data disk to.\n \n \n The logical unit number of the disk.\n \n \n Parameters supplied to the Update Virtual Machine Data Disk\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Add Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n The name of the disk being updated.\n \n \n Parameters supplied to the Update Virtual Machine Disk operation.\n \n \n Cancellation token.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Service Management API includes operations for managing the virtual\n machine extensions in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx for\n more information)\n \n \n \n \n The List Resource Extensions operation lists the resource\n extensions that are available to add to a Virtual Machine. In\n Azure, a process can run as a resource extension of a Virtual\n Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495441.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n The List Resource Extension Versions operation lists the versions\n of a resource extension that are available to add to a Virtual\n Machine. In Azure, a process can run as a resource extension of a\n Virtual Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495440.aspx\n for more information)\n \n \n The name of the publisher.\n \n \n The name of the extension.\n \n \n Cancellation token.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n The Service Management API includes operations for managing the virtual\n machines in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx for\n more information)\n \n \n \n \n The Begin Capturing Role operation creates a copy of the operating\n system virtual hard disk (VHD) that is deployed in the virtual\n machine, saves the VHD copy in the same storage location as the\n operating system VHD, and registers the copy as an image in your\n image gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to restart.\n \n \n Parameters supplied to the Begin Capturing Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Begin capturing role as VM template.\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to restart.\n \n \n Parameters supplied to the Capture Virtual Machine operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Role operation adds a virtual machine to an\n existing deployment. You can refer to the OSDisk in the Add Role\n operation in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Begin Creating Virtual Machine operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Virtual Machine Deployment operation provisions\n a virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n The name of your service.\n \n \n Parameters supplied to the Begin Creating Virtual Machine\n Deployment operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Role operation deletes the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to delete.\n \n \n Specifies that the source blob(s) for the virtual machine should\n also be deleted from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Restarting role operation restarts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to restart.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to shutdown.\n \n \n The parameters for the shutdown vm operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Shutting Down Roles operation stops the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469421.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters to pass to the Begin Shutting Down Roles operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Role operation starts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to start.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Roles operation starts the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469419.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters to pass to the Begin Starting Roles operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Role operation adds a virtual machine to an\n existing deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of your virtual machine.\n \n \n Parameters supplied to the Begin Updating Virtual Machine operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469417.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Begin Updating Load Balanced Endpoint\n Set operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Capture Role operation creates a copy of the operating system\n virtual hard disk (VHD) that is deployed in the virtual machine,\n saves the VHD copy in the same storage location as the operating\n system VHD, and registers the copy as an image in your image\n gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to restart.\n \n \n Parameters supplied to the Capture Virtual Machine operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Capture role as VM template.\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to restart.\n \n \n Parameters supplied to the Capture Virtual Machine operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Role operation adds a virtual machine to an existing\n deployment. You can refer to the OSDisk in the Add Role operation\n in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Create Virtual Machine operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Virtual Machine Deployment operation provisions a\n virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n The name of your service.\n \n \n Parameters supplied to the Create Virtual Machine Deployment\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role operation deletes the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to delete.\n \n \n Specifies that the source blob(s) for the virtual machine should\n also be deleted from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Role operation retrieves information about the specified\n virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157193.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine.\n \n \n Cancellation token.\n \n \n The Get Virtual Machine operation response.\n \n \n \n \n The Download RDP file operation retrieves the Remote Desktop\n Protocol configuration file from the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157183.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine.\n \n \n Cancellation token.\n \n \n The Download RDP file operation response.\n \n \n \n \n The Restart role operation restarts the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to restart.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to shutdown.\n \n \n The parameters for the shutdown virtual machine operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Roles operation stops the specified set of virtual\n machines.\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters to pass to the Shutdown Roles operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Role operation starts the specified virtual machine.\n (see http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of the virtual machine to start.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Roles operation starts the specified set of virtual\n machines.\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters to pass to the Start Roles operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Role operation adds a virtual machine to an existing\n deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n The name of your virtual machine.\n \n \n Parameters supplied to the Update Virtual Machine operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole.\n \n \n The name of your service.\n \n \n The name of your deployment.\n \n \n Parameters supplied to the Update Load Balanced Endpoint Set\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Service Management API includes operations for managing the OS\n images in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157175.aspx for\n more information)\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n The name of the virtual machine image to share.\n \n \n The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n The name of the virtual machine image to replicate. Note: The OS\n Image Name should be the user OS Image, not the published name of\n the OS Image.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create OS Image operation adds an operating system image that\n is stored in a storage account and is available from the image\n repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157192.aspx\n for more information)\n \n \n Parameters supplied to the Create Virtual Machine Image operation.\n \n \n Cancellation token.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n The Delete OS Image operation deletes the specified OS image from\n your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157203.aspx\n for more information)\n \n \n The name of the image to delete.\n \n \n Specifies that the source blob for the image should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get OS Image operation retrieves the details for an operating\n system image from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n The name of the OS image to retrieve.\n \n \n Cancellation token.\n \n \n A virtual machine image associated with your subscription.\n \n \n \n \n Gets OS Image's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n The name of the virtual machine image to replicate.\n \n \n Cancellation token.\n \n \n The Get Details OS Images operation response.\n \n \n \n \n The List OS Images operation retrieves a list of the operating\n system images from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List OS Images operation response.\n \n \n \n \n Replicate an OS image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n The name of the virtual machine OS image to replicate.\n \n \n Parameters supplied to the Replicate Virtual Machine Image\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n The name of the virtual machine image to share.\n \n \n The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n The name of the virtual machine image to replicate. Note: The OS\n Image Name should be the user OS Image, not the published name of\n the OS Image.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update OS Image operation updates an OS image that in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157198.aspx\n for more information)\n \n \n The name of the virtual machine image to be updated.\n \n \n Parameters supplied to the Update Virtual Machine Image operation.\n \n \n Cancellation token.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n The Service Management API includes operations for managing the virtual\n machine templates in your subscription.\n \n \n \n \n The Begin Deleting Virtual Machine Image operation deletes the\n specified virtual machine image.\n \n \n The name of the virtual machine image to delete.\n \n \n Specifies that the source blob for the image should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n The name of the virtual machine image to share.\n \n \n The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n The name of the virtual machine image to replicate. Note: The VM\n Image Name should be the user VM Image, not the published name of\n the VM Image.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Virtual Machine Image operation deletes the specified\n virtual machine image.\n \n \n The name of the virtual machine image to delete.\n \n \n Specifies that the source blob for the image should also be deleted\n from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets VMImage's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n The name of the virtual machine image to replicate.\n \n \n Cancellation token.\n \n \n The Get Details VM Images operation response.\n \n \n \n \n The List Virtual Machine Images operation retrieves a list of the\n virtual machine images.\n \n \n Cancellation token.\n \n \n The List VM Images operation response.\n \n \n \n \n Replicate an VM image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n The name of the virtual machine image to replicate.\n \n \n Parameters supplied to the Replicate Virtual Machine Image\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n The name of the virtual machine image to share.\n \n \n The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n The name of the virtual machine image to replicate. Note: The VM\n Image Name should be the user VM Image, not the published name of\n the VM Image.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update VM Image operation updates a VM image that in your image\n repository.\n \n \n The name of the virtual machine image to be updated.\n \n \n Parameters supplied to the Update Virtual Machine Image operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Compute Management API includes operations for managing the load\n balancers for your subscription.\n \n \n \n \n Initializes a new instance of the LoadBalancerOperations class.\n \n \n Reference to the service client.\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. Parameters supplied to the Create Load Balancer operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the load balancer.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. Parameters supplied to the Create Load Balancer operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the load balancer.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. Parameters supplied to the Create Load Balancer operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. Parameters supplied to the Create Load Balancer operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the load balancer.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the load balancer.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. Parameters supplied to the Create Load Balancer operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Add an internal load balancer to a an existing deployment. When\n used by an input endpoint, the internal load balancer will provide\n an additional private VIP that can be used for load balancing to\n the roles in this deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. Parameters supplied to the Create Load Balancer operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the load balancer.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Delete an internal load balancer from the deployment.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.ILoadBalancerOperations.\n \n \n Required. The name of the service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the load balancer.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n An access control rule for a public endpoint.\n \n \n \n \n Initializes a new instance of the AccessControlListRule class.\n \n \n \n \n Optional. The action allowed by this Access Control List Rule.\n \n \n \n \n Optional. The description for this Access Control List Rule.\n \n \n \n \n Optional. The order of application for this Access Control List\n Rule.\n \n \n \n \n Optional. The remote subnet that is granted access for this Access\n Control List Rule.\n \n \n \n \n The service certificate format. Azure supports the pfx and cer file\n formats.\n \n \n \n \n Algorithm that was used to hash a service certificate.\n \n \n \n \n The compute capabilities.\n \n \n \n \n Initializes a new instance of the ComputeCapabilities class.\n \n \n \n \n Optional. Role sizes support for IaaS deployments.\n \n \n \n \n Optional. Role sizes support for PaaS deployments.\n \n \n \n \n Objects that provide system or application data.\n \n \n \n \n Initializes a new instance of the ConfigurationSet class.\n \n \n \n \n Optional. Specifies the string representing the administrator\n password to use for the virtual machine. If the VM will be created\n from a 'Specialized' VM image, the password is not required.\n \n \n \n \n Optional. Specifies the name that is used to rename the default\n administrator account. If the VM will be created from a\n 'Specialized' VM image, the user name is not required.\n \n \n \n \n Optional. Specifies the computer name for the virtual machine. If\n the computer name is not specified, a name is created based on the\n name of the role. Computer names must be 1 to 15 characters in\n length. This element is only used with the\n WindowsProvisioningConfiguration set.\n \n \n \n \n Optional. Specifies the configuration type for the configuration\n set.\n \n \n \n \n Optional. Optional. Provides base64 encoded custom data to be\n passed to VM.\n \n \n \n \n Optional. Specifies whether or not SSH authentication is disabled\n for the password. This element is only used with the\n LinuxProvisioningConfiguration set. By default this value is set\n to true.\n \n \n \n \n Optional. Contains properties that specify a domain to which the\n virtual machine will be joined. This element is only used with the\n WindowsProvisioningConfiguration set.\n \n \n \n \n Optional. Specifies whether automatic updates are enabled for the\n virtual machine. This element is only used with the\n WindowsProvisioningConfiguration set. The default value is false.\n \n \n \n \n Optional. Specifies the host name for the VM. Host names are ASCII\n character strings 1 to 64 characters in length. This element is\n only used with the LinuxProvisioningConfiguration set.\n \n \n \n \n Optional. Contains a collection of external endpoints for the\n virtual machine. This element is only used with the\n NetworkConfigurationSet type.\n \n \n \n \n Optional. Optional. A set of public IPs. Currently, only one\n additional public IP per role is supported in an IaaS deployment.\n The IP address is in addition to the default VIP for the\n deployment.\n \n \n \n \n Optional. Specifies whether password should be reset the first time\n the administrator logs in.\n \n \n \n \n Optional. Specifies the SSH public keys and key pairs to populate\n in the image during provisioning. This element is only used with\n the LinuxProvisioningConfiguration set.\n \n \n \n \n Optional. Specifies a Customer Address, i.e. an IP address assigned\n to a VM in a VNet's SubNet. For example: 10.0.0.4.\n \n \n \n \n Optional. Contains a list of service certificates with which to\n provision to the new role. This element is only used with the\n WindowsProvisioningConfiguration set.\n \n \n \n \n Optional. The list of Virtual Network subnet names that the\n deployment belongs to. This element is only used with the\n NetworkConfigurationSet type.\n \n \n \n \n Optional. Specifies the time zone for the virtual machine. This\n element is only used with the WindowsProvisioningConfiguration\n set. For a complete list of supported time zone entries, you can\n refer to the values listed in the registry entry\n HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\n NT\\\\CurrentVersion\\\\Time Zones on a computer running Windows 7,\n Windows Server 2008, and Windows Server 2008 R2 or you can use the\n tzutil command-line tool to list the valid time. The tzutil tool\n is installed by default on Windows 7, Windows Server 2008, and\n Windows Server 2008 R2.\n \n \n \n \n Optional. Specifies the name of a user to be created in the sudoer\n group of the virtual machine. User names are ASCII character\n strings 1 to 32 characters in length. This element is only used\n with the LinuxProvisioningConfiguration set.\n \n \n \n \n Optional. Specifies the password for user name. Passwords are ASCII\n character strings 6 to 72 characters in length. This element is\n only used with the LinuxProvisioningConfiguration set.\n \n \n \n \n Optional. Configures the Windows Remote Management service on the\n virtual machine, which enables remote Windows PowerShell.\n \n \n \n \n An additional public IP that will be created for the role. The\n public IP will be an additional IP for the role. The role\n continues to be addressable via the default deployment VIP.\n \n \n \n \n Initializes a new instance of the PublicIP class.\n \n \n \n \n Optional. The name of the public IP.\n \n \n \n \n Specifies the configuration type for the configuration set.\n \n \n \n \n The data disk configuration.\n \n \n \n \n Initializes a new instance of the\n DataDiskConfigurationUpdateParameters class.\n \n \n \n \n Optional. Optional. Host caching option for a data disk within the\n VM Image. 'ReadOnly', 'ReadWrite', or 'None'.If this parameter is\n specified you must also specify the Name for the\n DataDiskConfiguration you want to change.\n \n \n \n \n Optional. Optional. LUN for the data disk. LUNs must not conflict\n with other Data Disks in the VM Image. If this parameter is\n specified you must also specify the Name for the\n DataDiskConfiguration you want to change.\n \n \n \n \n Optional. Optional if not changing any data disk configurations.\n Name of an existing DataDiskConfiguration. The name cannot be\n changed, this is just to identify the disk for changing other\n properties.\n \n \n \n \n Objects that are used to create a data disk for a virtual machine.\n \n \n \n \n Initializes a new instance of the DataVirtualHardDisk class.\n \n \n \n \n Optional. Specifies the platform caching behavior of the data disk\n blob for read/write efficiency. The default value is ReadOnly.\n \n \n \n \n Optional. Specifies the friendly name of the VHD used to create the\n data disk for the virtual machine.\n \n \n \n \n Optional. Specifies the size, in GB, of an empty VHD to be attached\n to the virtual machine. The VHD can be created as part of an\n attached disk or created as a virtual machine call by specifying\n the value for this property. Azure creates the empty VHD based on\n the size preference and attaches the newly created VHD to the\n virtual machine.\n \n \n \n \n Optional. Specifies the Logical Unit Number (LUN) for the data\n disk. The LUN specifies the slot in which the data drive appears\n when mounted for usage by the virtual machine. This element is\n only listed when more than one data disk is attached to a virtual\n machine.\n \n \n \n \n Optional. Optional. If the disk that is being added is already\n registered in the subscription or the VHD for the disk already\n exists in blob storage, this element is ignored. If a VHD file\n does not exist in blob storage, this element defines the location\n of the new VHD that is created when the new disk is added.Example:\n http://example.blob.core.windows.net/disks/mydatadisk.vhd\n \n \n \n \n Optional. Specifies the name of the VHD used to create the data\n disk for the virtual machine.\n \n \n \n \n Optional. Optional. If the disk that is being added is already\n registered in the subscription or the VHD for the disk does not\n exist in blob storage, this element is ignored. If the VHD file\n exists in blob storage, this element defines the path to the VHD\n and a disk is registered from it and attached to the virtual\n machine.\n \n \n \n \n Parameters supplied to the Change Configuration Deployment operation.\n \n \n \n \n Initializes a new instance of the\n DeploymentChangeConfigurationParameters class.\n \n \n \n \n Required. The encoded service configuration file for the deployment.\n \n \n \n \n Optional. Represents the name of an extended deployment property.\n Each extended property must have a defined name and a value. You\n can have a maximum of 25 extended property name/value pairs. The\n maximum length of the name element is 64 characters, only\n alphanumeric characters and underscores are valid in the name, and\n the name must start with a letter. Attempting to use other\n characters, starting the name with a non-letter character, or\n entering a name that is identical to that of another extended\n property owned by the same hosted service will result in a status\n code 400 (Bad Request) error.\n \n \n \n \n Optional. Represents an extension that is added to the cloud\n service. In Azure, a process can run as an extension of a cloud\n service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n must add an extension to the cloud service by using Add Extension\n before it can be added to the deployment.\n \n \n \n \n Optional. The Change Configuration Deployment mode. Possible values\n are: Auto and Manual. If not specified, the default value is Auto.\n If set to Manual, WalkUpgradeDomain must be called to apply the\n update. If set to Auto, the update is automatically applied to\n each update domain for the service.\n \n \n \n \n Optional. Indicates whether to treat package validation warnings as\n errors. The default value is false. If set to true, the Created\n Deployment operation fails if there are validation warnings on the\n service package.\n \n \n \n \n Parameters supplied to the Create Deployment operation.\n \n \n \n \n Initializes a new instance of the DeploymentCreateParameters class.\n \n \n \n \n Required. The service configuration file for the deployment.\n \n \n \n \n Optional. Represents the name of an extended deployment property.\n Each extended property must have a defined name and a value. You\n can have a maximum of 25 extended property name/value pairs. The\n maximum length of the name element is 64 characters, only\n alphanumeric characters and underscores are valid in the name, and\n the name must start with a letter. Attempting to use other\n characters, starting the name with a non-letter character, or\n entering a name that is identical to that of another extended\n property owned by the same hosted service will result in a status\n code 400 (Bad Request) error.\n \n \n \n \n Optional. Represents an extension that is added to the cloud\n service. In Azure, a process can run as an extension of a cloud\n service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n must add an extension to the cloud service by using Add Extension\n before it can be added to the deployment.\n \n \n \n \n Required. A name for the hosted service. The name can be up to 100\n characters in length. It is recommended that the label be unique\n within the subscription. The name can be used identify the hosted\n service for your tracking purposes.\n \n \n \n \n Required. The name for the deployment. The deployment name must be\n unique among other deployments for the cloud service.\n \n \n \n \n Required. A URL that refers to the location of the service package\n in the Blob service. The service package can be located either in\n a storage account beneath the same subscription or a Shared Access\n Signature (SAS) URI from any storage account. For more info about\n Shared Access Signatures, see Delegating Access with a Shared\n Access Signature (REST API) at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee395415.aspx.\n \n \n \n \n Optional. Indicates whether to start the deployment immediately\n after it is created. The default value is false. If false, the\n service model is still deployed to the virtual machines but the\n code is not run immediately. Instead, the service is Suspended\n until you call Update Deployment Status and set the status\n toRunning, at which time the service will be started. A deployed\n service still incurs charges, even if it is suspended.\n \n \n \n \n Optional. Indicates whether to treat package validation warnings as\n errors. The default value is false. If set to true, the Created\n Deployment operation fails if there are validation warnings on the\n service package.\n \n \n \n \n Parameters supplied to the delete role instance by deployment name\n operation.\n \n \n \n \n Initializes a new instance of the\n DeploymentDeleteRoleInstanceParameters class.\n \n \n \n \n Optional.\n \n \n \n \n Parameters supplied to the Get Package operation.\n \n \n \n \n Initializes a new instance of the DeploymentGetPackageParameters\n class.\n \n \n \n \n Required. Specifies the URI of the container to which the packages\n will be saved.\n \n \n \n \n Optional. Specifies whether an existing package in the storage\n container should be overwritten.\n \n \n \n \n A deployment that exists in the cloud service.\n \n \n \n \n Initializes a new instance of the DeploymentGetResponse class.\n \n \n \n \n Optional. The configuration file of the deployment.\n \n \n \n \n Optional. The time that the deployment was created.\n \n \n \n \n Optional. The deployment environment in which this deployment is\n running.\n \n \n \n \n Optional. The custom DNS settings that are specified for deployment.\n \n \n \n \n Optional. Represents the name of an extended cloud service\n property. Each extended property must have a defined name and a\n value. You can have a maximum of 50 extended property name and\n value pairs. The maximum length of the name element is 64\n characters, only alphanumeric characters and underscores are valid\n in the name, and it must start with a letter. Attempting to use\n other characters, starting with a non-letter character, or\n entering a name that is identical to that of another extended\n property owned by the same service will result in a status code\n 400 (Bad Request) error. Each extended property value has a\n maximum length of 255 characters.\n \n \n \n \n Optional. Represents an extension that is added to the cloud\n service.\n \n \n \n \n Optional. The user-supplied name of the deployment. This name can\n be used identify the deployment for tracking purposes.\n \n \n \n \n Optional. The last time that the deployment was modified.\n \n \n \n \n Optional. Optional. A list of internal load balancers that each\n provide load balancing on a private VIP. It's created when a name\n is assigned in the list here.\n \n \n \n \n Optional. Indicates whether the deployment is locked for new write\n operations because an existing operation is updating the\n deployment.\n \n \n \n \n Optional.\n \n \n \n \n Optional. Specifies information about when the virtual machine has\n been started and stopped.\n \n \n \n \n Optional. The unique identifier for this deployment.\n \n \n \n \n Optional. The name of the Reserved IP that the deployment belongs\n to.\n \n \n \n \n Optional. The list of role instances in the deployment.\n \n \n \n \n Optional. The list of roles in the deployment.\n \n \n \n \n Optional. Indicates whether the Rollback Update Or Upgrade\n operation is allowed at this time.\n \n \n \n \n Optional. The version of the Azure SDK that was used to generate\n the .cspkg that created this deployment. The first two numerical\n components of the returned version represent the version of the\n SDK used to create the package.\n \n \n \n \n Optional. The status of the deployment.\n \n \n \n \n Optional. The number of upgrade domains available to this cloud\n service.\n \n \n \n \n Optional. Information about an update occurring on the deployment.\n \n \n \n \n Optional. The URL used to access the hosted service. For example,\n if the service name is MyService you could access the access the\n service by calling: http://MyService.cloudapp.net.\n \n \n \n \n Optional. The virtual IP addresses that are specified for the\n deployment.\n \n \n \n \n Optional. The name of the Virtual Network that the virtual machine\n connects to.\n \n \n \n \n Parameters supplied to the Rollback Update Or Upgrade operation.\n \n \n \n \n Initializes a new instance of the\n DeploymentRollbackUpdateOrUpgradeParameters class.\n \n \n \n \n Optional. Specifies whether the rollback should proceed even when\n it will cause local data to be lost from some role instances. True\n if the rollback should proceed; otherwise false.\n \n \n \n \n Required. Specifies whether the rollback should proceed\n automatically.\n \n \n \n \n The deployment environment in which this deployment is running.\n \n \n \n \n The status of the deployment.\n \n \n \n \n Parameters supplied to the Swap Deployment operation.\n \n \n \n \n Initializes a new instance of the DeploymentSwapParameters class.\n \n \n \n \n Optional. The optional name of the production deployment.\n \n \n \n \n Required. The name of the source deployment.\n \n \n \n \n Parameters supplied to the Update Deployment Status operation.\n \n \n \n \n Initializes a new instance of the DeploymentUpdateStatusParameters\n class.\n \n \n \n \n Required. The new status of the deployment.\n \n \n \n \n Parameters supplied to the Upgrade Deployment operation.\n \n \n \n \n Initializes a new instance of the DeploymentUpgradeParameters class.\n \n \n \n \n Required. The service configuration file for the deployment.\n \n \n \n \n Optional. Represents the name of an extended deployment property.\n Each extended property must have a defined name and a value. You\n can have a maximum of 25 extended property name/value pairs. The\n maximum length of the name element is 64 characters, only\n alphanumeric characters and underscores are valid in the name, and\n the name must start with a letter. Attempting to use other\n characters, starting the name with a non-letter character, or\n entering a name that is identical to that of another extended\n property owned by the same hosted service will result in a status\n code 400 (Bad Request) error.\n \n \n \n \n Optional. Represents an extension that is added to the cloud\n service. In Azure, a process can run as an extension of a cloud\n service. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as extensions to the cloud service. You\n must add an extension to the cloud service by using Add Extension\n before it can be added to the deployment.\n \n \n \n \n Required. Specifies whether the rollback should proceed even when\n it will cause local data to be lost from some role instances.\n \n \n \n \n Required. A name for the hosted service. The name can be up to 100\n characters in length. It is recommended that the label be unique\n within the subscription. The name can be used identify the hosted\n service for your tracking purposes.\n \n \n \n \n Required. The type of update to initiate. Role instances are\n allocated to update domains when the service is deployed. Updates\n can be initiated manually in each update domain or initiated\n automatically in all update domains. Possible values are Auto or\n Manual. If not specified, the default value is Auto. If set to\n Manual, WalkUpgradeDomain must be called to apply the update. If\n set to Auto, the update is automatically applied to each update\n domain in sequence.\n \n \n \n \n Required. A URL that refers to the location of the service package\n in the Blob service. The service package can be located either in\n a storage account beneath the same subscription or a Shared Access\n Signature (SAS) URI from any storage account. For more information\n about Shared Access Signatures, see Delegating Access with a\n Shared Access Signature (REST API) at\n http://msdn.microsoft.com/en-us/library/windowsazure/ee395415.aspx.\n \n \n \n \n Optional. The name of the specific role instance to update.\n \n \n \n \n The type of the upgrade.\n \n \n \n \n Parameters supplied to the Walk Upgrade Domain operation.\n \n \n \n \n Initializes a new instance of the\n DeploymentWalkUpgradeDomainParameters class.\n \n \n \n \n Required. An integer value that identifies the update domain to\n update. Update domains are identified with a zero-based index: the\n first update domain has an ID of 0, the second has an ID of 1, and\n so on.\n \n \n \n \n Information about a DNS Server in the virtual network.\n \n \n \n \n Initializes a new instance of the DnsServer class.\n \n \n \n \n Optional. The DNS server address.\n \n \n \n \n Optional. The name of the DNS server.\n \n \n \n \n The custom DNS settings that are specified for the deployment.\n \n \n \n \n Initializes a new instance of the DnsSettings class.\n \n \n \n \n Optional. Contains a collection of objects that define the DNS\n server settings.\n \n \n \n \n Specifies the values to use to join the virtual machine to the domain.\n \n \n \n \n Initializes a new instance of the DomainJoinCredentials class.\n \n \n \n \n Optional. Specifies the name of the domain used to authenticate an\n account. The value is a fully qualified DNS domain. If the domains\n name is not specified, Username must specify the user principal\n name (UPN) format (user@fully-qualified-DNS-domain) or the\n fully-qualified-DNS-domain\\\\username format. Example: example.com.\n \n \n \n \n Required. Specifies the password to use to join the domain.\n \n \n \n \n Required. Specifies a user name in the domain that can be used to\n join the domain.\n \n \n \n \n The configuration needed to provision the machine in the domain.\n \n \n \n \n Initializes a new instance of the DomainJoinProvisioning class.\n \n \n \n \n Optional. The account info for joining the domain.\n \n \n \n \n Contains properties that specify a domain to which the virtual machine\n will be joined. This element is only used with the\n WindowsProvisioningConfiguration set.\n \n \n \n \n Initializes a new instance of the DomainJoinSettings class.\n \n \n \n \n Optional. Specifies the values to use to join the virtual machine\n to the domain.\n \n \n \n \n Optional. Specifies the domain to join.\n \n \n \n \n Optional. Specifies the Lightweight Directory Access Protocol\n (LDAP) X 500-distinguished name of the organizational unit (OU) in\n which the computer account is created. This account is in Active\n Directory on a domain controller in the domain to which the\n computer is being joined. Example:\n OU=MyOu,OU=MyParentOu,DC=example.com,DC=MyCompany,DC=com.\n \n \n \n \n Optional. Additional information for domain join provisioning.\n \n \n \n \n The set of access control rules for the endpoint.\n \n \n \n \n Initializes a new instance of the EndpointAcl class.\n \n \n \n \n Optional. The set of access control rules for the endpoint.\n \n \n \n \n Represents an extension that is added to the cloud service.\n \n \n \n \n Initializes a new instance of the ExtensionConfiguration class.\n \n \n \n \n Optional. Specifies a list of extensions that are applied to all\n roles in a deployment.\n \n \n \n \n Optional. Specifies a list of extensions that are applied to\n specific roles in a deployment.\n \n \n \n \n Represents an extension that is to be deployed to a role in a cloud\n service.\n \n \n \n \n Initializes a new instance of the Extension class.\n \n \n \n \n Required. The identifier of the extension. The identifier is\n created when the extension is added to the cloud service. You\n can find the ID of an extension that was added to a cloud\n service by using List Extensions.\n \n \n \n \n Specifies a list of extensions that are applied to specific roles\n in a deployment.\n \n \n \n \n Initializes a new instance of the NamedRole class.\n \n \n \n \n Required. Represents an extension that is to be deployed to a\n role in a cloud service.\n \n \n \n \n Required. Specifies the name of the role.\n \n \n \n \n The configuration for the virtual IP address (VIP) this load balancer\n provides.\n \n \n \n \n Initializes a new instance of the FrontendIPConfiguration class.\n \n \n \n \n Optional. If the deployment exists inside a virtual network, a\n specific address from the load balancer subnet can be specified.\n The VIP for the load balancer will then be this specific IP\n address. If a static virtual network IP address is provided, the\n SubnetName element of the load balancer must be specified as well.\n If the deployment exists outside of a virtual network, no static\n virtual network IP address can be specified.\n \n \n \n \n Optional. If the deployment exists inside a virtual network, a\n subnet of that virtual network must be specified for the load\n balancer. The VIP managed by the load balancer will then be an IP\n address out of this subnet. If the deployment exists outside of a\n virtual network, no subnet can be specified and the private VIP\n will be an IP address from the general private address pool.\n \n \n \n \n Optional. The type of the VIP provided by this load balancer.\n Currently, only 'Private' is supported. This will create load\n balancing services on a private VIP.\n \n \n \n \n The type of the VIP provided by this load balancer. Currently, only\n 'Private' is supported. This will create load balancing services on a\n private VIP.\n \n \n \n \n This object encapsulates a localized status message from the Guest\n Agent.\n \n \n \n \n Initializes a new instance of the GuestAgentFormattedMessage class.\n \n \n \n \n Optional. Language code. Eg. \"en-US\".\n \n \n \n \n Optional. A string containing a message about the status of the\n Guest Agent or Resource Extension.\n \n \n \n \n The guest agent message.\n \n \n \n \n Initializes a new instance of the GuestAgentMessage class.\n \n \n \n \n Optional. The message resource ID.\n \n \n \n \n Optional. The guest agent message parameter list.\n \n \n \n \n Optional. This object contains status information of the Guest Agent\n installed on a RoleInstance. Guest Agent can be installed on a role\n instance by setting \"ProvisionGuestAgent\" to true in Create Deployment\n or Add Role API calls. Version header: Required to be \"2014-04-01\" or\n later.\n \n \n \n \n Initializes a new instance of the GuestAgentStatus class.\n \n \n \n \n Optional. Integer. Status code from the result of applying the GA\n settings.\n \n \n \n \n Optional. This object encapsulates a formatted localized status\n message from the Guest Agent.\n \n \n \n \n Optional. Version of the Guest Agent installed on the role instance.\n \n \n \n \n Optional. This object encapsulates a localized status message from\n the Guest Agent.\n \n \n \n \n Optional. Protocol version used by the Guest Agent for status\n reporting.\n \n \n \n \n Optional. The guest agent status, which can be: \"Ready\" or\n \"NotReady\".\n \n \n \n \n Optional. UTC time at which the status was reported.\n \n \n \n \n The guest agent status, which can be: \"Ready\" or \"NotReady\".\n \n \n \n \n Parameters supplied to the Add Extension operation.\n \n \n \n \n Initializes a new instance of the\n HostedServiceAddExtensionParameters class.\n \n \n \n \n Required. The identifier of the extension.\n \n \n \n \n Optional. The private configuration that is defined using the\n schema returned by the List Available Extensions operation.\n \n \n \n \n Optional. The provider namespace of the extension. The provider\n namespace for Azure extensions is\n Microsoft.Windows.Azure.Extensions.\n \n \n \n \n Optional. The public configuration that is defined using the schema\n returned by the List Available Extensions operation.\n \n \n \n \n Optional. The thumbprint of the certificate that is used to encrypt\n the configuration specified in PrivateConfiguration. If this\n element is not specified, a certificate may be automatically\n generated and added to the cloud service.\n \n \n \n \n Optional. The thumbprint algorithm of the certificate that is used\n to encrypt the configuration specified in PrivateConfiguration.\n \n \n \n \n Required. The type of the extension.\n \n \n \n \n Optional. Specifies the version of the extension. If this element\n is not specified or an asterisk (*) is used as the value, the\n latest version of the extension is used. If the value is specified\n with a major version number and an asterisk as the minor version\n number (X.*), the latest minor version of the specified major\n version is selected. If a major version number and a minor version\n number are specified (X.Y), the specific extension version is\n selected. If a version is specified, an auto-upgrade is performed\n on the role instance.\n \n \n \n \n The Check Hosted Service Name Availability operation response.\n \n \n \n \n Initializes a new instance of the\n HostedServiceCheckNameAvailabilityResponse class.\n \n \n \n \n Optional. Indicates whether the name is available for you to use.\n The operation returns false for reserved or profane words.\n \n \n \n \n Optional. Describes why the name cannot be used to create the cloud\n service.\n \n \n \n \n Parameters supplied to the Create Hosted Service operation.\n \n \n \n \n Initializes a new instance of the HostedServiceCreateParameters\n class.\n \n \n \n \n Optional. The name of an existing affinity group associated with\n this subscription. Required if Location is not specified. This\n name is a GUID and can be retrieved by examining the name element\n of the response body returned by the List Affinity Groups\n operation. Specify either Location or AffinityGroup, but not both.\n To list available affinity groups, use the List Affinity Groups\n operation.\n \n \n \n \n Optional. A description for the cloud service. The description can\n be up to 1024 characters in length.\n \n \n \n \n Optional. Represents the name of an extended cloud service\n property. Each extended property must have a defined name and a\n value. You can have a maximum of 50 extended property name and\n value pairs. The maximum length of the name element is 64\n characters, only alphanumeric characters and underscores are valid\n in the name, and it must start with a letter. Attempting to use\n other characters, starting with a non-letter character, or\n entering a name that is identical to that of another extended\n property owned by the same service will result in a status code\n 400 (Bad Request) error. Each extended property value has a\n maximum length of 255 characters.\n \n \n \n \n Required. A name for the cloud service. The name can be up to 100\n characters in length. The name can be used to identify the storage\n account for your tracking purposes.\n \n \n \n \n Optional. The location where the cloud service will be created.\n Required if AffinityGroup is not specified. Specify either\n Location or AffinityGroup, but not both. To list available\n locations, use the List Locations operation.\n \n \n \n \n Required. A name for the cloud service that is unique within Azure.\n This name is the DNS prefix name and can be used to access the\n service.\n \n \n \n \n The detailed Get Hosted Service operation response.\n \n \n \n \n The Get Hosted Service operation response.\n \n \n \n \n Initializes a new instance of the HostedServiceGetResponse class.\n \n \n \n \n Optional. The compute capabilities in this hosted service.\n \n \n \n \n Optional. The properties that are assigned to the cloud service.\n \n \n \n \n Optional. The name of the cloud service. This name is the DNS\n prefix name and can be used to access the cloud service. For\n example, if the cloud service name is MyService you could access\n the access the cloud service by calling:\n http://MyService.cloudapp.net.\n \n \n \n \n Optional. The Service Management API request URI used to perform\n Get Hosted Service Properties requests against the cloud service.\n \n \n \n \n Initializes a new instance of the HostedServiceGetDetailedResponse\n class.\n \n \n \n \n Optional. The deployments that exist in the cloud service.\n \n \n \n \n A deployment that exists in the cloud service.\n \n \n \n \n Initializes a new instance of the Deployment class.\n \n \n \n \n Optional. The configuration file of the deployment.\n \n \n \n \n Optional. The time that the deployment was created.\n \n \n \n \n Optional. The deployment environment in which this deployment\n is running.\n \n \n \n \n Optional. The custom DNS settings that are specified for the\n deployment.\n \n \n \n \n Optional. Represents the name of an extended cloud service\n property. Each extended property must have a defined name and\n a value. You can have a maximum of 50 extended property name\n and value pairs. The maximum length of the name element is 64\n characters, only alphanumeric characters and underscores are\n valid in the name, and it must start with a letter. Attempting\n to use other characters, starting with a non-letter character,\n or entering a name that is identical to that of another\n extended property owned by the same service will result in a\n status code 400 (Bad Request) error. Each extended property\n value has a maximum length of 255 characters.\n \n \n \n \n Optional. The user-supplied name of the deployment. This name\n can be used identify the deployment for your tracking purposes.\n \n \n \n \n Optional. The last time that the deployment was modified.\n \n \n \n \n Optional. Indicates whether the deployment is locked for new\n write operations because an existing operation is updating the\n deployment.\n \n \n \n \n Optional. The name of the deployment.\n \n \n \n \n Optional. Specifies information about when the virtual machine\n has been started and stopped.\n \n \n \n \n Optional. The unique identifier for this deployment.\n \n \n \n \n Optional. The list of role instances in the deployment.\n \n \n \n \n Optional. The list of roles in the deployment.\n \n \n \n \n Optional. Indicates whether the Rollback Update Or Upgrade\n operation is allowed at this time.\n \n \n \n \n Optional. The version of the Azure SDK that was used to\n generate the .cspkg that created this deployment. The first\n two numerical components of the returned version represent the\n version of the SDK used to create the package.\n \n \n \n \n Optional. The status of the deployment.\n \n \n \n \n Optional. The number of upgrade domains available to this cloud\n service.\n \n \n \n \n Optional. Specifies information about an update occurring on\n the deployment.\n \n \n \n \n Optional. The URL used to access the hosted service. For\n example, if the service name is MyService you could access the\n access the service by calling: http://MyService.cloudapp.net.\n \n \n \n \n Optional. The virtual IP addresses that are specified for\n thedeployment.\n \n \n \n \n Optional. The name of the Virtual Network that the virtual\n machine connects to.\n \n \n \n \n The Get Extension operation response.\n \n \n \n \n Initializes a new instance of the HostedServiceGetExtensionResponse\n class.\n \n \n \n \n Optional. The identifier of the extension.\n \n \n \n \n Optional. The provider namespace of the extension. The provider\n namespace for Azure extensions is\n Microsoft.Windows.Azure.Extensions.\n \n \n \n \n Optional. The public configuration that is defined using the schema\n returned by the List Available Extensions operation.\n \n \n \n \n Optional. The thumbprint of the certificate that is used to encrypt\n the configuration specified in PrivateConfiguration. If this\n element is not specified, a certificate may be automatically\n generated and added to the cloud service.\n \n \n \n \n Optional. The thumbprint algorithm of the certificate that is used\n toencrypt the configuration specified in PrivateConfiguration.\n \n \n \n \n Required. The type of the extension.\n \n \n \n \n Optional. The version of the extension.\n \n \n \n \n The List Available Extensions operation response.\n \n \n \n \n Initializes a new instance of the\n HostedServiceListAvailableExtensionsResponse class.\n \n \n \n \n Gets the sequence of ExtensionImages.\n \n \n \n \n Gets the sequence of ExtensionImages.\n \n \n \n \n Optional. The extensions that are available to add to your cloud\n service.\n \n \n \n \n An extension available to add to your cloud service.\n \n \n \n \n Initializes a new instance of the ExtensionImage class.\n \n \n \n \n Optional. Indicates whether this version of extension blocks\n the role upon failure.\n \n \n \n \n Optional. The description of the extension.\n \n \n \n \n Optional. URI string pointing to the EULA (End User License\n Agreement) of this version of extension. This is optionally\n specified by the third-party publishing the extension instead\n of Azure, at the time of extension creation or update.\n \n \n \n \n Optional. URI string pointing to the homepage of this version\n of extension. This is optionally specified by the third-party\n publishing the extension instead of Azure, at the time of\n extension creation or update.\n \n \n \n \n Optional. The type of resource that supports the extension.\n This value can be WebRole, WorkerRole, or WebRole|WorkerRole.\n \n \n \n \n Optional. Boolean property indicating whether the extension\n accepts JSON or XML based configuration. If this property is\n 'true' then the extension accepts JSON based configuration. If\n this property is 'false' the extension accepts XML based\n configuration.\n \n \n \n \n Optional. The label that is used to identify the extension.\n \n \n \n \n Optional. URI string pointing to the privacy document of this\n version of extension. This is optionally specified by the\n third-party publishing the extension instead of Azure, at the\n time of extension creation or update.\n \n \n \n \n Optional. The schema of the private configuration.\n \n \n \n \n Optional. The provider namespace of the extension. The provider\n namespace for Azure extensions is\n Microsoft.Windows.Azure.Extensions.\n \n \n \n \n Optional. The schema of the public configuration.\n \n \n \n \n Optional. Indicates whether this version of extension has been\n replicated to all regions or not. If true, then the given\n extension version can be used in creating or updating\n deployments. Otherwise, the given extension version might\n cause failure in creating or updating deployments. The typical\n time is 20 minutes for a newly-registered or newly-updated\n extension to replicate completely by Azure.\n \n \n \n \n Optional. A sample configuration file for the resource\n extension.\n \n \n \n \n Optional. The thumbprint algorithm of the certificate that is\n used for encryption.\n \n \n \n \n Required. The type of the extension.\n \n \n \n \n Optional. The version of the extension.\n \n \n \n \n The List Extensions operation response.\n \n \n \n \n Initializes a new instance of the\n HostedServiceListExtensionsResponse class.\n \n \n \n \n Gets the sequence of Extensions.\n \n \n \n \n Gets the sequence of Extensions.\n \n \n \n \n Optional. The extensions that were added to a cloud service.\n \n \n \n \n An extension that was added to a cloud service.\n \n \n \n \n Initializes a new instance of the Extension class.\n \n \n \n \n Optional. The identifier of the extension.\n \n \n \n \n Optional. The provider namespace of the extension. The provider\n namespace for Azure extensions is\n Microsoft.Windows.Azure.Extensions.\n \n \n \n \n Optional. The public configuration that is defined using the\n schema returned by the List Extensions operation.\n \n \n \n \n Optional. The thumbprint of the certificate that is used to\n encrypt the configuration specified in PrivateConfiguration.\n If this element is not specified, a certificate may be\n automatically generated and added to the cloud service.\n \n \n \n \n Optional. The thumbprint algorithm of the certificate that is\n used to encrypt the configuration specified in\n PrivateConfiguration.\n \n \n \n \n Required. The type of the extension.\n \n \n \n \n Optional. The version of the extension.\n \n \n \n \n The List Hosted Service operation response.\n \n \n \n \n Initializes a new instance of the HostedServiceListResponse class.\n \n \n \n \n Gets the sequence of HostedServices.\n \n \n \n \n Gets the sequence of HostedServices.\n \n \n \n \n Optional. The hosted services associated with your subscription.\n \n \n \n \n A hosted service associated with your subscription.\n \n \n \n \n Initializes a new instance of the HostedService class.\n \n \n \n \n Optional. The compute capabilities in this hosted service.\n \n \n \n \n Optional. The properties that are assigned to the cloud service.\n \n \n \n \n Optional. The name of the cloud service. This name is the DNS\n prefix name and can be used to access the cloud service. For\n example, if the cloud service name is MyService you could\n access the cloud service by calling:\n http://MyService.cloudapp.net.\n \n \n \n \n Optional. The Service Management API request URI used to\n perform List Hosted Service Properties requests against the\n cloud service.\n \n \n \n \n The properties that are assigned to the cloud service.\n \n \n \n \n Initializes a new instance of the HostedServiceProperties class.\n \n \n \n \n Optional. The affinity group with which this cloud service is\n associated, if any. If the service is associated with an affinity\n group, the Location element is not returned.\n \n \n \n \n Optional. The date that the cloud service was created, in\n [4DigitYear]-[2DigitMonth]-[2DigitDay]T[2DigitHour]:[2DigitMinute]:[2DigitSecond]Z\n format. The date 2011-05-11T16:15:26Z is an example that could be\n returned by the DateCreated or DateLastModified elements.\n \n \n \n \n Optional. The date that the cloud service was last updated, in\n [4DigitYear]-[2DigitMonth]-[2DigitDay]T[2DigitHour]:[2DigitMinute]:[2DigitSecond]Z\n format. The date 2011-05-11T16:15:26Z is an example that could be\n returned by the DateCreated or DateLastModified elements.\n \n \n \n \n Optional. The description for the cloud service.\n \n \n \n \n Optional. Represents the name of an extended cloud service\n property. Each extended property must have a defined name and a\n value. You can have a maximum of 50 extended property name and\n value pairs. The maximum length of the name element is 64\n characters, only alphanumeric characters and underscores are valid\n in the name, and it must start with a letter. Attempting to use\n other characters, starting with a non-letter character, or\n entering a name that is identical to that of another extended\n property owned by the same service will result in a status code\n 400 (Bad Request) error. Each extended property value has a\n maximum length of 255 characters.\n \n \n \n \n Optional. The user-supplied name of the cloud service. This name\n can be used identify the service for your tracking purposes.\n \n \n \n \n Optional. The geo-location of the cloud service in Windows Azure,\n if the service is not associated with an affinity group. If a\n location has been specified, the AffinityGroup element is not\n returned.\n \n \n \n \n Optional. The status of the cloud service.\n \n \n \n \n The status of the cloud service.\n \n \n \n \n Parameters supplied to the Update Hosted Service operation.\n \n \n \n \n Initializes a new instance of the HostedServiceUpdateParameters\n class.\n \n \n \n \n Optional. A description for the cloud service. The description may\n be up to 1024 characters in length. You must specify a value for\n at least one of Label or Description.\n \n \n \n \n Optional. Represents the name of an extended cloud service\n property. Each extended property must have a defined name and a\n value. You can have a maximum of 50 extended property name and\n value pairs. The maximum length of the name element is 64\n characters, only alphanumeric characters and underscores are valid\n in the name, and it must start with a letter. Attempting to use\n other characters, starting with a non-letter character, or\n entering a name that is identical to that of another extended\n property owned by the same service will result in a status code\n 400 (Bad Request) error. Each extended property value has a\n maximum length of 255 characters.\n \n \n \n \n Optional. A name for the cloud service. The name may be up to 100\n characters in length. You must specify a value for at least one of\n Label or Description. It is recommended that the label be unique\n within the subscription. The name can be used identify the service\n for your tracking purposes.\n \n \n \n \n Objects that provide input endpoint details.\n \n \n \n \n Initializes a new instance of the InputEndpoint class.\n \n \n \n \n Optional. Specifies whether direct server return is enabled for the\n endpoint.\n \n \n \n \n Optional. Specifies the list of access control rules for the\n endpoint.\n \n \n \n \n Optional. Specifies a name for a set of load-balanced endpoints.\n Specifying this name in multiple endpoints adds them all to the\n set. This element is only listed for Virtual Machine deployments.\n \n \n \n \n Optional. Optional. Specify the name of an internal load balancer\n if this endpoint shall not be exposed on the default load balancer.\n \n \n \n \n Optional. Contains properties that specify the endpoint settings\n which the Azure load balancer uses to monitor the availability of\n this virtual machine before forwarding traffic to the endpoint.\n \n \n \n \n Optional. Specifies the internal port on which the virtual machine\n is listening to serve the endpoint. This element is only listed\n for Virtual Machine deployments.\n \n \n \n \n Optional. Specifies the name for the external endpoint. This\n element is only listed for Virtual Machine deployments.\n \n \n \n \n Optional. The size of the role instance.\n \n \n \n \n Optional. Specifies the transport protocol for the endpoint.\n \n \n \n \n Optional. The virtual IP address of the role instance.\n \n \n \n \n Specifies the transport protocol for an endpoint.\n \n \n \n \n Objects that provide instance endpoint details.\n \n \n \n \n Initializes a new instance of the InstanceEndpoint class.\n \n \n \n \n Optional. Specifies the internal port on which the virtual machine\n is listening to serve the endpoint. This element is only listed\n for Virtual Machine deployments.\n \n \n \n \n Optional. Specifies the name for the external endpoint. This\n element is only listed for Virtual Machine deployments.\n \n \n \n \n Optional. The external port of the role instance endpoint.\n \n \n \n \n Optional. Specifies the transport protocol for the endpoint.\n \n \n \n \n Optional. The Virtual IP of the role endpoint.\n \n \n \n \n A list of internal load balancers that each provide load balancing on a\n private VIP.\n \n \n \n \n Initializes a new instance of the LoadBalancer class.\n \n \n \n \n Optional. The configuration for the virtual IP address (VIP) this\n load balancer provides.\n \n \n \n \n Optional. The name of the load balancer.\n \n \n \n \n Parameters supplied to the Create Load Balancer operation.\n \n \n \n \n Initializes a new instance of the LoadBalancerCreateParameters\n class.\n \n \n \n \n Optional. The configuration for the virtual IP address (VIP) this\n load balancer provides.\n \n \n \n \n Optional. Name of the load balancer.\n \n \n \n \n Contains properties that specify the endpoint settings which the Azure\n load balancer uses to monitor the availability of this virtual machine\n before forwarding traffic to the endpoint.\n \n \n \n \n Initializes a new instance of the LoadBalancerProbe class.\n \n \n \n \n Optional. Specifies the interval for the load balancer probe in\n seconds. The minimum value is 5 seconds. If not specified, the\n default is 15 seconds.\n \n \n \n \n Optional. Specifies the relative path name to inspect to determine\n the virtual machine availability status. If Protocol is set to\n TCP, this value must be NULL.\n \n \n \n \n Optional. Specifies the port to use to inspect the virtual machine\n availability status.\n \n \n \n \n Optional. Specifies the protocol to use to inspect the virtual\n machine availability status.\n \n \n \n \n Optional. Specifies the timeout for the load balancer probe in\n seconds. The minimum value is 11 seconds. If not specified, the\n default is 31 seconds.\n \n \n \n \n Specifies the protocol to use when inspecting the virtual machine\n availability status.\n \n \n \n \n Describes an operating system family.\n \n \n \n \n The List Operating System Families operation response.\n \n \n \n \n Initializes a new instance of the\n OperatingSystemListFamiliesResponse class.\n \n \n \n \n Gets the sequence of OperatingSystemFamilies.\n \n \n \n \n Gets the sequence of OperatingSystemFamilies.\n \n \n \n \n Optional. The operating system families that are valid for your\n subscription.\n \n \n \n \n An operating system that is valid for your subscription.\n \n \n \n \n Initializes a new instance of the OperatingSystem class.\n \n \n \n \n Optional. Indicates whether this operating system version is\n currently active for running a service. If an operating system\n version is active, you can manually configure your service to\n run on that version. An operating system version may be\n inactive for one of two reasons: 1. It is not yet active as it\n is in the process of being rolled out to Azure data centers.\n If your service is configured to use auto-upgrade, it will be\n upgraded to the new operating system version during the\n rollout. If you are manually configuring your operating system\n version, you can upgrade to the latest version once it becomes\n active. 2. It is no longer supported for running a service. In\n this case you will either need to manually configure your\n service to run on a newer version, or configure your service\n to use auto-upgrade to manage operating system upgrades.\n \n \n \n \n Optional. Indicates whether this operating system version is\n the default version for a service that has not otherwise\n specified a particular version. The default operating system\n version is applied to services that are configured for\n auto-upgrade. An operating system family has exactly one\n default operating system version at any given time, for which\n the IsDefault element is set to true; for all other versions,\n IsDefault is set to false.\n \n \n \n \n Optional. The label of the operating system version.\n \n \n \n \n Optional. The operating system version. This value corresponds\n to the configuration value for specifying that your service is\n to run on a particular version of the Azure guest operating\n system. See Configuring Settings for the Windows Azure Guest\n OS for additional details.\n \n \n \n \n An operating system family that is valid for your subscription.\n \n \n \n \n Initializes a new instance of the OperatingSystemFamily class.\n \n \n \n \n Optional. The label of the operating system family.\n \n \n \n \n Optional. Indicates which operating system family this version\n belongs to. A value of 1 corresponds to the Azure guest\n operating system that is substantially compatible with Windows\n Server 2008 SP2. A value of 2 corresponds to the Azure guest\n operating system that is substantially compatible with Windows\n Server 2008 R2.\n \n \n \n \n Optional. The available operating systems in your subscription\n belonging to this family.\n \n \n \n \n The List Operating Systems operation response.\n \n \n \n \n Initializes a new instance of the OperatingSystemListResponse class.\n \n \n \n \n Gets the sequence of OperatingSystems.\n \n \n \n \n Gets the sequence of OperatingSystems.\n \n \n \n \n Optional. The operating systems that are valid for your\n subscription.\n \n \n \n \n An operating system that is valid for your subscription.\n \n \n \n \n Initializes a new instance of the OperatingSystem class.\n \n \n \n \n Optional. Indicates which operating system family this version\n belongs to. A value of 1 corresponds to the Azure guest\n operating system that is substantially compatible with Windows\n Server 2008 SP2. A value of 2 corresponds to the Azure guest\n operating system that is substantially compatible with Windows\n Server 2008 R2.\n \n \n \n \n Optional. The label of the operating system family.\n \n \n \n \n Optional. Indicates whether this operating system version is\n currently active for running a service. If an operating system\n version is active, you can manually configure your service to\n run on that version. An operating system version may be\n inactive for one of two reasons: 1. It is not yet active as it\n is in the process of being rolled out to Azure data centers.\n If your service is configured to use auto-upgrade, it will be\n upgraded to the new operating system version during the\n rollout. If you are manually configuring your operating system\n version, you can upgrade to the latest version once it becomes\n active. 2. It is no longer supported for running a service. In\n this case you will either need to manually configure your\n service to run on a newer version, or configure your service\n to use auto-upgrade to manage operating system upgrades.\n \n \n \n \n Optional. Indicates whether this operating system version is\n the default version for a service that has not otherwise\n specified a particular version. The default operating system\n version is applied to services that are configured for\n auto-upgrade. An operating system family has exactly one\n default operating system version at any given time, for which\n the IsDefault element is set to true; for all other versions,\n IsDefault is set to false.\n \n \n \n \n Optional. The label of the operating system version.\n \n \n \n \n Optional. The operating system version. This value corresponds\n to the configuration value for specifying that your service is\n to run on a particular version of the Azure guest operating\n system. See Configuring Settings for the Windows Azure Guest\n OS for additional details.\n \n \n \n \n The OS disk configuration.\n \n \n \n \n Initializes a new instance of the\n OSDiskConfigurationUpdateParameters class.\n \n \n \n \n Optional. Specifies the platform caching behavior of the operating\n system disk blob for read/write efficiency.\n \n \n \n \n The parameters Azure uses to create the operating system disk for the\n virtual machine.\n \n \n \n \n Initializes a new instance of the OSVirtualHardDisk class.\n \n \n \n \n Optional. Specifies the platform caching behavior of the operating\n system disk blob for read/write efficiency.\n \n \n \n \n Optional. Specifies the friendly name of an operating system image\n in the image repository.\n \n \n \n \n Optional. Specifies the location of the operating system disk in\n Azure storage.\n \n \n \n \n Optional. Specifies the name of an operating system image in the\n image repository.\n \n \n \n \n Optional. The operating system running in the virtual machine.\n \n \n \n \n Optional. Specifies the name of the source image that was used to\n provision the virtual machine.\n \n \n \n \n Contains information about when the virtual machine has been started\n and stopped.\n \n \n \n \n Initializes a new instance of the PersistentVMDowntime class.\n \n \n \n \n Optional. The time that the virtual machine was stopped.\n \n \n \n \n Optional. The time that the virtual machine was started.\n \n \n \n \n Optional. The status of the virtual machine.\n \n \n \n \n Specifies the action that is performed after the capture operation\n finishes.\n \n \n \n \n Causes the virtual machine to be deleted after the image has been\n captured\n \n \n \n \n Causes the virtual machine to be redeployed after the image is\n captured by using the specified information in\n ProvisioningConfiguration.\n \n \n \n \n The status information of the settings passed to the Resource Extension.\n \n \n \n \n Initializes a new instance of the\n ResourceExtensionConfigurationStatus class.\n \n \n \n \n Optional. Integer status code from the result of applying the\n configuration settings.\n \n \n \n \n Optional. UTC time at which the configuration was applied.\n \n \n \n \n Optional. This object encapsulates a formatted localized status\n message.\n \n \n \n \n Optional. This object encapsulates a localized status message.\n \n \n \n \n Optional. Name of the settings passed to the Resource Extension.\n \n \n \n \n Optional. Operation executed by the Resource Extension for the\n settings passed to it.\n \n \n \n \n Optional. The status of the resourse extension, containing values\n like Transitioning, Error, Success, or Warning.\n \n \n \n \n Optional. List of substatus objects which contain additional status\n information reported by the Resource Extension.\n \n \n \n \n Optional. UTC time at which the status was reported.\n \n \n \n \n The status of the resource extension configuration, containing values\n like Transitioning, Error, Success, or Warning.\n \n \n \n \n Specifies the key, value, and type of the parameter.\n \n \n \n \n Initializes a new instance of the ResourceExtensionParameterValue\n class.\n \n \n \n \n Optional. The key of the parameter.\n \n \n \n \n Optional. Optional. Public | Private. If this value is set to\n Private, the parameter will not be returned by Get Deployment. You\n can only specify one public parameter and one private parameter\n for a maximum of two parameters.\n \n \n \n \n Optional. The value of the parameter.\n \n \n \n \n Specifies the properties of a resource extension that should be\n installed on the Virtual Machine.\n \n \n \n \n Initializes a new instance of the ResourceExtensionReference class.\n \n \n \n \n Optional. Specifies the name of the resource extension. You can use\n List Resource Extensions to find the names of available resource\n extensions.\n \n \n \n \n Optional. Specifies the name of the publisher who created the\n resource extension. You can use List Resource Extensions to find\n the publisher name of a resource extension.\n \n \n \n \n Optional. Specifies the reference name of the resource extension.\n \n \n \n \n Optional. Contains a collection of parameters that are passed to\n the resource extension when it is installed.\n \n \n \n \n Optional. Specifies the state of the resource extension.Possible\n values are: Enable | Disable. The default value is Enable.\n \n \n \n \n Optional. Specifies the version of the resource extension. You can\n use List Resource Extension Versions to find the version of the\n resource extension.\n \n \n \n \n Optional. The status information of a specific Resource Extension.\n \n \n \n \n Initializes a new instance of the ResourceExtensionStatus class.\n \n \n \n \n Optional. Status code sent by the Resource Extension.\n \n \n \n \n Optional. This object encapsulates the extension setting status for\n the Resource Extension.\n \n \n \n \n Optional. This object encapsulates a formatted localized status\n message from the Resource Extension.\n \n \n \n \n Optional. Name of the Resource Extension.\n \n \n \n \n Optional. This object encapsulates a localized status message from\n the Guest Agent.\n \n \n \n \n Optional. The resource extension status, which can be \"Installing\",\n \"Ready\", \"NotReady\", or \"Unresponsive\".\n \n \n \n \n Optional. Version of the Resource Extension.\n \n \n \n \n The resource extension status, which can be \"Installing\", \"Ready\",\n \"NotReady\", or \"Unresponsive\".\n \n \n \n \n A substatus object containing additional status information reported by\n the Resource Extension.\n \n \n \n \n Initializes a new instance of the ResourceExtensionSubStatus class.\n \n \n \n \n Optional. Integer status code from the result of applying the\n substatus settings.\n \n \n \n \n Optional. This object encapsulates a formatted localized status\n message.\n \n \n \n \n Optional. This object encapsulates a localized status message.\n \n \n \n \n Optional. A name for the substatus.\n \n \n \n \n Optional. The resource extension substatus, containing values like\n Transitioning, Error, Success, or Warning.\n \n \n \n \n The resource extension substatus, containing values like Transitioning,\n Error, Success, or Warning.\n \n \n \n \n Details of a role in a deployment.\n \n \n \n \n Initializes a new instance of the Role class.\n \n \n \n \n Optional. The name of the role.\n \n \n \n \n Optional. A collection of values that represents system or\n application configuration settings.\n \n \n \n \n Optional. Contains the parameters Azure uses to create a data disk\n for a virtual machine.\n \n \n \n \n Optional. The read-only thumbprint of the certificate that is used\n with the HTTPS listener for WinRM.\n \n \n \n \n Optional. The friendly name for the role.\n \n \n \n \n Optional. Storage location where the VM Image VHDs should be\n copied, for published VM Images.\n \n \n \n \n Optional. The version of the operating system on which the role\n instances are running.\n \n \n \n \n Optional. Contains the parameters Azure uses to create the\n operating system disk for the virtual machine.\n \n \n \n \n Optional. Indicates whether the WindowsAzureGuestAgent service is\n installed on the Virtual Machine. To run a resource extension in a\n Virtual Machine, this service must be installed.\n \n \n \n \n Optional. Contains a collection of resource extensions that are to\n be installed on the Virtual Machine. This element is used if\n ProvisionGuestAgent is set to true.\n \n \n \n \n Optional. The name of the role.\n \n \n \n \n Optional. The size of the role instance.\n \n \n \n \n Optional. Specifies the type of the role. This element is only\n listed for Virtual Machine deployments, and by default is\n PersistentVMRole.\n \n \n \n \n Optional. Optional. The name of the VMImage from which this Role is\n to be created. If the OSDisk in the VMImage was Specialized, then\n no WindowsProvisioningConfigurationSet or\n LinuxProvisioningConfigurationSet should be provided. No\n OSVirtualHardDisk or DataVirtualHardDisk should be specified when\n using this argument.\n \n \n \n \n Details of a specific role instance.\n \n \n \n \n Initializes a new instance of the RoleInstance class.\n \n \n \n \n Optional. Guest Agent Status.\n \n \n \n \n Optional. The DNS host name of the service in which the role\n instance is running. This element is only listed for Virtual\n Machine deployments.\n \n \n \n \n Optional. The list of instance endpoints for the role.\n \n \n \n \n Optional. An error code that can be provided to Windows Azure\n support to assist in resolution of errors. This field will\n typically be empty.\n \n \n \n \n Optional. The fault domain that this role instance belongs to. Role\n instances that are part of the same fault domain may all be\n vulnerable to the failure of the same piece of shared hardware.\n \n \n \n \n Optional. The name of the specific role instance, if an instance of\n the role is running.\n \n \n \n \n Optional. The size of the role instance.\n \n \n \n \n Optional. The instance state, returned as a string that, when\n present, provides a snapshot of the state of the virtual machine\n at the time the operation was called.\n \n \n \n \n Optional. The current status of this instance.\n \n \n \n \n Optional. The update domain that this role instance belongs to.\n During an Upgrade Deployment, all roles in the same update domain\n are updated at the same time.\n \n \n \n \n Optional. The IP address of the role instance (DIP).\n \n \n \n \n Optional. The running state of the role instance.\n \n \n \n \n Optional. Optional. A set of public IPs. Currently, only one\n additional public IP per role is supported in an IaaS deployment.\n The IP address is in addition to the default VIP for the\n deployment.\n \n \n \n \n Optional. The thumbprint of the RDP server certificate (in Windows)\n or SSH server certificate (in Linux). The thumbprint is only used\n for Virtual Machines that have been created from an image.\n \n \n \n \n Optional. Resource Extension Status List.\n \n \n \n \n Optional. The name of the role.\n \n \n \n \n An additional public IP that will be created for the role. The\n public IP will be an additional IP for the role. The role\n continues to be addressable via the default deployment VIP.\n \n \n \n \n Initializes a new instance of the PublicIP class.\n \n \n \n \n Optional. The address of the public IP.\n \n \n \n \n Optional. The name of the public IP.\n \n \n \n \n The running state of the role instance.\n \n \n \n \n The current status of a role instance.\n \n \n \n \n The role state is currently unknown. The state should automatically\n be resolved once the role state is detected, so no action is\n required.\n \n \n \n \n The host agent is currently creating resources for the Virtual\n Machine.\n \n \n \n \n The host agent is starting the Virtual Machine.\n \n \n \n \n Azure is creating resources for the role.\n \n \n \n \n Azure is starting the role.\n \n \n \n \n The role instance has started and is ready to be used.\n \n \n \n \n The role instance is unavailable for requests. This state is\n usually generated while the role is being created or stopped.\n \n \n \n \n Azure is stopping the role.\n \n \n \n \n The host agent is stopping the Virtual Machine. This status also\n indicates that the role has already been stopped.\n \n \n \n \n The Virtual Machine is being deleted by the host agent.\n \n \n \n \n The Virtual Machine is not running. This is the final state of the\n shutdown process, and no other status messages should be received\n after StoppedVM.\n \n \n \n \n The role has unexpectedly stopped or has failed to start. This\n status indicates that there is a problem with the role that is\n causing it to crash or is preventing it from starting, which must\n be corrected before the role can be started. The\n InstanceStateDetails and InstanceErrorCode fields can hold\n information about the role error that caused this state, which may\n be useful for identifying and debugging the problem.\n \n \n \n \n The role has continually crashed after being started by Azure. This\n status indicates that there is a problem with the role that\n prevents it from starting, and may be generated after the\n StartingRole and ReadyRole statuses are received. The problem in\n the role must be found and corrected before the role can be\n started. The InstanceStateDetails and InstanceErrorCode fields can\n hold information about the role error that caused this state,\n which may be useful for identifying and debugging the problem.\n \n \n \n \n The role has continually failed to start. This status indicates\n that there is a problem with the role that prevents it from\n starting, and may be generated after the process returns\n StartingRole. The problem in the role must be found and corrected\n before the role can be started. The InstanceStateDetails and\n InstanceErrorCode fields can hold information about the role error\n that caused this state, which may be useful for identifying and\n debugging the problem.\n \n \n \n \n An Azure or container error is preventing the Virtual Machine from\n starting. This status is generated by Azure, and does not indicate\n an error with the role. It may be generated after the StartingRole\n state.\n \n \n \n \n The role has timed out before receiving a status message and is not\n responding to requests.\n \n \n \n \n The rollback proceeds without further user input.\n \n \n \n \n You must call the Walk Upgrade Domain operation to apply the\n rollback to each upgrade domain.\n \n \n \n \n Parameters supplied to the Create Service Certificate operation.\n \n \n \n \n Initializes a new instance of the\n ServiceCertificateCreateParameters class.\n \n \n \n \n Required. The service certificate format. Azure supports the pfx\n and cer file formats.\n \n \n \n \n Required. The pfx or cer file.\n \n \n \n \n Optional. The password for a pfx certificate. A cer certificate\n does not require a password.\n \n \n \n \n Parameters supplied to the Delete Service Certificate operation.\n \n \n \n \n Initializes a new instance of the\n ServiceCertificateDeleteParameters class.\n \n \n \n \n Required. The DNS prefix name of your service.\n \n \n \n \n Required. The hexadecimal representation of the thumbprint.\n \n \n \n \n Required. The algorithm for the certificate's thumbprint.\n \n \n \n \n Parameters supplied to the Get Service Certificate operation.\n \n \n \n \n Initializes a new instance of the ServiceCertificateGetParameters\n class.\n \n \n \n \n Required. The DNS prefix name of your service.\n \n \n \n \n Required. The hexadecimal representation of the thumbprint.\n \n \n \n \n Required. The algorithm for the certificate's thumbprint.\n \n \n \n \n The Get Service Certificate operation response.\n \n \n \n \n Initializes a new instance of the ServiceCertificateGetResponse\n class.\n \n \n \n \n Optional. The public portion of the X.509 service certificate as a\n form of the cer file.\n \n \n \n \n The List Service Certificates operation response.\n \n \n \n \n Initializes a new instance of the ServiceCertificateListResponse\n class.\n \n \n \n \n Gets the sequence of Certificates.\n \n \n \n \n Gets the sequence of Certificates.\n \n \n \n \n Optional. The service certificates that are valid for your\n subscription.\n \n \n \n \n A service certificate that is valid for your subscription.\n \n \n \n \n Initializes a new instance of the Certificate class.\n \n \n \n \n Optional. The Service Management API request URI used to\n perform Get Service Certificate requests against the\n certificate store.\n \n \n \n \n Optional. The public part of the service certificate as a cer\n file.\n \n \n \n \n Optional. The X509 certificate thumb print property of the\n service certificate.\n \n \n \n \n Optional. The algorithm that was used to hash the service\n certificate. Currently SHA-1 is the only supported algorithm.\n \n \n \n \n Contains an SSH key pair to be installed on the virtual machine.\n \n \n \n \n Initializes a new instance of the SshSettingKeyPair class.\n \n \n \n \n Required. Specifies the SHA1 fingerprint of an X509 certificate\n associated with the hosted service that includes the SSH key pair.\n \n \n \n \n Required. Specifies the full path of a file on the virtual machine\n which stores the SSH private key. The file is overwritten when\n multiple keys are written to it. The SSH public key is stored in\n the same directory and has the same name as the private key file\n with .pub suffix. Example: /home/user/.ssh/id_rsa.\n \n \n \n \n Specifies a public key in the SSH settings.\n \n \n \n \n Initializes a new instance of the SshSettingPublicKey class.\n \n \n \n \n Required. Specifies the SHA1 fingerprint of an X509 certificate\n associated with the hosted service that includes the SSH public\n key.\n \n \n \n \n Required. Specifies the full path of a file on the virtual machine\n which stores the SSH public key. If the file already exists, the\n specified key is appended to the file. Example:\n /home/user/.ssh/authorized_keys.\n \n \n \n \n Specifies the SSH public keys and key pairs to populate in the image\n during provisioning. This element is only used with the\n LinuxProvisioningConfiguration set.\n \n \n \n \n Initializes a new instance of the SshSettings class.\n \n \n \n \n Optional. Specifies the collection of SSH key pairs.\n \n \n \n \n Optional. Specifies the collection of SSH public keys.\n \n \n \n \n Service certificates with which to provision the new virtual machine.\n Stored certificate settings reference certificates that already exist\n in the Azure hosted service. Prior to configuring the stored\n certificates for the virtual machine, you must call the Add Service\n Certificate operation or add the certificate via the Azure Management\n portal.\n \n \n \n \n Initializes a new instance of the StoredCertificateSettings class.\n \n \n \n \n Required. Specifies the name of the certificate store from which to\n retrieve certificates. For example, \"My\".\n \n \n \n \n Required. Specifies the thumbprint of the certificate to be\n provisioned. The thumbprint must specify an existing service\n certificate.\n \n \n \n \n The current state of the upgrade.\n \n \n \n \n Contains upgrade details of the deployment.\n \n \n \n \n Initializes a new instance of the UpgradeStatus class.\n \n \n \n \n Optional. An integer value that identifies the current upgrade\n domain. Upgrade domains are identified with a zero-based index:\n the first upgrade domain has an ID of 0, the second has an ID of\n 1, and so on.\n \n \n \n \n Optional. The current state of the upgrade. Possible values are\n Before and During\n \n \n \n \n Optional. The type of the upgrade. Possible values are Auto and\n Manual.\n \n \n \n \n Specifies the platform caching behavior of the data disk blob for\n read/write efficiency.\n \n \n \n \n The virtual IP address of the deployment.\n \n \n \n \n Initializes a new instance of the VirtualIPAddress class.\n \n \n \n \n Optional. The virtual IP address of the deployment.\n \n \n \n \n Optional. Indicates whether the IP address is DNS programmed.\n \n \n \n \n Optional. The name of the virtual IP.\n \n \n \n \n Parameters supplied to the Capture Virtual Machine operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineCaptureOSImageParameters class.\n \n \n \n \n Required. Specifies the action that is performed after the capture\n operation finishes. Possible values are: Delete - this value\n causes the virtual machine to be deleted after the image has been\n captured; or Reprovision - this value causes the virtual machine\n to be redeployed after the image is captured by using the\n specified information in ProvisioningConfiguration.\n \n \n \n \n Optional. Provides information to be used to redeploy the virtual\n machine after the image has been captured. This element is only\n used when the PostCaptureAction is set to Reprovision.\n \n \n \n \n Required. Specifies the friendly name of the captured image. This\n is the value that appears in the Name column for the image in the\n Azure Management Portal.\n \n \n \n \n Required. Specifies the image name of the captured image.\n \n \n \n \n The Virtual Machine Template Capture Role operation response.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineCaptureVMImageParameters class.\n \n \n \n \n Optional. Required. Must be set to CaptureRoleOperation.\n \n \n \n \n Optional. Required. The OS state: Generalized | Specialized.\n \n \n \n \n Optional. Required. The VM Template Label.\n \n \n \n \n Optional. Required. The VM Template Name.\n \n \n \n \n Parameters supplied to the Create Virtual Machine Deployment operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineCreateDeploymentParameters class.\n \n \n \n \n Required. Specifies the environment in which to deploy the virtual\n machine. Possible values are: Staging or Production.\n \n \n \n \n Optional. Contains a list of DNS servers to associate with the\n machine.\n \n \n \n \n Required. A name for the hosted service. The name can be up to 100\n characters in length. It is recommended that the label be unique\n within the subscription. The name can be used identify the hosted\n service for tracking purposes.\n \n \n \n \n Optional. A list of internal load balancers that each provide load\n balancing on a private VIP.\n \n \n \n \n Required. A name for the deployment. The deployment name must be\n unique among other deployments for the hosted service.\n \n \n \n \n Optional. Optional. Specifies the name of an existing reserved IP\n to which the deployment will belong. Reserved IPs are created by\n calling the Create Reserved IP operation.\n \n \n \n \n Required. Contains the provisioning details for the new virtual\n machine deployment.\n \n \n \n \n Optional. Specifies the name of an existing virtual network to\n which the deployment will belong. Virtual networks are created by\n calling the Set Network Configuration operation.\n \n \n \n \n Parameters supplied to the Create Virtual Machine operation.\n \n \n \n \n Initializes a new instance of the VirtualMachineCreateParameters\n class.\n \n \n \n \n Optional. Specifies the name of an availability set to which to add\n the virtual machine. This value controls the virtual machine\n allocation in the Azure environment. Virtual machines specified in\n the same availability set are allocated to different nodes to\n maximize availability.\n \n \n \n \n Optional. Contains the collection of configuration sets that\n contain system and application configuration settings.\n \n \n \n \n Optional. Contains the parameters Azure used to create the data\n disk for the virtual machine.\n \n \n \n \n Optional. Location where VMImage VHDs should be copied, for\n published VMImages.\n \n \n \n \n Optional. Contains the parameters Azure used to create the\n operating system disk for the virtual machine.\n \n \n \n \n Optional. Indicates whether the WindowsAzureGuestAgent service is\n installed on the Virtual Machine. To run a resource extension in a\n Virtual Machine, this service must be installed.\n \n \n \n \n Optional. Contains a collection of resource extensions that are to\n be installed on the Virtual Machine. This element is used if\n ProvisionGuestAgent is set to true.\n \n \n \n \n Required. Specifies the name for the virtual machine. The name must\n be unique within the deployment.\n \n \n \n \n Optional. The size of the virtual machine.\n \n \n \n \n Optional. Name of the VMImage from which this Role is to be\n created. If the OSDisk in the VMImage was Specialized, then no\n WindowsProvisioningConfigurationSet or\n LinuxProvisioningConfigurationSet should be provided. No\n OSVirtualHardDisk or DataVirtualHardDisk should be specified when\n using this argument.\n \n \n \n \n Parameters supplied to the Create Virtual Machine Data Disk operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineDataDiskCreateParameters class.\n \n \n \n \n Required. Specifies the platform caching behavior of data disk blob\n for read/write efficiency. The default vault is ReadOnly. Possible\n values are: None, ReadOnly, or ReadWrite. Warning: Setting this\n property impacts the consistency of the disk.\n \n \n \n \n Optional. Specifies the description of the data disk. When you\n attach a disk, either by directly referencing a media using the\n MediaLink element or specifying the target disk size, you can use\n the DiskLabel element to customize the name property of the target\n data disk.\n \n \n \n \n Optional. Specifies the size, in GB, of an empty disk to be\n attached to the role. The disk can be created as part of disk\n attach or create VM role call by specifying the value for this\n property. Azure creates the empty disk based on size preference\n and attaches the newly created disk to the Role.\n \n \n \n \n Optional. Specifies the Logical Unit Number (LUN) for the disk. The\n LUN specifies the slot in which the data drive appears when\n mounted for usage by the virtual machine. Valid LUN values are 0\n through 15.\n \n \n \n \n Required. Specifies the location of the blob in Azure storage where\n the media for the disk is located. The blob location must belong\n to the storage account in the subscription specified by the\n SubscriptionId value in the operation call. Example:\n http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Optional. Specifies the name of the disk. Azure uses the specified\n disk to create the data disk for the machine and populates this\n field with the disk name.\n \n \n \n \n Optional. Specifies the location of a blob in account storage which\n is mounted as a data disk when the virtual machine is created.\n \n \n \n \n The Get Data Disk operation response.\n \n \n \n \n Initializes a new instance of the VirtualMachineDataDiskGetResponse\n class.\n \n \n \n \n Optional. The current value of the platform caching behavior of\n data disk blob for read/write efficiency. Possible values are:\n None, ReadOnly, or ReadWrite.\n \n \n \n \n Optional. The description of the data disk.\n \n \n \n \n Optional. The size, in GB, of the data disk.\n \n \n \n \n Optional. The Logical Unit Number (LUN) for the disk. The LUN\n specifies the slot in which the data drive appears when mounted\n for usage by the virtual machine.\n \n \n \n \n Optional. The location of the physical blob backing the data disk.\n The blob location is in the storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n \n \n \n \n Optional. The name of the data disk.\n \n \n \n \n Parameters supplied to the Update Virtual Machine Data Disk operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineDataDiskUpdateParameters class.\n \n \n \n \n Required. Specifies the platform caching behavior of data disk blob\n for read/write efficiency. The default vault is ReadOnly. Possible\n values are: None, ReadOnly, or ReadWrite. Warning: Setting this\n property impacts the consistency of the disk.\n \n \n \n \n Optional. Specifies the description of the data disk. When you\n attach a disk, either by directly referencing a media using the\n MediaLink element or specifying the target disk size, you can use\n the DiskLabel element to customize the name property of the target\n data disk.\n \n \n \n \n Optional. Specifies the size, in GB, of an empty disk to be\n attached to the role. The disk can be created as part of disk\n attach or create VM role call by specifying the value for this\n property. Azure creates the empty disk based on size preference\n and attaches the newly created disk to the Role.\n \n \n \n \n Optional. Specifies the Logical Unit Number (LUN) for the disk. The\n LUN specifies the slot in which the data drive appears when\n mounted for usage by the virtual machine. Valid LUN values are 0\n through 15.\n \n \n \n \n Required. Specifies the location of the blob in Azure blob store\n where the media for the disk is located. The blob location must\n belong to the storage account in the subscription specified by the\n SubscriptionId value in the operation call. Example:\n http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Optional. Specifies the name of the disk. Azure uses the specified\n disk to create the data disk for the machine and populates this\n field with the disk name.\n \n \n \n \n Parameters supplied to the Create Virtual Disk Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineDiskCreateParameters class.\n \n \n \n \n Required. Specifies the friendly name of the disk.\n \n \n \n \n Required. Specifies the location of the blob in Azure storage. The\n blob location must belong to a storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n Example: http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Required. Specifies a name for the disk. Azure uses the name to\n identify the disk when creating virtual machines from the disk.\n \n \n \n \n Optional. The operating system type of the disk. Possible values\n are: Linux or Windows.\n \n \n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineDiskCreateResponse\n class.\n \n \n \n \n Optional. The affinity group in which the disk is located. The\n AffinityGroup value is derived from storage account that contains\n the blob in which the media is located. If the storage account\n does not belong to an affinity group the value is NULL.\n \n \n \n \n Optional. Specifies whether the comtained image is a premium image\n \n \n \n \n Optional. The friendly name of the disk\n \n \n \n \n Optional. The geo-location in which the disk is located. The\n Location value is derived from storage account that contains the\n blob in which the disk is located. If the storage account belongs\n to an affinity group the value is NULL.\n \n \n \n \n Optional. The size, in GB, of the disk.\n \n \n \n \n Optional. The location of the blob in the blob store in which the\n media for the disk is located. The blob location belongs to a\n storage account in the subscription specified by the\n SubscriptionId value in the operation call. Example:\n http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Optional. The name of the disk. This is the name that is used when\n creating one or more virtual machines using the disk.\n \n \n \n \n Optional. The Operating System type for the disk.\n \n \n \n \n Optional. The name of the OS Image from which the disk was created.\n This property is populated automatically when a disk is created\n from an OS image by calling the Add Role, Create Deployment, or\n Provision Disk operations.\n \n \n \n \n Optional. Contains properties that specify a virtual machine that\n is currently using the disk. A disk cannot be deleted as long as\n it is attached to a virtual machine.\n \n \n \n \n Contains properties that specify a virtual machine that currently\n using the disk. A disk cannot be deleted as long as it is attached\n to a virtual machine.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineDiskUsageDetails class.\n \n \n \n \n Optional. The deployment in which the disk is being used.\n \n \n \n \n Optional. The hosted service in which the disk is being used.\n \n \n \n \n Optional. The virtual machine that the disk is attached to.\n \n \n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineDiskGetResponse\n class.\n \n \n \n \n Optional. The affinity group in which the disk is located. The\n AffinityGroup value is derived from storage account that contains\n the blob in which the media is located. If the storage account\n does not belong to an affinity group the value is NULL.\n \n \n \n \n Optional. Specifies whether the disk is known to be corrupt.\n \n \n \n \n Optional. Specifies whether or not the disk contains a premium\n virtual machine image.\n \n \n \n \n Optional. The friendly name of the disk.\n \n \n \n \n Optional. The geo-location in which the disk is located. The\n Location value is derived from storage account that contains the\n blob in which the disk is located. If the storage account belongs\n to an affinity group the value is NULL.\n \n \n \n \n Optional. The size, in GB, of the disk.\n \n \n \n \n Optional. The location of the blob in the blob store in which the\n media for the disk is located. The blob location belongs to a\n storage account in the subscription specified by the\n SubscriptionId value in the operation call. Example:\n http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Optional. The name of the disk. This is the name that is used when\n creating one or more virtual machines using the disk.\n \n \n \n \n Optional. The operating system type of the OS image. Possible\n Values are: Linux, Windows, or NULL.\n \n \n \n \n Optional. The name of the OS Image from which the disk was created.\n This property is populated automatically when a disk is created\n from an OS image by calling the Add Role, Create Deployment, or\n Provision Disk operations.\n \n \n \n \n Optional. Contains properties that specify a virtual machine that\n is currently using the disk. A disk cannot be deleted as long as\n it is attached to a virtual machine.\n \n \n \n \n Contains properties that specify a virtual machine that currently\n using the disk. A disk cannot be deleted as long as it is attached\n to a virtual machine.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineDiskUsageDetails class.\n \n \n \n \n Optional. The deployment in which the disk is being used.\n \n \n \n \n Optional. The hosted service in which the disk is being used.\n \n \n \n \n Optional. The virtual machine that the disk is attached to.\n \n \n \n \n The List Disks operation response.\n \n \n \n \n Initializes a new instance of the VirtualMachineDiskListResponse\n class.\n \n \n \n \n Gets the sequence of Disks.\n \n \n \n \n Gets the sequence of Disks.\n \n \n \n \n Optional. The virtual machine disks associated with your\n subscription.\n \n \n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineDisk class.\n \n \n \n \n Optional. The affinity group in which the disk is located. The\n AffinityGroup value is derived from storage account that\n contains the blob in which the media is located. If the\n storage account does not belong to an affinity group the value\n is NULL.\n \n \n \n \n Optional. Specifies thether the disk is known to be corrupt.\n \n \n \n \n Optional. Specifies whether or not the disk contains a premium\n virtual machine image.\n \n \n \n \n Optional. The friendly name of the disk.\n \n \n \n \n Optional. The geo-location in which the disk is located. The\n Location value is derived from storage account that contains\n the blob in which the disk is located. If the storage account\n belongs to an affinity group the value is NULL.\n \n \n \n \n Optional. The size, in GB, of the disk.\n \n \n \n \n Optional. The location of the blob in the blob store in which\n the media for the disk is located. The blob location belongs\n to a storage account in the subscription specified by the\n SubscriptionId value in the operation call. Example:\n http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Optional. The name of the disk. This is the name that is used\n when creating one or more virtual machines using the disk.\n \n \n \n \n Optional. The operating system type of the OS image. Possible\n Values are: Linux, Windows, or NULL.\n \n \n \n \n Optional. The name of the OS Image from which the disk was\n created. This property is populated automatically when a disk\n is created from an OS image by calling the Add Role, Create\n Deployment, or Provision Disk operations.\n \n \n \n \n Optional. Contains properties that specify a virtual machine\n that currently using the disk. A disk cannot be deleted as\n long as it is attached to a virtual machine.\n \n \n \n \n Contains properties that specify a virtual machine that currently\n using the disk. A disk cannot be deleted as long as it is attached\n to a virtual machine.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineDiskUsageDetails class.\n \n \n \n \n Optional. The deployment in which the disk is being used.\n \n \n \n \n Optional. The hosted service in which the disk is being used.\n \n \n \n \n Optional. The virtual machine that the disk is attached to.\n \n \n \n \n Parameters supplied to the Update Virtual Disk Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineDiskUpdateParameters class.\n \n \n \n \n Optional. Specifies whether the disk contains an operating system.\n Note: Only a disk with an operating system installed can be\n mounted as OS Drive.\n \n \n \n \n Required. Specifies the friendly name of the disk.\n \n \n \n \n Optional. Specifies the location of the blob in Azure storage. The\n blob location must belong to a storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n Example: http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Required. Specifies a name for the disk. Azure uses the name to\n identify the disk when creating virtual machines from the disk.\n \n \n \n \n Optional. The operating system type of the disk. Possible values\n are: Linux or Windows.\n \n \n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineDiskUpdateResponse\n class.\n \n \n \n \n Optional. The affinity group in which the disk is located. The\n AffinityGroup value is derived from storage account that contains\n the blob in which the media is located. If the storage account\n does not belong to an affinity group the value is NULL.\n \n \n \n \n Optional. Specifies whether the contained image is a premium image.\n \n \n \n \n Optional. The friendly name of the disk\n \n \n \n \n Optional. The geo-location in which the disk is located. The\n Location value is derived from storage account that contains the\n blob in which the disk is located. If the storage account belongs\n to an affinity group the value is NULL.\n \n \n \n \n Optional. The size, in GB, of the disk.\n \n \n \n \n Optional. The location of the blob in the blob store in which the\n media for the disk is located. The blob location belongs to a\n storage account in the subscription specified by the\n SubscriptionId value in the operation call. Example:\n http://example.blob.core.windows.net/disks/mydisk.vhd\n \n \n \n \n Optional. The name of the disk. This is the name that is used when\n creating one or more virtual machines using the disk.\n \n \n \n \n Optional. The Operating System type for the disk.\n \n \n \n \n The List Resource Extensions operation response.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineExtensionListResponse class.\n \n \n \n \n Gets the sequence of ResourceExtensions.\n \n \n \n \n Gets the sequence of ResourceExtensions.\n \n \n \n \n Optional. The extensions that are available to add to your cloud\n service.\n \n \n \n \n An extension available to add to your virtual machine.\n \n \n \n \n Initializes a new instance of the ResourceExtension class.\n \n \n \n \n Optional. The description of the extension.\n \n \n \n \n Optional. URI string pointing to the EULA (End User License\n Agreement) of this version of extension. This is optionally\n specified by the third-party publishing the extension instead\n of Azure, at the time of extension creation or update.\n \n \n \n \n Optional. URI string pointing to the homepage of this version\n of extension. This is optionally specified by the third-party\n publishing the extension instead of Azure, at the time of\n extension creation or update.\n \n \n \n \n Optional. Indicates whether the extension accepts JSON or XML\n based configuration. If this property is 'true' the extension\n accepts JSON based configuration. If this property is 'false'\n the extension accepts XML based configuration.\n \n \n \n \n Optional. The label that is used to identify the extension.\n \n \n \n \n Optional. The name of the extension.\n \n \n \n \n Optional. URI string pointing to the privacy document of this\n version of extension. This is optionally specified by the\n third-party publishing the extension instead of Azure, at the\n time of extension creation or update.\n \n \n \n \n Optional. The base64-encoded schema of the private\n configuration.\n \n \n \n \n Optional. The base64-encoded schema of the public configuration.\n \n \n \n \n Optional. The provider namespace of the extension. The provider\n namespace for Azure extensions is Microsoft.Compute.\n \n \n \n \n Optional. Indicates whether this version of extension has been\n replicated to all regions or not. If true, then the given\n extension version can be used in creating or updating\n deployments. Otherwise, the given extension version might\n cause failure in creating or updating deployments. The typical\n time is 20 minutes for a newly-registered or newly-updated\n extension to replicate completely by Azure.\n \n \n \n \n Optional. A sample configuration file for the resource\n extension.\n \n \n \n \n Optional. The version of the extension.\n \n \n \n \n The Download RDP file operation response.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineGetRemoteDesktopFileResponse class.\n \n \n \n \n Required. A Remote Desktop Protocol (.rdp) file that can be used to\n establish a remote desktop session to the virtual machine\n \n \n \n \n The Get Virtual Machine operation response.\n \n \n \n \n Initializes a new instance of the VirtualMachineGetResponse class.\n \n \n \n \n Optional. The name of the availability set the virtual machine\n belongs to. This value controls the virtual machine allocation in\n the Windows Azure environment. Virtual machines specified in the\n same availability set are allocated to different nodes to maximize\n availability.\n \n \n \n \n Optional. Contains the collection of configuration sets that\n contain system and application configuration settings.\n \n \n \n \n Optional. Contains the parameters Azure used to create the data\n disk for the virtual machine.\n \n \n \n \n Optional. The read-only thumbprint of the certificate that is used\n with the HTTPS listener for WinRM.\n \n \n \n \n Optional. The version of the operating system on which the role\n instances are running.\n \n \n \n \n Optional. Contains the parameters Azure used to create the\n operating system disk for the virtual machine.\n \n \n \n \n Optional. The name for the virtual machine. The name is unique\n within Azure.\n \n \n \n \n Optional. The size of the virtual machine.\n \n \n \n \n Optional. The type of the role for the virtual machine. The only\n supported value is PersistentVMRole.\n \n \n \n \n Parameters supplied to the Create Virtual Machine Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineOSImageCreateParameters class.\n \n \n \n \n Optional. Specifies the description of the OS image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a string,\n but it is recommended that the value be a URL that points to a\n EULA.\n \n \n \n \n Optional. Specifies the URI to the icon that is displayed for the\n image in the Management Portal.\n \n \n \n \n Optional. Specifies a value that can be used to group OS images.\n \n \n \n \n Required. Indicates if the image contains software or associated\n services that will incur charges above the core price for the\n virtual machine.\n \n \n \n \n Required. Specifies the friendly name of the image.\n \n \n \n \n Optional. Specifies the language of the image. The Language element\n is only available using version 2013-03-01 or higher.\n \n \n \n \n Required. Specifies the location of the blob in Azure storage. The\n blob location must belong to a storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n Example: http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Required. Specifies a name that Azure uses to identify the image\n when creating one or more virtual machines.\n \n \n \n \n Required. The operating system type of the OS image. Possible\n values are: Linux or Windows.\n \n \n \n \n Optional. Specifies the URI that points to a document that contains\n the privacy policy related to the OS image.\n \n \n \n \n Optional. Specifies the date when the OS image was added to the\n image repository.\n \n \n \n \n Optional. Specifies the size to use for the virtual machine that is\n created from the OS image.\n \n \n \n \n Required. Specifies whether the image should appear in the image\n gallery.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal. The\n SmallIconUri element is only available using version 2013-03-01 or\n higher.\n \n \n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineOSImageCreateResponse class.\n \n \n \n \n Optional. The repository classification of the image. All user\n images have the category User.\n \n \n \n \n Optional. Specifies the description of the OS image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a string,\n but it is recommended that the value be a URL that points to a\n EULA.\n \n \n \n \n Optional. Specifies the URI to the icon that is displayed for the\n image in the Management Portal.\n \n \n \n \n Optional. Specifies a value that can be used to group OS images.\n \n \n \n \n Optional. Indicates if the image contains software or associated\n services that will incur charges above the core price for the\n virtual machine.\n \n \n \n \n Optional. Specifies the friendly name of the image.\n \n \n \n \n Optional. Specifies the language of the image. The Language element\n is only available using version 2013-03-01 or higher.\n \n \n \n \n Optional. The geo-location in which this media is located. The\n Location value is derived from storage account that contains the\n blob in which the media is located. If the storage account belongs\n to an affinity group the value is NULL. If the version is set to\n 2012-08-01 or later, the locations are returned for platform\n images; otherwise, this value is NULL for platform images.\n \n \n \n \n Optional. The size, in GB, of the image.\n \n \n \n \n Optional. Specifies the location of the blob in Azure storage. The\n blob location must belong to a storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n Example: http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Optional. Specifies a name that Azure uses to identify the image\n when creating one or more virtual machines.\n \n \n \n \n Optional. The operating system type of the OS image. Possible\n values are: Linux or Windows.\n \n \n \n \n Optional. Specifies the URI that points to a document that contains\n the privacy policy related to the OS image.\n \n \n \n \n Optional. Specifies the date when the OS image was added to the\n image repository.\n \n \n \n \n Optional. Specifies the name of the publisher of the image.\n \n \n \n \n Optional. Specifies the size to use for the virtual machine that is\n created from the OS image.\n \n \n \n \n Optional. Specifies whether the image should appear in the image\n gallery.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal. The\n SmallIconUri element is only available using version 2013-03-01 or\n higher.\n \n \n \n \n The Get Details OS Images operation response.\n \n \n \n \n A virtual machine image associated with your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineOSImageGetResponse\n class.\n \n \n \n \n Optional. The affinity in which the media is located. The\n AffinityGroup value is derived from storage account that contains\n the blob in which the media is located. If the storage account\n does not belong to an affinity group the value is NULL and the\n element is not displayed in the response. This value is NULL for\n platform images.\n \n \n \n \n Optional. The repository classification of the image. All user\n images have the category User.\n \n \n \n \n Optional. Specifies the description of the image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a string,\n but it is recommended that the value be a URL that points to a\n EULA.\n \n \n \n \n Optional. Provides the URI to the icon for this Operating System\n Image.\n \n \n \n \n Optional. Specifies a value that can be used to group images.\n \n \n \n \n Optional. Indicates whether the image contains software or\n associated services that will incur charges above the core price\n for the virtual machine. For additional details, see the\n PricingDetailLink element.\n \n \n \n \n Optional. An identifier for the image.\n \n \n \n \n Optional. Specifies the language of the image. The Language element\n is only available using version 2013-03-01 or higher.\n \n \n \n \n Optional. The geo-location in which this media is located. The\n Location value is derived from storage account that contains the\n blob in which the media is located. If the storage account belongs\n to an affinity group the value is NULL. If the version is set to\n 2012-08-01 or later, the locations are returned for platform\n images; otherwise, this value is NULL for platform images.\n \n \n \n \n Optional. The size, in GB, of the image.\n \n \n \n \n Optional. The location of the blob in Azure storage. The blob\n location belongs to a storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n Example: http://example.blob.core.windows.net/disks/myimage.vhd.\n \n \n \n \n Optional. The name of the operating system image. This is the name\n that is used when creating one or more virtual machines using the\n image.\n \n \n \n \n Optional. The operating system type of the OS image. Possible\n values are: Linux or Windows.\n \n \n \n \n Optional. Specifies the URI that points to a document that contains\n the privacy policy related to the image.\n \n \n \n \n Optional. Specifies the date when the image was added to the image\n repository.\n \n \n \n \n Optional. The name of the publisher of this OS Image in Azure.\n \n \n \n \n Optional. Specifies the size to use for the virtual machine that is\n created from the OS image.\n \n \n \n \n Optional. Indicates whether the image should be shown in the Azure\n portal.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal. The\n SmallIconUri element is only available using version 2013-03-01 or\n higher.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineOSImageGetDetailsResponse class.\n \n \n \n \n Optional. The indicator of whether the image is corrupted or not.\n \n \n \n \n Optional. The replication progress information of VM images.\n \n \n \n \n The replication progress information of VM images.\n \n \n \n \n Initializes a new instance of the ReplicationProgressElement\n class.\n \n \n \n \n Optional. The location of the replication of VM image.\n \n \n \n \n Optional. The progress of the replication of VM image.\n \n \n \n \n The List OS Images operation response.\n \n \n \n \n Initializes a new instance of the VirtualMachineOSImageListResponse\n class.\n \n \n \n \n Gets the sequence of Images.\n \n \n \n \n Gets the sequence of Images.\n \n \n \n \n Optional. The virtual machine images associated with your\n subscription.\n \n \n \n \n A virtual machine image associated with your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineOSImage class.\n \n \n \n \n Optional. The affinity in which the media is located. The\n AffinityGroup value is derived from storage account that\n contains the blob in which the media is located. If the\n storage account does not belong to an affinity group the value\n is NULL and the element is not displayed in the response.\n This value is NULL for platform images.\n \n \n \n \n Optional. The repository classification of the image. All user\n images have the category User.\n \n \n \n \n Optional. Specifies the description of the image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a\n string, but it is recommended that the value be a URL that\n points to a EULA.\n \n \n \n \n Optional. Specifies a value that can be used to group images.\n \n \n \n \n Optional. Indicates whether the image contains software or\n associated services that will incur charges above the core\n price for the virtual machine. For additional details, see the\n PricingDetailLink element.\n \n \n \n \n Optional. An identifier for the image.\n \n \n \n \n Optional. Specifies the language of the image. The Language\n element is only available using version 2013-03-01 or higher.\n \n \n \n \n Optional. The geo-location in which this media is located. The\n Location value is derived from storage account that contains\n the blob in which the media is located. If the storage account\n belongs to an affinity group the value is NULL. If the\n version is set to 2012-08-01 or later, the locations are\n returned for platform images; otherwise, this value is NULL\n for platform images.\n \n \n \n \n Optional. The size, in GB, of the image.\n \n \n \n \n Optional. The location of the blob in Azure storage. The blob\n location belongs to a storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n Example:\n http://example.blob.core.windows.net/disks/myimage.vhd\n \n \n \n \n Optional. The name of the operating system image. This is the\n name that is used when creating one or more virtual machines\n using the image.\n \n \n \n \n Optional. The operating system type of the OS image. Possible\n values are: Linux, Windows.\n \n \n \n \n Optional. Specifies a URL for an image with IsPremium set to\n true, which contains the pricing details for a virtual machine\n that is created from the image. The PricingDetailLink element\n is only available using version 2012-12-01 or higher.\n \n \n \n \n Optional. Specifies the URI that points to a document that\n contains the privacy policy related to the image.\n \n \n \n \n Optional. Specifies the date when the image was added to the\n image repository.\n \n \n \n \n Optional. The name of the publisher of this OS Image in Azure.\n \n \n \n \n Optional. Specifies the size to use for the virtual machine\n that is created from the OS image.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal.\n The SmallIconUri element is only available using version\n 2013-03-01 or higher.\n \n \n \n \n Known values for the operating system type of the OS in a virtual\n machine image.\n \n \n \n \n Parameters supplied to the Replicate Virtual Machine Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineOSImageReplicateParameters class.\n \n \n \n \n Optional. The replication target regional locations.Note: The\n regions in the request body are not additive. If an OS Image has\n already been replicated to Regions A, B, and C, and a request is\n made to replicate to Regions A and D, the VM Image will remain in\n Region A, will be replicated in Region D, and will be unreplicated\n from Regions B and C.\n \n \n \n \n The response body contains the published name of the image.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineOSImageReplicateResponse class.\n \n \n \n \n Optional. The published name of the image.\n \n \n \n \n Specifies the permission type for sharing.\n \n \n \n \n Parameters supplied to the Update Virtual Machine Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineOSImageUpdateParameters class.\n \n \n \n \n Optional. Specifies the description of the OS image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a string,\n but it is recommended that the value be a URL that points to a\n EULA.\n \n \n \n \n Optional. Specifies the URI to the icon that is displayed for the\n image in the Management Portal.\n \n \n \n \n Optional. Specifies a value that can be used to group OS images.\n \n \n \n \n Optional. Indicates if the image contains software or associated\n services that will incur charges above the core price for the\n virtual machine.\n \n \n \n \n Required. Specifies the friendly name of the image to be updated.\n You cannot use this operation to update images provided by the\n Azure platform.\n \n \n \n \n Optional. Specifies the language of the image. The Language element\n is only available using version 2013-03-01 or higher.\n \n \n \n \n Optional. Specifies the URI that points to a document that contains\n the privacy policy related to the OS image.\n \n \n \n \n Optional. Specifies the date when the OS image was added to the\n image repository.\n \n \n \n \n Optional. Specifies the size to use for the virtual machine that is\n created from the OS image.\n \n \n \n \n Optional. When published, should this image show up in the windows\n azure image gallery or not. True by default.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal. The\n SmallIconUri element is only available using version 2013-03-01 or\n higher.\n \n \n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineOSImageUpdateResponse class.\n \n \n \n \n Optional. The repository classification of the image. All user\n images have the category User.\n \n \n \n \n Optional. Specifies the description of the OS image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a string,\n but it is recommended that the value be a URL that points to a\n EULA.\n \n \n \n \n Optional. Specifies the URI to the icon that is displayed for the\n image in the Management Portal.\n \n \n \n \n Optional. Specifies a value that can be used to group OS images.\n \n \n \n \n Optional. Indicates if the image contains software or associated\n services that will incur charges above the core price for the\n virtual machine.\n \n \n \n \n Optional. Specifies the friendly name of the image.\n \n \n \n \n Optional. Specifies the language of the image. The Language element\n is only available using version 2013-03-01 or higher.\n \n \n \n \n Optional. The geo-location in which this media is located. The\n Location value is derived from storage account that contains the\n blob in which the media is located. If the storage account belongs\n to an affinity group the value is NULL. If the version is set to\n 2012-08-01 or later, the locations are returned for platform\n images; otherwise, this value is NULL for platform images.\n \n \n \n \n Optional. The size, in GB, of the image.\n \n \n \n \n Optional. Specifies the location of the blob in Azure storage. The\n blob location must belong to a storage account in the subscription\n specified by the SubscriptionId value in the operation call.\n Example: http://example.blob.core.windows.net/disks/mydisk.vhd.\n \n \n \n \n Optional. Specifies a name that Azure uses to identify the image\n when creating one or more virtual machines.\n \n \n \n \n Optional. The operating system type of the OS image. Possible\n values are: Linux or Windows.\n \n \n \n \n Optional. Specifies the URI that points to a document that contains\n the privacy policy related to the OS image.\n \n \n \n \n Optional. Specifies the date when the OS image was added to the\n image repository.\n \n \n \n \n Optional. Specifies the name of the publisher of the image.\n \n \n \n \n Optional. Specifies the size to use for the virtual machine that is\n created from the OS image.\n \n \n \n \n Optional. Specifies whether the image should appear in the image\n gallery.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal. The\n SmallIconUri element is only available using version 2013-03-01 or\n higher.\n \n \n \n \n The size of a virtual machine.\n \n \n \n \n The type of the role for the virtual machine.\n \n \n \n \n The parameters required for shutting down the virtual machine.\n \n \n \n \n Initializes a new instance of the VirtualMachineShutdownParameters\n class.\n \n \n \n \n Optional. The state of the virtual machine after shutdown (Stopped\n or StoppedDeallocated).\n \n \n \n \n Parameters for the shutdown roles operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineShutdownRolesParameters class.\n \n \n \n \n Optional. The state of the roles after shutdown. Possible values\n include Stopped or StoppedDeallocated.\n \n \n \n \n Optional. The set of roles to shut down.\n \n \n \n \n Parameters for the Start Roles operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineStartRolesParameters class.\n \n \n \n \n Optional. The set of roles to shut down.\n \n \n \n \n The set of parameters required to update a load balanced endpoint set.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineUpdateLoadBalancedSetParameters class.\n \n \n \n \n Optional. A list of load balanced InputEndpoints to update.\n \n \n \n \n The modeled external endpoint for a persistent VM role.\n \n \n \n \n Initializes a new instance of the InputEndpoint class.\n \n \n \n \n Optional. A Boolean specifying whether this endpoint uses\n Direct Server Return\n \n \n \n \n Required. Specifies whether this endpoint is part of shared\n LoadBalanced endpoint and served by multiple role instances.\n If not specified a BadRequest error will be returned. It must\n also be in use by the deployment (at least one role in the\n deployment must have an endpoint whose\n LoadBalancedEndpointSetName matches this) otherwise a\n BadRequest error will be returned.\n \n \n \n \n Optional. Optional. Specify the name of an internal load\n balancer if this endpoint shall not be exposed on the default\n load balancer.\n \n \n \n \n Optional. This represents an endpoint setting which platform\n load balancer must monitor to detect the availability of this\n role before forwarding traffic to this endpoint. If not\n specified the probe settings (if any) from the existing load\n balanced endpoint definition will be retained.\n \n \n \n \n Optional. Specifies the internal port on which a service\n running inside the VM is listening to serve this endpoint.\n WARNING: If specified then ALL the endpoints of this LB set on\n all the roles will be updated to have THIS local port. To keep\n unique local ports on each role for a load balanced endpoint\n specify this as 0 (zero) and if you need to change those use\n UpdateRole. In case of port conflict with a local port (or\n probe port) on a role a BadRequestwill be returned.\n \n \n \n \n Optional. The name of the InputEndpoint. The name is ignored\n if specified\n \n \n \n \n Optional. An integer specifying the public port for this\n endpoint. Allowed values are between 1 and 65535 inclusive. A\n unqiue Port and Protocol combination must be specified for\n each InputEndpoint in the list.\n \n \n \n \n Optional. Specifies the transport protocol for the endpoint.\n \n \n \n \n Optional. A collection of access control rules which control\n the external network traffic reaching to this endpoint. NOTES:\n (1) To remove the ACLs from a load-balanced endpoint just omit\n this element. (2) ACLs are set as specified. There is no merge\n done with existing ACLs.\n \n \n \n \n Optional. The virtual IP address of the endpoint.\n \n \n \n \n Parameters supplied to the Update Virtual Machine operation.\n \n \n \n \n Initializes a new instance of the VirtualMachineUpdateParameters\n class.\n \n \n \n \n Optional. Specifies the name of an availability set to which to add\n the virtual machine. This value controls the virtual machine\n allocation in the Azure environment. Virtual machines specified in\n the same availability set are allocated to different nodes to\n maximize availability.\n \n \n \n \n Optional. Contains the collection of configuration sets that\n contain system and application configuration settings.\n \n \n \n \n Optional. Contains the parameters Azure used to create the data\n disk for the virtual machine.\n \n \n \n \n Optional. Specifies the friendly name for the virtual machine.\n \n \n \n \n Required. Contains the parameters Azure used to create the\n operating system disk for the virtual machine.\n \n \n \n \n Optional. Indicates whether the WindowsAzureGuestAgent service is\n installed on the Virtual Machine. To run a resource extension in a\n Virtual Machine, this service must be installed.\n \n \n \n \n Optional. Contains a collection of resource extensions that are to\n be installed on the Virtual Machine. This element is used if\n ProvisionGuestAgent is set to true.\n \n \n \n \n Required. Specifies the name for the virtual machine. The name must\n be unique within the deployment.\n \n \n \n \n Optional. The size of the virtual machine.\n \n \n \n \n The Get Details VM Images operation response.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineVMImageGetDetailsResponse class.\n \n \n \n \n Optional. The affinity group name of the virtual machine image.\n \n \n \n \n Optional. The classification of the virtual machine image.\n \n \n \n \n Optional. The date when the virtual machine image was created.\n \n \n \n \n Optional. The data disk configurations.\n \n \n \n \n Optional. The deployment name of the virtual machine image.\n \n \n \n \n Optional. The description of the virtual machine image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a string,\n but it is recommended that the value be a URL that points to a\n EULA.\n \n \n \n \n Optional. Provides the URI to the icon for this Operating System\n Image.\n \n \n \n \n Optional. The image family of the virtual machine image.\n \n \n \n \n Optional. The indicator of whether the image is corrupted or not.\n \n \n \n \n Optional. The indicator of whether the virtual machine image is\n premium.\n \n \n \n \n Optional. An identifier for the virtual machine image.\n \n \n \n \n Optional. The language of the virtual machine image.\n \n \n \n \n Optional. The location name of the virtual machine image.\n \n \n \n \n Optional. The date when the virtual machine image was created.\n \n \n \n \n Optional. The name of the virtual machine image.\n \n \n \n \n Optional. The OS disk configuration.\n \n \n \n \n Optional. Specifies the URI that points to the pricing detail.\n \n \n \n \n Optional. Specifies the URI that points to a document that contains\n the privacy policy related to the image.\n \n \n \n \n Optional. Specifies the date when the image was added to the image\n repository.\n \n \n \n \n Optional. The publisher name of the VM image.\n \n \n \n \n Optional. The name of the publisher of this VM Image in Azure.\n \n \n \n \n Optional. The recommended size of the virtual machine image.\n \n \n \n \n Optional. The replication progress information of VM images.\n \n \n \n \n Optional. The role name of the virtual machine image.\n \n \n \n \n Optional. The service name of the virtual machine image.\n \n \n \n \n Optional. The sharing status of the VM image.\n \n \n \n \n Optional. Specifies whether to show in Gui.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal.\n \n \n \n \n The replication progress information of VM images.\n \n \n \n \n Initializes a new instance of the ReplicationProgressElement\n class.\n \n \n \n \n Optional. The location of the replication of VM image.\n \n \n \n \n Optional. The progress of the replication of VM image.\n \n \n \n \n The List VM Images operation response.\n \n \n \n \n Initializes a new instance of the VirtualMachineVMImageListResponse\n class.\n \n \n \n \n Gets the sequence of VMImages.\n \n \n \n \n Gets the sequence of VMImages.\n \n \n \n \n Optional. The virtual machine images associated with your\n subscription.\n \n \n \n \n The data disk configuration.\n \n \n \n \n Initializes a new instance of the DataDiskConfiguration class.\n \n \n \n \n Optional. Specifies the platform caching behavior of the data\n disk blob for read/write efficiency. The default vault is\n ReadOnly.\n \n \n \n \n Optional. Specifies the size, in GB, of an empty VHD to be\n attached to the virtual machine. The VHD can be created as\n part of disk attach or create virtual machine calls by\n specifying the value for this property. Azure creates the\n empty VHD based on size preference and attaches the newly\n created VHD to the virtual machine.\n \n \n \n \n Optional. Specifies the Logical Unit Number (LUN) for the data\n disk. The LUN specifies the slot in which the data drive\n appears when mounted for usage by the virtual machine. This\n element is only listed when more than one data disk is\n attached to a virtual machine.\n \n \n \n \n Optional. Specifies the location of the disk in Windows Azure\n storage.\n \n \n \n \n Optional. Specifies the name of the VHD to use to create the\n data disk for the virtual machine.\n \n \n \n \n The OS disk configuration.\n \n \n \n \n Initializes a new instance of the OSDiskConfiguration class.\n \n \n \n \n Optional. Specifies the platform caching behavior of the\n operating system disk blob for read/write efficiency.\n \n \n \n \n Optional. Specifies the size, in GB, of an empty VHD to be\n attached to the virtual machine. The VHD can be created as\n part of disk attach or create virtual machine calls by\n specifying the value for this property. Azure creates the\n empty VHD based on size preference and attaches the newly\n created VHD to the virtual machine.\n \n \n \n \n Optional. Specifies the location of the disk in Windows Azure\n storage.\n \n \n \n \n Optional. Specifies the name of an operating system image in\n the image repository.\n \n \n \n \n Optional. The operating system running in the virtual machine.\n \n \n \n \n Optional. The operating system state in the virtual machine.\n \n \n \n \n A virtual machine image associated with your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineVMImage class.\n \n \n \n \n Optional. The affinity group name of the virtual machine image.\n \n \n \n \n Optional. The classification of the virtual machine image.\n \n \n \n \n Optional. The date when the virtual machine image was created.\n \n \n \n \n Optional. The data disk configurations.\n \n \n \n \n Optional. The deployment name of the virtual machine image.\n \n \n \n \n Optional. The description of the virtual machine image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a\n string, but it is recommended that the value be a URL that\n points to a EULA.\n \n \n \n \n Optional. Provides the URI to the icon for this Operating\n System Image.\n \n \n \n \n Optional. The image family of the virtual machine image.\n \n \n \n \n Optional. The indicator of whether the virtual machine image is\n premium.\n \n \n \n \n Optional. An identifier for the virtual machine image.\n \n \n \n \n Optional. The language of the virtual machine image.\n \n \n \n \n Optional. The location name of the virtual machine image.\n \n \n \n \n Optional. The date when the virtual machine image was created.\n \n \n \n \n Optional. The name of the virtual machine image.\n \n \n \n \n Optional. The OS disk configuration.\n \n \n \n \n Optional. Specifies the URI that points to the pricing detail.\n \n \n \n \n Optional. Specifies the URI that points to a document that\n contains the privacy policy related to the image.\n \n \n \n \n Optional. Specifies the date when the image was added to the\n image repository.\n \n \n \n \n Optional. The name of the publisher of this VM Image in Azure.\n \n \n \n \n Optional. The recommended size of the virtual machine image.\n \n \n \n \n Optional. The role name of the virtual machine image.\n \n \n \n \n Optional. The service name of the virtual machine image.\n \n \n \n \n Optional. Specifies whether to show in Gui.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal.\n \n \n \n \n Parameters supplied to the Replicate Virtual Machine Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineVMImageReplicateParameters class.\n \n \n \n \n Optional. The replication target regional locations.Note: The\n regions in the request body are not additive. If a VM Image has\n already been replicated to Regions A, B, and C, and a request is\n made to replicate to Regions A and D, the VM Image will remain in\n Region A, will be replicated in Region D, and will be unreplicated\n from Regions B and C.\n \n \n \n \n The response body contains the published name of the image.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineVMImageReplicateResponse class.\n \n \n \n \n Optional. The published name of the image.\n \n \n \n \n Specifies the permission type for sharing.\n \n \n \n \n Parameters supplied to the Update Virtual Machine Image operation.\n \n \n \n \n Initializes a new instance of the\n VirtualMachineVMImageUpdateParameters class.\n \n \n \n \n Optional. Optional. The Data Disk Configurations.\n \n \n \n \n Optional. Specifies the description of the OS image.\n \n \n \n \n Optional. Specifies the End User License Agreement that is\n associated with the image. The value for this element is a string,\n but it is recommended that the value be a URL that points to a\n EULA.\n \n \n \n \n Optional. Specifies the URI to the icon that is displayed for the\n image in the Management Portal.\n \n \n \n \n Optional. Specifies a value that can be used to group OS images.\n \n \n \n \n Required. Specifies the friendly name of the image to be updated.\n You cannot use this operation to update images provided by the\n Azure platform.\n \n \n \n \n Optional. Specifies the language of the image.\n \n \n \n \n Optional. Optional. The OS Disk Configuration.\n \n \n \n \n Optional. Specifies the URI that points to a document that contains\n the privacy policy related to the OS image.\n \n \n \n \n Optional. Specifies the date when the OS image was added to the\n image repository.\n \n \n \n \n Optional. Specifies the size to use for the virtual machine that is\n created from the OS image.\n \n \n \n \n Optional. Optional. True or False.\n \n \n \n \n Optional. Specifies the URI to the small icon that is displayed\n when the image is presented in the Azure Management Portal.\n \n \n \n \n Specifies the type of listener for enabling remote Windows PowerShell.\n \n \n \n \n Contains the type and certificate information for the listener.\n \n \n \n \n Initializes a new instance of the WindowsRemoteManagementListener\n class.\n \n \n \n \n Optional. Specifies the certificate thumbprint for the secure\n connection. If Type is Https then this value is an optional value\n that is set to the thumbprint of the service certificate that is\n used to provision the WinRM HTTPS listener. If this value is not\n specified, a self-signed certificate is generated and used for the\n virtual machine.\n \n \n \n \n Required. Specifies the type of listener. This value can be Http or\n Https. The value is case sensitive.\n \n \n \n \n Configures the Windows Remote Management service on the virtual\n machine, which enables remote Windows PowerShell.\n \n \n \n \n Initializes a new instance of the WindowsRemoteManagementSettings\n class.\n \n \n \n \n Optional. Contains a collection of information for enabling remote\n Windows PowerShell.\n \n \n \n \n Operations for determining the version of the Azure Guest Operating\n System on which your service is running. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684169.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the OperatingSystemOperations class.\n \n \n Reference to the service client.\n \n \n \n \n The List Operating Systems operation lists the versions of the\n guest operating system that are currently available in Windows\n Azure. The 2010-10-28 version of List Operating Systems also\n indicates what family an operating system version belongs to.\n Currently Azure supports two operating system families: the Azure\n guest operating system that is substantially compatible with\n Windows Server 2008 SP2, and the Azure guest operating system that\n is substantially compatible with Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684168.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Operating Systems operation response.\n \n \n \n \n The List OS Families operation lists the guest operating system\n families available in Azure, and also lists the operating system\n versions available for each family. Currently Azure supports two\n operating system families: the Azure guest operating system that\n is substantially compatible with Windows Server 2008 SP2, and the\n Azure guest operating system that is substantially compatible with\n Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441291.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Operating System Families operation response.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The List Operating Systems operation lists the versions of the\n guest operating system that are currently available in Windows\n Azure. The 2010-10-28 version of List Operating Systems also\n indicates what family an operating system version belongs to.\n Currently Azure supports two operating system families: the Azure\n guest operating system that is substantially compatible with\n Windows Server 2008 SP2, and the Azure guest operating system that\n is substantially compatible with Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684168.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IOperatingSystemOperations.\n \n \n The List Operating Systems operation response.\n \n \n \n \n The List Operating Systems operation lists the versions of the\n guest operating system that are currently available in Windows\n Azure. The 2010-10-28 version of List Operating Systems also\n indicates what family an operating system version belongs to.\n Currently Azure supports two operating system families: the Azure\n guest operating system that is substantially compatible with\n Windows Server 2008 SP2, and the Azure guest operating system that\n is substantially compatible with Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ff684168.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IOperatingSystemOperations.\n \n \n The List Operating Systems operation response.\n \n \n \n \n The List OS Families operation lists the guest operating system\n families available in Azure, and also lists the operating system\n versions available for each family. Currently Azure supports two\n operating system families: the Azure guest operating system that\n is substantially compatible with Windows Server 2008 SP2, and the\n Azure guest operating system that is substantially compatible with\n Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441291.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IOperatingSystemOperations.\n \n \n The List Operating System Families operation response.\n \n \n \n \n The List OS Families operation lists the guest operating system\n families available in Azure, and also lists the operating system\n versions available for each family. Currently Azure supports two\n operating system families: the Azure guest operating system that\n is substantially compatible with Windows Server 2008 SP2, and the\n Azure guest operating system that is substantially compatible with\n Windows Server 2008 R2. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/gg441291.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IOperatingSystemOperations.\n \n \n The List Operating System Families operation response.\n \n \n \n \n Operations for managing service certificates for your subscription.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee795178.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the ServiceCertificateOperations\n class.\n \n \n Reference to the service client.\n \n \n \n \n The Begin Creating Service Certificate operation adds a certificate\n to a hosted service. This operation is an asynchronous operation.\n To determine whether the management service has finished\n processing the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n Required. The DNS prefix name of your service.\n \n \n Required. Parameters supplied to the Begin Creating Service\n Certificate operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Required. Parameters supplied to the Begin Deleting Service\n Certificate operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Service Certificate operation adds a certificate to a\n hosted service. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n Required. The DNS prefix name of your service.\n \n \n Required. Parameters supplied to the Create Service Certificate\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Required. Parameters supplied to the Delete Service Certificate\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Service Certificate operation returns the public data for\n the specified X.509 certificate associated with a hosted service.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460792.aspx\n for more information)\n \n \n Required. Parameters supplied to the Get Service Certificate\n operation.\n \n \n Cancellation token.\n \n \n The Get Service Certificate operation response.\n \n \n \n \n The List Service Certificates operation lists all of the service\n certificates associated with the specified hosted service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154105.aspx\n for more information)\n \n \n Required. The DNS prefix name of your hosted service.\n \n \n Cancellation token.\n \n \n The List Service Certificates operation response.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Begin Creating Service Certificate operation adds a certificate\n to a hosted service. This operation is an asynchronous operation.\n To determine whether the management service has finished\n processing the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. The DNS prefix name of your service.\n \n \n Required. Parameters supplied to the Begin Creating Service\n Certificate operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Service Certificate operation adds a certificate\n to a hosted service. This operation is an asynchronous operation.\n To determine whether the management service has finished\n processing the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. The DNS prefix name of your service.\n \n \n Required. Parameters supplied to the Begin Creating Service\n Certificate operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. Parameters supplied to the Begin Deleting Service\n Certificate operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. Parameters supplied to the Begin Deleting Service\n Certificate operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Service Certificate operation adds a certificate to a\n hosted service. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. The DNS prefix name of your service.\n \n \n Required. Parameters supplied to the Create Service Certificate\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Service Certificate operation adds a certificate to a\n hosted service. This operation is an asynchronous operation. To\n determine whether the management service has finished processing\n the request, call Get Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460817.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. The DNS prefix name of your service.\n \n \n Required. Parameters supplied to the Create Service Certificate\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. Parameters supplied to the Delete Service Certificate\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Service Certificate operation deletes a service\n certificate from the certificate store of a hosted service. This\n operation is an asynchronous operation. To determine whether the\n management service has finished processing the request, call Get\n Operation Status. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460803.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. Parameters supplied to the Delete Service Certificate\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Service Certificate operation returns the public data for\n the specified X.509 certificate associated with a hosted service.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460792.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. Parameters supplied to the Get Service Certificate\n operation.\n \n \n The Get Service Certificate operation response.\n \n \n \n \n The Get Service Certificate operation returns the public data for\n the specified X.509 certificate associated with a hosted service.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460792.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. Parameters supplied to the Get Service Certificate\n operation.\n \n \n The Get Service Certificate operation response.\n \n \n \n \n The List Service Certificates operation lists all of the service\n certificates associated with the specified hosted service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154105.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. The DNS prefix name of your hosted service.\n \n \n The List Service Certificates operation response.\n \n \n \n \n The List Service Certificates operation lists all of the service\n certificates associated with the specified hosted service. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154105.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IServiceCertificateOperations.\n \n \n Required. The DNS prefix name of your hosted service.\n \n \n The List Service Certificates operation response.\n \n \n \n \n The Service Management API includes operations for managing the disks\n in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157188.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the VirtualMachineDiskOperations\n class.\n \n \n Reference to the service client.\n \n \n \n \n The Begin Deleting Data Disk operation removes the specified data\n disk from a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to delete the data disk from.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Data Disk operation adds a data disk to a virtual\n machine. There are three ways to create the data disk using the\n Add Data Disk operation. Option 1 - Attach an empty data disk to\n the role by specifying the disk label and location of the disk\n image. Do not include the DiskName and SourceMediaLink elements in\n the request body. Include the MediaLink element and reference a\n blob that is in the same geographical region as the role. You can\n also omit the MediaLink element. In this usage, Azure will create\n the data disk in the storage account configured as default for the\n role. Option 2 - Attach an existing data disk that is in the image\n repository. Do not include the DiskName and SourceMediaLink\n elements in the request body. Specify the data disk to use by\n including the DiskName element. Note: If included the in the\n response body, the MediaLink and LogicalDiskSizeInGB elements are\n ignored. Option 3 - Specify the location of a blob in your storage\n account that contain a disk image to use. Include the\n SourceMediaLink element. Note: If the MediaLink element\n isincluded, it is ignored. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157199.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to add the data disk to.\n \n \n Required. Parameters supplied to the Create Virtual Machine Data\n Disk operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Required. Parameters supplied to the Create Virtual Machine Disk\n operation.\n \n \n Cancellation token.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Delete Data Disk operation removes the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to delete the data disk from.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Disk operation deletes the specified data or operating\n system disk from your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157200.aspx\n for more information)\n \n \n Required. The name of the disk to delete.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Data Disk operation retrieves the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157180.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role.\n \n \n Required. The logical unit number of the disk.\n \n \n Cancellation token.\n \n \n The Get Data Disk operation response.\n \n \n \n \n The Get Disk operation retrieves a disk from the user image\n repository. The disk can be an operating system disk or a data\n disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Required. The name of the disk.\n \n \n Cancellation token.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The List Disks operation retrieves a list of the disks in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157176.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Disks operation response.\n \n \n \n \n The Update Data Disk operation updates the specified data disk\n attached to the specified virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157190.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to add the data disk to.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Parameters supplied to the Update Virtual Machine Data\n Disk operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Add Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Required. The name of the disk being updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Disk\n operation.\n \n \n Cancellation token.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Begin Deleting Data Disk operation removes the specified data\n disk from a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to delete the data disk from.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Data Disk operation removes the specified data\n disk from a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to delete the data disk from.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Data Disk operation adds a data disk to a virtual\n machine. There are three ways to create the data disk using the\n Add Data Disk operation. Option 1 - Attach an empty data disk to\n the role by specifying the disk label and location of the disk\n image. Do not include the DiskName and SourceMediaLink elements in\n the request body. Include the MediaLink element and reference a\n blob that is in the same geographical region as the role. You can\n also omit the MediaLink element. In this usage, Azure will create\n the data disk in the storage account configured as default for the\n role. Option 2 - Attach an existing data disk that is in the image\n repository. Do not include the DiskName and SourceMediaLink\n elements in the request body. Specify the data disk to use by\n including the DiskName element. Note: If included the in the\n response body, the MediaLink and LogicalDiskSizeInGB elements are\n ignored. Option 3 - Specify the location of a blob in your storage\n account that contain a disk image to use. Include the\n SourceMediaLink element. Note: If the MediaLink element\n isincluded, it is ignored. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157199.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to add the data disk to.\n \n \n Required. Parameters supplied to the Create Virtual Machine Data\n Disk operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Data Disk operation adds a data disk to a virtual\n machine. There are three ways to create the data disk using the\n Add Data Disk operation. Option 1 - Attach an empty data disk to\n the role by specifying the disk label and location of the disk\n image. Do not include the DiskName and SourceMediaLink elements in\n the request body. Include the MediaLink element and reference a\n blob that is in the same geographical region as the role. You can\n also omit the MediaLink element. In this usage, Azure will create\n the data disk in the storage account configured as default for the\n role. Option 2 - Attach an existing data disk that is in the image\n repository. Do not include the DiskName and SourceMediaLink\n elements in the request body. Specify the data disk to use by\n including the DiskName element. Note: If included the in the\n response body, the MediaLink and LogicalDiskSizeInGB elements are\n ignored. Option 3 - Specify the location of a blob in your storage\n account that contain a disk image to use. Include the\n SourceMediaLink element. Note: If the MediaLink element\n isincluded, it is ignored. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157199.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to add the data disk to.\n \n \n Required. Parameters supplied to the Create Virtual Machine Data\n Disk operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. Parameters supplied to the Create Virtual Machine Disk\n operation.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Create Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. Parameters supplied to the Create Virtual Machine Disk\n operation.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Delete Data Disk operation removes the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to delete the data disk from.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Data Disk operation removes the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157179.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to delete the data disk from.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Disk operation deletes the specified data or operating\n system disk from your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157200.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of the disk to delete.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Disk operation deletes the specified data or operating\n system disk from your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157200.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of the disk to delete.\n \n \n Required. Specifies that the source blob for the disk should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Data Disk operation retrieves the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157180.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role.\n \n \n Required. The logical unit number of the disk.\n \n \n The Get Data Disk operation response.\n \n \n \n \n The Get Data Disk operation retrieves the specified data disk from\n a virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157180.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role.\n \n \n Required. The logical unit number of the disk.\n \n \n The Get Data Disk operation response.\n \n \n \n \n The Get Disk operation retrieves a disk from the user image\n repository. The disk can be an operating system disk or a data\n disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of the disk.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Get Disk operation retrieves a disk from the user image\n repository. The disk can be an operating system disk or a data\n disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of the disk.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The List Disks operation retrieves a list of the disks in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157176.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n The List Disks operation response.\n \n \n \n \n The List Disks operation retrieves a list of the disks in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157176.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n The List Disks operation response.\n \n \n \n \n The Update Data Disk operation updates the specified data disk\n attached to the specified virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157190.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to add the data disk to.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Parameters supplied to the Update Virtual Machine Data\n Disk operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Update Data Disk operation updates the specified data disk\n attached to the specified virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157190.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of the deployment.\n \n \n Required. The name of the role to add the data disk to.\n \n \n Required. The logical unit number of the disk.\n \n \n Required. Parameters supplied to the Update Virtual Machine Data\n Disk operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Add Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of the disk being updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Disk\n operation.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Add Disk operation adds a disk to the user image repository.\n The disk can be an operating system disk or a data disk. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157178.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineDiskOperations.\n \n \n Required. The name of the disk being updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Disk\n operation.\n \n \n A virtual machine disk associated with your subscription.\n \n \n \n \n The Service Management API includes operations for managing the virtual\n machine extensions in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the VirtualMachineExtensionOperations\n class.\n \n \n Reference to the service client.\n \n \n \n \n The List Resource Extensions operation lists the resource\n extensions that are available to add to a Virtual Machine. In\n Azure, a process can run as a resource extension of a Virtual\n Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495441.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n The List Resource Extension Versions operation lists the versions\n of a resource extension that are available to add to a Virtual\n Machine. In Azure, a process can run as a resource extension of a\n Virtual Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495440.aspx\n for more information)\n \n \n Required. The name of the publisher.\n \n \n Required. The name of the extension.\n \n \n Cancellation token.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The List Resource Extensions operation lists the resource\n extensions that are available to add to a Virtual Machine. In\n Azure, a process can run as a resource extension of a Virtual\n Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495441.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineExtensionOperations.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n The List Resource Extensions operation lists the resource\n extensions that are available to add to a Virtual Machine. In\n Azure, a process can run as a resource extension of a Virtual\n Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495441.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineExtensionOperations.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n The List Resource Extension Versions operation lists the versions\n of a resource extension that are available to add to a Virtual\n Machine. In Azure, a process can run as a resource extension of a\n Virtual Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495440.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineExtensionOperations.\n \n \n Required. The name of the publisher.\n \n \n Required. The name of the extension.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n The List Resource Extension Versions operation lists the versions\n of a resource extension that are available to add to a Virtual\n Machine. In Azure, a process can run as a resource extension of a\n Virtual Machine. For example, Remote Desktop Access or the Azure\n Diagnostics Agent can run as resource extensions to the Virtual\n Machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn495440.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineExtensionOperations.\n \n \n Required. The name of the publisher.\n \n \n Required. The name of the extension.\n \n \n The List Resource Extensions operation response.\n \n \n \n \n The Service Management API includes operations for managing the virtual\n machines in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157206.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the VirtualMachineOperations class.\n \n \n Reference to the service client.\n \n \n \n \n The Begin Capturing Role operation creates a copy of the operating\n system virtual hard disk (VHD) that is deployed in the virtual\n machine, saves the VHD copy in the same storage location as the\n operating system VHD, and registers the copy as an image in your\n image gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Begin Capturing Virtual\n Machine operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Begin capturing role as VM template.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Role operation adds a virtual machine to an\n existing deployment. You can refer to the OSDisk in the Add Role\n operation in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Creating Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Virtual Machine Deployment operation provisions\n a virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. Parameters supplied to the Begin Creating Virtual Machine\n Deployment operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Role operation deletes the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to delete.\n \n \n Required. Specifies that the source blob(s) for the virtual machine\n should also be deleted from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Restarting role operation restarts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to shutdown.\n \n \n Required. The parameters for the shutdown vm operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Shutting Down Roles operation stops the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469421.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Begin Shutting Down Roles\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Role operation starts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to start.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Roles operation starts the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469419.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Begin Starting Roles operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Role operation adds a virtual machine to an\n existing deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your virtual machine.\n \n \n Required. Parameters supplied to the Begin Updating Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469417.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Updating Load Balanced\n Endpoint Set operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Capture Role operation creates a copy of the operating system\n virtual hard disk (VHD) that is deployed in the virtual machine,\n saves the VHD copy in the same storage location as the operating\n system VHD, and registers the copy as an image in your image\n gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Capture role as VM template.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Role operation adds a virtual machine to an existing\n deployment. You can refer to the OSDisk in the Add Role operation\n in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Create Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Virtual Machine Deployment operation provisions a\n virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. Parameters supplied to the Create Virtual Machine\n Deployment operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role operation deletes the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to delete.\n \n \n Required. Specifies that the source blob(s) for the virtual machine\n should also be deleted from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Role operation retrieves information about the specified\n virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157193.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine.\n \n \n Cancellation token.\n \n \n The Get Virtual Machine operation response.\n \n \n \n \n The Download RDP file operation retrieves the Remote Desktop\n Protocol configuration file from the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157183.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine.\n \n \n Cancellation token.\n \n \n The Download RDP file operation response.\n \n \n \n \n The Restart role operation restarts the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to shutdown.\n \n \n Required. The parameters for the shutdown virtual machine operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Roles operation stops the specified set of virtual\n machines.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Shutdown Roles operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Role operation starts the specified virtual machine.\n (see http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to start.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Roles operation starts the specified set of virtual\n machines.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Start Roles operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Role operation adds a virtual machine to an existing\n deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your virtual machine.\n \n \n Required. Parameters supplied to the Update Virtual Machine\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Update Load Balanced Endpoint\n Set operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Begin Capturing Role operation creates a copy of the operating\n system virtual hard disk (VHD) that is deployed in the virtual\n machine, saves the VHD copy in the same storage location as the\n operating system VHD, and registers the copy as an image in your\n image gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Begin Capturing Virtual\n Machine operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Capturing Role operation creates a copy of the operating\n system virtual hard disk (VHD) that is deployed in the virtual\n machine, saves the VHD copy in the same storage location as the\n operating system VHD, and registers the copy as an image in your\n image gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Begin Capturing Virtual\n Machine operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Begin capturing role as VM template.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Begin capturing role as VM template.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Role operation adds a virtual machine to an\n existing deployment. You can refer to the OSDisk in the Add Role\n operation in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Creating Virtual Machine\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Role operation adds a virtual machine to an\n existing deployment. You can refer to the OSDisk in the Add Role\n operation in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Creating Virtual Machine\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Virtual Machine Deployment operation provisions\n a virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. Parameters supplied to the Begin Creating Virtual Machine\n Deployment operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Virtual Machine Deployment operation provisions\n a virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. Parameters supplied to the Begin Creating Virtual Machine\n Deployment operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Role operation deletes the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to delete.\n \n \n Required. Specifies that the source blob(s) for the virtual machine\n should also be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Role operation deletes the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to delete.\n \n \n Required. Specifies that the source blob(s) for the virtual machine\n should also be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Restarting role operation restarts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Restarting role operation restarts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to shutdown.\n \n \n Required. The parameters for the shutdown vm operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to shutdown.\n \n \n Required. The parameters for the shutdown vm operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Shutting Down Roles operation stops the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469421.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Begin Shutting Down Roles\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Shutting Down Roles operation stops the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469421.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Begin Shutting Down Roles\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Role operation starts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to start.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Role operation starts the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to start.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Roles operation starts the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469419.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Begin Starting Roles operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Starting Roles operation starts the specified set of\n virtual machines. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469419.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Begin Starting Roles operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Role operation adds a virtual machine to an\n existing deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your virtual machine.\n \n \n Required. Parameters supplied to the Begin Updating Virtual Machine\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Role operation adds a virtual machine to an\n existing deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your virtual machine.\n \n \n Required. Parameters supplied to the Begin Updating Virtual Machine\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469417.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Updating Load Balanced\n Endpoint Set operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Updating Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/dn469417.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Begin Updating Load Balanced\n Endpoint Set operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Capture Role operation creates a copy of the operating system\n virtual hard disk (VHD) that is deployed in the virtual machine,\n saves the VHD copy in the same storage location as the operating\n system VHD, and registers the copy as an image in your image\n gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Capture Role operation creates a copy of the operating system\n virtual hard disk (VHD) that is deployed in the virtual machine,\n saves the VHD copy in the same storage location as the operating\n system VHD, and registers the copy as an image in your image\n gallery. From the captured image, you can create additional\n customized virtual machines. For more information about images and\n disks, see Manage Disks and Images at\n http://msdn.microsoft.com/en-us/library/windowsazure/jj672979.aspx.\n For more information about capturing images, see How to Capture an\n Image of a Virtual Machine Running Windows Server 2008 R2 at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-capture-image-windows-server/\n or How to Capture an Image of a Virtual Machine Running Linux at\n http://www.windowsazure.com/en-us/documentation/articles/virtual-machines-linux-capture-image/.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157201.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Capture role as VM template.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Capture role as VM template.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n Required. Parameters supplied to the Capture Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Role operation adds a virtual machine to an existing\n deployment. You can refer to the OSDisk in the Add Role operation\n in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Create Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Role operation adds a virtual machine to an existing\n deployment. You can refer to the OSDisk in the Add Role operation\n in the following ways: Platform/User Image - Set the\n SourceImageName to a platform or user image. You can optionally\n specify the DiskName and MediaLink values as part the operation to\n control the name and location of target disk. When DiskName and\n MediaLink are specified in this mode, they must not already exist\n in the system, otherwise a conflict fault is returned; UserDisk -\n Set DiskName to a user supplied image in image repository.\n SourceImageName must be set to NULL. All other properties are\n ignored; or Blob in a Storage Account - Set MediaLink to a blob\n containing the image. SourceImageName and DiskName are set to\n NULL. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157186.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Create Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Virtual Machine Deployment operation provisions a\n virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. Parameters supplied to the Create Virtual Machine\n Deployment operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Virtual Machine Deployment operation provisions a\n virtual machine based on the supplied configuration. When you\n create a deployment of a virtual machine, you should make sure\n that the cloud service and the disk or image that you use are\n located in the same region. For example, if the cloud service was\n created in the West US region, the disk or image that you use\n should also be located in a storage account in the West US region.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157194.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. Parameters supplied to the Create Virtual Machine\n Deployment operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role operation deletes the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to delete.\n \n \n Required. Specifies that the source blob(s) for the virtual machine\n should also be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Role operation deletes the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157184.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to delete.\n \n \n Required. Specifies that the source blob(s) for the virtual machine\n should also be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Role operation retrieves information about the specified\n virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157193.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine.\n \n \n The Get Virtual Machine operation response.\n \n \n \n \n The Get Role operation retrieves information about the specified\n virtual machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157193.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine.\n \n \n The Get Virtual Machine operation response.\n \n \n \n \n The Download RDP file operation retrieves the Remote Desktop\n Protocol configuration file from the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157183.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine.\n \n \n The Download RDP file operation response.\n \n \n \n \n The Download RDP file operation retrieves the Remote Desktop\n Protocol configuration file from the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157183.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine.\n \n \n The Download RDP file operation response.\n \n \n \n \n The Restart role operation restarts the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Restart role operation restarts the specified virtual machine.\n (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157197.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to restart.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to shutdown.\n \n \n Required. The parameters for the shutdown virtual machine operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Role operation shuts down the specified virtual\n machine. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157195.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to shutdown.\n \n \n Required. The parameters for the shutdown virtual machine operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Roles operation stops the specified set of virtual\n machines.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Shutdown Roles operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Shutdown Roles operation stops the specified set of virtual\n machines.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Shutdown Roles operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Role operation starts the specified virtual machine.\n (see http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to start.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Role operation starts the specified virtual machine.\n (see http://msdn.microsoft.com/en-us/library/windowsazure/jj157189.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of the virtual machine to start.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Roles operation starts the specified set of virtual\n machines.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Start Roles operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Start Roles operation starts the specified set of virtual\n machines.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters to pass to the Start Roles operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Role operation adds a virtual machine to an existing\n deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your virtual machine.\n \n \n Required. Parameters supplied to the Update Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Role operation adds a virtual machine to an existing\n deployment. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157187.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. The name of your virtual machine.\n \n \n Required. Parameters supplied to the Update Virtual Machine\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Update Load Balanced Endpoint\n Set operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update Load Balanced Endpoint Set operation changes the\n specified load-balanced InputEndpoints on all the roles of an\n Infrastructure as a Service deployment. Non-load-balanced\n endpoints must be changed using UpdateRole.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOperations.\n \n \n Required. The name of your service.\n \n \n Required. The name of your deployment.\n \n \n Required. Parameters supplied to the Update Load Balanced Endpoint\n Set operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Service Management API includes operations for managing the OS\n images in your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157175.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the VirtualMachineOSImageOperations\n class.\n \n \n Reference to the service client.\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The OS Image Name should be the user OS Image, not the published\n name of the OS Image.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create OS Image operation adds an operating system image that\n is stored in a storage account and is available from the image\n repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157192.aspx\n for more information)\n \n \n Required. Parameters supplied to the Create Virtual Machine Image\n operation.\n \n \n Cancellation token.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n The Delete OS Image operation deletes the specified OS image from\n your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157203.aspx\n for more information)\n \n \n Required. The name of the image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get OS Image operation retrieves the details for an operating\n system image from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n Required. The name of the OS image to retrieve.\n \n \n Cancellation token.\n \n \n A virtual machine image associated with your subscription.\n \n \n \n \n Gets OS Image's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n Cancellation token.\n \n \n The Get Details OS Images operation response.\n \n \n \n \n The List OS Images operation retrieves a list of the operating\n system images from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List OS Images operation response.\n \n \n \n \n Replicate an OS image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine OS image to replicate.\n \n \n Required. Parameters supplied to the Replicate Virtual Machine\n Image operation.\n \n \n Cancellation token.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The OS Image Name should be the user OS Image, not the published\n name of the OS Image.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update OS Image operation updates an OS image that in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157198.aspx\n for more information)\n \n \n Required. The name of the virtual machine image to be updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Image\n operation.\n \n \n Cancellation token.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The OS Image Name should be the user OS Image, not the published\n name of the OS Image.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The OS Image Name should be the user OS Image, not the published\n name of the OS Image.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Create OS Image operation adds an operating system image that\n is stored in a storage account and is available from the image\n repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157192.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. Parameters supplied to the Create Virtual Machine Image\n operation.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n The Create OS Image operation adds an operating system image that\n is stored in a storage account and is available from the image\n repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157192.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. Parameters supplied to the Create Virtual Machine Image\n operation.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n The Delete OS Image operation deletes the specified OS image from\n your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157203.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete OS Image operation deletes the specified OS image from\n your image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157203.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get OS Image operation retrieves the details for an operating\n system image from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the OS image to retrieve.\n \n \n A virtual machine image associated with your subscription.\n \n \n \n \n The Get OS Image operation retrieves the details for an operating\n system image from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the OS image to retrieve.\n \n \n A virtual machine image associated with your subscription.\n \n \n \n \n Gets OS Image's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n The Get Details OS Images operation response.\n \n \n \n \n Gets OS Image's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n The Get Details OS Images operation response.\n \n \n \n \n The List OS Images operation retrieves a list of the operating\n system images from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n The List OS Images operation response.\n \n \n \n \n The List OS Images operation retrieves a list of the operating\n system images from the image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157191.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n The List OS Images operation response.\n \n \n \n \n Replicate an OS image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine OS image to replicate.\n \n \n Required. Parameters supplied to the Replicate Virtual Machine\n Image operation.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Replicate an OS image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine OS image to replicate.\n \n \n Required. Parameters supplied to the Replicate Virtual Machine\n Image operation.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Share an already replicated OS image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The OS Image Name should be the user OS Image, not the published\n name of the OS Image.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an OS image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user OS Image.\n It does not remove the actual user OS Image. To remove the actual\n user OS Image, the publisher will have to call Delete OS Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The OS Image Name should be the user OS Image, not the published\n name of the OS Image.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update OS Image operation updates an OS image that in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157198.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to be updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Image\n operation.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n The Update OS Image operation updates an OS image that in your\n image repository. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj157198.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineOSImageOperations.\n \n \n Required. The name of the virtual machine image to be updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Image\n operation.\n \n \n Parameters returned from the Create Virtual Machine Image operation.\n \n \n \n \n The Service Management API includes operations for managing the virtual\n machine templates in your subscription.\n \n \n \n \n Initializes a new instance of the VirtualMachineVMImageOperations\n class.\n \n \n Reference to the service client.\n \n \n \n \n The Begin Deleting Virtual Machine Image operation deletes the\n specified virtual machine image.\n \n \n Required. The name of the virtual machine image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The VM Image Name should be the user VM Image, not the published\n name of the VM Image.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Virtual Machine Image operation deletes the specified\n virtual machine image.\n \n \n Required. The name of the virtual machine image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets VMImage's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n Cancellation token.\n \n \n The Get Details VM Images operation response.\n \n \n \n \n The List Virtual Machine Images operation retrieves a list of the\n virtual machine images.\n \n \n Cancellation token.\n \n \n The List VM Images operation response.\n \n \n \n \n Replicate an VM image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n Required. Parameters supplied to the Replicate Virtual Machine\n Image operation.\n \n \n Cancellation token.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The VM Image Name should be the user VM Image, not the published\n name of the VM Image.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update VM Image operation updates a VM image that in your image\n repository.\n \n \n Required. The name of the virtual machine image to be updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Image\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Compute.ComputeManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL, and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Begin Deleting Virtual Machine Image operation deletes the\n specified virtual machine image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Deleting Virtual Machine Image operation deletes the\n specified virtual machine image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The VM Image Name should be the user VM Image, not the published\n name of the VM Image.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The VM Image Name should be the user VM Image, not the published\n name of the VM Image.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Virtual Machine Image operation deletes the specified\n virtual machine image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Virtual Machine Image operation deletes the specified\n virtual machine image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to delete.\n \n \n Required. Specifies that the source blob for the image should also\n be deleted from storage.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets VMImage's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n The Get Details VM Images operation response.\n \n \n \n \n Gets VMImage's properties and its replication details. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n The Get Details VM Images operation response.\n \n \n \n \n The List Virtual Machine Images operation retrieves a list of the\n virtual machine images.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n The List VM Images operation response.\n \n \n \n \n The List Virtual Machine Images operation retrieves a list of the\n virtual machine images.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n The List VM Images operation response.\n \n \n \n \n Replicate an VM image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n Required. Parameters supplied to the Replicate Virtual Machine\n Image operation.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Replicate an VM image to multiple target locations. This operation\n is only for publishers. You have to be registered as image\n publisher with Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate.\n \n \n Required. Parameters supplied to the Replicate Virtual Machine\n Image operation.\n \n \n The response body contains the published name of the image.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Share an already replicated VM image. This operation is only for\n publishers. You have to be registered as image publisher with\n Windows Azure to be able to call this.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to share.\n \n \n Required. The sharing permission: public, msdn, or private.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The VM Image Name should be the user VM Image, not the published\n name of the VM Image.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Unreplicate an VM image to multiple target locations. This\n operation is only for publishers. You have to be registered as\n image publisher with Windows Azure to be able to call this. Note:\n The operation removes the published copies of the user VM Image.\n It does not remove the actual user VM Image. To remove the actual\n user VM Image, the publisher will have to call Delete VM Image.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to replicate. Note:\n The VM Image Name should be the user VM Image, not the published\n name of the VM Image.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Update VM Image operation updates a VM image that in your image\n repository.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to be updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Image\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Update VM Image operation updates a VM image that in your image\n repository.\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Compute.IVirtualMachineVMImageOperations.\n \n \n Required. The name of the virtual machine image to be updated.\n \n \n Required. Parameters supplied to the Update Virtual Machine Image\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild2/References/Microsoft.WindowsAzure.Management.Storage.xml", "content": "\n\n \n Microsoft.WindowsAzure.Management.Storage\n \n \n \n \n The Service Management API includes operations for managing the storage\n accounts beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460790.aspx for\n more information)\n \n \n \n \n The Begin Creating Storage Account operation creates a new storage\n account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Parameters supplied to the Begin Creating Storage Account operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Check Name Availability operation checks if a storage account\n name is available for use in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154125.aspx\n for more information)\n \n \n The desired storage account name to check for availability.\n \n \n Cancellation token.\n \n \n The response to a storage account check name availability request.\n \n \n \n \n The Create Storage Account operation creates a new storage account\n in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Parameters supplied to the Create Storage Account operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Storage Account operation deletes the specified storage\n account from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264517.aspx\n for more information)\n \n \n The name of the storage account to be deleted.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Storage Account Properties operation returns system\n properties for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460802.aspx\n for more information)\n \n \n Name of the storage account to get properties for.\n \n \n Cancellation token.\n \n \n The Get Storage Account Properties operation response.\n \n \n \n \n The Get Storage Keys operation returns the primary and secondary\n access keys for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460785.aspx\n for more information)\n \n \n The name of the desired storage account.\n \n \n Cancellation token.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The List Storage Accounts operation lists the storage accounts\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460787.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Storage Accounts operation response.\n \n \n \n \n The Regenerate Keys operation regenerates the primary or secondary\n access key for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460795.aspx\n for more information)\n \n \n Parameters supplied to the Regenerate Keys operation.\n \n \n Cancellation token.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The Update Storage Account operation updates the label and the\n description, and enables or disables the geo-replication status\n for a storage account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264516.aspx\n for more information)\n \n \n Name of the storage account to update.\n \n \n Parameters supplied to the Update Storage Account operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n The request ID for the request you wish to track. The request ID is\n returned in the x-ms-request-id response header for every request.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets the API version.\n \n \n \n \n Gets the URI used as the base for all cloud service requests.\n \n \n \n \n Gets subscription credentials which uniquely identify Microsoft\n Azure subscription. The subscription ID forms part of the URI for\n every service call.\n \n \n \n \n Gets or sets the initial timeout for Long Running Operations.\n \n \n \n \n Gets or sets the retry timeout for Long Running Operations.\n \n \n \n \n The Service Management API includes operations for managing the\n storage accounts beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460790.aspx\n for more information)\n \n \n \n \n The response to a storage account check name availability request.\n \n \n \n \n Initializes a new instance of the CheckNameAvailabilityResponse\n class.\n \n \n \n \n Optional. The result of the availability request indicating if the\n name is available.\n \n \n \n \n Optional. The reason for unavailability, if the requested name is\n unavailable.\n \n \n \n \n The geographical region in which a storage account exists.\n \n \n \n \n Indicates whether the storage region is available.\n \n \n \n \n A Storage Service associated with your subscription.\n \n \n \n \n Initializes a new instance of the StorageAccount class.\n \n \n \n \n Optional. Represents the name of an extended storage account\n property. Each extended property must have both a defined name and\n a value. You can have a maximum of 50 extended property name/value\n pairs. The maximum length of the Name element is 64 characters,\n only alphanumeric characters and underscores are valid in the\n Name, and the name must start with a letter. Attempting to use\n other characters, starting the Name with a non-letter character,\n or entering a name that is identical to that of another extended\n property owned by the same storage account, will result in a\n status code 400 (Bad Request) error. Each extended property value\n has a maximum length of 255 characters.\n \n \n \n \n Optional. The name of the storage account. This name is the DNS\n prefix name and can be used to access blobs, queues, and tables in\n the storage account. For example, if the service name is\n MyStorageAccount, you could access the blob containers by calling:\n http://MyStorageAccount.blob.core.windows.net/mycontainer/.\n \n \n \n \n Optional. Details about the storage account.\n \n \n \n \n Optional. The Service Management API request URI used to perform\n Get Storage Account Properties requests against the storage\n account.\n \n \n \n \n Parameters supplied to the Create Storage Account operation.\n \n \n \n \n Initializes a new instance of the StorageAccountCreateParameters\n class.\n \n \n \n \n Optional. The name of an existing affinity group in the specified\n subscription. Required if Location is not specified. You can\n include either a Location or AffinityGroup element in the request\n body, but not both. To list available affinity groups, use the\n List Affinity Groups operation.\n \n \n \n \n Optional. A description for the storage account. The description\n may be up to 1024 characters in length.\n \n \n \n \n Optional. Represents the name of an extended storage account\n property. Each extended property must have a defined name and a\n value. You can have a maximum of 50 extended property name/value\n pairs. The maximum length of the Name element is 64 characters,\n only alphanumeric characters and underscores are valid in the\n Name, and the name must start with a letter. Attempting to use\n other characters, starting the Name with a non-letter character,\n or entering a name that is identical to that of another extended\n property owned by the same storage account will result in a status\n code 400 (Bad Request) error. Each extended property value has a\n maximum length of 255 characters.\n \n \n \n \n Optional. Specifies whether the storage account is created with\n geo-replication enabled. If the element is not included in the\n request body, the default value is true. If set to true, the data\n in the storage account is replicated across more than one\n geographic location to enable resilience in the face of\n catastrophic service loss.\n \n \n \n \n Required. A name for the storage account, specified as\n abase64-encoded string. The name may be up to 100 characters in\n length. The name can be used identify the storage account for your\n tracking purposes.\n \n \n \n \n Optional. The location where the storage account is created.\n Required if AffinityGroup is not specified. You can include either\n a Location or AffinityGroup element in the request body, but not\n both. To list available locations, use the List Locations\n operation.\n \n \n \n \n Required. A name for the storage account, unique within Azure.\n Storage account names must be between 3 and 24 characters in\n length, and must use numbers and lower-case letters only. This\n name is the DNS prefix name and can be used to access blobs,\n queues, and tables in the storage account. For example:\n http://ServiceName.blob.core.windows.net/mycontainer/.\n \n \n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n Initializes a new instance of the StorageAccountGetKeysResponse\n class.\n \n \n \n \n Optional. The primary access key for the storage account.\n \n \n \n \n Optional. The secondary access key for the storage account.\n \n \n \n \n Optional. The Service Management API request URI used to perform\n Get Storage Account Properties requests against the storage\n account.\n \n \n \n \n The Get Storage Account Properties operation response.\n \n \n \n \n Initializes a new instance of the StorageAccountGetResponse class.\n \n \n \n \n Optional. The requested storage account.\n \n \n \n \n The List Storage Accounts operation response.\n \n \n \n \n Initializes a new instance of the StorageAccountListResponse class.\n \n \n \n \n Gets the sequence of StorageAccounts.\n \n \n \n \n Gets the sequence of StorageAccounts.\n \n \n \n \n Optional. The requested storage accounts.\n \n \n \n \n Details about a storage account.\n \n \n \n \n Initializes a new instance of the StorageAccountProperties class.\n \n \n \n \n Optional. The affinity group with which this storage account is\n associated.\n \n \n \n \n Optional. The user-supplied description of the storage account.\n \n \n \n \n Optional. The URLs that are used to perform a retrieval of a public\n blob, queue, or table object.\n \n \n \n \n Optional. Indicates the primary geographical region in which the\n storage account exists at this time.\n \n \n \n \n Optional. Indicates whether geo-replication is\n enabled.Geo-replication means data in the storage account is\n replicated across more than one geographic location so as to\n enable resilience in the face of catastrophic service loss.\n \n \n \n \n Optional. Indicates the geographical region in which the storage\n account is being replicated. The GeoSecondaryRegion element is not\n returned if geo-replication is \"off\" for this account.\n \n \n \n \n Optional. The user-supplied name of the storage account, returned\n as a base-64 encoded string. This name can be used identify the\n storage account for your tracking purposes.\n \n \n \n \n Optional. A timestamp that indicates the most recent instance of a\n failover to the secondary region. In the case of multiple\n failovers, only the latest failover date and time is maintained.\n The format of the returned timestamp is:\n [4DigitYear]-[2DigitMonth]-[2DigitDay]T[2DigitMinute]:[2DigitSecond]:[7DigitsOfPrecision]Z.\n LastGeoFailoverTime is not returned if there has not been an\n instance of a failover.\n \n \n \n \n Optional. The geo-location specified when the storage account was\n created. This property is only returned if the storage account is\n not associated with an affinity group.\n \n \n \n \n Optional. The status of the storage account at the time the\n operation was called.\n \n \n \n \n Optional. Indicates whether the primary storage region is available.\n \n \n \n \n Optional. Indicates whether the secondary storage region is\n available.\n \n \n \n \n Parameters supplied to the Regenerate Keys operation.\n \n \n \n \n Initializes a new instance of the\n StorageAccountRegenerateKeysParameters class.\n \n \n \n \n Required. Specifies which key to regenerate.\n \n \n \n \n Required. The name of the desired storage account.\n \n \n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n Initializes a new instance of the\n StorageAccountRegenerateKeysResponse class.\n \n \n \n \n Optional. The primary access key for the storage account.\n \n \n \n \n Optional. The secondary access key for the storage account.\n \n \n \n \n Optional. The Service Management API request URI used to perform\n Get Storage Account Properties requests against the storage\n account.\n \n \n \n \n The status of the storage account at the time the operation was called.\n \n \n \n \n The Storage Account has been created.\n \n \n \n \n The Storage Account is being created.\n \n \n \n \n The DNS name for the storage account is being propagated.\n \n \n \n \n The Storage Account is being deleted.\n \n \n \n \n Parameters supplied to the Update Storage Account operation.\n \n \n \n \n Initializes a new instance of the StorageAccountUpdateParameters\n class.\n \n \n \n \n Optional.\n \n \n \n \n Optional. Represents the name of an extended storage account\n property. Each extended property must have a defined name and a\n value. You can have a maximum of 50 extended property name/value\n pairs. The maximum length of the Name element is 64 characters,\n only alphanumeric characters and underscores are valid in the\n Name, and the name must start with a letter. Attempting to use\n other characters, starting the Name with a non-letter character,\n or entering a name that is identical to that of another extended\n property owned by the same storage account will result in a status\n code 400 (Bad Request) error. Each extended property value has a\n maximum length of 255 characters. You can delete an extended\n property by setting the value to NULL.\n \n \n \n \n Optional. Indicates whether geo-replication is enabled on the\n specified storage account. If set to true, the data in the storage\n account is replicated across more than one geographic location so\n as to enable resiliency in the face of catastrophic service loss.\n If the element is not included in the request body, the current\n value is left unchanged. Important: If you have enabled\n geo-replication, you can elect to disable it by setting this\n element to false. When disabled, your data is no longer replicated\n to a secondary data center and any data in the secondary location\n will be removed. Enabling geo-replication once it has been\n disabled will result in the storage account being billed for\n replicating the current copy of data to the secondary data center.\n After the existing copy of the data is replicated to the secondary\n data center, updates are geo-replicated at no additional charge.\n \n \n \n \n Optional. A name for the storage account, base64-encoded. The name\n may be up to 100 characters in length. The name can be used\n identify the storage account for your tracking purposes.\n \n \n \n \n Describes the type of a storage key.\n \n \n \n \n The Service Management API includes operations for managing the storage\n accounts beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460790.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the StorageAccountOperations class.\n \n \n Reference to the service client.\n \n \n \n \n The Begin Creating Storage Account operation creates a new storage\n account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Required. Parameters supplied to the Begin Creating Storage Account\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Check Name Availability operation checks if a storage account\n name is available for use in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154125.aspx\n for more information)\n \n \n Required. The desired storage account name to check for\n availability.\n \n \n Cancellation token.\n \n \n The response to a storage account check name availability request.\n \n \n \n \n The Create Storage Account operation creates a new storage account\n in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Required. Parameters supplied to the Create Storage Account\n operation.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Storage Account operation deletes the specified storage\n account from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264517.aspx\n for more information)\n \n \n Required. The name of the storage account to be deleted.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Storage Account Properties operation returns system\n properties for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460802.aspx\n for more information)\n \n \n Required. Name of the storage account to get properties for.\n \n \n Cancellation token.\n \n \n The Get Storage Account Properties operation response.\n \n \n \n \n The Get Storage Keys operation returns the primary and secondary\n access keys for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460785.aspx\n for more information)\n \n \n Required. The name of the desired storage account.\n \n \n Cancellation token.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The List Storage Accounts operation lists the storage accounts\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460787.aspx\n for more information)\n \n \n Cancellation token.\n \n \n The List Storage Accounts operation response.\n \n \n \n \n The Regenerate Keys operation regenerates the primary or secondary\n access key for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460795.aspx\n for more information)\n \n \n Required. Parameters supplied to the Regenerate Keys operation.\n \n \n Cancellation token.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The Update Storage Account operation updates the label and the\n description, and enables or disables the geo-replication status\n for a storage account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264516.aspx\n for more information)\n \n \n Required. Name of the storage account to update.\n \n \n Required. Parameters supplied to the Update Storage Account\n operation.\n \n \n Cancellation token.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n Gets a reference to the\n Microsoft.WindowsAzure.Management.Storage.StorageManagementClient.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Begin Creating Storage Account operation creates a new storage\n account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Parameters supplied to the Begin Creating Storage Account\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Begin Creating Storage Account operation creates a new storage\n account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Parameters supplied to the Begin Creating Storage Account\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Check Name Availability operation checks if a storage account\n name is available for use in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154125.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. The desired storage account name to check for\n availability.\n \n \n The response to a storage account check name availability request.\n \n \n \n \n The Check Name Availability operation checks if a storage account\n name is available for use in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/jj154125.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. The desired storage account name to check for\n availability.\n \n \n The response to a storage account check name availability request.\n \n \n \n \n The Create Storage Account operation creates a new storage account\n in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Parameters supplied to the Create Storage Account\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Create Storage Account operation creates a new storage account\n in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264518.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Parameters supplied to the Create Storage Account\n operation.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Delete Storage Account operation deletes the specified storage\n account from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264517.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. The name of the storage account to be deleted.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Delete Storage Account operation deletes the specified storage\n account from Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264517.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. The name of the storage account to be deleted.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Get Storage Account Properties operation returns system\n properties for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460802.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Name of the storage account to get properties for.\n \n \n The Get Storage Account Properties operation response.\n \n \n \n \n The Get Storage Account Properties operation returns system\n properties for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460802.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Name of the storage account to get properties for.\n \n \n The Get Storage Account Properties operation response.\n \n \n \n \n The Get Storage Keys operation returns the primary and secondary\n access keys for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460785.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. The name of the desired storage account.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The Get Storage Keys operation returns the primary and secondary\n access keys for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460785.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. The name of the desired storage account.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The List Storage Accounts operation lists the storage accounts\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460787.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n The List Storage Accounts operation response.\n \n \n \n \n The List Storage Accounts operation lists the storage accounts\n available under the current subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460787.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n The List Storage Accounts operation response.\n \n \n \n \n The Regenerate Keys operation regenerates the primary or secondary\n access key for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460795.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Parameters supplied to the Regenerate Keys operation.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The Regenerate Keys operation regenerates the primary or secondary\n access key for the specified storage account. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460795.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Parameters supplied to the Regenerate Keys operation.\n \n \n The primary and secondary access keys for a storage account.\n \n \n \n \n The Update Storage Account operation updates the label and the\n description, and enables or disables the geo-replication status\n for a storage account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264516.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Name of the storage account to update.\n \n \n Required. Parameters supplied to the Update Storage Account\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Update Storage Account operation updates the label and the\n description, and enables or disables the geo-replication status\n for a storage account in Azure. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/hh264516.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageAccountOperations.\n \n \n Required. Name of the storage account to update.\n \n \n Required. Parameters supplied to the Update Storage Account\n operation.\n \n \n A standard service response including an HTTP status code and\n request ID.\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n Initializes a new instance of the StorageManagementClient class.\n \n \n \n \n Initializes a new instance of the StorageManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n Required. Gets the URI used as the base for all cloud service\n requests.\n \n \n \n \n Initializes a new instance of the StorageManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n \n \n Initializes a new instance of the StorageManagementClient class.\n \n \n The Http client\n \n \n \n \n Initializes a new instance of the StorageManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n Required. Gets the URI used as the base for all cloud service\n requests.\n \n \n The Http client\n \n \n \n \n Initializes a new instance of the StorageManagementClient class.\n \n \n Required. Gets subscription credentials which uniquely identify\n Microsoft Azure subscription. The subscription ID forms part of\n the URI for every service call.\n \n \n The Http client\n \n \n \n \n Clones properties from current instance to another\n StorageManagementClient instance\n \n \n Instance of StorageManagementClient to clone to\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n Required. The request ID for the request you wish to track. The\n request ID is returned in the x-ms-request-id response header for\n every request.\n \n \n Cancellation token.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n Gets the API version.\n \n \n \n \n Gets the URI used as the base for all cloud service requests.\n \n \n \n \n Gets subscription credentials which uniquely identify Microsoft\n Azure subscription. The subscription ID forms part of the URI for\n every service call.\n \n \n \n \n Gets or sets the initial timeout for Long Running Operations.\n \n \n \n \n Gets or sets the retry timeout for Long Running Operations.\n \n \n \n \n The Service Management API includes operations for managing the\n storage accounts beneath your subscription. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460790.aspx\n for more information)\n \n \n \n \n The Service Management API provides programmatic access to much of the\n functionality available through the Management Portal. The Service\n Management API is a REST API. All API operations are performed over\n SSL and are mutually authenticated using X.509 v3 certificates. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx for\n more information)\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageManagementClient.\n \n \n Required. The request ID for the request you wish to track. The\n request ID is returned in the x-ms-request-id response header for\n every request.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n \n The Get Operation Status operation returns the status of the\n specified operation. After calling an asynchronous operation, you\n can call Get Operation Status to determine whether the operation\n has succeeded, failed, or is still in progress. (see\n http://msdn.microsoft.com/en-us/library/windowsazure/ee460783.aspx\n for more information)\n \n \n Reference to the\n Microsoft.WindowsAzure.Management.Storage.IStorageManagementClient.\n \n \n Required. The request ID for the request you wish to track. The\n request ID is returned in the x-ms-request-id response header for\n every request.\n \n \n The response body contains the status of the specified asynchronous\n operation, indicating whether it has succeeded, is inprogress, or\n has failed. Note that this status is distinct from the HTTP status\n code returned for the Get Operation Status operation itself. If\n the asynchronous operation succeeded, the response body includes\n the HTTP status code for the successful request. If the\n asynchronous operation failed, the response body includes the HTTP\n status code for the failed request and error information regarding\n the failure.\n \n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild2/References/Microsoft.WindowsAzure.Storage.xml", "content": "\n\n \n Microsoft.WindowsAzure.Storage\n \n \n \n \n Represents the status of an asynchronous operation and provides support for cancellation.\n \n \n \n \n Cancels the asynchronous operation.\n \n \n \n \n Represents a handler that signs HTTP requests.\n \n \n \n \n Signs the specified HTTP request so it can be authenticated by the Windows Azure storage services.\n \n The HTTP request to sign.\n An object for tracking the current operation.\n \n \n \n Represents a handler that signs HTTP requests with no authentication information.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Signs the specified HTTP request with no authentication information.\n \n The HTTP request to sign.\n An object for tracking the current operation.\n \n \n \n Represents a handler that signs HTTP requests with a shared key.\n \n \n \n \n Initializes a new instance of the class.\n \n A canonicalizer that converts HTTP request data into a standard form appropriate for signing.\n A object providing credentials for the request.\n The name of the storage account that the HTTP request will access.\n \n \n \n Signs the specified HTTP request with a shared key.\n \n The HTTP request to sign.\n An object for tracking the current operation.\n \n \n \n Represents a handler that signs HTTP requests with a shared key.\n \n \n \n \n Initializes a new instance of the class.\n \n A canonicalizer that converts HTTP request data into a standard form appropriate for signing.\n A object providing credentials for the request.\n The name of the storage account that the HTTP request will access.\n \n \n \n Signs the specified HTTP request with a shared key.\n \n The HTTP request to sign.\n An object for tracking the current operation.\n \n \n \n Initializes a new instance of the BlobReadStreamBase class.\n \n Blob reference to read from\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n An object for tracking the current operation.\n \n \n \n Sets the position within the current stream.\n \n A byte offset relative to the origin parameter.\n A value of type SeekOrigin indicating the reference\n point used to obtain the new position.\n The new position within the current stream.\n Seeking in a BlobReadStream disables MD5 validation.\n \n \n \n This operation is not supported in BlobReadStreamBase.\n \n Not used.\n \n \n \n This operation is not supported in BlobReadStreamBase.\n \n Not used.\n Not used.\n Not used.\n \n \n \n This operation is a no-op in BlobReadStreamBase.\n \n \n \n \n Read as much as we can from the internal buffer\n \n The buffer to read the data into.\n The byte offset in buffer at which to begin writing\n data read from the stream.\n The maximum number of bytes to read.\n Number of bytes read from the stream.\n \n \n \n Calculates the number of bytes to read from the blob.\n \n Number of bytes to read.\n \n \n \n Updates the blob MD5 with newly downloaded content.\n \n The buffer to read the data from.\n The byte offset in buffer at which to begin reading data.\n The maximum number of bytes to read.\n \n \n \n Releases the blob resources used by the Stream.\n \n true to release both managed and unmanaged resources; false to release only unmanaged resources.\n \n \n \n Gets a value indicating whether the current stream supports reading.\n \n \n \n \n Gets a value indicating whether the current stream supports seeking.\n \n \n \n \n Gets a value indicating whether the current stream supports writing.\n \n \n \n \n Gets or sets the position within the current stream.\n \n \n \n \n Gets the length in bytes of the stream.\n \n The length in bytes of the stream.\n \n \n \n Initializes a new instance of the BlobReadStream class.\n \n Blob reference to read from\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n An object for tracking the current operation.\n \n \n \n Reads a sequence of bytes from the current stream and advances the\n position within the stream by the number of bytes read.\n \n The buffer to read the data into.\n The byte offset in buffer at which to begin writing\n data read from the stream.\n The maximum number of bytes to read.\n The total number of bytes read into the buffer. This can be\n less than the number of bytes requested if that many bytes are not\n currently available, or zero (0) if the end of the stream has been reached.\n \n \n \n Begins an asynchronous read operation.\n \n The buffer to read the data into.\n The byte offset in buffer at which to begin writing\n data read from the stream.\n The maximum number of bytes to read.\n An optional asynchronous callback, to be called when the read is complete.\n A user-provided object that distinguishes this particular asynchronous read request from other requests.\n An IAsyncResult that represents the asynchronous read, which could still be pending.\n \n \n \n Waits for the pending asynchronous read to complete.\n \n The reference to the pending asynchronous request to finish.\n The total number of bytes read into the buffer. This can be\n less than the number of bytes requested if that many bytes are not\n currently available, or zero (0) if the end of the stream has been reached.\n \n \n \n Dispatches an async read operation that either reads from the cache or makes a call to\n the server.\n \n The reference to the pending asynchronous request to finish.\n The buffer to read the data into.\n The byte offset in buffer at which to begin writing\n data read from the stream.\n The maximum number of bytes to read.\n \n \n \n Called when the asynchronous DownloadRangeToStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Dispatches a sync read operation that either reads from the cache or makes a call to\n the server.\n \n The buffer to read the data into.\n The byte offset in buffer at which to begin writing\n data read from the stream.\n The maximum number of bytes to read.\n Number of bytes read from the stream.\n \n \n \n Represents a stream for writing to a blob.\n \n \n \n \n Clears all buffers for this stream, causes any buffered data to be written to the underlying blob, and commits the blob.\n \n \n \n \n Begins an asynchronous commit operation.\n \n An optional asynchronous callback, to be called when the commit is complete.\n A user-provided object that distinguishes this particular asynchronous commit request from other requests.\n An ICancellableAsyncResult that represents the asynchronous commit, which could still be pending.\n \n \n \n Waits for the pending asynchronous commit to complete.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Begins an asynchronous flush operation.\n \n An optional asynchronous callback, to be called when the flush is complete.\n A user-provided object that distinguishes this particular asynchronous flush request from other requests.\n An ICancellableAsyncResult that represents the asynchronous flush, which could still be pending.\n \n \n \n Waits for the pending asynchronous flush to complete.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Initializes a new instance of the BlobWriteStreamBase class.\n \n The service client. \n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n An object for tracking the current operation.\n \n \n \n Initializes a new instance of the BlobWriteStreamBase class for a block blob.\n \n Blob reference to write to.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n An object for tracking the current operation.\n \n \n \n Initializes a new instance of the BlobWriteStreamBase class for a page blob.\n \n Blob reference to write to.\n Size of the page blob.\n Use true if the page blob is newly created, false otherwise.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n An object for tracking the current operation.\n \n \n \n This operation is not supported in BlobWriteStreamBase.\n \n Not used.\n Not used.\n Not used.\n \n \n \n Calculates the new position within the current stream for a Seek operation.\n \n A byte offset relative to the origin parameter.\n A value of type SeekOrigin indicating the reference\n point used to obtain the new position.\n The new position within the current stream.\n \n \n \n This operation is not supported in BlobWriteStreamBase.\n \n Not used.\n \n \n \n Generates a new block ID to be used for PutBlock.\n \n Base64 encoded block ID\n \n \n \n Releases the blob resources used by the Stream.\n \n true to release both managed and unmanaged resources; false to release only unmanaged resources.\n \n \n \n Gets a value indicating whether the current stream supports reading.\n \n \n \n \n Gets a value indicating whether the current stream supports seeking.\n \n \n \n \n Gets a value indicating whether the current stream supports writing.\n \n \n \n \n Gets the length in bytes of the stream.\n \n \n \n \n Gets or sets the position within the current stream.\n \n \n \n \n Initializes a new instance of the BlobWriteStream class for a block blob.\n \n Blob reference to write to.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n An object for tracking the current operation.\n \n \n \n Initializes a new instance of the BlobWriteStream class for a page blob.\n \n Blob reference to write to.\n Size of the page blob.\n Use true if the page blob is newly created, false otherwise.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n An object for tracking the current operation.\n \n \n \n Sets the position within the current stream.\n \n A byte offset relative to the origin parameter.\n A value of type SeekOrigin indicating the reference\n point used to obtain the new position.\n The new position within the current stream.\n \n \n \n Writes a sequence of bytes to the current stream and advances the current\n position within this stream by the number of bytes written.\n \n An array of bytes. This method copies count bytes from\n buffer to the current stream. \n The zero-based byte offset in buffer at which to begin\n copying bytes to the current stream.\n The number of bytes to be written to the current stream.\n \n \n \n Begins an asynchronous write operation.\n \n An array of bytes. This method copies count bytes from\n buffer to the current stream. \n The zero-based byte offset in buffer at which to begin\n copying bytes to the current stream.\n The number of bytes to be written to the current stream.\n An optional asynchronous callback, to be called when the write is complete.\n A user-provided object that distinguishes this particular asynchronous write request from other requests.\n An IAsyncResult that represents the asynchronous write, which could still be pending.\n \n \n \n Waits for the pending asynchronous write to complete.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Clears all buffers for this stream and causes any buffered data to be written to the underlying blob.\n \n \n \n \n Begins an asynchronous flush operation.\n \n An optional asynchronous callback, to be called when the flush is complete.\n A user-provided object that distinguishes this particular asynchronous flush request from other requests.\n An ICancellableAsyncResult that represents the asynchronous flush, which could still be pending.\n \n \n \n Waits for the pending asynchronous flush to complete.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Called when noPendingWritesEvent is signalled indicating that there are no outstanding write requests.\n \n An object containing information to be used by the callback method each time it executes. \n true if the WaitHandle timed out; false if it was signaled.\n \n \n \n Releases the blob resources used by the Stream.\n \n true to release both managed and unmanaged resources; false to release only unmanaged resources.\n \n \n \n Clears all buffers for this stream, causes any buffered data to be written to the underlying blob, and commits the blob.\n \n \n \n \n Begins an asynchronous commit operation.\n \n An optional asynchronous callback, to be called when the commit is complete.\n A user-provided object that distinguishes this particular asynchronous commit request from other requests.\n An ICancellableAsyncResult that represents the asynchronous commit, which could still be pending.\n \n \n \n Waits for the pending asynchronous commit to complete.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Called when the pending flush operation completes so that we can continue with the commit.\n \n The result of the asynchronous operation.\n \n \n \n Called when the block blob commit operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Called when the page blob commit operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Dispatches a write operation.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Starts an asynchronous PutBlock operation as soon as the parallel\n operation semaphore becomes available.\n \n Data to be uploaded\n Block ID\n MD5 hash of the data to be uploaded\n The reference to the pending asynchronous request to finish.\n \n \n \n Called when the asynchronous PutBlock operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Starts an asynchronous WritePages operation as soon as the parallel\n operation semaphore becomes available.\n \n Data to be uploaded\n Offset within the page blob\n MD5 hash of the data to be uploaded\n The reference to the pending asynchronous request to finish.\n \n \n \n Called when the asynchronous WritePages operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Provides a client-side logical representation of the Windows Azure Blob service. This client is used to configure and execute requests against the Blob service.\n \n The service client encapsulates the base URI for the Blob service. If the service client will be used for authenticated access, \n it also encapsulates the credentials for accessing the storage account.\n \n Provides a client-side logical representation of the Windows Azure Blob service. This client is used to configure and execute requests against the Blob service.\n \n The service client encapsulates the base URI for the Blob service. If the service client will be used for authenticated access, it also encapsulates \n the credentials for accessing the storage account.\n \n \n \n Returns an enumerable collection of containers whose names \n begin with the specified prefix and that are retrieved lazily.\n \n The container name prefix.\n A value that indicates whether to return container metadata with the listing.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n An enumerable collection of containers that are retrieved lazily.\n \n \n \n Returns a result segment containing a collection of objects.\n \n A returned by a previous listing operation.\n A result segment of containers.\n \n \n \n Returns a result segment containing a collection of objects.\n \n The container name prefix.\n A returned by a previous listing operation.\n A result segment of containers.\n \n \n \n Returns a result segment containing a collection of containers whose names begin with the specified prefix.\n \n The container name prefix.\n A value that indicates whether to return container metadata with the listing.\n A non-negative integer value that indicates the maximum number of results to be returned \n in the result segment, up to the per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A returned by a previous listing operation.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A result segment of containers.\n \n \n \n Returns a result segment containing a collection of containers\n whose names begin with the specified prefix.\n \n The container name prefix.\n A value that indicates whether to return container metadata with the listing.\n A non-negative integer value that indicates the maximum number of results to be returned \n in the result segment, up to the per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A result segment of containers.\n \n \n \n Begins an asynchronous request to return a result segment containing a collection of containers.\n \n A continuation token returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to return a result segment containing a collection of containers.\n \n The container name prefix.\n A continuation token returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to return a result segment containing a collection of containers\n whose names begin with the specified prefix.\n \n The container name prefix.\n A value that indicates whether to return container metadata with the listing.\n A non-negative integer value that indicates the maximum number of results to be returned \n in the result segment, up to the per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return a result segment containing a collection of containers.\n \n An that references the pending asynchronous operation.\n A result segment of containers.\n \n \n \n Returns a task that performs an asynchronous request to return a result segment containing a collection of containers.\n \n A continuation token returned by a previous listing operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to return a result segment containing a collection of containers.\n \n A continuation token returned by a previous listing operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to return a result segment containing a collection of containers.\n \n The container name prefix.\n A continuation token returned by a previous listing operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to return a result segment containing a collection of containers.\n \n The container name prefix.\n A continuation token returned by a previous listing operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to return a result segment containing a collection of containers.\n \n The container name prefix.\n A value that indicates whether to return container metadata with the listing.\n A non-negative integer value that indicates the maximum number of results to be returned \n in the result segment, up to the per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to return a result segment containing a collection of containers.\n \n The container name prefix.\n A value that indicates whether to return container metadata with the listing.\n A non-negative integer value that indicates the maximum number of results to be returned \n in the result segment, up to the per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns an enumerable collection of the blobs in the container that are retrieved lazily.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An enumerable collection of objects that implement and are retrieved lazily.\n \n \n \n Returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix, including the container name.\n A returned by a previous listing operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix, including the container name.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A result segment containing objects that implement .\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix, including the container name.\n A returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix, including the container name.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n An that references the pending asynchronous operation.\n A result segment containing objects that implement .\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix, including the container name.\n A returned by a previous listing operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n A returned by a previous listing operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets a reference to a blob from the service.\n \n The URI of the blob. The service assumes this is the URI for the blob in the primary location.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An object of type containing a reference to the blob.\n \n \n \n Gets a reference to a blob from the service.\n \n The URI of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies any additional options for the request.\n An object that represents the context for the current operation.\n An object of type containing a reference to the blob.\n \n \n \n Begins an asynchronous operation to get a reference to a blob from the service.\n \n The URI of the blob. The service assumes this is the URI for the blob in the primary location.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get a reference to a blob from the service.\n \n The URI of the blob. The service assumes this is the URI for the blob in the primary location.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get a reference to a blob from the service.\n \n The URI of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies any additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get a reference to a blob from the service.\n \n An that references the pending asynchronous operation.\n A reference to the blob.\n \n \n \n Returns a task that gets a reference to a blob from the service.\n \n The URI of the blob. The service assumes this is the URI for the blob in the primary location.\n A object that represents the current operation.\n \n \n \n Returns a task that gets a reference to a blob from the service.\n \n The URI of the blob. The service assumes this is the URI for the blob in the primary location.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a object that gets a reference to a blob from the service.\n \n The URI of the blob. The service assumes this is the URI for the blob in the primary location.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that gets a reference to a blob from the service.\n \n The URI of the blob. The service assumes this is the URI for the blob in the primary location.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that gets a reference to a blob from the service.\n \n The URI of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n An object that specifies any additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that gets a reference to a blob from the service.\n \n The URI of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n An object that specifies any additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Core implementation for the ListContainers method.\n \n The container prefix.\n The details included.\n The continuation token.\n A non-negative integer value that indicates the maximum number of results to be returned \n in the result segment, up to the per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A object that specifies additional options for the request.\n A that lists the containers.\n \n \n \n Implements the FetchAttributes method. The attributes are updated immediately.\n \n The URI of the blob.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that fetches the attributes.\n \n \n \n Begins an asynchronous operation to get the properties of the blob service.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get the properties of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get the properties of the blob service.\n \n An that references the pending asynchronous operation.\n The blob service properties.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the blob service.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the blob service.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the properties of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The blob service properties.\n \n \n \n Begins an asynchronous operation to set the properties of the blob service.\n \n The blob service properties.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to set the properties of the blob service.\n \n The blob service properties.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to set the properties of the blob service.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that gets the properties of the blob service.\n \n The blob service properties.\n A object that represents the current operation.\n \n \n \n Returns a task that gets the properties of the blob service.\n \n The blob service properties.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that gets the properties of the blob service.\n \n The blob service properties.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that gets the properties of the blob service.\n \n The blob service properties.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets the properties of the blob service.\n \n The blob service properties.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to get the stats of the blob service.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get the stats of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get the stats of the blob service.\n \n An that references the pending asynchronous operation.\n The blob service stats.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the blob service.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the blob service.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the stats of the blob service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The blob service stats.\n \n \n \n Stores the default delimiter.\n \n \n \n \n Stores the parallelism factor.\n \n \n \n \n Default is 32 MB.\n \n \n \n \n The default server and client timeout interval.\n \n \n \n \n Max execution time across all potential retries.\n \n \n \n \n Initializes a new instance of the class using the specified Blob service endpoint\n and anonymous credentials.\n \n The Blob service endpoint to use to create the client.\n \n \n \n Initializes a new instance of the class using the specified Blob service endpoint\n and account credentials.\n \n The Blob service endpoint to use to create the client.\n The account credentials.\n \n \n \n Initializes a new instance of the class using the specified Blob service endpoint\n and account credentials.\n \n The Blob service endpoint to use to create the client.\n The account credentials.\n \n \n \n Returns a reference to the root container for this service client.\n \n A reference to the root container.\n \n \n \n Returns a reference to a object with the specified name.\n \n The name of the container, or an absolute URI to the container.\n A reference to a container.\n \n \n \n Parses the user prefix.\n \n The prefix.\n Name of the container.\n The listing prefix.\n \n \n \n Gets or sets the authentication scheme to use to sign HTTP requests.\n \n \n \n \n Gets the authentication handler used to sign HTTP requests.\n \n The authentication handler.\n \n \n \n Gets or sets a buffer manager that implements the interface, \n specifying a buffer pool for use with operations against the Blob service client.\n \n \n \n \n Gets the account credentials used to create the Blob service client.\n \n The account credentials.\n \n \n \n Gets the base URI for the Blob service client, at the primary location.\n \n The base URI used to construct the Blob service client, at the primary location.\n \n \n \n Gets the Blob service endpoints for all locations.\n \n An object of type containing Blob service URIs for all locations.\n \n \n \n Gets or sets the default retry policy for requests made via the Blob service client.\n \n The retry policy.\n \n \n \n Gets or sets the default location mode for requests made via the Blob service client.\n \n The location mode.\n \n \n \n Gets or sets the default server and client timeout for requests made via the Blob service client.\n \n The server and client timeout interval.\n \n \n \n Gets or sets the maximum execution time across all potential retries.\n \n The maximum execution time across all potential retries.\n \n \n \n Gets or sets the default delimiter that may be used to create a virtual directory structure of blobs.\n \n The default delimiter.\n \n \n \n Gets or sets the maximum size of a blob in bytes that may be uploaded as a single blob. \n \n The maximum size of a blob, in bytes, that may be uploaded as a single blob,\n ranging from between 1 and 64 MB inclusive.\n \n \n \n Gets or sets the number of blocks that may be simultaneously uploaded when uploading a blob that is greater than \n the value specified by the property in size.\n \n The number of parallel operations that may proceed.\n \n \n \n Gets a value indicating whether the service client is used with Path style or Host style.\n \n Is true if use path style URIs; otherwise, false.\n \n \n \n Represents a container in the Windows Azure Blob service.\n \n Containers hold directories, which are encapsulated as objects, and directories hold block blobs and page blobs. Directories can also contain sub-directories.\n \n Represents a container in the Windows Azure Blob service.\n \n \n \n \n Creates the container.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object\n is used to track requests to the storage service, and to provide additional runtime information about the operation. \n \n \n \n Creates the container and specifies the level of access to the container's data.\n \n An object that specifies whether data in the container may be accessed publicly and what level of access is to be allowed.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object\n is used to track requests to the storage service, and to provide additional runtime information about the operation. \n \n \n \n Begins an asynchronous operation to create a container.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a container.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a container and specify the level of access to the container's data.\n \n An object that specifies whether data in the container may be accessed publicly and what level of access is to be allowed. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to create a container.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that creates a container.\n \n A object that represents the current operation.\n \n \n \n Returns a task that creates a container.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that creates a container.\n \n An object that specifies whether data in the container may be accessed publicly and what level of access is to be allowed.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that creates a container and specifies the level of access to the container's data.\n \n An object that specifies whether data in the container may be accessed publicly and what level of access is to be allowed. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Creates the container if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the container did not already exist and was created; otherwise false.\n \n \n \n Creates the container if it does not already exist and specifies whether the container or its blobs are publicly accessible.\n \n An object that specifies whether data in the container may be accessed publicly and what level of access is to be allowed. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the container did not already exist and was created; otherwise false.\n \n \n \n Begins an asynchronous request to create the container if it does not already exist.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to create the container if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to create the container if it does not already exist.\n \n An object that specifies whether data in the container may be accessed publicly and the level of access.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to create the container if it does not already exist.\n \n An that references the pending asynchronous operation.\n true if the container did not already exist and was created; otherwise, false.\n \n \n \n Returns a task that creates the container if it does not already exist.\n \n A object that represents the current operation.\n \n \n \n Returns a task that creates the container if it does not already exist.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that creates the container if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that creates the container if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that creates the container if it does not already exist.\n \n An object that specifies whether data in the container may be accessed publicly and the level of access.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that creates the container if it does not already exist.\n \n An object that specifies whether data in the container may be accessed publicly and the level of access.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the container.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to delete a container.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete a container.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete a container.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that deletes the container.\n \n A object that represents the current operation.\n \n \n \n Returns a task that deletes the container.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that deletes the container.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that deletes the container.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the container if it already exists.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the container did not already exist and was created; otherwise false.\n \n \n \n Begins an asynchronous request to delete the container if it already exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to delete the container if it already exists.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to delete the container if it already exists.\n \n An that references the pending asynchronous operation.\n true if the container did not already exist and was created; otherwise, false.\n \n \n \n Returns a task that deletes the container if it already exists.\n \n A object that represents the current operation.\n \n \n \n Returns a task that deletes the container if it already exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that deletes the container if it already exists.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that deletes the container if it already exists.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets a reference to a blob in this container.\n \n The name of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A reference to the blob.\n \n \n \n Begins an asynchronous operation to get a reference to a blob in this container.\n \n The name of the blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get a reference to a blob in this container.\n \n The name of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get a reference to a blob in this container.\n \n An that references the pending asynchronous operation.\n A reference to the blob.\n \n \n \n Returns a task that gets a reference to a blob in this container.\n \n The name of the blob.\n A object that represents the current operation.\n \n \n \n Returns a task that gets a reference to a blob in this container.\n \n The name of the blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that gets a reference to a blob in this container.\n \n The name of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that gets a reference to a blob in this container.\n \n The name of the blob.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns an enumerable collection of the blobs in the container that are retrieved lazily.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An enumerable collection of objects that implement and are retrieved lazily.\n \n \n \n Returns a result segment containing a collection of blob items \n in the container.\n \n A continuation token returned by a previous listing operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n A continuation token returned by a previous listing operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A result segment containing objects that implement .\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n A continuation token returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n A continuation token returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return a result segment containing a collection of blob items \n in the container.\n \n An that references the pending asynchronous operation.\n A result segment containing objects that implement .\n \n \n \n Returns a task that returns a result segment containing a collection of blob items \n in the container.\n \n A continuation token returned by a previous listing operation.\n \n \n \n Returns a task that returns a result segment containing a collection of blob items \n in the container.\n \n A continuation token returned by a previous listing operation.\n A to observe while waiting for a task to complete.\n \n \n \n Returns a task that returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n A continuation token returned by a previous listing operation.\n \n \n \n Returns a task that returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n A continuation token returned by a previous listing operation.\n A to observe while waiting for a task to complete.\n \n \n \n Returns a task that returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that returns a result segment containing a collection of blob items \n in the container.\n \n The blob name prefix.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets permissions for the container.\n \n The permissions to apply to the container.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous request to set permissions for the container.\n \n The permissions to apply to the container.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to set permissions for the container.\n \n The permissions to apply to the container.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to set permissions for the container.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that sets permissions for the container.\n \n The permissions to apply to the container.\n A object that represents the current operation.\n \n \n \n Returns a task that sets permissions for the container.\n \n The permissions to apply to the container.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that sets permissions for the container.\n \n The permissions to apply to the container.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that sets permissions for the container.\n \n The permissions to apply to the container.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the permissions settings for the container.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The container's permissions.\n \n \n \n Begins an asynchronous request to get the permissions settings for the container.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to get the permissions settings for the container.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to get the permissions settings for the container.\n \n An that references the pending asynchronous operation.\n The container's permissions.\n \n \n \n Returns a task that gets the permissions settings for the container.\n \n A object that represents the current operation.\n \n \n \n Returns a task that gets the permissions settings for the container.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that gets the permissions settings for the container.\n \n An object that represents the access conditions for the container. If null, no condition is used. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that gets the permissions settings for the container.\n \n An object that represents the access conditions for the container. If null, no condition is used. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Checks whether the container exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the container exists.\n \n \n \n Checks whether the container exists.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the container exists.\n \n \n \n Begins an asynchronous request to check whether the container exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check whether the container exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check whether the container exists.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to check whether the container exists.\n \n An that references the pending asynchronous operation.\n true if the container exists.\n \n \n \n Returns a task that checks whether the container exists.\n \n A object that represents the current operation.\n \n \n \n Returns a task that checks whether the container exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that checks whether the container exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that checks whether the container exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Retrieves the container's attributes.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to retrieve the container's attributes.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to retrieve the container's attributes.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to retrieve the container's attributes.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that retrieves the container's attributes.\n \n A object that represents the current operation.\n \n \n \n Returns a task that retrieves the container's attributes.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that retrieves the container's attributes.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that retrieves the container's attributes.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets the container's user-defined metadata.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to set user-defined metadata on the container.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to set user-defined metadata on the container.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous request operation to set user-defined metadata on the container.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that sets container's user-defined metadata.\n \n A object that represents the current operation.\n \n \n \n Returns a task that sets container's user-defined metadata.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that sets container's user-defined metadata.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that sets container's user-defined metadata.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Acquires a lease on this container.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n The ID of the acquired lease.\n \n \n \n Begins an asynchronous operation to acquire a lease on this container.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to acquire a lease on this container.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to acquire a lease on this container.\n \n An IAsyncResult that references the pending asynchronous operation.\n The ID of the acquired lease.\n \n \n \n Returns a task that acquires a lease on this container.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n A object that represents the current operation.\n \n \n \n Returns a task that acquires a lease on this container.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that acquires a lease on this container.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that acquires a lease on this container.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Renews a lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to renew a lease on this container.\n \n An IAsyncResult that references the pending asynchronous operation.\n \n \n \n Returns a task that renews a lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that renews a lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that renews a lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that renews a lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Changes the lease ID on this container.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the container, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n The new lease ID.\n \n \n \n Begins an asynchronous operation to change the lease on this container.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the container, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to change the lease on this container.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the container, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to change the lease on this container.\n \n An IAsyncResult that references the pending asynchronous operation.\n The new lease ID.\n \n \n \n Returns a task that changes the lease ID on this container.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the container, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that changes the lease ID on this container.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the container, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that changes the lease ID on this container.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the container, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that changes the lease ID on this container.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the container, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Releases the lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to release the lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to release the lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to release the lease on this container.\n \n An IAsyncResult that references the pending asynchronous operation.\n \n \n \n Returns a task that releases the lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that releases the lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that releases the lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that releases the lease on this container.\n \n An object that represents the access conditions for the container, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Breaks the current lease on this container.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Begins an asynchronous operation to break the current lease on this container.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to break the current lease on this container.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to break the current lease on this container.\n \n An IAsyncResult that references the pending asynchronous operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Returns a task that breaks the current lease on this container.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n A object that represents the current operation.\n \n \n \n Returns a task that breaks the current lease on this container.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that breaks the current lease on this container.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that breaks the current lease on this container.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Generates a RESTCommand for acquiring a lease.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation. This parameter must not be null.\n A RESTCommand implementing the acquire lease operation.\n \n \n \n Generates a RESTCommand for renewing a lease.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation, including the current lease ID.\n This cannot be null.\n A RESTCommand implementing the renew lease operation.\n \n \n \n Generates a RESTCommand for changing a lease ID.\n \n The proposed new lease ID.\n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation, including the current lease ID. This cannot be null.\n A RESTCommand implementing the change lease ID operation.\n \n \n \n Generates a RESTCommand for releasing a lease.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation, including the current lease ID.\n This cannot be null.\n A RESTCommand implementing the release lease operation.\n \n \n \n Generates a RESTCommand for breaking a lease.\n \n The amount of time to allow the lease to remain, rounded down to seconds.\n If null, the break period is the remainder of the current lease, or zero for infinite leases.\n An object that represents the access conditions for the container. If null, no condition is used.\n The options for this operation. Cannot be null.\n A RESTCommand implementing the break lease operation.\n \n \n \n Implementation for the Create method.\n \n A object that specifies additional options for the request.\n An object that specifies whether data in the container may be accessed publicly and the level of access. \n A that creates the container.\n \n \n \n Implementation for the Delete method.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n A that deletes the container.\n \n \n \n Implementation for the FetchAttributes method.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n A that fetches the attributes.\n \n \n \n Implementation for the Exists method.\n \n A object that specifies additional options for the request.\n If true, the command will be executed against the primary location.\n A that checks existence.\n \n \n \n Implementation for the SetMetadata method.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n A that sets the metadata.\n \n \n \n Implementation for the SetPermissions method.\n \n The permissions to set.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n A that sets the permissions.\n \n \n \n Implementation for the GetPermissions method.\n \n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n A that gets the permissions.\n \n \n \n Selects the protocol response.\n \n The protocol item.\n The parsed .\n \n \n \n Core implementation of the ListBlobs method.\n \n The blob prefix.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A object that specifies additional options for the request.\n A continuation token returned by a previous listing operation.\n A that lists the blobs.\n \n \n \n Retrieve ETag and LastModified date time from response.\n \n The response to parse.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the container.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the container.\n The account credentials.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the container.\n The account credentials.\n \n \n \n Initializes a new instance of the class.\n \n The container name.\n A client object that specifies the endpoint for the Blob service.\n \n \n \n Initializes a new instance of the class.\n \n The properties.\n The metadata.\n The container name.\n The client to be used.\n \n \n \n Parse URI for SAS (Shared Access Signature) information.\n \n The complete Uri.\n The credentials to use.\n \n \n \n Returns the canonical name for shared access.\n \n The canonical name.\n \n \n \n Returns a shared access signature for the container.\n \n The access policy for the shared access signature.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Returns a shared access signature for the container.\n \n The access policy for the shared access signature.\n A container-level access policy.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Gets a reference to a page blob in this container.\n \n The name of the blob.\n A reference to a page blob.\n \n \n \n Returns a reference to a page blob in this virtual directory.\n \n The name of the page blob.\n The snapshot timestamp, if the blob is a snapshot.\n A reference to a page blob.\n \n \n \n Gets a reference to a block blob in this container.\n \n The name of the blob.\n A reference to a block blob.\n \n \n \n Gets a reference to a block blob in this container.\n \n The name of the blob.\n The snapshot timestamp, if the blob is a snapshot.\n A reference to a block blob.\n \n \n \n Gets a reference to a virtual blob directory beneath this container.\n \n The name of the virtual blob directory.\n A reference to a virtual blob directory.\n \n \n \n Gets the service client for the container.\n \n A client object that specifies the endpoint for the Blob service.\n \n \n \n Gets the container's URI for the primary location.\n \n The absolute URI to the container, at the primary location.\n \n \n \n Gets the container's URIs for all locations.\n \n An object of type containing the container's URIs for all locations.\n \n \n \n Gets the name of the container.\n \n The container's name.\n \n \n \n Gets the container's metadata.\n \n The container's metadata.\n \n \n \n Gets the container's system properties.\n \n The container's properties.\n \n \n \n Represents a virtual directory of blobs, designated by a delimiter character.\n \n Containers, which are encapsulated as objects, hold directories, and directories hold block blobs and page blobs. Directories can also contain sub-directories.\n \n Represents a virtual directory of blobs on the client which emulates a hierarchical data store by using delimiter characters.\n \n Containers, which are encapsulated as objects, hold directories, and directories hold block blobs and page blobs. Directories can also contain sub-directories.\n \n \n \n Represents an item that may be returned by a blob listing operation.\n \n \n \n \n Gets the URI to the blob item, at the primary location.\n \n The blob item's URI.\n \n \n \n Gets the blob item's URIs for all locations.\n \n An object of type containing the blob item's URIs for all locations.\n \n \n \n Gets the blob item's parent virtual directory.\n \n The blob item's parent virtual directory.\n \n \n \n Gets the blob item's container.\n \n The blob item's container.\n \n \n \n Returns an enumerable collection of the blobs in the virtual directory that are retrieved lazily.\n \n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An enumerable collection of objects that implement and are retrieved lazily.\n \n \n \n Returns a result segment containing a collection of blob items \n in the virtual directory.\n \n A continuation token returned by a previous listing operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of blob items \n in the virtual directory.\n \n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A result segment containing objects that implement .\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of blob items \n in the virtual directory.\n \n A continuation token returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of blob items \n in the virtual directory.\n \n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return a result segment containing a collection of blob items \n in the virtual directory.\n \n An that references the pending asynchronous operation.\n A result segment containing objects that implement .\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the virtual directory.\n \n A continuation token returned by a previous listing operation. \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the virtual directory.\n \n A continuation token returned by a previous listing operation. \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the virtual directory.\n \n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of blob items \n in the virtual directory.\n \n Specifies whether to list blobs in a flat listing, or whether to list blobs hierarchically, by virtual directory.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A continuation token returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Stores the parent directory.\n \n \n \n \n Initializes a new instance of the class given an address and a client.\n \n The blob directory's Uri.\n The blob directory's prefix. \n The container for the virtual directory.\n \n \n \n Gets a reference to a page blob in this virtual directory.\n \n The name of the blob.\n A reference to a page blob.\n \n \n \n Returns a reference to a page blob in this virtual directory.\n \n The name of the page blob.\n The snapshot timestamp, if the blob is a snapshot.\n A reference to a page blob.\n \n \n \n Gets a reference to a block blob in this virtual directory.\n \n The name of the blob.\n A reference to a block blob.\n \n \n \n Gets a reference to a block blob in this virtual directory.\n \n The name of the blob.\n The snapshot timestamp, if the blob is a snapshot.\n A reference to a block blob.\n \n \n \n Returns a virtual subdirectory within this virtual directory.\n \n The name of the virtual subdirectory.\n A object representing the virtual subdirectory.\n \n \n \n Gets the service client for the virtual directory.\n \n A client object that specifies the endpoint for the Windows Azure Blob service.\n \n \n \n Gets the URI that identifies the virtual directory for the primary location.\n \n The URI to the virtual directory, at the primary location.\n \n \n \n Gets the blob directory's URIs for all locations.\n \n An object of type containing the blob directory's URIs for all locations.\n \n \n \n Gets the container for the virtual directory.\n \n The container for the virtual directory.\n \n \n \n Gets the parent directory for the virtual directory.\n \n The virtual directory's parent directory.\n \n \n \n Gets the prefix.\n \n The prefix.\n \n \n \n Called when the asynchronous operation to commit the blob started by UploadFromStream finishes.\n \n The result of the asynchronous operation.\n \n \n \n Implements getting the stream without specifying a range.\n \n The blob.\n The attributes.\n The destination stream.\n The offset.\n The length.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A that gets the stream.\n \n \n \n \n Implements the FetchAttributes method. The attributes are updated immediately.\n \n The blob.\n The attributes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A that fetches the attributes.\n \n \n \n \n Implementation for the Exists method.\n \n The blob.\n The attributes.\n An object that specifies additional options for the request.\n If true, the command will be executed against the primary location.\n \n A that checks existence.\n \n \n \n \n Implementation for the SetMetadata method.\n \n The blob.\n The attributes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A that sets the metadata.\n \n \n \n \n Implementation for the SetProperties method.\n \n The blob.\n The attributes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A that sets the properties.\n \n \n \n \n Implements the DeleteBlob method.\n \n The blob.\n The attributes.\n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A that deletes the blob.\n \n \n \n \n Generates a for acquiring a lease.\n \n The blob.\n The attributes.\n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A implementing the acquire lease operation.\n \n \n \n \n Generates a for renewing a lease.\n \n The blob.\n The attributes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A implementing the renew lease operation.\n \n accessCondition\n \n \n \n Generates a for changing a lease ID.\n \n The blob.\n The attributes.\n The proposed new lease ID.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A implementing the change lease ID operation.\n \n accessCondition\n \n \n \n Generates a for releasing a lease.\n \n The blob.\n The attributes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A implementing the release lease operation.\n \n accessCondition\n \n \n \n Generates a for breaking a lease.\n \n The blob.\n The attributes.\n The amount of time to allow the lease to remain, rounded down to seconds.\n If null, the break period is the remainder of the current lease, or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A implementing the break lease operation.\n \n \n \n \n Implementation of the StartCopyFromBlob method. Result is a BlobAttributes object derived from the response headers.\n \n The blob.\n The attributes.\n The URI of the source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A that starts to copy the blob.\n \n sourceAccessCondition\n \n \n \n Implementation of the AbortCopy method. No result is produced.\n \n The blob.\n The attributes.\n The copy ID of the copy operation to abort.\n An object that represents the access conditions for the operation. If null, no condition is used.\n An object that specifies additional options for the request.\n \n A that aborts the copy.\n \n \n \n \n Updates this blob with the given attributes at the end of a fetch attributes operation.\n \n The new attributes.\n The response.\n if set to true, blob's MD5 will not be updated.\n \n \n \n \n Retrieve ETag, LMT, and Sequence-Number from response.\n \n The attributes.\n The response to parse.\n \n \n \n Converts the source blob of a copy operation to an appropriate access URI, taking Shared Access Signature credentials into account.\n \n The source blob.\n A URI addressing the source blob, using SAS if appropriate.\n \n \n \n Represents a blob that is uploaded as a set of blocks.\n \n \n Represents a blob that is uploaded as a set of blocks.\n \n \n \n \n An interface required for Windows Azure blob types. The and classes implement the interface.\n \n \n An interface required for Windows Azure blob types. The and classes implement the interface.\n \n \n \n \n Opens a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A stream to be used for reading from the blob.\n On the object returned by this method, the method must be called exactly once for every call. Failing to end a read process before beginning another read can cause unknown behavior.\n \n \n \n Begins an asynchronous operation to open a stream for reading from the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to open a stream for reading from the blob.\n \n An that references the pending asynchronous operation.\n A stream to be used for reading from the blob.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a stream to the Windows Azure Blob Service. \n \n The stream providing the blob content. Use a seek-able stream for optimal performance.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Uploads a stream to the Windows Azure Blob Service. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a blob.\n \n The stream providing the blob content.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation. \n \n \n \n Begins an asynchronous operation to upload a stream to a blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a block blob.\n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a stream to a blob. \n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a blob.\n \n The stream providing the blob content.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a blob.\n \n The stream providing the blob content.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob.\n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob.\n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Uploads a file to the Windows Azure Blob Service. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation. \n \n \n \n Begins an asynchronous operation to upload a file to a blob. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a file to a blob. \n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Uploads the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload the contents of a byte array to a blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Downloads the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a stream.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Downloads the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a file.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Downloads the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The total number of bytes read into the buffer.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a byte array.\n \n An that references the pending asynchronous operation.\n The total number of bytes read into the buffer.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Downloads a range of bytes from a blob to a stream.\n \n The target stream.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download a range of bytes from a blob to a stream.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Downloads a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The total number of bytes read into the buffer.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n An that references the pending asynchronous operation.\n The total number of bytes read into the buffer.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data range, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Checks existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob exists.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to check existence of the blob.\n \n An that references the pending asynchronous operation.\n true if the blob exists.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Populates a blob's properties and metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to populate the blob's properties and metadata.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to populate the blob's properties and metadata.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Updates the blob's metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to update the blob's metadata.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to update the blob's metadata.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Updates the blob's properties.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to update the blob's properties.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to update the blob's properties.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Deletes the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to delete the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete the blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Deletes the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob did not already exist and was created; otherwise false.\n \n \n \n Begins an asynchronous request to delete the blob if it already exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to delete the blob if it already exists.\n \n An that references the pending asynchronous operation.\n true if the blob did not already exist and was created; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Acquires a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds.\n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The ID of the acquired lease.\n \n \n \n Begins an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds.\n A string representing the proposed lease ID for the new lease.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds.\n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to acquire a lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n The ID of the acquired lease.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds.\n A string representing the proposed lease ID for the new lease.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds.\n A string representing the proposed lease ID for the new lease.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds.\n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds.\n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Renews a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to renew a lease on this blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Changes the lease ID on this blob.\n \n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The new lease ID.\n \n \n \n Begins an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to change the lease on this blob.\n \n An that references the pending asynchronous operation.\n The new lease ID.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Releases the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to release the lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Breaks the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Begins an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to break the current lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Requests that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob.\n An object that represents the access conditions for the destination blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The copy ID associated with the copy operation. \n \n \n \n Begins an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob.\n An object that represents the access conditions for the destination blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n An that references the pending asynchronous operation.\n The copy ID associated with the copy operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob.\n An object that represents the access conditions for the destination blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob.\n An object that represents the access conditions for the destination blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Aborts an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to abort an ongoing blob copy operation.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation. \n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation. \n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n A container-level access policy.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n The optional header values to set for a blob accessed with this SAS.\n A shared access signature.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n The optional header values to set for a blob returned with this SAS.\n A stored access policy.\n A shared access signature.\n \n \n \n Gets the blob item's name.\n \n The blob item's name.\n \n \n \n Gets the object that represents the Blob service.\n \n A client object that specifies the Blob service endpoint.\n \n \n \n Gets or sets the number of bytes to buffer when writing to a page blob stream or\n the block size for writing to a block blob.\n \n The number of bytes to buffer or the size of a block, in bytes.\n \n \n \n Gets or sets the minimum number of bytes to buffer when reading from a blob stream.\n \n The minimum number of bytes to buffer.\n \n \n \n Gets the blob's system properties.\n \n The blob's properties.\n \n \n \n Gets the user-defined metadata for the blob.\n \n The blob's metadata, as a collection of name-value pairs.\n \n \n \n Gets the date and time that the blob snapshot was taken, if this blob is a snapshot.\n \n The blob's snapshot time if the blob is a snapshot; otherwise, null.\n \n If the blob is not a snapshot, the value of this property is null.\n \n \n \n \n Gets a value indicating whether this blob is a snapshot.\n \n true if this blob is a snapshot; otherwise, false.\n \n \n \n Gets the absolute URI to the blob, including query string information if the blob is a snapshot, at the primary location.\n \n The absolute URI to the blob, including snapshot query information if the blob is a snapshot, at the primary location.\n \n \n \n Gets the blob's URI for all locations, including query string information if the blob is a snapshot.\n \n An object of type containing the blob's URIs for all locations, \n including snapshot query information if the blob is a snapshot.\n \n \n \n Gets the state of the most recent or pending copy operation.\n \n A object containing the copy state, or null if no copy blob state exists for this blob.\n \n \n \n Gets the type of the blob.\n \n The type of the blob.\n \n \n \n Opens a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A stream to be used for reading from the blob.\n On the object returned by this method, the method must be called exactly once for every call. Failing to end a read process before beginning another read can cause unknown behavior.\n \n \n \n Begins an asynchronous operation to open a stream for reading from the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to open a stream for reading from the blob.\n \n An that references the pending asynchronous operation.\n A stream to be used for reading from the blob.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Opens a stream for writing to the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A stream to be used for writing to the blob.\n \n \n \n Begins an asynchronous operation to open a stream for writing to the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to open a stream for writing to the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to open a stream for writing to the blob.\n \n An that references the pending asynchronous operation.\n A stream to be used for writing to the blob.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a stream to a block blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Uploads a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Uploads a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a block blob.\n \n The stream providing the blob content.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a block blob.\n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a stream to a block blob. \n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a block blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a file to the Blob service. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation. \n \n \n \n Begins an asynchronous operation to upload a file to a blob. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Called when the asynchronous UploadFromStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a file to a blob. \n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload the contents of a byte array to a blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a string of text to a blob. \n \n The text to upload.\n An object that indicates the text encoding to use. If null, UTF-8 will be used.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a string of text to a blob. \n \n The text to upload.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a string of text to a blob. \n \n The text to upload.\n An object that indicates the text encoding to use. If null, UTF-8 will be used.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a string of text to a blob. \n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a string of text to a blob.\n \n The text to upload.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a string of text to a blob.\n \n The text to upload.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a string of text to a blob.\n \n The text to upload.\n An object that indicates the text encoding to use. If null, UTF-8 will be used.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a string of text to a blob.\n \n The text to upload.\n An object that indicates the text encoding to use. If null, UTF-8 will be used.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a stream.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Called when the asynchronous DownloadToStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a file.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The total number of bytes read into the buffer.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a byte array.\n \n An that references the pending asynchronous operation.\n The total number of bytes read into the buffer.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads the blob's contents as a string.\n \n An object that indicates the text encoding to use.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The contents of the blob, as a string.\n \n \n \n Begins an asynchronous operation to download the blob's contents as a string.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the blob's contents as a string.\n \n An object that indicates the text encoding to use.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Called when the asynchronous DownloadToStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the blob's contents as a string.\n \n An that references the pending asynchronous operation.\n The contents of the blob, as a string.\n \n \n \n Returns a task that performs an asynchronous operation to download the blob's contents as a string.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the blob's contents as a string.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the blob's contents as a string.\n \n An object that indicates the text encoding to use.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the blob's contents as a string.\n \n An object that indicates the text encoding to use.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download a range of bytes from a blob to a stream.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The total number of bytes read into the buffer.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Called when the asynchronous DownloadRangeToStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n An that references the pending asynchronous operation.\n The total number of bytes read into the buffer.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Checks existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob exists.\n \n \n \n Checks existence of the blob.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob exists.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to check existence of the blob.\n \n An that references the pending asynchronous operation.\n true if the blob exists.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Populates a blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to populate the blob's properties and metadata.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to populate the blob's properties and metadata.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Updates the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to update the blob's metadata.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to update the blob's metadata.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Updates the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to update the blob's properties.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to update the blob's properties.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to delete the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete the blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob did already exist and was deleted; otherwise false.\n \n \n \n Begins an asynchronous request to delete the blob if it already exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to delete the blob if it already exists.\n \n An that references the pending asynchronous operation.\n true if the blob did already exist and was deleted; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Creates a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request, or null.\n An object that represents the context for the current operation.\n A blob snapshot.\n \n \n \n Begins an asynchronous operation to create a snapshot of the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request, or null.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to create a snapshot of the blob.\n \n An that references the pending asynchronous operation.\n A blob snapshot.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Acquires a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n The ID of the acquired lease.\n \n \n \n Begins an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to acquire a lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n The ID of the acquired lease.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Renews a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to renew a lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Changes the lease ID on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n The new lease ID.\n \n \n \n Begins an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to change the lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n The new lease ID.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Releases the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to release the lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Breaks the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Begins an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to break the current lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a single block.\n \n A base64-encoded block ID that identifies the block.\n A stream that provides the data for the block.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a single block.\n \n A base64-encoded block ID that identifies the block.\n A stream that provides the data for the block.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a single block.\n \n A base64-encoded block ID that identifies the block.\n A stream that provides the data for the block.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a single block.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a single block.\n \n A base64-encoded block ID that identifies the block.\n A stream that provides the data for the block.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a single block.\n \n A base64-encoded block ID that identifies the block.\n A stream that provides the data for the block.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a single block.\n \n A base64-encoded block ID that identifies the block.\n A stream that provides the data for the block.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a single block.\n \n A base64-encoded block ID that identifies the block.\n A stream that provides the data for the block.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a list of blocks to a new or existing blob. \n \n An enumerable collection of block IDs, as base64-encoded strings.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a list of blocks to a new or existing blob. \n \n An enumerable collection of block IDs, as base64-encoded strings.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a list of blocks to a new or existing blob. \n \n An enumerable collection of block IDs, as base64-encoded strings.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a list of blocks to a new or existing blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a list of blocks to a new or existing blob. \n \n An enumerable collection of block IDs, as base64-encoded strings.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a list of blocks to a new or existing blob. \n \n An enumerable collection of block IDs, as base64-encoded strings.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a list of blocks to a new or existing blob. \n \n An enumerable collection of block IDs, as base64-encoded strings.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a list of blocks to a new or existing blob. \n \n An enumerable collection of block IDs, as base64-encoded strings.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns an enumerable collection of the blob's blocks, using the specified block list filter.\n \n One of the enumeration values that indicates whether to return \n committed blocks, uncommitted blocks, or both.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An enumerable collection of objects implementing .\n \n \n \n Begins an asynchronous operation to return an enumerable collection of the blob's blocks, \n using the specified block list filter.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return an enumerable collection of the blob's blocks, \n using the specified block list filter.\n \n One of the enumeration values that indicates whether to return \n committed blocks, uncommitted blocks, or both.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return an enumerable collection of the blob's blocks, \n using the specified block list filter.\n \n An that references the pending asynchronous operation.\n An enumerable collection of objects implementing .\n \n \n \n Returns a task that performs an asynchronous operation to return an enumerable collection of the blob's blocks, \n using the specified block list filter.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return an enumerable collection of the blob's blocks, \n using the specified block list filter.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return an enumerable collection of the blob's blocks, \n using the specified block list filter.\n \n One of the enumeration values that indicates whether to return \n committed blocks, uncommitted blocks, or both.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return an enumerable collection of the blob's blocks, \n using the specified block list filter.\n \n One of the enumeration values that indicates whether to return \n committed blocks, uncommitted blocks, or both.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Requests that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The copy ID associated with the copy operation.\n \n This method fetches the blob's ETag, last modified time, and part of the copy state.\n The copy ID and copy status fields are fetched, and the rest of the copy state is cleared.\n \n \n \n \n Requests that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The copy ID associated with the copy operation.\n \n This method fetches the blob's ETag, last modified time, and part of the copy state.\n The copy ID and copy status fields are fetched, and the rest of the copy state is cleared.\n \n \n \n \n Begins an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The source blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation. \n \n \n \n Ends an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n An that references the pending asynchronous operation.\n The copy ID associated with the copy operation.\n \n This method fetches the blob's ETag, last modified time, and part of the copy state.\n The copy ID and copy status fields are fetched, and the rest of the copy state is cleared.\n \n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Aborts an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to abort an ongoing blob copy operation.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Implementation for the CreateSnapshot method.\n \n A collection of name-value pairs defining the metadata of the snapshot, or null.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that creates the snapshot.\n If the metadata parameter is null then no metadata is associated with the request.\n \n \n \n Uploads the full blob from a seekable stream.\n \n The content stream. Must be seekable.\n Number of bytes to upload from the content stream starting at its current position.\n The content MD5.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that gets the stream.\n \n \n \n Uploads the block.\n \n The source stream.\n The block ID.\n The content MD5.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that uploads the block.\n \n \n \n Uploads the block list.\n \n The blocks to upload.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that uploads the block list.\n \n \n \n Gets the download block list.\n \n The types of blocks.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that gets the download block list.\n \n \n \n Default is 4 MB.\n \n \n \n \n Default is 4 MB.\n \n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob.\n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob.\n The account credentials.\n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob.\n The snapshot timestamp, if the blob is a snapshot.\n The account credentials.\n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob.\n The snapshot timestamp, if the blob is a snapshot.\n The account credentials.\n \n \n \n Initializes a new instance of the class using the specified blob name and\n the parent container reference.\n If snapshotTime is not null, the blob instance represents a Snapshot.\n \n Name of the blob.\n Snapshot time in case the blob is a snapshot.\n The reference to the parent container.\n \n \n \n Initializes a new instance of the class.\n \n The attributes.\n The service client.\n \n \n \n Stores the that contains this blob.\n \n \n \n \n Stores the blob's parent .\n \n \n \n \n Stores the blob's attributes.\n \n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n A stored access policy.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n The optional header values to set for a blob accessed with this SAS.\n A shared access signature.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n The optional header values to set for a blob returned with this SAS.\n A stored access policy.\n A shared access signature.\n \n \n \n Gets the canonical name of the blob, formatted as /<account-name>/<container-name>/<blob-name>.\n If ignoreSnapshotTime is false and this blob is a snapshot, the canonical name is augmented with a\n query of the form ?snapshot=<snapshot-time>.\n This is used by both Shared Access and Copy blob operations.\n \n Indicates if the snapshot time is ignored.\n The canonical name of the blob.\n \n \n \n Parse URI for SAS (Shared Access Signature) and snapshot information.\n \n The complete Uri.\n The credentials to use.\n \n \n \n Gets the object that represents the Blob service.\n \n A client object that specifies the Blob service endpoint.\n \n \n \n Gets or sets the block size for writing to a block blob.\n \n The size of a block, in bytes, ranging from between 16 KB and 4 MB inclusive.\n \n \n \n Gets or sets the minimum number of bytes to buffer when reading from a blob stream.\n \n The minimum number of bytes to buffer, being at least 16KB.\n \n \n \n Gets the blob's system properties.\n \n The blob's properties.\n \n \n \n Gets the user-defined metadata for the blob.\n \n The blob's metadata, as a collection of name-value pairs.\n \n \n \n Gets the blob's URI for the primary location.\n \n The absolute URI to the blob, at the primary location.\n \n \n \n Gets the block blob's URIs for all locations.\n \n An object of type containing the block blob's URIs for all locations.\n \n \n \n Gets the date and time that the blob snapshot was taken, if this blob is a snapshot.\n \n The blob's snapshot time, if the blob is a snapshot. If the blob is not a snapshot, the value of this property is null.\n \n \n \n Gets a value indicating whether this blob is a snapshot.\n \n true if this blob is a snapshot; otherwise, false.\n \n \n \n Gets the absolute URI to the blob, including query string information if the blob is a snapshot.\n \n The absolute URI to the blob, including snapshot query information if the blob is a snapshot.\n \n \n \n Gets the block blob's URI for all locations, including query string information if the blob is a snapshot.\n \n An object of type containing the block blob's URIs for all locations, \n including snapshot query information if the blob is a snapshot.\n \n \n \n Gets the state of the most recent or pending copy operation.\n \n A object containing the copy state, or null if no copy blob state exists for this blob.\n \n \n \n Gets the type of the blob.\n \n The type of the blob.\n \n \n \n Gets the blob's name.\n \n The blob's name.\n \n \n \n Gets a object representing the blob's container.\n \n The blob's container.\n \n \n \n Gets the object representing the\n virtual parent directory for the blob.\n \n The blob's virtual parent directory.\n \n \n \n Represents a Windows Azure page blob.\n \n \n Represents a Windows Azure page blob.\n \n \n \n \n Opens a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A stream to be used for reading from the blob.\n On the object returned by this method, the method must be called exactly once for every call. Failing to end a read process before beginning another read can cause unknown behavior.\n \n \n \n Begins an asynchronous operation to open a stream for reading from the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to open a stream for reading from the blob.\n \n An that references the pending asynchronous operation.\n A stream to be used for reading from the blob.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for reading from the blob.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Opens a stream for writing to the blob.\n \n The size of the page blob, in bytes. The size must be a multiple of 512. If null, the page blob must already exist.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A stream to be used for writing to the blob.\n \n \n \n Begins an asynchronous operation to open a stream for writing to the blob.\n \n The size of the page blob, in bytes. The size must be a multiple of 512. If null, the page blob must already exist.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to open a stream for writing to the blob.\n \n The size of the page blob, in bytes. The size must be a multiple of 512. If null, the page blob must already exist.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to open a stream for writing to the blob.\n \n An that references the pending asynchronous operation.\n A stream to be used for writing to the blob.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n The size of the page blob, in bytes. The size must be a multiple of 512. If null, the page blob must already exist.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n The size of the page blob, in bytes. The size must be a multiple of 512. If null, the page blob must already exist.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n The size of the page blob, in bytes. The size must be a multiple of 512. If null, the page blob must already exist.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to open a stream for writing to the blob.\n \n The size of the page blob, in bytes. The size must be a multiple of 512. If null, the page blob must already exist.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a stream.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a stream.\n \n The target stream.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Called when the asynchronous DownloadToStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a file.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a file.\n \n The target file.\n A constant that determines how to open or create the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The total number of bytes read into the buffer.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download the contents of a blob to a byte array.\n \n An that references the pending asynchronous operation.\n The total number of bytes read into the buffer.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download the contents of a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download a range of bytes from a blob to a stream.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a stream.\n \n The target stream.\n The offset at which to begin downloading the blob, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Downloads a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The total number of bytes read into the buffer.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Called when the asynchronous DownloadRangeToStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n An that references the pending asynchronous operation.\n The total number of bytes read into the buffer.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to download a range of bytes from a blob to a byte array.\n \n The target byte array.\n The starting offset in the byte array.\n The starting offset of the data range, in bytes.\n The length of the data to download from the blob, in bytes.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a stream to a page blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Uploads a stream to a page blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Uploads a stream to a page blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a page blob.\n \n The stream providing the blob content.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a page blob.\n \n The stream providing the blob content.\n Specifies the number of bytes from the Stream source to upload from the start position.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n Specifies the number of bytes from the Stream source to upload from the start position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n Specifies the number of bytes from the Stream source to upload from the start position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a stream to a page blob. \n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a stream to a page blob. \n \n The stream providing the blob content.\n The number of bytes to write from the source stream at its current position.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads a file to the Windows Azure Blob Service. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation. \n \n \n \n Begins an asynchronous operation to upload a file to a blob. \n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Called when the asynchronous UploadFromStream operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload a file to a blob. \n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload a file to a blob.\n \n The file providing the blob content.\n A constant that determines how to open the file.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Uploads the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to upload the contents of a byte array to a blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to upload the contents of a byte array to a blob.\n \n An array of bytes.\n The zero-based byte offset in buffer at which to begin uploading bytes to the blob.\n The number of bytes to be written to the blob.\n An object that represents the access conditions for the blob.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Creates a page blob.\n \n The maximum size of the page blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to create a page blob.\n \n The maximum size of the page blob, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a page blob.\n \n The maximum size of the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to create a page blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a page blob.\n \n The maximum size of the blob, in bytes.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a page blob.\n \n The maximum size of the blob, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a page blob.\n \n The maximum size of the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a page blob.\n \n The maximum size of the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Resizes the page blob to the specified size.\n \n The size of the page blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to resize the page blob to the specified size.\n \n The size of the page blob, in bytes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to resize the page blob to the specified size.\n \n The size of the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to resize the page blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to resize the page blob to the specified size.\n \n The size of the blob, in bytes.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to resize the page blob to the specified size.\n \n The size of the blob, in bytes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to resize the page blob to the specified size.\n \n The size of the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to resize the page blob to the specified size.\n \n The size of the blob, in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets the page blob's sequence number.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if is equal to .\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to set the page blob's sequence number.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if is equal to .\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to set the page blob's sequence number.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if is equal to .\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to set the page blob's sequence number.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the page blob's sequence number.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if is equal to .\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the page blob's sequence number.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if is equal to .\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the page blob's sequence number.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if is equal to .\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the page blob's sequence number.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if is equal to .\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Checks existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob exists.\n \n \n \n Checks existence of the blob.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob exists.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check existence of the blob.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to check existence of the blob.\n \n An that references the pending asynchronous operation.\n true if the blob exists.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the blob.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Populates a blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to populate the blob's properties and metadata.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to populate the blob's properties and metadata.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to populate the blob's properties and metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets a collection of valid page ranges and their starting and ending bytes.\n \n The starting offset of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n The length of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n An enumerable collection of page ranges.\n \n \n \n Begins an asynchronous operation to return a collection of valid page ranges and their starting and ending bytes.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a collection of valid page ranges and their starting and ending bytes.\n \n The starting offset of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n The length of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return a collection of valid page ranges and their starting and ending bytes.\n \n An that references the pending asynchronous operation.\n An enumerable collection of page ranges.\n \n \n \n Returns a task that performs an asynchronous operation to return a collection of page ranges and their starting and ending bytes.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a collection of page ranges and their starting and ending bytes.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a collection of page ranges and their starting and ending bytes.\n \n The starting offset of the data range, in bytes. Must be a multiple of 512.\n The length of the data range, in bytes. Must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a collection of page ranges and their starting and ending bytes.\n \n The starting offset of the data range, in bytes. Must be a multiple of 512.\n The length of the data range, in bytes. Must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Updates the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to update the blob's metadata.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to update the blob's metadata.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's metadata.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Updates the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to update the blob's properties.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to update the blob's properties.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the blob's properties.\n \n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to delete the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete the blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the blob.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n true if the blob did already exist and was deleted; otherwise false.\n \n \n \n Begins an asynchronous request to delete the blob if it already exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to delete the blob if it already exists.\n \n An that references the pending asynchronous operation.\n true if the blob did already exist and was deleted; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the blob if it already exists.\n \n Whether to only delete the blob, to delete the blob and all snapshots, or to only delete the snapshots.\n An object that represents the access conditions for the container. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Creates a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request, or null.\n An object that represents the context for the current operation.\n A blob snapshot.\n \n \n \n Begins an asynchronous operation to create a snapshot of the blob.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request, or null.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to create a snapshot of the blob.\n \n An that references the pending asynchronous operation.\n A blob snapshot.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a snapshot of the blob.\n \n A collection of name-value pairs defining the metadata of the snapshot.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Acquires a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n The ID of the acquired lease.\n \n \n \n Begins an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to acquire a lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n The ID of the acquired lease.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to acquire a lease on this blob.\n \n A representing the span of time for which to acquire the lease,\n which will be rounded down to seconds. If null, an infinite lease will be acquired. If not null, this must be\n greater than zero.\n A string representing the proposed lease ID for the new lease, or null if no lease ID is proposed.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Renews a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to renew a lease on this blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to renew a lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Changes the lease ID on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n The new lease ID.\n \n \n \n Begins an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to change the lease on this blob.\n \n An that references the pending asynchronous operation.\n The new lease ID.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to change the lease on this blob.\n \n A string representing the proposed lease ID for the new lease. This cannot be null.\n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Releases the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to release the lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to release the lease on this blob.\n \n An object that represents the access conditions for the blob, including a required lease ID.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Breaks the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Begins an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n The options for this operation. If null, default options will be used.\n An object that represents the context for the current operation.\n An optional callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to break the current lease on this blob.\n \n An IAsyncResult that references the pending asynchronous operation.\n A representing the amount of time before the lease ends, to the second.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to break the current lease on this blob.\n \n A representing the amount of time to allow the lease to remain,\n which will be rounded down to seconds. If null, the break period is the remainder of the current lease,\n or zero for infinite leases.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Writes pages to a page blob.\n \n A stream providing the page data.\n The offset at which to begin writing, in bytes. The offset must be a multiple of 512.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to write pages to a page blob.\n \n A stream providing the page data.\n The offset at which to begin writing, in bytes. The offset must be a multiple of 512.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to write pages to a page blob.\n \n A stream providing the page data.\n The offset at which to begin writing, in bytes. The offset must be a multiple of 512.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to write pages to a page blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to write pages to a page blob.\n \n A stream providing the page data.\n The offset at which to begin writing, in bytes. The offset must be a multiple of 512.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to write pages to a page blob.\n \n A stream providing the page data.\n The offset at which to begin writing, in bytes. The offset must be a multiple of 512.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to write pages to a page blob.\n \n A stream providing the page data.\n The offset at which to begin writing, in bytes. The offset must be a multiple of 512.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to write pages to a page blob.\n \n A stream providing the page data.\n The offset at which to begin writing, in bytes. The offset must be a multiple of 512.\n An optional hash value that will be used to set the property\n on the blob. May be null or an empty string.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Clears pages from a page blob.\n \n The offset at which to begin clearing pages, in bytes. The offset must be a multiple of 512.\n The length of the data range to be cleared, in bytes. The length must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to clear pages from a page blob.\n \n The offset at which to begin clearing pages, in bytes. The offset must be a multiple of 512.\n The length of the data range to be cleared, in bytes. The length must be a multiple of 512.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to clear pages from a page blob.\n \n The offset at which to begin clearing pages, in bytes. The offset must be a multiple of 512.\n The length of the data range to be cleared, in bytes. The length must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to clear pages from a page blob.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear pages from a page blob.\n \n The offset at which to begin clearing pages, in bytes. The offset must be a multiple of 512.\n The length of the data range to be cleared, in bytes. The length must be a multiple of 512.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear pages from a page blob.\n \n The offset at which to begin clearing pages, in bytes. The offset must be a multiple of 512.\n The length of the data range to be cleared, in bytes. The length must be a multiple of 512.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear pages from a page blob.\n \n The offset at which to begin clearing pages, in bytes. The offset must be a multiple of 512.\n The length of the data range to be cleared, in bytes. The length must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear pages from a page blob.\n \n The offset at which to begin clearing pages, in bytes. The offset must be a multiple of 512.\n The length of the data range to be cleared, in bytes. The length must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Requests that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The copy ID associated with the copy operation.\n \n This method fetches the blob's ETag, last modified time, and part of the copy state.\n The copy ID and copy status fields are fetched, and the rest of the copy state is cleared.\n \n \n \n \n Requests that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The copy ID associated with the copy operation.\n \n This method fetches the blob's ETag, last modified time, and part of the copy state.\n The copy ID and copy status fields are fetched, and the rest of the copy state is cleared.\n \n \n \n \n Begins an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The URI of a source blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n The source blob.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to request that the service start to copy a blob's contents, properties, and metadata to a new blob.\n \n An that references the pending asynchronous operation.\n The copy ID associated with the copy operation.\n \n This method fetches the blob's ETag, last modified time, and part of the copy state.\n The copy ID and copy status fields are fetched, and the rest of the copy state is cleared.\n \n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The URI of a source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to request that the service start to copy another blob's contents, properties, and metadata\n to the blob referenced by this object.\n \n The source blob.\n An object that represents the access conditions for the source blob. If null, no condition is used.\n An object that represents the access conditions for the destination blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Aborts an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to abort an ongoing blob copy operation.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to abort an ongoing blob copy operation.\n \n A string identifying the copy operation.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Implements the Create method.\n \n The size in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that creates the blob.\n \n \n \n Implementation for the Resize method.\n \n The size in bytes.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that sets the metadata.\n \n \n \n Implementation for the SetSequenceNumber method.\n \n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if this operation is an increment action.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that sets the sequence number.\n \n \n \n Implementation for the CreateSnapshot method.\n \n A collection of name-value pairs defining the metadata of the snapshot, or null.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that creates the snapshot.\n If the metadata parameter is null then no metadata is associated with the request.\n \n \n \n Gets the page ranges impl.\n \n The starting offset of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n The length of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A for getting the page ranges.\n \n \n \n Implementation method for the WritePage methods.\n \n The page data.\n The start offset. \n The content MD5.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that writes the pages.\n \n \n \n Implementation method for the ClearPage methods.\n \n The start offset. Must be multiples of 512.\n Length of the data range to be cleared. Must be multiples of 512.\n An object that represents the access conditions for the blob. If null, no condition is used.\n A object that specifies additional options for the request.\n A that writes the pages.\n \n \n \n Default is 4 MB.\n \n \n \n \n Default is 4 MB.\n \n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob.\n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob.\n The account credentials.\n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob.\n The snapshot timestamp, if the blob is a snapshot.\n The account credentials.\n \n \n \n Initializes a new instance of the class using an absolute URI to the blob.\n \n The absolute URI to the blob. The service assumes this is the URI for the blob in the primary location.\n The snapshot timestamp, if the blob is a snapshot.\n The account credentials.\n \n \n \n Initializes a new instance of the class using the specified blob name and\n the parent container reference.\n If snapshotTime is not null, the blob instance represents a Snapshot.\n \n Name of the blob.\n Snapshot time in case the blob is a snapshot.\n The reference to the parent container.\n \n \n \n Initializes a new instance of the class.\n \n The attributes.\n The service client.\n \n \n \n Stores the that contains this blob.\n \n \n \n \n Stores the blob's parent .\n \n \n \n \n Stores the blob's attributes.\n \n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n A stored access policy.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n The optional header values to set for a blob accessed with this SAS.\n A shared access signature.\n \n \n \n Returns a shared access signature for the blob.\n \n The access policy for the shared access signature.\n The optional header values to set for a blob returned with this SAS.\n A stored access policy.\n A shared access signature.\n \n \n \n Gets the canonical name of the blob, formatted as /<account-name>/<container-name>/<blob-name>.\n If ignoreSnapshotTime is false and this blob is a snapshot, the canonical name is augmented with a\n query of the form ?snapshot=<snapshot-time>.\n This is used by both Shared Access and Copy blob operations.\n \n Indicates if the snapshot time is ignored.\n The canonical name of the blob.\n \n \n \n Parse URI for SAS (Shared Access Signature) and snapshot information.\n \n The complete Uri.\n The credentials to use.\n \n \n \n Gets the object that represents the Blob service.\n \n A client object that specifies the Blob service endpoint.\n \n \n \n Gets or sets the number of bytes to buffer when writing to a page blob stream.\n \n The number of bytes to buffer, ranging from between 512 bytes and 4 MB inclusive.\n \n \n \n Gets or sets the minimum number of bytes to buffer when reading from a blob stream.\n \n The minimum number of bytes to buffer, being at least 16KB.\n \n \n \n Gets the blob's system properties.\n \n The blob's properties.\n \n \n \n Gets the user-defined metadata for the blob.\n \n The blob's metadata, as a collection of name-value pairs.\n \n \n \n Gets the blob's URI for the primary location.\n \n The absolute URI to the blob, at the primary location.\n \n \n \n Gets the page blob's URIs for all locations.\n \n An object of type containing the page blob's URIs for all locations.\n \n \n \n Gets the date and time that the blob snapshot was taken, if this blob is a snapshot.\n \n The blob's snapshot time, if the blob is a snapshot. If the blob is not a snapshot, the value of this property is null.\n \n \n \n Gets a value indicating whether this blob is a snapshot.\n \n true if this blob is a snapshot; otherwise, false.\n \n \n \n Gets the absolute URI to the blob, including query string information if the blob is a snapshot.\n \n The absolute URI to the blob, including snapshot query information if the blob is a snapshot.\n \n \n \n Gets the page blob's URI for all locations, including query string information if the blob is a snapshot.\n \n An object of type containing the page blob's URIs for all locations, \n including snapshot query information if the blob is a snapshot.\n \n \n \n Gets the state of the most recent or pending copy operation.\n \n A object containing the copy state, or null if no copy blob state exists for this blob.\n \n \n \n Gets the type of the blob.\n \n The type of the blob.\n \n \n \n Gets the blob's name.\n \n The blob's name.\n \n \n \n Gets a object representing the blob's container.\n \n The blob's container.\n \n \n \n Gets the object representing the\n virtual parent directory for the blob.\n \n The blob's virtual parent directory.\n \n \n \n Provides a set of methods for parsing a response containing blob data from the Blob service.\n \n \n \n \n Gets the request ID from the response.\n \n The web response.\n A unique value associated with the request.\n \n \n \n Gets the blob's properties from the response.\n \n The web response.\n The blob's properties.\n \n \n \n Extracts the lease status from a web response.\n \n The web response.\n A enumeration from the web response.\n If the appropriate header is not present, a status of is returned.\n The header contains an unrecognized value.\n \n \n \n Extracts the lease state from a web response.\n \n The web response.\n A enumeration from the web response.\n If the appropriate header is not present, a status of is returned.\n The header contains an unrecognized value.\n \n \n \n Extracts the lease duration from a web response.\n \n The web response.\n A enumeration from the web response.\n If the appropriate header is not present, a status of is returned.\n The header contains an unrecognized value.\n \n \n \n Extracts the lease ID header from a web response.\n \n The web response.\n The lease ID.\n \n \n \n Extracts the remaining lease time from a web response.\n \n The web response.\n The remaining lease time, in seconds.\n \n \n \n Gets the user-defined metadata.\n \n The response from server.\n A of the metadata.\n \n \n \n Extracts a object from the headers of a web response.\n \n The HTTP web response.\n A object, or null if the web response does not contain a copy status.\n \n \n \n Gets the snapshot timestamp from the response.\n \n The web response.\n The snapshot timestamp.\n \n \n \n Reads service properties from a stream.\n \n The stream from which to read the service properties.\n The service properties stored in the stream.\n \n \n \n Reads service stats from a stream.\n \n The stream from which to read the service stats.\n The service stats stored in the stream.\n \n \n \n Gets a from a string.\n \n The lease status string.\n A enumeration.\n If a null or empty string is supplied, a status of is returned.\n The string contains an unrecognized value.\n \n \n \n Gets a from a string.\n \n The lease state string.\n A enumeration.\n If a null or empty string is supplied, a status of is returned.\n The string contains an unrecognized value.\n \n \n \n Gets a from a string.\n \n The lease duration string.\n A enumeration.\n If a null or empty string is supplied, a status of is returned.\n The string contains an unrecognized value.\n \n \n \n Builds a object from the given strings containing formatted copy information.\n \n The copy status, as a string.\n The copy ID.\n The source URI of the copy, as a string.\n A string formatted as progressBytes/TotalBytes.\n The copy completion time, as a string, or null.\n The copy status description, if any.\n A object populated from the given strings.\n \n \n \n A factory class for constructing a web request to manage blobs in the Blob service.\n \n \n \n \n Creates a web request to get the properties of the Blob service.\n \n The absolute URI to the Blob service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to get the Blob service properties.\n \n \n \n \n Creates a web request to set the properties of the Blob service.\n \n The absolute URI to the Blob service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to set the Blob service properties.\n \n \n \n \n Creates a web request to get the stats of the Blob service.\n \n The absolute URI to the Blob service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to get the Blob service stats.\n \n \n \n \n Writes Blob service properties to a stream, formatted in XML.\n \n The service properties to format and write to the stream.\n The stream to which the formatted properties are to be written.\n \n \n \n Constructs a web request to create a new block blob or page blob, or to update the content \n of an existing block blob. \n \n The absolute URI to the blob.\n The server timeout interval.\n The properties to set for the blob.\n The type of the blob.\n For a page blob, the size of the blob. This parameter is ignored\n for block blobs.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Adds the snapshot.\n \n An object of type that contains additional parameters to add to the URI query string.\n The snapshot version, if the blob is a snapshot.\n \n \n \n Constructs a web request to return the list of valid page ranges for a page blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The snapshot timestamp, if the blob is a snapshot.\n The starting offset of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n The length of the data range over which to list page ranges, in bytes. Must be a multiple of 512.\n The access condition to apply to the request.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Adds the Range Header for Blob Service Operations.\n \n Request\n Starting byte of the range\n Number of bytes in the range\n \n \n \n Constructs a web request to return the blob's system properties.\n \n The absolute URI to the blob.\n The server timeout interval.\n The snapshot timestamp, if the blob is a snapshot.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Constructs a web request to set system properties for a blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The blob's properties.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to resize a page blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The new blob size, if the blob is a page blob. Set this parameter to null to keep the existing blob size.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to set a page blob's sequence number.\n \n The absolute URI to the blob.\n The server timeout interval.\n A value of type , indicating the operation to perform on the sequence number.\n The sequence number. Set this parameter to null if this operation is an increment action.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to return the user-defined metadata for the blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The snapshot timestamp, if the blob is a snapshot.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Constructs a web request to set user-defined metadata for the blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Adds user-defined metadata to the request as one or more name-value pairs.\n \n The web request.\n The user-defined metadata.\n \n \n \n Adds user-defined metadata to the request as a single name-value pair.\n \n The web request.\n The metadata name.\n The metadata value.\n \n \n \n Constructs a web request to delete a blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The snapshot timestamp, if the blob is a snapshot.\n A set of options indicating whether to delete only blobs, only snapshots, or both.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to create a snapshot of a blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to use to acquire, renew, change, release or break the lease for the blob.\n \n The absolute URI to the blob.\n The server timeout interval, in seconds.\n The lease action to perform.\n A lease ID to propose for the result of an acquire or change operation,\n or null if no ID is proposed for an acquire operation. This should be null for renew, release, and break operations.\n The lease duration, in seconds, for acquire operations.\n If this is -1 then an infinite duration is specified. This should be null for renew, change, release, and break operations.\n The amount of time to wait, in seconds, after a break operation before the lease is broken.\n If this is null then the default time is used. This should be null for acquire, renew, change, and release operations.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Adds a proposed lease id to a request.\n \n The request.\n The proposed lease id.\n \n \n \n Adds a lease duration to a request.\n \n The request.\n The lease duration.\n \n \n \n Adds a lease break period to a request.\n \n The request.\n The lease break period.\n \n \n \n Adds a lease action to a request.\n \n The request.\n The lease action.\n \n \n \n Constructs a web request to write a block to a block blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The block ID for this block.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to create or update a blob by committing a block list.\n \n The absolute URI to the blob.\n The server timeout interval.\n The properties to set for the blob.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Constructs a web request to return the list of blocks for a block blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The snapshot timestamp, if the blob is a snapshot.\n The types of blocks to include in the list: committed, uncommitted, or both.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to write or clear a range of pages in a page blob.\n \n The absolute URI to the blob.\n The server timeout interval.\n The page range, defined by an object of type .\n A value of type , indicating the operation to perform on the page blob.\n The to apply to the request.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Generates a web request to copy a blob.\n \n The absolute URI to the destination blob.\n The server timeout interval.\n The absolute URI to the source blob, including any necessary authentication parameters.\n The access condition to apply to the source blob.\n The access condition to apply to the destination blob.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to abort a copy operation.\n \n The absolute URI to the blob.\n The server timeout interval.\n The ID string of the copy operation to be aborted.\n The access condition to apply to the request. Only lease conditions are supported for this operation.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Constructs a web request to get the blob's content, properties, and metadata.\n \n The absolute URI to the blob.\n The server timeout interval.\n The snapshot version, if the blob is a snapshot.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Constructs a web request to return a specified range of the blob's content, together with its properties and metadata.\n \n The absolute URI to the blob.\n The server timeout interval, in seconds.\n The snapshot version, if the blob is a snapshot.\n The byte offset at which to begin returning content.\n The number of bytes to return, or null to return all bytes through the end of the blob.\n If set to true, request an MD5 header for the specified range.\n The access condition to apply to the request.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Provides a set of methods for parsing container responses from the Blob service.\n \n \n \n \n Gets the request ID from the response.\n \n The web response.\n A unique value associated with the request.\n \n \n \n Gets the container's properties from the response.\n \n The web response.\n The container's attributes.\n \n \n \n Gets the user-defined metadata.\n \n The response from server.\n A of the metadata.\n \n \n \n Gets the ACL for the container from the response.\n \n The web response.\n A value indicating the public access level for the container.\n \n \n \n Reads the share access policies from a stream in XML.\n \n The stream of XML policies.\n The permissions object to which the policies are to be written.\n \n \n \n Converts the ACL string to a object.\n \n The string to convert.\n The resulting object.\n \n \n \n A factory class for constructing a web request to manage containers in the Blob service.\n \n \n \n \n Constructs a web request to create a new container.\n \n The absolute URI to the container.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to create a new container.\n \n The absolute URI to the container.\n The server timeout interval.\n An object for tracking the current operation.\n An object that specifies whether data in the container may be accessed publicly and the level of access. \n A web request to use to perform the operation.\n \n \n \n Constructs a web request to delete the container and all of the blobs within it.\n \n The absolute URI to the container.\n The server timeout interval.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to return the user-defined metadata for this container.\n \n The absolute URI to the container.\n The server timeout interval.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to return the properties and user-defined metadata for this container.\n \n The absolute URI to the container.\n The server timeout interval.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to set user-defined metadata for the container.\n \n The absolute URI to the container.\n The server timeout interval.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to use to acquire, renew, change, release or break the lease for the container.\n \n The absolute URI to the container.\n The server timeout interval, in seconds.\n The lease action to perform.\n A lease ID to propose for the result of an acquire or change operation,\n or null if no ID is proposed for an acquire operation. This should be null for renew, release, and break operations.\n The lease duration, in seconds, for acquire operations.\n If this is -1 then an infinite duration is specified. This should be null for renew, change, release, and break operations.\n The amount of time to wait, in seconds, after a break operation before the lease is broken.\n If this is null then the default time is used. This should be null for acquire, renew, change, and release operations.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Adds user-defined metadata to the request as one or more name-value pairs.\n \n The web request.\n The user-defined metadata.\n \n \n \n Adds user-defined metadata to the request as a single name-value pair.\n \n The web request.\n The metadata name.\n The metadata value.\n \n \n \n Constructs a web request to return a listing of all containers in this storage account.\n \n The absolute URI for the account.\n The server timeout interval.\n A set of parameters for the listing operation.\n Additional details to return with the listing.\n An object for tracking the current operation.\n A web request for the specified operation.\n \n \n \n Constructs a web request to return the ACL for a container.\n \n The absolute URI to the container.\n The server timeout interval.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to set the ACL for a container.\n \n The absolute URI to the container.\n The server timeout interval.\n The type of public access to allow for the container.\n The access condition to apply to the request.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to return a listing of all blobs in the container.\n \n The absolute URI to the container.\n The server timeout interval.\n A set of parameters for the listing operation.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Gets the container Uri query builder.\n \n A for the container.\n \n \n \n This class represents a queue in the Windows Azure Queue service.\n \n \n This class represents a queue in the Windows Azure Queue service.\n \n \n \n \n Creates the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous operation to create a queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to create a queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Creates the queue if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n true if the queue did not already exist and was created; otherwise false.\n \n \n \n Begins an asynchronous request to create the queue if it does not already exist.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to create the queue if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to create the queue if it does not already exist.\n \n An that references the pending asynchronous operation.\n true if the queue did not already exist and was created; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous request to create the queue if it does not already exist.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to create the queue if it does not already exist.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to create the queue if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to create the queue if it does not already exist.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the queue if it already exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n true if the queue did not already exist and was created; otherwise false.\n \n \n \n Begins an asynchronous request to delete the queue if it already exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to delete the queue if it already exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to delete the queue if it already exists.\n \n An that references the pending asynchronous operation.\n true if the queue did not already exist and was created; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous request to delete the queue if it already exists.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the queue if it already exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the queue if it already exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to delete the queue if it already exists.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous operation to delete a queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete a queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete a queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets permissions for the queue.\n \n The permissions to apply to the queue.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous request to set permissions for the queue.\n \n The permissions to apply to the queue.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to set permissions for the queue.\n \n The permissions to apply to the queue.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the result of an asynchronous request to set permissions for the queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous request to set permissions for the queue.\n \n The permissions to apply to the queue.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to set permissions for the queue.\n \n The permissions to apply to the queue.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to set permissions for the queue.\n \n The permissions to apply to the queue.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to set permissions for the queue.\n \n The permissions to apply to the queue.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the permissions settings for the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The queue's permissions.\n \n \n \n Begins an asynchronous request to get the permissions settings for the queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to get the permissions settings for the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to get the permissions settings for the queue.\n \n An that references the pending asynchronous operation.\n The queue's permissions.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Checks existence of the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n true if the queue exists.\n \n \n \n Checks existence of the queue.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n true if the queue exists.\n \n \n \n Begins an asynchronous request to check existence of the queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check existence of the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to check existence of the queue.\n \n If true, the command will be executed against the primary location.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to check existence of the queue.\n \n An that references the pending asynchronous operation.\n true if the queue exists.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to check existence of the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets the queue's user-defined metadata.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous operation to set user-defined metadata on the queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to set user-defined metadata on the queue.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous request operation to set user-defined metadata on the queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to set user-defined metadata on the queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set user-defined metadata on the queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set user-defined metadata on the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set user-defined metadata on the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Fetches the queue's attributes.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous operation to fetch the queue's attributes.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to fetch the queue's attributes.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to fetch a queue's attributes.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to fetch the queue's attributes.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to fetch the queue's attributes.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to fetch the queue's attributes.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to fetch the queue's attributes.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Adds a message to the queue.\n \n The message to add.\n The maximum time to allow the message to be in the queue, or null.\n The length of time from now during which the message will be invisible.\n If null then the message will be visible immediately.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to add a message to the queue.\n \n The message to add.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to add a message to the queue.\n \n The message to add.\n The maximum time to allow the message to be in the queue, or null.\n The length of time from now during which the message will be invisible.\n If null then the message will be visible immediately. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to add a message to the queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to add a message to the queue.\n \n The message to add.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to add a message to the queue.\n \n The message to add.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to add a message to the queue.\n \n The message to add.\n The maximum time to allow the message to be in the queue, or null.\n The length of time from now during which the message will be invisible.\n If null then the message will be visible immediately.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to add a message to the queue.\n \n The message to add.\n The maximum time to allow the message to be in the queue, or null.\n The length of time from now during which the message will be invisible.\n If null then the message will be visible immediately.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Updates the visibility timeout and optionally the content of a message.\n \n The message to update.\n The visibility timeout interval.\n Flags of values that specifies which parts of the message are to be updated.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n \n \n \n Begins an asynchronous operation to update the visibility timeout and optionally the content of a message.\n \n The message to update.\n The visibility timeout interval.\n An EnumSet of values that specifies which parts of the message are to be updated.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to update the visibility timeout and optionally the content of a message.\n \n The message to update.\n The visibility timeout interval.\n An EnumSet of values that specifies which parts of the message are to be updated.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to add a message to the queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the visibility timeout and optionally the content of a message.\n \n The message to update.\n The visibility timeout interval.\n An EnumSet of values that specifies which parts of the message are to be updated.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the visibility timeout and optionally the content of a message.\n \n The message to update.\n The visibility timeout interval.\n An EnumSet of values that specifies which parts of the message are to be updated.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the visibility timeout and optionally the content of a message.\n \n The message to update.\n The visibility timeout interval.\n An EnumSet of values that specifies which parts of the message are to be updated.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to update the visibility timeout and optionally the content of a message.\n \n The message to update.\n The visibility timeout interval.\n An EnumSet of values that specifies which parts of the message are to be updated.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes a message.\n \n A message.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Deletes the specified message from the queue.\n \n The message ID.\n The pop receipt value.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous operation to delete a message.\n \n A message.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete a message.\n \n A message.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete a message.\n \n The message ID.\n The pop receipt value.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete a message.\n \n The message ID.\n The pop receipt value.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete a message.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n A message.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n A message.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n A message.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n A message.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n The message ID.\n The pop receipt value.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n The message ID.\n The pop receipt value.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n The message ID.\n The pop receipt value.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a message.\n \n The message ID.\n The pop receipt value.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the specified number of messages from the queue using the specified request options and \n operation context. This operation marks the retrieved messages as invisible in the queue for the default \n visibility timeout period. \n \n The number of messages to retrieve.\n The visibility timeout interval.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n An enumerable collection of messages.\n \n \n \n Begins an asynchronous operation to get messages from the queue.\n \n The number of messages to retrieve.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get the specified number of messages from the queue using the \n specified request options and operation context. This operation marks the retrieved messages as invisible in the \n queue for the default visibility timeout period.\n \n The number of messages to retrieve.\n The visibility timeout interval.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get messages from the queue.\n \n An that references the pending asynchronous operation.\n An enumerable collection of messages.\n \n \n \n Returns a task that performs an asynchronous operation to get messages from the queue.\n \n The number of messages to retrieve.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get messages from the queue.\n \n The number of messages to retrieve.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the specified number of messages from the queue using the \n specified request options and operation context. This operation marks the retrieved messages as invisible in the \n queue for the default visibility timeout period.\n \n The number of messages to retrieve.\n The visibility timeout interval.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the specified number of messages from the queue using the \n specified request options and operation context. This operation marks the retrieved messages as invisible in the \n queue for the default visibility timeout period.\n \n The number of messages to retrieve.\n The visibility timeout interval.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets a message from the queue using the default request options. This operation marks the retrieved message as invisible in the queue for the default visibility timeout period. \n \n The visibility timeout interval.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n A message.\n \n \n \n Begins an asynchronous operation to get a single message from the queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get a single message from the queue, and specifies how long the message should be \n reserved before it becomes visible, and therefore available for deletion.\n \n The visibility timeout interval.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get a single message from the queue.\n \n An that references the pending asynchronous operation.\n A message.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue, and specifies how long the message should be \n reserved before it becomes visible, and therefore available for deletion.\n \n The visibility timeout interval.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue, and specifies how long the message should be \n reserved before it becomes visible, and therefore available for deletion.\n \n The visibility timeout interval.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Peeks a message from the queue, using the specified request options and operation context. A peek request retrieves a message from the queue without changing its visibility. \n \n The number of messages to peek.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n An enumerable collection of messages.\n \n \n \n Begins an asynchronous operation to peek messages from the queue.\n \n The number of messages to peek.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to peek messages from the queue.\n \n The number of messages to peek.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to peek messages from the queue.\n \n An that references the pending asynchronous operation.\n An enumerable collection of messages.\n \n \n \n Returns a task that performs an asynchronous operation to peek messages from the queue.\n \n The number of messages to peek.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to peek messages from the queue.\n \n The number of messages to peek.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to peek messages from the queue.\n \n The number of messages to peek.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to peek messages from the queue.\n \n The number of messages to peek.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Peeks a single message from the queue. A peek request retrieves a message from the queue without changing its visibility.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n A message.\n \n \n \n Begins an asynchronous operation to get a single message from the queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to peek a single message from the queue.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to peek a single message from the queue.\n \n An that references the pending asynchronous operation.\n A message.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get a single message from the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Clears all messages from the queue.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous operation to clear all messages from the queue.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to clear all messages from the queue.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests to the storage service, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to clear all messages from the queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear all messages from the queue.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear all messages from the queue.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear all messages from the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to clear all messages from the queue.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Ends an asynchronous operation to clear all messages from the queue.\n \n An that references the pending asynchronous operation.\n \n \n \n Implementation for the ClearMessages method.\n \n A object that specifies additional options for the request.\n A that gets the permissions.\n \n \n \n Implementation for the Create method.\n \n A object that specifies additional options for the request.\n A that creates the queue.\n \n \n \n Implementation for the Delete method.\n \n A object that specifies additional options for the request.\n A that deletes the queue.\n \n \n \n Implementation for the FetchAttributes method.\n \n A object that specifies additional options for the request.\n A that fetches the attributes.\n \n \n \n Implementation for the Exists method.\n \n A object that specifies additional options for the request.\n If true, the command will be executed against the primary location.\n A that checks existence.\n \n \n \n Implementation for the SetMetadata method.\n \n A object that specifies additional options for the request.\n A that sets the metadata.\n \n \n \n Implementation for the SetPermissions method.\n \n The permissions to set.\n A object that specifies additional options for the request.\n A that sets the permissions.\n \n \n \n Implementation for the GetPermissions method.\n \n A object that specifies additional options for the request.\n A that gets the permissions.\n \n \n \n Implementation for the AddMessageImpl method.\n \n A queue message.\n A value indicating the message time-to-live.\n The visibility delay for the message.\n A object that specifies additional options for the request.\n A that sets the permissions.\n \n \n \n Implementation for the UpdateMessage method.\n \n A queue message.\n The visibility timeout for the message.\n Indicates whether to update the visibility delay, message contents, or both.\n A object that specifies additional options for the request.\n A that sets the permissions.\n \n \n \n Implementation for the DeleteMessage method.\n \n The message ID.\n The pop receipt value.\n A object that specifies additional options for the request.\n A that deletes the queue.\n \n \n \n Implementation for the GetPermissions method.\n \n The number of messages to retrieve.\n The visibility timeout interval.\n A object that specifies additional options for the request.\n A that gets the permissions.\n \n \n \n Implementation for the PeekMessages method.\n \n The number of messages to retrieve.\n A object that specifies additional options for the request.\n A that gets the permissions.\n \n \n \n Gets the ApproximateMessageCount and metadata from response.\n \n The web response.\n \n \n \n Update the message pop receipt and next visible time.\n \n The Cloud Queue Message.\n The web response.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the queue.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the queue.\n The account credentials.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the queue.\n The account credentials.\n \n \n \n Initializes a new instance of the class.\n \n The queue name.\n A client object that specifies the endpoint for the queue service.\n \n \n \n Uri for the messages.\n \n \n \n \n Gets the Uri for general message operations.\n \n \n \n \n Gets the individual message address.\n \n The message id.\n The URI of the message.\n \n \n \n Parse URI for SAS (Shared Access Signature) information.\n \n The complete Uri.\n The credentials to use.\n \n \n \n Returns the canonical name for shared access.\n \n The canonical name.\n \n \n \n Selects the get message response.\n \n The protocol message.\n The parsed message.\n \n \n \n Selects the peek message response.\n \n The protocol message.\n The parsed message.\n \n \n \n Returns a shared access signature for the queue.\n \n The access policy for the shared access signature.\n A queue-level access policy.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n \n \n \n Gets the service client for the queue.\n \n A client object that specifies the endpoint for the queue service.\n \n \n \n Gets the queue's URI for the primary location.\n \n The absolute URI to the queue, at the primary location.\n \n \n \n Gets the queue's URIs for all locations.\n \n An object of type containing the queue's URIs for all locations.\n \n \n \n Gets the name of the queue.\n \n The queue's name.\n \n \n \n Gets the approximate message count for the queue.\n \n The approximate message count.\n \n \n \n Gets or sets a value indicating whether to apply base64 encoding when adding or retrieving messages.\n \n True to encode messages; otherwise, false. The default value is true.\n \n \n \n Gets the queue's metadata.\n \n The queue's metadata.\n \n \n \n Provides a client-side logical representation of the Windows Azure Queue service. This client is used to configure and execute requests against the Queue service.\n \n The service client encapsulates the base URI for the Queue service. If the service client will be used for authenticated access, it also encapsulates the credentials for accessing the storage account.\n \n Provides a client-side logical representation of the Windows Azure Queue service. This client is used to configure and execute requests against the Queue service.\n \n The service client encapsulates the base URI for the Queue service. If the service client will be used for authenticated access, it also encapsulates the credentials for accessing the storage account.\n \n \n \n Returns an enumerable collection of the queues in the storage account whose names begin with the specified prefix and that are retrieved lazily.\n \n The queue name prefix.\n An enumeration value that indicates which details to include in the listing.\n An object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n An enumerable collection of objects that implement and are retrieved lazily.\n \n \n \n Returns a result segment containing a collection of queues in the storage account.\n \n A continuation token returned by a previous listing operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of queues in the storage account.\n \n The queue name prefix.\n A continuation token returned by a previous listing operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of queues in the storage account.\n \n The queue name prefix.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n An object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n A result segment containing objects that implement .\n \n \n \n Returns a result segment containing a collection of queues in the storage account.\n \n The queue name prefix.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n An object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n A result segment.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of queue items.\n \n A returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of queue items.\n \n The queue name prefix.\n A returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of queue items.\n \n The queue name prefix.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n An object that specifies additional options for the request.\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return a result segment containing a collection of queue items.\n \n An that references the pending asynchronous operation.\n A queue result segment.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of queue items.\n \n A returned by a previous listing operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of queue items.\n \n A returned by a previous listing operation. \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of queue items.\n \n The queue name prefix. \n A returned by a previous listing operation. \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of queue items.\n \n The queue name prefix. \n A returned by a previous listing operation. \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of queue items.\n \n The queue name prefix.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection of queue items.\n \n The queue name prefix.\n A enumeration describing which items to include in the listing.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000. \n A returned by a previous listing operation. \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Core implementation of the ListQueues method.\n \n The queue name prefix.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A enumeration describing which items to include in the listing.\n An object that specifies additional options for the request.\n The continuation token.\n A that lists the queues.\n \n \n \n Begins an asynchronous operation to get the properties of the queue service.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get the properties of the queue service.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get the properties of the queue service.\n \n The result returned from a prior call to .\n A object containing the queue service properties.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the queue service.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the queue service.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the queue service.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the properties of the queue service.\n \n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the properties of the queue service.\n \n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n The queue service properties.\n \n \n \n Begins an asynchronous operation to set the properties of the queue service.\n \n The queue service properties.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to set the properties of the queue service.\n \n The queue service properties.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to set the properties of the queue service.\n \n The result returned from a prior call to .\n \n \n \n Returns a task that performs an asynchronous operation to set the properties of the queue service.\n \n The queue service properties.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the properties of the queue service.\n \n The queue service properties.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the properties of the queue service.\n \n The queue service properties.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the properties of the queue service.\n \n The queue service properties.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets the properties of the queue service.\n \n The queue service properties.\n A object that specifies additional options for the request. Specifying null will use the default request options from the associated service client ().\n An object that represents the context for the current operation. This object is used to track requests, and to provide additional runtime information about the operation.\n \n \n \n Begins an asynchronous operation to get the stats of the queue service.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get the stats of the queue service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get the stats of the queue service.\n \n An that references the pending asynchronous operation.\n The queue service stats.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the queue service.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the queue service.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the queue service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the queue service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the stats of the queue service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The queue service stats.\n \n \n \n The default server and client timeout interval.\n \n \n \n \n Max execution time across all potential retries.\n \n \n \n \n Initializes a new instance of the class using the specified queue service endpoint\n and anonymous credentials.\n \n The queue service endpoint to use to create the client.\n \n \n \n Initializes a new instance of the class using the specified queue service endpoint\n and account credentials.\n \n The queue service endpoint to use to create the client.\n The account credentials.\n \n \n \n Initializes a new instance of the class using the specified Queue service endpoint\n and account credentials.\n \n The Queue service endpoint to use to create the client.\n The account credentials.\n \n \n \n Returns a reference to a object with the specified name.\n \n The name of the queue, or an absolute URI to the queue.\n A reference to a queue.\n \n \n \n Gets or sets the authentication scheme to use to sign HTTP requests.\n \n \n \n \n Gets the authentication handler used to sign HTTP requests.\n \n The authentication handler.\n \n \n \n Gets or sets a buffer manager that implements the interface, \n specifying a buffer pool for use with operations against the Queue service client.\n \n \n \n \n Gets the account credentials used to create the queue service client.\n \n The account credentials.\n \n \n \n Gets the base URI for the Queue service client, at the primary location.\n \n The base URI used to construct the Queue service client, at the primary location.\n \n \n \n Gets the Queue service endpoints for all locations.\n \n An object of type containing Queue service URIs for all locations.\n \n \n \n Gets or sets the default retry policy for requests made via the Queue service client.\n \n The retry policy.\n \n \n \n Gets or sets the default location mode for requests made via the Queue service client.\n \n The location mode.\n \n \n \n Gets or sets the default server and client timeout for requests made via the Queue service client.\n \n The server and client timeout interval.\n \n \n \n Gets or sets the maximum execution time across all potential retries.\n \n The maximum execution time across all potential retries.\n \n \n \n Gets a value indicating whether the service client is used with Path style or Host style.\n \n Is true if use path style URIs; otherwise, false.\n \n \n \n Represents a message in the Windows Azure Queue service.\n \n \n Represents a message in the Windows Azure Queue service.\n \n \n \n \n The maximum message size in bytes.\n \n \n \n \n The maximum number of messages that can be peeked at a time.\n \n \n \n \n Initializes a new instance of the class with the given byte array.\n \n The content of the message as a byte array.\n \n \n \n Sets the content of this message.\n \n The new message content.\n \n \n \n The maximum amount of time a message is kept in the queue.\n \n \n \n \n Custom UTF8Encoder to throw exception in case of invalid bytes.\n \n \n \n \n Initializes a new instance of the class with the given byte array.\n \n \n \n \n Initializes a new instance of the class with the given string.\n \n The content of the message as a string of text.\n \n \n \n Initializes a new instance of the class with the given message ID and pop receipt.\n \n The message ID.\n The pop receipt token.\n \n \n \n Initializes a new instance of the class with the given Base64 encoded string.\n This method is only used internally.\n \n The text string.\n Whether the string is Base64 encoded.\n \n \n \n Gets the content of the message for transfer (internal use only).\n \n Indicates if the message should be encoded.\n The message content as a string.\n \n \n \n Sets the content of this message.\n \n The new message content.\n \n \n \n Gets the maximum message size in bytes.\n \n The maximum message size in bytes.\n \n \n \n Gets the maximum amount of time a message is kept in the queue.\n \n The maximum amount of time a message is kept in the queue.\n \n \n \n Gets the maximum number of messages that can be peeked at a time.\n \n The maximum number of messages that can be peeked at a time.\n \n \n \n Gets the content of the message as a byte array.\n \n The content of the message as a byte array.\n \n \n \n Gets the message ID.\n \n The message ID.\n \n \n \n Gets the message's pop receipt.\n \n The pop receipt value.\n \n \n \n Gets the time that the message was added to the queue.\n \n The time that the message was added to the queue.\n \n \n \n Gets the time that the message expires.\n \n The time that the message expires.\n \n \n \n Gets the time that the message will next be visible.\n \n The time that the message will next be visible.\n \n \n \n Gets the content of the message, as a string.\n \n The message content.\n \n \n \n Gets the number of times this message has been dequeued.\n \n The number of times this message has been dequeued.\n \n \n \n Gets message type that indicates if the RawString is the original message string or Base64 encoding of the original binary data.\n \n \n \n \n Gets or sets the original message string or Base64 encoding of the original binary data.\n \n The original message string.\n \n \n \n Provides a set of methods for parsing a response containing queue data from the Queue service.\n \n \n \n \n Gets the request ID from the response.\n \n The web response.\n A unique value associated with the request.\n \n \n \n Gets the approximate message count for the queue.\n \n The web response.\n The approximate count for the queue.\n \n \n \n Gets the user-defined metadata.\n \n The response from server.\n An object of type containing the metadata.\n \n \n \n Extracts the pop receipt from a web response header.\n \n The web response.\n The pop receipt stored in the header of the response.\n \n \n \n Extracts the next visibility time from a web response header.\n \n The web response.\n The time of next visibility stored in the header of the response.\n \n \n \n Reads service properties from a stream.\n \n The stream from which to read the service properties.\n The service properties stored in the stream.\n \n \n \n Reads service stats from a stream.\n \n The stream from which to read the service stats.\n The service stats stored in the stream.\n \n \n \n Reads the share access policies from a stream in XML.\n \n The stream of XML policies.\n The permissions object to which the policies are to be written.\n \n \n \n A factory class for constructing a web request to manage queues in the Queue service.\n \n \n \n \n Creates a web request to get the properties of the Queue service.\n \n The absolute URI to the Queue service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to get the Queue service properties.\n \n \n \n \n Creates a web request to set the properties of the Queue service.\n \n The absolute URI to the Queue service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to set the Queue service properties.\n \n \n \n \n Creates a web request to get the stats of the Queue service.\n \n The absolute URI to the Queue service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to get the Queue service stats.\n \n \n \n \n Writes Queue service properties to a stream, formatted in XML.\n \n The service properties to format and write to the stream.\n The stream to which the formatted properties are to be written.\n \n \n \n Constructs a web request to create a new queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to delete the queue and all of the messages within it.\n \n The absolute URI to the queue.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to clear all messages in the queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to return the user-defined metadata for this queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Generates a web request to set user-defined metadata for the queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Adds user-defined metadata to the request as one or more name-value pairs.\n \n The web request.\n The user-defined metadata.\n \n \n \n Adds user-defined metadata to the request as a single name-value pair.\n \n The web request.\n The metadata name.\n The metadata value.\n \n \n \n Constructs a web request to return a listing of all queues in this storage account.\n \n The absolute URI for the account.\n The server timeout interval.\n A set of parameters for the listing operation.\n Additional details to return with the listing.\n An object for tracking the current operation.\n A web request for the specified operation.\n \n \n \n Constructs a web request to return the ACL for a queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to set the ACL for a queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to add a message for a queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n The message time-to-live, in seconds.\n The visibility timeout, in seconds.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Constructs a web request to update a message.\n \n The absolute URI to the message to update.\n The server timeout interval, in seconds.\n The pop receipt of the message.\n The length of time from now during which the message will be invisible, in seconds.\n An object for tracking the current operation.\n A web request for the update operation.\n \n \n \n Constructs a web request to update a message.\n \n The absolute URI to the message to update.\n The server timeout interval, in seconds.\n The pop receipt of the message.\n An object for tracking the current operation.\n A web request for the update operation.\n \n \n \n Constructs a web request to get messages for a queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n The number of messages.\n The visibility timeout.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Constructs a web request to peeks messages for a queue.\n \n The absolute URI to the queue.\n The server timeout interval.\n The number of messages.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Represents a Windows Azure table.\n \n \n Represents a Windows Azure table.\n \n \n \n \n Executes the operation on a table, using the specified and . \n \n A object that represents the operation to perform.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A containing the result of executing the operation on the table.\n \n \n \n Begins an asynchronous table operation.\n \n A object that represents the operation to perform.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous table operation using the specified and .\n \n A object that represents the operation to perform.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous table operation.\n \n An that references the pending asynchronous operation.\n A containing the result executing the operation on the table.\n \n \n \n Returns a task that performs an asynchronous table operation using the specified and .\n \n A object that represents the operation to perform.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous table operation using the specified and .\n \n A object that represents the operation to perform.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous table operation using the specified and .\n \n A object that represents the operation to perform.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous table operation using the specified and .\n \n A object that represents the operation to perform.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Executes a batch operation on a table as an atomic operation, using the specified and .\n \n The object representing the operations to execute on the table.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n An enumerable collection of objects that contains the results, in order, of each operation in the on the table.\n \n \n \n Begins an asynchronous operation to execute a batch of operations on a table.\n \n The object representing the operations to execute on the table.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to execute a batch of operations on a table, using the specified and .\n \n The object representing the operations to execute on the table.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous batch of operations on a table.\n \n An that references the pending asynchronous operation.\n A enumerable collection of type that contains the results, in order, of each operation in the on the table.\n \n \n \n Returns a task that performs an asynchronous operation to execute a batch of operations on a table, using the specified and .\n \n The object representing the operations to execute on the table.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a batch of operations on a table, using the specified and .\n \n The object representing the operations to execute on the table.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a batch of operations on a table, using the specified and .\n \n The object representing the operations to execute on the table.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a batch of operations on a table, using the specified and .\n \n The object representing the operations to execute on the table.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Executes a query on a table, using the specified and .\n \n A representing the query to execute.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n An enumerable collection of objects, representing table entities returned by the query.\n \n \n \n Executes a query in segmented mode with the specified continuation token, , and .\n \n A representing the query to execute.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A object containing the results of executing the query.\n \n \n \n Begins an asynchronous segmented query operation using the specified continuation token.\n \n A representing the query to execute.\n A object representing a continuation token from the server when the operation returns a partial result.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to query a table in segmented mode using the specified continuation token, , and .\n \n A representing the query to execute.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous segmented query operation. \n \n An that references the pending asynchronous operation.\n A object containing the results of executing the query.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token, , and .\n \n A representing the query to execute.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token, , and .\n \n A representing the query to execute.\n A object representing a continuation token from the server when the operation returns a partial result.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token, , and .\n \n A representing the query to execute.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token, , and .\n \n A representing the query to execute.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Executes a query on a table, using the specified and , applying the to the result.\n \n A representing the query to execute.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n An enumerable collection, containing the projection into type TResult, of the results of executing the query.\n \n \n \n Executes a query in segmented mode with the specified continuation token, , and .\n \n A representing the query to execute.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A object containing the results of executing the query.\n \n \n \n Begins an asynchronous segmented query operation using the specified continuation token.\n \n A representing the query to execute.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n A factory method that creates a query that can be modified using LINQ. The query may be subsequently executed using one of the execution methods available for , \n such as , , or .\n \n The entity type of the query.\n A object, specialized for type TElement, that may subsequently be executed.\n \n The namespace includes extension methods for the object, \n including , , and . To use these methods, include a using\n statement that references the namespace.\n \n \n \n \n Executes a query on a table, using the specified and .\n \n The entity type of the query.\n A TableQuery instance specifying the table to query and the query parameters to use, specialized for a type T implementing TableEntity.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n An enumerable collection, specialized for type TElement, of the results of executing the query.\n \n \n \n Queries a table in segmented mode using the specified continuation token, , and .\n \n The entity type of the query.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A , specialized for type TElement, containing the results of executing the query.\n \n \n \n Begins an asynchronous operation to query a table in segmented mode, using the specified continuation token.\n \n The entity type of the query.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n A object representing a continuation token from the server when the operation returns a partial result.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to query a table in segmented mode using the specified continuation token and .\n \n The entity type of the query.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous segmented table query operation.\n \n The type of the results to be returned. Can be the entity type specified in the Begin or the result type of the resolver\n An that references the pending asynchronous operation.\n A containing the results of executing the query.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token and .\n \n The entity type of the query.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token and .\n \n The entity type of the query.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n A object representing a continuation token from the server when the operation returns a partial result.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token and .\n \n The entity type of the query.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to query a table in segmented mode using the specified continuation token and .\n \n The entity type of the query.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Executes a query, using the specified and , applying the to the result.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n An enumerable collection, containing the projection into type TResult, of the results of executing the query.\n \n \n \n Executes a query in segmented mode with the specified continuation token, using the specified and , applying the to the results.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A containing the projection into type TResult of the results of executing the query. \n \n \n \n Begins an asynchronous operation to query a table in segmented mode, using the specified and continuation token.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous segmented table query operation.\n \n The entity type of the query.\n The type into which the will project the query results.\n An that references the pending asynchronous operation.\n A containing the projection into type TResult of the results of executing the query. \n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query in segmented mode with the specified continuation token, , and , applies the to the results.\n \n The entity type of the query.\n The type into which the will project the query results.\n A instance specifying the table to query and the query parameters to use, specialized for a type TElement.\n An instance which creates a projection of the table query result entities into the specified type TResult.\n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Creates a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n \n \n \n Begins an asynchronous operation to create a table.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to create a table.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a table.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a table.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Creates the table if it does not already exist.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n true if table was created; otherwise, false.\n \n \n \n Begins an asynchronous operation to create a table if it does not already exist.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to create a table if it does not already exist.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to determine whether a table exists.\n \n An that references the pending asynchronous operation.\n true if table exists; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous operation to create a table if it does not already exist.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a table if it does not already exist.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a table if it does not already exist.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to create a table if it does not already exist.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n \n \n \n Begins an asynchronous operation to delete a table.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete a table.\n \n An that references the pending asynchronous operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a table.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a table.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete a table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Deletes the table if it exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n true if the table was deleted; otherwise, false.\n \n \n \n Begins an asynchronous operation to delete the table if it exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to delete the table if it exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to delete the table if it exists.\n \n An that references the pending asynchronous operation.\n true if the table was deleted; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous operation to delete the table if it exists.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the table if it exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the table if it exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to delete the table if it exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Checks whether the table exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n true if table exists; otherwise, false.\n \n \n \n Checks whether the table exists.\n \n If true, the command will be executed against the primary location.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n true if table exists; otherwise, false.\n \n \n \n Begins an asynchronous operation to determine whether a table exists.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to determine whether a table exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to determine whether a table exists.\n \n If true, the command will be executed against the primary location.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to determine whether a table exists.\n \n An that references the pending asynchronous operation.\n true if table exists; otherwise, false.\n \n \n \n Returns a task that performs an asynchronous operation to determine whether a table exists.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to determine whether a table exists.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to determine whether a table exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to determine whether a table exists.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the permissions settings for the table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The table's permissions.\n \n \n \n Begins an asynchronous request to get the permissions settings for the table.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to get the permissions settings for the table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to get the permissions settings for the table.\n \n An that references the pending asynchronous operation.\n The table's permissions.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the table.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the table.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to get the permissions settings for the table.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets the permissions settings for the table.\n \n A object that represents the permissions to set.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n \n \n \n Begins an asynchronous request to set permissions for the table.\n \n The permissions to apply to the table.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous request to set permissions for the table.\n \n The permissions to apply to the table.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Returns the asynchronous result of the request to get the permissions settings for the table.\n \n An that references the pending asynchronous operation. \n \n \n \n Returns a task that performs an asynchronous request to set permissions for the table.\n \n The permissions to apply to the table.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to set permissions for the table.\n \n The permissions to apply to the table.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to set permissions for the table.\n \n The permissions to apply to the table.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous request to set permissions for the table.\n \n The permissions to apply to the table.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the table.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the table.\n The account credentials.\n \n \n \n Initializes a new instance of the class.\n \n The absolute URI to the table.\n The account credentials.\n \n \n \n Initializes a new instance of the class.\n \n The table name.\n The client.\n \n \n \n Returns a shared access signature for the table.\n \n The access policy for the shared access signature.\n An access policy identifier.\n The start partition key, or null.\n The start row key, or null.\n The end partition key, or null.\n The end row key, or null.\n A shared access signature, as a URI query string.\n The query string returned includes the leading question mark.\n Thrown if the current credentials don't support creating a shared access signature.\n \n \n \n Returns the name of the table.\n \n The name of the table.\n \n \n \n Parse URI for SAS (Shared Access Signature) information.\n \n The complete Uri.\n The credentials to use.\n \n \n \n Gets the canonical name of the table, formatted as /<account-name>/<table-name>.\n \n The canonical name of the table.\n \n \n \n Gets the object that represents the Table service.\n \n A client object that specifies the Table service endpoint.\n \n \n \n Gets the table name.\n \n The table name.\n \n \n \n Gets the table's URI for the primary location.\n \n The absolute URI to the table, at the primary location.\n \n \n \n Gets the table's URIs for all locations.\n \n An object of type containing the table's URIs for all locations.\n \n \n \n Provides a client-side logical representation of the Windows Azure Table Service. This client is used to configure and execute requests against the Table Service.\n \n The service client encapsulates the base URI for the Table service. If the service client will be used for authenticated access, it also encapsulates the credentials for accessing the storage account. \n \n Provides a client-side logical representation of the Windows Azure Table service. This client is used to configure and execute requests against the Table service.\n \n The CloudTableClient object encapsulates the base URI for the Table service. If the service client will be used for authenticated access, \n it also encapsulates the credentials for accessing the storage account. \n \n \n \n Returns an enumerable collection of tables, which are retrieved lazily, that begin with the specified prefix.\n \n The table name prefix.\n A object that specifies additional options for the request.\n An object that provides information on how the operation executed.\n An enumerable collection of tables that are retrieved lazily.\n \n \n \n Returns an enumerable collection of tables in the storage account.\n \n A returned by a previous listing operation.\n An enumerable collection of tables.\n \n \n \n Returns an enumerable collection of tables, which are retrieved lazily, that begin with the specified prefix.\n \n The table name prefix.\n A returned by a previous listing operation.\n An enumerable collection of tables that are retrieved lazily.\n \n \n \n Returns an enumerable collection of tables that begin with the specified prefix and that are retrieved lazily.\n \n The table name prefix.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A returned by a previous listing operation.\n A object that specifies additional options for the request.\n An object that provides information on how the operation executed.\n An enumerable collection of tables that are retrieved lazily.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection of tables \n in the storage account.\n \n A returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n The table name prefix.\n A returned by a previous listing operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n The table name prefix.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A returned by a previous listing operation.\n The server timeout, maximum execution time, and retry policies for the operation.\n An object that provides information on how the operation executed.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to return a result segment containing a collection \n of tables. \n \n An that references the pending asynchronous operation.\n A result segment containing tables.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n A returned by a previous listing operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n A returned by a previous listing operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n The table name prefix.\n A returned by a previous listing operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n The table name prefix.\n A returned by a previous listing operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n The table name prefix.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A returned by a previous listing operation.\n The server timeout, maximum execution time, and retry policies for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to return a result segment containing a collection \n of tables beginning with the specified prefix.\n \n The table name prefix.\n A non-negative integer value that indicates the maximum number of results to be returned at a time, up to the \n per-operation limit of 5000. If this value is null, the maximum possible number of results will be returned, up to 5000.\n A returned by a previous listing operation.\n The server timeout, maximum execution time, and retry policies for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the service properties for the Table service.\n \n A object that specifies additional options for the request.\n An object that provides information on how the operation executed.\n The table service properties as a object.\n \n \n \n Begins an asynchronous operation to get the service properties of the Table service.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get the service properties of the Table service.\n \n A object that specifies additional options for the request.\n An object that provides information on how the operation executed.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get the service properties of the Table service.\n \n The result returned from a prior call to .\n The table service properties.\n \n \n \n Returns a task that performs an asynchronous operation to get the service properties of the Table service.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the service properties of the Table service.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the service properties of the Table service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the service properties of the Table service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Sets the service properties of the Table service.\n \n The table service properties.\n A object that specifies additional options for the request.\n An object that provides information on how the operation executed.\n \n \n \n Begins an asynchronous operation to set the service properties of the Table service.\n \n The table service properties.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to set the service properties of the Table service.\n \n The table service properties.\n A object that specifies additional options for the request.\n An object that provides information on how the operation executed.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to set the service properties of the Table service.\n \n The result returned from a prior call to \n \n \n \n Returns a task that performs an asynchronous operation to set the service properties of the Table service.\n \n The table service properties.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the service properties of the Table service.\n \n The table service properties.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the service properties of the Table service.\n \n The table service properties.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to set the service properties of the Table service.\n \n The table service properties.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Begins an asynchronous operation to get the stats of the table service.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to get the stats of the table service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user defined object to be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to get the stats of the table service.\n \n An that references the pending asynchronous operation.\n The table service stats.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the table service.\n \n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the table service.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the table service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to get the stats of the table service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the stats of the table service.\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n The table service stats.\n \n \n \n Creates a new object for performing operations against the Table service.\n \n A service context to use for performing operations against the Table service.\n \n \n \n The default server and client timeout interval.\n \n \n \n \n Max execution time across all potential retries.\n \n \n \n \n Initializes a new instance of the class using the specified Table service endpoint\n and anonymous credentials.\n \n The Table service endpoint to use to create the client.\n \n \n \n Initializes a new instance of the class using the specified Table service endpoint\n and storage account credentials.\n \n The Table service endpoint to use to create the client.\n The storage account credentials.\n \n \n \n Initializes a new instance of the class using the specified Blob service endpoint\n and account credentials.\n \n The Table service endpoint to use to create the client.\n The storage account credentials.\n \n \n \n Gets a reference to the specified table.\n \n The name of the table.\n A object.\n \n \n \n Gets or sets the authentication scheme to use to sign HTTP requests.\n \n Note that if you are using the legacy Table service API, which is based on WCF Data Services, the authentication scheme used by the TableServiceContext object will always be Shared Key Lite, regardless of the value of this property. \n \n \n \n Gets the authentication handler used to sign HTTP requests.\n \n The authentication handler.\n \n \n \n Gets or sets a buffer manager that implements the interface, \n specifying a buffer pool for use with operations against the Table service client.\n \n \n \n \n Gets the storage account credentials used to create the Table service client.\n \n The storage account credentials.\n \n \n \n Gets the base URI for the Table service client, at the primary location.\n \n The base URI used to construct the Table service client, at the primary location.\n \n \n \n Gets the Table service endpoints for all locations.\n \n An object of type containing Table service URIs for all locations.\n \n \n \n Gets or sets the default retry policy for requests made via the Table service client.\n \n The retry policy.\n \n \n \n Gets or sets the default location mode for requests made via the Table service client.\n \n The location mode.\n \n \n \n Gets or sets the default server and client timeout for requests.\n \n The server and client timeout interval.\n \n \n \n Gets or sets the maximum execution time across all potential retries.\n \n The maximum execution time across all potential retries.\n \n \n \n Gets and sets the that is used for any table accessed with this object.\n \n The TablePayloadFormat to use.\n \n \n \n Gets a value indicating whether the service client is used with Path style or Host style.\n \n Is true if use path style URIs; otherwise, false.\n \n \n \n Gets the associated account name for the client.\n \n The account name.\n \n \n \n Represents a custom attribute that can be used to ignore entity properties during serialization/de-serialization.\n \n \n \n \n Represents a batch operation on a table.\n \n \n Represents a batch operation on a table.\n \n A batch operation is a collection of table operations which are executed by the Storage Service REST API as a single atomic operation, by invoking an \n Entity Group Transaction.A batch operation may contain up to 100 individual \n table operations, with the requirement that each operation entity must have same partition key. A batch with a retrieve operation cannot contain any other operations. \n Note that the total payload of a batch operation is limited to 4MB.\n \n \n \n Inserts a into the batch that retrieves an entity based on its row key and partition key. The entity will be deserialized into the specified class type which extends .\n \n The class of type for the entity to retrieve.\n A string containing the partition key of the entity to retrieve.\n A string containing the row key of the entity to retrieve. \n \n \n \n Adds a table operation to retrieve an entity of the specified class type with the specified partition key and row key to the batch operation.\n \n The return type which the specified will resolve the given entity to.\n A string containing the partition key of the entity to retrieve.\n A string containing the row key of the entity to retrieve.\n The implementation to project the entity to retrieve as a particular type in the result.\n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Adds a to the that deletes the specified entity from a table.\n \n The entity to be deleted from the table.\n \n \n \n Adds a to the that inserts the specified entity into a table.\n \n The entity to be inserted into the table.\n \n \n \n Adds a object that inserts the specified entity into the table as part of the batch operation.\n \n The entity to be inserted into the table.\n true if the message payload should be returned in the response to the insert operation;otherwise, false.\n \n \n \n Adds a to the that inserts the specified entity into a table if the entity does not exist; if the entity does exist then its contents are merged with the provided entity.\n \n The entity whose contents are being inserted or merged.\n \n \n \n Adds a to the that inserts the specified entity into a table if the entity does not exist; if the entity does exist then its contents are replaced with the provided entity.\n \n The entity whose contents are being inserted or replaced.\n \n \n \n Adds a to the that merges the contents of the specified entity with the existing entity in a table.\n \n The entity whose contents are being merged.\n \n \n \n Adds a to the that replaces the contents of the specified entity in a table.\n \n The entity whose contents are being replaced.\n \n \n \n Adds a to the that retrieves an entity with the specified partition key and row key.\n \n A string containing the partition key of the entity to retrieve.\n A string containing the row key of the entity to retrieve.\n \n \n \n Returns the zero-based index of the first occurrence of the specified item, or -1 if the does not contain the item.\n \n The item to search for.\n The zero-based index of the first occurrence of item within the , if found; otherwise, –1.\n \n \n \n Inserts a into the at the specified index.\n \n The index at which to insert the .\n The item to insert.\n \n \n \n Removes the at the specified index from the .\n \n The index of the to remove from the .\n \n \n \n Adds the to the .\n \n The item to add to the .\n \n \n \n Clears all objects from the .\n \n \n \n \n Returns true if this contains the specified element.\n \n The item to search for.\n true if the item is contained in the ; false, otherwise.\n \n \n \n Copies all the elements of the to the specified one-dimensional array starting at the specified destination array index. \n \n The one-dimensional array that is the destination of the elements copied from the .\n The index in the destination array at which copying begins.\n \n \n \n Removes the specified item from the .\n \n The item to remove.\n true if the item was successfully removed; false, otherwise.\n \n \n \n Returns an for the .\n \n An enumerable collection of items.\n \n \n \n Returns an .\n \n An for the .\n \n \n \n Gets or sets the item at the specified index.\n \n The index at which to get or set the item.\n The item at the specified index.\n \n \n \n Gets the number of operations in this .\n \n The number of operations in the .\n \n \n \n Gets a value indicating whether the is read-only.\n \n true if the is read-only; false, otherwise.\n \n \n \n Represents a single table operation.\n \n \n Represents a single table operation.\n \n \n \n \n Creates a new table operation that retrieves the contents of\n the given entity in a table.\n \n The class of type for the entity to retrieve.\n A string containing the partition key of the entity to retrieve.\n A string containing the row key of the entity to retrieve. \n The object.\n \n \n \n Creates a new table operation that retrieves the contents of\n the given entity in a table.\n \n The return type which the specified will resolve the given entity to.\n A string containing the partition key of the entity to retrieve.\n A string containing the row key of the entity to retrieve.\n The implementation to project the entity to retrieve as a particular type in the result.\n The object.\n \n \n \n Creates a new instance of the class given the\n entity to operate on and the type of operation that is being\n performed.\n \n The entity on which the operation is being performed.\n The type of operation.\n \n \n \n Creates a new table operation that deletes the given entity\n from a table.\n \n The entity to be deleted from the table.\n The object.\n \n \n \n Creates a new table operation that inserts the given entity\n into a table.\n \n The entity to be inserted into the table.\n The object.\n \n \n \n Creates a new table operation that inserts the given entity\n into a table.\n \n The entity to be inserted into the table.\n true if the message payload should be returned in the response to the insert operation. false otherwise.\n The table operation.\n \n \n \n Creates a new table operation that inserts the given entity\n into a table if the entity does not exist; if the entity does\n exist then its contents are merged with the provided entity.\n \n The entity whose contents are being inserted\n or merged.\n The object.\n \n \n \n Creates a new table operation that inserts the given entity\n into a table if the entity does not exist; if the entity does\n exist then its contents are replaced with the provided entity.\n \n The entity whose contents are being inserted\n or replaced.\n The object.\n \n \n \n Creates a new table operation that merges the contents of\n the given entity with the existing entity in a table.\n \n The entity whose contents are being merged.\n The object.\n \n \n \n Creates a new table operation that replaces the contents of\n the given entity in a table.\n \n The entity whose contents are being replaced.\n The object.\n \n \n \n Creates a new table operation that replaces the contents of\n the given entity in a table.\n \n The partition key of the entity to be replaced.\n The row key of the entity to be replaced.\n The object.\n \n \n \n Gets the entity that is being operated upon.\n \n \n \n \n Gets the type of operation.\n \n \n \n \n Gets or sets the value that represents whether the message payload should be returned in the response.\n \n \n \n \n Represents a query against a Windows Azure table.\n \n A class which implements .\n \n Represents a query against a specified table.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Executes a query on a table, using the specified and .\n \n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n An enumerable collection, specialized for type TElement, of the results of executing the query. \n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to execute a query and return the results as a result segment.\n \n The reference to the pending asynchronous request to finish.\n A result segment containing objects of type .\n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n A of object that represents the current operation.\n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null./// A to observe while waiting for a task to complete.\n A of object that represents the current operation.\n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n An object for tracking the current operation.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n A of object that represents the current operation.\n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n An object for tracking the current operation.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n A to observe while waiting for a task to complete.\n A of object that represents the current operation.\n \n \n \n Queries a table in segmented mode using the specified continuation token, , and .\n \n A object representing a continuation token from the server when the operation returns a partial result.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object for tracking the current operation.\n A , specialized for type TElement, containing the results of executing the query.\n \n \n \n Returns an enumerator that iterates through the .\n \n An for the .\n \n \n \n Generates a property filter condition string for the string value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A string containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the boolean value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A bool containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the binary value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A byte array containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value, formatted as the specified .\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A string containing the value to compare with the property.\n The to format the value as.\n A string containing the formatted filter condition.\n \n \n \n Creates a filter condition using the specified logical operator on two filter conditions.\n \n A string containing the first formatted filter condition.\n A string containing Operators.AND or Operators.OR.\n A string containing the second formatted filter condition.\n A string containing the combined filter expression.\n \n \n \n Defines the property names of the table entity properties to return when the table query is executed. \n \n The select clause is optional on a table query, used to limit the table properties returned from the server. By default, a query will return all properties from the table entity.\n A list of string objects containing the property names of the table entity properties to return when the query is executed.\n A instance set with the table entity properties to return.\n \n \n \n Defines the upper bound for the number of entities the query returns.\n \n The maximum number of entities for the table query to return.\n A instance set with the number of entities to return.\n \n \n \n Defines a filter expression for the table query. Only entities that satisfy the specified filter expression will be returned by the query. \n \n Setting a filter expression is optional; by default, all entities in the table are returned if no filter expression is specified in the table query.\n A string containing the filter expression to apply to the table query.\n A instance set with the filter on entities to return.\n \n \n \n Gets the type of the element(s) that are returned when the expression tree is executed.\n \n \n \n \n Gets the expression tree.\n \n \n \n \n Gets the query provider that is associated with this data source.\n \n \n \n \n Gets or sets the number of entities the query returns specified in the table query. \n \n The maximum number of entities for the table query to return.\n \n \n \n Gets or sets the filter expression to use in the table query.\n \n A string containing the filter expression to use in the query.\n \n \n \n Gets or sets the property names of the table entity properties to return when the table query is executed.\n \n A list of strings containing the property names of the table entity properties to return when the query is executed.\n \n \n \n Represents a query against a specified table.\n \n The class aggregates and encodes the query parameters to pass with the request when the query is executed. \n To execute the query, call the executeQuery or executeQuerySegmented method of the class. \n \n \n \n Represents a query against a specified table.\n \n A instance aggregates the query parameters to use when the query is executed. One of the executeQuery or executeQuerySegmented methods \n of must be called to execute the query. The parameters are encoded and passed to the server when the table query is executed.\n \n \n \n Specifies the names of the entity properties to return when the query is executed against the table. \n \n The Project clause is optional on a query, used to limit the properties returned from the server. By default, a query will return all properties from the entity.\n The entity type of the query. \n The entity instance to project off of.\n A list of string objects containing the names of the entity properties to return when the query is executed.\n A instance set with the entity properties to return.\n \n \n \n Generates a property filter condition string for the string value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A string containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the boolean value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A bool containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the binary value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A byte array containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value.\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A containing the value to compare with the property.\n A string containing the formatted filter condition.\n \n \n \n Generates a property filter condition string for the value, formatted as the specified .\n \n A string containing the name of the property to compare.\n A string containing the comparison operator to use.\n A string containing the value to compare with the property.\n The to format the value as.\n A string containing the formatted filter condition.\n \n \n \n Creates a filter condition using the specified logical operator on two filter conditions.\n \n A string containing the first formatted filter condition.\n A string containing Operators.AND or Operators.OR.\n A string containing the second formatted filter condition.\n A string containing the combined filter expression.\n \n \n \n Defines the property names of the table entity properties to return when the table query is executed. \n \n The select clause is optional on a table query, used to limit the table properties returned from the server. By default, a query will return all properties from the table entity.\n A list of string objects containing the property names of the table entity properties to return when the query is executed.\n A instance set with the table entity properties to return.\n \n \n \n Defines the upper bound for the number of entities the query returns.\n \n The maximum number of entities for the table query to return.\n A instance set with the number of entities to return.\n \n \n \n Defines a filter expression for the table query. Only entities that satisfy the specified filter expression will be returned by the query. \n \n Setting a filter expression is optional; by default, all entities in the table are returned if no filter expression is specified in the table query.\n A string containing the filter expression to apply to the table query.\n A instance set with the filter on entities to return.\n \n \n \n Gets or sets the number of entities the table query will return. \n \n The maximum number of entities for the table query to return.\n \n \n \n Gets or sets the filter expression to use in the table query.\n \n A string containing the filter expression to use in the query.\n \n \n \n Gets or sets the property names of the table entity properties to return when the table query is executed.\n \n A list of strings containing the property names of the table entity properties to return when the query is executed.\n \n \n \n Represents the default EDM entity container for table storage.\n \n \n \n \n Initializes a new instance of the EdmEntityContainer class and sets the model and entity set. The name and namespace should not matter since we look for default entity container.\n \n Sets the data model that will be used for table transactions. \n \n \n \n Searches for an entity set with the given name in this entity container and creates a new set if no such set exists.\n \n The name of the element being found.\n The requested element, or the new element created if no such element exists.\n \n \n \n Represents a data model that will be used by OData for table transactions.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Searches for a type with the given name in this model and creates a new type if no such type exists.\n \n The qualified name of the type being found.\n The requested type, or the new type created if no such type exists.\n \n \n \n Create a new type with the standard set of properties(PK, RK and TimeStamp).\n \n Namespace the entity belongs to.\n Name of the entity.\n The EdmEntityType created.\n \n \n \n Searches for a type with the given name in this model. Returns true if such a type is found, otherwise returns false.\n \n The qualified name of the type being found.\n true if the type is found; otherwise, false.\n \n \n \n Represents a object for use with the Windows Azure Table service.\n \n The class does not support concurrent queries or requests.\n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Callback on DataContext object sending request.\n \n The sender.\n The instance containing the event data. \n \n \n \n Saves changes, using the retry policy specified for the service context.\n \n A that represents the result of the operation.\n \n \n \n Saves changes, using the retry policy specified for the service context.\n \n Additional options for saving changes.\n \n \n A that represents the result of the operation.\n \n \n \n Begins an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n Additional options for saving changes.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n Additional options for saving changes.\n An object for tracking the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n \n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to save changes.\n \n An that references the pending asynchronous operation.\n A that represents the result of the operation.\n \n \n \n Returns a object that performs an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n A object that represents the current operation.\n \n \n \n Returns a object that performs an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a object that performs an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n Additional options for saving changes.\n A object that represents the current operation.\n \n \n \n Returns a object that performs an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n Additional options for saving changes.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a object that performs an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n Additional options for saving changes.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a object that performs an asynchronous operation to save changes, using the retry policy specified for the service context.\n \n Additional options for saving changes.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Releases all resources used by the TableServiceContext.\n \n \n \n \n Releases the unmanaged resources used by the TableServiceContext and optionally releases the managed resources.\n \n true to release both managed and unmanaged resources; false to release only unmanaged resources.\n \n \n \n Gets the object that represents the Table service.\n \n A client object that specifies the Table service endpoint.\n \n \n \n Gets the authentication handler used to sign HTTP requests.\n \n The authentication handler.\n \n \n \n Represents an entity in the Windows Azure Table service.\n \n \n \n \n Initializes a new instance of the class.\n \n The partition key.\n The row key.\n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets or sets the timestamp for the entity.\n \n The entity's timestamp.\n \n \n \n Gets or sets the partition key of a table entity.\n \n The partition key.\n \n \n \n Gets or sets the row key of a table entity.\n \n The row key.\n \n \n \n Provides a set of extensions for the Table service.\n \n \n \n \n Converts the query into a object that supports \n additional operations like retries.\n \n The type of the element.\n The query.\n A object that represents the runtime context of the Table service.\n The converted query.\n \n \n \n A class for constructing a query against the Table service.\n \n The type of the element. \n \n \n \n Initializes a new instance of the class.\n \n An object that implements .\n A object.\n \n \n \n Expands the specified path.\n \n The path to expand.\n A new query with the expanded path.\n \n \n \n Returns an enumerator that iterates through the collection.\n \n \n A that can be used to iterate through the collection.\n \n \n \n \n Executes the request with any specified options.\n \n An object of type .\n An object for tracking the current operation.\n An enumerable collection, specialized for type TElement, of the results of executing the query.\n \n \n \n Executes a segmented query against the Table service.\n \n The continuation token.\n The request options.\n An object for tracking the current operation.\n A result segment containing objects of type .\n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Begins an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n A object that specifies additional options for the request.\n An object that represents the context for the current operation.\n The callback delegate that will receive notification when the asynchronous operation completes.\n A user-defined object that will be passed to the callback delegate.\n An that references the asynchronous operation.\n \n \n \n Ends an asynchronous operation to execute a query and return the results as a result segment.\n \n The reference to the pending asynchronous request to finish.\n A result segment containing objects of type .\n \n \n \n Returns a task that performs an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A object that represents the current operation.\n \n \n \n Returns a task that performs an asynchronous operation to execute a query and return the results as a result segment.\n \n A continuation token returned by a previous listing operation, can be null.\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n An object that represents the context for the current operation.\n A to observe while waiting for a task to complete.\n A object that represents the current operation.\n \n \n \n Gets the table service context.\n \n \n An object of type .\n \n \n \n \n Stores the wrapped .\n \n \n \n \n Gets the type of the element(s) that are returned when the expression tree associated with this \n instance of is executed.\n \n \n A that represents the type of the element(s) that are returned when the expression tree associated with this object is executed.\n \n \n \n \n Gets the expression tree that is associated with the instance of .\n \n \n The that is associated with this instance of .\n \n \n \n \n Gets the query provider that is associated with this data source.\n \n \n The that is associated with this data source.\n \n \n \n \n A factory class for constructing a web request to manage tables in the Table service.\n \n \n \n \n Creates a web request to get the properties of the Table service.\n \n The absolute URI to the Table service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to get the Table service properties.\n \n \n \n \n Creates a web request to set the properties of the Table service.\n \n The absolute URI to the Table service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to set the Table service properties.\n \n \n \n \n Creates a web request to get the stats of the Table service.\n \n The absolute URI to the Table service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval, in seconds.\n An object for tracking the current operation.\n \n A web request to get the Table service stats.\n \n \n \n \n Writes Table service properties to a stream, formatted in XML.\n \n The service properties to format and write to the stream.\n The stream to which the formatted properties are to be written.\n \n \n \n Constructs a web request to return the ACL for a table.\n \n The absolute URI to the table.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Constructs a web request to set the ACL for a table.\n \n The absolute URI to the table.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval.\n An object for tracking the current operation.\n \n A web request to use to perform the operation.\n \n \n \n \n Provides a set of methods for parsing a response stream from the Table service.\n \n \n \n \n Gets the request ID from the response.\n \n The web response.\n A unique value associated with the request.\n \n \n \n Reads service properties from a stream.\n \n The stream from which to read the service properties.\n The service properties stored in the stream.\n \n \n \n Reads service stats from a stream.\n \n The stream from which to read the service stats.\n The service stats stored in the stream.\n \n \n \n Reads the share access policies from a stream in XML.\n \n The stream of XML policies.\n The permissions object to which the policies are to be written.\n \n \n \n Gets the table continuation from response.\n \n The response.\n The continuation.\n \n \n \n Translates the data service exception.\n \n The exception.\n The request result.\n The delegate used to parse the error to get extended error information.\n \n The translated exception.\n \n \n \n \n Look for an inner exception of type T. \n \n The exception.\n The found exception or null.\n \n \n \n Applies the continuation to query.\n \n The continuation token.\n The local query.\n The modified query.\n \n \n \n Gets the query take count.\n \n The type of the element.\n The query.\n The default value.\n \n The take count of the query, if any.\n \n \n \n \n Gets the table continuation from response.\n \n The response.\n The continuation.\n \n \n \n Copies the headers and properties from a request into a different request.\n \n The request to copy into.\n The request to copy from.\n \n \n \n Gets an ETag from a response.\n \n The web response.\n A quoted ETag string.\n \n \n \n Gets the user-defined metadata.\n \n The response from server.\n A of the metadata.\n \n \n \n Gets the metadata or properties.\n \n The response from server.\n The prefix for all the headers.\n A of the headers with the prefix.\n \n \n \n Converts a string to UTC time.\n \n The string to convert.\n A UTC representation of the string.\n \n \n \n Reads service properties from a stream.\n \n The stream from which to read the service properties.\n The service properties stored in the stream.\n \n \n \n Reads service stats from a stream.\n \n The stream from which to read the service stats.\n The service stats stored in the stream.\n \n \n \n Reads a collection of shared access policies from the specified object.\n \n A collection of shared access policies to be filled.\n A policy response object for reading the stream.\n The type of policy to read.\n \n \n \n Creates the web request.\n \n The HTTP method.\n The request URI.\n The timeout.\n An object of type , containing additional parameters to add to the URI query string.\n An object for tracking the current operation.\n \n A web request for performing the operation.\n \n \n \n \n Creates the specified URI.\n \n The URI to create.\n The timeout.\n The builder.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Constructs a web request to return the ACL for a cloud resource.\n \n The absolute URI to the resource.\n The server timeout interval.\n An optional query builder to use.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Constructs a web request to set the ACL for a cloud resource.\n \n The absolute URI to the resource.\n The server timeout interval.\n An optional query builder to use.\n An object for tracking the current operation.\n A web request to use to perform the operation.\n \n \n \n Gets the properties.\n \n The URI to query.\n The timeout.\n The builder.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Gets the metadata.\n \n The blob Uri.\n The timeout.\n The builder.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Sets the metadata.\n \n The blob Uri.\n The timeout.\n The builder.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Adds the metadata.\n \n The request.\n The metadata.\n \n \n \n Adds the metadata.\n \n The request.\n The metadata name.\n The metadata value.\n \n \n \n Deletes the specified URI.\n \n The URI of the resource to delete.\n The timeout.\n The builder.\n An object for tracking the current operation.\n A web request for performing the operation.\n \n \n \n Creates a web request to get the properties of the service.\n \n The absolute URI to the service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval.\n An object for tracking the current operation.\n \n A web request to get the service properties.\n \n \n \n \n Creates a web request to set the properties of the service.\n \n The absolute URI to the service.\n The builder.\n The server timeout interval.\n An object for tracking the current operation.\n \n A web request to set the service properties.\n \n \n \n \n Creates a web request to get the stats of the service.\n \n The absolute URI to the service.\n An object of type , containing additional parameters to add to the URI query string.\n The server timeout interval.\n An object for tracking the current operation.\n \n A web request to get the service stats.\n \n \n \n \n Generates a query builder for building service requests.\n \n A for building service requests.\n \n \n \n Adds the lease id.\n \n The request.\n The lease id.\n \n \n \n Adds an optional header to a request.\n \n The web request.\n The metadata name.\n The metadata value.\n \n \n \n Adds an optional header to a request.\n \n The web request.\n The header name.\n The header value.\n \n \n \n Adds an optional header to a request.\n \n The web request.\n The header name.\n The header value.\n \n \n \n Applies the lease condition to the web request.\n \n The request to be modified.\n Access condition to be added to the request.\n \n \n \n Applies the sequence number condition to the web request.\n \n The request to be modified.\n Access condition to be added to the request.\n \n \n \n Applies the condition to the web request.\n \n The request to be modified.\n Access condition to be added to the request.\n \n \n \n Applies the condition for a source blob to the web request.\n \n The request to be modified.\n Access condition to be added to the request.\n \n \n \n Creates a well-formatted log entry so that logs can be easily parsed\n \n An object that represents the context for the current operation.\n A composite format string.\n An object array that contains zero or more objects to format.\n Log entry that contains common log prefix and a copy of format in which the format items have been replaced by the string representation of the corresponding objects in args.\n \n \n \n Determines if the current operation context allows for a specific level of log entry.\n \n Level of the log entry.\n An object that represents the context for the current operation.\n true if the entry should be logged; otherwise false.\n \n \n \n Represents a canonicalizer that converts HTTP request data into a standard form appropriate for signing.\n For detailed information on how to authenticate a request, \n see Authentication for the Windows Azure Storage Services.\n \n \n \n \n Converts the specified HTTP request data into a standard form appropriate for signing.\n \n The HTTP request that needs to be signed.\n The name of the storage account that the HTTP request will access.\n The canonicalized string containing the HTTP request data in a standard form appropriate for signing.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets the authorization scheme used for canonicalization.\n \n The authorization scheme used for canonicalization.\n Authentication for the Windows Azure Storage Services\n \n \n \n Represents a canonicalizer that converts HTTP request data into a standard form appropriate for signing via \n the Shared Key authentication scheme for the Blob or Queue service.\n \n Authentication for the Windows Azure Storage Services\n \n \n \n Converts the specified HTTP request data into a standard form appropriate for signing.\n \n The HTTP request that needs to be signed.\n The name of the storage account that the HTTP request will access.\n The canonicalized string containing the HTTP request data in a standard form appropriate for signing.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets a static instance of the object.\n \n The static instance of the class.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets the authorization scheme used for canonicalization.\n \n The authorization scheme used for canonicalization.\n Authentication for the Windows Azure Storage Services\n \n \n \n Represents a canonicalizer that converts HTTP request data into a standard form appropriate for signing via \n the Shared Key Lite authentication scheme for the Blob or Queue service.\n \n Authentication for the Windows Azure Storage Services\n \n \n \n Converts the specified HTTP request data into a standard form appropriate for signing.\n \n The HTTP request that needs to be signed.\n The name of the storage account that the HTTP request will access.\n The canonicalized string containing the HTTP request data in a standard form appropriate for signing.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets a static instance of the object.\n \n The static instance of the class.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets the authorization scheme used for canonicalization.\n \n The authorization scheme used for canonicalization.\n Authentication for the Windows Azure Storage Services\n \n \n \n Represents a canonicalizer that converts HTTP request data into a standard form appropriate for signing via \n the Shared Key Lite authentication scheme for the Table service.\n \n Authentication for the Windows Azure Storage Services\n \n \n \n Converts the specified HTTP request data into a standard form appropriate for signing.\n \n The HTTP request that needs to be signed.\n The name of the storage account that the HTTP request will access.\n The canonicalized string containing the HTTP request data in a standard form appropriate for signing.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets a static instance of the object.\n \n The static instance of the class.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets the authorization scheme used for canonicalization.\n \n The authorization scheme used for canonicalization.\n Authentication for the Windows Azure Storage Services\n \n \n \n Represents a canonicalizer that converts HTTP request data into a standard form appropriate for signing via \n the Shared Key authentication scheme for the Table service.\n \n Authentication for the Windows Azure Storage Services\n \n \n \n Converts the specified HTTP request data into a standard form appropriate for signing.\n \n The HTTP request that needs to be signed.\n The name of the storage account that the HTTP request will access.\n The canonicalized string containing the HTTP request data in a standard form appropriate for signing.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets a static instance of the object.\n \n The static instance of the class.\n Authentication for the Windows Azure Storage Services\n \n \n \n Gets the authorization scheme used for canonicalization.\n \n The authorization scheme used for canonicalization.\n Authentication for the Windows Azure Storage Services\n \n \n \n Helper class to allow an APM Method to be executed with a given timeout in milliseconds\n \n \n \n \n Helper class to convert an APM method to a Task method.\n \n \n \n \n This class provides asynchronous semaphore functionality (based on Stephen Toub's blog).\n \n \n \n \n Creates and initializes a new asynchronous copy operation.\n \n The source stream.\n The destination stream.\n An ExecutionState used to coordinate copy operation.\n Size of read and write buffers used to move data.\n Boolean value indicating whether the MD-5 should be calculated.\n An object that represents the state for the current operation.\n \n \n \n Begins a stream copy operation.\n \n Callback delegate\n Number of bytes to copy from source stream to destination stream. Cannot be passed with a value for maxLength.\n Maximum length of the source stream. Cannot be passed with a value for copyLength.\n \n \n \n Aborts an ongoing copy operation.\n \n \n \n \n Cleans up references. To end a copy operation, use Abort().\n \n \n \n \n Synchronizes Read and Write operations, and handles exceptions.\n \n Read/Write operation or null if first run.\n \n \n \n Helper method for EndOpWithCatch(IAsyncResult). Begins/Ends Read and Write Stream operations.\n Should only be called by EndOpWithCatch(IAsyncResult) since it assumes we are inside the lock.\n \n Read/Write operation or null if first run.\n \n \n \n Callback for timeout timer. Aborts the AsyncStreamCopier operation if a timeout occurs.\n \n AsyncStreamCopier operation.\n True if the timer has timed out, false otherwise.\n \n \n \n Aborts the AsyncStreamCopier operation.\n \n AsyncStreamCopier operation.\n True if aborted due to a time out, or false for a general cancellation.\n \n \n \n Terminates and cleans up the AsyncStreamCopier.\n \n \n \n \n Helper method for this.SignalCompletion()\n Should only be called by this.SignalCompletion()\n \n \n \n \n Determines whether the next operation should begin or halt due to an exception or cancellation.\n \n True to continue, false to halt.\n \n \n \n Waits for a read operation to end and updates the AsyncStreamCopier state.\n \n \n \n \n Waits for a write operation to end and updates the AsyncStreamCopier state.\n \n \n \n \n If a read operation has completed with data, swaps the read/write buffers and resets their corresponding counts.\n This must be called inside a lock as it could lead to undefined behavior if multiple unsynchronized callers simultaneously called in.\n \n Number of bytes to write, or negative if no read operation has completed.\n \n \n \n Determines the number of bytes that should be read from the source in the next BeginRead operation.\n Should only be called when no outstanding read operations exist.\n \n Number of bytes to read.\n \n \n \n Determines whether no more data can be read from the source Stream.\n \n True if at the end, false otherwise.\n \n \n \n Determines whether the current read buffer contains data ready to be written.\n \n True if read buffer is full, false otherwise.\n \n \n \n Represents an operation that supports cancellation. Used by\n ICancellableAsyncResult implementations throughout the library.\n Also used by AsyncExtensions as a bridge between CancellationToken\n and the ICancellableAsyncResult returned by an APM method call.\n \n \n \n \n The class is provides the helper functions to do FISMA compliant MD5.\n \n \n \n \n Cryptographic service provider.\n \n \n \n \n Access to the private keys is not required and the user interface can be bypassed.\n \n \n \n \n ALG_ID value that identifies the hash algorithm to use.\n \n \n \n \n The hash value or message hash for the hash object specified by hashHandle. \n \n \n \n \n The address to which the function copies a handle to the new hash object. Has to be released by calling the CryptDestroyHash function after we are finished using the hash object.\n \n \n \n \n A handle to a CSP created by a call to CryptAcquireContext.\n \n \n \n \n Whether this object has been torn down or not.\n \n \n \n \n Initializes a new instance of NativeMD5.\n \n \n \n \n Finalizes an instance of the NativeMD5 class, unhooking it from all events.\n \n \n \n \n Initializes an implementation of the NativeMD5 class.\n \n \n \n \n Routes data written to the object into the hash algorithm for computing the hash.\n \n The input to compute the hash code for.\n The offset into the byte array from which to begin using data.\n The number of bytes in the byte array to use as data.\n \n \n \n Finalizes the hash computation after the last data is processed by the cryptographic stream object.\n \n The computed hash code.\n \n \n \n Releases the unmanaged resources used by the NativeMD5.\n \n true to release both managed and unmanaged resources; false to release only unmanaged resources.\n \n \n \n Validates the status returned by all the crypto functions and throws exception per the return code.\n \n The boolean status returned by the crypto functions.\n \n \n \n Represents the async result returned by operations that do not directly\n call into the Executor.\n \n Async operation's result type\n \n \n \n Represents the async result returned by a storage command.\n \n \n \n \n The callback provided by the user.\n \n \n \n \n The state for the callback.\n \n \n \n \n Indicates whether a task is completed.\n \n \n \n \n Indicates whether task completed synchronously.\n \n \n \n \n The event for blocking on this task's completion.\n \n \n \n \n Initializes a new instance of the StorageCommandAsyncResult class.\n \n The callback method to be used on completion.\n The state for the callback.\n \n \n \n We implement the dispose only to allow the explicit closing of the event.\n \n \n \n \n Releases unmanaged and - optionally - managed resources.\n \n Set to true to release both managed and unmanaged resources; false to release only unmanaged resources.\n \n \n \n Provides the lazy initialization of the WaitHandle (based on Joe Duffy's blog).\n \n The WaitHandle to use for waiting on completion.\n \n \n \n Called on completion of the async operation to notify the user\n (Based on Joe Duffy's lockless design).\n \n \n \n \n Blocks the calling thread until the async operation is completed.\n \n \n \n \n Updates the CompletedSynchronously flag with another asynchronous operation result.\n \n Set to true if the last operation was completed synchronously; false if it was completed asynchronously.\n \n \n \n Gets A user-defined object that contains information about the asynchronous operation.\n \n \n \n \n Gets a System.Threading.WaitHandle that is used to wait for an asynchronous operation to complete.\n \n \n \n \n Gets a value indicating whether the asynchronous operation completed synchronously.\n \n \n \n \n Gets a value indicating whether the asynchronous operation has completed.\n \n \n \n \n Initializes a new instance of the StorageAsyncResult class.\n \n The callback method to be used on completion.\n The state for the callback.\n \n \n \n Called on completion of the async operation to notify the user\n \n Exception that was caught by the caller.\n \n \n \n Blocks the calling thread until the async operation is completed and throws\n any stored exceptions.\n \n \n \n \n Represents a set of access conditions to be used for operations against the storage services. \n \n \n \n \n Time for IfModifiedSince.\n \n \n \n \n Time for IfUnmodifiedSince.\n \n \n \n \n Constructs an empty access condition.\n \n An empty access condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if the resource's ETag value\n matches the specified ETag value.\n \n The ETag value that must be matched.\n An AccessCondition object that represents the If-Match condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if the resource has been\n modified since the specified time.\n \n The time since which the resource must have been modified in order for the operation to proceed.\n An AccessCondition object that represents the If-Modified-Since condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if the resource's ETag value\n does not match the specified ETag value.\n \n The ETag value that must be matched, or \"*\".\n An AccessCondition object that represents the If-None-Match condition.\n \n If \"*\" is specified as the parameter then this condition requires that the resource does not exist.\n \n \n \n \n Constructs an access condition such that an operation will be performed only if the resource has not been\n modified since the specified time.\n \n The time since which the resource must not have been modified in order for the operation to proceed.\n An AccessCondition object that represents the If-Unmodified-Since condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if resource's current sequence\n number is less than or equal to the specified value.\n \n The value that the current sequence number of the resource must be less than or equal to.\n An AccessCondition object that represents the If-Sequence-Number-LE condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if resource's current sequence\n number is less than the specified value.\n \n The value that the current sequence number of the resource must be less than.\n An AccessCondition object that represents the If-Sequence-Number-LT condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if resource's current sequence\n number is equal to the specified value.\n \n The value that the current sequence number of the resource must be equal to.\n An AccessCondition object that represents the If-Sequence-Number-EQ condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if the lease ID on the\n resource matches the specified lease ID.\n \n The lease ID that must match the lease ID of the resource.\n An AccessCondition object that represents the lease condition.\n \n \n \n Constructs an access condition such that an operation will be performed only if the resource's ETag value\n matches the specified ETag value and the lease ID on the resource matches the lease ID specified in\n the given access condition.\n \n An AccessCondition object that represents the lease condition.\n The ETag value that must be matched.\n An AccessCondition object that represents the If-Match and the lease conditions.\n \n \n \n Gets or sets an ETag value that must match the ETag of the specified resource.\n \n A string containing an ETag value, or \"*\" to match any ETag. If null, no condition exists.\n \n \n \n Gets or sets an ETag value that must not match the ETag of the specified resource.\n \n A string containing an ETag value, or \"*\" to match any ETag. If null, no condition exists.\n \n \n \n Gets or sets a time that must be before the last modification of a resource.\n \n A DateTimeOffset in UTC, or null if no condition exists.\n \n \n \n Gets or sets a time that must not be before the last modification of a resource.\n \n A DateTimeOffset in UTC, or null if no condition exists.\n \n \n \n Gets or sets a sequence number that the current sequence number of a page blob must be less than or equal to in order for the operation to proceed.\n \n A sequence number, or null if no condition exists.\n This condition only applies to page blobs.\n \n \n \n Gets or sets a sequence number that the current sequence number of a page blob must be less than in order for the operation to proceed.\n \n A sequence number, or null if no condition exists.\n This condition only applies to page blobs.\n \n \n \n Gets or sets a sequence number that the current sequence number of a page blob must be equal to in order for the operation to proceed.\n \n A sequence number, or null if no condition exists.\n This condition only applies to page blobs.\n \n \n \n Gets or sets a lease ID that must match the lease on a resource.\n \n A lease ID, or null if no condition exists.\n \n \n \n Determines whether the access condition is one of the four conditional headers.\n \n true if the access condition is a conditional header; otherwise, false.\n \n \n \n Specifies the authentication scheme used to sign HTTP requests.\n \n \n \n \n Signs HTTP requests using the Shared Key Lite authentication scheme.\n \n \n \n \n Signs HTTP requests using the Shared Key authentication scheme.\n \n \n \n \n Represents a Windows Azure Storage account.\n \n \n \n \n The setting name for using the development storage.\n \n \n \n \n The setting name for specifying a development storage proxy Uri.\n \n \n \n \n The setting name for using the default storage endpoints with the specified protocol.\n \n \n \n \n The setting name for the account name.\n \n \n \n \n The setting name for the account key name.\n \n \n \n \n The setting name for the account key.\n \n \n \n \n The setting name for a custom blob storage endpoint.\n \n \n \n \n The setting name for a custom queue endpoint.\n \n \n \n \n The setting name for a custom table storage endpoint.\n \n \n \n \n The setting name for a custom storage endpoint suffix.\n \n \n \n \n The setting name for a shared access key.\n \n \n \n \n The default account name for the development storage.\n \n \n \n \n The default account key for the development storage.\n \n \n \n \n The credentials string used to test for the development storage credentials.\n \n \n \n \n The suffix appended to account in order to access secondary location for read only access.\n \n \n \n \n The default storage service hostname suffix.\n \n \n \n \n The default blob storage DNS hostname prefix.\n \n \n \n \n The root queue DNS name prefix.\n \n \n \n \n The root table storage DNS name prefix.\n \n \n \n \n The FISMA compliance default value.\n \n \n \n \n Validator for the UseDevelopmentStorage setting. Must be \"true\".\n \n \n \n \n Validator for the DevelopmentStorageProxyUri setting. Must be a valid Uri.\n \n \n \n \n Validator for the DefaultEndpointsProtocol setting. Must be either \"http\" or \"https\".\n \n \n \n \n Validator for the AccountName setting. No restrictions.\n \n \n \n \n Validator for the AccountKey setting. No restrictions.\n \n \n \n \n Validator for the AccountKey setting. Must be a valid base64 string.\n \n \n \n \n Validator for the BlobEndpoint setting. Must be a valid Uri.\n \n \n \n \n Validator for the QueueEndpoint setting. Must be a valid Uri.\n \n \n \n \n Validator for the TableEndpoint setting. Must be a valid Uri.\n \n \n \n \n Validator for the EndpointSuffix setting. Must be a valid Uri.\n \n \n \n \n Validator for the SharedAccessSignature setting. No restrictions.\n \n \n \n \n Singleton instance for the development storage account.\n \n \n \n \n Initializes a new instance of the class using the specified\n account credentials and service endpoints.\n \n The account credentials.\n The Blob service endpoint.\n The Queue service endpoint.\n The Table service endpoint.\n \n \n \n Initializes a new instance of the class using the specified\n account credentials and service endpoints.\n \n The account credentials.\n The Blob service endpoint.\n The Queue service endpoint.\n The Table service endpoint.\n \n \n \n Initializes a new instance of the class using the specified\n account credentials and the default service endpoints. \n \n An object of type that \n specifies the account name and account key for the storage account.\n True to use HTTPS to connect to storage service endpoints; otherwise, false.\n \n \n \n Initializes a new instance of the class using the specified\n account credentials and the default service endpoints. \n \n An object of type that \n specifies the account name and account key for the storage account.\n The DNS endpoint suffix for all storage services, e.g. \"core.windows.net\".\n True to use HTTPS to connect to storage service endpoints; otherwise, false.\n \n \n \n Parses a connection string and returns a created\n from the connection string.\n \n A valid connection string.\n Thrown if is null or empty.\n Thrown if is not a valid connection string.\n Thrown if cannot be parsed.\n A object constructed from the values provided in the connection string.\n \n \n \n Indicates whether a connection string can be parsed to return a object.\n \n The connection string to parse.\n A object to hold the instance returned if\n the connection string can be parsed.\n true if the connection string was successfully parsed; otherwise, false.\n \n \n \n Creates the Table service client.\n \n A client object that specifies the Table service endpoint.\n \n \n \n Creates the Queue service client.\n \n A client object that specifies the Queue service endpoint.\n \n \n \n Creates the Blob service client.\n \n A client object that specifies the Blob service endpoint.\n \n \n \n Returns a connection string for this storage account, without sensitive data.\n \n A connection string.\n \n \n \n Returns a connection string for the storage account, optionally with sensitive data.\n \n True to include sensitive data in the string; otherwise, false.\n A connection string.\n \n \n \n Returns a with development storage credentials using the specified proxy Uri.\n \n The proxy endpoint to use.\n The new .\n \n \n \n Internal implementation of Parse/TryParse.\n \n The string to parse.\n The to return.\n A callback for reporting errors.\n If true, the parse was successful. Otherwise, false.\n \n \n \n Tokenizes input and stores name value pairs.\n \n The string to parse.\n Error reporting delegate.\n Tokenized collection.\n \n \n \n Encapsulates a validation rule for an enumeration based account setting.\n \n The name of the setting.\n A list of valid values for the setting.\n An representing the enumeration constraint.\n \n \n \n Encapsulates a validation rule using a func.\n \n The name of the setting.\n A func that determines if the value is valid.\n An representing the constraint.\n \n \n \n Determines whether the specified setting value is a valid base64 string.\n \n The setting value.\n true if the specified setting value is a valid base64 string; otherwise, false.\n \n \n \n Validation function that validates Uris.\n \n Value to validate.\n true if the specified setting value is a valid Uri; otherwise, false.\n \n \n \n Validation function that validates a domain name.\n \n Value to validate.\n true if the specified setting value is a valid domain; otherwise, false.\n \n \n \n Settings filter that requires all specified settings be present and valid.\n \n A list of settings that must be present.\n The remaining settings or null if the filter's requirement is not satisfied.\n \n \n \n Settings filter that removes optional values.\n \n A list of settings that are optional.\n The remaining settings or null if the filter's requirement is not satisfied.\n \n \n \n Settings filter that ensures that at least one setting is present.\n \n A list of settings of which one must be present.\n The remaining settings or null if the filter's requirement is not satisfied.\n \n \n \n Settings filter that ensures that a valid combination of credentials is present.\n \n The remaining settings or null if the filter's requirement is not satisfied.\n \n \n \n Tests to see if a given list of settings matches a set of filters exactly.\n \n The settings to check.\n A list of filters to check.\n \n If any filter returns null, false.\n If there are any settings left over after all filters are processed, false.\n Otherwise true.\n \n \n \n \n Gets a StorageCredentials object corresponding to whatever credentials are supplied in the given settings.\n \n The settings to check.\n The StorageCredentials object specified in the settings.\n \n \n \n Gets the default blob endpoint using specified settings.\n \n The settings to use.\n The default blob endpoint.\n \n \n \n Gets the default blob endpoint using the specified protocol and account name.\n \n The protocol to use.\n The name of the storage account.\n The Endpoint DNS suffix; use null for default.\n The default blob endpoint.\n \n \n \n Gets the default queue endpoint using the specified settings.\n \n The settings.\n The default queue endpoint.\n \n \n \n Gets the default queue endpoint using the specified protocol and account name.\n \n The protocol to use.\n The name of the storage account.\n The Endpoint DNS suffix; use null for default.\n The default queue endpoint.\n \n \n \n Gets the default table endpoint using the specified settings.\n \n The settings.\n The default table endpoint.\n \n \n \n Gets the default table endpoint using the specified protocol and account name.\n \n The protocol to use.\n The name of the storage account.\n The Endpoint DNS suffix; use null for default.\n The default table endpoint.\n \n \n \n Gets or sets a value indicating whether the FISMA MD5 setting will be used.\n \n false to use the FISMA MD5 setting; true to use the .NET default implementation.\n \n \n \n Gets a object that references the development storage account.\n \n A reference to the development storage account.\n \n \n \n Indicates whether this account is a development storage account.\n \n \n \n \n The storage service hostname suffix set by the user, if any.\n \n \n \n \n The connection string parsed into settings.\n \n \n \n \n True if the user used a constructor that auto-generates endpoints.\n \n \n \n \n Gets the primary endpoint for the Blob service, as configured for the storage account.\n \n The primary Blob service endpoint.\n \n \n \n Gets the primary endpoint for the Queue service, as configured for the storage account.\n \n The primary Queue service endpoint.\n \n \n \n Gets the primary endpoint for the Table service, as configured for the storage account.\n \n The primary Table service endpoint.\n \n \n \n Gets the endpoints for the Blob service, as configured for the storage account.\n \n An object of type containing the endpoints for the Blob service.\n \n \n \n Gets the endpoints for the Queue service, as configured for the storage account.\n \n An object of type containing the endpoints for the Queue service.\n \n \n \n Gets the endpoints for the Table service, as configured for the storage account.\n \n An object of type containing the endpoints for the Table service.\n \n \n \n Gets the credentials used to create this object.\n \n The credentials used to create the object.\n \n \n \n Specifies that the method will make one or more requests to the storage service. \n \n \n \n \n An interface that allows clients to provide a buffer manager to a given service client. This interface is patterned after\n the System.ServiceModel.Channels.BufferManager class.\n \n \n \n \n Returns a buffer to the pool.\n \n A reference to the buffer being returned.\n Buffer reference cannot be null.\n Length of buffer does not match the pool's buffer length property.\n \n \n \n Gets a buffer of at least the specified size from the pool.\n \n The size, in bytes, of the requested buffer.\n The value specified for cannot be less than zero.\n A byte array that is the requested size of the buffer.\n \n \n \n Gets the size, in bytes, of the buffers managed by the given pool. Note that the buffer manager must return buffers of the exact size requested by the client.\n \n The size, in bytes, of the buffers managed by the given pool.\n \n \n \n An interface required for continuation token types.\n \n The , , \n and classes implement the interface.\n \n \n \n Gets the location that the token applies to.\n \n The location that the token applies to.\n \n \n \n An interface required for request option types.\n \n The , , and classes implement the interface.\n \n \n \n Gets or sets the retry policy for the request.\n \n The retry policy delegate.\n \n \n \n Gets or sets the location mode of the request.\n \n The location mode of the request.\n \n \n \n Gets or sets the server timeout for the request. \n \n The client and server timeout interval for the request.\n \n \n \n Gets or sets the maximum execution time across all potential retries.\n \n The maximum execution time across all potential retries.\n \n \n \n Specifies what messages to output to the log.\n \n \n \n \n Output no tracing and debugging messages.\n \n \n \n \n Output error-handling messages.\n \n \n \n \n Output warnings and error-handling messages.\n \n \n \n \n Output informational messages, warnings, and error-handling messages.\n \n \n \n \n Output all debugging and tracing messages.\n \n \n \n \n Represents the context for a request operation against the storage service, and provides additional runtime information about its execution.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets or sets additional headers on the request, for example, for proxy or logging information.\n \n A object containing additional header information.\n \n \n \n Gets or sets the client request ID.\n \n The client request ID.\n \n \n \n Gets or sets the default logging level to be used for subsequently created instances of the class.\n \n A value of type that specifies which events are logged by default by instances of the .\n \n \n \n Gets or sets the logging level to be used for an instance of the class.\n \n A value of type that specifies which events are logged by the .\n \n \n \n Occurs immediately before a request is signed.\n \n \n \n \n Occurs when a response is received from the server.\n \n \n \n \n Gets or sets the start time of the operation.\n \n The start time of the operation.\n \n \n \n Gets or sets the end time of the operation.\n \n The end time of the operation.\n \n \n \n Gets or sets the set of request results that the current operation has created.\n \n An object that contains objects that represent the request results created by the current operation.\n \n \n \n Gets the last request result encountered for the operation.\n \n A object that represents the last request result.\n \n \n \n Provides information and event data that is associated with a request event.\n \n \n \n \n Initializes a new instance of the class by using the specified parameter.\n \n The object.\n \n \n \n Gets the request information associated with this event.\n \n The request information associated with this event.\n \n \n \n Gets the HTTP request associated with this event.\n \n The HTTP request associated with this event.\n \n \n \n Gets the HTTP response associated with this event.\n \n The HTTP response associated with this event.\n \n \n \n Represents the result of a physical request.\n \n \n \n \n Translates the specified message into a object.\n \n The message to translate.\n The translated .\n \n \n \n Generates a serializable RequestResult from its XML representation.\n \n The stream from which the RequestResult is deserialized.\n \n \n \n Converts a serializable RequestResult into its XML representation.\n \n The stream to which the RequestResult is serialized.\n \n \n \n Gets or sets the HTTP status code for the request.\n \n The HTTP status code for the request.\n \n \n \n Gets the HTTP status message for the request.\n \n The HTTP status message for the request.\n \n \n \n Gets the service request ID for this request.\n \n The service request ID for this request.\n \n \n \n Gets the content-MD5 value for the request. \n \n The content-MD5 value for the request.\n \n \n \n Gets the ETag value of the request.\n \n The ETag value of the request.\n \n \n \n Gets the request date.\n \n The request date.\n \n \n \n Gets the location that the request was sent to.\n \n The location that the request was sent to.\n \n \n \n Gets the extended error information.\n \n The extended error information.\n \n \n \n Gets or sets the exception.\n \n The exception.\n \n \n \n Gets the start time of the operation.\n \n The start time of the operation.\n \n \n \n Gets the end time of the operation.\n \n The end time of the operation.\n \n \n \n Represents a result segment that was retrieved from the total set of possible results.\n \n The type of the element.\n \n \n \n Stores the continuation token used to retrieve the next segment of results.\n \n \n \n \n Initializes a new instance of the ResultSegment class.\n \n The result.\n \n \n \n Gets an enumerable collection of results.\n \n An enumerable collection of results.\n \n \n \n Gets a continuation token to use to retrieve the next set of results with a subsequent call to the operation.\n \n The continuation token.\n \n \n \n Represents an exception thrown by the Windows Azure storage service.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class using the specified error message.\n \n The message that describes the error.\n \n \n \n Initializes a new instance of the class with a specified error message and a reference to the inner exception that generated this exception.\n \n The exception error message.\n The inner exception.\n \n \n \n Initializes a new instance of the class with serialized data.\n \n The that contains contextual information about the source or destination.\n The object that holds serialized object data for the exception being thrown.\n This constructor is called during de-serialization to reconstitute the exception object transmitted over a stream.\n \n \n \n Populates a object with the data needed to serialize the target object.\n \n The destination context for this serialization.\n The object to populate with data.\n \n \n \n Initializes a new instance of the class by using the specified parameters.\n \n The request result.\n The exception message.\n The inner exception.\n \n \n \n Translates the specified exception into a .\n \n The exception to translate.\n The request result.\n The storage exception.\n An exception of type .\n \n \n \n Translates the specified exception into a storage exception.\n \n The exception to translate.\n The request result.\n The delegate used to parse the error to get extended error information.\n The storage exception.\n \n \n \n Translates the specified exception into a storage exception.\n \n The exception to translate.\n The request result.\n The delegate used to parse the error to get extended error information.\n The error stream that contains the error information.\n The storage exception.\n \n \n \n Tries to translate the specified exception into a storage exception.\n \n The exception to translate.\n The request result.\n The delegate used to parse the error to get extended error information.\n The storage exception or null.\n \n \n \n Translates the specified exception into a storage exception.\n \n The exception to translate.\n The request result.\n The delegate used to parse the error to get extended error information.\n The storage exception.\n \n \n \n Populate the RequestResult.\n \n The request result.\n The web response.\n \n \n \n Represents an exception thrown by the Windows Azure storage client library. \n \n A string that represents the exception.\n \n \n \n Gets the object for this object.\n \n The object for this object.\n \n \n \n Represents extended error information returned by the Windows Azure storage services.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets the error details from stream.\n \n The input stream.\n The error details.\n \n \n \n Gets the error details from the stream using OData library.\n \n The input stream.\n The web response.\n The response Content-Type.\n The error details.\n \n \n \n Gets the error details from the stream using OData library.\n \n The input stream.\n The web response headers.\n The response Content-Type.\n The error details.\n \n \n \n Parses the error details from the stream using OData library.\n \n The IODataResponseMessage to parse.\n The error details.\n \n \n \n Generates a serializable object from its XML representation.\n \n The stream from which the object is deserialized.\n \n \n \n Converts a serializable object into its XML representation.\n \n The stream to which the object is serialized.\n \n \n \n Gets the storage service error code.\n \n The storage service error code.\n \n \n \n Gets the storage service error message.\n \n The storage service error message.\n \n \n \n Gets additional error details.\n \n The additional error details.\n \n \n \n Represents a storage service location.\n \n \n \n \n Primary storage service location.\n \n \n \n \n Secondary storage service location.\n \n \n \n \n Contains the URIs for both the primary and secondary locations of a Windows Azure Storage resource.\n \n \n \n \n Initializes a new instance of the class using the primary endpoint for the storage account.\n \n The URI for the primary endpoint.\n \n \n \n Initializes a new instance of the class using the primary and secondary endpoints for the storage account.\n \n The URI for the primary endpoint.\n The URI for the secondary endpoint.\n \n \n \n Returns the URI for the storage account endpoint at the specified location.\n \n The primary or secondary location for the storage account.\n The of the specified location.\n \n \n \n Returns a that represents this instance.\n \n \n A that represents this instance.\n \n \n \n \n Returns a hash code for this instance.\n \n \n A hash code for this instance, suitable for use in hashing algorithms and data structures like a hash table. \n \n \n \n \n Determines whether the specified is equal to this instance.\n \n The to compare with this instance.\n true if the specified is equal to this instance; otherwise, false.\n \n \n \n Indicates whether the current object is equal to another object of the same type.\n \n An object to compare with this object.\n true if the current object is equal to the parameter; otherwise, false.\n \n \n \n The endpoint for the primary location for the storage account.\n \n \n The URI for the primary endpoint.\n \n \n \n \n The endpoint for the secondary location for the storage account.\n \n \n The URI for the secondary endpoint.\n \n \n \n \n Represents a set of credentials used to authenticate access to a Windows Azure storage account.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class with the specified account name and key value.\n \n A string that represents the name of the storage account.\n A string that represents the Base64-encoded account access key.\n \n \n \n Initializes a new instance of the class with the specified account name and key value.\n \n A string that represents the name of the storage account.\n An array of bytes that represent the account access key.\n \n \n \n Initializes a new instance of the class with the specified account name, key value, and key name.\n \n A string that represents the name of the storage account.\n A string that represents the Base64-encoded account access key.\n A string that represents the name of the key.\n \n \n \n Initializes a new instance of the class with the specified account name, key value, and key name.\n \n A string that represents the name of the storage account.\n An array of bytes that represent the account access key.\n A string that represents the name of the key.\n \n \n \n Initializes a new instance of the class with the specified shared access signature token.\n \n A string representing the shared access signature token.\n \n \n \n Updates the key value for the credentials.\n \n The key value, as a Base64-encoded string, to update.\n \n \n \n Updates the key value for the credentials.\n \n The key value, as an array of bytes, to update.\n \n \n \n Updates the key value and key name for the credentials.\n \n The key value, as a Base64-encoded string, to update.\n The key name to update.\n \n \n \n Updates the key value and key name for the credentials.\n \n The key value, as an array of bytes, to update.\n The key name to update.\n \n \n \n Updates the shared access signature (SAS) token value for storage credentials created with a shared access signature.\n \n A string that specifies the SAS token value to update.\n \n \n \n Returns the account key for the credentials.\n \n An array of bytes that contains the key.\n \n \n \n Transforms a resource URI into a shared access signature URI, by appending a shared access token.\n \n A object that represents the resource URI to be transformed.\n A object that represents the signature, including the resource URI and the shared access token.\n \n \n \n Transforms a resource URI into a shared access signature URI, by appending a shared access token.\n \n A object that represents the resource URI to be transformed.\n A object that represents the signature, including the resource URI and the shared access token.\n \n \n \n Exports the value of the account access key to a Base64-encoded string.\n \n The account access key.\n \n \n \n Determines whether an other object is equal to this one by comparing their SAS tokens, account names, key names, and key values.\n \n The object to compare to this one.\n true if the two objects are equal; otherwise, false.\n \n \n \n Gets the associated shared access signature token for the credentials.\n \n The shared access signature token.\n \n \n \n Gets the associated account name for the credentials.\n \n The account name.\n \n \n \n Gets the associated key name for the credentials.\n \n The key name.\n \n \n \n Gets a value indicating whether the credentials are for anonymous access.\n \n true if the credentials are for anonymous access; otherwise, false.\n \n \n \n Gets a value indicating whether the credentials are a shared access signature token.\n \n true if the credentials are a shared access signature token; otherwise, false.\n \n \n \n Gets a value indicating whether the credentials are a shared key.\n \n true if the credentials are a shared key; otherwise, false.\n \n \n \n Represents a canonicalized string used in authenticating a request against the azure service.\n \n \n \n \n Stores the internal that holds the canonicalized string.\n \n \n \n \n Initializes a new instance of the class.\n \n The first canonicalized element to start the string with.\n \n \n \n Initializes a new instance of the class.\n \n The first canonicalized element to start the string with.\n The starting size of the string.\n \n \n \n Append additional canonicalized element to the string.\n \n An additional canonicalized element to append to the string.\n \n \n \n Converts the value of this instance to a string.\n \n A string whose value is the same as this instance.\n \n \n \n This class provides MemoryStream-like behavior but uses a list of buffers rather than a single buffer.\n \n \n \n \n The default small buffer size.\n \n \n \n \n The size of each buffer.\n \n \n \n \n The underlying buffer blocks for the stream.\n \n \n \n \n The currently used length.\n \n \n \n \n The total capacity of the stream.\n \n \n \n \n The current position.\n \n \n \n \n A reference to the IBufferManager for the stream to use to acquire and return buffers.\n \n \n \n \n Initializes a new instance of the MultiBufferMemoryStream class with provided IBufferManager.\n \n A reference to the IBufferManager for the stream to use to acquire and return buffers. May be null.\n The Buffer size to use for each block, default is 64 KB. Note this parameter is disregarded when a IBufferManager is specified.\n \n \n \n Reads a block of bytes from the current stream and writes the data to a buffer.\n \n When this method returns, the buffer contains the specified byte array with the values between offset and (offset + count - 1) replaced by the bytes read from the current source.\n The zero-based byte offset in buffer at which to begin storing the data read from the current stream.\n The maximum number of bytes to be read.\n The total number of bytes read into the buffer. This can be less than the number of bytes requested if that many bytes are not currently available, or zero if the end of the stream has been reached.\n \n \n \n Begins an asynchronous read operation.\n \n When this method returns, the buffer contains the specified byte array with the values between offset and (offset + count - 1) replaced by the bytes read from the current source.\n The zero-based byte offset in buffer at which to begin storing the data read from the current stream.\n The maximum number of bytes to be read.\n An optional asynchronous callback, to be called when the read is complete.\n A user-provided object that distinguishes this particular asynchronous read request from other requests.\n An IAsyncResult that represents the asynchronous read, which could still be pending.\n \n \n \n Waits for the pending asynchronous read to complete.\n \n The reference to the pending asynchronous request to finish.\n The total number of bytes read into the buffer. This can be less than the number of bytes requested if that many bytes are not currently available, or zero if the end of the stream has been reached.\n \n \n \n Sets the position within the current stream.\n \n A byte offset relative to the origin parameter.\n A value of type System.IO.SeekOrigin indicating the reference point used to obtain the new position.\n The new position within the current stream.\n Thrown if is invalid for SeekOrigin.\n \n \n \n Sets the length of the current stream to the specified value. (pre-allocating the bufferBlocks).\n \n The desired length of the current stream in bytes.\n If the is negative.\n \n \n \n Writes a block of bytes to the current stream using data read from a buffer.\n \n The buffer to write data from.\n The zero-based byte offset in buffer at which to begin copying bytes to the current stream.\n The number of bytes to write. \n \n \n \n Begins an asynchronous write operation.\n \n The buffer to write data from.\n The zero-based byte offset in buffer at which to begin copying bytes to the current stream.\n The number of bytes to write.\n An optional asynchronous callback, to be called when the write is complete.\n A user-provided object that distinguishes this particular asynchronous write request from other requests.\n An IAsyncResult that represents the asynchronous write, which could still be pending.\n \n \n \n Ends an asynchronous write operation.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Does not perform any operation as it's an in-memory stream.\n \n \n \n \n Reads the bytes from the current stream and writes them to another stream. However, this method eliminates copying the data into a temporary buffer by directly writing to the destination stream.\n \n The stream to which the contents of the current stream will be copied.\n DateTime indicating the expiry time.\n \n \n \n Begins an asynchronous fast-copy operation.\n \n The stream to which the contents of the current stream will be copied.\n DateTime indicating the expiry time.\n An optional asynchronous callback, to be called when the copy is complete.\n A user-provided object that distinguishes this particular asynchronous copy request from other requests.\n An IAsyncResult that represents the asynchronous copy, which could still be pending.\n \n \n \n Initiates a write operation for the next buffer in line.\n \n Internal StorageAsyncResult that represents the asynchronous copy.\n \n \n \n Callback method to be called when the corresponding write operation completes.\n \n The result of the asynchronous operation.\n \n \n \n Ends an asynchronous copy operation.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n Computes the hash value for this stream.\n \n String representation of the computed hash value.\n \n \n \n Ensures that the amount of bufferBlocks is greater than or equal to the required size. \n Does not trim the size.\n \n The required size.\n If the is negative.\n \n \n \n Adds another block to the underlying bufferBlocks.\n \n \n \n \n Copies the specified amount of data from internal buffers to the buffer and advances the position.\n \n An array of bytes. When this method returns, the buffer contains the specified byte array with the values \n between offset and (offset + count - 1) replaced by the bytes read from the current source.\n The zero-based byte offset in buffer at which to begin storing the data read from the current stream.\n The maximum number of bytes to be read from the current stream.\n The total number of bytes read into the buffer. This can be less than the number of bytes requested \n if that many bytes are not currently available, or zero (0) if the end of the stream has been reached.\n \n \n \n \n Writes a sequence of bytes to the current stream and advances the current position within this stream by the number of bytes written.\n (Requires the stream to be of sufficient size for writing).\n \n An array of bytes. This method copies count bytes from buffer to the current stream.\n The zero-based byte offset in buffer at which to begin copying bytes to the current stream.\n The number of bytes to be written to the current stream.\n \n \n \n Advances the current position of the stream and adjust the offset and remainder based on the amount completed.\n \n The current offset in the external buffer.\n The amount of data left to process.\n The amount of data processed.\n \n \n \n Advances the current position of the stream and adjust the remainder based on the amount completed.\n \n The amount of data left to process.\n The amount of data processed.\n \n \n \n Calculate the block for the current position.\n \n \n \n \n Gets a value indicating whether the current stream supports reading.\n \n Is true if the stream supports reading; otherwise, false.\n \n \n \n Gets a value indicating whether the current stream supports seeking.\n \n Is true if the stream supports seeking; otherwise, false.\n \n \n \n Gets a value indicating whether the current stream supports writing.\n \n Is true if the stream supports writing; otherwise, false.\n \n \n \n Gets the currently written length.\n \n \n \n \n Represents the current position in the stream.\n \n Thrown if position is outside the stream size\n \n \n \n A NullTaskReturn type.\n \n \n \n \n Represents a no-return from a task.\n \n \n \n \n Prevents a default instance of the class from being created.\n \n \n \n \n Provides a standard set of errors that could be thrown from the client library.\n \n \n \n \n This class provides APM Read/Write overrides for memory stream to improve performance.\n \n \n \n \n Initializes a new instance of the SyncMemoryStream class with an expandable capacity initialized to zero.\n \n \n \n \n Initializes a new non-resizable instance of the SyncMemoryStream class based on the specified byte array. \n \n The array of unsigned bytes from which to create the current stream.\n \n \n \n Initializes a new non-resizable instance of the SyncMemoryStream class based on the specified region (index) of a byte array. \n \n The array of unsigned bytes from which to create the current stream.\n The index into buffer at which the stream begins.\n \n \n \n Initializes a new non-resizable instance of the SyncMemoryStream class based on the specified region (index) of a byte array. \n \n The array of unsigned bytes from which to create the current stream.\n The index into buffer at which the stream begins.\n The length of the stream in bytes.\n \n \n \n Begins an asynchronous read operation.\n \n When this method returns, the buffer contains the specified byte array with the values between offset and (offset + count - 1) replaced by the bytes read from the current source.\n The zero-based byte offset in buffer at which to begin storing the data read from the current stream.\n The maximum number of bytes to be read.\n An optional asynchronous callback, to be called when the read is complete.\n A user-provided object that distinguishes this particular asynchronous read request from other requests.\n An IAsyncResult that represents the asynchronous read, which could still be pending.\n \n \n \n Waits for the pending asynchronous read to complete.\n \n The reference to the pending asynchronous request to finish.\n The total number of bytes read into the buffer. This can be less than the number of bytes requested if that many bytes are not currently available, or zero if the end of the stream has been reached.\n \n \n \n Begins an asynchronous write operation.\n \n The buffer to write data from.\n The zero-based byte offset in buffer at which to begin copying bytes to the current stream.\n The number of bytes to write.\n An optional asynchronous callback, to be called when the write is complete.\n A user-provided object that distinguishes this particular asynchronous write request from other requests.\n An IAsyncResult that represents the asynchronous write, which could still be pending.\n \n \n \n Ends an asynchronous write operation.\n \n The reference to the pending asynchronous request to finish.\n \n \n \n A convenience class for constructing URI query strings.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class that contains elements copied from the specified .\n \n The whose elements are copied to the new .\n \n \n \n Stores the query parameters.\n \n \n \n \n Add the value with URI escaping.\n \n The query name.\n The query value.\n \n \n \n Returns a containing the URI.\n \n \n A containing the URI.\n \n \n \n \n Adds a query parameter to a URI.\n \n The original URI, including any existing query parameters.\n The URI with the new query parameter appended.\n \n \n \n Adds a query parameter to a URI.\n \n The original URI, including any existing query parameters.\n The URI with the new query parameter appended.\n \n \n \n Contains helper methods for implementing shared access signatures.\n \n \n \n \n Get the complete query builder for creating the Shared Access Signature query.\n \n The shared access policy to hash.\n The optional header values to set for a blob returned with this SAS.\n An optional identifier for the policy.\n Either \"b\" for blobs or \"c\" for containers.\n The signature to use.\n The name of the key used to create the signature, or null if the key is implicit.\n The finished query builder.\n \n \n \n Get the complete query builder for creating the Shared Access Signature query.\n \n The shared access policy to hash.\n An optional identifier for the policy.\n The signature to use.\n The name of the key used to create the signature, or null if the key is implicit.\n The finished query builder.\n \n \n \n Get the complete query builder for creating the Shared Access Signature query.\n \n The shared access policy to hash.\n The name of the table associated with this shared access signature.\n An optional identifier for the policy.\n The start partition key, or null.\n The start row key, or null.\n The end partition key, or null.\n The end row key, or null.\n The signature to use.\n The name of the key used to create the signature, or null if the key is implicit.\n The finished query builder.\n \n \n \n Converts the specified value to either a string representation or .\n \n The value to convert.\n A string representing the specified value.\n \n \n \n Converts the specified value to either a string representation or null.\n \n The value to convert.\n A string representing the specified value.\n \n \n \n Escapes and adds the specified name/value pair to the query builder if it is not null.\n \n The builder to add the value to.\n The name of the pair.\n The value to be escaped.\n \n \n \n Parses the query.\n \n The query parameters.\n A boolean that represents whether SignedResource is part of Sas or not. True for blobs, False for Queues and Tables.\n \n \n \n Get the signature hash embedded inside the Shared Access Signature.\n \n The shared access policy to hash.\n An optional identifier for the policy.\n The canonical resource string, unescaped.\n The key value retrieved as an atomic operation used for signing.\n The signed hash.\n \n \n \n Get the signature hash embedded inside the Shared Access Signature.\n \n The shared access policy to hash.\n An optional identifier for the policy.\n The start partition key, or null.\n The start row key, or null.\n The end partition key, or null.\n The end row key, or null.\n The canonical resource string, unescaped.\n The key value retrieved as an atomic operation used for signing.\n The signed hash.\n \n \n \n Get the signature hash embedded inside the Shared Access Signature.\n \n The shared access policy to hash.\n The optional header values to set for a blob returned with this SAS.\n An optional identifier for the policy.\n The canonical resource string, unescaped.\n The key value retrieved as an atomic operation used for signing.\n The signed hash.\n \n \n \n Gets the value of the x-ms-date or Date header.\n \n The request where the value is read from.\n The value of the x-ms-date or Date header.\n \n \n \n Appends the value of the Content-Length header to the specified canonicalized string.\n \n The canonicalized string where the value is appended.\n The request where the value is read from.\n \n \n \n Appends the value of the Date header (or, optionally, the x-ms-date header) to the specified canonicalized string.\n \n The canonicalized string where the value is appended.\n The request where the value is read from.\n true if the value of the x-ms-date header can be used and is preferred; otherwise, false.\n \n \n \n Appends the values of the x-ms-* headers to the specified canonicalized string.\n \n The canonicalized string where the values are appended.\n The request where the values are read from.\n \n \n \n Gets the canonicalized header value to use for the specified date/time or null if it does not have a value.\n \n The date/time.\n The canonicalized header value to use for the specified date/time or null if it does not have a value.\n \n \n \n In case of path style, this method will strip off -secondary from absolute path and replace it with account name.\n \n The resource URI.\n The name of the storage account.\n Absolute path with no -secondary suffix.\n \n \n \n Gets the canonicalized resource string for the specified URI.\n \n The resource URI.\n The name of the storage account.\n true when using the Shared Key Lite authentication scheme or the table service; otherwise, false.\n The canonicalized resource string.\n \n \n \n Determines which location can the listing command target by looking at the\n continuation token.\n \n Continuation token\n Location mode\n \n \n \n Create an ExecutionState object that can be used for pre-request operations\n such as buffering user's data.\n \n Request options\n Temporary ExecutionState object\n \n \n \n Returns the larger of two time spans.\n \n The first of two time spans to compare.\n The second of two time spans to compare.\n Parameter or , whichever is larger.\n \n \n \n Gets the first header value or null if no header values exist.\n \n The type of header objects contained in the enumerable.\n An enumerable that contains header values.\n The first header value or null if no header values exist.\n \n \n \n Throws an exception if the string is empty or null.\n \n The name of the parameter.\n The value of the parameter.\n Thrown if value is empty.\n Thrown if value is null.\n \n \n \n Throw an exception if the value is null.\n \n The name of the parameter.\n The value of the parameter.\n Thrown if value is null.\n \n \n \n Throw an exception indicating argument is out of range.\n \n The name of the parameter.\n The value of the parameter.\n \n \n \n Throw an exception if the argument is out of bounds.\n \n The type of the value.\n The name of the parameter.\n The value of the parameter.\n The minimum value for the parameter.\n The maximum value for the parameter.\n \n \n \n Throw an exception if the argument is out of bounds.\n \n The type of the value.\n The name of the parameter.\n The value of the parameter.\n The minimum value for the parameter.\n \n \n \n Checks that the given timeout in within allowed bounds.\n \n The timeout to check.\n The timeout is not within allowed bounds.\n \n \n \n Combines AssertNotNullOrEmpty and AssertInBounds for convenience.\n \n The name of the parameter.\n Turns on or off null/empty checking.\n The value of the parameter.\n The maximum size of value.\n \n \n \n Rounds up to seconds.\n \n The time span.\n The time rounded to seconds.\n \n \n \n List of ports used for path style addressing.\n \n \n \n \n Determines if a URI requires path style addressing.\n \n The URI to check.\n Returns true if the Uri uses path style addressing; otherwise, false.\n \n \n \n Read the value of an element in the XML.\n \n The name of the element whose value is retrieved.\n A reader that provides access to XML data.\n A string representation of the element's value.\n \n \n \n Returns an enumerable collection of results that is retrieved lazily.\n \n The type of ResultSegment like Blob, Container, Queue and Table.\n The segment generator.\n >A non-negative integer value that indicates the maximum number of results to be returned \n in the result segment, up to the per-operation limit of 5000.\n \n \n \n \n Applies the request optimizations such as disabling buffering and 100 continue.\n \n The request to be modified.\n The length of the content, -1 if the content length is not settable.\n \n \n \n Increments the counter by one and thus sets the state of the event to non-signaled, causing threads to block.\n \n \n \n \n Decrements the counter by one. If the counter reaches zero, sets the state of the event to signaled, allowing one or more waiting threads to proceed.\n \n \n \n \n Blocks the current thread until the CounterEvent is set.\n \n \n \n \n Blocks the current thread until the CounterEvent is set, using a 32-bit signed integer to measure the timeout.\n \n The number of milliseconds to wait, or Infinite(-1) to wait indefinitely.\n true if the CounterEvent was set; otherwise, false.\n \n \n \n Releases all resources used by the current instance of the CounterEvent class.\n \n \n \n \n Gets a WaitHandle that is used to wait for the event to be set.\n \n A WaitHandle that is used to wait for the event to be set.\n \n \n \n Provides helper functions for http request/response processing. \n \n \n \n \n Parse the http query string.\n \n Http query string.\n \n \n \n \n Converts the DateTimeOffset object to an Http string of form: Sun, 28 Jan 2008 12:11:37 GMT.\n \n The DateTimeOffset object to convert to an Http string.\n String of form: Sun, 28 Jan 2008 12:11:37 GMT.\n \n \n \n Try to get the value of the specified header name.\n \n The Http web response from which to get the header value.\n The name of the header whose value is to be retrieved.\n The default value for the header that is returned if we can't get the actual header value.\n A string representing the header value.\n \n \n \n Wrapper class for MD5.\n \n \n \n \n Calculates an on-going hash using the input byte array.\n \n The input array used for calculating the hash.\n The offset in the input buffer to calculate from.\n The number of bytes to use from input.\n \n \n \n Retrieves the string representation of the hash. (Completes the creation of the hash).\n \n String representation of the computed hash value.\n \n \n \n Contains methods for dealing with navigation.\n \n \n \n \n The name of the root container.\n \n \n \n \n Used in address parsing.\n \n \n \n \n Used in address parsing.\n \n \n \n \n Used in address parsing.\n \n \n \n \n Used to split string on slash.\n \n \n \n \n Used to split hostname.\n \n \n \n \n Retrieves the container part of a storage Uri, or \"$root\" if the container is implicit.\n \n The blob address.\n If set to true use path style Uris.\n Name of the container.\n \n The trailing slash is always removed.\n \n GetContainerName(new Uri(\"http://test.blob.core.windows.net/mycontainer/myfolder/myblob\")) will return \"mycontainer\"\n GetContainerName(new Uri(\"http://test.blob.core.windows.net/mycontainer/\")) will return \"mycontainer\"\n GetContainerName(new Uri(\"http://test.blob.core.windows.net/myblob\")) will return \"$root\"\n GetContainerName(new Uri(\"http://test.blob.core.windows.net/\")) will throw ArgumentException\n \n \n \n \n \n Retrieves the blob part of a storage Uri.\n \n The blob address.\n If set to true use path style Uris.\n The name of the blob.\n \n \n \n Retrieves the complete container address from a storage Uri\n Example GetContainerAddress(new Uri(\"http://test.blob.core.windows.net/mycontainer/myfolder/myblob\"))\n will return http://test.blob.core.windows.net/mycontainer.\n \n The blob address.\n True to use path style Uris.\n Uri of the container.\n \n \n \n Retrieves the parent name from a storage Uri.\n \n The blob address.\n The delimiter.\n If set to true use path style Uris.\n The name of the parent.\n \n Adds the trailing delimiter as the prefix returned by the storage REST api always contains the delimiter.\n \n \n GetParentName(new Uri(\"http://test.blob.core.windows.net/mycontainer/myfolder/myblob\", \"/\")) will return \"/mycontainer/myfolder/\"\n GetParentName(new Uri(\"http://test.blob.core.windows.net/mycontainer/myfolder|myblob\", \"|\") will return \"/mycontainer/myfolder|\"\n GetParentName(new Uri(\"http://test.blob.core.windows.net/mycontainer/myblob\", \"/\") will return \"/mycontainer/\"\n GetParentName(new Uri(\"http://test.blob.core.windows.net/mycontainer/\", \"/\") will return \"/mycontainer/\"\n \n \n \n \n Gets the service client base address.\n \n The address Uri.\n The use path style Uris.\n The base address of the client.\n \n GetServiceClientBaseAddress(\"http://testaccount.blob.core.windows.net/testcontainer/blob1\") \n returns \"http://testaccount.blob.core.windows.net\"\n \n \n \n \n Gets the service client base address.\n \n The address Uri.\n The use path style Uris.\n The base address of the client.\n \n GetServiceClientBaseAddress(\"http://testaccount.blob.core.windows.net/testcontainer/blob1\") \n returns \"http://testaccount.blob.core.windows.net\"\n \n \n \n \n Appends a path to a list of URIs correctly using \"/\" as separator.\n \n The base URI.\n The relative or absolute URI.\n The list of appended URIs.\n \n \n \n Appends a path to a list of URIs correctly using \"/\" as separator.\n \n The base URI.\n The relative or absolute URI.\n The separator.\n The list of appended URIs.\n \n \n \n Append a relative path to a URI, handling trailing slashes appropriately.\n \n The base URI.\n The relative or absolute URI.\n The appended Uri.\n \n \n \n Append a relative path to a URI, handling trailing slashes appropriately.\n \n The base URI.\n The relative or absolute URI.\n The separator.\n The appended Uri.\n \n \n \n Get container name from address for styles of paths\n Example: http://test.blob.core.windows.net/container/blob => container\n http://127.0.0.1:10000/test/container/blob => container.\n \n The container Uri.\n If set to true use path style Uris.\n The container name.\n \n \n \n Similar to getting container name from Uri.\n \n The queue Uri.\n If set to true use path style Uris.\n The queue name.\n \n \n \n Extracts a table name from the table's Uri.\n \n The queue Uri.\n If set to true use path style Uris.\n The queue name.\n \n \n \n Retrieve the container address and address.\n \n The blob address.\n True to use path style Uris.\n Name of the container.\n The container URI.\n true when the container is an explicit container. false, otherwise. \n \n \n \n Retrieve the container name and the blob name from a blob address.\n \n The blob address.\n If set to true use path style Uris.\n The resulting container name.\n The resulting blob name.\n A bool representing whether the blob is in an explicit container or not.\n \n \n \n Parses the snapshot time.\n \n The snapshot time.\n The parsed snapshot time.\n \n \n \n Parse Uri for SAS (Shared access signature) information.\n \n The complete Uri.\n The credentials to use.\n The parsed snapshot.\n The blob URI without credentials or snapshot info\n address\n \n Validate that no other query parameters are passed in.\n Any SAS information will be recorded as corresponding credentials instance.\n If credentials is passed in and it does not match the SAS information found, an\n exception will be thrown.\n Otherwise a new client is created based on SAS information or as anonymous credentials.\n \n \n \n \n Parse Uri for SAS (Shared access signature) information.\n \n The complete Uri.\n The credentials to use.\n The parsed snapshot.\n The blob URI without credentials or snapshot info\n address\n \n Validate that no other query parameters are passed in.\n Any SAS information will be recorded as corresponding credentials instance.\n If credentials is passed in and it does not match the SAS information found, an\n exception will be thrown.\n Otherwise a new client is created based on SAS information or as anonymous credentials.\n \n \n \n \n Parse Uri for SAS (Shared access signature) information.\n \n The complete Uri.\n The credentials to use.\n \n Validate that no other query parameters are passed in.\n Any SAS information will be recorded as corresponding credentials instance.\n If credentials is passed in and it does not match the SAS information found, an\n exception will be thrown.\n Otherwise a new client is created based on SAS information or as anonymous credentials.\n \n \n \n \n Parse Uri for SAS (Shared access signature) information.\n \n The complete Uri.\n The credentials to use.\n \n Validate that no other query parameters are passed in.\n Any SAS information will be recorded as corresponding credentials instance.\n If credentials is passed in and it does not match the SAS information found, an\n exception will be thrown.\n Otherwise a new client is created based on SAS information or as anonymous credentials.\n \n \n \n \n Represents a canonicalized string used in authenticating a request against the azure service.\n \n \n \n \n Provides properties to keep track of Md5 hash / Length of a stream as it is being copied.\n \n \n \n \n Provides stream helper methods that allow us to copy streams and measure the stream size.\n \n \n \n \n Reads synchronously the specified content of the stream and writes it to the given output stream.\n \n The origin stream.\n The destination stream. \n Number of bytes to copy from source stream to destination stream. Cannot be passed with a value for maxLength.\n Maximum length of the stream to write. \n true to calculate the MD5 hash.\n A boolean indicating whether the write happens synchronously.\n An object that stores state of the operation.\n State of the stream copy.\n stream\n \n \n \n Asynchronously reads the entire content of the stream and writes it to the given output stream.\n \n The result type of the ExecutionState\n The origin stream.\n The destination stream.\n Number of bytes to copy from source stream to destination stream. Cannot be passed with a value for maxLength.\n Maximum length of the source stream. Cannot be passed with a value for copyLength.\n Bool value indicating whether the Md5 should be calculated.\n An object that stores state of the operation.\n State of the stream copy.\n The action taken when the execution is completed.\n \n \n \n Represents a retry policy that performs a specified number of retries, using a randomized exponential back off scheme to determine the interval between retries. \n \n \n \n \n Represents a retry policy.\n \n \n \n \n Represents a retry policy.\n \n \n \n \n Generates a new retry policy for the current request attempt.\n \n An object that represents the retry policy for the current request attempt. \n \n \n \n Determines whether the operation should be retried and the interval until the next retry.\n \n The number of retries for the given operation. A value of zero signifies this is the first error encountered.\n The status code for the last operation.\n An object that represents the last exception encountered.\n The interval to wait until the next retry.\n An object for tracking the current operation.\n true if the operation should be retried; otherwise, false.\n \n \n \n Determines whether the operation should be retried and the interval until the next retry.\n \n A object that indicates the number of retries, the results of the last request, and whether the next retry should happen in the primary or secondary location, and specifies the location mode.\n An object for tracking the current operation.\n A object that indicates the location mode, and whether the next retry should happen in the primary or secondary location. If null, the operation will not be retried.\n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class using the specified delta and maximum number of retries.\n \n The back off interval between retries.\n The maximum number of retry attempts.\n \n \n \n Determines whether the operation should be retried and the interval until the next retry.\n \n The number of retries for the given operation. A value of zero signifies this is the first error encountered.\n The status code for the last operation.\n An object that represents the last exception encountered.\n The interval to wait until the next retry.\n An object for tracking the current operation.\n true if the operation should be retried; otherwise, false.\n \n \n \n Determines whether the operation should be retried and the interval until the next retry.\n \n A object that indicates the number of retries, the results of the last request, and whether the next retry should happen in the primary or secondary location, and specifies the location mode.\n An object for tracking the current operation.\n A object that indicates the location mode, and whether the next retry should happen in the primary or secondary location. If null, the operation will not be retried.\n \n \n \n Generates a new retry policy for the current request attempt.\n \n An object that represents the retry policy for the current request attempt.\n \n \n \n Represents a retry policy that performs a specified number of retries, using a specified fixed time interval between retries.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class using the specified delta and maximum number of retries.\n \n The back off interval between retries.\n The maximum number of retry attempts.\n \n \n \n Determines whether the operation should be retried and the interval until the next retry.\n \n The number of retries for the given operation. A value of zero signifies this is the first error encountered.\n The status code for the last operation.\n An object that represents the last exception encountered.\n The interval to wait until the next retry.\n An object for tracking the current operation.\n true if the operation should be retried; otherwise, false.\n \n \n \n Determines whether the operation should be retried and the interval until the next retry.\n \n A object that indicates the number of retries, the results of the last request, and whether the next retry should happen in the primary or secondary location, and specifies the location mode.\n An object for tracking the current operation.\n A object that indicates the location mode, and whether the next retry should happen in the primary or secondary location. If null, the operation will not be retried.\n \n \n \n Generates a new retry policy for the current request attempt.\n \n An object that represents the retry policy for the current request attempt. \n \n \n \n Specifies the location mode used to decide which location the request should be sent to.\n \n \n \n \n Requests should always be sent to the primary location.\n \n \n \n \n Requests should always be sent to the primary location first. If the request fails, it should be sent to the secondary location.\n \n \n \n \n Requests should always be sent to the secondary location.\n \n \n \n \n Requests should always be sent to the secondary location first. If the request fails, it should be sent to the primary location.\n \n \n \n \n Represents a retry policy that performs no retries.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Determines if the operation should be retried and how long to wait until the next retry. \n \n The number of retries for the given operation. A value of zero signifies this is the first error encountered.\n The status code for the last operation.\n An object that represents the last exception encountered.\n The interval to wait until the next retry.\n An object for tracking the current operation.\n true if the operation should be retried; otherwise, false.\n \n \n \n Generates a new retry policy for the current request attempt.\n \n An object that represents the retry policy for the current request attempt.\n \n \n \n Represents the context for one or more retries of a request made against the Windows Azure storage services,\n including the number of retries made for the request, the results of the last request, and the storage location and location mode for subsequent retries.\n \n \n \n \n Returns a string that represents the current instance.\n \n A string that represents the current instance.\n \n \n \n Gets the target location for the next retry.\n \n The target location for the next retry.\n \n \n \n Gets the location mode for subsequent retries.\n \n The location mode for subsequent retries.\n \n \n \n Gets the number of retries for the given operation.\n \n The number of retries for the given operation.\n \n \n \n Gets the results of the last request.\n \n A object that represents the results of the last request.\n \n \n \n Specifies parameters for the next retry of a request to be made against the Windows Azure storage services,\n including the target location and location mode for the next retry and the interval until the next retry.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class.\n \n The object that was passed in to the retry policy.\n \n \n \n Returns a string that represents the current instance.\n \n A string that represents the current instance.\n \n \n \n Gets or sets the target location for the next retry.\n \n The target location for the next retry.\n \n \n \n Gets or sets the location mode for subsequent retries.\n \n The location mode for subsequent retries.\n \n \n \n Gets the interval until the next retry.\n \n The interval until the next retry.\n \n \n \n Verifies that the blob is not a snapshot.\n \n \n \n \n Gets the blob's system properties.\n \n The blob's properties.\n \n \n \n Gets the user-defined metadata for the blob.\n \n The blob's metadata, as a collection of name-value pairs.\n \n \n \n Gets the blob's URI for the primary location.\n \n The absolute URI to the blob, at the primary location.\n \n \n \n Gets the list of URIs for all locations.\n \n The list of URIs for all locations.\n \n \n \n Gets the date and time that the blob snapshot was taken, if this blob is a snapshot.\n \n The blob's snapshot time if the blob is a snapshot; otherwise, null.\n \n If the blob is not a snapshot, the value of this property is null.\n \n \n \n \n Gets the state of the most recent or pending copy operation.\n \n A object containing the copy state, or null if no copy blob state exists for this blob.\n \n \n \n Represents the permissions for a container.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets or sets the public access setting for the container.\n \n The public access setting for the container.\n \n \n \n Gets the set of shared access policies for the container.\n \n The set of shared access policies for the container.\n \n \n \n Represents the system properties for a container.\n \n \n \n \n Gets the ETag value for the container.\n \n The container's quoted ETag value.\n \n \n \n Gets the container's last-modified time.\n \n The container's last-modified time.\n \n \n \n Gets the container's lease status.\n \n A object that indicates the container's lease status.\n \n \n \n Gets the container's lease state.\n \n A object that indicates the container's lease state.\n \n \n \n Gets the container's lease duration.\n \n A object that indicates the container's lease duration.\n \n \n \n Specifies the level of public access that is allowed on the container.\n \n \n \n \n No public access. Only the account owner can read resources in this container.\n \n \n \n \n Container-level public access. Anonymous clients can read container and blob data.\n \n \n \n \n Blob-level public access. Anonymous clients can read blob data within this container, but not container data.\n \n \n \n \n Represents a continuation token for listing operations. \n \n continuation tokens are used in methods that return a object, such as .\n \n \n \n Gets an XML representation of an object.\n \n \n An that describes the XML representation of the object that is produced by the method and consumed by the method.\n \n \n \n \n Generates a serializable continuation token from its XML representation.\n \n The stream from which the continuation token is deserialized.\n \n \n \n Converts a serializable continuation token into its XML representation.\n \n The stream to which the continuation token is serialized.\n \n \n \n Gets or sets the version for continuing results for enumeration operations.\n \n The version.\n \n \n \n Gets or sets the type element (blob, queue, table) for continuing results for enumeration operations.\n \n The type element.\n \n \n \n Gets or sets the next marker for continuing results for enumeration operations.\n \n The next marker.\n \n \n \n Gets or sets the storage location that the continuation token applies to.\n \n The storage location that the continuation token applies to.\n \n \n \n Specifies which items to include when listing a set of blobs.\n \n \n \n \n List only committed blobs, and do not return blob metadata.\n \n \n \n \n List committed blobs and blob snapshots.\n \n \n \n \n Retrieve blob metadata for each blob returned in the listing.\n \n \n \n \n List committed and uncommitted blobs.\n \n \n \n \n Include copy properties in the listing.\n \n \n \n \n List all available committed blobs, uncommitted blobs, and snapshots, and return all metadata and copy status for those blobs.\n \n \n \n \n Represents the system properties for a blob.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class based on an existing instance.\n \n The set of properties to clone.\n Lease-related properties will not be cloned, because a lease associated with the base blob is not copied to the snapshot.\n \n \n \n Gets or sets the cache-control value stored for the blob.\n \n The blob's cache-control value.\n \n \n \n Gets or sets the content-disposition value stored for the blob.\n \n The blob's content-disposition value.\n \n If this property has not been set for the blob, it returns null.\n \n \n \n \n Gets or sets the content-encoding value stored for the blob.\n \n The blob's content-encoding value.\n \n If this property has not been set for the blob, it returns null.\n \n \n \n \n Gets or sets the content-language value stored for the blob.\n \n The blob's content-language value.\n \n If this property has not been set for the blob, it returns null.\n \n \n \n \n Gets the size of the blob, in bytes.\n \n The blob's size in bytes.\n \n \n \n Gets or sets the content-MD5 value stored for the blob.\n \n The blob's content-MD5 hash.\n \n \n \n Gets or sets the content-type value stored for the blob.\n \n The blob's content-type value.\n \n If this property has not been set for the blob, it returns null.\n \n \n \n \n Gets the blob's ETag value.\n \n The blob's ETag value.\n \n \n \n Gets the the last-modified time for the blob, expressed as a UTC value.\n \n The blob's last-modified time, in UTC format.\n \n \n \n Gets the type of the blob.\n \n A object that indicates the type of the blob.\n \n \n \n Gets the blob's lease status.\n \n A object that indicates the blob's lease status.\n \n \n \n Gets the blob's lease state.\n \n A object that indicates the blob's lease state.\n \n \n \n Gets the blob's lease duration.\n \n A object that indicates the blob's lease duration.\n \n \n \n If the blob is a page blob, gets the blob's current sequence number.\n \n The blob's current sequence number.\n \n \n \n Represents a set of timeout and retry policy options that may be specified for a request against the Blob service.\n \n \n \n \n Stores the parallelism factor.\n \n \n \n \n Default is 32 MB.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Clones an instance of BlobRequestOptions so that we can apply defaults.\n \n BlobRequestOptions instance to be cloned.\n \n \n \n Gets or sets the absolute expiry time across all potential retries for the request. \n \n \n \n \n Gets or sets the retry policy.\n \n The retry policy.\n \n \n \n Gets or sets the location mode of the request.\n \n The location mode of the request.\n \n \n \n Gets or sets the server timeout interval for the request.\n \n The server timeout interval for the request.\n \n \n \n Gets or sets the maximum execution time across all potential retries for the request. \n \n A representing the maximum execution time for retries for the request.\n \n \n \n Gets or sets the number of blocks that may be simultaneously uploaded when uploading a blob that is greater than \n the value specified by the property in size.\n \n The number of parallel operations that may proceed.\n \n \n \n Gets or sets the maximum size of a blob in bytes that may be uploaded as a single blob. \n \n The maximum size of a blob, in bytes, that may be uploaded as a single blob,\n ranging from between 1 and 64 MB inclusive.\n \n \n \n Gets or sets a value to calculate and send/validate content MD5 for transactions.\n \n Use true to calculate and send/validate content MD5 for transactions; otherwise, false. \n \n \n \n Gets or sets a value to indicate that an MD5 hash will be calculated and stored when uploading a blob.\n \n Use true to calculate and store an MD5 hash when uploading a blob; otherwise, false.\n \n \n \n Gets or sets a value to indicate that MD5 validation will be disabled when downloading blobs.\n \n Use true to disable MD5 validation; false to enable MD5 validation.\n \n \n \n Represents a segment of results, with continuation information for pagination scenarios.\n \n \n \n \n Gets an enumerable collection of results.\n \n An enumerable collection of results.\n \n \n \n Gets the continuation token used to retrieve the next segment of results. Returns null if there are no more results.\n \n The continuation token.\n \n \n \n The type of a blob.\n \n \n \n \n Not specified.\n \n \n \n \n A page blob.\n \n \n \n \n A block blob.\n \n \n \n \n Indicates whether to list only committed blocks, only uncommitted blocks, or all blocks.\n \n \n \n \n Committed blocks.\n \n \n \n \n Uncommitted blocks.\n \n \n \n \n Both committed and uncommitted blocks.\n \n \n \n \n Indicates which block lists should be searched to find a specified block. \n \n \n \n \n Search the committed block list only.\n \n \n \n \n Search the uncommitted block list only.\n \n \n \n \n Search the uncommitted block list first, and if the block is not found there, search \n the committed block list.\n \n \n \n \n Specifies which details to include when listing the containers in this storage account.\n \n \n \n \n No additional details.\n \n \n \n \n Retrieve container metadata.\n \n \n \n \n Retrieve all available details.\n \n \n \n \n Represents a segment of results and contains continuation and pagination information.\n \n \n \n \n Gets an enumerable collection of results.\n \n An enumerable collection of results.\n \n \n \n Gets the continuation token used to retrieve the next segment of results.\n \n The continuation token.\n \n \n \n Represents the attributes of a copy operation.\n \n \n \n \n Gets the ID of the copy operation.\n \n A copy ID string.\n \n \n \n Gets the time the copy operation completed, and indicates whether completion was due to a successful copy, the cancelling of the operation, or a failure.\n \n A containing the completion time, or null if the operation has not completed.\n \n \n \n Gets the status of the copy operation.\n \n A enumeration indicating the status of the operation.\n \n \n \n Gets the source URI of a copy operation.\n \n A indicating the source of a copy operation, or null.\n \n \n \n Gets the number of bytes copied in the operation so far.\n \n The number of bytes copied in the operation so far, or null.\n \n \n \n Gets the total number of bytes in the source of the copy.\n \n The number of bytes in the source, or null.\n \n \n \n Gets the description of the current status, if any.\n \n A status description string, or null.\n \n \n \n Represents the status of a copy blob operation.\n \n \n \n \n The copy status is invalid.\n \n \n \n \n The copy operation is pending.\n \n \n \n \n The copy operation succeeded.\n \n \n \n \n The copy operation has been aborted.\n \n \n \n \n The copy operation encountered an error.\n \n \n \n \n The set of options describing delete operation.\n \n \n \n \n Delete blobs but not snapshots.\n \n \n \n \n Delete the blob and its snapshots.\n \n \n \n \n Delete the blob's snapshots only.\n \n \n \n \n Describes actions that can be performed on a lease.\n \n \n \n \n Acquire the lease.\n \n \n \n \n Renew the lease.\n \n \n \n \n Release the lease.\n \n \n \n \n Break the lease.\n \n \n \n \n Change the lease ID.\n \n \n \n \n The lease duration of a resource.\n \n \n \n \n The lease duration is not specified.\n \n \n \n \n The lease duration is finite.\n \n \n \n \n The lease duration is infinite.\n \n \n \n \n The lease state of a resource.\n \n \n \n \n The lease state is not specified.\n \n \n \n \n The lease is in the Available state.\n \n \n \n \n The lease is in the Leased state.\n \n \n \n \n The lease is in the Expired state.\n \n \n \n \n The lease is in the Breaking state.\n \n \n \n \n The lease is in the Broken state.\n \n \n \n \n The lease status of a resource.\n \n \n \n \n The lease status is not specified.\n \n \n \n \n The resource is locked.\n \n \n \n \n The resource is available to be locked.\n \n \n \n \n Represents a block retrieved from the blob's block list.\n \n \n \n \n Gets the name of the block.\n \n The block name.\n \n \n \n Gets the size of block in bytes.\n \n The block size.\n \n \n \n Gets a value indicating whether or not the block has been committed.\n \n True if the block has been committed; otherwise, false.\n \n \n \n Represents a range of pages in a page blob.\n \n \n \n \n Initializes a new instance of the class.\n \n The starting offset.\n The ending offset.\n \n \n \n Returns the content of the page range as a string.\n \n The content of the page range.\n \n \n \n Gets the starting offset of the page range.\n \n The starting offset.\n \n \n \n Gets the ending offset of the page range.\n \n The ending offset.\n \n \n \n Describes actions that can be performed on a page blob sequence number.\n \n \n \n \n Sets the sequence number to be the higher of the value included with the request and the value currently stored for the blob.\n \n \n \n \n Sets the sequence number to the value included with the request.\n \n \n \n \n Increments the value of the sequence number by 1.\n \n \n \n \n Represents the optional headers that can be returned with blobs accessed using SAS.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class based on an existing instance.\n \n The set of to clone.\n \n \n \n Gets or sets the cache-control header returned with the blob.\n \n The cache-control value.\n \n \n \n Gets or sets the content-disposition header returned with the blob.\n \n The content-disposition value.\n \n \n \n Gets or sets the content-encoding header returned with the blob.\n \n The content-encoding value.\n \n \n \n Gets or sets the content-language header returned with the blob.\n \n The content-language value.\n \n \n \n Gets or sets the content-type header returned with the blob.\n \n The content-type value.\n \n \n \n Specifies the set of possible permissions for a shared access policy.\n \n \n \n \n No shared access granted.\n \n \n \n \n Read access granted.\n \n \n \n \n Write access granted.\n \n \n \n \n Delete access granted for blobs.\n \n \n \n \n List access granted.\n \n \n \n \n Represents the collection of shared access policies defined for a container.\n \n \n \n \n Adds the specified key and value to the collection of shared access policies.\n \n The key of the value to add.\n The value to add the collection of shared access policies.\n \n \n \n Determines whether the collection of shared access policies contains the specified key.\n \n The key to locate in the collection of shared access policies.\n true if the collection of shared access policies contains an element with the specified key; otherwise, false.\n \n \n \n Removes the value with the specified key from the shared access policies collection.\n \n The key of the item to remove.\n true if the element is successfully found and removed; otherwise, false. This method returns false if the key is not found.\n \n \n \n Gets the item associated with the specified key. \n \n The key of the value to get.\n The item to get.\n The item associated with the specified key, if the key is found; otherwise, the default value for the type.\n \n \n \n Adds the specified key/ value, stored in a , to the collection of shared access policies.\n \n The object, containing a key/ value pair, to add to the shared access policies collection.\n \n \n \n Removes all keys and values from the shared access collection.\n \n \n \n \n Determines whether the collection of shared access policies contains the key and value in the specified object.\n \n A object containing the key and value to search for.\n true if the shared access policies collection contains the specified key/value; otherwise, false.\n \n \n \n Copies each key/ value pair in the shared access policies collection to a compatible one-dimensional array, starting at the specified index of the target array.\n \n The one-dimensional array of objects that is the destination of the elements copied from the shared access policies collection.\n The zero-based index in at which copying begins.\n \n \n \n Removes the value, specified in the object, from the shared access policies collection.\n \n The object, containing a key and value, to remove from the shared access policies collection.\n true if the item was successfully removed; otherwise, false.\n \n \n \n Returns an enumerator that iterates through the collection of shared access policies.\n \n An of type .\n \n \n \n Returns an enumerator that iterates through the collection of shared access policies.\n \n An object that can be used to iterate through the collection of shared access policies.\n \n \n \n Gets a collection containing the keys in the shared access policies collection.\n \n A collection containing the keys in the of shared access policies collection.\n \n \n \n Gets a collection containing the values in the shared access policies collection.\n \n A collection of items in the shared access policies collection.\n \n \n \n Gets or sets the item associated with the specified key.\n \n The key of the value to get or set.\n The item associated with the specified key, or null if key is not in the shared access policies collection.\n \n \n \n Gets the number of key/ value pairs contained in the shared access policies collection.\n \n The number of key/ value pairs contained in the shared access policies collection.\n \n \n \n Gets a value indicating whether the collection of shared access policies is read-only. \n \n true if the collection of shared access policies is read-only; otherwise, false.\n \n \n \n Represents a shared access policy, which specifies the start time, expiry time, \n and permissions for a shared access signature.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Converts the permissions specified for the shared access policy to a string.\n \n The shared access permissions.\n The shared access permissions in string format.\n \n \n \n Constructs a object from a permissions string.\n \n The shared access permissions in string format.\n A set of shared access permissions.\n \n \n \n Gets or sets the start time for a shared access signature associated with this shared access policy.\n \n The shared access start time.\n \n \n \n Gets or sets the expiry time for a shared access signature associated with this shared access policy.\n \n The shared access expiry time.\n \n \n \n Gets or sets the permissions for a shared access signature associated with this shared access policy.\n \n The permissions.\n \n \n \n Parses the response XML from an operation to set the access policy for a container.\n \n \n \n \n Parses the response XML from an operation to set the access policy for a cloud object.\n \n The policy type to be filled.\n \n \n \n Provides a base class that is used internally to parse XML streams from storage service operations.\n \n The type to be parsed.\n \n \n \n Indicates that all parsable objects have been consumed. This field is reserved and should not be used.\n \n \n \n \n Stores any objects that have not yet been parsed. This field is reserved and should not be used.\n \n \n \n \n The reader used for parsing. This field is reserved and should not be used.\n \n \n \n \n The IEnumerator over the parsed content.\n \n \n \n \n Used to make sure that parsing is only done once, since a stream is not re-entrant.\n \n \n \n \n Initializes a new instance of the ResponseParsingBase class.\n \n The stream to be parsed.\n \n \n \n Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources. \n \n \n \n \n Parses the XML response. This method is reserved and should not be used.\n \n A collection of enumerable objects.\n \n \n \n Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources, and optional\n managed resources.\n \n True to release both managed and unmanaged resources; otherwise, false.\n \n \n \n This method is reserved and should not be used.\n \n True when the object is consumable.\n \n \n \n Parses the XML and close.\n \n A list of parsed results.\n \n \n \n Gets the parsable objects. This method is reserved and should not be used.\n \n The objects to parse.\n \n \n \n Initializes a new instance of the AccessPolicyResponseBase class.\n \n The stream to be parsed.\n \n \n \n Parses the current element.\n \n The shared access policy element to parse.\n The shared access policy.\n \n \n \n Parses the response XML from a Set Container ACL operation to retrieve container-level access policy data.\n \n A list of enumerable key-value pairs.\n \n \n \n Gets an enumerable collection of container-level access policy identifiers.\n \n An enumerable collection of container-level access policy identifiers.\n \n \n \n Initializes a new instance of the BlobAccessPolicyResponse class.\n \n The stream to be parsed.\n \n \n \n Parses the current element.\n \n The shared access policy element to parse.\n The shared access policy.\n \n \n \n Represents a container item returned in the XML response for a container listing operation.\n \n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets the user-defined metadata for the container.\n \n The container's metadata, as a collection of name-value pairs.\n \n \n \n Gets the container's system properties.\n \n The container's properties.\n \n \n \n Gets the name of the container.\n \n The container's name.\n \n \n \n Gets the container's URI.\n \n The absolute URI to the container.\n \n \n \n Provides error code strings that are specific to the Blob service.\n \n \n \n \n Error code that may be returned when a block ID is invalid.\n \n \n \n \n Error code that may be returned when a blob with the specified address cannot be found.\n \n \n \n \n Error code that may be returned when a client attempts to create a blob that already exists.\n \n \n \n \n Error code that may be returned when the specified block or blob is invalid.\n \n \n \n \n Error code that may be returned when a block list is invalid.\n \n \n \n \n The specified container was not found.\n \n \n \n \n The specified container already exists.\n \n \n \n \n The specified container is disabled.\n \n \n \n \n The specified container is being deleted.\n \n \n \n \n Error code that may be returned when there is currently no lease on the blob.\n \n \n \n \n Error code that may be returned when there is currently no lease on the container.\n \n \n \n \n Error code that may be returned when a lease ID was specified, but the lease has expired.\n \n \n \n \n Error code that may be returned when the lease ID specified did not match the lease ID for the blob.\n \n \n \n \n Error code that may be returned when the lease ID specified did not match the lease ID for the container.\n \n \n \n \n Error code that may be returned when there is currently a lease on the resource and no lease ID was specified in the request.\n \n \n \n \n Error code that may be returned when there is currently no lease on the resource.\n \n \n \n \n Error code that may be returned when the lease ID specified did not match the lease ID.\n \n \n \n \n Error code that may be returned when there is already a lease present.\n \n \n \n \n Error code that may be returned when the lease has already been broken and cannot be broken again.\n \n \n \n \n Error code that may be returned when the lease ID matched, but the lease has been broken explicitly and cannot be renewed.\n \n \n \n \n Error code that may be returned when the lease ID matched, but the lease is breaking and cannot be acquired.\n \n \n \n \n Error code that may be returned when the lease ID matched, but the lease is breaking and cannot be changed.\n \n \n \n \n Error code that may be returned when the copy ID specified in an Abort Copy operation does not match the current pending copy ID.\n \n \n \n \n Error code that may be returned when an Abort Copy operation is called when there is no pending copy.\n \n \n \n \n Error code that may be returned when an attempt to modify the destination of a pending copy is made.\n \n \n \n \n Error code that may be returned when the source of a copy cannot be accessed.\n \n \n \n \n Error code that may be returned when the destination of a copy operation has a lease of fixed duration.\n \n \n \n \n Provides a set of parameters for a blob listing operation.\n \n \n \n \n Represents the listing context for enumeration operations.\n \n \n \n \n Initializes a new instance of the class.\n \n The resource name prefix.\n The maximum number of resources to return in a single operation, up to the per-operation limit of 5000.\n \n \n \n Gets or sets the Prefix value.\n \n The Prefix value.\n \n \n \n Gets or sets the MaxResults value.\n \n The MaxResults value.\n \n \n \n Gets or sets the Marker value.\n \n The Marker value.\n \n \n \n Initializes a new instance of the class.\n \n The blob prefix.\n The maximum number of results to return.\n The blob delimiter.\n The include parameter.\n \n \n \n Gets or sets the delimiter for a blob listing operation.\n \n The delimiter to use to traverse the virtual hierarchy of blobs.\n \n The delimiter parameter enables the caller to traverse the blob namespace by using a user-configured delimiter. \n Using this parameter, it is possible to traverse a virtual hierarchy of blobs as though it were a file system. \n \n \n \n \n Gets or sets the details for the listing operation, which indicates the types of data to include in the \n response.\n \n The details to include in the listing operation.\n \n The include parameter specifies that the response should include one or more of the following subsets: snapshots,\n metadata, uncommitted blobs.\n \n \n \n \n Provides a set of helper methods for constructing a request against the Blob service.\n \n \n \n \n Converts the date time to snapshot string.\n \n The date time.\n The converted string.\n \n \n \n Writes a collection of shared access policies to the specified stream in XML format.\n \n A collection of shared access policies.\n An output stream.\n \n \n \n Writes the body of the block list to the specified stream in XML format.\n \n An enumerable collection of objects.\n The stream to which the block list is written.\n \n \n \n Provides methods for parsing the response from an operation to return a block list.\n \n \n \n \n Initializes a new instance of the class.\n \n The stream to be parsed.\n \n \n \n Reads a block item for block listing.\n \n Whether we are currently listing committed blocks or not\n Block listing entry\n \n \n \n Parses the XML response returned by an operation to retrieve a list of blocks.\n \n An enumerable collection of objects.\n \n \n \n Gets an enumerable collection of objects from the response.\n \n An enumerable collection of objects.\n \n \n \n Provides methods for parsing the response from an operation to get a range of pages for a page blob.\n \n \n \n \n Initializes a new instance of the class.\n \n The stream of page ranges to be parsed.\n \n \n \n Reads a page range.\n \n Page range entry\n \n \n \n Parses the XML response for an operation to get a range of pages for a page blob.\n \n An enumerable collection of objects.\n \n \n \n Gets an enumerable collection of objects from the response.\n \n An enumerable collection of objects.\n \n \n \n Represents an item that may be returned by a blob listing operation.\n \n \n \n \n Represents a blob item returned in the XML response for a blob listing operation.\n \n \n \n \n Initializes a new instance of the class.\n \n The name of the blob.\n The blob's attributes.\n \n \n \n Stores the blob item's attributes.\n \n \n \n \n Gets the name of the blob item.\n \n The name of the blob item.\n \n \n \n Gets the blob item's system properties.\n \n The blob item's properties.\n \n \n \n Gets the user-defined metadata for the blob item.\n \n The blob item's metadata, as a collection of name-value pairs.\n \n \n \n Gets the blob item's URI.\n \n The absolute URI to the blob item.\n \n \n \n Gets the date and time that the blob snapshot was taken, if this blob is a snapshot.\n \n The blob's snapshot time if the blob is a snapshot; otherwise, null.\n \n If the blob is not a snapshot, the value of this property is null.\n \n \n \n \n Gets the state of the most recent or pending copy operation.\n \n A object containing the copy state, or null if no copy blob state exists for this blob.\n \n \n \n Represents the blob name prefix that is returned in the XML response for a blob listing operation.\n \n \n \n \n Gets the blob name prefix.\n \n The blob name prefix.\n \n \n \n Provides methods for parsing the response from a blob listing operation.\n \n \n \n \n Stores the blob prefix.\n \n \n \n \n Signals when the blob prefix can be consumed.\n \n \n \n \n Stores the marker.\n \n \n \n \n Signals when the marker can be consumed.\n \n \n \n \n Stores the blob delimiter.\n \n \n \n \n Signals when the blob delimiter can be consumed.\n \n \n \n \n Stores the max results.\n \n \n \n \n Signals when the max results can be consumed.\n \n \n \n \n Stores the next marker.\n \n \n \n \n Signals when the next marker can be consumed.\n \n \n \n \n Initializes a new instance of the class.\n \n The stream to be parsed.\n \n \n \n Parses a blob entry in a blob listing response.\n \n Blob listing entry\n \n \n \n Parses a blob prefix entry in a blob listing response.\n \n Blob listing entry\n \n \n \n Parses the response XML for a blob listing operation.\n \n An enumerable collection of objects that implement .\n \n \n \n Gets the listing context from the XML response.\n \n A set of parameters for the listing operation.\n \n \n \n Gets an enumerable collection of objects that implement from the response.\n \n An enumerable collection of objects that implement .\n \n \n \n Gets the Prefix value provided for the listing operation from the XML response.\n \n The Prefix value.\n \n \n \n Gets the Marker value provided for the listing operation from the XML response.\n \n The Marker value.\n \n \n \n Gets the Delimiter value provided for the listing operation from the XML response.\n \n The Delimiter value.\n \n \n \n Gets the MaxResults value provided for the listing operation from the XML response.\n \n The MaxResults value.\n \n \n \n Gets the NextMarker value from the XML response, if the listing was not complete.\n \n The NextMarker value.\n \n \n \n Provides methods for parsing the response from a container listing operation.\n \n \n \n \n Stores the container prefix.\n \n \n \n \n Signals when the container prefix can be consumed.\n \n \n \n \n Stores the marker.\n \n \n \n \n Signals when the marker can be consumed.\n \n \n \n \n Stores the max results.\n \n \n \n \n Signals when the max results can be consumed.\n \n \n \n \n Stores the next marker.\n \n \n \n \n Signals when the next marker can be consumed.\n \n \n \n \n Initializes a new instance of the class.\n \n The stream to be parsed.\n \n \n \n Reads a container entry completely including its properties and metadata.\n \n Container listing entry\n \n \n \n Parses the response XML for a container listing operation.\n \n An enumerable collection of objects.\n \n \n \n Gets the listing context from the XML response.\n \n A set of parameters for the listing operation.\n \n \n \n Gets an enumerable collection of objects from the response.\n \n An enumerable collection of objects.\n \n \n \n Gets the Prefix value provided for the listing operation from the XML response.\n \n The Prefix value.\n \n \n \n Gets the Marker value provided for the listing operation from the XML response.\n \n The Marker value.\n \n \n \n Gets the MaxResults value provided for the listing operation from the XML response.\n \n The MaxResults value.\n \n \n \n Gets the NextMarker value from the XML response, if the listing was not complete.\n \n The NextMarker value.\n \n \n \n Describes actions that may be used for writing to a page blob or clearing a set of pages.\n \n \n \n \n Update the page with new data.\n \n \n \n \n Clear the page.\n \n \n \n \n Represents a block in a block list.\n \n \n \n \n Initializes a new instance of the class.\n \n The block ID.\n One of the enumeration values that specifies in which block lists to search for the block.\n \n \n \n Gets the block ID.\n \n The block ID.\n \n \n \n Gets a value that indicates which block lists to search for the block.\n \n One of the enumeration values that specifies in which block lists to search for the block.\n \n \n \n Enumeration controlling the options for updating queue messages.\n \n \n \n \n Update the message visibility timeout.\n \n \n \n \n Update the message content.\n \n \n \n \n Represents a continuation token returned by the Queue service.\n \n continuation tokens are used in methods that return a object, such as . \n \n \n \n Gets an XML representation of an object.\n \n \n An that describes the XML representation of the object that is produced by the method and consumed by the method.\n \n \n \n \n Generates a serializable continuation token from its XML representation.\n \n The stream from which the continuation token is deserialized.\n \n \n \n Converts a serializable continuation token into its XML representation.\n \n The stream to which the continuation token is serialized.\n \n \n \n Gets or sets the version for continuing results for CloudQueue enumeration operations.\n \n The version.\n \n \n \n Gets or sets the type element (blob, queue, table) for continuing results for CloudQueue enumeration operations.\n \n The type element.\n \n \n \n Gets or sets the NextMarker for continuing results for CloudQueue enumeration operations.\n \n The next marker.\n \n \n \n Gets or sets the storage location that the continuation token applies to.\n \n The storage location that the continuation token applies to.\n \n \n \n Enum for Queue message type.\n Internal use only. \n \n \n \n \n Indicates the message object stores the raw text string.\n \n \n \n \n Indicates the message object stores the Base64-Encoded representation of the raw data. \n \n \n \n \n Represents a set of timeout and retry policy options that may be specified for a request against the Queue service.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Clones an instance of QueueRequestOptions so that we can apply defaults.\n \n QueueRequestOptions instance to be cloned.\n \n \n \n Gets or sets the absolute expiry time across all potential retries for the request. \n \n \n \n \n Gets or sets the retry policy for the request.\n \n The retry policy delegate.\n \n \n \n Gets or sets the location mode of the request.\n \n The location mode of the request.\n \n \n \n Gets or sets the server timeout for the request. \n \n The client and server timeout interval for the request.\n \n \n \n Gets or sets the maximum execution time across all potential retries for the request. \n \n A representing the maximum execution time for retries for the request.\n \n \n \n Represents a segment of results, with continuation information for pagination scenarios.\n \n \n \n \n Gets an enumerable collection of results.\n \n An enumerable collection of results.\n \n \n \n Gets the continuation token used to retrieve the next segment of results. Returns null if there are no more results.\n \n The continuation token.\n \n \n \n Specifies the set of possible permissions for a shared access queue policy.\n \n \n \n \n No shared access granted.\n \n \n \n \n Permission to peek messages and get queue metadata granted.\n \n \n \n \n Permission to add messages granted.\n \n \n \n \n Permissions to update messages granted.\n \n \n \n \n Permission to get and delete messages granted.\n \n \n \n \n Represents the collection of shared access policies defined for a queue.\n \n \n \n \n Adds the specified key and value to the collection of shared access policies.\n \n The key of the value to add.\n The value to add the collection of shared access policies.\n \n \n \n Determines whether the collection of shared access policies contains the specified key.\n \n The key to locate in the collection of shared access policies.\n true if the collection of shared access policies contains an element with the specified key; otherwise, false.\n \n \n \n Removes the value with the specified key from the shared access policies collection.\n \n The key of the item to remove.\n true if the element is successfully found and removed; otherwise, false. This method returns false if the key is not found.\n \n \n \n Gets the item associated with the specified key. \n \n The key of the value to get.\n The item to get.\n The item associated with the specified key, if the key is found; otherwise, the default value for the type.\n \n \n \n Adds the specified key/ value, stored in a , to the collection of shared access policies.\n \n The object, containing a key/ value pair, to add to the shared access policies collection.\n \n \n \n Removes all keys and values from the shared access collection.\n \n \n \n \n Determines whether the collection of shared access policies contains the key and value in the specified object.\n \n A object containing the key and value to search for.\n true if the shared access policies collection contains the specified key/value; otherwise, false.\n \n \n \n Copies each key/ value pair in the shared access policies collection to a compatible one-dimensional array, starting at the specified index of the target array.\n \n The one-dimensional array of objects that is the destination of the elements copied from the shared access policies collection.\n The zero-based index in at which copying begins.\n \n \n \n Removes the value, specified in the object, from the shared access policies collection.\n \n The object, containing a key and value, to remove from the shared access policies collection.\n true if the item was successfully removed; otherwise, false.\n \n \n \n Returns an enumerator that iterates through the collection of shared access policies.\n \n An of type .\n \n \n \n Returns an enumerator that iterates through the collection of shared access policies.\n \n An object that can be used to iterate through the collection of shared access policies.\n \n \n \n Gets a collection containing the keys in the shared access policies collection.\n \n A collection containing the keys in the of shared access policies collection.\n \n \n \n Gets a collection containing the values in the shared access policies collection.\n \n A collection of items in the shared access policies collection.\n \n \n \n Gets or sets the item associated with the specified key.\n \n The key of the value to get or set.\n The item associated with the specified key, or null if key is not in the shared access policies collection.\n \n \n \n Gets the number of key/ value pairs contained in the shared access policies collection.\n \n The number of key/ value pairs contained in the shared access policies collection.\n \n \n \n Gets a value indicating whether the collection of shared access policies is read-only. \n \n true if the collection of shared access policies is read-only; otherwise, false.\n \n \n \n Represents a shared access policy for a queue, which specifies the start time, expiry time, \n and permissions for a shared access signature.\n \n \n \n \n Initializes a new instance of the SharedAccessQueuePolicy class.\n \n \n \n \n Converts the permissions specified for the shared access policy to a string.\n \n The shared access permissions.\n The shared access permissions in string format.\n \n \n \n Constructs a object from a permissions string.\n \n The shared access permissions in string format.\n A set of shared access permissions.\n \n \n \n Gets or sets the start time for a shared access signature associated with this shared access policy.\n \n The shared access start time.\n \n \n \n Gets or sets the expiry time for a shared access signature associated with this shared access policy.\n \n The shared access expiry time.\n \n \n \n Gets or sets the permissions for a shared access signature associated with this shared access policy.\n \n The permissions.\n \n \n \n Provides methods for parsing the response from an operation to get messages from a queue.\n \n \n \n \n Initializes a new instance of the class.\n \n The stream of messages to parse.\n \n \n \n Parses a message entry in a queue get messages response.\n \n Message entry\n \n \n \n Parses the XML response returned by an operation to get messages from a queue.\n \n An enumerable collection of objects.\n \n \n \n Gets an enumerable collection of objects from the response.\n \n An enumerable collection of objects.\n \n \n \n Provides methods for parsing the response from a queue listing operation.\n \n \n \n \n Stores the container prefix.\n \n \n \n \n Signals when the container prefix can be consumed.\n \n \n \n \n Stores the marker.\n \n \n \n \n Signals when the marker can be consumed.\n \n \n \n \n Stores the max results.\n \n \n \n \n Signals when the max results can be consumed.\n \n \n \n \n Stores the next marker.\n \n \n \n \n Signals when the next marker can be consumed.\n \n \n \n \n Initializes a new instance of the class.\n \n The stream to be parsed.\n \n \n \n Parses a queue entry in a queue listing response.\n \n Queue listing entry\n \n \n \n Parses the response XML for a queue listing operation.\n \n An enumerable collection of objects.\n \n \n \n Gets the listing context from the XML response.\n \n A set of parameters for the listing operation.\n \n \n \n Gets an enumerable collection of objects from the response.\n \n An enumerable collection of objects.\n \n \n \n Gets the Prefix value provided for the listing operation from the XML response.\n \n The Prefix value.\n \n \n \n Gets the Marker value provided for the listing operation from the XML response.\n \n The Marker value.\n \n \n \n Gets the MaxResults value provided for the listing operation from the XML response.\n \n The MaxResults value.\n \n \n \n Gets the NextMarker value from the XML response, if the listing was not complete.\n \n The NextMarker value.\n \n \n \n Parses the response XML from an operation to set the access policy for a queue.\n \n \n \n \n Initializes a new instance of the QueueAccessPolicyResponse class.\n \n The stream to be parsed.\n \n \n \n Parses the current element.\n \n The shared access policy element to parse.\n The shared access policy.\n \n \n \n Represents a queue item returned in the XML response for a queue listing operation.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class.\n \n The name of the queue.\n The Uri of the queue.\n The queue's metadata.\n \n \n \n Gets the user-defined metadata for the queue.\n \n The queue's metadata, as a collection of name-value pairs.\n \n \n \n Gets the name of the queue.\n \n The queue's name.\n \n \n \n Gets the queue's URI.\n \n The absolute URI to the queue.\n \n \n \n Provides error code strings that are specific to the Queue service.\n \n \n \n \n Error code that may be returned when the specified queue was not found.\n \n \n \n \n Error code that may be returned when the specified queue is disabled.\n \n \n \n \n Error code that may be returned when the specified queue already exists.\n \n \n \n \n Error code that may be returned when the specified queue is not empty.\n \n \n \n \n Error code that may be returned when the specified queue is being deleted.\n \n \n \n \n Error code that may be returned when the specified pop receipt does not match.\n \n \n \n \n Error code that may be returned when one or more request parameters are invalid.\n \n \n \n \n Error code that may be returned when the specified message was not found.\n \n \n \n \n Error code that may be returned when the specified message is too large.\n \n \n \n \n Error code that may be returned when the specified marker is invalid.\n \n \n \n \n Provides a set of parameters for a queue listing operation.\n \n \n \n \n Initializes a new instance of the class.\n \n The queue prefix.\n The maximum number of results to return.\n The include parameter.\n \n \n \n Gets or sets the details for the listing operation, which indicates the types of data to include in the \n response.\n \n The details to include in the listing operation.\n \n \n \n Specifies which details to include when listing the queues in this storage account.\n \n \n \n \n No additional details.\n \n \n \n \n Retrieve queue metadata.\n \n \n \n \n Retrieve all available details.\n \n \n \n \n Represents a message retrieved from a queue.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets the message expiration time.\n \n The message expiration time.\n \n \n \n Gets the message ID.\n \n The message ID.\n \n \n \n Gets the time the message was added to the queue.\n \n The message insertion time.\n \n \n \n Gets the time the message is next visible.\n \n The time the message is next visible.\n \n \n \n Gets the pop receipt for the message.\n \n The message's pop receipt.\n \n \n \n Gets the text of the message.\n \n The message text.\n \n \n \n Gets the number of times this message has been dequeued.\n \n The dequeue count.\n \n \n \n Represents the permissions for a queue.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets the set of shared access policies for the queue.\n \n The set of shared access policies for the queue.\n \n \n \n Provides a set of helper methods for constructing a request against the Queue service.\n \n \n \n \n Writes a collection of shared access policies to the specified stream in XML format.\n \n A collection of shared access policies.\n An output stream.\n \n \n \n Writes a message to the specified stream in XML format.\n \n The message body.\n An output stream.\n \n \n \n Gets or sets the number of entities the table query will return. \n \n The maximum number of entities for the table query to return.\n \n \n \n Gets or sets the filter expression to use in the table query.\n \n A string containing the filter expression to use in the query.\n \n \n \n Gets or sets the property names of the table entity properties to return when the table query is executed.\n \n A list of strings containing the property names of the table entity properties to return when the query is executed.\n \n \n \n Provides a set of extension methods for objects of type .\n \n \n \n \n Specifies a set of on the query.\n \n The entity type of the query.\n A query that implements .\n A object that specifies execution options, such as retry policy and timeout settings, for the operation.\n A object with the specified request options set.\n \n \n \n \n Specifies an for the query.\n \n The entity type of the query.\n A query that implements .\n An object for tracking the current operation.\n A object with the specified operation context.\n \n \n \n \n Specifies an entity resolver for the query.\n \n The entity type of the query.\n The type of the resolver.\n A query that implements .\n The entity resolver, of type .\n A with the specified resolver.\n \n \n \n \n Specifies that a query be returned as a object.\n \n The entity type of the query.\n A query that implements .\n An object of type .\n \n \n \n \n A type which allows callers direct access to the property map of the entity. This class eliminates the use of reflection for serialization and deserialization.\n \n \n \n \n An interface required for table entity types. The interface declares getter and setter methods for the mandatory entity properties, and \n and methods for serialization and de-serialization of all entity properties using a property dictionary. Create classes implementing to customize property \n storage, retrieval, serialization and de-serialization, and to provide additional custom logic for a table entity.\n \n The storage client library includes two implementations of that provide for simple property access and serialization:\n implements and provides a simple property dictionary to store and retrieve properties. Use a for simple access \n to entity properties when only a subset of properties are returned (for example, by a select clause in a query), or for scenarios where your query can return multiple entity types \n with different properties. You can also use this type to perform bulk table updates of heterogeneous entities without losing property information.\n is an implementation of that uses reflection-based serialization and de-serialization behavior in its and methods. \n -derived classes with methods that follow a convention for types and naming are serialized and deserialized automatically. -derived classes must also provide a get-able and set-able public\n property of a type that is supported by the Windows Azure Table service.\n \n \n \n Populates the entity's properties from the data values in the dictionary. \n \n The dictionary of string property names to data values to deserialize and store in this table entity instance.\n An object used to track the execution of the operation.\n \n \n \n Serializes the of property names mapped to data values from the entity instance.\n \n An object used to track the execution of the operation.\n A dictionary of property names to data typed values created by serializing this table entity instance.\n \n \n \n Gets or sets the entity's partition key.\n \n The entity's partition key.\n \n \n \n Gets or sets the entity's row key.\n \n The entity's row key.\n \n \n \n Gets or sets the entity's timestamp.\n \n The entity's timestamp. The property is populated by the Windows Azure Table Service.\n \n \n \n Gets or sets the entity's current ETag. Set this value to '*'\n in order to blindly overwrite an entity as part of an update\n operation.\n \n The entity's timestamp.\n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class with the specified partition key and row key.\n \n The partition key value for the entity.\n The row key value for the entity.\n \n \n \n Initializes a new instance of the class with the entity's partition key, row key, ETag (if available/required), and properties.\n \n The entity's partition key.\n The entity's row key.\n The entity's current ETag.\n The entity's properties, indexed by property name.\n \n \n \n Initializes a new instance of the class with the entity's partition key, row key, timestamp, ETag (if available/required), and properties.\n \n The entity's partition key.\n The entity's row key.\n The timestamp for this entity as returned by Windows Azure.\n The entity's current ETag; set to null to ignore the ETag during subsequent update operations.\n An containing a map of property names to data typed values to store in the new .\n \n \n \n Deserializes this instance using the specified of property names to values of type .\n \n A collection containing the of string property names mapped to values of type to store in this instance.\n An object used to track the execution of the operation.\n \n \n \n Serializes the of property names mapped to values of type from this instance.\n \n An object used to track the execution of the operation.\n A collection containing the map of string property names to values of type stored in this instance.\n \n \n \n Gets or sets the properties in the table entity, indexed by property name.\n \n The entity properties.\n \n \n \n Gets or sets the entity's partition key.\n \n The entity partition key.\n \n \n \n Gets or sets the entity's row key.\n \n The entity row key.\n \n \n \n Gets or sets the entity's timestamp.\n \n The entity timestamp.\n \n \n \n Gets or sets the entity's current ETag. Set this value to '*' to blindly overwrite an entity as part of an update operation.\n \n The entity ETag.\n \n \n \n Gets or sets the entity's property, given the name of the property.\n \n The name of the property.\n The property.\n \n \n \n Enumeration containing the types of values that can be stored in\n a table entity property.\n \n \n \n \n Represents fixed- or variable-length character data.\n \n \n \n \n Represents fixed- or variable-length binary data.\n \n \n \n \n Represents the mathematical concept of binary-valued logic.\n \n \n \n \n Represents date and time.\n \n \n \n \n Represents a floating point number with 15 digits precision that can represent values with approximate range of +/- 2.23e -308 through +/- 1.79e +308.\n \n \n \n \n Represents a 16-byte (128-bit) unique identifier value.\n \n \n \n \n Represents a signed 32-bit integer value.\n \n \n \n \n Represents a signed 64-bit integer value.\n \n \n \n \n Class for storing information about a single property in an entity in a table.\n \n \n \n \n Creates a new object that represents the specified offset value.\n \n The value for the new .\n A new of the offset type.\n \n \n \n Creates a new object that represents the specified byte array.\n \n The value for the new .\n A new of the byte array.\n \n \n \n Creates a new object that represents the specified value.\n \n The value for the new .\n A new of the type.\n \n \n \n Creates a new object that represents the specified value.\n \n The value for the new .\n A new of the type.\n \n \n \n Creates a new object that represents the specified value.\n \n The value for the new .\n A new of the type.\n \n \n \n Creates a new object that represents the specified value.\n \n The value for the new .\n A new of the type.\n \n \n \n Creates a new object that represents the specified value.\n \n The value for the new .\n A new of the type.\n \n \n \n Creates a new object that represents the specified value.\n \n The value for the new .\n A new of the type.\n \n \n \n Initializes a new instance of the class by using the\n byte array value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the class by using the\n value of the property.\n \n The value for the new .\n \n \n \n Initializes a new instance of the EntityProperty class given the\n EdmType of the property (the value must be set by a public\n constructor).\n \n \n \n \n Compares the given object (which is probably an )\n for equality with this object.\n \n The other object.\n true if the objects are equivalent; false otherwise.\n \n \n \n Compares the given object (which is probably an )\n for equality with this object.\n \n The other object.\n true if the objects are equivalent; false otherwise.\n \n \n \n Gets the hash code for this entity property.\n \n The hash code for the entity property.\n \n \n \n Creates an from the object.\n \n The value of the object.\n The reference to the object created.\n \n \n \n Ensures that the given type matches the type of this entity\n property; throws an exception if the types do not match.\n \n \n \n \n Gets the as a generic object.\n \n \n \n \n Gets the of this object.\n \n The of this object.\n \n \n \n Gets or sets the byte array value of this object.\n An exception will be thrown if you attempt to set this property to anything other than an byte array.\n \n The byte array value of this object.\n \n \n \n Gets or sets the value of this object.\n An exception will be thrown if you attempt to set this property to anything other than an Object.\n \n The value of this object.\n \n \n \n Gets or sets the offset value of this object.\n An exception will be thrown if you attempt to set this property to anything other than a object.\n \n The offset value of this object.\n \n \n \n Gets or sets the value of this object.\n An exception will be thrown if you attempt to set this property to anything other than a object.\n \n The value of this object.\n \n \n \n Gets or sets the value of this object.\n An exception will be thrown if you attempt to set this property to anything other than a object.\n \n The value of this object.\n \n \n \n Gets or sets the value of this object.\n An exception will be thrown if you attempt to set this property to anything other than an Object.\n \n The value of this object.\n \n \n \n Gets or sets the value of this object.\n An exception will be thrown if you attempt to set this property to anything other than an Object.\n \n The value of this object.\n \n \n \n Gets or sets the value of this object.\n An exception will be thrown if you attempt to set this property to anything other than a object.\n \n The value of this object.\n \n \n \n Returns a delegate for resolving entities.\n \n The type into which the query results are projected.\n The partition key.\n The row key.\n The timestamp.\n A dictionary of properties.\n The ETag.\n \n \n \n \n Defines the set of comparison operators that may be used for constructing queries.\n \n \n \n \n Represents the Equal operator.\n \n \n \n \n Represents the Not Equal operator.\n \n \n \n \n Represents the Greater Than operator.\n \n \n \n \n Represents the Greater Than or Equal operator.\n \n \n \n \n Represents the Less Than operator.\n \n \n \n \n Represents the Less Than or Equal operator.\n \n \n \n \n Specifies the set of possible permissions for a shared access table policy.\n \n \n \n \n No shared access granted.\n \n \n \n \n Permission to query entities granted.\n \n \n \n \n Permission to add entities granted.\n \n \n \n \n Permission to modify entities granted.\n \n \n \n \n Permission to delete entities granted.\n \n \n \n \n Represents the collection of shared access policies defined for a table.\n \n \n \n \n Adds the specified key and value to the collection of shared access policies.\n \n The key of the value to add.\n The value to add to the collection of shared access policies.\n \n \n \n Determines whether the collection of shared access policies contains the specified key.\n \n The key to locate in the collection of shared access policies.\n true if the collection of shared access policies contains an element with the specified key; otherwise, false.\n \n \n \n Removes the value with the specified key from the shared access policies collection.\n \n The key of the item to remove.\n true if the element is successfully found and removed; otherwise, false. This method returns false if the key is not found.\n \n \n \n Gets the item associated with the specified key. \n \n The key of the value to get.\n The item to get.\n The item associated with the specified key, if the key is found; otherwise, the default value for the type.\n \n \n \n Adds the specified key/ value, stored in a , to the collection of shared access policies.\n \n The object, containing a key/ value pair, to add to the shared access policies collection.\n \n \n \n Removes all keys and values from the shared access collection.\n \n \n \n \n Determines whether the collection of shared access policies contains the key and value in the specified object.\n \n A object containing the key and value to search for.\n true if the shared access policies collection contains the specified key/value; otherwise, false.\n \n \n \n Copies each key/ value pair in the shared access policies collection to a compatible one-dimensional array, starting at the specified index of the target array.\n \n The one-dimensional array of objects that is the destination of the elements copied from the shared access policies collection.\n The zero-based index in at which copying begins.\n \n \n \n Removes the value, specified in the object, from the shared access policies collection.\n \n The object, containing a key and value, to remove from the shared access policies collection.\n true if the item was successfully removed; otherwise, false.\n \n \n \n Returns an enumerator that iterates through the collection of shared access policies.\n \n An of type .\n \n \n \n Returns an enumerator that iterates through the collection of shared access policies.\n \n An object that can be used to iterate through the collection of shared access policies.\n \n \n \n Gets a collection containing the keys in the shared access policies collection.\n \n A collection containing the keys in the of shared access policies collection.\n \n \n \n Gets a collection containing the values in the shared access policies collection.\n \n A collection of items in the shared access policies collection.\n \n \n \n Gets or sets the item associated with the specified key.\n \n The key of the value to get or set.\n The item associated with the specified key, or null if key is not in the shared access policies collection.\n \n \n \n Gets the number of key/ value pairs contained in the shared access policies collection.\n \n The number of key/ value pairs contained in the shared access policies collection.\n \n \n \n Gets a value indicating whether the collection of shared access policies is read-only. \n \n true if the collection of shared access policies is read-only; otherwise, false.\n \n \n \n Represents a shared access policy, which specifies the start time, expiry time, \n and permissions for a shared access signature.\n \n \n \n \n Initializes a new instance of the SharedAccessTablePolicy class.\n \n \n \n \n Converts the permissions specified for the shared access policy to a string.\n \n The shared access permissions.\n The shared access permissions in string format.\n \n \n \n Constructs a object from a permissions string.\n \n The shared access permissions in string format.\n A set of shared access permissions.\n \n \n \n Gets or sets the start time for a shared access signature associated with this shared access policy.\n \n The shared access start time.\n \n \n \n Gets or sets the expiry time for a shared access signature associated with this shared access policy.\n \n The shared access expiry time.\n \n \n \n Gets or sets the permissions for a shared access signature associated with this shared access policy.\n \n The permissions.\n \n \n \n Represents a continuation token for listing operations. \n \n A method that may return a partial set of results via a object also returns a continuation token, \n which can be used in a subsequent call to return the next set of available results. \n \n \n \n Gets an XML representation of an object.\n \n \n An that describes the XML representation of the object that is produced by the method and consumed by the method.\n \n \n \n \n Generates a serializable continuation token from its XML representation.\n \n The stream from which the continuation token is deserialized.\n \n \n \n Converts a serializable continuation token into its XML representation.\n \n The stream to which the continuation token is serialized.\n \n \n \n Gets or sets the version for continuing results for enumeration operations.\n \n The version.\n \n \n \n Gets or sets the type element (blob, queue, table) for continuing results for enumeration operations.\n \n The type element.\n \n \n \n Gets or sets the next partition key for enumeration operations.\n \n The next partition key.\n \n \n \n Gets or sets the next row key for enumeration operations.\n \n The next row key.\n \n \n \n Gets or sets the next table name for enumeration operations.\n \n The name of the next table.\n \n \n \n Gets or sets the storage location that the continuation token applies to.\n \n The storage location that the continuation token applies to.\n \n \n \n Represents the base object type for a table entity in the Table service.\n \n provides a base implementation for the interface that provides and methods that by default serialize and \n deserialize all properties via reflection. A table entity class may extend this class and override the and methods to provide customized or better performing serialization logic.\n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class with the specified partition key and row key.\n \n The partition key of the to be initialized.\n The row key of the to be initialized.\n \n \n \n Deserializes this instance using the specified of property names to data typed values. \n \n The map of string property names to data values to deserialize and store in this table entity instance.\n An object used to track the execution of the operation.\n \n \n \n Deserializes a custom entity instance using the specified of property names to data typed values. \n \n Custom entity instance being deserialized.\n The map of string property names to data values to deserialize and store in this entity instance.\n An object used to track the execution of the operation. \n \n \n \n Serializes the of property names mapped to data values from this instance.\n \n An object used to track the execution of the operation.\n A map of property names to data typed values created by serializing this table entity instance.\n \n \n \n Create a of objects for all the properties of the specified entity object.\n \n The entity object to serialize.\n An object used to track the execution of the operation.\n A of objects for all the properties of the specified entity object.\n \n \n \n Determines if the given property should be skipped based on its name, if it exposes a public getter and setter, and if the IgnoreAttribute is not defined.\n \n The PropertyInfo of the property to check\n An object used to track the execution of the operation.\n True if the property should be skipped, false otherwise. \n \n \n \n Compiles a ReadAction for the given type\n \n The type to compile for\n A ReadAction that deserializes the given entity type.\n \n \n \n Compiles a WriteFunc for the given type\n \n The type to compile for\n A WriteFunc that serializes the given entity type.\n \n \n \n Generates a Conditional Expression that will retrieve the given entity value by type and set it into the current property. \n \n The entity type\n The property to deserialize into\n An Expression that represents the entity instance\n An Expression that represents the current EntityProperty expression\n \n \n \n \n Gets the EntityProperty from the dictionary, or returns null. Similar to IDictionary.TryGetValue with logging support.\n \n The key value\n The Dictionary instance\n The operationContext to log to.\n \n \n \n \n Gets or sets the entity's partition key.\n \n The partition key of the entity.\n \n \n \n Gets or sets the entity's row key.\n \n The row key of the entity.\n \n \n \n Gets or sets the entity's timestamp.\n \n The timestamp of the entity.\n \n \n \n Gets or sets the entity's current ETag. Set this value to '*' in order to blindly overwrite an entity as part of an update operation.\n \n The ETag of the entity.\n \n \n \n Disables the ability to dynamically generate read and write lambdas at runtime. Setting this to false will clear out the static cache shared across all type instances that derive from TableEntity.\n \n \n \n \n This entities compiled Write Func\n \n \n \n \n This entities compiled Read Action\n \n \n \n \n Gets or sets the status of the property resolver cache for the . \n \n The property resolver cache caches known entity types and their respective property resolver dictionaries when entities are deserialized and the payload does not include JSON metadata. For most scenarios, disabling the property resolver cache is not recommended due to its effect on performance. \n \n \n \n \n \n Enumeration containing the types of operations that can be\n performed by a .\n \n \n \n \n Represents an insert operation.\n \n \n \n \n Represents a delete operation.\n \n \n \n \n Represents a replace operation.\n \n \n \n \n Represents a merge operation.\n \n \n \n \n Represents an insert or replace operation.\n \n \n \n \n Represents an insert or merge operation.\n \n \n \n \n Represents a retrieve operation.\n \n \n \n \n Defines the set of Boolean operators for constructing queries.\n \n \n \n \n Represents the And operator.\n \n \n \n \n Represents the Not operator.\n \n \n \n \n Represents the Or operator.\n \n \n \n \n Describes the payload formats supported for Tables.\n \n \n \n \n Use AtomPub.\n \n \n \n \n Use JSON with full metadata.\n \n \n \n \n Use JSON with minimal metadata.\n \n \n \n \n Use JSON with no metadata.\n \n \n \n \n Represents the permissions for a table.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Gets the set of shared access policies for the container.\n \n The set of shared access policies for the container.\n \n \n \n Represents a segment of results and contains continuation token information.\n \n The type of the result that the segment contains.\n \n \n \n Stores the continuation token used to retrieve the next segment of results.\n \n \n \n \n Initializes a new instance of the class.\n \n The result.\n \n \n \n Returns an enumerator that iterates through the .\n \n An enumerator that iterates through the .\n \n \n \n Gets an enumerable collection of results.\n \n An enumerable collection of results. \n \n \n \n Gets a continuation token to use to retrieve the next set of results with a subsequent call to the operation.\n \n The continuation token.\n \n \n \n Represents a set of timeout and retry policy options that may be specified for a request against the Table service.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class with the specified .\n \n The request options used to initialize this instance of the class.\n \n \n \n Gets or sets the absolute expiry time across all potential retries for the request. \n \n \n \n \n Gets or sets the retry policy for the request.\n \n The retry policy delegate.\n \n \n \n Gets or sets the location mode of the request.\n \n The location mode of the request.\n \n \n \n Gets or sets the server timeout for the request. \n \n The client and server timeout interval for the request.\n \n \n \n Gets or sets the maximum execution time for all potential retries for the request.\n \n A representing the maximum execution time for retries for the request.\n \n \n \n Gets or sets the that will be used for the request.\n \n The TablePayloadFormat to use.\n \n \n \n Gets or sets the delegate that is used to get the for an entity property given the partition key, row key, and the property name. \n \n \n \n \n Represents the result of a table operation.\n \n The class encapsulates the HTTP response and any table entity results returned by the Storage Service REST API operation called for a particular .\n \n \n \n Gets or sets the result returned by the as an .\n \n The result of the table operation as an .\n \n \n \n Gets or sets the HTTP status code returned by a request.\n \n The HTTP status code returned by a request.\n \n \n \n Gets or sets the ETag returned with the request results.\n \n The ETag returned with the request results.\n \n \n \n Represents a segment of results, with continuation information for pagination scenarios.\n \n \n \n \n Initializes a new instance of the class.\n \n The result.\n \n \n \n Stores the continuation token used to retrieve the next segment of results or null if there are no more results.\n \n \n \n \n Returns an enumerator that iterates through the segment of results. \n \n An enumerator that iterates through the segment of results.\n \n \n \n Gets an enumerable collection of results.\n \n An enumerable collection of results.\n \n \n \n Gets the continuation token used to retrieve the next segment of results. Returns null if there are no more results.\n \n The continuation token.\n \n \n \n Internal table service entity for creating tables.\n \n \n \n \n Stores the table name.\n \n \n \n \n Initializes a new instance of the class.\n \n \n \n \n Initializes a new instance of the class with the specified name.\n \n The name of the table.\n \n \n \n Determines whether the specified is equal to this instance.\n \n The to compare with this instance.\n \n Returns true if the specified is equal to this instance; otherwise, false.\n \n \n The parameter is null.\n \n \n \n \n Returns a hash code for this instance.\n \n \n A hash code for this instance, suitable for use in hashing algorithms and data structures like a hash table. \n \n \n \n \n Gets or sets the table name.\n \n The name of the table.\n \n \n \n Parses the response XML from an operation to set the access policy for a table.\n \n \n \n \n Initializes a new instance of the TableAccessPolicyResponse class.\n \n The stream to be parsed.\n \n \n \n Parses the current element.\n \n The shared access policy element to parse.\n The shared access policy.\n \n \n \n A set of constants used in operations against the Table service.\n \n \n \n \n Stores the header prefix for continuation information.\n \n \n \n \n Stores the header suffix for the next partition key.\n \n \n \n \n Stores the header suffix for the next row key.\n \n \n \n \n Stores the table suffix for the next table name.\n \n \n \n \n Stores the maximum results the table service can return.\n \n \n \n \n The maximum size of a string property for the table service in bytes.\n \n \n \n \n The maximum size of a string property for the table service in bytes.\n \n \n \n \n The maximum size of a string property for the table service in chars.\n \n \n \n \n The name of the special table used to store tables.\n \n \n \n \n The name of the partition key property.\n \n \n \n \n The name of the row key property.\n \n \n \n \n The name of the Timestamp property.\n \n \n \n \n The name of the ETag property.\n \n \n \n \n The name of the property that stores the table name.\n \n \n \n \n The query filter clause name.\n \n \n \n \n The query top clause name.\n \n \n \n \n The query select clause name.\n \n \n \n \n The minimum DateTime supported.\n \n \n \n \n Provides error code strings that are specific to the Windows Azure Table service.\n \n \n \n \n The request uses X-HTTP-Method with an HTTP verb other than POST.\n \n \n \n \n The specified X-HTTP-Method is invalid.\n \n \n \n \n More than one X-HTTP-Method is specified.\n \n \n \n \n The specified table has no properties.\n \n \n \n \n A property is specified more than once.\n \n \n \n \n The specified table has no such property.\n \n \n \n \n A duplicate key property was specified.\n \n \n \n \n The specified table already exists.\n \n \n \n \n The specified table was not found.\n \n \n \n \n The specified entity was not found.\n \n \n \n \n The specified entity already exists.\n \n \n \n \n The partition key was not specified.\n \n \n \n \n One or more specified operators are invalid.\n \n \n \n \n The specified update condition was not satisfied.\n \n \n \n \n All properties must have values.\n \n \n \n \n The partition key property cannot be updated.\n \n \n \n \n The entity contains more properties than allowed.\n \n \n \n \n The entity is larger than the maximum size permitted.\n \n \n \n \n The property value is larger than the maximum size permitted.\n \n \n \n \n One or more value types are invalid.\n \n \n \n \n The specified table is being deleted.\n \n \n \n \n The Table service server is out of memory.\n \n \n \n \n The type of the primary key property is invalid.\n \n \n \n \n The property name exceeds the maximum allowed length.\n \n \n \n \n The property name is invalid.\n \n \n \n \n Batch operations are not supported for this operation type.\n \n \n \n \n JSON format is not supported.\n \n \n \n \n The specified method is not allowed.\n \n \n \n \n The specified operation is not yet implemented.\n \n \n \n \n Provides a set of helper methods for constructing a request against the Table service.\n \n \n \n \n Writes a collection of shared access policies to the specified stream in XML format.\n \n A collection of shared access policies.\n An output stream.\n \n \n \n Contains storage constants.\n \n \n \n \n Constant for the max value of ParallelOperationThreadCount for Block Blobs.\n \n \n \n \n Maximum number of shared access policy identifiers supported by server.\n \n \n \n \n Default Write Block Size used by Blob stream.\n \n \n \n \n The maximum size of a blob before it must be separated into blocks.\n \n \n \n \n The maximum size of a single block.\n \n \n \n \n The maximum size of a range get operation that returns content MD5.\n \n \n \n \n The maximum number of blocks.\n \n \n \n \n The maximum size of a blob with blocks.\n \n \n \n \n Default size of buffer for unknown sized requests.\n \n \n \n \n Common name to be used for all loggers.\n \n \n \n \n The size of a page in a PageBlob.\n \n \n \n \n A constant representing a kilo-byte (Non-SI version).\n \n \n \n \n A constant representing a megabyte (Non-SI version).\n \n \n \n \n A constant representing a megabyte (Non-SI version).\n \n \n \n \n XML element for committed blocks.\n \n \n \n \n XML element for uncommitted blocks.\n \n \n \n \n XML element for blocks.\n \n \n \n \n XML element for names.\n \n \n \n \n XML element for sizes.\n \n \n \n \n XML element for block lists.\n \n \n \n \n XML element for queue message lists.\n \n \n \n \n XML element for queue messages.\n \n \n \n \n XML element for message IDs.\n \n \n \n \n XML element for insertion times.\n \n \n \n \n XML element for expiration times.\n \n \n \n \n XML element for pop receipts.\n \n \n \n \n XML element for the time next visible fields.\n \n \n \n \n XML element for message texts.\n \n \n \n \n XML element for dequeue counts.\n \n \n \n \n XML element for page ranges.\n \n \n \n \n XML element for page list elements.\n \n \n \n \n XML element for page range start elements.\n \n \n \n \n XML element for page range end elements.\n \n \n \n \n XML element for delimiters.\n \n \n \n \n XML element for blob prefixes.\n \n \n \n \n XML element for content type fields.\n \n \n \n \n XML element for content type fields.\n \n \n \n \n XML element for content encoding fields.\n \n \n \n \n XML element for content language fields.\n \n \n \n \n XML element for content length fields.\n \n \n \n \n XML element for content MD5 fields.\n \n \n \n \n XML element for enumeration results.\n \n \n \n \n XML element for service endpoint.\n \n \n \n \n XML element for container name.\n \n \n \n \n XML element for blobs.\n \n \n \n \n XML element for prefixes.\n \n \n \n \n XML element for maximum results.\n \n \n \n \n XML element for markers.\n \n \n \n \n XML element for the next marker.\n \n \n \n \n XML element for the ETag.\n \n \n \n \n XML element for the last modified date.\n \n \n \n \n XML element for the Url.\n \n \n \n \n XML element for blobs.\n \n \n \n \n XML element for copy ID.\n \n \n \n \n XML element for copy status.\n \n \n \n \n XML element for copy source.\n \n \n \n \n XML element for copy progress.\n \n \n \n \n XML element for copy completion time.\n \n \n \n \n XML element for copy status description.\n \n \n \n \n Constant signaling a page blob.\n \n \n \n \n Constant signaling a block blob.\n \n \n \n \n Constant signaling the blob is locked.\n \n \n \n \n Constant signaling the blob is unlocked.\n \n \n \n \n Constant signaling the resource is available for leasing.\n \n \n \n \n Constant signaling the resource is leased.\n \n \n \n \n Constant signaling the resource's lease has expired.\n \n \n \n \n Constant signaling the resource's lease is breaking.\n \n \n \n \n Constant signaling the resource's lease is broken.\n \n \n \n \n Constant signaling the resource's lease is infinite.\n \n \n \n \n Constant signaling the resource's lease is fixed (finite).\n \n \n \n \n Constant for a pending copy.\n \n \n \n \n Constant for a successful copy.\n \n \n \n \n Constant for an aborted copy.\n \n \n \n \n Constant for a failed copy.\n \n \n \n \n Constant for unavailable geo-replication status.\n \n \n \n \n Constant for live geo-replication status.\n \n \n \n \n Constant for bootstrap geo-replication status.\n \n \n \n \n XML element for blob types.\n \n \n \n \n XML element for the lease status.\n \n \n \n \n XML element for the lease status.\n \n \n \n \n XML element for the lease status.\n \n \n \n \n XML element for snapshots.\n \n \n \n \n XML element for containers.\n \n \n \n \n XML element for a container.\n \n \n \n \n XML element for queues.\n \n \n \n \n Version 2 of the XML element for the queue name.\n \n \n \n \n XML element for the queue.\n \n \n \n \n XML element for properties.\n \n \n \n \n XML element for the metadata.\n \n \n \n \n XML element for an invalid metadata name.\n \n \n \n \n XML element for maximum results.\n \n \n \n \n XML element for committed blocks.\n \n \n \n \n XML element for uncommitted blocks.\n \n \n \n \n XML element for the latest.\n \n \n \n \n XML element for signed identifiers.\n \n \n \n \n XML element for a signed identifier.\n \n \n \n \n XML element for access policies.\n \n \n \n \n XML attribute for IDs.\n \n \n \n \n XML element for the start time of an access policy.\n \n \n \n \n XML element for the end of an access policy.\n \n \n \n \n XML element for the permissions of an access policy.\n \n \n \n \n The URI path component to access the messages in a queue.\n \n \n \n \n XML element for exception details.\n \n \n \n \n XML root element for errors.\n \n \n \n \n XML element for error codes.\n \n \n \n \n XML element for error codes returned by the preview tenants.\n \n \n \n \n XML element for error messages.\n \n \n \n \n XML element for error messages.\n \n \n \n \n XML element for exception messages.\n \n \n \n \n XML element for stack traces.\n \n \n \n \n Namespace of the entity container.\n \n \n \n \n Name of the entity container.\n \n \n \n \n Name of the entity set.\n \n \n \n \n Namespace name for primitive types.\n \n \n \n \n Default namespace name for Tables. \n \n \n \n \n Default name for Tables. \n \n \n \n \n Header value to set Accept to XML.\n \n \n \n \n Header value to set Accept to AtomPub.\n \n \n \n \n Header value to set Accept to JsonLight.\n \n \n \n \n Header value to set Accept to JsonFullMetadata.\n \n \n \n \n Header value to set Accept to JsonNoMetadata.\n \n \n \n \n Header value to set Content-Type to AtomPub.\n \n \n \n \n Header value to set Content-Type to JSON.\n \n \n \n \n The prefix used in all ETags.\n \n \n \n \n Default client side timeout for all service clients.\n \n \n \n \n Default server side timeout for all service clients.\n \n \n \n \n Maximum Retry Policy back-off\n \n \n \n \n Maximum allowed timeout for any request.\n \n \n \n \n Constants for HTTP headers.\n \n \n \n \n Specifies the value to use for UserAgent header.\n \n \n \n \n Specifies the value to use for UserAgent header.\n \n \n \n \n Master Windows Azure Storage header prefix.\n \n \n \n \n True Header.\n \n \n \n \n False Header.\n \n \n \n \n Header prefix for properties.\n \n \n \n \n Header prefix for metadata.\n \n \n \n \n Header that specifies content length.\n \n \n \n \n Header that specifies content language.\n \n \n \n \n Header that specifies the ETag value for the resource.\n \n \n \n \n Header for data ranges.\n \n \n \n \n Header for range content MD5.\n \n \n \n \n Header for storage version.\n \n \n \n \n Header for copy source.\n \n \n \n \n Header for the If-Match condition.\n \n \n \n \n Header for the If-Modified-Since condition.\n \n \n \n \n Header for the If-None-Match condition.\n \n \n \n \n Header for the If-Unmodified-Since condition.\n \n \n \n \n Header for the If-Sequence-Number-LE condition.\n \n \n \n \n Header for the If-Sequence-Number-LT condition.\n \n \n \n \n Header for the If-Sequence-Number-EQ condition.\n \n \n \n \n Header for the blob type.\n \n \n \n \n Header for snapshots.\n \n \n \n \n Header to delete snapshots.\n \n \n \n \n Header that specifies approximate message count of a queue.\n \n \n \n \n Header that specifies blob caching control.\n \n \n \n \n Response header that specifies the blob content disposition.\n \n \n \n \n Request header that specifies the blob content disposition.\n \n \n \n \n Header that specifies blob content encoding.\n \n \n \n \n Header that specifies blob content language.\n \n \n \n \n Header that specifies blob content MD5.\n \n \n \n \n Header that specifies blob content type.\n \n \n \n \n Header that specifies blob content length.\n \n \n \n \n Header that specifies blob sequence number.\n \n \n \n \n Header that specifies sequence number action.\n \n \n \n \n Header that specifies lease ID.\n \n \n \n \n Header that specifies lease status.\n \n \n \n \n Header that specifies lease status.\n \n \n \n \n Header that specifies page write mode.\n \n \n \n \n Header that specifies the date.\n \n \n \n \n Header indicating the request ID.\n \n \n \n \n Header indicating the client request ID.\n \n \n \n \n Header that specifies public access to blobs.\n \n \n \n \n Format string for specifying ranges.\n \n \n \n \n Current storage version header value.\n Every time this version changes, assembly version needs to be updated as well.\n \n \n \n \n Specifies the page blob type.\n \n \n \n \n Specifies the block blob type.\n \n \n \n \n Specifies only snapshots are to be included.\n \n \n \n \n Specifies snapshots are to be included.\n \n \n \n \n Header that specifies the pop receipt for a message.\n \n \n \n \n Header that specifies the next visible time for a message.\n \n \n \n \n Header that specifies whether to peek-only.\n \n \n \n \n Header that specifies whether data in the container may be accessed publicly and what level of access is to be allowed.\n \n \n \n \n Header that specifies the lease action to perform.\n \n \n \n \n Header that specifies the proposed lease ID for a leasing operation.\n \n \n \n \n Header that specifies the duration of a lease.\n \n \n \n \n Header that specifies the break period of a lease.\n \n \n \n \n Header that specifies the remaining lease time.\n \n \n \n \n Header that specifies the key name for explicit keys.\n \n \n \n \n Header that specifies the copy ID.\n \n \n \n \n Header that specifies the copy last modified time.\n \n \n \n \n Header that specifies the copy status.\n \n \n \n \n Header that specifies the copy progress.\n \n \n \n \n Header that specifies a copy error message.\n \n \n \n \n Header that specifies the copy action.\n \n \n \n \n The value of the copy action header that signifies an abort operation.\n \n \n \n \n Header that specifies the Accept type for the response payload.\n \n \n \n \n Header that specifies the Content type for the request payload.\n \n \n \n \n Specifies the value to use for UserAgent header.\n \n \n \n \n Specifies the comment to use for UserAgent header.\n \n \n \n \n Constants for query strings.\n \n \n \n \n Query component for snapshot time.\n \n \n \n \n Query component for the signed SAS start time.\n \n \n \n \n Query component for the signed SAS expiry time.\n \n \n \n \n Query component for the signed SAS resource.\n \n \n \n \n Query component for the SAS table name.\n \n \n \n \n Query component for the signed SAS permissions.\n \n \n \n \n Query component for the SAS start partition key.\n \n \n \n \n Query component for the SAS start row key.\n \n \n \n \n Query component for the SAS end partition key.\n \n \n \n \n Query component for the SAS end row key.\n \n \n \n \n Query component for the signed SAS identifier.\n \n \n \n \n Query component for the signing SAS key.\n \n \n \n \n Query component for the signed SAS version.\n \n \n \n \n Query component for SAS signature.\n \n \n \n \n Query component for SAS cache control.\n \n \n \n \n Query component for SAS content type.\n \n \n \n \n Query component for SAS content encoding.\n \n \n \n \n Query component for SAS content language.\n \n \n \n \n Query component for SAS content disposition.\n \n \n \n \n Query component for message time-to-live.\n \n \n \n \n Query component for message visibility timeout.\n \n \n \n \n Query component for the number of messages.\n \n \n \n \n Query component for message pop receipt.\n \n \n \n \n Query component for resource type.\n \n \n \n \n Query component for the operation (component) to access.\n \n \n \n \n Query component for the copy ID.\n \n \n \n \n Constants for Result Continuations\n \n \n \n \n Top Element for Continuation Tokens\n \n \n \n \n XML element for the next marker.\n \n \n \n \n XML element for the next partition key.\n \n \n \n \n XML element for the next row key.\n \n \n \n \n XML element for the next table name.\n \n \n \n \n XML element for the target location.\n \n \n \n \n XML element for the token version.\n \n \n \n \n Stores the current token version value.\n \n \n \n \n XML element for the token type.\n \n \n \n \n Specifies the blob continuation token type.\n \n \n \n \n Specifies the queue continuation token type.\n \n \n \n \n Specifies the table continuation token type.\n \n \n \n \n HTTP methods that are supported by CORS.\n \n \n \n \n Represents no HTTP method in a CORS rule.\n \n \n \n \n Represents the GET HTTP method in a CORS rule.\n \n \n \n \n Represents the HEAD HTTP method in a CORS rule.\n \n \n \n \n Represents the POST HTTP method in a CORS rule.\n \n \n \n \n Represents the PUT HTTP method in a CORS rule.\n \n \n \n \n Represents the DELETE HTTP method in a CORS rule.\n \n \n \n \n Represents the TRACE HTTP method in a CORS rule.\n \n \n \n \n Represents the OPTIONS HTTP method in a CORS rule.\n \n \n \n \n Represents the CONNECT HTTP method in a CORS rule.\n \n \n \n \n Represents the MERGE HTTP method in a CORS rule.\n \n \n \n \n Class representing the service properties pertaining to CORS.\n \n \n \n \n Constructs a CORS Properties object.\n \n \n \n \n Gets or sets CORS rules. The order of the list corresponds to precedence of rules. \n \n A collection containing CORS rules, limited to 5.\n \n \n \n Class representing the service properties pertaining to CORS.\n \n \n \n \n Gets or sets domain names allowed via CORS.\n \n A collection of strings containing the allowed domain names, limited to 64.\n \n \n \n Gets or sets response headers that should be exposed to client via CORS.\n \n A collection of strings containing exposed headers, limited to 64 defined headers and two prefixed headers.\n \n \n \n Gets or sets headers allowed to be part of the CORS request.\n \n A collection of strings containing allowed headers, limited to 64 defined headers and two prefixed headers.\n \n \n \n Gets or sets the HTTP methods permitted to execute for this origin.\n \n The allowed HTTP methods.\n \n \n \n Gets or sets the length of time in seconds that a preflight response should be cached by browser.\n \n The maximum number of seconds to cache the response.\n \n \n \n Class representing the geo-replication stats.\n \n \n \n \n The name of the status XML element.\n \n \n \n \n The name of the last sync time XML element.\n \n \n \n \n Initializes a new instance of the GeoReplicationStats class.\n \n \n \n \n Gets a from a string.\n \n The geo-replication status string.\n A enumeration.\n The string contains an unrecognized value.\n \n \n \n Constructs a GeoReplicationStats object from an XML element.\n \n The XML element.\n A GeoReplicationStats object containing the properties in the element.\n \n \n \n Gets or sets the status of geo-replication.\n \n The status of geo-replication.\n \n \n \n Gets or sets the last synchronization time.\n \n The last synchronization time.\n All primary writes preceding this value are guaranteed to be available for read operations. Primary writes following this point in time may or may not be available for reads.\n \n \n \n Enumeration representing the state of geo-replication in a service.\n \n \n \n \n Status of geo-replication is unavailable.\n \n \n \n \n Geo-replication is live.\n \n \n \n \n Data is being bootstrapped from primary to secondary.\n \n \n \n \n Enumeration representing the state of logging in a service.\n \n \n \n \n Logging is disabled.\n \n \n \n \n Log read operations.\n \n \n \n \n Log write operations.\n \n \n \n \n Log delete operations.\n \n \n \n \n Log all operations.\n \n \n \n \n Class representing the service properties pertaining to logging.\n \n \n \n \n Gets or sets the version of the analytics service.\n \n A string identifying the version of the service.\n \n \n \n Gets or sets the state of logging.\n \n A combination of flags describing the operations that are logged.\n \n \n \n Gets or sets the logging retention policy.\n \n The number of days to retain the logs.\n \n \n \n Enumeration representing the state of metrics collection in a service.\n \n \n \n \n Metrics collection is disabled.\n \n \n \n \n Service-level metrics collection is enabled.\n \n \n \n \n Service-level and API metrics collection are enabled.\n \n \n \n \n Class representing the service properties pertaining to metrics.\n \n \n \n \n Gets or sets the version of the analytics service.\n \n A string identifying the version of the service.\n \n \n \n Gets or sets the state of metrics collection.\n \n A value indicating which metrics to collect, if any.\n \n \n \n Gets or sets the logging retention policy.\n \n The number of days to retain the logs.\n \n \n \n Writes a collection of shared access policies to the specified stream in XML format.\n \n A collection of shared access policies.\n An output stream.\n A delegate that writes a policy to an XML writer.\n The type of policy to write.\n \n \n \n Gets the request id.\n \n The response from server.\n The request ID.\n \n \n \n Reads a collection of shared access policies from the specified object.\n \n A collection of shared access policies to be filled.\n A policy response object for reading the stream.\n The type of policy to read.\n \n \n \n Parses the metadata.\n \n The reader.\n A of metadata.\n \n Precondition: reader at <Metadata>\n Postcondition: reader after </Metadata> (<Metadata/> consumed)\n \n \n \n \n Class representing a set of properties pertaining to a cloud storage service.\n \n \n \n \n The name of the root XML element.\n \n \n \n \n The name of the logging XML element.\n \n \n \n \n The name of the metrics XML element.\n \n \n \n \n The name of the CORS XML element.\n \n \n \n \n The name of the minute metrics XML element.\n \n \n \n \n The name of the version XML element.\n \n \n \n \n The name of the delete operation XML element.\n \n \n \n \n The name of the read operation XML element.\n \n \n \n \n The name of the write operation XML element.\n \n \n \n \n The name of the retention policy XML element.\n \n \n \n \n The name of the enabled XML element.\n \n \n \n \n The name of the days XML element.\n \n \n \n \n The name of the include APIs XML element.\n \n \n \n \n The name of the default service version XML element.\n \n \n \n \n The name of the CORS Rule XML element.\n \n \n \n \n The name of the Allowed Origin XML element.\n \n \n \n \n The name of the Allowed Method XML element.\n \n \n \n \n The name of the Maximum Age XML element.\n \n \n \n \n The name of the Exposed Headers XML element.\n \n \n \n \n The name of the Allowed Headers XML element.\n \n \n \n \n Initializes a new instance of the ServiceProperties class.\n \n \n \n \n Constructs a ServiceProperties object from an XML document received from the service.\n \n The XML document.\n A ServiceProperties object containing the properties in the XML document.\n \n \n \n Converts these properties into XML for communicating with the service.\n \n An XML document containing the service properties.\n \n \n \n Generates XML representing the given retention policy.\n \n The number of days to retain, or null if the policy is disabled.\n An XML retention policy element.\n \n \n \n Generates XML representing the given metrics properties.\n \n The metrics properties.\n The XML name for these metrics.\n An XML metrics element.\n \n \n \n Generates XML representing the given logging properties.\n \n The logging properties.\n An XML logging element.\n \n \n \n Generates XML representing the given CORS properties.\n \n The CORS properties.\n An XML logging element.\n \n \n \n Constructs a LoggingProperties object from an XML element.\n \n The XML element.\n A LoggingProperties object containing the properties in the element.\n \n \n \n Constructs a MetricsProperties object from an XML element.\n \n The XML element.\n A MetricsProperties object containing the properties in the element.\n \n \n \n Constructs a CorsProperties object from an XML element.\n \n The XML element.\n A CorsProperties object containing the properties in the element.\n \n \n \n Constructs a retention policy (number of days) from an XML element.\n \n The XML element.\n The number of days to retain, or null if retention is disabled.\n \n \n \n Writes service properties to a stream, formatted in XML.\n \n The stream to which the formatted properties are to be written.\n \n \n \n Gets or sets the logging properties.\n \n The logging properties.\n \n \n \n Gets or sets the hour metrics properties.\n \n The metrics properties.\n \n \n \n Gets or sets the hour metrics properties.\n \n The metrics properties.\n \n \n \n Gets or sets the Cross Origin Resource Sharing (CORS) properties.\n \n The CORS properties.\n \n \n \n Gets or sets the minute metrics properties.\n \n The minute metrics properties.\n \n \n \n Gets or sets the default service version.\n \n The default service version identifier.\n \n \n \n Class representing a set of stats pertaining to a cloud storage service.\n \n \n \n \n The name of the root XML element.\n \n \n \n \n The name of the geo-replication XML element.\n \n \n \n \n Initializes a new instance of the ServiceStats class.\n \n \n \n \n Constructs a ServiceStats object from an XML document received from the service.\n \n The XML document.\n A ServiceStats object containing the properties in the XML document.\n \n \n \n Gets or sets the geo-replication stats.\n \n The geo-replication stats.\n \n \n \n Provides error code strings that are common to all storage services.\n \n \n \n \n The specified HTTP verb is not supported.\n \n \n \n \n The Content-Length header is required for this request.\n \n \n \n \n A required header was missing.\n \n \n \n \n A required XML node was missing.\n \n \n \n \n One or more header values are not supported.\n \n \n \n \n One or more XML nodes are not supported.\n \n \n \n \n One or more header values are invalid.\n \n \n \n \n One or more XML node values are invalid.\n \n \n \n \n A required query parameter is missing.\n \n \n \n \n One or more query parameters is not supported.\n \n \n \n \n One or more query parameters are invalid.\n \n \n \n \n One or more query parameters are out of range.\n \n \n \n \n The URI is invalid.\n \n \n \n \n The HTTP verb is invalid.\n \n \n \n \n The metadata key is empty.\n \n \n \n \n The request body is too large.\n \n \n \n \n The specified XML document is invalid.\n \n \n \n \n An internal error occurred.\n \n \n \n \n Authentication failed.\n \n \n \n \n The specified MD5 hash does not match the server value.\n \n \n \n \n The specified MD5 hash is invalid.\n \n \n \n \n The input is out of range.\n \n \n \n \n The input is invalid.\n \n \n \n \n The operation timed out.\n \n \n \n \n The specified resource was not found.\n \n \n \n \n The specified metadata is invalid.\n \n \n \n \n The specified metadata is too large.\n \n \n \n \n The specified condition was not met.\n \n \n \n \n The specified range is invalid.\n \n \n \n \n The specified container was not found.\n \n \n \n \n The specified container already exists.\n \n \n \n \n The specified container is disabled.\n \n \n \n \n The specified container is being deleted.\n \n \n \n \n The server is busy.\n \n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild2/Settings.StyleCop", "content": "\n \n \n .\n \n \n\n" }, { "path": "ironclad-apps/tools/NuBuild2/makefile", "content": "\r\nMSBUILD=C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\r\n#MSBUILD=C:/Windows/Microsoft.NET/Framework/v4.0.30319/MSBuild.exe\r\n\r\n#BIN = ../../bin_tools/NuBuild\r\n#\t\r\n#NUBUILD_SOURCES = $(wildcard NuBuild/*.cs) NuBuild/NuBuild.csproj\r\n#\r\n#all: $(BIN)/NuBuild.exe\r\n#\r\n#$(BIN)/NuBuild.exe: $(NUBUILD_SOURCES) NuBuild.sln\r\n#\t$(MSBUILD) NuBuild.sln\r\n\r\nall: me\r\n\r\nme: \r\n\techo hi\r\n\t$(MSBUILD) NuBuild.sln\r\n\r\n" }, { "path": "ironclad-apps/tools/NuBuild2/modules.log", "content": "beat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl.tmp -in Partition_i.beat \nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition.bpl.tmp -in Partition.beat -i Partition_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core_i.bpl.tmp -in Core_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i Partition_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core.bpl.tmp -in Core.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i Partition_i.beat -i core_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\LogicalAddressing_i.bpl.tmp -in LogicalAddressing_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i Partition_i.beat -i Core_i.beat -i Separation_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\LogicalAddressing.bpl.tmp -in LogicalAddressing.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i Partition_i.beat -i Core_i.beat -i Separation_i.beat -i LogicalAddressing_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Stacks_i.bpl.tmp -in Stacks_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i Separation_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Stacks.bpl.tmp -in Stacks.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i Separation_i.beat -i Stacks_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Separation_i.bpl.tmp -in Separation_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i Partition_i.beat -i Core_i.beat -i LogicalAddressing_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Separation.bpl.tmp -in Separation.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i Partition_i.beat -i Core_i.beat -i Separation_i.beat -i Util_i.beat -i LogicalAddressing_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Overflow.bpl.tmp -in Overflow.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i Util_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Overflow_i.bpl -i Separation_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\BitVectorLemmasBase_i.bpl.tmp -in BitVectorLemmasBase_i.beat \nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\BitVectorLemmasBase.bpl.tmp -in BitVectorLemmasBase.beat -i BitVectorLemmasBase_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\IntLemmasBase_i.bpl.tmp -in IntLemmasBase_i.beat \nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\IntLemmasBase.bpl.tmp -in IntLemmasBase.beat -i BitVectorLemmasBase_i.beat -i IntLemmasBase_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Util_i.bpl.tmp -in Util_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i Separation_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Util.bpl.tmp -in Util.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i Separation_i.beat -i Util_i.beat -i IntLemmasBase_i.beat\nboogie /proverOpt:OPTIMIZE_FOR_BV=true ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\BitVectorSpec_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\BitVectorLemmasBase_i.bpl\nboogie /restartProver /proverOpt:OPTIMIZE_FOR_BV=true ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\BitVectorSpec_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\BitVectorLemmasBase_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\BitVectorLemmasBase.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_axioms.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\BitVectorLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\IntLemmasBase_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_axioms.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\BitVectorLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\IntLemmasBase_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\IntLemmasBase.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\LogicalAddressing_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\LogicalAddressing.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Util_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Util.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Stacks_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Stacks_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Stacks.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Separation_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Separation_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Separation.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Overflow_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\Base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Overflow_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Base\\Overflow.bpl\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\BitVectorLemmasGc_i.bpl.tmp -in BitVectorLemmasGc_i.beat \nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\BitVectorLemmasGc.bpl.tmp -in BitVectorLemmasGc.beat -i BitVectorLemmasGc_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\IntLemmasGc_i.bpl.tmp -in IntLemmasGc_i.beat \nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\IntLemmasGc.bpl.tmp -in IntLemmasGc.beat -i BitVectorLemmasGc_i.beat -i IntLemmasGc_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleGcMemory_i.bpl.tmp -in SimpleGcMemory_i.beat \nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleGcMemory.bpl.tmp -in SimpleGcMemory.beat -i SimpleGcMemory_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleCommon_i.bpl.tmp -in SimpleCommon_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\Base\\partition_i.beat -i ..\\Base\\core_i.beat -i ..\\Base\\separation_i.beat -i SimpleGcMemory_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleCommon.bpl.tmp -in SimpleCommon.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\Base\\partition_i.beat -i ..\\Base\\core_i.beat -i ..\\Base\\separation_i.beat -i ..\\Base\\LogicalAddressing_i.beat -i SimpleGcMemory_i.beat -i SimpleCommon_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleCollector_i.bpl.tmp -in ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleCollector_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\Base\\partition_i.beat -i ..\\Base\\core_i.beat -i ..\\Base\\LogicalAddressing_i.beat -i ..\\Base\\separation_i.beat -i SimpleGcMemory_i.beat -i SimpleCommon_i.beat -i IntLemmasGc_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleCollector.bpl.tmp -in SimpleCollector.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\Base\\partition_i.beat -i ..\\Base\\core_i.beat -i ..\\Base\\LogicalAddressing_i.beat -i ..\\Base\\separation_i.beat -i ..\\Base\\Util_i.beat -i ..\\Base\\Stacks_i.beat -i SimpleGcMemory_i.beat -i SimpleCommon_i.beat -i ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleCollector_i.beat -i IntLemmasGc_i.beat\nboogie /proverOpt:OPTIMIZE_FOR_BV=true ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\BitVectorSpec_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\BitVectorLemmasGc_i.bpl\nboogie /restartProver /proverOpt:OPTIMIZE_FOR_BV=true ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\BitVectorSpec_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\BitVectorLemmasGc_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\BitVectorLemmasGc.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\IntLemmasGc_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\BitVectorLemmasGc_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\IntLemmasGc.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleGcMemory_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleGcMemory.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleCommon_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleCommon.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleCollector_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\GC\\SimpleCollector.bpl\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\BitVectorLemmasDevices_i.bpl.tmp -in BitVectorLemmasDevices_i.beat \nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\BitVectorLemmasDevices.bpl.tmp -in BitVectorLemmasDevices.beat -i BitVectorLemmasDevices_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IntLemmasDevices_i.bpl.tmp -in IntLemmasDevices_i.beat \nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IntLemmasDevices.bpl.tmp -in IntLemmasDevices.beat -i BitVectorLemmasDevices_i.beat -i IntLemmasDevices_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IoMainCP_i.bpl.tmp -in IoMain_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i ..\\Base\\Partition_i.beat -i ..\\Base\\Core_i.beat -i ..\\Base\\Separation_i.beat -i ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCollector_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\PCICP_i.bpl.tmp -in PCI_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i ..\\Base\\Partition_i.beat -i ..\\Base\\Core_i.beat -i ..\\Base\\Separation_i.beat -i ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCollector_i.beat -i IntLemmasDevices_i.beat -i IoMain_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IntelNICCP_i.bpl.tmp -in IntelNIC_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i ..\\Base\\Partition_i.beat -i ..\\Base\\Core_i.beat -i ..\\Base\\Separation_i.beat -i ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCollector_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IoMainCP.bpl.tmp -in IoMain.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i ..\\Base\\Partition_i.beat -i ..\\Base\\Core_i.beat -i ..\\Base\\Separation_i.beat -i ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCollector_i.beat -i ..\\Base\\LogicalAddressing_i.beat -i ..\\Base\\Util_i.beat -i ..\\GC\\SimpleGcMemory_i.beat -i ..\\GC\\SimpleCommon_i.beat -i ..\\Base\\IntLemmasBase_i.beat -i ..\\GC\\IntLemmasGc_i.beat -i IoMain_i.beat -i PCI_i.beat -i IntLemmasDevices_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\PCICP.bpl.tmp -in PCI.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i ..\\Base\\Partition_i.beat -i ..\\Base\\Core_i.beat -i ..\\Base\\Separation_i.beat -i ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCollector_i.beat -i ..\\Base\\LogicalAddressing_i.beat -i ..\\Base\\Util_i.beat -i ..\\GC\\SimpleGcMemory_i.beat -i ..\\GC\\SimpleCommon_i.beat -i PCI_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IntelNICCP.bpl.tmp -in IntelNIC.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl -i ..\\Base\\Partition_i.beat -i ..\\Base\\Core_i.beat -i ..\\Base\\Separation_i.beat -i ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCollector_i.beat -i ..\\Base\\LogicalAddressing_i.beat -i ..\\Base\\Util_i.beat -i ..\\GC\\SimpleGcMemory_i.beat -i ..\\GC\\SimpleCommon_i.beat -i IntLemmasDevices_i.beat -i PCI_i.beat -i IntelNIC_i.beat\nboogie /proverOpt:OPTIMIZE_FOR_BV=true ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\BitVectorSpec_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\BitVectorLemmasDevices_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\BitVectorLemmasDevices_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IntLemmasDevices_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\BitVectorLemmasDevices_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IntLemmasDevices_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IntLemmasDevices.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\PCICP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\PCICP.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IoMainCP_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IntLemmasDevices_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\PCICP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IoMainCP.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IntLemmasDevices_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\PCICP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IntelNICCP_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IntLemmasDevices_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\PCICP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IntelNICCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Devices\\IntelNICCP.bpl\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_assembly_i_tmp.bpl.tmp -in dafny_assembly_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\Base\\partition_i.beat -i ..\\Base\\core_i.beat -i ..\\Base\\LogicalAddressing_i.beat -i ..\\Base\\separation_i.beat -i ..\\Base\\Util_i.beat -i ..\\GC\\SimpleGcMemory_i.beat -i ..\\GC\\SimpleCommon_i.beat -i ..\\GC\\SimpleCollector_i.beat -i ..\\Devices\\IoMain_i.beat -i DafnyAssembly_i.beat -i ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_assembly_i_i.bpl\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_bit_vector_lemmas_i_tmp.bpl.tmp -in dafny_bit_vector_lemmas_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\Base\\partition_i.beat -i ..\\Base\\core_i.beat -i ..\\Base\\LogicalAddressing_i.beat -i ..\\Base\\separation_i.beat -i ..\\Base\\Util_i.beat -i ..\\GC\\SimpleGcMemory_i.beat -i ..\\GC\\SimpleCommon_i.beat -i ..\\GC\\SimpleCollector_i.beat -i ..\\Devices\\IoMain_i.beat -i ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_bit_vector_lemmas_i_i.bpl\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\BitVectorLemmasMain_i.bpl.tmp -in BitVectorLemmasMain_i.beat \nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\BitVectorLemmasMain.bpl.tmp -in BitVectorLemmasMain.beat -i BitVectorLemmasMain_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl.tmp -in IntLemmasMain_i.beat \nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain.bpl.tmp -in IntLemmasMain.beat -i BitVectorLemmasMain_i.beat -i IntLemmasMain_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl.tmp -in DafnyAssembly_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\Base\\partition_i.beat -i ..\\Base\\core_i.beat -i ..\\Base\\LogicalAddressing_i.beat -i ..\\Base\\separation_i.beat -i ..\\Base\\Util_i.beat -i ..\\GC\\SimpleGcMemory_i.beat -i ..\\GC\\SimpleCommon_i.beat -i ..\\GC\\SimpleCollector_i.beat -i ..\\Devices\\IoMain_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly.bpl.tmp -in DafnyAssembly.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\Base\\partition_i.beat -i ..\\Base\\core_i.beat -i ..\\Base\\LogicalAddressing_i.beat -i ..\\Base\\separation_i.beat -i ..\\Base\\Util_i.beat -i ..\\GC\\SimpleGcMemory_i.beat -i ..\\GC\\SimpleCommon_i.beat -i ..\\GC\\SimpleCollector_i.beat -i ..\\Devices\\IoMain_i.beat -i DafnyAssembly_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\MainCP_i.bpl.tmp -in Main_i.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\Base\\partition_i.beat -i ..\\Base\\core_i.beat -i ..\\Base\\LogicalAddressing_i.beat -i ..\\Base\\separation_i.beat -i ..\\Base\\Util_i.beat -i ..\\GC\\SimpleGcMemory_i.beat -i ..\\GC\\SimpleCommon_i.beat -i ..\\GC\\SimpleCollector_i.beat -i ..\\Devices\\IoMain_i.beat\nbeat -out ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\EntryCP_tmp.bpl.tmp -in Entry.beat -i ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl -i ..\\Base\\partition_i.beat -i ..\\Base\\core_i.beat -i ..\\Base\\LogicalAddressing_i.beat -i ..\\Base\\separation_i.beat -i ..\\Base\\Util_i.beat -i ..\\GC\\SimpleGcMemory_i.beat -i ..\\GC\\SimpleCommon_i.beat -i ..\\GC\\SimpleCollector_i.beat -i ..\\Devices\\IoMain_i.beat -i Main_i.beat -i ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\EntryImport.beat -i ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\EntryCP_i.bpl -i ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl -i ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_Cube_i.bpl\nboogie /proverOpt:OPTIMIZE_FOR_BV=true ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\BitVectorSpec_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\BitVectorLemmasMain_i.bpl\nboogie /restartProver /proverOpt:OPTIMIZE_FOR_BV=true ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\BitVectorSpec_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\BitVectorLemmasMain_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\BitVectorLemmasMain.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\BitVectorLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\BitVectorLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\IntSpec_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain.bpl\nboogie /timeLimit:30 ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_base_s_i.bpl\nboogie /timeLimit:30 ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_base_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_Base_i.bpl\nboogie /timeLimit:300 /trace /z3opt:NL_ARITH=false ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_base_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_Base_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_Base.bpl\nboogie /timeLimit:30 ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_relational_s_i.bpl\nboogie /timeLimit:30 ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_base_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_power2_s_i.bpl\nboogie /timeLimit:30 ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_mul_nonlinear_i_i.bpl\nboogie /timeLimit:300 /trace /z3opt:NL_ARITH=false /z3opt:NL_ARITH=true ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_mul_nonlinear_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_mul_nonlinear_i.bpl\nboogie /timeLimit:30 ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_mul_nonlinear_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_mul_i_i.bpl\nboogie /timeLimit:300 /trace /z3opt:NL_ARITH=false ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_mul_nonlinear_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_mul_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_mul_i.bpl\nboogie /timeLimit:30 ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_base_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_relational_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_assembly_i_i.bpl\nboogie /timeLimit:300 /trace /z3opt:NL_ARITH=false ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_base_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_relational_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_assembly_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_assembly_i.bpl\nboogie /timeLimit:30 ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_base_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_relational_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_assembly_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_bit_vector_lemmas_i_i.bpl\nboogie /timeLimit:300 /trace /z3opt:NL_ARITH=false ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_base_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_relational_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_assembly_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_bit_vector_lemmas_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_bit_vector_lemmas_i.bpl\nboogie /timeLimit:30 ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_relational_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_base_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_power2_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_mul_nonlinear_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_mul_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_assembly_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_bit_vector_lemmas_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_Cube_i.bpl\nboogie /timeLimit:300 /trace /z3opt:NL_ARITH=false ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_relational_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_base_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_power2_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_mul_nonlinear_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_mul_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_assembly_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_bit_vector_lemmas_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_Cube_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_Cube.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_relational_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_base_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_power2_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_mul_nonlinear_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_mul_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_assembly_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_bit_vector_lemmas_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_Cube_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\EntryCP_i.bpl\nboogie ..\\..\\..\\..\\src\\Trusted\\Spec\\base_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\memory_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_types_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\MachineState_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Assembly_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Interrupts_i.bpl ..\\..\\..\\..\\src\\Trusted\\Spec\\Io_i.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\base_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\word_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\memory_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\assembly_axioms.bpl /trustedBoogie:..\\..\\..\\..\\src\\Trusted\\Spec\\Io_axioms.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\core_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\LogicalAddressing_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\overflow_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\util_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\stacks_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\partition_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\separation_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Base\\IntLemmasBase_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\IntLemmasGc_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleGcMemory_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCommon_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\GC\\SimpleCollector_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\..\\Devices\\IoMainCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\IntLemmasMain_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Trusted_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Checked_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\HeapCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\Seq_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\dafny_DafnyPrelude_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\DafnyAssembly_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_relational_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_base_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_power2_s_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_mul_nonlinear_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_mul_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_assembly_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_bit_vector_lemmas_i_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\\\dafny_Cube_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\EntryCP_i.bpl ..\\..\\..\\..\\obj\\Checked\\Nucleus\\Main\\EntryCP.bpl\n" }, { "path": "ironclad-apps/tools/NuBuild2/modules.result", "content": "Can't resolve target Separation.ifc. Loop?\nCan't resolve target LogicalAddressing.ifc. Loop?\n\nIo_types.ifc imports \nInterrupts.ifc imports \n\nPCICP.ifc imports \nbase.ifc imports \nAssembly.ifc imports \nIo.ifc imports \nIntSpec.ifc imports \nMachineState.ifc imports \nmemory.ifc imports \n# EntryImport.imp imports \n* Partition.ifc imports Io.ifc,Io_types.ifc,MachineState.ifc,Memory.ifc,Assembly.ifc,Interrupts.ifc,Base.ifc\n* IntLemmasGc.ifc imports base.ifc,memory.ifc,IntSpec.ifc\n* BitVectorLemmasGc.ifc imports base.ifc,memory.ifc\n* BitVectorLemmasBase.ifc imports base.ifc,memory.ifc\n* BitVectorLemmasMain.ifc imports base.ifc,memory.ifc\n* BitVectorLemmasDevices.ifc imports base.ifc,memory.ifc\n* Partition.imp imports Partition.ifc\n* Core.ifc imports Partition.ifc\n# BitVectorLemmasBase.imp imports BitVectorLemmasBase.ifc\n* IntLemmasBase.ifc imports Io_types.ifc,BitVectorLemmasBase.ifc,Assembly.ifc,MachineState.ifc,IntSpec.ifc\n# BitVectorLemmasMain.imp imports BitVectorLemmasMain.ifc\n# BitVectorLemmasGc.imp imports BitVectorLemmasGc.ifc\n# IntLemmasGc.imp imports BitVectorLemmasGc.ifc,IntLemmasGc.ifc\n# BitVectorLemmasDevices.imp imports BitVectorLemmasDevices.ifc\nIntLemmasDevices.ifc imports Io_types.ifc,BitVectorLemmasDevices.ifc,Assembly.ifc,MachineState.ifc,IntSpec.ifc\n* IntLemmasMain.ifc imports BitVectorLemmasMain.ifc,IntSpec.ifc\n# IntLemmasDevices.imp imports IntLemmasDevices.ifc\n# Core.imp imports core.ifc\n* LogicalAddressing.ifc imports IntLemmasBase.ifc,Core.ifc\n* Separation.ifc imports Core.ifc\n# IntLemmasBase.imp imports IntLemmasBase.ifc\n# IntLemmasMain.imp imports IntLemmasMain.ifc\n* Util.ifc imports LogicalAddressing.ifc\n# LogicalAddressing.imp imports LogicalAddressing.ifc\n* Stacks.ifc imports Util.ifc\n# Util.imp imports LogicalAddressing.ifc,Util.ifc\n# Separation.imp imports Stacks.ifc\nOverflow.ifc imports Stacks.ifc\n# Stacks.imp imports Stacks.ifc\n# SimpleGcMemory.ifc imports overflow.ifc\n# Overflow.imp imports Overflow.ifc\n# SimpleGcMemory.imp imports SimpleGcMemory.ifc\n* SimpleCommon.ifc imports SimpleGcMemory.ifc,IntLemmasGc.ifc\n* SimpleCollector.ifc imports SimpleCommon.ifc\n# SimpleCommon.imp imports SimpleCommon.ifc\n* IntelNICCP.ifc imports PCICP.ifc,SimpleCollector.ifc,IntLemmasDevices.ifc,LogicalAddressing.ifc\n# PCICP.imp imports SimpleCollector.ifc,PCICP.ifc,LogicalAddressing.ifc\n# SimpleCollector.imp imports SimpleCollector.ifc\n* IoMainCP.ifc imports SimpleCollector.ifc,LogicalAddressing.ifc\nIntelNIC.ifc imports SimpleCollector.ifc\n* IoMain.ifc imports SimpleCollector.ifc\nTrusted.ifc imports IoMainCP.ifc\n* Main.ifc imports SimpleCollector.ifc,IoMain.ifc\n# IoMainCP.imp imports PCICP.ifc,IntLemmasDevices.ifc,IoMainCP.ifc\n* PCI.ifc imports IoMain.ifc,IntLemmasDevices.ifc\n# IntelNICCP.imp imports IntelNICCP.ifc\n# IoMain.imp imports PCI.ifc,SimpleCollector.ifc,LogicalAddressing.ifc\n# PCI.imp imports PCI.ifc,SimpleCollector.ifc\nChecked.ifc imports Trusted.ifc,IntLemmasMain.ifc\ndafny_DafnyPrelude.ifc imports Trusted.ifc\n# IntelNIC.imp imports IntelNIC.ifc,PCI.ifc,SimpleCollector.ifc\ndafny_base_s.ifc imports dafny_DafnyPrelude.ifc\n# Checked.imp imports Checked.ifc\n* HeapCP.ifc imports Checked.ifc\ndafny_relational_s.ifc imports dafny_DafnyPrelude.ifc\n# HeapCP.imp imports HeapCP.ifc\nSeq.ifc imports HeapCP.ifc\ndafny_power2_s.ifc imports dafny_base_s.ifc\n* DafnyAssembly.ifc imports dafny_DafnyPrelude.ifc,IoMain.ifc,Seq.ifc\n# Seq.imp imports Seq.ifc\ndafny_Base.ifc imports DafnyAssembly.ifc,dafny_base_s.ifc\ndafny_assembly_i.ifc imports DafnyAssembly.ifc,dafny_relational_s.ifc,dafny_base_s.ifc\ndafny_mul_nonlinear_i.ifc imports DafnyAssembly.ifc\n# DafnyAssembly.imp imports DafnyAssembly.ifc\n# dafny_Base.imp imports dafny_Base.ifc\ndafny_assembly.ifc imports dafny_assembly_i.ifc,IoMain.ifc\ndafny_mul_nonlinear.ifc imports dafny_mul_nonlinear_i.ifc\n* dafny_bit_vector_lemmas_i.ifc imports dafny_assembly_i.ifc\ndafny_mul_i.ifc imports dafny_mul_nonlinear_i.ifc\ndafny_mul.ifc imports dafny_mul_i.ifc\ndafny_bit_vector_lemmas.ifc imports IoMain.ifc,dafny_bit_vector_lemmas_i.ifc\ndafny_Cube.ifc imports dafny_mul_i.ifc,dafny_power2_s.ifc,dafny_bit_vector_lemmas_i.ifc\nEntryCP.ifc imports dafny_Cube.ifc\n# dafny_Cube.imp imports dafny_Cube.ifc\n# EntryCP.imp imports EntryCP.ifc\n# Entry.imp imports EntryCP.ifc,Main.ifc,EntryImport.imp\n" }, { "path": "ironclad-apps/tools/SymDiff/SymDiff.exe.config", "content": "\r\n\r\n\r\n" }, { "path": "ironclad-apps/tools/SymDiff/SymDiff.vshost.exe.config", "content": "\r\n\r\n\r\n" }, { "path": "ironclad-apps/tools/SymDiff/SymDiff.vshost.exe.manifest", "content": "\r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n" }, { "path": "ironclad-apps/tools/SymDiff/TypedUnivBackPred2.sx", "content": "; -------------------------------------------------------------------------\r\n; Boogie 2 universal background predicate for Z3 (Simplify notation with types)\r\n; Copyright (c) 2004-2009, Microsoft Corp.\r\n\r\n(DEFTYPE $int :BUILTIN Int)\r\n(DEFTYPE $bool :BUILTIN bool)\r\n(DEFTYPE U)\r\n(DEFTYPE T)\r\n\r\n(DEFOP <: U U $bool) ; used for translation with type premisses\r\n(DEFOP <:: T U U $bool) ; used for translation with type arguments\r\n\r\n(BG_PUSH (AND\r\n\r\n ; false is not true\r\n\r\n (DISTINCT |@false| |@true|)\r\n\r\n ; we assume type correctness of the operations here\r\n ; a-l>=0 ==> (v ++ w:l)[a:b] = v[a-l:b-l]\r\n (FORALL (v lv w lw lvw a b)\r\n (QID bv:e:c1)\r\n (PATS ($bv_extract ($bv_concat v lv w lw) lvw a b))\r\n (IMPLIES\r\n (>= (- a lw) 0)\r\n (EQ ($bv_extract ($bv_concat v lv w lw) lvw a b) ($bv_extract v lv (- a lw) (- b lw)))))\r\n\r\n ; b<=l ==> (v ++ w:l)[a:b] = w[a:b]\r\n (FORALL (v lv w lw lvw a b)\r\n (QID bv:e:c2)\r\n (PATS ($bv_extract ($bv_concat v lv w lw) lvw a b))\r\n (IMPLIES\r\n (<= b lw)\r\n (EQ ($bv_extract ($bv_concat v lv w lw) lvw a b) ($bv_extract w lw a b))))\r\n\r\n ; v:l\r\n ; a>=x || b<=y ==> (v[x:l] ++ w ++ v[0:y])[a:b] = v[a:b]\r\n (FORALL (v lv x lxv w lw lwy y a b)\r\n (QID bv:e:c3)\r\n (PATS \r\n ($bv_extract \r\n ($bv_concat \r\n ($bv_extract v lv x lv) lxv\r\n\t ($bv_concat \r\n\t w lw\r\n ($bv_extract v lv 0 y) y) lwy) lv a b))\r\n (IMPLIES\r\n (AND\r\n (EQ lw (- x y))\r\n (EQ lxv (- lv x))\r\n (EQ lwy (+ w y))\r\n (OR (>= a x) (<= b y)))\r\n (EQ\r\n ($bv_extract \r\n ($bv_concat \r\n ($bv_extract v lv x lv) lxv\r\n\t ($bv_concat \r\n\t w lw\r\n ($bv_extract v lv 0 y) y) lwy) lv a b)\r\n\t($bv_extract v lv a b))))\r\n\r\n ; a>=x ==> (v[x:l] ++ w)[a:b] = v[a:b]\r\n (FORALL (v lv x lxv w a b)\r\n (QID bv:e:c4)\r\n (PATS \r\n ($bv_extract \r\n ($bv_concat \r\n ($bv_extract v lv x lv) lxv \r\n\t w x) \r\n\tlv a b))\r\n (IMPLIES\r\n (AND\r\n (EQ lxv (- lv x))\r\n (>= a x))\r\n (EQ\r\n ($bv_extract \r\n ($bv_concat \r\n ($bv_extract v lv x lv) lxv \r\n\t w x) \r\n\t lv a b)\r\n\t($bv_extract v lv a b))))\r\n\r\n (FORALL (v l)\r\n (QID bv:e:0)\r\n (PATS ($bv_extract v l 0 l))\r\n (EQ ($bv_extract v l 0 l) v))\r\n\r\n (FORALL (n)\r\n (QID bv:pow)\r\n (PATS ($pow2 n))\r\n (IMPLIES (> n 0) (EQ ($pow2 n) (* 2 ($pow2 (- n 1))))))\r\n\r\n (EQ ($pow2 0) 1)\r\n\r\n ; 0 <= v < 2^Y ==> 0bvX ++ v[0:Y] == v\r\n (FORALL (v l a b)\r\n (QID bv:e:pow)\r\n (PATS ($bv_concat 0 b ($bv_extract v l 0 a) a))\r\n (IMPLIES\r\n (AND\r\n (<= 0 v)\r\n (< v ($pow2 a))\r\n (EQ l (+ a b)))\r\n (EQ ($bv_concat 0 b ($bv_extract v l 0 a) a) v)))\r\n \r\n ; X > 0 ==> 0bvX ++ v >= 0\r\n (FORALL (v a b)\r\n (QID bv:e:pos)\r\n (PATS ($bv_concat 0 b v a))\r\n (IMPLIES\r\n (> b 0)\r\n (>= ($bv_concat 0 b v a) 0)))\r\n\r\n ;; unsound?\r\n; (FORALL (lv w lw)\r\n; (QID bv:c:0)\r\n; (PATS ($bv_concat 0 lv w lw))\r\n; (EQ ($bv_concat 0 lv w lw) w))\r\n ;; matching loop\r\n; (FORALL (v l1 a b l2 c d)\r\n; (QID bv:e:e)\r\n; (PATS ($bv_extract ($bv_extract v l1 a b) l2 c d))\r\n; (EQ ($bv_extract ($bv_extract v l1 a b) l2 c d) ($bv_extract v l1 (+ c a) (+ d a))))\r\n \r\n\r\n ; Reflect plus\r\n (FORALL (a b) (PATS (Reflect$Add a b)) (EQ (Reflect$Add a b) (+ a b)))\r\n\r\n)) ;; AND, BG_PUSH\r\n; End Boogie universal background predicate\r\n; -------------------------------------------------------------------------\r\n" }, { "path": "ironclad-apps/tools/SymDiff/UnivBackPred2.smt", "content": "; -------------------------------------------------------------------------\r\n; Boogie universal background predicate\r\n; Copyright (c) 2004-2006, Microsoft Corp.\r\n :logic AUFLIA\r\n :category { industrial }\r\n\r\n:extrasorts ( boogieU )\r\n:extrasorts ( boogieT )\r\n:extrasorts ( TermBool )\r\n\r\n:extrafuns (( boolTrue TermBool ))\r\n:extrafuns (( boolFalse TermBool ))\r\n:extrafuns (( boolIff TermBool TermBool TermBool ))\r\n:extrafuns (( boolImplies TermBool TermBool TermBool ))\r\n:extrafuns (( boolAnd TermBool TermBool TermBool ))\r\n:extrafuns (( boolOr TermBool TermBool TermBool ))\r\n:extrafuns (( boolNot TermBool TermBool ))\r\n:extrafuns (( UEqual boogieU boogieU TermBool ))\r\n:extrafuns (( TEqual boogieT boogieT TermBool ))\r\n:extrafuns (( IntEqual Int Int TermBool ))\r\n:extrafuns (( intLess Int Int TermBool ))\r\n:extrafuns (( intAtMost Int Int TermBool ))\r\n:extrafuns (( intGreater Int Int TermBool ))\r\n:extrafuns (( intAtLeast Int Int TermBool ))\r\n:extrafuns (( boogieIntMod Int Int Int ))\r\n:extrafuns (( boogieIntDiv Int Int Int ))\r\n\r\n; used for translation with type premisses\r\n:extrapreds (( UOrdering2 boogieU boogieU ))\r\n; used for translation with type arguments\r\n:extrapreds (( UOrdering3 boogieT boogieU boogieU ))\r\n\r\n; used for translation with type premisses\r\n:extrafuns (( TermUOrdering2 boogieU boogieU TermBool ))\r\n; used for translation with type arguments\r\n:extrafuns (( TermUOrdering3 boogieT boogieU boogieU TermBool ))\r\n\r\n ; formula/term axioms\r\n :assumption\r\n (forall (?x TermBool) (?y TermBool)\r\n (iff\r\n (= (boolIff ?x ?y) boolTrue)\r\n (iff (= ?x boolTrue) (= ?y boolTrue))))\r\n\r\n :assumption\r\n (forall (?x TermBool) (?y TermBool)\r\n (iff\r\n (= (boolImplies ?x ?y) boolTrue)\r\n (implies (= ?x boolTrue) (= ?y boolTrue))))\r\n\r\n :assumption\r\n (forall (?x TermBool) (?y TermBool)\r\n (iff\r\n (= (boolAnd ?x ?y) boolTrue)\r\n (and (= ?x boolTrue) (= ?y boolTrue))))\r\n\r\n :assumption\r\n (forall (?x TermBool) (?y TermBool)\r\n (iff\r\n (= (boolOr ?x ?y) boolTrue)\r\n (or (= ?x boolTrue) (= ?y boolTrue))))\r\n\r\n :assumption\r\n (forall (?x TermBool)\r\n (iff\r\n (= (boolNot ?x) boolTrue)\r\n (not (= ?x boolTrue)))\r\n :pat { (boolNot ?x) }\r\n )\r\n\r\n :assumption\r\n (forall (?x boogieU) (?y boogieU)\r\n (iff\r\n (= (UEqual ?x ?y) boolTrue)\r\n (= ?x ?y)))\r\n\r\n :assumption\r\n (forall (?x boogieT) (?y boogieT)\r\n (iff\r\n (= (TEqual ?x ?y) boolTrue)\r\n (= ?x ?y)))\r\n\r\n :assumption\r\n (forall (?x Int) (?y Int)\r\n (iff\r\n (= (IntEqual ?x ?y) boolTrue)\r\n (= ?x ?y)))\r\n\r\n :assumption\r\n (forall (?x Int) (?y Int)\r\n (iff\r\n (= (intLess ?x ?y) boolTrue)\r\n (< ?x ?y)))\r\n\r\n :assumption\r\n (forall (?x Int) (?y Int)\r\n (iff\r\n (= (intAtMost ?x ?y) boolTrue)\r\n (<= ?x ?y)))\r\n\r\n :assumption\r\n (forall (?x Int) (?y Int)\r\n (iff\r\n (= (intAtLeast ?x ?y) boolTrue)\r\n (>= ?x ?y)))\r\n\r\n :assumption\r\n (forall (?x Int) (?y Int)\r\n (iff\r\n (= (intGreater ?x ?y) boolTrue)\r\n (> ?x ?y)))\r\n\r\n ; false is not true\r\n :assumption\r\n (distinct boolFalse boolTrue)\r\n\r\n :assumption\r\n (forall (?x boogieU) (?y boogieU)\r\n (iff\r\n (= (TermUOrdering2 ?x ?y) boolTrue)\r\n (UOrdering2 ?x ?y)))\r\n\r\n :assumption\r\n (forall (?x boogieT) (?y boogieU) (?z boogieU)\r\n (iff\r\n (= (TermUOrdering3 ?x ?y ?z) boolTrue)\r\n (UOrdering3 ?x ?y ?z)))\r\n\r\n; End Boogie universal background predicate\r\n; -------------------------------------------------------------------------\r\n\r\n" }, { "path": "ironclad-apps/tools/SymDiff/UnivBackPred2.smt2", "content": "; Boogie universal background predicate\r\n; Copyright (c) 2004-2010, Microsoft Corp.\r\n(set-info :category \"industrial\")\r\n(declare-sort |T@U| 0)\r\n(declare-sort |T@T| 0)\r\n(declare-fun int_div (Int Int) Int)\r\n(declare-fun int_mod (Int Int) Int)\r\n(declare-fun UOrdering2 (|T@U| |T@U|) Bool)\r\n(declare-fun UOrdering3 (|T@T| |T@U| |T@U|) Bool)\r\n(declare-fun tickleBool (Bool) Bool)\r\n(assert (and (tickleBool true) (tickleBool false)))\r\n" }, { "path": "ironclad-apps/tools/SymDiff/UnivBackPred2.sx", "content": "; -------------------------------------------------------------------------\r\n; Boogie 2 universal background predicate\r\n; Copyright (c) 2004-2008, Microsoft Corp.\r\n(DEFPRED (<: t u)) ; used for translation with type premisses\r\n(DEFPRED (<:: s t u)) ; used for translation with type arguments\r\n\r\n(BG_PUSH (AND\r\n\r\n ; formula/term axioms\r\n\r\n (FORALL (x y)\r\n (IFF\r\n (EQ (boolIff x y) |@true|)\r\n (IFF (EQ x |@true|) (EQ y |@true|))))\r\n\r\n (FORALL (x y)\r\n (IFF\r\n (EQ (boolImplies x y) |@true|)\r\n (IMPLIES (EQ x |@true|) (EQ y |@true|))))\r\n\r\n (FORALL (x y)\r\n (IFF\r\n (EQ (boolAnd x y) |@true|)\r\n (AND (EQ x |@true|) (EQ y |@true|))))\r\n\r\n (FORALL (x y)\r\n (IFF\r\n (EQ (boolOr x y) |@true|)\r\n (OR (EQ x |@true|) (EQ y |@true|))))\r\n\r\n (FORALL (x)\r\n (PATS (boolNot x))\r\n (IFF\r\n (EQ (boolNot x) |@true|)\r\n (NEQ x |@true|)))\r\n\r\n (FORALL (x y)\r\n (IFF\r\n (EQ (anyEqual x y) |@true|)\r\n (EQ x y)))\r\n\r\n (FORALL (x y)\r\n (PATS (anyNeq x y))\r\n (IFF\r\n (EQ (anyNeq x y) |@true|)\r\n (NEQ x y)))\r\n\r\n (FORALL (x y)\r\n (IFF\r\n (EQ (intLess x y) |@true|)\r\n (< x y)))\r\n\r\n (FORALL (x y)\r\n (IFF\r\n (EQ (intAtMost x y) |@true|)\r\n (<= x y)))\r\n\r\n (FORALL (x y)\r\n (IFF\r\n (EQ (intAtLeast x y) |@true|)\r\n (>= x y)))\r\n\r\n (FORALL (x y)\r\n (IFF\r\n (EQ (intGreater x y) |@true|)\r\n (> x y)))\r\n\r\n ; false is not true\r\n\r\n (DISTINCT |@false| |@true|)\r\n\r\n ;; The following axiom gives a way to typed produce verification conditions,\r\n ;; that is, verification conditions where the terms are typable. To use these,\r\n ;; the VCExpressionGenerator.{CastTo,CastFrom} methods must be overridden.\r\n ;; Look for USE_SORTED_LOGIC in VCGeneration/VCExpr.ssc.\r\n ; (FORALL (val T U)\r\n ; (PATS (TypeConvert (TypeConvert val T U) U T))\r\n ; (EQ (TypeConvert (TypeConvert val T U) U T) val))\r\n\r\n ; Reflect plus\r\n (FORALL (a b) (PATS (Reflect$Add a b)) (EQ (Reflect$Add a b) (+ a b)))\r\n\r\n)) ;; AND, BG_PUSH\r\n; End Boogie universal background predicate\r\n; -------------------------------------------------------------------------\r\n" }, { "path": "ironclad-apps/tools/build/x86_x86/cl.exe.config", "content": "\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\r\n" }, { "path": "ironclad-apps/tools/build/x86_x86/link.exe.config", "content": "\r\n\t\r\n\t\t\r\n\t\r\n\t\r\n\t\t\r\n\t\t\t\r\n\t\t\r\n\t\r\n\r\n" }, { "path": "ironclad-apps/tools/fsharp/FSharp.Compiler.CodeDom.xml", "content": "\n\nFSharp.Compiler.CodeDom\n\n\n\n The total number of elements in the set\n\n\n\n\n Remove the given element from the set\n\n\n\n\n Apply the given function to each binding in the hash table \n\n\n\n\n Apply the given function to the set threading the accumulating parameter\n through the sequence of function applications\n\n\n\n\n Create a new empty mutable hash set \n with key hash/equality based on the F# structural \"hash\" and (=) functions\n\n\n\n\n Create a new empty mutable hash set with an internal bucket array of the given approximate size\n and with key hash/equality based on the F# structural \"hash\" and (=) functions\n\n\n\n\n Create a new empty mutable hash set with an internal bucket array of the given approximate size\n and with the given key hash/equality functions \n\n\n\n\n Create a new mutable hash set containing elements drawn from the given sequence\n\n\n\n\n Make a shallow copy of the set\n\n\n\n\n Test if the set contains the given element\n\n\n\n\n Clear all elements from the set\n\n\n\n\n Add an element to the collection\n\n\n\n\n Create a new empty mutable hash set \n with key hash/equality based on the F# structural \"hash\" and (=) functions\n\n\n\n\n Create a new empty mutable hash set with an internal bucket array of the given approximate size\n and with key hash/equality based on the F# structural \"hash\" and (=) functions\n\n\n\n\n Create a new empty mutable hash set with an internal bucket array of the given approximate size\n and with the given key hash/equality functions \n\n\n\n\n Create a new mutable hash set containing elements drawn from the given sequence\n\n\n\n\n Mutable hash sets based by default on F# structural \"hash\" and (=) functions. Implemented via a hash table and/or Dictionary.\n\n\n\n\n The default location of FSharp.Core.dll and fsc.exe based on the version of fsc.exe that is running\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Implementation of the CodeDomProvider for the F# language.\n This is specialized version that can be used with ASP.NET.\n\n\n\n\n\n\n\n Implementation of the CodeDomProvider for the F# language.\n If you intend to use CodeDom with ASP.NET you should use FSharpAspNetCodeProvider instead.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Where are we generating member?\n\n\n\n\n\n\n\n Generates code for binary operator using function for left and right operand\n\n\n\n\n Process collection - keeps context through the whole processing\n calls 'f' for every element in sequence and 'fs' between every two elements \n as a separator\n\n\n\n\n\n\n\n Call specified function only on elements of specified type.\n (performs dynamic type test using x.GetType())\n\n\n\n\n Process collection - keeps context through the whole processing\n calls 'f' for every element in sequence and 'fs' between every two elements \n as a separator. This is a variant that works on typed collections.\n\n\n\n\n Returns F# conversion function for the specified type (or empty string)\n\n\n\n\n\n\n\n Create context using specified text writer and options\n\n\n\n\n Create closure to do the counting \n (this is usend when we need indexing during collection processing)\n\n\n\n\n\n\n\n Call function, but give it context as an argument \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Generate array initializer. Checks generator options for ASP.NET workaround.\n\n\n\n\n\n\n\n Generates expression which is casted to the inferred type using \"(unbox (box e))\"\n this is useful if the environment where it is used specifies the type explicitly\n for example in array initializers\n\n\n\n\n\n\n\n\n\n\n Generates method code, adds OverloadID attribute when index isn't \"-1\"\n Generates comments and than calls 'generatMethod'\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Generate code for compile unit (file) \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Generate expression - with unkonw type\n\n\n\n\n Generates expression, but generates \"this\" if the expression is null\n (used in field reference etc. because some CodeDOM generators do this \n though I believe it is a mistake)\n\n\n\n\n\n\n\n fields \n\n\n\n\n\n\n\n\n\n\n\n\n\n Abstract method in the interface\n\n\n\n\n Abstract property in the interface \n\n\n\n\n\n\n\n Generates a main method.\n\n\n\n\n By default all CodeDOM generated methods are 'virtual' which means that \n we have to generate \"abstract and default\" (unless we're in struct or\n we're implementing an interface, or the method is overriden)\n (NOTE: the same logic isn't properly implemented for properties)\n\n\n\n\n Generate code for namespace without compilation unit \n\n\n\n\n Generates namespace code - takes output from 'preprocessNamespace'\n\n\n\n\n\n\n\n Generate value of primitive expression \n\n\n\n\n\n\n\n\n\n\n\n\n\n Generate type arguments using context\n\n\n\n\n\n\n\n Generate code for type declaration (not included in namespace) \n\n\n\n\n Generate type reference using context\n (this is most commonly used method) \n\n\n\n\n Get type reference, but don't rename .NET types to F# types\n (this is only needed when calling static methods on the type)\n\n\n\n\n\n\n\n Generates type reference (not for arrays)\n\n\n\n\n Generate type reference with empty context\n\n\n\n\n\n\n\n\n\n\n Get full type reference using information from context \n\n\n\n\n Get full type reference string using empty context\n\n\n\n\n Identity function\n\n\n\n\n\n\n\n\n\n\n Are both types numerical types where numeric conversion function can be applied?\n\n\n\n\n\n\n\n\n\n\n\n\n\n Perform map and filter operations in one \n\n\n\n\n Output string as a valid F# identifier\n\n\n\n\n Append specified string without line-break\n\n\n\n\n Function composition operator\n\n\n\n\n Break-line and append specified string\n\n\n\n\n Returns CodeNamespace, list of classes with scope (which includes class names \n of containing classes and sequence of class renames)\n\n\n\n\n Preprocess collection with type parameters\n Returns array to be used with usingTyParams and\n function to be called to generate < ... > code\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Print object converted to string\n\n\n\n\n Tries to resolve type of a variable and adds it to the Context dictionary\n\n\n\n\n Tries to resolve type of an expression using a few tricks:\n * Fields of current type may have known type\n * Properties of current type as well\n * We can also try to resolve other properties (sometimes it helps)\n * Resolve type for local variables or argument reference \n\n\n\n\n Get System.Type of know type (either standard type or resolved) \n\n\n\n\n Tries to resolve if type is an array, so we can generate \n appropriate code (it can be either indexer or array, but we need to generate\n .Item call for indexers (no overloading is supported by .[]).\n Returns: \"None\" - can't resolve, \"Some\" resovled (true/false - is it an array?)\n\n\n\n\n Print unique id using: \"+> uniqid\"\n\n\n\n\n Record specified type parameters in the context, call generating function\n and then restore the original type parameters\n (this works if someone uses nested type parameters with the same name)\n\n\n\n\n Matches array or indexer expression and corrects it if the generated CodeDOM is incorrect\n\n\n\n\n Tries to find .NET type for specified type name\n This is used when we need to know type in order to generate something correctly,\n but it's just a fallback case\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Walks through the CodeDom tree and keeps current \"scope\" and the result.\n The result is collected through entire tree, but the modified scope is \n passed only to sub-nodes of the current node.\n\n First argument is a function that is called for nodes and has a \n function as a first argument, scope and result as a second and current node as a third.\n The function argument can be used to walk deeper in the tree if wanted.\n\n\n\n\n\n\n\n Search for members and return flat list of selected members\n Function given as an argument returns tuple - first item specifies\n if the current element should be included in the result, the second\n specifies if we should walk through child members of the current object\n\n\n\n\n\n\n\n\n\n\n\n\n\n" }, { "path": "ironclad-apps/tools/fsharp/FSharp.Core.xml", "content": "\n\nFSharp.Core\n\n\n\n Gets the tail of the list, which is a list containing all the elements of the list, excluding the first element \n\n\n\n\n Gets the number of items contained in the list\n\n\n\n\n Get the element of the list at the given position. Note lists are represented\n as linked lists so this is an O(n) operation.\n\n\n\n\n Gets a value indicating if the list contains no entries\n\n\n\n\n Gets the first element of the list\n\n\n\n\n Returns an empty list of a particular type\n\n\n\n\n Returns a list with head as its first element and tail as its subsequent elements\n\n\n\n\n The type of immutable singly-linked lists. \n\n Use the constructors [] and :: (infix) to create values of this type, or\n the notation [1;2;3]. Use the values in the List module to manipulate \n values of this type, or pattern match against the values directly.\n\n\n\n\n An abbreviation for the type of immutable singly-linked lists. \n\n\n\n\n Lookup an element in the map. Raise KeyNotFoundException if no binding\n exists in the map.\n\n\n\n\n Return true if there are no bindings in the map.\n\n\n\n\n The empty map\n\n\n\n\n The number of bindings in the map\n\n\n\n\n Lookup an element in the map, returning a Some value if the element is in the domain \n of the map and None if not.\n\n\n\n\n Remove an element from the domain of the map. No exception is raised if the element is not present.\n\n\n\n\n\n\n\n Test if an element is in the domain of the map\n\n\n\n\n Return a new map with the binding added to the given map.\n\n\n\n\n Build a map that contains the bindings of the given IEnumerable\n\n\n\n\n Immutable maps. Keys are ordered by F# generic comparison.\n\n \n Maps based on generic comparison are efficient for small keys. They are not a suitable choice if keys are recursive data structures \n or if keys require bespoke comparison semantics.\n \n\n\n\n\n An abbreviation for the .NET type System.Collections.Generic.List<_>\n\n\n\n\n Return a new set with the elements of the second set removed from the first.\n\n\n\n\n Compute the union of the two sets.\n\n\n\n\n Returns the lowest element in the set according to the ordering being used for the set\n\n\n\n\n Returns the highest element in the set according to the ordering being used for the set\n\n\n\n\n A useful shortcut for Set.isEmpty. See the Set module for further operations on sets.\n\n\n\n\n The empty set for the type 'T.\n\n\n\n\n The number of elements in the set\n\n\n\n\n Return a new set with the elements of the second set removed from the first.\n\n\n\n\n A useful shortcut for Set.remove. Note this operation produces a new set\n and does not mutate the original set. The new set will share many storage\n nodes with the original. See the Set module for further operations on sets.\n\n\n\n\n Evaluates to \"true\" if all elements of the first set are in the second\n\n\n\n\n Evaluates to \"true\" if all elements of the second set are in the first\n\n\n\n\n Returns the greatest element in the set that is less than the given key \n according to the ordering being used for the set\n\n\n\n\n Returns the least element in the set that is greater than the given key \n according to the ordering being used for the set\n\n\n\n\n\n\n\n A useful shortcut for Set.contains. See the Set module for further operations on sets.\n\n\n\n\n A useful shortcut for Set.add. Note this operation produces a new set\n and does not mutate the original set. The new set will share many storage\n nodes with the original. See the Set module for further operations on sets.\n\n\n\n\n Create a set containing elements drawn from the given sequence.\n\n\n\n\n Immutable sets based on binary trees, where comparison is the\n F# structural comparison function, potentially using implementations\n of the IComparable interface on key values.\n\n See the Set module for further operations on sets.\n\n These sets can be used with elements of any type, but you should check that\n structural hashing and equality on the element type are correct for your type. \n\n\n\n\n An abbreviation for the type of immutable singly-linked lists. \n\n Use the constructors [] and :: (infix) to create values of this type, or\n the notation [1;2;3]. Use the values in the List module to manipulate \n values of this type, or pattern match against the values directly.\n\n\n\n\n An abbreviation for the .NET type System.Collections.Generic.IEnumerable<_>\n\n\n\n\n Fetch the base-index for the first dimension of the array.\n\n See notes on the Array2D module re. zero-basing.\n\n\n\n\n Fetch the base-index for the second dimension of the array.\n\n See notes on the Array2D module re. zero-basing.\n\n\n\n\n Read a range of elements from the first array and write them into the second.\n\n\n\n\n Build a new array whose elements are the same as the input array.\n\n For non-zero-based arrays the basing on an input array will be propogated to the output\n array.\n\n\n\n\n Create an array whose elements are all initially the given value\n\n\n\n\n Create a based array whose elements are all initially the given value\n\n\n\n\n\n\n\n Fetch an element from a 2D array. You can also use the syntax 'array.[index1,index2]' \n\n\n\n\n Create an array given the dimensions and a generator function to compute the elements.\n\n\n\n\n Create a based array given the dimensions and a generator function to compute the elements.\n\n\n\n\n\n\n\n Apply the given function to each element of the array. \n\n\n\n\n Apply the given function to each element of the array. The integer indicies passed to the\n function indicates the index of element.\n\n\n\n\n Return the length of an array in the first dimension \n\n\n\n\n Return the length of an array in the second dimension \n\n\n\n\n Build a new array whose elements are the results of applying the given function\n to each of the elements of the array.\n\n For non-zero-based arrays the basing on an input array will be propogated to the output\n array.\n\n\n\n\n Build a new array whose elements are the results of applying the given function\n to each of the elements of the array. The integer indices passed to the\n function indicates the element being transformed.\n\n For non-zero-based arrays the basing on an input array will be propogated to the output\n array.\n\n\n\n\n Build a new array whose elements are the same as the input array but\n where a non-zero-based input array generates a corresponding zero-based \n output array.\n\n\n\n\n Set the value of an element in an array. You can also use the syntax 'array.[index1,index2] <- value' \n\n\n\n\n\n\n\n Create an array where the entries are initially Unchecked.defaultof<'T>. \n\n\n\n\n Create a based array where the entries are initially Unchecked.defaultof<'T>. \n\n\n\n\n\n\n\n\n\n\n Basic operations on 2-dimensional arrays. \n\n F# and .NET multi-dimensional arrays are typically zero-based. \n However, .NET multi-dimensional arrays used in conjunction with external\n libraries (e.g. libraries associated with Visual Basic) be \n non-zero based, using a potentially different base for each dimension.\n The operations in this module will accept such arrays, and\n the basing on an input array will be propogated to a matching output\n array on the Array2D.map and Array2D.mapi operations.\n Non-zero-based arrays can also be created using Array2D.zero_create_based, \n Array2D.create_based and Array2D.init_based.\n\n\n\n\n Create an array whose elements are all initially the given value\n\n\n\n\n Fetch an element from a 3D array. You can also use the syntax 'array.[index1,index2,index3]'\n\n\n\n\n Create an array given the dimensions and a generator function to compute the elements.\n\n\n\n\n Apply the given function to each element of the array. \n\n\n\n\n Apply the given function to each element of the array. The integer indicies passed to the\n function indicates the index of element.\n\n\n\n\n Return the length of an array in the first dimension \n\n\n\n\n Return the length of an array in the second dimension \n\n\n\n\n Return the length of an array in the third dimension \n\n\n\n\n Build a new array whose elements are the results of applying the given function\n to each of the elements of the array.\n\n For non-zero-based arrays the basing on an input array will be propogated to the output\n array.\n\n\n\n\n Build a new array whose elements are the results of applying the given function\n to each of the elements of the array. The integer indices passed to the\n function indicates the element being transformed.\n\n For non-zero-based arrays the basing on an input array will be propogated to the output\n array.\n\n\n\n\n Set the value of an element in an array. You can also \n use the syntax 'array.[index1,index2,index3] <- value'.\n\n\n\n\n Create an array where the entries are initially the \"default\" value. \n\n\n\n\n\n\n\n Basic operations on rank 3 arrays. \n\n\n\n\n Create an array whose elements are all initially the given value\n\n\n\n\n Fetch an element from a 4D array. You can also use the syntax 'array.[index1,index2,index3,index4]'\n\n\n\n\n Create an array given the dimensions and a generator function to compute the elements.\n\n\n\n\n Return the length of an array in the first dimension \n\n\n\n\n Return the length of an array in the second dimension \n\n\n\n\n Return the length of an array in the third dimension \n\n\n\n\n Return the length of an array in the fourth dimension \n\n\n\n\n Set the value of an element in an array. You can also \n use the syntax 'array.[index1,index2,index3,index4] <- value'.\n\n\n\n\n Create an array where the entries are initially the \"default\" value. \n\n\n\n\n Basic operations on rank 4 arrays. \n\n\n\n\n Build a new array that contains the elements of the first array followed by the elements of the second array\n\n\n\n\n Return the average of the elements in the array. If the array is empty an ArgumentException is thrown.\n\n\n\n\n Return the average of the elements generated by applying the function to each element of the array.\n If the array is empty an ArgumentException is thrown.\n\n\n\n\n\n\n\n Read a range of elements from the first array and write them into the second.\n\n\n\n\n Apply the given function to each element of the array. Return\n the array comprised of the results \"x\" for each element where\n the function returns Some(x)\n\n\n\n\n For each element of the array, apply the given function. Concatenate all the results and return the combined array.\n\n\n\n\n\n\n\n Build a new array that contains the elements of each of the given sequence of arrays\n\n\n\n\n Build a new array that contains the elements of the given array\n\n\n\n\n Create an array whose elements are all initially the given value.\n\n\n\n\n Return an empty array of the given type\n\n\n\n\n Test if any element of the array satisfies the given predicate.\n\n The predicate is applied to the elements of the input array. If any application \n returns true then the overall result is true and no further elements are tested. \n Otherwise, false is returned.\n\n\n\n\n Test if any pair of corresponding elements of the arrays satisfies the given predicate.\n\n The predicate is applied to matching elements in the two collections up to the lesser of the \n two lengths of the collections. If any application returns true then the overall result is \n true and no further elements are tested. Otherwise, if one collections is longer \n than the other then the ArgumentException exception is raised. \n Otherwise, false is returned.\n\n\n\n\n Fill a range of elements of the array with the given value.\n\n\n\n\n Return a new collection containing only the elements of the collection\n for which the given predicate returns \"true\"\n\n\n\n\n Return the first element for which the given function returns 'true'.\n Raise KeyNotFoundException if no such element exists.\n\n\n\n\n Return the index of the first element in the array\n that satisfies the given predicate. Raise KeyNotFoundException if \n none of the elements satisy the predicate.\n\n\n\n\n\n\n\n\n\n\n\n\n\n Apply a function to each element of the collection, threading an accumulator argument\n through the computation. If the input function is f and the elements are i0...iN then computes \n f (... (f s i0)...) iN\n\n\n\n\n Apply a function to pairs of elements drawn from the two collections, \n left-to-right, threading an accumulator argument\n through the computation. The two input\n arrays must have the same lengths, otherwise an ArgumentException is\n raised.\n\n\n\n\n Apply a function to each element of the array, threading an accumulator argument\n through the computation. If the input function is f and the elements are i0...iN then computes \n f i0 (...(f iN s))\n\n\n\n\n Apply a function to pairs of elements drawn from the two collections, right-to-left, \n threading an accumulator argument through the computation. The two input\n arrays must have the same lengths, otherwise an ArgumentException is\n raised.\n\n\n\n\n\n\n\n Apply a function to pairs of elements drawn from the two collections, \n left-to-right, threading an accumulator argument\n through the computation. The two input\n arrays must have the same lengths, otherwise an ArgumentException is\n raised.\n\n\n\n\n Apply a function to each element of the array, threading an accumulator argument\n through the computation. If the input function is f and the elements are i0...iN \n then computes f i0 (...(f iN s))\n\n\n\n\n\n\n\n\n\n\n\n\n\n Test if all elements of the array satisfy the given predicate.\n\n The predicate is applied to the elements of the input collection. If any application \n returns false then the overall result is false and no further elements are tested. \n Otherwise, true is returned.\n\n\n\n\n Test if all corresponding elements of the array satisfy the given predicate pairwise.\n\n The predicate is applied to matching elements in the two collections up to the lesser of the \n two lengths of the collections. If any application returns false then the overall result is \n false and no further elements are tested. Otherwise, if one collection is longer \n than the other then the ArgumentException exception is raised. \n Otherwise, true is returned.\n\n\n\n\n Get an element from an array\n\n\n\n\n Create an array given the dimension and a generator function to compute the elements.\n\n\n\n\n Return true if the given array is empty, otherwise false\n\n\n\n\n\n\n\n Apply the given function to each element of the array. \n\n\n\n\n Apply the given function to pair of elements drawn from matching indices in two arrays. The\n two arrays must have the same lengths, otherwise an ArgumentException is\n raised.\n\n\n\n\n Apply the given function to each element of the array. The integer passed to the\n function indicates the index of element.\n\n\n\n\n Apply the given function to pair of elements drawn from matching indices in two arrays,\n also passing the index of the elements. The two arrays must have the same lengths, \n otherwise an ArgumentException is raised.\n\n\n\n\n Return the length of an array. You can also use property arr.Length.\n\n\n\n\n\n\n\n Build a new array whose elements are the results of applying the given function\n to each of the elements of the array.\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to the corresponding elements of the two collections pairwise. The two input\n arrays must have the same lengths, otherwise an ArgumentException is\n raised.\n\n\n\n\n Build a new array whose elements are the results of applying the given function\n to each of the elements of the array. The integer index passed to the\n function indicates the index of element being transformed.\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to the corresponding elements of the two collections pairwise, also passing the index of \n the elements. The two input arrays must have the same lengths, otherwise an ArgumentException is\n raised.\n\n\n\n\n Return the greatest of all elements of the array, compared via Operators.max on the function result\n\n\n\n\n Return the greatest of all elements of the array, compared via Operators.max on the function result\n\n\n\n\n\n\n\n Return the lowest of all elements of the array, compared via Operators.min\n\n\n\n\n Return the lowest of all elements of the array, compared via Operators.min on the function result\n\n\n\n\n\n\n\n Build an array from the given list\n\n\n\n\n Build a new array from the given enumerable object\n\n\n\n\n Split the collection into two collections, containing the \n elements for which the given predicate returns \"true\" and \"false\"\n respectively \n\n\n\n\n Returns an array with all elements permuted according to the\n specified permutation\n\n\n\n\n Apply the given function to successive elements, returning the first\n result where function returns Some(x) for some x. If the function \n never returns Some(x) then KeyNotFoundException is raised.\n\n\n\n\n Apply a function to each element of the array, threading an accumulator argument\n through the computation. If the input function is f and the elements are i0...iN \n then computes f (... (f i0 i1)...) iN.\n Raises ArgumentException if the array has size zero.\n\n\n\n\n Apply a function to each element of the array, threading an accumulator argument\n through the computation. If the input function is f and the elements are i0...iN \n then computes f i0 (...(f iN-1 iN)).\n Raises ArgumentException if the array has size zero.\n\n\n\n\n\n\n\n\n\n\n Return a new array with the elements in reverse order\n\n\n\n\n Like fold_left, but return the intermediary and final results\n\n\n\n\n Like fold_right, but return both the intermediary and final results\n\n\n\n\n\n\n\n\n\n\n Set an element of an array\n\n\n\n\n Sort the elements of an array, returning a new array. Elements are compared using Operators.compare. \n\n\n\n\n Sort the elements of an array, using the given projection for the keys and returning a new array. Elements are compared using Operators.compare. \n\n\n\n\n Sort the elements of an array by mutating the array in-place, using the given comparison function. Elements are compared using Operators.compare.\n\n\n\n\n Sort the elements of an array by mutating the array in-place, using the given projection for the keys. Elements are compared using Operators.compare.\n\n\n\n\n Sort the elements of an array by mutating the array in-place, using the given comparison function as the order \n\n\n\n\n Sort the elements of an array, using the given comparison function as the order, returning a new array\n\n\n\n\n Sort the elements of an array, using the given projection for the keys. Elements are compared using Operators.compare.\n\n\n\n\n\n\n\n Build a new array that contains the given subrange specified by\n starting index and length.\n\n\n\n\n Return the sum of the elements in the array\n\n\n\n\n Return the sum of the results generated by applying the function to each element of the array.\n\n\n\n\n\n\n\n Build a list from the given array\n\n\n\n\n View the given array as a sequence\n\n\n\n\n Return the first element for which the given function returns true.\n Return None if no such element exists.\n\n\n\n\n Return the index of the first element in the array\n that satisfies the given predicate.\n\n\n\n\n Apply the given function to successive elements, returning the first\n result where function returns Some(x) for some x. If the function \n never returns Some(x) then None is returned.\n\n\n\n\n\n\n\n\n\n\n\n\n\n Split an array of pairs into two arrays\n\n\n\n\n Split an array of triples into three arrays\n\n\n\n\n Create an array where the entries are initially the default value Unchecked.defaultof<'T>. \n\n\n\n\n Create an array where the entries are initially the default value Unchecked.defaultof<'T>. \n\n\n\n\n Combine the two arrays into an array of pairs. The two arrays must have equal lengths, otherwise an ArgumentException is\n raised.\n\n\n\n\n Combine three arrays into an array of pairs. The three arrays must have equal lengths, otherwise an ArgumentException is\n raised.\n\n\n\n\n Basic operations on arrays\n\n\n\n\n Compare using the given comparer function\n\n\n\n\n Convert an existing IComparer object into a comparison function with a fast entry point\n If comparer was originally built using ComparisonIdentity.FromFunction then the original function will be\n returned\n\n\n\n\n Convert an existing IComparer object into a comparison function with a fast entry point\n\n\n\n\n Structural comparison. Compare using Operators.compare.\n\n\n\n\n Common notions of comparison identity used with sorted data structures.\n\n\n\n\n Hash using the given hashing and equality functions\n\n\n\n\n\n\n\n Physical hashing (hash on reference identity of objects, and the contents of value types). \n Hash using LanguagePrimitives.PhysicalEquality and LanguagePrimitives.PhysicalHash,\n That is, for value types use GetHashCode and Object.Equals (if no other optimization available),\n and for reference types use System.Runtime.CompilerServices.RuntimeHelpers.GetHashCode and \n reference equality. \n\n\n\n\n Structural hashing. Hash using Operators.(=) and Operators.hash.\n\n\n\n\n Common notions of value identity used with hash tables.\n\n\n\n\n Return a new list that contains the elements of the first list\n followed by elements of the second\n\n\n\n\n Return the average of the elements in the list.\n If the list is empty an ArgumentException is thrown.\n\n\n\n\n Return the average of the elements generated by applying the function to each element of the list.\n If the list is empty an ArgumentException is thrown.\n\n\n\n\n\n\n\n Apply the given function to each element of the list. Return\n the list comprised of the results x for each element where\n the function returns Some(x)\n\n\n\n\n For each element of the list, apply the given function. Concatenate all the results and return the combined list.\n\n\n\n\n\n\n\n Return a new list that contains the elements of each the lists in order\n\n\n\n\n Return an empty list of the given type\n\n\n\n\n Test if any element of the list satisfies the given predicate.\n\n The predicate is applied to the elements of the input list. If any application \n returns true then the overall result is true and no further elements are tested. \n Otherwise, false is returned.\n\n\n\n\n Test if any pair of corresponding elements of the lists satisfies the given predicate.\n\n The predicate is applied to matching elements in the two collections up to the lesser of the \n two lengths of the collections. If any application returns true then the overall result is \n true and no further elements are tested. Otherwise, if one collections is longer \n than the other then the ArgumentException exception is raised. \n Otherwise, false is returned.\n\n\n\n\n Return a new collection containing only the elements of the collection\n for which the given predicate returns \"true\"\n\n\n\n\n Return the first element for which the given function returns true.\n Raise KeyNotFoundException if no such element exists.\n\n\n\n\n Return the index of the first element in the list\n that satisfies the given predicate.\n Raise KeyNotFoundException if no such element exists.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Apply a function to each element of the collection, threading an accumulator argument\n through the computation. Take the second argument, and apply the function to it\n and the first element of the list. Then feed this result into the function along\n with the second element and so on. Return the final result.\n If the input function is f and the elements are i0...iN then \n computes f (... (f s i0) i1 ...) iN\n\n\n\n\n Apply a function to corresponding elements of two collections, threading an accumulator argument\n through the computation. The collections must have identical sizes.\n If the input function is f and the elements are i0...iN and j0...jN\n then computes f (... (f s i0 j0)...) iN jN.\n\n\n\n\n Apply a function to each element of the collection, threading an accumulator argument\n through the computation. If the input function is f and the elements are i0...iN then \n computes f i0 (...(f iN s)).\n\n\n\n\n Apply a function to corresponding elements of two collections, threading an accumulator argument\n through the computation. The collections must have identical sizes.\n If the input function is f and the elements are i0...iN and j0...jN\n then computes f i0 j0 (...(f iN jN s)).\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Test if all elements of the collection satisfy the given predicate.\n\n The predicate is applied to the elements of the input list. If any application \n returns false then the overall result is false and no further elements are tested. \n Otherwise, true is returned.\n\n\n\n\n Test if all corresponding elements of the collection satisfy the given predicate pairwise.\n\n The predicate is applied to matching elements in the two collections up to the lesser of the \n two lengths of the collections. If any application returns false then the overall result is \n false and no further elements are tested. Otherwise, if one collection is longer \n than the other then the ArgumentException exception is raised. \n Otherwise, true is returned.\n\n\n\n\n Return the first element of the list. Raise (Invalid_argument \"hd\") if undefined.\n\n\n\n\n Create a list by calling the given generator on each index\n\n\n\n\n Return true if the list contains no elements, false otherwise\n\n\n\n\n\n\n\n Apply the given function to each element of the collection. \n\n\n\n\n Apply the given function to two collections simultaneously. The\n collections must have identical size.\n\n\n\n\n Apply the given function to each element of the collection. The integer passed to the\n function indicates the index of element.\n\n\n\n\n Apply the given function to two collections simultaneously. The\n collections must have identical size. The integer passed to the\n function indicates the index of element.\n\n\n\n\n Return the length of the list\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to each of the elements of the collection.\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to the corresponding elements of the two collections pairwise.\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to the corresponding elements of the three collections simultaneously.\n\n\n\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to each of the elements of the collection. The integer index passed to the\n function indicates the index (from 0) of element being transformed.\n\n\n\n\n Like mapi, but mapping corresponding elements from two lists of equal length.\n\n\n\n\n Return the greatest of all elements of the list, compared via Operators.max\n\n\n\n\n Return the greatest of all elements of the array, compared via Operators.max on the function result\n\n\n\n\n\n\n\n Return the lowest of all elements of the list, compared via Operators.min\n\n\n\n\n Return the lowest of all elements of the array, compared via Operators.min on the function result\n\n\n\n\n\n\n\n Index into the list. The first element has index 0.\n\n\n\n\n Build a collection from the given array\n\n\n\n\n Build a new collection from the given enumerable object\n\n\n\n\n Split the collection into two collections, containing the \n elements for which the given predicate returns true and false\n respectively \n\n\n\n\n Returns a list with all elements permuted according to the\n specified permutation\n\n\n\n\n Apply the given function to successive elements, returning the first\n result where function returns Some(x) for some x. If no such\n element exists then raise System.Collections.Generic.KeyNotFoundException\n\n\n\n\n Apply a function to each element of the collection, threading an accumulator argument\n through the computation. Apply the function to the first two elements of the list.\n Then feed this result into the function along with the third element and so on. \n Return the final result. If the input function is f and the elements are i0...iN then computes \n f (... (f i0 i1) i2 ...) iN.\n Raises ArgumentException if the list has no elements. \n\n\n\n\n Apply a function to each element of the collection, threading an accumulator argument\n through the computation. If the input function is f and the elements are i0...iN then computes \n f i0 (...(f iN-1 iN)).\n Raises ArgumentException if the list has no elements.\n\n\n\n\n\n\n\n\n\n\n Create a list by calling the given generator on each index\n\n\n\n\n Return a new list with the elements in reverse order\n\n\n\n\n Apply a function to each element of the collection, threading an accumulator argument\n through the computation. Take the second argument, and apply the function to it\n and the first element of the list. Then feed this result into the function along\n with the second element and so on. Return the list of intermediate results and the final result.\n\n\n\n\n Like foldBack, but return both the intermediary and final results\n\n\n\n\n\n\n\n\n\n\n Sort the given list using the given comparison function\n\n\n\n\n Sort the given list using keys given by the given projection. Keys are compared using Operators.compare. \n\n\n\n\n Sort the given list using the given comparison function\n\n\n\n\n\n\n\n\n\n\n\n\n\n Return the sum of the elements in the list\n\n\n\n\n Return the sum of the results generated by applying the function to each element of the list.\n\n\n\n\n\n\n\n Return the tail of the list. Raise (Invalid_argument \"tl\") if undefined.\n\n\n\n\n Build an array from the given collection\n\n\n\n\n Build a new collection from the given enumerable object\n\n\n\n\n Return the first element for which the given function returns true.\n Return None if no such element exists.\n\n\n\n\n Return the index of the first element in the list\n that satisfies the given predicate.\n Return None if no such element exists.\n\n\n\n\n Apply the given function to successive elements, returning Some(x) the first\n result where function returns Some(x) for some x. If no such element \n exists then return None\n\n\n\n\n\n\n\n\n\n\n Split a list of pairs into two lists\n\n\n\n\n Split a list of triples into three lists\n\n\n\n\n Combine the two lists into a list of pairs. The two lists must have equal lengths.\n\n\n\n\n Combine the three lists into a list of triples. The lists must have equal lengths.\n\n\n\n\n Basic operations on lists. \n\n\n\n\n Return a new map with the binding added to the given map.\n\n\n\n\n Test is an element is in the domain of the map\n\n\n\n\n The empty map\n\n\n\n\n Return true if the given predicate returns true for one of the\n bindings in the map.\n\n\n\n\n Build a new map containing only the bindings for which the given predicate returns 'true'\n\n\n\n\n Lookup an element in the map, raising KeyNotFoundException if no binding\n exists in the map.\n\n\n\n\n Evaluates the function on each mapping in the collection. Returns the key for the first mapping\n where the function returns 'true'. Raise KeyNotFoundException if no such element exists.\n\n\n\n\n\n\n\n Search the map looking for the first element where the given function returns a Some value\n\n\n\n\n Fold over the bindings in the map \n\n\n\n\n Fold over the bindings in the map \n\n\n\n\n\n\n\n\n\n\n\n\n\n Return true if the given predicate returns true for all of the\n bindings in the map.\n\n\n\n\n Is the map empty?\n\n\n\n\n\n\n\n Apply the given function to each binding in the dictionary\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to each of the elements of the collection. The index passed to the\n function indicates the index of element being transformed.\n\n\n\n\n\n\n\n\n\n\n Return a new map made from the given bindings\n\n\n\n\n Return a new map made from the given bindings\n\n\n\n\n Return a new map made from the given bindings\n\n\n\n\n Build two new maps, one containing the bindings for which the given predicate returns 'true',\n and the other the remaining bindings.\n\n\n\n\n Search the map looking for the first element where the given function returns a Some value\n\n\n\n\n Remove an element from the domain of the map. No exception is raised if the element is not present.\n\n\n\n\n Returns an array of all key-value pairs in the mappinng\n\n\n\n\n Returns a list of all key-value pairs in the mappinng\n\n\n\n\n View the collection as an enumerable sequence. This collection\n type is also directly compatible with 'seq<KeyValuePair<_,_> >'.\n\n Note this function returns a sequence of tuples, whereas the collection\n itself is compatible with the logically equivalent sequence of KeyValuePairs.\n Using sequences of tuples tends to be more convenient in F#, however the\n collection itself must enumerate KeyValuePairs to conform to the .NET\n design guidelines and the IDictionary interface.\n\n\n\n\n Lookup an element in the map, returning a Some value if the element is in the domain \n of the map and None if not.\n\n\n\n\n Return the key of the first mapping in the collection that satisfies the given predicate. \n Return 'None' if no such element exists.\n\n\n\n\n Search the map looking for the first element where the given function returns a Some value\n\n\n\n\n\n\n\n\n\n\n Functional programming operators related to the Map<_,_> type.\n\n\n\n\n Wrap the two given enumeration-of-enumerations as a single concatenated\n enumeration.\n\n The returned sequence may be passed between threads safely. However, \n individual IEnumerator values generated from the returned sequence should not be accessed concurrently.\n\n\n\n\n Return the average of the elements in the sequence\n\n The elements are averaged using the '+' operator, 'DivideByInt' method and 'Zero' property \n associated with the element type.\n\n\n\n\n Return the average of the results generated by applying the function to each element of the sequence.\n\n The elements are averaged using the '+' operator, 'DivideByInt' method and 'Zero' property \n associated with the generated type.\n\n\n\n\n\n\n\n Return a sequence that corresponds to a cached version of the input sequence.\n This result sequence will have the same elements as the input sequence. The result \n can be enumerated multiple times. The input sequence will be enumerated at most \n once and only as far as is necessary.\n\n Enumeration of the result sequence is thread safe in the sense that multiple independent IEnumerator\n values may be used simultaneously from different threads (accesses to \n the internal lookaside table are thread safe). Each individual IEnumerator\n is not typically thread safe and should not be accessed concurrently.\n\n Note, once enumeration of the input sequence has started,\n it's enumerator will be kept live by this object until the enumeration has completed.\n At that point, the enumerator will be disposed. \n\n The enumerator may be disposed and underlying cache storage released by \n converting the returned sequence object to type IDisposable, and calling the Dispose method\n on this object. The sequence object may then be re-enumerated and a fresh enumerator will\n be used.\n\n\n\n\n Wrap a loosely-typed System.Collections sequence as a typed sequence.\n\n The use of this function usually requires a type annotation.\n An incorrect type annotation may result in runtime type\n errors.\n\n Individual IEnumerator values generated from the returned sequence should not be accessed concurrently.\n\n\n\n\n Apply the given function to each element of the list. Return\n the list comprised of the results \"x\" for each element where\n the function returns Some(x)\n\n The returned sequence may be passed between threads safely. However, \n individual IEnumerator values generated from the returned sequence should not be accessed concurrently.\n\n Remember sequence is lazy, effects are delayed until it is enumerated.\n\n\n\n\n For each element of the enumeration apply the given function and concatenate all the results.\n\n Remember sequence is lazy, effects are delayed until it is enumerated. \n\n\n\n\n Compare two sequence's using generic comparison, element by element.\n\n\n\n\n Compare two sequence's using the given comparison function, element by element.\n\n\n\n\n Wrap the given enumeration-of-enumerations as a single concatenated\n enumeration.\n\n The returned sequence may be passed between threads safely. However, \n individual IEnumerator values generated from the returned sequence should not be accessed concurrently.\n\n\n\n\n Apply a key-generating function to each element of a sequence and return a sequence yielding unique\n keys and their number of occurences in the original sequence. \n \n Note that this function returns a sequence that digests the whole initial sequence as soon as \n that sequence is iterated. As a result this function should not be used with \n large or infinite sequences. The function makes no assumption on the ordering of the original \n sequence.\n\n\n\n\n\n\n\n Return a sequence that is built from the given delayed specification of an\n Seq. The input function is evaluated each time an IEnumerator for the sequence \n is requested.\n\n\n\n\n Return a sequence that contains no duplicate entries according to generic hash and equality comparisons on the entries.\n If an element occurs multiple times in the sequence then the later occurrences are discarded.\n\n\n\n\n Return a sequence that contains no duplicate entries according to the \n generic hash and equality comparisons on the keys returned by the given key-generating function.\n If an element occurs multiple times in the sequence then the later occurrences are discarded.\n\n\n\n\n\n\n\n Create an empty sequence \n\n\n\n\n Test if any element of the sequence satisfies the given predicate.\n\n The predicate is applied to the elements of the input sequence. If any application \n returns true then the overall result is true and no further elements are tested. \n Otherwise, false is returned.\n\n\n\n\n Test if any pair of corresponding elements of the input sequences satisfies the given predicate.\n\n The predicate is applied to matching elements in the two sequences up to the lesser of the \n two lengths of the collections. If any application returns true then the overall result is \n true and no further elements are tested. Otherwise, false is returned. If one sequence is shorter than \n the other then the remaining elements of the longer sequence are ignored.\n\n\n\n\n Return a new collection containing only the elements of the collection\n for which the given predicate returns \"true\"\n\n The returned sequence may be passed between threads safely. However, \n individual IEnumerator values generated from the returned sequence should not be accessed concurrently.\n\n Remember sequence is lazy, effects are delayed until it is enumerated. \n\n\n\n\n Return the first element for which the given function returns true.\n Raise KeyNotFoundException if no such element exists.\n\n\n\n\n Return the index of the first element in the sequence of pairs\n that satisfies the given predicate. Raise KeyNotFoundException if no such element exists.\n\n\n\n\n\n\n\n\n\n\n\n\n\n Apply a function to each element of the collection, threading an accumulator argument\n through the computation. If the input function is f and the elements are i0...iN \n then computes f (... (f s i0)...) iN\n\n\n\n\n\n\n\n\n\n\n Test if all elements of the sequence satisfy the given predicate.\n\n The predicate is applied to the elements of the input sequence. If any application \n returns false then the overall result is false and no further elements are tested. \n Otherwise, true is returned.\n\n\n\n\n Test the all pairs of elements drawn from the two sequences satisfies the\n given predicate. If one sequence is shorter than \n the other then the remaining elements of the longer sequence are ignored\n\n\n\n\n Apply a key-generating function to each element of a sequence and yields a sequence of \n unique keys. Each unique key has also contains a sequence of all elements that match \n to this key. \n \n Note that this function returns a sequence that digests the whole initial sequence as soon as \n that sequence is iterated. As a result this function should not be used with \n large or infinite sequences. The function makes no assumption on the ordering of the original \n sequence.\n\n\n\n\n\n\n\n Return the first element of the sequence. \n\n\n\n\n Generate a new sequence which, when iterated, will return successive\n elements by calling the given function, up to the given count. The results of calling the function\n will not be saved, i.e. the function will be reapplied as necessary to\n regenerate the elements. The function is passed the index of the item being\n generated.\n\n The returned sequence may be passed between threads safely. However, \n individual IEnumerator values generated from the returned sequence should not be accessed concurrently.\n\n\n\n\n Generate a new sequence which, when iterated, will return successive\n elements by calling the given function. The results of calling the function\n will not be saved, i.e. the function will be reapplied as necessary to\n regenerate the elements. The function is passed the index of the item being\n generated\n\n The returned sequence may be passed between threads safely. However, \n individual IEnumerator values generated from the returned sequence should not be accessed concurrently.\n\n\n\n\n\n\n\n\n\n\n Return true if the sequence contains no elements, false otherwise\n\n\n\n\n\n\n\n Apply the given function to each element of the collection. \n\n\n\n\n Apply the given function to two collections simultaneously. If one sequence is shorter than \n the other then the remaining elements of the longer sequence are ignored.\n\n\n\n\n Apply the given function to each element of the collection. The integer passed to the\n function indicates the index of element.\n\n\n\n\n Return the length of the sequence\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to each of the elements of the collection. The given function will be applied\n as elements are demanded using the 'MoveNext' method on enumerators retrieved from the\n object. \n\n The returned sequence may be passed between threads safely. However, \n individual IEnumerator values generated from the returned sequence should not be accessed concurrently.\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to the corresponding pairs of elements from the two sequences. If one input sequence is shorter than \n the other then the remaining elements of the longer sequence are ignored.\n\n\n\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to each of the elements of the collection. The integer index passed to the\n function indicates the index (from 0) of element being transformed.\n\n\n\n\n Return the greatest of all elements of the sequence, compared via Operators.max\n\n\n\n\n Return the greatest of all elements of the array, compared via Operators.max on the function result\n\n\n\n\n\n\n\n Return the lowest of all elements of the sequence, compared via Operators.min\n\n\n\n\n Return the lowest of all elements of the array, compared via Operators.min on the function result\n\n\n\n\n\n\n\n Compute the nth element in the collection.\n\n\n\n\n Build a collection from the given array\n\n\n\n\n Build a collection from the given array\n\n\n\n\n Return a sequence of each element in the input sequence and its predecessor, with the\n exception of the first element which is only returned as the predecessor of the second element.\n\n\n\n\n Apply the given function to successive elements, returning the first\n 'x' where the function returns \"Some(x)\".\n\n\n\n\n Build a new sequence object that delegates to the given sequence object. This ensures \n the original sequence can't be rediscovered and mutated by a type cast. For example, \n if given an array the returned sequence will return the elements of the array, but\n you can't cast the returned sequence object to an array.\n\n\n\n\n Apply a function to each element of the sequence, threading an accumulator argument\n through the computation. Begin by applying the function to the first two elements.\n Then feed this result into the function along with the third element and so on. \n Return the final result.\n Raises ArgumentException if the sequence has no elements. \n\n\n\n\n Like fold, but compute on-demand and return the sequence of intermediary and final results\n\n\n\n\n Return a sequence that yields one item only.\n\n\n\n\n Return a sequence that skips N elements of the underlying sequence and then yields the\n remaining elements of the sequence\n\n\n\n\n Return a sequence that, when iterated, skips elements of the underlying sequence while the \n given predicate returns 'true', and then yields the remaining elements of the sequence\n\n\n\n\n\n\n\n Yield a sequence ordered by keys. \n \n Note that this function returns a sequence that digests the whole initial sequence as soon as \n that sequence is iterated. As a result this function should not be used with \n large or infinite sequences. The function makes no assumption on the ordering of the original \n sequence.\n\n\n\n\n Apply a key-generating function to each element of a sequence and yield a sequence ordered\n by keys. The keys are compared using generic comparison as implemented by Operators.compare. \n \n Note that this function returns a sequence that digests the whole initial sequence as soon as \n that sequence is iterated. As a result this function should not be used with \n large or infinite sequences. The function makes no assumption on the ordering of the original \n sequence.\n\n\n\n\n\n\n\n Return the sum of the elements in the sequence.\n\n The elements are summed using the '+' operator and 'Zero' property associated with the generated type.\n\n\n\n\n Return the sum of the results generated by applying the function to each element of the sequence.\n The generated elements are summed using the '+' operator and 'Zero' property associated with the generated type.\n\n\n\n\n\n\n\n Return the first N elements of the sequence. \n\n\n\n\n Return a sequence that, when iterated, yields elements of the underlying sequence while the \n given predicate returns 'true', and returns no further elements \n\n\n\n\n\n\n\n Build an array from the given collection\n\n\n\n\n Build a list from the given collection\n\n\n\n\n Return a sequence that when enumerated returns at most N elements.\n\n\n\n\n Return the first element for which the given function returns true.\n Return None if no such element exists.\n\n\n\n\n Return the index of the first element in the sequence \n that satisfies the given predicate. Return 'None' if no such element exists.\n\n\n\n\n Apply the given function to successive elements, returning the first\n result where the function returns \"Some(x)\".\n\n\n\n\n\n\n\n\n\n\n\n\n\n Return a sequence that contains the elements generated by the given computation.\n The given initial 'state' argument is passed to the element generator.\n For each IEnumerator elements in the stream are generated on-demand by applying the element\n generator, until a None value is returned by the element generator. Each call to the element\n generator returns a new residual 'state'.\n\n Note the stream will be recomputed each time an IEnumerator is requested and iterated for the Seq.\n\n The returned sequence may be passed between threads safely. However, \n individual IEnumerator values generated from the returned sequence should not be accessed concurrently.\n\n\n\n\n Return a sequence that yields 'sliding windows' of containing elements drawn from the input\n sequence. Each window is returned as a fresh array.\n\n\n\n\n Combine the two sequences into a list of pairs. The two sequences need not have equal lengths:\n when one sequence is exhausted any remaining elements in the other\n sequence are ignored.\n\n\n\n\n Combine the three sequences into a list of triples. The two sequences need not have equal lengths:\n when one sequence is exhausted any remaining elements in the other\n sequence are ignored.\n\n\n\n\n Basic operations on IEnumerables. \n\n\n\n\n The F# compiler emits implementations of this method for compiled sequence expressions\n\n\n\n\n The F# compiler emits implementations of this method for compiled sequence expressions\n\n\n\n\n The F# compiler emits implementations of this method for compiled sequence expressions\n\n\n\n\n The F# compiler emits implementations of this method for compiled sequence expressions\n\n\n\n\n The F# compiler emits implementations of this method for compiled sequence expressions\n\n\n\n\n The F# compiler emits implementations of this method for compiled sequence expressions\n\n\n\n\n The F# compiler emits implementations of this type for compiled sequence expressions\n\n\n\n\n The F# compiler emits calls to this function to implement the compiler-intrinsic\n conversions from untyped System.Collections.IEnumerable sequences to typed sequences\n\n\n\n\n The F# compiler emits calls to this function to \n implement the 'try/finally' operator for F# sequence expressions\n\n\n\n\n The F# compiler emits calls to this function to implement the 'use' operator for F# sequence expressions\n\n\n\n\n The F# compiler emits calls to this function to \n implement the 'while' operator for F# sequence expressions\n\n\n\n\n A group of functions used as part of the compiled representation of F# sequence expressions\n\n\n\n\n Return a new set with an element added to the set. No exception is raised if\n the set already contains the given element.\n\n\n\n\n Returns the minimum element of the set\n\n\n\n\n\n\n\nEvaluates to \"true\" if the given element is in the given set\n\n\n\n\nReturn the number of elements in the set. Same as size\n\n\n\n\n Return a new set with the elements of the second set removed from the first.\n\n\n\n\n The empty set for the type 'T .\n\n\n\n\nTest if any element of the collection satisfies the given predicate.\nIf the input function is f and the elements are i0...iN \nthen computes p i0 or ... or p iN.\n\n\n\n\n Return a new collection containing only the elements of the collection\n for which the given predicate returns true\n\n\n\n\n Apply the given accumulating function to all the elements of the set\n\n\n\n\n Apply the given accumulating function to all the elements of the set\n\n\n\n\n\n\n\n\n\n\n\n\n\n Test if all elements of the collection satisfy the given predicate.\n If the input function is f and the elements are i0...iN and \"j0...jN\"\n then computes p i0 && ... && p iN.\n\n\n\n\n Compute the intersection of the two sets.\n\n\n\n\nCompute the intersection of a sequence of sets. The sequence must be non-empty\n\n\n\n\n\n\n\nReturn \"true\" if the set is empty\n\n\n\n\n\n\n\nApply the given function to each element of the set, in order according\nto the comparison function\n\n\n\n\n Return a new collection containing the results of applying the\n given function to each element of the input set\n\n\n\n\n\n\n\nEvaluates to \"true\" if the given element is in the given set\n\n\n\n\n\n\n\n\n\n\n Build a set that contains the same elements as the given array\n\n\n\n\n Build a set that contains the same elements as the given list\n\n\n\n\n Build a new collection from the given enumerable object\n\n\n\n\nSplit the set into two sets containing the elements for which the given predicate\nreturns true and false respectively\n\n\n\n\n\n\n\nReturn a new set with the given element removed. No exception is raised in \nthe set doesn't contain the given element.\n\n\n\n\n The set containing the given one element.\n\n\n\n\n\n\n\n Evaluates to \"true\" if all elements of the second set are in the first \n\n\n\n\n Build an array that contains the elements of the set in order\n\n\n\n\n Build a list that contains the elements of the set in order\n\n\n\n\n Return a view of the collection as an enumerable object\n\n\n\n\nCompute the union of the two sets.\n\n\n\n\nCompute the union of a sequence of sets.\n\n\n\n\n\n\n\n Functional programming operators related to the Set<_> type.\n\n\n\n\n Get the default group for executing asynchronous computations\n\n\n\n\n Specify an asynchronous computation that, when run, executes computation,\n If p is effectively cancelled before its termination then\n the process f exn is executed. \n\n\n\n\n Specify an asynchronous computation that, when run, queues a CPU-intensive work in the thread pool item that runs\n its continutation.\n\n\n\n\n Specify an asynchronous computation that, when run, creates a new thread and runs\n its continutation in that thread\n\n\n\n\n Specify an asynchronous computation that, when run, runs\n its continuation using syncContext.Post. If syncContext is null \n then the asynchronous computation is equivalent to SwitchToThreadPool().\n\n\n\n\n Start a child computation within an asynchronous workflow. \n This allows multiple asynchronous computations to be executed simultaneously.\n \n This method should normally be used as the immediate \n right-hand-side of a 'let!' binding in an F# asynchronous workflow, i.e.,\n \n async { ...\n let! completor1 = childComputation1 |> Async.StartChild \n let! completor2 = childComputation2 |> Async.StartChild \n ... \n let! result1 = completor1 \n let! result2 = completor2 \n ... }\n \n When used in this way, each use of StartChild starts an instance of childComputation \n and returns a completor object representing a computation to wait for the completion of the operation.\n When executed, the completor awaits the completion of childComputation. \n\n\n\n\n Start the asynchronous computation in the thread pool. Do not await its result.\n\n Run as part of the default AsyncGroup\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Run an asynchronous computation, initially as a work item.\n\n Run as part of the default AsyncGroup\n\n\n\n\n Run the asynchronous computation and await its result.\n\n If an exception occurs in the asynchronous computation then an exception is re-raised by this\n function.\n\n Run as part of the default AsyncGroup\n\n\n\n\n\n\n\n\n\n\n Specify an asynchronous computation that, when run, executes the given callback. \n The callback must eventually call either the continuation,\n the exception continuation or the cancel exception.\n\n\n\n\n Specify an asynchronous computation that, when run, executese the three asynchronous computations, starting each in the thread pool.\n If any raise an exception then the overall computation will raise an exception, and attempt to cancel the others.\n All the sub-computations belong to an AsyncGroup that is a subsidiary of the AsyncGroup of the outer computations.\n\n\n\n\n Specify an asynchronous computation that, when run, executes the two asynchronous computations, starting each in the thread pool.\n If any raise an exception then the overall computation will raise an exception, and attempt to cancel the others.\n All the sub-computations belong to an AsyncGroup that is a subsidiary of the AsyncGroup of the outer computations.\n\n\n\n\n Specify an asynchronous computation that, when run, executes all the given asynchronous computations, initially\n queueing each as work items and using a fork/join pattern. If any raise an exception then the \n overall computation will raise the first detected exception, and attempt to cancel the others.\n All the sub-computations belong to an AsyncGroup that is a subsidiary of the AsyncGroup of the outer computations.\n\n\n\n\n Generate a scoped, cooperative cancellation handler for use within an asynchronous workflow. \n\n async { use! holder = Async.OnCancel f ... } generates an asynchronous computation where, \n if a cancellation happens any time during the execution of the asynchronous computation in the scope of 'holder',\n then action 'f' is executed on the thread that is performing the cancellation. You can use\n this to arrange for your own computation to be asynchronously notified that a cancellation has occurred, e.g.\n by setting a flag, or deregistering a pending I/O action.\n\n\n\n\n Specify an asynchronous computation that, when run, runs 'p', ignoring the result and\n returning the result '()'.\n\n\n\n\n\n\n\n Get the default group for executing asynchronous computations\n\n\n\n\n Raise the cancellation condition for the most recent set of Async computations started without any specific AsyncGroup.\n Replace the global group with a new global group for any asynchronous computations created after this point without \n any specific AsyncGroup.\n\n\n\n\n\n\n\n Specify an asynchronous computation in terms of a Begin/End pair of actions in \n the style used in .NET APIs where the overall operation is not qualified by any arguments. For example, \n Async.BuildPrimitive(ws.BeginGetWeather,ws.EndGetWeather)\n When the computation is run, the 'Begin' half of the operation is executed, and\n an asynchronous computation is returned that, when run, awaits the completion \n of the computation and fetches its overall result using the 'End' operation.\n\n\n\n\n Specify an asynchronous computation in terms of a Begin/End pair of actions in \n the style used in .NET APIs where the\n overall operation is qualified by one argument. For example, \n Async.BuildPrimitive(place,ws.BeginGetWeather,ws.EndGetWeather)\n When the computation is run, the 'Begin' half of the operation is executed, and\n an asynchronous computation is returned that, when run, awaits the completion \n of the computation and fetches its overall result using the 'End' operation.\n\n\n\n\n Specify an asynchronous computation in terms of a Begin/End pair of actions in \n the style used in .NET APIs where the\n overall operation is qualified by two arguments. For example, \n Async.BuildPrimitive(arg1,arg2,ws.BeginGetWeather,ws.EndGetWeather)\n When the computation is run, the 'Begin' half of the operation is executed, and\n an asynchronous computation is returned that, when run, awaits the completion \n of the computation and fetches its overall result using the 'End' operation.\n\n\n\n\n Specify an asynchronous computation in terms of a Begin/End pair of actions in \n the style used in .NET APIs where the overall operation is qualified by three arguments. For example, \n Async.BuildPrimitive(arg1,arg2,arg3,ws.BeginGetWeather,ws.EndGetWeather)\n When the computation is run, the 'Begin' half of the operation is executed, and\n an asynchronous computation is returned that, when run, awaits the completion \n of the computation and fetches its overall result using the 'End' operation.\n\n\n\n\n This static class holds members for creating and manipulating asynchronous computations\n\n\n\n\n Specify an asynchronous computation that, when run, just returns '()'\n\n\n\n\n Specify an asynchronous computation that, when run, runs 'p' repeatedly \n until 'gd()' becomes false.\n\n\n\n\n Specify an asynchronous computation that, when run, runs 'f(resource)'. \n The action 'resource.Dispose()' is executed as this computation yields its result\n or if the asynchronous computation exits by an exception or by cancellation.\n\n\n\n\n Specify an asynchronous computation that, when run, runs 'p' and returns its result.\n If an exception happens then 'f(exn)' is called and the resulting computation executed instead.\n\n\n\n\n Specify an asynchronous computation that, when run, runs 'p'. The action 'f' is executed \n after 'p' completes, whether 'p' exits normally or by an exception. If 'f' raises an exception itself\n the original exception is discarded and the new exception becomes the overall result of the computation.\n\n\n\n\n Specify an asynchronous computation that, when run, returns the result 'v'\n\n\n\n\n Specify an asynchronous computation that, when run, enumerates the sequence 'seq'\n on demand and runs 'f' for each element.\n\n\n\n\n Specify an asynchronous computation that, when run, runs 'f()'\n\n\n\n\n Specify an asynchronous computation that, when run, first runs 'p1' and then runs 'p2', returning the result of 'p2'.\n\n\n\n\n Specify an asynchronous computation that, when run, runs 'p', and when \n 'p' generates a result 'T', runs 'f res'.\n\n\n\n\n Generate an object used to build asynchronous computations using F# computation expressions. The value\n 'async' is a pre-defined instance of this type.\n\n\n\n\n The type of the 'async' operator, used to build workflows for asynchronous computations.\n\n\n\n\n Wait for the completion of the operation and get its result\n\n\n\n\n\n\n\n Raise the cancellation condition for this group of computations\n\n\n\n\n Start the asynchronous computation as a work item. Do not await its result.\n\n\n\n\n\n\n\n\n\n\n Start the asynchronous computation as a work item. \n Return a handle to the computation as an AsyncFuture.\n\n\n\n\n Run the asynchronous computation and await its result.\n\n If an exception occurs in the asynchronous computation then an exception is re-raised by this\n function.\n\n\n\n\n\n\n\n Generate a new asynchronous group\n\n\n\n\n A handle to a capability to cancel a set of asynchronous computations.\n\n\n\n\n Send a reply to a PostAndReply message\n\n\n\n\n A handle to a capability to reply to a PostAndReply message\n\n\n\n\n An asynchronous computation, which, when run, will eventually produce a value \n of the given type, or else raise an exception. The value and/or exception is not returned \n to the caller immediately, but is rather passed to a success continuation, exception continuation \n or cancellation continuation. \n\n Asynchronous computations are normally specified using the F# 'workflow' syntax for building \n computations.\n\n When run, asynchronous computations can normally be thought of as running run in one of\n two modes: 'work item mode' or 'waiting mode'.\n\n - 'work item mode' indicates that the computation is executing as a work item,\n e.g. in the .NET Thread Pool via ThreadPool.QueueUserWorkItem, or is running\n a brief event-response action on the GUI thread. \n\n - 'waiting mode' indicates the computations a waiting for asynchronous I/O completions,\n typically suspended as thunks using ThreadPool.RegisterWaitForSingleObject. \n\n Asynchronous computations running as 'work items' should not generally perform blocking\n operations, e.g. long running synchronous loops. However, some asynchronous \n computations may, out of necessity, need to execute blocking I/O operations: \n these should be run on new threads or a user-managed pool of threads specifically \n dedicated to resolving blocking conditions. For example, System.IO.OpenFile is, by \n design, a blocking operation. However frequently it is important to code as \n if this is asynchronous. This can be done by executing Async.SwitchToNewThread\n as part of the workflow.\n\n When run, asynchronous computations belong to an AsyncGroup. This can usually be specified \n when the async computation is started. The only action on an AsyncGroup is to raise a cancellation \n condition for the AsyncGroup. Async values check the cancellation condition for their AsyncGroup \n regularly, though synchronous computations within an asynchronous computation will not automatically \n check this condition. This gives a user-level cooperative cancellation protocol.\n\n\n\n\n Publish the event as a first class event value\n\n\n\n\n Trigger the event using the given parameters\n\n\n\n\n Create an event object suitable for implementing an arbitrary type of delegate\n\n\n\n\n Event implementations for an arbitrary type of delegate\n\n\n\n\n Publish the event as a first class event value\n\n\n\n\n Trigger the event using the given parameters\n\n\n\n\n Create an event object suitable for implementing for the IEvent<_> type\n\n\n\n\n Event implementations for the IEvent<_> type\n\n\n\n\n Publish the event as a first class event value\n\n\n\n\n Trigger the event using the given sender object and parameters. The sender object may be null.\n\n\n\n\n Create an event object suitable for delegate types following the standard .NET Framework convention of a first 'sender' argument\n\n\n\n\n Event implementations for a delegate types following the standard .NET Framework convention of a first 'sender' argument\n\n\n\n\n\n\n\n A delegate type associated with the F# event type IEvent<_>\n\n\n\n\n Remove a listener delegate from an event listener store\n\n\n\n\n Connect a handler delegate object to the event. A handler can\n be later removed using RemoveHandler. The listener will\n be invoked when the event is fired.\n\n\n\n\n F# gives special status to non-virtual instance member properties compatible with type IDelegateEvent, \n generating approriate .NET metadata to make the member appear to other .NET languages as a\n .NET event.\n\n\n\n\n First-class listening points (i.e. objects that permit you to register a 'callback'\n activated when the event is triggered). See the module Event\n for functions to create events.\n\n\n\n\n Connect a listener function to the event. The listener will\n be invoked when the event is fired.\n\n\n\n\nThe family of first class event values for delegate types that satisfy the F# delegate constraint.\n\n\n\n\n Force the execution of this value and return its result. Same as Value. Mutual exclusion is used to \n prevent other threads also computing the value.\n\n\n\n\n Indicates if the lazy value has been successfully computed\n\n\n\n\n Indicates if the lazy value is being computed or the computation raised an exception\n\n\n\n\n Indicates if the lazy value has yet to be computed \n\n\n\n\n Same as Force, except no lock is taken. \n\n\n\n\n Same as Force\n\n\n\n\n Force the execution of this value and return its result. Same as Value. Mutual exclusion is used to \n prevent other threads also computing the value. If the value is re-forced during its own computation\n the Undefined exception is raised.\n\n\n\n\n Create a lazy computation that evaluates to the given value when forced\n\n\n\n\n Create a lazy computation that evaluates to the result of the given function when forced\n\n\n\n\n The type of delayed computations.\n \n Use the values in the Lazy module to manipulate \n values of this type, and the notation 'lazy expr' to create values\n of this type.\n\n\n\n\n Raise a timeout exception if a message not received in this amount of time. Default infinite.\n\n\n\n\n Raise a timeout exception if a message not received in this amount of time. Default infinite.\n\n\n\n\n Return an asynchronous computation which will \n look through messages in arrival order until 'scanner' returns a Some value. No thread\n is blocked while waiting for further messages. Return None\n if the timeout is exceeded.\n\n\n\n\n Return an asynchronous computation which will \n consume the first message in arrival order. No thread\n is blocked while waiting for further messages. Return None\n if the timeout is exceeded.\n\n\n\n\n Like PostAndReply, but return None if no reply within the timeout period. \n\n\n\n\n Create and start an instance of a MailboxProcessor. The asynchronous computation executed by the\n processor is the one returned by the 'initial' function. \n\n\n\n\n Start the MailboxProcessor\n\n\n\n\n Return an asynchronous computation which will \n look through messages in arrival order until 'scanner' returns a Some value. No thread\n is blocked while waiting for further messages. Raise a TimeoutException\n if the timeout is exceeded.\n\n\n\n\n Return an asynchronous computation which will \n consume the first message in arrival order. No thread\n is blocked while waiting for further messages. Raise a TimeoutException\n if the timeout is exceeded.\n\n\n\n\n Post a message to the message queue of the MailboxProcessor and await a reply on the channel synchronously.\n The message is produced by a single call to the first function which must build a message\n containing the reply channel. The receiving MailboxProcessor must process this message and\n invoke the Reply method on the reply channel precisly once.\n\n\n\n\n Post a message to the message queue of the MailboxProcessor, asynchronously\n\n\n\n\n Like AsyncPostAndReply, but return None if no reply within the timeout period. \n\n\n\n\n Post a message to the message queue of the MailboxProcessor and await a reply on the channel asynchronously.\n The message is produced by a single call to the first function which must build a message\n containing the reply channel. The receiving MailboxProcessor must process this message and\n invoke the Reply method on the reply channel precisly once.\n\n\n\n\n Create an instance of a MailboxProcessor. The asynchronous computation executed by the\n processor is the one returned by the 'initial' function. This function is not executed until\n 'Start' is called.\n\n\n\n\n A MailboxProcessor is a message-processing agent defined using an asynchronous workflow. \n The agent encapsulates a message queue that supports multiple-writers and the single reader agent.\n Writers send messages to the agent by using the Post, PostAndReply or AsyncPostAndReply methods.\n\n The reader agent is specified when creating the MailboxProcessor. The \n agent is usually an asychronous workflow that waits for messages\n by using the Receive or TryReceive methods. \n A MailboxProcessor may also scan through all available messages by using the \n Scan or TryScan method. The encapsulated message queue only \n supports a single active reader, thus at most one concurrent call to Receive, TryReceive,\n Scan and/or TryScan may be active at any one time.\n\n\n\n\n The type of delayed computations.\n \n Use the values in the Lazy module to manipulate \n values of this type, and the notation 'lazy expr' to create values\n of this type.\n\n\n\n\n An exeption type raised when the evaluation of a lazy value recursively depend upon itself\n\n\n\n\n A module of extension members that provide asynchronous operations for some basic .NET types related to concurrency and I/O.\n\n\n\n\n Return a new event which fires on a selection of messages from the original event.\n The selection function takes an original message to an optional new message.\n\n\n\n\n Create an IEvent with no initial listeners. Two items are returned: \n a function to invoke (trigger) the event, and the event that clients \n can plug listeners into.\n\n\n\n\n Return a new event that listens to the original event and triggers the resulting\n event only when the argument to the event passes the given function\n\n\n\n\n Run the given function each time the given event is triggered.\n\n\n\n\n Return a new event that passes values transformed by the given function\n\n\n\n\n Fire the output event when either of the input events fire\n\n\n\n\n Return a new event that triggers on the second and subsequent triggerings of the input event.\n The Nth triggering of the input event passes the arguments from the N-1th and Nth triggering as\n a pair. The argument passed to the N-1th triggering is held in hidden internal state until the \n Nth triggering occurs.\n\n You should ensure that the contents of the values being sent down the event are\n not mutable. Note that many EventArgs types are mutable, e.g. MouseEventArgs, and\n each firing of an event using this argument type may reuse the same physical \n argument obejct with different values. In this case you should extract the necessary\n information from the argument before using this combinator. \n\n\n\n\n Return a new event that listens to the original event and triggers the \n first resulting event if the application of the predicate to the event arguments\n returned true, and the second event if it returned false\n\n\n\n\n Return a new event consisting of the results of applying the given accumulating function\n to successive values triggered on the input event. An item of internal state\n records the current value of the state parameter. The internal state is not locked during the\n execution of the accumulation function, so care should be taken that the \n input IEvent not triggered by multiple threads simultaneously.\n\n\n\n\n Return a new event that listens to the original event and triggers the \n first resulting event if the application of the function to the event arguments\n returned a Choice1Of2, and the second event if it returns a Choice2Of2\n\n\n\n\n Basic operations on first class event objects. \n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to class definition makes it abstract, which means it need not\n implement all its methods. Instances of abstract classes may not be constructed directly.\n\n\n\n\n Indicates the namespace or module to be automatically opened when an assembly is referenced\n or an enclosing module opened.\n\n\n\n\n Create an attribute used to mark a module as 'automatically opened' when the enclosing namespace is opened\n\n\n\n\n Create an attribute used to mark a namespace or module path to be 'automatically opened' when an assembly is referenced\n\n\n\n\n This attribute is used for two purposes. When applied to an assembly, it must be given a string\n argument, and this argument must indicate a valid module or namespace in that assembly. Source\n code files compiled with a reference to this assembly are processed in an environment\n where the given path is automatically oepned.\n\n When applied to a module within an assembly, then the attribute must not be given any arguments.\n When the enclosing namespace is opened in user source code, the module is also implicitly opened.\n\n\n\n\n The value of the attribute, indicating whether the type is automatically marked serializable or not\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a type with value 'false' disables the behaviour where F# makes the\n type Serializable by default.\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a property with event type causes it to be compiled with as a .NET \n Common Language Infrastructure metadata event, through a syntactic translation to a pair of\n 'add_EventName' and 'remove_EventName' methods.\n\n\n\n\n Helper types for active patterns with 2 choices.\n\n\n\n\n Helper types for active patterns with 3 choices.\n\n\n\n\n Helper types for active patterns with 4 choices.\n\n\n\n\n Helper types for active patterns with 5 choices.\n\n\n\n\n Helper types for active patterns with 6 choices.\n\n\n\n\n Helper types for active patterns with 7 choices.\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a type causes it to be represented using a .NET class.\n\n\n\n\n Indicates the variant number of the entity, if any, in a linear sequence of elements with F# source code\n\n\n\n\n Indicates the relationship between the compiled entity and F# source code\n\n\n\n\n Indicates the sequence number of the entity, if any, in a linear sequence of elements with F# source code\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n This attribute is inserted automatically by the F# compiler to tag \n types and methods in the gneerated .NET code with flags indicating the correspondence with\n original source constructs. It is used by the functions in the\n Microsoft.FSharp.Reflection library to reverse-map compiled constructs\n to their original forms. It is not intended for use from use code.\n\n\n\n\n Indicates one or more adjustments to the compiled representation of an F# type or member\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n This attribute is used to adjust the runtime representation for a type. \n For example, it may be used to note that the null representation\n may be used for a type. This affects how some constructs are compiled.\n\n\n\n\n Indicates one or more adjustments to the compiled representation of an F# type or member\n\n\n\n\n The value of the attribute, indicating whether the type has a default augmentation or not\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a discriminated union with value false\n turns off the generation of standard helper member tester, constructor \n and accessor members for the generated .NET class for that type.\n\n\n\n\n Indicates if a constraint is asserted that the field type supports 'null'\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a field declaration means that the field is \n not initialized. During type checking a constraint is asserted that the field type supports 'null'. \n If the 'check' value is false then the constraint is not asserted. \n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a function indicates it is the entrypoint for an application.\n If this absent is not speficied for an EXE then the initialization implicit in the\n module bindings in the last file in the compilation sequence are used as the entrypoint.\n\n\n\n\n Indicates the warning message to be emitted when F# source code uses this construct\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n This attribute is used to tag values that are part of an experimental library\n feature\n\n\n\n\n The release number of the F# version associated with the attribute\n\n\n\n\n The minor version number of the F# version associated with the attribute\n\n\n\n\n The major version number of the F# version associated with the attribute\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n This attribute is added to generated assemblies to indicate the \n version of the data schema used to encode additional F#\n specific information in the resource attached to compiled F# libraries.\n\n\n\n\n Convert an F# first class function value to a value of type System.Converter\n\n\n\n\n Convert an value of type System.Converter to a F# first class function value \n\n\n\n\n Convert an F# first class function value to a value of type System.Converter\n\n\n\n\n Invoke an F# first class function value with five curried arguments. In some cases this\n will result in a more efficient application than applying the arguments successively.\n\n\n\n\n Invoke an F# first class function value with four curried arguments. In some cases this\n will result in a more efficient application than applying the arguments successively.\n\n\n\n\n Invoke an F# first class function value with three curried arguments. In some cases this\n will result in a more efficient application than applying the arguments successively.\n\n\n\n\n Invoke an F# first class function value with two curried arguments. In some cases this\n will result in a more efficient application than applying the arguments successively.\n\n\n\n\n Invoke an F# first class function value with one argument\n\n\n\n\n Convert an value of type System.Converter to a F# first class function value \n\n\n\n\n Construct an instance of an F# first class function value \n\n\n\n\n The .NET type used to represent F# function values. This type is not\n typically used directly, though may be used from other .NET languages.\n\n\n\n\n Convert the given Action delegate object to an F# function value\n\n\n\n\n Convert the given Converter delegate object to an F# function value\n\n\n\n\n A utility funcion to convert function values from tupled to curried form\n\n\n\n\n A utility funcion to convert function values from tupled to curried form\n\n\n\n\n A utility funcion to convert function values from tupled to curried form\n\n\n\n\n A utility funcion to convert function values from tupled to curried form\n\n\n\n\n A utility funcion to convert function values from tupled to curried form\n\n\n\n\n Helper functions for converting F# first class function values to and from .NET representaions\n of functions using delegates.\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a non-function value with generic parameters indicates that \n uses of the construct can give rise to generic code through type inference. \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a type causes it to be represented using a .NET interface.\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a value causes it to be compiled as a .NET constant literal.\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a type causes it to be interpreted as a refined type, currently limited to measure-parameterized types.\n This may only be used under very limited conditions.\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a type causes it to be interpreted as a unit of measure.\n This may only be used under very limited conditions.\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n This attribute is used to tag values that may not be dynamically invoked at runtime. This is\n typically added to inlined functions whose implementations include unverifiable code. It\n causes the method body emitted for the inlined function to raise an exception if \n dynamically invoked, rather than including the unverifiable code in the generated\n assembly.\n\n\n\n\n Indicates the warning message to be emitted when F# source code uses this construct\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n This attribute is used to tag values, modules and types that are only\n present in F# to permit a degree of code-compatibility and cross-compilation\n with other implementations of ML-familty languages, in particular OCaml. The\n use of the construct will give a warning unless the --ml-compatibility flag\n is specified.\n\n\n\n\n Get the value of a 'Some' option. A NullReferenceException is raised if the option is 'None'.\n\n\n\n\n Create an option value that is a 'None' value.\n\n\n\n\n Return 'true' if the option is a 'Some' value.\n\n\n\n\n Return 'true' if the option is a 'None' value.\n\n\n\n\n Create an option value that is a 'Some' value.\n\n\n\n\n The type of optional values. When used from other .NET languages the\n empty option is the null value. \n\n Use the constructors Some and None to create values of this type.\n Use the values in the Option module to manipulate values of this type,\n or pattern match against the values directly.\n\n None values will appear as the value null to other .NET languages.\n Instance methods on this type will appear as static methods to other .NET languages\n due to the use of null as a value representation.\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n This attribute is added automatically for all optional arguments\n\n\n\n\n A unique identifier for this overloaded member within a given overload set\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding the OverloadID attribute to a member permits it to\n be part of a group overloaded by the same name and arity. The string\n must be a unique name amongst those in the overload set. Overrides\n of this method, if permitted, must be given the same OverloadID,\n and the OverloadID must be specified in both signature and implementation\n files if signature files are used.\n\n\n\n\n The current value of the reference cell\n\n\n\n\n The current value of the reference cell\n\n\n\n\n The type of mutable references. Use the functions [:=] and [!] to get and\n set values of this type.\n\n\n\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a record or union type disables the automatic generation\n of overrides for 'System.Object.Equals(obj)', 'System.Object.GetHashCode()' \n and 'System.IComparable' for the type. The type will by default use reference equality.\n This is identical to adding attributes StructuralEquality(false) and StructuralComparison(false).\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to the let-binding for the definition of a top-level \n value makes the quotation expression that implements the value available\n for use at runtime.\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n This attribute is used to indicate that references to a the elements of a module, record or union \n type require explicit qualified access.\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a type, value or member requires that \n uses of the construct must explicitly instantiate any generic type parameters.\n\n\n\n\n The value of the attribute, indicating whether the type is sealed or not\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to class definition makes it sealed, which means it may not\n be extended or implemented.\n\n\n\n\n Indicates the relationship between a compiled entity in a CLI binary and an element in F# source code\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a type causes it to be represented using a .NET struct.\n\n\n\n\n The value of the attribute, indicating whether the type uses structural comparison or not\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a record, union or struct type with value 'false' disables the automatic generation\n of implementations for 'System.IComparable' for the type.\n\n\n\n\n The value of the attribute, indicating whether the type uses structural equality or not\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n Adding this attribute to a record, union or struct type with value 'false' \n confirms the automatic generation of overrides for 'System.Object.Equals(obj)' \n and 'System.Object.GetHashCode()' for the type. This attribute is usually used in \n conjunction with StructuralComparison(false) to generate a type that supports\n structural equality but not structural comparison.\n\n\n\n\n Indicates the text to display by default when objects of this type are displayed \n using '%A' printf formatting patterns and other two-dimensional text-based display \n layouts. \n\n\n\n\n Create an instance of the attribute\n\n\n\n\n This attribute is used to mark how a type is displayed by default when using \n '%A' printf formatting patterns and other two-dimensional text-based display layouts. \n In this version of F# the only valid values are of the form PreText {PropertyName} PostText.\n The property name indicates a property to evaluate and to display instead of the object itself. \n\n\n\n\n\n\n\n\n\n\n Compiled versions of F# tuple types. These are not used directly, though\n these compiled forms are seen by other .NET languages.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Specialize the type function at a given type\n\n\n\n\n Construct an instance of an F# first class type function value \n\n\n\n\n The .NET type used to represent F# first-class type function values. This type is for use\n by compiled F# code.\n\n\n\n\n The type 'unit', which has only one value \"()\". This value is special and\n always uses the representation 'null'.\n\n\n\n\n Create an instance of the attribute\n\n\n\n\n This attribute is used to tag values whose use will result in the generation\n of unverifiable code. These values are inevitably marked 'inline' to ensure that\n the unverifiable constructs are not present in the actual code for the F# library,\n but are rather copied to the source code of the caller.\n\n\n\n\n Four dimensional arrays, typically zero-based. Non-zero-based arrays\n can be created using methods on the System.Array type.\n\n Use the values in the Array4D module\n to manipulate values of this type, or the notation 'arr.[x1,x2,x3,x4]' to get and set array\n values. \n\n\n\n\n Three dimensional arrays, typically zero-based. Non-zero-based arrays\n can be created using methods on the System.Array type.\n\n Use the values in the Array3D module\n to manipulate values of this type, or the notation 'arr.[x1,x2,x3]' to get and set array\n values. \n\n\n\n\n Two dimensional arrays, typically zero-based. \n\n Use the values in the Array2D module\n to manipulate values of this type, or the notation 'arr.[x,y]' to get/set array\n values. \n\n Non-zero-based arrays can also be created using methods on the System.Array type.\n\n\n\n\n Single dimensional, zero-based arrays, written 'int[]', 'string[]' etc.\n Use the values in the Array module to manipulate values \n of this type, or the notation 'arr.[x]' to get/set array\n values. \n\n\n\n\n Single dimensional, zero-based arrays, written 'int[]', 'string[]' etc.\n Use the values in the Array module to manipulate values \n of this type, or the notation 'arr.[x]' to get/set array\n values. \n\n\n\n\n An abbreviation for the type Microsoft.FSharp.Math.BigInt\n\n\n\n\n An abbreviation for the .NET type System.Boolean\n\n\n\n\n Represents a managed pointer in F# code.\n\n\n\n\n An abbreviation for the .NET type System.Byte\n\n\n\n\n An abbreviation for the .NET type System.Char\n\n\n\n\n An abbreviation for the .NET type System.Decimal\n\n\n\n\n The type of decimal numbers, annotated with a unit of measure. The unit\n of measure is erased in compiled code and when values of this type\n are analyzed using reflection. The type is representationally equivalent to \n System.Decimal.\n\n\n\n\n An abbreviation for the .NET type System.Double\n\n\n\n\n An abbreviation for the .NET type System.Exception\n\n\n\n\n An abbreviation for the .NET type System.Double\n\n\n\n\n An abbreviation for the .NET type System.Single\n\n\n\n\n The type of floating point numbers, annotated with a unit of measure. The unit\n of measure is erased in compiled code and when values of this type\n are analyzed using reflection. The type is representationally equivalent to \n System.Single.\n\n\n\n\n The type of floating point numbers, annotated with a unit of measure. The unit\n of measure is erased in compiled code and when values of this type\n are analyzed using reflection. The type is representationally equivalent to \n System.Double.\n\n\n\n\n This type is for internal use by the F# code generator\n\n\n\n\n An abbreviation for the .NET type System.Int32\n\n\n\n\n An abbreviation for the .NET type System.Int16\n\n\n\n\n The type of 16-bit signed integer numbers, annotated with a unit of measure. The unit\n of measure is erased in compiled code and when values of this type\n are analyzed using reflection. The type is representationally equivalent to \n System.Int16.\n\n\n\n\n An abbreviation for the .NET type System.Int32\n\n\n\n\n An abbreviation for the .NET type System.Int64\n\n\n\n\n The type of 64-bit signed integer numbers, annotated with a unit of measure. The unit\n of measure is erased in compiled code and when values of this type\n are analyzed using reflection. The type is representationally equivalent to \n System.Int64.\n\n\n\n\n An abbreviation for the .NET type System.SByte\n\n\n\n\n The type of 8-bit signed integer numbers, annotated with a unit of measure. The unit\n of measure is erased in compiled code and when values of this type\n are analyzed using reflection. The type is representationally equivalent to \n System.SByte.\n\n\n\n\n The type of 32-bit signed integer numbers, annotated with a unit of measure. The unit\n of measure is erased in compiled code and when values of this type\n are analyzed using reflection. The type is representationally equivalent to \n System.Int32.\n\n\n\n\n An abbreviation for the .NET type System.IntPtr\n\n\n\n\n Represents an unmanaged pointer in F# code.\n\n This type should only be used when writing F# code that interoperates\n with native code. Use of this type in F# code may result in\n unverifiable code being generated. Conversions to and from the \n nativeint type may be required. Values of this type can be generated\n by the functions in the NativeInterop.NativePtr module.\n\n\n\n\n An abbreviation for the .NET type System.Object\n\n\n\n\n The type of optional values. When used from other .NET languages the\n empty option is the null value. \n\n Use the constructors Some and None to create values of this type.\n Use the values in the Option module to manipulate values of this type,\n or pattern match against the values directly.\n\n 'None' values will appear as the value null to other .NET languages.\n Instance methods on this type will appear as static methods to other .NET languages\n due to the use of null as a value representation.\n\n\n\n\n The type of mutable references. Use the functions [:=] and [!] to get and\n set values of this type.\n\n\n\n\n An abbreviation for the .NET type System.SByte\n\n\n\n\n An abbreviation for the .NET type System.Single\n\n\n\n\n An abbreviation for the .NET type System.String\n\n\n\n\n An abbreviation for the .NET type System.UInt16\n\n\n\n\n An abbreviation for the .NET type System.UInt32\n\n\n\n\n An abbreviation for the .NET type System.UInt64\n\n\n\n\n An abbreviation for the .NET type System.Byte\n\n\n\n\n An abbreviation for the .NET type System.UIntPtr\n\n\n\n\n The type 'unit', which has only one value \"()\". This value is special and\n always uses the representation 'null'.\n\n\n\n\n Dynamic invocations of functions marked with the NoDynamicInvocationAttribute attribute raise this exception\n\n\n\n\n This exception is raised by 'failwith'\n\n\n\n\n Non-exhaustive match failures will raise the MatchFailure exception\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Build an aysnchronous workflow using computation expression syntax\n\n\n\n\n Builds a lookup table from a sequence of key/value pairs. The key objects are indexed using generic hashing and equality.\n\n\n\n\n Print to stderr using the given format\n\n\n\n\n Print to stderr using the given format, and add a newline\n\n\n\n\n Print to a string buffer and raise an exception with the given\n result. Helper printers must return strings.\n\n\n\n\n Print to a file using the given format\n\n\n\n\n Print to a file using the given format, and add a newline\n\n\n\n\n Special prefix operator for splicing typed expressions into quotation holes\n\n\n\n\n Special prefix operator for splicing untyped expressions into quotation holes\n\n\n\n\n\n\n\n\n\n\n Print to stdout using the given format\n\n\n\n\n Print to stdout using the given format, and add a newline\n\n\n\n\n Builds a sequence using sequence expression syntax\n\n\n\n\n Builds a set from a sequence of objects. The key objects are indexed using generic comparison\n\n\n\n\n Print to a string using the given format\n\n\n\n\n An active pattern to force the execution of values of type Lazy<_>\n\n\n\n\nPervasives: Additional bindings available at the top level \n\n\n\n\n A compiler intrinsic that implements dynamic invocations to the '+' operator\n\n\n\n\n A compiler intrinsic that implements dynamic invocations to the checked '+' operator\n\n\n\n\n A compiler intrinsic that implements dynamic invocations to the checked '+' operator\n\n\n\n\n Generate a null value for reference types.\n\n\n\n\n Divide a floating point value by an integer\n\n\n\n\n A compiler intrinsic that implements dynamic invocations for the DivideByInt primitive\n\n\n\n\n Build an enum value from an underlying value\n\n\n\n\n Get the underlying value for an enum value\n\n\n\n\n A static F# comparer object\n\n\n\n\n Return an F# comparer object suitable for hashing and equality. This hashing behaviour\n of the returned comparer is not limited by an overall node count when hashing F#\n records, lists and union types.\n\n\n\n\n Make an F# comparer object for the given type\n\n\n\n\n Make an F# hash/equality object for the given type\n\n\n\n\n Make an F# hash/equality object for the given type using node-limited hashing when hashing F#\n records, lists and union types.\n\n\n\n\n Compare two values \n\n\n\n\n Compare two values. May be called as a recursive case from an implementation of System.IComparable to\n ensure consistent NaN comparison semantics.\n\n\n\n\n Compare two values for equality\n\n\n\n\n Compare two values for equality\n\n\n\n\n Compare two values \n\n\n\n\n Compare two values \n\n\n\n\n Hash a value according to its structure. This hash is not limited by an overall node count when hashing F#\n records, lists and union types.\n\n\n\n\n Recursively hash a part of a value according to its structure. \n\n\n\n\n Compare two values \n\n\n\n\n Compare two values \n\n\n\n\n Hash a value according to its structure. Use the given limit to restrict the hash when hashing F#\n records, lists and union types.\n\n\n\n\n Take the maximum of two values structurally according to the order given by GenericComparison\n\n\n\n\n Take the minimum of two values structurally according to the order given by GenericComparison\n\n\n\n\n Resolves to the one value for any primitive numeric type or any type with a static member called 'One'\n\n\n\n\n Resolves to the zero value for any primitive numeric type or any type with a static member called 'Zero'\n\n\n\n\n Resolves to the zero value for any primitive numeric type or any type with a static member called 'Zero'\n\n\n\n\n Resolves to the zero value for any primitive numeric type or any type with a static member called 'Zero'\n\n\n\n\n A compiler intrinsic that implements dynamic invocations to the '+' operator\n\n\n\n\n Parse an int32 according to the rules used by the overloaded 'int32' conversion operator when applied to strings\n\n\n\n\n Parse an int64 according to the rules used by the overloaded 'int64' conversion operator when applied to strings\n\n\n\n\n Parse an uint32 according to the rules used by the overloaded 'uint32' conversion operator when applied to strings\n\n\n\n\n Parse an uint64 according to the rules used by the overloaded 'uint64' conversion operator when applied to strings\n\n\n\n\n Reference/physical equality. \n True if boxed versions of the inputs are reference-equal, OR if\n both are primitive numeric types and the implementation of Object.Equals for the type\n of the first argument returns true on the boxed versions of the inputs. \n\n\n\n\n The physical hash. Hashes on the object identity, except for value types,\n where we hash on the contents.\n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n A primitive entry point used by the F# compiler for optimization purposes. \n\n\n\n\n The F# compiler emits calls to some of the functions in this module as part of the compiled form of some language constructs\n\n\n\n\n This function implements calls to default constructors\n acccessed by 'new' constraints.\n\n\n\n\n A compiler intrinsic for the efficeint compilation of sequence expressions\n\n\n\n\n The standard overloaded associative (indexed) lookup operator\n\n\n\n\n The standard overloaded associative (2-indexed) lookup operator\n\n\n\n\n The standard overloaded associative (3-indexed) lookup operator\n\n\n\n\n The standard overloaded associative (4-indexed) lookup operator\n\n\n\n\n Primitive used by pattern match compilation \n\n\n\n\n This function implements parsing of decimal constants\n\n\n\n\n The standard overloaded associative (indexed) mutation operator\n\n\n\n\n The standard overloaded associative (2-indexed) mutation operator\n\n\n\n\n The standard overloaded associative (3-indexed) mutation operator\n\n\n\n\n The standard overloaded associative (4-indexed) mutation operator\n\n\n\n\n A compiler intrinsic that implements the ':?' operator\n\n\n\n\n A compiler intrinsic that implements the ':?' operator\n\n\n\n\n A compiler intrinsic that implements the ':?>' operator\n\n\n\n\n A compiler intrinsic that implements the ':?>' operator\n\n\n\n\n The F# compiler emits calls to some of the functions in this module as part of the compiled form of some language constructs\n\n\n\n\n Address-of. Uses of this value may result in the generation of unverifiable code.\n\n\n\n\n Binary 'and'. When used as a binary operator the right hand value is evaluated only on demand\n\n\n\n\n Binary 'and'. When used as a binary operator the right hand value is evaluated only on demand\n\n\n\n\n Binary 'or'. When used as a binary operator the right hand value is evaluated only on demand\n\n\n\n\n Address-of. Uses of this value may result in the generation of unverifiable code.\n\n\n\n\n Binary 'or'. When used as a binary operator the right hand value is evaluated only on demand\n\n\n\n\n The F# compiler emits calls to some of the functions in this module as part of the compiled form of some language constructs\n\n\n\n\n Language primitives associated with the F# language\n\n\n\n\n Provides a default implementations of F# numeric literal syntax for literals fo the form 'dddI' \n\n\n\n\n Provides a default implementations of F# numeric literal syntax for literals fo the form 'dddI' \n\n\n\n\n Provides a default implementations of F# numeric literal syntax for literals fo the form 'dddI' \n\n\n\n\n Provides a default implementations of F# numeric literal syntax for literals fo the form 'dddI' \n\n\n\n\n Provides a default implementations of F# numeric literal syntax for literals fo the form 'dddI' \n\n\n\n\n Provides a default implementations of F# numeric literal syntax for literals fo the form 'dddI' \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Provide a default implementation of the F# numeric literal syntax 'dddN' \n\n\n\n\n Provides a default implementations of F# numeric literal syntax for literals fo the form 'dddI' \n\n\n\n\n\n\n\n\n\n\n Absolute value of the given number\n\n\n\n\n Inverse cosine of the given number\n\n\n\n\n Inverse sine of the given number\n\n\n\n\n Inverse tangent of the given number\n\n\n\n\n Inverse tangent of x/y where x and y are specified separately\n\n\n\n\n Boxes a strongly typed value.\n\n\n\n\n Converts the argument to byte. This is a direct conversion for all \n primitive numeric types. For strings, the input is converted using Byte.Parse() on strings and otherwise requires a ToByte method on the input type\n\n\n\n\n Ceiling of the given number\n\n\n\n\n Converts the argument to character. Numeric inputs are converted according to the UTF-16 \n encoding for characters. String inputs must be exactly one character long.\n For other types a static member ToChar must exist on the type.\n\n\n\n\n Generic comparison\n\n\n\n\n Cosine of the given number\n\n\n\n\n Hyperbolic cosine of the given number\n\n\n\n\n Converts the argument to System.Decimal using a direct conversion for all \n primitive numeric types and requiring a ToDecimal method otherwise\n\n\n\n\n Decrement a mutable reference cell containing an integer\n\n\n\n\n Used to specify a default value for an optional argument in the implementation of a function\n\n\n\n\n Converts the argument to 64-bit float. This is a direct conversion for all \n primitive numeric types. For strings, the input is converted using Double.Parse() with InvariantCulture settings. Otherwise the operation requires and invokes a ToDouble method on the input type\n\n\n\n\n Converts the argument to a particular enum type.\n\n\n\n\n Exit the current hardware isolated process, if security settings permit,\n otherwise raise an exception. Calls System.Environment.Exit.\n\n\n\n\n Exponential of the given number\n\n\n\n\n Throw a FailureException exception\n\n\n\n\n Converts the argument to 64-bit float. This is a direct conversion for all \n primitive numeric types. For strings, the input is converted using Double.Parse() with InvariantCulture settings. Otherwise the operation requires and invokes a ToDouble method on the input type\n\n\n\n\n Converts the argument to 32-bit float. This is a direct conversion for all \n primitive numeric types. For strings, the input is converted using Single.Parse() with InvariantCulture settings. Otherwise the operation requires and invokes a ToSingle method on the input type\n\n\n\n\n Floor of the given number\n\n\n\n\n Return the first element of a tuple, fst (a,b) = a.\n\n\n\n\n A generic hash function, designed to return equal hash values for items that are \n equal according to the \"=\" operator. By default it will use structural hashing\n for F# union, record and tuple types, hashing the complete contents of the \n type. The exact behaviour of the function can be adjusted on a \n type-by-type basis by implementing GetHashCode for each type.\n\n\n\n\n The identity function\n\n\n\n\n Ignore the passed value. This is often used to throw away results of a computation.\n\n\n\n\n Increment a mutable reference cell containing an integer\n\n\n\n\n Equivalent to System.Double.PositiveInfinity\n\n\n\n\n Equivalent to System.Single.PositiveInfinity\n\n\n\n\n Converts the argument to signed 32-bit integer. This is a direct conversion for all \n primitive numeric types. For strings, the input is converted using Int32.Parse() with InvariantCulture settings. Otherwise the operation requires and invokes a ToInt32 method on the input type\n\n\n\n\n Converts the argument to signed 16-bit integer. This is a direct conversion for all \n primitive numeric types. For strings, the input is converted using Int16.Parse() with InvariantCulture settings. Otherwise the operation requires and invokes a ToInt16 method on the input type\n\n\n\n\n Converts the argument to signed 32-bit integer. This is a direct conversion for all \n primitive numeric types. For strings, the input is converted using Int32.Parse() with InvariantCulture settings. Otherwise the operation requires and invokes a ToInt32 method on the input type\n\n\n\n\n Converts the argument to signed 64-bit integer. This is a direct conversion for all \n primitive numeric types. For strings, the input is converted using Int64.Parse() with InvariantCulture settings. Otherwise the operation requires and invokes a ToInt64 method on the input type\n\n\n\n\n Throw an ArgumentException exception\n\n\n\n\n Throw an InvalidOperationException exception\n\n\n\n\n\n\n\n\n\n\n A generic hash function. This function has the same behaviour as 'hash', \n however the default structural hashing for F# union, record and tuple \n types stops when the given limit of nodes is reached. The exact behaviour of \n the function can be adjusted on a type-by-type basis by implementing \n GetHashCode for each type.\n\n\n\n\n Execute the function as a mutual-exlcusion region using the input value as a lock. \n\n\n\n\n Natural logarithm of the given number\n\n\n\n\n Logarithm to base 10 of the given number\n\n\n\n\n Maximum based on generic comparison\n\n\n\n\n Minimum based on generic comparison\n\n\n\n\n Equivalent to System.Double.NaN\n\n\n\n\n Equivalent to System.Single.NaN\n\n\n\n\n Converts the argument to signed native integer. This is a direct conversion for all \n primitive numeric types and ToIntPtr method otherwise)\n\n\n\n\n Negate a logical value. not true equals false and not false equals true\n\n\n\n\n Throw an KeyNotFoundException exception\n\n\n\n\n Throw an ArgumentNullException exception\n\n\n\n\n Overloaded addition operator\n\n\n\n\n Concatenate two lists.\n\n\n\n\n Apply a function to three values, the values being a triple on the left, the function on the right\n\n\n\n\n Apply a function to two values, the values being a pair on the left, the function on the right\n\n\n\n\n Overloaded logical-AND operator\n\n\n\n\n Overloaded logical-OR operator\n\n\n\n\n Assign to a mutable reference cell\n\n\n\n\n Compose two functions, the function on the right being applied first\n\n\n\n\n Compose two functions, the function on the left being applied first\n\n\n\n\n Concatenate two strings. The overlaoded operator '+' may also be used.\n\n\n\n\n Dereference a mutable reference cell\n\n\n\n\n Overloaded division operator\n\n\n\n\nStructural equality\n\n\n\n\n Overloaded logical-XOR operator\n\n\n\n\n Overloaded power operator.\n\n\n\n\n Structural greater-than\n\n\n\n\nStructural greater-than-or-equal\n\n\n\n\n Overloaded byte-shift left operator by a specified number of bits\n\n\n\n\n Apply a function to two values, the values being a pair on the right, the function on the left\n\n\n\n\n Apply a function to three values, the values being a triple on the right, the function on the left\n\n\n\n\nStructural inequality\n\n\n\n\n Structural less-than comparison\n\n\n\n\nStructural less-than-or-equal comparison\n\n\n\n\n Overloaded logical-NOT operator\n\n\n\n\n Overloaded modulo operator\n\n\n\n\n Overloaded multiplication operator\n\n\n\n\n Apply a function to a value, the value being on the right, the function on the left\n\n\n\n\n Apply a function to a value, the value being on the left, the function on the right\n\n\n\n\n The standard overloaded range operator, e.g. [n..m] for lists, seq {n..m} for sequences\n\n\n\n\n The standard overloaded skip range operator, e.g. [n..skip..m] for lists, seq {n..skip..m} for sequences\n\n\n\n\n Overloaded byte-shift right operator by a specified number of bits\n\n\n\n\n Overloaded subtraction operator\n\n\n\n\n Overloaded unary negation.\n\n\n\n\n Overloaded prefix=plus operator\n\n\n\n\n Overloaded power operator. If n > 0 then equivalent to x*...*x for n occurrences of x. \n\n\n\n\n Raises an exception\n\n\n\n\n Create a mutable reference cell\n\n\n\n\n Rethrows an exception. This should only be used when handling an exception\n\n\n\n\n Round the given number\n\n\n\n\n Converts the argument to signed byte. This is a direct conversion for all \n primitive numeric types. For strings, the input is converted using SByte.Parse() with InvariantCulture settings. Otherwise the operation requires and invokes a ToSByte method on the input type\n\n\n\n\n Sign of the given number\n\n\n\n\n Sine of the given number\n\n\n\n\n Converts the argument to 32-bit float. This is a direct conversion for all \n primitive numeric types. For strings, the input is converted using Single.Parse() with InvariantCulture settings. Otherwise the operation requires and invokes a ToSingle method on the input type\n\n\n\n\n Hyperbolic sine of the given number\n\n\n\n\n Returns the internal size of a type in bytes. For example, sizeof<int> returns 4.\n\n\n\n\n Return the second element of a tuple, snd (a,b) = b.\n\n\n\n\n Square root of the given number\n\n\n\n\n Reads the value of the property System.Console.Error. \n\n\n\n\n Reads the value of the property System.Console.In. \n\n\n\n\n Reads the value of the property System.Console.Out.\n\n\n\n\n Converts the argument to a string using ToString.\n For standard integer and floating point values the ToString conversion uses CultureInfo.InvariantCulture.\n Note, native integer ToString does not support specifying CultureInfo.\n\n\n\n\n Tangent of the given number\n\n\n\n\n Hyperbolic tangent of the given number\n\n\n\n\n Overloaded truncate operator.\n\n\n\n\n Generate a System.Type representation for a type definition. If the\n input type is a generic type instantiation then return the \n generic type definition associated with all such instantiations.\n\n\n\n\n Generate a System.Type runtime represenation of a static type.\n The static type is still maintained on the value returned.\n\n\n\n\n Converts the argument to unsigned 16-bit integer. This is a direct conversion for all \n primitive numeric types. For strings, the input is converted using UInt16.Parse() with InvariantCulture settings. Otherwise the operation requires and invokes a ToUInt16 method on the input type\n\n\n\n\n Converts the argument to unsigned 32-bit integer. This is a direct conversion for all \n primitive numeric types. For strings, the input is converted using UInt32.Parse() with InvariantCulture settings. Otherwise the operation requires and invokes a ToUInt32 method on the input type\n\n\n\n\n Converts the argument to unsigned 64-bit integer. This is a direct conversion for all \n primitive numeric types. For strings, the input is converted using UInt64.Parse() with InvariantCulture settings. Otherwise the operation requires and invokes a ToUInt64 method on the input type\n\n\n\n\n Converts the argument to unsigned native integer using a direct conversion for all \n primitive numeric types and requiring a ToUintPtr method otherwise\n\n\n\n\n Unboxes a strongly typed value. This is the inverse of box, unbox<t>(box<t> a) equals a.\n\n\n\n\n Clean up resources associated with the input object after the completion of the given function.\n Cleanup occurs even when an exception is raised by the protected\n code. \n\n\n\n\n\n\n\n An active pattern to match values of type System.Collections.Generic.KeyValuePair\n\n\n\n\n Converts the argument to byte. This is a direct conversion for all \n primitive numeric types and ToByte method otherwise)\n\n\n\n\n Converts the argument to unicode character based on UTF16 encoding (a direct conversion for all \n primitive numeric types and ToUIntPtr method otherwise)\n\n\n\n\n Converts the argument to signed 32-bit integer. This is a direct conversion for all \n primitive numeric types and ToInt32 method otherwise)\n\n\n\n\n Converts the argument to signed 16-bit integer. This is a direct conversion for all \n primitive numeric types and ToInt16 method otherwise)\n\n\n\n\n Converts the argument to signed 32-bit integer. This is a direct conversion for all \n primitive numeric types and ToInt32 method otherwise)\n\n\n\n\n Converts the argument to signed 64-bit integer. This is a direct conversion for all \n primitive numeric types and ToInt64 method otherwise)\n\n\n\n\n Converts the argument to signed native integer. This is a direct conversion for all \n primitive numeric types and ToIntPtr method otherwise)\n\n\n\n\n Overloaded addition operator (checks for overflow)\n\n\n\n\n Overloaded multiplication operator (checks for overflow)\n\n\n\n\n Overloaded subtraction operator (checks for overflow)\n\n\n\n\n Overloaded unary negation (checks for overflow)\n\n\n\n\n Converts the argument to signed byte. This is a direct conversion for all \n primitive numeric types and ToSByte method otherwise)\n\n\n\n\n Converts the argument to unsigned 16-bit integer. This is a direct conversion for all \n primitive numeric types and ToUInt16 method otherwise)\n\n\n\n\n Converts the argument to unsigned 32-bit integer. This is a direct conversion for all \n primitive numeric types and ToUInt32 method otherwise)\n\n\n\n\n Converts the argument to unsigned 64-bit integer. This is a direct conversion for all \n primitive numeric types and ToUInt64 method otherwise)\n\n\n\n\n Converts the argument to unsigned native integer. This is a direct conversion for all \n primitive numeric types and ToUIntPtr method otherwise)\n\n\n\n\n This module contains the basic arithmetic operations with overflow checks.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Get a slice of an array\n\n\n\n\n Get a slice of an array\n\n\n\n\n Get a slice of an array\n\n\n\n\n Get a slice of an array\n\n\n\n\n Get a slice from a string\n\n\n\n\n\n\n\n\n\n\n This is a library intrinsic. Calls to this function may be generated by uses of the generic 'pown' operator on values of type 'byte'\n\n\n\n\n This is a library intrinsic. Calls to this function may be generated by uses of the generic 'pown' operator on values of type 'decimal'\n\n\n\n\n This is a library intrinsic. Calls to this function may be generated by uses of the generic 'pown' operator on values of type 'float'\n\n\n\n\n\n\n\n This is a library intrinsic. Calls to this function may be generated by uses of the generic 'pown' operator \n\n\n\n\n This is a library intrinsic. Calls to this function may be generated by uses of the generic 'pown' operator on values of type 'int16'\n\n\n\n\n This is a library intrinsic. Calls to this function may be generated by uses of the generic 'pown' operator on values of type 'int32'\n\n\n\n\n This is a library intrinsic. Calls to this function may be generated by uses of the generic 'pown' operator on values of type 'int64'\n\n\n\n\n This is a library intrinsic. Calls to this function may be generated by uses of the generic 'pown' operator on values of type 'nativeint'\n\n\n\n\n This is a library intrinsic. Calls to this function may be generated by uses of the generic 'pown' operator on values of type 'sbyte'\n\n\n\n\n This is a library intrinsic. Calls to this function may be generated by uses of the generic 'pown' operator on values of type 'float32'\n\n\n\n\n This is a library intrinsic. Calls to this function may be generated by uses of the generic 'pown' operator on values of type 'uint16'\n\n\n\n\n This is a library intrinsic. Calls to this function may be generated by uses of the generic 'pown' operator on values of type 'uint32'\n\n\n\n\n This is a library intrinsic. Calls to this function may be generated by uses of the generic 'pown' operator on values of type 'uint64'\n\n\n\n\n This is a library intrinsic. Calls to this function may be generated by uses of the generic 'pown' operator on values of type 'unativeint'\n\n\n\n\n Generate a range of byte values\n\n\n\n\n Generate a range of char values\n\n\n\n\n Generate a range of float values\n\n\n\n\n Generate a range of values using the given zero, add, start, step and stop values\n\n\n\n\n Generate a range of int16 values\n\n\n\n\n Generate a range of integers \n\n\n\n\n Generate a range of int64 values\n\n\n\n\n Generate a range of nativeint values\n\n\n\n\n Generate a range of sbyte values\n\n\n\n\n Generate a range of float32 values\n\n\n\n\n Generate a range of values using the given zero, add, start, step and stop values\n\n\n\n\n Generate a range of uint16 values\n\n\n\n\n Generate a range of uint32 values\n\n\n\n\n Generate a range of uint64 values\n\n\n\n\n Generate a range of unativeint values\n\n\n\n\n\n\n\n Set a slice of an array\n\n\n\n\n Set a slice of an array\n\n\n\n\n Set a slice of an array\n\n\n\n\n Set a slice of an array\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n A module of compiler intrinsic functions for efficient implementations of F# integer ranges\n and dynamic invocations of other F# operators\n\n\n\n\n Generate a defult value for any type. This is null for reference types, \n For structs, this is struct value where all fields have the default value. \n This function is unsafe in the sense that some F# values do not have proper null values.\n\n\n\n\n This module contains basic operations which do not apply runtime and/or static checks\n\n\n\n\n Basic F# Operators. This module is automatically opened in all F# code.\n\n\n\n\n Invoke the optimized function value with two curried arguments \n\n\n\n\n Adapt an F# first class function value to be an optimized function value that can \n accept two curried arguments without intervening execution. \n\n\n\n\n Construct an optimized function value that can accept two curried \n arguments without intervening execution.\n\n\n\n\n The .NET type used to represent F# function values that accept\n two iterated (curried) arguments without intervening execution. This type should not\n typically used directly from either F# code or from other .NET languages.\n\n\n\n\n Invoke an F# first class function value that accepts three curried arguments \n without intervening execution\n\n\n\n\n Adapt an F# first class function value to be an optimized function value that can \n accept three curried arguments without intervening execution. \n\n\n\n\n Construct an optimized function value that can accept three curried \n arguments without intervening execution.\n\n\n\n\n The .NET type used to represent F# function values that accept\n three iterated (curried) arguments without intervening execution. This type should not\n typically used directly from either F# code or from other .NET languages.\n\n\n\n\n Invoke an F# first class function value that accepts four curried arguments \n without intervening execution\n\n\n\n\n Adapt an F# first class function value to be an optimized function value that can \n accept four curried arguments without intervening execution. \n\n\n\n\n Construct an optimized function value that can accept four curried \n arguments without intervening execution.\n\n\n\n\n The .NET type used to represent F# function values that accept\n four iterated (curried) arguments without intervening execution. This type should not\n typically used directly from either F# code or from other .NET languages.\n\n\n\n\n Invoke an F# first class function value that accepts five curried arguments \n without intervening execution\n\n\n\n\n Adapt an F# first class function value to be an optimized function value that can \n accept five curried arguments without intervening execution. \n\n\n\n\n Construct an optimized function value that can accept five curried \n arguments without intervening execution.\n\n\n\n\n The .NET type used to represent F# function values that accept\n five iterated (curried) arguments without intervening execution. This type should not\n typically used directly from either F# code or from other .NET languages.\n\n\n\n\n An implementation module used to hold some private implementations of function\n value invocation.\n\n\n\n bind f inp evaluates to match inp with None -> None | Some x -> f x\n\n\n length inp evaluates to match inp with None -> 0 | Some _ -> 1\n\n\n exists p inp evaluates to match inp with None -> false | Some x -> p x\n\n\n filter p inp evaluates to match inp with None -> None | Some x -> if p x then inp else None\n\n\n fold_left f s inp evaluates to match inp with None -> s | Some x -> f s x\n\n\n fold_right f inp s evaluates to \"match inp with None -> s | Some x -> f x s\"\n\n\n\n\n\n\n\n\n\n\n\n forall p inp\" evaluates to \"match inp with None -> true | Some x -> p x\n\n\n\n Gets the value associated with the option. If the option is None then\n raises ArgumentException\n\n\n\n\n Returns true if the option is None\n\n\n\n\n Returns true if the option is not None\n\n\n\n\n\n\n\n\n\n iter f inp executes match inp with None -> () | Some x -> f x\n\n\n filter p inp evaluates to match inp with None -> None | Some x -> if p x then inp else None\n\n\n map f inp evaluates to match inp with None -> None | Some x -> Some (f x)\n\n\n partition p inp evaluates to \n match inp with None -> None,None | Some x -> if p x then inp,None else None,inp\n\n\n\n Convert the option to an array of length 0 or 1\n\n\n\n\n Convert the option to a list of length 0 or 1\n\n\n\n\n Basic operations on options. \n\n\n\n\n Build a new string whose characters are the results of applying the function mapping\n to each of the characters of the input string and concatenating the resulting\n strings.\n\n\n\n\n Return a new string made by concatenating the given strings\n with separator 'sep', i.e. 'a1 + sep + ... + sep + aN'\n\n\n\n\n Test if any character of the string satisfies the given predicate.\n\n\n\n\n\n\n\n Test if all characters in the string satisfy the given predicate.\n\n\n\n\n Build a new string whose characters are the results of applying the function mapping\n to each index from 0 to count-1 and concatenating the resulting\n strings.\n\n\n\n\n Apply the function action to each character in the string.\n\n\n\n\n Apply the function action to the index of each character in the string and the character itself.\n\n\n\n\n Return the length of the string.\n\n\n\n\n Build a new string whose characters are the results of applying the function mapping\n to each of the characters of the input string.\n\n\n\n\n\n\n\n Build a new string whose characters are the results of applying the function mapping\n to each character in the string and the character itself.\n\n\n\n\n Return a string by concatenating count instances of str.\n\n\n\n\n Functional programming operators for string processing. Further string operations\n are available via the member functions on strings and other functionality in\n System.String \n and System.Text.RegularExpressions types.\n\n\n\n\n Return the given big integer\n\n\n\n\n Return the negation of a big integer\n\n\n\n\n Return the difference of big integers\n\n\n\n\n Generate a range of big integers, with a step\n\n\n\n\n Generate a range of big integers\n\n\n\n\n Return the product of big integers\n\n\n\n\n Return the modulus of big integers\n\n\n\n\n This operator is for use from other .NET languages\n\n\n\n\n This operator is for use from other .NET languages\n\n\n\n\n This operator is for use from other .NET languages\n\n\n\n\n This operator is for use from other .NET languages\n\n\n\n\n This operator is for use from other .NET languages\n\n\n\n\n This operator is for use from other .NET languages\n\n\n\n\n Return the ratio of big integers\n\n\n\n\n Return the sum of two big integers\n\n\n\n\n Get the big integer for zero\n\n\n\n\n Return the sign of a big integer: 0, +1 or -1\n\n\n\n\n Get the big integer for one\n\n\n\n\n Return true if a big integer is 'zero'\n\n\n\n\n Return true if a big integer is 'one'\n\n\n\n\n\n\n\n Convert a big integer to a 64-bit signed integer\n\n\n\n\n Convert a big integer to a 32-bit signed integer\n\n\n\n\n Convert a big integer to a floating point number\n\n\n\n\n Return n^m for two big integers\n\n\n\n\n Parse a big integer from a string format\n\n\n\n\n\n\n\n Return the greatest common divisor of two big integers\n\n\n\n\n Compute the factorial function as a big integer\n\n\n\n\n\n\n\n Compute the ratio and remainder of two big integers\n\n\n\n\n Compute the absolute value of a big integer \n\n\n\n\n Construct a BigInt value for the given integer\n\n\n\n\n Construct a BigInt value for the given 64-bit integer\n\n\n\n\n The type of arbitrary-sized integers\n\n\n\n\n Abstract internal type\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Return a typed native pointer by adding index * sizeof<'T> to the \n given input pointer \n\n\n\n\n Dereference the typed native pointer computed by adding index * sizeof<'T> to the \n given input pointer \n\n\n\n\n Get the address of an element of a pinned array\n\n\n\n\n Get the address of an element of a pinned 2-dimensional array\n\n\n\n\n Return a typed native pointer for a given machine address\n\n\n\n\n Dereference the given typed native pointer \n\n\n\n\n Assign the value into the memory location referenced by the typed native \n pointer computed by adding index * sizeof<'T> to the given input pointer \n\n\n\n\n Return a machine address for a given typed native pointer \n\n\n\n\n Assign the value into the memory location referenced by the given typed native pointer \n\n\n\n\n Contains operations on native pointers. Use of these operators may\n result in the generation of unverifiable code.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Returns type of an expression\n\n\n\n\n Returns the custom attributes of an expression\n\n\n\n\n Build an expression that represents a while loop\n\n\n\n\n Build an expression that represents setting a mutable variable\n\n\n\n\n Build an expression that represents a variable\n\n\n\n\n Build an expression that represents a constant value of a particular type\n\n\n\n\n Build an expression that represents a constant value \n\n\n\n\n Build an expression that represents a test of a value is of a particular union case\n\n\n\n\n Build an expression that represents a type test\n\n\n\n\n Build an expression that represents getting a field of a tuple\n\n\n\n\n Build an expression that represents a try/with construct for exception filtering and catching \n\n\n\n\n Try and find a stored reflection definition for the given method. Stored reflection\n definitions are added to an F# assembly through the use of the [<ReflectedDefinition>] attribute.\n\n\n\n\n Build an expression that represents a try/finally construct \n\n\n\n\n Substitute through the given expression using the given functions\n to map variables to new values. The functions must give consistent results\n at each application. Variable renaming may occur on the target expression\n if variable capture occurs.\n\n\n\n\n Build an expression that represents the sequential execution of one expression followed by another\n\n\n\n\n Permit interactive environments such as F# Interactive\n to explicitly register new pickled resources that represent persisted \n top level definitions. The string indicates a unique name for the resources\n being added. The format for the bytes is the encoding generated by the F# compiler.\n\n\n\n\n Build an expression that represents a nested quotation literal\n\n\n\n\n Build an expression that represents writing to a property of an object\n\n\n\n\n Build an expression that represents writing to a static property \n\n\n\n\n Build an expression that represents reading a property of an object\n\n\n\n\n Build an expression that represents reading a static property \n\n\n\n\n Build an expression that represents the creation of a union case value\n\n\n\n\n Build an expression that represents the creation of an F# tuple value\n\n\n\n\n Build record-construction expressions \n\n\n\n\n Build an expression that represents the invocation of an object constructor\n\n\n\n\n Build an expression that represents the creation of a delegate value for the given type\n\n\n\n\n Build an expression that represents the creation of an array value initialized with the given elements\n\n\n\n\n Build recursives expressions associated with 'let rec' constructs\n\n\n\n\n Build expressions associated with 'let' constructs\n\n\n\n\n Build an expression that represents the constrution of an F# function value\n\n\n\n\n Build 'if ... then ... else' expressions \n\n\n\n\n Fetch or create a new variable with the given name and type from a global pool of shared variables\n indexed by name and type. The type is given by the expicit or inferred type parameter\n\n\n\n\n Get the free expression variables of an expression as a list\n\n\n\n\n Build a 'for i = ... to ... do ...' expression that represent loops over integer ranges\n\n\n\n\n Build an expression that represents writing to a static field \n\n\n\n\n Build an expression that represents writing to a field of an object\n\n\n\n\n Build an expression that represents the access of a static field \n\n\n\n\n Build an expression that represents the access of a field of an object\n\n\n\n\n\n\n\n This function is called automatically when quotation syntax (<@ @>) and related typed-expression\n quotations are used. The bytes are a pickled binary representation of an unlinked form of the qutoed expression,\n and the System.Type argument is any type in the assembly where the quoted\n expression occurs, i.e. it helps scope the interpretation of the cross-assembly\n references in the bytes.\n\n\n\n\n Build an expression that represents the invocation of a default object constructor\n\n\n\n\n Build an expression that represents the coercion of an expression to a type\n\n\n\n\n Return a new typed expression given an underlying runtime-typed expression.\n A type annotation is usually required to use this function, and \n using an incorrect type annotation may result in a later runtime exception.\n\n\n\n\n Build an expression that represents a call to an static method or module-bound function\n\n\n\n\n Build an expression that represents a call to an instance method associated with an object\n\n\n\n\n Build an expression that represents the application of a first class function value to multiple arguments\n\n\n\n\n Build an expression that represents the application of a first class function value to a single argument\n\n\n\n\n Build an expression that represents setting the value held at a particular address\n\n\n\n\n Build an expression that represents getting the address of a value\n\n\n\n\n Quoted expressions annotated with System.Type values. \n\n\n\n\n Get the raw expression associated with this type-carrying expression\n\n\n\n\n Type-carrying quoted expressions. Expressions are generated either\n by quotations in source text or programatically\n\n\n\n\n The type associated with the variable\n\n\n\n\n The declared name of the variable\n\n\n\n\n Indicates if the variable represents a mutable storage location\n\n\n\n\n Fetch or create a new variable with the given name and type from a global pool of shared variables\n indexed by name and type\n\n\n\n\n Create a new variable with the given name, type and mutability\n\n\n\n\n Information at the binding site of a variable\n\n\n\n\n An active pattern to recognize expressions of the form a && b \n\n\n\n\n An active pattern to recognize expressions that represent the application of a (possibly curried or tupled) first class function value\n\n\n\n\n An active pattern to recognize constant boolean expressions\n\n\n\n\n An active pattern to recognize constant byte expressions\n\n\n\n\n An active pattern to recognize constant unicode character expressions\n\n\n\n\n An active pattern to recognize constant 64-bit floating point number expressions\n\n\n\n\n An active pattern to recognize constant int16 expressions\n\n\n\n\n An active pattern to recognize constant int32 expressions\n\n\n\n\n An active pattern to recognize constant int64 expressions\n\n\n\n\n An active pattern to recognize expressions that represent a (possibly curried or tupled) first class function value\n\n\n\n\n An active pattern to recognize methods that have an associated ReflectedDefinition\n\n\n\n\n An active pattern to recognize expressions of the form a || b \n\n\n\n\n An active pattern to recognize property getters or values in modules that have an associated ReflectedDefinition\n\n\n\n\n An active pattern to recognize property setters that have an associated ReflectedDefinition\n\n\n\n\n An active pattern to recognize constant signed byte expressions\n\n\n\n\n An active pattern to recognize constant 32-bit floating point number expressions\n\n\n\n\n A parameterized active pattern to recognize calls to a specified function or method\n\n\n\n\n An active pattern to recognize constant string expressions\n\n\n\n\n An active pattern to recognize constant unsigned int16 expressions\n\n\n\n\n An active pattern to recognize constant unsigned int32 expressions\n\n\n\n\n An active pattern to recognize constant unsigned int64 expressions\n\n\n\n\n An active pattern to recognize () constant expressions\n\n\n\n\n Contains a set of derived F# active patterns to analyze F# expression objects\n\n\n\n\n Re-build combination expressions. The first parameter should be an object\n returned by the ShapeCombination case of the active pattern in this module.\n\n\n\n\n An active pattern that performs a complete decomposition viewing the expression tree as a binding structure\n\n\n\n\n Active patterns for traversing, visiting, rebuilding and tranforming expressions in a generic way\n\n\n\n\n An active pattern to recognize expressions that represent getting the address of a value\n\n\n\n\n An active pattern to recognize expressions that represent setting the value held at an address \n\n\n\n\n An active pattern to recognize expressions that represent applications of first class function values\n\n\n\n\n An active pattern to recognize expressions that represent calls to static and instance methods, and functions defined in modules\n\n\n\n\n An active pattern to recognize expressions that represent coercions from one type to another\n\n\n\n\n An active pattern to recognize expressions that represent invocations of a default constructor of a struct\n\n\n\n\n An active pattern to recognize expressions that represent getting a static or instance field \n\n\n\n\n An active pattern to recognize expressions that represent setting a static or instance field \n\n\n\n\n An active pattern to recognize expressions that represent loops over integer ranges\n\n\n\n\n An active pattern to recognize expressions that represent conditionals\n\n\n\n\n An active pattern to recognize expressions that represent first class function values\n\n\n\n\n An active pattern to recognize expressions that represent recursive let bindings of one or more variables\n\n\n\n\n An active pattern to recognize expressions that represent let bindings\n\n\n\n\n An active pattern to recognize expressions that represent the construction of arrays \n\n\n\n\n An active pattern to recognize expressions that represent construction of delegate values\n\n\n\n\n An active pattern to recognize expressions that represent invocation of object constructors\n\n\n\n\n An active pattern to recognize expressions that represent construction of record values\n\n\n\n\n An active pattern to recognize expressions that represent construction of tuple values\n\n\n\n\n An active pattern to recognize expressions that represent construction of particular union case values\n\n\n\n\n An active pattern to recognize expressions that represent the read of a static or instance property, or a non-function value declared in a module\n\n\n\n\n An active pattern to recognize expressions that represent setting a static or instance property, or a non-function value declared in a module\n\n\n\n\n An active pattern to recognize expressions that represent a nested quotation literal\n\n\n\n\n An active pattern to recognize expressions that represent sequential exeuction of one expression followed by another\n\n\n\n\n An active pattern to recognize expressions that represent a try/finally construct \n\n\n\n\n An active pattern to recognize expressions that represent a try/with construct for exception filtering and catching \n\n\n\n\n An active pattern to recognize expressions that represent getting a tuple field\n\n\n\n\n An active pattern to recognize expressions that represent a dynamic type test\n\n\n\n\n An active pattern to recognize expressions that represent a test if a value is of a particular union case\n\n\n\n\n An active pattern to recognize expressions that represent a constant value\n\n\n\n\n An active pattern to recognize expressions that represent setting a mutable variable\n\n\n\n\n An active pattern to recognize expressions that represent a variable\n\n\n\n\n An active pattern to recognize expressions that represent while loops \n\n\n\n\n Contains a set of primitive F# active patterns to analyze F# expression objects\n\n\n\n\n Return a System.Type representing an F# tuple type with the given element types\n\n\n\n\n Return a System.Type representing the F# function type with the given domain and range\n\n\n\n\n Return true if the typ is a representation of an F# union type or the runtime type of a value of that type\n\n\n\n\n Return true if the typ is a representation of an F# tuple type \n\n\n\n\n Return true if the typ is a representation of an F# record type \n\n\n\n\n Return true if the typ is a System.Type value corresponding to the compiled form of an F# module \n\n\n\n\n Return true if the typ is a representation of an F# function type or the runtime type of a closure implementing an F# function type\n\n\n\n\n Return true if the typ is a representation of an F# exception declaration\n\n\n\n\n Get the cases of a union type.\n\n Assumes the given type is a union type. If not, ArgumentException is raised during pre-computation.\n\n\n\n\n Get the tuple elements from the representation of an F# tuple type \n\n\n\n\n Read all the fields from a record value, in declaration order\n\n Assumes the given input is a record value. If not, ArgumentException is raised.\n\n\n\n\n Get the domain and range types from an F# function type or from the runtime type of a closure implementing an F# type\n\n\n\n\n Read all the fields from an F# exception declaration, in declaration order\n\n Assumes exceptionType is an exception representation type. If not, ArgumentException is raised.\n\n\n\n\n Contains operations associated with constructing and analyzing F# types such as records, unions and tuples\n\n\n\n\n Assumes the given type is a union type. \n If not, ArgumentException is raised during pre-computation.\n\n Using the computed function is more efficient than calling GetUnionCase\n because the path executed by the computed function is optimized given the knowledge that it will be\n used to read values of the given type.\n\n\n\n\n Precompute a property or static method for reading an integer representing the case tag of a union type.\n\n\n\n\n Precompute a function for reading all the fields for a particular discriminator case of a union type\n\n Using the computed function will typically be faster than executing a corresponding call to GetFields\n\n\n\n\n A method that constructs objects of the given case\n\n\n\n\n Precompute a function for constructing a discriminated union value for a particular union case. \n\n\n\n\n Precompute a function for reading the values of a particular tuple type\n\n Assumes the given type is a TupleType.\n If not, ArgumentException is raised during pre-computation.\n\n\n\n\n Get information that indicates how to read a field of a tuple\n\n\n\n\n Get a method that constructs objects of the given tuple type. \n For small tuples, no additional typoe will be returned.\n \n For large tuples, an additional type is returned indicating that\n a nested encoding has been used for the tuple type. In this case\n the suffix portion of the tuple type has the given type and an\n object of this type must be created and passed as the last argument \n to the ConstructorInfo. A recursive call to PreComputeTupleConstructorInfo \n can be used to determine the constructor for that the suffix type.\n\n\n\n\n Precompute a function for reading the values of a particular tuple type\n\n Assumes the given type is a TupleType.\n If not, ArgumentException is raised during pre-computation.\n\n\n\n\n Precompute a function for reading all the fields from a record. The fields are returned in the\n same order as the fields reported by a call to Microsoft.FSharp.Reflection.Type.GetInfo for\n this type.\n\n Assumes the given type is a RecordType. \n If not, ArgumentException is raised during pre-computation.\n\n Using the computed function will typically be faster than executing a corresponding call to Value.GetInfo\n because the path executed by the computed function is optimized given the knowledge that it will be\n used to read values of the given type.\n\n\n\n\n Precompute a function for reading a particular field from a record.\n Assumes the given type is a RecordType with a field of the given name. \n If not, ArgumentException is raised during pre-computation.\n\n Using the computed function will typically be faster than executing a corresponding call to Value.GetInfo\n because the path executed by the computed function is optimized given the knowledge that it will be\n used to read values of the given type.\n\n\n\n\n Get a ConstructorInfo for a record type\n\n\n\n\n Precompute a function for constructing a record value. \n\n Assumes the given type is a RecordType.\n If not, ArgumentException is raised during pre-computation.\n\n\n\n\n Create a union case value\n\n\n\n\n Create an instance of a tuple type\n\n Assumes at least one element is given. If not, ArgumentException is raised.\n\n\n\n\n Create an instance of a record type\n\n Assumes the given input is a record type. If not, ArgumentException is raised.\n\n\n\n\n Build a typed function from object from a dynamic function implementation\n\n\n\n\n Identify the union case and its fields for an object\n\n Assumes the given input is a union case value. If not, ArgumentException is raised.\n\n If the type is not given, then the runtime type of the input object is used to identify the\n relevant union type. The type should always be given if the input object may be null. For example, \n option values may be represented using the 'null'.\n\n\n\n\n Read all fields from a tuple \n\n Assumes the given input is a tuple value. If not, ArgumentException is raised.\n\n\n\n\n Read a field from a tuple value\n\n Assumes the given input is a tuple value. If not, ArgumentException is raised.\n\n\n\n\n Read all the fields from a record value\n\n Assumes the given input is a record value. If not, ArgumentException is raised.\n\n\n\n\n Read a field from a record value\n\n Assumes the given input is a record value. If not, ArgumentException is raised.\n\n\n\n\n Read all the fields from a value built using an instance of an F# exception declaration\n\n Assumes the given input is an F# exception value. If not, ArgumentException is raised.\n\n\n\n\n Contains operations associated with constructing and analyzing values associated with F# types such as records, unions and tuples\n\n\n\n\n The integer tag for the case\n\n\n\n\n The name of the case\n\n\n\n\n The type in which the case occurs\n\n\n\n\n The fields associated with the case, represented by PropertyInfo \n\n\n\n\n Return the custom attributes associated with the case\n\n\n\n\n Return the custom attributes associated with the case matching the given attribute type\n\n\n\n\nRepresents a case of a discriminated union type\n\n\n\n\n Type of a formatting expression\n 'Printer : function type generated by printf\n 'State: type argument passed to %a formatters\n 'Residue: value generated by the overall printf action (e.g. sprint generates a string)\n 'Result: value generated after post processing (e.g. failwithf generates a string internally then raises an exception)\n\n\n\n\n Type of a formatting expression\n 'Printer : function type generated by printf\n 'State: type argument passed to %a formatters\n 'Residue: value generated by the overall printf action (e.g. sprint generates a string)\n 'Result: value generated after post processing (e.g. failwithf generates a string internally then raises an exception)\n 'Tuple: tuple of values generated by scan or match\n\n\n\n\n The raw text of the format string \n\n\n\n\n Construct a format string \n\n\n\n\n Type of a formatting expression.\n 'Printer : function type generated by printf\n 'State: type argument passed to %a formatters\n 'Residue: value generated by the overall printf action (e.g. sprint generates a string)\n 'Result: value generated after post processing (e.g. failwithf generates a string internally then raises an exception)\n\n\n\n\n Construct a format string \n\n\n\n\n Type of a formatting expression.\n 'Printer : function type generated by printf\n 'State: type argument passed to %a formatters\n 'Residue: value generated by the overall printf action (e.g. sprint generates a string)\n 'Result: value generated after post processing (e.g. failwithf generates a string internally then raises an exception)\n 'Tuple: tuple of values generated by scan or match\n\n\n\n\n Represents a statically-analyzed format associated with writing to a System.Text.StringBuilder. The type parameter indicates the\n arguments and return type of the format operation.\n\n\n\n\n Represents a statically-analyzed format associated with writing to a System.Text.StringBuilder. The first type parameter indicates the\n arguments of the format operation and the last the overall return type.\n\n\n\n\n Represents a statically-analyzed format when formatting builds a string. The type parameter indicates the\n arguments and return type of the format operation.\n\n\n\n\n Represents a statically-analyzed format when formatting builds a string. The first type parameter indicates the\n arguments of the format operation and the last the overall return type.\n\n\n\n\n Represents a statically-analyzed format associated with writing to a System.IO.TextWriter. The type parameter indicates the\n arguments and return type of the format operation.\n\n\n\n\n Represents a statically-analyzed format associated with writing to a System.IO.TextWriter. The first type parameter indicates the\n arguments of the format operation and the last the overall return type.\n\n\n\n\n Print to a System.Text.StringBuilder\n\n\n\n\n Formatted printing to stderr\n\n\n\n\n Formatted printing to stderr, adding a newline \n\n\n\n\n Print to a string buffer and raise an exception with the given\n result. Helper printers must return strings.\n\n\n\n\n Print to a text writer or an OCaml-compatible channel\n\n\n\n\n Print to a text writer or an OCaml-compatible channel, adding a newline\n\n\n\n\n bprintf, but call the given 'final' function to generate the result.\n See kprintf.\n\n\n\n\n fprintf, but call the given 'final' function to generate the result.\n See kprintf.\n\n\n\n\n printf, but call the given 'final' function to generate the result.\n For example, these let the printing force a flush after all output has \n been entered onto the channel, but not before. \n\n\n\n\n sprintf, but call the given 'final' function to generate the result.\n See kprintf.\n\n\n\n\n twprintf, but call the given 'final' function to generate the result.\n See kprintf.\n\n\n\n\n Formatted printing to stdout\n\n\n\n\n Formatted printing to stdout, adding a newline \n\n\n\n\n Print to a string via an internal string buffer and return \n the result as a string. Helper printers must return strings.\n\n\n\n\n Print to any subtype of the .NET type System.IO.TextWriter\n\n\n\n\n Print to any subtype of the .NET type System.IO.TextWriter, and add a newline\n\n\n\n\n Extensible printf-style formatting for numbers and other datatypes\n\n Format specifications are strings with \"%\" markers indicating format \n placeholders. Format placeholders consist of:\n \n %[flags][width][.precision][type]\n \n where the type is interpreted as follows:\n \n %b: bool, formatted as \"true\" or \"false\"\n %s: string, formatted as its unescaped contents\n %d, %i: any basic integer type formatted as a decimal integer, signed if the basic integer type is signed.\n %u: any basic integer type formatted as an unsigned decimal integer\n %x, %X, %o: any basic integer type formatted as an unsigned hexadecimal \n (a-f)/Hexadecimal (A-F)/Octal integer\n \n %e, %E, %f, %F, %g, %G: \n any basic floating point type (float,float32) formatted\n using a C-style floating point format specifications, i.e\n \n %e, %E: Signed value having the form [-]d.dddde[sign]ddd where \n d is a single decimal digit, dddd is one or more decimal\n digits, ddd is exactly three decimal digits, and sign \n is + or -\n \n %f: Signed value having the form [-]dddd.dddd, where dddd is one\n or more decimal digits. The number of digits before the \n decimal point depends on the magnitude of the number, and \n the number of digits after the decimal point depends on \n the requested precision.\n \n %g, %G: Signed value printed in f or e format, whichever is \n more compact for the given value and precision.\n \n \n %M: System.Decimal value\n \n %O: Any value, printed by boxing the object and using it's ToString method(s)\n \n %A: Any value, printed by using Microsoft.FSharp.Text.StructuredPrintfImpl.Display.any_to_string with the default layout settings \n \n %a: A general format specifier, requires two arguments:\n (1) a function which accepts two arguments:\n (a) a context parameter of the appropriate type for the\n given formatting function (e.g. an #System.IO.TextWriter)\n (b) a value to print\n and which either outputs or returns appropriate text.\n \n (2) the particular value to print\n \n \n %t: A general format specifier, requires one argument:\n (1) a function which accepts a context parameter of the\n appropriate type for the given formatting function (e.g. \n an System.IO.TextWriter)and which either outputs or returns \n appropriate text.\n\n Basic integer types are:\n byte,sbyte,int16,uint16,int32,uint32,int64,uint64,nativeint,unativeint\n Basic floating point types are:\n float, float32\n\n The following format patterns are accepted but a warning is printed:\n\n %h(d|u|x|X|o)\n %l(d|u|x|X|o)\n\n The following format patterns are now deprecated:\n\n %Ld, %Li, %Lu, %Lx, %LX, %Lo: same, but an int64\n %nd, %ni, %nu, %nx, %nX, %no: same, but a nativeint\n %Ud, %Ui, %Uu, %Ux, %UX, %Uo: same, but an unsigned int32 (uint32)\n %ULd, %ULi, %ULu, %ULx, %ULX, %ULo: same, but an unsigned int64 (uint64)\n %Und, %Uni, %Unu, %Unx, %UnX, %Uno: same, but an unsigned nativeint (unativeint)\n \n The optional width is an integer indicating the minimal width of the\n result. For instance, %6d prints an integer, prefixing it with spaces\n to fill at least 6 characters. If width is '*', then an extra integer\n argument is taken to specify the corresponding width.\n \n any number\n '*': \n \n Valid flags are:\n \n 0: add zeros instead of spaces to make up the required width\n '-': left justify the result within the width specified\n '+': add a '+' character if the number is positive (to match a '-' sign \n for negatives)\n ' ': add an extra space if the number is positive (to match a '-' \n sign for negatives)\n \n The printf '#' flag is invalid and a compile-time error will be reported if it is used.\n\n\n\n\n\n\n\n A record of options to control structural formatting.\n For F# Interactive properties matching those of this value can be accessed via the 'fsi'\n value.\n \n Floating Point format given in the same format accepted by System.Double.ToString,\n e.g. f6 or g15.\n\n If ShowProperties is set the printing process will evaluate properties of the values being\n displayed. This may cause additional computation. \n\n The ShowIEnumerable is set the printing process will force the evalution of IEnumerable objects\n to a small, finite depth, as determined by the printing parameters.\n This may lead to additional computation being performed during printing.\n\n \n From F# Interactive the default settings can be adjusted using, for example, \n 
    \n   open Microsoft.FSharp.Compiler.Interactive.Settings;;\n   setPrintWidth 120;;\n
    \n     \n    \n    \n\n\n Data representing structured layouts of terms. \n\n\n\n\n Convert any value to a string using a standard formatter\n Data is typically formatted in a structured format, e.g.\n lists are formatted using the \"[1;2]\" notation.\n The details of the format are not specified and may change\n from version to version and according to the flags given\n to the F# compiler. The format is intended to be human-readable,\n not machine readable. If alternative generic formats are required\n you should develop your own formatter, using the code in the\n implementation of this file as a starting point.\n\n Data from other .NET languages is formatted using a virtual\n call to Object.ToString() on the boxed version of the input.\n\n\n\n\n Convert any value to a layout using the given formatting options. The\n layout can then be processed using formatting display engines such as\n those in the LayoutOps module. any_to_string and output_any are\n built using any_to_layout with default format options.\n\n\n\n\n Ouput any value to a channel using the same set of formatting rules\n as any_to_string\n\n\n\n\n\n\n\n\n\n\n Layout two vertically.\n\n\n\n\n Layout list vertically. \n\n\n\n\n Wrap braces around layout. \n\n\n\n\n Wrap round brackets around Layout.\n\n\n\n\n Join layouts into a comma separated list.\n\n\n\n\n The empty layout\n\n\n\n\n Is it the empty layout?\n\n\n\n\n An string which is left parenthesis (no space on the right).\n\n\n\n\n Layout like an F# list. \n\n\n\n\n An uninterpreted leaf, to be interpreted into a string\n by the layout engine. This allows leaf layouts for numbers, strings and\n other atoms to be customized according to culture.\n\n\n\n\n Join broken with ident=0\n\n\n\n\n Join broken with ident=1 \n\n\n\n\n Join broken with ident=2 \n\n\n\n\n Join, unbreakable. \n\n\n\n\n Join, possible break with indent=1\n\n\n\n\n Join, possible break with indent=2 \n\n\n\n\n Join, possible break with indent=0\n\n\n\n\n Layout like an F# option.\n\n\n\n\n An string which is right parenthesis (no space on it's left).\n\n\n\n\n Join layouts into a semi-colon separated list.\n\n\n\n\n An string which requires no spaces either side.\n\n\n\n\n Join layouts into a list separated using the given Layout.\n\n\n\n\n Join layouts into a space separated list. \n\n\n\n\n Wrap square brackets around layout. \n\n\n\n\n See tagL\n\n\n\n\n Form tuple of layouts. \n\n\n\n\n For limitting layout of list-like sequences (lists,arrays,etc).\n unfold a list of items using (project and z) making layout list via itemL.\n If reach maxLength (before exhausting) then truncate.\n\n\n\n\n An string leaf \n\n\n\n\n A layout is a sequence of strings which have been joined together.\n The strings are classified as words, separators and left and right parenthesis.\n This classification determines where spaces are inserted.\n A joint is either unbreakable, breakable or broken.\n If a joint is broken the RHS layout occurs on the next line with optional indentation.\n A layout can be squashed to for given width which forces breaks as required.\n\n\n    \n    \n" }, { "path": "ironclad-apps/tools/fsharp/FSharp.PowerPack.Build.Tasks.xml", "content": "\n\nFSharp.PowerPack.Build.Tasks\n\n\n\n The default location of FSharp.Core.dll and fsc.exe based on the version of fsc.exe that is running\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n" }, { "path": "ironclad-apps/tools/fsharp/FSharp.PowerPack.Linq.xml", "content": "\n\nFSharp.PowerPack.Linq\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n When used in queries, this operator corresponds to the LINQ Min operator and the query convertor recognises it as such\n It differs in return type from Seq.min_by\n\n\n\n\n When used in queries, this operator corresponds to the LINQ Join operator and the query convertor recognises it as such\n\n\n\n\n This join operator implements the LINQ GroupJoin operator and the query convertor recognises it as such\n\n\n\n\n When used in queries, this operator corresponds to the LINQ Join operator and the query convertor recognises it as such\n\n\n\n\n This join operator implements the LINQ GroupJoin operator and the query convertor recognises it as such\n\n\n\n\n This join operator corresponds to the LINQ Join operator and the query convertor recognises it as such\n\n\n\n\n When used in queries, this operator corresponds to the LINQ Max operator and the query convertor recognises it as such\n It differs in return type from Seq.max_by\n\n\n\n\n When used in queries, this operator corresponds to the LINQ Max operator and the query convertor recognises it as such\n It differs in return type from Seq.max_by\n\n\n\n\n When used in queries, this operator corresponds to the LINQ Min operator and the query convertor recognises it as such\n It differs in return type from Seq.min_by\n\n\n\n\n When used in queries, this operator corresponds to the LINQ Min operator and the query convertor recognises it as such\n It differs in return type from Seq.min_by\n\n\n\n\n Evaluate the quotation expression by first converting to a LINQ expression tree\n making use of IQueryable operators and then executing expression tree\n\n Exceptions: InvalidArgumentException will be raised if the input expression is\n not in the subset that can be converted to a LINQ expression tree\n\n\n\n\n\n\n\n This function should not be called directly. \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n A set of types used for implementing quotation conversions.\n These are public only because targets of Linq Lambda expressions require them to be so\n\n\n\n\n This module provides Compile and Eval extension members\n for F# quotation values, implemented by translating to LINQ\n expression trees and using the LINQ dynamic compiler.\n\n\n\n\n" }, { "path": "ironclad-apps/tools/fsharp/FSharp.PowerPack.Metadata.xml", "content": "\n\nFSharp.PowerPack.Metadata\n\n\n\n\n\n\n Return the System.Reflection.Assembly object for the assembly\n\n\n\n\n Holds the full qualified assembly name\n\n\n\n\n Get the object representing the F# core library (FSharp.Core.dll) for the running program\n\n\n\n\n A handle to the full specification of the contents of the module contained in this Assembly \n\n\n\n\n A hint as to where does the code for the CCU live (e.g what was the tcConfig.implicitIncludeDir at compilation time for this DLL?) \n\n\n\n\n Return the System.Reflection.Assembly object for the assembly\n\n\n\n\n This is one way of starting the loading process off. \n\n\n\n\n This is one way of starting the loading process off. Dependencies are automatically\n resolved by calling System.Reflection.Assembly.Load.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n The declared documentation for the type or module \n\n\n\n\n Indicates the type prefers the \"tycon<a,b>\" syntax for display etc. \n\n\n\n\n The cases of a discriminated union\n\n\n\n\n The fields of the class, struct or enum \n\n\n\n\n The declaration location for the type constructor \n\n\n\n\n Get the fully qualified name of the type or module\n\n\n\n\n\n\n\n The name of the type, possibly with `n mangling \n\n\n\n\n Properties, methods etc. with implementations, also values in a module\n\n\n\n\n Indicates the type is a struct\n\n\n\n\n Indicates the entity is an F# module definition\n\n\n\n\n Indicates the entity is a measure definition\n\n\n\n\n If true, then this is a reference to something in some .NET assembly from another .NET language\n\n\n\n\n Indicates an F# exception declaration\n\n\n\n\n Indicates the type is a measure, type or exception abbreviation\n\n\n\n\n Interface implementations - boolean indicates compiler-generated \n\n\n\n\n Indicates that a module is compiled to a class with the given mangled name. The mangling is reversed during lookup \n\n\n\n\n Indicates the type is implemented through a mapping to IL assembly code. THis is only\n true for types in FSharp.Core.dll\n\n\n\n\n Get the generic parameters, possibly including unit-of-measure parameters\n\n\n\n\n Base type, if any \n\n\n\n\n The declared attributes for the type \n\n\n\n\n\n\n\n Return the System.Type for the type\n\n Raises InvalidOperationException if the type is an abbreviation or has an assembly code representation.\n\n\n\n\n Return the FSharpEntity corresponding to a .NET type\n\n\n\n\n\n\n\n The documentation for the type parameter. \n\n\n\n\n\n\n\n\n\n\n Is this a ^a type variable\n\n\n\n\n Is this a measure variable\n\n\n\n\n The declared attributes of the type parameter. \n\n\n\n\n\n\n\n An F# discriminated union, as an object model\n\n\n\n\n\n\n\n XML documentation attached to a value.\n\n\n\n\n The full type of the member or value when used as a first class value\n\n\n\n\n\n\n\n\n\n\n Is this an F# type function\n\n\n\n\n Is this a mutable value\n\n\n\n\n Is this a module or member value\n\n\n\n\n Is this an implicit constructor?\n\n\n\n\n Is this an extension member?\n\n\n\n\n Is this a compiler generated value\n\n\n\n\n Is this a must-inline value\n\n\n\n\n The typars of the member or value\n\n\n\n\n\n\n\n The member name in compiled code\n\n\n\n\n Custom attributes attached to the value. These contain references to other values (i.e. constructors in types). Mutable to fixup \n these value references after copying a colelction of values. \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Documentation for the field \n\n\n\n\n The type of the field, w.r.t. the generic parameters of the enclosing type constructor \n\n\n\n\n Declaration-location of the field \n\n\n\n\n Attributes attached to generated property \n\n\n\n\n Name of the field \n\n\n\n\n Indicates a static field \n\n\n\n\n Is the field declared in F#? \n\n\n\n\n Indicates a compiler generated field, not visible to Intellisense or name resolution \n\n\n\n\n Attributes attached to generated field \n\n\n\n\n\n\n\n Get the named entity for a type constructed using a named entity\n\n\n\n\n Indicates the type is a tuple type. The GenericArguments property returns the elements of the tuple type.\n\n\n\n\n Indicates the type is constructed using a named entity\n\n\n\n\n Indicates the type is a variable type, whether declared, generalized or an inference type parameter \n\n\n\n\n Indicates the type is a function type. The GenericArguments property returns the domain and range of the function type.\n\n\n\n\n Get the index for a generic parameter type\n\n\n\n\n Get the generic parameter data for a generic parameter type\n\n\n\n\n Get the generic arguments for a tuple type, a function type or a type constructed using a named entity\n\n\n\n\n\n\n\n Documentation for the case \n\n\n\n\n Return type constructed by the case. Normally exactly the type of the enclosing type, sometimes an abbreviation of it \n\n\n\n\n Range of the name of the case \n\n\n\n\n Name of the case \n\n\n\n\n Data carried by the case. \n\n\n\n\n Name of the case in generated IL code \n\n\n\n\n Attributes, attached to the generated static method to make instances of the case \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Calling conventions. These are used in method pointer types.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Global state: table of all assembly references keyed by AssemblyRefData\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n The explicit offset in bytes when explicit layout is used.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Index table by name and arity. \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n This is used to store event, property and field maps.\n\n Review: this is not such a great data structure.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n keyed first on namespace then on type name. The namespace is often a unique key for a given type map.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n A little ugly, but the idea is that if a data structure does not \n contain lazy values then we don't add laziness. So if the thing to map \n is already evaluated then immediately apply the function. \n\n\n\n\n\n\n\n Global State. All namespace splits\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Like Fixup but loader may return None, in which case there is no fixup.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Used when generating the secret paths used by FSI file generation\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n The characters that are allowed to be in an identifier.\n\n\n\n\n Is this character a part of a long identifier \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Used when generating the secret paths used by FSI file generation\n\n\n\n\n Used when generating the secret paths used by FSI file generation\n\n\n\n\n Try to chop \"get_\" or \"set_\" from a string\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Attrib(kind,unnamedArgs,propVals)\n\n\n\n\n We keep both source expression and evaluated expression around to help intellisense and signature printing\n\n\n\n\n\n\n\n AttribNamedArg(name,type,isField,value)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n The result of attempting to resolve an assembly name to a full ccu.\n UnresolvedCcu will contain the name of the assembly that could not be resolved.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Ensure the ccu is derefable in advance. Supply a path to attach to any resulting error message.\n\n\n\n\n\n\n\n\n\n\n A relinkable handle to the contents of a compilation unit. Relinking is performed by mutation.\n\n\n\n\n\n\n\n\n\n\n\n\n\n The information ILXGEN needs about the location of an item\n\n\n\n\n Specifies the compiled representations of type and exception definitions. \n Computed and cached by later phases (never computed type checking). Cached at \n type and exception definitions. Not pickled.\n\n\n\n\n Constants in expressions\n\n\n\n\n Decision trees. Pattern matching has been compiled down to\n a decision tree by this point. The right-hand-sides (actions) of\n the decision tree are labelled by integers that are unique for that\n particular tree.\n\n\n\n\n\n\n\n\n\n\n A target of a decision tree. Can be thought of as a little function, though is compiled as a local block. \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n From TAST TyconRef to IL ILTypeRef\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n A named module-or-namespace-fragment definition \n\n\n\n\n The module_typ is a binder. However it is not used in the ModuleOrNamespaceExpr: it is only referenced from the 'outside' \n The contents of a module-or-namespace-fragment definition \n\n\n\n\n A type for a module-or-namespace-fragment and the actual definition of the module-or-namespace-fragment\n\n\n\n\n\n\n\n note: ModuleOrNamespaceRef and TyconRef are type equivalent \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Namespace or module-compiled-as-type? \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Values, including members in F# types in this module-or-namespace-fragment. \n\n\n\n\n Type, mapping mangled name to Tycon, e.g. \n\n\n\n\n Lookup tables keyed the way various clients expect them to be keyed.\n We attach them here so we don't need to store lookup tables via any other technique \n\n\n\n\n\n\n\n\n\n\n Mutation used during compilation of FSharp.Core.dll\n\n\n\n\n\n\n\n\n\n\n\n\n\n Non-local references indirect via a CCU\n The lookup into the CCU is a NonLocalPath, which is a series of strings\n We cache the result of dereferencing\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Index into the namespace/module structure of a particular CCU \n\n\n\n\n\n\n\n A representation of a method in an object expression. \n Note: Methods associated with types are represented as val declarations\n Note: We should probably use val_specs for object expressions, as then the treatment of members \n in object expressions could be more unified with the treatment of members in types \n\n\n\n\n\n\n\n\n\n\n A public path records where a construct lives within the global namespace\n of a CCU.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n This ModuleOrNamespace that represents the compilation of a module as a class. \n The same set of tycons etc. are bound in the ModuleOrNamespace as in the ModuleOrNamespaceExpr\n This is the body of the module/namespace \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n The extra metadata stored about typars for top-level definitions. Any information here is propagated from signature through\n to the compiled code.\n\n\n\n\n The extra metadata stored about typars for top-level definitions. Any information here is propagated from signature through\n to the compiled code.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n The specification of a member constraint that must be solved \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n The ILX data structure representing the discriminated union. \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n The type of the value. \n May be a Type_forall for a generic value. \n May be a type variable or type containing type variables during type inference. \n\n\n\n\n\n\n\n\n\n\n\n\n\n A unique stamp within the context of this invocation of the compiler process \n\n\n\n\n\n\n\n\n\n\n The place where the value was defined. \n\n\n\n\n What is the public path to the value, if any? Should be set if and only if\n IsMemberOrModuleBinding is set.\n\n\n\n\n\n\n\n Is this a member, if so some more data about the member.\n\n Note, the value may still be (a) an extension member or (b) and abtract slot without\n a true body.\n\n\n\n\n\n\n\n\n\n\n The internal name the value. \n\n\n\n\n Was the value inferred to be a method or function that definitely makes no critical tailcalls?\n\n\n\n\n The value of a value or member marked with [<LiteralAttribute>] \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Is this a member definition or module definition?\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Is this represented as a \"top level\" static binding (i.e. a static field, static member,\n instance member), rather than an \"inner\" binding that may result in a closure.\n\n This is implied by IsMemberOrModuleBinding, however not vice versa, for two reasons.\n Some optimizations mutate this value when they decide to change the representation of a \n binding to be IsCompiledAsTopLevel. Second, even immediately after type checking we expect\n some non-module, non-member bindings to be marked IsCompiledAsTopLevel, e.g. 'y' in \n 'let x = let y = 1 in y + y' (NOTE: check this, don't take it as gospel)\n\n\n\n\n\n\n\n\n\n\n\n\n\n Range of the definition (implementation) of the value, used by Visual Studio \n Updated by mutation when the implementation is matched against the signature. \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n The parent type or module, if any (None for expression bindings and parameters)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n References are either local or nonlocal\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n The big type of expressions. \n\n\n\n\n\n\n\n\n\n\n\n\n\n The algebra of types\n\n\n\n\n\n\n\n Unique name generator for stamps attached to lambdas and object expressions\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Create a module Tycon based on an existing one using the function 'f'. \n We require that we be given the parent for the new module. \n We pass the new module to 'f' in case it needs to reparent the \n contents of the module. \n\n\n\n\n Create a tycon based on an existing one using the function 'f'. \n We require that we be given the new parent for the new tycon. \n We pass the new tycon to 'f' in case it needs to reparent the \n contents of the tycon. \n\n\n\n\n Create a Val based on an existing one using the function 'f'. \n We require that we be given the parent for the new Val. \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Given (newPath,oldPath) replace oldPath by newPath in the TAccess.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Equality on CCUs, implemented as reference equality\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Combine module types when multiple namespace fragments contribute to the\n same namespace, making new module specs as we go.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Identical to tcref.Deref and deref_tycon, just used to help distinguish what kind of entity we expect here\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Compiler-internal references to items in fslib are generated as Ref_nonlocal even when compiling fslib \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Unique name generator for stamps attached to to val_specs, tycon_specs etc.\n\n\n\n\n\n\n\n\n\n\n This predicate tests if non-local resolution paths are definitely known to resolve\n to different entities. All references with different named paths always resolve to \n different entities. Two references with the same named paths may resolve to the same \n entities even if they reference through different CCUs, because one reference\n may be forwarded to another via a .NET TypeForwarder.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n See nlpath_definitely_not_eq\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Equality on type varialbes, implemented as reference equality\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nverboseStamps: print #stamp on each id -- very verbose - but sometimes useful. Turn on using '--stamps'\n\n\n\n\n\n\n\n Equality on value specs, implemented as reference equality\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Metadata on values (names of arguments etc. \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n The default location of FSharp.Core.dll and fsc.exe based on the version of fsc.exe that is running\n\n\n\n\n\n\n\n\n\n\n\n\n\n" }, { "path": "ironclad-apps/tools/fsharp/FSharp.PowerPack.xml", "content": "\n\nFSharp.PowerPack\n\n\n\n\n\n\n Lookup or set the given element in the table. Set replaces all existing bindings for a value with a single\n bindings. Raise KeyNotFoundException if the element is not found.\n\n\n\n\n Lookup or set the given element in the table. Set replaces all existing bindings for a value with a single\n bindings. Raise KeyNotFoundException if the element is not found.\n\n\n\n\n The total number of keys in the hash table\n\n\n\n\n Lookup the given element in the table, returning the result as an Option\n\n\n\n\n Replace the latest binding (if any) for the given element.\n\n\n\n\n Remove the latest binding (if any) for the given element from the table\n\n\n\n\nApply the given function to each binding in the hash table \n\n\n\n\n Apply the given function to each element in the collection threading the accumulating parameter\n through the sequence of function applications\n\n\n\n\n Find all bindings for the given element in the table, if any\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Make a shallow copy of the collection\n\n\n\n\n Test if the collection contains any bindings for the given element\n\n\n\n\n Test if the collection contains any bindings for the given element\n\n\n\n\n Clear all elements from the collection\n\n\n\n\n Add a binding for the element to the table\n\n\n\n\n Create a new empty mutable HashMultiMap\n with key hash/equality based on the F# structural \"hash\" and (=) functions.\n\n\n\n\n Create a new empty mutable HashMultiMap with an internal bucket array of the given approximate size\n and with key hash/equality based on the F# structural \"hash\" and (=) functions\n\n\n\n\n Create a new empty mutable HashMultiMap with an internal bucket array of the given approximate size\n and with the given key hash/equality functions\n\n\n\n\n Build a map that contains the bindings of the given IEnumerable\n\n\n\n\n Hash tables, by default based on F# structural \"hash\" and (=) functions. \n The table may map a single key to multiple bindings.\n\n\n\n\n The total number of elements in the set\n\n\n\n\n Remove the given element from the set\n\n\n\n\n Apply the given function to each binding in the hash table \n\n\n\n\n Apply the given function to the set threading the accumulating parameter\n through the sequence of function applications\n\n\n\n\n Create a new empty mutable hash set \n with key hash/equality based on the F# structural \"hash\" and (=) functions\n\n\n\n\n Create a new empty mutable hash set with an internal bucket array of the given approximate size\n and with key hash/equality based on the F# structural \"hash\" and (=) functions\n\n\n\n\n Create a new empty mutable hash set with an internal bucket array of the given approximate size\n and with the given key hash/equality functions \n\n\n\n\n Create a new mutable hash set containing elements drawn from the given sequence\n\n\n\n\n Make a shallow copy of the set\n\n\n\n\n Test if the set contains the given element\n\n\n\n\n Clear all elements from the set\n\n\n\n\n Add an element to the collection\n\n\n\n\n Create a new empty mutable hash set \n with key hash/equality based on the F# structural \"hash\" and (=) functions\n\n\n\n\n Create a new empty mutable hash set with an internal bucket array of the given approximate size\n and with key hash/equality based on the F# structural \"hash\" and (=) functions\n\n\n\n\n Create a new empty mutable hash set with an internal bucket array of the given approximate size\n and with the given key hash/equality functions \n\n\n\n\n Create a new mutable hash set containing elements drawn from the given sequence\n\n\n\n\n Mutable hash sets based by default on F# structural \"hash\" and (=) functions. Implemented via a hash table and/or Dictionary.\n\n\n\n\n LazyLists are possibly-infinite, cached sequences. See also IEnumerable/Seq for\n uncached sequences. Calling \"get\" on the same lazy list value you will keep \n getting the same (cached) result. LazyLists normally involve delayed computations\n without side-effects, and calling \"get\" may cause these computations to be executed. The results \n of these computations are cached - evaluations will be performed \n only once for each element of the lazy list. This is different to IEnumerable/Seq where\n recomputation happens each time an enumerator is created and the sequence traversed.\n\n LazyLists can represent cached potentially-infinite computations. Because they are cached they may cause \n memory leaks if some part of your code maintains a live reference to\n the head of an infinite or very large lazy list while iterating it, or if a reference is\n maintained after the list is no longer required.\n\n Although lazy lists are an abstract type you may pattern match against them using the\n LazyList.Cons and LazyList.Nil active patterns. These may force the computation of elements\n of the list.\n\n\n\n\n\n\n\n\n\n\n Return the stream which contains on demand the elements of the first stream followed\n by the elements of the second list\n\n\n\n\n Return the stream which contains on demand the pair of elements of the first and second list\n\n\n\n\n Return the stream which contains on demand the list of elements of the list of lazy lists.\n\n\n\n\n Return a new stream which contains on demand the given item followed by the\n given stream.\n\n\n\n\n Return a new stream which contains on demand the given item followed by the\n stream returned by the given computation. The computation is\n not executed until the elements of the stream are consumed. The\n computation is only executed once.\n\n\n\n\n Return a stream that is in effect the stream returned by the given computation.\n The given computation is not executed until the first element on the stream is\n consumed.\n\n\n\n\n Return the stream without the first 'n' elements of the given stream. Does\n not force the evaluation of any cells in the stream.\n\n\n\n\n Evaluates to the stream that contains no items\n\n\n\n\n Return a new collection which on consumption will consist of only the elements of the collection\n for which the given predicate returns \"true\"\n\n\n\n\n Return the first element for which the given function returns true.\n Raise KeyNotFoundException if no such element exists.\n\n\n\n\n Apply the given function to successive elements of the list, returning the first\n result where function returns Some(x) for some x. If the function never returns\n true, 'None' is returned.\n\n\n\n\n Return a new stream consisting of the results of applying the given accumulating function\n to successive elements of the stream\n\n\n\n\n Get the first cell of the stream.\n\n\n\n\n Return the first element of the stream. Raise 'Invalid_argument \"hd\"' if the\n stream is empty. Forces the evaluation of\n the first cell of the stream if it is not already evaluated.\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to each of the elements of the collection.\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to the corresponding elements of the two collections pairwise.\n\n\n\n\n Test if a stream contains at least one element. Forces the evaluation of\n the first element of the stream if it is not already evaluated.\n\n\n\n\n Build a collection from the given array. This function will eagerly evaluate all of the \n stream (and thus may not terminate). \n\n\n\n\n Build a collection from the given list. This function will eagerly evaluate all of the \n stream (and thus may not terminate). \n\n\n\n\n Build a new collection from the given enumerable object\n\n\n\n\n Return the stream which on consumption will consist of an infinite sequence of the given item\n\n\n\n\n Return the stream which on consumption will consist of at most 'n' elements of \n the given stream. Does not force the evaluation of any cells in the stream.\n\n\n\n\n Return the stream corresponding to the remaining items in the sequence. \n Raise 'Invalid_argument \"tl\"' if the stream is empty. Forces the evaluation of\n the first cell of the stream if it is not already evaluated.\n\n\n\n\n Build an array from the given collection\n\n\n\n\n Build a list from the given collection This function will eagerly evaluate all of the \n stream (and thus may not terminate). \n\n\n\n\n Return a view of the collection as an enumerable object\n\n\n\n\n Return a stream that contains the elements returned by the given computation.\n The given computation is not executed until the first element on the stream is\n consumed. The given argument is passed to the computation. Subsequent elements\n in the stream are generated by again applying the residual 'b to the computation.\n\n\n\n\n\n\n\n\n\n\nBuild a new array that contains the elements of the first array followed by the elements of the second array\n\n\n\n\nRead a range of elements from the first array and write them into the second.\n\n\n\n\nApply the given function to each element of the array. Return\nthe array comprised of the results \"x\" for each element where\nthe function returns Some(x)\n\n\n\n\nCombine the two arrays into an array of pairs. The two arrays must have equal lengths.\n\n\n\n\nBuild a new array that contains the elements of each of the given list of arrays\n\n\n\n\nBuild a new array that contains the elements of the given array\n\n\n\n\n Create an array whose elements are all initially the given value.\n\n\n\n\n Test if any element of the array satisfies the given predicate.\n If the input function is f and the elements are i0...iN \n then computes p i0 or ... or p iN.\n\n\n\n\n Test elements of the two arrays pairwise to see if any pair of element satisfies the given predicate.\n Raise ArgumentException if the arrays have different lengths.\n\n\n\n\nFill a range of the collection with the given element\n\n\n\n\nReturn a new collection containing only the elements of the collection\nfor which the given predicate returns true\n\n\n\n\nReturn the first element for which the given function returns true.\nRaise KeyNotFoundException if no such element exists.\n\n\n\n\n Return the index of the first element in the array\n that satisfies the given predicate. Raise KeyNotFoundException if \n none of the elements satisy the predicate.\n\n\n\n\n Return the index of the first element in the array\n that satisfies the given predicate. Raise KeyNotFoundException if \n none of the elements satisy the predicate.\n\n\n\n\nApply the given function to successive elements, returning the first\nresult where function returns \"Some(x)\" for some x.\n\n\n\n\n Apply a function to each element of the collection, threading an accumulator argument\n through the computation. If the input function is f and the elements are i0...iN \n then computes f (... (f s i0)...) iN\n\n\n\n\n Apply a function to pairs of elements drawn from the two collections, \n left-to-right, threading an accumulator argument\n through the computation. The two input\n arrays must have the same lengths, otherwise an ArgumentException is\n raised.\n\n\n\n\n Apply a function to each element of the array, threading an accumulator argument\n through the computation. If the input function is f and the elements are i0...iN then \n computes f i0 (...(f iN s)).\n\n\n\n\n Apply a function to pairs of elements drawn from the two collections, right-to-left, \n threading an accumulator argument through the computation. The two input\n arrays must have the same lengths, otherwise an ArgumentException is\n raised.\n\n\n\n\n Test if all elements of the array satisfy the given predicate.\n If the input function is f and the elements are i0...iN and \"j0...jN\"\n then computes p i0 && ... && p iN.\n\n\n\n\n Test elements of the two arrays pairwise to see if all pairs of elements satisfy the given predicate.\n Raise ArgumentException if the arrays have different lengths.\n\n\n\n\n Fetch an element from the collection. You can also use the syntax arr.[idx].\n\n\n\n\n Create an array by calling the given generator on each index.\n\n\n\n\n Return true if the given array is empty, otherwise false\n\n\n\n\nApply the given function to each element of the array. \n\n\n\n\nApply the given function to two arrays simultaneously. The\ntwo arrays must have the same lengths, otherwise an Invalid_argument exception is\nraised.\n\n\n\n\nApply the given function to each element of the array. The integer passed to the\nfunction indicates the index of element.\n\n\n\n\n Apply the given function to pair of elements drawn from matching indices in two arrays,\n also passing the index of the elements. The two arrays must have the same lengths, \n otherwise an ArgumentException is raised.\n\n\n\n\n Return the length of the collection. You can also use property arr.Length.\n\n\n\n\nBuild a new array whose elements are the results of applying the given function\nto each of the elements of the array.\n\n\n\n\nBuild a new collection whose elements are the results of applying the given function\nto the corresponding elements of the two collections pairwise. The two input\narrays must have the same lengths.\n\n\n\n\nBuild a new array whose elements are the results of applying the given function\nto each of the elements of the array. The integer index passed to the\nfunction indicates the index of element being transformed.\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to the corresponding elements of the two collections pairwise. The two input\n arrays must have the same lengths, otherwise an ArgumentException is\n raised.\n\n\n\n\nBuild an array from the given list\n\n\n\n\nSplit the collection into two collections, containing the \nelements for which the given predicate returns true and false\nrespectively \n\n\n\n\n Apply a function to each element of the array, threading an accumulator argument\n through the computation. If the input function is f and the elements are i0...iN \n then computes f (... (f i0 i1)...) iN. Raises ArgumentException if the array has size zero.\n\n\n\n\n Apply a function to each element of the array, threading an accumulator argument\n through the computation. If the input function is f and the elements are i0...iN then \n computes f i0 (...(f iN-1 iN)). Raises ArgumentException if the array has size zero.\n\n\n\n\nReturn a new array with the elements in reverse order\n\n\n\n\n Like fold_left, but return the intermediary and final results\n\n\n\n\n Like fold_right, but return both the intermediary and final results\n\n\n\n\n Set the value of an element in the collection. You can also use the syntax arr.[idx] <- e.\n\n\n\n\n Return an array containing the given element\n\n\n\n\n Sort the elements using the given comparison function\n\n\n\n\n Sort the elements using the key extractor and generic comparison on the keys\n\n\n\n\nSplit a list of pairs into two lists\n\n\n\n\nBuild a new array that contains the given subrange specified by\nstarting index and length.\n\n\n\n\nBuild a list from the given array\n\n\n\n\n Return a view of the array as an enumerable object\n\n\n\n\nReturn the first element for which the given function returns true.\nReturn None if no such element exists.\n\n\n\n\n Return the index of the first element in the array\n that satisfies the given predicate.\n\n\n\n\n Return the index of the first element in the array\n that satisfies the given predicate.\n\n\n\n\n Split an array of pairs into two arrays\n\n\n\n\n Combine the two arrays into an array of pairs. The two arrays must have equal lengths, otherwise an ArgumentException is\n raised..\n\n\n\n\n Generic operations on the type System.Collections.Generic.List, which is called ResizeArray in the F# libraries.\n\n\n\n\n\n\n\n Lookup or set the given element in the table. Raise KeyNotFoundException if the element is not found.\n\n\n\n\n Lookup or set the given element in the table. Raise KeyNotFoundException if the element is not found.\n\n\n\n\n The number of bindings in the hash table\n\n\n\n\n Lookup the given element in the table, returning the result as an Option\n\n\n\n\n Replace the latest binding (if any) for the given element.\n\n\n\n\n Remove the latest binding (if any) for the given element from the table\n\n\n\n\n Apply the given function to each binding in the hash table \n\n\n\n\n Apply the given function to each element in the collection threading the accumulating parameter\n through the sequence of function applications\n\n\n\n\n Find all bindings for the given element in the table, if any\n\n\n\n\n Create a new empty mutable hash table with an internal bucket array of the given approximate size\n and with the given key hash/equality functions\n\n\n\n\n Make a shallow copy of the collection\n\n\n\n\n Test if the collection contains any bindings for the given element\n\n\n\n\n Test if the collection contains any bindings for the given element\n\n\n\n\n Clear all elements from the collection\n\n\n\n\n Add a binding for the element to the table\n\n\n\n\n HashMultiMap, but where a constraint tag tracks information about the hash/equality functions used\n for the hashing. When the tag is Tags.StructuralHash this is identical to HashMultiMap.\n\n\n\n\n\n\n\n The number of elements in the set\n\n\n\n\n Remove the given element from the set\n\n\n\n\n Apply the given function to each binding in the hash table \n\n\n\n\n Apply the given function to the set threading the accumulating parameter\n through the sequence of function applications\n\n\n\n\n Create a new empty mutable hash set with an internal bucket array of the given approximate size\n and with the given key hash/equality functions \n\n\n\n\n Make a shallow copy of the set\n\n\n\n\n Test if the set contains the given element\n\n\n\n\n Clear all elements from the set\n\n\n\n\n Add an element to the collection\n\n\n\n\n Mutable hash sets based on F# structural \"hash\" and (=) functions. Implemented via a hash table and/or Dictionary.\n Mutable hash sets where a constraint tag tracks information about the hash/equality functions used\n for the hashing. When the tag is Tags.StructuralHash this is identical to HashSet.\n\n\n\n\n Immutable maps. Keys are ordered by construction function specified\n when creating empty maps or by F# structural comparison if no\n construction function is specified.\n\n \n Maps based on structural comparison are \n efficient for small keys. They are not a suitable choice if keys are recursive data structures \n or require non-structural comparison semantics.\n \n\n\n\n\n Lookup an element in the map. Raise KeyNotFoundException if no binding\n exists in the map.\n\n\n\n\n Return true if there are no bindings in the map.\n\n\n\n\n The number of bindings in the map\n\n\n\n\n Lookup an element in the map, returning a Some value if the element is in the domain \n of the map and None if not.\n\n\n\n\n The elements of the set as a list.\n\n\n\n\n The elements of the set as an array\n\n\n\n\n Remove an element from the domain of the map. No exception is raised if the element is not present.\n\n\n\n\n Build two new maps, one containing the bindings for which the given predicate returns 'true',\n and the other the remaining bindings.\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to each of the elements of the collection.\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to each of the elements of the collection. The index passed to the\n function indicates the index of element being transformed.\n\n\n\n\n Apply the given function to each binding in the dictionary\n\n\n\n\n\n\n\n Return true if the given predicate returns true for all of the\n bindings in the map. Always returns true if the map is empty.\n\n\n\n\n Given the start and end points of a key range,\n Fold over the bindings in the map that are in the range,\n and the end points are included if present (the range is considered a closed interval).\n\n\n\n\n Fold over the bindings in the map. \n\n\n\n\n Fold over the bindings in the map. \n\n\n\n\n Search the map looking for the first element where the given function returns a Some value\n\n\n\n\n Build a new map containing the bindings for which the given predicate returns 'true'.\n\n\n\n\n Return true if the given predicate returns true for one of the\n bindings in the map. Always returns false if the map is empty.\n\n\n\n\n\n\n\n The empty map, and use the given comparer comparison function for all operations associated\n with any maps built from this map.\n\n\n\n\n Build a map that contains the bindings of the given IEnumerable\n and where comparison of elements is based on the given comparison function\n\n\n\n\n Test is an element is in the domain of the map\n\n\n\n\n Return a new map with the binding added to the given map.\n\n\n\n\n Immutable maps. A constraint tag carries information about the class of key-comparers being used. \n\n\n\n\n Immutable sets based on binary trees, default tag\n\n\n\n\n Return a new set with the elements of the second set removed from the first.\n\n\n\n\n Compute the union of the two sets.\n\n\n\n\n Returns the lowest element in the set according to the ordering being used for the set\n\n\n\n\n Returns the highest element in the set according to the ordering being used for the set\n\n\n\n\n A useful shortcut for Set.is_empty. See the Set module for further operations on sets.\n\n\n\n\n Return the number of elements in the set\n\n\n\n\n The number of elements in the set\n\n\n\n\n Compute the union of the two sets.\n\n\n\n\n The elements of the set as a list.\n\n\n\n\n The elements of the set as an array.\n\n\n\n\n A singleton set based on the given comparison operator\n\n\n\n\n A useful shortcut for Set.remove. Note this operation produces a new set\n and does not mutate the original set. The new set will share many storage\n nodes with the original. See the Set module for further operations on sets.\n\n\n\n\n Build two new sets, one containing the elements for which the given predicate returns 'true',\n and the other the remaining elements.\n\n\n\n\n Apply the given function to each binding in the collection\n\n\n\n\n Evaluates to \"true\" if all elements of the first set are in the second\n\n\n\n\n Evaluates to \"true\" if all elements of the second set are in the first\n\n\n\n\n Compute the intersection of the two sets.\n\n\n\n\n Test if all elements of the collection satisfy the given predicate.\n If the input function is f and the elements are i0...iN and j0...jN then \n computes p i0 && ... && p iN.\n\n\n\n\n Apply the given accumulating function to all the elements of the set\n\n\n\n\n Return a new collection containing only the elements of the collection\n for which the given predicate returns \"true\"\n\n\n\n\n Test if any element of the collection satisfies the given predicate.\n If the input function is f and the elements are i0...iN then computes \n p i0 or ... or p iN.\n\n\n\n\n\n\n\n Compares two sets and returns true if they are equal or false otherwise\n\n\n\n\n The empty set based on the given comparer\n\n\n\n\n Return a new set with the elements of the second set removed from the first.\n\n\n\n\n A set based on the given comparer containing the given initial elements\n\n\n\n\n A useful shortcut for Set.mem. See the Set module for further operations on sets.\n\n\n\n\n Compares a and b and returns 1 if a > b, -1 if b < a and 0 if a = b \n\n\n\n\n A useful shortcut for Set.add. Note this operation prodcues a new set\n and does not mutate the original set. The new set will share many storage\n nodes with the original. See the Set module for further operations on sets.\n\n\n\n\n Immutable sets where a constraint tag carries information about the class of key-comparer being used. \n\n\n\n\n\n\n\n\n\n\n The spec value describes the action of the argument,\n and whether it expects a following parameter.\n\n\n\n\n \"parse specs f use\" parses the arguments given by Sys.argv\n according to the argument processing specifications \"specs\".\n Arguments begin with \"-\". Non-arguments are passed to \"f\" in\n order. \"use\" is printed as part of the usage line if an error occurs.\n\n Permitted arguments are specified using triples: (arg, action, help).\n Actions are:\n Unit(f): call f, no subseq. arg\n Set(br): set ref to 'true', no subseq. arg.\n Clear(br): set ref to 'false, no subseq. arg.\n String(f): pass the subseq. arg to f\n Int(f): pass the subseq. arg to f\n Float(f): pass the subseq. arg to f\n Rest(f): pass all subseq. args to f in order\n\n\n\n\n\n\n\n \"usage specs use\" prints the help for each argument.\n\n\n\n\n\n\n\n\n\n\n A simple command-line argument processor.\n\n\n\n\n Is an element in the array, uses (=) equality.\n\n\n\n\n Create a jagged 2 dimensional array.\n\n This member is primarily provided for compatibility with implementations \n of ML. F# also supports non-jagged 2D arrays - see the Array2D module and \n types such as \"int[,]\".\n\n\n\n\n\n\n\n Create a jagged 2 dimensional array. Synonym for create.\n\n This member is primarily provided for compatibility with implementations \n of ML. F# also supports non-jagged 2D arrays - see the Array2D module and \n types such as \"int[,]\".\n\n\n\n\n\n\n\n Return true if the list is not empty.\n\n\n\n\n Pin the given array for the duration of a single call to the given function. A native pointer to\n the first element in the array is passed to the given function. Cleanup the GCHandle associated with the \n pin when the function completes, even if an exception is raised.\n\n\n\n\n As for Array.pin, except that the caller is responsible for calling Free on the returned GCHandle in order\n to release the pin.\n\n\n\n\n\n\n\n\n\n\n\n\n\n Like reduce, but return both the intermediary and final results\n\n\n\n\n Like reduceBack, but return both the intermediary and final results\n\n\n\n\n Compatibility operations on arrays. \n\n\n\n\n Pin the given array for the duration of a single call to the given function. A native pointer to\n the first element in the array is passed to the given function. Cleanup the GCHandle associated with the \n pin when the function completes, even if an exception is raised.\n\n\n\n\n As for Array2D.pin, except that the caller is responsible for calling Free on the returned GCHandle in order\n to release the pin.\n\n\n\n\n\n\n\n\n\n\n Returns the sum of a and b\n\n\n\n\n Compares a and b and returns 1 if a > b, -1 if b < a and 0 if a = b\n\n\n\n\n Returns a divided by b \n\n\n\n\n Combines the binary representation of a and b by bitwise and\n\n\n\n\n Returns the bitwise logical negation of a\n\n\n\n\n Combines the binary representation of a and b by bitwise or\n\n\n\n\n Combines the binary representation of a and b by bitwise xor\n\n\n\n\n Returns a multiplied by b \n\n\n\n\n Converts a char to a byte\n\n\n\n\n Converts a 32-bit integer to a byte\n\n\n\n\n Converts a 32-bit integer to a byte\n\n\n\n\n Converts a string to a byte\n\n\n\n\n Converts a 16-bit integer to a byte\n\n\n\n\n Converts an unsigned 32-bit integer to a byte\n\n\n\n\n The value one as a System.Byte\n\n\n\n\n Returns the predeccessor of the argument wrapped around 0uy\n\n\n\n\n Returns the remainder of a divided by b\n\n\n\n\n Shifts the binary representation a by n bits to the left\n\n\n\n\n Shifts the binary representation a by n bits to the right\n\n\n\n\n Returns a minus b \n\n\n\n\n Returns the successor of the argument wrapped around 255uy\n\n\n\n\n Converts a byte to a char \n\n\n\n\n Converts a byte to a 32-bit integer \n\n\n\n\n Converts a byte to a 32-bit integer \n\n\n\n\n Converts a byte to a string\n\n\n\n\n Converts a byte to a 16-bit integer \n\n\n\n\n Converts a byte to an unsigned 32-bit integer \n\n\n\n\n The value zero as a System.Byte\n\n\n\n\n Byte (8-bit) operations.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Apply a function to each element of the collection, threading an accumulator argument\n through the computation. If the input function is f and the elements are i0...iN \n then computes f (... (f s i0)...) iN\n\n\n\n\n Apply a function to each element of the collection, threading an accumulator argument\n through the computation. If the input function is f and the elements are i0...iN \n then computes f i0 (...(f iN s)).\n\n\n\n\n\n\n\n\n\n\n Apply the given function to each element of the collection. \n\n\n\n\n Apply the given function to each element of the collection. The integer passed to the\n function indicates the index of element.\n\n\n\n\n\n\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to each of the elements of the collection.\n\n\n\n\n Build a new collection whose elements are the results of applying the given function\n to each of the elements of the collection. The integer index passed to the\n function indicates the index of element being transformed.\n\n\n\n\nBuild a collection from the given list\n\n\n\n\n\n\n\n\n\n\n\n\n\nBuild a list from the given collection\n\n\n\n\n\n\n\n Byte arrays. Arrays of bytes type-compatible with the C# byte[] type\n\n\n\n\n Converts the value of the specified 32-bit signed integer to its equivalent Unicode character\n\n\n\n\n Converts the value of the specified Unicode character to the equivalent 32-bit signed integer\n\n\n\n\n Compares a and b and returns 1 if a > b, -1 if b < a and 0 if a = b\n\n\n\n\n Converts the value of a Unicode character to its lowercase equivalent\n\n\n\n\n Converts the value of a Unicode character to its uppercase equivalent\n\n\n\n\n Unicode characters, i.e. the System.Char type. see also the operations\n in System.Char and the System.Text.Encoding interfaces if necessary.\n\n\n\n\n Combine enum values using 'logical or'. The relevant enumeration type is inferred from context.\n\n\n\n\n Convert an integer to an enumeration value. The result type is inferred from context.\n\n\n\n\n Test if an enumeration value has a particular flag set, using 'logical and'. \n The relevant enumeration type is inferred from context.\n\n\n\n\n Convert an enumeration value to an integer. The argument type is inferred from context.\n\n\n\n\n Simple operations to convert between .NET enuemration types and integers\n\n\n\n\n Returns the sum of a and b\n\n\n\n\n Compares a and b and returns 1 if a > b, -1 if b < a and 0 if a = b\n\n\n\n\n Returns a divided by b \n\n\n\n\n Returns a multiplied by b \n\n\n\n\n Returns -a\n\n\n\n\n Converts a raw 32-bit representation to a 32-bit float\n\n\n\n\n Converts a 64-bit float to a 32-bit float\n\n\n\n\n Converts a 32-bit integer to a 32-bit float\n\n\n\n\n Converts a 32-bit integer to a 32-bit float\n\n\n\n\n Converts a 64-bit integer to a 32-bit float\n\n\n\n\n Converts a string to a 32-bit float\n\n\n\n\n Returns a minus b \n\n\n\n\n Converts a 32-bit float to raw 32-bit representation \n\n\n\n\n Converts a 32-bit float to a 64-bit float\n\n\n\n\n Converts a 32-bit float to a 32-bit integer\n\n\n\n\n Converts a 32-bit float to a 32-bit integer\n\n\n\n\n Converts a 32-bit float to a 64-bit integer \n\n\n\n\n Converts a 32-bit float to a string\n\n\n\n\n ML-like operations on 32-bit System.Single floating point numbers.\n\n\n\n\n Returns the sum of a and b\n\n\n\n\n Compares a and b and returns 1 if a > b, -1 if b < a and 0 if a = b\n\n\n\n\n Returns a divided by b \n\n\n\n\n Returns a multiplied by b \n\n\n\n\n Returns -a\n\n\n\n\n Converts a raw 64-bit representation to a 64-bit float\n\n\n\n\n Converts a 32-bit float to a 64-bit float\n\n\n\n\n Converts a 32-bit integer to a 64-bit float\n\n\n\n\n Converts a 32-bit integer to a 64-bit float\n\n\n\n\n Converts a 64-bit integer to a 64-bit float\n\n\n\n\n Converts a string to a 64-bit float\n\n\n\n\n Returns a minus b \n\n\n\n\n Converts a 64-bit float to raw 64-bit representation \n\n\n\n\n Converts a 64-bit float to a 32-bit float\n\n\n\n\n Converts a 64-bit float to a 32-bit integer\n\n\n\n\n Converts a 64-bit float to a 32-bit integer\n\n\n\n\n Converts a 64-bit float to a 64-bit integer \n\n\n\n\n Converts a 64-bit float to a string\n\n\n\n\n ML-like operations on 64-bit System.Double floating point numbers.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Returns the absolute value of the argument\n\n\n\n\n Returns the sum of a and b\n\n\n\n\n Converts a 64-bit float to a raw 32-bit representation \n\n\n\n\n Converts a 32-bit float to a raw 32-bit representation \n\n\n\n\n Compares a and b and returns 1 if a > b, -1 if b < a and 0 if a = b\n\n\n\n\n Returns a divided by b \n\n\n\n\n Converts a raw 32-bit representation to a 32-bit float\n\n\n\n\n Converts a raw 32-bit representation to a 64-bit float\n\n\n\n\n Combines the binary representation of a and b by bitwise and\n\n\n\n\n Returns the bitwise logical negation of a\n\n\n\n\n Combines the binary representation of a and b by bitwise or\n\n\n\n\n Combines the binary representation of a and b by bitwise xor\n\n\n\n\n Returns the largest 32-bit signed integer\n\n\n\n\n Returns the smallest 32-bit signed integer\n\n\n\n\n The value minus one as a System.Int32\n\n\n\n\n Returns a multiplied by b \n\n\n\n\n Returns -a\n\n\n\n\n Converts a 64-bit float to a 32-bit integer\n\n\n\n\n Converts a 32-bit float to a 32-bit integer\n\n\n\n\n Converts a 32-bit integer to a 32-bit integer (included for ML compatability)\n\n\n\n\n Converts a 64-bit unsigned integer to a 32-bit integer \n\n\n\n\n Converts a 32-bit unsigned integer to a 32-bit integer \n\n\n\n\n Converts a string to a 32-bit integer \n\n\n\n\n Converts a 32-bit unsigned integer to a 32-bit integer \n\n\n\n\n The value one as a System.Int32\n\n\n\n\n Returns the predeccessor of the argument \n\n\n\n\n Returns the remainder of a divided by b\n\n\n\n\n Shifts the binary representation a by n bits to the left\n\n\n\n\n Shifts the binary representation a by n bits to the right; high-order empty bits are set to the sign bit\n\n\n\n\n Shifts the binary representation a by n bits to the right; high-order bits are zero-filled\n\n\n\n\n Returns a minus b \n\n\n\n\n Returns the successor of the argument \n\n\n\n\n Converts a 32-bit integer to a 64-bit float \n\n\n\n\n Converts a 32-bit integer to a 32-bit float \n\n\n\n\n Converts a 32-bit integer to a 32-bit integer (included for ML compatability)\n\n\n\n\n Converts a 32-bit unsigned integer to a 64-bit integer \n\n\n\n\n Converts a 32-bit unsigned integer to a 32-bit integer \n\n\n\n\n Converts a 32-bit integer to a string \n\n\n\n\n Converts a 32-bit integer to a 32-bit unsigned integer \n\n\n\n\n The value zero as a System.Int32\n\n\n\n\n Basic operations on 32-bit integers. The type int32 is identical to System.Int32. \n\n\n\n\n Returns the absolute value of the argument\n\n\n\n\n Returns the sum of a and b\n\n\n\n\n Converts a 64-bit float to a raw 64-bit representation \n\n\n\n\n Compares a and b and returns 1 if a > b, -1 if b < a and 0 if a = b\n\n\n\n\n Returns a divided by b \n\n\n\n\n Converts a raw 64-bit representation to a 64-bit float\n\n\n\n\n Combines the binary representation of a and b by bitwise and\n\n\n\n\n Returns the bitwise logical negation of a\n\n\n\n\n Combines the binary representation of a and b by bitwise or\n\n\n\n\n Combines the binary representation of a and b by bitwise xor\n\n\n\n\n Returns the largest 64-bit signed integer\n\n\n\n\n Returns the smallest 64-bit signed integer\n\n\n\n\n The value minus one as a System.Int64\n\n\n\n\n Returns a multiplied by b \n\n\n\n\n Returns -a\n\n\n\n\n Converts a 64-bit float to a 64-bit integer\n\n\n\n\n Converts a 32-bit float to a 64-bit integer\n\n\n\n\n Converts a 32-bit integer to a 64-bit integer\n\n\n\n\n Converts a 32-bit integer to a 64-bit integer\n\n\n\n\n Converts a native integer to a 64-bit integer\n\n\n\n\n Converts a string to a 64-bit integer \n\n\n\n\n Converts an unsigned 64-bit integer to a 64-bit integer\n\n\n\n\n The value one as a System.Int64\n\n\n\n\n Returns the predeccessor of the argument \n\n\n\n\n Returns the remainder of a divided by b\n\n\n\n\n Shifts the binary representation a by n bits to the left\n\n\n\n\n Shifts the binary representation a by n bits to the right; high-order empty bits are set to the sign bit\n\n\n\n\n Shifts the binary representation a by n bits to the right; high-order bits are zero-filled\n\n\n\n\n Returns a minus b \n\n\n\n\n Returns the successor of the argument \n\n\n\n\n Converts a 64-bit integer to a 64-bit float \n\n\n\n\n Converts a 64-bit integer to a 32-bit float \n\n\n\n\n Converts a 64-bit integer to a 32-bit integer\n\n\n\n\n Converts a 64-bit integer to a 32-bit integer\n\n\n\n\n Converts a 64-bit integer to a native integer \n\n\n\n\n Converts a 64-bit integer to a string\n\n\n\n\n Converts a 64-bit integer to an unsigned 64-bit integer\n\n\n\n\n The value zero as a System.Int64\n\n\n\n\n Basic operations on 64-bit integers. The type int64 is identical to System.Int64. \n\n\n\n\n\n\n\n Build a lazy (delayed) value from the given computation\n\n\n\n\n See Lazy.Force\n\n\n\n\n See Lazy.Force.\n\n\n\n\n See Lazy.SynchronizedForce.\n\n\n\n\n See Lazy.UnsynchronizedForce\n\n\n\n\n Build a lazy (delayed) value from the given computation\n\n\n\n\n Build a lazy (delayed) value from the given pre-computed value.\n\n\n\n\n Check if a lazy (delayed) value has already been computed\n\n\n\n\n\n\n\n\n\n\n Lookup key's data in association list, uses (=) equality.\n Raise System.IndexOutOfRangeException exception if key not found, in which case you should typically use try_assoc instead.\n\n\n\n\n See assoc, but uses the physical equality operator (==) for equality tests\n\n\n\n\n Is an element in the list. Elements are compared using generic equality.\n\n\n\n\n\n\n\n Is an element in the list. Elements are compared using generic equality.\n\n\n\n\n Does the key have pair in the association list?\n\n\n\n\n See mem_assoc, but uses the physical equality operator (==) for equality tests. \n\n\n\n\n See mem, but uses the physical equality operator (==) for equality tests. \n\n\n\n\n Return true if the list is not empty.\n\n\n\n\n Remove pair for key from the association list (if it's there).\n\n\n\n\n See remove_assoc, but uses the physical equality operator (==) for equality tests. \n\n\n\n\n \"rev_append l1 l2\" evaluates to \"append (rev l1) l2\"\n\n\n\n\n \"rev_map f l1\" evaluates to \"map f (rev l1)\"\n\n\n\n\n \"rev_map2 f l1 l2\" evaluates to \"map2 f (rev l1) (rev l2)\"\n\n\n\n\n\n\n\n\n\n\n Like reduce_left, but return both the intermediary and final results\n\n\n\n\n Like reduce_right, but return both the intermediary and final results\n\n\n\n\n Lookup key's data in association list, uses (=) equality,\n returning \"Some data\" or \"None\". \n\n\n\n\n See try_assoc, but uses the physical equality operator (==) for equality tests. \n\n\n\n\n\n\n\n Compatibility operations on lists. \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n A collection of operations for creating and using maps based on a particular comparison function.\n The 'Tag type parameter is used to track information about the comparison function.\n\n\n\n\n For use when not opening the Map module, e.g. Map.t\n\n\n\n\n\n\n\n A functor to build a collection of operations for creating and using \n maps based on the given comparison function. This returns a record that \n contains the functions you use to create and manipulate maps of\n this kind. The returned value is much like an ML module. \n\n Language restrictions related to polymorphism may mean you\n have to create a new instantiation of for each toplevel\n key/value type pair.\n\n To use this function you need to define a new named class that implements IComparer and\n pass an instance of that class as the first argument. For example:\n type MyComparer = \n new() = { }\n interface IComparer<string> with \n member self.Compare(x,y) = ...\n\n let MyStringMapProvider : Map.Provider < string,int > = Map.MakeTagged(new MyComparer())\n\n\n\n\n Fold over the bindings in the map \n\n\n\n\n Extension functionality for maps using structural comparison\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Big_int compatability module for arbitrary sized integers.\n\n\n\n\n\n\n\n Add second buffer to the first.\n\n\n\n\n Read the given number of bytes as ASCII and add the resulting string \n to the buffer. Warning: this assumes an ASCII encoding for the I/O channel, i.e. it uses \n Pervasives.really_input and then use ascii_to_string to produce the string \n to add. \n\n\n\n\n Add character to the buffer.\n\n\n\n\n Add string to the buffer.\n\n\n\n\n Given a string, start position and length add that substring to the buffer.\n\n\n\n\n Clears the buffer.\n\n\n\n\n Gets the string built from the buffer.\n\n\n\n\n Create a buffer with suggested size.\n\n\n\n\n Number of characters in the buffer.\n\n\n\n\n\n\n\n Clears the buffer (same as Buffer.clear).\n\n\n\n\n Imperative buffers for building strings, a shallow interface to System.Text.StringBuilder\n\n\n\n\n \"dirname\" and \"basename\" decompose a filename into a directory name\n and a filename, i.e. \"concat (dirname s) (basename s) = s\"\n\n\n\n\n \"check_suffix f s\" returns true if filename \"f\" ends in suffix \"s\",\n e.g. check_suffix \"abc.fs\" \".fs\" returns true.\n\n\n\n\n \"chop_extension f\" removes the extension from the given\n filename. Raises ArgumentException if no extension is present.\n\n\n\n\n Assuming \"check_suffix f s\" holds, \"chop_suffix f s\" returns the\n filename \"f\" with the suffix \"s\" removed.\n\n\n\n\n \"concat a b\" returns System.IO.Path.Combine(a,b), i.e. the\n two names conjoined by the appropriate directory separator character\n for this architecture.\n\n\n\n\n The name used for the current directory on this OS. \n\n\n\n\n \"dirname\" and \"basename\" decompose a filename into a directory name\n and a filename, i.e. \"concat (dirname s) (basename s) = s\"\n\n\n\n\n Return true if the filename has a \".\" extension\n\n\n\n\n Returns true if the path is relative to the current directory but does not begin with \n an explicit \".\" or \"..\"\n\n\n\n\n Is the path is relative to the current directory or absolute.\n\n\n\n\n \"parent_dir_name\" returns the name for the directory above the current directory on\n this OS.\n\n\n\n\n \"quote s\" is designed for use to quote a filename when using it\n for a system command. It returns (\"\\'\" ^ s ^ \"\\'\"). \n\n\n\n\n \"temp_file f s\" returns a hitherto unused new file name. \"f\" and \"s\"\n are hints as to a suitable file name and suffix for the file.\n\n\n\n\n Common filename operations. This module is included to make it possible to cross-compile \n code with other ML compilers. See also System.IO.Path\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nA collection of operations for creating and using hash tables based on particular type-tracked hash/equality functions.\nGenerated by the Hashtbl.Make and Hashtbl.MakeTagged functors. This type is for use when you wish to\nspecify a comparison function once and carry around an object that is a provider of (i.e. a factory for) hashtables \nthat utilize that comparison function.\n\nThe 'Tag' type parameter is used to track information about the comparison function, which helps ensure \nthat you don't mixup maps created with different comparison functions\n\n\n\n\n OCaml compatible type name, for use when not opening module, e.g. Hashtbl.t\n\n\n\n\n Build a collection of operations for creating and using \n hashtables based on the given hash/equality functions. This returns a record\n that contains the functions you use to create and manipulate tables of\n this kind. The returned value is much like an ML module. You should call Make once for \n each new pair of key/value types. You may need to constrain the result \n to be an instantiation of Provider.\n\n let MyStringHashProvider : Provider<string,int> = Hashtbl.Make(myStringHash,myStringEq)\n\n\n\n\n Same as Make, except track the comparison function being used through an additional type parameter.\n\n To use this function accurately you need to define a new named class that implements IEqualityComparer and\n pass an instance of that class as the first argument. For example:\n type MyHasher = \n class\n new() = { }\n interface IEqualityComparer<string> with \n member self.GetHashCode(x) = ...\n member self.Equals(x,y) = ...\n end\n end\n\n let MyStringHashProvider : Hashtbl.Provider<string,int> = Hashtbl.MakeTagged(new MyStringHasher())\n\n\n\n\n Add key and data to the table.\n\n\n\n\n Empty the table.\n\n\n\n\n Create a copy of the table. Remember they are imperative and get mutated. \n\n\n\n\n Create a hash table with the suggested initial size. \n\n Inlined to enable generation of efficient hash routines for the key type in the common case.\n\n\n\n\n Lookup key's data in the table.\n Raises exception is key not in table, if this could happen you should be using tryfind.\n\n\n\n\n Return all bindings for the given key\n\n\n\n\n Fold over all bindings\n\n\n\n\n Hash on the structure of a value according to the F# structural hashing\n conventions. See Pervasives.hash\n\n\n\n\n Hash on the identity of an object. See Pervasives.hashq.\n\n\n\n\nApply the given function to each binding in the hash table \n\n\n\n\n Test for the existence of any bindings for the given key\n\n\n\n\n Create a hash table using the given data\n\n\n\n\n Create hash table using the given data\n\n Inlined to enable generation of efficient hash routines for the key type in the common case.\n\n\n\n\n Remove the latest binding for the given key\n\n\n\n\n Replace the latest binding for the given key\n\n\n\n\n Lookup the key's data in the table\n\n\n\n\n Multi-entry hash tables using the structural \"hash\" and \"equals\" functions. \n\nThese tables can be used with keys of any type, but you should check that\nstructural hashing and equality are correct for your key type. \nStructural hashing is efficient but not a suitable choice in all circumstances, \ne.g. may not hash efficiently on non-reference types and deeply-structured types.\nBetter efficiency is typically achieved if key types are F#-generated\ntypes.\n\nThese hash tables may map items to multiple keys (see find_all).\n\nThe implementations are not safe for concurrent reading/writing,\nand so users of these tables should take an appropriate lock\nbefore reading/writing if used in a concurrent setting.\n\n\n\n\n ASCII LexBuffers \n\n The type \"lexbuf\" is opaque, but has an internal position information field \n that can be updated by setting \"lexbuf.EndPos\", for example if you wish \n to update the other fields in that position data before or during \n lexing. You will need to do this if you wish to maintain accurate \n line-count information. If you do this and wish to maintain strict \n cross-compiling compatibility with OCamlLex and other tools you may need code \n to conditionally use lexbuf_set_curr_p when compiling F# code.\n\n\n\n\n\n\n\n Remove all input, though don't discard the except the current lexeme \n\n\n\n\n Fuel a lexer using the given BinaryReader. \n\n\n\n\n Fuel a lexer from an array of bytes\n\n\n\n\n Fuel a lexer using the given in_channel. The bytes are read using Pervasives.input.\n If the in_channel is a textual channel the bytes are \n presented to the lexer by decoding the characters using System.Text.Encoding.ASCII.\n\n\n\n\n Fuel a lexer from function that fills an array of bytes up to the given length, returning the\n number of bytes filled.\n\n\n\n\n Fuel a lexer from a string, converted to ascii using System.Text.Encoding.ASCII.GetBytes\n\n\n\n\n Fuel a lexer using the given TextReader or StreamReader.\n The characters read are decoded to bytes using the given encoding (e.g. System.Text.Encoding.ASCII)\n and the bytes presented to the lexer. The encoding used to decode the characters\n is associated with the expectations of the lexer (e.g. a lexer may be constructed to accept only \n ASCII or pseudo-UTF8 bytes) and will typically be different to \n the encoding used to decode the file.\n\n\n\n\n same as lexeme_end_p \n\n\n\n\n\n\n\n\n\n\n Return the matched string \n\n\n\n\n Return the bytes for the matched string \n\n\n\n\n Return a character from the matched string, innterpreting the bytes using an ASCII encoding\n\n\n\n\n Return absolute positions into the entire stream of characters\n\n\n\n\n Return the positions stored in the lexbuf for the matched string \n\n\n\n\n Return absolute positions into the entire stream of characters\n\n\n\n\n Return the positions stored in the lexbuf for the matched string \n\n\n\n\n Return the matched string interpreting the bytes using the given Unicode text encoding\n\n\n\n\n Lexing: ML-like lexing support\n\n This file maintains rough compatibility for lexbuffers used by some ML\n laxer generators. The lexbuf carries an associated pair of positions.\n Beware that only the \"cnum\" (absolute character number) field is automatically \n updated as each lexeme is matched. Upon each successful match the prior end\n position is transferred to be the start position and a new start position\n is allocated with an updated pos_cnum field.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n See Microsoft.FSharp.Core.LanguagePrimitives.PhysicalEquality\n\n\n\n\n\n\n\n Negation of Obj.eq (i.e. reference/physical inequality)\n\n\n\n\n\n\n\n See Microsoft.FSharp.Core.Operators.unbox\n\n\n\n\n See Microsoft.FSharp.Core.Operators.box\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n You can initialize error recovery by raising the Parse_error exception. \n\n\n\n\n Parsing: parser support for parsers produced by fsyacc.\n\n Parsers generated by fsyacc provide location information within parser\n actions. However that information is not available globally, but\n rather is accessed via the functions available on the following local\n variable which is available in all parser actions:\n\n parseState : 'a Microsoft.FSharp.Text.Parsing.IParseState\n\n However, this is not compatible with the parser specifications used\n with ocamlyacc and similar tools, which make a single parser state available\n globally. If you wish to use a global parser state (e.g. so your code will\n cross-compile with OCaml) then you can use the functions in this file.\n You will need to either generate the parser with '--ml-compatibility' option \n or add the code\n\n Parsing.set_parse_state parseState;\n\n at the start of each action of your grammar. The functions below\n simply report the results of corresponding calls to the latest object\n specified by a call to set_parse_state.\n\n Note that there could be unprotected multi-threaded concurrent access for the\n parser information, so you should not in general use these\n functions if there may be more than one parser active, and\n should instead use the functions directly available from the parseState\n object.\n\n\n\n\n\n\n\n\n\n\n\n\n\n A pseudo-abstraction over binary and textual input channels.\n OCaml-compatible channels conflate binary and text IO, and for this reasons their\n use from F# is somewhat deprecated (direct use of System.IO StreamReader, TextReader and \n BinaryReader objects is preferred, e.g. see System.IO.File.OpenText). \n Well-written OCaml-compatible code that simply opens either a channel in text or binary \n mode and then does text or binary I/O using the OCaml-compatible functions below\n will work, though care must be taken with regard to end-of-line characters (see \n input_char below).\n\n This library pretends that an in_channel is just a System.IO.TextReader. Channel values\n created using open_in_bin maintain a private System.IO.BinaryReader, which will be used whenever\n you do I/O using this channel. \n\n InChannel.of_BinaryReader and InChannel.of_StreamReader allow you to build input \n channels out of the corresponding .NET abstractions.\n\n\n\n\n This type is present primarily for compatibility with other versions of ML. When\n not cross-compiling we recommend using the .NET I/O libraries\n\n\n\n\n An pseudo-abstraction over binary and textual output channels.\n OCaml-compatible channels conflate binary and text IO, and for this reasons their\n use from F# is somewhat deprecated The direct use of System.IO StreamWriter, TextWriter and \n BinaryWriter objects is preferred, e.g. see System.IO.File.CreateText). Well-written OCaml code \n that simply opens either a channel in text or binary mode and then does text \n or binary I/O using the OCaml functions will work, though care must \n be taken with regard to end-of-line characters (see output_char below).\n\n This library pretends that an out_channel is just a System.IO.TextWriter. Channels\n created using open_out_bin maintain a private System.IO.BinaryWriter, which will be used whenever\n do I/O using this channel. \n\n\n\n\n The exception thrown by invalid_arg and misues of F# library functions\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Close the channel\n\n\n\n\n Close the given output channel\n\n\n\n\n This value is present primarily for compatibility with other versions of ML\n The smallest value that when added to 1.0 gives a different value to 1.0\n\n\n\n\n\n\n\n\n\n\n Flush all pending output on the channel to the physical\n output device.\n\n\n\n\n Return the length of the input channel\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Attempt to input the given number of bytes from the channel, writing them into the\n buffer at the given start position. Does not block if the bytes are not available.\n\n The use of this function with a channel performing byte-to-character translation (e.g. one\n created with open_in, open_in_utf8 or open_in_encoded, or one \n or built from a StreamReader or TextReader) is not recommended.\n Instead, open the channel using open_in_bin or InChannel.of_BinaryReader.\n\n If used with a StreamReader channel, i.e. one created using \n open_in, open_in_utf8 or open_in_encoded, or one \n or built from a StreamReader, this function reads bytes directly from the underlying\n BaseStream. This may not be appropriate if any other input techniques are being\n used on the channel.\n\n If used with a TextReader channel (e.g. stdin), this function reads characters from the\n stream and then fills some of the byte array with the decoding of these into \n bytes, where the decoding is performed using the System.Text.Encoding.Default encoding\n\n Raise End_of_file (= System.IO.EndOfStreamException) if end of file reached.\n\n\n\n\n Input a binary integer from a binary channel. Compatible with output_binary_int.\n\n\n\n\n Input a single byte. \n For text channels this only accepts characters with a UTF16 encoding that fits in a byte, e.g. ASCII.\n Raise End_of_file (= System.IO.EndOfStreamException) if end of file reached.\n\n\n\n\n Input a single character. Raise End_of_file (= System.IO.EndOfStreamException) if end of file reached.\n\n\n\n\n Attempt to input characters from a channel. Does not block if inpout is not available.\n Raise End_of_file (= System.IO.EndOfStreamException) if end of file reached.\n\n No CRLF translation is done on input, even in text mode. That is, if an input file\n has '\\r\\n' (CRLF) line terminators both characters will be seen in the input.\n\n\n\n\n Input a single line. Raise End_of_file (= System.IO.EndOfStreamException) if end of file reached.\n\n\n\n\n Input a single serialized value from a binary stream. Raise End_of_file (= System.IO.EndOfStreamException) if end of file reached.\n\n\n\n\n Negation on integers of the 'int' type\n\n\n\n\n\n\n\n\n\n\n\n\n\n Throw an Invalid_argument exception\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n This value is present primarily for compatibility with other versions of ML\n The highest representable positive value in the 'float' type\n\n\n\n\n The highest representable value in the 'int' type\n\n\n\n\n This value is present primarily for compatibility with other versions of ML\n The lowest non-denormalized positive IEEE64 float\n\n\n\n\n The lowest representable value in the 'int' type\n\n\n\n\n\n\n\n This value is present primarily for compatibility with other versions of ML\n\n\n\n\n This value is present primarily for compatibility with other versions of ML\n\n\n\n\n This value is present primarily for compatibility with other versions of ML\n\n\n\n\n 1D Array element set-accessor ('setter')\n\n\n\n\n 1D Array element get-accessor ('getter')\n\n\n\n\n Negation of the '==' operator, see also Obj.eq\n\n\n\n\n This value is present primarily for compatibility with other versions of ML. In F#\n the overloaded operators may be used.\n\n\n\n\nReference/physical equality. \nTrue if boxed versions of the inputs are reference-equal, OR if\nboth are value types and the implementation of Object.Equals for the type\nof the first argument returns true on the boxed versions of the inputs. \n\nIn normal use on reference types or non-mutable value types this function \nhas the following properties:\n - returns 'true' for two F# values where mutation of data\n in mutable fields of one affects mutation of data in the other\n - will return 'true' if (=) returns true\n - hashq will return equal hashes if (==) returns 'true'\n\nThe use on mutable value types is not recommended.\n\n\n\n\n This value is present primarily for compatibility with other versions of ML. In F#\n the overloaded operators may be used.\n\n\n\n\n This value is present primarily for compatibility with other versions of ML\n\n\n\n\n This value is present primarily for compatibility with other versions of ML. In F#\n the overloaded operators may be used.\n\n\n\n\n This value is present primarily for compatibility with other versions of ML. In F#\n the overloaded operators may be used.\n\n\n\n\n This value is present primarily for compatibility with other versions of ML. In F#\n the overloaded operators may be used.\n\n\n\n\n Open the given file to read. \n\nIn the absence of an explicit encoding (e.g. using Open_encoding) open_in\nuses the default text encoding (System.Text.Encoding.Default). If you want to read a file\nregardless of encoding then you should use binary modes. Note that .NET's \n\"new StreamReader\" function defaults to use a utf8 encoding, and also attempts\nto determine an automatic encoding by looking for \"byteorder-marks\" at the head\nof a text file. This function does not do this.\n\n No CR-LF translation is done on input.\n\n\n\n\n Open the given file to read in binary-mode \n\n\n\n\n Open the given file in the mode specified by the given flags\n\n\n\n\n Open the given file to read in text-mode using the UTF8 encoding\n\n\n\n\n Open the given file to write in text-mode using the\n System.Text.Encoding.Default encoding\n\n See output_char for a description of CR-LF translation\n done on output.\n\n\n\n\n Open the given file to write in binary-mode \n\n\n\n\n Open the given file to write in text-mode using the given encoding\n\n\n\n\n Open the given file to write in the mode according to the specified flags\n\n\n\n\n Open the given file to write in text-mode using the UTF8 encoding\n\n\n\n\n Return the length of the output channel. \n Raise an exception if not an app\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Write the given range of bytes to the output channel. \n\n\n\n\n Write the given integer to the output channel in binary format.\n Only valid on binary channels.\n\n\n\n\n Write the given byte to the output channel. No CRLF translation is\n performed.\n\n\n\n\n Write all the given bytes to the output channel. No CRLF translation is\n performed.\n\n\n\n\n Write the given Unicode character to the output channel. \n\n If the output channel is a binary stream and the UTF-16 value of the Unicode character is greater\n than 255 then ArgumentException is thrown.\n\n No CRLF translation is done on output. That is, if the output character is\n '\\n' (LF) characters they will not be written as '\\r\\n' (CRLF) characters, regardless\n of whether the underlying operating system or output stream uses CRLF as the default\n line-feed character.\n\n\n\n\n Write the given Unicode string to the output channel. See output_char for the treatment of\n '\\n' characters within the string.\n\n\n\n\n Serialize the given value to the output channel.\n\n\n\n\n Report the current position in the input channel\n\n\n\n\n Return the current position in the output channel, measured from the\n start of the channel. Not valid on all channels.\n\n\n\n\n n-1 (no overflow checking)\n\n\n\n\n Print a character to the stderr stream\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nRead a floating point number from the console.\n\n\n\n\nRead an integer from the console.\n\n\n\n\nRead a line from the console, without the end-of-line character.\n\n\n\n\n Reads bytes from the channel. Blocks if the bytes are not available.\n See 'input' for treatment of text channels.\n Raise End_of_file (= System.IO.EndOfStreamException) if end of file reached.\n\n\n\n\n Reads bytes from the channel. Blocks if the bytes are not available.\n For text channels this only accepts UTF-16 bytes with an encoding less than 256.\n Raise End_of_file (= System.IO.EndOfStreamException) if end of file reached.\n\n\n\n\n Set the current position in the output channel, measured from the\n start of the channel.\n\n\n\n\n Set the binary mode to true or false. If the binary mode is changed from \"true\" to \n \"false\" then a StreamReader is created to read the binary stream. The StreamReader uses \n the default text encoding System.Text.Encoding.Default\n\n\n\n\n Set the binary mode. If the binary mode is changed from \"true\" to \n \"false\" then a StreamWriter is created to write the binary stream. The StreamWriter uses \n the default text encoding System.Text.Encoding.Default.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n n+1 (no overflow checking)\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n The exception thrown by 'assert' failures.\n A future release of F# may map this exception to a corresponding .NET exception.\n\n\n\n\n\n\n\n\n\n\n\n\n\n Non-exhaustive match failures will raise Match failures\n A future release of F# may map this exception to a corresponding .NET exception.\n\n\n\n\n\n\n\n\n\n\nLink .NET IO with the out_channel/in_channel model\n\n\n\n\n Wrap a stream by creating a StreamReader for the \n stream and then wrapping is as an input channel.\n A text encoding must be given, e.g. System.Text.Encoding.UTF8\n\n\n\n\nLink .NET IO with the out_channel/in_channel model\n\n\n\n\nLink .NET IO with the out_channel/in_channel model\n\n\n\n\n Access the underlying stream-based objects for the channel\n\n\n\n\nLink .NET IO with the out_channel/in_channel model\n\n\n\n\n Access the underlying stream-based objects for the channel\n\n\n\n\n Access the underlying stream-based objects for the channel\n\n\n\n\n\n\n\nLink .NET IO with the out_channel/in_channel model\n\n\n\n\n Wrap a stream by creating a StreamWriter for the \n stream and then wrapping is as an output channel.\n A text encoding must be given, e.g. System.Text.Encoding.UTF8\n\n\n\n\nLink .NET IO with the out_channel/in_channel model\n\n\n\n\nLink .NET IO with the out_channel/in_channel model\n\n\n\n\n Access the underlying stream-based objects for the channel\n\n\n\n\n Access the underlying stream-based objects for the channel\n\n\n\n\n Access the underlying stream-based objects for the channel\n\n\n\n\n Access the underlying stream-based objects for the channel\n\n\n\n\n\n\n\n\n\n\nThe type of simple immutable lists \n\n\n\n\nThe type of None/Some options\n\n\n\n\nThe type of pointers to mutable reference cells\n\n\n\n\nAbsolute value of the given integer\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nStructural comparison\n\n\n\n\n\n\n\n\n\n\nDecrement a mutable reference cell containing an integer\n\n\n\n\nExit the current hardware isolated process, if security settings permit,\notherwise raise an exception. Calls System.Environment.Exit.\n\n\n\n\n\n\n\n Throw a 'Failure' exception\n\n\n\n\n\n\n\n\n\n\n\n\n\nThe \"hash\" function is a structural hash function. It is \ndesigned to return equal hash values for items that are \nequal according to the polymorphic equality \nfunction Pervasives.(=) (i.e. the standard \"=\" operator).\n\n\n\n\n\n\n\nIncrement a mutable reference cell containing an integer\n\n\n\n\n\n\n\n\n\n\n\n\n\nMaximum based on structural comparison\n\n\n\n\nMinimum based on structural comparison\n\n\n\n\n\n\n\n\n\n\n\n\n\n Concatenate two lists.\n\n\n\n\nAssign to a mutable reference cell\n\n\n\n\n Concatenate two strings. The overlaoded operator '+' may also be used.\n\n\n\n\nDereference a mutable reference cell\n\n\n\n\n\n\n\nStructural equality\n\n\n\n\n\n\n\nStructural greater-than\n\n\n\n\nStructural greater-than-or-equal\n\n\n\n\nStructural inequality\n\n\n\n\nStructural less-than comparison\n\n\n\n\nStructural less-than-or-equal comparison\n\n\n\n\n\n\n\n\n\n\n Throw an exception\n\n\n\n\nCreate a mutable reference cell\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n The exception thrown by failure and many other F# functions\n A future release of F# may map this exception to a corresponding .NET exception.\n\n\n\n\n\n\n\nPervasives: Additional OCaml-compatible bindings \n\n\n\n\n\n\n\n\n\n\n Compatibility module to display data about exceptions.\n\n\n\n\n The array of command line options. Gives the command line arguments\n as returned by System.Environment.GetCommandLineArgs.\n\n\n\n\n Sets the current working directory for the process using System.IO.Directory.SetCurrentDirectory \n\n\n\n\n Run the command and return it's exit code.\n\n Warning: 'command' currently attempts to execute the string using \n the 'cmd.exe' shell processor. If it is not present on the system \n then the operation will fail. Use System.Diagnostics.Process \n directly to run commands in a portable way, which involves specifying \n the program to run and the arguments independently.\n\n\n\n\n Path of the current executable, using\n System.IO.Path.Combine(System.AppDomain.CurrentDomain.BaseDirectory,System.AppDomain.CurrentDomain.FriendlyName)\n\n\n\n\n Returns true if a file currently exists, using System.IO.File.Exists(s).\n\n\n\n\n Returns the current working directory for the process using System.IO.Directory.GetCurrentDirectory\n\n\n\n\n Call System.Environment.GetEnvironmentVariable. Raise KeyNotFoundException if the variable is not defined.\n\n\n\n\n Deletes a file using System.IO.File.Delete.\n\n\n\n\n Rename a file on disk using System.IO.File.Move \n\n\n\n\n Time consumed by the main thread. (for approximate timings).\n Generally returns only the processor time used by the main \n thread of the application.\n\n\n\n\n The number of bits in the \"int\" type.\n\n\n\n\n Sys: Basic system operations (for ML compatibility)\n\n This module is only included to make it possible to cross-compile \n code with other ML compilers. It may be deprecated and/or removed in \n a future release. You may wish to use .NET functions directly instead. \n\n\n\n\n The identity permutation over any size\n\n\n\n\n\n\n\n Create a permutation by specifying the result of permuting [| 0 .. n-1 |]. For example, \n Permutation.of_array [| 1;2;0 |] specifies a permutation that rotates all elements right one place.\n\n\n\n\n Create a permutation by specifying (source,destination) index pairs. For example,\n Permutation(3,[ (0,2);(1,0); (2,1) ]) specifies a permutation that rotates \n all elements left one place. Not all elements need be given, e.g. \n Permutation(5,[ (1,2);(2,1) |]) specifies a permutation that swaps elements at indexes\n 1 and 2.\n\n\n\n\n Return a permutation that, when applied, maps index 0 to size-1, size-1 to 0 etc.\n\n\n\n\n Return a permutation that rotates right by the given distance. If the distance\n is negative then a left rotation results.\n\n\n\n\n Return a swaps the given two elements over any size\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Simple operations on signed bytes\n\n\n\n\n A synonym for Seq.zip\n\n\n\n\n Return an IEnumerable that when iterated yields\n the given item followed by the items in the given sequence\n\n\n\n\n\n\n\n\n\n\n Return true if the IEnumerable is not empty.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nA collection of operations for creating and using sets based on a particular comparison function.\nThe 'Tag' type parameter is used to track information about the comparison function.\n\n\n\n\n For use when not opening the Set module, e.g. Set.t\n\n\n\n\n Build a collection of operations for creating and using \n maps based on a single consistent comparison function. This returns a record\n that contains the functions you use to create and manipulate maps all of which \n use this comparison function. The returned value is much like an ML module. \n\n Use MakeTagged if you want additional type safety that guarantees that two sets\n based on different comparison functions can never be combined in inconsistent ways.\n\n\n\n\nA functor to build a collection of operations for creating and using \n sets based on the given comparison function. This returns a record that \n contains the functions you use to create and manipulate maps of\n this kind. The returned value is much like an ML module. \n\n To use this function you need to define a new named class that implements IComparer and\n pass an instance of that class as the first argument. For example:\n type MyComparer() = \n interface IComparer<string> with \n member self.Compare(x,y) = ...\n\n let MyStringSetProvider = Set.MakeTagged(new MyComparer())\n\n\n\n\n\n\n\nThe elements of the set as a list.\n\n\n\n\nCompute the intersection of the two sets.\n\n\n\n\n Immutable sets implemented via binary trees\n\n\n\n\n Return a string with the first character converted to uppercase.\n\n\n\n\n Compare the given strings using ordinal comparison\n\n\n\n\n Return true is the given string contains the given character\n\n\n\n\n Return true is the given string contains the given character in the\n range specified by the given start index and the given length\n\n\n\n\n Return true is the given string contains the given character in the\n range from the given start index to the end of the string.\n\n\n\n\n Returns the character at the specified position in the string\n\n\n\n\n Return the first index of the given character in the\n string. Raise KeyNotFoundException if\n the string does not contain the given character.\n\n\n\n\n Return the first index of the given character in the\n range from the given start position to the end of the string. \n Raise KeyNotFoundException if\n the string does not contain the given character.\n\n\n\n\n Return a new string with all characters converted to lowercase\n\n\n\n\n Return a string of the given length containing repetitions of the given character\n\n\n\n\n Return s string of length 1 containing the given character\n\n\n\n\n Return true if the string contains the given character prior to the given index\n\n\n\n\n Return the index of the first occurrence of the given character \n from the end of the string proceeding backwards\n\n\n\n\n Return the index of the first occurrence of the given character \n starting from the given index proceeding backwards.\n\n\n\n\n Split the string using the given list of separator characters.\n Trimming is also performed at both ends of the string and any empty\n strings that result from the split are discarded.\n\n\n\n\n Return a substring of length 'length' starting index 'start'.\n\n\n\n\n Removes all occurrences of a set of characters specified in a\n list from the beginning and end of this instance.\n\n\n\n\n Return a string with the first character converted to lowercase.\n\n\n\n\n Return a string with all characters converted to uppercase.\n\n\n\n\n Compatibility module for string processing. Richer string operations\n are available via the member functions on strings and other functionality in\n the System.String type\n and the System.Text.RegularExpressions namespace.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n UInt32: ML-like operations on 32-bit System.UInt32 numbers.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n UInt64: basic operations on 64-bit System.UInt64 numbers.\n\n\n\n\n Wait for the result and commit it\n\n\n\n\n Record the result in the AsyncResultCell.\n Subsequent sets of the result are ignored. This can happen, \n e.g. for a race between a cancellation and a success.\n\n\n\n\n Create a new result cell\n\n\n\n\n A helper type to store a single result from an asynchronous computation and asynchronously\n access its result.\n \n When using .NET 4.0 you can often use Task<'T> instead of this type\n\n\n\n\n Return an asynchronous computation that, when run, either returns a value, raises an exception \n of cancels according to the value of the asynchronous result.\n\n\n\n\n Represents the reified result of an asynchronous computation\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Extensions to the F# Microsoft.FSharp.Control.Async module\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n The type of floating-point matrices. See Microsoft.FSharp.Math\n\n\n\n\n The type of floating-point row vectors. See Microsoft.FSharp.Math\n\n\n\n\n The type of floating-point vectors. See Microsoft.FSharp.Math\n\n\n\n\n Constructs a complex number from both the real and imaginary part.\n\n\n\n\n\n\n\n Builds a matrix from a sequence of sequence of floats.\n\n\n\n\n Builds a (row) vector from a sequence of floats.\n\n\n\n\n Builds a (column) vector from a sequence of floats.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Return the given rational number\n\n\n\n\n Return the negation of a rational number\n\n\n\n\n Return the difference of two rational numbers\n\n\n\n\n Return the product of two rational numbers\n\n\n\n\n This operator is for use from other .NET languages\n\n\n\n\n This operator is for use from other .NET languages\n\n\n\n\n This operator is for use from other .NET languages\n\n\n\n\n This operator is for use from other .NET languages\n\n\n\n\n This operator is for use from other .NET languages\n\n\n\n\n This operator is for use from other .NET languages\n\n\n\n\n Return the ratio of two rational numbers\n\n\n\n\n Return the sum of two rational numbers\n\n\n\n\n Get zero as a rational number\n\n\n\n\n Return the sign of a rational number; 0, +1 or -1\n\n\n\n\n Get one as a rational number\n\n\n\n\n Return the numerator of the normalized rational number\n\n\n\n\n Return a boolean indicating if this rational number is strictly positive\n\n\n\n\n Return a boolean indicating if this rational number is strictly negative\n\n\n\n\n Return the denominator of the normalized rational number\n\n\n\n\n\n\n\n Return the result of converting the given rational number to an integer\n\n\n\n\n Return the result of converting the given rational number to a floating point number\n\n\n\n\n Return the result of converting the given rational number to a big integer\n\n\n\n\n Return the result of raising the given rational number to the given power\n\n\n\n\n Return the result of converting the string to a rational number \n\n\n\n\n\n\n\n Return the result of converting the given integer to a rational number\n\n\n\n\n Return the result of converting the given big integer to a rational number\n\n\n\n\n Return the absolute value of a rational number \n\n\n\n\n The type of arbitrary-sized rational numbers\n\n\n\n\n\n\n\n Unary negation of a complex number\n\n\n\n\n Subtract one complex number from another\n\n\n\n\n Multiply two complex numbers\n\n\n\n\n Multiply a scalar by a complex number \n\n\n\n\n Multiply a complex number by a scalar\n\n\n\n\n Complex division of two complex numbers\n\n\n\n\n Add two complex numbers\n\n\n\n\n The real part of a complex number\n\n\n\n\n The imaginary part of a complex number\n\n\n\n\n The complex number 0+0i\n\n\n\n\n The real part of a complex number\n\n\n\n\n The polar-coordinate phase of a complex number\n\n\n\n\n The complex number 0+1i\n\n\n\n\n The complex number 1+0i\n\n\n\n\n The polar-coordinate magnitude of a complex number\n\n\n\n\n The imaginary part of a complex number\n\n\n\n\n The conjugate of a complex number, i.e. x-yi\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Create a complex number using magnitude/phase polar coordinates\n\n\n\n\n Create a complex number x+ij using rectangular coordinates\n\n\n\n\n\n\n\n Computes the absolute value of a complex number: e.g. Abs x+iy = sqrt(x**2.0 + y**2.0.)\n Note: Complex.Abs(z) is the same as z.Magnitude\n\n\n\n\n The type of complex numbers stored as pairs of 64-bit floating point numbers in rectangular coordinates\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Get the item at the given position in the matrix\n\n\n\n\n Prefix '+' operator. A nop.\n\n\n\n\n Matrix negation. \n\n\n\n\n Point-wise subtraction of two matrices. An InvalidArgument exception will be\n raised if the dimensions do not match.\n\n\n\n\n Matrix multiplication. An InvalidArgument exception will be\n raised if the dimensions do not match.\n\n\n\n\n Matrix-vector multiplication. \n\n\n\n\n Multiply each element of a matrix by the given scalar value\n\n\n\n\n Multiply each element of a matrix by the given scalar value\n\n\n\n\n Pointwise matrix multiplication. An InvalidArgument exception will be\n raised if the dimensions do not match.\n\n\n\n\n Point-wise addition of two matrices. An InvalidArgument exception will be\n raised if the dimensions do not match.\n\n\n\n\n Get the transpose of the matrix.\n\n\n\n\n Get the number of rows in the matrix\n\n\n\n\n Get the number of columns in the matrix\n\n\n\n\n Returns sqrt(sum(norm(x)*(norm(x))) of all the elements of a matrix.\n The element type of the matrix must have an associated instance of INormFloat<'T> (see GlobalAssociations) ((else NotSupportedException)).\n\n\n\n\n Return the non-zero entries of a sparse or dense matrix\n\n\n\n\n Get the item at the given position in the matrix\n\n\n\n\n Indicates if the matrix uses the sparse representation.\n\n\n\n\n Indicates if the matrix uses the dense representation.\n\n\n\n\n Get the internal array of values for a sparse matrix. This property \n should only be used when interoperating with other matrix libraries.\n\n\n\n\n Get the internal array of row offsets for a sparse matrix. This property \n should only be used when interoperating with other matrix libraries.\n\n\n\n\n Get the internal array of column values for a sparse matrix. This property \n should only be used when interoperating with other matrix libraries.\n\n\n\n\n Get the internal array of values for a dense matrix. This property \n should only be used when interoperating with other matrix libraries.\n\n\n\n\n Retrieve the dictionary of numeric operations associated with the element\n type of this matrix. Accessing the property may raise an NotSupportedException if the element\n type doesn't support any numeric operations. The object returned\n may support additional numeric operations such as IFractional: \n this can be determined by a dynamic type test against the object\n returned.\n\n\n\n\n Get the number of (rows,columns) in the matrix\n\n\n\n\n Get the main diagonal of a matrix, as a vector\n\n\n\n\n Convert the matrix to a column vector\n\n\n\n\n Convert the matrix to a row vector\n\n\n\n\n Return a new array containing the elements of the given matrix\n\n\n\n\n Supports the slicing syntax 'A.[idx1..idx2,idx1..idx2] <- B'\n\n\n\n\n Select a range of rows from a matrix\n\n\n\n\n Select a row from a matrix\n\n\n\n\n Select a region from a matrix\n\n\n\n\n Permutes the rows of the matrix.\n\n\n\n\n Permutes the columns of the matrix.\n\n\n\n\n Supports the slicing syntax 'A.[idx1..idx2,idx1..idx2]'\n\n\n\n\n\n\n\n Return the nth diagonal of a matrix, as a vector. Diagonal 0 is the primary\n diagonal, positive diagonals are further to the upper-right of the matrix.\n\n\n\n\n\n\n\n Create a new matrix that is a copy of the given array\n\n\n\n\n Select a range of columns from a matrix\n\n\n\n\n Select a column from a matrix\n\n\n\n\n The type of matrices. The arithmetic operations on the element type are determined by inspection on the element type itself.\n Two representations are supported: sparse and dense. \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Get the transpose of the row vector.\n\n\n\n\n\n\n\n\n\n\n\n\n\n Get the underlying internal array of values for the vector. This property \n should only be used when interoperating with other matrix libraries.\n\n\n\n\n\n\n\n Return a new array containing a copy of the elements of the given vector\n\n\n\n\n Supports the slicing syntax 'rv.[idx1..idx2] <- rv2'\n\n\n\n\n Permute the elements of the row vector.\n\n\n\n\n Supports the slicing syntax 'rv.[idx1..idx2]'\n\n\n\n\n\n\n\n\n\n\n Create a new matrix that is a copy of the given array\n\n\n\n\n The type of row vectors. \n\n\n\n\n Gets an item from the the vector\n\n\n\n\n Return the input vector \n\n\n\n\n Negate a vector\n\n\n\n\n Subtract two vectors, pointwise\n\n\n\n\n Multiply each element of a vector by the given scalar value.\n\n\n\n\n Multiply a column vector and a row vector to produce a matrix\n\n\n\n\n Multiply a vector by a scalar\n\n\n\n\n Pointwise multiplication of two vectors.\n\n\n\n\n Add two vectors, pointwise\n\n\n\n\n Get the transpose of the vector.\n\n\n\n\n Gets the number of rows in the vector\n\n\n\n\n Computes the 2-norm of a vector: sqrt(x.Transpose*x).\n\n\n\n\n Gets the number of entries in the vector\n\n\n\n\n Gets an item from the the vector\n\n\n\n\n Get the underlying internal array of values for the vector. This property \n should only be used when interoperating with other matrix libraries.\n\n\n\n\n Gets the element operations for the element type of the vector, if any\n\n\n\n\n Return a new array containing a copy of the elements of the given vector\n\n\n\n\n Supports the slicing syntax 'v.[idx1..idx2] <- v2'\n\n\n\n\n Permute the elements of the vector.\n\n\n\n\n Supports the slicing syntax 'v.[idx1..idx2]'\n\n\n\n\n\n\n\n\n\n\n Create a new matrix that is a copy of the given array\n\n\n\n\n The type of column vectors. The arithmetic operations on the element type are determined by inspection \n on the element type itself\n\n\n\n\n\n\n\n The type of complex numbers \n\n\n\n\n The type of floating point matrices\n\n\n\n\n The type of floating point row vectors\n\n\n\n\n The type of floating point column vectors\n\n\n\n\n Add two complex numbers\n\n\n\n\n A complex of magnitude 1 and the given phase and , i.e. cis x = mkPolar 1.0 x\n\n\n\n\n The conjugate of a complex number, i.e. x-yi\n\n\n\n\n Cosine\n\n\n\n\n Complex division of two complex numbers\n\n\n\n\n exp(x) = e^x\n\n\n\n\n The imaginary part of a complex number\n\n\n\n\n log(x) is natural log (base e)\n\n\n\n\n The polar-coordinate magnitude of a complex number\n\n\n\n\n Create a complex number using magnitude/phase polar coordinates\n\n\n\n\n\n\n\n Multiply two complex numbers\n\n\n\n\n Multiply a complex number by a scalar\n\n\n\n\n Unary negation of a complex number\n\n\n\n\n The complex number 1+0i\n\n\n\n\n The complex number 0+1i\n\n\n\n\n The polar-coordinate phase of a complex number\n\n\n\n\n pi\n\n\n\n\n The real part of a complex number\n\n\n\n\n Sine\n\n\n\n\n Multiply a scalar by a complex number \n\n\n\n\n sqrt(x) and 0 <= phase(x) < pi\n\n\n\n\n Subtract one complex number from another\n\n\n\n\n Tagent\n\n\n\n\n The complex number 0+0i\n\n\n\n\n\n\n\n Attempt to determine a numeric association for the given type, i.e. a registered dictionary of\n numeric operations. The interface can be queried dynamically for additional functionality in the numerics\n hierarchy.\n\n\n\n\n Record an AppDomain-wide association between the given type and the given dictionary of\n numeric operations. Raise an error if an existing association already exists. \n\n\n\n\n\n\n\n Associations are a way of associating dictionaries of\n operations with given types at runtime. Associations are global to a \n .NET application domain. Once specified an association may not be deleted\n or modified.\n\n In this release the system of associations is simply \n limited to a registry of types that support dictionaries (i.e. interface objects)\n of numeric operations. The following types are pre-registered with associated numeric\n operations: float, int32, int64, bigint, float32, Complex, bignum. Other types must be\n registered explicitly by user code.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nAdd two matrices (operator +)\n\n\n\n\n\n\n\n Create a new matrix that is a copy of the given array\n\n\n\n\nPoint-wise maximum element of two matrices\n\n\n\n\nPoint-wise minimum element of two matrices\n\n\n\n\n\n\n\nPointwise exponential of a matrix.\n\n\n\n\n Create a matrix with all entries the given constant\n\n\n\n\n\n\n\nDot product\n\n\n\n\n Check if a predicate holds for at least one element of a matrix\n\n\n\n\n Check if a predicate holds for at least one element of a matrix\n\n\n\n\n Fold the given function over all elements of a matrix\n\n\n\n\n Fold the given function down each column of a matrix\n\n\n\n\n Fold the given function along each row of a matrix\n\n\n\n\n Fold the given function along a particular column of a matrix\n\n\n\n\n Fold the given function down a particular row of a matrix\n\n\n\n\n Fold the given function over all elements of a matrix\n\n\n\n\n Check if a predicate holds for all elements of a matrix\n\n\n\n\n Check if a predicate holds for all elements of a matrix\n\n\n\n\n Get an element of a matrix\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Create a square matrix with the constant 1.0 lying on diagonal\n\n\n\n\n\n\n\n Create a dense representation matrix with the given entries. \n\n\n\n\n Create a square matrix with the given vector lying on diagonal\n\n\n\n\n Create a sparse representation matrix with the given entries. Not all \n operations are available for sparse matrices, and mutation is not permitted.\n If an operation on sparse matrices raises a runtime exception then consider \n converting to a dense matrix using to_dense.\n\n\n\n\n\n\n\n\n\n\n\n\n\n In-place addition mutates first matrix argument.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n In-place subtraction mutates first matrix argument. \n\n\n\n\n Map the given function over each element of the matrix, producing a new matrix\n\n\n\n\n Map the given indexed function over each element of the matrix, producing a new matrix\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nsqrt(sum(x*x)) of all the elements of a matrix\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nMultiply all the elements of the matrix\n\n\n\n\nGenerate a new matrix of the same size as the input with random entries \ndrawn from the range 0..aij. Random numbers are generated using a globally \nshared System.Random instance with the initial seed 99.\n\n\n\n\n\n\n\n Set an element of a matrix\n\n\n\n\n\n\n\nSum all the elements of a matrix\n\n\n\n\n\n\n\n Ensure that a matrix uses dense representation. See init_sparse\n\n\n\n\n\n\n\n\n\n\n\n\n\n Sum of the diagonal elements of the matrix\n\n\n\n\nTranspose of a matrix. Use also m.Transpose\n\n\n\n\n Create a matrix with all entries zero\n\n\n\n\n\n\n\n\n\n\n\n\n\n Create a new matrix that is a copy of the given array\n\n\n\n\nTake the pointwise maximum of two matrices\n\n\n\n\nTake the pointwise maximum of two matrices\n\n\n\n\n\n\n\n Create a matrix containing the given value at every element.\n\n\n\n\n\n\n\n Sum of the point-wise multiple of the two matrices.\n The element type of the matrix must have an associated instance of INumeric<'T> (see GlobalAssociations) ((else NotSupportedException)).\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Get an element from a matrix. The indexes are given in row/column order.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Create a square matrix with the one for the element type lying on diagonal\n The element type of the matrix must have an associated instance of INumeric<'T> (see GlobalAssociations) ((else NotSupportedException)).\n\n\n\n\n Create a matrix using the given function to compute the item at each index.\n\n\n\n\n\n\n\n Create a matrix containing the given vector along the diagonal.\n The element type of the matrix must have an associated instance of INumeric<'T> (see GlobalAssociations) ((else NotSupportedException)).\n\n\n\n\n Create a matrix using the given function to compute the item at each index.\n The element type of the matrix must have an associated instance of INumeric<'T> (see GlobalAssociations) ((else NotSupportedException)).\n The function is passed the dictionary of associated operations in addition to the index pair.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Returns sqrt(sum(norm(x)*(norm(x))) of all the elements of a matrix.\n The element type of the matrix must have an associated instance of INormFloat<'T> (see GlobalAssociations) ((else NotSupportedException)).\n\n\n\n\n Create a matrix from the given (usually constant) data \n\n\n\n\n Create a matrix from the given (usually constant) data \n\n\n\n\n\n\n\n Create a 1x1 matrix containing the given value \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Set an element in a matrix. The indexes are given in row/column order.\n\n\n\n\n\n\n\n\n\n\n Return a new array containing the elements of the given matrix\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Return a new matrix which is the transpose of the input matrix\n\n\n\n\n Create a matrix containing the zero element at each index.\n The element type of the matrix must have an associated instance of INumeric<'T> (see GlobalAssociations) ((else NotSupportedException)).\n\n\n\n\n Operations to manipulate matrix types carrying\n arbitrary element types. The names and types of the operations match those\n in the containing module Math.Matrix. \n\n The numeric operations on the element type (add, zero etc.) are inferred from the type\n argument itself. That is, for some operations \n the element type of the matrix must have an associated instance of INumeric<'T> \n or some more specific numeric association (see GlobalAssociations) ((else NotSupportedException)).\n\n\n\n\n Operations to manipulate floating\n point matrices. The submodule Matrix.Generic contains a \n matching set of operations to manipulate matrix types carrying\n arbitrary element types.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Faraday constant\n\n\n\n\n Newtonian constant of gravitation\n\n\n\n\n Conductance quantum 2e^2/h\n\n\n\n\n Avogadro constant\n\n\n\n\n Magnetic flux quantum h/2e\n\n\n\n\n Molar gas constant\n\n\n\n\n Rydberg constant\n\n\n\n\n Fine-structure constant\n\n\n\n\n speed of light in vacuum\n\n\n\n\n Elementary charge\n\n\n\n\n Electron volt\n\n\n\n\n electric constant = 1/(mu0 c^2)\n\n\n\n\n Planck constant\n\n\n\n\n Dirac constant, also known as the reduced Planck constant = h/2pi\n\n\n\n\n Boltzmann constant R/N_A\n\n\n\n\n Electron mass\n\n\n\n\n Proton mass\n\n\n\n\n magnetic constant\n\n\n\n\n Stefan-Boltzmann constant\n\n\n\n\n Unified atomic mass unit\n\n\n\n\n Fundamental physical constants, with units-of-measure\n\n\n\n\n\n\n\n Create by constant initialization\n\n\n\n\n Get an element of a column vector\n\n\n\n\n Create by comprehension\n\n\n\n\n Get the dimensions (number of rows) of a column rowvec. \n\n\n\n\n Create a vector from an array of double precision floats\n\n\n\n\n Create a vector from a list of numbers\n\n\n\n\n\n\n\n Set an element of a column rowvec\n\n\n\n\n Return a new array containing a copy of the elements of the given vector\n\n\n\n\n\n\n\n Return a vector of the given length where every entry is zero.\n\n\n\n\n\n\n\n Create by constant initialization\n\n\n\n\n Get an element from a column vector. \n\n\n\n\n Create by comprehension\n\n\n\n\n Get the number of rows in a column vector. \n\n\n\n\n Create a row vector from an array of elements\n\n\n\n\n Create a row vector from a list of elements\n\n\n\n\n Create a row vector from a sequence of elements\n\n\n\n\n Set an element in a column vector. \n\n\n\n\n Return a new array containing a copy of the elements of the given vector\n\n\n\n\n Transpose the row vector\n\n\n\n\n Return a vector of the given length where every entry is zero.\n\n\n\n\n Operations to manipulate row vectors types carrying\n arbitrary element types. \n\n\n\n\n Operations to manipulate floating\n point row vectors. These are included for completeness and are\n nearly always transposed to column vectors.\n\n\n\n\n ampere, SI unit of electric current\n\n\n\n\n becquerel, SI unit of activity referred to a radionuclide\n\n\n\n\n coulomb, SI unit of electric charge, amount of electricity\n\n\n\n\n farad, SI unit of capacitance\n\n\n\n\n gray, SI unit of absorbed dose\n\n\n\n\n henry, SI unit of inductance\n\n\n\n\n hertz, SI unit of frequency\n\n\n\n\n joule, SI unit of energy, work, amount of heat\n\n\n\n\n kelvin, SI unit of thermodynamic temperature\n\n\n\n\n newton, SI unit of force\n\n\n\n\n pascal, SI unit of pressure, stress\n\n\n\n\n siemens, SI unit of electric conductance\n\n\n\n\n sievert, SI unit of does equivalent\n\n\n\n\n tesla, SI unit of magnetic flux density\n\n\n\n\n volt, SI unit of electric potential difference, electromotive force\n\n\n\n\n watt, SI unit of power, radiant flux\n\n\n\n\n weber, SI unit of magnetic flux\n\n\n\n\n candela, SI unit of luminous intensity\n\n\n\n\n katal, SI unit of catalytic activity\n\n\n\n\n kilogram, SI unit of mass\n\n\n\n\n lumen, SI unit of luminous flux\n\n\n\n\n lux, SI unit of illuminance\n\n\n\n\n metre (or meter), SI unit of length\n\n\n\n\n mole, SI unit of amount of substance\n\n\n\n\n ohm, SI unit of electric resistance\n\n\n\n\n second, SI unit of time\n\n\n\n\n The International System of Units (SI)\n\n\n\n\n\n\n\n\n\n\n\n\n\nPointwise exponential of a vector.\n\n\n\n\n Generate a vector of the given length where each entry contains the given value\n\n\n\n\nDot product\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Get an element of a column vector\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Get the dimensions (number of rows) of a column vector. Identical to nrows\n\n\n\n\n\n\n\n\n\n\n\n\n\n Computes the 2-norm of a vector: sqrt(x.Transpose*x).\n\n\n\n\n Create a vector from an array of double precision floats\n\n\n\n\n Create a vector from a list of numbers\n\n\n\n\n Create a 1-element vector\n\n\n\n\n\n\n\nMultiply all the elements of the matrix\n\n\n\n\n Create a vector that represents a integral mesh over the given range\n e.g. range 1 5 = vector [ 1.;2.;3.;4.;5. ]\n\n\n\n\n Create a vector that represents a mesh over the given range\n e.g. rangef (-1.0) 0.5 1.0 = vector [ -1.0; -0.5; 0.0; 0.5; 1.0]\n\n\n\n\n\n\n\n Set an element of a column vector\n\n\n\n\n\n\n\nSum all the elements of a vector\n\n\n\n\n Return a new array containing a copy of the elements of the given vector\n\n\n\n\nTranspose of a matrix. Use also m.Transpose\n\n\n\n\n Return a vector of the given length where every entry is zero.\n\n\n\n\nAdd two vectors (operator +)\n\n\n\n\n\n\n\nTake the pointwise maximum of two vectors\n\n\n\n\nTake the pointwise minimum of two vectors\n\n\n\n\nPoint-wise multiplication of two vectors (operator .*)\n\n\n\n\n Generate a vector of the given length where each entry contains the given value\n\n\n\n\nDot product\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Get an element of a column vector\n\n\n\n\n Creation: general\n\n\n\n\n Creation: useful when the element type has associated operations.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Get the dimensions (number of rows) of a column vector. Identical to nrows\n\n\n\n\n\n\n\n\n\n\nNegation of the vector (each element is negated) (unary operator -)\n\n\n\n\n Computes the 2-norm of a vector: sqrt(x.Transpose*x).\n\n\n\n\n Create a vector from an array of elements\n\n\n\n\n Create a vector from a list of numbers\n\n\n\n\n Create a 1-element vector\n\n\n\n\n Create a vector from a sequence of numbers\n\n\n\n\nMultiply all the elements of the matrix\n\n\n\n\nPointwise multiplication of a matrix by a scalar\n\n\n\n\n Set an element of a column vector\n\n\n\n\nSubtract one vector from another (operator -)\n\n\n\n\nSum all the elements of a vector\n\n\n\n\n Return a new array containing a copy of the elements of the given vector\n\n\n\n\nTranspose of a matrix. Use also m.Transpose\n\n\n\n\n Return a vector of the given length where every entry is zero.\n\n\n\n\n Operations to manipulate column vectors carrying\n arbitrary element types. \n\n\n\n\n Operations to manipulate floating\n point column vectors. The submodule VectorOps.Generic contains a \n matching set of operations to manipulate column vectors carrying\n arbitrary element types.\n\n\n\n\n See NativeArray2\n\n\n\n\n WARNING: use of this function may lead to unverifiable or invalid code\n\n\n\n\n\n\n\n\n\n\n\n\n\n View a FortranMatrix as a CMatrix. Doesn't actually allocate\n a new matirx - just gives a different label to the same bits, and swaps the\n row/column count information associated with the bits.\n\n\n\n\n WARNING: use of this function may lead to unverifiable or invalid code\n\n\n\n\n\n\n\n This type wraps a pointer to a blob of unmanaged memory assumed to contain\n a Fortran-style column major two-dimensional matrix of items compatible with the (presumably blittable) \n type 'T. The blob of memory must be allocated and managed externally, \n e.g. by a computation routine written in C.\n\n All operations on this type are marked inlined\n because the code used to implement the operations is not verifiable. \n\n Any code that uses these operations will be unverifiable and may \n cause memory corruption if not used with extreme care.\n\n\n\n\n WARNING: use of this function may lead to unverifiable or invalid code\n\n\n\n\n Pointer to the C-style row major two-dimensional array \n\n\n\n\n Number of rows of the native array\n\n\n\n\n Number of columns of the native array\n\n\n\n\n View a CMatrix as a FortranMatrix. Doesn't actually allocate\n a new matirx - just gives a different label to the same bits, and swaps the\n row/column count information associated with the bits.\n\n\n\n\n WARNING: use of this function may lead to unverifiable or invalid code\n\n\n\n\n Creates a C-style row major two-dimensional array from a native pointer, the number of rows and the number of columns. \n Nothing is actually copied.\n\n\n\n\n This type wraps a pointer to a blob of unmanaged memory assumed to contain\n a C-style row major two-dimensional matrix of items compatible with the (presumably blittable) \n type 'T. The blob of memory must be allocated and managed externally, \n e.g. by a computation routine written in C.\n\n All operations on this type are marked inlined\n because the code used to implement the operations is not verifiable. \n\n Any code that uses these operations will be unverifiable and may \n cause memory corruption if not used with extreme care.\n\n\n\n\n WARNING: use of this function may lead to unverifiable or invalid code\n\n\n\n\n Pointer to the C-style one-dimensional array\n\n\n\n\n Length of the C-style one-dimensional array\n\n\n\n\n WARNING: use of this function may lead to unverifiable or invalid code\n\n\n\n\n Creates a C-style one dimensional array from a native pointer and the length of the array\n Nothing is actually copied.\n\n\n\n\n This type wraps a pointer to a blob of unmanaged memory assumed to contain\n a C-style one-dimensional array of items compatible with the (presumably blittable) \n type 'T. The blob of memory must be allocated and managed externally, \n e.g. by a computation routine written in C.\n\n All operations on this type are marked inlined\n because the code used to implement the operations is not verifiable. \n\n Any code that uses these operations will be unverifiable and may \n cause memory corruption if not used with extreme care.\n\n\n\n\n For native interop. Pin the given object\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Represents a pinned handle to a structure with an underlying 2D array, i.e. an underlying NativeArray2.\n Used when interfacing with native code math libraries such as LAPACK.\n\n\n\n\n For native interop. Pin the given object\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Represents a pinned handle to a structure with an underlying 1D array, i.e. an underlying NativeArray.\n Used when interfacing with native code math libraries such as LAPACK.\n\n\n\n\n\n\n\n Pin the given ref for the duration of a single call to the given function. A native pointer to\n the contents of the ref is passed to the given function. Cleanup the GCHandle associated with the \n pin when the function completes, even if an exception is raised.\n\n This function should only be used if 'T is a simple blittable type\n such as \"int\" that does not contain any further heap references.\n\n WARNING: use of this function may lead to unverifiable or invalid code\n\n\n\n\n\n\n\n Interpret tables for an ascii lexer generated by fslex. \n\n\n\n\n\n\n\n Interpret tables for an ascii lexer generated by fslex, processing input asynchronously\n\n\n\n\n The type of tables for an ascii lexer generated by fslex. \n\n\n\n\n The start position for the lexeme\n\n\n\n\n True if the refill of the buffer ever failed , or if explicitly set to true.\n\n\n\n\n The end position for the lexeme\n\n\n\n\n The start position for the lexeme\n\n\n\n\n The length of the matched string \n\n\n\n\n The matched string \n\n\n\n\n True if the refill of the buffer ever failed , or if explicitly set to true.\n\n\n\n\n The end position for the lexeme\n\n\n\n\n Dynamically typed, non-lexically scoped parameter table\n\n\n\n\n Fast helper to turn the matched characters into a string, avoiding an intermediate array\n\n\n\n\n Fetch a particular character in the matched string \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Adjust the start position associated with the lexbuf\n\n\n\n\n\n\n\n\n\n\n\n\n\n Remove all input, though don't discard the current lexeme \n\n\n\n\n\n\n\n Return absolute offset of the start of the line marked by the position\n\n\n\n\n\n\n\n The line number in the input stream, assuming fresh positions have been updated \n using AsNewLinePos() and by modifying the EndPos property of the LexBuffer.\n\n\n\n\n The file name associated with the input stream.\n\n\n\n\n Get an arbitrary position, with the empty string as filename, and \n\n\n\n\n Return the column number marked by the position, i.e. the difference between the AbsoluteOffset and the StartOfLineAbsoluteOffset\n\n\n\n\n\n\n\n The character number in the input stream\n\n\n\n\n Gives a position shifted by specified number of characters\n\n\n\n\n Get a position corresponding to the first line (line number 1) in a given file\n\n\n\n\n Given a position at the start of a token of length n, return a position just beyond the end of the token\n\n\n\n\n\n\n\n Position information stored for lexing tokens\n\n\n\n\n Interpret tables for a unicode lexer generated by fslex. \n\n\n\n\n\n\n\n Interpret tables for a unicode lexer generated by fslex, processing input asynchronously\n\n\n\n\n The type of tables for an unicode lexer generated by fslex. \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Parsers generated by FsPars provide information from within parser\n actions. This is accessed via the functions available on the local\n variable parseState within parser actions\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n Tables generated by fsyacc\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n A record of options to control structural formatting.\n For F# Interactive properties matching those of this value can be accessed via the 'fsi'\n value.\n \n Floating Point format given in the same format accepted by System.Double.ToString,\n e.g. f6 or g15.\n\n If ShowProperties is set the printing process will evaluate properties of the values being\n displayed. This may cause additional computation. \n\n The ShowIEnumerable is set the printing process will force the evalution of IEnumerable objects\n to a small, finite depth, as determined by the printing parameters.\n This may lead to additional computation being performed during printing.\n\n \n From F# Interactive the default settings can be adjusted using, for example, \n 
    \n   open Microsoft.FSharp.Compiler.Interactive.Settings;;\n   setPrintWidth 120;;\n
    \n     \n    \n    \n\n\n The maximum number of rows for which to generate layout for table-like \n structures. -1 if no maximum.\n\n\n\n\n The maximum number of elements for which to generate layout for \n list-like structures, or columns in table-like \n structures. -1 if no maximum.\n\n\n\n\n Return to the layout-generation \n environment to layout any otherwise uninterpreted object\n\n\n\n\n\n\n\n Data representing structured layouts of terms. \n\n\n\n\n\n\n\n Convert any value to a string using a standard formatter\n Data is typically formatted in a structured format, e.g.\n lists are formatted using the \"[1;2]\" notation.\n The details of the format are not specified and may change\n from version to version and according to the flags given\n to the F# compiler. The format is intended to be human-readable,\n not machine readable. If alternative generic formats are required\n you should develop your own formatter, using the code in the\n implementation of this file as a starting point.\n\n Data from other .NET languages is formatted using a virtual\n call to Object.ToString() on the boxed version of the input.\n\n\n\n\n\n\n\n Convert any value to a layout using the given formatting options. The\n layout can then be processed using formatting display engines such as\n those in the LayoutOps module. any_to_string and output_any are\n built using any_to_layout with default format options.\n\n\n\n\n Ouput any value to a channel using the same set of formatting rules\n as any_to_string\n\n\n\n\n\n\n\n\n\n\n\n\n\n Layout two vertically.\n\n\n\n\n Layout list vertically. \n\n\n\n\n Wrap braces around layout. \n\n\n\n\n Wrap round brackets around Layout.\n\n\n\n\n Join layouts into a comma separated list.\n\n\n\n\n The empty layout\n\n\n\n\n Is it the empty layout?\n\n\n\n\n An string which is left parenthesis (no space on the right).\n\n\n\n\n Layout like an F# list. \n\n\n\n\n An uninterpreted leaf, to be interpreted into a string\n by the layout engine. This allows leaf layouts for numbers, strings and\n other atoms to be customized according to culture.\n\n\n\n\n Join broken with ident=0\n\n\n\n\n Join broken with ident=1 \n\n\n\n\n Join broken with ident=2 \n\n\n\n\n Join, unbreakable. \n\n\n\n\n Join, possible break with indent=1\n\n\n\n\n Join, possible break with indent=2 \n\n\n\n\n Join, possible break with indent=0\n\n\n\n\n Layout like an F# option.\n\n\n\n\n An string which is right parenthesis (no space on it's left).\n\n\n\n\n Join layouts into a semi-colon separated list.\n\n\n\n\n An string which requires no spaces either side.\n\n\n\n\n Join layouts into a list separated using the given Layout.\n\n\n\n\n Join layouts into a space separated list. \n\n\n\n\n Wrap square brackets around layout. \n\n\n\n\n See tagL\n\n\n\n\n Form tuple of layouts. \n\n\n\n\n For limitting layout of list-like sequences (lists,arrays,etc).\n unfold a list of items using (project and z) making layout list via itemL.\n If reach maxLength (before exhausting) then truncate.\n\n\n\n\n An string leaf \n\n\n\n\n A layout is a sequence of strings which have been joined together.\n The strings are classified as words, separators and left and right parenthesis.\n This classification determines where spaces are inserted.\n A joint is either unbreakable, breakable or broken.\n If a joint is broken the RHS layout occurs on the next line with optional indentation.\n A layout can be squashed to for given width which forces breaks as required.\n\n\n    \n    \n" }, { "path": "ironclad-apps/tools/scripts/.gitignore", "content": "*.pyc\r\n*.obj\r\n" }, { "path": "ironclad-apps/tools/scripts/binary_to_c_symbols.py", "content": "#!/usr/bin/python\r\n\r\nimport sys\r\n\r\nbinaryfile = sys.argv[1]\r\nsymbolname = sys.argv[2]\r\nhfile = sys.argv[3]\r\ncfile = sys.argv[4]\r\n\r\nifp = open(binaryfile, \"rb\")\r\nbinaryBytes = ifp.read()\r\nifp.close()\r\n\r\nofp = open(hfile, \"w\")\r\nofp.write(\"#pragma once\\n extern char %s[%d];\\n\" %(symbolname, len(binaryBytes)))\r\nofp.close()\r\n\r\nofp = open(cfile, \"w\")\r\nofp.write(\"char %s[%d] = {\\n\" %(symbolname, len(binaryBytes)))\r\nfor b in binaryBytes:\r\n ofp.write(\"0x%02x, \\n\" % ord(b))\r\n\r\nofp.write(\"};\\n\")\r\nofp.close()\r\n" }, { "path": "ironclad-apps/tools/scripts/build-standalone-asm.py", "content": "#!/usr/bin/python\r\n\r\nimport sys\r\nimport re\r\nimport os\r\n\r\n# Remove in and out instructions\r\ndef banned(line):\r\n tline = line.strip()\r\n\r\n result = False\r\n # Don't wait on the serial port\r\n result = result or (tline.startswith(\"je\") and \"waitForSerialPort\" in tline)\r\n\r\n # Ban VgaDebugStore lines (very brittle :( )\r\n result = result or (\"edx + 753664\" in tline)\r\n\r\n # Ban IO instructions\r\n result = result or (tline.startswith(\"in \") or tline.startswith(\"out \"))\r\n\r\n return result\r\n\r\ndef munge(filename):\r\n establish_locality_in_progress = False;\r\n with open(filename) as f:\r\n for line in f:\r\n line = line.rstrip()\r\n\r\n # Tack an extern declaration on to the header\r\n if line == \".model flat\":\r\n print line\r\n print 'EXTERN ?c_debug_print@@YAXHH@Z : proc'\r\n print 'EXTERN ?fixup_stack@@YAXXZ : proc'\r\n print 'EXTERN ?c_exit@@YAXXZ : proc'\r\n continue\r\n\r\n # Neuter Proc_establish_locality (TPM initialization)\r\n if line.startswith(\"_?Proc_establish__locality proc\"):\r\n establish_locality_in_progress = True\r\n print line\r\n print \"\\tret\"\r\n if line.startswith(\"_?Proc_establish__locality endp\"):\r\n establish_locality_in_progress = False\r\n\r\n # Replace the jump that conditions on the contents of eax with \r\n # an unconditional jump. But first, fixup Windows notion of where our stack will be\r\n if 'je AppEntryPoint$__L1' in line:\r\n print '\\tcall ?fixup_stack@@YAXXZ'\r\n print '\\tjmp AppEntryPoint$__L1'\r\n continue\r\n\r\n # Replace calls to TPM-based random with calls to non-TPM random\r\n if line.strip() == 'call _?Proc_get__random':\r\n print '\\tcall _?Proc_insecure__get__random'\r\n continue\r\n\r\n # Replace calls to Dafny's debug print with the C version\r\n if line.strip() == 'call _?Proc_debug__print':\r\n print '\\tcall ?c_debug_print@@YAXHH@Z'\r\n continue\r\n\r\n # Replace the infinite loop with an exit\r\n if line.strip() == 'jmp AppEntryPoint$myInfLoop':\r\n print '\\tcall ?c_exit@@YAXXZ'\r\n continue\r\n\r\n if (establish_locality_in_progress):\r\n pass\r\n elif banned(line):\r\n pass\r\n else:\r\n print line\r\n\r\n# Extra memory spacing\r\n#Spacer SEGMENT DWORD MEMORY FLAT READ WRITE\r\n#REPEAT 100000;8388608\r\n#QWORD ?\r\n#ENDM\r\n#REPEAT 100000;8388608\r\n#QWORD ?\r\n#ENDM\r\n#REPEAT 100000;8388608\r\n#QWORD ?\r\n#ENDM\r\n#REPEAT 100000;8388608\r\n#QWORD ?\r\n#ENDM\r\n#Spacer ENDS\r\n#\r\n\r\ntry:\r\n arg = sys.argv[1]\r\nexcept:\r\n sys.stderr.write(\"Usage: %s \\n\" % sys.argv[0])\r\n sys.exit(-1)\r\nmunge(arg)\r\n\r\n" }, { "path": "ironclad-apps/tools/scripts/build-standalone-init.sh", "content": "#!/bin/bash\n\ntar xvjf zero-obj.bz2\ncp zero.obj zero2.obj\n" }, { "path": "ironclad-apps/tools/scripts/zero.asm", "content": ".686p\n.model flat\nSoloSpacer SEGMENT DWORD MEMORY FLAT READ WRITE\nREPEAT 8388608\nQWORD ?\nENDM\nSoloSpacer ENDS\nend\n" }, { "path": "ironclad-apps/tools/standalone/.gitignore", "content": "Debug/\r\nDbgExec/\r\n*sdf\r\n*.user\r\n*.suo\r\n" }, { "path": "ironclad-apps/tools/standalone/StandAloneSupport.sln", "content": "\r\nMicrosoft Visual Studio Solution File, Format Version 12.00\r\n# Visual Studio 2013\r\nVisualStudioVersion = 12.0.30110.0\r\nMinimumVisualStudioVersion = 10.0.40219.1\r\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"StandAloneSupport\", \"StandAloneSupport.vcxproj\", \"{D5413EFA-3A5F-4DD7-9AA3-C42871DD40CE}\"\r\nEndProject\r\nGlobal\r\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\r\n\t\tDbgExec|Win32 = DbgExec|Win32\r\n\t\tDebug|Win32 = Debug|Win32\r\n\t\tRelease|Win32 = Release|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\r\n\t\t{D5413EFA-3A5F-4DD7-9AA3-C42871DD40CE}.DbgExec|Win32.ActiveCfg = DbgExec|Win32\r\n\t\t{D5413EFA-3A5F-4DD7-9AA3-C42871DD40CE}.DbgExec|Win32.Build.0 = DbgExec|Win32\r\n\t\t{D5413EFA-3A5F-4DD7-9AA3-C42871DD40CE}.Debug|Win32.ActiveCfg = Debug|Win32\r\n\t\t{D5413EFA-3A5F-4DD7-9AA3-C42871DD40CE}.Debug|Win32.Build.0 = Debug|Win32\r\n\t\t{D5413EFA-3A5F-4DD7-9AA3-C42871DD40CE}.Release|Win32.ActiveCfg = Release|Win32\r\n\t\t{D5413EFA-3A5F-4DD7-9AA3-C42871DD40CE}.Release|Win32.Build.0 = Release|Win32\r\n\tEndGlobalSection\r\n\tGlobalSection(SolutionProperties) = preSolution\r\n\t\tHideSolutionNode = FALSE\r\n\tEndGlobalSection\r\nEndGlobal\r\n" }, { "path": "ironclad-apps/tools/standalone/StandAloneSupport.vcxproj", "content": "\r\n\r\n \r\n \r\n DbgExec\r\n Win32\r\n \r\n \r\n Debug\r\n Win32\r\n \r\n \r\n Release\r\n Win32\r\n \r\n \r\n \r\n {D5413EFA-3A5F-4DD7-9AA3-C42871DD40CE}\r\n Win32Proj\r\n StandAloneSupport\r\n \r\n \r\n \r\n StaticLibrary\r\n true\r\n v120\r\n Unicode\r\n \r\n \r\n Application\r\n true\r\n v120\r\n Unicode\r\n \r\n \r\n Application\r\n false\r\n v120\r\n true\r\n Unicode\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n true\r\n \r\n \r\n true\r\n \r\n \r\n false\r\n \r\n \r\n \r\n \r\n \r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Level3\r\n Disabled\r\n WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n Level3\r\n \r\n \r\n MaxSpeed\r\n true\r\n true\r\n WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions)\r\n \r\n \r\n Console\r\n true\r\n true\r\n true\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ironclad-apps/tools/standalone/StandAloneSupport.vcxproj.filters", "content": "\r\n\r\n \r\n \r\n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\r\n cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx\r\n \r\n \r\n {93995380-89BD-4b04-88EB-625FBE52EBFB}\r\n h;hh;hpp;hxx;hm;inl;inc;xsd\r\n \r\n \r\n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\r\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\r\n \r\n \r\n \r\n \r\n Source Files\r\n \r\n \r\n" }, { "path": "ironclad-apps/tools/standalone/support.cpp", "content": "#include \r\n#include \r\n#include \r\n#include \r\n#include \r\n#include \r\n#include \r\n#include \r\n#include \r\n\r\nusing namespace std;\r\n\r\nvoid hello() {\r\n printf(\"Hello world\\n\");\r\n}\r\n\r\nvoid c_debug_print(int x, int y) {\r\n printf(\"%#2x, %#8x\\n\", x, y);\r\n\r\n\r\n\r\n\r\n}\r\n\r\nvoid c_exit() {\r\n exit(0);\r\n}\r\n\r\nvoid fixup_stack() {\r\n unsigned int* teb = (unsigned int*)NtCurrentTeb();\r\n\r\n NT_TIB* tib = (NT_TIB*)teb;\r\n\r\n tib->StackBase = (void*)0xffffffff; \r\n tib->StackLimit = (void*)0; \r\n\r\n //\r\n //*(teb + 4) = 0x44F000; \r\n //*(teb + 8) = 0x44F400; \r\n //\r\n ////*(teb + 4) = 0x44F400; \r\n ////*(teb + 8) = 0x44F000; \r\n \r\n \r\n \r\n\r\n \r\n \r\n \r\n \r\n}\r\n\r\n#define LOOP_COUNT (1<<25)\r\n\r\nint total = 0;\r\n\r\nvoid function5(int x) {\r\n for (int i = 0; i < LOOP_COUNT; i++) {\r\n total += i;\r\n }\r\n}\r\n\r\n\r\nvoid function4(int x) {\r\n for (int i = 0; i < LOOP_COUNT; i++) {\r\n total += i;\r\n if (i % 100000 == 0) {\r\n function5(x);\r\n }\r\n }\r\n}\r\n\r\nvoid function3(int x) {\r\n for (int i = 0; i < LOOP_COUNT; i++) {\r\n total += i;\r\n if (i % 100000 == 0) {\r\n function4(x);\r\n }\r\n }\r\n}\r\n\r\nvoid function2(int x) {\r\n for (int i = 0; i < LOOP_COUNT; i++) {\r\n total += i;\r\n if (i % 100000 == 0) {\r\n function3(x);\r\n }\r\n }\r\n}\r\n\r\nvoid function1(int x) {\r\n for (int i = 0; i < LOOP_COUNT; i++) {\r\n total += i;\r\n if (i % 100000 == 0) {\r\n function2(x);\r\n }\r\n }\r\n}\r\n\r\nvoid main() {\r\n hello();\r\n function1(24);\r\n hello();\r\n}\r\n" }, { "path": "ironfleet/.gitignore", "content": "codeplex\r\nobj/\r\nobj-*/\r\nbin-*/\r\nbin/\r\nbin_tools/\r\nobj_tools/\r\nsrc/Clients/*/bin/\r\n*-disabled\r\nnucache/\r\nnuobj/\r\nnutemp/\r\nnubuild.config\r\nnubuild.cloud-credentials\r\nnubuild.log\r\nnubuild.progress\r\nExperiments/\r\n*.csproj.user\r\n/nubuild.progress\r\n*.log\r\n*.pdb\r\n*.pyc\r\n*.aux\r\nStyleCop.Cache\r\ntmp/\r\n*.swp\r\n*.dlg\r\nflycheck_*\r\n*.vim\r\nnohup.out\r\n*.vdfy\r\n*.tmp\r\n.sconsign.dblite\r\n*.suo\r\n*~\r\nport*\r\ncerts/\r\n" }, { "path": "ironfleet/CODE.md", "content": "# Code Layout\r\n\r\nHere is a brief overview of the files of interest in this repository. One central\r\nconvention is that all trusted specification files end in `.s.dfy`. Everything else\r\nshould be a `.i.dfy` file and will be verified for correctness.\r\n\r\n- `SConstruct`\r\n SCons build file for verifying and compiling everything\r\n- `src`\r\n + `IronLockServer`\r\n C# solution and project files for building the lock server.\r\n + `IronRSLKVServer`\r\n C# solution and project files for building a key-value store replica that\r\n uses IronRSL to coordinate with other replicas. This directory includes\r\n the file `Service.cs` defining the key-value service.\r\n + `IronRSLKVClient`\r\n Unverified C# client for the key-value service replicated by IronRSL.\r\n + `IronRSLCounterServer`\r\n C# solution and project files for building a counter service replica that\r\n uses IronRSL to coordinate with other replicas. This directory includes\r\n the file `Service.cs` defining the counter service.\r\n + `IronRSLCounterClient`\r\n Unverified C# client for the counter service replicated by IronRSL.\r\n + `IronSHTServer`\r\n C# solution and project files for building the IronSHT (sharded hash table) server.\r\n + `IronSHTClient`\r\n Unverified C# client for IronSHT.\r\n + `Dafny`\r\n - `Libraries` \r\n Basic library support for various tasks, particularly for dealing with\r\n non-linear operations that Z3 struggles with. These libraries were inherited from\r\n the [IroncladApps](http://research.microsoft.com/apps/pubs/default.aspx?id=230123) project.\r\n - `Distributed`\r\n The core IronFleet code\r\n + `Common`\r\n Code shared across our services for various core taskes\r\n - `Collections`\r\n Useful definitions, lemmas, and methods for dealing with Sets, Maps, and Sequences.\r\n - `Framework`\r\n This is the trusted framework that forms the core portion of each service's\r\n specification. Each service further adds service-specific specifications in\r\n `src/Dafny/Distributed/Services`.\r\n - `Logic`\r\n Our encoding of TLA in Dafny.\r\n - `Native`\r\n Our trusted interface to C# for networking, time, command-line arguments and\r\n other functionality that Dafny does not expose.\r\n + `Impl`\r\n - `Common`\r\n Useful libraries shared across services. Includes command-line parsing, generic\r\n marshalling and parsing, end-point identities, and a UDP client.\r\n - `RSL`\r\n The core implementation of IronRSL. These files define concrete versions of the\r\n types specified by the protocol. For each role, e.g., the Acceptor, we have a\r\n file `AcceptorState.i.dfy` which defines the basic datatype and predicates on\r\n it, and a file `AcceptorModel.i.dfy` which defines the actions that can be\r\n performed on the data type. ReplicaModel is the top-level role that combines\r\n all of the others, and ReplicaImpl interfaces with the external world to send\r\n and receive packets. ReplicaModel and ReplicaImpl are split into multiple files\r\n to increase the file-level parallelism of our build tool.\r\n - `SHT`\r\n The core implementation of IronSHT (sharded hash table).\r\n - `LiveSHT`\r\n SHT's scheduler and functionality for sending and receiving packets.\r\n - `Lock`\r\n The core implementation for IronLock. This includes the command line parser,\r\n the message definitions, parsing and marshalling, a simple scheduler, etc. \r\n + `Protocol`\r\n - `Common`\r\n Common files shared by all of our protocols\r\n - `RSL`\r\n Defines the protocol layer of our RSL system\r\n + `RefinementProof`\r\n Proof of safety, in the form of a proof that the implementation\r\n refines the specification given that it refines the protocol.\r\n + `LivenessProof`\r\n Proof of liveness, specifically that if a client submits a request\r\n repeatedly he eventually receives a reply. It requires various\r\n assumptions codified in Assumptions.i.dfy, e.g., a quorum of\r\n replicas is live and the network eventually delivers packets among\r\n the client and the live quorum in bounded time. The ultimate\r\n liveness proof, in LivenessProof.i.dfy, is a proof by\r\n contradiction: if those assumptions hold and the client never gets\r\n a reply, then `false`.\r\n - `SHT`\r\n Defines the protocol layer of our SHT system\r\n + `RefinementProof`\r\n Proof of safety, in the form of a proof that the implementation\r\n refines the specification given that it refines the protocol.\r\n - `LiveSHT`\r\n Defines a small additional layer that adds a scheduler to SHT and maps\r\n the low level Environment to SHT's notion of a Network.\r\n + `RefinementProof`\r\n Proof that LiveSHT is a refinement of SHT\r\n + `LivenessProof`\r\n Proof of liveness of the reliable-delivery layer, specifically\r\n that if a message is submitted to the reliable-delivery\r\n component then its intended recipient eventually receives it and\r\n queues it for processing. This proof requires various\r\n assumptions codified in `Assumptions.i.dfy`, e.g., a message sent\r\n infinitely often is eventually delivered. The ultimate liveness\r\n proof is in `LivenessProof.i.dfy`.\r\n - `Lock`\r\n Defines the protocol layer of our Lock service\r\n + `RefinementProof`\r\n Proof that the implementation refines the specification. The proof\r\n uses two intermediate layers of states beyond the implementation and\r\n the specification. The `LS_State` layer represents the protocol states,\r\n while the `GLS_State` layer augments each protocol state with a history\r\n variable, which is used to prove refinement to the high-level specification.\r\n + `Services`\r\n These directories tie the implementation, protocol, and specifications together.\r\n Each service has a directory with `.s.dfy` files that define the service-specific\r\n specifications (e.g. that RSL should be a state machine or that SHT should be a\r\n hash table). The file `Main.i.dfy` in each directory instantiates the abstract\r\n host with the concrete implementation and supplies a proof that refinement holds\r\n from the implementation all the way up to the abstract specification. See\r\n `src/Dafny/Distributed/Common/Framework` for the guarantees this provides.\r\n" }, { "path": "ironfleet/CONTRIBUTING.md", "content": "\r\n# Legal\r\nTo contribute, you will need to complete a Contributor License Agreement (CLA). Briefly,\r\nthis agreement testifies that you are granting us permission to use the submitted change\r\naccording to the terms of the project's license, and that the work being submitted is\r\nunder appropriate copyright.\r\n\r\nPlease submit a Contributor License Agreement (CLA) before submitting a pull request. You\r\nmay visit https://cla.microsoft.com to sign digitally. Alternatively, download the agreement \r\n[Microsoft Contribution License Agreement.docx](https://www.codeplex.com/Download?ProjectName=typescript&DownloadId=822190)\r\nor [Microsoft Contribution License Agreement.pdf](https://www.codeplex.com/Download?ProjectName=typescript&DownloadId=921298)),\r\nsign, scan, and email it back to [cla@microsoft.com](mailto:cla@microsoft.com). Be sure to include\r\nyour github user name along with the agreement. Once we have received the signed CLA,\r\nwe'll review the request.\r\n\r\n# Code of Conduct\r\nThis project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.\r\n\r\n# Housekeeping\r\nYour pull request should:\r\n\r\n - Include a description of what your change intends to do\r\n - Be a child commit of a reasonably recent commit in the master branch\r\n - Requests need not be a single commit, but should be a linear sequence of commits (i.e.\r\n no merge commits in your private repository).\r\n - It is desirable, but not necessary, for the full BatchDafny verification to succeed at\r\n each commit (see the [README](./README.md) for instructions on running BatchDafny),\r\n but it must succeed for the final commit.\r\n - Have clear commit messages e.g. \"Refactor feature\" or \"Fix issue\"\r\n - Follow the code conventions described in the [STYLE](./STYLE.md) guidelines\r\n\r\n\r\n" }, { "path": "ironfleet/IRONROOT.sentinel", "content": "This file marks the top of the Ironclad source repository.\r\nIts presence is used by the NuBuild system to orient itself\r\nto the src/, nuobj/, and nucache/ directories.\r\n" }, { "path": "ironfleet/LICENSE", "content": "Ironclad 1.0\r\n\r\nCopyright (c) Microsoft Corporation\r\nAll rights reserved. \r\n\r\nMIT License\r\n\r\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"\"Software\"\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\r\n\r\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\r\n\r\nTHE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\r\n\r\n\r\n" }, { "path": "ironfleet/README.md", "content": "# About\r\n\r\nThis directory contains experimental verified IronFleet code, as described in:\r\n\r\n> [_IronFleet: Proving Practical Distributed Systems Correct_](https://www.microsoft.com/en-us/research/publication/ironfleet-proving-practical-distributed-systems-correct/)\r\n> Chris Hawblitzel, Jon Howell, Manos Kapritsos, Jacob R. Lorch, \r\n> Bryan Parno, Michael L. Roberts, Srinath Setty, and Brian Zill.\r\n> In Proceedings of the ACM Symposium on Operating Systems Principles (SOSP).\r\n> October 5, 2015.\r\n\r\n> [_IronFleet: Proving Safety and Liveness of Practical Distributed Systems_](https://www.microsoft.com/en-us/research/publication/ironfleet-proving-safety-liveness-practical-distributed-systems/)\r\n> Chris Hawblitzel, Jon Howell, Manos Kapritsos, Jacob R. Lorch, \r\n> Bryan Parno, Michael L. Roberts, Srinath Setty, and Brian Zill.\r\n> Communications of the ACM (CACM) 60(7), July 2017.\r\n\r\nAs a brief summary, we are motivated by the fact that distributed systems are notorious\r\nfor harboring subtle bugs. Verification can, in principle, eliminate these bugs a priori,\r\nbut verification has historically been difficult to apply at full-program scale, much less\r\ndistributed-system scale.\r\n\r\nWe developed a methodology for building practical and provably correct distributed systems\r\nbased on a unique blend of TLA-style state-machine refinement and Hoare-logic\r\nverification. In this code release, we demonstrate the methodology on a complex\r\nimplementation of a Paxos-based replicated state machine library (IronRSL) and a\r\nlease-based sharded key-value store (IronKV). We prove that each obeys a concise safety\r\nspecification, as well as desirable liveness requirements. Each implementation achieves\r\nperformance competitive with a reference system. With our methodology and lessons\r\nlearned, we aim to raise the standard for distributed systems from \"tested\" to \"correct.\"\r\n\r\nSee https://research.microsoft.com/ironclad for more details.\r\n\r\n# License\r\n\r\nIronFleet is licensed under the MIT license included in the [LICENSE](./LICENSE) file.\r\n\r\n# Setup\r\n\r\nTo use Ironfleet, you'll need the following tools:\r\n * .NET 6.0 SDK (available at `https://dotnet.microsoft.com/download`)\r\n * Dafny v3.4.0 (verifier, available at `https://github.com/dafny-lang/dafny`)\r\n * python 2 or 3 (needed for running scons)\r\n * scons (installable by running `pip install scons`)\r\n \r\nThe instructions below have been tested using Windows 10 and 11, macOS\r\nCatalina, and Ubuntu 20.04. They should also work for other platforms\r\nDafny and .NET support, such as Ubuntu 16.04 and Debian. On Windows,\r\nthey work with at least the following shells: Command Prompt, Windows\r\nPowerShell, Cygwin mintty, and Ubuntu 20.04 on Windows Subsystem for\r\nLinux.\r\n\r\n# Verification and Compilation\r\n\r\nTo build and verify the contents of this repo, use:\r\n\r\n `scons --dafny-path=/path/to/directory/with/dafny/`\r\n\r\nTo use `` threads in parallel, add `-j ` to this command.\r\n\r\nExpect this to take up to several hours, depending on your machine and how many\r\ncores you have available. Also note that the prover's time limits are based on\r\nwall clock time, so if you run the verification on a slow machine, you may see a\r\nfew timeouts not present in our build. If that happens, try using a longer time\r\nlimit for each verification; for example, using `--time-limit=120` makes the time\r\nlimit 120 seconds instead of the default 60 seconds.\r\n\r\nRunning scons will produce the following executables:\r\n```\r\n bin/CreateIronServiceCerts.dll\r\n bin/TestIoFramework.dll\r\n bin/IronLockServer.dll\r\n bin/IronRSLCounterServer.dll\r\n bin/IronRSLCounterClient.dll\r\n bin/IronRSLKVServer.dll\r\n bin/IronRSLKVClient.dll\r\n bin/IronSHTServer.dll\r\n bin/IronSHTClient.dll\r\n```\r\n\r\nTo produce these executables without performing verification, use `--no-verify`.\r\n\r\n# Running\r\n\r\n## Creating certificates\r\n\r\nIronfleet servers identify themselves using certificates. So, before running\r\nany Ironfleet services, you need to generate certificates for the service by\r\nrunning `CreateIronServiceCerts`. On the command line you'll specify the name\r\nand type of the service and, for each server, its public address and port. Each\r\nsuch address can be a hostname like `www.myservice.com` or an IP address like\r\n`127.0.0.1` or `2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF`.\r\n\r\nFor instance, you can run the following command:\r\n```\r\n dotnet bin/CreateIronServiceCerts.dll outputdir=certs name=MyService type=TestService addr1=server1.com port1=6000 addr2=server2.com port2=7000\r\n```\r\nThis will create three files in the directory `certs`. Two of these files,\r\n`MyService.TestService.server1.private.txt` and\r\n`MyService.TestService.server2.private.txt`, are the private key files for the\r\ntwo servers. The third, `MyService.TestService.service.txt`, contains the\r\nservice identity, including the public keys of the two servers.\r\n\r\nYou'll distribute the service file to all servers and all clients. But,\r\nyou should only copy a private key file to the server corresponding to that\r\nprivate key, and after copying it you should delete your local copy. So, in\r\nthis example, you'd copy `MyService.TestService.server1.private.txt` only to\r\nserver1.com.\r\n\r\n## IronLock\r\n\r\nIronLock is the simplest of the protocols we've verified, so it may be a good\r\nstarting point. It consists of N processes passing around a lock. To run it,\r\nmake sure your firewall isn't blocking the TCP ports you use. Here's an example\r\nconfiguration with three processes:\r\n\r\nCreate the service with:\r\n```\r\n dotnet bin/CreateIronServiceCerts.dll outputdir=certs name=MyLock type=IronLock addr1=127.0.0.1 port1=4001 addr2=127.0.0.1 port2=4002 addr3=127.0.0.1 port3=4003\r\n```\r\n\r\nRun the service by executing the following three commands in three different\r\nwindows:\r\n```\r\n dotnet bin/IronLockServer.dll certs/MyLock.IronLock.service.txt certs/MyLock.IronLock.server2.private.txt\r\n dotnet bin/IronLockServer.dll certs/MyLock.IronLock.service.txt certs/MyLock.IronLock.server3.private.txt\r\n dotnet bin/IronLockServer.dll certs/MyLock.IronLock.service.txt certs/MyLock.IronLock.server1.private.txt\r\n```\r\n\r\nIt's important that you start the \"first\" process last (as in the above\r\nexample), as it initially holds the lock and will immediately start passing it\r\naround. As this is a toy example, message retransmission isn't implemented.\r\nTherefore, if the other processes aren't running by the time the first process\r\nsends a grant message, the message will be lost and the protocol will stop.\r\n\r\nIf started properly, the processes will pass the lock among them as fast as they\r\ncan, printing a message everytime they accept or grant the lock.\r\n\r\n## IronRSL - Counter\r\n\r\nTo run the counter service replicated with IronRSL, you should ideally use\r\nfour different machines, but in a pinch you can use four separate windows on\r\nthe same machine.\r\n\r\nThe client has reasonable defaults that you can override with key=value\r\ncommand-line arguments. Run the client with no arguments to get detailed usage\r\ninformation. Make sure your firewall isn't blocking the TCP ports you use.\r\n\r\nTo test the IronRSL counter on a single machine, you can do the following.\r\n\r\nFirst, create certificates with:\r\n```\r\n dotnet bin/CreateIronServiceCerts.dll outputdir=certs name=MyCounter type=IronRSLCounter addr1=127.0.0.1 port1=4001 addr2=127.0.0.1 port2=4002 addr3=127.0.0.1 port3=4003\r\n```\r\n\r\nThen, run each of the following three server commands, each in a different window.\r\n```\r\n dotnet bin/IronRSLCounterServer.dll certs/MyCounter.IronRSLCounter.service.txt certs/MyCounter.IronRSLCounter.server1.private.txt\r\n dotnet bin/IronRSLCounterServer.dll certs/MyCounter.IronRSLCounter.service.txt certs/MyCounter.IronRSLCounter.server2.private.txt\r\n dotnet bin/IronRSLCounterServer.dll certs/MyCounter.IronRSLCounter.service.txt certs/MyCounter.IronRSLCounter.server3.private.txt\r\n```\r\n\r\nFinally, run this client command in yet another window:\r\n```\r\n dotnet bin/IronRSLCounterClient.dll certs/MyCounter.IronRSLCounter.service.txt nthreads=10 duration=30 print=true\r\n```\r\n\r\nIf you don't want the client to print the counter values it receives in replies,\r\nremove `print=true` from the client command. In that case, its output will\r\nprimarily consist of reports of the form `#req \r\n`.\r\n\r\nYou can run the client as many times as you want. But, you can only run each\r\nserver once since we haven't implemented crash recovery. To prevent you from\r\naccidentally running a server multiple times, the server program deletes its\r\nprivate key file right after reading it.\r\n\r\nFortunately, `IronRSLCounter` can deal with the failure of fewer than half its\r\nservers. But, if half of them or more fail, you'll have to create a new\r\nservice. That is, you'll have to start over by running `CreateIronServiceCerts`,\r\nand that new service's counter will start at 0.\r\n\r\nNote that the servers use non-blocking network receives, so they may be slow\r\nto respond to Ctrl-C.\r\n\r\n## IronRSL - Key-Value Store\r\n\r\nTo run the key-value service replicated with IronRSL, you should ideally use\r\nfour different machines, but in a pinch you can use four separate windows on\r\nthe same machine.\r\n\r\nThe client has reasonable defaults that you can override with key=value\r\ncommand-line arguments. Run the client with no arguments to get detailed usage\r\ninformation. Make sure your firewall isn't blocking the TCP ports you use.\r\n\r\nTo test the IronRSL key-value store on a single machine, you can do the following.\r\nFirst, create certificates with:\r\n```\r\n dotnet bin/CreateIronServiceCerts.dll outputdir=certs name=MyKV type=IronRSLKV addr1=127.0.0.1 port1=4001 addr2=127.0.0.1 port2=4002 addr3=127.0.0.1 port3=4003\r\n```\r\n\r\nThen, run each of the following three server commands, each in a different window:\r\n```\r\n dotnet bin/IronRSLKVServer.dll certs/MyKV.IronRSLKV.service.txt certs/MyKV.IronRSLKV.server1.private.txt\r\n dotnet bin/IronRSLKVServer.dll certs/MyKV.IronRSLKV.service.txt certs/MyKV.IronRSLKV.server2.private.txt\r\n dotnet bin/IronRSLKVServer.dll certs/MyKV.IronRSLKV.service.txt certs/MyKV.IronRSLKV.server3.private.txt\r\n```\r\n\r\nFinally, run this client command in yet another window:\r\n```\r\n dotnet bin/IronRSLKVClient.dll certs/MyKV.IronRSLKV.service.txt nthreads=10 duration=30 setfraction=0.25 deletefraction=0.05 print=true\r\n```\r\n\r\nIf you don't want the client to print the requests it sends and the replies it\r\nreceives, remove `print=true` from the client command. In that case, its output\r\nwill primarily consist of reports of the form `#req \r\n`.\r\n\r\nYou can run the client as many times as you want. But, you can only run each\r\nserver once since we haven't implemented crash recovery. To prevent you from\r\naccidentally running a server multiple times, the server program deletes its\r\nprivate key file right after reading it.\r\n\r\nFortunately, `IronRSLKV` can deal with the failure of fewer than half its\r\nservers. But, if half of them or more fail, you'll have to create a new\r\nservice. That is, you'll have to start over by running `CreateIronServiceCerts`,\r\nand that new service's key-value store will start out empty.\r\n\r\nNote that the servers use non-blocking network receives, so they may be slow\r\nto respond to Ctrl-C.\r\n\r\n## IronSHT\r\n\r\nTo run IronSHT (our sharded hash table), you should ideally use multiple\r\ndifferent machines, but in a pinch you can use separate windows on the same\r\nmachine.\r\n\r\nThe client has reasonable defaults that you can override with key=value\r\ncommand-line arguments. Run the client with no arguments to get detailed usage\r\ninformation. Make sure your firewall isn't blocking the TCP ports you use.\r\n\r\nTo test the IronSHT sharded hash table on a single machine, you can do the following.\r\nFirst, create certificates with:\r\n```\r\n dotnet bin/CreateIronServiceCerts.dll outputdir=certs name=MySHT type=IronSHT addr1=127.0.0.1 port1=4001 addr2=127.0.0.1 port2=4002 addr3=127.0.0.1 port3=4003\r\n```\r\n\r\nThen, run each of the following three server commands, each in a different window:\r\n```\r\n dotnet bin/IronSHTServer.dll certs/MySHT.IronSHT.service.txt certs/MySHT.IronSHT.server1.private.txt\r\n dotnet bin/IronSHTServer.dll certs/MySHT.IronSHT.service.txt certs/MySHT.IronSHT.server2.private.txt\r\n dotnet bin/IronSHTServer.dll certs/MySHT.IronSHT.service.txt certs/MySHT.IronSHT.server3.private.txt\r\n```\r\n\r\nFinally, run this client command in yet another window:\r\n```\r\n dotnet bin/IronSHTClient.dll certs/MySHT.IronSHT.service.txt nthreads=10 duration=30 workload=g numkeys=1000\r\n```\r\nThe client's output will primarily consist of reports of the form `#req\r\n `. This output won't start for\r\nseveral seconds since the client has a lot of setup to do.\r\n\r\nWe haven't implemented crash recovery, so if you restart a server its state will\r\nbe empty.\r\n\r\n# Custom Replicated Services\r\n\r\nIronRSL-Counter and IronRSL-KV are examples showing how to write a service in C#\r\nand replicate it using IronRSL. If you want to replicate a different C#\r\nservice, it's fairly easy to do by just following the examples in\r\n`src/IronRSLCounterServer/IronRSLCounterServer.sln`,\r\n`src/IronRSLKVServer/IronRSLKVServer.sln`,\r\n`src/IronRSLCounterClient/IronRSLCounterClient.sln`, and\r\n`src/IronRSLKVClient/IronRSLKVClient.sln`.\r\n\r\nYour service implementation, like in `src/IronRSLCounterServer/Service.cs`, must\r\nlook like this:\r\n```\r\n namespace IronRSL {\r\n public class Service {\r\n public static string Name { get { ... } }\r\n public static Service Initialize() { ... }\r\n public byte[] Serialize() { ... }\r\n public static Service Deserialize(byte[] buf) { ... }\r\n public byte[] HandleRequest(byte[] request) { ... }\r\n }\r\n }\r\n```\r\nwhere you fill out the ellipses to provide:\r\n* a static property to provide the service name,\r\n* a static method to initialize the service state,\r\n* a method to serialize the service state,\r\n* a static method to deserialize the service state, and\r\n* a method to handle a request and return a reply.\r\n\r\nYour client implementation, like in `src/IronRSLKVClient/Client.cs`, will\r\ncreate a connection to the replicated service with:\r\n```\r\n var serviceIdentity = ServiceIdentity.ReadFromFile(serviceFileName);\r\n RSLClient rslClient = new RSLClient(serviceIdentity, serviceName);\r\n```\r\nand submit requests to that replicated service with:\r\n```\r\n byte[] reply = rslClient.SubmitRequest(request);\r\n```\r\n\r\n# Code Layout\r\n\r\nSee the [CODE](./CODE.md) file for more details on the various files in the\r\nrepository.\r\n\r\n# Contributing\r\n\r\nSee the [CONTRIBUTING](./CONTRIBUTING.md) file for more details.\r\n\r\n# Version History\r\n- v0.1: Initial code release\r\n- v0.2: Compatibility with Dafny 3.0.0 and .NET Core 5\r\n" }, { "path": "ironfleet/SConstruct", "content": "# -*- python -*-\r\nimport atexit\r\nimport os, os.path\r\nimport re\r\nimport shutil\r\nimport subprocess\r\nimport sys\r\nimport SCons.Util\r\nimport threading\r\n\r\nImport(\"*\")\r\n\r\nenv = Environment(ENV=os.environ)\r\n\r\n# Retrieve tool-specific command overrides passed in by the user\r\nAddOption('--dafny-path',\r\n dest='dafny_path',\r\n type='string',\r\n default=None,\r\n action='store',\r\n help='Specify the path to Dafny tool binaries')\r\n\r\nAddOption('--no-verify',\r\n dest='no_verify',\r\n default=False,\r\n action='store_true',\r\n help=\"Don't verify, just build executables\")\r\n\r\nAddOption('--time-limit',\r\n dest='time_limit',\r\n type='int',\r\n default=60,\r\n action='store',\r\n help='Specify the time limit to use for each verification')\r\n\r\ndafny_path = GetOption('dafny_path')\r\nif dafny_path is None:\r\n sys.stderr.write(\"ERROR: Missing --dafny-path on command line\\n\")\r\n exit(-1)\r\n\r\nif sys.platform == \"win32\" or sys.platform == \"cygwin\":\r\n dafny_exe = os.path.join(dafny_path, 'Dafny.exe')\r\n if not os.path.exists(dafny_exe):\r\n print(\"ERROR: Could not find Dafny executable in \" + dafny_path)\r\n exit(-1)\r\n dafny_invocation = [dafny_exe]\r\nelse:\r\n dafny_exe = os.path.join(dafny_path, 'Dafny.dll')\r\n if not os.path.exists(dafny_exe):\r\n dafny_exe = os.path.join(dafny_path, 'dafny.dll')\r\n if not os.path.exists(dafny_exe):\r\n print(\"ERROR: Could not find Dafny executable in \" + dafny_path)\r\n exit(-1)\r\n dafny_invocation = [\"dotnet\", dafny_exe]\r\n\r\n# Useful Dafny command lines\r\ndafny_basic_args = ['/compile:0', '/timeLimit:' + str(GetOption('time_limit')), '/trace']\r\ndafny_default_args = dafny_basic_args + ['/arith:5', '/noCheating:1']\r\ndafny_args_nlarith = dafny_basic_args + ['/arith:2', '/noCheating:1']\r\ndafny_spec_args = dafny_basic_args\r\n\r\n####################################################################\r\n#\r\n# General routines\r\n#\r\n####################################################################\r\n\r\ndef recursive_glob(env, pattern, strings=False):\r\n matches = []\r\n split = os.path.split(pattern) # [0] is the directory, [1] is the actual pattern\r\n platform_directory = split[0] #os.path.normpath(split[0])\r\n for d in os.listdir(platform_directory):\r\n if os.path.isdir(os.path.join(platform_directory, d)):\r\n newpattern = os.path.join(split[0], d, split[1])\r\n matches.append(recursive_glob(env, newpattern, strings))\r\n\r\n files = env.Glob(pattern, strings=strings)\r\n matches.append(files)\r\n return Flatten(matches)\r\n\r\n####################################################################\r\n#\r\n# Make table of special cases requiring non-default arguments\r\n#\r\n####################################################################\r\n\r\nsource_to_args = [\r\n ('src/Dafny/Distributed/Protocol/Lock/RefinementProof/RefinementProof\\.i\\.dfy', dafny_default_args + ['/noNLarith']),\r\n ('.*nonlinear\\.i\\.dfy', dafny_args_nlarith),\r\n ('.*\\.s\\.dfy', dafny_spec_args),\r\n ('.*\\.dfy', dafny_default_args),\r\n]\r\n\r\n####################################################################\r\n#\r\n# Dafny-specific utilities\r\n#\r\n####################################################################\r\n\r\ndafny_include_re = re.compile(r'include\\s+\"(\\S+)\"', re.M)\r\nsingle_line_comments_re = re.compile(r'//.*\\n')\r\nmultiline_comments_re = re.compile(r'/\\*(([^/\\*])|(\\*[^/])|(/[^\\*]))*\\*/')\r\n\r\ndef remove_dafny_comments(contents):\r\n # Strip out multi-line comments, using a loop to deal with nested comments\r\n while True:\r\n (contents, substitutions_made) = re.subn(multiline_comments_re, ' ', contents)\r\n if substitutions_made == 0:\r\n break\r\n\r\n # Strip out single-line comments\r\n contents = re.sub(single_line_comments_re, '\\n', contents)\r\n return contents\r\n\r\n# helper to look up Dafny command-line arguments matching a srcpath, from the\r\n# source_to_args[] dictionary, dealing with POSIX and Windows pathnames, and\r\n# falling back on a default if no specific override is present.\r\ndef get_dafny_command_line_args(srcpath):\r\n srcpath = os.path.normpath(srcpath) # normalize the path, which, on Windows, switches to \\\\ separators\r\n srcpath = srcpath.replace('\\\\', '/') # switch to posix path separators\r\n for entry in source_to_args:\r\n pattern, args = entry\r\n if re.search(pattern, srcpath, flags=re.IGNORECASE):\r\n return args\r\n\r\n return dafny_default_args\r\n\r\ndependencies_by_file = dict()\r\nalready_verified_files = set()\r\nalready_printed_files = set()\r\n\r\n# Scan a .dfy file to discover its transitive dependencies, and store a\r\n# list of them in dependencies_by_file[fullpath].\r\ndef recursively_scan_for_dependencies(fullpath, depth):\r\n if fullpath in dependencies_by_file:\r\n return\r\n contents = File(fullpath).get_text_contents()\r\n dirname = os.path.dirname(fullpath)\r\n filename = os.path.basename(fullpath)\r\n contents = remove_dafny_comments(contents)\r\n includes = dafny_include_re.findall(contents)\r\n extra_files = [os.path.abspath(os.path.join(dirname, i)) for i in includes]\r\n transitive_dependencies = set(extra_files)\r\n for srcpath in extra_files:\r\n recursively_scan_for_dependencies(srcpath, depth + 1)\r\n transitive_dependencies.update(dependencies_by_file[srcpath])\r\n all_dependencies = sorted(list(transitive_dependencies))\r\n dependencies_by_file[fullpath] = all_dependencies\r\n\r\n\r\n# Scan a .dfy file to discover its dependencies, and add .vdfy targets for each.\r\ndef scan_for_more_targets(target, source, env):\r\n node = source[0]\r\n fullpath = str(node)\r\n recursively_scan_for_dependencies(fullpath, 0)\r\n dependencies = dependencies_by_file[fullpath]\r\n for srcpath in dependencies:\r\n if srcpath not in already_verified_files:\r\n f = os.path.splitext(srcpath)[0] + '.vdfy'\r\n env.DafnyVerify(f, [srcpath, dafny_exe])\r\n already_verified_files.add(srcpath)\r\n return target, source + dependencies\r\n\r\n####################################################################\r\n#\r\n# Dafny routines\r\n#\r\n####################################################################\r\n\r\ndef check_dafny(lines):\r\n for line in lines:\r\n if re.search(\"[Oo]ut of resource\", line):\r\n sys.stderr.write(\"Dafny reported an out-of-resource error\\n\")\r\n raise Exception()\r\n if re.search(\"proof obligations\\]\\s+errors\", line):\r\n sys.stderr.write(\"Dafny reported errors not in summary\\n\")\r\n raise Exception()\r\n\r\ndef check_and_print_tail(filename):\r\n with open(filename, 'r') as fh:\r\n lines = fh.readlines()\r\n check_dafny(lines)\r\n sys.stdout.write(lines[-1])\r\n sys.stdout.write('Full check of Dafny output succeeded\\n')\r\n\r\nCheckAndPrintTail = SCons.Action.ActionFactory(check_and_print_tail, lambda x: \"Checking \" + x)\r\n\r\ndef generate_dafny_verifier_actions(source, target, env, for_signature):\r\n abs_source = File(source[0]).abspath\r\n abs_target = File(target[0]).abspath\r\n source_name = str(source[0])\r\n temp_target_file = re.sub(r'\\.dfy$', '.tmp', source_name)\r\n args = get_dafny_command_line_args(abs_source)\r\n return [\r\n dafny_invocation + args + [source_name, \">\", temp_target_file],\r\n CheckAndPrintTail(temp_target_file),\r\n Move(abs_target, temp_target_file)\r\n ]\r\n\r\n# Add env.DafnyVerify(), to generate Dafny verifier actions\r\ndef add_dafny_verifier_builder(env):\r\n dafny_verifier = Builder(generator = generate_dafny_verifier_actions,\r\n suffix = '.vdfy',\r\n src_suffix = '.dfy',\r\n chdir=0,\r\n emitter = scan_for_more_targets,\r\n )\r\n env.Append(BUILDERS = {'DafnyVerify' : dafny_verifier})\r\n\r\n# Verify a set of Dafny files by creating verification targets for each,\r\n# which in turn causes a dependency scan to verify all of their dependencies.\r\ndef verify_dafny_files(env, files):\r\n for f in files:\r\n target = os.path.splitext(f)[0] + '.vdfy'\r\n env.DafnyVerify(target, [f, dafny_exe])\r\n\r\n# Verify *.dfy files in a list of directories. This enumerates\r\n# all files in those trees, and creates verification targets for each,\r\n# which in turn causes a dependency scan to verify all of their dependencies.\r\ndef verify_files_in(env, directories):\r\n for d in directories:\r\n files = recursive_glob(env, d+'/*.dfy', strings=True)\r\n verify_dafny_files(env, files)\r\n\r\ndef verify_dafny_file(source):\r\n if GetOption('no_verify'):\r\n return\r\n target = re.sub(r\"\\.dfy$\", \".vdfy\", source)\r\n env.DafnyVerify(target, [source, dafny_exe])\r\n\r\n####################################################################\r\n#\r\n# Dafny compilation\r\n#\r\n####################################################################\r\n\r\ndef generate_dafny_compile_actions(source, target, env, for_signature):\r\n return [\r\n dafny_invocation + ['/compile:0', '/spillTargetCode:3', '/noVerify', str(source[0])],\r\n ]\r\n\r\ndef get_dafny_compile_dependencies(target, source, env):\r\n source_name = str(source[0])\r\n recursively_scan_for_dependencies(source_name, 0)\r\n verification_dependencies = dependencies_by_file[source_name]\r\n extra_dependencies = verification_dependencies\r\n if not GetOption('no_verify'):\r\n extra_dependencies.extend([re.sub('\\.dfy$', '.vdfy', f) for f in verification_dependencies if re.search('\\.dfy$', f)])\r\n return target, source + extra_dependencies\r\n\r\n# Add env.DafnyCompile(), to generate dafny_compile build actions\r\ndef add_dafny_compiler_builder(env):\r\n client_builder = Builder(generator = generate_dafny_compile_actions,\r\n chdir=0,\r\n emitter=get_dafny_compile_dependencies)\r\n env.Append(BUILDERS = {'DafnyCompile' : client_builder})\r\n\r\n####################################################################\r\n#\r\n# .NET binaries\r\n#\r\n####################################################################\r\n\r\ndef generate_dotnet_actions(source, target, env, for_signature):\r\n target_dir = os.path.dirname(str(target[0]))\r\n return [\r\n [\"dotnet\", \"build\", \"--configuration\", \"Release\", \"--output\", target_dir, str(source[0])]\r\n ]\r\n\r\ndef get_dotnet_dependencies(target, source, env):\r\n csproj_file = str(source[0])\r\n source_dir = os.path.dirname(csproj_file)\r\n extra_dependencies = [os.path.join(source_dir, f) for f in os.listdir(source_dir) if re.search('\\.cs$', f)]\r\n with open(csproj_file, 'r') as fh:\r\n for line in fh.readlines():\r\n m = re.search(r'', line)\r\n if m:\r\n raw_file_name = re.sub(r'\\\\', '/', m.group(1))\r\n file_name = os.path.normpath(os.path.join(source_dir, raw_file_name))\r\n extra_dependencies.append(file_name)\r\n return target, source + extra_dependencies\r\n\r\n# Add env.DotnetBuild(), to generate dotnet build actions\r\ndef add_dotnet_builder(env):\r\n client_builder = Builder(generator = generate_dotnet_actions,\r\n chdir=0,\r\n emitter=get_dotnet_dependencies)\r\n env.Append(BUILDERS = {'DotnetBuild' : client_builder})\r\n \r\n\r\n####################################################################\r\n#\r\n# Extract verification failure information\r\n#\r\n####################################################################\r\n\r\n# extract a string filename out of a build failure\r\ndef bf_to_filename(bf):\r\n import SCons.Errors\r\n if bf is None: # unknown targets product None in list\r\n return '(unknown tgt)'\r\n elif isinstance(bf, SCons.Errors.StopError):\r\n return str(bf)\r\n elif bf.node:\r\n return str(bf.node)\r\n elif bf.filename:\r\n return bf.filename\r\n return '(unknown failure)'\r\n\r\ndef report_verification_failures():\r\n from SCons.Script import GetBuildFailures\r\n bf = GetBuildFailures()\r\n if bf:\r\n # bf is normally a list of build failures; if an element is None,\r\n # it's because of a target that scons doesn't know anything about.\r\n for x in bf:\r\n if x is not None:\r\n filename = bf_to_filename(x)\r\n if filename.endswith('.vdfy'):\r\n file_to_print = os.path.splitext(filename)[0] + '.tmp'\r\n if os.path.isfile(file_to_print):\r\n sys.stdout.write('\\n##### Verification error. Printing contents of ' + file_to_print + ' #####\\n\\n')\r\n with open (file_to_print, 'r') as myfile:\r\n sys.stdout.write(myfile.read())\r\n else:\r\n print(\"ERROR: Verification error, but cannot print output since file %s doesn't exist\" % (file_to_print))\r\n else:\r\n print(\"Build failure for %s\" % (filename))\r\n\r\n\r\ndef display_build_status():\r\n report_verification_failures()\r\n\r\n####################################################################\r\n#\r\n# Put it all together\r\n#\r\n####################################################################\r\n\r\nadd_dafny_verifier_builder(env)\r\nadd_dafny_compiler_builder(env)\r\nadd_dotnet_builder(env)\r\nenv.AddMethod(verify_files_in, \"VerifyFilesIn\")\r\nenv.AddMethod(verify_dafny_files, \"VerifyDafnyFiles\")\r\natexit.register(display_build_status)\r\n\r\n####################################################################\r\n#\r\n# Create dependencies\r\n#\r\n####################################################################\r\n\r\nverify_dafny_file('src/Dafny/Distributed/Services/Lock/Main.i.dfy')\r\nverify_dafny_file('src/Dafny/Distributed/Services/SHT/Main.i.dfy')\r\nverify_dafny_file('src/Dafny/Distributed/Services/RSL/Main.i.dfy')\r\nverify_dafny_file('src/Dafny/Distributed/Protocol/RSL/LivenessProof/LivenessProof.i.dfy')\r\nverify_dafny_file('src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/LivenessProof.i.dfy')\r\n\r\nenv.DafnyCompile('src/Dafny/Distributed/Services/RSL/Main.i.cs', 'src/Dafny/Distributed/Services/RSL/Main.i.dfy')\r\nenv.DotnetBuild('bin/IronRSLCounterServer.dll', 'src/IronRSLCounterServer/IronRSLCounterServer.csproj')\r\nenv.DotnetBuild('bin/IronRSLCounterClient.dll', 'src/IronRSLCounterClient/IronRSLCounterClient.csproj')\r\nenv.DotnetBuild('bin/IronRSLKVServer.dll', 'src/IronRSLKVServer/IronRSLKVServer.csproj')\r\nenv.DotnetBuild('bin/IronRSLKVClient.dll', 'src/IronRSLKVClient/IronRSLKVClient.csproj')\r\n\r\nenv.DafnyCompile('src/Dafny/Distributed/Services/SHT/Main.i.cs', 'src/Dafny/Distributed/Services/SHT/Main.i.dfy')\r\nenv.DotnetBuild('bin/IronSHTServer.dll', 'src/IronSHTServer/IronSHTServer.csproj')\r\nenv.DotnetBuild('bin/IronSHTClient.dll', 'src/IronSHTClient/IronSHTClient.csproj')\r\n\r\nenv.DafnyCompile('src/Dafny/Distributed/Services/Lock/Main.i.cs', 'src/Dafny/Distributed/Services/Lock/Main.i.dfy')\r\nenv.DotnetBuild('bin/IronLockServer.dll', 'src/IronLockServer/IronLockServer.csproj')\r\n\r\nenv.DotnetBuild('bin/CreateIronServiceCerts.dll', 'src/CreateIronServiceCerts/CreateIronServiceCerts.csproj')\r\nenv.DotnetBuild('bin/TestIoFramework.dll', 'src/TestIoFramework/TestIoFramework.csproj')\r\n" }, { "path": "ironfleet/STYLE.md", "content": "# Style Guide\r\n\r\nThese are the conventions we aspire to follow. Note that not all of the current code has\r\nbeen brought into line yet.\r\n\r\n- Use spaces, not tabs. 4 spaces per \"tab\"\r\n- Files should use Windows-style newlines (CRLF)\r\n- We sort functions/methods within a file topologically, so that everything method M depends on should be above M in the file\r\n- We use the lemma keyword to indicate ghost methods used for proof purposes, and we prefix the method's name with \"lemma_\"\r\n- In the implementation, given a concrete type, e.g., `CPacket`, we define the following:\r\n + `function AbstractifyCPacket(pkt:CPacket) : Packet`\r\n + Which in turn requires:\r\n `predicate CPacketIsAbstractable(pkt:CPacket)`\r\n which should be the minimum necessary to call `AbstractifyCPacket`\r\n + We also define:\r\n `predicate CPacketIsValid(pkt:CPacket)`\r\n which should imply `CPacketIsAbstractable` and include any additional requirements necessary \r\n at the implementation level (e.g., that it fits with 2^64 bytes)\r\n- For method, lemma, class, and datatype names, we use camel case\r\n + Note that acronyms only capitalize the first letter (e.g., `TpmIsValid` instead of `TPMIsValid`)\r\n + Method names are capitalized\r\n + Lemmas begin with \"lemma_\"\r\n- Variables:\r\n + Initially lower case\r\n + Underscores instead of camel case\r\n- Braces:\r\n + If/else open on same line\r\n + Calc open on same line\r\n - Operator or tab, then hint\r\n + While loops are matched\r\n + Methods, predicates, functions: matched unless single line\r\n- Use `predicate` instead of `function foo():bool`\r\n\r\n" }, { "path": "ironfleet/src/CreateIronServiceCerts/.gitignore", "content": ".vs\nProperties/\n" }, { "path": "ironfleet/src/CreateIronServiceCerts/CreateIronServiceCerts.csproj", "content": "\n\n \n Exe\n net6.0\n \n\n \n 1701;1702;162;164;168;183;219;436;1717;1718\n \n\n \n CreateIronServiceCerts.Program\n \n\n \n \n \n\n \n \n \n\n\n" }, { "path": "ironfleet/src/CreateIronServiceCerts/CreateIronServiceCerts.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.31005.135\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"CreateIronServiceCerts\", \"CreateIronServiceCerts.csproj\", \"{80249939-7D35-43CA-891A-F4C73EC6D959}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {3EDDD386-2BE8-48A4-8188-FFDA2034F16D}\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironfleet/src/CreateIronServiceCerts/Params.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.IO;\nusing System.Net;\nusing System.Text.RegularExpressions;\n\nnamespace CreateIronServiceCerts\n{\n public class Params\n {\n private static int MAX_SERVER_COUNT = 1000;\n private string serviceName;\n private string serviceType;\n private int maxServerIndex;\n private string outputDir;\n private Dictionary serverAddrs;\n private Dictionary serverPorts;\n private bool verbose;\n private bool useSsl;\n\n public Params()\n {\n serviceName = \"MyIronfleetService\";\n serviceType = \"IronRSLKV\";\n maxServerIndex = 0;\n outputDir = \".\";\n serverAddrs = new Dictionary();\n serverPorts = new Dictionary();\n verbose = false;\n useSsl = true;\n }\n\n public int MaxServerIndex { get { return maxServerIndex; } }\n public string ServiceName { get { return serviceName; } }\n public string ServiceType { get { return serviceType; } }\n public string OutputDir { get { return outputDir; } }\n public bool Verbose { get { return verbose; } }\n public bool UseSsl { get { return useSsl; } }\n\n public bool GetServerData (int serverIndex, out string addr, out int port)\n {\n addr = \"\";\n port = 0;\n if (!serverAddrs.TryGetValue(serverIndex, out addr)) {\n return false;\n }\n if (!serverPorts.TryGetValue(serverIndex, out port)) {\n return false;\n }\n return true;\n }\n\n public bool UseServerIndex(int serverIndex)\n {\n if (serverIndex >= MAX_SERVER_COUNT) {\n Console.WriteLine(\"ERROR - Server #{0} too big -- must be less than {1}\", serverIndex, MAX_SERVER_COUNT);\n return false;\n }\n if (serverIndex == 0) {\n Console.WriteLine(\"ERROR - Server indices should start at 1, not 0. So, don't use addr0 or port0.\");\n return false;\n }\n\n maxServerIndex = Math.Max(maxServerIndex, serverIndex);\n return true;\n }\n\n public bool Validate()\n {\n if (maxServerIndex == 0)\n {\n Console.WriteLine(\"ERROR - No server data supplied. You need to provide at least addr1 and port1.\");\n return false;\n }\n\n for (int serverIndex = 1; serverIndex <= maxServerIndex; ++serverIndex) {\n if (!serverAddrs.ContainsKey(serverIndex)) {\n Console.WriteLine(\"ERROR - Missing addr{0}\", serverIndex);\n return false;\n }\n if (!serverPorts.ContainsKey(serverIndex)) {\n Console.WriteLine(\"ERROR - Missing port{0}\", serverIndex);\n return false;\n }\n }\n return true;\n }\n\n public bool ProcessCommandLineArgument(string arg)\n {\n var pos = arg.IndexOf(\"=\");\n if (pos < 0) {\n Console.WriteLine(\"ERROR - Invalid argument {0}\", arg);\n return false;\n }\n var key = arg.Substring(0, pos).ToLower();\n var value = arg.Substring(pos + 1);\n return SetValue(key, value);\n }\n\n private bool SetValue(string key, string value)\n {\n if (key == \"name\") {\n serviceName = value;\n return true;\n }\n\n if (key == \"type\") {\n serviceType = value;\n return true;\n }\n\n if (key == \"verbose\") {\n if (value == \"false\") {\n verbose = false;\n return true;\n }\n if (value == \"true\") {\n verbose = true;\n return true;\n }\n Console.WriteLine(\"ERROR - Invalid verbose value {0} - should be false or true\", value);\n return false;\n }\n\n if (key == \"usessl\") {\n if (value == \"false\") {\n useSsl = false;\n return true;\n }\n if (value == \"true\") {\n useSsl = true;\n return true;\n }\n Console.WriteLine(\"ERROR - Invalid useSSL value {0} - should be false or true\", value);\n return false;\n }\n\n if (key == \"outputdir\") {\n outputDir = value;\n try {\n Directory.CreateDirectory(outputDir);\n }\n catch (Exception e) {\n Console.WriteLine(\"ERROR - Can't create requested output directory {0}\", outputDir);\n return false;\n }\n return true;\n }\n\n Match m = Regex.Match(key, @\"^addr(\\d+)$\");\n if (m.Success) {\n if (value.Length == 0) {\n Console.WriteLine(\"ERROR - Address {0} cannot be empty\", key);\n return false;\n }\n int serverIndex = Convert.ToInt32(m.Groups[1].Value);\n if (!UseServerIndex(serverIndex)) {\n return false;\n }\n serverAddrs[serverIndex] = value;\n maxServerIndex = Math.Max(maxServerIndex, serverIndex);\n return true;\n }\n\n m = Regex.Match(key, @\"^port(\\d+)$\");\n if (m.Success) {\n int port;\n try {\n port = Convert.ToInt32(value);\n }\n catch (Exception e) {\n Console.WriteLine(\"ERROR - Invalid port number {0} given for key {1}\", value, key);\n return false;\n }\n if (port == 0 || port > 65535) {\n Console.WriteLine(\"ERROR - Invalid port number {0} given for key {1}\", value, key);\n return false;\n }\n\n int serverIndex = Convert.ToInt32(m.Groups[1].Value);\n if (!UseServerIndex(serverIndex)) {\n return false;\n }\n \n serverPorts[serverIndex] = port;\n return true;\n }\n\n Console.WriteLine(\"ERROR - Invalid argument key {0}\", key);\n return false;\n }\n }\n}\n" }, { "path": "ironfleet/src/CreateIronServiceCerts/Program.cs", "content": "using IronfleetIoFramework;\nusing System;\nusing System.Collections.Generic;\nusing System.IO;\nusing System.Linq;\nusing System.Net;\nusing System.Numerics;\nusing System.Threading;\n\nnamespace CreateIronServiceCerts\n{\n class Program\n {\n static void usage()\n {\n Console.Write(@\"\nUsage: dotnet CreateIronServiceCerts.dll [key=value]...\n\nAllowed keys:\n name - friendly name of the service (default \"\"MyIronfleetService\"\")\n type - service type (default \"\"IronRSLKV\"\")\n outputdir - directory to write certificates into (default \"\".\"\")\n addr - public address (host name or IP) of server #\n port - public port of server #\n verbose - print verbose output (false or true, default false)\n useSSL - whether to use SSL (default: true)\n\");\n }\n\n static void Main(string[] args)\n {\n Params ps = new Params();\n\n foreach (var arg in args)\n {\n if (!ps.ProcessCommandLineArgument(arg)) {\n usage();\n return;\n }\n }\n\n if (!ps.Validate()) {\n return;\n }\n\n List serverPublicIdentities = new List();\n\n for (int serverIndex = 1; serverIndex <= ps.MaxServerIndex; ++serverIndex) {\n string addr;\n int port;\n if (!ps.GetServerData(serverIndex, out addr, out port)) {\n Console.WriteLine(\"ERROR - Missing data for server #{0}\", serverIndex);\n return;\n }\n\n PublicIdentity publicIdentity;\n PrivateIdentity privateIdentity;\n string serverName = string.Format(\"{0}.{1}.server{2}\", ps.ServiceName, ps.ServiceType, serverIndex);\n IronfleetCrypto.CreateNewIdentity(serverName, addr, port, out publicIdentity, out privateIdentity);\n\n var privateKeyFileName = Path.Join(ps.OutputDir, string.Format(\"{0}.private.txt\", serverName));\n if (!privateIdentity.WriteToFile(privateKeyFileName)) {\n return;\n }\n Console.WriteLine(\"Successfully wrote private key for server {0} to {1}\", serverIndex, privateKeyFileName);\n\n serverPublicIdentities.Add(publicIdentity);\n }\n\n var serviceIdentity = new ServiceIdentity {\n FriendlyName = ps.ServiceName,\n ServiceType = ps.ServiceType,\n Servers = serverPublicIdentities,\n UseSsl = ps.UseSsl\n };\n var serviceFileName = Path.Join(ps.OutputDir, string.Format(\"{0}.{1}.service.txt\", ps.ServiceName, ps.ServiceType));\n if (!serviceIdentity.WriteToFile(serviceFileName)) {\n return;\n }\n Console.WriteLine(\"Successfully wrote service description to {0}\", serviceFileName);\n\n Console.WriteLine(\"DONE - SUCCESS\");\n }\n }\n}\n" }, { "path": "ironfleet/src/Dafny/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/.gitignore", "content": "*.i.dll\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Collections/CountMatches.i.dfy", "content": "module Collections__CountMatches_i {\r\n\r\nfunction CountMatchesInSeq(s:seq, f:T-->bool):int\r\n reads f.reads\r\n requires forall x :: f.requires(x)\r\n{\r\n if |s| == 0 then\r\n 0\r\n else\r\n CountMatchesInSeq(s[1..], f) + if f(s[0]) then 1 else 0\r\n}\r\n\r\nfunction CountMatchesInMultiset(m:multiset, f:T-->bool):int\r\n reads f.reads\r\n requires forall x :: f.requires(x)\r\n{\r\n if |m| == 0 then\r\n 0\r\n else\r\n var x :| x in m;\r\n CountMatchesInMultiset(m - multiset{x}, f) + if f(x) then 1 else 0\r\n}\r\n\r\nlemma Lemma_RemovingElementAffectsCount(m:multiset, f:T-->bool, x:T)\r\n requires forall u :: f.requires(u)\r\n requires x in m\r\n ensures CountMatchesInMultiset(m, f) - CountMatchesInMultiset(m - multiset{x}, f) == if f(x) then 1 else 0\r\n{\r\n if |m| > 0\r\n {\r\n var x' :| x' in m && CountMatchesInMultiset(m, f) - CountMatchesInMultiset(m - multiset{x'}, f) == if f(x') then 1 else 0;\r\n if x' != x\r\n {\r\n Lemma_RemovingElementAffectsCount(m - multiset{x'}, f, x);\r\n assert m - multiset{x'} - multiset{x} == m - multiset{x} - multiset{x'};\r\n Lemma_RemovingElementAffectsCount(m - multiset{x}, f, x');\r\n }\r\n }\r\n}\r\n\r\nlemma Lemma_MatchCountInSeqIsMatchCountInMultiset(s:seq, m:multiset, f:T-->bool)\r\n requires forall x :: f.requires(x)\r\n requires m == multiset(s)\r\n ensures CountMatchesInSeq(s, f) == CountMatchesInMultiset(m, f)\r\n{\r\n if |s| > 0\r\n {\r\n assert s == [s[0]] + s[1..];\r\n var m' := multiset(s[1..]);\r\n assert m' == m - multiset {s[0]};\r\n Lemma_RemovingElementAffectsCount(m, f, s[0]);\r\n Lemma_MatchCountInSeqIsMatchCountInMultiset(s[1..], m', f);\r\n }\r\n}\r\n\r\npredicate IsNthHighestValueInSequence(v:int, s:seq, n:int)\r\n{\r\n && 0 < n <= |s|\r\n && v in s\r\n && CountMatchesInSeq(s, x => x > v) < n\r\n && CountMatchesInSeq(s, x => x >= v) >= n\r\n}\r\n\r\npredicate IsNthHighestValueInMultiset(v:int, m:multiset, n:int)\r\n{\r\n && 0 < n <= |m|\r\n && v in m\r\n && CountMatchesInMultiset(m, x => x > v) < n\r\n && CountMatchesInMultiset(m, x => x >= v) >= n\r\n}\r\n\r\nlemma Lemma_SequenceToMultisetPreservesIsNthHighestValue(v:int, s:seq, m:multiset, n:int)\r\n requires m == multiset(s)\r\n ensures IsNthHighestValueInSequence(v, s, n) <==> IsNthHighestValueInMultiset(v, m, n)\r\n{\r\n Lemma_MatchCountInSeqIsMatchCountInMultiset(s, m, x => x > v);\r\n Lemma_MatchCountInSeqIsMatchCountInMultiset(s, m, x => x >= v);\r\n}\r\n\r\nlemma Lemma_CountMatchesInSeqSameForSameFunctions(s:seq, f1:T-->bool, f2:T-->bool)\r\n requires forall x :: f1.requires(x)\r\n requires forall x :: f2.requires(x)\r\n requires forall x :: f1(x) == f2(x)\r\n ensures CountMatchesInSeq(s, f1) == CountMatchesInSeq(s, f2)\r\n{\r\n}\r\n\r\nlemma Lemma_CountMatchesInSeqBounds(s:seq, f:T-->bool)\r\n requires forall x :: f.requires(x)\r\n ensures 0 <= CountMatchesInSeq(s, f) <= |s|\r\n{\r\n}\r\n\r\nlemma Lemma_CountMatchesInSeqAll(s:seq, f:T-->bool)\r\n requires forall x :: f.requires(x)\r\n requires forall x :: x in s ==> f(x)\r\n ensures CountMatchesInSeq(s, f) == |s|\r\n{\r\n}\r\n\r\nlemma Lemma_CountMatchesInSeqCorrespondence(s1:seq, f1:T1-->bool, s2:seq, f2:T2-->bool)\r\n requires forall x :: f1.requires(x)\r\n requires forall x :: f2.requires(x)\r\n requires |s1| == |s2|\r\n requires forall i :: 0 <= i < |s1| ==> f1(s1[i]) == f2(s2[i])\r\n ensures CountMatchesInSeq(s1, f1) == CountMatchesInSeq(s2, f2)\r\n{\r\n}\r\n\r\nfunction{:opaque} EnumerateMatchesInSeq(s:seq, f:T-->bool):seq\r\n reads f.reads\r\n requires forall x :: f.requires(x)\r\n ensures forall x :: (x in s && f(x)) <==> x in EnumerateMatchesInSeq(s, f)\r\n ensures |EnumerateMatchesInSeq(s, f)| == CountMatchesInSeq(s, f)\r\n{\r\n if |s| == 0 then\r\n []\r\n else if f(s[0]) then\r\n [s[0]] + EnumerateMatchesInSeq(s[1..], f)\r\n else\r\n EnumerateMatchesInSeq(s[1..], f)\r\n}\r\n\r\nfunction EnumerateIndicesOfMatchesInSeq_Helper(s:seq, f:T-->bool, offset:int):seq\r\n reads f.reads\r\n requires forall x :: f.requires(x)\r\n ensures forall i :: i in EnumerateIndicesOfMatchesInSeq_Helper(s, f, offset) ==> offset <= i < offset + |s|\r\n ensures forall i :: (0 <= i < |s| && f(s[i])) <==> i+offset in EnumerateIndicesOfMatchesInSeq_Helper(s, f, offset)\r\n ensures offset == 0 ==> forall i :: (0 <= i < |s| && f(s[i])) <==> i in EnumerateIndicesOfMatchesInSeq_Helper(s, f, offset)\r\n ensures |EnumerateIndicesOfMatchesInSeq_Helper(s, f, offset)| == CountMatchesInSeq(s, f)\r\n{\r\n if |s| == 0 then\r\n []\r\n else if f(s[0]) then\r\n [offset] + EnumerateIndicesOfMatchesInSeq_Helper(s[1..], f, offset + 1)\r\n else\r\n EnumerateIndicesOfMatchesInSeq_Helper(s[1..], f, offset + 1)\r\n}\r\n\r\nfunction{:opaque} EnumerateIndicesOfMatchesInSeq(s:seq, f:T-->bool):seq\r\n reads f.reads\r\n requires forall x :: f.requires(x)\r\n ensures forall i :: (0 <= i < |s| && f(s[i])) <==> i in EnumerateIndicesOfMatchesInSeq(s, f)\r\n ensures |EnumerateIndicesOfMatchesInSeq(s, f)| == CountMatchesInSeq(s, f)\r\n{\r\n EnumerateIndicesOfMatchesInSeq_Helper(s, f, 0)\r\n}\r\n\r\nfunction SetOfIndicesOfMatchesInSeq_Helper(s:seq, f:T-->bool, offset:int):set\r\n reads f.reads\r\n requires forall x :: f.requires(x)\r\n ensures forall i :: i in SetOfIndicesOfMatchesInSeq_Helper(s, f, offset) ==> offset <= i < offset + |s|\r\n ensures forall i :: (0 <= i < |s| && f(s[i])) <==> i+offset in SetOfIndicesOfMatchesInSeq_Helper(s, f, offset)\r\n ensures offset == 0 ==> forall i :: (0 <= i < |s| && f(s[i])) <==> i in SetOfIndicesOfMatchesInSeq_Helper(s, f, offset)\r\n ensures |SetOfIndicesOfMatchesInSeq_Helper(s, f, offset)| == CountMatchesInSeq(s, f)\r\n{\r\n if |s| == 0 then\r\n {}\r\n else if f(s[0]) then\r\n {offset} + SetOfIndicesOfMatchesInSeq_Helper(s[1..], f, offset + 1)\r\n else\r\n SetOfIndicesOfMatchesInSeq_Helper(s[1..], f, offset + 1)\r\n}\r\n\r\nfunction{:opaque} SetOfIndicesOfMatchesInSeq(s:seq, f:T-->bool):set\r\n reads f.reads\r\n requires forall x :: f.requires(x)\r\n ensures forall i :: (0 <= i < |s| && f(s[i])) <==> i in SetOfIndicesOfMatchesInSeq(s, f)\r\n ensures |SetOfIndicesOfMatchesInSeq(s, f)| == CountMatchesInSeq(s, f)\r\n{\r\n SetOfIndicesOfMatchesInSeq_Helper(s, f, 0)\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Collections/Maps.i.dfy", "content": "\r\nmodule Collections__Maps_i {\r\n\r\n// TODO_MODULE: module Collections__Maps_i {\r\n\r\npredicate eq_map(x:map, y:map)\r\n ensures eq_map(x, y) ==> x == y;\r\n{\r\n && (forall a :: a in x <==> a in y)\r\n && (forall a :: a in x ==> x[a] == y[a])\r\n}\r\n\r\nfunction method domain(m: map): set\r\n ensures forall i :: i in domain(m) <==> i in m;\r\n{\r\n set s | s in m\r\n}\r\n\r\nfunction union(m: map, m': map): map\r\n requires m.Keys !! m'.Keys\r\n ensures forall i :: i in union(m, m') <==> i in m || i in m'\r\n ensures forall i :: i in m ==> union(m, m')[i] == m[i]\r\n ensures forall i :: i in m' ==> union(m, m')[i] == m'[i]\r\n{\r\n map i{:auto_trigger} | i in (domain(m) + domain(m')) :: if i in m then m[i] else m'[i]\r\n}\r\n\r\nfunction method RemoveElt(m:map, elt:U) : map\r\n requires elt in m\r\n decreases |m|\r\n ensures |RemoveElt(m, elt)| == |m| - 1\r\n ensures !(elt in RemoveElt(m, elt))\r\n ensures forall elt' :: elt' in RemoveElt(m, elt) <==> elt' in m && elt' != elt\r\n{\r\n var m' := map elt' | elt' in m && elt' != elt :: m[elt'];\r\n lemma_map_remove_one(m, m', elt);\r\n m'\r\n}\r\n\r\nlemma lemma_non_empty_map_has_elements(m:map)\r\n requires |m| > 0\r\n ensures exists x :: x in m\r\n{\r\n var dom := domain(m);\r\n var empty_map:map := map [];\r\n assert m.Keys !! empty_map.Keys;\r\n assert m.Keys != empty_map.Keys;\r\n assert |dom| > 0;\r\n}\r\n\r\nlemma lemma_MapSizeIsDomainSize(dom:set, m:map)\r\n requires dom == domain(m)\r\n ensures |m| == |dom|\r\n{\r\n if |m| == 0 {\r\n assert |dom| == 0;\r\n } else {\r\n lemma_non_empty_map_has_elements(m);\r\n var x :| x in m;\r\n assert x in m;\r\n assert x in dom;\r\n var m' := map y | y in m && y != x :: m[y];\r\n var dom' := dom - { x };\r\n lemma_MapSizeIsDomainSize(dom', m');\r\n assert |dom'| == |m'|;\r\n assert |dom| == |dom'| + 1;\r\n assert m == m'[x := m[x]];\r\n assert |m| == |m'| + 1;\r\n }\r\n}\r\n\r\nlemma lemma_maps_decrease(before:map, after:map, item_removed:S)\r\n requires item_removed in before\r\n requires after == map s | s in before && s != item_removed :: before[s]\r\n ensures |after| < |before|\r\n{\r\n assert !(item_removed in after);\r\n forall i | i in after\r\n ensures i in before;\r\n {\r\n assert i in before;\r\n }\r\n\r\n var domain_before := set s | s in before;\r\n var domain_after := set s | s in after;\r\n\r\n lemma_MapSizeIsDomainSize(domain_before, before);\r\n lemma_MapSizeIsDomainSize(domain_after, after);\r\n\r\n if |after| == |before| {\r\n if domain_before == domain_after {\r\n assert !(item_removed in domain_after);\r\n assert false;\r\n } else {\r\n assert |domain_after| == |domain_before|;\r\n var diff := domain_after - domain_before;\r\n assert forall i :: i in domain_after ==> i in domain_before;\r\n assert |diff| == 0;\r\n var diff2 := domain_before - domain_after;\r\n assert item_removed in diff2;\r\n assert |diff2| >= 1;\r\n assert false;\r\n }\r\n } else if |after| > |before|{\r\n //var extra :| extra in domain_after && !(extra in domain_before);\r\n var diff := domain_after - domain_before;\r\n assert |domain_after| > |domain_before|;\r\n if |diff| == 0 {\r\n assert |diff| == |domain_after| - |domain_after*domain_before|;\r\n assert |domain_after*domain_before| <= |domain_before|;\r\n assert |domain_after| == |domain_after*domain_before|;\r\n assert |domain_after| <= |domain_before|;\r\n assert false;\r\n } else {\r\n assert |diff| >= 1;\r\n var diff_item :| diff_item in diff;\r\n assert diff_item in domain_after;\r\n assert !(diff_item in domain_before);\r\n assert false;\r\n }\r\n assert false;\r\n }\r\n}\r\n\r\n\r\nlemma lemma_map_remove_one(before:map, after:map, item_removed:S)\r\n requires item_removed in before\r\n requires after == map s | s in before && s != item_removed :: before[s]\r\n ensures |after| + 1 == |before|\r\n{\r\n lemma_maps_decrease(before, after, item_removed);\r\n var domain_before := domain(before);\r\n var domain_after := domain(after);\r\n\r\n lemma_MapSizeIsDomainSize(domain_before, before);\r\n lemma_MapSizeIsDomainSize(domain_after, after);\r\n \r\n assert domain_after + { item_removed } == domain_before;\r\n}\r\n\r\n// TODO_MODULE: } import opened Collections__Maps_i_ = Collections__Maps_i\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Collections/Maps2.i.dfy", "content": "include \"Maps2.s.dfy\"\r\n// TODO eliminate redundancy between these two libraries we've accreted.\r\n\r\nmodule Collections__Maps2_i {\r\nimport opened Collections__Maps2_s\r\n\r\nfunction maprange(m:map) : set\r\n{\r\n set k | k in m :: m[k]\r\n}\r\n\r\ntype imap2 = imap>\r\n\r\npredicate imap2total(m:imap2)\r\n{\r\n imaptotal(m) && forall k1 :: imaptotal(m[k1])\r\n}\r\n\r\npredicate imaptotal_(f:imap) { imaptotal(f) } // TODO: remove hack when opaque/generic bug is fixed\r\n\r\npredicate monotonic(f:imap)\r\n{\r\n forall i1, i2 :: i1 in f && i2 in f && i1 <= i2 ==> f[i1] <= f[i2]\r\n}\r\n\r\npredicate monotonic_from(start:int, f:imap)\r\n{\r\n forall i1, i2 :: i1 in f && i2 in f && start <= i1 <= i2 ==> f[i1] <= f[i2]\r\n}\r\n\r\npredicate behaviorMonotonic(b:imap, f:imap)\r\n requires imaptotal(b)\r\n requires imaptotal(f)\r\n{\r\n forall i1, i2 :: i1 <= i2 ==> f[b[i1]] <= f[b[i2]]\r\n}\r\n\r\n// TODO_MODULE: module Collections__Maps2_i {\r\n// TODO_MODULE: import opened Collections__Maps2_s\r\n\r\nlemma Lemma_EqualityConditionForMapsWithSameDomain(m1:map, m2:map)\r\n requires mapdomain(m1) == mapdomain(m2)\r\n requires forall s :: s in m1 && s in m2 ==> m1[s] == m2[s]\r\n ensures m1 == m2\r\n{\r\n forall s | s in m1\r\n ensures s in m2;\r\n {\r\n assert s in mapdomain(m1);\r\n assert s in mapdomain(m2);\r\n }\r\n\r\n forall s | s in m2\r\n ensures s in m1;\r\n {\r\n assert s in mapdomain(m2);\r\n assert s in mapdomain(m1);\r\n }\r\n}\r\n\r\nlemma Lemma_imap2equiv(f:imap2, g:imap2)\r\n requires forall k1 :: k1 in f <==> k1 in g\r\n requires forall k1 :: k1 in f ==> f[k1] == g[k1]\r\n ensures f == g\r\n{\r\n}\r\n\r\npredicate TLe(i:int, j:int) { i <= j }\r\n\r\nlemma Lemma_imapInductionRange(start:int, end:int, f:imap)\r\n requires TLe(start, end)\r\n requires forall i :: TLe(start, i) && TLe(i, end) ==> i in f\r\n requires forall i :: TLe(start, i) && TLe(i + 1, end) && f[i] ==> f[i + 1]\r\n requires f[start]\r\n ensures f[end]\r\n decreases end - start\r\n{\r\n if (start != end) {\r\n assert TLe(start, start) && TLe(start + 1, end);\r\n forall i | TLe(start + 1, i) && TLe(i + 1, end)\r\n ensures f[i] ==> f[i+1];\r\n {\r\n assert TLe(start, i) && TLe(i + 1, end);\r\n }\r\n Lemma_imapInductionRange(start + 1, end, f);\r\n }\r\n}\r\n\r\n// TODO_MODULE: } import opened Collections__Maps2_i_ = Collections__Maps2_i\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Collections/Maps2.s.dfy", "content": "// TODO eliminate redundancy between these two libraries we've accreted.\r\n\r\nmodule Collections__Maps2_s {\r\n\r\nfunction mapdomain(m:map) : set\r\n{\r\n set k | k in m :: k\r\n}\r\n\r\nfunction mapremove(m:map, k:KT) : map\r\n{\r\n map ki | ki in m && ki != k :: m[ki]\r\n}\r\n\r\npredicate imaptotal(m:imap)\r\n{\r\n forall k {:trigger m[k]}{:trigger k in m} :: k in m\r\n}\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Collections/Multisets.s.dfy", "content": "\r\nmodule Collections__Multisets_s {\r\nfunction RestrictMultiset(m:multiset, f:S->bool):multiset\r\n reads f.reads\r\n requires forall x :: f.requires(x)\r\n ensures RestrictMultiset(m, f) <= m\r\n ensures forall x :: RestrictMultiset(m, f)[x] == if f(x) then m[x] else 0\r\n{\r\n if |m| == 0 then\r\n multiset{}\r\n else\r\n var x :| x in m;\r\n var m_without_x := m[x := 0];\r\n if f(x) then\r\n RestrictMultiset(m_without_x, f)[x := m[x]]\r\n else\r\n RestrictMultiset(m_without_x, f)\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Collections/Seqs.i.dfy", "content": "include \"Seqs.s.dfy\"\r\n\r\nmodule Collections__Seqs_i {\r\nimport opened Collections__Seqs_s \r\n\r\nlemma SeqAdditionIsAssociative(a:seq, b:seq, c:seq)\r\n ensures a+(b+c) == (a+b)+c;\r\n{\r\n}\r\n\r\npredicate ItemAtPositionInSeq(s:seq, v:T, idx:int)\r\n{\r\n 0 <= idx < |s| && s[idx] == v\r\n}\r\n\r\nlemma Lemma_ItemInSeqAtASomePosition(s:seq, v:T)\r\n requires v in s\r\n ensures exists idx :: ItemAtPositionInSeq(s, v, idx)\r\n{\r\n var idx :| 0 <= idx < |s| && s[idx] == v;\r\n assert ItemAtPositionInSeq(s, v, idx);\r\n}\r\n\r\nfunction FindIndexInSeq(s:seq, v:T):int\r\n ensures var idx := FindIndexInSeq(s, v);\r\n if idx >= 0 then\r\n idx < |s| && s[idx] == v\r\n else\r\n v !in s\r\n{\r\n if v in s then\r\n Lemma_ItemInSeqAtASomePosition(s, v);\r\n var idx :| ItemAtPositionInSeq(s, v, idx);\r\n idx\r\n else\r\n -1\r\n}\r\n\r\nlemma Lemma_IdenticalSingletonSequencesHaveIdenticalElement(x:T, y:T)\r\n requires [x] == [y]\r\n ensures x == y\r\n{\r\n calc {\r\n x;\r\n [x][0];\r\n [y][0];\r\n y;\r\n }\r\n}\r\n\r\n//////////////////////////////////////////////////////////\r\n// Combining sequences of sequences\r\n//////////////////////////////////////////////////////////\r\nfunction SeqCat(seqs:seq>) : seq\r\n{\r\n if |seqs| == 0 then []\r\n else seqs[0] + SeqCat(seqs[1..])\r\n}\r\n\r\nfunction SeqCatRev(seqs:seq>) : seq\r\n{\r\n if |seqs| == 0 then []\r\n else SeqCatRev(all_but_last(seqs)) + last(seqs)\r\n}\r\n\r\nlemma lemma_SeqCat_adds(A:seq>, B:seq>)\r\n ensures SeqCat(A + B) == SeqCat(A) + SeqCat(B)\r\n{\r\n if |A| == 0 {\r\n assert A+B == B;\r\n } else {\r\n calc {\r\n SeqCat(A + B);\r\n { assert (A + B)[0] == A[0]; assert (A + B)[1..] == A[1..] + B; }\r\n A[0] + SeqCat(A[1..] + B);\r\n A[0] + SeqCat(A[1..]) + SeqCat(B);\r\n SeqCat(A) + SeqCat(B);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_SeqCatRev_adds(A:seq>, B:seq>)\r\n ensures SeqCatRev(A + B) == SeqCatRev(A) + SeqCatRev(B)\r\n{\r\n if |B| == 0 {\r\n assert SeqCatRev(B) == [];\r\n assert A+B == A;\r\n } else {\r\n calc {\r\n SeqCatRev(A + B);\r\n { assert last(A + B) == last(B); assert all_but_last(A + B) == A + all_but_last(B); }\r\n SeqCatRev(A + all_but_last(B)) + last(B);\r\n SeqCatRev(A) + SeqCatRev(all_but_last(B)) + last(B);\r\n SeqCatRev(A) + SeqCatRev(B);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_SeqCat_equivalent(seqs:seq>)\r\n ensures SeqCat(seqs) == SeqCatRev(seqs)\r\n{\r\n if |seqs| == 0 {\r\n } else {\r\n calc {\r\n SeqCatRev(seqs);\r\n SeqCatRev(all_but_last(seqs)) + last(seqs);\r\n { lemma_SeqCat_equivalent(all_but_last(seqs)); }\r\n SeqCat(all_but_last(seqs)) + last(seqs);\r\n SeqCat(all_but_last(seqs)) + SeqCat([last(seqs)]);\r\n { lemma_SeqCat_adds(all_but_last(seqs), [last(seqs)]); \r\n assert seqs == all_but_last(seqs) + [last(seqs)]; }\r\n SeqCat(seqs);\r\n }\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Collections/Seqs.s.dfy", "content": "\r\nmodule Collections__Seqs_s {\r\n\r\nfunction last(s:seq):T\r\n requires |s| > 0\r\n{\r\n s[|s|-1]\r\n}\r\n\r\nfunction all_but_last(s:seq):seq\r\n requires |s| > 0\r\n ensures |all_but_last(s)| == |s| - 1\r\n{\r\n s[..|s|-1]\r\n}\r\n \r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Collections/Sets.i.dfy", "content": "\r\nmodule Collections__Sets_i {\r\n\r\nlemma ThingsIKnowAboutSubset(x:set, y:set)\r\n requires x(x:set, y:set)\r\n ensures x |x|<|y|\r\n ensures x<=y ==> |x|<=|y|\r\n{\r\n if (x(foo:set, x:T)\r\n requires foo=={x}\r\n ensures |foo|==1\r\n{\r\n}\r\n\r\nlemma ThingsIKnowAboutASingletonSet(foo:set, x:T, y:T)\r\n requires |foo|==1\r\n requires x in foo\r\n requires y in foo\r\n ensures x==y\r\n{\r\n if (x!=y) {\r\n assert {x} < foo;\r\n ThingsIKnowAboutSubset({x}, foo);\r\n assert |{x}| < |foo|;\r\n assert |foo|>1;\r\n assert false;\r\n }\r\n}\r\n\r\npredicate Injective(f:X-->Y)\r\n reads f.reads\r\n requires forall x :: f.requires(x)\r\n{\r\n forall x1, x2 :: f(x1) == f(x2) ==> x1 == x2\r\n}\r\n\r\npredicate InjectiveOver(xs:set, ys:set, f:X-->Y)\r\n reads f.reads\r\n requires forall x :: x in xs ==> f.requires(x)\r\n{\r\n forall x1, x2 :: x1 in xs && x2 in xs && f(x1) in ys && f(x2) in ys && f(x1) == f(x2) ==> x1 == x2\r\n}\r\n\r\npredicate InjectiveOverSeq(xs:seq, ys:set, f:X-->Y)\r\n reads f.reads\r\n requires forall x :: x in xs ==> f.requires(x)\r\n{\r\n forall x1, x2 :: x1 in xs && x2 in xs && f(x1) in ys && f(x2) in ys && f(x1) == f(x2) ==> x1 == x2\r\n}\r\n\r\nlemma lemma_MapSetCardinality(xs:set, ys:set, f:X-->Y)\r\n requires forall x :: f.requires(x)\r\n requires Injective(f)\r\n requires forall x :: x in xs <==> f(x) in ys\r\n requires forall y :: y in ys ==> exists x :: x in xs && y == f(x)\r\n ensures |xs| == |ys|\r\n{\r\n if (xs != {})\r\n {\r\n var x :| x in xs;\r\n var xs' := xs - {x};\r\n var ys' := ys - {f(x)};\r\n lemma_MapSetCardinality(xs', ys', f);\r\n }\r\n}\r\n\r\nlemma lemma_MapSetCardinalityOver(xs:set, ys:set, f:X-->Y)\r\n requires forall x :: x in xs ==> f.requires(x)\r\n requires InjectiveOver(xs, ys, f)\r\n requires forall x :: x in xs ==> f(x) in ys\r\n requires forall y :: y in ys ==> exists x :: x in xs && y == f(x)\r\n ensures |xs| == |ys|\r\n{\r\n if (xs != {})\r\n {\r\n var x :| x in xs;\r\n var xs' := xs - {x};\r\n var ys' := ys - {f(x)};\r\n lemma_MapSetCardinalityOver(xs', ys', f);\r\n }\r\n}\r\n\r\nlemma lemma_MapSubsetCardinalityOver(xs:set, ys:set, f:X-->Y)\r\n requires forall x :: x in xs ==> f.requires(x)\r\n requires InjectiveOver(xs, ys, f)\r\n requires forall x :: x in xs ==> f(x) in ys\r\n ensures |xs| <= |ys|\r\n{\r\n if (xs != {})\r\n {\r\n var x :| x in xs;\r\n var xs' := xs - {x};\r\n var ys' := ys - {f(x)};\r\n lemma_MapSubsetCardinalityOver(xs', ys', f);\r\n }\r\n}\r\n\r\nlemma lemma_MapSubseqCardinalityOver(xs:seq, ys:set, f:X-->Y)\r\n requires forall x :: x in xs ==> f.requires(x)\r\n requires forall i, j :: 0 <= i < |xs| && 0 <= j < |xs| && i != j ==> xs[i] != xs[j]\r\n requires InjectiveOverSeq(xs, ys, f)\r\n requires forall x :: x in xs ==> f(x) in ys\r\n ensures |xs| <= |ys|\r\n{\r\n if (xs != [])\r\n {\r\n var x := xs[0];\r\n var xs' := xs[1..];\r\n var ys' := ys - {f(x)};\r\n forall x' | x' in xs'\r\n ensures f(x') in ys'\r\n {\r\n assert x' in xs;\r\n assert f(x') in ys;\r\n if f(x') == f(x)\r\n {\r\n assert x in xs && x' in xs && f(x) in ys && f(x') in ys && f(x') == f(x);\r\n assert x' == x;\r\n }\r\n }\r\n forall x1, x2 | x1 in xs' && x2 in xs' && f(x1) in ys' && f(x2) in ys' && f(x1) == f(x2)\r\n ensures x1 == x2\r\n {\r\n assert x1 in xs && x2 in xs && f(x1) in ys && f(x2) in ys';\r\n }\r\n lemma_MapSubseqCardinalityOver(xs', ys', f);\r\n }\r\n}\r\n\r\nfunction/*TODO:{:opaque}*/ MapSetToSet(xs:set, f:X-->Y):set\r\n reads f.reads\r\n requires forall x :: f.requires(x)\r\n requires Injective(f)\r\n ensures forall x :: x in xs <==> f(x) in MapSetToSet(xs, f)\r\n ensures |xs| == |MapSetToSet(xs, f)|\r\n{\r\n var ys := set x | x in xs :: f(x); \r\n lemma_MapSetCardinality(xs, ys, f);\r\n ys\r\n}\r\n\r\nfunction/*TODO:{:opaque}*/ MapSetToSetOver(xs:set, f:X-->Y):set\r\n reads f.reads\r\n requires forall x :: x in xs ==> f.requires(x)\r\n requires InjectiveOver(xs, set x | x in xs :: f(x), f)\r\n ensures forall x :: x in xs ==> f(x) in MapSetToSetOver(xs, f)\r\n ensures |xs| == |MapSetToSetOver(xs, f)|\r\n{\r\n var ys := set x | x in xs :: f(x); \r\n lemma_MapSetCardinalityOver(xs, ys, f);\r\n ys\r\n}\r\n\r\nfunction/*TODO:{:opaque}*/ MapSeqToSet(xs:seq, f:X-->Y):set\r\n reads f.reads\r\n requires forall x :: f.requires(x)\r\n requires Injective(f)\r\n ensures forall x :: x in xs <==> f(x) in MapSeqToSet(xs, f)\r\n{\r\n set x | x in xs :: f(x)\r\n}\r\n\r\nfunction SeqToSet(xs:seq):set\r\n{\r\n set x | x in xs\r\n}\r\n\r\nlemma lemma_SubsetCardinality(xs:set, ys:set, f:X-->bool)\r\n requires forall x :: x in xs ==> f.requires(x)\r\n requires forall x :: x in ys ==> x in xs && f(x)\r\n ensures |ys| <= |xs|\r\n{\r\n if (ys != {})\r\n {\r\n var y :| y in ys;\r\n var xs' := xs - {y};\r\n var ys' := ys - {y};\r\n lemma_SubsetCardinality(xs', ys', f);\r\n }\r\n}\r\n\r\nfunction/*TODO:{:opaque}*/ MakeSubset(xs:set, f:X->bool):set\r\n reads f.reads\r\n requires forall x :: x in xs ==> f.requires(x)\r\n ensures forall x :: x in MakeSubset(xs, f) <==> x in xs && f(x)\r\n ensures |MakeSubset(xs, f)| <= |xs|\r\n{\r\n var ys := set x | x in xs && f(x);\r\n lemma_SubsetCardinality(xs, ys, f);\r\n ys\r\n}\r\n\r\n/* examples:\r\nfunction{:opaque} setAdd1(xs:set):set\r\n ensures forall x :: x in xs <==> x + 1 in setAdd1(xs)\r\n ensures |xs| == |setAdd1(xs)|\r\n{\r\n MapSetToSet(xs, x => x + 1)\r\n}\r\n\r\nfunction{:opaque} setPos(xs:set):set\r\n ensures forall x :: x in setPos(xs) <==> x in xs && x > 0\r\n{\r\n MakeSubset(xs, x => x > 0)\r\n}\r\n*/\r\n\r\nlemma lemma_UnionCardinality(xs:set, ys:set, us:set)\r\n requires us==xs+ys\r\n ensures |us| >= |xs|\r\n decreases ys\r\n{\r\n if (ys=={}) {\r\n } else {\r\n var y :| y in ys;\r\n if (y in xs) {\r\n var xr := xs - {y};\r\n var yr := ys - {y};\r\n var ur := us - {y};\r\n lemma_UnionCardinality(xr, yr, ur);\r\n } else {\r\n var ur := us - {y};\r\n var yr := ys - {y};\r\n lemma_UnionCardinality(xs, yr, ur);\r\n }\r\n }\r\n}\r\n\r\nfunction SetOfNumbersInRightExclusiveRange(a:int, b:int):set\r\n requires a <= b\r\n ensures forall opn :: a <= opn < b ==> opn in SetOfNumbersInRightExclusiveRange(a, b)\r\n ensures forall opn :: opn in SetOfNumbersInRightExclusiveRange(a, b) ==> a <= opn < b\r\n ensures |SetOfNumbersInRightExclusiveRange(a, b)| == b-a\r\n decreases b-a\r\n{\r\n if a == b then {} else {a} + SetOfNumbersInRightExclusiveRange(a+1, b)\r\n}\r\n\r\nlemma lemma_CardinalityOfBoundedSet(s:set, a:int, b:int)\r\n requires forall opn :: opn in s ==> a <= opn < b\r\n requires a <= b\r\n ensures |s| <= b-a\r\n{\r\n var range := SetOfNumbersInRightExclusiveRange(a, b);\r\n forall i | i in s\r\n ensures i in range;\r\n {\r\n }\r\n assert s <= range;\r\n SubsetCardinality(s, range);\r\n}\r\n\r\nfunction intsetmax(s:set):int\r\n requires |s| > 0\r\n ensures var m := intsetmax(s);\r\n m in s && forall i :: i in s ==> m >= i\r\n{\r\n var x :| x in s;\r\n if |s| == 1 then\r\n assert |s - {x}| == 0;\r\n x\r\n else\r\n var sy := s - {x};\r\n var y := intsetmax(sy);\r\n assert forall i :: i in s ==> i in sy || i == x;\r\n if x > y then x else y\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Framework/AbstractService.s.dfy", "content": "//- The high-level spec is written in the form of a state-machine\r\n//- The states and transition functions are instantiated on a per-service basis\r\n\r\ninclude \"../Native/Io.s.dfy\"\r\ninclude \"Environment.s.dfy\"\r\n\r\nabstract module AbstractService_s {\r\nimport opened Native__Io_s\r\nimport opened Environment_s \r\nimport opened Native__NativeTypes_s\r\n\r\ntype ServiceState \r\n\r\npredicate Service_Init(s:ServiceState, serverAddresses:set) \r\npredicate Service_Next(s:ServiceState, s':ServiceState) \r\n\r\npredicate Service_Correspondence(concretePkts:set>>, serviceState:ServiceState)\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Framework/DistributedSystem.s.dfy", "content": "include \"Host.s.dfy\"\r\ninclude \"../Collections/Maps2.s.dfy\"\r\n\r\nabstract module DistributedSystem_s {\r\n\r\nimport H_s : Host_s\r\nimport opened Collections__Maps2_s\r\nimport opened Native__Io_s\r\nimport opened Environment_s\r\nimport opened Native__NativeTypes_s\r\n\r\n/////////////////////////////////////////\r\n// PHYSICAL ENVIRONMENT\r\n/////////////////////////////////////////\r\n\r\npredicate ValidPhysicalEnvironmentStep(step:LEnvStep>)\r\n{\r\n step.LEnvStepHostIos? ==> forall io{:trigger io in step.ios}{:trigger ValidPhysicalIo(io)} :: io in step.ios ==> ValidPhysicalIo(io)\r\n}\r\n\r\n/////////////////////////////////////////\r\n// DS_State\r\n/////////////////////////////////////////\r\n\r\ndatatype DS_State = DS_State(\r\n config:H_s.ConcreteConfiguration,\r\n environment:LEnvironment>,\r\n servers:map\r\n )\r\n\r\npredicate DS_Init(s:DS_State, config:H_s.ConcreteConfiguration)\r\n reads *\r\n{\r\n && s.config == config\r\n && H_s.ConcreteConfigToServers(s.config) == mapdomain(s.servers)\r\n && H_s.ConcreteConfigInit(s.config)\r\n && LEnvironment_Init(s.environment)\r\n && (forall id :: id in s.servers ==> H_s.HostInit(s.servers[id], config, id))\r\n}\r\n \r\npredicate DS_NextOneServer(s:DS_State, s':DS_State, id:EndPoint, ios:seq>>)\r\n requires id in s.servers\r\n reads *\r\n{\r\n && id in s'.servers\r\n && H_s.HostNext(s.servers[id], s'.servers[id], ios)\r\n && s'.servers == s.servers[id := s'.servers[id]]\r\n}\r\n\r\npredicate DS_Next(s:DS_State, s':DS_State)\r\n reads *\r\n{\r\n && s'.config == s.config\r\n && LEnvironment_Next(s.environment, s'.environment)\r\n && ValidPhysicalEnvironmentStep(s.environment.nextStep)\r\n && if s.environment.nextStep.LEnvStepHostIos? && s.environment.nextStep.actor in s.servers then\r\n DS_NextOneServer(s, s', s.environment.nextStep.actor, s.environment.nextStep.ios)\r\n else\r\n s'.servers == s.servers\r\n}\r\n\r\n// /////////////////////////////////////////////////////////////////////\r\n// // Relationship with the abstract service's state machine\r\n// function DS_AbstractState(s:DS_State) : SpecState\r\n// function DS_AbstractConfig(s:ConcreteConfiguration) : SpecConfiguration\r\n//\r\n// predicate IsAbstractStateAbstractionSequenceOf(s:seq, start:SpecState, end:SpecState)\r\n// {\r\n// && |s| > 0\r\n// && s[0] == start\r\n// && s[|s|-1] == end\r\n// && (forall i :: 0 <= i < |s|-1 ==> Spec_Next(s[i], s[i+1]))\r\n// }\r\n\r\n}\r\n\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Framework/Environment.s.dfy", "content": "include \"../Collections/Maps2.s.dfy\"\r\ninclude \"../Logic/Temporal/Temporal.s.dfy\"\r\n\r\nmodule Environment_s {\r\nimport opened Collections__Maps2_s\r\nimport opened Temporal__Temporal_s\r\n\r\ndatatype LPacket = LPacket(dst:IdType, src:IdType, msg:MessageType)\r\n\r\ndatatype LIoOp = LIoOpSend(s:LPacket)\r\n | LIoOpReceive(r:LPacket)\r\n | LIoOpTimeoutReceive()\r\n | LIoOpReadClock(t:int)\r\n\r\ndatatype LEnvStep = LEnvStepHostIos(actor:IdType, ios:seq>)\r\n | LEnvStepDeliverPacket(p:LPacket)\r\n | LEnvStepAdvanceTime()\r\n | LEnvStepStutter()\r\n\r\ndatatype LHostInfo = LHostInfo(queue:seq>)\r\n\r\ndatatype LEnvironment = LEnvironment(time:int,\r\n sentPackets:set>,\r\n hostInfo:map>,\r\n nextStep:LEnvStep)\r\n \r\npredicate IsValidLIoOp(io:LIoOp, actor:IdType, e:LEnvironment)\r\n{\r\n match io\r\n case LIoOpSend(s) => s.src == actor\r\n case LIoOpReceive(r) => r.dst == actor\r\n case LIoOpTimeoutReceive => true\r\n case LIoOpReadClock(t) => true\r\n}\r\n\r\npredicate LIoOpOrderingOKForAction(\r\n io1:LIoOp,\r\n io2:LIoOp\r\n )\r\n{\r\n io1.LIoOpReceive? || io2.LIoOpSend?\r\n}\r\n\r\npredicate LIoOpSeqCompatibleWithReduction(\r\n ios:seq>\r\n )\r\n{\r\n forall i {:trigger ios[i], ios[i+1]} :: 0 <= i < |ios| - 1 ==> LIoOpOrderingOKForAction(ios[i], ios[i+1])\r\n}\r\n\r\npredicate IsValidLEnvStep(e:LEnvironment, step:LEnvStep)\r\n{\r\n match step\r\n case LEnvStepHostIos(actor, ios) => && (forall io :: io in ios ==> IsValidLIoOp(io, actor, e))\r\n && LIoOpSeqCompatibleWithReduction(ios)\r\n case LEnvStepDeliverPacket(p) => p in e.sentPackets\r\n case LEnvStepAdvanceTime => true\r\n case LEnvStepStutter => true\r\n}\r\n\r\npredicate LEnvironment_Init(\r\n e:LEnvironment\r\n )\r\n{\r\n && |e.sentPackets| == 0\r\n && e.time >= 0\r\n}\r\n\r\npredicate LEnvironment_PerformIos(\r\n e:LEnvironment,\r\n e':LEnvironment,\r\n actor:IdType,\r\n ios:seq>\r\n )\r\n{\r\n && e'.sentPackets == e.sentPackets + (set io | io in ios && io.LIoOpSend? :: io.s)\r\n && (forall io :: io in ios && io.LIoOpReceive? ==> io.r in e.sentPackets)\r\n && e'.time == e.time\r\n}\r\n\r\npredicate LEnvironment_AdvanceTime(\r\n e:LEnvironment,\r\n e':LEnvironment\r\n )\r\n{\r\n && e'.time > e.time\r\n // UNCHANGED\r\n && e'.sentPackets == e.sentPackets\r\n}\r\n\r\npredicate LEnvironment_Stutter(\r\n e:LEnvironment,\r\n e':LEnvironment\r\n )\r\n{\r\n && e'.time == e.time\r\n && e'.sentPackets == e.sentPackets\r\n}\r\n\r\npredicate LEnvironment_Next(\r\n e:LEnvironment,\r\n e':LEnvironment\r\n )\r\n{\r\n && IsValidLEnvStep(e, e.nextStep)\r\n && match e.nextStep\r\n case LEnvStepHostIos(actor, ios) => LEnvironment_PerformIos(e, e', actor, ios)\r\n case LEnvStepDeliverPacket(p) => LEnvironment_Stutter(e, e') // this is only relevant for synchrony\r\n case LEnvStepAdvanceTime => LEnvironment_AdvanceTime(e, e')\r\n case LEnvStepStutter => LEnvironment_Stutter(e, e')\r\n}\r\n\r\nfunction{:opaque} EnvironmentNextTemporal(b:Behavior>):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, EnvironmentNextTemporal(b))} ::\r\n sat(i, EnvironmentNextTemporal(b)) <==> LEnvironment_Next(b[i], b[nextstep(i)])\r\n{\r\n stepmap(imap i :: LEnvironment_Next(b[i], b[nextstep(i)]))\r\n}\r\n\r\npredicate LEnvironment_BehaviorSatisfiesSpec(\r\n b:Behavior>\r\n )\r\n{\r\n && imaptotal(b)\r\n && LEnvironment_Init(b[0])\r\n && sat(0, always(EnvironmentNextTemporal(b)))\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Framework/EnvironmentSynchrony.s.dfy", "content": "include \"Environment.s.dfy\"\r\ninclude \"../Logic/Temporal/Temporal.s.dfy\"\r\ninclude \"../Logic/Temporal/Time.s.dfy\"\r\ninclude \"../Collections/Multisets.s.dfy\"\r\n\r\nmodule EnvironmentSynchrony_s {\r\nimport opened Environment_s\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Multisets_s\r\n\r\nfunction{:opaque} BehaviorToTimeMap(\r\n b:Behavior>\r\n ):imap\r\n requires imaptotal(b)\r\n ensures imaptotal(BehaviorToTimeMap(b))\r\n ensures forall i {:trigger BehaviorToTimeMap(b)[i]} :: BehaviorToTimeMap(b)[i] == b[i].time\r\n{\r\n imap i :: b[i].time\r\n}\r\n\r\n///////////////////////////\r\n// HOST QUEUES\r\n///////////////////////////\r\n\r\npredicate HostQueue_PerformIos(\r\n hostQueue:seq>,\r\n hostQueue':seq>,\r\n ios:seq>\r\n )\r\n{\r\n if |ios| == 0 then\r\n hostQueue' == hostQueue\r\n else if ios[0].LIoOpReceive? then\r\n && |hostQueue| > 0\r\n && ios[0] == LIoOpReceive(hostQueue[0])\r\n && HostQueue_PerformIos(hostQueue[1..], hostQueue', ios[1..])\r\n else if ios[0].LIoOpTimeoutReceive? then\r\n hostQueue' == hostQueue == []\r\n else\r\n hostQueue' == hostQueue\r\n}\r\n\r\npredicate HostQueues_Init(\r\n e:LEnvironment\r\n )\r\n{\r\n && (forall id :: id in e.hostInfo ==> e.hostInfo[id] == LHostInfo([]))\r\n && e.time >= 0\r\n}\r\n\r\npredicate HostQueues_Next(\r\n e:LEnvironment,\r\n e':LEnvironment\r\n )\r\n{\r\n match e.nextStep\r\n case LEnvStepHostIos(actor, ios) =>\r\n && actor in e.hostInfo\r\n && actor in e'.hostInfo\r\n && e'.hostInfo == e.hostInfo[actor := e'.hostInfo[actor]]\r\n && LIoOpSeqCompatibleWithReduction(ios)\r\n && HostQueue_PerformIos(e.hostInfo[actor].queue, e'.hostInfo[actor].queue, ios)\r\n\r\n case LEnvStepDeliverPacket(p) =>\r\n && p in e.sentPackets\r\n && p.dst in e.hostInfo\r\n && e'.hostInfo == e.hostInfo[p.dst := LHostInfo(e.hostInfo[p.dst].queue + [p])]\r\n\r\n case LEnvStepAdvanceTime => e'.hostInfo == e.hostInfo\r\n case LEnvStepStutter => e'.hostInfo == e.hostInfo\r\n}\r\n\r\nfunction{:opaque} HostQueuesNextTemporal(\r\n b:Behavior>\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, HostQueuesNextTemporal(b))} :: sat(i, HostQueuesNextTemporal(b)) == HostQueues_Next(b[i], b[nextstep(i)])\r\n{\r\n stepmap(imap i :: HostQueues_Next(b[i], b[nextstep(i)]))\r\n}\r\n\r\npredicate HostQueuesLive(\r\n b:Behavior>\r\n )\r\n requires imaptotal(b)\r\n{\r\n && HostQueues_Init(b[0])\r\n && sat(0, always(HostQueuesNextTemporal(b)))\r\n}\r\n\r\n///////////////////////////\r\n// SYNCHRONOUS NETWORK\r\n///////////////////////////\r\n\r\nfunction{:opaque} PacketDeliveredTemporal(\r\n b:Behavior>,\r\n p:LPacket\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, PacketDeliveredTemporal(b, p))} ::\r\n sat(i, PacketDeliveredTemporal(b, p)) <==> b[i].nextStep == LEnvStepDeliverPacket(p);\r\n{\r\n stepmap(imap i :: b[i].nextStep == LEnvStepDeliverPacket(p))\r\n}\r\n\r\npredicate PacketSentBetweenHosts(\r\n e:LEnvironment,\r\n p:LPacket,\r\n sources:set,\r\n destinations:set\r\n )\r\n{\r\n && e.nextStep.LEnvStepHostIos?\r\n && LIoOpSend(p) in e.nextStep.ios\r\n && (p.src in sources || e.nextStep.actor in sources)\r\n && p.dst in destinations\r\n}\r\n\r\npredicate PacketsSynchronousForHosts(\r\n b:Behavior>,\r\n i:int,\r\n latency_bound:int,\r\n sources:set,\r\n destinations:set\r\n )\r\n requires imaptotal(b)\r\n{\r\n forall p {:trigger PacketSentBetweenHosts(b[i], p, sources, destinations)} ::\r\n p in b[i+1].sentPackets && PacketSentBetweenHosts(b[i], p, sources, destinations) ==>\r\n sat(i, next(eventuallynextwithin(PacketDeliveredTemporal(b, p), latency_bound, BehaviorToTimeMap(b))))\r\n}\r\n\r\nfunction{:opaque} PacketsSynchronousForHostsTemporal(\r\n b:Behavior>,\r\n latency_bound:int,\r\n sources:set,\r\n destinations:set\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, PacketsSynchronousForHostsTemporal(b, latency_bound, sources, destinations))} ::\r\n sat(i, PacketsSynchronousForHostsTemporal(b, latency_bound, sources, destinations)) <==>\r\n PacketsSynchronousForHosts(b, i, latency_bound, sources, destinations)\r\n{\r\n stepmap(imap i :: PacketsSynchronousForHosts(b, i, latency_bound, sources, destinations))\r\n}\r\n\r\npredicate NetworkSynchronousForHosts(\r\n b:Behavior>,\r\n start_step:int,\r\n latency_bound:int,\r\n sources:set,\r\n destinations:set\r\n )\r\n requires imaptotal(b)\r\n{\r\n sat(start_step, always(PacketsSynchronousForHostsTemporal(b, latency_bound, sources, destinations)))\r\n}\r\n\r\n///////////////////////////\r\n// TIME NEVER STOPS\r\n///////////////////////////\r\n\r\nfunction{:opaque} TimeReachesTemporal(\r\n b:Behavior>,\r\n t:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, TimeReachesTemporal(b, t))} :: sat(i, TimeReachesTemporal(b, t)) <==> b[i].time >= t\r\n{\r\n stepmap(imap i :: b[i].time >= t)\r\n}\r\n\r\npredicate NoZenoBehavior(\r\n b:Behavior>\r\n )\r\n requires imaptotal(b)\r\n{\r\n forall t :: sat(0, eventual(TimeReachesTemporal(b, t)))\r\n}\r\n\r\n//////////////////////////////\r\n// CLOCK AMBIGUITY LIMITED\r\n//////////////////////////////\r\n\r\npredicate ClockAmbiguityLimitedForHostsInStep(\r\n e:LEnvironment,\r\n max_clock_ambiguity:int,\r\n hosts:set\r\n )\r\n{\r\n e.nextStep.LEnvStepHostIos? && e.nextStep.actor in hosts ==>\r\n (forall io :: io in e.nextStep.ios && io.LIoOpReadClock? ==> e.time - max_clock_ambiguity <= io.t <= e.time + max_clock_ambiguity)\r\n}\r\n\r\nfunction{:opaque} ClockAmbiguityLimitedForHostsTemporal(\r\n b:Behavior>,\r\n max_clock_ambiguity:int,\r\n hosts:set\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, ClockAmbiguityLimitedForHostsTemporal(b, max_clock_ambiguity, hosts))} ::\r\n sat(i, ClockAmbiguityLimitedForHostsTemporal(b, max_clock_ambiguity, hosts)) ==\r\n ClockAmbiguityLimitedForHostsInStep(b[i], max_clock_ambiguity, hosts)\r\n{\r\n stepmap(imap i :: ClockAmbiguityLimitedForHostsInStep(b[i], max_clock_ambiguity, hosts))\r\n}\r\n\r\npredicate ClockAmbiguityLimitedForHosts(\r\n b:Behavior>,\r\n start_step:int,\r\n max_clock_ambiguity:int,\r\n hosts:set\r\n )\r\n requires imaptotal(b)\r\n{\r\n sat(start_step, always(ClockAmbiguityLimitedForHostsTemporal(b, max_clock_ambiguity, hosts)))\r\n}\r\n\r\n//////////////////////////////\r\n// RATE-LIMITED HOSTS\r\n//////////////////////////////\r\n\r\nfunction{:opaque} PacketDeliveredToHostTemporal(b:Behavior>, host:IdType):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, PacketDeliveredToHostTemporal(b, host))} :: sat(i, PacketDeliveredToHostTemporal(b, host)) <==>\r\n b[i].nextStep.LEnvStepDeliverPacket? && b[i].nextStep.p.dst == host\r\n{\r\n stepmap(imap i :: b[i].nextStep.LEnvStepDeliverPacket? && b[i].nextStep.p.dst == host)\r\n}\r\n\r\nfunction{:opaque} NetworkDeliveryRateForHostBoundedSinceTemporal(\r\n b:Behavior>,\r\n i:int,\r\n burst_size:int,\r\n host:IdType\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall j{:trigger sat(j, NetworkDeliveryRateForHostBoundedSinceTemporal(b, i, burst_size, host))} ::\r\n sat(j, NetworkDeliveryRateForHostBoundedSinceTemporal(b, i, burst_size, host)) <==>\r\n countWithin(i, j, PacketDeliveredToHostTemporal(b, host)) <= burst_size\r\n{\r\n stepmap(imap j :: countWithin(i, j, PacketDeliveredToHostTemporal(b, host)) <= burst_size)\r\n}\r\n\r\nfunction{:opaque} NetworkDeliveryRateForHostBoundedTemporal(\r\n b:Behavior>,\r\n burst_size:int,\r\n burst_period:int,\r\n host:IdType\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, NetworkDeliveryRateForHostBoundedTemporal(b, burst_size, burst_period, host))} ::\r\n sat(i, NetworkDeliveryRateForHostBoundedTemporal(b, burst_size, burst_period, host)) <==>\r\n sat(i, alwayswithin(NetworkDeliveryRateForHostBoundedSinceTemporal(b, i, burst_size, host), burst_period, BehaviorToTimeMap(b)))\r\n{\r\n stepmap(imap i :: sat(i, alwayswithin(NetworkDeliveryRateForHostBoundedSinceTemporal(b, i, burst_size, host), burst_period, BehaviorToTimeMap(b))))\r\n}\r\n\r\npredicate NetworkDeliveryRateBoundedForHosts(\r\n b:Behavior>,\r\n start_step:int,\r\n burst_size:int,\r\n burst_period:int,\r\n hosts:set\r\n )\r\n requires imaptotal(b)\r\n{\r\n forall host :: host in hosts ==> sat(start_step, always(NetworkDeliveryRateForHostBoundedTemporal(b, burst_size, burst_period, host)))\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Framework/EnvironmentSynchronyLemmas.i.dfy", "content": "include \"EnvironmentSynchrony.s.dfy\"\r\ninclude \"HostQueueLemmas.i.dfy\"\r\ninclude \"../Logic/Temporal/Heuristics.i.dfy\"\r\ninclude \"../Logic/Temporal/Rules.i.dfy\"\r\ninclude \"../Logic/Temporal/Induction.i.dfy\"\r\ninclude \"../Logic/Temporal/Time.i.dfy\"\r\ninclude \"../../../Libraries/Math/mul_auto.i.dfy\"\r\ninclude \"../Collections/Sets.i.dfy\"\r\n\r\nmodule Liveness__EnvironmentSynchronyLemmas_i {\r\nimport opened Environment_s\r\nimport opened EnvironmentSynchrony_s\r\nimport opened Liveness__HostQueueLemmas_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Monotonicity_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Induction_i\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Collections__Sets_i\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Maps2_i\r\nimport opened Math__mul_auto_i\r\nimport opened Math__mul_i\r\n\r\nfunction{:opaque} HostQueueEmptyTemporal(\r\n b:Behavior>,\r\n host:IdType\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, HostQueueEmptyTemporal(b, host))} ::\r\n sat(i, HostQueueEmptyTemporal(b, host)) <==> (host in b[i].hostInfo ==> |b[i].hostInfo[host].queue| == 0)\r\n{\r\n stepmap(imap i :: host in b[i].hostInfo ==> |b[i].hostInfo[host].queue| == 0)\r\n}\r\n\r\nfunction{:opaque} PacketInHostQueueTemporal(\r\n b:Behavior>,\r\n p:LPacket\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, PacketInHostQueueTemporal(b, p))} :: sat(i, PacketInHostQueueTemporal(b, p)) <==>\r\n (p.dst in b[i].hostInfo && p in b[i].hostInfo[p.dst].queue)\r\n{\r\n stepmap(imap i :: p.dst in b[i].hostInfo && p in b[i].hostInfo[p.dst].queue)\r\n}\r\n\r\npredicate PacketReceivedDuringAction(\r\n e:LEnvironment,\r\n p:LPacket\r\n )\r\n{\r\n e.nextStep.LEnvStepHostIos? && LIoOpReceive(p) in e.nextStep.ios\r\n}\r\n\r\nfunction{:opaque} PacketReceivedTemporal(\r\n b:Behavior>,\r\n p:LPacket\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, PacketReceivedTemporal(b, p))} ::\r\n sat(i, PacketReceivedTemporal(b, p)) <==> PacketReceivedDuringAction(b[i], p)\r\n{\r\n stepmap(imap i :: PacketReceivedDuringAction(b[i], p))\r\n}\r\n\r\npredicate AllPacketsReceivedWithin(\r\n b:Behavior>,\r\n i:int,\r\n receive_period:int,\r\n sources:set,\r\n destinations:set\r\n )\r\n requires imaptotal(b)\r\n{\r\n forall p {:trigger PacketSentBetweenHosts(b[i], p, sources, destinations)} ::\r\n PacketSentBetweenHosts(b[i], p, sources, destinations) ==>\r\n sat(i, next(eventuallynextwithin(PacketReceivedTemporal(b, p), receive_period, BehaviorToTimeMap(b))))\r\n}\r\n\r\nfunction{:opaque} AllPacketsReceivedWithinTemporal(\r\n b:Behavior>,\r\n receive_period:int,\r\n sources:set,\r\n destinations:set\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, AllPacketsReceivedWithinTemporal(b, receive_period, sources, destinations))} ::\r\n sat(i, AllPacketsReceivedWithinTemporal(b, receive_period, sources, destinations)) <==>\r\n AllPacketsReceivedWithin(b, i, receive_period, sources, destinations)\r\n{\r\n stepmap(imap i :: AllPacketsReceivedWithin(b, i, receive_period, sources, destinations))\r\n}\r\n\r\npredicate ReceiveAttemptedInStep(\r\n e:LEnvironment,\r\n host:IdType\r\n )\r\n{\r\n && e.nextStep.LEnvStepHostIos?\r\n && e.nextStep.actor == host\r\n && |e.nextStep.ios| > 0\r\n && (e.nextStep.ios[0].LIoOpTimeoutReceive? || e.nextStep.ios[0].LIoOpReceive?)\r\n}\r\n\r\nfunction{:opaque} ReceiveAttemptedTemporal(\r\n b:Behavior>,\r\n host:IdType\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, ReceiveAttemptedTemporal(b, host))} ::\r\n sat(i, ReceiveAttemptedTemporal(b, host)) <==> ReceiveAttemptedInStep(b[i], host)\r\n{\r\n stepmap(imap i :: ReceiveAttemptedInStep(b[i], host))\r\n}\r\n\r\nlemma Lemma_TimeOnlyAdvancesBetweenSteps(\r\n b:Behavior>,\r\n i:int,\r\n j:int\r\n )\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires 0 <= i <= j\r\n ensures b[i].time <= b[j].time\r\n decreases j - i\r\n{\r\n if j > i\r\n {\r\n Lemma_TimeOnlyAdvancesBetweenSteps(b, i, j-1);\r\n TemporalDeduceFromAlways(0, j-1, EnvironmentNextTemporal(b));\r\n }\r\n}\r\n\r\nlemma Lemma_EstablishMonotonicFromOpaque(\r\n b:Behavior>,\r\n start:int\r\n )\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires 0 <= start\r\n ensures monotonic_from_opaque(start, BehaviorToTimeMap(b))\r\n{\r\n var f := BehaviorToTimeMap(b);\r\n forall i1, i2 | i1 in f && i2 in f && start <= i1 <= i2\r\n ensures f[i1] <= f[i2]\r\n {\r\n Lemma_TimeOnlyAdvancesBetweenSteps(b, i1, i2);\r\n }\r\n reveal monotonic_from_opaque();\r\n}\r\n\r\nlemma Lemma_IfOpSeqIsCompatibleWithReductionAndFirstIsntReceiveThenNoneAreReceives2(\r\n ios:seq>\r\n )\r\n requires LIoOpSeqCompatibleWithReduction(ios)\r\n ensures |ios| > 0 && !ios[0].LIoOpReceive? && !ios[0].LIoOpTimeoutReceive? ==> (forall io :: io in ios ==> !io.LIoOpReceive? && !io.LIoOpTimeoutReceive?)\r\n{\r\n if |ios| > 1 && !ios[0].LIoOpReceive? && !ios[0].LIoOpTimeoutReceive?\r\n {\r\n var i := 0;\r\n assert 0 <= i < |ios| - 1;\r\n assert LIoOpOrderingOKForAction(ios[i], ios[i+1]);\r\n assert ios[1].LIoOpSend?;\r\n Lemma_IfOpSeqIsCompatibleWithReductionThenSoIsSuffix(ios, 1);\r\n Lemma_IfOpSeqIsCompatibleWithReductionAndFirstIsntReceiveThenNoneAreReceives2(ios[1..]);\r\n }\r\n}\r\n\r\nlemma Lemma_ReceiveMakesHostQueueSmaller2(\r\n q:seq>,\r\n q':seq>,\r\n ios:seq>,\r\n io:LIoOp\r\n )\r\n requires HostQueue_PerformIos(q, q', ios)\r\n requires LIoOpSeqCompatibleWithReduction(ios)\r\n requires io.LIoOpTimeoutReceive? || io.LIoOpReceive?\r\n ensures |q'| <= |q|\r\n ensures io in ios ==> |q| == 0 || |q'| < |q|\r\n decreases |ios|\r\n{\r\n if (|ios| == 0)\r\n {\r\n assert q == q';\r\n assert io !in ios;\r\n return;\r\n }\r\n var io0 := ios[0];\r\n assert ios == [io0] + ios[1..];\r\n if (io0.LIoOpTimeoutReceive?)\r\n {\r\n assert |q| == 0;\r\n }\r\n else if (io0.LIoOpReceive?)\r\n {\r\n Lemma_IfOpSeqIsCompatibleWithReductionThenSoIsSuffix(ios, 1);\r\n Lemma_ReceiveMakesHostQueueSmaller2(q[1..], q', ios[1..], io);\r\n }\r\n else\r\n {\r\n Lemma_IfOpSeqIsCompatibleWithReductionAndFirstIsntReceiveThenNoneAreReceives2(ios);\r\n }\r\n}\r\n\r\nfunction{:opaque} QueuePosition(q:seq>, p:LPacket):int\r\n requires p in q\r\n ensures 0 <= QueuePosition(q, p) < |q|\r\n{\r\n if q[0] == p then 0\r\n else 1 + QueuePosition(q[1..], p)\r\n}\r\n\r\nlemma Lemma_QueuePosition(q:seq>, p:LPacket)\r\n requires p in q\r\n ensures QueuePosition(q, p) > 0 ==> |q| > 0 && p in q[1..] && QueuePosition(q[1..], p) < QueuePosition(q, p)\r\n{\r\n reveal QueuePosition();\r\n}\r\n\r\nlemma Lemma_QueuePositionTail(\r\n q:seq>,\r\n p:LPacket,\r\n q':seq>\r\n )\r\n requires p in q\r\n ensures QueuePosition(q, p) == QueuePosition(q + q', p)\r\n{\r\n reveal QueuePosition();\r\n if (q[0] == p)\r\n {\r\n assert QueuePosition(q, p) == QueuePosition(q + q', p);\r\n }\r\n else\r\n {\r\n Lemma_QueuePositionTail(q[1..], p, q');\r\n assert q[1..] + q' == (q + q')[1..];\r\n }\r\n}\r\n\r\nlemma Lemma_DeliverIsInstantaneous(\r\n b:Behavior>,\r\n i:int,\r\n host:IdType\r\n )\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires 0 <= i\r\n ensures sat(i, always(ActionIsInstantaneousTemporal(PacketDeliveredToHostTemporal(b, host), BehaviorToTimeMap(b))))\r\n{\r\n var x := PacketDeliveredToHostTemporal(b, host);\r\n var f := BehaviorToTimeMap(b);\r\n \r\n forall j | i <= j\r\n ensures sat(j, ActionIsInstantaneousTemporal(x, f))\r\n {\r\n if sat(j, x)\r\n {\r\n TemporalDeduceFromAlways(0, j, EnvironmentNextTemporal(b));\r\n assert f[j] == f[j+1];\r\n }\r\n }\r\n TemporalAlways(i, ActionIsInstantaneousTemporal(x, f));\r\n}\r\n\r\nlemma Lemma_ReceiveIsInstantaneous(\r\n b:Behavior>,\r\n i:int,\r\n host:IdType\r\n )\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires 0 <= i\r\n ensures sat(i, always(ActionIsInstantaneousTemporal(ReceiveAttemptedTemporal(b, host), BehaviorToTimeMap(b))))\r\n{\r\n var x := ReceiveAttemptedTemporal(b, host);\r\n var f := BehaviorToTimeMap(b);\r\n \r\n forall j | i <= j\r\n ensures sat(j, ActionIsInstantaneousTemporal(x, f));\r\n {\r\n if sat(j, x)\r\n {\r\n TemporalDeduceFromAlways(0, j, EnvironmentNextTemporal(b));\r\n assert f[j] == f[j+1];\r\n }\r\n }\r\n TemporalAlways(i, ActionIsInstantaneousTemporal(x, f));\r\n}\r\n\r\n\r\nlemma Lemma_DeliverIncrReceiveDecr(\r\n i1:int,\r\n i2:int,\r\n b:Behavior>,\r\n host:IdType,\r\n d:imap\r\n )\r\n requires imaptotal(b)\r\n requires imaptotal(d)\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires HostQueuesLive(b)\r\n requires TLe(0, i1)\r\n requires TLe(i1, i2)\r\n requires d[i1] >= 0\r\n requires d[i2] >= 1\r\n requires d == imap i :: if host in b[i].hostInfo then |b[i].hostInfo[host].queue| else 0\r\n ensures || (sat(i2, PacketDeliveredToHostTemporal(b, host)) && !sat(i2, ReceiveAttemptedTemporal(b, host)) && d[i2 + 1] == d[i2] + 1)\r\n || (!sat(i2, PacketDeliveredToHostTemporal(b, host)) && sat(i2, ReceiveAttemptedTemporal(b, host)) && d[i2 + 1] < d[i2])\r\n || (!sat(i2, PacketDeliveredToHostTemporal(b, host)) && !sat(i2, ReceiveAttemptedTemporal(b, host)) && d[i2 + 1] == d[i2])\r\n{\r\n TemporalAssist();\r\n assert TLe(i1, i1);\r\n var incr := PacketDeliveredToHostTemporal(b, host);\r\n var decr := ReceiveAttemptedTemporal(b, host);\r\n\r\n assert TLe(0, i2);\r\n assert i2 == i1 || TLe(i1, i2 - 1);\r\n assert sat(i2, EnvironmentNextTemporal(b));\r\n var e := b[i2];\r\n var e' := b[i2 + 1];\r\n assert LEnvironment_Next(e, e');\r\n assert HostQueues_Next(e, e');\r\n\r\n assert 0 < d[i2];\r\n assert host in e.hostInfo;\r\n\r\n var q := e.hostInfo[host].queue;\r\n\r\n if e.nextStep.LEnvStepHostIos?\r\n {\r\n if e.nextStep.actor != host\r\n {\r\n assert d[i2 + 1] == d[i2];\r\n }\r\n else if ReceiveAttemptedInStep(e, host)\r\n {\r\n var actor := e.nextStep.actor;\r\n var ios := e.nextStep.ios;\r\n var io := e.nextStep.ios[0];\r\n var q' := e'.hostInfo[host].queue;\r\n Lemma_ReceiveMakesHostQueueSmaller2(q, q', ios, io);\r\n assert d[i2 + 1] < d[i2];\r\n }\r\n else\r\n {\r\n assert d[i2+1] == d[i2];\r\n }\r\n }\r\n else if e.nextStep.LEnvStepDeliverPacket?\r\n {\r\n var p := e.nextStep.p;\r\n if (p.dst == host)\r\n {\r\n assert d[i2 + 1] == d[i2] + 1;\r\n }\r\n }\r\n}\r\n\r\n// TODO: merge with Lemma_DeliverIncrReceiveDecr\r\nlemma Lemma_DeliverIncr(\r\n i1:int,\r\n i2:int,\r\n b:Behavior>,\r\n host:IdType,\r\n d:imap\r\n )\r\n requires imaptotal(b)\r\n requires imaptotal(d)\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires HostQueuesLive(b)\r\n requires TLe(0, i1)\r\n requires TLe(i1, i2)\r\n requires d[i1] >= 0\r\n requires d == imap i :: if host in b[i].hostInfo then |b[i].hostInfo[host].queue| else 0\r\n ensures || (sat(i2, PacketDeliveredToHostTemporal(b, host)) && d[i2 + 1] == d[i2] + 1)\r\n || (!sat(i2, PacketDeliveredToHostTemporal(b, host)) && d[i2 + 1] <= d[i2])\r\n{\r\n TemporalAssist();\r\n assert TLe(i1, i1);\r\n var incr := PacketDeliveredToHostTemporal(b, host);\r\n var decr := ReceiveAttemptedTemporal(b, host);\r\n\r\n assert TLe(0, i2);\r\n assert i2 == i1 || TLe(i1, i2 - 1);\r\n assert sat(i2, EnvironmentNextTemporal(b));\r\n var e := b[i2];\r\n var e' := b[i2 + 1];\r\n assert LEnvironment_Next(e, e');\r\n assert HostQueues_Next(e, e');\r\n\r\n if (sat(i2, decr))\r\n {\r\n if (host in e.hostInfo)\r\n {\r\n var ios := e.nextStep.ios;\r\n var io := e.nextStep.ios[0];\r\n var q := e.hostInfo[host].queue;\r\n var q' := e'.hostInfo[host].queue;\r\n Lemma_ReceiveMakesHostQueueSmaller2(q, q', ios, io);\r\n assert d[i2 + 1] <= d[i2];\r\n }\r\n }\r\n else if e.nextStep.LEnvStepDeliverPacket?\r\n {\r\n var p := e.nextStep.p;\r\n if (p.dst == host)\r\n {\r\n assert d[i2 + 1] == d[i2] + 1;\r\n }\r\n }\r\n else if e.nextStep.LEnvStepAdvanceTime?\r\n {\r\n assert d[i2 + 1] == d[i2];\r\n }\r\n else if e.nextStep.LEnvStepHostIos?\r\n {\r\n assert !sat(i2, PacketDeliveredToHostTemporal(b, host));\r\n var actor := e.nextStep.actor;\r\n var ios := e.nextStep.ios;\r\n if (host == actor)\r\n {\r\n if (!sat(i2+1, decr) && |ios| != 0)\r\n {\r\n if (ios[0].LIoOpReceive?)\r\n {\r\n assert ReceiveAttemptedInStep(e, host);\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma Lemma_HostQueueEmptiesAgain(\r\n latency_bound:int,\r\n host:IdType,\r\n b:Behavior>,\r\n i1:int,\r\n burst_size:int,\r\n receive_period:int\r\n ) returns(i2:int)\r\n requires imaptotal(b)\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires HostQueuesLive(b)\r\n requires TLe(0, i1)\r\n requires 1 <= receive_period\r\n requires 1 <= burst_size\r\n requires sat(i1, HostQueueEmptyTemporal(b, host))\r\n requires sat(i1, always(eventuallynextwithin(ReceiveAttemptedTemporal(b, host), receive_period, BehaviorToTimeMap(b))))\r\n requires sat(i1, always(NetworkDeliveryRateForHostBoundedTemporal(b, burst_size, burst_size * receive_period + 1, host)))\r\n ensures sat(i2, HostQueueEmptyTemporal(b, host))\r\n ensures i1 < i2\r\n ensures forall i :: i1 <= i <= i2 && host in b[i].hostInfo ==> |b[i].hostInfo[host].queue| <= burst_size\r\n{\r\n var timefun := BehaviorToTimeMap(b);\r\n var goal := HostQueueEmptyTemporal(b, host);\r\n var d := imap i :: if host in b[i].hostInfo then |b[i].hostInfo[host].queue| else 0;\r\n var bs := burst_size;\r\n var r := receive_period;\r\n var p := bs * r;\r\n var incr := PacketDeliveredToHostTemporal(b, host);\r\n var decr := ReceiveAttemptedTemporal(b, host);\r\n var nIncr:int := bs;\r\n var nDecr:int := bs;\r\n TemporalAssist();\r\n\r\n Lemma_EstablishMonotonicFromOpaque(b, i1);\r\n Lemma_DeliverIsInstantaneous(b, i1, host);\r\n Lemma_ReceiveIsInstantaneous(b, i1, host);\r\n\r\n forall ensures 1 <= p { lemma_mul_increases(bs, r); }\r\n\r\n assert TLe(i1, i1);\r\n forall ensures sat(i1, countWithinGe(nDecr, decr, p, timefun))\r\n {\r\n Lemma_CountWithinGeOne(i1, decr, r, timefun);\r\n Lemma_CountWithinGeMultiple(i1, bs, 1, decr, r, timefun);\r\n }\r\n\r\n forall ensures sat(i1, countWithinLe(nIncr, incr, p, timefun))\r\n {\r\n lemma_mul_is_commutative(bs, r);\r\n assert sat(i1, always(NetworkDeliveryRateForHostBoundedTemporal(b, burst_size, burst_size * receive_period + 1, host)));\r\n assert sat(i1, always(countWithinLe(bs, incr, p + 1, timefun)));\r\n assert sat(i1, always(countWithinLe(bs, incr, p, timefun)));\r\n }\r\n\r\n if (d[i1 + 1] == 0)\r\n {\r\n i2 := i1 + 1;\r\n return;\r\n }\r\n\r\n assert sat(i1, PacketDeliveredToHostTemporal(b, host));\r\n assert sat(i1, ActionIsInstantaneousTemporal(PacketDeliveredToHostTemporal(b, host), timefun));\r\n assert timefun[i1] == timefun[i1+1];\r\n if (forall i :: TLe(i1, i) && i1 != i && timefun[i] <= timefun[i1] + p ==> d[i] > 0)\r\n {\r\n assert TLe(i1, i1);\r\n forall i {:trigger TLe(i1, i)} | TLe(i1, i) && i1 != i && timefun[i] <= timefun[i1] + p\r\n ensures || (sat(i, incr) && !sat(i, decr) && d[i + 1] == d[i] + 1)\r\n || (!sat(i, incr) && sat(i, decr) && d[i + 1] < d[i])\r\n || (!sat(i, incr) && !sat(i, decr) && d[i + 1] == d[i])\r\n {\r\n Lemma_DeliverIncrReceiveDecr(i1, i, b, host, d);\r\n }\r\n\r\n forall ensures sat(i1, incr) && !sat(i1, decr) && d[i1 + 1] == d[i1] + 1\r\n {\r\n if (!(host in b[i1].hostInfo))\r\n {\r\n assert !(host in b[i1 + 1].hostInfo);\r\n }\r\n if (sat(i1, decr))\r\n {\r\n if (host in b[i1].hostInfo)\r\n {\r\n var ios := b[i1].nextStep.ios;\r\n var io := ios[0];\r\n Lemma_ReceiveMakesHostQueueSmaller2(b[i1].hostInfo[host].queue, b[i1 + 1].hostInfo[host].queue, ios, io);\r\n }\r\n else\r\n {\r\n }\r\n assert false; // proof by contradiction\r\n }\r\n }\r\n\r\n i2 := Lemma_CountIncrDecr(i1, d, nIncr, nDecr, incr, decr, p, timefun);\r\n var f1 := imap i :: d[i] <= d[i1] + nIncr - nDecr;\r\n assert TLe(i1, i2) && sat(i2, stepmap(f1)) && timefun[i2] <= timefun[i1] + p;\r\n assert d[i2] <= d[i1];\r\n assert TLe(i1, i2);\r\n assert i1 != i2;\r\n assert timefun[i2] <= timefun[i1] + p;\r\n\r\n assert false; // proof by contradiction\r\n }\r\n\r\n i2 :| i1 < i2 && timefun[i2] <= timefun[i1] + p && d[i2] == 0;\r\n\r\n forall i {:trigger TLe(i1, i)} | TLe(i1, i) && timefun[i] <= timefun[i1] + p\r\n ensures || (sat(i, incr) && d[i + 1] == d[i] + 1)\r\n || (!sat(i, incr) && d[i + 1] <= d[i])\r\n {\r\n Lemma_DeliverIncr(i1, i, b, host, d);\r\n }\r\n Lemma_CountIncr(i1, d, nIncr, incr, p, timefun);\r\n var f2 := imap i :: d[i] <= d[i1] + nIncr;\r\n assert sat(i1, alwayswithin(stepmap(f2), p, timefun));\r\n\r\n forall i | i1 <= i <= i2 && host in b[i].hostInfo\r\n ensures |b[i].hostInfo[host].queue| <= burst_size\r\n {\r\n Lemma_TimeOnlyAdvancesBetweenSteps(b, i, i2);\r\n TemporalDeduceFromAlways(i1, i, untilabsolutetime(stepmap(f2), timefun[i1] + p, timefun));\r\n assert sat(i, stepmap(f2));\r\n }\r\n}\r\n\r\nlemma Lemma_ReceiveAttemptNoDecr(\r\n i2:int,\r\n i3:int,\r\n i4:int,\r\n b:Behavior>,\r\n p:LPacket,\r\n d:imap,\r\n r:int,\r\n timefun:imap\r\n ) \r\n requires imaptotal(b)\r\n requires imaptotal(timefun)\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires HostQueuesLive(b)\r\n requires TLe(0, i2)\r\n requires TLe(i2 + 1, i3)\r\n ensures TLe(i3, i4)\r\n requires sat(i3, eventuallynextwithin(ReceiveAttemptedTemporal(b, p.dst), r, timefun))\r\n requires d == imap i ::\r\n (if TLe(i2, i) && p.dst in b[i].hostInfo && p in b[i].hostInfo[p.dst].queue\r\n then 1 + QueuePosition(b[i].hostInfo[p.dst].queue, p)\r\n else 0)\r\n requires monotonic_from(i3, timefun)\r\n requires i4 == earliestActionWithin(i3, ReceiveAttemptedTemporal(b, p.dst), r, timefun)\r\n requires d[i3] >= 1\r\n ensures d[i4] == d[i3]\r\n decreases i4 - i3\r\n{\r\n TemporalAssist();\r\n if (i3 < i4)\r\n {\r\n assert TLe(0, i3);\r\n var e := b[i3];\r\n var e' := b[i3 + 1];\r\n var q := e.hostInfo[p.dst].queue;\r\n assert !sat(i3, ReceiveAttemptedTemporal(b, p.dst));\r\n\r\n assert LEnvironment_Next(e, e');\r\n assert HostQueues_Next(e, e');\r\n\r\n if e.nextStep.LEnvStepDeliverPacket?\r\n {\r\n var q' := e'.hostInfo[p.dst].queue;\r\n if (q != q')\r\n {\r\n var p' :| q' == q + [p'];\r\n Lemma_QueuePositionTail(q, p, [p']);\r\n assert d[i3] == d[i3 + 1];\r\n }\r\n assert d[i3] == d[i3 + 1];\r\n }\r\n else if e.nextStep.LEnvStepAdvanceTime?\r\n {\r\n assert d[i3] == d[i3 + 1];\r\n }\r\n else if e.nextStep.LEnvStepHostIos?\r\n {\r\n var actor := e.nextStep.actor;\r\n var ios := e.nextStep.ios;\r\n if (actor == p.dst)\r\n {\r\n var q' := e'.hostInfo[p.dst].queue;\r\n assert HostQueue_PerformIos(q, q', ios);\r\n if (|ios| > 0 && ios[0].LIoOpReceive?)\r\n {\r\n var io := ios[0];\r\n assert ReceiveAttemptedInStep(e, p.dst);\r\n }\r\n }\r\n }\r\n\r\n assert d[i3] == d[i3 + 1];\r\n var k := TemporalDeduceFromEventual(i3, nextbefore(ReceiveAttemptedTemporal(b, p.dst), timefun[i3] + r, timefun));\r\n assert k != i3;\r\n TemporalEventually(i3 + 1, k, nextbefore(ReceiveAttemptedTemporal(b, p.dst), timefun[i3] + r, timefun));\r\n Lemma_ReceiveAttemptNoDecr(i2, i3 + 1, i4, b, p, d, r, timefun);\r\n }\r\n}\r\n\r\nlemma Lemma_PromoteInQueue(\r\n q:seq>,\r\n q':seq>,\r\n p:LPacket,\r\n ios:seq>\r\n )\r\n requires p in q\r\n requires HostQueue_PerformIos(q, q', ios)\r\n requires (forall i :: 0 <= i < |ios| && ios[i].LIoOpReceive? ==> ios[i].r != p)\r\n ensures p in q'\r\n ensures QueuePosition(q', p) <= QueuePosition(q, p)\r\n ensures |ios| >= 1 && ios[0].LIoOpReceive? ==> QueuePosition(q', p) < QueuePosition(q, p)\r\n decreases ios\r\n{\r\n reveal QueuePosition();\r\n if (|ios| > 0)\r\n {\r\n var io := ios[0];\r\n if (io.LIoOpReceive?)\r\n {\r\n Lemma_QueuePosition(q, p);\r\n Lemma_PromoteInQueue(q[1..], q', p, ios[1..]);\r\n }\r\n }\r\n}\r\n\r\nlemma Lemma_ReceiveAttemptDecr(\r\n i2:int,\r\n i3:int,\r\n b:Behavior>,\r\n p:LPacket,\r\n d:imap,\r\n r:int,\r\n timefun:imap\r\n ) returns(i4:int)\r\n requires imaptotal(b)\r\n requires imaptotal(timefun)\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires HostQueuesLive(b)\r\n requires TLe(0, i2)\r\n requires TLe(i2 + 1, i3)\r\n requires monotonic_from(i3, timefun)\r\n requires sat(i3, eventuallynextwithin(ReceiveAttemptedTemporal(b, p.dst), r, timefun))\r\n requires d == imap i ::\r\n (if TLe(i2, i) && p.dst in b[i].hostInfo && p in b[i].hostInfo[p.dst].queue\r\n then 1 + QueuePosition(b[i].hostInfo[p.dst].queue, p)\r\n else 0)\r\n ensures TLe(i3, i4)\r\n ensures sat(i3, actionGoalDecreaseWithin(PacketReceivedTemporal(b, p), d, r, timefun))\r\n{\r\n TemporalAssist();\r\n var goal := PacketReceivedTemporal(b, p);\r\n\r\n i4 := earliestActionWithin(i3, ReceiveAttemptedTemporal(b, p.dst), r, timefun);\r\n\r\n if (d[i3] != 0)\r\n {\r\n assert d[i3] == (if TLe(i2, i3) && p.dst in b[i3].hostInfo && p in b[i3].hostInfo[p.dst].queue\r\n then 1 + QueuePosition(b[i3].hostInfo[p.dst].queue, p)\r\n else 0);\r\n assert d[i3] > 0;\r\n Lemma_ReceiveAttemptNoDecr(i2, i3, i4, b, p, d, r, timefun);\r\n assert d[i3] == d[i4];\r\n assert d[i4] > 0;\r\n\r\n TemporalDeduceFromAlways(0, i4, HostQueuesNextTemporal(b));\r\n var e := b[i4];\r\n var e' := b[i4 + 1];\r\n var ios := b[i4].nextStep.ios;\r\n var io := ios[0];\r\n var q := e.hostInfo[p.dst].queue;\r\n Lemma_IfOpSeqIsCompatibleWithReductionAndFirstIsntReceiveThenNoneAreReceives2(ios);\r\n assert io.LIoOpTimeoutReceive? || io.LIoOpReceive?;\r\n\r\n if (ios[0].LIoOpTimeoutReceive?)\r\n {\r\n assert |q| == 0;\r\n }\r\n if (ios[0].LIoOpReceive?)\r\n {\r\n assert p.dst in e'.hostInfo;\r\n var q' := e'.hostInfo[p.dst].queue;\r\n assert HostQueue_PerformIos(q, q', ios);\r\n if (exists i :: 0 <= i < |ios| && ios[i].LIoOpReceive? && ios[i].r == p)\r\n {\r\n assert sat(i4, goal);\r\n }\r\n else\r\n {\r\n Lemma_PromoteInQueue(q, q', p, ios);\r\n assert p in q' && QueuePosition(q', p) < QueuePosition(q, p);\r\n assert (0 < d[i4 + 1] && d[i4 + 1] < d[i3]);\r\n }\r\n }\r\n\r\n assert (0 < d[i4 + 1] && d[i4 + 1] < d[i3]) || sat(i4, goal);\r\n assert sat(i3, actionGoalDecreaseWithin(PacketReceivedTemporal(b, p), d, r, timefun));\r\n }\r\n}\r\n\r\nlemma Lemma_HostQueueSizeBoundedAfterEmptyHelper(\r\n latency_bound:int,\r\n host:IdType,\r\n b:Behavior>,\r\n i1:int,\r\n i2:int,\r\n burst_size:int,\r\n receive_period:int\r\n )\r\n requires imaptotal(b)\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires HostQueuesLive(b)\r\n requires TLe(0, i1)\r\n requires TLe(i1, i2)\r\n requires 1 <= receive_period\r\n requires 1 <= burst_size\r\n requires sat(i1, HostQueueEmptyTemporal(b, host))\r\n requires sat(i1, always(eventuallynextwithin(ReceiveAttemptedTemporal(b, host), receive_period, BehaviorToTimeMap(b))))\r\n requires sat(i1, always(NetworkDeliveryRateForHostBoundedTemporal(b, burst_size, burst_size * receive_period + 1, host)))\r\n ensures forall i :: i1 <= i <= i2 && host in b[i].hostInfo ==> |b[i].hostInfo[host].queue| <= burst_size\r\n decreases i2 - i1\r\n{\r\n TemporalAssist();\r\n Lemma_EstablishMonotonicFromOpaque(b, 0);\r\n var i1' := Lemma_HostQueueEmptiesAgain(latency_bound, host, b, i1, burst_size, receive_period);\r\n if (i1' < i2)\r\n {\r\n Lemma_HostQueueSizeBoundedAfterEmptyHelper(latency_bound, host, b, i1', i2, burst_size, receive_period);\r\n }\r\n}\r\n\r\nfunction{:opaque} QueueBounded(b:Behavior>, host:IdType, burst_size:int):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, QueueBounded(b, host, burst_size))} ::\r\n sat(i, QueueBounded(b, host, burst_size)) <==> (host in b[i].hostInfo ==> |b[i].hostInfo[host].queue| <= burst_size)\r\n{\r\n stepmap(imap i :: host in b[i].hostInfo ==> |b[i].hostInfo[host].queue| <= burst_size)\r\n}\r\n\r\nlemma Lemma_HostQueueSizeBoundedAfterEmpty(\r\n latency_bound:int,\r\n host:IdType,\r\n b:Behavior>,\r\n i1:int,\r\n burst_size:int,\r\n receive_period:int\r\n )\r\n requires imaptotal(b)\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires HostQueuesLive(b)\r\n requires TLe(0, i1)\r\n requires 1 <= receive_period\r\n requires 1 <= burst_size\r\n requires sat(i1, HostQueueEmptyTemporal(b, host))\r\n requires sat(i1, always(eventuallynextwithin(ReceiveAttemptedTemporal(b, host), receive_period, BehaviorToTimeMap(b))))\r\n requires sat(i1, always(NetworkDeliveryRateForHostBoundedTemporal(b, burst_size, burst_size * receive_period + 1, host)))\r\n ensures sat(i1, always(QueueBounded(b, host, burst_size)))\r\n{\r\n TemporalAssist();\r\n forall i2 | TLe(i1, i2)\r\n ensures sat(i2, QueueBounded(b, host, burst_size))\r\n {\r\n if (host in b[i2].hostInfo)\r\n {\r\n Lemma_HostQueueSizeBoundedAfterEmptyHelper(latency_bound, host, b, i1, i2, burst_size, receive_period);\r\n assert |b[i2].hostInfo[host].queue| <= burst_size;\r\n }\r\n assert host in b[i2].hostInfo ==> |b[i2].hostInfo[host].queue| <= burst_size;\r\n assert sat(i2, stepmap(imap i :: host in b[i].hostInfo ==> |b[i].hostInfo[host].queue| <= burst_size));\r\n assert sat(i2, QueueBounded(b, host, burst_size));\r\n }\r\n assert sat(i1, always(QueueBounded(b, host, burst_size)));\r\n}\r\n\r\nlemma Lemma_EventuallyEachHostQueueEmpties(\r\n latency_bound:int,\r\n destinations:set,\r\n b:Behavior>,\r\n synchrony_start:int,\r\n burst_size:int,\r\n receive_period:int\r\n )\r\n requires imaptotal(b)\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires HostQueuesLive(b)\r\n requires TLe(0, synchrony_start)\r\n requires 1 <= receive_period\r\n requires 1 <= burst_size\r\n\r\n // Starting from the synchrony point, each host attempts to receive a packet at least once every receive_period.\r\n // That is, it performs an I/O that's either a Receive or a TimeoutReceive.\r\n requires forall host :: host in destinations ==> sat(synchrony_start, always(eventuallynextwithin(ReceiveAttemptedTemporal(b, host), receive_period, BehaviorToTimeMap(b))))\r\n\r\n // Starting from the synchrony point, the network stops overwhelming each host with\r\n // delivered packets. That is, there are at most burst_size packets delivered to any host during any period\r\n // of length <= burst_size * receive_period + 1\r\n requires forall host :: host in destinations ==> sat(synchrony_start, always(NetworkDeliveryRateForHostBoundedTemporal(b, burst_size, burst_size * receive_period + 1, host)))\r\n\r\n // At some point after the synchrony point, possibly different for each host, that host's queue becomes empty.\r\n ensures forall host:: host in destinations ==> sat(synchrony_start, eventual(HostQueueEmptyTemporal(b, host)))\r\n{\r\n var timefun := BehaviorToTimeMap(b);\r\n\r\n forall host | host in destinations\r\n ensures sat(synchrony_start, eventual(HostQueueEmptyTemporal(b, host)))\r\n {\r\n // If []t :: <>(goal || d' < d[t]')\r\n // and [](0 <= d)\r\n // then []<>(goal)\r\n // goal = (|Q| == 0)\r\n // d = |Q|\r\n var i0 := synchrony_start;\r\n var goal := HostQueueEmptyTemporal(b, host);\r\n\r\n var d := imap i :: if host in b[i].hostInfo then |b[i].hostInfo[host].queue| else 0;\r\n\r\n TemporalAssist();\r\n var start := i0;\r\n forall i1 | TLe(i0, i1)\r\n ensures sat(i1, nextOrDecrease(goal, d))\r\n {\r\n if (!sat(i1, eventual(or(goal, nextDecrease(i1, d)))))\r\n {\r\n assert forall i :: TLe(i1, i) ==> !sat(i, goal);\r\n assert forall i :: TLe(i1, i) ==> !sat(i, nextDecrease(i1, d));\r\n assert forall i :: TLe(i1, i) ==> d[i + 1] >= d[i1];\r\n assert TLe(i1, i1);\r\n assert !sat(i1, HostQueueEmptyTemporal(b, host));\r\n assert !(host in b[i1].hostInfo ==> |b[i1].hostInfo[host].queue| == 0);\r\n assert d[i1] > 0;\r\n\r\n Lemma_EstablishMonotonicFromOpaque(b, i1);\r\n\r\n var bs := burst_size;\r\n var r := receive_period;\r\n var p := bs * r;\r\n forall ensures 1 <= p { lemma_mul_increases(bs, r); }\r\n forall ensures 0 <= p * (p + 1) { lemma_mul_nonnegative(p, p + 1); }\r\n forall ensures p * (p + 1) == (p + 1) * p { lemma_mul_auto(); }\r\n forall ensures bs * p < bs * (p + 1) { lemma_mul_auto(); }\r\n\r\n // In time p * (p + 1), we'll deliver >= bs * (p + 1) messages\r\n // In time (p + 1) * p, we'll receive <= bs * p messages\r\n // So in time p * (p + 1) == (p + 1) * p, we'll decrease d by bs\r\n\r\n // use d >= 1 to prove that delivery decrements\r\n // define decr_action as d' = d - 1\r\n // define incr_action as d' = d + 1\r\n // p * (p + 1): |decr_action| >= bs * (p + 1)\r\n // p: |decr_action| >= bs\r\n // r: |decr_action| >= 1\r\n // (p * 1) * p: |incr_action| <= bs * p\r\n // p + 1: |incr_action| <= bs\r\n // d' = d + |incr_action| - |decr_action|\r\n var incr := PacketDeliveredToHostTemporal(b, host);\r\n var decr := ReceiveAttemptedTemporal(b, host);\r\n\r\n assert TLe(i1, i1);\r\n forall ensures sat(i1, countWithinGe(bs * (p + 1), decr, p * (p + 1), timefun))\r\n {\r\n Lemma_CountWithinGeOne(i1, decr, r, timefun);\r\n Lemma_CountWithinGeMultiple(i1, bs, 1, decr, r, timefun);\r\n Lemma_CountWithinGeMultiple(i1, p + 1, bs, decr, p, timefun);\r\n }\r\n \r\n forall ensures sat(i1, countWithinLe(bs * p, incr, p * (p + 1), timefun))\r\n {\r\n assert sat(synchrony_start,\r\n always(NetworkDeliveryRateForHostBoundedTemporal(b, burst_size, burst_size * receive_period + 1, host)));\r\n assert sat(i1, always(NetworkDeliveryRateForHostBoundedTemporal(b, burst_size, burst_size * receive_period + 1, host)));\r\n assert sat(i1, always(countWithinLe(bs, incr, p + 1, timefun)));\r\n Lemma_DeliverIsInstantaneous(b, i1, host);\r\n Lemma_CountWithinLeMultiple(i1, p, bs, incr, p + 1, timefun);\r\n }\r\n\r\n var nIncr:int := bs * p;\r\n var nDecr:int := bs * (p + 1);\r\n var span := p * (p + 1);\r\n assert sat(i1, countWithinLe(nIncr, incr, span, timefun));\r\n assert sat(i1, countWithinGe(nDecr, decr, span, timefun));\r\n\r\n forall i2 {:trigger TLe(i1, i2)} | TLe(i1, i2)\r\n ensures || (sat(i2, PacketDeliveredToHostTemporal(b, host)) && !sat(i2, ReceiveAttemptedTemporal(b, host)) && d[i2 + 1] == d[i2] + 1)\r\n || (!sat(i2, PacketDeliveredToHostTemporal(b, host)) && sat(i2, ReceiveAttemptedTemporal(b, host)) && d[i2 + 1] < d[i2])\r\n || (!sat(i2, PacketDeliveredToHostTemporal(b, host)) && !sat(i2, ReceiveAttemptedTemporal(b, host)) && d[i2 + 1] == d[i2]);\r\n {\r\n Lemma_DeliverIncrReceiveDecr(i1, i2, b, host, d);\r\n }\r\n\r\n var i2 := Lemma_CountIncrDecr(i1, d, nIncr, nDecr, incr, decr, span, timefun);\r\n assert nDecr > 0;\r\n assert TLe(i1, i2 - 1);\r\n assert nIncr < nDecr;\r\n assert d[i2] < d[i1];\r\n assert sat(i2, stepDecrease(i1, d));\r\n assert i2 - 1 + 1 == i2;\r\n assert sat(i2 - 1 + 1, stepDecrease(i1, d));\r\n assert sat(i2 - 1, nextDecrease(i1, d));\r\n assert !sat(i2 - 1, nextDecrease(i1, d));\r\n assert false; // proof by contradiction\r\n }\r\n var i2 :| TLe(i1, i2) && sat(i2, or(goal, nextDecrease(i1, d)));\r\n assert sat(i1, eventual(or(goal, nextDecrease(i1, d))));\r\n }\r\n assert imaptotal(d);\r\n assert forall i :: start <= i ==> 0 <= d[i];\r\n assert sat(start, always(nextOrDecrease(goal, d)));\r\n Lemma_EventuallyNext(i0, d, goal);\r\n assert sat(start, always(eventual(goal)));\r\n }\r\n}\r\n\r\nlemma Lemma_EventuallyAllPacketsAlwaysReceivedInTimeHelper3(\r\n synchrony_start:int,\r\n latency_bound:int,\r\n sources:set,\r\n destinations:set,\r\n b:Behavior>,\r\n burst_size:int,\r\n receive_period:int\r\n ) returns\r\n (processing_bound:int)\r\n requires imaptotal(b)\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires HostQueuesLive(b)\r\n requires TLe(0, synchrony_start)\r\n requires 1 <= receive_period\r\n requires 1 <= burst_size\r\n\r\n // Eventually we reach a point where packets sent between these hosts are delivered within latency_bound.\r\n requires sat(synchrony_start, always(PacketsSynchronousForHostsTemporal(b, latency_bound, sources, destinations)))\r\n\r\n // Each of the destinations eventually reaches a point where it attempts to receive a packet at least once every receive_period.\r\n // That is, it performs an I/O that's either a Receive or a TimeoutReceive.\r\n requires forall host :: host in destinations ==> sat(synchrony_start, always(eventuallynextwithin(ReceiveAttemptedTemporal(b, host), receive_period, BehaviorToTimeMap(b))))\r\n\r\n requires forall host :: host in destinations ==> sat(synchrony_start, always(QueueBounded(b, host, burst_size)));\r\n\r\n // Eventually we reach a point where any packet sent between these hosts is received within burst_size *\r\n // receive_period after it is sent.\r\n ensures sat(synchrony_start, always(AllPacketsReceivedWithinTemporal(b, latency_bound + burst_size * receive_period, sources, destinations)))\r\n ensures processing_bound == latency_bound + burst_size * receive_period\r\n{\r\n forall i1 | TLe(synchrony_start, i1)\r\n ensures sat(i1, AllPacketsReceivedWithinTemporal(b, latency_bound + burst_size * receive_period, sources, destinations))\r\n {\r\n forall p {:trigger PacketSentBetweenHosts(b[i1], p, sources, destinations)} | PacketSentBetweenHosts(b[i1], p, sources, destinations)\r\n ensures sat(i1, next(eventuallynextwithin(PacketReceivedTemporal(b, p), latency_bound + burst_size * receive_period, BehaviorToTimeMap(b))))\r\n {\r\n var timefun := BehaviorToTimeMap(b);\r\n var bs := burst_size;\r\n var r := receive_period;\r\n var lb := latency_bound;\r\n var goal := PacketReceivedTemporal(b, p);\r\n assert p.dst in destinations;\r\n\r\n forall ensures (exists i2 :: TLe(i1, i2) && sat(i2, PacketDeliveredTemporal(b, p)) && timefun[i2 + 1] <= timefun[i1+1] + lb)\r\n {\r\n TemporalDeduceFromAlways(synchrony_start, i1, PacketsSynchronousForHostsTemporal(b, latency_bound, sources, destinations));\r\n TemporalDeduceFromAlways(0, i1, EnvironmentNextTemporal(b));\r\n assert p in b[i1 + 1].sentPackets;\r\n var i2 := TemporalDeduceFromEventual(i1 + 1, nextbefore(PacketDeliveredTemporal(b, p), timefun[i1 + 1] + lb, timefun));\r\n Lemma_TimeOnlyAdvancesBetweenSteps(b, i2, i2 + 1);\r\n }\r\n var i2 :| TLe(i1, i2) && sat(i2, PacketDeliveredTemporal(b, p)) && timefun[i2 + 1] <= timefun[i1+1] + lb;\r\n TemporalDeduceFromAlways(0, i2, HostQueuesNextTemporal(b));\r\n var d := imap i ::\r\n (if TLe(i2, i) && p.dst in b[i].hostInfo && p in b[i].hostInfo[p.dst].queue\r\n then 1 + QueuePosition(b[i].hostInfo[p.dst].queue, p)\r\n else 0);\r\n forall ensures sat(i2 + 1, eventuallynextwithin(goal, r * bs, timefun))\r\n {\r\n assert p in b[i2 + 1].hostInfo[p.dst].queue;\r\n assert TLe(synchrony_start, i2 + 1);\r\n forall i | TLe(synchrony_start, i) && p.dst in b[i].hostInfo\r\n ensures |b[i].hostInfo[p.dst].queue| <= bs\r\n {\r\n TemporalAssist();\r\n assert TLe(synchrony_start, i);\r\n TemporalDeduceFromAlways(synchrony_start, i, QueueBounded(b, p.dst, bs));\r\n assert |b[i].hostInfo[p.dst].queue| <= bs;\r\n }\r\n forall i3 | TLe(i2 + 1, i3)\r\n ensures sat(i3, actionGoalDecreaseWithin(goal, d, r, timefun))\r\n {\r\n TemporalAssist();\r\n assert TLe(synchrony_start, i3);\r\n assert sat(i3, eventuallynextwithin(ReceiveAttemptedTemporal(b, p.dst), r, timefun));\r\n Lemma_EstablishMonotonicFromOpaque(b, i3);\r\n reveal monotonic_from_opaque();\r\n var i4 := Lemma_ReceiveAttemptDecr(i2, i3, b, p, d, r, timefun);\r\n assert sat(i3, actionGoalDecreaseWithin(goal, d, r, timefun));\r\n }\r\n forall ensures sat(i2 + 1, eventuallynextwithinspans(d, goal, r, timefun))\r\n {\r\n forall ensures sat(i2 + 1, always(actionGoalDecreaseWithin(goal, d, r, timefun)))\r\n {\r\n TemporalAssist();\r\n assert forall i3 :: TLe(i2 + 1, i3) ==> sat(i3, actionGoalDecreaseWithin(goal, d, r, timefun));\r\n assert sat(i2 + 1, always(actionGoalDecreaseWithin(goal, d, r, timefun)));\r\n }\r\n Lemma_EventuallyNextGoalSpans(i2 + 1, d, goal, r, timefun);\r\n }\r\n forall ensures sat(i2 + 1, eventuallynextwithin(goal, r * bs, timefun))\r\n {\r\n TemporalAssist();\r\n assert sat(i2 + 1, eventuallynextwithinspans(d, goal, r, timefun));\r\n assert sat(i2 + 1, eventuallynextwithin(goal, r * d[i2 + 1], timefun));\r\n assert d[i2 + 1] <= bs;\r\n forall ensures r * d[i2 + 1] <= r * bs { lemma_mul_inequality_forall(); lemma_mul_auto(); }\r\n assert sat(i2 + 1, eventuallynextwithin(goal, r * bs, timefun));\r\n }\r\n }\r\n forall ensures sat(i1, next(eventuallynextwithin(goal, lb + bs * r, timefun)))\r\n {\r\n var i3 := TemporalDeduceFromEventual(i2 + 1, nextbefore(goal, timefun[i2 + 1] + (r * bs), timefun));\r\n calc {\r\n timefun[i3 + 1];\r\n <= timefun[i2 + 1] + (r * bs);\r\n == { lemma_mul_auto(); }\r\n timefun[i2 + 1] + (bs * r);\r\n <= { assert timefun[i2 + 1] <= timefun[i1 + 1] + lb; }\r\n (timefun[i1 + 1] + lb) + (bs * r);\r\n == timefun[i1 + 1] + (lb + (bs * r));\r\n }\r\n TemporalEventually(i1 + 1, i3, nextbefore(goal, timefun[i1 + 1] + (lb + bs * r), timefun));\r\n }\r\n }\r\n }\r\n forall ensures sat(synchrony_start, always(AllPacketsReceivedWithinTemporal(b, latency_bound + burst_size * receive_period, sources, destinations)))\r\n {\r\n TemporalAssist();\r\n }\r\n\r\n processing_bound := latency_bound + burst_size * receive_period;\r\n}\r\n\r\nlemma Lemma_EventuallyAllPacketsAlwaysReceivedInTimeHelper2(\r\n synchrony_start:int,\r\n i1:int,\r\n latency_bound:int,\r\n sources:set,\r\n destinations:set,\r\n b:Behavior>,\r\n burst_size:int,\r\n receive_period:int\r\n ) returns (\r\n processing_sync_start:int,\r\n processing_bound:int\r\n )\r\n requires imaptotal(b)\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires HostQueuesLive(b)\r\n requires TLe(0, synchrony_start)\r\n requires TLe(synchrony_start, i1)\r\n requires 1 <= receive_period\r\n requires 1 <= burst_size\r\n\r\n // Eventually we reach a point where packets sent between these hosts are delivered within latency_bound.\r\n requires sat(synchrony_start, always(PacketsSynchronousForHostsTemporal(b, latency_bound, sources, destinations)))\r\n\r\n // Each of the destinations eventually reaches a point where it attempts to receive a packet at least once every receive_period.\r\n // That is, it performs an I/O that's either a Receive or a TimeoutReceive.\r\n requires forall host :: host in destinations ==> sat(synchrony_start, always(eventuallynextwithin(ReceiveAttemptedTemporal(b, host), receive_period, BehaviorToTimeMap(b))))\r\n\r\n // Each of the destinations eventually reaches a point after which the network stops overwhelming it with\r\n // delivered packets. That is, there are at most burst_size packets delivered to it during any period\r\n // of length <= burst_size * receive_period + 1\r\n requires forall host :: host in destinations ==> sat(synchrony_start, always(NetworkDeliveryRateForHostBoundedTemporal(b, burst_size, burst_size * receive_period + 1, host)))\r\n\r\n requires forall host :: host in destinations ==> sat(i1, always(QueueBounded(b, host, burst_size)))\r\n\r\n // Eventually we reach a point where any packet sent between these hosts is received within burst_size *\r\n // receive_period after it is sent.\r\n ensures synchrony_start <= processing_sync_start\r\n ensures processing_bound == latency_bound + burst_size * receive_period\r\n ensures sat(processing_sync_start, always(AllPacketsReceivedWithinTemporal(b, latency_bound + burst_size * receive_period, sources, destinations)))\r\n{\r\n Lemma_AlwaysImpliesLaterAlways(synchrony_start, i1, PacketsSynchronousForHostsTemporal(b, latency_bound, sources, destinations));\r\n forall host | host in destinations\r\n ensures sat(i1, always(eventuallynextwithin(ReceiveAttemptedTemporal(b, host), receive_period, BehaviorToTimeMap(b))))\r\n ensures sat(i1, always(NetworkDeliveryRateForHostBoundedTemporal(b, burst_size, burst_size * receive_period + 1, host)))\r\n {\r\n Lemma_AlwaysImpliesLaterAlways(synchrony_start, i1,\r\n eventuallynextwithin(ReceiveAttemptedTemporal(b, host), receive_period, BehaviorToTimeMap(b)));\r\n Lemma_AlwaysImpliesLaterAlways(synchrony_start, i1,\r\n NetworkDeliveryRateForHostBoundedTemporal(b, burst_size, burst_size * receive_period + 1, host));\r\n }\r\n processing_bound :=\r\n Lemma_EventuallyAllPacketsAlwaysReceivedInTimeHelper3(i1, latency_bound, sources, destinations, b, burst_size, receive_period);\r\n processing_sync_start := i1;\r\n}\r\n\r\nlemma Lemma_EventuallyAllPacketsAlwaysReceivedInTime(\r\n synchrony_start:int,\r\n latency_bound:int,\r\n sources:set,\r\n destinations:set,\r\n b:Behavior>,\r\n burst_size:int,\r\n receive_period:int\r\n ) returns (\r\n processing_sync_start:int,\r\n processing_bound:int\r\n )\r\n requires imaptotal(b)\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires HostQueuesLive(b)\r\n requires TLe(0, synchrony_start)\r\n requires 1 <= receive_period\r\n requires 1 <= burst_size\r\n\r\n // All packets sent between these hosts are delivered within latency_bound.\r\n requires NetworkSynchronousForHosts(b, synchrony_start, latency_bound, sources, destinations)\r\n\r\n // The network does not overwhelm any of the destinations with delivered packets. That is,\r\n // there are at most burst_size packets delivered to it during any period of\r\n // length <= burst_size * receive_period + 1.\r\n requires NetworkDeliveryRateBoundedForHosts(b, synchrony_start, burst_size, burst_size * receive_period + 1, destinations)\r\n\r\n // Each of the destinations attempts to receive a packet at least once every receive_period.\r\n // That is, it performs an I/O that's either a Receive or a TimeoutReceive.\r\n requires forall host :: host in destinations ==> sat(synchrony_start, always(eventuallynextwithin(ReceiveAttemptedTemporal(b, host), receive_period, BehaviorToTimeMap(b))))\r\n\r\n // Any packet sent between these hosts is received within burst_size * receive_period after it is sent.\r\n ensures synchrony_start <= processing_sync_start\r\n ensures processing_bound == latency_bound + burst_size * receive_period\r\n ensures sat(processing_sync_start, always(AllPacketsReceivedWithinTemporal(b, latency_bound + burst_size * receive_period, sources, destinations)))\r\n{\r\n Lemma_EventuallyEachHostQueueEmpties(latency_bound, destinations, b, synchrony_start, burst_size, receive_period);\r\n\r\n forall host | host in destinations\r\n ensures exists i0a :: TLe(synchrony_start, i0a) && sat(i0a, always(QueueBounded(b, host, burst_size)))\r\n {\r\n TemporalAssist();\r\n var i0a :| TLe(synchrony_start, i0a) && sat(i0a, HostQueueEmptyTemporal(b, host));\r\n Lemma_HostQueueSizeBoundedAfterEmpty(latency_bound, host, b, i0a, burst_size, receive_period);\r\n }\r\n var i0as := set host | host in destinations ::\r\n (var i0a :| TLe(synchrony_start, i0a) && sat(i0a, always(QueueBounded(b, host, burst_size))); i0a);\r\n var i0s := {synchrony_start} + i0as;\r\n var i1 := intsetmax(i0s);\r\n\r\n assert synchrony_start <= i1;\r\n assert forall i :: i in i0as ==> i <= i1;\r\n\r\n forall host | host in destinations\r\n ensures sat(i1, always(QueueBounded(b, host, burst_size)))\r\n {\r\n var i0a :| i0a in i0as && sat(i0a, always(QueueBounded(b, host, burst_size)));\r\n assert i0a <= i1;\r\n TemporalAssist();\r\n }\r\n processing_sync_start, processing_bound :=\r\n Lemma_EventuallyAllPacketsAlwaysReceivedInTimeHelper2(synchrony_start, i1, latency_bound, sources, destinations,\r\n b, burst_size, receive_period);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Framework/Host.s.dfy", "content": "include \"../Native/Io.s.dfy\"\r\ninclude \"Environment.s.dfy\"\r\n\r\nabstract module Host_s {\r\n\r\nimport opened Native__Io_s\r\nimport opened Environment_s \r\nimport opened Native__NativeTypes_s\r\n \r\ntype HostState\r\ntype ConcreteConfiguration\r\n\r\npredicate HostInit(host_state:HostState, config:ConcreteConfiguration, id:EndPoint)\r\n reads *\r\npredicate HostNext(host_state:HostState, host_state':HostState, ios:seq>>)\r\n reads *\r\n\r\npredicate ConcreteConfigInit(config:ConcreteConfiguration)\r\nfunction ConcreteConfigToServers(config:ConcreteConfiguration) : set\r\n\r\npredicate HostStateInvariants(host_state:HostState, env:HostEnvironment)\r\n reads *\r\n\r\nfunction ParseCommandLineConfiguration(args:seq>) : ConcreteConfiguration\r\n\r\npredicate ArbitraryObject(o:object) { true }\r\n\r\nmethod HostInitImpl(ghost env:HostEnvironment, netc:NetClient, args:seq>) returns (\r\n ok:bool,\r\n host_state:HostState\r\n )\r\n requires env.Valid()\r\n requires env.ok.ok()\r\n requires netc.IsOpen()\r\n requires netc.env == env\r\n requires ValidPhysicalAddress(EndPoint(netc.MyPublicKey()))\r\n modifies set x:object | ArbitraryObject(x) // Everything!\r\n ensures ok ==> env.Valid() && env.ok.ok()\r\n ensures ok ==> HostStateInvariants(host_state, env)\r\n ensures ok ==> var id := EndPoint(netc.MyPublicKey());\r\n var config := ParseCommandLineConfiguration(args);\r\n && id in ConcreteConfigToServers(config)\r\n && ConcreteConfigInit(config)\r\n && HostInit(host_state, config, id)\r\n ensures env.net.history() == old(env.net.history()) // Prohibit HostInitImpl from sending (and receiving) packets\r\n\r\n\r\nmethod HostNextImpl(ghost env:HostEnvironment, host_state:HostState) \r\n returns (\r\n ok:bool,\r\n host_state':HostState,\r\n ghost recvs:seq,\r\n ghost clocks:seq,\r\n ghost sends:seq,\r\n ghost ios:seq>>\r\n )\r\n requires env.Valid() && env.ok.ok()\r\n requires HostStateInvariants(host_state, env)\r\n modifies set x:object | ArbitraryObject(x) // Everything!\r\n ensures ok <==> env.Valid() && env.ok.ok()\r\n ensures ok ==> HostStateInvariants(host_state', env)\r\n ensures ok ==> HostNext(host_state, host_state', ios)\r\n // Connect the low-level IO events to the spec-level IO events\r\n ensures ok ==> recvs + clocks + sends == ios\r\n // These obligations enable us to apply reduction\r\n // Even when !ok, if sent is non-empty, we need to return valid set of sent packets too\r\n ensures (ok || |sends| > 0) ==> env.net.history() == old(env.net.history()) + (recvs + clocks + sends)\r\n ensures forall e :: && (e in recvs ==> e.LIoOpReceive?) \r\n && (e in clocks ==> e.LIoOpReadClock? || e.LIoOpTimeoutReceive?) \r\n && (e in sends ==> e.LIoOpSend?)\r\n ensures |clocks| <= 1\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Framework/HostQueueLemmas.i.dfy", "content": "include \"Environment.s.dfy\"\r\ninclude \"EnvironmentSynchrony.s.dfy\"\r\ninclude \"../Logic/Temporal/Heuristics.i.dfy\"\r\ninclude \"../Logic/Temporal/Rules.i.dfy\"\r\ninclude \"../Logic/Temporal/Induction.i.dfy\"\r\n\r\nmodule Liveness__HostQueueLemmas_i {\r\nimport opened Environment_s\r\nimport opened EnvironmentSynchrony_s\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Induction_i\r\nimport opened Collections__Maps2_s\r\n\r\npredicate LEnvironmentInvariant(\r\n e:LEnvironment\r\n )\r\n{\r\n forall p, id :: id in e.hostInfo && p in e.hostInfo[id].queue ==> p in e.sentPackets\r\n}\r\n\r\nlemma Lemma_LEnvironmentInitEstablishesInvariant(\r\n e:LEnvironment\r\n )\r\n requires LEnvironment_Init(e)\r\n requires HostQueues_Init(e)\r\n ensures LEnvironmentInvariant(e)\r\n{\r\n}\r\n\r\nlemma Lemma_HostQueuePerformIosProducesTail(\r\n hostQueue:seq>,\r\n hostQueue':seq>,\r\n ios:seq>\r\n )\r\n returns (i:int)\r\n requires HostQueue_PerformIos(hostQueue, hostQueue', ios)\r\n ensures 0 <= i <= |hostQueue|\r\n ensures hostQueue' == hostQueue[i..]\r\n{\r\n if |ios| > 0 && ios[0].LIoOpReceive? {\r\n var j := Lemma_HostQueuePerformIosProducesTail(hostQueue[1..], hostQueue', ios[1..]);\r\n i := j + 1;\r\n }\r\n else {\r\n i := 0;\r\n }\r\n}\r\n\r\nlemma Lemma_LEnvironmentNextPreservesInvariant(\r\n e:LEnvironment,\r\n e':LEnvironment\r\n )\r\n requires LEnvironmentInvariant(e)\r\n requires LEnvironment_Next(e, e')\r\n requires HostQueues_Next(e, e')\r\n ensures LEnvironmentInvariant(e')\r\n{\r\n if e.nextStep.LEnvStepHostIos?\r\n {\r\n var actor := e.nextStep.actor;\r\n var ios := e.nextStep.ios;\r\n forall p, id | id in e'.hostInfo && p in e'.hostInfo[id].queue\r\n ensures p in e'.sentPackets\r\n {\r\n assert id in mapdomain(e'.hostInfo);\r\n assert id in e.hostInfo;\r\n if (id == actor) {\r\n assert HostQueue_PerformIos(e.hostInfo[id].queue, e'.hostInfo[id].queue, ios);\r\n var i := Lemma_HostQueuePerformIosProducesTail(e.hostInfo[id].queue, e'.hostInfo[id].queue, ios);\r\n assert p in e'.hostInfo[id].queue ==> p in e.hostInfo[id].queue;\r\n assert p in e'.sentPackets;\r\n }\r\n else {\r\n assert e'.hostInfo[id].queue == e.hostInfo[id].queue;\r\n assert p in e'.sentPackets;\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma Lemma_IfOpSeqIsCompatibleWithReductionThenSoIsSuffix(\r\n ios:seq>,\r\n j:int\r\n )\r\n requires LIoOpSeqCompatibleWithReduction(ios)\r\n requires 0 <= j <= |ios|\r\n ensures LIoOpSeqCompatibleWithReduction(ios[j..])\r\n{\r\n forall i | 0 <= i < |ios[j..]| - 1\r\n ensures LIoOpOrderingOKForAction(ios[j..][i], ios[j..][i+1])\r\n {\r\n assert ios[j..][i] == ios[j+i];\r\n assert ios[j..][i+1] == ios[j+i+1];\r\n }\r\n}\r\n\r\nlemma Lemma_IfOpSeqIsCompatibleWithReductionAndFirstIsntReceiveThenNoneAreReceives(\r\n ios:seq>\r\n )\r\n requires LIoOpSeqCompatibleWithReduction(ios)\r\n ensures |ios| > 0 && !ios[0].LIoOpReceive? ==> (forall io :: io in ios ==> !io.LIoOpReceive?)\r\n{\r\n if |ios| > 1 && !ios[0].LIoOpReceive?\r\n {\r\n var i := 0;\r\n assert 0 <= i < |ios| - 1;\r\n assert LIoOpOrderingOKForAction(ios[i], ios[i+1]);\r\n assert ios[1].LIoOpSend?;\r\n Lemma_IfOpSeqIsCompatibleWithReductionThenSoIsSuffix(ios, 1);\r\n Lemma_IfOpSeqIsCompatibleWithReductionAndFirstIsntReceiveThenNoneAreReceives(ios[1..]);\r\n }\r\n}\r\n\r\npredicate HostQueueDecomposition(\r\n hostQueue:seq>,\r\n hostQueue':seq>,\r\n s1:seq>,\r\n s2:seq>,\r\n p:LPacket\r\n )\r\n{\r\n hostQueue == s1 + [p] + s2 + hostQueue'\r\n}\r\n\r\nlemma Lemma_ReceiveRemovesPacketFromHostQueue(\r\n hostQueue:seq>,\r\n hostQueue':seq>,\r\n ios:seq>,\r\n p:LPacket\r\n )\r\n requires HostQueue_PerformIos(hostQueue, hostQueue', ios)\r\n requires LIoOpReceive(p) in ios\r\n requires LIoOpSeqCompatibleWithReduction(ios)\r\n ensures exists s1, s2 :: HostQueueDecomposition(hostQueue, hostQueue', s1, s2, p)\r\n{\r\n if (!ios[0].LIoOpReceive?)\r\n {\r\n Lemma_IfOpSeqIsCompatibleWithReductionAndFirstIsntReceiveThenNoneAreReceives(ios);\r\n assert false;\r\n }\r\n \r\n if ios[0].r == p\r\n {\r\n assert hostQueue[0] == p; \r\n var j := Lemma_HostQueuePerformIosProducesTail(hostQueue[1..], hostQueue', ios[1..]);\r\n assert 0 <= j <= |hostQueue[1..]| && hostQueue' == hostQueue[1..][j..];\r\n var s1 := [];\r\n var s2 := hostQueue[1..j+1];\r\n calc {\r\n hostQueue;\r\n [hostQueue[0]] + hostQueue[1..];\r\n [hostQueue[0]] + hostQueue[1..j+1] + hostQueue[j+1..];\r\n [hostQueue[0]] + hostQueue[1..j+1] + hostQueue[1..][j..];\r\n }\r\n assert HostQueueDecomposition(hostQueue, hostQueue', s1, s2, p);\r\n return;\r\n }\r\n\r\n Lemma_IfOpSeqIsCompatibleWithReductionThenSoIsSuffix(ios, 1);\r\n Lemma_ReceiveRemovesPacketFromHostQueue(hostQueue[1..], hostQueue', ios[1..], p);\r\n var s1', s2 :| hostQueue[1..] == s1' + [p] + s2 + hostQueue';\r\n var j := Lemma_HostQueuePerformIosProducesTail(hostQueue[1..], hostQueue', ios[1..]);\r\n assert 0 <= j <= |hostQueue[1..]| && hostQueue' == hostQueue[1..][j..];\r\n calc {\r\n hostQueue;\r\n [hostQueue[0]] + hostQueue[1..];\r\n [hostQueue[0]] + s1' + [p] + s2 + hostQueue';\r\n }\r\n var s1 := [hostQueue[0]] + s1';\r\n assert HostQueueDecomposition(hostQueue, hostQueue', s1, s2, p);\r\n}\r\n\r\nlemma Lemma_RemovePacketFromHostQueueImpliesReceive(\r\n hostQueue:seq>,\r\n hostQueue':seq>,\r\n ios:seq>,\r\n p:LPacket\r\n )\r\n requires HostQueue_PerformIos(hostQueue, hostQueue', ios)\r\n requires exists s1, s2 :: HostQueueDecomposition(hostQueue, hostQueue', s1, s2, p)\r\n requires LIoOpSeqCompatibleWithReduction(ios)\r\n ensures LIoOpReceive(p) in ios\r\n{\r\n var s1, s2 :| HostQueueDecomposition(hostQueue, hostQueue', s1, s2, p);\r\n if |s1| > 0\r\n {\r\n if (!ios[0].LIoOpReceive?)\r\n {\r\n Lemma_IfOpSeqIsCompatibleWithReductionAndFirstIsntReceiveThenNoneAreReceives(ios);\r\n assert false;\r\n }\r\n\r\n assert HostQueue_PerformIos(hostQueue[1..], hostQueue', ios[1..]);\r\n assert HostQueueDecomposition(hostQueue[1..], hostQueue', s1[1..], s2, p);\r\n Lemma_IfOpSeqIsCompatibleWithReductionThenSoIsSuffix(ios, 1);\r\n Lemma_RemovePacketFromHostQueueImpliesReceive(hostQueue[1..], hostQueue', ios[1..], p);\r\n }\r\n}\r\n\r\nlemma Lemma_ReceiveMakesHostQueueSmaller(\r\n hostQueue:seq>,\r\n hostQueue':seq>,\r\n ios:seq>,\r\n p:LPacket\r\n )\r\n requires HostQueue_PerformIos(hostQueue, hostQueue', ios)\r\n requires LIoOpReceive(p) in ios\r\n requires LIoOpSeqCompatibleWithReduction(ios)\r\n ensures |hostQueue'| < |hostQueue|\r\n{\r\n Lemma_ReceiveRemovesPacketFromHostQueue(hostQueue, hostQueue', ios, p);\r\n}\r\n\r\nlemma Lemma_HostQueuePerformIosReceivesFromHostQueue(\r\n hostQueue:seq>,\r\n hostQueue':seq>,\r\n ios:seq>\r\n )\r\n requires HostQueue_PerformIos(hostQueue, hostQueue', ios)\r\n requires LIoOpSeqCompatibleWithReduction(ios)\r\n ensures forall io :: io in ios && io.LIoOpReceive? ==> io.r in hostQueue\r\n decreases |ios|\r\n{\r\n if |ios| == 0\r\n {\r\n }\r\n else if ios[0].LIoOpReceive?\r\n {\r\n assert ios[0].r in hostQueue;\r\n Lemma_IfOpSeqIsCompatibleWithReductionThenSoIsSuffix(ios, 1);\r\n Lemma_HostQueuePerformIosReceivesFromHostQueue(hostQueue[1..], hostQueue', ios[1..]);\r\n }\r\n else\r\n {\r\n Lemma_IfOpSeqIsCompatibleWithReductionAndFirstIsntReceiveThenNoneAreReceives(ios);\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Framework/Main.s.dfy", "content": "include \"../../Common/Native/Io.s.dfy\"\r\ninclude \"DistributedSystem.s.dfy\"\r\ninclude \"AbstractService.s.dfy\"\r\ninclude \"../Collections/Seqs.s.dfy\"\r\n\r\nabstract module Main_s\r\n{\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened DS_s : DistributedSystem_s\r\nimport opened AS_s : AbstractService_s\r\nimport opened Collections__Seqs_s\r\n\r\nmethod IronfleetMain(ghost env:HostEnvironment, netc:NetClient, args:seq>)\r\n requires env.Valid() && env.ok.ok()\r\n requires env.net.history() == []\r\n requires netc.IsOpen()\r\n requires netc.env == env\r\n requires ValidPhysicalAddress(EndPoint(netc.MyPublicKey()))\r\n modifies set x:object | DS_s.H_s.ArbitraryObject(x) // Everything!\r\n decreases *\r\n{\r\n var ok, host_state := DS_s.H_s.HostInitImpl(env, netc, args);\r\n var config := DS_s.H_s.ParseCommandLineConfiguration(args);\r\n var id := EndPoint(netc.MyPublicKey());\r\n assert ok ==> DS_s.H_s.HostInit(host_state, config, id);\r\n\r\n while (ok) \r\n invariant ok ==> DS_s.H_s.HostStateInvariants(host_state, env)\r\n invariant ok ==> env.Valid() && env.ok.ok()\r\n decreases *\r\n {\r\n ghost var old_net_history := env.net.history();\r\n ghost var old_state := host_state;\r\n\r\n ghost var recvs, clocks, sends, ios;\r\n ok, host_state, recvs, clocks, sends, ios := DS_s.H_s.HostNextImpl(env, host_state);\r\n\r\n if ok {\r\n // Correctly executed one action\r\n assert DS_s.H_s.HostNext(old_state, host_state, ios);\r\n\r\n // Connect the low-level IO events to the spec-level IO events\r\n assert recvs + clocks + sends == ios;\r\n\r\n // These obligations enable us to apply reduction\r\n assert env.net.history() == old_net_history + recvs + clocks + sends;\r\n assert forall e :: && (e in recvs ==> e.LIoOpReceive?) \r\n && (e in clocks ==> e.LIoOpReadClock? || e.LIoOpTimeoutReceive?) \r\n && (e in sends ==> e.LIoOpSend?);\r\n assert |clocks| <= 1;\r\n }\r\n }\r\n}\r\n\r\nlemma RefinementProof(config:DS_s.H_s.ConcreteConfiguration, db:seq) returns (sb:seq)\r\n requires |db| > 0\r\n requires DS_Init(db[0], config)\r\n requires forall i {:trigger DS_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> DS_Next(db[i], db[i+1])\r\n ensures |db| == |sb|\r\n ensures Service_Init(sb[0], Collections__Maps2_s.mapdomain(db[0].servers))\r\n ensures forall i {:trigger Service_Next(sb[i], sb[i+1])} :: 0 <= i < |sb| - 1 ==> sb[i] == sb[i+1] || Service_Next(sb[i], sb[i+1])\r\n ensures forall i :: 0 <= i < |db| ==> Service_Correspondence(db[i].environment.sentPackets, sb[i])\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Logic/Option.i.dfy", "content": "\r\nmodule Logic__Option_i {\r\ndatatype Option = Some(v:T) | None\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Logic/Temporal/Heuristics.i.dfy", "content": "include \"Temporal.s.dfy\"\r\ninclude \"../../Collections/Maps2.i.dfy\"\r\n\r\nmodule Temporal__Heuristics_i {\r\nimport opened Temporal__Temporal_s\r\nimport opened Collections__Maps2_i\r\n\r\n////////////////////\r\n// DEFINITIONS\r\n////////////////////\r\n\r\nfunction TBlast(i:int):bool { true }\r\n\r\n////////////////////\r\n// LEMMAS\r\n////////////////////\r\n \r\n// Conservative heuristics; not complete\r\n// (e.g. won't prove <>[]A ==> []<>A)\r\nlemma TemporalAssist()\r\n ensures forall i:int, x:temporal {:trigger sat(i, always(x))} :: sat(i, always(x))\r\n == (forall j:int :: TLe(i, j) ==> sat(j, x))\r\n ensures forall i:int, x:temporal {:trigger sat(i, eventual(x))} :: sat(i, eventual(x))\r\n == (exists j:int :: TLe(i, j) && sat(j, x))\r\n ensures TLe(0, 0)\r\n{\r\n forall i:int, x:temporal {:trigger sat(i, always(x))}\r\n ensures sat(i, always(x)) == (forall j:int :: TLe(i, j) ==> sat(j, x))\r\n {\r\n reveal always();\r\n var f := imap ii{:trigger sat(ii, always(x))} :: forall j {:trigger sat(j, x)} :: ii <= j ==> sat(j, x);\r\n calc {\r\n sat(i, always(x));\r\n sat(i, stepmap(f));\r\n f[i];\r\n }\r\n }\r\n\r\n forall i:int, x:temporal {:trigger sat(i, eventual(x))}\r\n ensures sat(i, eventual(x)) == (exists j:int :: TLe(i, j) && sat(j, x))\r\n {\r\n reveal eventual();\r\n }\r\n}\r\n\r\n// Moderately aggressive heuristics\r\nlemma TemporalBlast()\r\n ensures forall i:int, x:temporal {:trigger sat(i, always(x))} :: sat(i, always(x))\r\n == (forall j:int :: TLe(i, j) ==> sat(j, x))\r\n ensures forall i:int, x:temporal {:trigger sat(i, eventual(x))} :: sat(i, eventual(x))\r\n == (exists j:int :: TLe(i, j) && sat(j, x))\r\n ensures forall i:int, j1:int, j2:int {:trigger TLe(i, j1), TLe(i, j2)} :: TLe(j1, j2) || TLe(j2, j1)\r\n ensures TLe(0, 0)\r\n{\r\n forall i:int, x:temporal {:trigger sat(i, always(x))}\r\n ensures sat(i, always(x)) == (forall j:int :: TLe(i, j) ==> sat(j, x))\r\n {\r\n reveal always();\r\n var f := imap ii{:trigger sat(ii, always(x))} :: forall j {:trigger sat(j, x)} :: ii <= j ==> sat(j, x);\r\n calc {\r\n sat(i, always(x));\r\n sat(i, stepmap(f));\r\n f[i];\r\n }\r\n }\r\n\r\n forall i:int, x:temporal {:trigger sat(i, eventual(x))}\r\n ensures sat(i, eventual(x)) == (exists j:int :: TLe(i, j) && sat(j, x))\r\n {\r\n reveal eventual();\r\n }\r\n}\r\n \r\n// Most aggressive heuristics; might not terminate\r\n// (e.g. won't terminate on invalid formula <>[](A || B) ==> <>[]A || <>[]B)\r\nlemma TemporalFullBlast()\r\n ensures forall i:int, x:temporal {:trigger sat(i, always(x))} :: sat(i, always(x))\r\n == (forall j:int {:trigger sat(j, x)}{:trigger TBlast(j)} :: TBlast(j) ==> i <= j ==> sat(j, x))\r\n ensures forall i:int, x:temporal {:trigger sat(i, eventual(x))} :: sat(i, eventual(x))\r\n == (exists j:int {:trigger sat(j, x)}{:trigger TBlast(j)} :: TBlast(j) && i <= j && sat(j, x))\r\n ensures TBlast(0)\r\n{\r\n forall i:int, x:temporal {:trigger sat(i, always(x))}\r\n ensures sat(i, always(x)) == (forall j:int :: TLe(i, j) ==> sat(j, x))\r\n {\r\n reveal always();\r\n var f := imap ii{:trigger sat(ii, always(x))} :: forall j {:trigger sat(j, x)} :: ii <= j ==> sat(j, x);\r\n calc {\r\n sat(i, always(x));\r\n sat(i, stepmap(f));\r\n f[i];\r\n }\r\n }\r\n\r\n forall i:int, x:temporal {:trigger sat(i, eventual(x))}\r\n ensures sat(i, eventual(x)) == (exists j:int :: TLe(i, j) && sat(j, x))\r\n {\r\n reveal eventual();\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Logic/Temporal/Induction.i.dfy", "content": "include \"Temporal.s.dfy\"\r\ninclude \"Heuristics.i.dfy\"\r\ninclude \"Rules.i.dfy\"\r\n\r\nmodule Temporal__Induction_i {\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Rules_i\r\n\r\nlemma TemporalInductionNextPartial(i1:int, i2:int, x:temporal)\r\n requires sat(i1, x)\r\n requires forall j :: i1 <= j ==> sat(j, imply(x, next(x)))\r\n ensures forall j :: i1 <= j <= i2 ==> sat(j, x)\r\n decreases i2 - i1\r\n{\r\n TemporalAssist();\r\n if (i1 < i2)\r\n {\r\n assert sat(i1, always(imply(x, next(x))));\r\n assert sat(i1, imply(x, next(x)));\r\n TemporalInductionNextPartial(nextstep(i1), i2, x);\r\n }\r\n}\r\n\r\nlemma TemporalInductionNext(i:int, x:temporal)\r\n requires sat(i, x)\r\n requires forall j :: i <= j ==> sat(j, imply(x, next(x)))\r\n ensures sat(i, always(x))\r\n{\r\n TemporalAssist();\r\n forall k | i <= k\r\n ensures sat(k, x)\r\n {\r\n reveal imply();\r\n reveal next();\r\n TemporalInductionNextPartial(i, k, x);\r\n }\r\n assert sat(i, always(x));\r\n}\r\n\r\nlemma TemporalInductionPartial(i1:int, i2:int, x:temporal)\r\n requires sat(i1, x)\r\n requires sat(i1, always(stepmap(imap j :: sat(j, x) ==> sat(nextstep(j), x))))\r\n ensures forall j :: i1 <= j <= i2 ==> sat(j, x)\r\n decreases i2 - i1\r\n{\r\n TemporalAssist();\r\n if (i1 < i2)\r\n {\r\n assert sat(i1, stepmap(imap j :: sat(j, x) ==> sat(nextstep(j), x)));\r\n TemporalInductionPartial(nextstep(i1), i2, x);\r\n }\r\n}\r\n \r\n// A && [](A ==> ()A) ==> []A\r\nlemma TemporalInduction(i:int, x:temporal)\r\n requires sat(i, x)\r\n requires sat(i, always(stepmap(imap j :: sat(j, x) ==> sat(nextstep(j), x))))\r\n ensures sat(i, always(x))\r\n{\r\n assert sat(i, always(stepmap(imap j :: sat(j, x) ==> sat(nextstep(j), x))));\r\n TemporalAssist();\r\n forall j | i <= j\r\n ensures sat(j, x)\r\n {\r\n TemporalInductionPartial(i, j, x);\r\n }\r\n}\r\n\r\nlemma TemporalInductionNextWithInvariantPartial(i1:int, i2:int, x:temporal, inv:temporal)\r\n requires sat(i1, x)\r\n requires sat(i1, always(inv))\r\n requires sat(i1, always(imply(and(x, inv), next(x))))\r\n ensures forall j :: i1 <= j <= i2 ==> sat(j, x)\r\n decreases i2 - i1\r\n{\r\n TemporalAssist();\r\n if (i1 < i2)\r\n {\r\n assert sat(i1, always(imply(and(x, inv), next(x))));\r\n assert sat(i1, imply(and(x, inv), next(x)));\r\n assert sat(i1, imply(x, next(x)));\r\n TemporalInductionNextWithInvariantPartial(nextstep(i1), i2, x, inv);\r\n }\r\n}\r\n\r\nlemma TemporalInductionNextWithInvariant(i:int, x:temporal, inv:temporal)\r\n requires sat(i, x)\r\n requires sat(i, always(inv))\r\n requires sat(i, always(imply(and(x, inv), next(x))))\r\n ensures sat(i, always(x))\r\n{\r\n assert sat(i, always(imply(and(x, inv), next(x))));\r\n TemporalAssist();\r\n forall j | i <= j\r\n ensures sat(j, x)\r\n {\r\n TemporalInductionNextWithInvariantPartial(i, j, x, inv);\r\n }\r\n assert sat(i, always(x));\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Logic/Temporal/LeadsTo.i.dfy", "content": "include \"Heuristics.i.dfy\"\r\ninclude \"Rules.i.dfy\"\r\ninclude \"Time.i.dfy\"\r\ninclude \"../../../../Libraries/Math/mul.i.dfy\"\r\n\r\nmodule Temporal__LeadsTo_i {\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Maps2_i\r\nimport opened Math__mul_i\r\n\r\n//////////////////\r\n// DEFINITIONS\r\n//////////////////\r\n\r\nfunction leadsto(x:temporal, y:temporal):temporal\r\n{\r\n always(imply(x, eventual(y)))\r\n}\r\n\r\nfunction leadstowithin(x:temporal, y:temporal, t:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n{\r\n always(imply(x, eventuallywithin(y, t, timefun)))\r\n}\r\n\r\nfunction leadstonextwithin(x:temporal, action:temporal, t:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n{\r\n always(imply(x, eventuallynextwithin(action, t, timefun)))\r\n}\r\n\r\nfunction leadstonextwithinnext(x:temporal, action:temporal, t:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n{\r\n always(imply(x, next(eventuallynextwithin(action, t, timefun))))\r\n}\r\n\r\n//////////////////\r\n// LEMMAS\r\n//////////////////\r\n\r\nlemma TransitivityOfLeadsTo(i:int, x:temporal, y:temporal, z:temporal)\r\n requires sat(i, leadsto(x, y))\r\n requires sat(i, leadsto(y, z))\r\n ensures sat(i, leadsto(x, z))\r\n{\r\n forall j | TLe(i, j)\r\n ensures sat(j, imply(x, eventual(z)))\r\n {\r\n if sat(j, x) {\r\n TemporalDeduceFromAlways(i, j, imply(x, eventual(y)));\r\n var k := TemporalDeduceFromEventual(j, y);\r\n TemporalDeduceFromAlways(i, k, imply(y, eventual(z)));\r\n var m := TemporalDeduceFromEventual(k, z);\r\n TemporalEventually(j, m, z);\r\n }\r\n }\r\n TemporalAlways(i, imply(x, eventual(z)));\r\n}\r\n\r\nlemma TransitivityOfLeadsToGeneral()\r\n ensures forall i:int, x:temporal, y:temporal, z:temporal :: sat(i, leadsto(x, y)) && sat(i, leadsto(y, z)) ==> sat(i, leadsto(x, z))\r\n{\r\n forall i:int, x:temporal, y:temporal, z:temporal | sat(i, leadsto(x, y)) && sat(i, leadsto(y, z))\r\n {\r\n TransitivityOfLeadsTo(i, x, y, z);\r\n }\r\n}\r\n\r\nlemma TransitivityOfLeadsToWithin(i:int, x:temporal, y:temporal, z:temporal, t1:int, t2:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires sat(i, leadstowithin(x, y, t1, timefun))\r\n requires sat(i, leadstowithin(y, z, t2, timefun))\r\n ensures sat(i, leadstowithin(x, z, t1 + t2, timefun))\r\n{\r\n TemporalAssist();\r\n\r\n forall j | TLe(i, j) && sat(j, x)\r\n ensures sat(j, eventuallywithin(z, t1 + t2, timefun))\r\n {\r\n assert sat(j, eventuallywithin(y, t1, timefun));\r\n assert sat(j, eventual(beforeabsolutetime(y, timefun[j] + t1, timefun)));\r\n var k :| TLe(j, k) && sat(k, beforeabsolutetime(y, timefun[j] + t1, timefun));\r\n assert TLe(i, k);\r\n assert sat(k, eventuallywithin(z, t2, timefun));\r\n assert sat(k, eventual(beforeabsolutetime(z, timefun[j] + t1 + t2, timefun)));\r\n var l :| TLe(k, l) && sat(l, beforeabsolutetime(z, timefun[j] + t1 + t2, timefun));\r\n assert TLe(j, l);\r\n assert sat(j, eventuallywithin(z, t1 + t2, timefun));\r\n }\r\n}\r\n\r\nlemma LeadsToDistributesOverOr(i:int, x:temporal, y:temporal, z:temporal)\r\n requires sat(i, leadsto(x, z))\r\n requires sat(i, leadsto(y, z))\r\n ensures sat(i, leadsto(or(x, y), z))\r\n{\r\n TemporalAssist();\r\n}\r\n\r\nlemma Lemma_EventuallyXMeansEventuallyY(i:int, x:temporal, y:temporal)\r\n requires sat(i, eventual(x))\r\n requires sat(i, leadsto(x, y))\r\n ensures sat(i, eventual(y))\r\n{\r\n TemporalAssist();\r\n}\r\n\r\nlemma Lemma_AlwaysEventuallyXAndXLeadsToYMeansAlwaysEventuallyY(i:int, x:temporal, y:temporal)\r\n requires sat(i, always(eventual(x)))\r\n requires sat(i, leadsto(x, y))\r\n ensures sat(i, always(eventual(y)))\r\n{\r\n TemporalAssist();\r\n\r\n forall j | TLe(i, j)\r\n ensures sat(j, eventual(y))\r\n {\r\n Lemma_EventuallyXMeansEventuallyY(j, x, y);\r\n }\r\n}\r\n\r\nlemma Lemma_LeadsToNextWithinImpliesLeadsToOtherNextWithin(\r\n i:int,\r\n x:temporal,\r\n action1:temporal,\r\n action2:temporal,\r\n t:int,\r\n timefun:imap\r\n )\r\n requires imaptotal(timefun)\r\n requires sat(i, leadstonextwithin(x, action1, t, timefun))\r\n requires sat(i, always(imply(action1, action2)))\r\n ensures sat(i, leadstonextwithin(x, action2, t, timefun))\r\n{\r\n TemporalAssist();\r\n forall j | TLe(i, j) && sat(j, x)\r\n ensures sat(j, eventuallynextwithin(action2, t, timefun))\r\n {\r\n var k :| TLe(j, k) && sat(k, nextbefore(action1, timefun[j] + t, timefun));\r\n assert TLe(i, k);\r\n }\r\n}\r\n\r\nlemma Lemma_LeadsToNextWithinNextImpliesLeadsToOtherNextWithinNext(\r\n i:int,\r\n x:temporal,\r\n action1:temporal,\r\n action2:temporal,\r\n t:int,\r\n timefun:imap\r\n )\r\n requires imaptotal(timefun)\r\n requires sat(i, leadstonextwithinnext(x, action1, t, timefun))\r\n requires sat(i, always(imply(action1, action2)))\r\n ensures sat(i, leadstonextwithinnext(x, action2, t, timefun))\r\n{\r\n TemporalAssist();\r\n forall j | TLe(i, j) && sat(j, x)\r\n ensures sat(j, next(eventuallynextwithin(action2, t, timefun)));\r\n {\r\n var k :| TLe(nextstep(j), k) && sat(k, nextbefore(action1, timefun[nextstep(j)] + t, timefun));\r\n assert TLe(i, k);\r\n }\r\n}\r\n\r\nlemma Lemma_LeadsToTwoWays(i:int, x:temporal, y:temporal, z:temporal)\r\n requires sat(i, leadsto(x, or(y, z)))\r\n requires sat(i, leadsto(y, z))\r\n ensures sat(i, leadsto(x, z))\r\n{\r\n TemporalAssist();\r\n TransitivityOfLeadsTo(i, x, or(y, z), z);\r\n}\r\n\r\nlemma Lemma_LeadsToWithinPossiblyImmediate(i:int, x:temporal, y:temporal, t:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires sat(i, leadstowithin(x, y, t, timefun))\r\n requires t >= 0\r\n ensures sat(i, leadstowithin(or(x, y), y, t, timefun))\r\n{\r\n TemporalAssist();\r\n forall j | TLe(i, j)\r\n ensures sat(j, imply(or(x, y), eventuallywithin(y, t, timefun)))\r\n {\r\n if sat(j, y)\r\n {\r\n TemporalEventually(j, j, beforeabsolutetime(y, timefun[j] + t, timefun));\r\n }\r\n }\r\n}\r\n\r\nlemma Lemma_LeadsToWithinImpliesLeadsToConsequenceWithin(i:int, x:temporal, y:temporal, z:temporal, t:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires sat(i, leadstowithin(x, y, t, timefun))\r\n requires sat(i, always(imply(y, z)))\r\n ensures sat(i, leadstowithin(x, z, t, timefun))\r\n{\r\n TemporalAssist();\r\n forall j | TLe(i, j) && sat(j, x)\r\n ensures sat(j, eventuallywithin(z, t, timefun))\r\n {\r\n var k :| TLe(j, k) && sat(k, beforeabsolutetime(y, timefun[j] + t, timefun));\r\n assert TLe(i, k);\r\n }\r\n}\r\n\r\nlemma Lemma_LeadsToWithinTwoWays(i:int, x:temporal, y:temporal, z:temporal, t1:int, t2:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires sat(i, leadstowithin(x, or(y, z), t1, timefun))\r\n requires sat(i, leadstowithin(y, z, t2, timefun))\r\n requires t2 >= 0\r\n ensures sat(i, leadstowithin(x, z, t1+t2, timefun))\r\n{\r\n Lemma_LeadsToWithinPossiblyImmediate(i, y, z, t2, timefun);\r\n TransitivityOfLeadsToWithin(i, x, or(y, z), z, t1, t2, timefun);\r\n}\r\n\r\nlemma Lemma_LeadsToTwoPossibilitiesWithin(i:int, w:temporal, x:temporal, y:temporal, z:temporal, t1:int, t2:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires sat(i, leadstowithin(w, or(x, z), t1, timefun))\r\n requires sat(i, leadstowithin(x, or(y, z), t2, timefun))\r\n requires t2 >= 0\r\n ensures sat(i, leadstowithin(w, or(y, z), t1+t2, timefun))\r\n{\r\n forall j | i <= j\r\n ensures sat(j, imply(or(x, z), or(x, or(y, z))));\r\n {\r\n }\r\n TemporalAlways(i, imply(or(x, z), or(x, or(y, z))));\r\n Lemma_LeadsToWithinImpliesLeadsToConsequenceWithin(i, w, or(x, z), or(x, or(y, z)), t1, timefun);\r\n Lemma_LeadsToWithinPossiblyImmediate(i, x, or(y, z), t2, timefun);\r\n TransitivityOfLeadsToWithin(i, w, or(x, or(y, z)), or(y, z), t1, t2, timefun);\r\n}\r\n\r\nlemma Lemma_LeadsToTwoPossibilitiesWithinWithFirstStepAnAction(i:int, w:temporal, x:temporal, y:temporal, z:temporal, t1:int,\r\n t2:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires sat(i, always(imply(w, or(eventuallynextwithin(x, t1, timefun), eventuallywithin(z, t1, timefun)))))\r\n requires sat(i, always(imply(x, next(eventuallywithin(or(y, z), t2, timefun)))))\r\n requires t2 >= 0\r\n ensures sat(i, leadstowithin(w, or(y, z), t1 + t2, timefun))\r\n{\r\n TemporalAssist();\r\n \r\n forall j | TLe(i, j)\r\n ensures sat(j, imply(w, eventuallywithin(or(y, z), t1 + t2, timefun)))\r\n {\r\n if sat(j, w)\r\n {\r\n TemporalDeduceFromAlways(i, j, imply(w, or(eventuallynextwithin(x, t1, timefun), eventuallywithin(z, t1, timefun))));\r\n assert sat(j, imply(w, or(eventuallynextwithin(x, t1, timefun), eventuallywithin(z, t1, timefun))));\r\n if sat(j, eventuallynextwithin(x, t1, timefun))\r\n {\r\n var k :| TLe(j, k) && sat(k, nextbefore(x, timefun[j] + t1, timefun));\r\n TemporalDeduceFromAlways(i, k, imply(x, next(eventuallywithin(or(y, z), t2, timefun))));\r\n assert sat(nextstep(k), eventuallywithin(or(y, z), t2, timefun));\r\n var m :| TLe(nextstep(k), m) && sat(m, beforeabsolutetime(or(y, z), timefun[k+1] + t2, timefun));\r\n assert TLe(j, m);\r\n assert sat(j, eventuallywithin(or(y, z), t1 + t2, timefun));\r\n }\r\n else\r\n {\r\n assert sat(j, eventuallywithin(z, t1, timefun));\r\n assert sat(j, eventuallywithin(or(y, z), t1, timefun));\r\n assert sat(j, eventuallywithin(or(y, z), t1 + t2, timefun));\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma Lemma_LeadsToWithinLeadsToTransition(i:int, x:temporal, y:temporal, t:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires sat(i, leadstowithin(x, y, t, timefun))\r\n requires sat(i, always(imply(x, not(y))))\r\n requires monotonic_from(i, timefun)\r\n ensures sat(i, leadstonextwithin(x, and(not(y), next(y)), t, timefun))\r\n{\r\n TemporalAssist();\r\n\r\n forall j | i <= j\r\n ensures sat(j, imply(x, eventuallynextwithin(and(not(y), next(y)), t, timefun)))\r\n {\r\n if sat(j, x)\r\n {\r\n TemporalDeduceFromAlways(i, j, imply(x, eventuallywithin(y, t, timefun)));\r\n var k := TemporalDeduceFromEventual(j, beforeabsolutetime(y, timefun[j] + t, timefun));\r\n var m := earliestStep(j, y);\r\n TemporalDeduceFromAlways(i, j, imply(x, not(y)));\r\n assert j != m;\r\n var prev := m-1;\r\n assert j <= prev < m;\r\n assert !sat(prev, y);\r\n assert sat(prev, and(not(y), next(y)));\r\n TemporalEventually(j, prev, nextbefore(and(not(y), next(y)), timefun[j] + t, timefun));\r\n }\r\n }\r\n}\r\n\r\nlemma Lemma_LeadsToWithinOrSomethingLeadsToTransitionOrSomething(i:int, x:temporal, y:temporal, z:temporal, t:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires sat(i, leadstowithin(x, or(y, z), t, timefun))\r\n requires sat(i, always(imply(x, not(y))))\r\n requires monotonic_from(i, timefun)\r\n ensures sat(i, always(imply(x, or(eventuallynextwithin(and(not(y), next(y)), t, timefun), eventuallywithin(z, t, timefun)))))\r\n{\r\n TemporalAssist();\r\n\r\n forall j | i <= j\r\n ensures sat(j, imply(x, or(eventuallynextwithin(and(not(y), next(y)), t, timefun), eventuallywithin(z, t, timefun))))\r\n {\r\n if sat(j, x)\r\n {\r\n TemporalDeduceFromAlways(i, j, imply(x, eventuallywithin(or(y, z), t, timefun)));\r\n var k :| j <= k && sat(k, beforeabsolutetime(or(y, z), timefun[j] + t, timefun));\r\n if sat(k, z)\r\n {\r\n assert sat(k, beforeabsolutetime(z, timefun[j] + t, timefun));\r\n assert sat(j, eventuallywithin(z, t, timefun));\r\n }\r\n else\r\n {\r\n var m := earliestStep(j, y);\r\n var prev := m-1;\r\n TemporalDeduceFromAlways(i, j, imply(x, not(y)));\r\n assert !sat(prev, y);\r\n assert sat(prev, and(not(y), next(y)));\r\n TemporalEventually(j, prev, nextbefore(and(not(y), next(y)), timefun[j] + t, timefun));\r\n assert sat(j, eventuallynextwithin(and(not(y), next(y)), t, timefun));\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma TemporalDeduceFromLeadsToWithin(i:int, j:int, x:temporal, y:temporal, t:int, timefun:imap) returns (step:int)\r\n requires imaptotal(timefun)\r\n requires sat(i, leadstowithin(x, y, t, timefun))\r\n requires i <= j\r\n requires sat(j, x)\r\n ensures j <= step\r\n ensures timefun[step] <= timefun[j] + t\r\n ensures sat(step, y)\r\n{\r\n TemporalDeduceFromAlways(i, j, imply(x, eventuallywithin(y, t, timefun)));\r\n step := TemporalDeduceFromEventuallyWithin(j, y, t, timefun);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Logic/Temporal/Monotonicity.i.dfy", "content": "include \"Heuristics.i.dfy\"\r\n\r\nmodule Temporal__Monotonicity_i {\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Maps2_i\r\n\r\n//////////////////\r\n// DEFINITIONS\r\n//////////////////\r\n\r\nfunction{:opaque} stepDecrease(start:int, d:imap):temporal\r\n requires imaptotal(d)\r\n ensures forall i {:trigger sat(i, stepDecrease(start, d))} :: sat(i, stepDecrease(start, d)) <==> d[i] < d[start]\r\n{\r\n TemporalAssist();\r\n stepmap(imap i :: d[i] < d[start])\r\n}\r\n\r\nfunction nextDecrease(start:int, d:imap):temporal\r\n requires imaptotal(d)\r\n{\r\n next(stepDecrease(start, d))\r\n}\r\n\r\nfunction{:opaque} nextOrDecrease(goal:temporal, d:imap):temporal\r\n requires imaptotal(d)\r\n ensures forall i {:trigger sat(i, nextOrDecrease(goal, d))} :: sat(i, nextOrDecrease(goal, d)) <==>\r\n sat(i, eventual(or(goal, nextDecrease(i, d))))\r\n{\r\n TemporalAssist();\r\n stepmap(imap i :: sat(i, eventual(or(goal, nextDecrease(i, d)))))\r\n}\r\n\r\n//////////////////\r\n// LEMMAS\r\n//////////////////\r\n\r\n// If d decreases unless A, then <>A.\r\nlemma TemporalInductionOfEventuallyFromDecreasingFunction(i:int, x:temporal, d:imap)\r\n requires imaptotal(d)\r\n requires forall j {:trigger sat(j, x)} :: i <= j ==> sat(j, x) || d[nextstep(j)] < d[j]\r\n requires forall j :: d[j] >= 0\r\n ensures sat(i, eventual(x))\r\n decreases d[i]\r\n{\r\n TemporalAssist();\r\n if (!sat(i, x))\r\n {\r\n TemporalInductionOfEventuallyFromDecreasingFunction(i + 1, x, d);\r\n }\r\n}\r\n\r\nlemma Lemma_MonotonicStepsLeadToMonotonicBehaviorPartial(i:int, f:imap, j:int, k:int)\r\n requires imaptotal(f)\r\n requires sat(i, always(stepmap(imap u :: f[u] <= f[nextstep(u)])))\r\n requires i <= j <= k\r\n ensures f[j] <= f[k]\r\n decreases k - j\r\n{\r\n TemporalAssist();\r\n if (k > j)\r\n {\r\n Lemma_MonotonicStepsLeadToMonotonicBehaviorPartial(i, f, j, k-1);\r\n assert TLe(i, k-1);\r\n assert sat(k-1, stepmap(imap a :: f[a] <= f[nextstep(a)]));\r\n }\r\n}\r\n\r\n// If f monotonically increases at each step, then it monotonically increases\r\n// across any pair of steps\r\nlemma Lemma_MonotonicStepsLeadToMonotonicBehavior(i:int, f:imap)\r\n requires imaptotal(f)\r\n requires sat(i, always(stepmap(imap j :: f[j] <= f[nextstep(j)])))\r\n ensures forall j, k :: i <= j <= k ==> f[j] <= f[k]\r\n{\r\n forall j, k | i <= j <= k\r\n ensures f[j] <= f[k]\r\n {\r\n Lemma_MonotonicStepsLeadToMonotonicBehaviorPartial(i, f, j, k);\r\n }\r\n}\r\n\r\nlemma Lemma_EventuallyNextHelper(start:int, start':int, d:imap, goal:temporal)\r\n requires imaptotal(d)\r\n requires TLe(start, start')\r\n requires forall i :: start <= i ==> 0 <= d[i]\r\n requires sat(start, always(nextOrDecrease(goal, d)))\r\n ensures sat(start', eventual(goal))\r\n decreases d[start']\r\n{\r\n TemporalAssist();\r\n assert sat(start', nextOrDecrease(goal, d));\r\n var n1 {:trigger TLe(start', n1)} :| TLe(start', n1) && sat(n1, or(goal, nextDecrease(start', d)));\r\n if (!sat(n1, goal))\r\n {\r\n Lemma_EventuallyNextHelper(start, n1 + 1, d, goal);\r\n }\r\n}\r\n\r\n// If []t :: <>(goal || d' < d[t]')\r\n// and [](0 <= d)\r\n// then []<>(goal)\r\nlemma Lemma_EventuallyNext(start:int, d:imap, goal:temporal)\r\n requires imaptotal(d)\r\n requires forall i :: start <= i ==> 0 <= d[i]\r\n requires sat(start, always(nextOrDecrease(goal, d)))\r\n ensures sat(start, always(eventual(goal)))\r\n{\r\n TemporalAssist();\r\n forall start' | TLe(start, start')\r\n ensures sat(start', eventual(goal))\r\n {\r\n Lemma_EventuallyNextHelper(start, start', d, goal);\r\n }\r\n}\r\n\r\nlemma Lemma_MonotonicFromImpliesMonotonicFromLater(start1:int, start2:int, f:imap)\r\n requires imaptotal(f)\r\n requires monotonic_from(start1, f)\r\n requires start1 <= start2\r\n ensures monotonic_from(start2, f)\r\n{\r\n forall i1, i2 | start2 <= i1 <= i2\r\n ensures f[i1] <= f[i2]\r\n {\r\n assert start1 <= i1 <= i2;\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Logic/Temporal/Rules.i.dfy", "content": "include \"Heuristics.i.dfy\"\r\n\r\nmodule Temporal__Rules_i {\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Collections__Maps2_i\r\n\r\n///////////////////\r\n// DEFINITIONS\r\n///////////////////\r\n \r\nfunction{:opaque} eventualStep(start:int, x:temporal):(step:int)\r\n requires sat(start, eventual(x))\r\n ensures sat(step, x)\r\n ensures TLe(start, step)\r\n{\r\n TemporalAssist();\r\n var end :| TLe(start, end) && sat(end, x);\r\n end\r\n}\r\n\r\nfunction{:opaque} earliestStepBetween(start:int, end:int, x:temporal):(pos:int)\r\n requires sat(end, x)\r\n requires TLe(start, end)\r\n ensures sat(pos, x)\r\n ensures TLe(start, pos)\r\n ensures TLe(pos, end)\r\n ensures forall i :: start <= i < pos ==> !sat(i, x)\r\n decreases end - start\r\n{\r\n if (sat(start, x)) then start\r\n else earliestStepBetween(start + 1, end, x)\r\n}\r\n\r\nfunction{:opaque} earliestStep(start:int, x:temporal):(step:int)\r\n requires sat(start, eventual(x))\r\n ensures sat(step, x)\r\n ensures TLe(start, step)\r\n ensures forall i :: start <= i < step ==> !sat(i, x)\r\n{\r\n earliestStepBetween(start, eventualStep(start, x), x)\r\n}\r\n\r\n///////////////////\r\n// LEMMAS\r\n///////////////////\r\n\r\n// []A ==> A\r\n// <>A <== A\r\nlemma TemporalNow(i:int, x:temporal)\r\n ensures sat(i, always(x)) ==> sat(i, x)\r\n ensures sat(i, eventual(x)) <== sat(i, x)\r\n{\r\n TemporalAssist();\r\n}\r\n \r\n// [][]A = []A\r\n// <><>A = <>A\r\nlemma TemporalIdempotent(i:int, x:temporal)\r\n ensures sat(i, always(always(x))) == sat(i, always(x))\r\n ensures sat(i, eventual(eventual(x))) == sat(i, eventual(x))\r\n{\r\n TemporalAssist();\r\n reveal always();\r\n reveal eventual();\r\n}\r\n \r\n// <>[]A ==> []<>A\r\nlemma TemporalEventuallyAlwaysImpliesAlwaysEventually(i:int, x:temporal)\r\n ensures sat(i, eventual(always(x))) ==> sat(i, always(eventual(x)))\r\n{\r\n TemporalBlast();\r\n}\r\n \r\n// <>!A = ![]A\r\n// []!A = !<>A\r\nlemma TemporalNot(i:int, x:temporal)\r\n ensures sat(i, eventual(not(x))) <==> !sat(i, always(x))\r\n ensures sat(i, always(not(x))) <==> !sat(i, eventual(x))\r\n{\r\n TemporalAssist();\r\n reveal eventual();\r\n reveal always();\r\n}\r\n \r\n// [](A&&B) = []A && []B\r\n// <>(A&&B) ==> <>A && <>B\r\n// <>(A&&B) <== []A && <>B\r\n// <>(A&&B) <== <>A && []B\r\nlemma TemporalAnd(i:int, x:temporal, y:temporal)\r\n ensures sat(i, always(and(x, y))) <==> sat(i, always(x)) && sat(i, always(y))\r\n ensures sat(i, eventual(and(x, y))) ==> sat(i, eventual(x)) && sat(i, eventual(y))\r\n ensures sat(i, eventual(and(x, y))) <== sat(i, always(x)) && sat(i, eventual(y))\r\n ensures sat(i, eventual(and(x, y))) <== sat(i, eventual(x)) && sat(i, always(y))\r\n{\r\n TemporalAssist();\r\n reveal eventual();\r\n reveal always();\r\n}\r\n \r\n// [](A||B) <== []A || []B\r\n// [](A||B) ==> []A || <>B\r\n// [](A||B) ==> <>A || []B\r\n// <>(A||B) = <>A || <>B\r\nlemma TemporalOr(i:int, x:temporal, y:temporal)\r\n ensures sat(i, always(or(x, y))) <== sat(i, always(x)) || sat(i, always(y))\r\n ensures sat(i, always(or(x, y))) ==> sat(i, always(x)) || sat(i, eventual(y))\r\n ensures sat(i, always(or(x, y))) ==> sat(i, eventual(x)) || sat(i, always(y))\r\n ensures sat(i, eventual(or(x, y))) <==> sat(i, eventual(x)) || sat(i, eventual(y))\r\n{\r\n TemporalAssist();\r\n reveal eventual();\r\n reveal always();\r\n}\r\n \r\n// [](A==>B) ==> ([]A ==> []B)\r\n// [](A==>B) ==> (<>A ==> <>B)\r\n// [](A==>B) <== (<>A ==> []B)\r\n// <>(A==>B) = ([]A ==> <>B)\r\nlemma TemporalImply(i:int, x:temporal, y:temporal)\r\n ensures sat(i, always(imply(x, y))) ==> (sat(i, always(x)) ==> sat(i, always(y)))\r\n ensures sat(i, always(imply(x, y))) ==> (sat(i, eventual(x)) ==> sat(i, eventual(y)))\r\n ensures sat(i, always(imply(x, y))) <== (sat(i, eventual(x)) ==> sat(i, always(y)))\r\n ensures sat(i, eventual(imply(x, y))) <==> (sat(i, always(x)) ==> sat(i, eventual(y)))\r\n{\r\n TemporalAssist();\r\n reveal eventual();\r\n reveal always();\r\n}\r\n \r\nlemma TemporalAlways(i:int, x:temporal)\r\n requires forall j :: i <= j ==> sat(j, x)\r\n ensures sat(i, always(x))\r\n{\r\n TemporalAssist();\r\n assert forall j :: TLe(i, j) ==> sat(j, x);\r\n}\r\n\r\nlemma TemporalEventually(i1:int, i2:int, x:temporal)\r\n requires i1 <= i2\r\n requires sat(i2, x)\r\n ensures sat(i1, eventual(x))\r\n{\r\n TemporalAssist();\r\n}\r\n \r\nlemma ValidAlways(i:int, x:temporal)\r\n requires (forall j:int :: sat(j, x))\r\n ensures sat(i, always(x))\r\n{\r\n TemporalAssist();\r\n}\r\n \r\nlemma ValidImply(i:int, x:temporal, y:temporal)\r\n requires forall j:int :: sat(j, x) ==> sat(j, y)\r\n ensures sat(i, always(x)) ==> sat(i, always(y))\r\n ensures sat(i, eventual(x)) ==> sat(i, eventual(y))\r\n{\r\n TemporalAssist();\r\n}\r\n \r\nlemma ValidEquiv(i:int, x:temporal, y:temporal)\r\n requires forall j:int :: sat(j, x) <==> sat(j, y)\r\n ensures sat(i, always(x)) <==> sat(i, always(y))\r\n ensures sat(i, eventual(x)) <==> sat(i, eventual(y))\r\n{\r\n TemporalAssist();\r\n reveal eventual();\r\n reveal always();\r\n}\r\n\r\nlemma TemporalDeduceFromAlways(i:int, j:int, x:temporal)\r\n requires i <= j\r\n requires sat(i, always(x))\r\n ensures sat(j, x)\r\n{\r\n TemporalAssist();\r\n assert TLe(i, j);\r\n}\r\n\r\nlemma TemporalDeduceFromEventual(i:int, x:temporal) returns (j:int)\r\n requires sat(i, eventual(x))\r\n ensures i <= j\r\n ensures sat(j, x)\r\n{\r\n TemporalAssist();\r\n j :| TLe(i, j) && sat(j, x);\r\n}\r\n \r\nlemma Lemma_EventuallyAlwaysImpliesLaterEventuallyAlways(\r\n i:int,\r\n j:int,\r\n x:temporal\r\n )\r\n requires i <= j\r\n requires sat(i, eventual(always(x)))\r\n ensures sat(j, eventual(always(x)))\r\n{\r\n TemporalAssist();\r\n var k :| TLe(i, k) && sat(k, always(x));\r\n var l := if k > j then k else j;\r\n assert TLe(k, l) && TLe(j, l);\r\n}\r\n\r\nlemma Lemma_AlwaysImpliesLaterAlways(\r\n i:int,\r\n j:int,\r\n x:temporal\r\n )\r\n requires i <= j\r\n ensures sat(i, always(x)) ==> sat(j, always(x))\r\n{\r\n TemporalAssist();\r\n assert TLe(i, j);\r\n}\r\n\r\nlemma Lemma_EventuallyNowButNotNextMeansNow(x:temporal, i:int)\r\n ensures sat(i, eventual(x)) && !sat(i+1, eventual(x)) ==> sat(i, x)\r\n{\r\n TemporalAssist();\r\n}\r\n\r\nlemma Lemma_EventuallyImpliesEarlierEventually(\r\n i:int,\r\n j:int,\r\n x:temporal\r\n )\r\n requires i <= j\r\n ensures sat(j, eventual(x)) ==> sat(i, eventual(x))\r\n{\r\n TemporalAssist();\r\n assert TLe(i, j);\r\n}\r\n\r\nlemma TemporalAlwaysEventualImpliesAlwaysEventualWithDifferentStartPoint(i:int, j:int, x:temporal)\r\n ensures sat(i, always(eventual(x))) ==> sat(j, always(eventual(x)))\r\n{\r\n TemporalAssist();\r\n \r\n if sat(i, always(eventual(x))) && i > j\r\n {\r\n assert sat(i, eventual(x));\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Logic/Temporal/Sets.i.dfy", "content": "include \"Heuristics.i.dfy\"\r\ninclude \"Rules.i.dfy\"\r\ninclude \"Time.s.dfy\"\r\ninclude \"LeadsTo.i.dfy\"\r\ninclude \"../../Collections/Sets.i.dfy\"\r\n\r\nmodule Temporal__Sets_i {\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__LeadsTo_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Maps2_i\r\nimport opened Collections__Sets_i\r\n\r\n/////////////////////////\r\n// DEFINITIONS\r\n/////////////////////////\r\n\r\nfunction{:opaque} andset(xs:set):temporal\r\n ensures forall i{:trigger sat(i, andset(xs))} :: sat(i, andset(xs)) <==> (forall x :: x in xs ==> sat(i, x))\r\n{\r\n stepmap(imap i{:trigger sat(i, andset(xs))} :: (forall x :: x in xs ==> sat(i, x)))\r\n}\r\n\r\nfunction{:opaque} orset(xs:set):temporal\r\n ensures forall i{:trigger sat(i, orset(xs))} :: sat(i, orset(xs)) <==> (exists x :: x in xs && sat(i, x))\r\n{\r\n stepmap(imap i{:trigger sat(i, orset(xs))} :: (exists x :: x in xs && sat(i, x)))\r\n}\r\n\r\n/////////////////////////\r\n// LEMMAS\r\n/////////////////////////\r\n\r\nlemma Lemma_EventuallyAlwaysEachImpliesEventuallyAlwaysAll(\r\n i:int,\r\n xs:set\r\n )\r\n requires forall x :: x in xs ==> sat(i, eventual(always(x)))\r\n ensures sat(i, eventual(always(andset(xs))))\r\n decreases |xs|\r\n{\r\n TemporalAssist();\r\n\r\n if |xs| == 0\r\n {\r\n assert sat(i, always(andset(xs)));\r\n }\r\n else\r\n {\r\n var x :| x in xs;\r\n var xs' := xs - {x};\r\n Lemma_EventuallyAlwaysEachImpliesEventuallyAlwaysAll(i, xs');\r\n var j := eventualStep(i, always(andset(xs')));\r\n var k := eventualStep(i, always(x));\r\n var m := if j > k then j else k;\r\n Lemma_AlwaysImpliesLaterAlways(j, m, andset(xs'));\r\n Lemma_AlwaysImpliesLaterAlways(k, m, x);\r\n reveal andset();\r\n assert sat(m, always(andset(xs)));\r\n }\r\n}\r\n\r\nlemma Lemma_EventuallyAlwaysWithinEachImpliesEventuallyAlwaysWithinAll(\r\n i:int,\r\n xs:set,\r\n span:int,\r\n timefun:imap\r\n )\r\n requires imaptotal(timefun)\r\n requires span >= 0 || |xs| > 0\r\n requires forall x :: x in xs ==> sat(i, eventuallywithin(always(x), span, timefun))\r\n ensures sat(i, eventuallywithin(always(andset(xs)), span, timefun))\r\n decreases |xs|\r\n{\r\n TemporalAssist();\r\n \r\n if |xs| == 0\r\n {\r\n assert sat(i, always(andset(xs)));\r\n assert sat(i, beforeabsolutetime(always(andset(xs)), timefun[i] + span, timefun));\r\n }\r\n else\r\n {\r\n var x :| x in xs;\r\n if |xs| == 1\r\n {\r\n var j := eventualStep(i, beforeabsolutetime(always(x), timefun[i] + span, timefun));\r\n assert sat(j, beforeabsolutetime(always(x), timefun[i] + span, timefun));\r\n forall k | TLe(j, k)\r\n ensures sat(k, imply(x, andset(xs)))\r\n {\r\n forall x' | x' in xs\r\n ensures x' == x\r\n {\r\n ThingsIKnowAboutASingletonSet(xs, x, x');\r\n }\r\n reveal andset();\r\n }\r\n assert sat(j, beforeabsolutetime(always(andset(xs)), timefun[i] + span, timefun));\r\n }\r\n else\r\n {\r\n var xs' := xs - {x};\r\n Lemma_EventuallyAlwaysWithinEachImpliesEventuallyAlwaysWithinAll(i, xs', span, timefun);\r\n var j := eventualStep(i, beforeabsolutetime(always(andset(xs')), timefun[i] + span, timefun));\r\n var k := eventualStep(i, beforeabsolutetime(always(x), timefun[i] + span, timefun));\r\n var m := if j > k then j else k;\r\n Lemma_AlwaysImpliesLaterAlways(j, m, andset(xs'));\r\n Lemma_AlwaysImpliesLaterAlways(k, m, x);\r\n forall ensures sat(m, always(imply(and(andset(xs'), x), andset(xs))))\r\n {\r\n assert forall x' :: x' in xs ==> x' in xs' || x' in {x};\r\n reveal andset();\r\n }\r\n assert sat(m, always(andset(xs)));\r\n }\r\n }\r\n}\r\n\r\nlemma Lemma_LeadsToAlwaysEachWithinImpliesLeadsToAlwaysAllWithin(\r\n i:int,\r\n x:temporal,\r\n ys:set,\r\n span:int,\r\n timefun:imap\r\n )\r\n requires imaptotal(timefun)\r\n requires span >= 0 || |ys| > 0\r\n requires forall y :: y in ys ==> sat(i, leadstowithin(x, always(y), span, timefun))\r\n ensures sat(i, leadstowithin(x, always(andset(ys)), span, timefun))\r\n{\r\n TemporalAssist();\r\n\r\n forall j | TLe(i, j)\r\n ensures sat(j, imply(x, eventuallywithin(always(andset(ys)), span, timefun)))\r\n {\r\n if sat(j, x)\r\n {\r\n Lemma_EventuallyAlwaysWithinEachImpliesEventuallyAlwaysWithinAll(j, ys, span, timefun);\r\n }\r\n }\r\n}\r\n\r\nlemma Lemma_EventuallyAlwaysWithinEachOrAlternativeImpliesEventuallyAlwaysWithinAllOrAlternative(\r\n i:int,\r\n xs:set,\r\n y:temporal,\r\n span:int,\r\n timefun:imap\r\n )\r\n requires imaptotal(timefun)\r\n requires span >= 0 || |xs| > 0\r\n requires forall x :: x in xs ==> sat(i, eventuallywithin(or(always(x), y), span, timefun))\r\n ensures sat(i, eventuallywithin(or(always(andset(xs)), y), span, timefun))\r\n decreases |xs|\r\n{\r\n TemporalAssist();\r\n\r\n if |xs| == 0\r\n {\r\n assert sat(i, or(always(andset(xs)), y));\r\n assert sat(i, beforeabsolutetime(or(always(andset(xs)), y), timefun[i] + span, timefun));\r\n }\r\n else\r\n {\r\n var x :| x in xs;\r\n if |xs| == 1\r\n {\r\n var j := eventualStep(i, beforeabsolutetime(or(always(x), y), timefun[i] + span, timefun));\r\n forall k | TLe(j, k)\r\n ensures sat(k, imply(x, andset(xs)))\r\n {\r\n forall x' | x' in xs\r\n ensures x' == x\r\n {\r\n ThingsIKnowAboutASingletonSet(xs, x, x');\r\n }\r\n reveal andset();\r\n }\r\n assert sat(j, beforeabsolutetime(or(always(andset(xs)), y), timefun[i] + span, timefun));\r\n }\r\n else\r\n {\r\n var xs' := xs - {x};\r\n Lemma_EventuallyAlwaysWithinEachOrAlternativeImpliesEventuallyAlwaysWithinAllOrAlternative(i, xs', y, span, timefun);\r\n var j := eventualStep(i, beforeabsolutetime(or(always(andset(xs')), y), timefun[i] + span, timefun));\r\n var k := eventualStep(i, beforeabsolutetime(or(always(x), y), timefun[i] + span, timefun));\r\n if sat(j, y)\r\n {\r\n assert sat(j, or(always(andset(xs)), y));\r\n }\r\n else if sat(k, y)\r\n {\r\n assert sat(k, or(always(andset(xs)), y));\r\n }\r\n else\r\n {\r\n var m := if j > k then j else k;\r\n Lemma_AlwaysImpliesLaterAlways(j, m, andset(xs'));\r\n Lemma_AlwaysImpliesLaterAlways(k, m, x);\r\n forall ensures sat(m, always(imply(and(andset(xs'), x), andset(xs))))\r\n {\r\n assert forall x' :: x' in xs ==> x' in xs' || x' in {x};\r\n reveal andset();\r\n }\r\n assert sat(m, or(always(andset(xs)), y));\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma Lemma_LeadsToAlwaysEachOrAlternativeWithinImpliesLeadsToAlwaysAllOrAlternativeWithin(\r\n i:int,\r\n x:temporal,\r\n ys:set,\r\n z:temporal,\r\n span:int,\r\n timefun:imap\r\n )\r\n requires imaptotal(timefun)\r\n requires span >= 0 || |ys| > 0\r\n requires forall y :: y in ys ==> sat(i, leadstowithin(x, or(always(y), z), span, timefun))\r\n ensures sat(i, leadstowithin(x, or(always(andset(ys)), z), span, timefun))\r\n{\r\n TemporalAssist();\r\n\r\n forall j | TLe(i, j)\r\n ensures sat(j, imply(x, eventuallywithin(or(always(andset(ys)), z), span, timefun)))\r\n {\r\n if sat(j, x)\r\n {\r\n Lemma_EventuallyAlwaysWithinEachOrAlternativeImpliesEventuallyAlwaysWithinAllOrAlternative(j, ys, z, span, timefun);\r\n }\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Logic/Temporal/Temporal.s.dfy", "content": "include \"../../Collections/Maps2.s.dfy\"\r\n\r\nmodule Temporal__Temporal_s {\r\nimport opened Collections__Maps2_s\r\n\r\n// TODO_MODULE: module Logic__Temporal_s {\r\n// TODO_MODULE: import opened Collections__Maps2_s\r\n\r\n//// TODO_MODULE: module TemporalLogic\r\n//{\r\n\r\ntype temporal = imap\r\ntype Behavior = imap\r\n \r\nfunction stepmap(f:imap):temporal\r\n ensures forall i:int :: i in f ==> sat(i, stepmap(f)) == f[i]\r\n{\r\n f\r\n}\r\n\r\npredicate sat(s:int, t:temporal)\r\n{\r\n s in t && t[s]\r\n}\r\n\r\nfunction{:opaque} and(x:temporal, y:temporal):temporal\r\n ensures forall i:int {:trigger sat(i, and(x, y))} :: sat(i, and(x, y)) == (sat(i, x) && sat(i, y))\r\n{\r\n stepmap(imap i :: sat(i, x) && sat(i, y))\r\n}\r\n\r\nfunction{:opaque} or(x:temporal, y:temporal):temporal\r\n ensures forall i:int {:trigger sat(i, or(x, y))} :: sat(i, or(x, y)) == (sat(i, x) || sat(i, y))\r\n{\r\n stepmap(imap i :: sat(i, x) || sat(i, y))\r\n}\r\n\r\nfunction{:opaque} imply(x:temporal, y:temporal):temporal\r\n ensures forall i:int {:trigger sat(i, imply(x, y))} :: sat(i, imply(x, y)) == (sat(i, x) ==> sat(i, y))\r\n{\r\n stepmap(imap i :: sat(i, x) ==> sat(i, y))\r\n}\r\n\r\nfunction{:opaque} equiv(x:temporal, y:temporal):temporal\r\n ensures forall i:int {:trigger sat(i, equiv(x, y))} :: sat(i, equiv(x, y)) == (sat(i, x) <==> sat(i, y))\r\n{\r\n stepmap(imap i :: sat(i, x) <==> sat(i, y))\r\n}\r\n\r\nfunction{:opaque} not(x:temporal):temporal\r\n ensures forall i:int {:trigger sat(i, not(x))} :: sat(i, not(x)) == !sat(i, x)\r\n{\r\n stepmap(imap i :: !sat(i, x))\r\n}\r\n\r\nfunction nextstep(i:int):int\r\n{\r\n i+1\r\n}\r\n\r\nfunction{:opaque} next(x:temporal):temporal\r\n ensures forall i:int {:trigger sat(i, next(x))} :: sat(i, next(x)) == sat(nextstep(i), x)\r\n{\r\n stepmap(imap i :: sat(nextstep(i), x))\r\n}\r\n\r\nfunction{:opaque} always(x:temporal):temporal\r\n{\r\n stepmap(imap i {:trigger sat(i, always(x))} :: forall j {:trigger sat(j, x)} :: i <= j ==> sat(j, x))\r\n}\r\n\r\nfunction{:opaque} eventual(x:temporal):temporal\r\n{\r\n stepmap(imap i {:trigger sat(i, eventual(x))} :: exists j :: i <= j && sat(j, x))\r\n}\r\n\r\n//}\r\n\r\n// TODO_MODULE: } import opened Logic__Temporal_s_ = Logic__Temporal_s\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Logic/Temporal/Time.i.dfy", "content": "include \"Time.s.dfy\"\r\ninclude \"Heuristics.i.dfy\"\r\ninclude \"Rules.i.dfy\"\r\ninclude \"Monotonicity.i.dfy\"\r\ninclude \"../../../../Libraries/Math/mul.i.dfy\"\r\n\r\nmodule Temporal__Time_i {\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Monotonicity_i\r\nimport opened Math__mul_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Maps2_i\r\nimport opened Math__mul_auto_i\r\n\r\n/////////////////////////\r\n// DEFINITIONS\r\n/////////////////////////\r\n\r\nfunction{:opaque} earliestStepWithin(start:int, x:temporal, span:int, timefun:imap):int\r\n requires imaptotal(timefun)\r\n requires monotonic_from(start, timefun)\r\n requires sat(start, eventuallywithin(x, span, timefun))\r\n ensures sat(earliestStepWithin(start, x, span, timefun), beforeabsolutetime(x, timefun[start] + span, timefun))\r\n ensures start <= earliestStepWithin(start, x, span, timefun)\r\n ensures forall i :: start <= i < earliestStepWithin(start, x, span, timefun) ==> !sat(i, x)\r\n{\r\n TemporalAssist();\r\n var i1 := earliestStep(start, x);\r\n var i2 := earliestStep(start, beforeabsolutetime(x, timefun[start] + span, timefun));\r\n assert TLe(i1, i2);\r\n i1\r\n}\r\n\r\nfunction{:opaque} earliestActionWithin(start:int, x:temporal, span:int, timefun:imap):int\r\n requires imaptotal(timefun)\r\n requires monotonic_from(start, timefun)\r\n requires sat(start, eventuallynextwithin(x, span, timefun))\r\n ensures sat(earliestActionWithin(start, x, span, timefun), and(x, next(before(timefun[start] + span, timefun))))\r\n ensures start <= earliestActionWithin(start, x, span, timefun)\r\n ensures forall i :: start <= i < earliestActionWithin(start, x, span, timefun) ==> !sat(i, x)\r\n{\r\n TemporalAssist();\r\n var i1 := earliestStep(start, x);\r\n var i2 := earliestStep(start, and(x, next(before(timefun[start] + span, timefun))));\r\n assert TLe(i1, i2);\r\n i1\r\n}\r\n\r\nfunction{:opaque} goalOrDecrease(goal:temporal, d:imap, span:int, timefun:imap):temporal\r\n requires imaptotal(d)\r\n requires imaptotal(timefun)\r\n ensures forall i {:trigger sat(i, goalOrDecrease(goal, d, span, timefun))} :: sat(i, goalOrDecrease(goal, d, span, timefun)) <==>\r\n sat(i, eventuallywithin(or(goal, stepDecrease(i, d)), span, timefun))\r\n{\r\n TemporalAssist();\r\n stepmap(imap i :: sat(i, eventuallywithin(or(goal, stepDecrease(i, d)), span, timefun)))\r\n}\r\n\r\nfunction{:opaque} nextOrDecreaseWithin(goal:temporal, d:imap, span:int, timefun:imap):temporal\r\n requires imaptotal(d)\r\n requires imaptotal(timefun)\r\n ensures forall i {:trigger sat(i, nextOrDecreaseWithin(goal, d, span, timefun))} :: sat(i, nextOrDecreaseWithin(goal, d, span, timefun)) <==>\r\n sat(i, eventuallynextwithin(or(goal, nextDecrease(i, d)), span, timefun));\r\n{\r\n TemporalAssist();\r\n stepmap(imap i :: sat(i, eventuallynextwithin(or(goal, nextDecrease(i, d)), span, timefun)))\r\n}\r\n\r\nfunction{:opaque} eventuallywithinspans(d:imap, goal:temporal, span:int, timefun:imap):temporal\r\n requires imaptotal(d)\r\n requires imaptotal(timefun)\r\n ensures forall i {:trigger sat(i, eventuallywithinspans(d, goal, span, timefun))} ::\r\n sat(i, eventuallywithinspans(d, goal, span, timefun)) <==>\r\n sat(i, eventuallywithin(goal, span * d[i], timefun));\r\n{\r\n TemporalAssist();\r\n stepmap(imap i :: sat(i, eventuallywithin(goal, span * d[i], timefun)))\r\n}\r\n\r\nfunction{:opaque} eventuallynextwithinspans(d:imap, goal:temporal, span:int, timefun:imap):temporal\r\n requires imaptotal(d)\r\n requires imaptotal(timefun)\r\n ensures forall i {:trigger sat(i, eventuallynextwithinspans(d, goal, span, timefun))} ::\r\n sat(i, eventuallynextwithinspans(d, goal, span, timefun)) <==>\r\n sat(i, eventuallynextwithin(goal, span * d[i], timefun));\r\n{\r\n TemporalAssist();\r\n stepmap(imap i :: sat(i, eventuallynextwithin(goal, span * d[i], timefun)))\r\n}\r\n\r\nfunction stepattimeboundary(i:int, j:int, t:int, timefun:imap):int\r\n requires imaptotal(timefun)\r\n requires monotonic_from(i, timefun)\r\n requires timefun[i] <= t\r\n requires timefun[j] >= t\r\n requires i <= j\r\n ensures var k := stepattimeboundary(i, j, t, timefun);\r\n && timefun[k] <= t\r\n && i <= k <= j\r\n && forall m :: m > k ==> timefun[m] >= t\r\n decreases j-i\r\n{\r\n if i == j then i else if timefun[j-1] <= t then j-1 else stepattimeboundary(i, j-1, t, timefun)\r\n}\r\n\r\npredicate TimeNotZeno(timefun:imap)\r\n requires imaptotal(timefun)\r\n{\r\n forall t :: sat(0, eventual(after(t, timefun)))\r\n}\r\n\r\n/////////////////////////\r\n// LEMMAS\r\n/////////////////////////\r\n\r\nlemma TemporalEventuallyWithin(i:int, j:int, x:temporal, span:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires i <= j\r\n requires sat(j, beforeabsolutetime(x, timefun[i] + span, timefun))\r\n ensures sat(i, eventuallywithin(x, span, timefun))\r\n{\r\n TemporalAssist();\r\n}\r\n\r\nlemma TemporalEventuallyNextWithin(i:int, j:int, x:temporal, span:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires i <= j\r\n requires sat(j, x)\r\n requires sat(j+1, before(timefun[i] + span, timefun))\r\n ensures sat(i, eventuallynextwithin(x, span, timefun))\r\n{\r\n TemporalEventually(i, j, nextbefore(x, timefun[i] + span, timefun));\r\n}\r\n\r\nlemma Lemma_EventuallyWithinSpansHelper(start:int, start':int, d:imap, goal:temporal, span:int, timefun:imap)\r\n requires imaptotal(d)\r\n requires imaptotal(timefun)\r\n requires 1 <= span\r\n requires TLe(start, start')\r\n requires forall i :: start <= i ==> 1 <= d[i]\r\n requires sat(start, always(goalOrDecrease(goal, d, span, timefun)))\r\n ensures sat(start', eventuallywithin(goal, span * d[start'], timefun))\r\n decreases d[start']\r\n{\r\n TemporalAssist();\r\n assert sat(start', goalOrDecrease(goal, d, span, timefun));\r\n var n1 {:trigger TLe(start', n1)} :|\r\n TLe(start', n1) && sat(n1, beforeabsolutetime(or(goal, stepDecrease(start', d)), timefun[start'] + span, timefun));\r\n if (sat(n1, goal))\r\n {\r\n calc\r\n {\r\n 1 <= d[start'];\r\n { lemma_mul_inequality(1, d[start'], span); }\r\n span * 1 <= span * d[start'];\r\n }\r\n }\r\n else\r\n {\r\n Lemma_EventuallyWithinSpansHelper(start, n1, d, goal, span, timefun);\r\n var n2 {:trigger TLe(n1, n2)} :|\r\n TLe(n1, n2) && sat(n2, beforeabsolutetime(goal, timefun[n1] + span * d[n1], timefun));\r\n calc\r\n {\r\n d[n1] + 1 <= d[start'];\r\n { lemma_mul_inequality_forall(); lemma_mul_is_commutative_forall(); }\r\n span * (d[n1] + 1) <= span * d[start'];\r\n { lemma_mul_is_distributive_forall(); }\r\n span * d[n1] + span <= span * d[start'];\r\n }\r\n assert sat(n2, beforeabsolutetime(goal, timefun[start'] + span * d[start'], timefun));\r\n }\r\n}\r\n\r\n// If []t :: (goal || d < d[t])\r\n// and [](0 <= d)\r\n// then [](goal)\r\nlemma Lemma_EventuallyWithinSpans(start:int, d:imap, goal:temporal, span:int, timefun:imap)\r\n requires imaptotal(d)\r\n requires imaptotal(timefun)\r\n requires 1 <= span\r\n requires forall i :: start <= i ==> 1 <= d[i]\r\n requires sat(start, always(goalOrDecrease(goal, d, span, timefun)))\r\n ensures sat(start, always(eventuallywithinspans(d, goal, span, timefun)))\r\n{\r\n TemporalAssist();\r\n forall start' | TLe(start, start')\r\n ensures sat(start', eventuallywithin(goal, span * d[start'], timefun))\r\n {\r\n Lemma_EventuallyWithinSpansHelper(start, start', d, goal, span, timefun);\r\n }\r\n}\r\n\r\n// If [](goal)\r\n// and [](d <= n)\r\n// then [](goal)\r\nlemma Lemma_EventuallyWithinBound(start:int, d:imap, n:int, goal:temporal, span:int, timefun:imap)\r\n requires imaptotal(d)\r\n requires imaptotal(timefun)\r\n requires forall i :: d[i] <= n\r\n requires 0 <= span\r\n requires sat(start, always(eventuallywithinspans(d, goal, span, timefun)))\r\n ensures sat(start, always(eventuallywithin(goal, span * n, timefun)))\r\n{\r\n TemporalAssist();\r\n forall i1 | TLe(start, i1)\r\n ensures sat(i1, eventuallywithin(goal, span * n, timefun))\r\n {\r\n lemma_mul_inequality_forall();\r\n lemma_mul_is_commutative_forall();\r\n assert span * d[i1] <= span * n;\r\n }\r\n}\r\n\r\nlemma Lemma_EventuallynextWithinSpansHelper(start:int, start':int, d:imap, goal:temporal, span:int, timefun:imap)\r\n requires imaptotal(d)\r\n requires imaptotal(timefun)\r\n requires 1 <= span\r\n requires TLe(start, start')\r\n requires forall i :: start <= i ==> 1 <= d[i]\r\n requires sat(start, always(nextOrDecreaseWithin(goal, d, span, timefun)))\r\n ensures sat(start', eventuallynextwithin(goal, span * d[start'], timefun))\r\n decreases d[start']\r\n{\r\n TemporalAssist();\r\n assert sat(start', nextOrDecreaseWithin(goal, d, span, timefun));\r\n var n1 {:trigger TLe(start', n1)} :|\r\n TLe(start', n1) && sat(n1, and(or(goal, nextDecrease(start', d)), next(before(timefun[start'] + span, timefun))));\r\n if (sat(n1, goal))\r\n {\r\n calc\r\n {\r\n 1 <= d[start'];\r\n { lemma_mul_inequality(1, d[start'], span); }\r\n span * 1 <= span * d[start'];\r\n }\r\n }\r\n else\r\n {\r\n Lemma_EventuallynextWithinSpansHelper(start, n1 + 1, d, goal, span, timefun);\r\n var n2 {:trigger TLe(n1 + 1, n2)} :| TLe(n1 + 1, n2)\r\n && sat(n2, and(goal, next(before(timefun[n1 + 1] + span * d[n1 + 1], timefun))));\r\n calc\r\n {\r\n d[n1 + 1] + 1 <= d[start'];\r\n { lemma_mul_inequality_forall(); lemma_mul_is_commutative_forall(); }\r\n span * (d[n1 + 1] + 1) <= span * d[start'];\r\n { lemma_mul_is_distributive_forall(); }\r\n span * d[n1 + 1] + span <= span * d[start'];\r\n }\r\n assert sat(n2, nextbefore(goal, timefun[start'] + span * d[start'], timefun));\r\n assert sat(n2, and(goal, next(before(timefun[start'] + span * d[start'], timefun))));\r\n }\r\n}\r\n\r\n// If []t :: (goal || d' < d[t]')\r\n// and [](1 <= d)\r\n// then [](goal)\r\nlemma Lemma_EventuallynextWithinSpans(start:int, d:imap, goal:temporal, span:int, timefun:imap)\r\n requires imaptotal(d)\r\n requires imaptotal(timefun)\r\n requires 1 <= span\r\n requires forall i :: start <= i ==> 1 <= d[i]\r\n requires sat(start, always(nextOrDecreaseWithin(goal, d, span, timefun)))\r\n ensures sat(start, always(eventuallynextwithinspans(d, goal, span, timefun)))\r\n{\r\n TemporalAssist();\r\n forall start' | TLe(start, start')\r\n ensures sat(start', eventuallynextwithin(goal, span * d[start'], timefun))\r\n {\r\n Lemma_EventuallynextWithinSpansHelper(start, start', d, goal, span, timefun);\r\n }\r\n}\r\n\r\n// If [](goal)\r\n// and [](d <= n)\r\n// then [](goal)\r\nlemma Lemma_EventuallynextWithinBound(start:int, d:imap, n:int, goal:temporal, span:int, timefun:imap)\r\n requires imaptotal(d)\r\n requires imaptotal(timefun)\r\n requires forall i :: d[i] <= n\r\n requires 0 <= span\r\n requires sat(start, always(eventuallynextwithinspans(d, goal, span, timefun)))\r\n ensures sat(start, always(eventuallynextwithin(goal, span * n, timefun)))\r\n{\r\n TemporalAssist();\r\n forall i1 | TLe(start, i1)\r\n ensures sat(i1, eventuallynextwithin(goal, span * n, timefun))\r\n {\r\n lemma_mul_inequality_forall();\r\n lemma_mul_is_commutative_forall();\r\n assert span * d[i1] <= span * n;\r\n }\r\n}\r\n\r\nlemma Lemma_EventuallynextWithinImpliesEventuallynext(i:int, x:temporal, span:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires sat(i, eventuallynextwithin(x, span, timefun))\r\n ensures sat(i, eventual(x))\r\n{\r\n TemporalAssist();\r\n}\r\n\r\nlemma Lemma_AlwaysEventuallyWithinMeansAlwaysEventuallyWithinAfter(i:int, action:temporal, wait:int, span:int, timefun:imap)\r\n returns (step:int)\r\n requires imaptotal(timefun)\r\n requires monotonic_from(0, timefun)\r\n requires wait >= 0\r\n requires span >= 0\r\n requires TimeNotZeno(timefun)\r\n requires sat(i, always(eventuallynextwithin(action, span, timefun)))\r\n requires 0 <= i\r\n ensures i <= step\r\n ensures sat(step, and(nextbefore(action, timefun[i] + wait + span, timefun), next(after(timefun[i] + wait, timefun))))\r\n ensures sat(i, eventual(and(nextbefore(action, timefun[i] + wait + span, timefun), next(after(timefun[i] + wait, timefun)))))\r\n{\r\n var rt1 := timefun[i] + wait;\r\n var rt2 := timefun[i] + wait + span;\r\n var j := eventualStep(0, after(rt1, timefun));\r\n Lemma_MonotonicFromImpliesMonotonicFromLater(0, i, timefun);\r\n if (j < i)\r\n {\r\n j := i;\r\n }\r\n var k := stepattimeboundary(i, j, rt1, timefun);\r\n TemporalDeduceFromAlways(i, k, eventuallynextwithin(action, span, timefun));\r\n step := eventualStep(k, nextbefore(action, timefun[k] + span, timefun));\r\n TemporalEventually(i, step, and(nextbefore(action, rt2, timefun), next(after(rt1, timefun))));\r\n}\r\n\r\nlemma Lemma_AlwaysEventuallyWithinImpliesAfter(i:int, j:int, action:temporal, span:int, timefun:imap, rt:int) returns (step:int)\r\n requires imaptotal(timefun)\r\n requires monotonic_from(0, timefun)\r\n requires span >= 0\r\n requires TimeNotZeno(timefun)\r\n requires sat(i, always(eventuallynextwithin(action, span, timefun)))\r\n requires 0 <= i <= j\r\n ensures j <= step\r\n ensures sat(step, action)\r\n ensures rt <= timefun[step+1]\r\n{\r\n assert sat(0, eventual(after(rt, timefun)));\r\n var k := TemporalDeduceFromEventual(0, after(rt, timefun));\r\n if k < j\r\n {\r\n assert rt <= timefun[k] <= timefun[j];\r\n k := j;\r\n }\r\n TemporalDeduceFromAlways(i, k, eventuallynextwithin(action, span, timefun));\r\n step := TemporalDeduceFromEventual(k, nextbefore(action, timefun[k] + span, timefun));\r\n}\r\n\r\nlemma Lemma_UntilAbsoluteTimeImpliesUntilEarlierTime(i:int, x:temporal, t1:int, t2:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires monotonic_from(i, timefun)\r\n requires sat(i, untilabsolutetime(x, t1, timefun))\r\n requires t2 <= t1\r\n ensures sat(i, untilabsolutetime(x, t2, timefun))\r\n{\r\n TemporalAssist();\r\n}\r\n\r\nlemma Lemma_AlwaysUntilAbsoluteTimeImpliesAlwaysUntilEarlierTime(i:int, x:temporal, t1:int, t2:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires monotonic_from(i, timefun)\r\n requires sat(i, always(untilabsolutetime(x, t1, timefun)))\r\n requires t2 <= t1\r\n ensures sat(i, always(untilabsolutetime(x, t2, timefun)))\r\n{\r\n TemporalAssist();\r\n}\r\n\r\nlemma TemporalDeduceFromEventuallyWithin(i:int, x:temporal, span:int, timefun:imap) returns (step:int)\r\n requires imaptotal(timefun)\r\n requires sat(i, eventuallywithin(x, span, timefun))\r\n ensures i <= step\r\n ensures sat(step, beforeabsolutetime(x, timefun[i] + span, timefun))\r\n{\r\n step := TemporalDeduceFromEventual(i, beforeabsolutetime(x, timefun[i] + span, timefun));\r\n}\r\n\r\nlemma TemporalDeduceFromEventuallyNextWithin(i:int, x:temporal, span:int, timefun:imap) returns (step:int)\r\n requires imaptotal(timefun)\r\n requires sat(i, eventuallynextwithin(x, span, timefun))\r\n ensures i <= step\r\n ensures sat(step, nextbefore(x, timefun[i] + span, timefun))\r\n{\r\n step := TemporalDeduceFromEventual(i, nextbefore(x, timefun[i] + span, timefun));\r\n}\r\n\r\nlemma TemporalDeduceFromAlwaysWithin(i:int, j:int, x:temporal, span:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires sat(i, alwayswithin(x, span, timefun))\r\n requires i <= j\r\n requires sat(j, before(timefun[i] + span, timefun))\r\n ensures sat(j, x)\r\n{\r\n TemporalDeduceFromAlways(i, j, untilabsolutetime(x, timefun[i] + span, timefun));\r\n}\r\n\r\npredicate{:opaque} monotonic_from_opaque(start:int, f:imap)\r\n{\r\n forall i1, i2 {:trigger f[i1], f[i2]} :: i1 in f && i2 in f && start <= i1 <= i2 ==> f[i1] <= f[i2]\r\n}\r\n\r\nfunction{:opaque} actionGoalDecrease(i1:int, goal:temporal, d:imap):temporal\r\n requires imaptotal(d)\r\n ensures forall i {:trigger sat(i, actionGoalDecrease(i1, goal, d))} :: sat(i, actionGoalDecrease(i1, goal, d)) <==>\r\n (0 < d[i + 1] && d[i + 1] < d[i1]) || sat(i, goal) || (d[i1] == 0)\r\n{\r\n TemporalAssist();\r\n stepmap(imap i :: (0 < d[i + 1] && d[i + 1] < d[i1]) || sat(i, goal) || (d[i1] == 0))\r\n}\r\n\r\nfunction{:opaque} actionGoalDecreaseWithin(goal:temporal, d:imap, span:int, timefun:imap):temporal\r\n requires imaptotal(d)\r\n requires imaptotal(timefun)\r\n ensures forall i {:trigger sat(i, actionGoalDecreaseWithin(goal, d, span, timefun))} ::\r\n sat(i, actionGoalDecreaseWithin(goal, d, span, timefun)) <==>\r\n sat(i, eventuallynextwithin(actionGoalDecrease(i, goal, d), span, timefun))\r\n{\r\n TemporalAssist();\r\n stepmap(imap i :: sat(i, eventuallynextwithin(actionGoalDecrease(i, goal, d), span, timefun)))\r\n}\r\n\r\n// If []t :: ((0 < d' < d[t]') || goal || (d[t]' == 0))\r\n// and [](0 <= d)\r\n// and 1 <= d\r\n// then (goal)\r\nlemma Lemma_EventuallyNextGoalSpans(start:int, d:imap, goal:temporal, span:int, timefun:imap)\r\n requires imaptotal(d)\r\n requires imaptotal(timefun)\r\n requires 1 <= span\r\n requires 1 <= d[start]\r\n requires forall i :: start <= i ==> 0 <= d[i]\r\n requires sat(start, always(actionGoalDecreaseWithin(goal, d, span, timefun)))\r\n ensures sat(start, eventuallynextwithinspans(d, goal, span, timefun))\r\n decreases d[start]\r\n{\r\n TemporalAssist();\r\n assert sat(start, actionGoalDecreaseWithin(goal, d, span, timefun));\r\n var i1 {:trigger TLe(start, i1)} :|\r\n TLe(start, i1) && sat(i1, actionGoalDecrease(start, goal, d)) && timefun[i1 + 1] <= timefun[start] + span;\r\n if (sat(i1, goal))\r\n {\r\n calc\r\n {\r\n 1 <= d[start];\r\n { lemma_mul_inequality(1, d[start], span); }\r\n span * 1 <= span * d[start];\r\n }\r\n assert sat(start, eventuallynextwithinspans(d, goal, span, timefun));\r\n }\r\n else\r\n {\r\n Lemma_EventuallyNextGoalSpans(i1 + 1, d, goal, span, timefun);\r\n var i2 {:trigger TLe(i1 + 1, i2)} :| TLe(i1 + 1, i2)\r\n && sat(i2, and(goal, next(before(timefun[i1 + 1] + span * d[i1 + 1], timefun))));\r\n calc\r\n {\r\n d[i1 + 1] + 1 <= d[start];\r\n { lemma_mul_inequality_forall(); lemma_mul_is_commutative_forall(); }\r\n span * (d[i1 + 1] + 1) <= span * d[start];\r\n { lemma_mul_is_distributive_forall(); }\r\n span * d[i1 + 1] + span <= span * d[start];\r\n }\r\n assert sat(i2, nextbefore(goal, timefun[start] + span * d[start], timefun));\r\n assert sat(i2, and(goal, next(before(timefun[start] + span * d[start], timefun))));\r\n }\r\n}\r\n\r\nfunction {:opaque} ActionIsInstantaneousTemporal(x:temporal, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n ensures forall i {:trigger sat(i, ActionIsInstantaneousTemporal(x, timefun))} ::\r\n sat(i, ActionIsInstantaneousTemporal(x, timefun)) <==> (sat(i, x) ==> timefun[i] == timefun[i+1])\r\n{\r\n stepmap(imap i :: sat(i, x) ==> timefun[i] == timefun[i+1])\r\n}\r\n\r\n// \"x\" happens at most \"count\" times in all periods no longer than \"span\"\r\nfunction{:opaque} countWithinLe(count:int, x:temporal, span:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n ensures forall i1 {:trigger sat(i1, countWithinLe(count, x, span, timefun))} :: sat(i1, countWithinLe(count, x, span, timefun))\r\n <==> (forall i2 :: TLe(i1, i2) && timefun[i2] <= timefun[i1] + span ==> countWithin(i1, i2, x) <= count)\r\n{\r\n TemporalAssist();\r\n stepmap(imap i1 :: forall i2 :: TLe(i1, i2) && timefun[i2] <= timefun[i1] + span ==> countWithin(i1, i2, x) <= count)\r\n}\r\n\r\n// \"x\" happens at least \"count\" times in a period no longer than \"span\"\r\nfunction{:opaque} countWithinGe(count:int, x:temporal, span:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n ensures forall i1 {:trigger sat(i1, countWithinGe(count, x, span, timefun))} :: sat(i1, countWithinGe(count, x, span, timefun))\r\n <==> (exists i2 :: TLe(i1, i2) && timefun[i2] <= timefun[i1] + span && countWithin(i1, i2, x) >= count)\r\n{\r\n TemporalAssist();\r\n stepmap(imap i1 :: exists i2 :: TLe(i1, i2) && timefun[i2] <= timefun[i1] + span && countWithin(i1, i2, x) >= count)\r\n}\r\n\r\nlemma Lemma_CountWithinLeMultiple(start:int, n:nat, count:int, x:temporal, span:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires monotonic_from_opaque(start, timefun)\r\n requires 1 <= n\r\n requires 0 <= span\r\n requires sat(start, always(ActionIsInstantaneousTemporal(x, timefun)))\r\n requires sat(start, always(countWithinLe(count, x, span, timefun)))\r\n ensures sat(start, always(countWithinLe(count * n, x, span * n, timefun)))\r\n decreases n\r\n{\r\n TemporalAssist();\r\n reveal monotonic_from_opaque();\r\n forall i1 | TLe(start, i1)\r\n ensures sat(i1, countWithinLe(count * n, x, span * n, timefun))\r\n {\r\n if (n > 1)\r\n {\r\n forall i3 | TLe(i1, i3) && timefun[i3] <= timefun[i1] + span * n\r\n ensures countWithin(i1, i3, x) <= count * n\r\n {\r\n Lemma_CountWithinLeMultiple(i1, n - 1, count, x, span, timefun);\r\n assert sat(i1, countWithinLe(count * (n - 1), x, span * (n - 1), timefun));\r\n assert forall i2 :: TLe(i1, i2) && timefun[i2] <= timefun[i1] + span * (n - 1) ==> countWithin(i1, i2, x) <= count * (n - 1);\r\n if (exists i2' :: TLe(i1, i2') && TLe(i2', i3) && timefun[i2'] > timefun[i1] + span * (n - 1))\r\n {\r\n var f := imap i2' :: TLe(i2', i3) && timefun[i2'] > timefun[i1] + span * (n - 1);\r\n var i2' := earliestStep(i1, stepmap(f));\r\n lemma_mul_nonnegative(span, n-1);\r\n var i2 := i2' - 1;\r\n assert !sat(i2, stepmap(f));\r\n TemporalDeduceFromAlways(i1, i2, ActionIsInstantaneousTemporal(x, timefun));\r\n assert !sat(i2, x);\r\n forall ensures 0 <= span * (n - 1) { lemma_mul_nonnegative(span, n - 1); }\r\n assert TLe(i1, i2');\r\n assert TLe(i1, i2);\r\n assert TLe(i2, i3);\r\n assert forall i :: i1 <= i <= i2 ==> !sat(i, stepmap(f));\r\n assert forall i :: sat(i, stepmap(f)) == (TLe(i, i3) && timefun[i] > timefun[i1] + span * (n - 1));\r\n assert forall i :: i1 <= i <= i2 ==> !(TLe(i, i3) && timefun[i] > timefun[i1] + span * (n - 1));\r\n assert !(TLe(i2, i3) && timefun[i2] > timefun[i1] + span * (n - 1));\r\n assert countWithin(i1, i2, x) <= count * (n - 1);\r\n\r\n assert sat(i2', countWithinLe(count, x, span, timefun));\r\n assert TLe(i2', i3) && timefun[i3] <= timefun[i2'] + span ==> countWithin(i2', i3, x) <= count;\r\n forall\r\n ensures span + span * (n - 1) == span * n\r\n ensures count + count * (n - 1) == count * n\r\n {\r\n lemma_mul_auto();\r\n }\r\n assert countWithin(i2', i3, x) <= count;\r\n\r\n assert actionsWithin(i1, i3, x) == actionsWithin(i1, i2, x) + actionsWithin(i2', i3, x);\r\n assert |actionsWithin(i1, i3, x)| >= |actionsWithin(i1, i2, x)| + |actionsWithin(i2', i3, x)|;\r\n }\r\n else\r\n {\r\n assert forall i2' :: TLe(i1, i2') && TLe(i2', i3) ==> timefun[i2'] <= timefun[i1] + span * (n - 1);\r\n assert timefun[i3] <= timefun[i1] + span * (n - 1);\r\n assert countWithin(i1, i3, x) <= count * (n - 1);\r\n forall ensures count * (n - 1) <= count * n { lemma_mul_auto(); }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma Lemma_CountWithinGeMultiple(start:int, n:nat, count:int, x:temporal, span:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires monotonic_from_opaque(start, timefun)\r\n requires 1 <= n\r\n requires 0 <= span\r\n requires sat(start, always(countWithinGe(count, x, span, timefun)))\r\n ensures sat(start, always(countWithinGe(count * n, x, span * n, timefun)))\r\n decreases n\r\n{\r\n TemporalAssist();\r\n reveal monotonic_from_opaque();\r\n forall i1 | TLe(start, i1)\r\n ensures sat(i1, countWithinGe(count * n, x, span * n, timefun))\r\n {\r\n if (n > 1)\r\n {\r\n assert sat(i1, countWithinGe(count, x, span, timefun));\r\n var i2 :| TLe(i1, i2) && timefun[i2] <= timefun[i1] + span && countWithin(i1, i2, x) >= count;\r\n Lemma_CountWithinGeMultiple(i2, n - 1, count, x, span, timefun);\r\n assert sat(i2, always(countWithinGe(count * (n - 1), x, span * (n - 1), timefun)));\r\n assert sat(i2, countWithinGe(count * (n - 1), x, span * (n - 1), timefun));\r\n var i3 :| TLe(i2, i3) && timefun[i3] <= timefun[i2] + span * (n - 1) && countWithin(i2, i3, x) >= count * (n - 1);\r\n assert TLe(i1, i3);\r\n assert actionsWithin(i1, i3, x) == actionsWithin(i1, i2, x) + actionsWithin(i2, i3, x);\r\n assert |actionsWithin(i1, i3, x)| >= |actionsWithin(i1, i2, x)| + |actionsWithin(i2, i3, x)|;\r\n forall\r\n ensures span + span * (n - 1) == span * n\r\n ensures count + count * (n - 1) == count * n\r\n {\r\n lemma_mul_auto();\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma Lemma_CountWithinGeOne(start:int, x:temporal, span:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires 0 <= span\r\n requires sat(start, always(eventuallynextwithin(x, span, timefun)))\r\n ensures sat(start, always(countWithinGe(1, x, span, timefun)))\r\n{\r\n TemporalAssist();\r\n forall i1 | TLe(start, i1)\r\n ensures sat(i1, countWithinGe(1, x, span, timefun))\r\n {\r\n var i2 :| TLe(i1, i2) && sat(i2, nextbefore(x, timefun[i1] + span, timefun));\r\n var i2' := i2 + 1;\r\n assert i2 in actionsWithin(i1, i2', x);\r\n assert countWithin(i1, i2', x) >= 1;\r\n }\r\n}\r\n\r\nlemma{:timeLimitMultiplier 2} Lemma_CountIncrDecrHelper(i1:int, i2:int, d:imap, nIncr:int, nDecr:int,\r\n incr:temporal, decr:temporal)\r\n requires imaptotal(d)\r\n requires i1 <= i2\r\n requires countWithin(i1, i2, decr) >= nDecr\r\n requires countWithin(i1, i2, incr) <= nIncr\r\n requires forall i {:trigger TLe(i1, i)}{:trigger sat(i, incr)}{:trigger sat(i, decr)} :: TLe(i1, i) && TLe(i, i2) ==>\r\n || (sat(i, incr) && !sat(i, decr) && d[i + 1] == d[i] + 1)\r\n || (!sat(i, incr) && sat(i, decr) && d[i + 1] < d[i])\r\n || (!sat(i, incr) && !sat(i, decr) && d[i + 1] == d[i])\r\n ensures d[i2] <= d[i1] + nIncr - nDecr\r\n decreases i2 - i1\r\n{\r\n if (i1 == i2)\r\n {\r\n assert forall i :: i !in actionsWithin(i1, i2, decr);\r\n assert actionsWithin(i1, i2, decr) == {};\r\n assert countWithin(i1, i2, decr) == 0;\r\n }\r\n else\r\n {\r\n assert actionsWithin(i1, i2, incr) == actionsWithin(i1, i1 + 1, incr) + actionsWithin(i1 + 1, i2, incr);\r\n assert actionsWithin(i1, i2, decr) == actionsWithin(i1, i1 + 1, decr) + actionsWithin(i1 + 1, i2, decr);\r\n if (sat(i1, incr))\r\n {\r\n assert i1 in actionsWithin(i1, i2, incr);\r\n Lemma_CountIncrDecrHelper(i1 + 1, i2, d, nIncr - 1, nDecr, incr, decr);\r\n }\r\n else if (sat(i1, decr))\r\n {\r\n forall j | i1 <= j < i1 + 1 && sat(j, decr)\r\n ensures j == i1\r\n {\r\n }\r\n assert i1 in actionsWithin(i1, i1 + 1, decr);\r\n assert actionsWithin(i1, i1 + 1, decr) <= {i1};\r\n assert actionsWithin(i1, i1 + 1, decr) == {i1};\r\n Lemma_CountIncrDecrHelper(i1 + 1, i2, d, nIncr, nDecr - 1, incr, decr);\r\n }\r\n else\r\n {\r\n Lemma_CountIncrDecrHelper(i1 + 1, i2, d, nIncr, nDecr, incr, decr);\r\n }\r\n }\r\n}\r\n\r\nlemma Lemma_CountIncrDecr(i1:int, d:imap, nIncr:int, nDecr:int, incr:temporal, decr:temporal, span:int, timefun:imap)\r\n returns (i2:int)\r\n // |decr| >= nDecr\r\n // |incr| <= nIncr\r\n requires imaptotal(d)\r\n requires imaptotal(timefun)\r\n requires monotonic_from_opaque(i1, timefun)\r\n requires 0 <= span\r\n requires sat(i1, countWithinLe(nIncr, incr, span, timefun))\r\n requires sat(i1, countWithinGe(nDecr, decr, span, timefun))\r\n requires forall i {:trigger TLe(i1, i)} :: TLe(i1, i) && timefun[i] <= timefun[i1] + span ==>\r\n || (sat(i, incr) && !sat(i, decr) && d[i + 1] == d[i] + 1)\r\n || (!sat(i, incr) && sat(i, decr) && d[i + 1] < d[i])\r\n || (!sat(i, incr) && !sat(i, decr) && d[i + 1] == d[i]);\r\n ensures timefun[i2] <= timefun[i1] + span\r\n ensures sat(i2, stepmap(imap i :: d[i] <= d[i1] + nIncr - nDecr))\r\n ensures sat(i1, alwayswithin(stepmap(imap i :: d[i] <= d[i1] + nIncr), span, timefun))\r\n ensures nDecr > 0 ==> i2 > i1\r\n{\r\n TemporalAssist();\r\n reveal monotonic_from_opaque();\r\n i2 :| TLe(i1, i2) && timefun[i2] <= timefun[i1] + span && countWithin(i1, i2, decr) >= nDecr;\r\n assert TLe(i1, i2) && timefun[i2] <= timefun[i1] + span ==> countWithin(i1, i2, incr) <= nIncr;\r\n\r\n assert countWithin(i1, i2, decr) >= nDecr;\r\n assert countWithin(i1, i2, incr) <= nIncr;\r\n Lemma_CountIncrDecrHelper(i1, i2, d, nIncr, nDecr, incr, decr);\r\n assert d[i2] <= d[i1] + nIncr - nDecr;\r\n\r\n var f1 := imap i :: d[i] <= d[i1] + nIncr - nDecr;\r\n assert sat(i2, stepmap(f1));\r\n assert sat(i1, eventuallywithin(stepmap(f1), span, timefun));\r\n\r\n var f2 := imap i :: d[i] <= d[i1] + nIncr;\r\n forall i | TLe(i1, i) && timefun[i] <= timefun[i1] + span\r\n ensures f2[i]\r\n {\r\n Lemma_CountIncrDecrHelper(i1, i, d, nIncr, countWithin(i1, i, decr), incr, decr);\r\n assert d[i] <= d[i1] + nIncr;\r\n }\r\n assert sat(i1, alwayswithin(stepmap(f2), span, timefun));\r\n}\r\n\r\nlemma Lemma_CountIncrHelper(i1:int, i2:int, d:imap, nIncr:int, incr:temporal)\r\n requires imaptotal(d)\r\n requires i1 <= i2\r\n requires countWithin(i1, i2, incr) <= nIncr\r\n requires forall i {:trigger TLe(i1, i)}{:trigger sat(i, incr)} :: TLe(i1, i) && TLe(i, i2) ==>\r\n || (sat(i, incr) && d[i + 1] == d[i] + 1)\r\n || (!sat(i, incr) && d[i + 1] <= d[i])\r\n ensures d[i2] <= d[i1] + nIncr\r\n decreases i2 - i1\r\n{\r\n if (i1 != i2)\r\n {\r\n assert actionsWithin(i1, i2, incr) == actionsWithin(i1, i1 + 1, incr) + actionsWithin(i1 + 1, i2, incr);\r\n if (sat(i1, incr))\r\n {\r\n assert i1 in actionsWithin(i1, i2, incr);\r\n Lemma_CountIncrHelper(i1 + 1, i2, d, nIncr - 1, incr);\r\n }\r\n else\r\n {\r\n Lemma_CountIncrHelper(i1 + 1, i2, d, nIncr, incr);\r\n }\r\n }\r\n}\r\n\r\nlemma Lemma_CountIncr(i1:int, d:imap, nIncr:int, incr:temporal, span:int, timefun:imap)\r\n // |incr| <= nIncr\r\n requires imaptotal(d)\r\n requires imaptotal(timefun)\r\n requires monotonic_from_opaque(i1, timefun)\r\n requires 0 <= span\r\n requires sat(i1, countWithinLe(nIncr, incr, span, timefun))\r\n requires forall i {:trigger TLe(i1, i)} :: TLe(i1, i) && timefun[i] <= timefun[i1] + span ==>\r\n || (sat(i, incr) && d[i + 1] == d[i] + 1)\r\n || (!sat(i, incr) && d[i + 1] <= d[i])\r\n ensures sat(i1, alwayswithin(stepmap(imap i :: d[i] <= d[i1] + nIncr), span, timefun))\r\n{\r\n TemporalAssist();\r\n reveal monotonic_from_opaque();\r\n\r\n var f2 := imap i :: d[i] <= d[i1] + nIncr;\r\n forall i | TLe(i1, i) && timefun[i] <= timefun[i1] + span\r\n ensures f2[i]\r\n {\r\n Lemma_CountIncrHelper(i1, i, d, nIncr, incr);\r\n assert d[i] <= d[i1] + nIncr;\r\n }\r\n assert sat(i1, alwayswithin(stepmap(f2), span, timefun));\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Logic/Temporal/Time.s.dfy", "content": "include \"Temporal.s.dfy\"\r\n\r\nmodule Temporal__Time_s {\r\nimport opened Temporal__Temporal_s\r\nimport opened Collections__Maps2_s\r\n\r\nfunction{:opaque} eventuallywithin(x:temporal, span:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n ensures forall i {:trigger sat(i, eventuallywithin(x, span, timefun))} ::\r\n sat(i, eventuallywithin(x, span, timefun)) <==>\r\n sat(i, eventual(beforeabsolutetime(x, timefun[i] + span, timefun)))\r\n{\r\n stepmap(imap j :: sat(j, eventual(beforeabsolutetime(x, timefun[j] + span, timefun))))\r\n}\r\n\r\nfunction{:opaque} alwayswithin(x:temporal, span:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n ensures forall i {:trigger sat(i, alwayswithin(x, span, timefun))} ::\r\n sat(i, alwayswithin(x, span, timefun)) <==>\r\n sat(i, always(untilabsolutetime(x, timefun[i] + span, timefun)))\r\n{\r\n stepmap(imap j :: sat(j, always(untilabsolutetime(x, timefun[j] + span, timefun))))\r\n}\r\n\r\nfunction{:opaque} before(t:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n ensures forall i {:trigger sat(i, before(t, timefun))} ::\r\n sat(i, before(t, timefun)) <==> timefun[i] <= t\r\n{\r\n stepmap(imap i :: timefun[i] <= t)\r\n}\r\n\r\nfunction{:opaque} after(t:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n ensures forall i{:trigger sat(i, after(t, timefun))} ::\r\n sat(i, after(t, timefun)) <==> (timefun[i] >= t)\r\n{\r\n stepmap(imap i :: timefun[i] >= t)\r\n}\r\n\r\nfunction nextbefore(action:temporal, t:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n{\r\n and(action, next(before(t, timefun)))\r\n}\r\n\r\nfunction nextafter(action:temporal, t:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n{\r\n and(action, next(after(t, timefun)))\r\n}\r\n\r\nfunction{:opaque} eventuallynextwithin(action:temporal, span:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n ensures forall i {:trigger sat(i, eventuallynextwithin(action, span, timefun))} ::\r\n sat(i, eventuallynextwithin(action, span, timefun)) <==>\r\n sat(i, eventual(nextbefore(action, timefun[i] + span, timefun)))\r\n{\r\n stepmap(imap i :: sat(i, eventual(nextbefore(action, timefun[i] + span, timefun))))\r\n}\r\n\r\nfunction{:opaque} beforeabsolutetime(x:temporal, t:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n ensures forall i {:trigger sat(i, beforeabsolutetime(x, t, timefun))} ::\r\n sat(i, beforeabsolutetime(x, t, timefun)) <==>\r\n sat(i, x) && timefun[i] <= t\r\n{\r\n and(x, before(t, timefun))\r\n}\r\n\r\nfunction{:opaque} untilabsolutetime(x:temporal, t:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n ensures forall i {:trigger sat(i, untilabsolutetime(x, t, timefun))} ::\r\n sat(i, untilabsolutetime(x, t, timefun)) <==>\r\n timefun[i] <= t ==> sat(i, x)\r\n{\r\n imply(before(t, timefun), x)\r\n}\r\n\r\nfunction actionsWithin(i1:int, i2:int, x:temporal):set\r\n{\r\n set i | i1 <= i < i2 && sat(i, x)\r\n}\r\n\r\nfunction countWithin(i1:int, i2:int, x:temporal):int\r\n{\r\n |actionsWithin(i1, i2, x)|\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Logic/Temporal/WF1.i.dfy", "content": "include \"Temporal.s.dfy\"\r\ninclude \"Heuristics.i.dfy\"\r\ninclude \"Rules.i.dfy\"\r\ninclude \"LeadsTo.i.dfy\"\r\ninclude \"Induction.i.dfy\"\r\ninclude \"Time.i.dfy\"\r\n\r\nmodule Temporal__WF1_i {\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__LeadsTo_i\r\nimport opened Temporal__Induction_i\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Maps2_i\r\n\r\n/////////////////////\r\n// DEFINITIONS\r\n/////////////////////\r\n\r\nfunction TemporalWF1Req1(P:temporal, Q:temporal):temporal\r\n{\r\n imply(P, or(Q, next(or(P, Q))))\r\n}\r\n\r\nfunction TemporalWF1Req2(P:temporal, Q:temporal, Action:temporal):temporal\r\n{\r\n imply(and(P, Action), or(Q, next(Q)))\r\n}\r\n\r\nfunction TemporalWF1RealTimeDelayedReq2(P:temporal, Q:temporal, Action:temporal, rt:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n{\r\n imply(and(P, nextafter(Action, rt, timefun)), or(Q, next(Q)))\r\n}\r\n\r\nfunction TemporalWF1RealTimeDelayedImmediateQReq2(P:temporal, Q:temporal, Action:temporal, rt:int, timefun:imap):temporal\r\n requires imaptotal(timefun)\r\n{\r\n imply(and(P, nextafter(Action, rt, timefun)), Q)\r\n}\r\n\r\n/////////////////////\r\n// LEMMAS\r\n/////////////////////\r\n\r\nlemma TemporalWF1(i:int, P:temporal, Q:temporal, Action:temporal)\r\n requires sat(i, always(imply(P, or(Q, next(or(P, Q))))))\r\n requires sat(i, always(imply(and(P, Action), or(Q, next(Q)))))\r\n requires sat(i, always(eventual(Action)))\r\n ensures sat(i, leadsto(P, Q))\r\n{\r\n if !sat(i, leadsto(P, Q)) {\r\n TemporalDeduceFromAlways(i, i, imply(P, or(Q, next(or(P, Q)))));\r\n TemporalNot(i, imply(P, eventual(Q)));\r\n var j := TemporalDeduceFromEventual(i, not(imply(P, eventual(Q))));\r\n assert TLe(i, j) && sat(j, and(P, not(eventual(Q))));\r\n TemporalNot(j, Q);\r\n assert sat(j, always(not(Q)));\r\n TemporalDeduceFromAlways(i, j, eventual(Action));\r\n var k := TemporalDeduceFromEventual(j, Action);\r\n var m := j;\r\n while m < k\r\n invariant j <= m <= k\r\n invariant sat(m, P)\r\n {\r\n TemporalDeduceFromAlways(i, m, imply(P, or(Q, next(or(P, Q)))));\r\n TemporalDeduceFromAlways(j, m, not(Q));\r\n assert sat(m, next(or(P, Q)));\r\n TemporalDeduceFromAlways(j, m + 1, not(Q));\r\n m := m + 1;\r\n }\r\n assert sat(k, P);\r\n TemporalDeduceFromAlways(i, k, imply(and(P, Action), or(Q, next(Q))));\r\n TemporalDeduceFromAlways(j, k, not(Q));\r\n TemporalDeduceFromAlways(j, k + 1, not(Q));\r\n assert false;\r\n }\r\n}\r\n\r\nlemma TemporalWF1Specific(i:int, action_step:int, P:temporal, Q:temporal) returns (q_step:int)\r\n requires i <= action_step\r\n requires forall j :: i <= j ==> sat(j, TemporalWF1Req1(P, Q))\r\n requires sat(i, P)\r\n requires sat(action_step, imply(P, or(Q, next(Q))))\r\n ensures i <= q_step <= action_step + 1\r\n ensures sat(q_step, Q)\r\n{\r\n if sat(action_step, P)\r\n {\r\n assert sat(i, TemporalWF1Req1(P, Q));\r\n q_step := if sat(action_step, Q) then action_step else action_step + 1;\r\n return;\r\n }\r\n\r\n var first_non_p_step := earliestStepBetween(i, action_step, not(P));\r\n assert sat(first_non_p_step, not(P));\r\n var transition_step := first_non_p_step - 1;\r\n assert first_non_p_step != i;\r\n assert sat(transition_step, TemporalWF1Req1(P, Q));\r\n assert !sat(transition_step, not(P));\r\n if sat(transition_step, Q) {\r\n q_step := transition_step;\r\n }\r\n else {\r\n assert sat(transition_step, next(or(P, Q)));\r\n q_step := first_non_p_step;\r\n }\r\n}\r\n\r\nlemma TemporalWF1RealTime(i:int, P:temporal, Q:temporal, action:temporal, span:int, timefun:imap)\r\n requires imaptotal(timefun)\r\n requires monotonic_from(i, timefun)\r\n requires sat(i, always(imply(P, or(Q, next(or(P, Q))))))\r\n requires sat(i, always(imply(and(P, action), or(Q, next(Q)))))\r\n requires sat(i, always(eventuallynextwithin(action, span, timefun)))\r\n ensures sat(i, leadstowithin(P, Q, span, timefun))\r\n{\r\n forall j | TLe(i, j) && sat(j, P)\r\n ensures sat(j, eventuallywithin(Q, span, timefun));\r\n {\r\n TemporalDeduceFromAlways(i, j, eventuallynextwithin(action, span, timefun));\r\n var k := TemporalDeduceFromEventual(j, nextbefore(action, timefun[j] + span, timefun));\r\n assert TLe(j, k) && sat(k, nextbefore(action, timefun[j] + span, timefun));\r\n assert timefun[nextstep(k)] <= timefun[j] + span;\r\n if !sat(j, eventuallywithin(Q, span, timefun))\r\n {\r\n assert !sat(j, eventual(beforeabsolutetime(Q, timefun[j] + span, timefun)));\r\n TemporalNot(j, beforeabsolutetime(Q, timefun[j] + span, timefun));\r\n assert sat(j, always(not(beforeabsolutetime(Q, timefun[j] + span, timefun))));\r\n TemporalDeduceFromAlways(j, nextstep(k), not(beforeabsolutetime(Q, timefun[j] + span, timefun)));\r\n assert !sat(nextstep(k), Q);\r\n var a := j;\r\n while a < k\r\n invariant j <= a <= k\r\n invariant sat(a, P)\r\n {\r\n assert timefun[a] <= timefun[nextstep(a)] <= timefun[k] <= timefun[j] + span;\r\n TemporalDeduceFromAlways(j, a, not(beforeabsolutetime(Q, timefun[j] + span, timefun)));\r\n TemporalDeduceFromAlways(i, a, imply(P, or(Q, next(or(P, Q)))));\r\n TemporalDeduceFromAlways(j, nextstep(a), not(beforeabsolutetime(Q, timefun[j] + span, timefun)));\r\n a := a + 1;\r\n }\r\n assert sat(k, P);\r\n TemporalDeduceFromAlways(i, k, imply(and(P, action), or(Q, next(Q))));\r\n assert sat(k, or(Q, next(Q)));\r\n if sat(k, Q) {\r\n assert i <= k <= k + 0 + 1; // saying \"k + 1\" triggers too many facts\r\n assert timefun[k] <= timefun[nextstep(k)];\r\n assert sat(k, beforeabsolutetime(Q, timefun[j] + span, timefun));\r\n TemporalDeduceFromAlways(j, k, not(beforeabsolutetime(Q, timefun[j] + span, timefun)));\r\n }\r\n else {\r\n assert sat(k, next(Q));\r\n assert false;\r\n }\r\n }\r\n }\r\n TemporalAlways(i, imply(P, eventuallywithin(Q, span, timefun)));\r\n assert sat(i, leadstowithin(P, Q, span, timefun));\r\n}\r\n\r\nlemma TemporalWF1RealTimeDelayed(i:int, P:temporal, Q:temporal, action:temporal, span:int, rt:int, timefun:imap)\r\n returns (step:int)\r\n requires imaptotal(timefun)\r\n requires monotonic_from(0, timefun)\r\n requires TimeNotZeno(timefun)\r\n requires 0 <= span\r\n requires 0 <= i\r\n requires sat(i, P)\r\n requires sat(i, always(imply(P, or(Q, next(or(P, Q))))))\r\n requires sat(i, always(imply(and(P, nextafter(action, rt, timefun)), or(Q, next(Q)))))\r\n requires sat(i, always(eventuallynextwithin(action, span, timefun)))\r\n ensures i <= step\r\n ensures sat(step, Q)\r\n ensures timefun[step] <= (if rt >= timefun[i] then rt else timefun[i]) + span\r\n{\r\n var wait := if rt >= timefun[i] then rt - timefun[i] else 0;\r\n reveal after();\r\n var j := Lemma_AlwaysEventuallyWithinMeansAlwaysEventuallyWithinAfter(i, action, wait, span, timefun);\r\n assert timefun[j+1] <= (if rt >= timefun[i] then rt else timefun[i]) + span;\r\n if sat(i, always(P))\r\n {\r\n TemporalDeduceFromAlways(i, j, P);\r\n TemporalDeduceFromAlways(i, j, imply(and(P, nextafter(action, rt, timefun)), or(Q, next(Q))));\r\n step := if sat(j, Q) then j else j + 1;\r\n }\r\n else\r\n {\r\n TemporalNot(i, P);\r\n var k := earliestStep(i, not(P));\r\n assert k != i;\r\n assert sat(k-1, not(not(P)));\r\n assert sat(k, not(P));\r\n if k > j + 1\r\n {\r\n assert i <= j + 1 < k ==> !sat(j, not(P));\r\n TemporalDeduceFromAlways(i, j, imply(and(P, nextafter(action, rt, timefun)), or(Q, next(Q))));\r\n step := if sat(j, Q) then j else j + 1;\r\n }\r\n else\r\n {\r\n assert i < k;\r\n TemporalDeduceFromAlways(i, k-1, imply(P, or(Q, next(or(P, Q)))));\r\n if sat(k-1, Q)\r\n {\r\n step := k - 1;\r\n }\r\n else\r\n {\r\n assert sat(k-1, next(or(P, Q)));\r\n assert sat(k, or(P, Q)) by { assert nextstep(k-1) == k; }\r\n step := k;\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma TemporalWF1RealTimeDelayedImmediateQ(i:int, P:temporal, Q:temporal, action:temporal, span:int, rt:int, timefun:imap)\r\n returns (step:int)\r\n requires imaptotal(timefun)\r\n requires monotonic_from(0, timefun)\r\n requires TimeNotZeno(timefun)\r\n requires 0 <= span\r\n requires 0 <= i\r\n requires sat(i, P)\r\n requires sat(i, always(imply(P, or(Q, next(P)))))\r\n requires sat(i, always(imply(and(P, nextafter(action, rt, timefun)), Q)))\r\n requires sat(i, always(eventuallynextwithin(action, span, timefun)))\r\n ensures i <= step\r\n ensures sat(step, Q)\r\n ensures timefun[step+1] <= (if rt >= timefun[i] then rt else timefun[i]) + span\r\n{\r\n var wait := if rt >= timefun[i] then rt - timefun[i] else 0;\r\n reveal after();\r\n var j := Lemma_AlwaysEventuallyWithinMeansAlwaysEventuallyWithinAfter(i, action, wait, span, timefun);\r\n assert timefun[j+1] <= (if rt >= timefun[i] then rt else timefun[i]) + span;\r\n if sat(i, always(P))\r\n {\r\n TemporalDeduceFromAlways(i, j, P);\r\n TemporalDeduceFromAlways(i, j, imply(and(P, nextafter(action, rt, timefun)), Q));\r\n step := j;\r\n }\r\n else\r\n {\r\n TemporalNot(i, P);\r\n var k := earliestStep(i, not(P));\r\n assert k != i;\r\n assert sat(k-1, not(not(P)));\r\n assert sat(k, not(P));\r\n if k > j + 1\r\n {\r\n assert i <= j + 1 < k ==> !sat(j, not(P));\r\n TemporalDeduceFromAlways(i, j, imply(and(P, nextafter(action, rt, timefun)), Q));\r\n step := j;\r\n }\r\n else\r\n {\r\n assert i < k;\r\n TemporalDeduceFromAlways(i, k-1, imply(P, or(Q, next(P))));\r\n assert !sat(k-1, next(P));\r\n assert sat(k-1, Q);\r\n step := k - 1;\r\n }\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Native/Io.s.dfy", "content": "include \"NativeTypes.s.dfy\"\r\ninclude \"../Framework/Environment.s.dfy\"\r\n\r\nmodule Native__Io_s {\r\nimport opened Native__NativeTypes_s\r\nimport opened Environment_s\r\n\r\nclass HostEnvironment\r\n{\r\n ghost var ok:OkState;\r\n ghost var now:NowState;\r\n ghost var net:NetState;\r\n ghost var files:FileSystemState;\r\n\r\n constructor{:axiom} () requires false\r\n\r\n predicate Valid()\r\n reads this\r\n {\r\n true\r\n }\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Failure\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\n// not failed; IO operations only allowed when ok() == true\r\nclass OkState\r\n{\r\n constructor{:axiom} () requires false\r\n function{:axiom} ok():bool reads this\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Print parameters\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\nclass PrintParams\r\n{\r\n constructor{:axiom} () requires false\r\n static function method{:axiom} ShouldPrintProfilingInfo() : bool\r\n static function method{:axiom} ShouldPrintProgress() : bool\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Time\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\n// current local real time in milliseconds\r\n// (current actually means \"current as of last waiting operation or call to GetTime\")\r\nclass NowState\r\n{\r\n constructor{:axiom} () requires false\r\n function{:axiom} now():int reads this\r\n}\r\n\r\n// maximum assumed time taken by any non-waiting code (in milliseconds)\r\nfunction{:axiom} realTimeBound():int\r\npredicate AdvanceTime(oldTime:int, newTime:int, delay:int) { oldTime <= newTime < oldTime + delay + realTimeBound() }\r\n\r\nclass Time\r\n{\r\n static method{:axiom} GetTime(ghost env:HostEnvironment) returns(t:uint64)\r\n requires env.Valid()\r\n modifies env.now // To avoid contradiction, GetTime must advance time, because successive calls to GetTime can return different values\r\n modifies env.net\r\n ensures t as int == env.now.now()\r\n ensures AdvanceTime(old(env.now.now()), env.now.now(), 0)\r\n ensures env.net.history() == old(env.net.history()) + [LIoOpReadClock(t as int)]\r\n\r\n // Used for performance debugging\r\n static method{:axiom} GetDebugTimeTicks() returns(t:uint64)\r\n static method{:axiom} RecordTiming(name:array, time:uint64)\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Networking\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\ndatatype EndPoint = EndPoint(public_key:seq)\r\n // NetPacket_ctor has silly name to ferret out backwards calls\r\ntype NetPacket = LPacket>\r\ntype NetEvent = LIoOp>\r\n\r\nfunction MaxPacketSize() : int { 0xFFFF_FFFF_FFFF_FFFF }\r\n\r\npredicate ValidPhysicalAddress(endPoint:EndPoint)\r\n{\r\n |endPoint.public_key| < 0x10_0000 // < 1 MB\r\n}\r\n \r\npredicate ValidPhysicalPacket(p:LPacket>)\r\n{\r\n && ValidPhysicalAddress(p.src)\r\n && ValidPhysicalAddress(p.dst)\r\n && |p.msg| <= MaxPacketSize()\r\n}\r\n \r\npredicate ValidPhysicalIo(io:LIoOp>)\r\n{\r\n && (io.LIoOpReceive? ==> ValidPhysicalPacket(io.r))\r\n && (io.LIoOpSend? ==> ValidPhysicalPacket(io.s))\r\n}\r\n\r\nclass NetState\r\n{\r\n constructor{:axiom} () requires false\r\n function{:axiom} history():seq reads this\r\n}\r\n\r\nclass NetClient\r\n{\r\n ghost var env:HostEnvironment\r\n function method{:axiom} MyPublicKey():seq reads this\r\n function{:axiom} IsOpen():bool reads this\r\n constructor{:axiom} () requires false\r\n\r\n method{:axiom} Close() returns(ok:bool)\r\n requires env.Valid()\r\n requires env.ok.ok()\r\n requires this.IsOpen()\r\n modifies this\r\n modifies env.ok\r\n ensures env == old(env)\r\n ensures env.ok.ok() == ok\r\n\r\n method{:axiom} Receive(timeLimit:int32) returns(ok:bool, timedOut:bool, remote:seq, buffer:array)\r\n requires env.Valid()\r\n requires env.ok.ok()\r\n requires IsOpen()\r\n requires timeLimit >= 0\r\n requires (timeLimit as int) * 1000 < 0x80000000 // only needed when the underlying implementation uses Socket.Poll instead of Task.Wait\r\n modifies this\r\n modifies env.ok\r\n modifies env.now\r\n modifies env.net\r\n ensures env == old(env)\r\n ensures env.ok.ok() == ok\r\n ensures AdvanceTime(old(env.now.now()), env.now.now(), timeLimit as int)\r\n ensures MyPublicKey() == old(MyPublicKey())\r\n ensures ok ==> IsOpen()\r\n ensures ok ==> timedOut ==> env.net.history() == old(env.net.history()) + [LIoOpTimeoutReceive()]\r\n ensures ok ==> !timedOut ==>\r\n && fresh(buffer)\r\n && env.net.history() == old(env.net.history()) +\r\n [LIoOpReceive(LPacket(EndPoint(MyPublicKey()), EndPoint(remote), buffer[..]))]\r\n && ValidPhysicalAddress(EndPoint(remote))\r\n && buffer.Length <= MaxPacketSize()\r\n\r\n method{:axiom} Send(remote:seq, buffer:array) returns(ok:bool)\r\n requires env.Valid()\r\n requires env.ok.ok()\r\n requires IsOpen()\r\n requires buffer.Length <= MaxPacketSize()\r\n modifies this\r\n modifies env.ok\r\n modifies env.net\r\n ensures env == old(env)\r\n ensures env.ok.ok() == ok\r\n ensures MyPublicKey() == old(MyPublicKey())\r\n ensures ok ==> IsOpen()\r\n ensures ok ==> env.net.history() == old(env.net.history()) + [LIoOpSend(LPacket(EndPoint(remote), EndPoint(MyPublicKey()), buffer[..]))]\r\n}\r\n\r\n// jonh temporarily neutered this because the opaque type can't be compiled\r\nclass FileSystemState\r\n{\r\n}\r\n\r\nclass MutableSet\r\n{\r\n static function method {:axiom} SetOf(s:MutableSet) : set\r\n reads s\r\n\r\n static method {:axiom} EmptySet() returns (s:MutableSet)\r\n ensures SetOf(s) == {}\r\n ensures fresh(s);\r\n\r\n constructor{:axiom} () requires false\r\n\r\n method {:axiom} Size() returns (size:int) \r\n ensures size == |SetOf(this)|\r\n\r\n method {:axiom} SizeModest() returns (size:uint64) \r\n requires |SetOf(this)| < 0x1_0000_0000_0000_0000\r\n ensures size as int == |SetOf(this)|\r\n\r\n method {:axiom} Contains(x:T) returns (contains:bool)\r\n ensures contains == (x in SetOf(this))\r\n\r\n method {:axiom} Add(x:T) \r\n modifies this\r\n ensures SetOf(this) == old(SetOf(this)) + {x}\r\n\r\n method {:axiom} AddSet(s:MutableSet) \r\n modifies this\r\n ensures SetOf(this) == old(SetOf(this)) + old(SetOf(s))\r\n\r\n method {:axiom} TransferSet(s:MutableSet) \r\n modifies this\r\n modifies s\r\n ensures SetOf(this) == old(SetOf(s))\r\n ensures SetOf(s) == {}\r\n\r\n method {:axiom} Remove(x:T) \r\n modifies this\r\n ensures SetOf(this) == old(SetOf(this)) - {x}\r\n\r\n method {:axiom} RemoveAll()\r\n modifies this\r\n ensures SetOf(this) == {}\r\n}\r\n\r\nfunction KVTupleSeqToMap(kvs: seq<(K, V)>) : (m: map)\r\n ensures forall k, v :: (k, v) in kvs ==> k in m\r\n ensures forall k :: k in m ==> (k, m[k]) in kvs\r\n{\r\n if |kvs| == 0 then\r\n map []\r\n else\r\n var kvs_prefix := kvs[..|kvs|-1];\r\n var m_prefix := KVTupleSeqToMap(kvs_prefix);\r\n var kv_last := kvs[|kvs|-1];\r\n m_prefix[kv_last.0 := kv_last.1]\r\n}\r\n\r\nclass MutableMap\r\n{\r\n static function method {:axiom} MapOf(m:MutableMap) : map\r\n reads m\r\n\r\n static method {:axiom} EmptyMap() returns (m:MutableMap)\r\n ensures MapOf(m) == map []\r\n ensures fresh(m);\r\n\r\n static method {:axiom} FromMap(dafny_map:map) returns (m:MutableMap)\r\n ensures MapOf(m) == dafny_map\r\n ensures fresh(m)\r\n\r\n static method {:axiom} FromKVTuples(kvs:seq<(K, V)>) returns (m:MutableMap)\r\n ensures MapOf(m) == KVTupleSeqToMap(kvs)\r\n\r\n constructor{:axiom} () requires false\r\n\r\n function method {:axiom} Size() : int\r\n reads this\r\n ensures this.Size() == |MapOf(this)|\r\n\r\n method {:axiom} SizeModest() returns (size:uint64) \r\n requires |MapOf(this)| < 0x1_0000_0000_0000_0000\r\n ensures size as int == |MapOf(this)|\r\n\r\n method {:axiom} Contains(key:K) returns (contains:bool)\r\n ensures contains == (key in MapOf(this))\r\n\r\n method {:axiom} TryGetValue(key:K) returns (contains:bool, val:V)\r\n ensures contains == (key in MapOf(this))\r\n ensures contains ==> val == MapOf(this)[key]\r\n\r\n method {:axiom} Set(key:K, val:V) \r\n modifies this\r\n ensures MapOf(this) == old(MapOf(this))[key := val]\r\n\r\n method {:axiom} Remove(key:K) \r\n modifies this\r\n ensures MapOf(this) == old(MapOf(this)) - { key }\r\n\r\n method {:axiom} AsKVTuples() returns (kvs:seq<(K, V)>)\r\n ensures |kvs| == |MapOf(this).Keys|\r\n ensures forall k :: k in MapOf(this) ==> (k, MapOf(this)[k]) in kvs\r\n ensures forall k, v :: (k, v) in kvs ==> k in MapOf(this) && MapOf(this)[k] == v\r\n}\r\n\r\n// Leverage .NET's ability to perform copies faster than one element at a time\r\nclass Arrays\r\n{\r\n static method{:axiom} CopySeqIntoArray(src:seq, srcIndex:uint64, dst:array, dstIndex:uint64, len:uint64)\r\n requires (srcIndex as int) + (len as int) <= |src|\r\n requires (dstIndex as int) + (len as int) <= dst.Length\r\n modifies dst\r\n ensures forall i :: 0 <= i < dst.Length ==> dst[i] == (\r\n if dstIndex as int <= i < (dstIndex as int) + (len as int)\r\n then src[i - (dstIndex as int) + (srcIndex as int)]\r\n else old(dst[..])[i])\r\n ensures forall i :: srcIndex as int <= i < (srcIndex as int) + (len as int) ==>\r\n src[i] == dst[i - (srcIndex as int) + (dstIndex as int)]\r\n}\r\n\r\n/*\r\n//////////////////////////////////////////////////////////////////////////////\r\n// File System\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\ntype FileSystem\r\n\r\ndatatype FileOp =\r\n FileRead(fileReadOffset:int, fileReadBytes:seq)\r\n| FileWrite(fileWriteOffset:int, fileWriteBytes:seq)\r\n| FileFlush\r\n\r\nclass FileSystemState\r\n{\r\n constructor{:axiom} () requires false;\r\n function{:axiom} state():FileSystem reads this;\r\n}\r\n\r\nfunction{:axiom} FileOpRequires(fs:FileSystem, fileName:string, op:FileOp):bool\r\nfunction{:axiom} FileOpEnsures(fsOld:FileSystem, fsNew:FileSystem, fileName:string, op:FileOp):bool\r\n\r\nclass FileStream\r\n{\r\n ghost var env:HostEnvironment;\r\n function{:axiom} Name():string reads this;\r\n function{:axiom} IsOpen():bool reads this;\r\n constructor{:axiom} () requires false;\r\n\r\n static method{:axiom} Open(name:array, ghost env:HostEnvironment)\r\n returns(ok:bool, f:FileStream)\r\n requires env.Valid();\r\n requires env.ok.ok();\r\n requires name != null;\r\n modifies env.ok;\r\n ensures env.ok.ok() == ok;\r\n ensures ok ==> f != null && fresh(f) && f.env == env && f.IsOpen() && f.Name() == name[..];\r\n\r\n method{:axiom} Close() returns(ok:bool)\r\n requires env.Valid();\r\n requires env.ok.ok();\r\n requires IsOpen();\r\n modifies this;\r\n modifies env.ok;\r\n ensures env == old(env);\r\n ensures env.ok.ok() == ok;\r\n\r\n method{:axiom} Read(fileOffset:nat32, buffer:array, start:int32, end:int32) returns(ok:bool)\r\n requires env.Valid();\r\n requires env.ok.ok();\r\n requires IsOpen();\r\n requires buffer != null;\r\n requires 0 <= start as int <= end as int <= buffer.Length;\r\n requires FileOpRequires(env.files.state(), Name(), FileRead(fileOffset as int, buffer[start..end]));\r\n modifies this;\r\n modifies env.ok;\r\n modifies env.files;\r\n modifies buffer;\r\n ensures env == old(env);\r\n ensures env.ok.ok() == ok;\r\n ensures Name() == old(Name());\r\n ensures forall i:int :: 0 <= i < buffer.Length && !(start as int <= i < end as int) ==> buffer[i] == old(buffer[i]);\r\n ensures ok ==> IsOpen();\r\n ensures ok ==> FileOpEnsures(old(env.files.state()), env.files.state(), Name(), FileRead(fileOffset as int, buffer[start..end]));\r\n\r\n method{:axiom} Write(fileOffset:nat32, buffer:array, start:int32, end:int32) returns(ok:bool)\r\n requires env.Valid();\r\n requires env.ok.ok();\r\n requires IsOpen();\r\n requires buffer != null;\r\n requires 0 <= start as int <= end as int <= buffer.Length;\r\n requires FileOpRequires(env.files.state(), Name(), FileWrite(fileOffset as int, buffer[start..end]));\r\n modifies this;\r\n modifies env.ok;\r\n modifies env.files;\r\n ensures env == old(env);\r\n ensures env.ok.ok() == ok;\r\n ensures Name() == old(Name());\r\n ensures ok ==> IsOpen();\r\n ensures ok ==> FileOpEnsures(old(env.files.state()), env.files.state(), Name(), FileWrite(fileOffset as int, buffer[start..end]));\r\n\r\n method{:axiom} Flush() returns(ok:bool)\r\n requires env.Valid();\r\n requires env.ok.ok();\r\n requires IsOpen();\r\n requires FileOpRequires(env.files.state(), Name(), FileFlush);\r\n modifies this;\r\n modifies env.ok;\r\n modifies env.files;\r\n ensures env == old(env);\r\n ensures env.ok.ok() == ok;\r\n ensures Name() == old(Name());\r\n ensures ok ==> IsOpen();\r\n ensures ok ==> FileOpEnsures(old(env.files.state()), env.files.state(), Name(), FileFlush);\r\n}\r\n\r\n*/\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Native/IoFramework.cs", "content": "using System;\nusing System.Collections;\nusing System.Collections.Concurrent;\nusing System.Collections.Generic;\nusing System.IO;\nusing System.Linq;\nusing System.Net;\nusing System.Net.Security;\nusing System.Net.Sockets;\nusing System.Text;\nusing System.Text.Json;\nusing System.Threading;\nusing System.Threading.Tasks.Dataflow;\nusing System.Security.Cryptography;\nusing System.Security.Cryptography.X509Certificates;\n\nnamespace IronfleetIoFramework\n{\n public class PrivateIdentity\n {\n public string FriendlyName { get; set; }\n public byte[] Pkcs12 { get; set; }\n public string HostNameOrAddress { get; set; }\n public int Port { get; set; }\n\n public bool WriteToFile (string fileName)\n {\n string json;\n\n try {\n json = JsonSerializer.Serialize(this);\n }\n catch (Exception e) {\n Console.Error.WriteLine(\"Could not serialize private key data for {0}. Exception:\\n{1}\", FriendlyName, e);\n return false;\n }\n\n try {\n File.WriteAllText(fileName, json);\n }\n catch (Exception e) {\n Console.Error.WriteLine(\"Could not create file {0}. Exception:\\n{1}\", fileName, e);\n return false;\n }\n\n return true;\n }\n\n public static PrivateIdentity ReadFromFile(string fileName)\n {\n string json;\n\n try {\n json = File.ReadAllText(fileName);\n }\n catch (Exception) {\n Console.Error.WriteLine(\"ERROR - Could not read contents of private key file {0}\", fileName);\n return null;\n }\n\n PrivateIdentity privateIdentity;\n try {\n privateIdentity = JsonSerializer.Deserialize(json);\n }\n catch (Exception e) {\n Console.Error.WriteLine(\"Could not deserialize contents of private key file {0}. Exception:\\n{1}\", fileName, e);\n return null;\n }\n\n return privateIdentity;\n }\n }\n\n public class PublicIdentity\n {\n public string FriendlyName { get; set; }\n public byte[] PublicKey { get; set; }\n public string HostNameOrAddress { get; set; }\n public int Port { get; set; }\n }\n\n public class ServiceIdentity\n {\n public string FriendlyName { get; set; }\n public string ServiceType { get; set; }\n public List Servers { get; set; }\n public bool UseSsl { get; set; }\n\n public bool WriteToFile(string fileName)\n {\n string json;\n\n try {\n json = JsonSerializer.Serialize(this);\n }\n catch (Exception e) {\n Console.Error.WriteLine(\"Could not serialize service identity. Exception:\\n{0}\", e);\n return false;\n }\n\n try {\n File.WriteAllText(fileName, json);\n }\n catch (Exception e) {\n Console.Error.WriteLine(\"Could not write service identity to file {0}. Exception:\\n{1}\", fileName, e);\n return false;\n }\n\n return true;\n }\n\n public static ServiceIdentity ReadFromFile(string fileName)\n {\n string json;\n\n try {\n json = File.ReadAllText(fileName);\n }\n catch (Exception) {\n Console.Error.WriteLine(\"ERROR - Could not read contents of service file {0}\", fileName);\n return null;\n }\n\n ServiceIdentity serviceIdentity;\n try {\n serviceIdentity = JsonSerializer.Deserialize(json);\n }\n catch (Exception e) {\n Console.Error.WriteLine(\"Could not deserialize contents of service file {0}. Exception:\\n{1}\", fileName, e);\n return null;\n }\n\n return serviceIdentity;\n }\n }\n\n public class ByteArrayComparer : IEqualityComparer\n {\n private static ByteArrayComparer staticDefault;\n\n public static ByteArrayComparer Default()\n {\n if (staticDefault == null) {\n staticDefault = new ByteArrayComparer();\n }\n return staticDefault;\n }\n\n public bool Equals (byte[] a1, byte[] a2)\n {\n return StructuralComparisons.StructuralEqualityComparer.Equals(a1, a2);\n }\n\n public int GetHashCode(byte[] a)\n {\n return StructuralComparisons.StructuralEqualityComparer.GetHashCode(a);\n }\n }\n\n public class IronfleetCrypto\n {\n public static void CreateNewIdentity(string friendlyName, string hostNameOrAddress, int port,\n out PublicIdentity publicIdentity, out PrivateIdentity privateIdentity)\n {\n var key = RSA.Create(4096);\n var subject = string.Format(\"CN = {0}\", friendlyName);\n var req = new CertificateRequest(subject, key, HashAlgorithmName.SHA256, RSASignaturePadding.Pss);\n var now = DateTime.Now;\n var expiry = now.AddYears(10);\n var cert = req.CreateSelfSigned(now, expiry);\n var pkcs12 = cert.Export(X509ContentType.Pkcs12, \"\" /* empty password */);\n\n publicIdentity = new PublicIdentity {\n FriendlyName = friendlyName,\n PublicKey = IoScheduler.GetCertificatePublicKey(cert),\n HostNameOrAddress = hostNameOrAddress,\n Port = port\n };\n privateIdentity = new PrivateIdentity {\n FriendlyName = friendlyName,\n Pkcs12 = pkcs12,\n HostNameOrAddress = hostNameOrAddress,\n Port = port\n };\n }\n\n public static X509Certificate2 CreateTransientClientIdentity ()\n {\n var key = RSA.Create(2048);\n var req = new CertificateRequest(\"CN = client\", key, HashAlgorithmName.SHA256, RSASignaturePadding.Pss);\n var now = DateTime.Now;\n var expiry = now.AddYears(1);\n var cert = req.CreateSelfSigned(now, expiry);\n // On Linux, it's OK to just return cert. But on Windows, we need the following\n // code to allow it to be used to authenticate a client.\n return new X509Certificate2(cert.Export(X509ContentType.Pkcs12));\n }\n }\n\n public class IoEncoder\n {\n private static int MAX_IO_SIZE = 0x80_0000 /* 8 MB */;\n\n public static bool ReadBytes(Stream stream, byte[] buf, int offset, UInt64 byteCount)\n {\n UInt64 bytesRead = 0;\n while (bytesRead < byteCount)\n {\n int bytesToRead = (byteCount - bytesRead > (UInt64)(MAX_IO_SIZE)) ? MAX_IO_SIZE : (int)(byteCount - bytesRead);\n int additionalBytesRead = stream.Read(buf, offset + (int)bytesRead, bytesToRead);\n if (additionalBytesRead == 0) {\n return false;\n }\n bytesRead += (UInt64)additionalBytesRead;\n }\n return true;\n }\n\n public static void WriteBytes(Stream stream, byte[] buf, int offset, UInt64 byteCount)\n {\n UInt64 bytesWritten = 0;\n while (bytesWritten < byteCount)\n {\n int bytesToWrite = (byteCount - bytesWritten > (UInt64)(MAX_IO_SIZE)) ? MAX_IO_SIZE : (int)(byteCount - bytesWritten);\n stream.Write(buf, offset + (int)bytesWritten, bytesToWrite);\n bytesWritten += (UInt64)(bytesToWrite);\n }\n }\n\n public static UInt64 ExtractUInt64(byte[] bytes, int offset)\n {\n byte[] extractedBytes = bytes.Skip(offset).Take(8).ToArray();\n if (BitConverter.IsLittleEndian) {\n Array.Reverse(extractedBytes);\n }\n return BitConverter.ToUInt64(extractedBytes, 0);\n }\n\n public static UInt32 ExtractUInt32(byte[] bytes, int offset)\n {\n byte[] extractedBytes = bytes.Skip(offset).Take(4).ToArray();\n if (BitConverter.IsLittleEndian) {\n Array.Reverse(extractedBytes);\n }\n return BitConverter.ToUInt32(extractedBytes, 0);\n }\n\n public static Int32 ExtractInt32(byte[] bytes, int offset)\n {\n byte[] extractedBytes = bytes.Skip(offset).Take(4).ToArray();\n if (BitConverter.IsLittleEndian) {\n Array.Reverse(extractedBytes);\n }\n return BitConverter.ToInt32(extractedBytes, 0);\n }\n\n public static void WriteUInt64(Stream stream, UInt64 value)\n {\n var bytes = BitConverter.GetBytes(value);\n if (BitConverter.IsLittleEndian) {\n Array.Reverse(bytes);\n }\n WriteBytes(stream, bytes, 0, 8);\n }\n\n public static void WriteUInt32(Stream stream, UInt32 value)\n {\n var bytes = BitConverter.GetBytes(value);\n if (BitConverter.IsLittleEndian) {\n Array.Reverse(bytes);\n }\n WriteBytes(stream, bytes, 0, 4);\n }\n\n public static void WriteInt32(Stream stream, Int32 value)\n {\n var bytes = BitConverter.GetBytes(value);\n if (BitConverter.IsLittleEndian) {\n Array.Reverse(bytes);\n }\n WriteBytes(stream, bytes, 0, 4);\n }\n\n public static bool ReadUInt64(Stream stream, out UInt64 value)\n {\n byte[] buf8 = new byte[8];\n bool success = ReadBytes(stream, buf8, 0, 8);\n if (success) {\n if (BitConverter.IsLittleEndian) {\n Array.Reverse(buf8);\n }\n value = BitConverter.ToUInt64(buf8);\n }\n else {\n value = 0;\n }\n return success;\n }\n\n public static bool ReadUInt32(Stream stream, out UInt32 value)\n {\n byte[] buf4 = new byte[4];\n bool success = ReadBytes(stream, buf4, 0, 4);\n if (success) {\n if (BitConverter.IsLittleEndian) {\n Array.Reverse(buf4);\n }\n value = BitConverter.ToUInt32(buf4);\n }\n else {\n value = 0;\n }\n return success;\n }\n\n public static bool ReadInt32(Stream stream, out Int32 value)\n {\n byte[] buf4 = new byte[4];\n bool success = ReadBytes(stream, buf4, 0, 4);\n if (success) {\n if (BitConverter.IsLittleEndian) {\n Array.Reverse(buf4);\n }\n value = BitConverter.ToInt32(buf4);\n }\n else {\n value = 0;\n }\n return success;\n }\n }\n\n public class ReceivedPacket\n {\n public byte[] senderKeyHash { get; }\n public byte[] message { get; }\n\n public ReceivedPacket(byte[] i_senderKeyHash, byte[] i_message)\n {\n senderKeyHash = i_senderKeyHash;\n message = i_message;\n }\n }\n\n public class SendTask\n {\n public byte[] destinationPublicKeyHash { get; }\n public byte[] message { get; }\n private int numTriesSoFar;\n\n public SendTask(byte[] i_destinationPublicKeyHash, byte[] i_message)\n {\n destinationPublicKeyHash = i_destinationPublicKeyHash;\n message = i_message;\n numTriesSoFar = 0;\n }\n\n public int IncrementNumTriesSoFar()\n {\n numTriesSoFar++;\n return numTriesSoFar;\n }\n }\n\n public class CertificateValidator\n {\n private IoScheduler scheduler;\n private PublicIdentity expectedPublicIdentity;\n\n public CertificateValidator(IoScheduler i_scheduler, PublicIdentity i_expectedPublicIdentity = null)\n {\n scheduler = i_scheduler;\n expectedPublicIdentity = i_expectedPublicIdentity;\n }\n\n public bool ValidateSSLCertificate(object sender, X509Certificate certificate, X509Chain chain,\n SslPolicyErrors sslPolicyErrors)\n {\n const SslPolicyErrors ignoredErrors = SslPolicyErrors.RemoteCertificateChainErrors;\n\n if ((sslPolicyErrors & ~ignoredErrors) != SslPolicyErrors.None) {\n Console.Error.WriteLine(\"Could not validate SSL certificate for {0} due to errors {1}\",\n IoScheduler.GetCertificatePublicKey(certificate as X509Certificate2),\n sslPolicyErrors & ~ignoredErrors);\n return false;\n }\n\n var cert2 = certificate as X509Certificate2;\n\n // If we were expecting a specific public identity, check that\n // the key in the certificate matches what we were expecting.\n\n if (expectedPublicIdentity != null) {\n if (!ByteArrayComparer.Default().Equals(IoScheduler.GetCertificatePublicKey(cert2), expectedPublicIdentity.PublicKey)) {\n Console.Error.WriteLine(\"Connected to {0} expecting public key {1} but found public key {2}, so disconnecting.\",\n IoScheduler.PublicIdentityToString(expectedPublicIdentity),\n IoScheduler.PublicKeyToString(expectedPublicIdentity.PublicKey),\n IoScheduler.PublicKeyToString(IoScheduler.GetCertificatePublicKey(cert2)));\n return false;\n }\n\n if (cert2.SubjectName.Name != \"CN=\" + expectedPublicIdentity.FriendlyName) {\n Console.Error.WriteLine(\"Connected to {0} expecting subject CN={1} but found {2}, so disconnecting.\",\n IoScheduler.PublicIdentityToString(expectedPublicIdentity),\n expectedPublicIdentity.FriendlyName,\n cert2.SubjectName.Name);\n return false;\n }\n }\n else {\n // If we weren't expecting any particular public identity,\n // consider the expected public identity to be the known one\n // matching the public key in the certificate we got. If\n // there is no known one, then this is just an anonymous\n // client, which is fine. Otherwise, check that the subject\n // matches what we expect. This is just a paranoid check; it\n // should never fail.\n\n expectedPublicIdentity = scheduler.LookupPublicKeyHash(scheduler.HashPublicKey(IoScheduler.GetCertificatePublicKey(cert2)));\n if (expectedPublicIdentity != null) {\n if (cert2.SubjectName.Name != \"CN=\" + expectedPublicIdentity.FriendlyName) {\n Console.Error.WriteLine(\"Received a certificate we expected to have subject CN={1} but found {2}, so disconnecting.\",\n IoScheduler.PublicIdentityToString(expectedPublicIdentity),\n expectedPublicIdentity.FriendlyName,\n cert2.SubjectName.Name);\n return false;\n }\n }\n }\n\n return true;\n }\n }\n\n public class ReceiverThread\n {\n private IoScheduler scheduler;\n private Stream stream;\n private byte[] remoteKeyHash;\n\n private ReceiverThread(IoScheduler i_scheduler, byte[] i_remoteKeyHash, Stream i_stream)\n {\n scheduler = i_scheduler;\n stream = i_stream;\n remoteKeyHash = i_remoteKeyHash;\n }\n\n public void Run()\n {\n try\n {\n ReceiveLoop();\n }\n catch (Exception e)\n {\n scheduler.ReportException(e, \"receiving from \" + scheduler.LookupPublicKeyHashAsString(remoteKeyHash));\n }\n }\n\n public static ReceiverThread Create(IoScheduler scheduler, byte[] remoteKeyHash, Stream stream)\n {\n ReceiverThread receiverThread = new ReceiverThread(scheduler, remoteKeyHash, stream);\n Thread t = new Thread(receiverThread.Run);\n t.Start();\n return receiverThread;\n }\n\n private void ReceiveLoop()\n {\n bool success;\n\n if (scheduler.Verbose) {\n Console.WriteLine(\"Starting receive loop with remote identified as {0}\", scheduler.LookupPublicKeyHashAsString(remoteKeyHash));\n }\n\n while (true)\n {\n // Read the next message's size.\n\n UInt64 messageSize;\n success = IoEncoder.ReadUInt64(stream, out messageSize);\n if (!success) {\n if (scheduler.Verbose) {\n Console.Error.WriteLine(\"Failed to receive message size from {0}\", scheduler.LookupPublicKeyHashAsString(remoteKeyHash));\n }\n return;\n }\n if (scheduler.Verbose) {\n Console.WriteLine(\"Received message size {0} from {1}\", messageSize, scheduler.LookupPublicKeyHashAsString(remoteKeyHash));\n }\n\n byte[] messageBuf = new byte[messageSize];\n success = IoEncoder.ReadBytes(stream, messageBuf, 0, messageSize);\n if (!success) {\n if (scheduler.Verbose) {\n Console.Error.WriteLine(\"Failed to receive message of size {0} from {1}\",\n messageSize, scheduler.LookupPublicKeyHashAsString(remoteKeyHash));\n }\n return;\n }\n if (scheduler.Verbose) {\n Console.WriteLine(\"Received message of size {0} from {1}\", messageSize, scheduler.LookupPublicKeyHashAsString(remoteKeyHash));\n }\n\n ReceivedPacket packet = new ReceivedPacket(remoteKeyHash, messageBuf);\n scheduler.NoteReceivedPacket(packet);\n }\n }\n }\n\n public abstract class SenderThread\n {\n protected IoScheduler scheduler;\n protected byte[] destinationPublicKeyHash;\n protected Stream stream;\n private BufferBlock sendQueue;\n private SendTask currentSendTask;\n\n protected SenderThread(IoScheduler i_scheduler, byte[] i_destinationPublicKeyHash, Stream i_stream)\n {\n scheduler = i_scheduler;\n destinationPublicKeyHash = i_destinationPublicKeyHash;\n stream = i_stream;\n sendQueue = new BufferBlock();\n currentSendTask = null;\n }\n\n protected string EndpointDescription()\n {\n return scheduler.LookupPublicKeyHashAsString(destinationPublicKeyHash);\n }\n \n protected abstract bool Connect();\n\n public void Start()\n {\n scheduler.RegisterSender(destinationPublicKeyHash, this);\n Thread t = new Thread(this.Run);\n t.Start();\n }\n\n private void Run()\n {\n try\n {\n if (Connect()) {\n SendLoop();\n }\n }\n catch (Exception e)\n {\n scheduler.ReportException(e, \"sending to \" + EndpointDescription());\n }\n\n scheduler.UnregisterSender(destinationPublicKeyHash, this);\n\n // If we crashed in the middle of sending a packet, re-queue it\n // for sending by another sender thread.\n \n if (currentSendTask != null) {\n scheduler.ResendPacket(currentSendTask);\n currentSendTask = null;\n }\n\n // If there are packets queued for us to send, re-queue them\n // for sending by another sender thread.\n\n while (sendQueue.TryReceive(out currentSendTask)) {\n scheduler.ResendPacket(currentSendTask);\n currentSendTask = null;\n }\n }\n\n private void SendLoop()\n {\n if (scheduler.Verbose) {\n Console.WriteLine(\"Starting send loop with {0}\", EndpointDescription());\n }\n\n while (true)\n {\n // Wait for there to be a packet to send.\n\n currentSendTask = sendQueue.Receive();\n\n // Send its length as an 8-byte value.\n\n UInt64 messageSize = (UInt64)currentSendTask.message.Length;\n IoEncoder.WriteUInt64(stream, messageSize);\n if (scheduler.Verbose) {\n Console.WriteLine(\"Sent message size {0} to {1}\", messageSize, EndpointDescription());\n }\n\n // Send its contents.\n\n IoEncoder.WriteBytes(stream, currentSendTask.message, 0, messageSize);\n if (scheduler.Verbose) {\n Console.WriteLine(\"Sent message of size {0} to {1}\", messageSize, EndpointDescription());\n }\n\n // Set the currentSendTask to null so we know we don't have to\n // resend it if the connection fails.\n\n currentSendTask = null;\n }\n }\n\n public void EnqueueSendTask(SendTask sendTask)\n {\n sendQueue.Post(sendTask);\n }\n }\n\n public class ServerSenderThread : SenderThread\n {\n private ServerSenderThread(IoScheduler i_scheduler, byte[] i_destinationPublicKeyHash, Stream i_stream) :\n base(i_scheduler, i_destinationPublicKeyHash, i_stream)\n {\n }\n\n public static ServerSenderThread Create(IoScheduler scheduler, byte[] destinationPublicKeyHash, Stream stream)\n {\n if (scheduler.Verbose) {\n Console.WriteLine(\"Creating sender thread to send to remote {0}\",\n scheduler.LookupPublicKeyHashAsString(destinationPublicKeyHash));\n }\n\n ServerSenderThread senderThread = new ServerSenderThread(scheduler, destinationPublicKeyHash, stream);\n senderThread.Start();\n return senderThread;\n }\n\n protected override bool Connect()\n {\n // There's nothing to do since server sender threads start out connected.\n return true;\n }\n }\n\n public class ClientSenderThread : SenderThread\n {\n protected bool useSsl;\n\n private ClientSenderThread(IoScheduler i_scheduler, byte[] i_destinationPublicKeyHash, bool i_useSsl) :\n base(i_scheduler, i_destinationPublicKeyHash, null)\n {\n useSsl = i_useSsl;\n }\n\n public static ClientSenderThread Create(IoScheduler scheduler, byte[] destinationPublicKeyHash, bool useSsl)\n {\n if (scheduler.Verbose) {\n Console.WriteLine(\"Creating sender thread to send to remote {0}\",\n scheduler.LookupPublicKeyHashAsString(destinationPublicKeyHash));\n }\n\n ClientSenderThread senderThread = new ClientSenderThread(scheduler, destinationPublicKeyHash, useSsl);\n senderThread.Start();\n return senderThread;\n }\n\n protected override bool Connect()\n {\n var destinationPublicIdentity = scheduler.LookupPublicKeyHash(destinationPublicKeyHash);\n if (destinationPublicIdentity == null) {\n if (scheduler.Verbose) {\n Console.Error.WriteLine(\"Could not connect to destination public key hash {0} because we don't know its address.\",\n System.Convert.ToBase64String(destinationPublicKeyHash));\n }\n return false;\n }\n\n if (scheduler.Verbose) {\n Console.WriteLine(\"Starting connection to {0}\", IoScheduler.PublicIdentityToString(destinationPublicIdentity));\n }\n\n TcpClient client;\n try\n {\n client = new TcpClient(destinationPublicIdentity.HostNameOrAddress, destinationPublicIdentity.Port);\n }\n catch (Exception e)\n {\n scheduler.ReportException(e, \"connecting to \" + IoScheduler.PublicIdentityToString(destinationPublicIdentity));\n return false;\n }\n\n if (useSsl) {\n var myCertificateCollection = new X509CertificateCollection();\n myCertificateCollection.Add(scheduler.MyCert);\n var myValidator = new CertificateValidator(scheduler, destinationPublicIdentity);\n SslStream s;\n\n try {\n s = new SslStream(client.GetStream(), leaveInnerStreamOpen: false, myValidator.ValidateSSLCertificate);\n s.AuthenticateAsClient(destinationPublicIdentity.FriendlyName, myCertificateCollection,\n checkCertificateRevocation: false);\n }\n catch (Exception e) {\n scheduler.ReportException(e, \"authenticating connection to \" + IoScheduler.PublicIdentityToString(destinationPublicIdentity));\n return false;\n }\n\n var remoteCert = s.RemoteCertificate as X509Certificate2;\n\n if (!ByteArrayComparer.Default().Equals(IoScheduler.GetCertificatePublicKey(remoteCert), destinationPublicIdentity.PublicKey)) {\n Console.Error.WriteLine(\"Connected to {0} expecting public key {1} but found public key {2}, so disconnecting.\",\n IoScheduler.PublicIdentityToString(destinationPublicIdentity),\n IoScheduler.PublicKeyToString(destinationPublicIdentity.PublicKey),\n IoScheduler.PublicKeyToString(IoScheduler.GetCertificatePublicKey(remoteCert)));\n return false;\n }\n\n if (scheduler.Verbose) {\n Console.WriteLine(\"Successfully connected to {0} and got certificate identifying it as {1}\",\n IoScheduler.PublicIdentityToString(destinationPublicIdentity),\n IoScheduler.CertificateToString(remoteCert));\n }\n stream = (Stream) s;\n } else {\n stream = client.GetStream();\n var myKey = IoScheduler.GetCertificatePublicKey(scheduler.MyCert);\n if (scheduler.Verbose) {\n Console.WriteLine(\"Sending my public key {0} to {1}\", IoScheduler.PublicKeyToString(myKey),\n scheduler.LookupPublicKeyHashAsString(destinationPublicKeyHash));\n }\n IoEncoder.WriteUInt64(stream, (ulong) myKey.Length);\n IoEncoder.WriteBytes(stream, myKey, 0, (ulong) myKey.Length);\n\n if (scheduler.Verbose) {\n Console.WriteLine(\"Successfully connected to {0} without certificate\",\n IoScheduler.PublicIdentityToString(destinationPublicIdentity));\n }\n }\n\n // Now that the connection is successful, create a thread to\n // receive packets on it.\n\n ReceiverThread receiverThread = ReceiverThread.Create(scheduler, destinationPublicKeyHash, stream);\n return true;\n }\n }\n\n public class ListenerThread\n {\n private IoScheduler scheduler;\n private TcpListener listener;\n private IPEndPoint myEndpoint;\n private bool useSsl;\n\n public ListenerThread(IoScheduler i_scheduler, IPEndPoint i_myEndpoint, bool i_useSsl)\n {\n scheduler = i_scheduler;\n myEndpoint = i_myEndpoint;\n useSsl = i_useSsl;\n }\n\n public void Run()\n {\n while (true)\n {\n try\n {\n ListenLoop();\n }\n catch (Exception e)\n {\n Console.Error.WriteLine(\"Listener thread caught the following exception, so restarting:\\n{0}\", e);\n }\n }\n }\n\n private void ListenLoop()\n {\n if (scheduler.Verbose) {\n Console.WriteLine(\"Starting to listen on {0}\", myEndpoint);\n }\n\n listener = new TcpListener(myEndpoint);\n listener.ExclusiveAddressUse = true;\n listener.Start();\n while (true)\n {\n if (scheduler.Verbose) {\n Console.WriteLine(\"Waiting for the next incoming connection\");\n }\n\n TcpClient client = listener.AcceptTcpClient();\n Stream stream = client.GetStream();\n byte[] remoteKeyHash;\n\n if (useSsl) {\n CertificateValidator myValidator = new CertificateValidator(scheduler);\n SslStream sslStream = new SslStream(stream, leaveInnerStreamOpen: false, myValidator.ValidateSSLCertificate);\n sslStream.AuthenticateAsServer(scheduler.MyCert, clientCertificateRequired: true, checkCertificateRevocation: false);\n\n var remoteCert = sslStream.RemoteCertificate as X509Certificate2;\n\n stream = (Stream) sslStream;\n var key = IoScheduler.GetCertificatePublicKey(remoteCert);\n remoteKeyHash = scheduler.HashPublicKey(key); //Hash the key\n } else {\n UInt64 len;\n bool success;\n success = IoEncoder.ReadUInt64(stream, out len);\n if (!success) {\n Console.WriteLine(\"Failed to receive the length of public key from {0}\", client.Client.RemoteEndPoint.ToString());\n continue;\n }\n byte[] remoteKey = new byte[len];\n success = IoEncoder.ReadBytes(stream, remoteKey, 0, len);\n remoteKeyHash = scheduler.HashPublicKey(remoteKey); //Hash the key\n if (!success) {\n Console.WriteLine(\"Failed to receive public key from {0}\", client.Client.RemoteEndPoint.ToString());\n continue;\n }\n }\n\n if (scheduler.Verbose) {\n Console.WriteLine(\"Received an incoming connection from remote identity as {0}\",\n scheduler.LookupPublicKeyHashAsString(remoteKeyHash));\n }\n\n ReceiverThread.Create(scheduler, remoteKeyHash, stream);\n ServerSenderThread.Create(scheduler, remoteKeyHash, stream);\n }\n }\n }\n\n public class SendDispatchThread\n {\n private IoScheduler scheduler;\n private bool useSsl;\n private BufferBlock sendQueue;\n\n public SendDispatchThread(IoScheduler i_scheduler, bool i_useSsl)\n {\n scheduler = i_scheduler;\n useSsl = i_useSsl;\n sendQueue = new BufferBlock();\n }\n\n public void Run()\n {\n while (true)\n {\n try\n {\n SendDispatchLoop();\n }\n catch (Exception e)\n {\n Console.Error.WriteLine(\"Send dispatch thread caught the following exception, so restarting:\\n{0}\", e);\n }\n }\n }\n\n private void SendDispatchLoop()\n {\n while (true)\n {\n if (scheduler.Verbose) {\n Console.WriteLine(\"Waiting for the next send to dispatch\");\n }\n\n SendTask sendTask = sendQueue.Receive();\n\n if (scheduler.Verbose) {\n Console.WriteLine(\"Dispatching send of message of size {0} to {1}\",\n sendTask.message.Length, scheduler.LookupPublicKeyHashAsString(sendTask.destinationPublicKeyHash));\n }\n\n SenderThread senderThread = scheduler.FindSenderForDestinationPublicKeyHash(sendTask.destinationPublicKeyHash);\n\n if (senderThread == null) {\n senderThread = ClientSenderThread.Create(scheduler, sendTask.destinationPublicKeyHash, useSsl);\n }\n\n senderThread.EnqueueSendTask(sendTask);\n }\n }\n\n public void EnqueueSendTask(SendTask sendTask)\n {\n sendQueue.Post(sendTask);\n }\n }\n\n public class IoScheduler\n {\n private X509Certificate2 myCert;\n private bool onlyClient;\n private bool verbose;\n private bool useSsl;\n private int maxSendTries;\n private BufferBlock receiveQueue;\n private Dictionary> destinationPublicKeyHashToSenderThreadMap;\n private Dictionary publicKeyHashToPublicIdentityMap;\n private ListenerThread listenerThread;\n private SendDispatchThread sendDispatchThread;\n private SHA256 hasher;\n\n private IoScheduler(PrivateIdentity myIdentity, string localHostNameOrAddress, int localPort,\n List knownIdentities, bool i_verbose, bool i_useSsl, int i_maxSendTries = 3)\n {\n verbose = i_verbose;\n useSsl = i_useSsl;\n maxSendTries = i_maxSendTries;\n receiveQueue = new BufferBlock();\n destinationPublicKeyHashToSenderThreadMap = new Dictionary>(ByteArrayComparer.Default());\n publicKeyHashToPublicIdentityMap = new Dictionary(ByteArrayComparer.Default());\n hasher = SHA256.Create();\n\n foreach (var knownIdentity in knownIdentities) {\n publicKeyHashToPublicIdentityMap[HashPublicKey(knownIdentity.PublicKey)] = knownIdentity;\n }\n\n if (myIdentity == null) {\n StartClient();\n }\n else {\n StartServer(myIdentity, localHostNameOrAddress, localPort);\n }\n }\n\n public static IoScheduler CreateServer(PrivateIdentity myIdentity, string localHostNameOrAddress, int localPort,\n List knownIdentities, bool verbose, bool useSsl, \n int maxSendTries = 3)\n {\n return new IoScheduler(myIdentity, localHostNameOrAddress, localPort, knownIdentities, verbose, useSsl, maxSendTries);\n }\n\n public static IoScheduler CreateClient(List serverIdentities, bool verbose, bool useSsl, \n bool connectToAllServers = true, int maxSendTries = 3)\n {\n var scheduler = new IoScheduler(null, null, 0, serverIdentities, verbose, useSsl, maxSendTries);\n if (connectToAllServers) {\n foreach (var serverIdentity in serverIdentities) {\n scheduler.Connect(scheduler.HashPublicKey(serverIdentity.PublicKey));\n }\n }\n return scheduler;\n }\n\n private void StartServer(PrivateIdentity myIdentity, string localHostNameOrAddress, int localPort)\n {\n onlyClient = false;\n\n try {\n myCert = new X509Certificate2(myIdentity.Pkcs12, \"\" /* empty password */, X509KeyStorageFlags.Exportable);\n }\n catch (Exception e) {\n Console.Error.WriteLine(\"Could not import private key. Exception:{0}\", e);\n throw new Exception(\"Can't start server because private key not decryptable\");\n }\n\n // The `local` parameters override the parameters in\n // `myIdentity`, unless they're empty or zero.\n\n if (localHostNameOrAddress == null || localHostNameOrAddress.Length == 0) {\n localHostNameOrAddress = myIdentity.HostNameOrAddress;\n }\n if (localPort == 0) {\n localPort = myIdentity.Port;\n }\n\n var address = LookupHostNameOrAddress(localHostNameOrAddress);\n if (address == null) {\n Console.Error.WriteLine(\"ERROR: Could not find any addresses when resolving {0}, which I'm supposed to bind to.\");\n throw new Exception(\"Can't resolve binding address\");\n }\n var myEndpoint = new IPEndPoint(address, localPort);\n\n if (verbose) {\n Console.WriteLine(\"Starting I/O scheduler as server listening to {0} certified as {1}\",\n myEndpoint, IoScheduler.CertificateToString(myCert));\n }\n\n sendDispatchThread = new SendDispatchThread(this, useSsl);\n Thread st = new Thread(sendDispatchThread.Run);\n st.Start();\n\n // Start a thread to listen on my binding endpoint.\n\n listenerThread = new ListenerThread(this, myEndpoint, useSsl);\n Thread lt = new Thread(listenerThread.Run);\n lt.Start();\n }\n\n private void StartClient()\n {\n onlyClient = true;\n\n myCert = IronfleetCrypto.CreateTransientClientIdentity();\n\n if (verbose) {\n Console.WriteLine(\"Starting I/O scheduler as client with certificate {0}\",\n IoScheduler.CertificateToString(myCert));\n }\n\n sendDispatchThread = new SendDispatchThread(this, useSsl);\n Thread st = new Thread(sendDispatchThread.Run);\n st.Start();\n }\n\n private static IPAddress LookupHostNameOrAddress(string hostNameOrAddress)\n {\n var addresses = Dns.GetHostAddresses(hostNameOrAddress);\n if (addresses.Length < 1) {\n return null;\n }\n\n // Return the first IPv4 address in the list.\n\n foreach (var address in addresses) {\n if (address.AddressFamily == AddressFamily.InterNetwork) {\n return address;\n }\n }\n\n // If there was no IPv4 address, return the first address in the\n // list.\n\n return addresses[0];\n }\n\n public bool Verbose { get { return verbose; } }\n public bool OnlyClient { get { return onlyClient; } }\n public X509Certificate2 MyCert { get { return myCert; } }\n\n /////////////////////////////////////\n // SENDING\n /////////////////////////////////////\n\n public void RegisterSender(byte[] destinationPublicKeyHash, SenderThread senderThread)\n {\n lock (destinationPublicKeyHashToSenderThreadMap)\n {\n if (destinationPublicKeyHashToSenderThreadMap.ContainsKey(destinationPublicKeyHash)) {\n destinationPublicKeyHashToSenderThreadMap[destinationPublicKeyHash].Insert(0, senderThread);\n }\n else {\n destinationPublicKeyHashToSenderThreadMap[destinationPublicKeyHash] = new List { senderThread };\n }\n }\n }\n\n public void UnregisterSender(byte[] destinationPublicKeyHash, SenderThread senderThread)\n {\n lock (destinationPublicKeyHashToSenderThreadMap)\n {\n destinationPublicKeyHashToSenderThreadMap[destinationPublicKeyHash].Remove(senderThread);\n }\n }\n\n public SenderThread FindSenderForDestinationPublicKeyHash(byte[] destinationPublicKeyHash)\n {\n lock (destinationPublicKeyHashToSenderThreadMap)\n {\n if (destinationPublicKeyHashToSenderThreadMap.ContainsKey(destinationPublicKeyHash) &&\n destinationPublicKeyHashToSenderThreadMap[destinationPublicKeyHash].Count > 0) {\n return destinationPublicKeyHashToSenderThreadMap[destinationPublicKeyHash][0];\n }\n }\n\n return null;\n }\n\n /////////////////////////////////////\n // RECEIVING\n /////////////////////////////////////\n\n public void NoteReceivedPacket(ReceivedPacket packet)\n {\n receiveQueue.Post(packet);\n }\n\n /////////////////////////////////////\n // UTILITY METHODS\n /////////////////////////////////////\n\n public static byte[] GetCertificatePublicKey(X509Certificate2 cert)\n {\n return cert.PublicKey.EncodedKeyValue.RawData;\n }\n\n public byte[] HashPublicKey(byte[] publicKey)\n {\n return hasher.ComputeHash(publicKey);\n }\n\n public static string PublicKeyToString(byte[] destinationPublicKey)\n {\n return System.Convert.ToBase64String(destinationPublicKey).Substring(12, 8);\n }\n\n public static string PublicIdentityToString(PublicIdentity id)\n {\n return string.Format(\"{0} (key {1}) @ {2}:{3}\", id.FriendlyName, PublicKeyToString(id.PublicKey),\n id.HostNameOrAddress, id.Port);\n }\n\n public static string CertificateToString(X509Certificate2 cert)\n {\n return string.Format(\"{0} (key {1})\",\n cert.SubjectName.Name, PublicKeyToString(IoScheduler.GetCertificatePublicKey(cert)));\n }\n\n public PublicIdentity LookupPublicKeyHash(byte[] publicKeyHash)\n {\n PublicIdentity publicIdentity;\n if (!publicKeyHashToPublicIdentityMap.TryGetValue(publicKeyHash, out publicIdentity)) {\n return null;\n }\n else {\n return publicIdentity;\n }\n }\n\n public string LookupPublicKeyHashAsString(byte[] destinationPublicKeyHash)\n {\n var publicIdentity = LookupPublicKeyHash(destinationPublicKeyHash);\n if (publicIdentity == null) {\n return System.Convert.ToBase64String(destinationPublicKeyHash);\n }\n else {\n return PublicIdentityToString(publicIdentity);\n }\n }\n\n public void ReportException(Exception e, string activity)\n {\n if (e is IOException ioe) {\n e = ioe.InnerException;\n }\n if (e is SocketException se) {\n if (se.SocketErrorCode == SocketError.ConnectionReset) {\n if (verbose) {\n Console.WriteLine(\"Stopped {0} because of a connection reset. Will try again later if necessary.\", activity);\n }\n return;\n }\n if (se.SocketErrorCode == SocketError.ConnectionRefused) {\n if (verbose) {\n Console.WriteLine(\"Stopped {0} because the connection was refused. Will try again later if necessary.\", activity);\n }\n return;\n }\n if (se.SocketErrorCode == SocketError.Shutdown) {\n if (verbose) {\n Console.WriteLine(\"Stopped {0} because the connection was shut down. Will try again later if necessary.\", activity);\n }\n return;\n }\n }\n Console.WriteLine(\"Stopped {0} because of the following exception, but will try again later if necessary:\\n{1}\",\n activity, e);\n }\n\n ///////////////////////////////////\n // API for IoNative.cs\n ///////////////////////////////////\n\n public void ReceivePacket(Int32 timeLimit, out bool ok, out bool timedOut, out byte[] remotePublicKeyHash, out byte[] message)\n {\n ReceivedPacket packet;\n\n try {\n if (timeLimit == 0) {\n timedOut = !receiveQueue.TryReceive(out packet);\n }\n else {\n TimeSpan timeSpan = TimeSpan.FromMilliseconds(timeLimit);\n packet = receiveQueue.Receive(timeSpan);\n timedOut = false;\n }\n\n ok = true;\n if (timedOut) {\n remotePublicKeyHash = null;\n message = null;\n }\n else {\n remotePublicKeyHash = packet.senderKeyHash;\n message = packet.message;\n if (verbose) {\n Console.WriteLine(\"Dequeueing a packet of size {0} from {1}\",\n message.Length, LookupPublicKeyHashAsString(remotePublicKeyHash));\n }\n }\n }\n catch (TimeoutException) {\n remotePublicKeyHash = null;\n message = null;\n ok = true;\n timedOut = true;\n }\n catch (Exception e) {\n Console.Error.WriteLine(\"Unexpected error trying to read packet from packet queue. Exception:\\n{0}\", e);\n remotePublicKeyHash = null;\n message = null;\n ok = false;\n timedOut = false;\n }\n }\n\n public bool SendPacket(byte[] remotePublicKeyHash, byte[] message)\n {\n try {\n byte[] messageCopy = new byte[message.Length];\n Array.Copy(message, messageCopy, message.Length);\n byte[] remotePublicKeyHashCopy = new byte[remotePublicKeyHash.Length];\n Array.Copy(remotePublicKeyHash, remotePublicKeyHashCopy, remotePublicKeyHash.Length);\n SendTask sendTask = new SendTask(remotePublicKeyHashCopy, messageCopy);\n if (verbose) {\n Console.WriteLine(\"Enqueueing send of a message of size {0} to {1}\", message.Length,\n LookupPublicKeyHashAsString(remotePublicKeyHash));\n }\n sendDispatchThread.EnqueueSendTask(sendTask);\n return true;\n }\n catch (Exception e) {\n Console.Error.WriteLine(\"Unexpected error when trying to send a message. Exception:\\n{0}\", e);\n return false;\n }\n }\n\n public void ResendPacket(SendTask sendTask)\n {\n if (sendTask.IncrementNumTriesSoFar() < maxSendTries) {\n sendDispatchThread.EnqueueSendTask(sendTask);\n }\n }\n\n ///////////////////////////////////\n // Extra API calls for client\n ///////////////////////////////////\n\n public void Connect(byte[] destinationPublicKeyHash)\n {\n SenderThread senderThread = FindSenderForDestinationPublicKeyHash(destinationPublicKeyHash);\n if (senderThread == null) {\n senderThread = ClientSenderThread.Create(this, destinationPublicKeyHash, useSsl);\n }\n }\n }\n}\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Native/IoLemmas.i.dfy", "content": "include \"Io.s.dfy\"\n\nmodule Native__IoLemmas_i {\n\nimport opened Native__NativeTypes_s\nimport opened Native__Io_s\n\nlemma lemma_KVTupleSeqToMapCantIncreaseNumKeys(kvs: seq<(K, V)>)\n ensures |KVTupleSeqToMap(kvs)| <= |kvs|\n{\n if |kvs| == 0 {\n return;\n }\n\n var kvs_prefix := kvs[..|kvs|-1];\n lemma_KVTupleSeqToMapCantIncreaseNumKeys(kvs_prefix);\n}\n\nlemma lemma_SetOfSequenceElementsNoBiggerThanSeq(s: seq)\n ensures |(set x | x in s)| <= |s|\n{\n if |s| == 0 {\n return;\n }\n\n lemma_SetOfSequenceElementsNoBiggerThanSeq(s[1..]);\n assert (set x | x in s) == {s[0]} + (set x | x in s[1..]);\n}\n\nlemma lemma_AsKVTuplesEnsuresKeysDistinct(m: map, kvs: seq<(K, V)>)\n requires |kvs| == |m.Keys|\n requires forall k :: k in m ==> (k, m[k]) in kvs\n requires forall k, v :: (k, v) in kvs ==> k in m && m[k] == v\n requires |kvs| > 0\n ensures kvs[|kvs|-1] !in kvs[..|kvs|-1]\n{\n forall kv | kv in kvs\n ensures kv in m.Items\n {\n var (k, v) := kv;\n assert k in m && m[k] == v;\n assert kv in m.Items;\n }\n\n forall kv | kv in m.Items\n ensures kv in kvs\n {\n var (k, v) := kv;\n assert k in m && m[k] == v;\n assert (k, m[k]) in kvs;\n }\n\n var kv_last := kvs[|kvs|-1];\n var kvs_prefix := kvs[..|kvs|-1];\n if kv_last in kvs_prefix {\n var s'' := set kv | kv in kvs_prefix;\n assert s'' == m.Items;\n lemma_SetOfSequenceElementsNoBiggerThanSeq(kvs_prefix);\n assert |s''| <= |kvs_prefix| < |kvs|;\n assert false;\n }\n}\n\nlemma lemma_AsKVTuplesThenKVTupleSeqToMapIsIdentity(m: map, kvs: seq<(K, V)>)\n requires |kvs| == |m.Keys|\n requires forall k :: k in m ==> (k, m[k]) in kvs\n requires forall k, v :: (k, v) in kvs ==> k in m && m[k] == v\n ensures KVTupleSeqToMap(kvs) == m\n{\n if |kvs| == 0 {\n return;\n }\n\n var kvs_prefix := kvs[..|kvs|-1];\n var kv_last := kvs[|kvs|-1];\n var m_prefix := m - {kv_last.0};\n assert kv_last !in kvs_prefix by { lemma_AsKVTuplesEnsuresKeysDistinct(m, kvs); }\n lemma_AsKVTuplesThenKVTupleSeqToMapIsIdentity(m_prefix, kvs_prefix);\n}\n\n}\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Native/IoNative.cs", "content": "using IronfleetIoFramework;\r\nusing System;\r\nusing System.Net.Sockets;\r\nusing System.Numerics;\r\nusing System.Diagnostics;\r\nusing System.Threading;\r\nusing System.Collections.Concurrent;\r\nusing System.Collections.Generic;\r\nusing FStream = System.IO.FileStream;\r\n\r\n\r\nnamespace Native____Io__s_Compile {\r\n\r\n public partial class PrintParams\r\n {\r\n internal static bool shouldPrintProfilingInfo = false;\r\n internal static bool shouldPrintProgress = false;\r\n\r\n public static bool ShouldPrintProfilingInfo() { return shouldPrintProfilingInfo; }\r\n public static bool ShouldPrintProgress() { return shouldPrintProgress; }\r\n\r\n public static void SetParameters(bool i_shouldPrintProfilingInfo, bool i_shouldPrintProgress)\r\n {\r\n shouldPrintProfilingInfo = i_shouldPrintProfilingInfo;\r\n shouldPrintProgress = i_shouldPrintProgress;\r\n }\r\n }\r\n \r\n public partial class NetClient\r\n {\r\n internal IoScheduler scheduler;\r\n\r\n Dafny.ISequence myPublicKeyHash;\r\n\r\n internal NetClient(IoScheduler i_scheduler, byte[] publicKey)\r\n {\r\n scheduler = i_scheduler;\r\n myPublicKeyHash = Dafny.Sequence.FromArray(scheduler.HashPublicKey(publicKey));\r\n }\r\n\r\n public static int MaxPublicKeySize { get { return 0xFFFFF; } }\r\n\r\n public Dafny.ISequence MyPublicKey() { return myPublicKeyHash; }\r\n\r\n public static NetClient Create(PrivateIdentity myIdentity, string localHostNameOrAddress, int localPort,\r\n List knownIdentities, bool verbose, bool useSsl, int maxSendRetries = 3)\r\n {\r\n try\r\n {\r\n var scheduler = IoScheduler.CreateServer(myIdentity, localHostNameOrAddress, localPort, knownIdentities,\r\n verbose, useSsl, maxSendRetries);\r\n var myPublicKey = IoScheduler.GetCertificatePublicKey(scheduler.MyCert);\r\n if (myPublicKey.Length > MaxPublicKeySize) {\r\n System.Console.Error.WriteLine(\"ERROR: The provided public key for my identity is too big ({0} > {1} bytes)\",\r\n myPublicKey.Length, MaxPublicKeySize);\r\n return null;\r\n }\r\n return new NetClient(scheduler, myPublicKey);\r\n }\r\n catch (Exception e)\r\n {\r\n System.Console.Error.WriteLine(e);\r\n return null;\r\n }\r\n }\r\n \r\n public void Receive(int timeLimit, out bool ok, out bool timedOut, out Dafny.ISequence remote, out byte[] buffer)\r\n {\r\n byte[] remoteBytes;\r\n scheduler.ReceivePacket(timeLimit, out ok, out timedOut, out remoteBytes, out buffer);\r\n if (ok && !timedOut && remoteBytes != null && remoteBytes.Length > MaxPublicKeySize) {\r\n timedOut = true;\r\n }\r\n if (ok && !timedOut) {\r\n remote = Dafny.Sequence.FromArray(remoteBytes);\r\n }\r\n else {\r\n remote = Dafny.Sequence.Empty;\r\n }\r\n }\r\n \r\n public bool Send(Dafny.ISequence remote, byte[] buffer)\r\n {\r\n return scheduler.SendPacket(remote.Elements, buffer);\r\n }\r\n\r\n public byte[] HashPublicKey(byte[] key)\r\n {\r\n return scheduler.HashPublicKey(key);\r\n }\r\n }\r\n \r\n public partial class FileStream\r\n {\r\n internal FStream fstream;\r\n internal FileStream(FStream fstream) { this.fstream = fstream; }\r\n \r\n public static void Open(char[] name, out bool ok, out FileStream f)\r\n {\r\n try\r\n {\r\n f = new FileStream(new FStream(new string(name), System.IO.FileMode.OpenOrCreate, System.IO.FileAccess.ReadWrite));\r\n ok = true;\r\n }\r\n catch (Exception e)\r\n {\r\n System.Console.Error.WriteLine(e);\r\n f = null;\r\n ok = false;\r\n }\r\n }\r\n \r\n public void Close(out bool ok)\r\n {\r\n try\r\n {\r\n fstream.Close();\r\n ok = true;\r\n }\r\n catch (Exception e)\r\n {\r\n System.Console.Error.WriteLine(e);\r\n ok = false;\r\n }\r\n }\r\n \r\n public void Read(int fileOffset, byte[] buffer, int start, int end, out bool ok)\r\n {\r\n try\r\n {\r\n fstream.Seek(fileOffset, System.IO.SeekOrigin.Begin);\r\n fstream.Read(buffer, start, end - start);\r\n ok = true;\r\n }\r\n catch (Exception e)\r\n {\r\n System.Console.Error.WriteLine(e);\r\n ok = false;\r\n }\r\n }\r\n \r\n public void Write(int fileOffset, byte[] buffer, int start, int end, out bool ok)\r\n {\r\n try\r\n {\r\n fstream.Seek(fileOffset, System.IO.SeekOrigin.Begin);\r\n fstream.Write(buffer, start, end - start);\r\n ok = true;\r\n }\r\n catch (Exception e)\r\n {\r\n System.Console.Error.WriteLine(e);\r\n ok = false;\r\n }\r\n }\r\n \r\n public void Flush(out bool ok)\r\n {\r\n try\r\n {\r\n fstream.Flush();\r\n ok = true;\r\n }\r\n catch (Exception e)\r\n {\r\n System.Console.Error.WriteLine(e);\r\n ok = false;\r\n }\r\n }\r\n }\r\n \r\n public partial class Time\r\n {\r\n static Stopwatch watch;\r\n \r\n public static void Initialize()\r\n {\r\n watch = new Stopwatch();\r\n watch.Start();\r\n }\r\n \r\n public static ulong GetTime()\r\n {\r\n return (ulong) (DateTime.Now.Ticks / 10000);\r\n }\r\n \r\n public static ulong GetDebugTimeTicks()\r\n {\r\n return (ulong) watch.ElapsedTicks;\r\n }\r\n \r\n public static void RecordTiming(char[] name, ulong time)\r\n {\r\n var str = new string(name);\r\n IronfleetCommon.Profiler.Record(str, (long)time);\r\n }\r\n }\r\n \r\n public partial class MutableSet\r\n {\r\n private HashSet setImpl;\r\n public MutableSet() {\r\n this.setImpl = new HashSet();\r\n }\r\n \r\n public static Dafny.Set SetOf(MutableSet s) { return Dafny.Set.FromCollection(s.setImpl); }\r\n \r\n public static MutableSet EmptySet(Dafny.TypeDescriptor typeDescriptor) { return new MutableSet(); }\r\n \r\n public BigInteger Size() { return new BigInteger(this.setImpl.Count); }\r\n \r\n public ulong SizeModest() { return (ulong)this.setImpl.Count; }\r\n \r\n public bool Contains(T x) { return this.setImpl.Contains(x); }\r\n \r\n public void Add(T x) { this.setImpl.Add(x); }\r\n \r\n public void AddSet(MutableSet s) { this.setImpl.UnionWith(s.setImpl); }\r\n \r\n public void TransferSet(MutableSet s) { this.setImpl = s.setImpl; s.setImpl = new HashSet(); }\r\n \r\n public void Remove(T x) { this.setImpl.Remove(x); }\r\n \r\n public void RemoveAll() { this.setImpl.Clear(); }\r\n }\r\n \r\n public partial class MutableMap\r\n {\r\n private Dictionary mapImpl;\r\n \r\n // TODO: This is pretty inefficient. Should change Dafny's interface to allow us to \r\n // pass in an enumerable or an ImmutableDictionary\r\n public static Dafny.Map MapOf(MutableMap s)\r\n {\r\n List> pairs = new List>();\r\n foreach (var pair in s.mapImpl) {\r\n pairs.Add(new Dafny.Pair(pair.Key, pair.Value));\r\n }\r\n return Dafny.Map.FromCollection(pairs); \r\n }\r\n \r\n public static MutableMap EmptyMap()\r\n {\r\n var m = new MutableMap();\r\n m.mapImpl = new Dictionary();\r\n return m;\r\n }\r\n \r\n public static MutableMap FromMap(Dafny.IMap m)\r\n {\r\n var new_m = new MutableMap();\r\n new_m.mapImpl = new Dictionary();\r\n foreach (var kv in m.ItemEnumerable) {\r\n new_m.mapImpl.Add(kv.Car, kv.Cdr);\r\n }\r\n return new_m;\r\n }\r\n \r\n public BigInteger Size() { return new BigInteger(this.mapImpl.Count); }\r\n \r\n public ulong SizeModest() { return (ulong)this.mapImpl.Count; }\r\n \r\n public bool Contains(K key) { return this.mapImpl.ContainsKey(key); }\r\n \r\n public void TryGetValue(K key, out bool contains, out V val)\r\n {\r\n contains = this.mapImpl.TryGetValue(key, out val);\r\n }\r\n \r\n public void Set(K key, V val) { this.mapImpl[key] = val; }\r\n \r\n //public void AddMap(MutableMap s) { this.mapImpl.}\r\n \r\n public void Remove(K key) { this.mapImpl.Remove(key); }\r\n }\r\n \r\n public partial class @Arrays\r\n {\r\n public static void @CopySeqIntoArray(Dafny.ISequence src, ulong srcIndex, A[] dst, ulong dstIndex, ulong len) {\r\n System.Array.Copy(src.Elements, (long)srcIndex, dst, (long)dstIndex, (long)len);\r\n }\r\n }\r\n\r\n}\r\n\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Native/NativeTypes.i.dfy", "content": "include \"NativeTypes.s.dfy\"\r\n\r\nmodule Native__NativeTypes_i {\r\nimport opened Native__NativeTypes_s\r\n\r\nfunction method Uint64Size() : uint64 { 8 }\r\nfunction method Uint32Size() : uint64 { 4 }\r\nfunction method Uint16Size() : uint64 { 2 }\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Common/Native/NativeTypes.s.dfy", "content": "\r\nmodule Native__NativeTypes_s {\r\nnewtype{:nativeType \"sbyte\"} sbyte = i:int | -0x80 <= i < 0x80\r\nnewtype{:nativeType \"byte\"} byte = i:int | 0 <= i < 0x100\r\nnewtype{:nativeType \"short\"} int16 = i:int | -0x8000 <= i < 0x8000\r\nnewtype{:nativeType \"ushort\"} uint16 = i:int | 0 <= i < 0x10000\r\nnewtype{:nativeType \"int\"} int32 = i:int | -0x80000000 <= i < 0x80000000\r\nnewtype{:nativeType \"uint\"} uint32 = i:int | 0 <= i < 0x100000000\r\nnewtype{:nativeType \"long\"} int64 = i:int | -0x8000000000000000 <= i < 0x8000000000000000\r\nnewtype{:nativeType \"ulong\"} uint64 = i:int | 0 <= i < 0x10000000000000000\r\n\r\nnewtype{:nativeType \"sbyte\"} nat8 = i:int | 0 <= i < 0x80\r\nnewtype{:nativeType \"short\"} nat16 = i:int | 0 <= i < 0x8000\r\nnewtype{:nativeType \"int\"} nat32 = i:int | 0 <= i < 0x80000000\r\nnewtype{:nativeType \"long\"} nat64 = i:int | 0 <= i < 0x8000000000000000\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Common/CmdLineParser.i.dfy", "content": "include \"../../Common/Native/Io.s.dfy\"\r\ninclude \"../../../Libraries/Math/power.i.dfy\"\r\ninclude \"SeqIsUniqueDef.i.dfy\"\r\ninclude \"NetClient.i.dfy\"\r\n\r\nmodule CmdLineParser_i {\r\n\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Math__power_s\r\nimport opened Common__SeqIsUniqueDef_i\r\nimport opened Common__NetClient_i\r\n\r\nfunction method parse_end_point(public_key:seq) : (bool, EndPoint)\r\n ensures var tuple := parse_end_point(public_key);\r\n var ok, ep := tuple.0, tuple.1;\r\n ok ==> EndPointIsValidPublicKey(ep)\r\n{\r\n if |public_key| < 0x10_0000 then\r\n (true, EndPoint(public_key))\r\n else\r\n (false, EndPoint(public_key))\r\n}\r\n\r\nmethod test_unique(endpoints:seq) returns (unique:bool)\r\n ensures unique <==> SeqIsUnique(endpoints)\r\n{\r\n unique := true;\r\n\r\n var i := 0;\r\n\r\n while i < |endpoints| \r\n invariant 0 <= i <= |endpoints|\r\n invariant forall j,k :: 0 <= j < |endpoints| && 0 <= k < i && j != k \r\n ==> endpoints[j] != endpoints[k]\r\n {\r\n var j := 0;\r\n while j < |endpoints|\r\n invariant 0 <= j <= |endpoints|\r\n invariant forall k :: 0 <= k < j && k != i ==> endpoints[i] != endpoints[k]\r\n {\r\n if i != j && endpoints[i] == endpoints[j] {\r\n unique := false;\r\n reveal_SeqIsUnique();\r\n return;\r\n }\r\n j := j + 1;\r\n }\r\n i := i + 1;\r\n }\r\n reveal SeqIsUnique();\r\n}\r\n\r\nfunction method parse_end_points(args:seq>) : (bool, seq)\r\n ensures var (ok, endpoints) := parse_end_points(args);\r\n ok ==> (forall e :: e in endpoints ==> EndPointIsValidPublicKey(e))\r\n{\r\n if |args| == 0 then\r\n (true, [])\r\n else\r\n var (ok1, ep) := parse_end_point(args[0]);\r\n var (ok2, rest) := parse_end_points(args[1..]);\r\n\r\n if !(ok1 && ok2) then\r\n (false, [])\r\n else \r\n (true, [ep] + rest)\r\n}\r\n\r\nmethod GetHostIndex(host:EndPoint, hosts:seq) returns (found:bool, index:uint64)\r\n requires EndPointIsValidPublicKey(host)\r\n requires SeqIsUnique(hosts)\r\n requires |hosts| < 0x1_0000_0000_0000_0000\r\n requires forall h :: h in hosts ==> EndPointIsValidPublicKey(h)\r\n ensures found ==> 0 <= index as int < |hosts| && hosts[index] == host\r\n ensures !found ==> !(host in hosts)\r\n{\r\n var i:uint64 := 0;\r\n\r\n while i < (|hosts| as uint64)\r\n invariant i as int <= |hosts|;\r\n invariant forall j :: 0 <= j < i ==> hosts[j] != host;\r\n {\r\n if host == hosts[i] {\r\n found := true;\r\n index := i;\r\n \r\n calc ==> {\r\n true;\r\n { reveal_SeqIsUnique(); }\r\n forall j :: 0 <= j < |hosts| && j != i as int ==> hosts[j] != host;\r\n }\r\n\r\n return;\r\n }\r\n\r\n if i == (|hosts| as uint64) - 1 {\r\n found := false;\r\n return;\r\n }\r\n\r\n i := i + 1;\r\n }\r\n found := false;\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Common/GenericMarshalling.i.dfy", "content": "include \"../../Common/Native/NativeTypes.s.dfy\"\r\ninclude \"../../Common/Collections/Maps.i.dfy\"\r\ninclude \"../../Common/Collections/Seqs.i.dfy\"\r\ninclude \"../../Common/Logic/Option.i.dfy\"\r\ninclude \"Util.i.dfy\"\r\ninclude \"MarshallInt.i.dfy\"\r\n\r\nmodule Common__GenericMarshalling_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__NativeTypes_i\r\nimport opened Collections__Maps_i\r\nimport opened Collections__Seqs_i \r\nimport opened Logic__Option_i\r\nimport opened Common__Util_i\r\nimport opened Common__MarshallInt_i\r\nimport opened Math__power2_i\r\n\r\ndatatype G = GUint64\r\n | GArray(elt:G)\r\n | GTuple(t:seq)\r\n | GByteArray\r\n | GTaggedUnion(cases:seq)\r\n\r\ndatatype V = VUint64(u:uint64)\r\n | VArray(a:seq)\r\n | VTuple(t:seq)\r\n | VByteArray(b:seq)\r\n | VCase(c:uint64, val:V)\r\n\r\npredicate ValInGrammar(val:V, grammar:G)\r\n{\r\n match val\r\n case VUint64(_) => grammar.GUint64?\r\n case VArray(a) => grammar.GArray? && forall v :: v in a ==> ValInGrammar(v, grammar.elt)\r\n case VTuple(t) => grammar.GTuple? && |t| == |grammar.t| && (forall i :: 0 <= i < |t| ==> ValInGrammar(t[i], grammar.t[i]))\r\n case VByteArray(b) => grammar.GByteArray?\r\n case VCase(c, v) => grammar.GTaggedUnion? && c as int < |grammar.cases| && ValInGrammar(v, grammar.cases[c])\r\n}\r\n\r\n// We only support reasonably sized grammars\r\npredicate ValidGrammar(grammar:G) \r\n{\r\n match grammar\r\n case GUint64 => true\r\n case GArray(elt) => ValidGrammar(elt)\r\n case GTuple(t) => |t| < 0x1_0000_0000_0000_0000 && (forall g :: g in t ==> ValidGrammar(g))\r\n case GByteArray => true\r\n case GTaggedUnion(cases) => |cases| < 0x1_0000_0000_0000_0000 && (forall g :: g in cases ==> ValidGrammar(g))\r\n}\r\n\r\n// We can't encode values that are not valid\r\npredicate ValidVal(val:V)\r\n{\r\n match val\r\n case VUint64(_) => true\r\n case VArray(a) => |a| < 0x1_0000_0000_0000_0000 && forall v :: v in a ==> ValidVal(v)\r\n case VTuple(t) => |t| < 0x1_0000_0000_0000_0000 && forall v :: v in t ==> ValidVal(v)\r\n case VByteArray(b) => |b| < 0x1_0000_0000_0000_0000\r\n case VCase(c, v) => ValidVal(v)\r\n}\r\n\r\nfunction {:opaque} SeqSum(t:seq) : int\r\n ensures SeqSum(t) >= 0\r\n{\r\n if |t| == 0 then 0\r\n else SizeOfV(t[0]) + SeqSum(t[1..])\r\n}\r\n\r\nfunction SizeOfV(val:V) : int\r\n ensures SizeOfV(val) >= 0\r\n{\r\n match val\r\n case VUint64(_) => 8\r\n case VArray(a) => 8 + SeqSum(a) // 8 bytes for length\r\n case VTuple(t) => SeqSum(t)\r\n case VByteArray(b) => 8 + |b| // 8 bytes for a length field\r\n case VCase(c, v) => 8 + SizeOfV(v) // 8 bytes for the case identifier\r\n}\r\n\r\npredicate Trigger(i:int)\r\n{\r\n true\r\n}\r\n\r\nfunction method parse_Uint64(data:seq) : (Option, seq)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n ensures if |data| >= 8 then |parse_Uint64(data).1| == |data| - 8 else |parse_Uint64(data).1| == 0\r\n{\r\n if |data| as uint64 >= Uint64Size() then\r\n (Some(VUint64(SeqByteToUint64(data[..Uint64Size()]))), data[Uint64Size()..])\r\n else\r\n (None, [])\r\n}\r\n\r\nmethod ParseUint64(data:array, index:uint64) returns (success:bool, v:V, rest_index:uint64)\r\n requires index as int <= data.Length\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n ensures rest_index as int <= data.Length\r\n ensures var (v', rest') := parse_Uint64(data[index..]);\r\n var v_opt := if success then Some(v) else None();\r\n v_opt == v' && data[rest_index..] == rest'\r\n{\r\n lemma_2toX();\r\n\r\n if data.Length as uint64 >= 8 && index <= (data.Length as uint64) - 8 {\r\n // Avoids overflow and equvalent to: if index + 8 < (data.Length as uint64) {\r\n var result := (data[index as int] as uint64) * 0x1_00_0000_0000_0000\r\n + (data[index as int + 1] as uint64) * 0x1_00_0000_0000_00\r\n + (data[index as int + 2] as uint64) * 0x1_00_0000_0000\r\n + (data[index as int + 3] as uint64) * 0x1_00_0000_00\r\n + (data[index as int + 4] as uint64) * 0x1_00_0000\r\n + (data[index as int + 5] as uint64) * 0x1_00_00\r\n + (data[index as int + 6] as uint64) * 0x1_00\r\n + (data[index as int + 7] as uint64);\r\n success := true;\r\n v := VUint64(result);\r\n rest_index := index + Uint64Size();\r\n } else {\r\n success := false;\r\n rest_index := data.Length as uint64;\r\n }\r\n}\r\n\r\nfunction method {:opaque} parse_Array_contents(data:seq, eltType:G, len:uint64) : (Option>, seq)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires ValidGrammar(eltType)\r\n decreases eltType, 1, len\r\n ensures var (opt_seq, rest) := parse_Array_contents(data, eltType, len);\r\n |rest| <= |data| && (opt_seq.Some? ==> forall i :: 0 <= i < |opt_seq.v| ==> ValInGrammar(opt_seq.v[i], eltType))\r\n{\r\n if len == 0 then\r\n (Some([]), data)\r\n else\r\n var (val, rest1) := parse_Val(data, eltType);\r\n var (others, rest2) := parse_Array_contents(rest1, eltType, len - 1);\r\n if !val.None? && !others.None? then\r\n (Some([val.v] + others.v), rest2)\r\n else\r\n (None, [])\r\n}\r\n\r\ndatatype ContentsTraceStep = ContentsTraceStep(data:seq, val:Option)\r\n\r\nlemma lemma_ArrayContents_helper(data:seq, eltType:G, len:uint64, v:seq, trace:seq)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires ValidGrammar(eltType)\r\n requires |trace| == (len as int) + 1\r\n requires |v| == len as int\r\n requires forall j :: 0 <= j < |trace| ==> |trace[j].data| < 0x1_0000_0000_0000_0000\r\n requires trace[0].data == data\r\n requires forall j :: 0 < j < (len as int) + 1 ==> \r\n && trace[j].val == parse_Val(trace[j-1].data, eltType).0\r\n && trace[j].data == parse_Val(trace[j-1].data, eltType).1\r\n requires forall j :: 0 < j < |trace| ==> trace[j].val.Some?;\r\n requires forall j :: 0 < j < |trace| ==> v[j-1] == trace[j].val.v;\r\n //requires v == ExtractValues(trace[1..])\r\n decreases len;\r\n ensures var (v', rest') := parse_Array_contents(data, eltType, len);\r\n var v_opt := Some(v);\r\n v_opt == v' && trace[|trace|-1].data == rest'\r\n{\r\n reveal parse_Array_contents();\r\n if len == 0 {\r\n } else {\r\n var tuple := parse_Val(data, eltType);\r\n var val, rest1 := tuple.0, tuple.1;\r\n assert trace[1].data == rest1;\r\n assert val.Some?;\r\n assert trace[1].val == val;\r\n lemma_ArrayContents_helper(rest1, eltType, len-1, v[1..], trace[1..]);\r\n var tuple'' := parse_Array_contents(rest1, eltType, len-1);\r\n var v'', rest'' := tuple''.0, tuple''.1;\r\n var v_opt'' := Some(v[1..]);\r\n assert v_opt'' == v'' && trace[1..][|trace[1..]|-1].data == rest'';\r\n\r\n var tuple' := parse_Array_contents(data, eltType, len);\r\n var v', rest' := tuple'.0, tuple'.1;\r\n calc { \r\n v'; \r\n Some([val.v] + v''.v);\r\n Some([val.v] + v[1..]);\r\n Some([v[0]] + v[1..]);\r\n { assert v == [v[0]] + v[1..]; }\r\n Some(v);\r\n }\r\n assert rest' == rest'';\r\n }\r\n}\r\n\r\nlemma lemma_ArrayContents_helper_bailout(data:seq, eltType:G, len:uint64, trace:seq)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires ValidGrammar(eltType)\r\n requires 1 < |trace| <= (len as int) + 1\r\n //requires |v| == len as int\r\n requires forall j :: 0 <= j < |trace| ==> |trace[j].data| < 0x1_0000_0000_0000_0000\r\n requires trace[0].data == data\r\n requires forall j :: 0 < j < |trace| ==> \r\n && trace[j].val == parse_Val(trace[j-1].data, eltType).0\r\n && trace[j].data == parse_Val(trace[j-1].data, eltType).1\r\n requires forall j :: 0 < j < |trace| - 1 ==> trace[j].val.Some?;\r\n //requires forall j :: 0 < j < |trace| - 1 ==> v[j-1] == trace[j].val.v\r\n requires trace[|trace|-1].val.None?\r\n //requires v == ExtractValues(trace[1..])\r\n decreases len\r\n ensures var (v', rest') := parse_Array_contents(data, eltType, len);\r\n v'.None? && rest' == []\r\n{\r\n reveal parse_Array_contents();\r\n \r\n var tuple := parse_Val(data, eltType);\r\n var val, rest1 := tuple.0, tuple.1;\r\n if |trace| == 2 {\r\n assert val.None?;\r\n var tuple' := parse_Array_contents(data, eltType, len);\r\n var v', rest' := tuple'.0, tuple'.1;\r\n assert v'.None?;\r\n assert rest' == [];\r\n } else {\r\n lemma_ArrayContents_helper_bailout(rest1, eltType, len-1, trace[1..]);\r\n }\r\n}\r\n\r\nmethod{:timeLimitMultiplier 2} ParseArrayContents(data:array, index:uint64, eltType:G, len:uint64) \r\n returns (success:bool, v:seq, rest_index:uint64)\r\n requires index as int <= data.Length\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n requires ValidGrammar(eltType)\r\n decreases eltType, 1, len\r\n ensures rest_index as int <= data.Length\r\n ensures var (v', rest') := parse_Array_contents(data[index..], eltType, len);\r\n var v_opt := if success then Some(v) else None();\r\n v_opt == v' && data[rest_index..] == rest'\r\n ensures success ==> ValidVal(VArray(v))\r\n{\r\n reveal parse_Array_contents();\r\n var vArr := new V[len];\r\n ghost var g_v := [];\r\n success := true;\r\n var i:uint64 := 0;\r\n var next_val_index:uint64 := index;\r\n ghost var trace := [ContentsTraceStep(data[index..], None())];\r\n\r\n while i < len\r\n invariant 0 <= i <= len\r\n invariant index <= next_val_index <= data.Length as uint64\r\n invariant |trace| == (i as int) + 1\r\n invariant |g_v| == i as int\r\n invariant vArr[..i] == g_v\r\n invariant trace[0].data == data[index..]\r\n invariant forall j :: 0 <= j < (i as int)+1 ==> |trace[j].data| < 0x1_0000_0000_0000_0000\r\n invariant trace[i].data == data[next_val_index..]\r\n invariant forall j :: 0 < j <= i ==> trace[j].val.Some?\r\n invariant forall j :: 0 < j <= i ==> g_v[j-1] == trace[j].val.v\r\n invariant forall j :: 0 < j < (i as int)+1 ==>\r\n && trace[j].val == parse_Val(trace[j-1].data, eltType).0\r\n && trace[j].data == parse_Val(trace[j-1].data, eltType).1\r\n invariant ValidVal(VArray(vArr[..i]))\r\n {\r\n var some1, val, rest1 := ParseVal(data, next_val_index, eltType);\r\n ghost var step := ContentsTraceStep(data[rest1..], if some1 then Some(val) else None());\r\n ghost var old_trace := trace;\r\n trace := trace + [step];\r\n if !some1 {\r\n success := false;\r\n rest_index := data.Length as uint64;\r\n lemma_ArrayContents_helper_bailout(data[index..], eltType, len, trace);\r\n return;\r\n }\r\n g_v := g_v + [val];\r\n vArr[i] := val;\r\n next_val_index := rest1;\r\n\r\n i := i + 1;\r\n }\r\n\r\n success := true;\r\n rest_index := next_val_index;\r\n v := vArr[..]; \r\n lemma_ArrayContents_helper(data[index..], eltType, len, v, trace);\r\n}\r\n\r\nfunction method parse_Array(data:seq, eltType:G) : (Option, seq)\r\n requires ValidGrammar(eltType)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n decreases eltType\r\n ensures var (opt_val, rest) := parse_Array(data, eltType);\r\n |rest| <= |data| && (opt_val.Some? ==> ValInGrammar(opt_val.v, GArray(eltType)))\r\n{\r\n var (len, rest) := parse_Uint64(data);\r\n if !len.None? then\r\n var (contents, remainder) := parse_Array_contents(rest, eltType, len.v.u);\r\n if !contents.None? then\r\n (Some(VArray(contents.v)), remainder)\r\n else\r\n (None, [])\r\n else\r\n (None, [])\r\n}\r\n\r\nmethod ParseArray(data:array, index:uint64, eltType:G) returns (success:bool, v:V, rest_index:uint64)\r\n requires index as int <= data.Length\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n requires ValidGrammar(eltType)\r\n decreases eltType\r\n ensures rest_index as int <= data.Length\r\n ensures var (v', rest') := parse_Array(data[index..], eltType);\r\n var v_opt := if success then Some(v) else None();\r\n v_opt == v' && data[rest_index..] == rest'\r\n ensures success ==> ValidVal(v);\r\n{\r\n var some1, len, rest := ParseUint64(data, index);\r\n if some1 {\r\n var some2, contents, remainder := ParseArrayContents(data, rest, eltType, len.u);\r\n if some2 {\r\n success := true;\r\n v := VArray(contents);\r\n rest_index := remainder;\r\n } else {\r\n success := false;\r\n rest_index := data.Length as uint64;\r\n }\r\n } else {\r\n success := false;\r\n rest_index := data.Length as uint64;\r\n }\r\n}\r\n\r\n\r\nfunction method {:opaque} parse_Tuple_contents(data:seq, eltTypes:seq) : (Option>, seq)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires |eltTypes| < 0x1_0000_0000_0000_0000\r\n requires forall elt :: elt in eltTypes ==> ValidGrammar(elt)\r\n decreases eltTypes, 0\r\n ensures var (opt_val, rest) := parse_Tuple_contents(data, eltTypes);\r\n |rest| <= |data| &&\r\n (opt_val.Some? ==> (|opt_val.v| == |eltTypes|\r\n && forall i :: 0 <= i < |opt_val.v| ==> ValInGrammar(opt_val.v[i], eltTypes[i])))\r\n{\r\n if eltTypes == [] then\r\n (Some([]), data)\r\n else\r\n var (val, rest1) := parse_Val(data, eltTypes[0]);\r\n assert |rest1| <= |data|;\r\n var (contents, rest2) := parse_Tuple_contents(rest1, eltTypes[1..]);\r\n if !val.None? && !contents.None? then\r\n (Some([val.v] + contents.v), rest2)\r\n else\r\n (None, [])\r\n}\r\n\r\n\r\nlemma lemma_TupleContents_helper(data:seq, eltTypes:seq, v:seq, trace:seq)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires |eltTypes| < 0x1_0000_0000_0000_0000\r\n requires forall elt :: elt in eltTypes ==> ValidGrammar(elt)\r\n requires |trace| == |eltTypes| + 1\r\n requires |v| == |eltTypes| as int\r\n requires forall j :: 0 <= j < |trace| ==> |trace[j].data| < 0x1_0000_0000_0000_0000\r\n requires trace[0].data == data\r\n requires forall j :: 0 < j < (|eltTypes| as int)+1 ==>\r\n && trace[j].val == parse_Val(trace[j-1].data, eltTypes[j-1]).0\r\n && trace[j].data == parse_Val(trace[j-1].data, eltTypes[j-1]).1\r\n requires forall j :: 0 < j < |trace| ==> trace[j].val.Some?\r\n requires forall j :: 0 < j < |trace| ==> v[j-1] == trace[j].val.v\r\n //requires v == ExtractValues(trace[1..])\r\n decreases |eltTypes|\r\n ensures var (v', rest') := parse_Tuple_contents(data, eltTypes);\r\n var v_opt := Some(v);\r\n v_opt == v' && trace[|trace|-1].data == rest'\r\n{\r\n reveal parse_Tuple_contents();\r\n if |eltTypes| == 0 {\r\n } else {\r\n var tuple := parse_Val(data, eltTypes[0]);\r\n var val, rest1 := tuple.0, tuple.1;\r\n assert trace[1].data == rest1;\r\n assert val.Some?;\r\n assert trace[1].val == val;\r\n lemma_TupleContents_helper(rest1, eltTypes[1..], v[1..], trace[1..]);\r\n var tuple'' := parse_Tuple_contents(rest1, eltTypes[1..]);\r\n var v'', rest'' := tuple''.0, tuple''.1;\r\n var v_opt'' := Some(v[1..]);\r\n assert v_opt'' == v'' && trace[1..][|trace[1..]|-1].data == rest'';\r\n\r\n var tuple' := parse_Tuple_contents(data, eltTypes);\r\n var v', rest' := tuple'.0, tuple'.1;\r\n calc { \r\n v'; \r\n Some([val.v] + v''.v);\r\n Some([val.v] + v[1..]);\r\n Some([v[0]] + v[1..]);\r\n { assert v == [v[0]] + v[1..]; }\r\n Some(v);\r\n }\r\n assert rest' == rest'';\r\n }\r\n}\r\n\r\nlemma lemma_TupleContents_helper_bailout(data:seq, eltTypes:seq, trace:seq)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires |eltTypes| < 0x1_0000_0000_0000_0000\r\n requires forall elt :: elt in eltTypes ==> ValidGrammar(elt)\r\n requires 1 < |trace| <= (|eltTypes| as int) + 1\r\n requires forall j :: 0 <= j < |trace| ==> |trace[j].data| < 0x1_0000_0000_0000_0000\r\n requires trace[0].data == data\r\n requires forall j :: 0 < j < |trace| ==> \r\n && trace[j].val == parse_Val(trace[j-1].data, eltTypes[j-1]).0\r\n && trace[j].data == parse_Val(trace[j-1].data, eltTypes[j-1]).1\r\n requires forall j :: 0 < j < |trace| - 1 ==> trace[j].val.Some?\r\n //requires forall j :: 0 < j < |trace| - 1 ==> v[j-1] == trace[j].val.v\r\n requires trace[|trace|-1].val.None?\r\n //requires v == ExtractValues(trace[1..])\r\n decreases |eltTypes|\r\n ensures var (v', rest') := parse_Tuple_contents(data, eltTypes);\r\n v'.None? && rest' == []\r\n{\r\n reveal parse_Tuple_contents();\r\n \r\n var tuple := parse_Val(data, eltTypes[0]);\r\n var val, rest1 := tuple.0, tuple.1;\r\n if |trace| == 2 {\r\n assert val.None?;\r\n var tuple' := parse_Tuple_contents(data, eltTypes);\r\n var v', rest' := tuple'.0, tuple'.1;\r\n assert v'.None?;\r\n assert rest' == [];\r\n } else {\r\n lemma_TupleContents_helper_bailout(rest1, eltTypes[1..], trace[1..]);\r\n }\r\n}\r\n\r\nmethod{:timeLimitMultiplier 2} ParseTupleContents(data:array, index:uint64, eltTypes:seq) \r\n returns (success:bool, v:seq, rest_index:uint64)\r\n requires index as int <= data.Length\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n requires |eltTypes| < 0x1_0000_0000_0000_0000\r\n requires forall elt :: elt in eltTypes ==> ValidGrammar(elt)\r\n decreases eltTypes, 0\r\n ensures rest_index as int <= data.Length\r\n ensures var (v', rest') := parse_Tuple_contents(data[index..], eltTypes);\r\n var v_opt := if success then Some(v) else None();\r\n v_opt == v' && data[rest_index..] == rest'\r\n ensures success ==> ValidVal(VTuple(v))\r\n{\r\n reveal parse_Tuple_contents();\r\n var vArr := new V[|eltTypes|];\r\n ghost var g_v := [];\r\n success := true;\r\n var i:int := 0;\r\n var next_val_index:uint64 := index;\r\n ghost var trace := [ContentsTraceStep(data[index..], None())];\r\n\r\n while i < |eltTypes|\r\n invariant 0 <= i <= |eltTypes|\r\n invariant index <= next_val_index <= data.Length as uint64\r\n invariant |trace| == i + 1\r\n invariant |g_v| == i\r\n invariant vArr[..i] == g_v\r\n invariant trace[0].data == data[index..]\r\n invariant forall j :: 0 <= j < i+1 ==> |trace[j].data| < 0x1_0000_0000_0000_0000\r\n invariant trace[i].data == data[next_val_index..]\r\n invariant forall j :: 0 < j <= i ==> trace[j].val.Some?\r\n invariant forall j :: 0 < j <= i ==> g_v[j-1] == trace[j].val.v\r\n invariant forall j :: 0 < j < i+1 ==> \r\n && trace[j].val == parse_Val(trace[j-1].data, eltTypes[j-1]).0\r\n && trace[j].data == parse_Val(trace[j-1].data, eltTypes[j-1]).1\r\n invariant ValidVal(VTuple(vArr[..i]))\r\n {\r\n var some1, val, rest1 := ParseVal(data, next_val_index, eltTypes[i]);\r\n ghost var step := ContentsTraceStep(data[rest1..], if some1 then Some(val) else None());\r\n ghost var old_trace := trace;\r\n trace := trace + [step];\r\n if !some1 {\r\n success := false;\r\n rest_index := data.Length as uint64;\r\n lemma_TupleContents_helper_bailout(data[index..], eltTypes, trace);\r\n return;\r\n }\r\n g_v := g_v + [val];\r\n vArr[i] := val;\r\n next_val_index := rest1;\r\n\r\n i := i + 1;\r\n }\r\n\r\n success := true;\r\n rest_index := next_val_index;\r\n v := vArr[..]; \r\n lemma_TupleContents_helper(data[index..], eltTypes, v, trace);\r\n}\r\n\r\nfunction method parse_Tuple(data:seq, eltTypes:seq) : (Option, seq)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires |eltTypes| < 0x1_0000_0000_0000_0000\r\n requires forall elt :: elt in eltTypes ==> ValidGrammar(elt)\r\n decreases eltTypes, 1\r\n ensures var (opt_val, rest) := parse_Tuple(data, eltTypes);\r\n |rest| <= |data| && (opt_val.Some? ==> ValInGrammar(opt_val.v, GTuple(eltTypes)))\r\n{\r\n var (contents, rest) := parse_Tuple_contents(data, eltTypes);\r\n if !contents.None? then\r\n (Some(VTuple(contents.v)), rest)\r\n else\r\n (None, [])\r\n}\r\n\r\n\r\nmethod ParseTuple(data:array, index:uint64, eltTypes:seq) returns (success:bool, v:V, rest_index:uint64)\r\n requires index as int <= data.Length\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n requires |eltTypes| < 0x1_0000_0000_0000_0000\r\n requires forall elt :: elt in eltTypes ==> ValidGrammar(elt)\r\n decreases eltTypes, 1\r\n ensures rest_index as int <= data.Length\r\n ensures var (v', rest') := parse_Tuple(data[index..], eltTypes);\r\n var v_opt := if success then Some(v) else None();\r\n v_opt == v' && data[rest_index..] == rest'\r\n ensures success ==> ValidVal(v);\r\n{\r\n var some, contents, rest := ParseTupleContents(data, index, eltTypes);\r\n if some {\r\n success := true;\r\n v := VTuple(contents);\r\n rest_index := rest;\r\n } else {\r\n success := false;\r\n rest_index := data.Length as uint64;\r\n }\r\n}\r\n\r\nfunction method parse_ByteArray(data:seq) : (Option, seq)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n{\r\n var (len, rest) := parse_Uint64(data);\r\n if !len.None? && len.v.u <= |rest| as uint64 then\r\n (Some(VByteArray(rest[0..len.v.u])), rest[len.v.u..])\r\n else\r\n (None, [])\r\n}\r\n\r\nmethod ParseByteArray(data:array, index:uint64) returns (success:bool, v:V, rest_index:uint64)\r\n requires index as int <= data.Length\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n ensures rest_index as int <= data.Length\r\n ensures var (v', rest') := parse_ByteArray(data[index..]);\r\n var v_opt := if success then Some(v) else None();\r\n v_opt == v' && data[rest_index..] == rest'\r\n{\r\n var some, len, rest := ParseUint64(data, index);\r\n if some && len.u <= data.Length as uint64 - rest {\r\n var rest_seq := data[rest..];\r\n assert len.u <= |rest_seq| as uint64;\r\n calc {\r\n rest_seq[0..len.u];\r\n data[rest..rest + len.u];\r\n }\r\n success := true;\r\n v := VByteArray(data[rest..rest + len.u]);\r\n rest_index := rest + len.u;\r\n } else {\r\n success := false;\r\n rest_index := data.Length as uint64;\r\n }\r\n}\r\n\r\nfunction method parse_Case(data:seq, cases:seq) : (Option, seq)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires |cases| < 0x1_0000_0000_0000_0000\r\n requires forall elt :: elt in cases ==> ValidGrammar(elt)\r\n decreases cases\r\n ensures var (opt_val, rest) := parse_Case(data, cases);\r\n |rest| <= |data| && (opt_val.Some? ==> ValInGrammar(opt_val.v, GTaggedUnion(cases)))\r\n{\r\n var (caseID, rest1) := parse_Uint64(data);\r\n\r\n if !caseID.None? && caseID.v.u < |cases| as uint64 then\r\n var (val, rest2) := parse_Val(rest1, cases[caseID.v.u]);\r\n if !val.None? then\r\n (Some(VCase(caseID.v.u, val.v)), rest2)\r\n else\r\n (None, [])\r\n else\r\n (None, [])\r\n}\r\n\r\nmethod ParseCase(data:array, index:uint64, cases:seq) returns (success:bool, v:V, rest_index:uint64)\r\n requires index as int <= data.Length\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n requires |cases| < 0x1_0000_0000_0000_0000\r\n requires forall elt :: elt in cases ==> ValidGrammar(elt)\r\n decreases cases\r\n ensures rest_index as int <= data.Length\r\n ensures var (v', rest') := parse_Case(data[index..], cases);\r\n var v_opt := if success then Some(v) else None();\r\n v_opt == v' && data[rest_index..] == rest'\r\n ensures success ==> ValidVal(v)\r\n{\r\n var some1, caseID, rest1 := ParseUint64(data, index);\r\n\r\n if some1 && caseID.u < |cases| as uint64 {\r\n var some2, val, rest2 := ParseVal(data, rest1, cases[caseID.u]);\r\n if some2 {\r\n success := true;\r\n v := VCase(caseID.u, val);\r\n rest_index := rest2;\r\n } else {\r\n success := false;\r\n rest_index := data.Length as uint64;\r\n }\r\n } else {\r\n success := false;\r\n rest_index := data.Length as uint64;\r\n }\r\n}\r\n\r\nfunction method {:opaque} parse_Val(data:seq, grammar:G) : (Option, seq)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires ValidGrammar(grammar)\r\n decreases grammar, 0\r\n ensures var (val, rest) := parse_Val(data, grammar);\r\n |rest| <= |data| && (!val.None? ==> ValInGrammar(val.v, grammar))\r\n{\r\n match grammar\r\n case GUint64 => parse_Uint64(data)\r\n case GArray(elt) => parse_Array(data, elt)\r\n case GTuple(t) => parse_Tuple(data, t)\r\n case GByteArray => parse_ByteArray(data)\r\n case GTaggedUnion(cases) => parse_Case(data, cases)\r\n}\r\n\r\nmethod ParseVal(data:array, index:uint64, grammar:G) returns (success:bool, v:V, rest_index:uint64)\r\n requires index as int <= data.Length\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n requires ValidGrammar(grammar)\r\n decreases grammar, 0\r\n ensures rest_index as int <= data.Length\r\n ensures var (v', rest') := parse_Val(data[index..], grammar);\r\n var v_opt := if success then Some(v) else None();\r\n v_opt == v' && data[rest_index..] == rest'\r\n ensures success ==> ValidVal(v);\r\n{\r\n reveal parse_Val();\r\n\r\n match grammar {\r\n case GUint64 => success, v, rest_index := ParseUint64(data, index);\r\n case GArray(elt) => success, v, rest_index := ParseArray(data, index, elt);\r\n case GTuple(t) => success, v, rest_index := ParseTuple(data, index, t);\r\n case GByteArray => success, v, rest_index := ParseByteArray(data, index);\r\n case GTaggedUnion(cases) => success, v, rest_index := ParseCase(data, index, cases);\r\n }\r\n}\r\n\r\npredicate Demarshallable(data:seq, grammar:G)\r\n{\r\n && |data| < 0x1_0000_0000_0000_0000\r\n && ValidGrammar(grammar)\r\n && !parse_Val(data, grammar).0.None?\r\n && ValidVal(parse_Val(data, grammar).0.v)\r\n && parse_Val(data, grammar).1 == []\r\n}\r\n\r\nfunction DemarshallFunc(data:seq, grammar:G) : V\r\n requires Demarshallable(data, grammar)\r\n decreases grammar, 0\r\n ensures var (val, rest) := parse_Val(data, grammar);\r\n !val.None? && ValInGrammar(val.v, grammar)\r\n{\r\n parse_Val(data, grammar).0.v\r\n}\r\n\r\nmethod Demarshall(data:array, grammar:G) returns (success:bool, v:V)\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n requires ValidGrammar(grammar)\r\n ensures success == Demarshallable(data[..], grammar)\r\n ensures success ==> v == DemarshallFunc(data[..], grammar)\r\n{\r\n var rest:uint64;\r\n success, v, rest := ParseVal(data, 0, grammar);\r\n if success && rest == data.Length as uint64 {\r\n assert v == parse_Val(data[..], grammar).0.v;\r\n assert Demarshallable(data[..], grammar);\r\n assert v == DemarshallFunc(data[..], grammar);\r\n } else {\r\n success := false;\r\n assert !Demarshallable(data[..], grammar);\r\n }\r\n}\r\n\r\n\r\nlemma lemma_parse_Val_view_ByteArray(data:seq, v:V, grammar:G, index:int)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires ValInGrammar(v, grammar)\r\n requires ValidGrammar(grammar)\r\n requires grammar.GByteArray?\r\n requires 0 <= index <= |data|\r\n requires 0 <= index + SizeOfV(v) <= |data|\r\n ensures forall bound :: Trigger(bound) ==> (index+SizeOfV(v) <= bound <= |data| ==>\r\n ((parse_ByteArray(data[index..bound]).0 == Some(v)) <==> (parse_ByteArray(data[index..index+SizeOfV(v)]).0 == Some(v))))\r\n ensures forall bound :: index+SizeOfV(v) <= bound <= |data| ==>\r\n parse_ByteArray(data[index..bound]).0 == Some(v) ==> parse_ByteArray(data[index..bound]).1 == data[index+SizeOfV(v)..bound]\r\n{\r\n forall bound {:trigger Trigger(bound)} | Trigger(bound)\r\n ensures index+SizeOfV(v) <= bound <= |data| ==>\r\n ((parse_ByteArray(data[index..bound]).0 == Some(v)) <==> (parse_ByteArray(data[index..index+SizeOfV(v)]).0 == Some(v)))\r\n {\r\n if index+SizeOfV(v) <= bound <= |data| {\r\n var narrow_tuple := parse_ByteArray(data[index..index+SizeOfV(v)]);\r\n var bound_tuple := parse_ByteArray(data[index..bound]);\r\n var narrow_len_tuple := parse_Uint64(data[index..index+SizeOfV(v)]);\r\n var bound_len_tuple := parse_Uint64(data[index..bound]);\r\n assert narrow_len_tuple.0 == bound_len_tuple.0;\r\n\r\n if bound_tuple.0 == Some(v) {\r\n assert bound_len_tuple.1[0..bound_len_tuple.0.v.u] == narrow_len_tuple.1[0..bound_len_tuple.0.v.u]; // OBSERVE\r\n }\r\n\r\n if narrow_tuple.0 == Some(v) {\r\n assert bound_len_tuple.1[0..bound_len_tuple.0.v.u] == narrow_len_tuple.1[0..bound_len_tuple.0.v.u]; // OBSERVE\r\n }\r\n assert ((parse_ByteArray(data[index..bound]).0 == Some(v)) <==> (parse_ByteArray(data[index..index+SizeOfV(v)]).0 == Some(v)));\r\n }\r\n assert index+SizeOfV(v) <= bound <= |data| ==> ((parse_ByteArray(data[index..bound]).0 == Some(v)) <==> (parse_ByteArray(data[index..index+SizeOfV(v)]).0 == Some(v)));\r\n }\r\n assert forall bound :: Trigger(bound) ==> (index+SizeOfV(v) <= bound <= |data| ==>\r\n ((parse_ByteArray(data[index..bound]).0 == Some(v)) <==> (parse_ByteArray(data[index..index+SizeOfV(v)]).0 == Some(v))));\r\n assert forall bound :: index+SizeOfV(v) <= bound <= |data| ==>\r\n parse_ByteArray(data[index..bound]).0 == Some(v) ==> parse_ByteArray(data[index..bound]).1 == data[index+SizeOfV(v)..bound];\r\n}\r\n\r\nlemma lemma_SeqSum_prefix(s:seq, v:V)\r\n ensures SeqSum(s + [v]) == SeqSum(s) + SizeOfV(v)\r\n{\r\n reveal SeqSum();\r\n if |s| == 0 {\r\n } else {\r\n calc {\r\n SeqSum(s + [v]);\r\n { assert (s + [v])[0] == s[0]; \r\n assert (s + [v])[1..] == s[1..]+[v]; }\r\n SizeOfV(s[0]) + SeqSum(s[1..] + [v]);\r\n { lemma_SeqSum_prefix(s[1..], v); }\r\n SizeOfV(s[0]) + SeqSum(s[1..]) + SizeOfV(v);\r\n SeqSum(s) + SizeOfV(v);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_SeqSum_bound(s:seq, bound:int)\r\n requires SeqSum(s) < bound\r\n ensures forall v :: v in s ==> SizeOfV(v) < bound\r\n{\r\n reveal SeqSum();\r\n if |s| == 0 {\r\n } else {\r\n assert SizeOfV(s[0]) + SeqSum(s[1..]) < bound;\r\n assert SizeOfV(s[0]) < bound;\r\n lemma_SeqSum_bound(s[1..], bound);\r\n }\r\n}\r\n\r\nlemma lemma_SeqSum_bound_prefix(s:seq, prefix:seq, index:int)\r\n requires 0 <= index <= |s|\r\n requires prefix == s[..index]\r\n ensures SeqSum(prefix) <= SeqSum(s)\r\n{\r\n reveal SeqSum();\r\n if |prefix| == 0 {\r\n } else {\r\n lemma_SeqSum_bound_prefix(s[1..], prefix[1..], index - 1);\r\n }\r\n}\r\n\r\nlemma lemma_parse_Array_contents_len(data:seq, eltType:G, len:uint64)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires ValidGrammar(eltType)\r\n requires len >= 0\r\n requires !parse_Array_contents(data, eltType, len).0.None?\r\n decreases len\r\n ensures len as int == |parse_Array_contents(data, eltType, len).0.v|\r\n{\r\n reveal parse_Array_contents();\r\n if len == 0 {\r\n } else {\r\n var tuple1 := parse_Val(data, eltType);\r\n var val := tuple1.0;\r\n var rest1 := tuple1.1;\r\n var tuple2 := parse_Array_contents(rest1, eltType, len - 1);\r\n var others := tuple2.0;\r\n var rest2 := tuple2.1;\r\n assert !val.None? && !others.None?;\r\n lemma_parse_Array_contents_len(rest1, eltType, len - 1);\r\n }\r\n}\r\n\r\nlemma lemma_parse_Val_view_Array_contents(data:seq, vs:seq, grammar:G, index:int, bound:int, len:uint64)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires forall v :: v in vs ==> ValInGrammar(v, grammar)\r\n requires ValidGrammar(grammar)\r\n requires len as int == |vs|\r\n requires 0 <= index <= |data|\r\n requires 0 <= index + SeqSum(vs) <= |data|\r\n requires index+SeqSum(vs) <= bound <= |data|\r\n decreases grammar, 1, len\r\n //decreases |vs|\r\n ensures (parse_Array_contents(data[index..bound], grammar, len).0 == Some(vs)) <==> (parse_Array_contents(data[index..index+SeqSum(vs)], grammar, len).0 == Some(vs))\r\n ensures parse_Array_contents(data[index..bound], grammar, len).0 == Some(vs) ==> parse_Array_contents(data[index..bound], grammar, len).1 == data[index+SeqSum(vs)..bound]\r\n{\r\n reveal parse_Array_contents();\r\n if len == 0 {\r\n reveal SeqSum();\r\n } else {\r\n var narrow_tuple := parse_Array_contents(data[index..index+SeqSum(vs)], grammar, len);\r\n var bound_tuple := parse_Array_contents(data[index..bound], grammar, len);\r\n var narrow_val_tuple := parse_Val(data[index..index+SeqSum(vs)], grammar);\r\n var bound_val_tuple := parse_Val(data[index..bound], grammar);\r\n var narrow_contents_tuple := parse_Array_contents(narrow_val_tuple.1, grammar, len - 1);\r\n var bound_contents_tuple := parse_Array_contents(bound_val_tuple.1, grammar, len - 1);\r\n\r\n\r\n if narrow_tuple.0 == Some(vs) {\r\n assert !narrow_val_tuple.0.None? && !narrow_contents_tuple.0.None?;\r\n calc {\r\n index + SeqSum(vs) <= |data|;\r\n SeqSum(vs) <= |data| - index;\r\n SeqSum(vs) < |data| - index + 1;\r\n }\r\n lemma_SeqSum_bound(vs, |data| - index + 1);\r\n lemma_parse_Val_view(data, vs[0], grammar, index);\r\n\r\n lemma_SeqSum_bound(vs, SeqSum(vs) + 1);\r\n assert index+SizeOfV(vs[0]) <= bound <= |data|;\r\n assert (parse_Val(data[index..index+SeqSum(vs)], grammar).0 == Some(vs[0])) <==> (parse_Val(data[index..index+SizeOfV(vs[0])], grammar).0 == Some(vs[0]));\r\n lemma_SeqSum_bound(vs, bound - index + 1);\r\n assert index+SizeOfV(vs[0]) <= bound <= |data|; // OBSERVE (trigger on forall?)\r\n assert (parse_Val(data[index..bound], grammar).0 == Some(vs[0])) <==> (parse_Val(data[index..index+SizeOfV(vs[0])], grammar).0 == Some(vs[0]));\r\n assert narrow_val_tuple.0.v == vs[0] == bound_val_tuple.0.v;\r\n\r\n var new_index := index + SizeOfV(narrow_val_tuple.0.v);\r\n calc {\r\n SizeOfV(narrow_val_tuple.0.v) + SeqSum(vs[1..]);\r\n { reveal SeqSum(); }\r\n SeqSum(vs);\r\n }\r\n assert new_index+SeqSum(vs[1..]) <= bound;\r\n\r\n lemma_parse_Val_view_Array_contents(data, vs[1..], grammar, new_index, bound, len - 1);\r\n\r\n assert (parse_Array_contents(data[new_index..bound], grammar, len - 1).0 == Some(vs[1..])) <==> (parse_Array_contents(data[new_index..new_index+SeqSum(vs[1..])], grammar, len - 1).0 == Some(vs[1..]));\r\n assert data[new_index..new_index+SeqSum(vs[1..])] == narrow_val_tuple.1;\r\n assert data[new_index..bound] == bound_val_tuple.1;\r\n\r\n assert bound_tuple.0 == Some([vs[0]] + vs[1..]) == Some(vs);\r\n } else if bound_tuple.0 == Some(vs) {\r\n assert !bound_val_tuple.0.None? && !bound_contents_tuple.0.None?;\r\n\r\n lemma_SeqSum_bound(vs, |data| - index + 1);\r\n lemma_parse_Val_view(data, vs[0], grammar, index);\r\n // This is exactly the ensures of the lemma above\r\n assert forall bound' :: index+SizeOfV(vs[0]) <= bound' <= |data| ==>\r\n ((parse_Val(data[index..bound'], grammar).0 == Some(vs[0])) <==> (parse_Val(data[index..index+SizeOfV(vs[0])], grammar).0 == Some(vs[0])));\r\n\r\n lemma_SeqSum_bound(vs, bound - index + 1);\r\n lemma_SeqSum_bound(vs, SeqSum(vs) + 1);\r\n assert index+SizeOfV(vs[0]) <= index+SeqSum(vs) <= |data|;\r\n assert (parse_Val(data[index..index+SeqSum(vs)], grammar).0 == Some(vs[0])) <==> (parse_Val(data[index..index+SizeOfV(vs[0])], grammar).0 == Some(vs[0]));\r\n assert (parse_Val(data[index..bound], grammar).0 == Some(vs[0])) <==> (parse_Val(data[index..index+SizeOfV(vs[0])], grammar).0 == Some(vs[0]));\r\n assert narrow_val_tuple.0.v == vs[0] == bound_val_tuple.0.v;\r\n\r\n var new_index := index + SizeOfV(narrow_val_tuple.0.v);\r\n calc {\r\n SizeOfV(narrow_val_tuple.0.v) + SeqSum(vs[1..]);\r\n { reveal SeqSum(); }\r\n SeqSum(vs);\r\n }\r\n assert new_index+SeqSum(vs[1..]) <= bound;\r\n\r\n lemma_parse_Val_view_Array_contents(data, vs[1..], grammar, new_index, bound, len - 1);\r\n\r\n assert (parse_Array_contents(data[new_index..bound], grammar, len - 1).0 == Some(vs[1..])) <==> (parse_Array_contents(data[new_index..new_index+SeqSum(vs[1..])], grammar, len - 1).0 == Some(vs[1..]));\r\n assert data[new_index..new_index+SeqSum(vs[1..])] == narrow_val_tuple.1;\r\n assert data[new_index..bound] == bound_val_tuple.1;\r\n\r\n assert narrow_tuple.0 == Some([vs[0]] + vs[1..]) == Some(vs);\r\n } else {\r\n // Doesn't matter for our ensures clause\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_parse_Val_view_Array(data:seq, v:V, grammar:G, index:int, bound:int)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires ValInGrammar(v, grammar)\r\n requires ValidGrammar(grammar)\r\n requires grammar.GArray?\r\n requires 0 <= index <= |data|\r\n requires 0 <= index + SizeOfV(v) <= |data|\r\n requires index+SizeOfV(v) <= bound <= |data|\r\n decreases grammar, -1\r\n ensures (parse_Array(data[index..bound], grammar.elt).0 == Some(v)) <==> (parse_Array(data[index..index+SizeOfV(v)], grammar.elt).0 == Some(v))\r\n ensures parse_Array(data[index..bound], grammar.elt).0 == Some(v) ==> parse_Array(data[index..bound], grammar.elt).1 == data[index+SizeOfV(v)..bound]\r\n{\r\n var narrow_tuple := parse_Array(data[index..index+SizeOfV(v)], grammar.elt);\r\n var bound_tuple := parse_Array(data[index..bound], grammar.elt);\r\n var narrow_len_tuple := parse_Uint64(data[index..index+SizeOfV(v)]);\r\n var bound_len_tuple := parse_Uint64(data[index..bound]);\r\n var narrow_contents_tuple := parse_Array_contents(narrow_len_tuple.1, grammar.elt, narrow_len_tuple.0.v.u);\r\n var bound_contents_tuple := parse_Array_contents(bound_len_tuple.1, grammar.elt, bound_len_tuple.0.v.u);\r\n\r\n assert narrow_len_tuple.0 == bound_len_tuple.0;\r\n\r\n if bound_tuple.0 == Some(v) {\r\n assert parse_Array_contents(bound_len_tuple.1, grammar.elt, bound_len_tuple.0.v.u).0 == Some(v.a); // OBSERVE\r\n lemma_parse_Array_contents_len(bound_len_tuple.1, grammar.elt, narrow_len_tuple.0.v.u);\r\n lemma_parse_Val_view_Array_contents(data, v.a, grammar.elt, index+8, bound, narrow_len_tuple.0.v.u);\r\n }\r\n\r\n if narrow_tuple.0 == Some(v) {\r\n assert parse_Array_contents(narrow_len_tuple.1, grammar.elt, narrow_len_tuple.0.v.u).0 == Some(v.a); // OBSERVE\r\n lemma_parse_Array_contents_len(narrow_len_tuple.1, grammar.elt, narrow_len_tuple.0.v.u);\r\n lemma_parse_Val_view_Array_contents(data, v.a, grammar.elt, index+8, bound, narrow_len_tuple.0.v.u);\r\n }\r\n}\r\n\r\nlemma lemma_parse_Val_view_Tuple_contents(data:seq, vs:seq, grammar:seq, index:int, bound:int)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires |vs| == |grammar|\r\n requires forall i :: 0 <= i < |vs| ==> ValInGrammar(vs[i], grammar[i])\r\n requires |grammar| < 0x1_0000_0000_0000_0000\r\n requires forall g :: g in grammar ==> ValidGrammar(g)\r\n requires 0 <= index <= |data|\r\n requires 0 <= index + SeqSum(vs) <= |data|\r\n requires index+SeqSum(vs) <= bound <= |data|\r\n decreases grammar, -1, vs\r\n ensures (parse_Tuple_contents(data[index..bound], grammar).0 == Some(vs)) <==> (parse_Tuple_contents(data[index..index+SeqSum(vs)], grammar).0 == Some(vs))\r\n ensures parse_Tuple_contents(data[index..bound], grammar).0 == Some(vs) ==> parse_Tuple_contents(data[index..bound], grammar).1 == data[index+SeqSum(vs)..bound]\r\n{\r\n reveal parse_Tuple_contents();\r\n if grammar == [] {\r\n reveal SeqSum();\r\n } else {\r\n var narrow_tuple := parse_Tuple_contents(data[index..index+SeqSum(vs)], grammar);\r\n var bound_tuple := parse_Tuple_contents(data[index..bound], grammar);\r\n var narrow_val_tuple := parse_Val(data[index..index+SeqSum(vs)], grammar[0]);\r\n var bound_val_tuple := parse_Val(data[index..bound], grammar[0]);\r\n var narrow_contents_tuple := parse_Tuple_contents(narrow_val_tuple.1, grammar[1..]);\r\n var bound_contents_tuple := parse_Tuple_contents(bound_val_tuple.1, grammar[1..]);\r\n\r\n\r\n if narrow_tuple.0 == Some(vs) {\r\n assert !narrow_val_tuple.0.None? && !narrow_contents_tuple.0.None?;\r\n calc {\r\n index + SeqSum(vs) <= |data|;\r\n SeqSum(vs) <= |data| - index;\r\n SeqSum(vs) < |data| - index + 1;\r\n }\r\n lemma_SeqSum_bound(vs, |data| - index + 1);\r\n lemma_parse_Val_view(data, vs[0], grammar[0], index);\r\n lemma_SeqSum_bound(vs, SeqSum(vs) + 1);\r\n assert index+SizeOfV(vs[0]) <= bound <= |data|;\r\n assert (parse_Val(data[index..index+SeqSum(vs)], grammar[0]).0 == Some(vs[0])) <==> (parse_Val(data[index..index+SizeOfV(vs[0])], grammar[0]).0 == Some(vs[0]));\r\n lemma_SeqSum_bound(vs, bound - index + 1);\r\n assert index+SizeOfV(vs[0]) <= bound <= |data|; // OBSERVE (trigger on forall?)\r\n assert (parse_Val(data[index..bound], grammar[0]).0 == Some(vs[0])) <==> (parse_Val(data[index..index+SizeOfV(vs[0])], grammar[0]).0 == Some(vs[0]));\r\n assert narrow_val_tuple.0.v == vs[0] == bound_val_tuple.0.v;\r\n\r\n var new_index := index + SizeOfV(narrow_val_tuple.0.v);\r\n calc {\r\n SizeOfV(narrow_val_tuple.0.v) + SeqSum(vs[1..]);\r\n { reveal SeqSum(); }\r\n SeqSum(vs);\r\n }\r\n assert new_index+SeqSum(vs[1..]) <= bound;\r\n\r\n lemma_parse_Val_view_Tuple_contents(data, vs[1..], grammar[1..], new_index, bound);\r\n\r\n assert (parse_Tuple_contents(data[new_index..bound], grammar[1..]).0 == Some(vs[1..])) <==> (parse_Tuple_contents(data[new_index..new_index+SeqSum(vs[1..])], grammar[1..]).0 == Some(vs[1..]));\r\n assert data[new_index..new_index+SeqSum(vs[1..])] == narrow_val_tuple.1;\r\n assert data[new_index..bound] == bound_val_tuple.1;\r\n\r\n assert bound_tuple.0 == Some([vs[0]] + vs[1..]) == Some(vs);\r\n } else if bound_tuple.0 == Some(vs) {\r\n assert !bound_val_tuple.0.None? && !bound_contents_tuple.0.None?;\r\n\r\n lemma_SeqSum_bound(vs, |data| - index + 1);\r\n lemma_parse_Val_view(data, vs[0], grammar[0], index);\r\n // This is exactly the ensures of the lemma above\r\n assert forall bound' :: index+SizeOfV(vs[0]) <= bound' <= |data| ==>\r\n ((parse_Val(data[index..bound'], grammar[0]).0 == Some(vs[0])) <==> (parse_Val(data[index..index+SizeOfV(vs[0])], grammar[0]).0 == Some(vs[0])));\r\n\r\n lemma_SeqSum_bound(vs, bound - index + 1);\r\n lemma_SeqSum_bound(vs, SeqSum(vs) + 1);\r\n assert index+SizeOfV(vs[0]) <= index+SeqSum(vs) <= |data|;\r\n assert (parse_Val(data[index..index+SeqSum(vs)], grammar[0]).0 == Some(vs[0])) <==> (parse_Val(data[index..index+SizeOfV(vs[0])], grammar[0]).0 == Some(vs[0]));\r\n assert (parse_Val(data[index..bound], grammar[0]).0 == Some(vs[0])) <==> (parse_Val(data[index..index+SizeOfV(vs[0])], grammar[0]).0 == Some(vs[0]));\r\n assert narrow_val_tuple.0.v == vs[0] == bound_val_tuple.0.v;\r\n\r\n var new_index := index + SizeOfV(narrow_val_tuple.0.v);\r\n calc {\r\n SizeOfV(narrow_val_tuple.0.v) + SeqSum(vs[1..]);\r\n { reveal SeqSum(); }\r\n SeqSum(vs);\r\n }\r\n assert new_index+SeqSum(vs[1..]) <= bound;\r\n\r\n lemma_parse_Val_view_Tuple_contents(data, vs[1..], grammar[1..], new_index, bound);\r\n\r\n assert (parse_Tuple_contents(data[new_index..bound], grammar[1..]).0 == Some(vs[1..])) <==> (parse_Tuple_contents(data[new_index..new_index+SeqSum(vs[1..])], grammar[1..]).0 == Some(vs[1..]));\r\n assert data[new_index..new_index+SeqSum(vs[1..])] == narrow_val_tuple.1;\r\n assert data[new_index..bound] == bound_val_tuple.1;\r\n\r\n assert narrow_tuple.0 == Some([vs[0]] + vs[1..]) == Some(vs);\r\n } else {\r\n // Doesn't matter for our ensures clause\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_parse_Val_view_Tuple(data:seq, v:V, grammar:seq, index:int, bound:int)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires v.VTuple?\r\n requires |v.t| == |grammar|\r\n requires forall i :: 0 <= i < |v.t| ==> ValInGrammar(v.t[i], grammar[i])\r\n requires |grammar| < 0x1_0000_0000_0000_0000\r\n requires forall g :: g in grammar ==> ValidGrammar(g)\r\n requires 0 <= index <= |data|\r\n requires 0 <= index + SizeOfV(v) <= |data|\r\n requires index+SizeOfV(v) <= bound <= |data|\r\n decreases grammar, -1, v\r\n ensures (parse_Tuple(data[index..bound], grammar).0 == Some(v)) <==> (parse_Tuple(data[index..index+SizeOfV(v)], grammar).0 == Some(v))\r\n ensures parse_Tuple(data[index..bound], grammar).0 == Some(v) ==> parse_Tuple(data[index..bound], grammar).1 == data[index+SizeOfV(v)..bound]\r\n{\r\n var bound_tuple := parse_Tuple(data[index..bound], grammar);\r\n var bound_contents := bound_tuple.0;\r\n var bound_rest := bound_tuple.1;\r\n var narrow_tuple := parse_Tuple(data[index..index+SizeOfV(v)], grammar);\r\n var narrow_contents := narrow_tuple.0;\r\n var narrow_rest := narrow_tuple.1;\r\n\r\n if parse_Tuple(data[index..bound], grammar).0 == Some(v) {\r\n assert !bound_contents.None?;\r\n lemma_parse_Val_view_Tuple_contents(data, v.t, grammar, index, bound);\r\n assert (parse_Tuple_contents(data[index..bound], grammar).0 == Some(v.t)) <==> (parse_Tuple_contents(data[index..index+SeqSum(v.t)], grammar).0 == Some(v.t)); // OBSERVE\r\n } else if parse_Tuple(data[index..index+SizeOfV(v)], grammar).0 == Some(v) {\r\n assert !narrow_contents.None?;\r\n lemma_parse_Val_view_Tuple_contents(data, v.t, grammar, index, bound);\r\n assert (parse_Tuple_contents(data[index..bound], grammar).0 == Some(v.t)) <==> (parse_Tuple_contents(data[index..index+SeqSum(v.t)], grammar).0 == Some(v.t)); // OBSERVE\r\n } else {\r\n // Don't care\r\n }\r\n}\r\n\r\nlemma lemma_parse_Val_view_Union(data:seq, v:V, grammar:G, index:int, bound:int)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires ValInGrammar(v, grammar)\r\n requires ValidGrammar(grammar)\r\n requires grammar.GTaggedUnion?\r\n requires 0 <= index <= |data|\r\n requires 0 <= index + SizeOfV(v) <= |data|\r\n requires index+SizeOfV(v) <= bound <= |data|\r\n decreases grammar, -1\r\n ensures (parse_Case(data[index..bound], grammar.cases).0 == Some(v)) <==> (parse_Case(data[index..index+SizeOfV(v)], grammar.cases).0 == Some(v))\r\n ensures parse_Case(data[index..bound], grammar.cases).0 == Some(v) ==> parse_Case(data[index..bound], grammar.cases).1 == data[index+SizeOfV(v)..bound]\r\n{\r\n var narrow_tuple := parse_Case(data[index..index+SizeOfV(v)], grammar.cases);\r\n var bound_tuple := parse_Case(data[index..bound], grammar.cases);\r\n var narrow_caseID_tuple := parse_Uint64(data[index..index+SizeOfV(v)]);\r\n var bound_caseID_tuple := parse_Uint64(data[index..bound]);\r\n // assert narrow_caseID_tuple.0.v == bound_caseID_tuple.0.v;\r\n\r\n if parse_Case(data[index..bound], grammar.cases).0 == Some(v) {\r\n var narrow_val_tuple := parse_Val(narrow_caseID_tuple.1, grammar.cases[narrow_caseID_tuple.0.v.u]);\r\n var bound_val_tuple := parse_Val(bound_caseID_tuple.1, grammar.cases[bound_caseID_tuple.0.v.u]);\r\n\r\n // assert ValInGrammar(v.val, grammar.cases[narrow_caseID_tuple.0.v.u]);\r\n if (ValInGrammar(v.val, grammar.cases[narrow_caseID_tuple.0.v.u])){\r\n lemma_parse_Val_view(data, v.val, grammar.cases[narrow_caseID_tuple.0.v.u], index + 8);\r\n assert index+SizeOfV(v.val) <= bound <= |data|;\r\n assert (parse_Val(data[index+8..bound], grammar.cases[narrow_caseID_tuple.0.v.u]).0 == Some(v.val)) <==> (parse_Val(data[index+8..index+8+SizeOfV(v.val)], grammar.cases[narrow_caseID_tuple.0.v.u]).0 == Some(v.val));\r\n }\r\n } else if parse_Case(data[index..index+SizeOfV(v)], grammar.cases).0 == Some(v) {\r\n var narrow_val_tuple := parse_Val(narrow_caseID_tuple.1, grammar.cases[narrow_caseID_tuple.0.v.u]);\r\n // var bound_val_tuple := parse_Val(bound_caseID_tuple.1, grammar.cases[bound_caseID_tuple.0.v.u]);\r\n\r\n lemma_parse_Val_view(data, v.val, grammar.cases[narrow_caseID_tuple.0.v.u], index + 8);\r\n assert (parse_Val(data[index+8..bound], grammar.cases[narrow_caseID_tuple.0.v.u]).0 == Some(v.val)) <==> (parse_Val(data[index+8..index+8+SizeOfV(v.val)], grammar.cases[narrow_caseID_tuple.0.v.u]).0 == Some(v.val));\r\n assert index + SizeOfV(v) == bound;\r\n } else {\r\n // Doesn't matter\r\n }\r\n}\r\n\r\nlemma lemma_parse_Val_view(data:seq, v:V, grammar:G, index:int)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires ValInGrammar(v, grammar)\r\n requires ValidGrammar(grammar)\r\n requires 0 <= index <= |data|\r\n requires 0 <= index + SizeOfV(v) <= |data|\r\n decreases grammar, 0\r\n ensures forall bound :: index+SizeOfV(v) <= bound <= |data| ==>\r\n ((parse_Val(data[index..bound], grammar).0 == Some(v)) <==> (parse_Val(data[index..index+SizeOfV(v)], grammar).0 == Some(v)))\r\n ensures forall bound :: index+SizeOfV(v) <= bound <= |data| ==>\r\n (parse_Val(data[index..bound], grammar).0 == Some(v)) ==> parse_Val(data[index..bound], grammar).1 == data[index+SizeOfV(v)..bound]\r\n{\r\n forall bound | index+SizeOfV(v) <= bound <= |data|\r\n ensures (parse_Val(data[index..bound], grammar).0 == Some(v)) <==> (parse_Val(data[index..index+SizeOfV(v)], grammar).0 == Some(v))\r\n ensures (parse_Val(data[index..bound], grammar).0 == Some(v)) ==> parse_Val(data[index..bound], grammar).1 == data[index+SizeOfV(v)..bound]\r\n {\r\n reveal parse_Val();\r\n match grammar\r\n case GUint64 => assert (parse_Val(data[index..bound], grammar).0 == Some(v)) <==> (parse_Val(data[index..index+SizeOfV(v)], grammar).0 == Some(v));\r\n case GArray(elt) => lemma_parse_Val_view_Array(data, v, grammar, index, bound);\r\n assert (parse_Val(data[index..bound], grammar).0 == Some(v)) <==> (parse_Val(data[index..index+SizeOfV(v)], grammar).0 == Some(v));\r\n case GTuple(t) => lemma_parse_Val_view_Tuple(data, v, t, index, bound); assert (parse_Val(data[index..bound], grammar).0 == Some(v)) <==> (parse_Val(data[index..index+SizeOfV(v)], grammar).0 == Some(v));\r\n case GByteArray => lemma_parse_Val_view_ByteArray(data, v, grammar, index); assert (parse_Val(data[index..bound], grammar).0 == Some(v)) <==> (parse_Val(data[index..index+SizeOfV(v)], grammar).0 == Some(v));\r\n case GTaggedUnion(cases) => lemma_parse_Val_view_Union(data, v, grammar, index, bound); assert (parse_Val(data[index..bound], grammar).0 == Some(v)) <==> (parse_Val(data[index..index+SizeOfV(v)], grammar).0 == Some(v));\r\n }\r\n}\r\n\r\n\r\nlemma lemma_parse_Val_view_specific(data:seq, v:V, grammar:G, index:int, bound:int)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires ValInGrammar(v, grammar)\r\n requires ValidGrammar(grammar)\r\n requires 0 <= index <= |data|\r\n requires 0 <= index + SizeOfV(v) <= |data|\r\n requires index+SizeOfV(v) <= bound <= |data|;\r\n requires parse_Val(data[index..index+SizeOfV(v)], grammar).0 == Some(v)\r\n decreases grammar, 0\r\n ensures parse_Val(data[index..bound], grammar).0 == Some(v)\r\n ensures parse_Val(data[index..bound], grammar).1 == data[index+SizeOfV(v)..bound]\r\n{\r\n lemma_parse_Val_view(data, v, grammar, index);\r\n}\r\n\r\nlemma lemma_parse_Val_view_specific_size(data:seq, v:V, grammar:G, index:int, bound:int)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires ValInGrammar(v, grammar)\r\n requires ValidGrammar(grammar)\r\n requires 0 <= index <= |data|\r\n requires 0 <= index + SizeOfV(v) <= |data|\r\n requires index+SizeOfV(v) <= bound <= |data|\r\n requires parse_Val(data[index..bound], grammar).0 == Some(v)\r\n decreases grammar, 0\r\n ensures parse_Val(data[index..index+SizeOfV(v)], grammar).0 == Some(v)\r\n ensures parse_Val(data[index..bound], grammar).1 == data[index+SizeOfV(v)..bound]\r\n{\r\n lemma_parse_Val_view(data, v, grammar, index);\r\n}\r\n\r\nmethod ComputeSeqSum(s:seq) returns (size:uint64)\r\n requires |s| < 0x1_0000_0000_0000_0000\r\n requires 0 <= SeqSum(s) < 0x1_0000_0000_0000_0000\r\n requires forall v :: v in s ==> ValidVal(v)\r\n ensures size as int == SeqSum(s)\r\n{\r\n reveal SeqSum();\r\n if |s| as uint64 == 0 {\r\n size := 0;\r\n } else {\r\n var v_size := ComputeSizeOf(s[0]);\r\n var rest_size := ComputeSeqSum(s[1..]);\r\n size := v_size + rest_size;\r\n }\r\n}\r\n\r\nmethod ComputeSizeOf(val:V) returns (size:uint64)\r\n requires 0 <= SizeOfV(val) < 0x1_0000_0000_0000_0000\r\n requires ValidVal(val)\r\n ensures size as int == SizeOfV(val)\r\n{\r\n match val\r\n case VUint64(_) => size := 8;\r\n case VArray(a) => var v := ComputeSeqSum(a);\r\n if v == 0 {\r\n size := 8;\r\n } else {\r\n size := 8 + v;\r\n }\r\n case VTuple(t) => size := ComputeSeqSum(t);\r\n case VByteArray(b) => size := 8 + (|b| as uint64);\r\n case VCase(c, v) => var vs := ComputeSizeOf(v);\r\n size := 8 + vs;\r\n}\r\n\r\nmethod MarshallUint64(n:uint64, data:array, index:uint64)\r\n requires (index as int) + (Uint64Size() as int) <= data.Length\r\n requires 0 <= (index as int) + (Uint64Size() as int) < 0x1_0000_0000_0000_0000 // Needed to prevent overflow below\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n modifies data\r\n ensures SeqByteToUint64(data[index..index+Uint64Size()]) == n\r\n ensures !parse_Uint64(data[index .. index+Uint64Size()]).0.None?\r\n ensures !parse_Uint64(data[index .. ]).0.None?\r\n ensures var tuple := parse_Uint64(data[index .. index+Uint64Size()]);\r\n tuple.0.v.u == n && tuple.1 == []\r\n ensures var tuple := parse_Uint64(data[index .. ]);\r\n tuple.0.v.u == n && tuple.1 == data[index+Uint64Size()..]\r\n ensures data[0..index] == old(data[0..index])\r\n ensures data[index+Uint64Size()..] == old(data[index+Uint64Size()..])\r\n ensures forall i :: 0 <= i < index ==> data[i] == old(data[i])\r\n ensures forall i :: (index as int) + (Uint64Size() as int) <= i < data.Length ==> data[i] == old(data[i])\r\n{\r\n MarshallUint64_guts(n, data, index);\r\n calc {\r\n parse_Uint64(data[index .. index+Uint64Size()]).0.v.u;\r\n (Some(VUint64(SeqByteToUint64(data[index .. index+Uint64Size()][..Uint64Size()]))), data[Uint64Size()..]).0.v.u;\r\n SeqByteToUint64(data[index .. index+Uint64Size()][..Uint64Size()]);\r\n SeqByteToUint64(data[index .. index+Uint64Size()]);\r\n SeqByteToUint64(data[index .. index+(Uint64Size() as uint64)]);\r\n n;\r\n }\r\n calc {\r\n parse_Uint64(data[index..]).0.v.u;\r\n (Some(VUint64(SeqByteToUint64(data[index..][..Uint64Size()]))), data[Uint64Size()..]).0.v.u;\r\n SeqByteToUint64(data[index..][..Uint64Size()]);\r\n SeqByteToUint64(data[index .. index+Uint64Size()]);\r\n SeqByteToUint64(data[index .. index+(Uint64Size() as uint64)]);\r\n n;\r\n }\r\n}\r\n\r\nlemma lemma_marshall_array_contents(contents:seq, eltType:G, marshalled_bytes:seq, trace:seq>)\r\n requires forall v :: v in contents ==> ValInGrammar(v, eltType)\r\n requires forall v :: v in contents ==> ValidVal(v)\r\n requires ValidGrammar(eltType)\r\n requires |marshalled_bytes| < 0x1_0000_0000_0000_0000\r\n requires |contents| < 0x1_0000_0000_0000_0000\r\n requires |contents| == |trace|\r\n requires |marshalled_bytes| == SeqSum(contents)\r\n requires marshalled_bytes == SeqCatRev(trace)\r\n requires forall j :: 0 <= j < |trace| ==> SizeOfV(contents[j]) == |trace[j]| < 0x1_0000_0000_0000_0000\r\n requires forall j :: 0 <= j < |trace| ==> var (val, rest) := parse_Val(trace[j], eltType); val.Some? && val.v == contents[j];\r\n ensures parse_Array_contents(marshalled_bytes, eltType, |contents| as uint64).0.Some?\r\n ensures parse_Array_contents(marshalled_bytes, eltType, |contents| as uint64).0.v == contents\r\n{\r\n if |contents| == 0 {\r\n reveal parse_Array_contents();\r\n } else {\r\n var val_tuple := parse_Val(marshalled_bytes, eltType);\r\n var val, rest1 := val_tuple.0, val_tuple.1;\r\n var rest_tuple := parse_Array_contents(rest1, eltType, |contents| as uint64-1);\r\n var others, rest2 := rest_tuple.0, rest_tuple.1;\r\n var target := parse_Array_contents(marshalled_bytes, eltType, |contents| as uint64).0;\r\n calc {\r\n target;\r\n { reveal parse_Array_contents(); }\r\n if !val.None? && !others.None? then Some([val.v] + others.v) else None;\r\n }\r\n\r\n calc {\r\n SeqCatRev(trace);\r\n { lemma_SeqCat_equivalent(trace); }\r\n SeqCat(trace);\r\n }\r\n\r\n assert marshalled_bytes[0..SizeOfV(contents[0])] == trace[0];\r\n assert parse_Val(trace[0], eltType).0.Some?;\r\n assert parse_Val(trace[0], eltType).0.v == contents[0];\r\n lemma_parse_Val_view_specific(marshalled_bytes, contents[0], eltType, 0, |marshalled_bytes|);\r\n assert parse_Val(marshalled_bytes[0..|marshalled_bytes|], eltType).0 == Some(contents[0]);\r\n assert marshalled_bytes[0..|marshalled_bytes|] == marshalled_bytes; // OBSERVE\r\n assert val.Some? && val.v == contents[0];\r\n assert rest1 == marshalled_bytes[SizeOfV(contents[0])..];\r\n\r\n // Prove a requires for the recursive call\r\n calc {\r\n marshalled_bytes[SizeOfV(contents[0])..];\r\n calc {\r\n marshalled_bytes;\r\n SeqCatRev(trace);\r\n { lemma_SeqCat_equivalent(trace); }\r\n SeqCat(trace);\r\n trace[0] + SeqCat(trace[1..]);\r\n { lemma_SeqCat_equivalent(trace[1..]); }\r\n trace[0] + SeqCatRev(trace[1..]);\r\n }\r\n (trace[0] + SeqCatRev(trace[1..]))[SizeOfV(contents[0])..];\r\n { assert |trace[0]| == SizeOfV(contents[0]); }\r\n SeqCatRev(trace[1..]);\r\n }\r\n\r\n // Prove a requires for the recursive call\r\n calc {\r\n SeqSum(contents);\r\n { reveal SeqSum(); }\r\n SizeOfV(contents[0]) + SeqSum(contents[1..]);\r\n }\r\n lemma_marshall_array_contents(contents[1..], eltType, marshalled_bytes[SizeOfV(contents[0])..], trace[1..]);\r\n assert others.Some?;\r\n assert others.v == contents[1..];\r\n assert contents == [contents[0]] + contents[1..];\r\n }\r\n}\r\n\r\nmethod{:timeLimitMultiplier 4} MarshallArrayContents(contents:seq, eltType:G, data:array, index:uint64) returns (size:uint64)\r\n requires forall v :: v in contents ==> ValInGrammar(v, eltType)\r\n requires forall v :: v in contents ==> ValidVal(v)\r\n requires ValidGrammar(eltType)\r\n requires (index as int) + SeqSum(contents) <= data.Length\r\n requires 0 <= (index as int) + SeqSum(contents) < 0x1_0000_0000_0000_0000\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n requires |contents| < 0x1_0000_0000_0000_0000\r\n decreases eltType, 1, |contents|\r\n modifies data\r\n ensures parse_Array_contents(data[index..(index as int) + SeqSum(contents)], eltType, |contents| as uint64).0.Some?\r\n ensures parse_Array_contents(data[index..(index as int) + SeqSum(contents)], eltType, |contents| as uint64).0.v == contents\r\n ensures forall i :: 0 <= i < index ==> data[i] == old(data[i])\r\n ensures forall i :: (index as int) + SeqSum(contents) <= i < data.Length ==> data[i] == old(data[i])\r\n ensures size as int == SeqSum(contents)\r\n{\r\n var i:int := 0;\r\n var cur_index := index;\r\n reveal SeqSum();\r\n reveal parse_Array_contents();\r\n\r\n ghost var trace := [];\r\n ghost var marshalled_bytes := [];\r\n\r\n while i < |contents|\r\n invariant 0 <= i <= |contents|\r\n invariant 0 <= index as int <= (index as int) + SeqSum(contents[..i]) <= data.Length\r\n invariant cur_index as int == (index as int) + SeqSum(contents[..i])\r\n invariant forall j :: 0 <= j < index ==> data[j] == old(data[j])\r\n invariant forall j :: (index as int) + SeqSum(contents) <= j < data.Length ==> data[j] == old(data[j])\r\n invariant marshalled_bytes == data[index..cur_index]\r\n invariant marshalled_bytes == SeqCatRev(trace)\r\n invariant |trace| == i\r\n invariant forall j :: 0 <= j < |trace| ==> SizeOfV(contents[j]) == |trace[j]| < 0x1_0000_0000_0000_0000\r\n invariant forall j :: 0 <= j < |trace| ==> \r\n var (val, rest) := parse_Val(trace[j], eltType); \r\n val.Some? && val.v == contents[j]\r\n {\r\n lemma_SeqSum_bound(contents, 0x1_0000_0000_0000_0000);\r\n\r\n // Prove we meet MarshallVal's length requirement\r\n calc <= {\r\n (cur_index as int) + SizeOfV(contents[i]);\r\n (index as int) + SeqSum(contents[..i]) + SizeOfV(contents[i]);\r\n { lemma_SeqSum_prefix(contents[..i], contents[i]); \r\n assert contents[..i] + [contents[i]] == contents[..i+1]; }\r\n (index as int) + SeqSum(contents[..i+1]);\r\n { lemma_SeqSum_bound_prefix(contents, contents[..i+1], i+1); }\r\n //{ lemma_SeqSum_bound(contents, data.Length - (index as int) + 1); }\r\n (index as int) + SeqSum(contents);\r\n //data.Length;\r\n }\r\n var item_size := MarshallVal(contents[i], eltType, data, cur_index);\r\n //var item_size := ComputeSizeOf(contents[i as uint64]);\r\n\r\n ghost var fresh_bytes := data[cur_index..cur_index + item_size];\r\n marshalled_bytes := marshalled_bytes + fresh_bytes;\r\n forall ensures var (val, rest) := parse_Val(fresh_bytes, eltType);\r\n val.Some? && val.v == contents[i]\r\n {\r\n assert SizeOfV(contents[i]) <= |fresh_bytes|; // OBSERVE\r\n lemma_parse_Val_view(fresh_bytes, contents[i], eltType, 0);\r\n }\r\n\r\n ghost var old_trace := trace;\r\n trace := trace + [fresh_bytes];\r\n\r\n ghost var old_cur_index := cur_index;\r\n cur_index := cur_index + item_size;\r\n i := i + 1;\r\n\r\n // Prove the invariant that we stay within bounds\r\n calc <= {\r\n (index as int) + SeqSum(contents[..i]);\r\n calc {\r\n SeqSum(contents[..i]);\r\n <= { lemma_SeqSum_bound_prefix(contents, contents[..i], i); }\r\n SeqSum(contents);\r\n }\r\n (index as int) + SeqSum(contents);\r\n data.Length;\r\n }\r\n assert {:split_here} true;\r\n assert marshalled_bytes == data[index..cur_index];\r\n\r\n // Prove the invariant about our index tracking correctly\r\n calc {\r\n cur_index as int;\r\n (old_cur_index as int) + SizeOfV(contents[i-1]);\r\n (index as int) + SeqSum(contents[..i-1]) + SizeOfV(contents[i-1]);\r\n { lemma_SeqSum_prefix(contents[..i-1], contents[i-1]); \r\n assert contents[..i-1] + [contents[i-1]] == contents[..i]; }\r\n (index as int) + SeqSum(contents[..i]);\r\n }\r\n assert cur_index as int == (index as int) + SeqSum(contents[..i]);\r\n assert marshalled_bytes == data[index..cur_index];\r\n }\r\n\r\n // Prove that parsing will produce the correct result\r\n\r\n // After the while loop, we know:\r\n assert contents[..i] == contents; // OBSERVE\r\n assert cur_index as int == (index as int) + SeqSum(contents);\r\n assert marshalled_bytes == data[index..(index as int)+SeqSum(contents)];\r\n //assert marshalled_bytes == SeqCatRev(trace);\r\n //assert |trace| == |contents|;\r\n lemma_marshall_array_contents(contents, eltType, marshalled_bytes, trace);\r\n size := cur_index - index;\r\n}\r\n\r\nmethod MarshallArray(val:V, grammar:G, data:array, index:uint64) returns (size:uint64)\r\n requires val.VArray?\r\n requires ValInGrammar(val, grammar)\r\n requires ValidGrammar(grammar)\r\n requires ValidVal(val)\r\n requires (index as int) + SizeOfV(val) <= data.Length\r\n requires 0 <= (index as int) + SizeOfV(val) < 0x1_0000_0000_0000_0000 // Needed to prevent overflow below\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n modifies data\r\n decreases grammar, -1\r\n ensures parse_Val(data[index..(index as int) + SizeOfV(val)], grammar).0.Some? &&\r\n parse_Val(data[index..(index as int) + SizeOfV(val)], grammar).0.v == val\r\n ensures forall i :: 0 <= i < index ==> data[i] == old(data[i])\r\n ensures forall i :: (index as int) + SizeOfV(val) <= i < data.Length ==> data[i] == old(data[i])\r\n ensures (size as int) == SizeOfV(val)\r\n{\r\n //assert{:split_here} true;\r\n reveal parse_Val();\r\n MarshallUint64(|val.a| as uint64, data, index);\r\n\r\n ghost var tuple := parse_Uint64(data[index..(index as int) + SizeOfV(val)]);\r\n ghost var len := tuple.0;\r\n ghost var rest := tuple.1;\r\n assert !len.None?;\r\n var contents_size := MarshallArrayContents(val.a, grammar.elt, data, index + Uint64Size());\r\n tuple := parse_Uint64(data[index..(index as int) + SizeOfV(val)]);\r\n assert {:split_here} true;\r\n len := tuple.0;\r\n rest := tuple.1;\r\n assert !len.None?;\r\n ghost var contents_tuple := parse_Array_contents(rest, grammar.elt, len.v.u);\r\n ghost var contents := contents_tuple.0;\r\n ghost var remainder := contents_tuple.1;\r\n assert !contents.None?;\r\n size := 8 + contents_size;\r\n}\r\n\r\nlemma lemma_marshall_tuple_contents(contents:seq, eltTypes:seq, marshalled_bytes:seq, trace:seq>)\r\n requires |contents| == |eltTypes|\r\n requires forall i :: 0 <= i < |contents| ==> ValInGrammar(contents[i], eltTypes[i])\r\n requires forall g :: g in eltTypes ==> ValidGrammar(g)\r\n requires |eltTypes| < 0x1_0000_0000_0000_0000\r\n requires forall i :: 0 <= i < |contents| ==> ValidVal(contents[i])\r\n requires |marshalled_bytes| < 0x1_0000_0000_0000_0000\r\n requires |contents| < 0x1_0000_0000_0000_0000\r\n requires |contents| == |trace|\r\n requires |marshalled_bytes| == SeqSum(contents)\r\n requires marshalled_bytes == SeqCatRev(trace)\r\n requires forall j :: 0 <= j < |trace| ==> SizeOfV(contents[j]) == |trace[j]| < 0x1_0000_0000_0000_0000\r\n requires forall j :: 0 <= j < |trace| ==> var (val, rest) := parse_Val(trace[j], eltTypes[j]); val.Some? && val.v == contents[j];\r\n ensures parse_Tuple_contents(marshalled_bytes, eltTypes).0.Some?\r\n ensures parse_Tuple_contents(marshalled_bytes, eltTypes).0.v == contents\r\n{\r\n if |contents| == 0 {\r\n reveal parse_Tuple_contents();\r\n } else {\r\n var val_tuple := parse_Val(marshalled_bytes, eltTypes[0]);\r\n var val, rest1 := val_tuple.0, val_tuple.1;\r\n var rest_tuple := parse_Tuple_contents(rest1, eltTypes[1..]);\r\n var others, rest2 := rest_tuple.0, rest_tuple.1;\r\n var target := parse_Tuple_contents(marshalled_bytes, eltTypes).0;\r\n calc {\r\n target;\r\n { reveal parse_Tuple_contents(); }\r\n if !val.None? && !others.None? then Some([val.v] + others.v) else None;\r\n }\r\n\r\n calc {\r\n SeqCatRev(trace);\r\n { lemma_SeqCat_equivalent(trace); }\r\n SeqCat(trace);\r\n }\r\n\r\n assert marshalled_bytes[0..SizeOfV(contents[0])] == trace[0];\r\n assert parse_Val(trace[0], eltTypes[0]).0.Some?;\r\n assert parse_Val(trace[0], eltTypes[0]).0.v == contents[0];\r\n lemma_parse_Val_view_specific(marshalled_bytes, contents[0], eltTypes[0], 0, |marshalled_bytes|);\r\n assert parse_Val(marshalled_bytes[0..|marshalled_bytes|], eltTypes[0]).0 == Some(contents[0]);\r\n assert marshalled_bytes[0..|marshalled_bytes|] == marshalled_bytes; // OBSERVE\r\n assert val.Some? && val.v == contents[0];\r\n assert rest1 == marshalled_bytes[SizeOfV(contents[0])..];\r\n\r\n // Prove a requires for the recursive call\r\n calc {\r\n marshalled_bytes[SizeOfV(contents[0])..];\r\n calc {\r\n marshalled_bytes;\r\n SeqCatRev(trace);\r\n { lemma_SeqCat_equivalent(trace); }\r\n SeqCat(trace);\r\n trace[0] + SeqCat(trace[1..]);\r\n { lemma_SeqCat_equivalent(trace[1..]); }\r\n trace[0] + SeqCatRev(trace[1..]);\r\n }\r\n (trace[0] + SeqCatRev(trace[1..]))[SizeOfV(contents[0])..];\r\n { assert |trace[0]| == SizeOfV(contents[0]); }\r\n SeqCatRev(trace[1..]);\r\n }\r\n\r\n // Prove a requires for the recursive call\r\n calc {\r\n SeqSum(contents);\r\n { reveal SeqSum(); }\r\n SizeOfV(contents[0]) + SeqSum(contents[1..]);\r\n }\r\n lemma_marshall_tuple_contents(contents[1..], eltTypes[1..], marshalled_bytes[SizeOfV(contents[0])..], trace[1..]);\r\n assert others.Some?;\r\n assert others.v == contents[1..];\r\n assert contents == [contents[0]] + contents[1..];\r\n }\r\n}\r\n\r\nmethod{:timeLimitMultiplier 2} MarshallTupleContents(contents:seq, eltTypes:seq, data:array, index:uint64) returns (size:uint64)\r\n requires |contents| == |eltTypes|\r\n requires forall i :: 0 <= i < |contents| ==> ValInGrammar(contents[i], eltTypes[i])\r\n requires forall g :: g in eltTypes ==> ValidGrammar(g)\r\n requires |eltTypes| < 0x1_0000_0000_0000_0000\r\n requires forall i :: 0 <= i < |contents| ==> ValidVal(contents[i])\r\n requires (index as int) + SeqSum(contents) <= data.Length\r\n requires 0 <= (index as int) + SeqSum(contents) < 0x1_0000_0000_0000_0000\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n requires |contents| < 0x1_0000_0000_0000_0000\r\n decreases eltTypes, 1, |contents|\r\n modifies data\r\n ensures parse_Tuple_contents(data[index..(index as int) + SeqSum(contents)], eltTypes).0.Some?\r\n ensures parse_Tuple_contents(data[index..(index as int) + SeqSum(contents)], eltTypes).0.v == contents\r\n ensures forall i :: 0 <= i < index ==> data[i] == old(data[i])\r\n ensures forall i :: (index as int) + SeqSum(contents) <= i < data.Length ==> data[i] == old(data[i])\r\n ensures size as int == SeqSum(contents)\r\n{\r\n var i:int := 0;\r\n var cur_index := index;\r\n reveal SeqSum();\r\n reveal parse_Tuple_contents();\r\n\r\n ghost var trace := [];\r\n ghost var marshalled_bytes := [];\r\n\r\n while i < |contents|\r\n invariant 0 <= i <= |contents|\r\n invariant 0 <= index as int <= (index as int) + SeqSum(contents[..i]) <= data.Length\r\n invariant cur_index as int == (index as int) + SeqSum(contents[..i])\r\n invariant forall j :: 0 <= j < index ==> data[j] == old(data[j])\r\n invariant forall j :: (index as int) + SeqSum(contents) <= j < data.Length ==> data[j] == old(data[j])\r\n invariant marshalled_bytes == data[index..cur_index]\r\n invariant marshalled_bytes == SeqCatRev(trace)\r\n invariant |trace| == i\r\n invariant forall j :: 0 <= j < |trace| ==> SizeOfV(contents[j]) == |trace[j]| < 0x1_0000_0000_0000_0000\r\n invariant forall j :: 0 <= j < |trace| ==> \r\n var (val, rest) := parse_Val(trace[j], eltTypes[j]); \r\n val.Some? && val.v == contents[j]\r\n {\r\n lemma_SeqSum_bound(contents, 0x1_0000_0000_0000_0000);\r\n ghost var old_marshalled_bytes := marshalled_bytes;\r\n ghost var old_data := data[index..cur_index];\r\n assert old_marshalled_bytes == old_data;\r\n\r\n // Prove we meet MarshallVal's length requirement\r\n calc <= {\r\n (cur_index as int) + SizeOfV(contents[i]);\r\n (index as int) + SeqSum(contents[..i]) + SizeOfV(contents[i]);\r\n { lemma_SeqSum_prefix(contents[..i], contents[i]); \r\n assert contents[..i] + [contents[i]] == contents[..i+1]; }\r\n (index as int) + SeqSum(contents[..i+1]);\r\n { lemma_SeqSum_bound_prefix(contents, contents[..i+1], i+1); }\r\n //{ lemma_SeqSum_bound(contents, data.Length - (index as int) + 1); }\r\n (index as int) + SeqSum(contents);\r\n //data.Length;\r\n }\r\n var item_size := MarshallVal(contents[i], eltTypes[i], data, cur_index);\r\n //var item_size := ComputeSizeOf(contents[i]);\r\n\r\n ghost var fresh_bytes := data[cur_index..cur_index + item_size];\r\n marshalled_bytes := marshalled_bytes + fresh_bytes;\r\n forall ensures var (val, rest) := parse_Val(fresh_bytes, eltTypes[i]);\r\n val.Some? && val.v == contents[i];\r\n {\r\n assert SizeOfV(contents[i]) <= |fresh_bytes|; // OBSERVE\r\n lemma_parse_Val_view(fresh_bytes, contents[i], eltTypes[i], 0);\r\n }\r\n\r\n ghost var old_trace := trace;\r\n trace := trace + [fresh_bytes];\r\n\r\n ghost var old_cur_index := cur_index;\r\n cur_index := cur_index + item_size;\r\n i := i + 1;\r\n \r\n assert {:split_here} true;\r\n\r\n // Prove the invariant about marshalled_bytes' contents\r\n calc {\r\n marshalled_bytes;\r\n old_marshalled_bytes + fresh_bytes;\r\n old_data + fresh_bytes;\r\n data[index..old_cur_index] + fresh_bytes;\r\n data[index..old_cur_index] + data[old_cur_index..cur_index];\r\n data[index..cur_index];\r\n }\r\n\r\n // Prove the invariant that we stay within bounds\r\n calc <= {\r\n (index as int) + SeqSum(contents[..i]);\r\n calc {\r\n SeqSum(contents[..i]);\r\n <= { lemma_SeqSum_bound_prefix(contents, contents[..i], i); }\r\n SeqSum(contents);\r\n }\r\n (index as int) + SeqSum(contents);\r\n data.Length;\r\n }\r\n\r\n // Prove the invariant about our index tracking correctly\r\n calc {\r\n cur_index as int;\r\n (old_cur_index as int) + SizeOfV(contents[i-1]);\r\n (index as int) + SeqSum(contents[..i-1]) + SizeOfV(contents[i-1]);\r\n { lemma_SeqSum_prefix(contents[..i-1], contents[i-1]); \r\n assert contents[..i-1] + [contents[i-1]] == contents[..i]; }\r\n (index as int) + SeqSum(contents[..i]);\r\n }\r\n assert cur_index as int == (index as int) + SeqSum(contents[..i]);\r\n }\r\n\r\n // Prove that parsing will produce the correct result\r\n\r\n // After the while loop, we know:\r\n assert contents[..i] == contents; // OBSERVE\r\n assert cur_index as int == (index as int) + SeqSum(contents);\r\n assert marshalled_bytes == data[index..(index as int)+SeqSum(contents)];\r\n //assert marshalled_bytes == SeqCatRev(trace);\r\n //assert |trace| == |contents|;\r\n lemma_marshall_tuple_contents(contents, eltTypes, marshalled_bytes, trace);\r\n size := cur_index - index;\r\n}\r\n\r\nmethod MarshallTuple(val:V, grammar:G, data:array, index:uint64) returns (size:uint64)\r\n requires val.VTuple?\r\n requires ValidVal(val)\r\n requires ValidGrammar(grammar)\r\n requires ValInGrammar(val, grammar)\r\n requires (index as int) + SizeOfV(val) <= data.Length\r\n requires 0 <= (index as int) + SizeOfV(val) < 0x1_0000_0000_0000_0000 // Needed to prevent overflow below\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n modifies data\r\n decreases grammar, -1\r\n ensures parse_Val(data[index..(index as int) + SizeOfV(val)], grammar).0.Some? &&\r\n parse_Val(data[index..(index as int) + SizeOfV(val)], grammar).0.v == val\r\n ensures forall i :: 0 <= i < index ==> data[i] == old(data[i])\r\n ensures forall i :: (index as int) + SizeOfV(val) <= i < data.Length ==> data[i] == old(data[i])\r\n ensures size as int == SizeOfV(val)\r\n{\r\n size := MarshallTupleContents(val.t, grammar.t, data, index);\r\n\r\n calc {\r\n parse_Val(data[index..(index as int) + SizeOfV(val)], grammar);\r\n { reveal parse_Val(); }\r\n parse_Tuple(data[index..(index as int) + SizeOfV(val)], grammar.t);\r\n }\r\n}\r\n\r\nmethod MarshallBytes(bytes:seq, data:array, index:uint64)\r\n requires (index as int) + |bytes| <= data.Length\r\n requires 0 <= (index as int) + |bytes| < 0x1_0000_0000_0000_0000 // Needed to prevent overflow below\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n modifies data\r\n ensures forall i :: 0 <= i < index ==> data[i] == old(data[i])\r\n ensures forall i :: (index as int) <= i < (index as int) + |bytes| ==> data[i] == bytes[i - (index as int)]\r\n ensures forall i :: (index as int) + |bytes| <= i < data.Length ==> data[i] == old(data[i])\r\n{\r\n Arrays.CopySeqIntoArray(bytes, 0, data, index, |bytes| as uint64);\r\n\r\n /*\r\n var j:uint64 := 0;\r\n\r\n while (j < |bytes| as uint64)\r\n invariant 0 <= j as int <= |bytes|\r\n invariant forall i:int :: 0 <= i < (index as int) ==> data[i] == old(data[i])\r\n invariant forall i:int :: index as int <= i < (index as int) + (j as int) ==> data[i] == bytes[i-(index as int)]\r\n invariant forall i:int :: (index as int) + |bytes| <= i < data.Length ==> data[i] == old(data[i])\r\n {\r\n data[index + j] := bytes[j];\r\n j := j + 1;\r\n }\r\n */\r\n}\r\n\r\nmethod MarshallByteArray(val:V, grammar:G, data:array, index:uint64) returns (size:uint64)\r\n requires val.VByteArray?\r\n requires ValidGrammar(grammar)\r\n requires ValInGrammar(val, grammar)\r\n requires ValidVal(val)\r\n requires (index as int) + SizeOfV(val) <= data.Length\r\n requires 0 <= (index as int) + SizeOfV(val) < 0x1_0000_0000_0000_0000 // Needed to prevent overflow below\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n modifies data\r\n decreases grammar\r\n ensures parse_Val(data[index..(index as int) + SizeOfV(val)], grammar).0.Some? &&\r\n parse_Val(data[index..(index as int) + SizeOfV(val)], grammar).0.v == val\r\n ensures forall i :: 0 <= i < index ==> data[i] == old(data[i]);\r\n ensures forall i :: (index as int) + SizeOfV(val) <= i < data.Length ==> data[i] == old(data[i])\r\n ensures size as int == SizeOfV(val)\r\n{\r\n MarshallUint64(|val.b| as uint64, data, index);\r\n assert SeqByteToUint64(data[index..index+Uint64Size()]) == (|val.b| as uint64);\r\n MarshallBytes(val.b, data, index + 8);\r\n\r\n calc {\r\n parse_Val(data[index..(index as int) + SizeOfV(val)], grammar);\r\n { reveal parse_Val(); }\r\n parse_ByteArray(data[index..(index as int) + SizeOfV(val)]);\r\n }\r\n ghost var data_seq := data[index..(index as int) + SizeOfV(val)];\r\n ghost var tuple := parse_Uint64(data_seq);\r\n ghost var len := tuple.0;\r\n ghost var rest := tuple.1;\r\n assert{:split_here} true;\r\n assert len.v.u == |val.b| as uint64;\r\n \r\n assert rest == data[index + 8..(index as int) + SizeOfV(val)] == val.b;\r\n assert !len.None? && (len.v.u as int) <= |rest|;\r\n assert rest[0..len.v.u] == val.b; // OBSERVE\r\n size := 8 + (|val.b| as uint64);\r\n}\r\n\r\nmethod MarshallCase(val:V, grammar:G, data:array, index:uint64) returns (size:uint64)\r\n requires val.VCase?\r\n requires ValidGrammar(grammar)\r\n requires ValInGrammar(val, grammar)\r\n requires ValidVal(val)\r\n requires (index as int) + SizeOfV(val) <= data.Length\r\n requires 0 <= (index as int) + SizeOfV(val) < 0x1_0000_0000_0000_0000 // Needed to prevent overflow below\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n modifies data\r\n decreases grammar, -1\r\n ensures parse_Val(data[index..(index as int) + SizeOfV(val)], grammar).0.Some? &&\r\n parse_Val(data[index..(index as int) + SizeOfV(val)], grammar).0.v == val\r\n ensures forall i :: 0 <= i < index ==> data[i] == old(data[i])\r\n ensures forall i :: (index as int) + SizeOfV(val) <= i < data.Length ==> data[i] == old(data[i])\r\n ensures size as int == SizeOfV(val)\r\n{\r\n MarshallUint64(val.c, data, index);\r\n ghost var int_bytes := data[index..index+Uint64Size()];\r\n ghost var tuple0 := parse_Uint64(int_bytes);\r\n ghost var caseID0 := tuple0.0;\r\n ghost var rest10 := tuple0.1;\r\n assert !caseID0.None?;\r\n assert caseID0.v.u == val.c;\r\n\r\n var val_size := MarshallVal(val.val, grammar.cases[val.c], data, index + 8);\r\n\r\n ghost var new_int_bytes := data[index..index+Uint64Size()];\r\n assert forall i {:auto_trigger} :: 0 <= i < Uint64Size() ==> int_bytes[i] == new_int_bytes[i];\r\n assert int_bytes == new_int_bytes;\r\n\r\n assert val.VCase?; \r\n assert grammar.GTaggedUnion?; \r\n assert val.c as int < |grammar.cases|;\r\n\r\n ghost var bytes := data[index..(index as int) + SizeOfV(val)];\r\n assert bytes[..8] == new_int_bytes;\r\n calc {\r\n parse_Val(bytes, grammar);\r\n { reveal parse_Val(); }\r\n parse_Case(bytes, grammar.cases);\r\n }\r\n\r\n assert{:split_here} true;\r\n ghost var tuple1 := parse_Uint64(bytes);\r\n ghost var caseID := tuple1.0;\r\n ghost var rest1 := tuple1.1;\r\n\r\n assert !caseID.None?;\r\n assert caseID.v.u == val.c;\r\n assert (caseID.v.u as int) < |grammar.cases|;\r\n ghost var tuple2 := parse_Val(rest1, grammar.cases[caseID.v.u]);\r\n ghost var v:= tuple2.0;\r\n ghost var rest2 := tuple2.1;\r\n assert !v.None?;\r\n\r\n size := 8 + val_size;\r\n}\r\n\r\nmethod MarshallVUint64(val:V, grammar:G, data:array, index:uint64) returns (size:uint64)\r\n requires val.VUint64?\r\n requires ValidGrammar(grammar)\r\n requires ValInGrammar(val, grammar)\r\n requires (index as int) + SizeOfV(val) <= data.Length\r\n requires 0 <= (index as int) + SizeOfV(val) < 0x1_0000_0000_0000_0000 // Needed to prevent overflow below\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n modifies data\r\n decreases grammar\r\n ensures parse_Val(data[index..(index as int) + SizeOfV(val)], grammar).0.Some? &&\r\n parse_Val(data[index..(index as int) + SizeOfV(val)], grammar).0.v == val\r\n ensures forall i :: 0 <= i < index ==> data[i] == old(data[i])\r\n ensures forall i :: (index as int) + SizeOfV(val) <= i < data.Length ==> data[i] == old(data[i])\r\n ensures size as int == SizeOfV(val)\r\n{\r\n MarshallUint64(val.u, data, index);\r\n calc {\r\n parse_Val(data[index..(index as int) + SizeOfV(val)], grammar);\r\n { reveal parse_Val(); }\r\n parse_Uint64(data[index..(index as int) + SizeOfV(val)]);\r\n }\r\n return 8;\r\n}\r\n\r\nmethod MarshallVal(val:V, grammar:G, data:array, index:uint64) returns (size:uint64)\r\n requires ValidGrammar(grammar)\r\n requires ValInGrammar(val, grammar)\r\n requires ValidVal(val)\r\n requires 0 <= SizeOfV(val) < 0x1_0000_0000_0000_0000\r\n requires (index as int) + SizeOfV(val) <= data.Length\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n modifies data\r\n decreases grammar, 0\r\n ensures parse_Val(data[index..(index as int) + SizeOfV(val)], grammar).0.Some? &&\r\n parse_Val(data[index..(index as int) + SizeOfV(val)], grammar).0.v == val\r\n ensures forall i :: 0 <= i < index ==> data[i] == old(data[i])\r\n ensures forall i :: (index as int) + SizeOfV(val) <= i < data.Length ==> data[i] == old(data[i])\r\n ensures size as int == SizeOfV(val)\r\n{\r\n match val\r\n case VUint64(_) => size := MarshallVUint64(val, grammar, data, index);\r\n case VArray(_) => size := MarshallArray(val, grammar, data, index);\r\n case VTuple(_) => size := MarshallTuple(val, grammar, data, index);\r\n case VByteArray(_) => size := MarshallByteArray(val, grammar, data, index);\r\n case VCase(_,_) => size := MarshallCase(val, grammar, data, index);\r\n}\r\n\r\nmethod Marshall(val:V, grammar:G) returns (data:array)\r\n requires ValidGrammar(grammar)\r\n requires ValInGrammar(val, grammar)\r\n requires ValidVal(val)\r\n requires 0 <= SizeOfV(val) < 0x1_0000_0000_0000_0000\r\n ensures fresh(data)\r\n ensures Demarshallable(data[..], grammar)\r\n ensures parse_Val(data[..], grammar).0.Some? && parse_Val(data[..], grammar).0.v == val\r\n ensures parse_Val(data[..], grammar).1 == []\r\n ensures |data[..]| == SizeOfV(val)\r\n{\r\n var size := ComputeSizeOf(val);\r\n data := new byte[size];\r\n\r\n var computed_size := MarshallVal(val, grammar, data, 0);\r\n\r\n assert data[0..0 + SizeOfV(val)] == data[0..0 + size] == data[..]; // OBSERVE\r\n\r\n lemma_parse_Val_view_specific(data[..], val, grammar, 0, size as int);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Common/GenericRefinement.i.dfy", "content": "include \"../../Common/Native/NativeTypes.s.dfy\"\r\ninclude \"../../Common/Collections/Maps.i.dfy\"\r\ninclude \"../../Common/Collections/Sets.i.dfy\"\r\n\r\nmodule GenericRefinement_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Collections__Maps_i\r\nimport opened Collections__Sets_i\r\n\r\n// Useful to give this cast a name, so it can be used as a higher-order function\r\nfunction uint64_to_int(u:uint64) : int { u as int }\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Generic seq-to-seq refinement\r\nfunction {:opaque} MapSeqToSeq(s:seq, refine_func:T~>U) : seq\r\n reads refine_func.reads\r\n requires forall i :: refine_func.reads(i) == {}\r\n requires forall i :: 0 <= i < |s| ==> refine_func.requires(s[i])\r\n ensures |MapSeqToSeq(s, refine_func)| == |s|\r\n ensures forall i :: 0 <= i < |s| ==> refine_func(s[i]) == MapSeqToSeq(s,refine_func)[i]\r\n{\r\n if |s| == 0 then []\r\n else [refine_func(s[0])] + MapSeqToSeq(s[1..], refine_func)\r\n}\r\n\r\n/////////////////////////////////////////////////////////\r\n// Generic map refinement from concrete to abstract \r\n/////////////////////////////////////////////////////////\r\npredicate MapIsAbstractable(m:map, RefineKey:CKT~>KT, RefineValue:CVT~>VT, ReverseKey:KT~>CKT) \r\n reads RefineKey.reads, RefineValue.reads, ReverseKey.reads\r\n{\r\n && (forall ck :: ck in m ==> RefineKey.requires(ck) && RefineValue.requires(m[ck]))\r\n && (forall ck :: ck in m ==> ReverseKey.requires(RefineKey(ck)) && ReverseKey(RefineKey(ck)) == ck)\r\n}\r\n\r\nfunction {:opaque} AbstractifyMap(m:map, RefineKey:CKT~>KT, RefineValue:CVT~>VT, ReverseKey:KT~>CKT) : map\r\n reads RefineKey.reads, RefineValue.reads, ReverseKey.reads\r\n requires forall ck :: ck in m ==> RefineKey.requires(ck) && RefineValue.requires(m[ck])\r\n requires forall ck :: ck in m ==> ReverseKey.requires(RefineKey(ck)) && ReverseKey(RefineKey(ck)) == ck\r\n ensures var rm := AbstractifyMap(m,RefineKey,RefineValue,ReverseKey);\r\n forall k :: k in rm ==> (exists ck :: ck in m && RefineKey(ck) == k)\r\n{\r\n // var new_domain := set ck | ck in m :: RefineKey(ck);\r\n // map k | k in new_domain :: RefineValue(m[ReverseKey(k)])\r\n map k | k in (set ck | ck in m :: RefineKey(ck)) :: RefineValue(m[ReverseKey(k)])\r\n}\r\n\r\nlemma Lemma_AbstractifyMap_basic_properties(m:map, RefineKey:CKT~>KT, RefineValue:CVT~>VT, ReverseKey:KT~>CKT)\r\n requires MapIsAbstractable(m, RefineKey, RefineValue, ReverseKey)\r\n // Injectivity\r\n requires forall ck1, ck2 :: RefineKey.requires(ck1) && RefineKey.requires(ck2) && RefineKey(ck1) == RefineKey(ck2) ==> ck1 == ck2\r\n ensures m == map [] ==> AbstractifyMap(m, RefineKey, RefineValue, ReverseKey) == map []\r\n ensures forall ck :: ck in m <==> RefineKey.requires(ck) && RefineKey(ck) in AbstractifyMap(m, RefineKey, RefineValue, ReverseKey)\r\n ensures forall ck :: ck in m ==> AbstractifyMap(m, RefineKey, RefineValue, ReverseKey)[RefineKey(ck)] == RefineValue(m[ck])\r\n{\r\n reveal AbstractifyMap();\r\n}\r\n\r\nlemma Lemma_AbstractifyMap_preimage(cm:map, RefineKey:CKT~>KT, RefineValue:CVT~>VT, ReverseKey:KT~>CKT)\r\n requires MapIsAbstractable(cm, RefineKey, RefineValue, ReverseKey)\r\n // Injectivity\r\n requires forall ck1, ck2 :: RefineKey.requires(ck1) && RefineKey.requires(ck2) && RefineKey(ck1) == RefineKey(ck2) ==> ck1 == ck2\r\n ensures var rm := AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey);\r\n forall k :: k in rm ==> (exists ck :: ck in cm && RefineKey(ck) == k)\r\n{\r\n var rm := AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey);\r\n Lemma_AbstractifyMap_basic_properties(cm, RefineKey, RefineValue, ReverseKey);\r\n forall k | k in rm \r\n ensures (exists ck :: ck in cm && RefineKey(ck) == k)\r\n {\r\n reveal AbstractifyMap();\r\n }\r\n}\r\n\r\nlemma Lemma_AbstractifyMap_append(cm:map, RefineKey:CKT~>KT, RefineValue:CVT~>VT, ReverseKey:KT~>CKT,\r\n ck:CKT, cval:CVT)\r\n requires MapIsAbstractable(cm, RefineKey, RefineValue, ReverseKey)\r\n // Injectivity\r\n requires forall ck1, ck2 :: RefineKey.requires(ck1) && RefineKey.requires(ck2) && RefineKey(ck1) == RefineKey(ck2) ==> ck1 == ck2\r\n requires RefineKey.requires(ck)\r\n requires RefineValue.requires(cval)\r\n requires ReverseKey.requires(RefineKey(ck)) && ReverseKey(RefineKey(ck)) == ck\r\n ensures var rm := AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey);\r\n var rm' := AbstractifyMap(cm[ck := cval], RefineKey, RefineValue, ReverseKey);\r\n rm' == AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey)[RefineKey(ck) := RefineValue(cval)]\r\n{\r\n var rm := AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey);\r\n var cm' := cm[ck := cval];\r\n var rm' := AbstractifyMap(cm', RefineKey, RefineValue, ReverseKey);\r\n var r_cm' := AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey)[RefineKey(ck) := RefineValue(cval)];\r\n\r\n forall rk | rk in rm'\r\n ensures rk in r_cm'\r\n ensures r_cm'[rk] == rm'[rk]\r\n {\r\n Lemma_AbstractifyMap_basic_properties(cm', RefineKey, RefineValue, ReverseKey);\r\n Lemma_AbstractifyMap_preimage(cm', RefineKey, RefineValue, ReverseKey);\r\n if (exists p :: p in cm' && RefineKey(p) == rk){\r\n var preimage :| preimage in cm' && RefineKey(preimage) == rk;\r\n if preimage in cm {\r\n Lemma_AbstractifyMap_basic_properties(cm, RefineKey, RefineValue, ReverseKey);\r\n calc ==> {\r\n true;\r\n { Lemma_AbstractifyMap_preimage(cm, RefineKey, RefineValue, ReverseKey); }\r\n RefineKey(preimage) in rm;\r\n RefineKey(preimage) in rm';\r\n rk in r_cm';\r\n }\r\n } else {\r\n assert preimage == ck;\r\n assert RefineKey(preimage) in r_cm';\r\n }\r\n }\r\n reveal AbstractifyMap();\r\n }\r\n\r\n forall rk | rk in r_cm'\r\n ensures rk in rm'\r\n {\r\n Lemma_AbstractifyMap_basic_properties(cm, RefineKey, RefineValue, ReverseKey);\r\n Lemma_AbstractifyMap_preimage(cm, RefineKey, RefineValue, ReverseKey);\r\n Lemma_AbstractifyMap_basic_properties(cm', RefineKey, RefineValue, ReverseKey);\r\n if rk in rm {\r\n if(exists p :: p in cm && RefineKey(p) == rk){\r\n var preimage :| preimage in cm && RefineKey(preimage) == rk;\r\n assert rk in rm';\r\n }\r\n } else {\r\n assert rk == RefineKey(ck);\r\n }\r\n reveal AbstractifyMap();\r\n }\r\n\r\n assert r_cm' == rm';\r\n}\r\n\r\nlemma Lemma_AbstractifyMap_remove(\r\n cm:map, RefineKey:CKT~>KT, RefineValue:CVT~>VT, ReverseKey:KT~>CKT, ck:CKT)\r\n requires MapIsAbstractable(cm, RefineKey, RefineValue, ReverseKey)\r\n // Injectivity\r\n requires forall ck1, ck2 :: RefineKey.requires(ck1) && RefineKey.requires(ck2) && RefineKey(ck1) == RefineKey(ck2) ==> ck1 == ck2\r\n requires RefineKey.requires(ck)\r\n requires ReverseKey.requires(RefineKey(ck)) && ReverseKey(RefineKey(ck)) == ck\r\n requires ck in cm\r\n ensures var rm := AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey);\r\n var rm' := AbstractifyMap(RemoveElt(cm, ck), RefineKey, RefineValue, ReverseKey);\r\n RefineKey(ck) in rm &&\r\n rm' == RemoveElt(rm, RefineKey(ck))\r\n{\r\n Lemma_AbstractifyMap_basic_properties(cm, RefineKey, RefineValue, ReverseKey);\r\n\r\n var rm := AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey);\r\n var smaller_cm := RemoveElt(cm, ck);\r\n var rm' := AbstractifyMap(smaller_cm, RefineKey, RefineValue, ReverseKey);\r\n var smaller_rm := RemoveElt(rm, RefineKey(ck));\r\n\r\n Lemma_AbstractifyMap_basic_properties(smaller_cm, RefineKey, RefineValue, ReverseKey);\r\n\r\n forall o | o in rm'\r\n ensures o in smaller_rm && rm'[o] == smaller_rm[o];\r\n {\r\n if (exists c :: c in smaller_cm && RefineKey(c) == o){\r\n var co :| co in smaller_cm && RefineKey(co) == o;\r\n assert co != ck;\r\n assert RefineKey(co) != RefineKey(ck);\r\n }\r\n reveal AbstractifyMap();\r\n }\r\n\r\n forall o | o in smaller_rm\r\n ensures o in rm' && rm'[o] == smaller_rm[o]\r\n {\r\n Lemma_AbstractifyMap_preimage(cm, RefineKey, RefineValue, ReverseKey);\r\n // var co :| co in cm && co != ck && RefineKey(co) == o;\r\n reveal AbstractifyMap();\r\n }\r\n\r\n assert forall o :: (o in rm' <==> o in smaller_rm) && (o in rm' ==> rm'[o] == smaller_rm[o]);\r\n assert rm' == smaller_rm;\r\n}\r\n\r\nlemma lemma_AbstractifyMap_properties(\r\n cm:map, RefineKey:CKT~>KT, RefineValue:CVT~>VT, ReverseKey:KT~>CKT)\r\n requires MapIsAbstractable(cm, RefineKey, RefineValue, ReverseKey)\r\n // Injectivity\r\n requires forall ck1, ck2 :: RefineKey.requires(ck1) && RefineKey.requires(ck2) && RefineKey(ck1) == RefineKey(ck2) ==> ck1 == ck2\r\n ensures cm == map [] ==> AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey) == map []\r\n ensures forall ck :: ck in cm <==> RefineKey.requires(ck) && RefineKey(ck) in AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey)\r\n ensures forall ck :: ck in cm ==> AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey)[RefineKey(ck)] == RefineValue(cm[ck])\r\n ensures forall ck :: ck !in cm && RefineKey.requires(ck) ==> RefineKey(ck) !in AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey)\r\n ensures var rm := AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey);\r\n forall k :: k in rm ==> (exists ck :: ck in cm && RefineKey(ck) == k)\r\n ensures forall ck, cval {:trigger cm[ck := cval]} {:trigger RefineKey(ck), RefineValue(cval)} ::\r\n (RefineKey.requires(ck) && RefineValue.requires(cval) \r\n && ReverseKey.requires(RefineKey(ck)) && ReverseKey(RefineKey(ck)) == ck) ==>\r\n var rm := AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey);\r\n var rm' := AbstractifyMap(cm[ck := cval], RefineKey, RefineValue, ReverseKey);\r\n rm' == AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey)[RefineKey(ck) := RefineValue(cval)]\r\n ensures forall ck {:trigger RemoveElt(AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey), RefineKey(ck)) } :: \r\n (RefineKey.requires(ck) && ReverseKey.requires(RefineKey(ck)) && ReverseKey(RefineKey(ck)) == ck && ck in cm) ==>\r\n var rm := AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey);\r\n var rm' := AbstractifyMap(RemoveElt(cm, ck), RefineKey, RefineValue, ReverseKey);\r\n rm' == RemoveElt(rm, RefineKey(ck))\r\n{\r\n Lemma_AbstractifyMap_basic_properties(cm, RefineKey, RefineValue, ReverseKey);\r\n Lemma_AbstractifyMap_preimage(cm, RefineKey, RefineValue, ReverseKey);\r\n\r\n forall ck, cval | RefineKey.requires(ck) && RefineValue.requires(cval)\r\n && ReverseKey.requires(RefineKey(ck)) && ReverseKey(RefineKey(ck)) == ck\r\n ensures var rm := AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey);\r\n var rm' := AbstractifyMap(cm[ck := cval], RefineKey, RefineValue, ReverseKey);\r\n rm' == AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey)[RefineKey(ck) := RefineValue(cval)]\r\n {\r\n Lemma_AbstractifyMap_append(cm, RefineKey, RefineValue, ReverseKey, ck, cval);\r\n }\r\n\r\n forall ck | RefineKey.requires(ck) && ReverseKey.requires(RefineKey(ck)) && ReverseKey(RefineKey(ck)) == ck && ck in cm\r\n ensures var rm := AbstractifyMap(cm, RefineKey, RefineValue, ReverseKey);\r\n var rm' := AbstractifyMap(RemoveElt(cm, ck), RefineKey, RefineValue, ReverseKey);\r\n rm' == RemoveElt(rm, RefineKey(ck))\r\n {\r\n Lemma_AbstractifyMap_remove(cm, RefineKey, RefineValue, ReverseKey, ck);\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Common/MarshallInt.i.dfy", "content": "include \"../../Common/Native/NativeTypes.s.dfy\"\r\ninclude \"Util.i.dfy\"\r\n\r\nmodule Common__MarshallInt_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__NativeTypes_i\r\nimport opened Common__Util_i\r\nimport opened Math__power2_i\r\n\r\n/* Doesn't appear to be in use at present\r\nmethod MarshallUint32_guts(n:uint32, data:array, index:uint64)\r\n requires data != null\r\n requires (index as int) + (Uint32Size() as int) <= data.Length\r\n requires 0 <= (index as int) + (Uint32Size() as int) < 0x1_0000_0000_0000_0000 // Needed to prevent overflow on the next line\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n modifies data\r\n ensures BEByteSeqToUint32(data[index .. index + Uint32Size() as uint64]) == n\r\n ensures data[0..index] == old(data[0..index])\r\n ensures data[index + Uint32Size() as uint64 ..] == old(data[index + Uint32Size() as uint64..])\r\n{\r\n data[index ] := ( n/0x1000000) as byte;\r\n data[index+1] := ((n/ 0x10000)%0x100) as byte;\r\n data[index+2] := ((n/ 0x100)%0x100) as byte;\r\n data[index+3] := ( n %0x100) as byte;\r\n ghost var i := n as int;\r\n ghost var bs := [ i / 16777216, (i / 65536) % 256, (i / 256) % 256, i % 256 ];\r\n assert SeqByteToByteSeq(data[index..index+4]) == bs;\r\n\r\n lemma_2toX();\r\n BEWordToByte_literal(n as int, bs);\r\n}\r\n*/\r\n\r\nmethod MarshallUint64_guts(n:uint64, data:array, index:uint64)\r\n requires (index as int) + (Uint64Size() as int) <= data.Length\r\n requires 0 <= (index as int) + (Uint64Size() as int) < 0x1_0000_0000_0000_0000 // Needed to prevent overflow on the next line\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n modifies data\r\n ensures SeqByteToUint64(data[index..index+(Uint64Size() as uint64)]) == n\r\n ensures data[0..index] == old(data[0..index])\r\n ensures data[index+(Uint64Size() as uint64)..] == old(data[index+(Uint64Size() as uint64)..])\r\n{\r\n data[index ] := (n/0x1000000_00000000) as byte;\r\n data[index+1] := ((n/ 0x10000_00000000)%0x100) as byte;\r\n data[index+2] := ((n/ 0x100_00000000)%0x100) as byte;\r\n data[index+3] := ((n/ 0x1_00000000)%0x100) as byte;\r\n data[index+4] := ((n/ 0x1000000)%0x100) as byte;\r\n data[index+5] := ((n/ 0x10000)%0x100) as byte;\r\n data[index+6] := ((n/ 0x100)%0x100) as byte;\r\n data[index+7] := ( n %0x100) as byte;\r\n\r\n lemma_2toX();\r\n\r\n assert data[index..index+(Uint64Size() as uint64)] == Uint64ToSeqByte(n);\r\n lemma_BEUintToSeqByte_invertability(data[index..index+(Uint64Size() as uint64)], n as int, 8);\r\n}\r\n\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Common/NetClient.i.dfy", "content": "include \"../../Common/Native/Io.s.dfy\"\r\n\r\nmodule Common__NetClient_i {\r\nimport opened Native__Io_s\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Things that probably belong in \"../../../Common/Native/Io.i.dfy\"\r\n\r\nfunction Workaround_CastHostEnvironmentToObject(env:HostEnvironment) : object {env}\r\nfunction Workaround_CastOkStateToObject(okState:OkState) : object {okState}\r\nfunction Workaround_CastNowStateToObject(nowState:NowState) : object {nowState}\r\nfunction Workaround_CastNetStateToObject(netState:NetState) : object {netState}\r\nfunction Workaround_CastNetClientToObject(netc:NetClient?) : object? {netc}\r\n\r\nfunction HostEnvironmentDefaultFrame(env:HostEnvironment) : set\r\n reads env\r\n reads {env.now}\r\n reads {env.ok}\r\n reads {env.net}\r\n reads {env}\r\n{\r\n {Workaround_CastOkStateToObject(env.ok), Workaround_CastNowStateToObject(env.now), Workaround_CastNetStateToObject(env.net)}\r\n}\r\n\r\nfunction NetClientRepr(netc:NetClient?) : set\r\n reads netc\r\n reads if netc != null then HostEnvironmentDefaultFrame.reads(netc.env) else {}\r\n{\r\n {Workaround_CastNetClientToObject(netc)} +\r\n (if netc != null then HostEnvironmentDefaultFrame(netc.env) else {})\r\n}\r\n\r\npredicate HostEnvironmentIsValid(env:HostEnvironment)\r\n reads env\r\n reads env.Valid.reads()\r\n reads env.ok.ok.reads()\r\n{\r\n && env.Valid()\r\n && env.ok.ok()\r\n}\r\n\r\npredicate NetClientOk(netc:NetClient?)\r\n reads netc\r\n reads if netc != null then HostEnvironmentDefaultFrame.reads(netc.env) else {}\r\n{\r\n && netc != null\r\n && netc.env.ok.ok()\r\n}\r\n\r\nfunction method EndPointIsValidPublicKey(endPoint:EndPoint) : bool\r\n{\r\n && |endPoint.public_key| < 0x10_0000 // < 1 MB\r\n}\r\n\r\npredicate NetClientIsValid(netc:NetClient?)\r\n reads NetClientRepr(netc)\r\n reads if netc != null then HostEnvironmentIsValid.reads(netc.env) else {}\r\n{\r\n && netc != null\r\n && netc.IsOpen()\r\n && HostEnvironmentIsValid(netc.env)\r\n && EndPointIsValidPublicKey(EndPoint(netc.MyPublicKey()))\r\n}\r\n\r\npredicate EndPointsAreValidPublicKeys(eps:seq) \r\n{\r\n forall i :: 0 <= i < |eps| ==> EndPointIsValidPublicKey(eps[i])\r\n}\r\n\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Common/NodeIdentity.i.dfy", "content": "include \"Util.i.dfy\"\r\ninclude \"NetClient.i.dfy\"\r\ninclude \"SeqIsUnique.i.dfy\"\r\ninclude \"../../Protocol/Common/NodeIdentity.i.dfy\"\r\ninclude \"GenericRefinement.i.dfy\"\r\ninclude \"../../Common/Collections/Sets.i.dfy\"\r\n\r\nmodule Common__NodeIdentity_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened Common__Util_i\r\nimport opened Common__NetClient_i\r\nimport opened Common__SeqIsUniqueDef_i\r\nimport opened Common__SeqIsUnique_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened GenericRefinement_i\r\nimport opened Collections__Sets_i\r\nimport opened Math__power2_s\r\nimport opened Math__power2_i\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Useful for EndPoint index to node index conversions\r\n\r\nfunction {:opaque} AbstractifySeqOfUint64sToSeqOfInts(s:seq) : seq\r\n ensures |AbstractifySeqOfUint64sToSeqOfInts(s)| == |s|\r\n ensures forall i :: 0 <= i < |s| ==> s[i] as int == AbstractifySeqOfUint64sToSeqOfInts(s)[i]\r\n{\r\n MapSeqToSeq(s, uint64_to_int)\r\n}\r\n\r\nfunction {:opaque} AbstractifySeqOfUint64sToSetOfInts(s:seq) : set\r\n requires SeqIsUnique(s)\r\n ensures forall x :: x in s ==> (x as int in AbstractifySeqOfUint64sToSetOfInts(s))\r\n{\r\n var unique_set := UniqueSeqToSet(s);\r\n set i | i in unique_set :: i as int\r\n}\r\n\r\nlemma lemma_AbstractifySeqOfUint64sToSetOfInts_properties(s:seq)\r\n requires SeqIsUnique(s)\r\n ensures |AbstractifySeqOfUint64sToSetOfInts(s)| == |s|\r\n ensures forall i {:auto_trigger} :: (i in s <==> i as int in AbstractifySeqOfUint64sToSetOfInts(s))\r\n{\r\n var unique_set := UniqueSeqToSet(s);\r\n var r_s := AbstractifySeqOfUint64sToSetOfInts(s);\r\n\r\n reveal AbstractifySeqOfUint64sToSetOfInts();\r\n lemma_MapSetCardinality(unique_set, r_s, uint64_to_int);\r\n lemma_seqs_set_cardinality(s, unique_set);\r\n lemma_seqs_set_membership(s, unique_set);\r\n}\r\n\r\n\r\nlemma lemma_AbstractifySeqOfUint64sToSetOfInts_append(original_seq:seq, new_index:uint64)\r\n requires SeqIsUnique(original_seq)\r\n ensures var r_original_set := AbstractifySeqOfUint64sToSetOfInts(original_seq);\r\n AbstractifySeqOfUint64sToSetOfInts(AppendToUniqueSeqMaybe(original_seq, new_index)) == r_original_set + {new_index as int}\r\n{\r\n var appended_seq := AppendToUniqueSeqMaybe(original_seq, new_index);\r\n var r_set := AbstractifySeqOfUint64sToSetOfInts(appended_seq);\r\n var r_original_set := AbstractifySeqOfUint64sToSetOfInts(original_seq);\r\n var new_set := r_original_set + {new_index as int};\r\n assert new_index in appended_seq;\r\n assert new_index as int in r_set;\r\n assert forall x :: x in original_seq ==> x as int in r_original_set;\r\n assert forall x :: x in original_seq ==> x in appended_seq;\r\n\r\n forall rId | rId in r_set\r\n ensures rId in new_set\r\n {\r\n lemma_AbstractifySeqOfUint64sToSetOfInts_properties(appended_seq);\r\n lemma_AbstractifySeqOfUint64sToSetOfInts_properties(original_seq);\r\n reveal AbstractifySeqOfUint64sToSetOfInts();\r\n }\r\n\r\n forall rId | rId in new_set\r\n ensures rId in r_set\r\n {\r\n lemma_AbstractifySeqOfUint64sToSetOfInts_properties(appended_seq);\r\n lemma_AbstractifySeqOfUint64sToSetOfInts_properties(original_seq);\r\n reveal AbstractifySeqOfUint64sToSetOfInts();\r\n }\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// NodeIdentity\r\n\r\npredicate EndPointIsAbstractable(endpoint:EndPoint)\r\n{\r\n true\r\n}\r\n\r\nfunction AbstractifyEndPointToNodeIdentity(endpoint:EndPoint) : NodeIdentity\r\n{\r\n endpoint\r\n}\r\n\r\npredicate SeqOfEndPointsIsAbstractable(endPoints:seq)\r\n{\r\n forall e :: e in endPoints ==> EndPointIsAbstractable(e)\r\n}\r\n\r\nfunction {:opaque} AbstractifyEndPointsToNodeIdentities(endPoints:seq) : seq\r\n requires forall e :: e in endPoints ==> EndPointIsAbstractable(e)\r\n ensures |AbstractifyEndPointsToNodeIdentities(endPoints)| == |endPoints|\r\n ensures forall i :: 0<=i<|endPoints| ==> AbstractifyEndPointToNodeIdentity(endPoints[i]) == AbstractifyEndPointsToNodeIdentities(endPoints)[i]\r\n{\r\n if |endPoints| == 0 then []\r\n else [AbstractifyEndPointToNodeIdentity(endPoints[0])] + AbstractifyEndPointsToNodeIdentities(endPoints[1..])\r\n}\r\n\r\nlemma lemma_AbstractifyEndPointToNodeIdentity_injective(e1:EndPoint, e2:EndPoint)\r\n requires AbstractifyEndPointToNodeIdentity(e1) == AbstractifyEndPointToNodeIdentity(e2)\r\n ensures e1==e2\r\n{\r\n}\r\n\r\nlemma lemma_AbstractifyEndPointToNodeIdentity_injective_forall()\r\n ensures forall e1, e2 {:trigger AbstractifyEndPointToNodeIdentity(e1),AbstractifyEndPointToNodeIdentity(e2)} ::\r\n AbstractifyEndPointToNodeIdentity(e1) == AbstractifyEndPointToNodeIdentity(e2) ==> e1 == e2;\r\n{\r\n forall e1, e2 | AbstractifyEndPointToNodeIdentity(e1) == AbstractifyEndPointToNodeIdentity(e2)\r\n ensures e1 == e2\r\n {\r\n lemma_AbstractifyEndPointToNodeIdentity_injective(e1, e2);\r\n }\r\n}\r\n\r\nlemma lemma_seqs_set_cardinality_EndPoint(Q:seq, S:set)\r\n requires SeqIsUnique(Q)\r\n requires S == set e | e in Q\r\n ensures |Q| == |S|\r\n decreases |Q|\r\n{\r\n lemma_seqs_set_cardinality(Q, S);\r\n}\r\n\r\nlemma lemma_sets_cardinality_EndPoint(S:set, T:set)\r\n requires forall e :: e in S ==> EndPointIsAbstractable(e)\r\n requires T == set e | e in S :: AbstractifyEndPointToNodeIdentity(e)\r\n ensures |S| == |T|\r\n decreases |S|\r\n{\r\n if (S=={}) {\r\n return;\r\n }\r\n var s0 :| s0 in S;\r\n var Sr := S - {s0};\r\n var Tr := T - {AbstractifyEndPointToNodeIdentity(s0)};\r\n assert |S| == |Sr| + 1;\r\n assert |T| == |Tr| + 1;\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n lemma_sets_cardinality_EndPoint(Sr, Tr);\r\n}\r\n\r\nlemma lemma_AbstractifyEndPointsToNodeIdentities_properties(endpoints:seq)\r\n requires SeqIsUnique(endpoints)\r\n requires SeqOfEndPointsIsAbstractable(endpoints)\r\n ensures |AbstractifyEndPointsToNodeIdentities(endpoints)| == |endpoints|\r\n ensures forall e :: e in endpoints ==> AbstractifyEndPointToNodeIdentity(e) in AbstractifyEndPointsToNodeIdentities(endpoints)\r\n ensures forall e :: EndPointIsAbstractable(e) ==> (e in endpoints <==> AbstractifyEndPointToNodeIdentity(e) in AbstractifyEndPointsToNodeIdentities(endpoints))\r\n{\r\n forall e | EndPointIsAbstractable(e)\r\n ensures e in endpoints <==> AbstractifyEndPointToNodeIdentity(e) in AbstractifyEndPointsToNodeIdentities(endpoints)\r\n {\r\n if e in endpoints {\r\n assert AbstractifyEndPointToNodeIdentity(e) in AbstractifyEndPointsToNodeIdentities(endpoints);\r\n }\r\n\r\n if AbstractifyEndPointToNodeIdentity(e) in AbstractifyEndPointsToNodeIdentities(endpoints) {\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n assert e in endpoints;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_AbstractifyEndPointsToNodeIdentities_injective_elements(s1:seq, s2:seq)\r\n requires forall e :: e in s1 ==> EndPointIsAbstractable(e)\r\n requires forall e :: e in s2 ==> EndPointIsAbstractable(e)\r\n requires AbstractifyEndPointsToNodeIdentities(s1) == AbstractifyEndPointsToNodeIdentities(s2)\r\n ensures forall e :: e in s1 <==> e in s2\r\n{\r\n reveal AbstractifyEndPointsToNodeIdentities();\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n}\r\n\r\nlemma lemma_AbstractifyEndPointsToNodeIdentities_injective(s1:seq, s2:seq)\r\n requires forall e :: e in s1 ==> EndPointIsAbstractable(e)\r\n requires forall e :: e in s2 ==> EndPointIsAbstractable(e)\r\n requires AbstractifyEndPointsToNodeIdentities(s1) == AbstractifyEndPointsToNodeIdentities(s2)\r\n ensures s1 == s2;\r\n{\r\n reveal AbstractifyEndPointsToNodeIdentities();\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n}\r\n\r\n//////////////////////////////////////////////////////////\r\n// Reversing the process of refining a node identity\r\n//////////////////////////////////////////////////////////\r\n\r\npredicate NodeIdentityIsRefinable(id:NodeIdentity)\r\n{\r\n true\r\n}\r\n\r\n// Give Dafny a symbol handle for this choose (:|) expression\r\nfunction{:opaque} RefineNodeIdentityToEndPoint(id:NodeIdentity) : EndPoint\r\n ensures NodeIdentityIsRefinable(id) ==> EndPointIsAbstractable(RefineNodeIdentityToEndPoint(id))\r\n ensures NodeIdentityIsRefinable(id) ==> AbstractifyEndPointToNodeIdentity(RefineNodeIdentityToEndPoint(id)) == id\r\n{\r\n id\r\n}\r\n\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Common/SeqIsUnique.i.dfy", "content": "include \"SeqIsUniqueDef.i.dfy\"\r\ninclude \"../../Common/Native/NativeTypes.i.dfy\"\r\n\r\nmodule Common__SeqIsUnique_i {\r\nimport opened Common__SeqIsUniqueDef_i\r\nimport opened Native__NativeTypes_i\r\n\r\nfunction UniqueSeqToSet(xs:seq) : set\r\n requires SeqIsUnique(xs)\r\n ensures forall x :: x in xs ==> x in UniqueSeqToSet(xs)\r\n{\r\n set x | x in xs\r\n}\r\n\r\nfunction{:timeLimitMultiplier 3}{:opaque} SetToUniqueSeq(s:set):seq\r\n ensures forall x :: x in SetToUniqueSeq(s) <==> x in s\r\n ensures SeqIsUnique(SetToUniqueSeq(s))\r\n ensures |SetToUniqueSeq(s)| == |s|\r\n{\r\n if s == {} then\r\n (\r\n var xs:seq := [];\r\n calc ==> {true; { reveal SeqIsUnique(); } SeqIsUnique(xs);}\r\n xs\r\n )\r\n else\r\n (\r\n var x :| x in s;\r\n var s' := s - {x};\r\n var xs' := SetToUniqueSeq(s');\r\n calc ==> {true; { reveal SeqIsUnique(); } SeqIsUnique(xs' + [x]);}\r\n xs' + [x]\r\n )\r\n}\r\n\r\nfunction/*TODO:{:opaque}*/ Subsequence(xs:seq, f:X->bool):seq\r\n reads f.reads\r\n requires forall x :: x in xs ==> f.requires(x)\r\n ensures forall x :: x in Subsequence(xs, f) <==> x in xs && f(x)\r\n// TODO: ensures |Subsequence(xs, f)| <= |xs|\r\n{\r\n var s := set x | x in xs && f(x);\r\n SetToUniqueSeq(s)\r\n}\r\n\r\nmethod SeqToSetConstruct(xs:seq) returns(s:set)\r\n ensures forall x :: x in s <==> x in xs\r\n ensures SeqIsUnique(xs) ==> |s| == |xs| && s == UniqueSeqToSet(xs)\r\n{\r\n reveal SeqIsUnique();\r\n s := {};\r\n var i := 0;\r\n while (i < |xs|)\r\n invariant 0 <= i <= |xs|\r\n invariant forall x :: x in s <==> x in xs[..i]\r\n invariant SeqIsUnique(xs[..i]) ==> |s| == i\r\n {\r\n s := s + {xs[i]};\r\n i := i + 1;\r\n }\r\n}\r\n\r\nmethod{:timeLimitMultiplier 5} SetToUniqueSeqConstruct(s:set) returns (xs:seq)\r\n ensures SeqIsUnique(xs)\r\n ensures UniqueSeqToSet(xs) == s\r\n ensures forall x :: x in xs <==> x in s\r\n ensures |xs| == |s|\r\n{\r\n var arr := new X[|s|];\r\n var s1 := s;\r\n ghost var s2 := {};\r\n ghost var i := 0;\r\n forall ensures SeqIsUnique(arr[..i]) { reveal SeqIsUnique(); }\r\n while (|s1| != 0)\r\n invariant 0 <= i <= |s|\r\n invariant s1 + s2 == s\r\n invariant s1 !! s2\r\n invariant |s1| == |s| - i\r\n invariant |s2| == i\r\n invariant SeqIsUnique(arr[..i])\r\n invariant forall x :: x in arr[..i] <==> x in s2\r\n {\r\n reveal SeqIsUnique();\r\n ghost var old_seq := arr[..i];\r\n var x :| x in s1;\r\n assert x !in old_seq;\r\n assert forall y {:trigger y in s2}{:trigger y in old_seq} :: y in s2 + {x} ==> y in old_seq + [x];\r\n arr[|s| - |s1|] := x;\r\n s1 := s1 - {x};\r\n s2 := s2 + {x};\r\n i := i + 1;\r\n assert arr[..i] == old_seq + [x];\r\n }\r\n xs := arr[..];\r\n assert xs == arr[..i];\r\n}\r\n\r\nmethod SubsequenceConstruct(xs:seq, f:X->bool) returns(xs':seq)\r\n requires forall x :: x in xs ==> f.requires(x)\r\n ensures forall x {:trigger x in xs}{:trigger x in xs'} :: x in xs' <==> x in xs && f(x)\r\n ensures SeqIsUnique(xs) ==> SeqIsUnique(xs')\r\n{\r\n reveal SeqIsUnique();\r\n var arr := new X[|xs|];\r\n var i := 0;\r\n var j := 0;\r\n while (i < |xs|)\r\n invariant 0 <= i <= |xs|\r\n invariant 0 <= j <= i\r\n invariant forall x {:trigger x in xs[..i]}{:trigger x in arr[..j]} :: x in arr[..j] <==> x in xs[..i] && f(x)\r\n invariant SeqIsUnique(xs) ==> SeqIsUnique(arr[..j])\r\n {\r\n ghost var old_xs := xs[..i];\r\n ghost var old_xs' := arr[..j];\r\n if (f(xs[i]))\r\n {\r\n if (SeqIsUnique(xs))\r\n {\r\n reveal SeqIsUnique();\r\n assert forall k :: 0 <= k < i ==> xs[k] != xs[i];\r\n assert forall k :: 0 <= k < i ==> xs[..i][k] != xs[i];\r\n assert xs[i] !in arr[..j];\r\n }\r\n\r\n arr[j] := xs[i];\r\n j := j + 1;\r\n assert arr[..j] == old_xs' + [xs[i]];\r\n }\r\n i := i + 1;\r\n assert xs[..i] == old_xs + [xs[i - 1]];\r\n }\r\n xs' := arr[..j];\r\n}\r\n\r\nmethod UniqueSubsequenceConstruct(xs:seq, f:X->bool) returns(xs':seq)\r\n requires forall x :: x in xs ==> f.requires(x)\r\n ensures forall x {:trigger x in xs}{:trigger x in xs'} :: x in xs' <==> x in xs && f(x)\r\n ensures SeqIsUnique(xs')\r\n{\r\n var s := set x | x in xs && f(x);\r\n xs' := SetToUniqueSeqConstruct(s);\r\n}\r\n\r\nlemma EstablishAppendToUniqueSeq(xs:seq, x:X, xs':seq)\r\n requires SeqIsUnique(xs)\r\n requires x !in xs\r\n requires xs' == xs + [x]\r\n ensures SeqIsUnique(xs')\r\n ensures x in xs'\r\n{\r\n var xs'' := xs + [x];\r\n reveal SeqIsUnique();\r\n assert SeqIsUnique(xs'');\r\n}\r\n\r\nfunction method AppendToUniqueSeq(xs:seq, x:X):seq\r\n requires SeqIsUnique(xs)\r\n requires x !in xs\r\n ensures SeqIsUnique(AppendToUniqueSeq(xs, x))\r\n ensures x in AppendToUniqueSeq(xs, x)\r\n{\r\n reveal SeqIsUnique();\r\n var xs' := xs + [x];\r\n EstablishAppendToUniqueSeq(xs, x, xs');\r\n xs'\r\n}\r\n\r\nfunction method AppendToUniqueSeqMaybe(xs:seq, x:X):seq\r\n requires SeqIsUnique(xs)\r\n ensures SeqIsUnique(AppendToUniqueSeqMaybe(xs, x))\r\n ensures x in AppendToUniqueSeqMaybe(xs, x)\r\n{\r\n reveal SeqIsUnique();\r\n if x in xs then xs\r\n else\r\n (\r\n var xs' := xs + [x];\r\n EstablishAppendToUniqueSeq(xs, x, xs');\r\n xs'\r\n )\r\n}\r\n\r\nlemma lemma_UniqueSeq_SubSeqsUnique(whole:seq, left:seq, right:seq)\r\n requires SeqIsUnique(whole)\r\n requires whole == left + right\r\n ensures SeqIsUnique(left)\r\n ensures SeqIsUnique(right)\r\n{\r\n reveal SeqIsUnique();\r\n assert SeqIsUnique(whole[..|left|]); \r\n}\r\n\r\nlemma lemma_seqs_set_cardinality(Q:seq, S:set)\r\n requires SeqIsUnique(Q)\r\n requires S == UniqueSeqToSet(Q)\r\n ensures |Q| == |S|\r\n{\r\n reveal SeqIsUnique();\r\n if (Q==[]) {\r\n return;\r\n }\r\n var q0 := Q[0];\r\n var Qr := Q[1..];\r\n var Sr := UniqueSeqToSet(Qr);\r\n forall s | s in Sr + {q0} ensures s in S;\r\n {\r\n if (s in Sr) {\r\n var idx :| 0<=idx<|Qr| && Qr[idx]==s;\r\n assert Q[idx+1]==s;\r\n assert Q[idx+1] in Q;\r\n assert s in S;\r\n } else {\r\n assert s == q0;\r\n assert Q[0] == s;\r\n assert Q[0] in Q;\r\n assert s in S;\r\n }\r\n }\r\n forall s | s in S ensures s in Sr + {q0};\r\n {\r\n var idx :| 0<=idx<|Q| && Q[idx]==s;\r\n if (idx==0) {\r\n assert Q[0] == q0;\r\n } else {\r\n assert s == Qr[idx-1];\r\n assert Qr[idx-1] in Qr;\r\n assert s in Qr;\r\n assert s in Sr;\r\n }\r\n assert s in Sr + {q0};\r\n }\r\n assert S == Sr + {q0};\r\n lemma_seqs_set_cardinality(Qr, Sr);\r\n}\r\n\r\n\r\nlemma lemma_seqs_set_membership(Q:seq, S:set)\r\n requires SeqIsUnique(Q)\r\n requires S == UniqueSeqToSet(Q)\r\n ensures forall i :: (i in Q <==> i in S)\r\n{\r\n reveal SeqIsUnique();\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Common/SeqIsUniqueDef.i.dfy", "content": "\r\nmodule Common__SeqIsUniqueDef_i {\r\npredicate {:opaque} SeqIsUnique(xs:seq)\r\n{\r\n forall i,j :: 0 <= i < |xs| && 0 <= j < |xs| && xs[i] == xs[j] ==> i == j\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Common/UpperBound.i.dfy", "content": "include \"../../Common/Native/NativeTypes.s.dfy\"\r\ninclude \"../../Protocol/Common/UpperBound.s.dfy\"\r\n\r\nmodule Common__UpperBound_i {\r\n\r\nimport opened Native__NativeTypes_s\r\nimport opened Common__UpperBound_s\r\n\r\nmethod UpperBoundedAdditionImpl(x:uint64, y:uint64, u:uint64) returns (sum:uint64)\r\n ensures sum as int == UpperBoundedAddition(x as int, y as int, UpperBoundFinite(u as int));\r\n{\r\n if y >= u\r\n {\r\n sum := u;\r\n }\r\n else if x >= u - y\r\n {\r\n sum := u;\r\n }\r\n else\r\n {\r\n sum := x + y;\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Common/Util.i.dfy", "content": "include \"../../Common/Native/NativeTypes.i.dfy\"\r\ninclude \"../../Common/Native/Io.s.dfy\"\r\ninclude \"../../../Libraries/Math/power2.i.dfy\"\r\n\r\nmodule Common__Util_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__NativeTypes_i\r\nimport opened Math__power2_s\r\nimport opened Math__power2_i\r\nimport opened Math__div_i\r\n\r\n// Uses BigIntegers. If you can, consider using the Opt versions below\r\nmethod seqToArray_slow(s:seq) returns(a:array)\r\n ensures a[..] == s\r\n{\r\n var len := |s|;\r\n a := new A[len];\r\n var i := 0;\r\n while (i < len)\r\n invariant 0 <= i <= len\r\n invariant a[..i] == s[..i]\r\n {\r\n a[i] := s[i];\r\n i := i + 1;\r\n }\r\n}\r\n\r\n// Uses BigIntegers. If you can, consider using the Opt versions below\r\n/*\r\nmethod seqIntoArray_slow(s:seq, a:array, index:nat)\r\n requires a != null\r\n requires index + |s| <= a.Length\r\n modifies a\r\n ensures a[..] == old(a[0..index]) + s + old(a[index + |s|..])\r\n{\r\n var i := index;\r\n\r\n while (i < index + |s|)\r\n invariant index <= i <= index + |s| <= a.Length\r\n invariant a[..] == old(a[0..index]) + s[0..(i-index)] + old(a[i..])\r\n {\r\n a[i] := s[i - index];\r\n i := i + 1;\r\n assert a[..] == old(a[0..index]) + s[0..(i-index)] + old(a[i..]);\r\n }\r\n}\r\n*/\r\n\r\nmethod seqIntoArrayOpt(s:seq, a:array)\r\n requires |s| == a.Length\r\n requires |s| < 0x1_0000_0000_0000_0000\r\n modifies a\r\n ensures a[..] == s\r\n{\r\n var i:uint64 := 0;\r\n\r\n while i < |s| as uint64\r\n invariant 0 <= i as int <= a.Length\r\n invariant a[..] == s[0..i] + old(a[i..])\r\n {\r\n a[i] := s[i];\r\n i := i + 1;\r\n }\r\n}\r\n\r\nmethod seqToArrayOpt(s:seq) returns(a:array)\r\n requires |s| < 0x1_0000_0000_0000_0000\r\n ensures a[..] == s\r\n ensures fresh(a)\r\n{\r\n a := new A[|s| as uint64];\r\n seqIntoArrayOpt(s, a);\r\n}\r\n\r\nmethod seqIntoArrayChar(s:seq, a:array)\r\n requires |s| == a.Length\r\n requires |s| < 0x1_0000_0000_0000_0000\r\n modifies a\r\n ensures a[..] == s\r\n{\r\n var i:uint64 := 0;\r\n\r\n while i < |s| as uint64\r\n invariant 0 <= i as int <= a.Length\r\n invariant a[..] == s[0..i] + old(a[i..])\r\n {\r\n a[i] := s[i];\r\n i := i + 1;\r\n }\r\n}\r\n\r\nmethod RecordTimingSeq(name:seq, start:uint64, end:uint64)\r\n requires 0 < |name| < 0x1_0000_0000_0000_0000\r\n{\r\n if PrintParams.ShouldPrintProfilingInfo() {\r\n var name_array := new char[|name|];\r\n\r\n seqIntoArrayChar(name, name_array);\r\n\r\n var time:uint64;\r\n if start <= end {\r\n time := end - start;\r\n } else {\r\n time := 0xFFFF_FFFF_FFFF_FFFF;\r\n }\r\n\r\n Time.RecordTiming(name_array, time);\r\n }\r\n}\r\n\r\nfunction BEByteSeqToInt(bytes:seq) : int\r\n decreases |bytes|\r\n{\r\n if bytes == [] then 0\r\n else BEByteSeqToInt(bytes[..|bytes|-1]) * 256 + (bytes[|bytes|-1] as int)\r\n}\r\n\r\nlemma lemma_BEByteSeqToInt_bound(bytes:seq)\r\n ensures 0 <= BEByteSeqToInt(bytes)\r\n ensures BEByteSeqToInt(bytes) < power2(8*|bytes|)\r\n{\r\n lemma_2toX();\r\n if bytes == [] {\r\n } else {\r\n calc {\r\n BEByteSeqToInt(bytes[..|bytes|-1]) + 1;\r\n <=\r\n power2(8*(|bytes|-1));\r\n }\r\n\r\n calc {\r\n BEByteSeqToInt(bytes);\r\n BEByteSeqToInt(bytes[..|bytes|-1]) * 256 + (bytes[|bytes|-1] as int);\r\n < \r\n BEByteSeqToInt(bytes[..|bytes|-1]) * 256 + 256;\r\n BEByteSeqToInt(bytes[..|bytes|-1]) * 256 + 1 * 256;\r\n (BEByteSeqToInt(bytes[..|bytes|-1]) + 1) * 256; \r\n <=\r\n power2(8*(|bytes|-1)) * 256; \r\n power2(8*(|bytes|-1)) * power2(8); \r\n { lemma_power2_adds(8*(|bytes|-1), 8); }\r\n power2(8*|bytes|);\r\n }\r\n }\r\n}\r\n\r\n/* Doesn't appear to be in use at present\r\nlemma lemma_BEByteSeqToUint32_properties(bs:seq)\r\n requires |bs| == Uint32Size() as int\r\n ensures var ret := uint32(bs[0]) * 256*256*256 + uint32(bs[1]) * 256*256 + uint32(bs[2]) * 256 + uint32(bs[3]);\r\n ret as int == BEByteSeqToInt(bs)\r\n{\r\n lemma_2toX(); \r\n lemma_BEByteSeqToInt_bound(bs);\r\n var ret := uint32(bs[0]) * 256*256*256 + uint32(bs[1]) * 256*256 + uint32(bs[2]) * 256 + uint32(bs[3]);\r\n calc {\r\n BEByteSeqToInt(bs);\r\n BEByteSeqToInt(bs[..|bs|-1]) * 256 + (bs[|bs|-1] as int);\r\n { assert bs[..|bs|-1][..|bs[..|bs|-1]|-1] == bs[..|bs|-2]; }\r\n (BEByteSeqToInt(bs[..|bs|-2]) * 256 + (bs[|bs|-2] as int)) * 256 + (bs[|bs|-1] as int);\r\n ((BEByteSeqToInt(bs[..|bs|-3]) * 256 + (bs[|bs|-3] as int)) * 256 + (bs[|bs|-2] as int)) * 256 + (bs[|bs|-1] as int);\r\n (((BEByteSeqToInt(bs[..|bs|-4]) * 256 + (bs[|bs|-4] as int)) * 256 + (bs[|bs|-3] as int)) * 256 + (bs[|bs|-2] as int)) * 256 + (bs[|bs|-1] as int);\r\n ret as int;\r\n }\r\n}\r\n*/\r\n\r\nlemma lemma_BEByteSeqToUint64_properties(bs:seq)\r\n requires |bs| == Uint64Size() as int\r\n ensures var ret := (bs[0] as uint64) * 256*256*256*0x100000000 + (bs[1] as uint64) * 256*256*0x100000000\r\n + (bs[2] as uint64) * 256*0x100000000 + (bs[3] as uint64) * 0x100000000\r\n + (bs[4] as uint64) * 256*256*256 + (bs[5] as uint64) * 256*256 + (bs[6] as uint64) * 256\r\n + (bs[7] as uint64);\r\n ret as int == BEByteSeqToInt(bs)\r\n{\r\n lemma_2toX();\r\n var ret := (bs[0] as uint64) * 256*256*256*0x100000000\r\n + (bs[1] as uint64) * 256*256*0x100000000\r\n + (bs[2] as uint64) * 256*0x100000000\r\n + (bs[3] as uint64) * 0x100000000\r\n + (bs[4] as uint64) * 256*256*256\r\n + (bs[5] as uint64) * 256*256\r\n + (bs[6] as uint64) * 256\r\n + (bs[7] as uint64);\r\n\r\n var byteSeq := bs;\r\n\r\n calc {\r\n BEByteSeqToInt(bs);\r\n BEByteSeqToInt(bs[..|bs|-1]) * 256 + (bs[|bs|-1] as int);\r\n { assert bs[..|bs|-1][..|bs[..|bs|-1]|-1] == bs[..|bs|-2]; }\r\n (BEByteSeqToInt(bs[..|bs|-2]) * 256 + (bs[|bs|-2] as int)) * 256 + (bs[|bs|-1] as int);\r\n { assert bs[..|bs|-2][..|bs[..|bs|-2]|-1] == bs[..|bs|-3]; }\r\n ((BEByteSeqToInt(bs[..|bs|-3]) * 256 + (bs[|bs|-3] as int)) * 256 + (bs[|bs|-2] as int)) * 256 + (bs[|bs|-1] as int);\r\n { assert bs[..|bs|-3][..|bs[..|bs|-3]|-1] == bs[..|bs|-4]; }\r\n (((BEByteSeqToInt(bs[..|bs|-4]) * 256 + (bs[|bs|-4] as int)) * 256 + (bs[|bs|-3] as int)) * 256 + (bs[|bs|-2] as int)) * 256 + (bs[|bs|-1] as int);\r\n { assert bs[..|bs|-4][..|bs[..|bs|-4]|-1] == bs[..|bs|-5]; }\r\n ((((BEByteSeqToInt(bs[..|bs|-5]) * 256 + (bs[|bs|-5] as int)) * 256 + (bs[|bs|-4] as int)) * 256 + (bs[|bs|-3] as int)) * 256 + (bs[|bs|-2] as int)) * 256 + (bs[|bs|-1] as int);\r\n { assert bs[..|bs|-5][..|bs[..|bs|-5]|-1] == bs[..|bs|-6]; }\r\n (((((BEByteSeqToInt(bs[..|bs|-6]) * 256 + (bs[|bs|-6] as int)) * 256 + (bs[|bs|-5] as int)) * 256 + (bs[|bs|-4] as int)) * 256 + (bs[|bs|-3] as int)) * 256 + (bs[|bs|-2] as int)) * 256 + (bs[|bs|-1] as int);\r\n { assert bs[..|bs|-6][..|bs[..|bs|-6]|-1] == bs[..|bs|-7]; }\r\n ((((((BEByteSeqToInt(bs[..|bs|-7]) * 256 + (bs[|bs|-7] as int)) * 256 + (bs[|bs|-6] as int)) * 256 + (bs[|bs|-5] as int)) * 256 + (bs[|bs|-4] as int)) * 256 + (bs[|bs|-3] as int)) * 256 + (bs[|bs|-2] as int)) * 256 + (bs[|bs|-1] as int);\r\n (((((((BEByteSeqToInt(bs[..|bs|-8]) * 256 + (bs[|bs|-8] as int)) * 256 + (bs[|bs|-7] as int)) * 256 + (bs[|bs|-6] as int)) * 256 + (bs[|bs|-5] as int)) * 256 + (bs[|bs|-4] as int)) * 256 + (bs[|bs|-3] as int)) * 256 + (bs[|bs|-2] as int)) * 256 + (bs[|bs|-1] as int);\r\n ret as int;\r\n }\r\n}\r\n\r\n/* Doesn't appear to be in use at present\r\nfunction method BEByteSeqToUint32(bs:seq) : uint32\r\n requires |bs| == Uint32Size() as int\r\n ensures 0 <= BEByteSeqToInt(SeqByteToByteSeq(bs)) < 0x100000000 // Need for the cast on the next line\r\n ensures BEByteSeqToUint32(bs) == BEByteSeqToInt(SeqByteToByteSeq(bs)) as uint32\r\n{\r\n lemma_2toX(); //byteIsUint32_forall();\r\n //byteIsUint32(bs[0]); byteIsUint32(bs[1]); byteIsUint32(bs[2]); byteIsUint32(bs[3]);\r\n //byteIsByte(bs[0]); byteIsByte(bs[1]); byteIsByte(bs[2]); byteIsByte(bs[3]);\r\n //byteTimes0x100IsWord(bs[2]); byteTimes0x10000IsWord(bs[1]); byteTimes0x1000000IsWord(bs[0]);\r\n lemma_BEByteSeqToUint32_properties(bs);\r\n uint32(bs[0]) * 256*256*256 + uint32(bs[1]) * 256*256 + uint32(bs[2]) * 256 + uint32(bs[3])\r\n}\r\n*/\r\n\r\n// renamed from BEByteSeqToUint64 to SeqByteToUint64\r\n// \"BEByteSeq\" is a seq with a byte precondition constraint, to\r\n// access the generic pv library.\r\n// So let's have SeqByte be a Dafny seq.\r\nfunction method SeqByteToUint64(bs:seq) : uint64\r\n requires |bs| == Uint64Size() as int\r\n ensures 0 <= BEByteSeqToInt(bs) < 0x10000000000000000 // Need for the cast on the next line\r\n ensures SeqByteToUint64(bs) == BEByteSeqToInt(bs) as uint64\r\n{\r\n lemma_2toX();\r\n lemma_BEByteSeqToUint64_properties(bs);\r\n (bs[0] as uint64) * 256*256*256*0x100000000\r\n + (bs[1] as uint64) * 256*256*0x100000000\r\n + (bs[2] as uint64) * 256*0x100000000\r\n + (bs[3] as uint64) * 0x100000000\r\n + (bs[4] as uint64) * 256*256*256\r\n + (bs[5] as uint64) * 256*256\r\n + (bs[6] as uint64) * 256\r\n + (bs[7] as uint64)\r\n}\r\n\r\nfunction BEUintToSeqByte(v:int, width:int) : seq\r\n ensures width >= 0 && v >= 0 ==> |BEUintToSeqByte(v, width)| == width\r\n{\r\n if width > 0 && v >= 0 then\r\n BEUintToSeqByte(v/0x100, width - 1) + [ (v % 0x100) as byte ]\r\n else\r\n []\r\n}\r\n\r\nlemma lemma_BEUintToSeqByte_invertability(bytes:seq, val:int, width:nat)\r\n requires bytes == BEUintToSeqByte(val, width)\r\n requires 0 <= val < power2(8*width)\r\n requires |bytes| == width\r\n ensures BEByteSeqToInt(bytes) == val\r\n{\r\n lemma_2toX32();\r\n if width == 0 {\r\n assert BEUintToSeqByte(val, width) == [];\r\n assert power2(width) == 1;\r\n assert val == 0;\r\n } else {\r\n calc {\r\n val / 0x100;\r\n < { lemma_power2_adds(8*width-8, 8);\r\n lemma_div_by_multiple_is_strongly_ordered(val, power2(8*width), power2(8*width-8), power2(8)); }\r\n power2(8*width) / 0x100;\r\n power2(8*width) / power2(8);\r\n { lemma_power2_div_is_sub(8, 8*width); }\r\n power2(8*(width - 1));\r\n }\r\n\r\n calc {\r\n BEByteSeqToInt(bytes);\r\n BEByteSeqToInt(bytes[..|bytes|-1]) * 256 + (bytes[|bytes|-1] as int);\r\n { lemma_BEUintToSeqByte_invertability(bytes[..|bytes|-1], val / 0x100, width - 1); }\r\n (val / 0x100) * 256 + (bytes[|bytes|-1] as int);\r\n val;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_BEByteSeqToInt_invertability(bytes:seq, val:int, width:nat)\r\n requires BEByteSeqToInt(bytes) == val\r\n requires 0 <= val < power2(8*width)\r\n requires |bytes| == width\r\n ensures bytes == BEUintToSeqByte(val, width)\r\n{\r\n lemma_2toX32();\r\n if width == 0 {\r\n assert BEUintToSeqByte(val, width) == [];\r\n assert power2(width) == 1;\r\n assert val == 0;\r\n } else {\r\n calc {\r\n val / 0x100;\r\n < { lemma_power2_adds(8*width-8, 8);\r\n lemma_div_by_multiple_is_strongly_ordered(val, power2(8*width), power2(8*width-8), power2(8)); }\r\n power2(8*width) / 0x100;\r\n power2(8*width) / power2(8);\r\n { lemma_power2_div_is_sub(8, 8*width); }\r\n power2(8*(width - 1));\r\n }\r\n\r\n calc {\r\n BEUintToSeqByte(val, width);\r\n BEUintToSeqByte(val/0x100, width - 1) + [ (val % 0x100) as byte ];\r\n { lemma_BEByteSeqToInt_invertability(bytes[..|bytes|-1], val / 0x100, width - 1); }\r\n bytes[..|bytes|-1] + [ (val % 0x100) as byte ];\r\n bytes[..|bytes|-1] + [ bytes[|bytes|-1] ];\r\n bytes;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_BEByteSeqToInt_BEUintToSeqByte_invertability()\r\n ensures forall bytes:seq, width:nat :: \r\n |bytes| == width ==> bytes == BEUintToSeqByte(BEByteSeqToInt(bytes), width)\r\n ensures forall val:int, width:nat :: 0 <= val < power2(8*width) ==>\r\n val == BEByteSeqToInt(BEUintToSeqByte(val, width))\r\n{\r\n forall bytes:seq, width:nat | |bytes| == width \r\n ensures bytes == BEUintToSeqByte(BEByteSeqToInt(bytes), width)\r\n {\r\n lemma_BEByteSeqToInt_bound(bytes);\r\n lemma_BEByteSeqToInt_invertability(bytes, BEByteSeqToInt(bytes), width);\r\n }\r\n forall val:int, width:nat | 0 <= val < power2(8*width)\r\n ensures val == BEByteSeqToInt(BEUintToSeqByte(val, width))\r\n {\r\n lemma_BEUintToSeqByte_invertability(BEUintToSeqByte(val, width), val, width);\r\n }\r\n}\r\n\r\n\r\nfunction method Uint64ToSeqByte(u:uint64) : seq\r\n ensures Uint64ToSeqByte(u) == BEUintToSeqByte(u as int, 8)\r\n{\r\n ghost var pv := 256;\r\n var bs := [\r\n (u/0x100000000000000) as byte,\r\n ((u/ 0x1000000000000) % 0x100) as byte,\r\n ((u/ 0x10000000000) % 0x100) as byte,\r\n ((u/ 0x100000000) % 0x100) as byte,\r\n ((u/ 0x1000000) % 0x100) as byte,\r\n ((u/ 0x10000) % 0x100) as byte,\r\n ((u/ 0x100) % 0x100) as byte,\r\n ((u ) % 0x100) as byte ];\r\n lemma_2toX();\r\n var u_int := u as int;\r\n calc {\r\n BEUintToSeqByte(u_int, 8);\r\n BEUintToSeqByte(u_int/0x100, 7) + [ (u_int % 0x100) as byte ];\r\n BEUintToSeqByte((u_int/0x100/0x100), 6) + [ ((u_int/0x100) % 0x100) as byte ] + [ (u_int % 0x100) as byte ];\r\n { lemma_div_denominator(u_int as int, 0x100, 0x100); }\r\n BEUintToSeqByte((u_int/0x10000), 6) + [ ((u_int/0x100) % 0x100) as byte ] + [ (u_int % 0x100) as byte ];\r\n { lemma_div_denominator(u_int as int, 0x10000, 0x100); }\r\n BEUintToSeqByte(u_int/0x1000000, 5) + [ ((u_int / 0x10000) % 0x100) as byte ] + [ ((u_int/0x100) % 0x100) as byte ] + [ (u_int % 0x100) as byte ];\r\n { lemma_div_denominator(u_int as int, 0x1000000, 0x100); }\r\n BEUintToSeqByte(u_int/0x100000000, 4) + [ ((u_int / 0x1000000) % 0x100) as byte ] + [ ((u_int / 0x10000) % 0x100) as byte ] + [ ((u_int/0x100) % 0x100) as byte ] + [ (u_int % 0x100) as byte ];\r\n { lemma_div_denominator(u_int as int, 0x100000000, 0x100); }\r\n BEUintToSeqByte(u_int/0x10000000000, 3) + [ ((u_int / 0x100000000) % 0x100) as byte ] + [ ((u_int / 0x1000000) % 0x100) as byte ] + [ ((u_int / 0x10000) % 0x100) as byte ] + [ ((u_int/0x100) % 0x100) as byte ] + [ (u_int % 0x100) as byte ];\r\n { lemma_div_denominator(u_int as int, 0x10000000000, 0x100); }\r\n BEUintToSeqByte(u_int/0x1000000000000, 2) + [ ((u_int / 0x10000000000) % 0x100) as byte ] + [ ((u_int / 0x100000000) % 0x100) as byte ] + [ ((u_int / 0x1000000) % 0x100) as byte ] + [ ((u_int / 0x10000) % 0x100) as byte ] + [ ((u_int/0x100) % 0x100) as byte ] + [ (u_int % 0x100) as byte ];\r\n { lemma_div_denominator(u_int as int, 0x1000000000000, 0x100); }\r\n BEUintToSeqByte(u_int/0x100000000000000, 1) + [ ((u_int / 0x1000000000000) % 0x100) as byte ] + [ ((u_int / 0x10000000000) % 0x100) as byte ] + [ ((u_int / 0x100000000) % 0x100) as byte ] + [ ((u_int / 0x1000000) % 0x100) as byte ] + [ ((u_int / 0x10000) % 0x100) as byte ] + [ ((u_int/0x100) % 0x100) as byte ] + [ (u_int % 0x100) as byte ];\r\n { lemma_div_denominator(u_int as int, 0x100000000000000, 0x100); }\r\n BEUintToSeqByte(u_int/0x10000000000000000, 0) + [ ((u_int / 0x100000000000000) % 0x100) as byte ] + [ ((u_int / 0x1000000000000) % 0x100) as byte ] + [ ((u_int / 0x10000000000) % 0x100) as byte ] + [ ((u_int / 0x100000000) % 0x100) as byte ] + [ ((u_int / 0x1000000) % 0x100) as byte ] + [ ((u_int / 0x10000) % 0x100) as byte ] + [ ((u_int/0x100) % 0x100) as byte ] + [ (u_int % 0x100) as byte ];\r\n }\r\n bs\r\n}\r\n\r\nfunction method SeqByteToUint16(bs:seq) : uint16\r\n requires |bs| == Uint16Size() as int\r\n ensures 0 <= BEByteSeqToInt(bs) < 0x10000000000000000 // Need for the cast on the next line\r\n ensures BEByteSeqToInt(bs) < 0x10000\r\n ensures SeqByteToUint16(bs) == BEByteSeqToInt(bs) as uint16\r\n{\r\n lemma_2toX();\r\n lemma_BEByteSeqToInt_bound(bs);\r\n (bs[0] as uint16) * 256 + (bs[1] as uint16)\r\n}\r\n\r\nfunction method Uint16ToSeqByte(u:uint16) : seq\r\n ensures Uint16ToSeqByte(u) == BEUintToSeqByte(u as int, 2)\r\n{\r\n ghost var pv := 256;\r\n var s := [\r\n ((u/0x100) % 0x100) as byte,\r\n ((u ) % 0x100) as byte ];\r\n lemma_2toX();\r\n var u_int := u as int;\r\n calc {\r\n BEUintToSeqByte(u_int, 2);\r\n BEUintToSeqByte(u_int/0x100, 1) + [ (u_int % 0x100) as byte ];\r\n BEUintToSeqByte((u_int/0x100/0x100), 0) + [ ((u_int/0x100) % 0x100) as byte ] + [ (u_int % 0x100) as byte ];\r\n { lemma_div_denominator(u_int as int, 0x100, 0x100); }\r\n BEUintToSeqByte((u_int/0x10000), 0) + [ ((u_int/0x100) % 0x100) as byte ] + [ (u_int % 0x100) as byte ];\r\n }\r\n s\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/LiveSHT/CmdLineParser.i.dfy", "content": "include \"../Common/CmdLineParser.i.dfy\"\r\ninclude \"../SHT/ConstantsState.i.dfy\"\r\n\r\nmodule ShtCmdLineParser_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened CmdLineParser_i\r\nimport opened SHT__ConstantsState_i\r\nimport opened Impl_Parameters_i\r\nimport opened Common__NetClient_i\r\nimport opened Common__SeqIsUniqueDef_i\r\nimport opened Common__NodeIdentity_i\r\n\r\nfunction EndPointNull () : EndPoint\r\n{\r\n EndPoint([])\r\n}\r\n\r\nfunction ConstantsStateNull () : ConstantsState \r\n{\r\n ConstantsState(EndPointNull(), [], StaticParams())\r\n}\r\n\r\nfunction sht_cmd_line_parsing(args:seq>) : ConstantsState\r\n{\r\n var (ok, endpoints) := parse_end_points(args);\r\n if !ok then\r\n ConstantsStateNull()\r\n else\r\n ConstantsState(if |endpoints| > 0 then endpoints[0] else EndPointNull(), // Root is the first endpoint in the list\r\n endpoints,\r\n StaticParams())\r\n}\r\n\r\nfunction sht_parse_id(arg:seq) : EndPoint\r\n{\r\n var (ok, ep) := parse_end_point(arg);\r\n ep\r\n}\r\n\r\nmethod GetHostIndex(host:EndPoint, hosts:seq) returns (found:bool, index:uint64)\r\n requires EndPointIsValidPublicKey(host)\r\n requires SeqIsUnique(hosts)\r\n requires |hosts| < 0x1_0000_0000_0000_0000\r\n requires forall h :: h in hosts ==> EndPointIsValidPublicKey(h)\r\n ensures found ==> 0 <= index as int < |hosts| && hosts[index] == host\r\n ensures !found ==> !(host in hosts)\r\n ensures !found ==> !(AbstractifyEndPointToNodeIdentity(host) in AbstractifyEndPointsToNodeIdentities(hosts))\r\n{\r\n var i:uint64 := 0;\r\n lemma_AbstractifyEndPointsToNodeIdentities_properties(hosts);\r\n\r\n while i < |hosts| as uint64\r\n invariant i as int <= |hosts|;\r\n invariant forall j :: 0 <= j < i ==> hosts[j] != host;\r\n {\r\n if host == hosts[i] {\r\n found := true;\r\n index := i;\r\n \r\n calc ==> {\r\n true;\r\n { reveal_SeqIsUnique(); }\r\n forall j :: 0 <= j < |hosts| && j != i as int ==> hosts[j] != host;\r\n }\r\n\r\n return;\r\n }\r\n\r\n if i == |hosts| as uint64 - 1 {\r\n found := false;\r\n return;\r\n }\r\n\r\n i := i + 1;\r\n }\r\n found := false;\r\n}\r\n\r\nmethod parse_cmd_line(id:EndPoint, args:seq>) returns (ok:bool, config:ConstantsState, my_index:uint64)\r\n requires EndPointIsValidPublicKey(id)\r\n ensures ok ==> && ConstantsStateIsValid(config)\r\n && 0 <= my_index as int < |config.hostIds|\r\n && config == sht_cmd_line_parsing(args)\r\n && config.hostIds[my_index] == id\r\n{\r\n var tuple1 := parse_end_points(args);\r\n ok := tuple1.0;\r\n var endpoints := tuple1.1;\r\n if !ok || |endpoints| >= 0xffff_ffff_ffff_ffff {\r\n ok := false;\r\n return;\r\n }\r\n\r\n var unique := test_unique(endpoints);\r\n if !unique {\r\n ok := false;\r\n return;\r\n }\r\n\r\n ok, my_index := GetHostIndex(id, endpoints);\r\n if !ok {\r\n return;\r\n }\r\n var root_identity := endpoints[0];\r\n\r\n config := ConstantsState(root_identity, endpoints, StaticParams());\r\n}\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/LiveSHT/Host.i.dfy", "content": "include \"../../Common/Framework/Host.s.dfy\"\r\ninclude \"SchedulerImpl.i.dfy\"\r\ninclude \"CmdLineParser.i.dfy\"\r\n\r\nmodule Host_i refines Host_s {\r\n import opened Collections__Sets_i\r\n\r\n import opened Common__NodeIdentity_i\r\n import opened Impl_Parameters_i\r\n import opened SHT__ConstantsState_i\r\n import opened LiveSHT__Environment_i\r\n import opened LiveSHT__Scheduler_i\r\n import opened LiveSHT__SchedulerImpl_i\r\n import opened LiveSHT__NetSHT_i\r\n import opened LiveSHT__Unsendable_i\r\n import opened CmdLineParser_i\r\n import opened ShtCmdLineParser_i \r\n export Spec\r\n provides Native__Io_s, Environment_s, Native__NativeTypes_s\r\n provides HostState\r\n provides ConcreteConfiguration\r\n provides HostInit, HostNext, ConcreteConfigInit, HostStateInvariants, ConcreteConfigToServers\r\n provides ParseCommandLineConfiguration, ArbitraryObject\r\n provides HostInitImpl, HostNextImpl\r\n export All reveals *\r\n\r\n\r\n datatype CScheduler = CScheduler(ghost sched:LScheduler, scheduler_impl:SchedulerImpl?)\r\n\r\n type HostState = CScheduler\r\n type ConcreteConfiguration = ConstantsState\r\n\r\n predicate HostStateInvariants(host_state:HostState, env:HostEnvironment)\r\n {\r\n host_state.scheduler_impl != null \r\n && host_state.scheduler_impl.Valid() \r\n && host_state.scheduler_impl.Env() == env\r\n && host_state.sched == host_state.scheduler_impl.AbstractifyToLScheduler()\r\n }\r\n\r\n predicate HostInit(host_state:HostState, config:ConcreteConfiguration, id:EndPoint)\r\n {\r\n host_state.scheduler_impl != null && host_state.scheduler_impl.Valid()\r\n && host_state.scheduler_impl.host.constants == config\r\n && host_state.scheduler_impl.host.me == id\r\n && LScheduler_Init(host_state.sched, \r\n AbstractifyEndPointToNodeIdentity(host_state.scheduler_impl.host.me), \r\n AbstractifyEndPointToNodeIdentity(config.rootIdentity), \r\n AbstractifyEndPointsToNodeIdentities(config.hostIds), \r\n AbstractifyCParametersToParameters(config.params))\r\n }\r\n\r\n predicate HostNext(host_state:HostState, host_state':HostState, ios:seq>>)\r\n {\r\n NetEventLogIsAbstractable(ios)\r\n && OnlySentMarshallableData(ios)\r\n && ( LScheduler_Next(host_state.sched, host_state'.sched, AbstractifyRawLogToIos(ios))\r\n || HostNextIgnoreUnsendable(host_state.sched, host_state'.sched, ios))\r\n }\r\n\r\n predicate ConcreteConfigInit(config:ConcreteConfiguration)\r\n {\r\n ConstantsStateIsValid(config)\r\n && config.rootIdentity in config.hostIds\r\n //&& (forall i :: 0 <= i < |config.hostIds| ==> c\r\n }\r\n\r\n function ConcreteConfigToServers(config:ConcreteConfiguration) : set\r\n {\r\n MapSeqToSet(config.hostIds, x=>x)\r\n }\r\n\r\n function ParseCommandLineConfiguration(args:seq>) : ConcreteConfiguration\r\n {\r\n sht_cmd_line_parsing(args)\r\n }\r\n \r\n method {:timeLimitMultiplier 4} HostInitImpl(\r\n ghost env:HostEnvironment,\r\n netc:NetClient,\r\n args:seq>\r\n ) returns (\r\n ok:bool,\r\n host_state:HostState\r\n )\r\n {\r\n var config:ConstantsState, my_index:uint64;\r\n var id := EndPoint(netc.MyPublicKey());\r\n ok, config, my_index := parse_cmd_line(id, args);\r\n if !ok { return; }\r\n assert config.hostIds[my_index] in config.hostIds;\r\n \r\n var scheduler := new SchedulerImpl();\r\n// calc {\r\n// constants.myIndex as int;\r\n// { reveal_SeqIsUnique(); }\r\n// my_index as int;\r\n// }\r\n\r\n assert env.Valid() && env.ok.ok();\r\n \r\n ok := scheduler.Host_Init_Impl(config, my_index, id, netc, env);\r\n \r\n if !ok { return; }\r\n host_state := CScheduler(scheduler.AbstractifyToLScheduler(), scheduler);\r\n assert ConcreteConfigInit(config);\r\n assert HostInit(host_state, config, id);\r\n }\r\n \r\n predicate EventsConsistent(recvs:seq, clocks:seq, sends:seq) \r\n {\r\n forall e :: (e in recvs ==> e.LIoOpReceive?) \r\n && (e in clocks ==> e.LIoOpReadClock? || e.LIoOpTimeoutReceive?) \r\n && (e in sends ==> e.LIoOpSend?)\r\n }\r\n\r\n ghost method RemoveRecvs(events:seq) returns (recvs:seq, rest:seq) \r\n ensures forall e :: e in recvs ==> e.LIoOpReceive?;\r\n ensures events == recvs + rest;\r\n ensures rest != [] ==> !rest[0].LIoOpReceive?;\r\n {\r\n recvs := [];\r\n rest := [];\r\n\r\n var i := 0;\r\n while i < |events| \r\n invariant 0 <= i <= |events|;\r\n invariant forall e :: e in recvs ==> e.LIoOpReceive?;\r\n //invariant events == recvs + events[i..];\r\n invariant recvs == events[0..i];\r\n {\r\n if !events[i].LIoOpReceive? {\r\n rest := events[i..];\r\n return;\r\n }\r\n recvs := recvs + [events[i]];\r\n i := i + 1;\r\n }\r\n }\r\n\r\n predicate NetEventsReductionCompatible(events:seq)\r\n {\r\n forall i :: 0 <= i < |events| - 1 ==> events[i].LIoOpReceive? || events[i+1].LIoOpSend?\r\n }\r\n\r\n\r\n lemma RemainingEventsAreSends(events:seq)\r\n requires NetEventsReductionCompatible(events);\r\n requires |events| > 0;\r\n requires !events[0].LIoOpReceive?;\r\n ensures forall e :: e in events[1..] ==> e.LIoOpSend?;\r\n {\r\n if |events| == 1 {\r\n } else {\r\n assert events[1].LIoOpSend?;\r\n RemainingEventsAreSends(events[1..]);\r\n }\r\n }\r\n\r\n ghost method PartitionEvents(events:seq) returns (recvs:seq, clocks:seq, sends:seq)\r\n requires NetEventsReductionCompatible(events);\r\n ensures events == recvs + clocks + sends;\r\n ensures EventsConsistent(recvs, clocks, sends);\r\n ensures |clocks| <= 1;\r\n {\r\n var rest;\r\n recvs, rest := RemoveRecvs(events);\r\n assert events[|recvs|..] == rest;\r\n if |rest| > 0 && (rest[0].LIoOpReadClock? || rest[0].LIoOpTimeoutReceive?) {\r\n clocks := [rest[0]];\r\n sends := rest[1..];\r\n RemainingEventsAreSends(rest);\r\n } else {\r\n clocks := [];\r\n sends := rest;\r\n if |rest| > 0 {\r\n RemainingEventsAreSends(rest);\r\n }\r\n }\r\n }\r\n\r\n /*lemma ProtocolIosRespectReduction(s:LScheduler, s':LScheduler, ios:seq)\r\n requires LScheduler_Next(s, s', ios);\r\n ensures LIoOpSeqCompatibleWithReduction(ios);\r\n {\r\n }*/\r\n\r\n lemma NetEventsRespectReduction(s:LScheduler, s':LScheduler, \r\n ios:seq, events:seq)\r\n requires LIoOpSeqCompatibleWithReduction(ios);\r\n requires RawIoConsistentWithSpecIO(events, ios);\r\n ensures NetEventsReductionCompatible(events);\r\n {\r\n lemma_AbstractifyRawLogToIos_properties(events, ios);\r\n assert NetEventsReductionCompatible(events);\r\n }\r\n\r\n method {:timeLimitMultiplier 3} HostNextImpl(ghost env:HostEnvironment, host_state:HostState) \r\n returns (ok:bool, host_state':HostState, \r\n ghost recvs:seq, ghost clocks:seq, ghost sends:seq, \r\n ghost ios:seq>>)\r\n {\r\n var okay, netEventLog, abstract_ios := host_state.scheduler_impl.Host_Next_main();\r\n if okay {\r\n// calc { \r\n// Q_LScheduler_Next(host_state.sched, host_state.replica_impl.AbstractifyToLScheduler(), abstract_ios);\r\n// { reveal_Q_LScheduler_Next(); }\r\n// LScheduler_Next(host_state.sched, host_state.replica_impl.AbstractifyToLScheduler(), abstract_ios);\r\n// }\r\n\r\n assert AbstractifyRawLogToIos(netEventLog) == abstract_ios;\r\n if LScheduler_Next(host_state.sched, host_state.scheduler_impl.AbstractifyToLScheduler(), abstract_ios)\r\n {\r\n //ProtocolIosRespectReduction(host_state.sched, host_state.scheduler_impl.AbstractifyToLScheduler(), abstract_ios);\r\n assert LIoOpSeqCompatibleWithReduction(abstract_ios);\r\n }\r\n NetEventsRespectReduction(host_state.sched, host_state.scheduler_impl.AbstractifyToLScheduler(), abstract_ios, netEventLog);\r\n recvs, clocks, sends := PartitionEvents(netEventLog);\r\n ios := recvs + clocks + sends; //abstract_ios;\r\n assert ios == netEventLog;\r\n host_state' := CScheduler(host_state.scheduler_impl.AbstractifyToLScheduler(), host_state.scheduler_impl);\r\n } else {\r\n recvs := [];\r\n clocks := [];\r\n sends := [];\r\n }\r\n ok := okay;\r\n }\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/LiveSHT/NetSHT.i.dfy", "content": "include \"../Common/NetClient.i.dfy\"\r\ninclude \"../SHT/PacketParsing.i.dfy\"\r\ninclude \"../../Protocol/LiveSHT/RefinementProof/Environment.i.dfy\"\r\ninclude \"../SHT/SHTConcreteConfiguration.i.dfy\"\r\ninclude \"../SHT/CMessage.i.dfy\"\r\n\r\nmodule LiveSHT__NetSHT_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened Environment_s\r\nimport opened Common__Util_i\r\nimport opened Common__NetClient_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened SHT__PacketParsing_i\r\nimport opened LiveSHT__Environment_i\r\nimport opened SHT__SHTConcreteConfiguration_i\r\nimport opened SHT__CMessage_i\r\n\r\npredicate NetEventIsAbstractable(evt:NetEvent)\r\n{\r\n match evt\r\n case LIoOpSend(s) => NetPacketIsAbstractable(s)\r\n case LIoOpReceive(r) => NetPacketIsAbstractable(r)\r\n case LIoOpTimeoutReceive => true\r\n case LIoOpReadClock(t) => true\r\n}\r\n\r\nfunction AbstractifyNetEventToLSHTIo(evt:NetEvent) : LSHTIo\r\n requires NetEventIsAbstractable(evt);\r\n{\r\n match evt\r\n case LIoOpSend(s) => LIoOpSend(AbstractifyNetPacketToLSHTPacket(s))\r\n case LIoOpReceive(r) => LIoOpReceive(AbstractifyNetPacketToLSHTPacket(r))\r\n case LIoOpTimeoutReceive => LIoOpTimeoutReceive()\r\n case LIoOpReadClock(t) => LIoOpReadClock(t as int)\r\n}\r\n\r\n\r\npredicate NetEventLogIsAbstractable(rawlog:seq)\r\n{\r\n forall i :: 0<=i<|rawlog| ==> NetEventIsAbstractable(rawlog[i])\r\n}\r\n\r\nfunction {:opaque} AbstractifyRawLogToIos(rawlog:seq) : seq\r\n requires NetEventLogIsAbstractable(rawlog);\r\n ensures |AbstractifyRawLogToIos(rawlog)| == |rawlog|;\r\n ensures forall i {:trigger AbstractifyNetEventToLSHTIo(rawlog[i])} {:trigger AbstractifyRawLogToIos(rawlog)[i]} :: 0<=i<|rawlog| ==> AbstractifyRawLogToIos(rawlog)[i] == AbstractifyNetEventToLSHTIo(rawlog[i]);\r\n{\r\n if (rawlog==[]) then [] else [AbstractifyNetEventToLSHTIo(rawlog[0])] + AbstractifyRawLogToIos(rawlog[1..])\r\n}\r\n\r\nlemma lemma_AbstractifyRawLogToIos_properties(rawlog:seq, ios:seq)\r\n requires NetEventLogIsAbstractable(rawlog);\r\n requires |rawlog| == |ios|;\r\n requires forall i :: 0<=i<|rawlog| ==> ios[i] == AbstractifyNetEventToLSHTIo(rawlog[i]);\r\n ensures AbstractifyRawLogToIos(rawlog) == ios;\r\n{\r\n reveal_AbstractifyRawLogToIos();\r\n}\r\n\r\npredicate RawIoConsistentWithSpecIO(rawlog:seq, ios:seq)\r\n{\r\n NetEventLogIsAbstractable(rawlog)\r\n && AbstractifyRawLogToIos(rawlog) == ios\r\n}\r\n\r\npredicate OnlySentMarshallableData(rawlog:seq)\r\n{\r\n forall io :: io in rawlog && io.LIoOpSend? ==> NetPacketBound(io.s.msg) && CSingleMessageMarshallable(SHTDemarshallData(io.s.msg))\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// These methods wrap the raw NetClient interface\r\n//\r\n\r\ndatatype ReceiveResult = RRFail() | RRTimeout() | RRPacket(cpacket:CPacket)\r\n\r\nmethod Receive(netClient:NetClient, localAddr:EndPoint) returns (rr:ReceiveResult, ghost netEvent:NetEvent)\r\n requires NetClientIsValid(netClient);\r\n requires EndPoint(netClient.MyPublicKey()) == localAddr;\r\n //requires KnownSendersMatchConfig(config);\r\n //requires SHTConcreteConfigurationIsValid(config);\r\n modifies NetClientRepr(netClient);\r\n ensures netClient.env == old(netClient.env);\r\n ensures netClient.MyPublicKey() == old(netClient.MyPublicKey());\r\n ensures NetClientOk(netClient) <==> !rr.RRFail?;\r\n ensures old(NetClientRepr(netClient)) == NetClientRepr(netClient);\r\n ensures !rr.RRFail? ==>\r\n netClient.IsOpen()\r\n && old(netClient.env.net.history()) + [netEvent] == netClient.env.net.history();\r\n ensures rr.RRTimeout? ==>\r\n netEvent.LIoOpTimeoutReceive?;\r\n ensures rr.RRPacket? ==>\r\n netEvent.LIoOpReceive?\r\n && NetPacketIsAbstractable(netEvent.r)\r\n && CPacketIsAbstractable(rr.cpacket)\r\n && EndPointIsValidPublicKey(rr.cpacket.src)\r\n && AbstractifyCPacketToShtPacket(rr.cpacket) == AbstractifyNetPacketToShtPacket(netEvent.r)\r\n && rr.cpacket.msg == SHTDemarshallData(netEvent.r.msg)\r\n && (rr.cpacket.dst == localAddr)\r\n{\r\n var timeout := 0; \r\n var ok, timedOut, remote, buffer := netClient.Receive(timeout);\r\n\r\n if (!ok) {\r\n rr := RRFail();\r\n return;\r\n }\r\n\r\n if (timedOut) {\r\n rr := RRTimeout();\r\n netEvent := LIoOpTimeoutReceive(); \r\n return;\r\n } else {\r\n var start_time := Time.GetDebugTimeTicks();\r\n var cmessage := SHTDemarshallDataMethod(buffer);\r\n var end_time := Time.GetDebugTimeTicks();\r\n var srcEp := EndPoint(remote);\r\n var cpacket := CPacket(localAddr, srcEp, cmessage);\r\n rr := RRPacket(cpacket);\r\n netEvent := LIoOpReceive(LPacket(EndPoint(netClient.MyPublicKey()), srcEp, buffer[..]));\r\n forall ()\r\n ensures AbstractifyCPacketToShtPacket(rr.cpacket) == AbstractifyNetPacketToShtPacket(netEvent.r);\r\n //ensures SHTEndPointIsValid(rr.cpacket.src, config);\r\n {\r\n// Uint64EndPointRelationships();\r\n// assert ConvertEndPointToUint64(srcEp) == rr.cpacket.src; // OBSERVE trigger\r\n assert EndPointIsValidPublicKey(EndPoint(netClient.MyPublicKey())); // OBSERVE trigger\r\n }\r\n }\r\n}\r\n\r\n/*\r\nmethod ReadClock(netClient:NetClient) returns (clock:CBoundedClock, ghost clockEvent:NetEvent)\r\n requires NetClientIsValid(netClient);\r\n modifies NetClientRepr(netClient);\r\n ensures old(NetClientRepr(netClient)) == NetClientRepr(netClient);\r\n ensures NetClientIsValid(netClient);\r\n ensures netClient.env == old(netClient.env);\r\n ensures old(netClient.env.net.history()) + [clockEvent] == netClient.env.net.history();\r\n ensures clockEvent.NetGetTime?;\r\n ensures clock.min as int <= clockEvent.time as int <= clock.max as int;\r\n ensures NetClientIsValid(netClient);\r\n ensures NetEventIsAbstractable(clockEvent);\r\n ensures netClient.MyPublicKey() == old(netClient.MyPublicKey());\r\n ensures clock.min==clock.max==clockEvent.time; // silly\r\n // ensures clockEvent.ClockEvent(clock_min, clock_max);\r\n // TODO we're going to call GetTime, which returns a single value.\r\n // Add/subtract the margin of error to make a CBoundedClock.\r\n // TODO Jay: if I pretend the margin is 0, how will the verification fail?\r\n{\r\n var t := Time.GetTime(netClient.env);\r\n var u := t as uint64;\r\n clockEvent := NetGetTime(t);\r\n clock := CBoundedClock(t,t);\r\n}\r\n*/\r\n\r\npredicate SendLogEntryReflectsPacket(event:NetEvent, cpacket:CPacket)\r\n{\r\n event.LIoOpSend?\r\n && NetPacketIsAbstractable(event.s)\r\n && CPacketIsAbstractable(cpacket)\r\n && AbstractifyCPacketToShtPacket(cpacket) == AbstractifyNetPacketToShtPacket(event.s)\r\n}\r\n\r\npredicate SendLogReflectsPacket(netEventLog:seq, packets:seq)\r\n{\r\n |netEventLog| == |packets| \r\n && (forall i :: 0 <= i < |packets| ==> SendLogEntryReflectsPacket(netEventLog[i], packets[i]))\r\n}\r\n\r\n/*\r\npredicate SendLogMatchesRefinement(netEventLog:seq, broadcast:CBroadcast, index:int)\r\n requires CBroadcastIsAbstractable(broadcast);\r\n requires broadcast.CBroadcast?;\r\n requires 0<=|netEventLog|<=|broadcast.dsts|\r\n requires 0 <= index < |netEventLog|;\r\n{\r\n netEventLog[index].NetSendEvent? && NetPacketIsAbstractable(netEventLog[index].sendPacket)\r\n && AbstractifyCBroadcastToRlsPacketSeq(broadcast)[index] == AbstractifyCPacketToShtPacket(netEventLog[index].sendPacket)\r\n}\r\n\r\npredicate SendLogReflectsBroadcastPrefix(netEventLog:seq, broadcast:CBroadcast)\r\n requires CBroadcastIsAbstractable(broadcast);\r\n requires broadcast.CBroadcast?;\r\n{\r\n 0<=|netEventLog|<=|broadcast.dsts|\r\n && forall i :: 0<=i<|netEventLog| ==> SendLogMatchesRefinement(netEventLog, broadcast, i)\r\n}\r\n*/\r\n\r\n/*\r\npredicate SendLogReflectsBroadcast(netEventLog:seq, broadcast:CBroadcast)\r\n requires CBroadcastIsAbstractable(broadcast);\r\n{\r\n if broadcast.CBroadcastNop? then netEventLog == []\r\n else \r\n SendLogReflectsBroadcastPrefix(netEventLog, broadcast)\r\n && |netEventLog| == |broadcast.dsts|\r\n}\r\n\r\nlemma lemma_NetEventLogAppend(broadcast:CBroadcast, netEventLog:seq, netEvent:NetEvent)\r\n requires broadcast.CBroadcast?;\r\n requires CBroadcastIsValid(broadcast);\r\n requires SendLogReflectsBroadcastPrefix(netEventLog, broadcast);\r\n requires |netEventLog| < |broadcast.dsts|;\r\n requires netEvent.NetSendEvent?;\r\n requires NetPacketIsAbstractable(netEvent.sendPacket);\r\n requires CMessageIsAbstractable(PaxosDemarshallData(netEvent.sendPacket.data));\r\n requires netEvent.sendPacket.dst == broadcast.dsts[|netEventLog|];\r\n requires netEvent.sendPacket.src == broadcast.src;\r\n requires BufferRefinementAgreesWithMessageRefinement(broadcast.msg, netEvent.sendPacket.data);\r\n ensures SendLogReflectsBroadcastPrefix(netEventLog + [netEvent], broadcast);\r\n{\r\n\r\n var i := |netEventLog|;\r\n\r\n calc {\r\n AbstractifyCBroadcastToRlsPacketSeq(broadcast)[i];\r\n BuildLBroadcast(AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyEndPointsToNodeIdentities(broadcast.dsts), \r\n AbstractifyCMessageToRslMessage(broadcast.msg))[i];\r\n LPacket(AbstractifyEndPointsToNodeIdentities(broadcast.dsts)[i], \r\n AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyCMessageToRslMessage(broadcast.msg));\r\n LPacket(AbstractifyEndPointToNodeIdentity(netEvent.sendPacket.dst),\r\n AbstractifyEndPointToNodeIdentity(netEvent.sendPacket.src),\r\n AbstractifyCMessageToRslMessage(PaxosDemarshallData(netEvent.sendPacket.data)));\r\n AbstractifyCPacketToShtPacket(netEvent.sendPacket);\r\n }\r\n\r\n var new_log := netEventLog + [netEvent];\r\n\r\n forall i | 0 <= i < |new_log|\r\n ensures SendLogMatchesRefinement(new_log, broadcast, i);\r\n {\r\n if i < |netEventLog| {\r\n assert new_log[i] == netEventLog[i];\r\n assert SendLogMatchesRefinement(netEventLog, broadcast, i);\r\n assert SendLogMatchesRefinement(new_log, broadcast, i);\r\n } else {\r\n assert new_log[i] == netEvent;\r\n assert SendLogMatchesRefinement(new_log, broadcast, i);\r\n }\r\n }\r\n\r\n calc ==> {\r\n true;\r\n forall i :: 0 <= i < |new_log| ==> SendLogMatchesRefinement(new_log, broadcast, i);\r\n SendLogReflectsBroadcastPrefix(new_log, broadcast);\r\n SendLogReflectsBroadcastPrefix(netEventLog + [netEvent], broadcast);\r\n }\r\n \r\n}\r\n*/\r\n\r\n\r\n/*\r\nmethod SendBroadcast(netClient:NetClient, broadcast:CBroadcast, ghost localAddr_:EndPoint) returns (ok:bool, ghost netEventLog:seq)\r\n requires NetClientIsValid(netClient);\r\n requires CBroadcastIsValid(broadcast);\r\n requires EndPoint(netClient.MyPublicKey()) == localAddr_;\r\n requires broadcast.CBroadcast? ==> broadcast.src == localAddr_;\r\n modifies NetClientRepr(netClient);\r\n ensures old(NetClientRepr(netClient)) == NetClientRepr(netClient);\r\n ensures netClient.env == old(netClient.env);\r\n ensures netClient.MyPublicKey() == old(netClient.MyPublicKey());\r\n ensures NetClientOk(netClient) <==> ok;\r\n ensures ok ==> (\r\n NetClientIsValid(netClient)\r\n && netClient.IsOpen()\r\n && old(netClient.env.net.history()) + netEventLog == netClient.env.net.history()\r\n && SendLogReflectsBroadcast(netEventLog, broadcast));\r\n{\r\n ok := true;\r\n netEventLog := [];\r\n\r\n if broadcast.CBroadcastNop? {\r\n // No work to do!\r\n } else {\r\n // Do the marshalling work once\r\n assert CMessageIsAbstractable(broadcast.msg);\r\n assert Marshallable(broadcast.msg);\r\n var buffer := PaxosMarshall(broadcast.msg);\r\n assert PaxosDemarshallable(buffer[..]);\r\n\r\n calc ==> {\r\n true;\r\n CBroadcastIsValid(broadcast);\r\n CBroadcastIsAbstractable(broadcast);\r\n CMessageIsAbstractable(broadcast.msg);\r\n }\r\n\r\n lemma_PaxosDemarshallableImpliesRefinable(buffer[..]);\r\n\r\n var i:uint64 := 0;\r\n while i < |broadcast.dsts| as uint64\r\n invariant 0 <= i as int <= |broadcast.dsts|;\r\n invariant |netEventLog| == i as int;\r\n invariant NetClientRepr(netClient) == old(NetClientRepr(netClient));\r\n invariant netClient.env == old(netClient.env);\r\n invariant netClient.MyPublicKey() == old(netClient.MyPublicKey());\r\n invariant NetClientIsValid(netClient);\r\n invariant NetClientOk(netClient);\r\n invariant old(netClient.env.net.history()) + netEventLog == netClient.env.net.history();\r\n invariant PaxosDemarshallable(buffer[..]);\r\n invariant BufferRefinementAgreesWithMessageRefinement(broadcast.msg, buffer[..]);\r\n invariant SendLogReflectsBroadcastPrefix(netEventLog, broadcast);\r\n invariant CMessageIsAbstractable(PaxosDemarshallData(buffer[..]));\r\n {\r\n ghost var netEventLog_old := netEventLog;\r\n\r\n // Construct the remote address -- TODO: Only do this once per replica!\r\n var dstEp:EndPoint := broadcast.dsts[i];\r\n var dstAddrAry := seqToArrayOpt(dstEp.addr);\r\n var remote;\r\n ok, remote := CryptoEndPoint.Construct(dstAddrAry, dstEp.port, netClient.env);\r\n if (!ok) { return; }\r\n\r\n ok := netClient.Send(remote, buffer);\r\n if (!ok) { return; }\r\n\r\n ghost var netEvent := NetSendEvent(NetPacket_ctor(remote.EP(), EndPoint(netClient.MyPublicKey()), buffer[..]));\r\n netEventLog := netEventLog + [netEvent];\r\n\r\n lemma_NetEventLogAppend(broadcast, netEventLog_old, netEvent);\r\n\r\n i := i + 1;\r\n }\r\n }\r\n\r\n}\r\n*/\r\n\r\n\r\nmethod SendPacketSeq(netClient:NetClient, cpackets:seq, ghost localAddr_:EndPoint) returns (ok:bool, ghost netEventLog:seq)\r\n requires NetClientIsValid(netClient);\r\n requires OutboundPacketsSeqIsValid(cpackets);\r\n requires EndPoint(netClient.MyPublicKey()) == localAddr_;\r\n requires OutboundPacketsSeqHasCorrectSrc(cpackets, localAddr_);\r\n modifies NetClientRepr(netClient);\r\n ensures old(NetClientRepr(netClient)) == NetClientRepr(netClient);\r\n ensures netClient.env == old(netClient.env);\r\n ensures netClient.MyPublicKey() == old(netClient.MyPublicKey());\r\n ensures NetClientOk(netClient) <==> ok;\r\n ensures ok ==> ( NetClientIsValid(netClient) && netClient.IsOpen());\r\n ensures ok ==> old(netClient.env.net.history()) + netEventLog == netClient.env.net.history();\r\n ensures ok ==> SendLogReflectsPacket(netEventLog, cpackets) && OnlySentMarshallableData(netEventLog);\r\n{\r\n var j:uint64 := 0;\r\n netEventLog := [];\r\n ok := true;\r\n \r\n ghost var netEventLog_old := netEventLog;\r\n ghost var netClientEnvHistory_old := old(netClient.env.net.history());\r\n var i := 0;\r\n\r\n while (i < |cpackets|)\r\n invariant old(NetClientRepr(netClient)) == NetClientRepr(netClient);\r\n invariant netClient.env == old(netClient.env);\r\n invariant netClient.MyPublicKey() == old(netClient.MyPublicKey());\r\n invariant NetClientOk(netClient) <==> ok;\r\n invariant ok ==> ( NetClientIsValid(netClient) && netClient.IsOpen());\r\n invariant ok ==> netClientEnvHistory_old + netEventLog == netClient.env.net.history();\r\n invariant ok ==> OnlySentMarshallableData(netEventLog);\r\n invariant (i == 0) ==> |netEventLog| == 0;\r\n invariant (0 < i < |cpackets|) ==> |netEventLog| == |cpackets[0..i]|;\r\n invariant (0 < i < |cpackets|) ==> SendLogReflectsPacket(netEventLog, cpackets[0..i]); \r\n invariant (i >= |cpackets|) ==> SendLogReflectsPacket(netEventLog, cpackets); \r\n \r\n {\r\n var cpacket := cpackets[i];\r\n // Construct the remote address\r\n var dstEp:EndPoint := cpacket.dst;\r\n assert cpacket in cpackets;\r\n assert OutboundPacketsIsValid(cpacket);\r\n\r\n assert CSingleMessageIsAbstractable(cpacket.msg);\r\n \r\n assert CSingleMessageMarshallable(cpacket.msg);\r\n var buffer := SHTMarshall(cpacket.msg);\r\n\r\n ghost var data := buffer[..];\r\n assert BufferRefinementAgreesWithMessageRefinement(cpacket.msg, data);\r\n\r\n ok := netClient.Send(dstEp.public_key, buffer);\r\n if (!ok) { return; }\r\n\r\n ghost var netEvent := LIoOpSend(LPacket(dstEp, EndPoint(netClient.MyPublicKey()), buffer[..]));\r\n ghost var net := netEvent.s;\r\n\r\n calc {\r\n AbstractifyCPacketToLSHTPacket(cpacket);\r\n LPacket(AbstractifyEndPointToNodeIdentity(cpacket.dst), AbstractifyEndPointToNodeIdentity(cpacket.src), AbstractifyCSingleMessageToSingleMessage(cpacket.msg));\r\n LPacket(AbstractifyEndPointToNodeIdentity(net.dst), AbstractifyEndPointToNodeIdentity(net.src), AbstractifyCSingleMessageToSingleMessage(cpacket.msg));\r\n AbstractifyBufferToLSHTPacket(net.src, net.dst, data);\r\n AbstractifyBufferToLSHTPacket(net.src, net.dst, net.msg);\r\n AbstractifyNetPacketToLSHTPacket(netEvent.s);\r\n }\r\n \r\n assert SendLogEntryReflectsPacket(netEvent, cpacket);\r\n assert OnlySentMarshallableData(netEventLog);\r\n assert NetPacketBound(netEvent.s.msg) && CSingleMessageMarshallable(SHTDemarshallData(netEvent.s.msg));\r\n netEventLog := netEventLog + [netEvent];\r\n assert cpackets[0..(i+1)] == cpackets[0..i] + [cpacket];\r\n assert SendLogReflectsPacket(netEventLog, cpackets[0..(i+1)]);\r\n assert OnlySentMarshallableData(netEventLog);\r\n i := i + 1;\r\n }\r\n}\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/LiveSHT/SchedulerImpl.i.dfy", "content": "include \"../SHT/HostModel.i.dfy\"\r\ninclude \"../../Protocol/LiveSHT/Scheduler.i.dfy\"\r\ninclude \"../../Common/Collections/Seqs.i.dfy\"\r\ninclude \"../../../Libraries/Math/mod_auto.i.dfy\"\r\ninclude \"../../Protocol/SHT/Host.i.dfy\"\r\ninclude \"NetSHT.i.dfy\"\r\ninclude \"SchedulerModel.i.dfy\"\r\ninclude \"Unsendable.i.dfy\"\r\n//include \"CBoundedClock.i.dfy\"\r\n\r\nmodule LiveSHT__SchedulerImpl_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened Logic__Option_i\r\nimport opened Math__mod_auto_i\r\nimport opened Collections__Seqs_i\r\nimport opened Environment_s\r\nimport opened SHT__Host_i\r\nimport opened SHT__HostModel_i\r\nimport opened SHT__HostState_i\r\nimport opened SHT__CMessage_i\r\nimport opened SHT__ConstantsState_i\r\nimport opened SHT__Network_i\r\nimport opened SHT__PacketParsing_i\r\nimport opened SHT__SingleDeliveryState_i\r\nimport opened SHT__SingleDelivery_i\r\nimport opened Impl_Parameters_i\r\nimport opened LiveSHT__Scheduler_i\r\nimport opened LiveSHT__NetSHT_i\r\nimport opened LiveSHT__SchedulerModel_i\r\nimport opened LiveSHT__Unsendable_i\r\nimport opened LiveSHT__Environment_i\r\nimport opened Common__GenericMarshalling_i\r\nimport opened Common__NetClient_i\r\nimport opened Common__NodeIdentity_i \r\nimport opened Common__Util_i\r\n\r\nclass SchedulerImpl\r\n{\r\n var host:HostState;\r\n var nextActionIndex:uint64;\r\n var resendCount:uint64;\r\n var netClient:NetClient?;\r\n var localAddr:EndPoint;\r\n\r\n ghost var Repr : set;\r\n\r\n constructor()\r\n {\r\n }\r\n\r\n predicate Valid()\r\n reads this;\r\n reads NetClientIsValid.reads(netClient);\r\n {\r\n HostStateIsValid(host)\r\n && HostStateIsAbstractable(host)\r\n && (0 <= nextActionIndex as int < LHost_NumActions())\r\n && (0 <= resendCount as int < 100000000)\r\n && NetClientIsValid(netClient)\r\n && EndPoint(netClient.MyPublicKey()) == localAddr\r\n && EndPoint(netClient.MyPublicKey()) == host.me\r\n && HostStateIsValid(host)\r\n && Repr == { this } + NetClientRepr(netClient)\r\n && CSingleDeliveryAccountIsValid(host.sd, host.constants.params)\r\n }\r\n \r\n function Env() : HostEnvironment?\r\n reads this, NetClientIsValid.reads(netClient);\r\n {\r\n if netClient!=null then netClient.env else null\r\n }\r\n \r\n function AbstractifyToHost() : Host\r\n reads this;\r\n requires HostStateIsAbstractable(host);\r\n {\r\n AbstractifyHostStateToHost(host)\r\n }\r\n\r\n function AbstractifyToLScheduler() : LScheduler\r\n reads this;\r\n requires HostStateIsAbstractable(host);\r\n {\r\n LScheduler(\r\n AbstractifyToHost(),\r\n nextActionIndex as int,\r\n resendCount as int)\r\n }\r\n \r\n method {:timeLimitMultiplier 2} Host_Init_Impl(\r\n constants:ConstantsState,\r\n my_index:uint64,\r\n me:EndPoint,\r\n nc:NetClient,\r\n ghost env_:HostEnvironment\r\n ) returns (\r\n ok:bool\r\n )\r\n requires env_.Valid() && env_.ok.ok()\r\n requires ConstantsStateIsValid(constants)\r\n requires EndPointIsValidPublicKey(me)\r\n requires NetClientIsValid(nc)\r\n requires EndPoint(nc.MyPublicKey()) == me\r\n requires 0 <= my_index as int < |constants.hostIds|\r\n requires EndPoint(nc.MyPublicKey()) == constants.hostIds[my_index]\r\n requires nc.env == env_\r\n modifies this\r\n ensures ok ==>\r\n Valid()\r\n && Env() == env_\r\n && LScheduler_Init(AbstractifyToLScheduler(), AbstractifyEndPointToNodeIdentity(me), AbstractifyEndPointToNodeIdentity(constants.rootIdentity), AbstractifyEndPointsToNodeIdentities(constants.hostIds), AbstractifyCParametersToParameters(constants.params))\r\n && host.constants == constants\r\n {\r\n netClient := nc;\r\n host := InitHostState(constants, me);\r\n nextActionIndex := 0;\r\n resendCount := 0;\r\n localAddr := host.me;\r\n Repr := { this } + NetClientRepr(netClient);\r\n ok := true;\r\n }\r\n\r\n static method rollActionIndex(a:uint64) returns (a':uint64)\r\n requires 0 <= a as int < 3;\r\n ensures a' as int == (a as int + 1) % LHost_NumActions();\r\n {\r\n lemma_mod_auto(3);\r\n if (a >= 2) {\r\n a' := 0;\r\n } else {\r\n a' := (a + 1);\r\n }\r\n }\r\n\r\n static method rollResendCount(a:uint64) returns (a':uint64)\r\n requires 0 <= a as int < 100000000;\r\n ensures a' as int == (a as int + 1) % 100000000;\r\n {\r\n lemma_mod_auto(100000000);\r\n if (a >= 100000000-1) {\r\n a' := 0;\r\n } else {\r\n a' := (a + 1);\r\n }\r\n }\r\n \r\n static lemma lemma_ExtractSentPacketsFromIos(ios:seq)\r\n requires AllIosAreSends(ios);\r\n ensures |ExtractSentPacketsFromIos(ios)| == |ios|;\r\n ensures forall i {:auto_trigger} :: 0 <= i < |ios| ==> ExtractSentPacketsFromIos(ios)[i] == ios[i].s;\r\n {\r\n reveal_ExtractSentPacketsFromIos();\r\n }\r\n\r\n\r\n method DeliverPacketSeq(packets:seq) returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires Valid();\r\n requires OutboundPacketsSeqIsValid(packets);\r\n requires OutboundPacketsSeqHasCorrectSrc(packets, host.me);\r\n modifies Repr;\r\n ensures Repr == old(Repr);\r\n ensures Env() == old(Env());\r\n ensures ok == NetClientOk(netClient);\r\n ensures ok ==> (\r\n Valid()\r\n && host == old(host)\r\n && nextActionIndex == old(nextActionIndex)\r\n && resendCount == old(resendCount)\r\n && AllIosAreSends(ios)\r\n && AbstractifyOutboundPacketsToSeqOfLSHTPackets(packets) == ExtractSentPacketsFromIos(ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(Env().net.history()) + netEventLog == Env().net.history());\r\n {\r\n var start_time := Time.GetDebugTimeTicks();\r\n ok, netEventLog := SendPacketSeq(netClient, packets, localAddr);\r\n if (!ok) { return; }\r\n\r\n ios := MapSentPacketSeqToIos(packets);\r\n MapSentPacketSeqToIos_ExtractSentPacketsFromIos_equivalence(packets, ios);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"DeliverPacketSeq\", start_time, end_time);\r\n \r\n }\r\n\r\n method DeliverOutboundPackets(packets:seq) returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires Valid();\r\n requires OutboundPacketsSeqIsValid(packets);\r\n requires OutboundPacketsSeqHasCorrectSrc(packets, host.me); \r\n modifies Repr;\r\n ensures Repr == old(Repr);\r\n ensures Env() == old(Env());\r\n ensures ok == NetClientOk(netClient);\r\n ensures ok ==> (\r\n Valid()\r\n && host == old(host)\r\n && nextActionIndex == old(nextActionIndex)\r\n && resendCount == old(resendCount)\r\n && AllIosAreSends(ios)\r\n && AbstractifyOutboundPacketsToSeqOfLSHTPackets(packets) == ExtractSentPacketsFromIos(ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(Env().net.history()) + netEventLog == Env().net.history());\r\n {\r\n ok, netEventLog, ios := DeliverPacketSeq(packets);\r\n }\r\n\r\n\r\n predicate ReceivedPacketProperties(cpacket:CPacket, netEvent0:NetEvent, io0:LSHTIo)\r\n reads this;\r\n //requires SHTConcreteConfigurationIsValid(host.constants.all.config);\r\n {\r\n CPacketIsSendable(cpacket)\r\n && EndPointIsValidPublicKey(host.me)\r\n && io0.LIoOpReceive?\r\n && NetEventIsAbstractable(netEvent0)\r\n && io0 == AbstractifyNetEventToLSHTIo(netEvent0)\r\n && NetEventIsAbstractable(netEvent0)\r\n && netEvent0.LIoOpReceive? && AbstractifyCPacketToShtPacket(cpacket) == AbstractifyNetPacketToShtPacket(netEvent0.r)\r\n }\r\n\r\n static lemma ExtractSentPacketsFromIos_DoesNotMindSomeClutter(ios_head:seq, ios_tail:seq)\r\n requires forall i :: 0<=i<|ios_head| ==> !ios_head[i].LIoOpSend?;\r\n ensures ExtractSentPacketsFromIos(ios_tail) == ExtractSentPacketsFromIos(ios_head + ios_tail);\r\n {\r\n if |ios_head| == 0 {\r\n assert ios_head + ios_tail == ios_tail;\r\n } else {\r\n assert !ios_head[0].LIoOpSend?;\r\n ghost var ios := [ios_head[0]] + ios_head[1..] + ios_tail;\r\n \r\n calc {\r\n ExtractSentPacketsFromIos(ios_head + ios_tail);\r\n { assert ios_head == [ios_head[0]] + ios_head[1..]; }\r\n ExtractSentPacketsFromIos([ios_head[0]] + ios_head[1..] + ios_tail);\r\n ExtractSentPacketsFromIos(ios);\r\n { assert ios[0] == ios_head[0]; assert ios[1..] == ios_head[1..] + ios_tail;\r\n reveal_ExtractSentPacketsFromIos(); \r\n }\r\n ExtractSentPacketsFromIos(ios_head[1..] + ios_tail);\r\n { ExtractSentPacketsFromIos_DoesNotMindSomeClutter(ios_head[1..], ios_tail); }\r\n ExtractSentPacketsFromIos(ios_tail);\r\n }\r\n }\r\n }\r\n\r\n method Host_NoReceive_NoClock_Next() returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires nextActionIndex == 2;\r\n requires Valid();\r\n modifies Repr;\r\n ensures Repr == old(Repr);\r\n ensures Env() == old(Env());\r\n ensures ok == NetClientOk(netClient);\r\n ensures ok ==> (\r\n Valid()\r\n && nextActionIndex == old(nextActionIndex)\r\n && resendCount == old(resendCount)\r\n && LHost_NoReceive_Next(old(AbstractifyToHost()), AbstractifyToHost(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog) \r\n && LIoOpSeqCompatibleWithReduction(ios)\r\n && old(Env().net.history()) + netEventLog == Env().net.history());\r\n {\r\n \r\n var sent_packets;\r\n \r\n host,sent_packets := HostModelSpontaneouslyRetransmit(host);\r\n \r\n ok, netEventLog, ios := DeliverOutboundPackets(sent_packets);\r\n if (!ok) { return; }\r\n assert old(Env().net.history()) + netEventLog == Env().net.history(); // deleteme\r\n\r\n // The following loop takes the forall that's stated in terms of io indices and turns\r\n // it into a forall in terms of ios. In other words, it takes\r\n // forall idx {:trigger 0 <= idx < |ios|} :: 0 <= idx < |ios| ==> ios[idx].LIoOpSend?\r\n // and turns it into\r\n // forall io {:trigger io in ios} :: io in ios ==> io.LIoOpSend?\r\n forall io | io in ios\r\n ensures io.LIoOpSend?;\r\n {\r\n var pos :| 0 <= pos < |ios| && io == ios[pos];\r\n assert ios[pos].LIoOpSend?;\r\n }\r\n\r\n assert AbstractifyOutboundPacketsToSeqOfLSHTPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n assert Env() == old(Env());\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n reveal_AbstractifyOutboundPacketsToSeqOfLSHTPackets();\r\n\r\n assert ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios)) == UnAckedMessages(AbstractifyToHost().sd, AbstractifyToHost().me);\r\n assert SpontaneouslyRetransmit(old(AbstractifyToHost()), AbstractifyToHost(), ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios)));\r\n assert LHost_NoReceive_Next(old(AbstractifyToHost()), AbstractifyToHost(), ios);\r\n }\r\n\r\n \r\n static lemma SingletonSeqPrependSilly(log_head:seq, log_tail:seq, log:seq)\r\n requires |log_head|==1;\r\n requires log == log_head + log_tail;\r\n ensures log_tail == log[1..];\r\n {\r\n }\r\n \r\n static lemma Combine_AbstractifyNetEventToLSHTIo(ios_head:seq, ios_tail:seq, ios:seq, log_head:seq, log_tail:seq, log:seq)\r\n requires |log_head| == |ios_head|;\r\n requires forall i :: 0<=i<|log_head|\r\n ==> NetEventIsAbstractable(log_head[i]) && ios_head[i] == AbstractifyNetEventToLSHTIo(log_head[i]);\r\n requires |log_tail| == |ios_tail|;\r\n requires forall i :: 0<=i<|log_tail|\r\n ==> NetEventIsAbstractable(log_tail[i]) && ios_tail[i] == AbstractifyNetEventToLSHTIo(log_tail[i]);\r\n requires ios == ios_head+ios_tail;\r\n requires log == log_head+log_tail;\r\n ensures forall i :: 0<=i<|log| ==> ios[i] == AbstractifyNetEventToLSHTIo(log[i]);\r\n {\r\n }\r\n\r\n static lemma NetEventLogIsAbstractable_Extend(log_head:seq, log_tail:seq, log:seq)\r\n requires log == log_head+log_tail;\r\n requires NetEventLogIsAbstractable(log_head);\r\n requires NetEventLogIsAbstractable(log_tail);\r\n ensures NetEventLogIsAbstractable(log);\r\n {\r\n }\r\n\r\n static lemma EstablishCombineIos(ios_head:seq, ios_tail:seq, ios:seq)\r\n requires ios == ios_head+ios_tail;\r\n requires |ios_head| == 1;\r\n requires forall i :: 0<=i<|ios_tail| ==> ios_tail[i].LIoOpSend?;\r\n ensures forall io :: io in ios[1..] ==> io.LIoOpSend?;\r\n {\r\n }\r\n\r\n static lemma SingletonSeqSilly(packets:seq, p:CPacket)\r\n requires packets == [p];\r\n requires |packets| == 1;\r\n ensures forall p' :: p' in packets ==> p' == p\r\n {\r\n }\r\n \r\n method{:timeLimitMultiplier 8} HostNextReceivePacket(ghost netEventLogOld:seq, rr:ReceiveResult, ghost receive_event:NetEvent) returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires nextActionIndex == 0;\r\n requires Valid();\r\n requires Env().net.history() == netEventLogOld + [receive_event];\r\n requires rr.RRPacket?;\r\n requires receive_event.LIoOpReceive?;\r\n requires CPacketIsAbstractable(rr.cpacket);\r\n requires ValidPhysicalAddress(rr.cpacket.src);\r\n requires NetPacketIsAbstractable(receive_event.r);\r\n //requires CSingleMessageMarshallable(rr.cpacket.msg);\r\n requires !rr.cpacket.msg.CInvalidMessage? && CSingleMessageIs64Bit(rr.cpacket.msg);\r\n requires AbstractifyCPacketToLSHTPacket(rr.cpacket) == AbstractifyNetPacketToLSHTPacket(receive_event.r);\r\n //requires CPacketIsSendable(rr.cpacket);\r\n requires rr.cpacket.dst == host.me;\r\n modifies Repr;\r\n ensures Repr == old(Repr);\r\n ensures ok == NetClientOk(netClient);\r\n ensures Env() == old(Env());\r\n ensures ok ==> (\r\n Valid()\r\n && nextActionIndex == old(nextActionIndex)\r\n && resendCount == old(resendCount)\r\n && LHost_ReceivePacket_Next(old(AbstractifyToHost()), AbstractifyToHost(), ios)\r\n && OnlySentMarshallableData(netEventLog) \r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && LIoOpSeqCompatibleWithReduction(ios)\r\n && netEventLogOld + netEventLog == Env().net.history());\r\n {\r\n var cpacket := rr.cpacket;\r\n var sent_packets, ack;\r\n host, sent_packets, ack := HostModelReceivePacket(host, cpacket); \r\n assert Valid();\r\n assert ReceivePacket(old(AbstractifyToHost()), AbstractifyToHost(), AbstractifyCPacketToShtPacket(cpacket), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets), AbstractifyCPacketToShtPacket(ack));\r\n\r\n ghost var io0 := LIoOpReceive(AbstractifyNetPacketToLSHTPacket(receive_event.r));\r\n ghost var log_head, log_tail, ios_head, ios_tail;\r\n\r\n ios_head := [io0];\r\n log_head := [receive_event];\r\n ghost var preDeliveryHistory := Env().net.history();\r\n\r\n assert Env() == old(Env());\r\n assert Valid();\r\n assert EndPoint(netClient.MyPublicKey()) == host.me;\r\n ok, log_tail, ios_tail := DeliverOutboundPackets(sent_packets);\r\n if (!ok) { return; }\r\n \r\n ios := ios_head + ios_tail;\r\n netEventLog := log_head + log_tail;\r\n\r\n calc {\r\n netEventLogOld + netEventLog;\r\n netEventLogOld + (log_head + log_tail);\r\n { SeqAdditionIsAssociative(netEventLogOld, log_head, log_tail); }\r\n (netEventLogOld + log_head) + log_tail;\r\n preDeliveryHistory + log_tail;\r\n { SingletonSeqPrependSilly(log_head, log_tail, netEventLog); }\r\n preDeliveryHistory + netEventLog[1..];\r\n preDeliveryHistory + log_tail;\r\n Env().net.history();\r\n }\r\n\r\n reveal_AbstractifyOutboundPacketsToSeqOfLSHTPackets();\r\n\r\n assert Env() == old(Env());\r\n\r\n assert io0 == AbstractifyNetEventToLSHTIo(receive_event);\r\n forall i | 0<=i<|log_head| ensures NetEventIsAbstractable(log_head[i]) && ios_head[i] == AbstractifyNetEventToLSHTIo(log_head[i]);\r\n {\r\n assert log_head[i] == receive_event;\r\n assert ios_head[i] == io0;\r\n }\r\n\r\n ExtractSentPacketsFromIos_DoesNotMindSomeClutter(ios_head, ios_tail);\r\n assert ios_tail == ios[1..];\r\n assert AllIosAreSends(ios_tail);\r\n assert forall i{:trigger ios_tail[i].LIoOpSend?} :: 0<=i<|ios_tail| ==> ios_tail[i].LIoOpSend?;\r\n Combine_AbstractifyNetEventToLSHTIo(ios_head, ios_tail, ios, log_head, log_tail, netEventLog);\r\n\r\n assert AbstractifyOutboundPacketsToSeqOfLSHTPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n NetEventLogIsAbstractable_Extend(log_head, log_tail, netEventLog);\r\n assert NetEventLogIsAbstractable(netEventLog);\r\n lemma_AbstractifyRawLogToIos_properties(netEventLog, ios);\r\n\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n ExtractSentPacketsFromIos_DoesNotMindSomeClutter(ios_head, ios_tail); \r\n assert ios[0] == io0;\r\n assert AbstractifyCPacketToShtPacket(cpacket) == Packet(ios[0].r.dst, ios[0].r.src, ios[0].r.msg);\r\n assert AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets) == ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios));\r\n assert ReceivePacket_Wrapper(old(AbstractifyToHost()), AbstractifyToHost(), AbstractifyCPacketToShtPacket(cpacket), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets));\r\n assert LHost_ReceivePacketWithoutReadingClock(old(AbstractifyToHost()), AbstractifyToHost(), ios);\r\n\r\n forall i | 1<=i<|ios|\r\n ensures ios[i].LIoOpSend?;\r\n {\r\n SingletonSeqPrependSilly2(ios_head, ios_tail, ios, i); // Help stabilize the next line \r\n assert ios[i] == ios_tail[i-1];\r\n var j := i-1;\r\n assert 0 <= j < |ios_tail|;\r\n assert ios_tail[j].LIoOpSend?;\r\n }\r\n assert LHost_ReceivePacket_Next(old(AbstractifyToHost()), AbstractifyToHost(), ios);\r\n }\r\n \r\n method Host_ReceivePacket_Next() returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires nextActionIndex == 0;\r\n requires Valid();\r\n modifies Repr;\r\n ensures Repr == old(Repr);\r\n ensures ok == NetClientOk(netClient);\r\n ensures Env() == old(Env());\r\n ensures ok ==> (\r\n Valid()\r\n && nextActionIndex == old(nextActionIndex)\r\n && resendCount == old(resendCount)\r\n && ( LHost_ReceivePacket_Next(old(AbstractifyToHost()), AbstractifyToHost(), ios)\r\n || ( IosReflectIgnoringUnDemarshallable(netEventLog)\r\n && old(AbstractifyToHost()) == AbstractifyToHost()) )\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog) \r\n && LIoOpSeqCompatibleWithReduction(ios)\r\n && old(Env().net.history()) + netEventLog == Env().net.history());\r\n {\r\n var start_time := Time.GetDebugTimeTicks();\r\n var rr;\r\n ghost var netEvent0;\r\n \r\n rr, netEvent0 := Receive(netClient, localAddr);\r\n ghost var midHistory := Env().net.history();\r\n assert Env()==old(Env());\r\n \r\n\r\n if (rr.RRFail?) {\r\n ok := false;\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Host_Next_ProcessPacket_fail\", start_time, end_time);\r\n return;\r\n } else if (rr.RRTimeout?) {\r\n ok := true;\r\n ios := [ LIoOpTimeoutReceive() ];\r\n netEventLog := [ netEvent0 ];\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Host_Next_ProcessPacket_timeout\", start_time, end_time);\r\n return;\r\n } else {\r\n ok := true;\r\n var cpacket := rr.cpacket;\r\n //assert Valid();\r\n //var marshallable := IsCSingleMessageMarshallable(cpacket.msg);\r\n //assert Valid();\r\n if cpacket.msg.CInvalidMessage? {\r\n ok := true;\r\n netEventLog := [netEvent0];\r\n ghost var receive_io := LIoOpReceive(AbstractifyNetPacketToLSHTPacket(netEvent0.r));\r\n ios := [receive_io];\r\n assert IosReflectIgnoringUnDemarshallable(netEventLog);\r\n } else {\r\n //assert CPacketIsAbstractable(cpacket) && CSingleMessageMarshallable(cpacket.msg);\r\n ok, netEventLog, ios := HostNextReceivePacket(old(Env().net.history()), rr, netEvent0); \r\n\r\n /* \r\n host, sent_packets, ack := HostModelReceivePacket(host, cpacket); \r\n assert Valid();\r\n assert ReceivePacket(old(AbstractifyToHost()), AbstractifyToHost(), AbstractifyCPacketToShtPacket(cpacket), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets), AbstractifyCPacketToShtPacket(ack));\r\n\r\n ghost var io0 := LIoOpReceive(AbstractifyNetPacketToLSHTPacket(netEvent0.r));\r\n ghost var log_head, log_tail, ios_head, ios_tail;\r\n\r\n ios_head := [io0];\r\n log_head := [netEvent0];\r\n ghost var preDeliveryHistory := Env().net.history();\r\n\r\n calc {\r\n old(Env().net.history()) + log_head;\r\n old(Env().net.history()) + [netEvent0];\r\n preDeliveryHistory;\r\n }\r\n assert Env() == old(Env());\r\n assert Valid();\r\n assert EndPoint(netClient.MyPublicKey()) == host.me;\r\n ok, log_tail, ios_tail := DeliverOutboundPackets(sent_packets);\r\n if (!ok) { return; }\r\n \r\n ios := ios_head + ios_tail;\r\n netEventLog := log_head + log_tail;\r\n\r\n calc {\r\n old(Env().net.history()) + netEventLog;\r\n old(Env().net.history()) + (log_head + log_tail);\r\n { SeqAdditionIsAssociative(old(Env().net.history()), log_head, log_tail); }\r\n (old(Env().net.history()) + log_head) + log_tail;\r\n preDeliveryHistory + log_tail;\r\n { SingletonSeqPrependSilly(log_head, log_tail, netEventLog); }\r\n preDeliveryHistory + netEventLog[1..];\r\n preDeliveryHistory + log_tail;\r\n Env().net.history();\r\n }\r\n\r\n reveal_AbstractifyOutboundPacketsToSeqOfLSHTPackets();\r\n\r\n assert Env() == old(Env());\r\n\r\n assert io0 == AbstractifyNetEventToLSHTIo(netEvent0);\r\n forall i | 0<=i<|log_head| ensures NetEventIsAbstractable(log_head[i]) && ios_head[i] == AbstractifyNetEventToLSHTIo(log_head[i]);\r\n {\r\n assert log_head[i] == netEvent0;\r\n assert ios_head[i] == io0;\r\n }\r\n\r\n ExtractSentPacketsFromIos_DoesNotMindSomeClutter(ios_head, ios_tail);\r\n assert ios_tail == ios[1..];\r\n assert AllIosAreSends(ios_tail);\r\n assert forall i{:trigger ios_tail[i].LIoOpSend?} :: 0<=i<|ios_tail| ==> ios_tail[i].LIoOpSend?;\r\n Combine_AbstractifyNetEventToLSHTIo(ios_head, ios_tail, ios, log_head, log_tail, netEventLog);\r\n\r\n assert AbstractifyOutboundPacketsToSeqOfLSHTPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n NetEventLogIsAbstractable_Extend(log_head, log_tail, netEventLog);\r\n assert NetEventLogIsAbstractable(netEventLog);\r\n lemma_AbstractifyRawLogToIos_properties(netEventLog, ios);\r\n\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n ExtractSentPacketsFromIos_DoesNotMindSomeClutter(ios_head, ios_tail); \r\n// assert LHost_ReceivePacketWithoutReadingClock(old(AbstractifyToHost()), AbstractifyToHost(), ios);\r\n\r\n forall i | 1<=i<|ios|\r\n ensures ios[i].LIoOpSend?;\r\n {\r\n SingletonSeqPrependSilly2(ios_head, ios_tail, ios, i); // Help stabilize the next line \r\n assert ios[i] == ios_tail[i-1];\r\n var j := i-1;\r\n assert 0 <= j < |ios_tail|;\r\n assert ios_tail[j].LIoOpSend?;\r\n }\r\n assert LHost_ReceivePacket_Next(old(AbstractifyToHost()), AbstractifyToHost(), ios);\r\n */\r\n }\r\n }\r\n }\r\n\r\n static lemma SingletonSeqPrependSilly2(log_head:seq, log_tail:seq, log:seq, index:int)\r\n requires |log_head|==1;\r\n requires log == log_head + log_tail;\r\n requires 1 <= index < |log|;\r\n ensures log_tail[index-1] == log[index];\r\n {\r\n }\r\n\r\n method{:timeLimitMultiplier 2} Host_ProcessReceivedPacket_Next() returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires nextActionIndex == 1;\r\n requires Valid();\r\n modifies Repr;\r\n ensures Repr == old(Repr);\r\n ensures Env() == old(Env());\r\n ensures ok == NetClientOk(netClient);\r\n ensures ok ==> (\r\n Valid()\r\n && nextActionIndex == old(nextActionIndex)\r\n && resendCount == old(resendCount)\r\n && (LHost_ProcessReceivedPacket_Next(old(AbstractifyToHost()), AbstractifyToHost(), ios)\r\n || HostNextIgnoreUnsendableProcess(old(AbstractifyToLScheduler()), AbstractifyToLScheduler().(nextActionIndex := 2), netEventLog))\r\n && old(AbstractifyToHost()).me == AbstractifyToHost().me\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog) \r\n && LIoOpSeqCompatibleWithReduction(ios)\r\n && old(AbstractifyToLScheduler()).host.constants == AbstractifyToLScheduler().host.constants\r\n && old(Env().net.history()) + netEventLog == Env().net.history());\r\n {\r\n var sent_packets := [];\r\n var b;\r\n if (host.receivedPacket.Some?)\r\n {\r\n b := ShouldProcessReceivedMessageImpl(host);\r\n if (b) {\r\n var cpacket := host.receivedPacket.v;\r\n\r\n if (cpacket.msg.CSingleMessage?) {\r\n assert |host.delegationMap.lows| < 0xFFFF_FFFF_FFFF_FFFF - 2;\r\n host, sent_packets := HostModelNextReceiveMessage(host, cpacket);\r\n } else {\r\n host := host.(receivedPacket := None);\r\n sent_packets := [];\r\n assert false;\r\n }\r\n } else {\r\n //host := host.(receivedPacket := None);\r\n sent_packets := [];\r\n //assert false;\r\n }\r\n } else {\r\n sent_packets := [];\r\n \r\n }\r\n ok, netEventLog, ios := DeliverOutboundPackets(sent_packets);\r\n if (!ok) { return; }\r\n assert old(Env().net.history()) + netEventLog == Env().net.history(); // deleteme\r\n lemma_ExtractSentPacketsFromIos(ios); // ==>\r\n assert |sent_packets| == 0 ==> |ios| == 0;\r\n\r\n // The following loop takes the forall that's stated in terms of io indices and turns\r\n // it into a forall in terms of ios. In other words, it takes\r\n // forall idx {:trigger 0 <= idx < |ios|} :: 0 <= idx < |ios| ==> ios[idx].LIoOpSend?\r\n // and turns it into\r\n // forall io {:trigger io in ios} :: io.LIoOpSend?\r\n forall io | io in ios\r\n ensures io.LIoOpSend?;\r\n {\r\n var pos :| 0 <= pos < |ios| && io == ios[pos];\r\n assert ios[pos].LIoOpSend?;\r\n }\r\n\r\n if (old(AbstractifyToHost()).receivedPacket.Some?) {\r\n if (b) {\r\n assert AbstractifyOutboundPacketsToSeqOfLSHTPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n assert Env() == old(Env());\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n reveal_AbstractifyOutboundPacketsToSeqOfLSHTPackets();\r\n ghost var packet := old(AbstractifyToHost()).receivedPacket.v;\r\n if packet.msg.SingleMessage? {\r\n assert Process_Message(old(AbstractifyToHost()), AbstractifyToHost(), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets))\r\n || HostIgnoringUnParseable(old(AbstractifyToHost()), AbstractifyToHost(), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets));\r\n } else {\r\n assert false;\r\n }\r\n\r\n assert AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets) == ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios));\r\n\r\n assert ProcessReceivedPacket(old(AbstractifyToHost()), AbstractifyToHost(), ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios))) || HostIgnoringUnParseable(old(AbstractifyToHost()), AbstractifyToHost(), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets));\r\n if ProcessReceivedPacket(old(AbstractifyToHost()), AbstractifyToHost(), ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios))) {\r\n assert LHost_ProcessReceivedPacket_Next(old(AbstractifyToHost()), AbstractifyToHost(), ios);\r\n } \r\n\r\n if HostIgnoringUnParseable(old(AbstractifyToHost()), AbstractifyToHost(), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets)) {\r\n assert HostNextIgnoreUnsendableProcess(old(AbstractifyToLScheduler()), AbstractifyToLScheduler().(nextActionIndex := 2), netEventLog);\r\n }\r\n assert LHost_ProcessReceivedPacket_Next(old(AbstractifyToHost()), AbstractifyToHost(), ios)\r\n || HostNextIgnoreUnsendableProcess(old(AbstractifyToLScheduler()), AbstractifyToLScheduler().(nextActionIndex := 2), netEventLog);\r\n } else {\r\n assert AbstractifyOutboundPacketsToSeqOfLSHTPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n assert Env() == old(Env());\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n reveal_AbstractifyOutboundPacketsToSeqOfLSHTPackets();\r\n assert !ShouldProcessReceivedMessage(old(AbstractifyToHost()));\r\n assert ProcessReceivedPacket(old(AbstractifyToHost()), AbstractifyToHost(), ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios)));\r\n assert LHost_ProcessReceivedPacket_Next(old(AbstractifyToHost()), AbstractifyToHost(), ios);\r\n }\r\n } else {\r\n assert AbstractifyOutboundPacketsToSeqOfLSHTPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n assert Env() == old(Env());\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n reveal_AbstractifyOutboundPacketsToSeqOfLSHTPackets();\r\n assert host.receivedPacket.Some? == false;\r\n assert old(AbstractifyToHost()).receivedPacket.Some? == false;\r\n assert ProcessReceivedPacket(old(AbstractifyToHost()), AbstractifyToHost(), ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios)));\r\n assert LHost_ProcessReceivedPacket_Next(old(AbstractifyToHost()), AbstractifyToHost(), ios);\r\n }\r\n \r\n }\r\n \r\n \r\n method {:timeLimitMultiplier 2} Host_Next_main()\r\n returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires Valid();\r\n modifies Repr;\r\n ensures Repr == old(Repr);\r\n ensures ok <==> Env() != null && Env().Valid() && Env().ok.ok();\r\n ensures Env() == old(Env());\r\n ensures ok ==> (\r\n Valid()\r\n && ( LScheduler_Next(old(AbstractifyToLScheduler()), AbstractifyToLScheduler(), ios)\r\n || HostNextIgnoreUnsendable(old(AbstractifyToLScheduler()), AbstractifyToLScheduler(), netEventLog))\r\n && LIoOpSeqCompatibleWithReduction(ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog) \r\n && old(Env().net.history()) + netEventLog == Env().net.history()\r\n );\r\n {\r\n var curActionIndex := nextActionIndex;\r\n var nextActionIndex' := rollActionIndex(nextActionIndex);\r\n\r\n var curResendCount;\r\n var nextResendCount;\r\n ghost var host_old := old(AbstractifyToHost());\r\n ghost var scheduler_old := old(AbstractifyToLScheduler());\r\n ghost var host;\r\n ghost var scheduler;\r\n\r\n //print (\"Host_Next_main Enter\\n\");\r\n assert scheduler_old.host == host_old;\r\n if (curActionIndex == 0) {\r\n ok, netEventLog, ios := Host_ReceivePacket_Next();\r\n if (!ok) { return; }\r\n } else if (curActionIndex == 1) {\r\n ok, netEventLog, ios := Host_ProcessReceivedPacket_Next();\r\n if (!ok) { return; }\r\n } else if (curActionIndex == 2) {\r\n curResendCount := resendCount;\r\n nextResendCount := rollResendCount(curResendCount);\r\n resendCount := nextResendCount;\r\n if (nextResendCount == 0) {\r\n ok, netEventLog, ios := Host_NoReceive_NoClock_Next();\r\n if (!ok) { return; }\r\n } else {\r\n ok := true;\r\n netEventLog := [];\r\n ios := [];\r\n }\r\n } else {\r\n assert false;\r\n }\r\n host := AbstractifyToHost();\r\n nextActionIndex := nextActionIndex';\r\n scheduler := AbstractifyToLScheduler();\r\n calc {\r\n scheduler.nextActionIndex;\r\n nextActionIndex as int;\r\n nextActionIndex' as int;\r\n (curActionIndex+1) as int % LHost_NumActions();\r\n (scheduler_old.nextActionIndex+1)%LHost_NumActions();\r\n }\r\n \r\n if (curActionIndex == 2) {\r\n calc {\r\n scheduler.resendCount;\r\n resendCount as int;\r\n nextResendCount as int;\r\n (curResendCount+1) as int % 100000000;\r\n (scheduler_old.resendCount+1)%100000000;\r\n }\r\n \r\n if (nextResendCount == 0) {\r\n assert LHost_NoReceive_Next(old(AbstractifyToLScheduler()).host, AbstractifyToLScheduler().host, ios);\r\n } else {\r\n assert scheduler == scheduler_old.(resendCount := scheduler.resendCount, nextActionIndex := scheduler.nextActionIndex);\r\n }\r\n\r\n }\r\n\r\n //assert LHost_ReceivePacket_Next(old(AbstractifyToLScheduler()).host, AbstractifyToLScheduler().host, ios) || LHost_ProcessReceivedPacket_Next(old(AbstractifyToLScheduler()).host, AbstractifyToLScheduler().host, ios) || LHost_NoReceive_Next(old(AbstractifyToLScheduler()).host, AbstractifyToLScheduler().host, ios);\r\n assert NetClientIsValid(netClient);\r\n assert old(AbstractifyToLScheduler()).host.constants == AbstractifyToLScheduler().host.constants; \r\n assert {:split_here} true;\r\n if (curActionIndex == 0) {\r\n assert old(AbstractifyToLScheduler()).nextActionIndex == 0;\r\n calc {\r\n AbstractifyToLScheduler().nextActionIndex;\r\n (curActionIndex+1) as int % LHost_NumActions();\r\n (curActionIndex+1) as int % 3;\r\n 1 % 3;\r\n 1;\r\n }\r\n assert LScheduler_Next(old(AbstractifyToLScheduler()), AbstractifyToLScheduler(), ios)\r\n || HostNextIgnoreUnsendable(old(AbstractifyToLScheduler()), AbstractifyToLScheduler(), netEventLog);\r\n } else if (curActionIndex == 1) {\r\n assert LScheduler_Next(old(AbstractifyToLScheduler()), AbstractifyToLScheduler(), ios)\r\n || HostNextIgnoreUnsendable(old(AbstractifyToLScheduler()), AbstractifyToLScheduler(), netEventLog);\r\n } else if (curActionIndex == 2) {\r\n assert LScheduler_Next(old(AbstractifyToLScheduler()), AbstractifyToLScheduler(), ios);\r\n }\r\n\r\n }\r\n}\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/LiveSHT/SchedulerModel.i.dfy", "content": "\r\ninclude \"../SHT/HostModel.i.dfy\"\r\ninclude \"../../Protocol/LiveSHT/Scheduler.i.dfy\"\r\ninclude \"../../Common/Collections/Seqs.i.dfy\"\r\ninclude \"../../../Libraries/Math/mod_auto.i.dfy\"\r\ninclude \"../../Protocol/SHT/Host.i.dfy\"\r\ninclude \"NetSHT.i.dfy\"\r\n//include \"CBoundedClock.i.dfy\"\r\n\r\nmodule LiveSHT__SchedulerModel_i {\r\nimport opened Environment_s\r\nimport opened SHT__Host_i\r\nimport opened SHT__HostModel_i\r\nimport opened SHT__CMessage_i\r\nimport opened SHT__PacketParsing_i\r\nimport opened LiveSHT__Scheduler_i\r\nimport opened LiveSHT__NetSHT_i\r\nimport opened LiveSHT__Environment_i\r\nimport opened Common__NodeIdentity_i\r\n\r\npredicate AllIosAreSends(ios:seq)\r\n{\r\n forall i :: 0<=i<|ios| ==> ios[i].LIoOpSend?\r\n}\r\n\r\nlemma MapSentPacketToIos_ExtractSentPacketsFromIos_equivalence(sent_packet:CPacket, ios:seq)\r\n requires OutboundPacketsIsValid(sent_packet);\r\n requires ios == MapSentPacketToIos(sent_packet);\r\n ensures [AbstractifyOutboundPacketsToLSHTPacket(sent_packet)] == ExtractSentPacketsFromIos(ios);\r\n{\r\n reveal_ExtractSentPacketsFromIos();\r\n}\r\n\r\nlemma MapSentPacketSeqToIos_ExtractSentPacketsFromIos_equivalence(sent_packets:seq, ios:seq)\r\n requires OutboundPacketsSeqIsValid(sent_packets);\r\n //requires forall i :: 0 <= i < |sent_packets| ==> CPacketIsSendable(sent_packets[i]) && sent_packets[i].msg.CSingleMessage? && CSingleMessageMarshallable(sent_packets[i].msg);\r\n requires ios == MapSentPacketSeqToIos(sent_packets);\r\n ensures AbstractifyOutboundPacketsToSeqOfLSHTPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n{\r\n reveal_ExtractSentPacketsFromIos();\r\n reveal_MapSentPacketSeqToIos();\r\n reveal_AbstractifyOutboundPacketsToSeqOfLSHTPackets();\r\n var x := AbstractifyOutboundPacketsToSeqOfLSHTPackets(sent_packets);\r\n var y := ExtractSentPacketsFromIos(ios);\r\n if (|x| > 0) {\r\n MapSentPacketSeqToIos_ExtractSentPacketsFromIos_equivalence(sent_packets[1..], ios[1..]);\r\n }\r\n}\r\n\r\nfunction MapSentPacketToIos(sent_packet:CPacket) : seq\r\n requires OutboundPacketsIsValid(sent_packet);\r\n{\r\n [LIoOpSend(AbstractifyCPacketToLSHTPacket(sent_packet))]\r\n}\r\n\r\n\r\nfunction {:opaque} MapSentPacketSeqToIos(sent_packets:seq) : seq\r\n requires OutboundPacketsSeqIsValid(sent_packets);\r\n //requires forall i :: 0 <= i < |sent_packets| ==> CPacketIsSendable(sent_packets[i]) && sent_packets[i].msg.CSingleMessage? && CSingleMessageMarshallable(sent_packets[i].msg)\r\n ensures |MapSentPacketSeqToIos(sent_packets)| == |sent_packets|;\r\n ensures forall i :: 0 <= i < |sent_packets| ==> MapSentPacketSeqToIos(sent_packets)[i] == LIoOpSend(AbstractifyCPacketToLSHTPacket(sent_packets[i]));\r\n ensures (forall io :: io in MapSentPacketSeqToIos(sent_packets) ==> io.LIoOpSend?);\r\n{\r\n //lemma_MapSentPacketSeqToIos(sent_packets);\r\n if |sent_packets| == 0 then\r\n []\r\n else if |sent_packets| == 1 then\r\n [LIoOpSend(AbstractifyCPacketToLSHTPacket(sent_packets[0]))]\r\n else\r\n [LIoOpSend(AbstractifyCPacketToLSHTPacket(sent_packets[0]))] + MapSentPacketSeqToIos(sent_packets[1..])\r\n}\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/LiveSHT/Unsendable.i.dfy", "content": "include \"../../Protocol/LiveSHT/Scheduler.i.dfy\"\r\ninclude \"../SHT/PacketParsing.i.dfy\"\r\n\r\nmodule LiveSHT__Unsendable_i {\r\n import opened Native__NativeTypes_s\r\n import opened Native__Io_s\r\n import opened Logic__Option_i\r\n import opened Environment_s\r\n import opened LiveSHT__Scheduler_i\r\n import opened SHT__PacketParsing_i\r\n import opened SHT__Host_i\r\n import opened SHT__Keys_i\r\n import opened Common__GenericMarshalling_i\r\n\r\n predicate IosReflectIgnoringUnDemarshallable(ios:seq>>)\r\n {\r\n |ios| == 1\r\n && ios[0].LIoOpReceive?\r\n// && !Demarshallable(ios[0].r.msg, CSingleMessage_grammar())\r\n && SHTDemarshallData(ios[0].r.msg).CInvalidMessage?\r\n }\r\n\r\n\r\n predicate IosReflectIgnoringUnParseable(s:LScheduler, ios:seq>>)\r\n {\r\n ios == []\r\n && ( s.host.receivedPacket.Some? \r\n && s.host.receivedPacket.v.msg.SingleMessage? \r\n && s.host.receivedPacket.v.msg.m.Delegate?\r\n && var msg := s.host.receivedPacket.v.msg.m;\r\n !(ValidKeyRange(msg.range) && ValidHashtable(msg.h) && !EmptyKeyRange(msg.range)\r\n && ValidPhysicalAddress(s.host.receivedPacket.v.msg.dst)))\r\n }\r\n \r\n predicate HostNextIgnoreUnsendableReceive(s:LScheduler, s':LScheduler, ios:seq>>)\r\n {\r\n s.nextActionIndex == 0\r\n && s' == s.(nextActionIndex := 1)\r\n && IosReflectIgnoringUnDemarshallable(ios) \r\n }\r\n\r\n predicate IgnoreSchedulerUpdate(s:LScheduler, s':LScheduler) \r\n {\r\n if ShouldProcessReceivedMessage(s.host) then\r\n s' == s.(nextActionIndex := 2, host := s.host.(receivedPacket := None))\r\n else \r\n s' == s.(nextActionIndex := 2)\r\n }\r\n \r\n predicate HostNextIgnoreUnsendableProcess(s:LScheduler, s':LScheduler, ios:seq>>)\r\n {\r\n s.nextActionIndex == 1\r\n && IgnoreSchedulerUpdate(s, s')\r\n && IosReflectIgnoringUnParseable(s, ios)\r\n }\r\n \r\n predicate HostNextIgnoreUnsendable(s:LScheduler, s':LScheduler, ios:seq>>)\r\n {\r\n HostNextIgnoreUnsendableReceive(s, s', ios) || HostNextIgnoreUnsendableProcess(s, s', ios)\r\n }\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Lock/CmdLineParser.i.dfy", "content": "include \"../Common/CmdLineParser.i.dfy\"\r\n\r\nmodule LockCmdLineParser_i {\r\n\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened Environment_s\r\nimport opened CmdLineParser_i\r\nimport opened Common__NetClient_i\r\nimport opened Common__SeqIsUniqueDef_i\r\n\r\nfunction lock_config_parsing(args:seq>) : seq\r\n{\r\n parse_end_points(args).1\r\n}\r\n\r\nmethod ParseCmdLine(id:EndPoint, args:seq>)\r\n returns (ok:bool, host_ids:seq, my_index:uint64)\r\n requires EndPointIsValidPublicKey(id)\r\n ensures ok ==> && 0 <= my_index as int < |host_ids| < 0x1_0000_0000_0000_0000\r\n && host_ids == lock_config_parsing(args)\r\n && host_ids[my_index] == id\r\n && SeqIsUnique(host_ids)\r\n && (forall h :: h in host_ids ==> EndPointIsValidPublicKey(h))\r\n{\r\n var tuple1 := parse_end_points(args);\r\n ok := tuple1.0;\r\n if !ok {\r\n return;\r\n }\r\n host_ids := tuple1.1;\r\n if |host_ids| == 0 || |host_ids| >= 0x1_0000_0000_0000_0000 {\r\n ok := false;\r\n return;\r\n }\r\n\r\n var unique := test_unique(host_ids);\r\n if !unique {\r\n ok := false;\r\n return;\r\n }\r\n\r\n ok, my_index := GetHostIndex(id, host_ids);\r\n if !ok {\r\n return;\r\n }\r\n\r\n ghost var ghost_host_ids := lock_config_parsing(args);\r\n assert host_ids == ghost_host_ids;\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Lock/Host.i.dfy", "content": "include \"../../Common/Framework/Host.s.dfy\"\r\ninclude \"../../Common/Collections/Sets.i.dfy\"\r\ninclude \"NodeImpl.i.dfy\"\r\ninclude \"CmdLineParser.i.dfy\"\r\n\r\nmodule Host_i refines Host_s {\r\n import opened Collections__Sets_i\r\n import opened Protocol_Node_i\r\n import opened NodeImpl_i\r\n import opened CmdLineParser_i\r\n import opened LockCmdLineParser_i\r\n import opened Types_i\r\n import opened Impl_Node_i\r\n import opened NetLock_i\r\n export Spec\r\n provides Native__Io_s, Environment_s, Native__NativeTypes_s\r\n provides HostState\r\n provides ConcreteConfiguration\r\n provides HostInit, HostNext, ConcreteConfigInit, HostStateInvariants\r\n provides ConcreteConfigToServers, ParseCommandLineConfiguration, ArbitraryObject\r\n provides HostInitImpl, HostNextImpl\r\n export All reveals *\r\n\r\n datatype CScheduler = CScheduler(ghost node:Node, node_impl:NodeImpl)\r\n\r\n type HostState = CScheduler\r\n type ConcreteConfiguration = Config\r\n\r\n predicate HostStateInvariants(host_state:HostState, env:HostEnvironment)\r\n {\r\n && host_state.node_impl.Valid() \r\n && host_state.node_impl.Env() == env\r\n && host_state.node == AbstractifyCNode(host_state.node_impl.node)\r\n }\r\n\r\n predicate HostInit(host_state:HostState, config:ConcreteConfiguration, id:EndPoint)\r\n {\r\n && host_state.node_impl.Valid()\r\n && host_state.node_impl.node.config == config\r\n && host_state.node_impl.node.config[host_state.node_impl.node.my_index] == id\r\n && NodeInit(host_state.node, \r\n host_state.node_impl.node.my_index as int,\r\n config)\r\n }\r\n\r\n predicate {:opaque} HostNext(host_state:HostState, host_state':HostState, ios:seq>>)\r\n {\r\n && NodeNext(host_state.node, host_state'.node, AbstractifyRawLogToIos(ios))\r\n && OnlySentMarshallableData(ios)\r\n }\r\n\r\n predicate ConcreteConfigInit(config:ConcreteConfiguration)\r\n {\r\n ValidConfig(config)\r\n }\r\n\r\n function ConcreteConfigToServers(config:ConcreteConfiguration) : set\r\n {\r\n MapSeqToSet(config, x=>x)\r\n }\r\n\r\n function ParseCommandLineConfiguration(args:seq>) : ConcreteConfiguration\r\n {\r\n lock_config_parsing(args)\r\n }\r\n \r\n method HostInitImpl(\r\n ghost env:HostEnvironment,\r\n netc:NetClient,\r\n args:seq>\r\n ) returns (\r\n ok:bool,\r\n host_state:HostState\r\n )\r\n {\r\n var my_index;\r\n var node_impl := new NodeImpl();\r\n host_state := CScheduler(AbstractifyCNode(node_impl.node), node_impl);\r\n\r\n var id := EndPoint(netc.MyPublicKey());\r\n var config;\r\n ok, config, my_index := ParseCmdLine(id, args);\r\n if !ok { return; }\r\n assert id in config;\r\n\r\n ok := node_impl.InitNode(config, my_index, netc, env);\r\n \r\n if !ok { return; }\r\n host_state := CScheduler(AbstractifyCNode(node_impl.node), node_impl);\r\n }\r\n \r\n predicate EventsConsistent(recvs:seq, clocks:seq, sends:seq) \r\n {\r\n forall e :: (e in recvs ==> e.LIoOpReceive?) \r\n && (e in clocks ==> e.LIoOpReadClock? || e.LIoOpTimeoutReceive?) \r\n && (e in sends ==> e.LIoOpSend?)\r\n }\r\n\r\n ghost method RemoveRecvs(events:seq) returns (recvs:seq, rest:seq) \r\n ensures forall e :: e in recvs ==> e.LIoOpReceive?;\r\n ensures events == recvs + rest;\r\n ensures rest != [] ==> !rest[0].LIoOpReceive?;\r\n {\r\n recvs := [];\r\n rest := [];\r\n\r\n var i := 0;\r\n while i < |events| \r\n invariant 0 <= i <= |events|;\r\n invariant forall e :: e in recvs ==> e.LIoOpReceive?;\r\n invariant recvs == events[0..i];\r\n {\r\n if !events[i].LIoOpReceive? {\r\n rest := events[i..];\r\n return;\r\n }\r\n recvs := recvs + [events[i]];\r\n i := i + 1;\r\n }\r\n }\r\n\r\n predicate NetEventsReductionCompatible(events:seq)\r\n {\r\n forall i :: 0 <= i < |events| - 1 ==> events[i].LIoOpReceive? || events[i+1].LIoOpSend?\r\n }\r\n\r\n lemma RemainingEventsAreSends(events:seq)\r\n requires NetEventsReductionCompatible(events);\r\n requires |events| > 0;\r\n requires !events[0].LIoOpReceive?;\r\n ensures forall e :: e in events[1..] ==> e.LIoOpSend?;\r\n {\r\n if |events| == 1 {\r\n } else {\r\n assert events[1].LIoOpSend?;\r\n RemainingEventsAreSends(events[1..]);\r\n }\r\n }\r\n\r\n ghost method PartitionEvents(events:seq) returns (recvs:seq, clocks:seq, sends:seq)\r\n requires NetEventsReductionCompatible(events);\r\n ensures events == recvs + clocks + sends;\r\n ensures EventsConsistent(recvs, clocks, sends);\r\n ensures |clocks| <= 1;\r\n {\r\n var rest;\r\n recvs, rest := RemoveRecvs(events);\r\n assert events[|recvs|..] == rest;\r\n if |rest| > 0 && (rest[0].LIoOpReadClock? || rest[0].LIoOpTimeoutReceive?) {\r\n clocks := [rest[0]];\r\n sends := rest[1..];\r\n RemainingEventsAreSends(rest);\r\n } else {\r\n clocks := [];\r\n sends := rest;\r\n if |rest| > 0 {\r\n RemainingEventsAreSends(rest);\r\n }\r\n }\r\n }\r\n\r\n lemma NetEventsRespectReduction(s:Node, s':Node, ios:seq, events:seq)\r\n requires LIoOpSeqCompatibleWithReduction(ios);\r\n requires AbstractifyRawLogToIos(events) == ios;\r\n ensures NetEventsReductionCompatible(events);\r\n {\r\n //reveal_AbstractifyRawLogToIos();\r\n assert AbstractifyRawLogToIos(events) == ios;\r\n forall i | 0 <= i < |events| - 1 \r\n ensures events[i].LIoOpReceive? || events[i+1].LIoOpSend?;\r\n {\r\n assert AbstractifyRawLogToIos(events)[i] == ios[i];\r\n assert AbstractifyRawLogToIos(events)[i+1] == ios[i+1];\r\n }\r\n }\r\n\r\n method HostNextImpl(ghost env:HostEnvironment, host_state:HostState) \r\n returns (ok:bool, host_state':HostState, \r\n ghost recvs:seq, ghost clocks:seq, ghost sends:seq, \r\n ghost ios:seq>>)\r\n {\r\n var okay, netEventLog, abstract_ios := host_state.node_impl.HostNextMain();\r\n if okay {\r\n NetEventsRespectReduction(host_state.node, AbstractifyCNode(host_state.node_impl.node), abstract_ios, netEventLog);\r\n recvs, clocks, sends := PartitionEvents(netEventLog);\r\n ios := recvs + clocks + sends; \r\n assert ios == netEventLog;\r\n host_state' := CScheduler(AbstractifyCNode(host_state.node_impl.node), host_state.node_impl);\r\n } else {\r\n recvs := [];\r\n clocks := [];\r\n sends := [];\r\n host_state' := host_state;\r\n }\r\n ok := okay;\r\n reveal_HostNext();\r\n }\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Lock/Message.i.dfy", "content": "include \"../../Protocol/Lock/Types.i.dfy\"\r\n\r\nmodule Message_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened Environment_s\r\nimport opened Types_i\r\n\r\ndatatype CMessage = CTransfer(transfer_epoch:uint64) | CLocked(locked_epoch:uint64) | CInvalid\r\n\r\nfunction AbstractifyCMessage(cmsg:CMessage) : LockMessage\r\n{\r\n match cmsg {\r\n case CTransfer(epoch) => Transfer(epoch as int)\r\n case CLocked(epoch) => Locked(epoch as int)\r\n case CInvalid => Invalid()\r\n }\r\n}\r\n\r\ntype CLockPacket = LPacket\r\n\r\nfunction AbstractifyCLockPacket(p:CLockPacket) : LockPacket\r\n{\r\n LPacket(p.dst, p.src, AbstractifyCMessage(p.msg))\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Lock/NetLock.i.dfy", "content": "include \"../Common/NetClient.i.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\n\r\nmodule NetLock_i {\r\nimport opened Native__Io_s\r\nimport opened Logic__Option_i\r\nimport opened Environment_s\r\nimport opened Types_i\r\nimport opened Message_i\r\nimport opened Common__Util_i\r\nimport opened Common__NetClient_i\r\nimport opened Common__GenericMarshalling_i\r\nimport opened PacketParsing_i \r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// These functions relate IO events with bytes to those with LockMessages\r\n// \r\n\r\nfunction AstractifyNetEventToLockIo(evt:NetEvent) : LockIo\r\n{\r\n match evt\r\n case LIoOpSend(s) => LIoOpSend(AbstractifyNetPacket(s))\r\n case LIoOpReceive(r) => LIoOpReceive(AbstractifyNetPacket(r))\r\n case LIoOpTimeoutReceive => LIoOpTimeoutReceive()\r\n case LIoOpReadClock(t) => LIoOpReadClock(t as int)\r\n}\r\n\r\nfunction {:opaque} AbstractifyRawLogToIos(rawlog:seq) : seq\r\n ensures |AbstractifyRawLogToIos(rawlog)| == |rawlog|;\r\n ensures forall i {:trigger AstractifyNetEventToLockIo(rawlog[i])} \r\n {:trigger AbstractifyRawLogToIos(rawlog)[i]} :: \r\n 0 <= i < |rawlog| ==> AbstractifyRawLogToIos(rawlog)[i] == AstractifyNetEventToLockIo(rawlog[i]);\r\n{\r\n if (rawlog==[]) then [] else [AstractifyNetEventToLockIo(rawlog[0])] + AbstractifyRawLogToIos(rawlog[1..])\r\n}\r\n\r\nlemma lemma_EstablishAbstractifyRawLogToIos(rawlog:seq, ios:seq)\r\n requires |rawlog| == |ios|;\r\n requires forall i :: 0<=i<|rawlog| ==> ios[i] == AstractifyNetEventToLockIo(rawlog[i]);\r\n ensures AbstractifyRawLogToIos(rawlog) == ios;\r\n{\r\n reveal_AbstractifyRawLogToIos();\r\n}\r\n\r\npredicate OnlySentMarshallableData(rawlog:seq)\r\n{\r\n forall io :: io in rawlog && io.LIoOpSend? ==> \r\n NetPacketBound(io.s.msg) && Demarshallable(io.s.msg, CMessageGrammar())\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// These methods wrap the raw NetClient interface\r\n//\r\n\r\ndatatype ReceiveResult = RRFail() | RRTimeout() | RRPacket(cpacket:CLockPacket)\r\n\r\nmethod Receive(netClient:NetClient, localAddr:EndPoint) \r\n returns (rr:ReceiveResult, ghost netEvent:NetEvent)\r\n requires NetClientIsValid(netClient);\r\n requires EndPoint(netClient.MyPublicKey()) == localAddr;\r\n modifies NetClientRepr(netClient);\r\n ensures netClient.env == old(netClient.env);\r\n ensures netClient.MyPublicKey() == old(netClient.MyPublicKey());\r\n ensures NetClientOk(netClient) <==> !rr.RRFail?;\r\n ensures old(NetClientRepr(netClient)) == NetClientRepr(netClient);\r\n ensures !rr.RRFail? ==>\r\n netClient.IsOpen()\r\n && old(netClient.env.net.history()) + [netEvent] == netClient.env.net.history();\r\n ensures rr.RRTimeout? ==> netEvent.LIoOpTimeoutReceive?;\r\n ensures rr.RRPacket? ==>\r\n netEvent.LIoOpReceive?\r\n && EndPointIsValidPublicKey(rr.cpacket.src)\r\n && AbstractifyCLockPacket(rr.cpacket) == AbstractifyNetPacket(netEvent.r)\r\n && rr.cpacket.msg == DemarshallData(netEvent.r.msg)\r\n{\r\n var timeout := 0;\r\n ghost var old_net_history := netClient.env.net.history();\r\n var ok, timedOut, remote, buffer := netClient.Receive(timeout);\r\n\r\n if (!ok) {\r\n rr := RRFail();\r\n return;\r\n }\r\n\r\n if (timedOut) {\r\n rr := RRTimeout();\r\n netEvent := LIoOpTimeoutReceive(); \r\n return;\r\n }\r\n\r\n var remoteEp:EndPoint := EndPoint(remote);\r\n netEvent := LIoOpReceive(LPacket(EndPoint(netClient.MyPublicKey()), remoteEp, buffer[..]));\r\n\r\n var cmessage := DemarshallDataMethod(buffer);\r\n var cpacket := LPacket(localAddr, remoteEp, cmessage);\r\n rr := RRPacket(cpacket);\r\n}\r\n\r\npredicate SendLogEntryReflectsPacket(event:NetEvent, cpacket:CLockPacket)\r\n{\r\n event.LIoOpSend?\r\n && AbstractifyCLockPacket(cpacket) == AbstractifyNetPacket(event.s)\r\n}\r\n\r\npredicate SendLogReflectsPacket(netEventLog:seq, packet:Option)\r\n{\r\n match packet {\r\n case Some(p) => |netEventLog| == 1 && SendLogEntryReflectsPacket(netEventLog[0], p)\r\n case None => netEventLog == []\r\n }\r\n}\r\n\r\nmethod SendPacket(netClient:NetClient, opt_packet:Option, ghost localAddr:EndPoint) returns (ok:bool, ghost netEventLog:seq)\r\n requires NetClientIsValid(netClient);\r\n requires EndPoint(netClient.MyPublicKey()) == localAddr;\r\n requires OptionCLockPacketValid(opt_packet);\r\n requires opt_packet.Some? ==> opt_packet.v.src == localAddr;\r\n modifies NetClientRepr(netClient);\r\n ensures old(NetClientRepr(netClient)) == NetClientRepr(netClient);\r\n ensures netClient.env == old(netClient.env);\r\n ensures netClient.MyPublicKey() == old(netClient.MyPublicKey());\r\n ensures NetClientOk(netClient) <==> ok;\r\n ensures ok ==> ( NetClientIsValid(netClient)\r\n && netClient.IsOpen()\r\n && old(netClient.env.net.history()) + netEventLog == netClient.env.net.history()\r\n && OnlySentMarshallableData(netEventLog)\r\n && SendLogReflectsPacket(netEventLog, opt_packet));\r\n{\r\n netEventLog := [];\r\n ok := true;\r\n\r\n if opt_packet.None? {\r\n\r\n } else {\r\n var cpacket := opt_packet.v;\r\n\r\n // Construct the remote address\r\n var dstEp:EndPoint := cpacket.dst;\r\n\r\n // Marshall the message\r\n var buffer := MarshallLockMessage(cpacket.msg);\r\n\r\n // Send the packet off\r\n ok := netClient.Send(dstEp.public_key, buffer);\r\n if (!ok) { return; }\r\n\r\n ghost var netEvent := LIoOpSend(LPacket(dstEp, EndPoint(netClient.MyPublicKey()), buffer[..]));\r\n netEventLog := [netEvent];\r\n }\r\n}\r\n\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Lock/Node.i.dfy", "content": "include \"../../Protocol/Lock/Node.i.dfy\"\r\ninclude \"Message.i.dfy\"\r\ninclude \"../Common/NetClient.i.dfy\"\r\ninclude \"../../Common/Logic/Option.i.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\ninclude \"../Common/SeqIsUniqueDef.i.dfy\"\r\n\r\nmodule Impl_Node_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Environment_s\r\nimport opened Protocol_Node_i\r\nimport opened Types_i\r\nimport opened Message_i\r\nimport opened Common__NetClient_i\r\nimport opened Logic__Option_i\r\nimport opened PacketParsing_i \r\nimport opened Common__SeqIsUniqueDef_i\r\n\r\ndatatype CNode = CNode(held:bool, epoch:uint64, my_index:uint64, config:Config)\r\n\r\npredicate ValidConfig(c:Config)\r\n{\r\n 0 < |c| < 0x1_0000_0000_0000_0000\r\n && (forall e :: e in c ==> EndPointIsValidPublicKey(e))\r\n && SeqIsUnique(c)\r\n}\r\n\r\npredicate ValidConfigIndex(c:Config, index:uint64)\r\n{\r\n 0 <= index as int < |c|\r\n}\r\n\r\npredicate CNodeValid(c:CNode)\r\n{\r\n ValidConfig(c.config)\r\n && ValidConfigIndex(c.config, c.my_index)\r\n}\r\n\r\nfunction AbstractifyCNode(n:CNode) : Node\r\n{\r\n Node(n.held, n.epoch as int, n.my_index as int, n.config)\r\n}\r\n\r\nmethod NodeInitImpl(my_index:uint64, config:Config) returns (node:CNode)\r\n requires 0 < |config| < 0x1_0000_0000_0000_0000;\r\n requires 0 <= my_index as int < |config|;\r\n requires ValidConfig(config);\r\n ensures CNodeValid(node);\r\n ensures NodeInit(AbstractifyCNode(node), my_index as int, config);\r\n ensures node.my_index == my_index;\r\n ensures node.config == config;\r\n{\r\n node := CNode(my_index == 0, if my_index == 0 then 1 else 0, my_index, config);\r\n if node.held {\r\n print \"I start holding the lock\\n\";\r\n }\r\n}\r\n\r\nmethod NodeGrantImpl(s:CNode) returns (s':CNode, packet:Option, ghost ios:seq)\r\n requires CNodeValid(s);\r\n ensures NodeGrant(AbstractifyCNode(s), AbstractifyCNode(s'), ios);\r\n ensures s'.my_index == s.my_index && s'.config == s.config;\r\n ensures |ios| == 0 || |ios| == 1;\r\n ensures packet.Some? ==> |ios| == 1 && ios[0].LIoOpSend? \r\n && ios[0].s == AbstractifyCLockPacket(packet.v);\r\n ensures OptionCLockPacketValid(packet) \r\n && (packet.Some? ==> packet.v.src == s.config[s.my_index]); \r\n ensures packet.None? ==> ios == [] && s' == s;\r\n ensures CNodeValid(s');\r\n{\r\n if s.held && s.epoch < 0xFFFF_FFFF_FFFF_FFFF {\r\n var ssss := CNode(false, s.epoch, s.my_index, s.config);\r\n s' := ssss;\r\n var dst_index := (s.my_index + 1) % (|s.config| as uint64);\r\n packet := Some(LPacket(s.config[dst_index], s.config[s.my_index], CTransfer(s.epoch + 1)));\r\n ios := [LIoOpSend(AbstractifyCLockPacket(packet.v))];\r\n print \"I grant the lock \", s.epoch, \"\\n\";\r\n } else {\r\n s' := s;\r\n ios := [];\r\n packet := None();\r\n }\r\n}\r\n\r\nmethod NodeAcceptImpl(s:CNode, transfer_packet:CLockPacket) \r\n returns (s':CNode, locked_packet:Option, ghost ios:seq)\r\n requires CNodeValid(s);\r\n ensures NodeAccept(AbstractifyCNode(s), AbstractifyCNode(s'), ios);\r\n ensures s'.my_index == s.my_index && s'.config == s.config;\r\n ensures |ios| == 1 || |ios| == 2;\r\n ensures locked_packet.None? ==> |ios| == 1 && ios[0].LIoOpReceive? \r\n && ios[0].r == AbstractifyCLockPacket(transfer_packet);\r\n ensures locked_packet.Some? ==> |ios| == 2 \r\n && ios == [LIoOpReceive(AbstractifyCLockPacket(transfer_packet)), \r\n LIoOpSend(AbstractifyCLockPacket(locked_packet.v))];\r\n ensures OptionCLockPacketValid(locked_packet) \r\n && (locked_packet.Some? ==> locked_packet.v.src == s.config[s.my_index]); \r\n ensures CNodeValid(s');\r\n{\r\n ios := [LIoOpReceive(AbstractifyCLockPacket(transfer_packet))];\r\n\r\n if !s.held \r\n && transfer_packet.src in s.config\r\n && transfer_packet.msg.CTransfer? \r\n && transfer_packet.msg.transfer_epoch > s.epoch {\r\n var ssss := CNode(true, transfer_packet.msg.transfer_epoch, s.my_index, s.config);\r\n s' := ssss;\r\n locked_packet := Some(LPacket(transfer_packet.src, \r\n s.config[s.my_index],\r\n CLocked(transfer_packet.msg.transfer_epoch)));\r\n ios := ios + [LIoOpSend(AbstractifyCLockPacket(locked_packet.v))];\r\n print \"I hold the lock!\\n\";\r\n } else {\r\n s' := s;\r\n locked_packet := None();\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Lock/NodeImpl.i.dfy", "content": "include \"Node.i.dfy\"\r\ninclude \"NetLock.i.dfy\"\r\n\r\nmodule NodeImpl_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened Environment_s\r\nimport opened Types_i\r\nimport opened Message_i\r\nimport opened Impl_Node_i\r\nimport opened NetLock_i\r\nimport opened Protocol_Node_i\r\nimport opened Common__Util_i\r\nimport opened Common__NetClient_i\r\n\r\nclass NodeImpl\r\n{\r\n var node:CNode;\r\n var netClient:NetClient?;\r\n var localAddr:EndPoint;\r\n\r\n ghost var Repr : set;\r\n\r\n constructor () {\r\n netClient := null;\r\n }\r\n\r\n predicate Valid()\r\n reads this;\r\n reads NetClientIsValid.reads(netClient);\r\n {\r\n CNodeValid(node)\r\n && NetClientIsValid(netClient)\r\n && EndPoint(netClient.MyPublicKey()) == localAddr\r\n && localAddr == node.config[node.my_index]\r\n && Repr == { this } + NetClientRepr(netClient)\r\n }\r\n \r\n function Env() : HostEnvironment?\r\n reads this, NetClientIsValid.reads(netClient);\r\n {\r\n if netClient!=null then netClient.env else null\r\n }\r\n\r\n method InitNode(config:Config, my_index:uint64, nc:NetClient, ghost env_:HostEnvironment) returns (ok:bool)\r\n requires env_.Valid() && env_.ok.ok()\r\n requires ValidConfig(config) && ValidConfigIndex(config, my_index)\r\n requires NetClientIsValid(nc)\r\n requires EndPoint(nc.MyPublicKey()) == config[my_index]\r\n requires nc.env == env_\r\n modifies this\r\n ensures ok ==>\r\n Valid()\r\n && Env() == env_\r\n && NodeInit(AbstractifyCNode(node), my_index as int, config)\r\n && node.config == config \r\n && node.my_index == my_index\r\n {\r\n netClient := nc;\r\n node := NodeInitImpl(my_index, config);\r\n assert node.my_index == my_index;\r\n localAddr := node.config[my_index];\r\n Repr := { this } + NetClientRepr(netClient);\r\n ok := true;\r\n }\r\n\r\n method NodeNextGrant() returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires Valid();\r\n modifies Repr;\r\n ensures Repr == old(Repr);\r\n ensures ok == NetClientOk(netClient);\r\n ensures Env() == old(Env());\r\n ensures ok ==> (\r\n Valid()\r\n && NodeGrant(old(AbstractifyCNode(node)), AbstractifyCNode(node), ios)\r\n && AbstractifyRawLogToIos(netEventLog) == ios\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(Env().net.history()) + netEventLog == Env().net.history());\r\n {\r\n var transfer_packet;\r\n node, transfer_packet, ios := NodeGrantImpl(node);\r\n ok := true;\r\n\r\n if transfer_packet.Some? {\r\n ghost var sendEventLog;\r\n ok, sendEventLog := SendPacket(netClient, transfer_packet, localAddr); \r\n netEventLog := sendEventLog;\r\n } else {\r\n netEventLog := [];\r\n assert AbstractifyRawLogToIos(netEventLog) == ios;\r\n }\r\n }\r\n\r\n method NodeNextAccept() returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires Valid();\r\n modifies Repr;\r\n ensures Repr == old(Repr);\r\n ensures ok == NetClientOk(netClient);\r\n ensures Env() == old(Env());\r\n ensures ok ==> (\r\n Valid()\r\n && NodeAccept(old(AbstractifyCNode(node)), AbstractifyCNode(node), ios)\r\n && AbstractifyRawLogToIos(netEventLog) == ios\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(Env().net.history()) + netEventLog == Env().net.history());\r\n {\r\n var rr;\r\n ghost var receiveEvent;\r\n rr, receiveEvent := Receive(netClient, localAddr);\r\n\r\n netEventLog := [ receiveEvent ];\r\n if (rr.RRFail?) {\r\n ok := false;\r\n return;\r\n } else if (rr.RRTimeout?) {\r\n ok := true;\r\n ios := [ LIoOpTimeoutReceive() ];\r\n return;\r\n } else {\r\n ok := true;\r\n var locked_packet;\r\n node, locked_packet, ios := NodeAcceptImpl(node, rr.cpacket);\r\n\r\n if locked_packet.Some? {\r\n ghost var sendEventLog;\r\n ok, sendEventLog := SendPacket(netClient, locked_packet, localAddr); \r\n netEventLog := netEventLog + sendEventLog;\r\n }\r\n }\r\n }\r\n\r\n\r\n method HostNextMain()\r\n returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires Valid();\r\n modifies Repr;\r\n ensures Repr == old(Repr);\r\n ensures ok <==> Env() != null && Env().Valid() && Env().ok.ok();\r\n ensures Env() == old(Env());\r\n ensures ok ==> (\r\n Valid()\r\n && NodeNext(old(AbstractifyCNode(node)), AbstractifyCNode(node), ios)\r\n && AbstractifyRawLogToIos(netEventLog) == ios\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(Env().net.history()) + netEventLog == Env().net.history()\r\n );\r\n {\r\n if node.held {\r\n ok, netEventLog, ios := NodeNextGrant();\r\n } else {\r\n ok, netEventLog, ios := NodeNextAccept();\r\n }\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/Lock/PacketParsing.i.dfy", "content": "include \"../Common/GenericMarshalling.i.dfy\"\r\ninclude \"../Common/NetClient.i.dfy\"\r\ninclude \"Message.i.dfy\"\r\n\r\nmodule PacketParsing_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened Logic__Option_i\r\nimport opened Environment_s\r\nimport opened Common__GenericMarshalling_i\r\nimport opened Common__NetClient_i\r\nimport opened Types_i\r\nimport opened Message_i\r\n\r\npredicate NetPacketBound(data:seq) \r\n{\r\n |data| < MaxPacketSize()\r\n}\r\n\r\n////////////////////////////////////////////////////////////////////\r\n// Grammars for the Lock messages\r\n////////////////////////////////////////////////////////////////////\r\n\r\nfunction method CMessageTransferGrammar() : G { GUint64 }\r\nfunction method CMessageLockedGrammar() : G { GUint64 }\r\n\r\nfunction method CMessageGrammar() : G \r\n{ \r\n GTaggedUnion([CMessageTransferGrammar(), CMessageLockedGrammar()])\r\n}\r\n\r\n////////////////////////////////////////////////////////////////////\r\n// Parsing\r\n////////////////////////////////////////////////////////////////////\r\n\r\nfunction method ParseCMessageTransfer(val:V) : CMessage\r\n requires ValInGrammar(val, CMessageTransferGrammar());\r\n{\r\n CTransfer(val.u)\r\n}\r\n\r\nfunction method ParseCMessageLocked(val:V) : CMessage\r\n requires ValInGrammar(val, CMessageLockedGrammar());\r\n{\r\n CLocked(val.u)\r\n}\r\n\r\nfunction method ParseCMessage(val:V) : CMessage\r\n requires ValInGrammar(val, CMessageGrammar());\r\n{\r\n if val.c == 0 then\r\n ParseCMessageTransfer(val.val)\r\n else\r\n ParseCMessageLocked(val.val)\r\n}\r\n\r\nfunction DemarshallData(data:seq) : CMessage\r\n{\r\n if Demarshallable(data, CMessageGrammar()) then\r\n var val := DemarshallFunc(data, CMessageGrammar());\r\n ParseCMessage(val)\r\n else\r\n CInvalid()\r\n}\r\n\r\nmethod DemarshallDataMethod(data:array) returns (msg:CMessage)\r\n requires data.Length < 0x1_0000_0000_0000_0000;\r\n ensures msg == DemarshallData(data[..]);\r\n// ensures if Demarshallable(data[..], msg_grammar) then \r\n// msg == PaxosDemarshallData(data[..]) \r\n// else msg.CMessage_Invalid?;\r\n// ensures CMessageIs64Bit(msg);\r\n{\r\n var success, val := Demarshall(data, CMessageGrammar());\r\n if success {\r\n //assert ValInGrammar(val, msg_grammar);\r\n msg := ParseCMessage(val);\r\n assert !msg.CInvalid?;\r\n } else {\r\n msg := CInvalid();\r\n }\r\n}\r\n\r\n\r\n\r\n////////////////////////////////////////////////////////////////////\r\n// Marshalling\r\n////////////////////////////////////////////////////////////////////\r\n\r\nmethod MarshallMessageTransfer(c:CMessage) returns (val:V)\r\n requires c.CTransfer?;\r\n ensures ValInGrammar(val, CMessageTransferGrammar());\r\n ensures ValidVal(val);\r\n ensures ParseCMessageTransfer(val) == c;\r\n ensures SizeOfV(val) < MaxPacketSize();\r\n{\r\n val := VUint64(c.transfer_epoch);\r\n}\r\n\r\nmethod MarshallMessageLocked(c:CMessage) returns (val:V)\r\n requires c.CLocked?;\r\n ensures ValInGrammar(val, CMessageLockedGrammar());\r\n ensures ValidVal(val);\r\n ensures ParseCMessageLocked(val) == c;\r\n ensures SizeOfV(val) < MaxPacketSize();\r\n{\r\n val := VUint64(c.locked_epoch);\r\n}\r\n\r\nmethod MarshallMessage(c:CMessage) returns (val:V)\r\n requires !c.CInvalid?;\r\n ensures ValInGrammar(val, CMessageGrammar());\r\n ensures ValidVal(val);\r\n ensures ParseCMessage(val) == c;\r\n ensures SizeOfV(val) < MaxPacketSize();\r\n{\r\n if c.CTransfer? {\r\n var msg := MarshallMessageTransfer(c);\r\n val := VCase(0, msg);\r\n } else if c.CLocked? {\r\n var msg := MarshallMessageLocked(c);\r\n val := VCase(1, msg);\r\n } else {\r\n assert false; // Provably will not reach here\r\n }\r\n}\r\n\r\nmethod MarshallLockMessage(msg:CMessage) returns (data:array)\r\n requires !msg.CInvalid?;\r\n ensures fresh(data);\r\n ensures NetPacketBound(data[..]);\r\n ensures DemarshallData(data[..]) == msg;\r\n{\r\n var val := MarshallMessage(msg);\r\n data := Marshall(val, CMessageGrammar());\r\n}\r\n\r\n////////////////////////////////////////////////////////////////////\r\n// Packet translation \r\n////////////////////////////////////////////////////////////////////\r\n\r\nfunction AbstractifyNetPacket(net:NetPacket) : LockPacket\r\n{\r\n LPacket(net.dst, net.src, AbstractifyCMessage(DemarshallData(net.msg)))\r\n}\r\n\r\npredicate CLockPacketValid(p:CLockPacket)\r\n{\r\n EndPointIsValidPublicKey(p.src)\r\n && EndPointIsValidPublicKey(p.dst)\r\n && !p.msg.CInvalid?\r\n}\r\n\r\npredicate OptionCLockPacketValid(opt_packet:Option)\r\n{\r\n opt_packet.Some? ==> CLockPacketValid(opt_packet.v)\r\n}\r\n\r\n}\r\n\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/AcceptorModel.i.dfy", "content": "include \"AcceptorState.i.dfy\"\r\ninclude \"Broadcast.i.dfy\"\r\ninclude \"../Common/Util.i.dfy\"\r\n\r\nmodule LiveRSL__AcceptorModel_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__Acceptor_i\r\nimport opened LiveRSL__AcceptorState_i\r\nimport opened LiveRSL__CLastCheckpointedMap_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__ParametersState_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Impl__LiveRSL__Broadcast_i\r\nimport opened Collections__Maps_i\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Sets_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__UpperBound_s\r\nimport opened Common__UpperBound_i\r\nimport opened Common__Util_i\r\nimport opened Environment_s\r\n\r\nmethod CreateSeq(len:int, init_int:uint64) returns (s:seq)\r\n requires len >= 0\r\n ensures |s| == len && forall i :: 0 <= i < |s| ==> s[i] == COperationNumber(init_int)\r\n{\r\n if len == 0 {\r\n s := [];\r\n } else { \r\n var rest := CreateSeq(len - 1, init_int);\r\n s := [COperationNumber(init_int)] + rest; \r\n }\r\n}\r\n\r\nmethod DummyInitLastCheckpointedOperation(config:CPaxosConfiguration) returns (ilco:CLastCheckpointedMap)\r\n requires CPaxosConfigurationIsValid(config)\r\n requires CPaxosConfigurationIsAbstractable(config)\r\n ensures CLastCheckpointedMapIsAbstractable(ilco)\r\n ensures LMinQuorumSize(AbstractifyCPaxosConfigurationToConfiguration(config)) <= |ilco|\r\n ensures |config.replica_ids| == |ilco|\r\n ensures forall i :: 0 <= i < |ilco| ==> ilco[i] == COperationNumber(0)\r\n{\r\n ilco := CreateSeq(|config.replica_ids|, 0);\r\n ghost var rlco := AbstractifyCLastCheckpointedMapToOperationNumberSequence(ilco); // TRIGGER\r\n reveal AbstractifyCLastCheckpointedMapToOperationNumberSequence();\r\n}\r\n\r\nmethod {:timeLimitMultiplier 2} InitAcceptorState(rcs:ReplicaConstantsState) returns (acceptor:AcceptorState)\r\n requires ReplicaConstantsState_IsValid(rcs)\r\n ensures NextAcceptorState_InitPostconditions(acceptor, rcs)\r\n{\r\n reveal AbstractifyCVotesToVotes();\r\n\r\n var max_ballot := CBallot(0, 0);\r\n var votes := CVotes(map []);\r\n var last_checkpointed_operation := DummyInitLastCheckpointedOperation(rcs.all.config);\r\n var log_truncation_point := COperationNumber(0);\r\n var min_voted_opn := COperationNumber(0);\r\n acceptor := AcceptorState(\r\n rcs, max_ballot, votes, last_checkpointed_operation, log_truncation_point, min_voted_opn);\r\n assert LAcceptorInit(AbstractifyAcceptorStateToAcceptor(acceptor), AbstractifyReplicaConstantsStateToLReplicaConstants(rcs));\r\n}\r\n\r\nmethod NextAcceptorState_Phase1(acceptor:AcceptorState, in_msg:CMessage, sender:EndPoint) returns (acceptor':AcceptorState, packets_sent:CBroadcast)\r\n requires NextAcceptorState_Phase1Preconditions(acceptor, in_msg, sender)\r\n ensures NextAcceptorState_Phase1Postconditions(acceptor, acceptor', in_msg, sender, packets_sent)\r\n{\r\n //print(\"NextAcceptorState_Phase1: Responding to an 1a message\\n\");\r\n packets_sent := CBroadcastNop;\r\n var ballot := in_msg.bal_1a;\r\n lemma_AbstractifyEndPointsToNodeIdentities_properties(acceptor.constants.all.config.replica_ids);\r\n\r\n // if the ballot is not greater\r\n if (!CBallotIsLessThan(acceptor.maxBallot, ballot)) {\r\n //print(\"NextAcceptorState_Phase1: Ignoring the 1a message because I'm in \", acceptor.maxBallot.seqno, acceptor.maxBallot.proposer_id, \" but the ballot is \", ballot.seqno, ballot.proposer_id, \"\\n\");\r\n acceptor' := acceptor;\r\n return;\r\n }\r\n if (sender !in acceptor.constants.all.config.replica_ids) {\r\n //print(\"NextAcceptorState_Phase1: Ignoring the 1a message because it's from a non-replica \", sender.addr, sender.port, \"\\n\");\r\n acceptor' := acceptor;\r\n return;\r\n }\r\n //print(\"NextAcceptorState_Phase1: Sending a 1b message for ballot \", ballot, \"\\n\");\r\n var outMsg := CMessage_1b(ballot, acceptor.log_truncation_point, acceptor.votes);\r\n packets_sent := CBroadcast(acceptor.constants.all.config.replica_ids[acceptor.constants.my_index], \r\n [sender], outMsg);\r\n\r\n acceptor' := acceptor.(maxBallot := ballot);\r\n\r\n ghost var r_packet := AbstractifyCMessageToRslPacket(acceptor.constants.all.config.replica_ids[acceptor.constants.my_index], sender, in_msg);\r\n ghost var r_constants := AbstractifyReplicaConstantsStateToLReplicaConstants(acceptor.constants);\r\n ghost var dsts := [acceptor.constants.all.config.replica_ids[acceptor.constants.my_index]];\r\n calc {\r\n AbstractifyCBroadcastToRlsPacketSeq(packets_sent);\r\n [ LPacket(AbstractifyEndPointToNodeIdentity(sender), AbstractifyEndPointsToNodeIdentities(dsts)[0], AbstractifyCMessageToRslMessage(outMsg)) ];\r\n [ LPacket(AbstractifyEndPointToNodeIdentity(sender), AbstractifyEndPointToNodeIdentity(acceptor.constants.all.config.replica_ids[acceptor.constants.my_index]), AbstractifyCMessageToRslMessage(outMsg)) ];\r\n [ LPacket(r_packet.src, r_constants.all.config.replica_ids[r_constants.my_index], AbstractifyCMessageToRslMessage(outMsg)) ];\r\n [ LPacket(r_packet.src, r_constants.all.config.replica_ids[r_constants.my_index], RslMessage_1b(r_packet.msg.bal_1a, AbstractifyCOperationNumberToOperationNumber(acceptor.log_truncation_point), AbstractifyCVotesToVotes(acceptor.votes))) ];\r\n }\r\n\r\n assert NextAcceptorState_Phase1Postconditions(acceptor, acceptor', in_msg, sender, packets_sent);\r\n}\r\n\r\nlemma lemma_AcceptorVotesSizeIsBoundedByLogLength(\r\n votes:CVotes,\r\n log_truncation_point:COperationNumber,\r\n params:ParametersState\r\n )\r\n requires params.max_log_length > 0\r\n requires forall opn :: opn in votes.v ==>\r\n AbstractifyCOperationNumberToOperationNumber(log_truncation_point)\r\n <= AbstractifyCOperationNumberToOperationNumber(opn)\r\n <= UpperBoundedAddition(AbstractifyCOperationNumberToOperationNumber(log_truncation_point),\r\n (params.max_log_length-1) as int,\r\n UpperBoundFinite(params.max_integer_val as int))\r\n ensures |votes.v| <= params.max_log_length as int\r\n{\r\n var copns := mapdomain(votes.v);\r\n var opns := AbstractifyCOperationNumbersToOperationNumbers(copns);\r\n lemma_AbstractifyCOperationNumbersToOperationNumbers_maintainsSize(copns);\r\n lemma_CardinalityOfBoundedSet(opns, AbstractifyCOperationNumberToOperationNumber(log_truncation_point), AbstractifyCOperationNumberToOperationNumber(log_truncation_point) + (params.max_log_length as int));\r\n lemma_MapSizeIsDomainSize(mapdomain(votes.v), votes.v);\r\n}\r\n\r\n\r\nmethod AddVoteAndRemoveOldOnesImpl(acceptor:AcceptorState, votes:CVotes, new_opn:COperationNumber, new_vote:CVote, newLogTruncationPoint:COperationNumber, minVotedOpn:COperationNumber,\r\n ghost oldLogTruncationPoint:COperationNumber, ghost params:ParametersState) returns (votes':CVotes, newMinVotedOpn:COperationNumber)\r\n requires CVotesIsAbstractable(votes)\r\n requires COperationNumberIsAbstractable(new_opn)\r\n requires CVoteIsAbstractable(new_vote)\r\n requires COperationNumberIsAbstractable(newLogTruncationPoint)\r\n requires newLogTruncationPoint.n <= params.max_integer_val\r\n requires new_opn.n <= params.max_integer_val\r\n requires newLogTruncationPoint.n <= new_opn.n\r\n requires params.max_integer_val > params.max_log_length > 0\r\n requires newLogTruncationPoint.n >= oldLogTruncationPoint.n\r\n requires params.max_log_length as int < max_votes_len()\r\n requires AbstractifyCOperationNumberToOperationNumber(new_opn) <= AbstractifyCOperationNumberToOperationNumber(newLogTruncationPoint) + ((params.max_log_length-1) as int)\r\n requires forall opn :: opn in votes.v ==>\r\n AbstractifyCOperationNumberToOperationNumber(oldLogTruncationPoint)\r\n <= AbstractifyCOperationNumberToOperationNumber(opn)\r\n <= UpperBoundedAddition(AbstractifyCOperationNumberToOperationNumber(oldLogTruncationPoint),\r\n (params.max_log_length-1) as int,\r\n UpperBoundFinite(params.max_integer_val as int))\r\n requires ValidVotes(votes)\r\n requires ValidVote(new_vote)\r\n requires AcceptorIsValid(acceptor)\r\n requires votes == acceptor.votes\r\n requires minVotedOpn == acceptor.minVotedOpn\r\n ensures forall opn :: opn in votes'.v ==>\r\n AbstractifyCOperationNumberToOperationNumber(newLogTruncationPoint)\r\n <= AbstractifyCOperationNumberToOperationNumber(opn)\r\n <= UpperBoundedAddition(AbstractifyCOperationNumberToOperationNumber(newLogTruncationPoint),\r\n (params.max_log_length-1) as int,\r\n UpperBoundFinite(params.max_integer_val as int))\r\n ensures CVotesIsAbstractable(votes')\r\n ensures ValidVotes(votes')\r\n ensures LAddVoteAndRemoveOldOnes(AbstractifyCVotesToVotes(votes), AbstractifyCVotesToVotes(votes'), AbstractifyCOperationNumberToOperationNumber(new_opn), AbstractifyCVoteToVote(new_vote), AbstractifyCOperationNumberToOperationNumber(newLogTruncationPoint))\r\n ensures forall v :: v in votes'.v ==> v.n >= newMinVotedOpn.n\r\n{\r\n reveal AbstractifyCVotesToVotes();\r\n\r\n var updated_votes := votes.v[new_opn := new_vote];\r\n var new_votes;\r\n if (newLogTruncationPoint.n > minVotedOpn.n) {\r\n //print(\"Creating new table, going to \",newLogTruncationPoint.n,\" up from \",minVotedOpn.n,\"\\n\");\r\n new_votes := (map op | op in updated_votes && op.n >= newLogTruncationPoint.n :: updated_votes[op]);\r\n newMinVotedOpn := newLogTruncationPoint;\r\n } else {\r\n new_votes := updated_votes;\r\n if( new_opn.n < minVotedOpn.n) {\r\n newMinVotedOpn := new_opn;\r\n } else {\r\n newMinVotedOpn := minVotedOpn;\r\n }\r\n }\r\n votes' := CVotes(new_votes);\r\n lemma_MapSizeIsDomainSize(domain(updated_votes), updated_votes);\r\n lemma_MapSizeIsDomainSize(domain(new_votes), new_votes);\r\n SubsetCardinality(domain(new_votes),domain(votes'.v));\r\n\r\n forall opn | opn in votes'.v\r\n ensures AbstractifyCOperationNumberToOperationNumber(newLogTruncationPoint)\r\n <= AbstractifyCOperationNumberToOperationNumber(opn)\r\n <= UpperBoundedAddition(AbstractifyCOperationNumberToOperationNumber(newLogTruncationPoint),\r\n (params.max_log_length-1) as int,\r\n UpperBoundFinite(params.max_integer_val as int))\r\n {\r\n if opn == new_opn {\r\n assert AbstractifyCOperationNumberToOperationNumber(opn)\r\n <= UpperBoundedAddition(AbstractifyCOperationNumberToOperationNumber(newLogTruncationPoint),\r\n (params.max_log_length-1) as int,\r\n UpperBoundFinite(params.max_integer_val as int));\r\n }\r\n }\r\n\r\n lemma_AcceptorVotesSizeIsBoundedByLogLength(votes', newLogTruncationPoint, params);\r\n assert |votes'.v| < 0x1_0000_0000;\r\n}\r\n\r\nmethod {:timeLimitMultiplier 2} NextAcceptorState_Phase2(acceptor:AcceptorState, in_msg:CMessage, sender:EndPoint) returns (acceptor':AcceptorState, packets_sent:CBroadcast)\r\n requires NextAcceptorState_Phase2Preconditions(acceptor, in_msg, sender)\r\n ensures NextAcceptorState_Phase2Postconditions(acceptor, acceptor', in_msg, sender, packets_sent)\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n// reveal AbstractifyCVotesToVotes();\r\n\r\n packets_sent := CBroadcastNop;\r\n acceptor' := acceptor;\r\n\r\n var ballot := in_msg.bal_2a;\r\n\r\n //print(\"Acceptor receiving 2a message about operation\", in_msg.opn_2a.n, \"in ballot\", in_msg.bal_2a, \"\\n\");\r\n\r\n assert acceptor.constants.all.params.max_integer_val > acceptor.constants.all.params.max_log_length > 0;\r\n var maxLogLengthMinus1:uint64 := acceptor.constants.all.params.max_log_length - 1;\r\n var newLogTruncationPoint := acceptor.log_truncation_point;\r\n if in_msg.opn_2a.n >= maxLogLengthMinus1\r\n {\r\n var potentialNewTruncationPoint:uint64 := in_msg.opn_2a.n - maxLogLengthMinus1;\r\n if potentialNewTruncationPoint > acceptor.log_truncation_point.n\r\n {\r\n newLogTruncationPoint := COperationNumber(potentialNewTruncationPoint);\r\n }\r\n }\r\n\r\n assert AbstractifyCOperationNumberToOperationNumber(newLogTruncationPoint) ==\r\n if AbstractifyCOperationNumberToOperationNumber(in_msg.opn_2a) - (acceptor.constants.all.params.max_log_length as int) + 1\r\n > AbstractifyCOperationNumberToOperationNumber(acceptor.log_truncation_point) then\r\n AbstractifyCOperationNumberToOperationNumber(in_msg.opn_2a) - (acceptor.constants.all.params.max_log_length as int) + 1\r\n else\r\n AbstractifyCOperationNumberToOperationNumber(acceptor.log_truncation_point);\r\n\r\n var addition := UpperBoundedAdditionImpl(acceptor.log_truncation_point.n, acceptor.constants.all.params.max_log_length, acceptor.constants.all.params.max_integer_val);\r\n assert AbstractifyCOperationNumberToOperationNumber(in_msg.opn_2a) <= \r\n UpperBoundedAddition(AbstractifyCOperationNumberToOperationNumber(newLogTruncationPoint), \r\n (acceptor.constants.all.params.max_log_length-1) as int,\r\n UpperBoundFinite(acceptor.constants.all.params.max_integer_val as int));\r\n\r\n var opn := in_msg.opn_2a;\r\n var value := in_msg.val_2a;\r\n var newVote := CVote(ballot, value);\r\n\r\n var votes', newMinVotedOpn;\r\n if(acceptor.log_truncation_point.n <= in_msg.opn_2a.n) {\r\n votes', newMinVotedOpn := AddVoteAndRemoveOldOnesImpl(acceptor, acceptor.votes, opn, newVote, newLogTruncationPoint, acceptor.minVotedOpn,\r\n acceptor.log_truncation_point /* ghost */, acceptor.constants.all.params /* ghost */);\r\n } else {\r\n votes' := acceptor.votes;\r\n newMinVotedOpn := acceptor.minVotedOpn;\r\n }\r\n \r\n var outMsg := CMessage_2b(ballot, opn, value);\r\n\r\n acceptor' :=\r\n acceptor.(\r\n votes := votes',\r\n maxBallot := ballot,\r\n log_truncation_point := newLogTruncationPoint,\r\n minVotedOpn := newMinVotedOpn);\r\n\r\n packets_sent := BuildBroadcastToEveryone(acceptor.constants.all.config, acceptor.constants.my_index, outMsg);\r\n assert NextAcceptorState_Phase2Postconditions(acceptor, acceptor', in_msg, sender, packets_sent);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"NextAcceptorState_Phase2\", start_time, end_time);\r\n}\r\n\r\nmethod {:timeLimitMultiplier 1} NextAcceptorState_ProcessHeartbeat(acceptor:AcceptorState, in_msg:CMessage, sender:EndPoint) returns (acceptor':AcceptorState)\r\n requires NextAcceptorState_ProcessHeartbeatPreconditions(acceptor, in_msg, sender)\r\n ensures NextAcceptorState_ProcessHeartbeatPostconditions(acceptor, acceptor', in_msg, sender)\r\n{\r\n acceptor' := acceptor;\r\n lemma_AbstractifyEndPointsToNodeIdentities_properties(acceptor.constants.all.config.replica_ids);\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n var found:bool, index:uint64 := CGetReplicaIndex(sender, acceptor.constants.all.config);\r\n if (!found) {\r\n //print(\"Acceptor ignoring heartbeat from\", sender, \"\\n\");\r\n return;\r\n }\r\n\r\n ///assert AbstractifyEndPointToNodeIdentity(sender) in AbstractifyCLastCheckpointedMapToOperationNumberSequence(acceptor.last_checkpointed_operation);\r\n assert 0 <= index as int < |acceptor.constants.all.config.replica_ids|;\r\n if (in_msg.opn_ckpt.n <= acceptor.last_checkpointed_operation[index].n) {\r\n return;\r\n }\r\n\r\n //print(\"Acceptor updating last checkpointed operation for\", sender, \"to\", in_msg.opn_ckpt.n, \"\\n\");\r\n\r\n var LCO := acceptor.last_checkpointed_operation;\r\n\r\n var newLCO := acceptor.last_checkpointed_operation[index as int := in_msg.opn_ckpt];\r\n\r\n acceptor' := acceptor.(last_checkpointed_operation:= newLCO);\r\n}\r\n\r\nmethod {:timeLimitMultiplier 1} NextAcceptorState_TruncateLog(acceptor:AcceptorState, opn:COperationNumber) returns (acceptor':AcceptorState)\r\n requires NextAcceptorState_TruncateLogPreconditions(acceptor, opn)\r\n ensures NextAcceptorState_TruncateLogPostconditions(acceptor, acceptor', opn)\r\n{\r\n //print(\"Acceptor truncating log to\", opn, \"\\n\");\r\n\r\n if (opn.n > acceptor.log_truncation_point.n) {\r\n assert AbstractifyCOperationNumberToOperationNumber(opn) > AbstractifyCOperationNumberToOperationNumber(acceptor.log_truncation_point);\r\n reveal AbstractifyCVotesToVotes();\r\n var truncatedVotes:map := (map op | op in acceptor.votes.v && op.n >= opn.n :: acceptor.votes.v[op]);\r\n acceptor' := acceptor.(log_truncation_point := opn,\r\n votes := acceptor.votes.(v := truncatedVotes));\r\n lemma_MapSizeIsDomainSize(domain(truncatedVotes), truncatedVotes);\r\n lemma_MapSizeIsDomainSize(domain(acceptor.votes.v), acceptor.votes.v);\r\n SubsetCardinality(domain(truncatedVotes),domain(acceptor.votes.v));\r\n } else {\r\n acceptor' := acceptor;\r\n }\r\n}\r\n\r\nmethod AcceptorModel_GetNthHighestValueAmongReportedCheckpoints(acceptor:AcceptorState, minQuorumSize:uint64) returns (opn:COperationNumber)\r\n requires AcceptorIsValid(acceptor)\r\n requires AcceptorIsAbstractable(acceptor)\r\n requires minQuorumSize > 0\r\n requires minQuorumSize as int <= |acceptor.last_checkpointed_operation|\r\n requires LMinQuorumSize(AbstractifyAcceptorStateToAcceptor(acceptor).constants.all.config) == minQuorumSize as int\r\n ensures IsLogTruncationPointValid(AbstractifyCOperationNumberToOperationNumber(opn), AbstractifyAcceptorStateToAcceptor(acceptor).last_checkpointed_operation, AbstractifyAcceptorStateToAcceptor(acceptor).constants.all.config)\r\n{\r\n opn := ComputeNthHighestValue(acceptor.last_checkpointed_operation, minQuorumSize);\r\n //print(\"Acceptor computes nth highest value as\", opn, \"\\n\");\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/AcceptorState.i.dfy", "content": "include \"../../Protocol/RSL/Acceptor.i.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\ninclude \"ReplicaConstantsState.i.dfy\"\r\ninclude \"CLastCheckpointedMap.i.dfy\"\r\n\r\nmodule LiveRSL__AcceptorState_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__Acceptor_i\r\nimport opened LiveRSL__Broadcast_i\r\nimport opened LiveRSL__CLastCheckpointedMap_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened Common__UpperBound_s\r\n\r\ndatatype AcceptorState = AcceptorState(\r\n constants:ReplicaConstantsState,\r\n maxBallot:CBallot,\r\n votes:CVotes,\r\n last_checkpointed_operation:CLastCheckpointedMap,\r\n log_truncation_point:COperationNumber,\r\n minVotedOpn:COperationNumber\r\n )\r\n\r\npredicate AcceptorIsAbstractable(acceptor:AcceptorState)\r\n{\r\n && ReplicaConstantsStateIsAbstractable(acceptor.constants)\r\n && CBallotIsAbstractable(acceptor.maxBallot)\r\n && CVotesIsAbstractable(acceptor.votes)\r\n && CLastCheckpointedMapIsAbstractable(acceptor.last_checkpointed_operation)\r\n && COperationNumberIsAbstractable(acceptor.log_truncation_point)\r\n && ReplicaConstantsStateIsAbstractable(acceptor.constants)\r\n}\r\n\r\nfunction AbstractifyAcceptorStateToAcceptor(acceptor:AcceptorState) : LAcceptor\r\n requires AcceptorIsAbstractable(acceptor);\r\n{\r\n LAcceptor(\r\n// AbstractifyEndPointToNodeIdentity(acceptor.constants.me),\r\n AbstractifyReplicaConstantsStateToLReplicaConstants(acceptor.constants),\r\n AbstractifyCBallotToBallot(acceptor.maxBallot),\r\n AbstractifyCVotesToVotes(acceptor.votes),\r\n AbstractifyCLastCheckpointedMapToOperationNumberSequence(acceptor.last_checkpointed_operation),\r\n AbstractifyCOperationNumberToOperationNumber(acceptor.log_truncation_point))\r\n}\r\n\r\npredicate VotedMinimum(acceptor:AcceptorState)\r\n{\r\n forall v :: v in acceptor.votes.v ==> v.n >= acceptor.minVotedOpn.n\r\n}\r\n\r\npredicate AcceptorIsValid(acceptor:AcceptorState)\r\n{\r\n && ReplicaConstantsState_IsValid(acceptor.constants)\r\n && acceptor.constants.all.config.replica_ids == acceptor.constants.all.config.replica_ids\r\n && ValidVotes(acceptor.votes)\r\n && acceptor.constants.all.params.max_integer_val > acceptor.constants.all.params.max_log_length > 0\r\n && (forall opn :: opn in acceptor.votes.v ==>\r\n AbstractifyCOperationNumberToOperationNumber(acceptor.log_truncation_point)\r\n <= AbstractifyCOperationNumberToOperationNumber(opn)\r\n <= UpperBoundedAddition(AbstractifyCOperationNumberToOperationNumber(acceptor.log_truncation_point),\r\n (acceptor.constants.all.params.max_log_length-1) as int,\r\n UpperBoundFinite(acceptor.constants.all.params.max_integer_val as int)))\r\n && AcceptorIsAbstractable(acceptor)\r\n && LMinQuorumSize(AbstractifyAcceptorStateToAcceptor(acceptor).constants.all.config) <= |acceptor.last_checkpointed_operation|\r\n && VotedMinimum(acceptor)\r\n && |acceptor.last_checkpointed_operation| == |acceptor.constants.all.config.replica_ids|\r\n}\r\n\r\npredicate NextAcceptorState_InitPostconditions(acceptor:AcceptorState, rcs:ReplicaConstantsState)\r\n requires ReplicaConstantsState_IsValid(rcs)\r\n{\r\n && AcceptorIsValid(acceptor)\r\n && AcceptorIsAbstractable(acceptor)\r\n && acceptor.constants == rcs\r\n && LAcceptorInit(AbstractifyAcceptorStateToAcceptor(acceptor), AbstractifyReplicaConstantsStateToLReplicaConstants(rcs))\r\n}\r\n\r\npredicate ConstantsStayConstant(acceptor:AcceptorState, acceptor':AcceptorState)\r\n// requires AcceptorIsAbstractable(acceptor)\r\n// requires AcceptorIsAbstractable(acceptor')\r\n// requires ReplicaConstantsStateIsAbstractable(acceptor.constants)\r\n// requires ReplicaConstantsStateIsAbstractable(acceptor'.constants)\r\n{\r\n// AbstractifyAcceptorStateToAcceptor(acceptor).constants == AbstractifyAcceptorStateToAcceptor(acceptor').constants\r\n acceptor.constants == acceptor'.constants\r\n}\r\n\r\npredicate CommonAcceptorPreconditions(acceptor:AcceptorState, in_msg:CMessage, sender:EndPoint)\r\n{\r\n && AcceptorIsValid(acceptor)\r\n && AcceptorIsAbstractable(acceptor)\r\n && ReplicaConstantsState_IsValid(acceptor.constants)\r\n && CMessageIsValid(in_msg)\r\n && CMessageIsAbstractable(in_msg)\r\n && PaxosEndPointIsValid(sender, acceptor.constants.all.config)\r\n}\r\n\r\npredicate CommonAcceptorPostconditions(acceptor:AcceptorState, acceptor':AcceptorState, packets_sent:CBroadcast)\r\n requires AcceptorIsValid(acceptor)\r\n requires AcceptorIsAbstractable(acceptor)\r\n{\r\n && AcceptorIsValid(acceptor')\r\n && AcceptorIsAbstractable(acceptor')\r\n && ConstantsStayConstant(acceptor, acceptor')\r\n && CBroadcastIsValid(packets_sent)\r\n && (packets_sent.CBroadcast? ==> packets_sent.src == acceptor.constants.all.config.replica_ids[acceptor.constants.my_index])\r\n}\r\n\r\npredicate NextAcceptorState_Phase1Preconditions(acceptor:AcceptorState, in_msg:CMessage, sender:EndPoint)\r\n{\r\n && CommonAcceptorPreconditions(acceptor, in_msg, sender)\r\n && in_msg.CMessage_1a?\r\n}\r\n\r\npredicate NextAcceptorState_Phase1Postconditions(acceptor:AcceptorState, acceptor':AcceptorState, in_msg:CMessage, sender:EndPoint, packets_sent:CBroadcast)\r\n{\r\n && NextAcceptorState_Phase1Preconditions(acceptor, in_msg, sender)\r\n && CommonAcceptorPostconditions(acceptor, acceptor', packets_sent)\r\n && LAcceptorProcess1a(\r\n AbstractifyAcceptorStateToAcceptor(acceptor),\r\n AbstractifyAcceptorStateToAcceptor(acceptor'),\r\n AbstractifyCMessageToRslPacket(acceptor.constants.all.config.replica_ids[acceptor.constants.my_index], sender, in_msg),\r\n AbstractifyCBroadcastToRlsPacketSeq(packets_sent))\r\n}\r\n\r\npredicate NextAcceptorState_Phase2Preconditions_AlwaysEnabled(acceptor:AcceptorState, in_msg:CMessage, sender:EndPoint)\r\n{\r\n && CommonAcceptorPreconditions(acceptor, in_msg, sender)\r\n && in_msg.CMessage_2a?\r\n && CPaxosConfigurationIsAbstractable(acceptor.constants.all.config)\r\n}\r\n\r\npredicate NextAcceptorState_Phase2Preconditions(acceptor:AcceptorState, in_msg:CMessage, sender:EndPoint)\r\n{\r\n && NextAcceptorState_Phase2Preconditions_AlwaysEnabled(acceptor, in_msg, sender)\r\n && CBallotIsNotGreaterThan(acceptor.maxBallot, in_msg.bal_2a)\r\n //&& AbstractifyCOperationNumberToOperationNumber(acceptor.log_truncation_point) <= \r\n && AbstractifyCOperationNumberToOperationNumber(in_msg.opn_2a) <= acceptor.constants.all.params.max_integer_val as int\r\n && sender in acceptor.constants.all.config.replica_ids\r\n}\r\n\r\npredicate NextAcceptorState_Phase2Postconditions(acceptor:AcceptorState, acceptor':AcceptorState, in_msg:CMessage, sender:EndPoint, packets_sent:CBroadcast)\r\n{\r\n && NextAcceptorState_Phase2Preconditions(acceptor, in_msg, sender)\r\n && CommonAcceptorPostconditions(acceptor, acceptor', packets_sent)\r\n && LAcceptorProcess2a(\r\n AbstractifyAcceptorStateToAcceptor(acceptor),\r\n AbstractifyAcceptorStateToAcceptor(acceptor'),\r\n AbstractifyCMessageToRslPacket(acceptor.constants.all.config.replica_ids[acceptor.constants.my_index], sender, in_msg),\r\n AbstractifyCBroadcastToRlsPacketSeq(packets_sent))\r\n}\r\n\r\npredicate NextAcceptorState_ProcessHeartbeatPreconditions(acceptor:AcceptorState, in_msg:CMessage, sender:EndPoint)\r\n{\r\n && CommonAcceptorPreconditions(acceptor, in_msg, sender)\r\n && in_msg.CMessage_Heartbeat?\r\n && CPaxosConfigurationIsAbstractable(acceptor.constants.all.config)\r\n}\r\n\r\npredicate NextAcceptorState_ProcessHeartbeatPostconditions(acceptor:AcceptorState, acceptor':AcceptorState, in_msg:CMessage, sender:EndPoint)\r\n{\r\n && NextAcceptorState_ProcessHeartbeatPreconditions(acceptor, in_msg, sender)\r\n && AcceptorIsValid(acceptor')\r\n && AcceptorIsAbstractable(acceptor')\r\n && ConstantsStayConstant(acceptor, acceptor')\r\n && LAcceptorProcessHeartbeat(\r\n AbstractifyAcceptorStateToAcceptor(acceptor),\r\n AbstractifyAcceptorStateToAcceptor(acceptor'),\r\n AbstractifyCMessageToRslPacket(acceptor.constants.all.config.replica_ids[acceptor.constants.my_index], sender, in_msg))\r\n}\r\n\r\npredicate NextAcceptorState_TruncateLogPreconditions(acceptor:AcceptorState, opn:COperationNumber)\r\n{\r\n && AcceptorIsValid(acceptor)\r\n && AcceptorIsAbstractable(acceptor)\r\n //&& opn.n > acceptor.log_truncation_point.n\r\n}\r\n\r\npredicate NextAcceptorState_TruncateLogPostconditions(acceptor:AcceptorState, acceptor':AcceptorState, opn:COperationNumber)\r\n{\r\n && NextAcceptorState_TruncateLogPreconditions(acceptor, opn)\r\n && AcceptorIsValid(acceptor')\r\n && AcceptorIsAbstractable(acceptor')\r\n && ConstantsStayConstant(acceptor, acceptor')\r\n && LAcceptorTruncateLog(\r\n AbstractifyAcceptorStateToAcceptor(acceptor),\r\n AbstractifyAcceptorStateToAcceptor(acceptor'),\r\n AbstractifyCOperationNumberToOperationNumber(opn))\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/AppInterface.i.dfy", "content": "include \"../../Common/Collections/Maps.i.dfy\"\r\ninclude \"../../Protocol/RSL/Configuration.i.dfy\"\r\ninclude \"../../Protocol/RSL/Message.i.dfy\"\r\ninclude \"../../Protocol/RSL/Types.i.dfy\"\r\ninclude \"../Common/GenericMarshalling.i.dfy\"\r\ninclude \"../Common/NodeIdentity.i.dfy\"\r\ninclude \"../../Services/RSL/AppStateMachine.s.dfy\"\r\n\r\nmodule LiveRSL__AppInterface_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Collections__Maps_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Common__GenericMarshalling_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened AppStateMachine_s\r\nimport opened Math__mul_nonlinear_i\r\nimport opened Math__mul_i\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// CAppRequest\r\n//\r\n// Currently, this is just the same as an AppRequest. Someday, we\r\n// might want it to be something more efficient, like an array.\r\n/////////////////////////////////////////////////////////////////////////////\r\n\r\ntype CAppRequest = Bytes\r\n\r\npredicate method CAppRequestIsAbstractable(request:CAppRequest)\r\n{\r\n true\r\n}\r\n\r\nfunction method AbstractifyCAppRequestToAppRequest(request:CAppRequest) : AppRequest\r\n{\r\n request\r\n}\r\n\r\npredicate method CAppRequestMarshallable(request:CAppRequest)\r\n{\r\n |request| <= MaxAppRequestSize()\r\n}\r\n\r\nfunction method MarshallCAppRequest(request:CAppRequest) : V\r\n{\r\n VByteArray(request)\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// CAppReply\r\n//\r\n// Currently, this is just the same as an AppReply. Someday, we\r\n// might want it to be something more efficient, like an array.\r\n/////////////////////////////////////////////////////////////////////////////\r\n\r\ntype CAppReply = Bytes\r\n\r\npredicate method CAppReplyIsAbstractable(reply:CAppReply)\r\n{\r\n true\r\n}\r\n\r\nfunction method AbstractifyCAppReplyToAppReply(reply:CAppReply) : AppReply\r\n{\r\n reply\r\n}\r\n\r\npredicate method CAppReplyMarshallable(reply:CAppReply)\r\n{\r\n |reply| <= MaxAppReplySize()\r\n}\r\n\r\nfunction method MarshallCAppReply(reply:CAppReply) : V\r\n{\r\n VByteArray(reply)\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// CAppState\r\n//\r\n// Currently, this is just the same as an AppState. Someday, we\r\n// might want it to be something more efficient, like an array.\r\n/////////////////////////////////////////////////////////////////////////////\r\n\r\ntype CAppState = Bytes\r\n\r\npredicate method CAppStateIsAbstractable(state:CAppState)\r\n{\r\n true\r\n}\r\n\r\nfunction method AbstractifyCAppStateToAppState(state:CAppState) : AppState\r\n{\r\n state\r\n}\r\n\r\npredicate method CAppStateMarshallable(state:CAppState)\r\n{\r\n |state| <= MaxAppStateSize()\r\n}\r\n\r\nfunction method MarshallCAppState(state:CAppState) : V\r\n{\r\n VByteArray(state)\r\n}\r\n\r\n}\r\n\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/Broadcast.i.dfy", "content": "include \"../../Protocol/RSL/Broadcast.i.dfy\"\r\ninclude \"ReplicaConstantsState.i.dfy\"\r\n\r\nmodule Impl__LiveRSL__Broadcast_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__Broadcast_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\n\r\nmethod BuildBroadcastToEveryone(config:CPaxosConfiguration, my_index:uint64, msg:CMessage) returns (broadcast:CBroadcast)\r\n requires CPaxosConfigurationIsValid(config)\r\n requires ReplicaIndexValid(my_index, config)\r\n requires CMessageIsAbstractable(msg)\r\n requires Marshallable(msg)\r\n ensures CBroadcastIsValid(broadcast)\r\n ensures OutboundPacketsHasCorrectSrc(Broadcast(broadcast), config.replica_ids[my_index])\r\n ensures LBroadcastToEveryone(AbstractifyCPaxosConfigurationToConfiguration(config), my_index as int, AbstractifyCMessageToRslMessage(msg), AbstractifyCBroadcastToRlsPacketSeq(broadcast))\r\n{\r\n broadcast := CBroadcast(config.replica_ids[my_index], config.replica_ids, msg);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/CClockReading.i.dfy", "content": "include \"../../Common/Native/NativeTypes.s.dfy\"\r\ninclude \"../../Protocol/RSL/ClockReading.i.dfy\"\r\n\r\nmodule LiveRSL__CClockReading_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__ClockReading_i\r\n\r\ndatatype CClockReading = CClockReading(t:uint64)\r\n\r\nfunction AbstractifyCClockReadingToClockReading(cclock:CClockReading) : ClockReading\r\n{\r\n ClockReading(cclock.t as int)\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/CLastCheckpointedMap.i.dfy", "content": "include \"CPaxosConfiguration.i.dfy\"\r\ninclude \"../../Common/Native/Io.s.dfy\"\r\ninclude \"../../Common/Collections/CountMatches.i.dfy\"\r\ninclude \"CTypes.i.dfy\"\r\ninclude \"../../Protocol/RSL/Acceptor.i.dfy\"\r\ninclude \"COperationNumberSort.i.dfy\"\r\n\r\nmodule LiveRSL__CLastCheckpointedMap_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__Acceptor_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__COperationNumberSort_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Collections__CountMatches_i\r\n\r\ntype CLastCheckpointedMap = seq\r\n\r\n////////////////////////////////////////////////////////////\r\n// Refining a CLastCheckpointedMap\r\n////////////////////////////////////////////////////////////\r\n\r\npredicate CLastCheckpointedMapIsAbstractable(s:CLastCheckpointedMap)\r\n{\r\n forall ep :: ep in s ==> COperationNumberIsAbstractable(ep)\r\n}\r\n\r\nfunction {:opaque} AbstractifyCLastCheckpointedMapToOperationNumberSequence(s:CLastCheckpointedMap) : seq\r\n ensures |AbstractifyCLastCheckpointedMapToOperationNumberSequence(s)| == |s|\r\n ensures forall i :: 0 <= i < |s| ==> AbstractifyCOperationNumberToOperationNumber(s[i]) == AbstractifyCLastCheckpointedMapToOperationNumberSequence(s)[i]\r\n{\r\n if |s| == 0 then []\r\n else [AbstractifyCOperationNumberToOperationNumber(s[0])] + AbstractifyCLastCheckpointedMapToOperationNumberSequence(s[1..])\r\n}\r\n\r\n\r\n//////////////////////////////////////////////////////////////////////////\r\n// Finding the nth highest operation number\r\n//////////////////////////////////////////////////////////////////////////\r\n\r\nmethod SeqToArray(s:seq) returns (a:array)\r\n ensures fresh(a)\r\n ensures a.Length == |s|\r\n ensures forall i :: 0 <= i < |s| ==> s[i] == a[i]\r\n ensures a[..] == s\r\n ensures fresh(a)\r\n{\r\n a := new T[|s|];\r\n\r\n var i := 0;\r\n while i < |s|\r\n invariant 0 <= i <= |s|\r\n invariant forall j :: 0 <= j < i ==> s[j] == a[j]\r\n {\r\n a[i] := s[i];\r\n i := i + 1;\r\n }\r\n}\r\n\r\npredicate IsNthHighestValueInSequenceOfCOperationNumbers(v:COperationNumber, s:seq, n:uint64)\r\n{\r\n && 0 < n as int <= |s|\r\n && v in s\r\n && CountMatchesInSeq(s, (x:COperationNumber) => x.n > v.n) < n as int\r\n && CountMatchesInSeq(s, (x:COperationNumber) => x.n >= v.n) >= n as int\r\n}\r\n\r\npredicate IsNthHighestValueInMultisetOfCOperationNumbers(v:COperationNumber, m:multiset, n:uint64)\r\n{\r\n && 0 < n as int <= |m|\r\n && v in m\r\n && CountMatchesInMultiset(m, (x:COperationNumber) => x.n > v.n) < n as int\r\n && CountMatchesInMultiset(m, (x:COperationNumber) => x.n >= v.n) >= n as int\r\n}\r\n\r\nlemma lemma_SequenceToMultisetPreservesIsNthHighestValueForCOperationNumbers(v:COperationNumber, s:seq, m:multiset, n:uint64)\r\n requires m == multiset(s)\r\n ensures IsNthHighestValueInSequenceOfCOperationNumbers(v, s, n) <==> IsNthHighestValueInMultisetOfCOperationNumbers(v, m, n)\r\n{\r\n Lemma_MatchCountInSeqIsMatchCountInMultiset(s, m, (x:COperationNumber) => x.n > v.n);\r\n Lemma_MatchCountInSeqIsMatchCountInMultiset(s, m, (x:COperationNumber) => x.n >= v.n);\r\n}\r\n\r\nlemma lemma_SortedSequenceMatchCount(s:seq, k:int)\r\n requires |s| > 0\r\n requires 0 < k <= |s|\r\n requires forall i, j :: 0 <= i < j < |s| ==> s[i].n <= s[j].n\r\n ensures CountMatchesInSeq(s, (x:COperationNumber) => x.n > s[|s|-k].n) < k\r\n ensures CountMatchesInSeq(s, (x:COperationNumber) => x.n >= s[|s|-k].n) >= k\r\n{\r\n var s' := s[1..];\r\n var f1 := (x:COperationNumber) => x.n > s[|s|-k].n;\r\n var f2 := (x:COperationNumber) => x.n >= s[|s|-k].n;\r\n\r\n if k == |s|\r\n {\r\n calc {\r\n CountMatchesInSeq(s, f1);\r\n CountMatchesInSeq(s', f1);\r\n < { Lemma_CountMatchesInSeqBounds(s', f1); }\r\n k;\r\n }\r\n\r\n Lemma_CountMatchesInSeqAll(s, f2);\r\n }\r\n else\r\n {\r\n var f1' := (x:COperationNumber) => x.n > s'[|s'|-k].n;\r\n var f2' := (x:COperationNumber) => x.n >= s'[|s'|-k].n;\r\n lemma_SortedSequenceMatchCount(s', k);\r\n assert s'[|s'|-k] == s[|s|-k];\r\n\r\n calc {\r\n CountMatchesInSeq(s, f1);\r\n CountMatchesInSeq(s', f1);\r\n { Lemma_CountMatchesInSeqSameForSameFunctions(s', f1, f1'); }\r\n CountMatchesInSeq(s', f1');\r\n < k;\r\n }\r\n\r\n calc {\r\n CountMatchesInSeq(s, f2);\r\n >= CountMatchesInSeq(s', f2);\r\n { Lemma_CountMatchesInSeqSameForSameFunctions(s', f2, f2'); }\r\n CountMatchesInSeq(s', f2');\r\n >= k;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_AbstractionOfCOperationNumberIsNthHighestValueInSequence(opn:COperationNumber, cm:CLastCheckpointedMap, n:uint64)\r\n requires IsNthHighestValueInSequenceOfCOperationNumbers(opn, cm, n)\r\n ensures IsNthHighestValueInSequence(AbstractifyCOperationNumberToOperationNumber(opn), AbstractifyCLastCheckpointedMapToOperationNumberSequence(cm), n as int)\r\n{\r\n var f1 := (x:COperationNumber) => x.n > opn.n;\r\n var f2 := x => x > AbstractifyCOperationNumberToOperationNumber(opn);\r\n Lemma_CountMatchesInSeqCorrespondence(cm, f1, AbstractifyCLastCheckpointedMapToOperationNumberSequence(cm), f2);\r\n\r\n var f1' := (x:COperationNumber) => x.n >= opn.n;\r\n var f2' := x => x >= AbstractifyCOperationNumberToOperationNumber(opn);\r\n Lemma_CountMatchesInSeqCorrespondence(cm, f1', AbstractifyCLastCheckpointedMapToOperationNumberSequence(cm), f2');\r\n}\r\n\r\nmethod ComputeNthHighestValue(cm:CLastCheckpointedMap, n:uint64) returns (opn:COperationNumber)\r\n requires CLastCheckpointedMapIsAbstractable(cm)\r\n requires 0 < n as int <= |cm|\r\n requires |cm| < 0xffff_ffff_ffff_ffff\r\n ensures IsNthHighestValueInSequence(AbstractifyCOperationNumberToOperationNumber(opn), AbstractifyCLastCheckpointedMapToOperationNumberSequence(cm), n as int)\r\n{\r\n var a := SeqToArray(cm);\r\n assert multiset(a[..]) == multiset(cm);\r\n InsertionSortCOperationNumbers(a);\r\n\r\n ghost var s := a[..]; \r\n assert multiset(s) == multiset(cm);\r\n forall i, j | 0 <= i < j < |s|\r\n ensures s[i].n <= s[j].n\r\n {\r\n assert a[i].n <= a[j].n;\r\n }\r\n\r\n opn := a[a.Length-(n as int)];\r\n assert opn == s[|s|-(n as int)];\r\n\r\n ghost var f1 := (x:COperationNumber) => x.n > s[|s|-(n as int)].n;\r\n ghost var f2 := (x:COperationNumber) => x.n > opn.n;\r\n Lemma_CountMatchesInSeqSameForSameFunctions(s, f1, f2);\r\n ghost var f1' := (x:COperationNumber) => x.n >= s[|s|-(n as int)].n;\r\n ghost var f2' := (x:COperationNumber) => x.n >= opn.n;\r\n Lemma_CountMatchesInSeqSameForSameFunctions(s, f1', f2');\r\n\r\n lemma_SortedSequenceMatchCount(s, n as int);\r\n assert IsNthHighestValueInSequenceOfCOperationNumbers(opn, s, n);\r\n lemma_SequenceToMultisetPreservesIsNthHighestValueForCOperationNumbers(opn, s, multiset(cm), n);\r\n lemma_SequenceToMultisetPreservesIsNthHighestValueForCOperationNumbers(opn, cm, multiset(cm), n);\r\n lemma_AbstractionOfCOperationNumberIsNthHighestValueInSequence(opn, cm, n);\r\n}\r\n\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/CMessage.i.dfy", "content": "include \"CTypes.i.dfy\"\r\n\r\nmodule LiveRSL__CMessage_i {\r\nimport opened LiveRSL__CTypes_i\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened Logic__Option_i\r\n\r\ndatatype CMessage =\r\n CMessage_Invalid()\r\n | CMessage_Request(seqno:uint64, val:CAppRequest)\r\n | CMessage_1a(bal_1a:CBallot)\r\n | CMessage_1b(bal_1b:CBallot, log_truncation_point:COperationNumber, votes:CVotes)\r\n | CMessage_2a(bal_2a:CBallot, opn_2a:COperationNumber, val_2a:CRequestBatch)\r\n | CMessage_2b(bal_2b:CBallot, opn_2b:COperationNumber, val_2b:CRequestBatch)\r\n | CMessage_Heartbeat(bal_heartbeat:CBallot, suspicious:bool, opn_ckpt:COperationNumber)\r\n | CMessage_Reply(seqno_reply:uint64, reply:CAppReply)\r\n | CMessage_AppStateRequest(bal_state_req:CBallot, opn_state_req:COperationNumber)\r\n | CMessage_AppStateSupply(bal_state_supply:CBallot, opn_state_supply:COperationNumber, app_state:CAppState)\r\n | CMessage_StartingPhase2(bal_2:CBallot, logTruncationPoint_2:COperationNumber)\r\n\r\ndatatype CPacket = CPacket(dst:EndPoint, src:EndPoint, msg:CMessage)\r\n\r\ndatatype CBroadcast = CBroadcast(src:EndPoint, dsts:seq, msg:CMessage) | CBroadcastNop\r\n\r\ndatatype OutboundPackets = Broadcast(broadcast:CBroadcast) | OutboundPacket(p:Option) | PacketSequence(s:seq)\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/CMessageRefinements.i.dfy", "content": "include \"../../Protocol/RSL/Message.i.dfy\"\r\ninclude \"../../Protocol/RSL/Environment.i.dfy\"\r\ninclude \"../../Protocol/RSL/Broadcast.i.dfy\"\r\ninclude \"../Common/NodeIdentity.i.dfy\"\r\ninclude \"CMessage.i.dfy\"\r\ninclude \"AppInterface.i.dfy\"\r\n\r\nmodule LiveRSL__CMessageRefinements_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Broadcast_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__NetClient_i\r\nimport opened Environment_s\r\nimport opened Collections__Sets_i\r\n\r\npredicate CMessageIsAbstractable(msg:CMessage)\r\n{\r\n match msg\r\n case CMessage_Invalid => true\r\n case CMessage_Request(seqno, value) => CAppRequestIsAbstractable(value)\r\n case CMessage_1a(ballot) => CBallotIsAbstractable(ballot)\r\n case CMessage_1b(ballot, log_truncation_point, votes) => CBallotIsAbstractable(ballot) && COperationNumberIsAbstractable(log_truncation_point) && CVotesIsAbstractable(votes)\r\n case CMessage_2a(ballot, opn, value) => CBallotIsAbstractable(ballot) && COperationNumberIsAbstractable(opn) && CRequestBatchIsAbstractable(value)\r\n case CMessage_2b(ballot, opn, value) => CBallotIsAbstractable(ballot) && COperationNumberIsAbstractable(opn) && CRequestBatchIsAbstractable(value)\r\n case CMessage_Heartbeat(bal_heartbeat, suspicious, opn_ckpt) => CBallotIsAbstractable(bal_heartbeat) && COperationNumberIsAbstractable(opn_ckpt)\r\n case CMessage_Reply(seqno, reply) => CAppReplyIsAbstractable(reply)\r\n case CMessage_AppStateRequest(bal_state_req, opn_state_req) => CBallotIsAbstractable(bal_state_req) && COperationNumberIsAbstractable(opn_state_req)\r\n case CMessage_AppStateSupply(bal_state_supply, opn_state_supply, app_state) => CBallotIsAbstractable(bal_state_supply) && COperationNumberIsAbstractable(opn_state_supply) && CAppStateIsAbstractable(app_state)\r\n case CMessage_StartingPhase2(bal_2, logTruncationPoint_2) => CBallotIsAbstractable(bal_2) && COperationNumberIsAbstractable(logTruncationPoint_2)\r\n\r\n}\r\n\r\nfunction AbstractifyCMessageToRslMessage(msg:CMessage) : RslMessage\r\n requires CMessageIsAbstractable(msg)\r\n{\r\n match msg\r\n case CMessage_Invalid => RslMessage_Invalid()\r\n case CMessage_Request(seqno, value) => RslMessage_Request(seqno as int, AbstractifyCAppRequestToAppRequest(value))\r\n case CMessage_1a(ballot) => RslMessage_1a(AbstractifyCBallotToBallot(ballot))\r\n case CMessage_1b(ballot, log_truncation_point, votes) => RslMessage_1b(AbstractifyCBallotToBallot(ballot), AbstractifyCOperationNumberToOperationNumber(log_truncation_point), AbstractifyCVotesToVotes(votes))\r\n case CMessage_2a(ballot, opn, value) => RslMessage_2a(AbstractifyCBallotToBallot(ballot), AbstractifyCOperationNumberToOperationNumber(opn), AbstractifyCRequestBatchToRequestBatch(value))\r\n case CMessage_2b(ballot, opn, value) => RslMessage_2b(AbstractifyCBallotToBallot(ballot), AbstractifyCOperationNumberToOperationNumber(opn), AbstractifyCRequestBatchToRequestBatch(value))\r\n case CMessage_Heartbeat(bal_heartbeat, suspicious, opn_ckpt) => RslMessage_Heartbeat(AbstractifyCBallotToBallot(bal_heartbeat), suspicious, AbstractifyCOperationNumberToOperationNumber(opn_ckpt))\r\n case CMessage_Reply(seqno, reply) => RslMessage_Reply(seqno as int, AbstractifyCAppReplyToAppReply(reply))\r\n case CMessage_AppStateRequest(bal_state_req, opn_state_req) => RslMessage_AppStateRequest(AbstractifyCBallotToBallot(bal_state_req), AbstractifyCOperationNumberToOperationNumber(opn_state_req))\r\n case CMessage_AppStateSupply(bal_state_supply, opn_state_supply, app_state) => RslMessage_AppStateSupply(AbstractifyCBallotToBallot(bal_state_supply), AbstractifyCOperationNumberToOperationNumber(opn_state_supply), AbstractifyCAppStateToAppState(app_state))\r\n case CMessage_StartingPhase2(bal_2, logTruncationPoint_2) => RslMessage_StartingPhase2(AbstractifyCBallotToBallot(bal_2), AbstractifyCOperationNumberToOperationNumber(logTruncationPoint_2))\r\n}\r\n\r\nfunction AbstractifyCMessageToRslPacket(sentTo:EndPoint, sentFrom:EndPoint, msg:CMessage) : RslPacket\r\n requires CMessageIsAbstractable(msg)\r\n requires EndPointIsValidPublicKey(sentTo)\r\n requires EndPointIsValidPublicKey(sentFrom)\r\n{\r\n LPacket(AbstractifyEndPointToNodeIdentity(sentTo), AbstractifyEndPointToNodeIdentity(sentFrom), AbstractifyCMessageToRslMessage(msg))\r\n}\r\n\r\npredicate CPacketIsAbstractable(cp:CPacket)\r\n{\r\n && CMessageIsAbstractable(cp.msg)\r\n && EndPointIsValidPublicKey(cp.src)\r\n && EndPointIsValidPublicKey(cp.dst)\r\n}\r\n\r\npredicate CPacketsIsAbstractable(cps:set)\r\n{\r\n forall cp :: cp in cps ==> CPacketIsAbstractable(cp)\r\n}\r\n\r\nfunction AbstractifyCPacketToRslPacket(cp: CPacket): RslPacket\r\n ensures CPacketIsAbstractable(cp) ==> AbstractifyCPacketToRslPacket(cp) == LPacket(AbstractifyEndPointToNodeIdentity(cp.dst), AbstractifyEndPointToNodeIdentity(cp.src), AbstractifyCMessageToRslMessage(cp.msg))\r\n{\r\n if (CPacketIsAbstractable(cp)) then\r\n LPacket(AbstractifyEndPointToNodeIdentity(cp.dst), AbstractifyEndPointToNodeIdentity(cp.src), AbstractifyCMessageToRslMessage(cp.msg))\r\n else\r\n var x:RslPacket :| (true); x\r\n}\r\n\r\nfunction AbstractifySetOfCPacketsToSetOfRslPackets_transparent(cps:set) : set\r\n requires CPacketsIsAbstractable(cps)\r\n{\r\n set cp | cp in cps :: AbstractifyCPacketToRslPacket(cp)\r\n}\r\n\r\nfunction {:opaque} AbstractifySetOfCPacketsToSetOfRslPackets(cps:set) : set\r\n requires CPacketsIsAbstractable(cps)\r\n //ensures forall p :: p in cps ==> AbstractifyCPacketToRslPacket(p) in AbstractifySetOfCPacketsToSetOfRslPackets(cps) // Still too trigger happy\r\n{\r\n// set netp | netp in netps ::\r\n// var net := AbstractifyCPacketToShtPacket(netp); net\r\n AbstractifySetOfCPacketsToSetOfRslPackets_transparent(cps)\r\n}\r\n\r\npredicate CPacketSeqIsAbstractable(cps:seq)\r\n{\r\n forall i :: 0 <= i < |cps| ==> CPacketIsAbstractable(cps[i])\r\n}\r\n\r\nfunction {:opaque} AbstractifySeqOfCPacketsToSeqOfRslPackets(cps:seq) : seq\r\n requires CPacketSeqIsAbstractable(cps)\r\n ensures |cps| == |AbstractifySeqOfCPacketsToSeqOfRslPackets(cps)|\r\n ensures forall i :: 0 <= i < |cps| ==> AbstractifySeqOfCPacketsToSeqOfRslPackets(cps)[i] == AbstractifyCPacketToRslPacket(cps[i])\r\n{\r\n if |cps| == 0 then []\r\n else [AbstractifyCPacketToRslPacket(cps[0])] + AbstractifySeqOfCPacketsToSeqOfRslPackets(cps[1..])\r\n}\r\n\r\npredicate CPacketSeqHasCorrectSrc(sent_packets:seq, me:EndPoint)\r\n{\r\n forall p :: p in sent_packets ==> p.src == me\r\n}\r\n\r\n\r\npredicate CMessageIsInjectiveType(m:CMessage)\r\n{\r\n && CMessageIsAbstractable(m)\r\n && (m.CMessage_1b? || m.CMessage_2b?)\r\n}\r\n\r\nlemma lemma_AbstractifyCMessageToRslMessage_isInjective(m1:CMessage, m2:CMessage)\r\n requires CMessageIsInjectiveType(m1) && CMessageIsInjectiveType(m2)\r\n requires AbstractifyCMessageToRslMessage(m1) == AbstractifyCMessageToRslMessage(m2)\r\n ensures m1 == m2\r\n{\r\n lemma_AbstractifyCRequestBatchToRequestBatch_isInjective();\r\n\r\n if (m1.CMessage_1b?) {\r\n lemma_BallotInjective(m1.bal_1b, m2.bal_1b);\r\n lemma_VotesInjective(m1.votes, m2.votes);\r\n assert m1 == m2;\r\n } else if (m1.CMessage_2b?) {\r\n lemma_BallotInjective(m1.bal_2b, m2.bal_2b);\r\n assert AbstractifyCRequestBatchToRequestBatch(m1.val_2b) == AbstractifyCRequestBatchToRequestBatch(m2.val_2b);\r\n assert m1 == m2;\r\n }\r\n}\r\n\r\npredicate CPacketIsInjectiveType(p:CPacket)\r\n{\r\n CPacketIsAbstractable(p) && CMessageIsInjectiveType(p.msg)\r\n}\r\n\r\nlemma lemma_AbstractifyCPacketToRslPacket_isInjective()\r\n ensures forall p1, p2 ::\r\n && CPacketIsInjectiveType(p1)\r\n && CPacketIsInjectiveType(p2)\r\n && AbstractifyCPacketToRslPacket(p1) == AbstractifyCPacketToRslPacket(p2)\r\n ==> p1 == p2\r\n{\r\n forall p1, p2 |\r\n && CPacketIsInjectiveType(p1)\r\n && CPacketIsInjectiveType(p2)\r\n && AbstractifyCPacketToRslPacket(p1) == AbstractifyCPacketToRslPacket(p2)\r\n ensures p1 == p2\r\n {\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n lemma_AbstractifyCMessageToRslMessage_isInjective(p1.msg, p2.msg);\r\n }\r\n}\r\n\r\npredicate SetOfInjectiveTypeCPackets(s:set)\r\n{\r\n forall p :: p in s ==> CPacketIsInjectiveType(p)\r\n}\r\n\r\npredicate SetOfInjectiveTypeCPacketsIsInjective(s:set)\r\n{\r\n && SetOfInjectiveTypeCPackets(s)\r\n && (forall p1, p2 :: p1 in s && p2 in s && AbstractifyCPacketToRslPacket(p1) == AbstractifyCPacketToRslPacket(p2)\r\n ==> p1 == p2)\r\n}\r\n\r\nlemma lemma_SetOfInjectiveTypeCPacketsIsInjective(s:set)\r\n requires SetOfInjectiveTypeCPackets(s)\r\n ensures SetOfInjectiveTypeCPacketsIsInjective(s)\r\n{\r\n lemma_AbstractifyCPacketToRslPacket_isInjective();\r\n}\r\n\r\nlemma lemma_AbstractifySetOfCPacketsToSetOfRslPackets_isInjective(cps1:set, cps2:set)\r\n requires CPacketsIsAbstractable(cps1)\r\n requires CPacketsIsAbstractable(cps2)\r\n requires SetOfInjectiveTypeCPackets(cps1)\r\n requires SetOfInjectiveTypeCPackets(cps2)\r\n requires AbstractifySetOfCPacketsToSetOfRslPackets(cps1) == AbstractifySetOfCPacketsToSetOfRslPackets(cps2)\r\n ensures cps1 == cps2\r\n{\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n lemma_AbstractifyCPacketToRslPacket_isInjective();\r\n forall cp1 | cp1 in cps1\r\n ensures cp1 in cps2\r\n {\r\n var p := AbstractifyCPacketToRslPacket(cp1);\r\n assert p in AbstractifySetOfCPacketsToSetOfRslPackets(cps2);\r\n }\r\n forall cp2 | cp2 in cps2\r\n ensures cp2 in cps1\r\n {\r\n var p := AbstractifyCPacketToRslPacket(cp2);\r\n assert p in AbstractifySetOfCPacketsToSetOfRslPackets(cps1);\r\n }\r\n}\r\n\r\nlemma lemma_AbstractifySetOfCPacketsToSetOfRslPackets_cardinality(cps:set)\r\n requires CPacketsIsAbstractable(cps)\r\n requires SetOfInjectiveTypeCPackets(cps)\r\n ensures |cps| == |AbstractifySetOfCPacketsToSetOfRslPackets(cps)|\r\n{\r\n lemma_SetOfInjectiveTypeCPacketsIsInjective(cps);\r\n var rps := AbstractifySetOfCPacketsToSetOfRslPackets(cps);\r\n forall y | y in rps \r\n ensures exists x :: x in cps && y == AbstractifyCPacketToRslPacket(x)\r\n {\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n }\r\n\r\n forall x | x in cps \r\n ensures AbstractifyCPacketToRslPacket(x) in rps\r\n {\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n }\r\n lemma_MapSetCardinalityOver(cps, rps, AbstractifyCPacketToRslPacket);\r\n}\r\n\r\n\r\nlemma lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(cps:set)\r\n requires CPacketsIsAbstractable(cps)\r\n ensures SetOfInjectiveTypeCPackets(cps) ==> |cps| == |AbstractifySetOfCPacketsToSetOfRslPackets(cps)|\r\n ensures AbstractifySetOfCPacketsToSetOfRslPackets({}) == {}\r\n{\r\n if SetOfInjectiveTypeCPackets(cps) {\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_cardinality(cps);\r\n }\r\n\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n}\r\n\r\nlemma lemma_AbstractifyCPacketToRslPacket_src(cps:set, src:EndPoint)\r\n requires CPacketsIsAbstractable(cps)\r\n requires EndPointIsValidPublicKey(src)\r\n requires forall p :: p in AbstractifySetOfCPacketsToSetOfRslPackets(cps) ==> p.src == AbstractifyEndPointToNodeIdentity(src)\r\n ensures forall cp :: cp in cps ==> cp.src == src\r\n{\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n forall cp | cp in cps\r\n ensures cp.src == src\r\n {\r\n assert AbstractifyCPacketToRslPacket(cp).src == AbstractifyEndPointToNodeIdentity(src);\r\n assert cp.src == src;\r\n }\r\n}\r\n\r\nlemma lemma_AbstractifySetOfCPacketsToSetOfRslPackets_srcMembershipNeg(cps:set, src:EndPoint)\r\n requires CPacketsIsAbstractable(cps)\r\n requires EndPointIsValidPublicKey(src)\r\n requires !(forall p :: p in cps ==> p.src != src)\r\n ensures !(forall p :: p in AbstractifySetOfCPacketsToSetOfRslPackets(cps) ==> p.src != AbstractifyEndPointToNodeIdentity(src))\r\n{\r\n assert exists p :: p in cps && p.src == src;\r\n var cp :| cp in cps && cp.src == src;\r\n var p := AbstractifyCPacketToRslPacket(cp);\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n assert p in AbstractifySetOfCPacketsToSetOfRslPackets(cps);\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n}\r\n\r\nlemma lemma_AbstractifySetOfCPacketsToSetOfRslPackets_srcMembershipPos(cps:set, src:EndPoint)\r\n requires CPacketsIsAbstractable(cps)\r\n requires EndPointIsValidPublicKey(src)\r\n requires forall p :: p in cps ==> p.src != src\r\n ensures forall p :: p in AbstractifySetOfCPacketsToSetOfRslPackets(cps) ==> p.src != AbstractifyEndPointToNodeIdentity(src)\r\n{\r\n forall p | p in AbstractifySetOfCPacketsToSetOfRslPackets(cps)\r\n ensures p.src != AbstractifyEndPointToNodeIdentity(src)\r\n {\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n var cp :| cp in cps && AbstractifyCPacketToRslPacket(cp) == p;\r\n assert p.src == AbstractifyEndPointToNodeIdentity(cp.src);\r\n assert cp.src != src;\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n }\r\n}\r\n\r\nlemma lemma_AbstractifySetOfCPacketsToSetOfRslPackets_srcMembership(cps:set, src:EndPoint)\r\n requires CPacketsIsAbstractable(cps)\r\n requires EndPointIsValidPublicKey(src)\r\n ensures (forall p :: p in cps ==> p.src != src) <==> (forall p :: p in AbstractifySetOfCPacketsToSetOfRslPackets(cps) ==> p.src != AbstractifyEndPointToNodeIdentity(src))\r\n{\r\n var b := (forall p :: p in cps ==> p.src != src);\r\n\r\n if b {\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_srcMembershipPos(cps, src);\r\n } else {\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_srcMembershipNeg(cps, src);\r\n }\r\n}\r\n\r\n\r\nfunction {:opaque} BuildLBroadcast(src:NodeIdentity, dsts:seq, m:RslMessage):seq\r\n ensures |BuildLBroadcast(src, dsts, m)| == |dsts|\r\n ensures forall i :: 0 <= i < |dsts| ==> BuildLBroadcast(src, dsts, m)[i] == LPacket(dsts[i], src, m)\r\n{\r\n if |dsts| == 0 then []\r\n else [LPacket(dsts[0], src, m)] + BuildLBroadcast(src, dsts[1..], m)\r\n}\r\n\r\npredicate CBroadcastIsAbstractable(broadcast:CBroadcast) \r\n{\r\n || broadcast.CBroadcastNop?\r\n || (&& broadcast.CBroadcast? \r\n && EndPointIsValidPublicKey(broadcast.src)\r\n && (forall i :: 0 <= i < |broadcast.dsts| ==> EndPointIsValidPublicKey(broadcast.dsts[i]))\r\n && CMessageIsAbstractable(broadcast.msg))\r\n}\r\n\r\nfunction AbstractifyCBroadcastToRlsPacketSeq(broadcast:CBroadcast) : seq\r\n requires CBroadcastIsAbstractable(broadcast)\r\n{\r\n match broadcast\r\n case CBroadcast(_,_,_) => BuildLBroadcast(AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyEndPointsToNodeIdentities(broadcast.dsts), \r\n AbstractifyCMessageToRslMessage(broadcast.msg))\r\n case CBroadcastNop => []\r\n}\r\n\r\npredicate OutboundPacketsIsAbstractable(out:OutboundPackets)\r\n{\r\n match out\r\n case Broadcast(broadcast) => CBroadcastIsAbstractable(broadcast)\r\n case OutboundPacket(Some(p)) => CPacketIsAbstractable(p)\r\n case OutboundPacket(None()) => true\r\n case PacketSequence(s) => CPacketSeqIsAbstractable(s)\r\n} \r\n\r\nfunction AbstractifyOutboundCPacketsToSeqOfRslPackets(out:OutboundPackets) : seq\r\n requires OutboundPacketsIsAbstractable(out)\r\n{\r\n match out\r\n case Broadcast(broadcast) => AbstractifyCBroadcastToRlsPacketSeq(broadcast)\r\n case OutboundPacket(Some(p)) => [AbstractifyCPacketToRslPacket(p)]\r\n case OutboundPacket(None()) => [] \r\n case PacketSequence(s) => AbstractifySeqOfCPacketsToSeqOfRslPackets(s)\r\n} \r\n\r\npredicate OutboundPacketsHasCorrectSrc(out:OutboundPackets, me:EndPoint)\r\n{\r\n match out\r\n case Broadcast(CBroadcast(src, _, _)) => src == me\r\n case Broadcast(CBroadcastNop()) => true\r\n case OutboundPacket(p) => p.Some? ==> p.v.src == me\r\n case PacketSequence(s) => (forall p :: p in s ==> p.src == me)\r\n// case OutboundPacket(Some(p)) => p.src == me\r\n// case OutboundPacket(None()) => true\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/COperationNumberSort.i.dfy", "content": "include \"../../Common/Native/Io.s.dfy\"\r\ninclude \"CTypes.i.dfy\"\r\n\r\n// This file is adapted from\r\n// https://dafny.codeplex.com/SourceControl/latest#Test/dafny3/GenericSort.dfy\r\n// and modified to apply only to COperationNumbers and to use uint64s as indices.\r\n\r\nmodule LiveRSL__COperationNumberSort_i {\r\n\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__CTypes_i\r\n\r\n// In the insertion sort routine below, it's more convenient to keep track of only that\r\n// neighboring elements of the array are sorted...\r\npredicate NeighborSorted_COperationNumber(a: array, low: uint64, high: uint64)\r\n requires a.Length < 0xFFFFFFFFFFFFFFFF\r\n requires 0 <= low <= high <= a.Length as uint64\r\n reads a\r\n{\r\n forall i {:trigger a[i-1].n, a[i].n} :: low < i < high ==> a[i-1].n <= a[i].n\r\n}\r\n\r\npredicate Sorted_COperationNumber(a: array, low: uint64, high: uint64)\r\n requires a.Length < 0xFFFFFFFFFFFFFFFF\r\n requires 0 <= low <= high <= a.Length as uint64\r\n reads a\r\n{\r\n forall i, j :: low <= i < j < high ==> a[i].n <= a[j].n\r\n}\r\n\r\n// ...but we show that property to imply all pairs to be sorted. The proof of this\r\n// lemma uses the transitivity property.\r\nlemma lemma_NeighborSortedImpliesSortedCOperationNumber(a: array, low: uint64, high: uint64)\r\n requires a.Length < 0xFFFFFFFFFFFFFFFF\r\n requires 0 <= low <= high <= a.Length as uint64\r\n requires NeighborSorted_COperationNumber(a, low, high)\r\n ensures Sorted_COperationNumber(a, low, high)\r\n decreases high - low\r\n{\r\n if low != high {\r\n lemma_NeighborSortedImpliesSortedCOperationNumber(a, low+1, high);\r\n forall j | low < j < high\r\n ensures a[low].n <= a[j].n\r\n {\r\n var i := low+1;\r\n if(i == j) {\r\n assert a[j-1].n <= a[j].n;\r\n } else {\r\n assert a[i-1].n <= a[i].n;\r\n assert a[i].n <= a[j].n;\r\n assert a[low].n <= a[j].n;\r\n }\r\n }\r\n }\r\n}\r\n\r\n // Standard insertion sort method\r\nmethod InsertionSortCOperationNumbers(a: array)\r\n modifies a\r\n requires a.Length < 0xFFFFFFFFFFFFFFFF\r\n ensures Sorted_COperationNumber(a, 0, a.Length as uint64)\r\n ensures multiset(a[..]) == old(multiset(a[..]))\r\n{\r\n if a.Length as uint64 == 0 { return; }\r\n var i:uint64 := 1;\r\n while i < a.Length as uint64\r\n invariant 0 < i <= a.Length as uint64\r\n invariant NeighborSorted_COperationNumber(a, 0, i)\r\n invariant multiset(a[..]) == old(multiset(a[..]))\r\n {\r\n var j:uint64 := i;\r\n while 0 < j && a[j-1].n > a[j].n\r\n invariant 0 <= j <= i\r\n invariant NeighborSorted_COperationNumber(a, 0, j)\r\n invariant NeighborSorted_COperationNumber(a, j, i+1)\r\n invariant 0 < j < i ==> a[j-1].n <= a[j+1].n\r\n invariant multiset(a[..]) == old(multiset(a[..]))\r\n {\r\n // The proof of correctness uses the totality property here.\r\n // It implies that if two elements are not previously in\r\n // sorted order, they will be after swapping them.\r\n a[j], a[j-1] := a[j-1], a[j];\r\n j := j - 1;\r\n }\r\n i := i + 1;\r\n }\r\n lemma_NeighborSortedImpliesSortedCOperationNumber(a, 0, a.Length as uint64);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/CPaxosConfiguration.i.dfy", "content": "include \"../../Protocol/RSL/Constants.i.dfy\"\r\ninclude \"../Common/NodeIdentity.i.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\ninclude \"ParametersState.i.dfy\"\r\n\r\nmodule LiveRSL__CPaxosConfiguration_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__ParametersState_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__SeqIsUniqueDef_i\r\nimport opened Common__NetClient_i\r\nimport opened Collections__Seqs_i\r\n\r\ndatatype CPaxosConfiguration = CPaxosConfiguration(replica_ids:seq)\r\n\r\npredicate CPaxosConfigurationIsAbstractable(config:CPaxosConfiguration)\r\n{\r\n && (forall e :: e in config.replica_ids ==> EndPointIsValidPublicKey(e))\r\n && SeqIsUnique(config.replica_ids)\r\n}\r\n\r\npredicate CPaxosConfigurationIsValid(config:CPaxosConfiguration)\r\n ensures CPaxosConfigurationIsValid(config) ==> SeqIsUnique(config.replica_ids)\r\n{\r\n && 0 < |config.replica_ids| < 0xffff_ffff_ffff_ffff\r\n && CPaxosConfigurationIsAbstractable(config)\r\n && LMinQuorumSize(AbstractifyCPaxosConfigurationToConfiguration(config)) <= |config.replica_ids|\r\n}\r\n\r\nfunction method PaxosEndPointIsValid(endPoint:EndPoint, config:CPaxosConfiguration) : bool\r\n requires CPaxosConfigurationIsValid(config)\r\n{\r\n EndPointIsValidPublicKey(endPoint)\r\n}\r\n\r\n\r\nfunction AbstractifyCPaxosConfigurationToConfiguration(config:CPaxosConfiguration) : LConfiguration\r\n requires CPaxosConfigurationIsAbstractable(config)\r\n{\r\n LConfiguration({}, AbstractifyEndPointsToNodeIdentities(config.replica_ids))\r\n}\r\n\r\npredicate ReplicaIndexValid(index:uint64, config:CPaxosConfiguration)\r\n{\r\n 0 <= index as int < |config.replica_ids|\r\n}\r\n\r\npredicate ReplicaIndicesValid(indices:seq, config:CPaxosConfiguration)\r\n{\r\n forall i :: 0 <= i < |indices| ==> ReplicaIndexValid(indices[i], config)\r\n}\r\n\r\nlemma lemma_WFCPaxosConfiguration(config:CPaxosConfiguration)\r\n ensures && CPaxosConfigurationIsAbstractable(config)\r\n && 0 < |config.replica_ids|\r\n ==> && CPaxosConfigurationIsAbstractable(config)\r\n && WellFormedLConfiguration(AbstractifyCPaxosConfigurationToConfiguration(config));\r\n{\r\n if CPaxosConfigurationIsAbstractable(config) && 0 < |config.replica_ids|\r\n {\r\n //lemma_CardinalityNonEmpty(config.replica_ids);\r\n var e := config.replica_ids[0];\r\n assert AbstractifyEndPointToNodeIdentity(e) in AbstractifyCPaxosConfigurationToConfiguration(config).replica_ids;\r\n assert 0 < |AbstractifyCPaxosConfigurationToConfiguration(config).replica_ids|;\r\n var r_replicaIds := AbstractifyCPaxosConfigurationToConfiguration(config).replica_ids;\r\n forall i, j | 0 <= i < |r_replicaIds| && 0 <= j < |r_replicaIds|\r\n ensures r_replicaIds[i] == r_replicaIds[j] ==> i == j\r\n {\r\n if r_replicaIds[i] == r_replicaIds[j] {\r\n if i != j {\r\n assert r_replicaIds[i] == AbstractifyEndPointToNodeIdentity(config.replica_ids[i]);\r\n assert r_replicaIds[j] == AbstractifyEndPointToNodeIdentity(config.replica_ids[j]);\r\n lemma_AbstractifyEndPointToNodeIdentity_injective(config.replica_ids[i], config.replica_ids[j]);\r\n assert config.replica_ids[i] == config.replica_ids[j];\r\n reveal_SeqIsUnique();\r\n assert i == j;\r\n assert false;\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\npredicate WFCPaxosConfiguration(config:CPaxosConfiguration)\r\n ensures WFCPaxosConfiguration(config) ==>\r\n && CPaxosConfigurationIsAbstractable(config)\r\n && WellFormedLConfiguration(AbstractifyCPaxosConfigurationToConfiguration(config))\r\n{\r\n lemma_WFCPaxosConfiguration(config);\r\n && CPaxosConfigurationIsAbstractable(config)\r\n && 0 < |config.replica_ids|\r\n}\r\n\r\nlemma lemma_MinQuorumSizeLessThanReplicaCount(config:CPaxosConfiguration)\r\n requires CPaxosConfigurationIsAbstractable(config)\r\n requires |config.replica_ids| > 0\r\n requires SeqIsUnique(config.replica_ids)\r\n ensures LMinQuorumSize(AbstractifyCPaxosConfigurationToConfiguration(config)) <= |config.replica_ids|\r\n{\r\n assert |config.replica_ids| > 0;\r\n var h_config := AbstractifyCPaxosConfigurationToConfiguration(config);\r\n lemma_AbstractifyEndPointsToNodeIdentities_properties(config.replica_ids);\r\n assert |h_config.replica_ids| == |config.replica_ids|;\r\n assert |h_config.replica_ids| > 0;\r\n}\r\n\r\nmethod CGetReplicaIndex(replica:EndPoint, config:CPaxosConfiguration) returns (found:bool, index:uint64)\r\n requires CPaxosConfigurationIsValid(config)\r\n requires EndPointIsValidPublicKey(replica)\r\n ensures found ==> ReplicaIndexValid(index, config) && config.replica_ids[index] == replica\r\n ensures found ==> GetReplicaIndex(AbstractifyEndPointToNodeIdentity(replica), AbstractifyCPaxosConfigurationToConfiguration(config)) == index as int\r\n ensures !found ==> !(replica in config.replica_ids)\r\n ensures !found ==> !(AbstractifyEndPointToNodeIdentity(replica) in AbstractifyEndPointsToNodeIdentities(config.replica_ids))\r\n{\r\n var i:uint64 := 0;\r\n lemma_AbstractifyEndPointsToNodeIdentities_properties(config.replica_ids);\r\n\r\n while i < |config.replica_ids| as uint64\r\n invariant i < |config.replica_ids| as uint64\r\n invariant forall j :: 0 <= j < i ==> config.replica_ids[j] != replica\r\n {\r\n if replica == config.replica_ids[i] {\r\n found := true;\r\n index := i;\r\n \r\n ghost var r_replica := AbstractifyEndPointToNodeIdentity(replica);\r\n ghost var r_replicas := AbstractifyCPaxosConfigurationToConfiguration(config).replica_ids;\r\n assert r_replica == r_replicas[index];\r\n assert ItemAtPositionInSeq(r_replicas, r_replica, index as int);\r\n calc ==> {\r\n true;\r\n { reveal_SeqIsUnique(); }\r\n forall j :: 0 <= j < |config.replica_ids| && j != i as int ==> config.replica_ids[j] != replica;\r\n }\r\n\r\n if exists j :: 0 <= j < |r_replicas| && j != index as int && ItemAtPositionInSeq(r_replicas, r_replica, j) {\r\n ghost var j :| 0 <= j < |r_replicas| && j != index as int && ItemAtPositionInSeq(r_replicas, r_replica, j);\r\n assert r_replicas[j] == r_replica;\r\n assert AbstractifyEndPointToNodeIdentity(config.replica_ids[j]) == r_replica;\r\n lemma_AbstractifyEndPointToNodeIdentity_injective(config.replica_ids[i], config.replica_ids[j]);\r\n assert false;\r\n }\r\n assert forall j :: 0 <= j < |r_replicas| && j != index as int ==> !ItemAtPositionInSeq(r_replicas, r_replica, j);\r\n assert FindIndexInSeq(r_replicas, r_replica) == index as int;\r\n return;\r\n }\r\n\r\n if i == (|config.replica_ids| as uint64) - 1 {\r\n found := false;\r\n return;\r\n }\r\n\r\n i := i + 1;\r\n }\r\n found := false;\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/CTypes.i.dfy", "content": "include \"../../Protocol/RSL/Types.i.dfy\"\r\ninclude \"../Common/NodeIdentity.i.dfy\"\r\ninclude \"../../Common/Native/NativeTypes.i.dfy\"\r\ninclude \"../Common/Util.i.dfy\"\r\ninclude \"../Common/GenericRefinement.i.dfy\"\r\ninclude \"../../Common/Collections/Sets.i.dfy\"\r\ninclude \"AppInterface.i.dfy\"\r\n\r\nmodule LiveRSL__CTypes_i {\r\nimport opened AppStateMachine_s\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__NativeTypes_i\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__NetClient_i\r\nimport opened Common__Util_i\r\nimport opened Collections__Maps_i\r\nimport opened Collections__Sets_i\r\nimport opened GenericRefinement_i\r\nimport opened Concrete_NodeIdentity_i\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Ballot\r\n\r\n// Note: proposer_id is now an index into the shared configuration, not a Uint64 representation of an EndPoint\r\ndatatype CBallot = CBallot(seqno:uint64, proposer_id:uint64)\r\n\r\nfunction method BallotSize() : uint64 { Uint64Size() + Uint64Size() }\r\n\r\nfunction method CBallotIsLessThan(lhs:CBallot, rhs:CBallot) : bool\r\n{\r\n || lhs.seqno < rhs.seqno\r\n || (lhs.seqno == rhs.seqno && lhs.proposer_id < rhs.proposer_id)\r\n}\r\n\r\nfunction method CBallotIsNotGreaterThan(lhs:CBallot, rhs:CBallot) : bool\r\n{\r\n || lhs.seqno < rhs.seqno\r\n || (lhs.seqno == rhs.seqno && lhs.proposer_id <= rhs.proposer_id)\r\n}\r\n\r\npredicate CBallotIsAbstractable(ballot:CBallot)\r\n{\r\n && ballot.CBallot? // OBSERVE: Always true, but seems necessary to avoid errors below\r\n && ballot.proposer_id <= 0xFFFF_FFFF_FFFF_FFFF // We don't support more than 2^64-1 replicas. Such is life.\r\n //&& EndPointUint64Representation(ballot.proposer_id)\r\n}\r\n\r\nfunction AbstractifyCBallotToBallot(ballot:CBallot) : Ballot\r\n // the specification of the ballot does not account for a null state.\r\n requires CBallotIsAbstractable(ballot)\r\n{\r\n //Ballot(int(ballot.seqno), AbstractifyUint64ToNodeIdentity(ballot.proposer_id))\r\n Ballot(ballot.seqno as int, ballot.proposer_id as int)\r\n}\r\n\r\n\r\npredicate CCBalLeq(ba:CBallot, bb:CBallot)\r\n requires CBallotIsAbstractable(ba) && CBallotIsAbstractable(bb)\r\n{\r\n BalLeq(AbstractifyCBallotToBallot(ba), AbstractifyCBallotToBallot(bb))\r\n}\r\n\r\npredicate CCBalLt(ba:CBallot, bb:CBallot)\r\n requires CBallotIsAbstractable(ba) && CBallotIsAbstractable(bb)\r\n{\r\n BalLt(AbstractifyCBallotToBallot(ba), AbstractifyCBallotToBallot(bb))\r\n}\r\n\r\nmethod CBalLeq(ba:CBallot, bb:CBallot) returns (b:bool)\r\n requires CBallotIsAbstractable(ba) && CBallotIsAbstractable(bb)\r\n ensures b == BalLeq(AbstractifyCBallotToBallot(ba), AbstractifyCBallotToBallot(bb))\r\n ensures b == CCBalLeq(ba, bb)\r\n{\r\n if (ba.seqno < bb.seqno || (ba.seqno == bb.seqno && ba.proposer_id <= bb.proposer_id)) {\r\n b := true;\r\n } else {\r\n b := false;\r\n }\r\n}\r\n\r\nmethod CBalLt(ba:CBallot, bb:CBallot) returns (b:bool)\r\n requires CBallotIsAbstractable(ba) && CBallotIsAbstractable(bb)\r\n ensures b == BalLt(AbstractifyCBallotToBallot(ba), AbstractifyCBallotToBallot(bb))\r\n ensures b == CCBalLt(ba, bb)\r\n{\r\n if (ba.seqno < bb.seqno || (ba.seqno == bb.seqno && ba.proposer_id < bb.proposer_id)) {\r\n b := true;\r\n } else {\r\n b := false;\r\n }\r\n}\r\n\r\nlemma lemma_BallotInjective(b1:CBallot, b2:CBallot)\r\n requires CBallotIsAbstractable(b1)\r\n requires CBallotIsAbstractable(b2)\r\n requires AbstractifyCBallotToBallot(b1) == AbstractifyCBallotToBallot(b2)\r\n ensures b1 == b2\r\n{\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// OperationNumber\r\n\r\ndatatype COperationNumber = COperationNumber(n:uint64)\r\n\r\nfunction method OpNumSize() : uint64 { Uint64Size() }\r\n\r\npredicate COperationNumberIsAbstractable(opn:COperationNumber)\r\n{\r\n opn.COperationNumber? // OBSERVE: Always true, but seems necessary to avoid errors below\r\n}\r\n\r\nfunction AbstractifyCOperationNumberToOperationNumber(opn:COperationNumber) : OperationNumber\r\n // requires COperationNumberIsAbstractable(opn)\r\n ensures COperationNumberIsAbstractable(opn) ==> (0 <= AbstractifyCOperationNumberToOperationNumber(opn) <= 0xffff_ffff_ffff_ffff)\r\n{\r\n opn.n as int\r\n}\r\n\r\nlemma lemma_AbstractifyCOperationNumberToOperationNumber_isInjective() \r\n ensures forall opn1, opn2 {:trigger AbstractifyCOperationNumberToOperationNumber(opn1), AbstractifyCOperationNumberToOperationNumber(opn2)} :: COperationNumberIsAbstractable(opn1) && COperationNumberIsAbstractable(opn2) && AbstractifyCOperationNumberToOperationNumber(opn1) == AbstractifyCOperationNumberToOperationNumber(opn2) ==> opn1 == opn2\r\n{\r\n}\r\n\r\nfunction AbstractifyCOperationNumbersToOperationNumbers(copns:set):set\r\n requires forall opn :: opn in copns ==> COperationNumberIsAbstractable(opn)\r\n{\r\n set copn | copn in copns :: AbstractifyCOperationNumberToOperationNumber(copn)\r\n}\r\n\r\nlemma lemma_AbstractifyCOperationNumbersToOperationNumbers_maintainsSize(copns:set)\r\n requires forall opn :: opn in copns ==> COperationNumberIsAbstractable(opn)\r\n ensures |copns| == |AbstractifyCOperationNumbersToOperationNumbers(copns)|\r\n{\r\n var opns := AbstractifyCOperationNumbersToOperationNumbers(copns);\r\n lemma_AbstractifyCOperationNumberToOperationNumber_isInjective();\r\n\r\n var f := AbstractifyCOperationNumberToOperationNumber;\r\n assert forall x :: x in copns ==> f(x) in opns;\r\n forall opn1, opn2 | f(opn1) == f(opn2)\r\n ensures opn1 == opn2\r\n {\r\n }\r\n assert forall x :: f(x) in opns ==> x in copns;\r\n\r\n lemma_MapSetCardinality(copns, opns, f);\r\n}\r\n\r\n\r\n////////////////////////////////////////////////\r\n// CRequest\r\n////////////////////////////////////////////////\r\n\r\ndatatype CRequest = CRequest(client:EndPoint, seqno:uint64, request:CAppRequest)\r\n\r\npredicate method ValidRequest(c:CRequest)\r\n{\r\n c.CRequest? ==> EndPointIsValidPublicKey(c.client) && CAppRequestMarshallable(c.request)\r\n}\r\n\r\npredicate CRequestIsAbstractable(c:CRequest)\r\n{\r\n EndPointIsAbstractable(c.client) && CAppRequestIsAbstractable(c.request)\r\n}\r\n\r\nfunction AbstractifyCRequestToRequest(c:CRequest) : Request\r\n requires CRequestIsAbstractable(c)\r\n{\r\n Request(AbstractifyEndPointToNodeIdentity(c.client), c.seqno as int, AbstractifyCAppRequestToAppRequest(c.request)) \r\n}\r\n\r\nlemma lemma_AbstractifyCRequestToRequest_isInjective()\r\n ensures forall v1, v2 :: CRequestIsAbstractable(v1) && CRequestIsAbstractable(v2) && AbstractifyCRequestToRequest(v1) == AbstractifyCRequestToRequest(v2) ==> v1 == v2\r\n{\r\n// assert forall u1:uint64, u2:uint64 :: u1 as int == u2 as int ==> u1 == u2;\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n}\r\n\r\n\r\npredicate CRequestsSeqIsAbstractable(cvals:seq)\r\n{\r\n forall cval :: cval in cvals ==> CRequestIsAbstractable(cval)\r\n}\r\n\r\n\r\nfunction {:opaque} AbstractifyCRequestsSeqToRequestsSeq(cvals:seq) : seq\r\n requires CRequestsSeqIsAbstractable(cvals)\r\n ensures |cvals| == |AbstractifyCRequestsSeqToRequestsSeq(cvals)|\r\n ensures forall i {:trigger AbstractifyCRequestsSeqToRequestsSeq(cvals)[i]} :: 0 <= i < |cvals| ==> AbstractifyCRequestToRequest(cvals[i]) == AbstractifyCRequestsSeqToRequestsSeq(cvals)[i]\r\n ensures forall c :: CRequestIsAbstractable(c) ==> (c in cvals <==> AbstractifyCRequestToRequest(c) in AbstractifyCRequestsSeqToRequestsSeq(cvals))\r\n{ \r\n lemma_AbstractifyCRequestToRequest_isInjective();\r\n if |cvals| == 0 then []\r\n else [AbstractifyCRequestToRequest(cvals[0])] + AbstractifyCRequestsSeqToRequestsSeq(cvals[1..])\r\n}\r\n\r\nlemma lemma_SequenceIndexing(s:seq, s':seq, index:int)\r\n requires |s| <= index < |s| + |s'|\r\n ensures (s + s')[index] == s'[index - |s|]\r\n{\r\n}\r\n\r\nlemma lemma_AbstractifyCRequestsSeqToRequestsSeq_concat(r1:seq, r2:seq)\r\n requires CRequestsSeqIsAbstractable(r1)\r\n requires CRequestsSeqIsAbstractable(r2)\r\n ensures AbstractifyCRequestsSeqToRequestsSeq(r1) + AbstractifyCRequestsSeqToRequestsSeq(r2) == AbstractifyCRequestsSeqToRequestsSeq(r1 + r2)\r\n ensures CRequestsSeqIsAbstractable(r1 + r2)\r\n{\r\n if |r1| == 0 {\r\n\r\n } else {\r\n var r_cat := AbstractifyCRequestsSeqToRequestsSeq(r1) + AbstractifyCRequestsSeqToRequestsSeq(r2);\r\n forall i | 0 <= i < |AbstractifyCRequestsSeqToRequestsSeq(r1 + r2)|\r\n ensures (r_cat)[i] == AbstractifyCRequestsSeqToRequestsSeq(r1 + r2)[i]\r\n {\r\n assert AbstractifyCRequestsSeqToRequestsSeq(r1 + r2)[i] == AbstractifyCRequestToRequest((r1+r2)[i]);\r\n if i < |r1| {\r\n assert (r1+r2)[i] == r1[i];\r\n } else {\r\n lemma_SequenceIndexing(r1, r2, i); \r\n assert (r1+r2)[i] == r2[i-|r1|];\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_AbstractifyCRequestsSeqToRequestsSeq_suffix(r:seq, n:int)\r\n requires 0 <= n <= |r|\r\n requires CRequestsSeqIsAbstractable(r)\r\n ensures AbstractifyCRequestsSeqToRequestsSeq(r[n..]) == AbstractifyCRequestsSeqToRequestsSeq(r)[n..]\r\n ensures AbstractifyCRequestsSeqToRequestsSeq(r[..n]) == AbstractifyCRequestsSeqToRequestsSeq(r)[..n]\r\n{\r\n}\r\n\r\n////////////////////////////////////////////////\r\n// CRequestBatch\r\n////////////////////////////////////////////////\r\n\r\ntype CRequestBatch = seq\r\n\r\nfunction method RequestBatchSizeLimit() : int { 100 } //{ 0xFFFF }\r\n \r\npredicate ValidRequestBatch(c:CRequestBatch)\r\n{\r\n (forall cr :: cr in c ==> ValidRequest(cr)) && |c| <= RequestBatchSizeLimit()\r\n}\r\n\r\npredicate CRequestBatchIsAbstractable(c:CRequestBatch)\r\n{\r\n CRequestsSeqIsAbstractable(c)\r\n}\r\n\r\npredicate CRequestBatchSeqIsAbstractable(s:seq)\r\n{\r\n forall cval :: cval in s ==> CRequestBatchIsAbstractable(cval)\r\n}\r\n\r\nfunction {:opaque} AbstractifyCRequestBatchToRequestBatch(cvals:CRequestBatch) : RequestBatch\r\n requires CRequestsSeqIsAbstractable(cvals)\r\n ensures |cvals| == |AbstractifyCRequestBatchToRequestBatch(cvals)|\r\n ensures forall i :: 0 <= i < |cvals| ==> AbstractifyCRequestToRequest(cvals[i]) == AbstractifyCRequestBatchToRequestBatch(cvals)[i]\r\n ensures forall c :: CRequestIsAbstractable(c) ==> (c in cvals <==> AbstractifyCRequestToRequest(c) in AbstractifyCRequestBatchToRequestBatch(cvals))\r\n{\r\n AbstractifyCRequestsSeqToRequestsSeq(cvals)\r\n}\r\n\r\nlemma lemma_AbstractifyCRequestBatchToRequestBatch_isInjective()\r\n ensures forall v1, v2 :: CRequestBatchIsAbstractable(v1) && CRequestBatchIsAbstractable(v2) && AbstractifyCRequestBatchToRequestBatch(v1) == AbstractifyCRequestBatchToRequestBatch(v2) ==> v1 == v2\r\n{\r\n forall v1, v2 | CRequestBatchIsAbstractable(v1) && CRequestBatchIsAbstractable(v2) && AbstractifyCRequestBatchToRequestBatch(v1) == AbstractifyCRequestBatchToRequestBatch(v2)\r\n ensures v1 == v2\r\n {\r\n assert |v1| == |AbstractifyCRequestBatchToRequestBatch(v1)|;\r\n assert |v1| == |v2|;\r\n forall i | 0 <= i < |v1|\r\n ensures v1[i] == v2[i]\r\n {\r\n assert AbstractifyCRequestBatchToRequestBatch(v1)[i] == AbstractifyCRequestBatchToRequestBatch(v2)[i];\r\n lemma_AbstractifyCRequestToRequest_isInjective();\r\n }\r\n reveal AbstractifyCRequestBatchToRequestBatch();\r\n }\r\n}\r\n\r\n////////////////////////////////////////////////\r\n// CReply (Almost identical to CRequest)\r\n////////////////////////////////////////////////\r\n// Not yet in use. Will be needed for the reply cache. \r\ndatatype CReply = CReply (client:EndPoint, seqno:uint64, reply:CAppReply)\r\n\r\npredicate method ValidReply(c:CReply)\r\n{\r\n c.CReply? ==> EndPointIsValidPublicKey(c.client) && CAppReplyMarshallable(c.reply)\r\n}\r\n\r\npredicate CReplyIsAbstractable(c:CReply)\r\n{\r\n EndPointIsAbstractable(c.client) && CAppReplyIsAbstractable(c.reply)\r\n}\r\n\r\nfunction AbstractifyCReplyToReply(c:CReply) : Reply\r\n requires CReplyIsAbstractable(c)\r\n{\r\n Reply(AbstractifyEndPointToNodeIdentity(c.client), c.seqno as int, AbstractifyCAppReplyToAppReply(c.reply))\r\n}\r\n\r\nlemma lemma_AbstractifyCReplyToReply_isInjective()\r\n ensures forall v1, v2 :: CReplyIsAbstractable(v1) && CReplyIsAbstractable(v2) && AbstractifyCReplyToReply(v1) == AbstractifyCReplyToReply(v2) ==> v1 == v2\r\n{\r\n// assert forall u1:uint64, u2:uint64 :: u1 as int == u2 as int ==> u1 == u2;\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n}\r\n\r\npredicate CReplySeqIsAbstractable(creplies:seq)\r\n{\r\n forall creply :: creply in creplies ==> CReplyIsAbstractable(creply)\r\n}\r\n\r\nfunction {:opaque} AbstractifyCReplySeqToReplySeq(s:seq) : seq\r\n requires CReplySeqIsAbstractable(s)\r\n ensures |AbstractifyCReplySeqToReplySeq(s)| == |s|\r\n ensures forall i :: 0 <= i < |AbstractifyCReplySeqToReplySeq(s)| ==> AbstractifyCReplySeqToReplySeq(s)[i] == AbstractifyCReplyToReply(s[i])\r\n{\r\n if |s| == 0 then\r\n []\r\n else\r\n [AbstractifyCReplyToReply(s[0])] + AbstractifyCReplySeqToReplySeq(s[1..])\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// ReplyCache\r\n\r\ntype CReplyCache = map\r\n\r\npredicate CReplyCacheIsAbstractable(m:CReplyCache)\r\n{\r\n forall e {:trigger EndPointIsValidPublicKey(e)} :: e in m ==> EndPointIsValidPublicKey(e) && CReplyIsAbstractable(m[e])\r\n}\r\n\r\nfunction max_reply_cache_size() : int { 256 } // 0x1_0000_0000\r\n\r\npredicate ValidReplyCache(m:CReplyCache)\r\n{\r\n && CReplyCacheIsAbstractable(m) && |m| < max_reply_cache_size()\r\n && (forall e {:trigger ValidReply(m[e])} :: e in m ==> ValidReply(m[e]))\r\n}\r\n\r\nfunction {:opaque} AbstractifyCReplyCacheToReplyCache(m:CReplyCache) : ReplyCache\r\n requires CReplyCacheIsAbstractable(m)\r\n{\r\n assert forall e :: e in m ==> EndPointIsValidPublicKey(e);\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n // var test:CReply->Reply := (AbstractifyCReplyToReply as CReply->Reply);\r\n AbstractifyMap(m, AbstractifyEndPointToNodeIdentity, AbstractifyCReplyToReply, RefineNodeIdentityToEndPoint)\r\n}\r\n\r\nlemma lemma_AbstractifyCReplyCacheToReplyCache_properties(m:CReplyCache)\r\n requires CReplyCacheIsAbstractable(m)\r\n ensures m == map [] ==> AbstractifyCReplyCacheToReplyCache(m) == map []\r\n ensures forall e {:trigger e in m}{:trigger e in AbstractifyCReplyCacheToReplyCache(m)} :: (e in m <==> EndPointIsValidPublicKey(e) && e in AbstractifyCReplyCacheToReplyCache(m))\r\n ensures forall e {:trigger e in m, EndPointIsValidPublicKey(e)}{:trigger e in AbstractifyCReplyCacheToReplyCache(m)} :: (e !in m && EndPointIsValidPublicKey(e) ==> e !in AbstractifyCReplyCacheToReplyCache(m))\r\n ensures forall e {:trigger AbstractifyCReplyToReply(m[e])}{:trigger AbstractifyCReplyCacheToReplyCache(m)[e]} :: e in m ==> AbstractifyCReplyCacheToReplyCache(m)[e] == AbstractifyCReplyToReply(m[e])\r\n ensures forall re :: re in AbstractifyCReplyCacheToReplyCache(m) ==> re in m\r\n ensures forall e, r {:trigger EndPointIsValidPublicKey(e), ValidReply(r)} :: EndPointIsValidPublicKey(e) && ValidReply(r) ==> \r\n var rm := AbstractifyCReplyCacheToReplyCache(m);\r\n var rm' := AbstractifyCReplyCacheToReplyCache(m[e := r]);\r\n rm' == AbstractifyCReplyCacheToReplyCache(m)[AbstractifyEndPointToNodeIdentity(e) := AbstractifyCReplyToReply(r)]\r\n ensures forall e {:trigger RemoveElt(m,e)} :: \r\n (EndPointIsValidPublicKey(e) && NodeIdentityIsRefinable(AbstractifyEndPointToNodeIdentity(e))\r\n && RefineNodeIdentityToEndPoint(AbstractifyEndPointToNodeIdentity(e)) == e && e in m) ==>\r\n var rm := AbstractifyCReplyCacheToReplyCache(m); \r\n var rm' := AbstractifyCReplyCacheToReplyCache(RemoveElt(m, e));\r\n rm' == RemoveElt(rm, e)\r\n{\r\n assert forall e :: e in m ==> EndPointIsValidPublicKey(e);\r\n reveal AbstractifyCReplyCacheToReplyCache();\r\n lemma_AbstractifyMap_properties(m, AbstractifyEndPointToNodeIdentity, AbstractifyCReplyToReply, RefineNodeIdentityToEndPoint);\r\n}\r\n\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// MapOfSeqNums\r\n\r\n\r\npredicate MapOfSeqNumsIsAbstractable(m:map)\r\n{\r\n forall e :: e in m ==> EndPointIsValidPublicKey(e)\r\n}\r\n\r\nfunction {:opaque} AbstractifyMapOfSeqNums(m:map) : map\r\n requires MapOfSeqNumsIsAbstractable(m)\r\n{\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n AbstractifyMap(m, AbstractifyEndPointToNodeIdentity, uint64_to_int, RefineNodeIdentityToEndPoint)\r\n}\r\n\r\nlemma lemma_AbstractifyMapOfSeqNums_properties(m:map)\r\n requires MapOfSeqNumsIsAbstractable(m)\r\n ensures m == map [] ==> AbstractifyMapOfSeqNums(m) == map []\r\n ensures forall e :: (e in m <==> EndPointIsValidPublicKey(e) && AbstractifyEndPointToNodeIdentity(e) in AbstractifyMapOfSeqNums(m))\r\n ensures forall e :: (e !in m && EndPointIsValidPublicKey(e) ==> AbstractifyEndPointToNodeIdentity(e) !in AbstractifyMapOfSeqNums(m))\r\n ensures forall e :: e in m ==> AbstractifyMapOfSeqNums(m)[AbstractifyEndPointToNodeIdentity(e)] == m[e] as int\r\n ensures forall e, u {:trigger AbstractifyMapOfSeqNums(m[e := u])} :: EndPointIsValidPublicKey(e) ==> \r\n var rm := AbstractifyMapOfSeqNums(m);\r\n var rm' := AbstractifyMapOfSeqNums(m[e := u]);\r\n rm' == AbstractifyMapOfSeqNums(m)[AbstractifyEndPointToNodeIdentity(e) := u as int]\r\n{\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n assert forall ck1, ck2 :: EndPointIsValidPublicKey(ck1) && EndPointIsValidPublicKey(ck2) && AbstractifyEndPointToNodeIdentity(ck1) == AbstractifyEndPointToNodeIdentity(ck2) ==> ck1 == ck2;\r\n assert forall ck1, ck2 :: AbstractifyEndPointToNodeIdentity.requires(ck1) && AbstractifyEndPointToNodeIdentity.requires(ck2) && AbstractifyEndPointToNodeIdentity(ck1) == AbstractifyEndPointToNodeIdentity(ck2) ==> ck1 == ck2;\r\n\r\n reveal AbstractifyMapOfSeqNums();\r\n lemma_AbstractifyMap_properties(m, AbstractifyEndPointToNodeIdentity, uint64_to_int, RefineNodeIdentityToEndPoint);\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Vote\r\n\r\ndatatype CVote = CVote(max_value_bal:CBallot, max_val:CRequestBatch)\r\ndatatype CVotes = CVotes(v:map)\r\n\r\nfunction ValidVote(vote:CVote) : bool\r\n{\r\n ValidRequestBatch(vote.max_val)\r\n}\r\n\r\nfunction method max_votes_len() : int { 8 } // previously 0x10_0000\r\n\r\nfunction ValidVotes(votes:CVotes) : bool\r\n{\r\n && |votes.v| < max_votes_len()\r\n && (forall o :: o in votes.v ==> ValidVote(votes.v[o]))\r\n}\r\n\r\npredicate CVoteIsAbstractable(vote:CVote)\r\n{\r\n && vote.CVote? // OBSERVE: Always true, but seems necessary to avoid errors below\r\n && CBallotIsAbstractable(vote.max_value_bal)\r\n && CRequestBatchIsAbstractable(vote.max_val)\r\n}\r\n\r\nfunction AbstractifyCVoteToVote(vote:CVote) : Vote\r\n requires CVoteIsAbstractable(vote)\r\n{\r\n Vote(AbstractifyCBallotToBallot(vote.max_value_bal), AbstractifyCRequestBatchToRequestBatch(vote.max_val))\r\n}\r\n\r\npredicate CVotesIsAbstractable(votes:CVotes)\r\n{\r\n forall i :: i in votes.v ==> COperationNumberIsAbstractable(i) && CVoteIsAbstractable(votes.v[i])\r\n}\r\n\r\nlemma lemma_AbstractifyMapOfThings(m:map, newDomain:set)\r\n requires newDomain == set i | i in m :: AbstractifyCOperationNumberToOperationNumber(i)\r\n ensures forall o :: o in newDomain ==> 0<=o<0x10000000000000000\r\n ensures forall o :: o in newDomain ==> COperationNumber(o as uint64) in m\r\n{\r\n forall o | o in newDomain\r\n ensures 0<=o<0x10000000000000000\r\n ensures COperationNumber(o as uint64) in m\r\n {\r\n var i :| i in m && o==AbstractifyCOperationNumberToOperationNumber(i);\r\n assert 0 <= i.n as int < 0x10000000000000000;\r\n }\r\n}\r\n\r\nfunction {:opaque} AbstractifyCVotesToVotes(votes:CVotes) : Votes\r\n requires CVotesIsAbstractable(votes)\r\n{\r\n // var newDomain := set i | i in votes.v :: AbstractifyCOperationNumberToOperationNumber(i);\r\n lemma_AbstractifyMapOfThings(votes.v, set i | i in votes.v :: AbstractifyCOperationNumberToOperationNumber(i));\r\n // map i | i in newDomain :: AbstractifyCVoteToVote(votes.v[COperationNumber(i as uint64)])\r\n map j {:trigger votes.v[COperationNumber(j as uint64)]} | j in (set i | i in votes.v :: AbstractifyCOperationNumberToOperationNumber(i)) :: AbstractifyCVoteToVote(votes.v[COperationNumber(j as uint64)])\r\n}\r\n\r\nlemma lemma_VotesInjective(v1:CVotes, v2:CVotes)\r\n requires CVotesIsAbstractable(v1)\r\n requires CVotesIsAbstractable(v2)\r\n requires AbstractifyCVotesToVotes(v1) == AbstractifyCVotesToVotes(v2)\r\n ensures v1 == v2\r\n{\r\n reveal AbstractifyCVotesToVotes();\r\n forall k | k in v1.v ensures k in v2.v\r\n {\r\n assert AbstractifyCOperationNumberToOperationNumber(k) in AbstractifyCVotesToVotes(v1);\r\n assert AbstractifyCOperationNumberToOperationNumber(k) in AbstractifyCVotesToVotes(v2);\r\n assert k in v2.v;\r\n }\r\n forall k | k in v2.v ensures k in v1.v\r\n {\r\n assert AbstractifyCOperationNumberToOperationNumber(k) in AbstractifyCVotesToVotes(v2);\r\n assert AbstractifyCOperationNumberToOperationNumber(k) in AbstractifyCVotesToVotes(v1);\r\n assert k in v1.v;\r\n }\r\n assert domain(v1.v)==domain(v2.v);\r\n forall k | k in domain(v1.v) ensures v1.v[k] == v2.v[k];\r\n {\r\n assert AbstractifyCVoteToVote(v1.v[k]) == AbstractifyCVotesToVotes(v1)[AbstractifyCOperationNumberToOperationNumber(k)]; // OBSERVER trigger map\r\n assert AbstractifyCVoteToVote(v2.v[k]) == AbstractifyCVotesToVotes(v2)[AbstractifyCOperationNumberToOperationNumber(k)]; // OBSERVER trigger map\r\n\r\n assert AbstractifyCBallotToBallot(v1.v[k].max_value_bal) == AbstractifyCBallotToBallot(v2.v[k].max_value_bal);\r\n// assert v1.v[k].max_value_bal.seqno == v2.v[k].max_value_bal.seqno;\r\n lemma_BallotInjective(v1.v[k].max_value_bal, v2.v[k].max_value_bal);\r\n\r\n assert AbstractifyCRequestBatchToRequestBatch(v1.v[k].max_val) == AbstractifyCRequestBatchToRequestBatch(v2.v[k].max_val);\r\n lemma_AbstractifyCRequestBatchToRequestBatch_isInjective();\r\n assert v1.v[k].max_val == v2.v[k].max_val;\r\n }\r\n assert v1.v==v2.v;\r\n assert v1==v2;\r\n}\r\n\r\n/////////////////////\r\n// LearnerDecidableOpn\r\n\r\ndatatype OptionOpn = ExistsOperation(opn:COperationNumber) \r\n | NotExistsOperation()\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/CmdLineParser.i.dfy", "content": "include \"../Common/CmdLineParser.i.dfy\"\r\ninclude \"CPaxosConfiguration.i.dfy\"\r\n\r\nmodule PaxosCmdLineParser_i {\r\n\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened CmdLineParser_i\r\nimport opened Common__NetClient_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\n\r\nfunction paxos_config_parsing(args:seq>) : CPaxosConfiguration\r\n{\r\n var (_, endpoints) := parse_end_points(args);\r\n CPaxosConfiguration(endpoints)\r\n}\r\n\r\nfunction paxos_parse_id(arg:seq) : EndPoint\r\n{\r\n var (_, ep) := parse_end_point(arg);\r\n ep\r\n}\r\n\r\nmethod parse_cmd_line(id:EndPoint, args:seq>) returns (ok:bool, config:CPaxosConfiguration, my_index:uint64)\r\n requires EndPointIsValidPublicKey(id)\r\n ensures ok ==> && CPaxosConfigurationIsValid(config)\r\n && |config.replica_ids| > 0\r\n && 0 <= my_index as int < |config.replica_ids|\r\n && config == paxos_config_parsing(args)\r\n && config.replica_ids[my_index] == id\r\n{\r\n var tuple1 := parse_end_points(args);\r\n ok := tuple1.0;\r\n if !ok {\r\n print \"Error encountered while processing command-line arguments\";\r\n return;\r\n }\r\n var endpoints := tuple1.1;\r\n\r\n if |endpoints| < 1 {\r\n print \"Must have at least one replica.\\n\";\r\n ok := false;\r\n return;\r\n }\r\n\r\n if |endpoints| >= 0xffff_ffff_ffff_ffff {\r\n print \"Internal error: impossibly many endpoints.\\n\";\r\n ok := false;\r\n return;\r\n }\r\n\r\n var unique := test_unique(endpoints);\r\n if !unique {\r\n print \"Error: Each endpoint must be unique.\\n\";\r\n ok := false;\r\n return;\r\n }\r\n\r\n config := CPaxosConfiguration(endpoints);\r\n lemma_MinQuorumSizeLessThanReplicaCount(config);\r\n\r\n ok, my_index := CGetReplicaIndex(id, config);\r\n if !ok {\r\n print \"Error: Could not find local endpoint (last command-line endpoint) in list of preceding endpoints\\n\";\r\n return;\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ConstantsState.i.dfy", "content": "include \"CPaxosConfiguration.i.dfy\"\r\n\r\nmodule LiveRSL__ConstantsState_i {\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__ParametersState_i\r\n\r\ndatatype ConstantsState = ConstantsState(\r\n config:CPaxosConfiguration,\r\n params:ParametersState\r\n )\r\n\r\npredicate ConstantsStateIsAbstractable(constants:ConstantsState)\r\n{\r\n CPaxosConfigurationIsAbstractable(constants.config)\r\n}\r\n\r\npredicate WFConstantsState(constants:ConstantsState)\r\n{\r\n && WFCPaxosConfiguration(constants.config)\r\n && WFParametersState(constants.params)\r\n}\r\n\r\npredicate ConstantsStateIsValid(cs:ConstantsState)\r\n{\r\n && CPaxosConfigurationIsValid(cs.config)\r\n && ConstantsStateIsAbstractable(cs)\r\n && WFConstantsState(cs)\r\n && cs.params.max_integer_val > cs.params.max_log_length > 0\r\n && cs.params.max_log_length as int < max_votes_len()\r\n && cs.params.max_integer_val < 0x8000_0000_0000_0000\r\n && 0 <= cs.params.heartbeat_period < cs.params.max_integer_val\r\n && 0 < cs.params.max_batch_size as int <= RequestBatchSizeLimit()\r\n}\r\n\r\nfunction AbstractifyConstantsStateToLConstants(constants:ConstantsState) : LConstants\r\n requires ConstantsStateIsAbstractable(constants)\r\n{\r\n LConstants(\r\n AbstractifyCPaxosConfigurationToConfiguration(constants.config),\r\n AbstractifyParametersStateToLParameters(constants.params))\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ElectionModel.i.dfy", "content": "include \"ElectionState.i.dfy\"\r\ninclude \"../Common/NodeIdentity.i.dfy\"\r\ninclude \"MinCQuorumSize.i.dfy\"\r\ninclude \"../Common/Util.i.dfy\"\r\ninclude \"../Common/UpperBound.i.dfy\"\r\n\r\nmodule LiveRSL__ElectionModel_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__ConstantsState_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__Election_i\r\nimport opened LiveRSL__ElectionState_i\r\nimport opened LiveRSL__MinCQuorumSize_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__SeqIsUnique_i\r\nimport opened Common__SeqIsUniqueDef_i\r\nimport opened Common__UpperBound_s\r\nimport opened Common__UpperBound_i\r\nimport opened Common__Util_i\r\nimport opened Collections__Seqs_s\r\nimport opened Collections__Sets_i\r\n\r\n// Same as x == y, but triggers extensional equality on fields and provides better error diagnostics\r\npredicate Eq_ElectionState(x:ElectionState, y:ElectionState)\r\n{\r\n && x.constants == y.constants\r\n && x.current_view == y.current_view\r\n && x.current_view_suspectors == y.current_view_suspectors\r\n && x.epoch_end_time == y.epoch_end_time\r\n && x.epoch_length == y.epoch_length\r\n && x.requests_received_this_epoch == y.requests_received_this_epoch\r\n && x.requests_received_prev_epochs == y.requests_received_prev_epochs\r\n}\r\n\r\n//////////////////////\r\n// BALLOT MATH\r\n//////////////////////\r\n\r\nmethod CComputeSuccessorView(cb:CBallot, constants:ConstantsState) returns(cb':CBallot)\r\n requires CBallotIsAbstractable(cb)\r\n requires ConstantsStateIsAbstractable(constants)\r\n requires CPaxosConfigurationIsValid(constants.config)\r\n requires cb.seqno < 0xFFFF_FFFF_FFFF_FFFF\r\n ensures CBallotIsAbstractable(cb')\r\n ensures ComputeSuccessorView(AbstractifyCBallotToBallot(cb), AbstractifyConstantsStateToLConstants(constants)) == AbstractifyCBallotToBallot(cb')\r\n{\r\n ghost var b := AbstractifyCBallotToBallot(cb);\r\n\r\n if cb.proposer_id < (|constants.config.replica_ids| as uint64) - 1 { \r\n cb' := CBallot(cb.seqno, cb.proposer_id + 1);\r\n } else {\r\n cb' := CBallot(cb.seqno + 1, 0);\r\n }\r\n}\r\n\r\nfunction ElectionStateUpdateValueSetsToReflectNextEpoch(es:ElectionState):ElectionState\r\n{\r\n es.(requests_received_this_epoch := [],\r\n requests_received_prev_epochs := es.requests_received_prev_epochs + es.requests_received_this_epoch)\r\n}\r\n\r\n//function method CElectionStateValueSetsReflectNewView(es:CElectionState):CElectionState\r\n// requires CElectionStateIsAbstractable(es)\r\n// ensures CElectionStateIsAbstractable(CElectionStateValueSetsReflectNewView(es))\r\n// ensures ElectionStateUpdateValueSetsToReflectNextEpoch(AbstractifyCElectionStateToElectionState(es)) \r\n// == AbstractifyCElectionStateToElectionState(CElectionStateValueSetsReflectNewView(es))\r\n//{\r\n// lemma_AbstractifyCRequestsSeqToRequestsSeq_concat(es.requests_received_prev_epochs, es.requests_received_this_epoch);\r\n// es[requests_received_this_epoch := []]\r\n// [requests_received_prev_epochs := es.requests_received_prev_epochs + es.requests_received_this_epoch]\r\n//}\r\n\r\n//////////////////////\r\n// SEQUENCE MATH\r\n//////////////////////\r\n\r\nfunction method BoundCRequestSequence(s:seq, lengthBound:uint64):(bool,seq)\r\n requires |s| < 0x1_0000_0000_0000_0000\r\n{\r\n if 0 <= lengthBound < (|s| as uint64) then (true, s[..lengthBound]) else (false,s)\r\n}\r\n\r\nlemma lemma_BoundCRequestSequence(s:seq, lengthBound:uint64)\r\n requires |s| < 0x1_0000_0000_0000_0000\r\n requires CRequestsSeqIsAbstractable(s)\r\n ensures BoundRequestSequence(AbstractifyCRequestsSeqToRequestsSeq(s), UpperBoundFinite(lengthBound as int))\r\n == AbstractifyCRequestsSeqToRequestsSeq(BoundCRequestSequence(s, lengthBound).1)\r\n ensures |BoundCRequestSequence(s, lengthBound).1| <= lengthBound as int\r\n{\r\n}\r\n\r\nlemma FindMatchingRequest(s:seq, headers:set, header:CRequestHeader) returns (index:int)\r\n requires HeadersMatch(s, headers)\r\n requires header in headers\r\n requires |s| >= 1\r\n ensures 0 <= index < |s|\r\n ensures CRequestHeader(s[index].client, s[index].seqno) == header\r\n{\r\n if |s| == 1 {\r\n assert CRequestHeader(s[0].client, s[0].seqno) in headers;\r\n assert |headers| == 1;\r\n ThingsIKnowAboutASingletonSet(headers, CRequestHeader(s[0].client, s[0].seqno), header);\r\n return 0;\r\n } else {\r\n var head := CRequestHeader(s[0].client, s[0].seqno);\r\n if head == header {\r\n return 0;\r\n } else {\r\n var new_set := headers - { head };\r\n forall r | r in s[1..]\r\n ensures CRequestHeader(r.client, r.seqno) in new_set;\r\n {\r\n if CRequestHeader(r.client, r.seqno) != head {\r\n assert CRequestHeader(r.client, r.seqno) in new_set;\r\n } else {\r\n var j :| 0 <= j < |s[1..]| && s[1..][j] == r;\r\n assert s[j+1] == s[1..][j] == r;\r\n assert CRequestsMatch(s[0], s[j+1]);\r\n assert j+1 == 0;\r\n assert false;\r\n }\r\n }\r\n index := FindMatchingRequest(s[1..], new_set, header);\r\n index := index + 1;\r\n }\r\n }\r\n}\r\n \r\n// This is inefficient, but we never expect to call it in practice, since we shouldn't exceed lengthBound\r\nmethod BoundCRequestHeaders(s:seq, ghost headers:set, lengthBound:uint64, cur_req_set:MutableSet)\r\n returns (ghost new_headers:set)\r\n requires |s| < 0x1_0000_0000_0000_0000\r\n requires HeadersMatch(s, headers)\r\n requires |s| > lengthBound as int\r\n modifies cur_req_set\r\n ensures HeadersMatch(BoundCRequestSequence(s, lengthBound).1, new_headers)\r\n ensures forall h :: h in new_headers ==> h in headers\r\n ensures MutableSet.SetOf(cur_req_set) == new_headers\r\n{\r\n var i := 0;\r\n new_headers := {};\r\n cur_req_set.RemoveAll();\r\n\r\n while i < lengthBound as int\r\n invariant 0 <= i <= lengthBound as int;\r\n invariant HeadersMatch(s[..i], new_headers)\r\n invariant forall h :: h in new_headers ==> h in headers\r\n invariant MutableSet.SetOf(cur_req_set) == new_headers\r\n {\r\n var new_header := CRequestHeader(s[i].client, s[i].seqno);\r\n if new_header in new_headers {\r\n var j := FindMatchingRequest(s[..i], new_headers, new_header); \r\n assert CRequestsMatch(s[j], s[i]);\r\n assert false;\r\n }\r\n new_headers := new_headers + { new_header };\r\n cur_req_set.Add(new_header);\r\n i := i + 1;\r\n }\r\n}\r\n\r\n\r\n//////////////////////\r\n// REQUESTS\r\n//////////////////////\r\n\r\nfunction {:fuel 5,6} RemoveAllSatisfiedCRequestsInSequence(s:seq, r:CRequest):seq\r\n ensures forall r' :: r' in RemoveAllSatisfiedCRequestsInSequence(s, r) ==> r' in s\r\n{\r\n if |s| == 0 then\r\n []\r\n else if CRequestSatisfiedBy(s[0], r) then\r\n RemoveAllSatisfiedCRequestsInSequence(s[1..], r)\r\n else\r\n [s[0]] + RemoveAllSatisfiedCRequestsInSequence(s[1..], r)\r\n}\r\n\r\nfunction {:fuel 5,6} RemoveAllSatisfiedCRequestsInSequenceAlt(s:seq, r:CRequest):seq\r\n{\r\n if |s| == 0 then\r\n []\r\n else if CRequestSatisfiedBy(last(s), r) then\r\n RemoveAllSatisfiedCRequestsInSequence(all_but_last(s), r)\r\n else\r\n RemoveAllSatisfiedCRequestsInSequence(all_but_last(s), r) + [last(s)]\r\n}\r\n\r\nlemma lemma_RemoveAllSatisfiedCRequestsInSequenceAltEquivalent(s:seq, r:CRequest)\r\n ensures RemoveAllSatisfiedCRequestsInSequence(s, r) == RemoveAllSatisfiedCRequestsInSequenceAlt(s, r)\r\n{\r\n if |s| == 0 || |s| == 1 {\r\n return;\r\n }\r\n\r\n lemma_RemoveAllSatisfiedCRequestsInSequenceAltEquivalent(s[1..], r);\r\n lemma_RemoveAllSatisfiedCRequestsInSequenceAltEquivalent(all_but_last(s[1..]), r);\r\n assert all_but_last(s)[0] == s[0];\r\n assert all_but_last(s)[1..] == all_but_last(s[1..]);\r\n}\r\n\r\nlemma lemma_RemoveAllSatisfiedCRequestsInSequenceUpdate(s:seq, r:CRequest, i:int)\r\n requires 0 <= i < |s|\r\n ensures RemoveAllSatisfiedCRequestsInSequence(s[..i+1], r) == RemoveAllSatisfiedCRequestsInSequence(s[..i], r) + if CRequestSatisfiedBy(s[i], r) then [] else [s[i]]\r\n{\r\n var s' := s[..i+1];\r\n assert last(s') == s[i];\r\n assert all_but_last(s') == s[..i];\r\n lemma_RemoveAllSatisfiedCRequestsInSequenceAltEquivalent(s', r);\r\n}\r\n\r\nfunction HeadersFromPrefix(s:seq, i:int):set\r\n requires 0 <= i <= |s|\r\n{\r\n set j | 0 <= j < i :: CRequestHeader(s[j].client, s[j].seqno)\r\n}\r\n\r\nlemma lemma_HeadersFromPrefixIncrease(s:seq, i:int)\r\n requires 0 <= i\r\n requires i+1 <= |s|\r\n ensures HeadersFromPrefix(s, i+1) == HeadersFromPrefix(s, i) + { CRequestHeader(s[i].client, s[i].seqno) }\r\n{\r\n}\r\n\r\nlemma lemma_EmptyHeadersMatch(\r\n s:seq,\r\n headers:set\r\n )\r\n requires s == []\r\n requires headers == {}\r\n ensures HeadersMatch(s, headers)\r\n{\r\n}\r\n\r\nlemma lemma_HeadersMatchImpliesEveryHeaderHasACorrespondingEntry(\r\n requests:seq,\r\n headers:set,\r\n header:CRequestHeader\r\n ) returns (\r\n i:int\r\n )\r\n requires HeadersMatch(requests, headers)\r\n requires header in headers\r\n ensures 0 <= i < |requests|\r\n ensures header.client == requests[i].client\r\n ensures header.seqno == requests[i].seqno\r\n{\r\n if |requests| == 0 {\r\n return;\r\n }\r\n\r\n var num_requests := |requests|;\r\n var last_header := CRequestHeader(requests[num_requests-1].client, requests[num_requests-1].seqno);\r\n assert last_header in headers;\r\n\r\n if header == last_header\r\n {\r\n i := num_requests - 1;\r\n return;\r\n }\r\n\r\n var requests' := requests[..num_requests-1];\r\n var headers' := headers - { last_header };\r\n\r\n forall r' | r' in requests'\r\n ensures CRequestHeader(r'.client, r'.seqno) in headers'\r\n {\r\n var j :| 0 <= j < |requests|-1 && r' == requests[j];\r\n var k := |requests| - 1;\r\n assert !CRequestsMatch(requests[j], requests[k]);\r\n }\r\n\r\n i := lemma_HeadersMatchImpliesEveryHeaderHasACorrespondingEntry(requests[..num_requests - 1], headers - { last_header }, header);\r\n}\r\n\r\nlemma lemma_AddingOneHeaderPreservesMatch(\r\n s:seq,\r\n headers:set,\r\n r:CRequest,\r\n s':seq,\r\n headers':set\r\n )\r\n requires s' == s + [r]\r\n requires headers' == headers + { CRequestHeader(r.client, r.seqno) }\r\n requires HeadersMatch(s, headers)\r\n requires forall r' :: r' in s ==> !CRequestsMatch(r', r)\r\n ensures HeadersMatch(s', headers')\r\n{\r\n var new_header := CRequestHeader(r.client, r.seqno);\r\n if new_header in headers\r\n {\r\n var i := lemma_HeadersMatchImpliesEveryHeaderHasACorrespondingEntry(s, headers, new_header);\r\n assert CRequestsMatch(s[i], r);\r\n assert false;\r\n }\r\n calc {\r\n |s'|;\r\n |s| + 1;\r\n |headers| + 1;\r\n |headers'|;\r\n }\r\n assert forall r' :: r' in s' ==> CRequestHeader(r'.client, r'.seqno) in headers';\r\n}\r\n\r\nlemma lemma_HeadersMatchImpliesHeadersFromPrefix(requests:seq, headers:set)\r\n requires HeadersMatch(requests, headers)\r\n ensures headers == HeadersFromPrefix(requests, |requests|)\r\n{\r\n var headers' := HeadersFromPrefix(requests, |requests|);\r\n\r\n forall h | h in headers\r\n ensures h in headers'\r\n {\r\n var i := lemma_HeadersMatchImpliesEveryHeaderHasACorrespondingEntry(requests, headers, h);\r\n }\r\n\r\n forall h | h in headers'\r\n ensures h in headers\r\n {\r\n var i :| 0 <= i < |requests| && h == CRequestHeader(requests[i].client, requests[i].seqno);\r\n }\r\n}\r\n\r\nmethod{:timeLimitMultiplier 2} RemoveAllSatisfiedCRequestsInSequenceIter(\r\n requests:seq,\r\n ghost headers:set,\r\n cur_req_set:MutableSet,\r\n r:CRequest\r\n ) returns (\r\n requests':seq,\r\n ghost headers':set\r\n )\r\n requires |requests| < 0x1_0000_0000_0000_0000\r\n requires HeadersMatch(requests, headers)\r\n requires MutableSet.SetOf(cur_req_set) == headers\r\n modifies cur_req_set\r\n ensures requests' == RemoveAllSatisfiedCRequestsInSequence(requests, r)\r\n ensures HeadersMatch(requests', headers')\r\n// ensures headers' == headers <==> requests' == requests\r\n ensures MutableSet.SetOf(cur_req_set) == headers'\r\n{\r\n var i:uint64 := 0;\r\n var len := |requests| as uint64;\r\n ghost var removed_headers:set := {};\r\n headers' := {};\r\n requests' := [];\r\n i := 0;\r\n\r\n lemma_EmptyHeadersMatch(requests', headers');\r\n\r\n while i < len\r\n invariant 0 <= i <= len\r\n invariant HeadersMatch(requests', headers')\r\n invariant forall r' :: r' in requests' ==> r' in requests[..i]\r\n invariant requests' == RemoveAllSatisfiedCRequestsInSequence(requests[..i], r)\r\n invariant MutableSet.SetOf(cur_req_set) == headers - removed_headers\r\n invariant headers' + removed_headers == HeadersFromPrefix(requests, i as int)\r\n invariant removed_headers * headers' == {}\r\n {\r\n ghost var old_requests' := requests';\r\n ghost var old_headers' := headers';\r\n\r\n lemma_RemoveAllSatisfiedCRequestsInSequenceUpdate(requests, r, i as int);\r\n\r\n var h := CRequestHeader(requests[i].client, requests[i].seqno);\r\n if h in removed_headers || h in headers'\r\n {\r\n var j :| 0 <= j < i && h == CRequestHeader(requests[j].client, requests[j].seqno);\r\n assert CRequestsMatch(requests[j], requests[i]);\r\n assert false;\r\n }\r\n \r\n if CRequestSatisfiedBy(requests[i], r) {\r\n cur_req_set.Remove(h);\r\n removed_headers := removed_headers + {h};\r\n }\r\n else {\r\n headers' := headers' + {h};\r\n requests' := requests' + [requests[i]];\r\n lemma_AddingOneHeaderPreservesMatch(old_requests', old_headers', requests[i], requests', headers');\r\n }\r\n\r\n lemma_HeadersFromPrefixIncrease(requests, i as int);\r\n i := i + 1;\r\n }\r\n\r\n assert requests[..i] == requests;\r\n lemma_HeadersMatchImpliesHeadersFromPrefix(requests, headers);\r\n}\r\n\r\nlemma lemma_RemoveAllSatisfiedCRequestsProducesCRequestSubset(requests:seq, r:CRequest)\r\n ensures forall r' :: r' in RemoveAllSatisfiedCRequestsInSequence(requests, r) ==> r' in requests\r\n{\r\n}\r\n\r\nlemma lemma_RemoveAllSatisfiedCRequestsProducesHeaderSubset(\r\n requests:seq,\r\n headers:set,\r\n requests':seq,\r\n headers':set,\r\n r:CRequest\r\n )\r\n requires HeadersMatch(requests, headers)\r\n requires HeadersMatch(requests', headers')\r\n requires requests' == RemoveAllSatisfiedCRequestsInSequence(requests, r)\r\n ensures headers' <= headers\r\n{\r\n forall h | h in headers'\r\n ensures h in headers\r\n {\r\n var i := lemma_HeadersMatchImpliesEveryHeaderHasACorrespondingEntry(requests', headers', h);\r\n lemma_RemoveAllSatisfiedCRequestsProducesCRequestSubset(requests, r);\r\n assert requests'[i] in requests;\r\n }\r\n}\r\n \r\n\r\nlemma lemma_RemoveAllSatisfiedPreservesHeaderMatches(requests1:seq, headers1:set, \r\n requests2:seq, headers2:set,\r\n requests1':seq, headers1':set,\r\n requests2':seq, headers2':set,\r\n r:CRequest)\r\n requires HeadersMatch(requests1, headers1)\r\n requires HeadersMatch(requests2, headers2)\r\n requires HeadersMatch(requests1 + requests2, headers1 + headers2)\r\n requires HeadersMatch(requests1', headers1')\r\n requires HeadersMatch(requests2', headers2')\r\n requires requests1' == RemoveAllSatisfiedCRequestsInSequence(requests1, r)\r\n requires requests2' == RemoveAllSatisfiedCRequestsInSequence(requests2, r)\r\n ensures HeadersMatch(requests1' + requests2', headers1' + headers2')\r\n{\r\n var requests3 := requests1 + requests2;\r\n var requests3' := requests1' + requests2';\r\n var headers3' := headers1' + headers2';\r\n\r\n lemma_RemoveAllSatisfiedCRequestsProducesHeaderSubset(requests1, headers1, requests1', headers1', r);\r\n lemma_RemoveAllSatisfiedCRequestsProducesHeaderSubset(requests2, headers2, requests2', headers2', r);\r\n\r\n forall h | h in headers1' && h in headers2'\r\n ensures false\r\n {\r\n assert h in headers1 && h in headers2;\r\n var i := lemma_HeadersMatchImpliesEveryHeaderHasACorrespondingEntry(requests1, headers1, h);\r\n var j := lemma_HeadersMatchImpliesEveryHeaderHasACorrespondingEntry(requests2, headers2, h);\r\n assert CRequestsMatch(requests3[i], requests3[j + |requests1|]);\r\n }\r\n assert headers1' * headers2' == {};\r\n assert |requests3'| == |headers3'|;\r\n}\r\n\r\nlemma lemma_RemoveAllSatisfiedCRequestsInSequenceAbstractable(s:seq, r:CRequest)\r\n requires CRequestsSeqIsAbstractable(s)\r\n requires CRequestIsAbstractable(r)\r\n ensures CRequestsSeqIsAbstractable(RemoveAllSatisfiedCRequestsInSequence(s, r))\r\n{\r\n}\r\n\r\nlemma lemma_CRequestsMatch()\r\n ensures forall r1:CRequest, r2:CRequest :: CRequestIsAbstractable(r1) && CRequestIsAbstractable(r2) ==>\r\n CRequestsMatch(r1, r2) == RequestsMatch(AbstractifyCRequestToRequest(r1), AbstractifyCRequestToRequest(r2))\r\n{\r\n forall r1:CRequest, r2:CRequest | CRequestIsAbstractable(r1) && CRequestIsAbstractable(r2)\r\n ensures CRequestsMatch(r1, r2) == RequestsMatch(AbstractifyCRequestToRequest(r1), AbstractifyCRequestToRequest(r2))\r\n {\r\n lemma_AbstractifyCRequestToRequest_isInjective();\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n }\r\n}\r\n\r\n\r\nlemma lemma_SequenceDots(s:seq, start:int)\r\n requires 0 <= start <= |s|\r\n ensures s[start..] == s[start..|s|]\r\n{}\r\n\r\nlemma lemma_RemoveAllSatisfiedCRequestsInSequenceProperties(s:seq, r:CRequest)\r\n requires CRequestsSeqIsAbstractable(s)\r\n requires CRequestIsAbstractable(r)\r\n ensures CRequestsSeqIsAbstractable(RemoveAllSatisfiedCRequestsInSequence(s, r))\r\n ensures AbstractifyCRequestsSeqToRequestsSeq(RemoveAllSatisfiedCRequestsInSequence(s, r)) \r\n == RemoveAllSatisfiedRequestsInSequence(AbstractifyCRequestsSeqToRequestsSeq(s), AbstractifyCRequestToRequest(r))\r\n ensures |RemoveAllSatisfiedCRequestsInSequence(s, r)| <= |s|\r\n ensures ElectionRequestQueueValid(s) ==> ElectionRequestQueueValid(RemoveAllSatisfiedCRequestsInSequence(s, r))\r\n{\r\n lemma_RemoveAllSatisfiedCRequestsInSequenceAbstractable(s, r);\r\n reveal AbstractifyCRequestsSeqToRequestsSeq();\r\n\r\n if |s| == 0\r\n {\r\n return;\r\n }\r\n\r\n if AbstractifyCRequestToRequest(s[0]).client == AbstractifyCRequestToRequest(r).client\r\n {\r\n lemma_AbstractifyEndPointToNodeIdentity_injective(s[0].client, r.client);\r\n }\r\n\r\n lemma_RemoveAllSatisfiedCRequestsInSequenceProperties(s[1..], r);\r\n}\r\n\r\n//////////////////////\r\n// ACTIONS\r\n//////////////////////\r\n\r\nmethod InitElectionState(constants:ReplicaConstantsState) returns (election:CElectionState, cur_req_set:MutableSet, prev_req_set:MutableSet)\r\n requires ReplicaConstantsStateIsAbstractable(constants)\r\n requires ReplicaConstantsState_IsValid(constants)\r\n requires CPaxosConfigurationIsValid(constants.all.config)\r\n ensures CElectionStateIsAbstractable(election)\r\n ensures WellFormedLConfiguration(AbstractifyReplicaConstantsStateToLReplicaConstants(constants).all.config)\r\n ensures ElectionStateInit(AbstractifyCElectionStateToElectionState(election), AbstractifyReplicaConstantsStateToLReplicaConstants(constants))\r\n ensures CElectionStateIsValid(election)\r\n ensures fresh(cur_req_set) && fresh(prev_req_set) && cur_req_set != prev_req_set\r\n ensures MutableSet.SetOf(cur_req_set) == election.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == election.prev_req_set\r\n{\r\n election := CElectionState(constants,\r\n CBallot(1, 0),\r\n [],\r\n 0,\r\n constants.all.params.baseline_view_timeout_period,\r\n [],\r\n {},\r\n [],\r\n {});\r\n cur_req_set := MutableSet.EmptySet();\r\n prev_req_set := MutableSet.EmptySet();\r\n\r\n calc ==> {\r\n true;\r\n { reveal SeqIsUnique(); }\r\n SeqIsUnique(election.current_view_suspectors);\r\n }\r\n\r\n // Some subset of below is an OBSERVE\r\n ghost var es := AbstractifyCElectionStateToElectionState(election);\r\n ghost var c := AbstractifyReplicaConstantsStateToLReplicaConstants(constants);\r\n\r\n assert es.constants == c;\r\n assert es.current_view == Ballot(1, 0);\r\n ghost var empty_set := {};\r\n calc { \r\n es.current_view_suspectors; \r\n { reveal AbstractifySeqOfUint64sToSetOfInts(); } \r\n empty_set;\r\n }\r\n assert es.epoch_end_time == 0;\r\n assert es.epoch_length == c.all.params.baseline_view_timeout_period;\r\n}\r\n\r\n\r\nmethod {:timeLimitMultiplier 3} ElectionProcessHeartbeat(ces:CElectionState, cp:CPacket, clock:uint64, cur_req_set:MutableSet, prev_req_set:MutableSet) returns (ces':CElectionState)\r\n requires CElectionStateIsValid(ces)\r\n requires CPacketIsAbstractable(cp)\r\n requires cp.msg.CMessage_Heartbeat?\r\n requires MutableSet.SetOf(cur_req_set) == ces.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == ces.prev_req_set\r\n modifies cur_req_set, prev_req_set\r\n ensures CElectionStateIsValid(ces')\r\n ensures ElectionStateProcessHeartbeat(AbstractifyCElectionStateToElectionState(ces), AbstractifyCElectionStateToElectionState(ces'), AbstractifyCPacketToRslPacket(cp), clock as int)\r\n ensures MutableSet.SetOf(cur_req_set) == ces'.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == ces'.prev_req_set\r\n{\r\n var src_ep := cp.src;\r\n var found:bool, index:uint64 := CGetReplicaIndex(src_ep, ces.constants.all.config);\r\n\r\n ghost var es := AbstractifyCElectionStateToElectionState(ces);\r\n ghost var es':ElectionState;\r\n lemma_AbstractifySeqOfUint64sToSetOfInts_properties(ces.current_view_suspectors);\r\n\r\n if !found {\r\n es' := es;\r\n ces' := ces;\r\n } else {\r\n ghost var p := AbstractifyCPacketToRslPacket(cp);\r\n ghost var sender_index := GetReplicaIndex(p.src, es.constants.all.config);\r\n if cp.msg.bal_heartbeat == ces.current_view && cp.msg.suspicious {\r\n es' := es.(current_view_suspectors := es.current_view_suspectors + {sender_index});\r\n ces' := ces.(current_view_suspectors := AppendToUniqueSeqMaybe(ces.current_view_suspectors, index));\r\n lemma_AbstractifySeqOfUint64sToSetOfInts_append(ces.current_view_suspectors, index);\r\n assert Eq_ElectionState(es', AbstractifyCElectionStateToElectionState(ces'));\r\n } else {\r\n var cmp := CBalLt(ces.current_view, cp.msg.bal_heartbeat);\r\n if cmp {\r\n ghost var new_epoch_length := UpperBoundedAddition(es.epoch_length, es.epoch_length, es.constants.all.params.max_integer_val);\r\n es' := es.(current_view := p.msg.bal_heartbeat,\r\n current_view_suspectors := (if p.msg.suspicious then {sender_index} else {}),\r\n epoch_length := new_epoch_length,\r\n epoch_end_time := UpperBoundedAddition(clock as int, new_epoch_length, es.constants.all.params.max_integer_val),\r\n requests_received_prev_epochs := BoundRequestSequence(es.requests_received_prev_epochs + es.requests_received_this_epoch, es.constants.all.params.max_integer_val),\r\n requests_received_this_epoch := []);\r\n\r\n var cnewEpochLength := UpperBoundedAdditionImpl(ces.epoch_length, ces.epoch_length, ces.constants.all.params.max_integer_val);\r\n var cnewEpochEndTime := UpperBoundedAdditionImpl(clock, cnewEpochLength, ces.constants.all.params.max_integer_val);\r\n\r\n var new_seq := ces.requests_received_prev_epochs + ces.requests_received_this_epoch;\r\n ghost var new_set := ces.prev_req_set + ces.cur_req_set;\r\n prev_req_set.AddSet(cur_req_set);\r\n cur_req_set.RemoveAll();\r\n assert HeadersMatch(new_seq, new_set);\r\n var tuple := BoundCRequestSequence(new_seq, ces.constants.all.params.max_integer_val);\r\n var bounded, bounded_seq := tuple.0, tuple.1;\r\n if bounded { // Should never happen\r\n new_set := BoundCRequestHeaders(new_seq, new_set, ces.constants.all.params.max_integer_val, prev_req_set);\r\n }\r\n ces' := ces.( //CElectionStateValueSetsReflectNewView(ces)\r\n current_view := cp.msg.bal_heartbeat,\r\n current_view_suspectors := (if cp.msg.suspicious then [index] else []),\r\n epoch_length := cnewEpochLength,\r\n epoch_end_time := cnewEpochEndTime,\r\n requests_received_prev_epochs := bounded_seq,\r\n requests_received_this_epoch := [],\r\n cur_req_set := {},\r\n prev_req_set := new_set);\r\n\r\n lemma_AbstractifyCRequestsSeqToRequestsSeq_concat(ces.requests_received_prev_epochs, ces.requests_received_this_epoch);\r\n lemma_BoundCRequestSequence(ces.requests_received_prev_epochs + ces.requests_received_this_epoch, ces.constants.all.params.max_integer_val);\r\n forall ensures SeqIsUnique(ces'.current_view_suspectors)\r\n {\r\n reveal SeqIsUnique();\r\n }\r\n calc {\r\n AbstractifySeqOfUint64sToSetOfInts(ces'.current_view_suspectors);\r\n { assert index as int == sender_index; reveal AbstractifySeqOfUint64sToSetOfInts();\r\n lemma_AbstractifySeqOfUint64sToSetOfInts_properties(ces'.current_view_suspectors); }\r\n es'.current_view_suspectors;\r\n }\r\n\r\n assert Eq_ElectionState(es', AbstractifyCElectionStateToElectionState(ces'));\r\n } else {\r\n es' := es;\r\n ces' := ces;\r\n }\r\n }\r\n reveal AbstractifyEndPointsToNodeIdentities();\r\n }\r\n assert Eq_ElectionState(es', AbstractifyCElectionStateToElectionState(ces'));\r\n}\r\n\r\nmethod {:timeLimitMultiplier 3} ElectionCheckForViewTimeout(ces:CElectionState, clock:uint64, cur_req_set:MutableSet, prev_req_set:MutableSet) returns (ces':CElectionState)\r\n requires CElectionStateIsValid(ces)\r\n requires MutableSet.SetOf(cur_req_set) == ces.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == ces.prev_req_set\r\n modifies cur_req_set, prev_req_set\r\n ensures CElectionStateIsValid(ces')\r\n ensures ElectionStateCheckForViewTimeout(AbstractifyCElectionStateToElectionState(ces), AbstractifyCElectionStateToElectionState(ces'), clock as int)\r\n ensures MutableSet.SetOf(cur_req_set) == ces'.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == ces'.prev_req_set\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n ghost var es := AbstractifyCElectionStateToElectionState(ces);\r\n ghost var es':ElectionState;\r\n lemma_AbstractifySeqOfUint64sToSetOfInts_properties(ces.current_view_suspectors);\r\n\r\n if clock < ces.epoch_end_time {\r\n es' := es;\r\n ces' := ces;\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"ElectionCheckForViewTimeout_nada\", start_time, end_time);\r\n assert Eq_ElectionState(es', AbstractifyCElectionStateToElectionState(ces'));\r\n } else if |ces.requests_received_prev_epochs| == 0 {\r\n ghost var new_epoch_length := es.constants.all.params.baseline_view_timeout_period;\r\n es' := es.(epoch_length := new_epoch_length,\r\n epoch_end_time := UpperBoundedAddition(clock as int, new_epoch_length, es.constants.all.params.max_integer_val),\r\n requests_received_prev_epochs := es.requests_received_this_epoch,\r\n requests_received_this_epoch := []);\r\n\r\n var cnewEpochLength := ces.constants.all.params.baseline_view_timeout_period;\r\n var cnewEpochEndTime := UpperBoundedAdditionImpl(clock, cnewEpochLength, ces.constants.all.params.max_integer_val);\r\n ces' := ces.(epoch_length := cnewEpochLength,\r\n epoch_end_time := cnewEpochEndTime,\r\n requests_received_prev_epochs := ces.requests_received_this_epoch,\r\n requests_received_this_epoch := [],\r\n cur_req_set := {},\r\n prev_req_set := ces.cur_req_set);\r\n prev_req_set.TransferSet(cur_req_set);\r\n assert Eq_ElectionState(es', AbstractifyCElectionStateToElectionState(ces'));\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"ElectionCheckForViewTimeout_noprev\", start_time, end_time);\r\n } else {\r\n es' := es.(current_view_suspectors := es.current_view_suspectors + {es.constants.my_index},\r\n epoch_end_time := UpperBoundedAddition(clock as int, es.epoch_length, es.constants.all.params.max_integer_val),\r\n requests_received_prev_epochs := BoundRequestSequence(es.requests_received_prev_epochs + es.requests_received_this_epoch, es.constants.all.params.max_integer_val),\r\n requests_received_this_epoch := []);\r\n\r\n var cnewEpochEndTime := UpperBoundedAdditionImpl(clock, ces.epoch_length, ces.constants.all.params.max_integer_val);\r\n\r\n var new_seq := ces.requests_received_prev_epochs + ces.requests_received_this_epoch;\r\n ghost var new_set := ces.prev_req_set + ces.cur_req_set;\r\n prev_req_set.AddSet(cur_req_set);\r\n cur_req_set.RemoveAll();\r\n assert HeadersMatch(new_seq, new_set);\r\n var tuple := BoundCRequestSequence(new_seq, ces.constants.all.params.max_integer_val);\r\n var bounded, bounded_seq := tuple.0, tuple.1;\r\n if bounded { // Should never happen\r\n new_set := BoundCRequestHeaders(new_seq, new_set, ces.constants.all.params.max_integer_val, prev_req_set);\r\n }\r\n\r\n ces' := ces.(current_view_suspectors := AppendToUniqueSeqMaybe(ces.current_view_suspectors, ces.constants.my_index),\r\n epoch_end_time := cnewEpochEndTime,\r\n requests_received_prev_epochs := bounded_seq,\r\n requests_received_this_epoch := [],\r\n cur_req_set := {},\r\n prev_req_set := new_set);\r\n\r\n lemma_AbstractifyCRequestsSeqToRequestsSeq_concat(ces.requests_received_prev_epochs, ces.requests_received_this_epoch);\r\n lemma_BoundCRequestSequence(ces.requests_received_prev_epochs + ces.requests_received_this_epoch, ces.constants.all.params.max_integer_val);\r\n calc {\r\n AbstractifySeqOfUint64sToSetOfInts(AppendToUniqueSeqMaybe(ces.current_view_suspectors, ces.constants.my_index));\r\n { lemma_AbstractifySeqOfUint64sToSetOfInts_append(ces.current_view_suspectors, ces.constants.my_index); }\r\n es.current_view_suspectors + {es.constants.my_index};\r\n }\r\n\r\n assert Eq_ElectionState(es', AbstractifyCElectionStateToElectionState(ces'));\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"ElectionCheckForViewTimeout_timeout\", start_time, end_time);\r\n } \r\n\r\n assert Eq_ElectionState(es', AbstractifyCElectionStateToElectionState(ces'));\r\n}\r\n\r\nmethod {:timeLimitMultiplier 3} ElectionCheckForQuorumOfViewSuspicions(ces:CElectionState, clock:uint64, cur_req_set:MutableSet, prev_req_set:MutableSet) returns(ces':CElectionState)\r\n requires CElectionStateIsValid(ces)\r\n requires MutableSet.SetOf(cur_req_set) == ces.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == ces.prev_req_set\r\n modifies cur_req_set, prev_req_set\r\n ensures CElectionStateIsValid(ces')\r\n ensures ElectionStateCheckForQuorumOfViewSuspicions(AbstractifyCElectionStateToElectionState(ces), AbstractifyCElectionStateToElectionState(ces'), clock as int)\r\n ensures MutableSet.SetOf(cur_req_set) == ces'.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == ces'.prev_req_set\r\n{\r\n reveal SeqIsUnique();\r\n ghost var es := AbstractifyCElectionStateToElectionState(ces);\r\n ghost var es':ElectionState;\r\n lemma_AbstractifySeqOfUint64sToSetOfInts_properties(ces.current_view_suspectors);\r\n lemma_AbstractifyEndPointsToNodeIdentities_properties(ces.constants.all.config.replica_ids);\r\n\r\n var minq := MinCQuorumSize(ces.constants.all.config);\r\n if |ces.current_view_suspectors| < minq as int || ces.current_view.seqno >= ces.constants.all.params.max_integer_val { //|| |ces.constants.all.config.replica_ids| == 0 {\r\n es' := es;\r\n ces' := ces;\r\n } else {\r\n ghost var new_epoch_length := UpperBoundedAddition(es.epoch_length, es.epoch_length, es.constants.all.params.max_integer_val);\r\n es' := es.(\r\n current_view := ComputeSuccessorView(es.current_view, es.constants.all),\r\n current_view_suspectors := {},\r\n epoch_length := new_epoch_length,\r\n epoch_end_time := UpperBoundedAddition(clock as int, new_epoch_length, es.constants.all.params.max_integer_val),\r\n requests_received_prev_epochs := BoundRequestSequence(es.requests_received_prev_epochs + es.requests_received_this_epoch, es.constants.all.params.max_integer_val),\r\n requests_received_this_epoch := []);\r\n\r\n var cview := CComputeSuccessorView(ces.current_view, ces.constants.all);\r\n var cnewEpochLength := UpperBoundedAdditionImpl(ces.epoch_length, ces.epoch_length, ces.constants.all.params.max_integer_val);\r\n var cnewEpochEndTime := UpperBoundedAdditionImpl(clock, cnewEpochLength, ces.constants.all.params.max_integer_val);\r\n\r\n var new_seq := ces.requests_received_prev_epochs + ces.requests_received_this_epoch;\r\n ghost var new_set := ces.prev_req_set + ces.cur_req_set;\r\n prev_req_set.AddSet(cur_req_set);\r\n cur_req_set.RemoveAll();\r\n assert HeadersMatch(new_seq, new_set);\r\n var tuple := BoundCRequestSequence(new_seq, ces.constants.all.params.max_integer_val);\r\n var bounded, bounded_seq := tuple.0, tuple.1;\r\n if bounded { // Should never happen\r\n new_set := BoundCRequestHeaders(new_seq, new_set, ces.constants.all.params.max_integer_val, prev_req_set);\r\n }\r\n\r\n ces' := ces.(\r\n current_view := cview,\r\n current_view_suspectors := [],\r\n epoch_length := cnewEpochLength,\r\n epoch_end_time := cnewEpochEndTime,\r\n requests_received_prev_epochs := bounded_seq,\r\n requests_received_this_epoch := [],\r\n cur_req_set := {},\r\n prev_req_set := new_set);\r\n lemma_AbstractifyCRequestsSeqToRequestsSeq_concat(ces.requests_received_prev_epochs, ces.requests_received_this_epoch);\r\n lemma_BoundCRequestSequence(ces.requests_received_prev_epochs + ces.requests_received_this_epoch, ces.constants.all.params.max_integer_val);\r\n }\r\n reveal AbstractifyEndPointsToNodeIdentities();\r\n lemma_AbstractifySeqOfUint64sToSetOfInts_properties([]);\r\n assert Eq_ElectionState(es', AbstractifyCElectionStateToElectionState(ces'));\r\n}\r\n\r\n/*\r\nmethod FindEarlierRequest(r1:seq, r2:seq, target:CRequest) returns (b:bool)\r\n requires CRequestsSeqIsAbstractable(r1)\r\n requires CRequestsSeqIsAbstractable(r2)\r\n requires CRequestIsAbstractable(target)\r\n requires |r1| < 0x1_0000_0000_0000_0000\r\n requires |r2| < 0x1_0000_0000_0000_0000\r\n ensures b == exists earlier_req :: (earlier_req in r1 || earlier_req in r2)\r\n && CRequestsMatch(earlier_req, target)\r\n ensures b == exists earlier_req :: (earlier_req in AbstractifyCRequestsSeqToRequestsSeq(r1) \r\n || earlier_req in AbstractifyCRequestsSeqToRequestsSeq(r2))\r\n && RequestsMatch(earlier_req, AbstractifyCRequestToRequest(target))\r\n{\r\n lemma_CRequestsMatch();\r\n\r\n var i:uint64 := 0;\r\n while i < |r1| as uint64\r\n invariant 0 <= i as int <= |r1|\r\n invariant forall j :: 0 <= j < i ==> !CRequestsMatch(r1[j], target)\r\n {\r\n if CRequestsMatch(r1[i], target) {\r\n b := true;\r\n return;\r\n }\r\n i := i + 1;\r\n }\r\n\r\n i := 0;\r\n while i < |r2| as uint64\r\n invariant 0 <= i as int <= |r2|\r\n invariant forall j :: 0 <= j < i ==> !CRequestsMatch(r2[j], target)\r\n {\r\n if CRequestsMatch(r2[i], target) {\r\n b := true;\r\n return;\r\n }\r\n i := i + 1;\r\n }\r\n\r\n b := false;\r\n}\r\n*/\r\n\r\nmethod FindEarlierRequestSets(ces:CElectionState, target:CRequest, cur_req_set:MutableSet, prev_req_set:MutableSet) returns (b:bool)\r\n requires CElectionStateIsValid(ces)\r\n requires CRequestIsAbstractable(target)\r\n requires MutableSet.SetOf(cur_req_set) == ces.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == ces.prev_req_set\r\n ensures b == exists earlier_req :: (earlier_req in ces.requests_received_prev_epochs \r\n || earlier_req in ces.requests_received_this_epoch)\r\n && CRequestsMatch(earlier_req, target)\r\n ensures b == exists earlier_req :: (earlier_req in AbstractifyCRequestsSeqToRequestsSeq(ces.requests_received_prev_epochs) \r\n || earlier_req in AbstractifyCRequestsSeqToRequestsSeq(ces.requests_received_this_epoch))\r\n && RequestsMatch(earlier_req, AbstractifyCRequestToRequest(target))\r\n{\r\n var header := CRequestHeader(target.client, target.seqno);\r\n var b1 := cur_req_set.Contains(header);\r\n if b1 {\r\n b := true;\r\n } else {\r\n var b2 := prev_req_set.Contains(header);\r\n b := b2;\r\n }\r\n assert b == (header in ces.cur_req_set) || (header in ces.prev_req_set);\r\n lemma_CRequestsMatch();\r\n if b {\r\n ghost var requests := ces.requests_received_prev_epochs + ces.requests_received_this_epoch;\r\n ghost var i := FindMatchingRequest(requests, ces.prev_req_set + ces.cur_req_set, header); \r\n // Lots of OBSERVE below to satisfy the existential in the ensures clause\r\n if i < |ces.requests_received_prev_epochs| {\r\n assert requests[i] == ces.requests_received_prev_epochs[i];\r\n ghost var r_req := AbstractifyCRequestToRequest(ces.requests_received_prev_epochs[i]);\r\n assert r_req in AbstractifyCRequestsSeqToRequestsSeq(ces.requests_received_prev_epochs);\r\n assert RequestsMatch(r_req, AbstractifyCRequestToRequest(target));\r\n } else {\r\n assert requests[i] == ces.requests_received_this_epoch[i - |ces.requests_received_prev_epochs|];\r\n ghost var r_req := AbstractifyCRequestToRequest(ces.requests_received_this_epoch[i - |ces.requests_received_prev_epochs|]);\r\n assert r_req in AbstractifyCRequestsSeqToRequestsSeq(ces.requests_received_this_epoch);\r\n assert RequestsMatch(r_req, AbstractifyCRequestToRequest(target));\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_HeadersMatchAddition(requests:seq, headers:set, req:CRequest)\r\n requires HeadersMatch(requests, headers)\r\n requires !(exists earlier_req :: earlier_req in requests && CRequestsMatch(earlier_req, req))\r\n ensures HeadersMatch(requests + [req], headers + { CRequestHeader(req.client, req.seqno) })\r\n{\r\n var header := CRequestHeader(req.client, req.seqno);\r\n if header in headers {\r\n ghost var i := FindMatchingRequest(requests, headers, header); \r\n assert requests[i] in requests && CRequestsMatch(requests[i], req);\r\n }\r\n assert !(header in headers);\r\n}\r\n\r\nfunction ExtractHeader(req:CRequest) : CRequestHeader\r\n{\r\n CRequestHeader(req.client, req.seqno)\r\n}\r\n\r\nlemma lemma_AddNewReqPreservesHeaderMatches(s1:seq, headers1:set, \r\n s2:seq, headers2:set,\r\n s1':seq, headers1':set,\r\n s2':seq, headers2':set,\r\n r:CRequest)\r\n requires HeadersMatch(s1, headers1)\r\n requires HeadersMatch(s2, headers2)\r\n requires HeadersMatch(s1 + s2, headers1 + headers2)\r\n requires HeadersMatch(s1', headers1')\r\n requires HeadersMatch(s2', headers2')\r\n requires headers1' == headers1;\r\n requires s1' == s1\r\n requires forall req :: req in s2' && !CRequestsMatch(req, r) ==> req in s2\r\n requires forall h :: h in headers2' && h != CRequestHeader(r.client, r.seqno) ==> h in headers2\r\n requires forall other_r :: other_r in s1 || other_r in s2 ==> !CRequestsMatch(other_r, r)\r\n ensures HeadersMatch(s1' + s2', headers1' + headers2')\r\n{\r\n var total_s := s1' + s2'; \r\n var total_h := headers1' + headers2'; \r\n forall i,j | 0 <= i < j < |total_s| && CRequestsMatch(total_s[i], total_s[j]) \r\n ensures i == j\r\n {\r\n if j < |s1'| {\r\n assert total_s[i] in s1 && total_s[j] in s1;\r\n assert i == j;\r\n } else if i >= |s1'| {\r\n assert total_s[i] in s2 && total_s[j] in s2;\r\n assert i == j;\r\n } else {\r\n assert i < |s1'| && j >= |s1'|;\r\n assert total_s[i] in s1 && total_s[j] in s2;\r\n var tot_s := s1 + s2;\r\n assert total_s[i] in tot_s && total_s[j] in tot_s;\r\n var i' :| 0 <= i' < |tot_s| && total_s[i] == tot_s[i'];\r\n var j' :| 0 <= j' < |tot_s| && total_s[j] == tot_s[j'];\r\n assert HeadersMatch(tot_s, headers1 + headers2);\r\n if (i' < j') {\r\n assert CRequestsMatch(tot_s[i'], tot_s[j']);\r\n } else if (i' > j') {\r\n assert CRequestsMatch(tot_s[j'], tot_s[i']);\r\n }\r\n assert i' == j';\r\n assert total_s[i] == total_s[j];\r\n if (total_s[j] in s1) {\r\n i' :| 0 <= i' < |s1| && total_s[j] == s1[i'];\r\n j' :| 0 <= j' < |s2| && total_s[j] == s2[j'];\r\n assert total_s[j] == tot_s[i'];\r\n assert total_s[j] == tot_s[|s1| + j'];\r\n }\r\n assert total_s[j] !in s1;\r\n assert i == j;\r\n }\r\n }\r\n\r\n var header_seq := [];\r\n var i := 0;\r\n while i < |total_s|\r\n invariant 0 <= i <= |total_s|\r\n invariant |header_seq| == i\r\n invariant forall j :: 0 <= j < i ==> header_seq[j] == ExtractHeader(total_s[j])\r\n {\r\n header_seq := header_seq + [ExtractHeader(total_s[i])];\r\n i := i + 1;\r\n }\r\n \r\n forall i', j' | 0 <= i' < |header_seq| && 0 <= j' < |header_seq| && header_seq[i'] == header_seq[j']\r\n ensures i' == j'\r\n {\r\n assert header_seq[i'] == ExtractHeader(total_s[i']);\r\n assert header_seq[j'] == ExtractHeader(total_s[j']);\r\n if i' < j' {\r\n assert CRequestsMatch(total_s[i'], total_s[j']); // OBSERVE\r\n } else if j' < i' {\r\n assert CRequestsMatch(total_s[j'], total_s[i']); // OBSERVE\r\n }\r\n }\r\n forall ensures SeqIsUnique(header_seq)\r\n {\r\n reveal SeqIsUnique();\r\n }\r\n\r\n //var headers := set r | r in total_s :: ExtractHeader(r);\r\n var header_set := UniqueSeqToSet(header_seq);\r\n lemma_seqs_set_cardinality(header_seq, header_set);\r\n forall h | h in header_set\r\n ensures h in total_h\r\n {\r\n }\r\n\r\n forall h | h in total_h\r\n ensures h in header_set\r\n {\r\n if h in headers1' {\r\n var j := FindMatchingRequest(s1', headers1', h); \r\n assert total_s[j] == s1'[j];\r\n assert header_seq[j] == ExtractHeader(total_s[j]);\r\n assert header_seq[j] == h;\r\n assert header_seq[j] in header_seq;\r\n assert header_seq[j] in header_set;\r\n } else {\r\n assert h in headers2';\r\n var j := FindMatchingRequest(s2', headers2', h); \r\n var j_offset := j + |s1'|;\r\n assert total_s[j_offset] == s2'[j];\r\n assert header_seq[j_offset] == ExtractHeader(total_s[j_offset]);\r\n assert header_seq[j_offset] == h;\r\n assert header_seq[j_offset] in header_seq;\r\n assert header_seq[j_offset] in header_set;\r\n }\r\n }\r\n lemma_MapSetCardinalityOver(total_h, header_set, h => h);\r\n assert |total_h| == |header_set|; // OBSERVE\r\n}\r\n\r\nmethod {:timeLimitMultiplier 10} ElectionReflectReceivedRequest(ces:CElectionState, creq:CRequest, cur_req_set:MutableSet, prev_req_set:MutableSet) returns (ces':CElectionState)\r\n requires CElectionStateIsValid(ces)\r\n requires CRequestIsAbstractable(creq)\r\n requires ValidRequest(creq)\r\n requires prev_req_set != cur_req_set\r\n requires MutableSet.SetOf(cur_req_set) == ces.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == ces.prev_req_set\r\n modifies cur_req_set\r\n ensures CElectionStateIsValid(ces')\r\n ensures ElectionStateReflectReceivedRequest(AbstractifyCElectionStateToElectionState(ces), AbstractifyCElectionStateToElectionState(ces'), AbstractifyCRequestToRequest(creq))\r\n ensures MutableSet.SetOf(cur_req_set) == ces'.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == ces'.prev_req_set\r\n{\r\n ghost var req := AbstractifyCRequestToRequest(creq);\r\n ghost var es := AbstractifyCElectionStateToElectionState(ces);\r\n ghost var es':ElectionState;\r\n\r\n //var earlier_start_time := Time.GetDebugTimeTicks();\r\n //var earlier:bool := FindEarlierRequest(ces.requests_received_this_epoch, ces.requests_received_prev_epochs, creq);\r\n var earlier:bool := FindEarlierRequestSets(ces, creq, cur_req_set, prev_req_set);\r\n //var earlier_end_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"ElectionReflectReceivedRequest_FindEarlier\", earlier_start_time, earlier_end_time);\r\n\r\n if earlier {\r\n es' := es;\r\n ces' := ces;\r\n } else {\r\n //var update_start_time := Time.GetDebugTimeTicks();\r\n es' := es.(requests_received_this_epoch := BoundRequestSequence(es.requests_received_this_epoch + [req], es.constants.all.params.max_integer_val));\r\n var new_seq := ces.requests_received_this_epoch + [creq];\r\n var header := CRequestHeader(creq.client, creq.seqno);\r\n ghost var new_set := ces.cur_req_set + { header };\r\n cur_req_set.Add(header);\r\n lemma_HeadersMatchAddition(ces.requests_received_this_epoch, ces.cur_req_set, creq);\r\n assert HeadersMatch(new_seq, new_set);\r\n var tuple := BoundCRequestSequence(new_seq, ces.constants.all.params.max_integer_val);\r\n var bounded, bounded_seq := tuple.0, tuple.1;\r\n if bounded { // Should never happen\r\n new_set := BoundCRequestHeaders(new_seq, new_set, ces.constants.all.params.max_integer_val, cur_req_set);\r\n }\r\n ces' := ces.(requests_received_this_epoch := bounded_seq, cur_req_set := new_set);\r\n\r\n lemma_AddNewReqPreservesHeaderMatches(ces.requests_received_prev_epochs, ces.prev_req_set,\r\n ces.requests_received_this_epoch, ces.cur_req_set,\r\n ces.requests_received_prev_epochs, ces.prev_req_set,\r\n bounded_seq, new_set,\r\n creq);\r\n lemma_AbstractifyCRequestsSeqToRequestsSeq_concat(ces.requests_received_this_epoch, [creq]);\r\n lemma_BoundCRequestSequence(bounded_seq, ces.constants.all.params.max_integer_val);\r\n\r\n assert {:split_here} true;\r\n\r\n assert Eq_ElectionState(es', AbstractifyCElectionStateToElectionState(ces'));\r\n }\r\n}\r\n\r\nlemma lemma_SequenceRemoveAllSatisfied(rseq:seq, batch:RequestBatch, i:int, rseq':seq, rseq'':seq)\r\n requires 0 <= i < |batch|\r\n requires rseq' == RemoveExecutedRequestBatch(rseq, batch[..i])\r\n requires rseq'' == RemoveAllSatisfiedRequestsInSequence(rseq', batch[i])\r\n ensures rseq'' == RemoveExecutedRequestBatch(rseq, batch[..i+1])\r\n decreases i\r\n{\r\n if i > 0 {\r\n assert batch[1..][..i-1] == batch[1..i]; \r\n assert batch[1..][..i] == batch[1..i+1]; \r\n var rseqalt := RemoveAllSatisfiedRequestsInSequence(rseq, batch[0]);\r\n var rseqalt' := RemoveExecutedRequestBatch(rseqalt, batch[1..i]);\r\n var rseqalt'' := RemoveAllSatisfiedRequestsInSequence(rseqalt', batch[i]);\r\n\r\n lemma_SequenceRemoveAllSatisfied(rseqalt, batch[1..], i-1, rseqalt', rseqalt''); \r\n }\r\n}\r\n\r\nmethod {:timeLimitMultiplier 3} ElectionReflectExecutedRequestBatch(ces:CElectionState, creqb:CRequestBatch, cur_req_set:MutableSet, prev_req_set:MutableSet) returns (ces':CElectionState)\r\n requires CElectionStateIsValid(ces)\r\n requires CRequestBatchIsAbstractable(creqb)\r\n requires ValidRequestBatch(creqb)\r\n requires cur_req_set != prev_req_set\r\n requires MutableSet.SetOf(cur_req_set) == ces.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == ces.prev_req_set\r\n modifies cur_req_set, prev_req_set\r\n ensures CElectionStateIsValid(ces')\r\n ensures ElectionStateReflectExecutedRequestBatch(AbstractifyCElectionStateToElectionState(ces), AbstractifyCElectionStateToElectionState(ces'), AbstractifyCRequestBatchToRequestBatch(creqb))\r\n ensures MutableSet.SetOf(cur_req_set) == ces'.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == ces'.prev_req_set\r\n decreases |creqb|\r\n{\r\n ghost var es := AbstractifyCElectionStateToElectionState(ces);\r\n var i:uint64 := 0;\r\n assert AbstractifyCRequestBatchToRequestBatch(creqb[..i]) == [];\r\n var tempces' := ces;\r\n\r\n while i < |creqb| as uint64\r\n invariant 0 <= i as int <= |creqb|\r\n invariant CElectionStateIsAbstractable(tempces')\r\n invariant CElectionStateIsValid(tempces')\r\n invariant ElectionStateReflectExecutedRequestBatch(es, AbstractifyCElectionStateToElectionState(tempces'), AbstractifyCRequestBatchToRequestBatch(creqb[..i]))\r\n invariant MutableSet.SetOf(cur_req_set) == tempces'.cur_req_set\r\n invariant MutableSet.SetOf(prev_req_set) == tempces'.prev_req_set\r\n { \r\n var creq := creqb[i];\r\n ghost var req := AbstractifyCRequestToRequest(creq);\r\n ghost var es':ElectionState := AbstractifyCElectionStateToElectionState(tempces');\r\n \r\n lemma_RemoveAllSatisfiedCRequestsInSequenceProperties(tempces'.requests_received_prev_epochs, creq);\r\n lemma_RemoveAllSatisfiedCRequestsInSequenceProperties(tempces'.requests_received_this_epoch, creq);\r\n\r\n assert ElectionStateReflectExecutedRequestBatch(es, AbstractifyCElectionStateToElectionState(tempces'), AbstractifyCRequestBatchToRequestBatch(creqb[..i]));\r\n ghost var es'' := es'.(requests_received_prev_epochs := RemoveAllSatisfiedRequestsInSequence(es'.requests_received_prev_epochs, req),\r\n requests_received_this_epoch := RemoveAllSatisfiedRequestsInSequence(es'.requests_received_this_epoch, req));\r\n\r\n var prevEpoch;\r\n ghost var prevEpochSet;\r\n prevEpoch, prevEpochSet := RemoveAllSatisfiedCRequestsInSequenceIter(tempces'.requests_received_prev_epochs, tempces'.prev_req_set, prev_req_set, creq);\r\n var thisEpoch; \r\n ghost var thisEpochSet;\r\n thisEpoch, thisEpochSet := RemoveAllSatisfiedCRequestsInSequenceIter(tempces'.requests_received_this_epoch, tempces'.cur_req_set, cur_req_set, creq);\r\n\r\n\r\n lemma_RemoveAllSatisfiedPreservesHeaderMatches(tempces'.requests_received_prev_epochs, tempces'.prev_req_set,\r\n tempces'.requests_received_this_epoch, tempces'.cur_req_set,\r\n prevEpoch, prevEpochSet,\r\n thisEpoch, thisEpochSet,\r\n creq);\r\n\r\n tempces' := tempces'.(requests_received_prev_epochs := prevEpoch,\r\n requests_received_this_epoch := thisEpoch,\r\n cur_req_set := thisEpochSet,\r\n prev_req_set := prevEpochSet);\r\n assert {:split_here} true;\r\n assert AbstractifyCRequestBatchToRequestBatch(creqb[..i]) == AbstractifyCRequestBatchToRequestBatch(creqb)[..i];\r\n assert AbstractifyCRequestBatchToRequestBatch(creqb[..i+1]) == AbstractifyCRequestBatchToRequestBatch(creqb)[..i+1];\r\n lemma_SequenceRemoveAllSatisfied(es.requests_received_prev_epochs, AbstractifyCRequestBatchToRequestBatch(creqb), i as int, es'.requests_received_prev_epochs, es''.requests_received_prev_epochs);\r\n lemma_SequenceRemoveAllSatisfied(es.requests_received_this_epoch, AbstractifyCRequestBatchToRequestBatch(creqb), i as int, es'.requests_received_this_epoch, es''.requests_received_this_epoch);\r\n i := i + 1;\r\n }\r\n assert creqb[..i] == creqb;\r\n ces' := tempces';\r\n}\r\n\r\n} \r\n\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ElectionState.i.dfy", "content": "include \"../../Protocol/RSL/Election.i.dfy\"\r\ninclude \"CTypes.i.dfy\"\r\ninclude \"ReplicaConstantsState.i.dfy\"\r\n\r\nmodule LiveRSL__ElectionState_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__Election_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened Common__SeqIsUniqueDef_i\r\nimport opened Common__NodeIdentity_i\r\n\r\ndatatype CRequestHeader = CRequestHeader(client:EndPoint, seqno:uint64)\r\n\r\ndatatype CElectionState = CElectionState(\r\n constants:ReplicaConstantsState,\r\n // The replica constants, duplicated here for convenience\r\n\r\n current_view:CBallot,\r\n // The last view I think has won a leader election\r\n\r\n current_view_suspectors:seq,\r\n // The set of nodes who suspect current_view. When this constitutes\r\n // a quorum, I'll elect the next view.\r\n\r\n epoch_end_time:uint64,\r\n // When the next view-test epoch will end.\r\n\r\n epoch_length:uint64,\r\n // How long the current view-test epoch length is. When we enter a new view,\r\n // we double this.\r\n\r\n requests_received_this_epoch:seq,\r\n // The set of requests we've received this epoch but haven't executed this epoch yet\r\n // and didn't execute in the previous epoch.\r\n\r\n ghost cur_req_set:set,\r\n // Duplicates the sequence above for faster lookups\r\n\r\n requests_received_prev_epochs:seq,\r\n // The set of requests we received in the previous epoch but haven't executed in\r\n // the current epoch, the previous epoch, or the epoch before that.\r\n\r\n ghost prev_req_set:set\r\n // Duplicates the sequence above for faster lookups\r\n )\r\n\r\npredicate ElectionRequestQueueValid(queue:seq) \r\n{\r\n forall i :: 0 <= i < |queue| ==> ValidRequest(queue[i])\r\n}\r\n\r\npredicate CElectionStateIsAbstractable(election:CElectionState)\r\n{\r\n && ReplicaConstantsStateIsAbstractable(election.constants)\r\n && CBallotIsAbstractable(election.current_view)\r\n && SeqIsUnique(election.current_view_suspectors)\r\n && CRequestsSeqIsAbstractable(election.requests_received_this_epoch)\r\n && CRequestsSeqIsAbstractable(election.requests_received_prev_epochs)\r\n}\r\n\r\nfunction AbstractifyCElectionStateToElectionState(election:CElectionState) : ElectionState\r\n requires CElectionStateIsAbstractable(election)\r\n{\r\n ElectionState(AbstractifyReplicaConstantsStateToLReplicaConstants(election.constants),\r\n AbstractifyCBallotToBallot(election.current_view),\r\n AbstractifySeqOfUint64sToSetOfInts(election.current_view_suspectors),\r\n election.epoch_end_time as int,\r\n election.epoch_length as int,\r\n AbstractifyCRequestsSeqToRequestsSeq(election.requests_received_this_epoch), \r\n AbstractifyCRequestsSeqToRequestsSeq(election.requests_received_prev_epochs))\r\n}\r\n\r\npredicate method CRequestsMatch(r1:CRequest, r2:CRequest)\r\n{\r\n r1.client == r2.client && r1.seqno == r2.seqno\r\n}\r\n\r\npredicate method CRequestSatisfiedBy(r1:CRequest, r2:CRequest)\r\n{\r\n r1.client == r2.client && r1.seqno <= r2.seqno\r\n}\r\n\r\npredicate HeadersMatch(requests:seq, headers:set)\r\n{\r\n && |requests| == |headers|\r\n && (forall r :: r in requests ==> CRequestHeader(r.client, r.seqno) in headers)\r\n && (forall i,j {:trigger CRequestsMatch(requests[i], requests[j])} :: 0 <= i < j < |requests| && CRequestsMatch(requests[i], requests[j]) ==> i == j)\r\n}\r\n\r\npredicate CElectionStateIsValid(election:CElectionState)\r\n{\r\n && CElectionStateIsAbstractable(election)\r\n && ReplicaConstantsState_IsValid(election.constants)\r\n && ReplicaIndicesValid(election.current_view_suspectors, election.constants.all.config)\r\n && |election.requests_received_this_epoch| < 0x8000_0000_0000_0000\r\n && |election.requests_received_prev_epochs| < 0x8000_0000_0000_0000\r\n && ElectionRequestQueueValid(election.requests_received_this_epoch)\r\n && ElectionRequestQueueValid(election.requests_received_prev_epochs)\r\n && HeadersMatch(election.requests_received_this_epoch, election.cur_req_set)\r\n && HeadersMatch(election.requests_received_prev_epochs, election.prev_req_set)\r\n && HeadersMatch(election.requests_received_prev_epochs + election.requests_received_this_epoch, election.prev_req_set + election.cur_req_set)\r\n}\r\n\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ExecutorModel.i.dfy", "content": "include \"AppInterface.i.dfy\"\r\ninclude \"ExecutorState.i.dfy\"\r\ninclude \"Broadcast.i.dfy\"\r\ninclude \"../Common/Util.i.dfy\"\r\ninclude \"../../Common/Native/IoLemmas.i.dfy\"\r\n\r\nmodule LiveRSL__ExecutorModel_i {\r\nimport opened Native__Io_s\r\nimport opened Native__IoLemmas_i\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened LiveRSL__ExecutorState_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened LiveRSL__StateMachine_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Impl__LiveRSL__Broadcast_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__NetClient_i\r\nimport opened Common__UpperBound_s\r\nimport opened Common__UpperBound_i\r\nimport opened Common__Util_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Collections__Maps_i\r\nimport opened Logic__Option_i\r\nimport opened Environment_s\r\nimport opened AppStateMachine_s\r\nimport opened Temporal__Temporal_s\r\n\r\npredicate ClientIndexMatches(req_idx:int, client:EndPoint, newReplyCache:CReplyCache, batch:CRequestBatch, replies:seq) \r\n requires |batch| == |replies|\r\n requires client in newReplyCache\r\n{\r\n 0 <= req_idx < |batch| && replies[req_idx].client == client && newReplyCache[client] == replies[req_idx] \r\n}\r\n\r\npredicate ReplyCacheUpdated(client:EndPoint, oldReplyCache:CReplyCache, newReplyCache:CReplyCache, batch:CRequestBatch, replies:seq) \r\n requires client in newReplyCache\r\n requires |batch| == |replies|\r\n{\r\n || (client in oldReplyCache && newReplyCache[client] == oldReplyCache[client])\r\n || (exists req_idx :: ClientIndexMatches(req_idx, client, newReplyCache, batch, replies))\r\n}\r\n\r\nlemma lemma_CReplyCacheUpdate(batch:CRequestBatch, reply_cache:CReplyCache, replies:seq, newReplyCache:CReplyCache) \r\n requires |batch| == |replies|\r\n requires ValidReplyCache(reply_cache)\r\n requires ValidReplyCache(newReplyCache)\r\n requires CReplyCacheIsAbstractable(reply_cache)\r\n requires CReplyCacheIsAbstractable(newReplyCache)\r\n requires CReplySeqIsAbstractable(replies);\r\n requires forall client :: client in newReplyCache ==> ReplyCacheUpdated(client, reply_cache, newReplyCache, batch, replies)\r\n ensures var r_newReplyCache := AbstractifyCReplyCacheToReplyCache(newReplyCache);\r\n var r_replyCache := AbstractifyCReplyCacheToReplyCache(reply_cache);\r\n forall client :: client in r_newReplyCache ==> \r\n (|| (client in r_replyCache && r_newReplyCache[client] == r_replyCache[client])\r\n || ExistsReqIdx(|batch|, replies, reply_cache, newReplyCache, client))\r\n{\r\n ghost var r_newReplyCache := AbstractifyCReplyCacheToReplyCache(newReplyCache);\r\n ghost var r_replyCache := AbstractifyCReplyCacheToReplyCache(reply_cache);\r\n forall r_client | r_client in r_newReplyCache \r\n ensures || (r_client in r_replyCache && r_newReplyCache[r_client] == r_replyCache[r_client])\r\n || ExistsReqIdx(|batch|, replies, reply_cache, newReplyCache, r_client)\r\n {\r\n lemma_AbstractifyCReplyCacheToReplyCache_properties(reply_cache);\r\n lemma_AbstractifyCReplyCacheToReplyCache_properties(newReplyCache);\r\n assert exists e :: e in newReplyCache && r_client == AbstractifyEndPointToNodeIdentity(e);\r\n var client :| client in newReplyCache && AbstractifyEndPointToNodeIdentity(client) == r_client;\r\n assert EndPointIsValidPublicKey(client);\r\n if client in reply_cache && newReplyCache[client] == reply_cache[client] {\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n assert r_client in r_replyCache;\r\n calc {\r\n r_newReplyCache[r_client];\r\n AbstractifyCReplyToReply(newReplyCache[client]);\r\n AbstractifyCReplyToReply(reply_cache[client]);\r\n r_replyCache[r_client];\r\n }\r\n } else {\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n ghost var req_idx :| ClientIndexMatches(req_idx, client, newReplyCache, batch, replies);\r\n assert 0 <= req_idx < |batch| && AbstractifyCReplySeqToReplySeq(replies)[req_idx].client == r_client && r_newReplyCache[r_client] == AbstractifyCReplySeqToReplySeq(replies)[req_idx];\r\n assert ExistsReqIdx(|batch|, replies, reply_cache, newReplyCache, r_client);\r\n }\r\n }\r\n}\r\n\r\nmethod {:timeLimitMultiplier 2} HandleRequestBatchImpl(\r\n state:AppStateMachine,\r\n batch:CRequestBatch,\r\n ghost reply_cache:CReplyCache,\r\n reply_cache_mutable:MutableMap\r\n ) returns (\r\n replies_seq:seq,\r\n ghost newReplyCache:CReplyCache,\r\n ghost g_states:seq,\r\n ghost g_replies:seq\r\n )\r\n requires ValidReplyCache(reply_cache)\r\n requires ValidRequestBatch(batch)\r\n requires CReplyCacheIsAbstractable(reply_cache)\r\n requires forall req :: req in batch ==> EndPointIsValidPublicKey(req.client)\r\n requires MutableMap.MapOf(reply_cache_mutable) == reply_cache\r\n modifies reply_cache_mutable\r\n modifies state\r\n ensures (g_states, g_replies) == HandleRequestBatch(old(state.Abstractify()), AbstractifyCRequestBatchToRequestBatch(batch));\r\n ensures |replies_seq| == |batch|\r\n ensures forall i :: 0 <= i < |batch| ==> HelperPredicateHRBI(i, batch, replies_seq, g_states)\r\n ensures g_states[0] == old(state.Abstractify())\r\n ensures g_states[|g_states|-1] == state.Abstractify()\r\n ensures CReplySeqIsAbstractable(replies_seq)\r\n ensures AbstractifyCReplySeqToReplySeq(replies_seq) == g_replies\r\n ensures ValidReplyCache(newReplyCache)\r\n ensures CReplyCacheIsAbstractable(newReplyCache)\r\n ensures forall client :: client in newReplyCache ==> ReplyCacheUpdated(client, reply_cache, newReplyCache, batch, replies_seq);\r\n ensures var r_newReplyCache := AbstractifyCReplyCacheToReplyCache(newReplyCache);\r\n var r_replyCache := AbstractifyCReplyCacheToReplyCache(reply_cache);\r\n forall client :: client in r_newReplyCache ==> \r\n (|| (client in r_replyCache && r_newReplyCache[client] == r_replyCache[client])\r\n || ExistsReqIdx(|batch|, replies_seq, reply_cache, newReplyCache, client))\r\n ensures newReplyCache == MutableMap.MapOf(reply_cache_mutable);\r\n ensures forall r :: r in replies_seq ==> ValidReply(r) && CReplyIsAbstractable(r)\r\n{\r\n ghost var g_state0 := state.Abstractify();\r\n ghost var g_batch := AbstractifyCRequestBatchToRequestBatch(batch);\r\n ghost var tuple := HandleRequestBatch(g_state0, g_batch);\r\n g_states := tuple.0;\r\n g_replies := tuple.1;\r\n\r\n assert tuple == HandleRequestBatchHidden(g_state0, g_batch);\r\n lemma_HandleRequestBatchHidden(g_state0, g_batch, g_states, g_replies);\r\n \r\n var i:uint64 := 0;\r\n ghost var replies := [];\r\n var repliesArr := new CReply[|batch| as uint64];\r\n newReplyCache := reply_cache;\r\n \r\n while i < |batch| as uint64\r\n invariant 0 <= i as int <= |batch|\r\n invariant |replies| == i as int\r\n invariant forall j :: 0 <= j < i as int ==> HelperPredicateHRBI(j, batch, replies, g_states)\r\n invariant ValidReplyCache(newReplyCache)\r\n invariant CReplyCacheIsAbstractable(newReplyCache)\r\n invariant forall r :: r in replies ==> ValidReply(r) && CReplyIsAbstractable(r)\r\n invariant AbstractifyCReplySeqToReplySeq(replies) == g_replies[..i]\r\n invariant repliesArr[..i] == replies\r\n invariant g_states[0] == g_state0\r\n invariant g_states[i] == state.Abstractify()\r\n invariant forall client {:trigger ReplyCacheUpdated(client, reply_cache, newReplyCache, batch[..i], replies)} :: \r\n client in newReplyCache ==> ReplyCacheUpdated(client, reply_cache, newReplyCache, batch[..i], replies)\r\n invariant MutableMap.MapOf(reply_cache_mutable) == newReplyCache\r\n {\r\n ghost var old_replies := replies;\r\n ghost var old_newReplyCache := newReplyCache;\r\n\r\n var old_state := state.Abstractify();\r\n var reply := state.HandleRequest(batch[i].request);\r\n var newReply := CReply(batch[i].client, batch[i].seqno, reply);\r\n assert ValidReply(newReply);\r\n\r\n replies := replies + [newReply];\r\n repliesArr[i] := newReply;\r\n newReplyCache := UpdateReplyCache(newReplyCache, reply_cache_mutable, batch[i].client, newReply, reply, i, batch, replies);\r\n i := i + 1;\r\n \r\n // Prove the invariant about HelperPredicateHRBI(j, batch, states, replies, g_states)\r\n forall j | 0 <= j < i as int \r\n ensures HelperPredicateHRBI(j, batch, replies, g_states)\r\n {\r\n if j < (i as int) - 1 {\r\n assert HelperPredicateHRBI(j, batch, old_replies, g_states); // From the loop invariant\r\n assert HelperPredicateHRBI(j, batch, replies, g_states);\r\n }\r\n }\r\n\r\n // Prove: AbstractifyCReplySeqToReplySeq(replies) == g_replies_prefix;\r\n ghost var g_replies_prefix := g_replies[..i];\r\n forall k | 0 <= k < |replies|\r\n ensures AbstractifyCReplySeqToReplySeq(replies)[k] == g_replies_prefix[k]\r\n {\r\n if k < |replies| - 1 {\r\n assert AbstractifyCReplySeqToReplySeq(old_replies) == g_replies[..i-1];\r\n } else {\r\n assert k == (i as int) - 1;\r\n ghost var reply' := AppHandleRequest(g_states[i-1], AbstractifyCAppRequestToAppRequest(batch[i-1].request)).1;\r\n calc {\r\n AbstractifyCReplySeqToReplySeq(replies)[k];\r\n AbstractifyCReplyToReply(replies[k]);\r\n Reply(AbstractifyEndPointToNodeIdentity(batch[i-1].client), batch[i-1].seqno as int, reply');\r\n Reply(g_batch[i-1].client, g_batch[i-1].seqno, \r\n AppHandleRequest(g_states[i-1], g_batch[i-1].request).1);\r\n { lemma_HandleBatchRequestProperties(g_state0, g_batch, g_states, g_replies, (i as int)-1); } \r\n g_replies_prefix[k];\r\n }\r\n }\r\n }\r\n assert AbstractifyCReplySeqToReplySeq(replies) == g_replies_prefix;\r\n\r\n // Prove the invariant about cache updates\r\n forall client | client in newReplyCache\r\n ensures ReplyCacheUpdated(client, reply_cache, newReplyCache, batch[..i], replies)\r\n {\r\n assert ReplyCacheUpdated(client, old_newReplyCache, newReplyCache, batch[..i], replies);\r\n assert || (client in old_newReplyCache && newReplyCache[client] == old_newReplyCache[client])\r\n || (exists req_idx :: ClientIndexMatches(req_idx, client, newReplyCache, batch[..i], replies));\r\n\r\n if client in old_newReplyCache {\r\n assert ReplyCacheUpdated(client, reply_cache, old_newReplyCache, batch[..i-1], old_replies);\r\n// assert || (client in reply_cache && old_newReplyCache[client] == reply_cache[client])\r\n// || (exists req_idx :: ClientIndexMatches(req_idx, client, old_newReplyCache, batch[..i-1], old_replies));\r\n if client in reply_cache && old_newReplyCache[client] == reply_cache[client] {\r\n if client in old_newReplyCache && newReplyCache[client] == old_newReplyCache[client] {\r\n assert client in reply_cache && newReplyCache[client] == reply_cache[client];\r\n assert ReplyCacheUpdated(client, reply_cache, newReplyCache, batch[..i], replies);\r\n } else {\r\n ghost var req_idx :| ClientIndexMatches(req_idx, client, newReplyCache, batch[..i], replies);\r\n assert ReplyCacheUpdated(client, reply_cache, newReplyCache, batch[..i], replies);\r\n }\r\n } else {\r\n ghost var req_idx :| ClientIndexMatches(req_idx, client, old_newReplyCache, batch[..i-1], old_replies);\r\n assert && 0 <= req_idx < |batch[..i-1]| \r\n && replies[req_idx].client == client \r\n && old_newReplyCache[client] == replies[req_idx];\r\n if client in old_newReplyCache && newReplyCache[client] == old_newReplyCache[client] {\r\n assert ClientIndexMatches(req_idx, client, newReplyCache, batch[..i], replies);\r\n } else {\r\n ghost var req_idx' :| ClientIndexMatches(req_idx', client, newReplyCache, batch[..i], replies);\r\n }\r\n assert ReplyCacheUpdated(client, reply_cache, newReplyCache, batch[..i], replies);\r\n }\r\n }\r\n\r\n assert || (client in reply_cache && newReplyCache[client] == reply_cache[client])\r\n || (exists req_idx :: ClientIndexMatches(req_idx, client, newReplyCache, batch[..i], replies));\r\n }\r\n }\r\n \r\n replies_seq := repliesArr[..];\r\n \r\n // Connect the while-loop invariant to the ensures\r\n forall client | client in newReplyCache\r\n ensures replies_seq == replies\r\n ensures ReplyCacheUpdated(client, reply_cache, newReplyCache, batch, replies)\r\n {\r\n assert ReplyCacheUpdated(client, reply_cache, newReplyCache, batch[..i], replies);\r\n assert i as int == |batch|;\r\n assert batch[..i] == batch;\r\n }\r\n \r\n assert replies_seq == replies;\r\n assert forall j :: 0 <= j < |batch| ==> j < |replies_seq| && HelperPredicateHRBI(j, batch, replies_seq, g_states);\r\n\r\n lemma_CReplyCacheUpdate(batch, reply_cache, replies, newReplyCache);\r\n}\r\n\r\nmethod {:timeLimitMultiplier 6} UpdateReplyCache(ghost reply_cache:CReplyCache, reply_cache_mutable:MutableMap, ep:EndPoint, newReply:CReply, reply:CAppReply, i:uint64, batch:CRequestBatch, ghost replies:seq) returns (ghost newReplyCache:CReplyCache)\r\n requires EndPointIsValidPublicKey(ep)\r\n requires ValidReply(newReply)\r\n requires CReplyIsAbstractable(newReply)\r\n requires 0 <= i as int < |batch|\r\n requires |replies| == |batch[..(i as int)+1]|\r\n requires replies[i] == newReply\r\n requires newReply.client == ep\r\n requires ValidReplyCache(reply_cache)\r\n requires CReplyCacheIsAbstractable(reply_cache)\r\n requires forall r :: r in replies ==> CReplyIsAbstractable(r)\r\n requires newReply == CReply(batch[i].client, batch[i].seqno, reply)\r\n requires MutableMap.MapOf(reply_cache_mutable) == reply_cache\r\n modifies reply_cache_mutable\r\n ensures ValidReplyCache(newReplyCache)\r\n ensures CReplyCacheIsAbstractable(newReplyCache)\r\n ensures forall client :: client in newReplyCache ==> ReplyCacheUpdated(client, reply_cache, newReplyCache, batch[..(i as int)+1], replies)\r\n ensures forall client :: client in newReplyCache ==> (|| (client in reply_cache && newReplyCache[client] == reply_cache[client])\r\n || ExistsReqIdxConcrete((i as int)+1, replies, reply_cache, newReplyCache, client))\r\n ensures var r_newReplyCache := AbstractifyCReplyCacheToReplyCache(newReplyCache);\r\n var r_replyCache := AbstractifyCReplyCacheToReplyCache(reply_cache);\r\n forall client :: client in r_newReplyCache ==> (|| (client in r_replyCache && r_newReplyCache[client] == r_replyCache[client])\r\n || ExistsReqIdx((i as int)+1, replies, reply_cache, newReplyCache, client))\r\n ensures newReplyCache == MutableMap.MapOf(reply_cache_mutable)\r\n{\r\n lemma_AbstractifyCReplyCacheToReplyCache_properties(reply_cache);\r\n ghost var slimReplyCache:CReplyCache;\r\n var staleEntry;\r\n var cache_size := reply_cache_mutable.SizeModest();\r\n if cache_size == 255 as uint64 { // max_reply_cache_size()\r\n staleEntry :| staleEntry in MutableMap.MapOf(reply_cache_mutable); // TODO: Choose based on age // TODO: This is very inefficient. Optimize value selection.\r\n slimReplyCache := RemoveElt(reply_cache, staleEntry);\r\n reply_cache_mutable.Remove(staleEntry);\r\n } else {\r\n slimReplyCache := reply_cache;\r\n }\r\n lemma_AbstractifyCReplyCacheToReplyCache_properties(slimReplyCache);\r\n assert ValidReplyCache(slimReplyCache);\r\n forall e {:trigger EndPointIsValidPublicKey(e)} | e in slimReplyCache \r\n ensures EndPointIsValidPublicKey(e) && CReplyIsAbstractable(slimReplyCache[e])\r\n {\r\n }\r\n newReplyCache := slimReplyCache[ep := newReply];\r\n reply_cache_mutable.Set(ep, newReply);\r\n forall e {:trigger EndPointIsValidPublicKey(e)} | e in newReplyCache \r\n ensures EndPointIsValidPublicKey(e) && CReplyIsAbstractable(newReplyCache[e])\r\n {\r\n if (e == ep) {\r\n\r\n }\r\n }\r\n// assert forall e {:trigger EndPointIsValidPublicKey(e)} :: e in newReplyCache ==> EndPointIsValidPublicKey(e) && CReplyIsAbstractable(newReplyCache[e]);\r\n assert CReplyCacheIsAbstractable(newReplyCache);\r\n lemma_AbstractifyCReplyCacheToReplyCache_properties(newReplyCache);\r\n assert ep in newReplyCache;\r\n assert EndPointIsValidPublicKey(ep);\r\n assert CReplyCacheIsAbstractable(newReplyCache);\r\n assert ValidReplyCache(newReplyCache);\r\n ghost var r_newReplyCache := AbstractifyCReplyCacheToReplyCache(newReplyCache);\r\n ghost var r_replyCache := AbstractifyCReplyCacheToReplyCache(reply_cache);\r\n forall client | client in r_newReplyCache\r\n ensures || (client in r_replyCache && r_newReplyCache[client] == r_replyCache[client])\r\n || ExistsReqIdx((i as int)+1, replies, reply_cache, newReplyCache, client)\r\n ensures ReplyCacheUpdated(RefineNodeIdentityToEndPoint(client), reply_cache, newReplyCache, batch[..i+1], replies)\r\n {\r\n var e := RefineNodeIdentityToEndPoint(client);\r\n if e == ep {\r\n assert AbstractifyCReplySeqToReplySeq(replies)[i].client == AbstractifyCReplyToReply(replies[i]).client;\r\n assert AbstractifyCReplySeqToReplySeq(replies)[i].client == client && r_newReplyCache[client] == AbstractifyCReplySeqToReplySeq(replies)[i];\r\n assert ExistsReqIdx((i as int)+1, replies, reply_cache, newReplyCache, client);\r\n assert ClientIndexMatches(i as int, e, newReplyCache, batch[..(i as int)+1], replies);\r\n assert ReplyCacheUpdated(RefineNodeIdentityToEndPoint(client), reply_cache, newReplyCache, batch[..(i as int)+1], replies);\r\n } else {\r\n assert e in reply_cache;\r\n if e == staleEntry && |reply_cache| == 0x1_0000_0000 - 1 {\r\n assert e !in slimReplyCache;\r\n \r\n assert e !in newReplyCache;\r\n assert AbstractifyEndPointToNodeIdentity(e) !in r_newReplyCache;\r\n assert false;\r\n } else {\r\n assert e in slimReplyCache;\r\n }\r\n assert e in slimReplyCache;\r\n \r\n assert newReplyCache[e] == reply_cache[e];\r\n assert AbstractifyCReplyCacheToReplyCache(newReplyCache)[AbstractifyEndPointToNodeIdentity(e)] == AbstractifyCReplyToReply(newReplyCache[e]);\r\n assert AbstractifyCReplyCacheToReplyCache(reply_cache)[AbstractifyEndPointToNodeIdentity(e)] == AbstractifyCReplyToReply(reply_cache[e]);\r\n assert ReplyCacheUpdated(RefineNodeIdentityToEndPoint(client), reply_cache, newReplyCache, batch[..(i as int)+1], replies);\r\n }\r\n }\r\n\r\n forall client | client in newReplyCache \r\n ensures ReplyCacheUpdated(client, reply_cache, newReplyCache, batch[..i+1], replies)\r\n {\r\n assert EndPointIsValidPublicKey(client); // OBSERVE: Needed b/c someone put an oddly strict trigger on lemma_AbstractifyCReplyCacheToReplyCache_properties\r\n lemma_AbstractifyCReplyCacheToReplyCache_properties(newReplyCache);\r\n assert AbstractifyEndPointToNodeIdentity(client) in r_newReplyCache;\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n assert client == RefineNodeIdentityToEndPoint(AbstractifyEndPointToNodeIdentity(client));\r\n }\r\n}\r\n\r\nlemma lemma_HelperPredicateHRBI(j:int, batch:CRequestBatch, replies:seq, g_states:seq)\r\n requires 0 <= j < |batch|\r\n requires 0 <= j < |g_states|-1\r\n requires 0 <= j < |replies|\r\n requires HelperPredicateHRBI(j, batch, replies, g_states)\r\n ensures replies[j].CReply?\r\n ensures (g_states[j+1], AbstractifyCAppReplyToAppReply(replies[j].reply)) == AppHandleRequest(g_states[j], AbstractifyCAppRequestToAppRequest(batch[j].request))\r\n ensures replies[j].client == batch[j].client\r\n ensures replies[j].seqno == batch[j].seqno\r\n{\r\n}\r\n\r\npredicate HelperPredicateHRBI(j:int, batch:CRequestBatch, replies:seq, g_states:seq)\r\n requires 0 <= j < |batch|\r\n requires 0 <= j < |g_states|-1\r\n requires 0 <= j < |replies|\r\n{\r\n && replies[j].CReply?\r\n && ((g_states[j+1], AbstractifyCAppReplyToAppReply(replies[j].reply)) == AppHandleRequest(g_states[j], AbstractifyCAppRequestToAppRequest(batch[j].request)))\r\n && replies[j].client == batch[j].client\r\n && replies[j].seqno == batch[j].seqno\r\n}\r\n\r\n// Same as x == y, but triggers extensional equality on fields and provides better error diagnostics\r\npredicate Eq_ExecutorState(x:LExecutor, y:LExecutor)\r\n{\r\n && x.constants == y.constants\r\n && x.app == y.app\r\n && x.ops_complete == y.ops_complete\r\n && x.next_op_to_execute == y.next_op_to_execute\r\n}\r\n\r\nmethod ExecutorInit(ccons:ReplicaConstantsState) returns(cs:ExecutorState, reply_cache_mutable:MutableMap)\r\n requires ReplicaConstantsState_IsValid(ccons)\r\n ensures ExecutorState_IsValid(cs)\r\n ensures LExecutorInit(AbstractifyExecutorStateToLExecutor(cs), AbstractifyReplicaConstantsStateToLReplicaConstants(ccons))\r\n ensures cs.constants == ccons\r\n ensures fresh(reply_cache_mutable)\r\n ensures cs.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n{\r\n ghost var c := AbstractifyReplicaConstantsStateToLReplicaConstants(ccons);\r\n ghost var s := LExecutor(\r\n c,\r\n AppInitialize(),\r\n 0,\r\n Ballot(0, 0),\r\n OutstandingOpUnknown(),\r\n map[]);\r\n var app_state := AppStateMachine.Initialize();\r\n cs := ExecutorState(\r\n ccons,\r\n app_state,\r\n COperationNumber(0),\r\n CBallot(0, 0),\r\n COutstandingOpUnknown(),\r\n map[]);\r\n reply_cache_mutable := MutableMap.EmptyMap();\r\n\r\n lemma_AbstractifyCReplyCacheToReplyCache_properties(cs.reply_cache);\r\n assert Eq_ExecutorState(s, AbstractifyExecutorStateToLExecutor(cs));\r\n}\r\n\r\nmethod ExecutorGetDecision(cs:ExecutorState, cbal:CBallot, copn:COperationNumber, ca:CRequestBatch) returns(cs':ExecutorState)\r\n requires ExecutorState_IsValid(cs)\r\n requires ValidRequestBatch(ca)\r\n requires CBallotIsAbstractable(cbal)\r\n requires copn == cs.ops_complete\r\n requires cs.next_op_to_execute.COutstandingOpUnknown?\r\n ensures ExecutorState_IsValid(cs')\r\n ensures LExecutorGetDecision(AbstractifyExecutorStateToLExecutor(cs), AbstractifyExecutorStateToLExecutor(cs'), AbstractifyCBallotToBallot(cbal), AbstractifyCOperationNumberToOperationNumber(copn), AbstractifyCRequestBatchToRequestBatch(ca))\r\n ensures cs.constants == cs'.constants\r\n ensures cs'.reply_cache == cs.reply_cache\r\n{\r\n ghost var s := AbstractifyExecutorStateToLExecutor(cs);\r\n ghost var v := AbstractifyCRequestBatchToRequestBatch(ca);\r\n ghost var opn := AbstractifyCOperationNumberToOperationNumber(copn);\r\n ghost var bal := AbstractifyCBallotToBallot(cbal);\r\n ghost var s' := s.(next_op_to_execute := OutstandingOpKnown(v, bal));\r\n cs' := cs.(next_op_to_execute := COutstandingOpKnown(ca, cbal));\r\n\r\n assert Eq_ExecutorState(s', AbstractifyExecutorStateToLExecutor(cs'));\r\n}\r\n\r\npredicate ExistsReqIdx(len:int, replies:seq, reply_cache:CReplyCache, newReplyCache:CReplyCache, client:NodeIdentity)\r\n requires CReplyCacheIsAbstractable(reply_cache)\r\n requires CReplyCacheIsAbstractable(newReplyCache)\r\n requires client in AbstractifyCReplyCacheToReplyCache(newReplyCache)\r\n requires |replies| == len\r\n requires (forall i :: i in replies ==> CReplyIsAbstractable(i))\r\n{\r\n var r_newReplyCache := AbstractifyCReplyCacheToReplyCache(newReplyCache);\r\n var r_replyCache := AbstractifyCReplyCacheToReplyCache(reply_cache );\r\n exists req_idx :: 0 <= req_idx < len && AbstractifyCReplySeqToReplySeq(replies)[req_idx].client == client && r_newReplyCache[client] == AbstractifyCReplySeqToReplySeq(replies)[req_idx]\r\n}\r\n\r\npredicate ExistsReqIdxConcrete(len:int, replies:seq, reply_cache:CReplyCache, newReplyCache:CReplyCache, client:EndPoint)\r\n requires client in newReplyCache\r\n requires |replies| == len\r\n requires (forall i :: i in replies ==> CReplyIsAbstractable(i))\r\n{\r\n exists req_idx :: 0 <= req_idx < len && replies[req_idx].client == client && newReplyCache[client] == replies[req_idx]\r\n}\r\n\r\n/*\r\nlemma lemma_BatchEquivalence(cv:CRequestBatch, cstates:seq, creplies:seq, v:RequestBatch, states:seq, replies:seq)\r\n requires var temp := HandleRequestBatch(s.app, v)\r\n{\r\n\r\n}\r\n*/\r\n\r\nlemma lemma_ExistsReqIdx(len:int, replies:seq, reply_cache:CReplyCache, newReplyCache:CReplyCache, client:NodeIdentity)\r\n requires CReplyCacheIsAbstractable(reply_cache)\r\n requires CReplyCacheIsAbstractable(newReplyCache)\r\n requires client in AbstractifyCReplyCacheToReplyCache(newReplyCache)\r\n requires |replies| == len\r\n requires (forall i :: i in replies ==> CReplyIsAbstractable(i))\r\n requires ExistsReqIdx(len, replies, reply_cache, newReplyCache, client)\r\n ensures exists req_idx :: 0 <= req_idx < len && AbstractifyCReplySeqToReplySeq(replies)[req_idx].client == client && AbstractifyCReplyCacheToReplyCache(newReplyCache)[client] == AbstractifyCReplySeqToReplySeq(replies)[req_idx]\r\n{\r\n}\r\n\r\n\r\nmethod GetPacketsFromRepliesImpl(me:EndPoint, requests:CRequestBatch, replies:seq) returns (cout_seq:seq)\r\n requires |requests| == |replies| < 0x1_0000_0000_0000_0000\r\n requires forall r :: r in requests ==> ValidRequest(r)\r\n requires forall r :: r in replies ==> ValidReply(r) && CReplyIsAbstractable(r)\r\n requires EndPointIsValidPublicKey(me)\r\n ensures CPacketSeqIsAbstractable(cout_seq)\r\n ensures |cout_seq| == |replies|\r\n ensures forall p :: p in cout_seq ==> p.src == me && p.msg.CMessage_Reply? && CPacketIsSendable(p)\r\n ensures AbstractifySeqOfCPacketsToSeqOfRslPackets(cout_seq) == GetPacketsFromReplies(AbstractifyEndPointToNodeIdentity(me), AbstractifyCRequestsSeqToRequestsSeq(requests), AbstractifyCReplySeqToReplySeq(replies))\r\n{\r\n var i:uint64 := 0;\r\n ghost var cout := [];\r\n var coutArr := new CPacket[|replies| as uint64];\r\n\r\n while i < |replies| as uint64 \r\n invariant 0 <= i as int <= |replies|\r\n invariant |cout| == i as int\r\n invariant coutArr[..i] == cout\r\n invariant CPacketSeqIsAbstractable(cout)\r\n invariant forall p :: p in cout ==> p.src == me && p.msg.CMessage_Reply? && CPacketIsSendable(p)\r\n invariant forall j :: 0 <= j < i ==> cout[j] == CPacket(requests[j].client, me, CMessage_Reply(requests[j].seqno, replies[j].reply))\r\n {\r\n assert ValidRequest(requests[i]) && ValidReply(replies[i]);\r\n var cmsg := CMessage_Reply(requests[i].seqno, replies[i].reply);\r\n if PrintParams.ShouldPrintProgress() {\r\n print(\"Sending reply to client \");\r\n print(requests[i].client);\r\n print(\" with sequence number \");\r\n print(requests[i].seqno);\r\n print(\"\\n\");\r\n }\r\n var cp := CPacket(requests[i].client, me, cmsg);\r\n cout := cout + [cp];\r\n coutArr[i] := cp;\r\n i := i + 1;\r\n }\r\n\r\n // Prove the final ensures clause\r\n ghost var r_cout := AbstractifySeqOfCPacketsToSeqOfRslPackets(cout);\r\n ghost var r_me := AbstractifyEndPointToNodeIdentity(me);\r\n ghost var r_requests := AbstractifyCRequestsSeqToRequestsSeq(requests);\r\n ghost var r_replies := AbstractifyCReplySeqToReplySeq(replies);\r\n ghost var r_cout' := GetPacketsFromReplies(r_me, r_requests, r_replies);\r\n\r\n calc {\r\n |r_cout|;\r\n |cout|;\r\n |replies|;\r\n |AbstractifyCReplySeqToReplySeq(replies)|;\r\n { lemma_SizeOfGetPacketsFromReplies(r_me, r_requests, r_replies, r_cout'); }\r\n |r_cout'|;\r\n }\r\n forall j | 0 <= j < |r_cout| \r\n ensures r_cout[j] == r_cout'[j]\r\n {\r\n calc {\r\n r_cout[j];\r\n AbstractifyCPacketToRslPacket(cout[j]);\r\n AbstractifyCPacketToRslPacket(CPacket(requests[j].client, me, CMessage_Reply(requests[j].seqno, replies[j].reply)));\r\n LPacket(r_requests[j].client, r_me, RslMessage_Reply(r_requests[j].seqno, r_replies[j].reply));\r\n { lemma_SpecificPacketInGetPacketsFromReplies(r_me, r_requests, r_replies, r_cout', j); }\r\n r_cout'[j];\r\n }\r\n }\r\n cout_seq := coutArr[..];\r\n}\r\n\r\nlemma lemma_OutboundPackets(cout:OutboundPackets, me:EndPoint)\r\n requires cout.PacketSequence?\r\n requires forall p :: p in cout.s ==> CPacketIsSendable(p) && p.src == me\r\n requires CPacketSeqIsAbstractable(cout.s)\r\n requires |cout.s| < 0xFFFF_FFFF_FFFF_FFFF\r\n ensures OutboundPacketsIsValid(cout)\r\n ensures OutboundPacketsHasCorrectSrc(cout, me)\r\n ensures OutboundPacketsIsAbstractable(cout)\r\n ensures AbstractifyOutboundCPacketsToSeqOfRslPackets(cout) == AbstractifySeqOfCPacketsToSeqOfRslPackets(cout.s)\r\n{\r\n}\r\n\r\nmethod {:timeLimitMultiplier 4} ExecutorExecute(cs:ExecutorState, reply_cache_mutable:MutableMap) returns(cs':ExecutorState, cout:OutboundPackets)\r\n requires ExecutorState_IsValid(cs)\r\n requires cs.ops_complete.n < cs.constants.all.params.max_integer_val\r\n requires cs.next_op_to_execute.COutstandingOpKnown?\r\n requires MutableMap.MapOf(reply_cache_mutable) == cs.reply_cache\r\n modifies cs.app\r\n modifies reply_cache_mutable\r\n ensures ExecutorState_IsValid(cs')\r\n ensures OutboundPacketsIsValid(cout)\r\n ensures OutboundPacketsHasCorrectSrc(cout, cs.constants.all.config.replica_ids[cs.constants.my_index])\r\n ensures OutboundPacketsIsAbstractable(cout)\r\n ensures LtUpperBound(AbstractifyExecutorStateToLExecutor(cs).ops_complete, AbstractifyExecutorStateToLExecutor(cs).constants.all.params.max_integer_val)\r\n ensures LExecutorExecute(old(AbstractifyExecutorStateToLExecutor(cs)), AbstractifyExecutorStateToLExecutor(cs'), AbstractifyOutboundCPacketsToSeqOfRslPackets(cout))\r\n ensures cs.constants == cs'.constants\r\n ensures cs'.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n{\r\n var cv := cs.next_op_to_execute.v;\r\n //var start_time := Time.GetDebugTimeTicks();\r\n ghost var s := AbstractifyExecutorStateToLExecutor(cs);\r\n ghost var v := AbstractifyCRequestBatchToRequestBatch(cv);\r\n\r\n assert AbstractifyCRequestBatchToRequestBatch(cv) == AbstractifyExecutorStateToLExecutor(cs).next_op_to_execute.v;\r\n assert AbstractifyCAppStateToAppState(cs.app.Abstractify()) == AbstractifyExecutorStateToLExecutor(cs).app;\r\n\r\n ghost var g_tuple := HandleRequestBatch(s.app, v);\r\n lemma_AbstractifyCReplyCacheToReplyCache_properties(cs.reply_cache);\r\n var creplies;\r\n ghost var states, replies, newReplyCache;\r\n var start_time_request_batch := Time.GetDebugTimeTicks();\r\n creplies, newReplyCache, states, replies := HandleRequestBatchImpl(cs.app, cv, cs.reply_cache, reply_cache_mutable);\r\n var end_time_request_batch := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"ExecutorExecute_HandleRequestBatch\", start_time_request_batch, end_time_request_batch);\r\n assert replies == AbstractifyCReplySeqToReplySeq(creplies);\r\n ghost var new_state := states[|states|-1];\r\n assert forall i :: 0 <= i < |cv| ==> AbstractifyCRequestToRequest(cv[i]) == v[i];\r\n \r\n //var end_time_app := Time.GetDebugTimeTicks();\r\n\r\n lemma_AbstractifyCReplyCacheToReplyCache_properties(newReplyCache);\r\n assert forall client :: client in newReplyCache ==> (|| (client in cs.reply_cache && newReplyCache[client] == cs.reply_cache[client])\r\n || (exists req_idx :: 0 <= req_idx < |cv| && creplies[req_idx].client == client && newReplyCache[client] == creplies[req_idx]));\r\n\r\n var newMaxBalReflected := (if CBallotIsNotGreaterThan(cs.max_bal_reflected, cs.next_op_to_execute.bal) then cs.next_op_to_execute.bal else cs.max_bal_reflected);\r\n cs' := cs.(ops_complete := COperationNumber(cs.ops_complete.n + 1),\r\n max_bal_reflected := newMaxBalReflected,\r\n next_op_to_execute := COutstandingOpUnknown(),\r\n reply_cache := newReplyCache);\r\n \r\n assert cs'.ops_complete.COperationNumber?;\r\n assert COperationNumberIsAbstractable(cs'.ops_complete);\r\n ghost var s' := AbstractifyExecutorStateToLExecutor(cs');\r\n \r\n assert s'.reply_cache == AbstractifyCReplyCacheToReplyCache(newReplyCache);\r\n assert AbstractifyExecutorStateToLExecutor(cs).reply_cache == AbstractifyCReplyCacheToReplyCache(cs.reply_cache);\r\n assert s.reply_cache == AbstractifyCReplyCacheToReplyCache(cs.reply_cache);\r\n \r\n var i := |cv|-1;\r\n if |cv| > 0 {\r\n assert 0 <= i < |cv|;\r\n } else {\r\n assert nextstep(i) == 0;\r\n }\r\n calc {\r\n nextstep(i);\r\n |cv|-1+1;\r\n |cv|;\r\n |states|-1;\r\n }\r\n assert AbstractifyExecutorStateToLExecutor(cs').app == new_state;\r\n\r\n var cme := cs.constants.all.config.replica_ids[cs.constants.my_index];\r\n assert forall r :: r in creplies ==> ValidReply(r) && CReplyIsAbstractable(r);\r\n assert cme == cs.constants.all.config.replica_ids[cs.constants.my_index];\r\n lemma_InSequence(cs.constants.all.config.replica_ids, cme, cs.constants.my_index);\r\n assert cme in cs.constants.all.config.replica_ids;\r\n assert ReplicaConstantsState_IsValid(cs.constants);\r\n assert CPaxosConfigurationIsValid(cs.constants.all.config);\r\n assert forall r :: r in cs.constants.all.config.replica_ids ==> EndPointIsValidPublicKey(r);\r\n assert EndPointIsValidPublicKey(cme);\r\n \r\n var start_time_get_packets := Time.GetDebugTimeTicks();\r\n var packets := GetPacketsFromRepliesImpl(cme, cv, creplies);\r\n cout := PacketSequence(packets);\r\n var end_time_get_packets := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"ExecutorExecute_GetPackets\", start_time_get_packets, end_time_get_packets);\r\n assert forall p :: p in packets ==> CPacketIsSendable(p);\r\n assert cout.PacketSequence?;\r\n assert forall p :: p in cout.s ==> CPacketIsSendable(p);\r\n lemma_OutboundPackets(cout, cme);\r\n assert OutboundPacketsIsValid(cout);\r\n \r\n assert OutboundPacketsHasCorrectSrc(cout, cme);\r\n\r\n ghost var out := AbstractifyOutboundCPacketsToSeqOfRslPackets(cout);\r\n ghost var refinedSeq := AbstractifySeqOfCPacketsToSeqOfRslPackets(cout.s);\r\n assert out == refinedSeq;\r\n assert refinedSeq == GetPacketsFromReplies(AbstractifyEndPointToNodeIdentity(cme), AbstractifyCRequestsSeqToRequestsSeq(cv), AbstractifyCReplySeqToReplySeq(creplies));\r\n lemma_BatchAndRequestSeqEquivalence(cv);\r\n assert AbstractifyCRequestsSeqToRequestsSeq(cv) == AbstractifyCRequestBatchToRequestBatch(cv);\r\n assert refinedSeq == GetPacketsFromReplies(AbstractifyEndPointToNodeIdentity(cme), AbstractifyCRequestBatchToRequestBatch(cv), AbstractifyCReplySeqToReplySeq(creplies));\r\n \r\n assert AbstractifyEndPointToNodeIdentity(cme) == s.constants.all.config.replica_ids[s.constants.my_index];\r\n assert AbstractifyCRequestBatchToRequestBatch(cv) == AbstractifyExecutorStateToLExecutor(cs).next_op_to_execute.v;\r\n assert s.next_op_to_execute.v == AbstractifyCRequestBatchToRequestBatch(cv);\r\n assert replies == HandleRequestBatch(s.app, s.next_op_to_execute.v).1;\r\n assert replies == AbstractifyCReplySeqToReplySeq(creplies);\r\n assert refinedSeq == GetPacketsFromReplies(s.constants.all.config.replica_ids[s.constants.my_index], s.next_op_to_execute.v, replies);\r\n calc {\r\n out;\r\n refinedSeq;\r\n GetPacketsFromReplies(s.constants.all.config.replica_ids[s.constants.my_index], s.next_op_to_execute.v, replies);\r\n }\r\n assert out == GetPacketsFromReplies(s.constants.all.config.replica_ids[s.constants.my_index], s.next_op_to_execute.v, replies);\r\n assert AbstractifyExecutorStateToLExecutor(cs').ops_complete == AbstractifyExecutorStateToLExecutor(cs).ops_complete + 1;\r\n}\r\n\r\nlemma lemma_BatchAndRequestSeqEquivalence(s:seq)\r\n requires CRequestsSeqIsAbstractable(s)\r\n ensures AbstractifyCRequestsSeqToRequestsSeq(s) == AbstractifyCRequestBatchToRequestBatch(s)\r\n{\r\n reveal AbstractifyCRequestBatchToRequestBatch();\r\n}\r\n\r\nlemma lemma_InSequence(s:seq, p:T, i:uint64)\r\n requires 0 <= i as int < |s|\r\n requires s[i] == p\r\n ensures p in s\r\n{\r\n}\r\n\r\nmethod ExecutorProcessAppStateSupply(cs:ExecutorState, cinp:CPacket) returns(cs':ExecutorState)\r\n requires ExecutorState_IsValid(cs)\r\n requires CPacketIsAbstractable(cinp)\r\n requires cinp.msg.CMessage_AppStateSupply?\r\n requires CAppStateMarshallable(cinp.msg.app_state)\r\n requires cinp.src in cs.constants.all.config.replica_ids\r\n requires cinp.msg.opn_state_supply.n > cs.ops_complete.n\r\n ensures ExecutorState_IsValid(cs')\r\n ensures AbstractifyCPacketToRslPacket(cinp).msg.RslMessage_AppStateSupply?\r\n ensures AbstractifyCPacketToRslPacket(cinp).src in AbstractifyExecutorStateToLExecutor(cs).constants.all.config.replica_ids\r\n ensures AbstractifyCPacketToRslPacket(cinp).msg.opn_state_supply > AbstractifyExecutorStateToLExecutor(cs).ops_complete\r\n ensures LExecutorProcessAppStateSupply(AbstractifyExecutorStateToLExecutor(cs), AbstractifyExecutorStateToLExecutor(cs'), AbstractifyCPacketToRslPacket(cinp))\r\n ensures cs.constants == cs'.constants\r\n ensures cs'.reply_cache == cs.reply_cache\r\n{\r\n ghost var s := AbstractifyExecutorStateToLExecutor(cs);\r\n ghost var inp := AbstractifyCPacketToRslPacket(cinp);\r\n ghost var m := inp.msg;\r\n ghost var s' := s.(\r\n app := m.app_state,\r\n ops_complete := m.opn_state_supply,\r\n max_bal_reflected := m.bal_state_supply,\r\n next_op_to_execute := OutstandingOpUnknown());\r\n var cm := cinp.msg;\r\n var app_state := AppStateMachine.Deserialize(cm.app_state);\r\n\r\n cs' := cs.(\r\n app := app_state,\r\n ops_complete := cm.opn_state_supply,\r\n max_bal_reflected := cm.bal_state_supply,\r\n next_op_to_execute := COutstandingOpUnknown());\r\n\r\n assert Eq_ExecutorState(s', AbstractifyExecutorStateToLExecutor(cs'));\r\n}\r\n\r\nmethod ExecutorProcessAppStateRequest(cs:ExecutorState, cinp:CPacket, reply_cache_mutable:MutableMap) returns(cs':ExecutorState, cout:OutboundPackets)\r\n requires ExecutorState_IsValid(cs)\r\n requires CPacketIsAbstractable(cinp)\r\n requires cinp.msg.CMessage_AppStateRequest?\r\n requires MutableMap.MapOf(reply_cache_mutable) == cs.reply_cache\r\n ensures ExecutorState_IsValid(cs')\r\n ensures OutboundPacketsIsValid(cout)\r\n ensures AbstractifyCPacketToRslPacket(cinp).msg.RslMessage_AppStateRequest?\r\n ensures OutboundPacketsHasCorrectSrc(cout, cs.constants.all.config.replica_ids[cs.constants.my_index])\r\n ensures OutboundPacketsIsAbstractable(cout)\r\n ensures LExecutorProcessAppStateRequest(AbstractifyExecutorStateToLExecutor(cs), AbstractifyExecutorStateToLExecutor(cs'), AbstractifyCPacketToRslPacket(cinp), AbstractifyOutboundCPacketsToSeqOfRslPackets(cout))\r\n ensures cs == cs'\r\n{\r\n ghost var s := AbstractifyExecutorStateToLExecutor(cs);\r\n ghost var inp := AbstractifyCPacketToRslPacket(cinp);\r\n ghost var m := inp.msg;\r\n ghost var s' := s;\r\n ghost var out:seq;\r\n cs' := cs;\r\n\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n lemma_AbstractifyEndPointsToNodeIdentities_properties(cs.constants.all.config.replica_ids);\r\n\r\n if cinp.src in cs.constants.all.config.replica_ids && CBallotIsNotGreaterThan(cs.max_bal_reflected, cinp.msg.bal_state_req) && cs.ops_complete.n >= cinp.msg.opn_state_req.n {\r\n ghost var me := s.constants.all.config.replica_ids[s.constants.my_index];\r\n var cme := cs.constants.all.config.replica_ids[cs.constants.my_index];\r\n var reply_cache := MutableMap.MapOf(reply_cache_mutable);\r\n var app_state := cs.app.Serialize();\r\n out := [ LPacket(inp.src, me, RslMessage_AppStateSupply(s.max_bal_reflected, s.ops_complete, s.app)) ];\r\n cout := OutboundPacket(Some(CPacket(cinp.src, cme, CMessage_AppStateSupply(cs.max_bal_reflected, cs.ops_complete, app_state))));\r\n } else {\r\n out := [];\r\n cout := OutboundPacket(None());\r\n }\r\n\r\n assert AbstractifyOutboundCPacketsToSeqOfRslPackets(cout) == out;\r\n}\r\n\r\nmethod ExecutorProcessStartingPhase2(cs:ExecutorState, cinp:CPacket) returns(cs':ExecutorState, cout:CBroadcast)\r\n requires ExecutorState_IsValid(cs)\r\n requires CPacketIsAbstractable(cinp)\r\n requires cinp.msg.CMessage_StartingPhase2?\r\n ensures ExecutorState_IsValid(cs')\r\n ensures CBroadcastIsValid(cout)\r\n ensures OutboundPacketsHasCorrectSrc(Broadcast(cout), cs.constants.all.config.replica_ids[cs.constants.my_index])\r\n ensures AbstractifyCPacketToRslPacket(cinp).msg.RslMessage_StartingPhase2?\r\n ensures LExecutorProcessStartingPhase2(AbstractifyExecutorStateToLExecutor(cs), AbstractifyExecutorStateToLExecutor(cs'), AbstractifyCPacketToRslPacket(cinp), AbstractifyCBroadcastToRlsPacketSeq(cout))\r\n ensures cs == cs'\r\n ensures OutboundPacketsHasCorrectSrc(Broadcast(cout), cs'.constants.all.config.replica_ids[cs'.constants.my_index])\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n ghost var s := AbstractifyExecutorStateToLExecutor(cs);\r\n ghost var inp := AbstractifyCPacketToRslPacket(cinp);\r\n ghost var opn := inp.msg.logTruncationPoint_2;\r\n ghost var s' := s;\r\n ghost var out:seq;\r\n var copn := cinp.msg.logTruncationPoint_2;\r\n cs' := cs;\r\n\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n lemma_AbstractifyEndPointsToNodeIdentities_properties(cs.constants.all.config.replica_ids);\r\n\r\n if cinp.src in cs.constants.all.config.replica_ids && copn.n > cs.ops_complete.n {\r\n ghost var msg := RslMessage_AppStateRequest(inp.msg.bal_2, opn);\r\n var cmsg := CMessage_AppStateRequest(cinp.msg.bal_2, copn);\r\n out := BuildLBroadcast(s.constants.all.config.replica_ids[s.constants.my_index], \r\n s.constants.all.config.replica_ids, msg);\r\n cout := BuildBroadcastToEveryone(cs.constants.all.config, cs.constants.my_index, cmsg);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"ExecutorProcessStartingPhase2_request\", start_time, end_time);\r\n } else {\r\n out := [];\r\n cout := CBroadcastNop;\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"ExecutorProcessStartingPhase2_nada\", start_time, end_time);\r\n }\r\n}\r\n\r\nmethod ExecutorProcessRequest(cs:ExecutorState, cinp:CPacket, cachedReply:CReply, reply_cache_mutable:MutableMap)\r\n returns(cout:OutboundPackets)\r\n requires ExecutorState_IsValid(cs)\r\n requires CPacketIsAbstractable(cinp)\r\n requires cinp.msg.CMessage_Request?\r\n requires cinp.src in cs.reply_cache\r\n requires cachedReply == cs.reply_cache[cinp.src]\r\n requires cachedReply.CReply?\r\n requires cinp.msg.seqno <= cachedReply.seqno\r\n requires MutableMap.MapOf(reply_cache_mutable) == cs.reply_cache\r\n ensures OutboundPacketsIsValid(cout)\r\n ensures OutboundPacketsHasCorrectSrc(cout, cs.constants.all.config.replica_ids[cs.constants.my_index])\r\n ensures OutboundPacketsIsAbstractable(cout)\r\n ensures AbstractifyCPacketToRslPacket(cinp).msg.RslMessage_Request?\r\n ensures AbstractifyCPacketToRslPacket(cinp).src in AbstractifyExecutorStateToLExecutor(cs).reply_cache\r\n ensures AbstractifyExecutorStateToLExecutor(cs).reply_cache[AbstractifyCPacketToRslPacket(cinp).src].Reply?\r\n ensures AbstractifyCPacketToRslPacket(cinp).msg.seqno_req <= AbstractifyExecutorStateToLExecutor(cs).reply_cache[AbstractifyCPacketToRslPacket(cinp).src].seqno\r\n ensures LExecutorProcessRequest(AbstractifyExecutorStateToLExecutor(cs), AbstractifyCPacketToRslPacket(cinp), AbstractifyOutboundCPacketsToSeqOfRslPackets(cout))\r\n ensures OutboundPacketsHasCorrectSrc(cout, cs.constants.all.config.replica_ids[cs.constants.my_index])\r\n{\r\n //ghost var s := AbstractifyExecutorStateToLExecutor(cs);\r\n ghost var inp := AbstractifyCPacketToRslPacket(cinp);\r\n lemma_AbstractifyCReplyCacheToReplyCache_properties(cs.reply_cache);\r\n ghost var out:seq;\r\n // the assert below is the trigger needed since we added an explicit trigger in the corresponding ensures in lemma_AbstractifyCReplyCacheToReplyCache_properties\r\n assert AbstractifyCReplyCacheToReplyCache(cs.reply_cache)[AbstractifyEndPointToNodeIdentity(cinp.src)] == AbstractifyCReplyToReply(cs.reply_cache[cinp.src]); \r\n assert cinp.msg.seqno <= cachedReply.seqno;\r\n var cr := cachedReply;\r\n var msg := CMessage_Reply(cr.seqno, cr.reply);\r\n if PrintParams.ShouldPrintProgress() {\r\n print(\"Sending cached reply to client \");\r\n print(cr.client);\r\n print(\" with sequence number \");\r\n print(cr.seqno);\r\n print(\"\\n\");\r\n }\r\n cout := OutboundPacket(Some(CPacket(cr.client, cs.constants.all.config.replica_ids[cs.constants.my_index], msg)));\r\n assert cinp.src in cs.reply_cache;\r\n assert ValidReply(cs.reply_cache[cinp.src]);\r\n assert CAppReplyMarshallable(cr.reply);\r\n assert OutboundPacketsIsValid(cout);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ExecutorState.i.dfy", "content": "include \"../../Protocol/RSL/Executor.i.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\ninclude \"ReplicaConstantsState.i.dfy\"\r\n\r\nmodule LiveRSL__ExecutorState_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened AppStateMachine_s\r\n\r\n///////////////////////////\r\n// COutstandingOperation\r\n///////////////////////////\r\n\r\ndatatype COutstandingOperation = COutstandingOpKnown(v:CRequestBatch,bal:CBallot) | COutstandingOpUnknown()\r\n\r\npredicate COutstandingOperationIsAbstractable(op:COutstandingOperation)\r\n{\r\n || op.COutstandingOpUnknown?\r\n || (CRequestBatchIsAbstractable(op.v) && CBallotIsAbstractable(op.bal))\r\n}\r\n\r\nfunction AbstractifyCOutstandingOperationToOutstandingOperation(op:COutstandingOperation):OutstandingOperation\r\n requires COutstandingOperationIsAbstractable(op)\r\n{\r\n match op\r\n case COutstandingOpKnown(v,bal) => OutstandingOpKnown(AbstractifyCRequestBatchToRequestBatch(v),AbstractifyCBallotToBallot(bal))\r\n case COutstandingOpUnknown => OutstandingOpUnknown()\r\n}\r\n\r\n///////////////////////////\r\n// ExecutorState\r\n///////////////////////////\r\n\r\ndatatype ExecutorState = ExecutorState(\r\n constants:ReplicaConstantsState,\r\n app:AppStateMachine,\r\n ops_complete:COperationNumber,\r\n max_bal_reflected:CBallot,\r\n next_op_to_execute:COutstandingOperation,\r\n ghost reply_cache:CReplyCache)\r\n\r\npredicate ExecutorState_IsAbstractable(executor:ExecutorState)\r\n{\r\n && ReplicaConstantsStateIsAbstractable(executor.constants)\r\n && COperationNumberIsAbstractable(executor.ops_complete)\r\n && CBallotIsAbstractable(executor.max_bal_reflected)\r\n && COutstandingOperationIsAbstractable(executor.next_op_to_execute)\r\n && CReplyCacheIsAbstractable(executor.reply_cache)\r\n}\r\n\r\nfunction AbstractifyExecutorStateToLExecutor(executor:ExecutorState) : LExecutor\r\n reads executor.app\r\n requires ExecutorState_IsAbstractable(executor)\r\n{\r\n LExecutor(\r\n AbstractifyReplicaConstantsStateToLReplicaConstants(executor.constants),\r\n executor.app.Abstractify(),\r\n AbstractifyCOperationNumberToOperationNumber(executor.ops_complete),\r\n AbstractifyCBallotToBallot(executor.max_bal_reflected),\r\n AbstractifyCOutstandingOperationToOutstandingOperation(executor.next_op_to_execute),\r\n AbstractifyCReplyCacheToReplyCache(executor.reply_cache))\r\n}\r\n\r\npredicate ExecutorState_IsValid(executor:ExecutorState)\r\n{\r\n && ExecutorState_IsAbstractable(executor)\r\n && ReplicaConstantsState_IsValid(executor.constants)\r\n && ValidReplyCache(executor.reply_cache)\r\n && (executor.next_op_to_execute.COutstandingOpKnown? ==> ValidRequestBatch(executor.next_op_to_execute.v))\r\n}\r\n\r\npredicate ExecutorState_CommonPreconditions(executor:ExecutorState)\r\n{\r\n && ExecutorState_IsValid(executor)\r\n && ExecutorState_IsAbstractable(executor) // Can I have this too?\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/Host.i.dfy", "content": "include \"../../Common/Framework/Host.s.dfy\"\r\ninclude \"ReplicaImplMain.i.dfy\"\r\ninclude \"CmdLineParser.i.dfy\"\r\ninclude \"Unsendable.i.dfy\"\r\n\r\nmodule Host_i refines Host_s {\r\n\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__ConstantsState_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__ParametersState_i\r\nimport opened LiveRSL__QRelations_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened LiveRSL__ReplicaImplClass_i\r\nimport opened LiveRSL__ReplicaImplMain_i\r\nimport opened LiveRSL__NetRSL_i\r\nimport opened LiveRSL__Unsendable_i\r\nimport opened CmdLineParser_i\r\nimport opened PaxosCmdLineParser_i \r\nimport opened Collections__Sets_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__SeqIsUnique_i\r\nimport opened Common__SeqIsUniqueDef_i\r\n\r\ndatatype CScheduler = CScheduler(ghost sched:LScheduler, replica_impl:ReplicaImpl)\r\n\r\ntype HostState = CScheduler\r\ntype ConcreteConfiguration = ConstantsState\r\n\r\npredicate ConcreteConfigInit(config:ConcreteConfiguration) \r\n{\r\n ConstantsStateIsValid(config)\r\n}\r\n\r\nfunction ConcreteConfigToServers(config:ConcreteConfiguration) : set\r\n{\r\n MapSeqToSet(config.config.replica_ids, x=>x)\r\n}\r\n\r\npredicate HostStateInvariants(host_state:HostState, env:HostEnvironment)\r\n{\r\n && host_state.replica_impl.Valid() \r\n && host_state.replica_impl.Env() == env\r\n && host_state.sched == host_state.replica_impl.AbstractifyToLScheduler()\r\n}\r\n\r\npredicate HostInit(host_state:HostState, config:ConcreteConfiguration, id:EndPoint)\r\n{\r\n && host_state.replica_impl.Valid()\r\n && host_state.replica_impl.replica.constants.all == config\r\n && config.config.replica_ids[host_state.replica_impl.replica.constants.my_index] == id\r\n && LSchedulerInit(host_state.sched, \r\n AbstractifyReplicaConstantsStateToLReplicaConstants(host_state.replica_impl.replica.constants))\r\n}\r\n\r\npredicate HostNext(host_state:HostState, host_state':HostState, ios:seq>>)\r\n{\r\n && NetEventLogIsAbstractable(ios)\r\n && OnlySentMarshallableData(ios)\r\n && (|| LSchedulerNext(host_state.sched, host_state'.sched, AbstractifyRawLogToIos(ios))\r\n || HostNextIgnoreUnsendable(host_state.sched, host_state'.sched, ios))\r\n}\r\n\r\nfunction ParseCommandLineConfiguration(args:seq>) : ConcreteConfiguration\r\n{\r\n var paxos_config := paxos_config_parsing(args);\r\n var params := StaticParams();\r\n ConstantsState(paxos_config, params)\r\n}\r\n\r\nmethod {:timeLimitMultiplier 4} HostInitImpl(\r\n ghost env:HostEnvironment,\r\n netc:NetClient,\r\n args:seq>\r\n ) returns (\r\n ok:bool,\r\n host_state:HostState\r\n )\r\n{\r\n var pconfig:CPaxosConfiguration, my_index;\r\n var id := EndPoint(netc.MyPublicKey());\r\n ok, pconfig, my_index := parse_cmd_line(id, args);\r\n\r\n var lschedule:LScheduler;\r\n var repImpl:ReplicaImpl := new ReplicaImpl(); \r\n host_state := CScheduler(lschedule,repImpl);\r\n\r\n if !ok { return; }\r\n assert id == pconfig.replica_ids[my_index];\r\n\r\n var scheduler := new ReplicaImpl();\r\n var constants := InitReplicaConstantsState(id, pconfig); //SystemConfiguration(me_ep);\r\n assert constants.all.config == pconfig;\r\n assert constants.all.config.replica_ids[constants.my_index] == id;\r\n calc {\r\n constants.my_index as int;\r\n { reveal SeqIsUnique(); }\r\n my_index as int;\r\n }\r\n\r\n assert env.Valid() && env.ok.ok();\r\n assert ReplicaConstantsState_IsValid(constants);\r\n assert WellFormedLConfiguration(AbstractifyReplicaConstantsStateToLReplicaConstants(constants).all.config);\r\n\r\n ok := scheduler.Replica_Init(constants, netc, env);\r\n if !ok { return; }\r\n host_state := CScheduler(scheduler.AbstractifyToLScheduler(), scheduler);\r\n}\r\n\r\npredicate EventsConsistent(recvs:seq, clocks:seq, sends:seq) \r\n{\r\n forall e :: && (e in recvs ==> e.LIoOpReceive?) \r\n && (e in clocks ==> e.LIoOpReadClock? || e.LIoOpTimeoutReceive?) \r\n && (e in sends ==> e.LIoOpSend?)\r\n}\r\n\r\nghost method RemoveRecvs(events:seq) returns (recvs:seq, rest:seq) \r\n ensures forall e :: e in recvs ==> e.LIoOpReceive?\r\n ensures events == recvs + rest\r\n ensures rest != [] ==> !rest[0].LIoOpReceive?\r\n ensures NetEventsReductionCompatible(events) ==> NetEventsReductionCompatible(rest);\r\n{\r\n recvs := [];\r\n rest := [];\r\n\r\n var i := 0;\r\n while i < |events| \r\n invariant 0 <= i <= |events|\r\n invariant forall e :: e in recvs ==> e.LIoOpReceive?\r\n //invariant events == recvs + events[i..]\r\n invariant recvs == events[0..i]\r\n {\r\n if !events[i].LIoOpReceive? {\r\n rest := events[i..];\r\n return;\r\n }\r\n recvs := recvs + [events[i]];\r\n i := i + 1;\r\n }\r\n}\r\n\r\npredicate NetEventsReductionCompatible(events:seq)\r\n{\r\n forall i :: 0 <= i < |events| - 1 ==> events[i].LIoOpReceive? || events[i+1].LIoOpSend?\r\n}\r\n\r\n\r\nlemma lemma_RemainingEventsAreSends(events:seq)\r\n requires NetEventsReductionCompatible(events)\r\n requires |events| > 0\r\n requires !events[0].LIoOpReceive?\r\n ensures forall e :: e in events[1..] ==> e.LIoOpSend?\r\n{\r\n if |events| == 1 {\r\n } else {\r\n assert events[1].LIoOpSend?;\r\n lemma_RemainingEventsAreSends(events[1..]);\r\n }\r\n}\r\n\r\nghost method PartitionEvents(events:seq) returns (recvs:seq, clocks:seq, sends:seq)\r\n requires NetEventsReductionCompatible(events)\r\n ensures events == recvs + clocks + sends\r\n ensures EventsConsistent(recvs, clocks, sends)\r\n ensures |clocks| <= 1\r\n{\r\n var rest;\r\n recvs, rest := RemoveRecvs(events);\r\n assert NetEventsReductionCompatible(rest);\r\n if |rest| > 0 && (rest[0].LIoOpReadClock? || rest[0].LIoOpTimeoutReceive?) {\r\n clocks := [rest[0]];\r\n sends := rest[1..];\r\n lemma_RemainingEventsAreSends(rest);\r\n } else {\r\n clocks := [];\r\n sends := rest;\r\n if |rest| > 0 {\r\n lemma_RemainingEventsAreSends(rest);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_ProtocolIosRespectReduction(s:LScheduler, s':LScheduler, ios:seq)\r\n requires Q_LScheduler_Next(s, s', ios)\r\n ensures LIoOpSeqCompatibleWithReduction(ios)\r\n{\r\n reveal Q_LScheduler_Next();\r\n}\r\n\r\nlemma lemma_NetEventsRespectReduction(s:LScheduler, s':LScheduler, ios:seq, events:seq)\r\n requires LIoOpSeqCompatibleWithReduction(ios)\r\n requires RawIoConsistentWithSpecIO(events, ios)\r\n ensures NetEventsReductionCompatible(events)\r\n{\r\n forall i | 0 <= i < |events| - 1\r\n ensures events[i].LIoOpReceive? || events[i+1].LIoOpSend?\r\n {\r\n assert LIoOpOrderingOKForAction(ios[i], ios[i+1]);\r\n reveal AbstractifyRawLogToIos();\r\n assert AbstractifyRawLogToIos(events)[i] == AbstractifyNetEventToRslIo(events[i]) == ios[i];\r\n }\r\n}\r\n\r\nmethod {:timeLimitMultiplier 3} HostNextImpl(ghost env:HostEnvironment, host_state:HostState) \r\n returns (ok:bool, host_state':HostState, \r\n ghost recvs:seq, ghost clocks:seq, ghost sends:seq, \r\n ghost ios:seq>>)\r\n{\r\n var lschedule:LScheduler;\r\n var repImpl:ReplicaImpl := new ReplicaImpl(); \r\n host_state' := CScheduler(lschedule,repImpl);\r\n\r\n var okay, netEventLog, abstract_ios := Replica_Next_main(host_state.replica_impl);\r\n if okay {\r\n calc { \r\n Q_LScheduler_Next(host_state.sched, host_state.replica_impl.AbstractifyToLScheduler(), abstract_ios);\r\n { reveal Q_LScheduler_Next(); }\r\n LSchedulerNext(host_state.sched, host_state.replica_impl.AbstractifyToLScheduler(), abstract_ios);\r\n }\r\n\r\n assert AbstractifyRawLogToIos(netEventLog) == abstract_ios;\r\n if LSchedulerNext(host_state.sched, host_state.replica_impl.AbstractifyToLScheduler(), abstract_ios)\r\n {\r\n lemma_ProtocolIosRespectReduction(host_state.sched, host_state.replica_impl.AbstractifyToLScheduler(), abstract_ios);\r\n }\r\n lemma_NetEventsRespectReduction(host_state.sched, host_state.replica_impl.AbstractifyToLScheduler(), abstract_ios, netEventLog);\r\n recvs, clocks, sends := PartitionEvents(netEventLog);\r\n ios := recvs + clocks + sends; //abstract_ios;\r\n assert ios == netEventLog;\r\n host_state' := CScheduler(host_state.replica_impl.AbstractifyToLScheduler(), host_state.replica_impl);\r\n } else {\r\n recvs := [];\r\n clocks := [];\r\n sends := [];\r\n }\r\n ok := okay;\r\n reveal Q_LScheduler_Next();\r\n assert host_state.replica_impl.Env() == env;\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/LearnerModel.i.dfy", "content": "include \"AppInterface.i.dfy\"\r\ninclude \"LearnerState.i.dfy\"\r\n\r\nmodule LiveRSL__LearnerModel_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__ExecutorState_i\r\nimport opened LiveRSL__Learner_i\r\nimport opened LiveRSL__LearnerState_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Collections__Maps_i\r\nimport opened Collections__Sets_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__SeqIsUnique_i\r\nimport opened Common__SeqIsUniqueDef_i\r\nimport opened Common__NetClient_i\r\nimport opened Concrete_NodeIdentity_i\r\n\r\nlemma lemma_Received2bPacketsSameSizeAsAbstraction(l_learner_tuple:CLearnerTuple, h_learner_tuple:LearnerTuple)\r\n requires LearnerTupleIsAbstractable(l_learner_tuple)\r\n requires h_learner_tuple == AbstractifyCLearnerTupleToLearnerTuple(l_learner_tuple)\r\n requires SeqIsUnique(l_learner_tuple.received_2b_message_senders)\r\n ensures |l_learner_tuple.received_2b_message_senders| == |h_learner_tuple.received_2b_message_senders|\r\n decreases |l_learner_tuple.received_2b_message_senders|\r\n{\r\n forall i1, i2\r\n ensures 0 <= i1 < |l_learner_tuple.received_2b_message_senders| && 0 <= i2 < |l_learner_tuple.received_2b_message_senders| && i1 != i2 ==>\r\n l_learner_tuple.received_2b_message_senders[i1] != l_learner_tuple.received_2b_message_senders[i2]\r\n {\r\n reveal SeqIsUnique();\r\n }\r\n\r\n if |l_learner_tuple.received_2b_message_senders| > 0\r\n {\r\n var src := l_learner_tuple.received_2b_message_senders[0];\r\n var l_received_2b_message_senders' := l_learner_tuple.received_2b_message_senders[1..];\r\n var l_learner_tuple' := CLearnerTuple(l_received_2b_message_senders', l_learner_tuple.candidate_learned_value);\r\n var h_learner_tuple' := AbstractifyCLearnerTupleToLearnerTuple(l_learner_tuple');\r\n\r\n assert src in l_learner_tuple.received_2b_message_senders;\r\n\r\n forall x | x in l_received_2b_message_senders'\r\n ensures AbstractifyEndPointToNodeIdentity(x) in h_learner_tuple'.received_2b_message_senders\r\n {\r\n var idx :| 0 <= idx < |l_received_2b_message_senders'| && x == l_received_2b_message_senders'[idx];\r\n assert x == l_learner_tuple.received_2b_message_senders[idx+1];\r\n assert x in l_learner_tuple.received_2b_message_senders[1..];\r\n assert AbstractifyEndPointToNodeIdentity(x) in AbstractifyEndPointsToNodeIdentities(l_learner_tuple.received_2b_message_senders[1..]);\r\n assert AbstractifyEndPointToNodeIdentity(x) in SeqToSet(AbstractifyEndPointsToNodeIdentities(l_learner_tuple.received_2b_message_senders[1..]));\r\n }\r\n\r\n forall x | EndPointIsValidPublicKey(x) && AbstractifyEndPointToNodeIdentity(x) in h_learner_tuple'.received_2b_message_senders\r\n ensures x in l_received_2b_message_senders'\r\n {\r\n var idx :| 0 <= idx < |l_learner_tuple'.received_2b_message_senders| && AbstractifyEndPointToNodeIdentity(x) == AbstractifyEndPointToNodeIdentity(l_learner_tuple'.received_2b_message_senders[idx]);\r\n lemma_AbstractifyEndPointToNodeIdentity_injective(x, l_learner_tuple'.received_2b_message_senders[idx]);\r\n assert x == l_learner_tuple'.received_2b_message_senders[idx];\r\n assert l_learner_tuple.received_2b_message_senders[idx+1] == l_learner_tuple'.received_2b_message_senders[idx];\r\n assert x == l_learner_tuple.received_2b_message_senders[idx+1];\r\n }\r\n\r\n assert forall x :: x in h_learner_tuple.received_2b_message_senders ==> x in h_learner_tuple'.received_2b_message_senders || x == AbstractifyEndPointToNodeIdentity(src);\r\n\r\n forall x | x in h_learner_tuple'.received_2b_message_senders || x == AbstractifyEndPointToNodeIdentity(src)\r\n ensures x in h_learner_tuple.received_2b_message_senders\r\n {\r\n if x == AbstractifyEndPointToNodeIdentity(src)\r\n {\r\n assert src in l_learner_tuple.received_2b_message_senders;\r\n assert x in AbstractifyEndPointsToNodeIdentities(l_learner_tuple.received_2b_message_senders);\r\n assert x in SeqToSet(AbstractifyEndPointsToNodeIdentities(l_learner_tuple.received_2b_message_senders));\r\n assert x in h_learner_tuple.received_2b_message_senders;\r\n }\r\n else\r\n {\r\n assert x in h_learner_tuple.received_2b_message_senders;\r\n var idx :| 0 <= idx < |l_learner_tuple'.received_2b_message_senders| && x == AbstractifyEndPointToNodeIdentity(l_learner_tuple'.received_2b_message_senders[idx]);\r\n assert l_learner_tuple.received_2b_message_senders[idx+1] == l_learner_tuple'.received_2b_message_senders[idx];\r\n assert x == AbstractifyEndPointToNodeIdentity(l_learner_tuple.received_2b_message_senders[idx+1]);\r\n }\r\n }\r\n\r\n assert h_learner_tuple.received_2b_message_senders == h_learner_tuple'.received_2b_message_senders + {AbstractifyEndPointToNodeIdentity(src)};\r\n reveal SeqIsUnique();\r\n lemma_Received2bPacketsSameSizeAsAbstraction(l_learner_tuple', h_learner_tuple');\r\n }\r\n}\r\n\r\n\r\nlemma lemma_AbstractifyCLearnerTupleOfOneSource(l_tup:CLearnerTuple, h_tup:LearnerTuple, src:EndPoint)\r\n requires l_tup.received_2b_message_senders == [src]\r\n requires EndPointIsValidPublicKey(src)\r\n requires LearnerTupleIsAbstractable(l_tup)\r\n requires h_tup.received_2b_message_senders == {AbstractifyEndPointToNodeIdentity(src)}\r\n requires h_tup.candidate_learned_value == AbstractifyCRequestBatchToRequestBatch(l_tup.candidate_learned_value)\r\n ensures h_tup == AbstractifyCLearnerTupleToLearnerTuple(l_tup)\r\n{\r\n var s := AbstractifyCLearnerTupleToLearnerTuple(l_tup).received_2b_message_senders;\r\n\r\n forall x\r\n ensures x in s <==> x in h_tup.received_2b_message_senders\r\n {\r\n if x in s\r\n {\r\n assert x == AbstractifyEndPointToNodeIdentity(src);\r\n assert x in h_tup.received_2b_message_senders;\r\n }\r\n if x in h_tup.received_2b_message_senders\r\n {\r\n assert src in [src] && x == AbstractifyEndPointToNodeIdentity(src);\r\n assert x in AbstractifyEndPointsToNodeIdentities([src]);\r\n assert x in s;\r\n }\r\n }\r\n\r\n assert s == h_tup.received_2b_message_senders;\r\n}\r\n\r\nlemma lemma_AddingSourceToSequenceAddsToSet(source:EndPoint, sseq1:seq, sset1:set,\r\n sseq2:seq, sset2:set)\r\n requires EndPointIsValidPublicKey(source)\r\n requires SeqOfEndPointsIsAbstractable(sseq1)\r\n requires SeqOfEndPointsIsAbstractable(sseq2)\r\n requires sset1 == SeqToSet(AbstractifyEndPointsToNodeIdentities(sseq1))\r\n requires sset2 == sset1 + {AbstractifyEndPointToNodeIdentity(source)}\r\n requires sseq2 == sseq1 + [source]\r\n ensures sset2 == SeqToSet(AbstractifyEndPointsToNodeIdentities(sseq2))\r\n{\r\n var sset2_alt := SeqToSet(AbstractifyEndPointsToNodeIdentities(sseq2));\r\n\r\n forall x\r\n ensures x in sset2 <==> x in sset2_alt\r\n {\r\n if x in sset2\r\n {\r\n if x in sset1\r\n {\r\n assert x in SeqToSet(AbstractifyEndPointsToNodeIdentities(sseq1));\r\n assert x in AbstractifyEndPointsToNodeIdentities(sseq1);\r\n var src :| src in sseq1 && x == AbstractifyEndPointToNodeIdentity(src);\r\n assert src in sseq2;\r\n assert AbstractifyEndPointToNodeIdentity(src) in AbstractifyEndPointsToNodeIdentities(sseq2);\r\n assert AbstractifyEndPointToNodeIdentity(src) in sset2_alt;\r\n assert x in sset2_alt;\r\n }\r\n else\r\n {\r\n assert x == AbstractifyEndPointToNodeIdentity(source);\r\n assert source in sseq2;\r\n assert AbstractifyEndPointToNodeIdentity(source) in AbstractifyEndPointsToNodeIdentities(sseq2);\r\n assert AbstractifyEndPointToNodeIdentity(source) in sset2_alt;\r\n assert x in sset2_alt;\r\n }\r\n }\r\n if x in sset2_alt\r\n {\r\n assert x in AbstractifyEndPointsToNodeIdentities(sseq2);\r\n var src :| src in sseq2 && x == AbstractifyEndPointToNodeIdentity(src);\r\n if src in sseq1\r\n {\r\n assert AbstractifyEndPointToNodeIdentity(src) in AbstractifyEndPointsToNodeIdentities(sseq1);\r\n assert x in AbstractifyEndPointsToNodeIdentities(sseq1);\r\n assert x in SeqToSet(AbstractifyEndPointsToNodeIdentities(sseq1));\r\n assert x in sset1;\r\n assert x in sset2;\r\n }\r\n else\r\n {\r\n assert src == source;\r\n lemma_AbstractifyEndPointToNodeIdentity_injective(src, source);\r\n assert x in sset2;\r\n }\r\n }\r\n }\r\n}\r\n\r\npredicate Eq_LLearner(x:LLearner, y:LLearner)\r\n{\r\n && x.constants == y.constants\r\n && x.max_ballot_seen == y.max_ballot_seen\r\n && x.unexecuted_learner_state == y.unexecuted_learner_state\r\n}\r\n\r\nmethod {:timeLimitMultiplier 2} LearnerModel_Process2b(learner:CLearnerState, executor:ExecutorState, packet:CPacket) returns (learner':CLearnerState)\r\n requires LearnerState_Process2b__Preconditions(learner, executor, packet)\r\n requires Marshallable_2b(packet.msg)\r\n ensures LearnerState_Process2b__Postconditions(learner, executor, packet, learner')\r\n{\r\n lemma_AbstractifyEndPointsToNodeIdentities_properties(learner.rcs.all.config.replica_ids);\r\n lemma_AbstractifyCOperationNumberToOperationNumber_isInjective();\r\n\r\n var msg := packet.msg;\r\n var src := packet.src;\r\n var opn := msg.opn_2b;\r\n var isBalLt1 := CBalLt(msg.bal_2b, learner.max_ballot_seen);\r\n var isBalLt2 := CBalLt(learner.max_ballot_seen, msg.bal_2b);\r\n var srcIsReplica := src in learner.rcs.all.config.replica_ids;\r\n ghost var r_learner := AbstractifyLearnerStateToLLearner(learner);\r\n ghost var r_packet := AbstractifyCPacketToRslPacket(packet);\r\n ghost var r_opn := AbstractifyCOperationNumberToOperationNumber(opn);\r\n\r\n assert srcIsReplica <==> AbstractifyCPacketToRslPacket(packet).src in AbstractifyReplicaConstantsStateToLReplicaConstants(learner.rcs).all.config.replica_ids;\r\n lemma_AbstractifyCLearnerTuplesToLearnerTuples_properties(learner.unexecuted_ops);\r\n\r\n if opn in learner.unexecuted_ops {\r\n assert CLearnerTupleIsValid(learner.unexecuted_ops[opn]);\r\n lemma_AbstractifyEndPointsToNodeIdentities_properties(learner.unexecuted_ops[opn].received_2b_message_senders);\r\n }\r\n\r\n if (!srcIsReplica || isBalLt1)\r\n {\r\n learner' := learner;\r\n }\r\n else if (isBalLt2)\r\n {\r\n var tup' := CLearnerTuple([packet.src], msg.val_2b);\r\n learner' :=\r\n learner.(\r\n max_ballot_seen := msg.bal_2b,\r\n unexecuted_ops := map[opn := tup']);\r\n ghost var r_learner' := AbstractifyLearnerStateToLLearner(learner');\r\n lemma_AbstractifyCLearnerTuplesToLearnerTuples_properties(learner'.unexecuted_ops);\r\n\r\n lemma_AbstractifyCLearnerTuplesToLearnerTuples_properties(map []);\r\n\r\n ghost var r_tup' := LearnerTuple({r_packet.src}, r_packet.msg.val_2b);\r\n ghost var r'_learner := r_learner.(max_ballot_seen := r_packet.msg.bal_2b,\r\n unexecuted_learner_state := map[r_opn := r_tup']);\r\n\r\n lemma_AbstractifyCLearnerTupleOfOneSource(tup', r_tup', packet.src);\r\n\r\n assert r_tup'.received_2b_message_senders == AbstractifyCLearnerTupleToLearnerTuple(tup').received_2b_message_senders;\r\n assert r_tup'.candidate_learned_value == AbstractifyCLearnerTupleToLearnerTuple(tup').candidate_learned_value;\r\n assert r_tup' == AbstractifyCLearnerTupleToLearnerTuple(tup');\r\n assert Eq_LLearner(r_learner', r'_learner);\r\n\r\n forall ensures CLearnerTupleIsValid(tup')\r\n {\r\n reveal SeqIsUnique();\r\n } \r\n }\r\n else if (opn !in learner.unexecuted_ops)\r\n {\r\n assert AbstractifyCOperationNumberToOperationNumber(opn) !in AbstractifyLearnerStateToLLearner(learner).unexecuted_learner_state;\r\n var tup' := CLearnerTuple([packet.src], msg.val_2b);\r\n learner' := learner.(unexecuted_ops := learner.unexecuted_ops[opn := tup']);\r\n ghost var r_learner' := AbstractifyLearnerStateToLLearner(learner');\r\n ghost var r_tup' := LearnerTuple({r_packet.src}, r_packet.msg.val_2b);\r\n ghost var r'_learner := r_learner.(unexecuted_learner_state := r_learner.unexecuted_learner_state[r_opn := r_tup']);\r\n\r\n lemma_AbstractifyCLearnerTupleOfOneSource(tup', r_tup', packet.src);\r\n\r\n assert r_tup'.received_2b_message_senders == AbstractifyCLearnerTupleToLearnerTuple(tup').received_2b_message_senders;\r\n assert r_tup'.candidate_learned_value == AbstractifyCLearnerTupleToLearnerTuple(tup').candidate_learned_value;\r\n assert r_tup' == AbstractifyCLearnerTupleToLearnerTuple(tup');\r\n assert Eq_LLearner(r_learner', r'_learner);\r\n\r\n forall ensures CLearnerTupleIsValid(tup')\r\n {\r\n reveal SeqIsUnique();\r\n }\r\n } \r\n else if packet.src in learner.unexecuted_ops[opn].received_2b_message_senders \r\n {\r\n learner' := learner;\r\n }\r\n else \r\n {\r\n var tup := learner.unexecuted_ops[opn];\r\n var tup' := tup.(received_2b_message_senders := tup.received_2b_message_senders + [packet.src]);\r\n learner' := learner.(unexecuted_ops := learner.unexecuted_ops[opn := tup']);\r\n ghost var r_learner' := AbstractifyLearnerStateToLLearner(learner');\r\n\r\n ghost var r_tup := r_learner.unexecuted_learner_state[r_opn];\r\n ghost var r_tup' := r_tup.(received_2b_message_senders := r_tup.received_2b_message_senders + {r_packet.src});\r\n ghost var r'_learner := r_learner.(unexecuted_learner_state := r_learner.unexecuted_learner_state[r_opn := r_tup']);\r\n\r\n lemma_AddingSourceToSequenceAddsToSet(packet.src, tup.received_2b_message_senders, r_tup.received_2b_message_senders,\r\n tup'.received_2b_message_senders, r_tup'.received_2b_message_senders);\r\n \r\n assert r_tup'.received_2b_message_senders == AbstractifyCLearnerTupleToLearnerTuple(tup').received_2b_message_senders;\r\n assert r_tup'.candidate_learned_value == AbstractifyCLearnerTupleToLearnerTuple(tup').candidate_learned_value;\r\n assert r_tup' == AbstractifyCLearnerTupleToLearnerTuple(tup');\r\n assert Eq_LLearner(r_learner', r'_learner);\r\n EstablishAppendToUniqueSeq(tup.received_2b_message_senders, packet.src, tup'.received_2b_message_senders);\r\n }\r\n}\r\n\r\nmethod LearnerModel_ForgetDecision(learner:CLearnerState, opn:COperationNumber) returns (learner':CLearnerState)\r\n requires LearnerState_ForgetDecision__Preconditions(learner, opn)\r\n ensures LearnerState_ForgetDecision__Postconditions(learner, opn, learner')\r\n{\r\n lemma_AbstractifyCLearnerTuplesToLearnerTuples_properties(learner.unexecuted_ops);\r\n if (opn in learner.unexecuted_ops)\r\n {\r\n learner' := learner.(unexecuted_ops := RemoveElt(learner.unexecuted_ops, opn));\r\n lemma_map_remove_one(learner.unexecuted_ops, learner'.unexecuted_ops, opn);\r\n //assert AbstractifyCOperationNumberToOperationNumber(opn) in AbstractifyCLearnerTuplesToLearnerTuples(learner.unexecuted_ops);\r\n lemma_AbstractifyCLearnerTuplesToLearnerTuples_properties(learner'.unexecuted_ops);\r\n //lemma_map_remove_one(AbstractifyCLearnerTuplesToLearnerTuples(learner.unexecuted_ops), AbstractifyCLearnerTuplesToLearnerTuples(learner'.unexecuted_ops), AbstractifyCOperationNumberToOperationNumber(opn));\r\n }\r\n else\r\n {\r\n learner' := learner;\r\n }\r\n}\r\n\r\nlemma lemma_MapEquality(m1:map, m2:map)\r\n requires forall u :: (u in m1 <==> u in m2)\r\n requires forall u :: u in m1 ==> m1[u] == m2[u]\r\n ensures m1 == m2\r\n{\r\n}\r\n\r\nlemma lemma_ForgetOperationsBeforeMap(m_before:map, m_after:map, ops_complete:COperationNumber)\r\n requires m_after == map op | op in m_before && op.n >= ops_complete.n :: m_before[op]\r\n requires CLearnerTuplesAreAbstractable(m_before)\r\n ensures var rm := AbstractifyCLearnerTuplesToLearnerTuples(m_before);\r\n var rm_new := map op | op in rm && op >= AbstractifyCOperationNumberToOperationNumber(ops_complete) :: rm[op];\r\n rm_new == AbstractifyCLearnerTuplesToLearnerTuples(m_after)\r\n{\r\n lemma_AbstractifyCLearnerTuplesToLearnerTuples_properties(m_before);\r\n lemma_AbstractifyCLearnerTuplesToLearnerTuples_properties(m_after);\r\n\r\n var r_before := AbstractifyCLearnerTuplesToLearnerTuples(m_before);\r\n var r_after := AbstractifyCLearnerTuplesToLearnerTuples(m_after);\r\n var r_op := AbstractifyCOperationNumberToOperationNumber(ops_complete);\r\n var rm_new := map op | op in r_before && op >= r_op :: r_before[op];\r\n\r\n forall o | o in r_after\r\n ensures o in rm_new && rm_new[o] == r_after[o]\r\n {\r\n var co :| co in m_after && AbstractifyCOperationNumberToOperationNumber(co) == o;\r\n assert co in m_before && co.n >= ops_complete.n;\r\n var r_co := AbstractifyCOperationNumberToOperationNumber(co);\r\n assert r_co in r_before;\r\n assert r_co >= r_op;\r\n assert r_co in rm_new;\r\n }\r\n\r\n forall o | o in rm_new\r\n ensures o in r_after && rm_new[o] == r_after[o]\r\n {\r\n }\r\n lemma_MapEquality(rm_new, r_after);\r\n}\r\n\r\nlemma lemma_LearnerStateForgetOperationsBeforePostconditions(learner:CLearnerState, ops_complete:COperationNumber, learner':CLearnerState)\r\n requires LearnerState_ForgetOperationsBefore__Preconditions(learner, ops_complete)\r\n requires LearnerState_CommonPostconditions(learner, learner')\r\n requires learner'.max_ballot_seen == learner.max_ballot_seen\r\n requires learner'.unexecuted_ops == map op | op in learner.unexecuted_ops && op.n >= ops_complete.n :: learner.unexecuted_ops[op]\r\n //requires forall opn :: opn in learner'.unexecuted_ops ==> opn in learner.unexecuted_ops\r\n ensures LearnerState_ForgetOperationsBefore__Postconditions(learner, ops_complete, learner')\r\n{\r\n ghost var r_learner := AbstractifyLearnerStateToLLearner(learner);\r\n ghost var r_learner' := AbstractifyLearnerStateToLLearner(learner');\r\n// var r_unexecutedOps := r_learner.unexecuted_learner_state;\r\n// var r_unexecutedOps' := r_learner'.unexecuted_learner_state;\r\n var r_opsComplete := AbstractifyCOperationNumberToOperationNumber(ops_complete);\r\n\r\n var r'_learner := r_learner.(unexecuted_learner_state := (map op | op in r_learner.unexecuted_learner_state && op >= r_opsComplete :: r_learner.unexecuted_learner_state[op]));\r\n\r\n /*\r\n assert forall o :: (o in r'_learner.unexecuted_learner_state <==> o in r_learner'.unexecuted_learner_state);\r\n assert forall o :: o in r'_learner.unexecuted_learner_state ==> r'_learner.unexecuted_learner_state[o] == r_learner'.unexecuted_learner_state[o];\r\n\r\n ghost var m1 := r'_learner.unexecuted_learner_state;\r\n ghost var m2 := r_learner'.unexecuted_learner_state;\r\n assert forall o :: (o in m1 <==> o in m2);\r\n assert forall o :: o in m1 ==> m1[o] == m2[o];\r\n assert (forall o :: (o in m1 <==> o in m2)) && (forall o :: o in m1 ==> m1[o] == m2[o]);\r\n lemma_MapEquality(m1, m2);\r\n assert m1 == m2;\r\n */\r\n lemma_ForgetOperationsBeforeMap(learner.unexecuted_ops, learner'.unexecuted_ops, ops_complete);\r\n assert r'_learner.unexecuted_learner_state == r_learner'.unexecuted_learner_state;\r\n assert Eq_LLearner(r'_learner, r_learner');\r\n /*\r\n lemma_AbstractifyCLearnerTuplesToLearnerTuples_properties(learner.unexecuted_ops);\r\n\r\n var rOpnComplete := AbstractifyCOperationNumberToOperationNumber(ops_complete);\r\n var r1 := AbstractifyLearnerStateToLLearner(learner).unexecuted_learner_state;\r\n var r2 := AbstractifyCLearnerTuplesToLearnerTuples(learner.unexecuted_ops);\r\n assert r1 == r2;\r\n var r1' := AbstractifyLearnerStateToLLearner(learner').unexecuted_learner_state;\r\n var r2' := AbstractifyCLearnerTuplesToLearnerTuples(learner'.unexecuted_ops);\r\n assert r1' == r2';\r\n var setO := set o | o in r1 && o >= rOpnComplete;\r\n forall o | o in domain(r1')\r\n ensures o in setO\r\n {\r\n assert o in r1 && o >= rOpnComplete;\r\n }\r\n forall o | o in setO\r\n ensures o in domain(r1')\r\n {}\r\n assert domain(r1') == set o | o in r1 && o >= rOpnComplete;\r\n assert forall o :: o in domain(r1') ==> r1'[o] == r1[o];\r\n assert r1' == map o | o in r1 && o >= rOpnComplete :: r1[o];\r\n assert AbstractifyLearnerStateToLLearner(learner').constants == AbstractifyLearnerStateToLLearner(learner).constants;\r\n assert learner'.max_ballot_seen == learner.max_ballot_seen;\r\n assert AbstractifyLearnerStateToLLearner(learner').max_ballot_seen == AbstractifyLearnerStateToLLearner(learner).max_ballot_seen;\r\n assert AbstractifyLearnerStateToLLearner(learner').learnerState == AbstractifyLearnerStateToLLearner(learner).learnerState;\r\n assert AbstractifyLearnerStateToLLearner(learner') == AbstractifyLearnerStateToLLearner(learner')[unexecuted_learner_state := r1'];\r\n var s := AbstractifyLearnerStateToLLearner(learner);\r\n var s' := AbstractifyLearnerStateToLLearner(learner');\r\n assert s' == s[unexecuted_learner_state := r1'];\r\n assert r1' == (map op | op in s.unexecuted_learner_state && op >= rOpnComplete :: s.unexecuted_learner_state[op]);\r\n assert s' == s[unexecuted_learner_state := (map op | op in s.unexecuted_learner_state && op >= rOpnComplete :: s.unexecuted_learner_state[op])];\r\n assert LLearnerForgetOperationsBefore(AbstractifyLearnerStateToLLearner(learner), AbstractifyLearnerStateToLLearner(learner'), AbstractifyCOperationNumberToOperationNumber(ops_complete));\r\n */\r\n}\r\n\r\nmethod LearnerModel_ForgetOperationsBefore(learner:CLearnerState, ops_complete:COperationNumber) returns (learner':CLearnerState)\r\n requires LearnerState_ForgetOperationsBefore__Preconditions(learner, ops_complete)\r\n ensures LearnerState_ForgetOperationsBefore__Postconditions(learner, ops_complete, learner')\r\n{\r\n var unexecuted_ops' := (map op | op in learner.unexecuted_ops && op.n >= ops_complete.n :: learner.unexecuted_ops[op]);\r\n learner' := learner.(unexecuted_ops := unexecuted_ops');\r\n lemma_LearnerStateForgetOperationsBeforePostconditions(learner, ops_complete, learner');\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/LearnerState.i.dfy", "content": "include \"../../Protocol/RSL/Learner.i.dfy\"\r\ninclude \"ReplicaConstantsState.i.dfy\"\r\ninclude \"ExecutorState.i.dfy\"\r\n\r\nmodule LiveRSL__LearnerState_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__ExecutorState_i\r\nimport opened LiveRSL__Learner_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__SeqIsUniqueDef_i\r\nimport opened Collections__Sets_i\r\nimport opened Collections__Maps_i\r\nimport opened GenericRefinement_i\r\n\r\ndatatype CLearnerTuple =\r\n CLearnerTuple(\r\n received_2b_message_senders:seq,\r\n candidate_learned_value:seq)\r\n\r\ndatatype CLearnerState =\r\n CLearnerState(\r\n rcs:ReplicaConstantsState,\r\n max_ballot_seen:CBallot,\r\n unexecuted_ops:map,\r\n sendDecision:bool,\r\n opn:COperationNumber,\r\n recv2b:bool,\r\n recvCp:CPacket)\r\n\r\npredicate CLearnerTupleIsValid(tuple:CLearnerTuple) \r\n{\r\n && SeqIsUnique(tuple.received_2b_message_senders)\r\n && ValidRequestBatch(tuple.candidate_learned_value)\r\n}\r\n\r\npredicate LearnerState_IsValid(learner:CLearnerState)\r\n{\r\n && LearnerState_IsAbstractable(learner)\r\n && (forall o :: o in learner.unexecuted_ops ==> CLearnerTupleIsValid(learner.unexecuted_ops[o]))\r\n && ReplicaConstantsState_IsValid(learner.rcs)\r\n && ReplicaConstantsStateIsAbstractable(learner.rcs)\r\n}\r\n\r\npredicate LearnerTupleIsAbstractable(tuple:CLearnerTuple)\r\n{\r\n && SeqOfEndPointsIsAbstractable(tuple.received_2b_message_senders)\r\n && CRequestBatchIsAbstractable(tuple.candidate_learned_value)\r\n}\r\n\r\nfunction AbstractifyCLearnerTupleToLearnerTuple(tuple:CLearnerTuple) : LearnerTuple\r\n ensures LearnerTupleIsAbstractable(tuple) ==> AbstractifyCLearnerTupleToLearnerTuple(tuple) == LearnerTuple(SeqToSet(AbstractifyEndPointsToNodeIdentities(tuple.received_2b_message_senders)), AbstractifyCRequestBatchToRequestBatch(tuple.candidate_learned_value))\r\n{\r\n if (LearnerTupleIsAbstractable(tuple)) then \r\n var pkts := AbstractifyEndPointsToNodeIdentities(tuple.received_2b_message_senders);\r\n var value := AbstractifyCRequestBatchToRequestBatch(tuple.candidate_learned_value);\r\n LearnerTuple(SeqToSet(pkts), value)\r\n else \r\n var lt:LearnerTuple :| (true); lt\r\n}\r\n\r\npredicate CLearnerTuplesAreAbstractable(tuples:map)\r\n{\r\n && (forall opn :: opn in tuples ==> COperationNumberIsAbstractable(opn))\r\n && (forall opn :: opn in tuples ==> LearnerTupleIsAbstractable(tuples[opn]))\r\n}\r\n\r\nfunction RefineOperationNumberToCOperationNumber(o:OperationNumber) : COperationNumber \r\n // requires 0 <= o < 0x1_0000_0000_0000_0000\r\n ensures (0 <= o < 0x1_0000_0000_0000_0000) ==> RefineOperationNumberToCOperationNumber(o) == COperationNumber(o as uint64)\r\n{\r\n if (0 <= o && o < 0x1_0000_0000_0000_0000) then\r\n COperationNumber(o as uint64)\r\n else\r\n var co:COperationNumber :| (true); co\r\n}\r\n\r\nfunction {:opaque} AbstractifyCLearnerTuplesToLearnerTuples(m:map) : map\r\n requires CLearnerTuplesAreAbstractable(m)\r\n ensures var rm := AbstractifyCLearnerTuplesToLearnerTuples(m);\r\n forall k :: k in rm ==> (exists ck :: ck in m && AbstractifyCOperationNumberToOperationNumber(ck) == k)\r\n{\r\n AbstractifyMap(m, AbstractifyCOperationNumberToOperationNumber, AbstractifyCLearnerTupleToLearnerTuple, RefineOperationNumberToCOperationNumber)\r\n}\r\n\r\nlemma lemma_AbstractifyCLearnerTuplesToLearnerTuples_properties(m:map)\r\n requires CLearnerTuplesAreAbstractable(m)\r\n ensures m == map [] ==> AbstractifyCLearnerTuplesToLearnerTuples(m) == map []\r\n ensures forall o :: (o in m <==> AbstractifyCOperationNumberToOperationNumber(o) in AbstractifyCLearnerTuplesToLearnerTuples(m))\r\n ensures forall o :: (o !in m ==> AbstractifyCOperationNumberToOperationNumber(o) !in AbstractifyCLearnerTuplesToLearnerTuples(m))\r\n ensures forall o :: o in m ==> AbstractifyCLearnerTuplesToLearnerTuples(m)[AbstractifyCOperationNumberToOperationNumber(o)] == AbstractifyCLearnerTupleToLearnerTuple(m[o])\r\n ensures var rm := AbstractifyCLearnerTuplesToLearnerTuples(m);\r\n forall k :: k in rm ==> (exists ck :: ck in m && AbstractifyCOperationNumberToOperationNumber(ck) == k)\r\n ensures forall o, t {:trigger AbstractifyCOperationNumberToOperationNumber(o), AbstractifyCLearnerTupleToLearnerTuple(t)}\r\n {:trigger m[o := t]} :: LearnerTupleIsAbstractable(t) ==>\r\n var rm := AbstractifyCLearnerTuplesToLearnerTuples(m);\r\n var rm' := AbstractifyCLearnerTuplesToLearnerTuples(m[o := t]);\r\n rm' == AbstractifyCLearnerTuplesToLearnerTuples(m)[AbstractifyCOperationNumberToOperationNumber(o) := AbstractifyCLearnerTupleToLearnerTuple(t)]\r\n ensures forall o {:trigger RemoveElt(m,o)} :: o in m ==>\r\n var rm := AbstractifyCLearnerTuplesToLearnerTuples(m);\r\n var rm' := AbstractifyCLearnerTuplesToLearnerTuples(RemoveElt(m, o));\r\n rm' == RemoveElt(AbstractifyCLearnerTuplesToLearnerTuples(m), AbstractifyCOperationNumberToOperationNumber(o))\r\n{\r\n var rm := AbstractifyCLearnerTuplesToLearnerTuples(m);\r\n reveal AbstractifyCLearnerTuplesToLearnerTuples();\r\n\r\n lemma_AbstractifyMap_properties(m, AbstractifyCOperationNumberToOperationNumber, AbstractifyCLearnerTupleToLearnerTuple, RefineOperationNumberToCOperationNumber);\r\n}\r\n\r\npredicate LearnerState_IsAbstractable(learner:CLearnerState)\r\n{\r\n && CBallotIsAbstractable(learner.max_ballot_seen)\r\n && ReplicaConstantsStateIsAbstractable(learner.rcs)\r\n && CLearnerTuplesAreAbstractable(learner.unexecuted_ops)\r\n}\r\n\r\nfunction AbstractifyLearnerStateToLLearner(learner:CLearnerState) : LLearner\r\n requires LearnerState_IsAbstractable(learner)\r\n{\r\n var rcs := AbstractifyReplicaConstantsStateToLReplicaConstants(learner.rcs);\r\n var ballot := AbstractifyCBallotToBallot(learner.max_ballot_seen);\r\n var unexecuted_ops := AbstractifyCLearnerTuplesToLearnerTuples(learner.unexecuted_ops);\r\n LLearner(rcs, ballot, unexecuted_ops)\r\n}\r\n\r\nfunction LearnerState_EndPoint(learner:CLearnerState) : EndPoint\r\n requires LearnerState_IsValid(learner)\r\n{\r\n learner.rcs.all.config.replica_ids[learner.rcs.my_index]\r\n}\r\n\r\nfunction LearnerState_Config(learner:CLearnerState) : CPaxosConfiguration\r\n requires LearnerState_IsValid(learner)\r\n{\r\n learner.rcs.all.config\r\n}\r\n\r\nmethod LearnerState_Init(rcs:ReplicaConstantsState) returns (learner:CLearnerState)\r\n requires ReplicaConstantsStateIsAbstractable(rcs)\r\n requires ReplicaConstantsState_IsValid(rcs)\r\n ensures learner.rcs == rcs\r\n ensures LearnerState_IsValid(learner)\r\n ensures LLearnerInit(AbstractifyLearnerStateToLLearner(learner), AbstractifyReplicaConstantsStateToLReplicaConstants(learner.rcs))\r\n{\r\n var endPoint := rcs.all.config.replica_ids[rcs.my_index];\r\n learner :=\r\n CLearnerState(\r\n rcs,\r\n CBallot(0, 0),\r\n map[],\r\n false, // sendDecision\r\n COperationNumber(0),\r\n false, // recv2b\r\n CPacket(\r\n endPoint,\r\n endPoint,\r\n CMessage_2b(\r\n CBallot(0,0),\r\n COperationNumber(0),\r\n [])));\r\n\r\n lemma_AbstractifyCLearnerTuplesToLearnerTuples_properties(learner.unexecuted_ops);\r\n assert LLearnerInit(AbstractifyLearnerStateToLLearner(learner), AbstractifyReplicaConstantsStateToLReplicaConstants(learner.rcs));\r\n}\r\n\r\npredicate LearnerState_CommonPreconditions(learner:CLearnerState)\r\n{\r\n LearnerState_IsValid(learner)\r\n}\r\n\r\npredicate LearnerState_CommonPostconditions(learner:CLearnerState, learner':CLearnerState)\r\n{\r\n && LearnerState_CommonPreconditions(learner)\r\n && LearnerState_IsValid(learner')\r\n && learner.rcs == learner'.rcs\r\n}\r\n\r\npredicate LearnerState_Process2b__Preconditions(learner:CLearnerState, executor:ExecutorState, packet:CPacket)\r\n{\r\n && LearnerState_CommonPreconditions(learner)\r\n && ExecutorState_CommonPreconditions(executor)\r\n && CPacketIsAbstractable(packet)\r\n && packet.msg.CMessage_2b?\r\n}\r\n\r\npredicate LearnerState_Process2b__Postconditions(learner:CLearnerState, executor:ExecutorState, packet:CPacket, learner':CLearnerState)\r\n{\r\n && LearnerState_Process2b__Preconditions(learner, executor, packet)\r\n && LearnerState_CommonPostconditions(learner, learner')\r\n && LLearnerProcess2b(AbstractifyLearnerStateToLLearner(learner), AbstractifyLearnerStateToLLearner(learner'), AbstractifyCPacketToRslPacket(packet))\r\n}\r\n\r\npredicate LearnerState_ForgetDecision__Preconditions(learner:CLearnerState, opn:COperationNumber)\r\n{\r\n && LearnerState_CommonPreconditions(learner)\r\n && COperationNumberIsAbstractable(opn)\r\n}\r\n\r\npredicate LearnerState_ForgetDecision__Postconditions(learner:CLearnerState, opn:COperationNumber, learner':CLearnerState)\r\n{\r\n && LearnerState_ForgetDecision__Preconditions(learner, opn)\r\n && LearnerState_CommonPostconditions(learner, learner')\r\n && LLearnerForgetDecision(AbstractifyLearnerStateToLLearner(learner), AbstractifyLearnerStateToLLearner(learner'), AbstractifyCOperationNumberToOperationNumber(opn))\r\n}\r\n\r\npredicate LearnerState_ForgetOperationsBefore__Preconditions(learner:CLearnerState, opn:COperationNumber)\r\n{\r\n && LearnerState_CommonPreconditions(learner)\r\n && COperationNumberIsAbstractable(opn)\r\n}\r\n\r\npredicate LearnerState_ForgetOperationsBefore__Postconditions(learner:CLearnerState, opn:COperationNumber, learner':CLearnerState)\r\n{\r\n && LearnerState_ForgetOperationsBefore__Preconditions(learner, opn)\r\n && LearnerState_CommonPostconditions(learner, learner')\r\n && LLearnerForgetOperationsBefore(AbstractifyLearnerStateToLLearner(learner), AbstractifyLearnerStateToLLearner(learner'), AbstractifyCOperationNumberToOperationNumber(opn))\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/MinCQuorumSize.i.dfy", "content": "include \"../Common/NodeIdentity.i.dfy\"\r\ninclude \"CTypes.i.dfy\"\r\ninclude \"ReplicaConstantsState.i.dfy\"\r\n\r\nmodule LiveRSL__MinCQuorumSize_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__NetClient_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened Math__div_i\r\n\r\nmethod MinCQuorumSize(config:CPaxosConfiguration) returns (quorumSize:uint64)\r\n requires CPaxosConfigurationIsValid(config)\r\n ensures quorumSize as int == LMinQuorumSize(AbstractifyCPaxosConfigurationToConfiguration(config))\r\n ensures quorumSize >= 0\r\n{\r\n lemma_div_basics_forall(); // Needed to prove the operation below is within uint64 bounds\r\n quorumSize := (|config.replica_ids| as uint64)/2+1;\r\n ghost var c := AbstractifyCPaxosConfigurationToConfiguration(config);\r\n assert EndPointsAreValidPublicKeys(config.replica_ids);\r\n forall ep1, ep2 | ep1 in config.replica_ids && ep2 in config.replica_ids\r\n //&& EndPointIsValidPublicKey(ep1) && EndPointIsValidPublicKey(ep2) \r\n && AbstractifyEndPointToNodeIdentity(ep1) == AbstractifyEndPointToNodeIdentity(ep2) \r\n ensures ep1 == ep2\r\n {\r\n lemma_AbstractifyEndPointToNodeIdentity_injective(ep1, ep2);\r\n }\r\n /*\r\n var s := set p | p in config.replica_ids;\r\n lemma_SeqsSetCardinalityEndPoint(config.replica_ids, s);\r\n\r\n ghost var t := set e | e in s :: AbstractifyEndPointToNodeIdentity(e);\r\n reveal AbstractifyEndPointsToNodeIdentities();\r\n assert t == c.replica_ids;\r\n\r\n lemma_SetsCardinalityEndPoint(s, c.replica_ids);\r\n */\r\n assert |config.replica_ids| == |c.replica_ids|;\r\n\r\n assert quorumSize as int == (LMinQuorumSize(AbstractifyCPaxosConfigurationToConfiguration(config)));\r\n}\r\n\r\n\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/NetRSL.i.dfy", "content": "include \"../Common/NetClient.i.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\ninclude \"CPaxosConfiguration.i.dfy\"\r\ninclude \"CClockReading.i.dfy\"\r\ninclude \"Broadcast.i.dfy\"\r\n\r\nmodule LiveRSL__NetRSL_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Common__GenericMarshalling_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__NetClient_i\r\nimport opened Common__Util_i\r\nimport opened LiveRSL__CClockReading_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened Impl__LiveRSL__Broadcast_i \r\nimport opened Logic__Option_i\r\nimport opened Environment_s\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// These functions relate NetEvent to LiveRSL's LIoOps.\r\n// \r\n\r\npredicate NetEventIsAbstractable(evt:NetEvent)\r\n{\r\n match evt\r\n case LIoOpSend(s) => NetPacketIsAbstractable(s)\r\n case LIoOpReceive(r) => NetPacketIsAbstractable(r)\r\n case LIoOpTimeoutReceive => true\r\n case LIoOpReadClock(t) => true\r\n}\r\n\r\nfunction AbstractifyNetEventToRslIo(evt:NetEvent) : RslIo\r\n requires NetEventIsAbstractable(evt)\r\n{\r\n match evt\r\n case LIoOpSend(s) => LIoOpSend(AbstractifyNetPacketToRslPacket(s))\r\n case LIoOpReceive(r) => LIoOpReceive(AbstractifyNetPacketToRslPacket(r))\r\n case LIoOpTimeoutReceive => LIoOpTimeoutReceive()\r\n case LIoOpReadClock(t) => LIoOpReadClock(t as int)\r\n}\r\n\r\npredicate NetEventLogIsAbstractable(rawlog:seq)\r\n{\r\n forall i :: 0<=i<|rawlog| ==> NetEventIsAbstractable(rawlog[i])\r\n}\r\n\r\nfunction {:opaque} AbstractifyRawLogToIos(rawlog:seq) : seq\r\n requires NetEventLogIsAbstractable(rawlog)\r\n ensures |AbstractifyRawLogToIos(rawlog)| == |rawlog|\r\n ensures forall i {:trigger AbstractifyNetEventToRslIo(rawlog[i])} {:trigger AbstractifyRawLogToIos(rawlog)[i]} :: 0<=i<|rawlog| ==> AbstractifyRawLogToIos(rawlog)[i] == AbstractifyNetEventToRslIo(rawlog[i])\r\n{\r\n if (rawlog==[]) then [] else [AbstractifyNetEventToRslIo(rawlog[0])] + AbstractifyRawLogToIos(rawlog[1..])\r\n}\r\n\r\nlemma lemma_EstablishAbstractifyRawLogToIos(rawlog:seq, ios:seq)\r\n requires NetEventLogIsAbstractable(rawlog)\r\n requires |rawlog| == |ios|\r\n requires forall i :: 0<=i<|rawlog| ==> ios[i] == AbstractifyNetEventToRslIo(rawlog[i])\r\n ensures AbstractifyRawLogToIos(rawlog) == ios\r\n{\r\n reveal AbstractifyRawLogToIos();\r\n}\r\n\r\npredicate RawIoConsistentWithSpecIO(rawlog:seq, ios:seq)\r\n{\r\n && NetEventLogIsAbstractable(rawlog)\r\n && AbstractifyRawLogToIos(rawlog) == ios\r\n}\r\n\r\npredicate OnlySentMarshallableData(rawlog:seq)\r\n{\r\n forall io :: io in rawlog && io.LIoOpSend? ==> NetPacketBound(io.s.msg) && Marshallable(PaxosDemarshallData(io.s.msg))\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// These methods wrap the raw NetClient interface\r\n//\r\n\r\ndatatype ReceiveResult = RRFail() | RRTimeout() | RRPacket(cpacket:CPacket)\r\n\r\nmethod{:timeLimitMultiplier 2} Receive(netClient:NetClient, localAddr:EndPoint, config:CPaxosConfiguration, msg_grammar:G) returns (rr:ReceiveResult, ghost netEvent:NetEvent)\r\n requires NetClientIsValid(netClient)\r\n requires EndPoint(netClient.MyPublicKey()) == localAddr\r\n //requires KnownSendersMatchConfig(config)\r\n requires CPaxosConfigurationIsValid(config)\r\n requires msg_grammar == CMessage_grammar()\r\n modifies NetClientRepr(netClient)\r\n ensures netClient.env == old(netClient.env)\r\n ensures netClient.MyPublicKey() == old(netClient.MyPublicKey())\r\n ensures NetClientOk(netClient) <==> !rr.RRFail?\r\n ensures old(NetClientRepr(netClient)) == NetClientRepr(netClient)\r\n ensures !rr.RRFail? ==>\r\n && netClient.IsOpen()\r\n && old(netClient.env.net.history()) + [netEvent] == netClient.env.net.history()\r\n ensures rr.RRTimeout? ==> netEvent.LIoOpTimeoutReceive?;\r\n ensures rr.RRPacket? ==>\r\n && netEvent.LIoOpReceive?\r\n && NetPacketIsAbstractable(netEvent.r)\r\n && CPacketIsAbstractable(rr.cpacket)\r\n && CMessageIs64Bit(rr.cpacket.msg)\r\n && EndPointIsValidPublicKey(rr.cpacket.src)\r\n && AbstractifyCPacketToRslPacket(rr.cpacket) == AbstractifyNetPacketToRslPacket(netEvent.r)\r\n && rr.cpacket.msg == PaxosDemarshallData(netEvent.r.msg)\r\n && PaxosEndPointIsValid(rr.cpacket.src, config)\r\n{\r\n var timeout := 0;\r\n ghost var old_net_history := netClient.env.net.history();\r\n var ok, timedOut, remote, buffer := netClient.Receive(timeout);\r\n\r\n if (!ok) {\r\n rr := RRFail();\r\n return;\r\n }\r\n\r\n if (timedOut) {\r\n rr := RRTimeout();\r\n netEvent := LIoOpTimeoutReceive(); \r\n return;\r\n }\r\n\r\n var srcEp:EndPoint := EndPoint(remote);\r\n netEvent := LIoOpReceive(LPacket(EndPoint(netClient.MyPublicKey()), srcEp, buffer[..]));\r\n assert netClient.env.net.history() == old_net_history + [netEvent];\r\n var start_time := Time.GetDebugTimeTicks();\r\n lemma_CMessageGrammarValid();\r\n var cmessage := PaxosDemarshallDataMethod(buffer, msg_grammar);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"PaxosDemarshallDataMethod\", start_time, end_time);\r\n\r\n var cpacket := CPacket(localAddr, srcEp, cmessage);\r\n rr := RRPacket(cpacket);\r\n assert netClient.env.net.history() == old_net_history + [netEvent];\r\n\r\n if cmessage.CMessage_Invalid? {\r\n RecordTimingSeq(\"DemarshallMessage_Invalid\", start_time, end_time);\r\n } else if cmessage.CMessage_Request? {\r\n RecordTimingSeq(\"DemarshallMessage_Request\", start_time, end_time);\r\n } else if cmessage.CMessage_1a? {\r\n RecordTimingSeq(\"DemarshallMessage_1a\", start_time, end_time);\r\n } else if cmessage.CMessage_1b? {\r\n RecordTimingSeq(\"DemarshallMessage_1b\", start_time, end_time);\r\n } else if cmessage.CMessage_2a? {\r\n RecordTimingSeq(\"DemarshallMessage_2a\", start_time, end_time);\r\n } else if cmessage.CMessage_2b? {\r\n RecordTimingSeq(\"DemarshallMessage_2b\", start_time, end_time);\r\n } else if cmessage.CMessage_Heartbeat? {\r\n RecordTimingSeq(\"DemarshallMessage_Heartbeat\", start_time, end_time);\r\n } else if cmessage.CMessage_Reply? {\r\n RecordTimingSeq(\"DemarshallMessage_Reply\", start_time, end_time);\r\n } else if cmessage.CMessage_AppStateRequest? {\r\n RecordTimingSeq(\"DemarshallMessage_AppStateRequest\", start_time, end_time);\r\n } else if cmessage.CMessage_AppStateSupply? {\r\n RecordTimingSeq(\"DemarshallMessage_AppStateSupply\", start_time, end_time);\r\n } else if cmessage.CMessage_StartingPhase2? {\r\n RecordTimingSeq(\"DemarshallMessage_StartingPhase2\", start_time, end_time);\r\n }\r\n\r\n assert EndPointIsValidPublicKey(EndPoint(netClient.MyPublicKey()));\r\n assert PaxosEndPointIsValid(rr.cpacket.src, config);\r\n assert AbstractifyCPacketToRslPacket(rr.cpacket) == AbstractifyNetPacketToRslPacket(netEvent.r);\r\n\r\n /*\r\n forall ()\r\n ensures AbstractifyCPacketToRslPacket(rr.cpacket) == AbstractifyNetPacketToRslPacket(netEvent.r)\r\n ensures PaxosEndPointIsValid(rr.cpacket.src, config)\r\n {\r\n// lemma_Uint64EndPointRelationships();\r\n// assert ConvertEndPointToUint64(srcEp) == rr.cpacket.src; // OBSERVE trigger\r\n assert EndPointIsValidPublicKey(netClient.LocalEndPoint()); // OBSERVE trigger\r\n }\r\n */\r\n}\r\n\r\nmethod ReadClock(netClient:NetClient) returns (clock:CClockReading, ghost clockEvent:NetEvent)\r\n requires NetClientIsValid(netClient)\r\n modifies NetClientRepr(netClient)\r\n ensures old(NetClientRepr(netClient)) == NetClientRepr(netClient)\r\n ensures NetClientIsValid(netClient)\r\n ensures netClient.env == old(netClient.env)\r\n ensures old(netClient.env.net.history()) + [clockEvent] == netClient.env.net.history()\r\n ensures clockEvent.LIoOpReadClock?\r\n ensures clock.t as int == clockEvent.t\r\n ensures NetClientIsValid(netClient)\r\n ensures NetEventIsAbstractable(clockEvent)\r\n ensures netClient.MyPublicKey() == old(netClient.MyPublicKey())\r\n // TODO we're going to call GetTime, which returns a single value.\r\n{\r\n var t := Time.GetTime(netClient.env);\r\n clockEvent := LIoOpReadClock(t as int);\r\n clock := CClockReading(t);\r\n}\r\n\r\npredicate SendLogEntryReflectsPacket(event:NetEvent, cpacket:CPacket)\r\n{\r\n && event.LIoOpSend?\r\n && NetPacketIsAbstractable(event.s)\r\n && CPacketIsAbstractable(cpacket)\r\n && AbstractifyCPacketToRslPacket(cpacket) == AbstractifyNetPacketToRslPacket(event.s)\r\n}\r\n\r\npredicate SendLogReflectsPacket(netEventLog:seq, packet:Option)\r\n{\r\n match packet {\r\n case Some(p) => |netEventLog| == 1 && SendLogEntryReflectsPacket(netEventLog[0], p)\r\n case None => netEventLog == []\r\n }\r\n}\r\n\r\npredicate SendLogReflectsPacketSeq(netEventLog:seq, packets:seq)\r\n{\r\n && |netEventLog| == |packets| \r\n && (forall i :: 0 <= i < |packets| ==> SendLogEntryReflectsPacket(netEventLog[i], packets[i]))\r\n}\r\n\r\npredicate SendLogMatchesRefinement(netEventLog:seq, broadcast:CBroadcast, index:int)\r\n requires CBroadcastIsAbstractable(broadcast)\r\n requires broadcast.CBroadcast?\r\n requires 0<=|netEventLog|<=|broadcast.dsts|\r\n requires 0 <= index < |netEventLog|\r\n{\r\n && netEventLog[index].LIoOpSend? && NetPacketIsAbstractable(netEventLog[index].s)\r\n && AbstractifyCBroadcastToRlsPacketSeq(broadcast)[index] == AbstractifyNetPacketToRslPacket(netEventLog[index].s)\r\n}\r\n\r\npredicate SendLogReflectsBroadcastPrefix(netEventLog:seq, broadcast:CBroadcast)\r\n requires CBroadcastIsAbstractable(broadcast)\r\n requires broadcast.CBroadcast?\r\n{\r\n && 0<=|netEventLog|<=|broadcast.dsts|\r\n && forall i :: 0<=i<|netEventLog| ==> SendLogMatchesRefinement(netEventLog, broadcast, i)\r\n}\r\n\r\npredicate SendLogReflectsBroadcast(netEventLog:seq, broadcast:CBroadcast)\r\n requires CBroadcastIsAbstractable(broadcast)\r\n{\r\n if broadcast.CBroadcastNop? then\r\n netEventLog == []\r\n else \r\n && SendLogReflectsBroadcastPrefix(netEventLog, broadcast)\r\n && |netEventLog| == |broadcast.dsts|\r\n}\r\n\r\nlemma lemma_NetEventLogAppend(broadcast:CBroadcast, netEventLog:seq, netEvent:NetEvent)\r\n requires broadcast.CBroadcast?\r\n requires CBroadcastIsValid(broadcast)\r\n requires SendLogReflectsBroadcastPrefix(netEventLog, broadcast)\r\n requires |netEventLog| < |broadcast.dsts|\r\n requires netEvent.LIoOpSend?\r\n requires NetPacketIsAbstractable(netEvent.s)\r\n requires CMessageIsAbstractable(PaxosDemarshallData(netEvent.s.msg))\r\n requires netEvent.s.dst == broadcast.dsts[|netEventLog|]\r\n requires netEvent.s.src == broadcast.src\r\n requires BufferRefinementAgreesWithMessageRefinement(broadcast.msg, netEvent.s.msg)\r\n ensures SendLogReflectsBroadcastPrefix(netEventLog + [netEvent], broadcast)\r\n{\r\n var i := |netEventLog|;\r\n\r\n calc {\r\n AbstractifyCBroadcastToRlsPacketSeq(broadcast)[i];\r\n BuildLBroadcast(AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyEndPointsToNodeIdentities(broadcast.dsts), \r\n AbstractifyCMessageToRslMessage(broadcast.msg))[i];\r\n LPacket(AbstractifyEndPointsToNodeIdentities(broadcast.dsts)[i], \r\n AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyCMessageToRslMessage(broadcast.msg));\r\n LPacket(AbstractifyEndPointToNodeIdentity(netEvent.s.dst),\r\n AbstractifyEndPointToNodeIdentity(netEvent.s.src),\r\n AbstractifyCMessageToRslMessage(PaxosDemarshallData(netEvent.s.msg)));\r\n AbstractifyNetPacketToRslPacket(netEvent.s);\r\n }\r\n\r\n var new_log := netEventLog + [netEvent];\r\n\r\n forall i' | 0 <= i' < |new_log|\r\n ensures SendLogMatchesRefinement(new_log, broadcast, i')\r\n {\r\n if i' < |netEventLog| {\r\n assert new_log[i'] == netEventLog[i'];\r\n assert SendLogMatchesRefinement(netEventLog, broadcast, i');\r\n assert SendLogMatchesRefinement(new_log, broadcast, i');\r\n } else {\r\n assert new_log[i'] == netEvent;\r\n assert SendLogMatchesRefinement(new_log, broadcast, i');\r\n }\r\n }\r\n\r\n calc ==> {\r\n true;\r\n forall i' :: 0 <= i' < |new_log| ==> SendLogMatchesRefinement(new_log, broadcast, i');\r\n SendLogReflectsBroadcastPrefix(new_log, broadcast);\r\n SendLogReflectsBroadcastPrefix(netEventLog + [netEvent], broadcast);\r\n }\r\n}\r\n\r\nmethod SendBroadcast(netClient:NetClient, broadcast:CBroadcast, ghost localAddr_:EndPoint) returns (ok:bool, ghost netEventLog:seq)\r\n requires NetClientIsValid(netClient)\r\n requires CBroadcastIsValid(broadcast)\r\n requires EndPoint(netClient.MyPublicKey()) == localAddr_\r\n requires broadcast.CBroadcast? ==> broadcast.src == localAddr_\r\n modifies NetClientRepr(netClient)\r\n ensures old(NetClientRepr(netClient)) == NetClientRepr(netClient)\r\n ensures netClient.env == old(netClient.env)\r\n ensures netClient.MyPublicKey() == old(netClient.MyPublicKey())\r\n ensures NetClientOk(netClient) <==> ok\r\n ensures ok ==>\r\n && NetClientIsValid(netClient)\r\n && netClient.IsOpen()\r\n && old(netClient.env.net.history()) + netEventLog == netClient.env.net.history()\r\n && OnlySentMarshallableData(netEventLog)\r\n && SendLogReflectsBroadcast(netEventLog, broadcast)\r\n{\r\n ok := true;\r\n netEventLog := [];\r\n\r\n if broadcast.CBroadcastNop? {\r\n // No work to do!\r\n } else {\r\n // Do the marshalling work once\r\n assert CMessageIsAbstractable(broadcast.msg);\r\n assert Marshallable(broadcast.msg);\r\n //var marshall_start_time := Time.GetDebugTimeTicks();\r\n var buffer := PaxosMarshall(broadcast.msg);\r\n //var marshall_end_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"SendBroadcast_PaxosMarshall\", marshall_start_time, marshall_end_time);\r\n assert NetPacketBound(buffer[..]);\r\n\r\n calc ==> {\r\n true;\r\n CBroadcastIsValid(broadcast);\r\n CBroadcastIsAbstractable(broadcast);\r\n CMessageIsAbstractable(broadcast.msg);\r\n }\r\n\r\n var i:uint64 := 0;\r\n while i < |broadcast.dsts| as uint64\r\n invariant 0 <= i as int <= |broadcast.dsts|\r\n invariant |netEventLog| == i as int\r\n invariant NetClientRepr(netClient) == old(NetClientRepr(netClient))\r\n invariant netClient.env == old(netClient.env)\r\n invariant netClient.MyPublicKey() == old(netClient.MyPublicKey())\r\n invariant NetClientIsValid(netClient)\r\n invariant NetClientOk(netClient)\r\n invariant old(netClient.env.net.history()) + netEventLog == netClient.env.net.history()\r\n invariant NetPacketBound(buffer[..])\r\n invariant Marshallable(PaxosDemarshallData(buffer[..]))\r\n invariant BufferRefinementAgreesWithMessageRefinement(broadcast.msg, buffer[..])\r\n invariant SendLogReflectsBroadcastPrefix(netEventLog, broadcast)\r\n invariant CMessageIsAbstractable(PaxosDemarshallData(buffer[..]))\r\n invariant OnlySentMarshallableData(netEventLog)\r\n {\r\n ghost var netEventLog_old := netEventLog;\r\n\r\n // Construct the remote address -- TODO: Only do this once per replica!\r\n var dstEp:EndPoint := broadcast.dsts[i];\r\n //var construct_start_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"SendBroadcast\", construct_start_time, construct_end_time);\r\n\r\n //var send_start_time := Time.GetDebugTimeTicks();\r\n ok := netClient.Send(dstEp.public_key, buffer);\r\n if (!ok) { return; }\r\n //var send_end_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"SendBroadcast_Send\", send_start_time, send_end_time);\r\n\r\n ghost var netEvent := LIoOpSend(LPacket(dstEp, EndPoint(netClient.MyPublicKey()), buffer[..]));\r\n netEventLog := netEventLog + [netEvent];\r\n\r\n lemma_NetEventLogAppend(broadcast, netEventLog_old, netEvent);\r\n\r\n i := i + 1;\r\n }\r\n }\r\n}\r\n\r\n\r\nmethod SendPacket(netClient:NetClient, packets:OutboundPackets, ghost localAddr_:EndPoint) returns (ok:bool, ghost netEventLog:seq)\r\n requires NetClientIsValid(netClient)\r\n requires packets.OutboundPacket?\r\n requires OutboundPacketsIsValid(packets)\r\n requires EndPoint(netClient.MyPublicKey()) == localAddr_\r\n requires OutboundPacketsHasCorrectSrc(packets, localAddr_)\r\n modifies NetClientRepr(netClient)\r\n ensures old(NetClientRepr(netClient)) == NetClientRepr(netClient)\r\n ensures netClient.env == old(netClient.env)\r\n ensures netClient.MyPublicKey() == old(netClient.MyPublicKey())\r\n ensures NetClientOk(netClient) <==> ok\r\n ensures ok ==> && NetClientIsValid(netClient)\r\n && netClient.IsOpen()\r\n && old(netClient.env.net.history()) + netEventLog == netClient.env.net.history()\r\n && OnlySentMarshallableData(netEventLog)\r\n && SendLogReflectsPacket(netEventLog, packets.p)\r\n{\r\n var j:uint64 := 0;\r\n netEventLog := [];\r\n ok := true;\r\n var opt_packet := packets.p;\r\n\r\n if opt_packet.None? {\r\n\r\n } else {\r\n var cpacket := opt_packet.v;\r\n\r\n ghost var netEventLog_old := netEventLog;\r\n\r\n // Construct the remote address\r\n var dstEp:EndPoint := cpacket.dst;\r\n\r\n assert CMessageIsAbstractable(cpacket.msg);\r\n assert Marshallable(cpacket.msg);\r\n var marshall_start_time := Time.GetDebugTimeTicks();\r\n var buffer := PaxosMarshall(cpacket.msg);\r\n var marshall_end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"SendBatch_PaxosMarshall\", marshall_start_time, marshall_end_time);\r\n\r\n ghost var data := buffer[..];\r\n assert BufferRefinementAgreesWithMessageRefinement(cpacket.msg, data);\r\n\r\n ok := netClient.Send(dstEp.public_key, buffer);\r\n if (!ok) { return; }\r\n\r\n ghost var netEvent := LIoOpSend(LPacket(dstEp, EndPoint(netClient.MyPublicKey()), buffer[..]));\r\n ghost var net := netEvent.s;\r\n\r\n calc {\r\n AbstractifyCPacketToRslPacket(cpacket);\r\n LPacket(AbstractifyEndPointToNodeIdentity(cpacket.dst), AbstractifyEndPointToNodeIdentity(cpacket.src), AbstractifyCMessageToRslMessage(cpacket.msg));\r\n LPacket(AbstractifyEndPointToNodeIdentity(net.dst), AbstractifyEndPointToNodeIdentity(net.src), AbstractifyCMessageToRslMessage(cpacket.msg));\r\n AbstractifyBufferToRslPacket(net.src, net.dst, data);\r\n AbstractifyBufferToRslPacket(net.src, net.dst, net.msg);\r\n AbstractifyNetPacketToRslPacket(netEvent.s);\r\n }\r\n assert SendLogEntryReflectsPacket(netEvent, cpacket);\r\n netEventLog := [netEvent];\r\n }\r\n}\r\n\r\n\r\nmethod{:timeLimitMultiplier 2} SendPacketSequence(netClient:NetClient, packets:OutboundPackets, ghost localAddr_:EndPoint) returns (ok:bool, ghost netEventLog:seq)\r\n requires NetClientIsValid(netClient)\r\n requires OutboundPacketsIsValid(packets)\r\n requires packets.PacketSequence?\r\n requires EndPoint(netClient.MyPublicKey()) == localAddr_\r\n requires OutboundPacketsHasCorrectSrc(packets, localAddr_)\r\n modifies NetClientRepr(netClient)\r\n ensures old(NetClientRepr(netClient)) == NetClientRepr(netClient)\r\n ensures netClient.env == old(netClient.env)\r\n ensures netClient.MyPublicKey() == old(netClient.MyPublicKey())\r\n ensures NetClientOk(netClient) <==> ok\r\n ensures ok ==>\r\n && NetClientIsValid(netClient)\r\n && netClient.IsOpen()\r\n && old(netClient.env.net.history()) + netEventLog == netClient.env.net.history()\r\n && OnlySentMarshallableData(netEventLog)\r\n && SendLogReflectsPacketSeq(netEventLog, packets.s)\r\n{\r\n var cpackets := packets.s;\r\n var j:uint64 := 0;\r\n netEventLog := [];\r\n ok := true;\r\n \r\n ghost var netEventLog_old := netEventLog;\r\n ghost var netClientEnvHistory_old := old(netClient.env.net.history());\r\n var i:uint64 := 0;\r\n\r\n while i < |cpackets| as uint64\r\n invariant old(NetClientRepr(netClient)) == NetClientRepr(netClient)\r\n invariant netClient.env == old(netClient.env)\r\n invariant netClient.MyPublicKey() == old(netClient.MyPublicKey())\r\n invariant NetClientOk(netClient) <==> ok\r\n invariant ok ==> ( NetClientIsValid(netClient) && netClient.IsOpen())\r\n invariant ok ==> netClientEnvHistory_old + netEventLog == netClient.env.net.history()\r\n invariant (i == 0) ==> |netEventLog| == 0\r\n invariant (0 < i as int < |cpackets|) ==> |netEventLog| == |cpackets[0..i]|\r\n invariant (0 < i as int < |cpackets|) ==> SendLogReflectsPacketSeq(netEventLog, cpackets[0..i]);\r\n invariant (i as int >= |cpackets|) ==> SendLogReflectsPacketSeq(netEventLog, cpackets);\r\n invariant OnlySentMarshallableData(netEventLog)\r\n {\r\n var cpacket := cpackets[i];\r\n // Construct the remote address\r\n var dstEp:EndPoint := cpacket.dst;\r\n assert cpacket in cpackets;\r\n assert OutboundPacketsIsValid(packets);\r\n\r\n assert CMessageIsAbstractable(cpacket.msg);\r\n \r\n assert Marshallable(cpacket.msg);\r\n var buffer := PaxosMarshall(cpacket.msg);\r\n\r\n ghost var data := buffer[..];\r\n assert BufferRefinementAgreesWithMessageRefinement(cpacket.msg, data);\r\n\r\n ok := netClient.Send(dstEp.public_key, buffer);\r\n if (!ok) { return; }\r\n\r\n ghost var netEvent := LIoOpSend(LPacket(dstEp, EndPoint(netClient.MyPublicKey()), buffer[..]));\r\n ghost var net := netEvent.s;\r\n\r\n calc {\r\n AbstractifyCPacketToRslPacket(cpacket);\r\n LPacket(AbstractifyEndPointToNodeIdentity(cpacket.dst), AbstractifyEndPointToNodeIdentity(cpacket.src), AbstractifyCMessageToRslMessage(cpacket.msg));\r\n LPacket(AbstractifyEndPointToNodeIdentity(net.dst), AbstractifyEndPointToNodeIdentity(net.src), AbstractifyCMessageToRslMessage(cpacket.msg));\r\n AbstractifyBufferToRslPacket(net.src, net.dst, data);\r\n AbstractifyBufferToRslPacket(net.src, net.dst, net.msg);\r\n AbstractifyNetPacketToRslPacket(netEvent.s);\r\n }\r\n \r\n assert SendLogEntryReflectsPacket(netEvent, cpacket);\r\n \r\n netEventLog := netEventLog + [netEvent];\r\n assert cpackets[0..(i as int+1)] == cpackets[0..i as int] + [cpacket];\r\n assert SendLogReflectsPacketSeq(netEventLog, cpackets[0..(i as int+1)]);\r\n i := i + 1;\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/PacketParsing.i.dfy", "content": "include \"../../Common/Collections/Maps.i.dfy\"\r\ninclude \"../../Protocol/RSL/Configuration.i.dfy\"\r\ninclude \"../../Protocol/RSL/Message.i.dfy\"\r\ninclude \"../../Protocol/RSL/Types.i.dfy\"\r\ninclude \"../Common/GenericMarshalling.i.dfy\"\r\ninclude \"CTypes.i.dfy\"\r\ninclude \"CMessage.i.dfy\"\r\ninclude \"CMessageRefinements.i.dfy\"\r\n\r\nmodule LiveRSL__PacketParsing_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Collections__Maps_i\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Common__GenericMarshalling_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__NetClient_i\r\nimport opened Common__Util_i\r\nimport opened AppStateMachine_s\r\nimport opened Environment_s\r\nimport opened Math__mul_i\r\nimport opened Math__mul_nonlinear_i\r\n\r\n////////////////////////////////////////////////////////////////////\r\n// Grammars for the Paxos types\r\n////////////////////////////////////////////////////////////////////\r\nfunction method EndPoint_grammar() : G { GByteArray }\r\nfunction method CRequest_grammar() : G { GTuple([EndPoint_grammar(), GUint64, GByteArray]) }\r\nfunction method CRequestBatch_grammar() : G { GArray(CRequest_grammar()) }\r\nfunction method CReply_grammar() : G { GTuple([EndPoint_grammar(), GUint64, GByteArray]) }\r\nfunction method CBallot_grammar() : G { GTuple([GUint64, GUint64]) }\r\nfunction method COperationNumber_grammar() : G { GUint64 }\r\nfunction method CVote_grammar() : G { GTuple([CBallot_grammar(), CRequestBatch_grammar()])} \r\nfunction method CMap_grammar(key:G, val:G) : G { GArray(GTuple([key, val])) }\r\nfunction method CVotes_grammar() : G { GArray(GTuple([COperationNumber_grammar(), CVote_grammar()])) }\r\n\r\n////////////////////////////////////////////////////////////////////\r\n// Grammars for the Paxos messages \r\n////////////////////////////////////////////////////////////////////\r\nfunction method CMessage_Request_grammar() : G { GTuple([GUint64, GByteArray]) }\r\nfunction method CMessage_1a_grammar() : G { CBallot_grammar() }\r\nfunction method CMessage_1b_grammar() : G { GTuple([CBallot_grammar(), COperationNumber_grammar(), CVotes_grammar()]) }\r\nfunction method CMessage_2a_grammar() : G { GTuple([CBallot_grammar(), COperationNumber_grammar(), CRequestBatch_grammar()]) }\r\nfunction method CMessage_2b_grammar() : G { GTuple([CBallot_grammar(), COperationNumber_grammar(), CRequestBatch_grammar()]) }\r\nfunction method CMessage_Heartbeat_grammar() : G { GTuple([CBallot_grammar(), GUint64, COperationNumber_grammar()]) }\r\nfunction method CMessage_Reply_grammar() : G { GTuple( [GUint64, GByteArray] ) }\r\nfunction method CMessage_AppStateRequest_grammar() : G { GTuple([CBallot_grammar(), COperationNumber_grammar()]) }\r\nfunction method CMessage_AppStateSupply_grammar() : G { GTuple([CBallot_grammar(), COperationNumber_grammar(), GByteArray]) }\r\nfunction method CMessage_StartingPhase2_grammar() : G { GTuple([CBallot_grammar(), COperationNumber_grammar()]) }\r\n\r\nfunction method CMessage_grammar() : G { GTaggedUnion([\r\n CMessage_Request_grammar(),\r\n CMessage_1a_grammar(),\r\n CMessage_1b_grammar(),\r\n CMessage_2a_grammar(),\r\n CMessage_2b_grammar(),\r\n CMessage_Heartbeat_grammar(),\r\n CMessage_Reply_grammar(),\r\n CMessage_AppStateRequest_grammar(),\r\n CMessage_AppStateSupply_grammar(),\r\n CMessage_StartingPhase2_grammar()\r\n ]) }\r\n\r\npredicate NetPacketBound(data:seq) \r\n{\r\n |data| < MaxPacketSize()\r\n}\r\n\r\n////////////////////////////////////////////////////////////////////\r\n// 64-bit Limits\r\n////////////////////////////////////////////////////////////////////\r\n\r\npredicate CRequestBatchIs64Bit(batch:CRequestBatch)\r\n{\r\n |batch| < 0x1_0000_0000_0000_0000\r\n}\r\n\r\npredicate CVoteIs64Bit(vote:CVote)\r\n{\r\n CRequestBatchIs64Bit(vote.max_val)\r\n}\r\n\r\npredicate CVotesIs64Bit(votes:CVotes)\r\n{\r\n && |votes.v| < 0x1_0000_0000_0000_0000\r\n && (forall opn :: opn in votes.v ==> CVoteIs64Bit(votes.v[opn]))\r\n}\r\n\r\npredicate CMessageIs64Bit(msg:CMessage)\r\n{\r\n match msg\r\n case CMessage_Invalid => true\r\n case CMessage_Request(seqno, val) => true\r\n case CMessage_1a(bal) => true\r\n case CMessage_1b(bal, log_truncation_point, votes) => CVotesIs64Bit(votes)\r\n case CMessage_2a(bal, opn, batch) => CRequestBatchIs64Bit(batch)\r\n case CMessage_2b(bal, opn, batch) => CRequestBatchIs64Bit(batch)\r\n case CMessage_Heartbeat(bal, suspicious, opn) => true\r\n case CMessage_Reply(seqno, reply) => true\r\n case CMessage_AppStateRequest(bal, opn) => true\r\n case CMessage_AppStateSupply(bal, opn, app) => true\r\n case CMessage_StartingPhase2(bal, log_truncation_point) => true\r\n}\r\n\r\n////////////////////////////////////////////////////////////////////\r\n// Parsing\r\n////////////////////////////////////////////////////////////////////\r\n\r\nfunction method parse_EndPoint(val:V) : EndPoint\r\n requires ValInGrammar(val, EndPoint_grammar())\r\n ensures EndPointIsAbstractable(parse_EndPoint(val))\r\n{\r\n EndPoint(val.b)\r\n}\r\n\r\nfunction method parse_Request(val:V) : CRequest\r\n requires ValInGrammar(val, CRequest_grammar())\r\n ensures CRequestIsAbstractable(parse_Request(val))\r\n{\r\n assert ValInGrammar(val.t[0], CRequest_grammar().t[0]); // OBSERVE \r\n assert ValInGrammar(val.t[1], CRequest_grammar().t[1]); // OBSERVE \r\n assert ValInGrammar(val.t[2], CRequest_grammar().t[2]); // OBSERVE \r\n var ep := parse_EndPoint(val.t[0]);\r\n CRequest(ep, val.t[1].u, val.t[2].b)\r\n}\r\n\r\nfunction parse_RequestBatch(val:V) : CRequestBatch\r\n requires ValInGrammar(val, CRequestBatch_grammar())\r\n ensures |parse_RequestBatch(val)| == |val.a|\r\n ensures forall i :: 0 <= i < |parse_RequestBatch(val)| ==> parse_RequestBatch(val)[i] == parse_Request(val.a[i])\r\n ensures CRequestBatchIsAbstractable(parse_RequestBatch(val))\r\n ensures ValidVal(val) ==> CRequestBatchIs64Bit(parse_RequestBatch(val))\r\n decreases |val.a|\r\n{\r\n if |val.a| == 0 then\r\n []\r\n else \r\n var req := parse_Request(val.a[0]);\r\n var restVal:V := VArray(val.a[1..]);\r\n var rest := parse_RequestBatch(restVal);\r\n [req] + rest\r\n}\r\n\r\n/*\r\nmethod parse_RequestBatchIter(val:V) returns (batch:CRequestBatch)\r\n requires ValInGrammar(val, CRequestBatch_grammar())\r\n requires ValidVal(val)\r\n ensures |batch| == |val.a|\r\n ensures forall i :: 0 <= i < |batch| ==> batch[i] == parse_Request(val.a[i])\r\n{\r\n batch := [];\r\n\r\n var i:uint64 := 0;\r\n while i < |val.a| as uint64 \r\n invariant 0 <= int(i) <= |val.a|\r\n invariant int(i) == |batch|\r\n invariant forall j :: 0 <= j < int(i) ==> batch[j] == parse_Request(val.a[j])\r\n {\r\n var req := parse_Request(val.a[i]);\r\n batch := batch + [req];\r\n i := i + 1;\r\n }\r\n}\r\n*/\r\n\r\nmethod Parse_RequestBatch(val:V) returns (batch:CRequestBatch)\r\n requires ValInGrammar(val, CRequestBatch_grammar())\r\n requires ValidVal(val)\r\n ensures |batch| == |val.a|\r\n ensures CRequestBatchIs64Bit(batch)\r\n ensures forall i :: 0 <= i < |batch| ==> batch[i] == parse_Request(val.a[i])\r\n ensures batch == parse_RequestBatch(val)\r\n ensures CRequestBatchIsAbstractable(batch)\r\n{\r\n var batchArr := new CRequest[|val.a| as uint64];\r\n\r\n var i:uint64 := 0;\r\n while i < |val.a| as uint64\r\n invariant 0 <= i as int <= |val.a|\r\n invariant forall j :: 0 <= j < i as int ==> batchArr[j] == parse_Request(val.a[j])\r\n {\r\n var req := parse_Request(val.a[i]);\r\n batchArr[i] := req;\r\n i := i + 1;\r\n }\r\n batch := batchArr[..];\r\n}\r\n\r\nfunction method parse_Reply(val:V) : CReply\r\n requires ValInGrammar(val, CReply_grammar())\r\n ensures CReplyIsAbstractable(parse_Reply(val))\r\n{\r\n assert ValInGrammar(val.t[0], CReply_grammar().t[0]); // OBSERVE \r\n assert ValInGrammar(val.t[1], CReply_grammar().t[1]); // OBSERVE \r\n assert ValInGrammar(val.t[2], CReply_grammar().t[2]); // OBSERVE \r\n var ep := parse_EndPoint(val.t[0]);\r\n CReply(ep, val.t[1].u, val.t[2].b)\r\n}\r\n\r\nfunction method parse_Ballot(val:V) : CBallot\r\n requires ValInGrammar(val, CBallot_grammar())\r\n ensures CBallotIsAbstractable(parse_Ballot(val))\r\n{\r\n assert ValInGrammar(val.t[0], CBallot_grammar().t[0]); // OBSERVE \r\n assert ValInGrammar(val.t[1], CBallot_grammar().t[1]); // OBSERVE\r\n CBallot(val.t[0].u, val.t[1].u)\r\n}\r\n\r\nfunction method parse_OperationNumber(val:V) : COperationNumber\r\n requires ValInGrammar(val, COperationNumber_grammar())\r\n ensures COperationNumberIsAbstractable(parse_OperationNumber(val))\r\n{\r\n COperationNumber(val.u)\r\n}\r\n\r\nfunction parse_Vote(val:V) : CVote\r\n requires ValInGrammar(val, CVote_grammar())\r\n ensures CVoteIsAbstractable(parse_Vote(val))\r\n ensures ValidVal(val) ==> CVoteIs64Bit(parse_Vote(val))\r\n{\r\n CVote(parse_Ballot(val.t[0]), parse_RequestBatch(val.t[1]))\r\n}\r\n\r\nmethod Parse_Vote(val:V) returns (vote:CVote)\r\n requires ValInGrammar(val, CVote_grammar())\r\n requires ValidVal(val)\r\n ensures parse_Vote(val) == vote\r\n ensures CVoteIs64Bit(vote)\r\n{\r\n var batch := Parse_RequestBatch(val.t[1]);\r\n vote := CVote(parse_Ballot(val.t[0]), batch);\r\n}\r\n\r\n\r\n// Abandoned for now, since the marshalling side is all methods, so we can't easily make it higher order\r\n// \r\n//function method parse_Map(val:V, parse_key:V->KT, parse_val:V->VT, key_grammar:G, val_grammar:G) : map\r\n// requires ValInGrammar(val, CMap_grammar(key_grammar, val_grammar))\r\n// requires forall v :: parse_key.requires(v) && parse_val.requires(v)\r\n// reads parse_key.reads, parse_val.reads;\r\n// decreases |val.a|\r\n//{\r\n// if |val.a| == 0 then\r\n// map []\r\n// else \r\n// var tuple := val.a[0];\r\n// assert ValInGrammar(tuple, CMap_grammar(key_grammar, val_grammar).elt);\r\n// assert ValInGrammar(tuple.t[0], CMap_grammar(key_grammar, val_grammar).elt.t[0]); // OBSERVE\r\n// assert ValInGrammar(tuple.t[1], CMap_grammar(key_grammar, val_grammar).elt.t[1]); // OBSERVE\r\n// var k := parse_key(tuple.t[0]);\r\n// var v := parse_val(tuple.t[1]);\r\n// var others := parse_Map(VArray(val.a[1..]), parse_key, parse_val, key_grammar, val_grammar);\r\n// var m := others[k := v];\r\n// m\r\n//}\r\n\r\nfunction parse_Votes(val:V) : CVotes\r\n requires ValInGrammar(val, CVotes_grammar())\r\n ensures CVotesIsAbstractable(parse_Votes(val))\r\n ensures |parse_Votes(val).v| <= |val.a|\r\n ensures ValidVal(val) ==> CVotesIs64Bit(parse_Votes(val))\r\n decreases |val.a|\r\n{\r\n if |val.a| == 0 then\r\n CVotes(map [])\r\n else \r\n var tuple := val.a[0];\r\n assert ValInGrammar(tuple, CVotes_grammar().elt);\r\n assert ValInGrammar(tuple.t[0], CVotes_grammar().elt.t[0]); // OBSERVE\r\n assert ValInGrammar(tuple.t[1], CVotes_grammar().elt.t[1]); // OBSERVE\r\n var op := parse_OperationNumber(tuple.t[0]);\r\n var vote := parse_Vote(tuple.t[1]);\r\n var others := parse_Votes(VArray(val.a[1..]));\r\n calc {\r\n ValidVal(val);\r\n ==> { assert val.a[0] in val.a; } ValidVal(val.a[0]);\r\n ==> ValidVal(tuple);\r\n ==> { assert tuple.t[1] in tuple.t; } ValidVal(tuple.t[1]);\r\n ==> CVoteIs64Bit(vote);\r\n }\r\n var m := others.v[op := vote];\r\n assert COperationNumberIsAbstractable(op);\r\n CVotes(m)\r\n}\r\n\r\nmethod Parse_Votes(val:V) returns (votes:CVotes)\r\n requires ValInGrammar(val, CVotes_grammar())\r\n requires ValidVal(val)\r\n ensures CVotesIsAbstractable(votes)\r\n ensures CVotesIs64Bit(votes)\r\n decreases |val.a|\r\n ensures votes == parse_Votes(val)\r\n{\r\n if |val.a| as uint64 == 0 {\r\n votes := CVotes(map []);\r\n } else {\r\n var tuple := val.a[0];\r\n assert ValInGrammar(tuple, CVotes_grammar().elt);\r\n assert ValInGrammar(tuple.t[0], CVotes_grammar().elt.t[0]); // OBSERVE\r\n assert ValInGrammar(tuple.t[1], CVotes_grammar().elt.t[1]); // OBSERVE\r\n calc ==> {\r\n ValidVal(val);\r\n ValidVal(tuple);\r\n ValidVal(tuple.t[1]);\r\n }\r\n var op := parse_OperationNumber(tuple.t[0]);\r\n var vote := Parse_Vote(tuple.t[1]);\r\n var others := Parse_Votes(VArray(val.a[1..]));\r\n var m := others.v[op := vote];\r\n votes := CVotes(m);\r\n }\r\n}\r\n\r\nfunction method parse_Message_Request(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_Request_grammar())\r\n ensures CMessageIsAbstractable(parse_Message_Request(val))\r\n ensures ValidVal(val) ==> CMessageIs64Bit(parse_Message_Request(val))\r\n{\r\n assert ValInGrammar(val.t[0], CMessage_Request_grammar().t[0]); // OBSERVE\r\n assert ValInGrammar(val.t[1], CMessage_Request_grammar().t[1]); // OBSERVE\r\n CMessage_Request(val.t[0].u, val.t[1].b)\r\n}\r\n\r\nfunction method parse_Message_1a(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_1a_grammar())\r\n ensures CMessageIsAbstractable(parse_Message_1a(val))\r\n ensures ValidVal(val) ==> CMessageIs64Bit(parse_Message_1a(val))\r\n{\r\n CMessage_1a(parse_Ballot(val))\r\n}\r\n\r\nfunction parse_Message_1b(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_1b_grammar())\r\n ensures CMessageIsAbstractable(parse_Message_1b(val))\r\n ensures ValidVal(val) ==> CMessageIs64Bit(parse_Message_1b(val))\r\n{\r\n CMessage_1b(parse_Ballot(val.t[0]), parse_OperationNumber(val.t[1]), parse_Votes(val.t[2]))\r\n}\r\n\r\nmethod Parse_Message_1b(val:V) returns (msg:CMessage)\r\n requires ValInGrammar(val, CMessage_1b_grammar())\r\n requires ValidVal(val)\r\n ensures msg == parse_Message_1b(val)\r\n ensures CMessageIsAbstractable(msg)\r\n ensures CMessageIs64Bit(msg)\r\n{\r\n var votes := Parse_Votes(val.t[2]);\r\n msg := CMessage_1b(parse_Ballot(val.t[0]), parse_OperationNumber(val.t[1]), votes);\r\n}\r\n\r\nfunction parse_Message_2a(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_2a_grammar())\r\n ensures CMessageIsAbstractable(parse_Message_2a(val))\r\n ensures ValidVal(val) ==> CMessageIs64Bit(parse_Message_2a(val))\r\n{\r\n CMessage_2a(parse_Ballot(val.t[0]), parse_OperationNumber(val.t[1]), parse_RequestBatch(val.t[2]))\r\n}\r\n\r\nmethod Parse_Message_2a(val:V) returns (msg:CMessage)\r\n requires ValInGrammar(val, CMessage_2a_grammar())\r\n requires ValidVal(val)\r\n ensures msg == parse_Message_2a(val)\r\n ensures CMessageIsAbstractable(msg)\r\n ensures CMessageIs64Bit(msg)\r\n{\r\n var batch := Parse_RequestBatch(val.t[2]);\r\n msg := CMessage_2a(parse_Ballot(val.t[0]), parse_OperationNumber(val.t[1]), batch);\r\n}\r\n\r\nfunction parse_Message_2b(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_2b_grammar())\r\n ensures ValidVal(val) ==> CMessageIs64Bit(parse_Message_2b(val))\r\n{\r\n CMessage_2b(parse_Ballot(val.t[0]), parse_OperationNumber(val.t[1]), parse_RequestBatch(val.t[2]))\r\n}\r\n\r\nmethod Parse_Message_2b(val:V) returns (msg:CMessage)\r\n requires ValInGrammar(val, CMessage_2b_grammar())\r\n requires ValidVal(val)\r\n ensures msg == parse_Message_2b(val)\r\n ensures CMessageIsAbstractable(msg)\r\n ensures CMessageIs64Bit(msg)\r\n{\r\n var batch := Parse_RequestBatch(val.t[2]);\r\n msg := CMessage_2b(parse_Ballot(val.t[0]), parse_OperationNumber(val.t[1]), batch);\r\n}\r\n\r\nfunction method parse_Message_Heartbeat(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_Heartbeat_grammar())\r\n ensures CMessageIsAbstractable(parse_Message_Heartbeat(val))\r\n ensures ValidVal(val) ==> CMessageIs64Bit(parse_Message_Heartbeat(val))\r\n{\r\n assert ValInGrammar(val.t[1], CMessage_Heartbeat_grammar().t[1]); // OBSERVE\r\n CMessage_Heartbeat(parse_Ballot(val.t[0]), val.t[1].u != 0, parse_OperationNumber(val.t[2]))\r\n}\r\n\r\nfunction method parse_Message_Reply(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_Reply_grammar())\r\n ensures CMessageIsAbstractable(parse_Message_Reply(val))\r\n ensures ValidVal(val) ==> CMessageIs64Bit(parse_Message_Reply(val))\r\n{\r\n assert ValInGrammar(val.t[0], CMessage_Reply_grammar().t[0]); // OBSERVE\r\n assert ValInGrammar(val.t[1], CMessage_Reply_grammar().t[1]); // OBSERVE\r\n CMessage_Reply(val.t[0].u, val.t[1].b)\r\n}\r\n\r\nfunction method parse_Message_AppStateRequest(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_AppStateRequest_grammar())\r\n ensures CMessageIsAbstractable(parse_Message_AppStateRequest(val))\r\n ensures ValidVal(val) ==> CMessageIs64Bit(parse_Message_AppStateRequest(val))\r\n{\r\n CMessage_AppStateRequest(parse_Ballot(val.t[0]), parse_OperationNumber(val.t[1]))\r\n}\r\n\r\nfunction method parse_Message_AppStateSupply(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_AppStateSupply_grammar())\r\n ensures CMessageIsAbstractable(parse_Message_AppStateSupply(val))\r\n ensures ValidVal(val) ==> CMessageIs64Bit(parse_Message_AppStateSupply(val))\r\n{\r\n assert ValInGrammar(val.t[2], GByteArray);\r\n CMessage_AppStateSupply(parse_Ballot(val.t[0]), parse_OperationNumber(val.t[1]), val.t[2].b)\r\n}\r\n\r\nfunction method parse_Message_StartingPhase2(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_StartingPhase2_grammar())\r\n ensures CMessageIsAbstractable(parse_Message_StartingPhase2(val))\r\n ensures ValidVal(val) ==> CMessageIs64Bit(parse_Message_StartingPhase2(val))\r\n{\r\n CMessage_StartingPhase2(parse_Ballot(val.t[0]), parse_OperationNumber(val.t[1]))\r\n}\r\n\r\n\r\nfunction parse_Message(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_grammar())\r\n ensures CMessageIsAbstractable(parse_Message(val))\r\n ensures ValidVal(val) ==> CMessageIs64Bit(parse_Message(val))\r\n{\r\n if val.c == 0 then\r\n parse_Message_Request(val.val)\r\n else if val.c == 1 then\r\n parse_Message_1a(val.val)\r\n else if val.c == 2 then\r\n parse_Message_1b(val.val)\r\n else if val.c == 3 then\r\n parse_Message_2a(val.val)\r\n else if val.c == 4 then\r\n parse_Message_2b(val.val)\r\n else if val.c == 5 then\r\n parse_Message_Heartbeat(val.val)\r\n else if val.c == 6 then\r\n parse_Message_Reply(val.val)\r\n else if val.c == 7 then\r\n parse_Message_AppStateRequest(val.val)\r\n else if val.c == 8 then\r\n parse_Message_AppStateSupply(val.val)\r\n else if val.c == 9 then\r\n parse_Message_StartingPhase2(val.val)\r\n else\r\n assert false; // Should never get here\r\n parse_Message_Request(val)\r\n}\r\n\r\nmethod Parse_Message(val:V) returns (msg:CMessage)\r\n\trequires ValInGrammar(val, CMessage_grammar())\r\n\trequires ValidVal(val)\r\n\tensures\t msg == parse_Message(val)\r\n\tensures\t !msg.CMessage_Invalid?\r\n\tensures\t CMessageIsAbstractable(msg)\r\n\tensures\t CMessageIs64Bit(msg)\r\n{\r\n\tif val.c == 0 {\r\n\t\tmsg := parse_Message_Request(val.val);\r\n\t} else if val.c == 1 {\r\n\t\tmsg := parse_Message_1a(val.val);\r\n\t} else if val.c == 2 {\r\n\t\tmsg := Parse_Message_1b(val.val);\r\n\t} else if val.c == 3 {\r\n\t\tmsg := Parse_Message_2a(val.val);\r\n\t} else if val.c == 4 {\r\n\t\tmsg := Parse_Message_2b(val.val);\r\n\t} else if val.c == 5 {\r\n\t\tmsg := parse_Message_Heartbeat(val.val);\r\n\t} else if val.c == 6 {\r\n\t\tmsg := parse_Message_Reply(val.val);\r\n\t} else if val.c == 7 {\r\n\t\tmsg := parse_Message_AppStateRequest(val.val);\r\n\t} else if val.c == 8 {\r\n\t\tmsg := parse_Message_AppStateSupply(val.val);\r\n\t} else if val.c == 9 {\r\n\t\tmsg := parse_Message_StartingPhase2(val.val);\r\n\t} else {\r\n\t\tassert false;\t\t\t\t// Should never get here\r\n\t\tmsg := parse_Message_Request(val);\r\n\t}\r\n}\r\n\r\nfunction PaxosDemarshallData(data:seq) : CMessage\r\n ensures CMessageIsAbstractable(PaxosDemarshallData(data))\r\n{\r\n if Demarshallable(data, CMessage_grammar()) then\r\n var val := DemarshallFunc(data, CMessage_grammar());\r\n parse_Message(val)\r\n else\r\n CMessage_Invalid()\r\n}\r\n\r\nmethod PaxosDemarshallDataMethod(data:array, msg_grammar:G) returns (msg:CMessage)\r\n requires data.Length < 0x1_0000_0000_0000_0000\r\n requires msg_grammar == CMessage_grammar()\r\n requires ValidGrammar(msg_grammar)\r\n ensures CMessageIsAbstractable(msg)\r\n ensures if Demarshallable(data[..], msg_grammar) then\r\n msg == PaxosDemarshallData(data[..]) \r\n else\r\n msg.CMessage_Invalid?\r\n ensures CMessageIs64Bit(msg)\r\n{\r\n var success, val := Demarshall(data, msg_grammar);\r\n if success {\r\n assert ValInGrammar(val, msg_grammar);\r\n msg := Parse_Message(val);\r\n assert !msg.CMessage_Invalid?;\r\n } else {\r\n msg := CMessage_Invalid();\r\n }\r\n}\r\n\r\n////////////////////////////////////////////////////////////////////\r\n// Can a value be marshalled?\r\n////////////////////////////////////////////////////////////////////\r\n\r\nfunction Marshallable_2a(msg:CMessage) : bool\r\n{\r\n && msg.CMessage_2a?\r\n && ValidRequestBatch(msg.val_2a)\r\n}\r\n\r\nfunction Marshallable_2b(msg:CMessage) : bool\r\n{\r\n && msg.CMessage_2b?\r\n && ValidRequestBatch(msg.val_2b)\r\n}\r\n\r\nfunction Marshallable(msg:CMessage) : bool\r\n{\r\n && (!msg.CMessage_Invalid?)\r\n && (msg.CMessage_Request? ==> CAppRequestMarshallable(msg.val))\r\n && (msg.CMessage_1a? ==> true)\r\n && (msg.CMessage_1b? ==> ValidVotes(msg.votes))\r\n && (msg.CMessage_2a? ==> Marshallable_2a(msg))\r\n && (msg.CMessage_2b? ==> Marshallable_2b(msg))\r\n && (msg.CMessage_Heartbeat? ==> true)\r\n && (msg.CMessage_Reply? ==> CAppReplyMarshallable(msg.reply))\r\n && (msg.CMessage_AppStateRequest? ==> true)\r\n && (msg.CMessage_AppStateSupply? ==> CAppStateMarshallable(msg.app_state))\r\n && (msg.CMessage_StartingPhase2? ==> true)\r\n}\r\n\r\nfunction CMessageIsValid(msg:CMessage) : bool\r\n{\r\n Marshallable(msg)\r\n}\r\n\r\npredicate CPacketsIsMarshallable(cps:set)\r\n{\r\n forall cp :: cp in cps ==> Marshallable(cp.msg)\r\n}\r\n\r\nmethod DetermineIfValidVote(vote:CVote) returns (b:bool)\r\n requires CVoteIsAbstractable(vote)\r\n requires CVoteIs64Bit(vote)\r\n ensures b == ValidVote(vote)\r\n{\r\n var num_votes:uint64 := |vote.max_val| as uint64;\r\n if num_votes > 100 { // RequestBatchSizeLimit\r\n b := false;\r\n return;\r\n }\r\n\r\n var pos:uint64 := 0;\r\n while pos < num_votes\r\n invariant 0 <= pos <= num_votes\r\n invariant forall i :: 0 <= i < pos ==> ValidRequest(vote.max_val[i])\r\n {\r\n var c := vote.max_val[pos];\r\n if !CAppRequestMarshallable(c.request) || !EndPointIsValidPublicKey(c.client) {\r\n assert !ValidRequest(c);\r\n assert !ValidRequestBatch(vote.max_val);\r\n b := false;\r\n return;\r\n }\r\n pos := pos + 1;\r\n }\r\n\r\n b := true;\r\n}\r\n\r\nmethod DetermineIfValidVotes(votes:CVotes) returns (b:bool)\r\n requires CVotesIsAbstractable(votes)\r\n requires CVotesIs64Bit(votes)\r\n ensures b == ValidVotes(votes)\r\n{\r\n b := (|votes.v| as uint64) < 8; // max_votes_len\r\n if !b {\r\n return;\r\n }\r\n\r\n var keys := domain(votes.v);\r\n lemma_MapSizeIsDomainSize(keys, votes.v);\r\n while |keys| > 0\r\n invariant |keys| < max_votes_len()\r\n invariant forall opn :: opn in keys ==> opn in votes.v\r\n invariant forall opn :: opn in votes.v ==> opn in keys || ValidVote(votes.v[opn])\r\n decreases |keys|\r\n {\r\n var opn :| opn in keys;\r\n keys := keys - {opn};\r\n b := DetermineIfValidVote(votes.v[opn]);\r\n if !b {\r\n return;\r\n }\r\n }\r\n}\r\n\r\nmethod DetermineIfValidRequestBatch(c:CRequestBatch) returns (b:bool)\r\n requires CRequestBatchIsAbstractable(c)\r\n requires CRequestBatchIs64Bit(c)\r\n ensures b == ValidRequestBatch(c)\r\n{\r\n var n := |c| as uint64;\r\n b := n <= 100;\r\n if !b {\r\n return;\r\n }\r\n\r\n var pos: uint64 := 0;\r\n while pos < n\r\n invariant 0 <= pos <= n\r\n invariant forall i :: 0 <= i < pos ==> ValidRequest(c[i])\r\n {\r\n var cr := c[pos];\r\n if !ValidRequest(c[pos]) {\r\n b := false;\r\n return;\r\n }\r\n pos := pos + 1;\r\n }\r\n}\r\n\r\nmethod DetermineIfMessageMarshallable(msg:CMessage) returns (b:bool)\r\n requires CMessageIsAbstractable(msg)\r\n requires CMessageIs64Bit(msg)\r\n ensures b == Marshallable(msg)\r\n{\r\n if msg.CMessage_Invalid? {\r\n b := false;\r\n }\r\n else if msg.CMessage_Request? {\r\n b := CAppRequestMarshallable(msg.val);\r\n }\r\n else if msg.CMessage_1a? {\r\n b := true;\r\n }\r\n else if msg.CMessage_1b? {\r\n b := DetermineIfValidVotes(msg.votes);\r\n }\r\n else if msg.CMessage_2a? {\r\n b := DetermineIfValidRequestBatch(msg.val_2a);\r\n }\r\n else if msg.CMessage_2b? {\r\n b := DetermineIfValidRequestBatch(msg.val_2b);\r\n }\r\n else if msg.CMessage_Heartbeat? {\r\n b := true;\r\n }\r\n else if msg.CMessage_Reply? {\r\n b := CAppReplyMarshallable(msg.reply);\r\n }\r\n else if msg.CMessage_AppStateRequest? {\r\n b := true;\r\n }\r\n else if msg.CMessage_AppStateSupply? {\r\n b := CAppStateMarshallable(msg.app_state);\r\n }\r\n else if msg.CMessage_StartingPhase2? {\r\n b := true;\r\n }\r\n else {\r\n assert false;\r\n }\r\n}\r\n\r\n////////////////////////////////////////////////////////////////////\r\n// Marshalling \r\n////////////////////////////////////////////////////////////////////\r\n\r\nmethod MarshallEndPoint(c:EndPoint) returns (val:V)\r\n requires EndPointIsValidPublicKey(c)\r\n ensures ValInGrammar(val, EndPoint_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_EndPoint(val) == c\r\n{\r\n val := VByteArray(c.public_key);\r\n}\r\n\r\nmethod MarshallRequest(c:CRequest) returns (val:V)\r\n requires ValidRequest(c)\r\n ensures ValInGrammar(val, CRequest_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Request(val) == c\r\n{\r\n var marshalled_app_message := MarshallCAppRequest(c.request);\r\n var marshalled_ep := MarshallEndPoint(c.client);\r\n val := VTuple([marshalled_ep, VUint64(c.seqno), marshalled_app_message]);\r\n\r\n assert ValInGrammar(val.t[0], CRequest_grammar().t[0]); // OBSERVE \r\n assert ValInGrammar(val.t[1], CRequest_grammar().t[1]); // OBSERVE \r\n assert ValInGrammar(val.t[2], CRequest_grammar().t[2]); // OBSERVE \r\n calc {\r\n ValidVal(val);\r\n ValidVal(val.t[0]) && ValidVal(val.t[1]) && ValidVal(val.t[2]);\r\n }\r\n}\r\n\r\nmethod MarshallRequestBatch(c:CRequestBatch) returns (val:V)\r\n requires ValidRequestBatch(c)\r\n ensures ValInGrammar(val, CRequestBatch_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_RequestBatch(val) == c\r\n{\r\n var reqs := new V[|c| as uint64];\r\n\r\n var i:uint64 := 0;\r\n while i < |c| as uint64\r\n invariant 0 <= i as int <= |c|\r\n invariant forall j :: 0 <= j < i ==> ValInGrammar(reqs[j], CRequest_grammar())\r\n invariant forall j :: 0 <= j < i ==> ValidVal(reqs[j])\r\n invariant forall j :: 0 <= j < i ==> parse_Request(reqs[j]) == c[j]\r\n {\r\n var single := MarshallRequest(c[i]);\r\n assert ValInGrammar(single, CRequest_grammar());\r\n reqs[i] := single;\r\n i := i + 1;\r\n }\r\n\r\n val := VArray(reqs[..]);\r\n}\r\n\r\nmethod MarshallReply(c:CReply) returns (val:V)\r\n requires ValidReply(c)\r\n ensures ValInGrammar(val, CReply_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Reply(val) == c\r\n{\r\n var marshalled_app_message := MarshallCAppReply(c.reply);\r\n var marshalled_ep := MarshallEndPoint(c.client);\r\n val := VTuple([marshalled_ep, VUint64(c.seqno), marshalled_app_message]);\r\n assert ValInGrammar(val.t[0], CReply_grammar().t[0]); // OBSERVE \r\n assert ValInGrammar(val.t[1], CReply_grammar().t[1]); // OBSERVE \r\n assert ValInGrammar(val.t[2], CReply_grammar().t[2]); // OBSERVE \r\n calc {\r\n ValidVal(val);\r\n ValidVal(val.t[0]) && ValidVal(val.t[1]) && ValidVal(val.t[2]);\r\n }\r\n}\r\n\r\nmethod MarshallBallot(c:CBallot) returns (val:V)\r\n ensures ValInGrammar(val, CBallot_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Ballot(val) == c\r\n{\r\n val := VTuple([VUint64(c.seqno), VUint64(c.proposer_id)]);\r\n}\r\n\r\nmethod MarshallOperationNumber(c:COperationNumber) returns (val:V)\r\n ensures ValInGrammar(val, COperationNumber_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_OperationNumber(val) == c\r\n{\r\n val := VUint64(c.n);\r\n}\r\n\r\nmethod MarshallVote(c:CVote) returns (val:V)\r\n requires ValidVote(c)\r\n ensures ValInGrammar(val, CVote_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Vote(val) == c\r\n{\r\n var bal := MarshallBallot(c.max_value_bal);\r\n var v := MarshallRequestBatch(c.max_val);\r\n val := VTuple([bal, v]);\r\n}\r\n\r\nmethod{:timeLimitMultiplier 3} MarshallVotes(c:CVotes) returns (val:V)\r\n requires ValidVotes(c)\r\n decreases |c.v|\r\n ensures ValInGrammar(val, CVotes_grammar())\r\n ensures |val.a| == |c.v|\r\n ensures ValidVal(val)\r\n ensures parse_Votes(val) == c\r\n //ensures val == fun_MarshallVotes(c)\r\n ensures SeqSum(val.a) <= |c.v| * (8 + (8 + 8) + (8 + (0x10_0018 + MaxAppRequestSize())*RequestBatchSizeLimit()))\r\n{\r\n if |c.v| == 0 {\r\n val := VArray([]);\r\n reveal SeqSum();\r\n } else {\r\n lemma_non_empty_map_has_elements(c.v);\r\n var op :| op in c.v;\r\n var marshalled_op := MarshallOperationNumber(op);\r\n var marshalled_vote := MarshallVote(c.v[op]);\r\n var remainder := RemoveElt(c.v, op);\r\n var marshalled_remainder := MarshallVotes(CVotes(remainder));\r\n assert parse_Votes(marshalled_remainder) == CVotes(remainder);\r\n val := VArray([VTuple([marshalled_op, marshalled_vote])] + marshalled_remainder.a);\r\n\r\n // OBSERVE (everything below; not sure which bit is critical to proving the final ensures\r\n ghost var tuple := val.a[0];\r\n ghost var rest := val.a[1..];\r\n assert ValInGrammar(tuple, CVotes_grammar().elt);\r\n assert ValInGrammar(tuple.t[0], CVotes_grammar().elt.t[0]); \r\n assert ValInGrammar(tuple.t[1], CVotes_grammar().elt.t[1]);\r\n ghost var op' := parse_OperationNumber(tuple.t[0]);\r\n ghost var vote' := parse_Vote(tuple.t[1]);\r\n ghost var others' := parse_Votes(VArray(val.a[1..]));\r\n ghost var m' := others'.v[op' := vote'];\r\n assert op' == op;\r\n assert vote' == c.v[op];\r\n assert others' == CVotes(remainder);\r\n assert m' == c.v;\r\n\r\n // Prove the SeqSum ensure\r\n calc {\r\n SeqSum(val.a);\r\n { reveal SeqSum(); }\r\n SizeOfV(val.a[0]) + SeqSum(val.a[1..]);\r\n <= \r\n SizeOfV(val.a[0]) + |remainder| * (8 + (8 + 8) + (8 + ((0x10_0018 + MaxAppRequestSize())*RequestBatchSizeLimit())));\r\n //SizeOfV(val.a[0]) + |remainder| * (8 + (8 + 8) + (0x10_0018 + MaxAppRequestSize()));\r\n { lemma_SeqSum2(val.a[0]); }\r\n SizeOfV(val.a[0].t[0]) + SizeOfV(val.a[0].t[1]) + |remainder| * (8 + (8 + 8) + (8 + ((0x10_0018 + MaxAppRequestSize())*RequestBatchSizeLimit())));\r\n <= { lemma_VoteValValid(c.v[op], val.a[0].t[1]); lemma_VoteBound(c.v[op], val.a[0].t[1]); }\r\n 8 + (8 + 8) + 8 + ((0x10_0018 + MaxAppRequestSize())*|val.a[0].t[1].t[1].a|) + |remainder| * (8 + (8 + 8) + (8 + ((0x10_0018 + MaxAppRequestSize())*RequestBatchSizeLimit())));\r\n <= { assert |val.a[0].t[1].t[1].a| <= RequestBatchSizeLimit(); lemma_mul_upper_bound(0x10_0018 + MaxAppRequestSize(), 0x10_0018 + MaxAppRequestSize(), |val.a[0].t[1].t[1].a|, RequestBatchSizeLimit());}\r\n 8 + (8 + 8) + 8 + ((0x10_0018 + MaxAppRequestSize())*RequestBatchSizeLimit()) + |remainder| * (8 + (8 + 8) + (8 + ((0x10_0018 + MaxAppRequestSize())*RequestBatchSizeLimit())));\r\n 1*(8 + (8 + 8) + (8 + ((0x10_0018 + MaxAppRequestSize())*RequestBatchSizeLimit()))) + |remainder| * (8 + (8 + 8) + (8 + ((0x10_0018 + MaxAppRequestSize())*RequestBatchSizeLimit())));\r\n { lemma_mul_is_distributive((8 + (8 + 8) + (8 + ((0x10_0018 + MaxAppRequestSize())*RequestBatchSizeLimit()))), 1, |remainder|); }\r\n (1+|remainder|) * (8 + (8 + 8) + (8 + ((0x10_0018 + MaxAppRequestSize())*RequestBatchSizeLimit())));\r\n |c.v| * (8 + (8 + 8) + (8 + ((0x10_0018 + MaxAppRequestSize())*RequestBatchSizeLimit())));\r\n }\r\n }\r\n}\r\n\r\nmethod MarshallMessage_Request(c:CMessage) returns (val:V)\r\n requires c.CMessage_Request?\r\n requires Marshallable(c)\r\n ensures ValInGrammar(val, CMessage_Request_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Message_Request(val) == c\r\n{\r\n var v := MarshallCAppRequest(c.val);\r\n val := VTuple([VUint64(c.seqno), v]);\r\n}\r\n\r\nmethod MarshallMessage_1a(c:CMessage) returns (val:V)\r\n requires c.CMessage_1a?\r\n requires Marshallable(c)\r\n ensures ValInGrammar(val, CMessage_1a_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Message_1a(val) == c\r\n{\r\n val := MarshallBallot(c.bal_1a);\r\n}\r\n\r\nmethod MarshallMessage_1b(c:CMessage) returns (val:V)\r\n requires c.CMessage_1b?\r\n requires Marshallable(c)\r\n ensures ValInGrammar(val, CMessage_1b_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Message_1b(val) == c\r\n ensures 0 <= SizeOfV(val) < MaxPacketSize() - 8\r\n{\r\n var bal := MarshallBallot(c.bal_1b);\r\n var log_truncation_point := MarshallOperationNumber(c.log_truncation_point);\r\n var votes := MarshallVotes(c.votes);\r\n val := VTuple([bal, log_truncation_point, votes]);\r\n // Prove the bound on SizeOfV(val)\r\n lemma_SeqSum3(val);\r\n assert ValInGrammar(val.t[0], CBallot_grammar()); // OBSERVE\r\n lemma_BallotBound(c.bal_1b, val.t[0]);\r\n assert ValInGrammar(val.t[1], COperationNumber_grammar()); // OBSERVE\r\n assert ValInGrammar(val.t[2], CVotes_grammar()); // OBSERVE\r\n calc {\r\n SizeOfV(val);\r\n 16 + 8 + SizeOfV(val.t[2]);\r\n <= \r\n 16 + 8 + 8 + (|c.votes.v| * (8 + (8 + 8) + (8 + (0x10_0018 + MaxAppRequestSize())*RequestBatchSizeLimit())));\r\n 32 + (|c.votes.v| * (32 + (0x10_0018 + MaxAppRequestSize()) * 100));\r\n < { lemma_mul_strict_inequality(|c.votes.v|, 8, (32 + (0x10_0018 + MaxAppRequestSize()) * 100)); }\r\n 32 + (8 * (32 + (0x10_0018 + MaxAppRequestSize()) * 100));\r\n <\r\n MaxPacketSize() - 8;\r\n }\r\n}\r\n\r\nmethod MarshallMessage_2a(c:CMessage) returns (val:V)\r\n requires c.CMessage_2a?\r\n requires Marshallable_2a(c)\r\n ensures ValInGrammar(val, CMessage_2a_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Message_2a(val) == c\r\n{\r\n var bal := MarshallBallot(c.bal_2a);\r\n var op := MarshallOperationNumber(c.opn_2a);\r\n var v := MarshallRequestBatch(c.val_2a);\r\n val := VTuple([bal, op, v]);\r\n assert forall u :: u in val.t ==> ValidVal(u); // OBSERVE\r\n assert ValInGrammar(bal, CMessage_2a_grammar().t[0]); // OBSERVE\r\n assert ValInGrammar(op, CMessage_2a_grammar().t[1]); // OBSERVE\r\n assert ValInGrammar(v, CMessage_2a_grammar().t[2]); // OBSERVE\r\n assert ValInGrammar(val, CMessage_2a_grammar()); // OBSERVE\r\n assert ValidVal(val);\r\n}\r\n\r\nmethod MarshallMessage_2b(c:CMessage) returns (val:V)\r\n requires c.CMessage_2b?\r\n requires Marshallable_2b(c)\r\n ensures ValInGrammar(val, CMessage_2b_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Message_2b(val) == c\r\n{\r\n var bal := MarshallBallot(c.bal_2b);\r\n var op := MarshallOperationNumber(c.opn_2b);\r\n var v := MarshallRequestBatch(c.val_2b);\r\n val := VTuple([bal, op, v]);\r\n assert ValInGrammar(bal, CBallot_grammar()); // OBSERVE\r\n assert ValInGrammar(op, COperationNumber_grammar()); // OBSERVE\r\n assert ValInGrammar(v, CRequestBatch_grammar()); // OBSERVE\r\n assert ValInGrammar(val, CMessage_2b_grammar()); // OBSERVE\r\n}\r\n\r\nmethod MarshallMessage_Heartbeat(c:CMessage) returns (val:V)\r\n requires c.CMessage_Heartbeat?\r\n requires Marshallable(c)\r\n ensures ValInGrammar(val, CMessage_Heartbeat_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Message_Heartbeat(val) == c\r\n{\r\n var ballot := MarshallBallot(c.bal_heartbeat);\r\n var op := MarshallOperationNumber(c.opn_ckpt);\r\n val := VTuple([ballot, VUint64(if c.suspicious then 1 else 0), op]);\r\n}\r\n\r\nmethod MarshallMessage_Reply(c:CMessage) returns (val:V)\r\n requires c.CMessage_Reply?\r\n requires Marshallable(c)\r\n ensures ValInGrammar(val, CMessage_Reply_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Message_Reply(val) == c\r\n{\r\n var app_val := MarshallCAppReply(c.reply);\r\n val := VTuple([VUint64(c.seqno_reply), app_val]);\r\n}\r\n\r\nmethod MarshallMessage_AppStateRequest(c:CMessage) returns (val:V)\r\n requires c.CMessage_AppStateRequest?\r\n requires Marshallable(c)\r\n ensures ValInGrammar(val, CMessage_AppStateRequest_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Message_AppStateRequest(val) == c\r\n{\r\n var ballot := MarshallBallot(c.bal_state_req);\r\n var opn := MarshallOperationNumber(c.opn_state_req);\r\n val := VTuple([ballot, opn]);\r\n}\r\n\r\nmethod MarshallMessage_AppStateSupply(c:CMessage) returns (val:V)\r\n requires c.CMessage_AppStateSupply?\r\n requires Marshallable(c)\r\n ensures ValInGrammar(val, CMessage_AppStateSupply_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Message_AppStateSupply(val) == c\r\n ensures 0 <= SizeOfV(val) < MaxPacketSize() - 8\r\n{\r\n var ballot := MarshallBallot(c.bal_state_supply);\r\n var opn_state_supply := MarshallOperationNumber(c.opn_state_supply);\r\n var app_state := MarshallCAppState(c.app_state);\r\n val := VTuple([ballot, opn_state_supply, app_state]);\r\n\r\n // Prove the bound on SizeOfV(val)\r\n lemma_SeqSum3(val);\r\n assert ValInGrammar(val.t[0], CBallot_grammar()); // OBSERVE\r\n lemma_BallotBound(c.bal_state_supply, val.t[0]);\r\n assert ValInGrammar(val.t[1], COperationNumber_grammar()); // OBSERVE\r\n assert ValInGrammar(val.t[2], GByteArray); // OBSERVE\r\n calc {\r\n SizeOfV(val);\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SizeOfV(val.t[2]);\r\n <=\r\n 16 + 16 + MaxAppStateSize();\r\n <\r\n MaxPacketSize() - 8;\r\n }\r\n}\r\n\r\nmethod MarshallMessage_StartingPhase2(c:CMessage) returns (val:V)\r\n requires c.CMessage_StartingPhase2?\r\n requires Marshallable(c)\r\n ensures ValInGrammar(val, CMessage_StartingPhase2_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Message_StartingPhase2(val) == c\r\n{\r\n var bal := MarshallBallot(c.bal_2);\r\n var op := MarshallOperationNumber(c.logTruncationPoint_2);\r\n val := VTuple([bal, op]);\r\n}\r\n\r\nmethod {:timeLimitMultiplier 2} MarshallMessage(c:CMessage) returns (val:V)\r\n requires Marshallable(c)\r\n ensures ValInGrammar(val, CMessage_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_Message(val) == c\r\n ensures c.CMessage_1b? ==> 0 <= SizeOfV(val) < MaxPacketSize()\r\n ensures c.CMessage_AppStateSupply? ==> 0 <= SizeOfV(val) < MaxPacketSize()\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n assert !c.CMessage_Invalid?;\r\n if c.CMessage_Request? {\r\n var msg := MarshallMessage_Request(c); \r\n val := VCase(0, msg); \r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"MarshallMessage_Request\", start_time, end_time);\r\n } else if c.CMessage_1a? {\r\n var msg := MarshallMessage_1a(c); \r\n val := VCase(1, msg); \r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"MarshallMessage_1a\", start_time, end_time);\r\n } else if c.CMessage_1b? {\r\n var msg := MarshallMessage_1b(c); \r\n val := VCase(2, msg); \r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"MarshallMessage_1b\", start_time, end_time);\r\n } else if c.CMessage_2a? {\r\n var msg := MarshallMessage_2a(c); \r\n val := VCase(3, msg); \r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"MarshallMessage_2a\", start_time, end_time);\r\n } else if c.CMessage_2b? {\r\n var msg := MarshallMessage_2b(c); \r\n val := VCase(4, msg); \r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"MarshallMessage_2b\", start_time, end_time);\r\n } else if c.CMessage_Heartbeat? {\r\n var msg := MarshallMessage_Heartbeat(c); \r\n val := VCase(5, msg); \r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"MarshallMessage_Heartbeat\", start_time, end_time);\r\n } else if c.CMessage_Reply? {\r\n var msg := MarshallMessage_Reply(c);\r\n val := VCase(6, msg); \r\n assert CMessage_grammar().cases[6] == CMessage_Reply_grammar();\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"MarshallMessage_Reply\", start_time, end_time);\r\n } else if c.CMessage_AppStateRequest? {\r\n var msg := MarshallMessage_AppStateRequest(c); \r\n val := VCase(7, msg); \r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"MarshallMessage_AppStateRequest\", start_time, end_time);\r\n } else if c.CMessage_AppStateSupply? {\r\n var msg := MarshallMessage_AppStateSupply(c); \r\n val := VCase(8, msg); \r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"MarshallMessage_AppStateSupply\", start_time, end_time);\r\n } else if c.CMessage_StartingPhase2? {\r\n var msg := MarshallMessage_StartingPhase2(c); \r\n val := VCase(9, msg); \r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"MarshallMessage_StartingPhase2\", start_time, end_time);\r\n }\r\n\r\n // The following should work just as well as above, but it doesn't. Not sure why. \r\n// var msg:V;\r\n// match c \r\n// case CMessage_Request(_,_) => msg := MarshallMessage_Request(c);\r\n// case CMessage_1a(_) => msg := MarshallMessage_1a(c); assert ValInGrammar(msg, CMessage_1a_grammar());\r\n// case CMessage_1b(_,_) => msg := MarshallMessage_1b(c);\r\n// case CMessage_2a(_,_,_) => msg := MarshallMessage_2a(c);\r\n// case CMessage_2b(_,_,_) => msg := MarshallMessage_2b(c);\r\n// case CMessage_Decision(_,_)=> msg := MarshallMessage_Decision(c);\r\n// \r\n// assert CMessage_grammar().cases[1] == CMessage_1a_grammar();\r\n//\r\n// match c \r\n// case CMessage_Request(_,_) => val := VCase(0, msg); \r\n// case CMessage_1a(_) => val := VCase(1, msg); \r\n// case CMessage_1b(_,_) => val := VCase(2, msg); \r\n// case CMessage_2a(_,_,_) => val := VCase(3, msg); \r\n// case CMessage_2b(_,_,_) => val := VCase(4, msg); \r\n// case CMessage_Decision(_,_)=> val := VCase(5, msg); \r\n// }\r\n}\r\n\r\nlemma lemma_SeqSum2(val:V)\r\n requires val.VTuple?\r\n requires |val.t| == 2\r\n ensures SizeOfV(val) == SizeOfV(val.t[0]) + SizeOfV(val.t[1])\r\n{\r\n calc {\r\n SeqSum(val.t);\r\n { reveal SeqSum(); }\r\n SizeOfV(val.t[0]) + SeqSum(val.t[1..]);\r\n { reveal SeqSum(); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SeqSum(val.t[2..]);\r\n { assert val.t[2..] == []; } // OBSERVE\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SeqSum([]);\r\n { reveal SeqSum(); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]);\r\n }\r\n}\r\n\r\nlemma lemma_SeqSum3(val:V)\r\n requires val.VTuple?\r\n requires |val.t| == 3\r\n ensures SizeOfV(val) == SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SizeOfV(val.t[2])\r\n{\r\n calc {\r\n SeqSum(val.t);\r\n { reveal SeqSum(); }\r\n SizeOfV(val.t[0]) + SeqSum(val.t[1..]);\r\n { reveal SeqSum(); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SeqSum(val.t[2..]);\r\n { reveal SeqSum(); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SizeOfV(val.t[2]) + SeqSum(val.t[3..]);\r\n { assert val.t[3..] == []; } // OBSERVE\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SizeOfV(val.t[2]) + SeqSum([]);\r\n { reveal SeqSum(); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SizeOfV(val.t[2]);\r\n }\r\n}\r\n\r\nlemma lemma_SeqSum4(val:V)\r\n requires val.VTuple?\r\n requires |val.t| == 4\r\n ensures SizeOfV(val) == SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SizeOfV(val.t[2]) + SizeOfV(val.t[3])\r\n{\r\n calc {\r\n SeqSum(val.t);\r\n { reveal SeqSum(); }\r\n SizeOfV(val.t[0]) + SeqSum(val.t[1..]);\r\n { reveal SeqSum(); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SeqSum(val.t[2..]);\r\n { reveal SeqSum(); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SizeOfV(val.t[2]) + SeqSum(val.t[3..]);\r\n { reveal SeqSum(); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SizeOfV(val.t[2]) + SizeOfV(val.t[3]) + SeqSum(val.t[4..]);\r\n { assert val.t[4..] == []; } // OBSERVE\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SizeOfV(val.t[2]) + SizeOfV(val.t[3]) + SeqSum([]);\r\n { reveal SeqSum(); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SizeOfV(val.t[2]) + SizeOfV(val.t[3]);\r\n }\r\n}\r\n\r\nlemma lemma_BallotBound(c:CBallot, val:V)\r\n requires ValInGrammar(val, CBallot_grammar())\r\n requires ValidVal(val)\r\n requires parse_Ballot(val) == c\r\n ensures SizeOfV(val) == 16\r\n{\r\n assert |val.t| == |CBallot_grammar().t| == 2;\r\n assert ValInGrammar(val.t[0], GUint64);\r\n assert ValInGrammar(val.t[1], GUint64);\r\n lemma_SeqSum2(val);\r\n assert SeqSum(val.t) == 16;\r\n}\r\n\r\nlemma lemma_CRequestBound(c:CRequest, val:V)\r\n requires ValInGrammar(val, CRequest_grammar())\r\n requires ValidRequest(c)\r\n requires parse_Request(val) == c\r\n ensures SizeOfV(val) <= 0x10_0018 + MaxAppRequestSize()\r\n{\r\n ghost var gtuple := GTuple([EndPoint_grammar(), GUint64, GByteArray]);\r\n assert ValInGrammar(val, gtuple);\r\n\r\n lemma_SeqSum3(val);\r\n assert ValInGrammar(val.t[0], gtuple.t[0]);\r\n assert ValInGrammar(val.t[1], gtuple.t[1]);\r\n assert SizeOfV(val.t[0]) <= 0x10_0008;\r\n assert SizeOfV(val.t[1]) == 8;\r\n assert SizeOfV(val.t[2]) <= 8 + MaxAppRequestSize();\r\n}\r\n\r\nlemma lemma_CRequestBatchBound(c:CRequestBatch, val:V)\r\n requires ValInGrammar(val, CRequestBatch_grammar())\r\n requires ValidRequestBatch(c)\r\n requires parse_RequestBatch(val) == c\r\n decreases |c|\r\n ensures SeqSum(val.a) <= (0x10_0018 + MaxAppRequestSize())*|val.a|\r\n{\r\n //ghost var gtuple := GTuple([EndPoint_grammar(), GUint64, GByteArray]);\r\n ghost var garray := GArray(CRequest_grammar());\r\n assert ValInGrammar(val, garray);\r\n reveal SeqSum();\r\n if |val.a| == 0 {\r\n assert SeqSum(val.a) <= (0x10_0018 + MaxAppRequestSize())*|val.a|;\r\n } else {\r\n var req := parse_Request(val.a[0]);\r\n var restVal:V := VArray(val.a[1..]);\r\n var rest := parse_RequestBatch(restVal);\r\n assert c == [req] + rest;\r\n var x := 0x10_0018 + MaxAppRequestSize();\r\n var N := |val.a|;\r\n lemma_CRequestBatchBound(rest, restVal);\r\n assert SeqSum(val.a[1..]) <= (x)*(N-1);\r\n lemma_CRequestBound(req, val.a[0]);\r\n assert SizeOfV(val.a[0]) <= x;\r\n assert SeqSum(val.a) == SizeOfV(val.a[0]) + SeqSum(val.a[1..]);\r\n assert |val.a| == |val.a[1..]| + 1;\r\n lemma_mul_is_distributive(x, N-1, 1);\r\n assert SeqSum(val.a) <= (x)*N;\r\n }\r\n}\r\n\r\nlemma lemma_ReplyBound(c:CReply, val:V)\r\n requires ValInGrammar(val, CReply_grammar())\r\n requires ValidReply(c)\r\n requires parse_Reply(val) == c\r\n ensures SizeOfV(val) <= 0x10_0018 + MaxAppRequestSize()\r\n{\r\n ghost var gtuple := GTuple([EndPoint_grammar(), GUint64, GByteArray]);\r\n assert ValInGrammar(val, gtuple);\r\n lemma_SeqSum3(val);\r\n assert ValInGrammar(val.t[0], gtuple.t[0]);\r\n assert ValInGrammar(val.t[1], gtuple.t[1]);\r\n assert SizeOfV(val.t[0]) <= 0x10_0008;\r\n assert SizeOfV(val.t[1]) == 8;\r\n assert SizeOfV(val.t[2]) <= 8 + MaxAppRequestSize();\r\n}\r\n\r\nlemma lemma_ReplyValValid(c:CReply, val:V)\r\n requires ValInGrammar(val, CReply_grammar())\r\n requires ValidReply(c)\r\n requires parse_Reply(val) == c\r\n ensures ValidVal(val)\r\n{\r\n lemma_SeqSum3(val);\r\n assert ValInGrammar(val.t[0], EndPoint_grammar()); // OBSERVE\r\n assert ValInGrammar(val.t[1], GUint64); // OBSERVE\r\n assert ValInGrammar(val.t[2], GByteArray); // OBSERVE\r\n\r\n // Lots of OBSERVE below\r\n ghost var gtuple := GTuple([EndPoint_grammar(), GUint64, GByteArray]);\r\n assert ValInGrammar(val, gtuple); \r\n assert ValInGrammar(val.t[0], gtuple.t[0]);\r\n assert ValInGrammar(val.t[1], gtuple.t[1]);\r\n assert ValInGrammar(val.t[2], gtuple.t[2]);\r\n assert ValidVal(val.t[0]);\r\n assert ValidVal(val.t[1]);\r\n assert ValidVal(val.t[2]);\r\n}\r\n\r\n\r\nlemma {:timeLimitMultiplier 2} lemma_VoteValValid(c:CVote, val:V)\r\n requires ValInGrammar(val, CVote_grammar())\r\n requires ValidVote(c)\r\n requires parse_Vote(val) == c\r\n ensures ValidVal(val)\r\n{\r\n lemma_SeqSum2(val);\r\n assert ValInGrammar(val.t[0], CBallot_grammar()); // OBSERVE\r\n assert ValInGrammar(val.t[1], CRequestBatch_grammar()); // OBSERVE\r\n lemma_BallotBound(c.max_value_bal, val.t[0]);\r\n lemma_CRequestBatchBound(c.max_val, val.t[1]);\r\n\r\n ghost var garray := GArray(CRequest_grammar());\r\n assert ValInGrammar(val.t[1], garray);\r\n ghost var gtuple := GTuple([EndPoint_grammar(), GUint64, GByteArray]);\r\n forall i, v | 0 <= i < |val.t[1].a| && v == val.t[1].a[i]\r\n ensures ValidVal(v)\r\n {\r\n assert c.max_val[i] in c.max_val; // OBSERVE antecedent to determine that ValidRequest(c.max_val[i])\r\n assert ValidRequest(c.max_val[i]);\r\n assert ValInGrammar(v, gtuple);\r\n assert ValInGrammar(v.t[0], gtuple.t[0]);\r\n assert ValInGrammar(v.t[1], gtuple.t[1]);\r\n assert ValInGrammar(v.t[2], gtuple.t[2]);\r\n assert |v.t[0].b| < 0x1_0000_0000_0000_0000;\r\n assert ValidVal(v.t[0]);\r\n assert ValidVal(v.t[1]);\r\n assert ValidVal(v.t[2]);\r\n assert ValidVal(v);\r\n }\r\n assert |val.t[1].a| == |c.max_val|;\r\n assert ValidVote(c);\r\n assert ValidRequestBatch(c.max_val);\r\n assert |c.max_val| < 0x1_0000_0000;\r\n assert |val.t[1].a| < 0x1_0000_0000_0000_0000;\r\n assert forall v :: v in val.t[1].a ==> ValidVal(v);\r\n\r\n calc ==> {\r\n true;\r\n ValidVal(val.t[0]); \r\n ValidVal(val.t[0]) && ValidVal(val.t[1]);\r\n ValidVal(val);\r\n }\r\n}\r\n\r\nlemma lemma_VoteBound(c:CVote, val:V)\r\n requires ValInGrammar(val, CVote_grammar())\r\n requires ValInGrammar(val.t[1], CRequestBatch_grammar())\r\n requires ValidVal(val)\r\n requires ValidVote(c)\r\n requires parse_Vote(val) == c\r\n ensures SizeOfV(val) <= (8 + 8) + 8 + ((0x10_0018 + MaxAppRequestSize())*|val.t[1].a|)\r\n{\r\n lemma_SeqSum2(val);\r\n assert ValInGrammar(val.t[0], CBallot_grammar()); // OBSERVE\r\n assert ValInGrammar(val.t[1], CRequestBatch_grammar()); // OBSERVE\r\n\r\n lemma_BallotBound(c.max_value_bal, val.t[0]);\r\n lemma_CRequestBatchBound(c.max_val, val.t[1]);\r\n}\r\n\r\nlemma lemma_MarshallableBound(c:CMessage, val:V)\r\n requires Marshallable(c)\r\n requires ValInGrammar(val, CMessage_grammar())\r\n requires ValidVal(val)\r\n requires parse_Message(val) == c\r\n ensures !c.CMessage_1b? && !c.CMessage_AppStateSupply? ==> 0 <= SizeOfV(val) < MaxPacketSize()\r\n{\r\n assert !c.CMessage_Invalid?;\r\n if c.CMessage_Request? {\r\n lemma_SeqSum2(val.val);\r\n assert ValInGrammar(val.val.t[0], GUint64); // OBSERVE\r\n assert ValInGrammar(val.val.t[1], GByteArray); // OBSERVE\r\n } else if c.CMessage_1a? {\r\n assert ValInGrammar(val.val, CMessage_1a_grammar()); // OBSERVE\r\n assert ValInGrammar(val.val, CBallot_grammar()); // OBSERVE\r\n lemma_BallotBound(c.bal_1a, val.val);\r\n assert SizeOfV(val) == 24;\r\n/* We prove this case during marshalling\r\n } else if c.CMessage_1b? {\r\n*/\r\n } else if c.CMessage_2a? {\r\n lemma_SeqSum3(val.val);\r\n lemma_BallotBound(c.bal_2a, val.val.t[0]);\r\n assert SizeOfV(val.val.t[0]) == 16;\r\n assert ValInGrammar(val.val.t[1], GUint64); // OBSERVE\r\n assert SizeOfV(val.val.t[1]) == 8;\r\n assert ValInGrammar(val.val.t[2], CRequestBatch_grammar()); // OBSERVE\r\n //assert SizeOfV(val.val.t[2]) == 8 + |val.val.t[2].b| == 8 + |c.val_2a.v|;\r\n lemma_CRequestBatchBound(c.val_2a, val.val.t[2]);\r\n assert |val.val.t[2].a| == |c.val_2a|;\r\n assert |c.val_2a| <= RequestBatchSizeLimit();\r\n \r\n calc {\r\n SizeOfV(val.val.t[2]);\r\n 8 + SeqSum(val.val.t[2].a);\r\n <=\r\n 8 + (0x10_0018 + MaxAppRequestSize())*|val.val.t[2].a|;\r\n <= { lemma_mul_is_commutative(|val.val.t[2].a|, RequestBatchSizeLimit());\r\n lemma_mul_is_commutative(|val.val.t[2].a|, 0x10_0018 + MaxAppRequestSize());\r\n lemma_mul_inequality(|val.val.t[2].a|, RequestBatchSizeLimit(), 0x10_0018 + MaxAppRequestSize());\r\n }\r\n 8 + (0x10_0018 + MaxAppRequestSize())*RequestBatchSizeLimit();\r\n }\r\n } else if c.CMessage_2b? {\r\n lemma_SeqSum3(val.val);\r\n lemma_BallotBound(c.bal_2b, val.val.t[0]);\r\n assert SizeOfV(val.val.t[0]) == 16;\r\n assert ValInGrammar(val.val.t[1], GUint64); // OBSERVE\r\n assert SizeOfV(val.val.t[1]) == 8;\r\n assert ValInGrammar(val.val.t[2], CRequestBatch_grammar()); // OBSERVE\r\n //assert SizeOfV(val.val.t[2]) == 8 + |val.val.t[2].b| == 8 + |c.val_2b.v|;\r\n lemma_CRequestBatchBound(c.val_2b, val.val.t[2]);\r\n calc {\r\n SizeOfV(val.val.t[2]);\r\n 8 + SeqSum(val.val.t[2].a);\r\n <=\r\n 8 + (0x10_0018 + MaxAppRequestSize())*|val.val.t[2].a|;\r\n <= { lemma_mul_is_commutative(|val.val.t[2].a|, RequestBatchSizeLimit());\r\n lemma_mul_is_commutative(|val.val.t[2].a|, 0x10_0018 + MaxAppRequestSize());\r\n lemma_mul_inequality(|val.val.t[2].a|, RequestBatchSizeLimit(), 0x10_0018 + MaxAppRequestSize());\r\n }\r\n 8 + (0x10_0018 + MaxAppRequestSize())*RequestBatchSizeLimit();\r\n }\r\n } else if c.CMessage_Heartbeat? {\r\n lemma_SeqSum3(val.val);\r\n assert ValInGrammar(val.val.t[0], CBallot_grammar()); // OBSERVE\r\n assert ValInGrammar(val.val.t[1], GUint64); // OBSERVE\r\n assert ValInGrammar(val.val.t[2], COperationNumber_grammar()); // OBSERVE\r\n lemma_BallotBound(c.bal_heartbeat, val.val.t[0]);\r\n } else if c.CMessage_Reply? {\r\n lemma_SeqSum2(val.val);\r\n assert ValInGrammar(val.val.t[0], GUint64); // OBSERVE\r\n assert ValInGrammar(val.val.t[1], GByteArray); // OBSERVE\r\n } else if c.CMessage_AppStateRequest? {\r\n lemma_SeqSum2(val.val);\r\n assert ValInGrammar(val.val.t[0], CBallot_grammar()); // OBSERVE\r\n assert ValInGrammar(val.val.t[1], COperationNumber_grammar()); // OBSERVE\r\n lemma_BallotBound(c.bal_state_req, val.val.t[0]);\r\n assert 0 <= SizeOfV(val) < MaxPacketSize();\r\n // assert SizeOfV(val.val.t[0]) == 8;\r\n/* We prove this case during marshalling\r\n } else if c.CMessage_AppStateSupply? {\r\n*/\r\n } else if c.CMessage_StartingPhase2? {\r\n lemma_SeqSum2(val.val);\r\n assert ValInGrammar(val.val.t[0], CBallot_grammar()); // OBSERVE\r\n assert ValInGrammar(val.val.t[1], COperationNumber_grammar()); // OBSERVE\r\n lemma_BallotBound(c.bal_2, val.val.t[0]);\r\n }\r\n}\r\n\r\n////////////////////////////////////////////////////////////////////////\r\n// These functions need to be here, rather than CMessageRefinements.i.dfy,\r\n// since they depend on PaxosDemarshallData\r\n////////////////////////////////////////////////////////////////////////\r\nfunction AbstractifyBufferToRslPacket(src:EndPoint, dst:EndPoint, data:seq) : RslPacket\r\n requires EndPointIsValidPublicKey(src)\r\n requires EndPointIsValidPublicKey(dst)\r\n{\r\n LPacket(AbstractifyEndPointToNodeIdentity(dst),\r\n AbstractifyEndPointToNodeIdentity(src),\r\n AbstractifyCMessageToRslMessage(PaxosDemarshallData(data)))\r\n}\r\n\r\npredicate BufferRefinementAgreesWithMessageRefinement(msg:CMessage, marshalled:seq)\r\n requires CMessageIsAbstractable(msg)\r\n requires CMessageIsAbstractable(msg)\r\n{\r\n forall src, dst :: (EndPointIsValidPublicKey(src) && EndPointIsValidPublicKey(dst)) ==>\r\n\r\n (AbstractifyBufferToRslPacket(src, dst, marshalled)\r\n == LPacket(AbstractifyEndPointToNodeIdentity(dst), AbstractifyEndPointToNodeIdentity(src), AbstractifyCMessageToRslMessage(msg)))\r\n}\r\n\r\nfunction AbstractifyNetPacketToRslPacket(net:NetPacket) : RslPacket\r\n requires NetPacketIsAbstractable(net)\r\n{\r\n AbstractifyBufferToRslPacket(net.src, net.dst, net.msg)\r\n}\r\n\r\npredicate NetPacketIsAbstractable(net:NetPacket)\r\n{\r\n && EndPointIsValidPublicKey(net.src)\r\n && EndPointIsValidPublicKey(net.dst)\r\n}\r\n\r\npredicate NetPacketsIsAbstractable(netps:set)\r\n{\r\n forall p :: p in netps ==> NetPacketIsAbstractable(p)\r\n}\r\n\r\nlemma lemma_CMessageGrammarValid()\r\n ensures ValidGrammar(CMessage_grammar())\r\n{\r\n var g := CMessage_grammar();\r\n assert |g.cases| < 0x1_0000_0000_0000_0000;\r\n assert ValidGrammar(CMessage_Request_grammar());\r\n assert ValidGrammar(CMessage_1a_grammar());\r\n assert ValidGrammar(CMessage_1b_grammar());\r\n assert ValidGrammar(CMessage_2a_grammar());\r\n assert ValidGrammar(CMessage_2b_grammar());\r\n assert ValidGrammar(CMessage_Heartbeat_grammar());\r\n assert ValidGrammar(CMessage_Reply_grammar());\r\n assert ValidGrammar(CMessage_AppStateRequest_grammar());\r\n assert ValidGrammar(CMessage_AppStateSupply_grammar());\r\n assert ValidGrammar(CMessage_StartingPhase2_grammar());\r\n}\r\n\r\nmethod PaxosMarshall(msg:CMessage) returns (data:array)\r\n requires CMessageIsAbstractable(msg)\r\n requires Marshallable(msg)\r\n ensures fresh(data)\r\n ensures NetPacketBound(data[..])\r\n ensures Marshallable(PaxosDemarshallData(data[..]))\r\n ensures BufferRefinementAgreesWithMessageRefinement(msg, data[..])\r\n{\r\n var marshall_start_time := Time.GetDebugTimeTicks();\r\n var val := MarshallMessage(msg);\r\n var marshall_end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"PaxosMarshall_MarshallMessage\", marshall_start_time, marshall_end_time);\r\n lemma_MarshallableBound(msg, val);\r\n lemma_CMessageGrammarValid();\r\n var generic_marshall_start_time := Time.GetDebugTimeTicks();\r\n data := Marshall(val, CMessage_grammar());\r\n var generic_marshall_end_time := Time.GetDebugTimeTicks();\r\n\r\n assert !msg.CMessage_Invalid?;\r\n if msg.CMessage_Request? {\r\n RecordTimingSeq(\"GenericMarshallMessage_Request\", generic_marshall_start_time, generic_marshall_end_time);\r\n } else if msg.CMessage_1a? {\r\n RecordTimingSeq(\"GenericMarshallMessage_1a\", generic_marshall_start_time, generic_marshall_end_time);\r\n } else if msg.CMessage_1b? {\r\n RecordTimingSeq(\"GenericMarshallMessage_1b\", generic_marshall_start_time, generic_marshall_end_time);\r\n } else if msg.CMessage_2a? {\r\n RecordTimingSeq(\"GenericMarshallMessage_2a\", generic_marshall_start_time, generic_marshall_end_time);\r\n } else if msg.CMessage_2b? {\r\n RecordTimingSeq(\"GenericMarshallMessage_2b\", generic_marshall_start_time, generic_marshall_end_time);\r\n } else if msg.CMessage_Heartbeat? {\r\n RecordTimingSeq(\"GenericMarshallMessage_Heartbeat\", generic_marshall_start_time, generic_marshall_end_time);\r\n } else if msg.CMessage_Reply? {\r\n RecordTimingSeq(\"GenericMarshallMessage_Reply\", generic_marshall_start_time, generic_marshall_end_time);\r\n } else if msg.CMessage_AppStateRequest? {\r\n RecordTimingSeq(\"GenericMarshallMessage_AppStateRequest\", generic_marshall_start_time, generic_marshall_end_time);\r\n } else if msg.CMessage_AppStateSupply? {\r\n RecordTimingSeq(\"GenericMarshallMessage_AppStateSupply\", generic_marshall_start_time, generic_marshall_end_time);\r\n } else if msg.CMessage_StartingPhase2? {\r\n RecordTimingSeq(\"GenericMarshallMessage_StartingPhase2\", generic_marshall_start_time, generic_marshall_end_time);\r\n }\r\n\r\n forall src, dst | EndPointIsValidPublicKey(src) && EndPointIsValidPublicKey(dst) \r\n ensures AbstractifyBufferToRslPacket(src, dst, data[..])\r\n == LPacket(AbstractifyEndPointToNodeIdentity(dst), AbstractifyEndPointToNodeIdentity(src), AbstractifyCMessageToRslMessage(msg));\r\n {\r\n calc {\r\n AbstractifyBufferToRslPacket(src, dst, data[..]);\r\n LPacket(AbstractifyEndPointToNodeIdentity(dst),\r\n AbstractifyEndPointToNodeIdentity(src),\r\n AbstractifyCMessageToRslMessage(PaxosDemarshallData(data[..])));\r\n LPacket(AbstractifyEndPointToNodeIdentity(dst),\r\n AbstractifyEndPointToNodeIdentity(src),\r\n AbstractifyCMessageToRslMessage(PaxosDemarshallData(data[..])));\r\n LPacket(AbstractifyEndPointToNodeIdentity(dst), AbstractifyEndPointToNodeIdentity(src), AbstractifyCMessageToRslMessage(msg));\r\n }\r\n }\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Sendable predicates\r\n\r\npredicate CPacketIsSendable(cpacket:CPacket)\r\n{\r\n && CMessageIsValid(cpacket.msg) \r\n && CPacketIsAbstractable(cpacket)\r\n && EndPointIsValidPublicKey(cpacket.src)\r\n}\r\n\r\npredicate CPacketSetIsSendable(cps:set)\r\n{\r\n forall p :: p in cps ==> CPacketIsSendable(p)\r\n}\r\n\r\npredicate CPacketSeqIsValid(cps:seq)\r\n{\r\n && CPacketSeqIsAbstractable(cps)\r\n && |cps| < 0xFFFF_FFFF_FFFF_FFFF\r\n && forall i :: 0<=i<|cps| ==> CPacketIsSendable(cps[i])\r\n}\r\n\r\npredicate CBroadcastIsValid(broadcast:CBroadcast) \r\n{\r\n && CBroadcastIsAbstractable(broadcast)\r\n && (broadcast.CBroadcast? ==>\r\n && Marshallable(broadcast.msg)\r\n && 0 <= |broadcast.dsts| < 0xFFFF_FFFF_FFFF_FFFF)\r\n}\r\n\r\npredicate OutboundPacketsIsValid(out:OutboundPackets)\r\n{\r\n match out\r\n case Broadcast(broadcast) => CBroadcastIsValid(broadcast)\r\n case OutboundPacket(p) => p.Some? ==> CPacketIsSendable(p.v)\r\n case PacketSequence(s) => |s| < 0xFFFF_FFFF_FFFF_FFFF \r\n && (forall p :: p in s ==> CPacketIsSendable(p))\r\n// case OutboundPacket(Some(p)) => CPacketIsSendable(p)\r\n// case OutboundPacket(None) => true\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ParametersState.i.dfy", "content": "include \"../../Common/Native/NativeTypes.s.dfy\"\r\ninclude \"../../Protocol/RSL/Parameters.i.dfy\"\r\ninclude \"../Common/UpperBound.i.dfy\"\r\n\r\nmodule LiveRSL__ParametersState_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__Parameters_i\r\nimport opened Common__UpperBound_i\r\nimport opened Common__UpperBound_s\r\n\r\ndatatype ParametersState = ParametersState(\r\n max_log_length:uint64,\r\n baseline_view_timeout_period:uint64,\r\n heartbeat_period:uint64,\r\n max_integer_val:uint64,\r\n max_batch_size:uint64,\r\n max_batch_delay:uint64)\r\n\r\nfunction AbstractifyParametersStateToLParameters(params:ParametersState) : LParameters\r\n{\r\n LParameters(params.max_log_length as int,\r\n params.baseline_view_timeout_period as int,\r\n params.heartbeat_period as int,\r\n UpperBoundFinite(params.max_integer_val as int),\r\n params.max_batch_size as int,\r\n params.max_batch_delay as int)\r\n}\r\n\r\nfunction method StaticParams() : ParametersState\r\n{\r\n ParametersState(7, // max log length\r\n 1000, // baseline view timeout period (1000 ms = 1 sec)\r\n 100, // heartbeat period (100 ms)\r\n 0x8000_0000_0000_0000 - 1, // Max integer value: 2^63 - 1\r\n 32, // max_batch_size\r\n 10) // max_batch_delay (10 ms)\r\n}\r\n\r\npredicate WFParametersState(params:ParametersState)\r\n{\r\n && params.max_integer_val > params.max_log_length > 0\r\n && params.max_integer_val > params.max_batch_delay\r\n && params.max_integer_val < 0x8000_0000_0000_0000\r\n && params.baseline_view_timeout_period > 0\r\n && params.heartbeat_period > 0\r\n && params.max_batch_size > 0\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/PaxosWorldState.i.dfy", "content": "include \"CPaxosConfiguration.i.dfy\"\r\n\r\nmodule LiveRSL__PaxosWorldState_i {\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened Native__NativeTypes_s\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// World\r\n// TODO jonh thinks this object should be deprecated.\r\n\r\ndatatype ActionStatus = Ok | Ignore | Fail\r\n\r\nfunction method f_max_uint64() : uint64\r\n{\r\n 0xffff_ffff_ffff_ffff\r\n}\r\n\r\ndatatype PaxosWorldState = PaxosWorldState(good:bool, config:CPaxosConfiguration)\r\n\r\npredicate PaxosWorldIsValid(world:PaxosWorldState)\r\n{\r\n && world.good\r\n && CPaxosConfigurationIsValid(world.config)\r\n}\r\n\r\nmethod UpdatePaxosWorld(world:PaxosWorldState, status:ActionStatus) returns (world':PaxosWorldState)\r\n ensures !status.Fail? ==> world' == world\r\n{\r\n if (status.Fail?)\r\n {\r\n world' := world.(good := false);\r\n }\r\n else\r\n {\r\n world' := world;\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ProposerLemmas.i.dfy", "content": "include \"ProposerState.i.dfy\"\r\n\r\nmodule LiveRSL__ProposerLemmas_i {\r\nimport opened Native__Io_s\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__ProposerState_i\r\nimport opened Collections__Sets_i\r\nimport opened Common__SeqIsUnique_i\r\n\r\npredicate SetOfMessage1b(S:set)\r\n{\r\n forall p :: p in S ==> p.msg.CMessage_1b?\r\n}\r\n\r\npredicate SetOfMessage1bAboutBallot(S:set, b:CBallot)\r\n{\r\n && SetOfMessage1b(S)\r\n && (forall p :: p in S ==> p.msg.bal_1b == b)\r\n}\r\n\r\npredicate IsAfterLogTruncationPoint(opn:COperationNumber, received_1b_packets:set)\r\n{\r\n forall p :: p in received_1b_packets && p.msg.CMessage_1b? ==> p.msg.log_truncation_point.n <= opn.n\r\n}\r\n\r\npredicate AllAcceptorsHadNoProposal(S:set, opn:COperationNumber)\r\n requires SetOfMessage1b(S)\r\n{\r\n forall p :: p in S ==> !(opn in p.msg.votes.v)\r\n}\r\n\r\nlemma lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(cps:set)\r\n requires CPacketsIsAbstractable(cps)\r\n ensures SetOfInjectiveTypeCPackets(cps) ==> |cps| == |AbstractifySetOfCPacketsToSetOfRslPackets(cps)|\r\n ensures AbstractifySetOfCPacketsToSetOfRslPackets({}) == {}\r\n ensures SetOfMessage1b(cps) ==> LSetOfMessage1b(AbstractifySetOfCPacketsToSetOfRslPackets(cps))\r\n ensures forall bal :: CBallotIsAbstractable(bal) ==> SetOfMessage1bAboutBallot(cps, bal) ==> LSetOfMessage1bAboutBallot(AbstractifySetOfCPacketsToSetOfRslPackets(cps), AbstractifyCBallotToBallot(bal))\r\n ensures forall opn {:trigger LIsAfterLogTruncationPoint(AbstractifyCOperationNumberToOperationNumber(opn), AbstractifySetOfCPacketsToSetOfRslPackets(cps))}{:trigger IsAfterLogTruncationPoint(opn, cps)} :: COperationNumberIsAbstractable(opn) ==> IsAfterLogTruncationPoint(opn, cps) == LIsAfterLogTruncationPoint(AbstractifyCOperationNumberToOperationNumber(opn), AbstractifySetOfCPacketsToSetOfRslPackets(cps))\r\n ensures SetOfMessage1b(cps) ==>\r\n (forall opn {:trigger LAllAcceptorsHadNoProposal(AbstractifySetOfCPacketsToSetOfRslPackets(cps), AbstractifyCOperationNumberToOperationNumber(opn))}{:trigger AllAcceptorsHadNoProposal(cps, opn)} :: COperationNumberIsAbstractable(opn) ==> \r\n AllAcceptorsHadNoProposal(cps, opn) == LAllAcceptorsHadNoProposal(AbstractifySetOfCPacketsToSetOfRslPackets(cps), AbstractifyCOperationNumberToOperationNumber(opn)))\r\n{\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(cps);\r\n if SetOfInjectiveTypeCPackets(cps) {\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_cardinality(cps);\r\n }\r\n\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n\r\n forall opn | COperationNumberIsAbstractable(opn) \r\n ensures !IsAfterLogTruncationPoint(opn, cps) ==> !LIsAfterLogTruncationPoint(AbstractifyCOperationNumberToOperationNumber(opn), AbstractifySetOfCPacketsToSetOfRslPackets(cps))\r\n {\r\n if !IsAfterLogTruncationPoint(opn, cps) {\r\n //if |cps| > 0 && (exists p :: p in cps && p.msg.CMessage_1b?)\r\n var p :| p in cps && p.msg.CMessage_1b? && p.msg.log_truncation_point.n > opn.n;\r\n var ref_p := AbstractifyCPacketToRslPacket(p);\r\n\r\n assert ref_p in AbstractifySetOfCPacketsToSetOfRslPackets(cps);\r\n assert ref_p.msg.RslMessage_1b?;\r\n assert ref_p.msg.log_truncation_point > AbstractifyCOperationNumberToOperationNumber(opn);\r\n }\r\n }\r\n\r\n if SetOfMessage1b(cps) {\r\n var ref_cps := AbstractifySetOfCPacketsToSetOfRslPackets(cps);\r\n forall opn | COperationNumberIsAbstractable(opn) \r\n ensures AllAcceptorsHadNoProposal(cps, opn) ==> LAllAcceptorsHadNoProposal(ref_cps, AbstractifyCOperationNumberToOperationNumber(opn))\r\n {\r\n var ref_opn := AbstractifyCOperationNumberToOperationNumber(opn);\r\n if AllAcceptorsHadNoProposal(cps, opn) {\r\n forall rp | rp in ref_cps\r\n ensures !(ref_opn in rp.msg.votes)\r\n {\r\n reveal AbstractifyCVotesToVotes();\r\n var p :| p in cps && rp == AbstractifyCPacketToRslPacket(p);\r\n if ref_opn in rp.msg.votes {\r\n assert opn in p.msg.votes.v;\r\n assert false;\r\n }\r\n }\r\n\r\n }\r\n }\r\n\r\n forall opn | COperationNumberIsAbstractable(opn) \r\n ensures !AllAcceptorsHadNoProposal(cps, opn) ==> !LAllAcceptorsHadNoProposal(ref_cps, AbstractifyCOperationNumberToOperationNumber(opn))\r\n {\r\n var ref_opn := AbstractifyCOperationNumberToOperationNumber(opn);\r\n if !AllAcceptorsHadNoProposal(cps, opn) {\r\n assert !(forall p :: p in cps ==> !(opn in p.msg.votes.v));\r\n var p :| p in cps && opn in p.msg.votes.v;\r\n var ref_p := AbstractifyCPacketToRslPacket(p);\r\n\r\n reveal AbstractifyCVotesToVotes();\r\n\r\n assert ref_p in ref_cps;\r\n }\r\n }\r\n }\r\n\r\n// calc ==> {\r\n// SetOfMessage1b(cps);\r\n// { reveal AbstractifySetOfCPacketsToSetOfRslPackets(); }\r\n// LSetOfMessage1b(AbstractifySetOfCPacketsToSetOfRslPackets(cps));\r\n// }\r\n// calc ==> {\r\n// true;\r\n// { reveal AbstractifySetOfCPacketsToSetOfRslPackets(); }\r\n// AbstractifySetOfCPacketsToSetOfRslPackets({}) == {};\r\n// }\r\n}\r\n\r\n// Name this accessor for the proof below\r\nfunction PacketSrc(pkt:CPacket) : EndPoint\r\n{\r\n pkt.src \r\n}\r\n\r\nlemma lemma_Received1bBound(proposer:ProposerState)\r\n requires ProposerIsValid(proposer)\r\n ensures |proposer.received_1b_packets| < 0xFFFF_FFFF_FFFF_FFFF\r\n{\r\n var srcs := set pkt | pkt in proposer.received_1b_packets :: PacketSrc(pkt);\r\n\r\n reveal Received1bProperties();\r\n lemma_MapSetCardinalityOver(proposer.received_1b_packets, srcs, PacketSrc);\r\n assert |srcs| == |proposer.received_1b_packets|;\r\n var replicas := UniqueSeqToSet(proposer.constants.all.config.replica_ids);\r\n lemma_seqs_set_cardinality(proposer.constants.all.config.replica_ids, replicas);\r\n SubsetCardinality(srcs, replicas);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ProposerModel.i.dfy", "content": "include \"AppInterface.i.dfy\"\r\ninclude \"ProposerState.i.dfy\"\r\ninclude \"ElectionModel.i.dfy\"\r\ninclude \"Broadcast.i.dfy\"\r\ninclude \"MinCQuorumSize.i.dfy\"\r\ninclude \"ProposerLemmas.i.dfy\"\r\ninclude \"../Common/Util.i.dfy\"\r\ninclude \"../../Common/Collections/Sets.i.dfy\"\r\n\r\nmodule LiveRSL__ProposerModel_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__Broadcast_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__ConstantsState_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__Election_i\r\nimport opened LiveRSL__ElectionModel_i\r\nimport opened LiveRSL__ElectionState_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__MinCQuorumSize_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__ProposerLemmas_i\r\nimport opened LiveRSL__ProposerState_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Impl__LiveRSL__Broadcast_i\r\nimport opened Collections__Maps_i\r\nimport opened Collections__Sets_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__SeqIsUnique_i\r\nimport opened Common__SeqIsUniqueDef_i\r\nimport opened Common__NetClient_i\r\nimport opened Common__UpperBound_s\r\nimport opened Common__UpperBound_i\r\nimport opened Common__Util_i\r\nimport opened AppStateMachine_s\r\n\r\n// Same as x == y, but triggers extensional equality on fields and provides better error diagnostics\r\npredicate Eq_LProposer(x:LProposer, y:LProposer)\r\n{\r\n && x.constants == y.constants\r\n && x.current_state == y.current_state\r\n && x.request_queue == y.request_queue\r\n && x.max_ballot_i_sent_1a == y.max_ballot_i_sent_1a\r\n && x.next_operation_number_to_propose == y.next_operation_number_to_propose \r\n && x.received_1b_packets == y.received_1b_packets\r\n && x.highest_seqno_requested_by_client_this_view == y.highest_seqno_requested_by_client_this_view\r\n && x.election_state == y.election_state \r\n}\r\n\r\nmethod InitProposerState(constants:ReplicaConstantsState) returns (proposer:ProposerState, cur_req_set:MutableSet, prev_req_set:MutableSet)\r\n requires ReplicaConstantsState_IsValid(constants)\r\n ensures ProposerIsAbstractable(proposer)\r\n ensures WellFormedLConfiguration(AbstractifyReplicaConstantsStateToLReplicaConstants(constants).all.config)\r\n ensures ProposerIsValid(proposer)\r\n ensures LProposerInit(AbstractifyProposerStateToLProposer(proposer), AbstractifyReplicaConstantsStateToLReplicaConstants(constants))\r\n ensures proposer.constants == constants\r\n ensures fresh(cur_req_set) && fresh(prev_req_set) && cur_req_set != prev_req_set\r\n ensures MutableSet.SetOf(cur_req_set) == proposer.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == proposer.election_state.prev_req_set\r\n{\r\n var election;\r\n election, cur_req_set, prev_req_set := InitElectionState(constants);\r\n proposer := ProposerState(constants,\r\n 0,\r\n [],\r\n CBallot(0, constants.my_index),\r\n 0,\r\n {},\r\n map [],\r\n CIncompleteBatchTimerOff(),\r\n election,\r\n COperationNumber(0),\r\n COperationNumber(0));\r\n ghost var ref_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n ghost var ref_constants := AbstractifyReplicaConstantsStateToLReplicaConstants(constants);\r\n\r\n forall ensures SeqIsUnique(proposer.request_queue)\r\n {\r\n reveal SeqIsUnique();\r\n }\r\n\r\n forall ensures Received1bProperties(proposer.received_1b_packets, proposer.constants)\r\n {\r\n reveal Received1bProperties();\r\n }\r\n\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(proposer.received_1b_packets);\r\n\r\n // Some subset of below is an OBSERVE?\r\n assert ref_proposer.constants == ref_constants;\r\n assert ref_proposer.current_state == 0;\r\n assert ref_proposer.request_queue == [];\r\n assert ref_proposer.max_ballot_i_sent_1a == Ballot(0, ref_constants.my_index);\r\n assert ref_proposer.next_operation_number_to_propose == 0;\r\n assert ref_proposer.received_1b_packets == {};\r\n lemma_AbstractifyMapOfSeqNums_properties(proposer.highest_seqno_requested_by_client_this_view); \r\n assert ElectionStateInit(ref_proposer.election_state, ref_constants);\r\n}\r\n\r\n//function method maprange_impl(m:map) : set\r\n//{\r\n// set k | k in m :: m[k]\r\n//}\r\n\r\nmethod {:timeLimitMultiplier 2} ProposerProcessRequest(proposer:ProposerState, packet:CPacket, cur_req_set:MutableSet, prev_req_set:MutableSet) returns (proposer':ProposerState)\r\n requires ProposerIsValid(proposer)\r\n requires CPacketIsAbstractable(packet)\r\n requires packet.msg.CMessage_Request?\r\n requires CAppRequestMarshallable(packet.msg.val)\r\n requires cur_req_set != prev_req_set\r\n requires MutableSet.SetOf(cur_req_set) == proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == proposer.election_state.prev_req_set\r\n modifies cur_req_set\r\n ensures ProposerIsValid(proposer')\r\n ensures LProposerProcessRequest(AbstractifyProposerStateToLProposer(proposer), AbstractifyProposerStateToLProposer(proposer'), AbstractifyCPacketToRslPacket(packet))\r\n ensures proposer.constants == proposer'.constants\r\n ensures MutableSet.SetOf(cur_req_set) == proposer'.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == proposer'.election_state.prev_req_set\r\n{\r\n ghost var ref_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n ghost var r_proposer;\r\n ghost var r_packet := AbstractifyCPacketToRslPacket(packet);\r\n var val := CRequest(packet.src, packet.msg.seqno, packet.msg.val);\r\n //var election_start_time := Time.GetDebugTimeTicks();\r\n var newElectionState := ElectionReflectReceivedRequest(proposer.election_state, val, cur_req_set, prev_req_set);\r\n //var election_end_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"ProposerProcessRequest_Election\", election_start_time, election_end_time);\r\n\r\n ghost var ref_val := AbstractifyCRequestToRequest(val);\r\n ghost var ref_myOutstandingProposedValues := AbstractifyMapOfSeqNums(proposer.highest_seqno_requested_by_client_this_view);\r\n lemma_AbstractifyMapOfSeqNums_properties(proposer.highest_seqno_requested_by_client_this_view);\r\n assert forall e :: (e !in proposer.highest_seqno_requested_by_client_this_view && EndPointIsValidPublicKey(e) ==> AbstractifyEndPointToNodeIdentity(e) !in AbstractifyMapOfSeqNums(proposer.highest_seqno_requested_by_client_this_view));\r\n assert EndPointIsValidPublicKey(packet.src);\r\n assert packet.src !in proposer.highest_seqno_requested_by_client_this_view ==> AbstractifyEndPointToNodeIdentity(packet.src) !in AbstractifyMapOfSeqNums(proposer.highest_seqno_requested_by_client_this_view);\r\n assert packet.src in proposer.highest_seqno_requested_by_client_this_view ==> \r\n (packet.msg.seqno > proposer.highest_seqno_requested_by_client_this_view[packet.src] <==>\r\n r_packet.msg.seqno_req > ref_proposer.highest_seqno_requested_by_client_this_view[r_packet.src]);\r\n \r\n //var lookup_start_time := Time.GetDebugTimeTicks();\r\n if proposer.current_state != 0 && \r\n (packet.src !in proposer.highest_seqno_requested_by_client_this_view ||\r\n packet.msg.seqno > proposer.highest_seqno_requested_by_client_this_view[packet.src]) {\r\n// var lookup_end_time := Time.GetDebugTimeTicks();\r\n// RecordTimingSeq(\"ProposerProcessRequest_Lookup\", lookup_start_time, lookup_end_time);\r\n //print(\"Processing request with seqno \", packet.msg.seqno, \". Inside if .\\n\");\r\n assert r_packet.src !in ref_proposer.highest_seqno_requested_by_client_this_view ||\r\n r_packet.msg.seqno_req > ref_proposer.highest_seqno_requested_by_client_this_view[r_packet.src];\r\n\r\n //var map_update_start_time := Time.GetDebugTimeTicks();\r\n var new_seqno_map := proposer.highest_seqno_requested_by_client_this_view[packet.src := packet.msg.seqno];\r\n //var map_update_end_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"ProposerProcessRequest_MapUpdate\", map_update_start_time, map_update_end_time);\r\n\r\n //var proposer_update_start_time := Time.GetDebugTimeTicks();\r\n proposer' := proposer.(election_state := newElectionState,\r\n request_queue := proposer.request_queue + [val],\r\n highest_seqno_requested_by_client_this_view := new_seqno_map);\r\n //var proposer_update_end_time := Time.GetDebugTimeTicks();\r\n lemma_AbstractifyMapOfSeqNums_properties(new_seqno_map);\r\n r_proposer := ref_proposer.(election_state := AbstractifyCElectionStateToElectionState(newElectionState),\r\n request_queue := ref_proposer.request_queue + [ref_val],\r\n highest_seqno_requested_by_client_this_view := \r\n ref_proposer.highest_seqno_requested_by_client_this_view\r\n [r_packet.src := r_packet.msg.seqno_req]);\r\n ghost var ref_proposer' := AbstractifyProposerStateToLProposer(proposer');\r\n assert Eq_LProposer(r_proposer, ref_proposer');\r\n assert LProposerProcessRequest(ref_proposer, r_proposer, r_packet);\r\n //RecordTimingSeq(\"ProposerProcessRequest_ProposerUpdate\", proposer_update_start_time, proposer_update_end_time);\r\n } else {\r\n //var lookup_end_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"ProposerProcessRequest_Lookup\", lookup_start_time, lookup_end_time);\r\n //print(\"Processing request with seqno \", packet.msg.seqno, \". Inside else.\\n\");\r\n proposer' := proposer.(election_state := newElectionState);\r\n r_proposer := ref_proposer.(election_state := AbstractifyCElectionStateToElectionState(newElectionState));\r\n ghost var ref_proposer' := AbstractifyProposerStateToLProposer(proposer');\r\n assert Eq_LProposer(r_proposer, ref_proposer');\r\n assert LProposerProcessRequest(ref_proposer, r_proposer, r_packet);\r\n }\r\n}\r\n\r\nmethod ProposerMaybeEnterNewViewAndSend1a(proposer:ProposerState) returns (proposer':ProposerState, sent_packets:CBroadcast)\r\n requires ProposerIsValid(proposer)\r\n ensures ProposerIsValid(proposer')\r\n ensures CBroadcastIsValid(sent_packets)\r\n ensures OutboundPacketsHasCorrectSrc(Broadcast(sent_packets), proposer.constants.all.config.replica_ids[proposer.constants.my_index])\r\n ensures LProposerMaybeEnterNewViewAndSend1a(AbstractifyProposerStateToLProposer(proposer), AbstractifyProposerStateToLProposer(proposer'), AbstractifyCBroadcastToRlsPacketSeq(sent_packets))\r\n ensures proposer.constants == proposer'.constants\r\n ensures proposer'.election_state.cur_req_set == proposer.election_state.cur_req_set\r\n ensures proposer'.election_state.prev_req_set == proposer.election_state.prev_req_set\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n ghost var ref_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n //lemma_ProposerId(proposer);\r\n var lt := CBalLt(proposer.max_ballot_i_sent_1a, proposer.election_state.current_view);\r\n if proposer.election_state.current_view.proposer_id == proposer.constants.my_index && lt {\r\n //print \"Proposer becoming leader of ballot \", proposer.election_state.current_view, \"\\n\";\r\n lemma_AbstractifyCRequestsSeqToRequestsSeq_concat(proposer.election_state.requests_received_prev_epochs, \r\n proposer.election_state.requests_received_this_epoch);\r\n assert RequestQueueValid(proposer.election_state.requests_received_prev_epochs);\r\n assert RequestQueueValid(proposer.election_state.requests_received_this_epoch);\r\n var new_requestQueue := proposer.election_state.requests_received_prev_epochs \r\n + proposer.election_state.requests_received_this_epoch;\r\n\r\n assert |new_requestQueue| == |proposer.election_state.requests_received_prev_epochs| + |proposer.election_state.requests_received_this_epoch|;\r\n proposer' := proposer.(current_state := 1,\r\n max_ballot_i_sent_1a := proposer.election_state.current_view,\r\n received_1b_packets := {},\r\n highest_seqno_requested_by_client_this_view := map[],\r\n request_queue := new_requestQueue);\r\n forall ensures Received1bProperties(proposer'.received_1b_packets, proposer.constants)\r\n {\r\n reveal Received1bProperties();\r\n }\r\n var msg := CMessage_1a(proposer.election_state.current_view);\r\n assert Marshallable(msg);\r\n assert CPaxosConfigurationIsValid(proposer.constants.all.config);\r\n sent_packets := BuildBroadcastToEveryone(proposer.constants.all.config, proposer.constants.my_index, msg);\r\n\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(proposer.received_1b_packets);\r\n\r\n // Some subset of the below is an OBSERVE\r\n ghost var ref_proposer' := AbstractifyProposerStateToLProposer(proposer');\r\n assert ref_proposer'.current_state == 1;\r\n assert ref_proposer'.max_ballot_i_sent_1a == ref_proposer.election_state.current_view;\r\n assert ref_proposer'.received_1b_packets == {};\r\n lemma_AbstractifyMapOfSeqNums_properties(proposer'.highest_seqno_requested_by_client_this_view); \r\n assert LBroadcastToEveryone(ref_proposer.constants.all.config, ref_proposer.constants.my_index, RslMessage_1a(ref_proposer.election_state.current_view), AbstractifyCBroadcastToRlsPacketSeq(sent_packets));\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"ProposerMaybeEnterNewViewAndSend1a_work\", start_time, end_time);\r\n } else {\r\n proposer' := proposer;\r\n sent_packets := CBroadcastNop;\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"ProposerMaybeEnterNewViewAndSend1a_nada\", start_time, end_time);\r\n }\r\n}\r\n\r\nmethod ProposerProcess1b(proposer:ProposerState, packet:CPacket) returns (proposer':ProposerState)\r\n requires ProposerIsValid(proposer)\r\n requires proposer.current_state == 1\r\n requires EndPointIsValidPublicKey(packet.src)\r\n requires packet.src in proposer.constants.all.config.replica_ids\r\n requires packet.msg.CMessage_1b?\r\n requires packet.msg.bal_1b == proposer.max_ballot_i_sent_1a\r\n requires ValidVotes(packet.msg.votes)\r\n requires CPacketIsAbstractable(packet)\r\n requires forall other_packet :: other_packet in proposer.received_1b_packets ==> other_packet.src != packet.src\r\n ensures ProposerIsValid(proposer')\r\n ensures forall other_packet :: other_packet in AbstractifyProposerStateToLProposer(proposer).received_1b_packets ==> other_packet.src != AbstractifyCPacketToRslPacket(packet).src\r\n ensures LProposerProcess1b(AbstractifyProposerStateToLProposer(proposer), AbstractifyProposerStateToLProposer(proposer'), AbstractifyCPacketToRslPacket(packet))\r\n ensures proposer.constants == proposer'.constants\r\n ensures proposer'.election_state.cur_req_set == proposer.election_state.cur_req_set\r\n ensures proposer'.election_state.prev_req_set == proposer.election_state.prev_req_set\r\n{\r\n //print(\"Proposer processing a 1b message about ballot\", packet.msg.bal_1b, \"\\n\");\r\n proposer' := proposer.(received_1b_packets := proposer.received_1b_packets + { packet });\r\n\r\n // Prove Received1bProperties\r\n reveal Received1bProperties();\r\n forall p | p in proposer'.received_1b_packets\r\n ensures p.src in proposer.constants.all.config.replica_ids\r\n {\r\n if p in proposer.received_1b_packets {\r\n assert p.src in proposer.constants.all.config.replica_ids;\r\n } else {\r\n assert p == packet && packet.src in proposer.constants.all.config.replica_ids;\r\n }\r\n }\r\n\r\n forall p1,p2 | p1 in proposer'.received_1b_packets && p2 in proposer'.received_1b_packets && p1.src == p2.src\r\n ensures p1 == p2\r\n {\r\n if p1 in proposer.received_1b_packets && p2 in proposer.received_1b_packets {\r\n assert p1 == p2;\r\n } else if p1 in proposer.received_1b_packets {\r\n assert p2 == packet;\r\n assert p2.src != p1.src;\r\n assert false;\r\n } else if p2 in proposer.received_1b_packets {\r\n assert p1 == packet;\r\n assert p2.src != p1.src;\r\n assert false;\r\n } else {\r\n assert p1 == packet == p2;\r\n }\r\n }\r\n\r\n ghost var ref_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n ghost var ref_proposer' := AbstractifyProposerStateToLProposer(proposer');\r\n ghost var ref_packet := AbstractifyCPacketToRslPacket(packet);\r\n calc {\r\n ref_proposer'.received_1b_packets;\r\n { reveal AbstractifySetOfCPacketsToSetOfRslPackets(); }\r\n ref_proposer.received_1b_packets + { ref_packet };\r\n }\r\n //assert ref_proposer'.received_1b_packets == ref_proposer.received_1b_packets + { ref_packet };\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_srcMembership(proposer.received_1b_packets, packet.src);\r\n}\r\n\r\nlemma lemma_MapSingleton(m:map, elm:T)\r\n requires |m| == 1\r\n requires elm in m\r\n ensures forall x :: x in m ==> x == elm\r\n{\r\n var empty := RemoveElt(m, elm);\r\n}\r\n\r\nmethod getMaxOpnWithProposalFromSingleton(m:map) returns (maxOpn:COperationNumber)\r\n requires |m| > 0\r\n ensures forall opn :: opn in m ==> opn.n <= maxOpn.n\r\n{\r\n if |m| == 1 \r\n {\r\n var opn :| opn in m;\r\n lemma_MapSingleton(m, opn);\r\n assert forall op :: op in m ==> op == opn;\r\n maxOpn := opn;\r\n } else {\r\n var opn :| opn in m;\r\n var rest := RemoveElt(m, opn);\r\n var restMax:COperationNumber;\r\n \r\n restMax := getMaxOpnWithProposalFromSingleton(rest);\r\n if (restMax.n > opn.n) {\r\n maxOpn := restMax;\r\n } else {\r\n maxOpn := opn;\r\n }\r\n }\r\n}\r\n\r\nmethod getMaxOpnWithProposalFromSet(s:set) returns (maxOpn:COperationNumber, foundNonEmpty:bool)\r\n requires forall p :: p in s ==> p.msg.CMessage_1b? && ValidVotes(p.msg.votes)\r\n requires |s| > 0\r\n ensures forall p :: p in s ==> (forall opn :: opn in p.msg.votes.v ==> opn.n <= maxOpn.n)\r\n ensures foundNonEmpty <==> exists p :: p in s && |p.msg.votes.v| > 0\r\n{\r\n if |s| == 1 \r\n {\r\n var p :| p in s;\r\n assert p.msg.CMessage_1b?;\r\n \r\n forall q | q in s \r\n ensures q == p\r\n {\r\n ThingsIKnowAboutASingletonSet(s, q, p);\r\n }\r\n if (|p.msg.votes.v| > 0) {\r\n maxOpn := getMaxOpnWithProposalFromSingleton(p.msg.votes.v);\r\n foundNonEmpty := true;\r\n } else {\r\n maxOpn := COperationNumber(0);\r\n foundNonEmpty := false;\r\n }\r\n } else {\r\n var p :| p in s;\r\n var rest := s - {p};\r\n var candidateOpn;\r\n var foundLocal:bool;\r\n if (|p.msg.votes.v| > 0) {\r\n candidateOpn := getMaxOpnWithProposalFromSingleton(p.msg.votes.v);\r\n foundLocal := true;\r\n assert forall opn :: opn in p.msg.votes.v ==> opn.n <= candidateOpn.n;\r\n } else {\r\n candidateOpn := COperationNumber(0);\r\n foundLocal := false;\r\n }\r\n forall x | x in rest \r\n ensures x.msg.CMessage_1b? && ValidVotes(x.msg.votes)\r\n {\r\n assert x in s;\r\n assert forall q :: q in s ==> q.msg.CMessage_1b? && ValidVotes(q.msg.votes);\r\n }\r\n \r\n var restMaxOpn, foundTemp := getMaxOpnWithProposalFromSet(rest);\r\n if (foundTemp || foundLocal) {\r\n foundNonEmpty := true;\r\n } else {\r\n foundNonEmpty := false;\r\n }\r\n if candidateOpn.n > restMaxOpn.n {\r\n maxOpn := candidateOpn;\r\n } else {\r\n maxOpn := restMaxOpn;\r\n }\r\n }\r\n}\r\n\r\nmethod getMaxLogTruncationPoint(s:set) returns (maxLogTruncationPoint:COperationNumber)\r\n requires forall p :: p in s ==> p.msg.CMessage_1b?\r\n requires |s| > 0\r\n ensures forall p :: p in s ==> p.msg.log_truncation_point.n <= maxLogTruncationPoint.n\r\n{\r\n if |s| == 1 \r\n {\r\n var p :| p in s;\r\n assert p.msg.CMessage_1b?;\r\n \r\n forall q | q in s \r\n ensures q == p\r\n {\r\n ThingsIKnowAboutASingletonSet(s, q, p);\r\n }\r\n maxLogTruncationPoint := p.msg.log_truncation_point;\r\n } else {\r\n var p :| p in s;\r\n var rest := s - {p};\r\n var candidateOpn := p.msg.log_truncation_point;\r\n forall x | x in rest \r\n ensures x.msg.CMessage_1b?\r\n {\r\n assert x in s;\r\n assert forall q :: q in s ==> q.msg.CMessage_1b?;\r\n }\r\n\r\n var restMaxOpn := getMaxLogTruncationPoint(rest);\r\n if candidateOpn.n > restMaxOpn.n {\r\n maxLogTruncationPoint := candidateOpn;\r\n } else {\r\n maxLogTruncationPoint := restMaxOpn;\r\n }\r\n }\r\n}\r\n\r\nmethod {:timeLimitMultiplier 8} ProposerMaybeEnterPhase2(proposer:ProposerState,log_truncation_point:COperationNumber) returns (proposer':ProposerState, sent_packets:CBroadcast)\r\n requires ProposerIsValid(proposer)\r\n requires COperationNumberIsAbstractable(log_truncation_point)\r\n ensures ProposerIsValid(proposer')\r\n ensures CBroadcastIsValid(sent_packets)\r\n ensures OutboundPacketsHasCorrectSrc(Broadcast(sent_packets), proposer.constants.all.config.replica_ids[proposer.constants.my_index])\r\n ensures LProposerMaybeEnterPhase2(AbstractifyProposerStateToLProposer(proposer), AbstractifyProposerStateToLProposer(proposer'), AbstractifyCOperationNumberToOperationNumber(log_truncation_point), AbstractifyCBroadcastToRlsPacketSeq(sent_packets))\r\n ensures proposer.constants == proposer'.constants\r\n ensures proposer'.election_state.cur_req_set == proposer.election_state.cur_req_set\r\n ensures proposer'.election_state.prev_req_set == proposer.election_state.prev_req_set\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n assert SetOfInjectiveTypeCPackets(proposer.received_1b_packets);\r\n ghost var ref_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(proposer.received_1b_packets);\r\n assert |proposer.received_1b_packets| == |AbstractifySetOfCPacketsToSetOfRslPackets(proposer.received_1b_packets)|;\r\n var quorum_size := MinCQuorumSize(proposer.constants.all.config);\r\n // The following is already true thanks to our IsValid invariant:\r\n // assert LSet(ref_proposer.received_1b_packets, ref_proposer.max_ballot_i_sent_1a);\r\n lemma_Received1bBound(proposer);\r\n if |proposer.received_1b_packets| as uint64 >= quorum_size && proposer.current_state == 1 {\r\n assert |ref_proposer.received_1b_packets| >= LMinQuorumSize(ref_proposer.constants.all.config);\r\n assert LSetOfMessage1bAboutBallot(ref_proposer.received_1b_packets, ref_proposer.max_ballot_i_sent_1a);\r\n assert ref_proposer.current_state == 1;\r\n\r\n var maxOpn, foundNonEmpty := getMaxOpnWithProposalFromSet(proposer.received_1b_packets);\r\n if !foundNonEmpty {\r\n maxOpn := COperationNumber(0);\r\n } else if (maxOpn.n < 0xffff_ffff_ffff_ffff) {\r\n maxOpn := COperationNumber(maxOpn.n + 1);\r\n }\r\n \r\n var maxLogTP := getMaxLogTruncationPoint(proposer.received_1b_packets);\r\n //print(\"Proposer starting phase 2 for ballot\", proposer.max_ballot_i_sent_1a, \". Setting maxOpnWithProposal to \", maxOpn, \" and maxLogTruncationPoint to\", maxLogTP, \"\\n\");\r\n proposer' := proposer.(current_state := 2, next_operation_number_to_propose := log_truncation_point.n, maxOpnWithProposal := maxOpn, maxLogTruncationPoint := maxLogTP);\r\n var msg := CMessage_StartingPhase2(proposer.max_ballot_i_sent_1a, log_truncation_point);\r\n assert Marshallable(msg);\r\n sent_packets := BuildBroadcastToEveryone(proposer.constants.all.config, proposer.constants.my_index, msg);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"ProposerMaybeEnterPhase2_work\", start_time, end_time);\r\n } else {\r\n proposer' := proposer;\r\n sent_packets := CBroadcastNop;\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer({});\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"ProposerMaybeEnterPhase2_nada\", start_time, end_time);\r\n }\r\n\r\n ghost var ref_proposer' := AbstractifyProposerStateToLProposer(proposer');\r\n ghost var ref_logTruncationPoint := AbstractifyCOperationNumberToOperationNumber(log_truncation_point);\r\n}\r\n\r\npredicate Proposer_CanNominateUsingOperationNumber(s:ProposerState, log_truncation_point:COperationNumber, opn:COperationNumber)\r\n requires ConstantsStateIsAbstractable(s.constants.all)\r\n{\r\n && s.election_state.current_view == s.max_ballot_i_sent_1a\r\n && s.current_state == 2\r\n && |s.received_1b_packets| >= LMinQuorumSize(AbstractifyCPaxosConfigurationToConfiguration(s.constants.all.config))\r\n && SetOfMessage1bAboutBallot(s.received_1b_packets, s.max_ballot_i_sent_1a)\r\n // Don't try to nominate for an operation that's already been truncated into history:\r\n && IsAfterLogTruncationPoint(opn, s.received_1b_packets)\r\n // Don't try to nominate in an operation that's too far in the future; that would grow the log too much.\r\n && opn.n as int < UpperBoundedAddition(log_truncation_point.n as int, s.constants.all.params.max_log_length as int, UpperBoundFinite(s.constants.all.params.max_integer_val as int))\r\n // Disallow negative operations\r\n && opn.n >= 0\r\n}\r\n\r\nlemma lemma_ProposerCanNominateUsingOperationNumberAbstractifies(s:ProposerState, log_truncation_point:COperationNumber, opn:COperationNumber)\r\n requires ProposerIsValid(s)\r\n requires COperationNumberIsAbstractable(log_truncation_point)\r\n requires Proposer_CanNominateUsingOperationNumber(s, log_truncation_point, opn)\r\n ensures LProposerCanNominateUsingOperationNumber(AbstractifyProposerStateToLProposer(s),\r\n AbstractifyCOperationNumberToOperationNumber(log_truncation_point),\r\n AbstractifyCOperationNumberToOperationNumber(opn))\r\n{\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(s.received_1b_packets);\r\n reveal AbstractifyCVotesToVotes();\r\n}\r\n\r\nlemma {:timeLimitMultiplier 4} lemma_NotProposerCanNominateUsingOperationNumberAbstractifies(s:ProposerState, log_truncation_point:COperationNumber, opn:COperationNumber)\r\n requires ProposerIsValid(s)\r\n requires COperationNumberIsAbstractable(log_truncation_point)\r\n requires !Proposer_CanNominateUsingOperationNumber(s, log_truncation_point, opn)\r\n ensures !LProposerCanNominateUsingOperationNumber(AbstractifyProposerStateToLProposer(s),\r\n AbstractifyCOperationNumberToOperationNumber(log_truncation_point),\r\n AbstractifyCOperationNumberToOperationNumber(opn))\r\n{\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(s.received_1b_packets);\r\n\r\n if !(s.election_state.current_view == s.max_ballot_i_sent_1a) {\r\n } else if !(s.current_state == 2) {\r\n } else if !(|s.received_1b_packets| >= LMinQuorumSize(AbstractifyCPaxosConfigurationToConfiguration(s.constants.all.config))) {\r\n } else if !(SetOfMessage1bAboutBallot(s.received_1b_packets, s.max_ballot_i_sent_1a)) {\r\n } else if !(IsAfterLogTruncationPoint(opn, s.received_1b_packets)) {\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(s.received_1b_packets);\r\n } else if !(opn.n as int < UpperBoundedAddition(log_truncation_point.n as int, s.constants.all.params.max_log_length as int, UpperBoundFinite(s.constants.all.params.max_integer_val as int))) {\r\n } else if (!(opn.n >= 0)) {\r\n } else {\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_AllAcceptorsHadNoProposalAbstractifies(S:set, opn:COperationNumber)\r\n requires CPacketsIsAbstractable(S)\r\n requires COperationNumberIsAbstractable(opn)\r\n requires SetOfMessage1b(S)\r\n requires AllAcceptorsHadNoProposal(S, opn)\r\n ensures LSetOfMessage1b(AbstractifySetOfCPacketsToSetOfRslPackets(S))\r\n ensures LAllAcceptorsHadNoProposal(AbstractifySetOfCPacketsToSetOfRslPackets(S),\r\n AbstractifyCOperationNumberToOperationNumber(opn))\r\n{\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(S);\r\n}\r\n\r\nlemma lemma_NotAllAcceptorsHadNoProposalAbstractifies(S:set, opn:COperationNumber)\r\n requires CPacketsIsAbstractable(S)\r\n requires SetOfMessage1b(S)\r\n requires COperationNumberIsAbstractable(opn)\r\n requires !AllAcceptorsHadNoProposal(S, opn)\r\n ensures LSetOfMessage1b(AbstractifySetOfCPacketsToSetOfRslPackets(S))\r\n ensures !LAllAcceptorsHadNoProposal(AbstractifySetOfCPacketsToSetOfRslPackets(S),\r\n AbstractifyCOperationNumberToOperationNumber(opn))\r\n{\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(S);\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n\r\n var p :| p in S && opn in p.msg.votes.v;\r\n assert AbstractifyCPacketToRslPacket(p) in AbstractifySetOfCPacketsToSetOfRslPackets(S);\r\n //assert !(AbstractifyCOperationNumberToOperationNumber(opn) in AbstractifyCPacketToRslPacket(p).msg.votes);\r\n reveal AbstractifyCVotesToVotes();\r\n}\r\n\r\n//lemma lemma_SequenceSuffix(s:seq, t:seq, n:int)\r\n// requires s == t\r\nmethod {:timeLimitMultiplier 7} ProposerNominateNewValueAndSend2a(proposer:ProposerState, clock:uint64, log_truncation_point:COperationNumber) returns (proposer':ProposerState, sent_packets:CBroadcast)\r\n requires ProposerIsValid(proposer)\r\n requires COperationNumberIsAbstractable(log_truncation_point)\r\n requires Proposer_CanNominateUsingOperationNumber(proposer, log_truncation_point, COperationNumber(proposer.next_operation_number_to_propose))\r\n requires AllAcceptorsHadNoProposal(proposer.received_1b_packets, COperationNumber(proposer.next_operation_number_to_propose))\r\n //requires |proposer.request_queue| > 0\r\n ensures ProposerIsValid(proposer')\r\n ensures CBroadcastIsValid(sent_packets)\r\n ensures LProposerCanNominateUsingOperationNumber(AbstractifyProposerStateToLProposer(proposer), AbstractifyCOperationNumberToOperationNumber(log_truncation_point), proposer.next_operation_number_to_propose as int)\r\n ensures LAllAcceptorsHadNoProposal(AbstractifyProposerStateToLProposer(proposer).received_1b_packets, AbstractifyProposerStateToLProposer(proposer).next_operation_number_to_propose)\r\n ensures LProposerNominateNewValueAndSend2a(AbstractifyProposerStateToLProposer(proposer), AbstractifyProposerStateToLProposer(proposer'), clock as int, AbstractifyCOperationNumberToOperationNumber(log_truncation_point), AbstractifyCBroadcastToRlsPacketSeq(sent_packets))\r\n ensures proposer.constants == proposer'.constants\r\n ensures OutboundPacketsHasCorrectSrc(Broadcast(sent_packets), proposer.constants.all.config.replica_ids[proposer.constants.my_index])\r\n ensures proposer'.election_state.cur_req_set == proposer.election_state.cur_req_set\r\n ensures proposer'.election_state.prev_req_set == proposer.election_state.prev_req_set\r\n{\r\n var batchSize := if |proposer.request_queue| <= proposer.constants.all.params.max_batch_size as int || proposer.constants.all.params.max_batch_size < 0 then |proposer.request_queue| else proposer.constants.all.params.max_batch_size as int;\r\n var v := proposer.request_queue[..batchSize];\r\n var opn := proposer.next_operation_number_to_propose;\r\n var opn_op := COperationNumber(proposer.next_operation_number_to_propose);\r\n //var sum := LCappedAdditionImpl(opn, 1, proposer.constants.all.params);\r\n var clock_sum := UpperBoundedAdditionImpl(clock, proposer.constants.all.params.max_batch_delay, proposer.constants.all.params.max_integer_val);\r\n var newTimer:CIncompleteBatchTimer := if |proposer.request_queue| > batchSize as int then CIncompleteBatchTimerOn(clock_sum) else CIncompleteBatchTimerOff();\r\n //print(\"Proposer sending 2a about new value in ballot\", proposer.max_ballot_i_sent_1a, \"operation\", opn_op, \"value\", v, \"\\n\");\r\n\r\n proposer' := proposer.(request_queue := proposer.request_queue[batchSize..],\r\n next_operation_number_to_propose := opn + 1,\r\n incomplete_batch_timer := newTimer);\r\n var msg := CMessage_2a(proposer.max_ballot_i_sent_1a, opn_op, v);\r\n assert Marshallable(msg);\r\n sent_packets := BuildBroadcastToEveryone(proposer.constants.all.config, proposer.constants.my_index, msg);\r\n \r\n lemma_ProposerCanNominateUsingOperationNumberAbstractifies(proposer, log_truncation_point, COperationNumber(proposer.next_operation_number_to_propose));\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(proposer.received_1b_packets);\r\n\r\n ghost var ref_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n ghost var ref_proposer' := AbstractifyProposerStateToLProposer(proposer');\r\n ghost var ref_logTruncationPoint := AbstractifyCOperationNumberToOperationNumber(log_truncation_point);\r\n ghost var batchSizeGhost := \r\n if |ref_proposer.request_queue| <= ref_proposer.constants.all.params.max_batch_size || ref_proposer.constants.all.params.max_batch_size < 0 \r\n then |ref_proposer.request_queue|\r\n else ref_proposer.constants.all.params.max_batch_size;\r\n assert batchSizeGhost == batchSize;\r\n assert {:split_here} true;\r\n ghost var vGhost := ref_proposer.request_queue[..batchSizeGhost];\r\n ghost var opnGhost := ref_proposer.next_operation_number_to_propose;\r\n ghost var s' := ref_proposer';\r\n ghost var s := ref_proposer;\r\n assert vGhost == AbstractifyCRequestBatchToRequestBatch(v);\r\n assert s'.request_queue == s.request_queue[batchSize..];\r\n assert s'.next_operation_number_to_propose == s.next_operation_number_to_propose + 1;\r\n assert s'.incomplete_batch_timer == if |s.request_queue| > batchSize then IncompleteBatchTimerOn(UpperBoundedAddition(clock as int, s.constants.all.params.max_batch_delay, s.constants.all.params.max_integer_val)) else IncompleteBatchTimerOff();\r\n\r\n assert LBroadcastToEveryone(AbstractifyCPaxosConfigurationToConfiguration(proposer.constants.all.config), proposer.constants.my_index as int, AbstractifyCMessageToRslMessage(msg), AbstractifyCBroadcastToRlsPacketSeq(sent_packets));\r\n assert AbstractifyCMessageToRslMessage(msg) == RslMessage_2a(AbstractifyProposerStateToLProposer(proposer).max_ballot_i_sent_1a, AbstractifyCOperationNumberToOperationNumber(opn_op), AbstractifyCRequestBatchToRequestBatch(v));\r\n assert vGhost == AbstractifyCRequestBatchToRequestBatch(v); \r\n assert LBroadcastToEveryone(ref_proposer.constants.all.config, \r\n ref_proposer.constants.my_index, \r\n RslMessage_2a(ref_proposer.max_ballot_i_sent_1a, opnGhost, vGhost), \r\n AbstractifyCBroadcastToRlsPacketSeq(sent_packets));\r\n \r\n assert {:split_here} true;\r\n assert 0 <= batchSize <= |proposer.request_queue|;\r\n lemma_AbstractifyCRequestsSeqToRequestsSeq_suffix(proposer.request_queue, batchSize);\r\n assert AbstractifyCRequestsSeqToRequestsSeq(proposer.request_queue[batchSize..]) == AbstractifyCRequestsSeqToRequestsSeq(proposer.request_queue)[batchSize..];\r\n assert AbstractifyCRequestsSeqToRequestsSeq(proposer.request_queue[..batchSize]) == AbstractifyCRequestsSeqToRequestsSeq(proposer.request_queue)[..batchSize];\r\n \r\n assert proposer'.request_queue == proposer.request_queue[batchSize..];\r\n assert ref_proposer'.request_queue == ref_proposer.request_queue[batchSize..];\r\n assert ref_proposer'.next_operation_number_to_propose == UpperBoundedAddition(ref_proposer.next_operation_number_to_propose, 1, ref_proposer.constants.all.params.max_integer_val);\r\n assert ref_proposer'.incomplete_batch_timer == AbstractifyCIncompleteBatchTimerToIncompleteBatchTimer(newTimer);\r\n assert ProposerIsValid(proposer');\r\n assert CBroadcastIsValid(sent_packets);\r\n assert LProposerCanNominateUsingOperationNumber(AbstractifyProposerStateToLProposer(proposer), AbstractifyCOperationNumberToOperationNumber(log_truncation_point), proposer.next_operation_number_to_propose as int);\r\n assert LAllAcceptorsHadNoProposal(AbstractifyProposerStateToLProposer(proposer).received_1b_packets, AbstractifyProposerStateToLProposer(proposer).next_operation_number_to_propose);\r\n assert {:split_here} true;\r\n \r\n assert LProposerNominateNewValueAndSend2a(AbstractifyProposerStateToLProposer(proposer), AbstractifyProposerStateToLProposer(proposer'), clock as int, AbstractifyCOperationNumberToOperationNumber(log_truncation_point), AbstractifyCBroadcastToRlsPacketSeq(sent_packets));\r\n assert proposer.constants == proposer'.constants;\r\n assert OutboundPacketsHasCorrectSrc(Broadcast(sent_packets), proposer.constants.all.config.replica_ids[proposer.constants.my_index]);\r\n}\r\n\r\npredicate ExistsCBallotInS(v:CRequestBatch, c:CBallot, S:set, opn:COperationNumber)\r\n// requires CRequestIsAbstractable(v) && COperationNumberIsAbstractable(opn) && CBallotIsAbstractable(c)\r\n// requires CPacketsIsAbstractable(S)\r\n requires SetOfMessage1b(S)\r\n{\r\n exists p :: && p in S\r\n && opn in p.msg.votes.v\r\n && p.msg.votes.v[opn].max_value_bal==c\r\n && p.msg.votes.v[opn].max_val==v\r\n}\r\n\r\npredicate CValIsHighestNumberedProposalAtBallot(v:CRequestBatch, c:CBallot, S:set, opn:COperationNumber)\r\n requires CBallotIsAbstractable(c) && CPacketsIsAbstractable(S) && COperationNumberIsAbstractable(opn)\r\n requires SetOfMessage1b(S)\r\n{\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(S);\r\n && LMaxBallotInS(AbstractifyCBallotToBallot(c), AbstractifySetOfCPacketsToSetOfRslPackets(S),\r\n AbstractifyCOperationNumberToOperationNumber(opn))\r\n && ExistsCBallotInS(v, c, S, opn)\r\n}\r\n\r\npredicate CValIsHighestNumberedProposal(v:CRequestBatch, S:set, opn:COperationNumber)\r\n requires CRequestBatchIsAbstractable(v) && COperationNumberIsAbstractable(opn)\r\n requires CPacketsIsAbstractable(S)\r\n requires SetOfMessage1b(S)\r\n{\r\n exists c :: CBallotIsAbstractable(c) && CValIsHighestNumberedProposalAtBallot(v, c, S, opn)\r\n}\r\n\r\nlemma lemma_CValIsHighestNumberedProposalAbstractifies(v:CRequestBatch, bal:CBallot, S:set, opn:COperationNumber)\r\n requires CRequestBatchIsAbstractable(v) && CBallotIsAbstractable(bal) && CPacketsIsAbstractable(S) && COperationNumberIsAbstractable(opn)\r\n requires SetOfMessage1b(S)\r\n requires CValIsHighestNumberedProposal(v, S, opn)\r\n requires CValIsHighestNumberedProposalAtBallot(v, bal, S, opn)\r\n ensures LSetOfMessage1b(AbstractifySetOfCPacketsToSetOfRslPackets(S))\r\n ensures LValIsHighestNumberedProposal(AbstractifyCRequestBatchToRequestBatch(v), AbstractifySetOfCPacketsToSetOfRslPackets(S), AbstractifyCOperationNumberToOperationNumber(opn))\r\n ensures LValIsHighestNumberedProposalAtBallot(AbstractifyCRequestBatchToRequestBatch(v), AbstractifyCBallotToBallot(bal), AbstractifySetOfCPacketsToSetOfRslPackets(S), AbstractifyCOperationNumberToOperationNumber(opn))\r\n{\r\n reveal AbstractifyCVotesToVotes();\r\n\r\n var c :| CBallotIsAbstractable(c) && CValIsHighestNumberedProposalAtBallot(v, c, S, opn);\r\n var ref_c := AbstractifyCBallotToBallot(c);\r\n var ref_v := AbstractifyCRequestBatchToRequestBatch(v);\r\n var ref_S := AbstractifySetOfCPacketsToSetOfRslPackets(S);\r\n var ref_opn := AbstractifyCOperationNumberToOperationNumber(opn);\r\n forall ensures LMaxBallotInS(ref_c, ref_S, ref_opn)\r\n {\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(S);\r\n }\r\n assert ExistsCBallotInS(v, c, S, opn);\r\n var p :| && p in S\r\n && opn in p.msg.votes.v\r\n && p.msg.votes.v[opn].max_value_bal==c\r\n && p.msg.votes.v[opn].max_val==v;\r\n var ref_p := AbstractifyCPacketToRslPacket(p);\r\n\r\n forall ensures ref_p in ref_S\r\n {\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n }\r\n assert ref_opn in ref_p.msg.votes;\r\n assert ref_p.msg.votes[ref_opn].max_value_bal == ref_c;\r\n assert ref_p.msg.votes[ref_opn].max_val == ref_v;\r\n\r\n assert LExistsBallotInS(ref_v, ref_c, ref_S, ref_opn);\r\n assert LValIsHighestNumberedProposalAtBallot(ref_v, ref_c, ref_S, ref_opn);\r\n assert LValIsHighestNumberedProposal(ref_v, ref_S, ref_opn);\r\n\r\n var ref_bal := AbstractifyCBallotToBallot(bal);\r\n assert ExistsCBallotInS(v, bal, S, opn);\r\n\r\n var p' :| && p' in S\r\n && opn in p'.msg.votes.v\r\n && p'.msg.votes.v[opn].max_value_bal==bal\r\n && p'.msg.votes.v[opn].max_val==v;\r\n\r\n assert AbstractifyCRequestBatchToRequestBatch(p'.msg.votes.v[opn].max_val) == AbstractifyCRequestBatchToRequestBatch(v);\r\n\r\n var ref_p' := AbstractifyCPacketToRslPacket(p');\r\n\r\n forall ensures ref_p' in ref_S\r\n {\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n }\r\n\r\n assert ref_opn in ref_p'.msg.votes;\r\n assert ref_p'.msg.votes[ref_opn].max_value_bal == ref_bal;\r\n assert ref_p'.msg.votes[ref_opn].max_val == ref_v;\r\n assert LExistsBallotInS(ref_v, ref_bal, ref_S, ref_opn);\r\n\r\n assert LValIsHighestNumberedProposalAtBallot(AbstractifyCRequestBatchToRequestBatch(v), AbstractifyCBallotToBallot(bal), AbstractifySetOfCPacketsToSetOfRslPackets(S), AbstractifyCOperationNumberToOperationNumber(opn));\r\n}\r\n\r\n\r\nmethod {:timeLimitMultiplier 5} FindValWithHighestNumberedProposal(received_1b_packets:set, opn:COperationNumber) returns (v:CRequestBatch)\r\n requires received_1b_packets != {}\r\n requires COperationNumberIsAbstractable(opn)\r\n requires SetOfMessage1b(received_1b_packets)\r\n requires CPacketsIsAbstractable(received_1b_packets)\r\n requires !AllAcceptorsHadNoProposal(received_1b_packets, opn)\r\n requires forall p :: p in received_1b_packets ==> ValidVotes(p.msg.votes)\r\n ensures CRequestBatchIsAbstractable(v)\r\n ensures ValidRequestBatch(v)\r\n ensures LSetOfMessage1b(AbstractifySetOfCPacketsToSetOfRslPackets(received_1b_packets))\r\n ensures LValIsHighestNumberedProposal(AbstractifyCRequestBatchToRequestBatch(v), AbstractifySetOfCPacketsToSetOfRslPackets(received_1b_packets), AbstractifyCOperationNumberToOperationNumber(opn))\r\n{\r\n var packets:set;\r\n ghost var processedPackets:set;\r\n\r\n packets := received_1b_packets;\r\n var pkt :| pkt in packets && opn in pkt.msg.votes.v;\r\n v := pkt.msg.votes.v[opn].max_val;\r\n var bal := pkt.msg.votes.v[opn].max_value_bal;\r\n var p_bal := pkt;\r\n packets := packets - {pkt};\r\n processedPackets := {pkt};\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n reveal AbstractifyCVotesToVotes();\r\n ghost var p := AbstractifyCPacketToRslPacket(pkt);\r\n ghost var S := AbstractifySetOfCPacketsToSetOfRslPackets(processedPackets);\r\n ghost var opn_s := AbstractifyCOperationNumberToOperationNumber(opn);\r\n\r\n while (packets != {})\r\n decreases packets\r\n invariant packets + processedPackets == received_1b_packets\r\n invariant processedPackets == received_1b_packets - packets\r\n invariant CRequestBatchIsAbstractable(v) && CBallotIsAbstractable(bal) && CPacketIsAbstractable(p_bal) && p_bal in processedPackets && opn in p_bal.msg.votes.v && v == p_bal.msg.votes.v[opn].max_val && bal == p_bal.msg.votes.v[opn].max_value_bal\r\n invariant forall q :: q in processedPackets && opn in q.msg.votes.v ==> CCBalLeq(q.msg.votes.v[opn].max_value_bal, p_bal.msg.votes.v[opn].max_value_bal)\r\n invariant p_bal in processedPackets\r\n invariant opn in p_bal.msg.votes.v\r\n invariant p_bal.msg.votes.v[opn].max_value_bal==bal\r\n invariant p_bal.msg.votes.v[opn].max_val==v\r\n invariant ExistsCBallotInS(v, bal, processedPackets, opn)\r\n invariant CValIsHighestNumberedProposalAtBallot(v, bal, processedPackets, opn)\r\n invariant CValIsHighestNumberedProposal(v, processedPackets, opn)\r\n invariant ValidRequestBatch(v)\r\n {\r\n pkt :| pkt in packets;\r\n if (opn in pkt.msg.votes.v) {\r\n var foundHigherBallot := CBalLeq(bal, pkt.msg.votes.v[opn].max_value_bal);\r\n\r\n if (foundHigherBallot) {\r\n p_bal := pkt;\r\n v := pkt.msg.votes.v[opn].max_val;\r\n bal := pkt.msg.votes.v[opn].max_value_bal;\r\n }\r\n }\r\n packets := packets - {pkt};\r\n processedPackets := processedPackets + {pkt};\r\n reveal AbstractifyCVotesToVotes();\r\n }\r\n\r\n assert processedPackets == received_1b_packets;\r\n p := AbstractifyCPacketToRslPacket(p_bal);\r\n assert CValIsHighestNumberedProposal(v, received_1b_packets, opn);\r\n lemma_CValIsHighestNumberedProposalAbstractifies(v, bal, received_1b_packets, opn);\r\n assert LValIsHighestNumberedProposalAtBallot(AbstractifyCRequestBatchToRequestBatch(v), AbstractifyCBallotToBallot(bal), AbstractifySetOfCPacketsToSetOfRslPackets(received_1b_packets), AbstractifyCOperationNumberToOperationNumber(opn));\r\n}\r\n\r\n\r\nmethod ProposerNominateOldValueAndSend2a(proposer:ProposerState,log_truncation_point:COperationNumber) returns (proposer':ProposerState, sent_packets:CBroadcast)\r\n requires ProposerIsValid(proposer)\r\n requires COperationNumberIsAbstractable(log_truncation_point)\r\n requires Proposer_CanNominateUsingOperationNumber(proposer, log_truncation_point, COperationNumber(proposer.next_operation_number_to_propose))\r\n requires !AllAcceptorsHadNoProposal(proposer.received_1b_packets, COperationNumber(proposer.next_operation_number_to_propose))\r\n ensures ProposerIsValid(proposer')\r\n ensures CBroadcastIsValid(sent_packets)\r\n ensures LProposerCanNominateUsingOperationNumber(AbstractifyProposerStateToLProposer(proposer), AbstractifyCOperationNumberToOperationNumber(log_truncation_point), proposer.next_operation_number_to_propose as int)\r\n ensures LSetOfMessage1b(AbstractifySetOfCPacketsToSetOfRslPackets(proposer.received_1b_packets))\r\n ensures !LAllAcceptorsHadNoProposal(AbstractifyProposerStateToLProposer(proposer).received_1b_packets, AbstractifyProposerStateToLProposer(proposer).next_operation_number_to_propose)\r\n ensures LProposerNominateOldValueAndSend2a(AbstractifyProposerStateToLProposer(proposer), AbstractifyProposerStateToLProposer(proposer'), AbstractifyCOperationNumberToOperationNumber(log_truncation_point), AbstractifyCBroadcastToRlsPacketSeq(sent_packets))\r\n ensures proposer.constants == proposer'.constants\r\n ensures OutboundPacketsHasCorrectSrc(Broadcast(sent_packets), proposer.constants.all.config.replica_ids[proposer.constants.my_index])\r\n ensures proposer'.election_state.cur_req_set == proposer.election_state.cur_req_set\r\n ensures proposer'.election_state.prev_req_set == proposer.election_state.prev_req_set\r\n{\r\n ghost var r_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n var opn := proposer.next_operation_number_to_propose;\r\n var opn_op := COperationNumber(proposer.next_operation_number_to_propose);\r\n var val := FindValWithHighestNumberedProposal(proposer.received_1b_packets, opn_op);\r\n assert LValIsHighestNumberedProposal(AbstractifyCRequestBatchToRequestBatch(val), AbstractifySetOfCPacketsToSetOfRslPackets(proposer.received_1b_packets), AbstractifyCOperationNumberToOperationNumber(opn_op));\r\n var sum := opn + 1;\r\n //print(\"Proposer sending 2a about old value in ballot\", proposer.max_ballot_i_sent_1a, \"operation\", opn_op, \"value\", val, \"\\n\");\r\n \r\n proposer' := proposer.(next_operation_number_to_propose := sum);\r\n\r\n // Update the protocol version too\r\n ghost var L_opn := r_proposer.next_operation_number_to_propose;\r\n ghost var r_proposer' := r_proposer.(next_operation_number_to_propose := UpperBoundedAddition(r_proposer.next_operation_number_to_propose, 1, r_proposer.constants.all.params.max_integer_val));\r\n\r\n var msg := CMessage_2a(proposer.max_ballot_i_sent_1a, opn_op, val);\r\n assert Marshallable(msg);\r\n sent_packets := BuildBroadcastToEveryone(proposer.constants.all.config, proposer.constants.my_index, msg);\r\n\r\n lemma_ProposerCanNominateUsingOperationNumberAbstractifies(proposer, log_truncation_point, COperationNumber(proposer.next_operation_number_to_propose));\r\n lemma_NotAllAcceptorsHadNoProposalAbstractifies(proposer.received_1b_packets, opn_op);\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(proposer.received_1b_packets);\r\n reveal AbstractifyCVotesToVotes();\r\n\r\n assert Eq_LProposer(r_proposer', AbstractifyProposerStateToLProposer(proposer'));\r\n}\r\n\r\n/*\r\nmethod ProposerNominateNoOpValueAndSend2a(proposer:ProposerState,log_truncation_point:COperationNumber) returns (proposer':ProposerState, sent_packets:CBroadcast)\r\n requires ProposerIsValid(proposer)\r\n requires COperationNumberIsAbstractable(log_truncation_point)\r\n requires Proposer_CanNominateUsingOperationNumber(proposer, log_truncation_point, COperationNumber(proposer.next_operation_number_to_propose))\r\n requires AllAcceptorsHadNoProposal(proposer.received_1b_packets, COperationNumber(proposer.next_operation_number_to_propose))\r\n requires exists opn:COperationNumber :: opn.n > proposer.next_operation_number_to_propose && !AllAcceptorsHadNoProposal(proposer.received_1b_packets, opn)\r\n ensures ProposerIsValid(proposer')\r\n ensures CBroadcastIsValid(sent_packets)\r\n ensures LProposerCanNominateUsingOperationNumber(AbstractifyProposerStateToLProposer(proposer), AbstractifyCOperationNumberToOperationNumber(log_truncation_point), proposer.next_operation_number_to_propose as int)\r\n ensures LSetOfMessage1b(AbstractifyProposerStateToLProposer(proposer).received_1b_packets)\r\n ensures LAllAcceptorsHadNoProposal(AbstractifyProposerStateToLProposer(proposer).received_1b_packets, AbstractifyProposerStateToLProposer(proposer).next_operation_number_to_propose)\r\n ensures exists l_opn :: l_opn > AbstractifyProposerStateToLProposer(proposer).next_operation_number_to_propose &&\r\n !LAllAcceptorsHadNoProposal(AbstractifyProposerStateToLProposer(proposer).received_1b_packets, l_opn)\r\n ensures LProposerNominateNewValueAndSend2a(AbstractifyProposerStateToLProposer(proposer), AbstractifyProposerStateToLProposer(proposer'), AbstractifyCOperationNumberToOperationNumber(log_truncation_point), AbstractifyCBroadcastToRlsPacketSeq(sent_packets))\r\n ensures proposer.constants == proposer'.constants\r\n ensures OutboundPacketsHasCorrectSrc(Broadcast(sent_packets), proposer.constants.all.config.replica_ids[proposer.constants.my_index])\r\n{\r\n var v := [];\r\n var opn := proposer.next_operation_number_to_propose;\r\n var opn_op := COperationNumber(proposer.next_operation_number_to_propose);\r\n var sum := LCappedAdditionImpl(opn, 1, proposer.constants.all.params);\r\n ghost var ref_op := AbstractifyCOperationNumberToOperationNumber(opn_op);\r\n ghost var ref_v := AbstractifyCRequestBatchToRequestBatch(v);\r\n\r\n //print(\"Proposer sending 2a about no-op in ballot\", proposer.max_ballot_i_sent_1a, \"operation\", opn_op, \"value\", v, \"\\n\");\r\n\r\n proposer' := proposer[next_operation_number_to_propose := sum];\r\n var msg := CMessage_2a(proposer.max_ballot_i_sent_1a, opn_op, v);\r\n sent_packets := BuildBroadcastToEveryone(proposer.constants.all.config, proposer.constants.my_index, msg);\r\n\r\n ghost var ref_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n\r\n lemma_ProposerCanNominateUsingOperationNumberAbstractifies(proposer, log_truncation_point, COperationNumber(proposer.next_operation_number_to_propose));\r\n lemma_AllAcceptorsHadNoProposalAbstractifies(proposer.received_1b_packets, opn_op);\r\n\r\n ghost var e_opn:COperationNumber :| e_opn.n > proposer.next_operation_number_to_propose && !AllAcceptorsHadNoProposal(proposer.received_1b_packets, e_opn);\r\n ghost var ref_e_opn := AbstractifyCOperationNumberToOperationNumber(e_opn);\r\n\r\n lemma_NotAllAcceptorsHadNoProposalAbstractifies(proposer.received_1b_packets, e_opn);\r\n assert ref_e_opn > ref_proposer.next_operation_number_to_propose && !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, ref_e_opn);\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(proposer.received_1b_packets);\r\n reveal AbstractifyCVotesToVotes();\r\n\r\n ghost var ref_proposer' := AbstractifyProposerStateToLProposer(proposer');\r\n ghost var ref_logTruncationPoint := AbstractifyCOperationNumberToOperationNumber(log_truncation_point);\r\n\r\n assert ref_proposer'.next_operation_number_to_propose == LCappedAddition(ref_proposer.next_operation_number_to_propose, 1, ref_proposer.constants.all.params);\r\n}\r\n*/\r\n\r\nmethod IsAfterLogTruncationPointImpl(opn:COperationNumber, received_1b_packets:set) returns (b:bool)\r\n requires COperationNumberIsAbstractable(opn) && CPacketsIsAbstractable(received_1b_packets)\r\n ensures b == IsAfterLogTruncationPoint(opn, received_1b_packets)\r\n ensures b == LIsAfterLogTruncationPoint(AbstractifyCOperationNumberToOperationNumber(opn), AbstractifySetOfCPacketsToSetOfRslPackets(received_1b_packets))\r\n{\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n lemma_AbstractifyCPacketToRslPacket_isInjective();\r\n assert forall p :: CPacketIsAbstractable(p) && AbstractifyCPacketToRslPacket(p).msg.RslMessage_1b? ==> CPacketIsInjectiveType(p);\r\n \r\n b := (forall p :: p in received_1b_packets && p.msg.CMessage_1b? ==> p.msg.log_truncation_point.n <= opn.n);\r\n}\r\n\r\nmethod Proposer_CanNominateUsingOperationNumberImpl(proposer:ProposerState,log_truncation_point:COperationNumber) returns (b:bool)\r\n requires ProposerIsValid(proposer)\r\n requires COperationNumberIsAbstractable(log_truncation_point)\r\n ensures b == Proposer_CanNominateUsingOperationNumber(proposer, log_truncation_point,\r\n COperationNumber(proposer.next_operation_number_to_propose))\r\n ensures b == LProposerCanNominateUsingOperationNumber(AbstractifyProposerStateToLProposer(proposer),\r\n AbstractifyCOperationNumberToOperationNumber(log_truncation_point),\r\n AbstractifyProposerStateToLProposer(proposer).next_operation_number_to_propose)\r\n{\r\n if (proposer.current_state == 2) {\r\n var opn := COperationNumber(proposer.next_operation_number_to_propose);\r\n var quorum_size := MinCQuorumSize(proposer.constants.all.config);\r\n\r\n var after_trunk;\r\n if (opn.n >= proposer.maxLogTruncationPoint.n) {\r\n after_trunk := true;\r\n } else { \r\n after_trunk := IsAfterLogTruncationPointImpl(opn, proposer.received_1b_packets);\r\n }\r\n var sum := UpperBoundedAdditionImpl(log_truncation_point.n, proposer.constants.all.params.max_log_length, proposer.constants.all.params.max_integer_val);\r\n assert SetOfMessage1bAboutBallot(proposer.received_1b_packets, proposer.max_ballot_i_sent_1a);\r\n lemma_Received1bBound(proposer);\r\n\r\n b := && proposer.election_state.current_view == proposer.max_ballot_i_sent_1a\r\n && proposer.current_state == 2\r\n && |proposer.received_1b_packets| as uint64 >= quorum_size\r\n // Should come for free from ProposerIsValid\r\n //&& SetOfMessage1bAboutBallot(proposer.received_1b_packets, proposer.max_ballot_i_sent_1a)\r\n && after_trunk\r\n && opn.n < sum\r\n && opn.n >=0;\r\n\r\n assert b == Proposer_CanNominateUsingOperationNumber(proposer, log_truncation_point,\r\n COperationNumber(proposer.next_operation_number_to_propose));\r\n if b {\r\n lemma_ProposerCanNominateUsingOperationNumberAbstractifies(proposer, log_truncation_point, COperationNumber(proposer.next_operation_number_to_propose));\r\n } else {\r\n lemma_NotProposerCanNominateUsingOperationNumberAbstractifies(proposer, log_truncation_point, COperationNumber(proposer.next_operation_number_to_propose));\r\n }\r\n } else {\r\n b := false;\r\n }\r\n}\r\n\r\nmethod {:timeLimitMultiplier 6} AllAcceptorsHadNoProposalImpl(proposer:ProposerState) returns (b:bool)\r\n requires ProposerIsValid(proposer)\r\n requires proposer.current_state == 2\r\n ensures LSetOfMessage1b(AbstractifyProposerStateToLProposer(proposer).received_1b_packets)\r\n ensures b == AllAcceptorsHadNoProposal(proposer.received_1b_packets,\r\n COperationNumber(proposer.next_operation_number_to_propose))\r\n ensures b == LAllAcceptorsHadNoProposal(AbstractifyProposerStateToLProposer(proposer).received_1b_packets,\r\n AbstractifyProposerStateToLProposer(proposer).next_operation_number_to_propose)\r\n{\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n reveal AbstractifyCVotesToVotes();\r\n lemma_AbstractifyCPacketToRslPacket_isInjective();\r\n lemma_AbstractifyCOperationNumberToOperationNumber_isInjective();\r\n assert forall p :: p in proposer.received_1b_packets ==> CPacketIsInjectiveType(p);\r\n\r\n var start_time := Time.GetDebugTimeTicks();\r\n \r\n var end_time; \r\n \r\n if(proposer.next_operation_number_to_propose < proposer.maxOpnWithProposal.n || proposer.maxOpnWithProposal.n == 0xffff_ffff_ffff_ffff) {\r\n var opn := COperationNumber(proposer.next_operation_number_to_propose);\r\n b := (forall p :: p in proposer.received_1b_packets ==> !(opn in p.msg.votes.v));\r\n end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"AllAcceptorsHadNoProposalImpl_full\", start_time, end_time);\r\n //print(\"AllAcceptorsHadNoProposalImpl_full: Doing full search, nextOpnToPropose = \", proposer.next_operation_number_to_propose, \" and maxOpnWithProposal = \", proposer.maxOpnWithProposal.n, \"\\n\"); \r\n } else {\r\n b := true;\r\n end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"AllAcceptorsHadNoProposalImpl_memoized\", start_time, end_time);\r\n //print(\"AllAcceptorsHadNoProposalImpl_memoized: Memoized, nextOpnToPropose = \", proposer.next_operation_number_to_propose, \" and maxOpnWithProposal = \", proposer.maxOpnWithProposal.n, \"\\n\"); \r\n }\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(proposer.received_1b_packets);\r\n}\r\n\r\nlemma {:timeLimitMultiplier 6} lemma_AllAcceptorsHadNoProposalImpl(proposer:ProposerState)\r\n requires ProposerIsValid(proposer)\r\n requires proposer.current_state == 2\r\n requires proposer.maxOpnWithProposal.n < 0xffff_ffff_ffff_ffff\r\n requires proposer.next_operation_number_to_propose >= proposer.maxOpnWithProposal.n\r\n ensures LSetOfMessage1b(AbstractifyProposerStateToLProposer(proposer).received_1b_packets)\r\n ensures AllAcceptorsHadNoProposal(proposer.received_1b_packets,\r\n COperationNumber(proposer.next_operation_number_to_propose))\r\n ensures LAllAcceptorsHadNoProposal(AbstractifyProposerStateToLProposer(proposer).received_1b_packets,\r\n AbstractifyProposerStateToLProposer(proposer).next_operation_number_to_propose)\r\n{\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n reveal AbstractifyCVotesToVotes();\r\n lemma_AbstractifyCPacketToRslPacket_isInjective();\r\n lemma_AbstractifyCOperationNumberToOperationNumber_isInjective();\r\n assert forall p :: p in proposer.received_1b_packets ==> CPacketIsInjectiveType(p);\r\n \r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(proposer.received_1b_packets);\r\n}\r\n\r\npredicate ExistsPred(proposer:ProposerState, ref_proposer:LProposer, existsOpn:bool)\r\n requires ProposerIsAbstractable(proposer)\r\n requires ref_proposer == AbstractifyProposerStateToLProposer(proposer)\r\n requires LSetOfMessage1b(ref_proposer.received_1b_packets)\r\n requires ProposerIsValid(proposer)\r\n{\r\n existsOpn <==> (exists opn :: && opn > ref_proposer.next_operation_number_to_propose \r\n && LSetOfMessage1b(ref_proposer.received_1b_packets)\r\n && !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn))\r\n}\r\n\r\npredicate AnAcceptorHadProposal(ref_proposer:LProposer, opn:OperationNumber)\r\n requires LSetOfMessage1b(ref_proposer.received_1b_packets)\r\n{\r\n opn > ref_proposer.next_operation_number_to_propose &&\r\n !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn)\r\n}\r\n\r\nmethod DidSomeAcceptorHaveProposal(proposer:ProposerState) returns (b:bool) //, opn:COperationNumber)\r\n requires ProposerIsValid(proposer)\r\n requires proposer.current_state == 2\r\n ensures LSetOfMessage1b(AbstractifyProposerStateToLProposer(proposer).received_1b_packets)\r\n ensures b <==> (exists opn:COperationNumber ::\r\n opn.n > proposer.next_operation_number_to_propose &&\r\n !AllAcceptorsHadNoProposal(proposer.received_1b_packets, opn))\r\n ensures b == var ref_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n (exists opn :: opn > ref_proposer.next_operation_number_to_propose &&\r\n !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn))\r\n{\r\n reveal AbstractifyCVotesToVotes();\r\n lemma_AbstractifyCPacketToRslPacket_isInjective();\r\n lemma_AbstractifyCOperationNumberToOperationNumber_isInjective();\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(proposer.received_1b_packets);\r\n assert forall p :: p in proposer.received_1b_packets ==> CPacketIsInjectiveType(p);\r\n\r\n if proposer.next_operation_number_to_propose >= proposer.maxOpnWithProposal.n {\r\n b := false;\r\n } else {\r\n b := (exists p :: p in proposer.received_1b_packets &&\r\n (exists opn:COperationNumber :: opn in p.msg.votes.v && opn.n > proposer.next_operation_number_to_propose));\r\n }\r\n // The \"exists opn\" needs a trigger that relates to \"opn.n > ...\":\r\n ghost var gt := (i:int, j:int) => i > j;\r\n assert b <==>\r\n (exists p :: p in proposer.received_1b_packets &&\r\n (exists opn:COperationNumber :: opn in p.msg.votes.v && gt(AbstractifyCOperationNumberToOperationNumber(opn), proposer.next_operation_number_to_propose as int)));\r\n\r\n ghost var ref_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n if ((exists opn :: gt(opn, ref_proposer.next_operation_number_to_propose) &&\r\n !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn))) {\r\n var ref_opn :| gt(ref_opn, ref_proposer.next_operation_number_to_propose) &&\r\n !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, ref_opn);\r\n var ref_p :| ref_p in ref_proposer.received_1b_packets && ref_opn in ref_p.msg.votes;\r\n\r\n forall ensures exists p :: p in proposer.received_1b_packets && ref_p == AbstractifyCPacketToRslPacket(p)\r\n {\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n }\r\n\r\n var p :| p in proposer.received_1b_packets && ref_p == AbstractifyCPacketToRslPacket(p);\r\n\r\n //assert exists o :: o in p.msg.votes.v && AbstractifyCOperationNumberToOperationNumber(o) == ref_opn;\r\n\r\n assert b;\r\n }\r\n\r\n assert b <==> (exists opn :: gt(opn, ref_proposer.next_operation_number_to_propose) && !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn));\r\n}\r\n\r\nlemma lemma_DidSomeAcceptorHaveProposal(proposer:ProposerState) //, opn:COperationNumber)\r\n requires ProposerIsValid(proposer)\r\n requires proposer.current_state == 2\r\n requires proposer.next_operation_number_to_propose >= proposer.maxOpnWithProposal.n\r\n ensures LSetOfMessage1b(AbstractifyProposerStateToLProposer(proposer).received_1b_packets)\r\n ensures !(exists opn:COperationNumber ::\r\n opn.n > proposer.next_operation_number_to_propose &&\r\n !AllAcceptorsHadNoProposal(proposer.received_1b_packets, opn))\r\n ensures !var ref_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n (exists opn :: opn > ref_proposer.next_operation_number_to_propose &&\r\n !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn))\r\n{\r\n reveal AbstractifyCVotesToVotes();\r\n lemma_AbstractifyCPacketToRslPacket_isInjective();\r\n lemma_AbstractifyCOperationNumberToOperationNumber_isInjective();\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(proposer.received_1b_packets);\r\n assert forall p :: p in proposer.received_1b_packets ==> CPacketIsInjectiveType(p);\r\n\r\n var b := false;\r\n \r\n // The \"exists opn\" needs a trigger that relates to \"opn.n > ...\":\r\n ghost var gt := (i:int, j:int) => i > j;\r\n assert b <==>\r\n (exists p :: p in proposer.received_1b_packets &&\r\n (exists opn:COperationNumber :: opn in p.msg.votes.v && gt(AbstractifyCOperationNumberToOperationNumber(opn), proposer.next_operation_number_to_propose as int)));\r\n\r\n ghost var ref_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n if ((exists opn :: gt(opn, ref_proposer.next_operation_number_to_propose) &&\r\n !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn))) {\r\n var ref_opn :| gt(ref_opn, ref_proposer.next_operation_number_to_propose) &&\r\n !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, ref_opn);\r\n var ref_p :| ref_p in ref_proposer.received_1b_packets && ref_opn in ref_p.msg.votes;\r\n\r\n forall ensures exists p :: p in proposer.received_1b_packets && ref_p == AbstractifyCPacketToRslPacket(p)\r\n {\r\n reveal AbstractifySetOfCPacketsToSetOfRslPackets();\r\n }\r\n\r\n var p :| p in proposer.received_1b_packets && ref_p == AbstractifyCPacketToRslPacket(p);\r\n\r\n //assert exists o :: o in p.msg.votes.v && AbstractifyCOperationNumberToOperationNumber(o) == ref_opn;\r\n\r\n assert b;\r\n }\r\n\r\n assert b <==> (exists opn :: gt(opn, ref_proposer.next_operation_number_to_propose) && !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn));\r\n}\r\n\r\nmethod {:timeLimitMultiplier 12} ProposerMaybeNominateValueAndSend2a(proposer:ProposerState, clock:uint64, log_truncation_point:COperationNumber) returns (proposer':ProposerState, sent_packets:CBroadcast)\r\n requires ProposerIsValid(proposer)\r\n requires COperationNumberIsAbstractable(log_truncation_point)\r\n ensures ProposerIsValid(proposer')\r\n ensures CBroadcastIsValid(sent_packets)\r\n ensures OutboundPacketsHasCorrectSrc(Broadcast(sent_packets), proposer.constants.all.config.replica_ids[proposer.constants.my_index])\r\n ensures LProposerMaybeNominateValueAndSend2a(AbstractifyProposerStateToLProposer(proposer), AbstractifyProposerStateToLProposer(proposer'), clock as int, AbstractifyCOperationNumberToOperationNumber(log_truncation_point), AbstractifyCBroadcastToRlsPacketSeq(sent_packets))\r\n ensures proposer.constants == proposer'.constants\r\n ensures proposer'.election_state.cur_req_set == proposer.election_state.cur_req_set\r\n ensures proposer'.election_state.prev_req_set == proposer.election_state.prev_req_set\r\n{\r\n //var start_time := Time.GetDebugTimeTicks();\r\n var canNominate := Proposer_CanNominateUsingOperationNumberImpl(proposer, log_truncation_point);\r\n //var end_time:= Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"ProposerMaybeNominateValueAndSend2a_preamble_Proposer_CanNominateUsingOperationNumberImpl\", start_time, end_time);\r\n /*\r\n //start_time := Time.GetDebugTimeTicks();\r\n \r\n end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"ProposerMaybeNominateValueAndSend2a_preamble_AllAcceptorsHadNoProposalImpl\", start_time, end_time);\r\n\r\n //start_time := Time.GetDebugTimeTicks();\r\n \r\n end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"ProposerMaybeNominateValueAndSend2a_preamble\", start_time, end_time);\r\n */\r\n //print(\"ProposerMaybeNominateValueAndSend2a: proposer.next_operation_number_to_propose = \", proposer.next_operation_number_to_propose, \", canNominate = \", canNominate, \"\\n\");\r\n \r\n if !canNominate {\r\n proposer' := proposer;\r\n sent_packets := CBroadcastNop;\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(sent_packets);\r\n //var end_timeNotCanNominate:= Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"ProposerMaybeNominateValueAndSend2a_unable\", start_time, end_timeNotCanNominate);\r\n } else {\r\n if (proposer.next_operation_number_to_propose >= proposer.maxOpnWithProposal.n && |proposer.request_queue| == 0 && proposer.maxOpnWithProposal.n < 0xffff_ffff_ffff_ffff) {\r\n lemma_DidSomeAcceptorHaveProposal(proposer);\r\n lemma_AllAcceptorsHadNoProposalImpl(proposer);\r\n \r\n //start_time := Time.GetDebugTimeTicks();\r\n proposer' := proposer;\r\n sent_packets := CBroadcastNop;\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(sent_packets);\r\n //var end_time4 := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"ProposerMaybeNominateValueAndSend2a_nada\", start_time, end_time4);\r\n //print(\"ProposerMaybeNominateValueAndSend2a: proposer.next_operation_number_to_propose = \", proposer.next_operation_number_to_propose, \". NADA\\n\");\r\n } else {\r\n var noProposal := AllAcceptorsHadNoProposalImpl(proposer);\r\n //var end_time2 := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"ProposerMaybeNominateValueAndSend2a_AllAcceptorsHadNoProposalImpl\", start_time, end_time2);\r\n //print(\"ProposerMaybeNominateValueAndSend2a: proposer.next_operation_number_to_propose = \", proposer.next_operation_number_to_propose, \", AllAcceptorsHadNoProposalImpl = \", noProposal, \"\\n\");\r\n if !noProposal {\r\n proposer', sent_packets := ProposerNominateOldValueAndSend2a(proposer, log_truncation_point);\r\n assert OutboundPacketsHasCorrectSrc(Broadcast(sent_packets), proposer.constants.all.config.replica_ids[proposer.constants.my_index]); //OBSERVE\r\n //var end_timeNotNoProposal := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"ProposerMaybeNominateValueAndSend2a_old\", end_time2, end_timeNotNoProposal);\r\n //print(\"ProposerMaybeNominateValueAndSend2a: Nominating old value at proposer.next_operation_number_to_propose = \", proposer.next_operation_number_to_propose, \"\\n\");\r\n } else {\r\n var queueSize := |proposer.request_queue|;\r\n var existsOpn := DidSomeAcceptorHaveProposal(proposer);\r\n ghost var ref_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n assert existsOpn ==> (exists opn :: opn > ref_proposer.next_operation_number_to_propose &&\r\n !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn));\r\n assert ExistsPred(proposer, ref_proposer, existsOpn);\r\n //var end_time3 := Time.GetDebugTimeTicks();\r\n //var ref_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n // (exists opn :: opn > ref_proposer.next_operation_number_to_propose &&\r\n // !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn));\r\n if existsOpn {\r\n assert ExistsPred(proposer, ref_proposer, existsOpn);\r\n assert existsOpn ==> (exists opn :: opn > ref_proposer.next_operation_number_to_propose &&\r\n !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn));\r\n assert exists opn :: opn > ref_proposer.next_operation_number_to_propose &&\r\n !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn);\r\n //ghost var opn :| opn > ref_proposer.next_operation_number_to_propose &&\r\n // !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn);\r\n } else {\r\n assert forall opn :: !(opn > ref_proposer.next_operation_number_to_propose &&\r\n !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn));\r\n }\r\n //assert existsOpn <==> var ref_proposer := AbstractifyProposerStateToLProposer(proposer);(exists opn :: opn > ref_proposer.next_operation_number_to_propose &&\r\n // !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn));\r\n\r\n // ;var ref_proposer := AbstractifyProposerStateToLProposer(proposer);\r\n // (exists opn :: opn > ref_proposer.next_operation_number_to_propose &&\r\n // !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn));\r\n\r\n if (|| (queueSize > 0 && proposer.incomplete_batch_timer.CIncompleteBatchTimerOn? && clock >= proposer.incomplete_batch_timer.when)\r\n || (queueSize >= proposer.constants.all.params.max_batch_size as int)\r\n || existsOpn) {\r\n if existsOpn {\r\n assert ExistsPred(proposer, ref_proposer, existsOpn);\r\n assert existsOpn ==> (exists opn :: opn > ref_proposer.next_operation_number_to_propose &&\r\n !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn));\r\n assert exists opn :: opn > ref_proposer.next_operation_number_to_propose &&\r\n !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn);\r\n //ghost var opn :| opn > ref_proposer.next_operation_number_to_propose &&\r\n // !LAllAcceptorsHadNoProposal(ref_proposer.received_1b_packets, opn);\r\n } else if (queueSize >= proposer.constants.all.params.max_batch_size as int) {\r\n assert |ref_proposer.request_queue| >= ref_proposer.constants.all.params.max_batch_size;\r\n } else if (queueSize > 0 && proposer.incomplete_batch_timer.CIncompleteBatchTimerOn? && clock >= proposer.incomplete_batch_timer.when) {\r\n assert (|ref_proposer.request_queue| > 0 && ref_proposer.incomplete_batch_timer.IncompleteBatchTimerOn? && clock as int >= ref_proposer.incomplete_batch_timer.when);\r\n }\r\n //assert existsOpn <==> \r\n // (exists opn:OperationNumber :: \r\n // (opn > AbstractifyProposerStateToLProposer(proposer).next_operation_number_to_propose \r\n // && !LAllAcceptorsHadNoProposal(AbstractifyProposerStateToLProposer(proposer).received_1b_packets, opn))\r\n // );\r\n proposer', sent_packets := ProposerNominateNewValueAndSend2a(proposer, clock, log_truncation_point);\r\n assert OutboundPacketsHasCorrectSrc(Broadcast(sent_packets), proposer.constants.all.config.replica_ids[proposer.constants.my_index]); //OBSERVE\r\n //var end_timeNominateNew := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"ProposerMaybeNominateValueAndSend2a_new_or_noop\", end_time2, end_timeNominateNew);\r\n //print(\"ProposerMaybeNominateValueAndSend2a: |proposer.request_queue| > 0. Nominating new value at \", proposer.next_operation_number_to_propose, \"\\n\");\r\n } else {\r\n if ( queueSize > 0 && proposer.incomplete_batch_timer.CIncompleteBatchTimerOff? ) {\r\n var sum := UpperBoundedAdditionImpl(clock, proposer.constants.all.params.max_batch_delay, proposer.constants.all.params.max_integer_val);\r\n proposer' := proposer.(incomplete_batch_timer := CIncompleteBatchTimerOn(sum));\r\n sent_packets := CBroadcastNop;\r\n } else {\r\n proposer' := proposer;\r\n sent_packets := CBroadcastNop;\r\n \r\n //RecordTimingSeq(\"ProposerMaybeNominateValueAndSend2a_DidSomeAcceptorHaveProposal\", end_time2, end_time3);\r\n //if existsOpn {\r\n // proposer', sent_packets := ProposerNominateNewValueAndSend2a(proposer, clock, log_truncation_point);\r\n // assert OutboundPacketsHasCorrectSrc(Broadcast(sent_packets), proposer.constants.all.config.replica_ids[proposer.constants.my_index]); //OBSERVE\r\n // var end_timeNoOp := Time.GetDebugTimeTicks();\r\n // RecordTimingSeq(\"ProposerMaybeNominateValueAndSend2a_noop\", start_time, end_timeNoOp);\r\n // //print(\"ProposerMaybeNominateValueAndSend2a: proposer.next_operation_number_to_propose = \", proposer.next_operation_number_to_propose, \", DidSomeAcceptorHaveProposal = \", existsOpn, \"\\n\");\r\n //} else {\r\n // //assert proposer.next_operation_number_to_propose == proposer.maxOpnWithProposal.n;\r\n // //start_time := Time.GetDebugTimeTicks();\r\n // proposer' := proposer;\r\n // sent_packets := CBroadcastNop;\r\n // //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_propertiesProposer(sent_packets);\r\n // var end_time4 := Time.GetDebugTimeTicks();\r\n // RecordTimingSeq(\"ProposerMaybeNominateValueAndSend2a_nada_shouldneverhappen\", start_time, end_time4);\r\n // //print(\"ProposerMaybeNominateValueAndSend2a: proposer.next_operation_number_to_propose = \", proposer.next_operation_number_to_propose, \". NADA\\n\");\r\n //}\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\n\r\nmethod ProposerProcessHeartbeat(proposer:ProposerState, packet:CPacket, clock:uint64, cur_req_set:MutableSet, prev_req_set:MutableSet) returns (proposer':ProposerState)\r\n requires ProposerIsValid(proposer)\r\n requires CPacketIsAbstractable(packet)\r\n requires packet.msg.CMessage_Heartbeat?\r\n requires MutableSet.SetOf(cur_req_set) == proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == proposer.election_state.prev_req_set\r\n modifies cur_req_set, prev_req_set\r\n ensures ProposerIsValid(proposer')\r\n ensures LProposerProcessHeartbeat(AbstractifyProposerStateToLProposer(proposer), AbstractifyProposerStateToLProposer(proposer'), AbstractifyCPacketToRslPacket(packet), clock as int)\r\n ensures proposer.constants == proposer'.constants\r\n ensures MutableSet.SetOf(cur_req_set) == proposer'.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == proposer'.election_state.prev_req_set\r\n{\r\n var election_state' := ElectionProcessHeartbeat(proposer.election_state, packet, clock, cur_req_set, prev_req_set);\r\n\r\n var current_state' := 0;\r\n var request_queue' := [];\r\n var lt := CBalLt(proposer.election_state.current_view, election_state'.current_view);\r\n if lt {\r\n //assert AbstractifyCBallotToBallot(election_state'.current_view) > AbstractifyCBallotToBallot(proposer.election_state.current_view);\r\n current_state' := 0;\r\n request_queue' := [];\r\n } else {\r\n current_state' := proposer.current_state;\r\n request_queue' := proposer.request_queue;\r\n }\r\n\r\n proposer' := proposer.(election_state := election_state', current_state := current_state', request_queue := request_queue');\r\n}\r\n\r\nmethod ProposerCheckForViewTimeout(proposer:ProposerState, clock:uint64, cur_req_set:MutableSet, prev_req_set:MutableSet) returns (proposer':ProposerState)\r\n requires ProposerIsValid(proposer)\r\n requires MutableSet.SetOf(cur_req_set) == proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == proposer.election_state.prev_req_set\r\n modifies cur_req_set, prev_req_set\r\n ensures ProposerIsValid(proposer')\r\n ensures LProposerCheckForViewTimeout(AbstractifyProposerStateToLProposer(proposer), AbstractifyProposerStateToLProposer(proposer'), clock as int)\r\n ensures proposer.constants == proposer'.constants\r\n ensures MutableSet.SetOf(cur_req_set) == proposer'.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == proposer'.election_state.prev_req_set\r\n{\r\n var election_state' := ElectionCheckForViewTimeout(proposer.election_state, clock, cur_req_set, prev_req_set);\r\n proposer' := proposer.(election_state := election_state');\r\n}\r\n\r\nmethod ProposerCheckForQuorumOfViewSuspicions(proposer:ProposerState, clock:uint64, cur_req_set:MutableSet, prev_req_set:MutableSet) returns (proposer':ProposerState)\r\n requires ProposerIsValid(proposer)\r\n requires MutableSet.SetOf(cur_req_set) == proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == proposer.election_state.prev_req_set\r\n modifies cur_req_set, prev_req_set\r\n ensures ProposerIsValid(proposer')\r\n ensures LProposerCheckForQuorumOfViewSuspicions(AbstractifyProposerStateToLProposer(proposer), AbstractifyProposerStateToLProposer(proposer'), clock as int)\r\n ensures proposer.constants == proposer'.constants\r\n ensures MutableSet.SetOf(cur_req_set) == proposer'.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == proposer'.election_state.prev_req_set\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n var election_state' := ElectionCheckForQuorumOfViewSuspicions(proposer.election_state, clock, cur_req_set, prev_req_set);\r\n\r\n var current_state' := 0;\r\n var request_queue' := [];\r\n var lt := CBalLt(proposer.election_state.current_view, election_state'.current_view);\r\n if lt {\r\n current_state' := 0;\r\n request_queue' := [];\r\n } else {\r\n current_state' := proposer.current_state;\r\n request_queue' := proposer.request_queue;\r\n }\r\n\r\n proposer' := proposer.(election_state := election_state', current_state := current_state', request_queue := request_queue');\r\n var end_time := Time.GetDebugTimeTicks();\r\n if lt {\r\n RecordTimingSeq(\"ProposerCheckForQuorumOfViewSuspicions_changed\", start_time, end_time);\r\n } else {\r\n RecordTimingSeq(\"ProposerCheckForQuorumOfViewSuspicions_nada\", start_time, end_time);\r\n }\r\n}\r\n\r\nmethod ProposerResetViewTimerDueToExecution(proposer:ProposerState, val:CRequestBatch, cur_req_set:MutableSet, prev_req_set:MutableSet) returns (proposer':ProposerState)\r\n requires ProposerIsValid(proposer)\r\n requires CRequestBatchIsAbstractable(val)\r\n requires ValidRequestBatch(val)\r\n requires cur_req_set != prev_req_set\r\n requires MutableSet.SetOf(cur_req_set) == proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == proposer.election_state.prev_req_set\r\n modifies cur_req_set, prev_req_set\r\n ensures ProposerIsValid(proposer')\r\n ensures LProposerResetViewTimerDueToExecution(AbstractifyProposerStateToLProposer(proposer), AbstractifyProposerStateToLProposer(proposer'), AbstractifyCRequestBatchToRequestBatch(val))\r\n ensures proposer.constants == proposer'.constants\r\n ensures MutableSet.SetOf(cur_req_set) == proposer'.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == proposer'.election_state.prev_req_set\r\n{\r\n var election_state' := ElectionReflectExecutedRequestBatch(proposer.election_state, val, cur_req_set, prev_req_set);\r\n proposer' := proposer.(election_state := election_state');\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ProposerState.i.dfy", "content": "include \"../../Protocol/RSL/Proposer.i.dfy\"\r\ninclude \"ElectionState.i.dfy\"\r\ninclude \"ReplicaConstantsState.i.dfy\"\r\n\r\nmodule LiveRSL__ProposerState_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__ElectionState_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\n\r\ndatatype CIncompleteBatchTimer = CIncompleteBatchTimerOn(when:uint64) | CIncompleteBatchTimerOff()\r\n\r\ndatatype ProposerState = ProposerState(\r\n constants:ReplicaConstantsState,\r\n\r\n current_state:byte,\r\n // What state the proposer is in:\r\n // 0 = not leader\r\n // 1 = leader in phase 1\r\n // 2 = leader in phase 2\r\n\r\n request_queue:seq,\r\n // Values that clients have requested that I need to eventually\r\n // propose, in the order I should propose them\r\n\r\n max_ballot_i_sent_1a:CBallot,\r\n // The maximum ballot I've sent a 1a message for\r\n\r\n next_operation_number_to_propose:uint64,\r\n // The next operation number I should propose\r\n\r\n received_1b_packets:set,\r\n // The set of 1b messages I've received concerning max_ballot_i_sent_1a\r\n\r\n highest_seqno_requested_by_client_this_view:map,\r\n // For each client, the highest sequence number for a request\r\n // I proposed in max_ballot_i_sent_1a\r\n\r\n incomplete_batch_timer:CIncompleteBatchTimer,\r\n // If the incomplete batch timer is set, it indicates when I should\r\n // give up on trying to amass a full-size batch and just propose\r\n // whatever I have. If it's not set, I shouldn't propose an\r\n // incomplete batch.\r\n\r\n election_state:CElectionState,\r\n\r\n maxOpnWithProposal:COperationNumber,\r\n\r\n maxLogTruncationPoint:COperationNumber\r\n )\r\n\r\n// Implied by Received1bPacketsIsModest\r\n//predicate Received1bPacketsIsModest(proposer:ProposerState)\r\n//{\r\n// |proposer.received_1b_packets| < 0xffffffff_ffffffff\r\n//}\r\n\r\npredicate ProposerIsAbstractable(proposer:ProposerState)\r\n{\r\n && ReplicaConstantsStateIsAbstractable(proposer.constants)\r\n && CRequestsSeqIsAbstractable(proposer.request_queue)\r\n && CBallotIsAbstractable(proposer.max_ballot_i_sent_1a)\r\n && CPacketsIsAbstractable(proposer.received_1b_packets)\r\n && MapOfSeqNumsIsAbstractable(proposer.highest_seqno_requested_by_client_this_view)\r\n && CElectionStateIsAbstractable(proposer.election_state)\r\n}\r\n\r\nfunction AbstractifyCIncompleteBatchTimerToIncompleteBatchTimer(timer:CIncompleteBatchTimer) : IncompleteBatchTimer\r\n{\r\n match timer {\r\n case CIncompleteBatchTimerOn(when) => IncompleteBatchTimerOn(when as int)\r\n case CIncompleteBatchTimerOff => IncompleteBatchTimerOff()\r\n }\r\n}\r\n\r\nfunction AbstractifyProposerStateToLProposer(proposer:ProposerState) : LProposer\r\n requires ProposerIsAbstractable(proposer)\r\n{\r\n LProposer(AbstractifyReplicaConstantsStateToLReplicaConstants(proposer.constants),\r\n proposer.current_state as int,\r\n AbstractifyCRequestsSeqToRequestsSeq(proposer.request_queue),\r\n AbstractifyCBallotToBallot(proposer.max_ballot_i_sent_1a),\r\n proposer.next_operation_number_to_propose as int,\r\n AbstractifySetOfCPacketsToSetOfRslPackets(proposer.received_1b_packets),\r\n AbstractifyMapOfSeqNums(proposer.highest_seqno_requested_by_client_this_view),\r\n AbstractifyCIncompleteBatchTimerToIncompleteBatchTimer(proposer.incomplete_batch_timer),\r\n AbstractifyCElectionStateToElectionState(proposer.election_state))\r\n}\r\n\r\npredicate RequestQueueValid(queue:seq) \r\n{\r\n forall i :: 0 <= i < |queue| ==> ValidRequest(queue[i])\r\n}\r\n\r\npredicate MaxOpnWithProposalInVotes(proposer:ProposerState)\r\n{\r\n forall p :: p in proposer.received_1b_packets && p.msg.CMessage_1b? ==> MaxOpnWithProposal(proposer, p.msg.votes)\r\n}\r\n\r\npredicate MaxOpnWithProposal(proposer:ProposerState, votes:CVotes)\r\n{\r\n forall opn :: opn in votes.v ==> opn.n < proposer.maxOpnWithProposal.n\r\n}\r\n\r\npredicate MaxLogTruncationPoint(proposer:ProposerState)\r\n{\r\n forall p :: p in proposer.received_1b_packets && p.msg.CMessage_1b? ==> p.msg.log_truncation_point.n <= proposer.maxLogTruncationPoint.n\r\n}\r\n\r\npredicate {:opaque} Received1bProperties(received_1b_packets:set, constants:ReplicaConstantsState)\r\n{\r\n && (forall p :: p in received_1b_packets ==> p.src in constants.all.config.replica_ids)\r\n && (forall p1,p2 :: p1 in received_1b_packets && p2 in received_1b_packets && p1.src == p2.src ==> p1 == p2)\r\n}\r\n\r\npredicate ProposerIsValid(proposer:ProposerState) \r\n{\r\n && ProposerIsAbstractable(proposer)\r\n && ReplicaConstantsState_IsValid(proposer.constants)\r\n && CElectionStateIsValid(proposer.election_state)\r\n && (forall p :: p in proposer.received_1b_packets ==> \r\n && p.msg.CMessage_1b? \r\n && p.msg.bal_1b == proposer.max_ballot_i_sent_1a // Useful invariant to simplify MaybeEnterPhase2\r\n && ValidVotes(p.msg.votes))\r\n && Received1bProperties(proposer.received_1b_packets, proposer.constants)\r\n && RequestQueueValid(proposer.request_queue)\r\n && (proposer.current_state == 2 ==> (proposer.maxOpnWithProposal.n < 0xffff_ffff_ffff_ffff ==> MaxOpnWithProposalInVotes(proposer)))\r\n && (proposer.current_state == 2 ==> MaxLogTruncationPoint(proposer))\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/QRelations.i.dfy", "content": "include \"../../Protocol/RSL/Replica.i.dfy\"\r\n\r\nmodule LiveRSL__QRelations_i {\r\nimport opened LiveRSL__ClockReading_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Replica_i\r\n\r\n// This file defines opaque (Q_*) versions of high-level protocol relations\r\n// to reduce the definition space available to combinatorially-challenged\r\n// methods in ReplicaImpl.\r\n\r\npredicate AllIosAreSends(ios:seq)\r\n{\r\n forall i :: 0<=i<|ios| ==> ios[i].LIoOpSend?\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\npredicate {:opaque} Q_LReplica_Next_Process_Invalid(replica:LReplica, replica':LReplica, lpacket:RslPacket, sent_packets:seq)\r\n{ lpacket.msg.RslMessage_Invalid? && LReplicaNextProcessInvalid(replica, replica', lpacket, sent_packets) }\r\n\r\npredicate {:opaque} Q_LReplica_Next_Process_Request(replica:LReplica, replica':LReplica, lpacket:RslPacket, sent_packets:seq)\r\n{ lpacket.msg.RslMessage_Request? && LReplicaNextProcessRequest(replica, replica', lpacket, sent_packets) }\r\n\r\npredicate {:opaque} Q_LReplica_Next_Process_1a(replica:LReplica, replica':LReplica, lpacket:RslPacket, sent_packets:seq)\r\n{ lpacket.msg.RslMessage_1a? && LReplicaNextProcess1a(replica, replica', lpacket, sent_packets) }\r\n\r\npredicate {:opaque} Q_LReplica_Next_Process_1b(replica:LReplica, replica':LReplica, lpacket:RslPacket, sent_packets:seq)\r\n{ lpacket.msg.RslMessage_1b? && LReplicaNextProcess1b(replica, replica', lpacket, sent_packets) }\r\n\r\npredicate {:opaque} Q_LReplica_Next_Process_StartingPhase2(replica:LReplica, replica':LReplica, lpacket:RslPacket, sent_packets:seq)\r\n{ lpacket.msg.RslMessage_StartingPhase2? && LReplicaNextProcessStartingPhase2(replica, replica', lpacket, sent_packets) }\r\n\r\npredicate {:opaque} Q_LReplica_Next_Process_2a(replica:LReplica, replica':LReplica, lpacket:RslPacket, sent_packets:seq)\r\n{ lpacket.msg.RslMessage_2a? && LReplicaNextProcess2a(replica, replica', lpacket, sent_packets) }\r\n\r\npredicate {:opaque} Q_LReplica_Next_Process_2b(replica:LReplica, replica':LReplica, lpacket:RslPacket, sent_packets:seq)\r\n{ lpacket.msg.RslMessage_2b? && LReplicaNextProcess2b(replica, replica', lpacket, sent_packets) }\r\n\r\n// TODO move this definition into Replica.i\r\npredicate {:opaque} Q_LReplica_Next_Process_Reply(replica:LReplica, replica':LReplica, lpacket:RslPacket, sent_packets:seq)\r\n{ lpacket.msg.RslMessage_Reply? && LReplicaNextProcessReply(replica, replica', lpacket, sent_packets) }\r\n\r\npredicate {:opaque} Q_LReplica_Next_Process_AppStateRequest(replica:LReplica, replica':LReplica, lpacket:RslPacket, sent_packets:seq)\r\n{ lpacket.msg.RslMessage_AppStateRequest? && LReplicaNextProcessAppStateRequest(replica, replica', lpacket, sent_packets) }\r\n\r\npredicate {:opaque} Q_LReplica_Next_Process_AppStateSupply(replica:LReplica, replica':LReplica, lpacket:RslPacket, sent_packets:seq)\r\n{ lpacket.msg.RslMessage_AppStateSupply? && LReplicaNextProcessAppStateSupply(replica, replica', lpacket, sent_packets) }\r\n\r\n\r\n\r\npredicate LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(ios:seq)\r\n{\r\n && |ios| >= 1\r\n && ios[0].LIoOpReceive?\r\n && !ios[0].r.msg.RslMessage_Heartbeat?\r\n}\r\n\r\npredicate {:opaque} Q_LReplica_Next_ProcessPacketWithoutReadingClock(replica:LReplica, replica':LReplica, ios:seq)\r\n{\r\n && LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(ios)\r\n && LReplicaNextProcessPacketWithoutReadingClock(replica, replica', ios)\r\n}\r\n\r\npredicate Establish_Q_LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(replica:LReplica, replica':LReplica, lpacket:RslPacket, sent_packets:seq, ios:seq)\r\n{\r\n && sent_packets == ExtractSentPacketsFromIos(ios)\r\n// && clock == SpontaneousClock(ios)\r\n && (|| (lpacket.msg.RslMessage_Request? && Q_LReplica_Next_Process_Request(replica, replica', lpacket, sent_packets))\r\n || (lpacket.msg.RslMessage_1a? && Q_LReplica_Next_Process_1a(replica, replica', lpacket, sent_packets))\r\n || (lpacket.msg.RslMessage_1b? && Q_LReplica_Next_Process_1b(replica, replica', lpacket, sent_packets))\r\n || (lpacket.msg.RslMessage_StartingPhase2? && Q_LReplica_Next_Process_StartingPhase2(replica, replica', lpacket, sent_packets))\r\n || (lpacket.msg.RslMessage_2a? && Q_LReplica_Next_Process_2a(replica, replica', lpacket, sent_packets))\r\n || (lpacket.msg.RslMessage_2b? && Q_LReplica_Next_Process_2b(replica, replica', lpacket, sent_packets))\r\n || (lpacket.msg.RslMessage_Reply? && Q_LReplica_Next_Process_Reply(replica, replica', lpacket, sent_packets))\r\n || (lpacket.msg.RslMessage_AppStateRequest? && Q_LReplica_Next_Process_AppStateRequest(replica, replica', lpacket, sent_packets))\r\n || (lpacket.msg.RslMessage_AppStateSupply? && Q_LReplica_Next_Process_AppStateSupply(replica, replica', lpacket, sent_packets)))\r\n && sent_packets == ExtractSentPacketsFromIos(ios)\r\n}\r\n\r\nlemma lemma_EstablishQLReplicaNextProcessPacketWithoutReadingClock(replica:LReplica, replica':LReplica, lpacket:RslPacket, sent_packets:seq, ios:seq)\r\n requires |ios| >= 1\r\n requires ios[0].LIoOpReceive?\r\n requires !ios[0].r.msg.RslMessage_Heartbeat?\r\n requires lpacket == ios[0].r\r\n requires AllIosAreSends(ios[1..])\r\n requires sent_packets == ExtractSentPacketsFromIos(ios)\r\n requires Establish_Q_LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(replica, replica', lpacket, sent_packets, ios)\r\n ensures Q_LReplica_Next_ProcessPacketWithoutReadingClock(replica, replica', ios)\r\n{\r\n reveal Q_LReplica_Next_Process_Invalid();\r\n reveal Q_LReplica_Next_Process_Request();\r\n reveal Q_LReplica_Next_Process_1a();\r\n reveal Q_LReplica_Next_Process_1b();\r\n reveal Q_LReplica_Next_Process_StartingPhase2();\r\n reveal Q_LReplica_Next_Process_2a();\r\n reveal Q_LReplica_Next_Process_2b();\r\n reveal Q_LReplica_Next_Process_Reply();\r\n reveal Q_LReplica_Next_Process_AppStateRequest();\r\n reveal Q_LReplica_Next_Process_AppStateSupply();\r\n\r\n reveal Q_LReplica_Next_ProcessPacketWithoutReadingClock();\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\npredicate {:opaque} Q_LReplica_Next_Spontaneous_MaybeEnterNewViewAndSend1a(replica:LReplica, replica':LReplica, sent_packets:seq)\r\n{ LReplicaNextSpontaneousMaybeEnterNewViewAndSend1a(replica, replica', sent_packets) }\r\n\r\npredicate {:opaque} Q_LReplica_Next_Spontaneous_MaybeEnterPhase2(replica:LReplica, replica':LReplica, sent_packets:seq)\r\n{ LReplicaNextSpontaneousMaybeEnterPhase2(replica, replica', sent_packets) }\r\n\r\npredicate {:opaque} Q_LReplica_Next_Spontaneous_TruncateLogBasedOnCheckpoints(replica:LReplica, replica':LReplica, sent_packets:seq)\r\n{ LReplicaNextSpontaneousTruncateLogBasedOnCheckpoints(replica, replica', sent_packets) }\r\n\r\npredicate {:opaque} Q_LReplica_Next_Spontaneous_MaybeMakeDecision(replica:LReplica, replica':LReplica, sent_packets:seq)\r\n{ LReplicaNextSpontaneousMaybeMakeDecision(replica, replica', sent_packets) }\r\n\r\npredicate {:opaque} Q_LReplica_Next_Spontaneous_MaybeExecute(replica:LReplica, replica':LReplica, sent_packets:seq)\r\n{ LReplicaNextSpontaneousMaybeExecute(replica, replica', sent_packets) }\r\n\r\nlemma lemma_EstablishQLReplicaNoReceiveNextFromNoClock(replica:LReplica, replica':LReplica, sent_packets:seq, nextActionIndex:int, ios:seq)\r\n requires sent_packets == ExtractSentPacketsFromIos(ios)\r\n requires SpontaneousIos(ios, 0)\r\n requires\r\n || (nextActionIndex==1 && Q_LReplica_Next_Spontaneous_MaybeEnterNewViewAndSend1a(replica, replica', sent_packets))\r\n || (nextActionIndex==2 && Q_LReplica_Next_Spontaneous_MaybeEnterPhase2(replica, replica', sent_packets))\r\n //\r\n || (nextActionIndex==4 && Q_LReplica_Next_Spontaneous_TruncateLogBasedOnCheckpoints(replica, replica', sent_packets))\r\n || (nextActionIndex==5 && Q_LReplica_Next_Spontaneous_MaybeMakeDecision(replica, replica', sent_packets))\r\n || (nextActionIndex==6 && Q_LReplica_Next_Spontaneous_MaybeExecute(replica, replica', sent_packets));\r\n ensures Q_LReplica_NoReceive_Next(replica, nextActionIndex as int, replica', ios)\r\n{\r\n reveal Q_LReplica_Next_Spontaneous_MaybeEnterNewViewAndSend1a();\r\n reveal Q_LReplica_Next_Spontaneous_MaybeEnterPhase2();\r\n //reveal Q_LReplica_Next_Spontaneous_MaybeNominateValueAndSend2a();\r\n reveal Q_LReplica_Next_Spontaneous_TruncateLogBasedOnCheckpoints();\r\n reveal Q_LReplica_Next_Spontaneous_MaybeMakeDecision();\r\n reveal Q_LReplica_Next_Spontaneous_MaybeExecute();\r\n\r\n assert LReplicaNoReceiveNext(replica, nextActionIndex as int, replica', ios);\r\n reveal Q_LReplica_NoReceive_Next();\r\n assert Q_LReplica_NoReceive_Next(replica, nextActionIndex as int, replica', ios);\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\npredicate {:opaque} Q_LReplica_Next_ReadClock_MaybeNominateValueAndSend2a(replica:LReplica, replica':LReplica, clock:ClockReading, sent_packets:seq)\r\n{ LReplicaNextReadClockMaybeNominateValueAndSend2a(replica, replica', clock, sent_packets) }\r\n\r\n\r\npredicate {:opaque} Q_LReplica_Next_ReadClock_CheckForViewTimeout(replica:LReplica, replica':LReplica, clock:ClockReading, sent_packets:seq)\r\n{\r\n LReplicaNextReadClockCheckForViewTimeout(replica, replica', clock, sent_packets)\r\n}\r\n\r\npredicate {:opaque} Q_LReplica_Next_ReadClock_CheckForQuorumOfViewSuspicions(replica:LReplica, replica':LReplica, clock:ClockReading, sent_packets:seq)\r\n{\r\n LReplicaNextReadClockCheckForQuorumOfViewSuspicions(replica, replica', clock, sent_packets)\r\n}\r\n\r\npredicate {:opaque} Q_LReplica_Next_ReadClock_MaybeSendHeartbeat(replica:LReplica, replica':LReplica, clock:ClockReading, sent_packets:seq)\r\n{\r\n LReplicaNextReadClockMaybeSendHeartbeat(replica, replica', clock, sent_packets)\r\n}\r\n\r\npredicate {:opaque} Q_LReplica_NoReceive_Next(replica:LReplica, nextActionIndex:int, replica':LReplica, ios:seq)\r\n{\r\n LReplicaNoReceiveNext(replica, nextActionIndex, replica', ios)\r\n}\r\n\r\npredicate {:opaque} Q_LReplica_Next_ProcessPacket(replica:LReplica, replica':LReplica, ios:seq)\r\n{\r\n LReplicaNextProcessPacket(replica, replica', ios)\r\n}\r\n\r\nlemma lemma_EstablishQLReplicaNextProcessPacket(replica:LReplica, replica':LReplica, ios:seq)\r\n requires Q_LReplica_Next_ProcessPacketWithoutReadingClock(replica, replica', ios)\r\n ensures Q_LReplica_Next_ProcessPacket(replica, replica', ios)\r\n{\r\n reveal Q_LReplica_Next_ProcessPacketWithoutReadingClock();\r\n reveal Q_LReplica_Next_ProcessPacket();\r\n}\r\n\r\nlemma lemma_EstablishQLReplicaNextProcessPacketFromTimeout(replica:LReplica, replica':LReplica, ios:seq)\r\n requires |ios|==1\r\n requires ios[0].LIoOpTimeoutReceive?\r\n requires replica==replica'\r\n ensures Q_LReplica_Next_ProcessPacket(replica, replica', ios)\r\n{\r\n reveal Q_LReplica_Next_ProcessPacket();\r\n}\r\n\r\npredicate {:opaque} Q_LScheduler_Next(s:LScheduler, s':LScheduler, ios:seq)\r\n{\r\n LSchedulerNext(s, s', ios)\r\n}\r\n\r\npredicate Establish_Q_LReplica_NoReceive_Next_preconditions(replica:LReplica, replica':LReplica, clock:ClockReading, sent_packets:seq, nextActionIndex:int, ios:seq)\r\n{\r\n && SpontaneousIos(ios, 1)\r\n && sent_packets == ExtractSentPacketsFromIos(ios)\r\n && clock == SpontaneousClock(ios)\r\n && (|| (nextActionIndex==3 && Q_LReplica_Next_ReadClock_MaybeNominateValueAndSend2a(replica, replica', clock, sent_packets))\r\n || (nextActionIndex==7 && Q_LReplica_Next_ReadClock_CheckForViewTimeout(replica, replica', clock, sent_packets))\r\n || (nextActionIndex==8 && Q_LReplica_Next_ReadClock_CheckForQuorumOfViewSuspicions(replica, replica', clock, sent_packets))\r\n || (nextActionIndex==9 && Q_LReplica_Next_ReadClock_MaybeSendHeartbeat(replica, replica', clock, sent_packets)))\r\n && sent_packets == ExtractSentPacketsFromIos(ios)\r\n}\r\n\r\nlemma lemma_EstablishQLReplicaNoReceiveNextFromReadClock(replica:LReplica, replica':LReplica, clock:ClockReading, sent_packets:seq, nextActionIndex:int, ios:seq)\r\n requires Establish_Q_LReplica_NoReceive_Next_preconditions(replica, replica', clock, sent_packets, nextActionIndex, ios)\r\n ensures Q_LReplica_NoReceive_Next(replica, nextActionIndex, replica', ios)\r\n{\r\n reveal Q_LReplica_Next_ReadClock_CheckForViewTimeout();\r\n reveal Q_LReplica_Next_ReadClock_CheckForQuorumOfViewSuspicions();\r\n reveal Q_LReplica_Next_ReadClock_MaybeSendHeartbeat();\r\n reveal Q_LReplica_Next_ReadClock_MaybeNominateValueAndSend2a();\r\n reveal Q_LReplica_NoReceive_Next();\r\n// if (nextActionIndex==7)\r\n// {\r\n// assert SpontaneousIos(ios, 1);\r\n// assert LReplicaNextReadClockCheckForViewTimeout(replica, replica', clock, sent_packets);\r\n// assert LReplicaNoReceiveNext(replica, nextActionIndex, replica', ios);\r\n// }\r\n// if (nextActionIndex==8)\r\n// {\r\n// assert SpontaneousIos(ios, 1);\r\n// assert LReplicaNextReadClockCheckForQuorumOfViewSuspicions(replica, replica', clock, sent_packets);\r\n// assert LReplicaNoReceiveNext(replica, nextActionIndex, replica', ios);\r\n// }\r\n// if (nextActionIndex==9)\r\n// {\r\n// assert SpontaneousIos(ios, 1);\r\n// assert LReplicaNextReadClockMaybeSendHeartbeat(replica, replica', clock, sent_packets);\r\n// assert LReplicaNoReceiveNext(replica, nextActionIndex, replica', ios);\r\n// }\r\n}\r\n\r\nlemma lemma_EstablishQLSchedulerNext(replica:LReplica, replica':LReplica, ios:seq, s:LScheduler, s':LScheduler)\r\n requires 0<=s.nextActionIndex<=9\r\n requires 0==s.nextActionIndex ==> Q_LReplica_Next_ProcessPacket(replica, replica', ios)\r\n requires 0< s.nextActionIndex<=6 ==> Q_LReplica_NoReceive_Next(replica, s.nextActionIndex, replica', ios)\r\n requires 6< s.nextActionIndex<=9 ==> Q_LReplica_NoReceive_Next(replica, s.nextActionIndex, replica', ios)\r\n requires s.replica == replica\r\n requires s'.replica == replica'\r\n requires s'.nextActionIndex == (s.nextActionIndex+1)%LReplicaNumActions()\r\n ensures Q_LScheduler_Next(s, s', ios)\r\n{\r\n reveal Q_LReplica_Next_ProcessPacket();\r\n reveal Q_LReplica_NoReceive_Next();\r\n// if (0==s.nextActionIndex) {\r\n// assert LReplicaNextProcessPacket(s.replica, s'.replica, ios);\r\n// assert LSchedulerNext(s, s', ios);\r\n// } else {\r\n// if (0< s.nextActionIndex<=6) {\r\n// assert Q_LReplica_NoReceive_Next(replica, s.nextActionIndex, replica', ios);\r\n// assert LReplicaNoReceiveNext(replica, s.nextActionIndex, replica', ios);\r\n// assert LSchedulerNext(s, s', ios);\r\n// } else if (6< s.nextActionIndex<=9) {\r\n// assert Q_LReplica_NoReceive_Next(replica, s.nextActionIndex, replica', ios);\r\n// assert LReplicaNoReceiveNext(replica, s.nextActionIndex, replica', ios);\r\n// assert LSchedulerNext(s, s', ios);\r\n// } else {\r\n// assert false;\r\n// }\r\n// }\r\n// assert LSchedulerNext(s, s', ios);\r\n reveal Q_LScheduler_Next();\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaConstantsState.i.dfy", "content": "include \"ConstantsState.i.dfy\"\r\ninclude \"PaxosWorldState.i.dfy\" // For those that still depend on it; should be deprecated away.\r\n\r\nmodule LiveRSL__ReplicaConstantsState_i {\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__ConstantsState_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__ParametersState_i\r\nimport opened LiveRSL__PaxosWorldState_i\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\n\r\ndatatype ReplicaConstantsState = ReplicaConstantsState(\r\n my_index:uint64,\r\n all:ConstantsState)\r\n\r\npredicate ReplicaConstantsStateIsAbstractable(rc:ReplicaConstantsState)\r\n{\r\n && ConstantsStateIsAbstractable(rc.all)\r\n && ReplicaIndexValid(rc.my_index, rc.all.config)\r\n}\r\n\r\nfunction AbstractifyReplicaConstantsStateToLReplicaConstants(rc:ReplicaConstantsState) : LReplicaConstants\r\n requires ReplicaConstantsStateIsAbstractable(rc)\r\n{\r\n LReplicaConstants(rc.my_index as int, AbstractifyConstantsStateToLConstants(rc.all))\r\n}\r\n\r\npredicate ReplicaConstantsState_IsValid(rcs:ReplicaConstantsState)\r\n{\r\n && ConstantsStateIsValid(rcs.all)\r\n && ReplicaConstantsStateIsAbstractable(rcs)\r\n}\r\n\r\nmethod InitReplicaConstantsState(endPoint:EndPoint, config:CPaxosConfiguration) returns (rc:ReplicaConstantsState)\r\n requires CPaxosConfigurationIsValid(config)\r\n requires PaxosEndPointIsValid(endPoint, config)\r\n requires endPoint in config.replica_ids // To satisfy WFReplicaConstantsState\r\n ensures ReplicaConstantsState_IsValid(rc)\r\n ensures rc.all.config.replica_ids[rc.my_index] == endPoint\r\n ensures rc.all.config == config\r\n ensures rc.all.params.max_integer_val > rc.all.params.max_log_length > 0\r\n ensures rc.all.params.max_log_length < 10000\r\n ensures rc.all.params == StaticParams()\r\n{\r\n var params := StaticParams(); \r\n //var config := CPaxosConfiguration(world.config.replica_ids);\r\n var constants := ConstantsState(config, params);\r\n var found, index := CGetReplicaIndex(endPoint, config);\r\n rc := ReplicaConstantsState(index, constants);\r\n}\r\n\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaImplClass.i.dfy", "content": "include \"../../Common/Collections/Seqs.i.dfy\"\r\ninclude \"../../../Libraries/Math/mod_auto.i.dfy\"\r\ninclude \"../../Protocol/RSL/Replica.i.dfy\"\r\ninclude \"ReplicaModel.i.dfy\"\r\ninclude \"ReplicaImplLemmas.i.dfy\"\r\ninclude \"NetRSL.i.dfy\"\r\ninclude \"CClockReading.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaImplClass_i {\r\n\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Collections__Seqs_i\r\nimport opened Math__mod_auto_i\r\nimport opened LiveRSL__AcceptorState_i\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__CClockReading_i\r\nimport opened LiveRSL__CLastCheckpointedMap_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__ConstantsState_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__ElectionState_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__ExecutorState_i\r\nimport opened LiveRSL__LearnerState_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__ParametersState_i\r\nimport opened LiveRSL__ProposerState_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened LiveRSL__ReplicaModel_i\r\nimport opened LiveRSL__ReplicaModel_Part1_i\r\nimport opened LiveRSL__ReplicaState_i\r\nimport opened LiveRSL__ReplicaImplLemmas_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__NetRSL_i\r\nimport opened Common__GenericMarshalling_i\r\nimport opened Common__NetClient_i\r\nimport opened Common__Util_i\r\nimport opened AppStateMachine_s\r\n\r\nclass ReplicaImpl\r\n{\r\n var replica:ReplicaState;\r\n var nextActionIndex:uint64;\r\n var netClient:NetClient?;\r\n var localAddr:EndPoint;\r\n // Optimized mutable sets for ElectionState\r\n var cur_req_set:MutableSet;\r\n var prev_req_set:MutableSet;\r\n var reply_cache_mutable:MutableMap;\r\n var msg_grammar:G;\r\n\r\n ghost var Repr : set;\r\n\r\n constructor()\r\n {\r\n netClient := null;\r\n var empty_MutableMap:MutableMap := MutableMap.EmptyMap();\r\n reply_cache_mutable := empty_MutableMap;\r\n var empty_MutableSet:MutableSet := MutableSet.EmptySet();\r\n cur_req_set := empty_MutableSet;\r\n prev_req_set := empty_MutableSet;\r\n var rcs := ReplicaConstantsState(0, ConstantsState(CPaxosConfiguration([]), ParametersState(0, 0, 0, 0, 0, 0)));\r\n var election_state := CElectionState(rcs, CBallot(0, 0), [], 0, 0, [], {}, [], {});\r\n var proposer_state :=\r\n ProposerState(rcs, 0, [], CBallot(0, 0), 0, {}, map [], CIncompleteBatchTimerOff(), election_state,\r\n COperationNumber(0), COperationNumber(0));\r\n var acceptor_state :=\r\n AcceptorState(rcs, CBallot(0, 0), CVotes(map []), [], COperationNumber(0), COperationNumber(0));\r\n var ep := EndPoint([]);\r\n var learner_state := CLearnerState(rcs, CBallot(0, 0), map [], false, COperationNumber(0), false, CPacket(ep, ep, CMessage_Invalid()));\r\n var app_state := AppStateMachine.Initialize();\r\n var executor_state := ExecutorState(rcs, app_state, COperationNumber(0), CBallot(0, 0), COutstandingOpUnknown(), map[]);\r\n replica := ReplicaState(rcs, 0, proposer_state, acceptor_state, learner_state, executor_state);\r\n }\r\n\r\n predicate Valid()\r\n reads this\r\n reads this.replica.executor.app\r\n reads this.cur_req_set\r\n reads this.prev_req_set\r\n reads this.reply_cache_mutable\r\n reads if netClient != null then NetClientIsValid.reads(netClient) else {}\r\n {\r\n && ReplicaStateIsAbstractable(replica)\r\n && (0 <= nextActionIndex as int < 10)\r\n && netClient != null\r\n && NetClientIsValid(netClient)\r\n && EndPoint(netClient.MyPublicKey()) == localAddr\r\n && EndPoint(netClient.MyPublicKey()) == replica.constants.all.config.replica_ids[replica.constants.my_index]\r\n && ReplicaStateIsValid(replica)\r\n && Repr == { this } + NetClientRepr(netClient)\r\n && cur_req_set != prev_req_set\r\n && MutableSet.SetOf(cur_req_set) == replica.proposer.election_state.cur_req_set\r\n && MutableSet.SetOf(prev_req_set) == replica.proposer.election_state.prev_req_set\r\n && MutableMap.MapOf(reply_cache_mutable) == replica.executor.reply_cache \r\n && msg_grammar == CMessage_grammar()\r\n }\r\n\r\n function Env() : HostEnvironment\r\n requires netClient != null\r\n reads this, NetClientIsValid.reads(netClient)\r\n {\r\n netClient.env\r\n }\r\n\r\n function AbstractifyToLReplica() : LReplica\r\n reads this\r\n reads this.replica.executor.app\r\n requires ReplicaStateIsAbstractable(replica)\r\n {\r\n AbstractifyReplicaStateToLReplica(replica)\r\n }\r\n\r\n function AbstractifyToLScheduler() : LScheduler\r\n reads this\r\n reads this.replica.executor.app\r\n requires ReplicaStateIsAbstractable(replica)\r\n {\r\n LScheduler(\r\n AbstractifyReplicaStateToLReplica(replica),\r\n nextActionIndex as int)\r\n }\r\n\r\n method Replica_Init(\r\n constants:ReplicaConstantsState,\r\n nc:NetClient,\r\n ghost env_:HostEnvironment\r\n ) returns (\r\n ok:bool\r\n )\r\n requires env_.Valid() && env_.ok.ok()\r\n requires ReplicaConstantsState_IsValid(constants)\r\n requires WellFormedLConfiguration(AbstractifyReplicaConstantsStateToLReplicaConstants(constants).all.config)\r\n requires NetClientIsValid(nc)\r\n requires EndPoint(nc.MyPublicKey()) == constants.all.config.replica_ids[constants.my_index]\r\n requires nc.env == env_\r\n //requires KnownSendersMatchConfig(constants.all.config)\r\n modifies this\r\n ensures ok ==>\r\n && Valid()\r\n && Env() == env_\r\n && this.replica.constants == constants\r\n && LSchedulerInit(AbstractifyToLScheduler(), AbstractifyReplicaConstantsStateToLReplicaConstants(constants))\r\n {\r\n netClient := nc;\r\n replica, cur_req_set, prev_req_set, reply_cache_mutable := InitReplicaState(constants);\r\n nextActionIndex := 0;\r\n localAddr := replica.constants.all.config.replica_ids[replica.constants.my_index];\r\n Repr := { this } + NetClientRepr(netClient);\r\n this.msg_grammar := CMessage_grammar();\r\n ok := true;\r\n }\r\n\r\n predicate ReceivedPacketProperties(cpacket:CPacket, netEvent0:NetEvent, io0:RslIo)\r\n reads this\r\n requires CPaxosConfigurationIsValid(replica.constants.all.config)\r\n {\r\n && CPacketIsSendable(cpacket)\r\n && PaxosEndPointIsValid(cpacket.src, replica.constants.all.config)\r\n && io0.LIoOpReceive?\r\n && NetEventIsAbstractable(netEvent0)\r\n && io0 == AbstractifyNetEventToRslIo(netEvent0)\r\n && NetEventIsAbstractable(netEvent0)\r\n && netEvent0.LIoOpReceive? && AbstractifyCPacketToRslPacket(cpacket) == AbstractifyNetPacketToRslPacket(netEvent0.r)\r\n }\r\n}\r\n\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaImplDelivery.i.dfy", "content": "include \"../../Common/Collections/Seqs.i.dfy\"\r\ninclude \"../../../Libraries/Math/mod_auto.i.dfy\"\r\ninclude \"../../Protocol/RSL/Replica.i.dfy\"\r\ninclude \"ReplicaModel.i.dfy\"\r\ninclude \"ReplicaImplLemmas.i.dfy\"\r\ninclude \"ReplicaImplClass.i.dfy\"\r\ninclude \"NetRSL.i.dfy\"\r\ninclude \"CClockReading.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaImplDelivery_i {\r\n\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Collections__Seqs_i\r\nimport opened Math__mod_auto_i\r\nimport opened LiveRSL__CClockReading_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__ReplicaModel_i\r\nimport opened LiveRSL__ReplicaImplLemmas_i\r\nimport opened LiveRSL__ReplicaImplClass_i\r\nimport opened LiveRSL__QRelations_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__NetRSL_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__NetClient_i\r\nimport opened Common__Util_i\r\nimport opened Environment_s\r\n\r\nmethod DeliverPacket(r:ReplicaImpl, packets:OutboundPackets) returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.Valid()\r\n requires packets.OutboundPacket?\r\n requires OutboundPacketsIsValid(packets)\r\n requires OutboundPacketsHasCorrectSrc(packets, r.replica.constants.all.config.replica_ids[r.replica.constants.my_index])\r\n modifies r.Repr\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env())\r\n ensures r.replica == old(r.replica)\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && AllIosAreSends(ios)\r\n && AbstractifyOutboundCPacketsToSeqOfRslPackets(packets) == ExtractSentPacketsFromIos(ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n ok, netEventLog := SendPacket(r.netClient, packets, r.localAddr);\r\n if (!ok) { return; }\r\n\r\n ios := MapSentPacketToIos(packets.p);\r\n lemma_MapSentPacketToIosExtractSentPacketsFromIosEquivalence(packets.p, ios);\r\n var end_time := Time.GetDebugTimeTicks();\r\n if packets.p.None? {\r\n RecordTimingSeq(\"DeliverPacketEmpty\", start_time, end_time);\r\n } else {\r\n RecordTimingSeq(\"DeliverPacketSingleton\", start_time, end_time);\r\n } \r\n}\r\n\r\nmethod {:timeLimitMultiplier 2} DeliverPacketSequence(r:ReplicaImpl, packets:OutboundPackets) returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.Valid()\r\n requires packets.PacketSequence?\r\n requires OutboundPacketsIsValid(packets)\r\n requires OutboundPacketsIsAbstractable(packets)\r\n requires OutboundPacketsHasCorrectSrc(packets, r.replica.constants.all.config.replica_ids[r.replica.constants.my_index])\r\n modifies r.Repr\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env())\r\n ensures r.replica == old(r.replica)\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && AllIosAreSends(ios)\r\n && AbstractifyOutboundCPacketsToSeqOfRslPackets(packets) == ExtractSentPacketsFromIos(ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n ok, netEventLog := SendPacketSequence(r.netClient, packets, r.localAddr);\r\n if (!ok) { return; }\r\n\r\n ios := MapSentPacketSeqToIos(packets.s);\r\n lemma_MapSentPacketSeqToIosExtractSentPacketsFromIosEquivalence(packets, ios);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"DeliverPacketSequence\", start_time, end_time);\r\n}\r\n\r\nmethod{:timeLimitMultiplier 2} DeliverBroadcast(r:ReplicaImpl, broadcast:CBroadcast) returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.Valid()\r\n requires CBroadcastIsValid(broadcast)\r\n requires broadcast.CBroadcast? ==> broadcast.src == r.replica.constants.all.config.replica_ids[r.replica.constants.my_index];\r\n modifies r.Repr\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env())\r\n ensures r.replica == old(r.replica)\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && AllIosAreSends(ios)\r\n && AbstractifyCBroadcastToRlsPacketSeq(broadcast) == ExtractSentPacketsFromIos(ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n ok, netEventLog := SendBroadcast(r.netClient, broadcast, r.localAddr);\r\n if (!ok) { return; }\r\n\r\n ios := MapBroadcastToIos(broadcast);\r\n lemma_MapBroadcastToIosExtractSentPacketsFromIosEquivalence(broadcast, ios);\r\n \r\n lemma_NetEventLogToBroadcastRefinable(netEventLog, broadcast);\r\n assert NetEventLogIsAbstractable(netEventLog);\r\n if broadcast.CBroadcastNop? {\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n } else {\r\n ghost var broadcast_ios := BuildBroadcastIos(AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyEndPointsToNodeIdentities(broadcast.dsts), \r\n AbstractifyCMessageToRslMessage(broadcast.msg));\r\n calc {\r\n AbstractifyRawLogToIos(netEventLog);\r\n {\r\n forall i | 0 <= i < |AbstractifyRawLogToIos(netEventLog)|\r\n ensures AbstractifyRawLogToIos(netEventLog)[i] == \r\n LIoOpSend(LPacket(AbstractifyEndPointsToNodeIdentities(broadcast.dsts)[i], \r\n AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyCMessageToRslMessage(broadcast.msg)))\r\n {\r\n calc {\r\n AbstractifyRawLogToIos(netEventLog)[i];\r\n AbstractifyNetEventToRslIo(netEventLog[i]);\r\n { lemma_NetEventLogToBroadcast(netEventLog, broadcast, i); }\r\n LIoOpSend(AbstractifyCBroadcastToRlsPacketSeq(broadcast)[i]);\r\n LIoOpSend(BuildLBroadcast(AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyEndPointsToNodeIdentities(broadcast.dsts), \r\n AbstractifyCMessageToRslMessage(broadcast.msg))[i]);\r\n LIoOpSend(LPacket(AbstractifyEndPointsToNodeIdentities(broadcast.dsts)[i], \r\n AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyCMessageToRslMessage(broadcast.msg)));\r\n }\r\n }\r\n forall i | 0 <= i < |broadcast_ios|\r\n ensures broadcast_ios[i] == LIoOpSend(LPacket(AbstractifyEndPointsToNodeIdentities(broadcast.dsts)[i], \r\n AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyCMessageToRslMessage(broadcast.msg)))\r\n {\r\n calc {\r\n LIoOpSend(LPacket(AbstractifyEndPointsToNodeIdentities(broadcast.dsts)[i], \r\n AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyCMessageToRslMessage(broadcast.msg)));\r\n BuildBroadcastIos(AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyEndPointsToNodeIdentities(broadcast.dsts), \r\n AbstractifyCMessageToRslMessage(broadcast.msg))[i];\r\n broadcast_ios[i];\r\n }\r\n }\r\n }\r\n broadcast_ios;\r\n BuildBroadcastIos(AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyEndPointsToNodeIdentities(broadcast.dsts), \r\n AbstractifyCMessageToRslMessage(broadcast.msg));\r\n MapBroadcastToIos(broadcast);\r\n ios;\r\n }\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n }\r\n\r\n var end_time := Time.GetDebugTimeTicks();\r\n if broadcast.CBroadcastNop? || (broadcast.CBroadcast? && |broadcast.dsts| as uint64 == 0) {\r\n RecordTimingSeq(\"DeliverBroadcastEmpty\", start_time, end_time);\r\n } else if broadcast.CBroadcast? && |broadcast.dsts| as uint64 == 1 {\r\n RecordTimingSeq(\"DeliverBroadcastSingleton\", start_time, end_time);\r\n } else {\r\n RecordTimingSeq(\"DeliverBroadcastMany\", start_time, end_time);\r\n }\r\n}\r\n\r\nmethod DeliverOutboundPackets(r:ReplicaImpl, packets:OutboundPackets) returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.Valid()\r\n requires OutboundPacketsIsValid(packets)\r\n requires OutboundPacketsIsAbstractable(packets)\r\n requires OutboundPacketsHasCorrectSrc(packets, r.replica.constants.all.config.replica_ids[r.replica.constants.my_index]);\r\n modifies r.Repr\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env())\r\n ensures r.replica == old(r.replica)\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && AllIosAreSends(ios)\r\n && AbstractifyOutboundCPacketsToSeqOfRslPackets(packets) == ExtractSentPacketsFromIos(ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n match packets {\r\n case Broadcast(broadcast) => ok, netEventLog, ios := DeliverBroadcast(r, broadcast);\r\n case OutboundPacket(p) => ok, netEventLog, ios := DeliverPacket(r, packets);\r\n case PacketSequence(s) => ok, netEventLog, ios := DeliverPacketSequence(r, packets);\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaImplLemmas.i.dfy", "content": "include \"../../Common/Collections/Seqs.i.dfy\"\r\ninclude \"../../Common/Framework/Environment.s.dfy\"\r\ninclude \"../../../Libraries/Math/mod_auto.i.dfy\"\r\ninclude \"../../Protocol/RSL/Replica.i.dfy\"\r\ninclude \"ReplicaModel.i.dfy\"\r\ninclude \"NetRSL.i.dfy\"\r\ninclude \"CClockReading.i.dfy\"\r\ninclude \"QRelations.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaImplLemmas_i {\r\n\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Collections__Seqs_i\r\nimport opened Math__mod_auto_i\r\nimport opened LiveRSL__CClockReading_i\r\nimport opened LiveRSL__ClockReading_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__QRelations_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__ReplicaModel_i\r\nimport opened LiveRSL__ReplicaState_i\r\nimport opened LiveRSL__NetRSL_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Logic__Option_i\r\nimport opened Environment_s\r\n\r\nfunction MapSentPacketToIos(sent_packet:Option) : seq\r\n requires OutboundPacketsIsValid(OutboundPacket(sent_packet))\r\n{\r\n match sent_packet {\r\n case Some(p) => [LIoOpSend(AbstractifyCPacketToRslPacket(p))]\r\n case None => []\r\n }\r\n}\r\n \r\nfunction {:opaque} MapSentPacketSeqToIos(sent_packets:seq) : seq\r\n requires OutboundPacketsIsValid(PacketSequence(sent_packets))\r\n requires OutboundPacketsIsAbstractable(PacketSequence(sent_packets))\r\n ensures |MapSentPacketSeqToIos(sent_packets)| == |sent_packets|\r\n ensures forall i :: 0 <= i < |sent_packets| ==> MapSentPacketSeqToIos(sent_packets)[i] == LIoOpSend(AbstractifyCPacketToRslPacket(sent_packets[i]))\r\n{\r\n //lemma_MapSentPacketSeqToIos(sent_packets);\r\n if |sent_packets| == 0 then\r\n []\r\n else if |sent_packets| == 1 then\r\n [LIoOpSend(AbstractifyCPacketToRslPacket(sent_packets[0]))]\r\n else\r\n [LIoOpSend(AbstractifyCPacketToRslPacket(sent_packets[0]))] + MapSentPacketSeqToIos(sent_packets[1..])\r\n}\r\n\r\nlemma {:timeLimitMultiplier 3} lemma_MapSentPacketSeqToIosExtractSentPacketsFromIosEquivalence(sent_packets:OutboundPackets, ios:seq)\r\n requires sent_packets.PacketSequence?\r\n requires OutboundPacketsIsValid(sent_packets)\r\n requires OutboundPacketsIsAbstractable(sent_packets)\r\n requires ios == MapSentPacketSeqToIos(sent_packets.s)\r\n requires forall i :: 0 <= i < |sent_packets.s| ==> CPacketIsSendable(sent_packets.s[i])\r\n ensures AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios)\r\n decreases |ios|\r\n{\r\n assert AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == AbstractifySeqOfCPacketsToSeqOfRslPackets(sent_packets.s);\r\n reveal ExtractSentPacketsFromIos();\r\n //assert |AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets)| == |ExtractSentPacketsFromIos(ios)|;\r\n reveal MapSentPacketSeqToIos();\r\n if (|ios| == 0) {\r\n assert AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n } else if (|ios| == 1) {\r\n assert AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n } else {\r\n if (ios[0].LIoOpSend?) {\r\n var one := ios[0];\r\n var rest := PacketSequence(sent_packets.s[1..]);\r\n assert ExtractSentPacketsFromIos(ios) == [ios[0].s] + ExtractSentPacketsFromIos(ios[1..]);\r\n \r\n lemma_MapSentPacketSeqToIosExtractSentPacketsFromIosEquivalence(rest, ios[1..]);\r\n reveal AbstractifySeqOfCPacketsToSeqOfRslPackets();\r\n assert {:split_here} true;\r\n calc {\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets);\r\n AbstractifySeqOfCPacketsToSeqOfRslPackets(sent_packets.s);\r\n [ios[0].s] + AbstractifyOutboundCPacketsToSeqOfRslPackets(rest);\r\n [ios[0].s] + ExtractSentPacketsFromIos(ios[1..]);\r\n ExtractSentPacketsFromIos(ios);\r\n }\r\n\r\n } else {\r\n assert AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n }\r\n assert AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n }\r\n //forall i | 0 <= i < |AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets)|\r\n // ensures AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets)[i] == ExtractSentPacketsFromIos(ios)[i];\r\n //{\r\n //}\r\n assert AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n}\r\n\r\nfunction {:opaque} BuildBroadcastIos(src:NodeIdentity, dsts:seq, msg:RslMessage) : seq\r\n ensures |BuildBroadcastIos(src, dsts, msg)| == |dsts|\r\n ensures forall i :: 0<=i<|dsts| ==> BuildBroadcastIos(src, dsts, msg)[i] == LIoOpSend(LPacket(dsts[i], src, msg))\r\n{\r\n if |dsts| == 0 then []\r\n else [ LIoOpSend(LPacket(dsts[0], src, msg)) ] + BuildBroadcastIos(src, dsts[1..], msg)\r\n}\r\n\r\nfunction MapBroadcastToIos(broadcast:CBroadcast) : seq\r\n requires CBroadcastIsAbstractable(broadcast)\r\n{\r\n match broadcast\r\n case CBroadcast(_,_,_) => BuildBroadcastIos(AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyEndPointsToNodeIdentities(broadcast.dsts), \r\n AbstractifyCMessageToRslMessage(broadcast.msg))\r\n case CBroadcastNop => []\r\n}\r\n\r\npredicate LReplica_Next_ReadClockAndProcessPacket_preconditions(ios:seq)\r\n{\r\n && |ios| >= 1\r\n && ios[0].LIoOpReceive?\r\n && ios[0].r.msg.RslMessage_Heartbeat?\r\n}\r\n\r\nlemma lemma_MapSentPacketToIosExtractSentPacketsFromIosEquivalence(sent_packet:Option, ios:seq)\r\n requires OutboundPacketsIsValid(OutboundPacket(sent_packet))\r\n requires ios == MapSentPacketToIos(sent_packet)\r\n ensures AbstractifyOutboundCPacketsToSeqOfRslPackets(OutboundPacket(sent_packet)) == ExtractSentPacketsFromIos(ios)\r\n{\r\n reveal ExtractSentPacketsFromIos();\r\n}\r\n\r\nlemma lemma_ExtractSentPacketsFromIos(ios:seq)\r\n requires AllIosAreSends(ios)\r\n ensures |ExtractSentPacketsFromIos(ios)| == |ios|\r\n ensures forall i {:auto_trigger} :: 0 <= i < |ios| ==> ExtractSentPacketsFromIos(ios)[i] == ios[i].s\r\n{\r\n reveal ExtractSentPacketsFromIos();\r\n}\r\n\r\nlemma lemma_MapBroadcastToIosExtractSentPacketsFromIosEquivalence(broadcast:CBroadcast, ios:seq)\r\n requires CBroadcastIsAbstractable(broadcast)\r\n requires ios == MapBroadcastToIos(broadcast)\r\n requires AllIosAreSends(ios)\r\n ensures AbstractifyCBroadcastToRlsPacketSeq(broadcast) == ExtractSentPacketsFromIos(ios)\r\n{\r\n reveal ExtractSentPacketsFromIos();\r\n\r\n if broadcast.CBroadcastNop? {\r\n\r\n } else {\r\n forall i | 0 <= i < |broadcast.dsts|\r\n ensures AbstractifyCBroadcastToRlsPacketSeq(broadcast)[i] == ExtractSentPacketsFromIos(ios)[i]\r\n {\r\n calc {\r\n AbstractifyCBroadcastToRlsPacketSeq(broadcast)[i];\r\n BuildLBroadcast(AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyEndPointsToNodeIdentities(broadcast.dsts), \r\n AbstractifyCMessageToRslMessage(broadcast.msg))[i];\r\n LPacket(AbstractifyEndPointsToNodeIdentities(broadcast.dsts)[i], \r\n AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyCMessageToRslMessage(broadcast.msg));\r\n\r\n calc {\r\n LIoOpSend(LPacket(AbstractifyEndPointsToNodeIdentities(broadcast.dsts)[i], \r\n AbstractifyEndPointToNodeIdentity(broadcast.src),\r\n AbstractifyCMessageToRslMessage(broadcast.msg)));\r\n BuildBroadcastIos(AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyEndPointsToNodeIdentities(broadcast.dsts), \r\n AbstractifyCMessageToRslMessage(broadcast.msg))[i];\r\n }\r\n { lemma_ExtractSentPacketsFromIos(ios); }\r\n ExtractSentPacketsFromIos(BuildBroadcastIos(AbstractifyEndPointToNodeIdentity(broadcast.src), \r\n AbstractifyEndPointsToNodeIdentities(broadcast.dsts), \r\n AbstractifyCMessageToRslMessage(broadcast.msg)))[i];\r\n ExtractSentPacketsFromIos(ios)[i];\r\n }\r\n }\r\n\r\n calc {\r\n |AbstractifyCBroadcastToRlsPacketSeq(broadcast)|;\r\n |broadcast.dsts|;\r\n |ios|;\r\n { lemma_ExtractSentPacketsFromIos(ios); }\r\n |ExtractSentPacketsFromIos(ios)|;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_NetEventLogToBroadcast(netEventLog:seq, broadcast:CBroadcast, index:int)\r\n requires CBroadcastIsValid(broadcast)\r\n requires broadcast.CBroadcast?\r\n requires 0 <= index < |netEventLog|\r\n requires SendLogReflectsBroadcast(netEventLog, broadcast)\r\n ensures netEventLog[index].LIoOpSend?\r\n ensures NetPacketIsAbstractable(netEventLog[index].s)\r\n ensures AbstractifyNetPacketToRslPacket(netEventLog[index].s) == AbstractifyCBroadcastToRlsPacketSeq(broadcast)[index]\r\n{\r\n calc ==> {\r\n true;\r\n SendLogReflectsBroadcast(netEventLog, broadcast);\r\n SendLogReflectsBroadcastPrefix(netEventLog, broadcast);\r\n SendLogMatchesRefinement(netEventLog, broadcast, index);\r\n netEventLog[index].LIoOpSend? && NetPacketIsAbstractable(netEventLog[index].s)\r\n && AbstractifyCBroadcastToRlsPacketSeq(broadcast)[index] == AbstractifyNetPacketToRslPacket(netEventLog[index].s);\r\n }\r\n}\r\n\r\nlemma lemma_NetEventLogToBroadcastRefinable(netEventLog:seq, broadcast:CBroadcast)\r\n requires CBroadcastIsValid(broadcast)\r\n requires SendLogReflectsBroadcast(netEventLog, broadcast)\r\n ensures NetEventLogIsAbstractable(netEventLog)\r\n{\r\n if broadcast.CBroadcastNop? {\r\n assert netEventLog == [];\r\n } else {\r\n forall i | 0 <= i < |netEventLog|\r\n ensures NetEventIsAbstractable(netEventLog[i])\r\n {\r\n lemma_NetEventLogToBroadcast(netEventLog, broadcast, i);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_ExtractSentPacketsFromIosDoesNotMindSomeClutter(ios_head:seq, ios_tail:seq)\r\n requires forall i :: 0<=i<|ios_head| ==> !ios_head[i].LIoOpSend?\r\n ensures ExtractSentPacketsFromIos(ios_tail) == ExtractSentPacketsFromIos(ios_head + ios_tail)\r\n{\r\n if |ios_head| == 0 {\r\n assert ios_head + ios_tail == ios_tail;\r\n } else {\r\n assert !ios_head[0].LIoOpSend?;\r\n ghost var ios := [ios_head[0]] + ios_head[1..] + ios_tail;\r\n \r\n calc {\r\n ExtractSentPacketsFromIos(ios_head + ios_tail);\r\n { assert ios_head == [ios_head[0]] + ios_head[1..]; }\r\n ExtractSentPacketsFromIos([ios_head[0]] + ios_head[1..] + ios_tail);\r\n ExtractSentPacketsFromIos(ios);\r\n { assert ios[0] == ios_head[0]; assert ios[1..] == ios_head[1..] + ios_tail;\r\n reveal ExtractSentPacketsFromIos(); }\r\n ExtractSentPacketsFromIos(ios_head[1..] + ios_tail);\r\n { lemma_ExtractSentPacketsFromIosDoesNotMindSomeClutter(ios_head[1..], ios_tail); }\r\n ExtractSentPacketsFromIos(ios_tail);\r\n }\r\n }\r\n}\r\n\r\npredicate NoClockMessage(msg:CMessage)\r\n{\r\n || msg.CMessage_Request?\r\n || msg.CMessage_1a?\r\n || msg.CMessage_1b?\r\n || msg.CMessage_StartingPhase2?\r\n || msg.CMessage_2a?\r\n || msg.CMessage_2b?\r\n || msg.CMessage_Reply?\r\n || msg.CMessage_AppStateRequest?\r\n || msg.CMessage_AppStateSupply?\r\n}\r\n\r\nlemma lemma_YesWeHaveNoPackets()\r\n ensures AbstractifyOutboundCPacketsToSeqOfRslPackets(Broadcast(CBroadcastNop)) == []\r\n{\r\n}\r\n\r\nlemma {:timeLimitMultiplier 3} lemma_ReplicaNextProcessPacketWithoutReadingClockHelper(\r\n replica:LReplica, replica':ReplicaState, cpacket:CPacket, sent_packets:OutboundPackets,\r\n ios:seq, io0:RslIo, ios_head:seq, ios_tail:seq, \r\n netEvent0:NetEvent, log_head:seq, log_tail:seq, netEventLog:seq)\r\n // From Receive:\r\n requires netEvent0.LIoOpReceive?\r\n requires CPacketIsAbstractable(cpacket)\r\n requires NetEventIsAbstractable(netEvent0)\r\n requires AbstractifyCPacketToRslPacket(cpacket) == AbstractifyNetPacketToRslPacket(netEvent0.r)\r\n requires io0 == LIoOpReceive(AbstractifyNetPacketToRslPacket(netEvent0.r))\r\n\r\n // From downcalls:\r\n requires ReplicaCommonPostconditions(replica, replica', sent_packets)\r\n requires Establish_Q_LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(replica, AbstractifyReplicaStateToLReplica(replica'), AbstractifyCPacketToRslPacket(cpacket), AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), ios)\r\n\r\n // From DeliverOutboundPackets:\r\n requires AllIosAreSends(ios_tail)\r\n requires AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios_tail)\r\n requires RawIoConsistentWithSpecIO(log_tail, ios_tail)\r\n\r\n requires ios_head == [io0]\r\n requires log_head == [netEvent0]\r\n requires ios == ios_head+ios_tail\r\n requires netEventLog == log_head+log_tail\r\n \r\n// ensures AllIosAreSends(ios); // bad idea\r\n //ensures Establish_Q_LReplica_NoReceive_Next_preconditions(replica, replica', clock, sent_packets, nextActionIndex, ios);\r\n ensures RawIoConsistentWithSpecIO(netEventLog, ios)\r\n ensures Q_LReplica_Next_ProcessPacketWithoutReadingClock(replica, AbstractifyReplicaStateToLReplica(replica'), ios)\r\n ensures RawIoConsistentWithSpecIO(netEventLog, ios)\r\n ensures forall io :: io in ios[1..] ==> io.LIoOpSend?\r\n{\r\n forall io | io in ios[1..] ensures io.LIoOpSend?\r\n {\r\n var idx :| 0<=idx<|ios[1..]| && io==ios[1..][idx]; // because spec uses 'in seq' instead of indexing\r\n assert io == ios_tail[idx];\r\n assert AllIosAreSends(ios_tail);\r\n assert io.LIoOpSend?;\r\n }\r\n\r\n forall i | 0<=i<|netEventLog|\r\n ensures NetEventIsAbstractable(netEventLog[i])\r\n ensures ios[i] == AbstractifyNetEventToRslIo(netEventLog[i])\r\n {\r\n if (i==0) {\r\n assert netEventLog[i]==netEvent0;\r\n assert NetEventIsAbstractable(netEventLog[i]);\r\n assert ios[i] == AbstractifyNetEventToRslIo(netEventLog[i]);\r\n } else {\r\n calc {\r\n netEventLog[i];\r\n ([netEvent0] + log_tail)[i];\r\n log_tail[i-1];\r\n }\r\n assert netEventLog[i]==log_tail[i-1];\r\n assert NetEventIsAbstractable(netEventLog[i]);\r\n assert ios[i] == AbstractifyNetEventToRslIo(netEventLog[i]);\r\n }\r\n }\r\n assert NetEventLogIsAbstractable(netEventLog);\r\n assert AbstractifyRawLogToIos(netEventLog) == ios;\r\n\r\n lemma_ExtractSentPacketsFromIosDoesNotMindSomeClutter(ios_head, ios_tail);\r\n\r\n lemma_EstablishQLReplicaNextProcessPacketWithoutReadingClock(replica, AbstractifyReplicaStateToLReplica(replica'), AbstractifyCPacketToRslPacket(cpacket), AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), ios);\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n}\r\n \r\nlemma lemma_CombineAbstractifyNetEventToRslIo(ios_head:seq, ios_tail:seq, ios:seq, log_head:seq, log_tail:seq, log:seq)\r\n requires |log_head| == |ios_head|\r\n requires forall i :: 0<=i<|log_head|\r\n ==> NetEventIsAbstractable(log_head[i]) && ios_head[i] == AbstractifyNetEventToRslIo(log_head[i])\r\n requires |log_tail| == |ios_tail|\r\n requires forall i :: 0<=i<|log_tail|\r\n ==> NetEventIsAbstractable(log_tail[i]) && ios_tail[i] == AbstractifyNetEventToRslIo(log_tail[i])\r\n requires ios == ios_head+ios_tail\r\n requires log == log_head+log_tail\r\n ensures forall i :: 0<=i<|log| ==> ios[i] == AbstractifyNetEventToRslIo(log[i])\r\n{\r\n}\r\n\r\nlemma lemma_NetEventLogIsAbstractableExtend(log_head:seq, log_tail:seq, log:seq)\r\n requires log == log_head+log_tail\r\n requires NetEventLogIsAbstractable(log_head)\r\n requires NetEventLogIsAbstractable(log_tail)\r\n ensures NetEventLogIsAbstractable(log)\r\n{\r\n}\r\n\r\nlemma lemma_ReplicaNoReceiveReadClockNextHelper(\r\n replica:LReplica, replica':ReplicaState, clock:CClockReading, sent_packets:OutboundPackets, nextActionIndex:int,\r\n ios:seq, io0:RslIo, ios_head:seq, ios_tail:seq, \r\n netEvent0:NetEvent, log_head:seq, log_tail:seq, netEventLog:seq)\r\n // From ReadClock:\r\n requires netEvent0.LIoOpReadClock?\r\n requires clock.t as int == netEvent0.t\r\n requires NetEventIsAbstractable(netEvent0)\r\n requires io0 == LIoOpReadClock(clock.t as int)\r\n\r\n // From downcalls:\r\n requires ReplicaCommonPostconditions(replica, replica', sent_packets)\r\n requires\r\n var lreplica' := AbstractifyReplicaStateToLReplica(replica');\r\n var lclock := AbstractifyCClockReadingToClockReading(clock);\r\n var lsent_packets := AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets);\r\n && (nextActionIndex == 3 || 7 <= nextActionIndex <= 9)\r\n && (nextActionIndex==3 ==> Q_LReplica_Next_ReadClock_MaybeNominateValueAndSend2a(replica, lreplica', lclock, lsent_packets))\r\n && (nextActionIndex==7 ==> Q_LReplica_Next_ReadClock_CheckForViewTimeout(replica, lreplica', lclock, lsent_packets))\r\n && (nextActionIndex==8 ==> Q_LReplica_Next_ReadClock_CheckForQuorumOfViewSuspicions(replica, lreplica', lclock, lsent_packets))\r\n && (nextActionIndex==9 ==> Q_LReplica_Next_ReadClock_MaybeSendHeartbeat(replica, lreplica', lclock, lsent_packets))\r\n\r\n // From DeliverOutboundPackets:\r\n requires AllIosAreSends(ios_tail)\r\n requires AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios_tail)\r\n requires RawIoConsistentWithSpecIO(log_tail, ios_tail)\r\n\r\n requires ios_head == [io0]\r\n requires log_head == [netEvent0]\r\n requires ios == ios_head+ios_tail\r\n requires netEventLog == log_head+log_tail\r\n \r\n// ensures AllIosAreSends(ios); // bad idea\r\n //ensures Establish_Q_LReplica_NoReceive_Next_preconditions(replica, replica', clock, sent_packets, nextActionIndex, ios);\r\n ensures RawIoConsistentWithSpecIO(netEventLog, ios)\r\n ensures Q_LReplica_NoReceive_Next(replica, nextActionIndex as int, AbstractifyReplicaStateToLReplica(replica'), ios)\r\n ensures forall io :: io in ios[1..] ==> io.LIoOpSend?\r\n{\r\n var lreplica' := AbstractifyReplicaStateToLReplica(replica');\r\n var lclock := AbstractifyCClockReadingToClockReading(clock);\r\n var lsent_packets := AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets);\r\n\r\n forall io | io in ios[1..] ensures io.LIoOpSend?\r\n {\r\n var idx :| 0<=idx<|ios[1..]| && io==ios[1..][idx]; // because spec uses 'in seq' instead of indexing\r\n assert io == ios_tail[idx];\r\n assert AllIosAreSends(ios_tail);\r\n assert io.LIoOpSend?;\r\n }\r\n// forall io | io in ios ensures io.LIoOpSend?\r\n// {\r\n// var i :| 0<=i<|ios| && io==ios[i];\r\n// }\r\n// assert AllIosAreSends(ios);\r\n\r\n assert io0 == AbstractifyNetEventToRslIo(netEvent0);\r\n forall i | 0<=i<|log_head| ensures NetEventIsAbstractable(log_head[i]) && ios_head[i] == AbstractifyNetEventToRslIo(log_head[i])\r\n {\r\n assert log_head[i] == netEvent0;\r\n assert ios_head[i] == io0;\r\n }\r\n\r\n lemma_ExtractSentPacketsFromIosDoesNotMindSomeClutter(ios_head, ios_tail);\r\n assert forall io :: io in ios[1..] ==> io.LIoOpSend?; // OBSERVE trigger\r\n ghost var log_head := [netEvent0];\r\n lemma_CombineAbstractifyNetEventToRslIo(ios_head, ios_tail, ios, log_head, log_tail, netEventLog);\r\n\r\n assert AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n lemma_NetEventLogIsAbstractableExtend(log_head, log_tail, netEventLog);\r\n assert NetEventLogIsAbstractable(netEventLog);\r\n lemma_EstablishAbstractifyRawLogToIos(netEventLog, ios);\r\n assert AbstractifyRawLogToIos(netEventLog) == ios;\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n\r\n assert SpontaneousIos(ios, 1);\r\n assert AbstractifyCClockReadingToClockReading(clock) == ClockReading(ios[0].t);\r\n assert AbstractifyCClockReadingToClockReading(clock) == SpontaneousClock(ios);\r\n\r\n lemma_EstablishQLReplicaNoReceiveNextFromReadClock(replica, lreplica', lclock, lsent_packets, nextActionIndex as int, ios);\r\n}\r\n\r\nlemma lemma_SingletonSeqPrependSilly(log_head:seq, log_tail:seq, log:seq)\r\n requires |log_head|==1\r\n requires log == log_head + log_tail\r\n ensures log_tail == log[1..]\r\n{\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaImplMain.i.dfy", "content": "include \"../../Common/Collections/Seqs.i.dfy\"\r\ninclude \"../../../Libraries/Math/mod_auto.i.dfy\"\r\ninclude \"../../Protocol/RSL/Replica.i.dfy\"\r\ninclude \"ReplicaModel.i.dfy\"\r\ninclude \"ReplicaImplLemmas.i.dfy\"\r\ninclude \"ReplicaImplClass.i.dfy\"\r\ninclude \"ReplicaImplProcessPacketX.i.dfy\"\r\ninclude \"ReplicaImplNoReceiveNoClock.i.dfy\"\r\ninclude \"ReplicaImplNoReceiveClock.i.dfy\"\r\ninclude \"NetRSL.i.dfy\"\r\ninclude \"CClockReading.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaImplMain_i {\r\n\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Collections__Seqs_i\r\nimport opened Math__mod_auto_i\r\nimport opened LiveRSL__CClockReading_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__QRelations_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__ReplicaImplClass_i\r\nimport opened LiveRSL__ReplicaImplLemmas_i\r\nimport opened LiveRSL__ReplicaImplNoReceiveClock_i\r\nimport opened LiveRSL__ReplicaImplNoReceiveNoClock_i\r\nimport opened LiveRSL__ReplicaImplProcessPacketX_i\r\nimport opened LiveRSL__ReplicaModel_i\r\nimport opened LiveRSL__NetRSL_i\r\nimport opened LiveRSL__Unsendable_i\r\nimport opened Common__NetClient_i\r\n\r\n\r\nmethod rollActionIndex(a:uint64) returns (a':uint64)\r\n requires 0 <= a as int < 10\r\n ensures a' as int == ((a as int) + 1) % LReplicaNumActions()\r\n{\r\n lemma_mod_auto(10);\r\n if (a >= 9) {\r\n a' := 0;\r\n } else {\r\n a' := (a + 1);\r\n }\r\n}\r\n\r\nmethod {:timeLimitMultiplier 2} ReplicaNextMainProcessPacketX(r:ReplicaImpl)\r\n returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.Valid()\r\n requires r.nextActionIndex == 0\r\n modifies r.Repr, r.cur_req_set, r.prev_req_set, r.reply_cache_mutable\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures r.Env().Valid() && r.Env().ok.ok() ==> ok\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && (|| Q_LScheduler_Next(old(r.AbstractifyToLScheduler()), r.AbstractifyToLScheduler(), ios)\r\n || HostNextIgnoreUnsendable(old(r.AbstractifyToLScheduler()), r.AbstractifyToLScheduler(), netEventLog))\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n ghost var replica_old := old(r.AbstractifyToLReplica());\r\n ghost var scheduler_old := old(r.AbstractifyToLScheduler());\r\n\r\n assert scheduler_old.nextActionIndex == 0;\r\n\r\n //print (\"Replica_Next_main Enter\\n\");\r\n assert scheduler_old.replica == replica_old;\r\n ok, netEventLog, ios := Replica_Next_ProcessPacketX(r);\r\n if (!ok) { return; }\r\n\r\n assert r.Valid();\r\n\r\n // Mention unchanged predicates over mutable state in the old heap.\r\n ghost var net_client_old := r.netClient;\r\n ghost var net_addr_old := r.netClient.MyPublicKey();\r\n assert NetClientIsValid(net_client_old);\r\n\r\n ghost var replica := r.AbstractifyToLReplica();\r\n r.nextActionIndex := 1;\r\n ghost var scheduler := r.AbstractifyToLScheduler();\r\n\r\n // Mention unchanged predicates over mutable state in the new heap.\r\n assert net_client_old == r.netClient;\r\n assert NetClientIsValid(r.netClient);\r\n assert net_addr_old == r.netClient.MyPublicKey();\r\n\r\n assert r.Valid();\r\n\r\n calc {\r\n scheduler.nextActionIndex;\r\n r.nextActionIndex as int;\r\n 1;\r\n { lemma_mod_auto(LReplicaNumActions()); }\r\n (1)%LReplicaNumActions();\r\n (scheduler_old.nextActionIndex+1)%LReplicaNumActions();\r\n }\r\n\r\n if Q_LReplica_Next_ProcessPacket(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios) {\r\n lemma_EstablishQLSchedulerNext(replica_old, replica, ios, scheduler_old, scheduler);\r\n assert Q_LScheduler_Next(old(r.AbstractifyToLScheduler()), r.AbstractifyToLScheduler(), ios);\r\n }\r\n else {\r\n assert IosReflectIgnoringUnsendable(netEventLog);\r\n assert old(r.AbstractifyToLReplica()) == r.AbstractifyToLReplica();\r\n assert HostNextIgnoreUnsendable(old(r.AbstractifyToLScheduler()), r.AbstractifyToLScheduler(), netEventLog);\r\n }\r\n}\r\n\r\nmethod ReplicaNextMainNoClock(r:ReplicaImpl)\r\n returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.Valid()\r\n requires r.nextActionIndex == 1 || r.nextActionIndex == 2 || r.nextActionIndex == 4 || r.nextActionIndex == 5 || r.nextActionIndex == 6\r\n modifies r.replica.executor.app, r.Repr, r.cur_req_set, r.prev_req_set, r.reply_cache_mutable\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures r.Env().Valid() && r.Env().ok.ok() ==> ok\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && Q_LScheduler_Next(old(r.AbstractifyToLScheduler()), r.AbstractifyToLScheduler(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n var curActionIndex := r.nextActionIndex;\r\n\r\n ghost var replica_old := old(r.AbstractifyToLReplica());\r\n ghost var scheduler_old := old(r.AbstractifyToLScheduler());\r\n\r\n assert scheduler_old.replica == replica_old;\r\n ok, netEventLog, ios := Replica_NoReceive_NoClock_Next(r);\r\n if (!ok) { return; }\r\n\r\n assert r.Valid();\r\n\r\n // Mention unchanged predicates over mutable state in the old heap.\r\n ghost var net_client_old := r.netClient;\r\n ghost var net_addr_old := r.netClient.MyPublicKey();\r\n assert NetClientIsValid(net_client_old);\r\n\r\n ghost var replica := r.AbstractifyToLReplica();\r\n var nextActionIndex' := r.nextActionIndex + 1; // rollActionIndex(r.nextActionIndex);\r\n r.nextActionIndex := nextActionIndex';\r\n ghost var scheduler := r.AbstractifyToLScheduler();\r\n\r\n // Mention unchanged predicates over mutable state in the new heap.\r\n assert net_client_old == r.netClient;\r\n assert NetClientIsValid(r.netClient);\r\n assert net_addr_old == r.netClient.MyPublicKey();\r\n\r\n assert r.Valid();\r\n \r\n calc {\r\n scheduler.nextActionIndex;\r\n r.nextActionIndex as int;\r\n nextActionIndex' as int;\r\n { lemma_mod_auto(LReplicaNumActions()); }\r\n ((curActionIndex+1) as int)%LReplicaNumActions();\r\n (scheduler_old.nextActionIndex+1)%LReplicaNumActions();\r\n }\r\n\r\n lemma_EstablishQLSchedulerNext(replica_old, replica, ios, scheduler_old, scheduler);\r\n assert Q_LScheduler_Next(old(r.AbstractifyToLScheduler()), r.AbstractifyToLScheduler(), ios);\r\n}\r\n\r\nmethod ReplicaNextMainReadClock(r:ReplicaImpl)\r\n returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.Valid()\r\n requires r.nextActionIndex == 3 || r.nextActionIndex == 7 || r.nextActionIndex == 8 || r.nextActionIndex == 9\r\n modifies r.Repr, r.cur_req_set, r.prev_req_set, r.reply_cache_mutable\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures r.Env().Valid() && r.Env().ok.ok() ==> ok\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && Q_LScheduler_Next(old(r.AbstractifyToLScheduler()), r.AbstractifyToLScheduler(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n var curActionIndex := r.nextActionIndex;\r\n\r\n ghost var replica_old := old(r.AbstractifyToLReplica());\r\n ghost var scheduler_old := old(r.AbstractifyToLScheduler());\r\n\r\n assert scheduler_old.replica == replica_old;\r\n ok, netEventLog, ios := Replica_NoReceive_ReadClock_Next(r);\r\n if (!ok) { return; }\r\n\r\n assert r.Valid();\r\n\r\n // Mention unchanged predicates over mutable state in the old heap.\r\n ghost var net_client_old := r.netClient;\r\n ghost var net_addr_old := r.netClient.MyPublicKey();\r\n assert NetClientIsValid(net_client_old);\r\n\r\n ghost var replica := r.AbstractifyToLReplica();\r\n var nextActionIndex' := rollActionIndex(r.nextActionIndex);\r\n r.nextActionIndex := nextActionIndex';\r\n ghost var scheduler := r.AbstractifyToLScheduler();\r\n\r\n // Mention unchanged predicates over mutable state in the new heap.\r\n assert net_client_old == r.netClient;\r\n assert NetClientIsValid(r.netClient);\r\n assert net_addr_old == r.netClient.MyPublicKey();\r\n\r\n assert r.Valid();\r\n \r\n calc {\r\n scheduler.nextActionIndex;\r\n r.nextActionIndex as int;\r\n nextActionIndex' as int;\r\n ((curActionIndex+1) as int)%LReplicaNumActions();\r\n (scheduler_old.nextActionIndex+1)%LReplicaNumActions();\r\n }\r\n\r\n lemma_EstablishQLSchedulerNext(replica_old, replica, ios, scheduler_old, scheduler);\r\n assert Q_LScheduler_Next(old(r.AbstractifyToLScheduler()), r.AbstractifyToLScheduler(), ios);\r\n}\r\n\r\nmethod Replica_Next_main(r:ReplicaImpl)\r\n returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.Valid()\r\n modifies r.replica.executor.app, r.Repr, r.cur_req_set, r.prev_req_set, r.reply_cache_mutable\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures r.Env().Valid() && r.Env().ok.ok() ==> ok\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && (|| Q_LScheduler_Next(old(r.AbstractifyToLScheduler()), r.AbstractifyToLScheduler(), ios)\r\n || HostNextIgnoreUnsendable(old(r.AbstractifyToLScheduler()), r.AbstractifyToLScheduler(), netEventLog))\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n //print (\"Replica_Next_main Enter\\n\");\r\n if r.nextActionIndex == 0 {\r\n ok, netEventLog, ios := ReplicaNextMainProcessPacketX(r);\r\n }\r\n else if r.nextActionIndex == 1 || r.nextActionIndex == 2 || r.nextActionIndex == 4 || r.nextActionIndex == 5 || r.nextActionIndex == 6 {\r\n ok, netEventLog, ios := ReplicaNextMainNoClock(r);\r\n }\r\n else if (r.nextActionIndex == 3 || 7 <= r.nextActionIndex <= 9) {\r\n ok, netEventLog, ios := ReplicaNextMainReadClock(r);\r\n }\r\n //print (\"Replica_Next_main Exit\\n\");\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaImplNoReceiveClock.i.dfy", "content": "include \"../../Common/Collections/Seqs.i.dfy\"\r\ninclude \"../../../Libraries/Math/mod_auto.i.dfy\"\r\ninclude \"../../Protocol/RSL/Replica.i.dfy\"\r\ninclude \"ReplicaModel.i.dfy\"\r\ninclude \"ReplicaImplLemmas.i.dfy\"\r\ninclude \"ReplicaImplClass.i.dfy\"\r\ninclude \"ReplicaImplDelivery.i.dfy\"\r\ninclude \"NetRSL.i.dfy\"\r\ninclude \"CClockReading.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaImplNoReceiveClock_i {\r\n\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Collections__Seqs_i\r\nimport opened Math__mod_auto_i\r\nimport opened LiveRSL__CClockReading_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__QRelations_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__ReplicaModel_i\r\nimport opened LiveRSL__ReplicaModel_Part3_i\r\nimport opened LiveRSL__ReplicaModel_Part4_i\r\nimport opened LiveRSL__ReplicaModel_Part5_i\r\nimport opened LiveRSL__ReplicaState_i\r\nimport opened LiveRSL__ReplicaImplLemmas_i\r\nimport opened LiveRSL__ReplicaImplClass_i\r\nimport opened LiveRSL__ReplicaImplDelivery_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__NetRSL_i\r\nimport opened Common__NetClient_i\r\nimport opened Environment_s\r\n\r\nlemma lemma_ReplicaNoReceiveReadClockNextHelper2(\r\n oldHistory:seq,\r\n preDeliveryHistory:seq,\r\n finalHistory:seq,\r\n log_head:seq,\r\n log_tail:seq,\r\n log_head_and_tail:seq\r\n )\r\n requires preDeliveryHistory == oldHistory + log_head\r\n requires finalHistory == preDeliveryHistory + log_tail\r\n requires log_head_and_tail == log_head + log_tail\r\n requires forall io :: io in log_head ==> !io.LIoOpSend?\r\n requires OnlySentMarshallableData(log_tail)\r\n ensures finalHistory == oldHistory + log_head_and_tail\r\n ensures OnlySentMarshallableData(log_head_and_tail)\r\n{\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextMaybeNominateValueAndSend2aPostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n clock:CClockReading,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_ReadClock_MaybeNominateValueAndSend2a_Postconditions(replica, replica', clock, packets_sent)\r\n ensures Q_LReplica_Next_ReadClock_MaybeNominateValueAndSend2a(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCClockReadingToClockReading(clock), AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n{\r\n reveal Q_LReplica_Next_ReadClock_MaybeNominateValueAndSend2a();\r\n}\r\n\r\nmethod {:fuel ReplicaStateIsValid,0,0}{:timeLimitMultiplier 3} ReplicaNoReceiveReadClockNextMaybeNominateValueAndSend2a(\r\n r:ReplicaImpl\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.nextActionIndex == 3\r\n requires r.Valid()\r\n modifies r.Repr\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==> \r\n && r.Valid()\r\n && r.Env() == old(r.Env())\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && Q_LReplica_NoReceive_Next(old(r.AbstractifyToLReplica()), r.nextActionIndex as int, r.AbstractifyToLReplica(), ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n var clock,netEvent0 := ReadClock(r.netClient);\r\n ghost var io0 := LIoOpReadClock(clock.t as int);\r\n\r\n var sent_packets;\r\n r.replica,sent_packets := Replica_Next_Spontaneous_MaybeNominateValueAndSend2a(r.replica, clock);\r\n lemma_RevealQFromReplicaNextMaybeNominateValueAndSend2aPostconditions(replica_old, r.replica, clock, sent_packets);\r\n\r\n assert r.Valid();\r\n ghost var preDeliveryHistory := r.Env().net.history();\r\n ghost var log_tail, ios_tail;\r\n ok, log_tail, ios_tail := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n\r\n ghost var ios_head := [io0];\r\n ghost var log_head := [netEvent0];\r\n ios := ios_head + ios_tail;\r\n netEventLog := log_head + log_tail;\r\n\r\n lemma_ReplicaNoReceiveReadClockNextHelper2(old(r.Env().net.history()), preDeliveryHistory, r.Env().net.history(),\r\n log_head, log_tail, netEventLog);\r\n lemma_ReplicaNoReceiveReadClockNextHelper(\r\n replica_old, r.replica, clock, sent_packets, r.nextActionIndex as int,\r\n ios, io0, ios_head, ios_tail, \r\n netEvent0, log_head, log_tail, netEventLog);\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextCheckForViewTimeoutPostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n clock:CClockReading,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_ReadClock_CheckForViewTimeout_Postconditions(replica, replica', clock, packets_sent)\r\n ensures Q_LReplica_Next_ReadClock_CheckForViewTimeout(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCClockReadingToClockReading(clock), AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n{\r\n reveal Q_LReplica_Next_ReadClock_CheckForViewTimeout();\r\n}\r\n\r\nmethod {:fuel ReplicaStateIsValid,0,0}{:timeLimitMultiplier 3} ReplicaNoReceiveReadClockNextCheckForViewTimeout(\r\n r:ReplicaImpl\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.nextActionIndex == 7\r\n requires r.Valid()\r\n modifies r.Repr, r.cur_req_set, r.prev_req_set //, r.reply_cache_mutable;\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env())\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.Env() == old(r.Env())\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && Q_LReplica_NoReceive_Next(old(r.AbstractifyToLReplica()), r.nextActionIndex as int, r.AbstractifyToLReplica(), ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n var clock,netEvent0 := ReadClock(r.netClient);\r\n ghost var io0 := LIoOpReadClock(clock.t as int);\r\n\r\n var sent_packets;\r\n r.replica,sent_packets := Replica_Next_ReadClock_CheckForViewTimeout(r.replica, clock, r.cur_req_set, r.prev_req_set);\r\n lemma_RevealQFromReplicaNextCheckForViewTimeoutPostconditions(replica_old, r.replica, clock, sent_packets);\r\n\r\n assert r.Valid();\r\n ghost var preDeliveryHistory := r.Env().net.history();\r\n ghost var log_tail, ios_tail;\r\n ok, log_tail, ios_tail := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n\r\n ghost var ios_head := [io0];\r\n ghost var log_head := [netEvent0];\r\n ios := ios_head + ios_tail;\r\n netEventLog := log_head + log_tail;\r\n\r\n lemma_ReplicaNoReceiveReadClockNextHelper2(old(r.Env().net.history()), preDeliveryHistory, r.Env().net.history(),\r\n log_head, log_tail, netEventLog);\r\n lemma_ReplicaNoReceiveReadClockNextHelper(\r\n replica_old, r.replica, clock, sent_packets, r.nextActionIndex as int,\r\n ios, io0, ios_head, ios_tail, \r\n netEvent0, log_head, log_tail, netEventLog);\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextCheckForQuorumOfViewSuspicionsPostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n clock:CClockReading,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_ReadClock_CheckForQuorumOfViewSuspicions_Postconditions(replica, replica', clock, packets_sent)\r\n ensures Q_LReplica_Next_ReadClock_CheckForQuorumOfViewSuspicions(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCClockReadingToClockReading(clock), AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n{\r\n reveal Q_LReplica_Next_ReadClock_CheckForQuorumOfViewSuspicions();\r\n}\r\n\r\nmethod {:fuel ReplicaStateIsValid,0,0}{:timeLimitMultiplier 3} ReplicaNoReceiveReadClockNextCheckForQuorumOfViewSuspicions(\r\n r:ReplicaImpl\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.nextActionIndex == 8\r\n requires r.Valid()\r\n modifies r.Repr, r.cur_req_set, r.prev_req_set //, r.reply_cache_mutable\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env())\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.Env() == old(r.Env())\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && Q_LReplica_NoReceive_Next(old(r.AbstractifyToLReplica()), r.nextActionIndex as int, r.AbstractifyToLReplica(), ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n var clock,netEvent0 := ReadClock(r.netClient);\r\n ghost var io0 := LIoOpReadClock(clock.t as int);\r\n\r\n var sent_packets;\r\n r.replica,sent_packets := Replica_Next_ReadClock_CheckForQuorumOfViewSuspicions(r.replica, clock, r.cur_req_set, r.prev_req_set);\r\n lemma_RevealQFromReplicaNextCheckForQuorumOfViewSuspicionsPostconditions(replica_old, r.replica, clock, sent_packets);\r\n \r\n assert r.Valid();\r\n ghost var preDeliveryHistory := r.Env().net.history();\r\n ghost var log_tail, ios_tail;\r\n ok, log_tail, ios_tail := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n\r\n ghost var ios_head := [io0];\r\n ghost var log_head := [netEvent0];\r\n ios := ios_head + ios_tail;\r\n netEventLog := log_head + log_tail;\r\n\r\n lemma_ReplicaNoReceiveReadClockNextHelper2(old(r.Env().net.history()), preDeliveryHistory, r.Env().net.history(),\r\n log_head, log_tail, netEventLog);\r\n lemma_ReplicaNoReceiveReadClockNextHelper(\r\n replica_old, r.replica, clock, sent_packets, r.nextActionIndex as int,\r\n ios, io0, ios_head, ios_tail, \r\n netEvent0, log_head, log_tail, netEventLog);\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextMaybeSendHeartbeatPostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n clock:CClockReading,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_ReadClock_MaybeSendHeartbeat_Postconditions(replica, replica', clock, packets_sent)\r\n ensures Q_LReplica_Next_ReadClock_MaybeSendHeartbeat(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCClockReadingToClockReading(clock), AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n{\r\n reveal Q_LReplica_Next_ReadClock_MaybeSendHeartbeat();\r\n}\r\n\r\nmethod {:fuel ReplicaStateIsValid,0,0}{:timeLimitMultiplier 3} ReplicaNoReceiveReadClockNextMaybeSendHeartbat(\r\n r:ReplicaImpl\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.nextActionIndex == 9\r\n requires r.Valid()\r\n modifies r.Repr\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env())\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.Env() == old(r.Env())\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && Q_LReplica_NoReceive_Next(old(r.AbstractifyToLReplica()), r.nextActionIndex as int, r.AbstractifyToLReplica(), ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n var clock,netEvent0 := ReadClock(r.netClient);\r\n ghost var io0 := LIoOpReadClock(clock.t as int);\r\n\r\n var sent_packets;\r\n r.replica,sent_packets := Replica_Next_ReadClock_MaybeSendHeartbeat(r.replica, clock);\r\n lemma_RevealQFromReplicaNextMaybeSendHeartbeatPostconditions(replica_old, r.replica, clock, sent_packets);\r\n\r\n assert r.Valid();\r\n ghost var preDeliveryHistory := r.Env().net.history();\r\n ghost var log_tail, ios_tail;\r\n ok, log_tail, ios_tail := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n\r\n ghost var ios_head := [io0];\r\n ghost var log_head := [netEvent0];\r\n ios := ios_head + ios_tail;\r\n netEventLog := log_head + log_tail;\r\n\r\n lemma_ReplicaNoReceiveReadClockNextHelper2(old(r.Env().net.history()), preDeliveryHistory, r.Env().net.history(),\r\n log_head, log_tail, netEventLog);\r\n lemma_ReplicaNoReceiveReadClockNextHelper(\r\n replica_old, r.replica, clock, sent_packets, r.nextActionIndex as int,\r\n ios, io0, ios_head, ios_tail, \r\n netEvent0, log_head, log_tail, netEventLog);\r\n}\r\n\r\nmethod {:fuel ReplicaStateIsValid,0,0} Replica_NoReceive_ReadClock_Next(\r\n r:ReplicaImpl\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.nextActionIndex == 3 || 7<=r.nextActionIndex<=9\r\n requires r.Valid()\r\n modifies r.Repr, r.cur_req_set, r.prev_req_set //, r.reply_cache_mutable;\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env())\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.Env() == old(r.Env())\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && Q_LReplica_NoReceive_Next(old(r.AbstractifyToLReplica()), r.nextActionIndex as int, r.AbstractifyToLReplica(), ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n if r.nextActionIndex == 3 {\r\n ok, netEventLog, ios := ReplicaNoReceiveReadClockNextMaybeNominateValueAndSend2a(r);\r\n } else if r.nextActionIndex == 7 {\r\n ok, netEventLog, ios := ReplicaNoReceiveReadClockNextCheckForViewTimeout(r);\r\n } else if r.nextActionIndex == 8 {\r\n ok, netEventLog, ios := ReplicaNoReceiveReadClockNextCheckForQuorumOfViewSuspicions(r);\r\n } else if r.nextActionIndex == 9 {\r\n ok, netEventLog, ios := ReplicaNoReceiveReadClockNextMaybeSendHeartbat(r);\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaImplNoReceiveNoClock.i.dfy", "content": "include \"../../Common/Collections/Seqs.i.dfy\"\r\ninclude \"../../../Libraries/Math/mod_auto.i.dfy\"\r\ninclude \"../../Protocol/RSL/Replica.i.dfy\"\r\ninclude \"ReplicaModel.i.dfy\"\r\ninclude \"ReplicaImplLemmas.i.dfy\"\r\ninclude \"ReplicaImplClass.i.dfy\"\r\ninclude \"ReplicaImplDelivery.i.dfy\"\r\ninclude \"NetRSL.i.dfy\"\r\ninclude \"CClockReading.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaImplNoReceiveNoClock_i {\r\n\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Collections__Seqs_i\r\nimport opened Math__mod_auto_i\r\nimport opened LiveRSL__CClockReading_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__QRelations_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__ReplicaImplLemmas_i\r\nimport opened LiveRSL__ReplicaImplClass_i\r\nimport opened LiveRSL__ReplicaImplDelivery_i\r\nimport opened LiveRSL__ReplicaModel_i\r\nimport opened LiveRSL__ReplicaModel_Part3_i\r\nimport opened LiveRSL__ReplicaModel_Part5_i\r\nimport opened LiveRSL__ReplicaState_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__NetRSL_i\r\nimport opened Common__NetClient_i\r\nimport opened Environment_s\r\n\r\nlemma lemma_RevealQFromReplicaNextSpontaneousMaybeEnterNewViewAndSend1aPostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_MaybeEnterNewViewAndSend1a_Postconditions(replica, replica', packets_sent)\r\n ensures Q_LReplica_Next_Spontaneous_MaybeEnterNewViewAndSend1a(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n{\r\n reveal Q_LReplica_Next_Spontaneous_MaybeEnterNewViewAndSend1a();\r\n}\r\n\r\nmethod ReplicaNoReceiveNoClockNextSpontaneousMaybeEnterNewViewAndSend1a(r:ReplicaImpl)\r\n returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.nextActionIndex==1\r\n requires r.Valid()\r\n modifies r.Repr\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && Q_LReplica_NoReceive_Next(old(r.AbstractifyToLReplica()), r.nextActionIndex as int, r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n var sent_packets;\r\n r.replica,sent_packets := Replica_Next_Spontaneous_MaybeEnterNewViewAndSend1a(r.replica);\r\n lemma_RevealQFromReplicaNextSpontaneousMaybeEnterNewViewAndSend1aPostconditions(replica_old, r.replica, sent_packets);\r\n\r\n ok, netEventLog, ios := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n assert old(r.Env().net.history()) + netEventLog == r.Env().net.history(); // deleteme\r\n\r\n assert SpontaneousIos(ios, 0);\r\n assert AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n assert r.Env() == old(r.Env());\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n lemma_EstablishQLReplicaNoReceiveNextFromNoClock(replica_old, r.AbstractifyToLReplica(), AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), r.nextActionIndex as int, ios);\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextSpontaneousMaybeEnterPhase2Postconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_MaybeEnterPhase2_Postconditions(replica, replica', packets_sent)\r\n ensures Q_LReplica_Next_Spontaneous_MaybeEnterPhase2(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n{\r\n reveal Q_LReplica_Next_Spontaneous_MaybeEnterPhase2();\r\n}\r\n\r\nmethod ReplicaNoReceiveNoClockNextSpontaneousMaybeEnterPhase2(r:ReplicaImpl)\r\n returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.nextActionIndex==2\r\n requires r.Valid()\r\n modifies r.Repr\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && Q_LReplica_NoReceive_Next(old(r.AbstractifyToLReplica()), r.nextActionIndex as int, r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n var sent_packets;\r\n r.replica,sent_packets := Replica_Next_Spontaneous_MaybeEnterPhase2(r.replica);\r\n lemma_RevealQFromReplicaNextSpontaneousMaybeEnterPhase2Postconditions(replica_old, r.replica, sent_packets);\r\n\r\n ok, netEventLog, ios := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n assert old(r.Env().net.history()) + netEventLog == r.Env().net.history(); // deleteme\r\n\r\n assert SpontaneousIos(ios, 0);\r\n assert AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n assert r.Env() == old(r.Env());\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n lemma_EstablishQLReplicaNoReceiveNextFromNoClock(replica_old, r.AbstractifyToLReplica(), AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), r.nextActionIndex as int, ios);\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextSpontaneousTruncateLogBasedOnCheckpointsPostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Spontaneous_TruncateLogBasedOnCheckpoints_Postconditions(replica, replica', packets_sent)\r\n ensures Q_LReplica_Next_Spontaneous_TruncateLogBasedOnCheckpoints(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent));\r\n{\r\n reveal Q_LReplica_Next_Spontaneous_TruncateLogBasedOnCheckpoints();\r\n}\r\n\r\nmethod ReplicaNoReceiveNoClockNextSpontaneousTruncateLogBasedOnCheckpoints(r:ReplicaImpl)\r\n returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.nextActionIndex==4\r\n requires r.Valid()\r\n modifies r.Repr\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && Q_LReplica_NoReceive_Next(old(r.AbstractifyToLReplica()), r.nextActionIndex as int, r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n var sent_packets;\r\n r.replica,sent_packets := Replica_Next_Spontaneous_TruncateLogBasedOnCheckpoints(r.replica);\r\n lemma_RevealQFromReplicaNextSpontaneousTruncateLogBasedOnCheckpointsPostconditions(replica_old, r.replica, sent_packets);\r\n\r\n ok, netEventLog, ios := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n assert old(r.Env().net.history()) + netEventLog == r.Env().net.history(); // deleteme\r\n\r\n assert SpontaneousIos(ios, 0);\r\n assert AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n assert r.Env() == old(r.Env());\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n lemma_EstablishQLReplicaNoReceiveNextFromNoClock(replica_old, r.AbstractifyToLReplica(), AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), r.nextActionIndex as int, ios);\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextSpontaneousMaybeMakeDecisionPostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Spontaneous_MaybeMakeDecision_Postconditions(replica, replica', packets_sent)\r\n ensures Q_LReplica_Next_Spontaneous_MaybeMakeDecision(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n{\r\n reveal Q_LReplica_Next_Spontaneous_MaybeMakeDecision();\r\n}\r\n\r\nmethod{:timeLimitMultiplier 2} ReplicaNoReceiveNoClockNextSpontaneousMaybeMakeDecision(r:ReplicaImpl)\r\n returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.nextActionIndex==5\r\n requires r.Valid()\r\n modifies r.Repr\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && Q_LReplica_NoReceive_Next(old(r.AbstractifyToLReplica()), r.nextActionIndex as int, r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n var sent_packets;\r\n r.replica,sent_packets := Replica_Next_Spontaneous_MaybeMakeDecision(r.replica);\r\n lemma_RevealQFromReplicaNextSpontaneousMaybeMakeDecisionPostconditions(replica_old, r.replica, sent_packets);\r\n\r\n ok, netEventLog, ios := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n assert old(r.Env().net.history()) + netEventLog == r.Env().net.history(); // deleteme\r\n\r\n assert SpontaneousIos(ios, 0);\r\n assert AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n assert r.Env() == old(r.Env());\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n lemma_EstablishQLReplicaNoReceiveNextFromNoClock(replica_old, r.AbstractifyToLReplica(), AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), r.nextActionIndex as int, ios);\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextSpontaneousMaybeExecutePostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Spontaneous_MaybeExecute_Postconditions(replica, replica', packets_sent)\r\n ensures Q_LReplica_Next_Spontaneous_MaybeExecute(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent));\r\n{\r\n reveal Q_LReplica_Next_Spontaneous_MaybeExecute();\r\n}\r\n\r\nmethod ReplicaNoReceiveNoClockNextSpontaneousMaybeExecute(r:ReplicaImpl)\r\n returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.nextActionIndex==6\r\n requires r.Valid()\r\n modifies r.replica.executor.app, r.Repr, r.cur_req_set, r.prev_req_set, r.reply_cache_mutable\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && Q_LReplica_NoReceive_Next(old(r.AbstractifyToLReplica()), r.nextActionIndex as int, r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n var sent_packets;\r\n r.replica,sent_packets := Replica_Next_Spontaneous_MaybeExecute(r.replica, r.cur_req_set, r.prev_req_set, r.reply_cache_mutable);\r\n lemma_RevealQFromReplicaNextSpontaneousMaybeExecutePostconditions(replica_old, r.replica, sent_packets);\r\n\r\n ok, netEventLog, ios := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n assert old(r.Env().net.history()) + netEventLog == r.Env().net.history(); // deleteme\r\n\r\n assert SpontaneousIos(ios, 0);\r\n assert AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios);\r\n assert r.Env() == old(r.Env());\r\n assert RawIoConsistentWithSpecIO(netEventLog, ios);\r\n assert Q_LReplica_Next_Spontaneous_MaybeExecute(replica_old, r.AbstractifyToLReplica(), AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets));\r\n lemma_EstablishQLReplicaNoReceiveNextFromNoClock(replica_old, r.AbstractifyToLReplica(), AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), r.nextActionIndex as int, ios);\r\n}\r\n\r\nmethod Replica_NoReceive_NoClock_Next(r:ReplicaImpl) returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.nextActionIndex==1 || r.nextActionIndex==2 || r.nextActionIndex==4 || r.nextActionIndex==5 || r.nextActionIndex==6\r\n requires r.Valid()\r\n modifies r.replica.executor.app, r.Repr, r.cur_req_set, r.prev_req_set, r.reply_cache_mutable\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && Q_LReplica_NoReceive_Next(old(r.AbstractifyToLReplica()), r.nextActionIndex as int, r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n if r.nextActionIndex == 1 {\r\n ok, netEventLog, ios := ReplicaNoReceiveNoClockNextSpontaneousMaybeEnterNewViewAndSend1a(r);\r\n } else if r.nextActionIndex == 2 {\r\n ok, netEventLog, ios := ReplicaNoReceiveNoClockNextSpontaneousMaybeEnterPhase2(r);\r\n } else if r.nextActionIndex == 4 {\r\n ok, netEventLog, ios := ReplicaNoReceiveNoClockNextSpontaneousTruncateLogBasedOnCheckpoints(r);\r\n } else if r.nextActionIndex == 5 {\r\n ok, netEventLog, ios := ReplicaNoReceiveNoClockNextSpontaneousMaybeMakeDecision(r);\r\n } else if r.nextActionIndex == 6 {\r\n ok, netEventLog, ios := ReplicaNoReceiveNoClockNextSpontaneousMaybeExecute(r);\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaImplProcessPacketNoClock.i.dfy", "content": "include \"../../Common/Collections/Seqs.i.dfy\"\r\ninclude \"../../../Libraries/Math/mod_auto.i.dfy\"\r\ninclude \"../../Protocol/RSL/Replica.i.dfy\"\r\ninclude \"ReplicaModel.i.dfy\"\r\ninclude \"ReplicaImplLemmas.i.dfy\"\r\ninclude \"ReplicaImplClass.i.dfy\"\r\ninclude \"ReplicaImplDelivery.i.dfy\"\r\ninclude \"NetRSL.i.dfy\"\r\ninclude \"CClockReading.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaImplProcessPacketNoClock_i {\r\n\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Collections__Seqs_i\r\nimport opened Math__mod_auto_i\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__CClockReading_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__QRelations_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened LiveRSL__ReplicaImplLemmas_i\r\nimport opened LiveRSL__ReplicaImplClass_i\r\nimport opened LiveRSL__ReplicaImplDelivery_i\r\nimport opened LiveRSL__ReplicaModel_i\r\nimport opened LiveRSL__ReplicaModel_Part1_i\r\nimport opened LiveRSL__ReplicaModel_Part2_i\r\nimport opened LiveRSL__ReplicaModel_Part3_i\r\nimport opened LiveRSL__ReplicaModel_Part4_i\r\nimport opened LiveRSL__ReplicaModel_Part5_i\r\nimport opened LiveRSL__ReplicaState_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__NetRSL_i\r\nimport opened Common__NetClient_i\r\nimport opened Environment_s\r\nimport opened Logic__Option_i\r\nimport opened Common__Util_i\r\n\r\nlemma lemma_ReplicaNextProcessPacketWithoutReadingClockHelper(\r\n cpacket:CPacket,\r\n sent_packets:OutboundPackets,\r\n old_net_history:seq,\r\n post_receive_net_history:seq,\r\n current_net_history:seq,\r\n receive_event:NetEvent,\r\n send_events:seq,\r\n receive_io:RslIo,\r\n send_ios:seq\r\n ) returns (\r\n netEventLog:seq,\r\n ios:seq\r\n )\r\n requires post_receive_net_history == old_net_history + [receive_event]\r\n requires current_net_history == post_receive_net_history + send_events\r\n\r\n // From Receive:\r\n requires receive_event.LIoOpReceive?\r\n requires !cpacket.msg.CMessage_Heartbeat?\r\n requires CPacketIsAbstractable(cpacket)\r\n requires NetEventIsAbstractable(receive_event)\r\n requires AbstractifyCPacketToRslPacket(cpacket) == AbstractifyNetPacketToRslPacket(receive_event.r)\r\n requires receive_io == AbstractifyNetEventToRslIo(receive_event)\r\n \r\n // From DeliverOutboundPackets:\r\n requires AllIosAreSends(send_ios)\r\n requires OutboundPacketsIsAbstractable(sent_packets)\r\n requires AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(send_ios)\r\n requires RawIoConsistentWithSpecIO(send_events, send_ios)\r\n requires OnlySentMarshallableData(send_events)\r\n \r\n ensures RawIoConsistentWithSpecIO(netEventLog, ios)\r\n ensures |ios| >= 1\r\n ensures ios[0] == receive_io\r\n ensures AllIosAreSends(ios[1..])\r\n ensures current_net_history == old_net_history + netEventLog\r\n ensures AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == ExtractSentPacketsFromIos(ios)\r\n ensures OnlySentMarshallableData(netEventLog)\r\n{\r\n var ios_head := [receive_io];\r\n ios := ios_head + send_ios;\r\n netEventLog := [receive_event] + send_events;\r\n \r\n calc {\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets);\r\n ExtractSentPacketsFromIos(send_ios);\r\n { lemma_ExtractSentPacketsFromIosDoesNotMindSomeClutter(ios_head, send_ios); }\r\n ExtractSentPacketsFromIos(ios_head + send_ios);\r\n ExtractSentPacketsFromIos(ios);\r\n }\r\n\r\n forall io | io in ios[1..] ensures io.LIoOpSend?\r\n {\r\n var idx :| 0<=idx<|ios[1..]| && io==ios[1..][idx]; // because spec uses 'in seq' instead of indexing\r\n assert io == send_ios[idx];\r\n assert AllIosAreSends(send_ios);\r\n assert io.LIoOpSend?;\r\n }\r\n\r\n assert NetEventLogIsAbstractable(netEventLog);\r\n assert AbstractifyRawLogToIos(netEventLog) == ios;\r\n \r\n lemma_ExtractSentPacketsFromIosDoesNotMindSomeClutter(ios_head, send_ios);\r\n}\r\n\r\nmethod {:fuel AbstractifyReplicaStateToLReplica,0,0} {:fuel ReplicaStateIsValid,0,0} ReplicaNextProcessPacketInvalid(\r\n r:ReplicaImpl,\r\n cpacket:CPacket,\r\n ghost old_net_history:seq,\r\n ghost receive_event:NetEvent,\r\n ghost receive_io:RslIo\r\n ) returns (\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires old_net_history + [receive_event] == r.Env().net.history()\r\n requires CPaxosConfigurationIsValid(r.replica.constants.all.config)\r\n requires r.ReceivedPacketProperties(cpacket, receive_event, receive_io)\r\n requires cpacket.msg.CMessage_Invalid?\r\n requires LReplica_Next_ProcessPacketWithoutReadingClock_preconditions([receive_io])\r\n ensures LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(ios)\r\n ensures Q_LReplica_Next_ProcessPacketWithoutReadingClock(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n ensures RawIoConsistentWithSpecIO(netEventLog, ios)\r\n ensures old_net_history + netEventLog == r.Env().net.history()\r\n ensures OnlySentMarshallableData(netEventLog)\r\n{\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Enter\\n\"); \r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n ghost var rreplica := AbstractifyReplicaStateToLReplica(r.replica);\r\n ghost var lpacket := AbstractifyCPacketToRslPacket(cpacket);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Processing a CMessage_Invalid\\n\");\r\n\r\n var sent_packets := OutboundPacket(None());\r\n assert AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets) == [];\r\n\r\n assert Q_LReplica_Next_Process_Invalid(rreplica, r.AbstractifyToLReplica(), lpacket, AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets));\r\n\r\n ghost var send_events := [];\r\n ghost var send_ios := [];\r\n\r\n netEventLog, ios := lemma_ReplicaNextProcessPacketWithoutReadingClockHelper(cpacket, sent_packets,\r\n old_net_history, old(r.Env().net.history()),\r\n r.Env().net.history(),\r\n receive_event, send_events, receive_io, send_ios);\r\n lemma_EstablishQLReplicaNextProcessPacketWithoutReadingClock(rreplica, AbstractifyReplicaStateToLReplica(r.replica),\r\n lpacket, AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), ios);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Exit\\n\");\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextProcessRequestPostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n inp:CPacket,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_Request_Postconditions(replica, replica', inp, packets_sent)\r\n ensures Q_LReplica_Next_Process_Request(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp), AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent));\r\n{\r\n reveal Q_LReplica_Next_Process_Request();\r\n}\r\n \r\nmethod {:fuel AbstractifyReplicaStateToLReplica,0,0} {:fuel ReplicaStateIsValid,0,0} {:timeLimitMultiplier 2} ReplicaNextProcessPacketRequest(\r\n r:ReplicaImpl,\r\n cpacket:CPacket,\r\n ghost old_net_history:seq,\r\n ghost receive_event:NetEvent,\r\n ghost receive_io:RslIo\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires old_net_history + [receive_event] == r.Env().net.history()\r\n requires CPaxosConfigurationIsValid(r.replica.constants.all.config)\r\n requires r.ReceivedPacketProperties(cpacket, receive_event, receive_io)\r\n requires cpacket.msg.CMessage_Request?\r\n requires LReplica_Next_ProcessPacketWithoutReadingClock_preconditions([receive_io])\r\n requires Replica_Next_Process_Request_Preconditions(r.replica, cpacket)\r\n modifies r.Repr, r.cur_req_set, r.prev_req_set, r.reply_cache_mutable\r\n ensures r.Repr==old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(ios)\r\n && Q_LReplica_Next_ProcessPacketWithoutReadingClock(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && r.Env() == old(r.Env())\r\n && old_net_history + netEventLog == r.Env().net.history()\r\n{\r\n if PrintParams.ShouldPrintProgress() {\r\n print(\"Received request from client \");\r\n print(cpacket.src);\r\n print(\" with sequence number \");\r\n print(cpacket.msg.seqno);\r\n print(\"\\n\");\r\n }\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Enter\\n\"); \r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n ghost var lpacket := AbstractifyCPacketToRslPacket(cpacket);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Processing a CMessage_Request\\n\");\r\n\r\n // Mention unchanged predicates over mutable state in the old heap.\r\n ghost var net_client_old := r.netClient;\r\n ghost var net_addr_old := r.netClient.MyPublicKey();\r\n assert NetClientIsValid(net_client_old);\r\n\r\n var sent_packets;\r\n r.replica, sent_packets := Replica_Next_Process_Request(r.replica, cpacket, r.cur_req_set, r.prev_req_set, r.reply_cache_mutable);\r\n\r\n // Mention unchanged predicates over mutable state in the new heap.\r\n assert net_client_old == r.netClient;\r\n assert NetClientIsValid(r.netClient);\r\n assert net_addr_old == r.netClient.MyPublicKey();\r\n\r\n lemma_RevealQFromReplicaNextProcessRequestPostconditions(replica_old, r.replica, cpacket, sent_packets);\r\n\r\n assert OutboundPacketsHasCorrectSrc(sent_packets, r.replica.constants.all.config.replica_ids[r.replica.constants.my_index]);\r\n\r\n ghost var send_events, send_ios;\r\n assert r.Valid();\r\n ok, send_events, send_ios := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n\r\n netEventLog, ios := lemma_ReplicaNextProcessPacketWithoutReadingClockHelper(cpacket, sent_packets,\r\n old_net_history, old(r.Env().net.history()),\r\n r.Env().net.history(),\r\n receive_event, send_events, receive_io, send_ios);\r\n lemma_EstablishQLReplicaNextProcessPacketWithoutReadingClock(replica_old, AbstractifyReplicaStateToLReplica(r.replica),\r\n lpacket, AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), ios);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Exit\\n\");\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextProcess1aPostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n inp:CPacket,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_1a_Postconditions(replica, replica', inp, packets_sent)\r\n ensures Q_LReplica_Next_Process_1a(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp), AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent));\r\n{\r\n reveal Q_LReplica_Next_Process_1a();\r\n}\r\n\r\nmethod {:fuel AbstractifyReplicaStateToLReplica,0,0} {:fuel ReplicaStateIsValid,0,0} {:timeLimitMultiplier 2} ReplicaNextProcessPacket1a(\r\n r:ReplicaImpl,\r\n cpacket:CPacket,\r\n ghost old_net_history:seq,\r\n ghost receive_event:NetEvent,\r\n ghost receive_io:RslIo\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires old_net_history + [receive_event] == r.Env().net.history()\r\n requires CPaxosConfigurationIsValid(r.replica.constants.all.config)\r\n requires r.ReceivedPacketProperties(cpacket, receive_event, receive_io)\r\n requires cpacket.msg.CMessage_1a?\r\n requires LReplica_Next_ProcessPacketWithoutReadingClock_preconditions([receive_io])\r\n requires Replica_Next_Process_1a_Preconditions(r.replica, cpacket)\r\n modifies r.Repr\r\n ensures r.Repr==old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(ios)\r\n && Q_LReplica_Next_ProcessPacketWithoutReadingClock(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && r.Env() == old(r.Env())\r\n && old_net_history + netEventLog == r.Env().net.history()\r\n{\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Enter\\n\"); \r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n ghost var lpacket := AbstractifyCPacketToRslPacket(cpacket);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Processing a CMessage_1a\\n\");\r\n\r\n // Mention unchanged predicates over mutable state in the old heap.\r\n ghost var net_client_old := r.netClient;\r\n ghost var net_addr_old := r.netClient.MyPublicKey();\r\n assert NetClientIsValid(net_client_old);\r\n\r\n var sent_packets;\r\n r.replica, sent_packets := Replica_Next_Process_1a(r.replica, cpacket);\r\n\r\n // Mention unchanged predicates over mutable state in the new heap.\r\n assert net_client_old == r.netClient;\r\n assert NetClientIsValid(r.netClient);\r\n assert net_addr_old == r.netClient.MyPublicKey();\r\n\r\n lemma_RevealQFromReplicaNextProcess1aPostconditions(replica_old, r.replica, cpacket, sent_packets);\r\n\r\n assert OutboundPacketsHasCorrectSrc(sent_packets, r.replica.constants.all.config.replica_ids[r.replica.constants.my_index]);\r\n\r\n ghost var send_events, send_ios;\r\n assert r.Valid();\r\n ok, send_events, send_ios := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n\r\n netEventLog, ios := lemma_ReplicaNextProcessPacketWithoutReadingClockHelper(cpacket, sent_packets,\r\n old_net_history, old(r.Env().net.history()),\r\n r.Env().net.history(),\r\n receive_event, send_events, receive_io, send_ios);\r\n lemma_EstablishQLReplicaNextProcessPacketWithoutReadingClock(replica_old, AbstractifyReplicaStateToLReplica(r.replica),\r\n lpacket, AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), ios);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Exit\\n\");\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextProcess1bPostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n inp:CPacket,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_1b_Postconditions(replica, replica', inp, packets_sent)\r\n ensures Q_LReplica_Next_Process_1b(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp), AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent));\r\n{\r\n reveal Q_LReplica_Next_Process_1b();\r\n}\r\n\r\nmethod {:fuel AbstractifyReplicaStateToLReplica,0,0} {:fuel ReplicaStateIsValid,0,0} {:timeLimitMultiplier 2} ReplicaNextProcessPacket1b(\r\n r:ReplicaImpl,\r\n cpacket:CPacket,\r\n ghost old_net_history:seq,\r\n ghost receive_event:NetEvent,\r\n ghost receive_io:RslIo\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires old_net_history + [receive_event] == r.Env().net.history()\r\n requires CPaxosConfigurationIsValid(r.replica.constants.all.config)\r\n requires r.ReceivedPacketProperties(cpacket, receive_event, receive_io)\r\n requires cpacket.msg.CMessage_1b?\r\n requires LReplica_Next_ProcessPacketWithoutReadingClock_preconditions([receive_io])\r\n requires Replica_Next_Process_1b_Preconditions(r.replica,cpacket)\r\n modifies r.Repr\r\n ensures r.Repr==old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(ios)\r\n && Q_LReplica_Next_ProcessPacketWithoutReadingClock(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && r.Env() == old(r.Env())\r\n && old_net_history + netEventLog == r.Env().net.history()\r\n{\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Enter\\n\"); \r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n ghost var lpacket := AbstractifyCPacketToRslPacket(cpacket);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Processing a CMessage_1b\\n\");\r\n\r\n // Mention unchanged predicates over mutable state in the old heap.\r\n ghost var net_client_old := r.netClient;\r\n ghost var net_addr_old := r.netClient.MyPublicKey();\r\n assert NetClientIsValid(net_client_old);\r\n\r\n var sent_packets;\r\n r.replica, sent_packets := Replica_Next_Process_1b(r.replica, cpacket);\r\n\r\n // Mention unchanged predicates over mutable state in the new heap.\r\n assert net_client_old == r.netClient;\r\n assert NetClientIsValid(r.netClient);\r\n assert net_addr_old == r.netClient.MyPublicKey();\r\n\r\n lemma_RevealQFromReplicaNextProcess1bPostconditions(replica_old, r.replica, cpacket, sent_packets);\r\n\r\n assert OutboundPacketsHasCorrectSrc(sent_packets, r.replica.constants.all.config.replica_ids[r.replica.constants.my_index]);\r\n\r\n ghost var send_events, send_ios;\r\n assert r.Valid();\r\n ok, send_events, send_ios := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n\r\n netEventLog, ios := lemma_ReplicaNextProcessPacketWithoutReadingClockHelper(cpacket, sent_packets,\r\n old_net_history, old(r.Env().net.history()),\r\n r.Env().net.history(),\r\n receive_event, send_events, receive_io, send_ios);\r\n lemma_EstablishQLReplicaNextProcessPacketWithoutReadingClock(replica_old, AbstractifyReplicaStateToLReplica(r.replica),\r\n lpacket, AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), ios);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Exit\\n\");\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextProcessStartingPhase2Postconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n inp:CPacket,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_StartingPhase2_Postconditions(replica, replica', inp, packets_sent)\r\n ensures Q_LReplica_Next_Process_StartingPhase2(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp), AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n{\r\n reveal Q_LReplica_Next_Process_StartingPhase2();\r\n}\r\n\r\nmethod {:fuel AbstractifyReplicaStateToLReplica,0,0} {:fuel ReplicaStateIsValid,0,0} {:timeLimitMultiplier 5} ReplicaNextProcessPacketStartingPhase2(\r\n r:ReplicaImpl,\r\n cpacket:CPacket,\r\n ghost old_net_history:seq,\r\n ghost receive_event:NetEvent,\r\n ghost receive_io:RslIo\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires old_net_history + [receive_event] == r.Env().net.history()\r\n requires CPaxosConfigurationIsValid(r.replica.constants.all.config)\r\n requires r.ReceivedPacketProperties(cpacket, receive_event, receive_io)\r\n requires cpacket.msg.CMessage_StartingPhase2?\r\n requires LReplica_Next_ProcessPacketWithoutReadingClock_preconditions([receive_io])\r\n modifies r.Repr\r\n ensures r.Repr==old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(ios)\r\n && Q_LReplica_Next_ProcessPacketWithoutReadingClock(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && r.Env() == old(r.Env())\r\n && old_net_history + netEventLog == r.Env().net.history()\r\n{\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Enter\\n\"); \r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n ghost var lpacket := AbstractifyCPacketToRslPacket(cpacket);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Processing a CMessage_StartingPhase2\\n\");\r\n\r\n // Mention unchanged predicates over mutable state in the old heap.\r\n ghost var net_client_old := r.netClient;\r\n ghost var net_addr_old := r.netClient.MyPublicKey();\r\n assert NetClientIsValid(net_client_old);\r\n\r\n var sent_packets;\r\n r.replica, sent_packets := Replica_Next_Process_StartingPhase2(r.replica, cpacket);\r\n\r\n // Mention unchanged predicates over mutable state in the new heap.\r\n assert net_client_old == r.netClient;\r\n assert NetClientIsValid(r.netClient);\r\n assert net_addr_old == r.netClient.MyPublicKey();\r\n\r\n lemma_RevealQFromReplicaNextProcessStartingPhase2Postconditions(replica_old, r.replica, cpacket, sent_packets);\r\n\r\n assert OutboundPacketsHasCorrectSrc(sent_packets, r.replica.constants.all.config.replica_ids[r.replica.constants.my_index]);\r\n\r\n ghost var send_events, send_ios;\r\n assert r.Valid();\r\n ok, send_events, send_ios := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n\r\n netEventLog, ios := lemma_ReplicaNextProcessPacketWithoutReadingClockHelper(cpacket, sent_packets,\r\n old_net_history, old(r.Env().net.history()),\r\n r.Env().net.history(),\r\n receive_event, send_events, receive_io, send_ios);\r\n lemma_EstablishQLReplicaNextProcessPacketWithoutReadingClock(replica_old, AbstractifyReplicaStateToLReplica(r.replica),\r\n lpacket, AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), ios);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Exit\\n\");\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextProcess2aPostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n inp:CPacket,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_2a_Postconditions(replica, replica', inp, packets_sent)\r\n ensures Q_LReplica_Next_Process_2a(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp), AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent));\r\n{\r\n reveal Q_LReplica_Next_Process_2a();\r\n}\r\n\r\nmethod {:fuel AbstractifyReplicaStateToLReplica,0,0} {:fuel ReplicaStateIsValid,0,0} {:timeLimitMultiplier 2} ReplicaNextProcessPacket2a(\r\n r:ReplicaImpl,\r\n cpacket:CPacket,\r\n ghost old_net_history:seq,\r\n ghost receive_event:NetEvent,\r\n ghost receive_io:RslIo\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires old_net_history + [receive_event] == r.Env().net.history()\r\n requires CPaxosConfigurationIsValid(r.replica.constants.all.config)\r\n requires r.ReceivedPacketProperties(cpacket, receive_event, receive_io)\r\n requires cpacket.msg.CMessage_2a?\r\n requires LReplica_Next_ProcessPacketWithoutReadingClock_preconditions([receive_io])\r\n requires Replica_Next_Process_2a_Preconditions(r.replica,cpacket)\r\n modifies r.Repr\r\n ensures r.Repr==old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(ios)\r\n && Q_LReplica_Next_ProcessPacketWithoutReadingClock(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && r.Env() == old(r.Env())\r\n && old_net_history + netEventLog == r.Env().net.history()\r\n{\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Enter\\n\"); \r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n ghost var lpacket := AbstractifyCPacketToRslPacket(cpacket);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Processing a CMessage_2a\\n\");\r\n\r\n // Mention unchanged predicates over mutable state in the old heap.\r\n ghost var net_client_old := r.netClient;\r\n ghost var net_addr_old := r.netClient.MyPublicKey();\r\n assert NetClientIsValid(net_client_old);\r\n\r\n var sent_packets;\r\n r.replica, sent_packets := Replica_Next_Process_2a(r.replica, cpacket);\r\n\r\n // Mention unchanged predicates over mutable state in the new heap.\r\n assert net_client_old == r.netClient;\r\n assert NetClientIsValid(r.netClient);\r\n assert net_addr_old == r.netClient.MyPublicKey();\r\n\r\n lemma_RevealQFromReplicaNextProcess2aPostconditions(replica_old, r.replica, cpacket, sent_packets);\r\n\r\n assert OutboundPacketsHasCorrectSrc(sent_packets, r.replica.constants.all.config.replica_ids[r.replica.constants.my_index]);\r\n\r\n ghost var send_events, send_ios;\r\n assert r.Valid();\r\n ok, send_events, send_ios := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n\r\n netEventLog, ios := lemma_ReplicaNextProcessPacketWithoutReadingClockHelper(cpacket, sent_packets,\r\n old_net_history, old(r.Env().net.history()),\r\n r.Env().net.history(),\r\n receive_event, send_events, receive_io, send_ios);\r\n lemma_EstablishQLReplicaNextProcessPacketWithoutReadingClock(replica_old, AbstractifyReplicaStateToLReplica(r.replica),\r\n lpacket, AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), ios);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Exit\\n\");\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextProcess2bPostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n inp:CPacket,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_2b_Postconditions(replica, replica', inp, packets_sent)\r\n ensures Q_LReplica_Next_Process_2b(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp), AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent));\r\n{\r\n reveal Q_LReplica_Next_Process_2b();\r\n}\r\n\r\nmethod {:fuel AbstractifyReplicaStateToLReplica,0,0} {:fuel ReplicaStateIsValid,0,0} {:timeLimitMultiplier 2} ReplicaNextProcessPacket2b(\r\n r:ReplicaImpl,\r\n cpacket:CPacket,\r\n ghost old_net_history:seq,\r\n ghost receive_event:NetEvent,\r\n ghost receive_io:RslIo\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires old_net_history + [receive_event] == r.Env().net.history()\r\n requires CPaxosConfigurationIsValid(r.replica.constants.all.config)\r\n requires r.ReceivedPacketProperties(cpacket, receive_event, receive_io)\r\n requires cpacket.msg.CMessage_2b?\r\n requires LReplica_Next_ProcessPacketWithoutReadingClock_preconditions([receive_io])\r\n requires Replica_Next_Process_2b_Preconditions(r.replica,cpacket)\r\n modifies r.Repr\r\n ensures r.Repr==old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(ios)\r\n && Q_LReplica_Next_ProcessPacketWithoutReadingClock(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && r.Env() == old(r.Env())\r\n && old_net_history + netEventLog == r.Env().net.history()\r\n{\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Enter\\n\"); \r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n ghost var lpacket := AbstractifyCPacketToRslPacket(cpacket);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Processing a CMessage_2b\\n\");\r\n\r\n // Mention unchanged predicates over mutable state in the old heap.\r\n ghost var net_client_old := r.netClient;\r\n ghost var net_addr_old := r.netClient.MyPublicKey();\r\n assert NetClientIsValid(net_client_old);\r\n\r\n var sent_packets;\r\n r.replica, sent_packets := Replica_Next_Process_2b(r.replica, cpacket);\r\n\r\n // Mention unchanged predicates over mutable state in the new heap.\r\n assert net_client_old == r.netClient;\r\n assert NetClientIsValid(r.netClient);\r\n assert net_addr_old == r.netClient.MyPublicKey();\r\n\r\n lemma_RevealQFromReplicaNextProcess2bPostconditions(replica_old, r.replica, cpacket, sent_packets);\r\n\r\n assert OutboundPacketsHasCorrectSrc(sent_packets, r.replica.constants.all.config.replica_ids[r.replica.constants.my_index]);\r\n\r\n ghost var send_events, send_ios;\r\n assert r.Valid();\r\n ok, send_events, send_ios := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n\r\n netEventLog, ios := lemma_ReplicaNextProcessPacketWithoutReadingClockHelper(cpacket, sent_packets,\r\n old_net_history, old(r.Env().net.history()),\r\n r.Env().net.history(),\r\n receive_event, send_events, receive_io, send_ios);\r\n lemma_EstablishQLReplicaNextProcessPacketWithoutReadingClock(replica_old, AbstractifyReplicaStateToLReplica(r.replica),\r\n lpacket, AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), ios);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Exit\\n\");\r\n}\r\n\r\nmethod {:fuel AbstractifyReplicaStateToLReplica,0,0} {:fuel ReplicaStateIsValid,0,0} ReplicaNextProcessPacketReply(\r\n r:ReplicaImpl,\r\n cpacket:CPacket,\r\n ghost old_net_history:seq,\r\n ghost receive_event:NetEvent,\r\n ghost receive_io:RslIo\r\n ) returns (\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires old_net_history + [receive_event] == r.Env().net.history()\r\n requires CPaxosConfigurationIsValid(r.replica.constants.all.config)\r\n requires r.ReceivedPacketProperties(cpacket, receive_event, receive_io)\r\n requires cpacket.msg.CMessage_Reply?\r\n requires LReplica_Next_ProcessPacketWithoutReadingClock_preconditions([receive_io])\r\n ensures LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(ios)\r\n ensures Q_LReplica_Next_ProcessPacketWithoutReadingClock(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n ensures RawIoConsistentWithSpecIO(netEventLog, ios)\r\n ensures OnlySentMarshallableData(netEventLog)\r\n ensures old_net_history + netEventLog == r.Env().net.history()\r\n{\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Enter\\n\"); \r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n ghost var lpacket := AbstractifyCPacketToRslPacket(cpacket);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Processing a CMessage_Reply\\n\");\r\n\r\n var sent_packets := Broadcast(CBroadcastNop);\r\n lemma_YesWeHaveNoPackets();\r\n reveal Q_LReplica_Next_Process_Reply();\r\n assert Q_LReplica_Next_Process_Reply(replica_old, r.AbstractifyToLReplica(), lpacket, AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets));\r\n\r\n ghost var send_events := [];\r\n ghost var send_ios := [];\r\n\r\n calc {\r\n ExtractSentPacketsFromIos(send_ios);\r\n { reveal ExtractSentPacketsFromIos(); }\r\n [];\r\n }\r\n\r\n netEventLog, ios := lemma_ReplicaNextProcessPacketWithoutReadingClockHelper(cpacket, sent_packets,\r\n old_net_history, old(r.Env().net.history()),\r\n r.Env().net.history(),\r\n receive_event, send_events, receive_io, send_ios);\r\n lemma_EstablishQLReplicaNextProcessPacketWithoutReadingClock(replica_old, AbstractifyReplicaStateToLReplica(r.replica),\r\n lpacket, AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), ios);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Exit\\n\");\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextProcessAppStateRequestPostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n inp:CPacket,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_AppStateRequest_Postconditions(replica, replica', inp, packets_sent)\r\n ensures Q_LReplica_Next_Process_AppStateRequest(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp), AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n{\r\n reveal Q_LReplica_Next_Process_AppStateRequest();\r\n}\r\n \r\nmethod {:fuel AbstractifyReplicaStateToLReplica,0,0} {:fuel ReplicaStateIsValid,0,0} {:timeLimitMultiplier 2} ReplicaNextProcessPacketAppStateRequest(\r\n r:ReplicaImpl,\r\n cpacket:CPacket,\r\n ghost old_net_history:seq,\r\n ghost receive_event:NetEvent,\r\n ghost receive_io:RslIo\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires old_net_history + [receive_event] == r.Env().net.history()\r\n requires CPaxosConfigurationIsValid(r.replica.constants.all.config)\r\n requires r.ReceivedPacketProperties(cpacket, receive_event, receive_io)\r\n requires cpacket.msg.CMessage_AppStateRequest?\r\n requires LReplica_Next_ProcessPacketWithoutReadingClock_preconditions([receive_io])\r\n modifies r.Repr, r.reply_cache_mutable\r\n ensures r.Repr==old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(ios)\r\n && Q_LReplica_Next_ProcessPacketWithoutReadingClock(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && r.Env() == old(r.Env())\r\n && old_net_history + netEventLog == r.Env().net.history()\r\n{\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Enter\\n\"); \r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n ghost var lpacket := AbstractifyCPacketToRslPacket(cpacket);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Processing a CMessage_AppStateRequest\\n\");\r\n\r\n // Mention unchanged predicates over mutable state in the old heap.\r\n ghost var net_client_old := r.netClient;\r\n ghost var net_addr_old := r.netClient.MyPublicKey();\r\n assert NetClientIsValid(net_client_old);\r\n\r\n var sent_packets;\r\n r.replica, sent_packets := Replica_Next_Process_AppStateRequest(r.replica, cpacket, r.reply_cache_mutable);\r\n\r\n // Mention unchanged predicates over mutable state in the new heap.\r\n assert net_client_old == r.netClient;\r\n assert NetClientIsValid(r.netClient);\r\n assert net_addr_old == r.netClient.MyPublicKey();\r\n\r\n lemma_RevealQFromReplicaNextProcessAppStateRequestPostconditions(replica_old, r.replica, cpacket, sent_packets);\r\n\r\n assert OutboundPacketsHasCorrectSrc(sent_packets, r.replica.constants.all.config.replica_ids[r.replica.constants.my_index]);\r\n\r\n ghost var send_events, send_ios;\r\n assert r.Valid();\r\n ok, send_events, send_ios := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n\r\n netEventLog, ios := lemma_ReplicaNextProcessPacketWithoutReadingClockHelper(cpacket, sent_packets,\r\n old_net_history, old(r.Env().net.history()),\r\n r.Env().net.history(),\r\n receive_event, send_events, receive_io, send_ios);\r\n lemma_EstablishQLReplicaNextProcessPacketWithoutReadingClock(replica_old, AbstractifyReplicaStateToLReplica(r.replica),\r\n lpacket, AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), ios);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Exit\\n\");\r\n}\r\n\r\nlemma lemma_RevealQFromReplicaNextProcessAppStateSupplyPostconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n inp:CPacket,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_AppStateSupply_Postconditions(replica, replica', inp, packets_sent)\r\n ensures Q_LReplica_Next_Process_AppStateSupply(replica, AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp), AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n{\r\n reveal Q_LReplica_Next_Process_AppStateSupply();\r\n}\r\n\r\nmethod {:fuel AbstractifyReplicaStateToLReplica,0,0} {:fuel ReplicaStateIsValid,0,0} {:timeLimitMultiplier 5} ReplicaNextProcessPacketAppStateSupply(\r\n r:ReplicaImpl,\r\n cpacket:CPacket,\r\n ghost old_net_history:seq,\r\n ghost receive_event:NetEvent,\r\n ghost receive_io:RslIo\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires old_net_history + [receive_event] == r.Env().net.history()\r\n requires CPaxosConfigurationIsValid(r.replica.constants.all.config)\r\n requires r.ReceivedPacketProperties(cpacket, receive_event, receive_io)\r\n requires cpacket.msg.CMessage_AppStateSupply?\r\n requires LReplica_Next_ProcessPacketWithoutReadingClock_preconditions([receive_io])\r\n requires Replica_Next_Process_AppStateSupply_Preconditions(r.replica,cpacket)\r\n modifies r.Repr\r\n ensures r.Repr==old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(ios)\r\n && Q_LReplica_Next_ProcessPacketWithoutReadingClock(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && r.Env() == old(r.Env())\r\n && old_net_history + netEventLog == r.Env().net.history()\r\n{\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Enter\\n\"); \r\n ghost var replica_old := AbstractifyReplicaStateToLReplica(r.replica);\r\n ghost var lpacket := AbstractifyCPacketToRslPacket(cpacket);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Processing a CMessage_AppStateSupply\\n\");\r\n\r\n // Mention unchanged predicates over mutable state in the old heap.\r\n ghost var net_client_old := r.netClient;\r\n ghost var net_addr_old := r.netClient.MyPublicKey();\r\n assert NetClientIsValid(net_client_old);\r\n\r\n var sent_packets, replicaChanged;\r\n r.replica, sent_packets, replicaChanged := Replica_Next_Process_AppStateSupply(r.replica, cpacket);\r\n\r\n // Mention unchanged predicates over mutable state in the new heap.\r\n assert net_client_old == r.netClient;\r\n assert NetClientIsValid(r.netClient);\r\n assert net_addr_old == r.netClient.MyPublicKey();\r\n\r\n lemma_RevealQFromReplicaNextProcessAppStateSupplyPostconditions(replica_old, r.replica, cpacket, sent_packets);\r\n\r\n assert OutboundPacketsHasCorrectSrc(sent_packets, r.replica.constants.all.config.replica_ids[r.replica.constants.my_index]);\r\n\r\n ghost var send_events, send_ios;\r\n assert r.Valid();\r\n ok, send_events, send_ios := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n\r\n netEventLog, ios := lemma_ReplicaNextProcessPacketWithoutReadingClockHelper(cpacket, sent_packets,\r\n old_net_history, old(r.Env().net.history()),\r\n r.Env().net.history(),\r\n receive_event, send_events, receive_io, send_ios);\r\n\r\n lemma_EstablishQLReplicaNextProcessPacketWithoutReadingClock(replica_old, AbstractifyReplicaStateToLReplica(r.replica),\r\n lpacket, AbstractifyOutboundCPacketsToSeqOfRslPackets(sent_packets), ios);\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Exit\\n\");\r\n}\r\n\r\nmethod {:fuel AbstractifyReplicaStateToLReplica,0,0} {:fuel ReplicaStateIsValid,0,0} Replica_Next_ProcessPacketWithoutReadingClock_body(\r\n r:ReplicaImpl,\r\n cpacket:CPacket,\r\n ghost old_net_history:seq,\r\n ghost receive_event:NetEvent,\r\n ghost receive_io:RslIo\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires old_net_history + [receive_event] == r.Env().net.history()\r\n requires CPaxosConfigurationIsValid(r.replica.constants.all.config)\r\n requires r.ReceivedPacketProperties(cpacket, receive_event, receive_io)\r\n requires NoClockMessage(cpacket.msg)\r\n requires LReplica_Next_ProcessPacketWithoutReadingClock_preconditions([receive_io])\r\n requires cpacket.msg.CMessage_AppStateRequest? ==> Replica_Next_Process_AppStateRequest_Preconditions(r.replica,cpacket)\r\n requires cpacket.msg.CMessage_AppStateSupply? ==> Replica_Next_Process_AppStateSupply_Preconditions(r.replica,cpacket)\r\n requires cpacket.msg.CMessage_2b? ==> Replica_Next_Process_2b_Preconditions(r.replica,cpacket)\r\n requires cpacket.msg.CMessage_2a? ==> Replica_Next_Process_2a_Preconditions(r.replica,cpacket)\r\n requires cpacket.msg.CMessage_1a? ==> Replica_Next_Process_1a_Preconditions(r.replica,cpacket)\r\n requires cpacket.msg.CMessage_1b? ==> Replica_Next_Process_1b_Preconditions(r.replica,cpacket)\r\n requires cpacket.msg.CMessage_Request? ==> Replica_Next_Process_Request_Preconditions(r.replica,cpacket)\r\n // requires Replica_Next_Process_AppStateSupply_Preconditions(r.replica,cpacket)\r\n modifies r.Repr, r.cur_req_set, r.prev_req_set, r.reply_cache_mutable\r\n ensures r.Repr==old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && LReplica_Next_ProcessPacketWithoutReadingClock_preconditions(ios)\r\n && Q_LReplica_Next_ProcessPacketWithoutReadingClock(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && r.Env() == old(r.Env())\r\n && old_net_history + netEventLog == r.Env().net.history()\r\n{\r\n if (cpacket.msg.CMessage_Invalid?) {\r\n ok := true;\r\n netEventLog, ios := ReplicaNextProcessPacketInvalid(r, cpacket, old_net_history, receive_event, receive_io);\r\n } else if (cpacket.msg.CMessage_Request?) {\r\n ok, netEventLog, ios := ReplicaNextProcessPacketRequest(r, cpacket, old_net_history, receive_event, receive_io);\r\n } else if (cpacket.msg.CMessage_1a?) {\r\n ok, netEventLog, ios := ReplicaNextProcessPacket1a(r, cpacket, old_net_history, receive_event, receive_io);\r\n } else if (cpacket.msg.CMessage_1b?) {\r\n ok, netEventLog, ios := ReplicaNextProcessPacket1b(r, cpacket, old_net_history, receive_event, receive_io);\r\n } else if (cpacket.msg.CMessage_StartingPhase2?) {\r\n ok, netEventLog, ios := ReplicaNextProcessPacketStartingPhase2(r, cpacket, old_net_history, receive_event, receive_io);\r\n } else if (cpacket.msg.CMessage_2a?) {\r\n ok, netEventLog, ios := ReplicaNextProcessPacket2a(r, cpacket, old_net_history, receive_event, receive_io);\r\n } else if (cpacket.msg.CMessage_2b?) {\r\n ok, netEventLog, ios := ReplicaNextProcessPacket2b(r, cpacket, old_net_history, receive_event, receive_io);\r\n } else if (cpacket.msg.CMessage_Reply?) {\r\n ok := true;\r\n netEventLog, ios := ReplicaNextProcessPacketReply(r, cpacket, old_net_history, receive_event, receive_io);\r\n } else if (cpacket.msg.CMessage_AppStateRequest?) {\r\n ok, netEventLog, ios := ReplicaNextProcessPacketAppStateRequest(r, cpacket, old_net_history, receive_event, receive_io);\r\n } else if (cpacket.msg.CMessage_AppStateSupply?) {\r\n ok, netEventLog, ios := ReplicaNextProcessPacketAppStateSupply(r, cpacket, old_net_history, receive_event, receive_io);\r\n } else {\r\n assert false;\r\n }\r\n //print (\"Replica_Next_ProcessPacketWithoutReadingClock_body: Exit\\n\");\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaImplProcessPacketX.i.dfy", "content": "include \"../../Common/Collections/Seqs.i.dfy\"\r\ninclude \"../../../Libraries/Math/mod_auto.i.dfy\"\r\ninclude \"../../Protocol/RSL/Replica.i.dfy\"\r\ninclude \"ReplicaModel.i.dfy\"\r\ninclude \"ReplicaImplLemmas.i.dfy\"\r\ninclude \"ReplicaImplClass.i.dfy\"\r\ninclude \"ReplicaImplReadClock.i.dfy\"\r\ninclude \"ReplicaImplProcessPacketNoClock.i.dfy\"\r\ninclude \"NetRSL.i.dfy\"\r\ninclude \"CClockReading.i.dfy\"\r\ninclude \"Unsendable.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaImplProcessPacketX_i {\r\n\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Collections__Seqs_i\r\nimport opened Math__mod_auto_i\r\nimport opened LiveRSL__CClockReading_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__QRelations_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__ReplicaImplLemmas_i\r\nimport opened LiveRSL__ReplicaImplClass_i\r\nimport opened LiveRSL__ReplicaImplReadClock_i\r\nimport opened LiveRSL__ReplicaImplProcessPacketNoClock_i\r\nimport opened LiveRSL__ReplicaModel_i\r\nimport opened LiveRSL__ReplicaState_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__NetRSL_i\r\nimport opened LiveRSL__Unsendable_i\r\nimport opened Common__NetClient_i\r\nimport opened Environment_s\r\n\r\nmethod ReplicaNextProcessPacketTimeout(r:ReplicaImpl, ghost old_net_history:seq, ghost timeout_event:NetEvent)\r\n returns (ghost netEventLog:seq, ghost ios:seq)\r\n requires r.Valid()\r\n requires r.Env().net.history() == old_net_history + [ timeout_event ]\r\n requires timeout_event.LIoOpTimeoutReceive?\r\n ensures Q_LReplica_Next_ProcessPacket(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n ensures RawIoConsistentWithSpecIO(netEventLog, ios)\r\n ensures old_net_history + netEventLog == r.Env().net.history()\r\n ensures OnlySentMarshallableData(netEventLog)\r\n{\r\n ios := [ LIoOpTimeoutReceive() ];\r\n netEventLog := [ timeout_event ];\r\n lemma_EstablishQLReplicaNextProcessPacketFromTimeout(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios);\r\n}\r\n\r\nmethod ReplicaNextProcessPacketUnmarshallable(\r\n r:ReplicaImpl,\r\n ghost old_net_history:seq,\r\n rr:ReceiveResult,\r\n ghost receive_event:NetEvent\r\n ) returns (\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires r.Env().net.history() == old_net_history + [receive_event]\r\n requires rr.RRPacket?\r\n requires receive_event.LIoOpReceive?\r\n requires !Marshallable(rr.cpacket.msg)\r\n requires NetPacketIsAbstractable(receive_event.r)\r\n requires CPacketIsAbstractable(rr.cpacket)\r\n requires AbstractifyCPacketToRslPacket(rr.cpacket) == AbstractifyNetPacketToRslPacket(receive_event.r)\r\n requires PaxosEndPointIsValid(rr.cpacket.src, r.replica.constants.all.config)\r\n requires rr.cpacket.msg == PaxosDemarshallData(receive_event.r.msg)\r\n ensures IosReflectIgnoringUnsendable(netEventLog)\r\n ensures RawIoConsistentWithSpecIO(netEventLog, ios)\r\n ensures old_net_history + netEventLog == r.Env().net.history()\r\n ensures OnlySentMarshallableData(netEventLog)\r\n{\r\n ghost var receive_io := LIoOpReceive(AbstractifyNetPacketToRslPacket(receive_event.r));\r\n netEventLog := [receive_event];\r\n ios := [receive_io];\r\n}\r\n\r\nmethod ReplicaNextProcessPacketHeartbeat(\r\n r:ReplicaImpl,\r\n ghost old_net_history:seq,\r\n rr:ReceiveResult,\r\n ghost receive_event:NetEvent\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires r.Env().net.history() == old_net_history + [receive_event]\r\n requires rr.RRPacket?\r\n requires receive_event.LIoOpReceive?\r\n requires rr.cpacket.msg.CMessage_Heartbeat?\r\n requires NetPacketIsAbstractable(receive_event.r)\r\n requires CPacketIsSendable(rr.cpacket)\r\n requires AbstractifyCPacketToRslPacket(rr.cpacket) == AbstractifyNetPacketToRslPacket(receive_event.r)\r\n requires PaxosEndPointIsValid(rr.cpacket.src, r.replica.constants.all.config)\r\n modifies r.Repr, r.cur_req_set, r.prev_req_set, r.reply_cache_mutable\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env().Valid() && r.Env().ok.ok() ==> ok\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && Q_LReplica_Next_ProcessPacket(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old_net_history + netEventLog == r.Env().net.history()\r\n{\r\n ok := true;\r\n //var process_start_time := Time.GetDebugTimeTicks();\r\n ghost var receive_io := LIoOpReceive(AbstractifyNetPacketToRslPacket(receive_event.r));\r\n assert r.ReceivedPacketProperties(rr.cpacket, receive_event, receive_io);\r\n //print (\"Replica_Next_ProcessPacket: Received a Hearbeat message\\n\");\r\n ghost var midEnv := r.Env();\r\n assert midEnv == old(r.Env());\r\n ok, netEventLog, ios := Replica_Next_ReadClockAndProcessPacket(r, rr.cpacket, old_net_history, receive_event, receive_io);\r\n assert ok ==> (r.Env()==midEnv==old(r.Env()));\r\n if (ok) {\r\n assert Q_LReplica_Next_ProcessPacket(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios);\r\n }\r\n\r\n //var end_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"Replica_Next_ProcessPacket_work\", process_start_time, end_time);\r\n reveal Q_LReplica_Next_ProcessPacket();\r\n}\r\n \r\nmethod ReplicaNextProcessPacketNonHeartbeat(\r\n r:ReplicaImpl,\r\n ghost old_net_history:seq,\r\n rr:ReceiveResult,\r\n ghost receive_event:NetEvent\r\n ) returns (\r\n ok:bool,\r\n ghost netEventLog:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires r.Env().net.history() == old_net_history + [receive_event]\r\n requires rr.RRPacket?\r\n requires receive_event.LIoOpReceive?\r\n requires !rr.cpacket.msg.CMessage_Heartbeat?\r\n requires NetPacketIsAbstractable(receive_event.r)\r\n requires CPaxosConfigurationIsValid(r.replica.constants.all.config)\r\n // requires Replica_Next_Process_AppStateSupply_Preconditions(r.replica,rr.cpacket)\r\n requires CPacketIsSendable(rr.cpacket)\r\n requires AbstractifyCPacketToRslPacket(rr.cpacket) == AbstractifyNetPacketToRslPacket(receive_event.r)\r\n requires PaxosEndPointIsValid(rr.cpacket.src, r.replica.constants.all.config)\r\n modifies r.Repr, r.cur_req_set, r.prev_req_set, r.reply_cache_mutable\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env().Valid() && r.Env().ok.ok() ==> ok\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && Q_LReplica_Next_ProcessPacket(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old_net_history + netEventLog == r.Env().net.history()\r\n{\r\n ok := true;\r\n //var process_start_time := Time.GetDebugTimeTicks();\r\n ghost var receive_io := LIoOpReceive(AbstractifyNetPacketToRslPacket(receive_event.r));\r\n assert r.ReceivedPacketProperties(rr.cpacket, receive_event, receive_io);\r\n //print (\"Replica_Next_ProcessPacket: Received a Hearbeat message\\n\");\r\n ghost var midEnv := r.Env();\r\n assert midEnv == old(r.Env());\r\n ok, netEventLog, ios := Replica_Next_ProcessPacketWithoutReadingClock_body(r, rr.cpacket, old_net_history, receive_event, receive_io);\r\n assert ok ==> (r.Env()==midEnv==old(r.Env()));\r\n if (ok) {\r\n lemma_EstablishQLReplicaNextProcessPacket(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios);\r\n }\r\n\r\n //var end_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"Replica_Next_ProcessPacket_work\", process_start_time, end_time);\r\n}\r\n\r\nmethod Replica_Next_ProcessPacketX(r:ReplicaImpl)\r\n returns (ok:bool, ghost netEventLog:seq, ghost ios:seq)\r\n requires r.Valid()\r\n requires CPaxosConfigurationIsValid(r.replica.constants.all.config)\r\n // requires Replica_Next_Process_AppStateSupply_Preconditions(r.replica,r.cpacket)\r\n modifies r.Repr, r.cur_req_set, r.prev_req_set, r.reply_cache_mutable\r\n ensures r.Repr == old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env().Valid() && r.Env().ok.ok() ==> ok\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==> \r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && (|| Q_LReplica_Next_ProcessPacket(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n || (&& IosReflectIgnoringUnsendable(netEventLog)\r\n && old(r.AbstractifyToLReplica()) == r.AbstractifyToLReplica()))\r\n && RawIoConsistentWithSpecIO(netEventLog, ios)\r\n && OnlySentMarshallableData(netEventLog)\r\n && old(r.Env().net.history()) + netEventLog == r.Env().net.history()\r\n{\r\n ghost var old_net_history := r.Env().net.history();\r\n //var start_time := Time.GetDebugTimeTicks();\r\n var rr;\r\n ghost var receive_event;\r\n //print (\"Replica_Next_ProcessPacket: Enter\\n\");\r\n //print (\"Replica_Next_ProcessPacket: Calling Receive for a packet\\n\");\r\n rr, receive_event := Receive(r.netClient, r.localAddr, r.replica.constants.all.config, r.msg_grammar);\r\n //var receive_packet_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"Replica_Next_Receive\", start_time, receive_packet_time);\r\n assert r.Env()==old(r.Env());\r\n\r\n if (rr.RRFail?) {\r\n ok := false;\r\n //var end_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"Replica_Next_ProcessPacket_fail\", start_time, end_time);\r\n return;\r\n } else if (rr.RRTimeout?) {\r\n ok := true;\r\n netEventLog, ios := ReplicaNextProcessPacketTimeout(r, old_net_history, receive_event);\r\n //var end_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"Replica_Next_ProcessPacket_timeout\", start_time, end_time);\r\n } else {\r\n var marshallable := DetermineIfMessageMarshallable(rr.cpacket.msg);\r\n if !marshallable {\r\n ok := true;\r\n netEventLog, ios := ReplicaNextProcessPacketUnmarshallable(r, old_net_history, rr, receive_event);\r\n } else if (rr.cpacket.msg.CMessage_Heartbeat?) {\r\n ok, netEventLog, ios := ReplicaNextProcessPacketHeartbeat(r, old_net_history, rr, receive_event);\r\n } else {\r\n ok, netEventLog, ios := ReplicaNextProcessPacketNonHeartbeat(r, old_net_history, rr, receive_event);\r\n }\r\n }\r\n //print (\"Replica_Next_ProcessPacket: Exit\\n\");\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaImplReadClock.i.dfy", "content": "include \"../../Common/Collections/Seqs.i.dfy\"\r\ninclude \"../../../Libraries/Math/mod_auto.i.dfy\"\r\ninclude \"../../Protocol/RSL/Replica.i.dfy\"\r\ninclude \"ReplicaModel.i.dfy\"\r\ninclude \"ReplicaImplLemmas.i.dfy\"\r\ninclude \"ReplicaImplClass.i.dfy\"\r\ninclude \"ReplicaImplDelivery.i.dfy\"\r\ninclude \"NetRSL.i.dfy\"\r\ninclude \"CClockReading.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaImplReadClock_i {\r\n\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened Collections__Seqs_i\r\nimport opened Math__mod_auto_i\r\nimport opened LiveRSL__CClockReading_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__QRelations_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__ReplicaModel_i\r\nimport opened LiveRSL__ReplicaModel_Part4_i\r\nimport opened LiveRSL__ReplicaImplLemmas_i\r\nimport opened LiveRSL__ReplicaImplClass_i\r\nimport opened LiveRSL__ReplicaImplDelivery_i\r\nimport opened LiveRSL__ReplicaState_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__NetRSL_i\r\nimport opened Environment_s\r\nimport opened Common__NetClient_i\r\n\r\nlemma {:timeLimitMultiplier 2} lemma_ReplicaNextReadClockAndProcessPacketHelper(\r\n old_history:seq,\r\n pre_clock_history:seq,\r\n pre_delivery_history:seq,\r\n final_history:seq,\r\n receive_event:NetEvent,\r\n clock_event:NetEvent,\r\n send_events:seq,\r\n all_events:seq,\r\n receive_io:RslIo,\r\n clock_io:RslIo,\r\n send_ios:seq,\r\n ios_head:seq,\r\n all_ios:seq\r\n )\r\n requires pre_clock_history == old_history + [receive_event]\r\n requires pre_delivery_history == pre_clock_history + [clock_event]\r\n requires final_history == pre_delivery_history + send_events\r\n requires all_events == [receive_event, clock_event] + send_events\r\n requires NetEventIsAbstractable(receive_event)\r\n requires receive_io == AbstractifyNetEventToRslIo(receive_event)\r\n requires NetEventIsAbstractable(clock_event)\r\n requires clock_io == AbstractifyNetEventToRslIo(clock_event)\r\n requires RawIoConsistentWithSpecIO(send_events, send_ios)\r\n requires all_events == [receive_event, clock_event] + send_events\r\n requires ios_head == [receive_io, clock_io]\r\n requires all_ios == ios_head + send_ios\r\n requires receive_io.LIoOpReceive?\r\n requires clock_io.LIoOpReadClock?\r\n requires AllIosAreSends(send_ios)\r\n requires OnlySentMarshallableData(send_events)\r\n ensures final_history == old_history + all_events\r\n ensures RawIoConsistentWithSpecIO(all_events, all_ios)\r\n ensures ExtractSentPacketsFromIos(all_ios) == ExtractSentPacketsFromIos(send_ios)\r\n ensures forall io :: io in all_ios[2..] ==> io.LIoOpSend?\r\n ensures OnlySentMarshallableData(all_events)\r\n{\r\n lemma_EstablishAbstractifyRawLogToIos(all_events, all_ios);\r\n lemma_ExtractSentPacketsFromIosDoesNotMindSomeClutter(ios_head, send_ios);\r\n assert all_ios[2..] == send_ios;\r\n forall io | io in send_ios\r\n ensures io.LIoOpSend?\r\n {\r\n var i :| 0 <= i < |send_ios| && io == send_ios[i]; // OBSERVE trigger\r\n }\r\n assert AbstractifyRawLogToIos(all_events) == all_ios;\r\n\r\n calc {\r\n final_history;\r\n pre_delivery_history + send_events;\r\n pre_clock_history + [clock_event] + send_events;\r\n old_history + [receive_event] + [clock_event] + send_events;\r\n old_history + ([receive_event] + [clock_event]) + send_events;\r\n old_history + [receive_event, clock_event] + send_events;\r\n { assert [receive_event] + [clock_event] == [receive_event, clock_event]; }\r\n old_history + ([receive_event, clock_event] + send_events);\r\n { assert ([receive_event, clock_event] + send_events) == all_events; }\r\n old_history + all_events;\r\n }\r\n\r\n forall io | io in all_events && io.LIoOpSend?\r\n ensures NetPacketBound(io.s.msg)\r\n ensures Marshallable(PaxosDemarshallData(io.s.msg))\r\n {\r\n assert io in send_events;\r\n }\r\n}\r\n\r\nmethod {:fuel ReplicaStateIsValid,0,0} {:timeLimitMultiplier 3} Replica_Next_ReadClockAndProcessPacket(\r\n r:ReplicaImpl,\r\n cpacket:CPacket,\r\n ghost old_net_history:seq,\r\n ghost receive_event:NetEvent,\r\n ghost receive_io:RslIo\r\n ) returns (\r\n ok:bool,\r\n ghost net_event_log:seq,\r\n ghost ios:seq\r\n )\r\n requires r.Valid()\r\n requires CPaxosConfigurationIsValid(r.replica.constants.all.config)\r\n requires r.ReceivedPacketProperties(cpacket, receive_event, receive_io)\r\n requires r.Env().net.history() == old_net_history + [receive_event]\r\n requires cpacket.msg.CMessage_Heartbeat?\r\n requires Replica_Next_Process_Heartbeat_Preconditions(r.replica, cpacket)\r\n modifies r.Repr, r.cur_req_set, r.prev_req_set\r\n ensures r.Repr==old(r.Repr)\r\n ensures r.netClient != null\r\n ensures ok == NetClientOk(r.netClient)\r\n ensures r.Env() == old(r.Env());\r\n ensures ok ==>\r\n && r.Valid()\r\n && r.nextActionIndex == old(r.nextActionIndex)\r\n && LReplica_Next_ReadClockAndProcessPacket_preconditions(ios)\r\n && ios[0] == receive_io\r\n && Q_LReplica_Next_ProcessPacket(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios)\r\n && RawIoConsistentWithSpecIO(net_event_log, ios)\r\n && OnlySentMarshallableData(net_event_log)\r\n && old_net_history + net_event_log == r.Env().net.history()\r\n{\r\n var old_r_AbstractifyToLReplica := old(r.AbstractifyToLReplica());\r\n var clock, clock_event := ReadClock(r.netClient);\r\n ghost var clock_io := LIoOpReadClock(clock.t as int);\r\n assert clock.t as int == clock_event.t; // OBSERVE uint64\r\n assert clock_io == AbstractifyNetEventToRslIo(clock_event);\r\n\r\n var sent_packets;\r\n r.replica, sent_packets := Replica_Next_Process_Heartbeat(r.replica, cpacket, clock.t, r.cur_req_set, r.prev_req_set);\r\n\r\n ghost var send_events, send_ios;\r\n ghost var pre_delivery_history := r.Env().net.history();\r\n ok, send_events, send_ios := DeliverOutboundPackets(r, sent_packets);\r\n if (!ok) { return; }\r\n ghost var ios_head := [receive_io, clock_io];\r\n ios := ios_head + send_ios;\r\n net_event_log := [receive_event, clock_event] + send_events;\r\n\r\n lemma_ReplicaNextReadClockAndProcessPacketHelper(old_net_history, old(r.Env().net.history()), pre_delivery_history,\r\n r.Env().net.history(), receive_event, clock_event, send_events, net_event_log,\r\n receive_io, clock_io, send_ios, ios_head, ios);\r\n\r\n assert LReplica_Next_ReadClockAndProcessPacket_preconditions(ios);\r\n\r\n assert LReplicaNextReadClockAndProcessPacket(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios);\r\n assert LReplicaNextProcessPacket(old(r.AbstractifyToLReplica()), r.AbstractifyToLReplica(), ios);\r\n assert Q_LReplica_Next_ProcessPacket(old_r_AbstractifyToLReplica, r.AbstractifyToLReplica(), ios) by {\r\n reveal Q_LReplica_Next_ProcessPacket();\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaModel-Part1.i.dfy", "content": "include \"AppInterface.i.dfy\"\r\ninclude \"ReplicaState.i.dfy\"\r\ninclude \"ProposerModel.i.dfy\"\r\ninclude \"AcceptorModel.i.dfy\"\r\ninclude \"LearnerModel.i.dfy\"\r\ninclude \"ExecutorModel.i.dfy\"\r\ninclude \"../Common/Util.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaModel_Part1_i {\r\nimport opened AppStateMachine_s\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__AcceptorState_i\r\nimport opened LiveRSL__AcceptorModel_i\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__ElectionState_i\r\nimport opened LiveRSL__ExecutorModel_i\r\nimport opened LiveRSL__LearnerState_i\r\nimport opened LiveRSL__LearnerModel_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__ProposerState_i\r\nimport opened LiveRSL__ProposerModel_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened LiveRSL__ReplicaState_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Logic__Option_i\r\n\r\nmethod InitReplicaState(constants:ReplicaConstantsState) returns (replica:ReplicaState, cur_req_set:MutableSet, prev_req_set:MutableSet, reply_cache_mutable:MutableMap)\r\n requires ReplicaConstantsState_IsValid(constants)\r\n ensures ReplicaStateIsValid(replica)\r\n ensures replica.constants == constants\r\n ensures LReplicaInit(AbstractifyReplicaStateToLReplica(replica), AbstractifyReplicaConstantsStateToLReplicaConstants(constants))\r\n ensures MutableSet.SetOf(cur_req_set) == replica.proposer.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == replica.proposer.election_state.prev_req_set\r\n ensures fresh(cur_req_set) && fresh(prev_req_set) && cur_req_set != prev_req_set\r\n ensures fresh(reply_cache_mutable)\r\n ensures replica.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n{\r\n var proposer;\r\n proposer, cur_req_set, prev_req_set := InitProposerState(constants);\r\n var acceptor := InitAcceptorState(constants);\r\n var learner := LearnerState_Init(constants);\r\n var executor;\r\n executor, reply_cache_mutable := ExecutorInit(constants);\r\n\r\n replica := ReplicaState(\r\n constants,\r\n 0,\r\n proposer,\r\n acceptor,\r\n learner,\r\n executor\r\n );\r\n assert AbstractifyReplicaStateToLReplica(replica).constants == AbstractifyReplicaConstantsStateToLReplicaConstants(constants);\r\n}\r\n\r\nmethod ReplicaNextProcessRequestImplCaseInvalid(\r\n replica:ReplicaState,\r\n inp:CPacket,\r\n cur_req_set:MutableSet,\r\n prev_req_set:MutableSet,\r\n reply_cache_mutable:MutableMap\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_Request_Preconditions(replica, inp)\r\n requires !CAppRequestMarshallable(inp.msg.val)\r\n requires cur_req_set != prev_req_set\r\n requires MutableSet.SetOf(cur_req_set) == replica.proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == replica.proposer.election_state.prev_req_set\r\n requires replica.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n modifies cur_req_set, prev_req_set, reply_cache_mutable\r\n ensures Replica_Next_Process_Request_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n inp, packets_sent)\r\n ensures MutableSet.SetOf(cur_req_set) == replica'.proposer.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == replica'.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n{\r\n replica' := replica;\r\n packets_sent := PacketSequence([]);\r\n}\r\n\r\nmethod ReplicaNextProcessRequestImplCaseUncached(\r\n replica:ReplicaState,\r\n inp:CPacket,\r\n cur_req_set:MutableSet,\r\n prev_req_set:MutableSet,\r\n reply_cache_mutable:MutableMap\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_Request_Preconditions(replica, inp)\r\n requires CAppRequestMarshallable(inp.msg.val)\r\n requires cur_req_set != prev_req_set\r\n requires MutableSet.SetOf(cur_req_set) == replica.proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == replica.proposer.election_state.prev_req_set\r\n requires replica.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n requires inp.src !in MutableMap.MapOf(reply_cache_mutable)\r\n modifies cur_req_set, prev_req_set, reply_cache_mutable\r\n ensures Replica_Next_Process_Request_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n inp, packets_sent)\r\n ensures MutableSet.SetOf(cur_req_set) == replica'.proposer.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == replica'.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n{\r\n //var start_time := Time.GetDebugTimeTicks();\r\n lemma_AbstractifyCReplyCacheToReplyCache_properties(replica.executor.reply_cache);\r\n ghost var s := AbstractifyReplicaStateToLReplica(replica);\r\n ghost var received_packet := AbstractifyCPacketToRslPacket(inp);\r\n\r\n assert received_packet.src !in s.executor.reply_cache;\r\n var newProposer := ProposerProcessRequest(replica.proposer, inp, cur_req_set, prev_req_set);\r\n replica' := replica.(proposer := newProposer);\r\n ghost var s' := AbstractifyReplicaStateToLReplica(replica');\r\n packets_sent := Broadcast(CBroadcastNop);\r\n assert OutboundPacketsIsValid(packets_sent);\r\n var notCachedTime := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"Replica_Next_Process_Request_isNotCached_ProposerProcessRequest\", start_time, notCachedTime);\r\n assert LProposerProcessRequest(s.proposer, s'.proposer, received_packet);\r\n assert Replica_Next_Process_Request_Postconditions(s, replica', inp, packets_sent);\r\n}\r\n\r\nmethod ReplicaNextProcessRequestImplCaseCachedNonReply(\r\n replica:ReplicaState,\r\n inp:CPacket,\r\n cur_req_set:MutableSet,\r\n prev_req_set:MutableSet,\r\n reply_cache_mutable:MutableMap,\r\n cached_reply:CReply\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_Request_Preconditions(replica, inp)\r\n requires CAppRequestMarshallable(inp.msg.val)\r\n requires cur_req_set != prev_req_set\r\n requires MutableSet.SetOf(cur_req_set) == replica.proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == replica.proposer.election_state.prev_req_set\r\n requires replica.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n requires inp.src in MutableMap.MapOf(reply_cache_mutable)\r\n requires cached_reply == MutableMap.MapOf(reply_cache_mutable)[inp.src]\r\n requires !cached_reply.CReply?\r\n modifies cur_req_set, prev_req_set, reply_cache_mutable\r\n ensures Replica_Next_Process_Request_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n inp, packets_sent)\r\n ensures MutableSet.SetOf(cur_req_set) == replica'.proposer.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == replica'.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n{\r\n //var start_time := Time.GetDebugTimeTicks();\r\n lemma_AbstractifyCReplyCacheToReplyCache_properties(replica.executor.reply_cache);\r\n ghost var s := AbstractifyReplicaStateToLReplica(replica);\r\n ghost var received_packet := AbstractifyCPacketToRslPacket(inp);\r\n\r\n assert !s.executor.reply_cache[received_packet.src].Reply?;\r\n var newProposer := ProposerProcessRequest(replica.proposer, inp, cur_req_set, prev_req_set);\r\n replica' := replica.(proposer := newProposer);\r\n packets_sent := Broadcast(CBroadcastNop);\r\n assert OutboundPacketsIsValid(packets_sent);\r\n var notReplyTime := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"Replica_Next_Process_Request_isNotReply_ProposerProcessRequest\", start_time, notReplyTime);\r\n assert Replica_Next_Process_Request_Postconditions(s, replica', inp, packets_sent);\r\n}\r\n\r\nmethod ReplicaNextProcessRequestImplCaseCachedOld(\r\n replica:ReplicaState,\r\n inp:CPacket,\r\n cur_req_set:MutableSet,\r\n prev_req_set:MutableSet\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_Request_Preconditions(replica, inp)\r\n requires CAppRequestMarshallable(inp.msg.val)\r\n requires cur_req_set != prev_req_set\r\n requires MutableSet.SetOf(cur_req_set) == replica.proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == replica.proposer.election_state.prev_req_set\r\n modifies cur_req_set, prev_req_set\r\n ensures Replica_Next_Process_Request_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n inp, packets_sent)\r\n ensures MutableSet.SetOf(cur_req_set) == replica'.proposer.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == replica'.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n //var start_time := Time.GetDebugTimeTicks();\r\n lemma_AbstractifyCReplyCacheToReplyCache_properties(replica.executor.reply_cache);\r\n ghost var s := AbstractifyReplicaStateToLReplica(replica);\r\n ghost var received_packet := AbstractifyCPacketToRslPacket(inp);\r\n\r\n var newProposer := ProposerProcessRequest(replica.proposer, inp, cur_req_set, prev_req_set);\r\n replica' := replica.(proposer := newProposer);\r\n packets_sent := OutboundPacket(None());\r\n assert OutboundPacketsIsValid(packets_sent);\r\n var seqnoIsBeyondTime := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"Replica_Next_Process_Request_seqnoIsBeyond_ProposerProcessRequest\", start_time, seqnoIsBeyondTime);\r\n assert LProposerProcessRequest(AbstractifyReplicaStateToLReplica(replica).proposer, AbstractifyReplicaStateToLReplica(replica').proposer, received_packet);\r\n assert Replica_Next_Process_Request_Postconditions(s, replica', inp, packets_sent);\r\n}\r\n\r\nmethod ReplicaNextProcessRequestImplCaseCachedMatchingOrLaterSeqNo(\r\n replica:ReplicaState,\r\n inp:CPacket,\r\n reply_cache_mutable:MutableMap,\r\n cached_reply:CReply\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_Request_Preconditions(replica, inp)\r\n requires CAppRequestMarshallable(inp.msg.val)\r\n requires replica.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n requires inp.src in MutableMap.MapOf(reply_cache_mutable)\r\n requires cached_reply == MutableMap.MapOf(reply_cache_mutable)[inp.src]\r\n requires cached_reply.CReply?\r\n requires inp.msg.seqno <= cached_reply.seqno\r\n ensures Replica_Next_Process_Request_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n inp, packets_sent)\r\n ensures replica' == replica\r\n{\r\n //var start_time := Time.GetDebugTimeTicks();\r\n lemma_AbstractifyCReplyCacheToReplyCache_properties(replica.executor.reply_cache);\r\n ghost var s := AbstractifyReplicaStateToLReplica(replica);\r\n ghost var received_packet := AbstractifyCPacketToRslPacket(inp);\r\n\r\n assert AbstractifyCReplyToReply(replica.executor.reply_cache[inp.src]) == AbstractifyReplicaStateToLReplica(replica).executor.reply_cache[received_packet.src];\r\n packets_sent := ExecutorProcessRequest(replica.executor, inp, cached_reply, reply_cache_mutable);\r\n assert OutboundPacketsIsValid(packets_sent);\r\n replica' := replica;\r\n var isCachedTime := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"Replica_Next_Process_Request_isCached_ExecutorProcessRequest\", start_time, isCachedTime);\r\n assert Replica_Next_Process_Request_Postconditions(s, replica', inp, packets_sent);\r\n}\r\n\r\nmethod Replica_Next_Process_Request(\r\n replica:ReplicaState,\r\n inp:CPacket,\r\n cur_req_set:MutableSet,\r\n prev_req_set:MutableSet,\r\n reply_cache_mutable:MutableMap\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_Request_Preconditions(replica, inp)\r\n requires cur_req_set != prev_req_set\r\n requires MutableSet.SetOf(cur_req_set) == replica.proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == replica.proposer.election_state.prev_req_set\r\n requires replica.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n modifies cur_req_set, prev_req_set, reply_cache_mutable\r\n ensures Replica_Next_Process_Request_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n inp, packets_sent)\r\n ensures MutableSet.SetOf(cur_req_set) == replica'.proposer.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == replica'.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n{\r\n //var start_time := Time.GetDebugTimeTicks();\r\n //var afterCheck_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"Replica_Next_Process_Request_checkIsValid\", start_time, afterCheck_time);\r\n var request_valid := |inp.msg.val| <= MaxAppRequestSize();\r\n if !request_valid {\r\n replica', packets_sent := ReplicaNextProcessRequestImplCaseInvalid(replica, inp, cur_req_set, prev_req_set, reply_cache_mutable);\r\n }\r\n else {\r\n var cached, cached_reply := reply_cache_mutable.TryGetValue(inp.src);\r\n if !cached { // ==> inp.src !in replica.executor.reply_cache {\r\n replica', packets_sent := ReplicaNextProcessRequestImplCaseUncached(replica, inp, cur_req_set, prev_req_set, reply_cache_mutable);\r\n } else if (!cached_reply.CReply?){\r\n replica', packets_sent := ReplicaNextProcessRequestImplCaseCachedNonReply(replica, inp, cur_req_set, prev_req_set, reply_cache_mutable, cached_reply);\r\n } else if (inp.msg.seqno <= cached_reply.seqno && (cached_reply.seqno < 10 || inp.msg.seqno > cached_reply.seqno - 10)) {\r\n replica', packets_sent := ReplicaNextProcessRequestImplCaseCachedMatchingOrLaterSeqNo(replica, inp, reply_cache_mutable, cached_reply);\r\n }\r\n else {\r\n replica', packets_sent := ReplicaNextProcessRequestImplCaseCachedOld(replica, inp, cur_req_set, prev_req_set);\r\n }\r\n }\r\n assert OutboundPacketsIsValid(packets_sent);\r\n //var end_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"Replica_Next_Process_Request\", start_time, end_time);\r\n}\r\nmethod Replica_Next_Process_1a(replica:ReplicaState, inp:CPacket) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Process_1a_Preconditions(replica, inp)\r\n ensures Replica_Next_Process_1a_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica', inp, packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n //print(\"Replica_Next_Process_1a: Calling NextAcceptorState_Phase1\\n\");\r\n //var start_time := Time.GetDebugTimeTicks();\r\n var newAcceptor, packets := NextAcceptorState_Phase1(replica.acceptor, inp.msg, inp.src);\r\n replica' := replica.(acceptor := newAcceptor);\r\n assert ConstantsStayConstant(replica.acceptor, newAcceptor);\r\n assert AbstractifyAcceptorStateToAcceptor(replica.acceptor).constants == AbstractifyAcceptorStateToAcceptor(newAcceptor).constants;\r\n assert AbstractifyAcceptorStateToAcceptor(replica.acceptor).constants == AbstractifyAcceptorStateToAcceptor(replica'.acceptor).constants;\r\n packets_sent := Broadcast(packets);\r\n //var end_time := Time.GetDebugTimeTicks();\r\n //RecordTimingSeq(\"Replica_Next_Process_1a\", start_time, end_time);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaModel-Part2.i.dfy", "content": "include \"AppInterface.i.dfy\"\r\ninclude \"ReplicaState.i.dfy\"\r\ninclude \"ProposerModel.i.dfy\"\r\ninclude \"AcceptorModel.i.dfy\"\r\ninclude \"LearnerModel.i.dfy\"\r\ninclude \"ExecutorModel.i.dfy\"\r\ninclude \"../Common/Util.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaModel_Part2_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__AcceptorState_i\r\nimport opened LiveRSL__AcceptorModel_i\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__ExecutorState_i\r\nimport opened LiveRSL__ExecutorModel_i\r\nimport opened LiveRSL__LearnerState_i\r\nimport opened LiveRSL__LearnerModel_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__ProposerState_i\r\nimport opened LiveRSL__ProposerModel_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\nimport opened LiveRSL__ReplicaState_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__Util_i\r\n\r\nmethod ProposerSrcNotPresent(proposer:ProposerState, packet:CPacket) returns (b:bool)\r\n requires ProposerIsValid(proposer)\r\n ensures b == forall other_packet :: other_packet in proposer.received_1b_packets ==> other_packet.src != packet.src\r\n{\r\n b := forall other_packet :: other_packet in proposer.received_1b_packets ==> other_packet.src != packet.src;\r\n}\r\n\r\nmethod ReplicaNextProcess1bIgnore(replica:ReplicaState, inp:CPacket) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Process_1b_Preconditions(replica, inp)\r\n requires || inp.src !in replica.proposer.constants.all.config.replica_ids\r\n || inp.msg.bal_1b != replica.proposer.max_ballot_i_sent_1a\r\n || replica.proposer.current_state != 1\r\n ensures Replica_Next_Process_1b_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica', inp, packets_sent)\r\n ensures replica' == replica\r\n{\r\n /*\r\n if (AbstractifyCPacketToRslPacket(inp).src in AbstractifyReplicaStateToLReplica(replica).proposer.constants.all.config.replica_ids) {\r\n var hi1 := AbstractifyCPacketToRslPacket(inp).src;\r\n reveal_AbstractifyEndPointsToNodeIdentities();\r\n var ep1 :| ep1 in replica.proposer.constants.all.config.replica_ids && AbstractifyEndPointToNodeIdentity(ep1) == hi1;\r\n var ep2 := inp.src;\r\n lemma_AbstractifyEndPointToNodeIdentity_injective(ep1, ep2);\r\n assert ep1 == ep2;\r\n assert false;\r\n }\r\n assert !(AbstractifyCPacketToRslPacket(inp).src in AbstractifyReplicaStateToLReplica(replica).proposer.constants.all.config.replica_ids);\r\n */\r\n replica' := replica;\r\n packets_sent := Broadcast(CBroadcastNop);\r\n}\r\n\r\nmethod ReplicaNextProcess1bAlreadyHave1bFromSource(\r\n replica:ReplicaState,\r\n inp:CPacket\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_1b_Preconditions(replica, inp)\r\n requires !(forall other_packet :: other_packet in replica.proposer.received_1b_packets ==> other_packet.src != inp.src)\r\n ensures Replica_Next_Process_1b_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica', inp, packets_sent)\r\n ensures replica' == replica\r\n{\r\n lemma_AbstractifyEndPointsToNodeIdentities_properties(replica.constants.all.config.replica_ids);\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_srcMembership(replica.proposer.received_1b_packets, inp.src);\r\n replica' := replica;\r\n packets_sent := Broadcast(CBroadcastNop);\r\n}\r\n\r\nmethod ReplicaNextProcess1bActual(replica:ReplicaState, inp:CPacket) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Process_1b_Preconditions(replica, inp)\r\n requires inp.src in replica.proposer.constants.all.config.replica_ids\r\n requires inp.msg.bal_1b == replica.proposer.max_ballot_i_sent_1a\r\n requires replica.proposer.current_state == 1\r\n requires forall other_packet :: other_packet in replica.proposer.received_1b_packets ==> other_packet.src != inp.src\r\n ensures Replica_Next_Process_1b_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica', inp, packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n lemma_AbstractifyEndPointsToNodeIdentities_properties(replica.constants.all.config.replica_ids);\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_srcMembership(replica.proposer.received_1b_packets, inp.src);\r\n \r\n packets_sent := Broadcast(CBroadcastNop);\r\n lemma_AbstractifyEndPointsToNodeIdentities_properties(replica.constants.all.config.replica_ids);\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(packets_sent);\r\n lemma_AbstractifySetOfCPacketsToSetOfRslPackets_srcMembership(replica.proposer.received_1b_packets, inp.src);\r\n var newProposer := ProposerProcess1b(replica.proposer, inp);\r\n var newAcceptor:= NextAcceptorState_TruncateLog(replica.acceptor, inp.msg.log_truncation_point);\r\n replica' := replica.(proposer := newProposer,\r\n acceptor := newAcceptor);\r\n assert LProposerProcess1b(AbstractifyReplicaStateToLReplica(replica).proposer, AbstractifyReplicaStateToLReplica(replica').proposer, AbstractifyCPacketToRslPacket(inp));\r\n}\r\n\r\nmethod Replica_Next_Process_1b(replica:ReplicaState, inp:CPacket) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Process_1b_Preconditions(replica, inp)\r\n ensures Replica_Next_Process_1b_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica', inp, packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n\r\n if || inp.src !in replica.proposer.constants.all.config.replica_ids\r\n || inp.msg.bal_1b != replica.proposer.max_ballot_i_sent_1a\r\n || replica.proposer.current_state != 1 {\r\n replica', packets_sent := ReplicaNextProcess1bIgnore(replica, inp);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Process_1b_discard\", start_time, end_time);\r\n }\r\n else {\r\n var srcNotPresent := ProposerSrcNotPresent(replica.proposer, inp);\r\n if srcNotPresent {\r\n replica', packets_sent := ReplicaNextProcess1bActual(replica, inp);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Process_1b_use\", start_time, end_time);\r\n }\r\n else {\r\n replica', packets_sent := ReplicaNextProcess1bAlreadyHave1bFromSource(replica, inp);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Process_1b_discard\", start_time, end_time);\r\n }\r\n }\r\n}\r\n\r\nmethod Replica_Next_Process_StartingPhase2(replica:ReplicaState, inp:CPacket) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Process_StartingPhase2_Preconditions(replica, inp)\r\n ensures Replica_Next_Process_StartingPhase2_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica', inp, packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n var newExecutor, packets := ExecutorProcessStartingPhase2(replica.executor, inp);\r\n replica' := replica.(executor := newExecutor);\r\n packets_sent := Broadcast(packets);\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(packets_sent);\r\n //lemma_AbstractifyCPacketToRslPacket_src(packets_sent, replica.constants.all.config.replica_ids[replica.constants.my_index]);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Process_StartingPhase2\", start_time, end_time);\r\n}\r\n\r\n\r\nmethod ReplicaNextProcess2aIgnore(replica:ReplicaState, inp:CPacket) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Process_2a_Preconditions(replica, inp)\r\n requires || inp.src !in replica.acceptor.constants.all.config.replica_ids\r\n || !BalLeq(AbstractifyCBallotToBallot(replica.acceptor.maxBallot), AbstractifyCBallotToBallot(inp.msg.bal_2a))\r\n || inp.msg.opn_2a.n > replica.acceptor.constants.all.params.max_integer_val\r\n ensures Replica_Next_Process_2a_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica', inp, packets_sent)\r\n ensures replica' == replica\r\n{\r\n replica' := replica;\r\n packets_sent := Broadcast(CBroadcastNop);\r\n}\r\n\r\n\r\nmethod ReplicaNextProcess2aActual(replica:ReplicaState, inp:CPacket) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Process_2a_Preconditions(replica, inp)\r\n requires inp.src in replica.acceptor.constants.all.config.replica_ids\r\n requires BalLeq(AbstractifyCBallotToBallot(replica.acceptor.maxBallot), AbstractifyCBallotToBallot(inp.msg.bal_2a))\r\n requires inp.msg.opn_2a.n <= replica.acceptor.constants.all.params.max_integer_val\r\n ensures Replica_Next_Process_2a_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica', inp, packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n assert replica.constants.all.params.max_integer_val > replica.constants.all.params.max_log_length > 0;\r\n var maxLogLengthMinus1:uint64 := replica.acceptor.constants.all.params.max_log_length - 1;\r\n var newLogTruncationPoint := replica.acceptor.log_truncation_point.n;\r\n\r\n //if (inp.msg.opn_2a.n - newLogTruncationPoint > maxLogLengthMinus1) {\r\n // newLogTruncationPoint := inp.msg.opn_2a.n - replica.acceptor.constants.all.params.max_log_length + 1;\r\n //}\r\n\r\n var newAcceptor, packets := NextAcceptorState_Phase2(replica.acceptor, inp.msg, inp.src);\r\n replica' := replica.(acceptor := newAcceptor);\r\n packets_sent := Broadcast(packets);\r\n}\r\n\r\n\r\nmethod Replica_Next_Process_2a(replica:ReplicaState, inp:CPacket) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Process_2a_Preconditions(replica, inp)\r\n ensures Replica_Next_Process_2a_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica', inp, packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n// lemma_AbstractifyEndPointsToNodeIdentities_properties(replica.constants.all.config.replica_ids);\r\n var ballot_leq := CBalLeq(replica.acceptor.maxBallot, inp.msg.bal_2a);\r\n if (&& inp.src in replica.acceptor.constants.all.config.replica_ids\r\n && ballot_leq\r\n //&& replica.acceptor.log_truncation_point.n <= inp.msg.opn_2a.n\r\n && inp.msg.opn_2a.n <= replica.acceptor.constants.all.params.max_integer_val)\r\n {\r\n replica', packets_sent := ReplicaNextProcess2aActual(replica, inp);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Process_2a_use\", start_time, end_time);\r\n }\r\n else\r\n {\r\n replica', packets_sent := ReplicaNextProcess2aIgnore(replica, inp);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Process_2a_discard\", start_time, end_time);\r\n }\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(packets_sent);\r\n //lemma_AbstractifyCPacketToRslPacket_src(packets_sent, replica.constants.all.config.replica_ids[replica.constants.my_index]);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaModel-Part3.i.dfy", "content": "include \"AppInterface.i.dfy\"\r\ninclude \"ReplicaState.i.dfy\"\r\ninclude \"ProposerModel.i.dfy\"\r\ninclude \"AcceptorModel.i.dfy\"\r\ninclude \"LearnerModel.i.dfy\"\r\ninclude \"ExecutorModel.i.dfy\"\r\ninclude \"../Common/Util.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaModel_Part3_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__AcceptorModel_i\r\nimport opened LiveRSL__AcceptorState_i\r\nimport opened LiveRSL__CClockReading_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__ExecutorModel_i\r\nimport opened LiveRSL__ExecutorState_i\r\nimport opened LiveRSL__LearnerModel_i\r\nimport opened LiveRSL__LearnerState_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__ProposerModel_i\r\nimport opened LiveRSL__ProposerState_i\r\nimport opened LiveRSL__ReplicaState_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__Util_i\r\n\r\nmethod Replica_Next_Process_2b(replica:ReplicaState, inp:CPacket) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Process_2b_Preconditions(replica, inp)\r\n ensures Replica_Next_Process_2b_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica', inp, packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n\r\n ghost var r_replica := AbstractifyReplicaStateToLReplica(replica);\r\n ghost var opn := AbstractifyCPacketToRslPacket(inp).msg.opn_2b;\r\n ghost var op_learnable := r_replica.executor.ops_complete < opn || (r_replica.executor.ops_complete == opn && r_replica.executor.next_op_to_execute.OutstandingOpUnknown?);\r\n\r\n var copn := inp.msg.opn_2b;\r\n var cop_learnable := replica.executor.ops_complete.n < copn.n || (replica.executor.ops_complete.n == copn.n && replica.executor.next_op_to_execute.COutstandingOpUnknown?);\r\n\r\n assert op_learnable <==> cop_learnable;\r\n\r\n if cop_learnable {\r\n var newLearner := LearnerModel_Process2b(replica.learner, replica.executor, inp);\r\n replica' := replica.(learner := newLearner);\r\n } else {\r\n replica' := replica;\r\n }\r\n packets_sent := Broadcast(CBroadcastNop);\r\n\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Process_2b\", start_time, end_time);\r\n}\r\n\r\nmethod Replica_Next_Spontaneous_MaybeEnterNewViewAndSend1a(replica:ReplicaState) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_MaybeEnterNewViewAndSend1a_Preconditions(replica)\r\n ensures Replica_Next_MaybeEnterNewViewAndSend1a_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n var newProposer, packets := ProposerMaybeEnterNewViewAndSend1a(replica.proposer);\r\n replica' := replica.(proposer := newProposer);\r\n packets_sent := Broadcast(packets);\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(packets_sent);\r\n //lemma_AbstractifyCPacketToRslPacket_src(packets_sent, replica.constants.all.config.replica_ids[replica.constants.my_index]);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Spontaneous_MaybeEnterNewViewAndSend1a\", start_time, end_time);\r\n}\r\n\r\nmethod Replica_Next_Spontaneous_MaybeEnterPhase2(replica:ReplicaState) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_MaybeEnterPhase2_Preconditions(replica)\r\n ensures Replica_Next_MaybeEnterPhase2_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica', packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n var newProposer, packets := ProposerMaybeEnterPhase2(replica.proposer, replica.acceptor.log_truncation_point);\r\n replica' := replica.(proposer := newProposer);\r\n packets_sent := Broadcast(packets);\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(packets_sent);\r\n //lemma_AbstractifyCPacketToRslPacket_src(packets_sent, replica.constants.all.config.replica_ids[replica.constants.my_index]);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Spontaneous_MaybeEnterPhase2\", start_time, end_time);\r\n}\r\n\r\nmethod Replica_Next_Spontaneous_MaybeNominateValueAndSend2a(replica:ReplicaState, clock:CClockReading) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_ReadClock_MaybeNominateValueAndSend2a_Preconditions(replica)\r\n ensures Replica_Next_ReadClock_MaybeNominateValueAndSend2a_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)),\r\n replica', clock, packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n var newProposer, packets := ProposerMaybeNominateValueAndSend2a(replica.proposer, clock.t, replica.acceptor.log_truncation_point);\r\n replica' := replica.(proposer := newProposer);\r\n packets_sent := Broadcast(packets);\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(packets_sent);\r\n //lemma_AbstractifyCPacketToRslPacket_src(packets_sent, replica.constants.all.config.replica_ids[replica.constants.my_index]);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Spontaneous_MaybeNominateValueAndSend2a\", start_time, end_time);\r\n}\r\n\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaModel-Part4.i.dfy", "content": "include \"AppInterface.i.dfy\"\r\ninclude \"ReplicaState.i.dfy\"\r\ninclude \"ProposerModel.i.dfy\"\r\ninclude \"AcceptorModel.i.dfy\"\r\ninclude \"LearnerModel.i.dfy\"\r\ninclude \"ExecutorModel.i.dfy\"\r\ninclude \"../Common/Util.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaModel_Part4_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__Acceptor_i\r\nimport opened LiveRSL__AcceptorModel_i\r\nimport opened LiveRSL__AcceptorState_i\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__CClockReading_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__ElectionState_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened LiveRSL__ExecutorModel_i\r\nimport opened LiveRSL__ExecutorState_i\r\nimport opened LiveRSL__LearnerModel_i\r\nimport opened LiveRSL__LearnerState_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__ProposerModel_i\r\nimport opened LiveRSL__ProposerState_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__ReplicaState_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__Util_i\r\n\r\nmethod Replica_Next_Process_AppStateRequest(\r\n replica:ReplicaState,\r\n inp:CPacket,\r\n reply_cache_mutable:MutableMap\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_AppStateRequest_Preconditions(replica, inp)\r\n requires replica.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n ensures Replica_Next_Process_AppStateRequest_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n inp, packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor == replica.executor\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n var newExecutor, packets := ExecutorProcessAppStateRequest(replica.executor, inp, reply_cache_mutable);\r\n replica' := replica.(executor := newExecutor);\r\n packets_sent := packets;\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(packets_sent);\r\n //lemma_AbstractifyCPacketToRslPacket_src(packets_sent, replica.constants.all.config.replica_ids[replica.constants.my_index]);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Process_AppStateRequest\", start_time, end_time);\r\n\r\n ghost var s := AbstractifyReplicaStateToLReplica(replica);\r\n ghost var s' := AbstractifyReplicaStateToLReplica(replica');\r\n ghost var received_packet := AbstractifyCPacketToRslPacket(inp);\r\n ghost var sent_packets := AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent);\r\n assert LExecutorProcessAppStateRequest(s.executor, s'.executor, received_packet, sent_packets);\r\n assert LReplicaNextProcessAppStateRequest(s, s', received_packet, sent_packets);\r\n}\r\n\r\nmethod Replica_Next_Process_Heartbeat(\r\n replica:ReplicaState,\r\n inp:CPacket,\r\n clock:uint64,\r\n cur_req_set:MutableSet,\r\n prev_req_set:MutableSet\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_Heartbeat_Preconditions(replica, inp)\r\n requires cur_req_set != prev_req_set\r\n requires MutableSet.SetOf(cur_req_set) == replica.proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == replica.proposer.election_state.prev_req_set\r\n modifies cur_req_set, prev_req_set\r\n ensures Replica_Next_Process_Heartbeat_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n inp, clock, packets_sent)\r\n ensures MutableSet.SetOf(cur_req_set) == replica'.proposer.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == replica'.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n packets_sent := Broadcast(CBroadcastNop);\r\n assert OutboundPacketsIsValid(packets_sent);\r\n var newProposer := ProposerProcessHeartbeat(replica.proposer, inp, clock, cur_req_set, prev_req_set);\r\n var newAcceptor := NextAcceptorState_ProcessHeartbeat(replica.acceptor, inp.msg, inp.src);\r\n replica' := replica.(proposer := newProposer,\r\n acceptor := newAcceptor);\r\n\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Process_Heartbeat\", start_time, end_time);\r\n\r\n ghost var s := AbstractifyReplicaStateToLReplica(replica);\r\n ghost var s' := AbstractifyReplicaStateToLReplica(replica');\r\n ghost var received_packet := AbstractifyCPacketToRslPacket(inp);\r\n ghost var sent_packets := AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent);\r\n assert LProposerProcessHeartbeat(s.proposer, s'.proposer, received_packet, clock as int);\r\n assert LAcceptorProcessHeartbeat(s.acceptor, s'.acceptor, received_packet);\r\n assert LReplicaNextProcessHeartbeat(s, s', received_packet, clock as int, sent_packets);\r\n}\r\n\r\nmethod {:timeLimitMultiplier 2} Replica_Next_ReadClock_CheckForViewTimeout(\r\n replica:ReplicaState,\r\n clock:CClockReading,\r\n cur_req_set:MutableSet,\r\n prev_req_set:MutableSet\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_ReadClock_CheckForViewTimeout_Preconditions(replica)\r\n requires cur_req_set != prev_req_set\r\n requires MutableSet.SetOf(cur_req_set) == replica.proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == replica.proposer.election_state.prev_req_set\r\n modifies cur_req_set, prev_req_set\r\n ensures Replica_Next_ReadClock_CheckForViewTimeout_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)),\r\n replica', clock, packets_sent)\r\n ensures MutableSet.SetOf(cur_req_set) == replica'.proposer.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == replica'.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n var newProposer := ProposerCheckForViewTimeout(replica.proposer, clock.t, cur_req_set, prev_req_set);\r\n replica' := replica.(proposer := newProposer);\r\n packets_sent := Broadcast(CBroadcastNop);\r\n assert OutboundPacketsIsValid(packets_sent);\r\n assert OutboundPacketsHasCorrectSrc(packets_sent, replica.constants.all.config.replica_ids[replica.constants.my_index]);\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(packets_sent);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_ReadClock_CheckForViewTimeout\", start_time, end_time);\r\n\r\n ghost var s := AbstractifyReplicaStateToLReplica(replica);\r\n ghost var s' := AbstractifyReplicaStateToLReplica(replica');\r\n ghost var sent_packets := AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent);\r\n assert LProposerCheckForViewTimeout(s.proposer, s'.proposer, clock.t as int);\r\n assert LReplicaNextReadClockCheckForViewTimeout(s, s', AbstractifyCClockReadingToClockReading(clock), sent_packets);\r\n}\r\n\r\nmethod {:timeLimitMultiplier 2} Replica_Next_ReadClock_CheckForQuorumOfViewSuspicions(\r\n replica:ReplicaState,\r\n clock:CClockReading,\r\n cur_req_set:MutableSet,\r\n prev_req_set:MutableSet\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_ReadClock_CheckForQuorumOfViewSuspicions_Preconditions(replica)\r\n requires cur_req_set != prev_req_set\r\n requires MutableSet.SetOf(cur_req_set) == replica.proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == replica.proposer.election_state.prev_req_set\r\n modifies cur_req_set, prev_req_set\r\n ensures Replica_Next_ReadClock_CheckForQuorumOfViewSuspicions_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)),\r\n replica', clock, packets_sent)\r\n ensures MutableSet.SetOf(cur_req_set) == replica'.proposer.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == replica'.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n var newProposer := ProposerCheckForQuorumOfViewSuspicions(replica.proposer, clock.t, cur_req_set, prev_req_set);\r\n replica' := replica.(proposer := newProposer);\r\n packets_sent := Broadcast(CBroadcastNop);\r\n assert OutboundPacketsIsValid(packets_sent);\r\n assert OutboundPacketsHasCorrectSrc(packets_sent, replica.constants.all.config.replica_ids[replica.constants.my_index]);\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(packets_sent);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_ReadClock_CheckForQuorumOfViewSuspicions\", start_time, end_time);\r\n\r\n ghost var s := AbstractifyReplicaStateToLReplica(replica);\r\n ghost var s' := AbstractifyReplicaStateToLReplica(replica');\r\n ghost var sent_packets := AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent);\r\n assert LProposerCheckForQuorumOfViewSuspicions(s.proposer, s'.proposer, clock.t as int);\r\n assert LReplicaNextReadClockCheckForQuorumOfViewSuspicions(s, s', AbstractifyCClockReadingToClockReading(clock), sent_packets);\r\n}\r\n\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaModel-Part5.i.dfy", "content": "include \"AppInterface.i.dfy\"\r\ninclude \"ReplicaState.i.dfy\"\r\ninclude \"ProposerModel.i.dfy\"\r\ninclude \"AcceptorModel.i.dfy\"\r\ninclude \"LearnerModel.i.dfy\"\r\ninclude \"ExecutorModel.i.dfy\"\r\ninclude \"../Common/Util.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaModel_Part5_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__Acceptor_i\r\nimport opened LiveRSL__AcceptorModel_i\r\nimport opened LiveRSL__AcceptorState_i\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__CClockReading_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__ElectionState_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened LiveRSL__ExecutorModel_i\r\nimport opened LiveRSL__ExecutorState_i\r\nimport opened LiveRSL__Learner_i\r\nimport opened LiveRSL__LearnerModel_i\r\nimport opened LiveRSL__LearnerState_i\r\nimport opened LiveRSL__MinCQuorumSize_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__ProposerModel_i\r\nimport opened LiveRSL__ProposerState_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__ReplicaState_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__UpperBound_s\r\nimport opened Common__UpperBound_i\r\nimport opened Common__Util_i\r\nimport opened Logic__Option_i\r\nimport opened Impl__LiveRSL__Broadcast_i\r\n\r\nmethod ReplicaNextProcessAppStateSupplyIgnore(replica:ReplicaState, inp:CPacket) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Process_AppStateSupply_Preconditions(replica, inp)\r\n requires || inp.src !in replica.executor.constants.all.config.replica_ids\r\n || inp.msg.opn_state_supply.n <= replica.executor.ops_complete.n\r\n ensures Replica_Next_Process_AppStateSupply_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n inp, packets_sent)\r\n ensures replica' == replica\r\n{\r\n replica' := replica;\r\n packets_sent := Broadcast(CBroadcastNop);\r\n}\r\n\r\nmethod ReplicaNextProcessAppStateSupplyActual(\r\n replica:ReplicaState,\r\n inp:CPacket\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Process_AppStateSupply_Preconditions(replica, inp)\r\n requires inp.src in replica.executor.constants.all.config.replica_ids\r\n requires inp.msg.opn_state_supply.n > replica.executor.ops_complete.n\r\n ensures Replica_Next_Process_AppStateSupply_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n inp, packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var newLearner := LearnerModel_ForgetOperationsBefore(replica.learner, inp.msg.opn_state_supply);\r\n var newExecutor;\r\n newExecutor := ExecutorProcessAppStateSupply(replica.executor, inp);\r\n replica' := replica.(learner := newLearner, executor := newExecutor);\r\n packets_sent := Broadcast(CBroadcastNop);\r\n}\r\n\r\nmethod Replica_Next_Process_AppStateSupply(\r\n replica:ReplicaState,\r\n inp:CPacket\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets,\r\n replicaChanged:bool\r\n )\r\n requires Replica_Next_Process_AppStateSupply_Preconditions(replica, inp)\r\n ensures Replica_Next_Process_AppStateSupply_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n inp, packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replicaChanged ==> replica'.executor.reply_cache == replica.executor.reply_cache\r\n ensures !replicaChanged ==> replica' == replica\r\n{\r\n var empty_Mutable_Map:MutableMap := MutableMap.EmptyMap();\r\n var start_time := Time.GetDebugTimeTicks();\r\n// lemma_AbstractifyEndPointsToNodeIdentities_properties(replica.executor.constants.all.config.replica_ids);\r\n if (&& inp.src in replica.executor.constants.all.config.replica_ids\r\n && inp.msg.opn_state_supply.n > replica.executor.ops_complete.n)\r\n {\r\n replica', packets_sent := ReplicaNextProcessAppStateSupplyActual(replica, inp);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Process_AppStateSupply_work\", start_time, end_time);\r\n replicaChanged := true;\r\n } else {\r\n replica', packets_sent := ReplicaNextProcessAppStateSupplyIgnore(replica, inp);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Process_AppStateSupply_nada\", start_time, end_time);\r\n replicaChanged := false;\r\n }\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(packets_sent);\r\n}\r\n\r\nmethod ReplicaNextSpontaneousMaybeExecuteIgnore(replica:ReplicaState) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Spontaneous_MaybeExecute_Preconditions(replica);\r\n requires || !replica.executor.next_op_to_execute.COutstandingOpKnown?\r\n || replica.executor.ops_complete.n >= replica.executor.constants.all.params.max_integer_val\r\n ensures Replica_Next_Spontaneous_MaybeExecute_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n packets_sent);\r\n ensures replica' == replica;\r\n{\r\n replica' := replica;\r\n packets_sent := OutboundPacket(None);\r\n}\r\n\r\nmethod ReplicaNextSpontaneousMaybeExecuteActual(\r\n replica:ReplicaState,\r\n cur_req_set:MutableSet,\r\n prev_req_set:MutableSet,\r\n reply_cache_mutable:MutableMap\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Spontaneous_MaybeExecute_Preconditions(replica)\r\n requires cur_req_set != prev_req_set\r\n requires MutableSet.SetOf(cur_req_set) == replica.proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == replica.proposer.election_state.prev_req_set\r\n requires replica.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n requires replica.executor.next_op_to_execute.COutstandingOpKnown?\r\n requires replica.executor.ops_complete.n < replica.executor.constants.all.params.max_integer_val\r\n modifies replica.executor.app\r\n modifies cur_req_set, prev_req_set, reply_cache_mutable\r\n ensures Replica_Next_Spontaneous_MaybeExecute_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n packets_sent)\r\n ensures MutableSet.SetOf(cur_req_set) == replica'.proposer.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == replica'.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n{\r\n ghost var s := AbstractifyReplicaStateToLReplica(replica);\r\n var val := replica.executor.next_op_to_execute.v;\r\n var newLearner := LearnerModel_ForgetDecision(replica.learner, replica.executor.ops_complete);\r\n assert LLearnerForgetDecision(AbstractifyLearnerStateToLLearner(replica.learner), AbstractifyLearnerStateToLLearner(newLearner), \r\n AbstractifyCOperationNumberToOperationNumber(replica.executor.ops_complete));\r\n\r\n var oldExecutor := AbstractifyExecutorStateToLExecutor(replica.executor);\r\n var newExecutor, packets := ExecutorExecute(replica.executor, reply_cache_mutable);\r\n assert LExecutorExecute(oldExecutor, AbstractifyExecutorStateToLExecutor(newExecutor), \r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets));\r\n\r\n var oldProposer := AbstractifyProposerStateToLProposer(replica.proposer);\r\n var newProposer := ProposerResetViewTimerDueToExecution(replica.proposer, val, cur_req_set, prev_req_set);\r\n assert LProposerResetViewTimerDueToExecution(oldProposer,\r\n AbstractifyProposerStateToLProposer(newProposer), \r\n AbstractifyCRequestBatchToRequestBatch(val));\r\n assert MutableSet.SetOf(cur_req_set) == newProposer.election_state.cur_req_set;\r\n assert MutableSet.SetOf(prev_req_set) == newProposer.election_state.prev_req_set;\r\n\r\n replica' := replica.(proposer := newProposer,\r\n learner := newLearner,\r\n executor := newExecutor);\r\n packets_sent := packets;\r\n\r\n ghost var s' := AbstractifyReplicaStateToLReplica(replica');\r\n ghost var sent_packets := AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent);\r\n\r\n assert LProposerResetViewTimerDueToExecution(s.proposer, s'.proposer, AbstractifyCRequestBatchToRequestBatch(val));\r\n assert LLearnerForgetDecision(s.learner, s'.learner, AbstractifyCOperationNumberToOperationNumber(replica.executor.ops_complete));\r\n assert LExecutorExecute(s.executor, s'.executor, sent_packets);\r\n assert LReplicaNextSpontaneousMaybeExecute(s, s', sent_packets);\r\n}\r\n\r\nmethod Replica_Next_Spontaneous_MaybeExecute(\r\n replica:ReplicaState,\r\n cur_req_set:MutableSet,\r\n prev_req_set:MutableSet,\r\n reply_cache_mutable:MutableMap\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Spontaneous_MaybeExecute_Preconditions(replica)\r\n requires cur_req_set != prev_req_set\r\n requires MutableSet.SetOf(cur_req_set) == replica.proposer.election_state.cur_req_set\r\n requires MutableSet.SetOf(prev_req_set) == replica.proposer.election_state.prev_req_set\r\n requires replica.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n modifies replica.executor.app\r\n modifies cur_req_set, prev_req_set, reply_cache_mutable\r\n ensures Replica_Next_Spontaneous_MaybeExecute_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n packets_sent)\r\n ensures MutableSet.SetOf(cur_req_set) == replica'.proposer.election_state.cur_req_set\r\n ensures MutableSet.SetOf(prev_req_set) == replica'.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == MutableMap.MapOf(reply_cache_mutable)\r\n{\r\n //var start_time := Time.GetDebugTimeTicks();\r\n if (&& replica.executor.next_op_to_execute.COutstandingOpKnown?\r\n && replica.executor.ops_complete.n < replica.executor.constants.all.params.max_integer_val)\r\n {\r\n replica', packets_sent := ReplicaNextSpontaneousMaybeExecuteActual(replica, cur_req_set, prev_req_set, reply_cache_mutable);\r\n //var end_time := Time.GetDebugTimeTicks();\r\n// RecordTimingSeq(\"Replica_Next_Spontaneous_MaybeExecute_work\", start_time, end_time);\r\n// RecordTimingSeq(\"Replica_Next_Spontaneous_MaybeExecute_work_proposer\", start_time, end_time_proposer);\r\n// RecordTimingSeq(\"Replica_Next_Spontaneous_MaybeExecute_work_learner\", start_time_learner, end_time_learner);\r\n// RecordTimingSeq(\"Replica_Next_Spontaneous_MaybeExecute_work_execute\", start_time_executor, end_time_executor);\r\n } else {\r\n replica', packets_sent := ReplicaNextSpontaneousMaybeExecuteIgnore(replica);\r\n //var end_time := Time.GetDebugTimeTicks();\r\n// RecordTimingSeq(\"Replica_Next_Spontaneous_MaybeExecute_nada\", start_time, end_time);\r\n }\r\n //lemma_AbstractifyCPacketToRslPacket_src(packets_sent, replica.constants.all.config.replica_ids[replica.constants.my_index]);\r\n}\r\n\r\nmethod ReplicaNextReadClockMaybeSendHeartbeatSkip(\r\n replica:ReplicaState,\r\n clock:CClockReading\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_ReadClock_MaybeSendHeartbeat_Preconditions(replica)\r\n requires clock.t < replica.nextHeartbeatTime\r\n ensures Replica_Next_ReadClock_MaybeSendHeartbeat_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n clock, packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n replica' := replica;\r\n packets_sent := Broadcast(CBroadcastNop);\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(packets_sent);\r\n}\r\n\r\nmethod ReplicaNextReadClockMaybeSendHeartbeatActual(\r\n replica:ReplicaState,\r\n clock:CClockReading\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_ReadClock_MaybeSendHeartbeat_Preconditions(replica)\r\n requires clock.t >= replica.nextHeartbeatTime\r\n ensures Replica_Next_ReadClock_MaybeSendHeartbeat_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n clock, packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var heartbeat := UpperBoundedAdditionImpl(clock.t, replica.constants.all.params.heartbeat_period, replica.constants.all.params.max_integer_val);\r\n replica' := replica.(nextHeartbeatTime := heartbeat);\r\n var flag := (replica.constants.my_index in replica.proposer.election_state.current_view_suspectors);\r\n var msg := CMessage_Heartbeat(replica.proposer.election_state.current_view, flag, replica.executor.ops_complete);\r\n var packets := BuildBroadcastToEveryone(replica.constants.all.config, replica.constants.my_index, msg);\r\n lemma_AbstractifySeqOfUint64sToSetOfInts_properties(replica.proposer.election_state.current_view_suspectors);\r\n packets_sent := Broadcast(packets);\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(packets_sent);\r\n}\r\n\r\nmethod Replica_Next_ReadClock_MaybeSendHeartbeat(\r\n replica:ReplicaState,\r\n clock:CClockReading\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_ReadClock_MaybeSendHeartbeat_Preconditions(replica)\r\n ensures Replica_Next_ReadClock_MaybeSendHeartbeat_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n clock, packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n if (clock.t >= replica.nextHeartbeatTime) {\r\n replica', packets_sent := ReplicaNextReadClockMaybeSendHeartbeatActual(replica, clock);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_ReadClock_MaybeSendHeartbeat_work\", start_time, end_time);\r\n } else {\r\n replica', packets_sent := ReplicaNextReadClockMaybeSendHeartbeatSkip(replica, clock);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_ReadClock_MaybeSendHeartbeat_nada\", start_time, end_time);\r\n }\r\n //lemma_AbstractifyCPacketToRslPacket_src(packets_sent, replica.constants.all.config.replica_ids[replica.constants.my_index]);\r\n}\r\n\r\nmethod ReplicaNextSpontaneousMaybeMakeDecisionSkip(replica:ReplicaState) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Spontaneous_MaybeMakeDecision_Preconditions(replica)\r\n requires var opn := replica.executor.ops_complete;\r\n || !replica.executor.next_op_to_execute.COutstandingOpUnknown?\r\n || opn !in replica.learner.unexecuted_ops\r\n || |replica.learner.unexecuted_ops[opn].received_2b_message_senders| < LMinQuorumSize(AbstractifyCPaxosConfigurationToConfiguration(replica.learner.rcs.all.config))\r\n ensures Replica_Next_Spontaneous_MaybeMakeDecision_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n packets_sent)\r\n ensures replica' == replica\r\n{\r\n replica' := replica;\r\n packets_sent := Broadcast(CBroadcastNop);\r\n\r\n lemma_AbstractifyCOperationNumberToOperationNumber_isInjective();\r\n lemma_AbstractifyCLearnerTuplesToLearnerTuples_properties(replica.learner.unexecuted_ops);\r\n\r\n ghost var s := AbstractifyReplicaStateToLReplica(replica);\r\n ghost var opn := replica.executor.ops_complete;\r\n if replica.executor.next_op_to_execute.COutstandingOpUnknown? && opn in replica.learner.unexecuted_ops\r\n {\r\n assert AbstractifyCOperationNumberToOperationNumber(opn) in s.learner.unexecuted_learner_state;\r\n calc {\r\n |s.learner.unexecuted_learner_state[AbstractifyCOperationNumberToOperationNumber(opn)].received_2b_message_senders|;\r\n { lemma_Received2bPacketsSameSizeAsAbstraction(replica.learner.unexecuted_ops[opn], AbstractifyCLearnerTupleToLearnerTuple(replica.learner.unexecuted_ops[opn])); }\r\n |replica.learner.unexecuted_ops[opn].received_2b_message_senders|;\r\n < LMinQuorumSize(AbstractifyCPaxosConfigurationToConfiguration(replica.learner.rcs.all.config));\r\n LMinQuorumSize(s.learner.constants.all.config);\r\n }\r\n }\r\n}\r\n\r\nmethod ReplicaNextSpontaneousMaybeMakeDecisionActual(replica:ReplicaState) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Spontaneous_MaybeMakeDecision_Preconditions(replica)\r\n requires replica.executor.next_op_to_execute.COutstandingOpUnknown?\r\n requires replica.executor.ops_complete in replica.learner.unexecuted_ops\r\n requires |replica.learner.unexecuted_ops[replica.executor.ops_complete].received_2b_message_senders| >= LMinQuorumSize(AbstractifyCPaxosConfigurationToConfiguration(replica.learner.rcs.all.config))\r\n ensures Replica_Next_Spontaneous_MaybeMakeDecision_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica', packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n lemma_AbstractifyCOperationNumberToOperationNumber_isInjective();\r\n lemma_AbstractifyCRequestToRequest_isInjective();\r\n lemma_AbstractifyCLearnerTuplesToLearnerTuples_properties(replica.learner.unexecuted_ops);\r\n \r\n var opn := replica.executor.ops_complete;\r\n\r\n lemma_Received2bPacketsSameSizeAsAbstraction(replica.learner.unexecuted_ops[opn], AbstractifyCLearnerTupleToLearnerTuple(replica.learner.unexecuted_ops[opn]));\r\n\r\n var candValue:CRequestBatch := replica.learner.unexecuted_ops[opn].candidate_learned_value;\r\n assert CLearnerTupleIsValid(replica.learner.unexecuted_ops[opn]);\r\n assert ValidRequestBatch(replica.learner.unexecuted_ops[opn].candidate_learned_value);\r\n var newExecutor := ExecutorGetDecision(replica.executor, replica.learner.max_ballot_seen, opn, candValue);\r\n\r\n replica' := replica.(executor := newExecutor);\r\n\r\n packets_sent := Broadcast(CBroadcastNop);\r\n lemma_AbstractifyCRequestToRequest_isInjective();\r\n\r\n ghost var s := AbstractifyReplicaStateToLReplica(replica);\r\n ghost var s' := AbstractifyReplicaStateToLReplica(replica');\r\n ghost var sent_packets := AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent);\r\n\r\n assert LExecutorGetDecision(s.executor, s'.executor, AbstractifyCBallotToBallot(replica.learner.max_ballot_seen),\r\n AbstractifyCOperationNumberToOperationNumber(opn), AbstractifyCRequestBatchToRequestBatch(candValue));\r\n assert LReplicaNextSpontaneousMaybeMakeDecision(s, s', sent_packets);\r\n}\r\n\r\nmethod Replica_Next_Spontaneous_MaybeMakeDecision(replica:ReplicaState) returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Spontaneous_MaybeMakeDecision_Preconditions(replica)\r\n ensures Replica_Next_Spontaneous_MaybeMakeDecision_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica',\r\n packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n var opn := replica.executor.ops_complete;\r\n var minCQS := MinCQuorumSize(replica.learner.rcs.all.config);\r\n\r\n if (&& replica.executor.next_op_to_execute.COutstandingOpUnknown?\r\n && opn in replica.learner.unexecuted_ops\r\n && (|replica.learner.unexecuted_ops[opn].received_2b_message_senders|) >= minCQS as int)\r\n {\r\n replica', packets_sent := ReplicaNextSpontaneousMaybeMakeDecisionActual(replica);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Spontaneous_MaybeMakeDecision_work\", start_time, end_time);\r\n } else {\r\n replica', packets_sent := ReplicaNextSpontaneousMaybeMakeDecisionSkip(replica);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Spontaneous_MaybeMakeDecision_nada\", start_time, end_time);\r\n }\r\n}\r\n\r\nmethod ReplicaNextSpontaneousTruncateLogBasedOnCheckpointsSkip(\r\n replica:ReplicaState,\r\n newLogTruncationPoint:COperationNumber\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Spontaneous_TruncateLogBasedOnCheckpoints_Preconditions(replica)\r\n requires IsLogTruncationPointValid(AbstractifyCOperationNumberToOperationNumber(newLogTruncationPoint),\r\n AbstractifyReplicaStateToLReplica(replica).acceptor.last_checkpointed_operation,\r\n AbstractifyReplicaStateToLReplica(replica).acceptor.constants.all.config)\r\n requires newLogTruncationPoint.n <= replica.acceptor.log_truncation_point.n\r\n ensures Replica_Next_Spontaneous_TruncateLogBasedOnCheckpoints_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)), replica', packets_sent)\r\n ensures replica' == replica\r\n{\r\n replica' := replica;\r\n packets_sent := Broadcast(CBroadcastNop);\r\n}\r\n\r\nmethod ReplicaNextSpontaneousTruncateLogBasedOnCheckpointsActual(\r\n replica:ReplicaState,\r\n newLogTruncationPoint:COperationNumber\r\n ) returns (\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n requires Replica_Next_Spontaneous_TruncateLogBasedOnCheckpoints_Preconditions(replica)\r\n requires IsLogTruncationPointValid(AbstractifyCOperationNumberToOperationNumber(newLogTruncationPoint),\r\n AbstractifyReplicaStateToLReplica(replica).acceptor.last_checkpointed_operation,\r\n AbstractifyReplicaStateToLReplica(replica).acceptor.constants.all.config)\r\n requires newLogTruncationPoint.n > replica.acceptor.log_truncation_point.n\r\n ensures Replica_Next_Spontaneous_TruncateLogBasedOnCheckpoints_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)),\r\n replica', packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n assert AbstractifyCOperationNumberToOperationNumber(newLogTruncationPoint) > AbstractifyAcceptorStateToAcceptor(replica.acceptor).log_truncation_point;\r\n var newAcceptor := NextAcceptorState_TruncateLog(replica.acceptor, newLogTruncationPoint);\r\n replica' := replica.(acceptor := newAcceptor);\r\n packets_sent := Broadcast(CBroadcastNop);\r\n //lemma_AbstractifySetOfCPacketsToSetOfRslPackets_properties(packets_sent);\r\n}\r\n\r\nmethod Replica_Next_Spontaneous_TruncateLogBasedOnCheckpoints(replica:ReplicaState)\r\n returns (replica':ReplicaState, packets_sent:OutboundPackets)\r\n requires Replica_Next_Spontaneous_TruncateLogBasedOnCheckpoints_Preconditions(replica)\r\n ensures Replica_Next_Spontaneous_TruncateLogBasedOnCheckpoints_Postconditions(old(AbstractifyReplicaStateToLReplica(replica)),\r\n replica', packets_sent)\r\n ensures replica'.proposer.election_state.cur_req_set == replica.proposer.election_state.cur_req_set\r\n ensures replica'.proposer.election_state.prev_req_set == replica.proposer.election_state.prev_req_set\r\n ensures replica'.executor.reply_cache == replica.executor.reply_cache\r\n{\r\n var start_time := Time.GetDebugTimeTicks();\r\n var minCQS := MinCQuorumSize(replica.acceptor.constants.all.config);\r\n var newLogTruncationPoint := AcceptorModel_GetNthHighestValueAmongReportedCheckpoints(replica.acceptor, minCQS);\r\n if newLogTruncationPoint.n > replica.acceptor.log_truncation_point.n {\r\n replica', packets_sent := ReplicaNextSpontaneousTruncateLogBasedOnCheckpointsActual(replica, newLogTruncationPoint);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Spontaneous_TruncateLogBasedOnCheckpoints_work\", start_time, end_time);\r\n } else {\r\n replica', packets_sent := ReplicaNextSpontaneousTruncateLogBasedOnCheckpointsSkip(replica, newLogTruncationPoint);\r\n var end_time := Time.GetDebugTimeTicks();\r\n RecordTimingSeq(\"Replica_Next_Spontaneous_TruncateLogBasedOnCheckpoints_nada\", start_time, end_time);\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaModel.i.dfy", "content": "include \"ReplicaModel-Part1.i.dfy\"\r\ninclude \"ReplicaModel-Part2.i.dfy\"\r\ninclude \"ReplicaModel-Part3.i.dfy\"\r\ninclude \"ReplicaModel-Part4.i.dfy\"\r\ninclude \"ReplicaModel-Part5.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaModel_i {\r\nimport opened LiveRSL__ReplicaModel_Part1_i\r\nimport opened LiveRSL__ReplicaModel_Part2_i\r\nimport opened LiveRSL__ReplicaModel_Part3_i\r\nimport opened LiveRSL__ReplicaModel_Part4_i\r\nimport opened LiveRSL__ReplicaModel_Part5_i\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/ReplicaState.i.dfy", "content": "include \"../../Protocol/RSL/Replica.i.dfy\"\r\ninclude \"ReplicaConstantsState.i.dfy\"\r\ninclude \"ProposerState.i.dfy\"\r\ninclude \"AcceptorState.i.dfy\"\r\ninclude \"LearnerState.i.dfy\"\r\ninclude \"ExecutorState.i.dfy\"\r\ninclude \"CClockReading.i.dfy\"\r\n\r\nmodule LiveRSL__ReplicaState_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__AcceptorState_i\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__CClockReading_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__CPaxosConfiguration_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__ExecutorState_i\r\nimport opened LiveRSL__LearnerState_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__ProposerState_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__ReplicaConstantsState_i\r\n\r\ndatatype ReplicaState = ReplicaState(\r\n constants:ReplicaConstantsState,\r\n nextHeartbeatTime:uint64,\r\n proposer:ProposerState,\r\n acceptor:AcceptorState,\r\n learner:CLearnerState,\r\n executor:ExecutorState\r\n )\r\n\r\npredicate ReplicaStateIsAbstractable(replica:ReplicaState)\r\n{\r\n && ReplicaConstantsStateIsAbstractable(replica.constants)\r\n && ProposerIsAbstractable(replica.proposer)\r\n && AcceptorIsAbstractable(replica.acceptor)\r\n && LearnerState_IsAbstractable(replica.learner)\r\n && ExecutorState_IsAbstractable(replica.executor)\r\n}\r\n\r\nfunction AbstractifyReplicaStateToLReplica(replica:ReplicaState) : (lreplica:LReplica)\r\n reads replica.executor.app\r\n requires ReplicaStateIsAbstractable(replica)\r\n ensures lreplica.constants == AbstractifyReplicaConstantsStateToLReplicaConstants(replica.constants)\r\n{\r\n LReplica(\r\n AbstractifyReplicaConstantsStateToLReplicaConstants(replica.constants),\r\n replica.nextHeartbeatTime as int,\r\n AbstractifyProposerStateToLProposer(replica.proposer),\r\n AbstractifyAcceptorStateToAcceptor(replica.acceptor),\r\n AbstractifyLearnerStateToLLearner(replica.learner),\r\n AbstractifyExecutorStateToLExecutor(replica.executor))\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\npredicate ReplicaCommonPreconditions(replica:ReplicaState)\r\n{\r\n ReplicaStateIsValid(replica)\r\n}\r\n\r\npredicate ReplicaReceivePreconditions(replica:ReplicaState, cpacket:CPacket)\r\n{\r\n && ReplicaCommonPreconditions(replica)\r\n && CPacketIsSendable(cpacket)\r\n && PaxosEndPointIsValid(cpacket.src, replica.constants.all.config)\r\n}\r\n\r\npredicate ReplicaCommonPostconditions(replica:LReplica, replica':ReplicaState, sent_packets:OutboundPackets)\r\n{\r\n && ReplicaConstantsState_IsValid(replica'.constants)\r\n && AbstractifyReplicaConstantsStateToLReplicaConstants(replica'.constants) == replica.constants\r\n && ReplicaStateIsAbstractable(replica')\r\n && OutboundPacketsIsValid(sent_packets)\r\n && OutboundPacketsIsAbstractable(sent_packets)\r\n && ReplicaStateIsValid(replica')\r\n && OutboundPacketsHasCorrectSrc(sent_packets, replica'.constants.all.config.replica_ids[replica'.constants.my_index])\r\n}\r\n\r\n//\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\npredicate ReplicaStateIsValid(replica:ReplicaState)\r\n{\r\n && ProposerIsValid(replica.proposer)\r\n && AcceptorIsValid(replica.acceptor)\r\n && LearnerState_IsValid(replica.learner)\r\n && ExecutorState_IsValid(replica.executor)\r\n && ReplicaStateIsAbstractable(replica)\r\n && ReplicaConstantsState_IsValid(replica.constants)\r\n && replica.constants == replica.proposer.constants\r\n && replica.constants == replica.acceptor.constants\r\n && replica.constants == replica.learner.rcs\r\n && replica.constants == replica.executor.constants\r\n}\r\n\r\npredicate ConstantsStayConstant_Replica(replica:LReplica, replica':ReplicaState)\r\n requires ReplicaConstantsStateIsAbstractable(replica'.constants)\r\n{\r\n && AbstractifyReplicaConstantsStateToLReplicaConstants(replica'.constants) == replica.constants\r\n && replica.constants == replica.proposer.constants\r\n && replica.constants == replica.acceptor.constants\r\n && replica.constants == replica.learner.constants\r\n && replica.constants == replica.executor.constants\r\n && replica'.constants == replica'.proposer.constants\r\n && replica'.constants == replica'.acceptor.constants\r\n && replica'.constants == replica'.learner.rcs\r\n && replica'.constants == replica'.executor.constants\r\n}\r\n\r\npredicate Replica_Common_Preconditions(replica:ReplicaState, inp:CPacket)\r\n{\r\n && ReplicaStateIsValid(replica)\r\n && CPacketIsSendable(inp)\r\n && PaxosEndPointIsValid(inp.src, replica.constants.all.config)\r\n}\r\n\r\npredicate Replica_Common_Postconditions(replica:LReplica, replica':ReplicaState, inp:CPacket, packets_sent:OutboundPackets)\r\n{\r\n && ReplicaConstantsState_IsValid(replica'.constants)\r\n && CPacketIsSendable(inp)\r\n && PaxosEndPointIsValid(inp.src, replica'.constants.all.config)\r\n && ReplicaStateIsAbstractable(replica')\r\n && ConstantsStayConstant_Replica(replica, replica')\r\n && ReplicaStateIsValid(replica')\r\n && OutboundPacketsIsValid(packets_sent)\r\n && OutboundPacketsHasCorrectSrc(packets_sent, replica'.constants.all.config.replica_ids[replica'.constants.my_index])\r\n && OutboundPacketsIsAbstractable(packets_sent)\r\n}\r\n\r\npredicate Replica_Common_Postconditions_NoPacket(replica:LReplica, replica':ReplicaState, packets_sent:OutboundPackets)\r\n{\r\n && ReplicaConstantsState_IsValid(replica'.constants)\r\n && ReplicaStateIsAbstractable(replica')\r\n && ConstantsStayConstant_Replica(replica, replica')\r\n && ReplicaStateIsValid(replica')\r\n && OutboundPacketsIsValid(packets_sent)\r\n && OutboundPacketsHasCorrectSrc(packets_sent, replica'.constants.all.config.replica_ids[replica'.constants.my_index])\r\n && OutboundPacketsIsAbstractable(packets_sent)\r\n}\r\n\r\npredicate Replica_Next_Process_Request_Preconditions(replica:ReplicaState, inp:CPacket)\r\n{\r\n && Replica_Common_Preconditions(replica, inp)\r\n && ProposerIsValid(replica.proposer)\r\n && CPacketIsAbstractable(inp)\r\n && inp.msg.CMessage_Request?\r\n}\r\n\r\npredicate Replica_Next_Process_Request_Postconditions(replica:LReplica, replica':ReplicaState, inp:CPacket,\r\n packets_sent:OutboundPackets)\r\n reads replica'.executor.app\r\n{\r\n && CPacketIsAbstractable(inp)\r\n && inp.msg.CMessage_Request?\r\n && Replica_Common_Postconditions(replica, replica', inp, packets_sent)\r\n && LReplicaNextProcessRequest(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_Process_1a_Preconditions(replica:ReplicaState, inp:CPacket)\r\n{\r\n && Replica_Common_Preconditions(replica, inp)\r\n && NextAcceptorState_Phase1Preconditions(replica.acceptor, inp.msg, inp.src)\r\n}\r\n\r\npredicate Replica_Next_Process_1a_Postconditions(replica:LReplica, replica':ReplicaState, inp:CPacket,\r\n packets_sent:OutboundPackets)\r\n reads replica'.executor.app\r\n{\r\n && CPacketIsAbstractable(inp)\r\n && inp.msg.CMessage_1a?\r\n && Replica_Common_Postconditions(replica, replica', inp, packets_sent)\r\n && LReplicaNextProcess1a(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_Process_1b_Preconditions(replica:ReplicaState, inp:CPacket)\r\n{\r\n && Replica_Common_Preconditions(replica, inp)\r\n && ProposerIsValid(replica.proposer)\r\n && CPacketIsAbstractable(inp)\r\n// && replica.proposer.current_state == 1\r\n// && ConvertUint64ToEndPoint(inp.src) in replica.proposer.constants.all.config.replica_ids\r\n && inp.msg.CMessage_1b?\r\n// && inp.msg.bal_1b == replica.proposer.max_ballot_i_sent_1a\r\n}\r\n\r\npredicate Replica_Next_Process_1b_Postconditions(replica:LReplica, replica':ReplicaState, inp:CPacket,\r\n packets_sent:OutboundPackets)\r\n reads replica'.executor.app\r\n{\r\n && CPacketIsAbstractable(inp)\r\n && inp.msg.CMessage_1b?\r\n && Replica_Common_Postconditions(replica, replica', inp, packets_sent)\r\n && LReplicaNextProcess1b(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_Process_StartingPhase2_Preconditions(replica:ReplicaState, inp:CPacket)\r\n{\r\n && Replica_Common_Preconditions(replica, inp)\r\n && CPacketIsAbstractable(inp)\r\n && inp.msg.CMessage_StartingPhase2?\r\n}\r\n\r\npredicate Replica_Next_Process_StartingPhase2_Postconditions(replica:LReplica, replica':ReplicaState, inp:CPacket,\r\n packets_sent:OutboundPackets)\r\n reads replica'.executor.app\r\n{\r\n && CPacketIsAbstractable(inp)\r\n && inp.msg.CMessage_StartingPhase2?\r\n && Replica_Common_Postconditions(replica, replica', inp, packets_sent)\r\n && LReplicaNextProcessStartingPhase2(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_Process_2a_Preconditions(replica:ReplicaState, inp:CPacket)\r\n{\r\n && Replica_Common_Preconditions(replica, inp)\r\n && NextAcceptorState_Phase2Preconditions_AlwaysEnabled(replica.acceptor, inp.msg, inp.src)\r\n}\r\n\r\npredicate Replica_Next_Process_2a_Postconditions(replica:LReplica, replica':ReplicaState, inp:CPacket,\r\n packets_sent:OutboundPackets)\r\n reads replica'.executor.app\r\n{\r\n && CPacketIsAbstractable(inp)\r\n && inp.msg.CMessage_2a?\r\n && Replica_Common_Postconditions(replica, replica', inp, packets_sent)\r\n && LReplicaNextProcess2a(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_Process_2b_Preconditions(replica:ReplicaState, inp:CPacket)\r\n{\r\n && Replica_Common_Preconditions(replica, inp)\r\n && LearnerState_Process2b__Preconditions(replica.learner, replica.executor, inp)\r\n}\r\n\r\npredicate Replica_Next_Process_2b_Postconditions(replica:LReplica, replica':ReplicaState, inp:CPacket,\r\n packets_sent:OutboundPackets)\r\n reads replica'.executor.app\r\n{\r\n && CPacketIsAbstractable(inp)\r\n && inp.msg.CMessage_2b?\r\n && Replica_Common_Postconditions(replica, replica', inp, packets_sent)\r\n && LReplicaNextProcess2b(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_MaybeEnterNewViewAndSend1a_Preconditions(replica:ReplicaState)\r\n{\r\n ReplicaStateIsValid(replica)\r\n}\r\n\r\npredicate Replica_Next_MaybeEnterNewViewAndSend1a_Postconditions(replica:LReplica, replica':ReplicaState, packets_sent:OutboundPackets)\r\n reads replica'.executor.app\r\n{\r\n && Replica_Common_Postconditions_NoPacket(replica, replica', packets_sent)\r\n && LReplicaNextSpontaneousMaybeEnterNewViewAndSend1a(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_MaybeEnterPhase2_Preconditions(replica:ReplicaState)\r\n{\r\n ReplicaStateIsValid(replica)\r\n}\r\n\r\npredicate Replica_Next_MaybeEnterPhase2_Postconditions(replica:LReplica, replica':ReplicaState, packets_sent:OutboundPackets)\r\n reads replica'.executor.app\r\n{\r\n && Replica_Common_Postconditions_NoPacket(replica, replica', packets_sent)\r\n && LReplicaNextSpontaneousMaybeEnterPhase2(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_ReadClock_MaybeNominateValueAndSend2a_Preconditions(replica:ReplicaState)\r\n{\r\n ReplicaStateIsValid(replica)\r\n}\r\n\r\npredicate Replica_Next_ReadClock_MaybeNominateValueAndSend2a_Postconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n clock:CClockReading,\r\n packets_sent:OutboundPackets\r\n )\r\n reads replica'.executor.app\r\n{\r\n && Replica_Common_Postconditions_NoPacket(replica, replica', packets_sent)\r\n && LReplicaNextReadClockMaybeNominateValueAndSend2a(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCClockReadingToClockReading(clock),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_Process_AppStateRequest_Preconditions(replica:ReplicaState, inp:CPacket)\r\n{\r\n && Replica_Common_Preconditions(replica, inp)\r\n && CPacketIsAbstractable(inp)\r\n && inp.msg.CMessage_AppStateRequest?\r\n}\r\n\r\npredicate Replica_Next_Process_AppStateRequest_Postconditions(replica:LReplica, replica':ReplicaState,\r\n inp:CPacket, packets_sent:OutboundPackets)\r\n reads replica'.executor.app\r\n{\r\n && CPacketIsAbstractable(inp)\r\n && inp.msg.CMessage_AppStateRequest?\r\n && Replica_Common_Postconditions(replica, replica', inp, packets_sent)\r\n && LReplicaNextProcessAppStateRequest(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_Process_Heartbeat_Preconditions(replica:ReplicaState, inp:CPacket)\r\n{\r\n && Replica_Common_Preconditions(replica, inp)\r\n && NextAcceptorState_ProcessHeartbeatPreconditions(replica.acceptor, inp.msg, inp.src)\r\n && CPacketIsAbstractable(inp)\r\n && inp.msg.CMessage_Heartbeat?\r\n}\r\n\r\npredicate Replica_Next_Process_Heartbeat_Postconditions(replica:LReplica, replica':ReplicaState,\r\n inp:CPacket, clock:uint64, packets_sent:OutboundPackets)\r\n reads replica'.executor.app\r\n{\r\n && CPacketIsAbstractable(inp)\r\n && inp.msg.CMessage_Heartbeat?\r\n && Replica_Common_Postconditions(replica, replica', inp, packets_sent)\r\n && LReplicaNextProcessHeartbeat(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp),\r\n clock as int,\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_ReadClock_CheckForViewTimeout_Preconditions(replica:ReplicaState)\r\n{\r\n ReplicaStateIsValid(replica)\r\n}\r\n\r\npredicate Replica_Next_ReadClock_CheckForViewTimeout_Postconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n clock:CClockReading,\r\n packets_sent:OutboundPackets\r\n )\r\n reads replica'.executor.app\r\n{\r\n && Replica_Common_Postconditions_NoPacket(replica, replica', packets_sent)\r\n && LReplicaNextReadClockCheckForViewTimeout(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCClockReadingToClockReading(clock),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_ReadClock_CheckForQuorumOfViewSuspicions_Preconditions(replica:ReplicaState)\r\n{\r\n ReplicaStateIsValid(replica)\r\n}\r\n\r\npredicate Replica_Next_ReadClock_CheckForQuorumOfViewSuspicions_Postconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n clock:CClockReading,\r\n packets_sent:OutboundPackets\r\n )\r\n reads replica'.executor.app\r\n{\r\n && Replica_Common_Postconditions_NoPacket(replica, replica', packets_sent)\r\n && LReplicaNextReadClockCheckForQuorumOfViewSuspicions(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCClockReadingToClockReading(clock),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_Process_AppStateSupply_Preconditions(replica:ReplicaState, inp:CPacket)\r\n{\r\n && Replica_Common_Preconditions(replica, inp)\r\n && inp.msg.CMessage_AppStateSupply?\r\n && LearnerState_ForgetOperationsBefore__Preconditions(replica.learner, inp.msg.opn_state_supply)\r\n}\r\n\r\npredicate Replica_Next_Process_AppStateSupply_Postconditions(replica:LReplica, replica':ReplicaState,\r\n inp:CPacket, packets_sent:OutboundPackets)\r\n reads replica'.executor.app\r\n{\r\n && CPacketIsAbstractable(inp)\r\n && inp.msg.CMessage_AppStateSupply?\r\n && Replica_Common_Postconditions(replica, replica', inp, packets_sent)\r\n && LReplicaNextProcessAppStateSupply(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCPacketToRslPacket(inp),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_Spontaneous_MaybeExecute_Preconditions(replica:ReplicaState)\r\n{\r\n ReplicaStateIsValid(replica)\r\n}\r\n\r\npredicate Replica_Next_Spontaneous_MaybeExecute_Postconditions(replica:LReplica, replica':ReplicaState,\r\n packets_sent:OutboundPackets)\r\n reads replica'.executor.app\r\n{\r\n && Replica_Common_Postconditions_NoPacket(replica, replica', packets_sent)\r\n && LReplicaNextSpontaneousMaybeExecute(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_ReadClock_MaybeSendHeartbeat_Preconditions(replica:ReplicaState)\r\n{\r\n ReplicaStateIsValid(replica)\r\n}\r\n\r\npredicate Replica_Next_ReadClock_MaybeSendHeartbeat_Postconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n clock:CClockReading,\r\n packets_sent:OutboundPackets\r\n )\r\n reads replica'.executor.app\r\n{\r\n && Replica_Common_Postconditions_NoPacket(replica, replica', packets_sent)\r\n && LReplicaNextReadClockMaybeSendHeartbeat(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyCClockReadingToClockReading(clock),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_Spontaneous_MaybeMakeDecision_Preconditions(replica:ReplicaState)\r\n{\r\n ReplicaStateIsValid(replica)\r\n}\r\n\r\npredicate Replica_Next_Spontaneous_MaybeMakeDecision_Postconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n reads replica'.executor.app\r\n{\r\n && Replica_Common_Postconditions_NoPacket(replica, replica', packets_sent)\r\n && LReplicaNextSpontaneousMaybeMakeDecision(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\npredicate Replica_Next_Spontaneous_TruncateLogBasedOnCheckpoints_Preconditions(replica:ReplicaState)\r\n{\r\n ReplicaStateIsValid(replica)\r\n}\r\n\r\npredicate Replica_Next_Spontaneous_TruncateLogBasedOnCheckpoints_Postconditions(\r\n replica:LReplica,\r\n replica':ReplicaState,\r\n packets_sent:OutboundPackets\r\n )\r\n reads replica'.executor.app\r\n{\r\n && Replica_Common_Postconditions_NoPacket(replica, replica', packets_sent)\r\n && LReplicaNextSpontaneousTruncateLogBasedOnCheckpoints(\r\n replica,\r\n AbstractifyReplicaStateToLReplica(replica'),\r\n AbstractifyOutboundCPacketsToSeqOfRslPackets(packets_sent))\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/RSL/Unsendable.i.dfy", "content": "include \"../../Protocol/RSL/Replica.i.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\n\r\nmodule LiveRSL__Unsendable_i {\r\nimport opened Native__Io_s\r\nimport opened Native__NativeTypes_s\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened Common__GenericMarshalling_i\r\nimport opened Environment_s\r\n\r\npredicate IosReflectIgnoringUnsendable(ios:seq>>)\r\n{\r\n && |ios| == 1\r\n && ios[0].LIoOpReceive?\r\n && (|| !Demarshallable(ios[0].r.msg, CMessage_grammar())\r\n || !Marshallable(parse_Message(DemarshallFunc(ios[0].r.msg, CMessage_grammar()))))\r\n}\r\n \r\npredicate HostNextIgnoreUnsendable(s:LScheduler, s':LScheduler, ios:seq>>)\r\n{\r\n && s.nextActionIndex == 0\r\n && s' == s.(nextActionIndex := 1)\r\n && IosReflectIgnoringUnsendable(ios)\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/SHT/AppInterface.i.dfy", "content": "include \"../Common/GenericMarshalling.i.dfy\"\r\ninclude \"../../Protocol/SHT/Keys.i.dfy\"\r\n\r\nabstract module Impl__AppInterface_i {\r\nimport opened Common__GenericMarshalling_i\r\nimport opened SHT__Keys_i\r\nimport opened AppInterface_i`All\r\n\r\n//////////////////////////////////////////////////////////////////////////////////\r\n// The application's implementation supplies these functions, lemmas, etc.\r\n//////////////////////////////////////////////////////////////////////////////////\r\n\r\nfunction method Key_grammar() : G \r\nfunction method Value_grammar() : G \r\n\r\nfunction method parse_Key(val:V) : Key\r\n requires ValInGrammar(val, Key_grammar());\r\n\r\nfunction method parse_Value(val:V) : Value\r\n requires ValInGrammar(val, Value_grammar());\r\n\r\nmethod MarshallKey(c:Key) returns (val:V)\r\n requires ValidKey(c);\r\n ensures ValInGrammar(val, Key_grammar());\r\n ensures ValidVal(val);\r\n ensures parse_Key(val) == c;\r\n ensures 0 <= SizeOfV(val) < 8 + max_key_len();\r\n\r\nmethod MarshallValue(c:Value) returns (val:V)\r\n requires ValidValue(c);\r\n ensures ValInGrammar(val, Value_grammar());\r\n ensures ValidVal(val);\r\n ensures parse_Value(val) == c;\r\n ensures 0 <= SizeOfV(val) < 8 + max_val_len();\r\n\r\nmethod IsKeyValid(key:Key) returns (b:bool)\r\n ensures b == ValidKey(key);\r\n\r\nmethod IsValueValid(val:Value) returns (b:bool)\r\n ensures b == ValidValue(val);\r\n\r\nmethod IsKeyLt(k:Key, k':Key) returns (b:bool)\r\n ensures b == KeyLt(k, k');\r\n\r\nlemma lemma_ValidKey_grammer()\r\n ensures ValidGrammar(Key_grammar());\r\n\r\nlemma lemma_ValidValue_grammer()\r\n ensures ValidGrammar(Value_grammar());\r\n\r\n//function method KeyRangeSize(kr:KeyRange) : uint64\r\n\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/SHT/AppInterfaceConcrete.i.dfy", "content": "include \"AppInterface.i.dfy\"\r\n\r\nmodule Impl__AppInterfaceConcrete_i refines Impl__AppInterface_i {\r\nexport Spec\r\n provides Common__GenericMarshalling_i, AppInterface_i\r\n provides Key_grammar, Value_grammar\r\n provides parse_Key, parse_Value\r\n provides MarshallKey, MarshallValue, IsKeyValid, IsValueValid, IsKeyLt\r\n provides lemma_ValidKey_grammer, lemma_ValidValue_grammer\r\nexport All reveals *\r\n\r\nfunction method Key_grammar() : G { GUint64 } \r\nfunction method Value_grammar() : G { GByteArray }\r\n\r\nfunction method parse_Key(val:V) : Key\r\n{\r\n val.u\r\n}\r\n\r\nfunction method parse_Value(val:V) : Value\r\n{\r\n val.b\r\n}\r\n\r\nmethod MarshallKey(c:Key) returns (val:V)\r\n{\r\n val := VUint64(c);\r\n}\r\n\r\nmethod MarshallValue(c:Value) returns (val:V)\r\n{\r\n val := VByteArray(c);\r\n}\r\n\r\nmethod IsKeyValid(key:Key) returns (b:bool)\r\n{\r\n b := true;\r\n}\r\n\r\nmethod IsValueValid(val:Value) returns (b:bool)\r\n{\r\n b := |val| < 1024;\r\n}\r\n\r\nmethod IsKeyLt(k:Key, k':Key) returns (b:bool)\r\n{\r\n b := k < k';\r\n}\r\n\r\nlemma lemma_ValidKey_grammer()\r\n{\r\n}\r\n\r\n\r\nlemma lemma_ValidValue_grammer()\r\n{\r\n}\r\n\r\n//function method KeyRangeSize(kr:KeyRange) : uint64\r\n//{\r\n// if KeyPlusLe(kr.khi, kr.klo) then 0\r\n// else\r\n// KeyPlusAntisymmetry(kr.khi, kr.klo);\r\n// assert !kr.khi.KeyZero?;\r\n// assert !kr.klo.KeyInf?;\r\n// var upper := if kr.khi.KeyInf? then 0xFFFF_FFFF_FFFF_FFFF else kr.khi.k;\r\n// var lower := if kr.klo.KeyZero? then 0 else kr.klo.k;\r\n// assert lower <= upper;\r\n// upper - lower\r\n//}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/SHT/CMessage.i.dfy", "content": "include \"../../Protocol/SHT/Message.i.dfy\"\r\ninclude \"../Common/NodeIdentity.i.dfy\"\r\ninclude \"../../Protocol/SHT/Network.i.dfy\"\r\ninclude \"Parameters.i.dfy\"\r\ninclude \"../../Common/Logic/Option.i.dfy\"\r\n\r\nmodule SHT__CMessage_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened SHT__Message_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened SHT__Network_i\r\nimport opened Impl_Parameters_i\r\nimport opened Logic__Option_i\r\nimport opened AppInterface_i`Spec\r\nimport opened SHT__HT_s\r\nimport opened SHT__SingleMessage_i\r\nimport opened SHT__Keys_i\r\nimport opened GenericRefinement_i\r\n\r\n// For now, we use the same keys and values the app's spec does\r\n// Someday, we may want to introduce a split between the app's\r\n// high-level view of keys and values, and its low-level implementation\r\n\r\ndatatype CMessage =\r\n CGetRequest(k_getrequest:Key)\r\n | CSetRequest(k_setrequest:Key, v_setrequest:OptionalValue)\r\n | CReply(k_reply:Key, v:OptionalValue)\r\n | CRedirect(k_redirect:Key, id:EndPoint)\r\n | CShard(kr:KeyRange, recipient:EndPoint)\r\n | CDelegate(range:KeyRange, h:Hashtable)\r\n\r\ndatatype CSingleMessage = CSingleMessage(seqno:uint64, dst:EndPoint, m:CMessage) \r\n | CAck(ack_seqno:uint64) // I got everything up to and including seqno\r\n | CInvalidMessage()\r\n\r\ntype CPMsg = CSingleMessage\r\ndatatype CPacket = CPacket(dst:EndPoint, src:EndPoint, msg:CPMsg)\r\n\r\npredicate CMessageIsAbstractable(cmsg:CMessage)\r\n{\r\n (cmsg.CRedirect? ==> EndPointIsAbstractable(cmsg.id))\r\n && (cmsg.CShard? ==> EndPointIsAbstractable(cmsg.recipient))\r\n}\r\n\r\nfunction AbstractifyCMessageToRslMessage(cmsg:CMessage) : Message\r\n requires CMessageIsAbstractable(cmsg);\r\n{\r\n match cmsg\r\n case CGetRequest(k) => GetRequest(k)\r\n case CSetRequest(k, v) => SetRequest(k, v)\r\n case CReply(k, v) => Reply(k, v)\r\n case CRedirect(k, id) => Redirect(k, AbstractifyEndPointToNodeIdentity(id))\r\n case CShard(kr, recipient) => Shard(kr, AbstractifyEndPointToNodeIdentity(recipient))\r\n case CDelegate(range, h) => Delegate(range, h)\r\n}\r\n\r\npredicate CSingleMessageIsAbstractable(smsg:CSingleMessage)\r\n{\r\n match smsg\r\n case CSingleMessage(seqno, dst, m) => EndPointIsAbstractable(dst) && CMessageIsAbstractable(m)\r\n case CAck(_) => true\r\n case CInvalidMessage => true\r\n}\r\n\r\nfunction AbstractifyCSingleMessageToSingleMessage(smsg:CSingleMessage) : SingleMessage\r\n requires CSingleMessageIsAbstractable(smsg);\r\n{\r\n match smsg\r\n case CSingleMessage(seqno, dst, m) => \r\n SingleMessage(seqno as int, AbstractifyEndPointToNodeIdentity(dst), AbstractifyCMessageToRslMessage(m))\r\n case CAck(seqno) => Ack(seqno as int)\r\n case CInvalidMessage => InvalidMessage()\r\n}\r\n\r\npredicate CSingleMessageIsValid(smsg:CSingleMessage, params:CParameters)\r\n{\r\n match smsg\r\n case CSingleMessage(seqno, _, _) => seqno < params.max_seqno\r\n case CAck(seqno) => seqno < params.max_seqno\r\n case CInvalidMessage => false\r\n}\r\n\r\npredicate CSingleMessageSeqIsAbstractable(cs:seq) \r\n{\r\n forall i :: 0 <= i < |cs| ==> CSingleMessageIsAbstractable(cs[i])\r\n}\r\n\r\nfunction AbstractifySeqOfCSingleMessageToSeqOfSingleMessage(cs:seq) : seq>\r\n requires CSingleMessageSeqIsAbstractable(cs); \r\n{\r\n MapSeqToSeq(cs, AbstractifyCSingleMessageToSingleMessage)\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\npredicate CPacketIsAbstractable(cpacket:CPacket)\r\n{\r\n EndPointIsAbstractable(cpacket.dst)\r\n && EndPointIsAbstractable(cpacket.src)\r\n && CSingleMessageIsAbstractable(cpacket.msg)\r\n}\r\n\r\nfunction AbstractifyCPacketToShtPacket(cpacket:CPacket) : Packet\r\n requires CPacketIsAbstractable(cpacket);\r\n{\r\n Packet(AbstractifyEndPointToNodeIdentity(cpacket.dst),\r\n AbstractifyEndPointToNodeIdentity(cpacket.src),\r\n AbstractifyCSingleMessageToSingleMessage(cpacket.msg))\r\n}\r\n\r\npredicate CPacketsIsAbstractable(cps:set)\r\n{\r\n forall p :: p in cps ==> CPacketIsAbstractable(p)\r\n}\r\n\r\nfunction {:opaque} AbstractifyCPacketsToPackets(cps:set) : set\r\n requires CPacketsIsAbstractable(cps);\r\n ensures forall p :: p in cps ==> AbstractifyCPacketToShtPacket(p) in AbstractifyCPacketsToPackets(cps);\r\n{\r\n set p | p in cps :: AbstractifyCPacketToShtPacket(p)\r\n}\r\n\r\npredicate CPacketSeqIsAbstractable(cps:seq)\r\n{\r\n forall p :: p in cps ==> CPacketIsAbstractable(p)\r\n}\r\n\r\nfunction {:opaque} AbstractifySeqOfCPacketsToSetOfShtPackets(cps:seq) : set\r\n requires CPacketSeqIsAbstractable(cps);\r\n ensures forall p :: p in cps ==> AbstractifyCPacketToShtPacket(p) in AbstractifySeqOfCPacketsToSetOfShtPackets(cps);\r\n{\r\n set p | p in cps :: AbstractifyCPacketToShtPacket(p)\r\n}\r\n\r\npredicate OptionCPacketIsAbstractable(cp:Option)\r\n{\r\n match cp {\r\n case Some(p) => CPacketIsAbstractable(p)\r\n case None => true\r\n }\r\n}\r\n\r\nfunction AbstractifyOptionCPacketToOptionShtPacket(cp:Option) : Option\r\n requires OptionCPacketIsAbstractable(cp);\r\n{\r\n match cp {\r\n case Some(p) => Some(AbstractifyCPacketToShtPacket(p))\r\n case None => None()\r\n }\r\n}\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/SHT/ConstantsState.i.dfy", "content": "include \"../../Protocol/SHT/Host.i.dfy\"\r\ninclude \"../Common/NodeIdentity.i.dfy\"\r\ninclude \"Parameters.i.dfy\"\r\n\r\nmodule SHT__ConstantsState_i {\r\nimport opened Common__SeqIsUniqueDef_i\r\nimport opened Native__Io_s\r\nimport opened SHT__Host_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Impl_Parameters_i\r\n\r\ndatatype ConstantsState = ConstantsState(\r\n rootIdentity:EndPoint,\r\n hostIds:seq,\r\n params:CParameters)\r\n\r\npredicate ConstantsStateIsAbstractable(constants:ConstantsState) {\r\n EndPointIsAbstractable(constants.rootIdentity)\r\n && SeqOfEndPointsIsAbstractable(constants.hostIds)\r\n}\r\n\r\nfunction AbstractifyToConstants(constants:ConstantsState) : Constants\r\n requires ConstantsStateIsAbstractable(constants);\r\n{\r\n Constants(AbstractifyEndPointToNodeIdentity(constants.rootIdentity), AbstractifyEndPointsToNodeIdentities(constants.hostIds), AbstractifyCParametersToParameters(constants.params))\r\n}\r\n\r\npredicate ConstantsStateIsValid(constants:ConstantsState) {\r\n ConstantsStateIsAbstractable(constants)\r\n && CParametersIsValid(constants.params)\r\n && SeqIsUnique(constants.hostIds)\r\n && ValidPhysicalAddress(constants.rootIdentity)\r\n}\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/SHT/DelegationLookup.i.dfy", "content": "include \"Delegations.i.dfy\"\r\n\r\nmodule DelegationLookup_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened Impl__Delegations_i\r\nimport opened SHT__Keys_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened AppInterface_i`Spec\r\nimport opened SHT__Delegations_i\r\n\r\nfunction min(x:int, y:int) : int { if x < y then x else y }\r\n\r\npredicate InBounds(i:int, low:int, high:int, len:int)\r\n{\r\n low <= i < min(high, len)\r\n}\r\n\r\nlemma lemma_CDM_NoLowsAreInfinite(m:CDelegationMap)\r\n requires CDelegationMapIsValid(m);\r\n ensures forall i :: 0 <= i < |m.lows| ==> !m.lows[i].klo.KeyInf?;\r\n{\r\n forall i | 0 <= i < |m.lows|\r\n ensures !m.lows[i].klo.KeyInf?;\r\n {\r\n if m.lows[i].klo.KeyInf? {\r\n CDelegationMapIsSortedExtension(m);\r\n var last := |m.lows| - 1;\r\n if i == last {\r\n assert KeyPlusLt(m.lows[i].klo, KeyInf());\r\n } else {\r\n assert KeyPlusLt(m.lows[i].klo, m.lows[last].klo);\r\n KeyPlusTransitivity(m.lows[i].klo, m.lows[last].klo, KeyInf());\r\n }\r\n KeyPlusAntisymmetry(m.lows[i].klo, KeyInf());\r\n assert false;\r\n }\r\n }\r\n}\r\n\r\nlemma CDM_IndexForKey_Ordering_specific(m:CDelegationMap, k1:KeyPlus, k2:KeyPlus)\r\n requires CDelegationMapIsValid(m);\r\n requires KeyPlusLe(k1, k2);\r\n ensures CDM_IndexForKey(m, k1) <= CDM_IndexForKey(m, k2);\r\n{\r\n CDM_IndexForKey_Ordering(m);\r\n}\r\n\r\n\r\nmethod DelegateForKeyRangeIsHostImpl(m:CDelegationMap, kr:KeyRange, id:EndPoint) returns (b:bool)\r\n requires CDelegationMapIsValid(m);\r\n requires EndPointIsAbstractable(id);\r\n ensures b == DelegateForKeyRangeIsHost(AbstractifyCDelegationMapToDelegationMap(m), kr, AbstractifyEndPointToNodeIdentity(id));\r\n{\r\n if EmptyKeyRange(kr) {\r\n b := true;\r\n forall k | KeyRangeContains(kr, KeyPlus(k))\r\n ensures false;\r\n {\r\n assert KeyPlusLe(kr.klo, KeyPlus(k));\r\n assert KeyPlusLt(KeyPlus(k), kr.khi);\r\n assert KeyPlusLe(kr.khi, kr.klo);\r\n KeyPlusTransitivity(kr.klo, KeyPlus(k), kr.khi);\r\n assert KeyPlusLt(kr.klo, kr.khi);\r\n KeyPlusAntisymmetry(kr.klo, kr.khi);\r\n }\r\n return;\r\n } \r\n\r\n var k_min := KeyMin();\r\n if kr.klo.KeyZero? && kr.khi == KeyPlus(k_min) {\r\n forall k | KeyRangeContains(kr, KeyPlus(k))\r\n ensures false;\r\n {\r\n assert KeyPlusLe(kr.khi, KeyPlus(k));\r\n KeyPlusAntisymmetry(kr.khi, KeyPlus(k));\r\n }\r\n return true;\r\n }\r\n\r\n var m' := CDM_Defragment(m);\r\n\r\n var lo_index := CDM_IndexForKey(m', kr.klo);\r\n var hi_index := CDM_IndexForKey(m', kr.khi);\r\n\r\n forall () ensures lo_index <= hi_index;\r\n {\r\n KeyPlusAntisymmetry(kr.klo, kr.khi);\r\n CDM_IndexForKey_Ordering_specific(m', kr.klo, kr.khi);\r\n }\r\n\r\n var index := lo_index;\r\n ghost var witness_key := kr.klo;\r\n assert KeyPlusLe(kr.klo, witness_key);\r\n KeyPlusAntisymmetry(kr.klo, kr.khi); // ==>\r\n assert KeyPlusLt(witness_key, kr.khi);\r\n while index <= hi_index \r\n invariant lo_index <= index <= hi_index + 1;\r\n invariant forall i {:trigger InBounds(i, lo_index as int, index as int, |m'.lows|)} :: \r\n InBounds(i, lo_index as int, index as int, |m'.lows|) ==> m'.lows[i].id == id;\r\n invariant !witness_key.KeyInf?;\r\n invariant KeyRangeContains(kr, witness_key);\r\n invariant index <= hi_index ==> CDM_IndexForKey(m', witness_key) == index;\r\n {\r\n if m'.lows[index].id != id {\r\n b := false;\r\n\r\n forall () ensures AbstractifyEndPointToNodeIdentity(m'.lows[index].id) != AbstractifyEndPointToNodeIdentity(id) \r\n {\r\n if AbstractifyEndPointToNodeIdentity(m'.lows[index].id) == AbstractifyEndPointToNodeIdentity(id) {\r\n lemma_AbstractifyEndPointToNodeIdentity_injective(m'.lows[index].id, id);\r\n assert false;\r\n }\r\n }\r\n if !witness_key.KeyZero? {\r\n assert !DelegateForKeyRangeIsHost(AbstractifyCDelegationMapToDelegationMap(m'), kr, AbstractifyEndPointToNodeIdentity(id));\r\n } else {\r\n assert kr.klo.KeyZero?;\r\n assert !kr.khi.KeyZero? && kr.khi != KeyPlus(k_min);\r\n forall () ensures index == 0;\r\n {\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m', 0), witness_key);\r\n CDM_Partitioned(m', witness_key, 0);\r\n if index != 0 {\r\n assert CDM_IndexForKey(m', witness_key) != 0;\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m', index as int), witness_key);\r\n assert false;\r\n }\r\n assert index == 0; // Because witness_key is 0, it can only be contained from below by the 0th mapping\r\n }\r\n if |m'.lows| == 1 {\r\n assert KeyRangeContains(kr, KeyPlus(k_min));\r\n assert AbstractifyCDelegationMapToDelegationMap(m')[k_min] != AbstractifyEndPointToNodeIdentity(id);\r\n } else {\r\n assert m'.lows[1].klo != KeyPlus(k_min);\r\n assert KeyPlusLt(KeyPlus(k_min), m'.lows[1].klo);\r\n assert KeyRangeContains(kr, KeyPlus(k_min));\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m', 0), KeyPlus(k_min));\r\n calc ==> {\r\n true;\r\n { CDM_Partitioned(m', KeyPlus(k_min), 0); }\r\n CDM_IndexForKey(m', KeyPlus(k_min)) == 0; \r\n }\r\n assert AbstractifyCDelegationMapToDelegationMap(m')[k_min] != AbstractifyEndPointToNodeIdentity(id);\r\n }\r\n assert b == DelegateForKeyRangeIsHost(AbstractifyCDelegationMapToDelegationMap(m'), kr, AbstractifyEndPointToNodeIdentity(id));\r\n }\r\n return;\r\n }\r\n ghost var old_index := index;\r\n index := index + 1;\r\n if index <= hi_index {\r\n ghost var old_witness := witness_key;\r\n witness_key := m'.lows[index].klo;\r\n lemma_CDM_NoLowsAreInfinite(m');\r\n //CDM_IndexForKey_Ordering_specific(m');\r\n\r\n assert KeyPlusLe(kr.klo, old_witness);\r\n assert CDM_IndexForKey(m', old_witness) == old_index;\r\n assert KeyPlusLt(old_witness, m'.lows[old_index + 1].klo);\r\n assert KeyPlusLe(m'.lows[old_index+1].klo, witness_key);\r\n KeyPlusTransitivity(kr.klo, old_witness, m'.lows[old_index + 1].klo);\r\n KeyPlusTransitivity(kr.klo, m'.lows[old_index + 1].klo, witness_key);\r\n assert KeyPlusLe(kr.klo, witness_key);\r\n\r\n if index < hi_index {\r\n assert KeyPlusLt(witness_key, CDM_IndexToKeyRange(m', index as int).khi);\r\n CDM_KeyRangesAreOrdered(m', index as int, hi_index as int);\r\n KeyPlusTransitivity(witness_key, CDM_IndexToKeyRange(m', index as int).khi, m'.lows[hi_index].klo);\r\n assert KeyPlusLt(witness_key, m'.lows[hi_index].klo);\r\n assert KeyPlusLe(m'.lows[hi_index].klo, kr.khi);\r\n KeyPlusTransitivity(witness_key, m'.lows[hi_index].klo, kr.khi);\r\n assert KeyPlusLt(witness_key, kr.khi);\r\n assert KeyRangeContains(kr, witness_key);\r\n } else {\r\n if kr.khi != m'.lows[index].klo {\r\n assert KeyRangeContains(kr, witness_key);\r\n } else {\r\n forall k | KeyRangeContains(kr, KeyPlus(k))\r\n ensures AbstractifyCDelegationMapToDelegationMap(m')[k] == AbstractifyEndPointToNodeIdentity(id);\r\n {\r\n assert KeyPlusLe(kr.klo, KeyPlus(k));\r\n assert KeyPlusLt(KeyPlus(k), kr.khi);\r\n assert KeyPlusLe(KeyPlus(k), kr.khi);\r\n ghost var k_index := CDM_IndexForKey(m', KeyPlus(k));\r\n CDM_IndexForKey_Ordering_specific(m', kr.klo, KeyPlus(k));\r\n CDM_IndexForKey_Ordering_specific(m', KeyPlus(k), kr.khi);\r\n assert lo_index as int <= k_index as int <= hi_index as int < |m'.lows|;\r\n if k_index == hi_index {\r\n assert KeyPlusLe(kr.khi, KeyPlus(k));\r\n KeyPlusAntisymmetry(kr.khi, KeyPlus(k));\r\n assert false;\r\n }\r\n assert InBounds(k_index as int, lo_index as int, hi_index as int, |m'.lows|);\r\n if k_index < old_index {\r\n assert InBounds(k_index as int, lo_index as int, old_index as int, |m'.lows|);\r\n assert m'.lows[k_index].id == id;\r\n } else {\r\n assert m'.lows[k_index].id == id;\r\n }\r\n }\r\n\r\n return true;\r\n }\r\n }\r\n\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m', index as int), witness_key);\r\n CDM_Partitioned(m', witness_key, index as int);\r\n assert CDM_IndexForKey(m', witness_key) == index;\r\n }\r\n forall i {:trigger InBounds(i, lo_index as int, index as int, |m'.lows|)} | \r\n InBounds(i, lo_index as int, index as int, |m'.lows|)\r\n ensures m'.lows[i].id == id;\r\n {\r\n if i < old_index as int {\r\n assert InBounds(i, lo_index as int, old_index as int, |m'.lows|) ==> m'.lows[i].id == id;\r\n } else {\r\n }\r\n }\r\n\r\n }\r\n\r\n forall k | KeyRangeContains(kr, KeyPlus(k))\r\n ensures AbstractifyCDelegationMapToDelegationMap(m')[k] == AbstractifyEndPointToNodeIdentity(id);\r\n {\r\n assert KeyPlusLe(kr.klo, KeyPlus(k));\r\n assert KeyPlusLt(KeyPlus(k), kr.khi);\r\n assert KeyPlusLe(KeyPlus(k), kr.khi);\r\n ghost var k_index := CDM_IndexForKey(m', KeyPlus(k));\r\n CDM_IndexForKey_Ordering_specific(m', kr.klo, KeyPlus(k));\r\n CDM_IndexForKey_Ordering_specific(m', KeyPlus(k), kr.khi);\r\n assert lo_index as int <= k_index as int <= hi_index as int < |m'.lows|;\r\n assert InBounds(k_index as int, lo_index as int, index as int, |m'.lows|);\r\n assert m'.lows[k_index].id == id;\r\n }\r\n\r\n b := true;\r\n return;\r\n}\r\n\r\nlemma lemma_CDM_Defragment_equivalence(m:CDelegationMap, m':CDelegationMap)\r\n requires CDelegationMapIsValid(m);\r\n requires CDelegationMapIsValid(m');\r\n requires forall k:Key :: true ==> m.lows[CDM_IndexForKey(m,KeyPlus(k))].id == m'.lows[CDM_IndexForKey(m',KeyPlus(k))].id;\r\n ensures AbstractifyCDelegationMapToDelegationMap(m) == AbstractifyCDelegationMapToDelegationMap(m');\r\n{\r\n}\r\n\r\n// TODO: Call this from update, not lookup (and add the last ensures to IsValid)\r\n// TODO: Defragment more aggressively\r\nmethod CDM_Defragment(m:CDelegationMap) returns (m':CDelegationMap)\r\n requires CDelegationMapIsValid(m);\r\n ensures CDelegationMapIsValid(m');\r\n ensures AbstractifyCDelegationMapToDelegationMap(m) == AbstractifyCDelegationMapToDelegationMap(m');\r\n ensures |m'.lows| >= 2 && m'.lows[1].klo.KeyPlus? ==> m'.lows[1].klo.k != KeyMin();\r\n{\r\n if |m.lows| as uint64 < 2 || m.lows[1].klo != KeyPlus(KeyMin()) {\r\n return m;\r\n }\r\n\r\n if |m.lows| >= 3 {\r\n CDelegationMapIsSortedExtension_recursive(m, 1, 2);\r\n KeyPlusAntisymmetry(m.lows[1].klo, m.lows[2].klo);\r\n assert m.lows[2].klo != KeyPlus(KeyMin());\r\n }\r\n\r\n var new_lows := [Mapping(KeyZero(), m.lows[1].id)] + m.lows[2..];\r\n m' := CDelegationMap(new_lows);\r\n\r\n // Prove the third ensures\r\n lemma_CDM_NoLowsAreInfinite(m);\r\n\r\n // Prove sorted to prove IsValid\r\n assert CDelegationMapBoundedSize(m');\r\n forall i | 0 <= i < |m'.lows| - 1\r\n ensures KeyPlusLt(m'.lows[i].klo, m'.lows[i+1].klo);\r\n {\r\n if i == 0 {\r\n assert KeyPlusLt(m.lows[0].klo, m.lows[1].klo);\r\n } else {\r\n assert m'.lows[i] == m.lows[2..][i-1] == m.lows[1+i];\r\n assert m'.lows[i+1] == m.lows[2..][i] == m.lows[2+i];\r\n CDelegationMapIsSortedExtension_recursive(m, 1+i, 2+i);\r\n assert KeyPlusLt(m.lows[1+i].klo, m.lows[2+i].klo);\r\n }\r\n }\r\n assert KeyPlusLt(m'.lows[|m'.lows|-1].klo, KeyInf());\r\n assert CDelegationMapIsSorted(m');\r\n \r\n // Prove equivalent refinements\r\n forall k:Key \r\n ensures m.lows[CDM_IndexForKey(m,KeyPlus(k))].id == m'.lows[CDM_IndexForKey(m',KeyPlus(k))].id;\r\n {\r\n ghost var kp := KeyPlus(k);\r\n ghost var k_index := CDM_IndexForKey(m, kp) as int;\r\n ghost var k_index' := CDM_IndexForKey(m', kp) as int;\r\n if KeyRangeContains(CDM_IndexToKeyRange(m, 0), kp) {\r\n assert KeyPlusLt(kp, m.lows[1].klo);\r\n assert KeyPlusLt(kp, KeyPlus(KeyMin()));\r\n KeyPlusAntisymmetry(kp, KeyPlus(KeyMin()));\r\n assert false;\r\n }\r\n assert k_index >= 1;\r\n \r\n if k_index' == 0 {\r\n if k_index == 1 {\r\n assert m'.lows[0].id == m.lows[1].id;\r\n } else {\r\n assert KeyPlusLt(kp, m'.lows[1].klo);\r\n assert KeyPlusLt(kp, m.lows[2].klo);\r\n if 2 < k_index {\r\n CDelegationMapIsSortedExtension_recursive(m, 2, k_index);\r\n }\r\n assert KeyPlusLe(m.lows[2].klo, m.lows[k_index].klo);\r\n KeyPlusTransitivity(kp, m.lows[2].klo, m.lows[k_index].klo); // ==> kp < m.lows[k_index]\r\n // But we also know:\r\n assert KeyPlusLe(m.lows[k_index].klo, kp);\r\n KeyPlusAntisymmetry(m.lows[k_index].klo, kp); // Contradiction!\r\n assert false;\r\n }\r\n } else {\r\n if k_index == k_index' + 1 {\r\n assert m'.lows[k_index'] == m.lows[k_index];\r\n } else {\r\n assert m'.lows[k_index'] == m.lows[k_index' + 1];\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m, k_index), kp);\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m, k_index' + 1), kp);\r\n CDM_Partitioned(m, kp, k_index);\r\n assert false;\r\n }\r\n } \r\n }\r\n lemma_CDM_Defragment_equivalence(m, m');\r\n}\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/SHT/Delegations.i.dfy", "content": "include \"../../Protocol/SHT/Delegations.i.dfy\"\r\ninclude \"../Common/NodeIdentity.i.dfy\"\r\n\r\nmodule Impl__Delegations_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened SHT__Delegations_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened AppInterface_i`Spec\r\nimport opened Concrete_NodeIdentity_i`Spec\r\nimport opened SHT__Keys_i\r\nimport opened Common__NetClient_i\r\n\r\n// To enable efficient lookups of which host owns a given key, \r\n// we maintain a list of mappings. Each mapping indicates that \r\n// its host owns all of the keys from the mapping's klo up until\r\n// the next mapping's klo (or KeyInf, if it's the last in the sequence)\r\n\r\n// TODO: change the name of the second field from \"id\" to \"ep\"\r\ndatatype Mapping = Mapping(klo:KeyPlus, id:EndPoint)\r\ndatatype CDelegationMap = CDelegationMap(lows:seq)\r\n\r\npredicate CDelegationMapBoundedSize(m:CDelegationMap)\r\n{\r\n 0 < |m.lows| < 0x1_0000_0000_0000_0000 - 1\r\n}\r\n\r\npredicate CDelegationMapIsSorted_Helper(m:CDelegationMap)\r\n requires CDelegationMapBoundedSize(m)\r\n{\r\n forall i {:trigger KeyPlusLt(m.lows[i].klo, m.lows[i+1].klo)} :: 0<=i<|m.lows|-1\r\n ==> KeyPlusLt(m.lows[i].klo, m.lows[i+1].klo)\r\n}\r\n\r\npredicate CDelegationMapIsSorted(m:CDelegationMap)\r\n{\r\n CDelegationMapBoundedSize(m)\r\n && CDelegationMapIsSorted_Helper(m)\r\n && KeyPlusLt(m.lows[|m.lows|-1].klo, KeyInf())\r\n}\r\n\r\nlemma CDelegationMapIsSortedExtension_recursive(m:CDelegationMap, i:int, j:int)\r\n requires 0<=i KeyPlusLt(m.lows[i].klo, m.lows[j].klo);\r\n{\r\n forall i,j | 0<=i)\r\n{\r\n forall m :: m in lows ==> EndPointIsValidPublicKey(m.id)\r\n}\r\n\r\npredicate CDelegationMapIsValid(m:CDelegationMap)\r\n{\r\n CDelegationMapHasValidEndPoints(m.lows)\r\n && CDelegationMapIsComplete(m)\r\n}\r\n\r\nfunction CDM_IndexToNextKeyBoundary(m:CDelegationMap, i:int) : KeyPlus\r\n requires 0 <= i < |m.lows|;\r\n{\r\n if i < |m.lows| - 1 then m.lows[i+1].klo else KeyInf()\r\n}\r\n\r\n// Key range from the i-th to the j-th key boundary\r\nfunction CDM_IndexRangeToKeyRange(m:CDelegationMap, i:int, j:int) : KeyRange\r\n requires 0<=i<=j<|m.lows|;\r\n{\r\n KeyRange(m.lows[i].klo, CDM_IndexToNextKeyBoundary(m, j))\r\n}\r\n\r\n// Key range from i-th key boundary to the next key boundary\r\nfunction CDM_IndexToKeyRange(m:CDelegationMap, idx:int) : KeyRange\r\n requires 0<=idx<|m.lows|;\r\n{\r\n CDM_IndexRangeToKeyRange(m, idx, idx)\r\n}\r\n\r\nfunction KeyRangesFromCDelegationMap(m:CDelegationMap) : set\r\n{\r\n set i | 0<=i<|m.lows| :: CDM_IndexToKeyRange(m, i)\r\n}\r\n\r\nfunction method {:opaque} CDM_IndexForKey_helper(m:CDelegationMap, k:KeyPlus, index:uint64) : uint64\r\n requires CDelegationMapIsAbstractable(m);\r\n requires forall i :: 0 <= i <= index as int && i < |m.lows| ==> KeyPlusLe(m.lows[i].klo, k);\r\n decreases |m.lows| - index as int;\r\n ensures 0 <= CDM_IndexForKey_helper(m, k, index) as int < |m.lows|;\r\n ensures !k.KeyInf? ==> KeyRangeContains(CDM_IndexToKeyRange(m, CDM_IndexForKey_helper(m, k, index) as int), k);\r\n ensures k.KeyInf? ==> CDM_IndexForKey_helper(m, k, index) as int == |m.lows| - 1;\r\n{\r\n CDelegationMapIsSortedExtension(m);\r\n if index >= (|m.lows| as uint64 - 1) as uint64 then\r\n (|m.lows| as uint64 - 1) as uint64\r\n else if KeyPlusLt(k, m.lows[index + 1].klo) then\r\n index\r\n else\r\n KeyPlusAntisymmetry(k, m.lows[index+1].klo);\r\n CDM_IndexForKey_helper(m, k, index + 1)\r\n}\r\n\r\nlemma CDM_Partitioned(m:CDelegationMap, k:KeyPlus, index:int) \r\n requires CDelegationMapIsValid(m);\r\n requires 0 <= index < |m.lows|;\r\n requires KeyRangeContains(CDM_IndexToKeyRange(m, index), k);\r\n ensures forall i :: 0 <= i < |m.lows| && i != index ==> !KeyRangeContains(CDM_IndexToKeyRange(m, i), k);\r\n{\r\n CDelegationMapIsSortedExtension(m);\r\n var real_kr := CDM_IndexToKeyRange(m, index);\r\n\r\n forall i | 0 <= i < |m.lows| && i != index\r\n ensures !KeyRangeContains(CDM_IndexToKeyRange(m, i), k);\r\n {\r\n if KeyRangeContains(CDM_IndexToKeyRange(m, i), k) { // Proof by contradiction\r\n var kr := CDM_IndexToKeyRange(m, i);\r\n if i < index {\r\n assert KeyPlusLt(k, kr.khi);\r\n CDM_KeyRangesAreOrdered(m, i, index);\r\n assert KeyPlusLe(kr.khi, real_kr.klo); \r\n KeyPlusTransitivity(k, kr.khi, real_kr.klo);\r\n KeyPlusAntisymmetry(k, real_kr.klo);\r\n assert false;\r\n } else {\r\n assert KeyPlusLe(kr.klo, k);\r\n assert KeyPlusLt(k, real_kr.khi);\r\n CDM_KeyRangesAreOrdered(m, index, i);\r\n assert KeyPlusLe(real_kr.khi, kr.klo);\r\n KeyPlusTransitivity(real_kr.khi, kr.klo, k);\r\n KeyPlusAntisymmetry(real_kr.khi, k);\r\n assert false;\r\n }\r\n }\r\n }\r\n\r\n}\r\n\r\nfunction method CDM_IndexForKey(m:CDelegationMap, k:KeyPlus) : uint64\r\n requires 0<|m.lows|;\r\n requires CDelegationMapIsAbstractable(m)\r\n ensures 0 <= CDM_IndexForKey(m, k) as int < |m.lows|;\r\n ensures !k.KeyInf? ==> KeyRangeContains(CDM_IndexToKeyRange(m, CDM_IndexForKey(m, k) as int), k);\r\n ensures k.KeyInf? ==> CDM_IndexForKey(m, k) as int == |m.lows| - 1;\r\n{\r\n //IndexForKeyAccurate(m, k, 0); \r\n CDM_IndexForKey_helper(m, k, 0)\r\n}\r\n\r\n// Explicitly naming this :| so Dafny will cooperate:\r\nfunction CDM_IndexForKeyRange(m:CDelegationMap, kr:KeyRange) : uint64 \r\n requires CDelegationMapIsAbstractable(m);\r\n requires kr in KeyRangesFromCDelegationMap(m);\r\n ensures 0 <= CDM_IndexForKeyRange(m, kr) as int < |m.lows|;\r\n{\r\n var idx :| 0<=idx<|m.lows| && kr==CDM_IndexToKeyRange(m,idx); idx as uint64\r\n}\r\n\r\npredicate CDelegationMapIsAbstractable(m:CDelegationMap)\r\n{\r\n && (forall low :: low in m.lows ==> EndPointIsAbstractable(low.id))\r\n && CDelegationMapIsComplete(m)\r\n}\r\n\r\nfunction RefineToDelegationMapEntry(m:CDelegationMap, k:Key) : NodeIdentity\r\n requires CDelegationMapIsAbstractable(m);\r\n requires forall low :: low in m.lows ==> EndPointIsAbstractable(low.id);\r\n{\r\n AbstractifyEndPointToNodeIdentity(m.lows[CDM_IndexForKey(m,KeyPlus(k))].id)\r\n}\r\n\r\nfunction AbstractifyCDelegationMapToDelegationMap(m:CDelegationMap) : DelegationMap\r\n requires CDelegationMapIsAbstractable(m);\r\n requires forall low :: low in m.lows ==> EndPointIsAbstractable(low.id);\r\n{\r\n imap k:Key {:trigger CDM_IndexForKey(m,KeyPlus(k))} :: RefineToDelegationMapEntry(m, k)\r\n}\r\n\r\nlemma CDM_KeyRangesAreOrdered(m:CDelegationMap, i1:int, i2:int)\r\n requires CDelegationMapIsSorted(m);\r\n requires 0<=i1 i1==i2;\r\n{\r\n forall i1,i2 |\r\n 0<=i1<|m.lows| && CDM_IndexToKeyRange(m, i1)==kr\r\n && 0<=i2<|m.lows| && CDM_IndexToKeyRange(m, i2)==kr\r\n ensures i1==i2;\r\n {\r\n if (i1 KeyPlusLt(sm.lows[i].klo, sm.lows[i+1].klo);\r\n assert sm.lows == m.lows[lo..hi];\r\n assert KeyPlusLt(m.lows[|m.lows|-1].klo, KeyInf());\r\n assert sm.lows[|sm.lows|-1] == m.lows[hi-1];\r\n assert CDelegationMapIsSorted(m);\r\n \r\n if (hi-1 == |m.lows|-1) { \r\n assert KeyPlusLe(m.lows[hi-1].klo, m.lows[|m.lows|-1].klo);\r\n } else if (hi-1 < |m.lows|-1) {\r\n var j := hi;\r\n var l := hi-1;\r\n assert KeyPlusLe(m.lows[l].klo, m.lows[l+1].klo);\r\n while (j < |m.lows|-1)\r\n invariant hi <= j <= |m.lows| - 1;\r\n invariant forall k :: l <= k <= j ==> KeyPlusLe(m.lows[l].klo, m.lows[k].klo);\r\n {\r\n var k' := j-1;\r\n assert KeyPlusLe(m.lows[l].klo, m.lows[k'].klo);\r\n assert KeyPlusLe(m.lows[k'].klo, m.lows[k'+1].klo);\r\n assert KeyPlusLe(m.lows[j].klo, m.lows[j+1].klo);\r\n j := j+ 1;\r\n }\r\n \r\n } else {\r\n assert false;\r\n }\r\n assert KeyPlusLe(m.lows[hi-1].klo, m.lows[|m.lows|-1].klo);\r\n assert KeyPlusLe(sm.lows[|sm.lows|-1].klo, m.lows[|m.lows|-1].klo);\r\n assert KeyPlusLt(sm.lows[|sm.lows|-1].klo, KeyInf());\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\nfunction CDelegationMapDelegate(m:CDelegationMap, k:Key) : NodeIdentity\r\n requires CDelegationMapIsAbstractable(m);\r\n{\r\n AbstractifyCDelegationMapToDelegationMap(m)[k]\r\n}\r\n\r\npredicate CDM_PrefixAgrees(m:CDelegationMap, dm:DelegationMap, klim:KeyPlus)\r\n requires CDelegationMapIsAbstractable(m);\r\n requires DelegationMapComplete(dm);\r\n{\r\n forall k:Key :: KeyPlusLt(KeyPlus(k), klim) ==> CDelegationMapDelegate(m,k)==dm[k]\r\n}\r\n\r\n\r\nlemma CDM_IndexForKey_Ordering(m:CDelegationMap)\r\n requires CDelegationMapIsValid(m);\r\n ensures forall k1, k2 :: KeyPlusLe(k1, k2) ==> CDM_IndexForKey(m, k1) <= CDM_IndexForKey(m, k2);\r\n{\r\n forall k1, k2 | KeyPlusLe(k1, k2) \r\n ensures CDM_IndexForKey(m, k1) <= CDM_IndexForKey(m, k2);\r\n {\r\n var index1 := CDM_IndexForKey(m, k1) as int;\r\n var index2 := CDM_IndexForKey(m, k2) as int;\r\n CDelegationMapIsSortedExtension(m);\r\n KeyPlusAntisymmetry(k1, k2);\r\n\r\n if k1.KeyInf? {\r\n assert k2.KeyInf?;\r\n assert index1 == |m.lows|-1 == index2;\r\n } else if k2.KeyInf? {\r\n assert index2 == |m.lows|-1;\r\n assert index1 <= |m.lows|-1;\r\n } else {\r\n if index2 < index1 { // Suppose...\r\n var kr1 := CDM_IndexToKeyRange(m, index1);\r\n var kr2 := CDM_IndexToKeyRange(m, index2);\r\n\r\n assert KeyPlusLt(kr2.klo, kr1.klo);\r\n\r\n assert KeyPlusLe(kr1.klo, k1);\r\n assert KeyPlusLt(k1, kr1.khi);\r\n \r\n assert KeyPlusLe(kr2.klo, k2);\r\n assert KeyPlusLt(k2, kr2.khi);\r\n\r\n assert KeyPlusLe(kr2.khi, kr1.klo);\r\n\r\n KeyPlusTransitivity(k2, kr2.khi, kr1.klo);\r\n assert KeyPlusLe(k2, kr1.klo);\r\n KeyPlusTransitivity(k2, kr1.klo, k1);\r\n assert KeyPlusLe(k2, k1);\r\n\r\n assert false;\r\n }\r\n assert index1 <= index2;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_UpdateCDelegationMap_Part2_Helper(m:CDelegationMap, m':CDelegationMap, newkr:KeyRange, id:EndPoint)\r\n requires CDelegationMapIsValid(m);\r\n requires CDelegationMapIsValid(m');\r\n requires EndPointIsValidPublicKey(id);\r\n requires !EmptyKeyRange(newkr);\r\n requires forall k:Key :: k in AbstractifyCDelegationMapToDelegationMap(m') <==> k in UpdateDelegationMap(AbstractifyCDelegationMapToDelegationMap(m), newkr, AbstractifyEndPointToNodeIdentity(id));\r\n requires forall k:Key :: true ==> AbstractifyCDelegationMapToDelegationMap(m')[k] == UpdateDelegationMap(AbstractifyCDelegationMapToDelegationMap(m), newkr, AbstractifyEndPointToNodeIdentity(id))[k];\r\n ensures AbstractifyCDelegationMapToDelegationMap(m') == UpdateDelegationMap(AbstractifyCDelegationMapToDelegationMap(m), newkr, AbstractifyEndPointToNodeIdentity(id));\r\n{\r\n}\r\n\r\nlemma {:timeLimitMultiplier 4} {:induction false} UpdateCDelegationMap_Part2(m:CDelegationMap, newkr:KeyRange, id:EndPoint, m':CDelegationMap,\r\n left_index:int, right_index:int, new_left:seq, new_right:seq)\r\n requires CDelegationMapIsValid(m);\r\n requires EndPointIsValidPublicKey(id);\r\n requires !EmptyKeyRange(newkr);\r\n requires left_index == CDM_IndexForKey(m, newkr.klo) as int;\r\n requires right_index == CDM_IndexForKey(m, newkr.khi) as int;\r\n requires new_left == m.lows[..left_index];\r\n requires m.lows[left_index].klo == newkr.klo;\r\n requires !(left_index == 0 && !newkr.klo.KeyZero?); // left_index != 0 || newkr.klo.KeyZero\r\n requires new_right == if newkr.khi.KeyInf? then [] else [Mapping(newkr.khi, m.lows[right_index].id)] + m.lows[right_index+1..];\r\n requires m' == CDelegationMap(new_left + [Mapping(newkr.klo, id)] + new_right);\r\n requires CDelegationMapIsValid(m');\r\n ensures AbstractifyCDelegationMapToDelegationMap(m') == UpdateDelegationMap(AbstractifyCDelegationMapToDelegationMap(m), newkr, AbstractifyEndPointToNodeIdentity(id));\r\n{\r\n var rm := AbstractifyCDelegationMapToDelegationMap(m);\r\n var rm' := AbstractifyCDelegationMapToDelegationMap(m');\r\n var updated_rm := UpdateDelegationMap(rm, newkr, AbstractifyEndPointToNodeIdentity(id));\r\n\r\n forall k:Key \r\n ensures k in rm' <==> k in updated_rm;\r\n { \r\n }\r\n\r\n forall k:Key \r\n ensures rm'[k] == updated_rm[k];\r\n { \r\n CDelegationMapIsSortedExtension(m);\r\n CDelegationMapIsSortedExtension(m');\r\n\r\n var k_index := CDM_IndexForKey(m', KeyPlus(k)) as int;\r\n if KeyRangeContains(newkr, KeyPlus(k)) {\r\n if newkr.klo.KeyZero? {\r\n assert KeyPlusLe(newkr.klo, m.lows[0].klo);\r\n if |m.lows| > 1 {\r\n assert KeyPlusLt(newkr.klo, m.lows[1].klo);\r\n }\r\n CDM_Partitioned(m, newkr.klo, 0);\r\n assert new_left == [];\r\n CDM_Partitioned(m', KeyPlus(k), 0);\r\n assert k_index == 0;\r\n assert rm'[k] == AbstractifyEndPointToNodeIdentity(id);\r\n assert rm'[k] == updated_rm[k];\r\n } else {\r\n assert m'.lows[left_index] == Mapping(newkr.klo, id);\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m', left_index), KeyPlus(k));\r\n CDM_Partitioned(m', KeyPlus(k), left_index);\r\n assert rm'[k] == AbstractifyEndPointToNodeIdentity(id);\r\n assert rm'[k] == updated_rm[k];\r\n }\r\n } else {\r\n KeyPlusAntisymmetry(KeyPlus(k), newkr.khi);\r\n assert !KeyPlusLt(KeyPlus(k), newkr.khi) ==> KeyPlusLe(newkr.khi, KeyPlus(k));\r\n KeyPlusAntisymmetry(newkr.klo, KeyPlus(k));\r\n assert !KeyPlusLe(newkr.klo, KeyPlus(k)) ==> KeyPlusLt(KeyPlus(k), newkr.klo);\r\n assert KeyPlusLt(KeyPlus(k), newkr.klo) || KeyPlusLe(newkr.khi, KeyPlus(k)); // From !KeyRangeContains(newkr, k)\r\n \r\n assert m'.lows[left_index] == Mapping(newkr.klo, id);\r\n\r\n if k_index < left_index {\r\n assert m'.lows[k_index] == m.lows[..left_index][k_index] == m.lows[k_index];\r\n if k_index < left_index - 1 {\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m', k_index), KeyPlus(k));\r\n CDM_Partitioned(m', KeyPlus(k), k_index);\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m, k_index), KeyPlus(k));\r\n CDM_Partitioned(m, KeyPlus(k), k_index);\r\n assert rm'[k] == updated_rm[k];\r\n } else { // k_index == left_index - 1\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m', k_index), KeyPlus(k));\r\n //CDM_Partitioned(m', KeyPlus(k), k_index);\r\n // ==> m.lows[k_index].klo <= k < newkr.klo\r\n assert KeyPlusLe(m.lows[k_index].klo, KeyPlus(k));\r\n assert KeyPlusLt(KeyPlus(k), newkr.klo);\r\n assert KeyPlusLt(KeyPlus(k), m.lows[left_index].klo);\r\n\r\n var range := CDM_IndexToKeyRange(m, k_index);\r\n assert range == CDM_IndexRangeToKeyRange(m, k_index, k_index);\r\n assert range == KeyRange(m.lows[k_index].klo, CDM_IndexToNextKeyBoundary(m, k_index));\r\n assert range == KeyRange(m.lows[k_index].klo, if k_index < |m.lows| - 1 then m.lows[k_index+1].klo else KeyInf());\r\n assert range == KeyRange(m.lows[k_index].klo, m.lows[k_index+1].klo);\r\n assert k_index == left_index - 1;\r\n assert KeyPlusLt(KeyPlus(k), m.lows[left_index].klo);\r\n assert left_index == k_index + 1;\r\n assert KeyPlusLt(KeyPlus(k), m.lows[k_index+1].klo);\r\n assert KeyPlusLe(range.klo, KeyPlus(k));\r\n assert KeyPlusLt(KeyPlus(k), range.khi);\r\n assert KeyRangeContains(range, KeyPlus(k));\r\n CDM_Partitioned(m, KeyPlus(k), k_index);\r\n assert CDM_IndexForKey(m, KeyPlus(k)) as int == k_index;\r\n assert rm'[k] == AbstractifyEndPointToNodeIdentity(m.lows[k_index].id);\r\n\r\n assert rm'[k] == updated_rm[k];\r\n }\r\n } else {\r\n var new_index := left_index; // Index of the new mapping, Mapping(newkr.klo, id)\r\n assert k_index > new_index;\r\n\r\n UpdateCDelegationMap_RHS(m, newkr, id, m', left_index, right_index, new_left, new_right, k, left_index);\r\n\r\n assert rm'[k] == updated_rm[k];\r\n }\r\n }\r\n }\r\n lemma_UpdateCDelegationMap_Part2_Helper(m, m', newkr, id);\r\n assert AbstractifyCDelegationMapToDelegationMap(m') == UpdateDelegationMap(AbstractifyCDelegationMapToDelegationMap(m), newkr, AbstractifyEndPointToNodeIdentity(id));\r\n}\r\n\r\nlemma SequenceIndexingHelper(a:seq, b:seq, c:seq, d:seq, combined:seq, index:int)\r\n requires combined == a + b + c + d;\r\n requires index >= |a + b + c|;\r\n requires 0 <= index < |combined|\r\n ensures combined[index] == d[index - |a + b + c|];\r\n{\r\n}\r\n\r\nlemma UpdateCDelegationMap_RHS_Helper(m:CDelegationMap, newkr:KeyRange, id:EndPoint, m':CDelegationMap,\r\n left_index:int, right_index:int, new_left:seq, new_right:seq,\r\n k:Key, new_index:int)\r\n requires CDelegationMapIsValid(m);\r\n requires EndPointIsValidPublicKey(id);\r\n requires !EmptyKeyRange(newkr);\r\n requires !KeyRangeContains(newkr, KeyPlus(k));\r\n requires left_index == CDM_IndexForKey(m, newkr.klo) as int;\r\n requires right_index == CDM_IndexForKey(m, newkr.khi) as int;\r\n requires 0 <= new_index <= |m.lows|;\r\n requires |new_left| == new_index;\r\n requires new_left == m.lows[..new_index];\r\n requires new_right == if newkr.khi.KeyInf? then [] else [Mapping(newkr.khi, m.lows[right_index].id)] + m.lows[right_index+1..];\r\n requires m' == CDelegationMap(new_left + [Mapping(newkr.klo, id)] + new_right);\r\n requires CDelegationMapIsValid(m');\r\n requires var k_index := CDM_IndexForKey(m', KeyPlus(k)) as int;\r\n k_index > new_index + 1;\r\n ensures AbstractifyCDelegationMapToDelegationMap(m')[k] == UpdateDelegationMap(AbstractifyCDelegationMapToDelegationMap(m), newkr, AbstractifyEndPointToNodeIdentity(id))[k];\r\n\r\n{\r\n var rm := AbstractifyCDelegationMapToDelegationMap(m);\r\n var rm' := AbstractifyCDelegationMapToDelegationMap(m');\r\n var updated_rm := UpdateDelegationMap(rm, newkr, AbstractifyEndPointToNodeIdentity(id));\r\n var k_index := CDM_IndexForKey(m', KeyPlus(k)) as int;\r\n\r\n CDelegationMapIsSortedExtension(m);\r\n CDelegationMapIsSortedExtension(m');\r\n\r\n assert !newkr.khi.KeyInf?;\r\n var cr := CDM_IndexToKeyRange(m', k_index as int);\r\n assert KeyRangeContains(cr, KeyPlus(k));\r\n assert m'.lows == m.lows[..new_index] + [Mapping(newkr.klo, id)] + [Mapping(newkr.khi, m.lows[right_index].id)] + m.lows[right_index+1..];\r\n\r\n assert {:split_here} true;\r\n\r\n assert |m.lows[..new_index]| == new_index == new_index;\r\n assert |m.lows[..new_index] + [Mapping(newkr.klo, id)] + [Mapping(newkr.khi, m.lows[right_index].id)]| == new_index + 2;\r\n if |m.lows[right_index+1..]| > k_index as int - new_index - 2 {\r\n assert {:split_here} true;\r\n SequenceIndexingHelper(m.lows[..new_index], [Mapping(newkr.klo, id)], [Mapping(newkr.khi, m.lows[right_index].id)], m.lows[right_index+1..], m'.lows, k_index);\r\n assert m'.lows[k_index] == m.lows[right_index+1..][k_index-new_index - 2];\r\n } else {\r\n assert false;\r\n }\r\n\r\n assert cr.klo == m'.lows[k_index].klo == m.lows[right_index+1..][k_index-new_index-2].klo;\r\n var offset_index := right_index+1 + k_index-new_index-2;\r\n calc {\r\n m'.lows[k_index];\r\n m.lows[right_index+1..|m.lows|][k_index-new_index-2];\r\n { assert m.lows[right_index+1..|m.lows|][k_index-new_index-2] == m.lows[right_index+1 + k_index-new_index-2];}\r\n m.lows[right_index+1 + k_index-new_index-2];\r\n m.lows[offset_index];\r\n }\r\n assert KeyPlusLe(m.lows[offset_index].klo, KeyPlus(k));\r\n var offplusone := offset_index + 1;\r\n if offplusone < |m.lows| {\r\n assert offplusone < |m.lows|;\r\n assert KeyPlusLt(KeyPlus(k), m.lows[offplusone].klo);\r\n }\r\n\r\n CDM_Partitioned(m, KeyPlus(k), offset_index);\r\n assert CDM_IndexForKey(m, KeyPlus(k)) as int == offset_index;\r\n //var i :| 0 <= i < |m.lows| && m.lows[i].klo == cr.klo;\r\n assert rm'[k] == rm[k];\r\n}\r\n\r\nlemma {:timeLimitMultiplier 4} UpdateCDelegationMap_RHS(m:CDelegationMap, newkr:KeyRange, id:EndPoint, m':CDelegationMap,\r\n left_index:int, right_index:int, new_left:seq, new_right:seq,\r\n k:Key, new_index:int)\r\n requires CDelegationMapIsValid(m);\r\n requires EndPointIsValidPublicKey(id);\r\n requires !EmptyKeyRange(newkr);\r\n requires !KeyRangeContains(newkr, KeyPlus(k));\r\n requires left_index == CDM_IndexForKey(m, newkr.klo) as int;\r\n requires right_index == CDM_IndexForKey(m, newkr.khi) as int;\r\n requires 0 <= new_index <= |m.lows|;\r\n requires |new_left| == new_index;\r\n requires new_left == m.lows[..new_index];\r\n requires new_right == if newkr.khi.KeyInf? then [] else [Mapping(newkr.khi, m.lows[right_index].id)] + m.lows[right_index+1..];\r\n requires m' == CDelegationMap(new_left + [Mapping(newkr.klo, id)] + new_right);\r\n requires CDelegationMapIsValid(m');\r\n requires var k_index := CDM_IndexForKey(m', KeyPlus(k)) as int;\r\n k_index > new_index;\r\n ensures AbstractifyCDelegationMapToDelegationMap(m')[k] == UpdateDelegationMap(AbstractifyCDelegationMapToDelegationMap(m), newkr, AbstractifyEndPointToNodeIdentity(id))[k];\r\n{\r\n var rm := AbstractifyCDelegationMapToDelegationMap(m);\r\n var rm' := AbstractifyCDelegationMapToDelegationMap(m');\r\n var updated_rm := UpdateDelegationMap(rm, newkr, AbstractifyEndPointToNodeIdentity(id));\r\n var k_index := CDM_IndexForKey(m', KeyPlus(k)) as int;\r\n\r\n CDelegationMapIsSortedExtension(m);\r\n CDelegationMapIsSortedExtension(m');\r\n\r\n assert !newkr.khi.KeyInf?;\r\n\r\n if k_index == new_index + 1 {\r\n assert CDM_IndexToKeyRange(m', k_index as int).klo == newkr.khi;\r\n assert rm'[k] == AbstractifyEndPointToNodeIdentity(m.lows[right_index].id);\r\n assert KeyPlusLe(m.lows[right_index].klo, newkr.khi);\r\n assert KeyPlusLe(newkr.khi, KeyPlus(k));\r\n KeyPlusTransitivity(m.lows[right_index].klo, newkr.khi, KeyPlus(k));\r\n assert KeyPlusLe(m.lows[right_index].klo, KeyPlus(k));\r\n if |m.lows| > right_index + 1 {\r\n assert KeyPlusLt(KeyPlus(k), m.lows[right_index+1].klo);\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m, right_index), KeyPlus(k));\r\n CDM_Partitioned(m, KeyPlus(k), right_index);\r\n } else if |m.lows| == right_index + 1 {\r\n assert rm'[k] == AbstractifyEndPointToNodeIdentity(m.lows[right_index].id);\r\n assert KeyPlusLe(m.lows[right_index].klo, newkr.khi);\r\n assert KeyPlusLe(newkr.khi, KeyPlus(k));\r\n KeyPlusTransitivity(m.lows[right_index].klo, newkr.khi, KeyPlus(k));// ==> m.lows[right_index] <= k\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m, right_index), KeyPlus(k));\r\n CDM_Partitioned(m, KeyPlus(k), right_index);\r\n assert rm[k] == AbstractifyEndPointToNodeIdentity(m.lows[right_index].id);\r\n assert rm'[k] == rm[k];\r\n } else {\r\n assert false;\r\n }\r\n } else {\r\n assert k_index > new_index + 1;\r\n UpdateCDelegationMap_RHS_Helper(m, newkr, id, m', left_index, right_index, new_left, new_right, k, new_index);\r\n }\r\n assert AbstractifyCDelegationMapToDelegationMap(m')[k] == UpdateDelegationMap(AbstractifyCDelegationMapToDelegationMap(m), newkr, AbstractifyEndPointToNodeIdentity(id))[k];\r\n}\r\n\r\nlemma {:timeLimitMultiplier 2} UpdateCDelegationMap_Part1(\r\n m:CDelegationMap, newkr:KeyRange, id:EndPoint, m':CDelegationMap,\r\n left_index:int, right_index:int, new_left:seq, new_right:seq\r\n )\r\n requires CDelegationMapIsValid(m);\r\n requires EndPointIsValidPublicKey(id);\r\n requires !EmptyKeyRange(newkr);\r\n requires left_index == CDM_IndexForKey(m, newkr.klo) as int;\r\n requires right_index == CDM_IndexForKey(m, newkr.khi) as int;\r\n requires m.lows[left_index].klo != newkr.klo;\r\n requires new_left == m.lows[..left_index+1];\r\n requires new_right == if newkr.khi.KeyInf? then [] else [Mapping(newkr.khi, m.lows[right_index].id)] + m.lows[right_index+1..];\r\n requires m' == CDelegationMap(new_left + [Mapping(newkr.klo, id)] + new_right);\r\n requires CDelegationMapIsValid(m');\r\n ensures AbstractifyCDelegationMapToDelegationMap(m') == UpdateDelegationMap(AbstractifyCDelegationMapToDelegationMap(m), newkr, AbstractifyEndPointToNodeIdentity(id));\r\n //ensures |m'.lows| as uint64 <= |m.lows| as uint64 + 1\r\n{\r\n var rm := AbstractifyCDelegationMapToDelegationMap(m);\r\n var rm' := AbstractifyCDelegationMapToDelegationMap(m');\r\n var updated_rm := UpdateDelegationMap(rm, newkr, AbstractifyEndPointToNodeIdentity(id));\r\n\r\n forall k:Key \r\n ensures k in rm' <==> k in updated_rm;\r\n { \r\n }\r\n\r\n forall k:Key \r\n ensures rm'[k] == updated_rm[k];\r\n { \r\n CDelegationMapIsSortedExtension(m);\r\n CDelegationMapIsSortedExtension(m');\r\n\r\n if KeyRangeContains(newkr, KeyPlus(k)) {\r\n //var k_index := CDM_IndexForKey(m', KeyPlus(k)) as int;\r\n var index := left_index + 1;\r\n assert m'.lows[index] == Mapping(newkr.klo, id);\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m', index), KeyPlus(k));\r\n CDM_Partitioned(m', KeyPlus(k), index);\r\n assert CDM_IndexForKey(m', KeyPlus(k)) as int == index;\r\n assert rm'[k] == AbstractifyEndPointToNodeIdentity(id);\r\n } else {\r\n KeyPlusAntisymmetry(KeyPlus(k), newkr.khi);\r\n assert !KeyPlusLt(KeyPlus(k), newkr.khi) ==> KeyPlusLe(newkr.khi, KeyPlus(k));\r\n KeyPlusAntisymmetry(newkr.klo, KeyPlus(k));\r\n assert !KeyPlusLe(newkr.klo, KeyPlus(k)) ==> KeyPlusLt(KeyPlus(k), newkr.klo);\r\n assert KeyPlusLt(KeyPlus(k), newkr.klo) || KeyPlusLe(newkr.khi, KeyPlus(k)); // From !KeyRangeContains(newkr, k)\r\n\r\n var k_index := CDM_IndexForKey(m', KeyPlus(k)) as int;\r\n var new_index := left_index+1; // Index of the new mapping, Mapping(newkr.klo, id)\r\n\r\n assert k_index != new_index;\r\n\r\n if k_index < new_index {\r\n var kr := CDM_IndexToKeyRange(m', k_index);\r\n\r\n if k_index == left_index {\r\n assert KeyPlusLe(m.lows[left_index].klo, KeyPlus(k));\r\n KeyPlusTransitivity(m.lows[left_index].klo, KeyPlus(k), newkr.klo);\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m', left_index), KeyPlus(k));\r\n CDM_Partitioned(m', KeyPlus(k), left_index);\r\n assert m'.lows[CDM_IndexForKey(m',KeyPlus(k))].id == m'.lows[k_index].id;\r\n assert !newkr.klo.KeyInf?;\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m, left_index), newkr.klo);\r\n //assert KeyPlusLt(newkr.klo, CDM_IndexToKeyRange(m, left_index).khi);\r\n assert KeyPlusLt(newkr.klo, CDM_IndexToNextKeyBoundary(m, k_index));\r\n KeyPlusTransitivity(KeyPlus(k), newkr.klo, CDM_IndexToNextKeyBoundary(m, k_index));\r\n CDM_Partitioned(m, KeyPlus(k), k_index);\r\n \r\n assert rm'[k] == rm[k];\r\n } else {\r\n assert k_index < left_index;\r\n //assert CDM_IndexToKeyRange(m, k_index) == CDM_IndexToKeyRange(m', k_index);\r\n CDM_Partitioned(m, KeyPlus(k), k_index);\r\n assert m.lows[k_index] == m'.lows[k_index];\r\n assert m.lows[CDM_IndexForKey(m,KeyPlus(k))] == m'.lows[CDM_IndexForKey(m',KeyPlus(k))];\r\n assert rm'[k] == rm[k];\r\n }\r\n// assert KeyRangeContains(kr.klo, KeyPlus(k));\r\n// CDM_Partitioned(m', KeyPlus(k), k_index);\r\n// assert CDM_IndexForKey(m', KeyPlus(k)) as int == k_index;\r\n /*\r\n assert KeyPlusLt(KeyPlus(k), newkr.klo);\r\n if |m.lows| > 1 {\r\n assert KeyPlusLt(newkr.klo, m.lows[1].klo);\r\n KeyPlusTransitivity(KeyPlus(k), newkr.klo, m.lows[1].klo);\r\n assert KeyRangeContains(CDM_IndexToKeyRange(m, 0), KeyPlus(k));\r\n CDM_Partitioned(m, KeyPlus(k), 0);\r\n assert CDM_IndexForKey(m, KeyPlus(k)) as int == 0;\r\n }\r\n calc {\r\n rm'[k];\r\n m.lows[0].id;\r\n rm[k];\r\n }\r\n */\r\n } else {\r\n assert k_index > new_index;\r\n\r\n UpdateCDelegationMap_RHS(m, newkr, id, m', left_index, right_index, new_left, new_right, k, left_index+1);\r\n }\r\n\r\n assert rm'[k] == rm[k];\r\n\r\n calc {\r\n rm'[k];\r\n rm[k];\r\n updated_rm[k];\r\n }\r\n }\r\n }\r\n lemma_UpdateCDelegationMap_Part2_Helper(m, m', newkr, id);\r\n}\r\n\r\n// After the update, every key in newkr should point at id\r\n// TODO: Need to convert ok check into an invariant that we don't grow too large!\r\nmethod {:induction false} {:timeLimitMultiplier 4} UpdateCDelegationMap(m:CDelegationMap, newkr:KeyRange, id:EndPoint) returns (ok:bool, m':CDelegationMap)\r\n requires CDelegationMapIsValid(m);\r\n requires EndPointIsValidPublicKey(id);\r\n requires !EmptyKeyRange(newkr);\r\n ensures |m.lows| as uint64 < 0xFFFF_FFFF_FFFF_FFFF - 2 ==> ok == true;\r\n ensures ok ==> CDelegationMapIsValid(m');\r\n ensures ok ==> AbstractifyCDelegationMapToDelegationMap(m') == UpdateDelegationMap(AbstractifyCDelegationMapToDelegationMap(m), newkr, AbstractifyEndPointToNodeIdentity(id));\r\n ensures ok ==> (|m.lows| as uint64 < 0xFFFF_FFFF_FFFF_FFFF - 2) && (|m'.lows| as uint64 <= |m.lows| as uint64 + 2);\r\n{\r\n if |m.lows| as uint64 >= 0xFFFF_FFFF_FFFF_FFFF - 2 {\r\n ok := false;\r\n return;\r\n }\r\n\r\n ok := true;\r\n\r\n // !Empty implies:\r\n assert !newkr.klo.KeyInf?;\r\n assert !newkr.khi.KeyZero?;\r\n\r\n var left_index := CDM_IndexForKey(m, newkr.klo);\r\n var right_index := CDM_IndexForKey(m, newkr.khi);\r\n\r\n CDM_IndexForKey_Ordering(m);\r\n KeyPlusAntisymmetry(newkr.klo, newkr.khi);\r\n assert left_index <= right_index;\r\n\r\n var new_left := m.lows[..left_index];\r\n if m.lows[left_index].klo != newkr.klo {\r\n // We need to keep the left_index-th mapping, since it contains the bottom of the range, before we get to newkr.klo\r\n new_left := m.lows[..left_index+1];\r\n }\r\n\r\n var new_right; \r\n if newkr.khi.KeyInf? {\r\n // We're taking all of the keys from newkr.klo onwards\r\n new_right := [];\r\n } else {\r\n // We still need to map the portion of the range above newkr.khi but inside m.lows[right_index]\r\n new_right := [Mapping(newkr.khi, m.lows[right_index].id)] + m.lows[right_index+1..];\r\n assert KeyPlusLt(newkr.klo, newkr.khi);\r\n if right_index as int + 1 < |m.lows| {\r\n assert KeyPlusLt(newkr.khi, m.lows[right_index+1].klo);\r\n }\r\n }\r\n\r\n m' := CDelegationMap(\r\n new_left\r\n + [Mapping(newkr.klo, id)]\r\n + new_right);\r\n\r\n CDelegationMapIsSortedExtension(m);\r\n\r\n assert {:split_here} true;\r\n\r\n forall i | 0 <= i < |m'.lows|-1\r\n ensures KeyPlusLt(m'.lows[i].klo, m'.lows[i+1].klo);\r\n {\r\n if i < |new_left| {\r\n assert m'.lows[i] == new_left[i];\r\n if i == |new_left| - 1 {\r\n assert m'.lows[i+1].klo == Mapping(newkr.klo, id).klo;\r\n if m.lows[left_index].klo != newkr.klo {\r\n assert KeyPlusLt(m'.lows[i].klo, m'.lows[i+1].klo);\r\n } else {\r\n assert i == left_index as int - 1;\r\n\r\n assert m'.lows[i].klo == m.lows[i].klo;\r\n assert KeyPlusLe(m.lows[i + 1].klo, newkr.klo);\r\n assert KeyPlusLt(m.lows[i].klo, m.lows[i + 1].klo);\r\n KeyPlusTransitivity(m.lows[i].klo, m.lows[i+1].klo, newkr.klo);\r\n\r\n assert KeyPlusLt(m'.lows[i].klo, Mapping(newkr.klo, id).klo);\r\n assert KeyPlusLt(m'.lows[i].klo, m'.lows[i+1].klo);\r\n }\r\n } else {\r\n assert KeyPlusLt(m'.lows[i].klo, m'.lows[i+1].klo);\r\n }\r\n } else if i == |new_left| {\r\n assert m'.lows[i].klo == newkr.klo;\r\n assert KeyPlusLt(m'.lows[i].klo, m'.lows[i+1].klo);\r\n } else {\r\n if newkr.khi.KeyInf? {\r\n } else {\r\n if i == |new_left| + 1 {\r\n assert m'.lows[i] == Mapping(newkr.khi, m.lows[right_index].id);\r\n assert m'.lows[i].klo == newkr.khi;\r\n assert m'.lows[i+1].klo == m.lows[right_index+1].klo;\r\n } else {\r\n SequenceIndexingHelper(new_left, [Mapping(newkr.klo, id)], [Mapping(newkr.khi, m.lows[right_index].id)], m.lows[right_index+1..], m'.lows, i);\r\n }\r\n }\r\n //assert KeyPlusLt(m'.lows[i].klo, m'.lows[i+1].klo);\r\n }\r\n }\r\n assert CDelegationMapIsSorted(m);\r\n assert KeyPlusLt(m.lows[|m.lows|-1].klo, KeyInf());\r\n assert KeyPlusLt(m'.lows[|m'.lows|-1].klo, KeyInf());\r\n\r\n assert CDelegationMapIsSorted(m'); \r\n \r\n if left_index > 0 {\r\n assert |m'.lows| > 0;\r\n assert m'.lows[0].klo == KeyZero();\r\n //assert AbstractifyCDelegationMapToDelegationMap(m') == UpdateDelegationMap(AbstractifyCDelegationMapToDelegationMap(m), newkr, id);\r\n } else {\r\n assert m.lows[0].klo == KeyZero();\r\n if newkr.klo != KeyZero() {\r\n assert new_left == m.lows[..1];\r\n assert m'.lows[0].klo == m.lows[0].klo;\r\n } else {\r\n assert m'.lows[0].klo == newkr.klo;\r\n }\r\n assert m'.lows[0].klo == KeyZero();\r\n //assert AbstractifyCDelegationMapToDelegationMap(m') == UpdateDelegationMap(AbstractifyCDelegationMapToDelegationMap(m), newkr, id);\r\n }\r\n\r\n if m.lows[left_index].klo != newkr.klo {\r\n UpdateCDelegationMap_Part1(m, newkr, id, m', left_index as int, right_index as int, new_left, new_right);\r\n } else {\r\n UpdateCDelegationMap_Part2(m, newkr, id, m', left_index as int, right_index as int, new_left, new_right);\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/SHT/HostModel.i.dfy", "content": "include \"HostState.i.dfy\"\r\ninclude \"SingleDeliveryModel.i.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\ninclude \"DelegationLookup.i.dfy\"\r\n\r\nmodule SHT__HostModel_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened SHT__HostState_i\r\nimport opened SHT__SingleDeliveryModel_i\r\nimport opened SHT__PacketParsing_i\r\nimport opened DelegationLookup_i\r\nimport opened Environment_s\r\nimport opened SHT__Host_i\r\nimport opened SHT__SingleDeliveryState_i\r\nimport opened Impl__Delegations_i\r\nimport opened SHT__ConstantsState_i\r\nimport opened SHT__HT_s\r\nimport opened Logic__Option_i\r\nimport opened AbstractServiceSHT_s`All\r\nimport opened SHT__CMessage_i\r\nimport opened Common__NetClient_i\r\nimport opened AppInterface_i`Spec\r\nimport opened Common__NodeIdentity_i\r\nimport opened Impl_Parameters_i\r\nimport opened SHT__Keys_i\r\nimport opened SHT__Network_i\r\nimport opened SHT__Delegations_i\r\nimport opened SHT__Message_i\r\nimport opened SHT__SingleMessage_i\r\nimport opened SHT__SingleDelivery_i\r\n\r\nfunction method mapremove(m:map, k:KT) : map\r\n{\r\n map ki | ki in m && ki != k :: m[ki]\r\n}\r\n\r\nfunction method mapdomain(m:map) : set\r\n{\r\n set k | k in m :: k\r\n}\r\n\r\nfunction method BulkUpdateDomain(h:Hashtable, kr:KeyRange, u:Hashtable) : set\r\n{\r\n set k | k in mapdomain(h)+mapdomain(u) && (KeyRangeContains(kr, KeyPlus(k)) ==> k in u)\r\n}\r\n\r\nfunction method BulkUpdateHashtable(h:Hashtable, kr:KeyRange, u:Hashtable) : Hashtable\r\n{\r\n map k {:auto_trigger} | k in BulkUpdateDomain(h, kr, u) :: if (k in u) then u[k] else h[k]\r\n}\r\n\r\nfunction method BulkRemoveHashtable(h:Hashtable, kr:KeyRange) : Hashtable {\r\n map k | (k in h && !KeyRangeContains(kr, KeyPlus(k))) :: h[k]\r\n}\r\n\r\nfunction method ExtractRange(h:Hashtable, kr:KeyRange) : Hashtable \r\n requires ValidKeyRange(kr);\r\n requires forall k :: k in h ==> ValidKey(k) && ValidValue(h[k]);\r\n ensures forall k :: k in ExtractRange(h, kr) ==> k in h && ExtractRange(h, kr)[k] == h[k];\r\n ensures (forall k :: k in ExtractRange(h, kr) ==> ValidKey(k) && ValidValue(ExtractRange(h, kr)[k]))\r\n //ensures ValidHashtable(ExtractRange(h, kr));\r\n{\r\n map k | (k in h && KeyRangeContains(kr, KeyPlus(k))) :: h[k]\r\n}\r\n\r\nmethod InitHostState(constants:ConstantsState, me:EndPoint) returns (host:HostState)\r\n requires ConstantsStateIsValid(constants);\r\n requires EndPointIsAbstractable(me);\r\n ensures InitHostStatePostconditions(constants, host);\r\n ensures host.me == me;\r\n ensures host.constants == constants;\r\n{\r\n var sd := CSingleDeliveryAcctInit(constants.params);\r\n var delegationMap := CDelegationMap([Mapping(KeyZero(), constants.rootIdentity)]);\r\n\r\n //host := HostState(constants, me, delegationMap, map[], sd, None(), |delegationMap.lows| as uint64);\r\n host := HostState(constants, me, delegationMap, map[], sd, None(), |delegationMap.lows| as uint64, []);\r\n \r\n assert AbstractifyCDelegationMapToDelegationMap(delegationMap) == DelegationMap_Init(AbstractifyEndPointToNodeIdentity(constants.rootIdentity));\r\n assert Host_Init(AbstractifyHostStateToHost(host), AbstractifyEndPointToNodeIdentity(me), AbstractifyEndPointToNodeIdentity(constants.rootIdentity), AbstractifyEndPointsToNodeIdentities(constants.hostIds), AbstractifyCParametersToParameters(constants.params));\r\n}\r\n\r\n// TODO: move this method to Delegations.i.dfy once it stabilizes\r\nmethod DelegateForKeyImpl(m:CDelegationMap, k:Key) returns (ep:EndPoint)\r\n requires 0<|m.lows|;\r\n requires CDelegationMapIsValid(m);\r\n ensures EndPointIsValidPublicKey(ep);\r\n ensures AbstractifyCDelegationMapToDelegationMap(m)[k] == AbstractifyEndPointToNodeIdentity(ep);\r\n ensures AbstractifyEndPointToNodeIdentity(ep) == DelegateForKey(AbstractifyCDelegationMapToDelegationMap(m), k);\r\n{\r\n ep := m.lows[CDM_IndexForKey(m,KeyPlus(k))].id;\r\n}\r\n\r\nmethod {:timeLimitMultiplier 2} HostModelNextGetRequest(host:HostState, cpacket:CPacket) returns (host':HostState, sent_packets:seq)\r\n requires NextGetRequestPreconditions(host, cpacket);\r\n ensures NextGetRequestPostconditions(host, cpacket, host', sent_packets);\r\n{\r\n var k := cpacket.msg.m.k_getrequest;\r\n var owner := DelegateForKeyImpl(host.delegationMap, k);\r\n\r\n var m;\r\n ghost var receivedRequest := AppGetRequest(cpacket.msg.seqno as int, k);\r\n ghost var newReceivedRequests:seq;\r\n \r\n if (owner == host.me) {\r\n m := CReply(k, HashtableLookup(host.h, k));\r\n newReceivedRequests := host.receivedRequests + [receivedRequest]; \r\n } else {\r\n m := CRedirect(k, owner);\r\n newReceivedRequests := host.receivedRequests;\r\n }\r\n assert MessageMarshallable(m); \r\n\r\n var sd', sm, shouldSend := SendSingleCMessage(host.sd, m, cpacket.src, host.constants.params);\r\n \r\n host' := host.(sd := sd', receivedPacket := None);\r\n var p := CPacket(cpacket.src, host.me, sm);\r\n if shouldSend {\r\n host' := host.(sd := sd', receivedPacket := None, receivedRequests := newReceivedRequests);\r\n sent_packets := [p];\r\n } else {\r\n host' := host.(receivedPacket := None);\r\n sent_packets := [];\r\n }\r\n\r\n ghost var s := AbstractifyHostStateToHost(host);\r\n ghost var s' := AbstractifyHostStateToHost(host');\r\n ghost var g_m := AbstractifyCMessageToRslMessage(m);\r\n ghost var g_sm := AbstractifyCSingleMessageToSingleMessage(sm);\r\n ghost var g_src := AbstractifyEndPointToNodeIdentity(cpacket.src);\r\n ghost var g_out := AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets);\r\n \r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n reveal_AbstractifySeqOfCPacketsToSetOfShtPackets();\r\n\r\n assert AbstractifyCPacketToShtPacket(p) == Packet(g_src, s.me, g_sm); // OBSERVE\r\n \r\n assert NextGetRequest_Reply(s, s', g_src, cpacket.msg.seqno as int, cpacket.msg.m.k_getrequest, g_sm, g_m, g_out, shouldSend);\r\n}\r\n\r\nmethod {:timeLimitMultiplier 2} HostModelNextSetRequest(host:HostState, cpacket:CPacket) returns (host':HostState, sent_packets:seq)\r\n requires NextSetRequestPreconditions(host, cpacket);\r\n ensures NextSetRequestPostconditions(host, cpacket, host', sent_packets);\r\n{ \r\n var k := cpacket.msg.m.k_setrequest;\r\n var ov := cpacket.msg.m.v_setrequest;\r\n var owner := DelegateForKeyImpl(host.delegationMap, k);\r\n var m;\r\n var h';\r\n \r\n var marshallable := IsMessageMarshallable(cpacket.msg.m);\r\n if !marshallable {\r\n assert !ValidKey(k) || !ValidOptionalValue(ov);\r\n host' := host.(receivedPacket := None);\r\n sent_packets := [];\r\n\r\n ghost var s := AbstractifyHostStateToHost(host);\r\n ghost var s' := AbstractifyHostStateToHost(host');\r\n reveal_AbstractifySeqOfCPacketsToSetOfShtPackets();\r\n assert AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets) == {};\r\n assert NextSetRequest_Complete(s, s', AbstractifyCPacketToShtPacket(cpacket).src, AbstractifyCPacketToShtPacket(cpacket).msg.seqno, \r\n AbstractifyCPacketToShtPacket(cpacket).msg.m, Ack(0), Reply(k, ov), {}, true);\r\n // ^ ^\r\n // Because we're in the else clause of SetRequest_Complete | |\r\n // these arguments don't matter ------------------------------------------\r\n return;\r\n }\r\n\r\n if (owner == host.me) {\r\n /*if ov.ValueAbsent? {\r\n h' := mapremove(host.h, k); \r\n } else {\r\n h' := host.h[k:=ov.v];\r\n }*/\r\n\r\n m := CReply(k, ov);\r\n \r\n } else {\r\n //h' := host.h;\r\n m := CRedirect(k, owner);\r\n }\r\n var sd', sm, shouldSend := SendSingleCMessage(host.sd, m, cpacket.src, host.constants.params);\r\n\r\n ghost var receivedRequest := AppSetRequest(cpacket.msg.seqno as int, k, ov);\r\n ghost var newReceivedRequests:seq;\r\n\r\n if (shouldSend) {\r\n if (owner == host.me) {\r\n if ov.ValueAbsent? {\r\n h' := mapremove(host.h, k); \r\n } else {\r\n h' := host.h[k:=ov.v];\r\n }\r\n \r\n newReceivedRequests := host.receivedRequests + [receivedRequest];\r\n } else {\r\n h' := host.h;\r\n newReceivedRequests := host.receivedRequests;\r\n }\r\n \r\n host' := host.(h := h', sd := sd', receivedPacket := None, receivedRequests := newReceivedRequests);\r\n } else {\r\n host' := host.(receivedPacket := None);\r\n }\r\n \r\n \r\n\r\n var p := CPacket(cpacket.src, host.me, sm);\r\n if shouldSend {\r\n sent_packets := [p];\r\n } else {\r\n sent_packets := [];\r\n }\r\n\r\n ghost var s := AbstractifyHostStateToHost(host);\r\n ghost var s' := AbstractifyHostStateToHost(host');\r\n ghost var g_m := AbstractifyCMessageToRslMessage(m);\r\n ghost var g_sm := AbstractifyCSingleMessageToSingleMessage(sm);\r\n ghost var g_src := AbstractifyEndPointToNodeIdentity(cpacket.src);\r\n ghost var g_seqno := cpacket.msg.seqno as int;\r\n ghost var g_out := AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets);\r\n \r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n reveal_AbstractifySeqOfCPacketsToSetOfShtPackets();\r\n assert AbstractifyCPacketToShtPacket(p) == Packet(g_src, s.me, g_sm); // OBSERVE\r\n assert NextSetRequest_Complete(s, s', g_src, g_seqno, AbstractifyCMessageToRslMessage(cpacket.msg.m), g_sm, g_m, g_out, shouldSend);\r\n}\r\n\r\npredicate HostIgnoringUnParseable(host:Host, host':Host, packets:set)\r\n{\r\n packets == {}\r\n && host' == host.(receivedPacket := None)\r\n && host.receivedPacket.Some? \r\n && host.receivedPacket.v.msg.SingleMessage? \r\n && host.receivedPacket.v.msg.m.Delegate?\r\n && var msg := host.receivedPacket.v.msg.m;\r\n !(ValidKeyRange(msg.range) && ValidHashtable(msg.h) && !EmptyKeyRange(msg.range)\r\n && ValidPhysicalAddress(host.receivedPacket.v.msg.dst))\r\n}\r\n\r\nmethod {:timeLimitMultiplier 4} HostModelNextDelegate(host:HostState, cpacket:CPacket) returns (host':HostState, sent_packets:seq)\r\n requires NextDelegatePreconditions(host, cpacket);\r\n requires CSingleMessageIs64Bit(cpacket.msg);\r\n requires host.receivedPacket.Some? && host.receivedPacket.v == cpacket;\r\n requires host.numDelegations < host.constants.params.max_delegations - 2;\r\n ensures NextDelegatePostconditions(host, cpacket, host', sent_packets);\r\n ensures NextDelegate(AbstractifyHostStateToHost(host), AbstractifyHostStateToHost(host'), \r\n AbstractifyCPacketToShtPacket(cpacket), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets)) \r\n || HostIgnoringUnParseable(AbstractifyHostStateToHost(host), AbstractifyHostStateToHost(host'), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets));\r\n{ \r\n sent_packets := [];\r\n reveal_AbstractifySeqOfCPacketsToSetOfShtPackets();\r\n\r\n var marshallable := IsCSingleMessageMarshallable(cpacket.msg);\r\n if !marshallable {\r\n host' := host.(receivedPacket := None);\r\n assert HostIgnoringUnParseable(AbstractifyHostStateToHost(host), AbstractifyHostStateToHost(host'), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets));\r\n return;\r\n }\r\n \r\n if cpacket.src in host.constants.hostIds {\r\n var ok, delegationMap' := UpdateCDelegationMap(host.delegationMap, cpacket.msg.m.range, host.me);\r\n var h' := BulkUpdateHashtable(host.h, cpacket.msg.m.range, cpacket.msg.m.h);\r\n host' := host.(h := h', delegationMap := delegationMap', receivedPacket := None, numDelegations := host.numDelegations + 1);\r\n } else {\r\n host' := host.(receivedPacket := None);\r\n }\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n //reveal_AbstractifySeqOfCPacketsToSetOfShtPackets();\r\n}\r\n\r\nmethod {:timeLimitMultiplier 4} HostModelNextShard(host:HostState, cpacket:CPacket) returns (host':HostState, sent_packets:seq)\r\n requires NextShardPreconditions(host, cpacket);\r\n requires host.numDelegations < host.constants.params.max_delegations - 2;\r\n ensures NextShardPostconditions(host, cpacket, host', sent_packets);\r\n{ \r\n var recipient := cpacket.msg.m.recipient;\r\n var kr := cpacket.msg.m.kr;\r\n sent_packets := [];\r\n host' := host.(receivedPacket := None);\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n reveal_AbstractifySeqOfCPacketsToSetOfShtPackets();\r\n var marshallable := IsMessageMarshallable(cpacket.msg.m);\r\n if (!marshallable || cpacket.msg.m.recipient == host.me || cpacket.msg.m.recipient !in host.constants.hostIds) {\r\n assert EndPointIsAbstractable(cpacket.msg.m.recipient);\r\n return;\r\n }\r\n \r\n var b:= DelegateForKeyRangeIsHostImpl(host.delegationMap, cpacket.msg.m.kr, host.me);\r\n if (!b) {\r\n assert !DelegateForKeyRangeIsHost(AbstractifyCDelegationMapToDelegationMap(host.delegationMap), cpacket.msg.m.kr, AbstractifyEndPointToNodeIdentity(host.me));\r\n return;\r\n }\r\n\r\n var h := ExtractRange(host.h, cpacket.msg.m.kr);\r\n if (|h| >= 62) { // max_hashtable_size()\r\n return;\r\n }\r\n\r\n var m := CDelegate(kr, ExtractRange(host.h, kr));\r\n \r\n var sd', sm, shouldSend := SendSingleCMessage(host.sd, m, recipient, host.constants.params);\r\n var p; \r\n \r\n if shouldSend {\r\n var ok, delegationMap' := UpdateCDelegationMap(host.delegationMap, kr, recipient);\r\n var h' := BulkRemoveHashtable(host.h, kr);\r\n \r\n host' := host.(h := h', delegationMap := delegationMap', sd := sd', receivedPacket := None, numDelegations := host.numDelegations + 1);\r\n\r\n p := CPacket(recipient, host.me, sm);\r\n sent_packets := [p];\r\n \r\n } else {\r\n host' := host.(receivedPacket := None, numDelegations := host.numDelegations + 1);\r\n sent_packets := [];\r\n }\r\n \r\n \r\n ghost var s := AbstractifyHostStateToHost(host);\r\n ghost var s' := AbstractifyHostStateToHost(host');\r\n ghost var g_sm := AbstractifyCSingleMessageToSingleMessage(sm);\r\n ghost var g_out := AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets);\r\n ghost var g_pkt := AbstractifyCPacketToShtPacket(cpacket);\r\n \r\n if shouldSend {\r\n assert AbstractifyCPacketToShtPacket(p) == Packet(AbstractifyEndPointToNodeIdentity(recipient), s.me, g_sm); // OBSERVE\r\n //assert g_out == { Packet(recipient, s.me, sm) }\r\n }\r\n \r\n assert NextShard(s, s', g_out, g_pkt.msg.m.kr, g_pkt.msg.m.recipient, g_sm, shouldSend); \r\n}\r\n\r\n\r\nmethod {:timeLimitMultiplier 2} HostModelNextReceiveMessage(host:HostState, cpacket:CPacket) returns (host':HostState, sent_packets:seq)\r\n requires cpacket.msg.CSingleMessage?;\r\n requires CSingleDeliveryAccountIsValid(host.sd, host.constants.params)\r\n requires CPacketIsAbstractable(cpacket);\r\n requires CSingleMessageIs64Bit(cpacket.msg);\r\n requires host.receivedPacket.Some? && host.receivedPacket.v == cpacket;\r\n requires HostState_common_preconditions(host, cpacket);\r\n requires cpacket.msg.m.CGetRequest? ==> NextGetRequestPreconditions(host, cpacket);\r\n requires cpacket.msg.m.CSetRequest? ==> NextSetRequestPreconditions(host, cpacket) \r\n requires cpacket.msg.m.CDelegate? ==> NextDelegatePreconditions(host, cpacket) && (host.numDelegations < host.constants.params.max_delegations - 2);\r\n requires cpacket.msg.m.CShard? ==> NextShardPreconditions(host, cpacket) && (host.numDelegations < host.constants.params.max_delegations - 2);\r\n\r\n ensures HostStateIsAbstractable(host');\r\n ensures CPacketSeqIsAbstractable(sent_packets);\r\n ensures HostState_common_postconditions(host, cpacket, host', sent_packets)\r\n ensures Process_Message(AbstractifyHostStateToHost(host), AbstractifyHostStateToHost(host'), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets))\r\n || HostIgnoringUnParseable(AbstractifyHostStateToHost(host), AbstractifyHostStateToHost(host'), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets));\r\n ensures AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets) == ExtractPacketsFromLSHTPackets(AbstractifyOutboundPacketsToSeqOfLSHTPackets(sent_packets));\r\n ensures host'.receivedPacket.None?\r\n{\r\n if (cpacket.msg.CInvalidMessage?) {\r\n host' := host;\r\n sent_packets := [];\r\n } else if (cpacket.msg.m.CGetRequest?) {\r\n host', sent_packets := HostModelNextGetRequest(host, cpacket);\r\n assert NextGetRequest(AbstractifyHostStateToHost(host), AbstractifyHostStateToHost(host'), AbstractifyCPacketToShtPacket(cpacket), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets));\r\n } else if (cpacket.msg.m.CSetRequest?) {\r\n host', sent_packets := HostModelNextSetRequest(host, cpacket);\r\n } else if (cpacket.msg.m.CDelegate?) {\r\n host', sent_packets := HostModelNextDelegate(host, cpacket);\r\n } else if (cpacket.msg.m.CShard?) {\r\n host', sent_packets := HostModelNextShard(host, cpacket);\r\n } else if (cpacket.msg.m.CReply? || cpacket.msg.m.CRedirect?) {\r\n host' := host.(receivedPacket := None);\r\n sent_packets := [];\r\n assert |sent_packets| == 0;\r\n reveal_AbstractifySeqOfCPacketsToSetOfShtPackets();\r\n assert |AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets)| == |sent_packets|;\r\n assert AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets) == {};\r\n } else {\r\n assert false;\r\n }\r\n \r\n }\r\n\r\nmethod ShouldProcessReceivedMessageImpl(s:HostState) returns (b:bool)\r\n requires HostStateIsValid(s)\r\n ensures b == ShouldProcessReceivedMessage(AbstractifyHostStateToHost(s))\r\n{\r\n if ( s.receivedPacket.Some?\r\n && s.receivedPacket.v.msg.CSingleMessage?\r\n && ((s.receivedPacket.v.msg.m.CDelegate? || s.receivedPacket.v.msg.m.CShard?) ==> s.numDelegations < s.constants.params.max_delegations - 2)) {\r\n b := true;\r\n } else {\r\n b := false;\r\n }\r\n}\r\n\r\nmethod HostModelReceivePacket(host:HostState, cpacket:CPacket) returns (host':HostState, sent_packets:seq, ack:CPacket)\r\n requires HostStateIsValid(host)\r\n requires CSingleDeliveryAccountIsValid(host.sd, host.constants.params)\r\n requires CPacketIsAbstractable(cpacket) && CSingleMessageIs64Bit(cpacket.msg) && !cpacket.msg.CInvalidMessage?; // CSingleMessageMarshallable(pkt.msg); \r\n requires !cpacket.msg.CInvalidMessage?;\r\n requires HostState_common_preconditions(host, cpacket);\r\n requires cpacket.dst == host.me;\r\n ensures HostStateIsValid(host');\r\n ensures HostStateIsValid(host') && OutboundPacketsSeqIsValid(sent_packets)\r\n ensures CPacketIsAbstractable(ack);\r\n ensures ReceivePacket(AbstractifyHostStateToHost(host), AbstractifyHostStateToHost(host'), AbstractifyCPacketToShtPacket(cpacket), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets), AbstractifyCPacketToShtPacket(ack))\r\n ensures OutboundPacketsSeqIsValid(sent_packets);\r\n ensures HostState_common_postconditions(host, cpacket, host', sent_packets);\r\n ensures |sent_packets| >= 1 ==> sent_packets == [ack];\r\n ensures sent_packets == [] ==> ack == cpacket;\r\n{\r\n sent_packets := [];\r\n \r\n reveal_AbstractifySeqOfCPacketsToSetOfShtPackets();\r\n \r\n if (host.receivedPacket.None?) {\r\n var b, sd';\r\n b, sd', ack := ReceiveSingleMessageImpl(host.sd, cpacket, host.constants.params);\r\n \r\n \r\n if (b) {\r\n var b' := NewSingleMessageImpl(host.sd, cpacket, host.constants.params);\r\n sent_packets := [ack]; \r\n \r\n if (b') {\r\n host' := host.(receivedPacket := Some(cpacket), sd := sd');\r\n } else {\r\n host' := host.(receivedPacket := None, sd := sd');\r\n }\r\n \r\n } else {\r\n host' := host.(sd := sd');\r\n ack := cpacket;\r\n sent_packets := [];\r\n }\r\n } else {\r\n host' := host;\r\n ack := cpacket;\r\n }\r\n\r\n}\r\n\r\nmethod {:timeLimitMultiplier 2} HostModelSpontaneouslyRetransmit(host:HostState) returns (host':HostState, sent_packets:seq)\r\n requires SpontaneouslyRetransmitPreconditions(host);\r\n ensures SpontaneouslyRetransmitPostconditions(host, host', sent_packets);\r\n ensures UnAckedMessages(AbstractifyHostStateToHost(host).sd, AbstractifyHostStateToHost(host).me) == ExtractPacketsFromLSHTPackets(AbstractifyOutboundPacketsToSeqOfLSHTPackets(sent_packets));\r\n{ \r\n host' := host;\r\n sent_packets := RetransmitUnAckedPackets(host.sd, host.me, host.constants.params);\r\n\r\n\r\n assert AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets) == UnAckedMessages(AbstractifyHostStateToHost(host).sd, AbstractifyHostStateToHost(host).me);\r\n \r\n reveal_AbstractifySeqOfCPacketsToSetOfShtPackets();\r\n \r\n assert forall p :: p in sent_packets ==> AbstractifyCPacketToShtPacket(p) in AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets);\r\n assert forall p :: p in sent_packets ==> AbstractifyCPacketToShtPacket(p) in ExtractPacketsFromLSHTPackets(AbstractifyOutboundPacketsToSeqOfLSHTPackets(sent_packets));\r\n \r\n ghost var sent_packets' := AbstractifyOutboundPacketsToSeqOfLSHTPackets(sent_packets);\r\n \r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n assert forall p :: p in sent_packets ==> CPacketIsAbstractable(p) && EndPointIsAbstractable(p.dst) && EndPointIsAbstractable(p.src);\r\n assert forall p :: p in sent_packets ==> LPacket(AbstractifyEndPointToNodeIdentity(p.dst), AbstractifyEndPointToNodeIdentity(p.src), AbstractifyCSingleMessageToSingleMessage(p.msg)) in sent_packets';\r\n \r\n assert forall p':: p' in sent_packets' ==> exists p :: p in sent_packets && LPacket(AbstractifyEndPointToNodeIdentity(p.dst), AbstractifyEndPointToNodeIdentity(p.src), AbstractifyCSingleMessageToSingleMessage(p.msg)) == p';\r\n assert AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets) == ExtractPacketsFromLSHTPackets(sent_packets');\r\n assert UnAckedMessages(AbstractifyHostStateToHost(host).sd, AbstractifyHostStateToHost(host).me) == ExtractPacketsFromLSHTPackets(AbstractifyOutboundPacketsToSeqOfLSHTPackets(sent_packets));\r\n}\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/SHT/HostState.i.dfy", "content": "include \"../../Protocol/SHT/Host.i.dfy\"\r\ninclude \"Delegations.i.dfy\"\r\ninclude \"SingleDeliveryState.i.dfy\"\r\ninclude \"ConstantsState.i.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\ninclude \"../../Common/Logic/Option.i.dfy\"\r\n\r\nmodule SHT__HostState_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened SHT__Host_i\r\nimport opened SHT__SingleDeliveryState_i\r\nimport opened Impl__Delegations_i\r\nimport opened SHT__ConstantsState_i\r\nimport opened SHT__PacketParsing_i\r\nimport opened SHT__HT_s\r\nimport opened Logic__Option_i\r\nimport opened AbstractServiceSHT_s`All\r\nimport opened SHT__CMessage_i\r\nimport opened Common__NetClient_i\r\nimport opened AppInterface_i`Spec\r\nimport opened Common__NodeIdentity_i\r\nimport opened Impl_Parameters_i\r\n\r\ndatatype HostState = HostState(\r\n constants:ConstantsState,\r\n me:EndPoint,\r\n delegationMap:CDelegationMap,\r\n h:Hashtable,\r\n sd:CSingleDeliveryAcct,\r\n receivedPacket:Option,\r\n numDelegations:uint64,\r\n ghost receivedRequests:seq\r\n)\r\n\r\npredicate HostStateIsAbstractable(host:HostState)\r\n{\r\n ConstantsStateIsAbstractable(host.constants)\r\n && EndPointIsAbstractable(host.me)\r\n && CDelegationMapIsAbstractable(host.delegationMap)\r\n && true // hashtable goes straight across\r\n && CSingleDeliveryAcctIsAbstractable(host.sd)\r\n && OptionCPacketIsAbstractable(host.receivedPacket)\r\n}\r\n\r\nfunction AbstractifyHostStateToHost(host:HostState) : Host\r\n requires HostStateIsAbstractable(host)\r\n{\r\n Host(AbstractifyToConstants(host.constants),\r\n AbstractifyEndPointToNodeIdentity(host.me), \r\n AbstractifyCDelegationMapToDelegationMap(host.delegationMap),\r\n host.h,\r\n AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(host.sd),\r\n AbstractifyOptionCPacketToOptionShtPacket(host.receivedPacket),\r\n host.numDelegations as int,\r\n host.receivedRequests)\r\n}\r\n\r\npredicate HostStateIsValid(host:HostState)\r\n{\r\n HostStateIsAbstractable(host)\r\n && CDelegationMapIsValid(host.delegationMap)\r\n && (forall k :: k in host.h ==> ValidKey(k)) \r\n && (forall k :: k in host.h ==> ValidValue(host.h[k]))\r\n && CSingleDeliveryAccountIsValid(host.sd, host.constants.params)\r\n && (host.receivedPacket.Some? ==> CPacketIsAbstractable(host.receivedPacket.v) \r\n && host.receivedPacket.v.msg.CSingleMessage? \r\n && !host.receivedPacket.v.msg.CInvalidMessage? \r\n && CSingleMessageIs64Bit(host.receivedPacket.v.msg) \r\n && host.receivedPacket.v.dst == host.me)\r\n && ConstantsStateIsValid(host.constants)\r\n && host.numDelegations < host.constants.params.max_delegations\r\n && |host.delegationMap.lows| <= 2 * host.numDelegations as int\r\n && (host.receivedPacket.Some? ==> ValidPhysicalAddress(host.receivedPacket.v.src))\r\n}\r\n\r\n\r\npredicate InitHostStatePostconditions(constants:ConstantsState, host:HostState)\r\n{\r\n ConstantsStateIsAbstractable(constants)\r\n && HostStateIsAbstractable(host)\r\n && Host_Init(AbstractifyHostStateToHost(host), AbstractifyEndPointToNodeIdentity(host.me), AbstractifyEndPointToNodeIdentity(constants.rootIdentity), AbstractifyEndPointsToNodeIdentities(constants.hostIds), AbstractifyCParametersToParameters(constants.params))\r\n && host.constants == constants\r\n && CSingleDeliveryAccountIsValid(host.sd, host.constants.params)\r\n && HostStateIsValid(host)\r\n}\r\n\r\npredicate HostState_common_preconditions(host:HostState, cpacket:CPacket)\r\n{\r\n HostStateIsAbstractable(host)\r\n && CPacketIsAbstractable(cpacket)\r\n && HostStateIsValid(host)\r\n && ValidPhysicalAddress(cpacket.src)\r\n}\r\n\r\npredicate HostState_common_postconditions(host:HostState, cpacket:CPacket, host':HostState, sent_packets:seq)\r\n{\r\n HostState_common_preconditions(host, cpacket)\r\n && HostStateIsAbstractable(host')\r\n && host'.constants == host.constants\r\n && host'.me == host.me\r\n && CPacketSeqIsAbstractable(sent_packets)\r\n && HostStateIsValid(host')\r\n && OutboundPacketsSeqIsValid(sent_packets)\r\n && OutboundPacketsSeqHasCorrectSrc(sent_packets, host.me)\r\n && (forall p :: p in sent_packets ==> p.msg.CSingleMessage? || p.msg.CAck?)\r\n && AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets) == ExtractPacketsFromLSHTPackets(AbstractifyOutboundPacketsToSeqOfLSHTPackets(sent_packets))\r\n}\r\n\r\npredicate NextGetRequestPreconditions(host:HostState, cpacket:CPacket)\r\n{\r\n HostStateIsAbstractable(host)\r\n && CPacketIsAbstractable(cpacket)\r\n && cpacket.msg.CSingleMessage?\r\n && cpacket.msg.m.CGetRequest?\r\n && EndPointIsValidPublicKey(cpacket.src)\r\n //&& ValidKey(cpacket.msg.m.k_getrequest)\r\n //&& CSingleMessageMarshallable(cpacket.msg)\r\n && CSingleDeliveryAccountIsValid(host.sd, host.constants.params)\r\n && HostState_common_preconditions(host, cpacket)\r\n}\r\npredicate NextGetRequestPostconditions(host:HostState, cpacket:CPacket, host':HostState, sent_packets:seq)\r\n{\r\n NextGetRequestPreconditions(host, cpacket)\r\n && HostStateIsAbstractable(host')\r\n && CPacketSeqIsAbstractable(sent_packets)\r\n && NextGetRequest(AbstractifyHostStateToHost(host), AbstractifyHostStateToHost(host'), AbstractifyCPacketToShtPacket(cpacket), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets))\r\n && HostState_common_postconditions(host, cpacket, host', sent_packets)\r\n && host'.receivedPacket == None\r\n}\r\n\r\npredicate NextSetRequestPreconditions(host:HostState, cpacket:CPacket)\r\n{\r\n HostStateIsAbstractable(host)\r\n && CPacketIsAbstractable(cpacket)\r\n && cpacket.msg.CSingleMessage?\r\n && cpacket.msg.m.CSetRequest?\r\n && CSingleDeliveryAccountIsValid(host.sd, host.constants.params)\r\n //&& ValidKey(cpacket.msg.m.k_setrequest)\r\n //&& ValidOptionalValue(cpacket.msg.m.v_setrequest)\r\n //&& CSingleMessageMarshallable(cpacket.msg)\r\n && HostState_common_preconditions(host, cpacket)\r\n}\r\npredicate NextSetRequestPostconditions(host:HostState, cpacket:CPacket, host':HostState, sent_packets:seq)\r\n{\r\n NextSetRequestPreconditions(host, cpacket)\r\n && HostStateIsAbstractable(host')\r\n && CPacketSeqIsAbstractable(sent_packets)\r\n && NextSetRequest(AbstractifyHostStateToHost(host), AbstractifyHostStateToHost(host'), AbstractifyCPacketToShtPacket(cpacket), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets))\r\n && HostState_common_postconditions(host, cpacket, host', sent_packets)\r\n && host'.receivedPacket == None\r\n}\r\n\r\npredicate NextDelegatePreconditions(host:HostState, cpacket:CPacket)\r\n{\r\n HostStateIsAbstractable(host)\r\n && CPacketIsAbstractable(cpacket)\r\n && cpacket.msg.CSingleMessage?\r\n && cpacket.msg.m.CDelegate?\r\n && CSingleDeliveryAccountIsValid(host.sd, host.constants.params)\r\n //&& |host.delegationMap.lows| < 0xFFFF_FFFF_FFFF_FFFF - 2\r\n //&& !EmptyKeyRange(cpacket.msg.m.range)\r\n /*&& ValidKeyRange(cpacket.msg.m.range)\r\n && (forall k :: k in cpacket.msg.m.h ==> ValidKey(k))\r\n && (forall k :: k in cpacket.msg.m.h ==> ValidValue(cpacket.msg.m.h[k]))*/\r\n //&& CSingleMessageMarshallable(cpacket.msg)\r\n && HostState_common_preconditions(host, cpacket)\r\n && ValidPhysicalAddress(host.me)\r\n //&& host.numDelegations < host.constants.params.max_delegations - 2\r\n\r\n}\r\npredicate NextDelegatePostconditions(host:HostState, cpacket:CPacket, host':HostState, sent_packets:seq)\r\n{\r\n NextDelegatePreconditions(host, cpacket)\r\n && HostStateIsAbstractable(host')\r\n && CPacketSeqIsAbstractable(sent_packets)\r\n && HostState_common_postconditions(host, cpacket, host', sent_packets)\r\n && host'.receivedPacket == None\r\n}\r\n\r\npredicate NextShardPreconditions(host:HostState, cpacket:CPacket)\r\n{\r\n HostStateIsAbstractable(host)\r\n && CPacketIsAbstractable(cpacket)\r\n && HostState_common_preconditions(host, cpacket)\r\n && cpacket.msg.CSingleMessage?\r\n && cpacket.msg.m.CShard?\r\n && CSingleDeliveryAccountIsValid(host.sd, host.constants.params)\r\n //&& cpacket.msg.m.recipient != host.constants.me\r\n //&& cpacket.msg.m.recipient in host.constants.hostIds\r\n //&& DelegateForKeyRangeIsHost(AbstractifyCDelegationMapToDelegationMap(host.delegationMap), cpacket.msg.m.kr, AbstractifyEndPointToNodeIdentity(host.constants.me))\r\n && |host.delegationMap.lows| < 0xFFFF_FFFF_FFFF_FFFF - 2\r\n //&& !EmptyKeyRange(cpacket.msg.m.kr)\r\n /*&& ValidKeyRange(cpacket.msg.m.kr)*/\r\n //&& |ExtractRange(host.h, cpacket.msg.m.kr)| < 0x1_0000_0000\r\n //&& CSingleMessageMarshallable(cpacket.msg)\r\n && HostState_common_preconditions(host, cpacket)\r\n //&& host.numDelegations < host.constants.params.max_delegations - 2\r\n}\r\n\r\npredicate NextShardPostconditions(host:HostState, cpacket:CPacket, host':HostState, sent_packets:seq)\r\n{\r\n NextShardPreconditions(host, cpacket)\r\n && HostStateIsAbstractable(host')\r\n && CPacketSeqIsAbstractable(sent_packets)\r\n && NextShard_Wrapper(AbstractifyHostStateToHost(host), AbstractifyHostStateToHost(host'), AbstractifyCPacketToShtPacket(cpacket), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets))\r\n && HostState_common_postconditions(host, cpacket, host', sent_packets)\r\n && host'.receivedPacket == None\r\n}\r\n\r\npredicate SpontaneouslyRetransmitPreconditions(host:HostState)\r\n{\r\n HostStateIsAbstractable(host)\r\n && CSingleDeliveryAccountIsValid(host.sd, host.constants.params)\r\n && HostStateIsValid(host)\r\n}\r\n\r\npredicate SpontaneouslyRetransmitPostconditions(host:HostState, host':HostState, sent_packets:seq)\r\n{\r\n SpontaneouslyRetransmitPreconditions(host)\r\n && host' == host\r\n && HostStateIsAbstractable(host')\r\n && CPacketSeqIsAbstractable(sent_packets)\r\n && SpontaneouslyRetransmit(AbstractifyHostStateToHost(host), AbstractifyHostStateToHost(host'), AbstractifySeqOfCPacketsToSetOfShtPackets(sent_packets))\r\n && (forall i :: 0 <= i < |sent_packets| ==> CPacketIsSendable(sent_packets[i]) && sent_packets[i].msg.CSingleMessage? && CSingleMessageMarshallable(sent_packets[i].msg) && sent_packets[i].src == host.me)\r\n && (forall i :: 0 <= i < |sent_packets| ==> sent_packets[i].src == host.me)\r\n && HostStateIsValid(host')\r\n}\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/SHT/PacketParsing.i.dfy", "content": "include \"CMessage.i.dfy\"\r\ninclude \"AppInterfaceConcrete.i.dfy\"\r\ninclude \"../Common/NodeIdentity.i.dfy\"\r\ninclude \"../Common/GenericMarshalling.i.dfy\"\r\ninclude \"../../Protocol/LiveSHT/RefinementProof/Environment.i.dfy\"\r\ninclude \"../../Protocol/SHT/Host.i.dfy\"\r\n\r\nmodule {:fuel ValInGrammar,4} SHT__PacketParsing_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened Collections__Maps_i\r\nimport opened Math__mul_i\r\nimport opened Environment_s\r\nimport opened Impl__AppInterfaceConcrete_i`Spec\r\nimport opened Common__GenericMarshalling_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened LiveSHT__Environment_i\r\nimport opened SHT__HT_s\r\nimport opened SHT__Keys_i\r\nimport opened SHT__CMessage_i\r\nimport opened SHT__Network_i\r\nimport opened SHT__Host_i\r\nimport opened Impl_Parameters_i\r\nimport opened AppInterface_i`All\r\nimport opened Common__NetClient_i\r\n\r\n////////////////////////////////////////////////////////////////////\r\n// Grammars for the basic types\r\n////////////////////////////////////////////////////////////////////\r\nfunction method OptionalValue_grammar() : G { GTaggedUnion([Value_grammar(), GTuple([])]) }\r\nfunction method KeyPlus_grammar() : G { GTaggedUnion([Key_grammar(), GUint64]) }\r\nfunction method KeyRange_grammar() : G { GTuple([KeyPlus_grammar(), KeyPlus_grammar()]) }\r\nfunction method Hashtable_grammar() : G { GArray(GTuple([Key_grammar(), Value_grammar()])) }\r\nfunction method EndPoint_grammar() : G { GByteArray }\r\n\r\n////////////////////////////////////////////////////////////////////\r\n// Grammars for the SHT messages \r\n////////////////////////////////////////////////////////////////////\r\nfunction method CMessage_GetRequest_grammar() : G { Key_grammar() }\r\nfunction method CMessage_SetRequest_grammar() : G { GTuple([Key_grammar(), OptionalValue_grammar()]) }\r\nfunction method CMessage_Reply_grammar() : G { GTuple([Key_grammar(), OptionalValue_grammar()]) }\r\nfunction method CMessage_Redirect_grammar() : G { GTuple([Key_grammar(), EndPoint_grammar()]) }\r\nfunction method CMessage_Shard_grammar() : G { GTuple([KeyRange_grammar(), EndPoint_grammar()]) }\r\nfunction method CMessage_Delegate_grammar() : G { GTuple([KeyRange_grammar(), Hashtable_grammar()]) }\r\n\r\nfunction method CMessage_grammar() : G { GTaggedUnion([\r\n CMessage_GetRequest_grammar(),\r\n CMessage_SetRequest_grammar(),\r\n CMessage_Reply_grammar(),\r\n CMessage_Redirect_grammar(),\r\n CMessage_Shard_grammar(),\r\n CMessage_Delegate_grammar()\r\n ]) }\r\n\r\nfunction method CSingleMessage_grammar() : G { \r\n GTaggedUnion( [ GTuple([GUint64, EndPoint_grammar(), CMessage_grammar()]), // CSingleMessage\r\n GUint64]) // Ack\r\n}\r\n\r\npredicate NetPacketBound(data:seq) \r\n{\r\n |data| < MaxPacketSize()\r\n}\r\n\r\nlemma lemma_CMessageGrammarValid()\r\n ensures ValidGrammar(CMessage_grammar());\r\n{\r\n var g := CMessage_grammar();\r\n assert |g.cases| < 0x1_0000_0000_0000_0000;\r\n lemma_ValidKey_grammer();\r\n lemma_ValidValue_grammer();\r\n assert ValidGrammar(CMessage_GetRequest_grammar());\r\n assert ValidGrammar(CMessage_SetRequest_grammar());\r\n assert ValidGrammar(CMessage_Reply_grammar());\r\n assert ValidGrammar(CMessage_Redirect_grammar());\r\n assert ValidGrammar(CMessage_Shard_grammar());\r\n assert ValidGrammar(CMessage_Delegate_grammar());\r\n}\r\n//function {:opaque} SHTDemarshallable(data:seq) : bool\r\n//{\r\n// |data| < 0x1_0000_0000_0000_0000\r\n// && Demarshallable(data, CSingleMessage_grammar()) \r\n// && !parse_Val(data, CSingleMessage_grammar()).0.None?\r\n// && (var v := DemarshallFunc(data, CSingleMessage_grammar());\r\n// CSingleMessageIsAbstractable(parse_CSingleMessage(v)) && CSingleMessageMarshallable(parse_CSingleMessage(v)))\r\n//}\r\n\r\n////////////////////////////////////////////////////////////////////\r\n// Parsing\r\n////////////////////////////////////////////////////////////////////\r\n\r\nfunction method parse_OptionalValue(val:V) : OptionalValue\r\n requires ValInGrammar(val, OptionalValue_grammar());\r\n{\r\n if val.c == 0 then\r\n ValuePresent(parse_Value(val.val))\r\n else \r\n ValueAbsent()\r\n}\r\n\r\nfunction method parse_KeyPlus(val:V) : KeyPlus\r\n requires ValInGrammar(val, KeyPlus_grammar());\r\n{\r\n if val.c == 0 then\r\n KeyPlus(parse_Key(val.val))\r\n else if val.c == 1 then\r\n if val.val.u == 0 then\r\n KeyZero()\r\n else \r\n KeyInf()\r\n else\r\n assert false; // Should never get here\r\n KeyInf()\r\n}\r\n\r\nfunction method parse_KeyRange(val:V) : KeyRange\r\n requires ValInGrammar(val, KeyRange_grammar());\r\n{\r\n KeyRange(parse_KeyPlus(val.t[0]), parse_KeyPlus(val.t[1]))\r\n}\r\n\r\nfunction method parse_Hashtable(val:V) : Hashtable \r\n requires ValInGrammar(val, Hashtable_grammar());\r\n ensures |parse_Hashtable(val)| <= |val.a|;\r\n ensures ValidVal(val) ==> HashtableIs64Bit(parse_Hashtable(val));\r\n decreases |val.a|;\r\n{\r\n if |val.a| == 0 then\r\n map []\r\n else \r\n var tuple := val.a[0];\r\n assert ValInGrammar(tuple, Hashtable_grammar().elt); // OBSERVE: Still needed despite fuel boost. Odd.\r\n var key := parse_Key(tuple.t[0]);\r\n var value := parse_Value(tuple.t[1]);\r\n var others := parse_Hashtable(VArray(val.a[1..]));\r\n var m := others[key := value];\r\n m\r\n}\r\n\r\nfunction method parse_EndPoint(val:V) : EndPoint\r\n requires ValInGrammar(val, EndPoint_grammar());\r\n ensures EndPointIsAbstractable(parse_EndPoint(val));\r\n{\r\n EndPoint(val.b)\r\n}\r\n\r\nfunction method parse_Message_GetRequest(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_GetRequest_grammar());\r\n ensures CMessageIsAbstractable(parse_Message_GetRequest(val));\r\n{\r\n CGetRequest(parse_Key(val))\r\n}\r\n\r\nfunction method parse_Message_SetRequest(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_SetRequest_grammar());\r\n ensures CMessageIsAbstractable(parse_Message_SetRequest(val));\r\n{\r\n CSetRequest(parse_Key(val.t[0]), parse_OptionalValue(val.t[1]))\r\n}\r\n\r\nfunction method parse_Message_Reply(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_Reply_grammar());\r\n ensures CMessageIsAbstractable(parse_Message_Reply(val));\r\n{\r\n CReply(parse_Key(val.t[0]), parse_OptionalValue(val.t[1]))\r\n}\r\n\r\nfunction method parse_Message_Redirect(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_Redirect_grammar());\r\n ensures CMessageIsAbstractable(parse_Message_Redirect(val));\r\n{\r\n CRedirect(parse_Key(val.t[0]), parse_EndPoint(val.t[1]))\r\n}\r\n\r\nfunction method parse_Message_Shard(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_Shard_grammar());\r\n ensures CMessageIsAbstractable(parse_Message_Shard(val));\r\n{\r\n CShard(parse_KeyRange(val.t[0]), parse_EndPoint(val.t[1]))\r\n}\r\n\r\nfunction method parse_Message_Delegate(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_Delegate_grammar());\r\n ensures CMessageIsAbstractable(parse_Message_Delegate(val));\r\n ensures parse_Message_Delegate(val).CDelegate?;\r\n ensures ValidVal(val) ==> HashtableIs64Bit(parse_Message_Delegate(val).h);\r\n{\r\n CDelegate(parse_KeyRange(val.t[0]), parse_Hashtable(val.t[1]))\r\n}\r\n\r\nfunction method parse_Message(val:V) : CMessage\r\n requires ValInGrammar(val, CMessage_grammar());\r\n ensures CMessageIsAbstractable(parse_Message(val));\r\n ensures ValidVal(val) ==> CMessageIs64Bit(parse_Message(val)); \r\n{\r\n if val.c == 0 then\r\n parse_Message_GetRequest(val.val)\r\n else if val.c == 1 then\r\n parse_Message_SetRequest(val.val)\r\n else if val.c == 2 then\r\n parse_Message_Reply(val.val)\r\n else if val.c == 3 then\r\n parse_Message_Redirect(val.val)\r\n else if val.c == 4 then\r\n parse_Message_Shard(val.val)\r\n else if val.c == 5 then\r\n parse_Message_Delegate(val.val)\r\n else\r\n assert false; // Should never get here\r\n parse_Message_GetRequest(val.val)\r\n}\r\n\r\nfunction method {:fuel ValidVal,2} parse_CSingleMessage(val:V) : CSingleMessage\r\n requires ValInGrammar(val, CSingleMessage_grammar());\r\n ensures CSingleMessageIsAbstractable(parse_CSingleMessage(val));\r\n ensures ValidVal(val) ==> CSingleMessageIs64Bit(parse_CSingleMessage(val)); \r\n{\r\n if val.c == 0 then\r\n CSingleMessage(val.val.t[0].u, parse_EndPoint(val.val.t[1]), parse_Message(val.val.t[2]))\r\n else\r\n CAck(val.val.u)\r\n}\r\n\r\nfunction SHTDemarshallData(data:seq) : (result:CSingleMessage)\r\n ensures result.CSingleMessage? ==> EndPointIsValidPublicKey(result.dst)\r\n{\r\n if Demarshallable(data, CSingleMessage_grammar()) then\r\n var val := DemarshallFunc(data, CSingleMessage_grammar());\r\n var result := parse_CSingleMessage(val);\r\n if result.CSingleMessage? && !EndPointIsValidPublicKey(result.dst) then\r\n CInvalidMessage()\r\n else\r\n result\r\n else\r\n CInvalidMessage()\r\n}\r\n\r\nmethod SHTDemarshallDataMethod(data:array) returns (msg:CSingleMessage)\r\n requires data.Length < 0x1_0000_0000_0000_0000;\r\n ensures CSingleMessageIs64Bit(msg); \r\n ensures if Demarshallable(data[..], CSingleMessage_grammar()) then\r\n msg == SHTDemarshallData(data[..])\r\n else\r\n msg.CInvalidMessage?;\r\n{\r\n lemma_CSingleMessage_grammar_valid();\r\n var success, val := Demarshall(data, CSingleMessage_grammar());\r\n if success {\r\n assert ValInGrammar(val, CSingleMessage_grammar());\r\n msg := parse_CSingleMessage(val);\r\n if msg.CSingleMessage? && !EndPointIsValidPublicKey(msg.dst) {\r\n msg := CInvalidMessage();\r\n }\r\n } else {\r\n msg := CInvalidMessage();\r\n }\r\n}\r\n\r\n///////////////////////////////////////////////////////////////////\r\n// 64-bit Limits\r\n////////////////////////////////////////////////////////////////////\r\n\r\npredicate HashtableIs64Bit(h:Hashtable) { |h| < 0x1_0000_0000_0000_0000 }\r\n\r\npredicate CMessageIs64Bit(m:CMessage)\r\n{\r\n m.CDelegate? ==> HashtableIs64Bit(m.h)\r\n}\r\n\r\npredicate CSingleMessageIs64Bit(msg:CSingleMessage) \r\n{\r\n msg.CSingleMessage? ==> CMessageIs64Bit(msg.m)\r\n}\r\n\r\n////////////////////////////////////////////////////////////////////\r\n// Marshalling \r\n////////////////////////////////////////////////////////////////////\r\n\r\n\r\npredicate ValidHashtable(h:Hashtable)\r\n{\r\n |h| < max_hashtable_size()\r\n && (forall k :: k in h ==> ValidKey(k) && ValidValue(h[k]))\r\n}\r\n \r\npredicate MessageMarshallable(msg:CMessage) \r\n{\r\n match msg\r\n case CGetRequest(k) => ValidKey(k)\r\n case CSetRequest(k, v) => ValidKey(k) && ValidOptionalValue(v) \r\n case CReply(k, v) => ValidKey(k) && ValidOptionalValue(v) \r\n case CRedirect(k, id) => ValidKey(k) && EndPointIsValidPublicKey(id)\r\n case CShard(kr, id) => ValidKeyRange(kr) && EndPointIsValidPublicKey(id) && !EmptyKeyRange(msg.kr)\r\n case CDelegate(kr, h) => ValidKeyRange(kr) && ValidHashtable(h) && !EmptyKeyRange(msg.range)\r\n}\r\n\r\npredicate CSingleMessageMarshallable(msg:CSingleMessage) \r\n{\r\n msg.CAck? || (msg.CSingleMessage? && EndPointIsValidPublicKey(msg.dst) && MessageMarshallable(msg.m))\r\n}\r\n\r\nmethod IsValidKeyPlus(kp:KeyPlus) returns (b:bool)\r\n ensures b == ValidKeyPlus(kp);\r\n{\r\n if kp.KeyZero? || kp.KeyInf? {\r\n b := true;\r\n } else {\r\n b := IsKeyValid(kp.k);\r\n }\r\n}\r\n\r\nmethod IsValidKeyRange(kr:KeyRange) returns (b:bool)\r\n ensures b == ValidKeyRange(kr);\r\n{\r\n b := IsValidKeyPlus(kr.klo);\r\n if b {\r\n b := IsValidKeyPlus(kr.khi);\r\n }\r\n}\r\n\r\nmethod IsEmptyKeyRange(kr:KeyRange) returns (b:bool)\r\n ensures b == EmptyKeyRange(kr);\r\n{\r\n if kr.khi == kr.klo {\r\n b := true;\r\n } else {\r\n match kr.khi {\r\n case KeyZero => b := true;\r\n case KeyInf => b := false;\r\n case KeyPlus(k) =>\r\n match kr.klo {\r\n case KeyZero => b := false;\r\n case KeyInf => b := true;\r\n case KeyPlus(k') => b := IsKeyLt(k, k');\r\n }\r\n }\r\n }\r\n}\r\n\r\nmethod IsValidHashtable(h:Hashtable) returns (b:bool)\r\n requires HashtableIs64Bit(h);\r\n ensures b == ValidHashtable(h);\r\n{\r\n b := |h| as uint64 < 62; // max_hashtable_size\r\n\r\n if !b { return; }\r\n\r\n var keys := domain(h);\r\n lemma_MapSizeIsDomainSize(keys, h);\r\n\r\n while |keys| as uint64 > 0\r\n invariant |keys| < max_hashtable_size();\r\n invariant forall k :: k in keys ==> k in h;\r\n invariant forall k :: k in h ==> k in keys || (ValidKey(k) && ValidValue(h[k]));\r\n decreases |keys|;\r\n {\r\n var k :| k in keys;\r\n keys := keys - {k};\r\n b := IsKeyValid(k);\r\n if !b {\r\n return;\r\n }\r\n b := IsValueValid(h[k]);\r\n if !b {\r\n return;\r\n }\r\n }\r\n}\r\n\r\nmethod IsMessageMarshallable(msg:CMessage) returns (b:bool)\r\n requires CMessageIs64Bit(msg);\r\n requires CMessageIsAbstractable(msg);\r\n ensures b == MessageMarshallable(msg);\r\n{\r\n match msg \r\n case CGetRequest(k) => b := IsKeyValid(k);\r\n case CSetRequest(k, v) =>\r\n b := IsKeyValid(k);\r\n if b && v.ValuePresent? {\r\n b := IsValueValid(v.v);\r\n }\r\n case CReply(k, v) => \r\n b := IsKeyValid(k);\r\n if b && v.ValuePresent? {\r\n b := IsValueValid(v.v);\r\n }\r\n case CRedirect(k, id) => \r\n b := IsKeyValid(k);\r\n b := b && (|id.public_key| < 0x10_0000);\r\n case CShard(kr, id) => \r\n b := IsValidKeyRange(kr);\r\n b := b && (|id.public_key| < 0x10_0000);\r\n if b {\r\n b := IsEmptyKeyRange(kr);\r\n b := !b;\r\n }\r\n case CDelegate(kr, h) => \r\n b := IsValidKeyRange(kr);\r\n if b {\r\n b := IsValidHashtable(h);\r\n if b {\r\n b := IsEmptyKeyRange(kr);\r\n b := !b;\r\n }\r\n }\r\n}\r\n\r\nmethod IsCSingleMessageMarshallable(msg:CSingleMessage) returns (b:bool)\r\n requires CSingleMessageIsAbstractable(msg);\r\n requires CSingleMessageIs64Bit(msg);\r\n ensures b == CSingleMessageMarshallable(msg);\r\n{\r\n if msg.CAck? {\r\n b := true;\r\n } else if msg.CInvalidMessage? {\r\n b := false;\r\n } else {\r\n assert msg.CSingleMessage?;\r\n\r\n if !(|msg.dst.public_key| < 0x10_0000) {\r\n b := false;\r\n return;\r\n }\r\n\r\n b := IsMessageMarshallable(msg.m);\r\n }\r\n\r\n}\r\n\r\n\r\nfunction CMessageIsValid(msg:CMessage) : bool\r\n{\r\n MessageMarshallable(msg)\r\n}\r\n\r\npredicate CPacketIsMarshallable(cp:CPacket)\r\n{\r\n EndPointIsAbstractable(cp.src) && EndPointIsAbstractable(cp.dst) && CSingleMessageMarshallable(cp.msg) && (cp.msg.CSingleMessage? && cp.msg.m.CShard? ==> cp.msg.m.recipient != cp.dst)\r\n}\r\n\r\npredicate CPacketsIsMarshallable(cps:set)\r\n{\r\n forall cp :: cp in cps ==> CPacketIsMarshallable(cp)\r\n}\r\n\r\n\r\nmethod MarshallOptionalValue(c:OptionalValue) returns (val:V)\r\n requires ValidOptionalValue(c);\r\n ensures ValInGrammar(val, OptionalValue_grammar());\r\n ensures ValidVal(val);\r\n ensures parse_OptionalValue(val) == c;\r\n ensures 0 <= SizeOfV(val) < 16 + max_val_len();\r\n{\r\n if c.ValuePresent? {\r\n var v := MarshallValue(c.v);\r\n val := VCase(0, v);\r\n } else {\r\n reveal_SeqSum();\r\n val := VCase(1, VTuple([]));\r\n }\r\n}\r\n\r\nmethod MarshallKeyPlus(c:KeyPlus) returns (val:V)\r\n requires ValidKeyPlus(c);\r\n ensures ValInGrammar(val, KeyPlus_grammar());\r\n ensures ValidVal(val);\r\n ensures parse_KeyPlus(val) == c;\r\n ensures 0 <= SizeOfV(val) < 16 + max_key_len();\r\n{\r\n if c.KeyPlus? {\r\n var key := MarshallKey(c.k);\r\n val := VCase(0, key);\r\n } else if c.KeyZero? {\r\n val := VCase(1, VUint64(0));\r\n } else {\r\n val := VCase(1, VUint64(42));\r\n }\r\n}\r\n\r\nmethod MarshallKeyRange(c:KeyRange) returns (val:V)\r\n requires ValidKeyRange(c);\r\n ensures ValInGrammar(val, KeyRange_grammar());\r\n ensures ValidVal(val);\r\n ensures parse_KeyRange(val) == c;\r\n ensures 0 <= SizeOfV(val) < (16 + max_key_len()) + (16 + max_key_len());\r\n{\r\n var klo := MarshallKeyPlus(c.klo);\r\n var khi := MarshallKeyPlus(c.khi);\r\n val := VTuple([klo, khi]);\r\n lemma_SeqSum_2(val);\r\n}\r\n\r\n// TODO: Refactor this and Paxos' version to put them in a common location\r\nlemma lemma_SeqSum_2(val:V)\r\n requires val.VTuple?;\r\n requires |val.t| == 2;\r\n ensures SizeOfV(val) == SizeOfV(val.t[0]) + SizeOfV(val.t[1]);\r\n{\r\n calc {\r\n SeqSum(val.t);\r\n { reveal_SeqSum(); }\r\n SizeOfV(val.t[0]) + SeqSum(val.t[1..]);\r\n { reveal_SeqSum(); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SeqSum(val.t[2..]);\r\n { assert val.t[2..] == []; } // OBSERVE\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SeqSum([]);\r\n { reveal_SeqSum(); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]);\r\n }\r\n}\r\n\r\nlemma lemma_SeqSum_3(val:V)\r\n requires val.VTuple?;\r\n requires |val.t| == 3;\r\n ensures SizeOfV(val) == SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SizeOfV(val.t[2]);\r\n{\r\n calc {\r\n SeqSum(val.t);\r\n { reveal_SeqSum(); }\r\n SizeOfV(val.t[0]) + SeqSum(val.t[1..]);\r\n { reveal_SeqSum(); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SeqSum(val.t[2..]);\r\n { reveal_SeqSum(); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SizeOfV(val.t[2]) + SeqSum(val.t[3..]);\r\n { assert val.t[3..] == []; } // OBSERVE\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SizeOfV(val.t[2]) + SeqSum([]);\r\n { reveal_SeqSum(); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]) + SizeOfV(val.t[2]);\r\n }\r\n\r\n}\r\n\r\nmethod MarshallHashtable(c:Hashtable) returns (val:V)\r\n requires ValidHashtable(c);\r\n ensures ValInGrammar(val, Hashtable_grammar());\r\n ensures ValidVal(val);\r\n ensures parse_Hashtable(val) == c;\r\n ensures |c| == |val.a|;\r\n ensures SeqSum(val.a) <= |c| * ((8 + max_key_len()) + (8 + max_val_len()));\r\n{\r\n if |c| == 0 {\r\n val := VArray([]);\r\n reveal_SeqSum();\r\n } else {\r\n lemma_non_empty_map_has_elements(c);\r\n var key := 0;\r\n key :| key in c;\r\n var marshalled_key := MarshallKey(key);\r\n var marshalled_value := MarshallValue(c[key]);\r\n var remainder := RemoveElt(c, key);\r\n var marshalled_remainder := MarshallHashtable(remainder);\r\n assert parse_Hashtable(marshalled_remainder) == remainder;\r\n val := VArray([VTuple([marshalled_key, marshalled_value])] + marshalled_remainder.a);\r\n\r\n // OBSERVE (everything below; not sure which bit is critical to proving the final ensures)\r\n ghost var tuple := val.a[0];\r\n ghost var rest := val.a[1..];\r\n ghost var key' := parse_Key(tuple.t[0]);\r\n ghost var value' := parse_Value(tuple.t[1]);\r\n ghost var others' := parse_Hashtable(VArray(val.a[1..]));\r\n ghost var m' := others'[key' := value'];\r\n assert key' == key;\r\n assert value' == c[key];\r\n assert others' == remainder;\r\n assert m' == c;\r\n\r\n // Prove the SeqSum ensures\r\n calc {\r\n SeqSum(val.a);\r\n { reveal_SeqSum(); }\r\n SizeOfV(val.a[0]) + SeqSum(val.a[1..]);\r\n <= \r\n SizeOfV(val.a[0]) + |remainder| * ((8 + max_key_len()) + (8 + max_val_len()));\r\n { lemma_SeqSum_2(val.a[0]); }\r\n SizeOfV(val.a[0].t[0]) + SizeOfV(val.a[0].t[1]) + |remainder| * ((8 + max_key_len()) + (8 + max_val_len()));\r\n < //{ lemma_Vote_Val_Valid(c[op], val.a[0].t[1]); lemma_Vote_bound(c[op], val.a[0].t[1]); }\r\n ((8 + max_key_len()) + (8 + max_val_len())) + |remainder| * ((8 + max_key_len()) + (8 + max_val_len()));\r\n 1*((8 + max_key_len()) + (8 + max_val_len())) + |remainder| * ((8 + max_key_len()) + (8 + max_val_len()));\r\n { lemma_mul_is_distributive(((8 + max_key_len()) + (8 + max_val_len())), 1, |remainder|); }\r\n (1+|remainder|) * ((8 + max_key_len()) + (8 + max_val_len()));\r\n |c| * ((8 + max_key_len()) + (8 + max_val_len()));\r\n }\r\n }\r\n}\r\n\r\nmethod MarshallEndPoint(c:EndPoint) returns (val:V)\r\n requires EndPointIsValidPublicKey(c)\r\n ensures ValInGrammar(val, EndPoint_grammar())\r\n ensures ValidVal(val)\r\n ensures parse_EndPoint(val) == c\r\n ensures 0 <= SizeOfV(val) < 0x10_0008\r\n{\r\n val := VByteArray(c.public_key);\r\n}\r\n\r\nmethod MarshallMessage_GetRequest(c:CMessage) returns (val:V)\r\n requires MessageMarshallable(c);\r\n requires c.CGetRequest?;\r\n ensures ValInGrammar(val, CMessage_GetRequest_grammar());\r\n ensures ValidVal(val);\r\n ensures parse_Message_GetRequest(val) == c;\r\n ensures 0 <= SizeOfV(val) < MaxPacketSize() - 0x10_0020;\r\n{\r\n val := MarshallKey(c.k_getrequest);\r\n}\r\n\r\nmethod MarshallMessage_SetRequest(c:CMessage) returns (val:V)\r\n requires MessageMarshallable(c);\r\n requires c.CSetRequest?;\r\n ensures ValInGrammar(val, CMessage_SetRequest_grammar());\r\n ensures ValidVal(val);\r\n ensures parse_Message_SetRequest(val) == c;\r\n ensures 0 <= SizeOfV(val) < MaxPacketSize() - 0x10_0020;\r\n{\r\n var k_setrequest := MarshallKey(c.k_setrequest);\r\n var v_setrequest := MarshallOptionalValue(c.v_setrequest);\r\n val := VTuple([k_setrequest, v_setrequest]);\r\n lemma_SeqSum_2(val);\r\n}\r\n\r\nmethod MarshallMessage_Reply(c:CMessage) returns (val:V)\r\n requires MessageMarshallable(c);\r\n requires c.CReply?;\r\n ensures ValInGrammar(val, CMessage_Reply_grammar());\r\n ensures ValidVal(val);\r\n ensures parse_Message_Reply(val) == c;\r\n ensures 0 <= SizeOfV(val) < MaxPacketSize() - 0x10_0020;\r\n{\r\n var k_reply := MarshallKey(c.k_reply);\r\n var v := MarshallOptionalValue(c.v);\r\n val := VTuple([k_reply, v]);\r\n lemma_SeqSum_2(val);\r\n}\r\n\r\nmethod MarshallMessage_Redirect(c:CMessage) returns (val:V)\r\n requires MessageMarshallable(c);\r\n requires c.CRedirect?;\r\n ensures ValInGrammar(val, CMessage_Redirect_grammar());\r\n ensures ValidVal(val);\r\n ensures parse_Message_Redirect(val) == c;\r\n ensures 0 <= SizeOfV(val) < MaxPacketSize() - 0x10_0020;\r\n{\r\n var k_redirect := MarshallKey(c.k_redirect);\r\n var ep := MarshallEndPoint(c.id);\r\n val := VTuple([k_redirect, ep]);\r\n lemma_SeqSum_2(val);\r\n}\r\n\r\nmethod MarshallMessage_Shard(c:CMessage) returns (val:V)\r\n requires MessageMarshallable(c);\r\n requires c.CShard?;\r\n ensures ValInGrammar(val, CMessage_Shard_grammar());\r\n ensures ValidVal(val);\r\n ensures parse_Message_Shard(val) == c;\r\n ensures 0 <= SizeOfV(val) < MaxPacketSize() - 0x10_0020;\r\n{\r\n var k_redirect := MarshallKeyRange(c.kr);\r\n var ep := MarshallEndPoint(c.recipient);\r\n val := VTuple([k_redirect, ep]);\r\n lemma_SeqSum_2(val);\r\n}\r\n\r\nmethod MarshallMessage_Delegate(c:CMessage) returns (val:V)\r\n requires MessageMarshallable(c);\r\n requires c.CDelegate?;\r\n ensures ValInGrammar(val, CMessage_Delegate_grammar());\r\n ensures ValidVal(val);\r\n ensures parse_Message_Delegate(val) == c;\r\n ensures 0 <= SizeOfV(val) < MaxPacketSize() - 0x10_0020;\r\n{\r\n var range := MarshallKeyRange(c.range);\r\n var h := MarshallHashtable(c.h);\r\n val := VTuple([range, h]);\r\n\r\n calc {\r\n SizeOfV(val);\r\n { lemma_SeqSum_2(val); }\r\n SizeOfV(val.t[0]) + SizeOfV(val.t[1]);\r\n < \r\n (16 + max_key_len()) + (16 + max_key_len()) + SizeOfV(val.t[1]);\r\n <=\r\n (16 + max_key_len()) + (16 + max_key_len()) + 8 + |c.h| * ((8 + max_key_len()) + (8 + max_val_len()));\r\n { lemma_mul_is_distributive_add_forall(); } \r\n (16 + max_key_len()) + (16 + max_key_len()) + 8 + |c.h| * (8 + max_key_len()) + |c.h| * (8 + max_val_len());\r\n { lemma_mul_is_distributive_add_forall(); } \r\n (16 + max_key_len()) + (16 + max_key_len()) + 8 + |c.h| * 8 + |c.h| * max_key_len() + |c.h| * 8 + |c.h| * max_val_len();\r\n <\r\n MaxPacketSize() - 0x10_0020;\r\n }\r\n\r\n}\r\n\r\nmethod MarshallMessage(c:CMessage) returns (val:V)\r\n requires MessageMarshallable(c);\r\n ensures ValInGrammar(val, CMessage_grammar());\r\n ensures ValidVal(val);\r\n ensures parse_Message(val) == c;\r\n ensures 0 <= SizeOfV(val) < MaxPacketSize() - 0x10_0018;\r\n{\r\n if c.CGetRequest? {\r\n var msg := MarshallMessage_GetRequest(c); \r\n val := VCase(0, msg); \r\n } else if c.CSetRequest? {\r\n var msg := MarshallMessage_SetRequest(c); \r\n val := VCase(1, msg); \r\n } else if c.CReply? {\r\n var msg := MarshallMessage_Reply(c); \r\n val := VCase(2, msg); \r\n } else if c.CRedirect? {\r\n var msg := MarshallMessage_Redirect(c); \r\n val := VCase(3, msg); \r\n } else if c.CShard? {\r\n var msg := MarshallMessage_Shard(c); \r\n val := VCase(4, msg); \r\n } else if c.CDelegate? {\r\n var msg := MarshallMessage_Delegate(c); \r\n val := VCase(5, msg); \r\n } else {\r\n assert false;\r\n }\r\n}\r\n\r\nmethod MarshallCSingleMessage(c:CSingleMessage) returns (val:V)\r\n requires CSingleMessageMarshallable(c);\r\n ensures ValInGrammar(val, CSingleMessage_grammar());\r\n ensures ValidVal(val);\r\n ensures parse_CSingleMessage(val) == c;\r\n ensures 0 <= SizeOfV(val) < MaxPacketSize();\r\n{\r\n if c.CSingleMessage? {\r\n var ep := MarshallEndPoint(c.dst);\r\n var msg := MarshallMessage(c.m);\r\n\r\n var tuple := VTuple([VUint64(c.seqno), ep, msg]);\r\n lemma_SeqSum_3(tuple);\r\n assert ValidVal(tuple); // OBSERVE\r\n val := VCase(0, tuple);\r\n } else {\r\n val := VCase(1, VUint64(c.ack_seqno));\r\n }\r\n}\r\n\r\n////////////////////////////////////////////////////////////////////////\r\n// These functions need to be here, rather than CMessageRefinements.i.dfy,\r\n// since they depend on SHTDemarshallData\r\n////////////////////////////////////////////////////////////////////////\r\n\r\nfunction AbstractifyBufferToLSHTPacket(src:EndPoint, dst:EndPoint, data:seq) : LSHTPacket\r\n{\r\n LPacket(AbstractifyEndPointToNodeIdentity(dst),\r\n AbstractifyEndPointToNodeIdentity(src),\r\n AbstractifyCSingleMessageToSingleMessage(SHTDemarshallData(data)))\r\n}\r\n\r\npredicate BufferRefinementAgreesWithMessageRefinement(msg:CSingleMessage, marshalled:seq)\r\n requires CSingleMessageIsAbstractable(msg);\r\n requires CSingleMessageIsAbstractable(msg);\r\n{\r\n forall src, dst :: (EndPointIsValidPublicKey(src) && EndPointIsValidPublicKey(dst)) ==>\r\n\r\n (AbstractifyBufferToLSHTPacket(src, dst, marshalled)\r\n == LPacket(AbstractifyEndPointToNodeIdentity(dst), AbstractifyEndPointToNodeIdentity(src), AbstractifyCSingleMessageToSingleMessage(msg)))\r\n}\r\n\r\nfunction AbstractifyCPacketToLSHTPacket(cp:CPacket) : LSHTPacket\r\n requires CPacketIsAbstractable(cp);\r\n{\r\n LPacket(AbstractifyEndPointToNodeIdentity(cp.dst), AbstractifyEndPointToNodeIdentity(cp.src), AbstractifyCSingleMessageToSingleMessage(cp.msg))\r\n}\r\n\r\n\r\nfunction AbstractifyNetPacketToLSHTPacket(net:NetPacket) : LSHTPacket\r\n requires NetPacketIsAbstractable(net);\r\n{\r\n AbstractifyBufferToLSHTPacket(net.src, net.dst, net.msg)\r\n}\r\n\r\nfunction AbstractifyNetPacketToShtPacket(net:NetPacket) : Packet\r\n requires NetPacketIsAbstractable(net);\r\n{\r\n var lp:= AbstractifyNetPacketToLSHTPacket(net);\r\n Packet(lp.dst, lp.src, lp.msg)\r\n}\r\n\r\npredicate NetPacketIsAbstractable(net:NetPacket)\r\n{\r\n EndPointIsAbstractable(net.src)\r\n && EndPointIsAbstractable(net.dst)\r\n}\r\n\r\npredicate NetPacketsIsAbstractable(netps:set)\r\n{\r\n forall p :: p in netps ==> NetPacketIsAbstractable(p)\r\n}\r\n\r\nlemma lemma_CSingleMessage_grammar_valid()\r\n ensures ValidGrammar(CSingleMessage_grammar());\r\n{\r\n var g := CSingleMessage_grammar();\r\n assert |g.cases| < 0x1_0000_0000_0000_0000;\r\n \r\n lemma_ValidKey_grammer();\r\n lemma_ValidValue_grammer();\r\n\r\n assert ValidGrammar(Key_grammar());\r\n assert ValidGrammar(Value_grammar());\r\n assert ValidGrammar(OptionalValue_grammar());\r\n assert ValidGrammar(CMessage_GetRequest_grammar());\r\n assert ValidGrammar(CMessage_SetRequest_grammar());\r\n assert ValidGrammar(CMessage_Reply_grammar());\r\n assert ValidGrammar(CMessage_Redirect_grammar());\r\n assert ValidGrammar(CMessage_Shard_grammar());\r\n assert ValidGrammar(CMessage_Delegate_grammar());\r\n}\r\n\r\nmethod SHTMarshall(msg:CSingleMessage) returns (data:array)\r\n requires CSingleMessageIsAbstractable(msg);\r\n requires CSingleMessageMarshallable(msg);\r\n ensures fresh(data);\r\n ensures NetPacketBound(data[..]);\r\n ensures BufferRefinementAgreesWithMessageRefinement(msg, data[..]);\r\n{\r\n var val := MarshallCSingleMessage(msg);\r\n lemma_CSingleMessage_grammar_valid();\r\n data := Marshall(val, CSingleMessage_grammar());\r\n\r\n forall src, dst | EndPointIsValidPublicKey(src) && EndPointIsValidPublicKey(dst) \r\n ensures AbstractifyBufferToLSHTPacket(src, \r\n dst, \r\n data[..])\r\n == LPacket(AbstractifyEndPointToNodeIdentity(dst), AbstractifyEndPointToNodeIdentity(src), AbstractifyCSingleMessageToSingleMessage(msg));\r\n {\r\n calc {\r\n AbstractifyBufferToLSHTPacket(src, \r\n dst, \r\n data[..]);\r\n LPacket(AbstractifyEndPointToNodeIdentity(dst),\r\n AbstractifyEndPointToNodeIdentity(src),\r\n AbstractifyCSingleMessageToSingleMessage(SHTDemarshallData(data[..])));\r\n //{ lemma_NodeIdentityToEndPoint(dst); lemma_NodeIdentityToEndPoint(src); }\r\n LPacket(AbstractifyEndPointToNodeIdentity(dst), AbstractifyEndPointToNodeIdentity(src), AbstractifyCSingleMessageToSingleMessage(SHTDemarshallData(data[..])));\r\n LPacket(AbstractifyEndPointToNodeIdentity(dst), AbstractifyEndPointToNodeIdentity(src), AbstractifyCSingleMessageToSingleMessage(msg));\r\n }\r\n }\r\n}\r\n\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Sendable predicates\r\n\r\npredicate CPacketIsValid(cpacket:CPacket, params:CParameters)\r\n{\r\n CPacketIsAbstractable(cpacket) && CSingleMessageIsValid(cpacket.msg, params) && CSingleMessageMarshallable(cpacket.msg)\r\n}\r\n\r\npredicate CPacketIsSendable(cpacket:CPacket)\r\n{\r\n CPacketIsAbstractable(cpacket) && CSingleMessageMarshallable(cpacket.msg)\r\n}\r\n\r\npredicate CPacketSetIsSendable(cps:set)\r\n{\r\n forall p :: p in cps ==> CPacketIsSendable(p)\r\n}\r\n\r\npredicate CPacketSeqIsSendable(cps:seq)\r\n{\r\n forall i :: 0<=i<|cps| ==> CPacketIsSendable(cps[i])\r\n}\r\n\r\npredicate OutboundPacketsIsValid(out:CPacket)\r\n{\r\n CPacketIsSendable(out) && (out.msg.CSingleMessage? || out.msg.CAck?) && CSingleMessageMarshallable(out.msg)\r\n}\r\n\r\npredicate OutboundPacketsSeqIsValid(cpackets:seq)\r\n{\r\n forall i :: 0 <= i < |cpackets| ==> OutboundPacketsIsValid(cpackets[i])\r\n}\r\n\r\npredicate OutboundPacketsIsAbstractable(out:CPacket)\r\n{\r\n CPacketIsAbstractable(out)\r\n}\r\n\r\nfunction AbstractifyOutboundPacketsToLSHTPacket(out:CPacket) : LSHTPacket\r\n requires OutboundPacketsIsAbstractable(out);\r\n{\r\n AbstractifyCPacketToLSHTPacket(out)\r\n}\r\n\r\nfunction {:opaque} AbstractifyOutboundPacketsToSeqOfLSHTPackets(out:seq) : seq\r\n requires forall i :: 0 <= i < |out| ==> CPacketIsAbstractable(out[i]);\r\n ensures |AbstractifyOutboundPacketsToSeqOfLSHTPackets(out)| == |out|;\r\n ensures forall i :: 0 <= i < |out| ==> AbstractifyOutboundPacketsToSeqOfLSHTPackets(out)[i] == AbstractifyCPacketToLSHTPacket(out[i]);\r\n{\r\n if out == [] then\r\n []\r\n else if |out| == 1 then\r\n [AbstractifyCPacketToLSHTPacket(out[0])]\r\n else\r\n [AbstractifyCPacketToLSHTPacket(out[0])] + AbstractifyOutboundPacketsToSeqOfLSHTPackets(out[1..])\r\n \r\n}\r\n\r\npredicate OutboundPacketsHasCorrectSrc(out:CPacket, me:EndPoint)\r\n{\r\n out.src == me\r\n}\r\n\r\npredicate OutboundPacketsSeqHasCorrectSrc(cpackets:seq, me:EndPoint)\r\n{\r\n forall cpacket :: cpacket in cpackets ==> OutboundPacketsHasCorrectSrc(cpacket, me)\r\n}\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/SHT/Parameters.i.dfy", "content": "include \"../../Protocol/SHT/Parameters.i.dfy\"\r\ninclude \"../../Common/Native/NativeTypes.s.dfy\"\r\n\r\nmodule Impl_Parameters_i {\r\nimport opened Protocol_Parameters_i\r\nimport opened Native__NativeTypes_s\r\n\r\ndatatype CParameters = CParameters(max_seqno:uint64, max_delegations:uint64)\r\n\r\nfunction AbstractifyCParametersToParameters(params:CParameters) : Parameters\r\n{\r\n Parameters(params.max_seqno as int, params.max_delegations as int)\r\n}\r\n\r\npredicate CParametersIsValid(params:CParameters)\r\n{\r\n params.max_seqno == 0xFFFF_FFFF_FFFF_FFFF\r\n && 3 < params.max_delegations < 0x8000_0000_0000_0000\r\n}\r\n\r\nfunction method StaticParams() : CParameters\r\n{\r\n CParameters(0xffff_ffff_ffff_ffff, // max seqno = 2^64-1\r\n 0x7FFF_FFFF_FFFF_FFFF) // max delegations = 2^63-1\r\n}\r\n\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/SHT/SHTConcreteConfiguration.i.dfy", "content": "include \"../../Protocol/SHT/Configuration.i.dfy\"\r\ninclude \"../../Protocol/LiveSHT/RefinementProof/SHTRefinement.i.dfy\"\r\ninclude \"../Common/NodeIdentity.i.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\n\r\n\r\nmodule SHT__SHTConcreteConfiguration_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened SHT__Configuration_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened SHT__PacketParsing_i\r\nimport opened LiveSHT__SHTRefinement_i\r\nimport opened Impl_Parameters_i\r\nimport opened Common__NetClient_i\r\nimport opened Common__SeqIsUniqueDef_i\r\nimport opened Collections__Seqs_i\r\n\r\n\r\ndatatype SHTConcreteConfiguration = SHTConcreteConfiguration(\r\n hostIds:seq,\r\n rootIdentity:EndPoint,\r\n params:CParameters)\r\n\r\npredicate SHTConcreteConfigurationIsAbstractable(config:SHTConcreteConfiguration)\r\n{\r\n (forall e :: e in config.hostIds ==> EndPointIsAbstractable(e))\r\n && EndPointIsAbstractable(config.rootIdentity)\r\n}\r\n\r\npredicate SHTConcreteConfigurationIsValid(config:SHTConcreteConfiguration)\r\n{\r\n 0 < |config.hostIds| < 0xffff_ffff_ffff_ffff\r\n && SHTConcreteConfigurationIsAbstractable(config)\r\n && SeqIsUnique(config.hostIds)\r\n && CParametersIsValid(config.params)\r\n}\r\n\r\nfunction method SHTEndPointIsValid(endPoint:EndPoint, config:SHTConcreteConfiguration) : bool\r\n requires SHTConcreteConfigurationIsValid(config);\r\n{\r\n EndPointIsValidPublicKey(endPoint)\r\n}\r\n\r\n\r\nfunction AbstractifyToConfiguration(config:SHTConcreteConfiguration) : SHTConfiguration\r\n requires SHTConcreteConfigurationIsAbstractable(config);\r\n{\r\n SHTConfiguration([], AbstractifyEndPointsToNodeIdentities(config.hostIds), AbstractifyEndPointToNodeIdentity(config.rootIdentity), AbstractifyCParametersToParameters(config.params))\r\n}\r\n\r\npredicate ReplicaIndexValid(index:uint64, config:SHTConcreteConfiguration)\r\n{\r\n 0 <= index as int < |config.hostIds|\r\n}\r\n\r\npredicate ReplicaIndicesValid(indices:seq, config:SHTConcreteConfiguration)\r\n{\r\n forall i :: 0 <= i < |indices| ==> ReplicaIndexValid(indices[i], config)\r\n}\r\n\r\nlemma lemma_WFSHTConcreteConfiguration(config:SHTConcreteConfiguration)\r\n ensures SHTConcreteConfigurationIsAbstractable(config)\r\n && 0 < |config.hostIds|\r\n && SeqIsUnique(config.hostIds)\r\n && config.rootIdentity in config.hostIds\r\n ==> SHTConcreteConfigurationIsAbstractable(config)\r\n && WFSHTConfiguration(AbstractifyToConfiguration(config));\r\n{\r\n if (SHTConcreteConfigurationIsAbstractable(config)\r\n && 0 < |config.hostIds|\r\n && SeqIsUnique(config.hostIds))\r\n {\r\n //lemma_CardinalityNonEmpty(config.hostIds);\r\n var e := config.hostIds[0];\r\n assert AbstractifyEndPointToNodeIdentity(e) in AbstractifyToConfiguration(config).hostIds;\r\n assert 0 < |AbstractifyToConfiguration(config).hostIds|;\r\n var r_hostIds := AbstractifyToConfiguration(config).hostIds;\r\n forall i, j | 0 <= i < |r_hostIds| && 0 <= j < |r_hostIds|\r\n ensures r_hostIds[i] == r_hostIds[j] ==> i == j;\r\n {\r\n if r_hostIds[i] == r_hostIds[j] {\r\n if i != j {\r\n assert r_hostIds[i] == AbstractifyEndPointToNodeIdentity(config.hostIds[i]);\r\n assert r_hostIds[j] == AbstractifyEndPointToNodeIdentity(config.hostIds[j]);\r\n lemma_AbstractifyEndPointToNodeIdentity_injective(config.hostIds[i], config.hostIds[j]);\r\n assert config.hostIds[i] == config.hostIds[j];\r\n reveal_SeqIsUnique();\r\n assert i == j;\r\n assert false;\r\n }\r\n }\r\n\r\n }\r\n }\r\n}\r\n\r\npredicate WFSHTConcreteConfiguration(config:SHTConcreteConfiguration)\r\n ensures WFSHTConcreteConfiguration(config) ==>\r\n SHTConcreteConfigurationIsAbstractable(config)\r\n && WFSHTConfiguration(AbstractifyToConfiguration(config));\r\n{\r\n lemma_WFSHTConcreteConfiguration(config);\r\n SHTConcreteConfigurationIsAbstractable(config)\r\n && 0 < |config.hostIds|\r\n && SeqIsUnique(config.hostIds)\r\n && config.rootIdentity in config.hostIds\r\n}\r\n\r\nmethod CGetReplicaIndex(replica:EndPoint, config:SHTConcreteConfiguration) returns (found:bool, index:uint64)\r\n requires SHTConcreteConfigurationIsValid(config);\r\n requires EndPointIsValidPublicKey(replica);\r\n ensures found ==> ReplicaIndexValid(index, config) && config.hostIds[index] == replica;\r\n ensures found ==> GetHostIndex(AbstractifyEndPointToNodeIdentity(replica), AbstractifyToConfiguration(config)) == index as int;\r\n ensures !found ==> !(replica in config.hostIds);\r\n ensures !found ==> !(AbstractifyEndPointToNodeIdentity(replica) in AbstractifyEndPointsToNodeIdentities(config.hostIds));\r\n{\r\n var i:uint64 := 0;\r\n lemma_AbstractifyEndPointsToNodeIdentities_properties(config.hostIds);\r\n\r\n while i < |config.hostIds| as uint64\r\n invariant i < |config.hostIds| as uint64;\r\n invariant forall j :: 0 <= j < i ==> config.hostIds[j] != replica;\r\n {\r\n if replica == config.hostIds[i] {\r\n found := true;\r\n index := i;\r\n \r\n ghost var r_replica := AbstractifyEndPointToNodeIdentity(replica);\r\n ghost var r_replicas := AbstractifyToConfiguration(config).hostIds;\r\n assert r_replica == r_replicas[index];\r\n assert ItemAtPositionInSeq(r_replicas, r_replica, index as int);\r\n calc ==> {\r\n true;\r\n { reveal_SeqIsUnique(); }\r\n forall j :: 0 <= j < |config.hostIds| && j != i as int ==> config.hostIds[j] != replica;\r\n }\r\n\r\n if exists j :: 0 <= j < |r_replicas| && j != index as int && ItemAtPositionInSeq(r_replicas, r_replica, j) {\r\n ghost var j :| 0 <= j < |r_replicas| && j != index as int && ItemAtPositionInSeq(r_replicas, r_replica, j);\r\n assert r_replicas[j] == r_replica;\r\n assert AbstractifyEndPointToNodeIdentity(config.hostIds[j]) == r_replica;\r\n lemma_AbstractifyEndPointToNodeIdentity_injective(config.hostIds[i], config.hostIds[j]);\r\n assert false;\r\n }\r\n assert forall j :: 0 <= j < |r_replicas| && j != index as int ==> !ItemAtPositionInSeq(r_replicas, r_replica, j);\r\n assert FindIndexInSeq(r_replicas, r_replica) == index as int;\r\n return;\r\n }\r\n\r\n if i == |config.hostIds| as uint64 - 1 {\r\n found := false;\r\n return;\r\n }\r\n\r\n i := i + 1;\r\n }\r\n found := false;\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/SHT/SingleDeliveryModel.i.dfy", "content": "include \"SingleDeliveryState.i.dfy\"\r\ninclude \"Parameters.i.dfy\"\r\ninclude \"../../Protocol/SHT/RefinementProof/InvProof.i.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\n\r\nmodule SHT__SingleDeliveryModel_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened SHT__Network_i\r\nimport opened SHT__CMessage_i\r\nimport opened SHT__SingleDeliveryState_i\r\nimport opened Impl_Parameters_i\r\nimport opened SHT__InvProof_i\r\nimport opened SHT__PacketParsing_i\r\nimport opened Common__SeqIsUnique_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened GenericRefinement_i\r\nimport opened SHT__SingleDelivery_i\r\n\r\nmethod CTombstoneTableLookup(src:EndPoint, t:CTombstoneTable) returns (last_seqno:uint64)\r\n requires EndPointIsAbstractable(src);\r\n requires CTombstoneTableIsAbstractable(t);\r\n ensures last_seqno as int == TombstoneTableLookup(AbstractifyEndPointToNodeIdentity(src), AbstractifyCTombstoneTableToTombstoneTable(t));\r\n{\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n lemma_AbstractifyMap_properties(t, AbstractifyEndPointToNodeIdentity, uint64_to_nat_t, RefineNodeIdentityToEndPoint);\r\n if src in t {\r\n last_seqno := t[src];\r\n } else {\r\n last_seqno := 0;\r\n }\r\n}\r\n\r\nmethod CAckStateLookup(src:EndPoint, sendState:CSendState, ghost params:CParameters) returns (ackState:CAckState)\r\n requires EndPointIsAbstractable(src);\r\n requires CSendStateIsAbstractable(sendState);\r\n requires CSendStateIsValid(sendState, params);\r\n ensures CAckStateIsAbstractable(ackState);\r\n ensures CAckStateIsValid(ackState, src, params);\r\n ensures AbstractifyCAskStateToAckState(ackState) == AckStateLookup(AbstractifyEndPointToNodeIdentity(src), AbstractifyCSendStateToSendState(sendState));\r\n{\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n lemma_AbstractifyMap_properties(sendState, AbstractifyEndPointToNodeIdentity, AbstractifyCAskStateToAckState, RefineNodeIdentityToEndPoint);\r\n if src in sendState {\r\n ackState := sendState[src];\r\n } else {\r\n ackState := CAckState(0, []);\r\n }\r\n}\r\n\r\nmethod CSingleDeliveryAcctInit(ghost params:CParameters) returns (acct:CSingleDeliveryAcct)\r\n ensures CSingleDeliveryAccountIsValid(acct, params);\r\n ensures SingleDelivery_Init() == AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct);\r\n{\r\n acct := CSingleDeliveryAcct(map[], map[]);\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n lemma_AbstractifyMap_properties(acct.receiveState, AbstractifyEndPointToNodeIdentity, uint64_to_nat_t, RefineNodeIdentityToEndPoint);\r\n lemma_AbstractifyMap_properties(acct.sendState, AbstractifyEndPointToNodeIdentity, AbstractifyCAskStateToAckState, RefineNodeIdentityToEndPoint);\r\n}\r\n\r\nmethod MessageNotReceivedImpl(acct:CSingleDeliveryAcct, src:EndPoint, sm:CSingleMessage, ghost params:CParameters) returns (b:bool)\r\n requires CSingleDeliveryAccountIsValid(acct, params);\r\n requires EndPointIsAbstractable(src);\r\n requires CSingleMessageIsAbstractable(sm);\r\n ensures b == MessageNotReceived(AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct), AbstractifyEndPointToNodeIdentity(src), AbstractifyCSingleMessageToSingleMessage(sm));\r\n{\r\n var last_seqno := CTombstoneTableLookup(src, acct.receiveState);\r\n b := sm.CSingleMessage? && sm.seqno > last_seqno;\r\n}\r\n\r\nmethod NewSingleMessageImpl(acct:CSingleDeliveryAcct, pkt:CPacket, ghost params:CParameters) returns (b:bool)\r\n requires CSingleDeliveryAccountIsValid(acct, params);\r\n requires CPacketIsAbstractable(pkt) && CSingleMessageIs64Bit(pkt.msg) && !pkt.msg.CInvalidMessage?; // CSingleMessageMarshallable(pkt.msg);\r\n ensures b == NewSingleMessage(AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct), AbstractifyCPacketToShtPacket(pkt));\r\n{\r\n if pkt.msg.CSingleMessage?\r\n {\r\n var last_seqno := CTombstoneTableLookup(pkt.src, acct.receiveState);\r\n b := if pkt.msg.seqno > 0 then pkt.msg.seqno - 1 == last_seqno else false;\r\n }\r\n else\r\n {\r\n b := false;\r\n }\r\n}\r\n\r\n\r\nmethod TruncateUnAckListImpl(unAcked:seq, seqnoAcked:uint64, e:EndPoint, ghost old_seqno:int, ghost bound:int) returns (truncated:seq)\r\n requires CSingleMessageSeqIsAbstractable(unAcked);\r\n requires CUnAckedListValidForDst(unAcked, e);\r\n requires UnAckedListSequential(unAcked);\r\n requires (|unAcked| > 0 ==> unAcked[0].seqno as int == old_seqno + 1);\r\n requires old_seqno <= seqnoAcked as int <= bound;\r\n requires |unAcked| + old_seqno <= bound;\r\n ensures CSingleMessageSeqIsAbstractable(truncated);\r\n ensures CUnAckedListValidForDst(truncated, e);\r\n ensures UnAckedListSequential(truncated);\r\n ensures AbstractifySeqOfCSingleMessageToSeqOfSingleMessage(truncated) == TruncateUnAckList(AbstractifySeqOfCSingleMessageToSeqOfSingleMessage(unAcked), seqnoAcked as int);\r\n ensures (|truncated| > 0 ==> truncated[0].seqno as int == seqnoAcked as int + 1)\r\n ensures |truncated| + seqnoAcked as int <= bound;\r\n{\r\n if |unAcked| > 0 && unAcked[0].CSingleMessage? && unAcked[0].seqno <= seqnoAcked {\r\n assert AbstractifySeqOfCSingleMessageToSeqOfSingleMessage(unAcked[1..]) == AbstractifySeqOfCSingleMessageToSeqOfSingleMessage(unAcked)[1..]; // OBSERVE\r\n truncated := TruncateUnAckListImpl(unAcked[1..], seqnoAcked, e, old_seqno + 1, bound);\r\n } else {\r\n truncated := unAcked;\r\n }\r\n}\r\n\r\nmethod ReceiveAckImpl(acct:CSingleDeliveryAcct, pkt:CPacket, ghost params:CParameters) returns (acct':CSingleDeliveryAcct)\r\n requires CSingleDeliveryAccountIsValid(acct, params);\r\n requires CPacketIsAbstractable(pkt) && CSingleMessageMarshallable(pkt.msg);\r\n requires pkt.msg.CAck?;\r\n requires CParametersIsValid(params);\r\n ensures CSingleDeliveryAccountIsValid(acct', params);\r\n ensures ReceiveAck(AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct), AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct'), AbstractifyCPacketToShtPacket(pkt), {});\r\n{\r\n var oldAckState := CAckStateLookup(pkt.src, acct.sendState, params);\r\n assert CUnAckedListValidForDst(oldAckState.unAcked, pkt.src);\r\n assert CUnAckedListValid(oldAckState.unAcked);\r\n\r\n if pkt.msg.ack_seqno > oldAckState.numPacketsAcked {\r\n var newUnAcked := TruncateUnAckListImpl(oldAckState.unAcked, pkt.msg.ack_seqno, pkt.src, oldAckState.numPacketsAcked as int, params.max_seqno as int);\r\n assert CUnAckedListValidForDst(newUnAcked, pkt.src);\r\n var newAckState := oldAckState.(numPacketsAcked := pkt.msg.ack_seqno, unAcked := newUnAcked);\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n lemma_AbstractifyMap_properties(acct.sendState, AbstractifyEndPointToNodeIdentity, AbstractifyCAskStateToAckState, RefineNodeIdentityToEndPoint);\r\n assert AbstractifyCAskStateToAckState(newAckState) == \r\n AbstractifyCAskStateToAckState(oldAckState).(numPacketsAcked := AbstractifyCPacketToShtPacket(pkt).msg.ack_seqno,\r\n unAcked := AbstractifySeqOfCSingleMessageToSeqOfSingleMessage(newUnAcked));\r\n// if newAckState.unAcked == [] {\r\n// assert pkt.msg.ack_seqno as int < params.max_seqno as int;\r\n// assert newAckState.numPacketsAcked as int + |newAckState.unAcked| <= params.max_seqno as int;\r\n// } else {\r\n// assert newAckState.numPacketsAcked as int + |newAckState.unAcked| <= params.max_seqno as int;\r\n// }\r\n acct' := acct.(sendState := acct.sendState[pkt.src := newAckState]);\r\n } else {\r\n acct' := acct;\r\n }\r\n}\r\n\r\nmethod ShouldAckSingleMessageImpl(acct:CSingleDeliveryAcct, pkt:CPacket, ghost params:CParameters) returns (b:bool)\r\n requires CSingleDeliveryAccountIsValid(acct, params);\r\n requires CPacketIsAbstractable(pkt);\r\n ensures b == ShouldAckSingleMessage(AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct), AbstractifyCPacketToShtPacket(pkt));\r\n{\r\n var last_seqno := CTombstoneTableLookup(pkt.src, acct.receiveState);\r\n\r\n b := pkt.msg.CSingleMessage? && pkt.msg.seqno <= last_seqno;\r\n}\r\n\r\nmethod SendAckImpl(acct:CSingleDeliveryAcct, pkt:CPacket, ghost params:CParameters) returns (ack:CPacket)\r\n requires CSingleDeliveryAccountIsValid(acct, params);\r\n requires CPacketIsAbstractable(pkt);\r\n requires pkt.msg.CSingleMessage?;\r\n requires ShouldAckSingleMessage(AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct), AbstractifyCPacketToShtPacket(pkt));\r\n ensures CPacketIsAbstractable(ack);\r\n ensures SendAck(AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct), AbstractifyCPacketToShtPacket(pkt), AbstractifyCPacketToShtPacket(ack), { AbstractifyCPacketToShtPacket(ack) });\r\n ensures ack.src == pkt.dst && ack.dst == pkt.src;\r\n{\r\n ack := CPacket(pkt.src, pkt.dst, CAck(pkt.msg.seqno));\r\n}\r\n\r\nmethod MaybeAckPacketImpl(acct:CSingleDeliveryAcct, pkt:CPacket, ghost params:CParameters) returns (b:bool, ack:CPacket)\r\n requires CSingleDeliveryAccountIsValid(acct, params);\r\n requires CPacketIsAbstractable(pkt);\r\n ensures CPacketIsAbstractable(ack);\r\n ensures MaybeAckPacket(AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct), AbstractifyCPacketToShtPacket(pkt), AbstractifyCPacketToShtPacket(ack), \r\n if b then { AbstractifyCPacketToShtPacket(ack) } else {});\r\n ensures b ==> ack.src == pkt.dst && ack.dst == pkt.src;\r\n{\r\n var should_ack := ShouldAckSingleMessageImpl(acct, pkt, params);\r\n if should_ack {\r\n b := true;\r\n ack := SendAckImpl(acct, pkt, params);\r\n } else {\r\n b := false;\r\n ack := pkt;\r\n }\r\n}\r\n\r\nmethod ReceiveRealPacketImpl(acct:CSingleDeliveryAcct, pkt:CPacket, ghost params:CParameters) returns (acct':CSingleDeliveryAcct)\r\n requires CSingleDeliveryAccountIsValid(acct, params);\r\n requires CPacketIsAbstractable(pkt) && CSingleMessageIs64Bit(pkt.msg) && !pkt.msg.CInvalidMessage?; // CSingleMessageMarshallable(pkt.msg); \r\n requires pkt.msg.CSingleMessage?;\r\n ensures CSingleDeliveryAccountIsValid(acct', params);\r\n ensures ReceiveRealPacket(AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct), AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct'), AbstractifyCPacketToShtPacket(pkt));\r\n{\r\n var b := NewSingleMessageImpl(acct, pkt, params);\r\n if b {\r\n var last_seqno := CTombstoneTableLookup(pkt.src, acct.receiveState);\r\n acct' := acct.(receiveState := acct.receiveState[pkt.src := last_seqno + 1]);\r\n\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n lemma_AbstractifyMap_properties(acct.receiveState, AbstractifyEndPointToNodeIdentity, uint64_to_nat_t, RefineNodeIdentityToEndPoint);\r\n } else {\r\n acct' := acct;\r\n }\r\n}\r\n\r\nmethod ReceiveSingleMessageImpl(acct:CSingleDeliveryAcct, pkt:CPacket, ghost params:CParameters) \r\n returns (b:bool, acct':CSingleDeliveryAcct, ack:CPacket)\r\n requires CSingleDeliveryAccountIsValid(acct, params);\r\n requires CPacketIsAbstractable(pkt) && CSingleMessageIs64Bit(pkt.msg) && !pkt.msg.CInvalidMessage?; // CSingleMessageMarshallable(pkt.msg); \r\n requires CParametersIsValid(params);\r\n ensures CSingleDeliveryAccountIsValid(acct', params);\r\n ensures CPacketIsAbstractable(ack);\r\n ensures ReceiveSingleMessage(AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct), AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct'), AbstractifyCPacketToShtPacket(pkt),\r\n AbstractifyCPacketToShtPacket(ack), if b then { AbstractifyCPacketToShtPacket(ack) } else {});\r\n ensures b ==> ack.src == pkt.dst && ack.dst == pkt.src;\r\n{\r\n if pkt.msg.CAck? {\r\n acct' := ReceiveAckImpl(acct, pkt, params);\r\n b := false;\r\n } else if pkt.msg.CSingleMessage? {\r\n acct' := ReceiveRealPacketImpl(acct, pkt, params);\r\n b, ack := MaybeAckPacketImpl(acct', pkt, params);\r\n }\r\n else {\r\n assert pkt.msg.CInvalidMessage?;\r\n b := false;\r\n acct' := acct;\r\n }\r\n\r\n if !b {\r\n ack := pkt; // Ensures ack is refinable\r\n }\r\n}\r\n\r\n\r\nmethod {:timeLimitMultiplier 3} SendSingleCMessage(acct:CSingleDeliveryAcct, m:CMessage, dst:EndPoint, params:CParameters) \r\n returns (acct':CSingleDeliveryAcct, sm:CSingleMessage, shouldSend:bool)\r\n requires CSingleDeliveryAccountIsValid(acct, params);\r\n requires CMessageIsAbstractable(m);\r\n requires MessageMarshallable(m);\r\n requires ValidPhysicalAddress(dst);\r\n requires CParametersIsValid(params);\r\n ensures CSingleDeliveryAccountIsValid(acct', params);\r\n ensures CSingleMessageIsAbstractable(sm);\r\n ensures sm.CSingleMessage? ==> sm.dst == dst;\r\n ensures SendSingleMessage(AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct), AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct'),\r\n AbstractifyCMessageToRslMessage(m), AbstractifyCSingleMessageToSingleMessage(sm), AbstractifyCParametersToParameters(params), shouldSend);\r\n{\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n lemma_AbstractifyMap_properties(acct.sendState, AbstractifyEndPointToNodeIdentity, AbstractifyCAskStateToAckState, RefineNodeIdentityToEndPoint);\r\n\r\n var oldAckState := CAckStateLookup(dst, acct.sendState, params);\r\n assert CAckStateIsValid(oldAckState, dst, params);\r\n\r\n assert oldAckState.numPacketsAcked as int + |oldAckState.unAcked| <= params.max_seqno as int;\r\n if oldAckState.numPacketsAcked + |oldAckState.unAcked| as uint64 == params.max_seqno {\r\n shouldSend := false;\r\n acct' := acct;\r\n sm := CSingleMessage(0, dst, m); // Dummy message to simplify postconditions\r\n } else {\r\n var sm_new := CSingleMessage((oldAckState.numPacketsAcked + |oldAckState.unAcked| as uint64 + 1) as uint64, dst, m);\r\n //assert CSingleMessageMarshallable(sm);\r\n assert MapSeqToSeq(oldAckState.unAcked + [sm_new], AbstractifyCSingleMessageToSingleMessage) == \r\n MapSeqToSeq(oldAckState.unAcked, AbstractifyCSingleMessageToSingleMessage) + [AbstractifyCSingleMessageToSingleMessage(sm_new)];\r\n\r\n var newAckState := oldAckState.(unAcked := oldAckState.unAcked + [sm_new]);\r\n var acctInt := acct.sendState[dst := newAckState];\r\n acct' := acct.(sendState := acctInt);\r\n sm := sm_new;\r\n shouldSend := true;\r\n UnAckedListFinalEntry(AbstractifySeqOfCSingleMessageToSeqOfSingleMessage(oldAckState.unAcked), oldAckState.numPacketsAcked as int);\r\n }\r\n}\r\n\r\npredicate CombinedPreImage(seqs:seq>, combined:seq, index:int)\r\n requires 0 <= index < |combined|;\r\n{\r\n exists j, k {:trigger seqs[j][k]} :: 0 <= j < |seqs| && 0 <= k < |seqs[j]| && seqs[j][k] == combined[index]\r\n}\r\n\r\nmethod ConcatenateSeqs(seqs:seq>) returns (combined:seq)\r\n ensures forall j, k :: 0 <= j < |seqs| && 0 <= k < |seqs[j]| \r\n ==> seqs[j][k] in combined;\r\n ensures forall m :: 0 <= m < |combined| ==> CombinedPreImage(seqs, combined, m);\r\n{\r\n combined := [];\r\n var i := 0;\r\n\r\n while i < |seqs|\r\n invariant 0 <= i <= |seqs|;\r\n invariant forall j, k :: 0 <= j < i && 0 <= k < |seqs[j]| \r\n ==> seqs[j][k] in combined;\r\n invariant forall m :: 0 <= m < |combined| ==> CombinedPreImage(seqs, combined, m);\r\n {\r\n ghost var old_combined := combined;\r\n combined := combined + seqs[i];\r\n i := i + 1;\r\n forall m | 0 <= m < |combined| \r\n ensures CombinedPreImage(seqs, combined, m);\r\n {\r\n if m < |old_combined| {\r\n // Loop invariant should cover this\r\n assert CombinedPreImage(seqs, old_combined, m);\r\n } else {\r\n var m_offset := m - |old_combined|;\r\n assert seqs[i - 1][m_offset] == combined[m];\r\n assert CombinedPreImage(seqs, combined, m);\r\n }\r\n }\r\n }\r\n\r\n}\r\n\r\nlemma lemma_AbstractifyCPacketsToPackets_reverse(cps:set, p:Packet) returns (cp:CPacket)\r\n requires CPacketsIsAbstractable(cps);\r\n requires p in AbstractifyCPacketsToPackets(cps);\r\n ensures CPacketIsAbstractable(cp);\r\n ensures AbstractifyCPacketToShtPacket(cp) == p\r\n ensures cp in cps;\r\n{\r\n reveal_AbstractifyCPacketsToPackets();\r\n cp :| cp in cps && CPacketIsAbstractable(cp) && AbstractifyCPacketToShtPacket(cp) == p;\r\n}\r\n\r\nlemma lemma_AbstractifySeqOfCPacketsToSetOfShtPackets_reverse(cps:seq, p:Packet) returns (cp:CPacket)\r\n requires CPacketSeqIsAbstractable(cps);\r\n requires p in AbstractifySeqOfCPacketsToSetOfShtPackets(cps);\r\n ensures CPacketIsAbstractable(cp);\r\n ensures AbstractifyCPacketToShtPacket(cp) == p\r\n ensures cp in cps;\r\n{\r\n reveal_AbstractifySeqOfCPacketsToSetOfShtPackets();\r\n cp :| cp in cps && CPacketIsAbstractable(cp) && AbstractifyCPacketToShtPacket(cp) == p;\r\n}\r\n\r\nmethod RetransmitUnAckedPackets(acct:CSingleDeliveryAcct, src:EndPoint, ghost params:CParameters) returns (pkts:seq)\r\n requires CSingleDeliveryAccountIsValid(acct, params);\r\n requires EndPointIsAbstractable(src);\r\n ensures CPacketSeqIsAbstractable(pkts);\r\n ensures AbstractifySeqOfCPacketsToSetOfShtPackets(pkts) == UnAckedMessages(AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct), AbstractifyEndPointToNodeIdentity(src));\r\n ensures (forall p :: p in pkts ==> p.src == src && p.msg.CSingleMessage? && CSingleMessageMarshallable(p.msg));\r\n ensures (forall i :: 0 <= i < |pkts| ==> CPacketIsSendable(pkts[i]));\r\n ensures (forall i :: 0 <= i < |pkts| ==> pkts[i].msg.CSingleMessage?);\r\n ensures (forall i :: 0 <= i < |pkts| ==> CSingleMessageMarshallable(pkts[i].msg));\r\n{\r\n var pkt_set := set dst, i | dst in acct.sendState && 0 <= i < |acct.sendState[dst].unAcked| && acct.sendState[dst].unAcked[i].CSingleMessage? :: \r\n var sm := acct.sendState[dst].unAcked[i];\r\n CPacket(sm.dst, src, sm);\r\n pkts := SetToUniqueSeqConstruct(pkt_set);\r\n\r\n // Prove that everything behaves as expected\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n lemma_AbstractifyMap_properties(acct.sendState, AbstractifyEndPointToNodeIdentity, AbstractifyCAskStateToAckState, RefineNodeIdentityToEndPoint);\r\n\r\n ghost var r_pkt_set := AbstractifyCPacketsToPackets(pkt_set);\r\n ghost var r_acct := AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct);\r\n ghost var r_src := AbstractifyEndPointToNodeIdentity(src);\r\n ghost var g_set := UnAckedMessages(r_acct, r_src);\r\n\r\n forall p | p in g_set\r\n ensures p in r_pkt_set;\r\n {\r\n var dst, i :| dst in r_acct.sendState && 0 <= i < |r_acct.sendState[dst].unAcked| && r_acct.sendState[dst].unAcked[i].SingleMessage? && (var sm := r_acct.sendState[dst].unAcked[i]; p.dst == sm.dst && p.src == r_src && p.msg == sm); // Needed for the OBSERVE on the next line\r\n assert AckStateLookup(dst, r_acct.sendState) == r_acct.sendState[dst]; // OBSERVE\r\n assert UnAckedMsgForDst(r_acct, p.msg, p.dst); // OBSERVE\r\n\r\n var c_dst :| c_dst in acct.sendState && AbstractifyEndPointToNodeIdentity(c_dst) == dst;\r\n var c_sm := acct.sendState[c_dst].unAcked[i];\r\n var cp := CPacket(c_sm.dst, src, c_sm);\r\n assert c_sm.CSingleMessage?;\r\n assert CSingleMessageMarshallable(c_sm);\r\n assert cp in pkt_set; // OBSERVE\r\n }\r\n forall p | p in r_pkt_set\r\n ensures p in g_set;\r\n {\r\n var c_p := lemma_AbstractifyCPacketsToPackets_reverse(pkt_set, p);\r\n var dst, i :| dst in acct.sendState && 0 <= i < |acct.sendState[dst].unAcked| && acct.sendState[dst].unAcked[i].CSingleMessage? && (var sm := acct.sendState[dst].unAcked[i]; c_p.dst == sm.dst && c_p.src == src && c_p.msg == sm); // Needed for the OBSERVE below\r\n var r_dst := AbstractifyEndPointToNodeIdentity(dst);\r\n var r_sm := r_acct.sendState[r_dst].unAcked[i];\r\n assert Packet(r_sm.dst, r_src, r_sm) in g_set; // OBSERVE\r\n }\r\n\r\n assert r_pkt_set == g_set;\r\n\r\n ghost var r_pkt_set' := AbstractifySeqOfCPacketsToSetOfShtPackets(pkts);\r\n\r\n forall p | p in r_pkt_set\r\n ensures p in r_pkt_set';\r\n {\r\n var c_p := lemma_AbstractifyCPacketsToPackets_reverse(pkt_set, p);\r\n assert c_p in pkt_set;\r\n assert c_p in pkts; // OBSERVE\r\n }\r\n forall p | p in r_pkt_set'\r\n ensures p in r_pkt_set;\r\n {\r\n var c_p := lemma_AbstractifySeqOfCPacketsToSetOfShtPackets_reverse(pkts, p);\r\n assert c_p in pkts;\r\n assert c_p in pkt_set; // OBSERVE\r\n }\r\n}\r\n \r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Impl/SHT/SingleDeliveryState.i.dfy", "content": "include \"../Common/NodeIdentity.i.dfy\"\r\ninclude \"../Common/GenericRefinement.i.dfy\"\r\ninclude \"../../Protocol/SHT/SingleDelivery.i.dfy\"\r\ninclude \"CMessage.i.dfy\"\r\ninclude \"Parameters.i.dfy\"\r\ninclude \"PacketParsing.i.dfy\"\r\n\r\nmodule SHT__SingleDeliveryState_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\nimport opened Common__NodeIdentity_i\r\nimport opened SHT__SingleDelivery_i\r\nimport opened GenericRefinement_i\r\nimport opened SHT__CMessage_i\r\nimport opened Impl_Parameters_i\r\nimport opened SHT__PacketParsing_i\r\nimport opened SHT__Message_i\r\n\r\n// Highest sequence number we have received from each node\r\ntype CTombstoneTable = map\r\n\r\n// State about packets we've sent to each node\r\ndatatype CAckState = CAckState(numPacketsAcked:uint64, unAcked:seq)\r\ntype CSendState = map\r\n\r\ndatatype CSingleDeliveryAcct = CSingleDeliveryAcct(receiveState:CTombstoneTable, sendState:CSendState)\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\n// Useful to give this cast a name, so it can be used as a higher-order function\r\nfunction uint64_to_nat_t(u:uint64) : nat_t { u as nat_t }\r\n\r\npredicate CTombstoneTableIsAbstractable(ts:CTombstoneTable) \r\n{\r\n forall e :: e in ts ==> EndPointIsAbstractable(e)\r\n}\r\n\r\nfunction AbstractifyCTombstoneTableToTombstoneTable(ts:CTombstoneTable) : TombstoneTable\r\n requires CTombstoneTableIsAbstractable(ts);\r\n{\r\n lemma_AbstractifyEndPointToNodeIdentity_injective_forall();\r\n AbstractifyMap(ts, AbstractifyEndPointToNodeIdentity, uint64_to_nat_t, RefineNodeIdentityToEndPoint)\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Unacked list\r\n\r\npredicate CAckStateIsAbstractable(cas:CAckState) \r\n{\r\n CSingleMessageSeqIsAbstractable(cas.unAcked)\r\n}\r\n\r\nfunction AbstractifyCAskStateToAckState(cas:CAckState) : AckState\r\n requires CAckStateIsAbstractable(cas); \r\n{\r\n AckState(cas.numPacketsAcked as int, AbstractifySeqOfCSingleMessageToSeqOfSingleMessage(cas.unAcked))\r\n}\r\n\r\n\r\npredicate NoAcksInUnAcked(list:seq)\r\n{\r\n forall i :: 0 <= i < |list| ==> list[i].CSingleMessage?\r\n}\r\n\r\npredicate UnAckedListSequential(list:seq)\r\n requires NoAcksInUnAcked(list);\r\n{\r\n forall i, j :: 0 <= i && j == i + 1 && j < |list|\r\n ==> list[i].seqno as int + 1 == list[j].seqno as int\r\n}\r\n\r\npredicate CUnAckedValid(msg:CSingleMessage)\r\n{\r\n msg.CSingleMessage? && CSingleMessageIsAbstractable(msg) && CSingleMessageMarshallable(msg)\r\n}\r\n\r\npredicate CUnAckedListValid(list:seq)\r\n{\r\n (forall i :: 0 <= i < |list| ==> CUnAckedValid(list[i]))\r\n && UnAckedListSequential(list)\r\n}\r\n\r\npredicate CUnAckedListValidForDst(list:seq, dst:EndPoint)\r\n{\r\n CUnAckedListValid(list) \r\n && (forall i :: 0 <= i < |list| ==> list[i].dst == dst)\r\n}\r\n\r\npredicate CAckStateIsValid(cas:CAckState, dst:EndPoint, params:CParameters)\r\n{\r\n CAckStateIsAbstractable(cas) && CUnAckedListValidForDst(cas.unAcked, dst)\r\n && cas.numPacketsAcked as int + |cas.unAcked| <= params.max_seqno as int\r\n && (|cas.unAcked| > 0 ==> cas.unAcked[0].seqno as int == cas.numPacketsAcked as int + 1)\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\npredicate CSendStateIsAbstractable(sendState:CSendState)\r\n{\r\n MapIsAbstractable(sendState, AbstractifyEndPointToNodeIdentity, AbstractifyCAskStateToAckState, RefineNodeIdentityToEndPoint)\r\n}\r\n\r\nfunction AbstractifyCSendStateToSendState(sendState:CSendState) : SendState\r\n requires CSendStateIsAbstractable(sendState);\r\n{\r\n AbstractifyMap(sendState, AbstractifyEndPointToNodeIdentity, AbstractifyCAskStateToAckState, RefineNodeIdentityToEndPoint)\r\n}\r\n\r\npredicate CSendStateIsValid(sendState:CSendState, params:CParameters)\r\n{\r\n CSendStateIsAbstractable(sendState) \r\n && forall e :: e in sendState ==> CAckStateIsValid(sendState[e], e, params)\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\npredicate CSingleDeliveryAcctIsAbstractable(acct:CSingleDeliveryAcct) \r\n{\r\n CTombstoneTableIsAbstractable(acct.receiveState) && CSendStateIsAbstractable(acct.sendState)\r\n}\r\n\r\nfunction AbstractifyCSingleDeliveryAcctToSingleDeliveryAcct(acct:CSingleDeliveryAcct) : SingleDeliveryAcct\r\n requires CSingleDeliveryAcctIsAbstractable(acct);\r\n{\r\n SingleDeliveryAcct(AbstractifyCTombstoneTableToTombstoneTable(acct.receiveState), AbstractifyCSendStateToSendState(acct.sendState))\r\n} \r\n\r\npredicate CSingleDeliveryAccountIsValid(acct:CSingleDeliveryAcct, params:CParameters) \r\n{\r\n CSingleDeliveryAcctIsAbstractable(acct) && CSendStateIsValid(acct.sendState, params)\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/Common/Liveness/RTSchedule.i.dfy", "content": "include \"../../../Common/Collections/Maps2.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Temporal.s.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Heuristics.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Rules.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Time.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Induction.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/WF1.i.dfy\"\r\ninclude \"../../../../Libraries/Math/mul_auto.i.dfy\"\r\ninclude \"../../../../Libraries/Math/mod_auto.i.dfy\"\r\n\r\nmodule Liveness__RTSchedule_i {\r\nimport opened Collections__Maps2_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Monotonicity_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Temporal__Induction_i\r\nimport opened Temporal__WF1_i\r\nimport opened Math__mul_auto_i\r\nimport opened Math__mod_auto_i\r\nimport opened Collections__Maps2_s\r\n\r\n// NOTE: This round-robin scheduler assumes that all actions in the schedule are always enabled.\r\n// This assumption can make the spec be not machine-closed, in Lamport's terminology.\r\n// In other words, it can make the actions impossible to implement. So, unless you\r\n// want your spec to be unimplementable, make sure that every action is always enabled,\r\n// e.g., by letting it stutter if there's nothing to do. An action A is enabled if\r\n// forall s :: exists s' :: apply(A, (s, s')).\r\n\r\nlemma Lemma_RoundRobinSchedulerTimelyForAllActionsTemporal(\r\n behavior:Behavior, // The behavior we'll prove it for\r\n next_action_type_fun:imap, // A function that takes a step and computes which action type has priority\r\n real_time_fun:imap, // A function that takes a step and computes at what real time it happened\r\n scheduler_action:temporal, // The subaction of 'next' that executes the scheduler\r\n schedule:seq, // The schedule the scheduler follows\r\n start_step:int, // The step at which the scheduler starts executing regularly\r\n interval:int // The maximum interval between scheduler actions during the regular-execution period\r\n )\r\n requires imaptotal(behavior)\r\n requires imaptotal(next_action_type_fun)\r\n requires imaptotal(real_time_fun)\r\n\r\n // The priority starts as a valid value. Note that this also implies the schedule has at least one action.\r\n requires 0 <= next_action_type_fun[0] < |schedule|\r\n\r\n // The regular-execution period is sensible.\r\n requires 0 <= start_step\r\n requires interval > 0\r\n\r\n // Every step either invokes the scheduler or leaves the action priority unchanged.\r\n requires sat(0, always(SchedulerActsOrNextActionTypeUnchangedTemporal(behavior, next_action_type_fun, scheduler_action)))\r\n\r\n // If the scheduler takes a step, it takes an action of the prioritized type, then gives\r\n // priority to the next action type in round-robin order.\r\n requires forall i {:trigger sat(i, scheduler_action)} :: 0 <= i && sat(i, scheduler_action) ==>\r\n var action_type_index := next_action_type_fun[i];\r\n && (0 <= action_type_index < |schedule| ==> sat(i, schedule[action_type_index]))\r\n && next_action_type_fun[i+1] == (action_type_index + 1) % |schedule|\r\n\r\n // Time moves forward.\r\n requires monotonic_from(0, real_time_fun)\r\n\r\n // The scheduler takes at least one step every interval during the epoch during which it's regularly scheduled.\r\n requires sat(start_step, always(eventuallynextwithin(scheduler_action, interval, real_time_fun)))\r\n\r\n // For each action type, an action of that type will happen in any period of duration (schedule-size * interval)\r\n // that is within the regular-execution period.\r\n ensures forall action_type_index ::\r\n 0 <= action_type_index < |schedule| ==>\r\n sat(start_step, always(eventuallynextwithin(schedule[action_type_index], interval * |schedule|, real_time_fun)))\r\n{\r\n var b := behavior;\r\n var span := interval;\r\n var i0 := start_step;\r\n var naf := next_action_type_fun;\r\n var n := |schedule|;\r\n var timefun := real_time_fun;\r\n var next_action := SchedulerActsOrNextActionTypeUnchangedTemporal(behavior, next_action_type_fun, scheduler_action);\r\n assert sat(0, always(next_action));\r\n\r\n forall ensures forall i {:trigger naf[i]} :: TLe(i0, i) ==> 0 <= naf[i] < n\r\n {\r\n TemporalAssist();\r\n var x := stepmap(imap i :: 0 <= naf[i] < n);\r\n assert sat(0, x);\r\n forall i | TLe(0, i)\r\n ensures sat(i, imply(x, next(x)))\r\n {\r\n }\r\n TemporalInductionNext(0, x);\r\n assert sat(i0, always(stepmap(imap i :: 0 <= naf[i] < n)));\r\n }\r\n\r\n forall a0 | 0 <= a0 < n\r\n ensures sat(i0, always(eventuallynextwithin(schedule[a0], span * n, timefun)))\r\n {\r\n var d := imap i :: 1 + ((a0 - naf[i]) % n);\r\n var goal := schedule[a0];\r\n\r\n forall ensures sat(i0, always(nextOrDecreaseWithin(goal, d, span, timefun)))\r\n {\r\n TemporalAssist();\r\n forall i1 {:trigger TLe(i0, i1)} | TLe(i0, i1)\r\n ensures sat(i1, nextOrDecreaseWithin(goal, d, span, timefun))\r\n {\r\n var i2 := earliestActionWithin(i1, scheduler_action, span, timefun);\r\n assert TLe(i1, i2);\r\n assert forall i :: TLe(i1, i) && TLe(i, i2 - 1) ==> sat(i, not(scheduler_action));\r\n var a2 := naf[i2];\r\n if (a2 != a0)\r\n {\r\n forall ensures d[i2 + 1] < d[i1]\r\n {\r\n forall ensures naf[i1] == a2\r\n {\r\n var indF := imap i :: naf[i1] == naf[i];\r\n forall i | TLe(i1, i) && TLe(i + 1, i2) && indF[i]\r\n ensures indF[i + 1]\r\n {\r\n assert sat(i, next_action);\r\n }\r\n Lemma_imapInductionRange(i1, i2, indF);\r\n }\r\n Lemma_mod_incr_decreases(a0, a2, n);\r\n }\r\n }\r\n assert sat(i1, eventuallynextwithin(or(goal, nextDecrease(i1, d)), span, timefun));\r\n }\r\n assert sat(i0, always(nextOrDecreaseWithin(goal, d, span, timefun)));\r\n }\r\n\r\n Lemma_EventuallynextWithinSpans(i0, d, goal, span, timefun);\r\n Lemma_EventuallynextWithinBound(i0, d, n, goal, span, timefun);\r\n assert sat(i0, always(eventuallynextwithin(schedule[a0], span * n, timefun)));\r\n }\r\n}\r\n\r\nlemma Lemma_mod_incr_decreases(x:int, y:int, n:int)\r\n requires 0 <= x < n\r\n requires 0 <= y < n\r\n requires x != y\r\n ensures (x - ((y + 1) % n)) % n < (x - y) % n\r\n{\r\n lemma_mod_auto(n);\r\n}\r\n\r\nfunction{:opaque} SchedulerActsOrNextActionTypeUnchangedTemporal(\r\n behavior:Behavior,\r\n next_action_type_fun:imap,\r\n scheduler_action:temporal\r\n ):temporal\r\n requires forall i :: i in behavior // TODO: Replace with imaptotal\r\n requires imaptotal(next_action_type_fun)\r\n ensures forall i {:trigger sat(i, SchedulerActsOrNextActionTypeUnchangedTemporal(behavior, next_action_type_fun, scheduler_action))} ::\r\n sat(i, SchedulerActsOrNextActionTypeUnchangedTemporal(behavior, next_action_type_fun, scheduler_action)) <==>\r\n (sat(i, scheduler_action) || next_action_type_fun[i] == next_action_type_fun[i+1])\r\n{\r\n stepmap(imap i :: sat(i, scheduler_action) || next_action_type_fun[i] == next_action_type_fun[i+1])\r\n}\r\n\r\nlemma Lemma_RoundRobinSchedulerEventuallyPerformsNextAction(\r\n behavior:Behavior,\r\n next_action_type_fun:imap,\r\n scheduler_action:temporal,\r\n schedule:seq,\r\n start_step:int,\r\n earliest_step:int,\r\n action_type:int\r\n ) returns\r\n (action_step:int)\r\n requires imaptotal(behavior)\r\n requires imaptotal(next_action_type_fun)\r\n requires 0 <= start_step <= earliest_step\r\n requires 0 <= action_type < |schedule|\r\n requires next_action_type_fun[earliest_step] == action_type\r\n requires sat(0, always(SchedulerActsOrNextActionTypeUnchangedTemporal(behavior, next_action_type_fun, scheduler_action)))\r\n requires forall i {:trigger sat(i, scheduler_action)} :: 0 <= i && sat(i, scheduler_action) ==>\r\n var action_type_index := next_action_type_fun[i];\r\n && (0 <= action_type_index < |schedule| ==> sat(i, schedule[action_type_index]))\r\n && next_action_type_fun[i+1] == (action_type_index + 1) % |schedule|\r\n requires sat(start_step, always(eventual(scheduler_action)))\r\n ensures earliest_step <= action_step\r\n ensures sat(action_step, schedule[action_type])\r\n ensures next_action_type_fun[action_step+1] == (action_type + 1) % |schedule|\r\n{\r\n TemporalDeduceFromAlways(start_step, earliest_step, eventual(scheduler_action));\r\n var later_action_step := TemporalDeduceFromEventual(earliest_step, scheduler_action);\r\n\r\n var P := stepmap(imap i :: next_action_type_fun[i] == action_type);\r\n var Q := and(schedule[action_type], next(stepmap(imap i :: next_action_type_fun[i] == (action_type + 1) % |schedule|)));\r\n\r\n forall j | earliest_step <= j\r\n ensures sat(j, TemporalWF1Req1(P, Q))\r\n {\r\n TemporalDeduceFromAlways(0, j, SchedulerActsOrNextActionTypeUnchangedTemporal(behavior, next_action_type_fun, scheduler_action));\r\n }\r\n\r\n action_step := TemporalWF1Specific(earliest_step, later_action_step, P, Q);\r\n}\r\n\r\nlemma Lemma_RoundRobinSchedulerEventuallyPerformsCertainNextAction(\r\n behavior:Behavior,\r\n next_action_type_fun:imap,\r\n scheduler_action:temporal,\r\n schedule:seq,\r\n start_step:int,\r\n earliest_step:int,\r\n next_action_type:int,\r\n action_type:int\r\n ) returns\r\n (action_step:int)\r\n requires imaptotal(behavior)\r\n requires imaptotal(next_action_type_fun)\r\n requires 0 <= start_step <= earliest_step\r\n requires 0 <= next_action_type < |schedule|\r\n requires 0 <= action_type < |schedule|\r\n requires next_action_type_fun[earliest_step] == next_action_type\r\n requires sat(0, always(SchedulerActsOrNextActionTypeUnchangedTemporal(behavior, next_action_type_fun, scheduler_action)))\r\n requires forall i {:trigger sat(i, scheduler_action)} :: 0 <= i && sat(i, scheduler_action) ==>\r\n var action_type_index := next_action_type_fun[i];\r\n && (0 <= action_type_index < |schedule| ==> sat(i, schedule[action_type_index]))\r\n && next_action_type_fun[i+1] == (action_type_index + 1) % |schedule|\r\n requires sat(start_step, always(eventual(scheduler_action)))\r\n ensures earliest_step <= action_step\r\n ensures sat(action_step, schedule[action_type])\r\n ensures next_action_type_fun[action_step+1] == (action_type + 1) % |schedule|\r\n decreases (|schedule| + action_type - next_action_type) % |schedule|\r\n{\r\n if action_type == next_action_type\r\n {\r\n action_step := Lemma_RoundRobinSchedulerEventuallyPerformsNextAction(behavior, next_action_type_fun, scheduler_action,\r\n schedule, start_step, earliest_step, action_type);\r\n return;\r\n }\r\n\r\n var earlier_action_step := Lemma_RoundRobinSchedulerEventuallyPerformsNextAction(behavior, next_action_type_fun,\r\n scheduler_action, schedule, start_step,\r\n earliest_step, next_action_type);\r\n\r\n lemma_mod_auto(|schedule|);\r\n\r\n action_step := Lemma_RoundRobinSchedulerEventuallyPerformsCertainNextAction(behavior, next_action_type_fun, scheduler_action,\r\n schedule, start_step, earlier_action_step + 1,\r\n (next_action_type + 1) % |schedule|, action_type);\r\n}\r\n\r\nlemma Lemma_RoundRobinSchedulerEventuallyPerformsSpecificAction(\r\n behavior:Behavior, // The behavior we'll prove it for\r\n next_action_type_fun:imap, // A function that takes a step and computes which action type has priority\r\n scheduler_action:temporal, // The subaction of 'next' that executes the scheduler\r\n schedule:seq, // The schedule the scheduler follows\r\n start_step:int, // The step at which the scheduler starts executing regularly\r\n earliest_step:int, // The step from which we need to find a subsequent step that takes the action\r\n action_type:int // The action type to find an action for\r\n ) returns\r\n (action_step:int)\r\n requires imaptotal(behavior)\r\n requires imaptotal(next_action_type_fun)\r\n\r\n // The priority starts as a valid value. Note that this also implies the schedule has at least one action.\r\n requires 0 <= next_action_type_fun[0] < |schedule|\r\n\r\n // The regular-execution period is sensible.\r\n requires 0 <= start_step\r\n\r\n // The requested parameters are sensible.\r\n requires start_step <= earliest_step\r\n requires 0 <= action_type < |schedule|\r\n\r\n // Every step either invokes the scheduler or leaves the action priority unchanged.\r\n requires sat(0, always(SchedulerActsOrNextActionTypeUnchangedTemporal(behavior, next_action_type_fun, scheduler_action)))\r\n\r\n // If the scheduler takes a step, it takes an action of the prioritized type, then gives\r\n // priority to the next action type in round-robin order.\r\n requires forall i {:trigger sat(i, scheduler_action)} :: 0 <= i && sat(i, scheduler_action) ==>\r\n var action_type_index := next_action_type_fun[i];\r\n && (0 <= action_type_index < |schedule| ==> sat(i, schedule[action_type_index]))\r\n && next_action_type_fun[i+1] == (action_type_index + 1) % |schedule|\r\n\r\n // The scheduler takes at least one step every interval during the epoch during which it's regularly scheduled.\r\n requires sat(start_step, always(eventual(scheduler_action)))\r\n\r\n ensures earliest_step <= action_step\r\n ensures sat(action_step, schedule[action_type])\r\n{\r\n var x := stepmap(imap i :: 0 <= next_action_type_fun[i] < |schedule|);\r\n forall i | 0 <= i\r\n ensures sat(i, imply(x, next(x)))\r\n {\r\n reveal imply();\r\n reveal next();\r\n TemporalDeduceFromAlways(0, i, SchedulerActsOrNextActionTypeUnchangedTemporal(behavior, next_action_type_fun, scheduler_action));\r\n }\r\n TemporalInductionNext(0, x);\r\n TemporalDeduceFromAlways(0, earliest_step, x);\r\n\r\n var next_action_type := next_action_type_fun[earliest_step];\r\n action_step := Lemma_RoundRobinSchedulerEventuallyPerformsCertainNextAction(behavior, next_action_type_fun, scheduler_action,\r\n schedule, start_step, earliest_step, next_action_type,\r\n action_type);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/Common/NodeIdentity.i.dfy", "content": "include \"NodeIdentity.s.dfy\"\r\ninclude \"../../Common/Native/Io.s.dfy\"\r\n\r\nmodule Concrete_NodeIdentity_i refines Common__NodeIdentity_s {\r\n import opened Native__Io_s\r\n export Spec provides NodeIdentity\r\n export reveals *\r\n\r\n type NodeIdentity = EndPoint\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/Common/NodeIdentity.s.dfy", "content": "abstract module Common__NodeIdentity_s {\r\n type NodeIdentity(==)\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/Common/UpperBound.s.dfy", "content": "module Common__UpperBound_s {\r\n\r\ndatatype UpperBound = UpperBoundFinite(n:int) | UpperBoundInfinite()\r\n\r\npredicate LeqUpperBound(x:int, u:UpperBound)\r\n{\r\n match u\r\n case UpperBoundFinite(n) => x <= n\r\n case UpperBoundInfinite => true\r\n}\r\n\r\npredicate LtUpperBound(x:int, u:UpperBound)\r\n{\r\n match u\r\n case UpperBoundFinite(n) => x < n\r\n case UpperBoundInfinite => true\r\n}\r\n \r\nfunction UpperBoundedAddition(x:int, y:int, u:UpperBound):int\r\n{\r\n if LeqUpperBound(x + y, u) then x + y else u.n\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/Acks.i.dfy", "content": "include \"Constants.i.dfy\"\r\ninclude \"Actions.i.dfy\"\r\ninclude \"PacketSending.i.dfy\"\r\n\r\nmodule LivenessProof__Acks_i {\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Environment_s\r\nimport opened LivenessProof__Actions_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Constants_i\r\nimport opened LivenessProof__PacketSending_i\r\nimport opened LiveSHT__Environment_i\r\nimport opened LiveSHT__SHT_i\r\nimport opened LiveSHT__SHTRefinement_i\r\nimport opened SHT__Configuration_i\r\nimport opened SHT__SingleDelivery_i\r\nimport opened Temporal__Temporal_s\r\n\r\nlemma Lemma_RecipientSequenceNumberMonotonicOneStep(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n sender:NodeIdentity,\r\n recipient_idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1);\r\n requires 0 <= i;\r\n requires 0 <= recipient_idx < |c.hostIds|;\r\n ensures 0 <= recipient_idx < |b[i].hosts|;\r\n ensures 0 <= recipient_idx < |b[i+1].hosts|;\r\n ensures TombstoneTableLookup(sender, b[i+1].hosts[recipient_idx].host.sd.receiveState) >= TombstoneTableLookup(sender, b[i].hosts[recipient_idx].host.sd.receiveState);\r\n{\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, i+1);\r\n Lemma_AssumptionsMakeValidTransition(b, c, i);\r\n\r\n if b[i+1].hosts[recipient_idx] == b[i].hosts[recipient_idx]\r\n {\r\n return;\r\n }\r\n\r\n var ap := Lemma_ActionThatChangesHostIsThatHostsAction(b, c, i, recipient_idx);\r\n}\r\n\r\nlemma Lemma_RecipientSequenceNumberMonotonic(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n j:int,\r\n sender:NodeIdentity,\r\n recipient_idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, j);\r\n requires 0 <= i <= j;\r\n requires 0 <= recipient_idx < |c.hostIds|;\r\n ensures 0 <= recipient_idx < |b[i].hosts|;\r\n ensures 0 <= recipient_idx < |b[j].hosts|;\r\n ensures TombstoneTableLookup(sender, b[j].hosts[recipient_idx].host.sd.receiveState) >= TombstoneTableLookup(sender, b[i].hosts[recipient_idx].host.sd.receiveState);\r\n{\r\n if i == j\r\n {\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n return;\r\n }\r\n\r\n Lemma_RecipientSequenceNumberMonotonic(b, c, i, j-1, sender, recipient_idx);\r\n Lemma_RecipientSequenceNumberMonotonicOneStep(b, c, j-1, sender, recipient_idx);\r\n}\r\n\r\nlemma Lemma_SenderSequenceNumberMonotonicOneStep(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n recipient:NodeIdentity,\r\n sender_idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1);\r\n requires 0 <= i;\r\n requires 0 <= sender_idx < |c.hostIds|;\r\n ensures 0 <= sender_idx < |b[i].hosts|;\r\n ensures 0 <= sender_idx < |b[i+1].hosts|;\r\n ensures AckStateLookup(recipient, b[i+1].hosts[sender_idx].host.sd.sendState).numPacketsAcked >=\r\n AckStateLookup(recipient, b[i].hosts[sender_idx].host.sd.sendState).numPacketsAcked;\r\n{\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, i+1);\r\n Lemma_AssumptionsMakeValidTransition(b, c, i);\r\n\r\n if b[i+1].hosts[sender_idx] == b[i].hosts[sender_idx]\r\n {\r\n return;\r\n }\r\n\r\n var ap := Lemma_ActionThatChangesHostIsThatHostsAction(b, c, i, sender_idx);\r\n}\r\n\r\nlemma Lemma_SenderSequenceNumberMonotonic(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n j:int,\r\n recipient:NodeIdentity,\r\n sender_idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, j);\r\n requires 0 <= i <= j;\r\n requires 0 <= sender_idx < |c.hostIds|;\r\n ensures 0 <= sender_idx < |b[i].hosts|;\r\n ensures 0 <= sender_idx < |b[j].hosts|;\r\n ensures AckStateLookup(recipient, b[j].hosts[sender_idx].host.sd.sendState).numPacketsAcked >=\r\n AckStateLookup(recipient, b[i].hosts[sender_idx].host.sd.sendState).numPacketsAcked;\r\n{\r\n if i == j\r\n {\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n return;\r\n }\r\n\r\n Lemma_SenderSequenceNumberMonotonic(b, c, i, j-1, recipient, sender_idx);\r\n Lemma_SenderSequenceNumberMonotonicOneStep(b, c, j-1, recipient, sender_idx);\r\n}\r\n\r\nlemma Lemma_AckPacketBeforeSenderSequenceNumber(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n src_idx:int,\r\n dst_idx:int,\r\n p:LSHTPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires p in b[i].environment.sentPackets;\r\n requires p.msg.Ack?;\r\n requires 0 <= src_idx < |c.hostIds|;\r\n requires 0 <= dst_idx < |c.hostIds|;\r\n requires p.src == c.hostIds[dst_idx];\r\n requires p.dst == c.hostIds[src_idx];\r\n ensures 0 <= dst_idx < |b[i].hosts|;\r\n ensures TombstoneTableLookup(c.hostIds[src_idx], b[i].hosts[dst_idx].host.sd.receiveState) >= p.msg.ack_seqno;\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n Lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n Lemma_ConstantsAllConsistent(b, c, i-1);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n Lemma_AckPacketBeforeSenderSequenceNumber(b, c, i-1, src_idx, dst_idx, p);\r\n Lemma_RecipientSequenceNumberMonotonicOneStep(b, c, i-1, c.hostIds[src_idx], dst_idx);\r\n return;\r\n }\r\n\r\n var ap := Lemma_ActionThatSendsPacketIsActionOfSource(b, c, i-1, p);\r\n Lemma_GetHostIndexIsUnique(c, src_idx);\r\n Lemma_GetHostIndexIsUnique(c, dst_idx);\r\n}\r\n\r\nlemma Lemma_NumPacketsAckedBeforeRecipientSequenceNumber(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n src_idx:int,\r\n dst_idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= src_idx < |c.hostIds|;\r\n requires 0 <= dst_idx < |c.hostIds|;\r\n ensures 0 <= src_idx < |b[i].hosts|;\r\n ensures 0 <= dst_idx < |b[i].hosts|;\r\n ensures TombstoneTableLookup(c.hostIds[src_idx], b[i].hosts[dst_idx].host.sd.receiveState) >=\r\n AckStateLookup(c.hostIds[dst_idx], b[i].hosts[src_idx].host.sd.sendState).numPacketsAcked;\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n Lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n Lemma_ConstantsAllConsistent(b, c, i-1);\r\n var src := c.hostIds[src_idx];\r\n var dst := c.hostIds[dst_idx];\r\n var host := b[i-1].hosts[src_idx].host;\r\n var host' := b[i].hosts[src_idx].host;\r\n \r\n Lemma_NumPacketsAckedBeforeRecipientSequenceNumber(b, c, i-1, src_idx, dst_idx);\r\n Lemma_RecipientSequenceNumberMonotonicOneStep(b, c, i-1, c.hostIds[src_idx], dst_idx);\r\n Lemma_GetHostIndexIsUnique(c, src_idx);\r\n Lemma_GetHostIndexIsUnique(c, dst_idx);\r\n\r\n if AckStateLookup(dst, host.sd.sendState).numPacketsAcked == AckStateLookup(dst, host'.sd.sendState).numPacketsAcked\r\n {\r\n return;\r\n }\r\n\r\n var ap := Lemma_ActionThatChangesHostIsThatHostsAction(b, c, i-1, src_idx);\r\n assert ap.nextActionIndex == 0;\r\n assert ap.ios[0].LIoOpReceive?;\r\n assert IsValidLIoOp(ap.ios[0], src, b[i-1].environment);\r\n Lemma_AckPacketBeforeSenderSequenceNumber(b, c, i, src_idx, dst_idx, ap.ios[0].r);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/Actions.i.dfy", "content": "include \"Constants.i.dfy\"\r\ninclude \"../RefinementProof/SHTRefinement.i.dfy\"\r\n\r\nmodule LivenessProof__Actions_i {\r\nimport opened Collections__Maps2_s\r\nimport opened Environment_s\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Constants_i\r\nimport opened LiveSHT__Environment_i\r\nimport opened LiveSHT__EnvironmentRefinement_i\r\nimport opened LiveSHT__Scheduler_i\r\nimport opened LiveSHT__SHT_i\r\nimport opened LiveSHT__SHTRefinement_i\r\nimport opened SHT__Configuration_i\r\nimport opened SHT__Host_i\r\nimport opened SHT__Network_i\r\nimport opened Temporal__Temporal_s\r\n\r\npredicate PacketProcessedViaIos(\r\n ps:LSHT_State,\r\n ps':LSHT_State,\r\n p:LSHTPacket,\r\n idx:int,\r\n ios:seq\r\n )\r\n{\r\n |ios| > 0\r\n && LIoOpReceive(p) == ios[0]\r\n && 0 <= idx < |ps.config.hostIds|\r\n && p.dst == ps.config.hostIds[idx]\r\n && ps.environment.nextStep == LEnvStepHostIos(p.dst, ios)\r\n && LSHT_NextOneHost(ps, ps', idx, ios)\r\n && LHost_ReceivePacket_Next(ps.hosts[idx].host, ps'.hosts[idx].host, ios)\r\n}\r\n\r\npredicate PacketProcessedDuringAction(\r\n ps:LSHT_State,\r\n p:LSHTPacket\r\n )\r\n{\r\n ps.environment.nextStep.LEnvStepHostIos? && LIoOpReceive(p) in ps.environment.nextStep.ios\r\n}\r\n\r\nfunction{:opaque} PacketProcessedTemporal(\r\n b:Behavior,\r\n p:LSHTPacket\r\n ):temporal\r\n requires imaptotal(b);\r\n ensures forall i {:trigger sat(i, PacketProcessedTemporal(b, p))} ::\r\n sat(i, PacketProcessedTemporal(b, p)) <==> PacketProcessedDuringAction(b[i], p);\r\n{\r\n stepmap(imap i :: PacketProcessedDuringAction(b[i], p))\r\n}\r\n\r\npredicate PacketSentDuringAction(\r\n ps:LSHT_State,\r\n p:LSHTPacket\r\n )\r\n{\r\n ps.environment.nextStep.LEnvStepHostIos? && LIoOpSend(p) in ps.environment.nextStep.ios\r\n}\r\n\r\nfunction{:opaque} PacketSentTemporal(\r\n b:Behavior,\r\n p:LSHTPacket\r\n ):temporal\r\n requires imaptotal(b);\r\n ensures forall i {:trigger sat(i, PacketSentTemporal(b, p))} ::\r\n sat(i, PacketSentTemporal(b, p)) <==> PacketSentDuringAction(b[i], p);\r\n{\r\n stepmap(imap i :: PacketSentDuringAction(b[i], p))\r\n}\r\n\r\ndatatype SHTActionParams = SHTActionParams(idx:int, ios:seq, host:Host, host':Host, recv:set, out:set,\r\n nextActionIndex:int, resendCount:int, pkt:Packet, ack:Packet)\r\n\r\npredicate SHTActionOccurred(ss:LSHT_State, ss':LSHT_State, ap:SHTActionParams)\r\n{\r\n 0 <= ap.idx < |ss.hosts|\r\n && 0 <= ap.idx < |ss.config.hostIds|\r\n && 0 <= ap.idx < |ss'.hosts|\r\n && ss.environment.nextStep.LEnvStepHostIos?\r\n && ss.environment.nextStep.actor == ss.config.hostIds[ap.idx]\r\n && ss.environment.nextStep.ios == ap.ios\r\n && ap.host == ss.hosts[ap.idx].host\r\n && ap.host' == ss'.hosts[ap.idx].host\r\n && ap.recv == PacketsTo(LSHTEnvironment_Refine(ss.environment), ap.host.me)\r\n && ap.out == ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ap.ios))\r\n && ap.nextActionIndex == ss.hosts[ap.idx].nextActionIndex\r\n && ap.resendCount == ss'.hosts[ap.idx].resendCount\r\n && LScheduler_Next(ss.hosts[ap.idx], ss'.hosts[ap.idx], ap.ios)\r\n && GetHostIndex(ss.config.hostIds[ap.idx], ss.config) == ap.idx\r\n && ( ( ap.nextActionIndex == 0\r\n && |ap.ios| == 1\r\n && ap.ios[0].LIoOpTimeoutReceive?\r\n && ap.host == ap.host')\r\n || ( ap.nextActionIndex == 0\r\n && |ap.ios| > 0\r\n && ap.ios[0].LIoOpReceive?\r\n && (forall i{:trigger ap.ios[i].LIoOpSend?} :: 1 <= i < |ap.ios| ==> ap.ios[i].LIoOpSend?)\r\n && ap.pkt == LSHTPacketToPacket(ap.ios[0].r)\r\n && LSHT_NextOneHost(ss, ss', ap.idx, ap.ios)\r\n && Host_Next(ap.host, ap.host', ap.recv, ap.out)\r\n && ReceivePacket(ap.host, ap.host', ap.pkt, ap.out, ap.ack))\r\n || ( ap.nextActionIndex == 1\r\n && (forall io{:trigger io in ap.ios} :: io in ap.ios ==> io.LIoOpSend?)\r\n && LSHT_NextOneHost(ss, ss', ap.idx, ap.ios)\r\n && Host_Next(ap.host, ap.host', ap.recv, ap.out)\r\n && ProcessReceivedPacket(ap.host, ap.host', ap.out))\r\n || ( ap.nextActionIndex == 2\r\n && (forall io{:trigger io in ap.ios} :: io in ap.ios ==> io.LIoOpSend?)\r\n && LSHT_NextOneHost(ss, ss', ap.idx, ap.ios)\r\n && (if ap.resendCount != 0 then\r\n ap.host == ap.host'\r\n else\r\n Host_Next(ap.host, ap.host', ap.recv, ap.out)\r\n && SpontaneouslyRetransmit(ap.host, ap.host', ap.out))))\r\n}\r\n\r\nlemma Lemma_NextActionIndexAlwaysWithinRange(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= idx < |b[i].hosts|;\r\n ensures 0 <= b[i].hosts[idx].nextActionIndex < 3;\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n Lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n Lemma_ConstantsAllConsistent(b, c, i-1);\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n Lemma_NextActionIndexAlwaysWithinRange(b, c, i-1, idx);\r\n}\r\n\r\n///////////////////////////////\r\n// ACTION REFINEMENT\r\n///////////////////////////////\r\n\r\nlemma Lemma_GetParametersOfAction0(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n idx:int\r\n ) returns\r\n (ap:SHTActionParams)\r\n requires IsValidBehaviorPrefix(b, c, i+1);\r\n requires 0 <= i;\r\n requires 0 <= idx < |b[i].hosts|;\r\n requires 0 <= idx < |c.hostIds|;\r\n requires b[i].environment.nextStep.LEnvStepHostIos?;\r\n requires b[i].environment.nextStep.actor == c.hostIds[idx];\r\n requires b[i].hosts[idx].nextActionIndex == 0;\r\n ensures SHTActionOccurred(b[i], b[i+1], ap);\r\n ensures ap.idx == idx;\r\n ensures ap.nextActionIndex == 0;\r\n{\r\n Lemma_AssumptionsMakeValidTransition(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, i+1);\r\n\r\n var scheduler := b[i].hosts[idx];\r\n var scheduler' := b[i+1].hosts[idx];\r\n\r\n var host := scheduler.host;\r\n var host' := scheduler'.host;\r\n var recv := PacketsTo(LSHTEnvironment_Refine(b[i].environment), host.me);\r\n var resendCount := scheduler'.resendCount;\r\n\r\n Lemma_GetHostIndexIsUnique(b[i].config, idx);\r\n\r\n assert LSHT_Next(b[i], b[i+1]);\r\n //assert !LSHT_NextEnvironment(b[i], b[i+1]);\r\n assert !(exists idx, ios :: LSHT_NextExternal(b[i], b[i+1], idx, ios));\r\n assert exists idx, ios :: LSHT_NextOneHost(b[i], b[i+1], idx, ios);\r\n\r\n var other_idx:int, ios:seq :| LSHT_NextOneHost(b[i], b[i+1], other_idx, ios);\r\n assert HostsDistinct(c.hostIds, idx, other_idx);\r\n\r\n var out := ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios));\r\n assert out == ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios));\r\n\r\n var pkt:Packet, ack:Packet;\r\n if ios[0].LIoOpTimeoutReceive?\r\n {\r\n }\r\n else\r\n {\r\n assert IsValidLIoOp(ios[0], host.me, b[i].environment);\r\n assert LHost_ReceivePacketWithoutReadingClock(host, host', ios);\r\n pkt := LSHTPacketToPacket(ios[0].r);\r\n ack :| ReceivePacket(host, host', pkt, out, ack);\r\n }\r\n\r\n ap := SHTActionParams(idx, ios, host, host', recv, out, 0, resendCount, pkt, ack);\r\n}\r\n\r\nlemma Lemma_GetParametersOfAction1(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n idx:int\r\n ) returns\r\n (ap:SHTActionParams)\r\n requires IsValidBehaviorPrefix(b, c, i+1);\r\n requires 0 <= i;\r\n requires 0 <= idx < |b[i].hosts|;\r\n requires 0 <= idx < |c.hostIds|;\r\n requires b[i].environment.nextStep.LEnvStepHostIos?;\r\n requires b[i].environment.nextStep.actor == c.hostIds[idx];\r\n requires b[i].hosts[idx].nextActionIndex == 1;\r\n ensures SHTActionOccurred(b[i], b[i+1], ap);\r\n ensures ap.idx == idx;\r\n ensures ap.nextActionIndex == 1;\r\n{\r\n Lemma_AssumptionsMakeValidTransition(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, i+1);\r\n\r\n var scheduler := b[i].hosts[idx];\r\n var scheduler' := b[i+1].hosts[idx];\r\n var host := scheduler.host;\r\n var host' := scheduler'.host;\r\n var recv := PacketsTo(LSHTEnvironment_Refine(b[i].environment), host.me);\r\n var resendCount := scheduler'.resendCount;\r\n var pkt:Packet, ack:Packet;\r\n\r\n Lemma_GetHostIndexIsUnique(b[i].config, idx);\r\n\r\n var other_idx, ios :| LSHT_NextOneHost(b[i], b[i+1], other_idx, ios);\r\n assert HostsDistinct(c.hostIds, idx, other_idx);\r\n var out := LSHTIoSeq_RefineAsSends(ios);\r\n assert out == ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios));\r\n\r\n ap := SHTActionParams(idx, ios, host, host', recv, out, 1, resendCount, pkt, ack);\r\n}\r\n\r\nlemma Lemma_GetParametersOfAction2(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n idx:int\r\n ) returns\r\n (ap:SHTActionParams)\r\n requires IsValidBehaviorPrefix(b, c, i+1);\r\n requires 0 <= i;\r\n requires 0 <= idx < |b[i].hosts|;\r\n requires 0 <= idx < |c.hostIds|;\r\n requires b[i].environment.nextStep.LEnvStepHostIos?;\r\n requires b[i].environment.nextStep.actor == c.hostIds[idx];\r\n requires b[i].hosts[idx].nextActionIndex == 2;\r\n ensures SHTActionOccurred(b[i], b[i+1], ap);\r\n ensures ap.idx == idx;\r\n ensures ap.nextActionIndex == 2;\r\n{\r\n Lemma_AssumptionsMakeValidTransition(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, i+1);\r\n\r\n var scheduler := b[i].hosts[idx];\r\n var scheduler' := b[i+1].hosts[idx];\r\n var host := scheduler.host;\r\n var host' := scheduler'.host;\r\n var recv := PacketsTo(LSHTEnvironment_Refine(b[i].environment), host.me);\r\n var resendCount := scheduler'.resendCount;\r\n var pkt:Packet, ack:Packet;\r\n\r\n Lemma_GetHostIndexIsUnique(b[i].config, idx);\r\n\r\n var other_idx, ios :| LSHT_NextOneHost(b[i], b[i+1], other_idx, ios);\r\n assert HostsDistinct(c.hostIds, idx, other_idx);\r\n var out := LSHTIoSeq_RefineAsSends(ios);\r\n assert out == ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios));\r\n\r\n ap := SHTActionParams(idx, ios, host, host', recv, out, 2, resendCount, pkt, ack);\r\n assert ap.nextActionIndex == 2;\r\n if ap.resendCount != 0\r\n {\r\n assert ap.host == ap.host';\r\n }\r\n else\r\n {\r\n assert SpontaneouslyRetransmit(ap.host, ap.host', ap.out);\r\n }\r\n}\r\n\r\nlemma Lemma_GetParametersOfAction(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int\r\n ) returns\r\n (ap:SHTActionParams)\r\n requires IsValidBehaviorPrefix(b, c, i+1);\r\n requires 0 <= i;\r\n requires b[i].environment.nextStep.LEnvStepHostIos?;\r\n requires b[i].environment.nextStep.actor in b[i].config.hostIds;\r\n ensures SHTActionOccurred(b[i], b[i+1], ap);\r\n{\r\n Lemma_AssumptionsMakeValidTransition(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, i+1);\r\n\r\n var idx, ios :| LSHT_NextOneHost(b[i], b[i+1], idx, ios);\r\n Lemma_GetHostIndexIsUnique(b[i].config, idx);\r\n var scheduler := b[i].hosts[idx];\r\n var nextActionIndex := scheduler.nextActionIndex;\r\n\r\n Lemma_NextActionIndexAlwaysWithinRange(b, c, i, idx);\r\n if nextActionIndex == 0\r\n {\r\n ap := Lemma_GetParametersOfAction0(b, c, i, idx);\r\n }\r\n else if nextActionIndex == 1\r\n {\r\n ap := Lemma_GetParametersOfAction1(b, c, i, idx);\r\n }\r\n else if nextActionIndex == 2\r\n {\r\n ap := Lemma_GetParametersOfAction2(b, c, i, idx);\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n}\r\n\r\nlemma Lemma_ActionThatChangesHostIsThatHostsAction(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n host_index:int\r\n )\r\n returns (ap:SHTActionParams)\r\n requires IsValidBehaviorPrefix(b, c, i+1);\r\n requires 0 <= i;\r\n requires 0 <= host_index < |b[i].hosts|;\r\n requires 0 <= host_index < |b[i+1].hosts|;\r\n requires b[i+1].hosts[host_index] != b[i].hosts[host_index];\r\n ensures SHTActionOccurred(b[i], b[i+1], ap);\r\n ensures ap.idx == host_index;\r\n ensures LSHT_Next(b[i], b[i+1]);\r\n ensures LSHT_NextOneHost(b[i], b[i+1], host_index, ap.ios);\r\n{\r\n Lemma_AssumptionsMakeValidTransition(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n ap := Lemma_GetParametersOfAction(b, c, i);\r\n Lemma_GetHostIndexIsUnique(c, host_index);\r\n}\r\n\r\nlemma Lemma_PacketProcessedImpliesPacketSent(\r\n ps:LSHT_State,\r\n ps':LSHT_State,\r\n idx:int,\r\n ios:seq,\r\n inp:LSHTPacket\r\n )\r\n requires LSHT_NextOneHost(ps, ps', idx, ios);\r\n requires LIoOpReceive(inp) in ios;\r\n ensures inp in ps.environment.sentPackets;\r\n{\r\n var id := ps.config.hostIds[idx];\r\n var e := ps.environment;\r\n var e' := ps'.environment;\r\n\r\n assert IsValidLIoOp(LIoOpReceive(inp), id, ps.environment);\r\n assert inp in e.sentPackets;\r\n}\r\n\r\nlemma Lemma_PacketProcessedImpliesPacketSentAlt(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n idx:int,\r\n inp:LSHTPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1);\r\n requires 0 <= i;\r\n requires 0 <= idx < |c.hostIds|;\r\n requires b[i].environment.nextStep.LEnvStepHostIos?;\r\n requires b[i].environment.nextStep.actor == c.hostIds[idx];\r\n requires LIoOpReceive(inp) in b[i].environment.nextStep.ios;\r\n ensures inp in b[i].environment.sentPackets;\r\n{\r\n var ps := b[i];\r\n var ps' := b[i+1];\r\n\r\n Lemma_AssumptionsMakeValidTransition(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var id := ps.config.hostIds[idx];\r\n var e := ps.environment;\r\n var e' := ps'.environment;\r\n\r\n assert IsValidLIoOp(LIoOpReceive(inp), id, ps.environment);\r\n assert inp in e.sentPackets;\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/Assumptions.i.dfy", "content": "include \"../RefinementProof/SHT.i.dfy\"\r\ninclude \"../../../Common/Framework/EnvironmentSynchrony.s.dfy\"\r\n\r\nmodule LivenessProof__Assumptions_i {\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Environment_s\r\nimport opened EnvironmentSynchrony_s\r\nimport opened LiveSHT__Environment_i\r\nimport opened LiveSHT__Scheduler_i\r\nimport opened LiveSHT__SHT_i\r\nimport opened SHT__Configuration_i\r\nimport opened SHT__Message_i\r\nimport opened SHT__SingleMessage_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Collections__Maps2_s\r\n\r\n///////////////////////\r\n// TYPES\r\n///////////////////////\r\n\r\ntype LSHTMessage = SingleMessage \r\n\r\ndatatype AssumptionParameters = AssumptionParameters(c:SHTConfiguration)\r\n\r\n///////////////////////\r\n// HELPERS\r\n///////////////////////\r\n\r\nfunction{:opaque} RestrictBehaviorToEnvironment(\r\n b:Behavior\r\n ):Behavior>\r\n requires imaptotal(b);\r\n ensures imaptotal(RestrictBehaviorToEnvironment(b));\r\n ensures forall i {:trigger RestrictBehaviorToEnvironment(b)[i]} :: RestrictBehaviorToEnvironment(b)[i] == b[i].environment;\r\n{\r\n imap i :: b[i].environment\r\n}\r\n\r\npredicate IsValidBehaviorPrefix(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int\r\n )\r\n{\r\n imaptotal(b)\r\n && LSHT_Init(c, b[0])\r\n && (forall j {:trigger LSHT_Next(b[j], b[j+1])} :: 0 <= j < i ==> LSHT_Next(b[j], b[j+1]))\r\n}\r\n\r\npredicate IsValidBehavior(\r\n b:Behavior,\r\n c:SHTConfiguration\r\n )\r\n{\r\n imaptotal(b)\r\n && LSHT_Init(c, b[0])\r\n && (forall i {:trigger LSHT_Next(b[i], b[i+1])} :: i >= 0 ==> LSHT_Next(b[i], b[i+1]))\r\n}\r\n\r\npredicate LSHTHostTakesAction(\r\n ps:LSHT_State,\r\n ps':LSHT_State,\r\n host_index:int\r\n )\r\n{\r\n ps.environment.nextStep.LEnvStepHostIos? \r\n && 0 <= host_index < |ps.config.hostIds|\r\n && ps.environment.nextStep.actor == ps.config.hostIds[host_index] \r\n && var ios := ps.environment.nextStep.ios;\r\n LSHT_NextOneHost(ps, ps', host_index, ios)\r\n && LScheduler_Next(ps.hosts[host_index], ps'.hosts[host_index], ios)\r\n}\r\n\r\nfunction{:opaque} LSHTHostTakesActionTemporal(\r\n b:Behavior,\r\n host_index:int\r\n ):temporal\r\n requires imaptotal(b);\r\n ensures forall i {:trigger sat(i, LSHTHostTakesActionTemporal(b, host_index))} ::\r\n sat(i, LSHTHostTakesActionTemporal(b, host_index)) <==> LSHTHostTakesAction(b[i], b[i+1], host_index);\r\n{\r\n stepmap(imap i :: LSHTHostTakesAction(b[i], b[i+1], host_index))\r\n}\r\n\r\nfunction AllShardPacketsSent(packets:set):set\r\n{\r\n set p | p in packets && p.msg.SingleMessage? && p.msg.m.Shard?\r\n}\r\n\r\n///////////////////////\r\n// ASSUMPTIONS\r\n///////////////////////\r\n\r\nfunction{:opaque} PacketSentBetweenHostsTemporal(\r\n b:Behavior>,\r\n p:LPacket,\r\n sources:set,\r\n destinations:set\r\n ):temporal\r\n requires imaptotal(b);\r\n ensures forall i {:trigger sat(i, PacketSentBetweenHostsTemporal(b, p, sources, destinations))} ::\r\n sat(i, PacketSentBetweenHostsTemporal(b, p, sources, destinations)) <==>\r\n PacketSentBetweenHosts(b[i], p, sources, destinations);\r\n{\r\n stepmap(imap i :: PacketSentBetweenHosts(b[i], p, sources, destinations))\r\n}\r\n\r\nfunction SeqToSet(xs:seq) : set\r\n{\r\n set x | x in xs\r\n}\r\n\r\npredicate NetworkWeaklyFair(\r\n b:Behavior>,\r\n hosts:seq\r\n )\r\n requires imaptotal(b);\r\n{\r\n var host_set := SeqToSet(hosts);\r\n forall p :: sat(0, always(imply(always(eventual(PacketSentBetweenHostsTemporal(b, p, host_set, host_set))), \r\n eventual(PacketDeliveredTemporal(b, p)))))\r\n}\r\n\r\n///////////////////////////\r\n// TOP-LEVEL ASSUMPTIONS\r\n///////////////////////////\r\n\r\npredicate LivenessAssumptions(\r\n b:Behavior,\r\n asp:AssumptionParameters\r\n )\r\n{\r\n IsValidBehavior(b, asp.c)\r\n && var eb := RestrictBehaviorToEnvironment(b);\r\n HostQueuesLive(eb)\r\n\r\n // Each host executes its scheduler infinitely often\r\n && (forall host_index :: 0 <= host_index < |asp.c.hostIds| ==> sat(0, always(eventual(LSHTHostTakesActionTemporal(b, host_index)))))\r\n\r\n // Admin doesn't send too many shard requests\r\n && (forall step :: 0 <= step ==> |AllShardPacketsSent(b[step].environment.sentPackets)| < asp.c.params.max_delegations - 4)\r\n\r\n // Messages sent infinitely often are delivered infinitely often\r\n //&& sat(0, always(NetworkWeaklyFairTemporal(eb, asp.c.hostIds)))\r\n && NetworkWeaklyFair(eb, asp.c.hostIds)\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/Constants.i.dfy", "content": "include \"../../../Common/Logic/Temporal/Rules.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\n\r\nmodule LivenessProof__Constants_i {\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LiveSHT__SHT_i\r\nimport opened SHT__Configuration_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\n\r\n///////////////////////////////\r\n// INVARIANT LEMMAS\r\n///////////////////////////////\r\n\r\nlemma Lemma_AssumptionsMakeValidTransition(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1);\r\n requires 0 <= i;\r\n ensures LSHT_Next(b[i], b[i+1]);\r\n{\r\n}\r\n\r\nlemma Lemma_HostConstantsAllConsistent(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= idx < |b[i].hosts| || 0 <= idx < |c.hostIds| || 0 <= idx < |b[i].config.hostIds|;\r\n ensures b[i].config == c;\r\n ensures |b[i].config.hostIds| == |b[i].hosts|;\r\n ensures var s := b[i].hosts[idx].host;\r\n s.me == c.hostIds[idx]\r\n && s.constants.rootIdentity == c.rootIdentity\r\n && s.constants.hostIds == c.hostIds\r\n && s.constants.params == c.params\r\n{\r\n if i > 0 {\r\n Lemma_AssumptionsMakeValidTransition(b, c, i - 1);\r\n Lemma_HostConstantsAllConsistent(b, c, i-1, idx);\r\n } \r\n}\r\n\r\nlemma Lemma_ConstantsAllConsistent(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n ensures b[i].config == c;\r\n ensures |b[i].config.hostIds| == |b[i].hosts|;\r\n ensures forall idx :: 0 <= idx < |c.hostIds| ==> \r\n var s := b[i].hosts[idx].host;\r\n s.me == c.hostIds[idx]\r\n && s.constants.rootIdentity == c.rootIdentity\r\n && s.constants.hostIds == c.hostIds\r\n && s.constants.params == c.params;\r\n{\r\n if i > 0 {\r\n Lemma_AssumptionsMakeValidTransition(b, c, i - 1);\r\n Lemma_ConstantsAllConsistent(b, c, i-1);\r\n } \r\n forall idx | 0 <= idx < |c.hostIds|\r\n ensures var s := b[i].hosts[idx].host;\r\n s.me == c.hostIds[idx]\r\n && s.constants.rootIdentity == c.rootIdentity\r\n && s.constants.hostIds == c.hostIds\r\n && s.constants.params == c.params;\r\n {\r\n Lemma_HostConstantsAllConsistent(b, c, i, idx);\r\n }\r\n\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/Environment.i.dfy", "content": "include \"Invariants.i.dfy\"\r\ninclude \"RoundRobin.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"RefinementInvariants.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/WF1.i.dfy\"\r\n\r\nmodule LivenessProof__Environment_i {\r\nimport opened Environment_s\r\nimport opened EnvironmentSynchrony_s\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Constants_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__RefinementInvariants_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LiveSHT__Environment_i\r\nimport opened LiveSHT__SHT_i\r\nimport opened SHT__Configuration_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__WF1_i\r\n\r\nlemma Lemma_AssumptionsMakeValidEnvironmentBehavior(\r\n b:Behavior,\r\n c:SHTConfiguration\r\n )\r\n requires IsValidBehavior(b, c);\r\n ensures LEnvironment_BehaviorSatisfiesSpec(RestrictBehaviorToEnvironment(b));\r\n{\r\n var eb := RestrictBehaviorToEnvironment(b);\r\n var x := EnvironmentNextTemporal(eb);\r\n\r\n forall i | i >= 0\r\n ensures sat(i, x);\r\n {\r\n Lemma_AssumptionsMakeValidTransition(b, c, i);\r\n assert LEnvironment_Next(eb[i], eb[i+1]);\r\n }\r\n\r\n TemporalAlways(0, x);\r\n assert LEnvironment_Init(eb[0]);\r\n assert LEnvironment_BehaviorSatisfiesSpec(eb);\r\n}\r\n\r\nlemma Lemma_PacketStaysInSentPackets(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n j:int,\r\n p:LSHTPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, j);\r\n requires 0 <= i <= j;\r\n requires p in b[i].environment.sentPackets;\r\n ensures p in b[j].environment.sentPackets;\r\n{\r\n if j == i\r\n {\r\n }\r\n else\r\n {\r\n Lemma_PacketStaysInSentPackets(b, c, i, j-1, p);\r\n Lemma_AssumptionsMakeValidTransition(b, c, j-1);\r\n }\r\n}\r\n\r\nlemma Lemma_PositionOfPacketInHostQueueEventuallyDecreasesByOne(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n current_step:int,\r\n host_idx:int,\r\n p:LSHTPacket,\r\n pos:int\r\n )\r\n returns\r\n (next_step:int)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= current_step;\r\n requires 0 <= host_idx < |asp.c.hostIds|;\r\n requires asp.c.hostIds[host_idx] in b[current_step].environment.hostInfo;\r\n requires 1 <= pos < |b[current_step].environment.hostInfo[asp.c.hostIds[host_idx]].queue|;\r\n requires p == b[current_step].environment.hostInfo[asp.c.hostIds[host_idx]].queue[pos];\r\n ensures current_step <= next_step;\r\n ensures asp.c.hostIds[host_idx] in b[next_step].environment.hostInfo;\r\n ensures pos-1 < |b[next_step].environment.hostInfo[asp.c.hostIds[host_idx]].queue|;\r\n ensures p == b[next_step].environment.hostInfo[asp.c.hostIds[host_idx]].queue[pos-1];\r\n{\r\n var host := asp.c.hostIds[host_idx];\r\n var P := stepmap(imap i :: host in b[i].environment.hostInfo\r\n && |b[i].environment.hostInfo[host].queue| > pos\r\n && p == b[i].environment.hostInfo[host].queue[pos]);\r\n var Q := stepmap(imap i :: host in b[i].environment.hostInfo\r\n && |b[i].environment.hostInfo[host].queue| > pos-1\r\n && p == b[i].environment.hostInfo[host].queue[pos-1]);\r\n\r\n var action_step := Lemma_HostNextPerformsSubactionEventually(b, asp, host_idx, current_step, 0);\r\n\r\n forall j | current_step <= j\r\n ensures sat(j, TemporalWF1Req1(P, Q));\r\n {\r\n Lemma_EffectOfNextOnHostQueue(b, asp, j, host_idx);\r\n }\r\n\r\n forall ensures sat(action_step, imply(P, or(Q, next(Q))))\r\n {\r\n if sat(action_step, P)\r\n {\r\n Lemma_ConstantsAllConsistent(b, asp.c, action_step);\r\n var ios := b[action_step].environment.nextStep.ios;\r\n var hostQueue := if host in b[action_step].environment.hostInfo then b[action_step].environment.hostInfo[host].queue else [];\r\n var hostQueue' := if host in b[action_step+1].environment.hostInfo then b[action_step+1].environment.hostInfo[host].queue else [];\r\n Lemma_HostQueuesNext(b, asp, action_step);\r\n assert HostQueue_PerformIos(hostQueue, hostQueue', ios);\r\n assert |ios| > 0;\r\n if ios[0].LIoOpTimeoutReceive?\r\n {\r\n assert false;\r\n }\r\n else\r\n {\r\n assert ios[0].LIoOpReceive?;\r\n assert |ios| == 1 || (ios[1] in ios /* trigger */ && !ios[1].LIoOpReceive?);\r\n assert HostQueue_PerformIos(hostQueue[1..], hostQueue', ios[1..]);\r\n assert hostQueue[1..] == hostQueue';\r\n }\r\n assert sat(action_step+1, Q);\r\n }\r\n }\r\n\r\n next_step := TemporalWF1Specific(current_step, action_step, P, Q);\r\n}\r\n\r\nlemma Lemma_PositionOfPacketInHostQueueEventuallyDecreasesToZero(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n current_step:int,\r\n host_idx:int,\r\n p:LSHTPacket,\r\n pos:int\r\n )\r\n returns\r\n (next_step:int)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= current_step;\r\n requires 0 <= host_idx < |asp.c.hostIds|;\r\n requires asp.c.hostIds[host_idx] in b[current_step].environment.hostInfo;\r\n requires 0 <= pos < |b[current_step].environment.hostInfo[asp.c.hostIds[host_idx]].queue|;\r\n requires p == b[current_step].environment.hostInfo[asp.c.hostIds[host_idx]].queue[pos];\r\n ensures current_step <= next_step;\r\n ensures asp.c.hostIds[host_idx] in b[next_step].environment.hostInfo;\r\n ensures 0 < |b[next_step].environment.hostInfo[asp.c.hostIds[host_idx]].queue|;\r\n ensures p == b[next_step].environment.hostInfo[asp.c.hostIds[host_idx]].queue[0];\r\n decreases pos;\r\n{\r\n if pos == 0\r\n {\r\n next_step := current_step;\r\n }\r\n else\r\n {\r\n var intermediate_step := Lemma_PositionOfPacketInHostQueueEventuallyDecreasesByOne(b, asp, current_step, host_idx, p, pos);\r\n next_step := Lemma_PositionOfPacketInHostQueueEventuallyDecreasesToZero(b, asp, intermediate_step, host_idx, p, pos-1);\r\n }\r\n}\r\n\r\nlemma Lemma_PacketInHostQueueEventuallyAtFrontOfHostQueue(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n current_step:int,\r\n host_idx:int,\r\n p:LSHTPacket\r\n )\r\n returns\r\n (next_step:int)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= current_step;\r\n requires 0 <= host_idx < |asp.c.hostIds|;\r\n requires asp.c.hostIds[host_idx] in b[current_step].environment.hostInfo;\r\n requires p in b[current_step].environment.hostInfo[asp.c.hostIds[host_idx]].queue;\r\n ensures current_step <= next_step;\r\n ensures asp.c.hostIds[host_idx] in b[next_step].environment.hostInfo;\r\n ensures 0 < |b[next_step].environment.hostInfo[asp.c.hostIds[host_idx]].queue|;\r\n ensures p == b[next_step].environment.hostInfo[asp.c.hostIds[host_idx]].queue[0];\r\n{\r\n var host := asp.c.hostIds[host_idx];\r\n var queue := b[current_step].environment.hostInfo[host].queue;\r\n var pos :| 0 <= pos < |queue| && queue[pos] == p;\r\n next_step := Lemma_PositionOfPacketInHostQueueEventuallyDecreasesToZero(b, asp, current_step, host_idx, p, pos);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/InfiniteSends.i.dfy", "content": "include \"PacketReceipt.i.dfy\"\r\ninclude \"Acks.i.dfy\"\r\ninclude \"RefinementInvariants.i.dfy\"\r\n\r\nmodule LivenessProof__InfiniteSends_i {\r\n\r\nimport opened Collections__Maps2_s\r\nimport opened Environment_s\r\nimport opened LivenessProof__Acks_i\r\nimport opened LivenessProof__Actions_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Constants_i\r\nimport opened LivenessProof__PacketReceipt_i\r\nimport opened LivenessProof__RefinementInvariants_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LiveSHT__Scheduler_i\r\nimport opened LiveSHT__SHT_i\r\nimport opened LiveSHT__SHTRefinement_i\r\nimport opened Math__mod_auto_i\r\nimport opened SHT__Configuration_i\r\nimport opened SHT__Host_i\r\nimport opened SHT__Message_i\r\nimport opened SHT__Network_i\r\nimport opened SHT__SingleDelivery_i\r\nimport opened SHT__SingleMessage_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__WF1_i\r\n\r\npredicate RecipientSequenceNumberBelow(\r\n ss:LSHT_State,\r\n src_idx:int,\r\n dst_idx:int,\r\n seqno:int\r\n )\r\n{\r\n 0 <= src_idx < |ss.config.hostIds|\r\n && 0 <= dst_idx < |ss.config.hostIds|\r\n && 0 <= dst_idx < |ss.hosts|\r\n && TombstoneTableLookup(ss.config.hostIds[src_idx], ss.hosts[dst_idx].host.sd.receiveState) < seqno\r\n}\r\n\r\nfunction RecipientSequenceNumberBelowTemporal(\r\n b:Behavior,\r\n src_idx:int,\r\n dst_idx:int,\r\n seqno:int\r\n ):temporal\r\n requires imaptotal(b);\r\n ensures forall i{:trigger sat(i, RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, seqno))} ::\r\n sat(i, RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, seqno)) <==>\r\n RecipientSequenceNumberBelow(b[i], src_idx, dst_idx, seqno);\r\n{\r\n stepmap(imap i :: RecipientSequenceNumberBelow(b[i], src_idx, dst_idx, seqno))\r\n}\r\n\r\nlemma Lemma_TruncateUnAckListDoesntRemoveHigherSeqno(\r\n unAcked:seq>,\r\n seqnoAcked:nat,\r\n unAcked':seq>,\r\n m:SingleMessage\r\n )\r\n requires unAcked' == TruncateUnAckList(unAcked, seqnoAcked);\r\n requires m in unAcked;\r\n requires m.SingleMessage?;\r\n requires m.seqno > seqnoAcked;\r\n ensures m in unAcked';\r\n{\r\n if |unAcked| > 0 && unAcked[0].SingleMessage? && unAcked[0].seqno <= seqnoAcked\r\n {\r\n assert m != unAcked[0];\r\n assert m in unAcked[1..];\r\n Lemma_TruncateUnAckListDoesntRemoveHigherSeqno(unAcked[1..], seqnoAcked, unAcked', m);\r\n }\r\n}\r\n\r\nlemma Lemma_IfRecipientSequenceNumberNeverBeyondThenPacketStaysInSendStateOneStep(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n src_idx:int,\r\n dst_idx:int,\r\n m:SingleMessage\r\n )\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= src_idx < |asp.c.hostIds|;\r\n requires 0 <= dst_idx < |asp.c.hostIds|;\r\n requires 0 <= src_idx < |b[i].hosts|;\r\n requires 0 <= i;\r\n requires m.SingleMessage?;\r\n requires m.dst == asp.c.hostIds[dst_idx];\r\n requires sat(i, always(RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, m.seqno)));\r\n requires m.dst in b[i].hosts[src_idx].host.sd.sendState;\r\n requires m in b[i].hosts[src_idx].host.sd.sendState[m.dst].unAcked;\r\n ensures 0 <= src_idx < |b[i+1].hosts|;\r\n ensures m.dst in b[i+1].hosts[src_idx].host.sd.sendState;\r\n ensures m in b[i+1].hosts[src_idx].host.sd.sendState[m.dst].unAcked;\r\n{\r\n Lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n Lemma_ConstantsAllConsistent(b, asp.c, i);\r\n\r\n var src := asp.c.hostIds[src_idx];\r\n var dst := asp.c.hostIds[dst_idx];\r\n Lemma_GetHostIndexIsUnique(asp.c, src_idx);\r\n Lemma_GetHostIndexIsUnique(asp.c, dst_idx);\r\n var host := b[i].hosts[src_idx].host;\r\n var host' := b[i+1].hosts[src_idx].host;\r\n \r\n TemporalDeduceFromAlways(i, i, RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, m.seqno));\r\n Lemma_NumPacketsAckedBeforeRecipientSequenceNumber(b, asp.c, i, src_idx, dst_idx);\r\n assert AckStateLookup(dst, host.sd.sendState).numPacketsAcked < m.seqno;\r\n\r\n TemporalDeduceFromAlways(i, i+1, RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, m.seqno));\r\n Lemma_NumPacketsAckedBeforeRecipientSequenceNumber(b, asp.c, i+1, src_idx, dst_idx);\r\n assert AckStateLookup(dst, host'.sd.sendState).numPacketsAcked < m.seqno;\r\n \r\n assert dst in host'.sd.sendState;\r\n if m in host'.sd.sendState[dst].unAcked\r\n {\r\n return;\r\n }\r\n\r\n var ap := Lemma_ActionThatChangesHostIsThatHostsAction(b, asp.c, i, src_idx);\r\n var pos :| 0 <= pos < |host.sd.sendState[dst].unAcked| && m == host.sd.sendState[dst].unAcked[pos];\r\n\r\n assert ap.nextActionIndex == 0;\r\n assert ap.ios[0].LIoOpReceive?;\r\n assert ap.ios[0].r.msg.Ack?;\r\n assert ReceiveAck(host.sd, host'.sd, ap.pkt, ap.out);\r\n assert host'.sd.sendState[dst].unAcked == TruncateUnAckList(host.sd.sendState[dst].unAcked, host'.sd.sendState[dst].numPacketsAcked);\r\n Lemma_TruncateUnAckListDoesntRemoveHigherSeqno(host.sd.sendState[dst].unAcked, host'.sd.sendState[dst].numPacketsAcked,\r\n host'.sd.sendState[dst].unAcked, m);\r\n}\r\n\r\nlemma Lemma_IfRecipientSequenceNumberNeverBeyondThenPacketStaysInSendState(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n j:int,\r\n src_idx:int,\r\n dst_idx:int,\r\n m:SingleMessage\r\n )\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= src_idx < |asp.c.hostIds|;\r\n requires 0 <= dst_idx < |asp.c.hostIds|;\r\n requires 0 <= src_idx < |b[i].hosts|;\r\n requires 0 <= i <= j;\r\n requires m.SingleMessage?;\r\n requires m.dst == asp.c.hostIds[dst_idx];\r\n requires sat(i, always(RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, m.seqno)));\r\n requires m.dst in b[i].hosts[src_idx].host.sd.sendState;\r\n requires m in b[i].hosts[src_idx].host.sd.sendState[m.dst].unAcked;\r\n ensures 0 <= src_idx < |b[j].hosts|;\r\n ensures m.dst in b[j].hosts[src_idx].host.sd.sendState;\r\n ensures m in b[j].hosts[src_idx].host.sd.sendState[m.dst].unAcked;\r\n{\r\n if i == j\r\n {\r\n return;\r\n }\r\n\r\n Lemma_IfRecipientSequenceNumberNeverBeyondThenPacketStaysInSendState(b, asp, i, j-1, src_idx, dst_idx, m);\r\n Lemma_AlwaysImpliesLaterAlways(i, j-1, RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, m.seqno));\r\n Lemma_IfRecipientSequenceNumberNeverBeyondThenPacketStaysInSendStateOneStep(b, asp, j-1, src_idx, dst_idx, m);\r\n}\r\n\r\nlemma Lemma_ResendCountAlwaysWithinRange(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= idx < |c.hostIds|;\r\n ensures 0 <= idx < |b[i].hosts|;\r\n ensures 0 <= b[i].hosts[idx].resendCount < 100000000;\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n Lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n Lemma_ConstantsAllConsistent(b, c, i-1);\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n Lemma_ResendCountAlwaysWithinRange(b, c, i-1, idx);\r\n\r\n var s := b[i-1].hosts[idx];\r\n var s' := b[i].hosts[idx];\r\n\r\n if s'.resendCount == s.resendCount\r\n {\r\n return;\r\n }\r\n\r\n var ap := Lemma_ActionThatChangesHostIsThatHostsAction(b, c, i-1, idx);\r\n assert LScheduler_Next(b[i-1].hosts[idx], b[i].hosts[idx], ap.ios);\r\n assert s'.resendCount == (s.resendCount + 1) % 100000000;\r\n lemma_mod_auto(100000000);\r\n}\r\n\r\nlemma Lemma_HostPerformsMaybeResendPacketsEventually(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n current_step:int,\r\n idx:int,\r\n resendCount:int\r\n ) returns\r\n (resend_step:int,\r\n ap:SHTActionParams)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= current_step;\r\n requires 0 <= idx < |asp.c.hostIds|;\r\n requires 0 <= idx < |b[current_step].hosts|;\r\n requires b[current_step].hosts[idx].resendCount == resendCount;\r\n requires 0 <= resendCount < 100000000;\r\n ensures current_step <= resend_step;\r\n ensures SHTActionOccurred(b[resend_step], b[resend_step+1], ap);\r\n ensures ap.idx == idx;\r\n ensures ap.nextActionIndex == 2;\r\n ensures ap.resendCount == (resendCount + 1) % 100000000;\r\n{\r\n var id := asp.c.hostIds[idx];\r\n Lemma_GetHostIndexIsUnique(asp.c, idx);\r\n\r\n var action_step := Lemma_HostNextPerformsSubactionEventually(b, asp, idx, current_step, 2);\r\n var P := stepmap(imap i :: 0 <= idx < |b[i].hosts|\r\n && b[i].hosts[idx].resendCount == resendCount);\r\n var Q := stepmap(imap i :: 0 <= idx < |b[i].hosts|\r\n && b[i].environment.nextStep.LEnvStepHostIos?\r\n && b[i].environment.nextStep.actor == id\r\n && b[i].hosts[idx].nextActionIndex == 2\r\n && b[i].hosts[idx].resendCount == resendCount);\r\n if sat(action_step, P)\r\n {\r\n var ap_local := Lemma_GetParametersOfAction(b, asp.c, action_step);\r\n Lemma_ConstantsAllConsistent(b, asp.c, action_step);\r\n assert sat(action_step, Q);\r\n }\r\n assert sat(action_step, imply(P, or(Q, next(Q))));\r\n\r\n forall j | current_step <= j\r\n ensures sat(j, TemporalWF1Req1(P, Q));\r\n {\r\n Lemma_ConstantsAllConsistent(b, asp.c, j);\r\n Lemma_ConstantsAllConsistent(b, asp.c, j+1);\r\n if sat(j, P) && !sat(j+1, P) && !sat(j, Q)\r\n {\r\n var ap_local := Lemma_ActionThatChangesHostIsThatHostsAction(b, asp.c, j, idx);\r\n assert false;\r\n }\r\n }\r\n\r\n resend_step := TemporalWF1Specific(current_step, action_step, P, Q);\r\n Lemma_ConstantsAllConsistent(b, asp.c, resend_step);\r\n ap := Lemma_GetParametersOfAction(b, asp.c, resend_step);\r\n}\r\n\r\nlemma Lemma_HostPerformsResendPacketsEventually(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n current_step:int,\r\n idx:int\r\n ) returns\r\n (resend_step:int,\r\n ap:SHTActionParams)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= current_step;\r\n requires 0 <= idx < |asp.c.hostIds|;\r\n ensures current_step <= resend_step;\r\n ensures SHTActionOccurred(b[resend_step], b[resend_step+1], ap);\r\n ensures ap.idx == idx;\r\n ensures ap.nextActionIndex == 2;\r\n ensures ap.resendCount == 0;\r\n decreases 100000000 - (if 0 <= idx < |b[current_step].hosts| then b[current_step].hosts[idx].resendCount else 0);\r\n{\r\n Lemma_ConstantsAllConsistent(b, asp.c, current_step);\r\n var resendCount := b[current_step].hosts[idx].resendCount;\r\n Lemma_ResendCountAlwaysWithinRange(b, asp.c, current_step, idx);\r\n\r\n if resendCount == 100000000-1\r\n {\r\n resend_step, ap := Lemma_HostPerformsMaybeResendPacketsEventually(b, asp, current_step, idx, resendCount);\r\n }\r\n else\r\n {\r\n var try_resend_step, try_ap := Lemma_HostPerformsMaybeResendPacketsEventually(b, asp, current_step, idx, resendCount);\r\n lemma_mod_auto(100000000);\r\n resend_step, ap := Lemma_HostPerformsResendPacketsEventually(b, asp, try_resend_step + 1, idx);\r\n }\r\n}\r\n\r\nlemma Lemma_IfRecipientSequenceNumberNeverBeyondThenPacketEventuallySent(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n current_step:int,\r\n src_idx:int,\r\n dst_idx:int,\r\n m:SingleMessage\r\n ) returns\r\n (resend_step:int,\r\n ap:SHTActionParams)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= src_idx < |asp.c.hostIds|;\r\n requires 0 <= dst_idx < |asp.c.hostIds|;\r\n requires 0 <= src_idx < |b[current_step].hosts|;\r\n requires 0 <= current_step;\r\n requires m.SingleMessage?;\r\n requires m.dst == asp.c.hostIds[dst_idx];\r\n requires sat(current_step, always(RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, m.seqno)));\r\n requires m.dst in b[current_step].hosts[src_idx].host.sd.sendState;\r\n requires m in b[current_step].hosts[src_idx].host.sd.sendState[m.dst].unAcked;\r\n ensures current_step <= resend_step;\r\n ensures SHTActionOccurred(b[resend_step], b[resend_step+1], ap);\r\n ensures LIoOpSend(LPacket(m.dst, asp.c.hostIds[src_idx], m)) in ap.ios;\r\n{\r\n resend_step, ap := Lemma_HostPerformsResendPacketsEventually(b, asp, current_step, src_idx);\r\n Lemma_GetHostIndexIsUnique(asp.c, ap.idx);\r\n Lemma_GetHostIndexIsUnique(asp.c, src_idx);\r\n Lemma_IfRecipientSequenceNumberNeverBeyondThenPacketStaysInSendState(b, asp, current_step, resend_step, src_idx, dst_idx, m);\r\n assert SpontaneouslyRetransmit(ap.host, ap.host', ap.out);\r\n assert ap.out == UnAckedMessages(ap.host.sd, ap.host.me);\r\n var pos :| 0 <= pos < |ap.host.sd.sendState[m.dst].unAcked| && ap.host.sd.sendState[m.dst].unAcked[pos] == m;\r\n assert Packet(m.dst, ap.host.me, m) in ap.out;\r\n Lemma_HostConstantsMeHasAppropriateValue(b, asp.c, resend_step, src_idx);\r\n}\r\n\r\nlemma Lemma_IfRecipientSequenceNumberNeverBeyondThenPacketSentInfinitelyOften(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n current_step:int,\r\n src_idx:int,\r\n dst_idx:int,\r\n m:SingleMessage\r\n )\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= src_idx < |asp.c.hostIds|;\r\n requires 0 <= dst_idx < |asp.c.hostIds|;\r\n requires 0 <= src_idx < |b[current_step].hosts|;\r\n requires 0 <= current_step;\r\n requires m.SingleMessage?;\r\n requires m.dst == asp.c.hostIds[dst_idx];\r\n requires sat(current_step, always(RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, m.seqno)));\r\n requires m.dst in b[current_step].hosts[src_idx].host.sd.sendState;\r\n requires m in b[current_step].hosts[src_idx].host.sd.sendState[m.dst].unAcked;\r\n ensures sat(current_step, always(eventual(SHTPacketSentTemporal(b, LPacket(m.dst, asp.c.hostIds[src_idx], m)))));\r\n{\r\n var p := LPacket(m.dst, asp.c.hostIds[src_idx], m);\r\n\r\n forall later_step | current_step <= later_step\r\n ensures sat(later_step, eventual(SHTPacketSentTemporal(b, p)));\r\n {\r\n Lemma_ConstantsAllConsistent(b, asp.c, later_step);\r\n Lemma_AlwaysImpliesLaterAlways(current_step, later_step, RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, m.seqno));\r\n Lemma_IfRecipientSequenceNumberNeverBeyondThenPacketStaysInSendState(b, asp, current_step, later_step, src_idx, dst_idx, m);\r\n var resend_step, ap := Lemma_IfRecipientSequenceNumberNeverBeyondThenPacketEventuallySent(b, asp, later_step, src_idx, dst_idx, m);\r\n Lemma_ConstantsAllConsistent(b, asp.c, resend_step);\r\n assert SHTPacketSent(b[resend_step], p);\r\n TemporalEventually(later_step, resend_step, SHTPacketSentTemporal(b, p));\r\n }\r\n\r\n TemporalAlways(current_step, eventual(SHTPacketSentTemporal(b, p)));\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/Invariants.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"../../../Common/Framework/HostQueueLemmas.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"RefinementInvariants.i.dfy\"\r\ninclude \"../../../Common/Collections/Seqs.s.dfy\"\r\n\r\nmodule LivenessProof__Invariants_i {\r\nimport opened Collections__Seqs_s\r\nimport opened EnvironmentSynchrony_s\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened Liveness__HostQueueLemmas_i\r\nimport opened LivenessProof__Actions_i\r\nimport opened LivenessProof__Constants_i\r\nimport opened LivenessProof__RefinementInvariants_i\r\nimport opened LiveSHT__SHT_i\r\nimport opened SHT__Configuration_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\n\r\nlemma Lemma_HostQueuesNext(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int\r\n )\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= i;\r\n ensures HostQueues_Next(b[i].environment, b[i+1].environment);\r\n{\r\n TemporalDeduceFromAlways(0, i, HostQueuesNextTemporal(RestrictBehaviorToEnvironment(b)));\r\n}\r\n\r\nlemma Lemma_LEnvironmentInvariantHolds(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int\r\n )\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= i;\r\n ensures LEnvironmentInvariant(b[i].environment);\r\n{\r\n if i == 0\r\n {\r\n Lemma_LEnvironmentInitEstablishesInvariant(b[i].environment);\r\n }\r\n else\r\n {\r\n Lemma_LEnvironmentInvariantHolds(b, asp, i-1);\r\n Lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n Lemma_HostQueuesNext(b, asp, i-1);\r\n\r\n Lemma_LEnvironmentNextPreservesInvariant(b[i-1].environment, b[i].environment);\r\n }\r\n}\r\n\r\nlemma Lemma_EffectOfNextOnHostQueue(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n host_idx:int\r\n )\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= i;\r\n requires 0 <= host_idx < |asp.c.hostIds|;\r\n ensures var host := asp.c.hostIds[host_idx];\r\n var hostQueue := if host in b[i].environment.hostInfo then b[i].environment.hostInfo[host].queue else [];\r\n var hostQueue' := if host in b[i+1].environment.hostInfo then b[i+1].environment.hostInfo[host].queue else [];\r\n (hostQueue' == hostQueue)\r\n || (|hostQueue'| > 0 && all_but_last(hostQueue') == hostQueue)\r\n || (|hostQueue| > 0 && hostQueue' == hostQueue[1..]);\r\n{\r\n Lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n Lemma_HostQueuesNext(b, asp, i);\r\n Lemma_ConstantsAllConsistent(b, asp.c, i);\r\n Lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n\r\n var host := asp.c.hostIds[host_idx];\r\n var hostQueue := if host in b[i].environment.hostInfo then b[i].environment.hostInfo[host].queue else [];\r\n var hostQueue' := if host in b[i+1].environment.hostInfo then b[i+1].environment.hostInfo[host].queue else [];\r\n\r\n if b[i].environment.nextStep.LEnvStepHostIos? \r\n {\r\n if b[i].environment.nextStep.actor in b[i].config.hostIds {\r\n var ap := Lemma_GetParametersOfAction(b, asp.c, i);\r\n var id := asp.c.hostIds[ap.idx];\r\n if ap.idx != host_idx\r\n {\r\n assert HostsDistinct(asp.c.hostIds, ap.idx, host_idx);\r\n }\r\n else\r\n {\r\n assert HostQueue_PerformIos(hostQueue, hostQueue', ap.ios);\r\n if ap.nextActionIndex == 0\r\n {\r\n if ap.ios[0].LIoOpTimeoutReceive?\r\n {\r\n assert hostQueue' == hostQueue;\r\n }\r\n else\r\n {\r\n assert ap.ios[0].LIoOpReceive?;\r\n assert |ap.ios| == 1 || (ap.ios[1] in ap.ios /* trigger */ && !ap.ios[1].LIoOpReceive?);\r\n assert HostQueue_PerformIos(hostQueue[1..], hostQueue', ap.ios[1..]);\r\n assert hostQueue[1..] == hostQueue';\r\n }\r\n }\r\n else if ap.nextActionIndex == 1\r\n {\r\n assert |ap.ios| == 0 || (ap.ios[0] in ap.ios /* trigger */ && ap.ios[0].LIoOpSend?);\r\n assert hostQueue' == hostQueue;\r\n }\r\n else\r\n {\r\n assert |ap.ios| == 0 || (ap.ios[0] in ap.ios /* trigger */ && ap.ios[0].LIoOpSend?);\r\n assert hostQueue' == hostQueue;\r\n }\r\n }\r\n } else {\r\n // NextExternal\r\n }\r\n }\r\n else\r\n {\r\n assert LSHT_NextEnvironment(b[i], b[i+1]);\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/LivenessProof.i.dfy", "content": "include \"Seqno.i.dfy\"\r\n\r\nmodule LivenessProof__LivenessProof_i {\r\n\r\nimport opened Environment_s\r\nimport opened LivenessProof__Actions_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Constants_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__RefinementInvariants_i\r\nimport opened LivenessProof__Seqno_i\r\nimport opened LiveSHT__Environment_i\r\nimport opened LiveSHT__SHT_i\r\nimport opened LiveSHT__SHTRefinement_i\r\nimport opened Logic__Option_i\r\nimport opened Protocol_Parameters_i\r\nimport opened SHT__Network_i\r\nimport opened SHT__SingleDelivery_i\r\nimport opened SHT__SingleMessage_i\r\nimport opened Temporal__Temporal_s\r\n\r\npredicate SendSingleValid(s:SingleDeliveryAcct, s':SingleDeliveryAcct, sm:SingleMessage, params:Parameters)\r\n{\r\n sm.SingleMessage?\r\n && SendSingleMessage(s, s', sm.m, sm, params, true)\r\n && var oldAckState := AckStateLookup(sm.dst, s.sendState); \r\n var new_seqno := oldAckState.numPacketsAcked + |oldAckState.unAcked| + 1;\r\n new_seqno <= params.max_seqno\r\n}\r\n\r\nlemma Lemma_PacketSentEventuallyReceivedAndNotDiscarded(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n src_idx:int,\r\n send_step:int,\r\n msg:LSHTMessage\r\n ) returns\r\n (dst_idx:int,\r\n received_step:int)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= send_step;\r\n requires 0 <= src_idx < |b[send_step].hosts| == |asp.c.hostIds|;\r\n requires 0 <= src_idx < |b[send_step + 1].hosts|;\r\n requires SendSingleValid(b[send_step].hosts[src_idx].host.sd, b[send_step + 1].hosts[src_idx].host.sd, msg, asp.c.params);\r\n requires msg.dst in asp.c.hostIds;\r\n requires b[send_step].environment.nextStep.LEnvStepHostIos?;\r\n requires b[send_step].environment.nextStep.actor == asp.c.hostIds[src_idx];\r\n requires LIoOpSend(LPacket(msg.dst, asp.c.hostIds[src_idx], msg)) in b[send_step].environment.nextStep.ios;\r\n ensures send_step <= received_step;\r\n ensures 0 <= dst_idx < |asp.c.hostIds| == |b[received_step].hosts|;\r\n ensures msg.dst == asp.c.hostIds[dst_idx];\r\n ensures 0 <= src_idx < |asp.c.hostIds|;\r\n ensures b[received_step].hosts[dst_idx].host.receivedPacket == Some(Packet(msg.dst, asp.c.hostIds[src_idx], msg));\r\n{\r\n Lemma_ConstantsAllConsistent(b, asp.c, send_step);\r\n Lemma_ConstantsAllConsistent(b, asp.c, send_step+1);\r\n dst_idx := GetHostIndex(msg.dst, asp.c);\r\n var src := asp.c.hostIds[src_idx];\r\n Lemma_GetHostIndexIsUnique(asp.c, src_idx);\r\n Lemma_GetHostIndexIsUnique(asp.c, dst_idx);\r\n\r\n Lemma_AssumptionsMakeValidTransition(b, asp.c, send_step);\r\n var p1 := LPacket(msg.dst, asp.c.hostIds[src_idx], msg);\r\n assert p1 in b[send_step+1].environment.sentPackets;\r\n\r\n var ap1 := Lemma_ActionThatChangesHostIsThatHostsAction(b, asp.c, send_step, src_idx);\r\n\r\n var reached_step := Lemma_IfTheresAnUnackedPacketThenRecipientSequenceNumberReachesItsSequenceNumber(b, asp, send_step+1, src_idx, dst_idx, msg);\r\n Lemma_ConstantsAllConsistent(b, asp.c, reached_step);\r\n\r\n Lemma_ReceiverHasCanceledNoUnsentSeqno(b, asp.c, send_step, src_idx, dst_idx);\r\n var prev_step, ap2 := Lemma_GetReceiveStepForSequenceNumber(b, asp.c, send_step, reached_step, src_idx, dst_idx, msg.seqno);\r\n Lemma_ConstantsAllConsistent(b, asp.c, prev_step);\r\n var p2 := ap2.ios[0].r;\r\n\r\n Lemma_PacketStaysInSentPackets(b, asp.c, send_step+1, prev_step, p1);\r\n Lemma_PacketsHaveSenderUniqueSeqnos(b, asp.c, prev_step, p1, p2);\r\n received_step := prev_step + 1;\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/PacketReceipt.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"Acks.i.dfy\"\r\ninclude \"PacketSending.i.dfy\"\r\n\r\nmodule LivenessProof__PacketReceipt_i {\r\n\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Sets_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Environment_s\r\nimport opened EnvironmentSynchrony_s\r\nimport opened LivenessProof__Acks_i\r\nimport opened LivenessProof__Actions_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Constants_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__PacketSending_i\r\nimport opened LivenessProof__RefinementInvariants_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LiveSHT__Environment_i\r\nimport opened LiveSHT__SHT_i\r\nimport opened LiveSHT__SHTRefinement_i\r\nimport opened SHT__Configuration_i\r\nimport opened SHT__SingleDelivery_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__WF1_i\r\n\r\npredicate SHTPacketSent(ss:LSHT_State, p:LSHTPacket)\r\n{\r\n ss.environment.nextStep.LEnvStepHostIos?\r\n && LIoOpSend(p) in ss.environment.nextStep.ios\r\n}\r\n\r\nfunction{:opaque} SHTPacketSentTemporal(b:Behavior, p:LSHTPacket):temporal\r\n requires imaptotal(b);\r\n ensures forall i{:trigger sat(i, SHTPacketSentTemporal(b, p))} ::\r\n sat(i, SHTPacketSentTemporal(b, p)) <==> SHTPacketSent(b[i], p);\r\n{\r\n stepmap(imap i :: SHTPacketSent(b[i], p))\r\n}\r\n\r\npredicate IsDelegateStep(\r\n ps:LSHT_State,\r\n ps':LSHT_State,\r\n idx:int\r\n )\r\n{\r\n 0 <= idx < |ps.hosts|\r\n && 0 <= idx < |ps.config.hostIds|\r\n && 0 <= idx < |ps'.hosts|\r\n && ps.environment.nextStep.LEnvStepHostIos?\r\n && ps.environment.nextStep.actor == ps.config.hostIds[idx]\r\n && ps.hosts[idx].nextActionIndex == 1\r\n && ps.hosts[idx].host.receivedPacket.Some?\r\n && ps.hosts[idx].host.receivedPacket.v.src in ps.config.hostIds\r\n && ps.hosts[idx].host.receivedPacket.v.dst == ps.config.hostIds[idx]\r\n && ps.hosts[idx].host.receivedPacket.v.msg.SingleMessage?\r\n && ps.hosts[idx].host.receivedPacket.v.msg.m.Delegate?\r\n && ps'.hosts[idx].host.receivedPacket.None?\r\n}\r\n\r\npredicate IsShardStepOfHost(\r\n ps:LSHT_State,\r\n ps':LSHT_State,\r\n idx:int\r\n )\r\n{\r\n 0 <= idx < |ps.hosts|\r\n && 0 <= idx < |ps.config.hostIds|\r\n && 0 <= idx < |ps'.hosts|\r\n && ps.environment.nextStep.LEnvStepHostIos?\r\n && ps.environment.nextStep.actor == ps.config.hostIds[idx]\r\n && ps.hosts[idx].nextActionIndex == 1\r\n && ps.hosts[idx].host.receivedPacket.Some?\r\n && ps.hosts[idx].host.receivedPacket.v.dst == ps.config.hostIds[idx]\r\n && ps.hosts[idx].host.receivedPacket.v.msg.SingleMessage?\r\n && ps.hosts[idx].host.receivedPacket.v.msg.m.Shard?\r\n && ps'.hosts[idx].host.receivedPacket.None?\r\n}\r\n\r\npredicate IsShardStepOfOtherHost(\r\n ps:LSHT_State,\r\n ps':LSHT_State,\r\n idx:int\r\n )\r\n{\r\n exists other_idx :: other_idx != idx && IsShardStepOfHost(ps, ps', other_idx)\r\n}\r\n\r\nfunction AllDelegatePacketsToHost(b:Behavior, i:int, dst:NodeIdentity):set\r\n requires imaptotal(b);\r\n{\r\n set p | p in b[i].environment.sentPackets && p.src in b[i].config.hostIds && p.msg.SingleMessage? && p.msg.m.Delegate? && p.dst == dst\r\n}\r\n\r\nlemma Lemma_ReceivedPacketAlwaysSingleMessageToProperDestination(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= idx < |c.hostIds|;\r\n ensures 0 <= idx < |b[i].hosts|;\r\n ensures var p := b[i].hosts[idx].host.receivedPacket;\r\n p.Some? ==> p.v.msg.SingleMessage? && p.v.dst == c.hostIds[idx];\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n \r\n Lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n Lemma_ConstantsAllConsistent(b, c, i-1);\r\n Lemma_ReceivedPacketAlwaysSingleMessageToProperDestination(b, c, i-1, idx);\r\n\r\n if b[i].hosts[idx].host.receivedPacket == b[i-1].hosts[idx].host.receivedPacket\r\n {\r\n return;\r\n }\r\n\r\n var ap := Lemma_ActionThatChangesHostIsThatHostsAction(b, c, i-1, idx);\r\n}\r\n\r\nlemma Lemma_ReceivedPacketInTombstoneTable(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= idx < |b[i].hosts|;\r\n requires b[i].hosts[idx].host.receivedPacket.Some?;\r\n requires b[i].hosts[idx].host.receivedPacket.v.msg.SingleMessage?;\r\n ensures var host := b[i].hosts[idx].host;\r\n TombstoneTableLookup(host.receivedPacket.v.src, host.sd.receiveState) >= host.receivedPacket.v.msg.seqno;\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n Lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n Lemma_ConstantsAllConsistent(b, c, i-1);\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var host := b[i-1].hosts[idx].host;\r\n var host' := b[i].hosts[idx].host;\r\n var src := host'.receivedPacket.v.src;\r\n\r\n if host'.receivedPacket == host.receivedPacket\r\n {\r\n Lemma_ReceivedPacketInTombstoneTable(b, c, i-1, idx);\r\n Lemma_RecipientSequenceNumberMonotonicOneStep(b, c, i-1, src, idx);\r\n return;\r\n }\r\n\r\n var ap := Lemma_ActionThatChangesHostIsThatHostsAction(b, c, i-1, idx);\r\n}\r\n\r\nlemma Lemma_PacketsProcessedInDifferentStepsHaveDifferentSourcesOrSequenceNumbers(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n j:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, j);\r\n requires 0 <= i < j;\r\n requires 0 <= idx < |b[i].hosts| == |b[i+1].hosts| == |b[j].hosts| == |c.hostIds|;\r\n requires b[i].environment.nextStep.LEnvStepHostIos?;\r\n requires b[i].environment.nextStep.actor == c.hostIds[idx];\r\n requires b[i].hosts[idx].host.receivedPacket.Some?;\r\n requires b[i+1].hosts[idx].host.receivedPacket.None?;\r\n requires b[j].environment.nextStep.LEnvStepHostIos?;\r\n requires b[j].environment.nextStep.actor == c.hostIds[idx];\r\n requires b[j].hosts[idx].host.receivedPacket.Some?;\r\n ensures b[i].hosts[idx].host.receivedPacket.v.msg.SingleMessage?;\r\n ensures b[j].hosts[idx].host.receivedPacket.v.msg.SingleMessage?;\r\n ensures var p1 := b[i].hosts[idx].host.receivedPacket.v;\r\n var p2 := b[j].hosts[idx].host.receivedPacket.v;\r\n p1.src != p2.src || p1.msg.seqno < p2.msg.seqno;\r\n{\r\n Lemma_ReceivedPacketAlwaysSingleMessageToProperDestination(b, c, i, idx);\r\n Lemma_ReceivedPacketAlwaysSingleMessageToProperDestination(b, c, j, idx);\r\n\r\n var p1 := b[i].hosts[idx].host.receivedPacket.v;\r\n var p2 := b[j].hosts[idx].host.receivedPacket.v;\r\n if p1.src != p2.src\r\n {\r\n return;\r\n }\r\n\r\n Lemma_ReceivedPacketInTombstoneTable(b, c, i, idx);\r\n\r\n var x := stepmap(imap k :: 0 <= idx < |b[k].hosts|\r\n && b[k].hosts[idx].host.receivedPacket.Some?\r\n && b[k].hosts[idx].host.receivedPacket.v == p2);\r\n assert !sat(i+1, x);\r\n assert sat(j, x);\r\n var transition_step := earliestStepBetween(i+1, j, x) - 1;\r\n assert i+1 <= transition_step < j;\r\n assert !sat(transition_step, x);\r\n Lemma_ConstantsAllConsistent(b, c, transition_step);\r\n\r\n var ap := Lemma_ActionThatChangesHostIsThatHostsAction(b, c, transition_step, idx);\r\n Lemma_RecipientSequenceNumberMonotonic(b, c, i, transition_step, p2.src, idx);\r\n}\r\n\r\nlemma Lemma_GetPacketsFromShardStepsOfHost(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n host_idx:int,\r\n shard_steps:set\r\n )\r\n returns\r\n (shard_packets:set)\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= host_idx < |c.hostIds|;\r\n requires forall step :: step in shard_steps ==> 0 <= step < i && IsShardStepOfHost(b[step], b[step+1], host_idx);\r\n ensures forall shard_packet :: shard_packet in shard_packets ==> shard_packet.dst == c.hostIds[host_idx];\r\n ensures shard_packets <= AllShardPacketsSent(b[i].environment.sentPackets);\r\n ensures |shard_steps| == |shard_packets|;\r\n{\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var f := ((step:int) requires step in shard_steps && IsShardStepOfHost(b[step], b[step+1], host_idx) =>\r\n PacketToLSHTPacket(b[step].hosts[host_idx].host.receivedPacket.v));\r\n shard_packets := set step | step in shard_steps :: f(step);\r\n\r\n assert forall step :: step in shard_steps ==> f(step) in shard_packets;\r\n\r\n forall shard_packet | shard_packet in shard_packets\r\n ensures shard_packet.dst == c.hostIds[host_idx];\r\n {\r\n var step :| step in shard_steps && shard_packet == f(step);\r\n Lemma_ConstantsAllConsistent(b, c, step);\r\n }\r\n \r\n forall step1, step2 | step1 in shard_steps\r\n && step2 in shard_steps\r\n && f(step1) in shard_packets\r\n && f(step2) in shard_packets\r\n && f(step1) == f(step2)\r\n && step1 != step2\r\n ensures false;\r\n {\r\n Lemma_ConstantsAllConsistent(b, c, step1);\r\n Lemma_ConstantsAllConsistent(b, c, step2);\r\n var p1 := b[step1].hosts[host_idx].host.receivedPacket.v;\r\n var p2 := b[step2].hosts[host_idx].host.receivedPacket.v;\r\n Lemma_ReceivedPacketWasSent(b, c, step1, host_idx);\r\n Lemma_ReceivedPacketWasSent(b, c, step2, host_idx);\r\n assert p1.src == p2.src;\r\n if step1 < step2\r\n {\r\n Lemma_ConstantsAllConsistent(b, c, step1+1);\r\n Lemma_PacketsProcessedInDifferentStepsHaveDifferentSourcesOrSequenceNumbers(b, c, step1, step2, host_idx);\r\n }\r\n else\r\n {\r\n Lemma_ConstantsAllConsistent(b, c, step2+1);\r\n Lemma_PacketsProcessedInDifferentStepsHaveDifferentSourcesOrSequenceNumbers(b, c, step2, step1, host_idx);\r\n }\r\n assert p1.msg.seqno != p2.msg.seqno;\r\n assert false;\r\n }\r\n\r\n lemma_MapSetCardinalityOver(shard_steps, shard_packets, f);\r\n\r\n var all_shard_packets := AllShardPacketsSent(b[i].environment.sentPackets);\r\n forall shard_packet | shard_packet in shard_packets\r\n ensures shard_packet in all_shard_packets;\r\n {\r\n var step :| step in shard_steps && shard_packet == f(step);\r\n Lemma_ReceivedPacketWasSent(b, c, step, host_idx);\r\n Lemma_PacketStaysInSentPackets(b, c, step, i, shard_packet);\r\n }\r\n assert shard_packets <= all_shard_packets;\r\n}\r\n\r\nlemma Lemma_GetPacketsFromShardStepsOfOtherHost(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n host_idx:int,\r\n shard_steps:set\r\n )\r\n returns\r\n (shard_packets:set)\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= host_idx < |c.hostIds|;\r\n requires forall step :: step in shard_steps ==> 0 <= step < i && IsShardStepOfOtherHost(b[step], b[step+1], host_idx);\r\n ensures forall shard_packet :: shard_packet in shard_packets ==> shard_packet.dst != c.hostIds[host_idx];\r\n ensures shard_packets <= AllShardPacketsSent(b[i].environment.sentPackets);\r\n ensures |shard_steps| == |shard_packets|;\r\n{\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var f := ((step:int) requires step in shard_steps && IsShardStepOfOtherHost(b[step], b[step+1], host_idx) =>\r\n var other_idx :| other_idx != host_idx && IsShardStepOfHost(b[step], b[step+1], other_idx);\r\n PacketToLSHTPacket(b[step].hosts[other_idx].host.receivedPacket.v));\r\n shard_packets := set step | step in shard_steps :: f(step);\r\n\r\n assert forall step :: step in shard_steps ==> f(step) in shard_packets;\r\n\r\n forall shard_packet | shard_packet in shard_packets\r\n ensures shard_packet.dst != c.hostIds[host_idx];\r\n {\r\n var step :| step in shard_steps && shard_packet == f(step);\r\n var other_idx :| other_idx != host_idx && IsShardStepOfHost(b[step], b[step+1], other_idx);\r\n Lemma_ConstantsAllConsistent(b, c, step);\r\n assert HostsDistinct(c.hostIds, host_idx, other_idx);\r\n }\r\n \r\n forall step1, step2 | step1 in shard_steps\r\n && step2 in shard_steps\r\n && f(step1) in shard_packets\r\n && f(step2) in shard_packets\r\n && f(step1) == f(step2)\r\n && step1 != step2\r\n ensures false;\r\n {\r\n Lemma_ConstantsAllConsistent(b, c, step1);\r\n Lemma_ConstantsAllConsistent(b, c, step2);\r\n var other_idx1 :| other_idx1 != host_idx\r\n && IsShardStepOfHost(b[step1], b[step1+1], other_idx1)\r\n && f(step1) == PacketToLSHTPacket(b[step1].hosts[other_idx1].host.receivedPacket.v);\r\n var other_idx2 :| other_idx2 != host_idx\r\n && IsShardStepOfHost(b[step2], b[step2+1], other_idx2)\r\n && f(step2) == PacketToLSHTPacket(b[step2].hosts[other_idx2].host.receivedPacket.v);\r\n var p1 := b[step1].hosts[other_idx1].host.receivedPacket.v;\r\n var p2 := b[step2].hosts[other_idx2].host.receivedPacket.v;\r\n Lemma_ReceivedPacketWasSent(b, c, step1, other_idx1);\r\n Lemma_ReceivedPacketWasSent(b, c, step2, other_idx2);\r\n assert HostsDistinct(c.hostIds, other_idx1, other_idx2);\r\n if step1 < step2\r\n {\r\n Lemma_ConstantsAllConsistent(b, c, step1+1);\r\n Lemma_PacketsProcessedInDifferentStepsHaveDifferentSourcesOrSequenceNumbers(b, c, step1, step2, other_idx1);\r\n }\r\n else\r\n {\r\n Lemma_ConstantsAllConsistent(b, c, step2+1);\r\n Lemma_PacketsProcessedInDifferentStepsHaveDifferentSourcesOrSequenceNumbers(b, c, step2, step1, other_idx2);\r\n }\r\n assert p1.msg.seqno != p2.msg.seqno;\r\n assert false;\r\n }\r\n\r\n lemma_MapSetCardinalityOver(shard_steps, shard_packets, f);\r\n\r\n var all_shard_packets := AllShardPacketsSent(b[i].environment.sentPackets);\r\n forall shard_packet | shard_packet in shard_packets\r\n ensures shard_packet in all_shard_packets;\r\n {\r\n var step :| step in shard_steps && shard_packet == f(step);\r\n var other_idx :| other_idx != host_idx\r\n && IsShardStepOfHost(b[step], b[step+1], other_idx)\r\n && shard_packet == PacketToLSHTPacket(b[step].hosts[other_idx].host.receivedPacket.v);\r\n Lemma_ReceivedPacketWasSent(b, c, step, other_idx);\r\n Lemma_PacketStaysInSentPackets(b, c, step, i, shard_packet);\r\n }\r\n assert shard_packets <= all_shard_packets;\r\n}\r\n\r\nlemma {:timeLimitMultiplier 3} Lemma_GetShardStepsLeadingToDelegateMessages(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n host_idx:int\r\n ) returns\r\n (shard_steps:set)\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= host_idx < |c.hostIds|;\r\n ensures 0 <= host_idx < |b[i].hosts|;\r\n ensures |shard_steps| == |AllDelegatePacketsToHost(b, i, c.hostIds[host_idx])|;\r\n ensures forall step :: step in shard_steps ==> 0 <= step < i && IsShardStepOfOtherHost(b[step], b[step+1], host_idx);\r\n{\r\n if i == 0 {\r\n shard_steps := {};\r\n return;\r\n }\r\n\r\n Lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n Lemma_ConstantsAllConsistent(b, c, i-1);\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n shard_steps := Lemma_GetShardStepsLeadingToDelegateMessages(b, c, i-1, host_idx);\r\n\r\n var dst := c.hostIds[host_idx];\r\n var s := b[i-1].hosts[host_idx].host;\r\n var s' := b[i].hosts[host_idx].host;\r\n\r\n if AllDelegatePacketsToHost(b, i, dst) == AllDelegatePacketsToHost(b, i-1, dst)\r\n {\r\n return;\r\n }\r\n\r\n var p :| p in b[i].environment.sentPackets\r\n && p !in b[i-1].environment.sentPackets\r\n && p.src in b[i].config.hostIds\r\n && p.msg.SingleMessage?\r\n && p.msg.m.Delegate?\r\n && p.dst == dst;\r\n var ap := Lemma_ActionThatSendsPacketIsActionOfSource(b, c, i-1, p);\r\n Lemma_ActionThatSendsFreshPacketIsNotResend(b, c, i-1, ap, p);\r\n \r\n assert ap.nextActionIndex == 1;\r\n assert ap.idx != host_idx;\r\n\r\n Lemma_ReceivedPacketAlwaysSingleMessageToProperDestination(b, c, i-1, ap.idx);\r\n assert IsShardStepOfHost(b[i-1], b[i], ap.idx);\r\n shard_steps := shard_steps + {i-1};\r\n\r\n assert AllDelegatePacketsToHost(b, i, dst) == AllDelegatePacketsToHost(b, i-1, dst) + {p};\r\n}\r\n\r\nlemma Lemma_GetPacketsFromDelegateSteps(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n host_idx:int,\r\n delegate_steps:set\r\n )\r\n returns\r\n (delegate_packets:set)\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= host_idx < |c.hostIds|;\r\n requires forall step :: step in delegate_steps ==> 0 <= step < i && IsDelegateStep(b[step], b[step+1], host_idx);\r\n ensures delegate_packets <= AllDelegatePacketsToHost(b, i, c.hostIds[host_idx]);\r\n ensures |delegate_steps| == |delegate_packets|;\r\n{\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var dst := c.hostIds[host_idx];\r\n var f := ((step:int) requires step in delegate_steps && IsDelegateStep(b[step], b[step+1], host_idx) =>\r\n PacketToLSHTPacket(b[step].hosts[host_idx].host.receivedPacket.v));\r\n delegate_packets := set step | step in delegate_steps :: f(step);\r\n\r\n assert forall step :: step in delegate_steps ==> f(step) in delegate_packets;\r\n\r\n forall step1, step2 | step1 in delegate_steps\r\n && step2 in delegate_steps\r\n && f(step1) in delegate_packets\r\n && f(step2) in delegate_packets\r\n && f(step1) == f(step2)\r\n && step1 != step2\r\n ensures false;\r\n {\r\n Lemma_ConstantsAllConsistent(b, c, step1);\r\n Lemma_ConstantsAllConsistent(b, c, step2);\r\n var p1 := b[step1].hosts[host_idx].host.receivedPacket.v;\r\n var p2 := b[step2].hosts[host_idx].host.receivedPacket.v;\r\n Lemma_ReceivedPacketWasSent(b, c, step1, host_idx);\r\n Lemma_ReceivedPacketWasSent(b, c, step2, host_idx);\r\n assert p1.src == p2.src;\r\n if step1 < step2\r\n {\r\n Lemma_ConstantsAllConsistent(b, c, step1+1);\r\n Lemma_PacketsProcessedInDifferentStepsHaveDifferentSourcesOrSequenceNumbers(b, c, step1, step2, host_idx);\r\n }\r\n else\r\n {\r\n Lemma_ConstantsAllConsistent(b, c, step2+1);\r\n Lemma_PacketsProcessedInDifferentStepsHaveDifferentSourcesOrSequenceNumbers(b, c, step2, step1, host_idx);\r\n }\r\n assert p1.msg.seqno != p2.msg.seqno;\r\n assert false;\r\n }\r\n\r\n lemma_MapSetCardinalityOver(delegate_steps, delegate_packets, f);\r\n\r\n var all_delegate_packets := AllDelegatePacketsToHost(b, i, dst);\r\n forall delegate_packet | delegate_packet in delegate_packets\r\n ensures delegate_packet in all_delegate_packets;\r\n {\r\n var step :| step in delegate_steps && delegate_packet == f(step);\r\n Lemma_ConstantsAllConsistent(b, c, step);\r\n Lemma_ReceivedPacketWasSent(b, c, step, host_idx);\r\n Lemma_PacketStaysInSentPackets(b, c, step, i, delegate_packet);\r\n assert delegate_packet.dst == dst;\r\n }\r\n assert delegate_packets <= all_delegate_packets;\r\n}\r\n\r\n\r\nlemma Lemma_GetDelegateAndShardStepsLeadingToNumDelegations(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n host_idx:int\r\n ) returns\r\n (delegate_steps:set,\r\n shard_steps:set)\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= host_idx < |c.hostIds|;\r\n ensures 0 <= host_idx < |b[i].hosts|;\r\n ensures |delegate_steps| + |shard_steps| + 1 == b[i].hosts[host_idx].host.numDelegations;\r\n ensures forall step :: step in delegate_steps ==> 0 <= step < i && IsDelegateStep(b[step], b[step+1], host_idx);\r\n ensures forall step :: step in shard_steps ==> 0 <= step < i && IsShardStepOfHost(b[step], b[step+1], host_idx);\r\n{\r\n if i == 0 {\r\n delegate_steps := {};\r\n shard_steps := {};\r\n return;\r\n }\r\n\r\n Lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n Lemma_ConstantsAllConsistent(b, c, i-1);\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n delegate_steps, shard_steps := Lemma_GetDelegateAndShardStepsLeadingToNumDelegations(b, c, i-1, host_idx);\r\n\r\n var s := b[i-1].hosts[host_idx].host;\r\n var s' := b[i].hosts[host_idx].host;\r\n\r\n if s'.numDelegations == s.numDelegations\r\n {\r\n return;\r\n }\r\n\r\n var ap := Lemma_ActionThatChangesHostIsThatHostsAction(b, c, i-1, host_idx);\r\n assert ap.nextActionIndex == 1;\r\n assert s'.numDelegations == s.numDelegations + 1;\r\n\r\n Lemma_ReceivedPacketAlwaysSingleMessageToProperDestination(b, c, i-1, host_idx);\r\n\r\n if IsShardStepOfHost(b[i-1], b[i], host_idx)\r\n {\r\n shard_steps := shard_steps + {i-1};\r\n }\r\n else\r\n {\r\n assert IsDelegateStep(b[i-1], b[i], host_idx);\r\n delegate_steps := delegate_steps + {i-1};\r\n }\r\n}\r\n\r\nlemma Lemma_DelegationBound(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n host_idx:int\r\n )\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= i;\r\n requires 0 <= host_idx < |asp.c.hostIds|;\r\n ensures 0 <= host_idx < |b[i].hosts|;\r\n ensures b[i].hosts[host_idx].host.numDelegations < asp.c.params.max_delegations - 2;\r\n{\r\n Lemma_ConstantsAllConsistent(b, asp.c, i);\r\n\r\n var host := asp.c.hostIds[host_idx];\r\n var delegate_steps, shard_steps_direct := Lemma_GetDelegateAndShardStepsLeadingToNumDelegations(b, asp.c, i, host_idx);\r\n var shard_packets_direct := Lemma_GetPacketsFromShardStepsOfHost(b, asp.c, i, host_idx, shard_steps_direct);\r\n var delegate_packets := Lemma_GetPacketsFromDelegateSteps(b, asp.c, i, host_idx, delegate_steps);\r\n var all_delegate_packets := AllDelegatePacketsToHost(b, i, asp.c.hostIds[host_idx]);\r\n SubsetCardinality(delegate_packets, all_delegate_packets);\r\n \r\n var shard_steps_indirect := Lemma_GetShardStepsLeadingToDelegateMessages(b, asp.c, i, host_idx);\r\n assert |shard_steps_indirect| == |all_delegate_packets|;\r\n var shard_packets_indirect := Lemma_GetPacketsFromShardStepsOfOtherHost(b, asp.c, i, host_idx, shard_steps_indirect);\r\n\r\n forall p1, p2 | p1 in shard_packets_direct && p2 in shard_packets_indirect\r\n ensures p1 != p2;\r\n {\r\n assert p1.dst == host;\r\n assert p2.dst != host;\r\n }\r\n var shard_packets := shard_packets_direct + shard_packets_indirect;\r\n assert |shard_packets| == |shard_packets_direct| + |shard_packets_indirect|;\r\n\r\n var all_shard_packets := AllShardPacketsSent(b[i].environment.sentPackets);\r\n SubsetCardinality(shard_packets, all_shard_packets);\r\n\r\n calc {\r\n b[i].hosts[host_idx].host.numDelegations;\r\n |delegate_steps| + |shard_steps_direct| + 1;\r\n |delegate_packets| + |shard_packets_direct| + 1;\r\n <= |all_delegate_packets| + |shard_packets_direct| + 1;\r\n |shard_steps_indirect| + |shard_packets_direct| + 1;\r\n |shard_packets_indirect| + |shard_packets_direct| + 1;\r\n |shard_packets| + 1;\r\n <= |all_shard_packets| + 1;\r\n <= asp.c.params.max_delegations - 4 + 1;\r\n }\r\n}\r\n\r\nlemma Lemma_ReceivedPacketSlotEmptyUnlessNextActionIndexOne(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= i;\r\n requires 0 <= idx < |asp.c.hostIds|;\r\n ensures 0 <= idx < |b[i].hosts|;\r\n ensures var s := b[i].hosts[idx];\r\n s.host.receivedPacket.Some? ==> s.nextActionIndex == 1;\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n Lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n Lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n Lemma_ReceivedPacketSlotEmptyUnlessNextActionIndexOne(b, asp, i-1, idx);\r\n\r\n if b[i-1].hosts[idx] == b[i].hosts[idx]\r\n {\r\n return;\r\n }\r\n\r\n var ap := Lemma_ActionThatChangesHostIsThatHostsAction(b, asp.c, i-1, idx);\r\n Lemma_ReceivedPacketAlwaysSingleMessageToProperDestination(b, asp.c, i-1, idx);\r\n assert 0 <= idx < |asp.c.hostIds| && 0 <= i-1 && 0 <= idx < |b[i-1].hosts|;\r\n Lemma_DelegationBound(b, asp, i-1, idx);\r\n assert b[i-1].hosts[idx].host.numDelegations < asp.c.params.max_delegations - 2;\r\n}\r\n\r\n\r\nlemma Lemma_PacketInHostQueueStaysThereUnlessActionZeroOccurs(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n host_idx:int,\r\n host:NodeIdentity,\r\n p:LSHTPacket\r\n )\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= i;\r\n requires 0 <= host_idx < |asp.c.hostIds|;\r\n requires host == asp.c.hostIds[host_idx];\r\n requires host in b[i].environment.hostInfo;\r\n requires |b[i].environment.hostInfo[host].queue| > 0;\r\n requires p == b[i].environment.hostInfo[host].queue[0];\r\n requires !( b[i].environment.nextStep.LEnvStepHostIos?\r\n && b[i].environment.nextStep.actor == host\r\n && 0 <= host_idx < |b[i].hosts|\r\n && b[i].hosts[host_idx].nextActionIndex == 0);\r\n ensures host in b[i+1].environment.hostInfo;\r\n ensures |b[i+1].environment.hostInfo[host].queue| > 0;\r\n ensures p == b[i+1].environment.hostInfo[host].queue[0];\r\n{\r\n Lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n Lemma_ConstantsAllConsistent(b, asp.c, i);\r\n Lemma_HostQueuesNext(b, asp, i);\r\n\r\n var hostQueue := if host in b[i].environment.hostInfo then b[i].environment.hostInfo[host].queue else [];\r\n var hostQueue' := if host in b[i+1].environment.hostInfo then b[i+1].environment.hostInfo[host].queue else [];\r\n\r\n if b[i].environment.nextStep.LEnvStepHostIos? \r\n && b[i].environment.nextStep.actor in b[i].config.hostIds\r\n {\r\n var ap := Lemma_GetParametersOfAction(b, asp.c, i);\r\n var id := asp.c.hostIds[ap.idx];\r\n if ap.idx != host_idx\r\n {\r\n assert HostsDistinct(asp.c.hostIds, ap.idx, host_idx);\r\n assert hostQueue' == hostQueue;\r\n }\r\n else\r\n {\r\n assert HostQueue_PerformIos(hostQueue, hostQueue', ap.ios);\r\n assert ap.nextActionIndex != 0;\r\n assert |ap.ios| == 0 || (ap.ios[0] in ap.ios /* trigger */ && ap.ios[0].LIoOpSend?);\r\n assert hostQueue' == hostQueue;\r\n }\r\n }\r\n}\r\n\r\n\r\nlemma Lemma_PacketInHostQueueEventuallyReceived(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n current_step:int,\r\n host_idx:int,\r\n p:LSHTPacket\r\n )\r\n returns\r\n (next_step:int,\r\n ap:SHTActionParams)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= current_step;\r\n requires 0 <= host_idx < |asp.c.hostIds|;\r\n requires asp.c.hostIds[host_idx] in b[current_step].environment.hostInfo;\r\n requires p in b[current_step].environment.hostInfo[asp.c.hostIds[host_idx]].queue;\r\n ensures current_step <= next_step;\r\n ensures SHTActionOccurred(b[next_step], b[next_step+1], ap);\r\n ensures ap.idx == host_idx;\r\n ensures ap.nextActionIndex == 0;\r\n ensures b[next_step].hosts[host_idx].host.receivedPacket.None?;\r\n ensures |ap.ios| > 0;\r\n ensures ap.ios[0] == LIoOpReceive(p);\r\n{\r\n var host := asp.c.hostIds[host_idx];\r\n var intermediate_step := Lemma_PacketInHostQueueEventuallyAtFrontOfHostQueue(b, asp, current_step, host_idx, p);\r\n\r\n var P := stepmap(imap i :: host in b[i].environment.hostInfo\r\n && |b[i].environment.hostInfo[host].queue| > 0\r\n && p == b[i].environment.hostInfo[host].queue[0]);\r\n var Q := stepmap(imap i :: host in b[i].environment.hostInfo\r\n && |b[i].environment.hostInfo[host].queue| > 0\r\n && p == b[i].environment.hostInfo[host].queue[0]\r\n && b[i].environment.nextStep.LEnvStepHostIos?\r\n && b[i].environment.nextStep.actor == host\r\n && 0 <= host_idx < |b[i].hosts|\r\n && b[i].hosts[host_idx].nextActionIndex == 0);\r\n\r\n var action_step := Lemma_HostNextPerformsSubactionEventually(b, asp, host_idx, intermediate_step, 0);\r\n\r\n forall j | intermediate_step <= j\r\n ensures sat(j, TemporalWF1Req1(P, Q));\r\n {\r\n if sat(j, P) && !sat(j, Q)\r\n {\r\n Lemma_PacketInHostQueueStaysThereUnlessActionZeroOccurs(b, asp, j, host_idx, host, p);\r\n assert sat(j+1, P);\r\n }\r\n }\r\n\r\n forall ensures sat(action_step, imply(P, or(Q, next(Q))))\r\n {\r\n if sat(action_step, P)\r\n {\r\n Lemma_ConstantsAllConsistent(b, asp.c, action_step);\r\n var ap_intermediate := Lemma_GetParametersOfAction(b, asp.c, action_step);\r\n Lemma_GetHostIndexIsUnique(asp.c, host_idx);\r\n assert host_idx == ap_intermediate.idx;\r\n assert sat(action_step, Q);\r\n }\r\n }\r\n\r\n next_step := TemporalWF1Specific(intermediate_step, action_step, P, Q);\r\n Lemma_ConstantsAllConsistent(b, asp.c, next_step);\r\n ap := Lemma_GetParametersOfAction(b, asp.c, next_step);\r\n Lemma_GetHostIndexIsUnique(asp.c, host_idx);\r\n Lemma_ReceivedPacketSlotEmptyUnlessNextActionIndexOne(b, asp, next_step, host_idx);\r\n Lemma_HostQueuesNext(b, asp, next_step);\r\n}\r\n\r\n\r\nlemma Lemma_DeliveredPacketEventuallyReceived(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n deliver_step:int,\r\n host_idx:int,\r\n p:LSHTPacket\r\n )\r\n returns\r\n (next_step:int,\r\n ap:SHTActionParams)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= deliver_step;\r\n requires 0 <= host_idx < |asp.c.hostIds|;\r\n requires p.dst == asp.c.hostIds[host_idx];\r\n requires b[deliver_step].environment.nextStep == LEnvStepDeliverPacket(p);\r\n ensures deliver_step + 1 <= next_step;\r\n ensures SHTActionOccurred(b[next_step], b[next_step+1], ap);\r\n ensures ap.idx == host_idx;\r\n ensures ap.nextActionIndex == 0;\r\n ensures b[next_step].hosts[host_idx].host.receivedPacket.None?;\r\n ensures |ap.ios| > 0;\r\n ensures ap.ios[0] == LIoOpReceive(p);\r\n{\r\n Lemma_AssumptionsMakeValidTransition(b, asp.c, deliver_step);\r\n Lemma_HostQueuesNext(b, asp, deliver_step);\r\n next_step, ap := Lemma_PacketInHostQueueEventuallyReceived(b, asp, deliver_step + 1, host_idx, p);\r\n}\r\n\r\n\r\nlemma Lemma_PacketSentInfinitelyOftenEventuallyReceived(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n current_step:int,\r\n src_idx:int,\r\n dst_idx:int,\r\n p:LSHTPacket\r\n )\r\n returns\r\n (receive_step:int,\r\n ap:SHTActionParams)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= src_idx < |asp.c.hostIds|;\r\n requires 0 <= dst_idx < |asp.c.hostIds|;\r\n requires sat(current_step, always(eventual(SHTPacketSentTemporal(b, p))));\r\n requires 0 <= current_step;\r\n requires p.src == asp.c.hostIds[src_idx];\r\n requires p.dst == asp.c.hostIds[dst_idx];\r\n ensures current_step <= receive_step;\r\n ensures SHTActionOccurred(b[receive_step], b[receive_step+1], ap);\r\n ensures ap.idx == dst_idx;\r\n ensures ap.nextActionIndex == 0;\r\n ensures b[receive_step].hosts[dst_idx].host.receivedPacket.None?;\r\n ensures |ap.ios| > 0;\r\n ensures ap.ios[0] == LIoOpReceive(p);\r\n{\r\n var eb := RestrictBehaviorToEnvironment(b);\r\n var host_set := Collections__Sets_i.SeqToSet(asp.c.hostIds);\r\n assert NetworkWeaklyFair(eb, asp.c.hostIds);\r\n\r\n forall i | current_step <= i\r\n ensures sat(i, eventual(PacketSentBetweenHostsTemporal(eb, p, host_set, host_set)));\r\n {\r\n TemporalDeduceFromAlways(current_step, i, eventual(SHTPacketSentTemporal(b, p)));\r\n var j := TemporalDeduceFromEventual(i, SHTPacketSentTemporal(b, p));\r\n Lemma_HostQueuesNext(b, asp, j);\r\n Lemma_ConstantsAllConsistent(b, asp.c, j);\r\n Lemma_GetHostIndexIsUnique(asp.c, src_idx);\r\n Lemma_GetHostIndexIsUnique(asp.c, dst_idx);\r\n assert PacketSentBetweenHosts(eb[j], p, host_set, host_set);\r\n TemporalEventually(i, j, PacketSentBetweenHostsTemporal(eb, p, host_set, host_set));\r\n }\r\n TemporalAlways(current_step, eventual(PacketSentBetweenHostsTemporal(eb, p, host_set, host_set)));\r\n \r\n TemporalDeduceFromAlways(0, current_step, imply(always(eventual(PacketSentBetweenHostsTemporal(eb, p, host_set, host_set))),\r\n eventual(PacketDeliveredTemporal(eb, p))));\r\n var deliver_step := TemporalDeduceFromEventual(current_step, PacketDeliveredTemporal(eb, p));\r\n receive_step, ap := Lemma_DeliveredPacketEventuallyReceived(b, asp, deliver_step, dst_idx, p);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/PacketSending.i.dfy", "content": "include \"../RefinementProof/SHT.i.dfy\"\r\ninclude \"RefinementInvariants.i.dfy\"\r\n\r\nmodule LivenessProof__PacketSending_i {\r\n\r\nimport opened Environment_s\r\nimport opened LivenessProof__Actions_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Constants_i\r\nimport opened LivenessProof__RefinementInvariants_i\r\nimport opened LiveSHT__Environment_i\r\nimport opened LiveSHT__SHT_i\r\nimport opened SHT__Configuration_i\r\nimport opened SHT__Host_i\r\nimport opened SHT__Network_i\r\nimport opened SHT__SingleDelivery_i\r\nimport opened Temporal__Temporal_s\r\n\r\nlemma Lemma_ActionThatSendsPacketIsActionOfSource(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n p:LSHTPacket\r\n )\r\n returns\r\n (ap:SHTActionParams)\r\n requires IsValidBehaviorPrefix(b, c, i+1);\r\n requires 0 <= i;\r\n requires p.src in c.hostIds;\r\n requires p in b[i+1].environment.sentPackets;\r\n requires p !in b[i].environment.sentPackets;\r\n ensures SHTActionOccurred(b[i], b[i+1], ap);\r\n ensures 0 <= ap.idx < |c.hostIds|;\r\n ensures p.src == c.hostIds[ap.idx];\r\n ensures LSHT_Next(b[i], b[i+1]);\r\n ensures LIoOpSend(p) in ap.ios;\r\n{\r\n Lemma_AssumptionsMakeValidTransition(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n assert b[i].environment.nextStep.LEnvStepHostIos?;\r\n assert LIoOpSend(p) in b[i].environment.nextStep.ios;\r\n ap := Lemma_GetParametersOfAction(b, c, i);\r\n}\r\n\r\nlemma Lemma_ActionThatSendsFreshPacketIsNotResend(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n ap:SHTActionParams,\r\n p:LSHTPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1);\r\n requires 0 < i;\r\n requires p in b[i+1].environment.sentPackets;\r\n requires p !in b[i].environment.sentPackets;\r\n requires SHTActionOccurred(b[i], b[i+1], ap);\r\n ensures ap.nextActionIndex != 2;\r\n{\r\n Lemma_AssumptionsMakeValidTransition(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n assert LIoOpSend(p) in ap.ios;\r\n assert LSHTPacketToPacket(p) in ap.out;\r\n if ap.nextActionIndex == 2\r\n {\r\n Lemma_HostConstantsMeHasAppropriateValue(b, c, i, ap.idx);\r\n assert SpontaneouslyRetransmit(ap.host, ap.host', ap.out);\r\n assert ap.out == UnAckedMessages(ap.host.sd, ap.host.me);\r\n var s := ap.host.sd;\r\n var dst, j :| dst in s.sendState\r\n && 0 <= j < |s.sendState[dst].unAcked|\r\n && s.sendState[dst].unAcked[j].SingleMessage?\r\n && LSHTPacketToPacket(p) == Packet(s.sendState[dst].unAcked[j].dst, ap.host.me, s.sendState[dst].unAcked[j]);\r\n assert LSHTPacketToPacket(p).msg == s.sendState[dst].unAcked[j];\r\n assert p.msg == s.sendState[dst].unAcked[j];\r\n Lemma_MessageInUnackedListHasParticularDestination(b, c, i, ap.idx, dst, p.msg);\r\n Lemma_UnAckedPacketInNetwork(b, c, i, ap.idx, p);\r\n }\r\n}\r\n \r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/RefinementInvariants.i.dfy", "content": "include \"Constants.i.dfy\"\r\ninclude \"Actions.i.dfy\"\r\ninclude \"../../SHT/RefinementProof/RefinementProof.i.dfy\"\r\ninclude \"../RefinementProof/SHTRefinement.i.dfy\"\r\ninclude \"../RefinementProof/SHTLemmas.i.dfy\"\r\n\r\nmodule LivenessProof__RefinementInvariants_i {\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Environment_s\r\nimport opened LivenessProof__Actions_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Constants_i\r\nimport opened LiveSHT__Environment_i\r\nimport opened LiveSHT__EnvironmentRefinement_i\r\nimport opened LiveSHT__SHT_i\r\nimport opened LiveSHT__SHTRefinement_i\r\nimport opened RefinementProof__DistributedSystemLemmas_i\r\nimport opened SHT__Configuration_i\r\nimport opened SHT__Delegations_i\r\nimport opened SHT__Host_i\r\nimport opened SHT__InvDefs_i\r\nimport opened SHT__InvProof_i\r\nimport opened SHT__Message_i\r\nimport opened SHT__Network_i\r\nimport opened SHT__RefinementProof_i\r\nimport opened SHT__SHT_i\r\nimport opened SHT__SingleDelivery_i\r\nimport opened SHT__SingleMessage_i\r\nimport opened Temporal__Temporal_s\r\n\r\nfunction PacketToLSHTPacket(p:Packet) : LSHTPacket\r\n{\r\n LPacket(p.dst, p.src, p.msg)\r\n}\r\n\r\nlemma Lemma_ActionMaintainsMapComplete(\r\n ss:LSHT_State,\r\n ss':LSHT_State,\r\n ap:SHTActionParams\r\n )\r\n requires SHTActionOccurred(ss, ss', ap);\r\n requires LSHTState_RefinementInvariant(ss);\r\n requires MapComplete(LSHTState_Refine(ss));\r\n requires ss'.config == ss.config;\r\n requires LSHT_Next(ss, ss');\r\n ensures LSHTState_RefinementInvariant(ss');\r\n ensures MapComplete(LSHTState_Refine(ss'));\r\n{\r\n var h_s := LSHTState_Refine(ss);\r\n\r\n forall idx | 0 <= idx < |ss'.config.hostIds|\r\n ensures DelegationMapComplete(ss'.hosts[idx].host.delegationMap);\r\n {\r\n var id := ss.config.hostIds[idx];\r\n Lemma_GetHostIndexIsUnique(ss.config, idx);\r\n assert DelegationMapComplete(h_s.hosts[id].delegationMap);\r\n assert DelegationMapComplete(ss.hosts[idx].host.delegationMap);\r\n }\r\n}\r\n\r\nlemma Lemma_RefinementInvariantHolds(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n ensures LSHTState_RefinementInvariant(b[i]);\r\n ensures Inv(LSHTState_Refine(b[i]));\r\n{\r\n if i == 0\r\n {\r\n InitInv(c, LSHTState_Refine(b[i]));\r\n return;\r\n }\r\n\r\n Lemma_RefinementInvariantHolds(b, c, i-1);\r\n Lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n Lemma_ConstantsAllConsistent(b, c, i-1);\r\n\r\n var h_s := LSHTState_Refine(b[i-1]);\r\n var h_s' := LSHTState_Refine(b[i]);\r\n\r\n if b[i-1].environment.nextStep.LEnvStepHostIos?\r\n {\r\n if b[i-1].environment.nextStep.actor in b[i-1].config.hostIds {\r\n var ap := Lemma_GetParametersOfAction(b, c, i-1);\r\n Lemma_ActionMaintainsMapComplete(b[i-1], b[i], ap);\r\n var id := c.hostIds[ap.idx];\r\n assert ap.out == LSHTIoSeq_RefineAsSends(ap.ios);\r\n\r\n if ap.nextActionIndex == 0\r\n {\r\n if ap.ios[0].LIoOpTimeoutReceive?\r\n {\r\n assert h_s'.hosts == h_s.hosts;\r\n assert h_s'.network == h_s.network;\r\n assert h_s == h_s';\r\n }\r\n else\r\n {\r\n assert SHT_NextPred(h_s, h_s', id, ap.recv, ap.out);\r\n NextInv(h_s, h_s');\r\n }\r\n }\r\n else if ap.nextActionIndex == 1\r\n {\r\n assert SHT_NextPred(h_s, h_s', id, ap.recv, ap.out);\r\n NextInv(h_s, h_s');\r\n }\r\n else if ap.nextActionIndex == 2\r\n {\r\n if ap.resendCount == 0\r\n {\r\n assert SHT_NextPred(h_s, h_s', id, ap.recv, ap.out);\r\n NextInv(h_s, h_s');\r\n }\r\n else\r\n {\r\n assert h_s'.hosts == h_s.hosts;\r\n assert h_s'.network == h_s.network;\r\n assert h_s == h_s';\r\n }\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n } else {\r\n var s := b[i-1];\r\n var s' := b[i];\r\n\r\n assert exists idx, ios :: LSHT_NextExternal(s, s', idx, ios);\r\n var idx, ios :| LSHT_NextExternal(s, s', idx, ios);\r\n assert SHT_NextExternal(h_s, h_s', idx, {}, LSHTIoSeq_RefineAsSends(ios));\r\n NextInv(h_s, h_s');\r\n }\r\n }\r\n else\r\n {\r\n assert LSHT_NextEnvironment(b[i-1], b[i]);\r\n assert h_s'.hosts == h_s.hosts;\r\n assert h_s'.network == h_s.network;\r\n }\r\n}\r\n\r\nlemma Lemma_PacketsHaveSenderUniqueSeqnos(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n p1:LSHTPacket,\r\n p2:LSHTPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires p1 in b[i].environment.sentPackets;\r\n requires p2 in b[i].environment.sentPackets;\r\n requires p1.msg.SingleMessage?;\r\n requires p2.msg.SingleMessage?;\r\n requires p1.src == p2.src;\r\n requires p1.dst == p2.dst;\r\n requires p1.src in b[i].config.hostIds && p1.dst in b[i].config.hostIds;\r\n requires p2.src in b[i].config.hostIds && p2.dst in b[i].config.hostIds;\r\n requires p1.msg.seqno == p2.msg.seqno;\r\n ensures p1 == p2;\r\n{\r\n Lemma_RefinementInvariantHolds(b, c, i);\r\n\r\n var s := LSHTState_Refine(b[i]);\r\n reveal_PacketsHaveSenderUniqueSeqnos();\r\n\r\n assert LSHTPacketToPacket(p1) in s.network;\r\n assert LSHTPacketToPacket(p2) in s.network;\r\n}\r\n\r\nlemma Lemma_ReceiverHasCanceledNoUnsentSeqno(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n src_idx:int,\r\n dst_idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= src_idx < |c.hostIds|;\r\n requires 0 <= dst_idx < |c.hostIds|;\r\n ensures 0 <= src_idx < |b[i].hosts|;\r\n ensures 0 <= dst_idx < |b[i].hosts|;\r\n ensures HighestSeqnoSent(b[i].hosts[src_idx].host.sd, c.hostIds[dst_idx]) >=\r\n TombstoneTableLookup(c.hostIds[src_idx], b[i].hosts[dst_idx].host.sd.receiveState);\r\n{\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var s := LSHTState_Refine(b[i]);\r\n\r\n Lemma_GetHostIndexIsUnique(b[i].config, src_idx);\r\n Lemma_GetHostIndexIsUnique(b[i].config, dst_idx);\r\n\r\n var src := c.hostIds[src_idx];\r\n var dst := c.hostIds[dst_idx];\r\n var seqno := HighestSeqnoSent(b[i].hosts[src_idx].host.sd, c.hostIds[dst_idx]) + 1;\r\n\r\n Lemma_RefinementInvariantHolds(b, c, i);\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, dst, src, seqno);\r\n assert seqno > TombstoneTableLookup(src, s.hosts[dst].sd.receiveState);\r\n}\r\n\r\nlemma Lemma_MessageInUnackedListHasParticularSeqno(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n src_idx:int,\r\n dst:NodeIdentity,\r\n m:SingleMessage,\r\n pos:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= src_idx < |c.hostIds|;\r\n requires 0 <= src_idx < |b[i].hosts|;\r\n requires dst in c.hostIds;\r\n requires dst in b[i].hosts[src_idx].host.sd.sendState;\r\n requires 0 <= pos < |b[i].hosts[src_idx].host.sd.sendState[dst].unAcked|;\r\n requires m == b[i].hosts[src_idx].host.sd.sendState[dst].unAcked[pos];\r\n ensures m.SingleMessage?;\r\n ensures m.seqno == b[i].hosts[src_idx].host.sd.sendState[dst].numPacketsAcked + pos + 1;\r\n decreases pos;\r\n{\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var s := LSHTState_Refine(b[i]);\r\n Lemma_GetHostIndexIsUnique(b[i].config, src_idx);\r\n\r\n var src := c.hostIds[src_idx];\r\n var ackState := s.hosts[src].sd;\r\n var unAcked := AckStateLookup(dst, ackState.sendState).unAcked;\r\n\r\n Lemma_RefinementInvariantHolds(b, c, i);\r\n assert AckListsInv(s);\r\n assert dst in AllHostIdentities(s);\r\n assert UnAckedListProperties(ackState);\r\n\r\n assert NoAcksInUnAckedLists(ackState);\r\n assert 0 <= pos < |unAcked|;\r\n assert unAcked[pos].SingleMessage?;\r\n\r\n if pos == 0\r\n {\r\n assert UnAckedListExceedsNumPacketsAcked(ackState);\r\n }\r\n else\r\n {\r\n Lemma_MessageInUnackedListHasParticularSeqno(b, c, i, src_idx, dst, unAcked[pos-1], pos-1);\r\n assert UnAckedListsSequential(ackState);\r\n assert unAcked[pos].seqno == unAcked[pos-1].seqno + 1;\r\n }\r\n}\r\n\r\nlemma Lemma_GetPositionOfMessageInUnackedList(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n src_idx:int,\r\n dst:NodeIdentity,\r\n m:SingleMessage\r\n )\r\n returns\r\n (pos:int)\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= src_idx < |c.hostIds|;\r\n requires 0 <= src_idx < |b[i].hosts|;\r\n requires dst in c.hostIds;\r\n requires dst in b[i].hosts[src_idx].host.sd.sendState;\r\n requires m in b[i].hosts[src_idx].host.sd.sendState[dst].unAcked;\r\n ensures 0 <= pos < |b[i].hosts[src_idx].host.sd.sendState[dst].unAcked|;\r\n ensures m == b[i].hosts[src_idx].host.sd.sendState[dst].unAcked[pos];\r\n ensures m.SingleMessage?;\r\n ensures pos == m.seqno - b[i].hosts[src_idx].host.sd.sendState[dst].numPacketsAcked - 1;\r\n{\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n pos :| 0 <= pos < |b[i].hosts[src_idx].host.sd.sendState[dst].unAcked| && b[i].hosts[src_idx].host.sd.sendState[dst].unAcked[pos] == m;\r\n Lemma_MessageInUnackedListHasParticularSeqno(b, c, i, src_idx, dst, m, pos);\r\n}\r\n\r\nlemma Lemma_MessageInUnackedListHasParticularDestination(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n src_idx:int,\r\n dst:NodeIdentity,\r\n m:SingleMessage\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= src_idx < |c.hostIds|;\r\n requires 0 <= src_idx < |b[i].hosts|;\r\n requires dst in b[i].hosts[src_idx].host.sd.sendState;\r\n requires m in b[i].hosts[src_idx].host.sd.sendState[dst].unAcked;\r\n ensures m.SingleMessage?;\r\n ensures m.dst == dst;\r\n{\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var s := LSHTState_Refine(b[i]);\r\n Lemma_GetHostIndexIsUnique(b[i].config, src_idx);\r\n\r\n var src := c.hostIds[src_idx];\r\n var ackState := s.hosts[src].sd;\r\n var unAcked := AckStateLookup(dst, ackState.sendState).unAcked;\r\n\r\n Lemma_RefinementInvariantHolds(b, c, i);\r\n assert AckListsInv(s);\r\n assert UnAckedListProperties(ackState);\r\n\r\n var pos :| 0 <= pos < |unAcked| && unAcked[pos] == m;\r\n assert NoAcksInUnAckedLists(ackState);\r\n assert 0 <= pos < |unAcked|;\r\n assert unAcked[pos].SingleMessage?;\r\n\r\n assert UnAckedDstsConsistent(ackState);\r\n assert m.dst == dst;\r\n}\r\n\r\nlemma Lemma_HostConstantsMeHasAppropriateValue(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= idx < |c.hostIds|;\r\n ensures 0 <= idx < |b[i].hosts|;\r\n ensures b[i].hosts[idx].host.me == c.hostIds[idx];\r\n{\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var s := LSHTState_Refine(b[i]);\r\n\r\n Lemma_RefinementInvariantHolds(b, c, i);\r\n assert InvConstants(s);\r\n var id := c.hostIds[idx];\r\n assert id in AllHostIdentities(s);\r\n}\r\n\r\nlemma Lemma_ReceivedPacketWasSent(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= idx < |b[i].hosts|;\r\n requires b[i].hosts[idx].host.receivedPacket.Some?;\r\n ensures PacketToLSHTPacket(b[i].hosts[idx].host.receivedPacket.v) in b[i].environment.sentPackets;\r\n{\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var s := LSHTState_Refine(b[i]);\r\n\r\n Lemma_RefinementInvariantHolds(b, c, i);\r\n assert BufferedPacketsInv(s);\r\n var id := c.hostIds[idx];\r\n Lemma_GetHostIndexIsUnique(c, idx);\r\n assert id in AllHostIdentities(s);\r\n}\r\n\r\nlemma Lemma_UnAckedPacketInNetwork(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n idx:int,\r\n p:LSHTPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i);\r\n requires 0 <= i;\r\n requires 0 <= idx < |b[i].hosts|;\r\n requires 0 <= idx < |c.hostIds|;\r\n requires p.msg in AckStateLookup(p.dst, b[i].hosts[idx].host.sd.sendState).unAcked;\r\n requires p.src == c.hostIds[idx];\r\n ensures p in b[i].environment.sentPackets;\r\n{\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var s := LSHTState_Refine(b[i]);\r\n\r\n Lemma_RefinementInvariantHolds(b, c, i);\r\n\r\n var id := c.hostIds[idx];\r\n Lemma_GetHostIndexIsUnique(c, idx);\r\n assert UnAckedListProperties(s.hosts[id].sd);\r\n assert NoAcksInUnAckedLists(s.hosts[id].sd);\r\n assert UnAckedListInNetwork(s);\r\n reveal_UnAckedListInNetwork();\r\n\r\n assert id in AllHostIdentities(s);\r\n assert p.msg in AckStateLookup(p.dst, s.hosts[id].sd.sendState).unAcked;\r\n assert Packet(p.msg.dst, s.hosts[id].me, p.msg) in s.network;\r\n Lemma_HostConstantsMeHasAppropriateValue(b, c, i, idx);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/RoundRobin.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"../../../Common/Framework/EnvironmentSynchronyLemmas.i.dfy\"\r\ninclude \"../../Common/Liveness/RTSchedule.i.dfy\"\r\n\r\nmodule LivenessProof__RoundRobin_i {\r\nimport opened Collections__Maps2_s\r\nimport opened Liveness__EnvironmentSynchronyLemmas_i\r\nimport opened Liveness__RTSchedule_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Constants_i\r\nimport opened LiveSHT__Scheduler_i\r\nimport opened LiveSHT__SHT_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\n\r\nfunction{:opaque} MakeLSHTAction_ReceivePacket_Temporal(\r\n b:Behavior,\r\n host_index:int\r\n ):temporal\r\n requires imaptotal(b);\r\n ensures forall i {:trigger sat(i, MakeLSHTAction_ReceivePacket_Temporal(b, host_index))} ::\r\n sat(i, MakeLSHTAction_ReceivePacket_Temporal(b, host_index)) <==>\r\n b[i].environment.nextStep.LEnvStepHostIos? \r\n && 0 <= host_index < |b[i].config.hostIds|\r\n && b[i].environment.nextStep.actor == b[i].config.hostIds[host_index] \r\n && 0 <= host_index < |b[i].hosts|\r\n && b[i].hosts[host_index].nextActionIndex == 0\r\n && var ios := b[i].environment.nextStep.ios;\r\n LSHT_NextOneHost(b[i], b[i+1], host_index, ios)\r\n && LHost_ReceivePacket_Next(b[i].hosts[host_index].host, b[i+1].hosts[host_index].host, ios);\r\n{\r\n stepmap(imap i :: b[i].environment.nextStep.LEnvStepHostIos? \r\n && 0 <= host_index < |b[i].config.hostIds|\r\n && b[i].environment.nextStep.actor == b[i].config.hostIds[host_index] \r\n && 0 <= host_index < |b[i].hosts|\r\n && b[i].hosts[host_index].nextActionIndex == 0\r\n && var ios := b[i].environment.nextStep.ios;\r\n LSHT_NextOneHost(b[i], b[i+1], host_index, ios)\r\n && LHost_ReceivePacket_Next(b[i].hosts[host_index].host, b[i+1].hosts[host_index].host, ios))\r\n}\r\n\r\n\r\nfunction{:opaque} MakeLSHTAction_ProcessReceivedPacket_Temporal(\r\n b:Behavior,\r\n host_index:int\r\n ):temporal\r\n requires imaptotal(b);\r\n ensures forall i {:trigger sat(i, MakeLSHTAction_ProcessReceivedPacket_Temporal(b, host_index))} ::\r\n sat(i, MakeLSHTAction_ProcessReceivedPacket_Temporal(b, host_index)) <==>\r\n b[i].environment.nextStep.LEnvStepHostIos? \r\n && 0 <= host_index < |b[i].config.hostIds|\r\n && b[i].environment.nextStep.actor == b[i].config.hostIds[host_index] \r\n && 0 <= host_index < |b[i].hosts|\r\n && b[i].hosts[host_index].nextActionIndex == 1\r\n && var ios := b[i].environment.nextStep.ios;\r\n LSHT_NextOneHost(b[i], b[i+1], host_index, ios)\r\n && LHost_ProcessReceivedPacket_Next(b[i].hosts[host_index].host, b[i+1].hosts[host_index].host, ios);\r\n{\r\n stepmap(imap i :: b[i].environment.nextStep.LEnvStepHostIos? \r\n && 0 <= host_index < |b[i].config.hostIds|\r\n && b[i].environment.nextStep.actor == b[i].config.hostIds[host_index] \r\n && 0 <= host_index < |b[i].hosts|\r\n && b[i].hosts[host_index].nextActionIndex == 1\r\n && var ios := b[i].environment.nextStep.ios;\r\n LSHT_NextOneHost(b[i], b[i+1], host_index, ios)\r\n && LHost_ProcessReceivedPacket_Next(b[i].hosts[host_index].host, b[i+1].hosts[host_index].host, ios))\r\n}\r\n\r\nfunction{:opaque} MakeLSHTAction_NoReceive_Next_Wrapper_Temporal(\r\n b:Behavior,\r\n host_index:int\r\n ):temporal\r\n requires imaptotal(b);\r\n ensures forall i {:trigger sat(i, MakeLSHTAction_NoReceive_Next_Wrapper_Temporal(b, host_index))} ::\r\n sat(i, MakeLSHTAction_NoReceive_Next_Wrapper_Temporal(b, host_index)) <==>\r\n b[i].environment.nextStep.LEnvStepHostIos? \r\n && 0 <= host_index < |b[i].config.hostIds|\r\n && b[i].environment.nextStep.actor == b[i].config.hostIds[host_index] \r\n && 0 <= host_index < |b[i].hosts|\r\n && b[i].hosts[host_index].nextActionIndex == 2\r\n && var ios := b[i].environment.nextStep.ios;\r\n LSHT_NextOneHost(b[i], b[i+1], host_index, ios)\r\n && LHost_NoReceive_Next_Wrapper(b[i].hosts[host_index], b[i+1].hosts[host_index], ios);\r\n{\r\n stepmap(imap i :: b[i].environment.nextStep.LEnvStepHostIos? \r\n && 0 <= host_index < |b[i].config.hostIds|\r\n && b[i].environment.nextStep.actor == b[i].config.hostIds[host_index] \r\n && 0 <= host_index < |b[i].hosts|\r\n && b[i].hosts[host_index].nextActionIndex == 2\r\n && var ios := b[i].environment.nextStep.ios;\r\n LSHT_NextOneHost(b[i], b[i+1], host_index, ios)\r\n && LHost_NoReceive_Next_Wrapper(b[i].hosts[host_index], b[i+1].hosts[host_index], ios))\r\n}\r\n\r\nfunction HostSchedule(b:Behavior, host_index:int):seq\r\n requires imaptotal(b);\r\n{\r\n [ MakeLSHTAction_ReceivePacket_Temporal(b, host_index),\r\n MakeLSHTAction_ProcessReceivedPacket_Temporal(b, host_index),\r\n MakeLSHTAction_NoReceive_Next_Wrapper_Temporal(b, host_index)\r\n ]\r\n}\r\n\r\nlemma Lemma_SHTNextTakesSchedulerActionOrLeavesNextActionIndexUnchanged(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n host_index:int,\r\n next_action_type_fun:imap,\r\n scheduler_action:temporal\r\n )\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= host_index < |asp.c.hostIds|;\r\n requires imaptotal(next_action_type_fun);\r\n requires forall i {:trigger next_action_type_fun[i]} ::\r\n next_action_type_fun[i] == if 0 <= host_index < |b[i].hosts| then b[i].hosts[host_index].nextActionIndex else 0;\r\n requires forall i :: sat(i, scheduler_action) <==> LSHTHostTakesAction(b[i], b[i+1], host_index);\r\n ensures sat(0, always(SchedulerActsOrNextActionTypeUnchangedTemporal(b, next_action_type_fun, scheduler_action)));\r\n{\r\n var m := SchedulerActsOrNextActionTypeUnchangedTemporal(b, next_action_type_fun, scheduler_action);\r\n\r\n forall i | 0 <= i\r\n ensures sat(i, m);\r\n {\r\n assert LSHT_Next(b[i], b[i+1]);\r\n\r\n Lemma_ConstantsAllConsistent(b, asp.c, i);\r\n\r\n if (exists idx, ios :: LSHT_NextOneHost(b[i], b[i+1], idx, ios))\r\n {\r\n var idx, ios :| LSHT_NextOneHost(b[i], b[i+1], idx, ios);\r\n if (idx == host_index)\r\n {\r\n assert sat(i, scheduler_action);\r\n }\r\n else\r\n {\r\n assert next_action_type_fun[i] == next_action_type_fun[i+1];\r\n }\r\n }\r\n else\r\n {\r\n assert next_action_type_fun[i] == next_action_type_fun[i+1];\r\n }\r\n\r\n assert sat(i, m);\r\n }\r\n\r\n TemporalAlways(0, m);\r\n}\r\n\r\nlemma Lemma_HostNextPerformsSubactionEventually(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n host_index:int,\r\n earliest_step:int,\r\n action_index:int\r\n ) returns\r\n (action_step:int)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= host_index < |asp.c.hostIds|;\r\n requires 0 <= action_index < LHost_NumActions();\r\n requires 0 <= earliest_step;\r\n ensures earliest_step <= action_step;\r\n ensures sat(action_step, HostSchedule(b, host_index)[action_index]);\r\n{\r\n var next_action_type_fun := imap i :: if 0 <= host_index < |b[i].hosts| then b[i].hosts[host_index].nextActionIndex else 0;\r\n var scheduler_action := LSHTHostTakesActionTemporal(b, host_index);\r\n var schedule := HostSchedule(b, host_index);\r\n\r\n Lemma_SHTNextTakesSchedulerActionOrLeavesNextActionIndexUnchanged(b, asp, host_index, next_action_type_fun, scheduler_action);\r\n forall i | 0 <= i && sat(i, scheduler_action)\r\n ensures var action_type_index := next_action_type_fun[i];\r\n (0 <= action_type_index < |schedule| ==> sat(i, schedule[action_type_index]))\r\n && next_action_type_fun[i+1] == (action_type_index + 1) % |schedule|;\r\n {\r\n }\r\n\r\n action_step := Lemma_RoundRobinSchedulerEventuallyPerformsSpecificAction(b, next_action_type_fun, scheduler_action, schedule, 0, earliest_step, action_index);\r\n}\r\n\r\nlemma Lemma_HostNextPerformsProcessPacketEventually(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n host_index:int,\r\n earliest_step:int\r\n ) returns\r\n (action_step:int)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= host_index < |asp.c.hostIds|;\r\n requires 0 <= earliest_step;\r\n ensures earliest_step <= action_step;\r\n ensures sat(action_step, ReceiveAttemptedTemporal(RestrictBehaviorToEnvironment(b), asp.c.hostIds[host_index]));\r\n{\r\n action_step := Lemma_HostNextPerformsSubactionEventually(b, asp, host_index, earliest_step, 0);\r\n var host := asp.c.hostIds[host_index];\r\n Lemma_ConstantsAllConsistent(b, asp.c, action_step);\r\n var ios := b[action_step].environment.nextStep.ios;\r\n assert |ios| >= 1 && (ios[0].LIoOpTimeoutReceive? || ios[0].LIoOpReceive?);\r\n assert ReceiveAttemptedInStep(b[action_step].environment, host);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/Seqno.i.dfy", "content": "include \"InfiniteSends.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Rules.i.dfy\"\r\n\r\nmodule LivenessProof__Seqno_i {\r\n\r\nimport opened Environment_s\r\nimport opened LivenessProof__Actions_i\r\nimport opened LivenessProof__Acks_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Constants_i\r\nimport opened LivenessProof__InfiniteSends_i\r\nimport opened LivenessProof__PacketReceipt_i\r\nimport opened LivenessProof__RefinementInvariants_i\r\nimport opened LiveSHT__SHT_i\r\nimport opened LiveSHT__SHTRefinement_i\r\nimport opened SHT__Configuration_i\r\nimport opened SHT__Message_i\r\nimport opened SHT__SingleDelivery_i\r\nimport opened SHT__SingleMessage_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\n\r\nlemma Lemma_IfRecipientSequenceNumberNeverBeyondThenPacketReceived(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n current_step:int,\r\n src_idx:int,\r\n dst_idx:int,\r\n m:SingleMessage\r\n ) returns\r\n (receive_step:int,\r\n ap:SHTActionParams)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= src_idx < |asp.c.hostIds|;\r\n requires 0 <= dst_idx < |asp.c.hostIds|;\r\n requires 0 <= src_idx < |b[current_step].hosts|;\r\n requires 0 <= current_step;\r\n requires m.SingleMessage?;\r\n requires m.dst == asp.c.hostIds[dst_idx];\r\n requires sat(current_step, always(RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, m.seqno)));\r\n requires m.dst in b[current_step].hosts[src_idx].host.sd.sendState;\r\n requires m in b[current_step].hosts[src_idx].host.sd.sendState[m.dst].unAcked;\r\n ensures current_step <= receive_step;\r\n ensures SHTActionOccurred(b[receive_step], b[receive_step+1], ap);\r\n ensures ap.idx == dst_idx;\r\n ensures ap.nextActionIndex == 0;\r\n ensures b[receive_step].hosts[dst_idx].host.receivedPacket.None?;\r\n ensures |ap.ios| > 0;\r\n ensures ap.ios[0] == LIoOpReceive(LPacket(m.dst, asp.c.hostIds[src_idx], m));\r\n{\r\n var p := LPacket(m.dst, asp.c.hostIds[src_idx], m);\r\n Lemma_IfRecipientSequenceNumberNeverBeyondThenPacketSentInfinitelyOften(b, asp, current_step, src_idx, dst_idx, m);\r\n receive_step, ap := Lemma_PacketSentInfinitelyOftenEventuallyReceived(b, asp, current_step, src_idx, dst_idx, p);\r\n}\r\n\r\nlemma Lemma_IfTheresAnUnackedPacketThenRecipientSequenceNumberIncreases(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n current_step:int,\r\n src_idx:int,\r\n dst_idx:int,\r\n m:SingleMessage\r\n ) returns\r\n (next_step:int)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= src_idx < |asp.c.hostIds|;\r\n requires 0 <= dst_idx < |asp.c.hostIds|;\r\n requires 0 <= src_idx < |b[current_step].hosts|;\r\n requires 0 <= dst_idx < |b[current_step].hosts|;\r\n requires 0 <= current_step;\r\n requires m.SingleMessage?;\r\n requires m.dst == asp.c.hostIds[dst_idx];\r\n requires m.dst in b[current_step].hosts[src_idx].host.sd.sendState;\r\n requires m in b[current_step].hosts[src_idx].host.sd.sendState[m.dst].unAcked;\r\n requires TombstoneTableLookup(asp.c.hostIds[src_idx], b[current_step].hosts[dst_idx].host.sd.receiveState) < m.seqno;\r\n ensures current_step <= next_step;\r\n ensures 0 <= dst_idx < |b[next_step].hosts|;\r\n ensures TombstoneTableLookup(asp.c.hostIds[src_idx], b[next_step].hosts[dst_idx].host.sd.receiveState) >\r\n TombstoneTableLookup(asp.c.hostIds[src_idx], b[current_step].hosts[dst_idx].host.sd.receiveState);\r\n{\r\n var src := asp.c.hostIds[src_idx];\r\n var dst := asp.c.hostIds[dst_idx];\r\n Lemma_GetHostIndexIsUnique(asp.c, src_idx);\r\n Lemma_GetHostIndexIsUnique(asp.c, dst_idx);\r\n\r\n Lemma_ConstantsAllConsistent(b, asp.c, current_step);\r\n var receiveState := b[current_step].hosts[dst_idx].host.sd.receiveState;\r\n var sendState := b[current_step].hosts[src_idx].host.sd.sendState;\r\n \r\n var recipientSeqno := TombstoneTableLookup(src, receiveState);\r\n var senderNumAcked := AckStateLookup(dst, sendState).numPacketsAcked;\r\n Lemma_NumPacketsAckedBeforeRecipientSequenceNumber(b, asp.c, current_step, src_idx, dst_idx);\r\n assert senderNumAcked <= recipientSeqno < m.seqno;\r\n var pos := Lemma_GetPositionOfMessageInUnackedList(b, asp.c, current_step, src_idx, dst, m);\r\n assert pos == m.seqno - senderNumAcked - 1 >= 0;\r\n\r\n var m_expected := sendState[dst].unAcked[recipientSeqno - senderNumAcked];\r\n Lemma_MessageInUnackedListHasParticularSeqno(b, asp.c, current_step, src_idx, dst, m_expected, recipientSeqno - senderNumAcked);\r\n assert m_expected.seqno == recipientSeqno + 1;\r\n Lemma_MessageInUnackedListHasParticularDestination(b, asp.c, current_step, src_idx, dst, m_expected);\r\n\r\n if sat(current_step, always(RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, m_expected.seqno)))\r\n {\r\n var receive_step, ap := Lemma_IfRecipientSequenceNumberNeverBeyondThenPacketReceived(b, asp, current_step, src_idx, dst_idx, m_expected);\r\n Lemma_ConstantsAllConsistent(b, asp.c, receive_step);\r\n assert ap.pkt.msg == m_expected;\r\n var last_seqno := TombstoneTableLookup(ap.pkt.src, ap.host.sd.receiveState);\r\n Lemma_RecipientSequenceNumberMonotonic(b, asp.c, current_step, receive_step, src, dst_idx);\r\n assert last_seqno >= recipientSeqno;\r\n if m_expected.seqno == last_seqno + 1\r\n {\r\n assert NewSingleMessage(ap.host.sd, ap.pkt);\r\n next_step := receive_step + 1;\r\n assert TombstoneTableLookup(src, b[next_step].hosts[dst_idx].host.sd.receiveState) >= m_expected.seqno;\r\n }\r\n else\r\n {\r\n next_step := receive_step;\r\n assert TombstoneTableLookup(src, b[receive_step].hosts[dst_idx].host.sd.receiveState) >= m_expected.seqno;\r\n }\r\n return;\r\n }\r\n\r\n TemporalNot(current_step, RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, m_expected.seqno));\r\n next_step := TemporalDeduceFromEventual(current_step, not(RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, m_expected.seqno)));\r\n Lemma_ConstantsAllConsistent(b, asp.c, next_step);\r\n}\r\n\r\nlemma Lemma_IfTheresAnUnackedPacketThenRecipientSequenceNumberReachesItsSequenceNumber(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n current_step:int,\r\n src_idx:int,\r\n dst_idx:int,\r\n m:SingleMessage\r\n ) returns\r\n (next_step:int)\r\n requires LivenessAssumptions(b, asp);\r\n requires 0 <= src_idx < |asp.c.hostIds|;\r\n requires 0 <= dst_idx < |asp.c.hostIds|;\r\n requires 0 <= src_idx < |b[current_step].hosts|;\r\n requires 0 <= dst_idx < |b[current_step].hosts|;\r\n requires 0 <= current_step;\r\n requires m.SingleMessage?;\r\n requires m.dst == asp.c.hostIds[dst_idx];\r\n requires m.dst in b[current_step].hosts[src_idx].host.sd.sendState;\r\n requires m in b[current_step].hosts[src_idx].host.sd.sendState[m.dst].unAcked;\r\n ensures current_step <= next_step;\r\n ensures 0 <= dst_idx < |b[next_step].hosts|;\r\n ensures TombstoneTableLookup(asp.c.hostIds[src_idx], b[next_step].hosts[dst_idx].host.sd.receiveState) >= m.seqno;\r\n decreases m.seqno - TombstoneTableLookup(asp.c.hostIds[src_idx], b[current_step].hosts[dst_idx].host.sd.receiveState);\r\n{\r\n var src := asp.c.hostIds[src_idx];\r\n var dst := asp.c.hostIds[dst_idx];\r\n Lemma_GetHostIndexIsUnique(asp.c, src_idx);\r\n Lemma_GetHostIndexIsUnique(asp.c, dst_idx);\r\n Lemma_ConstantsAllConsistent(b, asp.c, current_step);\r\n\r\n var x := RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, m.seqno);\r\n if !sat(current_step, always(x))\r\n {\r\n TemporalNot(current_step, x);\r\n next_step := TemporalDeduceFromEventual(current_step, not(x));\r\n Lemma_ConstantsAllConsistent(b, asp.c, next_step);\r\n return;\r\n }\r\n\r\n TemporalDeduceFromAlways(current_step, current_step, x);\r\n assert TombstoneTableLookup(src, b[current_step].hosts[dst_idx].host.sd.receiveState) < m.seqno;\r\n\r\n var intermediate_step := Lemma_IfTheresAnUnackedPacketThenRecipientSequenceNumberIncreases(b, asp, current_step, src_idx, dst_idx, m);\r\n Lemma_ConstantsAllConsistent(b, asp.c, intermediate_step);\r\n\r\n TemporalDeduceFromAlways(current_step, intermediate_step, x);\r\n assert TombstoneTableLookup(src, b[intermediate_step].hosts[dst_idx].host.sd.receiveState) < m.seqno;\r\n\r\n Lemma_IfRecipientSequenceNumberNeverBeyondThenPacketStaysInSendState(b, asp, current_step, intermediate_step, src_idx, dst_idx, m);\r\n next_step := Lemma_IfTheresAnUnackedPacketThenRecipientSequenceNumberReachesItsSequenceNumber(b, asp, intermediate_step, src_idx, dst_idx, m);\r\n Lemma_ConstantsAllConsistent(b, asp.c, next_step);\r\n}\r\n\r\nlemma Lemma_GetReceiveStepForSequenceNumber(\r\n b:Behavior,\r\n c:SHTConfiguration,\r\n i:int,\r\n j:int,\r\n src_idx:int,\r\n dst_idx:int,\r\n seqno:int\r\n ) returns\r\n (receive_step:int,\r\n ap:SHTActionParams)\r\n requires IsValidBehaviorPrefix(b, c, j);\r\n requires 0 <= i <= j;\r\n requires |c.hostIds| == |b[i].hosts| == |b[j].hosts|;\r\n requires 0 <= src_idx < |c.hostIds|;\r\n requires 0 <= dst_idx < |c.hostIds|;\r\n requires TombstoneTableLookup(c.hostIds[src_idx], b[i].hosts[dst_idx].host.sd.receiveState) < seqno;\r\n requires TombstoneTableLookup(c.hostIds[src_idx], b[j].hosts[dst_idx].host.sd.receiveState) >= seqno;\r\n ensures i <= receive_step < j;\r\n ensures SHTActionOccurred(b[receive_step], b[receive_step+1], ap);\r\n ensures ap.idx == dst_idx;\r\n ensures ap.nextActionIndex == 0;\r\n ensures b[receive_step].hosts[dst_idx].host.receivedPacket.None?;\r\n ensures b[receive_step+1].hosts[dst_idx].host.receivedPacket.Some?;\r\n ensures ap.pkt.msg.SingleMessage?;\r\n ensures ap.pkt.msg.seqno == seqno;\r\n ensures |ap.ios| > 0;\r\n ensures ap.ios[0].LIoOpReceive?;\r\n ensures ap.ios[0].r.msg == ap.pkt.msg;\r\n ensures ap.ios[0].r.src == c.hostIds[src_idx];\r\n{\r\n Lemma_ConstantsAllConsistent(b, c, i);\r\n Lemma_ConstantsAllConsistent(b, c, j);\r\n\r\n var x := RecipientSequenceNumberBelowTemporal(b, src_idx, dst_idx, seqno);\r\n receive_step := earliestStepBetween(i, j, not(x)) - 1;\r\n assert i <= receive_step < j;\r\n assert !sat(receive_step, not(x));\r\n assert sat(receive_step, x);\r\n assert sat(receive_step + 1, not(x));\r\n \r\n Lemma_ConstantsAllConsistent(b, c, receive_step);\r\n Lemma_AssumptionsMakeValidTransition(b, c, receive_step);\r\n ap := Lemma_ActionThatChangesHostIsThatHostsAction(b, c, receive_step, dst_idx);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/RefinementProof/Environment.i.dfy", "content": "include \"../../SHT/SingleDelivery.i.dfy\"\r\ninclude \"../../SHT/Message.i.dfy\"\r\ninclude \"../../../Common/Framework/Environment.s.dfy\"\r\n\r\nmodule LiveSHT__Environment_i {\r\nimport opened Concrete_NodeIdentity_i`Spec\r\nimport opened SHT__Message_i\r\nimport opened SHT__SingleMessage_i \r\nimport opened SHT__SingleDelivery_i\r\nimport opened Environment_s\r\n\r\ntype LSHTEnvironment = LEnvironment>\r\ntype LSHTPacket = LPacket>\r\ntype LSHTIo = LIoOp>\r\n\r\nfunction ConcatenateSHTIos(s:seq>) : seq\r\n{\r\n if |s| == 0 then\r\n []\r\n else\r\n s[0] + ConcatenateSHTIos(s[1..])\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/RefinementProof/EnvironmentLemmas.i.dfy", "content": "include \"../../../Common/Framework/Environment.s.dfy\"\r\ninclude \"EnvironmentRefinement.i.dfy\"\r\n\r\nmodule LiveSHT__EnvironmentLemmas_i {\r\nimport opened Environment_s\r\nimport opened LiveSHT__Environment_i\r\nimport opened LiveSHT__EnvironmentRefinement_i\r\n\r\nlemma Lemma_EffectOnLSHTEnvironmentRefinementOfAddingPackets(e:LSHTEnvironment, e':LSHTEnvironment, ios:seq)\r\n requires e'.sentPackets == e.sentPackets + (set io | io in ios && io.LIoOpSend? :: io.s);\r\n ensures LSHTEnvironment_Refine(e') == LSHTEnvironment_Refine(e) + LSHTIoSeq_RefineAsSends(ios);\r\n{\r\n}\r\n\r\nlemma Lemma_LSHTIoSeq_RefineAsSendsEmptyHelper(x: T, s1: set, s2: set)\r\n requires x in s1\r\n requires x !in s2\r\n ensures s1 != s2\r\n{\r\n}\r\n\r\nlemma Lemma_LSHTIoSeq_RefineAsSendsEmpty(ios:seq)\r\n requires (set io | io in ios && io.LIoOpSend? :: io.s) == {};\r\n ensures LSHTIoSeq_RefineAsSends(ios) == {};\r\n{\r\n var sends := LSHTIoSeq_RefineAsSends(ios);\r\n if (|sends| > 0)\r\n {\r\n var io' :| io' in ios && io'.LIoOpSend?;\r\n assert io'.s in (set io | io in ios && io.LIoOpSend? :: io.s);\r\n Lemma_LSHTIoSeq_RefineAsSendsEmptyHelper(io'.s, set io | io in ios && io.LIoOpSend? :: io.s, {});\r\n assert false;\r\n }\r\n}\r\n\r\nlemma Lemma_LSHTPacketSetRefineIsCommutative(l_ps1:set, l_ps2:set)\r\n ensures LSHTPacketSet_Refine(l_ps1 + l_ps2) == LSHTPacketSet_Refine(l_ps1) + LSHTPacketSet_Refine(l_ps2);\r\n{\r\n var h_ps1 := LSHTPacketSet_Refine(l_ps1);\r\n var h_ps2 := LSHTPacketSet_Refine(l_ps2);\r\n var l_ps := l_ps1 + l_ps2;\r\n var h_ps := LSHTPacketSet_Refine(l_ps);\r\n\r\n forall h_p | h_p in h_ps1\r\n ensures h_p in h_ps;\r\n {\r\n }\r\n\r\n forall h_p | h_p in h_ps2\r\n ensures h_p in h_ps;\r\n {\r\n }\r\n\r\n forall h_p | h_p in h_ps\r\n ensures (h_p in h_ps1) || (h_p in h_ps2);\r\n {\r\n }\r\n}\r\n\r\nlemma Lemma_LSHTPacketSetRefineOfOnePacket(l_ps:LSHTPacket)\r\n ensures LSHTPacketSet_Refine({l_ps}) == { LSHTPacket_Refine(l_ps) };\r\n{\r\n}\r\n\r\nlemma Lemma_LSHTPacketSeqRefineIsCommutative(l_ps1:seq, l_ps2:seq)\r\n ensures LSHTPacketSeq_Refine(l_ps1 + l_ps2) == LSHTPacketSeq_Refine(l_ps1) + LSHTPacketSeq_Refine(l_ps2);\r\n{\r\n var h_ps1 := LSHTPacketSeq_Refine(l_ps1);\r\n var h_ps2 := LSHTPacketSeq_Refine(l_ps2);\r\n var l_ps := l_ps1 + l_ps2;\r\n var h_ps := LSHTPacketSeq_Refine(l_ps);\r\n\r\n forall h_p | h_p in h_ps1\r\n ensures h_p in h_ps;\r\n {\r\n }\r\n\r\n forall h_p | h_p in h_ps2\r\n ensures h_p in h_ps;\r\n {\r\n }\r\n\r\n forall h_p | h_p in h_ps\r\n ensures (h_p in h_ps1) || (h_p in h_ps2);\r\n {\r\n }\r\n}\r\n\r\nlemma Lemma_LSHTPacketSeqRefineOfOnePacket(l_ps:LSHTPacket)\r\n ensures LSHTPacketSeq_Refine([l_ps]) == { LSHTPacket_Refine(l_ps) };\r\n{\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/RefinementProof/EnvironmentRefinement.i.dfy", "content": "include \"Environment.i.dfy\"\r\ninclude \"../../SHT/Network.i.dfy\"\r\n\r\nmodule LiveSHT__EnvironmentRefinement_i {\r\nimport opened LiveSHT__Environment_i\r\nimport opened SHT__Network_i\r\n\r\nfunction LSHTPacket_Refine(p:LSHTPacket) : Packet\r\n{\r\n Packet(p.dst, p.src, p.msg)\r\n}\r\n\r\nfunction LSHTPacketSet_Refine(packets:set) : set\r\n{\r\n set p | p in packets :: LSHTPacket_Refine(p)\r\n}\r\n\r\nfunction LSHTPacketSeq_Refine(packets:seq) : set\r\n{\r\n set p | p in packets :: LSHTPacket_Refine(p)\r\n}\r\n\r\nfunction LSHTIoSeq_RefineAsSends(ios:seq) : set\r\n{\r\n set io | io in ios && io.LIoOpSend? :: LSHTPacket_Refine(io.s)\r\n}\r\n\r\nfunction LSHTIoSeq_RefineAsReceives(ios:seq) : set\r\n{\r\n set io | io in ios && io.LIoOpReceive? :: LSHTPacket_Refine(io.r)\r\n}\r\n\r\nfunction LSHTEnvironment_Refine(e:LSHTEnvironment) : Network\r\n{\r\n set p | p in e.sentPackets :: LSHTPacket_Refine(p)\r\n}\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/RefinementProof/SHT.i.dfy", "content": "include \"../../SHT/Host.i.dfy\"\r\ninclude \"../../SHT/Configuration.i.dfy\"\r\ninclude \"../../../Common/Framework/Environment.s.dfy\"\r\ninclude \"../Scheduler.i.dfy\"\r\n\r\nmodule LiveSHT__SHT_i {\r\nimport opened SHT__Host_i\r\nimport opened SHT__Configuration_i\r\nimport opened Environment_s\r\nimport opened Concrete_NodeIdentity_i`Spec\r\nimport opened LiveSHT__Scheduler_i\r\nimport opened LiveSHT__Environment_i\r\n\r\ndatatype LSHT_State = LSHT_State(\r\n config:SHTConfiguration,\r\n environment:LSHTEnvironment,\r\n hosts:seq\r\n)\r\n\r\npredicate LSHT_MapsComplete(s:LSHT_State)\r\n{\r\n |s.config.hostIds| == |s.hosts|\r\n && WFSHTConfiguration(s.config) \r\n && (forall i :: 0 <= i < |s.config.hostIds| ==> s.hosts[i].host.me == s.config.hostIds[i])\r\n}\r\n\r\npredicate LSHT_Init(config:SHTConfiguration, s:LSHT_State) \r\n{\r\n LSHT_MapsComplete(s)\r\n && s.config == config\r\n && LEnvironment_Init(s.environment)\r\n && (forall i :: 0 <= i < |s.config.hostIds| ==> LScheduler_Init(s.hosts[i], s.config.hostIds[i], s.config.rootIdentity, s.config.hostIds, s.config.params))\r\n}\r\n\r\npredicate LSHT_NextOneHost(s:LSHT_State, s':LSHT_State, idx:int, ios:seq)\r\n{\r\n LSHT_MapsComplete(s)\r\n && LSHT_MapsComplete(s')\r\n && s'.config == s.config\r\n && 0 <= idx < |s.config.hostIds|\r\n && LScheduler_Next(s.hosts[idx], s'.hosts[idx], ios)\r\n && LEnvironment_Next(s.environment, s'.environment)\r\n && s.environment.nextStep == LEnvStepHostIos(s.config.hostIds[idx], ios)\r\n && s'.hosts == s.hosts[idx := s'.hosts[idx]]\r\n}\r\n\r\npredicate LSHT_NextEnvironment(s:LSHT_State, s':LSHT_State)\r\n{\r\n !s.environment.nextStep.LEnvStepHostIos?\r\n && LEnvironment_Next(s.environment, s'.environment)\r\n && s'.config == s.config\r\n && s'.hosts == s.hosts\r\n}\r\n\r\npredicate LSHT_NextExternal(s:LSHT_State, s':LSHT_State, eid:NodeIdentity, ios:seq)\r\n{\r\n LSHT_MapsComplete(s)\r\n && LSHT_MapsComplete(s')\r\n && eid !in s.config.hostIds\r\n && LEnvironment_Next(s.environment, s'.environment)\r\n && s.environment.nextStep == LEnvStepHostIos(eid, ios)\r\n && s'.config == s.config\r\n && s'.hosts == s.hosts\r\n}\r\n\r\npredicate LSHT_Next(s:LSHT_State, s':LSHT_State)\r\n{\r\n (exists idx, ios :: LSHT_NextOneHost(s, s', idx, ios))\r\n || (exists idx, ios :: LSHT_NextExternal(s, s', idx, ios))\r\n || LSHT_NextEnvironment(s, s')\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/RefinementProof/SHTLemmas.i.dfy", "content": "include \"../../../Common/Collections/Maps2.i.dfy\"\r\ninclude \"SHTRefinement.i.dfy\"\r\ninclude \"SchedulerRefinement.i.dfy\"\r\ninclude \"SchedulerLemmas.i.dfy\"\r\ninclude \"EnvironmentLemmas.i.dfy\"\r\ninclude \"SHT.i.dfy\"\r\n\r\nmodule RefinementProof__DistributedSystemLemmas_i {\r\nimport opened Native__Io_s\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Maps2_i\r\nimport opened Concrete_NodeIdentity_i`Spec\r\nimport opened Environment_s\r\nimport opened SHT__Host_i\r\nimport opened SHT__Network_i\r\nimport opened SHT__SHT_i\r\nimport opened SHT__Configuration_i\r\nimport opened LiveSHT__SHTRefinement_i\r\nimport opened LiveSHT__Scheduler_i\r\nimport opened LiveSHT__SchedulerRefinement_i\r\nimport opened LiveSHT__SchedulerLemmas_i\r\nimport opened LiveSHT__EnvironmentLemmas_i\r\nimport opened LiveSHT__SHT_i\r\nimport opened LiveSHT__EnvironmentRefinement_i\r\nimport opened LiveSHT__Environment_i\r\n\r\n\r\nlemma Lemma_HostNextImpliesHostNextWithBiggerReceiveSet(s:Host, s':Host, recvs1:set, recvs2:set, out:set)\r\n requires Host_Next(s, s', recvs1, out);\r\n requires recvs1 <= recvs2;\r\n ensures Host_Next(s, s', recvs1, out);\r\n{\r\n}\r\n\r\nlemma {:timeLimitMultiplier 2} Lemma_HostRefinementAllowsSHTStateRefinement(\r\n ps:SHT_State,\r\n ps':SHT_State,\r\n actor:NodeIdentity,\r\n environment:LSHTEnvironment,\r\n environment':LSHTEnvironment,\r\n ios:seq\r\n )\r\n requires environment.nextStep == LEnvStepHostIos(actor, ios);\r\n requires LEnvironment_Next(environment, environment');\r\n requires SHT_MapsComplete(ps);\r\n requires SHT_MapsComplete(ps');\r\n requires ps'.config == ps.config;\r\n requires actor in ps.hosts;\r\n requires actor in ps'.hosts;\r\n requires forall id :: id in ps.hosts <==> id in ps'.hosts;\r\n requires forall id :: id in ps.hosts <==> id in ps.config.hostIds;\r\n requires forall oid :: oid in ps.config.hostIds && oid != actor ==> ps'.hosts[oid] == ps.hosts[oid];\r\n requires actor in ps.config.hostIds;\r\n requires ps.network == LSHTEnvironment_Refine(environment);\r\n requires ps'.network == LSHTEnvironment_Refine(environment');\r\n requires HostNextOrStutter(ps.hosts[actor], ps'.hosts[actor],\r\n PacketsTo(LSHTEnvironment_Refine(environment), actor), LSHTIoSeq_RefineAsSends(ios));\r\n ensures SHTNextOrStutter(ps, ps');\r\n{\r\n var receives := PacketsTo(LSHTEnvironment_Refine(environment), actor);\r\n var sends := LSHTIoSeq_RefineAsSends(ios);\r\n var host := ps.hosts[actor];\r\n var host' := ps'.hosts[actor];\r\n\r\n Lemma_EffectOnLSHTEnvironmentRefinementOfAddingPackets(environment, environment', ios);\r\n\r\n if host' == host && sends == {} {\r\n assert ps'.network == ps.network;\r\n assert ps'.hosts == ps.hosts;\r\n assert ps' == ps;\r\n return;\r\n }\r\n\r\n assert receives <= PacketsTo(ps.network, actor);\r\n assert Host_Next(host, host', receives, sends);\r\n Lemma_HostNextImpliesHostNextWithBiggerReceiveSet(host, host', receives, PacketsTo(ps.network, actor), sends);\r\n assert Host_Next(host, host', PacketsTo(ps.network, actor), sends);\r\n assert SHT_NextPred(ps, ps', actor, PacketsTo(ps.network, actor), sends);\r\n assert SHT_Next(ps, ps');\r\n assert SHTNextOrStutter(ps, ps');\r\n}\r\n\r\nlemma Lemma_LSHTInitImpliesSHTInit(l_config:SHTConfiguration, l_ps:LSHT_State)\r\n requires LSHT_Init(l_config, l_ps);\r\n ensures SHT_Init(LSHTConfiguration_Refine(l_config), LSHTState_Refine(l_ps));\r\n ensures LSHTState_RefinementInvariant(l_ps);\r\n{\r\n var h_config := l_config;\r\n var h_ps := LSHTState_Refine(l_ps);\r\n\r\n forall nodeIndex | 0 <= nodeIndex < |h_config.hostIds|\r\n ensures Host_Init(h_ps.hosts[h_config.hostIds[nodeIndex]], h_config.hostIds[nodeIndex], h_config.rootIdentity, h_config.hostIds, h_config.params);\r\n ensures LScheduler_RefinementInvariant(l_ps.hosts[nodeIndex]);\r\n {\r\n Lemma_GetHostIndexIsUnique(l_config, nodeIndex);\r\n }\r\n}\r\n\r\nlemma Lemma_LSHTNextPreservesLocalInvariant(ps:LSHT_State, ps':LSHT_State)\r\n requires LSHTState_RefinementInvariant(ps);\r\n requires LSHT_Next(ps, ps');\r\n ensures |ps.hosts| == |ps'.hosts|;\r\n ensures |ps'.hosts| == |ps'.config.hostIds|;\r\n{\r\n}\r\n\r\nlemma Lemma_SHTStateRefinementLeavesHostDomainUnchanged(l_ps:LSHT_State, h_ps:SHT_State)\r\n requires LSHTState_RefinementInvariant(l_ps);\r\n requires h_ps == LSHTState_Refine(l_ps);\r\n ensures forall id :: id in l_ps.config.hostIds <==> id in mapdomain(h_ps.hosts);\r\n{\r\n forall id | id in l_ps.config.hostIds\r\n ensures id in mapdomain(h_ps.hosts);\r\n {\r\n assert id in h_ps.hosts;\r\n }\r\n}\r\n\r\nlemma Lemma_LSHTNextOneHostMaintainsInvariant(l_s:LSHT_State, l_s':LSHT_State, idx:int, ios:seq)\r\n requires l_s.config == l_s'.config;\r\n requires LSHT_NextOneHost(l_s, l_s', idx, ios);\r\n requires LSHTState_RefinementInvariant(l_s);\r\n ensures LSHTState_RefinementInvariant(l_s');\r\n{\r\n Lemma_LSHTNextPreservesLocalInvariant(l_s, l_s');\r\n Lemma_LSchedulerNextImpliesHostNextOrStutter(l_s.hosts[idx], l_s'.hosts[idx], l_s.environment, l_s'.environment, ios);\r\n}\r\n\r\nlemma Lemma_LSHTNextOneHostImpliesSHTNext(l_ps:LSHT_State, l_ps':LSHT_State, idx:int, ios:seq)\r\n requires LSHT_NextOneHost(l_ps, l_ps', idx, ios);\r\n requires LSHTState_RefinementInvariant(l_ps);\r\n ensures LSHTState_RefinementInvariant(l_ps');\r\n ensures SHTNextOrStutter(LSHTState_Refine(l_ps), LSHTState_Refine(l_ps'));\r\n{\r\n var h_ps := LSHTState_Refine(l_ps);\r\n\r\n Lemma_LSHTNextOneHostMaintainsInvariant(l_ps, l_ps', idx, ios);\r\n\r\n var h_ps' := LSHTState_Refine(l_ps');\r\n\r\n var id := l_ps.config.hostIds[idx];\r\n\r\n Lemma_SHTStateRefinementLeavesHostDomainUnchanged(l_ps, h_ps);\r\n Lemma_SHTStateRefinementLeavesHostDomainUnchanged(l_ps', h_ps');\r\n assert mapdomain(h_ps'.hosts) == mapdomain(h_ps.hosts);\r\n\r\n forall oid | oid != id && oid in h_ps.hosts\r\n ensures oid in h_ps'.hosts && h_ps'.hosts[oid] == h_ps.hosts[oid];\r\n {\r\n assert oid in mapdomain(h_ps.hosts);\r\n assert oid in mapdomain(h_ps'.hosts);\r\n var idx' := GetHostIndex(oid, l_ps.config);\r\n calc {\r\n h_ps.hosts[oid];\r\n (l_ps.hosts[idx'].host);\r\n (l_ps'.hosts[idx'].host);\r\n h_ps'.hosts[oid];\r\n }\r\n }\r\n \r\n Lemma_LSchedulerNextImpliesHostNextOrStutter(l_ps.hosts[idx], l_ps'.hosts[idx], l_ps.environment, l_ps'.environment, ios);\r\n\r\n Lemma_GetHostIndexIsUnique(l_ps.config, idx);\r\n Lemma_HostRefinementAllowsSHTStateRefinement(h_ps, h_ps', id, l_ps.environment, l_ps'.environment, ios);\r\n}\r\n\r\nlemma Lemma_LSHTNextExternalImpliesSHTNext(l_ps:LSHT_State, l_ps':LSHT_State, idx:EndPoint, ios:seq)\r\n requires LSHT_NextExternal(l_ps, l_ps', idx, ios);\r\n requires LSHTState_RefinementInvariant(l_ps);\r\n ensures LSHTState_RefinementInvariant(l_ps');\r\n ensures SHTNextOrStutter(LSHTState_Refine(l_ps), LSHTState_Refine(l_ps'));\r\n{\r\n var h_ps := LSHTState_Refine(l_ps);\r\n //Lemma_LSHTNextOneHostMaintainsInvariant(l_ps, l_ps', idx, ios);\r\n var h_ps' := LSHTState_Refine(l_ps');\r\n\r\n Lemma_SHTStateRefinementLeavesHostDomainUnchanged(l_ps, h_ps);\r\n Lemma_SHTStateRefinementLeavesHostDomainUnchanged(l_ps', h_ps');\r\n assert mapdomain(h_ps'.hosts) == mapdomain(h_ps.hosts);\r\n \r\n var s := [h_ps, h_ps'];\r\n assert SHT_NextExternal(h_ps, h_ps', idx, LSHTIoSeq_RefineAsSends(ios), LSHTIoSeq_RefineAsSends(ios)); // OBSERVE: exists\r\n assert SHTNextOrStutter(h_ps, h_ps');\r\n}\r\n\r\nlemma Lemma_LSHTNextEnvironmentImpliesSHTNext(l_s:LSHT_State, l_s':LSHT_State)\r\n requires LSHT_NextEnvironment(l_s, l_s');\r\n requires LSHTState_RefinementInvariant(l_s);\r\n requires LSHTState_RefinementInvariant(l_s');\r\n ensures SHTNextOrStutter(LSHTState_Refine(l_s), LSHTState_Refine(l_s'));\r\n{\r\n var h_s := LSHTState_Refine(l_s);\r\n var h_s' := LSHTState_Refine(l_s');\r\n\r\n assert h_s'.hosts == h_s.hosts;\r\n\r\n var s := [h_s];\r\n assert s[0] == LSHTState_Refine(l_s);\r\n\r\n assert h_s'.network == h_s.network;\r\n \r\n assert SHTNextOrStutter(LSHTState_Refine(l_s), LSHTState_Refine(l_s'));\r\n}\r\n\r\nlemma Lemma_LSHTNextImpliesSHTNext(l_s:LSHT_State, l_s':LSHT_State)\r\n requires LSHT_Next(l_s, l_s');\r\n requires LSHTState_RefinementInvariant(l_s);\r\n ensures LSHTState_RefinementInvariant(l_s');\r\n ensures SHTNextOrStutter(LSHTState_Refine(l_s), LSHTState_Refine(l_s'));\r\n{\r\n if (exists idx, ios :: LSHT_NextOneHost(l_s, l_s', idx, ios)) {\r\n var idx, ios :| LSHT_NextOneHost(l_s, l_s', idx, ios);\r\n Lemma_LSHTNextOneHostImpliesSHTNext(l_s, l_s', idx, ios);\r\n } else if (exists idx, ios :: LSHT_NextExternal(l_s, l_s', idx, ios)) {\r\n var idx, ios :| LSHT_NextExternal(l_s, l_s', idx, ios);\r\n Lemma_LSHTNextExternalImpliesSHTNext(l_s, l_s', idx, ios);\r\n } else if LSHT_NextEnvironment(l_s, l_s') {\r\n Lemma_LSHTNextEnvironmentImpliesSHTNext(l_s, l_s');\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/RefinementProof/SHTRefinement.i.dfy", "content": "include \"../../../Common/Collections/Maps2.i.dfy\"\r\ninclude \"SHT.i.dfy\"\r\ninclude \"SchedulerRefinement.i.dfy\"\r\ninclude \"EnvironmentRefinement.i.dfy\"\r\ninclude \"../../SHT/RefinementProof/SHT.i.dfy\"\r\ninclude \"../../../Common/Collections/Seqs.i.dfy\"\r\n\r\nmodule LiveSHT__SHTRefinement_i {\r\nimport opened Collections__Maps2_i\r\nimport opened Concrete_NodeIdentity_i`Spec\r\nimport opened LiveSHT__SHT_i\r\nimport opened LiveSHT__SchedulerRefinement_i\r\nimport opened LiveSHT__EnvironmentRefinement_i\r\nimport opened SHT__SHT_i\r\nimport opened SHT__Configuration_i\r\nimport opened Collections__Seqs_i\r\n\r\nfunction LSHTConfiguration_Refine(c:SHTConfiguration) : SHTConfiguration\r\n{\r\n c\r\n}\r\n\r\nfunction GetHostIndex(id:NodeIdentity, c:SHTConfiguration):int\r\n requires id in c.hostIds;\r\n ensures var idx := GetHostIndex(id, c);\r\n 0 <= idx < |c.hostIds| && c.hostIds[idx] == id;\r\n{\r\n FindIndexInSeq(c.hostIds, id)\r\n}\r\n\r\nlemma Lemma_GetHostIndexIsUnique(c:SHTConfiguration, idx:int)\r\n requires WFSHTConfiguration(c);\r\n requires 0 <= idx < |c.hostIds|;\r\n ensures GetHostIndex(c.hostIds[idx], c) == idx;\r\n{\r\n var j := GetHostIndex(c.hostIds[idx], c);\r\n assert HostsDistinct(c.hostIds, idx, j);\r\n}\r\n\r\nfunction LSHTState_Refine(s:LSHT_State) : SHT_State\r\n requires LSHT_MapsComplete(s);\r\n ensures SHT_MapsComplete(LSHTState_Refine(s))\r\n{\r\n SHT_State(LSHTConfiguration_Refine(s.config), LSHTEnvironment_Refine(s.environment),\r\n (map id {:trigger LScheduler_Refine(s.hosts[GetHostIndex(id, s.config)])} | id in s.config.hostIds :: LScheduler_Refine(s.hosts[GetHostIndex(id, s.config)])))\r\n}\r\n\r\npredicate LSHTState_RefinementInvariant(s:LSHT_State)\r\n{\r\n |s.hosts| == |s.config.hostIds|\r\n && LSHT_MapsComplete(s)\r\n && (forall nodeIndex :: 0 <= nodeIndex < |s.config.hostIds| ==>\r\n LScheduler_RefinementInvariant(s.hosts[nodeIndex]))\r\n}\r\n\r\npredicate SHTNextOrStutter(ls:SHT_State, ls':SHT_State)\r\n{\r\n ls == ls' || SHT_Next(ls, ls')\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/RefinementProof/SchedulerLemmas.i.dfy", "content": "include \"SchedulerRefinement.i.dfy\"\r\ninclude \"EnvironmentRefinement.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\n\r\nmodule LiveSHT__SchedulerLemmas_i {\r\nimport opened Environment_s\r\nimport opened SHT__Host_i\r\nimport opened SHT__Network_i\r\nimport opened LiveSHT__SchedulerRefinement_i\r\nimport opened LiveSHT__EnvironmentRefinement_i\r\nimport opened LiveSHT__Environment_i\r\nimport opened LiveSHT__Scheduler_i\r\n\r\nlemma Lemma_LHostNextReceivePacketImpliesHostNextOrStutter(\r\n l_host:Host,\r\n l_host':Host,\r\n l_environment:LSHTEnvironment,\r\n l_environment':LSHTEnvironment,\r\n ios:seq\r\n )\r\n requires l_host.constants == l_host'.constants;\r\n requires LEnvironment_Next(l_environment, l_environment');\r\n requires l_environment.nextStep == LEnvStepHostIos(l_host.me, ios);\r\n requires LHost_ReceivePacket_Next(l_host, l_host', ios);\r\n ensures HostNextOrStutter(l_host, l_host', PacketsTo(LSHTEnvironment_Refine(l_environment), l_host.me), LSHTIoSeq_RefineAsSends(ios));\r\n{\r\n if (ios[0].LIoOpTimeoutReceive?) {\r\n assert l_host == l_host';\r\n return;\r\n }\r\n\r\n assert ios[0].r in l_environment.sentPackets;\r\n assert IsValidLEnvStep(l_environment, l_environment.nextStep);\r\n assert IsValidLIoOp(ios[0], l_host.me, l_environment);\r\n assert ios[0].r.dst == l_host.me;\r\n \r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n Lemma_HostRefinementForPacketsAppliesToIos(l_host, l_host', PacketsTo(LSHTEnvironment_Refine(l_environment), l_host.me),\r\n sent_packets, l_environment, l_environment', ios);\r\n}\r\n\r\nlemma Lemma_LHostNextProcessReceivedPacketImpliesHostNextOrStutter(\r\n l_host:Host,\r\n l_host':Host,\r\n l_environment:LSHTEnvironment,\r\n l_environment':LSHTEnvironment,\r\n ios:seq\r\n )\r\n requires l_host.constants == l_host'.constants;\r\n requires l_host.me == l_host'.me;\r\n requires LHost_ProcessReceivedPacket_Next(l_host, l_host', ios);\r\n requires LEnvironment_Next(l_environment, l_environment');\r\n requires l_environment.nextStep == LEnvStepHostIos(l_host.me, ios);\r\n ensures HostNextOrStutter(l_host, l_host', PacketsTo(LSHTEnvironment_Refine(l_environment), l_host.me), LSHTIoSeq_RefineAsSends(ios));\r\n{\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n Lemma_HostRefinementForPacketsAppliesToIos(l_host, l_host', PacketsTo(LSHTEnvironment_Refine(l_environment), l_host.me),\r\n sent_packets, l_environment, l_environment', ios);\r\n}\r\n\r\nlemma Lemma_LHostNextSpontaneousImpliesHostNextOrStutter(\r\n l_scheduler:LScheduler, \r\n l_scheduler':LScheduler,\r\n l_environment:LSHTEnvironment,\r\n l_environment':LSHTEnvironment,\r\n ios:seq\r\n )\r\n requires LHost_NoReceive_Next_Wrapper(l_scheduler, l_scheduler', ios);\r\n requires LEnvironment_Next(l_environment, l_environment');\r\n requires l_environment.nextStep == LEnvStepHostIos(l_scheduler.host.me, ios);\r\n ensures HostNextOrStutter(l_scheduler.host, l_scheduler'.host,\r\n PacketsTo(LSHTEnvironment_Refine(l_environment), l_scheduler.host.me), LSHTIoSeq_RefineAsSends(ios));\r\n{\r\n if (l_scheduler'.resendCount == 0) {\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n Lemma_HostRefinementForPacketsAppliesToIos(l_scheduler.host, l_scheduler'.host,\r\n PacketsTo(LSHTEnvironment_Refine(l_environment), l_scheduler.host.me),\r\n sent_packets, l_environment, l_environment', ios);\r\n } else {\r\n assert l_scheduler'.host == l_scheduler.host;\r\n assert ios == [];\r\n }\r\n}\r\n\r\nlemma Lemma_LSchedulerNextImpliesHostNextOrStutter(l_scheduler:LScheduler, l_scheduler':LScheduler, l_environment:LSHTEnvironment,\r\n l_environment':LSHTEnvironment, ios:seq)\r\n requires l_scheduler.host.constants == l_scheduler'.host.constants;\r\n requires l_scheduler.host.me == l_scheduler'.host.me;\r\n requires LScheduler_Next(l_scheduler, l_scheduler', ios);\r\n requires LEnvironment_Next(l_environment, l_environment');\r\n requires l_environment.nextStep == LEnvStepHostIos(l_scheduler.host.me, ios);\r\n requires LScheduler_RefinementInvariant(l_scheduler);\r\n ensures LScheduler_RefinementInvariant(l_scheduler');\r\n ensures HostNextOrStutter(l_scheduler.host, l_scheduler'.host,\r\n PacketsTo(LSHTEnvironment_Refine(l_environment), l_scheduler.host.me), LSHTIoSeq_RefineAsSends(ios));\r\n{\r\n assert 0 <= l_scheduler'.nextActionIndex < LHost_NumActions();\r\n var l_host := l_scheduler.host;\r\n var l_host' := l_scheduler'.host;\r\n \r\n if l_scheduler.nextActionIndex == 0 {\r\n Lemma_LHostNextReceivePacketImpliesHostNextOrStutter(l_host, l_host', l_environment, l_environment', ios);\r\n } else if l_scheduler.nextActionIndex == 1 {\r\n Lemma_LHostNextProcessReceivedPacketImpliesHostNextOrStutter(l_host, l_host', l_environment, l_environment', ios);\r\n } else if l_scheduler.nextActionIndex == 2 {\r\n Lemma_LHostNextSpontaneousImpliesHostNextOrStutter(l_scheduler, l_scheduler', l_environment, l_environment', ios);\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/RefinementProof/SchedulerRefinement.i.dfy", "content": "include \"../Scheduler.i.dfy\"\r\ninclude \"../../SHT/Host.i.dfy\"\r\ninclude \"EnvironmentRefinement.i.dfy\"\r\n\r\nmodule LiveSHT__SchedulerRefinement_i {\r\nimport opened LiveSHT__Scheduler_i\r\nimport opened LiveSHT__EnvironmentRefinement_i\r\nimport opened Environment_s\r\nimport opened SHT__Host_i\r\nimport opened SHT__Network_i\r\nimport opened LiveSHT__Environment_i\r\n\r\nfunction AddPacketSets(ps:seq>) : set\r\n ensures forall i :: 0 <= i < |ps| ==> ps[i] <= AddPacketSets(ps);\r\n{\r\n if |ps| == 0 then {} else ps[0] + AddPacketSets(ps[1..])\r\n}\r\n\r\npredicate HostNextOrStutter(host:Host, host':Host, receives:set, sends:set)\r\n{\r\n (host == host' && sends == {})\r\n || ( (forall p :: p in receives ==> p.dst == host.me)\r\n && (forall p :: p in sends ==> p.src == host.me)\r\n && Host_Next(host, host', receives, sends))\r\n}\r\n\r\n\r\nlemma Lemma_HostRefinementForPacketsAppliesToIos(\r\n host:Host,\r\n host':Host,\r\n receives:set,\r\n sent_packets:seq,\r\n environment:LSHTEnvironment,\r\n environment':LSHTEnvironment,\r\n ios:seq\r\n )\r\n requires LEnvironment_Next(environment, environment');\r\n requires environment.nextStep == LEnvStepHostIos(host.me, ios);\r\n requires receives <= PacketsTo(LSHTEnvironment_Refine(environment), host.me);\r\n requires forall p :: p in sent_packets <==> p in (set io | io in ios && io.LIoOpSend? :: io.s);\r\n requires Host_Next(host, host', receives, ExtractPacketsFromLSHTPackets(sent_packets));\r\n ensures Host_Next(host, host', PacketsTo(LSHTEnvironment_Refine(environment), host.me), LSHTIoSeq_RefineAsSends(ios));\r\n{\r\n assert receives <= PacketsTo(LSHTEnvironment_Refine(environment), host.me);\r\n assert ExtractPacketsFromLSHTPackets(sent_packets) == LSHTIoSeq_RefineAsSends(ios);\r\n}\r\n\r\npredicate LScheduler_RefinementInvariant(s:LScheduler)\r\n{\r\n 0 <= s.nextActionIndex < LHost_NumActions()\r\n}\r\n\r\nfunction LScheduler_Refine(s:LScheduler) : Host\r\n{\r\n s.host\r\n}\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/LiveSHT/Scheduler.i.dfy", "content": "include \"../SHT/Host.i.dfy\"\r\ninclude \"RefinementProof/Environment.i.dfy\"\r\ninclude \"RefinementProof/EnvironmentRefinement.i.dfy\"\r\ninclude \"../../Common/Collections/Sets.i.dfy\"\r\n\r\nmodule LiveSHT__BoundedClock_i {\r\n\r\ndatatype BoundedClock = BoundedClock(min:int, max:int)\r\n}\r\n\r\nmodule LiveSHT__Scheduler_i {\r\nimport opened SHT__Host_i\r\nimport opened LiveSHT__Environment_i\r\nimport opened LiveSHT__EnvironmentRefinement_i\r\nimport opened Collections__Sets_i\r\nimport opened LiveSHT__BoundedClock_i\r\nimport opened SHT__Network_i\r\nimport opened Protocol_Parameters_i\r\nimport opened Concrete_NodeIdentity_i`Spec\r\nimport opened SHT__Delegations_i\r\nimport opened Environment_s\r\n\r\nfunction {:opaque} ExtractSentPacketsFromIos(ios:seq) : seq\r\n ensures forall p :: p in ExtractSentPacketsFromIos(ios) <==> LIoOpSend(p) in ios;\r\n{\r\n if |ios| == 0 then\r\n []\r\n else if ios[0].LIoOpSend? then\r\n [ios[0].s] + ExtractSentPacketsFromIos(ios[1..])\r\n else\r\n ExtractSentPacketsFromIos(ios[1..])\r\n\r\n}\r\n\r\npredicate ReceivePacket_Wrapper(s:Host, s':Host, pkt:Packet, sent_packets:set)\r\n{\r\n exists ack :: ReceivePacket(s, s', pkt, sent_packets, ack)\r\n}\r\n\r\npredicate LHost_ReceivePacketWithoutReadingClock(s:Host, s':Host, ios:seq)\r\n requires |ios| >= 1;\r\n requires ios[0].LIoOpReceive?;\r\n requires DelegationMapComplete(s.delegationMap);\r\n{\r\n var pkt := Packet(ios[0].r.dst, ios[0].r.src, ios[0].r.msg); \r\n var sent_packets := ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios)); \r\n ReceivePacket_Wrapper(s, s', pkt, sent_packets)\r\n}\r\n\r\npredicate LHost_ReceivePacket_Next(s:Host, s':Host, ios:seq)\r\n{\r\n |ios| >= 1\r\n && if ios[0].LIoOpTimeoutReceive? then\r\n s' == s && |ios| == 1\r\n else\r\n (\r\n DelegationMapComplete(s.delegationMap)\r\n && (ios[0].LIoOpReceive?\r\n //&& ios[0].r.msg.SingleMessage?\r\n && (forall i{:trigger ios[i].LIoOpSend?} :: 1 <= i < |ios| ==> ios[i].LIoOpSend?)\r\n && LHost_ReceivePacketWithoutReadingClock(s, s', ios))\r\n )\r\n}\r\n\r\nfunction LHost_NumActions() : int\r\n{\r\n 3\r\n}\r\n\r\ndatatype LScheduler = LScheduler(host:Host, nextActionIndex:int, resendCount:int)\r\n\r\npredicate LScheduler_Init(s:LScheduler, me:NodeIdentity, rootIdentity:NodeIdentity, hostIds:seq, params:Parameters)\r\n{\r\n Host_Init(s.host, me, rootIdentity, hostIds, params)\r\n && s.nextActionIndex == 0\r\n && s.resendCount == 0\r\n}\r\n\r\npredicate LHost_ProcessReceivedPacket_Next(s:Host, s':Host, ios:seq)\r\n{\r\n DelegationMapComplete(s.delegationMap)\r\n && (forall io {:trigger io in ios} :: io in ios ==> io.LIoOpSend?)\r\n && ProcessReceivedPacket(s, s', ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios)))\r\n}\r\n\r\npredicate LHost_NoReceive_Next(s:Host, s':Host, ios:seq)\r\n{\r\n DelegationMapComplete(s.delegationMap)\r\n && (forall io {:trigger io in ios} :: io in ios ==> io.LIoOpSend?)\r\n && SpontaneouslyRetransmit(s, s', ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios)))\r\n}\r\n\r\n/*\r\npredicate LHost_Next_ReadClock_MaybeReSendUnAckedPackets(s:Host, s':Host, clock:BoundedClock, ios:seq)\r\n{\r\n if clock.max < s.nextHeartbeatTime then\r\n s' == s && sent_packets == []\r\n else\r\n s'.nextHeartbeatTime == LCappedAddition(clock.min, s.constants.all.params.heartbeatPeriod, s.constants.all.params)\r\n && LBroadcastToEveryone(s.constants.all.config, s.constants.myIndex,\r\n LPaxosMessage_Heartbeat(s.proposer.electionState.currentView,\r\n s.constants.myIndex in s.proposer.electionState.currentViewSuspectors,\r\n s.executor.opsComplete),\r\n sent_packets)\r\n && s' == s[nextHeartbeatTime := s'.nextHeartbeatTime]\r\n}*/\r\n\r\npredicate LHost_NoReceive_Next_Wrapper(s:LScheduler, s':LScheduler, ios:seq)\r\n{\r\n DelegationMapComplete(s.host.delegationMap)\r\n && s'.resendCount == (s.resendCount + 1) % 100000000\r\n && if (s'.resendCount == 0) then\r\n LHost_NoReceive_Next(s.host, s'.host, ios) \r\n else (\r\n ios == []\r\n && s' == s.(resendCount := s'.resendCount, nextActionIndex := s'.nextActionIndex))\r\n}\r\n\r\npredicate LScheduler_Next(s:LScheduler, s':LScheduler, ios:seq)\r\n{\r\n s'.nextActionIndex == (s.nextActionIndex + 1) % LHost_NumActions()\r\n && s'.host.constants == s.host.constants\r\n && s'.host.me == s.host.me\r\n && if s.nextActionIndex == 0 then\r\n s'.resendCount == s.resendCount\r\n && LHost_ReceivePacket_Next(s.host, s'.host, ios)\r\n else if s.nextActionIndex == 1 then\r\n s'.resendCount == s.resendCount\r\n && LHost_ProcessReceivedPacket_Next(s.host, s'.host, ios)\r\n else\r\n LHost_NoReceive_Next_Wrapper(s, s', ios)\r\n}\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/Lock/Node.i.dfy", "content": "include \"Types.i.dfy\"\r\n\r\nmodule Protocol_Node_i {\r\nimport opened Types_i\r\nimport opened Native__Io_s\r\n\r\ntype Config = seq\r\n\r\ndatatype Node = Node(held:bool, epoch:int, my_index:int, config:Config)\r\n\r\npredicate NodeInit(s:Node, my_index:int, config:Config)\r\n{\r\n s.epoch == (if my_index == 0 then 1 else 0)\r\n && 0 <= my_index < |config|\r\n && s.my_index == my_index // change\r\n && s.held == (my_index == 0)\r\n && s.config == config\r\n}\r\n\r\npredicate NodeGrant(s:Node, s':Node, ios:seq)\r\n{\r\n s.my_index == s'.my_index // change\r\n && if s.held && s.epoch < 0xFFFF_FFFF_FFFF_FFFF then \r\n !s'.held \r\n && |ios| == 1 && ios[0].LIoOpSend?\r\n && |s.config| > 0\r\n && s'.config == s.config\r\n && s'.epoch == s.epoch\r\n && var outbound_packet := ios[0].s;\r\n outbound_packet.msg.Transfer? \r\n && outbound_packet.msg.transfer_epoch == s.epoch + 1\r\n && outbound_packet.dst == s.config[(s.my_index + 1) % |s.config|]\r\n else \r\n s == s' && ios == []\r\n}\r\n\r\npredicate NodeAccept(s:Node, s':Node, ios:seq)\r\n{\r\n s.my_index == s'.my_index // change\r\n && |ios| >= 1\r\n && if ios[0].LIoOpTimeoutReceive? then \r\n s == s' && |ios| == 1\r\n else\r\n ios[0].LIoOpReceive?\r\n && if !s.held \r\n && ios[0].r.src in s.config\r\n && ios[0].r.msg.Transfer? \r\n && ios[0].r.msg.transfer_epoch > s.epoch then\r\n s'.held\r\n && |ios| == 2\r\n && ios[1].LIoOpSend?\r\n && ios[1].s.msg.Locked?\r\n && s'.epoch == ios[0].r.msg.transfer_epoch == ios[1].s.msg.locked_epoch\r\n && s'.config == s.config\r\n else \r\n s == s' && |ios| == 1\r\n}\r\n\r\npredicate NodeNext(s:Node, s':Node, ios:seq)\r\n{\r\n NodeGrant(s, s', ios)\r\n || NodeAccept(s, s', ios)\r\n}\r\n\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/Lock/RefinementProof/DistributedSystem.i.dfy", "content": "include \"../Node.i.dfy\"\r\ninclude \"../../../Impl/Common/SeqIsUnique.i.dfy\"\r\ninclude \"../../../Common/Collections/Seqs.i.dfy\"\r\ninclude \"../../../Common/Framework/DistributedSystem.s.dfy\"\r\ninclude \"../../../Impl/Lock/Host.i.dfy\"\r\n\r\nmodule DistributedSystem_i {\r\n import opened Native__Io_s\r\n import opened Environment_s\r\n import opened Types_i\r\n import opened Protocol_Node_i\r\n import opened Common__SeqIsUniqueDef_i\r\n import opened Common__SeqIsUnique_i\r\n import opened Collections__Seqs_i\r\n import opened Host_i`Spec\r\n\r\n /////////////////////////////////////////\r\n // LS_State\r\n /////////////////////////////////////////\r\n \r\n datatype LS_State = LS_State(\r\n environment:LockEnvironment,\r\n servers:map\r\n )\r\n\r\n predicate LS_Init(s:LS_State, config:Config)\r\n {\r\n LEnvironment_Init(s.environment)\r\n && |config| > 0\r\n && SeqIsUnique(config)\r\n && (forall e :: e in config <==> e in s.servers)\r\n && (forall index :: 0 <= index < |config| ==> NodeInit(s.servers[config[index]], index, config))\r\n }\r\n \r\n predicate LS_NextOneServer(s:LS_State, s':LS_State, id:EndPoint, ios:seq)\r\n requires id in s.servers;\r\n {\r\n id in s'.servers\r\n && NodeNext(s.servers[id], s'.servers[id], ios)\r\n && s'.servers == s.servers[id := s'.servers[id]]\r\n }\r\n\r\n predicate NodeAcquiresLock(e:EndPoint, s:LS_State, s':LS_State)\r\n {\r\n e in s.servers && e in s'.servers && !s.servers[e].held && s'.servers[e].held\r\n }\r\n\r\n predicate LS_Next(s:LS_State, s':LS_State)\r\n {\r\n LEnvironment_Next(s.environment, s'.environment)\r\n && if s.environment.nextStep.LEnvStepHostIos? && s.environment.nextStep.actor in s.servers then\r\n LS_NextOneServer(s, s', s.environment.nextStep.actor, s.environment.nextStep.ios)\r\n else\r\n s'.servers == s.servers\r\n }\r\n\r\n /////////////////////////////////////////////\r\n // GLS_State: an LS_State augmented with\r\n // a history field. This history field is\r\n // initialized and updated according to\r\n // GLS_Init and GLS_Next\r\n /////////////////////////////////////////////\r\n\r\n datatype GLS_State = GLS_State(\r\n ls:LS_State,\r\n history:seq\r\n )\r\n\r\n predicate GLS_Init(s:GLS_State, config:Config)\r\n {\r\n LS_Init(s.ls, config)\r\n && s.history == [config[0]]\r\n }\r\n\r\n /////////////////////////////////////////////////////////\r\n // GLS_Next is defined according to LS_Next. When a node \r\n // sends a grant message, the destination of that message\r\n // (as computed in NodeGrant), is appended to the history\r\n /////////////////////////////////////////////////////////\r\n\r\n predicate GLS_Next(s:GLS_State, s':GLS_State)\r\n {\r\n LS_Next(s.ls, s'.ls)\r\n && (if s.ls.environment.nextStep.LEnvStepHostIos? && s.ls.environment.nextStep.actor in s.ls.servers\r\n && NodeGrant(s.ls.servers[s.ls.environment.nextStep.actor], s'.ls.servers[s.ls.environment.nextStep.actor], s.ls.environment.nextStep.ios)\r\n && s.ls.servers[s.ls.environment.nextStep.actor].held && s.ls.servers[s.ls.environment.nextStep.actor].epoch < 0xFFFF_FFFF_FFFF_FFFF then\r\n s'.history == s.history + [s.ls.servers[s.ls.environment.nextStep.actor].config[(s.ls.servers[s.ls.environment.nextStep.actor].my_index + 1) % |s.ls.servers[s.ls.environment.nextStep.actor].config|]]\r\n else\r\n s'.history == s.history\r\n )\r\n }\r\n} \r\n\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/Lock/RefinementProof/Refinement.i.dfy", "content": "include \"DistributedSystem.i.dfy\"\r\ninclude \"../../../Services/Lock/AbstractService.s.dfy\"\r\ninclude \"../../../Common/Collections/Sets.i.dfy\"\r\n\r\nmodule Refinement_i {\r\n import opened DistributedSystem_i\r\n import opened AbstractServiceLock_s`All\r\n import opened Collections__Maps2_s\r\n \r\n function AbstractifyGLS_State(gls:GLS_State) : ServiceState\r\n {\r\n ServiceState'(mapdomain(gls.ls.servers), gls.history)\r\n }\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/Lock/RefinementProof/RefinementProof.i.dfy", "content": "include \"Refinement.i.dfy\"\r\ninclude \"../../../Common/Collections/Sets.i.dfy\"\r\ninclude \"../../../Common/Collections/Maps.i.dfy\"\r\ninclude \"../../../Common/Logic/Option.i.dfy\"\r\n\r\nmodule RefinementProof_i {\r\n import opened Native__Io_s\r\n import opened Environment_s\r\n import opened Protocol_Node_i\r\n import opened DistributedSystem_i\r\n import opened Refinement_i\r\n import opened Collections__Seqs_s\r\n import opened Collections__Maps2_s\r\n import opened Collections__Sets_i\r\n import opened Collections__Maps_i\r\n import opened Logic__Option_i\r\n import opened Common__SeqIsUnique_i\r\n import opened AbstractServiceLock_s`All\r\n\r\n lemma lemma_InitRefines(gls:GLS_State, config:Config) \r\n requires GLS_Init(gls, config);\r\n ensures Service_Init(AbstractifyGLS_State(gls), UniqueSeqToSet(config));\r\n {\r\n assert config[0] in config; // OBSERVE: triggers the exists in Service_Init\r\n var s := AbstractifyGLS_State(gls);\r\n calc {\r\n s.hosts;\r\n mapdomain(gls.ls.servers);\r\n UniqueSeqToSet(config);\r\n }\r\n\r\n assert config[0] in config; // OBSERVE\r\n assert config[0] in UniqueSeqToSet(config);\r\n }\r\n\r\n predicate IsValidBehavior(glb:seq, config:Config)\r\n {\r\n |glb| > 0\r\n && GLS_Init(glb[0], config)\r\n && (forall i {:trigger GLS_Next(glb[i], glb[i+1])} :: 0 <= i < |glb| - 1 ==> GLS_Next(glb[i], glb[i+1]))\r\n }\r\n\r\n lemma lemma_LS_Next(glb:seq, config:Config, i:int)\r\n requires IsValidBehavior(glb, config);\r\n requires 0 <= i < |glb| - 1;\r\n ensures GLS_Next(glb[i], glb[i+1]);\r\n {\r\n }\r\n\r\n lemma lemma_LSConsistent(glb:seq, config:Config, i:int)\r\n requires IsValidBehavior(glb, config);\r\n requires 0 <= i < |glb|;\r\n ensures |glb[i].ls.servers| == |config|;\r\n ensures forall e :: e in config <==> e in glb[i].ls.servers;\r\n ensures mapdomain(glb[i].ls.servers) == mapdomain(glb[0].ls.servers);\r\n ensures forall id :: id in config ==> glb[0].ls.servers[id].config == glb[i].ls.servers[id].config;\r\n {\r\n if i == 0 {\r\n calc {\r\n UniqueSeqToSet(config);\r\n mapdomain(glb[0].ls.servers);\r\n }\r\n lemma_seqs_set_cardinality(config, mapdomain(glb[0].ls.servers));\r\n calc {\r\n |mapdomain(glb[0].ls.servers)|;\r\n { lemma_MapSizeIsDomainSize(mapdomain(glb[0].ls.servers), glb[0].ls.servers); }\r\n |glb[0].ls.servers|;\r\n }\r\n } else {\r\n lemma_LS_Next(glb, config, i - 1);\r\n lemma_LSConsistent(glb, config, i - 1);\r\n }\r\n }\r\n\r\n lemma lemma_LSNodeConsistent(glb:seq, config:Config, i:int, candidate:EndPoint, e:EndPoint)\r\n requires IsValidBehavior(glb, config);\r\n requires 0 <= i < |glb|;\r\n requires e in glb[i].ls.servers;\r\n ensures candidate in glb[i].ls.servers <==> candidate in glb[i].ls.servers[e].config;\r\n {\r\n if i == 0 {\r\n } else {\r\n lemma_LS_Next(glb, config, i-1);\r\n lemma_LSConsistent(glb, config, i-1);\r\n lemma_LSNodeConsistent(glb, config, i-1, candidate, e);\r\n }\r\n }\r\n\r\n lemma lemma_HistoryIncrement(glb:seq, config:Config, i:int)\r\n requires IsValidBehavior(glb, config);\r\n requires 0 <= i < |glb| - 1;\r\n ensures |glb[i].history| + 1 == |glb[i].history|\r\n || glb[i].history == glb[i].history;\r\n { }\r\n\r\n lemma lemma_HistorySize(glb:seq, config:Config, i:int)\r\n requires IsValidBehavior(glb, config);\r\n requires 0 <= i < |glb|;\r\n ensures 1 <= |glb[i].history| <= i + 1;\r\n { \r\n if i == 0 {\r\n var locked_packets := set p | p in glb[i].ls.environment.sentPackets && p.msg.Locked?;\r\n assert |locked_packets| == 0;\r\n assert exists host :: host in (glb[i]).ls.servers && (glb[i]).ls.servers[host].held;\r\n assert |glb[i].history| == 1;\r\n } else {\r\n lemma_HistorySize(glb, config, i - 1);\r\n lemma_HistoryIncrement(glb, config, i - 1);\r\n assert GLS_Next(glb[i-1], glb[i]);\r\n }\r\n }\r\n\r\n lemma lemma_HistoryMembership(glb:seq, config:Config, i:int)\r\n requires IsValidBehavior(glb, config);\r\n requires 0 <= i < |glb|;\r\n ensures 1 <= |glb[i].history| <= i + 1;\r\n ensures last(glb[i].history) in glb[i].ls.servers;\r\n {\r\n lemma_HistorySize(glb, config, i);\r\n\r\n if i == 0 { \r\n } else {\r\n lemma_LS_Next(glb, config, i - 1);\r\n lemma_LSConsistent(glb, config, i - 1);\r\n lemma_LSConsistent(glb, config, i);\r\n lemma_HistoryMembership(glb, config, i-1);\r\n }\r\n }\r\n\r\n lemma lemma_LS_NextAbstract(glb:seq, config:Config, i:int)\r\n requires IsValidBehavior(glb, config);\r\n requires 0 <= i < |glb| - 1;\r\n ensures Service_Next(AbstractifyGLS_State(glb[i]), AbstractifyGLS_State(glb[i+1]))\r\n || AbstractifyGLS_State(glb[i]) == AbstractifyGLS_State(glb[i+1]);\r\n {\r\n lemma_LSConsistent(glb, config, i);\r\n lemma_LSConsistent(glb, config, i+1);\r\n assert GLS_Next(glb[i], glb[i+1]);\r\n if i == 0 {\r\n assert glb[i].ls.servers[config[0]].held;\r\n } else {\r\n lemma_HistorySize(glb, config, i);\r\n assert |glb[i].history| > 0;\r\n lemma_HistoryMembership(glb, config, i);\r\n assert last(glb[i].history) in glb[i].ls.servers;\r\n }\r\n }\r\n\r\n ///////////////////////////////////////////////////////////////////\r\n /// Everything above here is useful for proving the refinement\r\n /// of Init and Next. The lemma below establishes properties\r\n /// needed to prove Service_Correspondence.\r\n ///////////////////////////////////////////////////////////////////\r\n\r\n lemma MakeLockHistory(glb:seq, config:Config, i:int) returns (history:seq)\r\n requires IsValidBehavior(glb, config);\r\n requires 0 <= i < |glb|;\r\n ensures |history| > 0;\r\n ensures forall p :: p in glb[i].ls.environment.sentPackets && p.msg.Transfer? && p.src in glb[i].ls.servers \r\n ==> 2 <= p.msg.transfer_epoch <= |history|;\r\n ensures forall p :: p in glb[i].ls.environment.sentPackets && p.msg.Transfer? && p.src in glb[i].ls.servers \r\n ==> history[p.msg.transfer_epoch-1] == p.dst;\r\n ensures forall h,j :: h in glb[i].ls.servers && 0 <= j < |history|-1 && history[j] == h ==> j+1 <= glb[i].ls.servers[h].epoch;\r\n ensures forall h :: h in glb[i].ls.servers && h != last(history) ==> !glb[i].ls.servers[h].held;\r\n ensures forall h :: h in glb[i].ls.servers && glb[i].ls.servers[h].held ==> glb[i].ls.servers[h].epoch == |history|;\r\n ensures history == glb[i].history;\r\n {\r\n if i == 0 {\r\n history := [config[0]];\r\n } else {\r\n var prevHistory := MakeLockHistory(glb, config, i-1);\r\n lemma_LS_Next(glb, config, i-1);\r\n lemma_LSConsistent(glb, config, i-1);\r\n lemma_LSConsistent(glb, config, i);\r\n var s := glb[i-1];\r\n var s' := glb[i];\r\n assert LEnvironment_Next(s.ls.environment, s'.ls.environment);\r\n \r\n if s.ls.environment.nextStep.LEnvStepHostIos? && s.ls.environment.nextStep.actor in s.ls.servers {\r\n var id := s.ls.environment.nextStep.actor;\r\n var ios := s.ls.environment.nextStep.ios;\r\n \r\n if NodeGrant(s.ls.servers[id], s'.ls.servers[id], ios) {\r\n if s.ls.servers[id].held && s.ls.servers[id].epoch < 0xFFFF_FFFF_FFFF_FFFF {\r\n history := prevHistory + [ios[0].s.dst];\r\n } else {\r\n history := prevHistory;\r\n }\r\n } else {\r\n history := prevHistory;\r\n \r\n if !ios[0].LIoOpTimeoutReceive? \r\n && !s.ls.servers[id].held \r\n && ios[0].r.src in s.ls.servers[id].config\r\n && ios[0].r.msg.Transfer? \r\n && ios[0].r.msg.transfer_epoch > s.ls.servers[id].epoch {\r\n var p := ios[0].r;\r\n assert IsValidLIoOp(ios[0], id, s.ls.environment); // trigger\r\n assert p.dst == id;\r\n }\r\n }\r\n } else {\r\n history := prevHistory;\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/Lock/Types.i.dfy", "content": "include \"../../Common/Framework/Environment.s.dfy\"\r\ninclude \"../../Common/Native/Io.s.dfy\"\r\n\r\nmodule Types_i {\r\nimport opened Environment_s\r\nimport opened Native__Io_s\r\n\r\ndatatype LockMessage = Transfer(transfer_epoch:int) | Locked(locked_epoch:int) | Invalid\r\n\r\ntype LockEnvironment = LEnvironment\r\ntype LockPacket = LPacket\r\ntype LockIo = LIoOp\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/Acceptor.i.dfy", "content": "include \"Environment.i.dfy\"\r\ninclude \"Configuration.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"Broadcast.i.dfy\"\r\ninclude \"../../Common/Collections/CountMatches.i.dfy\"\r\n\r\nmodule LiveRSL__Acceptor_i {\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__Broadcast_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__Message_i\r\nimport opened Collections__CountMatches_i\r\nimport opened Environment_s\r\nimport opened Common__UpperBound_s\r\n\r\ndatatype LAcceptor = LAcceptor(\r\n constants:LReplicaConstants,\r\n max_bal:Ballot,\r\n votes:Votes,\r\n last_checkpointed_operation:seq,\r\n log_truncation_point:OperationNumber\r\n )\r\n\r\npredicate IsLogTruncationPointValid(log_truncation_point:OperationNumber, last_checkpointed_operation:seq,\r\n config:LConfiguration)\r\n{\r\n IsNthHighestValueInSequence(log_truncation_point,\r\n last_checkpointed_operation,\r\n LMinQuorumSize(config))\r\n}\r\n\r\npredicate RemoveVotesBeforeLogTruncationPoint(votes:Votes, votes':Votes, log_truncation_point:int)\r\n{\r\n && (forall opn :: opn in votes' ==> opn in votes && votes'[opn] == votes[opn])\r\n && (forall opn :: opn < log_truncation_point ==> opn !in votes')\r\n && (forall opn :: opn >= log_truncation_point && opn in votes ==> opn in votes')\r\n}\r\n\r\npredicate LAddVoteAndRemoveOldOnes(votes:Votes, votes':Votes, new_opn:OperationNumber, new_vote:Vote, log_truncation_point:OperationNumber)\r\n{\r\n && (forall opn :: opn in votes' <==> opn >= log_truncation_point && (opn in votes || opn == new_opn))\r\n && (forall opn :: opn in votes' ==> votes'[opn] == (if opn == new_opn then new_vote else votes[opn]))\r\n}\r\n\r\npredicate LAcceptorInit(a:LAcceptor, c:LReplicaConstants)\r\n{\r\n && a.constants == c\r\n && a.max_bal == Ballot(0,0)\r\n && a.votes == map []\r\n && |a.last_checkpointed_operation| == |c.all.config.replica_ids|\r\n && (forall idx {:trigger a.last_checkpointed_operation[idx]} :: 0 <= idx < |a.last_checkpointed_operation| ==>\r\n a.last_checkpointed_operation[idx] == 0)\r\n && a.log_truncation_point == 0\r\n}\r\n\r\npredicate LAcceptorProcess1a(s:LAcceptor, s':LAcceptor, inp:RslPacket, sent_packets:seq)\r\n requires inp.msg.RslMessage_1a?\r\n{\r\n var m := inp.msg;\r\n if inp.src in s.constants.all.config.replica_ids && BalLt(s.max_bal, m.bal_1a) && LReplicaConstantsValid(s.constants) then\r\n && sent_packets == [ LPacket(inp.src, s.constants.all.config.replica_ids[s.constants.my_index],\r\n RslMessage_1b(m.bal_1a, s.log_truncation_point, s.votes)) ]\r\n && s' == s.(max_bal := m.bal_1a)\r\n else\r\n s' == s && sent_packets == []\r\n}\r\n\r\npredicate LAcceptorProcess2a(s:LAcceptor, s':LAcceptor, inp:RslPacket, sent_packets:seq)\r\n requires inp.msg.RslMessage_2a?\r\n requires inp.src in s.constants.all.config.replica_ids\r\n requires BalLeq(s.max_bal, inp.msg.bal_2a)\r\n requires LeqUpperBound(inp.msg.opn_2a, s.constants.all.params.max_integer_val)\r\n{\r\n var m := inp.msg;\r\n var newLogTruncationPoint := if inp.msg.opn_2a - s.constants.all.params.max_log_length + 1 > s.log_truncation_point then \r\n inp.msg.opn_2a - s.constants.all.params.max_log_length + 1\r\n else\r\n s.log_truncation_point;\r\n && LBroadcastToEveryone(s.constants.all.config, s.constants.my_index, RslMessage_2b(m.bal_2a, m.opn_2a, m.val_2a), sent_packets)\r\n && s'.max_bal == m.bal_2a\r\n && s'.log_truncation_point == newLogTruncationPoint\r\n && (if s.log_truncation_point <= inp.msg.opn_2a then\r\n LAddVoteAndRemoveOldOnes(s.votes, s'.votes, m.opn_2a, Vote(m.bal_2a, m.val_2a), newLogTruncationPoint)\r\n else\r\n s'.votes == s.votes\r\n )\r\n // UNCHANGED\r\n && s'.constants == s.constants\r\n && s'.last_checkpointed_operation == s.last_checkpointed_operation\r\n}\r\n\r\npredicate LAcceptorProcessHeartbeat(s:LAcceptor, s':LAcceptor, inp:RslPacket)\r\n requires inp.msg.RslMessage_Heartbeat?\r\n{\r\n if inp.src in s.constants.all.config.replica_ids then\r\n var sender_index := GetReplicaIndex(inp.src, s.constants.all.config);\r\n if 0 <= sender_index < |s.last_checkpointed_operation| && inp.msg.opn_ckpt > s.last_checkpointed_operation[sender_index] then\r\n //s' == s[last_checkpointed_operation := s.last_checkpointed_operation[inp.src := inp.msg.opn_ckpt]]\r\n s'.last_checkpointed_operation == s.last_checkpointed_operation[sender_index := inp.msg.opn_ckpt]\r\n // UNCHANGED\r\n && s'.constants == s.constants\r\n && s'.max_bal == s.max_bal\r\n && s'.votes == s.votes\r\n && s'.log_truncation_point == s.log_truncation_point\r\n else\r\n s' == s\r\n else\r\n s' == s\r\n}\r\n\r\npredicate LAcceptorTruncateLog(s:LAcceptor, s':LAcceptor, opn:OperationNumber)\r\n{\r\n if opn <= s.log_truncation_point then\r\n s' == s\r\n else\r\n && RemoveVotesBeforeLogTruncationPoint(s.votes, s'.votes, opn)\r\n && s' == s.(log_truncation_point := opn, votes := s'.votes)\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/Broadcast.i.dfy", "content": "include \"Configuration.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\n\r\nmodule LiveRSL__Broadcast_i {\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Message_i\r\nimport opened Environment_s\r\n\r\npredicate LBroadcastToEveryone(c:LConfiguration, myidx:int, m:RslMessage, sent_packets:seq)\r\n{\r\n && |sent_packets| == |c.replica_ids|\r\n && 0 <= myidx < |c.replica_ids|\r\n && forall idx {:trigger sent_packets[idx]}{:trigger c.replica_ids[idx]}{:trigger LPacket(c.replica_ids[idx], c.replica_ids[myidx], m)} ::\r\n 0 <= idx < |sent_packets| ==> sent_packets[idx] == LPacket(c.replica_ids[idx], c.replica_ids[myidx], m)\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/ClockReading.i.dfy", "content": "module LiveRSL__ClockReading_i {\r\n\r\ndatatype ClockReading = ClockReading(t:int)\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/Actions.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\n\r\nmodule CommonProof__Actions_i {\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\n\r\npredicate PacketProcessedViaIos(\r\n ps:RslState,\r\n ps':RslState,\r\n p:RslPacket,\r\n idx:int,\r\n ios:seq\r\n )\r\n{\r\n && |ios| > 0\r\n && LIoOpReceive(p) == ios[0]\r\n && 0 <= idx < |ps.constants.config.replica_ids|\r\n && p.dst == ps.constants.config.replica_ids[idx]\r\n && ps.environment.nextStep == LEnvStepHostIos(p.dst, ios)\r\n && RslNextOneReplica(ps, ps', idx, ios)\r\n && LReplicaNextProcessPacket(ps.replicas[idx].replica, ps'.replicas[idx].replica, ios)\r\n}\r\n\r\npredicate PacketProcessedDuringAction(\r\n ps:RslState,\r\n p:RslPacket\r\n )\r\n{\r\n ps.environment.nextStep.LEnvStepHostIos? && LIoOpReceive(p) in ps.environment.nextStep.ios\r\n}\r\n\r\nfunction{:opaque} PacketProcessedTemporal(\r\n b:Behavior,\r\n p:RslPacket\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, PacketProcessedTemporal(b, p))} ::\r\n sat(i, PacketProcessedTemporal(b, p)) <==> PacketProcessedDuringAction(b[i], p)\r\n{\r\n stepmap(imap i :: PacketProcessedDuringAction(b[i], p))\r\n}\r\n\r\npredicate PacketSentDuringAction(\r\n ps:RslState,\r\n p:RslPacket\r\n )\r\n{\r\n ps.environment.nextStep.LEnvStepHostIos? && LIoOpSend(p) in ps.environment.nextStep.ios\r\n}\r\n\r\nfunction{:opaque} PacketSentTemporal(\r\n b:Behavior,\r\n p:RslPacket\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, PacketSentTemporal(b, p))} ::\r\n sat(i, PacketSentTemporal(b, p)) <==> PacketSentDuringAction(b[i], p)\r\n{\r\n stepmap(imap i :: PacketSentDuringAction(b[i], p))\r\n}\r\n\r\n\r\nlemma lemma_ActionThatChangesReplicaIsThatReplicasAction(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n host_index:int\r\n )\r\n returns (ios:seq)\r\n requires IsValidBehaviorPrefix(b, c, i+1)\r\n requires 0 <= i\r\n requires 0 <= host_index < |b[i].replicas|\r\n requires 0 <= host_index < |b[i+1].replicas|\r\n requires b[i+1].replicas[host_index] != b[i].replicas[host_index]\r\n ensures b[i].environment.nextStep.LEnvStepHostIos?\r\n ensures 0 <= host_index < |c.config.replica_ids|\r\n ensures b[i].environment.nextStep.actor == c.config.replica_ids[host_index]\r\n ensures ios == b[i].environment.nextStep.ios\r\n ensures RslNext(b[i], b[i+1])\r\n ensures RslNextOneReplica(b[i], b[i+1], host_index, ios)\r\n{\r\n lemma_AssumptionsMakeValidTransition(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n assert RslNext(b[i], b[i+1]);\r\n ios :| RslNextOneReplica(b[i], b[i+1], host_index, ios);\r\n}\r\n\r\nlemma lemma_PacketProcessedImpliesPacketSent(\r\n ps:RslState,\r\n ps':RslState,\r\n idx:int,\r\n ios:seq,\r\n inp:RslPacket\r\n )\r\n requires RslNextOneReplica(ps, ps', idx, ios)\r\n requires LIoOpReceive(inp) in ios\r\n ensures inp in ps.environment.sentPackets\r\n{\r\n var id := ps.constants.config.replica_ids[idx];\r\n var e := ps.environment;\r\n var e' := ps'.environment;\r\n\r\n assert IsValidLIoOp(LIoOpReceive(inp), id, ps.environment);\r\n assert inp in e.sentPackets;\r\n}\r\n\r\nlemma lemma_PacketProcessedImpliesPacketSentAlt(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int,\r\n inp:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1)\r\n requires 0 <= i\r\n requires 0 <= idx < |c.config.replica_ids|\r\n requires b[i].environment.nextStep.LEnvStepHostIos?\r\n requires b[i].environment.nextStep.actor == c.config.replica_ids[idx]\r\n requires LIoOpReceive(inp) in b[i].environment.nextStep.ios\r\n ensures inp in b[i].environment.sentPackets\r\n{\r\n var ps := b[i];\r\n var ps' := b[i+1];\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var id := ps.constants.config.replica_ids[idx];\r\n var e := ps.environment;\r\n var e' := ps'.environment;\r\n\r\n assert IsValidLIoOp(LIoOpReceive(inp), id, ps.environment);\r\n assert inp in e.sentPackets;\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/Assumptions.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\n\r\nmodule CommonProof__Assumptions_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\n\r\nfunction{:opaque} RestrictBehaviorToEnvironment(\r\n b:Behavior\r\n ):Behavior>\r\n requires imaptotal(b)\r\n ensures imaptotal(RestrictBehaviorToEnvironment(b))\r\n ensures forall i {:trigger RestrictBehaviorToEnvironment(b)[i]} :: RestrictBehaviorToEnvironment(b)[i] == b[i].environment\r\n{\r\n imap i :: b[i].environment\r\n}\r\n\r\npredicate IsValidBehaviorPrefix(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int\r\n )\r\n{\r\n && imaptotal(b)\r\n && RslInit(c, b[0])\r\n && (forall j {:trigger RslNext(b[j], b[j+1])} :: 0 <= j < i ==> RslNext(b[j], b[j+1]))\r\n}\r\n\r\npredicate IsValidBehavior(\r\n b:Behavior,\r\n c:LConstants\r\n )\r\n{\r\n && imaptotal(b)\r\n && RslInit(c, b[0])\r\n && (forall i {:trigger RslNext(b[i], b[i+1])} :: i >= 0 ==> RslNext(b[i], b[i+1]))\r\n}\r\n\r\n}\r\n\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/CanonicalizeBallot.i.dfy", "content": "include \"../Types.i.dfy\"\r\ninclude \"../Configuration.i.dfy\"\r\ninclude \"../Proposer.i.dfy\"\r\ninclude \"../../../Common/Collections/Sets.i.dfy\"\r\ninclude \"../../../../Libraries/Math/mul.i.dfy\"\r\ninclude \"../../../../Libraries/Math/div.i.dfy\"\r\n\r\nmodule CommonProof__CanonicalizeBallot_i {\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Election_i\r\nimport opened Collections__Sets_i\r\nimport opened Math__mul_i\r\nimport opened Math__div_nonlinear_i\r\nimport opened Math__div_i\r\nimport opened Common__UpperBound_s\r\n\r\npredicate IsValidBallot(b:Ballot, c:LConstants)\r\n{\r\n 0 <= b.proposer_id < |c.config.replica_ids|\r\n}\r\n\r\npredicate BallotHasSuccessor(b:Ballot, c:LConstants)\r\n{\r\n || LtUpperBound(b.seqno, c.params.max_integer_val)\r\n || (b.seqno == c.params.max_integer_val.n && 0 <= b.proposer_id + 1 < |c.config.replica_ids|)\r\n}\r\n\r\n//////////////////////////\r\n// CanonicalizeBallot\r\n//////////////////////////\r\n\r\nfunction{:opaque} CanonicalizeBallot(b:Ballot, c:LConstants):int\r\n{\r\n b.seqno * |c.config.replica_ids| + b.proposer_id\r\n}\r\n\r\nlemma lemma_CanonicalizeBallotProperties()\r\n ensures forall b1:Ballot, b2:Ballot, c:LConstants :: IsValidBallot(b1, c) && IsValidBallot(b2, c) ==>\r\n && (BalLeq(b1, b2) <==> CanonicalizeBallot(b1, c) <= CanonicalizeBallot(b2, c))\r\n && (BalLt(b1, b2) <==> CanonicalizeBallot(b1, c) < CanonicalizeBallot(b2, c))\r\n && (b1 == b2 <==> CanonicalizeBallot(b1, c) == CanonicalizeBallot(b2, c));\r\n{\r\n reveal CanonicalizeBallot();\r\n\r\n forall b1:Ballot, b2:Ballot, c:LConstants | 0 <= b1.proposer_id < |c.config.replica_ids| && 0 <= b2.proposer_id < |c.config.replica_ids|\r\n ensures b1.seqno < b2.seqno ==> CanonicalizeBallot(b1, c) < CanonicalizeBallot(b2, c)\r\n {\r\n var ids := c.config.replica_ids;\r\n\r\n if b1.seqno < b2.seqno\r\n {\r\n calc {\r\n CanonicalizeBallot(b1, c);\r\n < b1.seqno * |c.config.replica_ids| + 1 * |ids|;\r\n == { lemma_mul_is_distributive_add_other_way(|ids|, b1.seqno, 1); } (b1.seqno + 1) * |ids|;\r\n <= { lemma_mul_properties(); } b2.seqno * |ids|;\r\n <= CanonicalizeBallot(b2, c);\r\n }\r\n }\r\n }\r\n\r\n forall b1:Ballot, b2:Ballot, c:LConstants | 0 <= b1.proposer_id < |c.config.replica_ids| && 0 <= b2.proposer_id < |c.config.replica_ids|\r\n ensures b1 != b2 ==> CanonicalizeBallot(b1, c) != CanonicalizeBallot(b2, c)\r\n {\r\n }\r\n}\r\n\r\nlemma lemma_CanonicalizeBallotPropertiesSpecific(b1:Ballot, b2:Ballot, c:LConstants)\r\n requires IsValidBallot(b1, c)\r\n requires IsValidBallot(b2, c)\r\n ensures && (BalLeq(b1, b2) <==> CanonicalizeBallot(b1, c) <= CanonicalizeBallot(b2, c))\r\n && (BalLt(b1, b2) <==> CanonicalizeBallot(b1, c) < CanonicalizeBallot(b2, c))\r\n && (b1 == b2 <==> CanonicalizeBallot(b1, c) == CanonicalizeBallot(b2, c))\r\n{\r\n lemma_CanonicalizeBallotProperties();\r\n}\r\n\r\nlemma lemma_CanonicalizeSuccessor(b:Ballot, c:LConstants)\r\n requires 0 <= b.proposer_id < |c.config.replica_ids|\r\n requires BallotHasSuccessor(b, c)\r\n ensures CanonicalizeBallot(ComputeSuccessorView(b, c), c) == CanonicalizeBallot(b, c) + 1\r\n{\r\n reveal CanonicalizeBallot();\r\n lemma_CanonicalizeBallotProperties();\r\n\r\n var ids := c.config.replica_ids;\r\n var params := c.params;\r\n\r\n if b.proposer_id + 1 >= |c.config.replica_ids|\r\n {\r\n calc {\r\n CanonicalizeBallot(ComputeSuccessorView(b, c), c);\r\n CanonicalizeBallot(Ballot(b.seqno + 1, 0), c);\r\n (b.seqno + 1) * |ids| + 0;\r\n { lemma_mul_is_distributive_add_other_way(|ids|, b.seqno, 1); }\r\n b.seqno * |ids| + 1 * |ids|;\r\n b.seqno * |ids| + |ids|;\r\n b.seqno * |ids| + |ids| - 1 + 1;\r\n CanonicalizeBallot(b, c) + 1;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_NothingBetweenViewAndSuccessor(b:Ballot, b':Ballot, c:LConstants)\r\n requires IsValidBallot(b, c)\r\n requires BallotHasSuccessor(b, c)\r\n requires IsValidBallot(b', c)\r\n ensures !BalLt(b, b') || !BalLt(b', ComputeSuccessorView(b, c))\r\n{\r\n lemma_CanonicalizeBallotProperties();\r\n\r\n var b'' := ComputeSuccessorView(b, c);\r\n\r\n if BalLt(b, b') && BalLt(b', b'')\r\n {\r\n lemma_CanonicalizeSuccessor(b, c);\r\n assert CanonicalizeBallot(b, c) < CanonicalizeBallot(b', c) < CanonicalizeBallot(b, c) + 1;\r\n assert false;\r\n }\r\n}\r\n\r\nfunction DecanonicalizeBallot(i:int, c:LConstants):Ballot\r\n requires WellFormedLConfiguration(c.config)\r\n{\r\n Ballot(i / |c.config.replica_ids|, i % |c.config.replica_ids|)\r\n}\r\n\r\nlemma lemma_DecanonicalizeBallotProperties(i:int, c:LConstants)\r\n requires i >= 0\r\n requires WellFormedLConfiguration(c.config)\r\n ensures CanonicalizeBallot(DecanonicalizeBallot(i, c), c) == i\r\n{\r\n calc {\r\n CanonicalizeBallot(DecanonicalizeBallot(i, c), c);\r\n CanonicalizeBallot(Ballot(i / |c.config.replica_ids|, i % |c.config.replica_ids|), c);\r\n { reveal_CanonicalizeBallot(); }\r\n (i / |c.config.replica_ids|) * |c.config.replica_ids| + (i % |c.config.replica_ids|);\r\n { lemma_mul_is_commutative(i / |c.config.replica_ids|, |c.config.replica_ids|); }\r\n |c.config.replica_ids| * (i / |c.config.replica_ids|) + i % |c.config.replica_ids|;\r\n { lemma_fundamental_div_mod(i, |c.config.replica_ids|); }\r\n i;\r\n }\r\n}\r\n\r\nfunction ComputePredecessorView(b:Ballot, c:LConstants):Ballot\r\n requires CanonicalizeBallot(b, c) > 0\r\n requires WellFormedLConfiguration(c.config)\r\n{\r\n DecanonicalizeBallot(CanonicalizeBallot(b, c) - 1, c)\r\n}\r\n\r\nlemma lemma_ComputePredecessorViewProperties(b:Ballot, c:LConstants)\r\n requires WellFormedLConfiguration(c.config)\r\n requires IsValidBallot(b, c)\r\n requires CanonicalizeBallot(b, c) > 0\r\n requires LeqUpperBound(b.seqno, c.params.max_integer_val)\r\n ensures BallotHasSuccessor(ComputePredecessorView(b, c), c)\r\n ensures CanonicalizeBallot(ComputePredecessorView(b, c), c) == CanonicalizeBallot(b, c) - 1\r\n ensures ComputeSuccessorView(ComputePredecessorView(b, c), c) == b\r\n{\r\n var i := CanonicalizeBallot(b, c);\r\n var b' := DecanonicalizeBallot(i-1, c);\r\n\r\n lemma_DecanonicalizeBallotProperties(i-1, c);\r\n lemma_CanonicalizeBallotPropertiesSpecific(ComputePredecessorView(b, c), b, c);\r\n lemma_CanonicalizeBallotPropertiesSpecific(b, ComputeSuccessorView(ComputePredecessorView(b, c), c), c);\r\n\r\n lemma_CanonicalizeSuccessor(b', c);\r\n}\r\n\r\nlemma lemma_ComputeSuccessorViewProducesValidBallot(b:Ballot, c:LConstants)\r\n requires WellFormedLConfiguration(c.config)\r\n requires IsValidBallot(b, c)\r\n ensures IsValidBallot(ComputeSuccessorView(b, c), c)\r\n{\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/Chosen.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"Actions.i.dfy\"\r\ninclude \"PacketSending.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"LearnerState.i.dfy\"\r\ninclude \"Quorum.i.dfy\"\r\ninclude \"Message1b.i.dfy\"\r\n\r\nmodule CommonProof__Chosen_i {\r\n\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Types_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened CommonProof__Environment_i\r\nimport opened CommonProof__LearnerState_i\r\nimport opened CommonProof__Quorum_i\r\nimport opened CommonProof__Message1b_i\r\nimport opened CommonProof__Message2a_i\r\nimport opened CommonProof__Message2b_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Collections__Sets_i\r\nimport opened Environment_s\r\n\r\ndatatype QuorumOf2bs = QuorumOf2bs(c:LConstants, indices:set, packets:seq, bal:Ballot, opn:OperationNumber, v:RequestBatch)\r\n\r\npredicate IsValidQuorumOf2bs(\r\n ps:RslState,\r\n q:QuorumOf2bs\r\n )\r\n{\r\n && |q.indices| >= LMinQuorumSize(ps.constants.config)\r\n && |q.packets| == |ps.constants.config.replica_ids|\r\n && (forall idx :: idx in q.indices ==> && 0 <= idx < |ps.constants.config.replica_ids|\r\n && var p := q.packets[idx];\r\n && p.src == ps.constants.config.replica_ids[idx]\r\n && p.msg.RslMessage_2b?\r\n && p.msg.opn_2b == q.opn\r\n && p.msg.val_2b == q.v\r\n && p.msg.bal_2b == q.bal\r\n && p in ps.environment.sentPackets)\r\n}\r\n\r\nlemma lemma_QuorumOf2bsStaysValid(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n j:int,\r\n q:QuorumOf2bs\r\n )\r\n requires IsValidBehaviorPrefix(b, c, j)\r\n requires IsValidQuorumOf2bs(b[i], q)\r\n requires 0 <= i <= j\r\n ensures IsValidQuorumOf2bs(b[j], q)\r\n{\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, j);\r\n\r\n forall idx | idx in q.indices\r\n ensures q.packets[idx] in b[j].environment.sentPackets\r\n {\r\n lemma_PacketStaysInSentPackets(b, c, i, j, q.packets[idx]);\r\n }\r\n}\r\n\r\nlemma lemma_ChosenQuorumAnd2aFromLaterBallotMatchValues(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n quorum_of_2bs:QuorumOf2bs,\r\n packet2a:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires IsValidQuorumOf2bs(b[i], quorum_of_2bs)\r\n requires packet2a in b[i].environment.sentPackets\r\n requires packet2a.src in c.config.replica_ids\r\n requires packet2a.msg.RslMessage_2a?\r\n requires quorum_of_2bs.opn == packet2a.msg.opn_2a\r\n requires BalLt(quorum_of_2bs.bal, packet2a.msg.bal_2a)\r\n ensures quorum_of_2bs.v == packet2a.msg.val_2a\r\n decreases packet2a.msg.bal_2a.seqno, packet2a.msg.bal_2a.proposer_id\r\n{\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var opn := quorum_of_2bs.opn;\r\n var quorum_of_1bs := lemma_2aMessageHas1bQuorumPermittingIt(b, c, i, packet2a);\r\n var quorum_of_1bs_indices := lemma_GetIndicesFromPackets(quorum_of_1bs, c.config);\r\n\r\n var overlap_idx := lemma_QuorumIndexOverlap(quorum_of_1bs_indices, quorum_of_2bs.indices, |c.config.replica_ids|);\r\n var packet1b_overlap :| packet1b_overlap in quorum_of_1bs && packet1b_overlap.src == c.config.replica_ids[overlap_idx];\r\n var packet2b_overlap := quorum_of_2bs.packets[overlap_idx];\r\n\r\n if opn !in packet1b_overlap.msg.votes\r\n {\r\n lemma_1bMessageWithoutOpnImplicationsFor2b(b, c, i, opn, packet1b_overlap, packet2b_overlap);\r\n assert false;\r\n }\r\n\r\n var highestballot_in_1b_set :| LValIsHighestNumberedProposalAtBallot(packet2a.msg.val_2a, highestballot_in_1b_set, quorum_of_1bs, opn);\r\n assert BalLeq(packet1b_overlap.msg.votes[opn].max_value_bal, highestballot_in_1b_set);\r\n var packet1b_highestballot :| && packet1b_highestballot in quorum_of_1bs\r\n && opn in packet1b_highestballot.msg.votes\r\n && packet1b_highestballot.msg.votes[opn] == Vote(highestballot_in_1b_set, packet2a.msg.val_2a);\r\n lemma_Vote1bMessageIsFromEarlierBallot(b, c, i, opn, packet1b_highestballot);\r\n\r\n lemma_1bMessageWithOpnImplicationsFor2b(b, c, i, opn, packet1b_overlap, packet2b_overlap);\r\n\r\n var previous_packet2a := lemma_1bMessageWithOpnImplies2aSent(b, c, i, opn, packet1b_highestballot);\r\n assert BalLt(previous_packet2a.msg.bal_2a, packet2a.msg.bal_2a);\r\n\r\n if quorum_of_2bs.bal == previous_packet2a.msg.bal_2a\r\n {\r\n var packet2a_overlap := lemma_2bMessageHasCorresponding2aMessage(b, c, i, packet2b_overlap);\r\n lemma_2aMessagesFromSameBallotAndOperationMatch(b, c, i, packet2a_overlap, previous_packet2a);\r\n }\r\n else\r\n {\r\n lemma_2aMessageHasValidBallot(b, c, i, packet2a); // to demonstrate decreases values are >= 0\r\n lemma_ChosenQuorumAnd2aFromLaterBallotMatchValues(b, c, i, quorum_of_2bs, previous_packet2a);\r\n }\r\n}\r\n\r\nlemma lemma_ChosenQuorumsMatchValue(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n q1:QuorumOf2bs,\r\n q2:QuorumOf2bs\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires IsValidQuorumOf2bs(b[i], q1)\r\n requires IsValidQuorumOf2bs(b[i], q2)\r\n requires q1.opn == q2.opn\r\n ensures q1.v == q2.v\r\n{\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var idx1 :| idx1 in q1.indices;\r\n var idx2 :| idx2 in q2.indices;\r\n var p1_2b := q1.packets[idx1];\r\n var p2_2b := q2.packets[idx2];\r\n var p1_2a := lemma_2bMessageHasCorresponding2aMessage(b, c, i, p1_2b);\r\n var p2_2a := lemma_2bMessageHasCorresponding2aMessage(b, c, i, p2_2b);\r\n\r\n if q1.bal == q2.bal\r\n {\r\n lemma_2aMessagesFromSameBallotAndOperationMatch(b, c, i, p1_2a, p2_2a);\r\n }\r\n else if BalLt(q1.bal, q2.bal)\r\n {\r\n lemma_ChosenQuorumAnd2aFromLaterBallotMatchValues(b, c, i, q1, p2_2a);\r\n }\r\n else\r\n {\r\n lemma_ChosenQuorumAnd2aFromLaterBallotMatchValues(b, c, i, q2, p1_2a);\r\n }\r\n}\r\n\r\nlemma lemma_DecidedOperationWasChosen(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int\r\n ) returns (\r\n q:QuorumOf2bs\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires b[i].replicas[idx].replica.executor.next_op_to_execute.OutstandingOpKnown?\r\n ensures IsValidQuorumOf2bs(b[i], q)\r\n ensures var s := b[i].replicas[idx].replica.executor;\r\n q.bal == s.next_op_to_execute.bal && q.opn == s.ops_complete && q.v == s.next_op_to_execute.v\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_ReplicaConstantsAllConsistent(b, c, i, idx);\r\n lemma_ReplicaConstantsAllConsistent(b, c, i-1, idx);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n var s := b[i-1].replicas[idx].replica;\r\n var s' := b[i].replicas[idx].replica;\r\n\r\n if s'.executor.next_op_to_execute == s.executor.next_op_to_execute\r\n {\r\n q := lemma_DecidedOperationWasChosen(b, c, i-1, idx);\r\n lemma_QuorumOf2bsStaysValid(b, c, i-1, i, q);\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n assert b[i-1].replicas[idx].nextActionIndex == 5;\r\n var opn := s.executor.ops_complete;\r\n var v := s.learner.unexecuted_learner_state[opn].candidate_learned_value;\r\n var bal := s.learner.max_ballot_seen;\r\n assert opn in s.learner.unexecuted_learner_state;\r\n assert |s.learner.unexecuted_learner_state[opn].received_2b_message_senders| >= LMinQuorumSize(c.config);\r\n assert s'.executor.next_op_to_execute == OutstandingOpKnown(v, bal);\r\n var senders := s.learner.unexecuted_learner_state[opn].received_2b_message_senders;\r\n\r\n var indices:set := {};\r\n var packets:seq := [];\r\n var sender_idx := 0;\r\n var dummy_packet := LPacket(c.config.replica_ids[0], c.config.replica_ids[0], RslMessage_1a(Ballot(0, 0)));\r\n while sender_idx < |c.config.replica_ids|\r\n invariant 0 <= sender_idx <= |c.config.replica_ids|\r\n invariant |packets| == sender_idx\r\n invariant forall sidx :: sidx in indices ==> && 0 <= sidx < sender_idx\r\n && var p := packets[sidx];\r\n && p.src == b[i].constants.config.replica_ids[sidx]\r\n && p.msg.RslMessage_2b?\r\n && p.msg.opn_2b == opn\r\n && p.msg.val_2b == v\r\n && p.msg.bal_2b == bal\r\n && p in b[i].environment.sentPackets\r\n invariant forall sidx {:trigger c.config.replica_ids[sidx] in senders} ::\r\n 0 <= sidx < sender_idx && c.config.replica_ids[sidx] in senders ==> sidx in indices\r\n {\r\n var sender := c.config.replica_ids[sender_idx];\r\n if sender in senders\r\n {\r\n var sender_idx_unused, p := lemma_GetSent2bMessageFromLearnerState(b, c, i, idx, opn, sender);\r\n assert ReplicasDistinct(c.config.replica_ids, sender_idx, GetReplicaIndex(p.src, c.config));\r\n packets := packets + [p];\r\n indices := indices + {sender_idx};\r\n }\r\n else\r\n {\r\n packets := packets + [dummy_packet];\r\n }\r\n sender_idx := sender_idx + 1;\r\n }\r\n\r\n lemma_Received2bMessageSendersAlwaysValidReplicas(b, c, i-1, idx, opn);\r\n var alt_indices := lemma_GetIndicesFromNodes(senders, c.config);\r\n forall sidx | sidx in alt_indices\r\n ensures sidx in indices\r\n {\r\n assert 0 <= sidx < |c.config.replica_ids|;\r\n assert c.config.replica_ids[sidx] in senders;\r\n }\r\n SubsetCardinality(alt_indices, indices);\r\n \r\n q := QuorumOf2bs(c, indices, packets, bal, opn, v);\r\n}\r\n\r\nlemma lemma_ExecutedOperationAndAllBeforeItWereChosen(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int\r\n ) returns (\r\n qs:seq\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures |qs| == b[i].replicas[idx].replica.executor.ops_complete\r\n ensures forall opn :: 0 <= opn < |qs| ==> && IsValidQuorumOf2bs(b[i], qs[opn])\r\n && qs[opn].opn == opn\r\n && BalLeq(qs[opn].bal, b[i].replicas[idx].replica.executor.max_bal_reflected)\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n qs := [];\r\n return;\r\n }\r\n\r\n lemma_ReplicaConstantsAllConsistent(b, c, i, idx);\r\n lemma_ReplicaConstantsAllConsistent(b, c, i-1, idx);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n var s := b[i-1].replicas[idx].replica.executor;\r\n var s' := b[i].replicas[idx].replica.executor;\r\n\r\n if s'.ops_complete == s.ops_complete\r\n {\r\n qs := lemma_ExecutedOperationAndAllBeforeItWereChosen(b, c, i-1, idx);\r\n forall opn | 0 <= opn < |qs|\r\n ensures IsValidQuorumOf2bs(b[i], qs[opn])\r\n {\r\n lemma_QuorumOf2bsStaysValid(b, c, i-1, i, qs[opn]);\r\n }\r\n if s'.max_bal_reflected != s.max_bal_reflected\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n assert false;\r\n }\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n if b[i-1].replicas[idx].nextActionIndex == 0\r\n {\r\n var p := ios[0].r;\r\n qs := lemma_TransferredStateBasedOnChosenOperations(b, c, i-1, p);\r\n return;\r\n }\r\n\r\n var prev_qs := lemma_ExecutedOperationAndAllBeforeItWereChosen(b, c, i-1, idx);\r\n var q := lemma_DecidedOperationWasChosen(b, c, i-1, idx);\r\n qs := prev_qs + [q];\r\n}\r\n\r\nlemma lemma_TransferredStateBasedOnChosenOperations(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p:RslPacket\r\n ) returns (\r\n qs:seq\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in c.config.replica_ids\r\n requires p.msg.RslMessage_AppStateSupply?\r\n ensures |qs| == p.msg.opn_state_supply\r\n ensures forall opn :: 0 <= opn < |qs| ==> && IsValidQuorumOf2bs(b[i], qs[opn])\r\n && qs[opn].opn == opn\r\n && BalLeq(qs[opn].bal, p.msg.bal_state_supply)\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n qs := lemma_TransferredStateBasedOnChosenOperations(b, c, i-1, p);\r\n forall opn | 0 <= opn < |qs|\r\n ensures IsValidQuorumOf2bs(b[i], qs[opn])\r\n {\r\n lemma_QuorumOf2bsStaysValid(b, c, i-1, i, qs[opn]);\r\n }\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n var idx, ios := lemma_ActionThatSendsAppStateSupplyIsProcessAppStateRequest(b[i-1], b[i], p);\r\n qs := lemma_ExecutedOperationAndAllBeforeItWereChosen(b, c, i-1, idx);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/Constants.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Rules.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\n\r\nmodule CommonProof__Constants_i {\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Heuristics_i\r\nimport opened CommonProof__Assumptions_i\r\n\r\n///////////////////////////////\r\n// INVARIANTS\r\n///////////////////////////////\r\n\r\npredicate ConstantsAllConsistentInv(ps:RslState)\r\n{\r\n && |ps.constants.config.replica_ids| == |ps.replicas|\r\n && forall idx :: 0 <= idx < |ps.constants.config.replica_ids| ==>\r\n var s := ps.replicas[idx].replica;\r\n && s.constants.my_index == idx\r\n && s.constants.all == ps.constants\r\n && s.proposer.constants == s.constants\r\n && s.proposer.election_state.constants == s.constants\r\n && s.acceptor.constants == s.constants\r\n && s.learner.constants == s.constants\r\n && s.executor.constants == s.constants\r\n}\r\n\r\n///////////////////////////////\r\n// INVARIANT LEMMAS\r\n///////////////////////////////\r\n\r\nlemma lemma_AssumptionsMakeValidTransition(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1)\r\n requires 0 <= i\r\n ensures RslNext(b[i], b[i+1])\r\n{\r\n}\r\n\r\nlemma lemma_ReplicasSize(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n ensures |c.config.replica_ids| == |b[i].replicas|\r\n{\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ReplicasSize(b, c, i-1);\r\n }\r\n}\r\n\r\nlemma lemma_ReplicaInState(\r\n b:Behavior,\r\n c:LConstants,\r\n replica_index:int,\r\n i:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= replica_index < |c.config.replica_ids|\r\n ensures 0 <= replica_index < |b[i].replicas|\r\n{\r\n lemma_ReplicasSize(b, c, i);\r\n}\r\n\r\nlemma lemma_ConstantsAllConsistent(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n ensures b[i].constants == c\r\n ensures ConstantsAllConsistentInv(b[i])\r\n{\r\n TemporalAssist();\r\n\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n }\r\n}\r\n\r\nlemma lemma_ReplicaConstantsAllConsistent(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas| || 0 <= idx < |c.config.replica_ids| || 0 <= idx < |b[i].constants.config.replica_ids|\r\n ensures b[i].constants == c\r\n ensures |b[i].constants.config.replica_ids| == |b[i].replicas|\r\n ensures var s := b[i].replicas[idx].replica;\r\n && s.constants.my_index == idx\r\n && s.constants.all == b[i].constants\r\n && s.proposer.constants == s.constants\r\n && s.proposer.election_state.constants == s.constants\r\n && s.acceptor.constants == s.constants\r\n && s.learner.constants == s.constants\r\n && s.executor.constants == s.constants\r\n{\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/Environment.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Heuristics.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\n\r\nmodule CommonProof__Environment_i {\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Rules_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened Environment_s\r\n\r\nlemma lemma_PacketStaysInSentPackets(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n j:int,\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, j)\r\n requires 0 <= i <= j\r\n requires p in b[i].environment.sentPackets\r\n ensures p in b[j].environment.sentPackets\r\n{\r\n if j == i\r\n {\r\n }\r\n else\r\n {\r\n lemma_PacketStaysInSentPackets(b, c, i, j-1, p);\r\n lemma_AssumptionsMakeValidTransition(b, c, j-1);\r\n }\r\n}\r\n\r\nlemma lemma_PacketSetStaysInSentPackets(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n j:int,\r\n packets:set\r\n )\r\n requires IsValidBehaviorPrefix(b, c, j)\r\n requires 0 <= i <= j\r\n requires packets <= b[i].environment.sentPackets\r\n ensures packets <= b[j].environment.sentPackets\r\n{\r\n forall p | p in packets\r\n ensures p in b[j].environment.sentPackets\r\n {\r\n lemma_PacketStaysInSentPackets(b, c, i, j, p);\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/LearnerState.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"Actions.i.dfy\"\r\ninclude \"PacketSending.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"Message2b.i.dfy\"\r\ninclude \"Message2a.i.dfy\"\r\n\r\nmodule CommonProof__LearnerState_i {\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Types_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened CommonProof__Environment_i\r\nimport opened CommonProof__Message2b_i\r\nimport opened CommonProof__Message2a_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Concrete_NodeIdentity_i\r\n\r\nlemma lemma_Received2bMessageSendersAlwaysValidReplicas(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n learner_idx:int,\r\n opn:OperationNumber\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= learner_idx < |b[i].replicas|\r\n requires opn in b[i].replicas[learner_idx].replica.learner.unexecuted_learner_state\r\n ensures forall sender :: sender in b[i].replicas[learner_idx].replica.learner.unexecuted_learner_state[opn].received_2b_message_senders\r\n ==> sender in c.config.replica_ids\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var s := b[i-1].replicas[learner_idx].replica.learner;\r\n var s' := b[i].replicas[learner_idx].replica.learner;\r\n\r\n forall sender | sender in s'.unexecuted_learner_state[opn].received_2b_message_senders\r\n ensures sender in c.config.replica_ids\r\n {\r\n if opn in s.unexecuted_learner_state && sender in s.unexecuted_learner_state[opn].received_2b_message_senders\r\n {\r\n lemma_Received2bMessageSendersAlwaysValidReplicas(b, c, i-1, learner_idx, opn);\r\n }\r\n else\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, learner_idx);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_Received2bMessageSendersAlwaysNonempty(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n learner_idx:int,\r\n opn:OperationNumber\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= learner_idx < |b[i].replicas|\r\n requires opn in b[i].replicas[learner_idx].replica.learner.unexecuted_learner_state\r\n ensures |b[i].replicas[learner_idx].replica.learner.unexecuted_learner_state[opn].received_2b_message_senders| > 0\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var s := b[i-1].replicas[learner_idx].replica.learner;\r\n var s' := b[i].replicas[learner_idx].replica.learner;\r\n\r\n if s'.unexecuted_learner_state == s.unexecuted_learner_state\r\n {\r\n lemma_Received2bMessageSendersAlwaysNonempty(b, c, i-1, learner_idx, opn);\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, learner_idx);\r\n if opn in s.unexecuted_learner_state\r\n {\r\n lemma_Received2bMessageSendersAlwaysNonempty(b, c, i-1, learner_idx, opn);\r\n }\r\n}\r\n\r\nlemma lemma_GetSent2bMessageFromLearnerState(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n learner_idx:int,\r\n opn:OperationNumber,\r\n sender:NodeIdentity\r\n ) returns (\r\n sender_idx:int,\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= learner_idx < |b[i].replicas|\r\n requires opn in b[i].replicas[learner_idx].replica.learner.unexecuted_learner_state\r\n requires sender in b[i].replicas[learner_idx].replica.learner.unexecuted_learner_state[opn].received_2b_message_senders\r\n ensures 0 <= sender_idx < |c.config.replica_ids|\r\n ensures p in b[i].environment.sentPackets\r\n ensures p.src == sender == c.config.replica_ids[sender_idx]\r\n ensures p.msg.RslMessage_2b?\r\n ensures p.msg.opn_2b == opn\r\n ensures p.msg.bal_2b == b[i].replicas[learner_idx].replica.learner.max_ballot_seen\r\n ensures p.msg.val_2b == b[i].replicas[learner_idx].replica.learner.unexecuted_learner_state[opn].candidate_learned_value\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_ReplicaConstantsAllConsistent(b, c, i, learner_idx);\r\n lemma_ReplicaConstantsAllConsistent(b, c, i-1, learner_idx);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n var s := b[i-1].replicas[learner_idx].replica.learner;\r\n var s' := b[i].replicas[learner_idx].replica.learner;\r\n\r\n if s'.max_ballot_seen == s.max_ballot_seen && s'.unexecuted_learner_state == s.unexecuted_learner_state\r\n {\r\n sender_idx, p := lemma_GetSent2bMessageFromLearnerState(b, c, i-1, learner_idx, opn, sender);\r\n lemma_PacketStaysInSentPackets(b, c, i-1, i, p);\r\n return;\r\n }\r\n\r\n if && opn in s.unexecuted_learner_state\r\n && sender in s.unexecuted_learner_state[opn].received_2b_message_senders\r\n && s'.unexecuted_learner_state[opn].candidate_learned_value == s.unexecuted_learner_state[opn].candidate_learned_value\r\n && s'.max_ballot_seen == s.max_ballot_seen\r\n {\r\n sender_idx, p := lemma_GetSent2bMessageFromLearnerState(b, c, i-1, learner_idx, opn, sender);\r\n lemma_PacketStaysInSentPackets(b, c, i-1, i, p);\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, learner_idx);\r\n assert ios[0].LIoOpReceive?;\r\n p := ios[0].r;\r\n sender_idx := GetReplicaIndex(p.src, c.config);\r\n\r\n if p.msg.val_2b != s'.unexecuted_learner_state[opn].candidate_learned_value\r\n {\r\n assert p.msg.bal_2b == s.max_ballot_seen;\r\n assert opn in s.unexecuted_learner_state;\r\n lemma_Received2bMessageSendersAlwaysNonempty(b, c, i-1, learner_idx, opn);\r\n var sender2 :| sender2 in s.unexecuted_learner_state[opn].received_2b_message_senders;\r\n var sender2_idx, p2 := lemma_GetSent2bMessageFromLearnerState(b, c, i-1, learner_idx, opn, sender2);\r\n\r\n var p_2a := lemma_2bMessageHasCorresponding2aMessage(b, c, i, p);\r\n var p2_2a := lemma_2bMessageHasCorresponding2aMessage(b, c, i, p2);\r\n lemma_2aMessagesFromSameBallotAndOperationMatch(b, c, i, p_2a, p2_2a);\r\n }\r\n}\r\n \r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/LogTruncationPoint.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Actions.i.dfy\"\r\ninclude \"PacketSending.i.dfy\"\r\ninclude \"MaxBallotISent1a.i.dfy\"\r\ninclude \"Quorum.i.dfy\"\r\n\r\nmodule CommonProof__LogTruncationPoint_i {\r\n\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened CommonProof__MaxBallotISent1a_i\r\nimport opened CommonProof__Quorum_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Collections__CountMatches_i\r\nimport opened Collections__Sets_i\r\n\r\npredicate QuorumIsWitnessForLogTruncationPoint(\r\n ps:RslState,\r\n q:set,\r\n log_truncation_point:int\r\n )\r\n{\r\n && |q| >= LMinQuorumSize(ps.constants.config)\r\n && forall idx :: idx in q ==> 0 <= idx < |ps.replicas| && ps.replicas[idx].replica.executor.ops_complete >= log_truncation_point \r\n}\r\n\r\npredicate LogTruncationPointInfoValid(\r\n ps:RslState,\r\n log_truncation_point:int\r\n )\r\n{\r\n exists q:set :: QuorumIsWitnessForLogTruncationPoint(ps, q, log_truncation_point)\r\n}\r\n\r\npredicate LogTruncationPointInfoInPacketValid(\r\n ps:RslState,\r\n p:RslPacket\r\n )\r\n{\r\n && (p.msg.RslMessage_1b? ==> LogTruncationPointInfoValid(ps, p.msg.log_truncation_point))\r\n && (p.msg.RslMessage_2a? ==> LogTruncationPointInfoValid(ps, p.msg.opn_2a - ps.constants.params.max_log_length + 1))\r\n}\r\n\r\npredicate LogTruncationPointInvariant(\r\n ps:RslState\r\n )\r\n{\r\n && (forall idx {:trigger LogTruncationPointInfoValid(ps, ps.replicas[idx].replica.acceptor.log_truncation_point)} ::\r\n 0 <= idx < |ps.replicas| ==> LogTruncationPointInfoValid(ps, ps.replicas[idx].replica.acceptor.log_truncation_point))\r\n && (forall p {:trigger LogTruncationPointInfoInPacketValid(ps, p)} ::\r\n p in ps.environment.sentPackets && p.src in ps.constants.config.replica_ids ==> LogTruncationPointInfoInPacketValid(ps, p))\r\n}\r\n\r\nlemma lemma_OpsCompleteMonotonicOneStep(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures 0 <= idx < |b[i+1].replicas|\r\n ensures b[i].replicas[idx].replica.executor.ops_complete <= b[i+1].replicas[idx].replica.executor.ops_complete\r\n{\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i+1);\r\n if b[i].replicas[idx].replica.executor.ops_complete > b[i+1].replicas[idx].replica.executor.ops_complete\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i+1);\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i, idx);\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_OpsCompleteMonotonic(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n j:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, j)\r\n requires 0 <= i <= j\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures 0 <= idx < |b[j].replicas|\r\n ensures b[i].replicas[idx].replica.executor.ops_complete <= b[j].replicas[idx].replica.executor.ops_complete\r\n decreases j-i\r\n{\r\n if j == i\r\n {\r\n }\r\n else if j == i + 1\r\n {\r\n lemma_OpsCompleteMonotonicOneStep(b, c, i, idx);\r\n }\r\n else\r\n {\r\n lemma_OpsCompleteMonotonic(b, c, i, j-1, idx);\r\n lemma_OpsCompleteMonotonicOneStep(b, c, j-1, idx);\r\n }\r\n}\r\n\r\nlemma lemma_LogTruncationPointMonotonicOneStep(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures 0 <= idx < |b[i+1].replicas|\r\n ensures b[i].replicas[idx].replica.acceptor.log_truncation_point <= b[i+1].replicas[idx].replica.acceptor.log_truncation_point\r\n{\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i+1);\r\n if b[i].replicas[idx].replica.acceptor.log_truncation_point > b[i+1].replicas[idx].replica.acceptor.log_truncation_point\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i+1);\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i, idx);\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_LogTruncationPointMonotonic(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n j:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, j)\r\n requires 0 <= i <= j\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures 0 <= idx < |b[j].replicas|\r\n ensures b[i].replicas[idx].replica.acceptor.log_truncation_point <= b[j].replicas[idx].replica.acceptor.log_truncation_point\r\n decreases j-i\r\n{\r\n if j == i\r\n {\r\n }\r\n else if j == i + 1\r\n {\r\n lemma_LogTruncationPointMonotonicOneStep(b, c, i, idx);\r\n }\r\n else\r\n {\r\n lemma_LogTruncationPointMonotonic(b, c, i, j-1, idx);\r\n lemma_LogTruncationPointMonotonicOneStep(b, c, j-1, idx);\r\n }\r\n}\r\n\r\nlemma lemma_HeartbeatMessagesReflectOpsComplete(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.msg.RslMessage_Heartbeat?\r\n requires p.src in c.config.replica_ids\r\n ensures var sender_index := GetReplicaIndex(p.src, c.config);\r\n && 0 <= sender_index < |b[i].replicas|\r\n && p.msg.opn_ckpt <= b[i].replicas[sender_index].replica.executor.ops_complete\r\n{\r\n if i == 0\r\n {\r\n assert false;\r\n }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n var sender_index := GetReplicaIndex(p.src, c.config);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n lemma_HeartbeatMessagesReflectOpsComplete(b, c, i-1, p);\r\n lemma_OpsCompleteMonotonicOneStep(b, c, i-1, sender_index);\r\n }\r\n else\r\n {\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n var idx, ios := lemma_ActionThatSendsHeartbeatIsMaybeSendHeartbeat(b[i-1], b[i], p);\r\n assert ReplicasDistinct(c.config.replica_ids, idx, sender_index);\r\n }\r\n}\r\n\r\nlemma lemma_LastCheckpointedOperationSize(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures |b[i].replicas[idx].replica.acceptor.last_checkpointed_operation| == |b[i].replicas|\r\n decreases i\r\n{\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n lemma_LastCheckpointedOperationSize(b, c, i-1, idx);\r\n\r\n if |b[i].replicas[idx].replica.acceptor.last_checkpointed_operation| != |b[i].replicas|\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n assert false;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_LastCheckpointedOperationReflectsOpsComplete(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n acceptor_idx:int,\r\n executor_idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= acceptor_idx < |b[i].replicas|\r\n requires 0 <= executor_idx < |b[i].replicas|\r\n ensures 0 <= executor_idx < |b[i].replicas[acceptor_idx].replica.acceptor.last_checkpointed_operation|\r\n ensures b[i].replicas[acceptor_idx].replica.acceptor.last_checkpointed_operation[executor_idx]\r\n <= b[i].replicas[executor_idx].replica.executor.ops_complete\r\n{\r\n lemma_LastCheckpointedOperationSize(b, c, i, acceptor_idx);\r\n \r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n lemma_LastCheckpointedOperationReflectsOpsComplete(b, c, i-1, acceptor_idx, executor_idx);\r\n lemma_OpsCompleteMonotonicOneStep(b, c, i-1, executor_idx);\r\n\r\n if b[i].replicas[acceptor_idx].replica.acceptor.last_checkpointed_operation[executor_idx] >\r\n b[i].replicas[executor_idx].replica.executor.ops_complete\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, acceptor_idx);\r\n lemma_PacketProcessedImpliesPacketSent(b[i-1], b[i], acceptor_idx, ios, ios[0].r);\r\n lemma_HeartbeatMessagesReflectOpsComplete(b, c, i-1, ios[0].r);\r\n assert false;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_LogTruncationPointInfoValidImpliesValidNext(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n log_truncation_point:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1)\r\n requires 0 <= i\r\n requires LogTruncationPointInfoValid(b[i], log_truncation_point)\r\n ensures LogTruncationPointInfoValid(b[i+1], log_truncation_point)\r\n{\r\n var q :| QuorumIsWitnessForLogTruncationPoint(b[i], q, log_truncation_point);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i+1);\r\n forall idx | idx in q\r\n ensures 0 <= idx < |b[i+1].replicas|\r\n ensures b[i+1].replicas[idx].replica.executor.ops_complete >= log_truncation_point\r\n {\r\n assert 0 <= idx < |b[i].replicas| && b[i].replicas[idx].replica.executor.ops_complete >= log_truncation_point;\r\n lemma_OpsCompleteMonotonicOneStep(b, c, i, idx);\r\n }\r\n assert QuorumIsWitnessForLogTruncationPoint(b[i+1], q, log_truncation_point);\r\n}\r\n\r\nlemma lemma_LogTruncationPointInfoValidImpliesSmallerOneValid(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n logTruncationPoint1:int,\r\n logTruncationPoint2:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires LogTruncationPointInfoValid(b[i], logTruncationPoint1)\r\n requires logTruncationPoint2 <= logTruncationPoint1\r\n ensures LogTruncationPointInfoValid(b[i], logTruncationPoint2)\r\n{\r\n var q :| QuorumIsWitnessForLogTruncationPoint(b[i], q, logTruncationPoint1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n forall idx | idx in q\r\n ensures b[i].replicas[idx].replica.executor.ops_complete >= logTruncationPoint2\r\n {\r\n assert 0 <= idx < |b[i].replicas| && b[i].replicas[idx].replica.executor.ops_complete >= logTruncationPoint1;\r\n }\r\n assert QuorumIsWitnessForLogTruncationPoint(b[i], q, logTruncationPoint2);\r\n}\r\n\r\nlemma lemma_LogTruncationPointStateInvariantMaintainedByStep(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1)\r\n requires 0 <= i\r\n requires LogTruncationPointInvariant(b[i])\r\n requires 0 <= idx < |b[i+1].replicas|\r\n ensures LogTruncationPointInfoValid(b[i+1], b[i+1].replicas[idx].replica.acceptor.log_truncation_point)\r\n{\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i+1);\r\n\r\n var s := b[i].replicas[idx].replica;\r\n var s' := b[i+1].replicas[idx].replica;\r\n\r\n if s'.acceptor.log_truncation_point == s.acceptor.log_truncation_point\r\n {\r\n lemma_LogTruncationPointInfoValidImpliesValidNext(b, c, i, s.acceptor.log_truncation_point);\r\n }\r\n else\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i, idx);\r\n var nextActionIndex := b[i].replicas[idx].nextActionIndex;\r\n if nextActionIndex == 0\r\n {\r\n var p := ios[0].r;\r\n lemma_PacketProcessedImpliesPacketSent(b[i], b[i+1], idx, ios, p);\r\n assert LogTruncationPointInfoInPacketValid(b[i], p);\r\n if p.msg.RslMessage_1b?\r\n {\r\n assert LogTruncationPointInfoValid(b[i], p.msg.log_truncation_point);\r\n assert s'.acceptor.log_truncation_point == p.msg.log_truncation_point;\r\n lemma_LogTruncationPointInfoValidImpliesValidNext(b, c, i, s'.acceptor.log_truncation_point);\r\n }\r\n else if p.msg.RslMessage_2a?\r\n {\r\n assert LogTruncationPointInfoValid(b[i], p.msg.opn_2a - b[i].constants.params.max_log_length + 1);\r\n assert s'.acceptor.log_truncation_point == p.msg.opn_2a - b[i].constants.params.max_log_length + 1;\r\n lemma_LogTruncationPointInfoValidImpliesValidNext(b, c, i, s'.acceptor.log_truncation_point);\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n }\r\n else if nextActionIndex == 4\r\n {\r\n var log_truncation_point := s'.acceptor.log_truncation_point;\r\n assert IsNthHighestValueInSequence(log_truncation_point, s.acceptor.last_checkpointed_operation,\r\n LMinQuorumSize(s.constants.all.config));\r\n assert CountMatchesInSeq(s.acceptor.last_checkpointed_operation, x => x >= log_truncation_point)\r\n >= LMinQuorumSize(s.constants.all.config);\r\n var q := SetOfIndicesOfMatchesInSeq(s.acceptor.last_checkpointed_operation, x => x >= log_truncation_point);\r\n assert |q| == CountMatchesInSeq(s.acceptor.last_checkpointed_operation, x => x >= log_truncation_point);\r\n assert |q| >= LMinQuorumSize(s.constants.all.config);\r\n forall executor_idx | executor_idx in q\r\n ensures 0 <= executor_idx < |b[i+1].replicas|\r\n ensures b[i+1].replicas[executor_idx].replica.executor.ops_complete >= log_truncation_point\r\n {\r\n assert s.acceptor.last_checkpointed_operation[executor_idx] >= log_truncation_point;\r\n lemma_LastCheckpointedOperationSize(b, c, i+1, idx);\r\n lemma_LastCheckpointedOperationReflectsOpsComplete(b, c, i+1, idx, executor_idx);\r\n }\r\n assert QuorumIsWitnessForLogTruncationPoint(b[i+1], q, log_truncation_point);\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_LogTruncationPointInvariantHolds(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n ensures LogTruncationPointInvariant(b[i])\r\n{\r\n if i == 0\r\n {\r\n var q := SetOfNumbersInRightExclusiveRange(0, |b[i].constants.config.replica_ids|);\r\n calc {\r\n |q|;\r\n |b[i].constants.config.replica_ids|;\r\n >= |b[i].constants.config.replica_ids| / 2 + 1;\r\n LMinQuorumSize(b[i].constants.config);\r\n }\r\n assert QuorumIsWitnessForLogTruncationPoint(b[i], q, 0);\r\n assert LogTruncationPointInfoValid(b[i], 0);\r\n assert LogTruncationPointInvariant(b[i]);\r\n }\r\n else\r\n {\r\n lemma_LogTruncationPointInvariantHolds(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n forall idx | 0 <= idx < |b[i].replicas|\r\n ensures LogTruncationPointInfoValid(b[i], b[i].replicas[idx].replica.acceptor.log_truncation_point)\r\n {\r\n lemma_LogTruncationPointStateInvariantMaintainedByStep(b, c, i-1, idx);\r\n }\r\n\r\n forall p | p in b[i].environment.sentPackets && p.src in b[i].constants.config.replica_ids\r\n ensures LogTruncationPointInfoInPacketValid(b[i], p)\r\n {\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n assert p.src in b[i-1].constants.config.replica_ids;\r\n assert LogTruncationPointInfoInPacketValid(b[i-1], p);\r\n if p.msg.RslMessage_1b?\r\n {\r\n lemma_LogTruncationPointInfoValidImpliesValidNext(b, c, i-1, p.msg.log_truncation_point);\r\n }\r\n else if p.msg.RslMessage_2a?\r\n {\r\n lemma_LogTruncationPointInfoValidImpliesValidNext(b, c, i-1, p.msg.opn_2a - b[i].constants.params.max_log_length + 1);\r\n }\r\n }\r\n else\r\n {\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n if p.msg.RslMessage_1b?\r\n {\r\n var idx, ios := lemma_ActionThatSends1bIsProcess1a(b[i-1], b[i], p);\r\n assert p.msg.log_truncation_point == b[i-1].replicas[idx].replica.acceptor.log_truncation_point;\r\n lemma_LogTruncationPointInfoValidImpliesValidNext(b, c, i-1, p.msg.log_truncation_point);\r\n }\r\n else if p.msg.RslMessage_2a?\r\n {\r\n var idx, ios := lemma_ActionThatSends2aIsMaybeNominateValueAndSend2a(b[i-1], b[i], p);\r\n var s := b[i-1].replicas[idx].replica;\r\n lemma_LogTruncationPointInfoValidImpliesValidNext(b, c, i-1, s.acceptor.log_truncation_point);\r\n lemma_LogTruncationPointInfoValidImpliesSmallerOneValid(b, c, i, s.acceptor.log_truncation_point,\r\n p.msg.opn_2a - s.proposer.constants.all.params.max_log_length + 1);\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_AlwaysSomeReplicaInQuorumBeyondLogTruncationPoint(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n acceptor_idx:int,\r\n quorum:set\r\n ) returns (\r\n king_idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= acceptor_idx < |b[i].replicas|\r\n requires forall replica_index :: replica_index in quorum ==> 0 <= replica_index < |c.config.replica_ids|\r\n requires |quorum| >= LMinQuorumSize(c.config)\r\n ensures king_idx in quorum\r\n ensures 0 <= king_idx < |b[i].replicas|\r\n ensures b[i].replicas[king_idx].replica.executor.ops_complete >= b[i].replicas[acceptor_idx].replica.acceptor.log_truncation_point\r\n{\r\n lemma_LogTruncationPointInvariantHolds(b, c, i);\r\n var log_truncation_point := b[i].replicas[acceptor_idx].replica.acceptor.log_truncation_point;\r\n assert LogTruncationPointInfoValid(b[i], log_truncation_point);\r\n\r\n var q :| QuorumIsWitnessForLogTruncationPoint(b[i], q, log_truncation_point);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n king_idx := lemma_QuorumIndexOverlap(q, quorum, |c.config.replica_ids|);\r\n}\r\n\r\nlemma lemma_ProposerLogTruncationPointAlwaysBeyondThatOfAllReceived1bs(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures var s := b[i].replicas[idx].replica;\r\n forall p{:trigger p in s.proposer.received_1b_packets} ::\r\n p in s.proposer.received_1b_packets && p.msg.RslMessage_1b?\r\n ==> s.acceptor.log_truncation_point >= p.msg.log_truncation_point\r\n decreases i\r\n{\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var s := b[i-1].replicas[idx].replica;\r\n var s' := b[i].replicas[idx].replica;\r\n forall p | p in s'.proposer.received_1b_packets && p.msg.RslMessage_1b?\r\n ensures s'.acceptor.log_truncation_point >= p.msg.log_truncation_point\r\n {\r\n if p in s.proposer.received_1b_packets\r\n {\r\n lemma_ProposerLogTruncationPointAlwaysBeyondThatOfAllReceived1bs(b, c, i-1, idx);\r\n assert s.acceptor.log_truncation_point >= p.msg.log_truncation_point;\r\n lemma_LogTruncationPointMonotonicOneStep(b, c, i-1, idx);\r\n }\r\n else\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n assert s'.acceptor.log_truncation_point >= p.msg.log_truncation_point;\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_VoteAlwaysWithinLogTruncationPointRange(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n replica_idx:int,\r\n opn:OperationNumber\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= replica_idx < |b[i].replicas|\r\n requires opn in b[i].replicas[replica_idx].replica.acceptor.votes\r\n ensures var log_truncation_point := b[i].replicas[replica_idx].replica.acceptor.log_truncation_point;\r\n log_truncation_point <= opn < log_truncation_point + c.params.max_log_length\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var s := b[i-1].replicas[replica_idx].replica;\r\n var s' := b[i].replicas[replica_idx].replica;\r\n\r\n var log_truncation_point := s.acceptor.log_truncation_point;\r\n var log_truncation_point' := s'.acceptor.log_truncation_point;\r\n \r\n if log_truncation_point' <= opn < log_truncation_point' + c.params.max_log_length\r\n {\r\n return;\r\n }\r\n\r\n if opn in s.acceptor.votes\r\n {\r\n lemma_VoteAlwaysWithinLogTruncationPointRange(b, c, i-1, replica_idx, opn);\r\n if log_truncation_point == log_truncation_point'\r\n {\r\n assert false;\r\n }\r\n else\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, replica_idx);\r\n assert false;\r\n }\r\n }\r\n else\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, replica_idx);\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_VoteIn1bMessageAlwaysWithinLogTruncationPointRange(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n opn:OperationNumber,\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.msg.RslMessage_1b?\r\n requires p.src in c.config.replica_ids\r\n requires opn in p.msg.votes\r\n ensures var log_truncation_point := p.msg.log_truncation_point;\r\n log_truncation_point <= opn < log_truncation_point + c.params.max_log_length\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n lemma_VoteIn1bMessageAlwaysWithinLogTruncationPointRange(b, c, i-1, opn, p);\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n var idx, ios := lemma_ActionThatSends1bIsProcess1a(b[i-1], b[i], p);\r\n var log_truncation_point := p.msg.log_truncation_point;\r\n lemma_VoteAlwaysWithinLogTruncationPointRange(b, c, i-1, idx, opn);\r\n assert log_truncation_point <= opn < log_truncation_point + c.params.max_log_length;\r\n}\r\n\r\nlemma lemma_VoteInReceived1bMessageAlwaysWithinLogTruncationPointRange(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int,\r\n opn:OperationNumber,\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires p in b[i].replicas[idx].replica.proposer.received_1b_packets\r\n requires p.msg.RslMessage_1b?\r\n requires opn in p.msg.votes\r\n ensures var log_truncation_point := b[i].replicas[idx].replica.acceptor.log_truncation_point;\r\n opn < log_truncation_point + c.params.max_log_length\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n var s := b[i-1].replicas[idx].replica;\r\n var s' := b[i].replicas[idx].replica;\r\n lemma_LogTruncationPointMonotonicOneStep(b, c, i-1, idx);\r\n\r\n if p in s.proposer.received_1b_packets\r\n {\r\n lemma_VoteInReceived1bMessageAlwaysWithinLogTruncationPointRange(b, c, i-1, idx, opn, p);\r\n lemma_LogTruncationPointMonotonicOneStep(b, c, i-1, idx);\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n lemma_VoteIn1bMessageAlwaysWithinLogTruncationPointRange(b, c, i, opn, p);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/MaxBallot.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"Actions.i.dfy\"\r\ninclude \"PacketSending.i.dfy\"\r\ninclude \"MaxBallotISent1a.i.dfy\"\r\n\r\nmodule CommonProof__MaxBallot_i {\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__Types_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened CommonProof__MaxBallotISent1a_i\r\nimport opened Temporal__Temporal_s\r\n\r\nlemma lemma_MaxBalLeqMaxBallotPrimarySent1a(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures 0 <= b[i].replicas[idx].replica.acceptor.max_bal.proposer_id < |b[i].replicas|\r\n ensures var max_bal := b[i].replicas[idx].replica.acceptor.max_bal;\r\n BalLeq(max_bal, b[i].replicas[max_bal.proposer_id].replica.proposer.max_ballot_i_sent_1a)\r\n decreases i\r\n{\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n var s := b[i-1].replicas[idx].replica;\r\n var s' := b[i].replicas[idx].replica;\r\n var max_bal := s.acceptor.max_bal;\r\n var max_bal' := s'.acceptor.max_bal;\r\n\r\n if max_bal == max_bal'\r\n {\r\n lemma_MaxBalLeqMaxBallotPrimarySent1a(b, c, i-1, idx);\r\n lemma_MaxBallotISent1aMonotonicOneStep(b, c, i-1, max_bal.proposer_id);\r\n }\r\n else\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n var nextActionIndex := b[i-1].replicas[idx].nextActionIndex;\r\n assert nextActionIndex == 0;\r\n var p := ios[0].r;\r\n lemma_PacketProcessedImpliesPacketSent(b[i-1], b[i], idx, ios, p);\r\n assert p in b[i-1].environment.sentPackets;\r\n if p.msg.RslMessage_1a?\r\n {\r\n lemma_Message1aLeqMaxBallotSenderSent1a(b, c, i-1, p);\r\n }\r\n else if p.msg.RslMessage_2a?\r\n {\r\n lemma_Message2aLeqMaxBallotSenderSent1a(b, c, i-1, p);\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_VotePrecedesMaxBal(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int,\r\n opn:OperationNumber\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires opn in b[i].replicas[idx].replica.acceptor.votes\r\n ensures BalLeq(b[i].replicas[idx].replica.acceptor.votes[opn].max_value_bal, b[i].replicas[idx].replica.acceptor.max_bal)\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_ReplicaConstantsAllConsistent(b, c, i, idx);\r\n lemma_ReplicaConstantsAllConsistent(b, c, i-1, idx);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n var s := b[i-1].replicas[idx].replica.acceptor;\r\n var s' := b[i].replicas[idx].replica.acceptor;\r\n\r\n if s' == s\r\n {\r\n lemma_VotePrecedesMaxBal(b, c, i-1, idx, opn);\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n if opn in s.votes\r\n {\r\n lemma_VotePrecedesMaxBal(b, c, i-1, idx, opn);\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/MaxBallotISent1a.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"Actions.i.dfy\"\r\ninclude \"PacketSending.i.dfy\"\r\n\r\nmodule CommonProof__MaxBallotISent1a_i {\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Types_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened Temporal__Temporal_s\r\n\r\npredicate PrimaryHasReachedState2OfBallot(\r\n ps:RslState,\r\n bal:Ballot\r\n )\r\n{\r\n var proposer_idx := bal.proposer_id;\r\n && 0 <= proposer_idx < |ps.replicas|\r\n && var s := ps.replicas[proposer_idx].replica.proposer;\r\n && BalLeq(bal, s.max_ballot_i_sent_1a)\r\n && (bal == s.max_ballot_i_sent_1a ==> s.current_state != 1)\r\n}\r\n\r\nlemma lemma_MaxBallotISent1aMonotonicOneStep(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures 0 <= idx < |b[i+1].replicas|\r\n ensures BalLeq(b[i].replicas[idx].replica.proposer.max_ballot_i_sent_1a, b[i+1].replicas[idx].replica.proposer.max_ballot_i_sent_1a)\r\n ensures b[i].replicas[idx].replica.proposer.current_state != 1 ==>\r\n || b[i+1].replicas[idx].replica.proposer.current_state != 1\r\n || BalLt(b[i].replicas[idx].replica.proposer.max_ballot_i_sent_1a, b[i+1].replicas[idx].replica.proposer.max_ballot_i_sent_1a)\r\n{\r\n lemma_AssumptionsMakeValidTransition(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i+1);\r\n}\r\n\r\nlemma lemma_MaxBallotISent1aMonotonic(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n j:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, j)\r\n requires 0 <= i <= j\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures 0 <= idx < |b[j].replicas|\r\n ensures BalLeq(b[i].replicas[idx].replica.proposer.max_ballot_i_sent_1a, b[j].replicas[idx].replica.proposer.max_ballot_i_sent_1a)\r\n ensures b[i].replicas[idx].replica.proposer.current_state != 1 ==>\r\n || b[j].replicas[idx].replica.proposer.current_state != 1\r\n || BalLt(b[i].replicas[idx].replica.proposer.max_ballot_i_sent_1a, b[j].replicas[idx].replica.proposer.max_ballot_i_sent_1a)\r\n{\r\n if j > i\r\n {\r\n lemma_ReplicaConstantsAllConsistent(b, c, i, idx);\r\n lemma_ReplicaConstantsAllConsistent(b, c, j-1, idx);\r\n lemma_ReplicaConstantsAllConsistent(b, c, j, idx);\r\n lemma_MaxBallotISent1aMonotonic(b, c, i, j-1, idx);\r\n lemma_MaxBallotISent1aMonotonicOneStep(b, c, j-1, idx);\r\n }\r\n}\r\n\r\nlemma lemma_MaxBallotISent1aHasMeAsProposer(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures b[i].replicas[idx].replica.proposer.max_ballot_i_sent_1a.proposer_id == idx\r\n ensures b[i].replicas[idx].replica.proposer.max_ballot_i_sent_1a.seqno >= 0\r\n decreases i\r\n{\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_MaxBallotISent1aHasMeAsProposer(b, c, i-1, idx);\r\n\r\n if b[i].replicas[idx].replica.proposer.max_ballot_i_sent_1a != b[i-1].replicas[idx].replica.proposer.max_ballot_i_sent_1a\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_PrimaryHasReachedState2OfBallotMaintainedByOneStep(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n bal:Ballot\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1)\r\n requires 0 <= i\r\n requires PrimaryHasReachedState2OfBallot(b[i], bal)\r\n ensures PrimaryHasReachedState2OfBallot(b[i+1], bal)\r\n{\r\n lemma_MaxBallotISent1aMonotonicOneStep(b, c, i, bal.proposer_id);\r\n}\r\n\r\nlemma lemma_Message1aLeqMaxBallotSenderSent1a(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in c.config.replica_ids\r\n requires p.msg.RslMessage_1a?\r\n ensures 0 <= p.msg.bal_1a.proposer_id < |b[i].replicas| == |b[i].constants.config.replica_ids|\r\n ensures p.src == b[i].constants.config.replica_ids[p.msg.bal_1a.proposer_id]\r\n ensures var proposer_idx := p.msg.bal_1a.proposer_id;\r\n BalLeq(p.msg.bal_1a, b[i].replicas[proposer_idx].replica.proposer.max_ballot_i_sent_1a)\r\n decreases i\r\n{\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n lemma_Message1aLeqMaxBallotSenderSent1a(b, c, i-1, p);\r\n lemma_MaxBallotISent1aMonotonicOneStep(b, c, i-1, p.msg.bal_1a.proposer_id);\r\n }\r\n else\r\n {\r\n var idx, ios := lemma_ActionThatSends1aIsMaybeEnterNewViewAndSend1a(b[i-1], b[i], p);\r\n lemma_MaxBallotISent1aHasMeAsProposer(b, c, i-1, idx);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_MessageStartingPhase2LeqMaxBallotSenderSent1a(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in c.config.replica_ids\r\n requires p.msg.RslMessage_StartingPhase2?\r\n ensures 0 <= p.msg.bal_2.proposer_id < |b[i].replicas| == |b[i].constants.config.replica_ids|\r\n ensures p.src == b[i].constants.config.replica_ids[p.msg.bal_2.proposer_id]\r\n ensures var proposer_idx := p.msg.bal_2.proposer_id;\r\n BalLeq(p.msg.bal_2, b[i].replicas[proposer_idx].replica.proposer.max_ballot_i_sent_1a)\r\n decreases i\r\n{\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n lemma_MessageStartingPhase2LeqMaxBallotSenderSent1a(b, c, i-1, p);\r\n lemma_MaxBallotISent1aMonotonicOneStep(b, c, i-1, p.msg.bal_2.proposer_id);\r\n }\r\n else\r\n {\r\n var idx, ios := lemma_ActionThatSendsStartingPhase2IsMaybeEnterPhase2(b[i-1], b[i], p);\r\n lemma_MaxBallotISent1aHasMeAsProposer(b, c, i-1, idx);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_Message2aLeqMaxBallotSenderSent1a(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in c.config.replica_ids\r\n requires p.msg.RslMessage_2a?\r\n ensures 0 <= p.msg.bal_2a.proposer_id < |b[i].replicas| == |b[i].constants.config.replica_ids|\r\n ensures p.src == b[i].constants.config.replica_ids[p.msg.bal_2a.proposer_id]\r\n ensures var proposer_idx := p.msg.bal_2a.proposer_id;\r\n BalLeq(p.msg.bal_2a, b[i].replicas[proposer_idx].replica.proposer.max_ballot_i_sent_1a)\r\n decreases i\r\n{\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n lemma_Message2aLeqMaxBallotSenderSent1a(b, c, i-1, p);\r\n lemma_MaxBallotISent1aMonotonicOneStep(b, c, i-1, p.msg.bal_2a.proposer_id);\r\n }\r\n else\r\n {\r\n var idx, ios := lemma_ActionThatSends2aIsMaybeNominateValueAndSend2a(b[i-1], b[i], p);\r\n lemma_MaxBallotISent1aHasMeAsProposer(b, c, i-1, idx);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_Message2aShowsPrimaryReachedState2(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in c.config.replica_ids\r\n requires p.msg.RslMessage_2a?\r\n ensures PrimaryHasReachedState2OfBallot(b[i], p.msg.bal_2a)\r\n decreases i\r\n{\r\n lemma_Message2aLeqMaxBallotSenderSent1a(b, c, i, p);\r\n\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n lemma_Message2aShowsPrimaryReachedState2(b, c, i-1, p);\r\n lemma_PrimaryHasReachedState2OfBallotMaintainedByOneStep(b, c, i-1, p.msg.bal_2a);\r\n }\r\n else\r\n {\r\n var idx, ios := lemma_ActionThatSends2aIsMaybeNominateValueAndSend2a(b[i-1], b[i], p);\r\n lemma_MaxBallotISent1aHasMeAsProposer(b, c, i-1, idx);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_Message2bShowsPrimaryReachedState2(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in c.config.replica_ids\r\n requires p.msg.RslMessage_2b?\r\n ensures PrimaryHasReachedState2OfBallot(b[i], p.msg.bal_2b)\r\n decreases i\r\n{\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n lemma_Message2bShowsPrimaryReachedState2(b, c, i-1, p);\r\n lemma_PrimaryHasReachedState2OfBallotMaintainedByOneStep(b, c, i-1, p.msg.bal_2b);\r\n }\r\n else\r\n {\r\n var idx, ios := lemma_ActionThatSends2bIsProcess2a(b[i-1], b[i], p);\r\n lemma_PacketProcessedImpliesPacketSent(b[i-1], b[i], idx, ios, ios[0].r);\r\n lemma_Message2aShowsPrimaryReachedState2(b, c, i-1, ios[0].r);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_LearnerMaxBallotSeenShowsPrimaryReachedState2(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n learner_idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= learner_idx < |b[i].replicas|\r\n ensures PrimaryHasReachedState2OfBallot(b[i], b[i].replicas[learner_idx].replica.learner.max_ballot_seen)\r\n decreases i\r\n{\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n var max_ballot_seen := b[i-1].replicas[learner_idx].replica.learner.max_ballot_seen;\r\n var max_ballot_seen' := b[i].replicas[learner_idx].replica.learner.max_ballot_seen;\r\n\r\n if max_ballot_seen' == max_ballot_seen\r\n {\r\n lemma_LearnerMaxBallotSeenShowsPrimaryReachedState2(b, c, i-1, learner_idx);\r\n lemma_PrimaryHasReachedState2OfBallotMaintainedByOneStep(b, c, i-1, max_ballot_seen);\r\n }\r\n else\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, learner_idx);\r\n lemma_PacketProcessedImpliesPacketSent(b[i-1], b[i], learner_idx, ios, ios[0].r);\r\n lemma_Message2bShowsPrimaryReachedState2(b, c, i-1, ios[0].r);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_ExecutorNextOpToExecuteBallotShowsPrimaryReachedState2(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n executor_idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= executor_idx < |b[i].replicas|\r\n ensures var nextOp := b[i].replicas[executor_idx].replica.executor.next_op_to_execute;\r\n nextOp.OutstandingOpKnown? ==> PrimaryHasReachedState2OfBallot(b[i], nextOp.bal)\r\n decreases i\r\n{\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n var nextOp := b[i-1].replicas[executor_idx].replica.executor.next_op_to_execute;\r\n var nextOp' := b[i].replicas[executor_idx].replica.executor.next_op_to_execute;\r\n\r\n if nextOp' == nextOp\r\n {\r\n lemma_ExecutorNextOpToExecuteBallotShowsPrimaryReachedState2(b, c, i-1, executor_idx);\r\n if nextOp.OutstandingOpKnown?\r\n {\r\n lemma_PrimaryHasReachedState2OfBallotMaintainedByOneStep(b, c, i-1, nextOp.bal);\r\n }\r\n }\r\n else\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, executor_idx);\r\n lemma_LearnerMaxBallotSeenShowsPrimaryReachedState2(b, c, i-1, executor_idx);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_Received1bPacketsAreFromMaxBallotISent1a(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures var s := b[i].replicas[idx].replica.proposer;\r\n forall p :: p in s.received_1b_packets ==> && p.msg.RslMessage_1b?\r\n && p.msg.bal_1b == s.max_ballot_i_sent_1a\r\n && p.src in c.config.replica_ids\r\n && p in b[i].environment.sentPackets\r\n ensures var s := b[i].replicas[idx].replica.proposer;\r\n forall p1, p2 :: p1 in s.received_1b_packets && p2 in s.received_1b_packets ==> p1 == p2 || p1.src != p2.src\r\n{\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_Received1bPacketsAreFromMaxBallotISent1a(b, c, i-1, idx);\r\n var s := b[i-1].replicas[idx].replica.proposer;\r\n var s' := b[i].replicas[idx].replica.proposer;\r\n forall p | p in s'.received_1b_packets\r\n ensures p.msg.RslMessage_1b?\r\n ensures p.msg.bal_1b == s.max_ballot_i_sent_1a\r\n ensures p in b[i].environment.sentPackets\r\n {\r\n if p !in s.received_1b_packets\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n lemma_PacketProcessedImpliesPacketSent(b[i-1], b[i], idx, ios, p);\r\n }\r\n }\r\n forall p1, p2 | p1 in s'.received_1b_packets && p2 in s'.received_1b_packets\r\n ensures p1 == p2 || p1.src != p2.src\r\n {\r\n if p1 !in s.received_1b_packets || p2 !in s.received_1b_packets\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n }\r\n }\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/Message1b.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"Actions.i.dfy\"\r\ninclude \"PacketSending.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"Message2b.i.dfy\"\r\ninclude \"MaxBallot.i.dfy\"\r\n\r\nmodule CommonProof__Message1b_i {\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Types_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened CommonProof__Environment_i\r\nimport opened CommonProof__Message2b_i\r\nimport opened CommonProof__MaxBallot_i\r\nimport opened Environment_s\r\nimport opened Temporal__Temporal_s\r\n\r\nlemma lemma_1bMessageImplicationsForAcceptorState(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n opn:OperationNumber,\r\n p:RslPacket\r\n ) returns (\r\n acceptor_idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in c.config.replica_ids\r\n requires p.msg.RslMessage_1b?\r\n ensures 0 <= acceptor_idx < |c.config.replica_ids|\r\n ensures 0 <= acceptor_idx < |b[i].replicas|\r\n ensures p.src == c.config.replica_ids[acceptor_idx]\r\n ensures BalLeq(p.msg.bal_1b, b[i].replicas[acceptor_idx].replica.acceptor.max_bal)\r\n ensures var s := b[i].replicas[acceptor_idx].replica.acceptor;\r\n opn in p.msg.votes && opn >= s.log_truncation_point ==>\r\n && opn in s.votes\r\n && (|| BalLeq(p.msg.bal_1b, s.votes[opn].max_value_bal)\r\n || s.votes[opn] == Vote(p.msg.votes[opn].max_value_bal, p.msg.votes[opn].max_val))\r\n ensures var s := b[i].replicas[acceptor_idx].replica.acceptor;\r\n opn !in p.msg.votes && opn >= s.log_truncation_point ==>\r\n || opn !in s.votes\r\n || (opn in s.votes && BalLeq(p.msg.bal_1b, s.votes[opn].max_value_bal));\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n acceptor_idx := lemma_1bMessageImplicationsForAcceptorState(b, c, i-1, opn, p);\r\n var s := b[i-1].replicas[acceptor_idx].replica.acceptor;\r\n var s' := b[i].replicas[acceptor_idx].replica.acceptor;\r\n\r\n if opn < s'.log_truncation_point\r\n {\r\n return;\r\n }\r\n if s'.log_truncation_point == s.log_truncation_point && s'.votes == s.votes\r\n {\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, acceptor_idx);\r\n assert opn >= s'.log_truncation_point >= s.log_truncation_point;\r\n if opn in p.msg.votes\r\n {\r\n lemma_CurrentVoteDoesNotExceedMaxBal(b, c, i-1, opn, acceptor_idx);\r\n\r\n if s'.votes[opn].max_value_bal == s.votes[opn].max_value_bal\r\n {\r\n lemma_ActionThatOverwritesVoteWithSameBallotDoesntChangeValue(b, c, i-1, opn, s.votes[opn].max_value_bal, acceptor_idx);\r\n }\r\n }\r\n return;\r\n }\r\n\r\n var ios:seq;\r\n acceptor_idx, ios := lemma_ActionThatSends1bIsProcess1a(b[i-1], b[i], p);\r\n\r\n var s := b[i-1].replicas[acceptor_idx].replica.acceptor;\r\n var s' := b[i].replicas[acceptor_idx].replica.acceptor;\r\n if opn in s.votes && opn in s'.votes && s'.votes[opn].max_value_bal == s.votes[opn].max_value_bal\r\n {\r\n lemma_ActionThatOverwritesVoteWithSameBallotDoesntChangeValue(b, c, i-1, opn, s.votes[opn].max_value_bal, acceptor_idx);\r\n }\r\n}\r\n\r\nlemma lemma_1bMessageWithoutOpnImplicationsFor2b(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n opn:OperationNumber,\r\n p_1b:RslPacket,\r\n p_2b:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p_1b in b[i].environment.sentPackets\r\n requires p_2b in b[i].environment.sentPackets\r\n requires p_1b.src in c.config.replica_ids\r\n requires p_1b.src == p_2b.src\r\n requires p_1b.msg.RslMessage_1b?\r\n requires p_2b.msg.RslMessage_2b?\r\n requires opn !in p_1b.msg.votes\r\n requires opn >= p_1b.msg.log_truncation_point\r\n requires p_2b.msg.opn_2b == opn\r\n ensures BalLeq(p_1b.msg.bal_1b, p_2b.msg.bal_2b)\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n\r\n if p_1b in b[i-1].environment.sentPackets\r\n {\r\n if p_2b in b[i-1].environment.sentPackets\r\n {\r\n lemma_1bMessageWithoutOpnImplicationsFor2b(b, c, i-1, opn, p_1b, p_2b);\r\n }\r\n else\r\n {\r\n var acceptor_idx := lemma_1bMessageImplicationsForAcceptorState(b, c, i-1, opn, p_1b);\r\n var acceptor_idx_alt, ios := lemma_ActionThatSends2bIsProcess2a(b[i-1], b[i], p_2b);\r\n assert ReplicasDistinct(c.config.replica_ids, acceptor_idx, acceptor_idx_alt);\r\n }\r\n }\r\n else\r\n {\r\n if p_2b in b[i-1].environment.sentPackets\r\n {\r\n var acceptor_idx := lemma_2bMessageImplicationsForAcceptorState(b, c, i-1, p_2b);\r\n var acceptor_idx_alt, ios := lemma_ActionThatSends1bIsProcess1a(b[i-1], b[i], p_1b);\r\n assert ReplicasDistinct(c.config.replica_ids, acceptor_idx, acceptor_idx_alt);\r\n }\r\n else\r\n {\r\n var acceptor_idx, ios := lemma_ActionThatSends1bIsProcess1a(b[i-1], b[i], p_1b);\r\n assert LIoOpSend(p_1b) in ios;\r\n assert false;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_1bMessageWithOpnImplicationsFor2b(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n opn:OperationNumber,\r\n p_1b:RslPacket,\r\n p_2b:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p_1b in b[i].environment.sentPackets\r\n requires p_2b in b[i].environment.sentPackets\r\n requires p_1b.src in c.config.replica_ids\r\n requires p_1b.src == p_2b.src\r\n requires p_1b.msg.RslMessage_1b?\r\n requires p_2b.msg.RslMessage_2b?\r\n requires opn in p_1b.msg.votes\r\n requires opn >= p_1b.msg.log_truncation_point\r\n requires p_2b.msg.opn_2b == opn\r\n ensures || BalLeq(p_1b.msg.bal_1b, p_2b.msg.bal_2b)\r\n || (p_2b.msg.bal_2b == p_1b.msg.votes[opn].max_value_bal && p_2b.msg.val_2b == p_1b.msg.votes[opn].max_val)\r\n || BalLt(p_2b.msg.bal_2b, p_1b.msg.votes[opn].max_value_bal)\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n\r\n if p_1b in b[i-1].environment.sentPackets\r\n {\r\n if p_2b in b[i-1].environment.sentPackets\r\n {\r\n lemma_1bMessageWithOpnImplicationsFor2b(b, c, i-1, opn, p_1b, p_2b);\r\n }\r\n else\r\n {\r\n var acceptor_idx := lemma_1bMessageImplicationsForAcceptorState(b, c, i-1, opn, p_1b);\r\n var acceptor_idx_alt, ios := lemma_ActionThatSends2bIsProcess2a(b[i-1], b[i], p_2b);\r\n assert ReplicasDistinct(c.config.replica_ids, acceptor_idx, acceptor_idx_alt);\r\n }\r\n }\r\n else\r\n {\r\n if p_2b in b[i-1].environment.sentPackets\r\n {\r\n var acceptor_idx := lemma_2bMessageImplicationsForAcceptorState(b, c, i-1, p_2b);\r\n var acceptor_idx_alt, ios := lemma_ActionThatSends1bIsProcess1a(b[i-1], b[i], p_1b);\r\n assert ReplicasDistinct(c.config.replica_ids, acceptor_idx, acceptor_idx_alt);\r\n }\r\n else\r\n {\r\n var acceptor_idx, ios := lemma_ActionThatSends1bIsProcess1a(b[i-1], b[i], p_1b);\r\n assert LIoOpSend(p_1b) in ios;\r\n assert false;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_Vote1bMessageIsFromEarlierBallot(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n opn:OperationNumber,\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in c.config.replica_ids\r\n requires p.msg.RslMessage_1b?\r\n requires opn in p.msg.votes\r\n ensures BalLt(p.msg.votes[opn].max_value_bal, p.msg.bal_1b)\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n lemma_Vote1bMessageIsFromEarlierBallot(b, c, i-1, opn, p);\r\n return;\r\n }\r\n\r\n var idx, ios := lemma_ActionThatSends1bIsProcess1a(b[i-1], b[i], p);\r\n lemma_VotePrecedesMaxBal(b, c, i-1, idx, opn);\r\n}\r\n\r\nlemma lemma_1bMessageWithOpnImplies2aSent(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n opn:OperationNumber,\r\n p_1b:RslPacket\r\n ) returns (\r\n p_2a:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p_1b in b[i].environment.sentPackets\r\n requires p_1b.src in c.config.replica_ids\r\n requires p_1b.msg.RslMessage_1b?\r\n requires opn in p_1b.msg.votes\r\n ensures p_2a in b[i].environment.sentPackets\r\n ensures p_2a.src in c.config.replica_ids\r\n ensures p_2a.msg.RslMessage_2a?\r\n ensures p_2a.msg.opn_2a == opn\r\n ensures p_2a.msg.bal_2a == p_1b.msg.votes[opn].max_value_bal\r\n ensures p_2a.msg.val_2a == p_1b.msg.votes[opn].max_val\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n\r\n if p_1b in b[i-1].environment.sentPackets\r\n {\r\n p_2a := lemma_1bMessageWithOpnImplies2aSent(b, c, i-1, opn, p_1b);\r\n return;\r\n }\r\n\r\n var idx, ios := lemma_ActionThatSends1bIsProcess1a(b[i-1], b[i], p_1b);\r\n p_2a := lemma_VoteWithOpnImplies2aSent(b, c, i-1, idx, opn);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/Message2a.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"Actions.i.dfy\"\r\ninclude \"PacketSending.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"MaxBallotISent1a.i.dfy\"\r\ninclude \"Received1b.i.dfy\"\r\n\r\nmodule CommonProof__Message2a_i {\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Types_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened CommonProof__Environment_i\r\nimport opened CommonProof__MaxBallotISent1a_i\r\nimport opened CommonProof__Received1b_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Environment_s\r\n\r\nlemma lemma_2aMessageImplicationsForProposerState(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p:RslPacket\r\n ) returns (\r\n proposer_idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in c.config.replica_ids\r\n requires p.msg.RslMessage_2a?\r\n ensures 0 <= proposer_idx < |c.config.replica_ids|\r\n ensures 0 <= proposer_idx < |b[i].replicas|\r\n ensures p.src == c.config.replica_ids[proposer_idx]\r\n ensures p.msg.bal_2a.proposer_id == proposer_idx\r\n ensures var s := b[i].replicas[proposer_idx].replica.proposer;\r\n || BalLt(p.msg.bal_2a, s.max_ballot_i_sent_1a)\r\n || (&& s.max_ballot_i_sent_1a == p.msg.bal_2a\r\n && s.current_state != 1\r\n && s.next_operation_number_to_propose > p.msg.opn_2a)\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n proposer_idx := lemma_2aMessageImplicationsForProposerState(b, c, i-1, p);\r\n var s := b[i-1].replicas[proposer_idx].replica.proposer;\r\n var s' := b[i].replicas[proposer_idx].replica.proposer;\r\n if s' != s\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, proposer_idx);\r\n }\r\n return;\r\n }\r\n\r\n var ios:seq;\r\n proposer_idx, ios := lemma_ActionThatSends2aIsMaybeNominateValueAndSend2a(b[i-1], b[i], p);\r\n lemma_MaxBallotISent1aHasMeAsProposer(b, c, i-1, proposer_idx);\r\n}\r\n\r\nlemma lemma_2aMessagesFromSameBallotAndOperationMatchWithoutLossOfGenerality(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p1:RslPacket,\r\n p2:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 < i\r\n requires p1 in b[i].environment.sentPackets\r\n requires p2 in b[i].environment.sentPackets\r\n requires p1.src in c.config.replica_ids\r\n requires p2.src in c.config.replica_ids\r\n requires p1.msg.RslMessage_2a?\r\n requires p2.msg.RslMessage_2a?\r\n requires p1.msg.opn_2a == p2.msg.opn_2a\r\n requires p1.msg.bal_2a == p2.msg.bal_2a\r\n requires p2 in b[i-1].environment.sentPackets ==> p1 in b[i-1].environment.sentPackets\r\n ensures p1.msg.val_2a == p2.msg.val_2a\r\n decreases 2 * i\r\n{\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n\r\n if p2 in b[i-1].environment.sentPackets\r\n {\r\n // Both packets had already been sent by i-1, so we induction.\r\n lemma_2aMessagesFromSameBallotAndOperationMatch(b, c, i-1, p1, p2);\r\n return;\r\n }\r\n\r\n var proposer_idx, ios := lemma_ActionThatSends2aIsMaybeNominateValueAndSend2a(b[i-1], b[i], p2);\r\n\r\n if p1 !in b[i-1].environment.sentPackets\r\n {\r\n // Both packets were sent in step i-1, so observe that any two packets sent in the same step\r\n // have the same value.\r\n assert LIoOpSend(p1) in ios;\r\n assert LIoOpSend(p2) in ios;\r\n return;\r\n }\r\n\r\n // Note the implications on processor state for p1, since once p1 is sent we\r\n // won't be able to send p2.\r\n var alt_proposer_idx := lemma_2aMessageImplicationsForProposerState(b, c, i-1, p1);\r\n\r\n // Note the implications on processor state for p2, just to notice that they\r\n // use the same replica index.\r\n var alt2_proposer_idx := lemma_2aMessageImplicationsForProposerState(b, c, i, p2);\r\n assert alt_proposer_idx == alt2_proposer_idx;\r\n assert ReplicasDistinct(c.config.replica_ids, proposer_idx, alt_proposer_idx);\r\n assert proposer_idx == alt_proposer_idx;\r\n assert false;\r\n}\r\n\r\nlemma lemma_2aMessagesFromSameBallotAndOperationMatch(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p1:RslPacket,\r\n p2:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p1 in b[i].environment.sentPackets\r\n requires p2 in b[i].environment.sentPackets\r\n requires p1.src in c.config.replica_ids\r\n requires p2.src in c.config.replica_ids\r\n requires p1.msg.RslMessage_2a?\r\n requires p2.msg.RslMessage_2a?\r\n requires p1.msg.opn_2a == p2.msg.opn_2a\r\n requires p1.msg.bal_2a == p2.msg.bal_2a\r\n ensures p1.msg.val_2a == p2.msg.val_2a\r\n decreases 2 * i + 1\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n if p2 in b[i-1].environment.sentPackets && p1 !in b[i-1].environment.sentPackets\r\n {\r\n lemma_2aMessagesFromSameBallotAndOperationMatchWithoutLossOfGenerality(b, c, i, p2, p1);\r\n }\r\n else\r\n {\r\n lemma_2aMessagesFromSameBallotAndOperationMatchWithoutLossOfGenerality(b, c, i, p1, p2);\r\n }\r\n}\r\n\r\nlemma lemma_2aMessageHas1bQuorumPermittingIt(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p:RslPacket\r\n ) returns (\r\n q:set\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in c.config.replica_ids\r\n requires p.msg.RslMessage_2a?\r\n ensures q <= b[i].environment.sentPackets\r\n ensures |q| >= LMinQuorumSize(c.config)\r\n ensures LIsAfterLogTruncationPoint(p.msg.opn_2a, q)\r\n ensures LSetOfMessage1bAboutBallot(q, p.msg.bal_2a)\r\n ensures LAllAcceptorsHadNoProposal(q, p.msg.opn_2a) || LValIsHighestNumberedProposal(p.msg.val_2a, q, p.msg.opn_2a)\r\n ensures forall p1, p2 :: p1 in q && p2 in q && p1 != p2 ==> p1.src != p2.src\r\n ensures forall p1 :: p1 in q ==> p1.src in c.config.replica_ids\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n q := lemma_2aMessageHas1bQuorumPermittingIt(b, c, i-1, p);\r\n lemma_PacketSetStaysInSentPackets(b, c, i-1, i, q);\r\n return;\r\n }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n var idx, ios := lemma_ActionThatSends2aIsMaybeNominateValueAndSend2a(b[i-1], b[i], p);\r\n q := b[i-1].replicas[idx].replica.proposer.received_1b_packets;\r\n\r\n forall p_1b | p_1b in q\r\n ensures p_1b in b[i].environment.sentPackets\r\n {\r\n lemma_PacketInReceived1bWasSent(b, c, i-1, idx, p_1b);\r\n lemma_PacketStaysInSentPackets(b, c, i-1, i, p_1b);\r\n }\r\n\r\n lemma_Received1bPacketsAreFromMaxBallotISent1a(b, c, i-1, idx);\r\n}\r\n\r\nlemma lemma_Find2aThatCausedVote(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int,\r\n opn:OperationNumber\r\n ) returns (\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires opn in b[i].replicas[idx].replica.acceptor.votes\r\n ensures p in b[i].environment.sentPackets\r\n ensures p.src in c.config.replica_ids\r\n ensures p.msg.RslMessage_2a?\r\n ensures p.msg.opn_2a == opn\r\n ensures p.msg.val_2a == b[i].replicas[idx].replica.acceptor.votes[opn].max_val\r\n ensures p.msg.bal_2a == b[i].replicas[idx].replica.acceptor.votes[opn].max_value_bal\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_ReplicaConstantsAllConsistent(b, c, i, idx);\r\n lemma_ReplicaConstantsAllConsistent(b, c, i-1, idx);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n var s := b[i-1].replicas[idx].replica.acceptor;\r\n var s' := b[i].replicas[idx].replica.acceptor;\r\n\r\n if opn in s.votes && s'.votes[opn] == s.votes[opn]\r\n {\r\n p := lemma_Find2aThatCausedVote(b, c, i-1, idx, opn);\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n p := ios[0].r;\r\n}\r\n\r\nlemma lemma_2aMessageHasValidBallot(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in c.config.replica_ids\r\n requires p.msg.RslMessage_2a?\r\n ensures p.msg.bal_2a.seqno >= 0\r\n ensures 0 <= p.msg.bal_2a.proposer_id < |c.config.replica_ids|\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n lemma_2aMessageHasValidBallot(b, c, i-1, p);\r\n return;\r\n }\r\n\r\n var idx, ios := lemma_ActionThatSends2aIsMaybeNominateValueAndSend2a(b[i-1], b[i], p);\r\n lemma_MaxBallotISent1aHasMeAsProposer(b, c, i-1, idx);\r\n}\r\n \r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/Message2b.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"Actions.i.dfy\"\r\ninclude \"PacketSending.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"Message2a.i.dfy\"\r\n\r\nmodule CommonProof__Message2b_i {\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Types_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened CommonProof__Environment_i\r\nimport opened CommonProof__Message2a_i\r\nimport opened Temporal__Temporal_s\r\n\r\nlemma lemma_2bMessageHasCorresponding2aMessage(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p_2b:RslPacket\r\n ) returns (\r\n p_2a:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p_2b in b[i].environment.sentPackets\r\n requires p_2b.src in c.config.replica_ids\r\n requires p_2b.msg.RslMessage_2b?\r\n ensures p_2a in b[i].environment.sentPackets\r\n ensures p_2a.src in c.config.replica_ids\r\n ensures p_2a.msg.RslMessage_2a?\r\n ensures p_2a.msg.opn_2a == p_2b.msg.opn_2b\r\n ensures p_2a.msg.bal_2a == p_2b.msg.bal_2b\r\n ensures p_2a.msg.val_2a == p_2b.msg.val_2b\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n if p_2b in b[i-1].environment.sentPackets\r\n {\r\n p_2a := lemma_2bMessageHasCorresponding2aMessage(b, c, i-1, p_2b);\r\n lemma_PacketStaysInSentPackets(b, c, i-1, i, p_2a);\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n\r\n var proposer_idx, ios := lemma_ActionThatSends2bIsProcess2a(b[i-1], b[i], p_2b);\r\n p_2a := ios[0].r;\r\n}\r\n\r\nlemma lemma_CurrentVoteDoesNotExceedMaxBal(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n opn:OperationNumber,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires opn in b[i].replicas[idx].replica.acceptor.votes\r\n ensures BalLeq(b[i].replicas[idx].replica.acceptor.votes[opn].max_value_bal, b[i].replicas[idx].replica.acceptor.max_bal)\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n \r\n lemma_ReplicaConstantsAllConsistent(b, c, i, idx);\r\n lemma_ReplicaConstantsAllConsistent(b, c, i-1, idx);\r\n\r\n var s := b[i-1].replicas[idx].replica.acceptor;\r\n var s' := b[i].replicas[idx].replica.acceptor;\r\n if s'.votes == s.votes && s'.max_bal == s.max_bal\r\n {\r\n lemma_CurrentVoteDoesNotExceedMaxBal(b, c, i-1, opn, idx);\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n if opn in s.votes\r\n {\r\n lemma_CurrentVoteDoesNotExceedMaxBal(b, c, i-1, opn, idx);\r\n }\r\n}\r\n\r\nlemma lemma_ActionThatOverwritesVoteWithSameBallotDoesntChangeValue(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n opn:OperationNumber,\r\n bal:Ballot,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires 0 <= idx < |b[i+1].replicas|\r\n requires opn in b[i].replicas[idx].replica.acceptor.votes\r\n requires opn in b[i+1].replicas[idx].replica.acceptor.votes\r\n requires b[i].replicas[idx].replica.acceptor.votes[opn].max_value_bal == b[i+1].replicas[idx].replica.acceptor.votes[opn].max_value_bal\r\n ensures b[i].replicas[idx].replica.acceptor.votes[opn].max_val == b[i+1].replicas[idx].replica.acceptor.votes[opn].max_val\r\n{\r\n lemma_ReplicaConstantsAllConsistent(b, c, i, idx);\r\n lemma_ReplicaConstantsAllConsistent(b, c, i+1, idx);\r\n lemma_AssumptionsMakeValidTransition(b, c, i);\r\n \r\n var s := b[i].replicas[idx].replica.acceptor;\r\n var s' := b[i+1].replicas[idx].replica.acceptor;\r\n\r\n if s'.votes[opn].max_val != s.votes[opn].max_val\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i, idx);\r\n var earlier_2a := lemma_Find2aThatCausedVote(b, c, i, idx, opn);\r\n lemma_2aMessagesFromSameBallotAndOperationMatch(b, c, i+1, earlier_2a, ios[0].r);\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_2bMessageImplicationsForAcceptorState(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p:RslPacket\r\n ) returns (\r\n acceptor_idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in c.config.replica_ids\r\n requires p.msg.RslMessage_2b?\r\n ensures 0 <= acceptor_idx < |c.config.replica_ids|\r\n ensures 0 <= acceptor_idx < |b[i].replicas|\r\n ensures p.src == c.config.replica_ids[acceptor_idx]\r\n ensures BalLeq(p.msg.bal_2b, b[i].replicas[acceptor_idx].replica.acceptor.max_bal)\r\n ensures var s := b[i].replicas[acceptor_idx].replica.acceptor;\r\n p.msg.opn_2b >= s.log_truncation_point ==>\r\n && p.msg.opn_2b in s.votes\r\n && BalLeq(p.msg.bal_2b, s.votes[p.msg.opn_2b].max_value_bal)\r\n && (s.votes[p.msg.opn_2b].max_value_bal == p.msg.bal_2b ==> s.votes[p.msg.opn_2b].max_val == p.msg.val_2b)\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n\r\n var v := p.msg.val_2b;\r\n var opn := p.msg.opn_2b;\r\n var bal := p.msg.bal_2b;\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n acceptor_idx := lemma_2bMessageImplicationsForAcceptorState(b, c, i-1, p);\r\n var s := b[i-1].replicas[acceptor_idx].replica.acceptor;\r\n var s' := b[i].replicas[acceptor_idx].replica.acceptor;\r\n if s' != s\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, acceptor_idx);\r\n if opn >= s'.log_truncation_point\r\n {\r\n lemma_CurrentVoteDoesNotExceedMaxBal(b, c, i-1, opn, acceptor_idx);\r\n if s'.votes[opn].max_value_bal == s.votes[opn].max_value_bal\r\n {\r\n lemma_ActionThatOverwritesVoteWithSameBallotDoesntChangeValue(b, c, i-1, opn, bal, acceptor_idx);\r\n }\r\n }\r\n }\r\n return;\r\n }\r\n\r\n var ios:seq;\r\n acceptor_idx, ios := lemma_ActionThatSends2bIsProcess2a(b[i-1], b[i], p);\r\n}\r\n\r\nlemma lemma_VoteWithOpnImplies2aSent(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int,\r\n opn:OperationNumber\r\n ) returns (\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires opn in b[i].replicas[idx].replica.acceptor.votes\r\n ensures p in b[i].environment.sentPackets\r\n ensures p.src in c.config.replica_ids\r\n ensures p.msg.RslMessage_2a?\r\n ensures p.msg.opn_2a == opn\r\n ensures p.msg.bal_2a == b[i].replicas[idx].replica.acceptor.votes[opn].max_value_bal\r\n ensures p.msg.val_2a == b[i].replicas[idx].replica.acceptor.votes[opn].max_val\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n\r\n var s := b[i-1].replicas[idx].replica.acceptor;\r\n var s' := b[i].replicas[idx].replica.acceptor;\r\n\r\n if s'.votes == s.votes\r\n {\r\n p := lemma_VoteWithOpnImplies2aSent(b, c, i-1, idx, opn);\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n if opn in s.votes && s'.votes[opn] == s.votes[opn]\r\n {\r\n p := lemma_VoteWithOpnImplies2aSent(b, c, i-1, idx, opn);\r\n return;\r\n }\r\n\r\n p := ios[0].r;\r\n}\r\n \r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/PacketSending.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\n\r\nmodule CommonProof__PacketSending_i {\r\n\r\nimport opened LiveRSL__Acceptor_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened Environment_s\r\n\r\nlemma lemma_ActionThatSendsPacketIsActionOfSource(\r\n ps:RslState,\r\n ps':RslState,\r\n p:RslPacket\r\n ) returns (\r\n idx:int,\r\n ios:seq\r\n )\r\n requires p.src in ps.constants.config.replica_ids\r\n requires p in ps'.environment.sentPackets\r\n requires p !in ps.environment.sentPackets\r\n requires RslNext(ps, ps')\r\n ensures 0 <= idx < |ps.constants.config.replica_ids|\r\n ensures 0 <= idx < |ps'.constants.config.replica_ids|\r\n ensures p.src == ps.constants.config.replica_ids[idx]\r\n ensures RslNextOneReplica(ps, ps', idx, ios)\r\n ensures LIoOpSend(p) in ios\r\n{\r\n assert ps.environment.nextStep.LEnvStepHostIos?;\r\n assert LIoOpSend(p) in ps.environment.nextStep.ios;\r\n idx, ios :| RslNextOneReplica(ps, ps', idx, ios) && LIoOpSend(p) in ios;\r\n}\r\n\r\nlemma lemma_ActionThatSends1aIsMaybeEnterNewViewAndSend1a(\r\n ps:RslState,\r\n ps':RslState,\r\n p:RslPacket\r\n ) returns (\r\n idx:int,\r\n ios:seq\r\n )\r\n requires p.src in ps.constants.config.replica_ids\r\n requires p.msg.RslMessage_1a?\r\n requires p in ps'.environment.sentPackets\r\n requires p !in ps.environment.sentPackets\r\n requires RslNext(ps, ps')\r\n ensures 0 <= idx < |ps.constants.config.replica_ids|\r\n ensures 0 <= idx < |ps'.constants.config.replica_ids|\r\n ensures p.src == ps.constants.config.replica_ids[idx]\r\n ensures RslNextOneReplica(ps, ps', idx, ios)\r\n ensures LIoOpSend(p) in ios\r\n ensures LReplicaNextSpontaneousMaybeEnterNewViewAndSend1a(ps.replicas[idx].replica, ps'.replicas[idx].replica,\r\n ExtractSentPacketsFromIos(ios))\r\n{\r\n assert ps.environment.nextStep.LEnvStepHostIos?;\r\n assert LIoOpSend(p) in ps.environment.nextStep.ios;\r\n idx, ios :| RslNextOneReplica(ps, ps', idx, ios) && LIoOpSend(p) in ios;\r\n var nextActionIndex := ps.replicas[idx].nextActionIndex;\r\n if nextActionIndex != 1\r\n {\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_ActionThatSends1bIsProcess1a(\r\n ps:RslState,\r\n ps':RslState,\r\n p:RslPacket\r\n ) returns (\r\n idx:int,\r\n ios:seq\r\n )\r\n requires p.src in ps.constants.config.replica_ids\r\n requires p.msg.RslMessage_1b?\r\n requires p in ps'.environment.sentPackets\r\n requires p !in ps.environment.sentPackets\r\n requires RslNext(ps, ps')\r\n ensures 0 <= idx < |ps.constants.config.replica_ids|\r\n ensures 0 <= idx < |ps'.constants.config.replica_ids|\r\n ensures p.src == ps.constants.config.replica_ids[idx]\r\n ensures RslNextOneReplica(ps, ps', idx, ios)\r\n ensures |ios| > 0\r\n ensures ios[0].LIoOpReceive?\r\n ensures ios[0].r.msg.RslMessage_1a?\r\n ensures LIoOpSend(p) in ios\r\n ensures LReplicaNextProcessPacketWithoutReadingClock(ps.replicas[idx].replica, ps'.replicas[idx].replica, ios)\r\n ensures LAcceptorProcess1a(ps.replicas[idx].replica.acceptor, ps'.replicas[idx].replica.acceptor, ios[0].r, [p])\r\n{\r\n assert ps.environment.nextStep.LEnvStepHostIos?;\r\n assert LIoOpSend(p) in ps.environment.nextStep.ios;\r\n idx, ios :| RslNextOneReplica(ps, ps', idx, ios) && LIoOpSend(p) in ios;\r\n}\r\n\r\nlemma lemma_ActionThatSends2aIsMaybeNominateValueAndSend2a(\r\n ps:RslState,\r\n ps':RslState,\r\n p:RslPacket\r\n ) returns (\r\n idx:int,\r\n ios:seq\r\n )\r\n requires p.src in ps.constants.config.replica_ids\r\n requires p.msg.RslMessage_2a?\r\n requires p in ps'.environment.sentPackets\r\n requires p !in ps.environment.sentPackets\r\n requires RslNext(ps, ps')\r\n ensures 0 <= idx < |ps.constants.config.replica_ids|\r\n ensures 0 <= idx < |ps'.constants.config.replica_ids|\r\n ensures p.src == ps.constants.config.replica_ids[idx]\r\n ensures RslNextOneReplica(ps, ps', idx, ios)\r\n ensures LIoOpSend(p) in ios\r\n ensures SpontaneousIos(ios, 1)\r\n ensures LReplicaNextReadClockMaybeNominateValueAndSend2a(ps.replicas[idx].replica, ps'.replicas[idx].replica,\r\n SpontaneousClock(ios), ExtractSentPacketsFromIos(ios))\r\n{\r\n assert ps.environment.nextStep.LEnvStepHostIos?;\r\n assert LIoOpSend(p) in ps.environment.nextStep.ios;\r\n idx, ios :| RslNextOneReplica(ps, ps', idx, ios) && LIoOpSend(p) in ios;\r\n var nextActionIndex := ps.replicas[idx].nextActionIndex;\r\n if nextActionIndex != 3\r\n {\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_ActionThatSends2bIsProcess2a(\r\n ps:RslState,\r\n ps':RslState,\r\n p:RslPacket\r\n ) returns (\r\n idx:int,\r\n ios:seq\r\n )\r\n requires p.src in ps.constants.config.replica_ids\r\n requires p.msg.RslMessage_2b?\r\n requires p in ps'.environment.sentPackets\r\n requires p !in ps.environment.sentPackets\r\n requires RslNext(ps, ps')\r\n ensures 0 <= idx < |ps.constants.config.replica_ids|\r\n ensures 0 <= idx < |ps'.constants.config.replica_ids|\r\n ensures p.src == ps.constants.config.replica_ids[idx]\r\n ensures RslNextOneReplica(ps, ps', idx, ios)\r\n ensures |ios| > 0\r\n ensures ios[0].LIoOpReceive?\r\n ensures LIoOpSend(p) in ios\r\n ensures LReplicaNextProcess2a(ps.replicas[idx].replica, ps'.replicas[idx].replica, ios[0].r, ExtractSentPacketsFromIos(ios))\r\n{\r\n assert ps.environment.nextStep.LEnvStepHostIos?;\r\n assert LIoOpSend(p) in ps.environment.nextStep.ios;\r\n idx, ios :| RslNextOneReplica(ps, ps', idx, ios) && LIoOpSend(p) in ios;\r\n}\r\n\r\nlemma lemma_ActionThatSendsHeartbeatIsMaybeSendHeartbeat(\r\n ps:RslState,\r\n ps':RslState,\r\n p:RslPacket\r\n ) returns (\r\n idx:int,\r\n ios:seq\r\n )\r\n requires p.src in ps.constants.config.replica_ids\r\n requires p.msg.RslMessage_Heartbeat?\r\n requires p in ps'.environment.sentPackets\r\n requires p !in ps.environment.sentPackets\r\n requires RslNext(ps, ps')\r\n ensures 0 <= idx < |ps.constants.config.replica_ids|\r\n ensures 0 <= idx < |ps'.constants.config.replica_ids|\r\n ensures p.src == ps.constants.config.replica_ids[idx]\r\n ensures RslNextOneReplica(ps, ps', idx, ios)\r\n ensures |ios| > 0\r\n ensures ios[0].LIoOpReadClock?\r\n ensures LIoOpSend(p) in ios\r\n ensures SpontaneousIos(ios, 1)\r\n ensures LReplicaNextReadClockMaybeSendHeartbeat(ps.replicas[idx].replica, ps'.replicas[idx].replica,\r\n SpontaneousClock(ios), ExtractSentPacketsFromIos(ios))\r\n{\r\n assert ps.environment.nextStep.LEnvStepHostIos?;\r\n assert LIoOpSend(p) in ps.environment.nextStep.ios;\r\n idx, ios :| RslNextOneReplica(ps, ps', idx, ios) && LIoOpSend(p) in ios;\r\n}\r\n\r\nlemma lemma_ActionThatSendsAppStateRequestIsProcessStartingPhase2(\r\n ps:RslState,\r\n ps':RslState,\r\n p:RslPacket\r\n ) returns (\r\n idx:int,\r\n ios:seq\r\n )\r\n requires p.src in ps.constants.config.replica_ids\r\n requires p.msg.RslMessage_AppStateRequest?\r\n requires p in ps'.environment.sentPackets\r\n requires p !in ps.environment.sentPackets\r\n requires RslNext(ps, ps')\r\n ensures 0 <= idx < |ps.constants.config.replica_ids|\r\n ensures 0 <= idx < |ps'.constants.config.replica_ids|\r\n ensures p.src == ps.constants.config.replica_ids[idx]\r\n ensures RslNextOneReplica(ps, ps', idx, ios)\r\n ensures |ios| > 0\r\n ensures ios[0].LIoOpReceive?\r\n ensures ios[0].r.msg.RslMessage_StartingPhase2?\r\n ensures LIoOpSend(p) in ios\r\n ensures LReplicaNextProcessPacketWithoutReadingClock(ps.replicas[idx].replica, ps'.replicas[idx].replica, ios)\r\n ensures LExecutorProcessStartingPhase2(ps.replicas[idx].replica.executor, ps'.replicas[idx].replica.executor,\r\n ios[0].r, ExtractSentPacketsFromIos(ios))\r\n{\r\n assert ps.environment.nextStep.LEnvStepHostIos?;\r\n assert LIoOpSend(p) in ps.environment.nextStep.ios;\r\n idx, ios :| RslNextOneReplica(ps, ps', idx, ios) && LIoOpSend(p) in ios;\r\n}\r\n\r\nlemma lemma_ActionThatSendsAppStateSupplyIsProcessAppStateRequest(\r\n ps:RslState,\r\n ps':RslState,\r\n p:RslPacket\r\n ) returns (\r\n idx:int,\r\n ios:seq\r\n )\r\n requires p.src in ps.constants.config.replica_ids\r\n requires p.msg.RslMessage_AppStateSupply?\r\n requires p in ps'.environment.sentPackets\r\n requires p !in ps.environment.sentPackets\r\n requires RslNext(ps, ps')\r\n ensures 0 <= idx < |ps.constants.config.replica_ids|\r\n ensures 0 <= idx < |ps'.constants.config.replica_ids|\r\n ensures p.src == ps.constants.config.replica_ids[idx]\r\n ensures RslNextOneReplica(ps, ps', idx, ios)\r\n ensures |ios| > 0\r\n ensures ios[0].LIoOpReceive?\r\n ensures ios[0].r.msg.RslMessage_AppStateRequest?\r\n ensures LIoOpSend(p) in ios\r\n ensures LReplicaNextProcessPacketWithoutReadingClock(ps.replicas[idx].replica, ps'.replicas[idx].replica, ios)\r\n ensures LExecutorProcessAppStateRequest(ps.replicas[idx].replica.executor, ps'.replicas[idx].replica.executor, ios[0].r, [p])\r\n{\r\n assert ps.environment.nextStep.LEnvStepHostIos?;\r\n assert LIoOpSend(p) in ps.environment.nextStep.ios;\r\n idx, ios :| RslNextOneReplica(ps, ps', idx, ios) && LIoOpSend(p) in ios;\r\n}\r\n\r\nlemma lemma_ActionThatSendsStartingPhase2IsMaybeEnterPhase2(\r\n ps:RslState,\r\n ps':RslState,\r\n p:RslPacket\r\n ) returns (\r\n idx:int,\r\n ios:seq\r\n )\r\n requires p.src in ps.constants.config.replica_ids\r\n requires p.msg.RslMessage_StartingPhase2?\r\n requires p in ps'.environment.sentPackets\r\n requires p !in ps.environment.sentPackets\r\n requires RslNext(ps, ps')\r\n ensures 0 <= idx < |ps.constants.config.replica_ids|\r\n ensures 0 <= idx < |ps'.constants.config.replica_ids|\r\n ensures p.src == ps.constants.config.replica_ids[idx]\r\n ensures RslNextOneReplica(ps, ps', idx, ios)\r\n ensures LIoOpSend(p) in ios\r\n ensures LReplicaNextSpontaneousMaybeEnterPhase2(ps.replicas[idx].replica, ps'.replicas[idx].replica, ExtractSentPacketsFromIos(ios))\r\n{\r\n assert ps.environment.nextStep.LEnvStepHostIos?;\r\n assert LIoOpSend(p) in ps.environment.nextStep.ios;\r\n idx, ios :| RslNextOneReplica(ps, ps', idx, ios) && LIoOpSend(p) in ios;\r\n var nextActionIndex := ps.replicas[idx].nextActionIndex;\r\n if nextActionIndex != 2\r\n {\r\n assert false;\r\n }\r\n}\r\n \r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/Quorum.i.dfy", "content": "include \"../Constants.i.dfy\"\r\ninclude \"../Environment.i.dfy\"\r\n\r\nmodule CommonProof__Quorum_i {\r\n\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Collections__Sets_i\r\n \r\nlemma lemma_SetOfElementsOfRangeNoBiggerThanRange(Q:set, n:int)\r\n requires forall idx :: idx in Q ==> 0 <= idx < n\r\n requires 0 <= n\r\n ensures |Q| <= n\r\n decreases n\r\n{\r\n if n == 0\r\n {\r\n forall idx | idx in Q\r\n ensures false\r\n {\r\n }\r\n assert Q == {};\r\n }\r\n else if n-1 in Q\r\n {\r\n lemma_SetOfElementsOfRangeNoBiggerThanRange(Q - {n-1}, n-1);\r\n }\r\n else\r\n {\r\n lemma_SetOfElementsOfRangeNoBiggerThanRange(Q, n-1);\r\n }\r\n}\r\n\r\nlemma lemma_QuorumIndexOverlap(Q1:set, Q2:set, n:int) returns (common:int)\r\n requires forall idx :: idx in Q1 ==> 0 <= idx < n\r\n requires forall idx :: idx in Q2 ==> 0 <= idx < n\r\n requires |Q1| + |Q2| > n >= 0\r\n ensures common in Q1\r\n ensures common in Q2\r\n ensures 0 <= common < n\r\n{\r\n if Q1 * Q2 == {}\r\n {\r\n lemma_SetOfElementsOfRangeNoBiggerThanRange(Q1 + Q2, n);\r\n assert false;\r\n }\r\n common :| common in Q1*Q2;\r\n}\r\n\r\nlemma lemma_GetIndicesFromNodes(nodes:set, config:LConfiguration) returns (indices:set)\r\n requires WellFormedLConfiguration(config)\r\n requires forall node :: node in nodes ==> node in config.replica_ids\r\n ensures forall idx :: idx in indices ==> 0 <= idx < |config.replica_ids| && config.replica_ids[idx] in nodes\r\n ensures forall node :: node in nodes ==> GetReplicaIndex(node, config) in indices\r\n ensures |indices| == |nodes|\r\n{\r\n indices := set idx | 0 <= idx < |config.replica_ids| && config.replica_ids[idx] in nodes;\r\n // var f := (idx requires 0 <= idx < |config.replica_ids| => config.replica_ids[idx]);\r\n var f := (idx => \r\n if (idx >= 0 && idx < |config.replica_ids|) then\r\n config.replica_ids[idx]\r\n else\r\n var end:NodeIdentity :| (true);end );\r\n forall idx1, idx2 | idx1 in indices && idx2 in indices && f(idx1) in nodes && f(idx2) in nodes && f(idx1) == f(idx2)\r\n ensures idx1 == idx2\r\n {\r\n assert ReplicasDistinct(config.replica_ids, idx1, idx2);\r\n }\r\n forall node | node in nodes\r\n ensures exists idx :: idx in indices && node == f(idx)\r\n {\r\n var idx := GetReplicaIndex(node, config);\r\n assert idx in indices && node == f(idx);\r\n }\r\n lemma_MapSetCardinalityOver(indices, nodes, f);\r\n}\r\n\r\nlemma lemma_GetIndicesFromPackets(packets:set, config:LConfiguration) returns (indices:set)\r\n requires WellFormedLConfiguration(config)\r\n requires forall p :: p in packets ==> p.src in config.replica_ids\r\n requires forall p1, p2 :: p1 in packets && p2 in packets && p1 != p2 ==> p1.src != p2.src\r\n ensures forall idx :: idx in indices ==> 0 <= idx < |config.replica_ids| && exists p :: (p in packets && config.replica_ids[idx] == p.src)\r\n ensures forall p :: p in packets ==> GetReplicaIndex(p.src, config) in indices\r\n ensures |indices| == |packets|\r\n{\r\n var nodes := set p | p in packets :: p.src;\r\n indices := lemma_GetIndicesFromNodes(nodes, config);\r\n lemma_MapSetCardinalityOver(packets, nodes, ((x:RslPacket)=>x.src));\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/Received1b.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Actions.i.dfy\"\r\ninclude \"PacketSending.i.dfy\"\r\n\r\nmodule CommonProof__Received1b_i {\r\n\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened Temporal__Temporal_s\r\n\r\nlemma lemma_PacketInReceived1bWasSent(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n replica_idx:int,\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= replica_idx < |b[i].replicas|\r\n requires p in b[i].replicas[replica_idx].replica.proposer.received_1b_packets\r\n ensures p in b[i].environment.sentPackets\r\n ensures p.src in c.config.replica_ids\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n var s := b[i-1].replicas[replica_idx].replica.proposer;\r\n var s' := b[i].replicas[replica_idx].replica.proposer;\r\n\r\n if p in s.received_1b_packets\r\n {\r\n lemma_PacketInReceived1bWasSent(b, c, i-1, replica_idx, p);\r\n assert p in b[i].environment.sentPackets;\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, replica_idx);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/ReplyCache.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Actions.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"PacketSending.i.dfy\"\r\n\r\n/////////////////////\r\n// INVARIANTS\r\n/////////////////////\r\n\r\nmodule CommonProof__ReplyCache_i {\r\n\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Environment_s\r\n\r\npredicate ReplyCacheObjectInv(cache:ReplyCache, client:NodeIdentity)\r\n{\r\n client in cache ==> cache[client].Reply? && cache[client].client == client\r\n}\r\n\r\npredicate ReplyCacheStateInv(ps:RslState, client:NodeIdentity)\r\n{\r\n forall idx :: 0 <= idx < |ps.replicas| ==> ReplyCacheObjectInv(ps.replicas[idx].replica.executor.reply_cache, client)\r\n}\r\n\r\nlemma lemma_ReplyCacheStateInv(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n client:NodeIdentity\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n ensures ReplyCacheStateInv(b[i], client)\r\n{\r\n if i > 0\r\n {\r\n lemma_ReplyCacheStateInv(b, c, i-1, client);\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n var ps := b[i-1];\r\n var ps' := b[i];\r\n assert RslNext(ps, ps');\r\n forall idx | 0 <= idx < |ps'.replicas|\r\n ensures ReplyCacheObjectInv(ps'.replicas[idx].replica.executor.reply_cache, client)\r\n {\r\n lemma_ReplicasSize(b, c, i-1);\r\n lemma_ReplicasSize(b, c, i);\r\n\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var cache := s.executor.reply_cache;\r\n var cache' := s'.executor.reply_cache;\r\n\r\n if cache' == cache\r\n {\r\n assert ReplyCacheObjectInv(cache', client);\r\n }\r\n else\r\n {\r\n var ios :| RslNextOneReplica(ps, ps', idx, ios);\r\n assert ReplyCacheObjectInv(cache', client);\r\n }\r\n }\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/CommonProof/Requests.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"../CommonProof/Assumptions.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../CommonProof/Environment.i.dfy\"\r\ninclude \"../CommonProof/PacketSending.i.dfy\"\r\ninclude \"../CommonProof/Chosen.i.dfy\"\r\n\r\nmodule CommonProof__Requests_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Election_i\r\nimport opened LiveRSL__Types_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Environment_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened CommonProof__Chosen_i\r\n\r\nlemma lemma_RemoveAllSatisfiedRequestsInSequenceProducesSubsequence(s':seq, s:seq, r:Request)\r\n requires s' == RemoveAllSatisfiedRequestsInSequence(s, r)\r\n ensures forall x :: x in s' ==> x in s\r\n decreases s, 1\r\n{\r\n if |s| > 0 && !RequestsMatch(s[0], r)\r\n {\r\n lemma_RemoveAllSatisfiedRequestsInSequenceProducesSubsequence(RemoveAllSatisfiedRequestsInSequence(s[1..], r), s[1..], r);\r\n }\r\n}\r\n\r\nlemma lemma_RemoveExecutedRequestBatchProducesSubsequence(s':seq, s:seq, batch:RequestBatch)\r\n requires s' == RemoveExecutedRequestBatch(s, batch)\r\n ensures forall x :: x in s' ==> x in s\r\n decreases |batch|\r\n{\r\n if |batch| > 0\r\n {\r\n var s'' := RemoveAllSatisfiedRequestsInSequence(s, batch[0]);\r\n lemma_RemoveAllSatisfiedRequestsInSequenceProducesSubsequence(s'', s, batch[0]);\r\n lemma_RemoveExecutedRequestBatchProducesSubsequence(s', s'', batch[1..]);\r\n }\r\n}\r\n \r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/Configuration.i.dfy", "content": "include \"Types.i.dfy\"\r\ninclude \"../../Common/Collections/Sets.i.dfy\"\r\ninclude \"../../Common/Collections/Seqs.i.dfy\"\r\n\r\nmodule LiveRSL__Configuration_i {\r\nimport opened LiveRSL__Types_i\r\nimport opened Collections__Sets_i\r\nimport opened Collections__Seqs_i\r\nimport opened Concrete_NodeIdentity_i\r\n\r\ndatatype LConfiguration = LConfiguration(\r\n clientIds:set,\r\n replica_ids:seq\r\n )\r\n\r\n// Jay suggests using a less-general notion of quorum.\r\nfunction LMinQuorumSize(c:LConfiguration) : int\r\n{\r\n |c.replica_ids|/2+1\r\n}\r\n\r\npredicate ReplicasDistinct(replica_ids:seq, i:int, j:int)\r\n{\r\n 0 <= i < |replica_ids| && 0 <= j < |replica_ids| && replica_ids[i] == replica_ids[j] ==> i == j\r\n}\r\n\r\npredicate WellFormedLConfiguration(c:LConfiguration)\r\n{\r\n && 0 < |c.replica_ids|\r\n && (forall i, j :: ReplicasDistinct(c.replica_ids, i, j))\r\n}\r\n\r\npredicate IsReplicaIndex(idx:int, id:NodeIdentity, c:LConfiguration)\r\n{\r\n && 0 <= idx < |c.replica_ids|\r\n && c.replica_ids[idx] == id\r\n}\r\n\r\nfunction GetReplicaIndex(id:NodeIdentity, c:LConfiguration):int\r\n requires id in c.replica_ids\r\n ensures var idx := GetReplicaIndex(id, c);\r\n 0 <= idx < |c.replica_ids| && c.replica_ids[idx] == id\r\n{\r\n FindIndexInSeq(c.replica_ids, id)\r\n}\r\n\r\nlemma lemma_GetReplicaIndexIsUnique(c:LConfiguration, idx:int)\r\n requires WellFormedLConfiguration(c)\r\n requires 0 <= idx < |c.replica_ids|\r\n ensures GetReplicaIndex(c.replica_ids[idx], c) == idx\r\n{\r\n var j := GetReplicaIndex(c.replica_ids[idx], c);\r\n assert ReplicasDistinct(c.replica_ids, idx, j);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/Constants.i.dfy", "content": "include \"Configuration.i.dfy\"\r\ninclude \"Parameters.i.dfy\"\r\n\r\nmodule LiveRSL__Constants_i {\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Parameters_i\r\n\r\ndatatype LConstants = LConstants(\r\n config:LConfiguration,\r\n params:LParameters\r\n )\r\n\r\ndatatype LReplicaConstants = LReplicaConstants(\r\n my_index:int,\r\n all:LConstants\r\n )\r\n\r\npredicate LReplicaConstantsValid(c:LReplicaConstants)\r\n{\r\n 0 <= c.my_index < |c.all.config.replica_ids|\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/DistributedSystem.i.dfy", "content": "include \"../../Common/Collections/Maps2.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"Replica.i.dfy\"\r\n\r\nmodule LiveRSL__DistributedSystem_i {\r\nimport opened Collections__Maps2_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Parameters_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Environment_s\r\n\r\ndatatype RslState = RslState(\r\n constants:LConstants,\r\n environment:LEnvironment,\r\n replicas:seq\r\n )\r\n\r\npredicate RslMapsComplete(ps:RslState)\r\n{\r\n |ps.replicas| == |ps.constants.config.replica_ids|\r\n}\r\n\r\npredicate RslConstantsUnchanged(ps:RslState, ps':RslState)\r\n{\r\n && |ps'.replicas| == |ps.replicas|\r\n && ps'.constants == ps.constants\r\n}\r\n\r\npredicate RslInit(con:LConstants, ps:RslState)\r\n{\r\n && WellFormedLConfiguration(con.config)\r\n && WFLParameters(con.params)\r\n && ps.constants == con\r\n && LEnvironment_Init(ps.environment)\r\n && RslMapsComplete(ps)\r\n && (forall i :: 0 <= i < |con.config.replica_ids| ==> LSchedulerInit(ps.replicas[i], LReplicaConstants(i, con)))\r\n}\r\n\r\npredicate RslNextCommon(ps:RslState, ps':RslState)\r\n{\r\n && RslMapsComplete(ps)\r\n && RslConstantsUnchanged(ps, ps')\r\n && LEnvironment_Next(ps.environment, ps'.environment)\r\n}\r\n\r\npredicate RslNextOneReplica(ps:RslState, ps':RslState, idx:int, ios:seq)\r\n{\r\n && RslNextCommon(ps, ps')\r\n && 0 <= idx < |ps.constants.config.replica_ids|\r\n && LSchedulerNext(ps.replicas[idx], ps'.replicas[idx], ios)\r\n && ps.environment.nextStep == LEnvStepHostIos(ps.constants.config.replica_ids[idx], ios)\r\n && ps'.replicas == ps.replicas[idx := ps'.replicas[idx]]\r\n}\r\n\r\npredicate RslNextEnvironment(ps:RslState, ps':RslState)\r\n{\r\n && RslNextCommon(ps, ps')\r\n && !ps.environment.nextStep.LEnvStepHostIos?\r\n && ps'.replicas == ps.replicas\r\n}\r\n\r\npredicate RslNextOneExternal(ps:RslState, ps':RslState, eid:NodeIdentity, ios:seq)\r\n{\r\n && RslNextCommon(ps, ps')\r\n && eid !in ps.constants.config.replica_ids\r\n && ps.environment.nextStep == LEnvStepHostIos(eid, ios)\r\n && ps'.replicas == ps.replicas\r\n}\r\n\r\npredicate RslNext(ps:RslState, ps':RslState)\r\n{\r\n || (exists idx, ios :: RslNextOneReplica(ps, ps', idx, ios))\r\n || (exists eid, ios :: RslNextOneExternal(ps, ps', eid, ios))\r\n || RslNextEnvironment(ps, ps')\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/Election.i.dfy", "content": "include \"Constants.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"Types.i.dfy\"\r\ninclude \"../../Common/Collections/Seqs.i.dfy\"\r\n\r\nmodule LiveRSL__Election_i {\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened Collections__Seqs_i\r\nimport opened Common__UpperBound_s\r\n\r\n//////////////////////\r\n// ELECTION STATE\r\n//////////////////////\r\n\r\ndatatype ElectionState = ElectionState(\r\n constants:LReplicaConstants,\r\n // The replica constants, duplicated here for convenience\r\n\r\n current_view:Ballot,\r\n // The last view I think has won a leader election\r\n\r\n current_view_suspectors:set,\r\n // The set of indices of nodes who suspect current_view. When this constitutes\r\n // a quorum, I'll elect the next view.\r\n\r\n epoch_end_time:int,\r\n // When the next view-test epoch will end.\r\n\r\n epoch_length:int,\r\n // How long the current view-test epoch length is. When we enter a new view,\r\n // we double this.\r\n \r\n requests_received_this_epoch:seq,\r\n // The set of requests we've received this epoch but haven't executed this epoch yet\r\n // and didn't execute in the previous epoch.\r\n\r\n requests_received_prev_epochs:seq\r\n // The set of requests we received in the previous epoch but haven't executed in\r\n // the current epoch, the previous epoch, or the epoch before that.\r\n )\r\n\r\n//////////////////////\r\n// BALLOT MATH\r\n//////////////////////\r\n\r\nfunction ComputeSuccessorView(b:Ballot, c:LConstants):Ballot\r\n{\r\n if b.proposer_id + 1 < |c.config.replica_ids| then\r\n Ballot(b.seqno, b.proposer_id + 1)\r\n else\r\n Ballot(b.seqno + 1, 0)\r\n}\r\n\r\n//////////////////////\r\n// SEQUENCE MATH\r\n//////////////////////\r\n\r\nfunction BoundRequestSequence(s:seq, lengthBound:UpperBound):seq\r\n{\r\n if lengthBound.UpperBoundFinite? && 0 <= lengthBound.n < |s| then s[..lengthBound.n] else s\r\n}\r\n\r\n//////////////////////\r\n// REQUESTS\r\n//////////////////////\r\n\r\npredicate RequestsMatch(r1:Request, r2:Request)\r\n{\r\n r1.Request? && r2.Request? && r1.client == r2.client && r1.seqno == r2.seqno\r\n}\r\n\r\npredicate RequestSatisfiedBy(r1:Request, r2:Request)\r\n{\r\n r1.Request? && r2.Request? && r1.client == r2.client && r1.seqno <= r2.seqno\r\n}\r\n\r\nfunction RemoveAllSatisfiedRequestsInSequence(s:seq, r:Request):seq\r\n{\r\n if |s| == 0 then\r\n []\r\n else if RequestSatisfiedBy(s[0], r) then\r\n RemoveAllSatisfiedRequestsInSequence(s[1..], r)\r\n else\r\n [s[0]] + RemoveAllSatisfiedRequestsInSequence(s[1..], r)\r\n}\r\n\r\n//////////////////////\r\n// INITIALIZATION\r\n//////////////////////\r\n\r\npredicate ElectionStateInit(\r\n es:ElectionState,\r\n c:LReplicaConstants\r\n )\r\n requires |c.all.config.replica_ids| > 0\r\n{\r\n && es.constants == c\r\n && es.current_view == Ballot(1, 0)\r\n && es.current_view_suspectors == {}\r\n && es.epoch_end_time == 0\r\n && es.epoch_length == c.all.params.baseline_view_timeout_period\r\n && es.requests_received_this_epoch == []\r\n && es.requests_received_prev_epochs == []\r\n}\r\n\r\n//////////////////////\r\n// ACTIONS\r\n//////////////////////\r\n\r\npredicate ElectionStateProcessHeartbeat(\r\n es:ElectionState,\r\n es':ElectionState,\r\n p:RslPacket,\r\n clock:int\r\n )\r\n requires p.msg.RslMessage_Heartbeat?\r\n{\r\n if p.src !in es.constants.all.config.replica_ids then\r\n es' == es\r\n else\r\n var sender_index := GetReplicaIndex(p.src, es.constants.all.config);\r\n if p.msg.bal_heartbeat == es.current_view && p.msg.suspicious then\r\n es' == es.(current_view_suspectors := es.current_view_suspectors + {sender_index})\r\n else if BalLt(es.current_view, p.msg.bal_heartbeat) then\r\n var new_epoch_length := UpperBoundedAddition(es.epoch_length, es.epoch_length, es.constants.all.params.max_integer_val);\r\n es' == es.(current_view := p.msg.bal_heartbeat,\r\n current_view_suspectors := (if p.msg.suspicious then {sender_index} else {}),\r\n epoch_length := new_epoch_length,\r\n epoch_end_time := UpperBoundedAddition(clock, new_epoch_length, es.constants.all.params.max_integer_val),\r\n requests_received_prev_epochs := BoundRequestSequence(es.requests_received_prev_epochs + es.requests_received_this_epoch, es.constants.all.params.max_integer_val),\r\n requests_received_this_epoch := [])\r\n else\r\n es' == es\r\n}\r\n\r\npredicate ElectionStateCheckForViewTimeout(\r\n es:ElectionState,\r\n es':ElectionState,\r\n clock:int\r\n )\r\n{\r\n if clock < es.epoch_end_time then\r\n es' == es\r\n else if |es.requests_received_prev_epochs| == 0 then\r\n var new_epoch_length := es.constants.all.params.baseline_view_timeout_period;\r\n es' == es.(epoch_length := new_epoch_length,\r\n epoch_end_time := UpperBoundedAddition(clock, new_epoch_length, es.constants.all.params.max_integer_val),\r\n requests_received_prev_epochs := es.requests_received_this_epoch,\r\n requests_received_this_epoch := [])\r\n else\r\n es' == es.(current_view_suspectors := es.current_view_suspectors + {es.constants.my_index},\r\n epoch_end_time := UpperBoundedAddition(clock, es.epoch_length, es.constants.all.params.max_integer_val),\r\n requests_received_prev_epochs := BoundRequestSequence(es.requests_received_prev_epochs + es.requests_received_this_epoch, es.constants.all.params.max_integer_val),\r\n requests_received_this_epoch := [])\r\n}\r\n\r\npredicate ElectionStateCheckForQuorumOfViewSuspicions(\r\n es:ElectionState,\r\n es':ElectionState,\r\n clock:int\r\n )\r\n{\r\n if |es.current_view_suspectors| < LMinQuorumSize(es.constants.all.config) || !LtUpperBound(es.current_view.seqno, es.constants.all.params.max_integer_val) then\r\n es' == es\r\n else\r\n var new_epoch_length := UpperBoundedAddition(es.epoch_length, es.epoch_length, es.constants.all.params.max_integer_val);\r\n es' == es.(current_view := ComputeSuccessorView(es.current_view, es.constants.all),\r\n current_view_suspectors := {},\r\n epoch_length := new_epoch_length,\r\n epoch_end_time := UpperBoundedAddition(clock, new_epoch_length, es.constants.all.params.max_integer_val),\r\n requests_received_prev_epochs := BoundRequestSequence(es.requests_received_prev_epochs + es.requests_received_this_epoch, es.constants.all.params.max_integer_val),\r\n requests_received_this_epoch := [])\r\n}\r\n\r\npredicate ElectionStateReflectReceivedRequest(\r\n es:ElectionState,\r\n es':ElectionState,\r\n req:Request\r\n )\r\n{\r\n if exists earlier_req :: && (earlier_req in es.requests_received_prev_epochs || earlier_req in es.requests_received_this_epoch)\r\n && RequestsMatch(earlier_req, req) then\r\n es' == es\r\n else\r\n es' == es.(requests_received_this_epoch := BoundRequestSequence(es.requests_received_this_epoch + [req], es.constants.all.params.max_integer_val))\r\n}\r\n\r\nfunction RemoveExecutedRequestBatch(reqs:seq, batch:RequestBatch):seq\r\n decreases |batch|\r\n{\r\n if |batch| == 0 then\r\n reqs\r\n else\r\n RemoveExecutedRequestBatch(RemoveAllSatisfiedRequestsInSequence(reqs, batch[0]), batch[1..])\r\n}\r\n\r\npredicate ElectionStateReflectExecutedRequestBatch(\r\n es:ElectionState,\r\n es':ElectionState,\r\n batch:RequestBatch\r\n )\r\n{\r\n es' == es.(requests_received_prev_epochs := RemoveExecutedRequestBatch(es.requests_received_prev_epochs, batch),\r\n requests_received_this_epoch := RemoveExecutedRequestBatch(es.requests_received_this_epoch, batch))\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/Environment.i.dfy", "content": "include \"Types.i.dfy\"\r\ninclude \"Message.i.dfy\"\r\ninclude \"../../Common/Framework/Environment.s.dfy\"\r\n\r\nmodule LiveRSL__Environment_i {\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__Message_i\r\nimport opened Environment_s\r\nimport opened Concrete_NodeIdentity_i\r\n\r\ntype RslEnvironment = LEnvironment\r\ntype RslPacket = LPacket\r\ntype RslIo = LIoOp\r\n\r\nfunction ConcatenatePaxosIos(s:seq>) : seq\r\n{\r\n if |s| == 0 then\r\n []\r\n else\r\n s[0] + ConcatenatePaxosIos(s[1..])\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/Executor.i.dfy", "content": "include \"Configuration.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"Types.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"../../Services/RSL/AppStateMachine.s.dfy\"\r\ninclude \"StateMachine.i.dfy\"\r\ninclude \"Broadcast.i.dfy\"\r\ninclude \"../../Common/Collections/Maps.i.dfy\"\r\n\r\nmodule LiveRSL__Executor_i {\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__StateMachine_i\r\nimport opened LiveRSL__Broadcast_i\r\nimport opened AppStateMachine_s\r\nimport opened Collections__Maps_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Environment_s\r\nimport opened Common__UpperBound_s\r\n\r\ndatatype OutstandingOperation = OutstandingOpKnown(v:RequestBatch, bal:Ballot) | OutstandingOpUnknown()\r\n\r\ndatatype LExecutor = LExecutor(\r\n constants:LReplicaConstants,\r\n app:AppState,\r\n ops_complete:int,\r\n max_bal_reflected:Ballot,\r\n next_op_to_execute:OutstandingOperation,\r\n reply_cache:ReplyCache\r\n )\r\n\r\npredicate LExecutorInit(s:LExecutor, c:LReplicaConstants)\r\n{\r\n && s.constants == c\r\n && s.app == AppInitialize()\r\n && s.ops_complete == 0\r\n && s.max_bal_reflected == Ballot(0, 0)\r\n && s.next_op_to_execute == OutstandingOpUnknown()\r\n && s.reply_cache == map[]\r\n}\r\n\r\npredicate LExecutorGetDecision(s:LExecutor, s':LExecutor, bal:Ballot, opn:OperationNumber, v:RequestBatch)\r\n requires opn == s.ops_complete\r\n requires s.next_op_to_execute.OutstandingOpUnknown?\r\n{\r\n s' == s.(next_op_to_execute := OutstandingOpKnown(v, bal))\r\n}\r\n\r\nfunction GetPacketsFromReplies(me:NodeIdentity, requests:seq, replies:seq) : seq\r\n requires |requests| == |replies|\r\n requires forall r :: r in replies ==> r.Reply?\r\n ensures forall p :: p in GetPacketsFromReplies(me, requests, replies) ==> p.src == me && p.msg.RslMessage_Reply?\r\n{\r\n if |requests| == 0 then\r\n []\r\n else\r\n [LPacket(requests[0].client, me, RslMessage_Reply(requests[0].seqno, replies[0].reply))]\r\n + GetPacketsFromReplies(me, requests[1..], replies[1..])\r\n}\r\n\r\nlemma lemma_SizeOfGetPacketsFromReplies(me:NodeIdentity, requests:seq, replies:seq, packets:seq)\r\n requires |requests| == |replies|\r\n requires forall r :: r in replies ==> r.Reply?\r\n requires packets == GetPacketsFromReplies(me, requests, replies)\r\n ensures |packets| == |requests|\r\n decreases |requests|\r\n{\r\n if |requests| > 0\r\n {\r\n lemma_SizeOfGetPacketsFromReplies(me, requests[1..], replies[1..], packets[1..]);\r\n }\r\n}\r\n\r\nlemma lemma_SpecificPacketInGetPacketsFromReplies(me:NodeIdentity, requests:seq, replies:seq,\r\n packets:seq, batch_idx:int)\r\n requires |requests| == |replies|\r\n requires forall r :: r in replies ==> r.Reply?\r\n requires 0 <= batch_idx < |requests|\r\n requires packets == GetPacketsFromReplies(me, requests, replies)\r\n ensures |packets| == |requests|\r\n ensures packets[batch_idx] == LPacket(requests[batch_idx].client, me, RslMessage_Reply(requests[batch_idx].seqno, replies[batch_idx].reply))\r\n decreases |requests|\r\n{\r\n lemma_SizeOfGetPacketsFromReplies(me, requests, replies, packets);\r\n\r\n if |requests| > 0\r\n {\r\n if batch_idx > 0\r\n {\r\n lemma_SpecificPacketInGetPacketsFromReplies(me, requests[1..], replies[1..], packets[1..], batch_idx-1);\r\n }\r\n }\r\n}\r\n \r\npredicate LExecutorExecute(s:LExecutor, s':LExecutor, sent_packets:seq)\r\n requires s.next_op_to_execute.OutstandingOpKnown?\r\n requires LtUpperBound(s.ops_complete, s.constants.all.params.max_integer_val)\r\n requires LReplicaConstantsValid(s.constants)\r\n{\r\n var batch := s.next_op_to_execute.v;\r\n var temp := HandleRequestBatch(s.app, batch);\r\n var new_state := temp.0[|temp.0|-1];\r\n var replies := temp.1;\r\n && s'.constants == s.constants\r\n && s'.app == new_state\r\n && s'.ops_complete == s.ops_complete + 1\r\n && s'.max_bal_reflected == (if BalLeq(s.max_bal_reflected, s.next_op_to_execute.bal) then s.next_op_to_execute.bal else s.max_bal_reflected)\r\n && s'.next_op_to_execute == OutstandingOpUnknown()\r\n && (forall client :: client in s'.reply_cache ==> (|| (client in s.reply_cache && s'.reply_cache[client] == s.reply_cache[client])\r\n || (exists req_idx :: && 0 <= req_idx < |batch|\r\n && replies[req_idx].client == client\r\n && s'.reply_cache[client] == replies[req_idx])))\r\n && sent_packets == GetPacketsFromReplies(s.constants.all.config.replica_ids[s.constants.my_index], batch, replies)\r\n}\r\n\r\npredicate LExecutorProcessAppStateSupply(s:LExecutor, s':LExecutor, inp:RslPacket)\r\n requires inp.msg.RslMessage_AppStateSupply?\r\n requires inp.src in s.constants.all.config.replica_ids && inp.msg.opn_state_supply > s.ops_complete\r\n{\r\n var m := inp.msg;\r\n s' == s.(app := m.app_state,\r\n ops_complete := m.opn_state_supply,\r\n max_bal_reflected := m.bal_state_supply,\r\n next_op_to_execute := OutstandingOpUnknown())\r\n}\r\n\r\npredicate LExecutorProcessAppStateRequest(s:LExecutor, s':LExecutor, inp:RslPacket, sent_packets:seq)\r\n requires inp.msg.RslMessage_AppStateRequest?\r\n{\r\n var m := inp.msg;\r\n if && inp.src in s.constants.all.config.replica_ids\r\n && BalLeq(s.max_bal_reflected, m.bal_state_req)\r\n && s.ops_complete >= m.opn_state_req\r\n && LReplicaConstantsValid(s.constants) then\r\n && s' == s\r\n && sent_packets == [ LPacket(inp.src, s.constants.all.config.replica_ids[s.constants.my_index],\r\n RslMessage_AppStateSupply(s.max_bal_reflected, s.ops_complete, s.app)) ]\r\n else\r\n s' == s && sent_packets == []\r\n}\r\n\r\npredicate LExecutorProcessStartingPhase2(s:LExecutor, s':LExecutor, inp:RslPacket, sent_packets:seq)\r\n requires inp.msg.RslMessage_StartingPhase2?\r\n{\r\n if inp.src in s.constants.all.config.replica_ids && inp.msg.logTruncationPoint_2 > s.ops_complete then\r\n s' == s && LBroadcastToEveryone(s.constants.all.config, s.constants.my_index,\r\n RslMessage_AppStateRequest(inp.msg.bal_2, inp.msg.logTruncationPoint_2), sent_packets)\r\n else\r\n s' == s && sent_packets == []\r\n}\r\n\r\npredicate LExecutorProcessRequest(s:LExecutor, inp:RslPacket, sent_packets:seq)\r\n requires inp.msg.RslMessage_Request?\r\n requires inp.src in s.reply_cache\r\n requires s.reply_cache[inp.src].Reply?\r\n requires inp.msg.seqno_req <= s.reply_cache[inp.src].seqno\r\n{\r\n if LReplicaConstantsValid(s.constants) then\r\n var r := s.reply_cache[inp.src];\r\n sent_packets == [ LPacket(r.client, s.constants.all.config.replica_ids[s.constants.my_index], RslMessage_Reply(r.seqno, r.reply)) ]\r\n else\r\n sent_packets == []\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/Learner.i.dfy", "content": "include \"Configuration.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"Types.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"Executor.i.dfy\"\r\ninclude \"../../Common/Collections/Maps.i.dfy\"\r\n\r\nmodule LiveRSL__Learner_i {\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened Collections__Maps_i\r\n\r\ndatatype LLearner = LLearner(\r\n constants:LReplicaConstants,\r\n max_ballot_seen:Ballot,\r\n unexecuted_learner_state:LearnerState\r\n )\r\n\r\npredicate LLearnerInit(l:LLearner, c:LReplicaConstants)\r\n{\r\n && l.constants == c\r\n && l.max_ballot_seen == Ballot(0,0)\r\n && l.unexecuted_learner_state == map[]\r\n}\r\n\r\npredicate LLearnerProcess2b(s:LLearner, s':LLearner, packet:RslPacket)\r\n requires packet.msg.RslMessage_2b?\r\n{\r\n var m := packet.msg;\r\n var opn := m.opn_2b;\r\n if packet.src !in s.constants.all.config.replica_ids || BalLt(m.bal_2b, s.max_ballot_seen) then\r\n s' == s\r\n else if BalLt(s.max_ballot_seen, m.bal_2b) then\r\n var tup' := LearnerTuple({packet.src}, m.val_2b);\r\n s' == s.(max_ballot_seen := m.bal_2b,\r\n unexecuted_learner_state := map[opn := tup'])\r\n else if opn !in s.unexecuted_learner_state then\r\n var tup' := LearnerTuple({packet.src}, m.val_2b);\r\n s' == s.(unexecuted_learner_state := s.unexecuted_learner_state[opn := tup'])\r\n else if packet.src in s.unexecuted_learner_state[opn].received_2b_message_senders then\r\n s' == s\r\n else\r\n var tup := s.unexecuted_learner_state[opn];\r\n var tup' := tup.(received_2b_message_senders := tup.received_2b_message_senders + {packet.src});\r\n s' == s.(unexecuted_learner_state := s.unexecuted_learner_state[opn := tup'])\r\n}\r\n\r\npredicate LLearnerForgetDecision(s:LLearner, s':LLearner, opn:OperationNumber)\r\n{\r\n if opn in s.unexecuted_learner_state then\r\n s' == s.(unexecuted_learner_state := RemoveElt(s.unexecuted_learner_state, opn))\r\n else\r\n s' == s\r\n}\r\n\r\npredicate LLearnerForgetOperationsBefore(s:LLearner, s':LLearner, ops_complete:OperationNumber)\r\n{\r\n s' == s.(unexecuted_learner_state := (map op | op in s.unexecuted_learner_state && op >= ops_complete :: s.unexecuted_learner_state[op]))\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Assumptions.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"../CommonProof/Assumptions.i.dfy\"\r\ninclude \"../../../Common/Framework/EnvironmentSynchrony.s.dfy\"\r\n\r\nmodule LivenessProof__Assumptions_i {\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Parameters_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened EnvironmentSynchrony_s\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Collections__Maps2_s\r\nimport opened AppStateMachine_s\r\nimport opened Environment_s\r\nimport opened Common__UpperBound_s\r\n\r\n///////////////////////\r\n// TYPES\r\n///////////////////////\r\n\r\ndatatype AssumptionParameters = AssumptionParameters(\r\n c:LConstants,\r\n live_quorum:set,\r\n synchrony_start:int,\r\n latency_bound:int,\r\n host_period:int,\r\n burst_size:int,\r\n persistent_request:Request,\r\n persistent_period:int,\r\n max_clock_ambiguity:int\r\n )\r\n\r\n///////////////////////\r\n// HELPERS\r\n///////////////////////\r\n\r\nfunction SetOfReplicaIndicesToSetOfHosts(s:set, ids:seq):set\r\n{\r\n set idx | idx in s && 0 <= idx < |ids| :: ids[idx]\r\n}\r\n\r\npredicate RslSchedulerActionOccursForReplica(\r\n ps:RslState,\r\n ps':RslState,\r\n replica_index:int\r\n )\r\n{\r\n exists ios {:trigger RslNextOneReplica(ps, ps', replica_index, ios)}\r\n {:trigger LSchedulerNext(ps.replicas[replica_index], ps'.replicas[replica_index], ios) } ::\r\n && RslNextOneReplica(ps, ps', replica_index, ios)\r\n && LSchedulerNext(ps.replicas[replica_index], ps'.replicas[replica_index], ios)\r\n}\r\n\r\nfunction{:opaque} MakeRslActionTemporalFromSchedulerFunction(\r\n b:Behavior,\r\n replica_index:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, MakeRslActionTemporalFromSchedulerFunction(b, replica_index))} ::\r\n sat(i, MakeRslActionTemporalFromSchedulerFunction(b, replica_index)) <==>\r\n RslSchedulerActionOccursForReplica(b[i], b[nextstep(i)], replica_index)\r\n{\r\n stepmap(imap i :: RslSchedulerActionOccursForReplica(b[i], b[nextstep(i)], replica_index))\r\n}\r\n\r\nfunction{:opaque} PaxosTimeMap(b:Behavior):imap\r\n requires imaptotal(b)\r\n ensures imaptotal(PaxosTimeMap(b))\r\n ensures forall i {:trigger PaxosTimeMap(b)[i]} :: PaxosTimeMap(b)[i] == b[i].environment.time\r\n{\r\n imap i :: b[i].environment.time\r\n}\r\n\r\npredicate ClientSendsRequestToReplica(ps:RslState, request:Request, replica:NodeIdentity)\r\n requires request.Request?\r\n{\r\n && ps.environment.nextStep.LEnvStepHostIos?\r\n && ps.environment.nextStep.actor == request.client\r\n && LIoOpSend(LPacket(replica, request.client, RslMessage_Request(request.seqno, request.request))) in ps.environment.nextStep.ios\r\n}\r\n\r\nfunction{:opaque} ClientSendsRequestToReplicaTemporal(\r\n b:Behavior,\r\n request:Request,\r\n replica:NodeIdentity\r\n ):temporal\r\n requires imaptotal(b)\r\n requires request.Request?\r\n ensures forall i {:trigger sat(i, ClientSendsRequestToReplicaTemporal(b, request, replica))} ::\r\n sat(i, ClientSendsRequestToReplicaTemporal(b, request, replica)) <==>\r\n ClientSendsRequestToReplica(b[i], request, replica)\r\n{\r\n stepmap(imap i :: ClientSendsRequestToReplica(b[i], request, replica))\r\n}\r\n\r\npredicate ClientNeverSentHigherSequenceNumberRequest(ps:RslState, request:Request)\r\n requires request.Request?\r\n{\r\n forall p :: p in ps.environment.sentPackets && p.src == request.client && p.msg.RslMessage_Request? ==>\r\n p.msg.seqno_req < request.seqno || (p.msg.seqno_req == request.seqno && p.msg.val == request.request)\r\n}\r\n\r\nfunction{:opaque} ClientNeverSentHigherSequenceNumberRequestTemporal(\r\n b:Behavior,\r\n asp:AssumptionParameters\r\n ):temporal\r\n requires imaptotal(b)\r\n requires asp.persistent_request.Request?\r\n ensures forall i {:trigger sat(i, ClientNeverSentHigherSequenceNumberRequestTemporal(b, asp))} ::\r\n sat(i, ClientNeverSentHigherSequenceNumberRequestTemporal(b, asp)) <==>\r\n ClientNeverSentHigherSequenceNumberRequest(b[i], asp.persistent_request)\r\n{\r\n stepmap(imap i :: ClientNeverSentHigherSequenceNumberRequest(b[i], asp.persistent_request))\r\n}\r\n\r\n///////////////////////\r\n// ASSUMPTIONS\r\n///////////////////////\r\n\r\npredicate HostExecutesPeriodically(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n replica_index:int\r\n )\r\n requires imaptotal(b)\r\n{\r\n var scheduler_action := MakeRslActionTemporalFromSchedulerFunction(b, replica_index);\r\n sat(asp.synchrony_start, always(eventuallynextwithin(scheduler_action, asp.host_period, PaxosTimeMap(b))))\r\n}\r\n\r\npredicate PersistentClientSendsRequestPeriodically(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n replica_index:int\r\n )\r\n requires imaptotal(b)\r\n requires asp.persistent_request.Request?\r\n requires 0 <= replica_index < |asp.c.config.replica_ids|\r\n{\r\n var client_send := ClientSendsRequestToReplicaTemporal(b, asp.persistent_request, asp.c.config.replica_ids[replica_index]);\r\n sat(asp.synchrony_start, always(eventuallynextwithin(client_send, asp.persistent_period, PaxosTimeMap(b))))\r\n}\r\n\r\npredicate ReplyDeliveredDuringStep(ps:RslState, req:Request)\r\n{\r\n && req.Request?\r\n && ps.environment.nextStep.LEnvStepDeliverPacket?\r\n && var p := ps.environment.nextStep.p;\r\n && p.src in ps.constants.config.replica_ids\r\n && p.dst == req.client\r\n && p.msg.RslMessage_Reply?\r\n && p.msg.seqno_reply == req.seqno\r\n}\r\n\r\nfunction{:opaque} ReplyDeliveredTemporal(b:Behavior, req:Request):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, ReplyDeliveredTemporal(b, req))} ::\r\n sat(i, ReplyDeliveredTemporal(b, req)) <==> ReplyDeliveredDuringStep(b[i], req)\r\n{\r\n stepmap(imap i :: ReplyDeliveredDuringStep(b[i], req))\r\n}\r\n\r\npredicate OverflowProtectionNotUsedForReplica(ps:RslState, replica_index:int, params:LParameters, max_clock_ambiguity:int)\r\n requires 0 <= replica_index < |ps.replicas|\r\n{\r\n var s := ps.replicas[replica_index].replica;\r\n && LtUpperBound(s.proposer.election_state.current_view.seqno, params.max_integer_val)\r\n && LeqUpperBound(ps.environment.time + max_clock_ambiguity + s.proposer.election_state.epoch_length, params.max_integer_val)\r\n && LeqUpperBound(s.proposer.election_state.epoch_length + s.proposer.election_state.epoch_length, params.max_integer_val)\r\n && LeqUpperBound(s.acceptor.log_truncation_point + params.max_log_length, params.max_integer_val)\r\n && LtUpperBound(s.proposer.next_operation_number_to_propose, params.max_integer_val)\r\n && LtUpperBound(s.executor.ops_complete, params.max_integer_val)\r\n && LeqUpperBound(|s.proposer.election_state.requests_received_prev_epochs + s.proposer.election_state.requests_received_this_epoch|,\r\n params.max_integer_val)\r\n && LtUpperBound(|s.proposer.election_state.requests_received_this_epoch|, params.max_integer_val)\r\n}\r\n\r\npredicate OverflowProtectionNotUsed(ps:RslState, params:LParameters, max_clock_ambiguity:int)\r\n{\r\n forall replica_index :: 0 <= replica_index < |ps.replicas| ==> OverflowProtectionNotUsedForReplica(ps, replica_index, params, max_clock_ambiguity)\r\n}\r\n\r\nfunction{:opaque} OverflowProtectionNotUsedTemporal(b:Behavior, params:LParameters, max_clock_ambiguity:int):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, OverflowProtectionNotUsedTemporal(b, params, max_clock_ambiguity))} ::\r\n sat(i, OverflowProtectionNotUsedTemporal(b, params, max_clock_ambiguity))\r\n <==> OverflowProtectionNotUsed(b[i], params, max_clock_ambiguity)\r\n{\r\n stepmap(imap i :: OverflowProtectionNotUsed(b[i], params, max_clock_ambiguity))\r\n}\r\n\r\n///////////////////////////\r\n// TOP-LEVEL ASSUMPTIONS\r\n///////////////////////////\r\n\r\npredicate LivenessAssumptions(\r\n b:Behavior,\r\n asp:AssumptionParameters\r\n )\r\n{\r\n && IsValidBehavior(b, asp.c)\r\n && var eb := RestrictBehaviorToEnvironment(b);\r\n var live_hosts := SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids);\r\n && HostQueuesLive(eb)\r\n\r\n // The synchrony period start time is valid\r\n && 0 <= asp.synchrony_start\r\n\r\n // Time goes forward without Zeno behaviors\r\n && NoZenoBehavior(eb)\r\n\r\n // Live replicas have fairly accurate time sync\r\n && 0 <= asp.max_clock_ambiguity\r\n && ClockAmbiguityLimitedForHosts(eb, 0, asp.max_clock_ambiguity, live_hosts)\r\n\r\n // Overflow protection is never used\r\n && sat(0, always(OverflowProtectionNotUsedTemporal(b, asp.c.params, asp.max_clock_ambiguity)))\r\n\r\n // The live quorum is a set of replica indices and is big enough to constitute a quorum\r\n && (forall replica_index :: replica_index in asp.live_quorum ==> 0 <= replica_index < |asp.c.config.replica_ids|)\r\n && |asp.live_quorum| >= LMinQuorumSize(asp.c.config)\r\n\r\n // Each host in the live quorum executes periodically, with period asp.host_period\r\n && 0 < asp.host_period\r\n && (forall replica_index {:trigger HostExecutesPeriodically(b, asp, replica_index)} ::\r\n replica_index in asp.live_quorum ==> HostExecutesPeriodically(b, asp, replica_index))\r\n\r\n // The request is valid\r\n && |asp.persistent_request.request| <= MaxAppRequestSize()\r\n\r\n // The persistent client sends its request periodically, with period asp.persistent_period\r\n && 0 < asp.persistent_period\r\n && asp.persistent_request.Request?\r\n && (forall replica_index {:trigger PersistentClientSendsRequestPeriodically(b, asp, replica_index)} ::\r\n replica_index in asp.live_quorum ==> PersistentClientSendsRequestPeriodically(b, asp, replica_index))\r\n\r\n // and the persistent client never sends a request with a higher sequence number\r\n && sat(0, always(ClientNeverSentHigherSequenceNumberRequestTemporal(b, asp)))\r\n\r\n // ..but it never receives a reply.\r\n && sat(0, always(not(ReplyDeliveredTemporal(b, asp.persistent_request))))\r\n\r\n // The network delivers packets among the client and live quorum within time asp.latency_bound\r\n && 0 < asp.latency_bound\r\n && NetworkSynchronousForHosts(eb, asp.synchrony_start, asp.latency_bound,\r\n live_hosts + {asp.persistent_request.client}, live_hosts + {asp.persistent_request.client})\r\n\r\n // The network doesn't deliver packets to any host in the live quorum faster than it can process them\r\n && 0 < asp.burst_size\r\n && NetworkDeliveryRateBoundedForHosts(eb, asp.synchrony_start, asp.burst_size,\r\n asp.burst_size * asp.host_period * LReplicaNumActions() + 1, live_hosts)\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Catchup.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"PacketHandling.i.dfy\"\r\ninclude \"MaxBalReflected.i.dfy\"\r\ninclude \"Phase2Invariants.i.dfy\"\r\ninclude \"../CommonProof/LogTruncationPoint.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Sets.i.dfy\"\r\n\r\nmodule LivenessProof__Catchup_i {\r\n\r\nimport opened LiveRSL__Broadcast_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__MaxBalReflected_i\r\nimport opened LivenessProof__Phase2Invariants_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__LogTruncationPoint_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Sets_i\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\n\r\nlemma{:timeLimitMultiplier 2} lemma_EventuallySpecificLiveReplicaCaughtUp(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n idx:int,\r\n h:Phase2Params\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires idx in asp.live_quorum\r\n ensures h.start_step + 1 <= step\r\n ensures sat(step, beforeabsolutetime(or(ReplicaCaughtUpTemporal(b, idx, h.log_truncation_point), not(NoReplicaBeyondViewTemporal(b, h.view))),\r\n b[h.start_step+1].environment.time + h.processing_bound * 3, PaxosTimeMap(b)))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var x := ReplicaCaughtUpTemporal(b, idx, h.log_truncation_point);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n var deadline := b[h.start_step+1].environment.time + h.processing_bound * 3;\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, h.start_step);\r\n var s1 := b[h.start_step].replicas[h.view.proposer_id].replica.proposer;\r\n assert s1.current_state == 1;\r\n assert LBroadcastToEveryone(b[h.start_step].constants.config, h.view.proposer_id, RslMessage_StartingPhase2(h.view, h.log_truncation_point), ExtractSentPacketsFromIos(h.ios));\r\n \r\n var p := LPacket(asp.c.config.replica_ids[idx], asp.c.config.replica_ids[h.view.proposer_id], RslMessage_StartingPhase2(s1.max_ballot_i_sent_1a, h.log_truncation_point));\r\n assert p in ExtractSentPacketsFromIos(h.ios);\r\n var first_step, ios2 := lemma_PacketSentToIndexProcessedByIt(b, asp, h.start_step, h.processing_bound, h.start_step, idx, p);\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, first_step);\r\n var s2 := b[first_step].replicas[idx].replica.executor;\r\n if s2.ops_complete >= h.log_truncation_point\r\n {\r\n step := first_step;\r\n assert sat(step, beforeabsolutetime(x, deadline, f));\r\n return;\r\n }\r\n\r\n assert LBroadcastToEveryone(s2.constants.all.config, s2.constants.my_index, RslMessage_AppStateRequest(p.msg.bal_2, h.log_truncation_point), ExtractSentPacketsFromIos(ios2));\r\n var p2 := LPacket(asp.c.config.replica_ids[h.king_idx], asp.c.config.replica_ids[idx], RslMessage_AppStateRequest(p.msg.bal_2, h.log_truncation_point));\r\n assert p2 in ExtractSentPacketsFromIos(ios2);\r\n\r\n var second_step, ios3 := lemma_PacketSentToIndexProcessedByIt(b, asp, h.start_step, h.processing_bound, first_step, h.king_idx, p2);\r\n lemma_ConstantsAllConsistent(b, asp.c, second_step);\r\n var s3 := b[second_step].replicas[h.king_idx].replica.executor;\r\n lemma_OpsCompleteMonotonic(b, asp.c, h.start_step+1, second_step, h.king_idx);\r\n assert s3.ops_complete >= h.log_truncation_point;\r\n\r\n assert p.msg.bal_2 == h.view;\r\n\r\n if sat(second_step, not(NoReplicaBeyondViewTemporal(b, h.view)))\r\n {\r\n step := second_step;\r\n assert sat(step, beforeabsolutetime(not(z), deadline, f));\r\n return;\r\n }\r\n\r\n lemma_MaxBalReflectedLeqCurrentView(b, asp, second_step, h.view, h.king_idx);\r\n assert BalLeq(s3.max_bal_reflected, h.view);\r\n var p3 := LPacket(asp.c.config.replica_ids[idx], asp.c.config.replica_ids[h.king_idx], RslMessage_AppStateSupply(s3.max_bal_reflected, s3.ops_complete, s3.app));\r\n assert p3 in ExtractSentPacketsFromIos(ios3);\r\n\r\n var third_step, ios4 := lemma_PacketSentToIndexProcessedByIt(b, asp, h.start_step, h.processing_bound, second_step, idx, p3);\r\n lemma_ConstantsAllConsistent(b, asp.c, third_step);\r\n var s4' := b[third_step+1].replicas[idx].replica.executor;\r\n assert s4'.ops_complete >= h.log_truncation_point;\r\n\r\n step := third_step+1;\r\n}\r\n\r\nlemma lemma_ReplicaCaughtUpIsStable(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int,\r\n opn:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n ensures sat(i, imply(ReplicaCaughtUpTemporal(b, idx, opn), always(ReplicaCaughtUpTemporal(b, idx, opn))))\r\n{\r\n if sat(i, ReplicaCaughtUpTemporal(b, idx, opn))\r\n {\r\n forall j | i <= j\r\n ensures sat(j, ReplicaCaughtUpTemporal(b, idx, opn))\r\n {\r\n lemma_OpsCompleteMonotonic(b, asp.c, i, j, idx);\r\n }\r\n TemporalAlways(i, ReplicaCaughtUpTemporal(b, idx, opn));\r\n }\r\n}\r\n\r\nlemma lemma_EventuallyAllLiveReplicasCaughtUp(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n ensures sat(h.start_step+1, eventuallywithin(or(always(andset(AllReplicasCaughtUpTemporalSet(b, asp.live_quorum, h.log_truncation_point))),\r\n not(NoReplicaBeyondViewTemporal(b, h.view))),\r\n h.processing_bound * 3, PaxosTimeMap(b)))\r\n{\r\n var xs := AllReplicasCaughtUpTemporalSet(b, asp.live_quorum, h.log_truncation_point);\r\n var y := not(NoReplicaBeyondViewTemporal(b, h.view));\r\n var t := h.processing_bound * 3;\r\n var f := PaxosTimeMap(b);\r\n forall x | x in xs\r\n ensures sat(h.start_step + 1, eventuallywithin(or(always(x), y), t, f))\r\n {\r\n var idx :| idx in asp.live_quorum && x == ReplicaCaughtUpTemporal(b, idx, h.log_truncation_point);\r\n var step := lemma_EventuallySpecificLiveReplicaCaughtUp(b, asp, idx, h);\r\n assert sat(step, or(x, y));\r\n lemma_ReplicaCaughtUpIsStable(b, asp, step, idx, h.log_truncation_point);\r\n assert sat(step, or(always(x), y));\r\n TemporalEventually(h.start_step+1, step, beforeabsolutetime(or(always(x), y), f[h.start_step+1] + t, f));\r\n }\r\n Lemma_EventuallyAlwaysWithinEachOrAlternativeImpliesEventuallyAlwaysWithinAllOrAlternative(h.start_step + 1, xs, y, t, f);\r\n}\r\n\r\nlemma lemma_EventuallyAllLiveReplicasReadyForFirstOperation(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n ensures h.start_step + 1 <= step\r\n ensures b[step].environment.time <= b[h.start_step + 1].environment.time + h.processing_bound * 3\r\n ensures sat(step, or(AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, h.log_truncation_point),\r\n not(NoReplicaBeyondViewTemporal(b, h.view))))\r\n{\r\n var t := h.processing_bound * 3;\r\n var f := PaxosTimeMap(b);\r\n var xs := AllReplicasCaughtUpTemporalSet(b, asp.live_quorum, h.log_truncation_point);\r\n var y := AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, h.log_truncation_point);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n lemma_EventuallyAllLiveReplicasCaughtUp(b, asp, h);\r\n step := TemporalDeduceFromEventual(h.start_step + 1, beforeabsolutetime(or(always(andset(xs)), not(NoReplicaBeyondViewTemporal(b, h.view))),\r\n f[h.start_step + 1] + t, f));\r\n lemma_ConstantsAllConsistent(b, asp.c, step);\r\n if sat(step, z)\r\n {\r\n forall idx | idx in asp.live_quorum\r\n ensures ReplicaCaughtUp(b[step], idx, h.log_truncation_point)\r\n {\r\n var x := ReplicaCaughtUpTemporal(b, idx, h.log_truncation_point);\r\n assert x in xs;\r\n assert sat(step, or(always(andset(xs)), not(z)));\r\n assert sat(step, always(andset(xs)));\r\n TemporalDeduceFromAlways(step, step, andset(xs));\r\n assert sat(step, x);\r\n }\r\n var s := b[step].replicas[h.view.proposer_id].replica;\r\n lemma_LogTruncationPointMonotonic(b, asp.c, h.start_step + 1, step, h.view.proposer_id);\r\n assert s.acceptor.log_truncation_point >= h.log_truncation_point;\r\n lemma_NextOperationNumberToProposeIncreasesInPhase2(b, asp, h, h.start_step + 1, step);\r\n assert s.proposer.next_operation_number_to_propose >= h.log_truncation_point;\r\n assert sat(step, y);\r\n }\r\n assert sat(step, or(y, not(z)));\r\n}\r\n \r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Environment.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\ninclude \"../CommonProof/Environment.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Heuristics.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Induction.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Rules.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Time.i.dfy\"\r\n\r\nmodule LivenessProof__Environment_i {\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Environment_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Induction_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Environment_s\r\nimport opened EnvironmentSynchrony_s\r\n\r\nlemma lemma_AssumptionsMakeValidEnvironmentBehavior(\r\n b:Behavior,\r\n c:LConstants\r\n )\r\n requires IsValidBehavior(b, c)\r\n ensures LEnvironment_BehaviorSatisfiesSpec(RestrictBehaviorToEnvironment(b))\r\n{\r\n var eb := RestrictBehaviorToEnvironment(b);\r\n var x := EnvironmentNextTemporal(eb);\r\n\r\n forall i | i >= 0\r\n ensures sat(i, x)\r\n {\r\n assert RslNext(b[i], b[i+1]);\r\n assert LEnvironment_Next(eb[i], eb[i+1]);\r\n }\r\n\r\n TemporalAlways(0, x);\r\n assert LEnvironment_Init(eb[0]);\r\n assert LEnvironment_BehaviorSatisfiesSpec(eb);\r\n}\r\n\r\nlemma lemma_ClockAmbiguityLimitApplies(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int,\r\n io:RslIo\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires idx in asp.live_quorum\r\n requires 0 <= idx < |asp.c.config.replica_ids|\r\n requires b[i].environment.nextStep.LEnvStepHostIos?\r\n requires b[i].environment.nextStep.actor == asp.c.config.replica_ids[idx]\r\n requires io in b[i].environment.nextStep.ios\r\n requires io.LIoOpReadClock?\r\n ensures b[i].environment.time - asp.max_clock_ambiguity <= io.t <= b[i].environment.time + asp.max_clock_ambiguity\r\n ensures b[i].environment.time == b[i+1].environment.time\r\n{\r\n var live_hosts := SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids);\r\n TemporalDeduceFromAlways(0, i, ClockAmbiguityLimitedForHostsTemporal(RestrictBehaviorToEnvironment(b), asp.max_clock_ambiguity,\r\n live_hosts));\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n}\r\n\r\nlemma lemma_PacketSentAppearsInSentPackets(\r\n b:Behavior,\r\n c:LConstants,\r\n send_step:int,\r\n p:RslPacket\r\n )\r\n requires IsValidBehavior(b, c)\r\n requires b[send_step].environment.nextStep.LEnvStepHostIos?\r\n requires LIoOpSend(p) in b[send_step].environment.nextStep.ios\r\n requires send_step >= 0\r\n ensures p in b[send_step + 1].environment.sentPackets\r\n{\r\n assert RslNext(b[send_step], b[send_step + 1]);\r\n}\r\n\r\nlemma lemma_PacketSentAppearsInSentPacketsEnvironment(\r\n b:Behavior>,\r\n send_step:int,\r\n p:LPacket\r\n )\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires b[send_step].nextStep.LEnvStepHostIos?\r\n requires LIoOpSend(p) in b[send_step].nextStep.ios\r\n requires send_step >= 0\r\n ensures p in b[send_step + 1].sentPackets\r\n{\r\n TemporalDeduceFromAlways(0, send_step, EnvironmentNextTemporal(b));\r\n}\r\n\r\nlemma lemma_PacketSentEventuallyDelivered(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n send_step:int,\r\n p:RslPacket\r\n ) returns (\r\n delivery_step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires asp.synchrony_start <= send_step\r\n requires var hosts := SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids) + { asp.persistent_request.client };\r\n PacketSentBetweenHosts(b[send_step].environment, p, hosts, hosts)\r\n ensures send_step <= delivery_step\r\n ensures b[delivery_step].environment.nextStep == LEnvStepDeliverPacket(p)\r\n ensures b[delivery_step+1].environment.time <= b[send_step+1].environment.time + asp.latency_bound\r\n{\r\n var eb := RestrictBehaviorToEnvironment(b);\r\n var hosts := SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids) + { asp.persistent_request.client };\r\n assert NetworkSynchronousForHosts(eb, asp.synchrony_start, asp.latency_bound, hosts, hosts);\r\n TemporalDeduceFromAlways(asp.synchrony_start, send_step, PacketsSynchronousForHostsTemporal(eb, asp.latency_bound, hosts, hosts));\r\n assert PacketSentBetweenHosts(eb[send_step], p, hosts, hosts); // TRIGGER\r\n lemma_PacketSentAppearsInSentPackets(b, asp.c, send_step, p);\r\n assert p in eb[send_step + 1].sentPackets;\r\n assert sat(send_step, next(eventuallynextwithin(PacketDeliveredTemporal(eb, p), asp.latency_bound, BehaviorToTimeMap(eb))));\r\n assert sat(send_step+1, eventuallynextwithin(PacketDeliveredTemporal(eb, p), asp.latency_bound, BehaviorToTimeMap(eb)));\r\n delivery_step := TemporalDeduceFromEventuallyNextWithin(send_step+1, PacketDeliveredTemporal(eb, p), asp.latency_bound,\r\n BehaviorToTimeMap(eb));\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/EpochLength.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"RequestsReceived.i.dfy\"\r\ninclude \"ViewSuspicion.i.dfy\"\r\ninclude \"WF1.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\n\r\nmodule LivenessProof__EpochLength_i {\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Election_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__RequestsReceived_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__ViewAdvance_i\r\nimport opened LivenessProof__ViewChange_i\r\nimport opened LivenessProof__ViewPropagation_i\r\nimport opened LivenessProof__ViewSuspicion_i\r\nimport opened LivenessProof__WF1_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__WF1_i\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\n\r\npredicate HostReadyToIncreaseEpochLength(\r\n ps:RslState,\r\n idx:int,\r\n epoch_length:int,\r\n epoch_end_time:int\r\n )\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && var es := ps.replicas[idx].replica.proposer.election_state;\r\n && es.epoch_length == epoch_length\r\n && es.epoch_end_time == epoch_end_time\r\n}\r\n\r\nfunction{:opaque} HostReadyToIncreaseEpochLengthTemporal(\r\n b:Behavior,\r\n idx:int,\r\n epoch_length:int,\r\n epoch_end_time:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, HostReadyToIncreaseEpochLengthTemporal(b, idx, epoch_length, epoch_end_time))} ::\r\n sat(i, HostReadyToIncreaseEpochLengthTemporal(b, idx, epoch_length, epoch_end_time))\r\n <==> HostReadyToIncreaseEpochLength(b[i], idx, epoch_length, epoch_end_time);\r\n{\r\n stepmap(imap i :: HostReadyToIncreaseEpochLength(b[i], idx, epoch_length, epoch_end_time))\r\n}\r\n\r\npredicate EpochLengthEqualOrGreater(ps:RslState, idx:int, epoch_length:int)\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && ps.replicas[idx].replica.proposer.election_state.epoch_length >= epoch_length\r\n}\r\n\r\nfunction{:opaque} EpochLengthEqualOrGreaterTemporal(b:Behavior, idx:int, epoch_length:int):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, EpochLengthEqualOrGreaterTemporal(b, idx, epoch_length))} ::\r\n sat(i, EpochLengthEqualOrGreaterTemporal(b, idx, epoch_length)) == EpochLengthEqualOrGreater(b[i], idx, epoch_length)\r\n{\r\n stepmap(imap i :: EpochLengthEqualOrGreater(b[i], idx, epoch_length))\r\n}\r\n\r\nlemma lemma_EpochLengthAtLeastInitialValue(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= idx < |asp.c.config.replica_ids|\r\n requires 0 <= i\r\n ensures EpochLengthEqualOrGreater(b[i], idx, asp.c.params.baseline_view_timeout_period)\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n if i == 0\r\n {\r\n assert EpochLengthEqualOrGreater(b[i], idx, asp.c.params.baseline_view_timeout_period);\r\n }\r\n else\r\n {\r\n lemma_EpochLengthAtLeastInitialValue(b, asp, i-1, idx);\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n assert EpochLengthEqualOrGreater(b[i-1], idx, asp.c.params.baseline_view_timeout_period);\r\n if !EpochLengthEqualOrGreater(b[i], idx, asp.c.params.baseline_view_timeout_period)\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i-1, idx);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, i-1, idx);\r\n assert false;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_EpochLengthNeverDecreases(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n idx:int,\r\n start_step:int,\r\n i:int,\r\n j:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires idx in asp.live_quorum\r\n requires sat(start_step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n requires 0 <= start_step <= i <= j\r\n ensures 0 <= idx < |b[i].replicas|\r\n ensures 0 <= idx < |b[j].replicas|\r\n ensures b[i].replicas[idx].replica.proposer.election_state.epoch_length <= b[j].replicas[idx].replica.proposer.election_state.epoch_length\r\n decreases j - i\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, j);\r\n \r\n if j == i + 1\r\n {\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n TemporalDeduceFromAlways(start_step, i, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx));\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, i, idx);\r\n// assert OverflowProtectionNotUsed(b[i], idx, b[i].replicas[idx].replica.proposer.election_state.constants.all.params);\r\n lemma_EpochLengthAtLeastInitialValue(b, asp, i, idx);\r\n if b[i].replicas[idx].replica.proposer.election_state.epoch_length > b[j].replicas[idx].replica.proposer.election_state.epoch_length\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, idx);\r\n assert false;\r\n }\r\n }\r\n else if j > i + 1\r\n {\r\n lemma_EpochLengthNeverDecreases(b, asp, idx, start_step, i, i+1);\r\n lemma_EpochLengthNeverDecreases(b, asp, idx, start_step, i+1, j);\r\n }\r\n}\r\n\r\nlemma lemma_EpochLengthEventuallyIncreasesWF1Req1(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int,\r\n epoch_length:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires idx in asp.live_quorum\r\n requires sat(i, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx))\r\n requires 0 <= i\r\n ensures var P := EpochLengthEqualOrGreaterTemporal(b, idx, epoch_length);\r\n var Q := EpochLengthEqualOrGreaterTemporal(b, idx, epoch_length + 1);\r\n sat(i, TemporalWF1Req1(P, Q))\r\n{\r\n var P := EpochLengthEqualOrGreaterTemporal(b, idx, epoch_length);\r\n var Q := EpochLengthEqualOrGreaterTemporal(b, idx, epoch_length + 1);\r\n if sat(i, P) && !sat(i, Q) && !sat(i+1, P) && !sat(i+1, Q)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, idx);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, i, idx);\r\n lemma_EpochLengthAtLeastInitialValue(b, asp, i, idx);\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_EpochLengthEventuallyIncreases(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n idx:int,\r\n start_step:int,\r\n i:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires processing_sync_start <= start_step <= i\r\n requires idx in asp.live_quorum\r\n requires sat(start_step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n ensures i <= step\r\n ensures 0 <= idx < |b[i].replicas|\r\n ensures 0 <= idx < |b[step].replicas|\r\n ensures b[step].replicas[idx].replica.proposer.election_state.epoch_length > b[i].replicas[idx].replica.proposer.election_state.epoch_length\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, i, idx);\r\n lemma_IsValidBallot(b, asp, i, idx);\r\n var epoch_length := b[i].replicas[idx].replica.proposer.election_state.epoch_length;\r\n var current_view := b[i].replicas[idx].replica.proposer.election_state.current_view;\r\n var nextView := ComputeSuccessorView(current_view, asp.c);\r\n lemma_IfPacketProcessingSynchronousThenAlways(b, asp, processing_sync_start, i, processing_bound);\r\n var intermediate_step, replica_index := lemma_SomeReplicaInLiveQuorumReachesView(b, asp, i, processing_bound, nextView);\r\n var advance_step := lemma_OneLiveReplicaSoonAdvancesAnother(b, asp, processing_sync_start, processing_bound, intermediate_step, replica_index, idx);\r\n lemma_ConstantsAllConsistent(b, asp.c, advance_step);\r\n\r\n var x := not(HostInViewTemporal(b, idx, current_view));\r\n var action_step := earliestStepBetween(i, advance_step, x) - 1;\r\n assert i <= action_step;\r\n lemma_ConstantsAllConsistent(b, asp.c, action_step);\r\n lemma_ConstantsAllConsistent(b, asp.c, action_step+1);\r\n assert !sat(action_step, x);\r\n\r\n var P := EpochLengthEqualOrGreaterTemporal(b, idx, epoch_length);\r\n var Q := EpochLengthEqualOrGreaterTemporal(b, idx, epoch_length + 1);\r\n\r\n forall j | i <= j\r\n ensures sat(j, TemporalWF1Req1(P, Q))\r\n {\r\n TemporalDeduceFromAlways(start_step, j, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx));\r\n lemma_EpochLengthEventuallyIncreasesWF1Req1(b, asp, j, idx, epoch_length);\r\n }\r\n\r\n if !sat(action_step, imply(P, or(Q, next(Q))))\r\n {\r\n assert sat(action_step, P) && !sat(action_step, Q) && !sat(action_step+1, Q);\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, action_step, idx);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, action_step, idx);\r\n lemma_EpochLengthAtLeastInitialValue(b, asp, action_step, idx);\r\n assert false;\r\n }\r\n\r\n step := TemporalWF1Specific(i, action_step, P, Q);\r\n}\r\n\r\nlemma lemma_EpochLengthEventuallyReaches(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n idx:int,\r\n start_step:int,\r\n epoch_length:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires processing_sync_start <= start_step\r\n requires idx in asp.live_quorum\r\n requires sat(start_step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n ensures step >= start_step\r\n ensures 0 <= idx < |b[step].replicas|\r\n ensures b[step].replicas[idx].replica.proposer.election_state.epoch_length >= epoch_length\r\n decreases epoch_length\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, start_step);\r\n if epoch_length <= asp.c.params.baseline_view_timeout_period\r\n {\r\n lemma_EpochLengthAtLeastInitialValue(b, asp, start_step, idx);\r\n step := start_step;\r\n }\r\n else\r\n {\r\n var almost_step := lemma_EpochLengthEventuallyReaches(b, asp, processing_sync_start, processing_bound, idx, start_step, epoch_length - 1);\r\n Lemma_AlwaysImpliesLaterAlways(start_step, almost_step, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx));\r\n step := lemma_EpochLengthEventuallyIncreases(b, asp, processing_sync_start, processing_bound, idx, start_step, almost_step);\r\n }\r\n}\r\n\r\nlemma lemma_EpochLengthForSomeEventuallyReaches(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n start_step:int,\r\n replica_indices:set,\r\n epoch_length:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires processing_sync_start <= start_step\r\n requires replica_indices <= asp.live_quorum\r\n requires forall idx :: idx in replica_indices ==> sat(start_step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n ensures start_step <= step;\r\n ensures forall idx :: idx in replica_indices ==> && 0 <= idx < |b[step].replicas|\r\n && b[step].replicas[idx].replica.proposer.election_state.epoch_length >= epoch_length\r\n{\r\n if |replica_indices| == 0\r\n {\r\n step := start_step;\r\n }\r\n else\r\n {\r\n var some_index :| some_index in replica_indices;\r\n var other_indices := replica_indices - {some_index};\r\n var almost_step := lemma_EpochLengthForSomeEventuallyReaches(b, asp, processing_sync_start, processing_bound, start_step, other_indices, epoch_length);\r\n Lemma_AlwaysImpliesLaterAlways(start_step, almost_step, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, some_index));\r\n step := lemma_EpochLengthEventuallyReaches(b, asp, processing_sync_start, processing_bound, some_index, almost_step, epoch_length);\r\n forall idx | idx in replica_indices\r\n ensures 0 <= idx < |b[step].replicas|\r\n ensures b[step].replicas[idx].replica.proposer.election_state.epoch_length >= epoch_length\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, almost_step);\r\n lemma_ConstantsAllConsistent(b, asp.c, step);\r\n if idx != some_index\r\n {\r\n assert idx in other_indices;\r\n lemma_EpochLengthNeverDecreases(b, asp, idx, start_step, almost_step, step);\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_EpochLengthForAllEventuallyReaches(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n epoch_length:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n ensures processing_sync_start <= step\r\n ensures forall idx :: idx in asp.live_quorum ==> sat(step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n ensures forall idx :: idx in asp.live_quorum ==> sat(step, always(EpochLengthEqualOrGreaterTemporal(b, idx, epoch_length)))\r\n{\r\n var start_step := lemma_EventuallyForAllPersistentRequestAlwaysInRequestsReceivedPrevEpochs(b, asp, processing_sync_start, processing_bound);\r\n step := lemma_EpochLengthForSomeEventuallyReaches(b, asp, processing_sync_start, processing_bound, start_step, asp.live_quorum, epoch_length);\r\n\r\n forall idx | idx in asp.live_quorum\r\n ensures sat(step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n ensures sat(step, always(EpochLengthEqualOrGreaterTemporal(b, idx, epoch_length)))\r\n {\r\n Lemma_AlwaysImpliesLaterAlways(start_step, step, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx));\r\n forall i | step <= i\r\n ensures sat(i, EpochLengthEqualOrGreaterTemporal(b, idx, epoch_length))\r\n {\r\n lemma_EpochLengthNeverDecreases(b, asp, idx, start_step, step, i);\r\n }\r\n TemporalAlways(step, EpochLengthEqualOrGreaterTemporal(b, idx, epoch_length));\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Execution.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\n\r\nmodule LivenessProof__Execution_i {\r\n\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__StateMachine_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Rules_i\r\nimport opened Environment_s\r\nimport opened EnvironmentSynchrony_s\r\nimport opened Collections__Maps2_s\r\nimport opened Common__UpperBound_s\r\n\r\npredicate ReplySentToClientWithSeqno(ps:RslState, ps':RslState, client:NodeIdentity, seqno:int, idx:int, ios:seq, batch_idx:int)\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && 0 <= idx < |ps'.replicas|\r\n && var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n && RslNextOneReplica(ps, ps', idx, ios)\r\n && LReplicaNextSpontaneousMaybeExecute(s, s', ExtractSentPacketsFromIos(ios))\r\n && s.executor.next_op_to_execute.OutstandingOpKnown?\r\n && LtUpperBound(s.executor.ops_complete, s.executor.constants.all.params.max_integer_val)\r\n && LReplicaConstantsValid(s.executor.constants)\r\n && 0 <= batch_idx < |s.executor.next_op_to_execute.v|\r\n && s.executor.next_op_to_execute.v[batch_idx].Request?\r\n && s.executor.next_op_to_execute.v[batch_idx].client == client\r\n && s.executor.next_op_to_execute.v[batch_idx].seqno == seqno\r\n}\r\n\r\npredicate RequestWithSeqnoExecuted(ps:RslState, ps':RslState, client:NodeIdentity, seqno:int, idx:int)\r\n{\r\n exists ios, batch_idx :: ReplySentToClientWithSeqno(ps, ps', client, seqno, idx, ios, batch_idx)\r\n}\r\n\r\nfunction {:opaque} RequestWithSeqnoExecutedTemporal(b:Behavior, client:NodeIdentity, seqno:int, idx:int):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, RequestWithSeqnoExecutedTemporal(b, client, seqno, idx))} ::\r\n sat(i, RequestWithSeqnoExecutedTemporal(b, client, seqno, idx)) <==> RequestWithSeqnoExecuted(b[i], b[nextstep(i)], client, seqno, idx)\r\n{\r\n stepmap(imap i :: RequestWithSeqnoExecuted(b[i], b[nextstep(i)], client, seqno, idx))\r\n}\r\n\r\npredicate ReplySentToClientAtLeastSeqno(ps:RslState, ps':RslState, client:NodeIdentity, seqno:int, idx:int, ios:seq, batch_idx:int)\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && 0 <= idx < |ps'.replicas|\r\n && var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n && RslNextOneReplica(ps, ps', idx, ios)\r\n && LReplicaNextSpontaneousMaybeExecute(s, s', ExtractSentPacketsFromIos(ios))\r\n && s.executor.next_op_to_execute.OutstandingOpKnown?\r\n && LtUpperBound(s.executor.ops_complete, s.executor.constants.all.params.max_integer_val)\r\n && LReplicaConstantsValid(s.executor.constants)\r\n && 0 <= batch_idx < |s.executor.next_op_to_execute.v|\r\n && s.executor.next_op_to_execute.v[batch_idx].Request?\r\n && s.executor.next_op_to_execute.v[batch_idx].client == client\r\n && s.executor.next_op_to_execute.v[batch_idx].seqno >= seqno\r\n}\r\n\r\npredicate RequestAtLeastSeqnoExecuted(ps:RslState, ps':RslState, client:NodeIdentity, seqno:int, idx:int)\r\n{\r\n exists ios, batch_idx :: ReplySentToClientAtLeastSeqno(ps, ps', client, seqno, idx, ios, batch_idx)\r\n}\r\n\r\nfunction {:opaque} RequestAtLeastSeqnoExecutedTemporal(b:Behavior, client:NodeIdentity, seqno:int, idx:int):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, RequestAtLeastSeqnoExecutedTemporal(b, client, seqno, idx))} ::\r\n sat(i, RequestAtLeastSeqnoExecutedTemporal(b, client, seqno, idx)) <==> RequestAtLeastSeqnoExecuted(b[i], b[nextstep(i)], client, seqno, idx)\r\n{\r\n stepmap(imap i :: RequestAtLeastSeqnoExecuted(b[i], b[nextstep(i)], client, seqno, idx))\r\n}\r\n\r\n\r\nlemma lemma_PersistentRequestNeverExecuted(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires idx in asp.live_quorum\r\n ensures sat(asp.synchrony_start, always(not(RequestWithSeqnoExecutedTemporal(b, asp.persistent_request.client, asp.persistent_request.seqno, idx))))\r\n{\r\n var client := asp.persistent_request.client;\r\n var seqno := asp.persistent_request.seqno;\r\n var t := RequestWithSeqnoExecutedTemporal(b, client, seqno, idx);\r\n \r\n forall i | asp.synchrony_start <= i\r\n ensures !sat(i, t)\r\n {\r\n if sat(i, t)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n\r\n var ps := b[i];\r\n var ps' := b[i+1];\r\n var s := ps.replicas[idx].replica.executor;\r\n var ios, batch_idx :| ReplySentToClientWithSeqno(ps, ps', client, seqno, idx, ios, batch_idx);\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n assert LExecutorExecute(ps.replicas[idx].replica.executor, ps'.replicas[idx].replica.executor, sent_packets);\r\n\r\n var batch := s.next_op_to_execute.v;\r\n var temp := HandleRequestBatch(s.app, batch);\r\n var new_state := temp.0[|temp.0|-1];\r\n var replies := temp.1;\r\n\r\n var me := s.constants.all.config.replica_ids[s.constants.my_index];\r\n lemma_SpecificPacketInGetPacketsFromReplies(me, batch, replies, sent_packets, batch_idx);\r\n var p := sent_packets[batch_idx];\r\n assert LIoOpSend(p) in ios;\r\n\r\n var delivery_step := lemma_PacketSentEventuallyDelivered(b, asp, i, p);\r\n lemma_ConstantsAllConsistent(b, asp.c, delivery_step);\r\n assert ReplyDeliveredDuringStep(b[delivery_step], asp.persistent_request);\r\n TemporalDeduceFromAlways(0, delivery_step, not(ReplyDeliveredTemporal(b, asp.persistent_request)));\r\n assert false;\r\n }\r\n }\r\n\r\n TemporalAlways(asp.synchrony_start, not(t));\r\n}\r\n \r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/GenericInvariants.i.dfy", "content": "include \"Invariants.i.dfy\"\r\ninclude \"RealTime.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\n\r\nmodule LivenessProof__GenericInvariants_i {\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__RealTime_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\nimport opened Common__UpperBound_s\r\n\r\nlemma lemma_ProposerBatchTimerNeverTooFarInFuture(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires idx in asp.live_quorum\r\n ensures 0 <= idx < |b[i].replicas|\r\n ensures var s := b[i].replicas[idx].replica.proposer;\r\n s.incomplete_batch_timer.IncompleteBatchTimerOn?\r\n ==> s.incomplete_batch_timer.when <= b[i].environment.time + asp.max_clock_ambiguity + asp.c.params.max_batch_delay\r\n decreases i\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n \r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n\r\n var s := b[i-1].replicas[idx].replica.proposer;\r\n var s' := b[i].replicas[idx].replica.proposer;\r\n\r\n lemma_ProposerBatchTimerNeverTooFarInFuture(b, asp, i-1, idx);\r\n\r\n if s'.incomplete_batch_timer.IncompleteBatchTimerOn?\r\n {\r\n if s'.incomplete_batch_timer == s.incomplete_batch_timer\r\n {\r\n lemma_TimeAdvancesBetween(b, asp, i-1, i);\r\n }\r\n else\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i-1, idx);\r\n assert LReplicaNextReadClockMaybeNominateValueAndSend2a(b[i-1].replicas[idx].replica, b[i].replicas[idx].replica,\r\n SpontaneousClock(ios), ExtractSentPacketsFromIos(ios));\r\n assert ios[0].LIoOpReadClock?;\r\n lemma_ClockAmbiguityLimitApplies(b, asp, i-1, idx, ios[0]);\r\n assert ios[0].t <= b[i].environment.time + asp.max_clock_ambiguity;\r\n assert s'.incomplete_batch_timer.when == UpperBoundedAddition(ios[0].t, asp.c.params.max_batch_delay, asp.c.params.max_integer_val);\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_HeartbeatTimerNeverTooFarInFuture(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires idx in asp.live_quorum\r\n ensures 0 <= idx < |b[i].replicas|\r\n ensures var s := b[i].replicas[idx].replica;\r\n s.nextHeartbeatTime <= b[i].environment.time + asp.max_clock_ambiguity + asp.c.params.heartbeat_period\r\n decreases i\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n \r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n\r\n var s := b[i-1].replicas[idx].replica;\r\n var s' := b[i].replicas[idx].replica;\r\n\r\n lemma_HeartbeatTimerNeverTooFarInFuture(b, asp, i-1, idx);\r\n\r\n if s'.nextHeartbeatTime == s.nextHeartbeatTime\r\n {\r\n lemma_TimeAdvancesBetween(b, asp, i-1, i);\r\n }\r\n else\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i-1, idx);\r\n assert ios[0].LIoOpReadClock?;\r\n lemma_ClockAmbiguityLimitApplies(b, asp, i-1, idx, ios[0]);\r\n assert ios[0].t <= b[i].environment.time + asp.max_clock_ambiguity;\r\n assert s'.nextHeartbeatTime == UpperBoundedAddition(ios[0].t, asp.c.params.heartbeat_period, asp.c.params.max_integer_val);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_NextCheckpointedOperationAlwaysSizeOfReplicas(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures |b[i].replicas[idx].replica.acceptor.last_checkpointed_operation| == |c.config.replica_ids|\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_NextCheckpointedOperationAlwaysSizeOfReplicas(b, c, i-1, idx);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Invariants.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"../../../Common/Framework/HostQueueLemmas.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Heuristics.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\n\r\nmodule LivenessProof__Invariants_i {\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened Liveness__HostQueueLemmas_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Rules_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened EnvironmentSynchrony_s\r\n\r\nlemma lemma_HostQueuesNext(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n ensures HostQueues_Next(b[i].environment, b[i+1].environment)\r\n{\r\n TemporalDeduceFromAlways(0, i, HostQueuesNextTemporal(RestrictBehaviorToEnvironment(b)));\r\n}\r\n\r\nlemma lemma_LEnvironmentInvariantHolds(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n ensures LEnvironmentInvariant(b[i].environment)\r\n{\r\n if i == 0\r\n {\r\n Lemma_LEnvironmentInitEstablishesInvariant(b[i].environment);\r\n }\r\n else\r\n {\r\n lemma_LEnvironmentInvariantHolds(b, asp, i-1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n lemma_HostQueuesNext(b, asp, i-1);\r\n\r\n Lemma_LEnvironmentNextPreservesInvariant(b[i-1].environment, b[i].environment);\r\n }\r\n}\r\n\r\nlemma lemma_OverflowProtectionNotUsedForReplica(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures OverflowProtectionNotUsedForReplica(b[i], idx, asp.c.params, asp.max_clock_ambiguity)\r\n{\r\n TemporalDeduceFromAlways(0, i, OverflowProtectionNotUsedTemporal(b, asp.c.params, asp.max_clock_ambiguity));\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/LivenessProof.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"Phase2Start.i.dfy\"\r\ninclude \"Phase2Conclusion.i.dfy\"\r\ninclude \"StateTransfer.i.dfy\"\r\n\r\nmodule LivenessProof__LivenessProof_i {\r\n\r\nimport opened AppStateMachine_s\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__StateMachine_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__Phase2Start_i\r\nimport opened LivenessProof__Phase2Conclusion_i\r\nimport opened LivenessProof__StateTransfer_i\r\nimport opened CommonProof__Chosen_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Environment_i\r\nimport opened CommonProof__MaxBallotISent1a_i\r\nimport opened CommonProof__Message2a_i\r\nimport opened CommonProof__Message2b_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Environment_s\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Common__UpperBound_s\r\n\r\nlemma lemma_EventuallyLiveReplicaExecutesClientRequest(\r\n b:Behavior,\r\n asp:AssumptionParameters\r\n ) returns (\r\n execute_step:int,\r\n executor_idx:int,\r\n ios:seq\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n ensures asp.synchrony_start <= execute_step\r\n ensures executor_idx in asp.live_quorum\r\n ensures 0 <= executor_idx < |b[execute_step].replicas|\r\n ensures 0 <= executor_idx < |b[execute_step+1].replicas|\r\n ensures RslNextOneReplica(b[execute_step], b[execute_step+1], executor_idx, ios)\r\n ensures var s := b[execute_step].replicas[executor_idx].replica.executor;\r\n && s.next_op_to_execute.OutstandingOpKnown?\r\n && asp.persistent_request in s.next_op_to_execute.v\r\n && LtUpperBound(s.ops_complete, s.constants.all.params.max_integer_val)\r\n && LReplicaConstantsValid(s.constants);\r\n ensures LExecutorExecute(b[execute_step].replicas[executor_idx].replica.executor,\r\n b[execute_step+1].replicas[executor_idx].replica.executor, ExtractSentPacketsFromIos(ios));\r\n{\r\n var h:Phase2Params, step:int, opn_higher:OperationNumber, p:RslPacket;\r\n h, step, opn_higher, p, execute_step, ios := lemma_EventuallyKingExecutesOperationCorrespondingTo2aWithClientRequest(b, asp);\r\n executor_idx := h.king_idx;\r\n\r\n var opn := p.msg.opn_2a;\r\n var bal := p.msg.bal_2a;\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, execute_step);\r\n \r\n var s := b[execute_step].replicas[executor_idx].replica.executor;\r\n var s' := b[execute_step+1].replicas[executor_idx].replica.executor;\r\n\r\n assert BalLeq(s.next_op_to_execute.bal, h.view);\r\n\r\n var q := lemma_DecidedOperationWasChosen(b, asp.c, execute_step, executor_idx);\r\n lemma_QuorumOf1bsFromPhase2StartPrecludesQuorumOf2bsFromEarlierView(b, asp, h, execute_step, q);\r\n assert s.next_op_to_execute.bal == h.view;\r\n\r\n var quorum_idx :| quorum_idx in q.indices;\r\n var packet_2b_from_quorum := q.packets[quorum_idx];\r\n var packet_2a_from_quorum := lemma_2bMessageHasCorresponding2aMessage(b, asp.c, execute_step, packet_2b_from_quorum);\r\n\r\n var latest_step := if execute_step > step then execute_step else step;\r\n lemma_PacketStaysInSentPackets(b, asp.c, execute_step, latest_step, packet_2a_from_quorum);\r\n lemma_PacketStaysInSentPackets(b, asp.c, step, latest_step, p);\r\n \r\n lemma_2aMessagesFromSameBallotAndOperationMatch(b, asp.c, latest_step, packet_2a_from_quorum, p);\r\n assert asp.persistent_request in s.next_op_to_execute.v;\r\n\r\n var x := stepmap(imap j :: packet_2a_from_quorum in b[j].environment.sentPackets);\r\n var send_2a_next_step := earliestStepBetween(0, execute_step, x);\r\n assert sat(send_2a_next_step, x);\r\n\r\n if (send_2a_next_step <= h.start_step)\r\n {\r\n var proposer_idx := lemma_2aMessageImplicationsForProposerState(b, asp.c, send_2a_next_step, packet_2a_from_quorum);\r\n assert proposer_idx == h.view.proposer_id;\r\n lemma_MaxBallotISent1aMonotonic(b, asp.c, send_2a_next_step, h.start_step, proposer_idx);\r\n assert false;\r\n }\r\n\r\n assert asp.synchrony_start <= h.start_step < send_2a_next_step <= execute_step;\r\n}\r\n\r\nlemma lemma_ExecutingRequestBatchWithRequestProducesReply(\r\n app:AppState,\r\n requestBatch:RequestBatch,\r\n req:Request,\r\n replies:seq\r\n ) returns (\r\n i:int,\r\n reply:Reply\r\n )\r\n requires replies == HandleRequestBatch(app, requestBatch).1\r\n requires req in requestBatch\r\n ensures 0 <= i < |requestBatch| == |replies|\r\n ensures req == requestBatch[i]\r\n ensures reply == replies[i]\r\n ensures reply.client == req.client\r\n ensures reply.seqno == req.seqno\r\n{\r\n var states := HandleRequestBatch(app, requestBatch).0;\r\n lemma_HandleRequestBatchTriggerHappy(app, requestBatch, states, replies);\r\n\r\n i :| 0 <= i < |requestBatch| && req == requestBatch[i];\r\n reply := replies[i];\r\n}\r\n\r\nlemma lemma_ExecutingRequestBatchWithRequestProducesReplyMessage(\r\n requestBatch:RequestBatch,\r\n replies:seq,\r\n me:NodeIdentity,\r\n sent_packets:seq,\r\n i:int,\r\n req:Request,\r\n reply:Reply\r\n ) returns (\r\n p:RslPacket\r\n )\r\n requires 0 <= i < |requestBatch| == |replies|\r\n requires req == requestBatch[i]\r\n requires reply == replies[i]\r\n requires sent_packets == GetPacketsFromReplies(me, requestBatch, replies)\r\n requires reply.client == req.client\r\n requires reply.seqno == req.seqno\r\n ensures p in sent_packets\r\n ensures p.src == me\r\n ensures p.dst == req.client\r\n ensures p.msg.RslMessage_Reply?\r\n ensures p.msg.seqno_reply == req.seqno\r\n{\r\n if req == requestBatch[0]\r\n {\r\n p := sent_packets[0];\r\n }\r\n else\r\n {\r\n p := lemma_ExecutingRequestBatchWithRequestProducesReplyMessage(requestBatch[1..], replies[1..], me, sent_packets[1..], i-1, req, reply);\r\n }\r\n}\r\n\r\nlemma lemma_EventuallyLiveReplicaSendsReplyToClientDuringSynchronyPeriod(\r\n b:Behavior,\r\n asp:AssumptionParameters\r\n ) returns (\r\n execute_step:int,\r\n executor_idx:int,\r\n ios:seq,\r\n p:RslPacket\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n ensures asp.synchrony_start <= execute_step\r\n ensures executor_idx in asp.live_quorum\r\n ensures 0 <= executor_idx < |b[execute_step].replicas|\r\n ensures 0 <= executor_idx < |b[execute_step+1].replicas|\r\n ensures LIoOpSend(p) in ios\r\n ensures p.src == asp.c.config.replica_ids[executor_idx]\r\n ensures p.dst == asp.persistent_request.client\r\n ensures p.msg.RslMessage_Reply?\r\n ensures p.msg.seqno_reply == asp.persistent_request.seqno\r\n ensures RslNextOneReplica(b[execute_step], b[execute_step+1], executor_idx, ios)\r\n{\r\n execute_step, executor_idx, ios := lemma_EventuallyLiveReplicaExecutesClientRequest(b, asp);\r\n lemma_ReplicaConstantsAllConsistent(b, asp.c, execute_step, executor_idx);\r\n var s := b[execute_step].replicas[executor_idx].replica.executor;\r\n var replies := HandleRequestBatch(s.app, s.next_op_to_execute.v).1;\r\n var i, reply := lemma_ExecutingRequestBatchWithRequestProducesReply(s.app, s.next_op_to_execute.v, asp.persistent_request, replies);\r\n var me := asp.c.config.replica_ids[executor_idx];\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n p := lemma_ExecutingRequestBatchWithRequestProducesReplyMessage(s.next_op_to_execute.v, replies, me, sent_packets, i, asp.persistent_request, reply);\r\n}\r\n\r\nlemma lemma_LivenessAssumptionsAssumingClientNeverGetsReplyCannotHold(\r\n b:Behavior,\r\n asp:AssumptionParameters\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n ensures false;\r\n{\r\n var execute_step, executor_idx, ios, p := lemma_EventuallyLiveReplicaSendsReplyToClientDuringSynchronyPeriod(b, asp);\r\n var delivery_step := lemma_PacketSentEventuallyDelivered(b, asp, execute_step, p);\r\n lemma_ReplicaConstantsAllConsistent(b, asp.c, delivery_step, executor_idx);\r\n assert ReplyDeliveredDuringStep(b[delivery_step], asp.persistent_request);\r\n TemporalDeduceFromAlways(0, delivery_step, not(ReplyDeliveredTemporal(b, asp.persistent_request)));\r\n assert false;\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/MaxBalReflected.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"ViewChange.i.dfy\"\r\ninclude \"MaxBallot.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../CommonProof/PacketSending.i.dfy\"\r\ninclude \"../CommonProof/MaxBallotISent1a.i.dfy\"\r\n\r\nmodule LivenessProof__MaxBalReflected_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__MaxBallot_i\r\nimport opened LivenessProof__MaxBallotISent1a_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__ViewChange_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened CommonProof__MaxBallotISent1a_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Collections__Seqs_i\r\nimport opened Environment_s\r\n\r\npredicate MaxBalReflectedInvariant(\r\n ps:RslState\r\n )\r\n{\r\n && (forall idx {:trigger PrimaryHasReachedState2OfBallot(ps, ps.replicas[idx].replica.executor.max_bal_reflected)}\r\n :: 0 <= idx < |ps.replicas| ==> PrimaryHasReachedState2OfBallot(ps, ps.replicas[idx].replica.executor.max_bal_reflected))\r\n && (forall p {:trigger p.msg.RslMessage_AppStateSupply?}\r\n :: p in ps.environment.sentPackets && p.src in ps.constants.config.replica_ids && p.msg.RslMessage_AppStateSupply?\r\n ==> PrimaryHasReachedState2OfBallot(ps, p.msg.bal_state_supply))\r\n}\r\n\r\nlemma lemma_IfMaxBalReflectedChangedThenInvariantStillHolds(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires MaxBalReflectedInvariant(b[i])\r\n requires 0 <= idx < |b[i].replicas|\r\n requires 0 <= idx < |b[i+1].replicas|\r\n requires b[i+1].replicas[idx].replica.executor.max_bal_reflected != b[i].replicas[idx].replica.executor.max_bal_reflected\r\n ensures PrimaryHasReachedState2OfBallot(b[i+1], b[i+1].replicas[idx].replica.executor.max_bal_reflected)\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n\r\n var max_bal_reflected := b[i].replicas[idx].replica.executor.max_bal_reflected;\r\n var max_bal_reflected' := b[i+1].replicas[idx].replica.executor.max_bal_reflected;\r\n assert max_bal_reflected' != max_bal_reflected;\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, idx);\r\n var nextActionIndex := b[i].replicas[idx].nextActionIndex;\r\n if nextActionIndex == 0\r\n {\r\n assert LExecutorProcessAppStateSupply(b[i].replicas[idx].replica.executor, b[i+1].replicas[idx].replica.executor, ios[0].r);\r\n var p := ios[0].r;\r\n lemma_PacketProcessedImpliesPacketSent(b[i], b[i+1], idx, ios, p);\r\n assert p in b[i].environment.sentPackets && p.src in b[i].constants.config.replica_ids && p.msg.RslMessage_AppStateSupply?;\r\n assert PrimaryHasReachedState2OfBallot(b[i], p.msg.bal_state_supply);\r\n lemma_PrimaryHasReachedState2OfBallotMaintainedByOneStep(b, asp.c, i, p.msg.bal_state_supply);\r\n assert PrimaryHasReachedState2OfBallot(b[i+1], p.msg.bal_state_supply);\r\n assert max_bal_reflected' == p.msg.bal_state_supply;\r\n assert PrimaryHasReachedState2OfBallot(b[i+1], max_bal_reflected');\r\n }\r\n else if nextActionIndex == 6\r\n {\r\n assert LReplicaNextSpontaneousMaybeExecute(b[i].replicas[idx].replica, b[i+1].replicas[idx].replica, ExtractSentPacketsFromIos(ios));\r\n assert b[i].replicas[idx].replica.executor.next_op_to_execute.OutstandingOpKnown?;\r\n lemma_ExecutorNextOpToExecuteBallotShowsPrimaryReachedState2(b, asp.c, i, idx);\r\n lemma_PrimaryHasReachedState2OfBallotMaintainedByOneStep(b, asp.c, i, b[i].replicas[idx].replica.executor.next_op_to_execute.bal);\r\n assert max_bal_reflected' == b[i].replicas[idx].replica.executor.next_op_to_execute.bal;\r\n assert PrimaryHasReachedState2OfBallot(b[i+1], max_bal_reflected');\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_MaxBalReflectedInvariantHolds(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n ensures MaxBalReflectedInvariant(b[i])\r\n{\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n lemma_MaxBalReflectedInvariantHolds(b, asp, i-1);\r\n\r\n forall idx | 0 <= idx < |b[i].replicas|\r\n ensures PrimaryHasReachedState2OfBallot(b[i], b[i].replicas[idx].replica.executor.max_bal_reflected)\r\n {\r\n var max_bal_reflected := b[i-1].replicas[idx].replica.executor.max_bal_reflected;\r\n var max_bal_reflected' := b[i].replicas[idx].replica.executor.max_bal_reflected;\r\n\r\n if max_bal_reflected' == max_bal_reflected\r\n {\r\n assert 0 <= idx < |b[i-1].replicas|;\r\n assert PrimaryHasReachedState2OfBallot(b[i-1], max_bal_reflected);\r\n lemma_PrimaryHasReachedState2OfBallotMaintainedByOneStep(b, asp.c, i-1, max_bal_reflected);\r\n }\r\n else\r\n {\r\n lemma_IfMaxBalReflectedChangedThenInvariantStillHolds(b, asp, i-1, idx);\r\n }\r\n }\r\n \r\n forall p | p in b[i].environment.sentPackets && p.src in b[i].constants.config.replica_ids && p.msg.RslMessage_AppStateSupply?\r\n ensures PrimaryHasReachedState2OfBallot(b[i], p.msg.bal_state_supply)\r\n {\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n assert PrimaryHasReachedState2OfBallot(b[i-1], p.msg.bal_state_supply);\r\n lemma_PrimaryHasReachedState2OfBallotMaintainedByOneStep(b, asp.c, i-1, p.msg.bal_state_supply);\r\n }\r\n else\r\n {\r\n var idx, ios := lemma_ActionThatSendsAppStateSupplyIsProcessAppStateRequest(b[i-1], b[i], p);\r\n var s := b[i-1].replicas[idx].replica.executor;\r\n assert LExecutorProcessAppStateRequest(b[i-1].replicas[idx].replica.executor, b[i].replicas[idx].replica.executor, ios[0].r, [p]);\r\n Lemma_IdenticalSingletonSequencesHaveIdenticalElement(p, LPacket(ios[0].r.src, asp.c.config.replica_ids[idx], RslMessage_AppStateSupply(s.max_bal_reflected, s.ops_complete, s.app)));\r\n assert 0 <= idx < |b[i-1].replicas|;\r\n assert PrimaryHasReachedState2OfBallot(b[i-1], s.max_bal_reflected);\r\n assert p.msg.bal_state_supply == s.max_bal_reflected;\r\n lemma_PrimaryHasReachedState2OfBallotMaintainedByOneStep(b, asp.c, i-1, p.msg.bal_state_supply);\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_MaxBalReflectedLeqCurrentView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n view:Ballot,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires sat(i, NoReplicaBeyondViewTemporal(b, view))\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures BalLeq(b[i].replicas[idx].replica.executor.max_bal_reflected, view)\r\n{\r\n lemma_NoReplicaBeyondViewImpliesNoMaxBallotISent1aBeyondView(b, asp, i, view);\r\n lemma_MaxBalReflectedInvariantHolds(b, asp, i);\r\n var max_bal_reflected := b[i].replicas[idx].replica.executor.max_bal_reflected;\r\n assert PrimaryHasReachedState2OfBallot(b[i], max_bal_reflected);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/MaxBallot.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"ViewChange.i.dfy\"\r\ninclude \"MaxBallotISent1a.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../CommonProof/MaxBallot.i.dfy\"\r\ninclude \"../CommonProof/PacketSending.i.dfy\"\r\n\r\nmodule LivenessProof__MaxBallot_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__MaxBallotISent1a_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__ViewChange_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__MaxBallot_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened Temporal__Temporal_s\r\n\r\nlemma lemma_WhenStablePeriodStartsEveryMaxBalPrecedesView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int,\r\n ahead_idx:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires StablePeriodStarted(b[i], asp.live_quorum, view, ahead_idx)\r\n ensures BalLt(b[i].replicas[idx].replica.acceptor.max_bal, view)\r\n{\r\n var max_bal := b[i].replicas[idx].replica.acceptor.max_bal;\r\n lemma_MaxBalLeqMaxBallotPrimarySent1a(b, asp.c, i, idx);\r\n assert BalLt(b[i].replicas[max_bal.proposer_id].replica.proposer.max_ballot_i_sent_1a, view); // TRIGGER\r\n}\r\n\r\nlemma lemma_DuringStablePeriodNoMaxBalBeyondView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires NoMaxBallotISent1aBeyondView(b[i], view)\r\n ensures BalLeq(b[i].replicas[idx].replica.acceptor.max_bal, view)\r\n{\r\n var max_bal := b[i].replicas[idx].replica.acceptor.max_bal;\r\n lemma_MaxBalLeqMaxBallotPrimarySent1a(b, asp.c, i, idx);\r\n assert BalLeq(b[i].replicas[max_bal.proposer_id].replica.proposer.max_ballot_i_sent_1a, view); // TRIGGER\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/MaxBallotISent1a.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"ViewChange.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\n\r\nmodule LivenessProof__MaxBallotISent1a_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__ViewChange_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened Temporal__Temporal_s\r\n\r\nlemma lemma_MaxBallotISent1aLeqView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures BalLeq(b[i].replicas[idx].replica.proposer.max_ballot_i_sent_1a, b[i].replicas[idx].replica.proposer.election_state.current_view)\r\n decreases i\r\n{\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_MaxBallotISent1aLeqView(b, asp, i-1, idx);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n lemma_BalLtProperties();\r\n\r\n if b[i].replicas[idx].replica.proposer.max_ballot_i_sent_1a != b[i-1].replicas[idx].replica.proposer.max_ballot_i_sent_1a\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i-1, idx);\r\n }\r\n else\r\n {\r\n lemma_ViewOfHostMonotonic(b, asp, idx, i-1, i);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_NoReplicaBeyondViewImpliesNoMaxBallotISent1aBeyondView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires NoReplicaBeyondView(b[i], view)\r\n ensures NoMaxBallotISent1aBeyondView(b[i], view)\r\n{\r\n forall idx | 0 <= idx < |b[i].replicas|\r\n ensures BalLeq(b[i].replicas[idx].replica.proposer.max_ballot_i_sent_1a, view)\r\n {\r\n assert BalLeq(CurrentViewOfHost(b[i], idx), view);\r\n lemma_MaxBallotISent1aLeqView(b, asp, i, idx);\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/NextOp.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"Catchup.i.dfy\"\r\ninclude \"WF1.i.dfy\"\r\n\r\nmodule LivenessProof__NextOp_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Catchup_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__GenericInvariants_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__Phase2Invariants_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__WF1_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__LogTruncationPoint_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__WF1_i\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\n\r\npredicate AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmpty(\r\n ps:RslState,\r\n live_quorum:set,\r\n view:Ballot,\r\n opn:OperationNumber\r\n )\r\n{\r\n && 0 <= view.proposer_id < |ps.replicas|\r\n && var s := ps.replicas[view.proposer_id].replica.proposer;\r\n && |s.request_queue| == 0\r\n && AllLiveReplicasReadyForNextOperation(ps, live_quorum, view, s.next_operation_number_to_propose)\r\n && s.next_operation_number_to_propose <= opn\r\n}\r\n\r\nfunction{:opaque} AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(\r\n b:Behavior,\r\n live_quorum:set,\r\n view:Ballot,\r\n opn:OperationNumber\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, live_quorum, view, opn))} ::\r\n sat(i, AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, live_quorum, view, opn)) ==\r\n AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmpty(b[i], live_quorum, view, opn)\r\n{\r\n stepmap(imap i :: AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmpty(b[i], live_quorum, view, opn))\r\n}\r\n\r\npredicate ProposerStartsBatchTimer(\r\n ps:RslState,\r\n idx:int\r\n )\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && ps.replicas[idx].replica.proposer.incomplete_batch_timer.IncompleteBatchTimerOn?\r\n}\r\n\r\nfunction{:opaque} ProposerStartsBatchTimerTemporal(\r\n b:Behavior,\r\n idx:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, ProposerStartsBatchTimerTemporal(b, idx))} ::\r\n sat(i, ProposerStartsBatchTimerTemporal(b, idx)) ==\r\n ProposerStartsBatchTimer(b[i], idx)\r\n{\r\n stepmap(imap i :: ProposerStartsBatchTimer(b[i], idx))\r\n}\r\n\r\npredicate ProposerExceedsCertainNextOp(\r\n ps:RslState,\r\n idx:int,\r\n opn:int\r\n )\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && ps.replicas[idx].replica.proposer.next_operation_number_to_propose > opn\r\n}\r\n\r\nfunction{:opaque} ProposerExceedsCertainNextOpTemporal(\r\n b:Behavior,\r\n idx:int,\r\n opn:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, ProposerExceedsCertainNextOpTemporal(b, idx, opn))} ::\r\n sat(i, ProposerExceedsCertainNextOpTemporal(b, idx, opn)) == ProposerExceedsCertainNextOp(b[i], idx, opn)\r\n{\r\n stepmap(imap i :: ProposerExceedsCertainNextOp(b[i], idx, opn))\r\n}\r\n\r\npredicate ProposerHasCertainNextOpAndNonemptyRequestQueue(\r\n ps:RslState,\r\n idx:int,\r\n opn:int\r\n )\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && var s := ps.replicas[idx].replica;\r\n && s.proposer.next_operation_number_to_propose == opn\r\n && |s.proposer.request_queue| > 0\r\n && s.acceptor.log_truncation_point >= opn\r\n}\r\n\r\nfunction{:opaque} ProposerHasCertainNextOpAndNonemptyRequestQueueTemporal(\r\n b:Behavior,\r\n idx:int,\r\n opn:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, ProposerHasCertainNextOpAndNonemptyRequestQueueTemporal(b, idx, opn))} ::\r\n sat(i, ProposerHasCertainNextOpAndNonemptyRequestQueueTemporal(b, idx, opn)) == ProposerHasCertainNextOpAndNonemptyRequestQueue(b[i], idx, opn)\r\n{\r\n stepmap(imap i :: ProposerHasCertainNextOpAndNonemptyRequestQueue(b[i], idx, opn))\r\n}\r\n\r\npredicate ProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimer(\r\n ps:RslState,\r\n idx:int,\r\n opn:int,\r\n timerExpiration:int\r\n )\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && var s := ps.replicas[idx].replica;\r\n && s.proposer.next_operation_number_to_propose == opn\r\n && |s.proposer.request_queue| > 0\r\n && s.acceptor.log_truncation_point >= opn\r\n && s.proposer.incomplete_batch_timer == IncompleteBatchTimerOn(timerExpiration)\r\n}\r\n\r\nfunction{:opaque} ProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimerTemporal(\r\n b:Behavior,\r\n idx:int,\r\n opn:int,\r\n timerExpiration:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, ProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimerTemporal(b, idx, opn, timerExpiration))} ::\r\n sat(i, ProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimerTemporal(b, idx, opn, timerExpiration)) == ProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimer(b[i], idx, opn, timerExpiration)\r\n{\r\n stepmap(imap i :: ProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimer(b[i], idx, opn, timerExpiration))\r\n}\r\n\r\nlemma lemma_IfProposerHasCertainNextOpAndNonemptyRequestQueueThenProposerEventuallyStartsBatchTimerHelper(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n i:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires prev_step <= i\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires ProposerHasCertainNextOpAndNonemptyRequestQueue(b[prev_step], h.view.proposer_id, opn)\r\n requires && ProposerHasCertainNextOpAndNonemptyRequestQueue(b[i], h.view.proposer_id, opn)\r\n && AllLiveReplicasReadyForNextOperation(b[i], asp.live_quorum, h.view, opn)\r\n requires !(&& ProposerHasCertainNextOpAndNonemptyRequestQueue(b[i+1], h.view.proposer_id, opn)\r\n && AllLiveReplicasReadyForNextOperation(b[i+1], asp.live_quorum, h.view, opn))\r\n requires !(&& ProposerStartsBatchTimer(b[i], h.view.proposer_id)\r\n && AllLiveReplicasReadyForNextOperation(b[i], asp.live_quorum, h.view, opn))\r\n requires !(&& ProposerExceedsCertainNextOp(b[i], h.view.proposer_id, opn)\r\n && AllLiveReplicasReadyForNextOperation(b[i], asp.live_quorum, h.view, opn))\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n requires !(&& ProposerStartsBatchTimer(b[i+1], h.view.proposer_id)\r\n && AllLiveReplicasReadyForNextOperation(b[i+1], asp.live_quorum, h.view, opn))\r\n requires !(&& ProposerExceedsCertainNextOp(b[i+1], h.view.proposer_id, opn)\r\n && AllLiveReplicasReadyForNextOperation(b[i+1], asp.live_quorum, h.view, opn))\r\n requires NoReplicaBeyondView(b[i+1], h.view)\r\n ensures false\r\n{\r\n var idx := h.view.proposer_id;\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i+1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n lemma_IfAllLiveReplicasReadyForNextOperationThenSoLaterInPhase2(b, asp, h, opn, prev_step, i+1);\r\n lemma_LogTruncationPointMonotonicOneStep(b, asp.c, i, idx);\r\n lemma_IfAllLiveReplicasReadyForNextOperationThenSoLaterInPhase2(b, asp, h, opn, prev_step, i+1);\r\n lemma_LogTruncationPointMonotonicOneStep(b, asp.c, i, idx);\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, idx);\r\n}\r\n\r\nlemma lemma_IfProposerHasCertainNextOpAndNonemptyRequestQueueThenProposerEventuallyStartsBatchTimer(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires ProposerHasCertainNextOpAndNonemptyRequestQueue(b[prev_step], h.view.proposer_id, opn)\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := TimeToPerformGenericAction(asp);\r\n var w := and(ProposerStartsBatchTimerTemporal(b, h.view.proposer_id), AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn));\r\n var x := and(ProposerExceedsCertainNextOpTemporal(b, h.view.proposer_id, opn), AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn));\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(w, or(x, or(y, not(z)))), b[prev_step].environment.time + t, f))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var t := TimeToPerformGenericAction(asp);\r\n var w := and(ProposerStartsBatchTimerTemporal(b, h.view.proposer_id), AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn));\r\n var x := and(ProposerExceedsCertainNextOpTemporal(b, h.view.proposer_id, opn), AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn));\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n \r\n var idx := h.view.proposer_id;\r\n \r\n var P := and(ProposerHasCertainNextOpAndNonemptyRequestQueueTemporal(b, h.view.proposer_id, opn), AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn));\r\n var Q := or(w, or(x, not(z)));\r\n var Action := MakeRslActionTemporalFromReadClockReplicaFunction(b, LReplicaNextReadClockMaybeNominateValueAndSend2a, idx);\r\n\r\n forall i | prev_step <= i\r\n ensures sat(i, TemporalWF1Req1(P, Q))\r\n ensures sat(i, TemporalWF1Req2(P, Q, Action))\r\n {\r\n if sat(i, P) && !sat(i, Q) && !sat(i+1, Q)\r\n {\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i+1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n if !sat(i+1, P)\r\n {\r\n lemma_IfProposerHasCertainNextOpAndNonemptyRequestQueueThenProposerEventuallyStartsBatchTimerHelper(b, asp, h, opn, prev_step, i);\r\n }\r\n if sat(i, Action)\r\n {\r\n assert SpecificClockReadingRslActionOccurs(b[i], b[i+1], LReplicaNextReadClockMaybeNominateValueAndSend2a, idx);\r\n var ios:seq :| && RslNextOneReplica(b[i], b[i+1], idx, ios)\r\n && SpontaneousIos(ios, 1)\r\n && LReplicaNextReadClockMaybeNominateValueAndSend2a(b[i].replicas[idx].replica,\r\n b[i+1].replicas[idx].replica,\r\n SpontaneousClock(ios),\r\n ExtractSentPacketsFromIos(ios));\r\n if sat(i, not(z))\r\n {\r\n assert sat(i, Q);\r\n assert false;\r\n }\r\n else\r\n {\r\n lemma_ProposerCanNominateInPhase2(b, asp, h, i);\r\n var s := b[i].replicas[idx].replica;\r\n assert s.acceptor.log_truncation_point >= s.proposer.next_operation_number_to_propose;\r\n assert s.proposer.next_operation_number_to_propose < s.acceptor.log_truncation_point + asp.c.params.max_log_length;\r\n assert LProposerCanNominateUsingOperationNumber(s.proposer, s.acceptor.log_truncation_point,\r\n s.proposer.next_operation_number_to_propose);\r\n lemma_IfAllLiveReplicasReadyForNextOperationThenSoLaterInPhase2(b, asp, h, opn, prev_step, i+1);\r\n assert LProposerNominateNewValueAndSend2a(s.proposer, b[i+1].replicas[idx].replica.proposer, ios[0].t,\r\n s.acceptor.log_truncation_point, ExtractSentPacketsFromIos(ios));\r\n assert ProposerStartsBatchTimer(b[i+1], h.view.proposer_id);\r\n assert sat(i+1, ProposerStartsBatchTimerTemporal(b, h.view.proposer_id));\r\n assert false;\r\n }\r\n }\r\n }\r\n }\r\n TemporalAlways(prev_step, TemporalWF1Req1(P, Q));\r\n TemporalAlways(prev_step, TemporalWF1Req2(P, Q, Action));\r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, idx, 3);\r\n lemma_EstablishRequirementsForWF1RealTime(b, asp, prev_step, Action, t);\r\n TemporalWF1RealTime(prev_step, P, Q, Action, t, f);\r\n\r\n TemporalDeduceFromAlways(prev_step, prev_step, imply(P, eventuallywithin(Q, t, f)));\r\n assert sat(prev_step, P);\r\n step := TemporalDeduceFromEventual(prev_step, beforeabsolutetime(Q, b[prev_step].environment.time + t, f));\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationThenProposerEventuallyStartsBatchTimer(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + TimeToPerformGenericAction(asp);\r\n var w := and(ProposerStartsBatchTimerTemporal(b, h.view.proposer_id), AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn));\r\n var x := and(ProposerExceedsCertainNextOpTemporal(b, h.view.proposer_id, opn), AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn));\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(w, or(x, or(y, not(z)))), t, f))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + TimeToPerformGenericAction(asp);\r\n var w := and(ProposerStartsBatchTimerTemporal(b, h.view.proposer_id), AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn));\r\n var x := and(ProposerExceedsCertainNextOpTemporal(b, h.view.proposer_id, opn), AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn));\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n \r\n var idx := h.view.proposer_id;\r\n lemma_ConstantsAllConsistent(b, asp.c, prev_step);\r\n var s := b[prev_step].replicas[idx].replica.proposer;\r\n\r\n if !sat(prev_step, z)\r\n {\r\n step := prev_step;\r\n assert sat(step, beforeabsolutetime(not(z), t, f));\r\n return;\r\n }\r\n \r\n if s.next_operation_number_to_propose > opn\r\n {\r\n step := prev_step;\r\n assert sat(step, beforeabsolutetime(x, t, f));\r\n return;\r\n }\r\n\r\n if |s.request_queue| == 0\r\n {\r\n step := prev_step;\r\n assert sat(step, y);\r\n return;\r\n }\r\n\r\n step := lemma_IfProposerHasCertainNextOpAndNonemptyRequestQueueThenProposerEventuallyStartsBatchTimer(b, asp, h, opn, prev_step);\r\n}\r\n\r\nlemma lemma_IfProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimerThenProposerEventuallyAdvancesNextOpHelper(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n timerExpiration:int,\r\n i:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires ProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimer(b[prev_step], h.view.proposer_id, opn, timerExpiration)\r\n requires prev_step <= i\r\n requires ProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimer(b[i], h.view.proposer_id, opn, timerExpiration)\r\n requires !ProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimer(b[i+1], h.view.proposer_id, opn, timerExpiration)\r\n requires !(&& ProposerExceedsCertainNextOp(b[i], h.view.proposer_id, opn)\r\n && AllLiveReplicasReadyForNextOperation(b[i], asp.live_quorum, h.view, opn))\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n requires !(&& ProposerExceedsCertainNextOp(b[i+1], h.view.proposer_id, opn)\r\n && AllLiveReplicasReadyForNextOperation(b[i+1], asp.live_quorum, h.view, opn))\r\n requires NoReplicaBeyondView(b[i+1], h.view)\r\n ensures false\r\n{\r\n var idx := h.view.proposer_id;\r\n\r\n lemma_ProposerBatchTimerNeverTooFarInFuture(b, asp, prev_step, idx);\r\n lemma_ConstantsAllConsistent(b, asp.c, prev_step);\r\n assert timerExpiration <= b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity;\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i+1);\r\n lemma_IfAllLiveReplicasReadyForNextOperationThenSoLaterInPhase2(b, asp, h, opn, prev_step, i+1);\r\n lemma_LogTruncationPointMonotonicOneStep(b, asp.c, i, idx);\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, idx);\r\n}\r\n\r\nlemma lemma_IfProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimerThenProposerEventuallyAdvancesNextOp(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n timerExpiration:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires ProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimer(b[prev_step], h.view.proposer_id, opn, timerExpiration)\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp);\r\n var x := and(ProposerExceedsCertainNextOpTemporal(b, h.view.proposer_id, opn), AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn));\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(x, not(z)), b[prev_step].environment.time + t, f))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var t := asp.c.params.max_batch_delay + TimeToPerformGenericAction(asp);\r\n var x := and(ProposerExceedsCertainNextOpTemporal(b, h.view.proposer_id, opn), AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn));\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n \r\n var idx := h.view.proposer_id;\r\n\r\n lemma_ProposerBatchTimerNeverTooFarInFuture(b, asp, prev_step, idx);\r\n lemma_ConstantsAllConsistent(b, asp.c, prev_step);\r\n assert timerExpiration <= b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity;\r\n \r\n var P := ProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimerTemporal(b, h.view.proposer_id, opn, timerExpiration);\r\n assert sat(prev_step, P);\r\n var Q := or(x, not(z));\r\n var Action := MakeRslActionTemporalFromReadClockReplicaFunction(b, LReplicaNextReadClockMaybeNominateValueAndSend2a, idx);\r\n\r\n forall i | prev_step <= i\r\n ensures sat(i, TemporalWF1Req1(P, Q))\r\n ensures sat(i, TemporalWF1RealTimeDelayedReq2(P, Q, Action, timerExpiration + asp.max_clock_ambiguity, f))\r\n {\r\n if sat(i, P) && !sat(i, Q) && !sat(i+1, Q)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i+1);\r\n if !sat(i+1, P)\r\n {\r\n lemma_IfProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimerThenProposerEventuallyAdvancesNextOpHelper(\r\n b, asp, h, opn, prev_step, timerExpiration, i);\r\n }\r\n if sat(i, nextafter(Action, timerExpiration + asp.max_clock_ambiguity, f))\r\n {\r\n assert SpecificClockReadingRslActionOccurs(b[i], b[i+1], LReplicaNextReadClockMaybeNominateValueAndSend2a, idx);\r\n var ios:seq :| && RslNextOneReplica(b[i], b[i+1], idx, ios)\r\n && SpontaneousIos(ios, 1)\r\n && LReplicaNextReadClockMaybeNominateValueAndSend2a(b[i].replicas[idx].replica,\r\n b[i+1].replicas[idx].replica,\r\n SpontaneousClock(ios),\r\n ExtractSentPacketsFromIos(ios));\r\n if sat(i, not(z))\r\n {\r\n assert sat(i, Q);\r\n assert false;\r\n }\r\n else\r\n {\r\n lemma_ProposerCanNominateInPhase2(b, asp, h, i);\r\n var s := b[i].replicas[idx].replica;\r\n assert s.acceptor.log_truncation_point >= s.proposer.next_operation_number_to_propose;\r\n assert s.proposer.next_operation_number_to_propose < s.acceptor.log_truncation_point + asp.c.params.max_log_length;\r\n assert LProposerCanNominateUsingOperationNumber(s.proposer, s.acceptor.log_truncation_point, s.proposer.next_operation_number_to_propose);\r\n assert ios[0].LIoOpReadClock?;\r\n lemma_ClockAmbiguityLimitApplies(b, asp, i, idx, ios[0]);\r\n assert ios[0].t >= b[i+1].environment.time - asp.max_clock_ambiguity;\r\n assert ios[0].t >= timerExpiration;\r\n assert false;\r\n }\r\n }\r\n }\r\n }\r\n TemporalAlways(prev_step, TemporalWF1Req1(P, Q));\r\n TemporalAlways(prev_step, TemporalWF1RealTimeDelayedReq2(P, Q, Action, timerExpiration + asp.max_clock_ambiguity, f));\r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, idx, 3);\r\n lemma_EstablishRequirementsForWF1RealTimeDelayed(b, asp, prev_step, Action, TimeToPerformGenericAction(asp));\r\n step := TemporalWF1RealTimeDelayed(prev_step, P, Q, Action, TimeToPerformGenericAction(asp), timerExpiration + asp.max_clock_ambiguity, f);\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationThenProposerEventuallyAdvancesNextOp(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 2;\r\n var x := and(ProposerExceedsCertainNextOpTemporal(b, h.view.proposer_id, opn), AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn));\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(x, or(y, not(z))), t, f))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 2;\r\n var x := and(ProposerExceedsCertainNextOpTemporal(b, h.view.proposer_id, opn), AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn));\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n var idx := h.view.proposer_id;\r\n\r\n var first_step := lemma_IfLiveReplicasReadyForAnOperationThenProposerEventuallyStartsBatchTimer(b, asp, h, opn, prev_step);\r\n assert sat(first_step, before(t, f));\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, first_step);\r\n var s := b[first_step].replicas[idx].replica.proposer;\r\n\r\n if !sat(first_step, z)\r\n {\r\n step := first_step;\r\n assert sat(step, beforeabsolutetime(not(z), t, f));\r\n return;\r\n }\r\n \r\n if s.next_operation_number_to_propose > opn\r\n {\r\n step := first_step;\r\n assert sat(step, x);\r\n return;\r\n }\r\n\r\n if |s.request_queue| == 0\r\n {\r\n step := first_step;\r\n assert sat(step, y);\r\n return;\r\n }\r\n\r\n step := lemma_IfProposerHasCertainNextOpAndNonemptyRequestQueueAndBatchTimerThenProposerEventuallyAdvancesNextOp(b, asp, h, opn, first_step, s.incomplete_batch_timer.when);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/PacketHandling.i.dfy", "content": "include \"RealTime.i.dfy\"\r\ninclude \"RoundRobin.i.dfy\"\r\ninclude \"../CommonProof/Environment.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Heuristics.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Rules.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Time.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/LeadsTo.i.dfy\"\r\ninclude \"../../../Common/Framework/EnvironmentSynchronyLemmas.i.dfy\"\r\ninclude \"../../../../Libraries/Math/mul.i.dfy\"\r\ninclude \"../../../../Libraries/Math/mul_auto.i.dfy\"\r\n\r\nmodule LivenessProof__PacketHandling_i {\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LivenessProof__RealTime_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Environment_i\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Time_i\r\nimport opened Temporal__LeadsTo_i\r\nimport opened Liveness__EnvironmentSynchronyLemmas_i\r\nimport opened Liveness__HostQueueLemmas_i\r\nimport opened Math__mul_i\r\nimport opened Math__mul_auto_i\r\nimport opened Math__mul_nonlinear_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Maps2_i\r\nimport opened Environment_s\r\nimport opened EnvironmentSynchrony_s\r\nimport opened Concrete_NodeIdentity_i\r\n\r\npredicate AllPacketsProcessedWithin(\r\n b:Behavior,\r\n i:int,\r\n processing_period:int,\r\n sources:set,\r\n destinations:set\r\n )\r\n requires imaptotal(b)\r\n{\r\n forall p {:trigger PacketSentBetweenHosts(b[i].environment, p, sources, destinations)} ::\r\n PacketSentBetweenHosts(b[i].environment, p, sources, destinations) ==>\r\n sat(i, eventuallynextwithin(PacketProcessedTemporal(b, p), processing_period, PaxosTimeMap(b)))\r\n}\r\n\r\nfunction{:opaque} AllPacketsProcessedWithinTemporal(\r\n b:Behavior,\r\n processing_period:int,\r\n sources:set,\r\n destinations:set\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, AllPacketsProcessedWithinTemporal(b, processing_period, sources, destinations))} ::\r\n sat(i, AllPacketsProcessedWithinTemporal(b, processing_period, sources, destinations)) <==>\r\n AllPacketsProcessedWithin(b, i, processing_period, sources, destinations)\r\n{\r\n stepmap(imap i :: AllPacketsProcessedWithin(b, i, processing_period, sources, destinations))\r\n}\r\n\r\n\r\nlemma lemma_LReplicaNextProcessPacketOnlyReceivesOnePacket(\r\n s:LReplica,\r\n s':LReplica,\r\n p:RslPacket,\r\n ios:seq\r\n )\r\n requires LReplicaNextProcessPacket(s, s', ios)\r\n requires LIoOpReceive(p) in ios\r\n ensures ios[0] == LIoOpReceive(p)\r\n{\r\n Lemma_IfOpSeqIsCompatibleWithReductionAndFirstIsntReceiveThenNoneAreReceives(ios);\r\n assert ios[0].LIoOpReceive?;\r\n\r\n forall i | 0 < i < |ios|\r\n ensures !ios[i].LIoOpReceive?\r\n {\r\n if ios[0].r.msg.RslMessage_Heartbeat?\r\n {\r\n if i == 1\r\n {\r\n assert ios[i].LIoOpReadClock?;\r\n }\r\n else\r\n {\r\n assert ios[i] in ios[2..];\r\n assert ios[i].LIoOpSend?;\r\n }\r\n }\r\n else\r\n {\r\n assert ios[i] in ios[1..];\r\n assert ios[i].LIoOpSend?;\r\n }\r\n }\r\n assert ios[0] == LIoOpReceive(p);\r\n}\r\n\r\n\r\nlemma lemma_PacketReceiveCausesPacketProcessing(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n p:RslPacket,\r\n i:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires p.dst in asp.c.config.replica_ids\r\n requires sat(i, PacketReceivedTemporal(RestrictBehaviorToEnvironment(b), p))\r\n ensures PacketProcessedDuringAction(b[i], p)\r\n{\r\n var eb := RestrictBehaviorToEnvironment(b);\r\n var ps := b[i];\r\n var ps' := b[i+1];\r\n\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n lemma_HostQueuesNext(b, asp, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n\r\n assert sat(i, PacketReceivedTemporal(eb, p));\r\n assert PacketReceivedDuringAction(ps.environment, p);\r\n var ios := ps.environment.nextStep.ios;\r\n var io := LIoOpReceive(p);\r\n assert io in ios;\r\n assert IsValidLIoOp(io, p.dst, ps.environment);\r\n\r\n Lemma_ReceiveMakesHostQueueSmaller(ps.environment.hostInfo[p.dst].queue, ps'.environment.hostInfo[p.dst].queue, ios, p);\r\n assert ps'.environment.hostInfo[p.dst].queue != ps.environment.hostInfo[p.dst].queue;\r\n\r\n if (exists idx, ios' :: RslNextOneReplica(ps, ps', idx, ios'))\r\n {\r\n var idx, ios' :| RslNextOneReplica(ps, ps', idx, ios');\r\n Lemma_ReceiveRemovesPacketFromHostQueue(ps.environment.hostInfo[p.dst].queue, ps'.environment.hostInfo[p.dst].queue, ios, p);\r\n Lemma_RemovePacketFromHostQueueImpliesReceive(ps.environment.hostInfo[p.dst].queue, ps'.environment.hostInfo[p.dst].queue, ios', p);\r\n assert io in ios';\r\n lemma_LReplicaNextProcessPacketOnlyReceivesOnePacket(ps.replicas[idx].replica, ps'.replicas[idx].replica, p, ios');\r\n assert PacketProcessedViaIos(b[i], b[i+1], p, idx, ios');\r\n }\r\n else if (exists eid, ios' :: RslNextOneExternal(ps, ps', eid, ios'))\r\n {\r\n var eid, ios' :| RslNextOneExternal(ps, ps', eid, ios');\r\n assert eid !in ps.constants.config.replica_ids;\r\n assert p.dst != eid;\r\n assert HostQueue_PerformIos(ps.environment.hostInfo[p.dst].queue, ps'.environment.hostInfo[p.dst].queue, []);\r\n assert ps'.environment.hostInfo[p.dst] == ps.environment.hostInfo[p.dst];\r\n assert false;\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n}\r\n\r\n\r\nlemma lemma_IfPacketsSynchronousForHostsThenSynchronousForFewerHosts(\r\n b:Behavior>,\r\n sync_start:int,\r\n latency_bound:int,\r\n sources:set,\r\n destinations:set,\r\n sources':set,\r\n destinations':set\r\n )\r\n requires LEnvironment_BehaviorSatisfiesSpec(b)\r\n requires NetworkSynchronousForHosts(b, sync_start, latency_bound, sources, destinations)\r\n requires 0 <= sync_start\r\n requires sources' <= sources\r\n requires destinations' <= destinations\r\n ensures NetworkSynchronousForHosts(b, sync_start, latency_bound, sources', destinations')\r\n{\r\n forall i | sync_start <= i\r\n ensures sat(i, PacketsSynchronousForHostsTemporal(b, latency_bound, sources', destinations'))\r\n {\r\n forall p | PacketSentBetweenHosts(b[i], p, sources', destinations')\r\n ensures sat(i, next(eventuallynextwithin(PacketDeliveredTemporal(b, p), latency_bound, BehaviorToTimeMap(b))))\r\n {\r\n assert PacketSentBetweenHosts(b[i], p, sources, destinations);\r\n TemporalDeduceFromAlways(sync_start, i, PacketsSynchronousForHostsTemporal(b, latency_bound, sources, destinations));\r\n lemma_PacketSentAppearsInSentPacketsEnvironment(b, i, p);\r\n }\r\n }\r\n TemporalAlways(sync_start, PacketsSynchronousForHostsTemporal(b, latency_bound, sources', destinations'));\r\n}\r\n\r\nlemma lemma_AllPacketsReceivedInTime(\r\n b:Behavior,\r\n asp:AssumptionParameters\r\n ) returns (\r\n processing_sync_start:int,\r\n processing_bound:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n ensures asp.synchrony_start <= processing_sync_start\r\n ensures processing_bound == asp.latency_bound + asp.burst_size * TimeToPerformGenericAction(asp)\r\n ensures var eb := RestrictBehaviorToEnvironment(b);\r\n var sources := SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids) + {asp.persistent_request.client};\r\n var destinations := SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids);\r\n sat(processing_sync_start, always(AllPacketsReceivedWithinTemporal(eb, processing_bound, sources, destinations)))\r\n{\r\n var eb := RestrictBehaviorToEnvironment(b);\r\n var sources := SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids) + {asp.persistent_request.client};\r\n var destinations := SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids);\r\n var receive_period := TimeToPerformGenericAction(asp);\r\n var burst_period := asp.burst_size * TimeToPerformGenericAction(asp) + 1;\r\n var real_time_fun := PaxosTimeMap(b);\r\n\r\n lemma_mul_is_associative(asp.burst_size, asp.host_period, LReplicaNumActions());\r\n \r\n forall i {:trigger real_time_fun[i]} {:trigger BehaviorToTimeMap(eb)[i]}\r\n ensures real_time_fun[i] == BehaviorToTimeMap(eb)[i]\r\n {\r\n }\r\n assert real_time_fun == BehaviorToTimeMap(eb);\r\n\r\n lemma_AssumptionsMakeValidEnvironmentBehavior(b, asp.c);\r\n assert LEnvironment_BehaviorSatisfiesSpec(eb);\r\n\r\n assert NetworkSynchronousForHosts(eb, asp.synchrony_start, asp.latency_bound, sources, sources);\r\n lemma_IfPacketsSynchronousForHostsThenSynchronousForFewerHosts(eb, asp.synchrony_start, asp.latency_bound, sources,\r\n sources, sources, destinations);\r\n assert NetworkSynchronousForHosts(eb, asp.synchrony_start, asp.latency_bound, sources, destinations);\r\n assert sat(asp.synchrony_start, always(PacketsSynchronousForHostsTemporal(eb, asp.latency_bound, sources, destinations)));\r\n TemporalEventually(0, asp.synchrony_start, always(PacketsSynchronousForHostsTemporal(eb, asp.latency_bound, sources, destinations)));\r\n\r\n forall host | host in destinations\r\n ensures sat(0, eventual(always(NetworkDeliveryRateForHostBoundedTemporal(eb, asp.burst_size, burst_period, host))))\r\n {\r\n var replica_index :| replica_index in asp.live_quorum && host == asp.c.config.replica_ids[replica_index];\r\n assert sat(asp.synchrony_start, always(NetworkDeliveryRateForHostBoundedTemporal(eb, asp.burst_size, burst_period, host)));\r\n TemporalEventually(0, asp.synchrony_start, always(NetworkDeliveryRateForHostBoundedTemporal(eb, asp.burst_size, burst_period, host)));\r\n }\r\n \r\n lemma_mul_is_associative(asp.burst_size, asp.host_period, LReplicaNumActions());\r\n assert forall host :: host in destinations ==> sat(0, eventual(always(NetworkDeliveryRateForHostBoundedTemporal(eb, asp.burst_size, asp.burst_size * receive_period + 1, host))));\r\n\r\n forall host | host in destinations\r\n ensures sat(asp.synchrony_start, always(eventuallynextwithin(ReceiveAttemptedTemporal(eb, host), receive_period, real_time_fun)))\r\n {\r\n var replica_index :| replica_index in asp.live_quorum && host == asp.c.config.replica_ids[replica_index];\r\n lemma_ReplicaNextPerformsProcessPacketPeriodically(b, asp, replica_index);\r\n }\r\n\r\n forall ensures 1 <= receive_period { lemma_mul_inequality_forall(); lemma_mul_auto(); }\r\n forall i, j | 0 <= i <= j ensures b[i].environment.time <= b[j].environment.time { lemma_TimeAdvancesBetween(b, asp, i, j); }\r\n processing_sync_start, processing_bound := Lemma_EventuallyAllPacketsAlwaysReceivedInTime(asp.synchrony_start, asp.latency_bound, sources, destinations, eb, asp.burst_size, receive_period);\r\n}\r\n\r\npredicate PacketProcessingSynchronousOneStep(\r\n b:Behavior,\r\n i:int,\r\n processing_bound:int,\r\n sources:set,\r\n destinations:set\r\n )\r\n requires imaptotal(b)\r\n{\r\n forall p {:trigger PacketSentDuringAction(b[i], p)} ::\r\n PacketSentDuringAction(b[i], p) && p.src in sources && p.dst in destinations\r\n ==> sat(i, next(eventuallynextwithin(PacketProcessedTemporal(b, p), processing_bound, PaxosTimeMap(b))))\r\n}\r\n\r\nfunction{:opaque} PacketProcessingSynchronousTemporal(\r\n b:Behavior,\r\n processing_bound:int,\r\n sources:set,\r\n destinations:set\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, PacketProcessingSynchronousTemporal(b, processing_bound, sources, destinations))} ::\r\n sat(i, PacketProcessingSynchronousTemporal(b, processing_bound, sources, destinations)) <==>\r\n PacketProcessingSynchronousOneStep(b, i, processing_bound, sources, destinations)\r\n{\r\n stepmap(imap i :: PacketProcessingSynchronousOneStep(b, i, processing_bound, sources, destinations))\r\n}\r\n\r\npredicate PacketProcessingSynchronous(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n processing_bound:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n{\r\n var sources := SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids) + {asp.persistent_request.client};\r\n var destinations := SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids);\r\n && asp.synchrony_start <= start_step\r\n && processing_bound >= 0\r\n && sat(start_step, always(PacketProcessingSynchronousTemporal(b, processing_bound, sources, destinations)))\r\n}\r\n\r\n\r\nlemma lemma_EventuallyPacketProcessingSynchronous(\r\n b:Behavior,\r\n asp:AssumptionParameters\r\n ) returns (\r\n processing_sync_start:int,\r\n processing_bound:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n ensures PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n{\r\n TemporalAssist();\r\n\r\n var eb := RestrictBehaviorToEnvironment(b);\r\n var f := PaxosTimeMap(b);\r\n var sources := SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids) + {asp.persistent_request.client};\r\n var destinations := SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids);\r\n var receive_period := TimeToPerformGenericAction(asp);\r\n\r\n processing_sync_start, processing_bound := lemma_AllPacketsReceivedInTime(b, asp);\r\n\r\n forall i | processing_sync_start <= i\r\n ensures sat(i, PacketProcessingSynchronousTemporal(b, processing_bound, sources, destinations))\r\n {\r\n forall p{:trigger PacketSentDuringAction(b[i], p)} | PacketSentDuringAction(b[i], p) && p.src in sources && p.dst in destinations\r\n ensures sat(i+1, eventuallynextwithin(PacketProcessedTemporal(b, p), processing_bound, f))\r\n {\r\n TemporalDeduceFromAlways(processing_sync_start, i, AllPacketsReceivedWithinTemporal(eb, processing_bound, sources, destinations));\r\n assert PacketSentBetweenHosts(eb[i], p, sources, destinations); // TRIGGER\r\n assert sat(i, AllPacketsReceivedWithinTemporal(eb, processing_bound, sources, destinations));\r\n assert AllPacketsReceivedWithin(eb, i, processing_bound, sources, destinations);\r\n assert sat(i, next(eventuallynextwithin(PacketReceivedTemporal(eb, p), processing_bound, f)));\r\n var j := TemporalDeduceFromEventual(i+1, nextbefore(PacketReceivedTemporal(eb, p), f[i+1] + processing_bound, f));\r\n assert sat(j, PacketReceivedTemporal(eb, p));\r\n lemma_PacketReceiveCausesPacketProcessing(b, asp, p, j);\r\n assert sat(j, imply(PacketReceivedTemporal(eb, p), PacketProcessedTemporal(b, p)));\r\n assert sat(j, PacketProcessedTemporal(b, p));\r\n TemporalEventually(i+1, j, nextbefore(PacketProcessedTemporal(b, p), f[i+1] + processing_bound, f));\r\n }\r\n }\r\n TemporalAlways(processing_sync_start, PacketProcessingSynchronousTemporal(b, processing_bound, sources, destinations));\r\n lemma_mul_nonnegative(asp.burst_size, receive_period);\r\n}\r\n\r\nlemma lemma_IfPacketProcessingSynchronousThenAlways(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n later_step:int,\r\n processing_bound:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, start_step, processing_bound)\r\n requires start_step <= later_step\r\n ensures PacketProcessingSynchronous(b, asp, later_step, processing_bound)\r\n{\r\n var sources := SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids) + {asp.persistent_request.client};\r\n var destinations := SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids);\r\n Lemma_AlwaysImpliesLaterAlways(start_step, later_step, PacketProcessingSynchronousTemporal(b, processing_bound, sources, destinations));\r\n}\r\n\r\nlemma lemma_SchedulerActionThatReceivesReceivesFirst(\r\n s:LScheduler,\r\n s':LScheduler,\r\n p:RslPacket,\r\n ios:seq\r\n )\r\n requires LIoOpReceive(p) in ios\r\n requires LSchedulerNext(s, s', ios)\r\n ensures LIoOpReceive(p) == ios[0]\r\n{\r\n if LReplicaNextProcessPacket(s.replica, s'.replica, ios)\r\n {\r\n assert ios[0].LIoOpReceive?;\r\n if ios[0].r.msg.RslMessage_Heartbeat?\r\n {\r\n assert ios[1].LIoOpReadClock?;\r\n assert forall i :: 1 < i < |ios| ==> ios[i].LIoOpSend?;\r\n assert LIoOpReceive(p) == ios[0];\r\n }\r\n else\r\n {\r\n assert LReplicaNextProcessPacketWithoutReadingClock(s.replica, s'.replica, ios);\r\n assert ios[0].LIoOpReceive?;\r\n assert forall i :: 0 < i < |ios| ==> ios[i].LIoOpSend?;\r\n assert LIoOpReceive(p) == ios[0];\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_PacketSentToIndexProcessedByIt(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n send_step:int,\r\n idx:int,\r\n p:RslPacket\r\n ) returns (\r\n processing_step:int,\r\n ios:seq\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires idx in asp.live_quorum\r\n requires PacketSentDuringAction(b[send_step], p)\r\n requires p.src in SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids) + { asp.persistent_request.client }\r\n requires p.dst == asp.c.config.replica_ids[idx]\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires processing_sync_start <= send_step\r\n ensures send_step+1 <= processing_step\r\n ensures PacketProcessedViaIos(b[processing_step], b[processing_step+1], p, idx, ios)\r\n ensures b[processing_step+1].environment.time <= b[send_step+1].environment.time + processing_bound\r\n{\r\n TemporalAssist();\r\n\r\n var timefun := PaxosTimeMap(b);\r\n\r\n assert TLe(processing_sync_start, send_step);\r\n processing_step :| && TLe(send_step+1, processing_step)\r\n && sat(processing_step, PacketProcessedTemporal(b, p))\r\n && timefun[processing_step+1] <= timefun[send_step+1] + processing_bound;\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, processing_step);\r\n lemma_ConstantsAllConsistent(b, asp.c, processing_step+1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, processing_step);\r\n \r\n assert b[processing_step].environment.nextStep.LEnvStepHostIos?;\r\n ios := b[processing_step].environment.nextStep.ios;\r\n var actor := b[processing_step].environment.nextStep.actor;\r\n assert p.dst == actor;\r\n assert RslNext(b[processing_step], b[processing_step+1]);\r\n if exists idx', ios' {:trigger RslNextOneReplica(b[processing_step], b[processing_step+1], idx', ios')} ::\r\n RslNextOneReplica(b[processing_step], b[processing_step+1], idx', ios')\r\n {\r\n var idx', ios' :| RslNextOneReplica(b[processing_step], b[processing_step+1], idx', ios');\r\n assert ReplicasDistinct(asp.c.config.replica_ids, idx, idx');\r\n assert idx' == idx && ios' == ios;\r\n assert LSchedulerNext(b[processing_step].replicas[idx], b[processing_step+1].replicas[idx], ios);\r\n assert LIoOpReceive(p) in ios;\r\n lemma_SchedulerActionThatReceivesReceivesFirst(b[processing_step].replicas[idx], b[processing_step+1].replicas[idx], p, ios);\r\n assert PacketProcessedViaIos(b[processing_step], b[processing_step+1], p, idx, ios);\r\n }\r\n else if exists eid, ios' {:trigger RslNextOneExternal(b[processing_step], b[processing_step+1], eid, ios')} ::\r\n RslNextOneExternal(b[processing_step], b[processing_step+1], eid, ios')\r\n {\r\n var eid, ios' :| RslNextOneExternal(b[processing_step], b[processing_step+1], eid, ios');\r\n assert false;\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Phase1a.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"ViewAdvance.i.dfy\"\r\ninclude \"MaxBallotISent1a.i.dfy\"\r\ninclude \"MaxBallot.i.dfy\"\r\ninclude \"WF1.i.dfy\"\r\ninclude \"../CommonProof/MaxBallotISent1a.i.dfy\"\r\ninclude \"../CommonProof/MaxBallot.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\ninclude \"../../../Common/Framework/EnvironmentSynchronyLemmas.i.dfy\"\r\n\r\nmodule LivenessProof__Phase1a_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__MaxBallotISent1a_i\r\nimport opened LivenessProof__MaxBallot_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__RealTime_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__ViewAdvance_i\r\nimport opened LivenessProof__ViewChange_i\r\nimport opened LivenessProof__WF1_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__MaxBallotISent1a_i\r\nimport opened CommonProof__MaxBallot_i\r\nimport opened Liveness__EnvironmentSynchronyLemmas_i\r\nimport opened Temporal__LeadsTo_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Temporal__WF1_i\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\n\r\npredicate PrimaryInView(\r\n ps:RslState,\r\n view:Ballot\r\n )\r\n{\r\n && 0 <= view.proposer_id < |ps.replicas|\r\n && CurrentViewOfHost(ps, view.proposer_id) == view\r\n}\r\n\r\nfunction{:opaque} PrimaryInViewTemporal(\r\n b:Behavior,\r\n view:Ballot\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, PrimaryInViewTemporal(b, view))} ::\r\n sat(i, PrimaryInViewTemporal(b, view)) == PrimaryInView(b[i], view)\r\n{\r\n stepmap(imap i :: PrimaryInView(b[i], view))\r\n}\r\n\r\npredicate PrimaryMaxBallotISent1aInView(\r\n ps:RslState,\r\n view:Ballot\r\n )\r\n{\r\n && 0 <= view.proposer_id < |ps.replicas|\r\n && ps.replicas[view.proposer_id].replica.proposer.max_ballot_i_sent_1a == view\r\n}\r\n\r\nfunction{:opaque} PrimaryMaxBallotISent1aInViewTemporal(\r\n b:Behavior,\r\n view:Ballot\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, PrimaryMaxBallotISent1aInViewTemporal(b, view))} ::\r\n sat(i, PrimaryMaxBallotISent1aInViewTemporal(b, view)) == PrimaryMaxBallotISent1aInView(b[i], view)\r\n{\r\n stepmap(imap i :: PrimaryMaxBallotISent1aInView(b[i], view))\r\n}\r\n\r\npredicate PrimarySent1aInView(\r\n ps:RslState,\r\n ps':RslState,\r\n view:Ballot\r\n )\r\n{\r\n exists ios :: && 0 <= view.proposer_id < |ps.replicas|\r\n && 0 <= view.proposer_id < |ps'.replicas|\r\n && var idx := view.proposer_id;\r\n var s := ps.replicas[idx].replica.proposer;\r\n var s' := ps'.replicas[idx].replica.proposer;\r\n && RslNextOneReplica(ps, ps', view.proposer_id, ios)\r\n && LProposerMaybeEnterNewViewAndSend1a(s, s', ExtractSentPacketsFromIos(ios))\r\n && s.election_state.current_view.proposer_id == s.constants.my_index\r\n && BalLt(s.max_ballot_i_sent_1a, s.election_state.current_view)\r\n && s.election_state.current_view == view\r\n}\r\n\r\nfunction{:opaque} PrimarySent1aInViewTemporal(\r\n b:Behavior,\r\n view:Ballot\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, PrimarySent1aInViewTemporal(b, view))} ::\r\n sat(i, PrimarySent1aInViewTemporal(b, view)) == PrimarySent1aInView(b[i], b[nextstep(i)], view)\r\n{\r\n stepmap(imap i :: PrimarySent1aInView(b[i], b[nextstep(i)], view))\r\n}\r\n\r\nlemma lemma_StablePeriodStartedLeadsToPrimaryInView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n ahead_idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, start_step, processing_bound)\r\n ensures sat(start_step, leadstowithin(StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx),\r\n or(PrimaryInViewTemporal(b, view), not(NoReplicaBeyondViewTemporal(b, view))),\r\n TimeForOneReplicaToAdvanceAnother(asp, processing_bound),\r\n PaxosTimeMap(b)))\r\n{\r\n var x := StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx);\r\n var y := or(PrimaryInViewTemporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound);\r\n var timefun := PaxosTimeMap(b);\r\n var primary_idx := view.proposer_id;\r\n forall i | start_step <= i\r\n ensures sat(i, imply(x, eventuallywithin(y, t, timefun)))\r\n {\r\n if sat(i, x)\r\n {\r\n lemma_IfPacketProcessingSynchronousThenAlways(b, asp, start_step, i, processing_bound);\r\n var j := lemma_OneLiveReplicaSoonAdvancesAnother(b, asp, i, processing_bound, i, ahead_idx, primary_idx);\r\n assert timefun[j] <= timefun[i] + t;\r\n assert BalLeq(view, CurrentViewOfHost(b[j], primary_idx));\r\n if CurrentViewOfHost(b[j], primary_idx) == view\r\n {\r\n assert sat(j, PrimaryInViewTemporal(b, view));\r\n }\r\n else\r\n {\r\n assert !BalLeq(CurrentViewOfHost(b[j], primary_idx), view);\r\n assert sat(j, not(NoReplicaBeyondViewTemporal(b, view)));\r\n }\r\n assert sat(j, y);\r\n assert sat(j, beforeabsolutetime(y, timefun[i] + t, timefun));\r\n TemporalEventually(i, j, beforeabsolutetime(y, timefun[i] + t, timefun));\r\n }\r\n }\r\n TemporalAlways(start_step, imply(x, eventuallywithin(y, t, timefun)));\r\n}\r\n\r\nlemma lemma_StablePeriodStartedLeadsToPrimaryInViewAlt(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n ahead_idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, start_step, processing_bound)\r\n requires sat(start_step, StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx))\r\n ensures start_step <= step\r\n ensures sat(step, or(PrimaryInViewTemporal(b, view), not(NoReplicaBeyondViewTemporal(b, view))))\r\n ensures b[step].environment.time <= b[start_step].environment.time + TimeForOneReplicaToAdvanceAnother(asp, processing_bound)\r\n{\r\n var primary_idx := view.proposer_id;\r\n step := lemma_OneLiveReplicaSoonAdvancesAnother(b, asp, start_step, processing_bound, start_step, ahead_idx, primary_idx);\r\n\r\n assert BalLeq(view, CurrentViewOfHost(b[step], primary_idx));\r\n if CurrentViewOfHost(b[step], primary_idx) == view\r\n {\r\n assert sat(step, PrimaryInViewTemporal(b, view));\r\n }\r\n else\r\n {\r\n assert !BalLeq(CurrentViewOfHost(b[step], primary_idx), view);\r\n assert sat(step, not(NoReplicaBeyondViewTemporal(b, view)));\r\n }\r\n}\r\n\r\nlemma lemma_PrimaryInViewLeadsToPrimaryMaxBallotISent1aInViewWF1Req1(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= start_step\r\n ensures var P := PrimaryInViewTemporal(b, view);\r\n var Q := or(PrimaryMaxBallotISent1aInViewTemporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n sat(start_step, always(TemporalWF1Req1(P, Q)))\r\n{\r\n var primary_idx := view.proposer_id;\r\n var P := PrimaryInViewTemporal(b, view);\r\n var Q := or(PrimaryMaxBallotISent1aInViewTemporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n\r\n forall i | start_step <= i\r\n ensures sat(i, TemporalWF1Req1(P, Q))\r\n {\r\n if sat(i, P) && !sat(i, Q) && !sat(i+1, P) && !sat(i+1, Q)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n assert BalLeq(CurrentViewOfHost(b[i+1], primary_idx), view);\r\n lemma_ViewOfHostMonotonic(b, asp, primary_idx, i, i+1);\r\n assert !NoReplicaBeyondView(b[i+1], view);\r\n }\r\n }\r\n\r\n TemporalAlways(start_step, TemporalWF1Req1(P, Q));\r\n}\r\n\r\nlemma lemma_PrimaryInViewLeadsToPrimaryMaxBallotISent1aInViewWF1Req2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= start_step\r\n ensures var P := PrimaryInViewTemporal(b, view);\r\n var Q := or(PrimaryMaxBallotISent1aInViewTemporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n var Action := MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousMaybeEnterNewViewAndSend1a, view.proposer_id);\r\n sat(start_step, always(TemporalWF1Req2(P, Q, Action)))\r\n{\r\n var primary_idx := view.proposer_id;\r\n var P := PrimaryInViewTemporal(b, view);\r\n var Q := or(PrimaryMaxBallotISent1aInViewTemporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n var Action := MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousMaybeEnterNewViewAndSend1a, primary_idx);\r\n\r\n forall i | start_step <= i\r\n ensures sat(i, TemporalWF1Req2(P, Q, Action))\r\n {\r\n if sat(i, P) && sat(i, Action) && !sat(i, Q) && !sat(i+1, Q)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n assert SpecificSpontaneousRslActionOccurs(b[i], b[i+1], LReplicaNextSpontaneousMaybeEnterNewViewAndSend1a, primary_idx);\r\n var ios :| && RslNextOneReplica(b[i], b[i+1], primary_idx, ios)\r\n && SpontaneousIos(ios, 0)\r\n && LReplicaNextSpontaneousMaybeEnterNewViewAndSend1a(b[i].replicas[primary_idx].replica,\r\n b[i+1].replicas[primary_idx].replica,\r\n ExtractSentPacketsFromIos(ios));\r\n lemma_NoReplicaBeyondViewImpliesNoMaxBallotISent1aBeyondView(b, asp, i, view);\r\n assert BalLeq(b[i].replicas[primary_idx].replica.proposer.max_ballot_i_sent_1a, view);\r\n assert false;\r\n }\r\n }\r\n\r\n TemporalAlways(start_step, TemporalWF1Req2(P, Q, Action));\r\n}\r\n\r\nlemma lemma_PrimaryInViewLeadsToPrimaryMaxBallotISent1aInView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires asp.synchrony_start <= start_step\r\n requires view.proposer_id in asp.live_quorum\r\n ensures sat(start_step, leadstowithin(PrimaryInViewTemporal(b, view),\r\n or(PrimaryMaxBallotISent1aInViewTemporal(b, view), not(NoReplicaBeyondViewTemporal(b, view))),\r\n TimeToPerformGenericAction(asp),\r\n PaxosTimeMap(b)))\r\n{\r\n var timefun := PaxosTimeMap(b);\r\n var primary_idx := view.proposer_id;\r\n var P := PrimaryInViewTemporal(b, view);\r\n var Q := or(PrimaryMaxBallotISent1aInViewTemporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n var Action := MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousMaybeEnterNewViewAndSend1a, primary_idx);\r\n var t := TimeToPerformGenericAction(asp);\r\n\r\n lemma_PrimaryInViewLeadsToPrimaryMaxBallotISent1aInViewWF1Req1(b, asp, start_step, view);\r\n lemma_PrimaryInViewLeadsToPrimaryMaxBallotISent1aInViewWF1Req2(b, asp, start_step, view);\r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, primary_idx, 1);\r\n lemma_EstablishRequirementsForWF1RealTime(b, asp, start_step, Action, t);\r\n TemporalWF1RealTime(start_step, P, Q, Action, t, timefun);\r\n}\r\n\r\nlemma lemma_StablePeriodStartedLeadsToPrimaryMaxBallotISent1aInView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n ahead_idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, start_step, processing_bound)\r\n requires view.proposer_id in asp.live_quorum\r\n ensures sat(start_step, leadstowithin(StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx),\r\n or(PrimaryMaxBallotISent1aInViewTemporal(b, view), not(NoReplicaBeyondViewTemporal(b, view))),\r\n TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp),\r\n PaxosTimeMap(b)))\r\n{\r\n var w := StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx);\r\n var x := PrimaryInViewTemporal(b, view);\r\n var y := PrimaryMaxBallotISent1aInViewTemporal(b, view);\r\n var z := not(NoReplicaBeyondViewTemporal(b, view));\r\n var t1 := TimeForOneReplicaToAdvanceAnother(asp, processing_bound);\r\n var t2 := TimeToPerformGenericAction(asp);\r\n \r\n lemma_StablePeriodStartedLeadsToPrimaryInView(b, asp, start_step, processing_bound, view, ahead_idx);\r\n lemma_PrimaryInViewLeadsToPrimaryMaxBallotISent1aInView(b, asp, start_step, view);\r\n Lemma_LeadsToTwoPossibilitiesWithin(start_step, w, x, y, z, t1, t2, PaxosTimeMap(b));\r\n\r\n assert sat(start_step, leadstowithin(w, or(y, z), t1 + t2, PaxosTimeMap(b)));\r\n}\r\n\r\nlemma lemma_IfPrimaryTransitionsToMaxBallotISent1aInViewThenPrimarySent1a(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires !sat(i, PrimaryMaxBallotISent1aInViewTemporal(b, view))\r\n requires sat(i+1, PrimaryMaxBallotISent1aInViewTemporal(b, view))\r\n ensures sat(i, PrimarySent1aInViewTemporal(b, view))\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n var idx := view.proposer_id;\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, idx);\r\n assert PrimarySent1aInView(b[i], b[i+1], view);\r\n}\r\n\r\nlemma lemma_StablePeriodStartedLeadsToPrimarySending1a(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n ahead_idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, start_step, processing_bound)\r\n requires view.proposer_id in asp.live_quorum\r\n ensures var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp);\r\n var f := PaxosTimeMap(b);\r\n sat(start_step, always(imply(StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx),\r\n or(eventuallynextwithin(PrimarySent1aInViewTemporal(b, view), t, f),\r\n eventuallywithin(not(NoReplicaBeyondViewTemporal(b, view)), t, f)))))\r\n{\r\n var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp);\r\n var f := PaxosTimeMap(b);\r\n var x := StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx);\r\n var y := PrimaryMaxBallotISent1aInViewTemporal(b, view);\r\n var z := not(NoReplicaBeyondViewTemporal(b, view));\r\n var w := PrimarySent1aInViewTemporal(b, view);\r\n lemma_StablePeriodStartedLeadsToPrimaryMaxBallotISent1aInView(b, asp, start_step, processing_bound, view, ahead_idx);\r\n lemma_TimeMonotonicFromInvariantHolds(b, asp, start_step);\r\n\r\n TemporalAlways(start_step, imply(x, not(y)));\r\n Lemma_LeadsToWithinOrSomethingLeadsToTransitionOrSomething(start_step, x, y, z, t, f);\r\n\r\n forall j | start_step <= j\r\n ensures sat(j, imply(x, or(eventuallynextwithin(w, t, f), eventuallywithin(z, t, f))))\r\n {\r\n TemporalDeduceFromAlways(start_step, j, imply(x, or(eventuallynextwithin(and(not(y), next(y)), t, f), eventuallywithin(z, t, f))));\r\n if sat(j, x) && !sat(j, eventuallywithin(z, t, f))\r\n {\r\n assert sat(j, eventuallynextwithin(and(not(y), next(y)), t, f));\r\n var k := TemporalDeduceFromEventual(j, nextbefore(and(not(y), next(y)), f[j] + t, f));\r\n lemma_IfPrimaryTransitionsToMaxBallotISent1aInViewThenPrimarySent1a(b, asp, k, view);\r\n TemporalEventually(j, k, nextbefore(w, f[j] + t, f));\r\n }\r\n }\r\n \r\n TemporalAlways(start_step, imply(x, or(eventuallynextwithin(w, t, f), eventuallywithin(z, t, f))));\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Phase1b.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"ViewAdvance.i.dfy\"\r\ninclude \"MaxBallotISent1a.i.dfy\"\r\ninclude \"MaxBallot.i.dfy\"\r\ninclude \"PacketHandling.i.dfy\"\r\ninclude \"Phase1a.i.dfy\"\r\ninclude \"../CommonProof/MaxBallotISent1a.i.dfy\"\r\ninclude \"../CommonProof/MaxBallot.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\ninclude \"../../../Common/Framework/EnvironmentSynchronyLemmas.i.dfy\"\r\n\r\nmodule LivenessProof__Phase1b_i {\r\n\r\nimport opened LiveRSL__Broadcast_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__MaxBallotISent1a_i\r\nimport opened LivenessProof__MaxBallot_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__Phase1a_i\r\nimport opened LivenessProof__RealTime_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__ViewAdvance_i\r\nimport opened LivenessProof__ViewChange_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__MaxBallotISent1a_i\r\nimport opened CommonProof__MaxBallot_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened Liveness__EnvironmentSynchronyLemmas_i\r\nimport opened Temporal__Induction_i\r\nimport opened Temporal__LeadsTo_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\n\r\npredicate PrimaryInState1or2(\r\n ps:RslState,\r\n view:Ballot\r\n )\r\n{\r\n && 0 <= view.proposer_id < |ps.replicas|\r\n && ps.replicas[view.proposer_id].replica.proposer.max_ballot_i_sent_1a == view\r\n && (ps.replicas[view.proposer_id].replica.proposer.current_state == 1 || ps.replicas[view.proposer_id].replica.proposer.current_state == 2)\r\n}\r\n\r\nfunction{:opaque} PrimaryInState1or2Temporal(\r\n b:Behavior,\r\n view:Ballot\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, PrimaryInState1or2Temporal(b, view))} ::\r\n sat(i, PrimaryInState1or2Temporal(b, view)) == PrimaryInState1or2(b[i], view)\r\n{\r\n stepmap(imap i :: PrimaryInState1or2(b[i], view))\r\n}\r\n\r\npredicate PrimaryInState2(\r\n ps:RslState,\r\n view:Ballot\r\n )\r\n{\r\n && 0 <= view.proposer_id < |ps.replicas|\r\n && ps.replicas[view.proposer_id].replica.proposer.max_ballot_i_sent_1a == view\r\n && ps.replicas[view.proposer_id].replica.proposer.current_state == 2\r\n}\r\n\r\nfunction{:opaque} PrimaryInState2Temporal(\r\n b:Behavior,\r\n view:Ballot\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, PrimaryInState2Temporal(b, view))} ::\r\n sat(i, PrimaryInState2Temporal(b, view)) == PrimaryInState2(b[i], view)\r\n{\r\n stepmap(imap i :: PrimaryInState2(b[i], view))\r\n}\r\n\r\npredicate AcceptorHasMaxBalInView(\r\n ps:RslState,\r\n view:Ballot,\r\n idx:int\r\n )\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && ps.replicas[idx].replica.acceptor.max_bal == view\r\n}\r\n\r\nfunction{:opaque} AcceptorHasMaxBalInViewTemporal(\r\n b:Behavior,\r\n view:Ballot,\r\n idx:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, AcceptorHasMaxBalInViewTemporal(b, view, idx))} ::\r\n sat(i, AcceptorHasMaxBalInViewTemporal(b, view, idx)) == AcceptorHasMaxBalInView(b[i], view, idx)\r\n{\r\n stepmap(imap i :: AcceptorHasMaxBalInView(b[i], view, idx))\r\n}\r\n\r\npredicate PrimaryHasSpecific1bFromAcceptorInView(\r\n ps:RslState,\r\n view:Ballot,\r\n idx:int,\r\n p:RslPacket\r\n )\r\n requires 0 <= view.proposer_id < |ps.replicas|\r\n requires 0 <= idx < |ps.constants.config.replica_ids|\r\n{\r\n && p in ps.replicas[view.proposer_id].replica.proposer.received_1b_packets\r\n && p.msg.RslMessage_1b?\r\n && p.msg.bal_1b == view\r\n && p.src == ps.constants.config.replica_ids[idx]\r\n && ps.replicas[view.proposer_id].replica.proposer.max_ballot_i_sent_1a == view\r\n && ps.replicas[view.proposer_id].replica.proposer.current_state == 1\r\n}\r\n\r\npredicate PrimaryHas1bFromAcceptorInView(\r\n ps:RslState,\r\n view:Ballot,\r\n idx:int\r\n )\r\n{\r\n && 0 <= view.proposer_id < |ps.replicas|\r\n && 0 <= idx < |ps.constants.config.replica_ids|\r\n && exists p :: PrimaryHasSpecific1bFromAcceptorInView(ps, view, idx, p)\r\n}\r\n\r\nfunction{:opaque} PrimaryHas1bFromAcceptorInViewTemporal(\r\n b:Behavior,\r\n view:Ballot,\r\n idx:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, PrimaryHas1bFromAcceptorInViewTemporal(b, view, idx))} ::\r\n sat(i, PrimaryHas1bFromAcceptorInViewTemporal(b, view, idx)) == PrimaryHas1bFromAcceptorInView(b[i], view, idx)\r\n{\r\n stepmap(imap i :: PrimaryHas1bFromAcceptorInView(b[i], view, idx))\r\n}\r\n\r\nlemma{:timeLimitMultiplier 3} lemma_PrimarySending1aLeadsToAcceptorSettingMaxBal(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, start_step, processing_bound)\r\n requires view.proposer_id in asp.live_quorum\r\n requires idx in asp.live_quorum\r\n ensures sat(start_step, always(imply(PrimarySent1aInViewTemporal(b, view),\r\n next(eventuallywithin(or(AcceptorHasMaxBalInViewTemporal(b, view, idx), not(NoReplicaBeyondViewTemporal(b, view))), processing_bound, PaxosTimeMap(b))))))\r\n{\r\n var primary_idx := view.proposer_id;\r\n var x := PrimarySent1aInViewTemporal(b, view);\r\n var y := AcceptorHasMaxBalInViewTemporal(b, view, idx);\r\n var z := not(NoReplicaBeyondViewTemporal(b, view));\r\n var t := processing_bound;\r\n var f := PaxosTimeMap(b);\r\n\r\n forall j | start_step <= j\r\n ensures sat(j, imply(x, next(eventuallywithin(or(y, z), t, f))))\r\n {\r\n if sat(j, x)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, j);\r\n lemma_ConstantsAllConsistent(b, asp.c, j+1);\r\n var ps := b[j];\r\n var ps' := b[j+1];\r\n var s := ps.replicas[primary_idx].replica.proposer;\r\n var s' := ps'.replicas[primary_idx].replica.proposer;\r\n var ios :| && RslNextOneReplica(ps, ps', view.proposer_id, ios)\r\n && LProposerMaybeEnterNewViewAndSend1a(s, s', ExtractSentPacketsFromIos(ios))\r\n && s.election_state.current_view.proposer_id == s.constants.my_index\r\n && BalLt(s.max_ballot_i_sent_1a, s.election_state.current_view)\r\n && s.election_state.current_view == view;\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n assert LBroadcastToEveryone(s.constants.all.config, s.constants.my_index, RslMessage_1a(s.election_state.current_view), sent_packets);\r\n var p := LPacket(s.constants.all.config.replica_ids[idx], s.constants.all.config.replica_ids[s.constants.my_index], RslMessage_1a(s.election_state.current_view));\r\n assert p in sent_packets;\r\n var k, ios' := lemma_PacketSentToIndexProcessedByIt(b, asp, start_step, t, j, idx, p);\r\n lemma_ConstantsAllConsistent(b, asp.c, k);\r\n lemma_ConstantsAllConsistent(b, asp.c, k+1);\r\n assert BalLeq(view, b[k+1].replicas[idx].replica.acceptor.max_bal);\r\n if !sat(k+1, or(y, z))\r\n {\r\n lemma_NoReplicaBeyondViewImpliesNoMaxBallotISent1aBeyondView(b, asp, k+1, view);\r\n lemma_DuringStablePeriodNoMaxBalBeyondView(b, asp, k+1, idx, view);\r\n assert BalLeq(b[k+1].replicas[idx].replica.acceptor.max_bal, view);\r\n assert false;\r\n }\r\n TemporalEventually(j+1, k+1, beforeabsolutetime(or(y, z), f[j+1] + t, f));\r\n }\r\n }\r\n TemporalAlways(start_step, imply(x, next(eventuallywithin(or(y, z), t, f))));\r\n}\r\n\r\nlemma lemma_StablePeriodStartedLeadsToAcceptorSettingMaxBal(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n ahead_idx:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, start_step, processing_bound)\r\n requires view.proposer_id in asp.live_quorum\r\n requires idx in asp.live_quorum\r\n ensures var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) + processing_bound;\r\n sat(start_step, always(imply(StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx),\r\n or(eventuallynextwithin(and(not(AcceptorHasMaxBalInViewTemporal(b, view, idx)),\r\n next(AcceptorHasMaxBalInViewTemporal(b, view, idx))),\r\n t, PaxosTimeMap(b)),\r\n eventuallywithin(not(NoReplicaBeyondViewTemporal(b, view)), t, PaxosTimeMap(b))))))\r\n{\r\n var w := StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx);\r\n var x := PrimarySent1aInViewTemporal(b, view);\r\n var y := AcceptorHasMaxBalInViewTemporal(b, view, idx);\r\n var z := not(NoReplicaBeyondViewTemporal(b, view));\r\n var t1 := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp);\r\n var t2 := processing_bound;\r\n var t := t1 + t2;\r\n var f := PaxosTimeMap(b);\r\n\r\n lemma_StablePeriodStartedLeadsToPrimarySending1a(b, asp, start_step, processing_bound, view, ahead_idx);\r\n assert sat(start_step, always(imply(w, or(eventuallynextwithin(x, t1, f), eventuallywithin(z, t1, f)))));\r\n lemma_PrimarySending1aLeadsToAcceptorSettingMaxBal(b, asp, start_step, processing_bound, view, idx);\r\n assert sat(start_step, always(imply(x, next(eventuallywithin(or(y, z), t2, f)))));\r\n Lemma_LeadsToTwoPossibilitiesWithinWithFirstStepAnAction(start_step, w, x, y, z, t1, t2, f);\r\n assert sat(start_step, leadstowithin(w, or(y, z), t1+t2, f));\r\n\r\n forall j | start_step <= j\r\n ensures sat(j, imply(w, not(y)))\r\n {\r\n if sat(j, w) && sat(j, y)\r\n {\r\n assert b[j].replicas[idx].replica.acceptor.max_bal == view;\r\n lemma_MaxBalLeqMaxBallotPrimarySent1a(b, asp.c, j, idx);\r\n assert BalLt(b[j].replicas[view.proposer_id].replica.proposer.max_ballot_i_sent_1a, view);\r\n assert false;\r\n }\r\n }\r\n TemporalAlways(start_step, imply(w, not(y)));\r\n\r\n lemma_TimeMonotonicFromInvariantHolds(b, asp, start_step);\r\n Lemma_LeadsToWithinOrSomethingLeadsToTransitionOrSomething(start_step, w, y, z, t1 + t2, f);\r\n}\r\n\r\nlemma lemma_IfPrimaryInState2ItsAlwaysAtLeastThere(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires var t := or(PrimaryInState2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n sat(i, t)\r\n ensures var t := or(PrimaryInState2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n sat(i, always(t))\r\n{\r\n var x := PrimaryInState2Temporal(b, view);\r\n var y := not(NoReplicaBeyondViewTemporal(b, view));\r\n var t := or(x, y);\r\n \r\n forall j | i <= j\r\n ensures sat(j, imply(t, next(t)))\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, j);\r\n if sat(j, t)\r\n {\r\n if sat(j, y)\r\n {\r\n var idx :| 0 <= idx < |b[j].replicas| && !BalLeq(CurrentViewOfHost(b[j], idx), view);\r\n lemma_ViewOfHostMonotonic(b, asp, idx, j, j+1);\r\n assert sat(j, next(t));\r\n }\r\n else\r\n {\r\n assert sat(j, x);\r\n if !sat(j+1, t)\r\n {\r\n lemma_BalLtProperties();\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, j+1);\r\n var primary_idx := view.proposer_id;\r\n var s := b[j].replicas[primary_idx].replica;\r\n var s' := b[j+1].replicas[primary_idx].replica;\r\n\r\n lemma_MaxBallotISent1aMonotonicOneStep(b, asp.c, j, primary_idx);\r\n assert BalLeq(s.proposer.max_ballot_i_sent_1a, s'.proposer.max_ballot_i_sent_1a);\r\n assert BalLeq(view, s'.proposer.max_ballot_i_sent_1a);\r\n lemma_MaxBallotISent1aLeqView(b, asp, j+1, primary_idx);\r\n assert BalLeq(s'.proposer.max_ballot_i_sent_1a, CurrentViewOfHost(b[j+1], primary_idx));\r\n assert BalLeq(view, CurrentViewOfHost(b[j+1], primary_idx));\r\n lemma_ViewOfHostMonotonic(b, asp, primary_idx, j, j+1);\r\n assert BalLeq(CurrentViewOfHost(b[j+1], primary_idx), view);\r\n assert CurrentViewOfHost(b[j+1], primary_idx) == view;\r\n\r\n assert BalLeq(CurrentViewOfHost(b[j], primary_idx), view);\r\n lemma_MaxBallotISent1aLeqView(b, asp, j, primary_idx);\r\n assert BalLeq(view, CurrentViewOfHost(b[j], primary_idx));\r\n assert s'.proposer.election_state.current_view == s.proposer.election_state.current_view;\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, j, primary_idx);\r\n assert s.proposer.current_state == 2;\r\n assert s'.proposer.current_state != 2;\r\n assert false;\r\n }\r\n }\r\n }\r\n reveal imply();\r\n reveal next();\r\n }\r\n TemporalInductionNext(i, t);\r\n}\r\n\r\nlemma lemma_If2aMessageSentThenPrimaryInState2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n p:RslPacket,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires p.msg.RslMessage_2a?\r\n requires p.msg.bal_2a == view\r\n requires 0 <= view.proposer_id < |asp.c.config.replica_ids|\r\n requires p.src in asp.c.config.replica_ids\r\n requires p in b[i].environment.sentPackets\r\n ensures p.src == asp.c.config.replica_ids[view.proposer_id]\r\n ensures var t := or(PrimaryInState2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n sat(i, always(t))\r\n decreases i\r\n{\r\n var t := or(PrimaryInState2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n\r\n if i == 0\r\n {\r\n assert |b[i].environment.sentPackets| == 0;\r\n assert false;\r\n }\r\n else if p in b[i-1].environment.sentPackets\r\n {\r\n lemma_If2aMessageSentThenPrimaryInState2(b, asp, i-1, p, view);\r\n Lemma_AlwaysImpliesLaterAlways(i-1, i, t);\r\n }\r\n else\r\n {\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n var idx, ios := lemma_ActionThatSends2aIsMaybeNominateValueAndSend2a(b[i-1], b[i], p);\r\n assert asp.c.config.replica_ids[idx] == p.src;\r\n lemma_MaxBallotISent1aHasMeAsProposer(b, asp.c, i, idx);\r\n assert PrimaryInState2(b[i-1], view);\r\n assert sat(i-1, PrimaryInState2Temporal(b, view));\r\n lemma_IfPrimaryInState2ItsAlwaysAtLeastThere(b, asp, i-1, view);\r\n Lemma_AlwaysImpliesLaterAlways(i-1, i, t);\r\n }\r\n}\r\n\r\nlemma lemma_IfPrimaryInState1or2ItsAlwaysAtLeastThere(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires var t := or(PrimaryInState1or2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n sat(i, t)\r\n ensures var t := or(PrimaryInState1or2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n sat(i, always(t))\r\n{\r\n var x := PrimaryInState1or2Temporal(b, view);\r\n var y := not(NoReplicaBeyondViewTemporal(b, view));\r\n var t := or(x, y);\r\n \r\n forall j | i <= j\r\n ensures sat(j, imply(t, next(t)))\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, j);\r\n if sat(j, t)\r\n {\r\n if sat(j, y)\r\n {\r\n var idx :| 0 <= idx < |b[j].replicas| && !BalLeq(CurrentViewOfHost(b[j], idx), view);\r\n lemma_ViewOfHostMonotonic(b, asp, idx, j, j+1);\r\n assert sat(j, next(t));\r\n }\r\n else\r\n {\r\n assert sat(j, x);\r\n if !sat(j+1, t)\r\n {\r\n lemma_BalLtProperties();\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, j+1);\r\n var primary_idx := view.proposer_id;\r\n var s := b[j].replicas[primary_idx].replica;\r\n var s' := b[j+1].replicas[primary_idx].replica;\r\n\r\n lemma_MaxBallotISent1aMonotonicOneStep(b, asp.c, j, primary_idx);\r\n assert BalLeq(s.proposer.max_ballot_i_sent_1a, s'.proposer.max_ballot_i_sent_1a);\r\n assert BalLeq(view, s'.proposer.max_ballot_i_sent_1a);\r\n lemma_MaxBallotISent1aLeqView(b, asp, j+1, primary_idx);\r\n assert BalLeq(s'.proposer.max_ballot_i_sent_1a, CurrentViewOfHost(b[j+1], primary_idx));\r\n assert BalLeq(view, CurrentViewOfHost(b[j+1], primary_idx));\r\n lemma_ViewOfHostMonotonic(b, asp, primary_idx, j, j+1);\r\n assert BalLeq(CurrentViewOfHost(b[j+1], primary_idx), view);\r\n assert CurrentViewOfHost(b[j+1], primary_idx) == view;\r\n\r\n assert BalLeq(CurrentViewOfHost(b[j], primary_idx), view);\r\n lemma_MaxBallotISent1aLeqView(b, asp, j, primary_idx);\r\n assert BalLeq(view, CurrentViewOfHost(b[j], primary_idx));\r\n assert s'.proposer.election_state.current_view == s.proposer.election_state.current_view;\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, j, primary_idx);\r\n assert s.proposer.current_state >= 2;\r\n assert s'.proposer.current_state == 0;\r\n assert false;\r\n }\r\n }\r\n }\r\n reveal imply();\r\n reveal next();\r\n }\r\n TemporalInductionNext(i, t);\r\n}\r\n\r\nlemma lemma_If1aMessageSentThenPrimaryInState1or2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n p:RslPacket,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires p.msg.RslMessage_1a?\r\n requires p.msg.bal_1a == view\r\n requires 0 <= view.proposer_id < |asp.c.config.replica_ids|\r\n requires p.src in asp.c.config.replica_ids\r\n requires p in b[i].environment.sentPackets\r\n ensures p.src == asp.c.config.replica_ids[view.proposer_id]\r\n ensures var t := or(PrimaryInState1or2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n sat(i, always(t))\r\n decreases i\r\n{\r\n var t := or(PrimaryInState1or2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n\r\n if i == 0\r\n {\r\n assert |b[i].environment.sentPackets| == 0;\r\n assert false;\r\n }\r\n else if p in b[i-1].environment.sentPackets\r\n {\r\n lemma_If1aMessageSentThenPrimaryInState1or2(b, asp, i-1, p, view);\r\n Lemma_AlwaysImpliesLaterAlways(i-1, i, t);\r\n }\r\n else\r\n {\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n var idx, ios := lemma_ActionThatSends1aIsMaybeEnterNewViewAndSend1a(b[i-1], b[i], p);\r\n assert asp.c.config.replica_ids[idx] == p.src;\r\n lemma_MaxBallotISent1aHasMeAsProposer(b, asp.c, i, idx);\r\n assert sat(i, PrimaryInState1or2Temporal(b, view));\r\n lemma_IfPrimaryInState1or2ItsAlwaysAtLeastThere(b, asp, i, view);\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Phase1bCont.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"ViewAdvance.i.dfy\"\r\ninclude \"MaxBallotISent1a.i.dfy\"\r\ninclude \"MaxBallot.i.dfy\"\r\ninclude \"PacketHandling.i.dfy\"\r\ninclude \"Phase1b.i.dfy\"\r\ninclude \"../CommonProof/MaxBallotISent1a.i.dfy\"\r\ninclude \"../CommonProof/MaxBallot.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\ninclude \"../../../Common/Framework/EnvironmentSynchronyLemmas.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Sets.i.dfy\"\r\ninclude \"../../../Common/Collections/Sets.i.dfy\"\r\n\r\nmodule LivenessProof__Phase1bCont_i {\r\n\r\nimport opened LiveRSL__Acceptor_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__MaxBallotISent1a_i\r\nimport opened LivenessProof__MaxBallot_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__Phase1a_i\r\nimport opened LivenessProof__Phase1b_i\r\nimport opened LivenessProof__RealTime_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__ViewAdvance_i\r\nimport opened LivenessProof__ViewChange_i\r\nimport opened LivenessProof__WF1_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__MaxBallotISent1a_i\r\nimport opened CommonProof__MaxBallot_i\r\nimport opened Liveness__EnvironmentSynchronyLemmas_i\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Induction_i\r\nimport opened Temporal__LeadsTo_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Sets_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Temporal__WF1_i\r\nimport opened Collections__Sets_i\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Maps2_i\r\nimport opened Environment_s\r\n\r\npredicate AcceptorSent1bInView(\r\n ps:RslState,\r\n ps':RslState,\r\n view:Ballot,\r\n idx:int\r\n )\r\n{\r\n && PrimaryInState1or2(ps, view)\r\n && 0 <= idx < |ps.replicas|\r\n && 0 <= idx < |ps'.replicas|\r\n && ps.environment.nextStep.LEnvStepHostIos?\r\n && var ios := ps.environment.nextStep.ios;\r\n var s := ps.replicas[idx].replica.acceptor;\r\n var s' := ps'.replicas[idx].replica.acceptor;\r\n && RslNextOneReplica(ps, ps', idx, ios)\r\n && |ios| > 0\r\n && ios[0].LIoOpReceive?\r\n && ios[0].r.msg.RslMessage_1a?\r\n && ios[0].r.msg.bal_1a == view\r\n && BalLt(s.max_bal, view)\r\n && s'.max_bal == view\r\n && LAcceptorProcess1a(s, s', ios[0].r, ExtractSentPacketsFromIos(ios))\r\n}\r\n\r\nfunction{:opaque} AcceptorSent1bInViewTemporal(\r\n b:Behavior,\r\n view:Ballot,\r\n idx:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, AcceptorSent1bInViewTemporal(b, view, idx))} ::\r\n sat(i, AcceptorSent1bInViewTemporal(b, view, idx)) == AcceptorSent1bInView(b[i], b[nextstep(i)], view, idx)\r\n{\r\n stepmap(imap i :: AcceptorSent1bInView(b[i], b[nextstep(i)], view, idx))\r\n}\r\n\r\nfunction PrimaryHas1bFromAcceptorOrIsPastPhase1Temporal(\r\n b:Behavior,\r\n view:Ballot,\r\n idx:int\r\n ):temporal\r\n requires imaptotal(b)\r\n{\r\n or(PrimaryHas1bFromAcceptorInViewTemporal(b, view, idx),\r\n or(PrimaryInState2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view))))\r\n}\r\n\r\nlemma lemma_StablePeriodStartedLeadsToAcceptorSending1b(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n ahead_idx:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, start_step, processing_bound)\r\n requires view.proposer_id in asp.live_quorum\r\n requires idx in asp.live_quorum\r\n ensures var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) + processing_bound;\r\n var f := PaxosTimeMap(b);\r\n sat(start_step, always(imply(StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx),\r\n or(eventuallynextwithin(AcceptorSent1bInViewTemporal(b, view, idx), t, f),\r\n eventuallywithin(or(PrimaryInState2Temporal(b, view),\r\n not(NoReplicaBeyondViewTemporal(b, view))), t, f)))))\r\n{\r\n var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) + processing_bound;\r\n var f := PaxosTimeMap(b);\r\n var a := AcceptorHasMaxBalInViewTemporal(b, view, idx);\r\n var w := StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx);\r\n var x := AcceptorSent1bInViewTemporal(b, view, idx);\r\n var y := PrimaryInState2Temporal(b, view);\r\n var z := not(NoReplicaBeyondViewTemporal(b, view));\r\n\r\n lemma_StablePeriodStartedLeadsToAcceptorSettingMaxBal(b, asp, start_step, processing_bound, view, ahead_idx, idx);\r\n assert sat(start_step, always(imply(w, or(eventuallynextwithin(and(not(a), next(a)), t, f), eventuallywithin(z, t, f)))));\r\n\r\n forall j | start_step <= j\r\n ensures sat(j, imply(w, or(eventuallynextwithin(x, t, f), eventuallywithin(or(y, z), t, f))))\r\n {\r\n if sat(j, w)\r\n {\r\n if sat(j, eventuallywithin(z, t, f))\r\n {\r\n var k := TemporalDeduceFromEventuallyWithin(j, z, t, f);\r\n TemporalEventuallyWithin(j, k, or(y, z), t, f);\r\n }\r\n else\r\n {\r\n TemporalDeduceFromAlways(start_step, j, imply(w, or(eventuallynextwithin(and(not(a), next(a)), t, f), eventuallywithin(z, t, f))));\r\n var k := TemporalDeduceFromEventuallyNextWithin(j, and(not(a), next(a)), t, f);\r\n lemma_ConstantsAllConsistent(b, asp.c, k);\r\n lemma_ConstantsAllConsistent(b, asp.c, k+1);\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, k, idx);\r\n var s := b[k].replicas[idx].replica;\r\n assert b[k].replicas[idx].nextActionIndex == 0;\r\n assert |ios| > 0;\r\n assert ios[0].LIoOpReceive?;\r\n lemma_PacketProcessedImpliesPacketSent(b[k], b[k+1], idx, ios, ios[0].r);\r\n if ios[0].r.msg.RslMessage_1a?\r\n {\r\n lemma_If1aMessageSentThenPrimaryInState1or2(b, asp, k, ios[0].r, view);\r\n TemporalDeduceFromAlways(k, k, or(PrimaryInState1or2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view))));\r\n if sat(k, z)\r\n {\r\n TemporalEventuallyWithin(j, k, or(y, z), t, f);\r\n }\r\n else\r\n {\r\n assert AcceptorSent1bInView(b[k], b[k+1], view, idx);\r\n assert sat(k, x);\r\n TemporalEventuallyNextWithin(j, k, x, t, f);\r\n }\r\n }\r\n else if ios[0].r.msg.RslMessage_2a?\r\n {\r\n lemma_If2aMessageSentThenPrimaryInState2(b, asp, k, ios[0].r, view);\r\n TemporalDeduceFromAlways(k, k, or(PrimaryInState2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view))));\r\n assert sat(k, or(y, z));\r\n TemporalEventuallyWithin(j, k, or(y, z), t, f);\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n }\r\n }\r\n }\r\n\r\n TemporalAlways(start_step, imply(w, or(eventuallynextwithin(x, t, f), eventuallywithin(or(y, z), t, f))));\r\n}\r\n\r\nlemma lemma_StablePeriodStartedLeadsToPrimaryGetting1bFromAcceptorHelper(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n idx:int,\r\n i:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, start_step, processing_bound)\r\n requires view.proposer_id in asp.live_quorum\r\n requires idx in asp.live_quorum\r\n requires start_step <= i\r\n requires sat(i, AcceptorSent1bInViewTemporal(b, view, idx))\r\n ensures TLe(i, step)\r\n ensures sat(step, or(PrimaryHas1bFromAcceptorInViewTemporal(b, view, idx),\r\n or(PrimaryInState2Temporal(b, view),\r\n not(NoReplicaBeyondViewTemporal(b, view)))))\r\n ensures b[step].environment.time <= b[i+1].environment.time + processing_bound\r\n{\r\n var t := processing_bound;\r\n var f := PaxosTimeMap(b);\r\n\r\n assert sat(i, PrimaryInState1or2Temporal(b, view));\r\n assert AcceptorSent1bInView(b[i], b[i+1], view, idx);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n var primary_idx := view.proposer_id;\r\n var s := b[i].replicas[idx].replica.acceptor;\r\n var s' := b[i+1].replicas[idx].replica.acceptor;\r\n var ios:seq :| && RslNextOneReplica(b[i], b[i+1], idx, ios)\r\n && |ios| > 0\r\n && ios[0].LIoOpReceive?\r\n && ios[0].r.msg.RslMessage_1a?\r\n && ios[0].r.msg.bal_1a == view\r\n && BalLt(s.max_bal, view)\r\n && s'.max_bal == view\r\n && LAcceptorProcess1a(s, s', ios[0].r, ExtractSentPacketsFromIos(ios));\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n var p := LPacket(ios[0].r.src, s.constants.all.config.replica_ids[s.constants.my_index], RslMessage_1b(view, s.log_truncation_point, s.votes));\r\n assert p in sent_packets;\r\n lemma_PacketProcessedImpliesPacketSent(b[i], b[i+1], idx, ios, ios[0].r);\r\n lemma_If1aMessageSentThenPrimaryInState1or2(b, asp, i, ios[0].r, view);\r\n assert p.dst == asp.c.config.replica_ids[primary_idx];\r\n var j, ios2 := lemma_PacketSentToIndexProcessedByIt(b, asp, start_step, t, i, primary_idx, p);\r\n lemma_ConstantsAllConsistent(b, asp.c, j);\r\n lemma_ConstantsAllConsistent(b, asp.c, j+1);\r\n step := j + 1;\r\n\r\n var s2 := b[j].replicas[primary_idx].replica;\r\n var s2' := b[j+1].replicas[primary_idx].replica;\r\n\r\n assert PacketProcessedViaIos(b[j], b[j+1], p, primary_idx, ios2);\r\n assert LReplicaNextProcess1b(s2, s2', p, ExtractSentPacketsFromIos(ios2));\r\n assert p.src in s2.proposer.constants.all.config.replica_ids;\r\n lemma_IfPrimaryInState1or2ItsAlwaysAtLeastThere(b, asp, i, view);\r\n TemporalDeduceFromAlways(i, j, or(PrimaryInState1or2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view))));\r\n\r\n var x := PrimaryHas1bFromAcceptorInViewTemporal(b, view, idx);\r\n var y := PrimaryInState2Temporal(b, view);\r\n var z := not(NoReplicaBeyondViewTemporal(b, view));\r\n\r\n if sat(j, or(y, z))\r\n {\r\n step := j;\r\n lemma_TimeAdvancesBetween(b, asp, j, j+1);\r\n }\r\n else\r\n {\r\n assert s2.proposer.max_ballot_i_sent_1a == view;\r\n assert s2.proposer.current_state == 1;\r\n step := j + 1;\r\n if exists other_packet :: other_packet in s2.proposer.received_1b_packets && other_packet.src == p.src\r\n {\r\n var other_packet :| other_packet in s2.proposer.received_1b_packets && other_packet.src == p.src;\r\n lemma_Received1bPacketsAreFromMaxBallotISent1a(b, asp.c, step, primary_idx);\r\n assert other_packet.msg.RslMessage_1b? && other_packet.msg.bal_1b == s2.proposer.max_ballot_i_sent_1a;\r\n assert PrimaryHasSpecific1bFromAcceptorInView(b[step], view, idx, other_packet);\r\n }\r\n else\r\n {\r\n assert PrimaryHasSpecific1bFromAcceptorInView(b[step], view, idx, p);\r\n }\r\n assert sat(step, x);\r\n }\r\n}\r\n\r\nlemma lemma_StablePeriodStartedLeadsToPrimaryGetting1bFromAcceptor(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n ahead_idx:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, start_step, processing_bound)\r\n requires view.proposer_id in asp.live_quorum\r\n requires idx in asp.live_quorum\r\n ensures var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) + processing_bound * 2;\r\n var f := PaxosTimeMap(b);\r\n sat(start_step, leadstowithin(StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx),\r\n PrimaryHas1bFromAcceptorOrIsPastPhase1Temporal(b, view, idx), t, f))\r\n{\r\n var t1 := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) + processing_bound;\r\n var t2 := processing_bound;\r\n var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) + processing_bound * 2;\r\n var f := PaxosTimeMap(b);\r\n var a := AcceptorSent1bInViewTemporal(b, view, idx);\r\n var w := StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx);\r\n var x := PrimaryHas1bFromAcceptorInViewTemporal(b, view, idx);\r\n var y := PrimaryInState2Temporal(b, view);\r\n var z := not(NoReplicaBeyondViewTemporal(b, view));\r\n\r\n assert t == t1 + t2;\r\n\r\n lemma_StablePeriodStartedLeadsToAcceptorSending1b(b, asp, start_step, processing_bound, view, ahead_idx, idx);\r\n assert sat(start_step, always(imply(w, or(eventuallynextwithin(a, t1, f), eventuallywithin(or(y, z), t1, f)))));\r\n\r\n TemporalAssist();\r\n\r\n forall j | start_step <= j\r\n ensures sat(j, imply(w, eventuallywithin(or(x, or(y, z)), t, f)))\r\n {\r\n if sat(j, w)\r\n {\r\n TemporalDeduceFromAlways(start_step, j, imply(w, or(eventuallynextwithin(a, t1, f), eventuallywithin(or(y, z), t1, f))));\r\n if sat(j, eventuallywithin(or(y, z), t1, f))\r\n {\r\n assert sat(j, eventuallywithin(or(x, or(y, z)), t1, f));\r\n assert sat(j, eventuallywithin(or(x, or(y, z)), t, f));\r\n }\r\n else\r\n {\r\n assert sat(j, eventuallynextwithin(a, t1, f));\r\n var k :| TLe(j, k) && sat(k, nextbefore(a, f[j] + t1, f));\r\n var m := lemma_StablePeriodStartedLeadsToPrimaryGetting1bFromAcceptorHelper(b, asp, start_step, processing_bound, view, idx, k);\r\n assert sat(m, beforeabsolutetime(or(x, or(y, z)), f[k+1] + t2, f));\r\n assert sat(m, beforeabsolutetime(or(x, or(y, z)), f[j] + t, f));\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_PrimaryHas1bFromAcceptorOrIsPastPhase1Stable(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n view:Ballot,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires 0 <= view.proposer_id < |asp.c.config.replica_ids|\r\n ensures sat(i, always(imply(PrimaryHas1bFromAcceptorOrIsPastPhase1Temporal(b, view, idx),\r\n always(PrimaryHas1bFromAcceptorOrIsPastPhase1Temporal(b, view, idx)))))\r\n{\r\n var x := PrimaryHas1bFromAcceptorInViewTemporal(b, view, idx);\r\n var y := PrimaryInState2Temporal(b, view);\r\n var z := not(NoReplicaBeyondViewTemporal(b, view));\r\n var t := PrimaryHas1bFromAcceptorOrIsPastPhase1Temporal(b, view, idx);\r\n \r\n forall j | i <= j && sat(j, t)\r\n ensures sat(j, always(t))\r\n {\r\n forall k | j <= k && sat(k, t) && !sat(k+1, t)\r\n ensures false\r\n {\r\n if sat(k, or(y, z))\r\n {\r\n lemma_IfPrimaryInState2ItsAlwaysAtLeastThere(b, asp, k, view);\r\n TemporalDeduceFromAlways(k, k+1, or(y, z));\r\n assert sat(k+1, t);\r\n assert false;\r\n }\r\n else\r\n {\r\n assert sat(k, x);\r\n var p :| PrimaryHasSpecific1bFromAcceptorInView(b[k], view, idx, p);\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, k);\r\n lemma_ConstantsAllConsistent(b, asp.c, k+1);\r\n var primary_idx := view.proposer_id;\r\n var s := b[k].replicas[primary_idx].replica;\r\n var s' := b[k+1].replicas[primary_idx].replica;\r\n \r\n lemma_NoReplicaBeyondViewImpliesNoMaxBallotISent1aBeyondView(b, asp, k, view);\r\n lemma_MaxBallotISent1aLeqView(b, asp, k, primary_idx);\r\n assert BalLeq(s.proposer.max_ballot_i_sent_1a, s.proposer.election_state.current_view);\r\n assert BalLeq(CurrentViewOfHost(b[k], primary_idx), view);\r\n assert s.proposer.election_state.current_view == view;\r\n\r\n lemma_ViewOfHostMonotonic(b, asp, primary_idx, k, k+1);\r\n assert BalLeq(s.proposer.election_state.current_view, s'.proposer.election_state.current_view);\r\n assert BalLeq(CurrentViewOfHost(b[k+1], primary_idx), view);\r\n assert s'.proposer.election_state.current_view == view;\r\n \r\n lemma_MaxBallotISent1aLeqView(b, asp, k+1, primary_idx);\r\n lemma_MaxBallotISent1aMonotonicOneStep(b, asp.c, k, primary_idx);\r\n assert s'.proposer.max_ballot_i_sent_1a == view;\r\n\r\n assert !PrimaryHasSpecific1bFromAcceptorInView(b[k+1], view, idx, p);\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, k, primary_idx);\r\n assert false;\r\n }\r\n }\r\n TemporalInductionNext(j, t);\r\n }\r\n TemporalAlways(i, imply(t, always(t)));\r\n}\r\n\r\nlemma lemma_StablePeriodStartedLeadsToPrimaryGetting1bFromAcceptorForever(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n ahead_idx:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, start_step, processing_bound)\r\n requires view.proposer_id in asp.live_quorum\r\n requires idx in asp.live_quorum\r\n ensures var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) + processing_bound * 2;\r\n var f := PaxosTimeMap(b);\r\n sat(start_step, leadstowithin(StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx),\r\n always(PrimaryHas1bFromAcceptorOrIsPastPhase1Temporal(b, view, idx)), t, f))\r\n{\r\n var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) + processing_bound * 2;\r\n var f := PaxosTimeMap(b);\r\n lemma_StablePeriodStartedLeadsToPrimaryGetting1bFromAcceptor(b, asp, start_step, processing_bound, view, ahead_idx, idx);\r\n lemma_PrimaryHas1bFromAcceptorOrIsPastPhase1Stable(b, asp, start_step, view, idx);\r\n Lemma_LeadsToWithinImpliesLeadsToConsequenceWithin(start_step,\r\n StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx),\r\n PrimaryHas1bFromAcceptorOrIsPastPhase1Temporal(b, view, idx),\r\n always(PrimaryHas1bFromAcceptorOrIsPastPhase1Temporal(b, view, idx)),\r\n t,\r\n f);\r\n}\r\n\r\nfunction{:opaque} PrimaryHas1bFromAllLiveAcceptorsOrIsPastPhase1TemporalSet(\r\n b:Behavior,\r\n live_quorum:set,\r\n view:Ballot\r\n ):set\r\n requires imaptotal(b)\r\n ensures forall idx :: idx in live_quorum ==>\r\n PrimaryHas1bFromAcceptorOrIsPastPhase1Temporal(b, view, idx) in PrimaryHas1bFromAllLiveAcceptorsOrIsPastPhase1TemporalSet(b, live_quorum, view)\r\n ensures forall x :: x in PrimaryHas1bFromAllLiveAcceptorsOrIsPastPhase1TemporalSet(b, live_quorum, view) ==>\r\n exists idx :: idx in live_quorum && x == PrimaryHas1bFromAcceptorOrIsPastPhase1Temporal(b, view, idx)\r\n{\r\n set idx | idx in live_quorum :: PrimaryHas1bFromAcceptorOrIsPastPhase1Temporal(b, view, idx)\r\n}\r\n\r\nlemma lemma_StablePeriodStartedLeadsToPrimaryGetting1bFromEveryLiveAcceptorForever(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n ahead_idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, start_step, processing_bound)\r\n requires view.proposer_id in asp.live_quorum\r\n ensures var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) + processing_bound * 2;\r\n var f := PaxosTimeMap(b);\r\n var xs := PrimaryHas1bFromAllLiveAcceptorsOrIsPastPhase1TemporalSet(b, asp.live_quorum, view);\r\n sat(start_step, leadstowithin(StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx), always(andset(xs)), t, f))\r\n{\r\n var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) + processing_bound * 2;\r\n var f := PaxosTimeMap(b);\r\n var w := StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx);\r\n var xs := PrimaryHas1bFromAllLiveAcceptorsOrIsPastPhase1TemporalSet(b, asp.live_quorum, view);\r\n forall x | x in xs\r\n ensures sat(start_step, leadstowithin(w, always(x), t, f))\r\n {\r\n var idx :| idx in asp.live_quorum && x == PrimaryHas1bFromAcceptorOrIsPastPhase1Temporal(b, view, idx);\r\n lemma_StablePeriodStartedLeadsToPrimaryGetting1bFromAcceptorForever(b, asp, start_step, processing_bound, view, ahead_idx, idx);\r\n }\r\n Lemma_LeadsToAlwaysEachWithinImpliesLeadsToAlwaysAllWithin(start_step, w, xs, t, f);\r\n}\r\n\r\nlemma lemma_PrimaryHas1bFromAllLiveAcceptorsLeadsToPrimaryEnteringPhase2WF1Req2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n i:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires view.proposer_id in asp.live_quorum\r\n requires 0 <= start_step <= i\r\n ensures var primary_idx := view.proposer_id;\r\n var xs := PrimaryHas1bFromAllLiveAcceptorsOrIsPastPhase1TemporalSet(b, asp.live_quorum, view);\r\n var P := always(andset(xs));\r\n var Q := or(PrimaryInState2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view)));\r\n var Action := MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousMaybeEnterPhase2, primary_idx);\r\n sat(i, TemporalWF1Req2(P, Q, Action))\r\n{\r\n var primary_idx := view.proposer_id;\r\n var xs := PrimaryHas1bFromAllLiveAcceptorsOrIsPastPhase1TemporalSet(b, asp.live_quorum, view);\r\n var y := PrimaryInState2Temporal(b, view);\r\n var z := not(NoReplicaBeyondViewTemporal(b, view));\r\n var P := always(andset(xs));\r\n var Q := or(y, z);\r\n var Action := MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousMaybeEnterPhase2, primary_idx);\r\n\r\n if sat(i, P) && !sat(i, Q) && sat(i, Action)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n assert BalLeq(CurrentViewOfHost(b[i], primary_idx), view);\r\n \r\n assert SpecificSpontaneousRslActionOccurs(b[i], b[i+1], LReplicaNextSpontaneousMaybeEnterPhase2, primary_idx);\r\n var ios:seq :| && RslNextOneReplica(b[i], b[i+1], primary_idx, ios)\r\n && SpontaneousIos(ios, 0)\r\n && LReplicaNextSpontaneousMaybeEnterPhase2(b[i].replicas[primary_idx].replica,\r\n b[i+1].replicas[primary_idx].replica,\r\n ExtractSentPacketsFromIos(ios));\r\n\r\n var s := b[i].replicas[primary_idx].replica.proposer;\r\n var s' := b[i+1].replicas[primary_idx].replica.proposer;\r\n\r\n TemporalDeduceFromAlways(i, i, andset(xs));\r\n\r\n lemma_Received1bPacketsAreFromMaxBallotISent1a(b, asp.c, i, primary_idx);\r\n var mapper := (p:RslPacket) requires p.src in asp.c.config.replica_ids => GetReplicaIndex(p.src, asp.c.config);\r\n var sources := MapSetToSetOver(s.received_1b_packets, mapper);\r\n\r\n forall idx | idx in asp.live_quorum\r\n ensures idx in sources\r\n {\r\n assert sat(i, PrimaryHas1bFromAcceptorInViewTemporal(b, view, idx));\r\n var p :| PrimaryHasSpecific1bFromAcceptorInView(b[i], view, idx, p);\r\n assert ReplicasDistinct(asp.c.config.replica_ids, mapper(p), idx);\r\n assert mapper(p) == idx;\r\n }\r\n lemma_SubsetCardinality(sources, asp.live_quorum, x=>true);\r\n assert |s.received_1b_packets| >= LMinQuorumSize(s.constants.all.config);\r\n assert LSetOfMessage1bAboutBallot(s.received_1b_packets, s.max_ballot_i_sent_1a);\r\n assert s.current_state == 1;\r\n assert s' == s.(current_state := 2,\r\n next_operation_number_to_propose := b[i].replicas[primary_idx].replica.acceptor.log_truncation_point);\r\n assert PrimaryInState2(b[i+1], view);\r\n assert sat(i+1, y);\r\n assert sat(i+1, Q);\r\n }\r\n}\r\n\r\nlemma lemma_PrimaryHas1bFromAllLiveAcceptorsLeadsToPrimaryEnteringPhase2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires asp.synchrony_start <= start_step\r\n requires view.proposer_id in asp.live_quorum\r\n ensures var t := TimeToPerformGenericAction(asp);\r\n var f := PaxosTimeMap(b);\r\n var xs := PrimaryHas1bFromAllLiveAcceptorsOrIsPastPhase1TemporalSet(b, asp.live_quorum, view);\r\n sat(start_step, leadstowithin(always(andset(xs)),\r\n or(PrimaryInState2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view))),\r\n t, f))\r\n{\r\n var t := TimeToPerformGenericAction(asp);\r\n var f := PaxosTimeMap(b);\r\n var primary_idx := view.proposer_id;\r\n var xs := PrimaryHas1bFromAllLiveAcceptorsOrIsPastPhase1TemporalSet(b, asp.live_quorum, view);\r\n var y := PrimaryInState2Temporal(b, view);\r\n var z := not(NoReplicaBeyondViewTemporal(b, view));\r\n var P := always(andset(xs));\r\n var Q := or(y, z);\r\n var Action := MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousMaybeEnterPhase2, primary_idx);\r\n\r\n forall i | start_step <= i\r\n ensures sat(i, TemporalWF1Req1(P, Q))\r\n ensures sat(i, TemporalWF1Req2(P, Q, Action))\r\n {\r\n if sat(i, P)\r\n {\r\n Lemma_AlwaysImpliesLaterAlways(i, i+1, andset(xs));\r\n }\r\n lemma_PrimaryHas1bFromAllLiveAcceptorsLeadsToPrimaryEnteringPhase2WF1Req2(b, asp, start_step, i, view);\r\n }\r\n TemporalAlways(start_step, TemporalWF1Req1(P, Q));\r\n TemporalAlways(start_step, TemporalWF1Req2(P, Q, Action));\r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, primary_idx, 2);\r\n lemma_EstablishRequirementsForWF1RealTime(b, asp, start_step, Action, t);\r\n TemporalWF1RealTime(start_step, P, Q, Action, t, f);\r\n}\r\n\r\nlemma lemma_StablePeriodStartedLeadsToPrimaryInPhase2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n ahead_idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, start_step, processing_bound)\r\n requires view.proposer_id in asp.live_quorum\r\n ensures var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) * 2 + processing_bound * 2;\r\n var f := PaxosTimeMap(b);\r\n sat(start_step, leadstowithin(StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx),\r\n or(PrimaryInState2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view))),\r\n t, f))\r\n{\r\n var t1 := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) + processing_bound * 2;\r\n var t2 := TimeToPerformGenericAction(asp);\r\n var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) * 2 + processing_bound * 2;\r\n var f := PaxosTimeMap(b);\r\n var xs := PrimaryHas1bFromAllLiveAcceptorsOrIsPastPhase1TemporalSet(b, asp.live_quorum, view);\r\n \r\n assert t == t1 + t2;\r\n lemma_StablePeriodStartedLeadsToPrimaryGetting1bFromEveryLiveAcceptorForever(b, asp, start_step, processing_bound, view, ahead_idx);\r\n lemma_PrimaryHas1bFromAllLiveAcceptorsLeadsToPrimaryEnteringPhase2(b, asp, start_step, view);\r\n TransitivityOfLeadsToWithin(start_step,\r\n StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx),\r\n always(andset(xs)),\r\n or(PrimaryInState2Temporal(b, view), not(NoReplicaBeyondViewTemporal(b, view))),\r\n t1, t2, f);\r\n}\r\n\r\nlemma lemma_StablePeriodStartedLeadsToPrimaryEnteringPhase2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n ahead_idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, start_step, processing_bound)\r\n requires view.proposer_id in asp.live_quorum\r\n ensures var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) * 2 + processing_bound * 2;\r\n var f := PaxosTimeMap(b);\r\n var y := PrimaryInState2Temporal(b, view);\r\n sat(start_step, always(imply(StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx),\r\n or(eventuallynextwithin(and(not(y), next(y)), t, f),\r\n eventuallywithin(not(NoReplicaBeyondViewTemporal(b, view)), t, f)))))\r\n{\r\n var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) * 2 + processing_bound * 2;\r\n var f := PaxosTimeMap(b);\r\n var x := StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx);\r\n var y := PrimaryInState2Temporal(b, view);\r\n var z := not(NoReplicaBeyondViewTemporal(b, view));\r\n \r\n lemma_StablePeriodStartedLeadsToPrimaryInPhase2(b, asp, start_step, processing_bound, view, ahead_idx);\r\n TemporalAlways(start_step, imply(x, not(y)));\r\n lemma_TimeMonotonicFromInvariantHolds(b, asp, start_step);\r\n Lemma_LeadsToWithinOrSomethingLeadsToTransitionOrSomething(start_step, x, y, z, t, f);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Phase2Conclusion.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"Phase2Start.i.dfy\"\r\ninclude \"Phase2c.i.dfy\"\r\ninclude \"GenericInvariants.i.dfy\"\r\ninclude \"StateTransfer.i.dfy\"\r\n\r\nmodule LivenessProof__Phase2Conclusion_i {\r\n\r\nimport opened LiveRSL__Broadcast_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__MaxBalReflected_i\r\nimport opened LivenessProof__NextOp_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__Phase2Invariants_i\r\nimport opened LivenessProof__Phase2Start_i\r\nimport opened LivenessProof__Phase2c_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__StateTransfer_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Environment_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_i\r\nimport opened Environment_s\r\nimport opened EnvironmentSynchrony_s\r\nimport opened Collections__Maps2_s\r\nimport opened Common__UpperBound_s\r\nimport opened Math__mul_i\r\n\r\npredicate A2aPacketWithThePersistentClientRequestWasSentInThisViewAndAssignedAnEarlierOperationNumber(\r\n p:RslPacket,\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int,\r\n opn:OperationNumber\r\n )\r\n requires imaptotal(b)\r\n{\r\n && h.start_step + 1 <= i\r\n && p in b[i].environment.sentPackets\r\n && 0 <= h.view.proposer_id < |asp.c.config.replica_ids|\r\n && 0 <= h.view.proposer_id < |b[h.start_step + 1].replicas|\r\n && p.src == asp.c.config.replica_ids[h.view.proposer_id]\r\n && p.dst == asp.c.config.replica_ids[h.view.proposer_id]\r\n && p.msg.RslMessage_2a?\r\n && p.msg.opn_2a < opn\r\n && p.msg.bal_2a == h.view\r\n && asp.persistent_request in p.msg.val_2a\r\n && 0 <= p.msg.opn_2a\r\n && LSetOfMessage1b(b[h.start_step + 1].replicas[h.view.proposer_id].replica.proposer.received_1b_packets)\r\n && LIsAfterLogTruncationPoint(p.msg.opn_2a, b[h.start_step + 1].replicas[h.view.proposer_id].replica.proposer.received_1b_packets)\r\n && LAllAcceptorsHadNoProposal(b[h.start_step + 1].replicas[h.view.proposer_id].replica.proposer.received_1b_packets, p.msg.opn_2a)\r\n}\r\n\r\npredicate ProposerReachedCertainNextOp(\r\n ps:RslState,\r\n idx:int,\r\n opn:OperationNumber\r\n )\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && ps.replicas[idx].replica.proposer.next_operation_number_to_propose >= opn\r\n}\r\n\r\nfunction{:opaque} ProposerReachedCertainNextOpTemporal(\r\n b:Behavior,\r\n idx:int,\r\n opn:OperationNumber\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, ProposerReachedCertainNextOpTemporal(b, idx, opn))} ::\r\n sat(i, ProposerReachedCertainNextOpTemporal(b, idx, opn)) == ProposerReachedCertainNextOp(b[i], idx, opn)\r\n{\r\n stepmap(imap i :: ProposerReachedCertainNextOp(b[i], idx, opn))\r\n}\r\n\r\nlemma lemma_Phase2EventuallyReadyForOperationBeyondClientRequest(\r\n b:Behavior,\r\n asp:AssumptionParameters\r\n ) returns (\r\n h:Phase2Params,\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n ensures Phase2StableWithRequest(b, asp, h)\r\n ensures h.start_step + 1 <= step\r\n ensures sat(step, NoReplicaBeyondViewTemporal(b, h.view))\r\n ensures var opn := h.log_truncation_point + asp.c.params.max_log_length + h.num_requests;\r\n sat(step, or(AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn),\r\n AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn)))\r\n{\r\n var processing_sync_start, processing_bound := lemma_EventuallyPacketProcessingSynchronous(b, asp);\r\n var primary_idx :| primary_idx in asp.live_quorum;\r\n var per_request_duration := TimeToAdvanceOneOperation(asp, processing_bound);\r\n var base_duration := TimeToBeginPhase2(asp, processing_bound) + asp.c.params.max_log_length * per_request_duration;\r\n lemma_mul_nonnegative(asp.c.params.max_log_length, per_request_duration);\r\n h := lemma_EventuallyPhase2StableWithRequest(b, asp, processing_sync_start, processing_bound, primary_idx,\r\n base_duration, per_request_duration);\r\n var opn := h.log_truncation_point + asp.c.params.max_log_length + h.num_requests;\r\n step := lemma_EventuallyAllLiveReplicasReadyForCertainOperation(b, asp, h, opn);\r\n\r\n assert h.per_request_duration == per_request_duration;\r\n assert h.base_duration == base_duration;\r\n assert h.duration == h.base_duration + h.num_requests * h.per_request_duration;\r\n\r\n calc {\r\n b[step].environment.time;\r\n <= b[h.start_step + 1].environment.time + TimeToBeginPhase2(asp, h.processing_bound) + (asp.c.params.max_log_length + h.num_requests) * per_request_duration;\r\n { lemma_mul_is_distributive_add_other_way(per_request_duration, asp.c.params.max_log_length, h.num_requests); }\r\n b[h.start_step + 1].environment.time + TimeToBeginPhase2(asp, h.processing_bound) + asp.c.params.max_log_length * per_request_duration + h.num_requests * per_request_duration;\r\n b[h.start_step + 1].environment.time + h.duration;\r\n }\r\n\r\n TemporalDeduceFromAlwaysWithin(h.start_step + 1, step, NoReplicaBeyondViewTemporal(b, h.view), h.duration, PaxosTimeMap(b));\r\n}\r\n\r\nlemma{:timeLimitMultiplier 2} lemma_RequestMovesUpInPrimaryRequestQueueAsNextOpToProposeIncreases(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int\r\n ) returns (\r\n p:RslPacket\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= i\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n ensures 0 <= h.view.proposer_id < |b[i].replicas|\r\n ensures var s := b[i].replicas[h.view.proposer_id].replica.proposer;\r\n var diff := s.next_operation_number_to_propose - (h.log_truncation_point + asp.c.params.max_log_length);\r\n var n := if diff >= 0 then h.num_requests - diff else h.num_requests;\r\n || ObjectInFirstNOfSequence(asp.persistent_request, s.request_queue, n)\r\n || A2aPacketWithThePersistentClientRequestWasSentInThisViewAndAssignedAnEarlierOperationNumber(p, b, asp, h, i, s.next_operation_number_to_propose)\r\n decreases i\r\n{\r\n if i == h.start_step + 1\r\n {\r\n return;\r\n }\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n var s := b[i-1].replicas[h.view.proposer_id].replica.proposer;\r\n var s' := b[i].replicas[h.view.proposer_id].replica.proposer;\r\n\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, i-1, i, h.view);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i-1);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i);\r\n p := lemma_RequestMovesUpInPrimaryRequestQueueAsNextOpToProposeIncreases(b, asp, h, i-1);\r\n\r\n var diff := s.next_operation_number_to_propose - (h.log_truncation_point + asp.c.params.max_log_length);\r\n var diff' := s'.next_operation_number_to_propose - (h.log_truncation_point + asp.c.params.max_log_length);\r\n var n := if diff >= 0 then h.num_requests - diff else h.num_requests;\r\n var n' := if diff' >= 0 then h.num_requests - diff' else h.num_requests;\r\n\r\n if !ObjectInFirstNOfSequence(asp.persistent_request, s.request_queue, n)\r\n {\r\n lemma_NextOperationNumberToProposeIncreasesInPhase2OneStep(b, asp, h, i-1);\r\n return;\r\n }\r\n\r\n if s.next_operation_number_to_propose == s'.next_operation_number_to_propose\r\n {\r\n if s.request_queue != s'.request_queue\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i-1, h.view.proposer_id);\r\n var val :| s'.request_queue == s.request_queue + [val];\r\n assert s.request_queue <= s'.request_queue;\r\n assert ObjectInFirstNOfSequence(asp.persistent_request, s'.request_queue, n);\r\n }\r\n }\r\n else\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i-1, h.view.proposer_id);\r\n assert s'.next_operation_number_to_propose == s.next_operation_number_to_propose + 1;\r\n if && LAllAcceptorsHadNoProposal(s.received_1b_packets, s.next_operation_number_to_propose)\r\n && LProposerNominateNewValueAndSend2a(s, s', ios[0].t,\r\n b[i-1].replicas[h.view.proposer_id].replica.acceptor.log_truncation_point,\r\n ExtractSentPacketsFromIos(ios))\r\n {\r\n var batchSize := if |s.request_queue| <= asp.c.params.max_batch_size then |s.request_queue| else asp.c.params.max_batch_size;\r\n if asp.persistent_request in s.request_queue[..batchSize]\r\n {\r\n assert LBroadcastToEveryone(asp.c.config, h.view.proposer_id, RslMessage_2a(h.view, s.next_operation_number_to_propose, s.request_queue[..batchSize]), ExtractSentPacketsFromIos(ios));\r\n p := LPacket(asp.c.config.replica_ids[h.view.proposer_id], asp.c.config.replica_ids[h.view.proposer_id], RslMessage_2a(h.view, s.next_operation_number_to_propose, s.request_queue[..batchSize]));\r\n assert LIoOpSend(p) in ios;\r\n assert p in b[i].environment.sentPackets;\r\n assert s'.next_operation_number_to_propose > s.next_operation_number_to_propose;\r\n lemma_Received1bPacketInvariantInPhase2(b, asp, h, i-1);\r\n assert A2aPacketWithThePersistentClientRequestWasSentInThisViewAndAssignedAnEarlierOperationNumber(p, b, asp, h, i, s'.next_operation_number_to_propose);\r\n }\r\n else\r\n {\r\n assert s'.request_queue == s.request_queue[batchSize..];\r\n }\r\n }\r\n else\r\n {\r\n if diff >= 0\r\n {\r\n lemma_OperationNumberMaxLogLengthAheadHasNoProposal(b, asp, h, i, s.next_operation_number_to_propose);\r\n var opn :| opn > s.next_operation_number_to_propose && !LAllAcceptorsHadNoProposal(s.received_1b_packets, opn);\r\n lemma_OperationNumberMaxLogLengthAheadHasNoProposal(b, asp, h, i, opn);\r\n assert false;\r\n }\r\n\r\n assert n' == n;\r\n assert s'.request_queue == s.request_queue;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_RequestGetsProposedOnceNextOpIsHighEnough(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int,\r\n opn:OperationNumber\r\n ) returns (\r\n p:RslPacket\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= i\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n requires 0 <= h.view.proposer_id < |b[i].replicas|\r\n requires b[i].replicas[h.view.proposer_id].replica.proposer.next_operation_number_to_propose >= opn >= h.log_truncation_point + asp.c.params.max_log_length + h.num_requests\r\n ensures 0 <= h.view.proposer_id < |b[i].replicas|\r\n ensures A2aPacketWithThePersistentClientRequestWasSentInThisViewAndAssignedAnEarlierOperationNumber(p, b, asp, h, i, opn)\r\n{\r\n var x := ProposerReachedCertainNextOpTemporal(b, h.view.proposer_id, opn);\r\n assert sat(i, x);\r\n assert !sat(h.start_step + 1, x);\r\n var earliest_step_reaching_opn := earliestStepBetween(h.start_step + 1, i, x);\r\n var prev_step := earliest_step_reaching_opn - 1;\r\n assert h.start_step + 1 <= prev_step < earliest_step_reaching_opn <= i;\r\n assert !sat(prev_step, x);\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, prev_step);\r\n lemma_ConstantsAllConsistent(b, asp.c, prev_step + 1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, prev_step);\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, prev_step, i, h.view);\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, prev_step + 1, i, h.view);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, prev_step);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, prev_step + 1);\r\n\r\n var s := b[prev_step].replicas[h.view.proposer_id].replica.proposer;\r\n var s' := b[prev_step + 1].replicas[h.view.proposer_id].replica.proposer;\r\n\r\n assert s'.next_operation_number_to_propose >= opn > s.next_operation_number_to_propose;\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, prev_step, h.view.proposer_id);\r\n \r\n assert s'.next_operation_number_to_propose == opn;\r\n p := lemma_RequestMovesUpInPrimaryRequestQueueAsNextOpToProposeIncreases(b, asp, h, prev_step + 1);\r\n\r\n lemma_PacketStaysInSentPackets(b, asp.c, prev_step + 1, i, p);\r\n}\r\n\r\nlemma lemma_IfPersistentRequestMissingFromRequestQueueDuringPhase2ThenPersistentRequestIsProposed(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int,\r\n opn:OperationNumber\r\n ) returns (\r\n p:RslPacket\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= i\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n requires 0 <= h.view.proposer_id < |b[i].replicas|\r\n requires asp.persistent_request !in b[i].replicas[h.view.proposer_id].replica.proposer.request_queue\r\n ensures A2aPacketWithThePersistentClientRequestWasSentInThisViewAndAssignedAnEarlierOperationNumber(p, b, asp, h, i, b[i].replicas[h.view.proposer_id].replica.proposer.next_operation_number_to_propose)\r\n{\r\n if i == h.start_step + 1\r\n {\r\n return;\r\n }\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, i-1, i, h.view);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i-1);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i);\r\n\r\n var s := b[i-1].replicas[h.view.proposer_id].replica.proposer;\r\n var s' := b[i].replicas[h.view.proposer_id].replica.proposer;\r\n\r\n if asp.persistent_request !in s.request_queue\r\n {\r\n p := lemma_IfPersistentRequestMissingFromRequestQueueDuringPhase2ThenPersistentRequestIsProposed(b, asp, h, i-1, opn);\r\n lemma_NextOperationNumberToProposeIncreasesInPhase2OneStep(b, asp, h, i-1);\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i-1, h.view.proposer_id);\r\n assert s'.next_operation_number_to_propose == s.next_operation_number_to_propose + 1;\r\n assert LAllAcceptorsHadNoProposal(s.received_1b_packets, s.next_operation_number_to_propose);\r\n assert LProposerNominateNewValueAndSend2a(s, s', ios[0].t,\r\n b[i-1].replicas[h.view.proposer_id].replica.acceptor.log_truncation_point,\r\n ExtractSentPacketsFromIos(ios));\r\n var batchSize := if |s.request_queue| <= asp.c.params.max_batch_size then |s.request_queue| else asp.c.params.max_batch_size;\r\n assert asp.persistent_request in s.request_queue[..batchSize];\r\n p := LPacket(asp.c.config.replica_ids[h.view.proposer_id], asp.c.config.replica_ids[h.view.proposer_id], RslMessage_2a(h.view, s.next_operation_number_to_propose, s.request_queue[..batchSize]));\r\n assert LIoOpSend(p) in ios;\r\n assert p in b[i].environment.sentPackets;\r\n lemma_Received1bPacketInvariantInPhase2(b, asp, h, i-1);\r\n assert A2aPacketWithThePersistentClientRequestWasSentInThisViewAndAssignedAnEarlierOperationNumber(p, b, asp, h, i, s'.next_operation_number_to_propose);\r\n}\r\n\r\nlemma lemma_Phase2EventuallyReadyForOperationBeyond2aWithClientRequest(\r\n b:Behavior,\r\n asp:AssumptionParameters\r\n ) returns (\r\n h:Phase2Params,\r\n step:int,\r\n opn:OperationNumber,\r\n p:RslPacket\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n ensures Phase2StableWithRequest(b, asp, h)\r\n ensures sat(step, NoReplicaBeyondViewTemporal(b, h.view))\r\n ensures ReplicaCaughtUp(b[step], h.king_idx, opn)\r\n ensures A2aPacketWithThePersistentClientRequestWasSentInThisViewAndAssignedAnEarlierOperationNumber(p, b, asp, h, step, opn)\r\n{\r\n h, step := lemma_Phase2EventuallyReadyForOperationBeyondClientRequest(b, asp);\r\n opn := h.log_truncation_point + asp.c.params.max_log_length + h.num_requests;\r\n lemma_ConstantsAllConsistent(b, asp.c, step);\r\n assert sat(step, NoReplicaBeyondViewTemporal(b, h.view));\r\n if sat(step, AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn))\r\n {\r\n p := lemma_RequestGetsProposedOnceNextOpIsHighEnough(b, asp, h, step, opn);\r\n assert ReplicaCaughtUp(b[step], h.king_idx, opn);\r\n assert A2aPacketWithThePersistentClientRequestWasSentInThisViewAndAssignedAnEarlierOperationNumber(p, b, asp, h, step, opn);\r\n }\r\n else\r\n {\r\n p := lemma_IfPersistentRequestMissingFromRequestQueueDuringPhase2ThenPersistentRequestIsProposed(b, asp, h, step, opn);\r\n opn := b[step].replicas[h.view.proposer_id].replica.proposer.next_operation_number_to_propose;\r\n assert ReplicaCaughtUp(b[step], h.king_idx, opn);\r\n assert A2aPacketWithThePersistentClientRequestWasSentInThisViewAndAssignedAnEarlierOperationNumber(p, b, asp, h, step, opn);\r\n }\r\n}\r\n\r\nlemma lemma_EventuallyKingExecutesOperationCorrespondingTo2aWithClientRequest(\r\n b:Behavior,\r\n asp:AssumptionParameters\r\n ) returns (\r\n h:Phase2Params,\r\n step:int,\r\n opn:OperationNumber,\r\n p:RslPacket,\r\n execute_step:int,\r\n ios:seq\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n ensures Phase2StableWithRequest(b, asp, h)\r\n ensures A2aPacketWithThePersistentClientRequestWasSentInThisViewAndAssignedAnEarlierOperationNumber(p, b, asp, h, step, opn)\r\n ensures 0 <= execute_step\r\n ensures 0 <= h.king_idx < |b[execute_step].replicas|\r\n ensures 0 <= h.king_idx < |b[execute_step+1].replicas|\r\n ensures RslNextOneReplica(b[execute_step], b[execute_step+1], h.king_idx, ios)\r\n ensures var s := b[execute_step].replicas[h.king_idx].replica.executor;\r\n && s.next_op_to_execute.OutstandingOpKnown?\r\n && BalLeq(s.next_op_to_execute.bal, h.view)\r\n && s.ops_complete == p.msg.opn_2a\r\n && LtUpperBound(s.ops_complete, s.constants.all.params.max_integer_val)\r\n && LReplicaConstantsValid(s.constants)\r\n ensures LExecutorExecute(b[execute_step].replicas[h.king_idx].replica.executor, b[execute_step+1].replicas[h.king_idx].replica.executor,\r\n ExtractSentPacketsFromIos(ios))\r\n{\r\n h, step, opn, p := lemma_Phase2EventuallyReadyForOperationBeyond2aWithClientRequest(b, asp);\r\n\r\n var x := stepmap(imap j :: 0 <= h.king_idx < |b[j].replicas| && b[j].replicas[h.king_idx].replica.executor.ops_complete > p.msg.opn_2a);\r\n var execute_next_step := earliestStepBetween(0, step, x);\r\n execute_step := execute_next_step - 1;\r\n assert !sat(0, x);\r\n assert !sat(execute_step, x);\r\n\r\n lemma_ReplicaConstantsAllConsistent(b, asp.c, execute_step, h.king_idx);\r\n lemma_ReplicaConstantsAllConsistent(b, asp.c, execute_next_step, h.king_idx);\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, execute_step, step, h.view);\r\n ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, execute_step, h.king_idx);\r\n\r\n var s := b[execute_step].replicas[h.king_idx].replica.executor;\r\n var s' := b[execute_next_step].replicas[h.king_idx].replica.executor;\r\n\r\n if b[execute_step].replicas[h.king_idx].nextActionIndex == 0\r\n {\r\n var p_state_supply := ios[0].r;\r\n assert IsValidLIoOp(ios[0], asp.c.config.replica_ids[h.king_idx], b[execute_step].environment);\r\n lemma_StateSupplyToKingDoesNotIncludeOpn(b, asp, h, execute_step, p.msg.opn_2a, p_state_supply);\r\n assert false;\r\n }\r\n\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, execute_next_step, step, h.view);\r\n lemma_MaxBalReflectedLeqCurrentView(b, asp, execute_next_step, h.view, h.king_idx);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Phase2Invariants.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"ViewChange.i.dfy\"\r\ninclude \"MaxBallot.i.dfy\"\r\ninclude \"MaxBallotISent1a.i.dfy\"\r\ninclude \"MaxBalReflected.i.dfy\"\r\ninclude \"GenericInvariants.i.dfy\"\r\ninclude \"../CommonProof/MaxBallotISent1a.i.dfy\"\r\ninclude \"../CommonProof/MaxBallot.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../CommonProof/LogTruncationPoint.i.dfy\"\r\ninclude \"../CommonProof/Environment.i.dfy\"\r\n\r\nmodule LivenessProof__Phase2Invariants_i {\r\n\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__ViewChange_i\r\nimport opened LivenessProof__MaxBallot_i\r\nimport opened LivenessProof__MaxBallotISent1a_i\r\nimport opened LivenessProof__MaxBalReflected_i\r\nimport opened LivenessProof__GenericInvariants_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Environment_i\r\nimport opened CommonProof__LogTruncationPoint_i\r\nimport opened CommonProof__MaxBallot_i\r\nimport opened CommonProof__MaxBallotISent1a_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\nimport opened Common__UpperBound_s\r\n\r\npredicate ReplicaCaughtUp(\r\n ps:RslState,\r\n idx:int,\r\n opn:OperationNumber\r\n )\r\n{\r\n 0 <= idx < |ps.replicas| && ps.replicas[idx].replica.executor.ops_complete >= opn\r\n}\r\n\r\nfunction{:opaque} ReplicaCaughtUpTemporal(\r\n b:Behavior,\r\n idx:int,\r\n opn:OperationNumber\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, ReplicaCaughtUpTemporal(b, idx, opn))} ::\r\n sat(i, ReplicaCaughtUpTemporal(b, idx, opn)) == ReplicaCaughtUp(b[i], idx, opn)\r\n{\r\n stepmap(imap i :: ReplicaCaughtUp(b[i], idx, opn))\r\n}\r\n\r\nfunction{:opaque} AllReplicasCaughtUpTemporalSet(\r\n b:Behavior,\r\n live_quorum:set,\r\n opn:OperationNumber\r\n ):set\r\n requires imaptotal(b)\r\n ensures forall idx :: idx in live_quorum ==> ReplicaCaughtUpTemporal(b, idx, opn) in AllReplicasCaughtUpTemporalSet(b, live_quorum, opn)\r\n ensures forall t :: t in AllReplicasCaughtUpTemporalSet(b, live_quorum, opn) ==> exists idx :: idx in live_quorum && t == ReplicaCaughtUpTemporal(b, idx, opn)\r\n{\r\n set idx | idx in live_quorum :: ReplicaCaughtUpTemporal(b, idx, opn)\r\n}\r\n\r\npredicate AllLiveReplicasReadyForNextOperation(\r\n ps:RslState,\r\n live_quorum:set,\r\n view:Ballot,\r\n opn:OperationNumber\r\n )\r\n{\r\n && (forall idx :: idx in live_quorum ==> ReplicaCaughtUp(ps, idx, opn))\r\n && var proposer_idx := view.proposer_id;\r\n && 0 <= proposer_idx < |ps.replicas|\r\n && var s := ps.replicas[proposer_idx].replica;\r\n && s.proposer.next_operation_number_to_propose >= opn\r\n && s.acceptor.log_truncation_point >= opn\r\n}\r\n\r\nfunction {:opaque} AllLiveReplicasReadyForNextOperationTemporal(\r\n b:Behavior,\r\n live_quorum:set,\r\n view:Ballot,\r\n opn:OperationNumber\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, AllLiveReplicasReadyForNextOperationTemporal(b, live_quorum, view, opn))} ::\r\n sat(i, AllLiveReplicasReadyForNextOperationTemporal(b, live_quorum, view, opn)) ==\r\n AllLiveReplicasReadyForNextOperation(b[i], live_quorum, view, opn)\r\n{\r\n stepmap(imap i :: AllLiveReplicasReadyForNextOperation(b[i], live_quorum, view, opn))\r\n}\r\n\r\nlemma lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n j:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i <= j\r\n requires NoReplicaBeyondView(b[j], view)\r\n ensures NoReplicaBeyondView(b[i], view)\r\n{\r\n if !sat(i, NoReplicaBeyondViewTemporal(b, view))\r\n {\r\n var idx :| 0 <= idx < |b[i].replicas| && BalLt(view, CurrentViewOfHost(b[i], idx));\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, j);\r\n lemma_ViewOfHostMonotonic(b, asp, idx, i, j);\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_ProposerStaysInState2InPhase2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= i\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n ensures 0 <= h.view.proposer_id < |b[i].replicas|\r\n ensures var s := b[i].replicas[h.view.proposer_id].replica.proposer;\r\n && s.max_ballot_i_sent_1a == h.view\r\n && s.current_state == 2;\r\n decreases i\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n \r\n if i > h.start_step + 1\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, i-1, i, h.view);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i-1);\r\n\r\n var s := b[i-1].replicas[h.view.proposer_id].replica.proposer;\r\n var s' := b[i].replicas[h.view.proposer_id].replica.proposer;\r\n assert s.max_ballot_i_sent_1a == h.view;\r\n assert s.current_state == 2;\r\n\r\n assert BalLeq(CurrentViewOfHost(b[i-1], h.view.proposer_id), h.view); // TRIGGER\r\n lemma_MaxBallotISent1aLeqView(b, asp, i-1, h.view.proposer_id);\r\n assert s.election_state.current_view == h.view;\r\n\r\n assert BalLeq(CurrentViewOfHost(b[i], h.view.proposer_id), h.view); // TRIGGER\r\n assert BalLeq(s'.election_state.current_view, h.view);\r\n lemma_NoReplicaBeyondViewImpliesNoMaxBallotISent1aBeyondView(b, asp, i, h.view);\r\n assert BalLeq(s'.max_ballot_i_sent_1a, h.view);\r\n\r\n if s'.max_ballot_i_sent_1a != h.view || s'.current_state != 2\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i-1, h.view.proposer_id);\r\n assert false;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_NextOperationNumberToProposeIncreasesInPhase2OneStep(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= i\r\n requires NoReplicaBeyondView(b[i+1], h.view)\r\n ensures 0 <= h.view.proposer_id < |b[i].replicas|\r\n ensures 0 <= h.view.proposer_id < |b[i+1].replicas|\r\n ensures b[i+1].replicas[h.view.proposer_id].replica.proposer.next_operation_number_to_propose\r\n >= b[i].replicas[h.view.proposer_id].replica.proposer.next_operation_number_to_propose\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n\r\n var s := b[i].replicas[h.view.proposer_id].replica.proposer;\r\n var s' := b[i+1].replicas[h.view.proposer_id].replica.proposer;\r\n\r\n if s'.next_operation_number_to_propose < s.next_operation_number_to_propose\r\n {\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, i, i+1, h.view);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i);\r\n assert s.max_ballot_i_sent_1a == h.view;\r\n assert s.current_state == 2;\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, h.view.proposer_id);\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_NextOperationNumberToProposeIncreasesInPhase2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int,\r\n j:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= i <= j\r\n requires NoReplicaBeyondView(b[j], h.view)\r\n ensures 0 <= h.view.proposer_id < |b[i].replicas|\r\n ensures 0 <= h.view.proposer_id < |b[j].replicas|\r\n ensures b[j].replicas[h.view.proposer_id].replica.proposer.next_operation_number_to_propose\r\n >= b[i].replicas[h.view.proposer_id].replica.proposer.next_operation_number_to_propose\r\n decreases j-i\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, j);\r\n\r\n if j == i\r\n {\r\n }\r\n else if j == i + 1\r\n {\r\n lemma_NextOperationNumberToProposeIncreasesInPhase2OneStep(b, asp, h, i);\r\n }\r\n else\r\n {\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, j-1, j, h.view);\r\n lemma_ConstantsAllConsistent(b, asp.c, j-1);\r\n lemma_NextOperationNumberToProposeIncreasesInPhase2(b, asp, h, i, j-1);\r\n lemma_NextOperationNumberToProposeIncreasesInPhase2OneStep(b, asp, h, j-1);\r\n }\r\n}\r\n\r\nlemma lemma_Received1bPacketInvariantInPhase2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= i\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n ensures 0 <= h.view.proposer_id < |b[i].replicas|\r\n ensures var s := b[i].replicas[h.view.proposer_id].replica.proposer;\r\n && s.received_1b_packets == b[h.start_step + 1].replicas[h.view.proposer_id].replica.proposer.received_1b_packets\r\n && |s.received_1b_packets| >= LMinQuorumSize(s.constants.all.config)\r\n && LSetOfMessage1bAboutBallot(s.received_1b_packets, s.max_ballot_i_sent_1a)\r\n decreases i;\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n \r\n if i > h.start_step + 1\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, i-1, i, h.view);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i-1);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i);\r\n\r\n var idx := h.view.proposer_id;\r\n var s := b[i-1].replicas[idx].replica.proposer;\r\n var s' := b[i].replicas[idx].replica.proposer;\r\n if s'.received_1b_packets != s.received_1b_packets\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i-1, idx);\r\n assert false;\r\n }\r\n\r\n lemma_Received1bPacketInvariantInPhase2(b, asp, h, i-1);\r\n }\r\n}\r\n\r\nlemma lemma_ProposerCanNominateInPhase2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= i\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n ensures 0 <= h.view.proposer_id < |b[i].replicas|\r\n ensures var s := b[i].replicas[h.view.proposer_id].replica;\r\n s.proposer.next_operation_number_to_propose < s.acceptor.log_truncation_point + asp.c.params.max_log_length\r\n ==> LProposerCanNominateUsingOperationNumber(s.proposer, s.acceptor.log_truncation_point, s.proposer.next_operation_number_to_propose)\r\n decreases i\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n var idx := h.view.proposer_id;\r\n\r\n var s := b[i].replicas[idx].replica;\r\n var opn := s.proposer.next_operation_number_to_propose;\r\n\r\n if opn < s.acceptor.log_truncation_point + asp.c.params.max_log_length\r\n {\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, i);\r\n assert s.proposer.max_ballot_i_sent_1a == h.view;\r\n assert s.proposer.current_state == 2;\r\n\r\n lemma_MaxBallotISent1aLeqView(b, asp, i, idx);\r\n assert BalLeq(CurrentViewOfHost(b[i], idx), h.view);\r\n assert s.proposer.election_state.current_view == s.proposer.max_ballot_i_sent_1a;\r\n\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, i, idx);\r\n assert opn < UpperBoundedAddition(s.acceptor.log_truncation_point, s.proposer.constants.all.params.max_log_length, s.proposer.constants.all.params.max_integer_val);\r\n\r\n lemma_NextOperationNumberToProposeIncreasesInPhase2(b, asp, h, h.start_step + 1, i);\r\n\r\n calc {\r\n opn;\r\n >= b[h.start_step + 1].replicas[idx].replica.proposer.next_operation_number_to_propose;\r\n == b[h.start_step + 1].replicas[idx].replica.acceptor.log_truncation_point;\r\n >= { lemma_LogTruncationPointMonotonic(b, asp.c, 0, h.start_step + 1, idx); }\r\n b[0].replicas[idx].replica.acceptor.log_truncation_point;\r\n == 0;\r\n }\r\n\r\n lemma_Received1bPacketInvariantInPhase2(b, asp, h, i);\r\n assert s.proposer.next_operation_number_to_propose >= h.log_truncation_point;\r\n lemma_ProposerLogTruncationPointAlwaysBeyondThatOfAllReceived1bs(b, asp.c, h.start_step + 1, idx);\r\n assert forall p :: p in s.proposer.received_1b_packets && p.msg.RslMessage_1b? ==> p.msg.log_truncation_point <= h.log_truncation_point <= s.proposer.next_operation_number_to_propose;\r\n assert LProposerCanNominateUsingOperationNumber(s.proposer, s.acceptor.log_truncation_point, opn);\r\n }\r\n}\r\n\r\nlemma lemma_IfAllLiveReplicasReadyForNextOperationThenSoLaterInPhase2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n i:int,\r\n j:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= i <= j\r\n requires AllLiveReplicasReadyForNextOperation(b[i], asp.live_quorum, h.view, opn)\r\n requires NoReplicaBeyondView(b[j], h.view)\r\n ensures AllLiveReplicasReadyForNextOperation(b[j], asp.live_quorum, h.view, opn)\r\n{\r\n lemma_LogTruncationPointMonotonic(b, asp.c, i, j, h.view.proposer_id);\r\n lemma_NextOperationNumberToProposeIncreasesInPhase2(b, asp, h, i, j);\r\n forall idx | idx in asp.live_quorum\r\n ensures ReplicaCaughtUp(b[j], idx, opn)\r\n {\r\n lemma_OpsCompleteMonotonic(b, asp.c, i, j, idx);\r\n }\r\n}\r\n\r\nlemma lemma_MaxBalNeverExceedsViewDuringPhase2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int,\r\n idx:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n ensures BalLeq(b[i].replicas[idx].replica.acceptor.max_bal, h.view)\r\n{\r\n if NoReplicaBeyondView(b[i], h.view)\r\n {\r\n lemma_MaxBalLeqMaxBallotPrimarySent1a(b, asp.c, i, idx);\r\n var max_bal := b[i].replicas[idx].replica.acceptor.max_bal;\r\n assert BalLeq(max_bal, b[i].replicas[max_bal.proposer_id].replica.proposer.max_ballot_i_sent_1a);\r\n lemma_NoReplicaBeyondViewImpliesNoMaxBallotISent1aBeyondView(b, asp, i, h.view);\r\n assert BalLeq(b[i].replicas[max_bal.proposer_id].replica.proposer.max_ballot_i_sent_1a, h.view);\r\n }\r\n}\r\n\r\nlemma lemma_LearnerMaxBallotSeenNeverExceedsViewDuringPhase2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int,\r\n idx:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n ensures BalLeq(b[i].replicas[idx].replica.learner.max_ballot_seen, h.view)\r\n{\r\n var max_ballot_seen := b[i].replicas[idx].replica.learner.max_ballot_seen;\r\n lemma_LearnerMaxBallotSeenShowsPrimaryReachedState2(b, asp.c, i, idx);\r\n assert BalLeq(max_ballot_seen, b[i].replicas[max_ballot_seen.proposer_id].replica.proposer.max_ballot_i_sent_1a);\r\n lemma_NoReplicaBeyondViewImpliesNoMaxBallotISent1aBeyondView(b, asp, i, h.view);\r\n assert BalLeq(b[i].replicas[max_ballot_seen.proposer_id].replica.proposer.max_ballot_i_sent_1a, h.view);\r\n}\r\n\r\nlemma lemma_OperationNumberMaxLogLengthAheadHasNoProposal(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int,\r\n opn:OperationNumber\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= i\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n requires opn >= h.log_truncation_point + asp.c.params.max_log_length\r\n ensures 0 <= h.view.proposer_id < |b[i].replicas|\r\n ensures LSetOfMessage1b(b[i].replicas[h.view.proposer_id].replica.proposer.received_1b_packets)\r\n ensures LAllAcceptorsHadNoProposal(b[i].replicas[h.view.proposer_id].replica.proposer.received_1b_packets, opn)\r\n{\r\n lemma_Received1bPacketInvariantInPhase2(b, asp, h, i);\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, h.start_step + 1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n \r\n var s := b[h.start_step + 1].replicas[h.view.proposer_id].replica;\r\n\r\n forall p | p in s.proposer.received_1b_packets\r\n ensures opn !in p.msg.votes\r\n {\r\n if opn in p.msg.votes\r\n {\r\n lemma_VoteInReceived1bMessageAlwaysWithinLogTruncationPointRange(b, asp.c, h.start_step + 1, h.view.proposer_id, opn, p);\r\n assert false;\r\n }\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Phase2Start.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"ViewPersistence.i.dfy\"\r\ninclude \"Phase1bCont.i.dfy\"\r\ninclude \"RequestQueue.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../CommonProof/LogTruncationPoint.i.dfy\"\r\ninclude \"../../../../Libraries/Math/mul.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Rules.i.dfy\"\r\n\r\nmodule LivenessProof__Phase2Start_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__Phase1b_i\r\nimport opened LivenessProof__Phase1bCont_i\r\nimport opened LivenessProof__RealTime_i\r\nimport opened LivenessProof__RequestQueue_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__ViewAdvance_i\r\nimport opened LivenessProof__ViewPersistence_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__LogTruncationPoint_i\r\nimport opened Math__mul_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\nimport opened Common__UpperBound_s\r\n\r\nlemma lemma_EventuallyPhase2StableWithRequestHelper(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n primary_idx:int,\r\n base_duration:int,\r\n per_request_duration:int\r\n ) returns (\r\n start_step:int,\r\n ahead_idx:int,\r\n step:int,\r\n view:Ballot,\r\n num_requests:int,\r\n duration:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires primary_idx in asp.live_quorum\r\n requires base_duration >= 0\r\n requires per_request_duration >= 0\r\n ensures processing_sync_start <= step\r\n ensures view.proposer_id == primary_idx\r\n ensures LeqUpperBound(view.seqno, asp.c.params.max_integer_val)\r\n ensures num_requests > 0\r\n ensures duration == base_duration + num_requests * per_request_duration\r\n ensures processing_sync_start <= start_step <= step\r\n ensures sat(start_step, StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx))\r\n ensures sat(start_step, always(RequestInFirstNTemporal(b, view.proposer_id, asp.persistent_request, num_requests)))\r\n ensures sat(step, always(untilabsolutetime(NoReplicaBeyondViewTemporal(b, view), b[step+1].environment.time + duration, PaxosTimeMap(b))))\r\n ensures !PrimaryInState2(b[step], view)\r\n ensures PrimaryInState2(b[step+1], view)\r\n{\r\n var t := TimeForOneReplicaToAdvanceAnother(asp, processing_bound) + TimeToPerformGenericAction(asp) * 2 + processing_bound * 2;\r\n var f := PaxosTimeMap(b);\r\n var full_duration:int;\r\n\r\n view, start_step, ahead_idx, num_requests, full_duration := lemma_EventuallyBallotStableWithRequest(b, asp, processing_sync_start, processing_bound, primary_idx, t + base_duration, per_request_duration);\r\n\r\n lemma_mul_nonnegative(num_requests, per_request_duration);\r\n\r\n var x := StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx);\r\n var y := PrimaryInState2Temporal(b, view);\r\n var z := NoReplicaBeyondViewTemporal(b, view);\r\n duration := base_duration + num_requests * per_request_duration;\r\n\r\n lemma_IfPacketProcessingSynchronousThenAlways(b, asp, processing_sync_start, start_step, processing_bound);\r\n lemma_StablePeriodStartedLeadsToPrimaryEnteringPhase2(b, asp, start_step, processing_bound, view, ahead_idx);\r\n TemporalDeduceFromAlways(start_step, start_step, imply(x, or(eventuallynextwithin(and(not(y), next(y)), t, f), eventuallywithin(not(z), t, f))));\r\n assert sat(start_step, x);\r\n assert sat(start_step, or(eventuallynextwithin(and(not(y), next(y)), t, f), eventuallywithin(not(z), t, f)));\r\n\r\n if sat(start_step, eventuallywithin(not(z), t, f))\r\n {\r\n var i := TemporalDeduceFromEventual(start_step, beforeabsolutetime(not(z), f[start_step] + t, f));\r\n TemporalDeduceFromAlways(start_step, i, untilabsolutetime(z, f[start_step] + full_duration, f));\r\n assert full_duration >= t;\r\n assert false;\r\n }\r\n\r\n assert sat(start_step, eventuallynextwithin(and(not(y), next(y)), t, f));\r\n step := TemporalDeduceFromEventual(start_step, nextbefore(and(not(y), next(y)), f[start_step]+t, f));\r\n Lemma_AlwaysImpliesLaterAlways(start_step, step, untilabsolutetime(z, f[start_step] + full_duration, f));\r\n\r\n assert f[step+1] + duration <= f[start_step] + full_duration;\r\n lemma_TimeMonotonicFromInvariantHolds(b, asp, step);\r\n Lemma_AlwaysUntilAbsoluteTimeImpliesAlwaysUntilEarlierTime(step, z, f[start_step] + full_duration, f[step+1] + duration, f);\r\n}\r\n\r\nlemma lemma_EventuallyPhase2StableWithRequest(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n primary_idx:int,\r\n base_duration:int,\r\n per_request_duration:int\r\n ) returns (\r\n h:Phase2Params\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires primary_idx in asp.live_quorum\r\n requires base_duration >= 0\r\n requires per_request_duration >= 0\r\n ensures h.view.proposer_id == primary_idx\r\n ensures LeqUpperBound(h.view.seqno, asp.c.params.max_integer_val)\r\n ensures h.base_duration == base_duration\r\n ensures h.per_request_duration == per_request_duration\r\n ensures h.processing_bound == processing_bound\r\n ensures Phase2StableWithRequest(b, asp, h)\r\n{\r\n var stable_start_step, ahead_idx, start_step, view, num_requests, duration := lemma_EventuallyPhase2StableWithRequestHelper(b, asp, processing_sync_start, processing_bound, primary_idx, base_duration, per_request_duration);\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, start_step);\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, start_step, primary_idx);\r\n var log_truncation_point := b[start_step].replicas[primary_idx].replica.acceptor.log_truncation_point;\r\n var king_idx := lemma_AlwaysSomeReplicaInQuorumBeyondLogTruncationPoint(b, asp.c, start_step+1, primary_idx, asp.live_quorum);\r\n\r\n lemma_RequestInFirstNOfRequestQueueDuringPhase1(b, asp, start_step, stable_start_step, view, ahead_idx, asp.persistent_request, num_requests);\r\n\r\n h := Phase2Params(start_step, duration, base_duration, per_request_duration, processing_bound, view, log_truncation_point, king_idx, num_requests, ios);\r\n lemma_IfPacketProcessingSynchronousThenAlways(b, asp, processing_sync_start, start_step, processing_bound);\r\n\r\n Lemma_AlwaysImpliesLaterAlways(start_step, start_step + 1, untilabsolutetime(NoReplicaBeyondViewTemporal(b, view), b[h.start_step + 1].environment.time + h.duration, PaxosTimeMap(b)));\r\n}\r\n \r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Phase2a.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"NextOp.i.dfy\"\r\n\r\nmodule LivenessProof__Phase2a_i {\r\n\r\nimport opened LiveRSL__Broadcast_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Learner_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__NextOp_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__Phase2Invariants_i\r\nimport opened LivenessProof__RealTime_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened Temporal__Induction_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Sets_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\nimport opened Common__UpperBound_s\r\n\r\npredicate ProposerSends2asForOperation(\r\n ps:RslState,\r\n ps':RslState,\r\n idx:int,\r\n opn:OperationNumber,\r\n ios:seq\r\n )\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && 0 <= idx < |ps'.replicas|\r\n && ps.replicas[idx].replica.proposer.next_operation_number_to_propose == opn\r\n && ps'.replicas[idx].replica.proposer.next_operation_number_to_propose == opn + 1\r\n && RslNextOneReplica(ps, ps', idx, ios)\r\n && SpontaneousIos(ios, 1)\r\n && LProposerMaybeNominateValueAndSend2a(ps.replicas[idx].replica.proposer,\r\n ps'.replicas[idx].replica.proposer,\r\n ios[0].t,\r\n ps.replicas[idx].replica.acceptor.log_truncation_point,\r\n ExtractSentPacketsFromIos(ios))\r\n}\r\n\r\nfunction{:opaque} ProposerSends2asForOperationTemporal(\r\n b:Behavior,\r\n idx:int,\r\n opn:OperationNumber\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, ProposerSends2asForOperationTemporal(b, idx, opn))} ::\r\n sat(i, ProposerSends2asForOperationTemporal(b, idx, opn)) <==>\r\n exists ios {:trigger ProposerSends2asForOperation(b[i], b[nextstep(i)], idx, opn, ios)} ::\r\n ProposerSends2asForOperation(b[i], b[nextstep(i)], idx, opn, ios)\r\n{\r\n stepmap(imap i :: exists ios {:trigger ProposerSends2asForOperation(b[i], b[nextstep(i)], idx, opn, ios)} ::\r\n ProposerSends2asForOperation(b[i], b[nextstep(i)], idx, opn, ios))\r\n}\r\n\r\npredicate LearnerHas2bFromAcceptorInView(\r\n ps:RslState,\r\n acceptor_idx:int,\r\n learner_idx:int,\r\n view:Ballot,\r\n opn:OperationNumber\r\n )\r\n{\r\n && 0 <= acceptor_idx < |ps.constants.config.replica_ids|\r\n && 0 <= learner_idx < |ps.replicas|\r\n && var s := ps.replicas[learner_idx].replica.learner;\r\n && s.max_ballot_seen == view\r\n && opn in s.unexecuted_learner_state\r\n && ps.constants.config.replica_ids[acceptor_idx] in s.unexecuted_learner_state[opn].received_2b_message_senders\r\n}\r\n\r\nfunction{:opaque} LearnerHas2bFromAcceptorInViewTemporal(\r\n b:Behavior,\r\n acceptor_idx:int,\r\n learner_idx:int,\r\n view:Ballot,\r\n opn:OperationNumber\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, view, opn))} ::\r\n sat(i, LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, view, opn))\r\n == LearnerHas2bFromAcceptorInView(b[i], acceptor_idx, learner_idx, view, opn);\r\n{\r\n stepmap(imap i :: LearnerHas2bFromAcceptorInView(b[i], acceptor_idx, learner_idx, view, opn))\r\n}\r\n\r\npredicate ExecutorHasLearnedDecisionAboutOp(\r\n ps:RslState,\r\n idx:int,\r\n opn:OperationNumber\r\n )\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && var s := ps.replicas[idx].replica.executor;\r\n s.ops_complete > opn || (s.ops_complete == opn && s.next_op_to_execute.OutstandingOpKnown?)\r\n}\r\n\r\nfunction{:opaque} ExecutorHasLearnedDecisionAboutOpTemporal(\r\n b:Behavior,\r\n idx:int,\r\n opn:OperationNumber\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, ExecutorHasLearnedDecisionAboutOpTemporal(b, idx, opn))} ::\r\n sat(i, ExecutorHasLearnedDecisionAboutOpTemporal(b, idx, opn)) == ExecutorHasLearnedDecisionAboutOp(b[i], idx, opn)\r\n{\r\n stepmap(imap i :: ExecutorHasLearnedDecisionAboutOp(b[i], idx, opn))\r\n}\r\n\r\nfunction{:opaque} LearnerHas2bFromEveryAcceptorInViewTemporalSet(\r\n b:Behavior,\r\n live_quorum:set,\r\n learner_idx:int,\r\n view:Ballot,\r\n opn:OperationNumber\r\n ):set\r\n requires imaptotal(b)\r\n ensures forall acceptor_idx :: acceptor_idx in live_quorum ==>\r\n or(LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, view, opn),\r\n or(ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn),\r\n not(NoReplicaBeyondViewTemporal(b, view))))\r\n in LearnerHas2bFromEveryAcceptorInViewTemporalSet(b, live_quorum, learner_idx, view, opn)\r\n ensures forall x :: x in LearnerHas2bFromEveryAcceptorInViewTemporalSet(b, live_quorum, learner_idx, view, opn) ==>\r\n exists acceptor_idx :: && acceptor_idx in live_quorum\r\n && x == or(LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, view, opn),\r\n or(ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn),\r\n not(NoReplicaBeyondViewTemporal(b, view))))\r\n{\r\n set acceptor_idx | acceptor_idx in live_quorum :: or(LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, view, opn),\r\n or(ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn),\r\n not(NoReplicaBeyondViewTemporal(b, view))))\r\n}\r\n\r\nlemma lemma_IfNextOperationBeyondThenProposerSent2as(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n i:int\r\n ) returns (\r\n step:int,\r\n ios:seq\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= i\r\n requires opn >= h.log_truncation_point\r\n requires 0 <= h.view.proposer_id < |b[i].replicas|\r\n requires b[i].replicas[h.view.proposer_id].replica.proposer.next_operation_number_to_propose > opn\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n ensures h.start_step + 1 <= step < i\r\n ensures ProposerSends2asForOperation(b[step], b[step+1], h.view.proposer_id, opn, ios)\r\n{\r\n var idx := h.view.proposer_id;\r\n var next_step := earliestStepBetween(h.start_step + 1, i, ProposerExceedsCertainNextOpTemporal(b, idx, opn));\r\n step := next_step - 1;\r\n assert h.start_step + 1 <= step < next_step <= i;\r\n assert !sat(step, ProposerExceedsCertainNextOpTemporal(b, idx, opn));\r\n\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, step, i, h.view);\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, step+1, i, h.view);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, step);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, step+1);\r\n \r\n ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, step, idx);\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, step);\r\n lemma_ConstantsAllConsistent(b, asp.c, step+1);\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationThenLearnerEventuallyLearnsItLastStep(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n acceptor_idx:int,\r\n learner_idx:int,\r\n v:RequestBatch,\r\n p:RslPacket,\r\n third_step:int,\r\n ios:seq\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires acceptor_idx in asp.live_quorum\r\n requires learner_idx in asp.live_quorum\r\n requires p.src == asp.c.config.replica_ids[acceptor_idx]\r\n requires p.msg == RslMessage_2b(h.view, opn, v)\r\n requires PacketProcessedViaIos(b[third_step], b[third_step+1], p, learner_idx, ios)\r\n requires b[third_step+1].environment.time <= b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 2 + h.processing_bound * 2\r\n requires h.start_step + 1 <= third_step\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 2 + h.processing_bound * 2;\r\n var w := LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, h.view, opn);\r\n var x := ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(w, or(x, or(y, not(z)))), t, f))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var w := LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, h.view, opn);\r\n var x := ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n\r\n if sat(third_step, or(x, not(z)))\r\n {\r\n step := third_step;\r\n lemma_TimeAdvancesBetween(b, asp, third_step, third_step + 1);\r\n return;\r\n }\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, third_step);\r\n var s3 := b[third_step].replicas[learner_idx].replica;\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, third_step+1);\r\n var s3' := b[third_step+1].replicas[learner_idx].replica;\r\n assert LReplicaNextProcessPacket(s3, s3', ios);\r\n assert LReplicaNextProcess2b(s3, s3', p, ExtractSentPacketsFromIos(ios));\r\n var op_learnable := s3.executor.ops_complete < opn || (s3.executor.ops_complete == opn && s3.executor.next_op_to_execute.OutstandingOpUnknown?);\r\n assert op_learnable;\r\n assert LLearnerProcess2b(s3.learner, s3'.learner, p);\r\n lemma_LearnerMaxBallotSeenNeverExceedsViewDuringPhase2(b, asp, h, third_step, learner_idx);\r\n assert p.src in s3.learner.constants.all.config.replica_ids;\r\n assert !BalLt(p.msg.bal_2b, s3.learner.max_ballot_seen);\r\n \r\n assert s3'.learner.max_ballot_seen == h.view;\r\n assert opn in s3'.learner.unexecuted_learner_state;\r\n assert p.src == asp.c.config.replica_ids[acceptor_idx];\r\n assert p.src in s3'.learner.unexecuted_learner_state[opn].received_2b_message_senders;\r\n\r\n step := third_step + 1;\r\n assert LearnerHas2bFromAcceptorInView(b[step], acceptor_idx, learner_idx, h.view, opn);\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationThenLearnerEventuallyLearnsItSecondStep(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n acceptor_idx:int,\r\n learner_idx:int,\r\n v:RequestBatch,\r\n p:RslPacket,\r\n second_step:int,\r\n ios:seq\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires acceptor_idx in asp.live_quorum\r\n requires learner_idx in asp.live_quorum\r\n requires p.src == asp.c.config.replica_ids[h.view.proposer_id]\r\n requires p.msg == RslMessage_2a(h.view, opn, v)\r\n requires PacketProcessedViaIos(b[second_step], b[second_step+1], p, acceptor_idx, ios)\r\n requires b[second_step+1].environment.time <= b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 2 + h.processing_bound\r\n requires h.start_step + 1 <= second_step\r\n requires LeqUpperBound(opn, asp.c.params.max_integer_val)\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 2 + h.processing_bound * 2;\r\n var w := LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, h.view, opn);\r\n var x := ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(w, or(x, or(y, not(z)))), t, f))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var w := LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, h.view, opn);\r\n var x := ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n\r\n if sat(second_step, not(z))\r\n {\r\n step := second_step;\r\n lemma_TimeAdvancesBetween(b, asp, second_step, second_step+1);\r\n return;\r\n }\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, second_step);\r\n lemma_ConstantsAllConsistent(b, asp.c, second_step+1);\r\n var s2 := b[second_step].replicas[acceptor_idx].replica;\r\n var s2' := b[second_step+1].replicas[acceptor_idx].replica;\r\n\r\n lemma_MaxBalNeverExceedsViewDuringPhase2(b, asp, h, second_step, acceptor_idx);\r\n assert LBroadcastToEveryone(asp.c.config, acceptor_idx, RslMessage_2b(h.view, opn, v), ExtractSentPacketsFromIos(ios));\r\n var p2 := LPacket(asp.c.config.replica_ids[learner_idx], asp.c.config.replica_ids[acceptor_idx], RslMessage_2b(h.view, opn, v));\r\n assert p2 in ExtractSentPacketsFromIos(ios);\r\n\r\n var third_step, ios3 := lemma_PacketSentToIndexProcessedByIt(b, asp, h.start_step, h.processing_bound, second_step, learner_idx, p2);\r\n assert f[third_step+1] <= f[prev_step] + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 2 + h.processing_bound * 2;\r\n step := lemma_IfLiveReplicasReadyForAnOperationThenLearnerEventuallyLearnsItLastStep(b, asp, h, opn, prev_step, acceptor_idx, learner_idx, v, p2, third_step, ios3);\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationThenLearnerEventuallyLearnsIt(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n acceptor_idx:int,\r\n learner_idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires acceptor_idx in asp.live_quorum\r\n requires learner_idx in asp.live_quorum\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 2 + h.processing_bound * 2;\r\n var w := LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, h.view, opn);\r\n var x := ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(w, or(x, or(y, not(z)))), t, f))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 2 + h.processing_bound * 2;\r\n var w := LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, h.view, opn);\r\n var x := ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n\r\n var later_step := lemma_IfLiveReplicasReadyForAnOperationThenProposerEventuallyAdvancesNextOp(b, asp, h, opn, prev_step);\r\n assert f[later_step] <= f[prev_step] + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 2;\r\n lemma_ConstantsAllConsistent(b, asp.c, later_step);\r\n if sat(later_step, or(y, not(z)))\r\n {\r\n step := later_step;\r\n return;\r\n }\r\n\r\n var first_step, ios := lemma_IfNextOperationBeyondThenProposerSent2as(b, asp, h, opn, later_step);\r\n lemma_TimeAdvancesBetween(b, asp, first_step + 1, later_step);\r\n if sat(first_step, not(z))\r\n {\r\n step := first_step;\r\n lemma_TimeAdvancesBetween(b, asp, step, first_step + 1);\r\n return;\r\n }\r\n\r\n assert f[first_step+1] <= f[prev_step] + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 2;\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, first_step);\r\n var s1 := b[first_step].replicas[h.view.proposer_id].replica;\r\n var v :| LBroadcastToEveryone(asp.c.config, h.view.proposer_id, RslMessage_2a(s1.proposer.max_ballot_i_sent_1a, opn, v), ExtractSentPacketsFromIos(ios));\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, first_step);\r\n assert s1.proposer.max_ballot_i_sent_1a == h.view;\r\n\r\n var p := LPacket(asp.c.config.replica_ids[acceptor_idx], asp.c.config.replica_ids[h.view.proposer_id], RslMessage_2a(h.view, opn, v));\r\n assert p in ExtractSentPacketsFromIos(ios);\r\n\r\n var second_step, ios2 := lemma_PacketSentToIndexProcessedByIt(b, asp, h.start_step, h.processing_bound, first_step, acceptor_idx, p);\r\n assert f[second_step+1] <= f[prev_step] + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 2 + h.processing_bound;\r\n step := lemma_IfLiveReplicasReadyForAnOperationThenLearnerEventuallyLearnsItSecondStep(b, asp, h, opn, prev_step, acceptor_idx, learner_idx, v, p, second_step, ios2);\r\n}\r\n\r\nlemma lemma_IfLearnerHas2bFromAcceptorItKeepsItHelper(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n acceptor_idx:int,\r\n learner_idx:int,\r\n j:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= j\r\n requires 0 <= learner_idx < |asp.c.config.replica_ids|\r\n requires ExecutorHasLearnedDecisionAboutOp(b[j], learner_idx, opn)\r\n requires !LearnerHas2bFromAcceptorInView(b[j+1], acceptor_idx, learner_idx, h.view, opn)\r\n requires !ExecutorHasLearnedDecisionAboutOp(b[j+1], learner_idx, opn)\r\n requires NoReplicaBeyondView(b[j+1], h.view)\r\n ensures false\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, j);\r\n lemma_ConstantsAllConsistent(b, asp.c, j+1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, j);\r\n var s := b[j].replicas[learner_idx].replica;\r\n var s' := b[j+1].replicas[learner_idx].replica;\r\n\r\n assert NoReplicaBeyondView(b[j+1], h.view);\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, j, j+1, h.view);\r\n assert NoReplicaBeyondView(b[j], h.view);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, j);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, j+1);\r\n assert s'.executor.ops_complete != s.executor.ops_complete || s'.executor.next_op_to_execute != s.executor.next_op_to_execute;\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, j, learner_idx);\r\n}\r\n\r\nlemma lemma_IfLearnerHas2bFromAcceptorItKeepsItHelper2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n acceptor_idx:int,\r\n learner_idx:int,\r\n j:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= j\r\n requires 0 <= learner_idx < |asp.c.config.replica_ids|\r\n requires !ExecutorHasLearnedDecisionAboutOp(b[j], learner_idx, opn)\r\n requires LearnerHas2bFromAcceptorInView(b[j], acceptor_idx, learner_idx, h.view, opn)\r\n requires !LearnerHas2bFromAcceptorInView(b[j+1], acceptor_idx, learner_idx, h.view, opn)\r\n requires !ExecutorHasLearnedDecisionAboutOp(b[j+1], learner_idx, opn)\r\n requires NoReplicaBeyondView(b[j+1], h.view)\r\n ensures false\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, j);\r\n lemma_ConstantsAllConsistent(b, asp.c, j+1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, j);\r\n var s := b[j].replicas[learner_idx].replica;\r\n var s' := b[j+1].replicas[learner_idx].replica;\r\n\r\n assert NoReplicaBeyondView(b[j+1], h.view);\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, j, j+1, h.view);\r\n assert NoReplicaBeyondView(b[j], h.view);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, j);\r\n lemma_ProposerStaysInState2InPhase2(b, asp, h, j+1);\r\n lemma_LearnerMaxBallotSeenNeverExceedsViewDuringPhase2(b, asp, h, j, learner_idx);\r\n lemma_LearnerMaxBallotSeenNeverExceedsViewDuringPhase2(b, asp, h, j+1, learner_idx);\r\n assert s'.learner.max_ballot_seen != s.learner.max_ballot_seen || s'.learner.unexecuted_learner_state != s.learner.unexecuted_learner_state;\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, j, learner_idx);\r\n assert BalLeq(s.learner.max_ballot_seen, s'.learner.max_ballot_seen);\r\n assert s'.learner.max_ballot_seen == s.learner.max_ballot_seen;\r\n}\r\n\r\nlemma lemma_IfLearnerHas2bFromAcceptorItKeepsIt(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n acceptor_idx:int,\r\n learner_idx:int,\r\n i:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires h.start_step + 1 <= i\r\n requires 0 <= learner_idx < |asp.c.config.replica_ids|\r\n requires sat(i, or(LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, h.view, opn),\r\n or(ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn),\r\n not(NoReplicaBeyondViewTemporal(b, h.view)))))\r\n ensures sat(i, always(or(LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, h.view, opn),\r\n or(ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn),\r\n not(NoReplicaBeyondViewTemporal(b, h.view))))));\r\n{\r\n var x := or(LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, h.view, opn),\r\n or(ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn),\r\n not(NoReplicaBeyondViewTemporal(b, h.view))));\r\n\r\n forall j | i <= j\r\n ensures sat(j, imply(x, next(x)))\r\n {\r\n if sat(j, x) && !sat(j+1, x)\r\n {\r\n if sat(j, ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn))\r\n {\r\n lemma_IfLearnerHas2bFromAcceptorItKeepsItHelper(b, asp, h, opn, acceptor_idx, learner_idx, j);\r\n }\r\n else if sat(j, LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, h.view, opn))\r\n {\r\n lemma_IfLearnerHas2bFromAcceptorItKeepsItHelper2(b, asp, h, opn, acceptor_idx, learner_idx, j);\r\n }\r\n else\r\n {\r\n assert NoReplicaBeyondView(b[j+1], h.view);\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, j, j+1, h.view);\r\n assert NoReplicaBeyondView(b[j], h.view);\r\n assert false;\r\n }\r\n }\r\n reveal imply();\r\n reveal next();\r\n }\r\n TemporalInductionNext(i, x);\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationThenLearnerEventuallyLearnsItFromAll(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n learner_idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires learner_idx in asp.live_quorum\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 2 + h.processing_bound * 2;\r\n var x := always(andset(LearnerHas2bFromEveryAcceptorInViewTemporalSet(b, asp.live_quorum, learner_idx, h.view, opn)));\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n sat(step, beforeabsolutetime(or(x, y), t, f))\r\n{\r\n var t := b[prev_step].environment.time - b[h.start_step + 1].environment.time\r\n + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 2 + h.processing_bound * 2;\r\n var f := PaxosTimeMap(b);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var x2 := ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n lemma_TimeAdvancesBetween(b, asp, h.start_step + 1, prev_step);\r\n\r\n if sat(h.start_step + 1, eventuallywithin(y, t, f))\r\n {\r\n step := TemporalDeduceFromEventual(h.start_step + 1, beforeabsolutetime(y, f[h.start_step + 1] + t, f));\r\n return;\r\n }\r\n \r\n forall acceptor_idx | acceptor_idx in asp.live_quorum\r\n ensures var a := or(LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, h.view, opn), or(x2, not(z)));\r\n sat(h.start_step + 1, eventuallywithin(always(a), t, f))\r\n {\r\n var learn_step := lemma_IfLiveReplicasReadyForAnOperationThenLearnerEventuallyLearnsIt(b, asp, h, opn, prev_step, acceptor_idx, learner_idx);\r\n assert f[learn_step] <= f[h.start_step+1] + t;\r\n var x1 := LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, h.view, opn);\r\n var a := or(x1, or(x2, not(z)));\r\n assert sat(learn_step, or(x1, or(x2, or(y, not(z)))));\r\n if sat(learn_step, y)\r\n {\r\n TemporalEventually(h.start_step + 1, learn_step, beforeabsolutetime(y, f[h.start_step + 1] + t, f));\r\n assert sat(h.start_step + 1, eventuallywithin(y, t, f));\r\n assert false;\r\n }\r\n else\r\n {\r\n lemma_IfLearnerHas2bFromAcceptorItKeepsIt(b, asp, h, opn, acceptor_idx, learner_idx, learn_step);\r\n TemporalEventually(h.start_step + 1, learn_step, beforeabsolutetime(always(a), f[h.start_step + 1] + t, f));\r\n assert sat(h.start_step + 1, eventuallywithin(always(a), t, f));\r\n }\r\n }\r\n\r\n var xs := LearnerHas2bFromEveryAcceptorInViewTemporalSet(b, asp.live_quorum, learner_idx, h.view, opn);\r\n Lemma_EventuallyAlwaysWithinEachImpliesEventuallyAlwaysWithinAll(h.start_step + 1, xs, t, f);\r\n step := TemporalDeduceFromEventuallyWithin(h.start_step + 1, always(andset(xs)), t, f);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Phase2b.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"NextOp.i.dfy\"\r\ninclude \"Phase2a.i.dfy\"\r\ninclude \"../CommonProof/Quorum.i.dfy\"\r\ninclude \"../CommonProof/LearnerState.i.dfy\"\r\n\r\nmodule LivenessProof__Phase2b_i {\r\n\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__NextOp_i\r\nimport opened LivenessProof__Phase2a_i\r\nimport opened LivenessProof__Phase2Invariants_i\r\nimport opened LivenessProof__RealTime_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LivenessProof__WF1_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__LearnerState_i\r\nimport opened CommonProof__LogTruncationPoint_i\r\nimport opened CommonProof__Quorum_i\r\nimport opened Temporal__LeadsTo_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Sets_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__WF1_i\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Sets_i\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationAndLearnerHas2bsFromAllLiveReplicasThenExecutorEventuallyHasDecisionWF1Req2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n i:int,\r\n learner_idx:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step <= i\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires learner_idx in asp.live_quorum\r\n requires sat(i, always(andset(LearnerHas2bFromEveryAcceptorInViewTemporalSet(b, asp.live_quorum, learner_idx, h.view, opn))))\r\n requires !sat(i, ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn))\r\n requires !sat(i+1, ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn))\r\n requires !sat(i, AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1))\r\n requires !sat(i+1, AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1))\r\n requires sat(i, NoReplicaBeyondViewTemporal(b, h.view))\r\n requires sat(i+1, NoReplicaBeyondViewTemporal(b, h.view))\r\n requires sat(i, ReplicaSchedule(b, learner_idx)[5])\r\n ensures false\r\n{\r\n var w_once := andset(LearnerHas2bFromEveryAcceptorInViewTemporalSet(b, asp.live_quorum, learner_idx, h.view, opn));\r\n var x := ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n var s := b[i].replicas[learner_idx].replica;\r\n var s' := b[i+1].replicas[learner_idx].replica;\r\n assert SpecificSpontaneousRslActionOccurs(b[i], b[i+1], LReplicaNextSpontaneousMaybeMakeDecision, learner_idx);\r\n var ios:seq :| && RslNextOneReplica(b[i], b[i+1], learner_idx, ios)\r\n && LReplicaNextSpontaneousMaybeMakeDecision(s, s', ExtractSentPacketsFromIos(ios));\r\n lemma_ConstantsAllConsistent(b, asp.c, prev_step);\r\n lemma_OpsCompleteMonotonic(b, asp.c, prev_step, i, learner_idx);\r\n assert s.executor.ops_complete == opn;\r\n assert s.executor.next_op_to_execute.OutstandingOpUnknown?;\r\n\r\n forall acceptor_idx | acceptor_idx in asp.live_quorum\r\n ensures opn in s.learner.unexecuted_learner_state\r\n ensures asp.c.config.replica_ids[acceptor_idx] in s.learner.unexecuted_learner_state[opn].received_2b_message_senders\r\n {\r\n var a := or(LearnerHas2bFromAcceptorInViewTemporal(b, acceptor_idx, learner_idx, h.view, opn), or(x, not(z)));\r\n assert a in LearnerHas2bFromEveryAcceptorInViewTemporalSet(b, asp.live_quorum, learner_idx, h.view, opn);\r\n TemporalDeduceFromAlways(i, i+1, w_once);\r\n assert sat(i+1, a);\r\n }\r\n\r\n assert {:split_here} true;\r\n\r\n assert opn in s.learner.unexecuted_learner_state;\r\n lemma_Received2bMessageSendersAlwaysValidReplicas(b, asp.c, i, learner_idx, opn);\r\n var acceptor_indices := lemma_GetIndicesFromNodes(s.learner.unexecuted_learner_state[opn].received_2b_message_senders, asp.c.config);\r\n\r\n forall acceptor_idx | acceptor_idx in asp.live_quorum\r\n ensures acceptor_idx in acceptor_indices\r\n {\r\n assert asp.c.config.replica_ids[acceptor_idx] in s.learner.unexecuted_learner_state[opn].received_2b_message_senders;\r\n assert ReplicasDistinct(asp.c.config.replica_ids, acceptor_idx, GetReplicaIndex(asp.c.config.replica_ids[acceptor_idx], asp.c.config));\r\n }\r\n\r\n assert {:split_here} true;\r\n \r\n SubsetCardinality(asp.live_quorum, acceptor_indices);\r\n assert |asp.live_quorum| <= |s.learner.unexecuted_learner_state[opn].received_2b_message_senders|;\r\n assert |s.learner.unexecuted_learner_state[opn].received_2b_message_senders| >= LMinQuorumSize(s.learner.constants.all.config);\r\n assert LExecutorGetDecision(s.executor, s'.executor, s.learner.max_ballot_seen, opn, s.learner.unexecuted_learner_state[opn].candidate_learned_value);\r\n\r\n assert sat(i+1, ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn));\r\n assert !sat(i+1, ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn));\r\n assert false;\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationAndLearnerHas2bsFromAllLiveReplicasThenExecutorEventuallyHasDecision(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n first_step:int,\r\n learner_idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step <= first_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires sat(first_step, always(andset(LearnerHas2bFromEveryAcceptorInViewTemporalSet(b, asp.live_quorum, learner_idx, h.view, opn))))\r\n requires learner_idx in asp.live_quorum\r\n ensures first_step <= step\r\n ensures b[step].environment.time <= b[first_step].environment.time + TimeToPerformGenericAction(asp)\r\n ensures var x := ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, or(x, or(y, not(z))))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var w_once := andset(LearnerHas2bFromEveryAcceptorInViewTemporalSet(b, asp.live_quorum, learner_idx, h.view, opn));\r\n var w := always(w_once);\r\n var x := ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n lemma_TimeAdvancesBetween(b, asp, h.start_step + 1, prev_step);\r\n\r\n var P := w;\r\n var Q := or(x, or(y, not(z)));\r\n var Action := ReplicaSchedule(b, learner_idx)[5];\r\n forall i | first_step <= i\r\n ensures sat(i, TemporalWF1Req1(P, Q))\r\n ensures sat(i, TemporalWF1Req2(P, Q, Action))\r\n {\r\n if sat(i, P) && !sat(i, Q) && !sat(i+1, Q)\r\n {\r\n Lemma_AlwaysImpliesLaterAlways(i, i+1, w_once);\r\n assert sat(i+1, P);\r\n\r\n if sat(i, Action)\r\n {\r\n lemma_IfLiveReplicasReadyForAnOperationAndLearnerHas2bsFromAllLiveReplicasThenExecutorEventuallyHasDecisionWF1Req2(b, asp, h, opn, prev_step, i, learner_idx);\r\n assert false;\r\n }\r\n }\r\n }\r\n\r\n TemporalAlways(first_step, TemporalWF1Req1(P, Q));\r\n TemporalAlways(first_step, TemporalWF1Req2(P, Q, Action));\r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, learner_idx, 5);\r\n lemma_EstablishRequirementsForWF1RealTime(b, asp, first_step, Action, TimeToPerformGenericAction(asp));\r\n TemporalWF1RealTime(first_step, P, Q, Action, TimeToPerformGenericAction(asp), f);\r\n step := TemporalDeduceFromLeadsToWithin(first_step, first_step, P, Q, TimeToPerformGenericAction(asp), f);\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationThenExecutorEventuallyHasDecision(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n learner_idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires learner_idx in asp.live_quorum\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 3 + h.processing_bound * 2;\r\n var x := ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(x, or(y, not(z))), t, f))\r\n{\r\n var w_once := andset(LearnerHas2bFromEveryAcceptorInViewTemporalSet(b, asp.live_quorum, learner_idx, h.view, opn));\r\n var w := always(w_once);\r\n var x := ExecutorHasLearnedDecisionAboutOpTemporal(b, learner_idx, opn);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n\r\n var first_step := lemma_IfLiveReplicasReadyForAnOperationThenLearnerEventuallyLearnsItFromAll(b, asp, h, opn, prev_step, learner_idx);\r\n if sat(first_step, or(x, or(y, not(z))))\r\n {\r\n step := first_step;\r\n return;\r\n }\r\n\r\n if first_step < prev_step\r\n {\r\n Lemma_AlwaysImpliesLaterAlways(first_step, prev_step, w_once);\r\n first_step := prev_step;\r\n }\r\n assert sat(first_step, w);\r\n\r\n step := lemma_IfLiveReplicasReadyForAnOperationAndLearnerHas2bsFromAllLiveReplicasThenExecutorEventuallyHasDecision(b, asp, h, opn, prev_step, first_step, learner_idx);\r\n}\r\n\r\nlemma lemma_ExecutorHasLearnedDecisionAboutOpStable(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n j:int,\r\n idx:int,\r\n opn:OperationNumber\r\n )\r\n requires IsValidBehaviorPrefix(b, c, j)\r\n requires 0 <= i <= j\r\n requires 0 <= idx < |b[i].replicas|\r\n requires sat(i, ExecutorHasLearnedDecisionAboutOpTemporal(b, idx, opn))\r\n ensures sat(j, ExecutorHasLearnedDecisionAboutOpTemporal(b, idx, opn))\r\n decreases j - i\r\n{\r\n if j == i\r\n {\r\n return;\r\n }\r\n\r\n lemma_ExecutorHasLearnedDecisionAboutOpStable(b, c, i, j-1, idx, opn);\r\n if !sat(j, ExecutorHasLearnedDecisionAboutOpTemporal(b, idx, opn))\r\n {\r\n lemma_ConstantsAllConsistent(b, c, j-1);\r\n lemma_ConstantsAllConsistent(b, c, j);\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, j-1, idx);\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationThenExecutorEventuallyExecutesIt(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n executor_idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires executor_idx in asp.live_quorum\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp) * 4 + h.processing_bound * 2;\r\n var x := ReplicaCaughtUpTemporal(b, executor_idx, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(x, or(y, not(z))), t, f))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var w := ExecutorHasLearnedDecisionAboutOpTemporal(b, executor_idx, opn);\r\n var x := ReplicaCaughtUpTemporal(b, executor_idx, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n var first_step := lemma_IfLiveReplicasReadyForAnOperationThenExecutorEventuallyHasDecision(b, asp, h, opn, prev_step, executor_idx);\r\n\r\n if sat(first_step, or(x, or(y, not(z))))\r\n {\r\n step := first_step;\r\n return;\r\n }\r\n\r\n if first_step < prev_step\r\n {\r\n lemma_ExecutorHasLearnedDecisionAboutOpStable(b, asp.c, first_step, prev_step, executor_idx, opn);\r\n first_step := prev_step;\r\n }\r\n assert sat(first_step, w);\r\n\r\n var P := w;\r\n var Q := or(x, or(y, not(z)));\r\n var Action := ReplicaSchedule(b, executor_idx)[6];\r\n forall i | first_step <= i\r\n ensures sat(i, TemporalWF1Req1(P, Q))\r\n ensures sat(i, TemporalWF1Req2(P, Q, Action))\r\n {\r\n if sat(i, P) && !sat(i, Q) && !sat(i+1, Q)\r\n {\r\n lemma_ExecutorHasLearnedDecisionAboutOpStable(b, asp.c, first_step, i+1, executor_idx, opn);\r\n assert sat(i+1, P);\r\n \r\n if sat(i, Action)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n var s := b[i].replicas[executor_idx].replica;\r\n var s' := b[i+1].replicas[executor_idx].replica;\r\n assert SpecificSpontaneousRslActionOccurs(b[i], b[i+1], LReplicaNextSpontaneousMaybeExecute, executor_idx);\r\n var ios:seq :| && RslNextOneReplica(b[i], b[i+1], executor_idx, ios)\r\n && LReplicaNextSpontaneousMaybeExecute(s, s', ExtractSentPacketsFromIos(ios));\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, i, executor_idx);\r\n assert LExecutorExecute(s.executor, s'.executor, ExtractSentPacketsFromIos(ios));\r\n assert false;\r\n }\r\n }\r\n }\r\n\r\n TemporalAlways(first_step, TemporalWF1Req1(P, Q));\r\n TemporalAlways(first_step, TemporalWF1Req2(P, Q, Action));\r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, executor_idx, 6);\r\n lemma_EstablishRequirementsForWF1RealTime(b, asp, first_step, Action, TimeToPerformGenericAction(asp));\r\n TemporalWF1RealTime(first_step, P, Q, Action, TimeToPerformGenericAction(asp), f);\r\n step := TemporalDeduceFromLeadsToWithin(first_step, first_step, P, Q, TimeToPerformGenericAction(asp), f);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Phase2c.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"NextOp.i.dfy\"\r\ninclude \"Phase2b.i.dfy\"\r\ninclude \"GenericInvariants.i.dfy\"\r\ninclude \"../CommonProof/Quorum.i.dfy\"\r\ninclude \"../CommonProof/LearnerState.i.dfy\"\r\n\r\n// Sure, there's no Phase 2c in Paxos. But it's what this file calls the phase\r\n// when the executors have finished executing the request and are telling the\r\n// primary about it so it can do log truncation.\r\n\r\nmodule LivenessProof__Phase2c_i {\r\n\r\nimport opened LiveRSL__Acceptor_i\r\nimport opened LiveRSL__Broadcast_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Catchup_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__GenericInvariants_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__NextOp_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__Phase2b_i\r\nimport opened LivenessProof__Phase2Invariants_i\r\nimport opened LivenessProof__RealTime_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__WF1_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__LogTruncationPoint_i\r\nimport opened CommonProof__Quorum_i\r\nimport opened Temporal__Induction_i\r\nimport opened Temporal__LeadsTo_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Sets_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Temporal__WF1_i\r\nimport opened Environment_s\r\nimport opened Collections__CountMatches_i\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Sets_i\r\nimport opened Math__mul_i\r\n\r\npredicate ReplicaSentHeartbeatToPrimaryReflectingOpn(\r\n ps:RslState,\r\n replica_idx:int,\r\n primary_idx:int,\r\n opn:OperationNumber,\r\n p:RslPacket\r\n )\r\n{\r\n && ps.environment.nextStep.LEnvStepHostIos?\r\n && LIoOpSend(p) in ps.environment.nextStep.ios\r\n && 0 <= replica_idx < |ps.constants.config.replica_ids|\r\n && 0 <= primary_idx < |ps.constants.config.replica_ids|\r\n && p.src == ps.constants.config.replica_ids[replica_idx]\r\n && p.dst == ps.constants.config.replica_ids[primary_idx]\r\n && p.msg.RslMessage_Heartbeat?\r\n && p.msg.opn_ckpt >= opn\r\n && 0 <= replica_idx < |ps.replicas|\r\n && ps.replicas[replica_idx].replica.executor.ops_complete >= opn\r\n}\r\n\r\nfunction{:opaque} ReplicaSentHeartbeatToPrimaryReflectingOpnTemporal(\r\n b:Behavior,\r\n replica_idx:int,\r\n primary_idx:int,\r\n opn:OperationNumber\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, ReplicaSentHeartbeatToPrimaryReflectingOpnTemporal(b, replica_idx, primary_idx, opn))} ::\r\n sat(i, ReplicaSentHeartbeatToPrimaryReflectingOpnTemporal(b, replica_idx, primary_idx, opn)) <==>\r\n exists p :: ReplicaSentHeartbeatToPrimaryReflectingOpn(b[i], replica_idx, primary_idx, opn, p)\r\n{\r\n stepmap(imap i :: exists p :: ReplicaSentHeartbeatToPrimaryReflectingOpn(b[i], replica_idx, primary_idx, opn, p))\r\n}\r\n\r\nfunction{:opaque} NextHeartbeatTimeOfReplicaIsParticularValueTemporal(\r\n b:Behavior,\r\n idx:int,\r\n nextHeartbeatTime:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, NextHeartbeatTimeOfReplicaIsParticularValueTemporal(b, idx, nextHeartbeatTime))} ::\r\n sat(i, NextHeartbeatTimeOfReplicaIsParticularValueTemporal(b, idx, nextHeartbeatTime)) <==>\r\n (0 <= idx < |b[i].replicas| && b[i].replicas[idx].replica.nextHeartbeatTime == nextHeartbeatTime)\r\n{\r\n stepmap(imap i :: 0 <= idx < |b[i].replicas| && b[i].replicas[idx].replica.nextHeartbeatTime == nextHeartbeatTime)\r\n}\r\n\r\npredicate PrimaryKnowsReplicaHasOpsComplete(\r\n ps:RslState,\r\n replica_idx:int,\r\n primary_idx:int,\r\n opn:OperationNumber\r\n )\r\n{\r\n && 0 <= primary_idx < |ps.replicas|\r\n && 0 <= replica_idx < |ps.replicas|\r\n && 0 <= replica_idx < |ps.replicas[primary_idx].replica.acceptor.last_checkpointed_operation|\r\n && ps.replicas[primary_idx].replica.acceptor.last_checkpointed_operation[replica_idx] >= opn\r\n && ps.replicas[replica_idx].replica.executor.ops_complete>= opn\r\n}\r\n\r\nfunction{:opaque} PrimaryKnowsReplicaHasOpsCompleteTemporal(\r\n b:Behavior,\r\n replica_idx:int,\r\n primary_idx:int,\r\n opn:OperationNumber\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, PrimaryKnowsReplicaHasOpsCompleteTemporal(b, replica_idx, primary_idx, opn))} ::\r\n sat(i, PrimaryKnowsReplicaHasOpsCompleteTemporal(b, replica_idx, primary_idx, opn)) <==>\r\n PrimaryKnowsReplicaHasOpsComplete(b[i], replica_idx, primary_idx, opn)\r\n{\r\n stepmap(imap i :: PrimaryKnowsReplicaHasOpsComplete(b[i], replica_idx, primary_idx, opn))\r\n}\r\n\r\nfunction{:opaque} PrimaryKnowsEveryReplicaHasOpsCompleteTemporalSet(\r\n b:Behavior,\r\n replica_indices:set,\r\n primary_idx:int,\r\n opn:OperationNumber\r\n ):set\r\n requires imaptotal(b)\r\n ensures forall replica_idx :: replica_idx in replica_indices\r\n ==> PrimaryKnowsReplicaHasOpsCompleteTemporal(b, replica_idx, primary_idx, opn)\r\n in PrimaryKnowsEveryReplicaHasOpsCompleteTemporalSet(b, replica_indices, primary_idx, opn)\r\n ensures forall x :: x in PrimaryKnowsEveryReplicaHasOpsCompleteTemporalSet(b, replica_indices, primary_idx, opn) ==>\r\n exists replica_idx :: && replica_idx in replica_indices\r\n && x == PrimaryKnowsReplicaHasOpsCompleteTemporal(b, replica_idx, primary_idx, opn)\r\n{\r\n set replica_idx | replica_idx in replica_indices :: PrimaryKnowsReplicaHasOpsCompleteTemporal(b, replica_idx, primary_idx, opn)\r\n}\r\n\r\npredicate PrimaryHasAdvancedLogTruncationPoint(\r\n ps:RslState,\r\n live_quorum:set,\r\n view:Ballot,\r\n opn:int\r\n )\r\n{\r\n && (forall idx :: idx in live_quorum ==> ReplicaCaughtUp(ps, idx, opn))\r\n && 0 <= view.proposer_id < |ps.replicas|\r\n && ps.replicas[view.proposer_id].replica.acceptor.log_truncation_point >= opn\r\n}\r\n\r\nfunction {:opaque} PrimaryHasAdvancedLogTruncationPointTemporal(\r\n b:Behavior,\r\n live_quorum:set,\r\n view:Ballot,\r\n opn:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, PrimaryHasAdvancedLogTruncationPointTemporal(b, live_quorum, view, opn))} ::\r\n sat(i, PrimaryHasAdvancedLogTruncationPointTemporal(b, live_quorum, view, opn)) ==\r\n PrimaryHasAdvancedLogTruncationPoint(b[i], live_quorum, view, opn)\r\n{\r\n stepmap(imap i :: PrimaryHasAdvancedLogTruncationPoint(b[i], live_quorum, view, opn))\r\n}\r\n\r\nlemma lemma_IfExecutorCaughtUpThenExecutorEventuallyExecutesItAndTellsPrimary(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n first_step:int,\r\n executor_idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step <= first_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires executor_idx in asp.live_quorum\r\n requires sat(first_step, ReplicaCaughtUpTemporal(b, executor_idx, opn + 1))\r\n ensures h.start_step + 1 <= step\r\n ensures b[step].environment.time <= b[first_step].environment.time + asp.c.params.heartbeat_period + asp.max_clock_ambiguity * 2 + TimeToPerformGenericAction(asp)\r\n ensures var x := ReplicaSentHeartbeatToPrimaryReflectingOpnTemporal(b, executor_idx, h.view.proposer_id, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, or(x, or(y, not(z))))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var w := ReplicaCaughtUpTemporal(b, executor_idx, opn + 1);\r\n var x := ReplicaSentHeartbeatToPrimaryReflectingOpnTemporal(b, executor_idx, h.view.proposer_id, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, first_step);\r\n var nextHeartbeatTime := b[first_step].replicas[executor_idx].replica.nextHeartbeatTime;\r\n lemma_HeartbeatTimerNeverTooFarInFuture(b, asp, first_step, executor_idx);\r\n assert nextHeartbeatTime <= b[first_step].environment.time + asp.c.params.heartbeat_period + asp.max_clock_ambiguity;\r\n\r\n var P := and(w, NextHeartbeatTimeOfReplicaIsParticularValueTemporal(b, executor_idx, nextHeartbeatTime));\r\n var Q := or(x, or(y, not(z)));\r\n var Action := ReplicaSchedule(b, executor_idx)[9];\r\n forall i | first_step <= i\r\n ensures sat(i, TemporalWF1Req1(P, Q))\r\n ensures sat(i, TemporalWF1RealTimeDelayedReq2(P, Q, Action, nextHeartbeatTime + asp.max_clock_ambiguity, f))\r\n {\r\n if sat(i, P) && !sat(i, Q) && !sat(i+1, Q)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n var s := b[i].replicas[executor_idx].replica;\r\n var s' := b[i+1].replicas[executor_idx].replica;\r\n var m := RslMessage_Heartbeat(s.proposer.election_state.current_view,\r\n s.constants.my_index in s.proposer.election_state.current_view_suspectors,\r\n s.executor.ops_complete);\r\n var p := LPacket(asp.c.config.replica_ids[h.view.proposer_id], asp.c.config.replica_ids[executor_idx], m);\r\n\r\n lemma_OpsCompleteMonotonic(b, asp.c, first_step, i+1, executor_idx);\r\n\r\n if !sat(i+1, P)\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, executor_idx);\r\n assert LBroadcastToEveryone(asp.c.config, executor_idx, m, ExtractSentPacketsFromIos(ios));\r\n assert LIoOpSend(p) in ios;\r\n assert ReplicaSentHeartbeatToPrimaryReflectingOpn(b[i], executor_idx, h.view.proposer_id, opn + 1, p);\r\n assert sat(i+1, x);\r\n assert false;\r\n }\r\n \r\n if sat(i, nextafter(Action, nextHeartbeatTime + asp.max_clock_ambiguity, f))\r\n {\r\n assert SpecificClockReadingRslActionOccurs(b[i], b[i+1], LReplicaNextReadClockMaybeSendHeartbeat, executor_idx);\r\n var ios:seq :| && RslNextOneReplica(b[i], b[i+1], executor_idx, ios)\r\n && SpontaneousIos(ios, 1)\r\n && LReplicaNextReadClockMaybeSendHeartbeat(s, s', SpontaneousClock(ios), ExtractSentPacketsFromIos(ios));\r\n lemma_ClockAmbiguityLimitApplies(b, asp, i, executor_idx, ios[0]);\r\n assert ios[0].t >= b[i].environment.time - asp.max_clock_ambiguity == b[i+1].environment.time - asp.max_clock_ambiguity >= nextHeartbeatTime == s.nextHeartbeatTime;\r\n assert LBroadcastToEveryone(asp.c.config, executor_idx, m, ExtractSentPacketsFromIos(ios));\r\n assert LIoOpSend(p) in ios;\r\n assert ReplicaSentHeartbeatToPrimaryReflectingOpn(b[i], executor_idx, h.view.proposer_id, opn + 1, p);\r\n assert sat(i+1, x);\r\n assert false;\r\n }\r\n }\r\n }\r\n\r\n TemporalAlways(first_step, TemporalWF1Req1(P, Q));\r\n TemporalAlways(first_step, TemporalWF1RealTimeDelayedReq2(P, Q, Action, nextHeartbeatTime + asp.max_clock_ambiguity, f));\r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, executor_idx, 9);\r\n lemma_EstablishRequirementsForWF1RealTimeDelayed(b, asp, first_step, Action, TimeToPerformGenericAction(asp));\r\n step := TemporalWF1RealTimeDelayed(first_step, P, Q, Action, TimeToPerformGenericAction(asp), nextHeartbeatTime + asp.max_clock_ambiguity, f);\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationThenExecutorEventuallyExecutesItAndTellsPrimary(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n executor_idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires executor_idx in asp.live_quorum\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 4 + asp.c.params.heartbeat_period + TimeToPerformGenericAction(asp) * 5 + h.processing_bound * 2;\r\n var x := ReplicaSentHeartbeatToPrimaryReflectingOpnTemporal(b, executor_idx, h.view.proposer_id, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(x, or(y, not(z))), t, f))\r\n{\r\n var first_step := lemma_IfLiveReplicasReadyForAnOperationThenExecutorEventuallyExecutesIt(b, asp, h, opn, prev_step, executor_idx);\r\n var w := ReplicaCaughtUpTemporal(b, executor_idx, opn + 1);\r\n var x := ReplicaSentHeartbeatToPrimaryReflectingOpnTemporal(b, executor_idx, h.view.proposer_id, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n\r\n if sat(first_step, or(x, or(y, not(z))))\r\n {\r\n step := first_step;\r\n return;\r\n }\r\n\r\n if first_step < prev_step\r\n {\r\n lemma_OpsCompleteMonotonic(b, asp.c, first_step, prev_step, executor_idx);\r\n first_step := prev_step;\r\n }\r\n assert sat(first_step, w);\r\n\r\n step := lemma_IfExecutorCaughtUpThenExecutorEventuallyExecutesItAndTellsPrimary(b, asp, h, opn, prev_step, first_step, executor_idx);\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationThenPrimaryFindsOutExecutorExecutedIt(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n executor_idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires executor_idx in asp.live_quorum\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 4 + asp.c.params.heartbeat_period + TimeToPerformGenericAction(asp) * 5 + h.processing_bound * 3;\r\n var x := PrimaryKnowsReplicaHasOpsCompleteTemporal(b, executor_idx, h.view.proposer_id, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(x, or(y, not(z))), t, f))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var w := ReplicaSentHeartbeatToPrimaryReflectingOpnTemporal(b, executor_idx, h.view.proposer_id, opn + 1);\r\n var x := PrimaryKnowsReplicaHasOpsCompleteTemporal(b, executor_idx, h.view.proposer_id, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 4\r\n + asp.c.params.heartbeat_period + TimeToPerformGenericAction(asp) * 5 + h.processing_bound * 3;\r\n\r\n var first_step := lemma_IfLiveReplicasReadyForAnOperationThenExecutorEventuallyExecutesItAndTellsPrimary(b, asp, h, opn, prev_step, executor_idx);\r\n\r\n if sat(first_step, or(x, or(y, not(z))))\r\n {\r\n step := first_step;\r\n return;\r\n }\r\n\r\n assert !PrimaryKnowsReplicaHasOpsComplete(b[first_step], executor_idx, h.view.proposer_id, opn + 1);\r\n assert !AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmpty(b[first_step], asp.live_quorum, h.view, opn + 1);\r\n assert NoReplicaBeyondView(b[first_step], h.view);\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, first_step);\r\n assert sat(first_step, w);\r\n var p :| ReplicaSentHeartbeatToPrimaryReflectingOpn(b[first_step], executor_idx, h.view.proposer_id, opn + 1, p);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, first_step);\r\n assert b[first_step+1].environment.time == b[first_step].environment.time;\r\n\r\n var processing_step, ios := lemma_PacketSentToIndexProcessedByIt(b, asp, h.start_step, h.processing_bound, first_step, h.view.proposer_id, p);\r\n lemma_ConstantsAllConsistent(b, asp.c, processing_step);\r\n lemma_ConstantsAllConsistent(b, asp.c, processing_step+1);\r\n\r\n lemma_NextCheckpointedOperationAlwaysSizeOfReplicas(b, asp.c, processing_step, h.view.proposer_id);\r\n assert ReplicasDistinct(asp.c.config.replica_ids, executor_idx, GetReplicaIndex(p.src, asp.c.config));\r\n \r\n lemma_OpsCompleteMonotonic(b, asp.c, first_step, processing_step + 1, executor_idx);\r\n assert PrimaryKnowsReplicaHasOpsComplete(b[processing_step+1], executor_idx, h.view.proposer_id, opn + 1);\r\n step := processing_step + 1;\r\n assert f[step] <= t;\r\n assert sat(step, x);\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationThenPrimaryAlwaysKnowsExecutorExecutedIt(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n executor_idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires executor_idx in asp.live_quorum\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 4 + asp.c.params.heartbeat_period + TimeToPerformGenericAction(asp) * 5 + h.processing_bound * 3;\r\n var x := PrimaryKnowsReplicaHasOpsCompleteTemporal(b, executor_idx, h.view.proposer_id, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(always(x), or(y, not(z))), t, f))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var x := PrimaryKnowsReplicaHasOpsCompleteTemporal(b, executor_idx, h.view.proposer_id, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n\r\n step := lemma_IfLiveReplicasReadyForAnOperationThenPrimaryFindsOutExecutorExecutedIt(b, asp, h, opn, prev_step, executor_idx);\r\n if sat(step, or(y, not(z)))\r\n {\r\n return;\r\n }\r\n assert sat(step, x);\r\n\r\n forall i | step <= i\r\n ensures sat(i, imply(x, next(x)))\r\n {\r\n if sat(i, x) && !sat(i+1, x)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n lemma_OpsCompleteMonotonicOneStep(b, asp.c, i, executor_idx);\r\n lemma_NextCheckpointedOperationAlwaysSizeOfReplicas(b, asp.c, i, h.view.proposer_id);\r\n var s := b[i].replicas[h.view.proposer_id].replica.acceptor;\r\n var s' := b[i+1].replicas[h.view.proposer_id].replica.acceptor;\r\n assert s' != s;\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, h.view.proposer_id);\r\n var action_index := b[i].replicas[h.view.proposer_id].nextActionIndex;\r\n if action_index == 1 || action_index == 2 || action_index == 3 || action_index == 4 || action_index == 5\r\n || action_index == 6 || action_index == 7 || action_index == 8 || action_index == 9\r\n {\r\n assert s'.last_checkpointed_operation == s.last_checkpointed_operation;\r\n assert false;\r\n }\r\n else if ios[0].LIoOpTimeoutReceive? {\r\n assert s' == s;\r\n assert false;\r\n }\r\n else {\r\n assert ios[0].LIoOpReceive?;\r\n var msg := ios[0].r.msg;\r\n if msg.RslMessage_Invalid? || msg.RslMessage_Request? || msg.RslMessage_1a? || msg.RslMessage_1b?\r\n || msg.RslMessage_StartingPhase2? || msg.RslMessage_2a? || msg.RslMessage_2b? || msg.RslMessage_Reply?\r\n || msg.RslMessage_AppStateRequest? || msg.RslMessage_AppStateSupply? {\r\n assert s'.last_checkpointed_operation == s.last_checkpointed_operation;\r\n assert false;\r\n }\r\n else {\r\n assert msg.RslMessage_Heartbeat?;\r\n assert false;\r\n }\r\n }\r\n }\r\n reveal imply();\r\n reveal next();\r\n }\r\n \r\n TemporalInductionNext(step, x);\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationThenPrimaryAlwaysKnowsEveryExecutorExecutedIt(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 4 + asp.c.params.heartbeat_period + TimeToPerformGenericAction(asp) * 5 + h.processing_bound * 3;\r\n var always_xs := always(andset(PrimaryKnowsEveryReplicaHasOpsCompleteTemporalSet(b, asp.live_quorum, h.view.proposer_id, opn + 1)));\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(always_xs, or(y, not(z))), t, f))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var xs := PrimaryKnowsEveryReplicaHasOpsCompleteTemporalSet(b, asp.live_quorum, h.view.proposer_id, opn + 1);\r\n var always_xs := always(andset(xs));\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n\r\n var start_time := b[h.start_step + 1].environment.time;\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 4 + asp.c.params.heartbeat_period + TimeToPerformGenericAction(asp) * 5 + h.processing_bound * 3;\r\n lemma_TimeAdvancesBetween(b, asp, h.start_step + 1, prev_step);\r\n\r\n forall x | x in xs\r\n ensures sat(h.start_step + 1, eventuallywithin(or(always(x), or(y, not(z))), t - start_time, f))\r\n {\r\n var executor_idx :| executor_idx in asp.live_quorum && x == PrimaryKnowsReplicaHasOpsCompleteTemporal(b, executor_idx, h.view.proposer_id, opn + 1);\r\n var my_step := lemma_IfLiveReplicasReadyForAnOperationThenPrimaryAlwaysKnowsExecutorExecutedIt(b, asp, h, opn, prev_step, executor_idx);\r\n TemporalEventuallyWithin(h.start_step + 1, my_step, or(always(x), or(y, not(z))), t - start_time, f);\r\n }\r\n\r\n Lemma_EventuallyAlwaysWithinEachOrAlternativeImpliesEventuallyAlwaysWithinAllOrAlternative(h.start_step + 1, xs, or(y, not(z)), t - start_time, f);\r\n step := TemporalDeduceFromEventuallyWithin(h.start_step + 1, or(always_xs, or(y, not(z))), t - start_time, f);\r\n}\r\n\r\nlemma lemma_IfPrimaryTruncatesLogDueToCheckpointsWhileKnowingAllRepliesExecutedOpnThenItAdvancesLogTruncationPoint(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n i:int,\r\n ios:seq\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= i\r\n requires sat(i, andset(PrimaryKnowsEveryReplicaHasOpsCompleteTemporalSet(b, asp.live_quorum, h.view.proposer_id, opn + 1)))\r\n requires RslNextOneReplica(b[i], b[i+1], h.view.proposer_id, ios)\r\n requires 0 <= h.view.proposer_id < |b[i].replicas|\r\n requires 0 <= h.view.proposer_id < |b[i+1].replicas|\r\n requires LReplicaNextSpontaneousTruncateLogBasedOnCheckpoints(b[i].replicas[h.view.proposer_id].replica, b[i+1].replicas[h.view.proposer_id].replica, ExtractSentPacketsFromIos(ios))\r\n ensures PrimaryHasAdvancedLogTruncationPoint(b[i+1], asp.live_quorum, h.view, opn + 1)\r\n{\r\n var xs := PrimaryKnowsEveryReplicaHasOpsCompleteTemporalSet(b, asp.live_quorum, h.view.proposer_id, opn + 1);\r\n var s := b[i].replicas[h.view.proposer_id].replica;\r\n\r\n forall idx | idx in asp.live_quorum\r\n ensures ReplicaCaughtUp(b[i+1], idx, opn + 1)\r\n ensures 0 <= idx < |s.acceptor.last_checkpointed_operation|\r\n ensures s.acceptor.last_checkpointed_operation[idx] >= opn + 1\r\n {\r\n var x := PrimaryKnowsReplicaHasOpsCompleteTemporal(b, idx, h.view.proposer_id, opn + 1);\r\n assert x in xs;\r\n assert sat(i, x);\r\n }\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n\r\n var a := s.acceptor.last_checkpointed_operation;\r\n forall opn' | IsLogTruncationPointValid(opn', a, s.constants.all.config)\r\n ensures opn' >= opn + 1\r\n {\r\n if opn' < opn + 1\r\n {\r\n assert IsNthHighestValueInSequence(opn', a, LMinQuorumSize(asp.c.config));\r\n var matchfun := x => x > opn';\r\n var matches := SetOfIndicesOfMatchesInSeq(a, matchfun);\r\n forall idx | idx in asp.live_quorum\r\n ensures idx in matches\r\n {\r\n assert 0 <= idx < |a|; // OBSERVE\r\n assert matchfun(a[idx]); // OBSERVE\r\n }\r\n assert asp.live_quorum <= matches;\r\n SubsetCardinality(asp.live_quorum, matches);\r\n assert |asp.live_quorum| <= |matches| == CountMatchesInSeq(a, matchfun) < LMinQuorumSize(asp.c.config);\r\n assert false;\r\n }\r\n }\r\n \r\n assert PrimaryHasAdvancedLogTruncationPoint(b[i+1], asp.live_quorum, h.view, opn + 1);\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationThenEventuallyPrimaryAdvancesLogTruncationPointHelper(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int,\r\n first_step:int,\r\n i:int\r\n )\r\n requires imaptotal(b)\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires h.start_step + 1 <= first_step <= i\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n requires var ws := PrimaryKnowsEveryReplicaHasOpsCompleteTemporalSet(b, asp.live_quorum, h.view.proposer_id, opn + 1);\r\n var always_ws := always(andset(ws));\r\n var P := always_ws;\r\n var x := PrimaryHasAdvancedLogTruncationPointTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n var Q := or(x, or(y, not(z)));\r\n sat(first_step, P) && sat(i, P) && !sat(i, Q) && !sat(i+1, Q)\r\n requires sat(i, ReplicaSchedule(b, h.view.proposer_id)[4])\r\n ensures false\r\n{\r\n var ws := PrimaryKnowsEveryReplicaHasOpsCompleteTemporalSet(b, asp.live_quorum, h.view.proposer_id, opn + 1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n Lemma_AlwaysImpliesLaterAlways(first_step, i+1, andset(ws));\r\n var s := b[i].replicas[h.view.proposer_id].replica;\r\n var s' := b[i+1].replicas[h.view.proposer_id].replica;\r\n lemma_ExpandReplicaSchedule(b, h.view.proposer_id, 4);\r\n assert sat(i, MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousTruncateLogBasedOnCheckpoints,\r\n h.view.proposer_id));\r\n assert SpecificSpontaneousRslActionOccurs(b[i], b[i+1], LReplicaNextSpontaneousTruncateLogBasedOnCheckpoints, h.view.proposer_id);\r\n var ios:seq :| && RslNextOneReplica(b[i], b[i+1], h.view.proposer_id, ios)\r\n && LReplicaNextSpontaneousTruncateLogBasedOnCheckpoints(s, s', ExtractSentPacketsFromIos(ios));\r\n TemporalDeduceFromAlways(i, i, andset(ws));\r\n lemma_IfPrimaryTruncatesLogDueToCheckpointsWhileKnowingAllRepliesExecutedOpnThenItAdvancesLogTruncationPoint(b, asp, h, opn, i, ios);\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationThenEventuallyPrimaryAdvancesLogTruncationPoint(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 4 + asp.c.params.heartbeat_period + TimeToPerformGenericAction(asp) * 6 + h.processing_bound * 3;\r\n var x := PrimaryHasAdvancedLogTruncationPointTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(x, or(y, not(z))), t, f))\r\n{\r\n var f := PaxosTimeMap(b);\r\n var ws := PrimaryKnowsEveryReplicaHasOpsCompleteTemporalSet(b, asp.live_quorum, h.view.proposer_id, opn + 1);\r\n var always_ws := always(andset(ws));\r\n \r\n var x := PrimaryHasAdvancedLogTruncationPointTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n \r\n var first_step := lemma_IfLiveReplicasReadyForAnOperationThenPrimaryAlwaysKnowsEveryExecutorExecutedIt(b, asp, h, opn, prev_step);\r\n if sat(first_step, or(y, not(z)))\r\n {\r\n step := first_step;\r\n return;\r\n }\r\n assert sat(first_step, always_ws);\r\n\r\n var P := always_ws;\r\n var Q := or(x, or(y, not(z)));\r\n forall i | first_step <= i\r\n ensures sat(i, TemporalWF1Req1(P, Q))\r\n {\r\n if sat(i, P) {\r\n Lemma_AlwaysImpliesLaterAlways(first_step, i+1, andset(ws));\r\n assert sat(i+1, P);\r\n }\r\n }\r\n var Action := ReplicaSchedule(b, h.view.proposer_id)[4];\r\n forall i | first_step <= i\r\n ensures sat(i, TemporalWF1Req2(P, Q, Action))\r\n {\r\n if sat(i, P) && sat(i, Action) && !sat(i, Q) && !sat(i+1, Q)\r\n {\r\n lemma_IfLiveReplicasReadyForAnOperationThenEventuallyPrimaryAdvancesLogTruncationPointHelper(b, asp, h, opn, prev_step,\r\n first_step, i);\r\n }\r\n }\r\n\r\n TemporalAlways(first_step, TemporalWF1Req1(P, Q));\r\n TemporalAlways(first_step, TemporalWF1Req2(P, Q, Action));\r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, h.view.proposer_id, 4);\r\n lemma_EstablishRequirementsForWF1RealTime(b, asp, first_step, Action, TimeToPerformGenericAction(asp));\r\n TemporalWF1RealTime(first_step, P, Q, Action, TimeToPerformGenericAction(asp), f);\r\n step := TemporalDeduceFromLeadsToWithin(first_step, first_step, P, Q, TimeToPerformGenericAction(asp), f);\r\n}\r\n\r\nlemma lemma_IfLiveReplicasReadyForAnOperationTheyllEventuallyBeReadyForNextOperation(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber,\r\n prev_step:int\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n requires h.start_step + 1 <= prev_step\r\n requires AllLiveReplicasReadyForNextOperation(b[prev_step], asp.live_quorum, h.view, opn)\r\n ensures h.start_step + 1 <= step\r\n ensures var f := PaxosTimeMap(b);\r\n var t := b[prev_step].environment.time + asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 4 + asp.c.params.heartbeat_period + TimeToPerformGenericAction(asp) * 6 + h.processing_bound * 3;\r\n var x := AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n sat(step, beforeabsolutetime(or(x, or(y, not(z))), t, f))\r\n{\r\n var x := AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var y := AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn + 1);\r\n var z := NoReplicaBeyondViewTemporal(b, h.view);\r\n\r\n var step1 := lemma_IfLiveReplicasReadyForAnOperationThenEventuallyPrimaryAdvancesLogTruncationPoint(b, asp, h, opn, prev_step);\r\n if sat(step1, or(y, not(z)))\r\n {\r\n step := step1;\r\n return;\r\n }\r\n lemma_ConstantsAllConsistent(b, asp.c, step1);\r\n assert forall idx :: idx in asp.live_quorum ==> ReplicaCaughtUp(b[step1], idx, opn + 1);\r\n assert b[step1].replicas[h.view.proposer_id].replica.acceptor.log_truncation_point >= opn + 1;\r\n\r\n var step2 := lemma_IfLiveReplicasReadyForAnOperationThenProposerEventuallyAdvancesNextOp(b, asp, h, opn, prev_step);\r\n if sat(step2, or(y, not(z)))\r\n {\r\n step := step2;\r\n return;\r\n }\r\n lemma_ConstantsAllConsistent(b, asp.c, step2);\r\n assert b[step2].replicas[h.view.proposer_id].replica.proposer.next_operation_number_to_propose >= opn + 1;\r\n\r\n if step1 < step2\r\n {\r\n step := step2;\r\n forall idx | idx in asp.live_quorum\r\n ensures ReplicaCaughtUp(b[step], idx, opn + 1)\r\n {\r\n lemma_OpsCompleteMonotonic(b, asp.c, step1, step2, idx);\r\n }\r\n lemma_LogTruncationPointMonotonic(b, asp.c, step1, step2, h.view.proposer_id);\r\n assert AllLiveReplicasReadyForNextOperation(b[step], asp.live_quorum, h.view, opn + 1);\r\n }\r\n else\r\n {\r\n step := step1;\r\n lemma_NextOperationNumberToProposeIncreasesInPhase2(b, asp, h, step2, step1);\r\n assert AllLiveReplicasReadyForNextOperation(b[step], asp.live_quorum, h.view, opn + 1);\r\n }\r\n}\r\n\r\nlemma lemma_EventuallyAllLiveReplicasReadyForCertainOperation(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n opn:OperationNumber\r\n ) returns (\r\n step:int\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires opn >= h.log_truncation_point\r\n ensures h.start_step + 1 <= step\r\n ensures b[step].environment.time <= b[h.start_step + 1].environment.time + TimeToBeginPhase2(asp, h.processing_bound) + (opn - h.log_truncation_point) * TimeToAdvanceOneOperation(asp, h.processing_bound)\r\n ensures sat(step, or(AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn),\r\n or(AllLiveReplicasCaughtUpWithEarlierOperationWithRequestQueueEmptyTemporal(b, asp.live_quorum, h.view, opn),\r\n not(NoReplicaBeyondViewTemporal(b, h.view)))))\r\n decreases opn - h.log_truncation_point\r\n{\r\n if opn == h.log_truncation_point\r\n {\r\n step := lemma_EventuallyAllLiveReplicasReadyForFirstOperation(b, asp, h);\r\n return;\r\n }\r\n\r\n var prev_step := lemma_EventuallyAllLiveReplicasReadyForCertainOperation(b, asp, h, opn - 1);\r\n calc {\r\n b[prev_step].environment.time + TimeToAdvanceOneOperation(asp, h.processing_bound);\r\n <= b[h.start_step+1].environment.time + TimeToBeginPhase2(asp, h.processing_bound)\r\n + (opn - 1 - h.log_truncation_point) * TimeToAdvanceOneOperation(asp, h.processing_bound) + TimeToAdvanceOneOperation(asp, h.processing_bound);\r\n == b[h.start_step+1].environment.time + TimeToBeginPhase2(asp, h.processing_bound)\r\n + (opn - 1 - h.log_truncation_point) * TimeToAdvanceOneOperation(asp, h.processing_bound) + 1 * TimeToAdvanceOneOperation(asp, h.processing_bound);\r\n == { lemma_mul_is_distributive_add_other_way(TimeToAdvanceOneOperation(asp, h.processing_bound), opn - 1 - h.log_truncation_point, 1); }\r\n b[h.start_step+1].environment.time + TimeToBeginPhase2(asp, h.processing_bound) + (opn - h.log_truncation_point) * TimeToAdvanceOneOperation(asp, h.processing_bound);\r\n }\r\n\r\n if !sat(prev_step, AllLiveReplicasReadyForNextOperationTemporal(b, asp.live_quorum, h.view, opn - 1))\r\n {\r\n step := prev_step;\r\n return;\r\n }\r\n\r\n step := lemma_IfLiveReplicasReadyForAnOperationTheyllEventuallyBeReadyForNextOperation(b, asp, h, opn - 1, prev_step);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/RealTime.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Induction.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/Rules.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/WF1.i.dfy\"\r\n\r\nmodule LivenessProof__RealTime_i {\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Maps2_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Induction_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Temporal__WF1_i\r\nimport opened EnvironmentSynchrony_s\r\n\r\nlemma lemma_TimeAdvancesBetween(b:Behavior, asp:AssumptionParameters, i:int, j:int)\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i <= j\r\n ensures PaxosTimeMap(b)[i] <= PaxosTimeMap(b)[j]\r\n decreases j - i\r\n{\r\n if j > i\r\n {\r\n lemma_TimeAdvancesBetween(b, asp, i, j-1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, j-1);\r\n }\r\n}\r\n\r\npredicate TimeMonotonicFromInvariant(b:Behavior, asp:AssumptionParameters, i:int)\r\n requires imaptotal(b)\r\n requires imaptotal(PaxosTimeMap(b))\r\n{\r\n monotonic_from(i, PaxosTimeMap(b))\r\n}\r\n\r\nlemma lemma_TimeMonotonicFromInvariantHolds(b:Behavior, asp:AssumptionParameters, i:int)\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n ensures TimeMonotonicFromInvariant(b, asp, i)\r\n{\r\n forall j, k | i <= j <= k\r\n {\r\n lemma_TimeAdvancesBetween(b, asp, j, k);\r\n }\r\n}\r\n\r\nlemma lemma_AfterForm(b:Behavior, asp:AssumptionParameters)\r\n requires LivenessAssumptions(b, asp)\r\n ensures TimeNotZeno(PaxosTimeMap(b))\r\n{\r\n var timefun := PaxosTimeMap(b);\r\n var eb := RestrictBehaviorToEnvironment(b);\r\n\r\n reveal eventual();\r\n reveal after();\r\n\r\n forall t\r\n ensures sat(0, eventual(after(t, timefun)))\r\n {\r\n var x := TimeReachesTemporal(eb, t);\r\n var i := eventualStep(0, x);\r\n TemporalEventually(0, i, after(t, timefun));\r\n }\r\n\r\n assert forall t :: sat(0, eventual(after(t, timefun)));\r\n assert forall t :: sat(0, eventual(after(t, PaxosTimeMap(b))));\r\n}\r\n\r\nlemma lemma_TimeReachesAfter(b:Behavior, asp:AssumptionParameters, i:int, rt:int) returns (j:int)\r\n requires LivenessAssumptions(b, asp)\r\n ensures i <= j\r\n ensures b[j].environment.time >= rt\r\n{\r\n var eb := RestrictBehaviorToEnvironment(b);\r\n var x := TimeReachesTemporal(eb, rt);\r\n assert sat(0, eventual(x));\r\n j := TemporalDeduceFromEventual(0, x);\r\n assert b[j].environment.time >= rt;\r\n if i > j\r\n {\r\n lemma_TimeAdvancesBetween(b, asp, j, i);\r\n j := i;\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/RequestQueue.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\n\r\nmodule LivenessProof__RequestQueue_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Rules_i\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\n\r\nlemma lemma_RequestInFirstNOfRequestQueueDuringPhase1(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n start_step:int,\r\n view:Ballot,\r\n ahead_idx:int,\r\n req:Request,\r\n n:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires sat(start_step, StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx))\r\n requires sat(start_step, always(RequestInFirstNTemporal(b, view.proposer_id, req, n)))\r\n requires 0 <= start_step <= i\r\n requires 0 <= view.proposer_id < |b[i].replicas|\r\n requires b[i].replicas[view.proposer_id].replica.proposer.max_ballot_i_sent_1a == view\r\n requires b[i].replicas[view.proposer_id].replica.proposer.current_state == 1\r\n ensures RequestInFirstNOfRequestQueue(b[i], view.proposer_id, req, n)\r\n{\r\n if i == start_step\r\n {\r\n assert false;\r\n }\r\n else\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n\r\n var idx := view.proposer_id;\r\n var s := b[i-1].replicas[idx].replica.proposer;\r\n var s' := b[i].replicas[idx].replica.proposer;\r\n\r\n if s.max_ballot_i_sent_1a == view && s.current_state == 1\r\n {\r\n lemma_RequestInFirstNOfRequestQueueDuringPhase1(b, asp, i-1, start_step, view, ahead_idx, req, n);\r\n if s'.request_queue == s.request_queue\r\n {\r\n assert RequestInFirstNOfRequestQueue(b[i], idx, req, n);\r\n }\r\n else\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i-1, idx);\r\n var action_index := b[i-1].replicas[idx].nextActionIndex;\r\n assert action_index == 0 && ios[0].LIoOpReceive? && ios[0].r.msg.RslMessage_Request?;\r\n assert s.request_queue <= s'.request_queue;\r\n }\r\n }\r\n else\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i-1, idx);\r\n TemporalDeduceFromAlways(start_step, i-1, RequestInFirstNTemporal(b, idx, req, n));\r\n var action_index := b[i-1].replicas[idx].nextActionIndex;\r\n assert action_index == 1;\r\n assert s.election_state.requests_received_prev_epochs <= s'.request_queue;\r\n }\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/RequestsReceived.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"Seqno.i.dfy\"\r\ninclude \"Execution.i.dfy\"\r\ninclude \"RoundRobin.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"WF1.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/WF1.i.dfy\"\r\n\r\nmodule LivenessProof__RequestsReceived_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Election_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__Execution_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LivenessProof__Seqno_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__WF1_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened Temporal__Induction_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Temporal__WF1_i\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\n\r\npredicate RequestInRequestsReceivedPrevEpochs(ps:RslState, req:Request, idx:int)\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && req in ps.replicas[idx].replica.proposer.election_state.requests_received_prev_epochs\r\n}\r\n\r\nfunction {:opaque} RequestInRequestsReceivedPrevEpochsTemporal(b:Behavior, req:Request, idx:int):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, RequestInRequestsReceivedPrevEpochsTemporal(b, req, idx))} ::\r\n sat(i, RequestInRequestsReceivedPrevEpochsTemporal(b, req, idx)) <==> RequestInRequestsReceivedPrevEpochs(b[i], req, idx)\r\n{\r\n stepmap(imap i :: RequestInRequestsReceivedPrevEpochs(b[i], req, idx))\r\n}\r\n\r\npredicate RequestInRequestsReceivedThisOrPrevEpochs(ps:RslState, req:Request, idx:int)\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && (|| req in ps.replicas[idx].replica.proposer.election_state.requests_received_prev_epochs\r\n || req in ps.replicas[idx].replica.proposer.election_state.requests_received_this_epoch)\r\n}\r\n\r\nfunction {:opaque} RequestInRequestsReceivedThisOrPrevEpochsTemporal(b:Behavior, req:Request, idx:int):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, RequestInRequestsReceivedThisOrPrevEpochsTemporal(b, req, idx))} ::\r\n sat(i, RequestInRequestsReceivedThisOrPrevEpochsTemporal(b, req, idx))\r\n <==> RequestInRequestsReceivedThisOrPrevEpochs(b[i], req, idx)\r\n{\r\n stepmap(imap i :: RequestInRequestsReceivedThisOrPrevEpochs(b[i], req, idx))\r\n}\r\n\r\nlemma lemma_RemoveAllSatisfiedRequestsRemoval(s:seq, r:Request, r':Request)\r\n ensures r' in s && r' !in RemoveAllSatisfiedRequestsInSequence(s, r) ==> RequestSatisfiedBy(r', r)\r\n{\r\n if r' in s && r' !in RemoveAllSatisfiedRequestsInSequence(s, r)\r\n {\r\n assert |s| > 0;\r\n assert r' !in RemoveAllSatisfiedRequestsInSequence(s[1..], r);\r\n lemma_RemoveAllSatisfiedRequestsRemoval(s[1..], r, r');\r\n if RequestSatisfiedBy(s[0], r)\r\n {\r\n assert r' in s;\r\n if r' == s[0]\r\n {\r\n assert RequestSatisfiedBy(r', r);\r\n }\r\n }\r\n else\r\n {\r\n assert r' != s[0];\r\n assert r' in s[1..];\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_RemoveExecutedRequestBatchRemoval(s:seq, batch:RequestBatch, r':Request) returns (req_idx:int)\r\n requires r' in s\r\n requires r' !in RemoveExecutedRequestBatch(s, batch)\r\n ensures 0 <= req_idx < |batch|\r\n ensures RequestSatisfiedBy(r', batch[req_idx])\r\n decreases |batch|\r\n{\r\n if |batch| == 0\r\n {\r\n }\r\n else if RequestSatisfiedBy(r', batch[0])\r\n {\r\n req_idx := 0;\r\n }\r\n else\r\n {\r\n lemma_RemoveAllSatisfiedRequestsRemoval(s, batch[0], r');\r\n assert r' in RemoveAllSatisfiedRequestsInSequence(s, batch[0]);\r\n var req_idx_minus_1 := lemma_RemoveExecutedRequestBatchRemoval(RemoveAllSatisfiedRequestsInSequence(s, batch[0]), batch[1..], r');\r\n req_idx := req_idx_minus_1 + 1;\r\n }\r\n}\r\n\r\nlemma lemma_IfObjectNotInFirstNOfSequenceItsNotTheFirst(r:T, s:seq, n:int)\r\n requires |s| > 0\r\n requires n > 0\r\n requires !ObjectInFirstNOfSequence(r, s, n)\r\n ensures r != s[0]\r\n{\r\n}\r\n\r\nlemma lemma_RemoveAllSatisfiedRequestsRemovalFromFirstN(s:seq, r:Request, r':Request, n:int)\r\n ensures ObjectInFirstNOfSequence(r', s, n) && !ObjectInFirstNOfSequence(r', RemoveAllSatisfiedRequestsInSequence(s, r), n)\r\n ==> RequestSatisfiedBy(r', r)\r\n{\r\n if ObjectInFirstNOfSequence(r', s, n) && !ObjectInFirstNOfSequence(r', RemoveAllSatisfiedRequestsInSequence(s, r), n)\r\n {\r\n assert |s| > 0;\r\n assert n > 0;\r\n if RequestSatisfiedBy(s[0], r)\r\n {\r\n if !ObjectInFirstNOfSequence(r', s[1..], n)\r\n {\r\n if |s[1..]| <= n\r\n {\r\n assert r' !in s[1..];\r\n assert r' == s[0];\r\n }\r\n else\r\n {\r\n assert r' !in s[1..][..n];\r\n assert r' !in s[1..n];\r\n assert |s| >= n;\r\n assert r' in s[..n];\r\n assert r' == s[0];\r\n }\r\n assert RequestSatisfiedBy(r', r);\r\n }\r\n else\r\n {\r\n lemma_RemoveAllSatisfiedRequestsRemovalFromFirstN(s[1..], r, r', n-1);\r\n assert RequestSatisfiedBy(r', r);\r\n }\r\n }\r\n else\r\n {\r\n var s' := RemoveAllSatisfiedRequestsInSequence(s[1..], r);\r\n assert !ObjectInFirstNOfSequence(r', [s[0]] + s', n);\r\n lemma_IfObjectNotInFirstNOfSequenceItsNotTheFirst(r', [s[0]] + s', n);\r\n assert r' != s[0];\r\n lemma_RemoveAllSatisfiedRequestsRemovalFromFirstN(s[1..], r, r', n-1);\r\n forall ensures !ObjectInFirstNOfSequence(r', s', n-1)\r\n {\r\n if |[s[0]] + s'| > n > 0 {\r\n assert ([s[0]] + s')[..n] == [s[0]] + s'[..n - 1];\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_RemoveExecutedRequestBatchRemovalFromFirstN(s:seq, batch:RequestBatch, r':Request, n:int) returns (req_idx:int)\r\n requires ObjectInFirstNOfSequence(r', s, n)\r\n requires !ObjectInFirstNOfSequence(r', RemoveExecutedRequestBatch(s, batch), n)\r\n ensures 0 <= req_idx < |batch|\r\n ensures RequestSatisfiedBy(r', batch[req_idx])\r\n decreases |batch|\r\n{\r\n if |batch| == 0\r\n {\r\n }\r\n else if RequestSatisfiedBy(r', batch[0])\r\n {\r\n req_idx := 0;\r\n }\r\n else\r\n {\r\n lemma_RemoveAllSatisfiedRequestsRemovalFromFirstN(s, batch[0], r', n);\r\n var s' := RemoveAllSatisfiedRequestsInSequence(s, batch[0]);\r\n assert ObjectInFirstNOfSequence(r', s', n);\r\n assert !ObjectInFirstNOfSequence(r', RemoveExecutedRequestBatch(s', batch[1..]), n);\r\n var req_idx_minus_1 := lemma_RemoveExecutedRequestBatchRemovalFromFirstN(s', batch[1..], r', n);\r\n req_idx := req_idx_minus_1 + 1;\r\n }\r\n}\r\n\r\nlemma lemma_NextOpToExecuteNeverExceedsSeqno(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int,\r\n req_idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires b[i].replicas[idx].replica.executor.next_op_to_execute.OutstandingOpKnown?\r\n requires 0 <= req_idx < |b[i].replicas[idx].replica.executor.next_op_to_execute.v|\r\n requires b[i].replicas[idx].replica.executor.next_op_to_execute.v[req_idx].client == asp.persistent_request.client\r\n ensures b[i].replicas[idx].replica.executor.next_op_to_execute.v[req_idx].seqno <= asp.persistent_request.seqno\r\n{\r\n var s := b[i].replicas[idx].replica;\r\n\r\n lemma_SequenceNumberStateInvHolds(b, asp, i);\r\n assert SequenceNumberReplicaInv(s, asp.persistent_request);\r\n assert SequenceNumberRequestInv(s.executor.next_op_to_execute.v[req_idx], asp.persistent_request);\r\n}\r\n\r\nlemma lemma_EventuallyPersistentRequestInRequestsReceivedThisOrPrevEpochs(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires idx in asp.live_quorum\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n ensures processing_sync_start <= step\r\n ensures sat(step, RequestInRequestsReceivedThisOrPrevEpochsTemporal(b, asp.persistent_request, idx))\r\n{\r\n var client_send := ClientSendsRequestToReplicaTemporal(b, asp.persistent_request, asp.c.config.replica_ids[idx]);\r\n assert PersistentClientSendsRequestPeriodically(b, asp, idx);\r\n assert sat(asp.synchrony_start, always(eventuallynextwithin(client_send, asp.persistent_period, PaxosTimeMap(b))));\r\n TemporalDeduceFromAlways(asp.synchrony_start, processing_sync_start, eventuallynextwithin(client_send, asp.persistent_period, PaxosTimeMap(b)));\r\n var send_step := TemporalDeduceFromEventual(processing_sync_start, nextbefore(client_send, b[processing_sync_start].environment.time + asp.persistent_period, PaxosTimeMap(b)));\r\n var p := LPacket(asp.c.config.replica_ids[idx], asp.persistent_request.client, RslMessage_Request(asp.persistent_request.seqno, asp.persistent_request.request));\r\n var processing_step, ios := lemma_PacketSentToIndexProcessedByIt(b, asp, processing_sync_start, processing_bound, send_step, idx, p);\r\n\r\n lemma_RequestNeverHitsInReplyCache(b, asp, processing_sync_start, processing_bound, processing_step, idx, ios, p);\r\n\r\n var es := b[processing_step].replicas[idx].replica.proposer.election_state;\r\n var es' := b[processing_step+1].replicas[idx].replica.proposer.election_state;\r\n assert ElectionStateReflectReceivedRequest(es, es', asp.persistent_request);\r\n\r\n if earlier_req :| && (earlier_req in es.requests_received_prev_epochs || earlier_req in es.requests_received_this_epoch)\r\n && RequestsMatch(earlier_req, asp.persistent_request)\r\n {\r\n lemma_SequenceNumberStateInvHolds(b, asp, processing_step);\r\n assert SequenceNumberRequestInv(earlier_req, asp.persistent_request);\r\n assert RequestInRequestsReceivedThisOrPrevEpochs(b[processing_step], asp.persistent_request, idx);\r\n step := processing_step;\r\n }\r\n else\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, processing_step);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, processing_step, idx);\r\n assert RequestInRequestsReceivedThisOrPrevEpochs(b[processing_step+1], asp.persistent_request, idx);\r\n step := processing_step + 1;\r\n }\r\n}\r\n\r\nlemma lemma_IfStepRemovesRequestFromBothThisAndPrevEpochsThenItsMaybeExecute(\r\n ps:RslState,\r\n ps':RslState,\r\n asp:AssumptionParameters,\r\n idx:int,\r\n req:Request\r\n ) returns (\r\n ios:seq\r\n )\r\n requires RslNext(ps, ps')\r\n requires RequestInRequestsReceivedThisOrPrevEpochs(ps, req, idx)\r\n requires !RequestInRequestsReceivedThisOrPrevEpochs(ps', req, idx)\r\n requires ps.replicas[idx].replica.proposer.election_state.constants.all.params == asp.c.params\r\n requires OverflowProtectionNotUsedForReplica(ps, idx, asp.c.params, asp.max_clock_ambiguity)\r\n ensures RslNextOneReplica(ps, ps', idx, ios)\r\n ensures LReplicaNextSpontaneousMaybeExecute(ps.replicas[idx].replica, ps'.replicas[idx].replica, ExtractSentPacketsFromIos(ios))\r\n{\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps.replicas[idx].replica;\r\n var es := ps.replicas[idx].replica.proposer.election_state;\r\n ios :| RslNextOneReplica(ps, ps', idx, ios);\r\n if && |ios| >= 1\r\n && ios[0].LIoOpReceive?\r\n && ios[0].r.msg.RslMessage_Request?\r\n && LReplicaNextProcessRequest(s, s', ios[0].r, ExtractSentPacketsFromIos(ios))\r\n && LProposerProcessRequest(s.proposer, s'.proposer, ios[0].r)\r\n {\r\n var p := ios[0].r;\r\n var val := Request(p.src, p.msg.seqno_req, p.msg.val);\r\n assert req in BoundRequestSequence(es.requests_received_prev_epochs + [val], es.constants.all.params.max_integer_val);\r\n assert false;\r\n }\r\n assert req in BoundRequestSequence(es.requests_received_prev_epochs + es.requests_received_this_epoch, es.constants.all.params.max_integer_val);\r\n}\r\n\r\nlemma lemma_EventuallyPersistentRequestAlwaysInRequestsReceivedThisOrPrevEpochs(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires idx in asp.live_quorum\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n ensures processing_sync_start <= step\r\n ensures sat(step, always(RequestInRequestsReceivedThisOrPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n{\r\n var client := asp.persistent_request.client;\r\n var seqno := asp.persistent_request.seqno;\r\n var t := RequestInRequestsReceivedThisOrPrevEpochsTemporal(b, asp.persistent_request, idx);\r\n step := lemma_EventuallyPersistentRequestInRequestsReceivedThisOrPrevEpochs(b, asp, processing_sync_start, processing_bound, idx);\r\n\r\n forall j {:trigger sat(j, imply(t, next(t)))} | step <= j\r\n ensures sat(j, imply(t, next(t)))\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, j);\r\n lemma_ConstantsAllConsistent(b, asp.c, j+1);\r\n if sat(j, t) && !sat(j+1, t)\r\n {\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, j);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, j, idx);\r\n var ios := lemma_IfStepRemovesRequestFromBothThisAndPrevEpochsThenItsMaybeExecute(b[j], b[j+1], asp, idx, asp.persistent_request);\r\n var s := b[j].replicas[idx].replica;\r\n var s' := b[j+1].replicas[idx].replica;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n if asp.persistent_request in es.requests_received_prev_epochs\r\n {\r\n var req_idx := lemma_RemoveExecutedRequestBatchRemoval(es.requests_received_prev_epochs, s.executor.next_op_to_execute.v, asp.persistent_request);\r\n lemma_NextOpToExecuteNeverExceedsSeqno(b, asp, j, idx, req_idx);\r\n assert ReplySentToClientWithSeqno(b[j], b[j+1], client, seqno, idx, ios, req_idx);\r\n }\r\n else\r\n {\r\n var req_idx := lemma_RemoveExecutedRequestBatchRemoval(es.requests_received_this_epoch, s.executor.next_op_to_execute.v, asp.persistent_request);\r\n lemma_NextOpToExecuteNeverExceedsSeqno(b, asp, j, idx, req_idx);\r\n assert ReplySentToClientWithSeqno(b[j], b[j+1], client, seqno, idx, ios, req_idx);\r\n }\r\n lemma_PersistentRequestNeverExecuted(b, asp, idx);\r\n TemporalDeduceFromAlways(asp.synchrony_start, j, not(RequestWithSeqnoExecutedTemporal(b, client, seqno, idx)));\r\n assert false;\r\n }\r\n reveal next();\r\n reveal imply();\r\n }\r\n\r\n TemporalInductionNext(step, t);\r\n TemporalEventually(processing_sync_start, step, always(t));\r\n}\r\n\r\npredicate RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEnd(\r\n ps:RslState,\r\n req:Request,\r\n idx:int,\r\n epoch_end_time:int\r\n )\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && var es := ps.replicas[idx].replica.proposer.election_state;\r\n && es.epoch_end_time == epoch_end_time\r\n && (req in es.requests_received_prev_epochs || req in es.requests_received_this_epoch)\r\n}\r\n\r\nfunction{:opaque} RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEndTemporal(\r\n b:Behavior,\r\n req:Request,\r\n idx:int,\r\n epoch_end_time:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEndTemporal(b, req, idx, epoch_end_time))} ::\r\n sat(i, RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEndTemporal(b, req, idx, epoch_end_time)) <==>\r\n RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEnd(b[i], req, idx, epoch_end_time)\r\n{\r\n stepmap(imap i :: RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEnd(b[i], req, idx, epoch_end_time))\r\n}\r\n\r\nlemma lemma_RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEndLeadsToRequestInRequestsReceivedPrevEpochsWF1Req1(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n idx:int,\r\n epoch_end_time:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires idx in asp.live_quorum\r\n ensures sat(asp.synchrony_start, always(TemporalWF1Req1(\r\n RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEndTemporal(b, asp.persistent_request, idx, epoch_end_time),\r\n RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx))))\r\n{\r\n var P := RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEndTemporal(b, asp.persistent_request, idx, epoch_end_time);\r\n var Q := RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx);\r\n\r\n forall i | asp.synchrony_start <= i\r\n ensures sat(i, TemporalWF1Req1(P, Q))\r\n {\r\n if sat(i, P) && !sat(i, Q) && !sat(i+1, P) && !sat(i+1, Q)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, idx);\r\n var nextActionIndex := b[i].replicas[idx].nextActionIndex;\r\n assert nextActionIndex == 0 || nextActionIndex == 1 || nextActionIndex == 2 || nextActionIndex == 3 ||\r\n nextActionIndex == 4 || nextActionIndex == 5 || nextActionIndex == 6 || nextActionIndex == 7 ||\r\n nextActionIndex == 8 || nextActionIndex == 9;\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, i, idx);\r\n var s := b[i].replicas[idx].replica;\r\n var s' := b[i+1].replicas[idx].replica;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n assert asp.persistent_request in es.requests_received_this_epoch;\r\n assert asp.persistent_request !in es.requests_received_prev_epochs;\r\n if LReplicaNextSpontaneousMaybeExecute(s, s', ExtractSentPacketsFromIos(ios))\r\n {\r\n var req_idx := lemma_RemoveExecutedRequestBatchRemoval(es.requests_received_this_epoch, s.executor.next_op_to_execute.v, asp.persistent_request);\r\n lemma_NextOpToExecuteNeverExceedsSeqno(b, asp, i, idx, req_idx);\r\n assert ReplySentToClientWithSeqno(b[i], b[i+1], asp.persistent_request.client, asp.persistent_request.seqno, idx, ios, req_idx);\r\n lemma_PersistentRequestNeverExecuted(b, asp, idx);\r\n TemporalDeduceFromAlways(asp.synchrony_start, i, not(RequestWithSeqnoExecutedTemporal(b, asp.persistent_request.client, asp.persistent_request.seqno, idx)));\r\n assert false;\r\n }\r\n else\r\n {\r\n if nextActionIndex == 0\r\n {\r\n assert false;\r\n }\r\n else if nextActionIndex == 1\r\n {\r\n assert false;\r\n }\r\n else if nextActionIndex == 2\r\n {\r\n assert false;\r\n }\r\n else if nextActionIndex == 3\r\n {\r\n assert false;\r\n }\r\n else if nextActionIndex == 4\r\n {\r\n assert false;\r\n }\r\n else if nextActionIndex == 5\r\n {\r\n assert false;\r\n }\r\n else if nextActionIndex == 6\r\n {\r\n assert false;\r\n }\r\n else if nextActionIndex == 7\r\n {\r\n assert false;\r\n }\r\n else if nextActionIndex == 8\r\n {\r\n assert false;\r\n }\r\n else if nextActionIndex == 9\r\n {\r\n assert false;\r\n }\r\n else {\r\n assert false;\r\n }\r\n }\r\n }\r\n }\r\n\r\n TemporalAlways(asp.synchrony_start, TemporalWF1Req1(P, Q));\r\n}\r\n\r\nlemma lemma_RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEndLeadsToRequestInRequestsReceivedPrevEpochsWF1Req2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n idx:int,\r\n epoch_end_time:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires idx in asp.live_quorum\r\n ensures sat(asp.synchrony_start, always(TemporalWF1RealTimeDelayedReq2(\r\n RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEndTemporal(b, asp.persistent_request, idx, epoch_end_time),\r\n RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx),\r\n ReplicaSchedule(b, idx)[7],\r\n epoch_end_time + asp.max_clock_ambiguity,\r\n PaxosTimeMap(b))))\r\n{\r\n var epochEndTimePlus := epoch_end_time + asp.max_clock_ambiguity;\r\n var P := RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEndTemporal(b, asp.persistent_request, idx, epoch_end_time);\r\n var Q := RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx);\r\n var Action := ReplicaSchedule(b, idx)[7];\r\n var f := PaxosTimeMap(b);\r\n\r\n forall i | asp.synchrony_start <= i\r\n ensures sat(i, TemporalWF1RealTimeDelayedReq2(P, Q, Action, epochEndTimePlus, f))\r\n {\r\n if sat(i, P) && sat(i, nextafter(Action, epochEndTimePlus, f)) && !sat(i, Q) && !sat(i+1, Q)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n assert SpecificClockReadingRslActionOccurs(b[i], b[i+1], LReplicaNextReadClockCheckForViewTimeout, idx);\r\n var ios:seq :| && RslNextOneReplica(b[i], b[i+1], idx, ios)\r\n && SpontaneousIos(ios, 1)\r\n && LReplicaNextReadClockCheckForViewTimeout(b[i].replicas[idx].replica, b[i+1].replicas[idx].replica,\r\n SpontaneousClock(ios), ExtractSentPacketsFromIos(ios));\r\n lemma_ClockAmbiguityLimitApplies(b, asp, i, idx, ios[0]);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, i, idx);\r\n var es := b[i].replicas[idx].replica.proposer.election_state;\r\n var es' := b[i+1].replicas[idx].replica.proposer.election_state;\r\n lemma_ClockAmbiguityLimitApplies(b, asp, i, idx, ios[0]);\r\n assert ElectionStateCheckForViewTimeout(es, es', ios[0].t);\r\n assert false;\r\n }\r\n }\r\n\r\n TemporalAlways(asp.synchrony_start, TemporalWF1RealTimeDelayedReq2(P, Q, Action, epochEndTimePlus, f));\r\n}\r\n\r\nlemma lemma_EventuallyPersistentRequestInRequestsReceivedPrevEpochs(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires idx in asp.live_quorum\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n ensures processing_sync_start <= step\r\n ensures sat(step, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx))\r\n{\r\n var i := lemma_EventuallyPersistentRequestInRequestsReceivedThisOrPrevEpochs(b, asp, processing_sync_start, processing_bound, idx);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n var epoch_end_time := b[i].replicas[idx].replica.proposer.election_state.epoch_end_time;\r\n \r\n var P := RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEndTemporal(b, asp.persistent_request, idx, epoch_end_time);\r\n var Q := RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx);\r\n var Action := ReplicaSchedule(b, idx)[7];\r\n\r\n Lemma_AlwaysImpliesLaterAlways(asp.synchrony_start, i, TemporalWF1Req1(P, Q));\r\n Lemma_AlwaysImpliesLaterAlways(asp.synchrony_start, i, TemporalWF1RealTimeDelayedReq2(P, Q, Action, epoch_end_time + asp.max_clock_ambiguity, PaxosTimeMap(b)));\r\n\r\n lemma_RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEndLeadsToRequestInRequestsReceivedPrevEpochsWF1Req1(b, asp, idx, epoch_end_time);\r\n lemma_RequestInRequestsReceivedThisOrPrevEpochsWithSpecificEpochEndLeadsToRequestInRequestsReceivedPrevEpochsWF1Req2(b, asp, idx, epoch_end_time);\r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, idx, 7);\r\n lemma_EstablishRequirementsForWF1RealTimeDelayed(b, asp, i, Action, TimeToPerformGenericAction(asp));\r\n step := TemporalWF1RealTimeDelayed(i, P, Q, Action, TimeToPerformGenericAction(asp), epoch_end_time + asp.max_clock_ambiguity, PaxosTimeMap(b));\r\n}\r\n\r\nlemma lemma_EventuallyPersistentRequestAlwaysInRequestsReceivedPrevEpochs(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires idx in asp.live_quorum\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n ensures processing_sync_start <= step\r\n ensures sat(step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n{\r\n var client := asp.persistent_request.client;\r\n var seqno := asp.persistent_request.seqno;\r\n var t := RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx);\r\n step := lemma_EventuallyPersistentRequestInRequestsReceivedPrevEpochs(b, asp, processing_sync_start, processing_bound, idx);\r\n\r\n forall j {:trigger sat(j, imply(t, next(t)))} | step <= j\r\n ensures sat(j, imply(t, next(t)))\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, j);\r\n lemma_ConstantsAllConsistent(b, asp.c, j+1);\r\n if sat(j, t) && !sat(j+1, t)\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, j, idx);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, j, idx);\r\n var s := b[j].replicas[idx].replica;\r\n var s' := b[j+1].replicas[idx].replica;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n assert LReplicaNextSpontaneousMaybeExecute(s, s', ExtractSentPacketsFromIos(ios));\r\n var req_idx := lemma_RemoveExecutedRequestBatchRemoval(es.requests_received_prev_epochs, s.executor.next_op_to_execute.v, asp.persistent_request);\r\n lemma_NextOpToExecuteNeverExceedsSeqno(b, asp, j, idx, req_idx);\r\n assert ReplySentToClientWithSeqno(b[j], b[j+1], client, seqno, idx, ios, req_idx);\r\n lemma_PersistentRequestNeverExecuted(b, asp, idx);\r\n TemporalDeduceFromAlways(asp.synchrony_start, j, not(RequestWithSeqnoExecutedTemporal(b, client, seqno, idx)));\r\n assert false;\r\n }\r\n reveal imply();\r\n reveal next();\r\n }\r\n\r\n TemporalInductionNext(step, t);\r\n TemporalEventually(processing_sync_start, step, always(t));\r\n}\r\n\r\nlemma lemma_EventuallyForSomePersistentRequestAlwaysInRequestsReceivedPrevEpochs(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n indices:set\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires indices <= asp.live_quorum\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n ensures processing_sync_start <= step\r\n ensures forall idx {:auto_trigger} :: idx in indices ==> sat(step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n{\r\n if |indices| == 0\r\n {\r\n step := processing_sync_start;\r\n }\r\n else\r\n {\r\n var some_index :| some_index in indices;\r\n var other_indices := indices - {some_index};\r\n var others_step := lemma_EventuallyForSomePersistentRequestAlwaysInRequestsReceivedPrevEpochs(b, asp, processing_sync_start, processing_bound, other_indices);\r\n var this_step := lemma_EventuallyPersistentRequestAlwaysInRequestsReceivedPrevEpochs(b, asp, processing_sync_start, processing_bound, some_index);\r\n step := if others_step > this_step then others_step else this_step;\r\n forall idx | idx in indices\r\n ensures sat(step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n {\r\n if step > this_step\r\n {\r\n Lemma_AlwaysImpliesLaterAlways(this_step, step, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx));\r\n }\r\n else\r\n {\r\n Lemma_AlwaysImpliesLaterAlways(others_step, step, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx));\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_EventuallyForAllPersistentRequestAlwaysInRequestsReceivedPrevEpochs(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n ensures processing_sync_start <= step\r\n ensures forall idx :: idx in asp.live_quorum ==> sat(step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n{\r\n step := lemma_EventuallyForSomePersistentRequestAlwaysInRequestsReceivedPrevEpochs(b, asp, processing_sync_start, processing_bound, asp.live_quorum);\r\n}\r\n\r\nlemma lemma_PersistentRequestDoesNotIncreasePositionInRequestsReceivedPrevEpochs(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n idx:int,\r\n step:int,\r\n n:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires idx in asp.live_quorum\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires processing_sync_start <= step\r\n requires sat(step, RequestInFirstNTemporal(b, idx, asp.persistent_request, n))\r\n ensures sat(step, always(RequestInFirstNTemporal(b, idx, asp.persistent_request, n)))\r\n{\r\n var client := asp.persistent_request.client;\r\n var seqno := asp.persistent_request.seqno;\r\n var t := RequestInFirstNTemporal(b, idx, asp.persistent_request, n);\r\n\r\n forall j {:trigger sat(j, imply(t, next(t)))} | step <= j\r\n ensures sat(j, imply(t, next(t)))\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, j);\r\n lemma_ConstantsAllConsistent(b, asp.c, j+1);\r\n if sat(j, t) && !sat(j+1, t)\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, j, idx);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, j, idx);\r\n var s := b[j].replicas[idx].replica;\r\n var s' := b[j+1].replicas[idx].replica;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n assert RequestInFirstN(b[j], idx, asp.persistent_request, n);\r\n assert !RequestInFirstN(b[j + 1], idx, asp.persistent_request, n);\r\n assert s.proposer.election_state.requests_received_prev_epochs != s'.proposer.election_state.requests_received_prev_epochs;\r\n var nextActionIndex := b[j].replicas[idx].nextActionIndex;\r\n if (nextActionIndex == 0 || nextActionIndex == 7 || nextActionIndex == 8) {\r\n assert s.proposer.election_state.requests_received_prev_epochs <= s'.proposer.election_state.requests_received_prev_epochs;\r\n assert false;\r\n }\r\n assert nextActionIndex == 6;\r\n assert LReplicaNextSpontaneousMaybeExecute(s, s', ExtractSentPacketsFromIos(ios));\r\n var req_idx := lemma_RemoveExecutedRequestBatchRemovalFromFirstN(es.requests_received_prev_epochs, s.executor.next_op_to_execute.v, asp.persistent_request, n);\r\n lemma_NextOpToExecuteNeverExceedsSeqno(b, asp, j, idx, req_idx);\r\n assert ReplySentToClientWithSeqno(b[j], b[j+1], client, seqno, idx, ios, req_idx);\r\n lemma_PersistentRequestNeverExecuted(b, asp, idx);\r\n TemporalDeduceFromAlways(asp.synchrony_start, j, not(RequestWithSeqnoExecutedTemporal(b, client, seqno, idx)));\r\n assert false;\r\n }\r\n reveal imply();\r\n reveal next();\r\n }\r\n\r\n TemporalInductionNext(step, t);\r\n TemporalEventually(processing_sync_start, step, always(t));\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/RoundRobin.i.dfy", "content": "include \"../Replica.i.dfy\"\r\ninclude \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"RealTime.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\ninclude \"../../../Common/Framework/EnvironmentSynchronyLemmas.i.dfy\"\r\ninclude \"../../Common/Liveness/RTSchedule.i.dfy\"\r\ninclude \"../../../../Libraries/Math/mul.i.dfy\"\r\n\r\nmodule LivenessProof__RoundRobin_i {\r\nimport opened LiveRSL__ClockReading_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened Liveness__EnvironmentSynchronyLemmas_i\r\nimport opened Liveness__RTSchedule_i\r\nimport opened LivenessProof__RealTime_i\r\nimport opened Math__mul_i\r\nimport opened Temporal__Monotonicity_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Maps2_i\r\n\r\npredicate SpecificRslActionOccurs(\r\n ps:RslState,\r\n ps':RslState,\r\n action_fun:(LReplica, LReplica, seq)->bool,\r\n replica_index:int\r\n )\r\n reads action_fun.reads\r\n requires forall r, r', ios :: action_fun.requires(r, r', ios)\r\n{\r\n exists ios {:trigger RslNextOneReplica(ps, ps', replica_index, ios)}\r\n {:trigger action_fun(ps.replicas[replica_index].replica, ps'.replicas[replica_index].replica, ios)} ::\r\n && RslNextOneReplica(ps, ps', replica_index, ios)\r\n && action_fun(ps.replicas[replica_index].replica, ps'.replicas[replica_index].replica, ios)\r\n}\r\n\r\nfunction{:opaque} MakeRslActionTemporalFromReplicaFunction(\r\n b:Behavior,\r\n action_fun:(LReplica, LReplica, seq)->bool,\r\n replica_index:int\r\n ):temporal\r\n reads action_fun.reads\r\n requires forall r, r', ios :: action_fun.requires(r, r', ios)\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, MakeRslActionTemporalFromReplicaFunction(b, action_fun, replica_index))} ::\r\n sat(i, MakeRslActionTemporalFromReplicaFunction(b, action_fun, replica_index)) <==>\r\n SpecificRslActionOccurs(b[i], b[i+1], action_fun, replica_index)\r\n{\r\n stepmap(imap i :: SpecificRslActionOccurs(b[i], b[nextstep(i)], action_fun, replica_index))\r\n}\r\n\r\npredicate SpecificSpontaneousRslActionOccurs(\r\n ps:RslState,\r\n ps':RslState,\r\n action_fun:(LReplica, LReplica, seq)->bool,\r\n replica_index:int\r\n )\r\n reads action_fun.reads\r\n requires forall r, r', sent_packets :: action_fun.requires(r, r', sent_packets)\r\n{\r\n exists ios {:trigger RslNextOneReplica(ps, ps', replica_index, ios)}\r\n {:trigger action_fun(ps.replicas[replica_index].replica, ps'.replicas[replica_index].replica, ExtractSentPacketsFromIos(ios))} ::\r\n && RslNextOneReplica(ps, ps', replica_index, ios)\r\n && SpontaneousIos(ios, 0)\r\n && action_fun(ps.replicas[replica_index].replica, ps'.replicas[replica_index].replica, ExtractSentPacketsFromIos(ios))\r\n}\r\n\r\nfunction{:opaque} MakeRslActionTemporalFromSpontaneousReplicaFunction(\r\n b:Behavior,\r\n action_fun:(LReplica, LReplica, seq)->bool,\r\n replica_index:int\r\n ):temporal\r\n reads action_fun.reads\r\n requires forall r, r', sent_packets :: action_fun.requires(r, r', sent_packets)\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, MakeRslActionTemporalFromSpontaneousReplicaFunction(b, action_fun, replica_index))} ::\r\n sat(i, MakeRslActionTemporalFromSpontaneousReplicaFunction(b, action_fun, replica_index)) <==>\r\n SpecificSpontaneousRslActionOccurs(b[i], b[i+1], action_fun, replica_index)\r\n{\r\n stepmap(imap i :: SpecificSpontaneousRslActionOccurs(b[i], b[nextstep(i)], action_fun, replica_index))\r\n}\r\n\r\npredicate SpecificClockReadingRslActionOccurs(\r\n ps:RslState,\r\n ps':RslState,\r\n action_fun:(LReplica, LReplica, ClockReading, seq)->bool,\r\n replica_index:int\r\n )\r\n reads action_fun.reads\r\n requires forall r, r', ios :: action_fun.requires(r, r', SpontaneousClock(ios), ExtractSentPacketsFromIos(ios))\r\n{\r\n exists ios {:trigger RslNextOneReplica(ps, ps', replica_index, ios)}\r\n {:trigger action_fun(ps.replicas[replica_index].replica, ps'.replicas[replica_index].replica, SpontaneousClock(ios), ExtractSentPacketsFromIos(ios))} ::\r\n && RslNextOneReplica(ps, ps', replica_index, ios)\r\n && SpontaneousIos(ios, 1)\r\n && action_fun(ps.replicas[replica_index].replica, ps'.replicas[replica_index].replica, SpontaneousClock(ios), ExtractSentPacketsFromIos(ios))\r\n}\r\n\r\nfunction{:opaque} MakeRslActionTemporalFromReadClockReplicaFunction(\r\n b:Behavior,\r\n action_fun:(LReplica, LReplica, ClockReading, seq)->bool,\r\n replica_index:int\r\n ):temporal\r\n reads action_fun.reads\r\n requires forall r, r', ios :: action_fun.requires(r, r', SpontaneousClock(ios), ExtractSentPacketsFromIos(ios))\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, MakeRslActionTemporalFromReadClockReplicaFunction(b, action_fun, replica_index))} ::\r\n sat(i, MakeRslActionTemporalFromReadClockReplicaFunction(b, action_fun, replica_index)) <==>\r\n SpecificClockReadingRslActionOccurs(b[i], b[nextstep(i)], action_fun, replica_index)\r\n{\r\n stepmap(imap i :: SpecificClockReadingRslActionOccurs(b[i], b[nextstep(i)], action_fun, replica_index))\r\n}\r\n\r\nfunction ReplicaSchedule(b:Behavior, replica_index:int):seq\r\n requires imaptotal(b)\r\n{\r\n [ MakeRslActionTemporalFromReplicaFunction(b, LReplicaNextProcessPacket, replica_index),\r\n MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousMaybeEnterNewViewAndSend1a, replica_index),\r\n MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousMaybeEnterPhase2, replica_index),\r\n MakeRslActionTemporalFromReadClockReplicaFunction(b, LReplicaNextReadClockMaybeNominateValueAndSend2a, replica_index),\r\n MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousTruncateLogBasedOnCheckpoints, replica_index),\r\n MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousMaybeMakeDecision, replica_index),\r\n MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousMaybeExecute, replica_index),\r\n MakeRslActionTemporalFromReadClockReplicaFunction(b, LReplicaNextReadClockCheckForViewTimeout, replica_index),\r\n MakeRslActionTemporalFromReadClockReplicaFunction(b, LReplicaNextReadClockCheckForQuorumOfViewSuspicions, replica_index),\r\n MakeRslActionTemporalFromReadClockReplicaFunction(b, LReplicaNextReadClockMaybeSendHeartbeat, replica_index)\r\n ]\r\n}\r\n\r\nfunction TimeToPerformGenericAction(asp:AssumptionParameters):int\r\n requires asp.host_period > 0\r\n ensures TimeToPerformGenericAction(asp) >= 0\r\n{\r\n lemma_mul_nonnegative(asp.host_period, LReplicaNumActions());\r\n asp.host_period * LReplicaNumActions()\r\n}\r\n\r\nlemma lemma_ExpandReplicaSchedule(\r\n b:Behavior,\r\n idx:int,\r\n pos:int\r\n )\r\n requires imaptotal(b)\r\n ensures pos == 0 ==> ReplicaSchedule(b, idx)[pos] ==\r\n MakeRslActionTemporalFromReplicaFunction(b, LReplicaNextProcessPacket, idx)\r\n ensures pos == 1 ==> ReplicaSchedule(b, idx)[pos] ==\r\n MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousMaybeEnterNewViewAndSend1a, idx)\r\n ensures pos == 2 ==> ReplicaSchedule(b, idx)[pos] ==\r\n MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousMaybeEnterPhase2, idx)\r\n ensures pos == 3 ==> ReplicaSchedule(b, idx)[pos] ==\r\n MakeRslActionTemporalFromReadClockReplicaFunction(b, LReplicaNextReadClockMaybeNominateValueAndSend2a, idx)\r\n ensures pos == 4 ==> ReplicaSchedule(b, idx)[pos] ==\r\n MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousTruncateLogBasedOnCheckpoints, idx)\r\n ensures pos == 5 ==> ReplicaSchedule(b, idx)[pos] ==\r\n MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousMaybeMakeDecision, idx)\r\n ensures pos == 6 ==> ReplicaSchedule(b, idx)[pos] ==\r\n MakeRslActionTemporalFromSpontaneousReplicaFunction(b, LReplicaNextSpontaneousMaybeExecute, idx)\r\n ensures pos == 7 ==> ReplicaSchedule(b, idx)[pos] ==\r\n MakeRslActionTemporalFromReadClockReplicaFunction(b, LReplicaNextReadClockCheckForViewTimeout, idx)\r\n ensures pos == 8 ==> ReplicaSchedule(b, idx)[pos] ==\r\n MakeRslActionTemporalFromReadClockReplicaFunction(b, LReplicaNextReadClockCheckForQuorumOfViewSuspicions, idx)\r\n ensures pos == 9 ==> ReplicaSchedule(b, idx)[pos] ==\r\n MakeRslActionTemporalFromReadClockReplicaFunction(b, LReplicaNextReadClockMaybeSendHeartbeat, idx)\r\n{\r\n}\r\n\r\nlemma lemma_PaxosNextTakesSchedulerActionOrLeavesNextActionIndexUnchanged(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n replica_index:int,\r\n next_action_type_fun:imap,\r\n scheduler_action:temporal\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= replica_index < |asp.c.config.replica_ids|\r\n requires imaptotal(next_action_type_fun)\r\n requires forall i {:trigger next_action_type_fun[i]} ::\r\n next_action_type_fun[i] == if 0 <= replica_index < |b[i].replicas| then b[i].replicas[replica_index].nextActionIndex else 0\r\n requires forall i :: sat(i, scheduler_action) <==>\r\n exists ios {:trigger RslNextOneReplica(b[i], b[i+1], replica_index, ios)}\r\n {:trigger LSchedulerNext(b[i].replicas[replica_index], b[i+1].replicas[replica_index], ios)} ::\r\n && RslNextOneReplica(b[i], b[i+1], replica_index, ios)\r\n && LSchedulerNext(b[i].replicas[replica_index], b[i+1].replicas[replica_index], ios)\r\n ensures sat(0, always(SchedulerActsOrNextActionTypeUnchangedTemporal(b, next_action_type_fun, scheduler_action)))\r\n{\r\n var m := SchedulerActsOrNextActionTypeUnchangedTemporal(b, next_action_type_fun, scheduler_action);\r\n\r\n forall i | TLe(0, i)\r\n ensures sat(i, m)\r\n {\r\n assert RslNext(b[i], b[i+1]);\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n\r\n if (exists idx, ios {:trigger RslNextOneReplica(b[i], b[i+1], idx, ios)} :: RslNextOneReplica(b[i], b[i+1], idx, ios))\r\n {\r\n var idx, ios :| RslNextOneReplica(b[i], b[i+1], idx, ios);\r\n if (idx == replica_index)\r\n {\r\n assert sat(i, scheduler_action);\r\n }\r\n else\r\n {\r\n assert next_action_type_fun[i] == next_action_type_fun[i+1];\r\n }\r\n }\r\n else\r\n {\r\n assert next_action_type_fun[i] == next_action_type_fun[i+1];\r\n }\r\n\r\n assert sat(i, m);\r\n }\r\n TemporalAlways(0, m);\r\n}\r\n\r\nlemma lemma_SchedulerNextImpliesSpecificScheduleAction(\r\n b:Behavior,\r\n i:int,\r\n asp:AssumptionParameters,\r\n replica_index:int,\r\n action_index:int\r\n )\r\n requires imaptotal(b)\r\n requires sat(i, MakeRslActionTemporalFromSchedulerFunction(b, replica_index))\r\n requires b[i].replicas[replica_index].nextActionIndex == action_index\r\n ensures 0 <= action_index < LReplicaNumActions() ==> sat(i, ReplicaSchedule(b, replica_index)[action_index])\r\n{\r\n assert RslSchedulerActionOccursForReplica(b[i], b[i+1], replica_index);\r\n var ios :| && RslNextOneReplica(b[i], b[i+1], replica_index, ios)\r\n && LSchedulerNext(b[i].replicas[replica_index], b[i+1].replicas[replica_index], ios);\r\n if action_index == 0\r\n {\r\n assert SpecificRslActionOccurs(b[i], b[i+1], LReplicaNextProcessPacket, replica_index);\r\n }\r\n else if action_index == 1\r\n {\r\n assert SpecificSpontaneousRslActionOccurs(b[i], b[i+1], LReplicaNextSpontaneousMaybeEnterNewViewAndSend1a, replica_index);\r\n }\r\n else if action_index == 2\r\n {\r\n assert SpecificSpontaneousRslActionOccurs(b[i], b[i+1], LReplicaNextSpontaneousMaybeEnterPhase2, replica_index);\r\n }\r\n else if action_index == 3\r\n {\r\n assert SpecificClockReadingRslActionOccurs(b[i], b[i+1], LReplicaNextReadClockMaybeNominateValueAndSend2a, replica_index);\r\n }\r\n else if action_index == 4\r\n {\r\n assert SpecificSpontaneousRslActionOccurs(b[i], b[i+1], LReplicaNextSpontaneousTruncateLogBasedOnCheckpoints, replica_index);\r\n }\r\n else if action_index == 5\r\n {\r\n assert SpecificSpontaneousRslActionOccurs(b[i], b[i+1], LReplicaNextSpontaneousMaybeMakeDecision, replica_index);\r\n }\r\n else if action_index == 6\r\n {\r\n assert SpecificSpontaneousRslActionOccurs(b[i], b[i+1], LReplicaNextSpontaneousMaybeExecute, replica_index);\r\n }\r\n else if action_index == 7\r\n {\r\n assert SpecificClockReadingRslActionOccurs(b[i], b[i+1], LReplicaNextReadClockCheckForViewTimeout, replica_index);\r\n }\r\n else if action_index == 8\r\n {\r\n assert SpecificClockReadingRslActionOccurs(b[i], b[i+1], LReplicaNextReadClockCheckForQuorumOfViewSuspicions, replica_index);\r\n }\r\n else if action_index == 9\r\n {\r\n assert SpecificClockReadingRslActionOccurs(b[i], b[i+1], LReplicaNextReadClockMaybeSendHeartbeat, replica_index);\r\n }\r\n}\r\n\r\nlemma lemma_ReplicaNextPerformsSubactionPeriodically(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n replica_index:int,\r\n action_index:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires replica_index in asp.live_quorum\r\n requires 0 <= action_index < LReplicaNumActions()\r\n ensures var real_time_fun := PaxosTimeMap(b);\r\n var longer_interval := TimeToPerformGenericAction(asp);\r\n sat(asp.synchrony_start, always(eventuallynextwithin(ReplicaSchedule(b, replica_index)[action_index],\r\n longer_interval, real_time_fun)));\r\n{\r\n var next_action_type_fun := imap i :: if 0 <= replica_index < |b[i].replicas| then b[i].replicas[replica_index].nextActionIndex else 0;\r\n var real_time_fun := PaxosTimeMap(b);\r\n var scheduler_action := MakeRslActionTemporalFromSchedulerFunction(b, replica_index);\r\n var schedule := ReplicaSchedule(b, replica_index);\r\n\r\n var t := stepmap(imap j :: real_time_fun[j] <= real_time_fun[nextstep(j)]);\r\n forall j | 0 <= j\r\n ensures sat(j, t)\r\n {\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, j);\r\n }\r\n TemporalAlways(0, t);\r\n Lemma_MonotonicStepsLeadToMonotonicBehavior(0, real_time_fun);\r\n\r\n lemma_PaxosNextTakesSchedulerActionOrLeavesNextActionIndexUnchanged(b, asp, replica_index, next_action_type_fun, scheduler_action);\r\n assert HostExecutesPeriodically(b, asp, replica_index);\r\n\r\n forall i {:trigger sat(i, scheduler_action)} | 0 <= i && sat(i, scheduler_action)\r\n ensures var action_type_index := next_action_type_fun[i];\r\n && (0 <= action_type_index < |schedule| ==> sat(i, schedule[action_type_index]))\r\n && next_action_type_fun[i+1] == (action_type_index + 1) % |schedule|\r\n {\r\n var action_type_index := next_action_type_fun[i];\r\n lemma_SchedulerNextImpliesSpecificScheduleAction(b, i, asp, replica_index, action_type_index);\r\n assert next_action_type_fun[i+1] == (action_type_index + 1) % |schedule|;\r\n }\r\n\r\n Lemma_RoundRobinSchedulerTimelyForAllActionsTemporal(b, next_action_type_fun, real_time_fun, scheduler_action, schedule,\r\n asp.synchrony_start, asp.host_period);\r\n\r\n assert sat(asp.synchrony_start, always(eventuallynextwithin(schedule[action_index], asp.host_period * |schedule|, real_time_fun)));\r\n assert sat(asp.synchrony_start, always(eventuallynextwithin(ReplicaSchedule(b, replica_index)[action_index],\r\n TimeToPerformGenericAction(asp), real_time_fun)));\r\n}\r\n\r\nlemma lemma_ReplicaNextPerformsSubactionSoon(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n replica_index:int,\r\n action_index:int\r\n ) returns (\r\n action_step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires replica_index in asp.live_quorum\r\n requires 0 <= action_index < LReplicaNumActions()\r\n requires asp.synchrony_start <= start_step\r\n ensures start_step <= action_step\r\n ensures b[action_step+1].environment.time <= b[start_step].environment.time + TimeToPerformGenericAction(asp)\r\n ensures sat(action_step, ReplicaSchedule(b, replica_index)[action_index])\r\n{\r\n var x := ReplicaSchedule(b, replica_index)[action_index];\r\n var t := TimeToPerformGenericAction(asp);\r\n var f := PaxosTimeMap(b);\r\n \r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, replica_index, action_index);\r\n TemporalDeduceFromAlways(asp.synchrony_start, start_step, eventuallynextwithin(x, t, f));\r\n action_step := TemporalDeduceFromEventuallyNextWithin(start_step, x, t, f);\r\n}\r\n\r\nlemma lemma_ReplicaNextPerformsSubactionSoonAfter(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n start_step:int,\r\n replica_index:int,\r\n action_index:int,\r\n earliest:int\r\n ) returns (\r\n action_step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires replica_index in asp.live_quorum\r\n requires 0 <= action_index < LReplicaNumActions()\r\n requires asp.synchrony_start <= start_step\r\n ensures start_step <= action_step\r\n ensures b[action_step+1].environment.time >= earliest\r\n ensures b[action_step+1].environment.time <= TimeToPerformGenericAction(asp) + (if earliest >= b[start_step].environment.time then earliest else b[start_step].environment.time)\r\n ensures sat(action_step, ReplicaSchedule(b, replica_index)[action_index]);\r\n{\r\n var x := ReplicaSchedule(b, replica_index)[action_index];\r\n var t := TimeToPerformGenericAction(asp);\r\n var f := PaxosTimeMap(b);\r\n \r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, replica_index, action_index);\r\n TemporalDeduceFromAlways(asp.synchrony_start, start_step, eventuallynextwithin(x, t, f));\r\n\r\n if earliest < b[start_step].environment.time\r\n {\r\n action_step := TemporalDeduceFromEventuallyNextWithin(start_step, x, t, f);\r\n assert b[action_step+1].environment.time <= b[start_step].environment.time + t;\r\n lemma_TimeAdvancesBetween(b, asp, start_step, action_step+1);\r\n }\r\n else\r\n {\r\n Lemma_AlwaysImpliesLaterAlways(asp.synchrony_start, start_step, eventuallynextwithin(x, t, f));\r\n lemma_TimeMonotonicFromInvariantHolds(b, asp, 0);\r\n lemma_AfterForm(b, asp);\r\n action_step := Lemma_AlwaysEventuallyWithinMeansAlwaysEventuallyWithinAfter(start_step, x, earliest - b[start_step].environment.time,\r\n t, f);\r\n assert b[action_step+1].environment.time <= b[start_step].environment.time + (earliest - b[start_step].environment.time) + t;\r\n }\r\n}\r\n\r\nlemma lemma_ProcessingPacketCausesReceiveAttempt(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n replica_index:int,\r\n i:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires 0 <= replica_index < |asp.c.config.replica_ids|\r\n requires sat(i, MakeRslActionTemporalFromReplicaFunction(b, LReplicaNextProcessPacket, replica_index))\r\n ensures sat(i, ReceiveAttemptedTemporal(RestrictBehaviorToEnvironment(b), asp.c.config.replica_ids[replica_index]))\r\n{\r\n var eb := RestrictBehaviorToEnvironment(b);\r\n var host := asp.c.config.replica_ids[replica_index];\r\n lemma_ReplicasSize(b, asp.c, i);\r\n var action := MakeRslActionTemporalFromReplicaFunction(b, LReplicaNextProcessPacket, replica_index);\r\n assert sat(i, action);\r\n assert SpecificRslActionOccurs(b[i], b[i+1], LReplicaNextProcessPacket, replica_index);\r\n var ios:seq :| && RslNextOneReplica(b[i], b[i+1], replica_index, ios)\r\n && LReplicaNextProcessPacket(b[i].replicas[replica_index].replica, b[i+1].replicas[replica_index].replica, ios);\r\n assert |ios| >= 1 && (ios[0].LIoOpTimeoutReceive? || ios[0].LIoOpReceive?);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n assert ReceiveAttemptedInStep(b[i].environment, host);\r\n assert sat(i, ReceiveAttemptedTemporal(eb, host));\r\n}\r\n\r\nlemma lemma_ReplicaNextPerformsProcessPacketPeriodically(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n replica_index:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires replica_index in asp.live_quorum\r\n ensures var real_time_fun := PaxosTimeMap(b);\r\n var longer_interval := TimeToPerformGenericAction(asp);\r\n sat(asp.synchrony_start, always(eventuallynextwithin(MakeRslActionTemporalFromReplicaFunction(b, LReplicaNextProcessPacket, replica_index), longer_interval, real_time_fun)))\r\n ensures var real_time_fun := PaxosTimeMap(b);\r\n var longer_interval := TimeToPerformGenericAction(asp);\r\n var host := asp.c.config.replica_ids[replica_index];\r\n sat(asp.synchrony_start, always(eventuallynextwithin(ReceiveAttemptedTemporal(RestrictBehaviorToEnvironment(b), host), longer_interval, real_time_fun)))\r\n{\r\n var real_time_fun := PaxosTimeMap(b);\r\n var longer_interval := TimeToPerformGenericAction(asp);\r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, replica_index, 0);\r\n assert sat(asp.synchrony_start, always(eventuallynextwithin(MakeRslActionTemporalFromReplicaFunction(b, LReplicaNextProcessPacket, replica_index), longer_interval, real_time_fun)));\r\n\r\n var host := asp.c.config.replica_ids[replica_index];\r\n\r\n var eb := RestrictBehaviorToEnvironment(b);\r\n forall i | TLe(asp.synchrony_start, i)\r\n ensures sat(i, eventuallynextwithin(ReceiveAttemptedTemporal(eb, host), longer_interval, real_time_fun))\r\n {\r\n lemma_ReplicasSize(b, asp.c, i);\r\n TemporalDeduceFromAlways(asp.synchrony_start, i, eventuallynextwithin(MakeRslActionTemporalFromReplicaFunction(b, LReplicaNextProcessPacket, replica_index), longer_interval, real_time_fun));\r\n var j := TemporalDeduceFromEventuallyNextWithin(i, MakeRslActionTemporalFromReplicaFunction(b, LReplicaNextProcessPacket, replica_index), longer_interval, real_time_fun);\r\n lemma_ProcessingPacketCausesReceiveAttempt(b, asp, replica_index, j);\r\n TemporalEventuallyNextWithin(i, j, ReceiveAttemptedTemporal(eb, host), longer_interval, real_time_fun);\r\n }\r\n TemporalAlways(asp.synchrony_start, eventuallynextwithin(ReceiveAttemptedTemporal(RestrictBehaviorToEnvironment(b), host), longer_interval, real_time_fun));\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/Seqno.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"PacketHandling.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../CommonProof/ReplyCache.i.dfy\"\r\ninclude \"../CommonProof/Requests.i.dfy\"\r\n\r\nmodule LivenessProof__Seqno_i {\r\nimport opened LiveRSL__Acceptor_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Election_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened LiveRSL__Learner_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__StateMachine_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened Liveness__HostQueueLemmas_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened CommonProof__ReplyCache_i\r\nimport opened CommonProof__Requests_i\r\nimport opened Temporal__Heuristics_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened AppStateMachine_s\r\nimport opened Environment_s\r\nimport opened EnvironmentSynchrony_s\r\n\r\n/////////////////////\r\n// INVARIANTS\r\n/////////////////////\r\n\r\npredicate SequenceNumberRequestInv(req':Request, req:Request)\r\n requires req.Request?\r\n{\r\n req'.Request? && req'.client == req.client ==> (req'.seqno < req.seqno) || (req'.seqno == req.seqno && req'.request == req.request)\r\n}\r\n\r\npredicate SequenceNumberBatchInv(batch:RequestBatch, req:Request)\r\n requires req.Request?\r\n{\r\n forall req' :: req' in batch ==> SequenceNumberRequestInv(req', req)\r\n}\r\n\r\npredicate SequenceNumberVotesInv(votes:Votes, req:Request)\r\n requires req.Request?\r\n{\r\n forall op :: op in votes ==> SequenceNumberBatchInv(votes[op].max_val, req)\r\n}\r\n\r\npredicate SequenceNumberLearnerStateInv(s:LearnerState, req:Request)\r\n requires req.Request?\r\n{\r\n forall op :: op in s ==> SequenceNumberBatchInv(s[op].candidate_learned_value, req)\r\n}\r\n\r\npredicate SequenceNumberReplyCacheInv(reply_cache:ReplyCache, req:Request)\r\n requires req.Request?\r\n{\r\n req.client in reply_cache && reply_cache[req.client].Reply? ==> reply_cache[req.client].seqno <= req.seqno\r\n}\r\n\r\npredicate SequenceNumberPacketInv(p:RslPacket, req:Request)\r\n requires req.Request?\r\n{\r\n && (p.msg.RslMessage_Request? ==> SequenceNumberRequestInv(Request(p.src, p.msg.seqno_req, p.msg.val), req))\r\n && (p.msg.RslMessage_1b? ==> SequenceNumberVotesInv(p.msg.votes, req))\r\n && (p.msg.RslMessage_2a? ==> SequenceNumberBatchInv(p.msg.val_2a, req))\r\n && (p.msg.RslMessage_2b? ==> SequenceNumberBatchInv(p.msg.val_2b, req))\r\n}\r\n\r\npredicate SequenceNumberReplicaInv(s:LReplica, req:Request)\r\n requires req.Request?\r\n{\r\n && (forall r :: r in s.proposer.request_queue ==> SequenceNumberRequestInv(r, req))\r\n && (forall p :: p in s.proposer.received_1b_packets ==> SequenceNumberPacketInv(p, req))\r\n && (forall r :: r in s.proposer.election_state.requests_received_this_epoch ==> SequenceNumberRequestInv(r, req))\r\n && (forall r :: r in s.proposer.election_state.requests_received_prev_epochs ==> SequenceNumberRequestInv(r, req))\r\n && SequenceNumberVotesInv(s.acceptor.votes, req)\r\n && SequenceNumberLearnerStateInv(s.learner.unexecuted_learner_state, req)\r\n && (s.executor.next_op_to_execute.OutstandingOpKnown? ==> SequenceNumberBatchInv(s.executor.next_op_to_execute.v, req))\r\n && SequenceNumberReplyCacheInv(s.executor.reply_cache, req)\r\n}\r\n\r\npredicate SequenceNumberStateInv(ps:RslState, req:Request)\r\n requires req.Request?\r\n{\r\n && (forall p :: p in ps.environment.sentPackets && p.src in ps.constants.config.replica_ids ==> SequenceNumberPacketInv(p, req))\r\n && (forall idx :: 0 <= idx < |ps.replicas| ==> SequenceNumberReplicaInv(ps.replicas[idx].replica, req))\r\n}\r\n\r\n////////////////////////\r\n// PACKET INVARIANT\r\n////////////////////////\r\n\r\nlemma lemma_SequenceNumberPacketInvHolds(\r\n ps:RslState,\r\n ps':RslState,\r\n idx:int,\r\n ios:seq,\r\n p:RslPacket,\r\n req:Request\r\n )\r\n requires RslNextOneReplica(ps, ps', idx, ios)\r\n requires req.Request?\r\n requires LIoOpSend(p) in ios\r\n requires SequenceNumberStateInv(ps, req)\r\n requires LEnvironmentInvariant(ps.environment)\r\n requires ConstantsAllConsistentInv(ps)\r\n ensures SequenceNumberPacketInv(p, req)\r\n{\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var id := ps.constants.config.replica_ids[idx];\r\n var e := ps.environment;\r\n var e' := ps'.environment;\r\n \r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n if p.msg.RslMessage_2b?\r\n {\r\n var inp:RslPacket :| ios[0] == LIoOpReceive(inp) && inp.msg.RslMessage_2a? && LReplicaNextProcess2a(s, s', inp, sent_packets);\r\n lemma_PacketProcessedImpliesPacketSent(ps, ps', idx, ios, inp);\r\n if inp.src in ps.constants.config.replica_ids\r\n {\r\n assert SequenceNumberPacketInv(inp, req);\r\n assert SequenceNumberPacketInv(p, req);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_ReplicaNextPreservesSequenceNumberRequestQueueInv(\r\n ps:RslState,\r\n ps':RslState,\r\n idx:int,\r\n ios:seq,\r\n req:Request\r\n )\r\n requires RslNext(ps, ps')\r\n requires req.Request?\r\n requires 0 <= idx < |ps.replicas|\r\n requires RslNextOneReplica(ps, ps', idx, ios)\r\n requires SequenceNumberStateInv(ps, req)\r\n requires LEnvironmentInvariant(ps.environment)\r\n requires ConstantsAllConsistentInv(ps)\r\n requires |ps.constants.config.replica_ids| == |ps.replicas| == |ps'.constants.config.replica_ids| == |ps'.replicas|\r\n requires 0 <= idx < |ps'.replicas|\r\n requires ClientNeverSentHigherSequenceNumberRequest(ps, req)\r\n ensures forall r :: r in ps'.replicas[idx].replica.proposer.request_queue ==> SequenceNumberRequestInv(r, req)\r\n{\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var votes := s.acceptor.votes;\r\n var votes' := s'.acceptor.votes;\r\n var id := ps.constants.config.replica_ids[idx];\r\n var e := ps.environment;\r\n var e' := ps'.environment;\r\n\r\n forall r | r in s'.proposer.request_queue\r\n ensures SequenceNumberRequestInv(r, req)\r\n {\r\n if r !in s.proposer.request_queue\r\n {\r\n if |ios| > 0 && ios[0].LIoOpReceive? && LProposerProcessRequest(s.proposer, s'.proposer, ios[0].r)\r\n {\r\n var inp := ios[0].r;\r\n lemma_PacketProcessedImpliesPacketSent(ps, ps', idx, ios, inp);\r\n assert SequenceNumberPacketInv(inp, req);\r\n assert r == Request(inp.src, inp.msg.seqno_req, inp.msg.val);\r\n assert SequenceNumberRequestInv(r, req);\r\n }\r\n else\r\n {\r\n assert SequenceNumberRequestInv(r, req);\r\n }\r\n }\r\n }\r\n}\r\n\r\n////////////////////////////////////////////////\r\n// STATE INVARIANTS - SPECIFIC PARTS OF STATE\r\n////////////////////////////////////////////////\r\n\r\nlemma lemma_ReplicaNextPreservesSequenceNumberReceived1bPacketsInv(\r\n ps:RslState,\r\n ps':RslState,\r\n idx:int,\r\n ios:seq,\r\n req:Request\r\n )\r\n requires RslNext(ps, ps')\r\n requires req.Request?\r\n requires 0 <= idx < |ps.replicas|\r\n requires RslNextOneReplica(ps, ps', idx, ios)\r\n requires SequenceNumberStateInv(ps, req)\r\n requires LEnvironmentInvariant(ps.environment)\r\n requires ConstantsAllConsistentInv(ps)\r\n requires |ps.constants.config.replica_ids| == |ps.replicas| == |ps'.constants.config.replica_ids| == |ps'.replicas|\r\n requires 0 <= idx < |ps'.replicas|\r\n ensures forall p :: p in ps'.replicas[idx].replica.proposer.received_1b_packets ==> SequenceNumberPacketInv(p, req)\r\n{\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var votes := s.acceptor.votes;\r\n var votes' := s'.acceptor.votes;\r\n var id := ps.constants.config.replica_ids[idx];\r\n var e := ps.environment;\r\n var e' := ps'.environment;\r\n\r\n forall p | p in s'.proposer.received_1b_packets\r\n ensures SequenceNumberPacketInv(p, req)\r\n {\r\n if p !in s.proposer.received_1b_packets\r\n {\r\n assert |ios| > 0 && ios[0].LIoOpReceive? && LProposerProcess1b(s.proposer, s'.proposer, ios[0].r);\r\n var inp := ios[0].r;\r\n lemma_PacketProcessedImpliesPacketSent(ps, ps', idx, ios, inp);\r\n assert SequenceNumberPacketInv(inp, req);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_ReplicaNextPreservesSequenceNumberRequestsReceivedInv(\r\n ps:RslState,\r\n ps':RslState,\r\n idx:int,\r\n ios:seq,\r\n req:Request\r\n )\r\n requires RslNext(ps, ps')\r\n requires req.Request?\r\n requires 0 <= idx < |ps.replicas|\r\n requires RslNextOneReplica(ps, ps', idx, ios)\r\n requires SequenceNumberStateInv(ps, req)\r\n requires LEnvironmentInvariant(ps.environment)\r\n requires ConstantsAllConsistentInv(ps)\r\n requires |ps.constants.config.replica_ids| == |ps.replicas| == |ps'.constants.config.replica_ids| == |ps'.replicas|\r\n requires 0 <= idx < |ps'.replicas|\r\n requires ClientNeverSentHigherSequenceNumberRequest(ps, req)\r\n ensures forall r :: r in ps'.replicas[idx].replica.proposer.election_state.requests_received_this_epoch ==> SequenceNumberRequestInv(r, req)\r\n ensures forall r :: r in ps'.replicas[idx].replica.proposer.election_state.requests_received_prev_epochs ==> SequenceNumberRequestInv(r, req)\r\n{\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var votes := s.acceptor.votes;\r\n var votes' := s'.acceptor.votes;\r\n var id := ps.constants.config.replica_ids[idx];\r\n var e := ps.environment;\r\n var e' := ps'.environment;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n\r\n forall r | r in es'.requests_received_this_epoch\r\n ensures SequenceNumberRequestInv(r, req)\r\n {\r\n if r !in es.requests_received_this_epoch\r\n {\r\n if |ios| > 0 && ios[0].LIoOpReceive? && LProposerProcessRequest(s.proposer, s'.proposer, ios[0].r)\r\n {\r\n var inp := ios[0].r;\r\n lemma_PacketProcessedImpliesPacketSent(ps, ps', idx, ios, inp);\r\n assert SequenceNumberPacketInv(inp, req);\r\n assert SequenceNumberRequestInv(r, req);\r\n }\r\n else if exists batch :: ElectionStateReflectExecutedRequestBatch(es, es', batch)\r\n {\r\n var batch :| ElectionStateReflectExecutedRequestBatch(es, es', batch);\r\n lemma_RemoveExecutedRequestBatchProducesSubsequence(es'.requests_received_this_epoch, es.requests_received_this_epoch, batch);\r\n assert SequenceNumberRequestInv(r, req);\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n }\r\n }\r\n\r\n forall r | r in es'.requests_received_prev_epochs\r\n ensures SequenceNumberRequestInv(r, req)\r\n {\r\n if r !in es.requests_received_prev_epochs\r\n {\r\n if exists batch :: ElectionStateReflectExecutedRequestBatch(es, es', batch)\r\n {\r\n var batch :| ElectionStateReflectExecutedRequestBatch(es, es', batch);\r\n lemma_RemoveExecutedRequestBatchProducesSubsequence(es'.requests_received_prev_epochs, es.requests_received_prev_epochs, batch);\r\n assert SequenceNumberRequestInv(r, req);\r\n }\r\n assert r in es.requests_received_this_epoch;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_ReplicaNextPreservesSequenceNumberVotesInv(\r\n ps:RslState,\r\n ps':RslState,\r\n idx:int,\r\n ios:seq,\r\n req:Request\r\n )\r\n requires RslNext(ps, ps')\r\n requires req.Request?\r\n requires 0 <= idx < |ps.replicas|\r\n requires RslNextOneReplica(ps, ps', idx, ios)\r\n requires SequenceNumberStateInv(ps, req)\r\n requires LEnvironmentInvariant(ps.environment)\r\n requires ConstantsAllConsistentInv(ps)\r\n requires |ps.constants.config.replica_ids| == |ps.replicas| == |ps'.constants.config.replica_ids| == |ps'.replicas|\r\n requires 0 <= idx < |ps'.replicas|\r\n ensures SequenceNumberVotesInv(ps'.replicas[idx].replica.acceptor.votes, req)\r\n{\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var votes := s.acceptor.votes;\r\n var votes' := s'.acceptor.votes;\r\n var id := ps.constants.config.replica_ids[idx];\r\n\r\n forall op | op in votes'\r\n ensures SequenceNumberBatchInv(votes'[op].max_val, req)\r\n {\r\n if op in votes && votes'[op] == votes[op]\r\n {\r\n assert SequenceNumberBatchInv(votes[op].max_val, req);\r\n }\r\n else\r\n {\r\n assert |ios| >= 1 && ios[0].LIoOpReceive?;\r\n var inp := ios[0].r;\r\n assert LAcceptorProcess2a(s.acceptor, s'.acceptor, inp, ExtractSentPacketsFromIos(ios));\r\n lemma_PacketProcessedImpliesPacketSent(ps, ps', idx, ios, inp);\r\n assert SequenceNumberPacketInv(inp, req);\r\n assert SequenceNumberBatchInv(votes'[op].max_val, req);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_ReplicaNextPreservesSequenceNumberLearnerStateInv(\r\n ps:RslState,\r\n ps':RslState,\r\n idx:int,\r\n ios:seq,\r\n req:Request\r\n )\r\n requires RslNext(ps, ps')\r\n requires req.Request?\r\n requires 0 <= idx < |ps.replicas|\r\n requires RslNextOneReplica(ps, ps', idx, ios)\r\n requires SequenceNumberStateInv(ps, req)\r\n requires LEnvironmentInvariant(ps.environment)\r\n requires ConstantsAllConsistentInv(ps)\r\n requires |ps.constants.config.replica_ids| == |ps.replicas| == |ps'.constants.config.replica_ids| == |ps'.replicas|\r\n requires 0 <= idx < |ps'.replicas|\r\n ensures SequenceNumberLearnerStateInv(ps'.replicas[idx].replica.learner.unexecuted_learner_state, req)\r\n{\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var votes := s.acceptor.votes;\r\n var votes' := s'.acceptor.votes;\r\n var id := ps.constants.config.replica_ids[idx];\r\n\r\n forall op | op in s'.learner.unexecuted_learner_state\r\n ensures SequenceNumberBatchInv(s'.learner.unexecuted_learner_state[op].candidate_learned_value, req)\r\n {\r\n if op in s.learner.unexecuted_learner_state && s'.learner.unexecuted_learner_state[op] == s.learner.unexecuted_learner_state[op]\r\n {\r\n assert SequenceNumberBatchInv(s.learner.unexecuted_learner_state[op].candidate_learned_value, req);\r\n }\r\n else\r\n {\r\n assert |ios| >= 1 && ios[0].LIoOpReceive?;\r\n var inp := ios[0].r;\r\n assert LLearnerProcess2b(s.learner, s'.learner, inp);\r\n lemma_PacketProcessedImpliesPacketSent(ps, ps', idx, ios, inp);\r\n assert SequenceNumberPacketInv(inp, req);\r\n assert SequenceNumberBatchInv(s'.learner.unexecuted_learner_state[op].candidate_learned_value, req);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_ReplicaNextPreservesSequenceNumberReplyCacheInv(\r\n ps:RslState,\r\n ps':RslState,\r\n idx:int,\r\n ios:seq,\r\n req:Request\r\n )\r\n requires RslNext(ps, ps')\r\n requires req.Request?\r\n requires 0 <= idx < |ps.replicas|\r\n requires RslNextOneReplica(ps, ps', idx, ios)\r\n requires SequenceNumberStateInv(ps, req)\r\n requires LEnvironmentInvariant(ps.environment)\r\n requires ConstantsAllConsistentInv(ps)\r\n requires |ps.constants.config.replica_ids| == |ps.replicas| == |ps'.constants.config.replica_ids| == |ps'.replicas|\r\n requires 0 <= idx < |ps'.replicas|\r\n ensures SequenceNumberReplyCacheInv(ps'.replicas[idx].replica.executor.reply_cache, req)\r\n{\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var votes := s.acceptor.votes;\r\n var votes' := s'.acceptor.votes;\r\n var id := ps.constants.config.replica_ids[idx];\r\n\r\n if req.Request? && req.client in s'.executor.reply_cache && s'.executor.reply_cache[req.client].Reply? && s'.executor.reply_cache[req.client].seqno > req.seqno\r\n {\r\n if LReplicaNextSpontaneousMaybeExecute(s, s', ExtractSentPacketsFromIos(ios))\r\n {\r\n var batch := s.executor.next_op_to_execute.v;\r\n var states := HandleRequestBatch(s.executor.app, batch).0;\r\n var replies := HandleRequestBatch(s.executor.app, batch).1;\r\n lemma_HandleRequestBatchTriggerHappy(s.executor.app, batch, states, replies);\r\n\r\n assert SequenceNumberReplyCacheInv(s.executor.reply_cache, req);\r\n var req_idx :| 0 <= req_idx < |batch| && replies[req_idx].client == req.client && s'.executor.reply_cache[req.client] == replies[req_idx];\r\n assert SequenceNumberBatchInv(batch, req);\r\n assert SequenceNumberRequestInv(batch[req_idx], req);\r\n assert false;\r\n }\r\n else if |ios| > 0 && ios[0].LIoOpReceive? && LExecutorProcessAppStateSupply(s.executor, s'.executor, ios[0].r)\r\n {\r\n assert SequenceNumberReplyCacheInv(s'.executor.reply_cache, req);\r\n }\r\n else\r\n {\r\n assert SequenceNumberReplyCacheInv(s'.executor.reply_cache, req);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_ReplicaNextPreservesSequenceNumberReplicaInv(\r\n ps:RslState,\r\n ps':RslState,\r\n idx:int,\r\n ios:seq,\r\n req:Request\r\n )\r\n requires RslNext(ps, ps')\r\n requires req.Request?\r\n requires 0 <= idx < |ps.replicas|\r\n requires RslNextOneReplica(ps, ps', idx, ios)\r\n requires SequenceNumberStateInv(ps, req)\r\n requires LEnvironmentInvariant(ps.environment)\r\n requires ConstantsAllConsistentInv(ps)\r\n requires |ps.constants.config.replica_ids| == |ps.replicas| == |ps'.constants.config.replica_ids| == |ps'.replicas|\r\n requires 0 <= idx < |ps'.replicas|\r\n requires ClientNeverSentHigherSequenceNumberRequest(ps, req)\r\n ensures SequenceNumberReplicaInv(ps'.replicas[idx].replica, req)\r\n{\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n\r\n lemma_ReplicaNextPreservesSequenceNumberRequestQueueInv(ps, ps', idx, ios, req);\r\n lemma_ReplicaNextPreservesSequenceNumberReceived1bPacketsInv(ps, ps', idx, ios, req);\r\n lemma_ReplicaNextPreservesSequenceNumberRequestsReceivedInv(ps, ps', idx, ios, req);\r\n lemma_ReplicaNextPreservesSequenceNumberVotesInv(ps, ps', idx, ios, req);\r\n lemma_ReplicaNextPreservesSequenceNumberLearnerStateInv(ps, ps', idx, ios, req);\r\n assert s'.executor.next_op_to_execute.OutstandingOpKnown? ==> SequenceNumberBatchInv(s'.executor.next_op_to_execute.v, req);\r\n lemma_ReplicaNextPreservesSequenceNumberReplyCacheInv(ps, ps', idx, ios, req);\r\n}\r\n\r\n/////////////////////////////////\r\n// STATE INVARIANT - REPLICA\r\n/////////////////////////////////\r\n\r\nlemma lemma_PaxosNextPreservesSequenceNumberReplicaInv(ps:RslState, ps':RslState, idx:int, req:Request)\r\n requires RslNext(ps, ps')\r\n requires req.Request?\r\n requires SequenceNumberStateInv(ps, req)\r\n requires LEnvironmentInvariant(ps.environment)\r\n requires ConstantsAllConsistentInv(ps)\r\n requires |ps.constants.config.replica_ids| == |ps.replicas| == |ps'.constants.config.replica_ids| == |ps'.replicas|\r\n requires 0 <= idx < |ps'.replicas|\r\n requires ClientNeverSentHigherSequenceNumberRequest(ps, req)\r\n ensures SequenceNumberReplicaInv(ps'.replicas[idx].replica, req)\r\n{\r\n var id := ps.constants.config.replica_ids[idx];\r\n if exists other_index, ios :: RslNextOneReplica(ps, ps', other_index, ios)\r\n {\r\n var other_index, ios :| RslNextOneReplica(ps, ps', other_index, ios);\r\n if other_index != idx\r\n {\r\n assert SequenceNumberReplicaInv(ps.replicas[idx].replica, req);\r\n assert ps'.replicas[idx].replica == ps.replicas[idx].replica;\r\n assert SequenceNumberReplicaInv(ps'.replicas[idx].replica, req);\r\n }\r\n else\r\n {\r\n lemma_ReplicaNextPreservesSequenceNumberReplicaInv(ps, ps', idx, ios, req);\r\n }\r\n }\r\n}\r\n\r\n/////////////////////////////////\r\n// STATE INVARIANT - OVERALL\r\n/////////////////////////////////\r\n\r\nlemma lemma_SequenceNumberStateInvHolds(b:Behavior, asp:AssumptionParameters, i:int)\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n ensures SequenceNumberStateInv(b[i], asp.persistent_request)\r\n{\r\n lemma_LEnvironmentInvariantHolds(b, asp, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n\r\n if i > 0\r\n {\r\n lemma_SequenceNumberStateInvHolds(b, asp, i-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_LEnvironmentInvariantHolds(b, asp, i-1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n\r\n var ps := b[i-1];\r\n var ps' := b[i];\r\n assert RslNext(ps, ps');\r\n forall idx | 0 <= idx < |ps'.replicas|\r\n ensures SequenceNumberReplicaInv(ps'.replicas[idx].replica, asp.persistent_request)\r\n {\r\n TemporalDeduceFromAlways(0, i-1, ClientNeverSentHigherSequenceNumberRequestTemporal(b, asp));\r\n assert sat(i-1, ClientNeverSentHigherSequenceNumberRequestTemporal(b, asp));\r\n assert ClientNeverSentHigherSequenceNumberRequest(ps, asp.persistent_request);\r\n lemma_PaxosNextPreservesSequenceNumberReplicaInv(ps, ps', idx, asp.persistent_request);\r\n }\r\n forall p | p in ps'.environment.sentPackets && p.src in ps.constants.config.replica_ids\r\n ensures SequenceNumberPacketInv(p, asp.persistent_request)\r\n {\r\n if p !in ps.environment.sentPackets\r\n {\r\n var idx, ios := lemma_ActionThatSendsPacketIsActionOfSource(ps, ps', p);\r\n lemma_SequenceNumberPacketInvHolds(ps, ps', idx, ios, p, asp.persistent_request);\r\n }\r\n }\r\n }\r\n}\r\n\r\n///////////////////////////\r\n// USEFUL COROLLARIES\r\n///////////////////////////\r\n\r\nlemma lemma_SequenceNumberReplyCacheInvHolds(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures SequenceNumberReplyCacheInv(b[i].replicas[idx].replica.executor.reply_cache, asp.persistent_request)\r\n{\r\n lemma_SequenceNumberStateInvHolds(b, asp, i);\r\n}\r\n\r\nlemma lemma_RequestNeverHitsInReplyCache(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n i:int,\r\n idx:int,\r\n ios:seq,\r\n inp:RslPacket\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires RslNextOneReplica(b[i], b[i+1], idx, ios)\r\n requires 0 <= idx < |b[i].replicas|\r\n requires 0 <= idx < |b[i+1].replicas|\r\n requires idx in asp.live_quorum\r\n requires inp.src == asp.persistent_request.client\r\n requires inp.msg.RslMessage_Request?\r\n requires inp.msg.seqno_req == asp.persistent_request.seqno\r\n requires inp.msg.val == asp.persistent_request.request\r\n requires processing_sync_start <= i\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires LReplicaNextProcessRequest(b[i].replicas[idx].replica, b[i+1].replicas[idx].replica, inp, ExtractSentPacketsFromIos(ios))\r\n ensures LProposerProcessRequest(b[i].replicas[idx].replica.proposer, b[i+1].replicas[idx].replica.proposer, inp)\r\n ensures ExtractSentPacketsFromIos(ios) == []\r\n ensures b[i+1].replicas[idx].replica == b[i].replicas[idx].replica.(proposer := b[i+1].replicas[idx].replica.proposer)\r\n{\r\n // If we satisfy the postcondition, we're done.\r\n\r\n if && LProposerProcessRequest(b[i].replicas[idx].replica.proposer, b[i+1].replicas[idx].replica.proposer, inp)\r\n && ExtractSentPacketsFromIos(ios) == []\r\n && b[i+1].replicas[idx].replica == b[i].replicas[idx].replica.(proposer := b[i+1].replicas[idx].replica.proposer)\r\n {\r\n return;\r\n }\r\n\r\n // Since we don't satisfy the postcondition, we know that we sent a reply out of\r\n // the reply cache.\r\n\r\n var executor := b[i].replicas[idx].replica.executor;\r\n var reply_cache := executor.reply_cache;\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n assert |inp.msg.val| <= MaxAppRequestSize();\r\n\r\n lemma_SequenceNumberReplyCacheInvHolds(b, asp, i, idx);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n\r\n // From the reply-cache invariant, we know that there can never be a sequence number\r\n // in the reply cache beyond that of the persistent request. Also, the protocol dictates\r\n // that we don't send a reply out of the reply cache that precedes the given request.\r\n // So it must be that the reply we sent out of the reply cache matches this request's\r\n // sequence number.\r\n\r\n assert inp.msg.seqno_req == reply_cache[inp.src].seqno;\r\n lemma_ReplyCacheStateInv(b, asp.c, i, inp.src);\r\n assert reply_cache[inp.src].client == inp.src;\r\n var p := sent_packets[0];\r\n assert LIoOpSend(p) in ios;\r\n\r\n // Since we sent a matching reply out of the reply cache, and we're in the synchronous\r\n // period, the packet must be eventually received by the client. This contradicts\r\n // the assumption that the client never receives a reply. And this contradiction\r\n // completes the proof.\r\n\r\n assert asp.synchrony_start <= i;\r\n assert p.src in SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids) + { asp.persistent_request.client };\r\n assert p.dst in SetOfReplicaIndicesToSetOfHosts(asp.live_quorum, asp.c.config.replica_ids) + { asp.persistent_request.client };\r\n\r\n var delivery_step := lemma_PacketSentEventuallyDelivered(b, asp, i, p);\r\n lemma_ConstantsAllConsistent(b, asp.c, delivery_step);\r\n assert ReplyDeliveredDuringStep(b[delivery_step], asp.persistent_request);\r\n TemporalDeduceFromAlways(0, delivery_step, not(ReplyDeliveredTemporal(b, asp.persistent_request)));\r\n assert false;\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/StablePeriod.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"PacketHandling.i.dfy\"\r\n \r\nmodule LivenessProof__StablePeriod_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Collections__Maps2_s\r\n \r\nfunction CurrentViewOfHost(\r\n ps:RslState,\r\n replica_index:int\r\n ):Ballot\r\n requires 0 <= replica_index < |ps.replicas|\r\n{\r\n ps.replicas[replica_index].replica.proposer.election_state.current_view\r\n}\r\n\r\npredicate StablePeriodStarted(\r\n ps:RslState,\r\n live_quorum:set,\r\n view:Ballot,\r\n ahead_idx:int\r\n )\r\n{\r\n && ahead_idx in live_quorum\r\n && 0 <= ahead_idx < |ps.replicas|\r\n && BalLeq(view, CurrentViewOfHost(ps, ahead_idx))\r\n && view.proposer_id in live_quorum\r\n && (forall idx :: 0 <= idx < |ps.replicas| ==> BalLt(ps.replicas[idx].replica.proposer.max_ballot_i_sent_1a, view))\r\n}\r\n\r\nfunction{:opaque} StablePeriodStartedTemporal(\r\n b:Behavior,\r\n live_quorum:set,\r\n view:Ballot,\r\n ahead_idx:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, StablePeriodStartedTemporal(b, live_quorum, view, ahead_idx))} ::\r\n sat(i, StablePeriodStartedTemporal(b, live_quorum, view, ahead_idx))\r\n <==> StablePeriodStarted(b[i], live_quorum, view, ahead_idx)\r\n{\r\n stepmap(imap i :: StablePeriodStarted(b[i], live_quorum, view, ahead_idx))\r\n}\r\n\r\npredicate NoReplicaBeyondView(\r\n ps:RslState,\r\n view:Ballot\r\n )\r\n{\r\n forall idx :: 0 <= idx < |ps.replicas| ==> BalLeq(CurrentViewOfHost(ps, idx), view)\r\n}\r\n\r\nfunction{:opaque} NoReplicaBeyondViewTemporal(\r\n b:Behavior,\r\n view:Ballot\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, NoReplicaBeyondViewTemporal(b, view))} ::\r\n sat(i, NoReplicaBeyondViewTemporal(b, view)) <==> NoReplicaBeyondView(b[i], view)\r\n{\r\n stepmap(imap i :: NoReplicaBeyondView(b[i], view))\r\n}\r\n\r\npredicate NoMaxBallotISent1aBeyondView(\r\n ps:RslState,\r\n view:Ballot\r\n )\r\n{\r\n forall idx :: 0 <= idx < |ps.replicas| ==> BalLeq(ps.replicas[idx].replica.proposer.max_ballot_i_sent_1a, view)\r\n}\r\n\r\nfunction{:opaque} NoMaxBallotISent1aBeyondViewTemporal(\r\n b:Behavior,\r\n view:Ballot\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, NoMaxBallotISent1aBeyondViewTemporal(b, view))} ::\r\n sat(i, NoMaxBallotISent1aBeyondViewTemporal(b, view)) <==> NoMaxBallotISent1aBeyondView(b[i], view)\r\n{\r\n stepmap(imap i :: NoMaxBallotISent1aBeyondView(b[i], view))\r\n}\r\n\r\npredicate ObjectInFirstNOfSequence(obj:T, s:seq, n:int)\r\n{\r\n if |s| <= n then (obj in s) else (n > 0 && obj in s[..n])\r\n}\r\n\r\npredicate RequestInFirstN(\r\n ps:RslState,\r\n idx:int,\r\n req:Request,\r\n n:int\r\n )\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && ObjectInFirstNOfSequence(req, ps.replicas[idx].replica.proposer.election_state.requests_received_prev_epochs, n)\r\n}\r\n\r\nfunction{:opaque} RequestInFirstNTemporal(\r\n b:Behavior,\r\n idx:int,\r\n req:Request,\r\n n:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, RequestInFirstNTemporal(b, idx, req, n))} ::\r\n sat(i, RequestInFirstNTemporal(b, idx, req, n)) <==> RequestInFirstN(b[i], idx, req, n)\r\n{\r\n stepmap(imap i :: RequestInFirstN(b[i], idx, req, n))\r\n}\r\n\r\npredicate RequestInFirstNOfRequestQueue(\r\n ps:RslState,\r\n idx:int,\r\n req:Request,\r\n n:int\r\n )\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && ObjectInFirstNOfSequence(req, ps.replicas[idx].replica.proposer.request_queue, n)\r\n}\r\n\r\ndatatype Phase2Params = Phase2Params(\r\n start_step:int,\r\n duration:int,\r\n base_duration:int,\r\n per_request_duration:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n log_truncation_point:int,\r\n king_idx:int,\r\n num_requests:int,\r\n ios:seq\r\n )\r\n\r\nfunction TimeToBeginPhase2(asp:AssumptionParameters, processing_bound:int):int\r\n{\r\n processing_bound * 3\r\n}\r\n\r\nfunction TimeToAdvanceOneOperation(asp:AssumptionParameters, processing_bound:int):int\r\n requires asp.host_period > 0\r\n{\r\n asp.c.params.max_batch_delay + asp.max_clock_ambiguity * 4 + asp.c.params.heartbeat_period + TimeToPerformGenericAction(asp) * 6 + processing_bound * 3\r\n}\r\n\r\npredicate Phase2Started(\r\n ps:RslState,\r\n ps':RslState,\r\n asp:AssumptionParameters,\r\n h:Phase2Params\r\n )\r\n{\r\n && 0 <= h.king_idx < |ps'.replicas|\r\n && 0 <= h.view.proposer_id < |ps.replicas|\r\n && 0 <= h.view.proposer_id < |ps'.replicas|\r\n && ps'.replicas[h.king_idx].replica.executor.ops_complete >= h.log_truncation_point\r\n && var s := ps.replicas[h.view.proposer_id].replica;\r\n var s' := ps'.replicas[h.view.proposer_id].replica;\r\n && RslNextOneReplica(ps, ps', h.view.proposer_id, h.ios)\r\n && LProposerMaybeEnterPhase2(s.proposer, s'.proposer, s.acceptor.log_truncation_point, ExtractSentPacketsFromIos(h.ios))\r\n && s.proposer.current_state == 1\r\n && s'.proposer.current_state == 2\r\n && s'.proposer.max_ballot_i_sent_1a == h.view\r\n && s'.proposer.next_operation_number_to_propose == h.log_truncation_point\r\n && ObjectInFirstNOfSequence(asp.persistent_request, s'.proposer.request_queue, h.num_requests)\r\n && s'.acceptor.log_truncation_point == h.log_truncation_point\r\n}\r\n\r\nfunction{:opaque} Phase2StartedTemporal(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, Phase2StartedTemporal(b, asp, h))} ::\r\n sat(i, Phase2StartedTemporal(b, asp, h)) <==>\r\n Phase2Started(b[i], b[nextstep(i)], asp, h);\r\n{\r\n stepmap(imap i :: Phase2Started(b[i], b[nextstep(i)], asp, h))\r\n}\r\n\r\npredicate Phase2StableWithRequest(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params\r\n )\r\n{\r\n && LivenessAssumptions(b, asp)\r\n && asp.synchrony_start <= h.start_step\r\n && PacketProcessingSynchronous(b, asp, h.start_step, h.processing_bound)\r\n && h.base_duration >= 0\r\n && h.per_request_duration >= 0\r\n && h.duration == h.base_duration + h.num_requests * h.per_request_duration\r\n && h.view.proposer_id in asp.live_quorum\r\n && h.king_idx in asp.live_quorum\r\n && h.num_requests > 0\r\n && sat(h.start_step, Phase2StartedTemporal(b, asp, h))\r\n && sat(h.start_step+1, alwayswithin(NoReplicaBeyondViewTemporal(b, h.view), h.duration, PaxosTimeMap(b)))\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/StateTransfer.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"Phase2Invariants.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../CommonProof/PacketSending.i.dfy\"\r\ninclude \"../CommonProof/MaxBallotISent1a.i.dfy\"\r\ninclude \"../CommonProof/Environment.i.dfy\"\r\ninclude \"../CommonProof/Chosen.i.dfy\"\r\ninclude \"../CommonProof/Quorum.i.dfy\"\r\ninclude \"../CommonProof/Received1b.i.dfy\"\r\n\r\nmodule LivenessProof__StateTransfer_i {\r\n\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__MaxBallotISent1a_i\r\nimport opened LivenessProof__Phase2Invariants_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Chosen_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Environment_i\r\nimport opened CommonProof__LogTruncationPoint_i\r\nimport opened CommonProof__MaxBallotISent1a_i\r\nimport opened CommonProof__Message1b_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened CommonProof__Quorum_i\r\nimport opened CommonProof__Received1b_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Rules_i\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\n\r\nlemma lemma_AppStateSupplyImpliesAppStateRequest(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p_state_supply:RslPacket\r\n ) returns (\r\n p_state_req:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p_state_supply in b[i].environment.sentPackets\r\n requires p_state_supply.src in c.config.replica_ids\r\n requires p_state_supply.msg.RslMessage_AppStateSupply?\r\n ensures p_state_req in b[i].environment.sentPackets\r\n ensures p_state_req.src in c.config.replica_ids\r\n ensures p_state_req.src == p_state_supply.dst\r\n ensures p_state_req.msg.RslMessage_AppStateRequest?\r\n ensures BalLeq(p_state_supply.msg.bal_state_supply, p_state_req.msg.bal_state_req)\r\n{\r\n if i == 0 { return; }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n if p_state_supply in b[i-1].environment.sentPackets\r\n {\r\n p_state_req := lemma_AppStateSupplyImpliesAppStateRequest(b, c, i-1, p_state_supply);\r\n lemma_PacketStaysInSentPackets(b, c, i-1, i, p_state_req);\r\n return;\r\n }\r\n\r\n var idx, ios := lemma_ActionThatSendsAppStateSupplyIsProcessAppStateRequest(b[i-1], b[i], p_state_supply);\r\n p_state_req := ios[0].r;\r\n assert IsValidLIoOp(ios[0], c.config.replica_ids[idx], b[i-1].environment);\r\n}\r\n\r\nlemma{:timeLimitMultiplier 2} lemma_StateRequestFromKingPrecedesBallotDuringStableView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int,\r\n p_state_req:RslPacket\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires 0 <= i\r\n requires p_state_req in b[i].environment.sentPackets\r\n requires p_state_req.src == asp.c.config.replica_ids[h.king_idx]\r\n requires p_state_req.msg.RslMessage_AppStateRequest?\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n ensures BalLt(p_state_req.msg.bal_state_req, h.view)\r\n{\r\n if i == 0 { return; }\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n\r\n if p_state_req in b[i-1].environment.sentPackets\r\n {\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, i-1, i, h.view);\r\n lemma_StateRequestFromKingPrecedesBallotDuringStableView(b, asp, h, i-1, p_state_req);\r\n return;\r\n }\r\n\r\n var king_idx, king_ios := lemma_ActionThatSendsAppStateRequestIsProcessStartingPhase2(b[i-1], b[i], p_state_req);\r\n var p_starting_phase2 := king_ios[0].r;\r\n assert ReplicasDistinct(asp.c.config.replica_ids, king_idx, h.king_idx);\r\n assert b[i].replicas[king_idx].replica.executor.ops_complete < p_starting_phase2.msg.logTruncationPoint_2;\r\n\r\n var x := stepmap(imap j :: p_starting_phase2 in b[j].environment.sentPackets);\r\n var next_step := earliestStepBetween(0, i, x);\r\n var step := next_step - 1;\r\n assert !sat(0, x);\r\n assert !sat(step, x);\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, step);\r\n lemma_ConstantsAllConsistent(b, asp.c, next_step);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, step);\r\n \r\n var primary_idx, primary_ios := lemma_ActionThatSendsStartingPhase2IsMaybeEnterPhase2(b[step], b[next_step], p_starting_phase2);\r\n \r\n var s := b[step].replicas[primary_idx].replica.proposer;\r\n var s' := b[next_step].replicas[primary_idx].replica.proposer;\r\n\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, step, i, h.view);\r\n lemma_NoReplicaBeyondViewImpliesNoMaxBallotISent1aBeyondView(b, asp, step, h.view);\r\n assert BalLeq(s.max_ballot_i_sent_1a, h.view);\r\n\r\n if BalLt(s.max_ballot_i_sent_1a, h.view)\r\n {\r\n return;\r\n }\r\n\r\n lemma_MaxBallotISent1aHasMeAsProposer(b, asp.c, step, primary_idx);\r\n\r\n if next_step <= h.start_step\r\n {\r\n lemma_MaxBallotISent1aMonotonic(b, asp.c, next_step, h.start_step, primary_idx);\r\n assert false;\r\n }\r\n\r\n if next_step > h.start_step + 1\r\n {\r\n lemma_MaxBallotISent1aMonotonic(b, asp.c, h.start_step + 1, step, primary_idx);\r\n assert false;\r\n }\r\n\r\n assert p_starting_phase2.msg.logTruncationPoint_2 == h.log_truncation_point;\r\n assert h.start_step + 1 <= i;\r\n lemma_OpsCompleteMonotonic(b, asp.c, h.start_step + 1, i, h.king_idx);\r\n assert false;\r\n}\r\n\r\nlemma lemma_StateSupplyToKingPrecedesBallotDuringStableView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int,\r\n p:RslPacket\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in asp.c.config.replica_ids\r\n requires p.dst == asp.c.config.replica_ids[h.king_idx]\r\n requires p.msg.RslMessage_AppStateSupply?\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n ensures BalLt(p.msg.bal_state_supply, h.view)\r\n{\r\n if i == 0 { return; }\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n lemma_IfNoReplicaBeyondViewNowThenNoReplicaBeyondViewEarlier(b, asp, i-1, i, h.view);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n lemma_StateSupplyToKingPrecedesBallotDuringStableView(b, asp, h, i-1, p);\r\n return;\r\n }\r\n\r\n var idx, ios := lemma_ActionThatSendsAppStateSupplyIsProcessAppStateRequest(b[i-1], b[i], p);\r\n var p_state_req := ios[0].r;\r\n lemma_StateRequestFromKingPrecedesBallotDuringStableView(b, asp, h, i-1, p_state_req);\r\n}\r\n\r\nlemma lemma_QuorumOf1bsFromPhase2StartPrecludesQuorumOf2bsFromEarlierView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int,\r\n q:QuorumOf2bs\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires 0 <= i\r\n requires LAllAcceptorsHadNoProposal(b[h.start_step + 1].replicas[h.view.proposer_id].replica.proposer.received_1b_packets, q.opn)\r\n requires LIsAfterLogTruncationPoint(q.opn, b[h.start_step + 1].replicas[h.view.proposer_id].replica.proposer.received_1b_packets)\r\n requires IsValidQuorumOf2bs(b[i], q)\r\n ensures BalLeq(h.view, q.bal)\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, h.start_step + 1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_Received1bPacketsAreFromMaxBallotISent1a(b, asp.c, h.start_step + 1, h.view.proposer_id);\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, h.start_step, h.view.proposer_id);\r\n \r\n var received_1b_packets := b[h.start_step + 1].replicas[h.view.proposer_id].replica.proposer.received_1b_packets;\r\n var received1b_indices := lemma_GetIndicesFromPackets(received_1b_packets, asp.c.config);\r\n var overlap_idx := lemma_QuorumIndexOverlap(q.indices, received1b_indices, |asp.c.config.replica_ids|);\r\n var packet_1b :| packet_1b in received_1b_packets && packet_1b.src == asp.c.config.replica_ids[overlap_idx];\r\n var packet_2b := q.packets[overlap_idx];\r\n\r\n var later_step := if h.start_step + 1 <= i then i else h.start_step + 1;\r\n lemma_PacketStaysInSentPackets(b, asp.c, h.start_step + 1, later_step, packet_1b);\r\n lemma_PacketStaysInSentPackets(b, asp.c, i, later_step, packet_2b);\r\n \r\n lemma_1bMessageWithoutOpnImplicationsFor2b(b, asp.c, later_step, q.opn, packet_1b, packet_2b);\r\n}\r\n\r\nlemma lemma_StateSupplyToKingDoesNotIncludeOpn(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n h:Phase2Params,\r\n i:int,\r\n opn:OperationNumber,\r\n p:RslPacket\r\n )\r\n requires Phase2StableWithRequest(b, asp, h)\r\n requires 0 <= i\r\n requires 0 <= opn\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in asp.c.config.replica_ids\r\n requires p.dst == asp.c.config.replica_ids[h.king_idx]\r\n requires p.msg.RslMessage_AppStateSupply?\r\n requires LIsAfterLogTruncationPoint(opn, b[h.start_step + 1].replicas[h.view.proposer_id].replica.proposer.received_1b_packets)\r\n requires LAllAcceptorsHadNoProposal(b[h.start_step + 1].replicas[h.view.proposer_id].replica.proposer.received_1b_packets, opn)\r\n requires NoReplicaBeyondView(b[i], h.view)\r\n ensures p.msg.opn_state_supply <= opn\r\n{\r\n lemma_StateSupplyToKingPrecedesBallotDuringStableView(b, asp, h, i, p);\r\n assert BalLt(p.msg.bal_state_supply, h.view);\r\n var qs := lemma_TransferredStateBasedOnChosenOperations(b, asp.c, i, p);\r\n\r\n if p.msg.opn_state_supply > opn\r\n {\r\n var q := qs[opn];\r\n assert BalLeq(q.bal, p.msg.bal_state_supply);\r\n assert BalLt(q.bal, h.view);\r\n\r\n lemma_QuorumOf1bsFromPhase2StartPrecludesQuorumOf2bsFromEarlierView(b, asp, h, i, q);\r\n assert false;\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/ViewAdvance.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"ViewPropagation.i.dfy\"\r\ninclude \"ViewPropagation2.i.dfy\"\r\ninclude \"WF1.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\n\r\nmodule LivenessProof__ViewAdvance_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Election_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__RealTime_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__ViewChange_i\r\nimport opened LivenessProof__ViewPropagation_i\r\nimport opened LivenessProof__ViewPropagation2_i\r\nimport opened LivenessProof__WF1_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Constants_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Temporal__WF1_i\r\nimport opened Environment_s\r\nimport opened Collections__Maps2_s\r\n\r\nfunction TimeForOneReplicaToSendHeartbeat(asp:AssumptionParameters):int\r\n requires asp.host_period > 0\r\n requires asp.max_clock_ambiguity >= 0\r\n requires asp.c.params.heartbeat_period >= 0\r\n ensures TimeForOneReplicaToSendHeartbeat(asp) >= 0\r\n{\r\n asp.max_clock_ambiguity * 2 + asp.c.params.heartbeat_period + TimeToPerformGenericAction(asp)\r\n}\r\n\r\nfunction TimeForOneReplicaToAdvanceAnother(asp:AssumptionParameters, processing_bound:int):int\r\n requires asp.host_period > 0\r\n requires asp.max_clock_ambiguity >= 0\r\n requires asp.c.params.heartbeat_period >= 0\r\n requires processing_bound >= 0\r\n ensures TimeForOneReplicaToAdvanceAnother(asp, processing_bound) >= 0\r\n{\r\n TimeForOneReplicaToSendHeartbeat(asp) + processing_bound\r\n}\r\n\r\npredicate HostReachedView(\r\n ps:RslState,\r\n replica_index:int,\r\n view:Ballot\r\n )\r\n{\r\n 0 <= replica_index < |ps.replicas| && BalLeq(view, CurrentViewOfHost(ps, replica_index))\r\n}\r\n\r\nfunction{:opaque} HostReachedViewTemporal(b:Behavior, replica_index:int, view:Ballot):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, HostReachedViewTemporal(b, replica_index, view))} ::\r\n sat(i, HostReachedViewTemporal(b, replica_index, view)) <==> HostReachedView(b[i], replica_index, view)\r\n{\r\n stepmap(imap i :: HostReachedView(b[i], replica_index, view))\r\n}\r\n\r\npredicate NextHeartbeatTimeInv(ps:RslState, idx:int, max_clock_ambiguity:int)\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && ps.replicas[idx].replica.nextHeartbeatTime <= ps.environment.time + max_clock_ambiguity + ps.constants.params.heartbeat_period\r\n}\r\n\r\npredicate ReplicaHasSpecificNextHeartbeatTime(\r\n ps:RslState,\r\n replica_index:int,\r\n nextHeartbeatTime:int\r\n )\r\n{\r\n && 0 <= replica_index < |ps.replicas|\r\n && ps.replicas[replica_index].replica.nextHeartbeatTime == nextHeartbeatTime\r\n}\r\n\r\nfunction{:opaque} ReplicaHasSpecificNextHeartbeatTimeTemporal(\r\n b:Behavior,\r\n replica_index:int,\r\n nextHeartbeatTime:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, ReplicaHasSpecificNextHeartbeatTimeTemporal(b, replica_index, nextHeartbeatTime))} ::\r\n sat(i, ReplicaHasSpecificNextHeartbeatTimeTemporal(b, replica_index, nextHeartbeatTime)) <==>\r\n ReplicaHasSpecificNextHeartbeatTime(b[i], replica_index, nextHeartbeatTime)\r\n{\r\n stepmap(imap i :: ReplicaHasSpecificNextHeartbeatTime(b[i], replica_index, nextHeartbeatTime))\r\n}\r\n\r\n\r\npredicate ReplicaSentHeartbeat(\r\n ps:RslState,\r\n ps':RslState,\r\n sender_idx:int,\r\n receiver_idx:int,\r\n p:RslPacket\r\n )\r\n{\r\n && 0 <= receiver_idx < |ps.constants.config.replica_ids|\r\n && 0 <= sender_idx < |ps.constants.config.replica_ids|\r\n && 0 <= sender_idx < |ps.replicas|\r\n && p.dst == ps.constants.config.replica_ids[receiver_idx]\r\n && p.src == ps.constants.config.replica_ids[sender_idx]\r\n && p.msg.RslMessage_Heartbeat?\r\n && p.msg.bal_heartbeat == ps.replicas[sender_idx].replica.proposer.election_state.current_view\r\n && ps.environment.nextStep.LEnvStepHostIos?\r\n && ps.environment.nextStep.actor == p.src\r\n && LIoOpSend(p) in ps.environment.nextStep.ios\r\n && RslNext(ps, ps')\r\n && RslNextOneReplica(ps, ps', sender_idx, ps.environment.nextStep.ios)\r\n}\r\n\r\nfunction{:opaque} ReplicaSentHeartbeatTemporal(\r\n b:Behavior,\r\n sender_idx:int,\r\n receiver_idx:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, ReplicaSentHeartbeatTemporal(b, sender_idx, receiver_idx))} ::\r\n sat(i, ReplicaSentHeartbeatTemporal(b, sender_idx, receiver_idx)) <==>\r\n exists p {:trigger ReplicaSentHeartbeat(b[i], b[nextstep(i)], sender_idx, receiver_idx, p)} ::\r\n ReplicaSentHeartbeat(b[i], b[nextstep(i)], sender_idx, receiver_idx, p)\r\n{\r\n stepmap(imap i :: exists p {:trigger ReplicaSentHeartbeat(b[i], b[nextstep(i)], sender_idx, receiver_idx, p)} :: ReplicaSentHeartbeat(b[i], b[nextstep(i)], sender_idx, receiver_idx, p))\r\n}\r\n \r\nlemma lemma_NextHeartbeatTimeInv(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires idx in asp.live_quorum\r\n ensures NextHeartbeatTimeInv(b[i], idx, asp.max_clock_ambiguity)\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n\r\n if i > 0\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n lemma_TimeAdvancesBetween(b, asp, i-1, i);\r\n lemma_NextHeartbeatTimeInv(b, asp, i-1, idx);\r\n var ps := b[i-1];\r\n var ps' := b[i];\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n if !NextHeartbeatTimeInv(b[i], idx, asp.max_clock_ambiguity)\r\n {\r\n assert s'.nextHeartbeatTime > s.nextHeartbeatTime;\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i-1, idx);\r\n lemma_ClockAmbiguityLimitApplies(b, asp, i-1, idx, ios[0]);\r\n assert false;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_ReplicaEventuallySendsHeartbeatForViewWithinWF1Req1(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n sender_idx:int,\r\n receiver_idx:int,\r\n start_step:int,\r\n nextHeartbeatTime:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires sender_idx in asp.live_quorum\r\n requires 0 <= receiver_idx < |asp.c.config.replica_ids|\r\n requires 0 <= start_step\r\n ensures var P := ReplicaHasSpecificNextHeartbeatTimeTemporal(b, sender_idx, nextHeartbeatTime);\r\n var Q := ReplicaSentHeartbeatTemporal(b, sender_idx, receiver_idx);\r\n sat(start_step, always(imply(P, or(Q, next(P)))))\r\n{\r\n var P := ReplicaHasSpecificNextHeartbeatTimeTemporal(b, sender_idx, nextHeartbeatTime);\r\n var Q := ReplicaSentHeartbeatTemporal(b, sender_idx, receiver_idx);\r\n var t := imply(P, or(Q, next(P)));\r\n\r\n forall i | start_step <= i\r\n ensures sat(i, t)\r\n {\r\n if sat(i, P) && !sat(i, Q) && !sat(i+1, P)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n\r\n var ps := b[i];\r\n var ps' := b[i+1];\r\n var s := ps.replicas[sender_idx].replica;\r\n var s' := ps'.replicas[sender_idx].replica;\r\n var es := s.proposer.election_state;\r\n assert s'.nextHeartbeatTime != s.nextHeartbeatTime;\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, sender_idx);\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n assert |ios| > 0;\r\n assert ios[0].LIoOpReadClock?;\r\n assert LReplicaNextReadClockMaybeSendHeartbeat(s, s', SpontaneousClock(ios), sent_packets);\r\n assert ios[0].t >= s.nextHeartbeatTime;\r\n var p := LPacket(ps.constants.config.replica_ids[receiver_idx],\r\n ps.constants.config.replica_ids[sender_idx],\r\n RslMessage_Heartbeat(es.current_view, es.constants.my_index in es.current_view_suspectors, s.executor.ops_complete));\r\n assert p in sent_packets;\r\n assert p in ps'.environment.sentPackets;\r\n assert ReplicaSentHeartbeat(ps, ps', sender_idx, receiver_idx, p);\r\n assert false;\r\n }\r\n }\r\n\r\n TemporalAlways(start_step, t);\r\n}\r\n\r\nlemma lemma_ReplicaEventuallySendsHeartbeatForViewWithinWF1Req2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n sender_idx:int,\r\n receiver_idx:int,\r\n start_step:int,\r\n nextHeartbeatTime:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires sender_idx in asp.live_quorum\r\n requires 0 <= receiver_idx < |asp.c.config.replica_ids|\r\n requires 0 <= start_step\r\n ensures var P := ReplicaHasSpecificNextHeartbeatTimeTemporal(b, sender_idx, nextHeartbeatTime);\r\n var Q := ReplicaSentHeartbeatTemporal(b, sender_idx, receiver_idx);\r\n var Action := ReplicaSchedule(b, sender_idx)[9];\r\n sat(start_step, always(TemporalWF1RealTimeDelayedImmediateQReq2(P, Q, Action, nextHeartbeatTime + asp.max_clock_ambiguity, PaxosTimeMap(b))))\r\n{\r\n var P := ReplicaHasSpecificNextHeartbeatTimeTemporal(b, sender_idx, nextHeartbeatTime);\r\n var Q := ReplicaSentHeartbeatTemporal(b, sender_idx, receiver_idx);\r\n var Action := ReplicaSchedule(b, sender_idx)[9];\r\n var t := TemporalWF1RealTimeDelayedImmediateQReq2(P, Q, Action, nextHeartbeatTime + asp.max_clock_ambiguity, PaxosTimeMap(b));\r\n\r\n forall i | start_step <= i\r\n ensures sat(i, t)\r\n {\r\n if sat(i, P) && sat(i, nextafter(Action, nextHeartbeatTime + asp.max_clock_ambiguity, PaxosTimeMap(b))) && !sat(i, Q)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n assert SpecificClockReadingRslActionOccurs(b[i], b[i+1], LReplicaNextReadClockMaybeSendHeartbeat, sender_idx);\r\n var ios:seq :| && RslNextOneReplica(b[i], b[i+1], sender_idx, ios)\r\n && SpontaneousIos(ios, 1)\r\n && LReplicaNextReadClockMaybeSendHeartbeat(b[i].replicas[sender_idx].replica,\r\n b[i+1].replicas[sender_idx].replica,\r\n SpontaneousClock(ios), ExtractSentPacketsFromIos(ios));\r\n lemma_ClockAmbiguityLimitApplies(b, asp, i, sender_idx, ios[0]);\r\n calc {\r\n ios[0].t;\r\n >= b[i+1].environment.time - asp.max_clock_ambiguity;\r\n >= nextHeartbeatTime;\r\n }\r\n var ps := b[i];\r\n var ps' := b[i+1];\r\n var s := ps.replicas[sender_idx].replica;\r\n var s' := ps'.replicas[sender_idx].replica;\r\n var es := s.proposer.election_state;\r\n var p := LPacket(ps.constants.config.replica_ids[receiver_idx],\r\n ps.constants.config.replica_ids[sender_idx],\r\n RslMessage_Heartbeat(es.current_view, es.constants.my_index in es.current_view_suspectors, s.executor.ops_complete));\r\n assert p in ExtractSentPacketsFromIos(ios);\r\n assert p in ps'.environment.sentPackets;\r\n assert ReplicaSentHeartbeat(ps, ps', sender_idx, receiver_idx, p);\r\n assert false;\r\n }\r\n }\r\n\r\n TemporalAlways(start_step, t);\r\n}\r\n\r\nlemma lemma_ReplicaEventuallySendsHeartbeatForViewWithin(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n sender_idx:int,\r\n receiver_idx:int,\r\n start_step:int\r\n ) returns (\r\n step:int,\r\n p:RslPacket\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires 0 <= processing_sync_start <= start_step\r\n requires sender_idx in asp.live_quorum\r\n requires receiver_idx in asp.live_quorum\r\n ensures start_step <= step\r\n ensures ReplicaSentHeartbeat(b[step], b[step+1], sender_idx, receiver_idx, p)\r\n ensures b[step+1].environment.time <= b[start_step].environment.time + TimeForOneReplicaToSendHeartbeat(asp)\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, start_step);\r\n var nextHeartbeatTime := b[start_step].replicas[sender_idx].replica.nextHeartbeatTime;\r\n var P := ReplicaHasSpecificNextHeartbeatTimeTemporal(b, sender_idx, nextHeartbeatTime);\r\n var Q := ReplicaSentHeartbeatTemporal(b, sender_idx, receiver_idx);\r\n var Action := ReplicaSchedule(b, sender_idx)[9];\r\n var span := TimeToPerformGenericAction(asp);\r\n var timefun := PaxosTimeMap(b);\r\n\r\n lemma_ReplicaEventuallySendsHeartbeatForViewWithinWF1Req1(b, asp, sender_idx, receiver_idx, start_step, nextHeartbeatTime);\r\n lemma_ReplicaEventuallySendsHeartbeatForViewWithinWF1Req2(b, asp, sender_idx, receiver_idx, start_step, nextHeartbeatTime);\r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, sender_idx, 9);\r\n lemma_EstablishRequirementsForWF1RealTimeDelayed(b, asp, start_step, Action, span);\r\n assume TimeNotZeno(timefun);\r\n step := TemporalWF1RealTimeDelayedImmediateQ(start_step, P, Q, Action, span, nextHeartbeatTime + asp.max_clock_ambiguity, timefun);\r\n assert start_step <= step;\r\n p :| ReplicaSentHeartbeat(b[step], b[step+1], sender_idx, receiver_idx, p);\r\n lemma_NextHeartbeatTimeInv(b, asp, start_step, sender_idx);\r\n lemma_ConstantsAllConsistent(b, asp.c, step);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, step);\r\n lemma_ClockAmbiguityLimitApplies(b, asp, step, sender_idx, b[step].environment.nextStep.ios[0]);\r\n}\r\n\r\nlemma lemma_ProcessingHeartbeatBringsViewUp(\r\n ps:RslState,\r\n ps':RslState,\r\n p:RslPacket,\r\n idx:int,\r\n ios:seq\r\n )\r\n requires PacketProcessedViaIos(ps, ps', p, idx, ios)\r\n requires p.msg.RslMessage_Heartbeat?\r\n requires p.src in ps.replicas[idx].replica.proposer.election_state.constants.all.config.replica_ids\r\n ensures BalLeq(p.msg.bal_heartbeat, ps'.replicas[idx].replica.proposer.election_state.current_view)\r\n{\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n assert LProposerProcessHeartbeat(s.proposer, s'.proposer, p, ios[1].t);\r\n assert ElectionStateProcessHeartbeat(es, es', p, ios[1].t);\r\n lemma_BalLtProperties();\r\n}\r\n \r\nlemma lemma_OneLiveReplicaSoonAdvancesAnother(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n start_step:int,\r\n ahead_idx:int,\r\n moved_idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires 0 <= processing_sync_start <= start_step\r\n requires ahead_idx in asp.live_quorum\r\n requires moved_idx in asp.live_quorum\r\n ensures 0 <= ahead_idx < |b[start_step].replicas|\r\n ensures 0 <= moved_idx < |b[step].replicas|\r\n ensures start_step <= step\r\n ensures BalLeq(CurrentViewOfHost(b[start_step], ahead_idx), CurrentViewOfHost(b[step], moved_idx))\r\n ensures b[step].environment.time <= b[start_step].environment.time + TimeForOneReplicaToAdvanceAnother(asp, processing_bound)\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, start_step);\r\n var nextHeartbeatTime := b[start_step].replicas[ahead_idx].replica.nextHeartbeatTime;\r\n var send_step, p := lemma_ReplicaEventuallySendsHeartbeatForViewWithin(b, asp, processing_sync_start, processing_bound, ahead_idx, moved_idx, start_step);\r\n lemma_ConstantsAllConsistent(b, asp.c, send_step);\r\n var view := CurrentViewOfHost(b[send_step], ahead_idx);\r\n lemma_ViewOfHostMonotonic(b, asp, ahead_idx, start_step, send_step);\r\n var s := b[send_step].replicas[ahead_idx].replica;\r\n assert BalLeq(CurrentViewOfHost(b[start_step], ahead_idx), view);\r\n assert p.msg.bal_heartbeat == view;\r\n var processing_step, ios := lemma_PacketSentToIndexProcessedByIt(b, asp, processing_sync_start, processing_bound, send_step, moved_idx, p);\r\n lemma_ConstantsAllConsistent(b, asp.c, processing_step);\r\n lemma_ProcessingHeartbeatBringsViewUp(b[processing_step], b[processing_step+1], p, moved_idx, ios);\r\n lemma_BalLtProperties();\r\n step := processing_step + 1;\r\n}\r\n\r\nlemma lemma_OneLiveReplicaSoonAdvancesAnotherForever(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n start_step:int,\r\n ahead_idx:int,\r\n moved_idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires 0 <= processing_sync_start <= start_step\r\n requires ahead_idx in asp.live_quorum\r\n requires moved_idx in asp.live_quorum\r\n ensures 0 <= ahead_idx < |b[start_step].replicas|\r\n ensures 0 <= moved_idx < |b[step].replicas|\r\n ensures BalLeq(CurrentViewOfHost(b[start_step], ahead_idx), CurrentViewOfHost(b[step], moved_idx))\r\n ensures start_step <= step\r\n ensures b[step].environment.time <= b[start_step].environment.time + TimeForOneReplicaToAdvanceAnother(asp, processing_bound)\r\n ensures sat(step, always(HostReachedViewTemporal(b, moved_idx, CurrentViewOfHost(b[start_step], ahead_idx))))\r\n{\r\n step := lemma_OneLiveReplicaSoonAdvancesAnother(b, asp, processing_sync_start, processing_bound, start_step, ahead_idx, moved_idx);\r\n forall j | step <= j\r\n ensures sat(j, HostReachedViewTemporal(b, moved_idx, CurrentViewOfHost(b[start_step], ahead_idx)))\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, j);\r\n lemma_ViewOfHostMonotonic(b, asp, moved_idx, step, j);\r\n }\r\n TemporalAlways(step, HostReachedViewTemporal(b, moved_idx, CurrentViewOfHost(b[start_step], ahead_idx)));\r\n}\r\n\r\nlemma lemma_OneLiveReplicaSoonAdvancesSomeForever(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n start_step:int,\r\n ahead_idx:int,\r\n moved_indices:set\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires 0 <= processing_sync_start <= start_step\r\n requires ahead_idx in asp.live_quorum\r\n requires moved_indices <= asp.live_quorum\r\n ensures 0 <= ahead_idx < |b[start_step].replicas|\r\n ensures start_step <= step\r\n ensures forall moved_idx :: moved_idx in moved_indices\r\n ==> sat(step, always(HostReachedViewTemporal(b, moved_idx, CurrentViewOfHost(b[start_step], ahead_idx))))\r\n ensures b[step].environment.time <= b[start_step].environment.time + TimeForOneReplicaToAdvanceAnother(asp, processing_bound)\r\n decreases |moved_indices|\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, start_step);\r\n if |moved_indices| == 0\r\n {\r\n step := start_step;\r\n }\r\n else\r\n {\r\n var moved_idx :| moved_idx in moved_indices;\r\n var other_indices := moved_indices - {moved_idx};\r\n var first_step := lemma_OneLiveReplicaSoonAdvancesSomeForever(b, asp, processing_sync_start, processing_bound, start_step, ahead_idx, other_indices);\r\n var second_step := lemma_OneLiveReplicaSoonAdvancesAnotherForever(b, asp, processing_sync_start, processing_bound, start_step, ahead_idx, moved_idx);\r\n var view := CurrentViewOfHost(b[start_step], ahead_idx);\r\n if second_step >= first_step\r\n {\r\n step := second_step;\r\n forall midx | midx in moved_indices\r\n ensures sat(step, always(HostReachedViewTemporal(b, midx, view)))\r\n {\r\n if midx != moved_idx\r\n {\r\n Lemma_AlwaysImpliesLaterAlways(first_step, step, HostReachedViewTemporal(b, midx, view));\r\n }\r\n }\r\n }\r\n else\r\n {\r\n step := first_step;\r\n forall midx | midx in moved_indices\r\n ensures sat(step, always(HostReachedViewTemporal(b, midx, view)))\r\n {\r\n if midx == moved_idx\r\n {\r\n Lemma_AlwaysImpliesLaterAlways(second_step, step, HostReachedViewTemporal(b, midx, view));\r\n }\r\n }\r\n }\r\n }\r\n}\r\n \r\nlemma lemma_OneLiveReplicaSoonAdvancesAllForever(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n start_step:int,\r\n ahead_idx:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires 0 <= processing_sync_start <= start_step\r\n requires ahead_idx in asp.live_quorum\r\n ensures 0 <= ahead_idx < |b[start_step].replicas|\r\n ensures start_step <= step\r\n ensures forall moved_idx :: moved_idx in asp.live_quorum\r\n ==> sat(step, always(HostReachedViewTemporal(b, moved_idx, CurrentViewOfHost(b[start_step], ahead_idx))))\r\n ensures b[step].environment.time <= b[start_step].environment.time + TimeForOneReplicaToAdvanceAnother(asp, processing_bound)\r\n{\r\n step := lemma_OneLiveReplicaSoonAdvancesSomeForever(b, asp, processing_sync_start, processing_bound, start_step, ahead_idx, asp.live_quorum);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/ViewChange.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"RequestsReceived.i.dfy\"\r\ninclude \"RoundRobin.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"WF1.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\n\r\nmodule LivenessProof__ViewChange_i {\r\n\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Election_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__RequestsReceived_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__WF1_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Actions_i\r\nimport opened Temporal__LeadsTo_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__WF1_i\r\nimport opened Collections__Maps2_s\r\nimport opened Common__UpperBound_s\r\n\r\ndatatype ViewPlus = ViewPlus(view:Ballot, suspected:bool)\r\n\r\npredicate ViewPlusLt(vp1:ViewPlus, vp2:ViewPlus)\r\n{\r\n BalLt(vp1.view, vp2.view) || (vp1.view == vp2.view && !vp1.suspected && vp2.suspected)\r\n}\r\n\r\npredicate ViewPlusLe(vp1:ViewPlus, vp2:ViewPlus)\r\n{\r\n BalLt(vp1.view, vp2.view) || (vp1.view == vp2.view && (vp1.suspected ==> vp2.suspected))\r\n}\r\n\r\nfunction CurrentViewPlusOfHost(\r\n ps:RslState,\r\n replica_index:int\r\n ):ViewPlus\r\n requires 0 <= replica_index < |ps.replicas|\r\n{\r\n var es := ps.replicas[replica_index].replica.proposer.election_state;\r\n ViewPlus(es.current_view, es.constants.my_index in es.current_view_suspectors)\r\n}\r\n\r\npredicate HostInView(\r\n ps:RslState,\r\n replica_index:int,\r\n view:Ballot\r\n )\r\n{\r\n 0 <= replica_index < |ps.replicas| && CurrentViewOfHost(ps, replica_index) == view\r\n}\r\n\r\nfunction{:opaque} HostInViewTemporal(b:Behavior, replica_index:int, view:Ballot):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, HostInViewTemporal(b, replica_index, view))} ::\r\n sat(i, HostInViewTemporal(b, replica_index, view)) <==> HostInView(b[i], replica_index, view)\r\n{\r\n stepmap(imap i :: HostInView(b[i], replica_index, view))\r\n}\r\n\r\npredicate HostSuspectsOrInLaterView(\r\n ps:RslState,\r\n replica_index:int,\r\n view:Ballot\r\n )\r\n{\r\n && 0 <= replica_index < |ps.replicas|\r\n && ViewPlusLe(ViewPlus(view, true), CurrentViewPlusOfHost(ps, replica_index))\r\n}\r\n\r\nfunction{:opaque} HostSuspectsOrInLaterViewTemporal(b:Behavior, replica_index:int, view:Ballot):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, HostSuspectsOrInLaterViewTemporal(b, replica_index, view))} ::\r\n sat(i, HostSuspectsOrInLaterViewTemporal(b, replica_index, view)) <==> HostSuspectsOrInLaterView(b[i], replica_index, view)\r\n{\r\n stepmap(imap i :: HostSuspectsOrInLaterView(b[i], replica_index, view))\r\n}\r\n\r\npredicate HostReadyToSuspectView(\r\n ps:RslState,\r\n idx:int,\r\n view:Ballot,\r\n req:Request,\r\n epoch_end_time:int\r\n )\r\n{\r\n && 0 <= idx < |ps.replicas|\r\n && var es := ps.replicas[idx].replica.proposer.election_state;\r\n && es.current_view == view\r\n && !(es.constants.my_index in es.current_view_suspectors)\r\n && es.epoch_end_time == epoch_end_time\r\n && req in es.requests_received_prev_epochs\r\n}\r\n\r\nfunction{:opaque} HostReadyToSuspectViewTemporal(\r\n b:Behavior,\r\n idx:int,\r\n view:Ballot,\r\n req:Request,\r\n epoch_end_time:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, HostReadyToSuspectViewTemporal(b, idx, view, req, epoch_end_time))} ::\r\n sat(i, HostReadyToSuspectViewTemporal(b, idx, view, req, epoch_end_time))\r\n <==> HostReadyToSuspectView(b[i], idx, view, req, epoch_end_time)\r\n{\r\n stepmap(imap i :: HostReadyToSuspectView(b[i], idx, view, req, epoch_end_time))\r\n}\r\n\r\n\r\nlemma lemma_ViewPlusLeTransitive(vp1:ViewPlus, vp2:ViewPlus, vp3:ViewPlus)\r\n ensures ViewPlusLe(vp1, vp2) && ViewPlusLe(vp2, vp3) ==> ViewPlusLe(vp1, vp3)\r\n{\r\n lemma_BalLtProperties();\r\n}\r\n\r\nlemma lemma_ViewPlusLeTransitiveDefinite(vp1:ViewPlus, vp2:ViewPlus, vp3:ViewPlus)\r\n requires ViewPlusLe(vp1, vp2)\r\n requires ViewPlusLe(vp2, vp3)\r\n ensures ViewPlusLe(vp1, vp3)\r\n{\r\n lemma_ViewPlusLeTransitive(vp1, vp2, vp3);\r\n}\r\n\r\nlemma lemma_ComputeSuccessorViewStrictlyIncreases(view:Ballot, constants:LConstants)\r\n requires LtUpperBound(view.seqno, constants.params.max_integer_val)\r\n ensures BalLt(view, ComputeSuccessorView(view, constants))\r\n{\r\n lemma_BalLtProperties();\r\n}\r\n\r\nlemma lemma_ViewPlusOfHostMonotonic(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n idx:int,\r\n i:int,\r\n j:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i <= j\r\n requires 0 <= idx < |asp.c.config.replica_ids|\r\n ensures 0 <= idx < |b[i].replicas|\r\n ensures 0 <= idx < |b[j].replicas|\r\n ensures ViewPlusLe(CurrentViewPlusOfHost(b[i], idx), CurrentViewPlusOfHost(b[j], idx))\r\n decreases j-i\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, j);\r\n lemma_BalLtProperties();\r\n\r\n var vp1 := CurrentViewPlusOfHost(b[i], idx);\r\n var vp2 := CurrentViewPlusOfHost(b[j], idx);\r\n \r\n if j == i + 1\r\n {\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n if !ViewPlusLe(vp1, vp2)\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, idx);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, i, idx);\r\n assert false;\r\n }\r\n }\r\n else if j > i + 1\r\n {\r\n lemma_ViewPlusOfHostMonotonic(b, asp, idx, i, i+1);\r\n lemma_ViewPlusOfHostMonotonic(b, asp, idx, i+1, j);\r\n lemma_ViewPlusLeTransitive(vp1, CurrentViewPlusOfHost(b[i+1], idx), vp2);\r\n }\r\n}\r\n\r\nlemma lemma_ViewOfHostMonotonic(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n idx:int,\r\n i:int,\r\n j:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i <= j\r\n requires 0 <= idx < |asp.c.config.replica_ids|\r\n ensures 0 <= idx < |b[i].replicas|\r\n ensures 0 <= idx < |b[j].replicas|\r\n ensures BalLeq(CurrentViewOfHost(b[i], idx), CurrentViewOfHost(b[j], idx))\r\n{\r\n lemma_ViewPlusOfHostMonotonic(b, asp, idx, i, j);\r\n}\r\n\r\nlemma lemma_HostReadyToSuspectViewEventuallyDoesWF1Req1(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n idx:int,\r\n view:Ballot,\r\n epoch_end_time:int,\r\n start_step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires idx in asp.live_quorum\r\n requires 0 <= start_step\r\n requires sat(start_step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n ensures var P := HostReadyToSuspectViewTemporal(b, idx, view, asp.persistent_request, epoch_end_time);\r\n var Q := HostSuspectsOrInLaterViewTemporal(b, idx, view);\r\n sat(start_step, always(TemporalWF1Req1(P, Q)))\r\n{\r\n var P := HostReadyToSuspectViewTemporal(b, idx, view, asp.persistent_request, epoch_end_time);\r\n var Q := HostSuspectsOrInLaterViewTemporal(b, idx, view);\r\n\r\n forall i | start_step <= i\r\n ensures sat(i, TemporalWF1Req1(P, Q))\r\n {\r\n if sat(i, P) && !sat(i, Q) && !sat(i+1, P) && !sat(i+1, Q)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, idx);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, i, idx);\r\n TemporalDeduceFromAlways(start_step, i+1, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx));\r\n assert false;\r\n }\r\n }\r\n\r\n TemporalAlways(start_step, TemporalWF1Req1(P, Q));\r\n}\r\n\r\nlemma lemma_HostReadyToSuspectViewEventuallyDoesWF1Req2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n idx:int,\r\n view:Ballot,\r\n epoch_end_time:int,\r\n start_step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires idx in asp.live_quorum\r\n requires asp.synchrony_start <= start_step\r\n requires sat(start_step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n ensures var P := HostReadyToSuspectViewTemporal(b, idx, view, asp.persistent_request, epoch_end_time);\r\n var Q := HostSuspectsOrInLaterViewTemporal(b, idx, view);\r\n var Action := ReplicaSchedule(b, idx)[7];\r\n sat(start_step, always(TemporalWF1RealTimeDelayedReq2(P, Q, Action, epoch_end_time + asp.max_clock_ambiguity, PaxosTimeMap(b))))\r\n{\r\n var epochEndTimePlus := epoch_end_time + asp.max_clock_ambiguity;\r\n var P := HostReadyToSuspectViewTemporal(b, idx, view, asp.persistent_request, epoch_end_time);\r\n var Q := HostSuspectsOrInLaterViewTemporal(b, idx, view);\r\n var Action := ReplicaSchedule(b, idx)[7];\r\n var x := TemporalWF1RealTimeDelayedReq2(P, Q, Action, epochEndTimePlus, PaxosTimeMap(b));\r\n\r\n forall i | start_step <= i\r\n ensures sat(i, x)\r\n {\r\n if sat(i, P) && sat(i, nextafter(Action, epochEndTimePlus, PaxosTimeMap(b))) && !sat(i, Q) && !sat(i+1, Q)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n assert SpecificClockReadingRslActionOccurs(b[i], b[i+1], LReplicaNextReadClockCheckForViewTimeout, idx);\r\n var ios:seq :| && RslNextOneReplica(b[i], b[i+1], idx, ios)\r\n && SpontaneousIos(ios, 1)\r\n && LReplicaNextReadClockCheckForViewTimeout(b[i].replicas[idx].replica, b[i+1].replicas[idx].replica,\r\n SpontaneousClock(ios), ExtractSentPacketsFromIos(ios));\r\n lemma_ClockAmbiguityLimitApplies(b, asp, i, idx, ios[0]);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, i, idx);\r\n var es := b[i].replicas[idx].replica.proposer.election_state;\r\n var es' := b[i+1].replicas[idx].replica.proposer.election_state;\r\n assert ElectionStateCheckForViewTimeout(es, es', ios[0].t);\r\n assert es' == es.(current_view_suspectors := es.current_view_suspectors + {es.constants.my_index},\r\n epoch_end_time := UpperBoundedAddition(ios[0].t, es.epoch_length, es.constants.all.params.max_integer_val),\r\n requests_received_prev_epochs := BoundRequestSequence(es.requests_received_prev_epochs + es.requests_received_this_epoch, es.constants.all.params.max_integer_val),\r\n requests_received_this_epoch := []);\r\n assert false;\r\n }\r\n }\r\n\r\n TemporalAlways(start_step, x);\r\n}\r\n\r\nlemma lemma_HostReadyToSuspectViewEventuallyDoes(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n idx:int,\r\n view:Ballot,\r\n epoch_end_time:int,\r\n start_step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires idx in asp.live_quorum\r\n requires asp.synchrony_start <= start_step\r\n requires sat(start_step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n ensures var P := HostReadyToSuspectViewTemporal(b, idx, view, asp.persistent_request, epoch_end_time);\r\n var Q := HostSuspectsOrInLaterViewTemporal(b, idx, view);\r\n sat(start_step, leadsto(P, Q))\r\n{\r\n var epochEndTimePlus := epoch_end_time + asp.max_clock_ambiguity;\r\n var P := HostReadyToSuspectViewTemporal(b, idx, view, asp.persistent_request, epoch_end_time);\r\n var Q := HostSuspectsOrInLaterViewTemporal(b, idx, view);\r\n var Action := ReplicaSchedule(b, idx)[7];\r\n\r\n forall i | start_step <= i\r\n ensures sat(i, imply(P, eventual(Q)))\r\n {\r\n if sat(i, P)\r\n {\r\n Lemma_AlwaysImpliesLaterAlways(start_step, i, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx));\r\n lemma_HostReadyToSuspectViewEventuallyDoesWF1Req1(b, asp, idx, view, epoch_end_time, i);\r\n lemma_HostReadyToSuspectViewEventuallyDoesWF1Req2(b, asp, idx, view, epoch_end_time, i);\r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, idx, 7);\r\n lemma_EstablishRequirementsForWF1RealTimeDelayed(b, asp, i, Action, TimeToPerformGenericAction(asp));\r\n var step := TemporalWF1RealTimeDelayed(i, P, Q, Action, TimeToPerformGenericAction(asp), epochEndTimePlus, PaxosTimeMap(b));\r\n TemporalEventually(i, step, Q);\r\n }\r\n }\r\n TemporalAlways(start_step, imply(P, eventual(Q)));\r\n}\r\n\r\nlemma lemma_ReplicaEventuallySuspectsViewOrIsInDifferentView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n idx:int,\r\n start_step:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires idx in asp.live_quorum\r\n requires processing_sync_start <= start_step\r\n requires 0 <= idx < |b[start_step].replicas|\r\n ensures start_step <= step\r\n ensures HostSuspectsOrInLaterView(b[step], idx, CurrentViewOfHost(b[start_step], idx))\r\n ensures sat(step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)))\r\n{\r\n var initialView := CurrentViewOfHost(b[start_step], idx);\r\n var i := lemma_EventuallyPersistentRequestAlwaysInRequestsReceivedPrevEpochs(b, asp, processing_sync_start, processing_bound, idx);\r\n if i < start_step\r\n {\r\n Lemma_AlwaysImpliesLaterAlways(i, start_step, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx));\r\n i := start_step;\r\n }\r\n assert sat(i, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx)));\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ViewPlusOfHostMonotonic(b, asp, idx, start_step, i);\r\n if HostSuspectsOrInLaterView(b[i], idx, initialView)\r\n {\r\n TemporalEventually(start_step, i, HostSuspectsOrInLaterViewTemporal(b, idx, initialView));\r\n step := i;\r\n }\r\n else\r\n {\r\n var epoch_end_time := b[i].replicas[idx].replica.proposer.election_state.epoch_end_time;\r\n var P := HostReadyToSuspectViewTemporal(b, idx, initialView, asp.persistent_request, epoch_end_time);\r\n var Q := HostSuspectsOrInLaterViewTemporal(b, idx, initialView);\r\n lemma_HostReadyToSuspectViewEventuallyDoes(b, asp, idx, initialView, epoch_end_time, i);\r\n TemporalDeduceFromAlways(i, i, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx));\r\n assert HostReadyToSuspectView(b[i], idx, initialView, asp.persistent_request, epoch_end_time);\r\n TemporalDeduceFromAlways(i, i, imply(P, eventual(Q)));\r\n step := TemporalDeduceFromEventual(i, Q);\r\n Lemma_AlwaysImpliesLaterAlways(i, step, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, idx));\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/ViewPersistence.i.dfy", "content": "include \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"EpochLength.i.dfy\"\r\ninclude \"ViewChange.i.dfy\"\r\ninclude \"ViewPropagation.i.dfy\"\r\ninclude \"ViewPropagation2.i.dfy\"\r\ninclude \"ViewSuspicion.i.dfy\"\r\ninclude \"MaxBallotISent1a.i.dfy\"\r\ninclude \"StablePeriod.i.dfy\"\r\ninclude \"../CommonProof/CanonicalizeBallot.i.dfy\"\r\ninclude \"../CommonProof/MaxBallotISent1a.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../../../Common/Framework/EnvironmentSynchronyLemmas.i.dfy\"\r\ninclude \"../../../../Libraries/Math/mul.i.dfy\"\r\n\r\nmodule LivenessProof__ViewPersistence_i {\r\n\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Election_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__EpochLength_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__RealTime_i\r\nimport opened LivenessProof__ViewChange_i\r\nimport opened LivenessProof__ViewPropagation_i\r\nimport opened LivenessProof__ViewPropagation2_i\r\nimport opened LivenessProof__ViewSuspicion_i\r\nimport opened LivenessProof__MaxBallotISent1a_i\r\nimport opened LivenessProof__RequestsReceived_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__CanonicalizeBallot_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__MaxBallotISent1a_i\r\nimport opened CommonProof__Quorum_i\r\nimport opened Common__UpperBound_s\r\nimport opened Liveness__EnvironmentSynchronyLemmas_i\r\nimport opened Math__mul_i\r\nimport opened Temporal__Induction_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Sets_i\r\nimport opened Environment_s\r\nimport opened EnvironmentSynchrony_s\r\n\r\npredicate NoLiveReplicaSuspectsViewBefore(\r\n ps:RslState,\r\n live_quorum:set,\r\n view:Ballot,\r\n endTime:int,\r\n max_clock_ambiguity:int\r\n )\r\n{\r\n ps.environment.time < endTime - max_clock_ambiguity ==>\r\n forall idx :: idx in live_quorum ==>\r\n && 0 <= idx < |ps.replicas|\r\n && var es := ps.replicas[idx].replica.proposer.election_state;\r\n (|| BalLt(es.current_view, view)\r\n || (&& es.current_view == view\r\n && es.constants.my_index !in es.current_view_suspectors\r\n && es.epoch_end_time >= endTime))\r\n}\r\n\r\nfunction{:opaque} NoLiveReplicaSuspectsViewBeforeTemporal(\r\n b:Behavior,\r\n live_quorum:set,\r\n view:Ballot,\r\n endTime:int,\r\n max_clock_ambiguity:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, NoLiveReplicaSuspectsViewBeforeTemporal(b, live_quorum, view, endTime, max_clock_ambiguity))} ::\r\n sat(i, NoLiveReplicaSuspectsViewBeforeTemporal(b, live_quorum, view, endTime, max_clock_ambiguity)) <==>\r\n NoLiveReplicaSuspectsViewBefore(b[i], live_quorum, view, endTime, max_clock_ambiguity)\r\n{\r\n stepmap(imap i :: NoLiveReplicaSuspectsViewBefore(b[i], live_quorum, view, endTime, max_clock_ambiguity))\r\n}\r\n\r\nlemma {:timeLimitMultiplier 2} lemma_NoLiveReplicaSuspectsViewBeforeStableOneStep(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n view:Ballot,\r\n minEpochLength:int,\r\n endTime:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires IsValidBallot(view, asp.c)\r\n requires minEpochLength >= 0\r\n requires b[i].environment.time >= endTime - minEpochLength - asp.max_clock_ambiguity\r\n requires NoLiveReplicaSuspectsViewBefore(b[i], asp.live_quorum, view, endTime, asp.max_clock_ambiguity)\r\n requires forall idx :: idx in asp.live_quorum ==> EpochLengthEqualOrGreater(b[i], idx, minEpochLength + asp.max_clock_ambiguity * 2)\r\n ensures NoLiveReplicaSuspectsViewBefore(b[i+1], asp.live_quorum, view, endTime, asp.max_clock_ambiguity)\r\n{\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n\r\n var ps := b[i];\r\n var ps' := b[i+1];\r\n\r\n if !NoLiveReplicaSuspectsViewBefore(b[i+1], asp.live_quorum, view, endTime, asp.max_clock_ambiguity)\r\n {\r\n lemma_NoOneCanExceedViewUntilAQuorumMemberSuspectsIt(b, asp, i, view);\r\n assert AllQuorumMembersViewPlusLe(ps, asp.live_quorum, ViewPlus(view, false));\r\n assert AllReplicasViewPlusLe(ps, ViewPlus(view, true));\r\n \r\n assert ps.environment.time < endTime - asp.max_clock_ambiguity;\r\n forall idx | idx in asp.live_quorum\r\n ensures var es' := ps'.replicas[idx].replica.proposer.election_state;\r\n || BalLt(es'.current_view, view)\r\n || (&& es'.current_view == view\r\n && es'.constants.my_index !in es'.current_view_suspectors\r\n && es'.epoch_end_time >= endTime)\r\n {\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n\r\n if es' != es && !BalLt(es'.current_view, view)\r\n {\r\n lemma_ViewOfHostMonotonic(b, asp, idx, i, i+1);\r\n lemma_IsValidBallot(b, asp, i, idx);\r\n lemma_IsValidBallot(b, asp, i+1, idx);\r\n lemma_ViewInfoStateInvHolds(b, asp, i);\r\n assert EpochLengthEqualOrGreater(ps, idx, minEpochLength);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, i, idx);\r\n \r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, idx);\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n if |ios| > 1 && ios[1].LIoOpReadClock? && LReplicaNextProcessHeartbeat(s, s', ios[0].r, ios[1].t, sent_packets) && ios[0].r.src in asp.c.config.replica_ids\r\n {\r\n var p := ios[0].r;\r\n var oid := p.src;\r\n var sender_index := GetReplicaIndex(oid, es.constants.all.config);\r\n lemma_PacketProcessedImpliesPacketSent(ps, ps', idx, ios, p);\r\n lemma_ClockAmbiguityLimitApplies(b, asp, i, idx, ios[1]);\r\n assert p in ps.environment.sentPackets;\r\n assert ViewInfoConsistent(ps, sender_index);\r\n assert ViewInfoInPacketConsistent(ps, sender_index, p);\r\n assert ViewPlusLe(CurrentViewPlusOfHost(ps, sender_index), ViewPlus(view, true));\r\n assert es'.current_view == view;\r\n assert es'.constants.my_index !in es'.current_view_suspectors;\r\n assert es'.epoch_end_time >= endTime;\r\n }\r\n else if LReplicaNextReadClockCheckForQuorumOfViewSuspicions(s, s', SpontaneousClock(ios), sent_packets)\r\n {\r\n assert es'.current_view == ComputeSuccessorView(es.current_view, asp.c);\r\n lemma_NothingBetweenViewAndSuccessor(es.current_view, view, asp.c);\r\n if es.current_view == view\r\n {\r\n assert |es.current_view_suspectors| >= LMinQuorumSize(es.constants.all.config);\r\n lemma_AllSuspectorsValidStateInvHolds(b, asp, i);\r\n var live_suspector_idx := lemma_QuorumIndexOverlap(es.current_view_suspectors, asp.live_quorum, |asp.c.config.replica_ids|);\r\n assert 0 <= live_suspector_idx < |ps.replicas|;\r\n assert ViewInfoConsistent(ps, live_suspector_idx);\r\n assert ViewInfoInObserverConsistent(ps, live_suspector_idx, idx);\r\n lemma_ViewPlusLeTransitiveDefinite(ViewPlus(view, true), CurrentViewPlusOfHost(ps, live_suspector_idx), ViewPlus(view, false));\r\n assert false;\r\n }\r\n lemma_ClockAmbiguityLimitApplies(b, asp, i, idx, ios[0]);\r\n }\r\n else if SpontaneousIos(ios, 1)\r\n {\r\n lemma_ClockAmbiguityLimitApplies(b, asp, i, idx, ios[0]);\r\n assert es'.current_view == view;\r\n assert es'.constants.my_index !in es'.current_view_suspectors;\r\n assert es'.epoch_end_time >= endTime;\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_NoLiveReplicaSuspectsViewBeforeStable(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n view:Ballot,\r\n minEpochLength:int,\r\n endTime:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires IsValidBallot(view, asp.c)\r\n requires minEpochLength >= 0\r\n requires b[i].environment.time >= endTime - minEpochLength - asp.max_clock_ambiguity\r\n requires NoLiveReplicaSuspectsViewBefore(b[i], asp.live_quorum, view, endTime, asp.max_clock_ambiguity)\r\n requires forall idx :: idx in asp.live_quorum ==> sat(i, always(EpochLengthEqualOrGreaterTemporal(b, idx, minEpochLength + asp.max_clock_ambiguity * 2)))\r\n ensures sat(i, always(NoLiveReplicaSuspectsViewBeforeTemporal(b, asp.live_quorum, view, endTime, asp.max_clock_ambiguity)))\r\n{\r\n var x := NoLiveReplicaSuspectsViewBeforeTemporal(b, asp.live_quorum, view, endTime, asp.max_clock_ambiguity);\r\n \r\n forall j | i <= j\r\n ensures sat(j, imply(x, next(x)))\r\n {\r\n if sat(j, x)\r\n {\r\n forall idx | idx in asp.live_quorum\r\n ensures EpochLengthEqualOrGreater(b[j], idx, minEpochLength + asp.max_clock_ambiguity * 2)\r\n {\r\n TemporalDeduceFromAlways(i, j, EpochLengthEqualOrGreaterTemporal(b, idx, minEpochLength + asp.max_clock_ambiguity * 2));\r\n }\r\n lemma_TimeAdvancesBetween(b, asp, i, j);\r\n lemma_NoLiveReplicaSuspectsViewBeforeStableOneStep(b, asp, j, view, minEpochLength, endTime);\r\n }\r\n reveal imply();\r\n reveal next();\r\n }\r\n\r\n TemporalInductionNext(i, x);\r\n}\r\n\r\nlemma lemma_LaterViewWithPrimaryExists(\r\n ps:RslState,\r\n primary_idx:int,\r\n max_integer_val:UpperBound\r\n ) returns (\r\n view:Ballot\r\n )\r\n requires ConstantsAllConsistentInv(ps)\r\n requires 0 <= primary_idx < |ps.replicas|\r\n requires forall idx :: 0 <= idx < |ps.replicas| ==> LtUpperBound(CurrentViewOfHost(ps, idx).seqno, max_integer_val)\r\n ensures view.proposer_id == primary_idx\r\n ensures LeqUpperBound(view.seqno, max_integer_val)\r\n ensures forall idx :: 0 <= idx < |ps.replicas| ==> BalLt(CurrentViewOfHost(ps, idx), view)\r\n{\r\n var ballot_seqnos := set idx | 0 <= idx < |ps.constants.config.replica_ids| :: CurrentViewOfHost(ps, idx).seqno;\r\n assert CurrentViewOfHost(ps, primary_idx).seqno in ballot_seqnos;\r\n var highest_seqno := intsetmax(ballot_seqnos);\r\n var highest_idx :| 0 <= highest_idx < |ps.constants.config.replica_ids| && CurrentViewOfHost(ps, highest_idx).seqno == highest_seqno;\r\n assert LtUpperBound(highest_seqno, max_integer_val);\r\n\r\n var next_seqno := highest_seqno + 1;\r\n view := Ballot(next_seqno, primary_idx);\r\n assert IsValidBallot(view, ps.constants);\r\n forall idx | 0 <= idx < |ps.constants.config.replica_ids|\r\n ensures BalLt(CurrentViewOfHost(ps, idx), view)\r\n {\r\n assert CurrentViewOfHost(ps, idx).seqno in ballot_seqnos;\r\n }\r\n}\r\n\r\npredicate SomeReplicaInLiveQuorumReachedView(\r\n ps:RslState,\r\n live_quorum:set,\r\n view:Ballot\r\n )\r\n{\r\n exists idx :: idx in live_quorum && 0 <= idx < |ps.replicas| && BalLeq(view, CurrentViewOfHost(ps, idx))\r\n}\r\n\r\nfunction{:opaque} SomeReplicaInLiveQuorumReachedViewTemporal(\r\n b:Behavior,\r\n live_quorum:set,\r\n view:Ballot\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i{:trigger sat(i, SomeReplicaInLiveQuorumReachedViewTemporal(b, live_quorum, view))} ::\r\n sat(i, SomeReplicaInLiveQuorumReachedViewTemporal(b, live_quorum, view)) <==>\r\n SomeReplicaInLiveQuorumReachedView(b[i], live_quorum, view)\r\n{\r\n stepmap(imap i :: SomeReplicaInLiveQuorumReachedView(b[i], live_quorum, view))\r\n}\r\n\r\nlemma lemma_FirstStepWithLiveReplicaInQuorumHasNoLiveReplicaSuspectingBeforeIfHeartbeat(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n view:Ballot,\r\n duration:int,\r\n step:int,\r\n ios:seq,\r\n ahead_idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires duration > 0\r\n requires 1 <= step\r\n requires view.proposer_id in asp.live_quorum\r\n requires forall idx :: idx in asp.live_quorum ==> sat(step-1, EpochLengthEqualOrGreaterTemporal(b, idx, duration + asp.max_clock_ambiguity * 2))\r\n requires ahead_idx in asp.live_quorum\r\n requires 0 <= ahead_idx < |b[step].replicas|\r\n requires BalLeq(view, CurrentViewOfHost(b[step], ahead_idx))\r\n requires !SomeReplicaInLiveQuorumReachedView(b[step-1], asp.live_quorum, view)\r\n requires |ios| > 1\r\n requires ios[0].LIoOpReceive?\r\n requires ios[0].r.msg.RslMessage_Heartbeat?\r\n requires ios[1].LIoOpReadClock?\r\n requires RslNextOneReplica(b[step-1], b[step], ahead_idx, ios)\r\n requires LReplicaNextProcessHeartbeat(b[step-1].replicas[ahead_idx].replica, b[step].replicas[ahead_idx].replica,\r\n ios[0].r, ios[1].t, ExtractSentPacketsFromIos(ios))\r\n ensures var es' := b[step].replicas[ahead_idx].replica.proposer.election_state;\r\n && es'.current_view == view\r\n && es'.constants.my_index !in es'.current_view_suspectors\r\n && es'.epoch_end_time >= b[step].environment.time + duration + asp.max_clock_ambiguity\r\n{\r\n var ps := b[step-1];\r\n var ps' := b[step];\r\n var s := ps.replicas[ahead_idx].replica;\r\n var s' := ps'.replicas[ahead_idx].replica;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n\r\n lemma_ViewOfHostMonotonic(b, asp, ahead_idx, step-1, step);\r\n lemma_IsValidBallot(b, asp, step-1, ahead_idx);\r\n lemma_IsValidBallot(b, asp, step, ahead_idx);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, step-1, ahead_idx);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, step, ahead_idx);\r\n assert EpochLengthEqualOrGreater(ps, ahead_idx, duration);\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, step-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, step);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, step-1);\r\n\r\n var p := ios[0].r;\r\n var oid := p.src;\r\n var sender_index := GetReplicaIndex(oid, es.constants.all.config);\r\n lemma_PacketProcessedImpliesPacketSent(ps, ps', ahead_idx, ios, p);\r\n assert p in ps.environment.sentPackets;\r\n lemma_ViewInfoStateInvHolds(b, asp, step-1);\r\n assert ViewInfoConsistent(ps, sender_index);\r\n assert ViewInfoInPacketConsistent(ps, sender_index, p);\r\n assert ViewPlusLe(ViewPlus(p.msg.bal_heartbeat, p.msg.suspicious), CurrentViewPlusOfHost(ps, sender_index));\r\n\r\n lemma_NoOneCanExceedViewUntilAQuorumMemberSuspectsIt(b, asp, step-1, view);\r\n assert AllQuorumMembersViewPlusLe(ps, asp.live_quorum, ViewPlus(view, false));\r\n assert AllReplicasViewPlusLe(ps, ViewPlus(view, true));\r\n assert ViewPlusLe(CurrentViewPlusOfHost(ps, sender_index), ViewPlus(view, true));\r\n lemma_BalLtProperties();\r\n lemma_ViewPlusLeTransitiveDefinite(ViewPlus(p.msg.bal_heartbeat, p.msg.suspicious), CurrentViewPlusOfHost(ps, sender_index), ViewPlus(view, true));\r\n assert BalLeq(p.msg.bal_heartbeat, view);\r\n lemma_ClockAmbiguityLimitApplies(b, asp, step-1, ahead_idx, ios[1]);\r\n}\r\n\r\nlemma{:timeLimitMultiplier 2} lemma_FirstStepWithLiveReplicaInQuorumHasNoLiveReplicaSuspectingBefore(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n view:Ballot,\r\n duration:int,\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires duration > 0\r\n requires 1 <= step\r\n requires view.proposer_id in asp.live_quorum\r\n requires forall idx :: idx in asp.live_quorum ==> sat(step-1, EpochLengthEqualOrGreaterTemporal(b, idx, duration + asp.max_clock_ambiguity * 2))\r\n requires !SomeReplicaInLiveQuorumReachedView(b[step-1], asp.live_quorum, view)\r\n requires SomeReplicaInLiveQuorumReachedView(b[step], asp.live_quorum, view)\r\n ensures NoLiveReplicaSuspectsViewBefore(b[step], asp.live_quorum, view, b[step].environment.time + duration + asp.max_clock_ambiguity, asp.max_clock_ambiguity)\r\n{\r\n var ps := b[step-1];\r\n var ps' := b[step];\r\n var ahead_idx :| ahead_idx in asp.live_quorum && 0 <= ahead_idx < |ps'.replicas| && BalLeq(view, CurrentViewOfHost(ps', ahead_idx));\r\n lemma_ConstantsAllConsistent(b, asp.c, step-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, step);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, step-1);\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, step-1, ahead_idx);\r\n\r\n forall idx | idx in asp.live_quorum\r\n ensures var es' := ps'.replicas[idx].replica.proposer.election_state;\r\n || BalLt(es'.current_view, view)\r\n || (&& es'.current_view == view\r\n && es'.constants.my_index !in es'.current_view_suspectors\r\n && es'.epoch_end_time >= ps'.environment.time + duration + asp.max_clock_ambiguity)\r\n {\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n\r\n lemma_ViewOfHostMonotonic(b, asp, idx, step-1, step);\r\n\r\n if idx != ahead_idx\r\n {\r\n assert BalLt(es'.current_view, view);\r\n }\r\n else\r\n {\r\n lemma_IsValidBallot(b, asp, step-1, idx);\r\n lemma_IsValidBallot(b, asp, step, idx);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, step-1, idx);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, step, idx);\r\n assert EpochLengthEqualOrGreater(ps, idx, duration);\r\n \r\n var ios2 := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, step-1, idx);\r\n var sent_packets := ExtractSentPacketsFromIos(ios2);\r\n if |ios2| > 1 && ios2[1].LIoOpReadClock? && LReplicaNextProcessHeartbeat(s, s', ios2[0].r, ios2[1].t, sent_packets) && ios2[0].r.src in asp.c.config.replica_ids\r\n {\r\n lemma_FirstStepWithLiveReplicaInQuorumHasNoLiveReplicaSuspectingBeforeIfHeartbeat(b, asp, view, duration, step, ios2, ahead_idx);\r\n lemma_ClockAmbiguityLimitApplies(b, asp, step-1, idx, ios2[1]);\r\n }\r\n else if LReplicaNextReadClockCheckForQuorumOfViewSuspicions(s, s', SpontaneousClock(ios2), sent_packets)\r\n {\r\n assert es'.current_view == ComputeSuccessorView(es.current_view, asp.c);\r\n lemma_NothingBetweenViewAndSuccessor(es.current_view, view, asp.c);\r\n lemma_ClockAmbiguityLimitApplies(b, asp, step-1, idx, ios2[0]);\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_FirstStepWithLiveReplicaInQuorumHasAllMaxBallot1aBeforeView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n view:Ballot,\r\n duration:int,\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires duration > 0\r\n requires 1 <= step\r\n requires view.proposer_id in asp.live_quorum\r\n requires !SomeReplicaInLiveQuorumReachedView(b[step-1], asp.live_quorum, view)\r\n requires SomeReplicaInLiveQuorumReachedView(b[step], asp.live_quorum, view)\r\n ensures forall idx :: 0 <= idx < |b[step].replicas| ==> BalLt(b[step].replicas[idx].replica.proposer.max_ballot_i_sent_1a, view)\r\n{\r\n var ps := b[step-1];\r\n var ps' := b[step];\r\n var ahead_idx :| ahead_idx in asp.live_quorum && 0 <= ahead_idx < |ps'.replicas| && BalLeq(view, CurrentViewOfHost(ps', ahead_idx));\r\n lemma_ConstantsAllConsistent(b, asp.c, step-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, step);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, step-1);\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, step-1, ahead_idx);\r\n\r\n forall idx | 0 <= idx < |b[step].replicas|\r\n ensures BalLt(b[step].replicas[idx].replica.proposer.max_ballot_i_sent_1a, view)\r\n {\r\n var s := b[step-1].replicas[idx].replica.proposer;\r\n var s' := b[step].replicas[idx].replica.proposer;\r\n \r\n lemma_BalLtProperties();\r\n lemma_MaxBallotISent1aLeqView(b, asp, step-1, idx);\r\n assert BalLeq(s.max_ballot_i_sent_1a, s.election_state.current_view);\r\n\r\n if idx == ahead_idx || idx in asp.live_quorum\r\n {\r\n assert BalLt(s.election_state.current_view, view);\r\n assert BalLt(s.max_ballot_i_sent_1a, view);\r\n assert s'.max_ballot_i_sent_1a == s.max_ballot_i_sent_1a;\r\n }\r\n else\r\n {\r\n lemma_NoOneCanExceedViewUntilAQuorumMemberSuspectsIt(b, asp, step-1, view);\r\n assert AllQuorumMembersViewPlusLe(b[step-1], asp.live_quorum, ViewPlus(view, false));\r\n assert AllReplicasViewPlusLe(b[step-1], ViewPlus(view, true));\r\n assert ViewPlusLe(CurrentViewPlusOfHost(b[step-1], idx), ViewPlus(view, true));\r\n assert BalLeq(s.election_state.current_view, view);\r\n lemma_MaxBallotISent1aHasMeAsProposer(b, asp.c, step-1, idx);\r\n assert s.max_ballot_i_sent_1a.proposer_id != view.proposer_id;\r\n assert BalLt(s.max_ballot_i_sent_1a, view);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_EventuallyViewStable(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n primary_idx:int,\r\n duration:int\r\n ) returns (\r\n view:Ballot,\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires primary_idx in asp.live_quorum\r\n requires duration > 0\r\n ensures processing_sync_start <= step\r\n ensures view.proposer_id == primary_idx\r\n ensures LeqUpperBound(view.seqno, asp.c.params.max_integer_val)\r\n ensures SomeReplicaInLiveQuorumReachedView(b[step], asp.live_quorum, view)\r\n ensures forall idx :: 0 <= idx < |b[step].replicas| ==> BalLt(b[step].replicas[idx].replica.proposer.max_ballot_i_sent_1a, view)\r\n ensures sat(step, always(NoLiveReplicaSuspectsViewBeforeTemporal(b, asp.live_quorum, view, b[step].environment.time + duration + asp.max_clock_ambiguity, asp.max_clock_ambiguity)))\r\n{\r\n var first_step := lemma_EpochLengthForAllEventuallyReaches(b, asp, processing_sync_start, processing_bound, duration + asp.max_clock_ambiguity * 2);\r\n lemma_ConstantsAllConsistent(b, asp.c, first_step);\r\n\r\n forall idx | 0 <= idx < |b[first_step].replicas|\r\n ensures LtUpperBound(CurrentViewOfHost(b[first_step], idx).seqno, asp.c.params.max_integer_val)\r\n {\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, first_step, idx);\r\n }\r\n \r\n view := lemma_LaterViewWithPrimaryExists(b[first_step], primary_idx, asp.c.params.max_integer_val);\r\n assert !sat(first_step, SomeReplicaInLiveQuorumReachedViewTemporal(b, asp.live_quorum, view));\r\n\r\n lemma_IfPacketProcessingSynchronousThenAlways(b, asp, processing_sync_start, first_step, processing_bound);\r\n var second_step, replica_index := lemma_SomeReplicaInLiveQuorumReachesView(b, asp, first_step, processing_bound, view);\r\n assert sat(second_step, SomeReplicaInLiveQuorumReachedViewTemporal(b, asp.live_quorum, view));\r\n TemporalEventually(first_step, second_step, SomeReplicaInLiveQuorumReachedViewTemporal(b, asp.live_quorum, view));\r\n step := earliestStep(first_step, SomeReplicaInLiveQuorumReachedViewTemporal(b, asp.live_quorum, view));\r\n assert first_step <= step - 1 < step;\r\n assert !sat(step-1, SomeReplicaInLiveQuorumReachedViewTemporal(b, asp.live_quorum, view));\r\n var endTime := b[step].environment.time + duration + asp.max_clock_ambiguity;\r\n\r\n forall idx | idx in asp.live_quorum\r\n ensures sat(step, always(EpochLengthEqualOrGreaterTemporal(b, idx, duration + asp.max_clock_ambiguity * 2)))\r\n ensures sat(step-1, EpochLengthEqualOrGreaterTemporal(b, idx, duration + asp.max_clock_ambiguity * 2))\r\n {\r\n TemporalDeduceFromAlways(first_step, step-1, EpochLengthEqualOrGreaterTemporal(b, idx, duration + asp.max_clock_ambiguity * 2));\r\n Lemma_AlwaysImpliesLaterAlways(first_step, step, EpochLengthEqualOrGreaterTemporal(b, idx, duration + asp.max_clock_ambiguity * 2));\r\n }\r\n\r\n lemma_FirstStepWithLiveReplicaInQuorumHasNoLiveReplicaSuspectingBefore(b, asp, view, duration, step);\r\n lemma_FirstStepWithLiveReplicaInQuorumHasAllMaxBallot1aBeforeView(b, asp, view, duration, step);\r\n lemma_NoLiveReplicaSuspectsViewBeforeStable(b, asp, step, view, duration, endTime);\r\n}\r\n\r\nlemma lemma_EventuallyBallotStable(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n primary_idx:int,\r\n duration:int\r\n ) returns (\r\n view:Ballot,\r\n step:int,\r\n ahead_idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires primary_idx in asp.live_quorum\r\n requires duration >= 0\r\n ensures processing_sync_start <= step\r\n ensures view.proposer_id == primary_idx\r\n ensures LeqUpperBound(view.seqno, asp.c.params.max_integer_val)\r\n ensures sat(step, StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx))\r\n ensures sat(step, always(untilabsolutetime(NoReplicaBeyondViewTemporal(b, view), b[step].environment.time + duration, PaxosTimeMap(b))))\r\n{\r\n view, step := lemma_EventuallyViewStable(b, asp, processing_sync_start, processing_bound, primary_idx, duration+1);\r\n ahead_idx :| ahead_idx in asp.live_quorum && 0 <= ahead_idx < |b[step].replicas| && BalLeq(view, CurrentViewOfHost(b[step], ahead_idx));\r\n assert StablePeriodStarted(b[step], asp.live_quorum, view, ahead_idx);\r\n\r\n var time_plus_duration := b[step].environment.time + duration;\r\n forall i | step <= i\r\n ensures sat(i, untilabsolutetime(NoReplicaBeyondViewTemporal(b, view), time_plus_duration, PaxosTimeMap(b)))\r\n {\r\n TemporalDeduceFromAlways(step, i, NoLiveReplicaSuspectsViewBeforeTemporal(b, asp.live_quorum, view, time_plus_duration + asp.max_clock_ambiguity + 1, asp.max_clock_ambiguity));\r\n if b[i].environment.time <= time_plus_duration\r\n {\r\n assert b[i].environment.time < time_plus_duration + 1;\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n forall idx | idx in asp.live_quorum\r\n ensures ViewPlusLe(CurrentViewPlusOfHost(b[i], idx), ViewPlus(view, false))\r\n {\r\n var es := b[i].replicas[idx].replica.proposer.election_state;\r\n assert || BalLt(es.current_view, view)\r\n || (&& es.current_view == view\r\n && es.constants.my_index !in es.current_view_suspectors\r\n && es.epoch_end_time >= time_plus_duration + asp.max_clock_ambiguity + 1);\r\n }\r\n lemma_NoOneCanExceedViewUntilAQuorumMemberSuspectsIt(b, asp, i, view);\r\n assert AllQuorumMembersViewPlusLe(b[i], asp.live_quorum, ViewPlus(view, false));\r\n assert AllReplicasViewPlusLe(b[i], ViewPlus(view, true));\r\n forall idx | 0 <= idx < |b[i].replicas|\r\n ensures BalLeq(CurrentViewOfHost(b[i], idx), view)\r\n {\r\n assert ViewPlusLe(CurrentViewPlusOfHost(b[i], idx), ViewPlus(view, true));\r\n lemma_BalLtProperties();\r\n }\r\n assert NoReplicaBeyondView(b[i], view);\r\n }\r\n }\r\n\r\n TemporalAlways(step, untilabsolutetime(NoReplicaBeyondViewTemporal(b, view), time_plus_duration, PaxosTimeMap(b)));\r\n}\r\n\r\nlemma lemma_EventuallyBallotStableWithRequest(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n primary_idx:int,\r\n base_duration:int,\r\n per_request_duration:int\r\n ) returns (\r\n view:Ballot,\r\n step:int,\r\n ahead_idx:int,\r\n num_requests:int,\r\n duration:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires primary_idx in asp.live_quorum\r\n requires base_duration >= 0\r\n requires per_request_duration >= 0\r\n ensures processing_sync_start <= step\r\n ensures num_requests > 0\r\n ensures view.proposer_id == primary_idx\r\n ensures LeqUpperBound(view.seqno, asp.c.params.max_integer_val)\r\n ensures duration == base_duration + num_requests * per_request_duration\r\n ensures sat(step, StablePeriodStartedTemporal(b, asp.live_quorum, view, ahead_idx))\r\n ensures sat(step, always(untilabsolutetime(NoReplicaBeyondViewTemporal(b, view), b[step].environment.time + duration, PaxosTimeMap(b))))\r\n ensures sat(step, always(RequestInFirstNTemporal(b, primary_idx, asp.persistent_request, num_requests)))\r\n{\r\n var first_step := lemma_EventuallyPersistentRequestInRequestsReceivedPrevEpochs(b, asp, processing_sync_start, processing_bound, primary_idx);\r\n num_requests := |b[first_step].replicas[primary_idx].replica.proposer.election_state.requests_received_prev_epochs|;\r\n duration := base_duration + num_requests * per_request_duration;\r\n lemma_mul_nonnegative(num_requests, per_request_duration);\r\n lemma_PersistentRequestDoesNotIncreasePositionInRequestsReceivedPrevEpochs(b, asp, processing_sync_start, processing_bound, primary_idx, first_step, num_requests);\r\n lemma_IfPacketProcessingSynchronousThenAlways(b, asp, processing_sync_start, first_step, processing_bound);\r\n lemma_ConstantsAllConsistent(b, asp.c, first_step);\r\n view, step, ahead_idx := lemma_EventuallyBallotStable(b, asp, first_step, processing_bound, primary_idx, duration);\r\n Lemma_AlwaysImpliesLaterAlways(first_step, step, RequestInFirstNTemporal(b, primary_idx, asp.persistent_request, num_requests));\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/ViewPropagation.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"ViewChange.i.dfy\"\r\ninclude \"WF1.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../CommonProof/CanonicalizeBallot.i.dfy\"\r\ninclude \"../CommonProof/PacketSending.i.dfy\"\r\ninclude \"../CommonProof/Quorum.i.dfy\"\r\n\r\nmodule LivenessProof__ViewPropagation_i {\r\n\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Election_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__ViewChange_i\r\nimport opened LivenessProof__WF1_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__CanonicalizeBallot_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened CommonProof__Quorum_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Collections__Maps2_s\r\nimport opened Environment_s\r\n\r\npredicate ViewInfoInObserverConsistent(ps:RslState, idx:int, observer_idx:int)\r\n requires 0 <= idx < |ps.replicas|\r\n requires 0 <= observer_idx < |ps.replicas|\r\n{\r\n idx in ps.replicas[observer_idx].replica.proposer.election_state.current_view_suspectors\r\n ==> ViewPlusLe(ViewPlus(CurrentViewOfHost(ps, observer_idx), true), CurrentViewPlusOfHost(ps, idx))\r\n}\r\n\r\npredicate ViewInfoInPacketConsistent(ps:RslState, idx:int, p:RslPacket)\r\n requires 0 <= idx < |ps.replicas|\r\n{\r\n 0 <= idx < |ps.constants.config.replica_ids| && p.src == ps.constants.config.replica_ids[idx] && p.msg.RslMessage_Heartbeat?\r\n ==> && IsValidBallot(p.msg.bal_heartbeat, ps.constants)\r\n && ViewPlusLe(ViewPlus(p.msg.bal_heartbeat, p.msg.suspicious), CurrentViewPlusOfHost(ps, idx))\r\n}\r\n\r\npredicate ViewInfoConsistent(ps:RslState, idx:int)\r\n requires 0 <= idx < |ps.replicas|\r\n{\r\n && IsValidBallot(CurrentViewOfHost(ps, idx), ps.constants)\r\n && (forall observer_idx :: 0 <= observer_idx < |ps.replicas| ==> ViewInfoInObserverConsistent(ps, idx, observer_idx))\r\n && (forall p :: p in ps.environment.sentPackets ==> ViewInfoInPacketConsistent(ps, idx, p))\r\n}\r\n\r\npredicate ViewInfoStateInv(ps:RslState)\r\n{\r\n forall idx :: 0 <= idx < |ps.replicas| ==> ViewInfoConsistent(ps, idx)\r\n}\r\n\r\npredicate AllSuspectorsValidStateInv(ps:RslState)\r\n{\r\n forall idx, suspector_idx\r\n :: 0 <= idx < |ps.replicas| && suspector_idx in ps.replicas[idx].replica.proposer.election_state.current_view_suspectors\r\n ==> 0 <= suspector_idx < |ps.replicas|\r\n}\r\n\r\npredicate AllQuorumMembersViewPlusLe(ps:RslState, quorum:set, v:ViewPlus)\r\n{\r\n forall idx :: idx in quorum && 0 <= idx < |ps.replicas| ==> ViewPlusLe(CurrentViewPlusOfHost(ps, idx), v)\r\n}\r\n\r\npredicate AllReplicasViewPlusLe(ps:RslState, v:ViewPlus)\r\n{\r\n forall idx :: 0 <= idx < |ps.replicas| ==> ViewPlusLe(CurrentViewPlusOfHost(ps, idx), v)\r\n}\r\n\r\npredicate NoMemberBeyondViewUntilAQuorumMemberSuspectsIt(ps:RslState, quorum:set, v:Ballot)\r\n{\r\n AllQuorumMembersViewPlusLe(ps, quorum, ViewPlus(v, false)) ==> AllReplicasViewPlusLe(ps, ViewPlus(v, true))\r\n}\r\n\r\npredicate HostSuspectsOrInLaterViewWithSpecificNextHeartbeatTime(\r\n ps:RslState,\r\n replica_index:int,\r\n view:Ballot,\r\n nextHeartbeatTime:int\r\n )\r\n{\r\n && 0 <= replica_index < |ps.replicas|\r\n && ViewPlusLe(ViewPlus(view, true), CurrentViewPlusOfHost(ps, replica_index))\r\n && ps.replicas[replica_index].replica.nextHeartbeatTime == nextHeartbeatTime\r\n}\r\n\r\nfunction{:opaque} HostSuspectsOrInLaterViewWithSpecificNextHeartbeatTimeTemporal(\r\n b:Behavior,\r\n replica_index:int,\r\n view:Ballot,\r\n nextHeartbeatTime:int\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, HostSuspectsOrInLaterViewWithSpecificNextHeartbeatTimeTemporal(b, replica_index, view, nextHeartbeatTime))} ::\r\n sat(i, HostSuspectsOrInLaterViewWithSpecificNextHeartbeatTimeTemporal(b, replica_index, view, nextHeartbeatTime)) <==>\r\n HostSuspectsOrInLaterViewWithSpecificNextHeartbeatTime(b[i], replica_index, view, nextHeartbeatTime)\r\n{\r\n stepmap(imap i :: HostSuspectsOrInLaterViewWithSpecificNextHeartbeatTime(b[i], replica_index, view, nextHeartbeatTime))\r\n}\r\n\r\npredicate HostSentSuspicion(\r\n ps:RslState,\r\n sid:NodeIdentity,\r\n oid:NodeIdentity,\r\n view:Ballot,\r\n p:RslPacket\r\n )\r\n{\r\n && p.dst == oid\r\n && p.src == sid\r\n && p.msg.RslMessage_Heartbeat?\r\n && p.msg.bal_heartbeat == view\r\n && p.msg.suspicious\r\n && ps.environment.nextStep.LEnvStepHostIos?\r\n && LIoOpSend(p) in ps.environment.nextStep.ios\r\n}\r\n\r\npredicate HostSentSuspicionOrInLaterView(\r\n ps:RslState,\r\n suspector_idx:int,\r\n observer_idx:int,\r\n view:Ballot\r\n )\r\n{\r\n && |ps.replicas| == |ps.constants.config.replica_ids|\r\n && 0 <= suspector_idx < |ps.replicas|\r\n && 0 <= observer_idx < |ps.replicas|\r\n && (|| BalLt(view, CurrentViewOfHost(ps, suspector_idx))\r\n || exists p :: HostSentSuspicion(ps, ps.constants.config.replica_ids[suspector_idx], ps.constants.config.replica_ids[observer_idx], view, p))\r\n}\r\n\r\nfunction{:opaque} HostSentSuspicionOrInLaterViewTemporal(\r\n b:Behavior,\r\n suspector_idx:int,\r\n observer_idx:int,\r\n view:Ballot\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, HostSentSuspicionOrInLaterViewTemporal(b, suspector_idx, observer_idx, view))} ::\r\n sat(i, HostSentSuspicionOrInLaterViewTemporal(b, suspector_idx, observer_idx, view)) ==\r\n HostSentSuspicionOrInLaterView(b[i], suspector_idx, observer_idx, view)\r\n{\r\n stepmap(imap i :: HostSentSuspicionOrInLaterView(b[i], suspector_idx, observer_idx, view))\r\n}\r\n\r\npredicate SuspicionPropagatedToObserver(\r\n ps:RslState,\r\n suspector_idx:int,\r\n observer_idx:int,\r\n view:Ballot\r\n )\r\n{\r\n && |ps.replicas| == |ps.constants.config.replica_ids|\r\n && 0 <= suspector_idx < |ps.replicas|\r\n && 0 <= observer_idx < |ps.replicas|\r\n && (|| BalLt(view, CurrentViewOfHost(ps, suspector_idx))\r\n || BalLt(view, CurrentViewOfHost(ps, observer_idx))\r\n || (&& CurrentViewOfHost(ps, observer_idx) == view\r\n && suspector_idx in ps.replicas[observer_idx].replica.proposer.election_state.current_view_suspectors))\r\n}\r\n\r\nfunction{:opaque} SuspicionPropagatedToObserverTemporal(\r\n b:Behavior,\r\n suspector_idx:int,\r\n observer_idx:int,\r\n view:Ballot\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, SuspicionPropagatedToObserverTemporal(b, suspector_idx, observer_idx, view))} ::\r\n sat(i, SuspicionPropagatedToObserverTemporal(b, suspector_idx, observer_idx, view)) ==\r\n SuspicionPropagatedToObserver(b[i], suspector_idx, observer_idx, view)\r\n{\r\n stepmap(imap i :: SuspicionPropagatedToObserver(b[i], suspector_idx, observer_idx, view))\r\n}\r\n\r\nlemma lemma_PaxosNextPreservesViewInfoInObserverConsistent(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int,\r\n observer_idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires ViewInfoStateInv(b[i])\r\n requires 0 <= idx < |b[i+1].replicas|\r\n requires 0 <= observer_idx < |b[i+1].replicas|\r\n ensures ViewInfoInObserverConsistent(b[i+1], idx, observer_idx)\r\n{\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n\r\n var ps := b[i];\r\n var ps' := b[i+1];\r\n var s := ps.replicas[observer_idx].replica;\r\n var s' := ps'.replicas[observer_idx].replica;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n assert RslNext(ps, ps');\r\n\r\n lemma_ViewPlusOfHostMonotonic(b, asp, idx, i, i+1);\r\n assert ViewInfoConsistent(ps, idx);\r\n assert ViewInfoInObserverConsistent(ps, idx, observer_idx);\r\n// lemma_LEnvironmentInvariantHolds(b, asp, i);\r\n\r\n if idx in es'.current_view_suspectors\r\n {\r\n if idx in es.current_view_suspectors\r\n {\r\n if es.current_view != es'.current_view\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, observer_idx);\r\n assert LReplicaNextProcessHeartbeat(s, s', ios[0].r, ios[1].t, ExtractSentPacketsFromIos(ios));\r\n lemma_PacketProcessedImpliesPacketSent(ps, ps', observer_idx, ios, ios[0].r);\r\n assert ViewInfoInPacketConsistent(ps, idx, ios[0].r);\r\n }\r\n }\r\n else\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, observer_idx);\r\n if |ios| >= 2 && ios[0].LIoOpReceive? && ios[1].LIoOpReadClock? &&\r\n LReplicaNextProcessHeartbeat(s, s', ios[0].r, ios[1].t, ExtractSentPacketsFromIos(ios))\r\n {\r\n lemma_PacketProcessedImpliesPacketSent(ps, ps', observer_idx, ios, ios[0].r);\r\n assert ViewInfoInPacketConsistent(ps, idx, ios[0].r);\r\n }\r\n else if LReplicaNextReadClockCheckForViewTimeout(s, s', SpontaneousClock(ios), ExtractSentPacketsFromIos(ios))\r\n {\r\n assert idx == observer_idx;\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma{:timeLimitMultiplier 2} lemma_PaxosNextPreservesViewInfoInPacketConsistent(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int,\r\n p:RslPacket\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires ViewInfoStateInv(b[i])\r\n requires 0 <= idx < |b[i+1].replicas|\r\n requires p in b[i+1].environment.sentPackets\r\n ensures ViewInfoInPacketConsistent(b[i+1], idx, p)\r\n{\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n\r\n var ps := b[i];\r\n var ps' := b[i+1];\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n assert RslNext(ps, ps');\r\n\r\n assert ViewInfoConsistent(ps, idx);\r\n\r\n if p.src == ps.constants.config.replica_ids[idx] && p.msg.RslMessage_Heartbeat?\r\n {\r\n if p in ps.environment.sentPackets\r\n {\r\n assert ViewInfoInPacketConsistent(ps, idx, p);\r\n lemma_ViewPlusOfHostMonotonic(b, asp, idx, i, i+1);\r\n lemma_ViewPlusLeTransitive(ViewPlus(p.msg.bal_heartbeat, p.msg.suspicious), CurrentViewPlusOfHost(ps, idx), CurrentViewPlusOfHost(ps', idx));\r\n }\r\n else\r\n {\r\n var observer_idx, ios := lemma_ActionThatSendsHeartbeatIsMaybeSendHeartbeat(ps, ps', p);\r\n assert ReplicasDistinct(ps.constants.config.replica_ids, idx, observer_idx);\r\n assert idx == observer_idx;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_PaxosNextPreservesIsValidBallot(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires ViewInfoStateInv(b[i])\r\n requires 0 <= idx < |b[i+1].replicas|\r\n ensures IsValidBallot(CurrentViewOfHost(b[i+1], idx), b[i+1].constants)\r\n{\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n\r\n var ps := b[i];\r\n var ps' := b[i+1];\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n assert RslNext(ps, ps');\r\n\r\n// lemma_LEnvironmentInvariantHolds(b, asp, i);\r\n assert ViewInfoConsistent(b[i], idx);\r\n\r\n if es'.current_view != es.current_view\r\n {\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, idx);\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n if && |ios| > 1\r\n && ios[1].LIoOpReadClock?\r\n && LReplicaNextProcessHeartbeat(s, s', ios[0].r, ios[1].t, sent_packets)\r\n && ios[0].r.src in asp.c.config.replica_ids\r\n {\r\n var p := ios[0].r;\r\n var sender_idx := GetReplicaIndex(p.src, ps.constants.config);\r\n lemma_PacketProcessedImpliesPacketSent(ps, ps', idx, ios, p);\r\n assert ViewInfoConsistent(ps, sender_idx);\r\n assert ViewInfoInPacketConsistent(ps, sender_idx, p);\r\n assert IsValidBallot(p.msg.bal_heartbeat, ps.constants);\r\n assert IsValidBallot(es'.current_view, ps'.constants);\r\n }\r\n else if LReplicaNextReadClockCheckForQuorumOfViewSuspicions(s, s', SpontaneousClock(ios), sent_packets)\r\n {\r\n assert es'.current_view == ComputeSuccessorView(es.current_view, es.constants.all);\r\n lemma_ComputeSuccessorViewProducesValidBallot(es.current_view, es.constants.all);\r\n assert IsValidBallot(es'.current_view, ps'.constants);\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_ViewInfoStateInvHolds(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n ensures ViewInfoStateInv(b[i])\r\n{\r\n if i > 0\r\n {\r\n lemma_ViewInfoStateInvHolds(b, asp, i-1);\r\n forall idx, observer_idx | 0 <= idx < |b[i].replicas| && 0 <= observer_idx < |b[i].replicas|\r\n ensures ViewInfoInObserverConsistent(b[i], idx, observer_idx)\r\n {\r\n lemma_PaxosNextPreservesViewInfoInObserverConsistent(b, asp, i-1, idx, observer_idx);\r\n }\r\n\r\n forall idx, p | 0 <= idx < |b[i].replicas| && p in b[i].environment.sentPackets\r\n ensures ViewInfoInPacketConsistent(b[i], idx, p)\r\n {\r\n lemma_PaxosNextPreservesViewInfoInPacketConsistent(b, asp, i-1, idx, p);\r\n }\r\n\r\n forall idx | 0 <= idx < |b[i].replicas|\r\n ensures IsValidBallot(CurrentViewOfHost(b[i], idx), b[i].constants)\r\n {\r\n lemma_PaxosNextPreservesIsValidBallot(b, asp, i-1, idx);\r\n }\r\n }\r\n}\r\n\r\nlemma{:timeLimitMultiplier 2} lemma_AllSuspectorsValidStateInvHolds(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n ensures AllSuspectorsValidStateInv(b[i])\r\n{\r\n if i > 0\r\n {\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i-1);\r\n lemma_AllSuspectorsValidStateInvHolds(b, asp, i-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i-1);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n\r\n var ps := b[i-1];\r\n var ps' := b[i];\r\n if !AllSuspectorsValidStateInv(b[i])\r\n {\r\n var idx, suspector_idx :| && 0 <= idx < |ps'.replicas|\r\n && suspector_idx in ps'.replicas[idx].replica.proposer.election_state.current_view_suspectors\r\n && !(0 <= suspector_idx < |ps'.replicas|);\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n assert suspector_idx in es'.current_view_suspectors - es.current_view_suspectors;\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i-1, idx);\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n if |ios| > 1 && ios[1].LIoOpReadClock? && LReplicaNextProcessHeartbeat(s, s', ios[0].r, ios[1].t, sent_packets) && ios[0].r.src in asp.c.config.replica_ids\r\n {\r\n assert suspector_idx == GetReplicaIndex(ios[0].r.src, es.constants.all.config);\r\n assert false;\r\n }\r\n else if LReplicaNextReadClockCheckForViewTimeout(s, s', SpontaneousClock(ios), sent_packets)\r\n {\r\n assert suspector_idx == es.constants.my_index;\r\n assert false;\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_IsValidBallot(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures IsValidBallot(CurrentViewOfHost(b[i], idx), asp.c)\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ViewInfoStateInvHolds(b, asp, i);\r\n assert ViewInfoConsistent(b[i], idx);\r\n}\r\n\r\nlemma lemma_CantChangeViewIfNoOneInQuorumSuspects(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n idx:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires 0 <= view.proposer_id < |asp.c.config.replica_ids|\r\n requires AllQuorumMembersViewPlusLe(b[i], asp.live_quorum, ViewPlus(view, false))\r\n requires 0 <= idx < |b[i].replicas|\r\n requires 0 <= idx < |b[i+1].replicas|\r\n requires ViewPlusLe(CurrentViewPlusOfHost(b[i], idx), ViewPlus(view, true))\r\n requires ViewPlusLt(ViewPlus(view, true), CurrentViewPlusOfHost(b[i+1], idx))\r\n requires AllReplicasViewPlusLe(b[i], ViewPlus(view, true))\r\n ensures false\r\n{\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n\r\n var ps := b[i];\r\n var ps' := b[i+1];\r\n var s := ps.replicas[idx].replica;\r\n var s' := ps'.replicas[idx].replica;\r\n var es := s.proposer.election_state;\r\n\r\n lemma_BalLtProperties();\r\n assert BalLt(CurrentViewOfHost(ps, idx), CurrentViewOfHost(ps', idx));\r\n assert BalLt(view, CurrentViewOfHost(ps', idx));\r\n\r\n// lemma_LEnvironmentInvariantHolds(b, asp, i);\r\n lemma_ViewInfoStateInvHolds(b, asp, i);\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, idx);\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n \r\n if |ios| > 1 && ios[1].LIoOpReadClock? && LReplicaNextProcessHeartbeat(s, s', ios[0].r, ios[1].t, sent_packets) && ios[0].r.src in asp.c.config.replica_ids\r\n {\r\n var p := ios[0].r;\r\n var oid := p.src;\r\n var sender_index := GetReplicaIndex(oid, es.constants.all.config);\r\n lemma_PacketProcessedImpliesPacketSent(ps, ps', idx, ios, p);\r\n assert p in ps.environment.sentPackets;\r\n assert ViewInfoConsistent(ps, sender_index);\r\n assert ViewInfoInPacketConsistent(ps, sender_index, p);\r\n assert ViewPlusLe(CurrentViewPlusOfHost(ps, sender_index), ViewPlus(view, true));\r\n assert false;\r\n }\r\n else if LReplicaNextReadClockCheckForQuorumOfViewSuspicions(s, s', SpontaneousClock(ios), sent_packets)\r\n {\r\n assert |es.current_view_suspectors| >= LMinQuorumSize(es.constants.all.config);\r\n lemma_AllSuspectorsValidStateInvHolds(b, asp, i);\r\n var common_index := lemma_QuorumIndexOverlap(es.current_view_suspectors, asp.live_quorum, |asp.c.config.replica_ids|);\r\n assert ViewPlusLe(CurrentViewPlusOfHost(ps, common_index), ViewPlus(view, false));\r\n assert ViewInfoConsistent(ps, common_index);\r\n assert ViewInfoInObserverConsistent(ps, common_index, idx);\r\n assert ViewPlusLe(ViewPlus(CurrentViewOfHost(ps, idx), true), CurrentViewPlusOfHost(ps, common_index));\r\n lemma_ViewPlusLeTransitiveDefinite(ViewPlus(CurrentViewOfHost(ps, idx), true), CurrentViewPlusOfHost(ps, common_index), ViewPlus(view, false));\r\n assert BalLt(CurrentViewOfHost(ps, idx), view);\r\n assert BalLt(view, CurrentViewOfHost(ps', idx));\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, i, idx);\r\n lemma_NothingBetweenViewAndSuccessor(CurrentViewOfHost(ps, idx), view, es.constants.all);\r\n assert false;\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_NoOneCanExceedViewUntilAQuorumMemberSuspectsItOneStep(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires 0 <= view.proposer_id < |asp.c.config.replica_ids|\r\n requires NoMemberBeyondViewUntilAQuorumMemberSuspectsIt(b[i], asp.live_quorum, view)\r\n ensures NoMemberBeyondViewUntilAQuorumMemberSuspectsIt(b[i+1], asp.live_quorum, view)\r\n{\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n\r\n var ps := b[i];\r\n var ps' := b[i+1];\r\n assert RslNext(ps, ps');\r\n if !NoMemberBeyondViewUntilAQuorumMemberSuspectsIt(ps', asp.live_quorum, view)\r\n {\r\n forall live_idx | live_idx in asp.live_quorum\r\n ensures ViewPlusLe(CurrentViewPlusOfHost(ps, live_idx), ViewPlus(view, false))\r\n {\r\n lemma_ViewPlusOfHostMonotonic(b, asp, live_idx, i, i+1);\r\n lemma_ViewPlusLeTransitiveDefinite(CurrentViewPlusOfHost(ps, live_idx), CurrentViewPlusOfHost(ps', live_idx), ViewPlus(view, false));\r\n }\r\n assert AllQuorumMembersViewPlusLe(ps, asp.live_quorum, ViewPlus(view, false));\r\n assert AllReplicasViewPlusLe(ps, ViewPlus(view, true));\r\n\r\n var idx :| 0 <= idx < |ps.replicas| && !ViewPlusLe(CurrentViewPlusOfHost(ps', idx), ViewPlus(view, true));\r\n assert ViewPlusLe(CurrentViewPlusOfHost(ps, idx), ViewPlus(view, true));\r\n lemma_CantChangeViewIfNoOneInQuorumSuspects(b, asp, i, idx, view);\r\n }\r\n}\r\n\r\nlemma lemma_NoOneCanExceedViewUntilAQuorumMemberSuspectsIt(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n view:Ballot\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= i\r\n requires 0 <= view.proposer_id < |asp.c.config.replica_ids|\r\n ensures NoMemberBeyondViewUntilAQuorumMemberSuspectsIt(b[i], asp.live_quorum, view)\r\n{\r\n lemma_BalLtProperties();\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n\r\n if i == 0\r\n {\r\n assert forall idx :: 0 <= idx < |b[i].replicas| ==> CurrentViewPlusOfHost(b[i], idx) == ViewPlus(Ballot(1, 0), false);\r\n if BalLt(view, Ballot(1, 0))\r\n {\r\n var idx :| idx in asp.live_quorum;\r\n assert CurrentViewPlusOfHost(b[i], idx) == ViewPlus(Ballot(1, 0), false);\r\n assert !ViewPlusLe(CurrentViewPlusOfHost(b[i], idx), ViewPlus(view, false));\r\n assert !AllQuorumMembersViewPlusLe(b[i], asp.live_quorum, ViewPlus(view, false));\r\n }\r\n else\r\n {\r\n forall idx | 0 <= idx < |b[i].replicas|\r\n ensures ViewPlusLe(CurrentViewPlusOfHost(b[i], idx), ViewPlus(view, true))\r\n {\r\n assert CurrentViewPlusOfHost(b[i], idx) == ViewPlus(Ballot(1, 0), false);\r\n }\r\n assert AllReplicasViewPlusLe(b[i], ViewPlus(view, true));\r\n }\r\n }\r\n else\r\n {\r\n lemma_NoOneCanExceedViewUntilAQuorumMemberSuspectsIt(b, asp, i-1, view);\r\n lemma_NoOneCanExceedViewUntilAQuorumMemberSuspectsItOneStep(b, asp, i-1, view);\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/ViewPropagation2.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"ViewChange.i.dfy\"\r\ninclude \"ViewPropagation.i.dfy\"\r\ninclude \"WF1.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../CommonProof/CanonicalizeBallot.i.dfy\"\r\ninclude \"../CommonProof/PacketSending.i.dfy\"\r\ninclude \"../CommonProof/Quorum.i.dfy\"\r\n\r\nmodule LivenessProof__ViewPropagation2_i {\r\n\r\nimport opened LiveRSL__Broadcast_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Environment_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__RequestsReceived_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__ViewChange_i\r\nimport opened LivenessProof__ViewPropagation_i\r\nimport opened LivenessProof__WF1_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__CanonicalizeBallot_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened CommonProof__Quorum_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__WF1_i\r\nimport opened Environment_s\r\n\r\nlemma lemma_ReplicaEventuallySendsSuspicionOrLeavesViewWF1Req1(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n suspector_idx:int,\r\n observer_idx:int,\r\n view:Ballot,\r\n nextHeartbeatTime:int,\r\n start_step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires suspector_idx in asp.live_quorum\r\n requires 0 <= observer_idx < |asp.c.config.replica_ids|\r\n requires 0 <= start_step\r\n requires sat(start_step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, suspector_idx)))\r\n ensures var P := HostSuspectsOrInLaterViewWithSpecificNextHeartbeatTimeTemporal(b, suspector_idx, view, nextHeartbeatTime);\r\n var Q := HostSentSuspicionOrInLaterViewTemporal(b, suspector_idx, observer_idx, view);\r\n sat(start_step, always(TemporalWF1Req1(P, Q)))\r\n{\r\n var P := HostSuspectsOrInLaterViewWithSpecificNextHeartbeatTimeTemporal(b, suspector_idx, view, nextHeartbeatTime);\r\n var Q := HostSentSuspicionOrInLaterViewTemporal(b, suspector_idx, observer_idx, view);\r\n\r\n forall i | start_step <= i\r\n ensures sat(i, TemporalWF1Req1(P, Q))\r\n {\r\n if sat(i, P) && !sat(i, Q) && !sat(i+1, P) && !sat(i+1, Q)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n lemma_ViewPlusOfHostMonotonic(b, asp, suspector_idx, i, i+1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n \r\n var ps := b[i];\r\n var ps' := b[i+1];\r\n var s := ps.replicas[suspector_idx].replica;\r\n var s' := ps'.replicas[suspector_idx].replica;\r\n assert s'.nextHeartbeatTime != s.nextHeartbeatTime;\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, asp.c, i, suspector_idx);\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n assert |ios| > 0;\r\n assert ios[0].LIoOpReadClock?;\r\n assert LReplicaNextReadClockMaybeSendHeartbeat(s, s', SpontaneousClock(ios), sent_packets);\r\n assert ios[0].t >= s.nextHeartbeatTime;\r\n var sid := ps.constants.config.replica_ids[suspector_idx];\r\n var oid := ps.constants.config.replica_ids[observer_idx];\r\n var p := LPacket(oid, sid, RslMessage_Heartbeat(view, true, s.executor.ops_complete));\r\n assert p in sent_packets;\r\n assert p in ps'.environment.sentPackets;\r\n assert HostSentSuspicion(ps, sid, oid, view, p);\r\n assert false;\r\n }\r\n }\r\n\r\n TemporalAlways(start_step, TemporalWF1Req1(P, Q));\r\n}\r\n\r\nlemma {:timeLimitMultiplier 2} lemma_ReplicaEventuallySendsSuspicionOrLeavesViewWF1Req2(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n suspector_idx:int,\r\n observer_idx:int,\r\n view:Ballot,\r\n nextHeartbeatTime:int,\r\n start_step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires suspector_idx in asp.live_quorum\r\n requires 0 <= observer_idx < |asp.c.config.replica_ids|\r\n requires asp.synchrony_start <= start_step\r\n requires sat(start_step, always(RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, suspector_idx)))\r\n ensures var P := HostSuspectsOrInLaterViewWithSpecificNextHeartbeatTimeTemporal(b, suspector_idx, view, nextHeartbeatTime);\r\n var Q := HostSentSuspicionOrInLaterViewTemporal(b, suspector_idx, observer_idx, view);\r\n var Action := ReplicaSchedule(b, suspector_idx)[9];\r\n sat(start_step, always(TemporalWF1RealTimeDelayedReq2(P, Q, Action, nextHeartbeatTime + asp.max_clock_ambiguity, PaxosTimeMap(b))))\r\n{\r\n var P := HostSuspectsOrInLaterViewWithSpecificNextHeartbeatTimeTemporal(b, suspector_idx, view, nextHeartbeatTime);\r\n var Q := HostSentSuspicionOrInLaterViewTemporal(b, suspector_idx, observer_idx, view);\r\n var Action := ReplicaSchedule(b, suspector_idx)[9];\r\n var x := TemporalWF1RealTimeDelayedReq2(P, Q, Action, nextHeartbeatTime + asp.max_clock_ambiguity, PaxosTimeMap(b));\r\n\r\n forall i | start_step <= i\r\n ensures sat(i, x)\r\n {\r\n if sat(i, P) && sat(i, nextafter(Action, nextHeartbeatTime + asp.max_clock_ambiguity, PaxosTimeMap(b))) && !sat(i, Q) && !sat(i+1, Q)\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n assert SpecificClockReadingRslActionOccurs(b[i], b[i+1], LReplicaNextReadClockMaybeSendHeartbeat, suspector_idx);\r\n var ios :| && RslNextOneReplica(b[i], b[i+1], suspector_idx, ios)\r\n && SpontaneousIos(ios, 1)\r\n && LReplicaNextReadClockMaybeSendHeartbeat(b[i].replicas[suspector_idx].replica, b[i+1].replicas[suspector_idx].replica,\r\n SpontaneousClock(ios), ExtractSentPacketsFromIos(ios));\r\n var ps := b[i];\r\n var ps' := b[i+1];\r\n var s := ps.replicas[suspector_idx].replica;\r\n var s' := ps'.replicas[suspector_idx].replica;\r\n var sid := ps.constants.config.replica_ids[suspector_idx];\r\n var oid := ps.constants.config.replica_ids[observer_idx];\r\n var p := LPacket(oid, sid, RslMessage_Heartbeat(view, true, s.executor.ops_complete));\r\n lemma_ClockAmbiguityLimitApplies(b, asp, i, suspector_idx, ios[0]);\r\n assert LBroadcastToEveryone(s.constants.all.config, s.constants.my_index,\r\n RslMessage_Heartbeat(s.proposer.election_state.current_view,\r\n s.constants.my_index in s.proposer.election_state.current_view_suspectors,\r\n s.executor.ops_complete),\r\n ExtractSentPacketsFromIos(ios));\r\n assert p in ExtractSentPacketsFromIos(ios);\r\n assert p in ps'.environment.sentPackets;\r\n assert HostSentSuspicion(ps, sid, oid, view, p);\r\n assert false;\r\n }\r\n }\r\n\r\n TemporalAlways(start_step, x);\r\n}\r\n\r\nlemma lemma_ReplicaEventuallySendsSuspicionOrLeavesView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n suspector_idx:int,\r\n observer_idx:int,\r\n start_step:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires suspector_idx in asp.live_quorum\r\n requires processing_sync_start <= start_step\r\n requires 0 <= suspector_idx < |b[start_step].replicas|\r\n requires 0 <= observer_idx < |b[start_step].replicas|\r\n ensures start_step <= step\r\n ensures HostSentSuspicionOrInLaterView(b[step], suspector_idx, observer_idx, CurrentViewOfHost(b[start_step], suspector_idx))\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, start_step);\r\n var view := CurrentViewOfHost(b[start_step], suspector_idx);\r\n var i := lemma_ReplicaEventuallySuspectsViewOrIsInDifferentView(b, asp, processing_sync_start, processing_bound, suspector_idx, start_step);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n var nextHeartbeatTime := b[i].replicas[suspector_idx].replica.nextHeartbeatTime;\r\n var P := HostSuspectsOrInLaterViewWithSpecificNextHeartbeatTimeTemporal(b, suspector_idx, view, nextHeartbeatTime);\r\n var Q := HostSentSuspicionOrInLaterViewTemporal(b, suspector_idx, observer_idx, view);\r\n var Action := ReplicaSchedule(b, suspector_idx)[9];\r\n\r\n Lemma_AlwaysImpliesLaterAlways(start_step, i, RequestInRequestsReceivedPrevEpochsTemporal(b, asp.persistent_request, suspector_idx));\r\n lemma_ReplicaEventuallySendsSuspicionOrLeavesViewWF1Req1(b, asp, suspector_idx, observer_idx, view, nextHeartbeatTime, i);\r\n lemma_ReplicaEventuallySendsSuspicionOrLeavesViewWF1Req2(b, asp, suspector_idx, observer_idx, view, nextHeartbeatTime, i);\r\n lemma_ReplicaNextPerformsSubactionPeriodically(b, asp, suspector_idx, 9);\r\n\r\n lemma_EstablishRequirementsForWF1RealTimeDelayed(b, asp, i, Action, TimeToPerformGenericAction(asp));\r\n step := TemporalWF1RealTimeDelayed(i, P, Q, Action, TimeToPerformGenericAction(asp), nextHeartbeatTime + asp.max_clock_ambiguity, PaxosTimeMap(b));\r\n}\r\n\r\nlemma lemma_ReplicaEventuallyPropagatesSuspicionOrLeavesView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n suspector_idx:int,\r\n observer_idx:int,\r\n start_step:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires suspector_idx in asp.live_quorum\r\n requires observer_idx in asp.live_quorum\r\n requires processing_sync_start <= start_step\r\n requires 0 <= suspector_idx < |b[start_step].replicas|\r\n ensures start_step <= step\r\n ensures 0 <= suspector_idx < |b[step].replicas|\r\n ensures 0 <= observer_idx < |b[step].replicas|\r\n ensures var view := CurrentViewOfHost(b[start_step], suspector_idx);\r\n SuspicionPropagatedToObserver(b[step], suspector_idx, observer_idx, view)\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, start_step);\r\n var view := CurrentViewOfHost(b[start_step], suspector_idx);\r\n var sid := asp.c.config.replica_ids[suspector_idx];\r\n var oid := asp.c.config.replica_ids[observer_idx];\r\n\r\n var i := lemma_ReplicaEventuallySendsSuspicionOrLeavesView(b, asp, processing_sync_start, processing_bound, suspector_idx, observer_idx, start_step);\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n assert HostSentSuspicionOrInLaterView(b[i], suspector_idx, observer_idx, view);\r\n if BalLt(view, CurrentViewOfHost(b[i], suspector_idx))\r\n {\r\n step := i;\r\n return;\r\n }\r\n var p :| HostSentSuspicion(b[i], sid, oid, view, p);\r\n var processing_step, ios := lemma_PacketSentToIndexProcessedByIt(b, asp, processing_sync_start, processing_bound, i, observer_idx, p);\r\n lemma_ConstantsAllConsistent(b, asp.c, processing_step);\r\n lemma_ConstantsAllConsistent(b, asp.c, processing_step+1);\r\n var s := b[processing_step].replicas[observer_idx].replica;\r\n var s' := b[processing_step+1].replicas[observer_idx].replica;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n assert LProposerProcessHeartbeat(s.proposer, s'.proposer, p, ios[1].t);\r\n step := processing_step + 1;\r\n assert ReplicasDistinct(asp.c.config.replica_ids, suspector_idx, GetReplicaIndex(p.src, es.constants.all.config));\r\n if es.current_view == view\r\n {\r\n assert suspector_idx in es'.current_view_suspectors;\r\n }\r\n else if BalLt(es.current_view, view)\r\n {\r\n assert suspector_idx in es'.current_view_suspectors;\r\n }\r\n else\r\n {\r\n lemma_BalLtProperties();\r\n assert BalLt(view, es.current_view);\r\n }\r\n}\r\n\r\nlemma lemma_SuspicionPropagatedToObserverStableOneStep(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n suspector_idx:int,\r\n observer_idx:int,\r\n view:Ballot,\r\n i:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= observer_idx < |asp.c.config.replica_ids|\r\n requires 0 <= suspector_idx < |asp.c.config.replica_ids|\r\n requires 0 <= i\r\n requires SuspicionPropagatedToObserver(b[i], suspector_idx, observer_idx, view)\r\n ensures SuspicionPropagatedToObserver(b[i+1], suspector_idx, observer_idx, view)\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n lemma_ViewPlusOfHostMonotonic(b, asp, suspector_idx, i, i+1);\r\n lemma_ViewPlusOfHostMonotonic(b, asp, observer_idx, i, i+1);\r\n}\r\n\r\nlemma lemma_SuspicionPropagatedToObserverStableMultipleSteps(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n suspector_idx:int,\r\n observer_idx:int,\r\n view:Ballot,\r\n i:int,\r\n j:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= observer_idx < |asp.c.config.replica_ids|\r\n requires 0 <= suspector_idx < |asp.c.config.replica_ids|\r\n requires 0 <= i <= j\r\n requires SuspicionPropagatedToObserver(b[i], suspector_idx, observer_idx, view)\r\n ensures SuspicionPropagatedToObserver(b[j], suspector_idx, observer_idx, view)\r\n decreases j-i\r\n{\r\n if j > i + 1\r\n {\r\n lemma_SuspicionPropagatedToObserverStableMultipleSteps(b, asp, suspector_idx, observer_idx, view, i, j-1);\r\n lemma_SuspicionPropagatedToObserverStableMultipleSteps(b, asp, suspector_idx, observer_idx, view, j-1, j);\r\n }\r\n else if j == i + 1\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n lemma_ViewPlusOfHostMonotonic(b, asp, observer_idx, i, i+1);\r\n lemma_ViewPlusOfHostMonotonic(b, asp, suspector_idx, i, i+1);\r\n }\r\n}\r\n\r\nlemma lemma_SuspicionPropagatedToObserverStable(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n suspector_idx:int,\r\n observer_idx:int,\r\n view:Ballot,\r\n i:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= observer_idx < |asp.c.config.replica_ids|\r\n requires 0 <= suspector_idx < |asp.c.config.replica_ids|\r\n requires 0 <= i\r\n requires SuspicionPropagatedToObserver(b[i], suspector_idx, observer_idx, view)\r\n ensures sat(i, always(SuspicionPropagatedToObserverTemporal(b, suspector_idx, observer_idx, view)))\r\n{\r\n forall j | i <= j\r\n ensures sat(j, SuspicionPropagatedToObserverTemporal(b, suspector_idx, observer_idx, view))\r\n {\r\n lemma_SuspicionPropagatedToObserverStableMultipleSteps(b, asp, suspector_idx, observer_idx, view, i, j);\r\n }\r\n\r\n TemporalAlways(i, SuspicionPropagatedToObserverTemporal(b, suspector_idx, observer_idx, view));\r\n}\r\n\r\nlemma lemma_SuspicionEventuallyPropagatedToObserverForever(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n suspector_idx:int,\r\n observer_idx:int,\r\n start_step:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires suspector_idx in asp.live_quorum\r\n requires observer_idx in asp.live_quorum\r\n requires processing_sync_start <= start_step\r\n requires 0 <= suspector_idx < |b[start_step].replicas|\r\n ensures start_step <= step\r\n ensures 0 <= suspector_idx < |b[step].replicas|\r\n ensures 0 <= observer_idx < |b[step].replicas|\r\n ensures var view := CurrentViewOfHost(b[start_step], suspector_idx);\r\n sat(step, always(SuspicionPropagatedToObserverTemporal(b, suspector_idx, observer_idx, view)))\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, start_step);\r\n var view := CurrentViewOfHost(b[start_step], suspector_idx);\r\n step := lemma_ReplicaEventuallyPropagatesSuspicionOrLeavesView(b, asp, processing_sync_start, processing_bound, suspector_idx, observer_idx, start_step);\r\n lemma_SuspicionPropagatedToObserverStable(b, asp, suspector_idx, observer_idx, view, step);\r\n}\r\n\r\nlemma lemma_SuspicionOfLiveReplicasEventuallyPropagatedToObserverForever(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n observer_idx:int,\r\n suspector_indices:set,\r\n view:Ballot,\r\n start_step:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires suspector_indices <= asp.live_quorum\r\n requires observer_idx in asp.live_quorum\r\n requires processing_sync_start <= start_step\r\n requires forall suspector_idx :: suspector_idx in suspector_indices ==> 0 <= suspector_idx < |b[start_step].replicas| && CurrentViewOfHost(b[start_step], suspector_idx) == view\r\n ensures start_step <= step\r\n ensures forall suspector_idx :: suspector_idx in suspector_indices ==> sat(step, always(SuspicionPropagatedToObserverTemporal(b, suspector_idx, observer_idx, view)))\r\n decreases |suspector_indices|\r\n{\r\n if |suspector_indices| == 0\r\n {\r\n step := start_step;\r\n }\r\n else\r\n {\r\n var suspector_idx :| suspector_idx in suspector_indices;\r\n var other_indices := suspector_indices - { suspector_idx };\r\n var first_step := lemma_SuspicionOfLiveReplicasEventuallyPropagatedToObserverForever(b, asp, processing_sync_start, processing_bound, observer_idx, other_indices, view, start_step);\r\n var second_step := lemma_SuspicionEventuallyPropagatedToObserverForever(b, asp, processing_sync_start, processing_bound, suspector_idx, observer_idx, start_step);\r\n if second_step >= first_step\r\n {\r\n step := second_step;\r\n forall sidx | sidx in suspector_indices\r\n ensures sat(step, always(SuspicionPropagatedToObserverTemporal(b, sidx, observer_idx, view)))\r\n {\r\n if sidx != suspector_idx\r\n {\r\n Lemma_AlwaysImpliesLaterAlways(first_step, step, SuspicionPropagatedToObserverTemporal(b, sidx, observer_idx, view));\r\n }\r\n }\r\n }\r\n else\r\n {\r\n step := first_step;\r\n forall sidx | sidx in suspector_indices\r\n ensures sat(step, always(SuspicionPropagatedToObserverTemporal(b, sidx, observer_idx, view)))\r\n {\r\n if sidx == suspector_idx\r\n {\r\n Lemma_AlwaysImpliesLaterAlways(second_step, step, SuspicionPropagatedToObserverTemporal(b, sidx, observer_idx, view));\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/ViewSuspicion.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"Assumptions.i.dfy\"\r\ninclude \"Invariants.i.dfy\"\r\ninclude \"ViewPropagation.i.dfy\"\r\ninclude \"ViewPropagation2.i.dfy\"\r\ninclude \"ViewAdvance.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\ninclude \"../../../Common/Collections/Sets.i.dfy\"\r\n\r\nmodule LivenessProof__ViewSuspicion_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Election_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__PacketHandling_i\r\nimport opened LivenessProof__RoundRobin_i\r\nimport opened LivenessProof__StablePeriod_i\r\nimport opened LivenessProof__ViewPropagation_i\r\nimport opened LivenessProof__ViewPropagation2_i\r\nimport opened LivenessProof__ViewAdvance_i\r\nimport opened LivenessProof__ViewChange_i\r\nimport opened CommonProof__CanonicalizeBallot_i\r\nimport opened CommonProof__Constants_i\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Sets_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Rules_i\r\nimport opened Common__UpperBound_s\r\nimport opened Environment_s\r\n\r\npredicate ReplicaHasCollectedSuspicionFrom(\r\n ps:RslState,\r\n collector_idx:int,\r\n suspector_idx:int,\r\n view:Ballot\r\n )\r\n{\r\n && 0 <= collector_idx < |ps.replicas|\r\n && (|| BalLt(view, CurrentViewOfHost(ps, collector_idx))\r\n || (&& CurrentViewOfHost(ps, collector_idx) == view\r\n && suspector_idx in ps.replicas[collector_idx].replica.proposer.election_state.current_view_suspectors))\r\n}\r\n\r\nfunction{:opaque} ReplicaHasCollectedSuspicionFromTemporal(\r\n b:Behavior,\r\n collector_idx:int,\r\n suspector_idx:int,\r\n view:Ballot\r\n ):temporal\r\n requires imaptotal(b)\r\n ensures forall i {:trigger sat(i, ReplicaHasCollectedSuspicionFromTemporal(b, collector_idx, suspector_idx, view))} ::\r\n sat(i, ReplicaHasCollectedSuspicionFromTemporal(b, collector_idx, suspector_idx, view)) ==\r\n ReplicaHasCollectedSuspicionFrom(b[i], collector_idx, suspector_idx, view)\r\n{\r\n stepmap(imap i :: ReplicaHasCollectedSuspicionFrom(b[i], collector_idx, suspector_idx, view))\r\n}\r\n\r\nlemma lemma_ReplicaHasCollectedSuspicionFromStableOneStep(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n collector_idx:int,\r\n suspector_idx:int,\r\n view:Ballot,\r\n i:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= collector_idx < |asp.c.config.replica_ids|\r\n requires 0 <= suspector_idx < |asp.c.config.replica_ids|\r\n requires 0 <= i\r\n requires ReplicaHasCollectedSuspicionFrom(b[i], collector_idx, suspector_idx, view)\r\n ensures ReplicaHasCollectedSuspicionFrom(b[i+1], collector_idx, suspector_idx, view)\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n lemma_ViewPlusOfHostMonotonic(b, asp, collector_idx, i, i+1);\r\n}\r\n\r\nlemma lemma_ReplicaHasCollectedSuspicionFromStableMultipleSteps(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n collector_idx:int,\r\n suspector_idx:int,\r\n view:Ballot,\r\n i:int,\r\n j:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= collector_idx < |asp.c.config.replica_ids|\r\n requires 0 <= suspector_idx < |asp.c.config.replica_ids|\r\n requires 0 <= i <= j\r\n requires ReplicaHasCollectedSuspicionFrom(b[i], collector_idx, suspector_idx, view)\r\n ensures ReplicaHasCollectedSuspicionFrom(b[j], collector_idx, suspector_idx, view)\r\n decreases j-i\r\n{\r\n if j > i + 1\r\n {\r\n lemma_ReplicaHasCollectedSuspicionFromStableMultipleSteps(b, asp, collector_idx, suspector_idx, view, i, j-1);\r\n lemma_ReplicaHasCollectedSuspicionFromStableMultipleSteps(b, asp, collector_idx, suspector_idx, view, j-1, j);\r\n }\r\n else if j == i + 1\r\n {\r\n lemma_ConstantsAllConsistent(b, asp.c, i);\r\n lemma_ConstantsAllConsistent(b, asp.c, i+1);\r\n lemma_AssumptionsMakeValidTransition(b, asp.c, i);\r\n lemma_ViewPlusOfHostMonotonic(b, asp, collector_idx, i, i+1);\r\n }\r\n}\r\n\r\nlemma lemma_ReplicaHasCollectedSuspicionFromStable(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n collector_idx:int,\r\n suspector_idx:int,\r\n view:Ballot,\r\n i:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= collector_idx < |asp.c.config.replica_ids|\r\n requires 0 <= suspector_idx < |asp.c.config.replica_ids|\r\n requires 0 <= i\r\n requires ReplicaHasCollectedSuspicionFrom(b[i], collector_idx, suspector_idx, view)\r\n ensures sat(i, always(ReplicaHasCollectedSuspicionFromTemporal(b, collector_idx, suspector_idx, view)))\r\n{\r\n forall j | i <= j\r\n ensures sat(j, ReplicaHasCollectedSuspicionFromTemporal(b, collector_idx, suspector_idx, view))\r\n {\r\n lemma_ReplicaHasCollectedSuspicionFromStableMultipleSteps(b, asp, collector_idx, suspector_idx, view, i, j);\r\n }\r\n\r\n TemporalAlways(i, ReplicaHasCollectedSuspicionFromTemporal(b, collector_idx, suspector_idx, view));\r\n}\r\n\r\nlemma lemma_ReplicaEventuallyCollectsSuspicionOrLeavesView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n suspector_idx:int,\r\n collector_idx:int,\r\n start_step:int\r\n ) returns (\r\n step:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires suspector_idx in asp.live_quorum\r\n requires collector_idx in asp.live_quorum\r\n requires processing_sync_start <= start_step\r\n requires 0 <= suspector_idx < |b[start_step].replicas|\r\n ensures start_step <= step\r\n ensures 0 <= suspector_idx < |b[step].replicas|\r\n ensures 0 <= collector_idx < |b[step].replicas|\r\n ensures var view := CurrentViewOfHost(b[start_step], suspector_idx);\r\n || BalLt(view, CurrentViewOfHost(b[step], suspector_idx))\r\n || sat(step, always(ReplicaHasCollectedSuspicionFromTemporal(b, collector_idx, suspector_idx, view)))\r\n{\r\n var view := CurrentViewOfHost(b[start_step], suspector_idx);\r\n step := lemma_ReplicaEventuallyPropagatesSuspicionOrLeavesView(b, asp, processing_sync_start, processing_bound,\r\n suspector_idx, collector_idx, start_step);\r\n lemma_ConstantsAllConsistent(b, asp.c, step);\r\n if !BalLt(view, CurrentViewOfHost(b[step], suspector_idx))\r\n {\r\n lemma_ReplicaHasCollectedSuspicionFromStable(b, asp, collector_idx, suspector_idx, view, step);\r\n }\r\n}\r\n\r\nlemma lemma_IfReplicaHasCollectedSuspicionsFromLiveQuorumItWillAdvanceView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n collector_idx:int,\r\n view:Ballot,\r\n action_step:int,\r\n ios:seq\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires 0 <= action_step\r\n requires IsValidBallot(view, asp.c)\r\n requires BallotHasSuccessor(view, asp.c)\r\n requires collector_idx in asp.live_quorum\r\n requires 0 <= collector_idx < |b[action_step].replicas|\r\n requires 0 <= collector_idx < |b[action_step+1].replicas|\r\n requires RslNextOneReplica(b[action_step], b[action_step+1], collector_idx, ios)\r\n requires SpontaneousIos(ios, 1)\r\n requires LReplicaNextReadClockCheckForQuorumOfViewSuspicions(b[action_step].replicas[collector_idx].replica, b[action_step+1].replicas[collector_idx].replica, SpontaneousClock(ios), ExtractSentPacketsFromIos(ios))\r\n requires CurrentViewOfHost(b[action_step], collector_idx) == view\r\n requires forall suspector_idx :: suspector_idx in asp.live_quorum ==> suspector_idx in b[action_step].replicas[collector_idx].replica.proposer.election_state.current_view_suspectors\r\n ensures 0 <= collector_idx < |b[action_step+1].replicas|\r\n ensures BalLt(view, CurrentViewOfHost(b[action_step+1], collector_idx))\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, action_step);\r\n\r\n var ps := b[action_step];\r\n var ps' := b[action_step+1];\r\n var s := ps.replicas[collector_idx].replica;\r\n var s' := ps'.replicas[collector_idx].replica;\r\n var es := s.proposer.election_state;\r\n var es' := s'.proposer.election_state;\r\n\r\n assert LReplicaNextReadClockCheckForQuorumOfViewSuspicions(s, s', SpontaneousClock(ios), ExtractSentPacketsFromIos(ios));\r\n assert LProposerCheckForQuorumOfViewSuspicions(s.proposer, s'.proposer, ios[0].t);\r\n assert ElectionStateCheckForQuorumOfViewSuspicions(es, es', ios[0].t);\r\n SubsetCardinality(asp.live_quorum, es.current_view_suspectors);\r\n lemma_OverflowProtectionNotUsedForReplica(b, asp, action_step, collector_idx);\r\n assert es'.current_view == ComputeSuccessorView(es.current_view, es.constants.all);\r\n}\r\n\r\nlemma lemma_IfAllLiveReplicasInViewOneWillReachSuccessor(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n start_step:int\r\n ) returns (\r\n step:int,\r\n replica_index:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires 0 <= processing_sync_start <= start_step\r\n requires IsValidBallot(view, asp.c)\r\n requires BallotHasSuccessor(view, asp.c)\r\n requires forall idx :: idx in asp.live_quorum ==> 0 <= idx < |b[start_step].replicas| && CurrentViewOfHost(b[start_step], idx) == view\r\n ensures processing_sync_start <= step\r\n ensures replica_index in asp.live_quorum\r\n ensures 0 <= replica_index < |b[step].replicas|\r\n ensures BalLt(view, CurrentViewOfHost(b[step], replica_index))\r\n{\r\n lemma_ConstantsAllConsistent(b, asp.c, start_step);\r\n var collector_idx :| collector_idx in asp.live_quorum;\r\n var first_step := lemma_SuspicionOfLiveReplicasEventuallyPropagatedToObserverForever(b, asp, processing_sync_start, processing_bound, collector_idx, asp.live_quorum, view, start_step);\r\n\r\n var action_step := lemma_ReplicaNextPerformsSubactionSoon(b, asp, first_step, collector_idx, 8);\r\n assert SpecificClockReadingRslActionOccurs(b[action_step], b[action_step+1], LReplicaNextReadClockCheckForQuorumOfViewSuspicions, collector_idx);\r\n var ios :| && RslNextOneReplica(b[action_step], b[action_step+1], collector_idx, ios)\r\n && SpontaneousIos(ios, 1)\r\n && LReplicaNextReadClockCheckForQuorumOfViewSuspicions(b[action_step].replicas[collector_idx].replica, b[action_step+1].replicas[collector_idx].replica, SpontaneousClock(ios), ExtractSentPacketsFromIos(ios));\r\n\r\n lemma_ConstantsAllConsistent(b, asp.c, action_step);\r\n if exists ridx :: ridx in asp.live_quorum && BalLt(view, CurrentViewOfHost(b[action_step], ridx))\r\n {\r\n step := action_step;\r\n replica_index :| replica_index in asp.live_quorum && BalLt(view, CurrentViewOfHost(b[action_step], replica_index));\r\n return;\r\n }\r\n assert !BalLt(view, CurrentViewOfHost(b[action_step], collector_idx));\r\n lemma_BalLtProperties();\r\n forall suspector_idx | suspector_idx in asp.live_quorum\r\n ensures suspector_idx in b[action_step].replicas[collector_idx].replica.proposer.election_state.current_view_suspectors\r\n {\r\n TemporalDeduceFromAlways(first_step, action_step, SuspicionPropagatedToObserverTemporal(b, suspector_idx, collector_idx, view));\r\n lemma_ViewPlusOfHostMonotonic(b, asp, suspector_idx, start_step, action_step);\r\n assert !BalLt(view, CurrentViewOfHost(b[action_step], suspector_idx));\r\n }\r\n lemma_ViewPlusOfHostMonotonic(b, asp, collector_idx, start_step, action_step);\r\n step := action_step + 1;\r\n replica_index := collector_idx;\r\n lemma_IfReplicaHasCollectedSuspicionsFromLiveQuorumItWillAdvanceView(b, asp, collector_idx, view, action_step, ios);\r\n}\r\n\r\nlemma lemma_IfOneLiveReplicaReachesViewOneWillReachSuccessor(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n view:Ballot,\r\n start_step:int,\r\n cur_index:int\r\n ) returns (\r\n step:int,\r\n replica_index:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires 0 <= processing_sync_start <= start_step\r\n requires cur_index in asp.live_quorum\r\n requires IsValidBallot(view, asp.c)\r\n requires BallotHasSuccessor(view, asp.c)\r\n requires 0 <= cur_index < |b[start_step].replicas|\r\n requires BalLeq(view, CurrentViewOfHost(b[start_step], cur_index))\r\n ensures processing_sync_start <= step\r\n ensures replica_index in asp.live_quorum\r\n ensures 0 <= replica_index < |b[step].replicas|\r\n ensures BalLt(view, CurrentViewOfHost(b[step], replica_index))\r\n{\r\n if CurrentViewOfHost(b[start_step], cur_index) != view\r\n {\r\n step := start_step;\r\n replica_index := cur_index;\r\n lemma_BalLtProperties();\r\n return;\r\n }\r\n assert CurrentViewOfHost(b[start_step], cur_index) == view;\r\n var first_step := lemma_OneLiveReplicaSoonAdvancesAllForever(b, asp, processing_sync_start, processing_bound, start_step, cur_index);\r\n lemma_ConstantsAllConsistent(b, asp.c, first_step);\r\n if exists ridx :: ridx in asp.live_quorum && BalLt(view, CurrentViewOfHost(b[first_step], ridx))\r\n {\r\n step := first_step;\r\n replica_index :| replica_index in asp.live_quorum && BalLt(view, CurrentViewOfHost(b[first_step], replica_index));\r\n return;\r\n }\r\n forall ridx | ridx in asp.live_quorum\r\n ensures CurrentViewOfHost(b[first_step], ridx) == view\r\n {\r\n TemporalDeduceFromAlways(first_step, first_step, HostReachedViewTemporal(b, ridx, view));\r\n assert !BalLt(view, CurrentViewOfHost(b[first_step], ridx));\r\n }\r\n step, replica_index := lemma_IfAllLiveReplicasInViewOneWillReachSuccessor(b, asp, processing_sync_start, processing_bound, view, first_step);\r\n}\r\n\r\nlemma lemma_SomeReplicaInLiveQuorumReachesView(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n processing_sync_start:int,\r\n processing_bound:int,\r\n view:Ballot\r\n ) returns (\r\n step:int,\r\n replica_index:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires PacketProcessingSynchronous(b, asp, processing_sync_start, processing_bound)\r\n requires 0 <= processing_sync_start\r\n requires IsValidBallot(view, asp.c)\r\n requires LeqUpperBound(view.seqno, asp.c.params.max_integer_val)\r\n ensures processing_sync_start <= step\r\n ensures replica_index in asp.live_quorum\r\n ensures 0 <= replica_index < |b[step].replicas|\r\n ensures BalLeq(view, CurrentViewOfHost(b[step], replica_index))\r\n decreases CanonicalizeBallot(view, asp.c)\r\n{\r\n lemma_CanonicalizeBallotProperties();\r\n \r\n var cview := CanonicalizeBallot(view, asp.c);\r\n if cview <= 1\r\n {\r\n replica_index :| replica_index in asp.live_quorum;\r\n lemma_ConstantsAllConsistent(b, asp.c, 0);\r\n calc {\r\n CanonicalizeBallot(CurrentViewOfHost(b[0], replica_index), asp.c);\r\n CanonicalizeBallot(Ballot(1, 0), asp.c);\r\n { reveal_CanonicalizeBallot(); }\r\n |asp.c.config.replica_ids|;\r\n >= 1;\r\n >= cview;\r\n }\r\n lemma_IsValidBallot(b, asp, 0, replica_index);\r\n assert BalLeq(view, CurrentViewOfHost(b[0], replica_index));\r\n step := processing_sync_start;\r\n lemma_ConstantsAllConsistent(b, asp.c, step);\r\n lemma_ViewPlusOfHostMonotonic(b, asp, replica_index, 0, step);\r\n }\r\n else\r\n {\r\n var previousView := ComputePredecessorView(view, asp.c);\r\n lemma_ComputePredecessorViewProperties(view, asp.c);\r\n var first_step, cur_index := lemma_SomeReplicaInLiveQuorumReachesView(b, asp, processing_sync_start, processing_bound, previousView);\r\n lemma_ConstantsAllConsistent(b, asp.c, first_step);\r\n step, replica_index := lemma_IfOneLiveReplicaReachesViewOneWillReachSuccessor(b, asp, processing_sync_start, processing_bound, previousView, first_step, cur_index);\r\n lemma_ConstantsAllConsistent(b, asp.c, step);\r\n lemma_IsValidBallot(b, asp, step, replica_index);\r\n lemma_NothingBetweenViewAndSuccessor(previousView, CurrentViewOfHost(b[step], replica_index), asp.c);\r\n lemma_BalLtProperties();\r\n }\r\n}\r\n\r\n}\r\n\r\n \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/LivenessProof/WF1.i.dfy", "content": "include \"Invariants.i.dfy\"\r\ninclude \"RealTime.i.dfy\"\r\ninclude \"../../../Common/Logic/Temporal/WF1.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\n\r\nmodule LivenessProof__WF1_i {\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LivenessProof__Assumptions_i\r\nimport opened LivenessProof__Invariants_i\r\nimport opened LivenessProof__RealTime_i\r\nimport opened CommonProof__Actions_i\r\nimport opened Temporal__Rules_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Temporal__Time_s\r\nimport opened Temporal__Time_i\r\nimport opened Temporal__WF1_i\r\nimport opened Collections__Maps2_i\r\n\r\nlemma lemma_EstablishRequirementsForWF1RealTimeDelayed(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n action:temporal,\r\n span:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires asp.synchrony_start <= i\r\n requires sat(asp.synchrony_start, always(eventuallynextwithin(action, span, PaxosTimeMap(b))))\r\n ensures sat(i, always(eventuallynextwithin(action, span, PaxosTimeMap(b))))\r\n ensures monotonic_from(0, PaxosTimeMap(b))\r\n ensures TimeNotZeno(PaxosTimeMap(b))\r\n{\r\n lemma_TimeMonotonicFromInvariantHolds(b, asp, 0);\r\n lemma_AfterForm(b, asp);\r\n Lemma_AlwaysImpliesLaterAlways(asp.synchrony_start, i, eventuallynextwithin(action, span, PaxosTimeMap(b)));\r\n reveal eventual();\r\n reveal after();\r\n}\r\n\r\nlemma lemma_EstablishRequirementsForWF1RealTime(\r\n b:Behavior,\r\n asp:AssumptionParameters,\r\n i:int,\r\n action:temporal,\r\n span:int\r\n )\r\n requires LivenessAssumptions(b, asp)\r\n requires asp.synchrony_start <= i\r\n requires sat(asp.synchrony_start, always(eventuallynextwithin(action, span, PaxosTimeMap(b))))\r\n ensures sat(i, always(eventuallynextwithin(action, span, PaxosTimeMap(b))))\r\n ensures monotonic_from(i, PaxosTimeMap(b))\r\n{\r\n lemma_TimeMonotonicFromInvariantHolds(b, asp, i);\r\n Lemma_AlwaysImpliesLaterAlways(asp.synchrony_start, i, eventuallynextwithin(action, span, PaxosTimeMap(b)));\r\n}\r\n \r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/Message.i.dfy", "content": "include \"Types.i.dfy\"\r\n\r\nmodule LiveRSL__Message_i {\r\nimport opened LiveRSL__Types_i\r\nimport opened AppStateMachine_s\r\n\r\n// TODO put to/from header in every message\r\n\r\ndatatype RslMessage =\r\n RslMessage_Invalid()\r\n | RslMessage_Request(seqno_req:int, val:AppRequest)\r\n | RslMessage_1a(bal_1a:Ballot)\r\n | RslMessage_1b(bal_1b:Ballot, log_truncation_point:OperationNumber, votes:Votes)\r\n | RslMessage_2a(bal_2a:Ballot, opn_2a:OperationNumber, val_2a:RequestBatch)\r\n | RslMessage_2b(bal_2b:Ballot, opn_2b:OperationNumber, val_2b:RequestBatch)\r\n | RslMessage_Heartbeat(bal_heartbeat:Ballot, suspicious:bool, opn_ckpt:OperationNumber)\r\n | RslMessage_Reply(seqno_reply:int, reply:AppReply)\r\n | RslMessage_AppStateRequest(bal_state_req:Ballot, opn_state_req:OperationNumber)\r\n | RslMessage_AppStateSupply(bal_state_supply:Ballot, opn_state_supply:OperationNumber, app_state:AppState)\r\n | RslMessage_StartingPhase2(bal_2:Ballot, logTruncationPoint_2:OperationNumber)\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/Parameters.i.dfy", "content": "include \"../Common/UpperBound.s.dfy\"\r\n\r\nmodule LiveRSL__Parameters_i {\r\n\r\nimport opened Common__UpperBound_s\r\n\r\ndatatype LParameters = LParameters(\r\n max_log_length:int,\r\n baseline_view_timeout_period:int,\r\n heartbeat_period:int,\r\n max_integer_val:UpperBound,\r\n max_batch_size:int,\r\n max_batch_delay:int\r\n )\r\n\r\npredicate WFLParameters(p:LParameters)\r\n{\r\n && p.max_log_length > 0\r\n && p.baseline_view_timeout_period > 0\r\n && p.heartbeat_period > 0\r\n && (p.max_integer_val.UpperBoundFinite? ==> p.max_integer_val.n > p.max_log_length)\r\n && p.max_batch_size > 0\r\n && p.max_batch_delay >= 0\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/Proposer.i.dfy", "content": "include \"Configuration.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"Broadcast.i.dfy\"\r\ninclude \"Election.i.dfy\"\r\ninclude \"Acceptor.i.dfy\"\r\n\r\nmodule LiveRSL__Proposer_i {\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__Broadcast_i\r\nimport opened LiveRSL__Acceptor_i\r\nimport opened LiveRSL__Election_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__Message_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Common__UpperBound_s\r\n\r\n///////////////////////////////////\r\n// DATATYPE DEFINITION\r\n///////////////////////////////////\r\n\r\ndatatype IncompleteBatchTimer = IncompleteBatchTimerOn(when:int) | IncompleteBatchTimerOff()\r\n\r\ndatatype LProposer = LProposer(\r\n constants:LReplicaConstants,\r\n // The replica constants, duplicated here for convenience\r\n\r\n current_state:int,\r\n // What state the proposer is in:\r\n // 0 = not leader\r\n // 1 = leader in phase 1\r\n // 2 = leader in phase 2\r\n\r\n request_queue:seq,\r\n // Values that clients have requested that I need to eventually\r\n // propose, in the order I should propose them\r\n\r\n max_ballot_i_sent_1a:Ballot,\r\n // The maximum ballot I've sent a 1a message for\r\n\r\n next_operation_number_to_propose:int,\r\n // The next operation number I should propose\r\n\r\n received_1b_packets:set,\r\n // The set of 1b messages I've received concerning max_ballot_i_sent_1a\r\n\r\n highest_seqno_requested_by_client_this_view:map,\r\n // For each client, the highest sequence number for a request\r\n // I proposed in max_ballot_i_sent_1a\r\n\r\n incomplete_batch_timer:IncompleteBatchTimer,\r\n // If the incomplete batch timer is set, it indicates when I should\r\n // give up on trying to amass a full-size batch and just propose\r\n // whatever I have. If it's not set, I shouldn't propose an\r\n // incomplete batch.\r\n\r\n election_state:ElectionState\r\n // State for view change election management\r\n )\r\n\r\n///////////////////////////////////\r\n// HELPER FUNCTIONS\r\n///////////////////////////////////\r\n \r\npredicate LIsAfterLogTruncationPoint(opn:OperationNumber, received_1b_packets:set)\r\n{\r\n (forall p :: p in received_1b_packets && p.msg.RslMessage_1b? ==> p.msg.log_truncation_point <= opn)\r\n}\r\n\r\npredicate LSetOfMessage1b(S:set)\r\n{\r\n forall p :: p in S ==> p.msg.RslMessage_1b?\r\n}\r\n\r\npredicate LSetOfMessage1bAboutBallot(S:set, b:Ballot)\r\n{\r\n && LSetOfMessage1b(S)\r\n && (forall p :: p in S ==> p.msg.bal_1b == b)\r\n}\r\n\r\npredicate LAllAcceptorsHadNoProposal(S:set, opn:OperationNumber)\r\n requires LSetOfMessage1b(S)\r\n{\r\n forall p :: p in S ==> !(opn in p.msg.votes)\r\n}\r\n\r\npredicate LMaxBallotInS(c:Ballot, S:set, opn:OperationNumber)\r\n requires LSetOfMessage1b(S)\r\n{\r\n forall p :: p in S && opn in p.msg.votes ==> BalLeq(p.msg.votes[opn].max_value_bal, c)\r\n}\r\n\r\npredicate LExistsBallotInS(v:RequestBatch, c:Ballot, S:set, opn:OperationNumber)\r\n requires LSetOfMessage1b(S)\r\n{\r\n exists p :: && p in S\r\n && opn in p.msg.votes\r\n && p.msg.votes[opn].max_value_bal==c\r\n && p.msg.votes[opn].max_val==v\r\n}\r\n\r\npredicate LValIsHighestNumberedProposalAtBallot(v:RequestBatch, c:Ballot, S:set, opn:OperationNumber)\r\n requires LSetOfMessage1b(S)\r\n{\r\n && LMaxBallotInS(c, S, opn)\r\n && LExistsBallotInS(v, c, S, opn)\r\n}\r\n\r\npredicate LValIsHighestNumberedProposal(v:RequestBatch, S:set, opn:OperationNumber)\r\n requires LSetOfMessage1b(S)\r\n{\r\n exists c :: LValIsHighestNumberedProposalAtBallot(v, c, S, opn)\r\n}\r\n\r\npredicate LProposerCanNominateUsingOperationNumber(s:LProposer, log_truncation_point:OperationNumber, opn:OperationNumber)\r\n{\r\n && s.election_state.current_view == s.max_ballot_i_sent_1a\r\n && s.current_state == 2\r\n && |s.received_1b_packets| >= LMinQuorumSize(s.constants.all.config)\r\n && LSetOfMessage1bAboutBallot(s.received_1b_packets, s.max_ballot_i_sent_1a)\r\n // Don't try to nominate for an operation that's already been truncated into history:\r\n && LIsAfterLogTruncationPoint(opn, s.received_1b_packets)\r\n // Don't try to nominate in an operation that's too far in the future; that would grow the log too much.\r\n && opn < UpperBoundedAddition(log_truncation_point, s.constants.all.params.max_log_length, s.constants.all.params.max_integer_val)\r\n // Disallow negative operations\r\n && opn >= 0\r\n // It must be possible to add one and still be representable, so we can compute next_operation_number_to_propose\r\n && LtUpperBound(opn, s.constants.all.params.max_integer_val)\r\n}\r\n\r\n///////////////////////////////////\r\n// INITIALIZATION\r\n///////////////////////////////////\r\n\r\npredicate LProposerInit(s:LProposer, c:LReplicaConstants)\r\n requires WellFormedLConfiguration(c.all.config)\r\n{\r\n && s.constants == c\r\n && s.current_state == 0\r\n && s.request_queue == []\r\n && s.max_ballot_i_sent_1a == Ballot(0, c.my_index)\r\n && s.next_operation_number_to_propose == 0\r\n && s.received_1b_packets == {}\r\n && s.highest_seqno_requested_by_client_this_view == map[]\r\n && ElectionStateInit(s.election_state, c)\r\n && s.incomplete_batch_timer.IncompleteBatchTimerOff?\r\n}\r\n\r\n///////////////////////////////////\r\n// ACTIONS\r\n///////////////////////////////////\r\n\r\npredicate LProposerProcessRequest(s:LProposer, s':LProposer, packet:RslPacket)\r\n requires packet.msg.RslMessage_Request?\r\n{\r\n var val := Request(packet.src, packet.msg.seqno_req, packet.msg.val);\r\n && ElectionStateReflectReceivedRequest(s.election_state, s'.election_state, val)\r\n && if && s.current_state != 0\r\n && (|| val.client !in s.highest_seqno_requested_by_client_this_view\r\n || val.seqno > s.highest_seqno_requested_by_client_this_view[val.client]) then\r\n s' == s.(election_state := s'.election_state,\r\n request_queue := s.request_queue + [val],\r\n highest_seqno_requested_by_client_this_view := s.highest_seqno_requested_by_client_this_view[val.client := val.seqno])\r\n else\r\n s' == s.(election_state := s'.election_state)\r\n}\r\n\r\npredicate LProposerMaybeEnterNewViewAndSend1a(s:LProposer, s':LProposer, sent_packets:seq)\r\n{\r\n if && s.election_state.current_view.proposer_id == s.constants.my_index\r\n && BalLt(s.max_ballot_i_sent_1a, s.election_state.current_view) then\r\n && s' == s.(current_state := 1,\r\n max_ballot_i_sent_1a := s.election_state.current_view,\r\n received_1b_packets := {},\r\n highest_seqno_requested_by_client_this_view := map[],\r\n request_queue := s.election_state.requests_received_prev_epochs + s.election_state.requests_received_this_epoch)\r\n && LBroadcastToEveryone(s.constants.all.config, s.constants.my_index, RslMessage_1a(s.election_state.current_view), sent_packets)\r\n else\r\n s' == s && sent_packets == []\r\n}\r\n\r\npredicate LProposerProcess1b(s:LProposer, s':LProposer, p:RslPacket)\r\n requires p.msg.RslMessage_1b?\r\n requires p.src in s.constants.all.config.replica_ids\r\n requires p.msg.bal_1b == s.max_ballot_i_sent_1a\r\n requires s.current_state == 1\r\n requires forall other_packet :: other_packet in s.received_1b_packets ==> other_packet.src != p.src\r\n{\r\n s' == s.(received_1b_packets := s.received_1b_packets + { p })\r\n}\r\n\r\npredicate LProposerMaybeEnterPhase2(s:LProposer, s':LProposer, log_truncation_point:OperationNumber, sent_packets:seq)\r\n{\r\n if && |s.received_1b_packets| >= LMinQuorumSize(s.constants.all.config)\r\n && LSetOfMessage1bAboutBallot(s.received_1b_packets, s.max_ballot_i_sent_1a)\r\n && s.current_state == 1 then\r\n && s' == s.(current_state := 2,\r\n next_operation_number_to_propose := log_truncation_point)\r\n && LBroadcastToEveryone(s.constants.all.config, s.constants.my_index,\r\n RslMessage_StartingPhase2(s.max_ballot_i_sent_1a, log_truncation_point), sent_packets)\r\n else\r\n s' == s && sent_packets == []\r\n}\r\n\r\npredicate LProposerNominateNewValueAndSend2a(s:LProposer, s':LProposer, clock:int, log_truncation_point:OperationNumber,\r\n sent_packets:seq)\r\n requires LProposerCanNominateUsingOperationNumber(s, log_truncation_point, s.next_operation_number_to_propose)\r\n requires LAllAcceptorsHadNoProposal(s.received_1b_packets, s.next_operation_number_to_propose)\r\n{\r\n var batchSize := if |s.request_queue| <= s.constants.all.params.max_batch_size || s.constants.all.params.max_batch_size < 0 then\r\n |s.request_queue|\r\n else\r\n s.constants.all.params.max_batch_size;\r\n var v := s.request_queue[..batchSize];\r\n var opn := s.next_operation_number_to_propose;\r\n && s' == s.(request_queue := s.request_queue[batchSize..],\r\n next_operation_number_to_propose := s.next_operation_number_to_propose + 1,\r\n incomplete_batch_timer := if |s.request_queue| > batchSize then IncompleteBatchTimerOn(UpperBoundedAddition(clock, s.constants.all.params.max_batch_delay, s.constants.all.params.max_integer_val)) else IncompleteBatchTimerOff())\r\n && LBroadcastToEveryone(s.constants.all.config, s.constants.my_index, RslMessage_2a(s.max_ballot_i_sent_1a, opn, v), sent_packets)\r\n}\r\n\r\npredicate LProposerNominateOldValueAndSend2a(s:LProposer, s':LProposer, log_truncation_point:OperationNumber, sent_packets:seq)\r\n requires LProposerCanNominateUsingOperationNumber(s, log_truncation_point, s.next_operation_number_to_propose)\r\n requires !LAllAcceptorsHadNoProposal(s.received_1b_packets, s.next_operation_number_to_propose)\r\n{\r\n var opn := s.next_operation_number_to_propose;\r\n exists v ::\r\n && LValIsHighestNumberedProposal(v, s.received_1b_packets, opn)\r\n && s' == s.(next_operation_number_to_propose := s.next_operation_number_to_propose + 1)\r\n && LBroadcastToEveryone(s.constants.all.config, s.constants.my_index, RslMessage_2a(s.max_ballot_i_sent_1a, opn, v), sent_packets)\r\n}\r\n\r\npredicate LProposerMaybeNominateValueAndSend2a(s:LProposer, s':LProposer, clock:int, log_truncation_point:int, sent_packets:seq)\r\n{\r\n if !LProposerCanNominateUsingOperationNumber(s, log_truncation_point, s.next_operation_number_to_propose) then\r\n s' == s && sent_packets == []\r\n else if !LAllAcceptorsHadNoProposal(s.received_1b_packets, s.next_operation_number_to_propose) then\r\n LProposerNominateOldValueAndSend2a(s, s', log_truncation_point, sent_packets)\r\n else if || (exists opn :: opn > s.next_operation_number_to_propose && !LAllAcceptorsHadNoProposal(s.received_1b_packets, opn))\r\n || |s.request_queue| >= s.constants.all.params.max_batch_size\r\n || (|s.request_queue| > 0 && s.incomplete_batch_timer.IncompleteBatchTimerOn? && clock >= s.incomplete_batch_timer.when) then\r\n LProposerNominateNewValueAndSend2a(s, s', clock, log_truncation_point, sent_packets)\r\n else if |s.request_queue| > 0 && s.incomplete_batch_timer.IncompleteBatchTimerOff? then\r\n && s' == s.(incomplete_batch_timer := IncompleteBatchTimerOn(UpperBoundedAddition(clock, s.constants.all.params.max_batch_delay, s.constants.all.params.max_integer_val)))\r\n && sent_packets == []\r\n else\r\n s' == s && sent_packets == []\r\n}\r\n\r\npredicate LProposerProcessHeartbeat(s:LProposer, s':LProposer, p:RslPacket, clock:int)\r\n requires p.msg.RslMessage_Heartbeat?\r\n{\r\n && ElectionStateProcessHeartbeat(s.election_state, s'.election_state, p, clock)\r\n && (if BalLt(s.election_state.current_view, s'.election_state.current_view) then\r\n s'.current_state == 0 && s'.request_queue == []\r\n else\r\n s'.current_state == s.current_state && s'.request_queue == s.request_queue\r\n )\r\n && s' == s.(election_state := s'.election_state,\r\n current_state := s'.current_state,\r\n request_queue := s'.request_queue)\r\n}\r\n\r\npredicate LProposerCheckForViewTimeout(s:LProposer, s':LProposer, clock:int)\r\n{\r\n && ElectionStateCheckForViewTimeout(s.election_state, s'.election_state, clock)\r\n && s' == s.(election_state := s'.election_state)\r\n}\r\n\r\npredicate LProposerCheckForQuorumOfViewSuspicions(s:LProposer, s':LProposer, clock:int)\r\n{\r\n && ElectionStateCheckForQuorumOfViewSuspicions(s.election_state, s'.election_state, clock)\r\n && (if BalLt(s.election_state.current_view, s'.election_state.current_view) then\r\n s'.current_state == 0 && s'.request_queue == []\r\n else\r\n s'.current_state == s.current_state && s'.request_queue == s.request_queue\r\n )\r\n && s' == s.(election_state := s'.election_state,\r\n current_state := s'.current_state,\r\n request_queue := s'.request_queue)\r\n}\r\n\r\npredicate LProposerResetViewTimerDueToExecution(s:LProposer, s':LProposer, val:RequestBatch)\r\n{\r\n && ElectionStateReflectExecutedRequestBatch(s.election_state, s'.election_state, val)\r\n && s' == s.(election_state := s'.election_state)\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/RefinementProof/Chosen.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../CommonProof/PacketSending.i.dfy\"\r\ninclude \"../CommonProof/Chosen.i.dfy\"\r\ninclude \"../../../Common/Collections/Seqs.s.dfy\"\r\ninclude \"../../../Common/Collections/Sets.i.dfy\"\r\ninclude \"HandleRequestBatch.i.dfy\"\r\n\r\nmodule DirectRefinement__Chosen_i {\r\n\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__StateMachine_i\r\nimport opened LiveRSL__Types_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Chosen_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Environment_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened Collections__Seqs_s\r\nimport opened Collections__Sets_i\r\nimport opened DirectRefinement__HandleRequestBatch_i\r\nimport opened Temporal__Temporal_s\r\n\r\npredicate IsValidQuorumOf2bsSequence(ps:RslState, qs:seq)\r\n{\r\n forall opn :: 0 <= opn < |qs| ==> qs[opn].opn == opn && IsValidQuorumOf2bs(ps, qs[opn])\r\n}\r\n\r\npredicate IsMaximalQuorumOf2bsSequence(ps:RslState, qs:seq)\r\n{\r\n && IsValidQuorumOf2bsSequence(ps, qs)\r\n && !exists q :: IsValidQuorumOf2bs(ps, q) && q.opn == |qs|\r\n}\r\n\r\nfunction GetSequenceOfRequestBatches(qs:seq):seq\r\n ensures |GetSequenceOfRequestBatches(qs)| == |qs|\r\n{\r\n if |qs| == 0 then\r\n []\r\n else\r\n GetSequenceOfRequestBatches(all_but_last(qs)) + [last(qs).v]\r\n}\r\n\r\nlemma lemma_SequenceOfRequestBatchesNthElement(qs:seq, n:int)\r\n requires 0 <= n < |qs|\r\n ensures GetSequenceOfRequestBatches(qs)[n] == qs[n].v\r\n{\r\n if n < |qs| - 1\r\n {\r\n lemma_SequenceOfRequestBatchesNthElement(all_but_last(qs), n);\r\n }\r\n}\r\n\r\nlemma lemma_GetUpperBoundOnQuorumOf2bsOperationNumber(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int\r\n ) returns (\r\n bound:OperationNumber\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n ensures bound >= 0\r\n ensures !exists q :: IsValidQuorumOf2bs(b[i], q) && q.opn == bound\r\n{\r\n var opns := set p | p in b[i].environment.sentPackets && p.msg.RslMessage_2b? :: p.msg.opn_2b;\r\n bound := if |opns| > 0 && intsetmax(opns) >= 0 then intsetmax(opns) + 1 else 1;\r\n if exists q :: IsValidQuorumOf2bs(b[i], q) && q.opn == bound\r\n {\r\n var q :| IsValidQuorumOf2bs(b[i], q) && q.opn == bound;\r\n var idx :| idx in q.indices;\r\n var p := q.packets[idx];\r\n assert p.msg.opn_2b in opns;\r\n assert p.msg.opn_2b > intsetmax(opns);\r\n assert p.msg.opn_2b in opns;\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_GetMaximalQuorumOf2bsSequenceWithinBound(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n bound:OperationNumber\r\n ) returns (\r\n qs:seq\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= bound\r\n ensures IsValidQuorumOf2bsSequence(b[i], qs)\r\n ensures |qs| == bound || !exists q :: IsValidQuorumOf2bs(b[i], q) && q.opn == |qs|\r\n{\r\n if bound == 0\r\n {\r\n qs := [];\r\n return;\r\n }\r\n\r\n qs := lemma_GetMaximalQuorumOf2bsSequenceWithinBound(b, c, i, bound-1);\r\n if !exists q :: IsValidQuorumOf2bs(b[i], q) && q.opn == |qs|\r\n {\r\n return;\r\n }\r\n\r\n assert |qs| == bound - 1;\r\n var q :| IsValidQuorumOf2bs(b[i], q) && q.opn == bound - 1;\r\n qs := qs + [q];\r\n}\r\n\r\nlemma lemma_GetMaximalQuorumOf2bsSequence(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int\r\n ) returns (\r\n qs:seq\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n ensures IsMaximalQuorumOf2bsSequence(b[i], qs)\r\n{\r\n var bound := lemma_GetUpperBoundOnQuorumOf2bsOperationNumber(b, c, i);\r\n qs := lemma_GetMaximalQuorumOf2bsSequenceWithinBound(b, c, i, bound);\r\n}\r\n\r\nlemma lemma_IfValidQuorumOf2bsSequenceNowThenNext(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n qs:seq\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1)\r\n requires 0 <= i\r\n requires IsValidQuorumOf2bsSequence(b[i], qs)\r\n ensures IsValidQuorumOf2bsSequence(b[i+1], qs)\r\n{\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_ConstantsAllConsistent(b, c, i+1);\r\n\r\n forall opn | 0 <= opn < |qs|\r\n ensures qs[opn].opn == opn\r\n ensures IsValidQuorumOf2bs(b[i+1], qs[opn])\r\n {\r\n assert qs[opn].opn == opn && IsValidQuorumOf2bs(b[i], qs[opn]);\r\n forall idx | idx in qs[opn].indices\r\n ensures qs[opn].packets[idx] in b[i+1].environment.sentPackets\r\n {\r\n lemma_PacketStaysInSentPackets(b, c, i, i+1, qs[opn].packets[idx]);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_TwoMaximalQuorumsOf2bsMatch(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n qs1:seq,\r\n qs2:seq\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires IsMaximalQuorumOf2bsSequence(b[i], qs1)\r\n requires IsMaximalQuorumOf2bsSequence(b[i], qs2)\r\n ensures GetSequenceOfRequestBatches(qs1) == GetSequenceOfRequestBatches(qs2)\r\n{\r\n var batches1 := GetSequenceOfRequestBatches(qs1);\r\n var batches2 := GetSequenceOfRequestBatches(qs2);\r\n\r\n if |qs1| > |qs2|\r\n {\r\n assert IsValidQuorumOf2bs(b[i], qs1[|qs2|]) && qs1[|qs2|].opn == |qs2|;\r\n assert false;\r\n }\r\n if |qs2| > |qs1|\r\n {\r\n assert IsValidQuorumOf2bs(b[i], qs2[|qs1|]) && qs2[|qs1|].opn == |qs1|;\r\n assert false;\r\n }\r\n \r\n forall opn | 0 <= opn < |qs1|\r\n ensures batches1[opn] == batches2[opn]\r\n {\r\n lemma_ChosenQuorumsMatchValue(b, c, i, qs1[opn], qs2[opn]);\r\n lemma_SequenceOfRequestBatchesNthElement(qs1, opn);\r\n lemma_SequenceOfRequestBatchesNthElement(qs2, opn);\r\n }\r\n}\r\n\r\nlemma lemma_RegularQuorumOf2bSequenceIsPrefixOfMaximalQuorumOf2bSequence(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n qs_regular:seq,\r\n qs_maximal:seq\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires IsValidQuorumOf2bsSequence(b[i], qs_regular)\r\n requires IsMaximalQuorumOf2bsSequence(b[i], qs_maximal)\r\n ensures |GetSequenceOfRequestBatches(qs_regular)| <= |GetSequenceOfRequestBatches(qs_maximal)|\r\n ensures GetSequenceOfRequestBatches(qs_regular) == GetSequenceOfRequestBatches(qs_maximal)[..|GetSequenceOfRequestBatches(qs_regular)|]\r\n{\r\n var batches1 := GetSequenceOfRequestBatches(qs_regular);\r\n var batches2 := GetSequenceOfRequestBatches(qs_maximal);\r\n\r\n if |qs_regular| > |qs_maximal|\r\n {\r\n assert IsValidQuorumOf2bs(b[i], qs_regular[|qs_maximal|]) && qs_regular[|qs_maximal|].opn == |qs_maximal|;\r\n assert false;\r\n }\r\n \r\n forall opn | 0 <= opn < |qs_regular|\r\n ensures batches1[opn] == batches2[opn]\r\n {\r\n lemma_ChosenQuorumsMatchValue(b, c, i, qs_regular[opn], qs_maximal[opn]);\r\n lemma_SequenceOfRequestBatchesNthElement(qs_regular, opn);\r\n lemma_SequenceOfRequestBatchesNthElement(qs_maximal, opn);\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/RefinementProof/Execution.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"../CommonProof/Assumptions.i.dfy\"\r\ninclude \"../CommonProof/Constants.i.dfy\"\r\ninclude \"../CommonProof/Actions.i.dfy\"\r\ninclude \"../CommonProof/Environment.i.dfy\"\r\ninclude \"../CommonProof/PacketSending.i.dfy\"\r\ninclude \"../CommonProof/Chosen.i.dfy\"\r\ninclude \"Chosen.i.dfy\"\r\n\r\nmodule DirectRefinement__Execution_i {\r\n\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__StateMachine_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Chosen_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Environment_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened DirectRefinement__Chosen_i\r\nimport opened DirectRefinement__HandleRequestBatch_i\r\nimport opened Environment_s\r\nimport opened Temporal__Temporal_s\r\nimport opened Common__UpperBound_s\r\nimport opened Collections__Seqs_s\r\n\r\n//////////////////////////////\r\n// APP STATE\r\n//////////////////////////////\r\n\r\nlemma lemma_AppStateAlwaysValid(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int\r\n ) returns (\r\n qs:seq\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n ensures IsValidQuorumOf2bsSequence(b[i], qs)\r\n ensures |qs| == b[i].replicas[idx].replica.executor.ops_complete\r\n ensures b[i].replicas[idx].replica.executor.app == GetAppStateFromRequestBatches(GetSequenceOfRequestBatches(qs))\r\n decreases i\r\n{\r\n if i == 0\r\n {\r\n qs := [];\r\n return;\r\n }\r\n\r\n lemma_ReplicaConstantsAllConsistent(b, c, i, idx);\r\n lemma_ReplicaConstantsAllConsistent(b, c, i-1, idx);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n var s := b[i-1].replicas[idx].replica.executor;\r\n var s' := b[i].replicas[idx].replica.executor;\r\n\r\n if s'.ops_complete == s.ops_complete\r\n {\r\n qs := lemma_AppStateAlwaysValid(b, c, i-1, idx);\r\n lemma_IfValidQuorumOf2bsSequenceNowThenNext(b, c, i-1, qs);\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n if b[i-1].replicas[idx].nextActionIndex == 0\r\n {\r\n var p := ios[0].r;\r\n qs := lemma_TransferredStateAlwaysValid(b, c, i-1, p);\r\n return;\r\n }\r\n\r\n var prev_qs := lemma_AppStateAlwaysValid(b, c, i-1, idx);\r\n var q := lemma_DecidedOperationWasChosen(b, c, i-1, idx);\r\n qs := prev_qs + [q];\r\n assert GetSequenceOfRequestBatches(qs) == GetSequenceOfRequestBatches(prev_qs) + [q.v];\r\n}\r\n\r\nlemma lemma_TransferredStateAlwaysValid(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p:RslPacket\r\n ) returns (\r\n qs:seq\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in c.config.replica_ids\r\n requires p.msg.RslMessage_AppStateSupply?\r\n ensures IsValidQuorumOf2bsSequence(b[i], qs)\r\n ensures |qs| == p.msg.opn_state_supply\r\n ensures p.msg.app_state == GetAppStateFromRequestBatches(GetSequenceOfRequestBatches(qs))\r\n decreases i\r\n{\r\n if i == 0 { return; }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n qs := lemma_TransferredStateAlwaysValid(b, c, i-1, p);\r\n lemma_IfValidQuorumOf2bsSequenceNowThenNext(b, c, i-1, qs);\r\n return;\r\n }\r\n\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n var idx, ios := lemma_ActionThatSendsAppStateSupplyIsProcessAppStateRequest(b[i-1], b[i], p);\r\n qs := lemma_AppStateAlwaysValid(b, c, i-1, idx);\r\n}\r\n\r\n//////////////////////////////\r\n// REPLY CACHE\r\n//////////////////////////////\r\n\r\nlemma lemma_ReplyInReplyCacheIsAllowed(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n client:NodeIdentity,\r\n idx:int\r\n ) returns (\r\n qs:seq,\r\n batches:seq,\r\n batch_num:int,\r\n req_num:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1)\r\n requires 0 <= i\r\n requires 0 <= idx < |c.config.replica_ids|\r\n requires 0 <= idx < |b[i].replicas|\r\n requires client in b[i].replicas[idx].replica.executor.reply_cache\r\n ensures IsValidQuorumOf2bsSequence(b[i], qs)\r\n ensures batches == GetSequenceOfRequestBatches(qs)\r\n ensures 0 <= batch_num < |batches|\r\n ensures 0 <= req_num < |batches[batch_num]|\r\n ensures b[i].replicas[idx].replica.executor.reply_cache[client] == GetReplyFromRequestBatches(batches, batch_num, req_num)\r\n decreases i\r\n{\r\n if i == 0 { return; }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n var s := b[i-1].replicas[idx].replica.executor;\r\n var s' := b[i].replicas[idx].replica.executor;\r\n if client in s.reply_cache && s'.reply_cache[client] == s.reply_cache[client]\r\n {\r\n qs, batches, batch_num, req_num := lemma_ReplyInReplyCacheIsAllowed(b, c, i-1, client, idx);\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n var nextActionIndex := b[i-1].replicas[idx].nextActionIndex;\r\n if nextActionIndex == 0\r\n {\r\n var p := ios[0].r;\r\n return;\r\n }\r\n\r\n assert nextActionIndex == 6;\r\n\r\n var qs_prev := lemma_AppStateAlwaysValid(b, c, i-1, idx);\r\n var q := lemma_DecidedOperationWasChosen(b, c, i-1, idx);\r\n qs := qs_prev + [q];\r\n batches := GetSequenceOfRequestBatches(qs);\r\n batch_num := |qs_prev|;\r\n\r\n assert GetSequenceOfRequestBatches(qs_prev) == batches[..batch_num];\r\n\r\n assert s.app == GetAppStateFromRequestBatches(GetSequenceOfRequestBatches(qs_prev));\r\n\r\n var batch := s.next_op_to_execute.v;\r\n var replies := HandleRequestBatch(s.app, batch).1;\r\n\r\n req_num :| 0 <= req_num < |batch| && replies[req_num].client == client && s'.reply_cache[client] == replies[req_num];\r\n}\r\n\r\n//////////////////////////////\r\n// REPLIES\r\n//////////////////////////////\r\n\r\nlemma lemma_GetRequestIndexCorrespondingToPacketInGetPacketsFromReplies(\r\n p:RslPacket,\r\n me:NodeIdentity,\r\n requests:seq,\r\n replies:seq\r\n ) returns (\r\n i:int\r\n )\r\n requires |requests| == |replies|\r\n requires forall r :: r in replies ==> r.Reply?\r\n requires p in GetPacketsFromReplies(me, requests, replies)\r\n ensures 0 <= i < |requests|\r\n ensures p.src == me\r\n ensures p.dst == requests[i].client\r\n ensures p.msg.RslMessage_Reply?\r\n ensures p.msg.seqno_reply == requests[i].seqno\r\n ensures p.msg.reply == replies[i].reply\r\n{\r\n if |requests| == 0\r\n {\r\n assert false;\r\n }\r\n\r\n if p == LPacket(requests[0].client, me, RslMessage_Reply(requests[0].seqno, replies[0].reply))\r\n {\r\n i := 0;\r\n }\r\n else\r\n {\r\n var i_minus_1 := lemma_GetRequestIndexCorrespondingToPacketInGetPacketsFromReplies(p, me, requests[1..], replies[1..]);\r\n i := i_minus_1 + 1;\r\n }\r\n}\r\n\r\nlemma lemma_ReplySentViaExecutionIsAllowed(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p:RslPacket,\r\n idx:int,\r\n ios:seq\r\n ) returns (\r\n qs:seq,\r\n batches:seq,\r\n batch_num:int,\r\n req_num:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i+1)\r\n requires 0 <= i\r\n requires 0 <= idx < |c.config.replica_ids|\r\n requires 0 <= idx < |b[i].replicas|\r\n requires LIoOpSend(p) in ios\r\n requires RslNext(b[i], b[i+1])\r\n requires b[i].environment.nextStep == LEnvStepHostIos(c.config.replica_ids[idx], ios)\r\n requires b[i].replicas[idx].replica.executor.next_op_to_execute.OutstandingOpKnown?\r\n requires LtUpperBound(b[i].replicas[idx].replica.executor.ops_complete,\r\n b[i].replicas[idx].replica.executor.constants.all.params.max_integer_val)\r\n requires LReplicaConstantsValid(b[i].replicas[idx].replica.executor.constants)\r\n requires LExecutorExecute(b[i].replicas[idx].replica.executor, b[i+1].replicas[idx].replica.executor, ExtractSentPacketsFromIos(ios))\r\n ensures IsValidQuorumOf2bsSequence(b[i], qs)\r\n ensures batches == GetSequenceOfRequestBatches(qs)\r\n ensures 0 <= batch_num < |batches|\r\n ensures 0 <= req_num < |batches[batch_num]|\r\n ensures Reply(p.dst, p.msg.seqno_reply, p.msg.reply) == GetReplyFromRequestBatches(batches, batch_num, req_num)\r\n{\r\n lemma_ReplicaConstantsAllConsistent(b, c, i, idx);\r\n lemma_ReplicaConstantsAllConsistent(b, c, i+1, idx);\r\n\r\n var qs_prev := lemma_AppStateAlwaysValid(b, c, i, idx);\r\n var q := lemma_DecidedOperationWasChosen(b, c, i, idx);\r\n qs := qs_prev + [q];\r\n batches := GetSequenceOfRequestBatches(qs);\r\n batch_num := |qs_prev|;\r\n\r\n assert GetSequenceOfRequestBatches(qs_prev) == batches[..batch_num];\r\n\r\n var s := b[i].replicas[idx].replica.executor;\r\n assert s.app == GetAppStateFromRequestBatches(GetSequenceOfRequestBatches(qs_prev));\r\n\r\n var batch := s.next_op_to_execute.v;\r\n var temp := HandleRequestBatch(s.app, batch);\r\n lemma_HandleRequestBatchTriggerHappy(s.app, batch, temp.0, temp.1);\r\n var new_state := last(temp.0);\r\n var replies := temp.1;\r\n var me := c.config.replica_ids[idx];\r\n\r\n assert p in GetPacketsFromReplies(me, batch, replies);\r\n assert p.src == c.config.replica_ids[idx];\r\n req_num := lemma_GetRequestIndexCorrespondingToPacketInGetPacketsFromReplies(p, me, batch, replies);\r\n var reply := Reply(p.dst, p.msg.seqno_reply, p.msg.reply);\r\n assert reply == replies[req_num];\r\n}\r\n\r\nlemma lemma_ReplySentIsAllowed(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p:RslPacket\r\n ) returns (\r\n qs:seq,\r\n batches:seq,\r\n batch_num:int,\r\n req_num:int\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p in b[i].environment.sentPackets\r\n requires p.src in c.config.replica_ids\r\n requires p.msg.RslMessage_Reply?\r\n ensures IsValidQuorumOf2bsSequence(b[i], qs)\r\n ensures batches == GetSequenceOfRequestBatches(qs)\r\n ensures 0 <= batch_num < |batches|\r\n ensures 0 <= req_num < |batches[batch_num]|\r\n ensures Reply(p.dst, p.msg.seqno_reply, p.msg.reply) == GetReplyFromRequestBatches(batches, batch_num, req_num)\r\n decreases i\r\n{\r\n if i == 0 { return; }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n if p in b[i-1].environment.sentPackets\r\n {\r\n qs, batches, batch_num, req_num := lemma_ReplySentIsAllowed(b, c, i-1, p);\r\n lemma_IfValidQuorumOf2bsSequenceNowThenNext(b, c, i-1, qs);\r\n return;\r\n }\r\n\r\n assert b[i-1].environment.nextStep.LEnvStepHostIos?;\r\n assert LIoOpSend(p) in b[i-1].environment.nextStep.ios;\r\n var idx := GetReplicaIndex(b[i-1].environment.nextStep.actor, c.config);\r\n var ios := b[i-1].environment.nextStep.ios;\r\n var idx_alt :| RslNextOneReplica(b[i-1], b[i], idx_alt, ios);\r\n assert ReplicasDistinct(c.config.replica_ids, idx, idx_alt);\r\n\r\n var nextActionIndex := b[i-1].replicas[idx].nextActionIndex;\r\n if nextActionIndex == 0\r\n {\r\n qs, batches, batch_num, req_num := lemma_ReplyInReplyCacheIsAllowed(b, c, i-1, ios[0].r.src, idx);\r\n lemma_IfValidQuorumOf2bsSequenceNowThenNext(b, c, i-1, qs);\r\n }\r\n else if nextActionIndex == 6\r\n {\r\n qs, batches, batch_num, req_num := lemma_ReplySentViaExecutionIsAllowed(b, c, i-1, p, idx, ios);\r\n lemma_IfValidQuorumOf2bsSequenceNowThenNext(b, c, i-1, qs);\r\n }\r\n else\r\n {\r\n assert false;\r\n }\r\n}\r\n \r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/RefinementProof/HandleRequestBatch.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"../../../Common/Collections/Seqs.s.dfy\"\r\n\r\nmodule DirectRefinement__HandleRequestBatch_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__StateMachine_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Collections__Seqs_s\r\nimport opened AppStateMachine_s\r\n\r\nfunction GetAppStateFromRequestBatches(batches:seq):AppState\r\n{\r\n if |batches| == 0 then\r\n AppInitialize()\r\n else\r\n last(HandleRequestBatch(GetAppStateFromRequestBatches(all_but_last(batches)), last(batches)).0)\r\n}\r\n\r\nfunction GetReplyFromRequestBatches(batches:seq, batch_num:int, req_num:int):Reply\r\n requires 0 <= batch_num < |batches|\r\n requires 0 <= req_num < |batches[batch_num]|\r\n{\r\n var prev_state := GetAppStateFromRequestBatches(batches[..batch_num]);\r\n var result := HandleRequestBatch(prev_state, batches[batch_num]);\r\n result.1[req_num]\r\n}\r\n\r\nlemma lemma_GetReplyFromRequestBatchesMatchesInSubsequence(batches1:seq, batches2:seq,\r\n batch_num:int, req_num:int)\r\n requires 0 <= batch_num < |batches1| <= |batches2|\r\n requires batches1 == batches2[..|batches1|]\r\n requires 0 <= req_num < |batches1[batch_num]|\r\n ensures GetReplyFromRequestBatches(batches1, batch_num, req_num) == GetReplyFromRequestBatches(batches2, batch_num, req_num)\r\n{\r\n assert batches1[..batch_num] == batches2[..batch_num];\r\n assert batches1[batch_num] == batches2[batch_num];\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/RefinementProof/Refinement.i.dfy", "content": "include \"StateMachine.i.dfy\"\r\ninclude \"HandleRequestBatch.i.dfy\"\r\ninclude \"Chosen.i.dfy\"\r\ninclude \"Execution.i.dfy\"\r\ninclude \"Requests.i.dfy\"\r\ninclude \"../DistributedSystem.i.dfy\"\r\ninclude \"../CommonProof/Chosen.i.dfy\"\r\ninclude \"../../../Common/Collections/Seqs.s.dfy\"\r\n \r\nmodule DirectRefinement__Refinement_i {\r\n\r\nimport opened DirectRefinement__StateMachine_i\r\nimport opened DirectRefinement__HandleRequestBatch_i\r\nimport opened DirectRefinement__Chosen_i\r\nimport opened DirectRefinement__Execution_i\r\nimport opened DirectRefinement__Requests_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__StateMachine_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Chosen_i\r\nimport opened CommonProof__Constants_i\r\nimport opened Collections__Seqs_s\r\nimport opened Collections__Sets_i\r\nimport opened Collections__Maps2_s\r\nimport opened Temporal__Temporal_s\r\nimport opened AppStateMachine_s\r\n\r\nfunction GetServerAddresses(ps:RslState):set\r\n{\r\n MapSeqToSet(ps.constants.config.replica_ids, x=>x)\r\n}\r\n\r\nfunction ProduceIntermediateAbstractState(server_addresses:set, batches:seq, reqs_in_last_batch:int)\r\n :RSLSystemState\r\n requires |batches| > 0\r\n requires 0 <= reqs_in_last_batch <= |last(batches)|\r\n{\r\n var requests := set batch_num, req_num | 0 <= batch_num < |batches| && 0 <= req_num < (if batch_num == |batches|-1 then reqs_in_last_batch else |batches[batch_num]|) :: batches[batch_num][req_num];\r\n var replies := set batch_num, req_num | 0 <= batch_num < |batches| && 0 <= req_num < (if batch_num == |batches|-1 then reqs_in_last_batch else |batches[batch_num]|) :: GetReplyFromRequestBatches(batches, batch_num, req_num);\r\n var stateBeforePrevBatch := GetAppStateFromRequestBatches(all_but_last(batches));\r\n var appStatesDuringBatch := HandleRequestBatch(stateBeforePrevBatch, last(batches)).0;\r\n RSLSystemState(server_addresses, appStatesDuringBatch[reqs_in_last_batch], requests, replies)\r\n}\r\n\r\nfunction ProduceAbstractState(server_addresses:set, batches:seq):RSLSystemState\r\n{\r\n var requests := set batch_num, req_num | 0 <= batch_num < |batches| && 0 <= req_num < |batches[batch_num]| :: batches[batch_num][req_num];\r\n var replies := set batch_num, req_num | 0 <= batch_num < |batches| && 0 <= req_num < |batches[batch_num]|\r\n :: GetReplyFromRequestBatches(batches, batch_num, req_num);\r\n RSLSystemState(server_addresses, GetAppStateFromRequestBatches(batches), requests, replies)\r\n}\r\n\r\npredicate SystemRefinementRelation(ps:RslState, rs:RSLSystemState)\r\n{\r\n exists qs :: IsMaximalQuorumOf2bsSequence(ps, qs) && rs == ProduceAbstractState(GetServerAddresses(ps), GetSequenceOfRequestBatches(qs))\r\n}\r\n\r\nlemma lemma_ProduceAbstractStateSatisfiesRefinementRelation(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n qs:seq,\r\n rs:RSLSystemState\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires IsMaximalQuorumOf2bsSequence(b[i], qs)\r\n requires rs == ProduceAbstractState(GetServerAddresses(b[i]), GetSequenceOfRequestBatches(qs))\r\n ensures RslSystemRefinement(b[i], rs)\r\n{\r\n var ps := b[i];\r\n var batches := GetSequenceOfRequestBatches(qs);\r\n\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n \r\n forall p | p in ps.environment.sentPackets && p.src in rs.server_addresses && p.msg.RslMessage_Reply?\r\n ensures Reply(p.dst, p.msg.seqno_reply, p.msg.reply) in rs.replies\r\n {\r\n assert p.src in GetServerAddresses(ps);\r\n var qs', batches', batch_num, req_num := lemma_ReplySentIsAllowed(b, c, i, p);\r\n lemma_RegularQuorumOf2bSequenceIsPrefixOfMaximalQuorumOf2bSequence(b, c, i, qs', qs);\r\n lemma_GetReplyFromRequestBatchesMatchesInSubsequence(batches', batches, batch_num, req_num);\r\n }\r\n\r\n forall req | req in rs.requests\r\n ensures exists p :: && p in ps.environment.sentPackets\r\n && p.dst in rs.server_addresses\r\n && p.msg.RslMessage_Request?\r\n && req == Request(p.src, p.msg.seqno_req, p.msg.val);\r\n {\r\n var batch_num, req_num :| 0 <= batch_num < |batches| && 0 <= req_num < |batches[batch_num]| && req == batches[batch_num][req_num];\r\n var p := lemma_DecidedRequestWasSentByClient(b, c, i, qs, batches, batch_num, req_num);\r\n }\r\n}\r\n\r\nlemma lemma_ProduceIntermediateAbstractStatesSatisfiesNext(\r\n server_addresses:set,\r\n batches:seq,\r\n reqs_in_last_batch:int\r\n ) returns (\r\n request:Request\r\n )\r\n requires |batches| > 0\r\n requires 0 <= reqs_in_last_batch < |last(batches)|\r\n requires |last(batches)[reqs_in_last_batch].request| <= MaxAppRequestSize()\r\n ensures request == last(batches)[reqs_in_last_batch]\r\n ensures RslSystemNextServerExecutesRequest(ProduceIntermediateAbstractState(server_addresses, batches, reqs_in_last_batch),\r\n ProduceIntermediateAbstractState(server_addresses, batches, reqs_in_last_batch+1), request)\r\n{\r\n var rs := ProduceIntermediateAbstractState(server_addresses, batches, reqs_in_last_batch);\r\n var rs' := ProduceIntermediateAbstractState(server_addresses, batches, reqs_in_last_batch+1);\r\n\r\n request := last(batches)[reqs_in_last_batch];\r\n var reply := GetReplyFromRequestBatches(batches, |batches|-1, reqs_in_last_batch);\r\n\r\n assert rs'.requests == rs.requests + { request };\r\n assert rs'.replies == rs.replies + { reply };\r\n\r\n var stateBeforePrevBatch := GetAppStateFromRequestBatches(all_but_last(batches));\r\n var appStatesDuringBatch := HandleRequestBatch(stateBeforePrevBatch, last(batches)).0;\r\n var g_replies := HandleRequestBatch(stateBeforePrevBatch, last(batches)).1;\r\n lemma_HandleRequestBatchTriggerHappy(stateBeforePrevBatch, last(batches), appStatesDuringBatch, g_replies);\r\n var result := AppHandleRequest(rs.app, last(batches)[reqs_in_last_batch].request);\r\n assert rs'.app == result.0;\r\n assert reply.reply == result.1;\r\n\r\n assert RslSystemNextServerExecutesRequest(rs, rs', request);\r\n}\r\n\r\nlemma lemma_FirstProduceIntermediateAbstractStateProducesAbstractState(\r\n server_addresses:set,\r\n batches:seq\r\n )\r\n requires |batches| > 0\r\n ensures ProduceAbstractState(server_addresses, all_but_last(batches)) == ProduceIntermediateAbstractState(server_addresses, batches, 0)\r\n{\r\n var rs := ProduceAbstractState(server_addresses, all_but_last(batches));\r\n var rs' := ProduceIntermediateAbstractState(server_addresses, batches, 0);\r\n\r\n var requests := set batch_num, req_num | 0 <= batch_num < |batches| && 0 <= req_num < (if batch_num == |batches|-1 then 0 else |batches[batch_num]|) :: batches[batch_num][req_num];\r\n var replies := set batch_num, req_num | 0 <= batch_num < |batches| && 0 <= req_num < (if batch_num == |batches|-1 then 0 else |batches[batch_num]|) :: GetReplyFromRequestBatches(batches, batch_num, req_num);\r\n var stateBeforePrevBatch := GetAppStateFromRequestBatches(all_but_last(batches));\r\n var appStatesDuringBatch := HandleRequestBatch(stateBeforePrevBatch, last(batches)).0;\r\n var replies' := HandleRequestBatch(stateBeforePrevBatch, last(batches)).1;\r\n lemma_HandleRequestBatchTriggerHappy(stateBeforePrevBatch, last(batches), appStatesDuringBatch, replies');\r\n\r\n forall req | req in rs'.requests\r\n ensures req in rs.requests\r\n {\r\n var batch_num, req_num :| && 0 <= batch_num < |batches|\r\n && 0 <= req_num < (if batch_num == |batches|-1 then 0 else |batches[batch_num]|)\r\n && req == batches[batch_num][req_num];\r\n assert 0 <= batch_num < |all_but_last(batches)|;\r\n assert 0 <= req_num < |batches[batch_num]|;\r\n assert 0 <= req_num < |all_but_last(batches)[batch_num]|;\r\n }\r\n\r\n assert rs'.requests == rs.requests;\r\n\r\n forall reply | reply in rs'.replies\r\n ensures reply in rs.replies\r\n {\r\n var batch_num, req_num :| && 0 <= batch_num < |batches|\r\n && 0 <= req_num < (if batch_num == |batches|-1 then 0 else |batches[batch_num]|)\r\n && reply == GetReplyFromRequestBatches(batches, batch_num, req_num);\r\n assert 0 <= batch_num < |all_but_last(batches)|;\r\n assert 0 <= req_num < |batches[batch_num]|;\r\n assert 0 <= req_num < |all_but_last(batches)[batch_num]|;\r\n lemma_GetReplyFromRequestBatchesMatchesInSubsequence(all_but_last(batches), batches, batch_num, req_num);\r\n }\r\n\r\n forall reply | reply in rs.replies\r\n ensures reply in rs'.replies\r\n {\r\n var batch_num, req_num :| && 0 <= batch_num < |all_but_last(batches)|\r\n && 0 <= req_num < |batches[batch_num]|\r\n && reply == GetReplyFromRequestBatches(all_but_last(batches), batch_num, req_num);\r\n lemma_GetReplyFromRequestBatchesMatchesInSubsequence(all_but_last(batches), batches, batch_num, req_num);\r\n }\r\n\r\n assert rs'.replies == rs.replies;\r\n}\r\n\r\nlemma lemma_LastProduceIntermediateAbstractStateProducesAbstractState(\r\n server_addresses:set,\r\n batches:seq\r\n )\r\n requires |batches| > 0\r\n ensures ProduceAbstractState(server_addresses, batches) == ProduceIntermediateAbstractState(server_addresses, batches, |last(batches)|)\r\n{\r\n var rs := ProduceAbstractState(server_addresses, batches);\r\n var rs' := ProduceIntermediateAbstractState(server_addresses, batches, |last(batches)|);\r\n\r\n assert rs'.requests == rs.requests;\r\n\r\n forall reply | reply in rs'.replies\r\n ensures reply in rs.replies\r\n {\r\n var batch_num, req_num :| && 0 <= batch_num < |batches|\r\n && 0 <= req_num < (if batch_num == |batches|-1 then |last(batches)| else |batches[batch_num]|)\r\n && reply == GetReplyFromRequestBatches(batches, batch_num, req_num);\r\n assert 0 <= req_num < |batches[batch_num]|;\r\n }\r\n\r\n assert rs'.replies == rs.replies;\r\n}\r\n\r\nfunction {:opaque} ConvertBehaviorSeqToImap(s:seq):imap\r\n requires |s| > 0\r\n ensures imaptotal(ConvertBehaviorSeqToImap(s))\r\n ensures forall i :: 0 <= i < |s| ==> ConvertBehaviorSeqToImap(s)[i] == s[i]\r\n{\r\n imap i {:trigger s[i]} :: if i < 0 then s[0] else if 0 <= i < |s| then s[i] else last(s)\r\n}\r\n\r\npredicate RslSystemBehaviorRefinementCorrectImap(\r\n b:Behavior,\r\n prefix_len:int,\r\n high_level_behavior:seq\r\n )\r\n{\r\n && imaptotal(b)\r\n && |high_level_behavior| == prefix_len\r\n && (forall i :: 0 <= i < prefix_len ==> RslSystemRefinement(b[i], high_level_behavior[i]))\r\n && |high_level_behavior| > 0\r\n && RslSystemInit(high_level_behavior[0], MapSeqToSet(b[0].constants.config.replica_ids, x=>x))\r\n && (forall i {:trigger RslSystemNext(high_level_behavior[i], high_level_behavior[i+1])} ::\r\n 0 <= i < |high_level_behavior| - 1 ==> RslSystemNext(high_level_behavior[i], high_level_behavior[i+1]))\r\n}\r\n\r\nlemma lemma_GetBehaviorRefinementForBehaviorOfOneStep(\r\n b:Behavior,\r\n c:LConstants\r\n ) returns (\r\n high_level_behavior:seq\r\n )\r\n requires imaptotal(b)\r\n requires RslInit(c, b[0])\r\n ensures RslSystemBehaviorRefinementCorrectImap(b, 1, high_level_behavior)\r\n ensures |high_level_behavior| == 1\r\n ensures SystemRefinementRelation(b[0], high_level_behavior[0])\r\n{\r\n var qs := [];\r\n var rs := ProduceAbstractState(GetServerAddresses(b[0]), GetSequenceOfRequestBatches(qs));\r\n if exists q :: IsValidQuorumOf2bs(b[0], q) && q.opn == 0\r\n {\r\n var q :| IsValidQuorumOf2bs(b[0], q) && q.opn == 0;\r\n var idx :| idx in q.indices;\r\n var packet := q.packets[idx];\r\n assert false;\r\n }\r\n assert IsMaximalQuorumOf2bsSequence(b[0], qs);\r\n assert SystemRefinementRelation(b[0], rs);\r\n high_level_behavior := [ rs ];\r\n}\r\n\r\nlemma lemma_DemonstrateRslSystemNextWhenBatchExtended(\r\n server_addresses:set,\r\n s:RSLSystemState,\r\n s':RSLSystemState,\r\n batches:seq,\r\n count:int\r\n ) returns (\r\n intermediate_states:seq,\r\n batch:seq\r\n )\r\n requires |batches| > 0\r\n requires 0 <= count <= |last(batches)|\r\n requires forall req, batch :: batch in batches && req in batch ==> |req.request| <= MaxAppRequestSize()\r\n requires s == ProduceIntermediateAbstractState(server_addresses, batches, 0)\r\n requires s' == ProduceIntermediateAbstractState(server_addresses, batches, count)\r\n ensures RslStateSequenceReflectsBatchExecution(s, s', intermediate_states, batch)\r\n ensures RslSystemNext(s, s')\r\n decreases count\r\n{\r\n if count == 0 {\r\n assert s' == s;\r\n intermediate_states := [s];\r\n batch := [];\r\n assert RslStateSequenceReflectsBatchExecution(s, s', intermediate_states, batch);\r\n return;\r\n }\r\n\r\n var s_middle := ProduceIntermediateAbstractState(server_addresses, batches, count - 1);\r\n var intermediate_states_middle, batch_middle := lemma_DemonstrateRslSystemNextWhenBatchExtended(server_addresses, s, s_middle,\r\n batches, count - 1);\r\n\r\n intermediate_states := intermediate_states_middle + [s'];\r\n\r\n assert last(batches) in batches && last(batches)[count-1] in last(batches);\r\n assert |last(batches)[count-1].request| <= MaxAppRequestSize();\r\n\r\n var next_request := lemma_ProduceIntermediateAbstractStatesSatisfiesNext(server_addresses, batches, count-1);\r\n batch := batch_middle + [next_request];\r\n assert RslSystemNextServerExecutesRequest(s_middle, s', next_request);\r\n assert RslStateSequenceReflectsBatchExecution(s, s', intermediate_states, batch);\r\n}\r\n\r\nlemma lemma_DemonstrateRslSystemNextWhenBatchesAdded(\r\n server_addresses:set,\r\n s:RSLSystemState,\r\n s':RSLSystemState,\r\n batches:seq,\r\n batches':seq\r\n ) returns (\r\n intermediate_states:seq,\r\n batch:seq\r\n )\r\n requires s == ProduceAbstractState(server_addresses, batches)\r\n requires s' == ProduceAbstractState(server_addresses, batches')\r\n requires |batches| <= |batches'|\r\n requires batches'[..|batches|] == batches\r\n requires forall req, batch :: batch in batches' && req in batch ==> |req.request| <= MaxAppRequestSize()\r\n ensures RslStateSequenceReflectsBatchExecution(s, s', intermediate_states, batch)\r\n ensures RslSystemNext(s, s')\r\n decreases |batches'|\r\n{\r\n if |batches| == |batches'| {\r\n assert batches' == batches;\r\n assert s == s';\r\n intermediate_states := [s];\r\n batch := [];\r\n assert RslStateSequenceReflectsBatchExecution(s, s', intermediate_states, batch);\r\n return;\r\n }\r\n\r\n var s_middle := ProduceAbstractState(server_addresses, all_but_last(batches'));\r\n var intermediate_states_middle, batch_middle := lemma_DemonstrateRslSystemNextWhenBatchesAdded(server_addresses, s, s_middle,\r\n batches, all_but_last(batches'));\r\n lemma_FirstProduceIntermediateAbstractStateProducesAbstractState(server_addresses, batches');\r\n lemma_LastProduceIntermediateAbstractStateProducesAbstractState(server_addresses, batches');\r\n var intermediate_states_next, batch_next := lemma_DemonstrateRslSystemNextWhenBatchExtended(server_addresses, s_middle, s', batches',\r\n |last(batches')|);\r\n intermediate_states := all_but_last(intermediate_states_middle) + intermediate_states_next;\r\n batch := batch_middle + batch_next;\r\n assert RslStateSequenceReflectsBatchExecution(s, s', intermediate_states, batch);\r\n}\r\n\r\nlemma lemma_GetBehaviorRefinementForPrefix(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int\r\n ) returns (\r\n high_level_behavior:seq\r\n )\r\n requires 0 <= i\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n ensures RslSystemBehaviorRefinementCorrectImap(b, i+1, high_level_behavior)\r\n ensures SystemRefinementRelation(b[i], last(high_level_behavior))\r\n{\r\n if i == 0\r\n {\r\n high_level_behavior := lemma_GetBehaviorRefinementForBehaviorOfOneStep(b, c);\r\n return;\r\n }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n assert GetServerAddresses(b[i-1]) == GetServerAddresses(b[i]);\r\n var server_addresses := GetServerAddresses(b[i-1]);\r\n\r\n var prev_high_level_behavior := lemma_GetBehaviorRefinementForPrefix(b, c, i-1);\r\n var prev_rs := last(prev_high_level_behavior);\r\n var prev_qs :| && IsMaximalQuorumOf2bsSequence(b[i-1], prev_qs)\r\n && prev_rs == ProduceAbstractState(server_addresses, GetSequenceOfRequestBatches(prev_qs));\r\n var prev_batches := GetSequenceOfRequestBatches(prev_qs);\r\n\r\n var qs := lemma_GetMaximalQuorumOf2bsSequence(b, c, i);\r\n var batches := GetSequenceOfRequestBatches(qs);\r\n\r\n lemma_IfValidQuorumOf2bsSequenceNowThenNext(b, c, i-1, prev_qs);\r\n lemma_RegularQuorumOf2bSequenceIsPrefixOfMaximalQuorumOf2bSequence(b, c, i, prev_qs, qs);\r\n\r\n forall req, batch | batch in batches && req in batch\r\n ensures |req.request| <= MaxAppRequestSize()\r\n {\r\n var batch_num :| 0 <= batch_num < |batches| && batches[batch_num] == batch;\r\n var req_num :| 0 <= req_num < |batch| && batch[req_num] == req;\r\n var p := lemma_DecidedRequestWasSentByClient(b, c, i, qs, batches, batch_num, req_num);\r\n }\r\n\r\n var s' := ProduceAbstractState(server_addresses, batches);\r\n var intermediate_states, batch := lemma_DemonstrateRslSystemNextWhenBatchesAdded(server_addresses, last(prev_high_level_behavior),\r\n s', prev_batches, batches);\r\n\r\n high_level_behavior := prev_high_level_behavior + [s'];\r\n \r\n lemma_ProduceAbstractStateSatisfiesRefinementRelation(b, c, i, qs, last(high_level_behavior));\r\n assert RslSystemRefinement(b[i], last(high_level_behavior));\r\n}\r\n\r\nlemma lemma_GetBehaviorRefinement(\r\n low_level_behavior:seq,\r\n c:LConstants\r\n ) returns (\r\n high_level_behavior:seq\r\n )\r\n requires |low_level_behavior| > 0\r\n requires RslInit(c, low_level_behavior[0])\r\n requires forall i {:trigger RslNext(low_level_behavior[i], low_level_behavior[i+1])} ::\r\n 0 <= i < |low_level_behavior| - 1 ==> RslNext(low_level_behavior[i], low_level_behavior[i+1])\r\n ensures RslSystemBehaviorRefinementCorrect(MapSeqToSet(c.config.replica_ids, x=>x), low_level_behavior, high_level_behavior)\r\n{\r\n var b := ConvertBehaviorSeqToImap(low_level_behavior);\r\n high_level_behavior := lemma_GetBehaviorRefinementForPrefix(b, c, |low_level_behavior|-1);\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/RefinementProof/Requests.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\ninclude \"../CommonProof/Requests.i.dfy\"\r\ninclude \"Chosen.i.dfy\"\r\n\r\nmodule DirectRefinement__Requests_i {\r\n\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Election_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened CommonProof__Actions_i\r\nimport opened CommonProof__Assumptions_i\r\nimport opened CommonProof__Chosen_i\r\nimport opened CommonProof__Constants_i\r\nimport opened CommonProof__Environment_i\r\nimport opened CommonProof__Message1b_i\r\nimport opened CommonProof__Message2b_i\r\nimport opened CommonProof__PacketSending_i\r\nimport opened CommonProof__Received1b_i\r\nimport opened CommonProof__Requests_i\r\nimport opened AppStateMachine_s\r\nimport opened DirectRefinement__Chosen_i\r\nimport opened Temporal__Temporal_s\r\nimport opened Environment_s\r\n\r\nlemma lemma_RequestInRequestsReceivedThisEpochHasCorrespondingRequestMessage(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int,\r\n req:Request\r\n ) returns (\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires req in b[i].replicas[idx].replica.proposer.election_state.requests_received_this_epoch\r\n ensures p in b[i].environment.sentPackets\r\n ensures p.dst in c.config.replica_ids\r\n ensures p.msg.RslMessage_Request?\r\n ensures req == Request(p.src, p.msg.seqno_req, p.msg.val)\r\n ensures |p.msg.val| <= MaxAppRequestSize()\r\n decreases i\r\n{\r\n if i == 0 { return; }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n var es := b[i-1].replicas[idx].replica.proposer.election_state;\r\n var es' := b[i].replicas[idx].replica.proposer.election_state;\r\n\r\n if req in es.requests_received_this_epoch\r\n {\r\n p := lemma_RequestInRequestsReceivedThisEpochHasCorrespondingRequestMessage(b, c, i-1, idx, req);\r\n lemma_PacketStaysInSentPackets(b, c, i-1, i, p);\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n var nextActionIndex := b[i-1].replicas[idx].nextActionIndex;\r\n\r\n if nextActionIndex == 0\r\n {\r\n p := ios[0].r;\r\n assert IsValidLIoOp(ios[0], c.config.replica_ids[idx], b[i-1].environment);\r\n return;\r\n }\r\n\r\n var batch := b[i-1].replicas[idx].replica.executor.next_op_to_execute.v;\r\n assert ElectionStateReflectExecutedRequestBatch(es, es', batch);\r\n lemma_RemoveExecutedRequestBatchProducesSubsequence(es'.requests_received_this_epoch, es.requests_received_this_epoch, batch);\r\n assert false;\r\n}\r\n\r\nlemma lemma_RequestInRequestsReceivedPrevEpochsHasCorrespondingRequestMessage(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int,\r\n req:Request\r\n ) returns (\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires req in b[i].replicas[idx].replica.proposer.election_state.requests_received_prev_epochs\r\n ensures p in b[i].environment.sentPackets\r\n ensures p.dst in c.config.replica_ids\r\n ensures p.msg.RslMessage_Request?\r\n ensures req == Request(p.src, p.msg.seqno_req, p.msg.val)\r\n ensures |p.msg.val| <= MaxAppRequestSize()\r\n decreases i\r\n{\r\n if i == 0 { return; }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n var es := b[i-1].replicas[idx].replica.proposer.election_state;\r\n var es' := b[i].replicas[idx].replica.proposer.election_state;\r\n\r\n if req in es.requests_received_prev_epochs\r\n {\r\n p := lemma_RequestInRequestsReceivedPrevEpochsHasCorrespondingRequestMessage(b, c, i-1, idx, req);\r\n lemma_PacketStaysInSentPackets(b, c, i-1, i, p);\r\n return;\r\n }\r\n if req in es.requests_received_this_epoch\r\n {\r\n p := lemma_RequestInRequestsReceivedThisEpochHasCorrespondingRequestMessage(b, c, i-1, idx, req);\r\n lemma_PacketStaysInSentPackets(b, c, i-1, i, p);\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n var batch := b[i-1].replicas[idx].replica.executor.next_op_to_execute.v;\r\n assert ElectionStateReflectExecutedRequestBatch(es, es', batch);\r\n lemma_RemoveExecutedRequestBatchProducesSubsequence(es'.requests_received_prev_epochs, es.requests_received_prev_epochs, batch);\r\n assert false;\r\n}\r\n\r\nlemma lemma_RequestInRequestQueueHasCorrespondingRequestMessage(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n idx:int,\r\n req:Request\r\n ) returns (\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires 0 <= idx < |b[i].replicas|\r\n requires req in b[i].replicas[idx].replica.proposer.request_queue\r\n ensures p in b[i].environment.sentPackets\r\n ensures p.dst in c.config.replica_ids\r\n ensures p.msg.RslMessage_Request?\r\n ensures req == Request(p.src, p.msg.seqno_req, p.msg.val)\r\n ensures |p.msg.val| <= MaxAppRequestSize()\r\n decreases i\r\n{\r\n if i == 0 { return; }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n\r\n var s := b[i-1].replicas[idx].replica.proposer;\r\n var s' := b[i].replicas[idx].replica.proposer;\r\n\r\n if req in s.request_queue\r\n {\r\n p := lemma_RequestInRequestQueueHasCorrespondingRequestMessage(b, c, i-1, idx, req);\r\n lemma_PacketStaysInSentPackets(b, c, i-1, i, p);\r\n return;\r\n }\r\n if req in s.election_state.requests_received_prev_epochs\r\n {\r\n p := lemma_RequestInRequestsReceivedPrevEpochsHasCorrespondingRequestMessage(b, c, i-1, idx, req);\r\n lemma_PacketStaysInSentPackets(b, c, i-1, i, p);\r\n return;\r\n }\r\n if req in s.election_state.requests_received_this_epoch\r\n {\r\n p := lemma_RequestInRequestsReceivedThisEpochHasCorrespondingRequestMessage(b, c, i-1, idx, req);\r\n lemma_PacketStaysInSentPackets(b, c, i-1, i, p);\r\n return;\r\n }\r\n\r\n var ios := lemma_ActionThatChangesReplicaIsThatReplicasAction(b, c, i-1, idx);\r\n p := ios[0].r;\r\n assert IsValidLIoOp(ios[0], c.config.replica_ids[idx], b[i-1].environment);\r\n}\r\n\r\nlemma lemma_RequestIn1bMessageHasCorrespondingRequestMessage(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p_1b:RslPacket,\r\n opn:OperationNumber,\r\n req_num:int\r\n ) returns (\r\n p_req:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p_1b in b[i].environment.sentPackets\r\n requires p_1b.src in c.config.replica_ids\r\n requires p_1b.msg.RslMessage_1b?\r\n requires opn in p_1b.msg.votes\r\n requires 0 <= req_num < |p_1b.msg.votes[opn].max_val|\r\n ensures p_req in b[i].environment.sentPackets\r\n ensures p_req.dst in c.config.replica_ids\r\n ensures p_req.msg.RslMessage_Request?\r\n ensures p_1b.msg.votes[opn].max_val[req_num] == Request(p_req.src, p_req.msg.seqno_req, p_req.msg.val)\r\n ensures |p_req.msg.val| <= MaxAppRequestSize()\r\n decreases i, 1\r\n{\r\n var p_2a := lemma_1bMessageWithOpnImplies2aSent(b, c, i, opn, p_1b);\r\n p_req := lemma_RequestIn2aMessageHasCorrespondingRequestMessage(b, c, i, p_2a, req_num);\r\n}\r\n\r\nlemma lemma_RequestIn2aMessageHasCorrespondingRequestMessage(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n p_2a:RslPacket,\r\n req_num:int\r\n ) returns (\r\n p_req:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires p_2a in b[i].environment.sentPackets\r\n requires p_2a.src in c.config.replica_ids\r\n requires p_2a.msg.RslMessage_2a?\r\n requires 0 <= req_num < |p_2a.msg.val_2a|\r\n ensures p_req in b[i].environment.sentPackets\r\n ensures p_req.dst in c.config.replica_ids\r\n ensures p_req.msg.RslMessage_Request?\r\n ensures p_2a.msg.val_2a[req_num] == Request(p_req.src, p_req.msg.seqno_req, p_req.msg.val)\r\n ensures |p_req.msg.val| <= MaxAppRequestSize()\r\n decreases i, 0\r\n{\r\n if i == 0\r\n {\r\n return;\r\n }\r\n\r\n if p_2a in b[i-1].environment.sentPackets\r\n {\r\n p_req := lemma_RequestIn2aMessageHasCorrespondingRequestMessage(b, c, i-1, p_2a, req_num);\r\n lemma_PacketStaysInSentPackets(b, c, i-1, i, p_req);\r\n return;\r\n }\r\n\r\n lemma_ConstantsAllConsistent(b, c, i-1);\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n lemma_AssumptionsMakeValidTransition(b, c, i-1);\r\n var idx, ios := lemma_ActionThatSends2aIsMaybeNominateValueAndSend2a(b[i-1], b[i], p_2a);\r\n\r\n var s := b[i-1].replicas[idx].replica.proposer;\r\n var s' := b[i].replicas[idx].replica.proposer;\r\n var log_truncation_point := b[i-1].replicas[idx].replica.acceptor.log_truncation_point;\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n\r\n if LAllAcceptorsHadNoProposal(s.received_1b_packets, s.next_operation_number_to_propose)\r\n {\r\n assert LProposerNominateNewValueAndSend2a(s, s', ios[0].t, log_truncation_point, sent_packets);\r\n assert s.request_queue[req_num] == p_2a.msg.val_2a[req_num];\r\n p_req := lemma_RequestInRequestQueueHasCorrespondingRequestMessage(b, c, i-1, idx, s.request_queue[req_num]);\r\n }\r\n else\r\n {\r\n assert LProposerNominateOldValueAndSend2a(s, s', log_truncation_point, sent_packets);\r\n var opn := s.next_operation_number_to_propose;\r\n var v := p_2a.msg.val_2a;\r\n // var earlier_ballot :| LValIsHighestNumberedProposalAtBallot(v, earlier_ballot, s.received_1b_packets, opn);\r\n var p_1b :| p_1b in s.received_1b_packets && opn in p_1b.msg.votes && p_1b.msg.votes[opn].max_val == v;\r\n lemma_PacketInReceived1bWasSent(b, c, i-1, idx, p_1b);\r\n p_req := lemma_RequestIn1bMessageHasCorrespondingRequestMessage(b, c, i-1, p_1b, opn, req_num);\r\n }\r\n}\r\n\r\nlemma lemma_DecidedRequestWasSentByClient(\r\n b:Behavior,\r\n c:LConstants,\r\n i:int,\r\n qs:seq,\r\n batches:seq,\r\n batch_num:int,\r\n req_num:int\r\n ) returns (\r\n p:RslPacket\r\n )\r\n requires IsValidBehaviorPrefix(b, c, i)\r\n requires 0 <= i\r\n requires IsValidQuorumOf2bsSequence(b[i], qs)\r\n requires batches == GetSequenceOfRequestBatches(qs)\r\n requires 0 <= batch_num < |batches|\r\n requires 0 <= req_num < |batches[batch_num]|\r\n ensures p in b[i].environment.sentPackets\r\n ensures p.dst in c.config.replica_ids\r\n ensures p.msg.RslMessage_Request?\r\n ensures batches[batch_num][req_num] == Request(p.src, p.msg.seqno_req, p.msg.val)\r\n ensures |p.msg.val| <= MaxAppRequestSize()\r\n decreases i\r\n{\r\n lemma_ConstantsAllConsistent(b, c, i);\r\n\r\n lemma_SequenceOfRequestBatchesNthElement(qs, batch_num);\r\n var batch := batches[batch_num];\r\n var request := batch[req_num];\r\n var q := qs[batch_num];\r\n var idx :| idx in q.indices;\r\n var packet_2b := q.packets[idx];\r\n assert packet_2b.msg.RslMessage_2b?;\r\n assert packet_2b.msg.val_2b == batch;\r\n\r\n var packet_2a := lemma_2bMessageHasCorresponding2aMessage(b, c, i, packet_2b);\r\n\r\n p := lemma_RequestIn2aMessageHasCorrespondingRequestMessage(b, c, i, packet_2a, req_num);\r\n}\r\n \r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/RefinementProof/StateMachine.i.dfy", "content": "include \"../DistributedSystem.i.dfy\"\r\n\r\nmodule DirectRefinement__StateMachine_i {\r\n\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Types_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened AppStateMachine_s\r\nimport opened Collections__Seqs_s\r\n\r\ndatatype RSLSystemState = RSLSystemState(\r\n server_addresses:set,\r\n app:AppState,\r\n requests:set,\r\n replies:set\r\n )\r\n\r\npredicate RslSystemInit(s:RSLSystemState, server_addresses:set)\r\n{\r\n && s.server_addresses == server_addresses\r\n && s.app == AppInitialize()\r\n && s.requests == {}\r\n && s.replies == {}\r\n}\r\n\r\npredicate RslSystemNextServerExecutesRequest(s:RSLSystemState, s':RSLSystemState, req:Request)\r\n{\r\n && |req.request| <= MaxAppRequestSize()\r\n && s'.server_addresses == s.server_addresses\r\n && s'.requests == s.requests + { req }\r\n && s'.app == AppHandleRequest(s.app, req.request).0\r\n && s'.replies == s.replies + { Reply(req.client, req.seqno, AppHandleRequest(s.app, req.request).1) }\r\n}\r\n\r\npredicate RslStateSequenceReflectsBatchExecution(s:RSLSystemState, s':RSLSystemState, intermediate_states:seq,\r\n batch:seq)\r\n{\r\n && |intermediate_states| == |batch| + 1\r\n && intermediate_states[0] == s\r\n && last(intermediate_states) == s'\r\n && forall i :: 0 <= i < |batch| ==> RslSystemNextServerExecutesRequest(intermediate_states[i], intermediate_states[i+1], batch[i])\r\n}\r\n\r\npredicate RslSystemNext(s:RSLSystemState, s':RSLSystemState)\r\n{\r\n exists intermediate_states, batch :: RslStateSequenceReflectsBatchExecution(s, s', intermediate_states, batch)\r\n}\r\n\r\npredicate RslSystemRefinement(ps:RslState, rs:RSLSystemState)\r\n{\r\n && (forall p :: p in ps.environment.sentPackets && p.src in rs.server_addresses && p.msg.RslMessage_Reply?\r\n ==> Reply(p.dst, p.msg.seqno_reply, p.msg.reply) in rs.replies)\r\n && (forall req :: req in rs.requests ==> exists p :: p in ps.environment.sentPackets && p.dst in rs.server_addresses && p.msg.RslMessage_Request?\r\n && req == Request(p.src, p.msg.seqno_req, p.msg.val))\r\n}\r\n\r\npredicate RslSystemBehaviorRefinementCorrect(server_addresses:set, low_level_behavior:seq, high_level_behavior:seq)\r\n{\r\n && |high_level_behavior| == |low_level_behavior|\r\n && (forall i :: 0 <= i < |low_level_behavior| ==> RslSystemRefinement(low_level_behavior[i], high_level_behavior[i]))\r\n && |high_level_behavior| > 0\r\n && RslSystemInit(high_level_behavior[0], server_addresses)\r\n && (forall i {:trigger high_level_behavior[i], high_level_behavior[i+1]} :: 0 <= i < |high_level_behavior| - 1\r\n ==> RslSystemNext(high_level_behavior[i], high_level_behavior[i+1]))\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/Replica.i.dfy", "content": "include \"Configuration.i.dfy\"\r\ninclude \"Environment.i.dfy\"\r\ninclude \"Types.i.dfy\"\r\ninclude \"ClockReading.i.dfy\"\r\ninclude \"Constants.i.dfy\"\r\ninclude \"Proposer.i.dfy\"\r\ninclude \"Acceptor.i.dfy\"\r\ninclude \"Learner.i.dfy\"\r\ninclude \"Executor.i.dfy\"\r\n\r\nmodule LiveRSL__Replica_i {\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__ClockReading_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__Proposer_i\r\nimport opened LiveRSL__Acceptor_i\r\nimport opened LiveRSL__Learner_i\r\nimport opened LiveRSL__Executor_i\r\nimport opened LiveRSL__Broadcast_i\r\nimport opened LiveRSL__Message_i\r\nimport opened AppStateMachine_s\r\nimport opened Common__UpperBound_s\r\nimport opened Environment_s\r\n\r\ndatatype LReplica = LReplica(\r\n constants:LReplicaConstants,\r\n nextHeartbeatTime:int,\r\n proposer:LProposer,\r\n acceptor:LAcceptor,\r\n learner:LLearner,\r\n executor:LExecutor)\r\n\r\npredicate LReplicaInit(r:LReplica, c:LReplicaConstants)\r\n requires WellFormedLConfiguration(c.all.config)\r\n{\r\n && r.constants == c\r\n && r.nextHeartbeatTime == 0\r\n && LProposerInit(r.proposer, c)\r\n && LAcceptorInit(r.acceptor, c)\r\n && LLearnerInit(r.learner, c)\r\n && LExecutorInit(r.executor, c)\r\n}\r\n\r\npredicate LReplicaNextProcessInvalid(s:LReplica, s':LReplica, received_packet:RslPacket, sent_packets:seq)\r\n requires received_packet.msg.RslMessage_Invalid?\r\n{\r\n && s' == s\r\n && sent_packets == []\r\n}\r\n\r\npredicate LReplicaNextProcessRequest(s:LReplica, s':LReplica, received_packet:RslPacket, sent_packets:seq)\r\n requires received_packet.msg.RslMessage_Request?\r\n{\r\n if |received_packet.msg.val| > MaxAppRequestSize() then\r\n && sent_packets == []\r\n && s' == s\r\n else\r\n // We may always propose the request, no matter what the reply-cache state.\r\n // If there's a matching or later request in the reply cache, we may instead reply out of the reply cache.\r\n || (&& LProposerProcessRequest(s.proposer, s'.proposer, received_packet)\r\n && sent_packets == []\r\n && s' == s.(proposer := s'.proposer))\r\n\r\n || (&& received_packet.src in s.executor.reply_cache\r\n && s.executor.reply_cache[received_packet.src].Reply?\r\n && received_packet.msg.seqno_req <= s.executor.reply_cache[received_packet.src].seqno\r\n && LExecutorProcessRequest(s.executor, received_packet, sent_packets)\r\n && s' == s)\r\n}\r\n\r\npredicate LReplicaNextProcess1a(s:LReplica, s':LReplica, received_packet:RslPacket, sent_packets:seq)\r\n requires received_packet.msg.RslMessage_1a?\r\n{\r\n && LAcceptorProcess1a(s.acceptor, s'.acceptor, received_packet, sent_packets)\r\n // UNCHANGED\r\n && s' == s.(acceptor := s'.acceptor)\r\n}\r\n\r\npredicate LReplicaNextProcess1b(s:LReplica, s':LReplica, received_packet:RslPacket, sent_packets:seq)\r\n requires received_packet.msg.RslMessage_1b?\r\n{\r\n if && received_packet.src in s.proposer.constants.all.config.replica_ids\r\n && received_packet.msg.bal_1b == s.proposer.max_ballot_i_sent_1a\r\n && s.proposer.current_state == 1\r\n && (forall other_packet :: other_packet in s.proposer.received_1b_packets ==> other_packet.src != received_packet.src) then\r\n && LProposerProcess1b(s.proposer, s'.proposer, received_packet)\r\n && LAcceptorTruncateLog(s.acceptor, s'.acceptor, received_packet.msg.log_truncation_point)\r\n && sent_packets == []\r\n && s' == s.(proposer := s'.proposer, acceptor := s'.acceptor)\r\n else\r\n s' == s && sent_packets == []\r\n}\r\n\r\npredicate LReplicaNextProcessStartingPhase2(s:LReplica, s':LReplica, received_packet:RslPacket, sent_packets:seq)\r\n requires received_packet.msg.RslMessage_StartingPhase2?\r\n{\r\n && LExecutorProcessStartingPhase2(s.executor, s'.executor, received_packet, sent_packets)\r\n && s' == s.(executor := s'.executor)\r\n}\r\n\r\npredicate LReplicaNextProcess2a(s:LReplica, s':LReplica, received_packet:RslPacket, sent_packets:seq)\r\n requires received_packet.msg.RslMessage_2a?\r\n{\r\n var m := received_packet.msg;\r\n if && received_packet.src in s.acceptor.constants.all.config.replica_ids\r\n && BalLeq(s.acceptor.max_bal, m.bal_2a)\r\n && LeqUpperBound(m.opn_2a, s.acceptor.constants.all.params.max_integer_val) then\r\n && LAcceptorProcess2a(s.acceptor, s'.acceptor, received_packet, sent_packets)\r\n && s' == s.(acceptor := s'.acceptor)\r\n else\r\n s' == s && sent_packets == []\r\n}\r\n\r\npredicate LReplicaNextProcess2b(s:LReplica, s':LReplica, received_packet:RslPacket, sent_packets:seq)\r\n requires received_packet.msg.RslMessage_2b?\r\n{\r\n var opn := received_packet.msg.opn_2b;\r\n var op_learnable := s.executor.ops_complete < opn || (s.executor.ops_complete == opn && s.executor.next_op_to_execute.OutstandingOpUnknown?);\r\n if op_learnable then\r\n && LLearnerProcess2b(s.learner, s'.learner, received_packet)\r\n && sent_packets == []\r\n && s' == s.(learner := s'.learner)\r\n else\r\n && s' == s\r\n && sent_packets == []\r\n}\r\n\r\npredicate LReplicaNextProcessReply(s:LReplica, s':LReplica, received_packet:RslPacket, sent_packets:seq)\r\n requires received_packet.msg.RslMessage_Reply?\r\n{\r\n && sent_packets == []\r\n && s' == s\r\n}\r\n\r\npredicate LReplicaNextProcessAppStateSupply(s:LReplica, s':LReplica, received_packet:RslPacket, sent_packets:seq)\r\n requires received_packet.msg.RslMessage_AppStateSupply?\r\n{\r\n if received_packet.src in s.executor.constants.all.config.replica_ids && received_packet.msg.opn_state_supply > s.executor.ops_complete then\r\n && LLearnerForgetOperationsBefore(s.learner, s'.learner, received_packet.msg.opn_state_supply)\r\n && LExecutorProcessAppStateSupply(s.executor, s'.executor, received_packet)\r\n && sent_packets == []\r\n && s' == s.(learner := s'.learner, executor := s'.executor)\r\n else\r\n s' == s && sent_packets == []\r\n}\r\n\r\npredicate LReplicaNextProcessAppStateRequest(s:LReplica, s':LReplica, received_packet:RslPacket, sent_packets:seq)\r\n requires received_packet.msg.RslMessage_AppStateRequest?\r\n{\r\n && LExecutorProcessAppStateRequest(s.executor, s'.executor, received_packet, sent_packets)\r\n && s' == s.(executor := s'.executor)\r\n}\r\n\r\npredicate LReplicaNextProcessHeartbeat(s:LReplica, s':LReplica, received_packet:RslPacket, clock:int, sent_packets:seq)\r\n requires received_packet.msg.RslMessage_Heartbeat?\r\n{\r\n && LProposerProcessHeartbeat(s.proposer, s'.proposer, received_packet, clock)\r\n && LAcceptorProcessHeartbeat(s.acceptor, s'.acceptor, received_packet)\r\n && sent_packets == []\r\n && s' == s.(proposer := s'.proposer, acceptor := s'.acceptor)\r\n}\r\n\r\npredicate LReplicaNextSpontaneousMaybeEnterNewViewAndSend1a(s:LReplica, s':LReplica, sent_packets:seq)\r\n{\r\n && LProposerMaybeEnterNewViewAndSend1a(s.proposer, s'.proposer, sent_packets)\r\n && s' == s.(proposer := s'.proposer)\r\n}\r\n\r\npredicate LReplicaNextSpontaneousMaybeEnterPhase2(s:LReplica, s':LReplica, sent_packets:seq)\r\n{\r\n && LProposerMaybeEnterPhase2(s.proposer, s'.proposer, s.acceptor.log_truncation_point, sent_packets)\r\n && s' == s.(proposer := s'.proposer)\r\n}\r\n\r\npredicate LReplicaNextReadClockMaybeNominateValueAndSend2a(s:LReplica, s':LReplica, clock:ClockReading, sent_packets:seq)\r\n{\r\n && LProposerMaybeNominateValueAndSend2a(s.proposer, s'.proposer, clock.t, s.acceptor.log_truncation_point, sent_packets)\r\n && s' == s.(proposer := s'.proposer)\r\n}\r\n\r\npredicate LReplicaNextSpontaneousTruncateLogBasedOnCheckpoints(s:LReplica, s':LReplica, sent_packets:seq)\r\n{\r\n (exists opn ::\r\n && IsLogTruncationPointValid(opn, s.acceptor.last_checkpointed_operation, s.constants.all.config)\r\n && opn > s.acceptor.log_truncation_point\r\n && LAcceptorTruncateLog(s.acceptor, s'.acceptor, opn)\r\n && s' == s.(acceptor := s'.acceptor)\r\n && sent_packets == []\r\n )\r\n ||\r\n (exists opn ::\r\n && IsLogTruncationPointValid(opn, s.acceptor.last_checkpointed_operation, s.constants.all.config)\r\n && opn <= s.acceptor.log_truncation_point\r\n && s' == s\r\n && sent_packets == []\r\n )\r\n}\r\n\r\npredicate LReplicaNextSpontaneousMaybeMakeDecision(s:LReplica, s':LReplica, sent_packets:seq)\r\n{\r\n var opn := s.executor.ops_complete;\r\n if && s.executor.next_op_to_execute.OutstandingOpUnknown?\r\n && opn in s.learner.unexecuted_learner_state\r\n && |s.learner.unexecuted_learner_state[opn].received_2b_message_senders| >= LMinQuorumSize(s.learner.constants.all.config) then\r\n && LExecutorGetDecision(s.executor, s'.executor, s.learner.max_ballot_seen, opn,\r\n s.learner.unexecuted_learner_state[opn].candidate_learned_value)\r\n && s' == s.(executor := s'.executor)\r\n && sent_packets == []\r\n else\r\n s' == s && sent_packets == []\r\n}\r\n\r\npredicate LReplicaNextSpontaneousMaybeExecute(s:LReplica, s':LReplica, sent_packets:seq)\r\n{\r\n if && s.executor.next_op_to_execute.OutstandingOpKnown?\r\n && LtUpperBound(s.executor.ops_complete, s.executor.constants.all.params.max_integer_val)\r\n && LReplicaConstantsValid(s.executor.constants) then\r\n var v := s.executor.next_op_to_execute.v;\r\n && LProposerResetViewTimerDueToExecution(s.proposer, s'.proposer, v)\r\n && LLearnerForgetDecision(s.learner, s'.learner, s.executor.ops_complete)\r\n && LExecutorExecute(s.executor, s'.executor, sent_packets)\r\n && s' == s.(proposer := s'.proposer, learner := s'.learner, executor := s'.executor)\r\n else\r\n s' == s && sent_packets == []\r\n}\r\n\r\npredicate LReplicaNextReadClockMaybeSendHeartbeat(s:LReplica, s':LReplica, clock:ClockReading, sent_packets:seq)\r\n{\r\n if clock.t < s.nextHeartbeatTime then\r\n s' == s && sent_packets == []\r\n else\r\n && s'.nextHeartbeatTime == UpperBoundedAddition(clock.t, s.constants.all.params.heartbeat_period, s.constants.all.params.max_integer_val)\r\n && LBroadcastToEveryone(s.constants.all.config, s.constants.my_index,\r\n RslMessage_Heartbeat(s.proposer.election_state.current_view,\r\n s.constants.my_index in s.proposer.election_state.current_view_suspectors,\r\n s.executor.ops_complete),\r\n sent_packets)\r\n && s' == s.(nextHeartbeatTime := s'.nextHeartbeatTime)\r\n}\r\n\r\npredicate LReplicaNextReadClockCheckForViewTimeout(s:LReplica, s':LReplica, clock:ClockReading, sent_packets:seq)\r\n{\r\n && LProposerCheckForViewTimeout(s.proposer, s'.proposer, clock.t)\r\n && sent_packets == []\r\n && s' == s.(proposer := s'.proposer)\r\n}\r\n\r\npredicate LReplicaNextReadClockCheckForQuorumOfViewSuspicions(s:LReplica, s':LReplica, clock:ClockReading, sent_packets:seq)\r\n{\r\n && LProposerCheckForQuorumOfViewSuspicions(s.proposer, s'.proposer, clock.t)\r\n && sent_packets == []\r\n && s' == s.(proposer := s'.proposer)\r\n}\r\n\r\nfunction {:opaque} ExtractSentPacketsFromIos(ios:seq) : seq\r\n ensures forall p :: p in ExtractSentPacketsFromIos(ios) <==> LIoOpSend(p) in ios\r\n{\r\n if |ios| == 0 then\r\n []\r\n else if ios[0].LIoOpSend? then\r\n [ios[0].s] + ExtractSentPacketsFromIos(ios[1..])\r\n else\r\n ExtractSentPacketsFromIos(ios[1..])\r\n}\r\n\r\npredicate LReplicaNextReadClockAndProcessPacket(s:LReplica, s':LReplica, ios:seq)\r\n requires |ios| >= 1\r\n requires ios[0].LIoOpReceive?\r\n requires ios[0].r.msg.RslMessage_Heartbeat?\r\n{\r\n && |ios| > 1\r\n && ios[1].LIoOpReadClock?\r\n && (forall io :: io in ios[2..] ==> io.LIoOpSend?)\r\n && LReplicaNextProcessHeartbeat(s, s', ios[0].r, ios[1].t, ExtractSentPacketsFromIos(ios))\r\n}\r\n\r\npredicate LReplicaNextProcessPacketWithoutReadingClock(s:LReplica, s':LReplica, ios:seq)\r\n requires |ios| >= 1\r\n requires ios[0].LIoOpReceive?\r\n requires !ios[0].r.msg.RslMessage_Heartbeat?\r\n{\r\n && (forall io :: io in ios[1..] ==> io.LIoOpSend?)\r\n && var sent_packets := ExtractSentPacketsFromIos(ios);\r\n match ios[0].r.msg\r\n case RslMessage_Invalid => LReplicaNextProcessInvalid(s, s', ios[0].r, sent_packets)\r\n case RslMessage_Request(_, _) => LReplicaNextProcessRequest(s, s', ios[0].r, sent_packets)\r\n case RslMessage_1a(_) => LReplicaNextProcess1a(s, s', ios[0].r, sent_packets)\r\n case RslMessage_1b(_, _, _) => LReplicaNextProcess1b(s, s', ios[0].r, sent_packets)\r\n case RslMessage_StartingPhase2(_, _) => LReplicaNextProcessStartingPhase2(s, s', ios[0].r, sent_packets)\r\n case RslMessage_2a(_, _, _) => LReplicaNextProcess2a(s, s', ios[0].r, sent_packets)\r\n case RslMessage_2b(_, _, _) => LReplicaNextProcess2b(s, s', ios[0].r, sent_packets)\r\n case RslMessage_Reply(_, _) => LReplicaNextProcessReply(s, s', ios[0].r, sent_packets)\r\n case RslMessage_AppStateRequest(_, _) => LReplicaNextProcessAppStateRequest(s, s', ios[0].r, sent_packets)\r\n case RslMessage_AppStateSupply(_, _, _) => LReplicaNextProcessAppStateSupply(s, s', ios[0].r, sent_packets)\r\n}\r\n\r\npredicate LReplicaNextProcessPacket(s:LReplica, s':LReplica, ios:seq)\r\n{\r\n && |ios| >= 1\r\n && if ios[0].LIoOpTimeoutReceive? then\r\n s' == s && |ios| == 1\r\n else\r\n (&& ios[0].LIoOpReceive?\r\n && if ios[0].r.msg.RslMessage_Heartbeat? then\r\n LReplicaNextReadClockAndProcessPacket(s, s', ios)\r\n else\r\n LReplicaNextProcessPacketWithoutReadingClock(s, s', ios)\r\n )\r\n}\r\n\r\nfunction LReplicaNumActions() : int\r\n{\r\n 10\r\n}\r\n\r\npredicate SpontaneousIos(ios:seq, clocks:int)\r\n requires 0<=clocks<=1\r\n{\r\n && clocks <= |ios|\r\n && (forall i :: 0<=i ios[i].LIoOpReadClock?)\r\n && (forall i :: clocks<=i<|ios| ==> ios[i].LIoOpSend?)\r\n}\r\n\r\nfunction SpontaneousClock(ios:seq) : ClockReading\r\n{\r\n if SpontaneousIos(ios, 1) then ClockReading(ios[0].t) else ClockReading(0) // nonsense to avoid putting a precondition on this function\r\n}\r\n\r\npredicate LReplicaNoReceiveNext(s:LReplica, nextActionIndex:int, s':LReplica, ios:seq)\r\n{\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n\r\n if nextActionIndex == 1 then\r\n && SpontaneousIos(ios, 0)\r\n && LReplicaNextSpontaneousMaybeEnterNewViewAndSend1a(s, s', sent_packets)\r\n else if nextActionIndex == 2 then\r\n && SpontaneousIos(ios, 0)\r\n && LReplicaNextSpontaneousMaybeEnterPhase2(s, s', sent_packets)\r\n else if nextActionIndex == 3 then\r\n && SpontaneousIos(ios, 1)\r\n && LReplicaNextReadClockMaybeNominateValueAndSend2a(s, s', SpontaneousClock(ios), sent_packets)\r\n else if nextActionIndex == 4 then\r\n && SpontaneousIos(ios, 0)\r\n && LReplicaNextSpontaneousTruncateLogBasedOnCheckpoints(s, s', sent_packets)\r\n else if nextActionIndex == 5 then\r\n && SpontaneousIos(ios, 0)\r\n && LReplicaNextSpontaneousMaybeMakeDecision(s, s', sent_packets)\r\n else if nextActionIndex == 6 then\r\n && SpontaneousIos(ios, 0)\r\n && LReplicaNextSpontaneousMaybeExecute(s, s', sent_packets)\r\n else if nextActionIndex == 7 then\r\n && SpontaneousIos(ios, 1)\r\n && LReplicaNextReadClockCheckForViewTimeout(s, s', SpontaneousClock(ios), sent_packets)\r\n else if nextActionIndex == 8 then\r\n && SpontaneousIos(ios, 1)\r\n && LReplicaNextReadClockCheckForQuorumOfViewSuspicions(s, s', SpontaneousClock(ios), sent_packets)\r\n else\r\n && nextActionIndex == 9\r\n && SpontaneousIos(ios, 1)\r\n && LReplicaNextReadClockMaybeSendHeartbeat(s, s', SpontaneousClock(ios), sent_packets)\r\n}\r\n\r\ndatatype LScheduler = LScheduler(replica:LReplica, nextActionIndex:int)\r\n\r\npredicate LSchedulerInit(s:LScheduler, c:LReplicaConstants)\r\n requires WellFormedLConfiguration(c.all.config)\r\n{\r\n && LReplicaInit(s.replica, c)\r\n && s.nextActionIndex == 0\r\n}\r\n\r\npredicate LSchedulerNext(s:LScheduler, s':LScheduler, ios:seq)\r\n{\r\n && s'.nextActionIndex == (s.nextActionIndex + 1) % LReplicaNumActions()\r\n && if s.nextActionIndex == 0 then\r\n LReplicaNextProcessPacket(s.replica, s'.replica, ios)\r\n else\r\n LReplicaNoReceiveNext(s.replica, s.nextActionIndex, s'.replica, ios)\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/StateMachine.i.dfy", "content": "include \"../../Services/RSL/AppStateMachine.s.dfy\"\r\ninclude \"Types.i.dfy\"\r\n \r\nmodule LiveRSL__StateMachine_i {\r\n\r\nimport opened AppStateMachine_s\r\nimport opened LiveRSL__Types_i\r\n\r\nfunction HandleRequest(state:AppState, request:Request) : (AppState, Reply)\r\n{\r\n var (new_state, reply) := AppHandleRequest(state, request.request);\r\n (new_state, Reply(request.client, request.seqno, reply))\r\n}\r\n\r\nfunction {:opaque} HandleRequestBatchHidden(state:AppState, batch:RequestBatch) : (seq, seq)\r\n ensures var (states, replies) := HandleRequestBatchHidden(state, batch); \r\n && |states| == |batch|+1\r\n && |replies| == |batch|\r\n && forall i :: 0 <= i < |batch| ==> replies[i].Reply?\r\n decreases |batch|\r\n{\r\n //lemma_HandleRequestBatch(state, batch, HandleRequestBatch(state, batch).0, HandleRequestBatch(state, batch).1);\r\n if |batch| == 0 then\r\n ([state], [])\r\n else\r\n var (restStates, restReplies) := HandleRequestBatchHidden(state, batch[..|batch|-1]);\r\n var (new_state, reply) := AppHandleRequest(restStates[|restStates|-1], batch[|batch|-1].request);\r\n (restStates+[new_state], restReplies+[Reply(batch[|batch|-1].client, batch[|batch|-1].seqno, reply)])\r\n}\r\n\r\nlemma{:timeLimitMultiplier 2} lemma_HandleRequestBatchHidden(state:AppState, batch:RequestBatch, states:seq, replies:seq)\r\n requires (states, replies) == HandleRequestBatchHidden(state, batch);\r\n ensures && states[0] == state\r\n && |states| == |batch|+1 \r\n && |replies| == |batch|\r\n && forall i :: 0 <= i < |batch| ==>\r\n && replies[i].Reply? \r\n && ((states[i+1], replies[i].reply) == AppHandleRequest(states[i], batch[i].request))\r\n && replies[i].client == batch[i].client\r\n && replies[i].seqno == batch[i].seqno\r\n decreases |batch|\r\n{\r\n reveal HandleRequestBatchHidden();\r\n if |batch| == 0 {\r\n assert && |states| == |batch|+1 \r\n && |replies| == |batch|\r\n && (forall i :: 0 <= i < |batch| ==> ((states[i+1], replies[i].reply) == AppHandleRequest(states[i], batch[i].request)));\r\n } else {\r\n var restBatch := HandleRequestBatchHidden(state, batch[..|batch|-1]);\r\n var restStates := restBatch.0;\r\n var AHR_result := AppHandleRequest(restStates[|restStates|-1], batch[|batch|-1].request);\r\n lemma_HandleRequestBatchHidden(state, batch[..|batch|-1], restStates, restBatch.1);\r\n assert replies[|batch|-1].reply == AHR_result.1;\r\n }\r\n}\r\n\r\nlemma lemma_HandleBatchRequestSizes(state:AppState, batch:RequestBatch, states:seq, replies:seq)\r\n requires (states, replies) == HandleRequestBatch(state, batch)\r\n ensures states[0] == state\r\n ensures |states| == |batch| + 1\r\n ensures |replies| == |batch|\r\n{\r\n assert states == HandleRequestBatchHidden(state, batch).0; // OBSERVE\r\n assert replies == HandleRequestBatchHidden(state, batch).1; // OBSERVE\r\n assert (states, replies) == HandleRequestBatchHidden(state, batch);\r\n lemma_HandleRequestBatchHidden(state, batch, states,replies);\r\n}\r\n\r\nlemma lemma_HandleBatchRequestProperties(state:AppState, batch:RequestBatch, states:seq, replies:seq, i:int)\r\n requires (states, replies) == HandleRequestBatch(state, batch)\r\n requires 0 <= i < |batch|\r\n ensures states[0] == state\r\n ensures |states| == |batch| + 1\r\n ensures |replies| == |batch|\r\n ensures replies[i].Reply?\r\n ensures var (s, r) := AppHandleRequest(states[i], batch[i].request);\r\n s == states[i+1] && r == replies[i].reply\r\n //ensures (states[i+1], replies[i]) == AppHandleRequest(states[i], batch[i].request)\r\n ensures replies[i].client == batch[i].client\r\n ensures replies[i].seqno == batch[i].seqno\r\n{\r\n assert states == HandleRequestBatchHidden(state, batch).0; // OBSERVE\r\n assert replies == HandleRequestBatchHidden(state, batch).1; // OBSERVE\r\n assert (states, replies) == HandleRequestBatchHidden(state, batch);\r\n lemma_HandleRequestBatchHidden(state, batch, states,replies);\r\n}\r\n\r\n// TODO: The forall in the ensures should have an explicit trigger,\r\n// but the proof appears to be depending on the overly generous triggers in several places\r\nlemma lemma_HandleRequestBatchTriggerHappy(state:AppState, batch:RequestBatch, states:seq, replies:seq)\r\n requires (states, replies) == HandleRequestBatch(state, batch);\r\n ensures && states[0] == state\r\n && |states| == |batch|+1 \r\n && |replies| == |batch|\r\n && forall i :: 0 <= i < |batch| ==>\r\n && replies[i].Reply? \r\n && ((states[i+1], replies[i].reply) == AppHandleRequest(states[i], batch[i].request))\r\n && replies[i].client == batch[i].client\r\n && replies[i].seqno == batch[i].seqno\r\n{\r\n assert states == HandleRequestBatchHidden(state, batch).0; // OBSERVE\r\n assert replies == HandleRequestBatchHidden(state, batch).1; // OBSERVE\r\n assert (states, replies) == HandleRequestBatchHidden(state, batch);\r\n lemma_HandleRequestBatchHidden(state, batch, states, replies);\r\n}\r\n\r\nfunction HandleRequestBatch(state:AppState, batch:RequestBatch) : (seq, seq)\r\n// ensures var (states, replies) := HandleRequestBatch(state, batch); \r\n// && states[0] == state\r\n// && |states| == |batch|+1 \r\n// && |replies| == |batch|\r\n// && (forall i :: 0 <= i < |batch| ==>\r\n// && replies[i].Reply? \r\n// && ((states[i+1], replies[i].reply) == AppHandleRequest(states[i], batch[i].request))\r\n// && replies[i].client == batch[i].client\r\n// && replies[i].seqno == batch[i].seqno)\r\n{\r\n var (states, replies) := HandleRequestBatchHidden(state, batch); \r\n lemma_HandleRequestBatchHidden(state, batch, states, replies);\r\n (states, replies)\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/RSL/Types.i.dfy", "content": "include \"../../Services/RSL/AppStateMachine.s.dfy\"\r\ninclude \"../Common/NodeIdentity.i.dfy\"\r\n\r\nmodule LiveRSL__Types_i {\r\n\r\nimport opened AppStateMachine_s\r\nimport opened Concrete_NodeIdentity_i\r\n\r\ntype OperationNumber = int\r\ndatatype Ballot = Ballot(seqno:int, proposer_id:int)\r\n \r\ndatatype Request = Request(client:NodeIdentity, seqno:int, request:AppRequest)\r\ndatatype Reply = Reply(client:NodeIdentity, seqno:int, reply:AppReply)\r\n\r\ntype RequestBatch = seq\r\ntype ReplyCache = map\r\n\r\ndatatype Vote = Vote(max_value_bal:Ballot, ghost max_val:RequestBatch)\r\ntype Votes = map\r\n\r\ndatatype LearnerTuple = LearnerTuple(received_2b_message_senders:set, candidate_learned_value:RequestBatch)\r\ntype LearnerState = map\r\n\r\npredicate BalLt(ba:Ballot, bb:Ballot)\r\n{\r\n || ba.seqno < bb.seqno\r\n || (ba.seqno==bb.seqno && ba.proposer_id < bb.proposer_id)\r\n}\r\n\r\npredicate BalLeq(ba:Ballot, bb:Ballot)\r\n{\r\n || ba.seqno < bb.seqno\r\n || (ba.seqno==bb.seqno && ba.proposer_id <= bb.proposer_id)\r\n}\r\n\r\nlemma lemma_BalLtMiddle(ba:Ballot, bb:Ballot)\r\n requires !BalLt(ba,bb)\r\n requires ba!=bb\r\n ensures BalLt(bb, ba)\r\n{\r\n}\r\n\r\nlemma lemma_BalLtProperties()\r\n ensures forall ba,bb :: !BalLt(ba,bb) && ba!=bb ==> BalLt(bb,ba)\r\n ensures forall ba,bb :: BalLeq(ba,bb) ==> BalLt(ba,bb) || ba==bb\r\n // Transitivity\r\n ensures forall ba,bb,bc :: BalLt(ba, bb) && BalLt(bb, bc) ==> BalLt(ba,bc)\r\n ensures forall ba,bb,bc :: BalLt(ba, bb) && BalLeq(bb, bc) ==> BalLt(ba,bc)\r\n ensures forall ba,bb,bc :: BalLeq(ba, bb) && BalLt(bb, bc) ==> BalLt(ba,bc)\r\n{\r\n forall (ba,bb | !BalLt(ba,bb) && ba!=bb)\r\n ensures BalLt(bb,ba)\r\n {\r\n lemma_BalLtMiddle(ba,bb);\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/SHT/Configuration.i.dfy", "content": "include \"Host.i.dfy\"\r\ninclude \"Parameters.i.dfy\"\r\n\r\nmodule SHT__Configuration_i {\r\nimport opened SHT__Host_i\r\nimport opened Protocol_Parameters_i \r\nimport opened Concrete_NodeIdentity_i`Spec\r\n\r\ndatatype SHTConfiguration = SHTConfiguration(\r\n clientIds:seq,\r\n hostIds:seq,\r\n rootIdentity:NodeIdentity,\r\n params:Parameters)\r\n\r\npredicate HostsDistinct(hostIds:seq, i:int, j:int)\r\n{\r\n 0 <= i < |hostIds| && 0 <= j < |hostIds| && hostIds[i] == hostIds[j] ==> i == j\r\n}\r\n\r\npredicate WFSHTConfiguration(c:SHTConfiguration)\r\n{\r\n 0 < |c.hostIds|\r\n && c.rootIdentity in c.hostIds\r\n && (forall i, j :: HostsDistinct(c.hostIds, i, j))\r\n}\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/SHT/Delegations.i.dfy", "content": "include \"../../Common/Collections/Maps2.s.dfy\"\r\ninclude \"Message.i.dfy\"\r\ninclude \"Keys.i.dfy\"\r\n\r\nmodule SHT__Delegations_i {\r\nimport opened Collections__Maps2_s\r\nimport opened AppInterface_i`Spec\r\nimport opened Concrete_NodeIdentity_i`Spec\r\nimport opened SHT__HT_s\r\nimport opened SHT__Message_i\r\nimport opened SHT__Keys_i\r\n\r\ntype DelegationMap = imap\r\n\r\npredicate DelegationMapComplete(dm:DelegationMap)\r\n{\r\n forall k :: k in dm\r\n}\r\n\r\nfunction {:opaque} UpdateDelegationMap(dm:DelegationMap, newkr:KeyRange, host:NodeIdentity) : DelegationMap\r\n requires DelegationMapComplete(dm);\r\n ensures DelegationMapComplete(UpdateDelegationMap(dm, newkr, host));\r\n ensures forall k :: UpdateDelegationMap(dm, newkr, host)[k] == if KeyRangeContains(newkr, KeyPlus(k)) then host else dm[k];\r\n{\r\n imap k :: if KeyRangeContains(newkr, KeyPlus(k)) then host else dm[k]\r\n}\r\n\r\npredicate DelegateForKeyRangeIsHost(dm:DelegationMap, kr:KeyRange, id:NodeIdentity)\r\n requires DelegationMapComplete(dm);\r\n{\r\n forall k :: KeyRangeContains(kr, KeyPlus(k)) ==> dm[k] == id\r\n}\r\n\r\n// Used in proofs of refinement of implementable data structures to DelegationMap\r\npredicate DelegationMapsAreEqualUpToKey(adm:DelegationMap, bdm:DelegationMap, khi:KeyPlus)\r\n requires DelegationMapComplete(adm);\r\n requires DelegationMapComplete(bdm);\r\n{\r\n forall k :: KeyPlusLt(KeyPlus(k), khi) ==> adm[k] == bdm[k]\r\n}\r\n\r\n// legacy definition\r\nfunction DelegateForKey(dm:DelegationMap, k:Key) : NodeIdentity\r\n requires DelegationMapComplete(dm);\r\n{\r\n dm[k]\r\n}\r\n\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Functions to update a node's hash table on receipt and transmission of\r\n// delegation messages:\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\nfunction BulkUpdateDomain(h:Hashtable, kr:KeyRange, u:Hashtable) : set\r\n{\r\n // Clumsy heuristically-obviously-finite set construction\r\n set k | k in mapdomain(h)+mapdomain(u) && (KeyRangeContains(kr, KeyPlus(k)) ==> k in u)\r\n}\r\n\r\nfunction BulkUpdateHashtable(h:Hashtable, kr:KeyRange, u:Hashtable) : Hashtable\r\n{\r\n map k {:auto_trigger} | k in BulkUpdateDomain(h, kr, u) :: if (k in u) then u[k] else h[k]\r\n}\r\n\r\nfunction BulkRemoveHashtable(h:Hashtable, kr:KeyRange) : Hashtable {\r\n map k | (k in h && !KeyRangeContains(kr, KeyPlus(k))) :: h[k]\r\n}\r\n\r\nfunction ExtractRange(h:Hashtable, kr:KeyRange) : Hashtable {\r\n map k | (k in h && KeyRangeContains(kr, KeyPlus(k))) :: h[k]\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/SHT/Host.i.dfy", "content": "include \"SingleDelivery.i.dfy\"\r\ninclude \"Delegations.i.dfy\"\r\ninclude \"Parameters.i.dfy\"\r\ninclude \"../LiveSHT/RefinementProof/Environment.i.dfy\"\r\ninclude \"../../Common/Collections/Sets.i.dfy\"\r\ninclude \"../../Common/Logic/Option.i.dfy\"\r\ninclude \"../../Services/SHT/AbstractService.s.dfy\"\r\ninclude \"../Common/NodeIdentity.i.dfy\"\r\n\r\nmodule SHT__Host_i {\r\nimport opened Native__Io_s\r\nimport opened Collections__Maps2_s\r\nimport opened SHT__SingleDelivery_i\r\nimport opened SHT__Delegations_i\r\nimport opened Protocol_Parameters_i \r\nimport opened LiveSHT__Environment_i\r\nimport opened Collections__Sets_i\r\nimport opened Logic__Option_i\r\nimport opened AbstractServiceSHT_s`All\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened SHT__HT_s\r\nimport opened SHT__Message_i\r\nimport opened SHT__SingleMessage_i\r\nimport opened SHT__Network_i\r\nimport opened AppInterface_i`Spec\r\nimport opened SHT__Keys_i\r\n\r\ndatatype Constants = Constants(\r\n rootIdentity:NodeIdentity,\r\n hostIds:seq,\r\n params:Parameters)\r\n\r\ndatatype Host = Host(\r\n constants:Constants,\r\n me:NodeIdentity,\r\n ghost delegationMap:DelegationMap,\r\n h:Hashtable,\r\n sd:SingleDeliveryAcct,\r\n receivedPacket:Option,\r\n numDelegations:int,\r\n ghost receivedRequests:seq\r\n )\r\n\r\nfunction LSHTPacketToPacket(lp:LSHTPacket) : Packet\r\n{\r\n Packet(lp.dst, lp.src, lp.msg)\r\n}\r\n\r\npredicate ValidKeyPlus(key:KeyPlus)\r\n{\r\n key.KeyZero? || key.KeyInf? || ValidKey(key.k)\r\n}\r\n\r\npredicate ValidOptionalValue(opt:OptionalValue)\r\n{\r\n opt.ValueAbsent? || ValidValue(opt.v)\r\n}\r\n\r\npredicate ValidKeyRange(kr:KeyRange)\r\n{\r\n ValidKeyPlus(kr.klo) && ValidKeyPlus(kr.khi)\r\n}\r\n\r\nfunction ExtractPacketsFromLSHTPackets(seqPackets:seq) : set\r\n ensures forall p :: p in seqPackets <==> Packet(p.dst, p.src, p.msg) in ExtractPacketsFromLSHTPackets(seqPackets)\r\n{\r\n MapSeqToSet(seqPackets, LSHTPacketToPacket)\r\n}\r\n\r\npredicate DelegationMap_InitTrigger(k:Key)\r\n{\r\n true\r\n}\r\n\r\nfunction DelegationMap_Init(rootIdentity:NodeIdentity) : DelegationMap {\r\n imap k {:trigger DelegationMap_InitTrigger(k)} :: rootIdentity\r\n}\r\n\r\nfunction method HashtableLookup(h:Hashtable, k:Key) : OptionalValue\r\n{\r\n if k in h then ValuePresent(h[k]) else ValueAbsent()\r\n}\r\n\r\n// Initially, everybody thinks the root is in charge of every key.\r\npredicate Host_Init(s:Host, id:NodeIdentity, rootIdentity:NodeIdentity, hostIds:seq, params:Parameters) {\r\n s==Host(\r\n Constants(rootIdentity, hostIds, params),\r\n id,\r\n DelegationMap_Init(rootIdentity),\r\n map [],\r\n SingleDelivery_Init(),\r\n None,\r\n 1,\r\n [])\r\n}\r\n\r\npredicate NextGetRequest_Reply(s:Host, s':Host, src:NodeIdentity, seqno:int, k:Key, sm:SingleMessage, m:Message, out:set, shouldSend:bool)\r\n requires DelegationMapComplete(s.delegationMap);\r\n{\r\n var owner := DelegateForKey(s.delegationMap, k);\r\n if shouldSend && ValidKey(k) then\r\n (if owner == s.me\r\n then \r\n m == Reply(k, HashtableLookup(s.h, k)) \r\n && s'.receivedRequests == s.receivedRequests + [AppGetRequest(seqno, k)]\r\n else \r\n m == Redirect(k, owner)\r\n && s'.receivedRequests == s.receivedRequests\r\n )\r\n && SendSingleMessage(s.sd, s'.sd, m, sm, s.constants.params, shouldSend)\r\n && sm.dst == src\r\n && out == {Packet(src, s.me, sm)}\r\n else\r\n s' == s.(receivedPacket := s'.receivedPacket)\r\n && out == {}\r\n}\r\n\r\npredicate NextGetRequest(s:Host, s':Host, pkt:Packet, out:set)\r\n requires pkt.msg.SingleMessage?;\r\n requires DelegationMapComplete(s.delegationMap);\r\n{\r\n pkt.msg.m.GetRequest?\r\n && s'.delegationMap == s.delegationMap\r\n && s'.h == s.h\r\n && s'.numDelegations == s.numDelegations // UNCHANGED\r\n && (exists sm,m,b :: NextGetRequest_Reply(s, s', pkt.src, pkt.msg.seqno, pkt.msg.m.k_getrequest, sm, m, out, b))\r\n}\r\n\r\npredicate NextSetRequest_Complete(s:Host, s':Host, src:NodeIdentity, seqno:int, reqm:Message, sm:SingleMessage, replym:Message, out:set, shouldSend:bool)\r\n requires DelegationMapComplete(s.delegationMap);\r\n requires reqm.SetRequest?;\r\n{\r\n var k := reqm.k_setrequest;\r\n var ov := reqm.v_setrequest;\r\n var owner := DelegateForKey(s.delegationMap, k);\r\n if shouldSend && ValidKey(k) && ValidOptionalValue(ov) then\r\n (if owner == s.me\r\n then\r\n s'.h == (if ov.ValueAbsent? then mapremove(s.h, k) else s.h[k:=ov.v])\r\n && replym == Reply(k, ov)\r\n && s'.receivedRequests == s.receivedRequests + [AppSetRequest(seqno, k, ov)]\r\n else\r\n s'.h == s.h\r\n && replym == Redirect(k, owner)\r\n && s'.receivedRequests == s.receivedRequests\r\n )\r\n && SendSingleMessage(s.sd, s'.sd, replym, sm, s.constants.params, shouldSend)\r\n && sm.dst == src\r\n && out == {Packet(src, s.me, sm)}\r\n else\r\n s' == s.(receivedPacket := s'.receivedPacket)\r\n && out == {}\r\n}\r\n\r\npredicate NextSetRequest(s:Host, s':Host, pkt:Packet, out:set)\r\n requires pkt.msg.SingleMessage?;\r\n requires DelegationMapComplete(s.delegationMap);\r\n{\r\n pkt.msg.m.SetRequest?\r\n && (exists sm,m,b :: NextSetRequest_Complete(s, s', pkt.src, pkt.msg.seqno, pkt.msg.m, sm, m, out, b))\r\n && s'.delegationMap == s.delegationMap // UNCHANGED\r\n && s'.numDelegations == s.numDelegations // UNCHANGED\r\n}\r\n\r\npredicate NextDelegate(s:Host, s':Host, pkt:Packet, out:set)\r\n requires pkt.msg.SingleMessage?;\r\n requires DelegationMapComplete(s.delegationMap);\r\n{\r\n pkt.msg.m.Delegate?\r\n && (if pkt.src in s.constants.hostIds then\r\n s'.delegationMap == UpdateDelegationMap(s.delegationMap, pkt.msg.m.range, s.me)\r\n && s'.h == BulkUpdateHashtable(s.h, pkt.msg.m.range, pkt.msg.m.h)\r\n && s'.numDelegations == s.numDelegations + 1 \r\n else \r\n s'.delegationMap == s.delegationMap\r\n && s'.h == s.h\r\n && s'.numDelegations == s.numDelegations\r\n )\r\n && SendNoMessage(s.sd, s'.sd)\r\n && ReceiveNoMessage(s.sd, s'.sd)\r\n && out == {}\r\n && s'.receivedRequests == s.receivedRequests\r\n}\r\n\r\npredicate NextShard(s:Host, s':Host, out:set, kr:KeyRange, recipient:NodeIdentity, sm:SingleMessage, shouldSend:bool)\r\n requires DelegationMapComplete(s.delegationMap);\r\n{\r\n recipient != s.me // HISTORY: proof caught this missing conjunct\r\n && recipient in s.constants.hostIds // HISTORY: proof caught this missing conjunct\r\n && DelegateForKeyRangeIsHost(s.delegationMap, kr, s.me) // HISTORY: proof caught this missing conjunct!\r\n && SendSingleMessage(s.sd, s'.sd, Delegate(kr, ExtractRange(s.h, kr)), sm, s.constants.params, shouldSend)\r\n && recipient == sm.dst\r\n && s.constants == s'.constants\r\n && s'.numDelegations == s.numDelegations + 1\r\n && s'.receivedRequests == s.receivedRequests\r\n && if shouldSend then\r\n out == { Packet(recipient, s.me, sm) }\r\n && s'.delegationMap == UpdateDelegationMap(s.delegationMap, kr, recipient)\r\n && s'.h == BulkRemoveHashtable(s.h, kr)\r\n else\r\n out == {}\r\n && s'.delegationMap == s.delegationMap\r\n && s'.h == s.h\r\n}\r\n\r\nfunction max_hashtable_size():int { 62 }\r\n\r\npredicate NextShard_Wrapper(s:Host, s':Host, pkt:Packet, out:set)\r\n requires pkt.msg.SingleMessage?;\r\n requires DelegationMapComplete(s.delegationMap);\r\n{\r\n pkt.msg.m.Shard?\r\n && if ( pkt.msg.m.recipient == s.me\r\n || !ValidKeyRange(pkt.msg.m.kr)\r\n || !ValidPhysicalAddress(pkt.msg.m.recipient)\r\n || EmptyKeyRange(pkt.msg.m.kr)\r\n || pkt.msg.m.recipient !in s.constants.hostIds \r\n || !DelegateForKeyRangeIsHost(s.delegationMap, pkt.msg.m.kr, s.me)\r\n || |ExtractRange(s.h, pkt.msg.m.kr)| >= max_hashtable_size()) then \r\n s' == s.(receivedPacket := s'.receivedPacket) && out == {} \r\n else \r\n exists sm,b :: NextShard(s, s', out, pkt.msg.m.kr, pkt.msg.m.recipient, sm, b)\r\n}\r\n\r\npredicate NextReply(s:Host, s':Host, pkt:Packet, out:set)\r\n requires pkt.msg.SingleMessage?;\r\n requires DelegationMapComplete(s.delegationMap);\r\n{\r\n pkt.msg.m.Reply?\r\n && out == {}\r\n && s' == s.(receivedPacket := s'.receivedPacket)\r\n}\r\n\r\npredicate NextRedirect(s:Host, s':Host, pkt:Packet, out:set)\r\n requires pkt.msg.SingleMessage?;\r\n requires DelegationMapComplete(s.delegationMap);\r\n{\r\n pkt.msg.m.Redirect?\r\n && out == {}\r\n && s' == s.(receivedPacket := s'.receivedPacket)\r\n}\r\n\r\npredicate ShouldProcessReceivedMessage(s:Host)\r\n{\r\n s.receivedPacket.Some?\r\n && s.receivedPacket.v.msg.SingleMessage?\r\n && ((s.receivedPacket.v.msg.m.Delegate? || s.receivedPacket.v.msg.m.Shard?) ==> s.numDelegations < s.constants.params.max_delegations - 2)\r\n}\r\n\r\npredicate Process_Message(s:Host, s':Host, out:set)\r\n requires DelegationMapComplete(s.delegationMap);\r\n{\r\n if ShouldProcessReceivedMessage(s) then\r\n (NextGetRequest(s, s', s.receivedPacket.v, out)\r\n || NextSetRequest(s, s', s.receivedPacket.v, out)\r\n || NextDelegate(s, s', s.receivedPacket.v, out)\r\n || NextShard_Wrapper(s, s', s.receivedPacket.v, out)\r\n || NextReply(s, s', s.receivedPacket.v, out)\r\n || NextRedirect(s, s', s.receivedPacket.v, out))\r\n && s'.receivedPacket.None?\r\n else\r\n s' == s && out == {}\r\n}\r\n\r\npredicate ReceivePacket(s:Host, s':Host, pkt:Packet, out:set, ack:Packet)\r\n{\r\n if s.receivedPacket.None? then // No packet currently waiting to be processed\r\n ReceiveSingleMessage(s.sd, s'.sd, pkt, ack, out) // Record and possibly ack it\r\n && (if NewSingleMessage(s.sd, pkt) then\r\n s'.receivedPacket == Some(pkt) // Enqueue this packet for processing\r\n else\r\n s'.receivedPacket.None?)\r\n && s' == s.(sd := s'.sd, receivedPacket := s'.receivedPacket) // Nothing else changes\r\n else \r\n s' == s && out == {}\r\n}\r\n\r\n\r\npredicate ProcessReceivedPacket(s:Host, s':Host, out:set)\r\n requires DelegationMapComplete(s.delegationMap);\r\n{\r\n if s.receivedPacket.Some? then \r\n Process_Message(s, s', out)\r\n else\r\n s' == s && out == {}\r\n}\r\n\r\n// REVIEW: For safety, we don't need to retransmit at all. \r\n// We could also just retransmit some, but not all, leaving it to the impl to decide.\r\n// For liveness, we have to retransmit some, and at the very least, retransmit in some order.\r\n// I suspect retransmitting them all will simplify things, however.\r\npredicate SpontaneouslyRetransmit(s:Host, s':Host, out:set)\r\n{\r\n (out == UnAckedMessages(s.sd, s.me) && s == s')\r\n}\r\n\r\npredicate Host_Next(s:Host, s':Host, recv:set, out:set)\r\n{\r\n s'.constants == s.constants\r\n && s'.me == s.me\r\n && DelegationMapComplete(s.delegationMap)\r\n && (\r\n (exists pkt, ack :: pkt in recv && ReceivePacket(s, s', pkt, out, ack))\r\n || ProcessReceivedPacket(s, s', out)\r\n || SpontaneouslyRetransmit(s, s', out)\r\n )\r\n}\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/SHT/Keys.i.dfy", "content": "include \"../../Services/SHT/AppInterface.i.dfy\"\r\n\r\nmodule SHT__Keys_i {\r\nimport opened AppInterface_i`All\r\n\r\npredicate method KeyLe(ka:Key, kb:Key) {\r\n ka == kb || KeyLt(ka, kb)\r\n}\r\n\r\nlemma KeyAntisymmetry(ka:Key, kb:Key)\r\n ensures KeyLt(ka,kb) ==> !KeyLe(kb,ka);\r\n ensures !KeyLt(ka,kb) ==> KeyLe(kb,ka);\r\n ensures KeyLe(ka,kb) ==> !KeyLt(kb,ka);\r\n ensures !KeyLe(ka,kb) ==> KeyLt(kb,ka);\r\n{\r\n lemma_KeyOrdering();\r\n}\r\n\r\nlemma KeyEq(ka:Key, kb:Key)\r\n requires ka==kb;\r\n ensures KeyLe(ka, kb);\r\n ensures KeyLe(kb, ka);\r\n{\r\n}\r\n\r\nlemma KeyReflexivity(ka:Key, kb:Key)\r\n requires KeyLe(ka, kb);\r\n requires KeyLe(kb, ka);\r\n ensures ka==kb;\r\n{\r\n lemma_KeyOrdering();\r\n}\r\n\r\nlemma KeyTransitivityLe(ka:Key, kb:Key, kc:Key)\r\n requires KeyLe(ka,kb) && KeyLe(kb,kc);\r\n ensures KeyLe(ka,kc);\r\n{\r\n lemma_KeyOrdering();\r\n}\r\n\r\nlemma KeyTransitivity(ka:Key, kb:Key, kc:Key)\r\n ensures KeyLt(ka,kb) && KeyLe(kb,kc) ==> KeyLt(ka,kc);\r\n ensures KeyLe(ka,kb) && KeyLt(kb,kc) ==> KeyLt(ka,kc);\r\n ensures KeyLt(ka,kb) && KeyLt(kb,kc) ==> KeyLt(ka,kc);\r\n ensures KeyLe(ka,kb) && KeyLe(kb,kc) ==> KeyLe(ka,kc);\r\n{\r\n lemma_KeyOrdering();\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// KeyPlus creates lower and upper bounds for keys\r\n \r\ndatatype KeyPlus = KeyZero() | KeyPlus(k:Key) | KeyInf()\r\n\r\npredicate method KeyPlusLt(kp:KeyPlus, kp':KeyPlus) {\r\n kp != kp' &&\r\n match kp {\r\n case KeyZero => true\r\n case KeyInf => false \r\n case KeyPlus(k) => \r\n match kp' {\r\n case KeyZero => false\r\n case KeyInf => true\r\n case KeyPlus(k') => KeyLt(k, k')\r\n }\r\n }\r\n}\r\n\r\npredicate method KeyPlusLe(kp:KeyPlus, kp':KeyPlus) {\r\n kp == kp' || KeyPlusLt(kp, kp')\r\n}\r\n\r\nlemma KeyPlusAntisymmetry(ka:KeyPlus, kb:KeyPlus)\r\n ensures KeyPlusLt(ka,kb) ==> !KeyPlusLe(kb,ka);\r\n ensures !KeyPlusLt(ka,kb) ==> KeyPlusLe(kb,ka);\r\n ensures KeyPlusLe(ka,kb) ==> !KeyPlusLt(kb,ka);\r\n ensures !KeyPlusLe(ka,kb) ==> KeyPlusLt(kb,ka);\r\n{\r\n if ka.KeyPlus? && kb.KeyPlus? {\r\n KeyAntisymmetry(ka.k, kb.k);\r\n }\r\n}\r\n\r\n\r\nlemma KeyPlusTransitivity(ka:KeyPlus, kb:KeyPlus, kc:KeyPlus)\r\n ensures KeyPlusLt(ka,kb) && KeyPlusLe(kb,kc) ==> KeyPlusLt(ka,kc);\r\n ensures KeyPlusLe(ka,kb) && KeyPlusLt(kb,kc) ==> KeyPlusLt(ka,kc);\r\n ensures KeyPlusLt(ka,kb) && KeyPlusLt(kb,kc) ==> KeyPlusLt(ka,kc);\r\n ensures KeyPlusLe(ka,kb) && KeyPlusLe(kb,kc) ==> KeyPlusLe(ka,kc);\r\n{\r\n lemma_KeyOrdering();\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// KeyRanges\r\n \r\ndatatype KeyRange = KeyRange(klo:KeyPlus, khi:KeyPlus)\r\n // range includes all keys klo <= k < khi\r\n\r\npredicate method KeyRangeContains(range:KeyRange, kp:KeyPlus) {\r\n KeyPlusLe(range.klo, kp) && KeyPlusLt(kp, range.khi)\r\n}\r\n\r\npredicate RangesOverlap(kra:KeyRange, krb:KeyRange) {\r\n KeyRangeContains(kra, krb.klo)\r\n || KeyRangeContains(kra, krb.khi)\r\n || KeyRangeContains(krb, kra.klo)\r\n || KeyRangeContains(krb, kra.khi) // Redundant, but adds symmetry\r\n}\r\n\r\nfunction CompleteRange() : KeyRange\r\n{\r\n KeyRange(KeyZero(), KeyInf())\r\n}\r\n\r\npredicate method EmptyKeyRange(kr:KeyRange)\r\n{\r\n KeyPlusLe(kr.khi, kr.klo)\r\n}\r\n\r\nlemma lemma_EmptyKeyRange(kr:KeyRange)\r\n ensures EmptyKeyRange(kr) <==> !KeyPlusLt(kr.klo, kr.khi);\r\n{\r\n KeyPlusAntisymmetry(kr.klo, kr.khi);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/SHT/Message.i.dfy", "content": "include \"../Common/NodeIdentity.i.dfy\"\r\ninclude \"Keys.i.dfy\"\r\ninclude \"../../Services/SHT/HT.s.dfy\"\r\n\r\nmodule SHT__Message_i {\r\nimport opened AppInterface_i`Spec\r\nimport opened Concrete_NodeIdentity_i`Spec\r\nimport opened SHT__Keys_i\r\nimport opened SHT__HT_s\r\n\r\ndatatype Message =\r\n GetRequest(k_getrequest:Key)\r\n | SetRequest(k_setrequest:Key, v_setrequest:OptionalValue)\r\n | Reply(k_reply:Key, v:OptionalValue)\r\n | Redirect(k_redirect:Key, id:NodeIdentity)\r\n | Shard(kr:KeyRange, recipient:NodeIdentity)\r\n | Delegate(range:KeyRange, h:Hashtable)\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/SHT/Network.i.dfy", "content": "include \"Message.i.dfy\"\r\ninclude \"SingleMessage.i.dfy\"\r\n\r\nmodule SHT__Network_i {\r\nimport opened Concrete_NodeIdentity_i`Spec\r\nimport opened SHT__Message_i\r\nimport opened SHT__SingleMessage_i\r\n\r\n// Ugly failure to parameterize\r\ntype PMsg = SingleMessage\r\ndatatype Packet = Packet(dst:NodeIdentity, src:NodeIdentity, msg:PMsg)\r\n\r\ntype Network = set\r\n\r\npredicate Network_Init(n:Network) {\r\n n == {}\r\n}\r\n\r\nfunction PacketsTo(ps:set, dst:NodeIdentity) : set\r\n{\r\n set p | p in ps && p.dst ==dst\r\n}\r\n\r\npredicate Network_Receive(n:Network, dst:NodeIdentity, recv:set) {\r\n recv == PacketsTo(n, dst)\r\n}\r\n\r\npredicate Network_Send(n:Network, n':Network, src:NodeIdentity, out:set)\r\n{\r\n (forall p :: p in out ==> p.src == src) // Jay rewired this to have OutboundPackets\r\n && n' == n + out\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/SHT/Parameters.i.dfy", "content": "module Protocol_Parameters_i {\r\n\r\ndatatype Parameters = Parameters(max_seqno:nat, max_delegations:nat)\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/SHT/RefinementProof/InvDefs.i.dfy", "content": "include \"SHT.i.dfy\"\r\n\r\nmodule SHT__InvDefs_i {\r\nimport opened SHT__SHT_i\r\nimport opened Concrete_NodeIdentity_i`Spec\r\nimport opened SHT__Network_i\r\nimport opened AppInterface_i`Spec\r\nimport opened SHT__HT_s\r\nimport opened SHT__SingleDelivery_i\r\nimport opened SHT__Host_i\r\nimport opened Logic__Option_i\r\nimport opened SHT__Keys_i\r\nimport opened SHT__Delegations_i\r\n\r\n// The Refinement definition (Lamport's Bar()) is trusted.\r\n// Ugh. That makes the entire Host.i definition ... trusted! Aaagh!\r\n// What a mess. Instead, can't we exists something?\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// These welformedness conditions are needed to define the refinement\r\n// mapping, so they get floated up here \r\n\r\nfunction AllHostIdentities(s:SHT_State) : seq\r\n requires SHT_MapsComplete(s);\r\n ensures forall id :: id in AllHostIdentities(s) ==> id in s.hosts;\r\n{\r\n s.config.hostIds\r\n}\r\n\r\npredicate MapComplete(s:SHT_State)\r\n{\r\n SHT_MapsComplete(s)\r\n && (forall id :: id in AllHostIdentities(s)\r\n ==> DelegationMapComplete(s.hosts[id].delegationMap))\r\n}\r\n\r\npredicate AllDelegationsToKnownHosts(s:SHT_State)\r\n requires MapComplete(s);\r\n{\r\n forall id,k :: id in AllHostIdentities(s)\r\n ==> DelegateForKey(s.hosts[id].delegationMap, k) in AllHostIdentities(s)\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Unacked list\r\n\r\npredicate NoAcksInUnAckedLists(acct:SingleDeliveryAcct)\r\n{\r\n forall id, i :: var unAcked := AckStateLookup(id, acct.sendState).unAcked;\r\n 0 <= i < |unAcked| ==> unAcked[i].SingleMessage?\r\n}\r\n\r\npredicate UnAckedListsSequential(acct:SingleDeliveryAcct)\r\n requires NoAcksInUnAckedLists(acct);\r\n{\r\n forall id, i, j :: var unAcked := AckStateLookup(id, acct.sendState).unAcked;\r\n 0 <= i && j == i + 1 && j < |unAcked|\r\n ==> unAcked[i].seqno + 1 == unAcked[j].seqno\r\n}\r\n\r\npredicate UnAckedDstsConsistent(acct:SingleDeliveryAcct)\r\n requires NoAcksInUnAckedLists(acct);\r\n{\r\n forall id, i :: var unAcked := AckStateLookup(id, acct.sendState).unAcked;\r\n 0 <= i < |unAcked| ==> unAcked[i].dst == id\r\n}\r\n\r\npredicate UnAckedListExceedsNumPacketsAcked(acct:SingleDeliveryAcct)\r\n requires NoAcksInUnAckedLists(acct);\r\n{\r\n forall id :: var ackState := AckStateLookup(id, acct.sendState);\r\n |ackState.unAcked| > 0 ==> ackState.unAcked[0].seqno == ackState.numPacketsAcked + 1\r\n}\r\n\r\npredicate {:opaque} UnAckedListInNetwork(s:SHT_State)\r\n requires MapComplete(s);\r\n{\r\n forall id,msg,dst {:trigger msg in AckStateLookup(dst, s.hosts[id].sd.sendState).unAcked } :: \r\n id in AllHostIdentities(s)\r\n && msg in AckStateLookup(dst, s.hosts[id].sd.sendState).unAcked\r\n && NoAcksInUnAckedLists(s.hosts[id].sd)\r\n && dst == msg.dst\r\n ==> Packet(msg.dst, s.hosts[id].me, msg) in s.network\r\n}\r\n\r\npredicate UnAckedListProperties(acct:SingleDeliveryAcct)\r\n{\r\n NoAcksInUnAckedLists(acct)\r\n && UnAckedListsSequential(acct)\r\n && UnAckedListExceedsNumPacketsAcked(acct)\r\n && UnAckedDstsConsistent(acct)\r\n}\r\n\r\npredicate AckListsInv(s:SHT_State)\r\n requires MapComplete(s);\r\n{\r\n UnAckedListInNetwork(s)\r\n && (forall id :: id in AllHostIdentities(s) ==> UnAckedListProperties(s.hosts[id].sd))\r\n}\r\n\r\n/*\r\npredicate NoAcksInUnAckedLists(s:SHT_State)\r\n requires MapComplete(s);\r\n{\r\n forall id, id' :: id in AllHostIdentities() && id' in AllHostIdentities() \r\n ==> (var unAcked := AckStateLookup(id', s.hosts[id].sd.sendState).unAcked;\r\n forall i :: 0 <= i < |unAcked| ==> unAcked[i].SingleMessage?)\r\n}\r\n\r\npredicate UnAckedListsSequential(s:SHT_State)\r\n requires MapComplete(s);\r\n requires NoAcksInUnAckedLists(s);\r\n{\r\n forall id, id' :: id in AllHostIdentities() && id' in AllHostIdentities() \r\n ==> (var unAcked := AckStateLookup(id', s.hosts[id].sd.sendState).unAcked;\r\n forall i, j :: 0 <= i && j == i + 1 && j < |unAcked|\r\n ==> unAcked[i].seqno + 1 == unAcked[j].seqno)\r\n}\r\n\r\npredicate UnAckedListExceedsNumPacketsAcked(s:SHT_State)\r\n requires MapComplete(s);\r\n requires NoAcksInUnAckedLists(s);\r\n{\r\n forall id, id' :: id in AllHostIdentities() && id' in AllHostIdentities() \r\n ==> (var ackState := AckStateLookup(id', s.hosts[id].sd.sendState);\r\n |ackState.unAcked| > 0 ==> ackState.unAcked[0].seqno == ackState.numPacketsAcked + 1)\r\n}\r\n*/\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Hosts claim keys\r\n\r\npredicate DelegationPacket(p:Option)\r\n{\r\n p.Some? && p.v.msg.SingleMessage? && p.v.msg.m.Delegate?\r\n}\r\n\r\npredicate BufferedPacketClaimsKey(s:Host, k:Key)\r\n{\r\n DelegationPacket(s.receivedPacket) && KeyRangeContains(s.receivedPacket.v.msg.m.range, KeyPlus(k))\r\n && s.receivedPacket.v.src in s.constants.hostIds\r\n && s.receivedPacket.v.dst in s.constants.hostIds\r\n}\r\n\r\npredicate HostClaimsKey(s:Host, k:Key)\r\n requires DelegationMapComplete(s.delegationMap);\r\n{\r\n // My map tells me I own the key\r\n DelegateForKey(s.delegationMap, k)==s.me\r\n || // or I have a buffered delegation message that gives me ownership of the key\r\n BufferedPacketClaimsKey(s, k)\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// Packets claim keys\r\n\r\npredicate PacketsHaveSaneHeaders(s:SHT_State)\r\n requires MapComplete(s);\r\n{\r\n true\r\n// Can't establish this once we start letting clients send packets\r\n// forall pkt :: pkt in s.network\r\n// ==> pkt.src in AllHostIdentities(s) && pkt.dst in AllHostIdentities(s)\r\n}\r\n\r\npredicate PacketInFlight(s:SHT_State, pkt:Packet)\r\n requires MapComplete(s);\r\n{\r\n pkt in s.network \r\n && pkt.src in AllHostIdentities(s)\r\n && pkt.dst in AllHostIdentities(s)\r\n && MessageNotReceived(s.hosts[pkt.dst].sd, pkt.src, pkt.msg)\r\n}\r\n\r\npredicate InFlightPacketClaimsKey(s:SHT_State, pkt:Packet, k:Key)\r\n requires MapComplete(s);\r\n{\r\n pkt.msg.SingleMessage?\r\n && pkt.msg.m.Delegate?\r\n && PacketInFlight(s, pkt)\r\n && KeyRangeContains(pkt.msg.m.range, KeyPlus(k))\r\n}\r\n\r\n// TODO Explicitly name these CHOOSE invocations to work around Dafny bug\r\nfunction ThePacketThatClaimsKey(s:SHT_State, k:Key) : Packet\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires exists pkt :: InFlightPacketClaimsKey(s,pkt,k);\r\n ensures var p := ThePacketThatClaimsKey(s,k);\r\n p.msg.SingleMessage? && p.msg.m.Delegate?;\r\n{\r\n var pkt :| InFlightPacketClaimsKey(s,pkt,k); pkt\r\n}\r\n\r\nfunction TheHostThatClaimsKey(s:SHT_State, k:Key) : NodeIdentity\r\n requires MapComplete(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n requires exists id {:trigger HostClaimsKey(s.hosts[id], k)} :: id in AllHostIdentities(s) && HostClaimsKey(s.hosts[id], k);\r\n{\r\n var id :| id in AllHostIdentities(s) && HostClaimsKey(s.hosts[id], k); id\r\n}\r\n\r\nfunction FindHostHashTable(s:SHT_State, k:Key) : Hashtable\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n requires exists id {:trigger HostClaimsKey(s.hosts[id], k)} ::\r\n id in AllHostIdentities(s) && HostClaimsKey(s.hosts[id], k);\r\n{\r\n var id := TheHostThatClaimsKey(s, k);\r\n if BufferedPacketClaimsKey(s.hosts[id], k) then\r\n // && NewSingleMessage(s.hosts[id].sd, s.hosts[id].receivedPacket.v) then\r\n s.hosts[id].receivedPacket.v.msg.m.h\r\n else // assert DelegateForKey(s.hosts[id].delegationMap, k)==s.hosts[id]..me \r\n s.hosts[id].h\r\n}\r\n\r\nfunction FindHashTable(s:SHT_State, k:Key) : Hashtable\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n{\r\n if exists pkt :: InFlightPacketClaimsKey(s,pkt,k) then\r\n ThePacketThatClaimsKey(s,k).msg.m.h\r\n else if exists id {:trigger HostClaimsKey(s.hosts[id], k)} :: \r\n id in AllHostIdentities(s) && HostClaimsKey(s.hosts[id], k) then\r\n FindHostHashTable(s, k)\r\n else\r\n // Inv ==> this case is false\r\n map []\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/SHT/RefinementProof/InvProof.i.dfy", "content": "include \"InvDefs.i.dfy\"\r\n\r\nmodule SHT__InvProof_i {\r\nimport opened Native__Io_s\r\nimport opened SHT__SHT_i\r\nimport opened Concrete_NodeIdentity_i`Spec\r\nimport opened SHT__Network_i\r\nimport opened AppInterface_i`Spec\r\nimport opened SHT__HT_s\r\nimport opened SHT__SingleDelivery_i\r\nimport opened SHT__Host_i\r\nimport opened Logic__Option_i\r\nimport opened SHT__Keys_i\r\nimport opened SHT__Delegations_i\r\nimport opened SHT__InvDefs_i\r\nimport opened SHT__Message_i\r\nimport opened SHT__SingleMessage_i\r\nimport opened Protocol_Parameters_i\r\nimport opened SHT__Configuration_i\r\n\r\nlemma lemma_AllDelegationsToKnownHosts(s:SHT_State, k:Key, id:NodeIdentity, nextId:NodeIdentity)\r\n requires MapComplete(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n requires id in AllHostIdentities(s);\r\n requires nextId == DelegateForKey(s.hosts[id].delegationMap, k);\r\n ensures nextId in AllHostIdentities(s);\r\n{\r\n var dm := s.hosts[id].delegationMap;\r\n}\r\n\r\npredicate NoHostsStoreEmptyValues(s:SHT_State)\r\n requires MapComplete(s);\r\n{\r\n forall id,k ::\r\n id in AllHostIdentities(s) && HostClaimsKey(s.hosts[id], k) && k in s.hosts[id].h\r\n ==> HashtableLookup(s.hosts[id].h, k) != ValueAbsent()\r\n}\r\n\r\npredicate BufferedDelegationPacketPresent(pkt:Option)\r\n requires DelegationPacket(pkt);\r\n{\r\n forall k {:trigger HashtableLookup(pkt.v.msg.m.h, k) }:: \r\n k in pkt.v.msg.m.h ==> HashtableLookup(pkt.v.msg.m.h, k) != ValueAbsent()\r\n}\r\n\r\npredicate BufferedPacketsInv(s:SHT_State)\r\n requires MapComplete(s);\r\n{\r\n forall id :: id in AllHostIdentities(s) ==> \r\n (s.hosts[id].receivedPacket.Some? ==> s.hosts[id].receivedPacket.v in s.network)\r\n &&\r\n (s.hosts[id].receivedPacket.Some? ==> s.hosts[id].receivedPacket.v.dst == id)\r\n &&\r\n (DelegationPacket(s.hosts[id].receivedPacket) ==> BufferedDelegationPacketPresent(s.hosts[id].receivedPacket))\r\n \r\n}\r\n\r\npredicate DestinationsConsistent(s:SHT_State) \r\n requires MapComplete(s);\r\n{\r\n forall pkt :: pkt in s.network && pkt.msg.SingleMessage? && pkt.src in AllHostIdentities(s)\r\n ==> pkt.msg.dst == pkt.dst\r\n}\r\n\r\npredicate DelegationMessagesCarryNoEmptyValues(s:SHT_State)\r\n{\r\n forall pkt, k :: pkt in s.network && pkt.msg.SingleMessage? && pkt.msg.m.Delegate? && k in pkt.msg.m.h\r\n ==> HashtableLookup(pkt.msg.m.h, k) != ValueAbsent()\r\n}\r\n\r\npredicate DelegationMessagesCarryOnlyClaimedKeys(s:SHT_State)\r\n requires MapComplete(s);\r\n{\r\n forall pkt, k :: pkt in s.network && pkt.src in AllHostIdentities(s)\r\n && pkt.msg.SingleMessage? && pkt.msg.m.Delegate? && k in pkt.msg.m.h\r\n ==> KeyRangeContains(pkt.msg.m.range, KeyPlus(k))\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n// EachKeyClaimedInExactlyOnePlace (one Host or one Packet)\r\n\r\npredicate SomeHostClaimsKey(s:SHT_State, k:Key)\r\n requires MapComplete(s);\r\n{\r\n exists id\r\n {:trigger HostClaimsKey(s.hosts[id], k)}\r\n :: id in AllHostIdentities(s) && HostClaimsKey(s.hosts[id], k)\r\n}\r\n\r\npredicate OnlyOneHostClaimsKey(s:SHT_State, k:Key)\r\n requires MapComplete(s);\r\n{\r\n forall i1,i2\r\n {:trigger HostClaimsKey(s.hosts[i1], k), HostClaimsKey(s.hosts[i2], k)}\r\n ::\r\n i1 in AllHostIdentities(s) && HostClaimsKey(s.hosts[i1], k)\r\n && i2 in AllHostIdentities(s) && HostClaimsKey(s.hosts[i2], k)\r\n ==> i1==i2\r\n}\r\n\r\npredicate UniqueHostClaimsKey(s:SHT_State, k:Key)\r\n requires MapComplete(s);\r\n{\r\n SomeHostClaimsKey(s,k) && OnlyOneHostClaimsKey(s,k)\r\n}\r\n\r\npredicate NoHostClaimsKey(s:SHT_State, k:Key)\r\n requires MapComplete(s);\r\n{\r\n forall id\r\n {:trigger HostClaimsKey(s.hosts[id], k)}\r\n :: id in AllHostIdentities(s) ==> !HostClaimsKey(s.hosts[id], k)\r\n}\r\n\r\npredicate SomePacketClaimsKey(s:SHT_State, k:Key)\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n{\r\n exists pkt\r\n {:trigger InFlightPacketClaimsKey(s, pkt, k)}\r\n :: InFlightPacketClaimsKey(s, pkt, k)\r\n}\r\n\r\npredicate OnlyOnePacketClaimsKey(s:SHT_State, k:Key)\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n{\r\n forall p1,p2\r\n// {:trigger InFlightPacketClaimsKey(s, p1, k), InFlightPacketClaimsKey(s, p2, k)}\r\n {:auto_trigger}\r\n :: InFlightPacketClaimsKey(s, p1, k) && InFlightPacketClaimsKey(s, p2, k) ==> p1==p2\r\n}\r\n\r\npredicate UniqueInFlightPacketClaimsKey(s:SHT_State, k:Key)\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n{\r\n SomePacketClaimsKey(s, k) && OnlyOnePacketClaimsKey(s, k)\r\n}\r\n\r\npredicate NoInFlightPacketClaimsKey(s:SHT_State, k:Key)\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n{\r\n forall pkt\r\n {:trigger InFlightPacketClaimsKey(s, pkt, k)}\r\n :: !InFlightPacketClaimsKey(s, pkt, k)\r\n}\r\n\r\n// Lots of exists in here seem to make this a brittle invariant to expose.\r\npredicate {:opaque} EachKeyClaimedInExactlyOnePlace(s:SHT_State)\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n{\r\n forall k ::\r\n (UniqueInFlightPacketClaimsKey(s, k) && NoHostClaimsKey(s, k))\r\n || (NoInFlightPacketClaimsKey(s, k) && UniqueHostClaimsKey(s, k))\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\npredicate InvConstants(s:SHT_State)\r\n requires MapComplete(s);\r\n{\r\n forall id {:auto_trigger} :: id in AllHostIdentities(s)\r\n ==> s.hosts[id].me == id && s.hosts[id].constants.hostIds == s.config.hostIds\r\n}\r\n\r\npredicate HostsStoreOnlyOwnedKeys(s:SHT_State)\r\n requires MapComplete(s);\r\n{\r\n forall id,k :: id in AllHostIdentities(s) && k in s.hosts[id].h\r\n ==> HostClaimsKey(s.hosts[id], k)\r\n}\r\n\r\npredicate {:opaque} PacketsHaveSenderUniqueSeqnos(s:SHT_State)\r\n requires MapComplete(s);\r\n{\r\n forall p1,p2 ::\r\n p1 in s.network && p2 in s.network\r\n && p1.msg.SingleMessage? && p2.msg.SingleMessage? \r\n && p1.src == p2.src && p1.dst == p2.dst\r\n && p1.src in AllHostIdentities(s) && p1.dst in AllHostIdentities(s)\r\n && p2.src in AllHostIdentities(s) && p2.dst in AllHostIdentities(s)\r\n && p1.msg.seqno == p2.msg.seqno\r\n ==> p1 == p2\r\n}\r\n\r\n// Need this invariant to prove ReceiverHasCanceledNoUnsentSeqnos\r\npredicate NoPacketContainsUnsentSeqno(s:SHT_State)\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n{\r\n forall pkt :: pkt in s.network && pkt.msg.SingleMessage? \r\n && pkt.src in AllHostIdentities(s) && pkt.dst in AllHostIdentities(s)\r\n ==> pkt.msg.seqno <= HighestSeqnoSent(s.hosts[pkt.src].sd, pkt.dst)\r\n}\r\n\r\n// Need this invariant to ensure that, at the moment we send a packet,\r\n// it isn't DOA because the recipient had inflated his receive seqno\r\npredicate ReceiverHasNotCanceledUnsentSeqno(s:SHT_State, dst:NodeIdentity, src:NodeIdentity, seqno:int)\r\n requires MapComplete(s);\r\n{\r\n dst in AllHostIdentities(s)\r\n && src in AllHostIdentities(s)\r\n && HighestSeqnoSent(s.hosts[src].sd, dst) < seqno\r\n ==> seqno > TombstoneTableLookup(src, s.hosts[dst].sd.receiveState)\r\n}\r\n\r\npredicate ReceiverHasCanceledNoUnsentSeqnos(s:SHT_State)\r\n requires MapComplete(s);\r\n{\r\n forall dst, src, seqno :: ReceiverHasNotCanceledUnsentSeqno(s, dst, src, seqno)\r\n}\r\n\r\n///////////////////////////////////////////////////////\r\n// The ultimate invariant\r\n//////////////////////////////////////////////////////\r\n\r\npredicate Inv(s:SHT_State)\r\n{\r\n MapComplete(s)\r\n && InvConstants(s)\r\n && AckListsInv(s)\r\n && AllDelegationsToKnownHosts(s)\r\n && HostsStoreOnlyOwnedKeys(s)\r\n && BufferedPacketsInv(s)\r\n && DestinationsConsistent(s)\r\n && NoHostsStoreEmptyValues(s)\r\n && DelegationMessagesCarryNoEmptyValues(s)\r\n && DelegationMessagesCarryOnlyClaimedKeys(s)\r\n && PacketsHaveSaneHeaders(s)\r\n && PacketsHaveSenderUniqueSeqnos(s)\r\n// && NoHostClaimsInFlightKeys(s)\r\n && NoPacketContainsUnsentSeqno(s)\r\n && ReceiverHasCanceledNoUnsentSeqnos(s)\r\n && EachKeyClaimedInExactlyOnePlace(s)\r\n}\r\n\r\npredicate {:opaque} HiddenInv(s:SHT_State)\r\n{\r\n Inv(s)\r\n}\r\n\r\n///////////////////////////////////////////////////////\r\n// AckList \r\n//////////////////////////////////////////////////////\r\n\r\nlemma TruncateAckPreservesUnAckListProperties(unAcked:seq>, old_seqno:nat, new_seqno:nat, id:NodeIdentity)\r\n requires forall i :: 0 <= i < |unAcked| ==> unAcked[i].SingleMessage?\r\n requires forall i, j :: 0 <= i && j == i + 1 && j < |unAcked|\r\n ==> unAcked[i].seqno + 1 == unAcked[j].seqno;\r\n requires |unAcked| > 0 ==> unAcked[0].seqno == old_seqno + 1;\r\n requires new_seqno >= old_seqno;\r\n requires forall i :: 0 <= i < |unAcked| ==> unAcked[i].dst == id;\r\n ensures var truncated := TruncateUnAckList(unAcked, new_seqno);\r\n forall i :: 0 <= i < |truncated| ==> truncated[i].SingleMessage?;\r\n ensures var truncated := TruncateUnAckList(unAcked, new_seqno);\r\n forall i, j :: 0 <= i && j == i + 1 && j < |truncated|\r\n ==> truncated[i].seqno + 1 == truncated[j].seqno;\r\n ensures var truncated := TruncateUnAckList(unAcked, new_seqno);\r\n |truncated| > 0 ==> truncated[0].seqno == new_seqno + 1;\r\n ensures var truncated := TruncateUnAckList(unAcked, new_seqno);\r\n |unAcked| - |truncated| <= new_seqno - old_seqno;\r\n ensures var truncated := TruncateUnAckList(unAcked, new_seqno);\r\n forall i :: 0 <= i < |truncated| ==> truncated[i].dst == id;\r\n{\r\n assert |unAcked| > 0 ==> unAcked[0].SingleMessage?;\r\n if |unAcked| > 0 && unAcked[0].SingleMessage? && unAcked[0].seqno <= new_seqno {\r\n TruncateAckPreservesUnAckListProperties(unAcked[1..], old_seqno + 1, new_seqno, id);\r\n } else {\r\n if |unAcked| == 0 {\r\n } else {\r\n assert unAcked[0].seqno > new_seqno;\r\n }\r\n }\r\n}\r\n\r\nlemma TruncateAckPreservesSubset(unAcked:seq>)\r\n ensures forall m, seqno:nat :: var truncated := TruncateUnAckList(unAcked, seqno);\r\n m in truncated ==> m in unAcked;\r\n{\r\n forall m, seqno:nat | var truncated := TruncateUnAckList(unAcked, seqno);\r\n m in truncated \r\n ensures m in unAcked;\r\n {\r\n \r\n }\r\n \r\n}\r\n\r\nlemma UnAckedListFinalEntry(unAcked:seq>, old_seqno:nat)\r\n requires forall i :: 0 <= i < |unAcked| ==> unAcked[i].SingleMessage?\r\n requires forall i, j :: 0 <= i && j == i + 1 && j < |unAcked|\r\n ==> unAcked[i].seqno + 1 == unAcked[j].seqno\r\n requires |unAcked| > 0 ==> unAcked[0].seqno == old_seqno + 1;\r\n ensures |unAcked| > 0 ==> unAcked[|unAcked|-1].seqno == old_seqno + |unAcked|;\r\n{\r\n if |unAcked| == 0 {\r\n } else {\r\n UnAckedListFinalEntry(unAcked[1..], old_seqno+1);\r\n }\r\n}\r\n\r\nlemma SendSingleMessagePreservesUnAckListProperties(s:SingleDeliveryAcct, s':SingleDeliveryAcct, m:MT, sm:SingleMessage, params:Parameters, shouldSend:bool)\r\n requires UnAckedListProperties(s);\r\n requires ReceiveNoMessage(s, s');\r\n requires SendSingleMessage(s, s', m, sm, params, shouldSend);\r\n ensures UnAckedListProperties(s');\r\n{\r\n // Prove NoAcksInUnAckedLists\r\n assert forall id :: var unAcked := AckStateLookup(id, s.sendState).unAcked;\r\n forall i :: 0 <= i < |unAcked| ==> unAcked[i].SingleMessage?;\r\n forall id \r\n ensures var unAcked := AckStateLookup(id, s'.sendState).unAcked;\r\n forall i :: 0 <= i < |unAcked| ==> unAcked[i].SingleMessage?;\r\n {\r\n var unAcked := AckStateLookup(id, s'.sendState).unAcked;\r\n if sm.dst == id {\r\n assert shouldSend ==> unAcked == AckStateLookup(id, s.sendState).unAcked + [ sm ]; // OBSERVE: Key fact, I think\r\n } else {\r\n assert unAcked == AckStateLookup(id, s.sendState).unAcked; \r\n }\r\n }\r\n\r\n // Prove UnAckedListsSequential\r\n forall id \r\n ensures var unAcked := AckStateLookup(id, s'.sendState).unAcked;\r\n forall i, j :: 0 <= i && j == i + 1 && j < |unAcked|\r\n ==> unAcked[i].seqno + 1 == unAcked[j].seqno\r\n {\r\n var numPacketsAcked := AckStateLookup(id, s.sendState).numPacketsAcked;\r\n var unAcked := AckStateLookup(id, s.sendState).unAcked;\r\n var unAcked' := AckStateLookup(id, s'.sendState).unAcked;\r\n if sm.dst == id {\r\n assert shouldSend ==> unAcked' == unAcked + [ sm ];\r\n if unAcked == [] {\r\n } else {\r\n assert unAcked[0].seqno == numPacketsAcked+1;\r\n UnAckedListFinalEntry(unAcked, numPacketsAcked);\r\n assert unAcked[|unAcked|-1].seqno == numPacketsAcked+1+|unAcked|-1;\r\n }\r\n assert shouldSend ==> sm.seqno == numPacketsAcked + |unAcked| + 1;\r\n } else {\r\n assert unAcked' == unAcked; \r\n }\r\n }\r\n\r\n // Prove UnAckedListExceedsNumPacketsAcked\r\n forall id \r\n ensures var ackState := AckStateLookup(id, s'.sendState);\r\n |ackState.unAcked| > 0 ==> ackState.unAcked[0].seqno == ackState.numPacketsAcked + 1;\r\n ensures var ackState := AckStateLookup(id, s'.sendState);\r\n forall i :: 0 <= i < |ackState.unAcked| ==> ackState.unAcked[i].dst == id;\r\n {\r\n var unAcked := AckStateLookup(id, s.sendState).unAcked;\r\n var unAcked' := AckStateLookup(id, s'.sendState).unAcked;\r\n\r\n if sm.dst == id {\r\n assert shouldSend ==> unAcked' == unAcked + [ sm ]; // OBSERVE: Key fact, I think\r\n } else {\r\n assert unAcked' == unAcked; \r\n }\r\n \r\n\r\n }\r\n\r\n}\r\n\r\nlemma ReceiveAckPreservesUnAckListProperties(s:SingleDeliveryAcct, s':SingleDeliveryAcct, pkt:Packet, acks:set)\r\n requires UnAckedListProperties(s);\r\n requires pkt.msg.Ack?;\r\n requires ReceiveAck(s, s', pkt, acks);\r\n ensures UnAckedListProperties(s');\r\n{\r\n var oldAckState := AckStateLookup(pkt.src, s.sendState);\r\n var newAckState := AckStateLookup(pkt.src, s'.sendState);\r\n if pkt.msg.ack_seqno > oldAckState.numPacketsAcked {\r\n TruncateAckPreservesUnAckListProperties(oldAckState.unAcked, oldAckState.numPacketsAcked, pkt.msg.ack_seqno, pkt.src);\r\n assert forall id :: id != pkt.src ==> // OBSERVE\r\n var unAcked := AckStateLookup(id, s.sendState ).unAcked;\r\n var unAcked' := AckStateLookup(id, s'.sendState).unAcked;\r\n unAcked == unAcked';\r\n } else {\r\n }\r\n}\r\n\r\nlemma HighestSeqnoSent_Monotonic(s:SingleDeliveryAcct, s':SingleDeliveryAcct, pkt:Packet, acks:set)\r\n requires UnAckedListProperties(s);\r\n requires pkt.msg.Ack?;\r\n requires ReceiveAck(s, s', pkt, acks);\r\n ensures forall dst :: HighestSeqnoSent(s', dst) >= HighestSeqnoSent(s, dst);\r\n{\r\n ReceiveAckPreservesUnAckListProperties(s, s', pkt, acks);\r\n\r\n forall dst \r\n ensures HighestSeqnoSent(s', dst) >= HighestSeqnoSent(s, dst);\r\n {\r\n if dst != pkt.src {\r\n assert HighestSeqnoSent(s', dst) == HighestSeqnoSent(s, dst);\r\n } else {\r\n var oldAckState := AckStateLookup(dst, s.sendState);\r\n\r\n if pkt.msg.ack_seqno > oldAckState.numPacketsAcked {\r\n var newAckState := oldAckState.(numPacketsAcked := pkt.msg.ack_seqno,\r\n unAcked := TruncateUnAckList(oldAckState.unAcked, pkt.msg.ack_seqno));\r\n assert s'.sendState[dst] == newAckState;\r\n TruncateAckPreservesUnAckListProperties(oldAckState.unAcked, oldAckState.numPacketsAcked, pkt.msg.ack_seqno, dst);\r\n calc {\r\n HighestSeqnoSent(s, dst);\r\n oldAckState.numPacketsAcked + |oldAckState.unAcked|;\r\n <= \r\n newAckState.numPacketsAcked + |newAckState.unAcked|;\r\n HighestSeqnoSent(s', dst);\r\n }\r\n } else {\r\n }\r\n }\r\n }\r\n var oldAckState := AckStateLookup(pkt.src, s.sendState);\r\n}\r\n\r\n\r\nlemma ReceivePacket_UnsentSeqnos(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, rpkt:Packet, out:set, ack:Packet)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires ReceivePacket(s.hosts[id], s'.hosts[id], rpkt, out, ack);\r\n requires s.hosts[id].receivedPacket.None?;\r\n requires rpkt in recv;\r\n ensures ReceiverHasCanceledNoUnsentSeqnos(s');\r\n{\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n\r\n assert ReceiveSingleMessage(h.sd, h'.sd, rpkt, ack, out);\r\n assert forall pkt :: pkt in s'.network && pkt.msg.SingleMessage?\r\n ==> pkt in s.network;\r\n assert NoPacketContainsUnsentSeqno(s);\r\n assert forall other_id :: other_id in AllHostIdentities(s) && other_id != id ==> s.hosts[other_id] == s'.hosts[other_id];\r\n reveal_PacketsHaveSenderUniqueSeqnos();\r\n\r\n // Prove ReceiverHasCanceledNoUnsentSeqnos(s')\r\n forall dst, src, seqno {:trigger ReceiverHasNotCanceledUnsentSeqno(s', dst, src, seqno)} | dst in AllHostIdentities(s') && src in AllHostIdentities(s')\r\n && HighestSeqnoSent(s'.hosts[src].sd, dst) < seqno\r\n ensures seqno > TombstoneTableLookup(src, s'.hosts[dst].sd.receiveState);\r\n {\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, dst, src, seqno); // OBSERVE: Need to trigger to expand the definition\r\n var seqno_sent := HighestSeqnoSent(s.hosts[src].sd, dst);\r\n var seqno_sent' := HighestSeqnoSent(s'.hosts[src].sd, dst);\r\n var seqno_recv := TombstoneTableLookup(src, s.hosts[dst].sd.receiveState);\r\n var seqno_recv' := TombstoneTableLookup(src, s'.hosts[dst].sd.receiveState);\r\n\r\n assert forall i :: i in AllHostIdentities(s') && i != id ==> s'.hosts[i] == s.hosts[i];\r\n //assert rpkt.src != rpkt.dst;\r\n if src != id {\r\n assert seqno_sent == seqno_sent';\r\n } else {\r\n assert src == id == rpkt.dst;\r\n var oldAckState := AckStateLookup(dst, h.sd.sendState);\r\n var ackState' := AckStateLookup(dst, h'.sd.sendState);\r\n assert seqno_sent' == ackState'.numPacketsAcked + |ackState'.unAcked|;\r\n if rpkt.msg.Ack? && ReceiveAck(h.sd, h'.sd, rpkt, out) {\r\n if dst != rpkt.src {\r\n assert seqno_sent' == seqno_sent;\r\n } else {\r\n HighestSeqnoSent_Monotonic(h.sd, h'.sd, rpkt, out);\r\n if rpkt.msg.ack_seqno > oldAckState.numPacketsAcked {\r\n assert seqno_sent' >= seqno_sent;\r\n } else {\r\n assert seqno_sent' == seqno_sent;\r\n }\r\n assert seqno_sent' >= seqno_sent;\r\n }\r\n } else {\r\n assert h'.sd.sendState == h.sd.sendState;\r\n assert seqno_sent' == seqno_sent;\r\n }\r\n }\r\n\r\n if NewSingleMessage(h.sd, rpkt) {\r\n if rpkt.src == src && dst == id {\r\n assert seqno_recv' == seqno_recv + 1;\r\n } else {\r\n assert seqno_recv' == seqno_recv;\r\n }\r\n } else {\r\n assert seqno_recv == seqno_recv';\r\n }\r\n\r\n assert seqno > seqno_recv';\r\n }\r\n}\r\n\r\nlemma ReceivePacket_EachKeyClaimed(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, rpkt:Packet, out:set, ack:Packet)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires ReceivePacket(s.hosts[id], s'.hosts[id], rpkt, out, ack);\r\n requires s.hosts[id].receivedPacket.None?;\r\n requires rpkt in recv;\r\n ensures EachKeyClaimedInExactlyOnePlace(s');\r\n{\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n\r\n assert ReceiveSingleMessage(h.sd, h'.sd, rpkt, ack, out);\r\n\r\n if NewSingleMessage(h.sd, rpkt) {\r\n assert h' == h.(sd := h'.sd, receivedPacket := Some(rpkt));\r\n } else {\r\n assert h' == h.(sd := h'.sd, receivedPacket := None);\r\n }\r\n\r\n // Prove EachKeyClaimedInExactlyOnePlace(s');\r\n forall () ensures EachKeyClaimedInExactlyOnePlace(s');\r\n {\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert forall k :: (UniqueInFlightPacketClaimsKey(s, k) && NoHostClaimsKey(s, k))\r\n || (NoInFlightPacketClaimsKey(s, k) && UniqueHostClaimsKey(s, k));\r\n forall k \r\n ensures (UniqueInFlightPacketClaimsKey(s', k) && NoHostClaimsKey(s', k))\r\n || (NoInFlightPacketClaimsKey(s', k) && UniqueHostClaimsKey(s', k))\r\n {\r\n if UniqueInFlightPacketClaimsKey(s, k) {\r\n assert exists pkt :: InFlightPacketClaimsKey(s, pkt, k); // OBSERVE\r\n var pkt :| InFlightPacketClaimsKey(s, pkt, k); \r\n var last_seqno := TombstoneTableLookup(pkt.src, s.hosts[pkt.dst].sd.receiveState);\r\n var last_seqno' := TombstoneTableLookup(pkt.src, s'.hosts[pkt.dst].sd.receiveState);\r\n assert pkt.msg.seqno > last_seqno;\r\n if pkt != rpkt {\r\n assert pkt in s'.network;\r\n if pkt.dst != id {\r\n assert pkt.msg.SingleMessage? && pkt.msg.seqno > last_seqno';\r\n } else {\r\n if NewSingleMessage(h.sd, rpkt) {\r\n assert h' == h.(sd := h'.sd, receivedPacket := Some(rpkt));\r\n if rpkt.src == pkt.src {\r\n forall () ensures pkt.msg.seqno != rpkt.msg.seqno; {\r\n reveal_PacketsHaveSenderUniqueSeqnos();\r\n }\r\n assert pkt.msg.SingleMessage? && pkt.msg.seqno > last_seqno';\r\n } else {\r\n assert pkt.msg.SingleMessage? && pkt.msg.seqno > last_seqno';\r\n }\r\n } else {\r\n assert h' == h.(sd := h'.sd, receivedPacket := None);\r\n assert pkt.msg.SingleMessage? && pkt.msg.seqno > last_seqno';\r\n }\r\n }\r\n assert PacketInFlight(s', pkt);\r\n assert InFlightPacketClaimsKey(s', pkt, k); // OBSERVE, exists trigger for SomePacketClaimsKey(s, k)\r\n assert forall p1,p2 {:auto_trigger} :: // OBSERVE for OnlyOnePacketClaimsKey(s', k)\r\n InFlightPacketClaimsKey(s, p1, k) && InFlightPacketClaimsKey(s, p2, k) ==> p1==p2;\r\n forall p1,p2 {:auto_trigger} | InFlightPacketClaimsKey(s', p1, k) // OBSERVE for OnlyOnePacketClaimsKey(s', k)\r\n && InFlightPacketClaimsKey(s', p2, k)\r\n ensures p1==p2;\r\n {\r\n assert InFlightPacketClaimsKey(s, p1, k) && InFlightPacketClaimsKey(s, p2, k); \r\n }\r\n assert OnlyOnePacketClaimsKey(s', k);\r\n assert UniqueInFlightPacketClaimsKey(s', k);\r\n\r\n forall i {:trigger HostClaimsKey(s'.hosts[i], k)} | i in AllHostIdentities(s') \r\n ensures !HostClaimsKey(s'.hosts[i], k); // OBSERVE for NoHostClaimsKey(s', k);\r\n {\r\n assert !HostClaimsKey(s.hosts[i], k);\r\n assert !(DelegateForKey(s'.hosts[i].delegationMap, k)==s'.hosts[i].me);\r\n if i != id {\r\n assert !BufferedPacketClaimsKey(s'.hosts[i], k);\r\n } else {\r\n if s'.hosts[i].receivedPacket.None? {\r\n assert !BufferedPacketClaimsKey(s'.hosts[i], k);\r\n } else {\r\n assert s'.hosts[i].receivedPacket == Some(rpkt);\r\n if BufferedPacketClaimsKey(s'.hosts[i], k) {\r\n assert InFlightPacketClaimsKey(s, rpkt, k);\r\n assert false;\r\n }\r\n assert !BufferedPacketClaimsKey(s'.hosts[i], k);\r\n }\r\n }\r\n }\r\n assert NoHostClaimsKey(s', k);\r\n assert UniqueInFlightPacketClaimsKey(s', k) && NoHostClaimsKey(s', k);\r\n } else { // pkt == rpkt\r\n assert !pkt.msg.Ack?;\r\n\r\n if NewSingleMessage(s.hosts[id].sd, pkt) {\r\n assert s'.hosts[id].receivedPacket.v == pkt;\r\n var last_seqno := TombstoneTableLookup(pkt.src, h.sd.receiveState);\r\n assert pkt.msg.seqno == last_seqno + 1;\r\n assert h'.sd == h.sd.(receiveState := h.sd.receiveState[pkt.src := (last_seqno + 1) as nat_t]);\r\n assert !NewSingleMessage(s'.hosts[id].sd, pkt);\r\n assert BufferedPacketClaimsKey(s'.hosts[id], k);\r\n assert HostClaimsKey(s'.hosts[id], k);\r\n assert UniqueHostClaimsKey(s', k);\r\n\r\n forall p \r\n ensures !InFlightPacketClaimsKey(s', p, k)\r\n {\r\n if p != pkt {\r\n assert !InFlightPacketClaimsKey(s, p, k);\r\n assert !InFlightPacketClaimsKey(s', p, k);\r\n } else {\r\n assert !PacketInFlight(s', p);\r\n assert !InFlightPacketClaimsKey(s', p, k);\r\n }\r\n }\r\n assert NoInFlightPacketClaimsKey(s', k) && UniqueHostClaimsKey(s', k);\r\n } else {\r\n assert PacketInFlight(s', pkt);\r\n assert InFlightPacketClaimsKey(s', pkt, k);\r\n assert NoHostClaimsKey(s', k);\r\n\r\n forall p1,p2 {:auto_trigger} | InFlightPacketClaimsKey(s', p1, k) && InFlightPacketClaimsKey(s', p2, k) \r\n ensures p1==p2;\r\n {\r\n assert InFlightPacketClaimsKey(s, p1, k);\r\n assert InFlightPacketClaimsKey(s, p2, k);\r\n }\r\n assert SomePacketClaimsKey(s', k) && OnlyOnePacketClaimsKey(s', k);\r\n\r\n assert UniqueInFlightPacketClaimsKey(s', k) && NoHostClaimsKey(s', k);\r\n }\r\n }\r\n } else if NoInFlightPacketClaimsKey(s, k) {\r\n forall pkt \r\n ensures !InFlightPacketClaimsKey(s', pkt, k);\r\n {\r\n assert !InFlightPacketClaimsKey(s, pkt, k);\r\n }\r\n assert NoInFlightPacketClaimsKey(s', k);\r\n\r\n assert SomeHostClaimsKey(s, k);\r\n assert exists id :: id in AllHostIdentities(s) && HostClaimsKey(s.hosts[id], k);\r\n var i :| i in AllHostIdentities(s) && HostClaimsKey(s.hosts[i], k);\r\n assert HostClaimsKey(s'.hosts[i], k);\r\n\r\n forall i1,i2 | i1 in AllHostIdentities(s') && HostClaimsKey(s'.hosts[i1], k) \r\n && i2 in AllHostIdentities(s') && HostClaimsKey(s'.hosts[i2], k)\r\n ensures i1==i2;\r\n {\r\n if i1 == id {\r\n if BufferedPacketClaimsKey(s'.hosts[i1], k) {\r\n assert InFlightPacketClaimsKey(s, rpkt, k);\r\n assert false;\r\n } else {\r\n assert HostClaimsKey(s.hosts[id], k);\r\n }\r\n assert HostClaimsKey(s.hosts[id], k);\r\n } else {\r\n assert HostClaimsKey(s.hosts[i1], k);\r\n }\r\n\r\n if i2 == id {\r\n if BufferedPacketClaimsKey(s'.hosts[i2], k) {\r\n assert InFlightPacketClaimsKey(s, rpkt, k);\r\n assert false;\r\n } else {\r\n assert HostClaimsKey(s.hosts[id], k);\r\n }\r\n assert HostClaimsKey(s.hosts[id], k);\r\n } else {\r\n assert HostClaimsKey(s.hosts[i2], k);\r\n }\r\n }\r\n assert SomeHostClaimsKey(s',k) && OnlyOneHostClaimsKey(s',k);\r\n assert UniqueHostClaimsKey(s', k);\r\n } else {\r\n assert false; // Not a viable option\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma ReceivePacket_Properties(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, rpkt:Packet, out:set, ack:Packet)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires ReceivePacket(s.hosts[id], s'.hosts[id], rpkt, out, ack);\r\n requires s.hosts[id].receivedPacket.None?;\r\n requires rpkt in recv;\r\n ensures AckListsInv(s');\r\n ensures PacketsHaveSenderUniqueSeqnos(s');\r\n ensures NoPacketContainsUnsentSeqno(s');\r\n ensures ReceiverHasCanceledNoUnsentSeqnos(s');\r\n ensures EachKeyClaimedInExactlyOnePlace(s');\r\n{\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n\r\n assert ReceiveSingleMessage(h.sd, h'.sd, rpkt, ack, out);\r\n assert forall pkt :: pkt in s'.network && pkt.msg.SingleMessage?\r\n ==> pkt in s.network;\r\n assert NoPacketContainsUnsentSeqno(s);\r\n assert forall other_id :: other_id in AllHostIdentities(s) && other_id != id ==> s.hosts[other_id] == s'.hosts[other_id];\r\n\r\n ReceivePacket_UnsentSeqnos(s, s', id, recv, rpkt, out, ack);\r\n ReceivePacket_EachKeyClaimed(s, s', id, recv, rpkt, out, ack);\r\n\r\n reveal_UnAckedListInNetwork();\r\n if rpkt.msg.Ack? {\r\n assert out == {};\r\n ReceiveAckPreservesUnAckListProperties(h.sd, h'.sd, rpkt, out);\r\n var oldAckState := AckStateLookup(rpkt.src, h.sd.sendState);\r\n var newAckState := AckStateLookup(rpkt.src, h'.sd.sendState);\r\n assert newAckState.unAcked == TruncateUnAckList(oldAckState.unAcked, rpkt.msg.ack_seqno);\r\n TruncateAckPreservesSubset(oldAckState.unAcked); \r\n\r\n forall id',msg,dst | id' in AllHostIdentities(s)\r\n && msg in AckStateLookup(dst, s'.hosts[id'].sd.sendState).unAcked\r\n && NoAcksInUnAckedLists(s'.hosts[id'].sd)\r\n && dst == msg.dst\r\n ensures Packet(msg.dst, s'.hosts[id'].me, msg) in s'.network\r\n {\r\n var p := Packet(msg.dst, s'.hosts[id'].me, msg);\r\n if id' == id {\r\n assert msg in AckStateLookup(dst, s.hosts[id'].sd.sendState).unAcked;\r\n assert p in s'.network;\r\n } else {\r\n assert p in s'.network;\r\n }\r\n }\r\n\r\n HighestSeqnoSent_Monotonic(h.sd, h'.sd, rpkt, out);\r\n assert AckListsInv(s');\r\n } else {\r\n }\r\n\r\n reveal_PacketsHaveSenderUniqueSeqnos(); // ==>\r\n assert PacketsHaveSenderUniqueSeqnos(s');\r\n}\r\n\r\n/*\r\nlemma ReceiveSingleMessageNew_Properties(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, rpkt:Packet, out:set, ack:Packet)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires rpkt in recv;\r\n requires ReceivePacket(s.hosts[id], s'.hosts[id], rpkt, out, ack);\r\n requires NewSingleMessage(s.hosts[id].sd, rpkt);\r\n ensures ReceiverHasCanceledNoUnsentSeqnos(s');\r\n{\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n assert ReceiveSingleMessage(h.sd, h'.sd, rpkt, ack, out);\r\n assert forall other_id :: other_id in AllHostIdentities(s) && other_id != id ==> s.hosts[other_id] == s'.hosts[other_id];\r\n\r\n // Remind Dafny what ReceiverHasCanceledNoUnsentSeqnos(s) means for s\r\n forall dst, src, seqno \r\n ensures dst in AllHostIdentities(s) && src in AllHostIdentities(s)\r\n && HighestSeqnoSent(s.hosts[src].sd, dst) < seqno\r\n ==> seqno > TombstoneTableLookup(src, s.hosts[dst].sd.receiveState);\r\n {\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, dst, src, seqno); // OBSERVE: Need to trigger to expand the definition\r\n }\r\n\r\n forall dst, src, seqno | dst in AllHostIdentities(s) && src in AllHostIdentities(s)\r\n && HighestSeqnoSent(s'.hosts[src].sd, dst) < seqno\r\n ensures seqno > TombstoneTableLookup(src, s'.hosts[dst].sd.receiveState);\r\n {\r\n if rpkt.src == src {\r\n } else {\r\n if dst == id {\r\n assert HighestSeqnoSent(s'.hosts[src].sd, dst) == HighestSeqnoSent(s.hosts[src].sd, dst); // OBSERVE\r\n assert seqno > TombstoneTableLookup(src, s'.hosts[dst].sd.receiveState);\r\n } else {\r\n }\r\n }\r\n }\r\n}\r\n*/\r\n\r\npredicate DelegationPacketStable(s:SHT_State, s':SHT_State, id:NodeIdentity)\r\n requires id in s.hosts && id in s'.hosts;\r\n requires DelegationPacket(s.hosts[id].receivedPacket);\r\n{\r\n s'.hosts[id].receivedPacket == s.hosts[id].receivedPacket\r\n}\r\n\r\nlemma DelegateStability(s:SHT_State, s':SHT_State)\r\n requires MapComplete(s) && InvConstants(s);\r\n requires MapComplete(s') && InvConstants(s');\r\n requires s.config == s'.config;\r\n requires forall id :: id in AllHostIdentities(s) && DelegationPacket(s.hosts[id].receivedPacket) \r\n ==> DelegationPacketStable(s, s', id);\r\n// ==> s'.hosts[id].receivedPacket == s.hosts[id].receivedPacket\r\n// && NewSingleMessage(s.hosts[id].sd, s.hosts[id].receivedPacket.v) ==\r\n// NewSingleMessage(s'.hosts[id].sd, s'.hosts[id].receivedPacket.v);\r\n requires forall id :: id in AllHostIdentities(s) && !DelegationPacket(s.hosts[id].receivedPacket) \r\n ==> !DelegationPacket(s'.hosts[id].receivedPacket); \r\n requires forall id :: id in AllHostIdentities(s)\r\n ==> s'.hosts[id].delegationMap == s.hosts[id].delegationMap;\r\n ensures forall id, k :: id in AllHostIdentities(s)\r\n ==> (HostClaimsKey(s.hosts[id], k) <==> HostClaimsKey(s'.hosts[id],k));\r\n{\r\n forall id, k | id in AllHostIdentities(s)\r\n ensures HostClaimsKey(s.hosts[id], k) <==> HostClaimsKey(s'.hosts[id],k);\r\n {\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n \r\n if BufferedPacketClaimsKey(h, k) {\r\n assert BufferedPacketClaimsKey(h', k);\r\n }\r\n if BufferedPacketClaimsKey(h', k) {\r\n assert DelegationPacket(h.receivedPacket);\r\n assert KeyRangeContains(h.receivedPacket.v.msg.m.range, KeyPlus(k));\r\n assert BufferedPacketClaimsKey(h, k);\r\n }\r\n\r\n calc {\r\n HostClaimsKey(h, k);\r\n DelegateForKey(h.delegationMap, k) == h.me || BufferedPacketClaimsKey(h, k);\r\n DelegateForKey(h.delegationMap, k) == id || BufferedPacketClaimsKey(h, k);\r\n DelegateForKey(h'.delegationMap, k) == id || BufferedPacketClaimsKey(h', k);\r\n DelegateForKey(h'.delegationMap, k) == h'.me || BufferedPacketClaimsKey(h', k);\r\n HostClaimsKey(h', k);\r\n }\r\n }\r\n}\r\n\r\n///////////////////////////////////////////////////////\r\n// Delegation\r\n//////////////////////////////////////////////////////\r\n\r\nlemma DelegateStabilitySpecific(s:SHT_State, s':SHT_State, k:Key, id:NodeIdentity)\r\n requires MapComplete(s) && InvConstants(s);\r\n requires MapComplete(s') && InvConstants(s');\r\n requires NoConfigChanged(s, s');\r\n requires forall id :: id in AllHostIdentities(s) && DelegationPacket(s.hosts[id].receivedPacket) \r\n ==> s'.hosts[id].receivedPacket == s.hosts[id].receivedPacket\r\n && NewSingleMessage(s.hosts[id].sd, s.hosts[id].receivedPacket.v) ==\r\n NewSingleMessage(s'.hosts[id].sd, s'.hosts[id].receivedPacket.v);\r\n requires forall id :: id in AllHostIdentities(s) && !DelegationPacket(s.hosts[id].receivedPacket) \r\n ==> s'.hosts[id].receivedPacket.None?; \r\n requires forall id :: id in AllHostIdentities(s)\r\n ==> s'.hosts[id].delegationMap == s.hosts[id].delegationMap;\r\n requires id in AllHostIdentities(s);\r\n ensures HostClaimsKey(s.hosts[id], k) <==> HostClaimsKey(s'.hosts[id],k);\r\n{\r\n DelegateStability(s, s');\r\n}\r\n\r\n// Trigger loop!?\r\nlemma NoHostClaimsKeySpecific(s:SHT_State, k:Key, id:NodeIdentity)\r\n requires MapComplete(s);\r\n requires NoHostClaimsKey(s, k);\r\n requires id in AllHostIdentities(s);\r\n ensures !HostClaimsKey(s.hosts[id], k);\r\n{\r\n}\r\n\r\npredicate NoDelegationPacketsChangedAboutKey(s:SHT_State, s':SHT_State, k:Key)\r\n requires MapComplete(s) && InvConstants(s) && PacketsHaveSaneHeaders(s);\r\n requires MapComplete(s') && InvConstants(s') && PacketsHaveSaneHeaders(s');\r\n{\r\n forall pkt:Packet ::\r\n pkt.msg.SingleMessage? && pkt.msg.m.Delegate? && KeyRangeContains(pkt.msg.m.range, KeyPlus(k))\r\n ==> (PacketInFlight(s, pkt) <==> PacketInFlight(s', pkt))\r\n}\r\n\r\npredicate NoConfigChanged(s:SHT_State, s':SHT_State)\r\n requires MapComplete(s);\r\n requires MapComplete(s');\r\n{\r\n s'.config == s.config\r\n}\r\n\r\n\r\n// TODO I think I can just dispense with this disjunct.\r\npredicate NoDelegationMapsChanged(s:SHT_State, s':SHT_State)\r\n requires MapComplete(s);\r\n requires MapComplete(s');\r\n requires NoConfigChanged(s, s');\r\n{\r\n forall id {:auto_trigger} :: id in AllHostIdentities(s)\r\n ==> s'.hosts[id].delegationMap == s.hosts[id].delegationMap\r\n}\r\n\r\npredicate NoDelegationMapsChangedAboutKey(s:SHT_State, s':SHT_State, k:Key)\r\n requires MapComplete(s);\r\n requires MapComplete(s');\r\n requires NoConfigChanged(s, s');\r\n{\r\n forall id {:trigger DelegateForKey(s.hosts[id].delegationMap, k)} \r\n {:trigger DelegateForKey(s'.hosts[id].delegationMap, k)} :: \r\n id in AllHostIdentities(s) ==> \r\n DelegateForKey(s'.hosts[id].delegationMap, k)\r\n == DelegateForKey(s.hosts[id].delegationMap, k)\r\n}\r\n\r\nlemma NonDelegationsEachKeyClaimedInExactlyOnePlace_case1(s:SHT_State, s':SHT_State, k:Key)\r\n requires MapComplete(s) && InvConstants(s) && PacketsHaveSaneHeaders(s);\r\n requires MapComplete(s') && InvConstants(s') && PacketsHaveSaneHeaders(s');\r\n requires NoDelegationPacketsChangedAboutKey(s, s', k);\r\n requires NoConfigChanged(s, s');\r\n requires NoDelegationMapsChanged(s, s')\r\n || NoDelegationMapsChangedAboutKey(s, s', k);\r\n requires forall id :: id in AllHostIdentities(s) && DelegationPacket(s.hosts[id].receivedPacket) \r\n ==> DelegationPacketStable(s, s', id) || s'.hosts[id].receivedPacket.None?;\r\n requires forall id :: id in AllHostIdentities(s) && !DelegationPacket(s.hosts[id].receivedPacket) \r\n ==> !DelegationPacket(s'.hosts[id].receivedPacket); \r\n requires UniqueInFlightPacketClaimsKey(s, k) && NoHostClaimsKey(s, k);\r\n ensures UniqueInFlightPacketClaimsKey(s', k) && NoHostClaimsKey(s', k);\r\n{\r\n // Some unfortunate triggering required by new conservative triggers.\r\n // I'm not certain why.\r\n// assert exists pkt :: InFlightPacketClaimsKey(s, pkt, k);\r\n var pkt :| InFlightPacketClaimsKey(s, pkt, k);\r\n assert InFlightPacketClaimsKey(s', pkt, k);\r\n assert exists pkt :: InFlightPacketClaimsKey(s', pkt, k);\r\n\r\n// assert SomePacketClaimsKey(s', k);\r\n\r\n forall p1,p2\r\n | InFlightPacketClaimsKey(s', p1, k) && InFlightPacketClaimsKey(s', p2, k)\r\n ensures p1==p2;\r\n {\r\n assert InFlightPacketClaimsKey(s, p1, k);\r\n assert InFlightPacketClaimsKey(s, p2, k);\r\n }\r\n// assert OnlyOnePacketClaimsKey(s', k);\r\n assert forall id :: id in AllHostIdentities(s) ==> !HostClaimsKey(s.hosts[id], k);\r\n}\r\n\r\n// This was easy to prove until I tightened the precondition.\r\nlemma NonDelegationsEachKeyClaimedInExactlyOnePlace_case2(s:SHT_State, s':SHT_State, k:Key)\r\n requires HiddenInv(s);\r\n requires MapComplete(s) && InvConstants(s) && PacketsHaveSaneHeaders(s);\r\n requires MapComplete(s') && InvConstants(s') && PacketsHaveSaneHeaders(s');\r\n requires NoDelegationPacketsChangedAboutKey(s, s', k);\r\n requires NoConfigChanged(s, s')\r\n requires forall id :: id in AllHostIdentities(s) && DelegationPacket(s.hosts[id].receivedPacket) \r\n ==> DelegationPacketStable(s, s', id);\r\n requires forall id :: id in AllHostIdentities(s) && !DelegationPacket(s.hosts[id].receivedPacket) \r\n ==> !DelegationPacket(s'.hosts[id].receivedPacket); \r\n requires NoDelegationMapsChanged(s, s')\r\n || NoDelegationMapsChangedAboutKey(s, s', k);\r\n requires NoInFlightPacketClaimsKey(s, k) && UniqueHostClaimsKey(s, k);\r\n ensures NoInFlightPacketClaimsKey(s', k) && UniqueHostClaimsKey(s', k);\r\n{\r\n if (NoDelegationMapsChanged(s, s')) {\r\n DelegateStability(s, s');\r\n }\r\n// assert NoInFlightPacketClaimsKey(s, k);\r\n assert forall pkt :: !InFlightPacketClaimsKey(s, pkt, k);\r\n// assert NoInFlightPacketClaimsKey(s', k);\r\n assert UniqueHostClaimsKey(s, k);\r\n var id :| id in AllHostIdentities(s) && HostClaimsKey(s.hosts[id], k);\r\n assert id in AllHostIdentities(s) && HostClaimsKey(s'.hosts[id], k);\r\n forall i1,i2 |\r\n i1 in AllHostIdentities(s) && HostClaimsKey(s'.hosts[i1], k)\r\n && i2 in AllHostIdentities(s) && HostClaimsKey(s'.hosts[i2], k)\r\n ensures i1==i2;\r\n {\r\n assert HostClaimsKey(s.hosts[i1], k);\r\n assert HostClaimsKey(s.hosts[i2], k);\r\n assert i1==i2;\r\n }\r\n assert UniqueHostClaimsKey(s', k);\r\n\r\n forall pkt ensures !InFlightPacketClaimsKey(s', pkt, k)\r\n {\r\n assert !InFlightPacketClaimsKey(s, pkt, k);\r\n }\r\n assert NoInFlightPacketClaimsKey(s', k);\r\n}\r\n\r\nlemma NonDelegationsEachKeyClaimedInExactlyOnePlace_case2'(s:SHT_State, s':SHT_State, k:Key)\r\n requires HiddenInv(s);\r\n requires MapComplete(s) && InvConstants(s) && PacketsHaveSaneHeaders(s);\r\n requires MapComplete(s') && InvConstants(s') && PacketsHaveSaneHeaders(s');\r\n requires NoDelegationPacketsChangedAboutKey(s, s', k);\r\n requires NoConfigChanged(s, s')\r\n requires forall id :: id in AllHostIdentities(s) && DelegationPacket(s.hosts[id].receivedPacket) \r\n ==> s'.hosts[id].receivedPacket == s.hosts[id].receivedPacket || s'.hosts[id].receivedPacket.None?;\r\n requires forall id :: id in AllHostIdentities(s) && DelegationPacket(s.hosts[id].receivedPacket) \r\n && s'.hosts[id].receivedPacket.None? ==> !BufferedPacketClaimsKey(s.hosts[id], k);\r\n requires forall id :: id in AllHostIdentities(s') ==> s'.hosts[id].sd == s.hosts[id].sd;\r\n requires forall id :: id in AllHostIdentities(s) && !DelegationPacket(s.hosts[id].receivedPacket) \r\n ==> !DelegationPacket(s'.hosts[id].receivedPacket); \r\n requires NoDelegationMapsChanged(s, s')\r\n || NoDelegationMapsChangedAboutKey(s, s', k);\r\n requires NoInFlightPacketClaimsKey(s, k) && UniqueHostClaimsKey(s, k);\r\n ensures NoInFlightPacketClaimsKey(s', k) && UniqueHostClaimsKey(s', k);\r\n{\r\n assert forall pkt :: !InFlightPacketClaimsKey(s, pkt, k);\r\n assert UniqueHostClaimsKey(s, k);\r\n var id :| id in AllHostIdentities(s) && HostClaimsKey(s.hosts[id], k);\r\n assert id in AllHostIdentities(s) && HostClaimsKey(s'.hosts[id], k);\r\n forall i1,i2 |\r\n i1 in AllHostIdentities(s) && HostClaimsKey(s'.hosts[i1], k)\r\n && i2 in AllHostIdentities(s) && HostClaimsKey(s'.hosts[i2], k)\r\n ensures i1==i2;\r\n {\r\n assert HostClaimsKey(s.hosts[i1], k);\r\n assert HostClaimsKey(s.hosts[i2], k);\r\n assert i1==i2;\r\n }\r\n assert UniqueHostClaimsKey(s', k);\r\n\r\n forall pkt ensures !InFlightPacketClaimsKey(s', pkt, k)\r\n {\r\n assert !InFlightPacketClaimsKey(s, pkt, k);\r\n }\r\n assert NoInFlightPacketClaimsKey(s', k);\r\n}\r\n\r\npredicate NotADelegateStep(s:SHT_State, s':SHT_State)\r\n requires MapComplete(s);\r\n requires MapComplete(s');\r\n requires PacketsHaveSaneHeaders(s);\r\n requires PacketsHaveSaneHeaders(s');\r\n{\r\n forall pkt:Packet :: pkt.msg.SingleMessage? && pkt.msg.m.Delegate?\r\n ==> (PacketInFlight(s, pkt) <==> PacketInFlight(s', pkt))\r\n}\r\n\r\nlemma NonDelegationsEachKeyClaimedInExactlyOnePlace(s:SHT_State, s':SHT_State)\r\n requires Inv(s);\r\n requires MapComplete(s) && InvConstants(s) && PacketsHaveSaneHeaders(s);\r\n requires MapComplete(s') && InvConstants(s') && PacketsHaveSaneHeaders(s');\r\n requires NoConfigChanged(s, s');\r\n requires NotADelegateStep(s, s');\r\n requires forall id :: id in AllHostIdentities(s)\r\n ==> s'.hosts[id].delegationMap == s.hosts[id].delegationMap;\r\n requires forall id :: id in AllHostIdentities(s) && DelegationPacket(s.hosts[id].receivedPacket) \r\n ==> DelegationPacketStable(s, s', id);\r\n requires forall id :: id in AllHostIdentities(s) && !DelegationPacket(s.hosts[id].receivedPacket) \r\n ==> !DelegationPacket(s'.hosts[id].receivedPacket); \r\n ensures EachKeyClaimedInExactlyOnePlace(s');\r\n{\r\n forall k\r\n ensures\r\n (UniqueInFlightPacketClaimsKey(s', k) && NoHostClaimsKey(s', k))\r\n || (NoInFlightPacketClaimsKey(s', k) && UniqueHostClaimsKey(s', k));\r\n {\r\n if (UniqueInFlightPacketClaimsKey(s, k) && NoHostClaimsKey(s, k)) {\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n NonDelegationsEachKeyClaimedInExactlyOnePlace_case1(s, s', k);\r\n } else {\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n reveal_HiddenInv();\r\n NonDelegationsEachKeyClaimedInExactlyOnePlace_case2(s, s', k);\r\n }\r\n }\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert EachKeyClaimedInExactlyOnePlace(s');\r\n}\r\n\r\nlemma NextInv_Get_NotADelegateStep(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.GetRequest? && NextGetRequest(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n ensures NotADelegateStep(s, s');\r\n{\r\n}\r\n\r\nlemma {:timeLimitMultiplier 3} NextInv_Get(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires Some(rpkt) == s.hosts[id].receivedPacket;\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.GetRequest? && NextGetRequest(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires NotADelegateStep(s, s');\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n ensures Inv(s');\r\n{\r\n var k := rpkt.msg.m.k_getrequest;\r\n var sm,m,b :| NextGetRequest_Reply(s.hosts[id], s'.hosts[id], rpkt.src, rpkt.msg.seqno, k, sm, m, out, b);\r\n \r\n if b {\r\n assert forall id' :: id' in AllHostIdentities(s) && id' != id \r\n ==> s'.hosts[id'] == s.hosts[id'];\r\n\r\n NonDelegationsEachKeyClaimedInExactlyOnePlace(s, s');\r\n\r\n assert SendSingleMessage(s.hosts[id].sd, s'.hosts[id].sd, m, sm, s.hosts[id].constants.params, b); \r\n assert NoHostsStoreEmptyValues(s');\r\n\r\n reveal_PacketsHaveSenderUniqueSeqnos();\r\n reveal_UnAckedListInNetwork();\r\n\r\n forall dst, src, seqno ensures ReceiverHasNotCanceledUnsentSeqno(s', dst, src, seqno);\r\n {\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, dst, src, seqno); // OBSERVE trigger\r\n } // assert ReceiverHasCanceledNoUnsentSeqnos(s');\r\n\r\n \r\n SendSingleMessagePreservesUnAckListProperties(s.hosts[id].sd, s'.hosts[id].sd, m, sm, s.hosts[id].constants.params, b);\r\n\r\n // Prove UnAckedListInNetwork \r\n reveal_UnAckedListInNetwork();\r\n forall id,msg,dst |\r\n id in AllHostIdentities(s)\r\n && msg in AckStateLookup(dst, s'.hosts[id].sd.sendState).unAcked\r\n && NoAcksInUnAckedLists(s'.hosts[id].sd)\r\n && dst == msg.dst\r\n ensures Packet(msg.dst, s'.hosts[id].me, msg) in s'.network;\r\n {\r\n var unAcked := AckStateLookup(dst, s.hosts[id].sd.sendState).unAcked;\r\n var unAcked' := AckStateLookup(dst, s'.hosts[id].sd.sendState).unAcked;\r\n var i :| 0 <= i < |unAcked'| && unAcked'[i] == msg;\r\n if i < |unAcked| {\r\n assert msg in AckStateLookup(dst, s.hosts[id].sd.sendState).unAcked;\r\n } else {\r\n var oldAckState := AckStateLookup(dst, s.hosts[id].sd.sendState); \r\n var new_seqno := oldAckState.numPacketsAcked + |oldAckState.unAcked| + 1;\r\n if new_seqno > s.hosts[id].constants.params.max_seqno {\r\n assert out == {};\r\n } else {\r\n assert out == {Packet(msg.dst, s'.hosts[id].me, msg)};\r\n }\r\n }\r\n }\r\n } else {\r\n forall dst, src, seqno ensures ReceiverHasNotCanceledUnsentSeqno(s', dst, src, seqno);\r\n {\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, dst, src, seqno); // OBSERVE trigger\r\n } \r\n reveal_UnAckedListInNetwork();\r\n reveal_PacketsHaveSenderUniqueSeqnos();\r\n NonDelegationsEachKeyClaimedInExactlyOnePlace(s, s');\r\n }\r\n}\r\n\r\nlemma NextInv_Set_NotADelegateStep(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.SetRequest? && NextSetRequest(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n ensures NotADelegateStep(s, s');\r\n{\r\n}\r\n\r\nlemma NextInv_Set(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires Some(rpkt) == s.hosts[id].receivedPacket;\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.SetRequest? && NextSetRequest(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires NotADelegateStep(s, s');\r\n //requires ReceivePacket(s.hosts[id], s'.hosts[id], rpkt, out, ack);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n ensures Inv(s');\r\n{\r\n var sm,m,b :| NextSetRequest_Complete(s.hosts[id], s'.hosts[id], rpkt.src, rpkt.msg.seqno, rpkt.msg.m, sm, m, out, b);\r\n\r\n NonDelegationsEachKeyClaimedInExactlyOnePlace(s, s');\r\n\r\n if b && ValidKey(rpkt.msg.m.k_setrequest) && ValidOptionalValue(rpkt.msg.m.v_setrequest) {\r\n assert SendSingleMessage(s.hosts[id].sd, s'.hosts[id].sd, m, sm, s.hosts[id].constants.params, b);\r\n assert NoHostsStoreEmptyValues(s');\r\n\r\n //ReceiveSingleMessageNew_Properties(s, s', id, recv, rpkt, out, ack);\r\n reveal_PacketsHaveSenderUniqueSeqnos();\r\n reveal_UnAckedListInNetwork();\r\n\r\n forall dst, src, seqno ensures ReceiverHasNotCanceledUnsentSeqno(s', dst, src, seqno);\r\n {\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, dst, src, seqno); // OBSERVE trigger\r\n } // assert ReceiverHasCanceledNoUnsentSeqnos(s');\r\n\r\n \r\n SendSingleMessagePreservesUnAckListProperties(s.hosts[id].sd, s'.hosts[id].sd, m, sm, s.hosts[id].constants.params, b);\r\n\r\n // Prove UnAckedListInNetwork \r\n reveal_UnAckedListInNetwork();\r\n forall id,msg,dst |\r\n id in AllHostIdentities(s)\r\n && msg in AckStateLookup(dst, s'.hosts[id].sd.sendState).unAcked\r\n && NoAcksInUnAckedLists(s'.hosts[id].sd)\r\n && dst == msg.dst\r\n ensures Packet(msg.dst, s'.hosts[id].me, msg) in s'.network;\r\n {\r\n var unAcked := AckStateLookup(dst, s.hosts[id].sd.sendState).unAcked;\r\n var unAcked' := AckStateLookup(dst, s'.hosts[id].sd.sendState).unAcked;\r\n var i :| 0 <= i < |unAcked'| && unAcked'[i] == msg;\r\n if i < |unAcked| {\r\n assert msg in AckStateLookup(dst, s.hosts[id].sd.sendState).unAcked;\r\n } else {\r\n var oldAckState := AckStateLookup(dst, s.hosts[id].sd.sendState); \r\n var new_seqno := oldAckState.numPacketsAcked + |oldAckState.unAcked| + 1;\r\n if new_seqno > s.hosts[id].constants.params.max_seqno {\r\n assert out == {};\r\n } else {\r\n assert out == {Packet(msg.dst, s'.hosts[id].me, msg)};\r\n }\r\n }\r\n }\r\n } else {\r\n forall dst, src, seqno ensures ReceiverHasNotCanceledUnsentSeqno(s', dst, src, seqno);\r\n {\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, dst, src, seqno); // OBSERVE trigger\r\n } \r\n reveal_UnAckedListInNetwork();\r\n reveal_PacketsHaveSenderUniqueSeqnos();\r\n }\r\n}\r\n\r\nlemma PacketStillInFlightForward_ReceiveSingle(s:SHT_State, s':SHT_State, id:NodeIdentity, out:set, rpkt:Packet, p:Packet, ack:Packet)\r\n requires HiddenInv(s);\r\n requires MapComplete(s);\r\n requires MapComplete(s');\r\n requires PacketsHaveSaneHeaders(s');\r\n requires NoConfigChanged(s, s');\r\n requires id in AllHostIdentities(s);\r\n requires rpkt in s.network;\r\n requires rpkt.dst == id;\r\n requires ReceiveSingleMessage(s.hosts[id].sd, s'.hosts[id].sd, rpkt, ack, out);\r\n requires NewSingleMessage(s.hosts[id].sd, rpkt);\r\n requires p!=rpkt;\r\n requires Network_Send(s.network, s'.network, id, out);\r\n requires !(p in out);\r\n requires forall oid :: oid in AllHostIdentities(s) && oid!=id ==> s'.hosts[oid]==s.hosts[oid];\r\n requires PacketInFlight(s, p);\r\n ensures PacketInFlight(s', p);\r\n{\r\n reveal_HiddenInv();\r\n reveal_PacketsHaveSenderUniqueSeqnos();\r\n}\r\n\r\nlemma PacketStillInFlightReverse(s:SHT_State, s':SHT_State, id:NodeIdentity, rpkt:Packet, out:set, p:Packet, ack:Packet)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires NoConfigChanged(s, s');\r\n requires PacketsHaveSaneHeaders(s');\r\n requires PacketsHaveSenderUniqueSeqnos(s');\r\n requires Network_Send(s.network, s'.network, id, out);\r\n requires rpkt in s.network;\r\n requires id in AllHostIdentities(s);\r\n requires ReceiveSingleMessage(s.hosts[id].sd, s'.hosts[id].sd, rpkt, ack, out);\r\n requires forall oid :: oid in AllHostIdentities(s) && oid!=id ==> s'.hosts[oid]==s.hosts[oid];\r\n requires rpkt.dst == id;\r\n requires PacketInFlight(s', p);\r\n requires forall po :: po in out ==> p!=po;\r\n requires rpkt != p;\r\n ensures PacketInFlight(s, p);\r\n{\r\n assert MessageNotReceived(s'.hosts[p.dst].sd, p.src, p.msg);\r\n}\r\n\r\n\r\nlemma NextInv_Delegate_EachKeyClaimedInExactlyOnePlace_NoInFlightPacketClaimsKey(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, pkt:Packet, k:Key)\r\n requires HiddenInv(s);\r\n requires MapComplete(s);\r\n requires MapComplete(s');\r\n requires PacketsHaveSaneHeaders(s');\r\n requires PacketsHaveSenderUniqueSeqnos(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires Some(pkt) == s.hosts[id].receivedPacket;\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires pkt in s.network && pkt.msg.SingleMessage? && pkt.msg.m.Delegate? && NextDelegate(s.hosts[id], s'.hosts[id], pkt, out);\r\n requires KeyRangeContains(pkt.msg.m.range, KeyPlus(k));\r\n requires NoInFlightPacketClaimsKey(s, k);\r\n requires UniqueHostClaimsKey(s, k);\r\n ensures NoInFlightPacketClaimsKey(s', k);\r\n ensures UniqueHostClaimsKey(s', k);\r\n{\r\n reveal_HiddenInv();\r\n // OBSERVE Unfortunate conservative triggers\r\n forall ipkt\r\n ensures !InFlightPacketClaimsKey(s', ipkt, k);\r\n {\r\n if ipkt.msg.Ack? || ipkt.msg.InvalidMessage? { // Can't claim a key\r\n } else if (!ipkt.msg.m.Delegate?) { // fine\r\n } else if (!KeyRangeContains(ipkt.msg.m.range, KeyPlus(k))) { // fine\r\n } else if (!PacketInFlight(s', ipkt)) { // fine\r\n } else {\r\n assert ipkt.msg.SingleMessage?;\r\n assert ipkt.msg.m.Delegate?;\r\n assert PacketInFlight(s', ipkt);\r\n assert KeyRangeContains(ipkt.msg.m.range, KeyPlus(k));\r\n assert InFlightPacketClaimsKey(s', ipkt, k);\r\n\r\n if PacketInFlight(s, ipkt) {\r\n assert InFlightPacketClaimsKey(s, ipkt, k);\r\n assert false;\r\n } else {\r\n assert false;\r\n }\r\n }\r\n }\r\n assert forall pkt :: !InFlightPacketClaimsKey(s', pkt, k); // OBSERVE unfortunate trigger\r\n assert exists id\r\n :: id in AllHostIdentities(s) && HostClaimsKey(s'.hosts[id], k); // OBSERVE unfortunate trigger\r\n assert forall i1,i2\r\n :: i1 in AllHostIdentities(s) && HostClaimsKey(s.hosts[i1], k)\r\n && i2 in AllHostIdentities(s) && HostClaimsKey(s.hosts[i2], k)\r\n ==> i1==i2; // OBSERVE unfortunate trigger\r\n}\r\n\r\n// This shouldn't take a lemma; Dafny's set reasoning managed\r\n// to stumble herewith:\r\n//\r\n// assert rpkt in recv;\r\n// assert recv == PacketsTo(s.network, id);\r\n// assert rpkt in PacketsTo(s.network, id); // on *This* line!!\r\n// assert rpkt in s.network;\r\n// Thus, I present:\r\nlemma NetworkReceive_ImpliesMembership(s:SHT_State, id:NodeIdentity, recv:set, rpkt:Packet)\r\n requires Network_Receive(s.network, id, recv);\r\n requires rpkt in recv;\r\n ensures rpkt in s.network;\r\n{\r\n}\r\n// And then it lost:\r\n// assert out=={};\r\n// assert !(pkt in out);\r\n// !!!\r\n\r\nlemma NextInv_Delegate_EachKeyClaimedInExactlyOnePlace(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet)\r\n requires HiddenInv(s);\r\n requires MapComplete(s);\r\n// requires PacketsHaveSenderUniqueSeqnos(s');\r\n requires MapComplete(s');\r\n requires PacketsHaveSaneHeaders(s');\r\n requires InvConstants(s');\r\n requires PacketsHaveSenderUniqueSeqnos(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires Network_Receive(s.network, id, recv);\r\n requires Some(rpkt) == s.hosts[id].receivedPacket;\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.Delegate? && NextDelegate(s.hosts[id], s'.hosts[id], rpkt, out);\r\n ensures EachKeyClaimedInExactlyOnePlace(s');\r\n{\r\n forall k\r\n ensures\r\n (UniqueInFlightPacketClaimsKey(s', k) && NoHostClaimsKey(s', k))\r\n || (NoInFlightPacketClaimsKey(s', k) && UniqueHostClaimsKey(s', k));\r\n {\r\n //if (KeyRangeContains(rpkt.msg.m.range, KeyPlus(k))) {\r\n if BufferedPacketClaimsKey(s.hosts[id], k) {\r\n reveal_HiddenInv();\r\n assert HostClaimsKey(s.hosts[id], k);\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n NextInv_Delegate_EachKeyClaimedInExactlyOnePlace_NoInFlightPacketClaimsKey(s, s', id, recv, out, rpkt, k);\r\n } else {\r\n if (UniqueInFlightPacketClaimsKey(s, k) && NoHostClaimsKey(s, k)) {\r\n forall pkt | pkt!=rpkt\r\n ensures (PacketInFlight(s, pkt) <==> PacketInFlight(s', pkt));\r\n {\r\n reveal_PacketsHaveSenderUniqueSeqnos();\r\n }\r\n forall xid | xid in AllHostIdentities(s)\r\n ensures DelegateForKey(s'.hosts[xid].delegationMap, k)\r\n == DelegateForKey(s.hosts[xid].delegationMap, k);\r\n {\r\n var dm := s.hosts[xid].delegationMap; // OBSERVE trigger\r\n var dm' := s'.hosts[xid].delegationMap; // OBSERVE trigger\r\n if rpkt.src !in s.hosts[xid].constants.hostIds {\r\n assert dm == dm';\r\n } else {\r\n calc ==> {\r\n true;\r\n { reveal_HiddenInv(); }\r\n rpkt.dst in s.hosts[xid].constants.hostIds;\r\n }\r\n assert rpkt.src in s.hosts[xid].constants.hostIds;\r\n assert DelegationPacket(Some(rpkt));\r\n assert !KeyRangeContains(rpkt.msg.m.range, KeyPlus(k));\r\n }\r\n }\r\n assert NoDelegationMapsChangedAboutKey(s, s', k);\r\n NonDelegationsEachKeyClaimedInExactlyOnePlace_case1(s, s', k);\r\n } else {\r\n reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n forall pkt:Packet |\r\n pkt.msg.SingleMessage? && pkt.msg.m.Delegate? && KeyRangeContains(pkt.msg.m.range, KeyPlus(k))\r\n ensures (PacketInFlight(s, pkt) <==> PacketInFlight(s', pkt));\r\n {\r\n reveal_PacketsHaveSenderUniqueSeqnos();\r\n }\r\n assert NoDelegationPacketsChangedAboutKey(s, s', k);\r\n NonDelegationsEachKeyClaimedInExactlyOnePlace_case2'(s, s', k);\r\n }\r\n }\r\n }\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert EachKeyClaimedInExactlyOnePlace(s');\r\n}\r\n\r\nlemma NextInv_Delegate(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires Some(rpkt) == s.hosts[id].receivedPacket;\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.Delegate? && NextDelegate(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n ensures Inv(s');\r\n{\r\n reveal_PacketsHaveSenderUniqueSeqnos();\r\n forall () ensures EachKeyClaimedInExactlyOnePlace(s');\r\n {\r\n reveal_HiddenInv();\r\n NextInv_Delegate_EachKeyClaimedInExactlyOnePlace(s, s', id, recv, out, rpkt);\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n }\r\n\r\n // NoHostsStoreEmptyValues:\r\n forall (i,k |\r\n i in AllHostIdentities(s) && HostClaimsKey(s'.hosts[i], k) && k in s'.hosts[i].h)\r\n ensures HashtableLookup(s'.hosts[i].h, k) != ValueAbsent()\r\n {\r\n if (i==id && KeyRangeContains(rpkt.msg.m.range, KeyPlus(k))) {\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n } else {\r\n assert HashtableLookup(s.hosts[i].h, k) != ValueAbsent(); // OBSERVE trigger\r\n }\r\n }\r\n\r\n forall id,k:Key | id in AllHostIdentities(s)\r\n ensures DelegateForKey(s'.hosts[id].delegationMap, k) in AllHostIdentities(s);\r\n {\r\n assert DelegateForKey(s.hosts[id].delegationMap, k) in AllHostIdentities(s); // OBSERVE trigger\r\n }\r\n\r\n forall i,k | i in AllHostIdentities(s) && k in s'.hosts[i].h\r\n ensures HostClaimsKey(s'.hosts[i], k)\r\n {\r\n if !(i==id && KeyRangeContains(rpkt.msg.m.range, KeyPlus(k))) {\r\n assert DelegateForKey(s.hosts[i].delegationMap, k)==s.hosts[i].me || BufferedPacketClaimsKey(s.hosts[i], k); // OBSERVE trigger\r\n }\r\n }\r\n assert HostsStoreOnlyOwnedKeys(s');\r\n\r\n forall dst, src, seqno ensures ReceiverHasNotCanceledUnsentSeqno(s', dst, src, seqno);\r\n {\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, dst, src, seqno); // OBSERVE trigger\r\n } // assert ReceiverHasCanceledNoUnsentSeqnos(s');\r\n\r\n reveal_UnAckedListInNetwork();\r\n}\r\n\r\nlemma NextInv_NextShard_EachKeyClaimedInExactlyOnePlace(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, kr:KeyRange, recipient:NodeIdentity, sm:SingleMessage, shouldSend:bool)\r\n requires Inv(s);\r\n// requires PacketsHaveSenderUniqueSeqnos(s');\r\n requires MapComplete(s');\r\n requires PacketsHaveSaneHeaders(s');\r\n requires PacketsHaveSenderUniqueSeqnos(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires recipient in AllHostIdentities(s);\r\n requires NextShard(s.hosts[id], s'.hosts[id], out, kr, recipient, sm, shouldSend);\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires var pkt := s.hosts[id].receivedPacket;\r\n pkt.Some? && pkt.v.msg.SingleMessage? && pkt.v.msg.m.Shard?;\r\n requires s.hosts[id].constants.hostIds == s.config.hostIds;\r\n ensures EachKeyClaimedInExactlyOnePlace(s');\r\n{\r\n var spkt := Packet(recipient, s.hosts[id].me, sm);\r\n forall k\r\n ensures\r\n (UniqueInFlightPacketClaimsKey(s', k) && NoHostClaimsKey(s', k))\r\n || (NoInFlightPacketClaimsKey(s', k) && UniqueHostClaimsKey(s', k));\r\n {\r\n if shouldSend {\r\n if (KeyRangeContains(kr, KeyPlus(k))) {\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, spkt.dst, spkt.src, spkt.msg.seqno); // OBSERVE trigger\r\n //PacketInFlight(s', spkt);\r\n forall () ensures NoInFlightPacketClaimsKey(s, k);\r\n { reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert HostClaimsKey(s.hosts[id], k);\r\n assert SomeHostClaimsKey(s, k);\r\n }\r\n if InFlightPacketClaimsKey(s', spkt, k) { // OBSERVE unfortunate trigger\r\n forall p1,p2 |\r\n InFlightPacketClaimsKey(s', p1, k) && InFlightPacketClaimsKey(s', p2, k)\r\n ensures p1==p2;\r\n {\r\n // OBSERVE unfortunate triggers: tickle NoInFlightPacketClaimsKey\r\n if (PacketInFlight(s, p1)) {\r\n assert InFlightPacketClaimsKey(s, p1, k);\r\n }\r\n if (PacketInFlight(s, p2)) {\r\n assert InFlightPacketClaimsKey(s, p2, k);\r\n }\r\n }\r\n assert SomePacketClaimsKey(s', k) && OnlyOnePacketClaimsKey(s', k);\r\n assert UniqueInFlightPacketClaimsKey(s', k);\r\n forall i | i in AllHostIdentities(s)\r\n ensures !HostClaimsKey(s'.hosts[i], k);\r\n {\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n if (i!=id) { // OBSERVE unfortunate trigger\r\n assert HostClaimsKey(s.hosts[id], k);\r\n } else {\r\n assert !(DelegateForKey(s'.hosts[id].delegationMap, k)==s'.hosts[id].me);\r\n assert !BufferedPacketClaimsKey(s'.hosts[id], k);\r\n assert !HostClaimsKey(s'.hosts[id], k);\r\n }\r\n }\r\n assert NoHostClaimsKey(s', k);\r\n }\r\n } else {\r\n if (UniqueInFlightPacketClaimsKey(s, k) && NoHostClaimsKey(s, k)) {\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n NonDelegationsEachKeyClaimedInExactlyOnePlace_case1(s, s', k);\r\n } else {\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n reveal_HiddenInv();\r\n NonDelegationsEachKeyClaimedInExactlyOnePlace_case2(s, s', k);\r\n }\r\n }\r\n } else {\r\n NonDelegationsEachKeyClaimedInExactlyOnePlace(s, s');\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n }\r\n }\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert EachKeyClaimedInExactlyOnePlace(s');\r\n}\r\n\r\nlemma NextInv_Shard(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, kr:KeyRange, recipient:NodeIdentity, sm:SingleMessage, shouldSend:bool)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires NextShard(s.hosts[id], s'.hosts[id], out, kr, recipient, sm, shouldSend);\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires var pkt := s.hosts[id].receivedPacket;\r\n pkt.Some? && pkt.v.msg.SingleMessage? && pkt.v.msg.m.Shard?;\r\n requires s.hosts[id].constants.hostIds == s.config.hostIds;\r\n ensures Inv(s');\r\n{\r\n assert NoHostsStoreEmptyValues(s');\r\n assert DelegationMessagesCarryNoEmptyValues(s');\r\n var m := Delegate(kr, ExtractRange(s.hosts[id].h, kr)); \r\n reveal_PacketsHaveSenderUniqueSeqnos();\r\n assert PacketsHaveSenderUniqueSeqnos(s');\r\n\r\n forall () ensures EachKeyClaimedInExactlyOnePlace(s');\r\n {\r\n NextInv_NextShard_EachKeyClaimedInExactlyOnePlace(s, s', id, recv, out, kr, recipient, sm, shouldSend);\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n }\r\n\r\n forall id,k:Key | id in AllHostIdentities(s)\r\n ensures DelegateForKey(s'.hosts[id].delegationMap, k) in AllHostIdentities(s);\r\n {\r\n assert AllDelegationsToKnownHosts(s);\r\n assert DelegateForKey(s.hosts[id].delegationMap, k) in AllHostIdentities(s); // OBSERVE trigger\r\n } //assert AllDelegationsToKnownHosts(s');\r\n\r\n forall dst, src, seqno ensures ReceiverHasNotCanceledUnsentSeqno(s', dst, src, seqno);\r\n {\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, dst, src, seqno); // OBSERVE trigger\r\n } // assert ReceiverHasCanceledNoUnsentSeqnos(s');\r\n\r\n SendSingleMessagePreservesUnAckListProperties(s.hosts[id].sd, s'.hosts[id].sd, m, sm, s.hosts[id].constants.params, shouldSend);\r\n\r\n // Prove UnAckedListInNetwork\r\n reveal_UnAckedListInNetwork();\r\n forall id,msg,dst |\r\n id in AllHostIdentities(s)\r\n && msg in AckStateLookup(dst, s'.hosts[id].sd.sendState).unAcked\r\n && NoAcksInUnAckedLists(s'.hosts[id].sd)\r\n && dst == msg.dst\r\n ensures Packet(msg.dst, s'.hosts[id].me, msg) in s'.network;\r\n {\r\n var unAcked := AckStateLookup(dst, s.hosts[id].sd.sendState).unAcked;\r\n var unAcked' := AckStateLookup(dst, s'.hosts[id].sd.sendState).unAcked;\r\n var i :| 0 <= i < |unAcked'| && unAcked'[i] == msg;\r\n if i < |unAcked| {\r\n assert msg in AckStateLookup(dst, s.hosts[id].sd.sendState).unAcked;\r\n } else {\r\n var oldAckState := AckStateLookup(dst, s.hosts[id].sd.sendState); \r\n var new_seqno := oldAckState.numPacketsAcked + |oldAckState.unAcked| + 1;\r\n if new_seqno > s.hosts[id].constants.params.max_seqno {\r\n assert out == {};\r\n } else {\r\n assert out == {Packet(msg.dst, s'.hosts[id].me, msg)};\r\n }\r\n }\r\n }\r\n}\r\n\r\nlemma NextInv_Process_Boring_Message(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires s.hosts[id].receivedPacket.Some? && s.hosts[id].receivedPacket.v.msg.SingleMessage?\r\n ==> !s.hosts[id].receivedPacket.v.msg.m.Delegate?;\r\n //requires s'.hosts[id].receivedPacket.None?;\r\n requires s'.hosts[id] == s.hosts[id].(receivedPacket := None);\r\n requires out == {};\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n ensures Inv(s');\r\n{\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n\r\n assert out == {};\r\n assert h' == h.(receivedPacket := None);\r\n reveal_UnAckedListInNetwork(); // ==>\r\n assert AckListsInv(s');\r\n reveal_PacketsHaveSenderUniqueSeqnos(); // ==>\r\n assert PacketsHaveSenderUniqueSeqnos(s');\r\n // Prove ReceiverHasCanceledNoUnsentSeqnos(s')\r\n forall dst, src, seqno {:trigger ReceiverHasNotCanceledUnsentSeqno(s', dst, src, seqno)}\r\n ensures dst in AllHostIdentities(s) && src in AllHostIdentities(s)\r\n && HighestSeqnoSent(s.hosts[src].sd, dst) < seqno\r\n ==> seqno > TombstoneTableLookup(src, s.hosts[dst].sd.receiveState);\r\n {\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, dst, src, seqno); // OBSERVE: Need to trigger to expand the definition\r\n }\r\n assert ReceiverHasCanceledNoUnsentSeqnos(s');\r\n reveal_EachKeyClaimedInExactlyOnePlace(); // ==>\r\n assert NotADelegateStep(s, s');\r\n NonDelegationsEachKeyClaimedInExactlyOnePlace(s, s'); // Prove EachKeyClaimedInExactlyOnePlace\r\n assert EachKeyClaimedInExactlyOnePlace(s');\r\n}\r\n\r\nlemma NextInv_Process_Message(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires ShouldProcessReceivedMessage(s.hosts[id]);\r\n requires s.hosts[id].receivedPacket.v in s.network;\r\n requires Process_Message(s.hosts[id], s'.hosts[id], out);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n ensures Inv(s');\r\n{\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n var rpkt := s.hosts[id].receivedPacket.v;\r\n\r\n if (NextGetRequest(h, h', rpkt, out)) {\r\n NextInv_Get_NotADelegateStep(s, s', id, recv, out, rpkt);\r\n NextInv_Get(s, s', id, recv, out, rpkt);\r\n assert Inv(s');\r\n } else if (NextSetRequest(h, h', rpkt, out)) {\r\n NextInv_Set_NotADelegateStep(s, s', id, recv, out, rpkt);\r\n NextInv_Set(s, s', id, recv, out, rpkt);\r\n } else if (NextDelegate(h, h', rpkt, out)) {\r\n NextInv_Delegate(s, s', id, recv, out, rpkt);\r\n } else if (NextShard_Wrapper(h, h', rpkt, out)) {\r\n if ( rpkt.msg.m.recipient == h.me \r\n || !ValidKeyRange(rpkt.msg.m.kr)\r\n || !ValidPhysicalAddress(rpkt.msg.m.recipient)\r\n || EmptyKeyRange(rpkt.msg.m.kr)\r\n || rpkt.msg.m.recipient !in h.constants.hostIds \r\n || !DelegateForKeyRangeIsHost(h.delegationMap, rpkt.msg.m.kr, h.me)\r\n || |ExtractRange(h.h, rpkt.msg.m.kr)| >= max_hashtable_size()) {\r\n //s' == s.(receivedPacket := s'.receivedPacket) && out == {} \r\n NextInv_Process_Boring_Message(s, s', id, recv, out);\r\n } else {\r\n var sm,b :| NextShard(h, h', out, rpkt.msg.m.kr, rpkt.msg.m.recipient, sm, b);\r\n NextInv_Shard(s, s', id, recv, out, rpkt.msg.m.kr, rpkt.msg.m.recipient, sm, b);\r\n }\r\n } else if NextReply(h, h', rpkt, out) {\r\n NextInv_Process_Boring_Message(s, s', id, recv, out);\r\n assert Inv(s');\r\n } else if NextRedirect(h, h', rpkt, out) {\r\n NextInv_Process_Boring_Message(s, s', id, recv, out);\r\n assert Inv(s');\r\n } else {\r\n assert false;\r\n }\r\n}\r\n\r\nlemma NextInv_ReceivePacket(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, rpkt:Packet, out:set, ack:Packet)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires rpkt in recv;\r\n requires ReceivePacket(s.hosts[id], s'.hosts[id], rpkt, out, ack);\r\n ensures Inv(s');\r\n{\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n\r\n if h.receivedPacket.None? {\r\n assert ReceiveSingleMessage(h.sd, h'.sd, rpkt, ack, out);\r\n ReceivePacket_Properties(s, s', id, recv, rpkt, out, ack);\r\n } else {\r\n assert s.hosts == s'.hosts; // OBSERVE (extensionality)\r\n assert s.network == s'.network; // OBSERVE (extensionality?)\r\n assert s == s';\r\n }\r\n}\r\n\r\n/*\r\nlemma NextInv_ProcessReceivedPacket_BoringPacket(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires ProcessReceivedPacket(s.hosts[id], s'.hosts[id], out);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n requires var h := s.hosts[id]; h.receivedPacket.Some? && !NewSingleMessage(h.sd, h.receivedPacket.v);\r\n ensures Inv(s');\r\n{\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n\r\n assert out == {};\r\n assert h' == h.(receivedPacket := None);\r\n reveal_UnAckedListInNetwork(); // ==>\r\n assert AckListsInv(s');\r\n reveal_PacketsHaveSenderUniqueSeqnos(); // ==>\r\n assert PacketsHaveSenderUniqueSeqnos(s');\r\n // Prove ReceiverHasCanceledNoUnsentSeqnos(s')\r\n forall dst, src, seqno \r\n ensures dst in AllHostIdentities(s) && src in AllHostIdentities(s)\r\n && HighestSeqnoSent(s.hosts[src].sd, dst) < seqno\r\n ==> seqno > TombstoneTableLookup(src, s.hosts[dst].sd.receiveState);\r\n {\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, dst, src, seqno); // OBSERVE: Need to trigger to expand the definition\r\n }\r\n assert ReceiverHasCanceledNoUnsentSeqnos(s');\r\n reveal_EachKeyClaimedInExactlyOnePlace(); // ==>\r\n assert NotADelegateStep(s, s');\r\n NonDelegationsEachKeyClaimedInExactlyOnePlace(s, s'); // Prove EachKeyClaimedInExactlyOnePlace\r\n assert EachKeyClaimedInExactlyOnePlace(s');\r\n}\r\n*/\r\n\r\nlemma NextInv_ProcessReceivedPacket(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires ProcessReceivedPacket(s.hosts[id], s'.hosts[id], out);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n ensures Inv(s');\r\n{\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n\r\n //assert ReceiveSingleMessage(h.sd, h'.sd, rpkt, ack, ack_packets);\r\n\r\n if ShouldProcessReceivedMessage(h) {\r\n NextInv_Process_Message(s, s', id, recv, out);\r\n } else {\r\n assert s.hosts == s'.hosts; // OBSERVE (extensionality)\r\n assert s.network == s'.network; // OBSERVE (extensionality?)\r\n assert s == s';\r\n }\r\n}\r\n\r\nlemma NextInv_SpontaneouslyRetransmit(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out)\r\n ensures Inv(s');\r\n{\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n\r\n reveal_UnAckedListInNetwork();\r\n assert h == h';\r\n forall p | p in out \r\n ensures p in s.network;\r\n {\r\n var dst, i :| dst in h.sd.sendState && 0 <= i < |h.sd.sendState[dst].unAcked| && h.sd.sendState[dst].unAcked[i].SingleMessage? && (var sm := h.sd.sendState[dst].unAcked[i]; p.dst == sm.dst && p.src == s.hosts[id].me && p.msg == sm); // Needed for the OBSERVE on the next line\r\n assert AckStateLookup(dst, h.sd.sendState) == h.sd.sendState[dst]; // OBSERVE\r\n assert UnAckedMsgForDst(h.sd, p.msg, p.dst); // OBSERVE\r\n }\r\n reveal_PacketsHaveSenderUniqueSeqnos();\r\n\r\n\r\n // Prove ReceiverHasCanceledNoUnsentSeqnos(s')\r\n forall dst, src, seqno {:trigger ReceiverHasNotCanceledUnsentSeqno(s', dst, src, seqno)}\r\n ensures dst in AllHostIdentities(s) && src in AllHostIdentities(s)\r\n && HighestSeqnoSent(s.hosts[src].sd, dst) < seqno\r\n ==> seqno > TombstoneTableLookup(src, s.hosts[dst].sd.receiveState);\r\n {\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, dst, src, seqno); // OBSERVE: Need to trigger to expand the definition\r\n }\r\n\r\n NonDelegationsEachKeyClaimedInExactlyOnePlace(s, s');\r\n}\r\n\r\nlemma NextInv_NextPred(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n ensures Inv(s');\r\n{\r\n\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n \r\n if (exists pkt, ack :: pkt in recv && ReceivePacket(h, h', pkt, out, ack)) {\r\n var pkt, ack :| pkt in recv && ReceivePacket(h, h', pkt, out, ack);\r\n NextInv_ReceivePacket(s, s', id, recv, pkt, out, ack);\r\n } else if SpontaneouslyRetransmit(h, h', out) {\r\n NextInv_SpontaneouslyRetransmit(s, s', id, recv, out);\r\n } else if ProcessReceivedPacket(h, h', out) {\r\n NextInv_ProcessReceivedPacket(s, s', id, recv, out);\r\n }\r\n}\r\n\r\nlemma NextInv_NextExternal(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_NextExternal(s, s', id, recv, out);\r\n ensures Inv(s');\r\n{\r\n reveal_UnAckedListInNetwork(); // ==>\r\n assert AckListsInv(s');\r\n\r\n reveal_PacketsHaveSenderUniqueSeqnos(); // ==>\r\n assert PacketsHaveSenderUniqueSeqnos(s');\r\n\r\n forall dst, src, seqno \r\n ensures ReceiverHasNotCanceledUnsentSeqno(s', dst, src, seqno); // <== Prove this subinvariant\r\n {\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, dst, src, seqno);\r\n }\r\n\r\n NonDelegationsEachKeyClaimedInExactlyOnePlace(s, s'); // ==> \r\n assert EachKeyClaimedInExactlyOnePlace(s');\r\n\r\n}\r\n\r\nlemma NextInv(s:SHT_State, s':SHT_State)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n ensures Inv(s');\r\n{\r\n if (exists id, recv, out :: SHT_NextPred(s, s', id, recv, out)) {\r\n var id, recv, out :| SHT_NextPred(s, s', id, recv, out);\r\n NextInv_NextPred(s, s', id, recv, out);\r\n } else if (exists id, recv, out :: SHT_NextExternal(s, s', id, recv, out)) {\r\n var id, recv, out :| SHT_NextExternal(s, s', id, recv, out);\r\n NextInv_NextExternal(s, s', id, recv, out);\r\n } else {\r\n assert false; // There should be no other cases\r\n }\r\n}\r\n\r\nlemma InitInv(c:SHTConfiguration, s:SHT_State)\r\n requires WFSHTConfiguration(c);\r\n requires SHT_Init(c, s);\r\n ensures Inv(s);\r\n{\r\n reveal_UnAckedListInNetwork();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n forall k\r\n ensures NoInFlightPacketClaimsKey(s, k);\r\n ensures UniqueHostClaimsKey(s, k);\r\n {\r\n var id := s.config.rootIdentity;\r\n assert HostClaimsKey(s.hosts[id], k);\r\n }\r\n reveal_PacketsHaveSenderUniqueSeqnos();\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/SHT/RefinementProof/Refinement.i.dfy", "content": "include \"../../../Services/SHT/HT.s.dfy\"\r\ninclude \"InvDefs.i.dfy\"\r\ninclude \"../../../Services/SHT/AbstractService.s.dfy\"\r\ninclude \"../Message.i.dfy\"\r\ninclude \"../../Common/NodeIdentity.i.dfy\"\r\ninclude \"../../../Common/Collections/Maps2.i.dfy\"\r\n\r\nmodule SHT__Refinement_i {\r\nimport opened SHT__HT_s\r\nimport opened SHT__InvDefs_i\r\nimport opened AbstractServiceSHT_s`All\r\nimport opened AppInterface_i`Spec\r\nimport opened SHT__Message_i\r\nimport opened SHT__SHT_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened Collections__Maps2_i\r\nimport opened Collections__Sets_i\r\n\r\n// Frustrating:\r\n// a set comprehension must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'h'\r\n//function RefinedDomain(s:SHT_State) : set\r\n// requires MapComplete(s);\r\n//{\r\n// set h,k | FindHashTable(s,k)==h && k in h :: k\r\n//}\r\n\r\n// Workaround: Add a finite bound for 'h'. This set doesn't\r\n// restrict RefinedDomain at all, but convinces Dafny it's finite.\r\nfunction AllHashTables(s:SHT_State) : set\r\n requires MapComplete(s);\r\n{\r\n (set pkt | pkt in s.network && pkt.src in AllHostIdentities(s) \r\n && pkt.msg.SingleMessage? && pkt.msg.m.Delegate? :: pkt.msg.m.h)\r\n +\r\n (set id {:auto_trigger} | id in AllHostIdentities(s) :: s.hosts[id].h)\r\n}\r\n\r\n// This definition is opaque because it is trigger-happy (alternating quantifiers)\r\nfunction {:opaque} RefinedDomain(s:SHT_State) : set\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n ensures forall k :: k in RefinedDomain(s) ==> k in FindHashTable(s,k); // Exposed to eliminate 'key may not be in domain' error in Refinement() below.\r\n{\r\n set h,k | (h in AllHashTables(s)) && FindHashTable(s,k)==h && (k in h) :: k\r\n}\r\n\r\n/*function Refinement(s:SHT_State) : Hashtable\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n{\r\n // TODO this will be a little tricky around empty values -- we must\r\n // be sure the domains match, which probably means ensuring that\r\n // we don't store empty values explicitly in either system (and then\r\n // making sure that's an invariant).\r\n map k | k in RefinedDomain(s) :: FindHashTable(s,k)[k]\r\n}*/\r\n\r\nfunction Refinement(s:SHT_State) : ServiceState\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n{\r\n // TODO this will be a little tricky around empty values -- we must\r\n // be sure the domains match, which probably means ensuring that\r\n // we don't store empty values explicitly in either system (and then\r\n // making sure that's an invariant).\r\n var reqs := set h,i {:trigger h.receivedRequests[i]} | h in maprange(s.hosts) && 0 <= i < |h.receivedRequests| :: h.receivedRequests[i];\r\n var ss := ServiceState'(\r\n MapSeqToSet(s.config.hostIds, x => x),\r\n map k | k in RefinedDomain(s) :: FindHashTable(s,k)[k],\r\n (reqs),\r\n //+ (set p | p in s.network && p.msg.SingleMessage? && p.msg.m.SetRequest? :: AppSetRequest(p.src, p.msg.seqno, p.msg.m.k_setrequest, p.msg.m.v_setrequest)),\r\n set p | p in s.network && p.msg.SingleMessage? && p.msg.m.Reply? && p.src in s.hosts :: AppReply(p.msg.seqno, p.msg.m.k_reply, p.msg.m.v)\r\n );\r\n ss\r\n\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/SHT/RefinementProof/RefinementProof.i.dfy", "content": "include \"../../../Common/Collections/Maps2.i.dfy\"\r\ninclude \"../../../Common/Collections/Sets.i.dfy\"\r\ninclude \"Refinement.i.dfy\"\r\ninclude \"InvProof.i.dfy\"\r\n\r\nmodule SHT__RefinementProof_i {\r\nimport opened Native__Io_s\r\nimport opened Logic__Option_i\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Maps2_i\r\nimport opened Collections__Sets_i\r\nimport opened AbstractServiceSHT_s`All\r\nimport opened AppInterface_i`Spec\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened SHT__Refinement_i\r\nimport opened SHT__InvProof_i\r\nimport opened SHT__HT_s\r\nimport opened SHT__InvDefs_i\r\nimport opened SHT__Message_i\r\nimport opened SHT__SHT_i\r\nimport opened SHT__Network_i\r\nimport opened SHT__SingleMessage_i\r\nimport opened SHT__Keys_i\r\nimport opened SHT__Host_i\r\nimport opened SHT__Delegations_i\r\nimport opened SHT__SingleDelivery_i\r\n\r\npredicate HashtableNext(h:Hashtable, h':Hashtable)\r\n{\r\n (exists k, ov :: Set(h, h', k, ov))\r\n || (exists k, ov :: Get(h, h', k, ov))\r\n}\r\n\r\npredicate HashtableStutter(h:Hashtable, h':Hashtable)\r\n{\r\n h'==h\r\n}\r\n\r\npredicate ServiceStutter(s:ServiceState', s':ServiceState')\r\n{\r\n s' == s\r\n}\r\n\r\nlemma PacketClaimsKey_forces_FindHashTable(s:SHT_State, pkt:Packet, k:Key)\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n requires InFlightPacketClaimsKey(s,pkt,k);\r\n requires UniqueInFlightPacketClaimsKey(s, k);\r\n ensures ThePacketThatClaimsKey(s,k) == pkt;\r\n ensures FindHashTable(s,k) == pkt.msg.m.h;\r\n{\r\n assert forall p1,p2 :: InFlightPacketClaimsKey(s,p1,k) && InFlightPacketClaimsKey(s,p2,k) ==> p1==p2;\r\n assert ThePacketThatClaimsKey(s,k) == pkt;\r\n// assert FindHashTable(s,k) == ThePacketThatClaimsKey(s,k).msg.m.h;\r\n}\r\n\r\nlemma HostClaimsKey_forces_FindHashTable(s:SHT_State, id:NodeIdentity, k:Key)\r\n requires Inv(s);\r\n requires id in AllHostIdentities(s);\r\n requires HostClaimsKey(s.hosts[id], k);\r\n ensures FindHashTable(s,k) == FindHostHashTable(s, k); //== s.hosts[id].h;\r\n{\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert NoInFlightPacketClaimsKey(s,k); // OBSERVE trigger\r\n}\r\n\r\n\r\nlemma UniquePacketClaimsKey_forces_FindHashTable(s:SHT_State, k:Key) returns (pkt:Packet)\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n requires UniqueInFlightPacketClaimsKey(s, k);\r\n ensures InFlightPacketClaimsKey(s,pkt,k);\r\n ensures ThePacketThatClaimsKey(s,k) == pkt;\r\n ensures FindHashTable(s,k) == pkt.msg.m.h;\r\n{\r\n assert forall p1,p2 :: InFlightPacketClaimsKey(s,p1,k) && InFlightPacketClaimsKey(s,p2,k) ==> p1==p2;\r\n pkt :| InFlightPacketClaimsKey(s, pkt, k);\r\n assert ThePacketThatClaimsKey(s,k) == pkt;\r\n// assert FindHashTable(s,k) == ThePacketThatClaimsKey(s,k).msg.m.h;\r\n}\r\n\r\n\r\nlemma HostClaimsKey_forces_FindHostHashTable(s:SHT_State, k:Key) returns (id:NodeIdentity)\r\n requires Inv(s);\r\n requires UniqueHostClaimsKey(s, k);\r\n ensures id in AllHostIdentities(s);\r\n ensures HostClaimsKey(s.hosts[id], k);\r\n ensures FindHashTable(s,k) == FindHostHashTable(s, k); \r\n ensures id == TheHostThatClaimsKey(s, k);\r\n{\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert NoInFlightPacketClaimsKey(s,k); // OBSERVE trigger\r\n id :| id in AllHostIdentities(s) && HostClaimsKey(s.hosts[id], k);\r\n}\r\n\r\npredicate HashtableIsNormalized(h:Hashtable)\r\n{\r\n forall k\r\n {:trigger k in h} {:trigger h[k]}\r\n :: k in h ==> HashtableLookup(h, k) != ValueAbsent()\r\n}\r\n\r\n\r\npredicate HashTablesAgreeUpToNormalization(h1:Hashtable, h2:Hashtable)\r\n{\r\n forall k\r\n /* Magical triggers from Chris */\r\n {:trigger HashtableLookup(h1,k)}{:trigger HashtableLookup(h2,k)}\r\n :: HashtableLookup(h1,k) == HashtableLookup(h2,k)\r\n}\r\n\r\nlemma HashtableAgreement(h1:Hashtable, h2:Hashtable)\r\n requires HashtableIsNormalized(h1);\r\n requires HashtableIsNormalized(h2);\r\n requires HashTablesAgreeUpToNormalization(h1, h2);\r\n ensures h1 == h2;\r\n{\r\n forall k\r\n ensures (k in h1) == (k in h2);\r\n {\r\n assert HashtableLookup(h1,k) == HashtableLookup(h2,k); // OBSERVE trigger\r\n }\r\n forall k | (k in h1)\r\n ensures h1[k]==h2[k];\r\n {\r\n assert HashtableLookup(h1,k) == HashtableLookup(h2,k); // OBSERVE trigger\r\n }\r\n}\r\n\r\npredicate InvRefinementNormalized(s:SHT_State)\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n{\r\n HashtableIsNormalized(Refinement(s).ht)\r\n}\r\n\r\npredicate {:opaque} HiddenInvRefinementNormalized(s:SHT_State)\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n{\r\n InvRefinementNormalized(s)\r\n}\r\n\r\nfunction NormalizedReplace(h:Hashtable, k:Key, ov:OptionalValue) : Hashtable\r\n{\r\n if ov.ValuePresent? then\r\n h[k := ov.v]\r\n else\r\n mapremove(h, k)\r\n}\r\n\r\nlemma NormalizedReplace_PreservesNormalization(h:Hashtable, k:Key, v:OptionalValue)\r\n requires HashtableIsNormalized(h);\r\n ensures HashtableIsNormalized(NormalizedReplace(h,k,v));\r\n{\r\n}\r\n\r\n\r\nlemma LookupInRefinement(s:SHT_State, k:Key)\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n requires EachKeyClaimedInExactlyOnePlace(s);\r\n requires BufferedPacketsInv(s);\r\n requires InvConstants(s);\r\n ensures HashtableLookup(Refinement(s).ht, k) == HashtableLookup(FindHashTable(s,k), k);\r\n{\r\n reveal_RefinedDomain();\r\n if exists pkt :: InFlightPacketClaimsKey(s,pkt,k) {\r\n// if k in Refinement(s) {\r\n//// calc {\r\n//// HashtableLookup(Refinement(s).ht, k);\r\n//// if k in Refinement(s) then ValuePresent(Refinement(s)[k]) else ValueAbsent();\r\n//// ValuePresent(Refinement(s)[k]); \r\n//// //FindHashTable(s,k)[k];\r\n//// HashtableLookup(FindHashTable(s,k), k);\r\n//// }\r\n// }\r\n assert HashtableLookup(Refinement(s).ht, k) == HashtableLookup(FindHashTable(s,k), k);\r\n } else if exists id :: id in AllHostIdentities(s) && HostClaimsKey(s.hosts[id], k) {\r\n var id :| id in AllHostIdentities(s) && HostClaimsKey(s.hosts[id], k); \r\n var h := s.hosts[id];\r\n assert DelegateForKey(h.delegationMap, k)==h.me || BufferedPacketClaimsKey(h, k);\r\n\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert UniqueHostClaimsKey(s, k); // OBSERVE\r\n assert OnlyOneHostClaimsKey(s, k); // OBSERVE\r\n if id != TheHostThatClaimsKey(s, k) {\r\n assert HostClaimsKey(s.hosts[id], k);\r\n assert HostClaimsKey(s.hosts[TheHostThatClaimsKey(s, k)], k);\r\n assert false;\r\n }\r\n assert id == TheHostThatClaimsKey(s, k);\r\n //assert s.hosts[id] == s.hosts[TheHostThatClaimsKey(s, k)];\r\n assert FindHashTable(s,k) == \r\n if BufferedPacketClaimsKey(s.hosts[id], k) then\r\n s.hosts[id].receivedPacket.v.msg.m.h\r\n else \r\n // assert DelegateForKey(s.hosts[id].delegationMap, k)==s.hosts[id].me \r\n s.hosts[id].h;\r\n\r\n if BufferedPacketClaimsKey(s.hosts[id], k) \r\n && NewSingleMessage(s.hosts[id].sd, s.hosts[id].receivedPacket.v) {\r\n //assert h.receivedPacket.Some? ==> h.receivedPacket.v in s.network;\r\n assert h.receivedPacket.v in s.network;\r\n assert FindHashTable(s,k) == s.hosts[id].receivedPacket.v.msg.m.h;\r\n assert s.hosts[id].receivedPacket.v.src in s.hosts[id].constants.hostIds;\r\n assert s.hosts[id].receivedPacket.v.src in AllHostIdentities(s);\r\n assert FindHashTable(s,k) in AllHashTables(s);\r\n } else { \r\n assert FindHashTable(s,k) in AllHashTables(s);\r\n }\r\n\r\n assert FindHashTable(s,k) in AllHashTables(s);\r\n //assert k in FindHashTable(s,k);\r\n if k in FindHashTable(s, k) {\r\n assert HashtableLookup(Refinement(s).ht, k) == HashtableLookup(FindHashTable(s,k), k);\r\n } else {\r\n assert HashtableLookup(Refinement(s).ht, k) == HashtableLookup(FindHashTable(s,k), k);\r\n }\r\n } else {\r\n assert HashtableLookup(Refinement(s).ht, k) == HashtableLookup(FindHashTable(s,k), k);\r\n }\r\n}\r\n\r\n\r\nlemma SetPreservesRefinement_koNotk(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet, k:Key, ko:Key, pkt:Packet) // requires Inv(s); // Boy, does Inv cause trouble.\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires EachKeyClaimedInExactlyOnePlace(s);\r\n requires Inv(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.SetRequest? && NextSetRequest(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires k==rpkt.msg.m.k_setrequest;\r\n requires HostClaimsKey(s.hosts[id], k);\r\n requires exists pkt :: InFlightPacketClaimsKey(s,pkt,ko);\r\n requires pkt == ThePacketThatClaimsKey(s,ko);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n ensures ko!=k;\r\n{\r\n forall () ensures NoHostClaimsKey(s, ko);\r\n { reveal_EachKeyClaimedInExactlyOnePlace(); }\r\n}\r\n\r\n\r\npredicate NoNewDelegationMessages(s:SHT_State, s':SHT_State)\r\n requires MapComplete(s);\r\n requires MapComplete(s');\r\n requires PacketsHaveSaneHeaders(s);\r\n requires PacketsHaveSaneHeaders(s');\r\n{\r\n forall pkt:Packet :: pkt.msg.SingleMessage? && pkt.msg.m.Delegate?\r\n ==> (pkt in s.network <==> pkt in s'.network)\r\n}\r\n\r\npredicate InvBasics(s:SHT_State)\r\n{\r\n MapComplete(s)\r\n && PacketsHaveSaneHeaders(s)\r\n && AllDelegationsToKnownHosts(s)\r\n}\r\n\r\nlemma ThereCanBeOnlyOneInFlightPacket(s:SHT_State, s':SHT_State, k:Key, pkt:Packet)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires SHT_Next(s, s');\r\n requires InFlightPacketClaimsKey(s,pkt,k);\r\n requires InFlightPacketClaimsKey(s',pkt,k);\r\n ensures ThePacketThatClaimsKey(s,k)==pkt;\r\n ensures ThePacketThatClaimsKey(s',k)==pkt;\r\n{\r\n forall ()\r\n ensures UniqueInFlightPacketClaimsKey(s, k);\r\n ensures UniqueInFlightPacketClaimsKey(s', k);\r\n {\r\n reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n }\r\n PacketClaimsKey_forces_FindHashTable(s, pkt, k);\r\n PacketClaimsKey_forces_FindHashTable(s', pkt, k);\r\n}\r\n\r\nlemma {:timeLimitMultiplier 2} NondelegatingReadonlyStepPreservesRefinement_guts(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires SHT_Next(s, s');\r\n requires NotADelegateStep(s, s');\r\n requires forall id :: id in AllHostIdentities(s) ==>\r\n s'.hosts[id].h==s.hosts[id].h\r\n && s'.hosts[id].delegationMap==s.hosts[id].delegationMap;\r\n requires forall id :: id in AllHostIdentities(s) && DelegationPacket(s.hosts[id].receivedPacket) \r\n ==> DelegationPacketStable(s, s', id);\r\n ensures forall k :: FindHashTable(s,k)==FindHashTable(s',k);\r\n{\r\n reveal_HiddenInv();\r\n forall k\r\n ensures FindHashTable(s,k)==FindHashTable(s',k);\r\n {\r\n if exists pkt :: InFlightPacketClaimsKey(s,pkt,k)\r\n {\r\n var pkt :| InFlightPacketClaimsKey(s,pkt,k);\r\n ThereCanBeOnlyOneInFlightPacket(s, s', k, pkt);\r\n } else {\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert UniqueHostClaimsKey(s, k); // OBSERVE trigger\r\n var kid :| kid in AllHostIdentities(s) && HostClaimsKey(s.hosts[kid], k);\r\n forall ()\r\n ensures TheHostThatClaimsKey(s, k)==kid;\r\n ensures TheHostThatClaimsKey(s', k)==kid;\r\n {\r\n assert HostClaimsKey(s'.hosts[kid],k);\r\n // most heinous of OBSERVE triggers:\r\n assert forall i1,i2 ::\r\n i1 in AllHostIdentities(s) && HostClaimsKey(s.hosts[i1], k)\r\n && i2 in AllHostIdentities(s) && HostClaimsKey(s.hosts[i2], k)\r\n ==> i1==i2;\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n }\r\n }\r\n if (exists pkt :: InFlightPacketClaimsKey(s,pkt,k)) {\r\n var pkt :| InFlightPacketClaimsKey(s,pkt,k);\r\n assert InFlightPacketClaimsKey(s',pkt,k);\r\n assert FindHashTable(s,k)==FindHashTable(s',k);\r\n } else {\r\n forall pkt ensures !InFlightPacketClaimsKey(s', pkt, k) {\r\n assert !InFlightPacketClaimsKey(s, pkt, k); // OBSERVE trigger\r\n }\r\n assert NoInFlightPacketClaimsKey(s', k); // OBSERVE trigger\r\n assert UniqueHostClaimsKey(s, k); // OBSERVE\r\n assert OnlyOneHostClaimsKey(s, k); // OBSERVE\r\n assert FindHashTable(s,k)==FindHashTable(s',k);\r\n }\r\n }\r\n}\r\n\r\nlemma NondelegatingReadonlyStepPreservesRefinement(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires SHT_Next(s, s');\r\n requires NotADelegateStep(s, s');\r\n requires NoNewDelegationMessages(s, s');\r\n requires forall id :: id in AllHostIdentities(s) ==>\r\n s'.hosts[id].h==s.hosts[id].h\r\n && s'.hosts[id].delegationMap==s.hosts[id].delegationMap;\r\n requires forall id :: id in AllHostIdentities(s) && DelegationPacket(s.hosts[id].receivedPacket) \r\n ==> DelegationPacketStable(s, s', id);\r\n ensures Refinement(s).ht == Refinement(s').ht;\r\n{\r\n\r\n forall ()\r\n ensures RefinedDomain(s) == RefinedDomain(s');\r\n {\r\n NondelegatingReadonlyStepPreservesRefinement_guts(s, s', id, recv, out);\r\n reveal_RefinedDomain();\r\n assert forall k :: FindHashTable(s,k)==FindHashTable(s',k);\r\n }\r\n\r\n forall k | k in RefinedDomain(s)\r\n ensures FindHashTable(s,k)[k] == FindHashTable(s',k)[k];\r\n {\r\n NondelegatingReadonlyStepPreservesRefinement_guts(s, s', id, recv, out);\r\n }\r\n /*assert Refinement(s).ht == Refinement(s').ht;\r\n var R := Refinement(s);\r\n var R' := Refinement(s');\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n var rpkt := s.hosts[id].receivedPacket.v;\r\n if NextGetRequest(h, h', rpkt, out) {\r\n assert Refinement(s).requests == Refinement(s').requests;\r\n assert Refinement(s).replies == Refinement(s').replies;\r\n }*/\r\n}\r\n\r\npredicate {:opaque} HiddenSHT_Next_and_SHT_NextPred(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires MapComplete(s);\r\n requires MapComplete(s');\r\n{\r\n SHT_Next(s, s') && SHT_NextPred(s, s', id, recv, out)\r\n}\r\n\r\nfunction {:opaque} HiddenRefinement(s:SHT_State) : Hashtable\r\n requires InvBasics(s);\r\n{\r\n Refinement(s).ht\r\n}\r\n\r\nlemma SetPreservesRefinement_InFlight(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet, ko:Key)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires id in AllHostIdentities(s);\r\n requires HiddenSHT_Next_and_SHT_NextPred(s, s', id, recv, out);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.SetRequest? && NextSetRequest(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires InvRefinementNormalized(s);\r\n requires DelegateForKey(s.hosts[id].delegationMap, rpkt.msg.m.k_setrequest)==id;\r\n requires (exists pkt :: InFlightPacketClaimsKey(s,pkt,ko));\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n ensures HashtableLookup(HiddenRefinement(s'),ko)\r\n == HashtableLookup(NormalizedReplace(HiddenRefinement(s),rpkt.msg.m.k_setrequest,rpkt.msg.m.v_setrequest), ko);\r\n{\r\n var k := rpkt.msg.m.k_setrequest;\r\n var v := rpkt.msg.m.v_setrequest;\r\n var R := HiddenRefinement(s);\r\n var R' := HiddenRefinement(s');\r\n var NRR := NormalizedReplace(R,k,v);\r\n\r\n var pkt := ThePacketThatClaimsKey(s,ko);\r\n assert InFlightPacketClaimsKey(s,pkt,ko); // OBSERVE trigger ... Whoah, why would I need a trigger here? The :| is an exists that is unhelpful?\r\n assert pkt!=rpkt;\r\n forall () ensures PacketInFlight(s', pkt);\r\n {\r\n reveal_HiddenInv();\r\n }\r\n forall() ensures ko!=k;\r\n {\r\n reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert HostClaimsKey(s.hosts[id],k); // OBSERVE trigger\r\n assert NoInFlightPacketClaimsKey(s, k);\r\n// assert !InFlightPacketClaimsKey(s,pkt,k);\r\n }\r\n\r\n assert InFlightPacketClaimsKey(s',pkt,ko); // OBSERVE trigger\r\n\r\n forall () ensures EachKeyClaimedInExactlyOnePlace(s) && BufferedPacketsInv(s)\r\n && EachKeyClaimedInExactlyOnePlace(s') && BufferedPacketsInv(s');\r\n {\r\n reveal_HiddenInv();\r\n }\r\n\r\n forall () ensures InvConstants(s) && InvConstants(s') { reveal_HiddenInv(); }\r\n\r\n calc {\r\n HashtableLookup(HiddenRefinement(s'),ko);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(Refinement(s').ht,ko);\r\n { LookupInRefinement(s',ko); }\r\n HashtableLookup(FindHashTable(s',ko), ko);\r\n HashtableLookup(ThePacketThatClaimsKey(s',ko).msg.m.h,ko);\r\n { ThereCanBeOnlyOneInFlightPacket(s, s', ko, pkt); }\r\n HashtableLookup(ThePacketThatClaimsKey(s,ko).msg.m.h,ko);\r\n HashtableLookup(FindHashTable(s,ko), ko);\r\n { LookupInRefinement(s,ko); }\r\n HashtableLookup(Refinement(s).ht,ko);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(HiddenRefinement(s),ko);\r\n HashtableLookup(NormalizedReplace(HiddenRefinement(s),k,v), ko);\r\n }\r\n calc {\r\n HashtableLookup(R,ko);\r\n HashtableLookup(HiddenRefinement(s),ko);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(Refinement(s).ht,ko);\r\n { LookupInRefinement(s,ko); }\r\n HashtableLookup(FindHashTable(s,ko), ko);\r\n HashtableLookup(ThePacketThatClaimsKey(s,ko).msg.m.h,ko);\r\n { assert ThePacketThatClaimsKey(s,ko) == pkt; }\r\n HashtableLookup(pkt.msg.m.h,ko);\r\n }\r\n assert HashtableLookup(R,ko) == HashtableLookup(pkt.msg.m.h,ko);\r\n assert InFlightPacketClaimsKey(s',pkt,ko);\r\n forall ()\r\n ensures UniqueInFlightPacketClaimsKey(s, ko);\r\n ensures UniqueInFlightPacketClaimsKey(s', ko);\r\n {\r\n reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n }\r\n PacketClaimsKey_forces_FindHashTable(s', pkt, ko);\r\n assert ThePacketThatClaimsKey(s',ko) == pkt;\r\n LookupInRefinement(s',ko);\r\n assert HashtableLookup(R',ko) == HashtableLookup(ThePacketThatClaimsKey(s',ko).msg.m.h,ko);\r\n forall () ensures ko!=k;\r\n {\r\n reveal_HiddenInv();\r\n SetPreservesRefinement_koNotk(s, s', id, recv, out, rpkt, k, ko, pkt);\r\n }\r\n// NormalizedReplace_Properties(R,k,v);\r\n assert HashtableLookup(NormalizedReplace(R,k,v), ko) == HashtableLookup(R,ko);\r\n}\r\n\r\npredicate FooFHT1(s:SHT_State, k:Key)\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n{\r\n exists pkt :: InFlightPacketClaimsKey(s,pkt,k)\r\n}\r\n\r\npredicate FooFHT2(s:SHT_State, k:Key)\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n{\r\n exists id\r\n {:trigger HostClaimsKey(s.hosts[id], k)}\r\n :: id in AllHostIdentities(s) && HostClaimsKey(s.hosts[id], k)\r\n}\r\n\r\nfunction FooFHT3(s:SHT_State, k:Key) : Hashtable\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n //requires exists id :: id in AllHostIdentities(s) && HostClaimsKey(s.hosts[id], k);\r\n requires FooFHT2(s,k);\r\n{\r\n var id := TheHostThatClaimsKey(s, k);\r\n if BufferedPacketClaimsKey(s.hosts[id], k) then \r\n s.hosts[id].receivedPacket.v.msg.m.h\r\n else // assert DelegateForKey(s.hosts[id].delegationMap, k)==s.hosts[id].me \r\n s.hosts[id].h\r\n}\r\n\r\nfunction FooFindHashTable(s:SHT_State, k:Key) : Hashtable\r\n requires MapComplete(s);\r\n requires PacketsHaveSaneHeaders(s);\r\n requires AllDelegationsToKnownHosts(s);\r\n{\r\n if FooFHT1(s,k) then\r\n ThePacketThatClaimsKey(s,k).msg.m.h\r\n else if FooFHT2(s,k) then\r\n FooFHT3(s,k)\r\n else\r\n // Inv ==> this case is false\r\n map []\r\n}\r\n\r\n\r\nlemma SetPreservesRefinement_ExpandFindHashTable(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet, ko:Key, kid:NodeIdentity)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n //requires SHT_Next(s, s');\r\n //requires SHT_NextPred(s, s', id, recv, out);\r\n requires NoConfigChanged(s, s');\r\n requires id in AllHostIdentities(s);\r\n requires HiddenSHT_Next_and_SHT_NextPred(s, s', id, recv, out);\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.SetRequest? && NextSetRequest(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires InvRefinementNormalized(s);\r\n requires DelegateForKey(s.hosts[id].delegationMap, rpkt.msg.m.k_setrequest)==id;\r\n requires !(exists pkt :: InFlightPacketClaimsKey(s,pkt,ko));\r\n requires kid in AllHostIdentities(s) && HostClaimsKey(s.hosts[kid], ko);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n requires s'.hosts[id].receivedPacket.None?;\r\n ensures exists id :: id in AllHostIdentities(s) && HostClaimsKey(s'.hosts[id], ko);\r\n ensures FindHashTable(s',ko) == FindHostHashTable(s', ko); //s'.hosts[TheHostThatClaimsKey(s', ko)].h;\r\n{\r\n reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert NoInFlightPacketClaimsKey(s,ko);\r\n assert !(exists pkt :: InFlightPacketClaimsKey(s,pkt,ko));\r\n assert kid in AllHostIdentities(s) && HostClaimsKey(s.hosts[kid], ko);\r\n forall () ensures kid in AllHostIdentities(s) && HostClaimsKey(s'.hosts[kid], ko);\r\n {\r\n reveal_HiddenSHT_Next_and_SHT_NextPred();\r\n assert SHT_Next(s, s');\r\n assert SHT_NextPred(s, s', id, recv, out);\r\n }\r\n\r\n assert NoInFlightPacketClaimsKey(s', ko); // OBSERVE trigger\r\n assert !(exists pkt :: InFlightPacketClaimsKey(s',pkt,ko));\r\n assert (exists id :: id in AllHostIdentities(s) && HostClaimsKey(s'.hosts[id], ko));\r\n assert !FooFHT1(s',ko);\r\n assert FooFHT2(s',ko);\r\n assert !BufferedPacketClaimsKey(s'.hosts[id], ko);\r\n if kid == id {\r\n assert !BufferedPacketClaimsKey(s'.hosts[TheHostThatClaimsKey(s',ko)], ko);\r\n } else {\r\n calc {\r\n s'.hosts[kid];\r\n { reveal_HiddenSHT_Next_and_SHT_NextPred(); assert SHT_Next(s, s'); }\r\n s.hosts[kid];\r\n }\r\n }\r\n calc {\r\n FindHashTable(s',ko);\r\n FooFindHashTable(s',ko);\r\n FooFHT3(s',ko);\r\n FindHostHashTable(s', ko);\r\n// var id' := TheHostThatClaimsKey(s', ko);\r\n// if BufferedPacketClaimsKey(s'.hosts[id'], ko) && NewSingleMessage(s'.hosts[id'].sd, s'.hosts[id'].receivedPacket.v) then\r\n// s'.hosts[id'].receivedPacket.v.msg.m.h\r\n// else \r\n// s'.hosts[id'].h;\r\n// s'.hosts[TheHostThatClaimsKey(s', ko)].h;\r\n }\r\n// assert FindHashTable(s',ko) == s'.hosts[TheHostThatClaimsKey(s', ko)].h;\r\n}\r\n\r\n\r\nlemma {:timeLimitMultiplier 2} SetPreservesRefinement_HostClaims(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet, ko:Key, sm:SingleMessage, m:Message)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires id in AllHostIdentities(s);\r\n requires HiddenSHT_Next_and_SHT_NextPred(s, s', id, recv, out);\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.SetRequest? && NextSetRequest(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires ValidKey(rpkt.msg.m.k_setrequest) && ValidOptionalValue(rpkt.msg.m.v_setrequest);\r\n requires NextSetRequest_Complete(s.hosts[id], s'.hosts[id], rpkt.src, rpkt.msg.seqno, rpkt.msg.m, sm, m, out, true);\r\n requires InvRefinementNormalized(s);\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires DelegateForKey(s.hosts[id].delegationMap, rpkt.msg.m.k_setrequest)==id;\r\n requires !(exists pkt :: InFlightPacketClaimsKey(s,pkt,ko));\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n requires !DelegationPacket(s.hosts[id].receivedPacket);\r\n ensures HashtableLookup(HiddenRefinement(s'),ko)\r\n == HashtableLookup(NormalizedReplace(HiddenRefinement(s),rpkt.msg.m.k_setrequest,rpkt.msg.m.v_setrequest), ko);\r\n{\r\n var k := rpkt.msg.m.k_setrequest;\r\n var v := rpkt.msg.m.v_setrequest;\r\n var R := HiddenRefinement(s);\r\n var R' := HiddenRefinement(s');\r\n var NRR := NormalizedReplace(R,k,v);\r\n assert NextSetRequest_Complete(s.hosts[id], s'.hosts[id], rpkt.src, rpkt.msg.seqno, rpkt.msg.m, sm, m, out, true);\r\n //assert b;\r\n\r\n forall () ensures exists kid :: kid in AllHostIdentities(s) && HostClaimsKey(s'.hosts[kid], ko);\r\n {\r\n reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert !(exists pkt :: InFlightPacketClaimsKey(s,pkt,ko));\r\n if (exists pkt :: InFlightPacketClaimsKey(s',pkt,ko)) {\r\n var pkt :| InFlightPacketClaimsKey(s',pkt,ko);\r\n assert !InFlightPacketClaimsKey(s,pkt,ko);\r\n assert rpkt in recv;\r\n assert Network_Receive(s.network, id, recv);\r\n assert rpkt.dst == id;\r\n assert pkt.msg.m.Delegate?;\r\n forall opkt | opkt in out\r\n ensures !opkt.msg.m.Delegate?;\r\n {\r\n var sm,m,b :| NextSetRequest_Complete(s.hosts[id], s'.hosts[id], rpkt.src, rpkt.msg.seqno, rpkt.msg.m, sm, m, out, b); // OBSERVE skolemize\r\n var tpkt := Packet(rpkt.src, s.hosts[id].me, sm);\r\n ItIsASingletonSet(out, tpkt); \r\n ThingsIKnowAboutASingletonSet(out, tpkt, opkt);\r\n }\r\n assert false;\r\n }\r\n assert !(exists pkt :: InFlightPacketClaimsKey(s',pkt,ko));\r\n assert UniqueHostClaimsKey(s', ko);\r\n }\r\n\r\n var kid :| kid in AllHostIdentities(s) && HostClaimsKey(s'.hosts[kid], ko);\r\n forall () ensures TheHostThatClaimsKey(s', ko)==kid;\r\n {\r\n reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert NoInFlightPacketClaimsKey(s', ko); // OBSERVE trigger\r\n }\r\n forall () ensures TheHostThatClaimsKey(s, ko)==kid;\r\n {\r\n reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert UniqueHostClaimsKey(s, ko); // OBSERVE trigger\r\n assert HostClaimsKey(s.hosts[kid], ko); // OBSERVE trigger\r\n }\r\n\r\n forall () ensures kid!=id ==> k!=ko;\r\n {\r\n reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert HostClaimsKey(s.hosts[id], k); // OBSERVE trigger\r\n assert UniqueHostClaimsKey(s, k); // OBSERVE trigger\r\n }\r\n\r\n forall () ensures EachKeyClaimedInExactlyOnePlace(s) && BufferedPacketsInv(s)\r\n && EachKeyClaimedInExactlyOnePlace(s') && BufferedPacketsInv(s');\r\n {\r\n reveal_HiddenInv();\r\n }\r\n forall () ensures InvConstants(s) && InvConstants(s') { reveal_HiddenInv(); }\r\n\r\n\r\n if (k==ko) {\r\n assert kid in AllHostIdentities(s) && HostClaimsKey(s'.hosts[kid], k); // OBSERVE trigger to satisfy preconditions of expr on next line.\r\n assert TheHostThatClaimsKey(s', k) == TheHostThatClaimsKey(s', ko);\r\n\r\n forall () ensures NoInFlightPacketClaimsKey(s',k);\r\n {\r\n reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n }\r\n calc {\r\n HashtableLookup(HiddenRefinement(s'),ko);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(Refinement(s').ht,ko);\r\n { LookupInRefinement(s',ko); }\r\n HashtableLookup(FindHashTable(s',ko), ko);\r\n { assert !(exists pkt :: InFlightPacketClaimsKey(s,pkt,k));\r\n assert id in AllHostIdentities(s) && HostClaimsKey(s'.hosts[id], k);\r\n }\r\n HashtableLookup(s'.hosts[TheHostThatClaimsKey(s', k)].h, ko);\r\n HashtableLookup(s'.hosts[id].h, ko);\r\n //if v.ValuePresent? then OptionValue_Present(v) else OptionValue_Absent();\r\n HashtableLookup(NRR, ko);\r\n }\r\n } else {\r\n assert kid in AllHostIdentities(s) && HostClaimsKey(s.hosts[kid], ko); // OBSERVE trigger\r\n\r\n calc {\r\n HashtableLookup(HiddenRefinement(s'),ko);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(Refinement(s').ht,ko);\r\n { LookupInRefinement(s',ko); }\r\n HashtableLookup(FindHashTable(s',ko), ko);\r\n { SetPreservesRefinement_ExpandFindHashTable(s, s', id, recv, out, rpkt, ko, kid); }\r\n HashtableLookup(FindHostHashTable(s',ko), ko);\r\n //HashtableLookup(s'.hosts[TheHostThatClaimsKey(s', ko)].h, ko);\r\n {\r\n if (kid==id) {\r\n assert HashtableLookup(s.hosts[id].h, ko) == HashtableLookup(s'.hosts[id].h, ko);\r\n } else {\r\n assert s'.hosts[kid].h == s.hosts[kid].h;\r\n }\r\n }\r\n HashtableLookup(FindHostHashTable(s, ko), ko);\r\n { LookupInRefinement(s,ko); }\r\n HashtableLookup(Refinement(s).ht, ko);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(R, ko);\r\n// { HashtableLookup_NormalizedReplace(R, k, v, ko); }\r\n HashtableLookup(NormalizedReplace(R,k,v), ko);\r\n HashtableLookup(NRR, ko);\r\n }\r\n calc {\r\n HashtableLookup(HiddenRefinement(s'),ko);\r\n HashtableLookup(NRR, ko);\r\n HashtableLookup(NormalizedReplace(R,k,v), ko);\r\n HashtableLookup(NormalizedReplace(HiddenRefinement(s),rpkt.msg.m.k_setrequest,rpkt.msg.m.v_setrequest), ko);\r\n }\r\n }\r\n}\r\n\r\n//lemma HashtableLookup_NormalizedReplace(R:Hashtable, k:Key, v:Value, ko:Key)\r\n// requires k != ko;\r\n// ensures HashtableLookup(R, ko) == HashtableLookup(NormalizedReplace(R,k,v), ko);\r\n//{\r\n//}\r\n\r\nlemma SetPreservesRefinement_ko(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet, ko:Key, sm:SingleMessage, m:Message)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires id in AllHostIdentities(s);\r\n requires HiddenSHT_Next_and_SHT_NextPred(s, s', id, recv, out);\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.SetRequest? && NextSetRequest(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires ValidKey(rpkt.msg.m.k_setrequest) && ValidOptionalValue(rpkt.msg.m.v_setrequest);\r\n requires NextSetRequest_Complete(s.hosts[id], s'.hosts[id], rpkt.src, rpkt.msg.seqno, rpkt.msg.m, sm, m, out, true);\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires InvRefinementNormalized(s);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n requires !DelegationPacket(s.hosts[id].receivedPacket);\r\n requires DelegateForKey(s.hosts[id].delegationMap, rpkt.msg.m.k_setrequest)==id;\r\n ensures HashtableLookup(HiddenRefinement(s'),ko)\r\n == HashtableLookup(NormalizedReplace(HiddenRefinement(s),rpkt.msg.m.k_setrequest,rpkt.msg.m.v_setrequest), ko);\r\n{\r\n if (exists pkt :: InFlightPacketClaimsKey(s,pkt,ko)) {\r\n SetPreservesRefinement_InFlight(s, s', id, recv, out, rpkt, ko);\r\n } else {\r\n SetPreservesRefinement_HostClaims(s, s', id, recv, out, rpkt, ko, sm, m);\r\n }\r\n}\r\n\r\nlemma HashtableLookup_implies_HashtableLookup_one_key(ha:Hashtable, hb:Hashtable, k:Key)\r\n requires HashtableLookup(ha,k) == HashtableLookup(hb, k);\r\n ensures HashtableLookup(ha,k) == HashtableLookup(hb, k);\r\n{\r\n if (k in ha) {\r\n //assert HashtableLookup(ha,k)==ha[k];\r\n //assert HashtableLookup(ha,k) == OptionValue_Present(ha[k]);\r\n assert k in hb;\r\n //assert HashtableLookup(hb,k) == OptionValue_Present(hb[k]);\r\n assert ha[k] == hb[k];\r\n //assert HashtableLookup(hb,k)==hb[k];\r\n } else {\r\n //assert HashtableLookup(ha,k)==[];\r\n assert !(k in hb);\r\n //assert HashtableLookup(hb,k)==[];\r\n }\r\n}\r\n\r\nlemma HashtableLookup_implies_HashtableLookup(ha:Hashtable, hb:Hashtable)\r\n requires forall k :: HashtableLookup(ha,k) == HashtableLookup(hb, k);\r\n ensures forall k :: HashtableLookup(ha,k) == HashtableLookup(hb, k);\r\n{\r\n forall k ensures HashtableLookup(ha,k) == HashtableLookup(hb, k);\r\n {\r\n HashtableLookup_implies_HashtableLookup_one_key(ha, hb, k);\r\n }\r\n}\r\n\r\nlemma SetPreservesRefinement_main(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet, sm:SingleMessage, m:Message)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires id in AllHostIdentities(s);\r\n requires HiddenSHT_Next_and_SHT_NextPred(s, s', id, recv, out);\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.SetRequest? && NextSetRequest(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires ValidKey(rpkt.msg.m.k_setrequest) && ValidOptionalValue(rpkt.msg.m.v_setrequest);\r\n requires NextSetRequest_Complete(s.hosts[id], s'.hosts[id], rpkt.src, rpkt.msg.seqno, rpkt.msg.m, sm, m, out, true);\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires InvRefinementNormalized(s);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n requires !DelegationPacket(s.hosts[id].receivedPacket);\r\n ensures if DelegateForKey(s.hosts[id].delegationMap, rpkt.msg.m.k_setrequest)==id\r\n then Set(HiddenRefinement(s), HiddenRefinement(s'), rpkt.msg.m.k_setrequest, rpkt.msg.m.v_setrequest)\r\n else HiddenRefinement(s)==HiddenRefinement(s');\r\n ensures InvRefinementNormalized(s');\r\n{\r\n var k := rpkt.msg.m.k_setrequest;\r\n var v := rpkt.msg.m.v_setrequest;\r\n var R := HiddenRefinement(s);\r\n var R' := HiddenRefinement(s');\r\n\r\n var sm,m,b :| NextSetRequest_Complete(s.hosts[id], s'.hosts[id], rpkt.src, rpkt.msg.seqno, rpkt.msg.m, sm, m, out, b);\r\n\r\n if(b) {\r\n if (DelegateForKey(s.hosts[id].delegationMap, k)==id)\r\n {\r\n reveal_HiddenRefinement();\r\n NormalizedReplace_PreservesNormalization(R,k,v);\r\n\r\n var NRR := NormalizedReplace(R,k,v);\r\n\r\n // This structure is carefully guarded due to trigger trouble.\r\n // The inner forall creates trigger trouble, but the lemma call\r\n // satisfies it before the triggers run away. The outer forall\r\n // hides the crazily-triggered forall, exposing only the nice\r\n // symbolic predicate term.\r\n forall () ensures HashTablesAgreeUpToNormalization(R', NRR);\r\n ensures HashtableIsNormalized(R');\r\n {\r\n forall ko ensures HashtableLookup(R',ko) == HashtableLookup(NRR, ko);\r\n {\r\n SetPreservesRefinement_ko(s, s', id, recv, out, rpkt, ko, sm, m);\r\n }\r\n forall ko ensures HashtableLookup(R',ko) == HashtableLookup(NRR, ko);\r\n {\r\n HashtableLookup_implies_HashtableLookup(R', NRR);\r\n }\r\n /*forall ko | ko in R' ensures R'[ko]!=[];\r\n {\r\n assert HashtableIsNormalized(NRR);\r\n assert HashtableLookup(R',ko) == HashtableLookup(NRR, ko);\r\n assert ko in NRR;\r\n }*/\r\n }\r\n\r\n reveal_HiddenInv();\r\n HashtableAgreement(R', NRR);\r\n } else {\r\n reveal_HiddenInv();\r\n NextInv_Set_NotADelegateStep(s, s', id, recv, out, rpkt);\r\n NondelegatingReadonlyStepPreservesRefinement(s, s', id, recv, out);\r\n reveal_HiddenRefinement();\r\n }\r\n } else {\r\n reveal_HiddenRefinement();\r\n reveal_HiddenInv();\r\n assert HiddenRefinement(s)==HiddenRefinement(s');\r\n }\r\n}\r\n\r\nlemma GetPreservesRefinement(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires id in AllHostIdentities(s);\r\n requires HiddenSHT_Next_and_SHT_NextPred(s, s', id, recv, out);\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.GetRequest? && NextGetRequest(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires InvRefinementNormalized(s);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n requires !DelegationPacket(s.hosts[id].receivedPacket);\r\n ensures if DelegateForKey(s.hosts[id].delegationMap, rpkt.msg.m.k_getrequest)==id\r\n then Get(HiddenRefinement(s), HiddenRefinement(s'), rpkt.msg.m.k_getrequest, HashtableLookup(s.hosts[id].h, rpkt.msg.m.k_getrequest))\r\n else HiddenRefinement(s)==HiddenRefinement(s');\r\n ensures InvRefinementNormalized(s');\r\n{\r\n reveal_HiddenInv();\r\n NextInv_Get_NotADelegateStep(s, s', id, recv, out, rpkt);\r\n NondelegatingReadonlyStepPreservesRefinement(s, s', id, recv, out);\r\n\r\n var k := rpkt.msg.m.k_getrequest;\r\n var v := HashtableLookup(s.hosts[id].h, rpkt.msg.m.k_getrequest);\r\n\r\n reveal_HiddenRefinement();\r\n assert HiddenRefinement(s)==HiddenRefinement(s');\r\n\r\n if (DelegateForKey(s.hosts[id].delegationMap, rpkt.msg.m.k_getrequest)==id)\r\n {\r\n LookupInRefinement(s, k);\r\n forall () ensures FindHashTable(s,k) == s.hosts[id].h;\r\n {\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert HostClaimsKey(s.hosts[id], k); // OBSERVE trigger\r\n assert NoInFlightPacketClaimsKey(s, k); // OBSERVE trigger\r\n }\r\n }\r\n}\r\n\r\nlemma NextDelegatePreservesRefinement_rpkt(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet, k:Key)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires id in AllHostIdentities(s);\r\n requires HiddenSHT_Next_and_SHT_NextPred(s, s', id, recv, out);\r\n requires Some(rpkt) == s.hosts[id].receivedPacket;\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.Delegate? && NextDelegate(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires InvRefinementNormalized(s);\r\n requires InFlightPacketClaimsKey(s,rpkt,k);\r\n ensures HashtableLookup(HiddenRefinement(s),k)\r\n == HashtableLookup(HiddenRefinement(s'),k);\r\n ensures k in HiddenRefinement(s') ==> HashtableLookup(HiddenRefinement(s'), k) != ValueAbsent();\r\n{\r\n forall () ensures InvConstants(s) && InvConstants(s') { reveal_HiddenInv(); }\r\n\r\n // Now s.hosts[id] claims key.\r\n assert HostClaimsKey(s'.hosts[id], k);\r\n forall () ensures EachKeyClaimedInExactlyOnePlace(s) && BufferedPacketsInv(s)\r\n && EachKeyClaimedInExactlyOnePlace(s') && BufferedPacketsInv(s');\r\n {\r\n reveal_HiddenInv();\r\n }\r\n\r\n calc {\r\n HashtableLookup(HiddenRefinement(s), k);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(Refinement(s).ht, k);\r\n { LookupInRefinement(s,k); }\r\n HashtableLookup(FindHashTable(s,k), k);\r\n { reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n PacketClaimsKey_forces_FindHashTable(s, rpkt, k); }\r\n HashtableLookup(rpkt.msg.m.h, k);\r\n }\r\n calc {\r\n HashtableLookup(rpkt.msg.m.h, k);\r\n {\r\n forall () ensures !HostClaimsKey(s.hosts[id], k);\r\n {\r\n reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert NoHostClaimsKey(s, k); // OBSERVE trigger\r\n }\r\n forall () ensures HostsStoreOnlyOwnedKeys(s);\r\n { reveal_HiddenInv(); }\r\n// if (k in BulkUpdateHashtable(s.hosts[id].h, rpkt.msg.m.h)) {\r\n// assert HostsStoreOnlyOwnedKeys(s);\r\n// assert !(k in s.hosts[id].h);\r\n// assert k in rpkt.msg.m.h;\r\n// assert rpkt.msg.m.h[k] == BulkUpdateHashtable(s.hosts[id].h, rpkt.msg.m.h)[k];\r\n// } else {\r\n// assert !(k in s.hosts[id].h);\r\n// }\r\n }\r\n HashtableLookup(BulkUpdateHashtable(s.hosts[id].h, rpkt.msg.m.range, rpkt.msg.m.h), k);\r\n HashtableLookup(s'.hosts[id].h, k);\r\n }\r\n assert !BufferedPacketClaimsKey(s'.hosts[id], k);\r\n calc {\r\n id;\r\n { reveal_HiddenInv(); reveal_EachKeyClaimedInExactlyOnePlace(); \r\n assert UniqueHostClaimsKey(s', k); assert OnlyOneHostClaimsKey(s',k); }\r\n TheHostThatClaimsKey(s', k);\r\n }\r\n calc {\r\n HashtableLookup(s'.hosts[id].h, k);\r\n HashtableLookup(FindHostHashTable(s',k), k);\r\n { reveal_HiddenInv();\r\n HostClaimsKey_forces_FindHashTable(s', id, k); }\r\n HashtableLookup(FindHashTable(s',k), k);\r\n { LookupInRefinement(s',k); }\r\n HashtableLookup(Refinement(s').ht, k);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(HiddenRefinement(s'), k);\r\n }\r\n forall () ensures DelegationMessagesCarryNoEmptyValues(s);\r\n { reveal_HiddenInv(); }\r\n assert k in rpkt.msg.m.h ==> HashtableLookup(rpkt.msg.m.h, k) != ValueAbsent(); // OBSERVE trigger\r\n}\r\n\r\nlemma NextDelegatePreservesRefinement_upkt(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet, k:Key, upkt:Packet)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires id in AllHostIdentities(s);\r\n requires HiddenSHT_Next_and_SHT_NextPred(s, s', id, recv, out);\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.Delegate? && NextDelegate(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires Some(rpkt) == s.hosts[id].receivedPacket;\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires InvRefinementNormalized(s);\r\n requires !InFlightPacketClaimsKey(s, rpkt, k);\r\n requires InFlightPacketClaimsKey(s, upkt, k);\r\n ensures HashtableLookup(HiddenRefinement(s),k)\r\n == HashtableLookup(HiddenRefinement(s'),k);\r\n ensures k in HiddenRefinement(s') ==> HashtableLookup(HiddenRefinement(s'), k) != ValueAbsent();\r\n{\r\n assert rpkt!=upkt;\r\n assert InFlightPacketClaimsKey(s', upkt, k);\r\n forall () ensures EachKeyClaimedInExactlyOnePlace(s) && BufferedPacketsInv(s)\r\n && EachKeyClaimedInExactlyOnePlace(s') && BufferedPacketsInv(s');\r\n {\r\n reveal_HiddenInv();\r\n }\r\n forall () ensures InvConstants(s) && InvConstants(s') { reveal_HiddenInv(); }\r\n calc {\r\n HashtableLookup(HiddenRefinement(s), k);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(Refinement(s).ht, k);\r\n { LookupInRefinement(s,k); }\r\n HashtableLookup(FindHashTable(s,k), k);\r\n { reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n PacketClaimsKey_forces_FindHashTable(s, upkt, k); }\r\n HashtableLookup(upkt.msg.m.h, k);\r\n }\r\n calc {\r\n HashtableLookup(upkt.msg.m.h, k);\r\n { reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n PacketClaimsKey_forces_FindHashTable(s', upkt, k); }\r\n HashtableLookup(FindHashTable(s',k), k);\r\n { LookupInRefinement(s',k); }\r\n HashtableLookup(Refinement(s').ht, k);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(HiddenRefinement(s'), k);\r\n }\r\n forall () ensures DelegationMessagesCarryNoEmptyValues(s);\r\n {\r\n reveal_HiddenInv();\r\n }\r\n assert k in upkt.msg.m.h ==> HashtableLookup(upkt.msg.m.h, k) != ValueAbsent();\r\n}\r\n\r\nlemma NextDelegatePreservesRefinement_host(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet, k:Key)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires id in AllHostIdentities(s);\r\n requires HiddenSHT_Next_and_SHT_NextPred(s, s', id, recv, out);\r\n requires Some(rpkt) == s.hosts[id].receivedPacket;\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.Delegate? && NextDelegate(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires Some(rpkt) == s.hosts[id].receivedPacket;\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires InvRefinementNormalized(s);\r\n requires !InFlightPacketClaimsKey(s, rpkt, k);\r\n requires !(UniqueInFlightPacketClaimsKey(s, k) && NoHostClaimsKey(s, k));\r\n ensures HashtableLookup(HiddenRefinement(s),k)\r\n == HashtableLookup(HiddenRefinement(s'),k);\r\n ensures k in HiddenRefinement(s') ==> HashtableLookup(HiddenRefinement(s'), k) != ValueAbsent();\r\n{\r\n forall ()\r\n ensures NoInFlightPacketClaimsKey(s, k) && UniqueHostClaimsKey(s, k);\r\n {\r\n reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n }\r\n forall () ensures EachKeyClaimedInExactlyOnePlace(s) && BufferedPacketsInv(s)\r\n && EachKeyClaimedInExactlyOnePlace(s') && BufferedPacketsInv(s');\r\n {\r\n reveal_HiddenInv();\r\n }\r\n forall () ensures InvConstants(s) && InvConstants(s') { reveal_HiddenInv(); }\r\n\r\n var kid :| kid in AllHostIdentities(s) && HostClaimsKey(s.hosts[kid], k);\r\n assert HostClaimsKey(s'.hosts[kid], k);\r\n calc {\r\n HashtableLookup(HiddenRefinement(s), k);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(Refinement(s).ht, k);\r\n { LookupInRefinement(s,k); }\r\n HashtableLookup(FindHashTable(s,k), k);\r\n { reveal_HiddenInv();\r\n HostClaimsKey_forces_FindHashTable(s, kid, k); }\r\n HashtableLookup(FindHostHashTable(s,k), k);\r\n }\r\n forall () ensures DelegationMessagesCarryOnlyClaimedKeys(s);\r\n { reveal_HiddenInv(); }\r\n\r\n if (kid==id && rpkt.src in AllHostIdentities(s)) {\r\n assert BulkUpdateHashtable(s.hosts[kid].h, rpkt.msg.m.range, rpkt.msg.m.h) == s'.hosts[kid].h; // OBSERVE trigger\r\n }\r\n// assert HashtableLookup(s.hosts[kid].h, k) == HashtableLookup(s'.hosts[kid].h, k);\r\n\r\n calc {\r\n HashtableLookup(FindHostHashTable(s',k), k);\r\n { reveal_HiddenInv();\r\n HostClaimsKey_forces_FindHashTable(s', kid, k); }\r\n HashtableLookup(FindHashTable(s',k), k);\r\n { LookupInRefinement(s',k); }\r\n HashtableLookup(Refinement(s').ht, k);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(HiddenRefinement(s'), k);\r\n }\r\n forall () ensures NoHostsStoreEmptyValues(s) {\r\n reveal_HiddenInv();\r\n }\r\n assert k in s.hosts[kid].h ==> HashtableLookup(s.hosts[kid].h, k) != ValueAbsent(); // OBSERVE trigger\r\n\r\n if kid == id {\r\n if BufferedPacketClaimsKey(s.hosts[kid], k) {\r\n calc {\r\n HashtableLookup(HiddenRefinement(s),k);\r\n HashtableLookup(FindHostHashTable(s,k), k);\r\n HashtableLookup(s.hosts[kid].receivedPacket.v.msg.m.h, k);\r\n HashtableLookup(s'.hosts[kid].h, k);\r\n HashtableLookup(HiddenRefinement(s'), k);\r\n }\r\n } else {\r\n calc {\r\n HashtableLookup(HiddenRefinement(s),k);\r\n HashtableLookup(s.hosts[kid].h, k);\r\n HashtableLookup(s'.hosts[kid].h, k);\r\n HashtableLookup(HiddenRefinement(s'), k);\r\n }\r\n }\r\n } else {\r\n calc {\r\n kid;\r\n { reveal_HiddenInv(); reveal_EachKeyClaimedInExactlyOnePlace(); \r\n assert UniqueHostClaimsKey(s', k); assert OnlyOneHostClaimsKey(s',k); }\r\n TheHostThatClaimsKey(s', k);\r\n }\r\n calc {\r\n HashtableLookup(HiddenRefinement(s),k);\r\n HashtableLookup(FindHostHashTable(s,k), k);\r\n HashtableLookup(FindHostHashTable(s',k), k);\r\n HashtableLookup(HiddenRefinement(s'), k);\r\n }\r\n }\r\n HashtableLookup_implies_HashtableLookup_one_key(HiddenRefinement(s), HiddenRefinement(s'), k);\r\n}\r\n\r\nlemma NextDelegatePreservesRefinement_k(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet, k:Key)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires id in AllHostIdentities(s);\r\n requires HiddenSHT_Next_and_SHT_NextPred(s, s', id, recv, out);\r\n requires Some(rpkt) == s.hosts[id].receivedPacket;\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.Delegate? && NextDelegate(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires InvRefinementNormalized(s);\r\n ensures HashtableLookup(HiddenRefinement(s),k)\r\n == HashtableLookup(HiddenRefinement(s'),k);\r\n ensures k in HiddenRefinement(s') ==> HashtableLookup(HiddenRefinement(s'), k) != ValueAbsent();\r\n{\r\n if (InFlightPacketClaimsKey(s,rpkt,k))\r\n {\r\n NextDelegatePreservesRefinement_rpkt(s, s', id, recv, out, rpkt, k);\r\n } else if (UniqueInFlightPacketClaimsKey(s, k) && NoHostClaimsKey(s, k)) {\r\n var upkt :| InFlightPacketClaimsKey(s, upkt, k);\r\n NextDelegatePreservesRefinement_upkt(s, s', id, recv, out, rpkt, k, upkt);\r\n } else {\r\n NextDelegatePreservesRefinement_host(s, s', id, recv, out, rpkt, k);\r\n }\r\n}\r\n\r\nlemma NextDelegatePreservesRefinement_main(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, rpkt:Packet)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires id in AllHostIdentities(s);\r\n requires HiddenSHT_Next_and_SHT_NextPred(s, s', id, recv, out);\r\n requires Some(rpkt) == s.hosts[id].receivedPacket;\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires rpkt in s.network && rpkt.msg.SingleMessage? && rpkt.msg.m.Delegate? && NextDelegate(s.hosts[id], s'.hosts[id], rpkt, out);\r\n requires InvRefinementNormalized(s);\r\n ensures HiddenRefinement(s)==HiddenRefinement(s');\r\n ensures InvRefinementNormalized(s');\r\n{\r\n var HR := HiddenRefinement(s);\r\n var HR' := HiddenRefinement(s');\r\n forall k\r\n ensures HashtableLookup(HR, k)\r\n == HashtableLookup(HR', k);\r\n ensures k in HR ==> HashtableLookup(HR, k) != ValueAbsent();\r\n ensures k in HR' ==> HashtableLookup(HR', k) != ValueAbsent();\r\n {\r\n NextDelegatePreservesRefinement_k(s, s', id, recv, out, rpkt, k);\r\n reveal_HiddenRefinement();\r\n }\r\n HashtableAgreement(HiddenRefinement(s), HiddenRefinement(s'));\r\n assert HashtableIsNormalized(HiddenRefinement(s')); // OBSERVE trigger\r\n reveal_HiddenRefinement();\r\n assert InvRefinementNormalized(s');\r\n}\r\n\r\nlemma NextShardPreservesRefinement_k(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, kr:KeyRange, recipient:NodeIdentity, sm:SingleMessage, k:Key, shouldSend:bool)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires id in AllHostIdentities(s);\r\n requires HiddenSHT_Next_and_SHT_NextPred(s, s', id, recv, out);\r\n requires NextShard(s.hosts[id], s'.hosts[id], out, kr, recipient, sm, shouldSend);\r\n requires !DelegationPacket(s.hosts[id].receivedPacket);\r\n requires !DelegationPacket(s'.hosts[id].receivedPacket);\r\n requires InvRefinementNormalized(s);\r\n ensures HashtableLookup(HiddenRefinement(s),k)\r\n == HashtableLookup(HiddenRefinement(s'),k);\r\n ensures k in HiddenRefinement(s') ==> HashtableLookup(HiddenRefinement(s'), k) != ValueAbsent();\r\n{\r\n forall () ensures NoHostsStoreEmptyValues(s);\r\n { reveal_HiddenInv(); }\r\n forall () ensures EachKeyClaimedInExactlyOnePlace(s) && BufferedPacketsInv(s)\r\n && EachKeyClaimedInExactlyOnePlace(s') && BufferedPacketsInv(s');\r\n {\r\n reveal_HiddenInv();\r\n }\r\n forall () ensures InvConstants(s) && InvConstants(s') { reveal_HiddenInv(); }\r\n\r\n if (HostClaimsKey(s.hosts[id], k)) {\r\n calc {\r\n id;\r\n { reveal_HiddenInv(); reveal_EachKeyClaimedInExactlyOnePlace(); \r\n assert UniqueHostClaimsKey(s, k); assert OnlyOneHostClaimsKey(s,k); }\r\n TheHostThatClaimsKey(s, k);\r\n }\r\n calc {\r\n HashtableLookup(HiddenRefinement(s),k);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(Refinement(s).ht, k);\r\n { LookupInRefinement(s,k); }\r\n HashtableLookup(FindHashTable(s,k), k);\r\n { reveal_HiddenInv();\r\n HostClaimsKey_forces_FindHashTable(s, id, k); }\r\n HashtableLookup(FindHostHashTable(s,k), k);\r\n HashtableLookup(s.hosts[id].h, k);\r\n }\r\n\r\n if DelegateForKey(s.hosts[id].delegationMap, k)==s.hosts[id].me {\r\n if (KeyRangeContains(kr, KeyPlus(k)))\r\n {\r\n var spkt := Packet(recipient, s.hosts[id].me, sm);\r\n assert k in s.hosts[id].h ==> HashtableLookup(s.hosts[id].h, k) != ValueAbsent();\r\n if shouldSend {\r\n calc {\r\n HashtableLookup(spkt.msg.m.h, k);\r\n { reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert ReceiverHasNotCanceledUnsentSeqno(s, spkt.dst, spkt.src, spkt.msg.seqno); // OBSERVE trigger\r\n assert InFlightPacketClaimsKey(s',spkt,k); // OBSERVE trigger\r\n PacketClaimsKey_forces_FindHashTable(s', spkt, k); }\r\n HashtableLookup(FindHashTable(s',k), k);\r\n { LookupInRefinement(s',k); }\r\n HashtableLookup(Refinement(s').ht, k);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(HiddenRefinement(s'), k);\r\n }\r\n } else {\r\n calc {\r\n HashtableLookup(HiddenRefinement(s), k);\r\n { reveal_HiddenRefinement(); LookupInRefinement(s,k); }\r\n HashtableLookup(FindHashTable(s, k), k);\r\n calc {\r\n FindHashTable(s, k);\r\n { reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert HostClaimsKey(s.hosts[id], k);\r\n assert HostClaimsKey(s'.hosts[id], k);\r\n assert NoInFlightPacketClaimsKey(s, k); // OBSERVE\r\n assert NoInFlightPacketClaimsKey(s', k); // OBSERVE (needed for the next two lines)\r\n assert !(exists pkt :: InFlightPacketClaimsKey(s,pkt,k));\r\n assert !(exists pkt :: InFlightPacketClaimsKey(s',pkt,k));\r\n }\r\n FindHashTable(s',k);\r\n }\r\n HashtableLookup(FindHashTable(s',k), k);\r\n { LookupInRefinement(s',k); }\r\n HashtableLookup(Refinement(s').ht, k);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(HiddenRefinement(s'), k);\r\n }\r\n }\r\n assert HashtableLookup(HiddenRefinement(s),k) == HashtableLookup(HiddenRefinement(s'),k);\r\n } else {\r\n assert HostClaimsKey(s'.hosts[id], k);\r\n forall pkt \r\n ensures !InFlightPacketClaimsKey(s',pkt,k);\r\n {\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n assert UniqueHostClaimsKey(s', k);\r\n assert NoInFlightPacketClaimsKey(s', k);\r\n assert !InFlightPacketClaimsKey(s', pkt, k);\r\n }\r\n assert !BufferedPacketClaimsKey(s'.hosts[id], k);\r\n calc {\r\n id;\r\n { reveal_HiddenInv(); reveal_EachKeyClaimedInExactlyOnePlace(); \r\n assert UniqueHostClaimsKey(s', k); assert OnlyOneHostClaimsKey(s',k); }\r\n TheHostThatClaimsKey(s', k);\r\n }\r\n calc {\r\n HashtableLookup(s'.hosts[id].h, k);\r\n HashtableLookup(FindHostHashTable(s',k), k);\r\n { reveal_HiddenInv();\r\n HostClaimsKey_forces_FindHashTable(s', id, k); }\r\n HashtableLookup(FindHashTable(s',k), k);\r\n { LookupInRefinement(s',k); }\r\n HashtableLookup(Refinement(s').ht, k);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(HiddenRefinement(s'), k);\r\n }\r\n assert HashtableLookup(s.hosts[id].h, k) == HashtableLookup(s'.hosts[id].h, k); // OBSERVE witness\r\n assert HashtableLookup(HiddenRefinement(s),k) == HashtableLookup(HiddenRefinement(s'),k);\r\n }\r\n assert HashtableLookup(HiddenRefinement(s),k) == HashtableLookup(HiddenRefinement(s'),k);\r\n } else {\r\n assert BufferedPacketClaimsKey(s.hosts[id], k);\r\n assert false;\r\n }\r\n } else if (UniqueInFlightPacketClaimsKey(s, k) && NoHostClaimsKey(s, k)) {\r\n var upkt :| InFlightPacketClaimsKey(s, upkt, k);\r\n calc {\r\n HashtableLookup(HiddenRefinement(s), k);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(Refinement(s).ht, k);\r\n { LookupInRefinement(s,k); }\r\n HashtableLookup(FindHashTable(s,k), k);\r\n { reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n PacketClaimsKey_forces_FindHashTable(s, upkt, k); }\r\n HashtableLookup(upkt.msg.m.h, k);\r\n }\r\n calc {\r\n HashtableLookup(upkt.msg.m.h, k);\r\n { reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n PacketClaimsKey_forces_FindHashTable(s', upkt, k); }\r\n HashtableLookup(FindHashTable(s',k), k);\r\n { LookupInRefinement(s',k); }\r\n HashtableLookup(Refinement(s').ht, k);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(HiddenRefinement(s'), k);\r\n }\r\n forall () ensures DelegationMessagesCarryNoEmptyValues(s);\r\n { reveal_HiddenInv(); }\r\n assert HashtableLookup(HiddenRefinement(s),k) == HashtableLookup(HiddenRefinement(s'),k);\r\n } else {\r\n forall () ensures UniqueHostClaimsKey(s, k);\r\n {\r\n reveal_HiddenInv();\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n }\r\n var kid :| kid in AllHostIdentities(s) && HostClaimsKey(s.hosts[kid], k);\r\n assert kid != id;\r\n\r\n calc {\r\n HashtableLookup(HiddenRefinement(s),k);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(Refinement(s).ht, k);\r\n { LookupInRefinement(s,k); }\r\n HashtableLookup(FindHashTable(s,k), k);\r\n { reveal_HiddenInv();\r\n HostClaimsKey_forces_FindHashTable(s, kid, k); }\r\n HashtableLookup(FindHostHashTable(s,k), k);\r\n //HashtableLookup(s.hosts[kid].h, k);\r\n }\r\n calc {\r\n //HashtableLookup(s'.hosts[kid].h, k);\r\n HashtableLookup(FindHostHashTable(s',k), k);\r\n { reveal_HiddenInv();\r\n HostClaimsKey_forces_FindHashTable(s', kid, k); }\r\n HashtableLookup(FindHashTable(s',k), k);\r\n { LookupInRefinement(s',k); }\r\n HashtableLookup(Refinement(s').ht, k);\r\n { reveal_HiddenRefinement(); }\r\n HashtableLookup(HiddenRefinement(s'), k);\r\n }\r\n assert HashtableLookup(HiddenRefinement(s),k) == HashtableLookup(HiddenRefinement(s'),k);\r\n }\r\n reveal_HiddenRefinement();\r\n}\r\n\r\n// I had to pull this forall out into a lonely method to avoid the\r\n// triggerstorm around the forall block, which doesn't admit explicit\r\n// triggers.\r\nlemma NextShardPreservesRefinement_JustAgreement(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, kr:KeyRange, recipient:NodeIdentity, sm:SingleMessage, shouldSend:bool)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires NoConfigChanged(s, s');\r\n requires id in AllHostIdentities(s);\r\n requires HiddenSHT_Next_and_SHT_NextPred(s, s', id, recv, out);\r\n requires NextShard(s.hosts[id], s'.hosts[id], out, kr, recipient, sm, shouldSend);\r\n requires !DelegationPacket(s.hosts[id].receivedPacket);\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires HiddenInvRefinementNormalized(s);\r\n ensures HashTablesAgreeUpToNormalization(HiddenRefinement(s), HiddenRefinement(s'));\r\n{\r\n forall k\r\n ensures HashtableLookup(HiddenRefinement(s), k)\r\n == HashtableLookup(HiddenRefinement(s'), k);\r\n {\r\n reveal_HiddenInvRefinementNormalized();\r\n reveal_HiddenSHT_Next_and_SHT_NextPred();\r\n NextShardPreservesRefinement_k(s, s', id, recv, out, kr, recipient, sm, k, shouldSend);\r\n }\r\n}\r\n\r\nlemma NextShardPreservesRefinement_main(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set, kr:KeyRange, recipient:NodeIdentity, sm:SingleMessage, shouldSend:bool)\r\n requires HiddenInv(s) && InvBasics(s);\r\n requires HiddenInv(s') && InvBasics(s');\r\n requires id in AllHostIdentities(s);\r\n requires HiddenSHT_Next_and_SHT_NextPred(s, s', id, recv, out);\r\n requires NoConfigChanged(s, s');\r\n requires NextShard(s.hosts[id], s'.hosts[id], out, kr, recipient, sm, shouldSend);\r\n requires !DelegationPacket(s.hosts[id].receivedPacket);\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires HiddenInvRefinementNormalized(s);\r\n ensures HiddenRefinement(s)==HiddenRefinement(s');\r\n ensures InvRefinementNormalized(s');\r\n{\r\n var HR := HiddenRefinement(s);\r\n var HR' := HiddenRefinement(s');\r\n\r\n NextShardPreservesRefinement_JustAgreement(s, s', id, recv, out, kr, recipient, sm, shouldSend);\r\n\r\n forall ensures HashtableIsNormalized(HR);\r\n {\r\n reveal_HiddenInvRefinementNormalized();\r\n reveal_HiddenRefinement();\r\n }\r\n\r\n forall k\r\n ensures k in HR' ==> HashtableLookup(HR', k) != ValueAbsent();\r\n {\r\n reveal_HiddenInvRefinementNormalized();\r\n reveal_HiddenSHT_Next_and_SHT_NextPred();\r\n NextShardPreservesRefinement_k(s, s', id, recv, out, kr, recipient, sm, k, shouldSend);\r\n reveal_HiddenRefinement();\r\n }\r\n assert HashtableIsNormalized(HiddenRefinement(s')); // OBSERVE trigger\r\n\r\n HashtableAgreement(HiddenRefinement(s), HiddenRefinement(s'));\r\n reveal_HiddenRefinement();\r\n assert InvRefinementNormalized(s');\r\n}\r\n\r\nlemma {:timeLimitMultiplier 12} Next_Process_Message_Refines(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires InvRefinementNormalized(s); \r\n requires ShouldProcessReceivedMessage(s.hosts[id]);\r\n requires s.hosts[id].receivedPacket.v in s.network;\r\n requires s'.hosts[id].receivedPacket.None?;\r\n requires Process_Message(s.hosts[id], s'.hosts[id], out);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n ensures Inv(s');\r\n ensures InvRefinementNormalized(s');\r\n ensures Service_Next(Refinement(s), Refinement(s'))\r\n || ServiceStutter(Refinement(s), Refinement(s'));\r\n{ \r\n NextInv(s, s');\r\n\r\n var R := Refinement(s);\r\n var R' := Refinement(s');\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n var rpkt := s.hosts[id].receivedPacket.v;\r\n\r\n reveal_HiddenInv();\r\n reveal_HiddenSHT_Next_and_SHT_NextPred();\r\n\r\n if NextGetRequest(h, h', rpkt, out) {\r\n var k := rpkt.msg.m.k_getrequest;\r\n GetPreservesRefinement(s, s', id, recv, out, rpkt);\r\n var v := HashtableLookup(h.h, k);\r\n \r\n var req := AppGetRequest(rpkt.msg.seqno, k);\r\n reveal_HiddenRefinement();\r\n var owner := DelegateForKey(h.delegationMap, k);\r\n //assume false;\r\n var sm:SingleMessage,m,b :| NextGetRequest_Reply(h, h', rpkt.src, rpkt.msg.seqno, k, sm, m, out, b);\r\n if(owner == h.me && b) {\r\n //assert Get(R.ht, R'.ht, k, v);\r\n //var reply := AppReply(rpkt.src, rpkt.msg.seqno, k, v);\r\n var p :| p in out;\r\n assert p in s'.network && p.msg.SingleMessage? && p.msg.m.Reply?;\r\n var reply := AppReply(p.msg.seqno, p.msg.m.k_reply, p.msg.m.v);\r\n assert reply in R'.replies;\r\n\r\n assert h'.receivedRequests[|h'.receivedRequests|-1] == req;\r\n assert h'.receivedRequests[.. |h'.receivedRequests|-1] == h.receivedRequests;\r\n assert R'.requests == R.requests + { req };\r\n assert R'.replies == R.replies + { reply };\r\n assert Service_Next_ServerExecutesRequest(Refinement(s), Refinement(s'), req, reply);\r\n assert Service_Next(Refinement(s), Refinement(s'));\r\n } else {\r\n //assert HashtableStutter(R.ht, R'.ht);\r\n assert Refinement(s).ht == Refinement(s').ht;\r\n assert Refinement(s).requests == Refinement(s').requests;\r\n assert Refinement(s).replies == Refinement(s').replies;\r\n assert ServiceStutter(Refinement(s), Refinement(s'));\r\n }\r\n //assert Refinement(s').requests == Refinement(s).requests + { req };\r\n } else if NextSetRequest(h, h', rpkt, out) {\r\n var sm:SingleMessage,m,b :| NextSetRequest_Complete(h, h', rpkt.src, rpkt.msg.seqno, rpkt.msg.m, sm, m, out, b);\r\n \r\n reveal_HiddenRefinement();\r\n var k := rpkt.msg.m.k_setrequest;\r\n var ov := rpkt.msg.m.v_setrequest;\r\n var v := HashtableLookup(h.h, k);\r\n var req := AppSetRequest(rpkt.msg.seqno, k, ov);\r\n var owner := DelegateForKey(h.delegationMap, k);\r\n \r\n if(owner == h.me && ValidKey(rpkt.msg.m.k_setrequest) && ValidOptionalValue(rpkt.msg.m.v_setrequest) && b) {\r\n SetPreservesRefinement_main(s, s', id, recv, out, rpkt, sm, m); \r\n var p :| p in out;\r\n assert p in s'.network && p.msg.SingleMessage? && p.msg.m.Reply?;\r\n var reply := AppReply(p.msg.seqno, p.msg.m.k_reply, p.msg.m.v);\r\n assert reply in R'.replies;\r\n\r\n forall r | r in R'.requests\r\n ensures r in R.requests + { req };\r\n {\r\n }\r\n forall r | r in R.requests + { req }\r\n ensures r in R'.requests;\r\n {\r\n assert h'.receivedRequests[|h'.receivedRequests|-1] == req;\r\n assert h'.receivedRequests[.. |h'.receivedRequests|-1] == h.receivedRequests;\r\n \r\n assert req in R'.requests;\r\n \r\n }\r\n assert R'.requests == R.requests + { req };\r\n assert Service_Next_ServerExecutesRequest(R, R', req, reply);\r\n assert Service_Next(Refinement(s), Refinement(s'));\r\n } else {\r\n assert NotADelegateStep(s, s');\r\n NondelegatingReadonlyStepPreservesRefinement(s, s', id, recv, out);\r\n assert Refinement(s).ht == Refinement(s').ht;\r\n assert Refinement(s).requests == Refinement(s').requests;\r\n assert Refinement(s).replies == Refinement(s').replies;\r\n assert ServiceStutter(Refinement(s), Refinement(s'));\r\n }\r\n } else if NextDelegate(h, h', rpkt, out) {\r\n //assume false;\r\n NextDelegatePreservesRefinement_main(s, s', id, recv, out, rpkt);\r\n reveal_HiddenRefinement();\r\n assert Refinement(s).ht == Refinement(s').ht;\r\n assert Refinement(s).requests == Refinement(s').requests;\r\n assert Refinement(s).replies == Refinement(s').replies;\r\n assert ServiceStutter(Refinement(s), Refinement(s'));\r\n assert ServiceStutter(R, R');\r\n } else if NextShard_Wrapper(h, h', rpkt, out) {\r\n reveal_HiddenInvRefinementNormalized();\r\n assert HiddenInvRefinementNormalized(s);\r\n reveal_HiddenRefinement();\r\n if ( rpkt.msg.m.recipient == h.me \r\n || !ValidKeyRange(rpkt.msg.m.kr)\r\n || !ValidPhysicalAddress(rpkt.msg.m.recipient)\r\n || EmptyKeyRange(rpkt.msg.m.kr)\r\n || rpkt.msg.m.recipient !in h.constants.hostIds\r\n || !DelegateForKeyRangeIsHost(h.delegationMap, rpkt.msg.m.kr, h.me) \r\n || |ExtractRange(h.h, rpkt.msg.m.kr)| >= max_hashtable_size()) {\r\n //assume false;\r\n NextInv_Process_Boring_Message(s, s', id, recv, out);\r\n NondelegatingReadonlyStepPreservesRefinement(s, s', id, recv, out);\r\n assert s.network == s'.network; // OBSERVE (extensionality?)\r\n assert HashtableStutter(R.ht, R'.ht);\r\n assert Refinement(s).requests == Refinement(s').requests;\r\n assert Refinement(s).replies == Refinement(s').replies;\r\n } else {\r\n var sm,b :| NextShard(h, h', out, rpkt.msg.m.kr, rpkt.msg.m.recipient, sm, b);\r\n NextShardPreservesRefinement_main(s, s', id, recv, out, rpkt.msg.m.kr, rpkt.msg.m.recipient, sm, b);\r\n assert HashtableStutter(R.ht, R'.ht);\r\n assert Refinement(s).requests == Refinement(s').requests;\r\n assert Refinement(s).replies == Refinement(s').replies;\r\n assert ServiceStutter(R, R');\r\n }\r\n } else if NextReply(h, h', rpkt, out) {\r\n NextInv_Process_Boring_Message(s, s', id, recv, out);\r\n NondelegatingReadonlyStepPreservesRefinement(s, s', id, recv, out);\r\n assert Inv(s');\r\n assert Refinement(s).requests == Refinement(s').requests;\r\n assert Refinement(s).replies == Refinement(s').replies;\r\n assert ServiceStutter(R, R');\r\n } else if NextRedirect(h, h', rpkt, out) {\r\n NextInv_Process_Boring_Message(s, s', id, recv, out);\r\n assert NotADelegateStep(s, s');\r\n NondelegatingReadonlyStepPreservesRefinement(s, s', id, recv, out);\r\n assert Inv(s');\r\n assert Refinement(s).requests == Refinement(s').requests;\r\n assert Refinement(s).replies == Refinement(s').replies;\r\n assert ServiceStutter(R, R');\r\n } else {\r\n assert false;\r\n }\r\n\r\n}\r\n\r\n/*\r\nlemma ReceiveBoringPacketRefines(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set) \r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires InvRefinementNormalized(s); \r\n requires ProcessReceivedPacket(s.hosts[id], s'.hosts[id], out);\r\n requires s.hosts[id].receivedPacket.Some?;\r\n requires !NewSingleMessage(s.hosts[id].sd, s.hosts[id].receivedPacket.v);\r\n ensures Inv(s');\r\n ensures InvRefinementNormalized(s');\r\n ensures HashtableNext(Refinement(s).ht, Refinement(s'))\r\n || HashtableStutter(Refinement(s).ht, Refinement(s'));\r\n{\r\n NextInv_ProcessReceivedPacket_BoringPacket(s, s', id, recv, out);\r\n\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n\r\n assert out == {};\r\n assert h' == h.(receivedPacket := None);\r\n\r\n reveal_HiddenInv();\r\n NondelegatingReadonlyStepPreservesRefinement(s, s', id, recv, out);\r\n}\r\n*/\r\n\r\nlemma {:timeLimitMultiplier 24} ReceivePacketRefines(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, rpkt:Packet, out:set, ack:Packet) \r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires InvRefinementNormalized(s); \r\n requires rpkt in recv;\r\n requires ReceivePacket(s.hosts[id], s'.hosts[id], rpkt, out, ack);\r\n ensures Inv(s');\r\n ensures InvRefinementNormalized(s');\r\n ensures Service_Next(Refinement(s), Refinement(s'))\r\n || ServiceStutter(Refinement(s), Refinement(s'));\r\n{\r\n NextInv_ReceivePacket(s, s', id, recv, rpkt, out, ack);\r\n\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n\r\n if h.receivedPacket.None? {\r\n assert ReceiveSingleMessage(h.sd, h'.sd, rpkt, ack, out);\r\n reveal_HiddenInv();\r\n if NewSingleMessage(h.sd, rpkt) {\r\n if NotADelegateStep(s, s') {\r\n NondelegatingReadonlyStepPreservesRefinement(s, s', id, recv, out);\r\n assert Refinement(s).requests == Refinement(s').requests;\r\n assert Refinement(s).replies == Refinement(s').replies;\r\n assert ServiceStutter(Refinement(s), Refinement(s'));\r\n } else {\r\n reveal_RefinedDomain();\r\n forall k \r\n ensures k in RefinedDomain(s') <==> k in RefinedDomain(s);\r\n ensures FindHashTable(s,k)[k] == FindHashTable(s',k)[k];\r\n {\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n if UniqueInFlightPacketClaimsKey(s, k) {\r\n assert FindHashTable(s,k) == ThePacketThatClaimsKey(s,k).msg.m.h;\r\n assert UniqueInFlightPacketClaimsKey(s', k) || UniqueHostClaimsKey(s', k);\r\n if UniqueInFlightPacketClaimsKey(s', k) {\r\n var pkt := UniquePacketClaimsKey_forces_FindHashTable(s, k);\r\n var pkt' := UniquePacketClaimsKey_forces_FindHashTable(s', k);\r\n assert PacketInFlight(s, pkt');\r\n assert InFlightPacketClaimsKey(s, pkt', k);\r\n assert pkt == pkt';\r\n calc {\r\n FindHashTable(s,k);\r\n pkt.msg.m.h;\r\n pkt'.msg.m.h;\r\n FindHashTable(s',k);\r\n }\r\n assert k in RefinedDomain(s') <==> k in RefinedDomain(s);\r\n } else {\r\n var pkt := UniquePacketClaimsKey_forces_FindHashTable(s, k);\r\n assert UniqueHostClaimsKey(s', k);\r\n var i := HostClaimsKey_forces_FindHostHashTable(s', k);\r\n assert i == TheHostThatClaimsKey(s', k);\r\n\r\n if DelegateForKey(h.delegationMap, k) == h.me {\r\n assert HostClaimsKey(h, k);\r\n assert SomeHostClaimsKey(s, k);\r\n assert NoHostClaimsKey(s, k);\r\n assert false;\r\n }\r\n assert DelegateForKey(h'.delegationMap, k) != h'.me;\r\n\r\n assert BufferedPacketClaimsKey(s'.hosts[i], k);\r\n assert PacketInFlight(s, rpkt);\r\n assert InFlightPacketClaimsKey(s, rpkt, k);\r\n assert pkt == rpkt;\r\n calc {\r\n FindHashTable(s',k);\r\n FindHostHashTable(s', k); \r\n s'.hosts[i].receivedPacket.v.msg.m.h;\r\n rpkt.msg.m.h;\r\n pkt.msg.m.h;\r\n FindHashTable(s,k);\r\n }\r\n assert k in RefinedDomain(s') <==> k in RefinedDomain(s);\r\n }\r\n assert k in RefinedDomain(s') <==> k in RefinedDomain(s);\r\n } else {\r\n assert NoInFlightPacketClaimsKey(s, k) && UniqueHostClaimsKey(s, k);\r\n if SomePacketClaimsKey(s', k) {\r\n var p :| InFlightPacketClaimsKey(s', p, k);\r\n assert InFlightPacketClaimsKey(s, p, k);\r\n assert false;\r\n }\r\n assert NoInFlightPacketClaimsKey(s', k) && UniqueHostClaimsKey(s', k);\r\n var i := HostClaimsKey_forces_FindHostHashTable(s , k);\r\n var i' := HostClaimsKey_forces_FindHostHashTable(s', k);\r\n if i == id {\r\n assert !BufferedPacketClaimsKey(s.hosts[i], k);\r\n if BufferedPacketClaimsKey(s'.hosts[i], k) {\r\n assert InFlightPacketClaimsKey(s, s'.hosts[i].receivedPacket.v, k);\r\n assert false;\r\n }\r\n }\r\n calc {\r\n FindHashTable(s',k);\r\n FindHostHashTable(s', k); \r\n { assert i == i'; }\r\n FindHostHashTable(s, k); \r\n FindHashTable(s,k);\r\n }\r\n assert k in RefinedDomain(s') <==> k in RefinedDomain(s);\r\n }\r\n\r\n }\r\n assert Refinement(s).ht == Refinement(s').ht;\r\n assert Refinement(s).requests == Refinement(s').requests;\r\n assert Refinement(s).replies == Refinement(s').replies;\r\n }\r\n } else {\r\n NondelegatingReadonlyStepPreservesRefinement(s, s', id, recv, out);\r\n assert Refinement(s).requests == Refinement(s').requests;\r\n assert Refinement(s).replies == Refinement(s').replies;\r\n assert ServiceStutter(Refinement(s), Refinement(s'));\r\n }\r\n } else {\r\n assert s.hosts == s'.hosts; // OBSERVE (extensionality)\r\n assert s.network == s'.network; // OBSERVE (extensionality?)\r\n assert s == s';\r\n }\r\n}\r\n\r\nlemma ProcessReceivedPacketRefines(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set) \r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires InvRefinementNormalized(s); \r\n requires ProcessReceivedPacket(s.hosts[id], s'.hosts[id], out);\r\n requires !SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n ensures Inv(s');\r\n ensures InvRefinementNormalized(s');\r\n ensures Service_Next(Refinement(s), Refinement(s'))\r\n || ServiceStutter(Refinement(s), Refinement(s'));\r\n{\r\n NextInv_ProcessReceivedPacket(s, s', id, recv, out);\r\n\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n\r\n if ShouldProcessReceivedMessage(h) {\r\n Next_Process_Message_Refines(s, s', id, recv, out);\r\n } else {\r\n assert s.hosts == s'.hosts; // OBSERVE (extensionality)\r\n assert s.network == s'.network; // OBSERVE (extensionality?)\r\n assert s == s';\r\n }\r\n}\r\n\r\nlemma RetransmitRefines(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set) \r\n requires Inv(s);\r\n requires SHT_MapsComplete(s);\r\n requires MapComplete(s');\r\n requires NoConfigChanged(s, s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires InvRefinementNormalized(s); \r\n requires SpontaneouslyRetransmit(s.hosts[id], s'.hosts[id], out);\r\n ensures Inv(s');\r\n ensures InvRefinementNormalized(s');\r\n ensures Service_Next(Refinement(s), Refinement(s'))\r\n || ServiceStutter(Refinement(s), Refinement(s'));\r\n{\r\n reveal_UnAckedListInNetwork();\r\n\r\n NextInv_SpontaneouslyRetransmit(s, s', id, recv, out);\r\n\r\n var R := Refinement(s);\r\n var R' := Refinement(s');\r\n\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n\r\n forall id',msg,dst | id' in AllHostIdentities(s)\r\n && msg in AckStateLookup(dst, s'.hosts[id'].sd.sendState).unAcked\r\n && NoAcksInUnAckedLists(s'.hosts[id'].sd)\r\n && dst == msg.dst\r\n ensures Packet(msg.dst, s'.hosts[id'].me, msg) in s'.network\r\n {\r\n var p := Packet(msg.dst, s'.hosts[id'].me, msg);\r\n if id' == id {\r\n assert msg in AckStateLookup(dst, s.hosts[id'].sd.sendState).unAcked;\r\n assert p in s'.network;\r\n } else {\r\n assert p in s'.network;\r\n }\r\n }\r\n\r\n assert forall id' :: id' in AllHostIdentities(s) ==> s.hosts[id'] == s'.hosts[id'];\r\n Lemma_EqualityConditionForMapsWithSameDomain(s.hosts, s'.hosts); // Proves the next line\r\n assert s.hosts == s'.hosts;\r\n forall p | p in out \r\n ensures p in s.network;\r\n {\r\n var dst, i :| dst in h.sd.sendState && 0 <= i < |h.sd.sendState[dst].unAcked| && h.sd.sendState[dst].unAcked[i].SingleMessage? && (var sm := h.sd.sendState[dst].unAcked[i]; p.dst == sm.dst && p.src == s.hosts[id].me && p.msg == sm); // Needed for the OBSERVE on the next line\r\n assert AckStateLookup(dst, h.sd.sendState) == h.sd.sendState[dst]; // OBSERVE\r\n assert UnAckedMsgForDst(h.sd, p.msg, p.dst); // OBSERVE\r\n }\r\n assert s.network == s'.network;\r\n assert s == s';\r\n\r\n assert HashtableStutter(R.ht, R'.ht);\r\n}\r\n\r\nlemma {:timeLimitMultiplier 2} NextPredRefines(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextPred(s, s', id, recv, out);\r\n requires InvRefinementNormalized(s);\r\n ensures Inv(s');\r\n ensures InvRefinementNormalized(s');\r\n ensures Service_Next(Refinement(s), Refinement(s'))\r\n || ServiceStutter(Refinement(s), Refinement(s'));\r\n{\r\n NextInv(s, s');\r\n\r\n var R := Refinement(s);\r\n var R' := Refinement(s');\r\n\r\n var h := s.hosts[id];\r\n var h' := s'.hosts[id];\r\n \r\n if (exists pkt, ack :: pkt in recv && ReceivePacket(h, h', pkt, out, ack)) {\r\n var pkt, ack :| pkt in recv && ReceivePacket(h, h', pkt, out, ack);\r\n ReceivePacketRefines(s, s', id, recv, pkt, out, ack);\r\n } else if SpontaneouslyRetransmit(h, h', out) {\r\n RetransmitRefines(s, s', id, recv, out);\r\n assert InvRefinementNormalized(s'); // OBSERVE trigger\r\n } else if ProcessReceivedPacket(h, h', out) {\r\n ProcessReceivedPacketRefines(s, s', id, recv, out);\r\n }\r\n}\r\n\r\nlemma {:timeLimitMultiplier 8} NextExternalRefines(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires SHT_NextExternal(s, s', id, recv, out);\r\n requires InvRefinementNormalized(s);\r\n ensures Inv(s');\r\n ensures InvRefinementNormalized(s');\r\n ensures ServiceStutter(Refinement(s), Refinement(s'));\r\n{\r\n NextInv(s, s');\r\n assert s.hosts == s'.hosts; // OBSERVE (extensionality)\r\n reveal_RefinedDomain();\r\n assert AllHashTables(s) == AllHashTables(s');\r\n forall h, k | h in AllHashTables(s)\r\n ensures FindHashTable(s,k) == FindHashTable(s',k);\r\n {\r\n reveal_EachKeyClaimedInExactlyOnePlace();\r\n if exists pkt :: InFlightPacketClaimsKey(s,pkt,k) {\r\n\r\n var pkt := UniquePacketClaimsKey_forces_FindHashTable(s, k);\r\n assert InFlightPacketClaimsKey(s',pkt,k);\r\n assert !NoInFlightPacketClaimsKey(s', k);\r\n var pkt' := UniquePacketClaimsKey_forces_FindHashTable(s', k);\r\n assert pkt == pkt';\r\n calc {\r\n FindHashTable(s,k);\r\n ThePacketThatClaimsKey(s,k).msg.m.h;\r\n ThePacketThatClaimsKey(s',k).msg.m.h;\r\n FindHashTable(s',k);\r\n }\r\n } else if exists id' :: id' in AllHostIdentities(s) && HostClaimsKey(s.hosts[id'], k) {\r\n var id' :| id' in AllHostIdentities(s) && HostClaimsKey(s.hosts[id'], k);\r\n assert id' in AllHostIdentities(s') && HostClaimsKey(s'.hosts[id'], k);\r\n\r\n var id_old := HostClaimsKey_forces_FindHostHashTable(s, k);\r\n var id_new := HostClaimsKey_forces_FindHostHashTable(s', k);\r\n \r\n assert UniqueHostClaimsKey(s', k);\r\n assert OnlyOneHostClaimsKey(s,k);\r\n assert OnlyOneHostClaimsKey(s',k);\r\n\r\n assert id_old == id_new;\r\n\r\n calc {\r\n FindHashTable(s,k);\r\n FindHostHashTable(s, k);\r\n FindHostHashTable(s', k);\r\n FindHashTable(s',k);\r\n }\r\n } else {\r\n assert UniqueInFlightPacketClaimsKey(s, k) || UniqueHostClaimsKey(s, k);\r\n assert SomePacketClaimsKey(s, k) || SomeHostClaimsKey(s, k);\r\n\r\n assert false;\r\n }\r\n }\r\n assert RefinedDomain(s) == RefinedDomain(s');\r\n assert forall k :: k in RefinedDomain(s') ==> FindHashTable(s,k) == FindHashTable(s',k);\r\n assert Refinement(s).ht == Refinement(s').ht;\r\n assert Refinement(s).requests == Refinement(s').requests;\r\n assert Refinement(s).replies == Refinement(s').replies;\r\n assert Inv(s');\r\n assert InvRefinementNormalized(s');\r\n assert ServiceStutter(Refinement(s), Refinement(s'));\r\n}\r\n\r\nlemma NextRefinesService(s:SHT_State, s':SHT_State)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n requires InvRefinementNormalized(s);\r\n ensures Inv(s');\r\n ensures InvRefinementNormalized(s');\r\n ensures Service_Next(Refinement(s), Refinement(s'))\r\n || ServiceStutter(Refinement(s), Refinement(s'));\r\n{\r\n NextInv(s, s');\r\n\r\n if (exists id, recv, out :: SHT_NextPred(s, s', id, recv, out)) {\r\n var id, recv, out :| SHT_NextPred(s, s', id, recv, out);\r\n NextPredRefines(s, s', id, recv, out);\r\n } else if (exists id, recv, out :: SHT_NextExternal(s, s', id, recv, out)) {\r\n var id, recv, out :| SHT_NextExternal(s, s', id, recv, out);\r\n NextExternalRefines(s, s', id, recv, out);\r\n } else {\r\n assert false; // There should be no other cases\r\n }\r\n}\r\n/*\r\npredicate RequestImpliesPacket(s:SHT_State)\r\n{\r\n forall id :: id in AllHostIdentities(s) ==> \r\n}\r\n\r\nlemma NextRefinesService(s:SHT_State, s':SHT_State)\r\n requires Inv(s);\r\n requires MapComplete(s');\r\n requires SHT_Next(s, s');\r\n\r\n*/\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/SHT/RefinementProof/SHT.i.dfy", "content": "include \"../Host.i.dfy\"\r\ninclude \"../Configuration.i.dfy\"\r\n\r\nmodule SHT__SHT_i {\r\nimport opened Collections__Maps2_s\r\nimport opened SHT__Host_i\r\nimport opened SHT__Configuration_i\r\nimport opened Concrete_NodeIdentity_i`Spec\r\nimport opened SHT__Network_i\r\n\r\ndatatype SHT_State = SHT_State(\r\n config:SHTConfiguration,\r\n network:Network,\r\n hosts:map)\r\n\r\npredicate SHT_MapsComplete(s:SHT_State)\r\n{\r\n (forall id {:auto_trigger} :: id in s.config.hostIds <==> id in s.hosts)\r\n}\r\n\r\npredicate SHT_Init(c:SHTConfiguration, s:SHT_State) {\r\n SHT_MapsComplete(s) \r\n && WFSHTConfiguration(c)\r\n && s.config == c\r\n && Network_Init(s.network)\r\n && (forall nodeIndex :: 0 <= nodeIndex < |s.config.hostIds| ==> var id := s.config.hostIds[nodeIndex]; \r\n Host_Init(s.hosts[id], id, s.config.rootIdentity, s.config.hostIds, s.config.params))\r\n}\r\n\r\npredicate SHT_NextPred(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires SHT_MapsComplete(s);\r\n requires SHT_MapsComplete(s');\r\n{\r\n id in s.config.hostIds\r\n && s'.config == s.config\r\n && Network_Receive(s.network, id, recv)\r\n && Host_Next(s.hosts[id], s'.hosts[id], recv, out)\r\n && Network_Send(s.network, s'.network, id, out)\r\n // All other hosts are unchanged \r\n && (forall oid {:auto_trigger} :: oid in s.config.hostIds && oid!=id ==> s'.hosts[oid]==s.hosts[oid])\r\n}\r\n\r\npredicate SHT_NextExternal(s:SHT_State, s':SHT_State, id:NodeIdentity, recv:set, out:set)\r\n requires SHT_MapsComplete(s);\r\n requires SHT_MapsComplete(s');\r\n{\r\n id !in s.config.hostIds\r\n && s'.config == s.config\r\n && Network_Send(s.network, s'.network, id, out)\r\n // Hosts are unchanged \r\n && s'.hosts == s.hosts\r\n}\r\n\r\npredicate SHT_Next(s:SHT_State, s':SHT_State)\r\n{\r\n SHT_MapsComplete(s)\r\n && SHT_MapsComplete(s')\r\n && s'.config == s.config\r\n && mapdomain(s'.hosts) == mapdomain(s.hosts)\r\n && ((exists id, recv, out :: SHT_NextPred(s, s', id, recv, out))\r\n ||(exists id, recv, out :: SHT_NextExternal(s, s', id, recv, out)))\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/SHT/SingleDelivery.i.dfy", "content": "include \"SingleMessage.i.dfy\"\r\ninclude \"Network.i.dfy\"\r\ninclude \"Parameters.i.dfy\"\r\n\r\nmodule SHT__SingleDelivery_i {\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened SHT__Message_i\r\nimport opened SHT__SingleMessage_i \r\nimport opened SHT__Network_i \r\nimport opened Protocol_Parameters_i\r\n\r\n// A module to ensure each message is delivered exactly once,\r\n// built by including sequence numbers in messages and recording\r\n// the highest received sequence number and the list of outstanding packets\r\n\r\n// Workaround for the fact that Dafny won't let us put nat into collection types, like TombstoneTable below\r\nnewtype nat_t = i:int | 0 <= i\r\n\r\n// Highest sequence number we have received from each node\r\ntype TombstoneTable = map\r\n\r\n// State about packets we've sent to each node\r\ndatatype AckState = AckState(numPacketsAcked:nat, unAcked:seq>)\r\ntype SendState = map>\r\n\r\ndatatype SingleDeliveryAcct = SingleDeliveryAcct(receiveState:TombstoneTable, sendState:SendState)\r\n\r\nfunction TombstoneTableLookup(src:NodeIdentity, t:TombstoneTable) : nat\r\n{\r\n if src in t then t[src] as int else 0 \r\n}\r\n\r\nfunction AckStateLookup(src:NodeIdentity, sendState:SendState):AckState\r\n{\r\n if src in sendState then sendState[src] else AckState(0, [])\r\n}\r\n\r\n// Written as a function to avoid an exists in the client\r\nfunction SingleDelivery_Init() : SingleDeliveryAcct\r\n{\r\n SingleDeliveryAcct(map[], map[])\r\n}\r\n\r\npredicate MessageNotReceived(s:SingleDeliveryAcct, src:NodeIdentity, sm:SingleMessage)\r\n{\r\n sm.SingleMessage? \r\n && sm.seqno > TombstoneTableLookup(src, s.receiveState)\r\n}\r\n\r\npredicate NewSingleMessage(s:SingleDeliveryAcct, pkt:Packet)\r\n{\r\n pkt.msg.SingleMessage? && \r\n var last_seqno := TombstoneTableLookup(pkt.src, s.receiveState);\r\n pkt.msg.seqno == last_seqno + 1\r\n}\r\n\r\n// Remove all packets implicitly ack'ed by seqnoAcked from the list of unacknowledged packets\r\nfunction TruncateUnAckList(unAcked:seq>, seqnoAcked:nat) : seq>\r\n ensures forall m :: m in TruncateUnAckList(unAcked, seqnoAcked) ==> m in unAcked;\r\n{\r\n if |unAcked| > 0 && unAcked[0].SingleMessage? && unAcked[0].seqno <= seqnoAcked then \r\n TruncateUnAckList(unAcked[1..], seqnoAcked)\r\n else \r\n unAcked\r\n}\r\n\r\npredicate ReceiveAck(s:SingleDeliveryAcct, s':SingleDeliveryAcct, pkt:Packet, acks:set)\r\n requires pkt.msg.Ack?;\r\n{\r\n acks == {} && // We don't ack acks\r\n var oldAckState := AckStateLookup(pkt.src, s.sendState);\r\n if pkt.msg.ack_seqno > oldAckState.numPacketsAcked then\r\n var newAckState := oldAckState.(numPacketsAcked := pkt.msg.ack_seqno,\r\n unAcked := TruncateUnAckList(oldAckState.unAcked, pkt.msg.ack_seqno));\r\n s' == s.(sendState := s.sendState[pkt.src := newAckState])\r\n else \r\n s' == s\r\n}\r\n\r\npredicate ShouldAckSingleMessage(s:SingleDeliveryAcct, pkt:Packet)\r\n{\r\n pkt.msg.SingleMessage? && // Don't want to ack acks\r\n var last_seqno := TombstoneTableLookup(pkt.src, s.receiveState);\r\n pkt.msg.seqno <= last_seqno\r\n}\r\n\r\npredicate SendAck(s:SingleDeliveryAcct, pkt:Packet, ack:Packet, acks:set) \r\n requires ShouldAckSingleMessage(s, pkt);\r\n{\r\n ack.msg.Ack? \r\n && ack.msg.ack_seqno == pkt.msg.seqno\r\n && ack.src == pkt.dst\r\n && ack.dst == pkt.src\r\n && acks == { ack }\r\n}\r\n\r\npredicate MaybeAckPacket(s:SingleDeliveryAcct, pkt:Packet, ack:Packet, acks:set) \r\n{\r\n if ShouldAckSingleMessage(s, pkt) then\r\n SendAck(s, pkt, ack, acks)\r\n else \r\n acks == {}\r\n}\r\n\r\npredicate ReceiveRealPacket(s:SingleDeliveryAcct, s':SingleDeliveryAcct, pkt:Packet)\r\n requires pkt.msg.SingleMessage?;\r\n{\r\n if NewSingleMessage(s, pkt) then\r\n var last_seqno := TombstoneTableLookup(pkt.src, s.receiveState);\r\n // Mark it received \r\n s' == s.(receiveState := s.receiveState[pkt.src := (last_seqno + 1) as nat_t])\r\n else\r\n s == s'\r\n}\r\n\r\npredicate UnAckedMsgForDst(s:SingleDeliveryAcct, msg:SingleMessage, dst:NodeIdentity)\r\n{\r\n dst in s.sendState && msg in s.sendState[dst].unAcked\r\n}\r\n\r\nfunction UnAckedMessages(s:SingleDeliveryAcct, src:NodeIdentity):set\r\n{\r\n set dst, i | dst in s.sendState && 0 <= i < |s.sendState[dst].unAcked| && s.sendState[dst].unAcked[i].SingleMessage? :: \r\n var sm := s.sendState[dst].unAcked[i];\r\n Packet(sm.dst, src, sm)\r\n}\r\n\r\n// Partial actions\r\n\r\n// Client should ReceiveSingleMessage or ReceiveNoMessage\r\npredicate ReceiveSingleMessage(s:SingleDeliveryAcct, s':SingleDeliveryAcct, pkt:Packet, ack:Packet, acks:set)\r\n{\r\n match pkt.msg {\r\n case Ack(_) => ReceiveAck(s, s', pkt, acks)\r\n case SingleMessage(seqno, _, m) => ReceiveRealPacket(s, s', pkt) && MaybeAckPacket(s', pkt, ack, acks)\r\n case InvalidMessage => (s' == s && acks == {})\r\n }\r\n}\r\n\r\npredicate ReceiveNoMessage(s:SingleDeliveryAcct, s':SingleDeliveryAcct)\r\n{\r\n s'.receiveState == s.receiveState\r\n}\r\n\r\n\r\n// Highest sequence number we've sent to dst\r\nfunction HighestSeqnoSent(s:SingleDeliveryAcct, dst:NodeIdentity) : nat\r\n{\r\n var ackState := AckStateLookup(dst, s.sendState); \r\n ackState.numPacketsAcked + |ackState.unAcked| \r\n}\r\n\r\n// Client should SendSingleMessage or SendNoMessage\r\npredicate SendSingleMessage(s:SingleDeliveryAcct, s':SingleDeliveryAcct, m:MT, sm:SingleMessage, params:Parameters, shouldSend:bool)\r\n{\r\n sm.SingleMessage? \r\n && sm.m == m\r\n && var oldAckState := AckStateLookup(sm.dst, s.sendState); \r\n var new_seqno := oldAckState.numPacketsAcked + |oldAckState.unAcked| + 1;\r\n if new_seqno > params.max_seqno then\r\n s' == s && !shouldSend // Packet shouldn't be sent if we exceed the maximum sequence number\r\n else\r\n (s' == s.(sendState := s.sendState[sm.dst := oldAckState.(unAcked := oldAckState.unAcked + [sm])])\r\n && sm.seqno == new_seqno\r\n && shouldSend)\r\n}\r\n\r\npredicate SendNoMessage(s:SingleDeliveryAcct, s':SingleDeliveryAcct)\r\n{\r\n s'.sendState == s.sendState // UNCHANGED\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Protocol/SHT/SingleMessage.i.dfy", "content": "include \"../Common/NodeIdentity.i.dfy\"\r\n\r\nmodule SHT__SingleMessage_i {\r\nimport opened Concrete_NodeIdentity_i`Spec\r\n\r\n// A type to ensure each message is delivered exactly once\r\n// Note that we send sequence numbers starting at 1\r\n\r\ndatatype SingleMessage = SingleMessage(seqno:nat, dst:NodeIdentity, m:MT) \r\n | Ack(ack_seqno:nat) // I got everything up to and including seqno\r\n | InvalidMessage()\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/Lock/.gitignore", "content": "Main.i.cs\nbuild/\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/Lock/AbstractService.s.dfy", "content": "include \"../../Common/Framework/AbstractService.s.dfy\"\r\n\r\nmodule AbstractServiceLock_s refines AbstractService_s {\r\nexport Spec\r\n provides Native__Io_s, Environment_s, Native__NativeTypes_s\r\n provides ServiceState \r\n provides Service_Init, Service_Next, Service_Correspondence\r\nexport All reveals *\r\n\r\ndatatype ServiceState' = ServiceState'(\r\n hosts:set,\r\n history:seq\r\n )\r\n\r\ntype ServiceState = ServiceState'\r\n\r\npredicate Service_Init(s:ServiceState, serverAddresses:set)\r\n{\r\n s.hosts == serverAddresses\r\n && (exists e :: e in serverAddresses && s.history == [e])\r\n}\r\n\r\npredicate Service_Next(s:ServiceState, s':ServiceState)\r\n{\r\n s'.hosts == s.hosts\r\n && (exists new_lock_holder :: \r\n new_lock_holder in s.hosts\r\n && s'.history == s.history + [new_lock_holder])\r\n}\r\n\r\nfunction Uint64ToBytes(u:uint64) : seq\r\n{\r\n [( u/0x1000000_00000000) as byte,\r\n ((u/ 0x10000_00000000)%0x100) as byte,\r\n ((u/ 0x100_00000000)%0x100) as byte,\r\n ((u/ 0x1_00000000)%0x100) as byte,\r\n ((u/ 0x1000000)%0x100) as byte,\r\n ((u/ 0x10000)%0x100) as byte,\r\n ((u/ 0x100)%0x100) as byte,\r\n ( u %0x100) as byte]\r\n}\r\n\r\nfunction MarshallLockMsg(epoch:int) : seq\r\n{\r\n if 0 <= epoch < 0x1_0000_0000_0000_0000 then\r\n [ 0, 0, 0, 0, 0, 0, 0, 1] // MarshallMesssage_Request magic number\r\n + Uint64ToBytes(epoch as uint64) \r\n else \r\n [ 1 ]\r\n}\r\n\r\npredicate Service_Correspondence(concretePkts:set>>, serviceState:ServiceState) \r\n{\r\n forall p, epoch :: \r\n p in concretePkts \r\n && p.src in serviceState.hosts \r\n && p.dst in serviceState.hosts \r\n && p.msg == MarshallLockMsg(epoch) \r\n ==>\r\n 1 <= epoch <= |serviceState.history|\r\n && p.src == serviceState.history[epoch-1]\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/Lock/LockDistributedSystem.i.dfy", "content": "include \"../../Impl/Lock/Host.i.dfy\"\ninclude \"../../Common/Framework/DistributedSystem.s.dfy\"\n\nmodule Lock_DistributedSystem_i refines DistributedSystem_s {\n\n import H_s = Host_i`All\n\n}\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/Lock/Main.i.dfy", "content": "include \"../../Common/Framework/Main.s.dfy\"\r\ninclude \"../../Common/Native/Io.s.dfy\"\r\ninclude \"LockDistributedSystem.i.dfy\"\r\ninclude \"../../Common/Framework/Environment.s.dfy\"\r\ninclude \"../../Protocol/Common/NodeIdentity.i.dfy\"\r\ninclude \"../../Impl/Lock/PacketParsing.i.dfy\"\r\ninclude \"../../Impl/Lock/NetLock.i.dfy\"\r\ninclude \"../../Impl/Lock/Host.i.dfy\"\r\ninclude \"AbstractService.s.dfy\"\r\ninclude \"../../Protocol/Lock/RefinementProof/Refinement.i.dfy\"\r\ninclude \"../../Protocol/Lock/RefinementProof/RefinementProof.i.dfy\"\r\ninclude \"Marshall.i.dfy\"\r\n\r\nmodule Main_i refines Main_s {\r\n import opened DS_s = Lock_DistributedSystem_i\r\n import opened Environment_s\r\n import opened Types_i\r\n import opened Concrete_NodeIdentity_i\r\n import opened PacketParsing_i\r\n import opened NetLock_i\r\n import opened AS_s = AbstractServiceLock_s`All\r\n import opened Protocol_Node_i\r\n import opened Refinement_i\r\n import opened RefinementProof_i\r\n import opened MarshallProof_i\r\n import opened DistributedSystem_i\r\n import opened DS_s.H_s\r\n import opened Common__Util_i\r\n import opened Common__GenericMarshalling_i\r\n import opened Message_i\r\n import opened Collections__Sets_i\r\n import opened Common__SeqIsUnique_i\r\n import opened Common__SeqIsUniqueDef_i\r\n import opened Impl_Node_i\r\n export\r\n provides DS_s, Native__Io_s, Native__NativeTypes_s\r\n provides IronfleetMain\r\n\r\n predicate IsValidBehavior(config:ConcreteConfiguration, db:seq)\r\n reads *;\r\n {\r\n |db| > 0\r\n && DS_Init(db[0], config)\r\n && forall i {:trigger DS_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> DS_Next(db[i], db[i+1])\r\n }\r\n\r\n predicate IsValidBehaviorLs(config:ConcreteConfiguration, db:seq)\r\n reads *;\r\n {\r\n |db| > 0\r\n && LS_Init(db[0], config)\r\n && forall i {:trigger LS_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> LS_Next(db[i], db[i+1])\r\n }\r\n\r\n function AbstractifyConcretePacket(p:LPacket>) : LPacket\r\n {\r\n LPacket(p.dst, p.src, AbstractifyCMessage(DemarshallData(p.msg)))\r\n }\r\n\r\n predicate LEnvStepIsAbstractable(step:LEnvStep>)\r\n {\r\n match step {\r\n case LEnvStepHostIos(actor, ios) => true\r\n case LEnvStepDeliverPacket(p) => true\r\n case LEnvStepAdvanceTime => true\r\n case LEnvStepStutter => true \r\n }\r\n }\r\n\r\n function AbstractifyConcreteEnvStep(step:LEnvStep>) : LEnvStep\r\n requires LEnvStepIsAbstractable(step);\r\n {\r\n match step {\r\n case LEnvStepHostIos(actor, ios) => LEnvStepHostIos(actor, AbstractifyRawLogToIos(ios))\r\n case LEnvStepDeliverPacket(p) => LEnvStepDeliverPacket(AbstractifyConcretePacket(p))\r\n case LEnvStepAdvanceTime => LEnvStepAdvanceTime()\r\n case LEnvStepStutter => LEnvStepStutter() \r\n }\r\n }\r\n\r\n predicate ConcreteEnvironmentIsAbstractable(ds_env:LEnvironment>)\r\n {\r\n LEnvStepIsAbstractable(ds_env.nextStep)\r\n }\r\n\r\n function AbstractifyConcreteSentPackets(sent:set>>) : set>\r\n {\r\n set p | p in sent :: AbstractifyConcretePacket(p)\r\n }\r\n\r\n function AbstractifyConcreteEnvironment(ds_env:LEnvironment>) : LEnvironment\r\n requires ConcreteEnvironmentIsAbstractable(ds_env);\r\n {\r\n LEnvironment(ds_env.time,\r\n AbstractifyConcreteSentPackets(ds_env.sentPackets),\r\n map [],\r\n AbstractifyConcreteEnvStep(ds_env.nextStep))\r\n }\r\n\r\n function {:opaque} AbstractifyConcreteReplicas(replicas:map, replica_order:seq) : map\r\n requires forall i :: 0 <= i < |replica_order| ==> replica_order[i] in replicas;\r\n requires SeqIsUnique(replica_order);\r\n ensures |AbstractifyConcreteReplicas(replicas, replica_order)| == |replica_order|;\r\n ensures forall i :: 0 <= i < |replica_order| ==> replica_order[i] in AbstractifyConcreteReplicas(replicas, replica_order);\r\n ensures forall i :: 0 <= i < |replica_order| ==> \r\n AbstractifyConcreteReplicas(replicas, replica_order)[replica_order[i]] == replicas[replica_order[i]].node;\r\n ensures forall e :: e in AbstractifyConcreteReplicas(replicas, replica_order) <==> e in replica_order;\r\n {\r\n if |replica_order| == 0 then map[]\r\n else\r\n lemma_UniqueSeq_SubSeqsUnique(replica_order, [replica_order[0]], replica_order[1..]);\r\n reveal_SeqIsUnique();\r\n assert SeqIsUnique(replica_order[1..]);\r\n assert replica_order[0] !in replica_order[1..];\r\n assert replica_order[0] !in AbstractifyConcreteReplicas(replicas, replica_order[1..]);\r\n \r\n var rest := AbstractifyConcreteReplicas(replicas, replica_order[1..]);\r\n rest[replica_order[0] := replicas[replica_order[0]].node]\r\n }\r\n\r\n predicate DsStateIsAbstractable(ds:DS_State) \r\n {\r\n ValidConfig(ds.config)\r\n && (forall r :: r in ds.config ==> r in ds.servers)\r\n }\r\n\r\n function AbstractifyDsState(ds:DS_State) : LS_State\r\n requires DsStateIsAbstractable(ds);\r\n {\r\n LS_State(AbstractifyConcreteEnvironment(ds.environment),\r\n AbstractifyConcreteReplicas(ds.servers, ds.config))\r\n }\r\n\r\n lemma lemma_DeduceTransitionFromDsBehavior(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int\r\n )\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db| - 1;\r\n ensures DS_Next(db[i], db[i+1]);\r\n {\r\n }\r\n \r\n lemma lemma_DsNextOffset(db:seq, index:int)\r\n requires |db| > 0;\r\n requires 0 < index < |db|;\r\n requires forall i {:trigger DS_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> DS_Next(db[i], db[i+1]);\r\n ensures DS_Next(db[index-1], db[index]);\r\n {\r\n var i := index - 1;\r\n assert DS_Next(db[i], db[i+1]); // OBSERVE trigger for the forall\r\n }\r\n\r\n lemma lemma_DsConsistency(config:ConcreteConfiguration, db:seq, i:int)\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db|;\r\n ensures db[i].config == config;\r\n ensures Collections__Maps2_s.mapdomain(db[i].servers) == Collections__Maps2_s.mapdomain(db[0].servers);\r\n {\r\n if i == 0 {\r\n } else {\r\n lemma_DsConsistency(config, db, i-1);\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n\r\n assert forall server :: server in db[i-1].servers ==> server in db[i].servers;\r\n assert forall server :: server in db[i].servers ==> server in db[i-1].servers;\r\n\r\n forall server | server in Collections__Maps2_s.mapdomain(db[i-1].servers)\r\n ensures server in Collections__Maps2_s.mapdomain(db[i].servers)\r\n {\r\n assert server in db[i-1].servers;\r\n assert server in db[i].servers;\r\n \r\n }\r\n\r\n forall server | server in Collections__Maps2_s.mapdomain(db[i].servers)\r\n ensures server in Collections__Maps2_s.mapdomain(db[i-1].servers)\r\n {\r\n assert server in db[i].servers;\r\n assert server in db[i-1].servers;\r\n }\r\n }\r\n }\r\n\r\n lemma lemma_IsValidEnvStep(de:LEnvironment>, le:LEnvironment)\r\n requires IsValidLEnvStep(de, de.nextStep);\r\n requires de.nextStep.LEnvStepHostIos?;\r\n requires ConcreteEnvironmentIsAbstractable(de);\r\n requires AbstractifyConcreteEnvironment(de) == le;\r\n ensures IsValidLEnvStep(le, le.nextStep);\r\n {\r\n var id := de.nextStep.actor;\r\n var ios := de.nextStep.ios;\r\n var r_ios := le.nextStep.ios;\r\n\r\n assert LIoOpSeqCompatibleWithReduction(r_ios);\r\n \r\n forall io | io in r_ios\r\n ensures IsValidLIoOp(io, id, le);\r\n {\r\n var j :| 0 <= j < |r_ios| && r_ios[j] == io;\r\n assert r_ios[j] == AstractifyNetEventToLockIo(ios[j]);\r\n assert IsValidLIoOp(ios[j], id, de);\r\n }\r\n }\r\n\r\n lemma lemma_IosRelations(ios:seq>>, r_ios:seq>)\r\n returns (sends:set>>, r_sends:set>) \r\n requires r_ios == AbstractifyRawLogToIos(ios);\r\n ensures sends == (set io | io in ios && io.LIoOpSend? :: io.s);\r\n ensures r_sends == (set io | io in r_ios && io.LIoOpSend? :: io.s);\r\n ensures r_sends == AbstractifyConcreteSentPackets(sends);\r\n {\r\n sends := (set io | io in ios && io.LIoOpSend? :: io.s);\r\n r_sends := (set io | io in r_ios && io.LIoOpSend? :: io.s);\r\n var refined_sends := AbstractifyConcreteSentPackets(sends);\r\n\r\n forall r | r in refined_sends\r\n ensures r in r_sends;\r\n {\r\n var send :| send in sends && AbstractifyConcretePacket(send) == r;\r\n var io :| io in ios && io.LIoOpSend? && io.s == send;\r\n assert AstractifyNetEventToLockIo(io) in r_ios;\r\n }\r\n\r\n forall r | r in r_sends\r\n ensures r in refined_sends;\r\n {\r\n var r_io :| r_io in r_ios && r_io.LIoOpSend? && r_io.s == r; \r\n var j :| 0 <= j < |r_ios| && r_ios[j] == r_io;\r\n assert AstractifyNetEventToLockIo(ios[j]) == r_io;\r\n assert ios[j] in ios;\r\n assert ios[j].s in sends;\r\n }\r\n }\r\n\r\n lemma lemma_LEnvironmentNextHost(de :LEnvironment>, le :LEnvironment,\r\n de':LEnvironment>, le':LEnvironment)\r\n requires ConcreteEnvironmentIsAbstractable(de);\r\n requires ConcreteEnvironmentIsAbstractable(de');\r\n requires AbstractifyConcreteEnvironment(de) == le;\r\n requires AbstractifyConcreteEnvironment(de') == le';\r\n requires de.nextStep.LEnvStepHostIos?;\r\n requires LEnvironment_Next(de, de');\r\n ensures LEnvironment_Next(le, le');\r\n {\r\n lemma_IsValidEnvStep(de, le);\r\n var id := de.nextStep.actor;\r\n var ios := de.nextStep.ios;\r\n var r_ios := le.nextStep.ios;\r\n\r\n assert LEnvironment_PerformIos(de, de', id, ios);\r\n\r\n var sends, r_sends := lemma_IosRelations(ios, r_ios);\r\n assert de.sentPackets + sends == de'.sentPackets;\r\n assert le.sentPackets + r_sends == le'.sentPackets;\r\n\r\n assert forall r_io :: r_io in r_ios && r_io.LIoOpReceive? ==> r_io.r in le.sentPackets;\r\n\r\n assert LEnvironment_PerformIos(le, le', id, r_ios);\r\n }\r\n\r\n lemma RefinementToLSStateHelper(ds:DS_State, ds':DS_State, ss:LS_State, ss':LS_State)\r\n requires DsStateIsAbstractable(ds)\r\n requires DsStateIsAbstractable(ds')\r\n requires ss == AbstractifyDsState(ds)\r\n requires ss' == AbstractifyDsState(ds')\r\n requires DS_Next(ds, ds')\r\n ensures LS_Next(ss, ss')\r\n {\r\n reveal_HostNext();\r\n if !ds.environment.nextStep.LEnvStepHostIos? {\r\n assert LS_Next(ss, ss');\r\n } else {\r\n lemma_LEnvironmentNextHost(ds.environment, ss.environment, ds'.environment, ss'.environment);\r\n assert LS_Next(ss, ss');\r\n }\r\n }\r\n\r\n lemma RefinementToLSState(config:ConcreteConfiguration, db:seq) returns (sb:seq)\r\n requires |db| > 0;\r\n requires DS_Init(db[0], config);\r\n requires forall i {:trigger DS_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> DS_Next(db[i], db[i+1]);\r\n ensures |sb| == |db|;\r\n ensures LS_Init(sb[0], db[0].config);\r\n ensures forall i {:trigger LS_Next(sb[i], sb[i+1])} :: 0 <= i < |sb| - 1 ==> LS_Next(sb[i], sb[i+1]);\r\n ensures forall i :: 0 <= i < |db| ==> DsStateIsAbstractable(db[i]) && sb[i] == AbstractifyDsState(db[i]);\r\n {\r\n if |db| == 1 {\r\n var ls := AbstractifyDsState(db[0]);\r\n sb := [ ls ];\r\n assert (forall id :: id in db[0].servers ==> HostInit(db[0].servers[id], config, id));\r\n reveal_SeqIsUnique();\r\n } else {\r\n lemma_DeduceTransitionFromDsBehavior(config, db, |db|-2);\r\n lemma_DsConsistency(config, db, |db|-2);\r\n var ls := AbstractifyDsState(db[|db|-2]);\r\n var ls' := AbstractifyDsState(last(db));\r\n var rest := RefinementToLSState(config, all_but_last(db));\r\n \r\n sb := rest + [ls'];\r\n forall i | 0 <= i < |sb| - 1 \r\n ensures LS_Next(sb[i], sb[i+1]);\r\n {\r\n if (0 <= i < |sb|-2) {\r\n assert LS_Next(sb[i], sb[i+1]);\r\n } else {\r\n RefinementToLSStateHelper(db[i], db[i+1], sb[i], sb[i+1]);\r\n }\r\n }\r\n }\r\n }\r\n\r\n lemma lemma_DeduceTransitionFromLsBehavior(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int\r\n )\r\n requires IsValidBehaviorLs(config, db);\r\n requires 0 <= i < |db| - 1;\r\n ensures LS_Next(db[i], db[i+1]);\r\n {\r\n }\r\n\r\n lemma lemma_LsConsistency(config:ConcreteConfiguration, lb:seq, i:int)\r\n requires IsValidBehaviorLs(config, lb);\r\n requires 0 <= i < |lb|;\r\n ensures Collections__Maps2_s.mapdomain(lb[i].servers) == Collections__Maps2_s.mapdomain(lb[0].servers);\r\n ensures forall e :: e in lb[i].servers ==> e in lb[0].servers && lb[i].servers[e].config == lb[0].servers[e].config;\r\n {\r\n if i == 0 {\r\n } else {\r\n lemma_LsConsistency(config, lb, i-1);\r\n lemma_DeduceTransitionFromLsBehavior(config, lb, i-1);\r\n\r\n assert forall server :: server in lb[i-1].servers ==> server in lb[i].servers;\r\n assert forall server :: server in lb[i].servers ==> server in lb[i-1].servers;\r\n\r\n forall server | server in Collections__Maps2_s.mapdomain(lb[i-1].servers)\r\n ensures server in Collections__Maps2_s.mapdomain(lb[i].servers)\r\n {\r\n assert server in lb[i-1].servers;\r\n assert server in lb[i].servers;\r\n }\r\n\r\n forall server | server in Collections__Maps2_s.mapdomain(lb[i].servers)\r\n ensures server in Collections__Maps2_s.mapdomain(lb[i-1].servers)\r\n {\r\n assert server in lb[i].servers;\r\n assert server in lb[i-1].servers;\r\n }\r\n }\r\n }\r\n lemma {:timeLimitMultiplier 2} MakeGLSBehaviorFromLS(config:ConcreteConfiguration, db:seq) returns (sb:seq)\r\n requires |db| > 0;\r\n requires LS_Init(db[0], config);\r\n requires forall i {:trigger LS_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> LS_Next(db[i], db[i+1]);\r\n ensures |sb| == |db|;\r\n ensures GLS_Init(sb[0], config);\r\n ensures forall i {:trigger GLS_Next(sb[i], sb[i+1])} :: 0 <= i < |sb| - 1 ==> GLS_Next(sb[i], sb[i+1]);\r\n ensures forall i :: 0 <= i < |db| ==> sb[i].ls == db[i];\r\n {\r\n if (|db| == 1) {\r\n sb := [GLS_State(db[0], [config[0]])];\r\n } else {\r\n var rest := MakeGLSBehaviorFromLS(config, all_but_last(db));\r\n var last_history := last(rest).history;\r\n var ls := db[|db|-2];\r\n var ls' := db[|db|-1];\r\n if ls.environment.nextStep.LEnvStepHostIos? && ls.environment.nextStep.actor in ls.servers {\r\n var id := ls.environment.nextStep.actor;\r\n var ios := ls.environment.nextStep.ios;\r\n lemma_DeduceTransitionFromLsBehavior(config, db, |db|-2);\r\n assert LS_Next(ls, ls');\r\n assert LS_NextOneServer(ls, ls', id, ios);\r\n var node := ls.servers[id];\r\n var node' := ls'.servers[id];\r\n assert NodeNext(node, node', ios);\r\n var new_history:seq;\r\n if NodeGrant(node, node', ios) && node.held && node.epoch < 0xFFFF_FFFF_FFFF_FFFF{\r\n new_history := last_history + [node.config[(node.my_index+1) % |node.config|]];\r\n } else {\r\n new_history := last_history;\r\n }\r\n sb := rest + [GLS_State(db[|db|-1], new_history)];\r\n assert GLS_Next(sb[|sb|-2], sb[|sb|-1]);\r\n } else {\r\n \r\n sb := rest + [GLS_State(db[|db|-1], last_history)];\r\n }\r\n }\r\n }\r\n\r\n lemma {:timeLimitMultiplier 2} RefinementToServiceState(config:ConcreteConfiguration, glb:seq) returns (sb:seq)\r\n requires |glb| > 0;\r\n requires GLS_Init(glb[0], config);\r\n requires forall i {:trigger GLS_Next(glb[i], glb[i+1])} :: 0 <= i < |glb| - 1 ==> GLS_Next(glb[i], glb[i+1]);\r\n ensures |sb| == |glb|;\r\n ensures Service_Init(sb[0], MapSeqToSet(config, x=>x));\r\n ensures forall i {:trigger Service_Next(sb[i], sb[i+1])} :: 0 <= i < |sb| - 1 ==> sb[i] == sb[i+1] || Service_Next(sb[i], sb[i+1]);\r\n ensures forall i :: 0 <= i < |glb| ==> sb[i] == AbstractifyGLS_State(glb[i]);\r\n ensures forall i :: 0 <= i < |sb| ==> sb[i].hosts == sb[0].hosts;\r\n ensures sb[|sb|-1] == AbstractifyGLS_State(glb[|glb|-1]);\r\n {\r\n if |glb| == 1 {\r\n sb := [AbstractifyGLS_State(glb[0])];\r\n lemma_InitRefines(glb[0], config);\r\n assert Service_Init(AbstractifyGLS_State(glb[0]), MapSeqToSet(config, x=>x));\r\n } else {\r\n var rest := RefinementToServiceState(config, all_but_last(glb));\r\n var gls := last(all_but_last(glb));\r\n var gls' := last(glb);\r\n\r\n lemma_LS_NextAbstract(glb, config, |glb|-2);\r\n sb := rest + [AbstractifyGLS_State(gls')];\r\n if (AbstractifyGLS_State(gls) == AbstractifyGLS_State(gls')) {\r\n assert sb[|sb|-2] == sb[|sb|-1];\r\n } else {\r\n assert Service_Next(sb[|sb|-2], sb[|sb|-1]);\r\n }\r\n }\r\n }\r\n\r\n lemma lemma_LockedPacketImpliesTransferPacket(\r\n config:ConcreteConfiguration,\r\n lb:seq,\r\n i:int,\r\n p:LockPacket\r\n )\r\n requires IsValidBehaviorLs(config, lb);\r\n requires 0 <= i < |lb|;\r\n requires p in lb[i].environment.sentPackets;\r\n requires p.src in lb[i].servers;\r\n requires p.msg.Locked?;\r\n ensures exists q :: q in lb[i].environment.sentPackets\r\n && q.msg.Transfer?\r\n && q.src in lb[i].servers\r\n && q.msg.transfer_epoch == p.msg.locked_epoch\r\n && q.dst == p.src;\r\n {\r\n if i == 0 {\r\n return;\r\n }\r\n lemma_DeduceTransitionFromLsBehavior(config, lb, i-1);\r\n lemma_LsConsistency(config, lb, i);\r\n assert Collections__Maps2_s.mapdomain(lb[i].servers) == Collections__Maps2_s.mapdomain(lb[0].servers);\r\n assert LS_Init(lb[0], config);\r\n \r\n if p in lb[i-1].environment.sentPackets {\r\n lemma_LockedPacketImpliesTransferPacket(config, lb, i-1, p);\r\n } else {\r\n var s := lb[i-1];\r\n var s' := lb[i];\r\n assert LS_Next(lb[i-1], lb[i]);\r\n if s.environment.nextStep.LEnvStepHostIos? && s.environment.nextStep.actor in s.servers {\r\n assert LS_NextOneServer(s, s', s.environment.nextStep.actor, s.environment.nextStep.ios);\r\n var id := s.environment.nextStep.actor;\r\n var node := s.servers[id];\r\n var node' := s'.servers[id];\r\n var ios := s.environment.nextStep.ios;\r\n if NodeAccept(node, node', ios) {\r\n var packet := ios[0].r;\r\n assert IsValidLIoOp(ios[0], id, s.environment);\r\n assert packet in lb[i].environment.sentPackets\r\n && packet.msg.Transfer?\r\n && packet.msg.transfer_epoch == p.msg.locked_epoch\r\n && packet.dst == p.src\r\n && packet.src in node.config;\r\n \r\n assert node.config == lb[0].servers[id].config == lb[i].servers[id].config;\r\n assert forall e :: e in lb[i].servers[id].config <==> e in Collections__Maps2_s.mapdomain(lb[i].servers);\r\n assert packet.src in lb[i].servers;\r\n }\r\n }\r\n }\r\n }\r\n\r\n lemma lemma_PacketSentByServerIsDemarshallable(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n p:LPacket>\r\n )\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db|;\r\n requires p.src in config;\r\n requires p in db[i].environment.sentPackets;\r\n ensures Demarshallable(p.msg, CMessageGrammar());\r\n {\r\n if i == 0 {\r\n return;\r\n }\r\n\r\n if p in db[i-1].environment.sentPackets {\r\n lemma_PacketSentByServerIsDemarshallable(config, db, i-1, p);\r\n return;\r\n }\r\n\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n lemma_DsConsistency(config, db, i-1);\r\n reveal_HostNext();\r\n }\r\n\r\n lemma RefinementProof(config:DS_s.H_s.ConcreteConfiguration, db:seq) returns (sb:seq)\r\n /*\r\n requires |db| > 0;\r\n requires DS_Init(db[0], config);\r\n requires forall i {:trigger DS_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> DS_Next(db[i], db[i+1]);\r\n ensures |db| == |sb|;\r\n ensures Service_Init(sb[0], Collections__Maps2_s.mapdomain(db[0].servers));\r\n ensures forall i {:trigger Service_Next(sb[i], sb[i+1])} :: 0 <= i < |sb| - 1 ==> sb[i] == sb[i+1] || Service_Next(sb[i], sb[i+1]);\r\n ensures forall i :: 0 <= i < |db| ==> Service_Correspondence(db[i].environment.sentPackets, sb[i]);\r\n */\r\n {\r\n var lsb := RefinementToLSState(config, db);\r\n var glsb := MakeGLSBehaviorFromLS(config, lsb);\r\n sb := RefinementToServiceState(config, glsb);\r\n //assert forall i :: 0 <= i < |sb| - 1 ==> Service_Next(sb[i], sb[i+1]);\r\n \r\n forall i | 0 <= i < |db|\r\n ensures Service_Correspondence(db[i].environment.sentPackets, sb[i]);\r\n {\r\n var ls := lsb[i];\r\n var gls := glsb[i];\r\n var ss := sb[i];\r\n var history := MakeLockHistory(glsb, config, i);\r\n assert history == gls.history;\r\n forall p, epoch | \r\n p in db[i].environment.sentPackets \r\n && p.src in ss.hosts \r\n && p.dst in ss.hosts \r\n && p.msg == MarshallLockMsg(epoch) \r\n ensures 2 <= epoch <= |ss.history|\r\n && p.src == ss.history[epoch-1];\r\n {\r\n var ap := AbstractifyConcretePacket(p);\r\n assert p.src in sb[0].hosts;\r\n lemma_PacketSentByServerIsDemarshallable(config, db, i, p);\r\n assert Demarshallable(p.msg, CMessageGrammar());\r\n lemma_ParseMarshallLockedAbstract(p.msg, epoch, ap.msg);\r\n lemma_LockedPacketImpliesTransferPacket(config, lsb, i, ap);\r\n var q :| q in ls.environment.sentPackets\r\n && q.msg.Transfer?\r\n && q.msg.transfer_epoch == ap.msg.locked_epoch\r\n && q.dst == p.src;\r\n assert q in gls.ls.environment.sentPackets;\r\n }\r\n }\r\n }\r\n \r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/Lock/Marshall.i.dfy", "content": "include \"AbstractService.s.dfy\"\r\ninclude \"../../Protocol/Lock/Types.i.dfy\"\r\ninclude \"../../Impl/Lock/PacketParsing.i.dfy\"\r\n\r\nmodule MarshallProof_i {\r\nimport opened Native__NativeTypes_s\r\n import opened AbstractServiceLock_s`All\r\n import opened Types_i \r\n import opened Math__power2_i\r\n import opened Common__Util_i\r\n import opened Common__GenericMarshalling_i\r\n import opened Message_i\r\n import opened PacketParsing_i\r\n\r\n lemma lemma_ParseValCorrectVCase(data:seq, v:V, g:G) returns (caseId:uint64, val:V, rest:seq)\r\n requires ValInGrammar(v, g);\r\n requires |data| < 0x1_0000_0000_0000_0000;\r\n requires ValidGrammar(g);\r\n requires parse_Val(data, g).0.Some?;\r\n requires parse_Val(data, g).0.v == v;\r\n requires g.GTaggedUnion?;\r\n ensures parse_Uint64(data).0.Some?;\r\n ensures caseId == parse_Uint64(data).0.v.u;\r\n ensures 0 <= caseId as int < |g.cases|;\r\n ensures rest == parse_Uint64(data).1;\r\n ensures parse_Val(rest, g.cases[caseId]).0.Some?;\r\n ensures val == parse_Val(rest, g.cases[caseId]).0.v\r\n ensures v == VCase(caseId, val);\r\n ensures ValInGrammar(val, g.cases[caseId]);\r\n {\r\n reveal_parse_Val();\r\n caseId := parse_Uint64(data).0.v.u;\r\n var tuple := parse_Val(parse_Uint64(data).1, g.cases[caseId]);\r\n val := tuple.0.v;\r\n rest := parse_Uint64(data).1;\r\n }\r\n\r\n lemma lemma_ParseValCorrectVUint64(data:seq, v:V, g:G) returns (u:uint64, rest:seq)\r\n requires ValInGrammar(v, g);\r\n requires |data| < 0x1_0000_0000_0000_0000;\r\n requires ValidGrammar(g);\r\n requires parse_Val(data, g).0.Some?;\r\n requires parse_Val(data, g).0.v == v;\r\n requires g.GUint64?;\r\n ensures parse_Uint64(data).0.Some?;\r\n ensures u == parse_Uint64(data).0.v.u;\r\n ensures v == VUint64(u);\r\n ensures rest == parse_Val(data, g).1;\r\n {\r\n reveal_parse_Val();\r\n u := parse_Uint64(data).0.v.u;\r\n rest := parse_Uint64(data).1;\r\n }\r\n\r\n lemma lemma_SizeOfCMessageLocked(v:V)\r\n requires ValInGrammar(v, CMessageGrammar());\r\n requires ValInGrammar(v.val, CMessageLockedGrammar());\r\n ensures SizeOfV(v) == 16;\r\n {\r\n }\r\n\r\n lemma lemma_ParseMarshallLockedAbstract(bytes:seq, epoch:int, msg:LockMessage)\r\n requires AbstractifyCMessage(DemarshallData(bytes)) == msg;\r\n requires bytes == MarshallLockMsg(epoch);\r\n requires Demarshallable(bytes, CMessageGrammar());\r\n ensures msg.Locked?;\r\n ensures msg.locked_epoch == epoch;\r\n {\r\n var marshalled_bytes := MarshallLockMsg(epoch);\r\n var g := CMessageGrammar();\r\n if 0 <= epoch < 0x1_0000_0000_0000_0000 {\r\n var cmsg := DemarshallData(bytes);\r\n var data := bytes;\r\n var v := DemarshallFunc(data, g);\r\n\r\n // Walk through the generic parsing process\r\n var msgCaseId, msgCaseVal, rest0 := lemma_ParseValCorrectVCase(data, v, g);\r\n\r\n // Prove that the first 8 bytes are correct\r\n assert msgCaseId == 1;\r\n assert 1 == SeqByteToUint64(bytes[..8]);\r\n assert bytes[..8] == [ 0, 0, 0, 0, 0, 0, 0, 1];\r\n\r\n // Prove that the next 8 bytes of seqno are correct\r\n var u, rest := lemma_ParseValCorrectVUint64(rest0, msgCaseVal, GUint64);\r\n lemma_2toX();\r\n calc {\r\n u;\r\n parse_Uint64(rest0).0.v.u;\r\n SeqByteToUint64(rest0[..8]);\r\n SeqByteToUint64(Uint64ToBytes(epoch as uint64));\r\n SeqByteToUint64(Uint64ToSeqByte(epoch as uint64));\r\n SeqByteToUint64(BEUintToSeqByte(epoch as uint64 as int, 8));\r\n { lemma_BEByteSeqToInt_BEUintToSeqByte_invertability(); }\r\n epoch as uint64;\r\n }\r\n assert msg.locked_epoch == u as int;\r\n assert epoch == msg.locked_epoch;\r\n } else {\r\n reveal_parse_Val();\r\n assert false;\r\n }\r\n }\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/RSL/.gitignore", "content": "Main.i.cs\nbuild/\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/RSL/AbstractService.s.dfy", "content": "/////////////////////////////////////////////////////////////////////////////\r\n//\r\n// This is the specification for an abstract service that implements an\r\n// application-defined state machine. It provides linearizability of\r\n// state-machine operations requested by clients. That is, each operation\r\n// the service executes appears to occur atomically, at a point after it\r\n// was submitted by the client and before the service sent its response.\r\n//\r\n// Note that the specification does not require exactly-once semantics.\r\n// If one needs exactly-once semantics, one should enforce that in the\r\n// application state machine. For instance, the state machine could keep\r\n// track of the highest request sequence number seen from each client, and\r\n// treat requests with older sequence numbers as no-ops.\r\n//\r\n/////////////////////////////////////////////////////////////////////////////\r\n\r\ninclude \"../../Common/Framework/AbstractService.s.dfy\"\r\ninclude \"../../Common/Collections/Seqs.s.dfy\"\r\ninclude \"AppStateMachine.s.dfy\"\r\n\r\nmodule AbstractServiceRSL_s refines AbstractService_s {\r\nimport opened AppStateMachine_s\r\nimport opened Collections__Seqs_s\r\n \r\ndatatype AppRequestMessage = AppRequestMessage(client:EndPoint, seqno:int, request:AppRequest)\r\ndatatype AppReplyMessage = AppReplyMessage(client:EndPoint, seqno:int, reply:AppReply)\r\n\r\ndatatype ServiceState' = ServiceState'(\r\n serverAddresses:set,\r\n app:AppState,\r\n requests:set,\r\n replies:set\r\n )\r\n\r\ntype ServiceState = ServiceState'\r\n\r\npredicate Service_Init(s:ServiceState, serverAddresses:set)\r\n{\r\n && s.serverAddresses == serverAddresses\r\n && s.app == AppInitialize()\r\n && s.requests == {}\r\n && s.replies == {}\r\n}\r\n\r\npredicate ServiceExecutesAppRequest(s:ServiceState, s':ServiceState, req:AppRequestMessage)\r\n{\r\n && |req.request| <= MaxAppRequestSize()\r\n && s'.serverAddresses == s.serverAddresses\r\n && s'.requests == s.requests + { req }\r\n && s'.app == AppHandleRequest(s.app, req.request).0\r\n && s'.replies == s.replies + { AppReplyMessage(req.client, req.seqno, AppHandleRequest(s.app, req.request).1) }\r\n}\r\n\r\npredicate StateSequenceReflectsBatchExecution(s:ServiceState, s':ServiceState, intermediate_states:seq,\r\n batch:seq)\r\n{\r\n && |intermediate_states| == |batch| + 1\r\n && intermediate_states[0] == s\r\n && last(intermediate_states) == s'\r\n && forall i :: 0 <= i < |batch| ==> ServiceExecutesAppRequest(intermediate_states[i], intermediate_states[i+1], batch[i])\r\n}\r\n\r\npredicate Service_Next(s:ServiceState, s':ServiceState)\r\n{\r\n exists intermediate_states, batch :: StateSequenceReflectsBatchExecution(s, s', intermediate_states, batch)\r\n}\r\n\r\nfunction Uint64ToBytes(u:uint64) : seq\r\n{\r\n [( u/0x1000000_00000000) as byte,\r\n ((u/ 0x10000_00000000)%0x100) as byte,\r\n ((u/ 0x100_00000000)%0x100) as byte,\r\n ((u/ 0x1_00000000)%0x100) as byte,\r\n ((u/ 0x1000000)%0x100) as byte,\r\n ((u/ 0x10000)%0x100) as byte,\r\n ((u/ 0x100)%0x100) as byte,\r\n ( u %0x100) as byte]\r\n}\r\n\r\nfunction MarshallServiceRequest(seqno:int, request:AppRequest) : seq\r\n{\r\n if 0 <= seqno < 0x1_0000_0000_0000_0000 && |request| <= MaxAppRequestSize() then\r\n [ 0, 0, 0, 0, 0, 0, 0, 0] // MarshallMesssage_Request magic number\r\n + Uint64ToBytes(seqno as uint64)\r\n + Uint64ToBytes(|request| as uint64)\r\n + request\r\n else \r\n [ 1 ]\r\n}\r\n\r\nfunction MarshallServiceReply(seqno:int, reply:AppReply) : seq\r\n{\r\n if 0 <= seqno < 0x1_0000_0000_0000_0000 && |reply| <= MaxAppReplySize() then\r\n [ 0, 0, 0, 0, 0, 0, 0, 6] // MarshallMesssage_Reply magic number\r\n + Uint64ToBytes(seqno as uint64)\r\n + Uint64ToBytes(|reply| as uint64)\r\n + reply\r\n else \r\n [ 1 ]\r\n}\r\n\r\npredicate Service_Correspondence(concretePkts:set>>, serviceState:ServiceState) \r\n{\r\n && (forall p, seqno, reply :: p in concretePkts && p.src in serviceState.serverAddresses && p.msg == MarshallServiceReply(seqno, reply) ==>\r\n AppReplyMessage(p.dst, seqno, reply) in serviceState.replies)\r\n && (forall req :: req in serviceState.requests ==> exists p :: p in concretePkts && p.dst in serviceState.serverAddresses \r\n && p.msg == MarshallServiceRequest(req.seqno, req.request)\r\n && p.src == req.client)\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/RSL/AppStateMachine.s.dfy", "content": "include \"../../Common/Native/Io.s.dfy\"\r\n\r\nmodule AppStateMachine_s {\r\nimport opened Native__NativeTypes_s\r\nimport opened Native__Io_s\r\n\r\ntype Bytes = seq\r\ntype AppState = Bytes\r\ntype AppRequest = Bytes\r\ntype AppReply = Bytes\r\n\r\nfunction {:axiom} AppInitialize() : AppState\r\nfunction {:axiom} AppHandleRequest(m:AppState, request:AppRequest) : (AppState, AppReply)\r\nfunction method MaxAppRequestSize() : int { 0x800_0000 } // 128 MB\r\nfunction method MaxAppReplySize() : int { 0x800_0000 } // 128 MB\r\nfunction method MaxAppStateSize() : int { 0x1000_0000_0000_0000 } // 2^60 B\r\n\r\nclass AppStateMachine\r\n{\r\n constructor{:axiom} ()\r\n requires false\r\n\r\n function {:axiom} Abstractify() : AppState\r\n\r\n static method {:axiom} Initialize() returns (m:AppStateMachine)\r\n ensures fresh(m)\r\n ensures m.Abstractify() == AppInitialize()\r\n\r\n static method {:axiom} Deserialize(state:AppState) returns (m:AppStateMachine)\r\n ensures fresh(m)\r\n ensures m.Abstractify() == state\r\n\r\n method {:axiom} Serialize() returns (state:AppState)\r\n ensures state == Abstractify()\r\n ensures |state| <= MaxAppStateSize()\r\n\r\n method {:axiom} HandleRequest(request:AppRequest) returns (reply:AppReply)\r\n requires |request| <= MaxAppRequestSize()\r\n ensures (Abstractify(), reply) == AppHandleRequest(old(Abstractify()), request)\r\n ensures |reply| <= MaxAppReplySize()\r\n}\r\n\r\n}\r\n\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/RSL/Main.i.dfy", "content": "include \"../../Common/Framework/Main.s.dfy\"\r\ninclude \"../../Impl/RSL/Host.i.dfy\"\r\ninclude \"../../Protocol/RSL/RefinementProof/Refinement.i.dfy\"\r\ninclude \"../../Protocol/Common/NodeIdentity.i.dfy\"\r\ninclude \"RSLDistributedSystem.i.dfy\"\r\ninclude \"AbstractService.s.dfy\"\r\ninclude \"Marshall.i.dfy\"\r\n\r\nmodule Main_i refines Main_s {\r\n\r\nimport opened Host = Host_i\r\nimport opened DS_s = RSL_DistributedSystem_i\r\nimport opened DirectRefinement__Refinement_i\r\nimport opened Concrete_NodeIdentity_i\r\nimport opened AS_s = AbstractServiceRSL_s\r\nimport opened AppStateMachine_s\r\nimport opened MarshallProof_i\r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__Configuration_i\r\nimport opened LiveRSL__Constants_i\r\nimport opened LiveRSL__ConstantsState_i\r\nimport opened LiveRSL__CTypes_i\r\nimport opened LiveRSL__DistributedSystem_i\r\nimport opened LiveRSL__Environment_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened LiveRSL__Replica_i\r\nimport opened LiveRSL__Types_i\r\nimport opened LiveRSL__NetRSL_i\r\nimport opened LiveRSL__Unsendable_i\r\nimport opened Collections__Maps2_s\r\nimport opened Collections__Sets_i\r\nimport opened Common__GenericMarshalling_i\r\nimport opened Common__NodeIdentity_i\r\nimport opened Common__SeqIsUniqueDef_i\r\nimport opened AbstractServiceRSL_s\r\nimport opened DirectRefinement__StateMachine_i\r\nimport opened Environment_s\r\nimport opened Math__mod_auto_i\r\n\r\npredicate IsValidBehavior(config:ConcreteConfiguration, db:seq)\r\n reads *\r\n{\r\n && |db| > 0\r\n && DS_Init(db[0], config)\r\n && forall i {:trigger DS_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> DS_Next(db[i], db[i+1])\r\n} \r\n\r\npredicate LPacketIsAbstractable(cp:LPacket>)\r\n{\r\n CMessageIsAbstractable(PaxosDemarshallData(cp.msg))\r\n}\r\n\r\nfunction AbstractifyConcretePacket(p:LPacket>) : LPacket\r\n requires LPacketIsAbstractable(p)\r\n{\r\n LPacket(p.dst, p.src, AbstractifyCMessageToRslMessage(PaxosDemarshallData(p.msg)))\r\n}\r\n\r\npredicate LEnvStepIsAbstractable(step:LEnvStep>)\r\n{\r\n match step {\r\n case LEnvStepHostIos(actor, ios) => NetEventLogIsAbstractable(ios)\r\n case LEnvStepDeliverPacket(p) => LPacketIsAbstractable(p)\r\n case LEnvStepAdvanceTime => true\r\n case LEnvStepStutter => true\r\n }\r\n}\r\n\r\nfunction AbstractifyConcreteEnvStep(step:LEnvStep>) : LEnvStep\r\n requires LEnvStepIsAbstractable(step)\r\n{\r\n match step {\r\n case LEnvStepHostIos(actor, ios) => LEnvStepHostIos(actor, AbstractifyRawLogToIos(ios))\r\n case LEnvStepDeliverPacket(p) => LEnvStepDeliverPacket(AbstractifyConcretePacket(p))\r\n case LEnvStepAdvanceTime => LEnvStepAdvanceTime()\r\n case LEnvStepStutter => LEnvStepStutter()\r\n }\r\n}\r\n\r\npredicate ConcreteEnvironmentIsAbstractable(ds_env:LEnvironment>)\r\n{\r\n && (forall p :: p in ds_env.sentPackets ==> LPacketIsAbstractable(p))\r\n && LEnvStepIsAbstractable(ds_env.nextStep)\r\n}\r\n\r\nfunction AbstractifyConcreteSentPackets(sent:set>>) : set>\r\n requires forall p :: p in sent ==> LPacketIsAbstractable(p)\r\n{\r\n set p | p in sent :: AbstractifyConcretePacket(p)\r\n}\r\n\r\nfunction AbstractifyConcreteEnvironment(ds_env:LEnvironment>) : LEnvironment\r\n requires ConcreteEnvironmentIsAbstractable(ds_env)\r\n{\r\n LEnvironment(ds_env.time,\r\n AbstractifyConcreteSentPackets(ds_env.sentPackets),\r\n map [],\r\n AbstractifyConcreteEnvStep(ds_env.nextStep))\r\n}\r\n\r\nfunction AbstractifyConcreteReplicas(replicas:map, replica_order:seq) : seq\r\n requires forall r :: r in replica_order ==> r in replicas\r\n ensures |AbstractifyConcreteReplicas(replicas, replica_order)| == |replica_order|\r\n ensures forall i :: 0 <= i < |replica_order| ==>\r\n AbstractifyConcreteReplicas(replicas, replica_order)[i] == replicas[replica_order[i]].sched\r\n{\r\n if replica_order == [] then []\r\n else\r\n [replicas[replica_order[0]].sched] + AbstractifyConcreteReplicas(replicas, replica_order[1..])\r\n}\r\n\r\npredicate DsStateIsAbstractable(ds:DS_State)\r\n{\r\n && ConstantsStateIsAbstractable(ds.config)\r\n && ConcreteEnvironmentIsAbstractable(ds.environment)\r\n && (forall r :: r in ds.config.config.replica_ids ==> r in ds.servers)\r\n}\r\n\r\nfunction AbstractifyDsState(ds:DS_State) : RslState\r\n requires DsStateIsAbstractable(ds)\r\n{\r\n RslState(AbstractifyConstantsStateToLConstants(ds.config),\r\n AbstractifyConcreteEnvironment(ds.environment),\r\n AbstractifyConcreteReplicas(ds.servers, ds.config.config.replica_ids))\r\n}\r\n\r\nlemma lemma_DeduceTransitionFromDsBehavior(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int\r\n )\r\n requires IsValidBehavior(config, db)\r\n requires 0 <= i < |db| - 1\r\n ensures DS_Next(db[i], db[i+1])\r\n{\r\n}\r\n\r\nlemma lemma_DsNextOffset(db:seq, index:int)\r\n requires |db| > 0\r\n requires 0 < index < |db|\r\n requires forall i {:trigger DS_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> DS_Next(db[i], db[i+1])\r\n ensures DS_Next(db[index-1], db[index])\r\n{\r\n var i := index - 1;\r\n assert DS_Next(db[i], db[i+1]); // OBSERVE trigger for the forall\r\n}\r\n\r\nlemma lemma_DsConsistency(config:ConcreteConfiguration, db:seq, i:int)\r\n requires IsValidBehavior(config, db)\r\n requires 0 <= i < |db|\r\n ensures db[i].config == config\r\n ensures mapdomain(db[i].servers) == mapdomain(db[0].servers)\r\n{\r\n if i == 0 {\r\n } else {\r\n lemma_DsConsistency(config, db, i-1);\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n\r\n assert forall server :: server in db[i-1].servers ==> server in db[i].servers;\r\n assert forall server :: server in db[i].servers ==> server in db[i-1].servers;\r\n\r\n forall server | server in mapdomain(db[i-1].servers)\r\n ensures server in mapdomain(db[i].servers)\r\n {\r\n assert server in db[i-1].servers;\r\n assert server in db[i].servers;\r\n }\r\n\r\n forall server | server in mapdomain(db[i].servers)\r\n ensures server in mapdomain(db[i-1].servers)\r\n {\r\n assert server in db[i].servers;\r\n assert server in db[i-1].servers;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_LSchedulerNextPreservesConstants(\r\n s:LScheduler,\r\n s':LScheduler,\r\n ios:seq\r\n )\r\n requires LSchedulerNext(s, s', ios)\r\n ensures s.replica.constants == s.replica.constants\r\n ensures s.replica.proposer.constants == s.replica.proposer.constants\r\n ensures s.replica.acceptor.constants == s.replica.acceptor.constants\r\n ensures s.replica.learner.constants == s.replica.learner.constants\r\n ensures s.replica.executor.constants == s.replica.executor.constants\r\n{\r\n}\r\n\r\nlemma {:timeLimitMultiplier 2} lemma_DsConstantsAllConsistent(config:ConcreteConfiguration, db:seq, i:int, id:EndPoint)\r\n requires IsValidBehavior(config, db)\r\n requires 0 <= i < |db|\r\n requires id in db[i].servers\r\n ensures db[i].config == config\r\n ensures db[i].servers[id].sched.replica.constants.all == AbstractifyConstantsStateToLConstants(config)\r\n ensures db[i].servers[id].sched.replica.proposer.constants.all == AbstractifyConstantsStateToLConstants(config)\r\n ensures db[i].servers[id].sched.replica.acceptor.constants.all == AbstractifyConstantsStateToLConstants(config)\r\n ensures db[i].servers[id].sched.replica.learner.constants.all == AbstractifyConstantsStateToLConstants(config)\r\n ensures db[i].servers[id].sched.replica.executor.constants.all == AbstractifyConstantsStateToLConstants(config)\r\n{\r\n if i == 0\r\n {\r\n assert DS_Init(db[0], config);\r\n return;\r\n }\r\n\r\n lemma_DsConsistency(config, db, i-1);\r\n lemma_DsConsistency(config, db, i);\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n\r\n assert mapdomain(db[i].servers) == mapdomain(db[0].servers) == mapdomain(db[i-1].servers);\r\n\r\n lemma_DsConstantsAllConsistent(config, db, i-1, id);\r\n\r\n var s := db[i-1].servers[id].sched;\r\n var s' := db[i].servers[id].sched;\r\n\r\n if s' == s\r\n {\r\n return;\r\n }\r\n\r\n var ios :| DS_NextOneServer(db[i-1], db[i], id, ios);\r\n var rios := AbstractifyRawLogToIos(ios);\r\n assert LSchedulerNext(s, s', rios) || HostNextIgnoreUnsendable(s, s', ios);\r\n if LSchedulerNext(s, s', rios)\r\n {\r\n lemma_LSchedulerNextPreservesConstants(s, s', rios);\r\n }\r\n else\r\n {\r\n assert s'.replica == s.replica;\r\n }\r\n}\r\n\r\nlemma{:timeLimitMultiplier 4} lemma_PacketSentByServerIsMarshallable(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n p:LPacket>\r\n )\r\n requires IsValidBehavior(config, db)\r\n requires 0 <= i < |db|\r\n requires p.src in config.config.replica_ids\r\n requires p in db[i].environment.sentPackets\r\n ensures NetPacketBound(p.msg)\r\n ensures Marshallable(PaxosDemarshallData(p.msg))\r\n{\r\n if i == 0 {\r\n return;\r\n }\r\n\r\n if p in db[i-1].environment.sentPackets {\r\n lemma_PacketSentByServerIsMarshallable(config, db, i-1, p);\r\n return;\r\n }\r\n\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n lemma_DsConsistency(config, db, i-1);\r\n assert LEnvironment_Next(db[i-1].environment, db[i].environment);\r\n assert db[i-1].environment.nextStep.LEnvStepHostIos?;\r\n var io := LIoOpSend(p);\r\n var ios := db[i-1].environment.nextStep.ios;\r\n assert io in ios;\r\n assert IsValidLIoOp(io, db[i-1].environment.nextStep.actor, db[i-1].environment);\r\n assert db[i-1].environment.nextStep.actor == p.src;\r\n assert DS_NextOneServer(db[i-1], db[i], p.src, ios);\r\n assert OnlySentMarshallableData(ios);\r\n assert NetPacketBound(io.s.msg);\r\n assert Marshallable(PaxosDemarshallData(io.s.msg));\r\n}\r\n\r\nlemma lemma_SentPacketIsValidPhysicalPacket(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n p:LPacket>\r\n )\r\n requires IsValidBehavior(config, db)\r\n requires 0 <= i < |db|\r\n requires p in db[i].environment.sentPackets\r\n ensures ValidPhysicalPacket(p)\r\n{\r\n if i == 0 {\r\n return;\r\n }\r\n\r\n if p in db[i-1].environment.sentPackets {\r\n lemma_SentPacketIsValidPhysicalPacket(config, db, i-1, p);\r\n return;\r\n }\r\n\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n assert LEnvironment_Next(db[i-1].environment, db[i].environment);\r\n assert db[i-1].environment.nextStep.LEnvStepHostIos?;\r\n var io := LIoOpSend(p);\r\n assert io in db[i-1].environment.nextStep.ios;\r\n assert ValidPhysicalEnvironmentStep(db[i-1].environment.nextStep);\r\n}\r\n\r\nlemma lemma_NetEventIsAbstractable(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n net_event:NetEvent\r\n )\r\n requires IsValidBehavior(config, db)\r\n requires 0 <= i < |db| - 1\r\n requires db[i].environment.nextStep.LEnvStepHostIos?\r\n requires net_event in db[i].environment.nextStep.ios\r\n ensures NetEventIsAbstractable(net_event)\r\n{\r\n if net_event.LIoOpTimeoutReceive? || net_event.LIoOpReadClock? {\r\n return;\r\n }\r\n\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i);\r\n assert ValidPhysicalEnvironmentStep(db[i].environment.nextStep);\r\n assert ValidPhysicalIo(net_event);\r\n}\r\n\r\nlemma lemma_DsIsAbstractable(config:ConcreteConfiguration, db:seq, i:int)\r\n requires IsValidBehavior(config, db)\r\n requires 0 <= i < |db|\r\n requires LEnvStepIsAbstractable(last(db).environment.nextStep)\r\n ensures DsStateIsAbstractable(db[i])\r\n{\r\n lemma_DsConsistency(config, db, i);\r\n\r\n forall p | p in db[i].environment.sentPackets\r\n ensures LPacketIsAbstractable(p)\r\n {\r\n lemma_SentPacketIsValidPhysicalPacket(config, db, i, p);\r\n }\r\n\r\n if i == |db|-1\r\n {\r\n return;\r\n }\r\n\r\n var step := db[i].environment.nextStep;\r\n if step.LEnvStepHostIos? {\r\n forall io | io in step.ios\r\n ensures NetEventIsAbstractable(io)\r\n {\r\n lemma_NetEventIsAbstractable(config, db, i, io);\r\n }\r\n assert NetEventLogIsAbstractable(step.ios);\r\n }\r\n else if step.LEnvStepDeliverPacket? {\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i);\r\n assert IsValidLEnvStep(db[i].environment, step);\r\n assert step.p in db[i].environment.sentPackets;\r\n lemma_SentPacketIsValidPhysicalPacket(config, db, i, step.p);\r\n }\r\n}\r\n\r\nlemma lemma_IosRelations(ios:seq>>, r_ios:seq>)\r\n returns (sends:set>>, r_sends:set>)\r\n requires NetEventLogIsAbstractable(ios)\r\n requires forall io :: io in ios && io.LIoOpSend? ==> LPacketIsAbstractable(io.s)\r\n requires r_ios == AbstractifyRawLogToIos(ios)\r\n ensures sends == (set io | io in ios && io.LIoOpSend? :: io.s)\r\n ensures r_sends == (set io | io in r_ios && io.LIoOpSend? :: io.s)\r\n ensures forall send :: send in sends ==> LPacketIsAbstractable(send)\r\n ensures r_sends == AbstractifyConcreteSentPackets(sends)\r\n{\r\n sends := (set io | io in ios && io.LIoOpSend? :: io.s);\r\n r_sends := (set io | io in r_ios && io.LIoOpSend? :: io.s);\r\n var refined_sends := AbstractifyConcreteSentPackets(sends);\r\n\r\n forall r | r in refined_sends\r\n ensures r in r_sends\r\n {\r\n var send :| send in sends && AbstractifyConcretePacket(send) == r;\r\n var io :| io in ios && io.LIoOpSend? && io.s == send;\r\n assert AbstractifyNetEventToRslIo(io) in r_ios;\r\n }\r\n\r\n forall r | r in r_sends\r\n ensures r in refined_sends\r\n {\r\n var r_io :| r_io in r_ios && r_io.LIoOpSend? && r_io.s == r;\r\n var j :| 0 <= j < |r_ios| && r_ios[j] == r_io;\r\n assert AbstractifyNetEventToRslIo(ios[j]) == r_io;\r\n assert ios[j] in ios;\r\n assert ios[j].s in sends;\r\n }\r\n}\r\n\r\nlemma lemma_IsValidEnvStep(de:LEnvironment>, le:LEnvironment)\r\n requires IsValidLEnvStep(de, de.nextStep)\r\n requires de.nextStep.LEnvStepHostIos?\r\n requires ConcreteEnvironmentIsAbstractable(de)\r\n requires AbstractifyConcreteEnvironment(de) == le\r\n ensures IsValidLEnvStep(le, le.nextStep)\r\n{\r\n var id := de.nextStep.actor;\r\n var ios := de.nextStep.ios;\r\n var r_ios := le.nextStep.ios;\r\n\r\n assert LIoOpSeqCompatibleWithReduction(r_ios);\r\n\r\n forall io | io in r_ios\r\n ensures IsValidLIoOp(io, id, le)\r\n {\r\n var j :| 0 <= j < |r_ios| && r_ios[j] == io;\r\n assert r_ios[j] == AbstractifyNetEventToRslIo(ios[j]);\r\n assert IsValidLIoOp(ios[j], id, de);\r\n }\r\n}\r\n\r\nlemma lemma_LEnvironmentNextHost(de :LEnvironment>, le :LEnvironment,\r\n de':LEnvironment>, le':LEnvironment)\r\n requires ConcreteEnvironmentIsAbstractable(de)\r\n requires ConcreteEnvironmentIsAbstractable(de')\r\n requires AbstractifyConcreteEnvironment(de) == le\r\n requires AbstractifyConcreteEnvironment(de') == le'\r\n requires de.nextStep.LEnvStepHostIos?\r\n requires LEnvironment_Next(de, de')\r\n ensures LEnvironment_Next(le, le')\r\n{\r\n lemma_IsValidEnvStep(de, le);\r\n var id := de.nextStep.actor;\r\n var ios := de.nextStep.ios;\r\n var r_ios := le.nextStep.ios;\r\n\r\n assert LEnvironment_PerformIos(de, de', id, ios);\r\n\r\n var sends, r_sends := lemma_IosRelations(ios, r_ios);\r\n assert de.sentPackets + sends == de'.sentPackets;\r\n assert le.sentPackets + r_sends == le'.sentPackets;\r\n\r\n assert forall r_io :: r_io in r_ios && r_io.LIoOpReceive? ==> r_io.r in le.sentPackets;\r\n\r\n assert LEnvironment_PerformIos(le, le', id, r_ios);\r\n}\r\n\r\nlemma lemma_RefinementOfUnsendablePacketHasLimitedPossibilities(\r\n p:LPacket>,\r\n g:G,\r\n rp:RslPacket\r\n )\r\n requires g == CMessage_grammar()\r\n requires ValidGrammar(g)\r\n requires !Demarshallable(p.msg, g) || !Marshallable(parse_Message(DemarshallFunc(p.msg, g)))\r\n requires NetPacketIsAbstractable(p)\r\n requires rp == AbstractifyNetPacketToRslPacket(p)\r\n ensures || rp.msg.RslMessage_Invalid?\r\n || rp.msg.RslMessage_Request?\r\n || rp.msg.RslMessage_1b?\r\n || rp.msg.RslMessage_2a?\r\n || rp.msg.RslMessage_2b?\r\n || rp.msg.RslMessage_Reply?\r\n || rp.msg.RslMessage_AppStateSupply?\r\n{\r\n}\r\n\r\nlemma lemma_IgnoringUnsendableGivesEmptySentPackets(ios:seq)\r\n requires |ios| == 1\r\n requires ios[0].LIoOpReceive?\r\n ensures ExtractSentPacketsFromIos(ios) == []\r\n{\r\n reveal ExtractSentPacketsFromIos();\r\n}\r\n\r\nlemma lemma_IgnoringInvalidMessageIsLSchedulerNext(\r\n s:LScheduler,\r\n s':LScheduler,\r\n ios:seq\r\n )\r\n requires s.nextActionIndex == 0\r\n requires s' == s.(nextActionIndex := (s.nextActionIndex + 1) % LReplicaNumActions())\r\n requires |ios| == 1\r\n requires ios[0].LIoOpReceive?\r\n requires ios[0].r.msg.RslMessage_Invalid?\r\n ensures LSchedulerNext(s, s', ios)\r\n{\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n lemma_IgnoringUnsendableGivesEmptySentPackets(ios);\r\n assert LReplicaNextProcessInvalid(s.replica, s'.replica, ios[0].r, sent_packets);\r\n assert LReplicaNextProcessPacketWithoutReadingClock(s.replica, s'.replica, ios);\r\n assert LReplicaNextProcessPacket(s.replica, s'.replica, ios);\r\n}\r\n\r\nlemma lemma_IgnoringInvalidRequestIsLSchedulerNext(\r\n s:LScheduler,\r\n s':LScheduler,\r\n ios:seq\r\n )\r\n requires s.nextActionIndex == 0\r\n requires s' == s.(nextActionIndex := (s.nextActionIndex + 1) % LReplicaNumActions())\r\n requires |ios| == 1\r\n requires ios[0].LIoOpReceive?\r\n requires ios[0].r.msg.RslMessage_Request?\r\n requires !CAppRequestMarshallable(ios[0].r.msg.val)\r\n ensures LSchedulerNext(s, s', ios)\r\n{\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n lemma_IgnoringUnsendableGivesEmptySentPackets(ios);\r\n assert LReplicaNextProcessRequest(s.replica, s'.replica, ios[0].r, sent_packets);\r\n assert LReplicaNextProcessPacketWithoutReadingClock(s.replica, s'.replica, ios);\r\n assert LReplicaNextProcessPacket(s.replica, s'.replica, ios);\r\n}\r\n\r\nlemma lemma_IgnoringReplyIsLSchedulerNext(\r\n s:LScheduler,\r\n s':LScheduler,\r\n ios:seq\r\n )\r\n requires s.nextActionIndex == 0\r\n requires s' == s.(nextActionIndex := (s.nextActionIndex + 1) % LReplicaNumActions())\r\n requires |ios| == 1\r\n requires ios[0].LIoOpReceive?\r\n requires ios[0].r.msg.RslMessage_Reply?\r\n ensures LSchedulerNext(s, s', ios)\r\n{\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n lemma_IgnoringUnsendableGivesEmptySentPackets(ios);\r\n assert LReplicaNextProcessReply(s.replica, s'.replica, ios[0].r, sent_packets);\r\n assert LReplicaNextProcessPacketWithoutReadingClock(s.replica, s'.replica, ios);\r\n assert LReplicaNextProcessPacket(s.replica, s'.replica, ios);\r\n}\r\n\r\nlemma lemma_IgnoringCertainMessageTypesFromNonServerIsLSchedulerNext(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n id:EndPoint,\r\n s:LScheduler,\r\n s':LScheduler,\r\n ios:seq\r\n )\r\n requires IsValidBehavior(config, db)\r\n requires 0 <= i < |db| - 1\r\n requires id in db[i].servers\r\n requires id in db[i+1].servers\r\n requires s == db[i].servers[id].sched\r\n requires s' == db[i+1].servers[id].sched\r\n requires s.nextActionIndex == 0\r\n requires s' == s.(nextActionIndex := (s.nextActionIndex + 1) % LReplicaNumActions())\r\n requires |ios| == 1\r\n requires ios[0].LIoOpReceive?\r\n requires || ios[0].r.msg.RslMessage_1b?\r\n || ios[0].r.msg.RslMessage_2a?\r\n || ios[0].r.msg.RslMessage_2b?\r\n || ios[0].r.msg.RslMessage_AppStateSupply?\r\n requires ios[0].r.src !in config.config.replica_ids\r\n ensures LSchedulerNext(s, s', ios)\r\n{\r\n lemma_DsConstantsAllConsistent(config, db, i, id);\r\n var sent_packets := ExtractSentPacketsFromIos(ios);\r\n lemma_IgnoringUnsendableGivesEmptySentPackets(ios);\r\n assert LReplicaNextProcessPacketWithoutReadingClock(s.replica, s'.replica, ios);\r\n assert LReplicaNextProcessPacket(s.replica, s'.replica, ios);\r\n}\r\n\r\nlemma lemma_HostNextIgnoreUnsendableIsLSchedulerNext(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n id:EndPoint,\r\n ios:seq>>\r\n )\r\n requires IsValidBehavior(config, db)\r\n requires 0 <= i < |db| - 1\r\n requires db[i].environment.nextStep == LEnvStepHostIos(id, ios)\r\n requires id in db[i].servers\r\n requires id in db[i+1].servers\r\n requires LEnvironment_Next(db[i].environment, db[i+1].environment)\r\n requires ValidPhysicalEnvironmentStep(db[i].environment.nextStep)\r\n requires HostNextIgnoreUnsendable(db[i].servers[id].sched, db[i+1].servers[id].sched, ios)\r\n requires NetEventLogIsAbstractable(ios)\r\n ensures LSchedulerNext(db[i].servers[id].sched, db[i+1].servers[id].sched, AbstractifyRawLogToIos(ios))\r\n{\r\n var p := ios[0].r;\r\n var rp := AbstractifyNetPacketToRslPacket(p);\r\n var g := CMessage_grammar();\r\n assert !Demarshallable(p.msg, g) || !Marshallable(parse_Message(DemarshallFunc(p.msg, g)));\r\n assert IsValidLIoOp(ios[0], id, db[i].environment);\r\n\r\n if p.src in config.config.replica_ids\r\n {\r\n lemma_PacketSentByServerIsMarshallable(config, db, i, p);\r\n assert false;\r\n }\r\n\r\n lemma_NetEventIsAbstractable(config, db, i, ios[0]);\r\n lemma_CMessageGrammarValid();\r\n assert ValidPhysicalIo(ios[0]);\r\n assert |p.msg| < 0x1_0000_0000_0000_0000;\r\n assert ValidGrammar(g);\r\n\r\n var rios := AbstractifyRawLogToIos(ios);\r\n assert |rios| == 1;\r\n assert rios[0].r == rp;\r\n\r\n var s := db[i].servers[id].sched;\r\n var s' := db[i+1].servers[id].sched;\r\n\r\n assert s.nextActionIndex == 0;\r\n calc {\r\n s'.nextActionIndex;\r\n 1;\r\n { lemma_mod_auto(LReplicaNumActions()); }\r\n (s.nextActionIndex + 1) % LReplicaNumActions();\r\n }\r\n\r\n lemma_RefinementOfUnsendablePacketHasLimitedPossibilities(p, g, rp);\r\n\r\n if rp.msg.RslMessage_Invalid? {\r\n lemma_IgnoringInvalidMessageIsLSchedulerNext(s, s', rios);\r\n }\r\n else if rp.msg.RslMessage_Request? {\r\n lemma_IgnoringInvalidRequestIsLSchedulerNext(s, s', rios);\r\n }\r\n else if rp.msg.RslMessage_Reply? {\r\n lemma_IgnoringReplyIsLSchedulerNext(s, s', rios);\r\n }\r\n else {\r\n lemma_DsConsistency(config, db, i);\r\n lemma_IgnoringCertainMessageTypesFromNonServerIsLSchedulerNext(config, db, i, id, s, s', rios);\r\n }\r\n}\r\n\r\nlemma {:timeLimitMultiplier 2} lemma_RslNext(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n ls:RslState,\r\n ls':RslState\r\n )\r\n requires IsValidBehavior(config, db)\r\n requires 0 <= i < |db| - 1\r\n requires DsStateIsAbstractable(db[i])\r\n requires DsStateIsAbstractable(db[i+1])\r\n requires ls == AbstractifyDsState(db[i])\r\n requires ls' == AbstractifyDsState(db[i+1])\r\n requires forall id :: id in db[i].servers ==> id in db[i].config.config.replica_ids\r\n ensures RslNext(ls, ls')\r\n{\r\n var ds := db[i];\r\n var ds' := db[i+1];\r\n\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i);\r\n\r\n if !ds.environment.nextStep.LEnvStepHostIos? {\r\n return;\r\n }\r\n\r\n lemma_LEnvironmentNextHost(db[i].environment, ls.environment, db[i+1].environment, ls'.environment);\r\n\r\n var id := ds.environment.nextStep.actor;\r\n var ios := ds.environment.nextStep.ios;\r\n var r_ios := AbstractifyRawLogToIos(ios);\r\n var replicas := ds.config.config.replica_ids;\r\n\r\n assert id in ds.servers <==> id in replicas;\r\n\r\n if id !in ds.servers {\r\n assert RslNextOneExternal(ls, ls', id, r_ios);\r\n assert RslNext(ls, ls');\r\n return;\r\n }\r\n\r\n var index :| 0 <= index < |replicas| && replicas[index] == id;\r\n\r\n assert ls.environment.nextStep == LEnvStepHostIos(id, r_ios);\r\n\r\n assert || LSchedulerNext(ds.servers[id].sched, ds'.servers[id].sched, r_ios)\r\n || HostNextIgnoreUnsendable(ds.servers[id].sched, ds'.servers[id].sched, ios);\r\n if HostNextIgnoreUnsendable(ds.servers[id].sched, ds'.servers[id].sched, ios)\r\n {\r\n lemma_HostNextIgnoreUnsendableIsLSchedulerNext(config, db, i, id, ios);\r\n }\r\n assert LSchedulerNext(ds.servers[id].sched, ds'.servers[id].sched, r_ios);\r\n\r\n assert LEnvironment_Next(ds.environment, ds'.environment);\r\n lemma_LEnvironmentNextHost(ds.environment, ls.environment, ds'.environment, ls'.environment);\r\n assert LEnvironment_Next(ls.environment, ls'.environment);\r\n\r\n reveal SeqIsUnique();\r\n forall other_idx | other_idx != index && 0 <= other_idx < |replicas|\r\n ensures replicas[other_idx] != replicas[index]\r\n {\r\n assert ReplicasDistinct(ls.constants.config.replica_ids, index, other_idx);\r\n }\r\n assert RslNextOneReplica(ls, ls', index, r_ios);\r\n\r\n assert RslNext(ls, ls');\r\n}\r\n\r\nlemma lemma_GetImplBehaviorRefinement(config:ConcreteConfiguration, db:seq)\r\n returns (protocol_behavior:seq, c:LConstants)\r\n requires IsValidBehavior(config, db)\r\n requires LEnvStepIsAbstractable(last(db).environment.nextStep)\r\n ensures |protocol_behavior| == |db|\r\n ensures protocol_behavior[0].constants == AbstractifyConstantsStateToLConstants(config)\r\n ensures RslInit(c, protocol_behavior[0])\r\n ensures forall i :: 0 <= i < |db| ==> DsStateIsAbstractable(db[i]) && protocol_behavior[i] == AbstractifyDsState(db[i]);\r\n ensures forall i {:trigger RslNext(protocol_behavior[i], protocol_behavior[i+1])} :: 0 <= i < |protocol_behavior| - 1 ==>\r\n RslNext(protocol_behavior[i], protocol_behavior[i+1])\r\n{\r\n c := AbstractifyConstantsStateToLConstants(config);\r\n if |db| == 1 {\r\n lemma_DsIsAbstractable(config, db, 0);\r\n var ls := AbstractifyDsState(db[0]);\r\n protocol_behavior := [ ls ];\r\n\r\n // Prove RslMapsComplete\r\n calc {\r\n |ls.replicas|;\r\n |AbstractifyConcreteReplicas(db[0].servers, db[0].config.config.replica_ids)|;\r\n |db[0].config.config.replica_ids|;\r\n |AbstractifyEndPointsToNodeIdentities(db[0].config.config.replica_ids)|;\r\n |AbstractifyConstantsStateToLConstants(db[0].config).config.replica_ids|;\r\n |ls.constants.config.replica_ids|;\r\n }\r\n\r\n calc {\r\n ls.constants;\r\n AbstractifyConstantsStateToLConstants(db[0].config);\r\n AbstractifyConstantsStateToLConstants(config);\r\n c;\r\n }\r\n\r\n forall i | 0 <= i < |c.config.replica_ids|\r\n ensures LSchedulerInit(ls.replicas[i], LReplicaConstants(i, c))\r\n {\r\n reveal SeqIsUnique();\r\n }\r\n\r\n forall i | 0 <= i < |db|\r\n ensures DsStateIsAbstractable(db[i]) && protocol_behavior[i] == AbstractifyDsState(db[i])\r\n {\r\n assert i == 0;\r\n }\r\n \r\n } else {\r\n lemma_DsConsistency(config, db, |db|-1);\r\n lemma_DeduceTransitionFromDsBehavior(config, db, |db|-2);\r\n lemma_DsIsAbstractable(config, db, |db|-1);\r\n lemma_DsIsAbstractable(config, db, |db|-2);\r\n \r\n var ls' := AbstractifyDsState(last(db));\r\n var rest, c' := lemma_GetImplBehaviorRefinement(config, all_but_last(db));\r\n protocol_behavior := rest + [ls'];\r\n\r\n // Help with sequence indexing\r\n forall i | 0 <= i < |db|\r\n ensures DsStateIsAbstractable(db[i])\r\n ensures protocol_behavior[i] == AbstractifyDsState(db[i])\r\n {\r\n lemma_DsIsAbstractable(config, db, i);\r\n if i < |db| - 1 {\r\n assert db[i] == all_but_last(db)[i];\r\n assert protocol_behavior[i] == AbstractifyDsState(all_but_last(db)[i]);\r\n assert protocol_behavior[i] == AbstractifyDsState(db[i]);\r\n } else {\r\n assert protocol_behavior[i] == ls';\r\n assert i == |db| - 1;\r\n assert db[i] == last(db);\r\n assert protocol_behavior[i] == AbstractifyDsState(db[i]);\r\n }\r\n }\r\n\r\n // Prove the crucial ensures\r\n forall i | 0 <= i < |protocol_behavior| - 1\r\n ensures RslNext(protocol_behavior[i], protocol_behavior[i+1])\r\n {\r\n if i < |protocol_behavior| - 2 {\r\n // Induction hypothesis\r\n assert RslNext(protocol_behavior[i], protocol_behavior[i+1]);\r\n } else {\r\n forall id | id in db[i].servers\r\n ensures id in db[i].config.config.replica_ids\r\n {\r\n calc ==> {\r\n id in db[i].servers;\r\n id in mapdomain(db[i].servers);\r\n { lemma_DsConsistency(config, db, i); }\r\n id in mapdomain(db[0].servers);\r\n id in db[0].config.config.replica_ids;\r\n { lemma_DsConsistency(config, db, i); }\r\n id in db[i].config.config.replica_ids;\r\n }\r\n }\r\n lemma_RslNext(config, db, i, protocol_behavior[i], protocol_behavior[i+1]);\r\n assert RslNext(protocol_behavior[i], protocol_behavior[i+1]);\r\n }\r\n }\r\n }\r\n}\r\n\r\nfunction RenameToAppRequestMessage(request:Request) : AppRequestMessage\r\n{\r\n AppRequestMessage(request.client, request.seqno, request.request)\r\n}\r\n\r\nfunction RenameToAppReplyMessage(reply:Reply) : AppReplyMessage\r\n{\r\n AppReplyMessage(reply.client, reply.seqno, reply.reply)\r\n}\r\n\r\nfunction RenameToAppRequestMessages(requests:set) : set\r\n{\r\n set r | r in requests :: RenameToAppRequestMessage(r)\r\n}\r\n\r\nfunction RenameToAppReplies(replies:set) : set\r\n{\r\n set r | r in replies :: RenameToAppReplyMessage(r)\r\n}\r\n\r\nfunction RenameToAppBatch(batch:seq) : seq\r\n ensures |RenameToAppBatch(batch)| == |batch|\r\n ensures forall i :: 0 <= i < |batch| ==> RenameToAppBatch(batch)[i] == RenameToAppRequestMessage(batch[i])\r\n{\r\n if |batch| == 0 then [] else RenameToAppBatch(all_but_last(batch)) + [RenameToAppRequestMessage(last(batch))]\r\n}\r\n\r\nfunction RenameToServiceState(rs:RSLSystemState) : ServiceState\r\n{\r\n ServiceState'(rs.server_addresses, rs.app, RenameToAppRequestMessages(rs.requests), RenameToAppReplies(rs.replies))\r\n}\r\n\r\nfunction RenameToServiceStates(rs:seq) : seq\r\n ensures |rs| == |RenameToServiceStates(rs)|\r\n ensures forall i :: 0 <= i < |rs| ==> RenameToServiceState(rs[i]) == RenameToServiceStates(rs)[i]\r\n{\r\n if rs == [] then []\r\n else [RenameToServiceState(rs[0])] + RenameToServiceStates(rs[1..])\r\n}\r\n\r\nlemma lemma_ServiceNextDoesntChangeServerAddresses(s:ServiceState, s':ServiceState)\r\n requires s == s' || Service_Next(s, s')\r\n ensures s'.serverAddresses == s.serverAddresses\r\n{\r\n if s == s' {\r\n return;\r\n }\r\n\r\n var intermediate_states:seq, batch :| StateSequenceReflectsBatchExecution(s, s', intermediate_states, batch);\r\n var i := 0;\r\n while i < |batch|\r\n invariant 0 <= i <= |batch|\r\n invariant intermediate_states[i].serverAddresses == s.serverAddresses\r\n {\r\n assert ServiceExecutesAppRequest(intermediate_states[i], intermediate_states[i+1], batch[i]);\r\n assert intermediate_states[i+1].serverAddresses == intermediate_states[i].serverAddresses == s.serverAddresses;\r\n i := i + 1;\r\n }\r\n\r\n assert intermediate_states[i] == last(intermediate_states) == s';\r\n}\r\n\r\nlemma lemma_ServiceStateServerAddressesNeverChange(sb:seq, server_addresses:set, i:int)\r\n requires |sb| > 0\r\n requires Service_Init(sb[0], server_addresses)\r\n requires forall j {:trigger Service_Next(sb[j], sb[j+1])} :: 0 <= j < |sb| - 1 ==> sb[j] == sb[j+1] || Service_Next(sb[j], sb[j+1])\r\n requires 0 <= i < |sb|\r\n ensures sb[i].serverAddresses == server_addresses\r\n{\r\n if i == 0 {\r\n return;\r\n }\r\n\r\n var j := i-1;\r\n assert sb[j] == sb[j+1] || Service_Next(sb[j], sb[j+1]);\r\n assert i == j+1;\r\n assert sb[i-1] == sb[i] || Service_Next(sb[i-1], sb[i]);\r\n lemma_ServiceNextDoesntChangeServerAddresses(sb[i-1], sb[i]);\r\n assert sb[i].serverAddresses == sb[i-1].serverAddresses;\r\n lemma_ServiceStateServerAddressesNeverChange(sb, server_addresses, i-1);\r\n}\r\n\r\nlemma lemma_RslSystemNextImpliesServiceNext(\r\n rs:RSLSystemState,\r\n rs':RSLSystemState,\r\n s:ServiceState,\r\n s':ServiceState'\r\n )\r\n requires s == RenameToServiceState(rs)\r\n requires s' == RenameToServiceState(rs')\r\n requires RslSystemNext(rs, rs')\r\n ensures Service_Next(s, s')\r\n{\r\n var intermediate_states, batch :| RslStateSequenceReflectsBatchExecution(rs, rs', intermediate_states, batch);\r\n var intermediate_states_renamed := RenameToServiceStates(intermediate_states);\r\n var batch_renamed := RenameToAppBatch(batch);\r\n assert StateSequenceReflectsBatchExecution(s, s', intermediate_states_renamed, batch_renamed);\r\n}\r\n\r\nlemma lemma_RequestSizeBounded(server_addresses:set, rb:seq, pos:int)\r\n requires |rb| > 0\r\n requires RslSystemInit(rb[0], server_addresses)\r\n requires forall i {:trigger RslSystemNext(rb[i], rb[i+1])} :: 0 <= i < |rb| - 1 ==> rb[i] == rb[i+1] || RslSystemNext(rb[i], rb[i+1])\r\n requires 0 <= pos < |rb|\r\n ensures forall req :: req in rb[pos].requests ==> |req.request| <= MaxAppRequestSize()\r\n{\r\n if pos == 0 {\r\n return;\r\n }\r\n\r\n var prev := pos - 1;\r\n assert rb[pos] == rb[prev] || RslSystemNext(rb[prev], rb[prev+1]);\r\n lemma_RequestSizeBounded(server_addresses, rb, prev);\r\n if (rb[pos] == rb[prev]) {\r\n return;\r\n }\r\n\r\n var s := rb[prev];\r\n var s' := rb[prev+1];\r\n var intermediate_states:seq, batch:seq :|\r\n RslStateSequenceReflectsBatchExecution(s, s', intermediate_states, batch);\r\n var which_req := 0;\r\n while which_req < |batch|\r\n invariant 0 <= which_req <= |batch|\r\n invariant forall req :: req in intermediate_states[which_req].requests ==> |req.request| <= MaxAppRequestSize()\r\n {\r\n assert RslSystemNextServerExecutesRequest(intermediate_states[which_req], intermediate_states[which_req+1], batch[which_req]);\r\n which_req := which_req + 1;\r\n }\r\n}\r\n\r\nlemma{:timeLimitMultiplier 4} lemma_RefinementProofForFixedBehavior(config:ConcreteConfiguration, db:seq)\r\n returns (sb:seq)\r\n requires IsValidBehavior(config, db)\r\n requires last(db).environment.nextStep.LEnvStepStutter?\r\n ensures |db| == |sb|\r\n ensures Service_Init(sb[0], mapdomain(db[0].servers))\r\n ensures forall i {:trigger Service_Next(sb[i], sb[i+1])} :: 0 <= i < |sb| - 1 ==> sb[i] == sb[i+1] || Service_Next(sb[i], sb[i+1])\r\n ensures forall i :: 0 <= i < |db| ==> Service_Correspondence(db[i].environment.sentPackets, sb[i])\r\n{\r\n var protocol_behavior, lconstants := lemma_GetImplBehaviorRefinement(config, db);\r\n var rs := lemma_GetBehaviorRefinement(protocol_behavior, lconstants);\r\n sb := RenameToServiceStates(rs);\r\n\r\n var server_addresses := MapSeqToSet(config.config.replica_ids, x=>x);\r\n assert Service_Init(sb[0], server_addresses);\r\n\r\n forall i {:trigger Service_Next(sb[i], sb[i+1])} | 0 <= i < |sb| - 1\r\n ensures sb[i] == sb[i+1] || Service_Next(sb[i], sb[i+1])\r\n {\r\n lemma_RslSystemNextImpliesServiceNext(rs[i], rs[i+1], sb[i], sb[i+1]);\r\n }\r\n\r\n forall i | 0 <= i < |db|\r\n ensures Service_Correspondence(db[i].environment.sentPackets, sb[i])\r\n {\r\n var concretePkts := db[i].environment.sentPackets;\r\n var serviceState := sb[i];\r\n\r\n var rsl := rs[i];\r\n var ps := protocol_behavior[i];\r\n assert RslSystemRefinement(ps, rsl);\r\n assert RenameToServiceState(rsl) == serviceState;\r\n\r\n forall p, seqno, reply | p in concretePkts && p.src in serviceState.serverAddresses && p.msg == MarshallServiceReply(seqno, reply)\r\n ensures AppReplyMessage(p.dst, seqno, reply) in serviceState.replies;\r\n {\r\n var abstract_p := AbstractifyConcretePacket(p);\r\n lemma_ServiceStateServerAddressesNeverChange(sb, server_addresses, i);\r\n assert serviceState.serverAddresses == server_addresses;\r\n assert p.src in config.config.replica_ids;\r\n lemma_PacketSentByServerIsMarshallable(config, db, i, p);\r\n lemma_ParseMarshallReply(p.msg, seqno, reply, abstract_p.msg);\r\n\r\n assert abstract_p in ps.environment.sentPackets && abstract_p.src in rsl.server_addresses && abstract_p.msg.RslMessage_Reply?;\r\n var r := Reply(abstract_p.dst, abstract_p.msg.seqno_reply, abstract_p.msg.reply);\r\n assert r in rsl.replies;\r\n var service_reply := RenameToAppReplyMessage(r);\r\n assert service_reply == AppReplyMessage(p.dst, seqno, reply);\r\n assert service_reply in serviceState.replies;\r\n }\r\n\r\n forall req | req in serviceState.requests\r\n ensures exists p :: p in concretePkts && p.dst in serviceState.serverAddresses\r\n && p.msg == MarshallServiceRequest(req.seqno, req.request)\r\n && p.src == req.client\r\n {\r\n var r_req :| r_req in rsl.requests && RenameToAppRequestMessage(r_req) == req;\r\n var abstract_p :| && abstract_p in ps.environment.sentPackets\r\n && abstract_p.dst in rsl.server_addresses\r\n && abstract_p.msg.RslMessage_Request?\r\n && r_req == Request(abstract_p.src, abstract_p.msg.seqno_req, abstract_p.msg.val);\r\n\r\n lemma_RequestSizeBounded(server_addresses, rs, i);\r\n assert |r_req.request| <= MaxAppRequestSize();\r\n\r\n assert ps.environment.sentPackets == AbstractifyConcreteSentPackets(concretePkts);\r\n var concrete_p :| concrete_p in concretePkts && AbstractifyConcretePacket(concrete_p) == abstract_p;\r\n assert concrete_p.dst in serviceState.serverAddresses;\r\n assert concrete_p.src == req.client;\r\n lemma_ParseMarshallRequest(concrete_p.msg, abstract_p.msg);\r\n assert concrete_p.msg == MarshallServiceRequest(req.seqno, req.request);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_FixFinalEnvStep(config:ConcreteConfiguration, db:seq) returns (db':seq)\r\n requires IsValidBehavior(config, db)\r\n ensures |db'| == |db|\r\n ensures DS_Init(db'[0], config)\r\n ensures forall i {:trigger DS_Next(db'[i], db'[i+1])} :: 0 <= i < |db'| - 1 ==> DS_Next(db'[i], db'[i+1])\r\n ensures last(db').environment.nextStep.LEnvStepStutter?\r\n ensures forall i :: 0 <= i < |db'| - 1 ==> db'[i] == db[i]\r\n ensures last(db') == last(db).(environment := last(db').environment)\r\n ensures last(db').environment == last(db).environment.(nextStep := LEnvStepStutter())\r\n{\r\n var sz := |db|;\r\n db' := all_but_last(db) + [last(db).(environment := last(db).environment.(nextStep := LEnvStepStutter()))];\r\n assert |db'| == |db|;\r\n forall i | 0 <= i < |db'| - 1\r\n ensures DS_Next(db'[i], db'[i+1])\r\n {\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i);\r\n if i == sz - 2\r\n {\r\n assert DS_Next(db'[i], db'[i+1]);\r\n }\r\n }\r\n}\r\n\r\nlemma RefinementProof(config:DS_s.H_s.ConcreteConfiguration, db:seq) returns (sb:seq)\r\n{\r\n var db' := lemma_FixFinalEnvStep(config, db);\r\n sb := lemma_RefinementProofForFixedBehavior(config, db');\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/RSL/Marshall.i.dfy", "content": "include \"AbstractService.s.dfy\"\r\ninclude \"../../Protocol/RSL/Message.i.dfy\"\r\ninclude \"../../Impl/RSL/PacketParsing.i.dfy\"\r\n\r\nmodule MarshallProof_i {\r\nimport opened Native__NativeTypes_s\r\nimport opened AppStateMachine_s\r\nimport opened AbstractServiceRSL_s \r\nimport opened LiveRSL__AppInterface_i\r\nimport opened LiveRSL__CMessage_i\r\nimport opened LiveRSL__CMessageRefinements_i\r\nimport opened LiveRSL__Message_i\r\nimport opened LiveRSL__PacketParsing_i\r\nimport opened Common__GenericMarshalling_i\r\nimport opened Common__Util_i\r\nimport opened Math__power2_i\r\n\r\nlemma lemma_ParseValCorrectVCase(data:seq, v:V, g:G) returns (caseId:uint64, val:V, rest:seq)\r\n requires ValInGrammar(v, g)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires ValidGrammar(g)\r\n requires parse_Val(data, g).0.Some?\r\n requires parse_Val(data, g).0.v == v\r\n requires g.GTaggedUnion?\r\n ensures parse_Uint64(data).0.Some?\r\n ensures caseId == parse_Uint64(data).0.v.u\r\n ensures 0 <= caseId as int < |g.cases|\r\n ensures rest == parse_Uint64(data).1\r\n ensures parse_Val(rest, g.cases[caseId]).0.Some?\r\n ensures val == parse_Val(rest, g.cases[caseId]).0.v\r\n ensures v == VCase(caseId, val)\r\n ensures ValInGrammar(val, g.cases[caseId])\r\n{\r\n reveal parse_Val();\r\n caseId := parse_Uint64(data).0.v.u;\r\n var tuple := parse_Val(parse_Uint64(data).1, g.cases[caseId]);\r\n val := tuple.0.v;\r\n rest := parse_Uint64(data).1;\r\n}\r\n\r\nlemma {:fuel ValInGrammar,3} lemma_ParseValCorrectTuple2(data:seq, v:V, g:G) returns (val0:V, val1:V, rest:seq)\r\n requires ValInGrammar(v, g)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires ValidGrammar(g)\r\n requires parse_Val(data, g).0.Some?\r\n requires parse_Val(data, g).0.v == v\r\n requires g.GTuple?\r\n requires |g.t| == 2\r\n\r\n ensures parse_Val(data, g.t[0]).0.Some?\r\n ensures val0 == parse_Val(data, g.t[0]).0.v\r\n ensures ValInGrammar(val0, g.t[0])\r\n\r\n ensures rest == parse_Val(data, g.t[0]).1\r\n ensures parse_Val(rest, g.t[1]).0.Some?\r\n ensures val1 == parse_Val(rest, g.t[1]).0.v\r\n ensures ValInGrammar(val1, g.t[1])\r\n\r\n ensures v == VTuple([val0, val1])\r\n{\r\n reveal parse_Val();\r\n reveal parse_Tuple_contents();\r\n\r\n // Prove that v == VTuple([val0, val1]);\r\n assert parse_Val(data, g).0.v == parse_Tuple(data, g.t).0.v == VTuple(parse_Tuple_contents(data, g.t).0.v);\r\n\r\n assert parse_Tuple_contents(data, g.t).0.v == [parse_Val(data, g.t[0]).0.v] \r\n + parse_Tuple_contents(parse_Val(data, g.t[0]).1, g.t[1..]).0.v;\r\n\r\n assert [parse_Val(data, g.t[0]).0.v] + parse_Tuple_contents(parse_Val(data, g.t[0]).1, g.t[1..]).0.v\r\n == [parse_Val(data, g.t[0]).0.v] + [parse_Val(parse_Val(data, g.t[0]).1, g.t[1]).0.v];\r\n\r\n assert [parse_Val(data, g.t[0]).0.v] + [parse_Val(parse_Val(data, g.t[0]).1, g.t[1]).0.v]\r\n == [parse_Val(data, g.t[0]).0.v, parse_Val(parse_Val(data, g.t[0]).1, g.t[1]).0.v];\r\n assert |v.t| == 2;\r\n var tuple0 := parse_Val(data, g.t[0]);\r\n assert tuple0.0.Some?;\r\n val0,rest := tuple0.0.v, tuple0.1;\r\n var tuple1 := parse_Val(rest, g.t[1]);\r\n var foo;\r\n val1,foo := tuple1.0.v, tuple1.1;\r\n\r\n // Prove that rest is set correctly\r\n assert parse_Val(data, g).1 == parse_Tuple(data, g.t).1 == parse_Tuple_contents(data, g.t).1;\r\n assert parse_Tuple_contents(data, g.t).1 == parse_Tuple_contents(parse_Val(data, g.t[0]).1, g.t[1..]).1;\r\n //assert parse_Tuple_contents(parse_Val(data, g.t[0]).1, g.t[1..]).1 == rest;\r\n}\r\n\r\nlemma lemma_ParseValCorrectVUint64(data:seq, v:V, g:G) returns (u:uint64, rest:seq)\r\n requires ValInGrammar(v, g)\r\n requires |data| < 0x1_0000_0000_0000_0000\r\n requires ValidGrammar(g)\r\n requires parse_Val(data, g).0.Some?\r\n requires parse_Val(data, g).0.v == v\r\n requires g.GUint64?\r\n ensures parse_Uint64(data).0.Some?\r\n ensures u == parse_Uint64(data).0.v.u\r\n ensures v == VUint64(u)\r\n ensures rest == parse_Val(data, g).1\r\n{\r\n reveal parse_Val();\r\n u := parse_Uint64(data).0.v.u;\r\n rest := parse_Uint64(data).1;\r\n}\r\n\r\nlemma ByteArrayOf8(bytes:seq, b:byte)\r\n requires |bytes| == 8\r\n requires SeqByteToUint64(bytes) == b as uint64\r\n ensures bytes == [ 0, 0, 0, 0, 0, 0, 0, b]\r\n{\r\n}\r\n\r\nlemma ByteConcat24(bytes:seq)\r\n requires |bytes| >= 24\r\n ensures bytes[0..24] == bytes[0..8] + bytes[8..16] + bytes[16..24]\r\n{\r\n}\r\n\r\nlemma ByteConcat32(bytes:seq)\r\n requires |bytes| >= 32\r\n ensures bytes[0..32] == bytes[0..8] + bytes[8..16] + bytes[16..24] + bytes[24..32]\r\n{\r\n}\r\n\r\nlemma {:fuel ValInGrammar,3} lemma_ParseMarshallRequest(bytes:seq, msg:RslMessage)\r\n requires msg.RslMessage_Request?\r\n requires CMessageIsAbstractable(PaxosDemarshallData(bytes))\r\n requires AbstractifyCMessageToRslMessage(PaxosDemarshallData(bytes)) == msg\r\n requires |msg.val| <= MaxAppRequestSize();\r\n ensures bytes == MarshallServiceRequest(msg.seqno_req, msg.val)\r\n{\r\n var cmsg := PaxosDemarshallData(bytes);\r\n assert cmsg.CMessage_Request?;\r\n assert cmsg.seqno as int == msg.seqno_req;\r\n assert AbstractifyCAppRequestToAppRequest(cmsg.val) == msg.val;\r\n\r\n var data := bytes;\r\n var g := CMessage_grammar();\r\n var v := DemarshallFunc(data, g);\r\n\r\n // Walk through the generic parsing process\r\n var msgCaseId, msgCaseVal, rest0 := lemma_ParseValCorrectVCase(data, v, g);\r\n var seqnoVal, appVal, rest1 := lemma_ParseValCorrectTuple2(rest0, msgCaseVal, g.cases[msgCaseId]);\r\n\r\n // Prove that the first 8 bytes are correct\r\n assert msgCaseId == 0;\r\n assert 0 == SeqByteToUint64(bytes[0..8]);\r\n ByteArrayOf8(bytes[0..8], 0);\r\n // Prove that the next 8 bytes are correct\r\n var u, rest := lemma_ParseValCorrectVUint64(rest0, seqnoVal, GUint64);\r\n assert msg.seqno_req == u as int;\r\n assert SeqByteToUint64(rest0[0..8]) == u;\r\n assert Uint64ToSeqByte(u) == AbstractServiceRSL_s.Uint64ToBytes(u);\r\n lemma_BEByteSeqToInt_BEUintToSeqByte_invertability();\r\n assert rest0[0..8] == Uint64ToSeqByte(msg.seqno_req as uint64);\r\n assert data[8..16] == rest0[0..8];\r\n reveal parse_Val();\r\n\r\n var request_len, rest2 := lemma_ParseValCorrectVUint64(rest1, VUint64(|msg.val| as uint64), GUint64);\r\n assert |msg.val| == request_len as int;\r\n assert Uint64ToSeqByte(request_len) == AbstractServiceRSL_s.Uint64ToBytes(request_len);\r\n assert rest1[0..8] == Uint64ToSeqByte(|msg.val| as uint64);\r\n assert rest1[8..] == rest2 == msg.val;\r\n\r\n calc {\r\n bytes;\r\n bytes[0..8] + rest0;\r\n [ 0, 0, 0, 0, 0, 0, 0, 0] + rest0;\r\n [ 0, 0, 0, 0, 0, 0, 0, 0] + (rest0[0..8] + rest1);\r\n [ 0, 0, 0, 0, 0, 0, 0, 0] + (Uint64ToBytes(msg.seqno_req as uint64) + rest1);\r\n [ 0, 0, 0, 0, 0, 0, 0, 0] + Uint64ToBytes(msg.seqno_req as uint64) + rest1;\r\n [ 0, 0, 0, 0, 0, 0, 0, 0] + Uint64ToBytes(msg.seqno_req as uint64) + (rest1[0..8] + rest1[8..]);\r\n [ 0, 0, 0, 0, 0, 0, 0, 0] + Uint64ToBytes(msg.seqno_req as uint64) + (Uint64ToBytes(|msg.val| as uint64) + rest1[8..]);\r\n [ 0, 0, 0, 0, 0, 0, 0, 0] + Uint64ToBytes(msg.seqno_req as uint64) + Uint64ToBytes(|msg.val| as uint64) + rest1[8..];\r\n [ 0, 0, 0, 0, 0, 0, 0, 0] + Uint64ToBytes(msg.seqno_req as uint64) + Uint64ToBytes(|msg.val| as uint64) + msg.val;\r\n MarshallServiceRequest(msg.seqno_req, msg.val);\r\n }\r\n}\r\n\r\nlemma {:timeLimitMultiplier 5} {:fuel ValInGrammar,3} lemma_ParseMarshallReply(bytes:seq, seqno:int, reply:AppReply, msg:RslMessage)\r\n requires CMessageIsAbstractable(PaxosDemarshallData(bytes))\r\n requires AbstractifyCMessageToRslMessage(PaxosDemarshallData(bytes)) == msg\r\n requires Marshallable(PaxosDemarshallData(bytes))\r\n requires bytes == MarshallServiceReply(seqno, reply)\r\n ensures msg.RslMessage_Reply?\r\n ensures msg.seqno_reply == seqno\r\n ensures msg.reply == reply\r\n{\r\n var marshalled_bytes := MarshallServiceReply(seqno, reply);\r\n var g := CMessage_grammar();\r\n if 0 <= seqno < 0x1_0000_0000_0000_0000 && |reply| <= MaxAppReplySize() {\r\n assert marshalled_bytes == [ 0, 0, 0, 0, 0, 0, 0, 6] + AbstractServiceRSL_s.Uint64ToBytes(seqno as uint64)\r\n + AbstractServiceRSL_s.Uint64ToBytes(|reply| as uint64) + reply;\r\n var cmsg := PaxosDemarshallData(bytes);\r\n var data := bytes;\r\n var v := DemarshallFunc(data, g);\r\n\r\n // Walk through the generic parsing process\r\n var msgCaseId, msgCaseVal, rest0 := lemma_ParseValCorrectVCase(data, v, g);\r\n assert msgCaseId == 6;\r\n var seqnoVal, appVal, rest1 := lemma_ParseValCorrectTuple2(rest0, msgCaseVal, g.cases[msgCaseId]);\r\n\r\n // Prove that the first 8 bytes are correct\r\n assert msgCaseId == SeqByteToUint64(bytes[..8]) == 6;\r\n assert cmsg.CMessage_Reply?;\r\n\r\n // Prove the seqno is parsed correctly\r\n assert rest0 == AbstractServiceRSL_s.Uint64ToBytes(seqno as uint64) + AbstractServiceRSL_s.Uint64ToBytes(|reply| as uint64) + reply;\r\n var u, rest := lemma_ParseValCorrectVUint64(rest0, seqnoVal, GUint64);\r\n lemma_2toX();\r\n calc {\r\n u;\r\n parse_Uint64(rest0).0.v.u;\r\n SeqByteToUint64(rest0[..8]);\r\n SeqByteToUint64(AbstractServiceRSL_s.Uint64ToBytes(seqno as uint64));\r\n SeqByteToUint64(Uint64ToSeqByte(seqno as uint64));\r\n SeqByteToUint64(BEUintToSeqByte(seqno as uint64 as int, 8));\r\n { lemma_BEByteSeqToInt_BEUintToSeqByte_invertability(); }\r\n seqno as uint64;\r\n }\r\n assert cmsg.seqno_reply as int == msg.seqno_reply;\r\n\r\n // Prove the app bytes are parsed correctly\r\n reveal parse_Val();\r\n\r\n var reply_len, rest2 := lemma_ParseValCorrectVUint64(rest1, VUint64(|msg.reply| as uint64), GUint64);\r\n assert |msg.reply| == reply_len as int;\r\n assert Uint64ToSeqByte(reply_len) == AbstractServiceRSL_s.Uint64ToBytes(reply_len);\r\n assert rest1[0..8] == Uint64ToSeqByte(|msg.reply| as uint64);\r\n assert rest1[8..] == rest2 == msg.reply;\r\n } else {\r\n assert bytes == [1];\r\n reveal parse_Val();\r\n assert parse_Val(bytes, g).0.None?;\r\n assert false;\r\n }\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/RSL/Program.cs", "content": "using IronfleetCommon;\nusing IronfleetIoFramework;\nusing IronRSL;\nusing MathNet.Numerics.Distributions;\nusing System;\nusing System.IO;\nusing System.Linq;\nusing System.Numerics;\nusing System.Threading;\n\nnamespace IronRSLServer\n{\n public class Params\n {\n private string serviceFileName;\n private string privateKeyFileName;\n private string localHostNameOrAddress;\n private int localPort;\n private bool profile;\n private bool progress;\n private bool verbose;\n private bool safeguard;\n\n public Params()\n {\n serviceFileName = \"\";\n privateKeyFileName = \"\";\n localHostNameOrAddress = \"\";\n localPort = 0;\n profile = false;\n progress = false;\n verbose = false;\n safeguard = true;\n }\n\n public string ServiceFileName { get { return serviceFileName; } }\n public string PrivateKeyFileName { get { return privateKeyFileName; } }\n public string LocalHostNameOrAddress { get { return localHostNameOrAddress; } }\n public int LocalPort { get { return localPort; } }\n public bool Profile { get { return profile; } }\n public bool Progress { get { return progress; } }\n public bool Verbose { get { return verbose; } }\n public bool Safeguard { get { return safeguard; } }\n\n public bool Validate()\n {\n if (serviceFileName.Length == 0) {\n Console.WriteLine(\"ERROR - Missing service parameter\");\n return false;\n }\n if (privateKeyFileName.Length == 0) {\n Console.WriteLine(\"ERROR - Missing private parameter\");\n return false;\n }\n return true;\n }\n\n public bool ProcessCommandLineArgument(string arg)\n {\n var pos = arg.IndexOf(\"=\");\n if (pos < 0) {\n if (serviceFileName.Length == 0) {\n serviceFileName = arg;\n return true;\n }\n else if (privateKeyFileName.Length == 0) {\n privateKeyFileName = arg;\n return true;\n }\n else {\n Console.WriteLine(\"ERROR - Invalid argument {0}\", arg);\n return false;\n }\n }\n var key = arg.Substring(0, pos).ToLower();\n var value = arg.Substring(pos + 1);\n return SetValue(key, value);\n }\n\n private bool SetBoolValue(string key, string value, ref bool p)\n {\n if (value == \"false\") {\n p = false;\n return true;\n }\n else if (value == \"true\") {\n p = true;\n return true;\n }\n else {\n Console.WriteLine(\"ERROR - Invalid {0} value {1} - should be false or true\", key, value);\n return false;\n }\n }\n\n private bool SetValue(string key, string value)\n {\n if (key == \"addr\") {\n localHostNameOrAddress = value;\n return true;\n }\n\n if (key == \"port\") {\n try {\n localPort = Convert.ToInt32(value);\n return true;\n }\n catch (Exception e) {\n Console.WriteLine(\"ERROR - Could not convert port {0} to a number. Exception:\\n{1}\", value, e);\n return false;\n }\n }\n\n if (key == \"profile\") {\n return SetBoolValue(key, value, ref profile);\n }\n\n if (key == \"progress\") {\n return SetBoolValue(key, value, ref progress);\n }\n\n if (key == \"verbose\") {\n return SetBoolValue(key, value, ref verbose);\n }\n\n if (key == \"safeguard\") {\n return SetBoolValue(key, value, ref safeguard);\n }\n\n Console.WriteLine(\"ERROR - Invalid argument key {0}\", key);\n return false;\n }\n }\n\n class Program\n {\n static void usage()\n {\n Console.Write(@\"\nUsage: dotnet IronRSL{0}Server.dll [key=value]...\n\n - file path of the service description\n - file path of the private key\n\nAllowed keys:\n addr - local host name or address to listen to (default:\n whatever's specified in the private key file)\n port - port to listen to (default: whatever's specified\n in the private key file)\n profile - print profiling info (false or true, default: false)\n progress - print progress (false or true, default: false)\n verbose - use verbose output (false or true, default: false)\n safeguard - delete the private key file after reading it to\n prevent running the same instance twice (false or\n true, default: true [see below])\n\nYou should only run an instance of this server once, since we haven't\nimplemented crash recovery. To prevent you from accidentally running\nit multiple times, this program deletes its private key file right\nafter reading it. You can override this behavior with\nsafeguard=false, but this is a VERY UNSAFE thing to do.\n\nFortunately, IronRSL can deal with the failure of fewer than half its\nservers. But, if half of them or more fail, you'll have to create a\nnew service. That is, you'll have to start over by running\nCreateIronServiceCerts, and that new service will be in its initial\nstate.\n\", Service.Name);\n }\n\n static void Main(string[] args)\n {\n Console.WriteLine(\"IronRSL{0}Server program started\", Service.Name);\n\n Console.WriteLine(\"Processing command-line arguments\");\n\n Params ps = new Params();\n\n foreach (var arg in args)\n {\n if (!ps.ProcessCommandLineArgument(arg)) {\n usage();\n return;\n }\n }\n\n if (!ps.Validate()) {\n usage();\n return;\n }\n\n ServiceIdentity serviceIdentity = ServiceIdentity.ReadFromFile(ps.ServiceFileName);\n if (serviceIdentity == null) {\n return;\n }\n if (serviceIdentity.ServiceType != \"IronRSL\" + Service.Name) {\n Console.Error.WriteLine(\"Provided service identity has type {0}, not IronRSL{1}.\",\n serviceIdentity.ServiceType, Service.Name);\n return;\n }\n\n PrivateIdentity privateIdentity = PrivateIdentity.ReadFromFile(ps.PrivateKeyFileName);\n if (privateIdentity == null) {\n return;\n }\n\n Native____Io__s_Compile.PrintParams.SetParameters(ps.Profile, ps.Progress);\n\n if (ps.Safeguard) {\n File.Delete(ps.PrivateKeyFileName);\n Console.WriteLine(\"Deleted private key file after reading it since RSL servers should never run twice.\");\n }\n else {\n Console.WriteLine(@\"\n *** DANGER: Because you specified safeguard=false, we didn't delete the ***\n *** private key file to prevent you from running the RSL server twice. ***\n *** Hopefully, you're just testing things. ***\n\");\n }\n\n var nc = Native____Io__s_Compile.NetClient.Create(privateIdentity, ps.LocalHostNameOrAddress, ps.LocalPort,\n serviceIdentity.Servers, ps.Verbose, serviceIdentity.UseSsl);\n Dafny.ISequence[] serverPublicKeys =\n serviceIdentity.Servers.Select(server => Dafny.Sequence.FromArray(nc.HashPublicKey(server.PublicKey))).ToArray();\n var ironArgs = Dafny.Sequence>.FromArray(serverPublicKeys);\n\n Profiler.Initialize();\n Native____Io__s_Compile.Time.Initialize();\n Console.WriteLine(\"[[READY]]\");\n Main__i_Compile.__default.IronfleetMain(nc, ironArgs);\n Console.WriteLine(\"[[EXIT]]\");\n }\n }\n}\n\nnamespace AppStateMachine__s_Compile\n{\n public partial class AppStateMachine\n {\n Service service;\n\n internal AppStateMachine(Service i_service)\n {\n service = i_service;\n }\n\n public static AppStateMachine Initialize()\n {\n return new AppStateMachine(Service.Initialize());\n }\n\n public static AppStateMachine Deserialize(Dafny.ISequence state)\n {\n return new AppStateMachine(Service.Deserialize(state.Elements));\n }\n\n public Dafny.ISequence Serialize()\n {\n return Dafny.Sequence.FromArray(service.Serialize());\n }\n\n public Dafny.ISequence HandleRequest(Dafny.ISequence request)\n {\n return Dafny.Sequence.FromArray(service.HandleRequest(request.Elements));\n }\n }\n}\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/RSL/RSLDistributedSystem.i.dfy", "content": "include \"../../Impl/RSL/Host.i.dfy\"\ninclude \"../../Common/Framework/DistributedSystem.s.dfy\"\n\nmodule RSL_DistributedSystem_i refines DistributedSystem_s {\n import H_s = Host_i\n}\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/SHT/.gitignore", "content": "Main.i.cs\nbuild/\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/SHT/AbstractService.s.dfy", "content": "include \"../../Common/Framework/AbstractService.s.dfy\"\r\ninclude \"AppInterface.s.dfy\"\r\ninclude \"HT.s.dfy\"\r\n\r\nmodule AbstractServiceSHT_s refines AbstractService_s {\r\nimport opened Bytes_s\r\nimport opened AppInterface_i`Spec\r\nimport opened SHT__HT_s\r\nexport Spec\r\n provides Native__Io_s, Environment_s, Native__NativeTypes_s\r\n provides ServiceState \r\n provides Service_Init, Service_Next, Service_Correspondence\r\n\r\n reveals AppRequest, AppReply\r\n provides AppInterface_i, SHT__HT_s\r\n provides MarshallServiceGetRequest, MarshallServiceSetRequest, MarshallServiceReply\r\nexport All reveals *\r\n\r\ndatatype AppRequest = AppGetRequest(g_seqno:int, g_k:Key) | AppSetRequest(s_seqno:int, s_k:Key, ov:OptionalValue)\r\ndatatype AppReply = AppReply(seqno:int, k:Key, ov:OptionalValue)\r\n \r\ndatatype ServiceState' = ServiceState'(\r\n serverAddresses:set,\r\n ht:Hashtable,\r\n requests:set,\r\n replies:set\r\n )\r\n\r\ntype ServiceState = ServiceState'\r\n\r\npredicate Service_Init(s:ServiceState, serverAddresses:set)\r\n{\r\n s.serverAddresses == serverAddresses\r\n && SpecInit(s.ht)\r\n && s.requests == {}\r\n && s.replies == {}\r\n}\r\n\r\n/*predicate Service_Next_ServerReceivesRequest(s:ServiceState, s':ServiceState, req:AppRequest)\r\n{\r\n s'.requests == s.requests + { req }\r\n}*/\r\n\r\npredicate Service_Next_ServerExecutesRequest(s:ServiceState, s':ServiceState, req:AppRequest, rep:AppReply)\r\n{\r\n s'.serverAddresses == s.serverAddresses\r\n && s'.requests == s.requests + { req }\r\n && (req.AppGetRequest? ==> Get(s.ht, s'.ht, req.g_k, rep.ov) && s'.replies == s.replies + { rep } && req.g_k == rep.k)\r\n && (req.AppSetRequest? ==> Set(s.ht, s'.ht, req.s_k, req.ov) && s'.replies == s.replies + { rep } && req.s_k == rep.k && req.ov == rep.ov)\r\n}\r\n\r\npredicate Service_Next(s:ServiceState, s':ServiceState)\r\n{\r\n exists request, reply :: Service_Next_ServerExecutesRequest(s, s', request, reply)\r\n //|| exists request :: Service_Next_ServerReceivesRequest(s, s', request)\r\n}\r\n\r\nfunction MarshallServiceGetRequest(app:AppRequest, reserved:seq) : seq\r\n requires app.AppGetRequest?\r\n{\r\n if 0 <= app.g_seqno < 0x1_0000_0000_0000_0000 && |reserved| < 0x10_0000 then\r\n [ 0, 0, 0, 0, 0, 0, 0, 0] // CSingleMessage_grammar magic number \r\n + Uint64ToBytes(app.g_seqno as uint64)\r\n + Uint64ToBytes(|reserved| as uint64)\r\n + reserved\r\n + [ 0, 0, 0, 0, 0, 0, 0, 0] // CMessage_GetRequest_grammar magic number\r\n + MarshallSHTKey(app.g_k)\r\n else\r\n [ 1 ]\r\n}\r\n\r\nfunction MarshallServiceSetRequest(app:AppRequest, reserved:seq) : seq\r\n requires app.AppSetRequest?\r\n{ \r\n if 0 <= app.s_seqno < 0x1_0000_0000_0000_0000 && |reserved| < 0x10_0000 then\r\n [ 0, 0, 0, 0, 0, 0, 0, 0] // CSingleMessage_grammar magic number \r\n + Uint64ToBytes(app.s_seqno as uint64)\r\n + Uint64ToBytes(|reserved| as uint64)\r\n + reserved\r\n + [ 0, 0, 0, 0, 0, 0, 0, 1] // CMessage_SetRequest_grammar magic number\r\n + MarshallSHTKey(app.s_k)\r\n + if app.ov.ValuePresent? then\r\n [ 0, 0, 0, 0, 0, 0, 0, 0] // ValuePresent magic number\r\n + MarshallSHTValue(app.ov.v)\r\n else\r\n [ 0, 0, 0, 0, 0, 0, 0, 1] // ValueAbsent magic number\r\n else\r\n [ 1 ]\r\n}\r\n\r\nfunction MarshallServiceReply(app:AppReply, reserved:seq) : seq\r\n{\r\n if 0 <= app.seqno < 0x1_0000_0000_0000_0000 && |reserved| < 0x10_0000 then\r\n [ 0, 0, 0, 0, 0, 0, 0, 0] // CSingleMessage_grammar magic number \r\n + Uint64ToBytes(app.seqno as uint64)\r\n + Uint64ToBytes(|reserved| as uint64)\r\n + reserved\r\n + [ 0, 0, 0, 0, 0, 0, 0, 2] // CMessage_Reply_grammar magic number\r\n + MarshallSHTKey(app.k)\r\n + if app.ov.ValuePresent? then\r\n [ 0, 0, 0, 0, 0, 0, 0, 0] // ValuePresent magic number\r\n + MarshallSHTValue(app.ov.v)\r\n else\r\n [ 0, 0, 0, 0, 0, 0, 0, 1] // ValueAbsent magic number\r\n else\r\n [ 1 ]\r\n}\r\n\r\npredicate Service_Correspondence(concretePkts:set>>, serviceState:ServiceState) \r\n{\r\n (forall p, reply, reserved_bytes :: \r\n p in concretePkts \r\n && p.src in serviceState.serverAddresses \r\n && p.msg == MarshallServiceReply(reply, reserved_bytes)\r\n && |reserved_bytes| < 0x10_0000\r\n ==> reply in serviceState.replies)\r\n && (forall req :: req in serviceState.requests && req.AppGetRequest? \r\n ==> exists p, reserved_bytes :: p in concretePkts && p.dst in serviceState.serverAddresses \r\n && p.msg == MarshallServiceGetRequest(req, reserved_bytes)\r\n && |reserved_bytes| < 0x10_0000)\r\n && (forall req :: req in serviceState.requests && req.AppSetRequest? \r\n ==> exists p, reserved_bytes :: p in concretePkts && p.dst in serviceState.serverAddresses \r\n && p.msg == MarshallServiceSetRequest(req, reserved_bytes)\r\n && |reserved_bytes| < 0x10_0000)\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/SHT/AppInterface.i.dfy", "content": "include \"AppInterface.s.dfy\"\r\ninclude \"Bytes.s.dfy\"\r\n\r\nmodule AppInterface_i refines AppInterface_s {\r\nimport opened Bytes_s\r\nexport Spec\r\n provides Native__NativeTypes_s\r\n reveals Key // provides Key REVIEW: triggers a Dafny bug\r\n provides Value\r\n provides KeyLt\r\n provides lemma_KeyOrdering\r\n provides KeyMin, ValidKey, ValidValue, MarshallSHTKey, MarshallSHTValue\r\nexport All reveals *\r\n\r\ntype Key(==, !new) = uint64\r\ntype Value = seq\r\n\r\npredicate method KeyLt(ka:Key, kb:Key) \r\n{\r\n ka < kb \r\n}\r\n\r\nlemma lemma_KeyOrdering()\r\n{\r\n}\r\n\r\nfunction max_key_len() : int { 16 } \r\nfunction max_val_len() : int { 1024 } \r\n\r\npredicate ValidKey(key:Key)\r\n{\r\n true \r\n}\r\n\r\npredicate ValidValue(v:Value)\r\n{\r\n |v| < max_val_len()\r\n}\r\n\r\nfunction method KeyMin() : Key { 0 }\r\n\r\nfunction MarshallSHTKey(k:Key) : seq\r\n{\r\n Uint64ToBytes(k)\r\n}\r\n\r\nfunction MarshallSHTValue(v:Value) : seq\r\n{\r\n if |v| < 0x1_0000_0000_0000_0000 then\r\n Uint64ToBytes(|v| as uint64) + v\r\n else\r\n [] // We only handle reasonably sized values\r\n}\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/SHT/AppInterface.s.dfy", "content": "include \"../../Common/Native/NativeTypes.s.dfy\"\r\n\r\nabstract module AppInterface_s {\r\n import opened Native__NativeTypes_s\r\n\r\n type Key(==, !new)\r\n type Value\r\n\r\n predicate method KeyLt(ka:Key, kb:Key) \r\n\r\n lemma lemma_KeyOrdering()\r\n ensures forall k,k' :: KeyLt(k,k') ==> !KeyLt(k',k); // Antisymmetry\r\n ensures forall k,k' :: !KeyLt(k,k') ==> KeyLt(k',k) || k' == k; \r\n ensures forall k,k',k'' :: KeyLt(k,k') && KeyLt(k',k'') ==> KeyLt(k, k''); // Transitivity\r\n\r\n function method KeyMin() : Key\r\n ensures forall k :: k == KeyMin() || KeyLt(KeyMin(), k);\r\n\r\n predicate ValidKey(key:Key)\r\n predicate ValidValue(v:Value)\r\n\r\n function MarshallSHTKey(k:Key) : seq\r\n function MarshallSHTValue(v:Value) : seq\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/SHT/Bytes.s.dfy", "content": "include \"../../Common/Native/NativeTypes.s.dfy\"\n\nmodule Bytes_s {\nimport opened Native__NativeTypes_s\n\nfunction Uint64ToBytes(u:uint64) : seq\n{\n [( u/0x1000000_00000000 ) as byte,\n ((u/ 0x10000_00000000)%0x100) as byte,\n ((u/ 0x100_00000000)%0x100) as byte,\n ((u/ 0x1_00000000)%0x100) as byte,\n ((u/ 0x1000000)%0x100) as byte,\n ((u/ 0x10000)%0x100) as byte,\n ((u/ 0x100)%0x100) as byte,\n ( u %0x100) as byte]\n}\n\n}\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/SHT/HT.s.dfy", "content": "include \"AppInterface.i.dfy\"\r\ninclude \"../../Common/Collections/Maps2.s.dfy\"\r\n\r\n////////////////////////////////////////////////////////\r\n// High-level spec for SHT is simply a hash table\r\n////////////////////////////////////////////////////////\r\n\r\nmodule SHT__HT_s {\r\n\r\nimport opened Collections__Maps2_s\r\nimport opened AppInterface_i`Spec\r\n\r\ndatatype OptionalValue = ValuePresent(v:Value) | ValueAbsent()\r\n\r\ntype Hashtable = map\r\n\r\npredicate SpecInit(h:Hashtable)\r\n{\r\n h == map []\r\n}\r\n\r\npredicate Set(h:Hashtable, h':Hashtable, k:Key, ov:OptionalValue)\r\n{\r\n h' == if ov.ValuePresent? then\r\n h[k := ov.v]\r\n else\r\n mapremove(h, k)\r\n}\r\n\r\npredicate Get(h:Hashtable, h':Hashtable, k:Key, ov:OptionalValue)\r\n{\r\n h' == h\r\n && ov == if k in h then ValuePresent(h[k]) else ValueAbsent()\r\n}\r\n\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/SHT/Main.i.dfy", "content": "include \"../../Common/Framework/Main.s.dfy\"\r\ninclude \"SHTDistributedSystem.i.dfy\"\r\ninclude \"../../Impl/LiveSHT/Host.i.dfy\"\r\ninclude \"../../Common/Collections/Maps2.s.dfy\"\r\ninclude \"../../Protocol/SHT/RefinementProof/RefinementProof.i.dfy\"\r\ninclude \"../../Protocol/Common/NodeIdentity.i.dfy\"\r\ninclude \"../../Protocol/LiveSHT/RefinementProof/SHTLemmas.i.dfy\"\r\ninclude \"Marshall.i.dfy\"\r\ninclude \"../../Protocol/SHT/Network.i.dfy\"\r\n\r\nmodule Main_i refines Main_s {\r\n import opened AS_s = AbstractServiceSHT_s`Spec\r\n import opened DS_s = SHT_DistributedSystem_i\r\n import opened DS_s.H_s\r\n import opened Math__mod_auto_i\r\n import opened Collections__Sets_i\r\n import opened Collections__Maps2_s\r\n import opened Collections__Maps2_i\r\n import opened Environment_s\r\n import opened Common__SeqIsUniqueDef_i\r\n import opened SHT__RefinementProof_i\r\n import opened Concrete_NodeIdentity_i\r\n import opened RefinementProof__DistributedSystemLemmas_i\r\n import opened MarshallProof_i\r\n import opened SHT__SHT_i\r\n import opened SHT__Network_i\r\n import opened SHT__Message_i\r\n import opened SHT__SingleMessage_i\r\n import opened SHT__Configuration_i\r\n import opened SHT__CMessage_i\r\n import opened SHT__PacketParsing_i\r\n import opened SHT__ConstantsState_i\r\n import opened SHT__SHTConcreteConfiguration_i\r\n import opened SHT__Host_i\r\n import opened SHT__Delegations_i\r\n import opened SHT__InvDefs_i\r\n import opened SHT__InvProof_i\r\n import opened SHT__Refinement_i\r\n import opened LiveSHT__NetSHT_i\r\n import opened LiveSHT__SHT_i\r\n import opened LiveSHT__Environment_i\r\n import opened LiveSHT__Scheduler_i\r\n import opened LiveSHT__Unsendable_i\r\n import opened LiveSHT__SHTRefinement_i\r\n import opened Common__GenericMarshalling_i\r\n import opened Common__NetClient_i\r\n import opened Common__NodeIdentity_i\r\n \r\n export\r\n provides DS_s, Native__Io_s, Native__NativeTypes_s\r\n provides IronfleetMain\r\n\r\n predicate IsValidBehavior(config:ConcreteConfiguration, db:seq)\r\n reads *;\r\n {\r\n |db| > 0\r\n && DS_Init(db[0], config)\r\n && (forall i {:trigger DS_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> DS_Next(db[i], db[i+1]))\r\n }\r\n\r\n predicate LPacketIsAbstractable(cp:LPacket>)\r\n {\r\n CSingleMessageIsAbstractable(SHTDemarshallData(cp.msg))\r\n }\r\n\r\n function AbstractifyConcretePacket(p:LPacket>) : LPacket>\r\n requires LPacketIsAbstractable(p);\r\n {\r\n LPacket(p.dst, p.src, AbstractifyCSingleMessageToSingleMessage(SHTDemarshallData(p.msg)))\r\n }\r\n\r\n predicate LEnvStepIsAbstractable(step:LEnvStep>)\r\n {\r\n match step {\r\n case LEnvStepHostIos(actor, ios) => NetEventLogIsAbstractable(ios)\r\n case LEnvStepDeliverPacket(p) => LPacketIsAbstractable(p)\r\n case LEnvStepAdvanceTime => true\r\n case LEnvStepStutter => true \r\n }\r\n }\r\n\r\n function AbstractifyConcreteEnvStep(step:LEnvStep>) : LEnvStep>\r\n requires LEnvStepIsAbstractable(step);\r\n {\r\n match step {\r\n case LEnvStepHostIos(actor, ios) => LEnvStepHostIos(actor, AbstractifyRawLogToIos(ios))\r\n case LEnvStepDeliverPacket(p) => LEnvStepDeliverPacket(AbstractifyConcretePacket(p))\r\n case LEnvStepAdvanceTime => LEnvStepAdvanceTime()\r\n case LEnvStepStutter => LEnvStepStutter() \r\n }\r\n }\r\n\r\n predicate ConcreteEnvironmentIsAbstractable(ds_env:LEnvironment>)\r\n {\r\n (forall p :: p in ds_env.sentPackets ==> LPacketIsAbstractable(p))\r\n && LEnvStepIsAbstractable(ds_env.nextStep)\r\n }\r\n\r\n function AbstractifyConcreteSentPackets(sent:set>>) : set>>\r\n requires forall p :: p in sent ==> LPacketIsAbstractable(p);\r\n {\r\n set p | p in sent :: AbstractifyConcretePacket(p)\r\n }\r\n\r\n function AbstractifyConcreteEnvironment(ds_env:LEnvironment>) : LEnvironment>\r\n requires ConcreteEnvironmentIsAbstractable(ds_env);\r\n {\r\n LEnvironment(ds_env.time,\r\n AbstractifyConcreteSentPackets(ds_env.sentPackets),\r\n map [],\r\n AbstractifyConcreteEnvStep(ds_env.nextStep))\r\n }\r\n\r\n function AbstractifyConcreteConfiguration(ds_config:ConcreteConfiguration) : SHTConfiguration\r\n requires ConstantsStateIsAbstractable(ds_config);\r\n {\r\n AbstractifyToConfiguration( \r\n SHTConcreteConfiguration(\r\n ds_config.hostIds,\r\n ds_config.rootIdentity,\r\n ds_config.params\r\n )\r\n )\r\n }\r\n\r\n function{:opaque} AbstractifyConcreteReplicas(replicas:map, replica_order:seq) : seq\r\n requires forall r :: r in replica_order ==> r in replicas;\r\n ensures |AbstractifyConcreteReplicas(replicas, replica_order)| == |replica_order|;\r\n ensures forall i {:trigger AbstractifyConcreteReplicas(replicas, replica_order)[i]} :: 0 <= i < |replica_order| ==> \r\n AbstractifyConcreteReplicas(replicas, replica_order)[i] == replicas[replica_order[i]].sched;\r\n {\r\n if replica_order == [] then []\r\n else\r\n [replicas[replica_order[0]].sched] + AbstractifyConcreteReplicas(replicas, replica_order[1..])\r\n }\r\n\r\n predicate DsStateIsAbstractable(ds:DS_State) \r\n {\r\n ConstantsStateIsValid(ds.config)\r\n && ConcreteEnvironmentIsAbstractable(ds.environment)\r\n && (forall r :: r in ds.config.hostIds ==> r in ds.servers)\r\n }\r\n\r\n function AbstractifyDsState(ds:DS_State) : LSHT_State\r\n requires DsStateIsAbstractable(ds);\r\n {\r\n LSHT_State(AbstractifyConcreteConfiguration(ds.config),\r\n AbstractifyConcreteEnvironment(ds.environment),\r\n AbstractifyConcreteReplicas(ds.servers, ds.config.hostIds))\r\n }\r\n\r\n lemma lemma_DeduceTransitionFromDsBehavior(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int\r\n )\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db| - 1;\r\n ensures DS_Next(db[i], db[i+1]);\r\n {\r\n }\r\n \r\n lemma lemma_DsNextOffset(db:seq, index:int)\r\n requires |db| > 0;\r\n requires 0 < index < |db|;\r\n requires forall i {:trigger DS_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> DS_Next(db[i], db[i+1]);\r\n ensures DS_Next(db[index-1], db[index]);\r\n {\r\n var i := index - 1;\r\n assert DS_Next(db[i], db[i+1]); // OBSERVE trigger for the forall\r\n }\r\n\r\n lemma lemma_DsConsistency(config:ConcreteConfiguration, db:seq, i:int)\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db|;\r\n ensures db[i].config == config;\r\n ensures Collections__Maps2_s.mapdomain(db[i].servers) == Collections__Maps2_s.mapdomain(db[0].servers);\r\n {\r\n if i == 0 {\r\n } else {\r\n lemma_DsConsistency(config, db, i-1);\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n\r\n assert forall server :: server in db[i-1].servers ==> server in db[i].servers;\r\n assert forall server :: server in db[i].servers ==> server in db[i-1].servers;\r\n\r\n forall server | server in Collections__Maps2_s.mapdomain(db[i-1].servers)\r\n ensures server in Collections__Maps2_s.mapdomain(db[i].servers)\r\n {\r\n assert server in db[i-1].servers;\r\n assert server in db[i].servers;\r\n }\r\n\r\n forall server | server in Collections__Maps2_s.mapdomain(db[i].servers)\r\n ensures server in Collections__Maps2_s.mapdomain(db[i-1].servers)\r\n {\r\n assert server in db[i].servers;\r\n assert server in db[i-1].servers;\r\n }\r\n }\r\n }\r\n \r\n lemma lemma_HostIdsConsistent(config:ConcreteConfiguration, db:seq, i:int, id:EndPoint, query:EndPoint)\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db|;\r\n requires id in db[i].servers;\r\n ensures query in db[i].servers[id].sched.host.constants.hostIds <==> query in config.hostIds;\r\n {\r\n lemma_DsConsistency(config, db, i); // ==> db[i].config == config\r\n if i == 0 {\r\n assert query in db[i].servers[id].sched.host.constants.hostIds <==> query in config.hostIds;\r\n } else {\r\n assert id in db[i].servers <==> id in Collections__Maps2_s.mapdomain(db[i].servers); // OBSERVE\r\n assert id in db[i-1].servers <==> id in Collections__Maps2_s.mapdomain(db[i-1].servers); // OBSERVE\r\n calc {\r\n Collections__Maps2_s.mapdomain(db[i].servers);\r\n Collections__Maps2_s.mapdomain(db[0].servers);\r\n { lemma_DsConsistency(config, db, i-1); }\r\n Collections__Maps2_s.mapdomain(db[i-1].servers);\r\n }\r\n lemma_HostIdsConsistent(config, db, i-1, id, query);\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n }\r\n }\r\n\r\n\r\n lemma lemma_PacketSentByServerIsMarshallable(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n p:LPacket>\r\n )\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db|;\r\n requires p.src in config.hostIds;\r\n requires p in db[i].environment.sentPackets;\r\n ensures NetPacketBound(p.msg);\r\n ensures CSingleMessageMarshallable(SHTDemarshallData(p.msg));\r\n {\r\n if i == 0 {\r\n return;\r\n }\r\n\r\n if p in db[i-1].environment.sentPackets {\r\n lemma_PacketSentByServerIsMarshallable(config, db, i-1, p);\r\n return;\r\n }\r\n\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n lemma_DsConsistency(config, db, i-1);\r\n assert LEnvironment_Next(db[i-1].environment, db[i].environment);\r\n assert db[i-1].environment.nextStep.LEnvStepHostIos?;\r\n var io := LIoOpSend(p);\r\n var ios := db[i-1].environment.nextStep.ios;\r\n assert io in ios;\r\n assert IsValidLIoOp(io, db[i-1].environment.nextStep.actor, db[i-1].environment);\r\n assert db[i-1].environment.nextStep.actor == p.src;\r\n assert DS_NextOneServer(db[i-1], db[i], p.src, ios);\r\n assert OnlySentMarshallableData(ios);\r\n assert NetPacketBound(io.s.msg);\r\n assert CSingleMessageMarshallable(SHTDemarshallData(io.s.msg));\r\n }\r\n \r\n lemma lemma_BufferedPacketFindRawPacket(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n id:EndPoint\r\n )\r\n returns(p:LPacket>)\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db|;\r\n requires id in db[i].servers;\r\n requires db[i].servers[id].sched.host.receivedPacket.Some?;\r\n ensures NetPacketIsAbstractable(p);\r\n ensures AbstractifyNetPacketToShtPacket(p) == db[i].servers[id].sched.host.receivedPacket.v;\r\n ensures p in db[i].environment.sentPackets;\r\n ensures p.dst == id;\r\n {\r\n if i == 0 {\r\n return;\r\n }\r\n\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n lemma_DsConsistency(config, db, i-1);\r\n\r\n if db[i].servers[id].sched.host.receivedPacket == db[i-1].servers[id].sched.host.receivedPacket {\r\n p := lemma_BufferedPacketFindRawPacket(config, db, i-1, id);\r\n return;\r\n }\r\n\r\n assert db[i-1].environment.nextStep.actor == id;\r\n p := db[i-1].environment.nextStep.ios[0].r;\r\n assert IsValidLIoOp(db[i-1].environment.nextStep.ios[0], id, db[i-1].environment);\r\n assert p.dst == id;\r\n }\r\n\r\n\r\n lemma lemma_FindReceivedRequestStepHelper(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n id:EndPoint,\r\n req_index:int\r\n )\r\n returns (step_before:int, step_after:int)\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db|;\r\n requires id in db[i].servers;\r\n requires 0 <= req_index < |db[i].servers[id].sched.host.receivedRequests|;\r\n ensures 0 <= step_before < step_after <= i;\r\n ensures step_after == step_before + 1;\r\n ensures id in db[step_before].servers;\r\n ensures id in db[step_after].servers;\r\n ensures |db[step_before].servers[id].sched.host.receivedRequests| == req_index;\r\n ensures |db[step_after].servers[id].sched.host.receivedRequests| == req_index + 1;\r\n {\r\n if i == 0 {\r\n assert false;\r\n }\r\n\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n lemma_DsConsistency(config, db, i-1);\r\n\r\n if db[i].servers[id].sched.host.receivedRequests == db[i-1].servers[id].sched.host.receivedRequests {\r\n step_before, step_after := lemma_FindReceivedRequestStepHelper(config, db, i-1, id, req_index);\r\n return;\r\n }\r\n\r\n assert |db[i].servers[id].sched.host.receivedRequests| == |db[i-1].servers[id].sched.host.receivedRequests| + 1;\r\n\r\n if |db[i-1].servers[id].sched.host.receivedRequests| > req_index {\r\n step_before, step_after := lemma_FindReceivedRequestStepHelper(config, db, i-1, id, req_index);\r\n return;\r\n }\r\n\r\n assert db[i-1].environment.nextStep.actor == id;\r\n step_before := i - 1;\r\n step_after := i;\r\n }\r\n\r\n lemma lemma_RecevedRequestsConsistent(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n j:int,\r\n id:EndPoint,\r\n req:AppRequest,\r\n req_index:int\r\n )\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i <= j < |db|;\r\n requires id in db[i].servers;\r\n requires 0 <= req_index < |db[i].servers[id].sched.host.receivedRequests|;\r\n requires db[i].servers[id].sched.host.receivedRequests[req_index] == req;\r\n ensures id in db[j].servers;\r\n ensures 0 <= req_index < |db[j].servers[id].sched.host.receivedRequests|;\r\n ensures db[j].servers[id].sched.host.receivedRequests[req_index] == req;\r\n {\r\n lemma_DsConsistency(config, db, i);\r\n lemma_DsConsistency(config, db, j);\r\n if j == i {\r\n return;\r\n } else {\r\n lemma_DsNextOffset(db, j);\r\n lemma_DeduceTransitionFromDsBehavior(config, db, j-1);\r\n lemma_RecevedRequestsConsistent(config, db, i, j - 1, id, req, req_index);\r\n }\r\n }\r\n\r\n lemma lemma_FindReceivedRequestStep(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n id:EndPoint,\r\n req:AppRequest,\r\n req_index:int\r\n )\r\n returns (step_before:int, step_after:int)\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db|;\r\n requires id in db[i].servers;\r\n requires 0 <= req_index < |db[i].servers[id].sched.host.receivedRequests|;\r\n requires db[i].servers[id].sched.host.receivedRequests[req_index] == req;\r\n ensures 0 <= step_before < step_after <= i;\r\n ensures step_after == step_before + 1;\r\n ensures id in db[step_before].servers;\r\n ensures id in db[step_after].servers;\r\n ensures |db[step_before].servers[id].sched.host.receivedRequests| == req_index;\r\n ensures |db[step_after].servers[id].sched.host.receivedRequests| == req_index + 1;\r\n ensures db[step_after].servers[id].sched.host.receivedRequests[req_index] == req;\r\n {\r\n step_before, step_after := lemma_FindReceivedRequestStepHelper(config, db, i, id, req_index);\r\n if db[step_after].servers[id].sched.host.receivedRequests[req_index] != req {\r\n var req' := db[step_after].servers[id].sched.host.receivedRequests[req_index];\r\n lemma_RecevedRequestsConsistent(config, db, step_after, i, id, req', req_index);\r\n }\r\n }\r\n \r\n lemma lemma_FindRawAppGetRequest(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n id:EndPoint,\r\n req:AppRequest,\r\n req_index:int\r\n )\r\n returns (step:int)\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db|;\r\n requires id in db[i].servers;\r\n requires 0 <= req_index < |db[i].servers[id].sched.host.receivedRequests|;\r\n requires db[i].servers[id].sched.host.receivedRequests[req_index] == req;\r\n requires req.AppGetRequest?;\r\n ensures 0 <= step <= i;\r\n ensures id in db[step].servers;\r\n ensures var h := db[step].servers[id].sched.host;\r\n h.receivedPacket.Some?\r\n && h.receivedPacket.v.msg.SingleMessage?\r\n && h.receivedPacket.v.msg.m.GetRequest?\r\n && req == AppGetRequest(h.receivedPacket.v.msg.seqno, h.receivedPacket.v.msg.m.k_getrequest);\r\n {\r\n var step_before, step_after := lemma_FindReceivedRequestStep(config, db, i, id, req, req_index);\r\n step := step_before;\r\n assert DS_Next(db[step], db[step+1]);\r\n }\r\n \r\n lemma lemma_FindRawAppSetRequest(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n id:EndPoint,\r\n req:AppRequest,\r\n req_index:int\r\n )\r\n returns (step:int)\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db|;\r\n requires id in db[i].servers;\r\n requires 0 <= req_index < |db[i].servers[id].sched.host.receivedRequests|;\r\n requires db[i].servers[id].sched.host.receivedRequests[req_index] == req;\r\n requires req.AppSetRequest?;\r\n ensures 0 <= step <= i;\r\n ensures id in db[step].servers;\r\n ensures var h := db[step].servers[id].sched.host;\r\n h.receivedPacket.Some?\r\n && h.receivedPacket.v.msg.SingleMessage?\r\n && h.receivedPacket.v.msg.m.SetRequest?\r\n && req == AppSetRequest(h.receivedPacket.v.msg.seqno, h.receivedPacket.v.msg.m.k_setrequest, h.receivedPacket.v.msg.m.v_setrequest);\r\n {\r\n var step_before, step_after := lemma_FindReceivedRequestStep(config, db, i, id, req, req_index);\r\n step := step_before;\r\n var h := db[step].servers[id].sched.host;\r\n assert DS_Next(db[step], db[step+1]);\r\n }\r\n \r\n lemma lemma_SentPacketIsValidPhysicalPacket(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n p:LPacket>\r\n )\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db|;\r\n requires p in db[i].environment.sentPackets;\r\n ensures ValidPhysicalPacket(p);\r\n {\r\n if i == 0 {\r\n return;\r\n }\r\n\r\n if p in db[i-1].environment.sentPackets {\r\n lemma_SentPacketIsValidPhysicalPacket(config, db, i-1, p);\r\n return;\r\n }\r\n\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n assert LEnvironment_Next(db[i-1].environment, db[i].environment);\r\n assert db[i-1].environment.nextStep.LEnvStepHostIos?;\r\n var io := LIoOpSend(p);\r\n assert io in db[i-1].environment.nextStep.ios;\r\n assert ValidPhysicalEnvironmentStep(db[i-1].environment.nextStep);\r\n }\r\n \r\n lemma lemma_NetEventIsAbstractable(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n net_event:NetEvent\r\n )\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db| - 1;\r\n requires db[i].environment.nextStep.LEnvStepHostIos?;\r\n requires net_event in db[i].environment.nextStep.ios;\r\n ensures NetEventIsAbstractable(net_event);\r\n {\r\n if net_event.LIoOpTimeoutReceive? || net_event.LIoOpReadClock? {\r\n return;\r\n }\r\n\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i);\r\n assert ValidPhysicalEnvironmentStep(db[i].environment.nextStep);\r\n assert ValidPhysicalIo(net_event);\r\n }\r\n\r\n lemma lemma_DsIsAbstractable(config:ConcreteConfiguration, db:seq, i:int)\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db|;\r\n requires LEnvStepIsAbstractable(last(db).environment.nextStep);\r\n ensures DsStateIsAbstractable(db[i]);\r\n {\r\n lemma_DsConsistency(config, db, i);\r\n\r\n forall p | p in db[i].environment.sentPackets\r\n ensures LPacketIsAbstractable(p);\r\n {\r\n lemma_SentPacketIsValidPhysicalPacket(config, db, i, p);\r\n }\r\n\r\n if i == |db|-1\r\n {\r\n return;\r\n }\r\n\r\n var step := db[i].environment.nextStep;\r\n if step.LEnvStepHostIos? {\r\n forall io | io in step.ios\r\n ensures NetEventIsAbstractable(io);\r\n {\r\n lemma_NetEventIsAbstractable(config, db, i, io);\r\n }\r\n assert NetEventLogIsAbstractable(step.ios);\r\n }\r\n else if step.LEnvStepDeliverPacket? {\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i);\r\n assert IsValidLEnvStep(db[i].environment, step);\r\n assert step.p in db[i].environment.sentPackets;\r\n lemma_SentPacketIsValidPhysicalPacket(config, db, i, step.p);\r\n }\r\n }\r\n\r\n lemma lemma_IosRelations(ios:seq>>, r_ios:seq>>)\r\n returns (sends:set>>, r_sends:set>>) \r\n requires NetEventLogIsAbstractable(ios);\r\n requires forall io :: io in ios && io.LIoOpSend? ==> LPacketIsAbstractable(io.s);\r\n requires r_ios == AbstractifyRawLogToIos(ios);\r\n ensures sends == (set io | io in ios && io.LIoOpSend? :: io.s);\r\n ensures r_sends == (set io | io in r_ios && io.LIoOpSend? :: io.s);\r\n ensures forall send :: send in sends ==> LPacketIsAbstractable(send);\r\n ensures r_sends == AbstractifyConcreteSentPackets(sends);\r\n {\r\n sends := (set io | io in ios && io.LIoOpSend? :: io.s);\r\n r_sends := (set io | io in r_ios && io.LIoOpSend? :: io.s);\r\n var refined_sends := AbstractifyConcreteSentPackets(sends);\r\n\r\n forall r | r in refined_sends\r\n ensures r in r_sends;\r\n {\r\n var send :| send in sends && AbstractifyConcretePacket(send) == r;\r\n var io :| io in ios && io.LIoOpSend? && io.s == send;\r\n assert AbstractifyNetEventToLSHTIo(io) in r_ios;\r\n }\r\n\r\n forall r | r in r_sends\r\n ensures r in refined_sends;\r\n {\r\n var r_io :| r_io in r_ios && r_io.LIoOpSend? && r_io.s == r; \r\n var j :| 0 <= j < |r_ios| && r_ios[j] == r_io;\r\n assert AbstractifyNetEventToLSHTIo(ios[j]) == r_io;\r\n assert ios[j] in ios;\r\n assert ios[j].s in sends;\r\n }\r\n }\r\n\r\n lemma lemma_IsValidEnvStep(de:LEnvironment>, le:LEnvironment>)\r\n requires IsValidLEnvStep(de, de.nextStep);\r\n requires de.nextStep.LEnvStepHostIos?;\r\n requires ConcreteEnvironmentIsAbstractable(de);\r\n requires AbstractifyConcreteEnvironment(de) == le;\r\n ensures IsValidLEnvStep(le, le.nextStep);\r\n {\r\n var id := de.nextStep.actor;\r\n var ios := de.nextStep.ios;\r\n var r_ios := le.nextStep.ios;\r\n\r\n assert LIoOpSeqCompatibleWithReduction(r_ios);\r\n \r\n forall io | io in r_ios\r\n ensures IsValidLIoOp(io, id, le);\r\n {\r\n var j :| 0 <= j < |r_ios| && r_ios[j] == io;\r\n assert r_ios[j] == AbstractifyNetEventToLSHTIo(ios[j]);\r\n assert IsValidLIoOp(ios[j], id, de);\r\n }\r\n }\r\n\r\n lemma lemma_LEnvironmentNextHost(de :LEnvironment>, le :LEnvironment>,\r\n de':LEnvironment>, le':LEnvironment>)\r\n requires ConcreteEnvironmentIsAbstractable(de);\r\n requires ConcreteEnvironmentIsAbstractable(de');\r\n requires AbstractifyConcreteEnvironment(de) == le;\r\n requires AbstractifyConcreteEnvironment(de') == le';\r\n requires de.nextStep.LEnvStepHostIos?;\r\n requires LEnvironment_Next(de, de');\r\n ensures LEnvironment_Next(le, le');\r\n {\r\n lemma_IsValidEnvStep(de, le);\r\n var id := de.nextStep.actor;\r\n var ios := de.nextStep.ios;\r\n var r_ios := le.nextStep.ios;\r\n\r\n assert LEnvironment_PerformIos(de, de', id, ios);\r\n\r\n var sends, r_sends := lemma_IosRelations(ios, r_ios);\r\n assert de.sentPackets + sends == de'.sentPackets;\r\n assert le.sentPackets + r_sends == le'.sentPackets;\r\n\r\n assert forall r_io :: r_io in r_ios && r_io.LIoOpReceive? ==> r_io.r in le.sentPackets;\r\n\r\n assert LEnvironment_PerformIos(le, le', id, r_ios);\r\n }\r\n\r\n predicate ReplicasDistinct(replica_ids:seq, i:int, j:int)\r\n {\r\n 0 <= i < |replica_ids| && 0 <= j < |replica_ids| && replica_ids[i] == replica_ids[j] ==> i == j\r\n }\r\n\r\n lemma lemma_LSchedulerNextPreservesConstants(\r\n s:LScheduler,\r\n s':LScheduler,\r\n ios:seq\r\n )\r\n requires LScheduler_Next(s, s', ios);\r\n ensures s.host.constants == s.host.constants;\r\n {\r\n }\r\n\r\n lemma {:timeLimitMultiplier 2} lemma_AllConfigConsistent(config:ConcreteConfiguration, db:seq, i:int, s:LSHT_State)\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db|;\r\n requires DsStateIsAbstractable(db[i]);\r\n requires s == AbstractifyDsState(db[i]);\r\n requires LEnvStepIsAbstractable(last(db).environment.nextStep);\r\n ensures db[i].config == config;\r\n ensures WFSHTConfiguration(s.config);\r\n ensures forall k :: 0 <= k < |s.config.hostIds| ==> s.hosts[k].host.me == s.config.hostIds[k];\r\n {\r\n if i == 0\r\n {\r\n assert DS_Init(db[0], config);\r\n lemma_DsIsAbstractable(config, db, 0);\r\n var ls := AbstractifyDsState(db[0]);\r\n //sb := [ ls ];\r\n\r\n // Prove LSHT_MapsComplete\r\n calc {\r\n |ls.hosts|;\r\n |AbstractifyConcreteReplicas(db[0].servers, db[0].config.hostIds)|;\r\n |db[0].config.hostIds|;\r\n |AbstractifyEndPointsToNodeIdentities(db[0].config.hostIds)|;\r\n |AbstractifyToConstants(db[0].config).hostIds|;\r\n |ls.config.hostIds|;\r\n }\r\n var shtconcreteconfig := SHTConcreteConfiguration(\r\n config.hostIds,\r\n config.rootIdentity,\r\n config.params\r\n );\r\n assert SHTConcreteConfigurationIsAbstractable(shtconcreteconfig)\r\n && shtconcreteconfig.rootIdentity in shtconcreteconfig.hostIds\r\n && 0 < |shtconcreteconfig.hostIds|;\r\n lemma_WFSHTConcreteConfiguration(shtconcreteconfig);\r\n forall i | 0 <= i < |ls.config.hostIds|\r\n ensures ls.hosts[i].host.me == ls.config.hostIds[i];\r\n {\r\n reveal_SeqIsUnique();\r\n }\r\n return;\r\n }\r\n lemma_DsConsistency(config, db, i-1);\r\n lemma_DsConsistency(config, db, i);\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n forall k | 0 <= k < |s.config.hostIds| \r\n ensures s.hosts[k].host.me == s.config.hostIds[k];\r\n {\r\n lemma_ConfigConsistent(config, db, i, k, s);\r\n }\r\n lemma_DsIsAbstractable(config, db, i-1);\r\n lemma_AllConfigConsistent(config, db, i-1, AbstractifyDsState(db[i-1]));\r\n }\r\n\r\n lemma {:timeLimitMultiplier 2} lemma_ConfigConsistent(config:ConcreteConfiguration, db:seq, i:int, k:int, s:LSHT_State)\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db|;\r\n requires DsStateIsAbstractable(db[i]);\r\n requires s == AbstractifyDsState(db[i]);\r\n requires LEnvStepIsAbstractable(last(db).environment.nextStep);\r\n requires 0 <= k < |s.config.hostIds|;\r\n ensures s.hosts[k].host.me == s.config.hostIds[k];\r\n {\r\n var id := s.config.hostIds[k];\r\n assert id in db[i].servers;\r\n \r\n if i == 0\r\n {\r\n assert DS_Init(db[0], config);\r\n lemma_DsIsAbstractable(config, db, 0);\r\n var ls := AbstractifyDsState(db[0]);\r\n //sb := [ ls ];\r\n\r\n // Prove LSHT_MapsComplete\r\n calc {\r\n |ls.hosts|;\r\n |AbstractifyConcreteReplicas(db[0].servers, db[0].config.hostIds)|;\r\n |db[0].config.hostIds|;\r\n |AbstractifyEndPointsToNodeIdentities(db[0].config.hostIds)|;\r\n |AbstractifyToConstants(db[0].config).hostIds|;\r\n |ls.config.hostIds|;\r\n }\r\n var shtconcreteconfig := SHTConcreteConfiguration(\r\n config.hostIds,\r\n config.rootIdentity,\r\n config.params\r\n );\r\n assert SHTConcreteConfigurationIsAbstractable(shtconcreteconfig)\r\n && shtconcreteconfig.rootIdentity in shtconcreteconfig.hostIds\r\n && 0 < |shtconcreteconfig.hostIds|;\r\n lemma_WFSHTConcreteConfiguration(shtconcreteconfig);\r\n forall i | 0 <= i < |ls.config.hostIds|\r\n ensures ls.hosts[i].host.me == ls.config.hostIds[i];\r\n {\r\n reveal_SeqIsUnique();\r\n }\r\n return;\r\n }\r\n lemma_DsConsistency(config, db, i-1);\r\n lemma_DsConsistency(config, db, i);\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n\r\n assert Collections__Maps2_s.mapdomain(db[i].servers) == Collections__Maps2_s.mapdomain(db[0].servers) == Collections__Maps2_s.mapdomain(db[i-1].servers);\r\n lemma_DsIsAbstractable(config, db, i-1);\r\n //lemma_ConfigConsistent(config, db, i-1, db[i-1].environment.nextStep.actor);\r\n\r\n \r\n\r\n if db[i-1].servers == db[i].servers// && db[i-1].config.hostIds == db[i].config.hostIds\r\n {\r\n var acr := AbstractifyConcreteReplicas(db[i-1].servers, db[i-1].config.hostIds); \r\n var acr' := AbstractifyConcreteReplicas(db[i].servers, db[i].config.hostIds); \r\n var ls := AbstractifyDsState(db[i-1]);\r\n var ls' := AbstractifyDsState(db[i]);\r\n assert ls.hosts == acr;\r\n assert ls'.hosts == acr';\r\n assert acr == acr';\r\n assert ls.hosts == ls'.hosts;\r\n lemma_ConfigConsistent(config, db, i-1, k, AbstractifyDsState(db[i-1]));\r\n /*var lsPrior := AbstractifyDsState(db[i-1]);\r\n assert forall i :: 0 <= i < |lsPrior.config.hostIds| ==> lsPrior.hosts[i].host.me == lsPrior.config.hostIds[i];\r\n assert lsPrior == ls;*/\r\n return;\r\n }\r\n assert db[i-1].environment.nextStep.LEnvStepHostIos? && db[i-1].environment.nextStep.actor in db[i-1].servers;\r\n \r\n \r\n var sc := db[i-1].servers[db[i-1].environment.nextStep.actor].sched;\r\n var sc' := db[i].servers[db[i-1].environment.nextStep.actor].sched;\r\n \r\n assert DS_NextOneServer(db[i-1], db[i], db[i-1].environment.nextStep.actor, db[i-1].environment.nextStep.ios);\r\n assert db[i].servers == db[i-1].servers[db[i-1].environment.nextStep.actor := db[i].servers[db[i-1].environment.nextStep.actor]];\r\n var ios :| DS_NextOneServer(db[i-1], db[i], db[i-1].environment.nextStep.actor, ios);\r\n var rios := AbstractifyRawLogToIos(ios);\r\n //assert HostNext(s.servers[id], s'.servers[id], ios)\r\n assert LScheduler_Next(sc, sc', rios) || HostNextIgnoreUnsendable(sc, sc', ios);\r\n lemma_ConfigConsistent(config, db, i-1, k, AbstractifyDsState(db[i-1]));\r\n if LScheduler_Next(sc, sc', rios)\r\n {\r\n var ls := AbstractifyDsState(db[i-1]);\r\n var ls' := AbstractifyDsState(db[i]);\r\n \r\n assert ls'.hosts[k].host.me == ls.hosts[k].host.me;\r\n assert ls'.hosts == AbstractifyConcreteReplicas(db[i].servers, db[i].config.hostIds);\r\n assert AbstractifyConcreteReplicas(db[i].servers, db[i].config.hostIds)[k] == db[i].servers[db[i].config.hostIds[k]].sched;\r\n assert ls'.hosts[k] == db[i].servers[db[i].config.hostIds[k]].sched;\r\n assert ls.hosts[k] == db[i-1].servers[db[i-1].config.hostIds[k]].sched;\r\n assert ls'.config.hostIds[k] == ls.config.hostIds[k];\r\n if (ls.config.hostIds[k] != db[i-1].environment.nextStep.actor) {\r\n assert ls'.hosts[k] == ls.hosts[k];\r\n } else {\r\n assert ls'.hosts[k].host.me == ls'.config.hostIds[k];\r\n }\r\n \r\n //lemma_LSchedulerNextPreservesConstants(s, s', rios);\r\n }\r\n else\r\n {\r\n //assert s'.host == s.host;\r\n }\r\n }\r\n\r\n lemma lemma_RefinementOfUnsendablePacketHasLimitedPossibilities(\r\n p:LPacket>,\r\n g:G,\r\n rp:LSHTPacket\r\n )\r\n requires g == CSingleMessage_grammar();\r\n requires ValidGrammar(g);\r\n requires !Demarshallable(p.msg, g) || !CSingleMessageMarshallable(parse_CSingleMessage(DemarshallFunc(p.msg, g)));\r\n requires NetPacketIsAbstractable(p);\r\n requires rp == AbstractifyNetPacketToLSHTPacket(p);\r\n ensures rp.msg.InvalidMessage?\r\n || rp.msg.SingleMessage? //&& !rp.msg.m.GetRequest?)\r\n {\r\n assert !rp.msg.Ack?;\r\n if Demarshallable(p.msg, g) {\r\n var cmsg := parse_CSingleMessage(DemarshallFunc(p.msg, g));\r\n if cmsg.CSingleMessage? {\r\n assert !EndPointIsValidPublicKey(cmsg.dst) || !MessageMarshallable(cmsg.m);\r\n }\r\n }\r\n }\r\n\r\n lemma lemma_IgnoringUnsendableGivesEmptySentPackets(ios:seq)\r\n requires |ios| == 1;\r\n requires ios[0].LIoOpReceive?;\r\n ensures ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios)) == {};\r\n {\r\n reveal_ExtractSentPacketsFromIos();\r\n }\r\n\r\n lemma lemma_IgnoringInvalidMessageIsLSchedulerNext(\r\n s:LScheduler,\r\n s':LScheduler,\r\n ios:seq\r\n )\r\n requires s.nextActionIndex == 0;\r\n requires s' == s.(nextActionIndex := (s.nextActionIndex + 1) % LHost_NumActions());\r\n requires |ios| == 1;\r\n requires ios[0].LIoOpReceive?;\r\n requires ios[0].r.msg.InvalidMessage?;\r\n requires DelegationMapComplete(s.host.delegationMap);\r\n ensures LScheduler_Next(s, s', ios);\r\n {\r\n var sent_packets := ExtractPacketsFromLSHTPackets(ExtractSentPacketsFromIos(ios));\r\n lemma_IgnoringUnsendableGivesEmptySentPackets(ios);\r\n assert sent_packets == {};\r\n var packet := Packet(ios[0].r.dst, ios[0].r.src, ios[0].r.msg);\r\n var ack;\r\n assert ReceivePacket(s.host, s'.host, packet, sent_packets, ack);\r\n assert ReceivePacket_Wrapper(s.host, s'.host, packet, sent_packets);\r\n assert LHost_ReceivePacketWithoutReadingClock(s.host, s'.host, ios);\r\n assert LHost_ReceivePacket_Next(s.host, s'.host, ios);\r\n }\r\n\r\n lemma lemma_IgnoringCertainMessageTypesFromNonServerIsLSchedulerNext(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n id:EndPoint,\r\n s:LScheduler,\r\n s':LScheduler,\r\n ios:seq>>\r\n )\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db| - 1;\r\n requires id in db[i].servers;\r\n requires id in db[i+1].servers;\r\n requires DelegationMapComplete(s.host.delegationMap);\r\n requires DsStateIsAbstractable(db[i]);\r\n requires s == db[i].servers[id].sched;\r\n requires s' == db[i+1].servers[id].sched;\r\n requires s.nextActionIndex == 1;\r\n requires IgnoreSchedulerUpdate(s, s');\r\n requires IosReflectIgnoringUnParseable(s, ios);\r\n ensures NetEventLogIsAbstractable(ios);\r\n ensures LScheduler_Next(s, s', AbstractifyRawLogToIos(ios));\r\n {\r\n assert |ios| == 0;\r\n assert NetEventLogIsAbstractable([]);\r\n assert AbstractifyRawLogToIos([]) == [];\r\n if s.host.receivedPacket.v.src in s.host.constants.hostIds {\r\n // No real host would have sent such a mangled packet\r\n var p := lemma_BufferedPacketFindRawPacket(config, db, i, id);\r\n //lemma_AllConfigConsistent(config, db, i, AbstractifyDsState(db[i]));\r\n lemma_HostIdsConsistent(config, db, i, id, s.host.receivedPacket.v.src);\r\n lemma_PacketSentByServerIsMarshallable(config, db, i, p);\r\n assert false;\r\n } else {\r\n // We ignore delegate messages from non-hosts\r\n assert NextDelegate(s.host, s'.host, s.host.receivedPacket.v, {});\r\n assert Process_Message(s.host, s'.host, {});\r\n assert ProcessReceivedPacket(s.host, s'.host, {});\r\n assert Host_Next(s.host, s'.host, {}, {});\r\n }\r\n }\r\n\r\n lemma lemma_HostNextIgnoreUnsendableIsLSchedulerNext(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n id:EndPoint,\r\n ios:seq>>\r\n )\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db| - 1;\r\n requires db[i].environment.nextStep == LEnvStepHostIos(id, ios);\r\n requires id in db[i].servers;\r\n requires id in db[i+1].servers;\r\n requires DsStateIsAbstractable(db[i]);\r\n requires DelegationMapComplete(db[i].servers[id].sched.host.delegationMap);\r\n requires HostNextIgnoreUnsendable(db[i].servers[id].sched, db[i+1].servers[id].sched, ios);\r\n ensures LScheduler_Next(db[i].servers[id].sched, db[i+1].servers[id].sched, AbstractifyRawLogToIos(ios));\r\n {\r\n var s := db[i].servers[id].sched;\r\n var s' := db[i+1].servers[id].sched;\r\n assert DS_Next(db[i], db[i+1]);\r\n if HostNextIgnoreUnsendableReceive(s, s', ios) {\r\n var p := ios[0].r;\r\n var rp := AbstractifyNetPacketToLSHTPacket(p);\r\n var g := CSingleMessage_grammar();\r\n assert !Demarshallable(p.msg, g) || !CSingleMessageMarshallable(parse_CSingleMessage(DemarshallFunc(p.msg, g)));\r\n\r\n if p.src in config.hostIds\r\n {\r\n lemma_PacketSentByServerIsMarshallable(config, db, i, p);\r\n assert false;\r\n }\r\n\r\n lemma_NetEventIsAbstractable(config, db, i, ios[0]);\r\n lemma_CMessageGrammarValid();\r\n assert |p.msg| < 0x1_0000_0000_0000_0000;\r\n assert |g.cases| < 0x1_0000_0000;\r\n //assert {:fuel ValidGrammar,5} ValidGrammar(g);\r\n\r\n var rios := AbstractifyRawLogToIos(ios);\r\n assert |rios| == 1;\r\n assert rios[0].r == rp;\r\n\r\n assert s.nextActionIndex == 0;\r\n calc {\r\n s'.nextActionIndex;\r\n 1;\r\n { lemma_mod_auto(LHost_NumActions()); }\r\n (s.nextActionIndex + 1) % LHost_NumActions();\r\n }\r\n lemma_RefinementOfUnsendablePacketHasLimitedPossibilities(p, g, rp);\r\n\r\n if rp.msg.InvalidMessage? {\r\n lemma_IgnoringInvalidMessageIsLSchedulerNext(s, s', rios);\r\n assert LScheduler_Next(db[i].servers[id].sched, db[i+1].servers[id].sched, AbstractifyRawLogToIos(ios));\r\n } else if rp.msg.Ack? {\r\n assert false;\r\n } else {\r\n lemma_DsConsistency(config, db, i);\r\n assert false;\r\n }\r\n } else {\r\n assert HostNextIgnoreUnsendableProcess(s, s', ios);\r\n lemma_IgnoringCertainMessageTypesFromNonServerIsLSchedulerNext(config, db, i, id, s, s', ios);\r\n }\r\n }\r\n\r\n lemma lemma_PacketsMonotonicStep(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int\r\n )\r\n requires IsValidBehavior(config, db);\r\n requires 0 < i < |db|;\r\n ensures db[i-1].environment.sentPackets <= db[i].environment.sentPackets;\r\n {\r\n lemma_DsConsistency(config, db, i);\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i-1);\r\n }\r\n\r\n lemma lemma_PacketsMonotonic(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n j:int\r\n )\r\n requires IsValidBehavior(config, db);\r\n requires 0 < i <= j < |db|;\r\n ensures db[i].environment.sentPackets <= db[j].environment.sentPackets;\r\n decreases j-i;\r\n {\r\n if i < j-1 {\r\n assert DS_Next(db[i], db[i+1]);\r\n lemma_PacketsMonotonic(config, db, i+1, j);\r\n } else if i == j-1 {\r\n lemma_PacketsMonotonicStep(config, db, j);\r\n assert DS_Next(db[i], db[i+1]);\r\n }\r\n }\r\n\r\n lemma {:timeLimitMultiplier 2} lemma_DelegationMapComplete(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n id:EndPoint\r\n )\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db| - 1;\r\n requires forall j :: 0 <= j < |db| ==> LEnvStepIsAbstractable(db[j].environment.nextStep);\r\n ensures id in db[i].servers ==> DelegationMapComplete(db[i].servers[id].sched.host.delegationMap);\r\n {\r\n if id in db[i].servers {\r\n if i == 0 {\r\n assert DelegationMapComplete(db[i].servers[id].sched.host.delegationMap);\r\n } else {\r\n lemma_DelegationMapComplete(config, db, i - 1, id);\r\n var i_minus_1 := i - 1;\r\n assert DS_Next(db[i_minus_1], db[i_minus_1+1]); // OBSERVE: trigger based on +1\r\n assert DS_Next(db[i-1], db[i]);\r\n if !(db[i-1].environment.nextStep.LEnvStepHostIos? && db[i-1].environment.nextStep.actor in db[i-1].servers) {\r\n assert db[i].servers == db[i-1].servers;\r\n assert DelegationMapComplete(db[i-1].servers[id].sched.host.delegationMap);\r\n } else {\r\n var sched := db[i-1].servers[id].sched;\r\n var sched' := db[i].servers[id].sched;\r\n var ios := db[i-1].environment.nextStep.ios;\r\n if id != db[i-1].environment.nextStep.actor {\r\n assert db[i].servers[id] == db[i-1].servers[id];\r\n } else {\r\n assert LScheduler_Next(sched, sched', AbstractifyRawLogToIos(ios))\r\n || HostNextIgnoreUnsendable(sched, sched', ios);\r\n if HostNextIgnoreUnsendable(sched, sched', ios) {\r\n assert DelegationMapComplete(db[i].servers[id].sched.host.delegationMap);\r\n } else {\r\n if sched.nextActionIndex == 0 {\r\n assert DelegationMapComplete(db[i].servers[id].sched.host.delegationMap);\r\n } else if sched.nextActionIndex == 1 {\r\n assert DelegationMapComplete(db[i].servers[id].sched.host.delegationMap);\r\n } else {\r\n assert DelegationMapComplete(db[i].servers[id].sched.host.delegationMap);\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n\r\n lemma {:timeLimitMultiplier 2} lemma_LSHTNext(\r\n config:ConcreteConfiguration,\r\n db:seq,\r\n i:int,\r\n ls:LSHT_State,\r\n ls':LSHT_State\r\n )\r\n requires IsValidBehavior(config, db);\r\n requires 0 <= i < |db| - 1;\r\n requires LEnvStepIsAbstractable(last(db).environment.nextStep);\r\n requires DsStateIsAbstractable(db[i]);\r\n requires DsStateIsAbstractable(db[i+1]);\r\n requires ls == AbstractifyDsState(db[i]);\r\n requires ls' == AbstractifyDsState(db[i+1]);\r\n requires db[i].environment.nextStep.LEnvStepHostIos? ==>\r\n var id := db[i].environment.nextStep.actor;\r\n id in db[i].servers ==> DelegationMapComplete(db[i].servers[id].sched.host.delegationMap);\r\n requires forall id :: id in db[i].servers ==> id in db[i].config.hostIds;\r\n ensures LSHT_Next(ls, ls');\r\n {\r\n var ds := db[i];\r\n var ds' := db[i+1];\r\n\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i);\r\n\r\n if !ds.environment.nextStep.LEnvStepHostIos? {\r\n return;\r\n }\r\n\r\n lemma_LEnvironmentNextHost(db[i].environment, ls.environment, db[i+1].environment, ls'.environment);\r\n\r\n var id := ds.environment.nextStep.actor;\r\n var ios := ds.environment.nextStep.ios;\r\n var r_ios := AbstractifyRawLogToIos(ios);\r\n var replicas := ds.config.hostIds;\r\n\r\n assert id in ds.servers <==> id in replicas;\r\n \r\n \r\n lemma_AllConfigConsistent(config, db, i, ls);\r\n lemma_AllConfigConsistent(config, db, i+1, ls');\r\n if id !in ds.servers {\r\n //assert !exists idx :: 0 <= idx < |replicas| && replicas[idx] == id;\r\n assert LSHT_NextExternal(ls, ls', id, r_ios);\r\n assert LSHT_Next(ls, ls');\r\n return;\r\n }\r\n var index :| 0 <= index < |replicas| && replicas[index] == id;\r\n \r\n assert ls.environment.nextStep == LEnvStepHostIos(id, r_ios);\r\n\r\n assert LScheduler_Next(ds.servers[id].sched, ds'.servers[id].sched, r_ios)\r\n || HostNextIgnoreUnsendable(ds.servers[id].sched, ds'.servers[id].sched, ios);\r\n if HostNextIgnoreUnsendable(ds.servers[id].sched, ds'.servers[id].sched, ios)\r\n {\r\n lemma_HostNextIgnoreUnsendableIsLSchedulerNext(config, db, i, id, ios);\r\n }\r\n assert LScheduler_Next(ds.servers[id].sched, ds'.servers[id].sched, r_ios);\r\n\r\n assert LEnvironment_Next(ds.environment, ds'.environment);\r\n lemma_LEnvironmentNextHost(ds.environment, ls.environment, ds'.environment, ls'.environment);\r\n assert LEnvironment_Next(ls.environment, ls'.environment);\r\n\r\n reveal_SeqIsUnique();\r\n forall other_idx | other_idx != index && 0 <= other_idx < |replicas|\r\n ensures replicas[other_idx] != replicas[index];\r\n {\r\n assert ReplicasDistinct(ls.config.hostIds, index, other_idx);\r\n }\r\n //assert RslNextOneReplica(ls, ls', index, r_ios);\r\n assert LSHT_NextOneHost(ls, ls', index, r_ios);\r\n assert LSHT_Next(ls, ls');\r\n }\r\n\r\n \r\n\r\n lemma {:timeLimitMultiplier 2} RefinementToLiveSHTProof(config:ConcreteConfiguration, db:seq) returns (sb:seq)\r\n requires |db| > 0;\r\n requires DS_Init(db[0], config);\r\n requires LEnvStepIsAbstractable(last(db).environment.nextStep);\r\n requires forall i {:trigger DS_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> DS_Next(db[i], db[i+1]);\r\n ensures |sb| == |db|;\r\n ensures LSHT_Init(AbstractifyConcreteConfiguration(db[0].config), sb[0]);\r\n ensures forall i {:trigger LSHT_Next(sb[i], sb[i+1])} :: 0 <= i < |sb| - 1 ==> LSHT_Next(sb[i], sb[i+1]);\r\n ensures forall i :: 0 <= i < |db| ==> DsStateIsAbstractable(db[i]) \r\n && sb[i] == AbstractifyDsState(db[i]);\r\n //ensures forall i :: 0 <= i < |db| ==> Service_Correspondence(db[i].environment.sentPackets, sb[i]);\r\n {\r\n var c := AbstractifyConcreteConfiguration(config);\r\n if |db| == 1 {\r\n lemma_DsIsAbstractable(config, db, 0);\r\n var ls := AbstractifyDsState(db[0]);\r\n sb := [ ls ];\r\n\r\n // Prove LSHT_MapsComplete\r\n calc {\r\n |ls.hosts|;\r\n |AbstractifyConcreteReplicas(db[0].servers, db[0].config.hostIds)|;\r\n |db[0].config.hostIds|;\r\n |AbstractifyEndPointsToNodeIdentities(db[0].config.hostIds)|;\r\n |AbstractifyToConstants(db[0].config).hostIds|;\r\n |ls.config.hostIds|;\r\n }\r\n var shtconcreteconfig := SHTConcreteConfiguration(\r\n config.hostIds,\r\n config.rootIdentity,\r\n config.params\r\n );\r\n assert SHTConcreteConfigurationIsAbstractable(shtconcreteconfig)\r\n && shtconcreteconfig.rootIdentity in shtconcreteconfig.hostIds\r\n && 0 < |shtconcreteconfig.hostIds|;\r\n lemma_WFSHTConcreteConfiguration(shtconcreteconfig);\r\n \r\n forall i | 0 <= i < |c.hostIds|\r\n ensures ls.hosts[i].host.me == ls.config.hostIds[i];\r\n {\r\n reveal_SeqIsUnique();\r\n }\r\n } else {\r\n lemma_DsConsistency(config, db, |db|-1);\r\n lemma_DeduceTransitionFromDsBehavior(config, db, |db|-2);\r\n lemma_DsIsAbstractable(config, db, |db|-1);\r\n lemma_DsIsAbstractable(config, db, |db|-2);\r\n\r\n var ls' := AbstractifyDsState(last(db));\r\n var rest := RefinementToLiveSHTProof(config, all_but_last(db));\r\n assert forall i {:trigger LSHT_Next(rest[i], rest[i+1])} :: 0 <= i < |rest| - 1 ==> LSHT_Next(rest[i], rest[i+1]);\r\n sb := rest + [ls'];\r\n\r\n // Help with sequence indexing\r\n forall i | 0 <= i < |db| \r\n ensures DsStateIsAbstractable(db[i]);\r\n ensures sb[i] == AbstractifyDsState(db[i]);\r\n {\r\n lemma_DsIsAbstractable(config, db, i);\r\n if i < |db| - 1 {\r\n assert db[i] == all_but_last(db)[i];\r\n assert sb[i] == AbstractifyDsState(all_but_last(db)[i]);\r\n assert sb[i] == AbstractifyDsState(db[i]);\r\n } else {\r\n assert sb[i] == ls';\r\n assert i == |db| - 1;\r\n assert db[i] == last(db);\r\n assert sb[i] == AbstractifyDsState(db[i]);\r\n }\r\n }\r\n\r\n // Prove the crucial ensures\r\n forall i | 0 <= i < |sb| - 1 \r\n ensures LSHT_Next(sb[i], sb[i+1]);\r\n {\r\n if i < |sb| - 2 {\r\n // Induction hypothesis\r\n assert LSHT_Next(sb[i], sb[i+1]);\r\n } else {\r\n forall id | id in db[i].servers\r\n ensures id in db[i].config.hostIds;\r\n {\r\n calc ==> {\r\n id in db[i].servers;\r\n id in Collections__Maps2_s.mapdomain(db[i].servers);\r\n { lemma_DsConsistency(config, db, i); }\r\n id in Collections__Maps2_s.mapdomain(db[0].servers);\r\n id in db[0].config.hostIds;\r\n { lemma_DsConsistency(config, db, i); }\r\n id in db[i].config.hostIds;\r\n }\r\n }\r\n// var sht_states,_ := RefinementToSHTSequence(c, all_but_last(sb));\r\n// InvHolds(c, sht_states);\r\n if db[i].environment.nextStep.LEnvStepHostIos? {\r\n lemma_DelegationMapComplete(config, db, i, db[i].environment.nextStep.actor);\r\n }\r\n lemma_LSHTNext(config, db, i, sb[i], sb[i+1]);\r\n assert LSHT_Next(sb[i], sb[i+1]);\r\n }\r\n }\r\n //assume false;\r\n }\r\n }\r\n \r\n lemma InvHolds(config:SHTConfiguration, db:seq) \r\n requires |db| > 0;\r\n requires SHT_Init(config, db[0]);\r\n requires forall i {:trigger SHT_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> db[i] == db[i+1] || SHT_Next(db[i], db[i+1]);\r\n ensures forall i {:trigger Inv(db[i])} :: 0 <= i < |db| ==> Inv(db[i]);\r\n ensures forall i {:trigger MapComplete(db[i])} :: 0 <= i < |db| ==> MapComplete(db[i]);\r\n ensures forall i {:trigger AllDelegationsToKnownHosts(db[i])} :: 0 <= i < |db| ==> AllDelegationsToKnownHosts(db[i]);\r\n {\r\n if |db| == 1 {\r\n InitInv(config, db[0]);\r\n } else {\r\n InvHolds(config, all_but_last(db));\r\n assert forall i :: 0 <= i < |all_but_last(db)| ==> Inv(all_but_last(db)[i]);\r\n var d := last(all_but_last(db));\r\n var d' := last(db);\r\n var penultimate_index := |db| - 2;\r\n if db[penultimate_index] != db[penultimate_index + 1] {\r\n calc {\r\n SHT_Next(db[penultimate_index], db[penultimate_index + 1]); // OBSERVE: +1 needed for trigger\r\n SHT_Next(d, d');\r\n }\r\n NextInv(d, d');\r\n }\r\n assert Inv(d');\r\n assert forall i :: 0 <= i < |db| ==> Inv(db[i]);\r\n }\r\n }\r\n\r\n lemma {:timeLimitMultiplier 20} RefinementToServiceStateSequence(config:SHTConfiguration, db:seq) returns (sb:seq)\r\n requires |db| > 0;\r\n requires SHT_Init(config, db[0]);\r\n requires forall i {:trigger SHT_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> db[i] == db[i+1] || SHT_Next(db[i], db[i+1]);\r\n ensures |sb| == |db|;\r\n ensures forall i {:trigger MapComplete(db[i])} :: 0 <= i < |db| ==> MapComplete(db[i]);\r\n ensures forall i {:trigger PacketsHaveSaneHeaders(db[i])} :: 0 <= i < |db| ==> PacketsHaveSaneHeaders(db[i]);\r\n ensures forall i {:trigger AllDelegationsToKnownHosts(db[i])} :: 0 <= i < |db| ==> AllDelegationsToKnownHosts(db[i]);\r\n ensures forall i {:trigger Refinement(db[i])} :: 0 <= i < |db| ==> Refinement(db[i]) == sb[i];\r\n ensures Service_Init(sb[0], MapSeqToSet(config.hostIds, x => x));\r\n ensures forall i {:trigger Service_Next(sb[i], sb[i+1])} :: 0 <= i < |sb| - 1 ==> sb[i] == sb[i+1] || Service_Next(sb[i], sb[i+1]);\r\n //ensures forall i :: 0 <= i < |db| ==> Service_Correspondence(db[i].environment.sentPackets, sb[i]);\r\n {\r\n if |db| == 1 {\r\n sb := [Refinement(db[0])];\r\n } else {\r\n InvHolds(config, db);\r\n var sb_others := RefinementToServiceStateSequence(config, all_but_last(db));\r\n assert forall i :: 0 <= i < |all_but_last(db)| ==> Refinement(all_but_last(db)[i]) == sb_others[i];\r\n var d := last(all_but_last(db));\r\n var d' := last(db);\r\n var s := Refinement(d);\r\n \r\n var penultimate_index := |db| - 2;\r\n if db[penultimate_index] != db[penultimate_index + 1] {\r\n calc {\r\n SHT_Next(db[penultimate_index], db[penultimate_index + 1]); // OBSERVE: +1 needed for trigger\r\n SHT_Next(d, d');\r\n }\r\n NextRefinesService(d, d');\r\n }\r\n var s' := Refinement(d');\r\n sb := sb_others + [s'];\r\n if Service_Next(s, s') {\r\n assert last(sb_others) == s;\r\n assert forall i {:trigger Service_Next(sb[i], sb[i+1])} :: 0 <= i < |sb| - 1 ==> sb[i] == sb[i+1] || Service_Next(sb[i], sb[i+1]);\r\n } else {\r\n assert ServiceStutter(s, s');\r\n }\r\n }\r\n }\r\n \r\n\r\n lemma lemma_SHTRefinementInvariantAppend(db:seq)\r\n requires |db| > 0;\r\n requires forall i :: 0 <= i < |db|-1 ==> LSHTState_RefinementInvariant(db[i]); \r\n requires LSHTState_RefinementInvariant(db[|db|-1]);\r\n ensures forall i :: 0 <= i < |db| ==> LSHTState_RefinementInvariant(db[i]); \r\n {\r\n }\r\n\r\n lemma {:timeLimitMultiplier 3} RefinementToSHTSequence(config:SHTConfiguration, db:seq) returns (sb:seq)\r\n requires |db| > 0;\r\n requires LSHT_Init(config, db[0]);\r\n requires forall i {:trigger LSHT_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> LSHT_Next(db[i], db[i+1]);\r\n ensures forall i {:trigger LSHTState_RefinementInvariant(db[i])} :: 0 <= i < |db| ==> LSHTState_RefinementInvariant(db[i]);\r\n ensures forall i {:trigger LSHT_MapsComplete(db[i])} :: 0 <= i < |db| ==> LSHT_MapsComplete(db[i]);\r\n ensures |sb| == |db|;\r\n ensures forall i {:trigger LSHTState_Refine(db[i])} :: 0 <= i < |db| ==> LSHTState_Refine(db[i]) == sb[i];\r\n ensures SHT_Init(config, sb[0]);\r\n ensures forall i {:trigger SHT_Next(sb[i], sb[i+1])} :: 0 <= i < |sb| - 1 ==> sb[i] == sb[i+1] || SHT_Next(sb[i], sb[i+1]);\r\n //ensures forall i :: 0 <= i < |db| ==> Service_Correspondence(db[i].environment.sentPackets, sb[i]);\r\n {\r\n \r\n if |db| == 1 {\r\n sb := [LSHTState_Refine(db[0])];\r\n } else {\r\n var sb_others := RefinementToSHTSequence(config, all_but_last(db));\r\n var d := last(all_but_last(db));\r\n var d' := last(db);\r\n var penultimate_index := |db| - 2;\r\n assert forall i :: 0 <= i < |all_but_last(db)| ==> LSHTState_RefinementInvariant(all_but_last(db)[i]);\r\n\r\n calc {\r\n LSHT_Next(db[penultimate_index], db[penultimate_index + 1]); // OBSERVE: +1 needed for trigger\r\n LSHT_Next(d, d');\r\n }\r\n\r\n Lemma_LSHTNextImpliesSHTNext(d, d');\r\n \r\n sb := sb_others + [LSHTState_Refine(last(db))];\r\n \r\n assert LSHTState_RefinementInvariant(last(db));\r\n lemma_SHTRefinementInvariantAppend(db);\r\n assert forall i :: 0 <= i < |db| ==> LSHTState_RefinementInvariant(db[i]);\r\n assert forall i :: 0 <= i < |all_but_last(db)| ==> LSHTState_Refine(all_but_last(db)[i]) == sb_others[i];\r\n assert forall i :: 0 <= i < |db|-1 ==> LSHTState_Refine(db[i]) == sb[i];\r\n assert LSHTState_Refine(last(db)) == last(sb);\r\n }\r\n }\r\n\r\n ghost method FixFinalEnvStep(config:ConcreteConfiguration, db:seq) returns (db':seq)\r\n requires IsValidBehavior(config, db);\r\n ensures |db'| == |db|;\r\n ensures DS_Init(db'[0], config);\r\n ensures forall i {:trigger DS_Next(db'[i], db'[i+1])} :: 0 <= i < |db'| - 1 ==> DS_Next(db'[i], db'[i+1]);\r\n ensures last(db').environment.nextStep.LEnvStepStutter?;\r\n ensures forall i :: 0 <= i < |db'| - 1 ==> db'[i] == db[i];\r\n ensures last(db') == last(db).(environment := last(db').environment);\r\n ensures last(db').environment == last(db).environment.(nextStep := LEnvStepStutter());\r\n ensures LEnvStepIsAbstractable(last(db').environment.nextStep);\r\n {\r\n var sz := |db|;\r\n db' := all_but_last(db) + [last(db).(environment := last(db).environment.(nextStep := LEnvStepStutter()))];\r\n assert |db'| == |db|;\r\n forall i | 0 <= i < |db'| - 1\r\n ensures DS_Next(db'[i], db'[i+1]);\r\n {\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i);\r\n if i == sz - 2\r\n {\r\n assert DS_Next(db'[i], db'[i+1]);\r\n }\r\n }\r\n assert last(db').environment.nextStep.LEnvStepStutter?;\r\n }\r\n\r\n lemma SequenceSortedProperty(s:seq, i:int, j:int)\r\n requires |s| > 0;\r\n requires forall i,j :: (0 <= i < |s| - 1) && (j == i+1) ==> s[i] <= s[j];\r\n requires 0 <= i <= j < |s|\r\n ensures s[i] <= s[j];\r\n decreases j-i;\r\n {\r\n if (i == j) {\r\n assert s[i] <= s[j];\r\n } else {\r\n SequenceSortedProperty(s, i+1, j);\r\n } \r\n }\r\n\r\n lemma lemma_ServiceStateServerAddressesNeverChange(sb:seq, server_addresses:set, i:int)\r\n requires |sb| > 0;\r\n requires Service_Init(sb[0], server_addresses);\r\n requires forall j {:trigger Service_Next(sb[j], sb[j+1])} :: 0 <= j < |sb| - 1 ==> sb[j] == sb[j+1] || Service_Next(sb[j], sb[j+1]);\r\n requires 0 <= i < |sb|;\r\n ensures sb[i].serverAddresses == server_addresses;\r\n {\r\n if i == 0 {\r\n return;\r\n }\r\n\r\n var j := i-1;\r\n assert sb[j] == sb[j+1] || Service_Next(sb[j], sb[j+1]);\r\n assert i == j+1;\r\n assert sb[i-1] == sb[i] || Service_Next(sb[i-1], sb[i]);\r\n assert sb[i].serverAddresses == sb[i-1].serverAddresses;\r\n lemma_ServiceStateServerAddressesNeverChange(sb, server_addresses, i-1);\r\n }\r\n\r\n predicate HostStateReq(sht_state:SHT_State, req:AppRequest)\r\n {\r\n exists h,req_index :: h in maprange(sht_state.hosts) && 0 <= req_index < |h.receivedRequests| && req == h.receivedRequests[req_index]\r\n }\r\n\r\n lemma {:timeLimitMultiplier 4} RefinementProofForFixedBehavior(config:ConcreteConfiguration, db:seq) returns (sb:seq)\r\n requires |db| > 0;\r\n requires DS_Init(db[0], config);\r\n requires forall i {:trigger DS_Next(db[i], db[i+1])} :: 0 <= i < |db| - 1 ==> DS_Next(db[i], db[i+1]);\r\n requires last(db).environment.nextStep.LEnvStepStutter?;\r\n ensures |db| == |sb|;\r\n ensures Service_Init(sb[0], Collections__Maps2_s.mapdomain(db[0].servers));\r\n ensures forall i {:trigger Service_Next(sb[i], sb[i+1])} :: 0 <= i < |sb| - 1 ==> sb[i] == sb[i+1] || Service_Next(sb[i], sb[i+1]);\r\n ensures forall i {:trigger Service_Correspondence(db[i].environment.sentPackets, sb[i])} :: 0 <= i < |db| ==> Service_Correspondence(db[i].environment.sentPackets, sb[i]);\r\n {\r\n var sht_config := AbstractifyConcreteConfiguration(config);\r\n //var db' := FixFinalEnvStep(config, db);\r\n var lsht_states := RefinementToLiveSHTProof(config, db);\r\n var sht_states := RefinementToSHTSequence(sht_config, lsht_states);\r\n var service_states := RefinementToServiceStateSequence(sht_config, sht_states);\r\n \r\n sb := service_states;\r\n var server_addresses := MapSeqToSet(config.hostIds, x=>x);\r\n assert Service_Init(sb[0], server_addresses);\r\n\r\n forall i {:trigger Service_Next(sb[i], sb[i+1])} | 0 <= i < |sb| - 1\r\n ensures sb[i] == sb[i+1] || Service_Next(sb[i], sb[i+1]);\r\n {\r\n }\r\n\r\n forall i | 0 <= i < |db|\r\n ensures Service_Correspondence(db[i].environment.sentPackets, sb[i]);\r\n {\r\n var concretePkts := db[i].environment.sentPackets;\r\n var serviceState := sb[i];\r\n var lsht_state := lsht_states[i];\r\n var sht_state := sht_states[i];\r\n\r\n forall p, reply, reserved_bytes | \r\n p in concretePkts \r\n && p.src in serviceState.serverAddresses \r\n && p.msg == MarshallServiceReply(reply, reserved_bytes)\r\n && |reserved_bytes| < 0x10_0000\r\n ensures reply in serviceState.replies;\r\n {\r\n var lsht_packet := AbstractifyConcretePacket(p);\r\n lemma_ServiceStateServerAddressesNeverChange(sb, server_addresses, i);\r\n assert serviceState.serverAddresses == server_addresses;\r\n assert p.src in config.hostIds;\r\n lemma_PacketSentByServerIsMarshallable(config, db, i, p);\r\n lemma_ParseMarshallReply(p.msg, reply, lsht_packet.msg, reserved_bytes);\r\n\r\n assert lsht_packet.src in serviceState.serverAddresses && lsht_packet.msg.m.Reply?;\r\n lemma_DsIsAbstractable(config, db, i);\r\n assert lsht_state == AbstractifyDsState(db[i]);\r\n assert sht_state == LSHTState_Refine(lsht_state);\r\n assert serviceState == Refinement(sht_state);\r\n assert lsht_packet in lsht_state.environment.sentPackets;\r\n var sht_packet := LSHTPacketToPacket(lsht_packet);\r\n assert sht_packet in sht_state.network && sht_packet.msg.SingleMessage? && sht_packet.msg.m.Reply? && sht_packet.src in sht_state.hosts;\r\n //assume reply.client == sht_packet.dst;\r\n assert reply.seqno == sht_packet.msg.seqno;\r\n assert reply.k == sht_packet.msg.m.k_reply;\r\n assert reply.ov == sht_packet.msg.m.v;\r\n\r\n assert reply == AppReply(sht_packet.msg.seqno, sht_packet.msg.m.k_reply, sht_packet.msg.m.v);\r\n //assert serviceState.replies == set p | p in sht_state.network && p.msg.SingleMessage? && p.msg.m.Reply? && p.src in sht_state.hosts :: AppReply(p.src, p.msg.seqno, p.msg.m.k_reply, p.msg.m.v);\r\n //assert service_reply in set p | p in sht_state.network && p.msg.SingleMessage? && p.msg.m.Reply? && p.src in sht_state.hosts :: AppReply(p.src, p.msg.seqno, p.msg.m.k_reply, p.msg.m.v);\r\n assert reply in serviceState.replies;\r\n //assert reply in serviceState.replies\r\n //assert r in rsl.replies;\r\n //var service_reply := RenameToAppReply(r);\r\n //assert service_reply == AppReply(p.dst, seqno, reply);\r\n //assert service_reply in serviceState.replies;\r\n }\r\n assert |db| > 0;\r\n assert DS_Init(db[0], config);\r\n assert last(db).environment.nextStep.LEnvStepStutter?;\r\n forall req | req in serviceState.requests && req.AppGetRequest? \r\n ensures exists p, reserved_bytes :: p in concretePkts && p.dst in serviceState.serverAddresses \r\n && p.msg == MarshallServiceGetRequest(req, reserved_bytes)\r\n && |reserved_bytes| < 0x10_0000;\r\n {\r\n \r\n assert serviceState == Refinement(sht_state);\r\n var h,req_index :| h in maprange(sht_state.hosts) && 0 <= req_index < |h.receivedRequests| && req == h.receivedRequests[req_index];\r\n var id := h.me;\r\n assert h in maprange(sht_state.hosts);\r\n assert sht_state == LSHTState_Refine(AbstractifyDsState(db[i]));\r\n assert sht_state == LSHTState_Refine(LSHT_State(AbstractifyConcreteConfiguration(db[i].config),\r\n AbstractifyConcreteEnvironment(db[i].environment),\r\n AbstractifyConcreteReplicas(db[i].servers, db[i].config.hostIds)));\r\n InvHolds(sht_config, sht_states);\r\n assert Inv(sht_state);\r\n var step := lemma_FindRawAppGetRequest(config, db, i, id, req, req_index);\r\n var concrete_p := lemma_BufferedPacketFindRawPacket(config, db, step, id);\r\n assert concrete_p in db[step].environment.sentPackets;\r\n lemma_PacketsMonotonic(config,db, step, i);\r\n \r\n assert concrete_p in db[i].environment.sentPackets;\r\n assert concrete_p.dst in db[step].servers;\r\n lemma_DsConsistency(config, db, i);\r\n lemma_DsConsistency(config, db, step);\r\n assert concrete_p.dst in db[i].servers;\r\n assert concrete_p.dst in serviceState.serverAddresses;\r\n \r\n var sht_p := LSHTPacketToPacket(AbstractifyConcretePacket(concrete_p));\r\n var reserved_bytes := lemma_ParseMarshallGetRequest(concrete_p.msg, sht_p.msg);\r\n assert concrete_p.msg == MarshallServiceGetRequest(req, reserved_bytes);\r\n }\r\n \r\n forall req | req in serviceState.requests && req.AppSetRequest? \r\n ensures exists p, reserved_bytes :: p in concretePkts && p.dst in serviceState.serverAddresses \r\n && p.msg == MarshallServiceSetRequest(req, reserved_bytes)\r\n && |reserved_bytes| < 0x10_0000;\r\n {\r\n assert serviceState == Refinement(sht_state);\r\n var h,req_index :| h in maprange(sht_state.hosts) && 0 <= req_index < |h.receivedRequests| && req == h.receivedRequests[req_index];\r\n var id := h.me;\r\n assert h in maprange(sht_state.hosts);\r\n assert sht_state == LSHTState_Refine(AbstractifyDsState(db[i]));\r\n assert sht_state == LSHTState_Refine(LSHT_State(AbstractifyConcreteConfiguration(db[i].config),\r\n AbstractifyConcreteEnvironment(db[i].environment),\r\n AbstractifyConcreteReplicas(db[i].servers, db[i].config.hostIds)));\r\n InvHolds(sht_config, sht_states);\r\n assert Inv(sht_state);\r\n var step := lemma_FindRawAppSetRequest(config, db, i, id, req, req_index);\r\n \r\n var concrete_p := lemma_BufferedPacketFindRawPacket(config, db, step, id);\r\n assert concrete_p in db[step].environment.sentPackets;\r\n lemma_PacketsMonotonic(config,db, step, i);\r\n \r\n assert concrete_p in db[i].environment.sentPackets;\r\n assert concrete_p.dst in db[step].servers;\r\n lemma_DsConsistency(config, db, i);\r\n lemma_DsConsistency(config, db, step);\r\n assert concrete_p.dst in db[i].servers;\r\n assert concrete_p.dst in serviceState.serverAddresses;\r\n \r\n var sht_p := LSHTPacketToPacket(AbstractifyConcretePacket(concrete_p));\r\n var reserved_bytes := lemma_ParseMarshallSetRequest(concrete_p.msg, sht_p.msg);\r\n assert concrete_p.msg == MarshallServiceSetRequest(req, reserved_bytes);\r\n }\r\n }\r\n }\r\n\r\n lemma lemma_FixFinalEnvStep(config:ConcreteConfiguration, db:seq) returns (db':seq)\r\n requires IsValidBehavior(config, db);\r\n ensures |db'| == |db|;\r\n ensures DS_Init(db'[0], config);\r\n ensures forall i {:trigger DS_Next(db'[i], db'[i+1])} :: 0 <= i < |db'| - 1 ==> DS_Next(db'[i], db'[i+1]);\r\n ensures last(db').environment.nextStep.LEnvStepStutter?;\r\n ensures forall i :: 0 <= i < |db'| - 1 ==> db'[i] == db[i];\r\n ensures last(db') == last(db).(environment := last(db').environment);\r\n ensures last(db').environment == last(db).environment.(nextStep := LEnvStepStutter());\r\n {\r\n var sz := |db|;\r\n db' := all_but_last(db) + [last(db).(environment := last(db).environment.(nextStep := LEnvStepStutter()))];\r\n assert |db'| == |db|;\r\n forall i | 0 <= i < |db'| - 1\r\n ensures DS_Next(db'[i], db'[i+1]);\r\n {\r\n lemma_DeduceTransitionFromDsBehavior(config, db, i);\r\n if i == sz - 2\r\n {\r\n assert DS_Next(db'[i], db'[i+1]);\r\n }\r\n }\r\n }\r\n\r\n lemma RefinementProof(config:DS_s.H_s.ConcreteConfiguration, db:seq) returns (sb:seq)\r\n {\r\n var db' := lemma_FixFinalEnvStep(config, db);\r\n sb := RefinementProofForFixedBehavior(config, db');\r\n }\r\n\r\n \r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/SHT/Marshall.i.dfy", "content": "\r\ninclude \"AbstractService.s.dfy\"\r\ninclude \"../../Protocol/SHT/Message.i.dfy\"\r\ninclude \"../../Impl/SHT/PacketParsing.i.dfy\"\r\ninclude \"../../Impl/SHT/AppInterfaceConcrete.i.dfy\"\r\ninclude \"AppInterface.i.dfy\"\r\n\r\nmodule MarshallProof_i {\r\n import opened Native__NativeTypes_s\r\n import opened Native__Io_s\r\n import opened Bytes_s\r\n import opened Math__power2_i\r\n import opened AbstractServiceSHT_s`All\r\n import opened SHT__Message_i\r\n import opened SHT__PacketParsing_i\r\n import opened SHT__SingleMessage_i\r\n import opened SHT__CMessage_i\r\n import opened Impl__AppInterfaceConcrete_i`All\r\n import opened AppInterface_i`All\r\n import opened Common__Util_i\r\n import opened Common__GenericMarshalling_i\r\n\r\n lemma lemma_ParseValCorrectVByteArray(data:seq, v:V, g:G) returns (len:uint64, val:V, rest:seq)\r\n requires ValInGrammar(v, g);\r\n requires |data| < 0x1_0000_0000_0000_0000;\r\n requires ValidGrammar(g);\r\n requires parse_Val(data, g).0.Some?;\r\n requires parse_Val(data, g).0.v == v;\r\n requires g.GByteArray?;\r\n ensures parse_Uint64(data).0.Some?;\r\n ensures len == parse_Uint64(data).0.v.u;\r\n ensures rest == parse_Uint64(data).1;\r\n ensures |rest| >= len as int;\r\n ensures val == VByteArray(rest[0..len]);\r\n ensures parse_Val(data, g) == parse_ByteArray(data)\r\n ensures parse_ByteArray(data).1 == rest[len..]\r\n {\r\n reveal_parse_Val();\r\n len := parse_Uint64(data).0.v.u;\r\n rest := parse_Uint64(data).1;\r\n val := VByteArray(rest[0..len]);\r\n }\r\n\r\n lemma lemma_ParseValCorrectVCase(data:seq, v:V, g:G) returns (caseId:uint64, val:V, rest:seq)\r\n requires ValInGrammar(v, g);\r\n requires |data| < 0x1_0000_0000_0000_0000;\r\n requires ValidGrammar(g);\r\n requires parse_Val(data, g).0.Some?;\r\n requires parse_Val(data, g).0.v == v;\r\n requires g.GTaggedUnion?;\r\n ensures parse_Uint64(data).0.Some?;\r\n ensures caseId == parse_Uint64(data).0.v.u;\r\n ensures 0 <= caseId as int < |g.cases|;\r\n ensures rest == parse_Uint64(data).1;\r\n ensures parse_Val(rest, g.cases[caseId]).0.Some?;\r\n ensures val == parse_Val(rest, g.cases[caseId]).0.v;\r\n ensures v == VCase(caseId, val);\r\n ensures ValInGrammar(val, g.cases[caseId]);\r\n ensures parse_Val(data, g) == parse_Case(data, g.cases)\r\n {\r\n reveal_parse_Val();\r\n caseId := parse_Uint64(data).0.v.u;\r\n var tuple := parse_Val(parse_Uint64(data).1, g.cases[caseId]);\r\n val := tuple.0.v;\r\n rest := parse_Uint64(data).1;\r\n }\r\n\r\n lemma {:fuel ValInGrammar,3} lemma_ParseValCorrectTuple2(data:seq, v:V, g:G) returns (val0:V, val1:V, rest:seq)\r\n requires ValInGrammar(v, g);\r\n requires |data| < 0x1_0000_0000_0000_0000;\r\n requires ValidGrammar(g);\r\n requires parse_Val(data, g).0.Some?;\r\n requires parse_Val(data, g).0.v == v;\r\n requires g.GTuple?;\r\n requires |g.t| == 2;\r\n\r\n ensures parse_Val(data, g.t[0]).0.Some?;\r\n ensures val0 == parse_Val(data, g.t[0]).0.v;\r\n ensures ValInGrammar(val0, g.t[0]);\r\n\r\n ensures rest == parse_Val(data, g.t[0]).1;\r\n ensures parse_Val(rest, g.t[1]).0.Some?;\r\n ensures val1 == parse_Val(rest, g.t[1]).0.v;\r\n ensures ValInGrammar(val1, g.t[1]);\r\n\r\n ensures v == VTuple([val0, val1]);\r\n {\r\n reveal_parse_Val();\r\n reveal_parse_Tuple_contents();\r\n\r\n // Prove that v == VTuple([val0, val1]);\r\n assert parse_Val(data, g).0.v == parse_Tuple(data, g.t).0.v == VTuple(parse_Tuple_contents(data, g.t).0.v);\r\n\r\n assert parse_Tuple_contents(data, g.t).0.v == [parse_Val(data, g.t[0]).0.v] \r\n + parse_Tuple_contents(parse_Val(data, g.t[0]).1, g.t[1..]).0.v;\r\n\r\n assert [parse_Val(data, g.t[0]).0.v] + parse_Tuple_contents(parse_Val(data, g.t[0]).1, g.t[1..]).0.v\r\n == [parse_Val(data, g.t[0]).0.v] + [parse_Val(parse_Val(data, g.t[0]).1, g.t[1]).0.v];\r\n\r\n assert [parse_Val(data, g.t[0]).0.v] + [parse_Val(parse_Val(data, g.t[0]).1, g.t[1]).0.v]\r\n == [parse_Val(data, g.t[0]).0.v, parse_Val(parse_Val(data, g.t[0]).1, g.t[1]).0.v];\r\n assert |v.t| == 2;\r\n var tuple0 := parse_Val(data, g.t[0]);\r\n assert tuple0.0.Some?;\r\n val0,rest := tuple0.0.v, tuple0.1;\r\n var tuple1 := parse_Val(rest, g.t[1]);\r\n var foo;\r\n val1,foo := tuple1.0.v, tuple1.1;\r\n\r\n // Prove that rest is set correctly\r\n assert parse_Val(data, g).1 == parse_Tuple(data, g.t).1 == parse_Tuple_contents(data, g.t).1;\r\n assert parse_Tuple_contents(data, g.t).1 == parse_Tuple_contents(parse_Val(data, g.t[0]).1, g.t[1..]).1;\r\n //assert parse_Tuple_contents(parse_Val(data, g.t[0]).1, g.t[1..]).1 == rest;\r\n }\r\n\r\n lemma {:fuel ValInGrammar,3} lemma_ParseValCorrectTuple3(data:seq, v:V, g:G) returns (val0:V, val1:V, val2:V, rest1:seq, rest2:seq)\r\n requires ValInGrammar(v, g);\r\n requires |data| < 0x1_0000_0000_0000_0000;\r\n requires ValidGrammar(g);\r\n requires parse_Val(data, g).0.Some?;\r\n requires parse_Val(data, g).0.v == v;\r\n requires g.GTuple?;\r\n requires |g.t| == 3;\r\n\r\n ensures parse_Val(data, g.t[0]).0.Some?;\r\n ensures val0 == parse_Val(data, g.t[0]).0.v;\r\n ensures ValInGrammar(val0, g.t[0]);\r\n\r\n ensures rest1 == parse_Val(data, g.t[0]).1;\r\n ensures parse_Val(rest1, g.t[1]).0.Some?\r\n ensures val1 == parse_Val(rest1, g.t[1]).0.v;\r\n ensures ValInGrammar(val1, g.t[1]);\r\n\r\n ensures rest2 == parse_Val(rest1, g.t[1]).1;\r\n ensures parse_Val(rest2, g.t[2]).0.Some?;\r\n ensures val2 == parse_Val(rest2, g.t[2]).0.v;\r\n ensures ValInGrammar(val2, g.t[2]);\r\n\r\n ensures v == VTuple([val0, val1, val2]);\r\n {\r\n reveal_parse_Val();\r\n reveal_parse_Tuple_contents();\r\n\r\n // Prove that v == VTuple([val0, val1, val2]);\r\n assert parse_Val(data, g).0.v == parse_Tuple(data, g.t).0.v == VTuple(parse_Tuple_contents(data, g.t).0.v);\r\n\r\n assert parse_Tuple_contents(data, g.t).0.v == [parse_Val(data, g.t[0]).0.v] \r\n + parse_Tuple_contents(parse_Val(data, g.t[0]).1, g.t[1..]).0.v;\r\n\r\n var interm_rest := parse_Val(data, g.t[0]).1;\r\n assert [parse_Val(data, g.t[0]).0.v] + parse_Tuple_contents(interm_rest, g.t[1..]).0.v\r\n == [parse_Val(data, g.t[0]).0.v] + [parse_Val(interm_rest, g.t[1]).0.v]\r\n + parse_Tuple_contents(parse_Val(interm_rest, g.t[1]).1, g.t[2..]).0.v\r\n == [parse_Val(data, g.t[0]).0.v] + [parse_Val(interm_rest, g.t[1]).0.v]\r\n + [parse_Val(parse_Val(interm_rest, g.t[1]).1, g.t[2]).0.v];\r\n\r\n assert [parse_Val(data, g.t[0]).0.v] \r\n + [parse_Val(interm_rest, g.t[1]).0.v]\r\n + [parse_Val(parse_Val(interm_rest, g.t[1]).1, g.t[2]).0.v]\r\n == [parse_Val(data, g.t[0]).0.v, \r\n parse_Val(interm_rest, g.t[1]).0.v,\r\n parse_Val(parse_Val(interm_rest, g.t[1]).1, g.t[2]).0.v];\r\n\r\n assert |v.t| == 3;\r\n var foo;\r\n var tuple0 := parse_Val(data, g.t[0]);\r\n assert tuple0.0.Some?;\r\n val0,rest1 := tuple0.0.v, tuple0.1;\r\n var tuple1 := parse_Val(interm_rest, g.t[1]);\r\n val1,rest2 := tuple1.0.v, tuple1.1;\r\n var tuple2 := parse_Val(rest2, g.t[2]);\r\n val2,foo := tuple2.0.v, tuple2.1;\r\n\r\n // Prove that rest is set correctly\r\n assert parse_Val(data, g).1 == parse_Tuple(data, g.t).1 == parse_Tuple_contents(data, g.t).1;\r\n assert parse_Tuple_contents(data, g.t).1 == parse_Tuple_contents(parse_Val(data, g.t[0]).1, g.t[1..]).1;\r\n //assert parse_Tuple_contents(parse_Val(data, g.t[0]).1, g.t[1..]).1 == rest;\r\n }\r\n\r\n lemma lemma_ParseValCorrectVUint64(data:seq, v:V, g:G) returns (u:uint64, rest:seq)\r\n requires ValInGrammar(v, g);\r\n requires |data| < 0x1_0000_0000_0000_0000;\r\n requires ValidGrammar(g);\r\n requires parse_Val(data, g).0.Some?;\r\n requires parse_Val(data, g).0.v == v;\r\n requires g.GUint64?;\r\n ensures parse_Uint64(data).0.Some?;\r\n ensures u == parse_Uint64(data).0.v.u;\r\n ensures v == VUint64(u);\r\n ensures rest == parse_Val(data, g).1;\r\n ensures rest == parse_Uint64(data).1;\r\n {\r\n reveal_parse_Val();\r\n u := parse_Uint64(data).0.v.u;\r\n rest := parse_Uint64(data).1;\r\n }\r\n\r\n lemma lemma_SeqOffset(s1:seq, s2:seq, offset:int, i:int, j:int)\r\n requires 0 <= offset <= |s1|\r\n requires s2 == s1[offset..]\r\n requires 0 <= i <= j <= |s2|\r\n ensures s2[i..j] == s1[i+offset..j+offset]\r\n {\r\n }\r\n\r\n lemma {:fuel ValInGrammar,3} lemma_ParseMarshallGetRequest(bytes:seq, msg:SingleMessage)\r\n returns (reserved_bytes:seq)\r\n requires msg.SingleMessage? && msg.m.GetRequest?;\r\n requires CSingleMessageIsAbstractable(SHTDemarshallData(bytes));\r\n requires AbstractifyCSingleMessageToSingleMessage(SHTDemarshallData(bytes)) == msg;\r\n ensures |reserved_bytes| < 0x10_0000;\r\n ensures bytes == MarshallServiceGetRequest(AppGetRequest(msg.seqno, msg.m.k_getrequest), reserved_bytes);\r\n {\r\n var cmsg := SHTDemarshallData(bytes);\r\n assert cmsg.CSingleMessage?;\r\n assert ValidPhysicalAddress(cmsg.dst);\r\n var data := bytes;\r\n var g := CSingleMessage_grammar();\r\n var v := DemarshallFunc(data, g);\r\n\r\n assert cmsg.dst == msg.dst;\r\n assert SHTDemarshallData(bytes) == parse_CSingleMessage(v);\r\n var cs := parse_CSingleMessage(v);\r\n assert v.c == 0;\r\n assert cs == CSingleMessage(v.val.t[0].u, parse_EndPoint(v.val.t[1]), parse_Message(v.val.t[2]));\r\n assert AbstractifyCSingleMessageToSingleMessage(cs) == msg;\r\n assert cs.dst == parse_EndPoint(v.val.t[1]);\r\n assert cs.dst == EndPoint(v.val.t[1].b);\r\n assert cs.dst == msg.dst;\r\n assert |v.val.t[1].b| < 0x10_0000;\r\n\r\n reserved_bytes := v.val.t[1].b;\r\n\r\n // Walk through the generic parsing process\r\n var msgCaseId, msgCaseVal, rest0 := lemma_ParseValCorrectVCase(data, v, g);\r\n var seqnoVal, dstVal, msgVal, rest1, rest2 := lemma_ParseValCorrectTuple3(rest0, msgCaseVal, g.cases[msgCaseId]);\r\n var mCaseId, mCaseVal, rest3 := lemma_ParseValCorrectVCase(rest2, msgVal, g.cases[msgCaseId].t[2]);\r\n\r\n assert v.val.t[0] == seqnoVal;\r\n assert v.val.t[1] == dstVal;\r\n assert v.val.t[2] == msgVal;\r\n\r\n // Prove that the first 8 bytes are correct\r\n assert msgCaseId == 0;\r\n assert 0 == SeqByteToUint64(bytes[..8]);\r\n assert bytes[..8] == [ 0, 0, 0, 0, 0, 0, 0, 0];\r\n\r\n // Prove that the next 8 bytes of seqno are correct\r\n var u, rest := lemma_ParseValCorrectVUint64(rest0, seqnoVal, GUint64);\r\n assert msg.seqno == u as int;\r\n assert SeqByteToUint64(rest0[..8]) == u;\r\n assert Uint64ToSeqByte(u) == Uint64ToBytes(u);\r\n lemma_BEByteSeqToInt_BEUintToSeqByte_invertability();\r\n assert rest0[..8] == Uint64ToSeqByte(msg.seqno as uint64);\r\n assert data[8..16] == rest0[..8];\r\n assert rest == rest0[8..];\r\n assert rest1 == rest0[8..];\r\n\r\n // Prove that the bytes of dst are correct\r\n var len_dst, val_dst, rest_dst := lemma_ParseValCorrectVByteArray(rest1, dstVal, EndPoint_grammar());\r\n assert val_dst == VByteArray(dstVal.b);\r\n assert rest1[..8] == Uint64ToSeqByte(len_dst);\r\n assert rest1[..8] == rest0[8..16];\r\n assert data[16..24] == rest1[..8];\r\n assert data[24..24+len_dst] == val_dst.b;\r\n assert len_dst as int == |cmsg.dst.public_key|;\r\n\r\n assert mCaseId == 0;\r\n assert rest2 == rest1[8 + len_dst..] == data[24 + len_dst ..];\r\n assert rest2[..8] == data[24 + len_dst .. 32 + len_dst];\r\n assert mCaseId == SeqByteToUint64(rest2[..8]) == SeqByteToUint64(data[24 + len_dst .. 32 + len_dst]);\r\n assert data[24 + len_dst .. 32 + len_dst] == Uint64ToSeqByte(mCaseId);\r\n \r\n var key, rest_key := lemma_ParseValCorrectVUint64(rest3, mCaseVal, GUint64);\r\n assert Uint64ToSeqByte(msg.m.k_getrequest) == MarshallSHTKey(msg.m.k_getrequest);\r\n assert data[32 + len_dst .. 40 + len_dst] == Uint64ToSeqByte(msg.m.k_getrequest);\r\n\r\n assert |data| == 40 + len_dst as int;\r\n }\r\n\r\n lemma {:fuel ValInGrammar,5} {:timeLimitMultiplier 2} lemma_ParseMarshallSetRequest(bytes:seq, msg:SingleMessage)\r\n returns (reserved_bytes:seq)\r\n requires msg.SingleMessage? && msg.m.SetRequest?;\r\n requires CSingleMessageIsAbstractable(SHTDemarshallData(bytes));\r\n requires AbstractifyCSingleMessageToSingleMessage(SHTDemarshallData(bytes)) == msg;\r\n ensures |reserved_bytes| < 0x10_0000\r\n ensures bytes == MarshallServiceSetRequest(AppSetRequest(msg.seqno, msg.m.k_setrequest, msg.m.v_setrequest), reserved_bytes);\r\n {\r\n var cmsg := SHTDemarshallData(bytes);\r\n assert cmsg.CSingleMessage?;\r\n var data := bytes;\r\n var g := CSingleMessage_grammar();\r\n var v := DemarshallFunc(data, g);\r\n\r\n assert cmsg.dst == msg.dst;\r\n assert SHTDemarshallData(bytes) == parse_CSingleMessage(v);\r\n var cs := parse_CSingleMessage(v);\r\n assert v.c == 0;\r\n assert cs == CSingleMessage(v.val.t[0].u, parse_EndPoint(v.val.t[1]), parse_Message(v.val.t[2]));\r\n assert AbstractifyCSingleMessageToSingleMessage(cs) == msg;\r\n assert cs.dst == parse_EndPoint(v.val.t[1]);\r\n assert cs.dst == EndPoint(v.val.t[1].b);\r\n assert cs.dst == msg.dst;\r\n assert |v.val.t[1].b| < 0x10_0000;\r\n reserved_bytes := v.val.t[1].b;\r\n\r\n // Walk through the generic parsing process\r\n var msgCaseId, msgCaseVal, rest0 := lemma_ParseValCorrectVCase(data, v, g);\r\n var seqnoVal, dstVal, msgVal, rest1, rest2 := lemma_ParseValCorrectTuple3(rest0, msgCaseVal, g.cases[msgCaseId]);\r\n var mCaseId, mCaseVal, rest3 := lemma_ParseValCorrectVCase(rest2, msgVal, g.cases[msgCaseId].t[2]);\r\n var keyVal, optValueVal, rest4 := lemma_ParseValCorrectTuple2(rest3, mCaseVal, g.cases[msgCaseId].t[2].cases[mCaseId]);\r\n var valCaseId, valCaseVal, rest5 := lemma_ParseValCorrectVCase(rest4, optValueVal, OptionalValue_grammar());\r\n\r\n // Prove that the first 8 bytes are correct\r\n assert msgCaseId == 0;\r\n assert 0 == SeqByteToUint64(bytes[..8]);\r\n assert bytes[..8] == [ 0, 0, 0, 0, 0, 0, 0, 0];\r\n\r\n // Prove that the next 8 bytes of seqno are correct\r\n var u, rest := lemma_ParseValCorrectVUint64(rest0, seqnoVal, GUint64);\r\n assert msg.seqno == u as int;\r\n assert SeqByteToUint64(rest0[..8]) == u;\r\n assert Uint64ToSeqByte(u) == Uint64ToBytes(u);\r\n lemma_BEByteSeqToInt_BEUintToSeqByte_invertability();\r\n assert rest0[..8] == Uint64ToSeqByte(msg.seqno as uint64);\r\n assert data[8..16] == rest0[..8];\r\n assert rest == rest0[8..];\r\n assert rest1 == rest0[8..];\r\n\r\n // Prove that the bytes of dst are correct\r\n var len_dst, val_dst, rest_dst := lemma_ParseValCorrectVByteArray(rest1, dstVal, EndPoint_grammar());\r\n assert val_dst == VByteArray(dstVal.b);\r\n assert rest1[..8] == Uint64ToSeqByte(len_dst);\r\n assert rest1[..8] == rest0[8..16];\r\n assert data[16..24] == rest1[..8];\r\n assert data[24..24+len_dst] == val_dst.b;\r\n assert len_dst as int == |cmsg.dst.public_key|;\r\n\r\n assert mCaseId == 1;\r\n assert rest2 == rest1[8 + len_dst..] == data[24 + len_dst ..];\r\n assert rest2[..8] == data[24 + len_dst .. 32 + len_dst];\r\n assert mCaseId == SeqByteToUint64(rest2[..8]) == SeqByteToUint64(data[24 + len_dst .. 32 + len_dst]);\r\n assert data[24 + len_dst .. 32 + len_dst] == Uint64ToSeqByte(mCaseId);\r\n\r\n assert Uint64ToSeqByte(msg.m.k_setrequest) == MarshallSHTKey(msg.m.k_setrequest);\r\n\r\n // Handle the two subcases of OptionalValue\r\n if cmsg.m.v_setrequest.ValuePresent? {\r\n assert valCaseId == 0;\r\n assert 0 == SeqByteToUint64(rest4[..8]);\r\n assert rest4[..8] == [ 0, 0, 0, 0, 0, 0, 0, 0];\r\n calc {\r\n rest4[..8];\r\n { lemma_SeqOffset(rest3, rest4, 8, 0, 8); }\r\n rest3[8..16];\r\n { lemma_SeqOffset(rest2, rest3, 8, 8, 16); }\r\n rest2[16..24];\r\n { lemma_SeqOffset(rest1, rest2, 8 + len_dst as int, 16, 24); }\r\n rest1[24+len_dst as int..32+len_dst as int];\r\n { lemma_SeqOffset(rest0, rest1, 8, 24 + len_dst as int, 32 + len_dst as int); }\r\n rest0[32+len_dst as int..40+len_dst as int];\r\n { lemma_SeqOffset(data, rest0, 8, 32 + len_dst as int, 40 + len_dst as int); }\r\n data[40+len_dst as int..48+len_dst as int];\r\n }\r\n var byteLen, bytesVal, rest6 := lemma_ParseValCorrectVByteArray(rest5, valCaseVal, GByteArray);\r\n assert data[..56+(len_dst as int)+(byteLen as int)] == \r\n [ 0, 0, 0, 0, 0, 0, 0, 0] \r\n + Uint64ToSeqByte(msg.seqno as uint64)\r\n + Uint64ToSeqByte(|reserved_bytes| as uint64)\r\n + reserved_bytes\r\n + [ 0, 0, 0, 0, 0, 0, 0, 1]\r\n + Uint64ToSeqByte(msg.m.k_setrequest)\r\n + [ 0, 0, 0, 0, 0, 0, 0, 0] \r\n + Uint64ToSeqByte(byteLen) \r\n + bytesVal.b;\r\n if |data| > 56 + (len_dst as int) + (byteLen as int) {\r\n assert data[0..|data|] == data[..];\r\n lemma_parse_Val_view_specific_size(data, v, CSingleMessage_grammar(), 0, |data|);\r\n lemma_parse_Val_view_specific(data, v, CSingleMessage_grammar(), 0, |data|);\r\n assert false;\r\n }\r\n assert |data| == 56 + (len_dst as int) + (byteLen as int);\r\n assert bytes == MarshallServiceSetRequest(AppSetRequest(msg.seqno, msg.m.k_setrequest, msg.m.v_setrequest), reserved_bytes);\r\n } else {\r\n assert cmsg.m.v_setrequest.ValueAbsent?;\r\n assert valCaseId == 1;\r\n assert 1 == SeqByteToUint64(rest4[..8]);\r\n assert rest4[..8] == [ 0, 0, 0, 0, 0, 0, 0, 1];\r\n assert data[..48+len_dst as int] == data[..8]\r\n + data[8..16]\r\n + data[16..24]\r\n + data[24..24+len_dst as int]\r\n + data[24+len_dst as int..32+len_dst as int]\r\n + data[32+len_dst as int..40+len_dst as int]\r\n + data[40+len_dst as int..48+len_dst as int];\r\n assert data[..48+len_dst as int] == [ 0, 0, 0, 0, 0, 0, 0, 0] \r\n + Uint64ToSeqByte(msg.seqno as uint64)\r\n + Uint64ToSeqByte(|reserved_bytes| as uint64)\r\n + reserved_bytes\r\n + [ 0, 0, 0, 0, 0, 0, 0, 1]\r\n + Uint64ToSeqByte(msg.m.k_setrequest)\r\n + [ 0, 0, 0, 0, 0, 0, 0, 1];\r\n if |data| > 48 + len_dst as int {\r\n assert data[0..|data|] == data[..];\r\n lemma_parse_Val_view_specific_size(data, v, CSingleMessage_grammar(), 0, |data|);\r\n lemma_parse_Val_view_specific(data, v, CSingleMessage_grammar(), 0, |data|);\r\n assert false;\r\n }\r\n assert |data| == 48 + len_dst as int;\r\n assert bytes == MarshallServiceSetRequest(AppSetRequest(msg.seqno, msg.m.k_setrequest, msg.m.v_setrequest), reserved_bytes);\r\n }\r\n }\r\n\r\n lemma lemma_ParseMarshallReplyHelper(bytes:seq, reply:AppReply, reserved_bytes:seq)\r\n requires bytes == MarshallServiceReply(reply, reserved_bytes)\r\n requires 0 <= reply.seqno < 0x1_0000_0000_0000_0000\r\n requires |reserved_bytes| < 0x10_0000\r\n ensures |bytes| >= 24 + |reserved_bytes|\r\n ensures bytes[24..24 + |reserved_bytes|] == reserved_bytes\r\n {\r\n }\r\n\r\n lemma {:fuel ValInGrammar,5} {:timeLimitMultiplier 2} lemma_ParseMarshallReply(\r\n bytes:seq, reply:AppReply, msg:SingleMessage, reserved_bytes:seq) \r\n requires CSingleMessageIsAbstractable(SHTDemarshallData(bytes));\r\n requires AbstractifyCSingleMessageToSingleMessage(SHTDemarshallData(bytes)) == msg;\r\n requires CSingleMessageMarshallable(SHTDemarshallData(bytes));\r\n requires bytes == MarshallServiceReply(reply, reserved_bytes);\r\n requires |reserved_bytes| < 0x10_0000;\r\n ensures msg.SingleMessage?;\r\n ensures msg.seqno == reply.seqno;\r\n ensures msg.m.Reply?;\r\n ensures msg.m.k_reply == reply.k;\r\n ensures msg.m.v == reply.ov;\r\n {\r\n var marshalled_bytes := MarshallServiceReply(reply, reserved_bytes);\r\n var g := CSingleMessage_grammar();\r\n if 0 <= reply.seqno < 0x1_0000_0000_0000_0000 {\r\n var cmsg := SHTDemarshallData(bytes);\r\n var data := bytes;\r\n var v := DemarshallFunc(data, g);\r\n\r\n // Walk through the generic parsing process\r\n var msgCaseId, msgCaseVal, rest0 := lemma_ParseValCorrectVCase(data, v, g);\r\n var seqnoVal, dstVal, msgVal, rest1, rest2 := lemma_ParseValCorrectTuple3(rest0, msgCaseVal, g.cases[msgCaseId]);\r\n var mCaseId, mCaseVal, rest3 := lemma_ParseValCorrectVCase(rest2, msgVal, g.cases[msgCaseId].t[2]);\r\n\r\n // Prove that the first 8 bytes are correct\r\n assert msgCaseId == 0;\r\n assert 0 == SeqByteToUint64(bytes[..8]);\r\n assert bytes[..8] == [ 0, 0, 0, 0, 0, 0, 0, 0];\r\n\r\n // Prove that the next 8 bytes of seqno are correct\r\n var u, rest := lemma_ParseValCorrectVUint64(rest0, seqnoVal, GUint64);\r\n lemma_2toX();\r\n calc {\r\n u;\r\n parse_Uint64(rest0).0.v.u;\r\n SeqByteToUint64(rest0[..8]);\r\n SeqByteToUint64(Uint64ToBytes(reply.seqno as uint64));\r\n SeqByteToUint64(Uint64ToSeqByte(reply.seqno as uint64));\r\n SeqByteToUint64(BEUintToSeqByte(reply.seqno as uint64 as int, 8));\r\n { lemma_BEByteSeqToInt_BEUintToSeqByte_invertability(); }\r\n reply.seqno as uint64;\r\n }\r\n assert msg.seqno == u as int;\r\n assert reply.seqno == msg.seqno;\r\n\r\n var len_dst_uint64, val_dst, rest_dst := lemma_ParseValCorrectVByteArray(rest1, dstVal, EndPoint_grammar());\r\n var len_dst := len_dst_uint64 as int;\r\n\r\n // Prove some length relationships to show that our indices are within bounds\r\n calc ==> {\r\n true;\r\n rest0 == parse_Uint64(data).1;\r\n |rest0| == |data| - 8;\r\n }\r\n calc ==> {\r\n true;\r\n rest1 == parse_Uint64(rest0).1;\r\n |rest1| == |rest0| - 8;\r\n }\r\n calc ==> {\r\n true;\r\n |rest2| == |rest1| - 8 - len_dst;\r\n }\r\n calc ==> {\r\n true;\r\n rest3 == parse_Uint64(rest2).1;\r\n |rest3| == |rest2| - 8;\r\n }\r\n\r\n assert rest0 == data[8..];\r\n assert rest1 == rest0[8..] == data[16..];\r\n assert rest2 == rest1[8 + len_dst..] == data[24 + len_dst..];\r\n assert rest3 == rest2[8..] == data[32 + len_dst..];\r\n\r\n assert data[16..24] == Uint64ToSeqByte(|reserved_bytes| as uint64);\r\n assert SeqByteToUint64(data[16..24]) == |reserved_bytes| as uint64 by {\r\n lemma_BEByteSeqToInt_BEUintToSeqByte_invertability();\r\n }\r\n assert len_dst_uint64 == SeqByteToUint64(rest1[..8]) == SeqByteToUint64(data[16..24]) == |reserved_bytes| as uint64;\r\n assert len_dst == |reserved_bytes|;\r\n\r\n calc {\r\n val_dst.b;\r\n rest_dst[0..len_dst_uint64];\r\n rest_dst[0..len_dst];\r\n rest1[8..][0..len_dst];\r\n { lemma_SeqOffset(rest1, rest1[8..], 8, 0, len_dst); }\r\n rest1[8 .. 8 + len_dst];\r\n data[16..][8 .. 8 + len_dst];\r\n { lemma_SeqOffset(data, data[16..], 16, 8, 8 + len_dst); }\r\n data[24 .. 24 + len_dst];\r\n { lemma_ParseMarshallReplyHelper(bytes, reply, reserved_bytes); }\r\n reserved_bytes;\r\n }\r\n\r\n assert rest2[..8] == data[24 + len_dst .. 32 + len_dst] == [0, 0, 0, 0, 0, 0, 0, 2];\r\n assert mCaseId == 2;\r\n \r\n var keyVal, optValueVal, rest4 := lemma_ParseValCorrectTuple2(rest3, mCaseVal, g.cases[msgCaseId].t[2].cases[mCaseId]);\r\n var valCaseId, valCaseVal, rest5 := lemma_ParseValCorrectVCase(rest4, optValueVal, OptionalValue_grammar());\r\n\r\n assert rest4 == rest3[8..] == data[40 + len_dst..];\r\n\r\n // Prove that the key is handled correctly\r\n var key, rest_key := lemma_ParseValCorrectVUint64(rest3, keyVal, GUint64);\r\n calc {\r\n msg.m.k_reply;\r\n key;\r\n parse_Uint64(rest3).0.v.u;\r\n parse_Uint64(MarshallSHTKey(reply.k)).0.v.u;\r\n SeqByteToUint64(MarshallSHTKey(reply.k));\r\n SeqByteToUint64(Uint64ToBytes(reply.k));\r\n SeqByteToUint64(Uint64ToSeqByte(reply.k));\r\n SeqByteToUint64(BEUintToSeqByte(reply.k as int, 8));\r\n { lemma_BEByteSeqToInt_BEUintToSeqByte_invertability(); }\r\n reply.k;\r\n }\r\n\r\n calc {\r\n rest4[..8];\r\n rest4[0..8];\r\n { lemma_SeqOffset(rest3, rest4, 8, 0, 8); }\r\n rest3[8..16];\r\n { lemma_SeqOffset(rest2, rest3, 8, 8, 16); }\r\n rest2[16..24];\r\n { lemma_SeqOffset(rest1, rest2, 8 + len_dst, 16, 24); }\r\n rest1[24+len_dst..32+len_dst];\r\n { lemma_SeqOffset(rest0, rest1, 8, 24 + len_dst, 32 + len_dst); }\r\n rest0[32+len_dst..40+len_dst];\r\n { lemma_SeqOffset(data, rest0, 8, 32 + len_dst, 40 + len_dst); }\r\n data[40+len_dst..48+len_dst];\r\n }\r\n\r\n // Handle the two subcases of OptionalValue\r\n if reply.ov.ValuePresent? {\r\n assert rest4[..8] == [ 0, 0, 0, 0, 0, 0, 0, 0];\r\n\r\n assert rest5 == parse_Uint64(rest4).1;\r\n assert |rest5| == |rest4| - 8;\r\n assert |rest5| < 0x1_0000_0000_0000_0000;\r\n\r\n var byteLen, bytesVal, rest6 := lemma_ParseValCorrectVByteArray(rest5, valCaseVal, GByteArray);\r\n calc {\r\n byteLen;\r\n parse_Uint64(rest5).0.v.u;\r\n SeqByteToUint64(rest5[..8]);\r\n SeqByteToUint64(Uint64ToBytes(|reply.ov.v| as uint64));\r\n SeqByteToUint64(Uint64ToSeqByte(|reply.ov.v| as uint64));\r\n SeqByteToUint64(BEUintToSeqByte(|reply.ov.v| as uint64 as int, 8));\r\n { lemma_BEByteSeqToInt_BEUintToSeqByte_invertability(); }\r\n |reply.ov.v| as uint64;\r\n }\r\n assert |bytesVal.b| == |msg.m.v.v|;\r\n assert bytesVal.b == msg.m.v.v;\r\n\r\n assert |bytesVal.b| == |reply.ov.v|;\r\n assert bytesVal.b == reply.ov.v;\r\n\r\n assert msg.m.v == reply.ov;\r\n } else {\r\n assert rest4[..8] == [ 0, 0, 0, 0, 0, 0, 0, 1];\r\n }\r\n } else {\r\n assert bytes == [1];\r\n reveal_parse_Val();\r\n assert parse_Val(bytes, g).0.None?;\r\n assert false;\r\n }\r\n }\r\n}\r\n" }, { "path": "ironfleet/src/Dafny/Distributed/Services/SHT/SHTDistributedSystem.i.dfy", "content": "include \"../../Impl/LiveSHT/Host.i.dfy\"\ninclude \"../../Common/Framework/DistributedSystem.s.dfy\"\n\nmodule SHT_DistributedSystem_i refines DistributedSystem_s {\n\n import H_s = Host_i`All\n\n}\n" }, { "path": "ironfleet/src/Dafny/Distributed/apps.dfy.batch", "content": "#\n# SHT\n#\nsrc/Dafny/Distributed/Services/SHT/Main.i.dfy\nsrc/Dafny/Distributed/Protocol/LiveSHT/LivenessProof/LivenessProof.i.dfy\n#\n# RSL\n#\nsrc/Dafny/Distributed/Protocol/RSL/LivenessProof/LivenessProof.i.dfy\nsrc/Dafny/Distributed/Services/RSL/Main.i.dfy\n#\n# Lock\n#\nsrc/Dafny/Distributed/Services/Lock/Main.i.dfy\n\n\n" }, { "path": "ironfleet/src/Dafny/Libraries/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/.gitignore", "content": "*.bpl\r\n*.log\r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/div.i.dfy", "content": "include \"power.i.dfy\"\r\ninclude \"mul.i.dfy\"\r\ninclude \"div_def.i.dfy\"\r\ninclude \"div_nonlinear.i.dfy\"\r\ninclude \"div_auto.i.dfy\"\r\n\r\nmodule Math__div_i {\r\nimport opened Math__power_s\r\nimport opened Math__power_i\r\nimport opened Math__mod_auto_i\r\nimport opened Math__mul_auto_i\r\nimport opened Math__mul_nonlinear_i\r\nimport opened Math__mul_i\r\nimport opened Math__div_def_i\r\nimport opened Math__div_nonlinear_i\r\nimport opened Math__div_auto_i\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//-\r\n//- Core div lemmas, with named arguments.\r\n//-\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nlemma lemma_div_by_one_is_identity(x:int) {}\r\n\r\nlemma lemma_div_basics(x:int)\r\n ensures x != 0 ==> 0 / x == 0\r\n ensures x / 1 == x\r\n ensures x!=0 ==> x / x == 1\r\n{\r\n if (x != 0) {\r\n lemma_div_by_self(x);\r\n lemma_div_of_0(x);\r\n }\r\n}\r\n\r\n\r\nlemma lemma_small_div_converse()\r\n ensures forall x, d {:trigger x/d} :: 0<=x && 0 x < d\r\n{\r\n forall x, d | 0<=x && 0 0<=u && 0 u < d);\r\n }\r\n}\r\n\r\n\r\nlemma lemma_div_is_ordered_by_denominator(x:int, y:int, z:int)\r\n requires x >= 0\r\n requires 1 <= y <= z\r\n ensures x / y >= x / z\r\n decreases x\r\n{\r\n lemma_div_is_div_recursive_forall();\r\n assert forall u:int, d:int {:trigger u / d}{:trigger my_div_recursive(u, d)} :: d > 0 ==> my_div_recursive(u, d) == u / d;\r\n\r\n if (x < z)\r\n {\r\n lemma_div_is_ordered(0, x, y);\r\n }\r\n else\r\n {\r\n lemma_div_is_ordered(x-z, x-y, y);\r\n lemma_div_is_ordered_by_denominator(x-z, y, z);\r\n }\r\n}\r\n\r\nlemma lemma_div_is_strictly_ordered_by_denominator(x:int, d:int)\r\n requires 0 < x\r\n requires 1 < d\r\n ensures x/d < x\r\n decreases x\r\n{\r\n lemma_div_auto_induction(d, x, u => 0 < u ==> u / d < u);\r\n}\r\n\r\nlemma lemma_dividing_sums(a:int, b:int, d:int, R:int)\r\n requires 0 {\r\n a%d + b%d == R + (a+b)%d;\r\n (a+b)-(a+b)%d - R == a-(a%d) + b - (b%d);\r\n {\r\n lemma_fundamental_div_mod(a+b,d);\r\n lemma_fundamental_div_mod(a,d);\r\n lemma_fundamental_div_mod(b,d);\r\n }\r\n d*((a+b)/d) - R == d*(a/d) + d*(b/d);\r\n }\r\n}\r\n\r\n\r\n//-static lemma lemma_negative_divisor(x:int, d:int)\r\n//- requires d < 0\r\n//- ensures x / (-1*d) == -1*(x / d)\r\n//-{\r\n//- var q := x / (-1*d);\r\n//- var r := x % (-1*d);\r\n//- \r\n//- calc {\r\n//- x;\r\n//- { lemma_fundamental_div_mod(x, -1*d); }\r\n//- q * (-1*d) + r;\r\n//- { lemma_mul_is_associative(q, -1, d); }\r\n//- (q*-1)*d + r;\r\n//- { lemma_mul_is_commutative(q, -1); }\r\n//- (-q) * d + r;\r\n//- }\r\n//- lemma_mod_range(x, -1*d);\r\n//- lemma_fundamental_div_mod_converse(x, d, -q, r);\r\n//- assert x / d == -q;\r\n//- assert -1*(x/d) == q;\r\n//-}\r\n\r\n\r\nlemma lemma_div_pos_is_pos(x:int, divisor:int)\r\n requires 0 <= x\r\n requires 0 < divisor\r\n ensures x / divisor >= 0\r\n{\r\n lemma_div_auto_induction(divisor, x, u => 0 <= u ==> u / divisor >= 0);\r\n}\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//-\r\n//- Forall lemmas: these restate the core lemmas with foralls,\r\n//- so callers needn't name the specific expressions to manipulate.\r\n//-\r\n//- These are all boilerplate transformations of args/requires/ensures\r\n//- into forall args :: requires ==> ensures, with a correpsonding\r\n//- mechanically generated forall proof that invokes the core lemma.\r\n// So don't bother reading them.\r\n//-\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nlemma lemma_div_basics_forall()\r\n ensures forall x {:trigger 0 / x} :: x != 0 ==> 0 / x == 0\r\n ensures forall x {:trigger x / 1} :: x / 1 == x\r\n ensures forall x, y {:trigger x/y} :: x >= 0 && y > 0 ==> x/y >= 0\r\n ensures forall x, y {:trigger x/y} :: x >= 0 && y > 0 ==> x/y <= x\r\n{\r\n forall x:int\r\n ensures x != 0 ==> 0 / x == 0\r\n ensures x / 1 == x\r\n {\r\n lemma_div_basics(x);\r\n }\r\n forall x:int, y:int | x >= 0 && y > 0\r\n ensures x / y >= 0\r\n ensures x / y <= x\r\n {\r\n lemma_div_pos_is_pos(x, y);\r\n lemma_div_is_ordered_by_denominator(x, 1, y);\r\n }\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n//\r\n// I'm not sure how useful this is. I wrote it to try to bring\r\n// negative numerators to the positive side for trying to prove\r\n// the negative half of lemma_fundamental_div_mod. That turned out\r\n// to be the wrong idea, so maybe these are just useless.\r\n\r\nlemma lemma_div_neg_neg(x:int, d:int)\r\n requires d > 0\r\n ensures x/d == -((-x+d-1)/d)\r\n{\r\n lemma_div_auto(d);\r\n}\r\n\r\n\r\n//-\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n\r\n/*******************************\r\n * Useful lemmas about mod *\r\n *******************************/\r\n\r\n////////////////////////////////////////////////\r\n// No longer needed. Here for legacy reasons\r\n////////////////////////////////////////////////\r\n\r\nlemma lemma_mod_2(x:int) {}\r\nlemma lemma_mod2_plus(x:int) {}\r\nlemma lemma_mod2_plus2(x:int) {}\r\nlemma lemma_mod32(x:int) {}\r\nlemma lemma_mod_remainder_neg_specific(x:int, m:int) {}\r\nlemma lemma_mod_remainder_neg() {}\r\nlemma lemma_mod_remainder_pos_specific(x:int, m:int) {}\r\nlemma lemma_mod_remainder_pos() {}\r\nlemma lemma_mod_remainder_specific(x:int, m:int) {}\r\nlemma lemma_mod_remainder() {}\r\n\r\n////////////////////////////////////////////////\r\n// Actual useful lemmas\r\n////////////////////////////////////////////////\r\n\r\nlemma lemma_mod_basics()\r\n ensures forall m:int {:trigger m % m} :: m > 0 ==> m % m == 0\r\n ensures forall x:int, m:int {:trigger (x%m) % m} :: m > 0 ==> (x%m) % m == x%m\r\n{\r\n forall m:int | m > 0\r\n ensures m % m == 0\r\n {\r\n lemma_mod_auto(m);\r\n }\r\n forall x:int, m:int | m > 0\r\n ensures (x % m) % m == x % m\r\n {\r\n lemma_mod_auto(m);\r\n }\r\n}\r\n\r\nlemma lemma_mod_properties()\r\n ensures forall m:int {:trigger m % m} :: m > 0 ==> m % m == 0\r\n ensures forall x:int, m:int {:trigger (x%m) % m} :: m > 0 ==> (x%m) % m == x%m\r\n ensures forall x:int, m:int {:trigger x%m} :: m > 0 ==> 0 <= x%m < m\r\n{\r\n lemma_mod_basics();\r\n\r\n forall x:int, m:int | m > 0\r\n ensures m > 0 ==> 0 <= x%m < m\r\n {\r\n lemma_mod_auto(m);\r\n }\r\n}\r\n\r\nlemma lemma_mod_decreases(x:nat, d:nat)\r\n requires 00 then a else -a\r\n requires 0 < m\r\n ensures (m*a + b) % m == b % m\r\n{\r\n lemma_mod_auto(m);\r\n lemma_mul_auto_induction(a, u => (m*u + b) % m == b % m);\r\n}\r\n\r\nlemma lemma_add_mod_noop(x:int, y:int, m:int)\r\n requires 0 < m\r\n ensures ((x % m) + (y % m)) % m == (x+y) % m\r\n{\r\n lemma_mod_auto(m);\r\n}\r\n\r\nlemma lemma_add_mod_noop_right(x:int, y:int, m:int)\r\n requires 0 < m\r\n ensures (x + (y % m)) % m == (x+y) % m\r\n{\r\n lemma_mod_auto(m);\r\n}\r\n\r\nlemma lemma_mod_equivalence(x:int, y:int, m:int)\r\n requires 0 < m\r\n ensures x % m == y % m <==> (x - y) % m == 0\r\n{\r\n lemma_mod_auto(m);\r\n}\r\n\r\nlemma lemma_sub_mod_noop(x:int, y:int, m:int)\r\n requires 0 < m\r\n ensures ((x % m) - (y % m)) % m == (x-y) % m\r\n{\r\n lemma_mod_auto(m);\r\n}\r\n\r\nlemma lemma_sub_mod_noop_right(x:int, y:int, m:int)\r\n requires 0 < m\r\n ensures (x - (y % m)) % m == (x-y) % m\r\n{\r\n lemma_mod_auto(m);\r\n}\r\n\r\nlemma lemma_mod_adds(a:int, b:int, d:int)\r\n requires 0 a%d + b%d == (a+b)%d\r\n{\r\n lemma_mul_auto();\r\n lemma_div_auto(d);\r\n}\r\n\r\nlemma {:timeLimitMultiplier 2} lemma_mod_neg_neg(x:int, d:int)\r\n requires d > 0\r\n ensures x%d == (x*(1-d))%d\r\n{\r\n forall ensures (x - x * d) % d == x % d\r\n {\r\n lemma_mod_auto(d);\r\n var f := i => (x - i * d) % d == x % d;\r\n assert MulAuto() ==> && f(0)\r\n && (forall i {:trigger TMulAutoLe(0, i)} :: TMulAutoLe(0, i) && f(i) ==> f(i + 1))\r\n && (forall i {:trigger TMulAutoLe(i, 0)} :: TMulAutoLe(i, 0) && f(i) ==> f(i - 1));\r\n lemma_mul_auto_induction(x, f);\r\n }\r\n lemma_mul_auto();\r\n}\r\n\r\nlemma {:timeLimitMultiplier 2} lemma_fundamental_div_mod_converse(x:int, d:int, q:int, r:int)\r\n requires d != 0\r\n requires 0 <= r < d\r\n requires x == q * d + r\r\n ensures q == x/d\r\n ensures r == x%d\r\n{\r\n lemma_div_auto(d);\r\n\r\n var f := u => u == (u * d + r) / d;\r\n forall i {:trigger TMulAutoLe(0, i)} | TMulAutoLe(0, i) && f(i)\r\n ensures f(i + 1)\r\n {\r\n calc {\r\n ((i + 1) * d + r) / d;\r\n { lemma_mul_is_distributive_add_other_way(d, i, 1); }\r\n (i * d + 1 * d + r) / d;\r\n (i * d + d + r) / d;\r\n (i * d + r) / d + 1;\r\n i + 1;\r\n }\r\n }\r\n lemma_mul_auto_induction(q, f);\r\n lemma_mul_auto_induction(q, u => r == (u * d + r) % d);\r\n\r\n// REVIEW: this is a plausible alternative, but it times out:\r\n// lemma_mul_auto();\r\n// lemma_div_auto_induction(d, x, x => x == q * d + r ==> q == x/d && r == x%d);\r\n}\r\n\r\nlemma lemma_mod_pos_bound(x:int, m:int)\r\n decreases x\r\n requires 0 <= x\r\n requires 0 < m\r\n ensures 0 <= x%m < m\r\n{\r\n lemma_mod_auto(m);\r\n}\r\n\r\n\r\nlemma lemma_mul_mod_noop_left(x:int, y:int, m:int)\r\n requires 0 < m\r\n ensures (x % m)*y % m == x*y % m\r\n{\r\n lemma_mod_auto(m);\r\n lemma_mul_auto_induction(y, u => (x % m)*u % m == x*u % m);\r\n}\r\n\r\nlemma lemma_mul_mod_noop_right(x:int, y:int, m:int)\r\n requires 0 < m\r\n ensures x*(y % m) % m == (x*y) % m\r\n{\r\n lemma_mod_auto(m);\r\n lemma_mul_auto_induction(x, u => u*(y % m) % m == (u*y) % m);\r\n}\r\n\r\nlemma lemma_mul_mod_noop_general(x:int, y:int, m:int)\r\n requires 0 < m\r\n ensures ((x % m) * y ) % m == (x * y) % m\r\n ensures ( x * (y % m)) % m == (x * y) % m\r\n ensures ((x % m) * (y % m)) % m == (x * y) % m\r\n{\r\n lemma_mod_properties();\r\n lemma_mul_mod_noop_left(x, y, m);\r\n lemma_mul_mod_noop_right(x, y, m);\r\n lemma_mul_mod_noop_right(x % m, y, m);\r\n}\r\n\r\n\r\nlemma lemma_mul_mod_noop(x:int, y:int, m:int)\r\n requires 0 < m\r\n ensures (x % m) * (y % m) % m == (x*y) % m\r\n{\r\n lemma_mul_mod_noop_general(x, y, m);\r\n}\r\n\r\nlemma lemma_power_mod_noop(b:int, e:nat, m:int)\r\n decreases e\r\n requires 0 < m\r\n ensures power(b % m, e) % m == power(b, e) % m\r\n{\r\n reveal power();\r\n lemma_mod_properties();\r\n if (e > 0)\r\n {\r\n calc {\r\n power(b % m, e) % m;\r\n ((b % m) * power(b % m, e - 1)) % m;\r\n { lemma_mul_mod_noop_general(b, power(b % m, e - 1), m); }\r\n ((b % m) * (power(b % m, e - 1) % m) % m) % m;\r\n { lemma_power_mod_noop(b, e - 1, m); }\r\n ((b % m) * (power(b, e - 1) % m) % m) % m;\r\n { lemma_mul_mod_noop_general(b, power(b, e - 1), m); }\r\n (b * (power(b, e - 1)) % m) % m;\r\n (b * (power(b, e - 1))) % m;\r\n power(b, e) % m;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_mod_subtraction(x:nat, s:nat, d:nat)\r\n requires 0 0\r\n ensures (x * m) % m == 0\r\n{\r\n lemma_mod_auto(m);\r\n lemma_mul_auto_induction(x, u => (u * m) % m == 0);\r\n}\r\n\r\n//-\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n\r\n/************************************************************\r\n * Lemmas that depend on properties of both div and mod *\r\n ************************************************************/\r\n\r\n//-/////////////////////////////////////////////////////\r\n//- Proof that div is recursive div\r\n//-/////////////////////////////////////////////////////\r\nlemma lemma_div_plus_one(x:int, d:int)\r\n requires d > 0\r\n //-requires x >= 0\r\n ensures 1 + x / d == (d + x) / d\r\n{\r\n lemma_div_auto(d);\r\n}\r\n\r\nlemma lemma_div_minus_one(x:int, d:int)\r\n requires d > 0\r\n ensures -1 + x / d == (-d + x) / d\r\n{\r\n lemma_div_auto(d);\r\n}\r\n\r\nlemma lemma_mod_mod(x:int, a:int, b:int)\r\n requires 0 0\r\n ensures my_div_recursive(x, d) == x / d\r\n{\r\n lemma_div_auto_induction(d, x, u => my_div_recursive(u, d) == u / d);\r\n\r\n// Omitted rather than prove lemma_negative_divisor\r\n//\r\n//- if d > 0 {\r\n//- lemma_div_is_div_pos(x, d); \r\n//- } else {\r\n//- calc {\r\n//- my_div_recursive(x, d);\r\n//- -1 * my_div_pos(x, -1*d);\r\n//- { lemma_div_is_div_pos(x, -1*d); }\r\n//- -1 * (x / (-1*d));\r\n//- { lemma_negative_divisor(x, d); }\r\n//- x / d;\r\n//- }\r\n//- }\r\n}\r\n\r\nlemma lemma_div_is_div_recursive_forall()\r\n ensures forall x:int, d:int :: d > 0 ==> my_div_recursive(x, d) == x / d\r\n{\r\n forall x:int, d:int | d > 0\r\n ensures my_div_recursive(x, d) == x / d\r\n {\r\n lemma_div_is_div_recursive(x, d);\r\n }\r\n}\r\n\r\n//-/////////////////////////////////////////////////////\r\n\r\n//-/////////////////////////////////////////////////////\r\n//- Proof that mod is recursive mod\r\n//-/////////////////////////////////////////////////////\r\n\r\nlemma lemma_mod_is_mod_recursive(x:int, m:int)\r\n requires m > 0\r\n ensures my_mod_recursive(x, m) == x % m\r\n decreases if x < 0 then -x + m else x\r\n{\r\n if x < 0 { \r\n calc { \r\n my_mod_recursive(x, m);\r\n my_mod_recursive(x + m, m);\r\n { lemma_mod_is_mod_recursive(x + m, m); }\r\n (x + m) % m;\r\n { lemma_add_mod_noop(x, m, m); } \r\n ((x % m) + (m % m)) % m;\r\n { lemma_mod_basics(); }\r\n (x % m) % m;\r\n { lemma_mod_basics(); }\r\n x % m;\r\n }\r\n } else if x < m { \r\n lemma_small_mod(x, m);\r\n } else {\r\n calc { \r\n my_mod_recursive(x, m);\r\n my_mod_recursive(x - m, m);\r\n { lemma_mod_is_mod_recursive(x - m, m); }\r\n (x - m) % m;\r\n { lemma_sub_mod_noop(x, m, m); } \r\n ((x % m) - (m % m)) % m;\r\n { lemma_mod_basics(); }\r\n (x % m) % m;\r\n { lemma_mod_basics(); }\r\n x % m;\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_mod_is_mod_recursive_forall()\r\n ensures forall x:int, d:int :: d > 0 ==> my_mod_recursive(x, d) == x % d\r\n{\r\n forall x:int, d:int | d > 0\r\n ensures my_mod_recursive(x, d) == x % d\r\n {\r\n lemma_mod_is_mod_recursive(x, d);\r\n }\r\n}\r\n\r\n//-/////////////////////////////////////////////////////\r\n\r\n\r\nlemma lemma_basic_div(d:int)\r\n requires d > 0\r\n ensures forall x {:trigger x / d} :: 0 <= x < d ==> x / d == 0\r\n{\r\n lemma_div_auto(d);\r\n}\r\n\r\nlemma lemma_div_is_ordered(x:int, y:int, z:int)\r\n requires x <= y\r\n requires z > 0\r\n ensures x / z <= y / z\r\n{\r\n lemma_div_auto_induction(z, x - y, xy => xy <= 0 ==> (xy + y) / z <= y / z);\r\n}\r\n\r\nlemma lemma_div_decreases(x:int, d:int)\r\n requires 0 0 u/d < u);\r\n}\r\n\r\nlemma lemma_div_nonincreasing(x:int, d:int)\r\n requires 0<=x\r\n requires 0 0<=u ==> u/d <= u);\r\n}\r\n\r\nlemma lemma_breakdown(a:int, b:int, c:int)\r\n requires 0<=a\r\n requires 0 0 <= u ==> u - divisor < u / divisor * divisor);\r\n}\r\n\r\nlemma lemma_remainder_lower(x:int, divisor:int)\r\n requires 0 <= x\r\n requires 0 < divisor\r\n ensures x >= x / divisor * divisor\r\n{\r\n lemma_mul_auto();\r\n lemma_div_auto_induction(divisor, x, u => 0 <= u ==> u >= u / divisor * divisor);\r\n}\r\n\r\nlemma lemma_remainder(x:int, divisor:int)\r\n requires 0 <= x\r\n requires 0 < divisor\r\n ensures 0 <= x - x / divisor * divisor < divisor\r\n{\r\n lemma_mul_auto();\r\n lemma_div_auto_induction(divisor, x, u => 0 <= u - u / divisor * divisor < divisor);\r\n}\r\n\r\n\r\nlemma lemma_div_denominator(x:int,c:nat,d:nat)\r\n requires 0 <= x\r\n requires 0= d) {\r\n lemma_fundamental_div_mod(R, c);\r\n//- assert R >= c*(R/c);\r\n lemma_mul_inequality(d, R/c, c);\r\n lemma_mul_is_commutative_forall();\r\n//- assert c*(R/c) >= c*d;\r\n//- assert R >= c*d;\r\n assert false;\r\n }\r\n assert R/c < d;\r\n\r\n lemma_mul_basics_forall();\r\n lemma_fundamental_div_mod_converse(R/c, d, 0, R/c);\r\n assert (R/c) % d == R/c;\r\n\r\n lemma_fundamental_div_mod(R, c);\r\n assert c*(R/c) + R%c == R;\r\n\r\n assert c*((R/c) % d) + R%c == R;\r\n\r\n var k := x/(c*d);\r\n lemma_fundamental_div_mod(x, c*d);\r\n assert x == (c*d)*(x/(c*d)) + x % (c*d);\r\n assert R == x - (c*d)*(x/(c*d));\r\n assert R == x - (c*d)*k;\r\n\r\n calc {\r\n c*((x/c)%d) + x%c;\r\n { lemma_mod_multiples_vanish(-k, x/c, d); lemma_mul_is_commutative_forall(); }\r\n c*((x/c+(-k)*d) % d) + x%c;\r\n { lemma_hoist_over_denominator(x, (-k)*d, c); }\r\n c*(((x+(((-k)*d)*c))/c) % d) + x%c;\r\n { lemma_mul_is_associative(-k,d,c); }\r\n c*(((x+((-k)*(d*c)))/c) % d) + x%c;\r\n { lemma_mul_unary_negation(k,d*c); }\r\n c*(((x+(-(k*(d*c))))/c) % d) + x%c;\r\n { lemma_mul_is_associative(k,d,c); }\r\n c*(((x+(-(k*d*c)))/c) % d) + x%c;\r\n c*(((x-k*d*c)/c) % d) + x%c;\r\n {\r\n lemma_mul_is_associative_forall();\r\n lemma_mul_is_commutative_forall();\r\n }\r\n c*((R/c) % d) + x%c;\r\n c*(R/c) + x%c;\r\n { lemma_fundamental_div_mod(R,c);\r\n assert R == c*(R/c) + R % c;\r\n lemma_mod_mod(x,c,d);\r\n assert R%c == x%c;\r\n }\r\n R;\r\n { lemma_mod_is_mod_recursive_forall(); }\r\n R%(c*d);\r\n (x-(c*d)*k) % (c*d);\r\n { lemma_mul_unary_negation(c*d,k); }\r\n (x+(c*d)*(-k)) % (c*d);\r\n { lemma_mod_multiples_vanish(-k, x, c*d); }\r\n x % (c*d);\r\n }\r\n calc ==> {\r\n c*(x/c) + x%c - R == c*(x/c) - c*((x/c)%d);\r\n { lemma_fundamental_div_mod(x,c); }\r\n x - R == c*(x/c) - c*((x/c)%d);\r\n }\r\n calc ==> {\r\n true;\r\n { lemma_fundamental_div_mod(x/c,d); }\r\n d*((x/c)/d) == x/c - ((x/c)%d);\r\n c*(d*((x/c)/d)) == c*(x/c - ((x/c)%d));\r\n { lemma_mul_is_associative_forall(); }\r\n (c*d)*((x/c)/d) == c*(x/c - ((x/c)%d));\r\n { lemma_mul_is_distributive_forall(); }\r\n (c*d)*((x/c)/d) == c*(x/c) - c*((x/c)%d);\r\n (c*d)*((x/c)/d) == x - R;\r\n { lemma_fundamental_div_mod(x, c*d); }\r\n (c*d)*((x/c)/d) == (c*d)*(x/(c*d)) + x%(c*d) - R;\r\n (c*d)*((x/c)/d) == (c*d)*(x/(c*d));\r\n { lemma_mul_one_to_one(c*d, (x/c)/d, x/(c*d)); }\r\n (x/c)/d == x/(c*d);\r\n }\r\n}\r\n\r\nlemma lemma_mul_hoist_inequality(x:int, y:int, z:int)\r\n requires 0 <= x\r\n requires 0 < z\r\n ensures x*(y/z) <= (x*y)/z\r\n{\r\n calc {\r\n (x*y)/z;\r\n { lemma_fundamental_div_mod(y, z); }\r\n (x*(z*(y/z)+y%z))/z;\r\n { lemma_mul_is_distributive_forall(); }\r\n (x*(z*(y/z))+x*(y%z))/z;\r\n >= {\r\n lemma_mod_properties();\r\n lemma_mul_nonnegative(x, y%z);\r\n lemma_div_is_ordered(x*(z*(y/z)), x*(z*(y/z))+x*(y%z), z); }\r\n (x*(z*(y/z)))/z;\r\n { lemma_mul_is_associative_forall();\r\n lemma_mul_is_commutative_forall(); }\r\n (z*(x*(y/z)))/z;\r\n { lemma_div_multiples_vanish(x*(y/z), z); }\r\n x*(y/z);\r\n }\r\n}\r\n\r\nlemma lemma_indistinguishable_quotients(a:int, b:int, d:int)\r\n requires 0 var u := ab + b; 0 <= u - u%d <= b < u + d - u%d ==> u/d == b/d);\r\n}\r\n\r\nlemma lemma_truncate_middle(x:int, b:int, c:int)\r\n requires 0<=x\r\n requires 0 {\r\n true;\r\n { lemma_fundamental_div_mod(x,c); }\r\n x == c*(x/c) + x%c;\r\n b*x == b*(c*(x/c) + x%c);\r\n { lemma_mul_is_distributive_forall(); }\r\n b*x == b*(c*(x/c)) + b*(x%c);\r\n { lemma_mul_is_associative_forall(); }\r\n b*x == (b*c)*(x/c) + b*(x%c);\r\n }\r\n}\r\n\r\nlemma lemma_div_multiples_vanish_quotient(x:int, a:int, d:int)\r\n requires 0 u%d == 0 ==> u==d*((u+r)/d));\r\n}\r\n\r\n\r\nlemma lemma_div_multiples_vanish_fancy(x:int, b:int, d:int)\r\n requires 0 (d*u + b)/d == u;\r\n lemma_mul_auto_induction(x, f);\r\n assert f(x);\r\n}\r\n\r\nlemma lemma_div_multiples_vanish(x:int, d:int)\r\n requires 0 0\r\n ensures x / z < y / z\r\n{\r\n lemma_mod_multiples_basic(m, z);\r\n lemma_div_auto_induction(z, y - x, yx => var u := yx + x; x < u && u % z == 0 ==> x / z < u / z);\r\n}\r\n\r\nlemma lemma_multiply_divide_le(a:int, b:int, c:int)\r\n requires 0 < b\r\n requires a <= b * c\r\n ensures a / b <= c\r\n{\r\n lemma_mod_multiples_basic(c, b);\r\n lemma_div_auto_induction(b, b * c - a, i => 0 <= i && (i + a) % b == 0 ==> a / b <= (i + a) / b);\r\n lemma_div_multiples_vanish(c, b);\r\n}\r\n\r\nlemma lemma_multiply_divide_lt(a:int, b:int, c:int)\r\n requires 0 < b\r\n requires a < b * c\r\n ensures a / b < c\r\n{\r\n lemma_mod_multiples_basic(c, b);\r\n lemma_div_auto_induction(b, b * c - a, i => 0 < i && (i + a) % b == 0 ==> a / b < (i + a) / b);\r\n lemma_div_multiples_vanish(c, b);\r\n}\r\n\r\nlemma lemma_hoist_over_denominator(x:int, j:int, d:nat)\r\n requires 0 x/d + u == (x+u*d) / d);\r\n}\r\n\r\nlemma lemma_part_bound1(a:int, b:int, c:int)\r\n requires 0<=a\r\n requires 0 {\r\n true;\r\n { lemma_mod_properties(); }\r\n b*(a/b) % (b*c) < b*c;\r\n b*((a/b) - (c*((b*(a/b))/(b*c)))) < b*c;\r\n { lemma_mul_is_commutative_forall(); lemma_mul_strict_inequality_converse_forall(); }\r\n ((a/b) - (c*((b*(a/b))/(b*c)))) < c;\r\n ((a/b) - (c*((b*(a/b))/(b*c)))) <= c-1;\r\n { lemma_mul_is_commutative_forall(); lemma_mul_inequality_forall(); }\r\n b*((a/b) - (c*((b*(a/b))/(b*c)))) <= b*(c-1);\r\n b*(a/b) % (b*c) <= b*(c-1);\r\n }\r\n}\r\n\r\nlemma lemma_part_bound2(a:int, b:int, c:int)\r\n requires 0<=a\r\n requires 0 c * d != 0\r\n ensures forall x:int,c:nat,d:nat {:trigger (x/c)/d} :: 0 <= x && 0 < c && 0 < d ==> (x/c)/d == x/(c*d)\r\n{\r\n lemma_mul_nonzero_forall();\r\n forall x:int,c:nat,d:nat | 0 <= x && 0 < c && 0 < d\r\n ensures (x/c)/d == x/(c*d)\r\n {\r\n lemma_div_denominator(x,c,d);\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/div_auto.i.dfy", "content": "include \"mod_auto.i.dfy\"\r\ninclude \"div_auto_proofs.i.dfy\"\r\n\r\nmodule Math__div_auto_i {\r\nimport opened Math__mod_auto_i\r\nimport opened Math__mod_auto_proofs_i\r\nimport opened Math__div_auto_proofs_i\r\n\r\npredicate DivAuto(n:int)\r\n requires n > 0 // TODO: allow n < 0\r\n{\r\n && ModAuto(n)\r\n && (n / n == -((-n) / n) == 1)\r\n && (forall x:int {:trigger x / n} :: 0 <= x < n <==> x / n == 0)\r\n && (forall x:int, y:int {:trigger (x + y) / n} ::\r\n (var z := (x % n) + (y % n);\r\n ( (0 <= z < n && (x + y) / n == x / n + y / n)\r\n || (n <= z < n + n && (x + y) / n == x / n + y / n + 1))))\r\n && (forall x:int, y:int {:trigger (x - y) / n} ::\r\n (var z := (x % n) - (y % n);\r\n ( (0 <= z < n && (x - y) / n == x / n - y / n)\r\n || (-n <= z < 0 && (x - y) / n == x / n - y / n - 1))))\r\n}\r\n\r\nlemma lemma_div_auto(n:int)\r\n requires n > 0\r\n ensures DivAuto(n)\r\n{\r\n lemma_mod_auto(n);\r\n lemma_div_auto_basics(n);\r\n assert (0 + n) / n == 1;\r\n assert (0 - n) / n == -1;\r\n forall x:int, y:int {:trigger (x + y) / n}\r\n ensures var z := (x % n) + (y % n);\r\n (|| (0 <= z < n && (x + y) / n == x / n + y / n)\r\n || (n <= z < 2 * n && (x + y) / n == x / n + y / n + 1))\r\n {\r\n var f := (xx:int, yy:int) =>\r\n (var z := (xx % n) + (yy % n);\r\n ( (0 <= z < n && (xx + yy) / n == xx / n + yy / n)\r\n || (n <= z < 2 * n && (xx + yy) / n == xx / n + yy / n + 1)));\r\n forall i, j\r\n ensures j >= 0 && f(i, j) ==> f(i, j + n)\r\n ensures i < n && f(i, j) ==> f(i - n, j)\r\n ensures j < n && f(i, j) ==> f(i, j - n)\r\n ensures i >= 0 && f(i, j) ==> f(i + n, j)\r\n {\r\n assert ((i + n) + j) / n == ((i + j) + n) / n;\r\n assert (i + (j + n)) / n == ((i + j) + n) / n;\r\n assert ((i - n) + j) / n == ((i + j) - n) / n;\r\n assert (i + (j - n)) / n == ((i + j) - n) / n;\r\n }\r\n forall i, j\r\n ensures 0 <= i < n && 0 <= j < n ==> f(i, j)\r\n {\r\n assert ((i + n) + j) / n == ((i + j) + n) / n;\r\n assert (i + (j + n)) / n == ((i + j) + n) / n;\r\n assert ((i - n) + j) / n == ((i + j) - n) / n;\r\n assert (i + (j - n)) / n == ((i + j) - n) / n;\r\n }\r\n lemma_mod_induction_forall2(n, f);\r\n assert f(x, y);\r\n }\r\n forall x:int, y:int {:trigger (x - y) / n}\r\n ensures var z := (x % n) - (y % n);\r\n (|| (0 <= z < n && (x - y) / n == x / n - y / n)\r\n || (-n <= z < 0 && (x - y) / n == x / n - y / n - 1))\r\n {\r\n var f := (xx:int, yy:int) =>\r\n (var z := (xx % n) - (yy % n);\r\n ( (0 <= z < n && (xx - yy) / n == xx / n - yy / n)\r\n || (-n <= z < 0 && (xx - yy) / n == xx / n - yy / n - 1)));\r\n forall i, j\r\n ensures j >= 0 && f(i, j) ==> f(i, j + n)\r\n ensures i < n && f(i, j) ==> f(i - n, j)\r\n ensures j < n && f(i, j) ==> f(i, j - n)\r\n ensures i >= 0 && f(i, j) ==> f(i + n, j)\r\n {\r\n assert ((i + n) - j) / n == ((i - j) + n) / n;\r\n assert (i - (j - n)) / n == ((i - j) + n) / n;\r\n assert ((i - n) - j) / n == ((i - j) - n) / n;\r\n assert (i - (j + n)) / n == ((i - j) - n) / n;\r\n }\r\n forall i, j\r\n ensures 0 <= i < n && 0 <= j < n ==> f(i, j)\r\n {\r\n assert ((i + n) - j) / n == ((i - j) + n) / n;\r\n assert (i - (j - n)) / n == ((i - j) + n) / n;\r\n assert ((i - n) - j) / n == ((i - j) - n) / n;\r\n assert (i - (j + n)) / n == ((i - j) - n) / n;\r\n }\r\n lemma_mod_induction_forall2(n, f);\r\n assert f(x, y);\r\n }\r\n}\r\n\r\npredicate TDivAutoLe(x:int, y:int) { x <= y }\r\n\r\nlemma lemma_div_auto_induction(n:int, x:int, f:int->bool)\r\n requires n > 0\r\n requires DivAuto(n) ==> && (forall i {:trigger TDivAutoLe(0, i)} :: TDivAutoLe(0, i) && i < n ==> f(i))\r\n && (forall i {:trigger TDivAutoLe(0, i)} :: TDivAutoLe(0, i) && f(i) ==> f(i + n))\r\n && (forall i {:trigger TDivAutoLe(i + 1, n)} :: TDivAutoLe(i + 1, n) && f(i) ==> f(i - n))\r\n ensures DivAuto(n)\r\n ensures f(x)\r\n{\r\n lemma_div_auto(n);\r\n assert forall i :: TDivAutoLe(0, i) && i < n ==> f(i);\r\n assert forall i {:trigger f(i), f(i + n)} :: TDivAutoLe(0, i) && f(i) ==> f(i + n);\r\n assert forall i {:trigger f(i), f(i - n)} :: TDivAutoLe(i + 1, n) && f(i) ==> f(i - n);\r\n lemma_mod_induction_forall(n, f);\r\n assert f(x);\r\n}\r\n\r\nlemma lemma_div_auto_induction_forall(n:int, f:int->bool)\r\n requires n > 0\r\n requires DivAuto(n) ==> && (forall i {:trigger TDivAutoLe(0, i)} :: TDivAutoLe(0, i) && i < n ==> f(i))\r\n && (forall i {:trigger TDivAutoLe(0, i)} :: TDivAutoLe(0, i) && f(i) ==> f(i + n))\r\n && (forall i {:trigger TDivAutoLe(i + 1, n)} :: TDivAutoLe(i + 1, n) && f(i) ==> f(i - n))\r\n ensures DivAuto(n)\r\n ensures forall i {:trigger f(i)} :: f(i)\r\n{\r\n lemma_div_auto(n);\r\n assert forall i :: TDivAutoLe(0, i) && i < n ==> f(i);\r\n assert forall i {:trigger f(i), f(i + n)} :: TDivAutoLe(0, i) && f(i) ==> f(i + n);\r\n assert forall i {:trigger f(i), f(i - n)} :: TDivAutoLe(i + 1, n) && f(i) ==> f(i - n);\r\n lemma_mod_induction_forall(n, f);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/div_auto_proofs.i.dfy", "content": "include \"mod_auto.i.dfy\"\r\n\r\nmodule Math__div_auto_proofs_i {\r\nimport opened Math__mod_auto_i\r\nimport opened Math__mod_auto_proofs_i\r\nimport opened Math__div_nonlinear_i\r\n\r\nlemma lemma_div_auto_basics(n:int)\r\n requires n > 0\r\n ensures n / n == -((-n) / n) == 1\r\n ensures forall x:int {:trigger x / n} :: 0 <= x < n <==> x / n == 0\r\n ensures forall x:int {:trigger (x + n) / n} :: (x + n) / n == x / n + 1\r\n ensures forall x:int {:trigger (x - n) / n} :: (x - n) / n == x / n - 1\r\n{\r\n lemma_mod_auto(n);\r\n lemma_mod_auto_basics(n);\r\n lemma_small_div();\r\n lemma_div_by_self(n);\r\n forall x:int | x / n == 0\r\n ensures 0 <= x < n\r\n {\r\n lemma_fundamental_div_mod(x, n);\r\n }\r\n}\r\n\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/div_def.i.dfy", "content": "//- Specs/implements mathematical div and mod, not the C version.\r\n//- This may produce \"surprising\" results for negative values\r\n//- For example, -3 div 5 is -1 and -3 mod 5 is 2.\r\n//- Note this is consistent: -3 * -1 + 2 == 5\r\n\r\nmodule Math__div_def_i {\r\n/*\r\nfunction mod(x:int, m:int) : int\r\n requires m > 0\r\n decreases if x < 0 then (m - x) else x\r\n{\r\n if x < 0 then\r\n mod(m + x, m)\r\n else if x < m then\r\n x\r\n else\r\n mod(x - m, m)\r\n}\r\n*/\r\n\r\nfunction div(x:int, d:int) : int\r\n requires d != 0\r\n{\r\n x/d\r\n}\r\n\r\nfunction mod(x:int, d:int) : int\r\n requires d != 0\r\n{\r\n x%d\r\n}\r\n\r\nfunction div_recursive(x:int, d:int) : int\r\n requires d != 0\r\n{ INTERNAL_div_recursive(x,d) }\r\n\r\nfunction mod_recursive(x:int, d:int) : int\r\n requires d > 0\r\n{ INTERNAL_mod_recursive(x,d) }\r\n\r\nfunction mod_boogie(x:int, y:int) : int\r\n requires y != 0\r\n{ x % y } //- INTERNAL_mod_boogie(x,y) }\r\n\r\nfunction div_boogie(x:int, y:int) : int\r\n requires y != 0\r\n{ x / y } //-{ INTERNAL_div_boogie(x,y) }\r\n\r\nfunction my_div_recursive(x:int, d:int) : int\r\n requires d != 0\r\n{\r\n if d > 0 then\r\n my_div_pos(x, d)\r\n else\r\n -1 * my_div_pos(x, -1*d)\r\n}\r\n\r\nfunction my_div_pos(x:int, d:int) : int\r\n requires d > 0\r\n decreases if x < 0 then (d - x) else x\r\n{\r\n if x < 0 then\r\n -1 + my_div_pos(x+d, d)\r\n else if x < d then\r\n 0\r\n else\r\n 1 + my_div_pos(x-d, d)\r\n}\r\n\r\nfunction my_mod_recursive(x:int, m:int) : int\r\n requires m > 0\r\n decreases if x < 0 then (m - x) else x\r\n{\r\n if x < 0 then\r\n my_mod_recursive(m + x, m)\r\n else if x < m then\r\n x\r\n else\r\n my_mod_recursive(x - m, m)\r\n}\r\n\r\n\r\n//- Kept for legacy reasons:\r\n//-static function INTERNAL_mod_boogie(x:int, m:int) : int { x % y }\r\nfunction INTERNAL_mod_recursive(x:int, m:int) : int \r\n requires m > 0\r\n{ my_mod_recursive(x, m) }\r\n\r\n//-static function INTERNAL_div_boogie(x:int, m:int) : int { x / m }\r\nfunction INTERNAL_div_recursive(x:int, d:int) : int \r\n requires d != 0\r\n{ my_div_recursive(x, d) }\r\n\r\n\r\n/*\r\nghost method mod_test()\r\n{\r\n assert -3 % 5 == 2;\r\n assert 10 % -5 == 0;\r\n assert 1 % -5 == 1;\r\n assert -3 / 5 == -1;\r\n}\r\n*/\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/div_nonlinear.i.dfy", "content": "//- \r\n//- WARNING: In general, you shouldn't need to call these directly. Try\r\n//- to use the ones in div.i.dfy instead. They're more full-featured anyway.\r\n\r\nmodule Math__div_nonlinear_i {\r\n\r\n// WARNING: Think three times before adding anything to this file!\r\n// Nonlinear verification is highly unstable, so even if it appears to work,\r\n// it may cause problems down the road. Thus, we want to keep this file as\r\n// small and simple as possible. Instead of adding code here, try proving\r\n// it in div.i.dfy using the connection to the recursive definition\r\n\r\nlemma lemma_div_of_0(d:int)\r\n requires d != 0\r\n ensures 0/d == 0\r\n{ }\r\n\r\nlemma lemma_div_by_self(d:int)\r\n requires d != 0\r\n ensures d/d == 1\r\n{ }\r\n\r\nlemma lemma_small_div()\r\n ensures forall x, d {:trigger x / d} :: 0 <= x < d && d > 0 ==> x / d == 0\r\n{ }\r\n\r\nlemma lemma_mod_of_zero_is_zero(m:int)\r\n requires 0 < m\r\n ensures 0 % m == 0\r\n{ }\r\n\r\nlemma lemma_fundamental_div_mod(x:int, d:int)\r\n requires d != 0\r\n ensures x == d * (x/d) + (x%d)\r\n{ }\r\n\r\nlemma lemma_0_mod_anything()\r\n ensures forall m:int {:trigger 0 % m} :: m > 0 ==> 0 % m == 0\r\n{ }\r\n\r\n// lemma lemma_mod_yourself(m:int)\r\n// ensures m > 0 ==> m % m == 0\r\n// { }\r\n\r\nlemma lemma_small_mod(x:nat, m:nat)\r\n requires x 0\r\n ensures 0 <= x % m < m\r\n{ }\r\n\r\nlemma lemma_real_div_gt(x:real, y:real)\r\n requires x > y\r\n requires x >= 0.0\r\n requires y > 0.0\r\n ensures x / y > 1 as real\r\n{ }\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/mod_auto.i.dfy", "content": "include \"mod_auto_proofs.i.dfy\"\r\n\r\nmodule Math__mod_auto_i {\r\nimport opened Math__mod_auto_proofs_i\r\nimport opened Math__div_nonlinear_i\r\nimport opened Math__mul_nonlinear_i\r\nimport opened Math__mul_i\r\n\r\npredicate eq_mod(x:int, y:int, n:int)\r\n requires n > 0\r\n{\r\n (x - y) % n == 0 // same as x % n == y % n, but easier to do induction on x - y than x and y separately\r\n}\r\n\r\npredicate ModAuto(n:int)\r\n requires n > 0;\r\n{\r\n && (n % n == (-n) % n == 0)\r\n && (forall x:int {:trigger (x % n) % n} :: (x % n) % n == x % n)\r\n && (forall x:int {:trigger x % n} :: 0 <= x < n <==> x % n == x)\r\n && (forall x:int, y:int {:trigger (x + y) % n} ::\r\n (var z := (x % n) + (y % n);\r\n ( (0 <= z < n && (x + y) % n == z)\r\n || (n <= z < n + n && (x + y) % n == z - n))))\r\n && (forall x:int, y:int {:trigger (x - y) % n} ::\r\n (var z := (x % n) - (y % n);\r\n ( (0 <= z < n && (x - y) % n == z)\r\n || (-n <= z < 0 && (x - y) % n == z + n))))\r\n}\r\n\r\nlemma lemma_QuotientAndRemainderUnique(x:int, q:int, r:int, n:int)\r\n requires n > 0\r\n requires 0 <= r < n\r\n requires x == q * n + r\r\n ensures q == x / n\r\n ensures r == x % n\r\n decreases if q > 0 then q else -q\r\n{\r\n lemma_mod_auto_basics(n);\r\n lemma_mul_is_commutative_forall();\r\n lemma_mul_is_distributive_add_forall();\r\n lemma_mul_is_distributive_sub_forall();\r\n\r\n if q > 0 {\r\n assert q * n + r == (q - 1) * n + n + r;\r\n lemma_QuotientAndRemainderUnique(x - n, q - 1, r, n);\r\n }\r\n else if q < 0 {\r\n assert q * n + r == (q + 1) * n - n + r;\r\n lemma_QuotientAndRemainderUnique(x + n, q + 1, r, n);\r\n }\r\n else {\r\n lemma_small_div();\r\n assert r / n == 0;\r\n }\r\n}\r\n\r\nlemma lemma_mod_auto(n:int)\r\n requires n > 0\r\n ensures ModAuto(n)\r\n{\r\n lemma_mod_auto_basics(n);\r\n lemma_mul_is_commutative_forall();\r\n lemma_mul_is_distributive_add_forall();\r\n lemma_mul_is_distributive_sub_forall();\r\n\r\n forall x:int, y:int {:trigger (x + y) % n}\r\n ensures var z := (x % n) + (y % n);\r\n || (0 <= z < n && (x + y) % n == z)\r\n || (n <= z < 2 * n && (x + y) % n == z - n)\r\n {\r\n var xq, xr := x / n, x % n;\r\n lemma_fundamental_div_mod(x, n);\r\n assert x == xq * n + xr;\r\n var yq, yr := y / n, y % n;\r\n lemma_fundamental_div_mod(y, n);\r\n assert y == yq * n + yr;\r\n if xr + yr < n {\r\n lemma_QuotientAndRemainderUnique(x + y, xq + yq, xr + yr, n);\r\n }\r\n else {\r\n lemma_QuotientAndRemainderUnique(x + y, xq + yq + 1, xr + yr - n, n);\r\n }\r\n }\r\n\r\n forall x:int, y:int {:trigger (x - y) % n}\r\n ensures var z := (x % n) - (y % n);\r\n || (0 <= z < n && (x - y) % n == z)\r\n || (-n <= z < 0 && (x - y) % n == z + n)\r\n {\r\n var xq, xr := x / n, x % n;\r\n lemma_fundamental_div_mod(x, n);\r\n assert x == xq * n + xr;\r\n var yq, yr := y / n, y % n;\r\n lemma_fundamental_div_mod(y, n);\r\n assert y == yq * n + yr;\r\n if xr - yr >= 0 {\r\n lemma_QuotientAndRemainderUnique(x - y, xq - yq, xr - yr, n);\r\n }\r\n else {\r\n lemma_QuotientAndRemainderUnique(x - y, xq - yq - 1, xr - yr + n, n);\r\n }\r\n }\r\n}\r\n\r\npredicate TModAutoLe(x:int, y:int) { x <= y }\r\n\r\nlemma lemma_mod_auto_induction(n:int, x:int, f:int->bool)\r\n requires n > 0\r\n requires ModAuto(n) ==> && (forall i {:trigger TModAutoLe(0, i)} :: TModAutoLe(0, i) && i < n ==> f(i))\r\n && (forall i {:trigger TModAutoLe(0, i)} :: TModAutoLe(0, i) && f(i) ==> f(i + n))\r\n && (forall i {:trigger TModAutoLe(i + 1, n)} :: TModAutoLe(i + 1, n) && f(i) ==> f(i - n))\r\n ensures ModAuto(n)\r\n ensures f(x)\r\n{\r\n lemma_mod_auto(n);\r\n assert forall i :: TModAutoLe(0, i) && i < n ==> f(i);\r\n assert forall i {:trigger f(i), f(i + n)} :: TModAutoLe(0, i) && f(i) ==> f(i + n);\r\n assert forall i {:trigger f(i), f(i - n)} :: TModAutoLe(i + 1, n) && f(i) ==> f(i - n);\r\n lemma_mod_induction_forall(n, f);\r\n assert f(x);\r\n}\r\n\r\nlemma lemma_mod_auto_induction_forall(n:int, f:int->bool)\r\n requires n > 0\r\n requires ModAuto(n) ==> && (forall i {:trigger TModAutoLe(0, i)} :: TModAutoLe(0, i) && i < n ==> f(i))\r\n && (forall i {:trigger TModAutoLe(0, i)} :: TModAutoLe(0, i) && f(i) ==> f(i + n))\r\n && (forall i {:trigger TModAutoLe(i + 1, n)} :: TModAutoLe(i + 1, n) && f(i) ==> f(i - n))\r\n ensures ModAuto(n)\r\n ensures forall i {:trigger f(i)} :: f(i)\r\n{\r\n lemma_mod_auto(n);\r\n assert forall i :: TModAutoLe(0, i) && i < n ==> f(i);\r\n assert forall i {:trigger f(i), f(i + n)} :: TModAutoLe(0, i) && f(i) ==> f(i + n);\r\n assert forall i {:trigger f(i), f(i - n)} :: TModAutoLe(i + 1, n) && f(i) ==> f(i - n);\r\n lemma_mod_induction_forall(n, f);\r\n}\r\n\r\n/* TODO: if we need these at all, they should have better triggers to protect call sites\r\nlemma lemma_mod_auto_induction2(x:int, y:int, n:int, f:imap<(int,int),bool>)\r\n requires n > 0\r\n requires forall i, j :: (i, j) in f\r\n requires ModAuto(n) ==> (forall i, j {:trigger f[(i, j)]} :: 0 <= i < n && 0 <= j < n ==> f[(i, j)])\r\n requires ModAuto(n) ==> (forall i, j {:trigger f[(i, j)]} :: i >= 0 && f[(i, j)] ==> f[(i + n, j)])\r\n requires ModAuto(n) ==> (forall i, j {:trigger f[(i, j)]} :: j >= 0 && f[(i, j)] ==> f[(i, j + n)])\r\n requires ModAuto(n) ==> (forall i, j {:trigger f[(i, j)]} :: i < n && f[(i, j)] ==> f[(i - n, j)])\r\n requires ModAuto(n) ==> (forall i, j {:trigger f[(i, j)]} :: j < n && f[(i, j)] ==> f[(i, j - n)])\r\n ensures ModAuto(n)\r\n ensures f[(x, y)]\r\n{\r\n lemma_mod_auto(n);\r\n lemma_mod_induction_forall2(n, f);\r\n assert f[(x, y)];\r\n}\r\n\r\nlemma lemma_mod_auto_induction_forall2(n:int, f:imap<(int,int),bool>)\r\n requires n > 0\r\n requires forall i, j :: (i, j) in f\r\n requires ModAuto(n) ==> (forall i, j {:trigger f[(i, j)]} :: 0 <= i < n && 0 <= j < n ==> f[(i, j)])\r\n requires ModAuto(n) ==> (forall i, j {:trigger f[(i, j)]} :: i >= 0 && f[(i, j)] ==> f[(i + n, j)])\r\n requires ModAuto(n) ==> (forall i, j {:trigger f[(i, j)]} :: j >= 0 && f[(i, j)] ==> f[(i, j + n)])\r\n requires ModAuto(n) ==> (forall i, j {:trigger f[(i, j)]} :: i < n && f[(i, j)] ==> f[(i - n, j)])\r\n requires ModAuto(n) ==> (forall i, j {:trigger f[(i, j)]} :: j < n && f[(i, j)] ==> f[(i, j - n)])\r\n ensures ModAuto(n)\r\n ensures forall i, j {:trigger f[(i, j)]} :: f[(i, j)]\r\n{\r\n lemma_mod_auto(n);\r\n lemma_mod_induction_forall2(n, f);\r\n}\r\n*/\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/mod_auto_proofs.i.dfy", "content": "include \"mul_auto.i.dfy\"\r\ninclude \"mul.i.dfy\"\r\ninclude \"div_nonlinear.i.dfy\"\r\n\r\nmodule Math__mod_auto_proofs_i {\r\nimport opened Math__mul_auto_i\r\nimport opened Math__mul_nonlinear_i\r\nimport opened Math__mul_i\r\nimport opened Math__div_nonlinear_i\r\n\r\nlemma lemma_mod_induction_helper(n:int, f:int->bool, x:int)\r\n requires n > 0\r\n requires forall i :: 0 <= i < n ==> f(i)\r\n requires forall i {:trigger f(i), f(i + n)} :: i >= 0 && f(i) ==> f(i + n)\r\n requires forall i {:trigger f(i), f(i - n)} :: i < n && f(i) ==> f(i - n)\r\n ensures f(x)\r\n decreases if x >= n then x else -x\r\n{\r\n if (x >= n)\r\n {\r\n lemma_mod_induction_helper(n, f, x - n);\r\n assert f((x - n) + n);\r\n }\r\n else if (x < 0)\r\n {\r\n lemma_mod_induction_helper(n, f, x + n);\r\n assert f((x + n) - n);\r\n }\r\n}\r\n\r\nlemma lemma_mod_induction_forall(n:int, f:int->bool)\r\n requires n > 0\r\n requires forall i :: 0 <= i < n ==> f(i)\r\n requires forall i {:trigger f(i), f(i + n)} :: i >= 0 && f(i) ==> f(i + n)\r\n requires forall i {:trigger f(i), f(i - n)} :: i < n && f(i) ==> f(i - n)\r\n ensures forall i :: f(i)\r\n{\r\n forall i ensures f(i) { lemma_mod_induction_helper(n, f, i); }\r\n}\r\n\r\nlemma lemma_mod_induction_forall2(n:int, f:(int,int)->bool)\r\n requires n > 0\r\n requires forall i, j :: 0 <= i < n && 0 <= j < n ==> f(i, j)\r\n requires forall i, j {:trigger f(i, j), f(i + n, j)} :: i >= 0 && f(i, j) ==> f(i + n, j)\r\n requires forall i, j {:trigger f(i, j), f(i, j + n)} :: j >= 0 && f(i, j) ==> f(i, j + n)\r\n requires forall i, j {:trigger f(i, j), f(i - n, j)} :: i < n && f(i, j) ==> f(i - n, j)\r\n requires forall i, j {:trigger f(i, j), f(i, j - n)} :: j < n && f(i, j) ==> f(i, j - n)\r\n ensures forall i, j :: f(i, j)\r\n{\r\n forall x, y\r\n ensures f(x, y)\r\n {\r\n forall i | 0 <= i < n\r\n ensures f(i, y)\r\n {\r\n var fj := j => f(i, j);\r\n lemma_mod_induction_forall(n, fj);\r\n assert fj(y);\r\n }\r\n var fi := i => f(i, y);\r\n lemma_mod_induction_forall(n, fi);\r\n assert fi(x);\r\n }\r\n}\r\n\r\nlemma lemma_mod_auto_basics(n:int)\r\n requires n > 0\r\n ensures forall x:int {:trigger (x + n) % n} :: (x + n) % n == x % n\r\n ensures forall x:int {:trigger (x - n) % n} :: (x - n) % n == x % n\r\n ensures forall x:int {:trigger (x + n) / n} :: (x + n) / n == x / n + 1\r\n ensures forall x:int {:trigger (x - n) / n} :: (x - n) / n == x / n - 1\r\n ensures forall x:int {:trigger x % n} :: 0 <= x < n <==> x % n == x\r\n{\r\n forall x:int\r\n ensures 0 <= x < n <==> x % n == x\r\n {\r\n if (0 <= x < n) { lemma_small_mod(x, n); }\r\n lemma_mod_range(x, n);\r\n }\r\n forall x:int\r\n ensures (x + n) % n == x % n\r\n ensures (x - n) % n == x % n\r\n ensures (x + n) / n == x / n + 1\r\n ensures (x - n) / n == x / n - 1\r\n {\r\n lemma_fundamental_div_mod(x, n);\r\n lemma_fundamental_div_mod(x + n, n);\r\n lemma_fundamental_div_mod(x - n, n);\r\n lemma_mod_range(x, n);\r\n lemma_mod_range(x + n, n);\r\n lemma_mod_range(x - n, n);\r\n var zp := (x + n) / n - x / n - 1;\r\n var zm := (x - n) / n - x / n + 1;\r\n forall ensures 0 == n * zp + ((x + n) % n) - (x % n) { lemma_mul_auto(); }\r\n forall ensures 0 == n * zm + ((x - n) % n) - (x % n) { lemma_mul_auto(); }\r\n if (zp > 0) { lemma_mul_inequality(1, zp, n); }\r\n if (zp < 0) { lemma_mul_inequality(zp, -1, n); }\r\n if (zp == 0) { lemma_mul_by_zero_is_zero(n); }\r\n if (zm > 0) { lemma_mul_inequality(1, zm, n); }\r\n if (zm < 0) { lemma_mul_inequality(zm, -1, n); }\r\n }\r\n}\r\n\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/mul.i.dfy", "content": "include \"mul_nonlinear.i.dfy\"\r\ninclude \"mul_auto.i.dfy\"\r\n\r\nmodule Math__mul_i {\r\nimport opened Math__mul_nonlinear_i\r\nimport opened Math__mul_auto_i\r\n\r\n// TODO_MODULE: module Math__mul_i {\r\n// TODO_MODULE: import opened Math__mul_nonlinear_i\r\n\r\nfunction mul(x:int, y:int) : int { x*y }\r\n\r\n//-////////////////////////////////////////////////////////////\r\n//- Recursive definitions that can be handy for proving \r\n//- properties we can't or don't want to rely on nonlinear for\r\n//-////////////////////////////////////////////////////////////\r\n\r\nfunction mul_recursive(x:int, y:int) : int\r\n{\r\n if x >= 0 then mul_pos(x, y)\r\n else -1*mul_pos(-1*x, y)\r\n}\r\n\r\nfunction{:opaque} mul_pos(x:int, y:int) : int\r\n requires x >= 0\r\n{\r\n if x == 0 then 0\r\n else y + mul_pos(x - 1, y)\r\n}\r\n\r\nlemma lemma_mul_is_mul_recursive(x:int, y:int)\r\n ensures x * y == mul_recursive(x, y)\r\n{\r\n if (x >= 0) { lemma_mul_is_mul_pos(x, y); }\r\n if (x <= 0) { lemma_mul_is_mul_pos(-x, y); }\r\n lemma_mul_auto();\r\n}\r\n\r\nlemma lemma_mul_is_mul_pos(x:int, y:int)\r\n requires x >= 0\r\n ensures x * y == mul_pos(x, y)\r\n{\r\n reveal_mul_pos();\r\n lemma_mul_auto_induction(x, u => u >= 0 ==> u * y == mul_pos(u, y));\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//-\r\n//- Core lemmas, with named arguments.\r\n//-\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nlemma lemma_mul_basics(x:int)\r\n ensures 0*x == 0\r\n ensures x*0 == 0\r\n ensures 1*x == x\r\n ensures x*1 == x\r\n{\r\n}\r\n\r\nlemma lemma_mul_is_commutative(x:int, y:int)\r\n ensures x*y == y*x\r\n{\r\n}\r\n\r\nlemma lemma_mul_ordering_general()\r\n ensures forall x:int, y:int {:trigger x*y} :: (0 < x && 0 < y && 0 <= x*y) ==> x <= x*y && y <= x*y\r\n{\r\n forall x:int, y:int | 0 < x && 0 < y && 0 <= x*y\r\n ensures x <= x*y && y <= x*y\r\n {\r\n lemma_mul_ordering(x, y);\r\n }\r\n}\r\n\r\nlemma lemma_mul_is_mul_boogie(x:int, y:int)\r\n{\r\n}\r\n\r\nlemma lemma_mul_inequality(x:int, y:int, z:int)\r\n requires x <= y\r\n requires z >= 0\r\n ensures x*z <= y*z\r\n{\r\n lemma_mul_auto_induction(z, u => u >= 0 ==> x * u <= y * u);\r\n}\r\n\r\nlemma lemma_mul_upper_bound(x:int, x_bound:int, y:int, y_bound:int)\r\n requires x <= x_bound\r\n requires y <= y_bound\r\n requires 0<=x\r\n requires 0<=y\r\n ensures x*y <= x_bound * y_bound\r\n{\r\n lemma_mul_inequality(x, x_bound, y);\r\n lemma_mul_inequality(y, y_bound, x_bound);\r\n}\r\n\r\n//- This lemma is less precise than the non-strict version, since\r\n//- it uses two < facts to achieve only one < result. Thus, use it with\r\n//- caution -- it may be throwing away precision you'll require later.\r\nlemma lemma_mul_strict_upper_bound(x:int, x_bound:int, y:int, y_bound:int)\r\n requires x < x_bound\r\n requires y < y_bound\r\n requires 0<=x\r\n requires 0<=y\r\n ensures x*y < x_bound * y_bound\r\n{\r\n lemma_mul_auto_induction(x, u => 0 <= u ==> u * y <= u * y_bound);\r\n lemma_mul_auto_induction(y_bound, u => 1 <= u ==> x * u < x_bound * u);\r\n}\r\n\r\nlemma lemma_mul_left_inequality(x:int, y:int, z:int)\r\n requires x > 0\r\n ensures y <= z ==> x*y <= x*z\r\n ensures y < z ==> x*y < x*z\r\n{\r\n lemma_mul_auto_induction(x, u => u > 0 ==> y <= z ==> u*y <= u*z);\r\n lemma_mul_auto_induction(x, u => u > 0 ==> y < z ==> u*y < u*z);\r\n}\r\n\r\nlemma lemma_mul_strict_inequality_converse(x:int, y:int, z:int)\r\n requires x*z < y*z\r\n requires z >= 0\r\n ensures x < y\r\n{\r\n lemma_mul_auto_induction(z, u => x * u < y * u && u >= 0 ==> x < y);\r\n}\r\n\r\nlemma lemma_mul_inequality_converse(x:int, y:int, z:int)\r\n requires x*z <= y*z\r\n requires z > 0\r\n ensures x <= y\r\n{\r\n lemma_mul_auto_induction(z, u => x * u <= y * u && u > 0 ==> x <= y);\r\n}\r\n\r\nlemma lemma_mul_equality_converse(x:int, y:int, z:int)\r\n requires x*z == y*z\r\n requires 0 x > y && 0 < u ==> x * u > y * u);\r\n lemma_mul_auto_induction(z, u => x < y && 0 < u ==> x * u < y * u);\r\n}\r\n\r\nlemma lemma_mul_is_distributive_add_other_way(x:int, y:int, z:int)\r\n ensures (y + z)*x == y*x + z*x\r\n{\r\n lemma_mul_auto();\r\n}\r\n\r\nlemma lemma_mul_is_distributive_sub(x:int, y:int, z:int)\r\n ensures x*(y - z) == x*y - x*z\r\n{\r\n lemma_mul_auto();\r\n}\r\n\r\nlemma lemma_mul_is_distributive(x:int, y:int, z:int)\r\n ensures x*(y + z) == x*y + x*z\r\n ensures x*(y - z) == x*y - x*z\r\n ensures (y + z)*x == y*x + z*x\r\n ensures (y - z)*x == y*x - z*x\r\n ensures x*(y + z) == (y + z)*x\r\n ensures x*(y - z) == (y - z)*x\r\n ensures x*y == y*x\r\n ensures x*z == z*x\r\n{\r\n lemma_mul_auto();\r\n}\r\n\r\nlemma lemma_mul_strictly_increases(x:int, y:int)\r\n requires 1 < x\r\n requires 0 < y\r\n ensures y < x*y\r\n{\r\n lemma_mul_auto_induction(x, u => 1 < u ==> y < u * y);\r\n}\r\n\r\nlemma lemma_mul_increases(x:int, y:int)\r\n requires 0 0 < u ==> y <= u * y);\r\n}\r\n\r\nlemma lemma_mul_nonnegative(x:int, y:int)\r\n requires 0 <= x\r\n requires 0 <= y\r\n ensures 0 <= x*y\r\n{\r\n lemma_mul_auto_induction(x, u => 0 <= u ==> 0 <= u * y);\r\n}\r\n\r\nlemma lemma_mul_unary_negation(x:int, y:int)\r\n ensures (-x)*y == -(x*y) == x*(-y)\r\n{\r\n lemma_mul_auto_induction(x, u => (-u)*y == -(u*y) == u*(-y));\r\n}\r\n\r\n// TODO: delete lemma_mul_one_to_one_pos; use lemma_mul_one_to_one instead\r\nlemma lemma_mul_one_to_one_pos(m:int, x:int, y:int)\r\n requires 0 x > y && 0 < u ==> x * u > y * u);\r\n lemma_mul_auto_induction(m, u => x < y && 0 < u ==> x * u < y * u);\r\n}\r\n\r\nlemma lemma_mul_one_to_one(m:int, x:int, y:int)\r\n requires m!=0\r\n requires m*x == m*y\r\n ensures x == y\r\n{\r\n lemma_mul_auto_induction(m, u => x > y && 0 < u ==> x * u > y * u);\r\n lemma_mul_auto_induction(m, u => x > y && 0 > u ==> x * u < y * u);\r\n lemma_mul_auto_induction(m, u => x < y && 0 < u ==> x * u < y * u);\r\n lemma_mul_auto_induction(m, u => x < y && 0 > u ==> x * u > y * u);\r\n}\r\n\r\n//-////////////////////////////////////////////////////////////////////////////\r\n//-\r\n//- Forall lemmas: these restate the core lemmas with foralls,\r\n//- so callers needn't name the specific expressions to manipulate.\r\n//-\r\n//- These are all boilerplate transformations of args/requires/ensures\r\n//- into forall args :: requires ==> ensures, with a correpsonding\r\n//- mechanically generated forall proof that invokes the core lemma.\r\n// So don't bother reading them.\r\n//-\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\nlemma lemma_mul_is_mul_recursive_forall()\r\n ensures forall x:int, y:int :: x * y == mul_recursive(x, y)\r\n{\r\n forall x:int, y:int\r\n ensures x * y == mul_recursive(x, y)\r\n {\r\n lemma_mul_is_mul_recursive(x, y);\r\n }\r\n}\r\n\r\nlemma lemma_mul_basics_forall()\r\n ensures forall x:int {:trigger 0*x} :: 0*x == 0\r\n ensures forall x:int {:trigger x*0} :: x*0 == 0\r\n ensures forall x:int {:trigger 1*x} :: 1*x == x\r\n ensures forall x:int {:trigger x*1} :: x*1 == x\r\n{\r\n}\r\n\r\nlemma lemma_mul_is_commutative_forall()\r\n ensures forall x:int, y:int {:trigger x*y} :: x*y == y*x\r\n{\r\n}\r\n\r\nlemma lemma_mul_ordering_forall()\r\n ensures forall x:int, y:int {:trigger x*y} ::\r\n 0 < x && 0 < y && 0 <= x*y ==> x <= x*y && y <= x*y\r\n{\r\n forall x:int, y:int | 0 < x && 0 < y && 0 <= x*y\r\n ensures x <= x*y && y <= x*y\r\n {\r\n lemma_mul_ordering(x,y);\r\n }\r\n}\r\n\r\nlemma lemma_mul_strict_inequality_forall()\r\n ensures forall x:int, y:int, z:int {:trigger x*z, y*z} :: x < y && z>0 ==> x*z < y*z\r\n{\r\n forall (x:int, y:int, z:int | x < y && z>0)\r\n ensures x*z < y*z\r\n {\r\n lemma_mul_strict_inequality(x, y, z);\r\n }\r\n}\r\n\r\nlemma lemma_mul_inequality_forall()\r\n ensures forall x:int, y:int, z:int {:trigger x*z, y*z} :: x <= y && z>=0 ==> x*z <= y*z\r\n{\r\n forall (x:int, y:int, z:int | x <= y && z>=0)\r\n ensures x*z <= y*z\r\n {\r\n lemma_mul_inequality(x, y, z);\r\n }\r\n}\r\n\r\nlemma lemma_mul_strict_inequality_converse_forall()\r\n ensures forall x:int, y:int, z:int {:trigger x*z, y*z} :: x*z < y*z && z>=0 ==> x < y\r\n{\r\n forall (x:int, y:int, z:int | x*z < y*z && z>=0)\r\n ensures x < y;\r\n {\r\n lemma_mul_strict_inequality_converse(x,y,z);\r\n }\r\n}\r\n\r\nlemma lemma_mul_inequality_converse_forall()\r\n ensures forall x:int, y:int, z:int {:trigger x*z, y*z} :: x*z <= y*z && z>0 ==> x <= y\r\n{\r\n forall (x:int, y:int, z:int | x*z <= y*z && z>0)\r\n ensures x <= y\r\n {\r\n lemma_mul_inequality_converse(x,y,z);\r\n }\r\n}\r\n\r\nlemma lemma_mul_is_distributive_add_forall()\r\n ensures forall x:int, y:int, z:int {:trigger x*(y + z)} :: x*(y + z) == x*y + x*z\r\n{\r\n forall (x:int, y:int, z:int)\r\n ensures x*(y + z) == x*y + x*z\r\n {\r\n lemma_mul_is_distributive_add(x,y,z);\r\n }\r\n}\r\n\r\nlemma lemma_mul_is_distributive_sub_forall()\r\n ensures forall x:int, y:int, z:int {:trigger x*(y - z)} :: x*(y - z) == x*y - x*z\r\n{\r\n forall (x:int, y:int, z:int)\r\n ensures x*(y - z) == x*y - x*z;\r\n {\r\n lemma_mul_is_distributive_sub(x,y,z);\r\n }\r\n}\r\n\r\nlemma lemma_mul_is_distributive_forall()\r\n ensures forall x:int, y:int, z:int {:trigger x*(y + z)} :: x*(y + z) == x*y + x*z\r\n ensures forall x:int, y:int, z:int {:trigger x*(y - z)} :: x*(y - z) == x*y - x*z\r\n ensures forall x:int, y:int, z:int {:trigger (y + z)*x} :: (y + z)*x == y*x + z*x\r\n ensures forall x:int, y:int, z:int {:trigger (y - z)*x} :: (y - z)*x == y*x - z*x\r\n{\r\n lemma_mul_is_distributive_add_forall();\r\n lemma_mul_is_distributive_sub_forall();\r\n lemma_mul_is_commutative_forall();\r\n}\r\n\r\nlemma lemma_mul_is_associative_forall()\r\n ensures forall x:int, y:int, z:int {:trigger x * (y * z)}{:trigger (x * y) * z} :: x * (y * z) == (x * y) * z\r\n{\r\n forall (x:int, y:int, z:int)\r\n ensures x * (y * z) == (x * y) * z\r\n {\r\n lemma_mul_is_associative(x,y,z);\r\n }\r\n}\r\n\r\nlemma lemma_mul_nonzero_forall()\r\n ensures forall x:int, y:int {:trigger x*y} :: x*y != 0 <==> x != 0 && y != 0\r\n{\r\n forall (x:int, y:int)\r\n ensures x*y != 0 <==> x != 0 && y != 0;\r\n {\r\n lemma_mul_nonzero(x,y);\r\n }\r\n}\r\n\r\nlemma lemma_mul_nonnegative_forall()\r\n ensures forall x:int, y:int {:trigger x*y} :: 0 <= x && 0 <= y ==> 0 <= x*y\r\n{\r\n forall (x:int, y:int | 0 <= x && 0 <= y)\r\n ensures 0 <= x*y\r\n {\r\n lemma_mul_nonnegative(x,y);\r\n }\r\n}\r\n\r\nlemma lemma_mul_unary_negation_forall()\r\n ensures forall x:int, y:int {:trigger (-x)*y}{:trigger x*(-y)} :: (-x)*y == -(x*y) == x*(-y)\r\n{\r\n forall (x:int, y:int) \r\n ensures (-x)*y == -(x*y) == x*(-y)\r\n {\r\n lemma_mul_unary_negation(x,y);\r\n }\r\n}\r\n\r\nlemma lemma_mul_strictly_increases_forall()\r\n ensures forall x:int, y:int {:trigger x*y} :: (1 < x && 0 < y) ==> (y < x*y)\r\n{\r\n forall (x:int, y:int | 1 < x && 0 < y)\r\n ensures y < x*y\r\n {\r\n lemma_mul_strictly_increases(x,y);\r\n }\r\n}\r\n\r\nlemma lemma_mul_increases_forall()\r\n ensures forall x:int, y:int {:trigger x*y} :: (0 < x && 0 < y) ==> (y <= x*y)\r\n{\r\n forall (x:int, y:int | 0 < x && 0 < y)\r\n ensures y <= x*y\r\n {\r\n lemma_mul_increases(x,y);\r\n }\r\n}\r\n\r\nlemma lemma_mul_strictly_positive_forall()\r\n ensures forall x:int, y:int {:trigger x*y} :: (0 < x && 0 < y) ==> (0 < x*y)\r\n{\r\n forall (x:int, y:int | 0 < x && 0 < y)\r\n ensures 0 < x*y\r\n {\r\n lemma_mul_strictly_positive(x,y);\r\n }\r\n}\r\n\r\nlemma lemma_mul_one_to_one_forall()\r\n ensures forall m:int, x:int, y:int {:trigger m*x, m*y} :: (m!=0 && m*x == m*y) ==> x==y\r\n{\r\n forall (m:int, x:int, y:int | m!=0 && m*x == m*y)\r\n ensures x==y\r\n {\r\n lemma_mul_one_to_one(m, x, y);\r\n }\r\n}\r\n\r\nlemma lemma_mul_by_zero_is_zero_forall()\r\n ensures forall x: int {:trigger 0*x} {:trigger x*0} :: x*0 == 0*x == 0\r\n{\r\n forall x:int {:trigger 0*x} {:trigger x*0}\r\n ensures x*0 == 0*x == 0\r\n {\r\n lemma_mul_by_zero_is_zero(x);\r\n }\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n//\r\n// The big properties bundle. This can be a little dangerous, because\r\n// it may produce a trigger storm. Whether it does seems to depend on\r\n// how complex the expressions being mul'ed are. If that happens,\r\n// fall back on specifying an individiual _forall lemma or use\r\n// lemma_mul_auto/lemma_mul_auto_induction.\r\n//\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\nlemma lemma_mul_properties()\r\n ensures forall x:int, y:int {:trigger x*y} :: x*y == y*x\r\n// ensures forall x:int {:trigger x*0}{:trigger 0*x} :: x*0 == 0*x == 0\r\n ensures forall x:int {:trigger x*1}{:trigger 1*x} :: x*1 == 1*x == x\r\n ensures forall x:int, y:int, z:int {:trigger x*z, y*z} :: x < y && z > 0 ==> x*z < y*z\r\n ensures forall x:int, y:int, z:int {:trigger x*z, y*z} :: x <= y && z >= 0 ==> x*z <= y*z\r\n ensures forall x:int, y:int, z:int {:trigger x*(y + z)} :: x*(y + z) == x*y + x*z\r\n ensures forall x:int, y:int, z:int {:trigger x*(y - z)} :: x*(y - z) == x*y - x*z\r\n ensures forall x:int, y:int, z:int {:trigger (y + z)*x} :: (y + z)*x == y*x + z*x\r\n ensures forall x:int, y:int, z:int {:trigger (y - z)*x} :: (y - z)*x == y*x - z*x\r\n ensures forall x:int, y:int, z:int {:trigger x*(y*z)}{:trigger (x*y)*z} :: x*(y*z) == (x*y)*z\r\n ensures forall x:int, y:int {:trigger x*y} :: x*y != 0 <==> x != 0 && y != 0\r\n ensures forall x:int, y:int {:trigger x*y} :: 0 <= x && 0 <= y ==> 0 <= x*y\r\n ensures forall x:int, y:int {:trigger x*y} :: 0 < x && 0 < y && 0 <= x*y ==> x <= x*y && y <= x*y\r\n ensures forall x:int, y:int {:trigger x*y} :: (1 < x && 0 < y) ==> (y < x*y)\r\n ensures forall x:int, y:int {:trigger x*y} :: (0 < x && 0 < y) ==> (y <= x*y)\r\n ensures forall x:int, y:int {:trigger x*y} :: (0 < x && 0 < y) ==> (0 < x*y)\r\n{\r\n lemma_mul_strict_inequality_forall();\r\n lemma_mul_inequality_forall();\r\n lemma_mul_is_distributive_forall();\r\n lemma_mul_is_associative_forall();\r\n lemma_mul_ordering_forall();\r\n lemma_mul_nonzero_forall();\r\n lemma_mul_nonnegative_forall();\r\n lemma_mul_strictly_increases_forall();\r\n lemma_mul_increases_forall();\r\n}\r\n\r\n//- Kept for legacy reasons:\r\nfunction INTERNAL_mul_recursive(x:int, y:int) : int { mul_recursive(x, y) }\r\n\r\n// TODO_MODULE: } import opened Math__mul_i_ = Math__mul_i\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/mul_auto.i.dfy", "content": "include \"mul_auto_proofs.i.dfy\"\r\n\r\nmodule Math__mul_auto_i {\r\nimport opened Math__mul_auto_proofs_i\r\n\r\npredicate MulAuto()\r\n{\r\n && (forall x:int, y:int {:trigger x * y} :: x * y == y * x)\r\n && (forall x:int, y:int, z:int {:trigger (x + y) * z} :: (x + y) * z == x * z + y * z)\r\n && (forall x:int, y:int, z:int {:trigger (x - y) * z} :: (x - y) * z == x * z - y * z)\r\n}\r\n\r\nlemma lemma_mul_auto()\r\n ensures MulAuto()\r\n{\r\n lemma_mul_auto_commutes();\r\n lemma_mul_auto_distributes();\r\n}\r\n\r\npredicate TMulAutoLe(x:int, y:int) { x <= y }\r\n\r\nlemma lemma_mul_auto_induction(x:int, f:int->bool)\r\n requires MulAuto() ==> f(0)\r\n && (forall i {:trigger TMulAutoLe(0, i)} :: TMulAutoLe(0, i) && f(i) ==> f(i + 1))\r\n && (forall i {:trigger TMulAutoLe(i, 0)} :: TMulAutoLe(i, 0) && f(i) ==> f(i - 1))\r\n ensures MulAuto()\r\n ensures f(x)\r\n{\r\n lemma_mul_auto_commutes();\r\n lemma_mul_auto_distributes();\r\n assert forall i {:trigger f(i)} :: TMulAutoLe(0, i) && f(i) ==> f(i + 1);\r\n assert forall i {:trigger f(i)} :: TMulAutoLe(i, 0) && f(i) ==> f(i - 1);\r\n lemma_mul_induction_forall(f);\r\n assert f(x);\r\n}\r\n\r\nlemma lemma_mul_auto_induction_forall(f:int->bool)\r\n requires MulAuto() ==> f(0)\r\n && (forall i {:trigger TMulAutoLe(0, i)} :: TMulAutoLe(0, i) && f(i) ==> f(i + 1))\r\n && (forall i {:trigger TMulAutoLe(i, 0)} :: TMulAutoLe(i, 0) && f(i) ==> f(i - 1))\r\n ensures MulAuto()\r\n ensures forall i {:trigger f(i)} :: f(i)\r\n{\r\n lemma_mul_auto_commutes();\r\n lemma_mul_auto_distributes();\r\n assert forall i {:trigger f(i)} :: TMulAutoLe(0, i) && f(i) ==> f(i + 1);\r\n assert forall i {:trigger f(i)} :: TMulAutoLe(i, 0) && f(i) ==> f(i - 1);\r\n lemma_mul_induction_forall(f);\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/mul_auto_proofs.i.dfy", "content": "include \"mul_nonlinear.i.dfy\"\r\n\r\nmodule Math__mul_auto_proofs_i {\r\nimport opened Math__mul_nonlinear_i\r\n\r\nlemma lemma_mul_induction_helper(f:int->bool, x:int)\r\n requires f(0)\r\n requires forall i {:trigger f(i), f(i + 1)} :: i >= 0 && f(i) ==> f(i + 1)\r\n requires forall i {:trigger f(i), f(i - 1)} :: i <= 0 && f(i) ==> f(i - 1)\r\n ensures f(x)\r\n decreases if x >= 0 then x else -x\r\n{\r\n if (x > 0)\r\n {\r\n lemma_mul_induction_helper(f, x - 1);\r\n assert f((x - 1) + 1);\r\n }\r\n else if (x < 0)\r\n {\r\n lemma_mul_induction_helper(f, x + 1);\r\n assert f((x + 1) - 1);\r\n }\r\n}\r\n\r\nlemma lemma_mul_induction_forall(f:int->bool)\r\n requires f(0)\r\n requires forall i {:trigger f(i), f(i + 1)} :: i >= 0 && f(i) ==> f(i + 1)\r\n requires forall i {:trigger f(i), f(i - 1)} :: i <= 0 && f(i) ==> f(i - 1)\r\n ensures forall i :: f(i)\r\n{\r\n forall i ensures f(i) { lemma_mul_induction_helper(f, i); }\r\n}\r\n\r\nlemma lemma_mul_auto_commutes()\r\n ensures forall x:int, y:int {:trigger x * y} :: x * y == y * x\r\n{\r\n forall x:int, y:int\r\n ensures x * y == y * x\r\n {\r\n lemma_mul_induction_forall(i => x * i == i * x);\r\n }\r\n}\r\n\r\nlemma lemma_mul_auto_succ()\r\n ensures forall x:int, y:int {:trigger (x + 1) * y} :: (x + 1) * y == x * y + y\r\n ensures forall x:int, y:int {:trigger (x - 1) * y} :: (x - 1) * y == x * y - y\r\n{\r\n lemma_mul_auto_commutes();\r\n forall x:int, y:int\r\n ensures (x + 1) * y == x * y + y\r\n ensures (x - 1) * y == x * y - y\r\n {\r\n lemma_mul_is_distributive_add(y, x, 1);\r\n lemma_mul_is_distributive_add(y, x, -1);\r\n }\r\n}\r\n\r\nlemma lemma_mul_auto_distributes()\r\n ensures forall x:int, y:int, z:int {:trigger (x + y) * z} :: (x + y) * z == x * z + y * z\r\n ensures forall x:int, y:int, z:int {:trigger (x - y) * z} :: (x - y) * z == x * z - y * z\r\n{\r\n lemma_mul_auto_succ();\r\n forall x:int, y:int, z:int\r\n ensures (x + y) * z == x * z + y * z\r\n ensures (x - y) * z == x * z - y * z\r\n {\r\n var f1 := i => (x + i) * z == x * z + i * z;\r\n var f2 := i => (x - i) * z == x * z - i * z;\r\n assert forall i {:trigger (x + (i + 1)) * z} :: (x + (i + 1)) * z == ((x + i) + 1) * z == (x + i) * z + z;\r\n assert forall i {:trigger (x + (i - 1)) * z} :: (x + (i - 1)) * z == ((x + i) - 1) * z == (x + i) * z - z;\r\n assert forall i {:trigger (x - (i + 1)) * z} :: (x - (i + 1)) * z == ((x - i) - 1) * z == (x - i) * z - z;\r\n assert forall i {:trigger (x - (i - 1)) * z} :: (x - (i - 1)) * z == ((x - i) + 1) * z == (x - i) * z + z;\r\n lemma_mul_induction_forall(f1);\r\n lemma_mul_induction_forall(f2);\r\n assert f1(y);\r\n assert f2(y);\r\n }\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/mul_nonlinear.i.dfy", "content": "//- \r\n//- WARNING: In general, you shouldn't need to call these directly. Try\r\n//- to use the ones in mul.i.dfy instead. They're more full-featured anyway.\r\n\r\nmodule Math__mul_nonlinear_i {\r\n\r\n// TODO_MODULE: module Math__mul_nonlinear_i {\r\n\r\n// WARNING: Think three times before adding anything to this file!\r\n// Nonlinear verification is highly unstable, so even if it appears to work,\r\n// it may cause problems down the road. Thus, we want to keep this file as\r\n// small and simple as possible. Instead of adding code here, try proving\r\n// it in div.i.dfy using the connection to the recursive definition\r\n\r\nlemma lemma_mul_strictly_positive(x:int, y:int)\r\n ensures (0 < x && 0 < y) ==> (0 < x*y)\r\n{}\r\n\r\nlemma lemma_mul_nonzero(x:int, y:int)\r\n ensures x*y != 0 <==> x != 0 && y != 0\r\n{}\r\n\r\nlemma lemma_mul_is_associative(x:int, y:int, z:int)\r\n ensures x * (y * z) == (x * y) * z\r\n{}\r\n\r\nlemma lemma_mul_is_distributive_add(x:int, y:int, z:int)\r\n ensures x*(y + z) == x*y + x*z\r\n{}\r\n\r\nlemma lemma_mul_ordering(x:int, y:int)\r\n requires 0 < x\r\n requires 0 < y\r\n requires 0 <= x*y\r\n ensures x <= x*y && y <= x*y\r\n{ }\r\n\r\nlemma lemma_mul_strict_inequality(x:int, y:int, z:int)\r\n requires x < y\r\n requires z > 0\r\n ensures x*z < y*z\r\n{}\r\n\r\nlemma lemma_mul_by_zero_is_zero(x:int)\r\n ensures 0*x == 0\r\n ensures x*0 == 0\r\n{ }\r\n\r\n// TODO_MODULE: } import opened Math__mul_nonlinear_i_ = Math__mul_nonlinear_i\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/power.i.dfy", "content": "include \"powers.i.dfy\"\r\ninclude \"mul.i.dfy\"\r\n\r\nmodule Math__power_i {\r\nimport opened Math__power_s\r\nimport opened Math__mul_i\r\nimport opened Math__mul_auto_i\r\n\r\n//-lemma lemma_mul_passes_harmlessly_through_mod(\r\n//- ensures mul(x,y) % m == mul(x\r\n\r\nlemma lemma_power_0(b:int)\r\n ensures power(b,0) == 1\r\n{\r\n reveal power();\r\n}\r\n\r\nlemma lemma_power_1(b:int)\r\n ensures power(b,1) == b\r\n{\r\n calc {\r\n power(b,1);\r\n { reveal power(); }\r\n b*power(b,0);\r\n { lemma_power_0(b); }\r\n b*1;\r\n { lemma_mul_basics_forall(); }\r\n b;\r\n }\r\n}\r\n\r\nlemma lemma_0_power(e:nat)\r\n requires e > 0\r\n ensures power(0,e) == 0\r\n{\r\n reveal power();\r\n lemma_mul_basics_forall();\r\n if (e != 1)\r\n {\r\n lemma_0_power(e - 1);\r\n }\r\n}\r\n\r\nlemma lemma_1_power(e:nat)\r\n ensures power(1,e) == 1\r\n{\r\n reveal power();\r\n lemma_mul_basics_forall();\r\n if (e != 0)\r\n {\r\n lemma_1_power(e - 1);\r\n }\r\n}\r\n\r\nlemma lemma_power_adds(b:int, e1:nat, e2:nat)\r\n decreases e1\r\n ensures power(b,e1)*power(b,e2) == power(b,e1+e2)\r\n{\r\n if (e1==0)\r\n {\r\n calc {\r\n power(b,e1)*power(b,e2);\r\n { lemma_power_0(b); }\r\n 1*power(b,e2);\r\n { lemma_mul_basics_forall(); }\r\n power(b,0+e2);\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n power(b,e1)*power(b,e2);\r\n { reveal power(); }\r\n (b*power(b,e1-1))*power(b,e2);\r\n { lemma_mul_is_associative_forall(); }\r\n b*(power(b,e1-1)*power(b,e2));\r\n { lemma_power_adds(b, e1-1, e2); }\r\n b*power(b,e1-1+e2);\r\n { reveal power(); }\r\n power(b,e1+e2);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_power_multiplies(a:int,b:nat,c:nat)\r\n decreases c\r\n ensures 0<=b*c\r\n ensures power(a,b*c) == power(power(a,b),c)\r\n{\r\n lemma_mul_nonnegative(b,c);\r\n if (0==c)\r\n {\r\n lemma_mul_basics_forall();\r\n calc {\r\n power(a,b*c);\r\n { lemma_power_0(a); }\r\n 1;\r\n { lemma_power_0(power(a,b)); }\r\n power(power(a,b),c);\r\n }\r\n }\r\n else\r\n {\r\n calc {\r\n b*c - b;\r\n { lemma_mul_basics_forall(); }\r\n b*c - mul(b,1);\r\n { lemma_mul_is_distributive_forall(); }\r\n b*(c-1);\r\n }\r\n lemma_mul_nonnegative(b,c-1);\r\n assert 0 <= b*c-b;\r\n\r\n calc {\r\n power(a,b*c);\r\n power(a,b+b*c-b);\r\n { lemma_power_adds(a,b,b*c-b); }\r\n power(a,b)*power(a,b*c-b);\r\n power(a,b)*power(a,b*(c-1));\r\n { lemma_power_multiplies(a,b,c-1); }\r\n power(a,b)*power(power(a,b),c-1);\r\n { reveal power(); }\r\n power(power(a,b),c);\r\n }\r\n }\r\n}\r\n\r\nlemma lemma_power_distributes(a:int, b:int, e:nat)\r\n decreases e\r\n ensures power(a*b, e) == power(a, e) * power(b, e)\r\n{\r\n reveal power();\r\n lemma_mul_basics_forall();\r\n if (e > 0)\r\n {\r\n calc {\r\n power(a*b, e);\r\n (a*b) * power(a*b, e - 1);\r\n { lemma_power_distributes(a, b, e - 1); }\r\n (a*b) * (power(a, e - 1) * power(b, e - 1));\r\n { lemma_mul_is_associative_forall(); lemma_mul_is_commutative_forall(); }\r\n (a*power(a, e - 1)) * (b*power(b, e - 1));\r\n power(a,e) * power(b,e);\r\n }\r\n lemma_mul_is_distributive_forall();\r\n }\r\n}\r\n\r\nlemma lemma_power_auto()\r\n ensures forall x:int {:trigger power(x, 0)} :: power(x, 0) == 1\r\n ensures forall x:int {:trigger power(x, 1)} :: power(x, 1) == x\r\n ensures forall x:int, y:int {:trigger power(x, y)} :: y == 0 ==> power(x, y) == 1 // REVIEW: because of Dafny's LitInt special treatment, these are not the same as the two ensures above\r\n ensures forall x:int, y:int {:trigger power(x, y)} :: y == 1 ==> power(x, y) == x // ...\r\n ensures forall x:int, y:int {:trigger x * y} :: 0 < x && 0 < y ==> x <= x * y\r\n ensures forall x:int, y:int {:trigger x * y} :: 0 < x && 1 < y ==> x < x * y\r\n ensures forall x:int, y:nat, z:nat {:trigger power(x, y + z)} :: power(x, y + z) == power(x, y) * power(x, z)\r\n ensures forall x:int, y:nat, z:nat {:trigger power(x, y - z)} :: y >= z ==> power(x, y - z) * power(x, z) == power(x, y)\r\n ensures forall x:int, y:int, z:nat {:trigger power(x * y, z)} :: power(x * y, z) == power(x, z) * power(y, z)\r\n{\r\n reveal power(); // This has to be revealed to allow power to be used in triggers\r\n\r\n forall x:int\r\n ensures power(x, 0) == 1\r\n ensures power(x, 1) == x\r\n {\r\n lemma_power_0(x);\r\n lemma_power_1(x);\r\n }\r\n\r\n forall x:int, y:int, z:nat {:trigger power(x * y, z)}\r\n ensures power(x * y, z) == power(x, z) * power(y, z)\r\n {\r\n lemma_power_distributes(x, y, z);\r\n }\r\n\r\n forall x:int, y:nat, z:nat {:trigger power(x, y + z)}\r\n ensures power(x, y + z) == power(x, y) * power(x, z)\r\n {\r\n lemma_power_adds(x, y, z);\r\n }\r\n\r\n forall x:int, y:nat, z:nat {:trigger power(x, y - z)} | y >= z\r\n ensures power(x, y - z) * power(x, z) == power(x, y)\r\n {\r\n lemma_power_adds(x, y - z, z);\r\n }\r\n\r\n forall x:int, y:int {:trigger x * y} | 0 < x && 0 < y\r\n ensures x <= x * y\r\n {\r\n lemma_mul_auto();\r\n lemma_mul_increases_forall();\r\n lemma_mul_strictly_increases_forall();\r\n }\r\n\r\n forall x:int, y:int {:trigger x * y} | 0 < x && 1 < y\r\n ensures x < x * y\r\n {\r\n lemma_mul_auto();\r\n lemma_mul_increases_forall();\r\n lemma_mul_strictly_increases_forall();\r\n }\r\n}\r\n\r\nlemma lemma_power_positive(b:int, e:nat)\r\n requires 0 0 <= u ==> 0 < power(b, u));\r\n}\r\n\r\nlemma lemma_power_increases(b:nat,e1:nat,e2:nat)\r\n requires 0 0 <= e ==> power(b, e1) <= power(b, e1 + e);\r\n forall i {:trigger TMulAutoLe(0, i)} | TMulAutoLe(0, i) && f(i)\r\n ensures f(i + 1)\r\n {\r\n calc {\r\n power(b, e1 + i);\r\n <= { lemma_power_positive(b, e1 + i);\r\n lemma_mul_left_inequality(power(b, e1 + i), 1, b); }\r\n power(b, e1 + i) * b;\r\n == { lemma_power_1(b); }\r\n power(b, e1 + i) * power(b, 1);\r\n == { lemma_power_adds(b, e1 + i, 1); }\r\n power(b, e1 + i + 1);\r\n }\r\n }\r\n lemma_mul_auto_induction(e2 - e1, f);\r\n}\r\n\r\nlemma lemma_power_strictly_increases(b:nat,e1:nat,e2:nat)\r\n requires 1 0 < e ==> power(b, e1) < power(b, e1 + e);\r\n forall i {:trigger TMulAutoLe(0, i)} | TMulAutoLe(0, i) && f(i)\r\n ensures f(i + 1)\r\n {\r\n calc {\r\n power(b, e1 + i);\r\n <= { lemma_power_positive(b, e1 + i);\r\n lemma_mul_left_inequality(power(b, e1 + i), 1, b); }\r\n power(b, e1 + i) * b;\r\n == { lemma_power_1(b); }\r\n power(b, e1 + i) * power(b, 1);\r\n == { lemma_power_adds(b, e1 + i, 1); }\r\n power(b, e1 + i + 1);\r\n }\r\n }\r\n lemma_mul_auto_induction(e2 - e1, f);\r\n}\r\n\r\nlemma lemma_square_is_power_2(x:nat)\r\n ensures power(x,2) == x*x\r\n{\r\n reveal power();\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/power2.i.dfy", "content": "include \"power2s.i.dfy\"\r\ninclude \"powers.i.dfy\"\r\ninclude \"power.i.dfy\"\r\ninclude \"div.i.dfy\"\r\n\r\nmodule Math__power2_i {\r\nimport opened Math__power2_s\r\nimport opened Math__power_s\r\nimport opened Math__power_i\r\nimport opened Math__div_nonlinear_i\r\nimport opened Math__div_i\r\nimport opened Math__mul_auto_i\r\nimport opened Math__mul_i\r\n\r\n/*\r\n * Real definition in spec directory (included above);\r\n * but here's a commented copy for your edification.\r\n\r\nfunction {:opaque} power2(exp: nat) : nat\r\n ensures power2(exp) > 0\r\n{\r\n if (exp==0) then\r\n 1\r\n else\r\n 2*power2(exp-1)\r\n}\r\n*/\r\n\r\nlemma lemma_power2_is_power_2_general()\r\n ensures forall x:nat :: power2(x) == power(2,x)\r\n{\r\n reveal power2();\r\n reveal power();\r\n \r\n forall x:nat\r\n ensures power2(x) == power(2,x)\r\n {\r\n lemma_power2_is_power_2(x);\r\n }\r\n}\r\n\r\nlemma lemma_power2_is_power_2(x:nat)\r\n ensures power2(x) == power(2, x)\r\n{\r\n reveal power();\r\n reveal power2();\r\n if (x != 0) {\r\n lemma_power2_is_power_2(x - 1);\r\n }\r\n}\r\n\r\nlemma lemma_power2_auto()\r\n ensures power2(0) == 1\r\n ensures power2(1) == 2\r\n ensures forall x:nat, y:nat {:trigger power2(x + y)} :: power2(x + y) == power2(x) * power2(y)\r\n ensures forall x:nat, y:nat {:trigger power2(x - y)} :: x >= y ==> power2(x - y) * power2(y) == power2(x)\r\n ensures forall x:nat, y:nat {:trigger x * y} :: y == 2 ==> x * y == x + x\r\n{\r\n reveal power2();\r\n lemma_power2_is_power_2_general();\r\n lemma_power_auto();\r\n}\r\n\r\n//////////////////////////////////////////////////////////////////////////////\r\n\r\nlemma lemma_power2_strictly_increases(e1: int, e2: int)\r\n requires 0 <= e1 < e2\r\n ensures power2(e1) < power2(e2)\r\n{\r\n lemma_power2_auto();\r\n lemma_mul_auto_induction(e2 - e1, e => 0 < e ==> power2(e1) < power2(e1 + e));\r\n}\r\n\r\nlemma lemma_power2_increases(e1: int, e2: int)\r\n requires 0 <= e1 <= e2\r\n ensures power2(e1) <= power2(e2)\r\n{\r\n lemma_power2_auto();\r\n lemma_mul_auto_induction(e2 - e1, e => 0 <= e ==> power2(e1) <= power2(e1 + e));\r\n}\r\n\r\n// lemma lemma_power2_positive()\r\n// ensures forall e:nat :: 0 < power2(e)\r\n// {\r\n// lemma_power2_auto();\r\n// lemma_mul_auto_induction_forall(e => 0 <= e ==> 0 < power2(e));\r\n// }\r\n\r\n// lemma lemma_power2_nonzero_bigger_than_one()\r\n// ensures forall e:nat :: 0 1 < power2(e)\r\n// {\r\n// lemma_power2_auto();\r\n// var f := e => (0 < e ==> 1 < power2(e));\r\n// lemma_mul_auto_induction_forall(f);\r\n// assert forall e :: f[e] <==> (0 < e ==> 1 < power2(e)); // REVIEW: why isn't this obvious to Dafny?\r\n// }\r\n\r\nlemma lemma_power2_strictly_increases_converse(e1: int, e2: int)\r\n requires 0 <= e1\r\n requires 0 < e2\r\n requires power2(e1) < power2(e2)\r\n ensures e1 < e2\r\n{\r\n if (e1 >= e2)\r\n {\r\n lemma_power2_increases(e2, e1);\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_power2_increases_converse(e1: int, e2: int)\r\n requires 0 < e1\r\n requires 0 < e2\r\n requires power2(e1) <= power2(e2)\r\n ensures e1 <= e2\r\n{\r\n if (e1 > e2) {\r\n lemma_power2_strictly_increases(e2, e1);\r\n assert false;\r\n }\r\n}\r\n\r\nlemma lemma_power2_adds(e1:nat, e2:nat)\r\n decreases e2\r\n ensures power2(e1 + e2) == power2(e1) * power2(e2)\r\n{\r\n reveal power2();\r\n lemma_power2_auto();\r\n}\r\n\r\nlemma lemma_power2_div_is_sub(x:int, y:int)\r\n requires 0 <= x <= y\r\n ensures power2(y - x) == power2(y) / power2(x) >= 0\r\n{\r\n calc {\r\n power2(y) / power2(x);\r\n { lemma_power2_adds(y-x, x); }\r\n (power2(y-x)*power2(x)) / power2(x);\r\n { lemma_div_by_multiple(power2(y-x), power2(x)); }\r\n power2(y-x);\r\n }\r\n}\r\n\r\nlemma lemma_2toX32()\r\n ensures power2(0) == 0x1\r\n ensures power2(1) == 0x2\r\n ensures power2(2) == 0x4\r\n ensures power2(3) == 0x8\r\n ensures power2(4) == 0x10\r\n ensures power2(5) == 0x20\r\n ensures power2(6) == 0x40\r\n ensures power2(7) == 0x80\r\n ensures power2(8) == 0x100\r\n ensures power2(9) == 0x200\r\n ensures power2(10) == 0x400\r\n ensures power2(11) == 0x800\r\n ensures power2(12) == 0x1000\r\n ensures power2(13) == 0x2000\r\n ensures power2(14) == 0x4000\r\n ensures power2(15) == 0x8000\r\n ensures power2(16) == 0x10000\r\n ensures power2(17) == 0x20000\r\n ensures power2(18) == 0x40000\r\n ensures power2(19) == 0x80000\r\n ensures power2(20) == 0x100000\r\n ensures power2(21) == 0x200000\r\n ensures power2(22) == 0x400000\r\n ensures power2(23) == 0x800000\r\n ensures power2(24) == 0x1000000\r\n ensures power2(25) == 0x2000000\r\n ensures power2(26) == 0x4000000\r\n ensures power2(27) == 0x8000000\r\n ensures power2(28) == 0x10000000\r\n ensures power2(29) == 0x20000000\r\n ensures power2(30) == 0x40000000\r\n ensures power2(31) == 0x80000000\r\n ensures power2(32) == 0x100000000\r\n{\r\n reveal power2();\r\n}\r\n\r\nlemma lemma_2toX()\r\n ensures power2(64) == 18446744073709551616\r\n ensures power2(60) == 1152921504606846976\r\n ensures power2(32) == 4294967296\r\n ensures power2(24) == 16777216\r\n ensures power2(19) == 524288\r\n ensures power2(16) == 65536\r\n ensures power2(8) == 256\r\n{\r\n lemma_2to32();\r\n lemma_2to64();\r\n}\r\n\r\nlemma lemma_power2_add8(n:int)\r\n requires n >= 0\r\n ensures power2(n + 1) == 2 * power2(n)\r\n ensures power2(n + 2) == 4 * power2(n)\r\n ensures power2(n + 3) == 8 * power2(n)\r\n ensures power2(n + 4) == 16 * power2(n)\r\n ensures power2(n + 5) == 32 * power2(n)\r\n ensures power2(n + 6) == 64 * power2(n)\r\n ensures power2(n + 7) == 128 * power2(n)\r\n ensures power2(n + 8) == 256 * power2(n)\r\n{\r\n reveal power2();\r\n}\r\n\r\nlemma lemma_2to32()\r\n ensures power2(32) == 4294967296\r\n ensures power2(24) == 16777216\r\n ensures power2(19) == 524288\r\n ensures power2(16) == 65536\r\n ensures power2(8) == 256\r\n ensures power2(0) == 1\r\n{\r\n lemma_2toX32();\r\n}\r\n\r\nlemma lemma_2to64()\r\n ensures power2(64) == 18446744073709551616\r\n ensures power2(60) == 1152921504606846976\r\n{\r\n lemma_2to32();\r\n lemma_power2_add8(32);\r\n lemma_power2_add8(40);\r\n lemma_power2_add8(48);\r\n lemma_power2_add8(56);\r\n}\r\n\r\nlemma lemma_power2_0_is_1()\r\n ensures power2(0) == 1\r\n{\r\n reveal power2();\r\n}\r\n\r\nlemma lemma_power2_1_is_2()\r\n ensures power2(1) == 2\r\n{\r\n reveal power2();\r\n}\r\n\r\nlemma lemma_bit_count_is_unique(x:int, a:int, b:int)\r\n requires 0= 0 ==> x / power2(24) == x / 16777216;\r\n ensures forall x :: x >= 0 ==> x / power2(16) == x / 65536;\r\n ensures forall x :: x >= 0 ==> x / power2(8) == x / 256;\r\n{\r\n lemma_2toX();\r\n reveal power2();\r\n lemma_div_is_div_recursive_forall();\r\n forall x | x >= 0\r\n ensures x / power2(24) == x / 16777216 && x / power2(16) == x / 65536 && x / power2(8) == x / 256;\r\n {\r\n lemma_div_2_to_8(x);\r\n lemma_div_2_to_16(x);\r\n lemma_div_2_to_24(x);\r\n }\r\n}\r\n\r\nlemma lemma_div_2_to_8(x:int)\r\n requires x >= 0;\r\n ensures x / power2(8) == x / 256;\r\n{\r\n lemma_2toX();\r\n lemma_div_is_div_recursive_forall();\r\n if (x < 256) {\r\n } else {\r\n lemma_div_2_to_8(x - 256);\r\n }\r\n}\r\n\r\nlemma lemma_div_2_to_16(x:int)\r\n requires x >= 0;\r\n ensures x / power2(16) == x / 65536;\r\n{\r\n lemma_2toX();\r\n lemma_div_is_div_recursive_forall();\r\n if (x < 65536) {\r\n } else {\r\n lemma_div_2_to_16(x - 65536);\r\n }\r\n}\r\n\r\nlemma lemma_div_2_to_24(x:int)\r\n requires x >= 0;\r\n ensures x / power2(24) == x / 16777216;\r\n{\r\n lemma_2toX();\r\n lemma_div_is_div_recursive_forall();\r\n if (x < 16777216) {\r\n } else {\r\n lemma_div_2_to_24(x - 16777216);\r\n }\r\n}\r\n*/\r\n\r\n//-\r\n//-////////////////////////////////////////////////////////////////////////////\r\n\r\n/*\r\nlemma lemma_word_to_bytes_unique_specific_power2_helper1(a:int, b:int)\r\n requires a % 256 == b % 256;\r\n requires (a / power2(8)) % 256 == (b / power2(8)) % 256;\r\n requires 0 <= a;\r\n requires 0 <= b;\r\n ensures a % 65536 == b % 65536;\r\n{\r\n var d := 256;\r\n var c := 256;\r\n assert d*c == 65536;\r\n lemma_2toX();\r\n\r\n calc {\r\n a % 65536;\r\n a % (d*c);\r\n { lemma_mod_breakdown(a,d,c); }\r\n d * ((a/d)%c) + a%d;\r\n d * ((b/d)%c) + b%d;\r\n { lemma_mod_breakdown(b,d,c); }\r\n b % (d*c);\r\n b % 65536;\r\n }\r\n}\r\n\r\nlemma lemma_word_to_bytes_unique_specific_power2_helper2(a:int, b:int)\r\n requires (a / power2(16)) % 256 == (b / power2(16)) % 256;\r\n requires a / power2(24) == b / power2(24);\r\n requires 0 <= a;\r\n requires 0 <= b;\r\n ensures a / power2(16) == b / power2(16);\r\n{\r\n var ap := a/power2(16);\r\n var bp := b/power2(16);\r\n var d := power2(8);\r\n\r\n lemma_2toX();\r\n lemma_mul_strictly_positive_forall();\r\n\r\n calc {\r\n ap/d;\r\n { lemma_div_denominator(a,power2(16),power2(8)); }\r\n a/(power2(16)*power2(8));\r\n { lemma_power2_adds(16,8); }\r\n a/power2(24);\r\n b/power2(24);\r\n { lemma_power2_adds(16,8); }\r\n b/(power2(16)*power2(8));\r\n { lemma_div_denominator(b,power2(16),power2(8)); }\r\n bp/d;\r\n }\r\n calc {\r\n a/power2(16);\r\n ap;\r\n { lemma_fundamental_div_mod(ap,d); }\r\n d*(ap/d)+ap%d;\r\n d*(bp/d)+bp%d;\r\n { lemma_fundamental_div_mod(bp,d); }\r\n bp;\r\n b/power2(16);\r\n }\r\n}\r\n\r\nlemma lemma_word_to_bytes_unique_specific_power2_helper3(a:int, b:int)\r\n requires a % 65536 == b % 65536;\r\n requires a / power2(16) == b / power2(16);\r\n requires 0 <= a;\r\n requires 0 <= b;\r\n ensures a == b;\r\n{\r\n lemma_2toX();\r\n lemma_fundamental_div_mod(a,65536);\r\n lemma_fundamental_div_mod(b,65536);\r\n}\r\n\r\nlemma lemma_word_to_bytes_unique_specific_power2(a:int, b:int)\r\n requires a % 256 == b % 256;\r\n requires (a / power2(8)) % 256 == (b / power2(8)) % 256;\r\n requires (a / power2(16)) % 256 == (b / power2(16)) % 256;\r\n requires a / power2(24) == b / power2(24);\r\n requires 0 <= a;\r\n requires 0 <= b;\r\n ensures a == b;\r\n{\r\n lemma_word_to_bytes_unique_specific_power2_helper1(a, b);\r\n lemma_word_to_bytes_unique_specific_power2_helper2(a, b);\r\n lemma_word_to_bytes_unique_specific_power2_helper3(a, b);\r\n}\r\n*/\r\n\r\nlemma lemma_pull_out_powers_of_2(x:nat, y:nat, z:nat)\r\n ensures 0<=x*y\r\n ensures 0<=y*z\r\n ensures power(power2(x*y), z) == power(power2(x), y*z)\r\n{\r\n lemma_mul_nonnegative(x,y);\r\n lemma_mul_nonnegative(y,z);\r\n lemma_power_positive(2,x);\r\n calc {\r\n power(power2(x*y), z);\r\n { lemma_power2_is_power_2(x*y); }\r\n power(power(2,x*y), z);\r\n { lemma_power_multiplies(2, x, y); }\r\n power(power(power(2,x),y), z);\r\n { lemma_power_multiplies(power(2,x), y, z); }\r\n power(power(2,x), y*z);\r\n { lemma_power2_is_power_2(x); }\r\n power(power2(x), y*z);\r\n }\r\n}\r\n\r\nlemma lemma_rebase_powers_of_2()\r\n ensures forall n:nat, e:nat {:trigger power(power2(n), e)} :: 0 <= n * e && power(power2(n), e) == power2(n * e)\r\n{\r\n reveal power();\r\n reveal power2();\r\n\r\n forall n:nat, e:nat\r\n ensures 0 <= n * e && power(power2(n), e) == power2(n * e)\r\n {\r\n lemma_pull_out_powers_of_2(1, n, e);\r\n lemma_power2_auto();\r\n lemma_power2_is_power_2_general();\r\n }\r\n}\r\n\r\nlemma lemma_mask_div_2(c:nat)\r\n requires 0 0 < u ==> (power2(u)-1)/2 == power2(u-1)-1;\r\n assert forall i {:trigger TMulAutoLe(0, i)} :: TMulAutoLe(0, i) && f(i) ==> f(i + 1);\r\n assert forall i {:trigger TMulAutoLe(i, 0)} :: TMulAutoLe(i, 0) && f(i) ==> f(i - 1);\r\n lemma_mul_auto_induction(c, f);\r\n}\r\n\r\nlemma lemma_power2_division_inequality(x:nat, p:nat, s:nat)\r\n requires s<=p\r\n requires x {\r\n x/power2(s) >= power2(p-s);\r\n { lemma_mul_inequality(power2(p-s), x/power2(s), power2(s)); }\r\n (x/power2(s))*power2(s) >= power2(p-s)*power2(s);\r\n { lemma_fundamental_div_mod(x, power2(s));\r\n lemma_mul_is_commutative_forall(); }\r\n x - x%power2(s) >= power2(p-s)*power2(s);\r\n { lemma_power2_adds(p-s, s); }\r\n x - x%power2(s) >= power2(p);\r\n { lemma_mod_properties(); }\r\n x >= power2(p);\r\n false;\r\n }\r\n}\r\n\r\nlemma lemma_power2_unfolding(a:nat, b:nat)\r\n ensures 0<=a*b\r\n ensures power(power2(a), b) == power2(a*b)\r\n{\r\n lemma_mul_nonnegative(a,b);\r\n lemma_power2_is_power_2(a);\r\n lemma_power_multiplies(2,a,b);\r\n lemma_power2_is_power_2(a*b);\r\n}\r\n\r\nfunction{:opaque} NatNumBits(n:nat):nat\r\n ensures NatNumBits(n) >= 0\r\n{\r\n if n == 0 then 0 else 1 + NatNumBits(n / 2)\r\n}\r\n\r\nlemma lemma_Power2BoundIsNatNumBits(c:nat, n:nat) \r\n ensures (((c>0) ==> (power2(c-1) <= n)) && (n < power2(c))) <==> c == NatNumBits(n)\r\n{\r\n reveal NatNumBits();\r\n reveal power2();\r\n if (c > 0)\r\n {\r\n lemma_Power2BoundIsNatNumBits(c - 1, n / 2);\r\n }\r\n assert NatNumBits(n / 2) >= 0; //- dafnycc\r\n}\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/power2s.i.dfy", "content": "module Math__power2_s {\r\n\r\n// TODO_MODULE: module Math__power2_s {\r\n// TODO_MODULE: import opened Libraries__base_s\r\n\r\nfunction {:opaque} power2(exp: nat) : nat\r\n ensures power2(exp) > 0\r\n{\r\n if (exp==0) then\r\n 1\r\n else\r\n 2*power2(exp-1)\r\n}\r\n\r\n// TODO Yay! A proof in the spec!\r\nlemma lemma_power2_32()\r\n ensures power2(8) == 0x100\r\n ensures power2(16) == 0x10000\r\n ensures power2(24) == 0x1000000\r\n ensures power2(32) == 0x100000000\r\n{\r\n reveal power2();\r\n assert power2(0) == 0x1;\r\n assert power2(2) == 0x4;\r\n assert power2(4) == 0x10;\r\n assert power2(6) == 0x40;\r\n assert power2(8) == 0x100;\r\n assert power2(10) == 0x400;\r\n assert power2(12) == 0x1000;\r\n assert power2(14) == 0x4000;\r\n assert power2(16) == 0x10000;\r\n assert power2(18) == 0x40000;\r\n assert power2(20) == 0x100000;\r\n assert power2(22) == 0x400000;\r\n assert power2(24) == 0x1000000;\r\n assert power2(26) == 0x4000000;\r\n assert power2(28) == 0x10000000;\r\n assert power2(30) == 0x40000000;\r\n}\r\n\r\n// TODO_MODULE: } import opened Math__power2_s_ = Math__power2_s\r\n\r\n} \r\n" }, { "path": "ironfleet/src/Dafny/Libraries/Math/powers.i.dfy", "content": "\r\nmodule Math__power_s {\r\n\r\n// TODO_MODULE: module Math__power_s {\r\nfunction {:opaque} power(b:int, e:nat) : int\r\n decreases e\r\n // ensures b > 0 ==> 0\n\n \n Exe\n net6.0\n \n\n \n 1701;1702;162;164;168;183;219;436;1717;1718\n \n\n \n IronLockServer.Program\n \n\n \n \n \n\n \n \n \n \n \n \n\n\n" }, { "path": "ironfleet/src/IronLockServer/IronLockServer.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.31005.135\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"IronLockServer\", \"IronLockServer.csproj\", \"{80249939-7D35-43CA-891A-F4C73EC6D959}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {3EDDD386-2BE8-48A4-8188-FFDA2034F16D}\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironfleet/src/IronLockServer/Params.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.IO;\nusing System.Net;\nusing System.Text.RegularExpressions;\n\nnamespace IronLockServer\n{\n public class Params\n {\n private string serviceFileName;\n private string privateKeyFileName;\n private string localHostNameOrAddress;\n private int localPort;\n private bool verbose;\n\n public Params()\n {\n serviceFileName = \"\";\n privateKeyFileName = \"\";\n localHostNameOrAddress = \"\";\n localPort = 0;\n }\n\n public string ServiceFileName { get { return serviceFileName; } }\n public string PrivateKeyFileName { get { return privateKeyFileName; } }\n public string LocalHostNameOrAddress { get { return localHostNameOrAddress; } }\n public int LocalPort { get { return localPort; } }\n public bool Verbose { get { return verbose; } }\n\n public bool Validate()\n {\n if (serviceFileName.Length == 0) {\n Console.WriteLine(\"ERROR - Missing service parameter\");\n return false;\n }\n if (privateKeyFileName.Length == 0) {\n Console.WriteLine(\"ERROR - Missing private parameter\");\n return false;\n }\n return true;\n }\n\n public bool ProcessCommandLineArgument(string arg)\n {\n var pos = arg.IndexOf(\"=\");\n if (pos < 0) {\n if (serviceFileName.Length == 0) {\n serviceFileName = arg;\n return true;\n }\n else if (privateKeyFileName.Length == 0) {\n privateKeyFileName = arg;\n return true;\n }\n else {\n Console.WriteLine(\"ERROR - Invalid argument {0}\", arg);\n return false;\n }\n }\n var key = arg.Substring(0, pos).ToLower();\n var value = arg.Substring(pos + 1);\n return SetValue(key, value);\n }\n\n private bool SetValue(string key, string value)\n {\n if (key == \"addr\") {\n localHostNameOrAddress = value;\n return true;\n }\n\n if (key == \"port\") {\n try {\n localPort = Convert.ToInt32(value);\n return true;\n }\n catch (Exception e) {\n Console.WriteLine(\"ERROR - Could not convert port {0} to a number. Exception:\\n{1}\", value, e);\n return false;\n }\n }\n\n if (key == \"verbose\") {\n if (value == \"false\") {\n verbose = false;\n return true;\n }\n if (value == \"true\") {\n verbose = true;\n return true;\n }\n Console.WriteLine(\"ERROR - Invalid verbose value {0} - should be false or true\", value);\n return false;\n }\n\n Console.WriteLine(\"ERROR - Invalid argument key {0}\", key);\n return false;\n }\n }\n}\n" }, { "path": "ironfleet/src/IronLockServer/Program.cs", "content": "using IronfleetCommon;\nusing IronfleetIoFramework;\nusing MathNet.Numerics.Distributions;\nusing System;\nusing System.Collections.Generic;\nusing System.IO;\nusing System.Linq;\nusing System.Numerics;\nusing System.Text.Json;\nusing System.Threading;\n\nnamespace IronLockServer\n{\n class Program\n {\n static void usage()\n {\n Console.Write(@\"\nUsage: dotnet IronLockServer.dll [key=value]...\n\n - file path of the service description\n - file path of the private key\n\nAllowed keys:\n addr - local host name or address to listen to (default:\n whatever's specified in the private key file)\n port - port to listen to (default: whatever's specified\n in the private key file)\n verbose - use verbose output (false or true, default: false)\n\");\n }\n\n static void Main(string[] args)\n {\n Console.WriteLine(\"IronLockServer program started\");\n\n Console.WriteLine(\"Processing command-line arguments\");\n\n Params ps = new Params();\n\n foreach (var arg in args)\n {\n if (!ps.ProcessCommandLineArgument(arg)) {\n usage();\n return;\n }\n }\n\n if (!ps.Validate()) {\n usage();\n return;\n }\n\n ServiceIdentity serviceIdentity = ServiceIdentity.ReadFromFile(ps.ServiceFileName);\n if (serviceIdentity == null) {\n return;\n }\n if (serviceIdentity.ServiceType != \"IronLock\") {\n Console.Error.WriteLine(\"ERROR - Service described by {0} is of type {1}, not IronLock\", ps.ServiceFileName,\n serviceIdentity.ServiceType);\n return;\n }\n\n PrivateIdentity privateIdentity = PrivateIdentity.ReadFromFile(ps.PrivateKeyFileName);\n if (privateIdentity == null) {\n return;\n }\n\n var nc = Native____Io__s_Compile.NetClient.Create(privateIdentity, ps.LocalHostNameOrAddress, ps.LocalPort,\n serviceIdentity.Servers, ps.Verbose, serviceIdentity.UseSsl);\n Dafny.ISequence[] serverPublicKeys =\n serviceIdentity.Servers.Select(server => Dafny.Sequence.FromArray(nc.HashPublicKey(server.PublicKey))).ToArray();\n var ironArgs = Dafny.Sequence>.FromArray(serverPublicKeys);\n\n Profiler.Initialize();\n Native____Io__s_Compile.Time.Initialize();\n Console.WriteLine(\"[[READY]]\");\n Main__i_Compile.__default.IronfleetMain(nc, ironArgs);\n Console.WriteLine(\"[[EXIT]]\");\n }\n }\n}\n" }, { "path": "ironfleet/src/IronRSLClient/.gitignore", "content": ".vs\r\nProperties\r\n" }, { "path": "ironfleet/src/IronRSLClient/IronRSLClient.csproj", "content": "\n\n \n net6.0\n IronRSLClient\n 1.0.4\n Jay Lorch and Chris Hawblitzel\n Microsoft Corporation\n true\n MIT\n \n\n \n \n \n \n\n\n" }, { "path": "ironfleet/src/IronRSLClient/IronRSLClient.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.31321.278\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"IronRSLClient\", \"IronRSLClient.csproj\", \"{0AC4042E-CFAF-41AD-86DD-C91B39D06CB5}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{0AC4042E-CFAF-41AD-86DD-C91B39D06CB5}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{0AC4042E-CFAF-41AD-86DD-C91B39D06CB5}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{0AC4042E-CFAF-41AD-86DD-C91B39D06CB5}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{0AC4042E-CFAF-41AD-86DD-C91B39D06CB5}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {AFC77FFD-EE03-4482-A506-7F4B3A3B4431}\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironfleet/src/IronRSLClient/RSLClient.cs", "content": "using IronfleetIoFramework;\nusing System;\nusing System.Collections.Generic;\nusing System.IO;\nusing System.Linq;\nusing System.Net;\n\nnamespace IronRSLClient\n{\n public class RSLClient\n {\n ServiceIdentity serviceIdentity;\n byte[][] serverPublicKeys;\n bool verbose;\n UInt64 nextSeqNum;\n int primaryServerIndex;\n IoScheduler scheduler;\n\n public RSLClient(ServiceIdentity i_serviceIdentity, string serviceName, bool i_verbose)\n {\n serviceIdentity = i_serviceIdentity;\n if (serviceIdentity.ServiceType != \"IronRSL\" + serviceName) {\n Console.Error.WriteLine(\"Provided service identity has type {0}, not IronRSL{1}.\",\n serviceIdentity.ServiceType, serviceName);\n throw new Exception(\"Wrong service type\");\n }\n verbose = i_verbose;\n nextSeqNum = 0;\n primaryServerIndex = 0;\n scheduler = IoScheduler.CreateClient(serviceIdentity.Servers, verbose, serviceIdentity.UseSsl);\n serverPublicKeys = serviceIdentity.Servers.Select(server => scheduler.HashPublicKey(server.PublicKey)).ToArray();\n }\n\n public byte[] SubmitRequest (byte[] request, int timeBeforeServerSwitchMs = 1000)\n {\n UInt64 seqNum = nextSeqNum++;\n byte[] requestMessage;\n using (var memStream = new MemoryStream())\n {\n IoEncoder.WriteUInt64(memStream, 0); // 0 means \"this is a CMessage_Request\"\n IoEncoder.WriteUInt64(memStream, seqNum); // sequence number\n IoEncoder.WriteUInt64(memStream, (UInt64)request.Length); // size of CAppRequest\n IoEncoder.WriteBytes(memStream, request, 0, (UInt64)request.Length); // CAppRequest\n requestMessage = memStream.ToArray();\n }\n\n scheduler.SendPacket(serverPublicKeys[primaryServerIndex], requestMessage);\n if (verbose) {\n Console.WriteLine(\"Sending a request with sequence number {0} to {1}\",\n seqNum, serviceIdentity.Servers[primaryServerIndex]);\n }\n\n while (true)\n {\n bool ok, timedOut;\n byte[] remote;\n byte[] replyBytes;\n scheduler.ReceivePacket(timeBeforeServerSwitchMs, out ok, out timedOut, out remote, out replyBytes);\n\n if (!ok) {\n throw new Exception(\"Unrecoverable networking failure\");\n }\n\n if (timedOut) {\n primaryServerIndex = (primaryServerIndex + 1) % serviceIdentity.Servers.Count();\n if (verbose) {\n Console.WriteLine(\"#timeout; rotating to server {0}\", primaryServerIndex);\n }\n scheduler.SendPacket(serverPublicKeys[primaryServerIndex], requestMessage);\n continue;\n }\n\n if (replyBytes.Length < 24) {\n throw new Exception(String.Format(\"Got RSL reply with invalid length {0}\", replyBytes.Length));\n }\n\n UInt64 messageType = IoEncoder.ExtractUInt64(replyBytes, 0);\n if (messageType != 6) {\n throw new Exception(\"Got RSL message that wasn't a reply\");\n }\n\n UInt64 replySeqNum = IoEncoder.ExtractUInt64(replyBytes, 8);\n if (replySeqNum != seqNum) {\n // This is a retransmission of a reply for an old sequence\n // number. Ignore it.\n continue;\n }\n \n UInt64 replyLength = IoEncoder.ExtractUInt64(replyBytes, 16);\n if (replyLength + 24 != (UInt64)replyBytes.Length) {\n throw new Exception(String.Format(\"Got RSL reply with invalid encoded length ({0} instead of {1})\",\n replyLength, replyBytes.Length - 24));\n }\n\n return replyBytes.Skip(24).ToArray();\n }\n }\n }\n}\n" }, { "path": "ironfleet/src/IronRSLCounterClient/.gitignore", "content": ".vs\nProperties/\n" }, { "path": "ironfleet/src/IronRSLCounterClient/Client.cs", "content": "using IronfleetCommon;\nusing IronfleetIoFramework;\nusing IronRSLClient;\nusing System;\nusing System.Collections.Generic;\nusing System.IO;\nusing System.Net;\nusing System.Threading;\nusing System.Linq;\n\nnamespace IronRSLCounterClient\n{\n public class IncrementRequest\n {\n public IncrementRequest() { }\n\n public byte[] Encode()\n {\n MemoryStream memStream = new MemoryStream();\n IoEncoder.WriteUInt64(memStream, 0); // request type (0 = increment)\n return memStream.ToArray();\n }\n }\n\n public class IncrementReply\n {\n public UInt64 counterValue;\n\n private IncrementReply(UInt64 i_counterValue)\n {\n counterValue = i_counterValue;\n }\n \n public static IncrementReply Decode(byte[] bytes)\n {\n if (bytes.Length != 8) {\n Console.Error.WriteLine(\"Got invalid-length reply\");\n return null;\n }\n\n UInt64 counterValue = IoEncoder.ExtractUInt64(bytes, 0);\n return new IncrementReply(counterValue);\n }\n }\n\n public class Client\n {\n public int id;\n public Params ps;\n public ServiceIdentity serviceIdentity;\n\n private Client(int i_id, Params i_ps, ServiceIdentity i_serviceIdentity)\n {\n id = i_id;\n ps = i_ps;\n serviceIdentity = i_serviceIdentity;\n }\n\n static public IEnumerable StartThreads(Params ps, ServiceIdentity serviceIdentity)\n {\n for (int i = 0; i < ps.NumThreads; ++i)\n {\n Client c = new Client(i, ps, serviceIdentity);\n Thread t = new Thread(c.Run);\n t.Start();\n yield return t;\n }\n }\n\n private void Run()\n {\n RSLClient rslClient = new RSLClient(serviceIdentity, \"Counter\", ps.Verbose);\n\n Thread.Sleep(3000);\n\n for (int requestNum = 1; true; ++requestNum)\n {\n var request = new IncrementRequest();\n byte[] requestBytes = request.Encode();\n var startTime = HiResTimer.Ticks;\n byte[] replyBytes = rslClient.SubmitRequest(requestBytes);\n var endTime = HiResTimer.Ticks;\n var reply = IncrementReply.Decode(replyBytes);\n if (ps.PrintReplies) {\n Console.WriteLine(\"Received increment reply with counter {0}\", reply.counterValue);\n }\n Console.WriteLine(\"#req {0} {1} {2}\",\n id,\n requestNum,\n HiResTimer.TicksToMilliseconds(endTime - startTime));\n }\n }\n }\n}\n" }, { "path": "ironfleet/src/IronRSLCounterClient/IronRSLCounterClient.csproj", "content": "\n\n \n Exe\n net6.0\n \n\n \n \n \n \n \n \n \n\n\n" }, { "path": "ironfleet/src/IronRSLCounterClient/IronRSLCounterClient.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.31019.35\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"IronRSLCounterClient\", \"IronRSLCounterClient.csproj\", \"{A154E4D2-1C7D-47EF-BAE7-B802C50DB10E}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{A154E4D2-1C7D-47EF-BAE7-B802C50DB10E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{A154E4D2-1C7D-47EF-BAE7-B802C50DB10E}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{A154E4D2-1C7D-47EF-BAE7-B802C50DB10E}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{A154E4D2-1C7D-47EF-BAE7-B802C50DB10E}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {1CE7BF3F-5BCC-4D62-8CD7-273A890D9E66}\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironfleet/src/IronRSLCounterClient/Params.cs", "content": "using System;\nusing System.Net;\n\nnamespace IronRSLCounterClient\n{\n public class Params\n {\n private string serviceFileName;\n private int numThreads;\n private ulong experimentDuration;\n private bool verbose;\n private bool printReplies;\n\n public Params()\n {\n serviceFileName = \"\";\n numThreads = 1;\n experimentDuration = 60;\n verbose = false;\n printReplies = false;\n }\n\n public string ServiceFileName { get { return serviceFileName; } }\n public int NumThreads { get { return numThreads; } }\n public ulong ExperimentDuration { get { return experimentDuration; } }\n public bool PrintReplies { get { return printReplies; } }\n public bool Verbose { get { return verbose; } }\n\n public bool Validate()\n {\n if (serviceFileName.Length == 0) {\n Console.WriteLine(\"ERROR - Missing service parameter\");\n return false;\n }\n return true;\n }\n\n public bool ProcessCommandLineArgument(string arg)\n {\n var pos = arg.IndexOf(\"=\");\n if (pos < 0) {\n if (serviceFileName.Length == 0) {\n serviceFileName = arg;\n return true;\n }\n else {\n Console.WriteLine(\"Invalid argument {0}\", arg);\n return false;\n }\n }\n var key = arg.Substring(0, pos).ToLower();\n var value = arg.Substring(pos + 1);\n return SetValue(key, value);\n }\n\n private bool SetBoolValue(string key, string value, ref bool p)\n {\n if (value == \"false\") {\n p = false;\n return true;\n }\n else if (value == \"true\") {\n p = true;\n return true;\n }\n else {\n Console.WriteLine(\"ERROR - Invalid {0} value {1} - should be false or true\", key, value);\n return false;\n }\n }\n\n private bool SetValue(string key, string value)\n {\n if (key == \"verbose\") {\n return SetBoolValue(key, value, ref verbose);\n }\n\n if (key == \"print\") {\n return SetBoolValue(key, value, ref printReplies);\n }\n\n if (key == \"nthreads\") {\n try {\n numThreads = Convert.ToInt32(value);\n if (numThreads < 1) {\n Console.WriteLine(\"Number of threads must be at least 1, so can't be {0}\", numThreads);\n return false;\n }\n }\n catch (Exception e) {\n Console.WriteLine(\"Could not parse number of threads {0} as a number. Exception:\\n{1}\", value, e);\n return false;\n }\n return true;\n }\n\n if (key == \"duration\") {\n experimentDuration = Convert.ToUInt64(value);\n return true;\n }\n\n Console.WriteLine(\"Invalid argument key {0}\", key);\n return false;\n }\n }\n}\n" }, { "path": "ironfleet/src/IronRSLCounterClient/Program.cs", "content": "using IronfleetCommon;\nusing IronfleetIoFramework;\nusing System;\nusing System.Linq;\nusing System.Numerics;\nusing System.Threading;\nusing System.IO;\nusing System.Net;\nusing System.Collections.Generic;\n\nnamespace IronRSLCounterClient\n{\n class Program\n {\n static void usage()\n {\n Console.Write(@\"\nUsage: dotnet IronRSLCounterClient.dll [key=value]...\n\n - file path of the service description\n\nAllowed keys:\n nthreads - number of client threads to run (default 1)\n duration - duration of experiment in seconds (default 60)\n print - print replies (false or true, default false)\n verbose - print verbose output (false or true, default false)\n\");\n }\n\n static void Main(string[] args)\n {\n Params ps = new Params();\n\n foreach (var arg in args)\n {\n if (!ps.ProcessCommandLineArgument(arg)) {\n usage();\n return;\n }\n }\n \n if (!ps.Validate())\n {\n usage();\n return;\n }\n\n var serviceIdentity = ServiceIdentity.ReadFromFile(ps.ServiceFileName);\n if (serviceIdentity == null) {\n return;\n }\n\n HiResTimer.Initialize();\n if (ps.Verbose) {\n Console.WriteLine(\"Client process starting {0} threads running for {1} s...\", ps.NumThreads, ps.ExperimentDuration);\n }\n \n Console.WriteLine(\"[[READY]]\");\n \n // Start the experiment\n var threads = Client.StartThreads(ps, serviceIdentity).ToArray();\n\n if (ps.ExperimentDuration == 0)\n {\n threads[0].Join();\n }\n else\n {\n Thread.Sleep((int)ps.ExperimentDuration * 1000);\n Console.Out.WriteLine(\"[[DONE]]\");\n Console.Out.Flush();\n Environment.Exit(0);\n }\n }\n }\n}\n" }, { "path": "ironfleet/src/IronRSLCounterServer/.gitignore", "content": ".vs\nProperties/\n" }, { "path": "ironfleet/src/IronRSLCounterServer/IronRSLCounterServer.csproj", "content": "\n\n \n Exe\n net6.0\n \n\n \n 1701;1702;162;164;168;183;219;436;1717;1718\n \n\n \n IronRSLServer.Program\n \n\n \n \n \n\n \n \n \n \n \n \n \n\n\n" }, { "path": "ironfleet/src/IronRSLCounterServer/IronRSLCounterServer.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.31005.135\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"IronRSLCounterServer\", \"IronRSLCounterServer.csproj\", \"{80249939-7D35-43CA-891A-F4C73EC6D959}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {3EDDD386-2BE8-48A4-8188-FFDA2034F16D}\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironfleet/src/IronRSLCounterServer/Service.cs", "content": "using IronfleetIoFramework;\nusing System;\nusing System.IO;\n\nnamespace IronRSL\n{\n public class Service\n {\n UInt64 counter;\n\n private Service(UInt64 i_counter)\n {\n counter = i_counter;\n }\n\n public static string Name { get { return \"Counter\"; } }\n\n public static Service Initialize()\n {\n return new Service(0);\n }\n\n public static Service Deserialize(byte[] buf)\n {\n if (buf.Length != 8) {\n Console.Error.WriteLine(\"Received Deserialize with wrong number of bytes: {0} instead of 8\", buf.Length);\n return new Service(0);\n }\n UInt64 counter = IoEncoder.ExtractUInt64(buf, 0);\n return new Service(counter);\n }\n\n public byte[] Serialize()\n {\n MemoryStream stream = new MemoryStream();\n IoEncoder.WriteUInt64(stream, counter);\n return stream.ToArray();\n }\n\n public byte[] HandleRequest(byte[] request)\n {\n if (request.Length != 8) {\n Console.Error.WriteLine(\"Received invalid request with wrong number of bytes: {0} instead of 8\", request.Length);\n }\n else {\n UInt64 command = IoEncoder.ExtractUInt64(request, 0);\n if (command != 0) {\n Console.Error.WriteLine(\"Received request with invalid command: {0}\", command);\n }\n else {\n counter++;\n }\n }\n\n MemoryStream stream = new MemoryStream();\n IoEncoder.WriteUInt64(stream, counter);\n return stream.ToArray();\n }\n }\n}\n\n" }, { "path": "ironfleet/src/IronRSLKVClient/.gitignore", "content": ".vs\nProperties/\n" }, { "path": "ironfleet/src/IronRSLKVClient/Client.cs", "content": "using IronfleetCommon;\nusing IronRSLClient;\nusing IronfleetIoFramework;\nusing KVMessages;\nusing System;\nusing System.Collections.Generic;\nusing System.IO;\nusing System.Linq;\nusing System.Net;\nusing System.Text;\nusing System.Threading;\n\nnamespace IronRSLKVClient\n{\n public class Client\n {\n public int id;\n public Params ps;\n public ServiceIdentity serviceIdentity;\n\n private Client(int i_id, Params i_ps, ServiceIdentity i_serviceIdentity)\n {\n id = i_id;\n ps = i_ps;\n serviceIdentity = i_serviceIdentity;\n }\n\n static public IEnumerable StartThreads(Params ps, ServiceIdentity serviceIdentity)\n {\n for (int i = 0; i < ps.NumThreads; ++i)\n {\n Client c = new Client(i, ps, serviceIdentity);\n Thread t = new Thread(c.Run);\n t.Start();\n yield return t;\n }\n }\n \n private static KVRequest GetRandomRequest(Random rng, Params ps)\n {\n int keySelector = rng.Next(26);\n char k = (char)('a' + keySelector);\n StringBuilder keyBuilder = new StringBuilder();\n keyBuilder.Append(k);\n keyBuilder.Append(k);\n keyBuilder.Append(k);\n string key = keyBuilder.ToString();\n \n int reqTypeSelector = rng.Next();\n if (reqTypeSelector < ps.SetFraction * Int32.MaxValue) {\n char v = (char)('A' + keySelector);\n StringBuilder valBuilder = new StringBuilder();\n valBuilder.Append(v);\n valBuilder.Append(v);\n valBuilder.Append(v);\n valBuilder.Append(v);\n valBuilder.Append(rng.Next(100000));\n string val = valBuilder.ToString();\n if (ps.PrintRequestsAndReplies) {\n Console.WriteLine(\"Submitting set request for {0} => {1}\", key, val);\n }\n return new KVSetRequest(key, val);\n }\n else if (reqTypeSelector < (ps.SetFraction + ps.DeleteFraction) * Int32.MaxValue) {\n if (ps.PrintRequestsAndReplies) {\n Console.WriteLine(\"Submitting delete request for {0}\", key);\n }\n return new KVDeleteRequest(key);\n }\n else {\n if (ps.PrintRequestsAndReplies) {\n Console.WriteLine(\"Submitting get request for {0}\", key);\n }\n return new KVGetRequest(key);\n }\n }\n\n private void Run()\n {\n RSLClient rslClient = new RSLClient(serviceIdentity, \"KV\", ps.Verbose);\n\n Thread.Sleep(3000);\n\n Random rng = new Random();\n\n for (int requestNum = 1; true; ++requestNum)\n {\n KVRequest request = GetRandomRequest(rng, ps);\n byte[] requestBytes = request.Encode();\n var startTime = HiResTimer.Ticks;\n byte[] replyBytes = rslClient.SubmitRequest(requestBytes);\n var endTime = HiResTimer.Ticks;\n KVReply reply = KVReply.Decode(replyBytes, 0);\n\n if (ps.PrintRequestsAndReplies) {\n Console.WriteLine(\"Received reply of type {0}\", reply.ReplyType);\n if (reply is KVGetFoundReply gfr) {\n Console.WriteLine(\"Value obtained for get was {0}\", gfr.Val);\n }\n }\n Console.WriteLine(\"#req {0} {1} {2}\",\n id,\n requestNum,\n HiResTimer.TicksToMilliseconds(endTime - startTime));\n }\n }\n }\n}\n" }, { "path": "ironfleet/src/IronRSLKVClient/IronRSLKVClient.csproj", "content": "\n\n \n Exe\n net6.0\n \n\n \n \n \n \n \n \n \n \n\n\n" }, { "path": "ironfleet/src/IronRSLKVClient/IronRSLKVClient.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.31019.35\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"IronRSLKVClient\", \"IronRSLKVClient.csproj\", \"{A154E4D2-1C7D-47EF-BAE7-B802C50DB10E}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{A154E4D2-1C7D-47EF-BAE7-B802C50DB10E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{A154E4D2-1C7D-47EF-BAE7-B802C50DB10E}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{A154E4D2-1C7D-47EF-BAE7-B802C50DB10E}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{A154E4D2-1C7D-47EF-BAE7-B802C50DB10E}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {1CE7BF3F-5BCC-4D62-8CD7-273A890D9E66}\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironfleet/src/IronRSLKVClient/Params.cs", "content": "using System;\nusing System.Net;\n\nnamespace IronRSLKVClient\n{\n public class Params\n {\n private string serviceFileName;\n private int numThreads;\n private ulong experimentDuration;\n private double setFraction;\n private double deleteFraction;\n private bool verbose;\n private bool printRequestsAndReplies;\n\n public Params()\n {\n serviceFileName = \"\";\n numThreads = 1;\n experimentDuration = 60;\n setFraction = 0.05;\n deleteFraction = 0.25;\n verbose = false;\n printRequestsAndReplies = false;\n }\n\n public string ServiceFileName { get { return serviceFileName; } }\n public int NumThreads { get { return numThreads; } }\n public ulong ExperimentDuration { get { return experimentDuration; } }\n public double SetFraction { get { return setFraction; } }\n public double DeleteFraction { get { return deleteFraction; } }\n public bool PrintRequestsAndReplies { get { return printRequestsAndReplies; } }\n public bool Verbose { get { return verbose; } }\n\n public bool Validate()\n {\n if (serviceFileName.Length == 0) {\n Console.WriteLine(\"ERROR - Missing service parameter\");\n return false;\n }\n return true;\n }\n\n public bool ProcessCommandLineArgument(string arg)\n {\n var pos = arg.IndexOf(\"=\");\n if (pos < 0) {\n if (serviceFileName.Length == 0) {\n serviceFileName = arg;\n return true;\n }\n else {\n Console.WriteLine(\"Invalid argument {0}\", arg);\n return false;\n }\n }\n var key = arg.Substring(0, pos).ToLower();\n var value = arg.Substring(pos + 1);\n return SetValue(key, value);\n }\n\n private bool SetBoolValue(string key, string value, ref bool p)\n {\n if (value == \"false\") {\n p = false;\n return true;\n }\n else if (value == \"true\") {\n p = true;\n return true;\n }\n else {\n Console.WriteLine(\"ERROR - Invalid {0} value {1} - should be false or true\", key, value);\n return false;\n }\n }\n\n private bool SetValue(string key, string value)\n {\n if (key == \"verbose\") {\n return SetBoolValue(key, value, ref verbose);\n }\n\n if (key == \"print\") {\n return SetBoolValue(key, value, ref printRequestsAndReplies);\n }\n\n if (key == \"nthreads\") {\n try {\n numThreads = Convert.ToInt32(value);\n if (numThreads < 1) {\n Console.WriteLine(\"Number of threads must be at least 1, so can't be {0}\", numThreads);\n return false;\n }\n return true;\n }\n catch (Exception e) {\n Console.WriteLine(\"Could not parse number of threads {0} as a number. Exception:\\n{1}\", value, e);\n return false;\n }\n }\n\n if (key == \"duration\") {\n experimentDuration = Convert.ToUInt64(value);\n return true;\n }\n\n if (key == \"setfraction\") {\n try {\n setFraction = Convert.ToDouble(value);\n return true;\n }\n catch (Exception e) {\n Console.WriteLine(\"Could not parse set fraction {0} as a number. Exception:\\n{1}\", value, e);\n return false;\n }\n }\n\n if (key == \"deletefraction\") {\n try {\n deleteFraction = Convert.ToDouble(value);\n return true;\n }\n catch (Exception e) {\n Console.WriteLine(\"Could not parse delete fraction {0} as a number. Exception:\\n{1}\", value, e);\n return false;\n }\n }\n\n Console.WriteLine(\"Invalid argument key {0}\", key);\n return false;\n }\n }\n}\n" }, { "path": "ironfleet/src/IronRSLKVClient/Program.cs", "content": "using IronfleetCommon;\nusing IronfleetIoFramework;\nusing System;\nusing System.Linq;\nusing System.Numerics;\nusing System.Threading;\nusing System.IO;\nusing System.Net;\nusing System.Collections.Generic;\n\nnamespace IronRSLKVClient\n{\n class Program\n {\n static void usage()\n {\n Console.Write(@\"\nUsage: dotnet IronRSLKVClient.dll [key=value]...\n\n - file path of the service description\n\nAllowed keys:\n nthreads - number of client threads to run (default 1)\n duration - duration of experiment in seconds (default 60)\n setfraction - fraction of requests that are sets (default 0.25)\n deletefraction - fraction of requests that are deletes (default 0.05)\n print - print requests and replies (false or true, default false)\n verbose - print verbose output (false or true, default false)\n\");\n }\n\n static void Main(string[] args)\n {\n Params ps = new Params();\n\n foreach (var arg in args)\n {\n if (!ps.ProcessCommandLineArgument(arg)) {\n usage();\n return;\n }\n }\n\n if (!ps.Validate()) {\n usage();\n return;\n }\n\n var serviceIdentity = ServiceIdentity.ReadFromFile(ps.ServiceFileName);\n if (serviceIdentity == null) {\n return;\n }\n\n HiResTimer.Initialize();\n if (ps.Verbose) {\n Console.WriteLine(\"Client process starting {0} threads running for {1} s...\", ps.NumThreads, ps.ExperimentDuration);\n }\n \n Console.WriteLine(\"[[READY]]\");\n \n // Start the experiment\n var threads = Client.StartThreads(ps, serviceIdentity).ToArray();\n\n if (ps.ExperimentDuration == 0)\n {\n threads[0].Join();\n }\n else\n {\n Thread.Sleep((int)ps.ExperimentDuration * 1000);\n Console.Out.WriteLine(\"[[DONE]]\");\n Console.Out.Flush();\n Environment.Exit(0);\n }\n }\n }\n}\n" }, { "path": "ironfleet/src/IronRSLKVServer/.gitignore", "content": ".vs\nProperties/\n" }, { "path": "ironfleet/src/IronRSLKVServer/IronRSLKVServer.csproj", "content": "\n\n \n Exe\n net6.0\n \n\n \n 1701;1702;162;164;168;183;219;436;1717;1718\n \n\n \n IronRSLServer.Program\n \n\n \n \n \n\n \n \n \n \n \n \n \n\n\n" }, { "path": "ironfleet/src/IronRSLKVServer/IronRSLKVServer.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.31005.135\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"IronRSLKVServer\", \"IronRSLKVServer.csproj\", \"{80249939-7D35-43CA-891A-F4C73EC6D959}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {3EDDD386-2BE8-48A4-8188-FFDA2034F16D}\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironfleet/src/IronRSLKVServer/KVMessages.cs", "content": "using IronfleetIoFramework;\nusing System;\nusing System.IO;\nusing System.Linq;\nusing System.Text;\n\nnamespace KVMessages\n{\n ///////////////////////////////////\n // KVRequest\n ///////////////////////////////////\n \n public enum KVRequestType\n {\n Invalid = 0,\n Get = 1,\n Set = 2,\n Delete = 3\n }\n \n public abstract class KVRequest\n {\n public KVRequest() { }\n\n public virtual KVRequestType RequestType\n {\n get { return KVRequestType.Invalid; }\n }\n\n public void Write(Stream stream)\n {\n IoEncoder.WriteInt32(stream, (Int32)RequestType);\n WriteTypeSpecificFields(stream);\n }\n\n public byte[] Encode()\n {\n MemoryStream memStream = new MemoryStream();\n Write(memStream);\n return memStream.ToArray();\n }\n \n public virtual void WriteTypeSpecificFields(Stream stream)\n {\n }\n\n public static KVRequest Decode(byte[] bytes, int offset)\n {\n if (bytes.Length < offset + 4) {\n Console.Error.WriteLine(\"Received request of invalid length {0}\", bytes.Length - offset);\n return null;\n }\n\n Int32 whichType = IoEncoder.ExtractInt32(bytes, offset);\n switch (whichType)\n {\n case (Int32)KVRequestType.Get : return KVGetRequest.ExtractFields(bytes, offset + 4);\n case (Int32)KVRequestType.Set : return KVSetRequest.ExtractFields(bytes, offset + 4);\n case (Int32)KVRequestType.Delete : return KVDeleteRequest.ExtractFields(bytes, offset + 4);\n default :\n Console.Error.WriteLine(\"Received request with invalid case {0}\", whichType);\n return new KVInvalidRequest();\n }\n }\n }\n\n public class KVInvalidRequest : KVRequest\n {\n }\n\n public class KVGetRequest : KVRequest\n {\n private string key;\n\n public KVGetRequest(string i_key)\n {\n key = i_key;\n }\n\n public override KVRequestType RequestType\n {\n get { return KVRequestType.Get; }\n }\n\n public string Key { get { return key; } }\n\n public static KVRequest ExtractFields(byte[] bytes, int offset)\n {\n Int32 keySize = IoEncoder.ExtractInt32(bytes, offset);\n if (keySize < 0 || keySize != bytes.Length - offset - 4) {\n Console.Error.WriteLine(\"Received get request with invalid key length ({0} instead of {1})\",\n keySize, bytes.Length - offset - 4);\n return new KVInvalidRequest();\n }\n byte[] keyBytes = bytes.Skip(offset + 4).ToArray();\n string key;\n try {\n key = Encoding.UTF8.GetString(keyBytes);\n }\n catch (Exception) {\n Console.Error.WriteLine(\"Could not decode key in get request using UTF-8\");\n return new KVInvalidRequest();\n }\n return new KVGetRequest(key);\n }\n\n public override void WriteTypeSpecificFields(Stream stream)\n {\n byte[] keyBytes = Encoding.UTF8.GetBytes(key);\n IoEncoder.WriteInt32(stream, keyBytes.Length);\n IoEncoder.WriteBytes(stream, keyBytes, 0, (UInt64)keyBytes.Length);\n }\n }\n\n public class KVSetRequest : KVRequest\n {\n private string key;\n private string val;\n\n public KVSetRequest(string i_key, string i_val)\n {\n key = i_key;\n val = i_val;\n }\n\n public override KVRequestType RequestType\n {\n get { return KVRequestType.Set; }\n }\n\n public string Key { get { return key; } }\n public string Val { get { return val; } }\n\n public static KVRequest ExtractFields(byte[] bytes, int offset)\n {\n Int32 keySize = IoEncoder.ExtractInt32(bytes, offset);\n if (keySize < 0 || keySize > bytes.Length - offset - 8) {\n Console.Error.WriteLine(\"Received set request with invalid key length ({0} > {1})\",\n keySize, bytes.Length - offset - 8);\n return new KVInvalidRequest();\n }\n byte[] keyBytes = bytes.Skip(offset + 4).Take(keySize).ToArray();\n string key;\n try {\n key = Encoding.UTF8.GetString(keyBytes);\n }\n catch (Exception) {\n Console.Error.WriteLine(\"Could not decode key in set request using UTF-8\");\n return new KVInvalidRequest();\n }\n Int32 valSize = IoEncoder.ExtractInt32(bytes, offset + 4 + keySize);\n if (valSize < 0 || valSize != bytes.Length - offset - 8 - keySize) {\n Console.Error.WriteLine(\"Received set request with invalid value length ({0} instead of {1})\",\n keySize, bytes.Length - offset - 8 - keySize);\n return new KVInvalidRequest();\n }\n byte[] valBytes = bytes.Skip(offset + 8 + keySize).ToArray();\n string val;\n try {\n val = Encoding.UTF8.GetString(valBytes);\n }\n catch (Exception) {\n Console.Error.WriteLine(\"Could not decode value in set request using UTF-8\");\n return new KVInvalidRequest();\n }\n return new KVSetRequest(key, val);\n }\n\n public override void WriteTypeSpecificFields(Stream stream)\n {\n byte[] keyBytes = Encoding.UTF8.GetBytes(key);\n byte[] valBytes = Encoding.UTF8.GetBytes(val);\n IoEncoder.WriteInt32(stream, keyBytes.Length);\n IoEncoder.WriteBytes(stream, keyBytes, 0, (UInt64)keyBytes.Length);\n IoEncoder.WriteInt32(stream, valBytes.Length);\n IoEncoder.WriteBytes(stream, valBytes, 0, (UInt64)valBytes.Length);\n }\n }\n\n public class KVDeleteRequest : KVRequest\n {\n private string key;\n\n public KVDeleteRequest(string i_key)\n {\n key = i_key;\n }\n\n public override KVRequestType RequestType\n {\n get { return KVRequestType.Delete; }\n }\n\n public string Key { get { return key; } }\n\n public static KVRequest ExtractFields(byte[] bytes, int offset)\n {\n Int32 keySize = IoEncoder.ExtractInt32(bytes, offset);\n if (keySize < 0 || keySize != bytes.Length - offset - 4) {\n Console.Error.WriteLine(\"Received delete request with invalid key length ({0} instead of {1})\",\n keySize, bytes.Length - offset - 4);\n return new KVInvalidRequest();\n }\n byte[] keyBytes = bytes.Skip(offset + 4).ToArray();\n string key;\n try {\n key = Encoding.UTF8.GetString(keyBytes);\n }\n catch (Exception) {\n Console.Error.WriteLine(\"Could not decode key in delete request using UTF-8\");\n return new KVInvalidRequest();\n }\n return new KVDeleteRequest(key);\n }\n\n public override void WriteTypeSpecificFields(Stream stream)\n {\n byte[] keyBytes = Encoding.UTF8.GetBytes(key);\n IoEncoder.WriteInt32(stream, keyBytes.Length);\n IoEncoder.WriteBytes(stream, keyBytes, 0, (UInt64)keyBytes.Length);\n }\n }\n\n ///////////////////////////////////\n // KVReply\n ///////////////////////////////////\n \n public enum KVReplyType\n {\n Invalid = 0,\n GetFound = 1,\n GetUnfound = 2,\n SetSuccess = 3,\n SetFailure = 4,\n DeleteFound = 5,\n DeleteUnfound = 6,\n InvalidRequest = 7\n }\n \n public abstract class KVReply\n {\n public KVReply() { }\n\n public virtual KVReplyType ReplyType\n {\n get { return KVReplyType.Invalid; }\n }\n\n public void Write(Stream stream)\n {\n IoEncoder.WriteInt32(stream, (Int32)ReplyType);\n WriteTypeSpecificFields(stream);\n }\n \n public virtual void WriteTypeSpecificFields(Stream stream)\n {\n }\n\n public static KVReply Decode(byte[] bytes, int offset)\n {\n if (bytes.Length < offset + 4) {\n Console.Error.WriteLine(\"Received reply of invalid length {0}\", bytes.Length - offset);\n return null;\n }\n\n Int32 whichCase = IoEncoder.ExtractInt32(bytes, offset);\n switch (whichCase)\n {\n case (Int32)KVReplyType.GetFound : return KVGetFoundReply.ExtractFields(bytes, offset + 4);\n case (Int32)KVReplyType.GetUnfound : return KVGetUnfoundReply.ExtractFields(bytes, offset + 4);\n case (Int32)KVReplyType.SetSuccess : return KVSetSuccessReply.ExtractFields(bytes, offset + 4);\n case (Int32)KVReplyType.SetFailure : return KVSetFailureReply.ExtractFields(bytes, offset + 4);\n case (Int32)KVReplyType.DeleteFound : return KVDeleteFoundReply.ExtractFields(bytes, offset + 4);\n case (Int32)KVReplyType.DeleteUnfound : return KVDeleteUnfoundReply.ExtractFields(bytes, offset + 4);\n case (Int32)KVReplyType.InvalidRequest : return KVInvalidRequestReply.ExtractFields(bytes, offset + 4);\n default :\n Console.Error.WriteLine(\"Received reply with invalid case {0}\", whichCase);\n return new KVInvalidReply();\n }\n }\n }\n\n public class KVInvalidReply : KVReply\n {\n }\n\n public class KVGetFoundReply : KVReply\n {\n private string val;\n\n public KVGetFoundReply(string i_val)\n {\n val = i_val;\n }\n\n public override KVReplyType ReplyType { get { return KVReplyType.GetFound; } }\n\n public string Val { get { return val; } }\n\n public static KVReply ExtractFields(byte[] bytes, int offset)\n {\n Int32 valSize = IoEncoder.ExtractInt32(bytes, offset);\n if (valSize < 0 || valSize != bytes.Length - offset - 4) {\n Console.Error.WriteLine(\"Received get-found reply with invalid value length ({0} instead of {1})\",\n valSize, bytes.Length - offset - 4);\n return new KVInvalidReply();\n }\n byte[] valBytes = bytes.Skip(offset + 4).ToArray();\n string val;\n try {\n val = Encoding.UTF8.GetString(valBytes);\n }\n catch (Exception) {\n Console.Error.WriteLine(\"Could not decode value in get-found reply using UTF-8\");\n return new KVInvalidReply();\n }\n return new KVGetFoundReply(val);\n }\n\n public override void WriteTypeSpecificFields(Stream stream)\n {\n byte[] valBytes = Encoding.UTF8.GetBytes(val);\n IoEncoder.WriteInt32(stream, valBytes.Length);\n IoEncoder.WriteBytes(stream, valBytes, 0, (UInt64)valBytes.Length);\n }\n }\n\n public class KVGetUnfoundReply : KVReply\n {\n public KVGetUnfoundReply() { }\n\n public override KVReplyType ReplyType { get { return KVReplyType.GetUnfound; } }\n\n public static KVReply ExtractFields(byte[] bytes, int offset)\n {\n if (bytes.Length != offset) {\n Console.Error.WriteLine(\"Received get-unfound reply with {0} extraneous bytes\", bytes.Length - offset);\n return new KVInvalidReply();\n }\n return new KVGetUnfoundReply();\n }\n }\n\n public class KVSetSuccessReply : KVReply\n {\n public KVSetSuccessReply() { }\n\n public override KVReplyType ReplyType { get { return KVReplyType.SetSuccess; } }\n\n public static KVReply ExtractFields(byte[] bytes, int offset)\n {\n if (bytes.Length != offset) {\n Console.Error.WriteLine(\"Received set-success reply with {0} extraneous bytes\", bytes.Length - offset);\n return new KVInvalidReply();\n }\n return new KVSetSuccessReply();\n }\n }\n\n public class KVSetFailureReply : KVReply\n {\n public KVSetFailureReply() { }\n\n public override KVReplyType ReplyType { get { return KVReplyType.SetFailure; } }\n\n public static KVReply ExtractFields(byte[] bytes, int offset)\n {\n if (bytes.Length != offset) {\n Console.Error.WriteLine(\"Received set-success reply with {0} extraneous bytes\", bytes.Length - offset);\n return new KVInvalidReply();\n }\n return new KVSetFailureReply();\n }\n }\n\n public class KVDeleteFoundReply : KVReply\n {\n public KVDeleteFoundReply() { }\n\n public override KVReplyType ReplyType { get { return KVReplyType.DeleteFound; } }\n\n public static KVReply ExtractFields(byte[] bytes, int offset)\n {\n if (bytes.Length != offset) {\n Console.Error.WriteLine(\"Received delete-found reply with {0} extraneous bytes\", bytes.Length - offset);\n return new KVInvalidReply();\n }\n return new KVDeleteFoundReply();\n }\n }\n\n public class KVDeleteUnfoundReply : KVReply\n {\n public KVDeleteUnfoundReply() { }\n\n public override KVReplyType ReplyType { get { return KVReplyType.DeleteUnfound; } }\n\n public static KVReply ExtractFields(byte[] bytes, int offset)\n {\n if (bytes.Length != offset) {\n Console.Error.WriteLine(\"Received delete-unfound reply with {0} extraneous bytes\", bytes.Length - offset);\n return new KVInvalidReply();\n }\n return new KVDeleteUnfoundReply();\n }\n }\n\n public class KVInvalidRequestReply : KVReply\n {\n public KVInvalidRequestReply() { }\n\n public override KVReplyType ReplyType { get { return KVReplyType.InvalidRequest; } }\n\n public static KVReply ExtractFields(byte[] bytes, int offset)\n {\n if (bytes.Length != offset) {\n Console.Error.WriteLine(\"Received invalid-request reply with {0} extraneous bytes\", bytes.Length - offset);\n return new KVInvalidReply();\n }\n return new KVInvalidRequestReply();\n }\n }\n \n}\n" }, { "path": "ironfleet/src/IronRSLKVServer/Service.cs", "content": "using IronfleetIoFramework;\nusing KVMessages;\nusing System;\nusing System.Collections.Generic;\nusing System.IO;\nusing System.Linq;\nusing System.Text;\n\nnamespace IronRSL\n{\n public class Service\n {\n Dictionary kvStore;\n\n public static string Name { get { return \"KV\"; } }\n\n private Service()\n {\n kvStore = new Dictionary();\n }\n\n public static int MaxKeySize { get { return 0x10_0000; /* 1 MB */ } }\n public static int MaxValueSize { get { return 0x800_0000; /* 128 MB */ } }\n public static int MaxNumKeys { get { return 100_000_000; /* 100 million */} }\n\n public static Service Initialize()\n {\n return new Service();\n }\n\n private void AddInitialKey(string key, string val)\n {\n kvStore[key] = val;\n }\n\n public static Service Deserialize(byte[] buf)\n {\n Service service = new Service();\n\n int offset = 0;\n while (offset < buf.Length) {\n if (offset + 4 > buf.Length) {\n Console.Error.WriteLine(\"WARNING - Got partial key size in state machine state\");\n break;\n }\n Int32 keySize = IoEncoder.ExtractInt32(buf, offset);\n if (keySize < 0 || keySize > MaxKeySize || keySize > buf.Length - offset - 8) {\n Console.Error.WriteLine(\"WARNING - Got invalid key size ({0}) in state machine state\", keySize);\n break;\n }\n if (keySize > buf.Length - offset - 8) {\n Console.Error.WriteLine(\"WARNING - Got key size {0} that exceeds the {1} bytes remaining in state machine state\",\n keySize, buf.Length - offset - 8);\n break;\n }\n byte[] keyBytes = buf.Skip(offset + 4).Take(keySize).ToArray();\n Int32 valueSize = IoEncoder.ExtractInt32(buf, offset + 4 + keySize);\n if (valueSize < 0 || valueSize > MaxValueSize) {\n Console.Error.WriteLine(\"WARNING - Got invalid value size {0} in state machine state\", valueSize);\n break;\n }\n if (valueSize > buf.Length - offset - 8 - keySize) {\n Console.Error.WriteLine(\"WARNING - Got value size {0} that exceeds the {1} bytes remaining in state machine state\",\n valueSize, buf.Length - offset - 8 - keySize);\n break;\n }\n byte[] valueBytes = buf.Skip(offset + 8 + keySize).Take(valueSize).ToArray();\n offset += (keySize + valueSize + 8);\n\n string key;\n try {\n key = Encoding.UTF8.GetString(keyBytes);\n }\n catch (Exception e) {\n Console.Error.WriteLine(\"WARNING - Got non-UTF-8-encoded key in state machine state\");\n break;\n }\n\n string value;\n try {\n value = Encoding.UTF8.GetString(valueBytes);\n }\n catch (Exception e) {\n Console.Error.WriteLine(\"WARNING - Got non-UTF-8-encoded value in state machine state\");\n break;\n }\n\n service.AddInitialKey(key, value);\n }\n\n return service;\n }\n\n public byte[] Serialize()\n {\n MemoryStream stream = new MemoryStream();\n foreach (var kv in kvStore) {\n byte[] keyBytes = Encoding.UTF8.GetBytes(kv.Key);\n byte[] valueBytes = Encoding.UTF8.GetBytes(kv.Value);\n IoEncoder.WriteInt32(stream, keyBytes.Length);\n IoEncoder.WriteBytes(stream, keyBytes, 0, (UInt64)keyBytes.Length);\n IoEncoder.WriteInt32(stream, valueBytes.Length);\n IoEncoder.WriteBytes(stream, valueBytes, 0, (UInt64)valueBytes.Length);\n }\n return stream.ToArray();\n }\n\n private KVReply HandleRequestInternal(KVRequest req)\n {\n if (req is KVGetRequest greq) {\n if (greq.Key.Length > MaxKeySize) {\n Console.Error.WriteLine(\"Received get request with too-large key size {0}\", greq.Key.Length);\n return new KVInvalidRequestReply();\n }\n string val;\n if (kvStore.TryGetValue(greq.Key, out val)) {\n return new KVGetFoundReply(val);\n }\n else {\n return new KVGetUnfoundReply();\n }\n }\n \n if (req is KVSetRequest sreq) {\n if (sreq.Key.Length > MaxKeySize) {\n Console.Error.WriteLine(\"Received set request with too-large key size {0}\", sreq.Key.Length);\n return new KVInvalidRequestReply();\n }\n if (sreq.Val.Length > MaxValueSize) {\n Console.Error.WriteLine(\"Received set request with too-large value size {0}\", sreq.Val.Length);\n return new KVInvalidRequestReply();\n }\n if (kvStore.Count == MaxNumKeys && !kvStore.ContainsKey(sreq.Key)) {\n Console.Error.WriteLine(\"Received set request with new key when KV store size was at its maximum\");\n return new KVSetFailureReply();\n }\n kvStore[sreq.Key] = sreq.Val;\n return new KVSetSuccessReply();\n }\n\n if (req is KVDeleteRequest dreq) {\n if (dreq.Key.Length > MaxKeySize) {\n Console.Error.WriteLine(\"Received delete request with too-large key size {0}\", dreq.Key.Length);\n return new KVInvalidRequestReply();\n }\n if (kvStore.ContainsKey(dreq.Key)) {\n kvStore.Remove(dreq.Key);\n return new KVDeleteFoundReply();\n }\n return new KVDeleteUnfoundReply();\n }\n\n return new KVInvalidRequestReply();\n }\n\n public byte[] HandleRequest(byte[] requestBytes)\n {\n KVRequest request = KVRequest.Decode(requestBytes, 0);\n KVReply reply = HandleRequestInternal(request);\n MemoryStream stream = new MemoryStream();\n reply.Write(stream);\n return stream.ToArray();\n }\n \n }\n \n}\n\n" }, { "path": "ironfleet/src/IronSHTClient/.gitignore", "content": "*.v12.suo\r\n.vs/\r\nProperties/\r\n" }, { "path": "ironfleet/src/IronSHTClient/Client.cs", "content": "using IronfleetCommon;\r\nusing IronfleetIoFramework;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Net;\r\nusing System.Threading;\r\n\r\nnamespace IronSHTClient\r\n{\r\n public abstract class MessageBase\r\n {\r\n public ulong CaseId { get; private set; }\r\n\r\n protected MessageBase(ulong caseId)\r\n {\r\n this.CaseId = caseId;\r\n }\r\n\r\n public abstract byte[] ToBigEndianByteArray();\r\n\r\n public byte[] ToByteArray()\r\n {\r\n return this.ToBigEndianByteArray();\r\n }\r\n\r\n protected void EncodeUlong(MemoryStream memStream, ulong value)\r\n {\r\n if (null == memStream)\r\n {\r\n throw new ArgumentNullException(\"memStream\");\r\n }\r\n\r\n var bytes = BitConverter.GetBytes(value);\r\n if (BitConverter.IsLittleEndian)\r\n {\r\n Array.Reverse(bytes);\r\n }\r\n memStream.Write(bytes, 0, bytes.Length);\r\n }\r\n\r\n protected void EncodeBool(MemoryStream memStream, bool value)\r\n {\r\n this.EncodeUlong(memStream, value ? 1UL : 0);\r\n }\r\n\r\n protected void EncodeBytes(MemoryStream memStream, byte[] value)\r\n {\r\n if (null == value)\r\n {\r\n throw new ArgumentNullException(\"value\");\r\n }\r\n\r\n this.EncodeUlong(memStream, (ulong)value.Length);\r\n memStream.Write(value, 0, value.Length);\r\n }\r\n\r\n protected void EncodeHeader(MemoryStream memStream)\r\n {\r\n this.EncodeUlong(memStream, CaseId);\r\n }\r\n }\r\n\r\n public class GetRequestMessage : MessageBase\r\n {\r\n public byte[] Value { get; set; }\r\n public ulong seqNum;\r\n public byte[] myPublicKey;\r\n public ulong key;\r\n\r\n public GetRequestMessage(ulong seqNum, byte[] myPublicKey, ulong key) : base(0)\r\n {\r\n this.seqNum = seqNum;\r\n this.myPublicKey = myPublicKey;\r\n this.key = key; \r\n }\r\n\r\n public override byte[] ToBigEndianByteArray()\r\n {\r\n return this.Encode();\r\n }\r\n\r\n public ulong GetSeqNum()\r\n {\r\n return seqNum;\r\n }\r\n\r\n private byte[] Encode(bool retrans = false)\r\n {\r\n using (var memStream = new MemoryStream())\r\n {\r\n this.EncodeUlong(memStream, (ulong)0); // case for CSingleMessage\r\n this.EncodeUlong(memStream, (ulong)seqNum); // field one in CSingleMessage\r\n this.EncodeBytes(memStream, myPublicKey); // field two in CSingleMessage \r\n this.EncodeUlong(memStream, (ulong)0); // case for GetRequest\r\n this.EncodeUlong(memStream, key); // field one in GetRequest\r\n \r\n return memStream.ToArray();\r\n }\r\n }\r\n }\r\n\r\n public class SetRequestMessage : MessageBase\r\n {\r\n public ulong seqNum;\r\n public byte[] myPublicKey;\r\n public ulong key;\r\n public ulong sizeValue;\r\n public Random rnd;\r\n\r\n public SetRequestMessage(ulong seqNum, byte[] myPublicKey, ulong key, ulong sizeValue) : base(0)\r\n {\r\n this.seqNum = seqNum;\r\n this.myPublicKey = myPublicKey;\r\n this.key = key;\r\n this.sizeValue = sizeValue;\r\n rnd = new Random();\r\n }\r\n\r\n public override byte[] ToBigEndianByteArray()\r\n {\r\n return this.Encode();\r\n }\r\n\r\n public ulong GetSeqNum()\r\n {\r\n return seqNum;\r\n }\r\n\r\n private byte[] Encode(bool retrans = false)\r\n {\r\n using (var memStream = new MemoryStream())\r\n {\r\n byte[] value = new byte[sizeValue];\r\n \r\n rnd.NextBytes(value);\r\n\r\n this.EncodeUlong(memStream, (ulong)0); // case for CSingleMessage\r\n this.EncodeUlong(memStream, (ulong)seqNum); // field one in CSingleMessage\r\n this.EncodeBytes(memStream, this.myPublicKey); // field two in CSingleMessage \r\n this.EncodeUlong(memStream, (ulong)1); // case for SetRequest\r\n this.EncodeUlong(memStream, key); // field one in SetRequest\r\n this.EncodeUlong(memStream, (ulong)0); // case for OptionalValue\r\n this.EncodeBytes(memStream, value); // field two in SetRequest\r\n return memStream.ToArray();\r\n }\r\n }\r\n }\r\n\r\n public class ShardRequestMessage : MessageBase\r\n {\r\n public ulong seqNum;\r\n public byte[] myPublicKey;\r\n public ulong k_lo, k_hi;\r\n public byte[] recipient;\r\n\r\n public ShardRequestMessage(ulong seqNum, byte[] myPublicKey, ulong k_lo, ulong k_hi, byte[] recipient) : base(0)\r\n {\r\n this.seqNum = seqNum;\r\n this.myPublicKey = myPublicKey;\r\n this.k_lo = k_lo;\r\n this.k_hi = k_hi;\r\n this.recipient = recipient;\r\n }\r\n\r\n public override byte[] ToBigEndianByteArray()\r\n {\r\n return this.Encode();\r\n }\r\n\r\n public ulong GetSeqNum()\r\n {\r\n return seqNum;\r\n }\r\n\r\n private byte[] Encode(bool retrans = false)\r\n {\r\n using (var memStream = new MemoryStream())\r\n {\r\n this.EncodeUlong(memStream, (ulong)0); // case for CSingleMessage\r\n this.EncodeUlong(memStream, (ulong)seqNum); // field one in CSingleMessage\r\n this.EncodeBytes(memStream, this.myPublicKey); // field two in CSingleMessage \r\n \r\n this.EncodeUlong(memStream, (ulong)4); // case for ShardRequest\r\n\r\n // encode a KeyRange\r\n this.EncodeUlong(memStream, (ulong)0); // case for KeyPlus(k:Key)\r\n this.EncodeUlong(memStream, (ulong)k_lo); // klo\r\n this.EncodeUlong(memStream, (ulong)0); // case for KeyPlus(k:Key)\r\n this.EncodeUlong(memStream, (ulong)k_hi); // khi\r\n\r\n // encode the recipient\r\n this.EncodeBytes(memStream, this.recipient);\r\n\r\n return memStream.ToArray();\r\n }\r\n }\r\n }\r\n\r\n public class AckMessage : MessageBase\r\n {\r\n public byte[] Value { get; set; }\r\n public ulong seqNum;\r\n\r\n public AckMessage(ulong seqNum) : base(0)\r\n {\r\n this.seqNum = seqNum;\r\n }\r\n\r\n public override byte[] ToBigEndianByteArray()\r\n {\r\n return this.Encode();\r\n }\r\n\r\n public ulong GetSeqNum()\r\n {\r\n return seqNum;\r\n }\r\n\r\n private byte[] Encode(bool retrans = false)\r\n {\r\n using (var memStream = new MemoryStream())\r\n {\r\n this.EncodeUlong(memStream, (ulong)1); // case for CAck\r\n this.EncodeUlong(memStream, (ulong)seqNum); // field one in CSingleMessage\r\n return memStream.ToArray();\r\n }\r\n }\r\n }\r\n\r\n public class ThreadParams\r\n {\r\n public Params ps;\r\n public ulong id;\r\n\r\n public ThreadParams(ulong i_id, Params i_ps)\r\n {\r\n id = i_id;\r\n ps = i_ps;\r\n }\r\n }\r\n\r\n public class Client\r\n {\r\n public int id;\r\n public Params ps;\r\n public IoScheduler scheduler;\r\n public ServiceIdentity serviceIdentity;\r\n\r\n private Client(int i_id, Params i_ps, ServiceIdentity i_serviceIdentity)\r\n {\r\n id = i_id;\r\n ps = i_ps;\r\n serviceIdentity = i_serviceIdentity;\r\n }\r\n\r\n static public IEnumerable StartSetupThreads(Params ps, ServiceIdentity serviceIdentity)\r\n {\r\n if (ps.NumThreads < 0)\r\n {\r\n throw new ArgumentException(\"count is less than 1\", \"count\");\r\n }\r\n\r\n for (int i = 0; i < ps.NumSetupThreads; ++i)\r\n {\r\n var c = new Client(i, ps, serviceIdentity);\r\n Thread t = new Thread(c.Setup);\r\n t.Start();\r\n yield return t;\r\n }\r\n }\r\n\r\n static public IEnumerable StartExperimentThreads(Params ps, ServiceIdentity serviceIdentity)\r\n {\r\n if (ps.NumThreads < 0)\r\n {\r\n throw new ArgumentException(\"count is less than 1\", \"count\");\r\n }\r\n\r\n for (int i = 0; i < ps.NumThreads; ++i)\r\n {\r\n var c = new Client(i, ps, serviceIdentity);\r\n Thread t = new Thread(c.Experiment);\r\n t.Start();\r\n yield return t;\r\n }\r\n }\r\n\r\n public string ByteArrayToString(byte[] ba)\r\n {\r\n string hex = BitConverter.ToString(ba);\r\n return hex.Replace(\"-\", \"\");\r\n }\r\n\r\n public void Setup()\r\n {\r\n scheduler = IoScheduler.CreateClient(serviceIdentity.Servers, ps.Verbose, serviceIdentity.UseSsl);\r\n byte[] myPublicKey = IoScheduler.GetCertificatePublicKey(scheduler.MyCert);\r\n \r\n int serverIdx = 0;\r\n ulong seqNum = 0;\r\n ulong requestKey;\r\n\r\n for (requestKey = 0; requestKey < (ulong)ps.NumKeys; ++requestKey)\r\n {\r\n seqNum++;\r\n var msg = new SetRequestMessage(seqNum, myPublicKey, requestKey, (ulong)ps.ValueSize);\r\n\r\n if (ps.Verbose) {\r\n Console.WriteLine(\"Sending set request message with seq {0}, key {1} to server {2}\", seqNum, requestKey, serverIdx);\r\n }\r\n this.Send(msg, serviceIdentity.Servers[serverIdx].PublicKey);\r\n \r\n // Wait for the reply\r\n var receivedReply = false;\r\n while (!receivedReply)\r\n {\r\n byte[] bytes = Receive();\r\n var endTime = HiResTimer.Ticks;\r\n if (bytes == null) {\r\n //serverIdx = (serverIdx + 1) % serviceIdentity.Servers.Count();\r\n Console.WriteLine(\"#timeout; retrying {0}\", serverIdx);\r\n this.Send(msg, serviceIdentity.Servers[serverIdx].PublicKey);\r\n continue;\r\n }\r\n //Trace(\"Got the following reply:\" + ByteArrayToString(bytes));\r\n //Console.Out.WriteLine(\"Got packet length: \" + bytes.Length);\r\n if (bytes.Length == 16)\r\n {\r\n //Ignore acks\r\n if (ps.Verbose) {\r\n Console.WriteLine(\"Received ack\");\r\n }\r\n }\r\n else if (bytes.Length >= 48) \r\n {\r\n var replySeqNum = ExtractBE64(bytes, offset: 8);\r\n if (ps.Verbose) {\r\n Console.WriteLine(\"Reply sequence number : {0}\", replySeqNum);\r\n }\r\n\r\n var ack_msg = new AckMessage(replySeqNum);\r\n\r\n if (ps.Verbose) {\r\n Console.Out.WriteLine(\"Client {0}: Sending an ack with sequence number {1} to {2}\",\r\n id, replySeqNum, serviceIdentity.Servers[serverIdx]);\r\n }\r\n this.Send(ack_msg, serviceIdentity.Servers[serverIdx].PublicKey);\r\n\r\n int publicKeyLength = Convert.ToInt32(ExtractBE64(bytes, offset: 16));\r\n if (bytes.Length < publicKeyLength + 40) {\r\n Console.WriteLine(\"ERROR - Received too-short message (size {0} not long enough for public key of length {1})\",\r\n bytes.Length, publicKeyLength);\r\n }\r\n else {\r\n var replyKey = ExtractBE64(bytes, offset: 32 + publicKeyLength);\r\n // Need to send an ack\r\n if (ps.Verbose) {\r\n Console.WriteLine(\"Request key : {0}\", requestKey);\r\n Console.WriteLine(\"Reply key : {0}\", replyKey);\r\n Console.WriteLine(\"Got packet length: {0}\", bytes.Length);\r\n }\r\n\r\n if (replyKey == requestKey)\r\n {\r\n receivedReply = true;\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n\r\n private void ReceiveReply(int serverIdx, byte[] myPublicKey, ulong requestKey, bool receiveOnlyAcks,\r\n bool expectRedirect = false)\r\n {\r\n var receivedReply = false;\r\n while (!receivedReply)\r\n {\r\n byte[] bytes = Receive();\r\n if (bytes == null) {\r\n Console.WriteLine(\"#timeout; retrying {0}\", serverIdx);\r\n continue;\r\n }\r\n\r\n if (bytes.Length == 16)\r\n {\r\n var replySeqNum = ExtractBE64(bytes, offset: 8);\r\n if (ps.Verbose) {\r\n Console.WriteLine(\"Received an ack for sequence number {0}\", replySeqNum);\r\n }\r\n \r\n if (receiveOnlyAcks)\r\n {\r\n receivedReply = true;\r\n }\r\n }\r\n else if (bytes.Length >= 48)\r\n {\r\n var replySeqNum = ExtractBE64(bytes, offset: 8);\r\n var ack_msg = new AckMessage(replySeqNum);\r\n this.Send(ack_msg, serviceIdentity.Servers[serverIdx].PublicKey);\r\n\r\n int publicKeyLength = Convert.ToInt32(ExtractBE64(bytes, offset: 16));\r\n if (bytes.Length < publicKeyLength + 40) {\r\n Console.WriteLine(\"ERROR - Received too-short message (size {0} not long enough for public key of length {1})\",\r\n bytes.Length, publicKeyLength);\r\n }\r\n else {\r\n var cmessage_case = ExtractBE64(bytes, offset: 24 + publicKeyLength);\r\n if (ps.Verbose) {\r\n Console.WriteLine(\"Received Message Case {0}\", cmessage_case);\r\n }\r\n\r\n var replyKey = ExtractBE64(bytes, offset: 32 + publicKeyLength);\r\n if (ps.Verbose) {\r\n if (cmessage_case == 2) {\r\n Console.WriteLine(\"Received a reply with key {0}\", replyKey);\r\n }\r\n else if (cmessage_case == 3) {\r\n Console.WriteLine(\"Received a redirect for key {0}\", replyKey);\r\n }\r\n }\r\n\r\n if (replyKey == requestKey && (expectRedirect ? cmessage_case == 3 : cmessage_case == 2))\r\n {\r\n receivedReply = true;\r\n }\r\n }\r\n }\r\n }\r\n }\r\n\r\n public void Experiment()\r\n {\r\n ulong requestKey;\r\n int serverIdx = 0;\r\n \r\n scheduler = IoScheduler.CreateClient(serviceIdentity.Servers, ps.Verbose, serviceIdentity.UseSsl);\r\n\r\n byte[] myPublicKey = IoScheduler.GetCertificatePublicKey(scheduler.MyCert);\r\n ulong seqNum = 0;\r\n \r\n // Test the functionality of the Sharding\r\n if (ps.Workload == 'f')\r\n {\r\n // A delegation can delegate at most 61 keys, so make sure\r\n // there can't be that many keys in the range by having the\r\n // range be smaller than 61.\r\n ulong k_lo = 125;\r\n ulong k_hi = 175;\r\n requestKey = 150;\r\n var recipient = serviceIdentity.Servers[(serverIdx + 1) % serviceIdentity.Servers.Count()];\r\n\r\n seqNum++;\r\n var msg = new GetRequestMessage(seqNum, myPublicKey, requestKey);\r\n this.Send(msg, serviceIdentity.Servers[serverIdx].PublicKey);\r\n ReceiveReply(serverIdx, myPublicKey, requestKey, false);\r\n\r\n seqNum++;\r\n Console.WriteLine(\"Sending a Shard request with a sequence number {0}\", seqNum);\r\n var shardMessage = new ShardRequestMessage(seqNum, myPublicKey, k_lo, k_hi, recipient.PublicKey);\r\n this.Send(shardMessage, serviceIdentity.Servers[serverIdx].PublicKey);\r\n ReceiveReply(serverIdx, myPublicKey, requestKey, true);\r\n\r\n Thread.Sleep(5000);\r\n\r\n Console.WriteLine(\"Sending a GetRequest after a Shard, expect a redirect\");\r\n\r\n seqNum++;\r\n msg = new GetRequestMessage(seqNum, myPublicKey, requestKey);\r\n this.Send(msg, serviceIdentity.Servers[(serverIdx + 0) % serviceIdentity.Servers.Count()].PublicKey);\r\n ReceiveReply(serverIdx, myPublicKey, requestKey, false, expectRedirect: true);\r\n\r\n Thread.Sleep(5000);\r\n\r\n Console.WriteLine(\"Sending a GetRequest after a Shard to the second host, expect a reply\");\r\n // Must use sequence number 1 since this is the first message\r\n // to this server.\r\n msg = new GetRequestMessage(1, myPublicKey, requestKey);\r\n this.Send(msg, serviceIdentity.Servers[(serverIdx + 1) % serviceIdentity.Servers.Count()].PublicKey);\r\n ReceiveReply((serverIdx + 1) % serviceIdentity.Servers.Count(), myPublicKey, requestKey, false);\r\n\r\n Console.WriteLine(\"Successfully received reply\");\r\n \r\n return;\r\n }\r\n\r\n // Run an actual workload\r\n while (true)\r\n {\r\n seqNum++;\r\n var receivedReply = false;\r\n requestKey = seqNum % (ulong)ps.NumKeys;\r\n \r\n MessageBase msg;\r\n if (ps.Workload == 'g') \r\n {\r\n msg = new GetRequestMessage(seqNum, myPublicKey, requestKey);\r\n }\r\n else\r\n {\r\n msg = new SetRequestMessage(seqNum, myPublicKey, requestKey, (ulong)ps.ValueSize);\r\n }\r\n\r\n var startTime = HiResTimer.Ticks;\r\n this.Send(msg, serviceIdentity.Servers[serverIdx].PublicKey);\r\n \r\n // Wait for the reply\r\n \r\n while (!receivedReply)\r\n {\r\n byte[] bytes = Receive();\r\n if (bytes == null) {\r\n //serverIdx = (serverIdx + 1) % serviceIdentity.Servers.Count();\r\n //Console.WriteLine(\"#timeout; rotating to server {0}\", serverIdx);\r\n Console.WriteLine(\"#timeout; retrying {0}\", serverIdx);\r\n this.Send(msg, serviceIdentity.Servers[serverIdx].PublicKey);\r\n continue;\r\n }\r\n var endTime = HiResTimer.Ticks;\r\n\r\n if (bytes.Length == 16)\r\n {\r\n //Ignore acks\r\n }\r\n else if (bytes.Length >= 56)\r\n {\r\n var replySeqNum = ExtractBE64(bytes, offset: 8);\r\n if (ps.Verbose)\r\n {\r\n Console.WriteLine(\"Reply sequence number : {0}\", replySeqNum);\r\n Console.WriteLine(\"Client {0}: Sending an ack with sequence number {1} to {2}\",\r\n id, replySeqNum, serviceIdentity.Servers[serverIdx]);\r\n }\r\n if (seqNum % 100 == 0)\r\n {\r\n var ack_msg = new AckMessage(replySeqNum);\r\n this.Send(ack_msg, serviceIdentity.Servers[serverIdx].PublicKey);\r\n }\r\n\r\n int publicKeyLength = Convert.ToInt32(ExtractBE64(bytes, offset: 16));\r\n if (bytes.Length < publicKeyLength + 40)\r\n {\r\n Console.WriteLine(\"ERROR - Received too-short message (size {0} not long enough for public key of length {1})\",\r\n bytes.Length, publicKeyLength);\r\n }\r\n else\r\n {\r\n var replyKey = ExtractBE64(bytes, offset: 32 + publicKeyLength);\r\n // Need to send an ack\r\n if (ps.Verbose)\r\n {\r\n Console.WriteLine(\"Request key : {0}\", requestKey);\r\n Console.WriteLine(\"Reply key : {0}\", replyKey);\r\n Console.WriteLine(\"Got packet length: {0}\", bytes.Length);\r\n }\r\n\r\n // key is the same as the sequence number\r\n if (replyKey == requestKey)\r\n {\r\n receivedReply = true;\r\n Console.WriteLine(\"#req {0} {1} {2}\",\r\n id,\r\n seqNum,\r\n HiResTimer.TicksToMilliseconds(endTime - startTime));\r\n }\r\n }\r\n }\r\n else {\r\n Console.WriteLine(\"Received packet of unexpected length {0}\", bytes.Length);\r\n }\r\n }\r\n }\r\n }\r\n\r\n private void Send(MessageBase msg, byte[] remote)\r\n {\r\n var a = msg.ToBigEndianByteArray();\r\n remote = scheduler.HashPublicKey(remote);\r\n if (!scheduler.SendPacket(remote, a))\r\n {\r\n throw new InvalidOperationException(\"failed to send complete message.\");\r\n }\r\n }\r\n\r\n private byte[] Receive()\r\n {\r\n bool ok;\r\n bool timedOut;\r\n byte[] remote;\r\n byte[] buffer;\r\n scheduler.ReceivePacket(1000, out ok, out timedOut, out remote, out buffer);\r\n return buffer;\r\n }\r\n\r\n public ulong EncodeIpPort(IPEndPoint ep)\r\n {\r\n ushort port = (ushort)ep.Port;\r\n byte[] addrBytes = ep.Address.GetAddressBytes();\r\n uint addr = ExtractBE32(addrBytes, 0);\r\n\r\n MemoryStream str = new MemoryStream();\r\n ushort preamble = 0;\r\n var bytes = BitConverter.GetBytes(preamble);\r\n str.Write(bytes, 0, bytes.Length);\r\n bytes = BitConverter.GetBytes(addr);\r\n if (BitConverter.IsLittleEndian)\r\n {\r\n Array.Reverse(bytes);\r\n }\r\n str.Write(bytes, 0, bytes.Length);\r\n bytes = BitConverter.GetBytes(port);\r\n if (BitConverter.IsLittleEndian)\r\n {\r\n Array.Reverse(bytes);\r\n }\r\n str.Write(bytes, 0, bytes.Length);\r\n byte[] s = str.ToArray();\r\n Array.Reverse(s);\r\n return BitConverter.ToUInt64(s, 0);\r\n }\r\n\r\n public static UInt64 ExtractBE64(byte[] byteArray, int offset)\r\n {\r\n byte[] extractedBytes = byteArray.Skip(offset).Take(8).ToArray();\r\n Array.Reverse(extractedBytes);\r\n return BitConverter.ToUInt64(extractedBytes, 0);\r\n }\r\n\r\n public static UInt32 ExtractBE32(byte[] byteArray, int offset)\r\n {\r\n byte[] extractedBytes = byteArray.Skip(offset).Take(4).ToArray();\r\n Array.Reverse(extractedBytes);\r\n return BitConverter.ToUInt32(extractedBytes, 0);\r\n }\r\n }\r\n}\r\n" }, { "path": "ironfleet/src/IronSHTClient/IronSHTClient.csproj", "content": "\n\n \n Exe\n net6.0\n \n\n \n \n \n \n \n\n\n" }, { "path": "ironfleet/src/IronSHTClient/IronSHTClient.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.31112.23\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"IronSHTClient\", \"IronSHTClient.csproj\", \"{5CC355BD-00A8-4B66-9E61-13CB850C13E5}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{5CC355BD-00A8-4B66-9E61-13CB850C13E5}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{5CC355BD-00A8-4B66-9E61-13CB850C13E5}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{5CC355BD-00A8-4B66-9E61-13CB850C13E5}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{5CC355BD-00A8-4B66-9E61-13CB850C13E5}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {AD1A62DC-08C5-41B5-9C5C-5C0682ED36ED}\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironfleet/src/IronSHTClient/Params.cs", "content": "using System;\nusing System.Net;\n\nnamespace IronSHTClient\n{\n public class Params\n {\n private string serviceFileName;\n private int numSetupThreads;\n private int numThreads;\n private ulong experimentDuration;\n private char workload;\n private int numKeys;\n private int valueSize;\n private bool verbose;\n\n public Params()\n {\n serviceFileName = \"\";\n numSetupThreads = 1;\n numThreads = 1;\n experimentDuration = 60;\n workload = 's';\n numKeys = 1000;\n valueSize = 1000;\n verbose = false;\n }\n\n public string ServiceFileName { get { return serviceFileName; } }\n public int NumSetupThreads { get { return numSetupThreads; } }\n public int NumThreads { get { return numThreads; } }\n public ulong ExperimentDuration { get { return experimentDuration; } }\n public char Workload { get { return workload; } }\n public int NumKeys { get { return numKeys; } }\n public int ValueSize { get { return valueSize; } }\n public bool Verbose { get { return verbose; } }\n\n public bool Validate()\n {\n if (serviceFileName.Length == 0) {\n Console.WriteLine(\"ERROR - Missing service parameter\");\n return false;\n }\n return true;\n }\n\n public bool ProcessCommandLineArgument(string arg)\n {\n var pos = arg.IndexOf(\"=\");\n if (pos < 0) {\n if (serviceFileName.Length == 0) {\n serviceFileName = arg;\n return true;\n }\n else {\n Console.WriteLine(\"Invalid argument {0}\", arg);\n return false;\n }\n }\n var key = arg.Substring(0, pos).ToLower();\n var value = arg.Substring(pos + 1);\n return SetValue(key, value);\n }\n\n private bool SetValue(string key, string value)\n {\n if (key == \"verbose\") {\n if (value == \"false\") {\n verbose = false;\n return true;\n }\n if (value == \"true\") {\n verbose = true;\n return true;\n }\n Console.WriteLine(\"ERROR - Invalid verbose value {0} - should be false or true\", value);\n return false;\n }\n\n if (key == \"nthreads\") {\n try {\n numThreads = Convert.ToInt32(value);\n if (numThreads < 1) {\n Console.WriteLine(\"Number of threads must be at least 1, so can't be {0}\", numThreads);\n return false;\n }\n }\n catch (Exception e) {\n Console.WriteLine(\"Could not parse number of threads {0} as a number. Exception:\\n{1}\", value, e);\n return false;\n }\n return true;\n }\n\n if (key == \"duration\") {\n experimentDuration = Convert.ToUInt64(value);\n return true;\n }\n\n if (key == \"workload\") {\n if (value != \"g\" && value != \"s\" && value != \"f\") {\n Console.WriteLine(\"Workload must be 'g', 's', or 'f', but you specified {0}\", value);\n return false;\n }\n workload = value[0];\n return true;\n }\n\n if (key == \"numkeys\") {\n numKeys = Convert.ToInt32(value);\n if (numKeys < 1) {\n Console.WriteLine(\"Number of keys must be greater than zero, not {0}\", value);\n return false;\n }\n return true;\n }\n\n if (key == \"valuesize\") {\n valueSize = Convert.ToInt32(value);\n if (valueSize < 0 || valueSize >= 1024) {\n Console.WriteLine(\"Value size must be non-negative and less than 1024, but you specified {0}\", valueSize);\n return false;\n }\n return true;\n }\n\n Console.WriteLine(\"Invalid argument key {0}\", key);\n return false;\n }\n }\n}\n" }, { "path": "ironfleet/src/IronSHTClient/Program.cs", "content": "using IronfleetCommon;\r\nusing IronfleetIoFramework;\r\nusing System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Linq;\r\nusing System.Net;\r\nusing System.Numerics;\r\nusing System.Threading;\r\n\r\nnamespace IronSHTClient\r\n{\r\n class Program\r\n {\r\n static void usage()\r\n {\r\n Console.Write(@\"\r\nUsage: dotnet IronSHTClient.dll [key=value]...\r\n\r\n - file path of the service description\r\n\r\nAllowed keys:\r\n nthreads - number of experiment client threads to run, not\r\n counting the setup thread (default 1)\r\n duration - duration of experiment in seconds (default 60)\r\n workload - g for Gets, s for Sets, f for Sharding (default s)\r\n numkeys - number of keys (default 1000)\r\n valsize - number of bytes in each value (default 1024)\r\n verbose - print verbose output (false or true, default false)\r\n\");\r\n }\r\n\r\n static void Main(string[] args)\r\n {\r\n Params ps = new Params();\r\n\r\n foreach (var arg in args)\r\n {\r\n if (!ps.ProcessCommandLineArgument(arg)) {\r\n usage();\r\n return;\r\n }\r\n }\r\n\r\n var serviceIdentity = ServiceIdentity.ReadFromFile(ps.ServiceFileName);\r\n if (serviceIdentity == null) {\r\n return;\r\n }\r\n if (serviceIdentity.ServiceType != \"IronSHT\") {\r\n Console.Error.WriteLine(\"ERROR - Service described by {0} is of type {1}, not IronSHT\", ps.ServiceFileName,\r\n serviceIdentity.ServiceType);\r\n return;\r\n }\r\n\r\n HiResTimer.Initialize();\r\n if (ps.Verbose) {\r\n Console.WriteLine(\"Client process starting {0} threads running for {1} s...\", ps.NumThreads, ps.ExperimentDuration);\r\n }\r\n\r\n Console.WriteLine(\"[[READY]]\");\r\n\r\n // Setup the system\r\n var setupThreads = Client.StartSetupThreads(ps, serviceIdentity).ToArray();\r\n setupThreads[0].Join();\r\n Console.WriteLine(\"[[SETUP COMPLETE]]\");\r\n\r\n // Start the experiment\r\n var threads = Client.StartExperimentThreads(ps, serviceIdentity).ToArray();\r\n\r\n if (ps.ExperimentDuration == 0)\r\n {\r\n threads[0].Join();\r\n }\r\n else\r\n {\r\n Thread.Sleep((int)ps.ExperimentDuration * 1000);\r\n Console.Out.WriteLine(\"[[DONE]]\");\r\n Console.Out.Flush();\r\n Environment.Exit(0);\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironfleet/src/IronSHTServer/.gitignore", "content": ".vs\nProperties/\n" }, { "path": "ironfleet/src/IronSHTServer/IronSHTServer.csproj", "content": "\n\n \n Exe\n net6.0\n \n\n \n 1701;1702;162;164;168;183;219;436;1717;1718\n \n\n \n IronSHTServer.Program\n \n\n \n \n \n\n \n \n \n \n \n \n\n\n" }, { "path": "ironfleet/src/IronSHTServer/IronSHTServer.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.31005.135\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"IronSHTServer\", \"IronSHTServer.csproj\", \"{80249939-7D35-43CA-891A-F4C73EC6D959}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {3EDDD386-2BE8-48A4-8188-FFDA2034F16D}\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironfleet/src/IronSHTServer/Params.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.IO;\nusing System.Net;\nusing System.Text.RegularExpressions;\n\nnamespace IronSHTServer\n{\n public class Params\n {\n private string serviceFileName;\n private string privateKeyFileName;\n private string localHostNameOrAddress;\n private int localPort;\n private bool profile;\n private bool verbose;\n\n public Params()\n {\n serviceFileName = \"\";\n privateKeyFileName = \"\";\n localHostNameOrAddress = \"\";\n localPort = 0;\n profile = false;\n verbose = false;\n }\n\n public string ServiceFileName { get { return serviceFileName; } }\n public string PrivateKeyFileName { get { return privateKeyFileName; } }\n public string LocalHostNameOrAddress { get { return localHostNameOrAddress; } }\n public int LocalPort { get { return localPort; } }\n public bool Profile { get { return profile; } }\n public bool Verbose { get { return verbose; } }\n\n public bool Validate()\n {\n if (serviceFileName.Length == 0) {\n Console.WriteLine(\"ERROR - Missing service parameter\");\n return false;\n }\n if (privateKeyFileName.Length == 0) {\n Console.WriteLine(\"ERROR - Missing private parameter\");\n return false;\n }\n return true;\n }\n\n public bool ProcessCommandLineArgument(string arg)\n {\n var pos = arg.IndexOf(\"=\");\n if (pos < 0) {\n if (serviceFileName.Length == 0) {\n serviceFileName = arg;\n return true;\n }\n else if (privateKeyFileName.Length == 0) {\n privateKeyFileName = arg;\n return true;\n }\n else {\n Console.WriteLine(\"ERROR - Invalid argument {0}\", arg);\n return false;\n }\n }\n var key = arg.Substring(0, pos).ToLower();\n var value = arg.Substring(pos + 1);\n return SetValue(key, value);\n }\n\n private bool SetBoolValue(string key, string value, ref bool p)\n {\n if (value == \"false\") {\n p = false;\n return true;\n }\n else if (value == \"true\") {\n p = true;\n return true;\n }\n else {\n Console.WriteLine(\"ERROR - Invalid {0} value {1} - should be false or true\", key, value);\n return false;\n }\n }\n\n private bool SetValue(string key, string value)\n {\n if (key == \"addr\") {\n localHostNameOrAddress = value;\n return true;\n }\n\n if (key == \"port\") {\n try {\n localPort = Convert.ToInt32(value);\n return true;\n }\n catch (Exception e) {\n Console.WriteLine(\"ERROR - Could not convert port {0} to a number. Exception:\\n{1}\", value, e);\n return false;\n }\n }\n\n if (key == \"profile\") {\n return SetBoolValue(key, value, ref profile);\n }\n\n if (key == \"verbose\") {\n return SetBoolValue(key, value, ref verbose);\n }\n\n Console.WriteLine(\"ERROR - Invalid argument key {0}\", key);\n return false;\n }\n }\n}\n" }, { "path": "ironfleet/src/IronSHTServer/Program.cs", "content": "using IronfleetCommon;\nusing IronfleetIoFramework;\nusing MathNet.Numerics.Distributions;\nusing System;\nusing System.Linq;\nusing System.Numerics;\nusing System.Threading;\n\nnamespace IronSHTServer\n{\n class Program\n {\n static void usage()\n {\n Console.Write(@\"\nUsage: dotnet IronSHTServer.dll [key=value]...\n\n - file path of the service description\n - file path of the private key\n\nAllowed keys:\n addr - local host name or address to listen to (default:\n whatever's specified in the private key file)\n port - port to listen to (default: whatever's specified\n in the private key file)\n profile - print profiling info (false or true, default: false)\n verbose - use verbose output (false or true, default: false)\n\");\n }\n\n static void Main(string[] args)\n {\n Console.WriteLine(\"IronSHTServer program started\");\n\n Console.WriteLine(\"Processing command-line arguments\");\n\n Params ps = new Params();\n\n foreach (var arg in args)\n {\n if (!ps.ProcessCommandLineArgument(arg)) {\n usage();\n return;\n }\n }\n\n if (!ps.Validate()) {\n usage();\n return;\n }\n\n ServiceIdentity serviceIdentity = ServiceIdentity.ReadFromFile(ps.ServiceFileName);\n if (serviceIdentity == null) {\n return;\n }\n if (serviceIdentity.ServiceType != \"IronSHT\") {\n Console.Error.WriteLine(\"ERROR - Service described by {0} is of type {1}, not IronSHT\", ps.ServiceFileName,\n serviceIdentity.ServiceType);\n return;\n }\n\n PrivateIdentity privateIdentity = PrivateIdentity.ReadFromFile(ps.PrivateKeyFileName);\n if (privateIdentity == null) {\n return;\n }\n\n Native____Io__s_Compile.PrintParams.SetParameters(ps.Profile, i_shouldPrintProgress: false);\n\n var nc = Native____Io__s_Compile.NetClient.Create(privateIdentity, ps.LocalHostNameOrAddress, ps.LocalPort,\n serviceIdentity.Servers, ps.Verbose, serviceIdentity.UseSsl);\n Dafny.ISequence[] serverPublicKeys =\n serviceIdentity.Servers.Select(server => Dafny.Sequence.FromArray(nc.HashPublicKey(server.PublicKey))).ToArray();\n var ironArgs = Dafny.Sequence>.FromArray(serverPublicKeys);\n\n Profiler.Initialize();\n Native____Io__s_Compile.Time.Initialize();\n Console.WriteLine(\"IronFleet program started.\");\n Console.WriteLine(\"[[READY]]\");\n Main__i_Compile.__default.IronfleetMain(nc, ironArgs);\n Console.WriteLine(\"[[EXIT]]\");\n }\n }\n}\n" }, { "path": "ironfleet/src/IronfleetCommon/Networking.cs", "content": "using System;\nusing System.IO;\nusing System.Net;\n\nnamespace IronfleetCommon\n{\n public class Networking\n {\n public static IPEndPoint ResolveIPEndpoint(string s)\n {\n try {\n return System.Net.IPEndPoint.Parse(s);\n }\n catch (FormatException) {\n }\n \n var pos = s.IndexOf(\":\");\n if (pos < 0)\n {\n Console.WriteLine(\"Invalid endpoint descriptor {0} (no colon found)\", s);\n return null;\n }\n\n string host = s.Substring(0, pos);\n int port = Convert.ToInt32(s.Substring(pos + 1));\n\n IPAddress[] addresses;\n try {\n addresses = Dns.GetHostEntry(host).AddressList;\n }\n catch (Exception e) {\n Console.WriteLine(\"Could not resolve host name {0} in server endpoint descriptor {1}, leading to exception:\\n{2}\", host, s, e);\n return null;\n }\n\n foreach (var addr in addresses)\n {\n if (addr.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork)\n {\n return new IPEndPoint(addr, port);\n }\n }\n\n Console.WriteLine(\"Could not resolve host name {0} in server endpoint descriptor {1}\", host, s);\n return null;\n }\n }\n}\n" }, { "path": "ironfleet/src/IronfleetCommon/Profiler.cs", "content": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\nusing System.Linq;\r\nusing System.Text;\r\nusing System.Threading.Tasks;\r\nusing MathNet.Numerics.Distributions;\r\n\r\nnamespace IronfleetCommon\r\n{\r\n public class Aggregator\r\n {\r\n private string name;\r\n private bool times;\r\n private long total;\r\n private int count;\r\n private double sumsq;\r\n\r\n public static void Initialize()\r\n {\r\n }\r\n\r\n public Aggregator(string i_name, bool i_times)\r\n {\r\n name = i_name;\r\n times = i_times;\r\n total = 0;\r\n count = 0;\r\n sumsq = 0;\r\n }\r\n\r\n public void AddValue(long value)\r\n {\r\n //if (CommonParams.printValues)\r\n //{\r\n // Console.WriteLine(\"{0}\\t{1}\", name, value * 1.0 / Stopwatch.Frequency);\r\n //}\r\n\r\n total += value;\r\n count++;\r\n sumsq += (value * 1.0 * value);\r\n }\r\n\r\n public void AddTime(Stopwatch s)\r\n {\r\n AddValue(s.ElapsedTicks);\r\n }\r\n\r\n public override string ToString()\r\n {\r\n if (count < 1) { return name + \": \"; }\r\n\r\n if (times)\r\n {\r\n double total_sec = total * 1.0 / Stopwatch.Frequency;\r\n if (count == 1) { return name + \": \" + total_sec.ToString(); }\r\n double average_sec = total_sec / count;\r\n double sumsq_sec = sumsq / Stopwatch.Frequency / Stopwatch.Frequency;\r\n double variance = (sumsq_sec - total_sec * total_sec / count) / (count - 1);\r\n double stdev = Math.Sqrt(variance);\r\n double conf95 = StudentT.InvCDF(0, stdev, count-1, 0.975) / Math.Sqrt(count);\r\n return string.Format(\"Aggregate {0}: avg_usec {1} conf95plusorminus {2} stdev {3} count {4} sum {5}\", name, average_sec * Math.Pow(10, 6), conf95 * Math.Pow(10, 6), stdev * Math.Pow(10, 6), count, total_sec * Math.Pow(10, 6));\r\n }\r\n else\r\n {\r\n if (count == 1) { return total.ToString(); }\r\n double average = total * 1.0 / count;\r\n double variance = (sumsq - (total * 1.0 * total) / count) / (count - 1);\r\n double stdev = Math.Sqrt(variance);\r\n double conf95 = StudentT.InvCDF(0, stdev, count - 1, 0.975) / Math.Sqrt(count);\r\n return string.Format(\"Aggregate {0}: avg_usec {1} conf95plusorminus {2} stdev {3} count {4} sum {5}\", name, average * Math.Pow(10, 6), conf95 * Math.Pow(10, 6), stdev * Math.Pow(10, 6), count, total * Math.Pow(10, 6));\r\n }\r\n }\r\n }\r\n\r\n public class Profiler\r\n {\r\n static Dictionary aggregators;\r\n static int count;\r\n static int ignore_count = 10000; // Ignore the first ignore_count events to try to stabilize measurements\r\n static int print_period = 1000000;\r\n static bool record;\r\n\r\n public static void Initialize()\r\n {\r\n aggregators = new Dictionary();\r\n Aggregator.Initialize();\r\n count = 0;\r\n record = false;\r\n }\r\n\r\n public static void Record(string name, long value)\r\n {\r\n if (record) {\r\n if (!aggregators.ContainsKey(name)) {\r\n aggregators[name] = new Aggregator(name, true);\r\n }\r\n\r\n aggregators[name].AddValue(value);\r\n }\r\n\r\n count++;\r\n if (count > ignore_count) {\r\n record = true;\r\n }\r\n if (count % print_period == 0) {\r\n Print();\r\n }\r\n } \r\n\r\n public static void Print()\r\n {\r\n Console.WriteLine(\"Profiler statistics\");\r\n foreach (KeyValuePair entry in aggregators)\r\n {\r\n Console.WriteLine(entry.Value.ToString());\r\n }\r\n }\r\n }\r\n}\r\n" }, { "path": "ironfleet/src/IronfleetCommon/Timer.cs", "content": "using System;\nusing System.Diagnostics;\n\nnamespace IronfleetCommon\n{\n public class HiResTimer\n {\n private static Stopwatch _stopWatch = null;\n\n public static long Ticks\n {\n get\n {\n return _stopWatch.ElapsedTicks;\n }\n }\n public static void Initialize()\n {\n _stopWatch = Stopwatch.StartNew();\n }\n\n public static double TicksToMilliseconds(long ticks)\n {\n return ticks * 1000.0 / Stopwatch.Frequency;\n }\n }\n}\n" }, { "path": "ironfleet/src/RedisClient/.gitignore", "content": "/packages/\n*.suo\n" }, { "path": "ironfleet/src/RedisClient/IronfleetShtClient/App.config", "content": "\n\n \n \n \n" }, { "path": "ironfleet/src/RedisClient/IronfleetShtClient/Experiment.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text;\nusing System.Threading.Tasks;\n\nnamespace IronfleetShtClient\n{\n using System.Diagnostics;\n using System.IO;\n using System.Security.Cryptography;\n using System.Threading;\n\n public abstract class Experiment\n {\n private readonly long durationMs;\n\n private readonly long durationTicks;\n\n private TextWriter textWriter;\n\n private readonly Thread[] threads;\n\n private KeyValueStoreClient[] clients;\n\n private readonly Barrier startBarrier;\n\n private Func connect; \n\n\n protected Experiment(Func connect, int clientCount, long durationMs, TextWriter textWriter)\n {\n if (null == connect)\n {\n throw new ArgumentNullException(\"connect\");\n }\n\n if (clientCount < 1)\n {\n throw new ArgumentOutOfRangeException(\"clientCount is less than 1.\");\n }\n\n if (durationMs < 1)\n {\n throw new ArgumentOutOfRangeException(\"duration is less than 1 millisecond.\");\n }\n\n this.connect = connect;\n this.durationMs = durationMs;\n this.durationTicks = TimeSpan.FromMilliseconds(durationMs).Ticks;\n this.textWriter = textWriter ?? Console.Out;\n this.startBarrier = new Barrier(clientCount + 1);\n this.threads = new Thread[clientCount];\n this.clients = new KeyValueStoreClient[clientCount];\n }\n\n public void Perform(Random rng)\n {\n Debug.Assert(this.textWriter != null, \"the text writer reference cannot be null.\");\n Console.Out.WriteLine(\"Starting {0} threads...\", this.threads.Length);\n\n for (var i = 0; i < this.threads.Length; ++i)\n {\n var thread = new Thread(ThreadMain);\n this.threads[i] = thread;\n this.clients[i] = this.connect();\n thread.Start(Tuple.Create(i, rng.Next()));\n }\n\n Console.Out.WriteLine(\"Waiting for connections to complete...\");\n this.startBarrier.SignalAndWait();\n\n Console.Out.WriteLine(\"Test started. Waiting for completion...\");\n foreach (var t in this.threads)\n {\n t.Join();\n }\n Console.Out.WriteLine(\"Test completed.\");\n }\n\n protected abstract void OnRequest(ulong reqNum, KeyValueStoreClient client, Random random);\n\n static protected ulong TicksToMilliseconds(long ticks)\n {\n return (ulong)(ticks * 1.0 / Stopwatch.Frequency * 1000);\n }\n\n private void ThreadMain(object obj)\n {\n var args = (Tuple)obj;\n int clientId = args.Item1;\n var random = new Random(args.Item2);\n var client = this.clients[clientId];\n var stopwatch = new Stopwatch();\n\n this.startBarrier.SignalAndWait();\n stopwatch.Start();\n\n ulong reqNum = 0;\n while (stopwatch.ElapsedTicks < this.durationTicks)\n {\n var t0 = stopwatch.ElapsedTicks;\n this.OnRequest(reqNum, client, random);\n var t1 = stopwatch.ElapsedTicks;\n var tMs0 = TicksToMilliseconds(t0);\n var tMs1 = TicksToMilliseconds(t1);\n lock (this.textWriter)\n {\n this.textWriter.WriteLine(\"#req{0} {1} {2} {3}\", reqNum, tMs0, tMs1, clientId);\n }\n ++reqNum;\n }\n }\n }\n}\n" }, { "path": "ironfleet/src/RedisClient/IronfleetShtClient/IVocabularyModule.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text;\nusing System.Threading.Tasks;\n\nnamespace IronfleetShtClient\n{\n using System.Diagnostics;\n using System.Threading;\n\n public interface IVocabularyModule\n {\n byte[] Pick(Random rng);\n }\n\n public static class VocabularyModuleExtensions\n {\n public static IEnumerable Series(this IVocabularyModule self, Random rng)\n {\n Debug.Assert(self != null, \"self is expected to be non-null\");\n\n while (true)\n {\n yield return self.Pick(rng);\n }\n }\n \n }\n}\n" }, { "path": "ironfleet/src/RedisClient/IronfleetShtClient/IronfleetShtClient.csproj", "content": "\n\n \n \n Debug\n AnyCPU\n {6257F848-DAFB-443B-90CA-234691ED86DD}\n Exe\n Properties\n IronfleetShtClient\n IronfleetShtClient\n v4.5.1\n 512\n true\n 0\n \n \n AnyCPU\n true\n full\n false\n bin\\Debug\\\n DEBUG;TRACE\n prompt\n 4\n False\n False\n True\n False\n False\n False\n True\n True\n True\n True\n True\n True\n True\n True\n False\n True\n False\n True\n False\n False\n False\n False\n True\n False\n True\n True\n True\n False\n False\n \n \n \n \n \n \n \n True\n False\n False\n True\n Full\n %28none%29\n 0\n \n \n AnyCPU\n pdbonly\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n ..\\packages\\StackExchange.Redis.1.0.481\\lib\\net45\\StackExchange.Redis.dll\n True\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n" }, { "path": "ironfleet/src/RedisClient/IronfleetShtClient/KeyValueStoreClient.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text;\nusing System.Threading.Tasks;\n\nnamespace IronfleetShtClient\n{\n using System.Net;\n using System.Runtime.Remoting.Messaging;\n\n public abstract class KeyValueStoreClient\n {\n public IPEndPoint ServerEndPoint { get; private set; }\n\n public KeyValueStoreClient(IPEndPoint endPoint)\n {\n this.ServerEndPoint = endPoint;\n }\n\n public abstract byte[] GetValue(byte[] key);\n\n public abstract void SetValue(byte[] key, byte[] value);\n }\n}\n" }, { "path": "ironfleet/src/RedisClient/IronfleetShtClient/Program.cs", "content": "\n\nnamespace IronfleetShtClient\n{\n using System;\n using System.Collections.Generic;\n using System.Diagnostics;\n using System.IO;\n using System.Linq;\n using System.Net;\n using System.Text;\n using System.Threading.Tasks;\n using StackExchange.Redis;\n\n public class Program\n {\n private static int Usage(int errorCode)\n {\n var console = 0 == errorCode ? Console.Out : Console.Error;\n console.WriteLine(\"usage: [SERVICE_TYPE] [SERVICE_IP] [SERVICE_PORT] [THREAD_COUNT] [DURATION_SECS]\");\n return errorCode;\n }\n\n public static int Main(string[] args)\n {\n IPEndPoint serviceEndpoint;\n int threadCount;\n long experimentDuration;\n int valueBytes;\n\n if (args.Length != 6)\n {\n Console.Error.WriteLine(\"incorrect number of arguments ({0})\", args.Length);\n return Usage(-1);\n }\n\n if (args[0].Trim().ToLowerInvariant() != \"redis\")\n {\n Console.Error.WriteLine(\"only 'redis' type is currently supported ('{0}' requested)\", args[0].Trim());\n return Usage(-1);\n }\n\n try\n {\n serviceEndpoint = new IPEndPoint(IPAddress.Parse(args[1]), Convert.ToInt32(args[2]));\n threadCount = Convert.ToInt32(args[3]);\n experimentDuration = Convert.ToInt64(args[4]) * 1000;\n valueBytes = Convert.ToInt32(args[5]);\n }\n catch (Exception e)\n {\n Console.Error.WriteLine(\"Command line exception: \" + e);\n return Usage(-2);\n }\n\n Console.Out.WriteLine(\"serviceEndpoint: {0}\", serviceEndpoint);\n Console.Out.WriteLine(\"threadCount: {0}\", threadCount);\n Console.Out.WriteLine(\"experimentDuration: {0} ms\", experimentDuration);\n Console.Out.WriteLine(\"valueBytes: {0}\", valueBytes);\n\n // Create a directory for logging all of our output\n string guid = Guid.NewGuid().ToString();\n string outputDirectory = String.Format(\"{0}\\\\IronfleetOutput\\\\Job-{1}\", Environment.GetEnvironmentVariable(\"TMP\"), guid);\n Directory.CreateDirectory(outputDirectory);\n\n // Create the log file itself\n var log = new FileStream(outputDirectory + \"\\\\client.txt\", FileMode.Create);\n var logStream = new StreamWriter(log);\n var rng = new Random();\n\n Func connect = () => RedisClient.Connect(serviceEndpoint);\n var dog = new StrawDog(connect, threadCount, experimentDuration, valueBytes, rng, logStream);\n\n Console.Out.WriteLine(\"[[READY]]\");\n Console.Out.WriteLine(\"ClientGUID {0}\", guid);\n \n dog.Perform(rng);\n\n Console.Out.WriteLine(\"[[DONE]]\");\n Console.Out.Flush();\n logStream.Flush();\n\n return 0;\n }\n }\n}\n" }, { "path": "ironfleet/src/RedisClient/IronfleetShtClient/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\nusing System.Runtime.CompilerServices;\nusing System.Runtime.InteropServices;\n\n// General Information about an assembly is controlled through the following \n// set of attributes. Change these attribute values to modify the information\n// associated with an assembly.\n[assembly: AssemblyTitle(\"IronfleetShtClient\")]\n[assembly: AssemblyDescription(\"\")]\n[assembly: AssemblyConfiguration(\"\")]\n[assembly: AssemblyCompany(\"\")]\n[assembly: AssemblyProduct(\"IronfleetShtClient\")]\n[assembly: AssemblyCopyright(\"Copyright © 2015\")]\n[assembly: AssemblyTrademark(\"\")]\n[assembly: AssemblyCulture(\"\")]\n\n// Setting ComVisible to false makes the types in this assembly not visible \n// to COM components. If you need to access a type in this assembly from \n// COM, set the ComVisible attribute to true on that type.\n[assembly: ComVisible(false)]\n\n// The following GUID is for the ID of the typelib if this project is exposed to COM\n[assembly: Guid(\"63f06234-d726-4dbc-805e-b5271c8e1218\")]\n\n// Version information for an assembly consists of the following four values:\n//\n// Major Version\n// Minor Version \n// Build Number\n// Revision\n//\n// You can specify all the values or you can default the Build and Revision Numbers \n// by using the '*' as shown below:\n// [assembly: AssemblyVersion(\"1.0.*\")]\n[assembly: AssemblyVersion(\"1.0.0.0\")]\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\n" }, { "path": "ironfleet/src/RedisClient/IronfleetShtClient/RedisClient.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text;\nusing System.Threading.Tasks;\n\nnamespace IronfleetShtClient\n{\n using System.Diagnostics;\n using System.Net;\n\n using StackExchange.Redis;\n\n class RedisClient : KeyValueStoreClient\n {\n private ConnectionMultiplexer redis;\n\n private IDatabase db;\n\n private RedisClient(IPEndPoint endPoint, ConnectionMultiplexer redis)\n : base(endPoint)\n {\n if (null == redis)\n {\n throw new ArgumentNullException(\"redis\");\n }\n\n this.redis = redis;\n this.db = redis.GetDatabase();\n }\n\n static public RedisClient Connect(IPEndPoint endPoint)\n {\n var config = new ConfigurationOptions { EndPoints = { endPoint }, WriteBuffer = 0, Ssl = false, ResolveDns = false };\n var redis = ConnectionMultiplexer.Connect(config/*, Console.Error*/);\n return new RedisClient(endPoint, redis);\n }\n\n public override byte[] GetValue(byte[] key)\n {\n Debug.Assert(this.db != null, \"the database reference cannot be null.\");\n return this.db.StringGet(key);\n }\n\n public override void SetValue(byte[] key, byte[] value)\n {\n Debug.Assert(this.db != null, \"the database reference cannot be null.\");\n this.db.StringSet(key, value);\n }\n }\n}\n" }, { "path": "ironfleet/src/RedisClient/IronfleetShtClient/StrawDog.cs", "content": "namespace IronfleetShtClient\n{\n using System;\n using System.Collections.Generic;\n using System.Diagnostics;\n using System.IO;\n using System.Linq;\n using System.Text;\n using System.Threading.Tasks;\n\n public class StrawDog : Experiment\n {\n private readonly Vocabulary keys;\n private readonly Vocabulary values;\n\n public StrawDog(Func connect, int clientCount, long durationMs, int valueBytes, Random rng, TextWriter textWriter) :\n base(connect, clientCount, durationMs, textWriter)\n {\n if (0 >= valueBytes)\n {\n throw new ArgumentOutOfRangeException(\"valueBytes\");\n }\n\n Console.Out.WriteLine(\"Generating test data...\");\n // set up pools of random byte strings for experiment.\n this.keys = new Vocabulary(rng, new Dictionary { { 8 /*bytes*/, 1000/*entries*/ } });\n this.values = new Vocabulary(rng, new Dictionary { { valueBytes, 1000 } });\n }\n\n protected override void OnRequest(ulong reqNum, KeyValueStoreClient client, Random rng)\n {\n Debug.Assert(client != null, \"client is expected to be non-null\");\n Debug.Assert(rng != null, \"random is expected to be non-null\");\n Debug.Assert(this.keys != null, \"key vocabulary is expected to be non-null\");\n Debug.Assert(this.values != null, \"value vocabulary is expected to be non-null\");\n\n var key = this.keys.Pick(rng);\n /*if ((reqNum & 1) == 0)\n {\n var value = this.values.Pick(rng);\n client.SetValue(key, value); \n }\n else*/\n {\n client.GetValue(key); \n }\n }\n }\n}\n" }, { "path": "ironfleet/src/RedisClient/IronfleetShtClient/Vocabulary.cs", "content": "\nnamespace IronfleetShtClient\n{\n using System;\n using System.CodeDom.Compiler;\n using System.Collections.Generic;\n using System.Linq;\n using System.Diagnostics;\n\n public class Vocabulary : IVocabularyModule\n {\n private readonly Dictionary specs;\n private readonly ModuleMux mux;\n\n private class ModuleMux : IVocabularyModule\n {\n private readonly IVocabularyModule[] sources;\n\n public ModuleMux(IEnumerable sources)\n {\n\n if (null == sources)\n {\n throw new ArgumentNullException(\"sources\");\n }\n\n this.sources = sources.ToArray();\n if (this.sources.Length == 0)\n {\n throw new ArgumentOutOfRangeException(\"sources\", \"sources is empty.\");\n }\n\n if (this.sources.Contains(null))\n {\n throw new ArgumentException(\"source list contains a null\", \"sources\");\n }\n }\n\n public byte[] Pick(Random rng)\n {\n Debug.Assert(rng != null, \"expect constructed object\");\n Debug.Assert(this.sources != null, \"expect constructed object\");\n\n var i = rng.Next(this.sources.Length);\n Debug.Assert(this.sources[i] != null, \"expect non-null object\");\n return this.sources[i].Pick(rng);\n }\n }\n\n private class Page : IVocabularyModule\n {\n private readonly int entryLength = 0;\n private readonly int entryCount = 0;\n private readonly List entries;\n\n public Page(Random rng, int entryLength, int entryCount)\n {\n this.entryLength = entryLength;\n this.entryCount = entryCount;\n this.entries = Generate(rng, entryLength, entryCount);\n }\n\n private static List Generate(Random rng, int entryLength, int entryCount)\n {\n if (rng == null)\n {\n throw new ArgumentNullException(\"rng\");\n }\n\n if (entryLength < 1)\n {\n throw new ArgumentOutOfRangeException(\"entryLength\", \"is smaller than 1\");\n }\n\n if (entryCount < 1)\n {\n throw new ArgumentOutOfRangeException(\"entryCount\", \"is smaller than 1\");\n }\n\n var entries = new List(entryCount);\n for (var i = 0; i < entryCount; ++i)\n {\n byte[] entry = null;\n do\n {\n entry = new byte[entryLength];\n rng.NextBytes(entry);\n }\n while (entries.Contains(entry));\n entries.Add(entry);\n }\n\n return entries;\n }\n\n public byte[] Pick(Random rng)\n {\n Debug.Assert(rng != null, \"expect constructed object\");\n Debug.Assert(this.entries != null, \"expect constructed object\");\n\n var i = rng.Next(this.entries.Count);\n return this.entries[i];\n }\n }\n\n public Vocabulary(Random rng, Dictionary specs)\n {\n this.specs = specs;\n this.mux = Generate(rng, specs);\n }\n\n private static ModuleMux Generate(Random rng, Dictionary specs)\n {\n if (rng == null)\n {\n throw new ArgumentNullException(\"rng\");\n }\n\n if (null == specs)\n {\n throw new ArgumentNullException(\"specs\");\n }\n\n if (specs.Count == 0)\n {\n throw new ArgumentException(\"vocabulary specification is empty\", \"specs\");\n }\n\n var pages = new List();\n foreach (var i in specs)\n {\n pages.Add(new Page(rng, i.Key, i.Value));\n }\n\n return new ModuleMux(pages);\n }\n\n public byte[] Pick(Random rng)\n {\n Debug.Assert(this.mux != null, \"expect constructed and initialized object\");\n\n return this.mux.Pick(rng);\n }\n }\n}\n" }, { "path": "ironfleet/src/RedisClient/IronfleetShtClient/packages.config", "content": "\n\n \n" }, { "path": "ironfleet/src/RedisClient/IronfleetShtClient.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio 2013\nVisualStudioVersion = 12.0.40629.0\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"IronfleetShtClient\", \"IronfleetShtClient\\IronfleetShtClient.csproj\", \"{6257F848-DAFB-443B-90CA-234691ED86DD}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{6257F848-DAFB-443B-90CA-234691ED86DD}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{6257F848-DAFB-443B-90CA-234691ED86DD}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{6257F848-DAFB-443B-90CA-234691ED86DD}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{6257F848-DAFB-443B-90CA-234691ED86DD}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironfleet/src/TestIoFramework/.gitignore", "content": ".vs\nProperties/\n" }, { "path": "ironfleet/src/TestIoFramework/Params.cs", "content": "using System;\nusing System.Collections.Generic;\nusing System.IO;\nusing System.Net;\nusing System.Text.RegularExpressions;\n\nnamespace TestIoFramework\n{\n public class Params\n {\n private string serviceFileName;\n private string privateKeyFileName;\n private string localHostNameOrAddress;\n private int localPort;\n private bool verbose;\n\n public Params()\n {\n serviceFileName = \"\";\n privateKeyFileName = \"\";\n localHostNameOrAddress = \"\";\n localPort = 0;\n }\n\n public string ServiceFileName { get { return serviceFileName; } }\n public string PrivateKeyFileName { get { return privateKeyFileName; } }\n public string LocalHostNameOrAddress { get { return localHostNameOrAddress; } }\n public int LocalPort { get { return localPort; } }\n public bool Verbose { get { return verbose; } }\n\n public bool Validate()\n {\n if (serviceFileName.Length == 0) {\n Console.WriteLine(\"ERROR - Missing service parameter\");\n return false;\n }\n if (privateKeyFileName.Length == 0) {\n Console.WriteLine(\"ERROR - Missing private parameter\");\n return false;\n }\n return true;\n }\n\n public bool ProcessCommandLineArgument(string arg)\n {\n var pos = arg.IndexOf(\"=\");\n if (pos < 0) {\n if (serviceFileName.Length == 0) {\n serviceFileName = arg;\n return true;\n }\n else if (privateKeyFileName.Length == 0) {\n privateKeyFileName = arg;\n return true;\n }\n else {\n Console.WriteLine(\"ERROR - Invalid argument {0}\", arg);\n return false;\n }\n }\n var key = arg.Substring(0, pos).ToLower();\n var value = arg.Substring(pos + 1);\n return SetValue(key, value);\n }\n\n private bool SetValue(string key, string value)\n {\n if (key == \"addr\") {\n localHostNameOrAddress = value;\n return true;\n }\n\n if (key == \"port\") {\n try {\n localPort = Convert.ToInt32(value);\n return true;\n }\n catch (Exception e) {\n Console.WriteLine(\"ERROR - Could not convert port {0} to a number. Exception:\\n{1}\", value, e);\n return false;\n }\n }\n\n if (key == \"verbose\") {\n if (value == \"false\") {\n verbose = false;\n return true;\n }\n if (value == \"true\") {\n verbose = true;\n return true;\n }\n Console.WriteLine(\"ERROR - Invalid verbose value {0} - should be false or true\", value);\n return false;\n }\n\n Console.WriteLine(\"ERROR - Invalid argument key {0}\", key);\n return false;\n }\n }\n}\n" }, { "path": "ironfleet/src/TestIoFramework/Program.cs", "content": "using IronfleetIoFramework;\nusing System;\nusing System.Collections.Generic;\nusing System.IO;\nusing System.Linq;\nusing System.Net;\nusing System.Numerics;\nusing System.Text;\nusing System.Text.Json;\nusing System.Threading;\n\nnamespace TestIoFramework\n{\n class Runner\n {\n private ServiceIdentity serviceIdentity;\n private PrivateIdentity privateIdentity;\n private IoScheduler scheduler;\n\n public Runner(ServiceIdentity i_serviceIdentity, PrivateIdentity i_privateIdentity, Params ps)\n {\n serviceIdentity = i_serviceIdentity;\n privateIdentity = i_privateIdentity;\n scheduler = IoScheduler.CreateServer(privateIdentity, ps.LocalHostNameOrAddress, ps.LocalPort,\n serviceIdentity.Servers, ps.Verbose, serviceIdentity.UseSsl);\n }\n\n public void Run()\n {\n Console.WriteLine(\"Starting on {0}\",\n IoScheduler.PublicKeyToString(IoScheduler.GetCertificatePublicKey(scheduler.MyCert)));\n Thread t = new Thread(this.SenderThread);\n t.Start();\n this.ReceiverThread();\n }\n\n private void SenderThread()\n {\n Random rng = new Random();\n while (true) {\n int serverIndex = rng.Next(serviceIdentity.Servers.Count);\n PublicIdentity serverIdentity = serviceIdentity.Servers[serverIndex];\n byte[] serverPublicKey = serverIdentity.PublicKey;\n byte[] serverPublicKeyHash = scheduler.HashPublicKey(serverPublicKey);\n\n int randomNumber = rng.Next(10000);\n string message = string.Format(\"Hello {0}\", randomNumber);\n byte[] messageBytes = Encoding.UTF8.GetBytes(message);\n\n Console.WriteLine(\"Sending message {0} to {1}\", message,\n scheduler.LookupPublicKeyHashAsString(serverPublicKeyHash));\n \n scheduler.SendPacket(serverPublicKeyHash, messageBytes);\n Thread.Sleep(1000);\n }\n }\n\n private void ReceiverThread()\n {\n while (true) {\n bool ok;\n bool timedOut;\n byte[] remotePublicKeyHash;\n byte[] messageBytes;\n scheduler.ReceivePacket(0, out ok, out timedOut, out remotePublicKeyHash, out messageBytes);\n if (!ok) {\n Console.WriteLine(\"Not OK, so terminating receiver thread\");\n return;\n }\n if (timedOut) {\n Thread.Sleep(100);\n continue;\n }\n string message = Encoding.UTF8.GetString(messageBytes);\n Console.WriteLine(\"Received message {0} from {1}\", message,\n scheduler.LookupPublicKeyHashAsString(remotePublicKeyHash));\n }\n }\n }\n \n class Program\n {\n static void usage()\n {\n Console.Write(@\"\nUsage: dotnet TestIoFramework.dll [key=value]...\n\n - file path of the service description\n - file path of the private key\n\nAllowed keys:\n addr - local host name or address to listen to (default:\n whatever's specified in the private key file)\n port - port to listen to (default: whatever's specified\n in the private key file)\n verbose - use verbose output (default: false)\n\");\n }\n\n static void Main(string[] args)\n {\n Params ps = new Params();\n\n foreach (var arg in args)\n {\n if (!ps.ProcessCommandLineArgument(arg)) {\n usage();\n return;\n }\n }\n\n if (!ps.Validate()) {\n return;\n }\n\n ServiceIdentity serviceIdentity = ServiceIdentity.ReadFromFile(ps.ServiceFileName);\n if (serviceIdentity == null) {\n return;\n }\n\n PrivateIdentity privateIdentity = PrivateIdentity.ReadFromFile(ps.PrivateKeyFileName);\n if (privateIdentity == null) {\n return;\n }\n\n var runner = new Runner(serviceIdentity, privateIdentity, ps);\n runner.Run();\n }\n }\n}\n" }, { "path": "ironfleet/src/TestIoFramework/TestIoFramework.csproj", "content": "\n\n \n Exe\n net6.0\n \n\n \n 1701;1702;162;164;168;183;219;436;1717;1718\n \n\n \n TestIoFramework.Program\n \n\n \n \n \n\n \n \n \n\n\n" }, { "path": "ironfleet/src/TestIoFramework/TestIoFramework.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.31005.135\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"TestIoFramework\", \"TestIoFramework.csproj\", \"{80249939-7D35-43CA-891A-F4C73EC6D959}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{80249939-7D35-43CA-891A-F4C73EC6D959}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {3EDDD386-2BE8-48A4-8188-FFDA2034F16D}\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironfleet/tools/DepGraph/parse.py", "content": "#!/usr/bin/python\n\nimport re, sys, os.path, getopt \nfrom subprocess import call\n\ndef main(argv):\n maxDepth = 1\n parsed_files = []\t\n arg_len = len(sys.argv)\n if arg_len < 2:\n print \"usage: parse.py []\"\n sys.exit(2)\n \n arg1 = sys.argv[1]\n if arg_len >= 3:\n maxDepth = int(sys.argv[2])\n else:\n maxDepth = 10000\n\n thisfile = sys.argv[0]\n actualArg1 = os.path.realpath(arg1)\n currentPath = os.path.dirname(os.path.realpath(thisfile))\n srcPath = os.path.realpath(currentPath + \"/../../src\")\n #print \"maxDepth = \", maxDepth\n with open(currentPath + \"/out.dot\", \"w\") as fw:\n fw.write(\"digraph G {\\n\")\n parseFile(actualArg1, srcPath, fw, parsed_files, 1, maxDepth)\n fw.write(\"}\\n\")\n \n wincurrentpath = currentPath.replace(\"/cygdrive/c\",\"C:\\\\\")\n call([\"dot\", \"-Tpdf\", wincurrentpath + \"/out.dot\", \"-o\", wincurrentpath + \"/output.pdf\"])\n call([\"cygstart.exe\", currentPath + \"/output.pdf\"])\n\ndef parseFile(filename, srcPath, fw, parsed_files, depth, maxDepth):\n if filename in parsed_files:\n return \n if depth > maxDepth:\n return\n\n parsed_files.append(filename)\n #print \"Parsing file %s at depth %d, with maxDepth %d\" % (filename, depth, maxDepth)\n f = open(filename, \"r\")\n \n for line in f:\n newfile = parseline(filename,line, srcPath, fw)\n if newfile:\n #print \"found included file: \" + newfile\n parseFile(newfile, srcPath, fw, parsed_files,depth+1,maxDepth)\n f.close()\n\ndef parseline(filename,line, srcPath, fw):\n # print \"Parsing line %s\" % line\n matchObj = re.match(\"^include \", line)\n if matchObj:\n index = line.index(\"\\\"\")\n # print \"index =\", index, \n secondindex = line.index(\"\\\"\", index+1)\n # print \"secondindex =\", secondindex, \n substr = line[index+1:secondindex]\n\tnewPath = os.path.dirname(os.path.realpath(os.path.dirname(filename) + \"/\" + substr))\n\tnewFilename = os.path.basename(substr)\n actualFile = newPath + \"/\" +newFilename \n\tif not re.match(\"^\"+srcPath,actualFile):\n print \"invalid file prefix\"\n sys.exit(2)\n\tif re.search(\"\\.s\\.dfy$\",newFilename):\n nodeshape = \"\\\"\" + normalizeFilename(actualFile,srcPath) + \"\\\" [shape=box, style=filled, fillcolor=lightblue]\\n\"\n\t fw.write(nodeshape)\n\tif re.search(\"\\.s\\.dfy$\",filename):\n nodeshape = \"\\\"\" + normalizeFilename(filename,srcPath) + \"\\\" [shape=box, style=filled, fillcolor=lightblue]\\n\"\n\t fw.write(nodeshape)\n outline = \"\\\"\" + normalizeFilename(filename,srcPath) + \"\\\" -> \\\"\" + normalizeFilename(actualFile,srcPath) + \"\\\"\\n\"\n fw.write(outline)\n return actualFile\n\ndef normalizeFilename(filename,srcPath):\n return filename[len(srcPath)+1:]\n\n\nif __name__ == \"__main__\":\n main(sys.argv)\n" }, { "path": "ironfleet/tools/scripts/.gitignore", "content": "*.pyc\r\n*.obj\r\n" }, { "path": "ironfleet/tools/scripts/build-summary.py", "content": "#!/usr/bin/python\r\n\r\nimport tarfile\r\nimport re\r\nimport sys\r\nimport subprocess\r\nfrom OutputFormatting import *\r\n\r\ntime_re = re.compile(\"real (\\d*)m([\\d.]*)s user\")\r\ndisposition_parse_error_re = re.compile(\"Error opening file\")\r\ndisposition_parse_error2_re = re.compile(\"(\\d*) parse errors detected in\")\r\ndisposition_timeouts_re = re.compile(\"Dafny program verifier finished with (\\d*) verified, (\\d*) errors*, (\\d) time outs*\")\r\ndisposition_notimeouts_re = re.compile(\"Dafny program verifier finished with (\\d*) verified, (\\d*) errors*\")\r\ndisposition_proverdied_re = re.compile(\"Prover error: Prover died\")\r\n\r\ndef extract_time(s):\r\n\tmo = time_re.search(s)\r\n\tif (mo==None):\r\n\t\treturn None\r\n\telse:\r\n\t\t(min,sec) = mo.groups(0)\r\n\t\treturn int(min)*60+float(sec)\r\n\r\nclass Disposition:\r\n\tdef __init__(self, s):\r\n\t\tself.parse_failures = 0\r\n\t\tself.verification_errors = 0\r\n\t\tself.timeouts = 0\r\n\t\tself.succeeding_methods = 0\r\n\r\n\t\tmo = disposition_timeouts_re.search(s)\r\n\t\tif (mo!=None):\r\n\t\t\t(succeeding_methods_s,verification_errors_s,timeouts_s) = mo.groups(0)\r\n\t\t\tself.succeeding_methods = int(succeeding_methods_s)\r\n\t\t\tself.verification_errors = int(verification_errors_s)\r\n\t\t\tself.timeouts = int(timeouts_s)\r\n\t\t\treturn\r\n\t\tmo = disposition_notimeouts_re.search(s)\r\n\t\tif (mo!=None):\r\n\t\t\t(succeeding_methods_s,verification_errors_s) = mo.groups(0)\r\n\t\t\tself.succeeding_methods = int(succeeding_methods_s)\r\n\t\t\tself.verification_errors = int(verification_errors_s)\r\n\t\t\treturn\r\n\t\tmo = disposition_parse_error_re.search(s)\r\n\t\tif (mo!=None):\r\n\t\t\tself.parse_failures = 1\r\n\t\t\t# not really a count, just a flag.\r\n\t\t\treturn\r\n\t\tmo = disposition_parse_error2_re.search(s)\r\n\t\tif (mo!=None):\r\n\t\t\tself.parse_failures = int(mo.groups(0)[0])\r\n\t\t\treturn\r\n\t\tmo = disposition_proverdied_re.search(s)\r\n\t\tif (mo!=None):\r\n\t\t\tself.verification_errors = 1\r\n\t\t\treturn\r\n\t\tprint s\r\n\t\traise Exception(\"unparsed log\")\r\n\t\tself.parse_failures = 1\r\n\t\t# TODO need regex for timeouts\r\n\r\n\tdef __repr__(self):\r\n\t\tif (self.parse_failures>0):\r\n\t\t\treturn \"parse_failure\"\r\n\t\telif (self.verification_errors>0):\r\n\t\t\treturn \"verification_error\"\r\n\t\telif (self.timeouts>0):\r\n\t\t\treturn \"timeout\"\r\n\t\telse:\r\n\t\t\treturn \"success\"\r\n\r\n\tdef succeeds(self):\r\n\t\treturn self.parse_failures==0 and self.verification_errors==0 and self.timeouts==0\r\n\r\nCOMMON_PREFIX=\"obj/dafny/\"\r\n\r\nclass DfyRecord:\r\n\tdef __init__(self, filename, time, disposition, log):\r\n\t\tself.filename = filename\r\n\t\tself.time = time\r\n\t\tself.disposition = disposition\r\n\t\tself.log = log\r\n\r\n\tdef brief_name(self):\r\n\t\tif (self.filename.startswith(COMMON_PREFIX)):\r\n\t\t\tfn = self.filename[len(COMMON_PREFIX):]\r\n\t\t\tfn = fn.replace(\".res\", \".dfy\")\r\n\t\t\treturn fn\r\n\t\telse:\r\n\t\t\treturn self.filename\r\n\r\nclass Summarize:\r\n\tdef __init__(self, fmt, tar_fn):\r\n\t\tself.records = []\r\n\t\tself.fmt = fmt\r\n\t\tself.parse(tar_fn)\r\n\t\tself.report()\r\n\r\n\tdef parse(self, tar_fn):\r\n\t\tself.tf = tarfile.open(tar_fn, \"r:gz\")\r\n\r\n\t\tself.total_time_sec = 0\r\n\t\tres_tis = filter(\r\n\t\t\tlambda ti: ti.name.endswith(\".res\"), self.tf.getmembers())\r\n\t\tfor ti in res_tis:\r\n\t\t\tself.process(ti)\r\n\t\r\n\tdef process(self, ti):\r\n\t\tres = self.tf.extractfile(ti).read()\r\n\t\telapsed_time = extract_time(res)\r\n\r\n\t\tlogname = ti.name+\".log\"\r\n\t\tlog = self.tf.extractfile(logname).read()\r\n\t\tdisposition = Disposition(log)\r\n\r\n\t\trecord = DfyRecord(ti.name, elapsed_time, disposition, log)\r\n\t\tself.records.append(record)\r\n\t\tself.total_time_sec += record.time\r\n\r\n\tdef collect_git_info_short(self):\r\n\t\treturn subprocess.check_output([\"git\", \"show\", \"-s\"])\r\n\r\n\tdef collect_git_info_long(self):\r\n\t\treturn subprocess.check_output([\"git\", \"show\"])\r\n\r\n\tdef report(self):\r\n\t\tfmt = self.fmt\r\n\t\tfp = sys.stdout\r\n\r\n\t\tfailure_records = filter(lambda r: not r.disposition.succeeds(), self.records)\r\n\t\tfailure_count = len(failure_records)\r\n\t\tparse_failure_count = len(filter(lambda r: r.disposition.parse_failures > 0, self.records))\r\n\t\tverification_error_count = len(filter(lambda r: r.disposition.verification_errors > 0, self.records))\r\n\t\ttimeout_count = len(filter(lambda r: r.disposition.timeouts > 0, self.records))\r\n\t\tif (failure_count == 0):\r\n\t\t\toverall_status = \"Success\"\r\n\t\t\toverall_color = fmt.Green\r\n\t\telse:\r\n\t\t\toverall_status = \"Fail\"\r\n\t\t\toverall_color = fmt.Red\r\n\t\tgit_info = self.collect_git_info_short()\r\n\r\n\t\tfp.write(fmt.prelude())\r\n\t\tfp.write(fmt.pre(git_info))\r\n\t\tfp.write(fmt.spacer())\r\n\t\tfp.write(fmt.color(overall_color, \"Overall status: %s\" % overall_status))\r\n\t\tfp.write(fmt.line(\"Count of files with failures: %d\" % failure_count))\r\n\t\tfp.write(fmt.error_count_color(parse_failure_count, fmt.bullet(\" Files with parse failures: %d\" % parse_failure_count)))\r\n\t\tfp.write(fmt.error_count_color(verification_error_count, fmt.bullet(\" Files with verification failures: %d\" % verification_error_count)))\r\n\t\tfp.write(fmt.error_count_color(timeout_count, fmt.bullet(\" Files with timeouts: %d\" % timeout_count)))\r\n\r\n\t\ttop_n = 10\r\n\t\trecords_by_time = list(self.records)\r\n\t\tdef bytime(a,b):\r\n\t\t\treturn cmp(a.time, b.time)\r\n\t\trecords_by_time.sort(bytime)\r\n\t\trecords_by_time = records_by_time[::-1]\r\n\t\tfp.write(fmt.spacer())\r\n\r\n\t\ttt_h = int(self.total_time_sec/3600)\r\n\t\ttt_m = int((self.total_time_sec-tt_h*3600)/60)\r\n\t\ttt_s = int((self.total_time_sec-tt_h*3600-tt_m*60))\r\n\t\tfp.write(fmt.header(\"Total processing time: %.0fs (%dh%02dm%02ds)\" % (\r\n\t\t\tself.total_time_sec, tt_h, tt_m, tt_s)))\r\n\t\tfp.write(fmt.line(\"Slowest %d verifications:\" % top_n))\r\n\t\tfor r in records_by_time[:top_n]:\r\n\t\t\tfp.write(fmt.error_count_color(1-r.disposition.succeeds(), \" %3.0fs %s\" % (r.time, r.brief_name())))\r\n\r\n\t\tdef byname(a,b):\r\n\t\t\treturn cmp(a.filename, b.filename)\r\n\t\tfailure_records.sort(byname)\r\n\t\tfor r in failure_records:\r\n\t\t\tfp.write(fmt.spacer())\r\n\t\t\tfp.write(fmt.header(\"Failure with %s, %s:\" % (r.brief_name(), r.disposition)))\r\n\t\t\tfp.write(fmt.pre(r.log))\r\n\r\n\t\tfp.write(fmt.spacer())\r\n\t\tfp.write(fmt.header(\"Commit details\"))\r\n\t\tgit_info = self.collect_git_info_long()\r\n\t\tfp.write(fmt.pre(git_info))\r\n\t\tfp.write(fmt.spacer())\r\n\t\tfp.write(fmt.epilogue())\r\n\r\nprogname = sys.argv[0]\r\n\r\ndef Usage():\r\n\tsys.stderr.write(\"Usage: %s [--ascii|--html] test.tgz\\n\" % progname)\r\n\tsys.exit(-1)\r\n\r\ndef main():\r\n\targv = sys.argv[1:]\r\n\r\n\tfmt = FormatHTML()\r\n\twhile (argv[0].startswith(\"--\")):\r\n\t\tif (argv[0]==\"--html\"):\r\n\t\t\tfmt = FormatHTML()\r\n\t\t\targv = argv[1:]\r\n\t\t\tcontinue\r\n\t\tif (argv[0]==\"--ascii\"):\r\n\t\t\tfmt = FormatASCII()\r\n\t\t\targv = argv[1:]\r\n\t\t\tcontinue\r\n\t\tUsage()\r\n\r\n\tif (len(argv)!=1):\r\n\t\tUsage()\r\n\r\n\tSummarize(fmt, argv[0])\r\n\r\nmain()\r\n" }, { "path": "ironfleet/tools/scripts/check-lf.ps1", "content": "ls -r -fi *.dfy | ?{$b = [System.IO.File]::ReadAllBytes($_.FullName); ($b | ?{$_ -eq 10}).Count -ne ($b | ?{$_ -eq 13}).Count} | %{$b = [System.IO.File]::ReadAllBytes($_.FullName); \"$(($b | ?{$_ -eq 10}).Count) $(($b | ?{$_ -eq 13}).Count) $($_.FullName)\"}\nls -r -fi *.beat | ?{$b = [System.IO.File]::ReadAllBytes($_.FullName); ($b | ?{$_ -eq 10}).Count -ne ($b | ?{$_ -eq 13}).Count} | %{$b = [System.IO.File]::ReadAllBytes($_.FullName); \"$(($b | ?{$_ -eq 10}).Count) $(($b | ?{$_ -eq 13}).Count) $($_.FullName)\"}\nls -r -fi *.basm | ?{$b = [System.IO.File]::ReadAllBytes($_.FullName); ($b | ?{$_ -eq 10}).Count -ne ($b | ?{$_ -eq 13}).Count} | %{$b = [System.IO.File]::ReadAllBytes($_.FullName); \"$(($b | ?{$_ -eq 10}).Count) $(($b | ?{$_ -eq 13}).Count) $($_.FullName)\"}\nls -r -fi *.cs | ?{$b = [System.IO.File]::ReadAllBytes($_.FullName); ($b | ?{$_ -eq 10}).Count -ne ($b | ?{$_ -eq 13}).Count} | %{$b = [System.IO.File]::ReadAllBytes($_.FullName); \"$(($b | ?{$_ -eq 10}).Count) $(($b | ?{$_ -eq 13}).Count) $($_.FullName)\"}\n" }, { "path": "ironfleet/tools/scripts/dafny-line-count.py", "content": "#!/usr/bin/python\r\n\r\nimport sys\r\nimport os\r\nimport time\r\nimport fileinput\r\nimport re\r\nimport argparse\r\nimport subprocess\r\nimport pickle\r\nfrom prettytable import PrettyTable # Install via: easy_install PrettyTable\r\n\r\nclass DafnyFile:\r\n def __init__(self, filename, verify_time):\r\n self.filename = filename.replace('\\\\', '/')\r\n self.verify_time = verify_time\r\n self.spec = 0\r\n self.impl = 0\r\n self.proof = 0\r\n\r\n def __repr__(self):\r\n return \"%s %s secs %s spec %s impl %s proof\" % (self.filename, self.verify_time, self.spec, self.impl, self.proof)\r\n\r\n def is_spec(self):\r\n return self.filename.endswith(\".s.dfy\")\r\n\r\ndef parse_nubuild(nubuild_output_file):\r\n dafny_files = []\r\n nubuild_output = open(nubuild_output_file, \"r\")\r\n for line in nubuild_output.readlines():\r\n result = re.search(\"DafnyVerifyOneVerb\\(#\\d+,(.*),\\) Success\\s+([.0-9]+)s\", line)\r\n if result:\r\n filename = result.group(1)\r\n time = result.group(2)\r\n dfile = DafnyFile(filename, time)\r\n dafny_files += [dfile]\r\n \r\n nubuild_output.close()\r\n return dafny_files\r\n\r\ndef run_dafny(iron_base, show_ghost, dafny_filename, tmp_filename):\r\n executable = iron_base + \"/tools/Dafny/Dafny.exe\"\r\n args = [] \r\n args += [\"/rprint:-\"]\r\n args += [\"/noAutoReq\"]\r\n args += [\"/noVerify\"]\r\n args += [\"/nologo\"]\r\n args += [\"/env:0\"]\r\n if show_ghost:\r\n args += [\"/printMode:NoIncludes\"]\r\n else:\r\n args += [\"/printMode:NoGhost\"]\r\n args += [dafny_filename]\r\n\r\n tmp_file = open(tmp_filename, \"w\")\r\n #print [executable] + args\r\n subprocess.call([executable] + args, shell=False, stdout=tmp_file)\r\n tmp_file.close()\r\n\r\n# Remove detritus from running Dafny\r\ndef clean_dafny_output(filename):\r\n file = open(filename, \"r\")\r\n clean = \"\"\r\n for line in file.readlines():\r\n if line.startswith(\"Dafny program verifier finished\"):\r\n pass\r\n else:\r\n clean += line + \"\\n\"\r\n file.close()\r\n file = open(filename, \"w\")\r\n file.write(clean)\r\n file.close()\r\n\r\ndef run_sloccount(iron_base, tmp_dir):\r\n executable = \"sloccount\"\r\n args = [] \r\n args += [\"--details\"]\r\n args += [tmp_dir]\r\n\r\n sloc = -1\r\n #print [executable] + args\r\n output = subprocess.check_output([executable] + args) #, shell=True)\r\n output = output.decode(\"utf-8\")\r\n for line in output.split('\\n'):\r\n result = re.search(\"(\\d+)\\s+dafny\", line)\r\n if result:\r\n sloc = result.group(1)\r\n if sloc == -1:\r\n raise Exception(\"Failed to find sloccount result!\")\r\n return sloc\r\n\r\ndef compute_sloc(iron_base, show_ghost, dafny_file, tmp_dir):\r\n tmp_file = tmp_dir + \"/tmp.dfy\"\r\n\r\n run_dafny(iron_base, show_ghost, dafny_file, tmp_file)\r\n clean_dafny_output(tmp_file)\r\n sloc = run_sloccount(iron_base, tmp_dir)\r\n os.remove(tmp_file)\r\n\r\n return int(sloc)\r\n\r\ndef collect_line_counts(iron_base, dafny_files):\r\n tmp_dir = iron_base + \"/tmp/linecounts/\"\r\n\r\n if not os.path.exists(tmp_dir):\r\n os.makedirs(tmp_dir)\r\n \r\n for f in dafny_files:\r\n print \"Processing %s\" % f.filename\r\n ghost_sloc = compute_sloc(iron_base, True, f.filename, tmp_dir)\r\n\r\n if f.is_spec():\r\n f.spec = ghost_sloc\r\n f.verify_time = 0\r\n else:\r\n impl_sloc = compute_sloc(iron_base, False, f.filename, tmp_dir)\r\n f.impl = impl_sloc\r\n f.proof = ghost_sloc - impl_sloc\r\n\r\ndef define_categories():\r\n dir_categories = {\\\r\n 'src/Dafny/Distributed/Impl/LiveSHT': 'kv_impl',\\\r\n 'src/Dafny/Distributed/Impl/SHT': 'kv_impl',\\\r\n \\\r\n 'src/Dafny/Distributed/Impl/Paxos': 'rsl_impl',\\\r\n \\\r\n 'src/Dafny/Distributed/Common': 'Common Libraries',\\\r\n 'src/Dafny/Distributed/Impl/Common': 'Common Libraries',\\\r\n 'src/Dafny/Distributed/Protocol/Common': 'Common Libraries',\\\r\n 'src/Dafny/Libraries': 'Common Libraries',\\\r\n 'src/Dafny/Drivers': 'Common Libraries',\\\r\n \\\r\n 'src/Dafny/Distributed/Common/Logic/Temporal': 'TLA Library',\\\r\n \\\r\n 'src/Dafny/Distributed/Common/Logic/Temporal/Temporal.s.dfy': 'Temporal Logic',\\\r\n 'src/Dafny/Distributed/Common/Logic/Temporal/Time.s.dfy': 'Temporal Logic',\\\r\n \\\r\n 'src/Dafny/Distributed/Protocol/Paxos/Common': 'rsl_proto',\\\r\n 'src/Dafny/Distributed/Protocol/Paxos/LiveRSL': 'rsl_proto',\\\r\n \\\r\n 'src/Dafny/Distributed/Protocol/SHT': 'kv_proto',\\\r\n 'src/Dafny/Distributed/Protocol/LiveSHT/Scheduler.i.dfy': 'kv_proto',\\\r\n \\\r\n 'src/Dafny/Distributed/Protocol/Paxos/LiveRSL/DirectRefinement': 'rsl_refine',\\\r\n 'src/Dafny/Distributed/Protocol/Paxos/LiveRSL/CommonProof': 'rsl_refine',\\\r\n #'src/Dafny/Distributed/Protocol/Paxos/RSL/': 'rsl_refine',\\\r\n #'src/Dafny/Distributed/Protocol/Paxos/LiveRSL/RefinementProof': 'rsl_refine',\\\r\n \\\r\n 'src/Dafny/Distributed/Protocol/Paxos/LiveRSL/LivenessProof': 'rsl_live',\\\r\n \\\r\n 'src/Dafny/Distributed/Protocol/SHT/InvProof.i.dfy': 'kv_refine',\\\r\n 'src/Dafny/Distributed/Protocol/SHT/InvDefs.i.dfy': 'kv_refine',\\\r\n 'src/Dafny/Distributed/Protocol/SHT/Refinement.i.dfy': 'kv_refine',\\\r\n 'src/Dafny/Distributed/Protocol/SHT/RefinementProof.i.dfy': 'kv_refine',\\\r\n 'src/Dafny/Distributed/Protocol/LiveSHT/': 'kv_refine',\\\r\n \\\r\n 'src/Dafny/Distributed/Protocol/LiveSHT/CommonProof': 'kv_live',\\\r\n 'src/Dafny/Distributed/Protocol/LiveSHT/LivenessProof': 'kv_live',\\\r\n \\\r\n 'src/Dafny/Distributed/Protocol/Paxos/LiveRSL/StateMachine.s.dfy': 'rsl_spec',\\\r\n 'src/Dafny/Distributed/Protocol/Paxos/LiveRSL/DirectRefinement/StateMachine.i.dfy': 'rsl_spec',\\\r\n 'src/Dafny/Distributed/Protocol/SHT/HT.s.dfy': 'kv_spec',\\\r\n \\\r\n 'src/Dafny/Distributed/Common/Native/Io.s.dfy' : 'IO/Native Interface',\\\r\n 'src/Dafny/Distributed/Common/Native/NativeTypes.s.dfy' : 'IO/Native Interface',\\\r\n 'src/Dafny/Distributed/Protocol/Common/Liveness/Environment.s.dfy' : 'IO/Native Interface',\\\r\n 'src/Dafny/Distributed/Protocol/Common/Liveness/EnvironmentSynchrony.s.dfy': 'IO/Native Interface',\\\r\n 'src/Dafny/Distributed/Protocol/Common/NodeIdentity.s.dfy' : 'IO/Native Interface',\\\r\n }\r\n\r\n return dir_categories\r\n\r\ndef categorize_files(dafny_files):\r\n categorized_files = {}\r\n dir_categories = define_categories()\r\n\r\n for dfile in dafny_files:\r\n best_match_prefix = \"\"\r\n best_match_cat = \"Unknown\"\r\n for prefix in dir_categories.keys():\r\n if dfile.filename.startswith(prefix) and len(prefix) > len(best_match_prefix):\r\n best_match_prefix = prefix\r\n best_match_cat = dir_categories[prefix]\r\n if not(best_match_cat in categorized_files):\r\n categorized_files[best_match_cat] = [dfile]\r\n else:\r\n categorized_files[best_match_cat] += [dfile]\r\n\r\n for cat in sorted(categorized_files.keys()):\r\n print\r\n print cat\r\n print \"-----------------------------\"\r\n for f in categorized_files[cat]:\r\n print f\r\n\r\n return categorized_files\r\n\r\nclass SubTable:\r\n def __init__(self, name, row_names, allow_impl):\r\n self.name = name\r\n self.rows = row_names\r\n self.allow_impl = allow_impl\r\n\r\ndef amt(string, pos='c'):\r\n if int(string) == 0:\r\n return \"--\" \r\n #return \"\\\\multicolumn{1}{r}{--}\" \r\n\r\n# if pos == 'l':\r\n# return \"\\\\multicolumn{1}{c}{--}\" \r\n# elif pos == 'r':\r\n# return \"\\\\multicolumn{1}{c|}{--}\" \r\n# else:\r\n# return \"\\\\multicolumn{1}{c}{--}\" \r\n else:\r\n return string\r\n\r\ndef define_labels():\r\n labels = {\\\r\n 'rsl_spec': \"IronRSL\",\\\r\n 'kv_spec': \"IronKV\",\\\r\n 'rsl_proto': \"IronRSL Protocol\",\\\r\n 'rsl_refine': \"\\hspace{11mm}Refinement\",\\\r\n 'rsl_live': \"\\hspace{11mm}Liveness\",\\\r\n 'kv_proto': \"IronKV Protocol\",\\\r\n 'kv_refine': \"\\hspace{10mm}Refinement\",\\\r\n 'kv_live': \"\\hspace{10mm}Liveness\",\\\r\n 'rsl_impl': \"IronRSL\",\\\r\n 'kv_impl': \"IronKV\"\\\r\n }\r\n return labels\r\n\r\ndef table_label(key):\r\n labels = define_labels()\r\n if key in labels:\r\n return labels[key]\r\n else:\r\n return key\r\n\r\ndef build_table(categorized_files, latex_file):\r\n spec = SubTable(\"High-Level Spec\", ['rsl_spec', 'kv_spec', 'Temporal Logic'], allow_impl=False)\r\n protocol = SubTable(\"Distributed Protocol\", \\\r\n ['rsl_proto', \\\r\n 'rsl_refine', \\\r\n 'rsl_live', \\\r\n 'kv_proto', \\\r\n 'kv_refine', \\\r\n 'kv_live',\\\r\n 'TLA Library', \\\r\n ], allow_impl=False)\r\n impl = SubTable(\"Implementation\", \\\r\n ['IO/Native Interface', 'Common Libraries', 'rsl_impl', 'kv_impl'], \\\r\n allow_impl=True)\r\n\r\n tables = [spec, protocol, impl]\r\n\r\n latex = \"\"\r\n# latex += r\"\\begin{tabular}{\" + \"\\n\"\r\n# latex += r\"@{}\" + \"\\n\"\r\n# latex += r\"*{1}{>{\\raggedright\\arraybackslash}b{.16\\textwidth}} @{ } % \" + \"\\n\"\r\n# latex += r\"*{1}{>{\\raggedleft\\arraybackslash}b{.05\\textwidth}} @{ } % Spec\" + \"\\n\"\r\n# latex += r\"*{1}{>{\\raggedleft\\arraybackslash}b{.05\\textwidth}} @{ } % Impl\" + \"\\n\"\r\n# latex += r\"*{1}{>{\\raggedleft\\arraybackslash}b{.05\\textwidth}} @{ } % Proof\" + \"\\n\"\r\n# latex += r\"*{1}{>{\\raggedleft\\arraybackslash}b{.001\\textwidth}} @{ } % dummy\" + \"\\n\"\r\n# latex += r\"*{1}{>{\\raggedleft\\arraybackslash}b{.09\\textwidth}} @{ } % time to verify \" + \"\\n\"\r\n# latex += r\"@{}\" + \"\\n\"\r\n# latex += r\"}\" + \"\\n\"\r\n# latex += r\"& \\multicolumn{1}{c}{\\textbf{Spec}} & \\multicolumn{1}{c}{\\textbf{Impl}} & \\multicolumn{1}{c}{\\textbf{Proof}} & & \\multicolumn{1}{c}{\\textbf{Time to Verify}}\\\\\" + \"\\n\"\r\n# latex += r\"& \\multicolumn{3}{c}{(source lines of code)} & & \\multicolumn{1}{c}{(minutes)}\\\\\" + \"\\n\"\r\n# latex += \"\\n\"\r\n# latex += r\"\\midrule\" + \"\\n\\n\"\r\n\r\n total_spec_sloc = 0\r\n total_impl_sloc = 0\r\n total_proof_sloc = 0\r\n total_verify = 0\r\n\r\n for subtable in tables:\r\n print\r\n print subtable.name\r\n latex += \"\\\\textbf{%s:} &&&& \\\\\\\\\\n\" % (subtable.name)\r\n tab = PrettyTable([\"Category\", \"Spec\", \"Impl\", \"Proof\", \"Time To Verify\"])\r\n for row in subtable.rows:\r\n spec_sloc = 0\r\n impl_sloc = 0\r\n proof_sloc = 0\r\n verify = 0\r\n for file in categorized_files[row]:\r\n if file.filename.startswith('src/Dafny/Libraries/') or file.filename.startswith('src/Dafny/Drivers/'): \r\n # Temporary hack, since we have a bunch of legacy .s files that really should be .i\r\n proof_sloc += file.spec + file.proof\r\n impl_sloc += file.impl\r\n elif file.filename.endswith(\"DirectRefinement/StateMachine.i.dfy\")\\\r\n or file.filename.endswith(\"Assumptions.i.dfy\")\\\r\n or file.filename.endswith(\"Protocol/SHT/Refinement.i.dfy\"):\r\n # Temporary hack for files that should be a .s\r\n spec_sloc += file.spec + file.proof + file.impl\r\n verify -= float(file.verify_time)\r\n else:\r\n spec_sloc += file.spec\r\n proof_sloc += file.proof\r\n impl_sloc += file.impl\r\n verify += float(file.verify_time)\r\n if not(subtable.allow_impl):\r\n proof_sloc += impl_sloc\r\n impl_sloc = 0\r\n # Temporary hack due to failure of spec discovery\r\n if subtable.name == \"High-Level Spec\":\r\n verify = 0\r\n row_label = table_label(row)\r\n verify_min = verify / 60\r\n tab.add_row([row_label, spec_sloc, impl_sloc, proof_sloc, verify_min])\r\n latex += \"%s & %s & %s & %s && %s \\\\\\\\\\n\" % (row_label, amt(spec_sloc,'l'), amt(impl_sloc,'c'), amt(proof_sloc,'r'), amt(int(verify_min)))\r\n\r\n total_spec_sloc += spec_sloc\r\n total_impl_sloc += impl_sloc\r\n total_proof_sloc += proof_sloc\r\n total_verify += verify\r\n\r\n print tab\r\n print\r\n latex += \"\\\\midrule\\n\"\r\n latex += \"Total & %s & %s & %s && %s \\\\\\\\\\n\" % (total_spec_sloc, total_impl_sloc, total_proof_sloc, int(total_verify/60))\r\n# latex += \"\\\\bottomrule\\n\"\r\n# latex += \"\\\\end{tabular}\\n\"\r\n\r\n print\r\n print latex\r\n latex_out = open(latex_file, \"w\")\r\n latex_out.write(latex)\r\n latex_out.close()\r\n\r\n\r\ndef main():\r\n parser = argparse.ArgumentParser(description='Compute Dafny line counts')\r\n parser.add_argument('-r', '--root', help=\"Iron root directory\", required=True)\r\n parser.add_argument('-n', '--nubuild', help=\"Output from running ./bin_tools/NuBuild/NuBuild.exe BatchDafny src/Dafny/Distributed/apps.dfy.batch\", required=True)\r\n parser.add_argument('-c', '--cache', help=\"Use the specified file for caching per-file line counts\", required=False)\r\n parser.add_argument('-l', '--latex', help=\"File for the LaTeX table\", required=True)\r\n args = parser.parse_args()\r\n\r\n# roots = [ \\\r\n# \"src/Dafny/Distributed/Protocol/SHT/RefinementProof.i.dfy\",\\\r\n# \"src/Dafny/Distributed/Protocol/LiveSHT/SHTLemmas.i.dfy\",\\\r\n# \"src/Dafny/Distributed/Impl/LiveSHT/Main.i.dfy\",\\\r\n# \"src/Dafny/Distributed/Protocol/Paxos/LiveRSL/RefinementProof/DistributedSystemLemmas.i.dfy\",\\\r\n# \"src/Dafny/Distributed/Protocol/Paxos/LiveRSL/LivenessProof/LivenessProof.i.dfy\",\\\r\n# \"src/Dafny/Distributed/Impl/Paxos/LiveRSL/Main.i.dfy\",\\\r\n# ]\r\n\r\n files = None\r\n if args.cache == None or not os.path.exists(args.cache):\r\n files = parse_nubuild(args.nubuild)\r\n collect_line_counts(args.root, files)\r\n pickler = open(args.cache, \"w\")\r\n pickle.dump(files, pickler)\r\n pickler.close()\r\n else:\r\n pickler = open(args.cache, \"r\")\r\n files = pickle.load(pickler)\r\n pickler.close()\r\n cats = categorize_files(files)\r\n build_table(cats, args.latex)\r\n\r\nmain()\r\n" }, { "path": "ironfleet/tools/scripts/dafny-oneproc.py", "content": "#!/usr/bin/python\r\n\r\nimport sys\r\nimport os\r\nimport subprocess\r\nimport re\r\n\r\ndef docmd(*cmd):\r\n print \"cmd:\", \" \".join(cmd)\r\n subprocess.call(cmd)\r\n \r\ndef main():\r\n (thisprog,dfyfile,procname) = sys.argv\r\n boogieFile = dfyfile.replace(\".dfy\", \".bpl\")\r\n escapedProcName = procname.replace(\"_\", \"__\")\r\n docmd(\"dafny\", \"/timeLimit:1\", \"/noVerify\", \"/compile:0\", \"/arith:5\", \"/print:%s\" % boogieFile, dfyfile)\r\n\r\n boogieFileHandle = open(boogieFile, 'r')\r\n mangledProcName = ''\r\n for line in boogieFileHandle:\r\n m = re.search(r'^procedure\\s*({:[^}]+}\\s*)*(Impl[^\\(]+)', line)\r\n\tif m:\r\n procedureName = m.group(2)\r\n if procedureName.find(escapedProcName) > -1:\r\n mangledProcName = procedureName\r\n break\r\n boogieFileHandle.close()\r\n if len(mangledProcName) == 0:\r\n print 'Could not find procedure with substring %s in %s' % (escapedProcName, boogieFile)\r\n sys.exit(-1)\r\n \r\n docmd(\"dafny\", \"/timeLimit:30\", \"/proverOpt:O:nlsat.randomize=false\", \"/proverOpt:O:pi.warnings=true\", \"/proverWarnings:1\", \"/compile:0\", \"/noCheating:1\", \"/arith:5\", \"/proc:%s\" % mangledProcName, dfyfile)\r\n docmd(\"rm\", boogieFile)\r\n\r\nmain()\r\n" }, { "path": "ironfleet/tools/scripts/dafnyBuildVsix.ps1", "content": "# Run this file from the ironfleet directory \n# (not from ironfleet\\tools or ironfleet\\tools\\scripts or ironfleet\\tools\\Dafny)\n# This script assumes existence of:\n# .\\tools\\Dafny\\DafnyLanguageService.vsix\n# .\\tools\\Dafny\\DafnyOptions.txt\n# .\\tools\\Dafny\\z3.exe\n# It copies .\\tools\\Dafny\\DafnyLanguageService.vsix into:\n# .\\tools\\Dafny\\DafnyIroncladVsPlugin.vsix\n# It then adds DafnyOptions.txt and z3.exe to .\\tools\\Dafny\\DafnyIroncladVsPlugin.vsix\n# It also fixes up the Boogie stack size\n\n\"running in $pwd\"\n$null = [System.Reflection.Assembly]::LoadWithPartialName(\"System.IO.Compression\")\n$null = [System.Reflection.Assembly]::LoadWithPartialName(\"System.IO.Compression.FileSystem\")\ncp .\\tools\\Dafny\\DafnyLanguageService.vsix .\\tools\\Dafny\\DafnyIroncladVsPlugin.vsix\n$zipArchive = [System.IO.Compression.ZipFile]::Open(\"$pwd\\tools\\Dafny\\DafnyIroncladVsPlugin.vsix\", [System.IO.Compression.ZipArchiveMode]::Update)\n$zipArchive.GetEntry(\"DafnyOptions.txt\").Delete()\n$null = [System.IO.Compression.ZipFileExtensions]::CreateEntryFromFile($zipArchive, \"$pwd\\tools\\Dafny\\DafnyOptions.txt\", \"DafnyOptions.txt\")\n#$null = [System.IO.Compression.ZipFileExtensions]::CreateEntryFromFile($zipArchive, \"$pwd\\tools\\Dafny\\z3.exe\", \"z3.exe\")\n$zipArchive.Dispose();\n\"done\"\n\n$vis = (ls \"C:\\Program Files (x86)\\Microsoft Visual Studio *\")[0].FullName\n$p = $env:PATH\n$env:PATH = $p + \";$vis\\VC\\bin\\;$vis\\Common7\\IDE\"\n& editbin.exe /stack:268435456 .\\tools\\Dafny\\Boogie.exe\n& editbin.exe /stack:268435456 .\\tools\\Dafny\\Dafny.exe\n$env:PATH = $p\n" }, { "path": "ironfleet/tools/scripts/expand-tabs-in-place", "content": "#!/bin/sh\nexpand -4 < $1 > $1.tmp\ncat < $1.tmp > $1\nrm $1.tmp\n" }, { "path": "ironfleet/tools/scripts/function_call_graph.py", "content": "#!/usr/local/bin/python\r\n# Some useful pydot examples at:\r\n# http://pythonhaven.wordpress.com/tag/pydot/\r\n# GraphVis docs: http://www.graphviz.org/pdf/dotguide.pdf\r\n# DOT language spec: http://www.graphviz.org/content/dot-language\r\n\r\nimport argparse\r\nimport re\r\nimport pydot\r\nimport fileinput\r\n\r\nclass Module():\r\n def __init__(self, name):\r\n self.name = name\r\n self.cluster = None\r\n \r\nclass Function():\r\n def __init__(self, name):\r\n self.name = name\r\n self.callees = []\r\n self.module = None\r\n self.node = None\r\n \r\n def __str__(self):\r\n# if (self.module == None) :\r\n# return \"%s has no module!!! Why?\" % self.name\r\n return \"%s,%s\" % (self.name, self.module.name)\r\n\r\nclass CallGraph():\r\n def __init__(self):\r\n self.modules = {}\r\n self.functions = {}\r\n\r\n def get_module(self, name):\r\n if not (name in self.modules):\r\n self.modules[name] = Module(name)\r\n return self.modules[name]\r\n\r\n def get_function(self, name):\r\n if not (name in self.functions):\r\n self.functions[name] = Function(name)\r\n return self.functions[name]\r\n\r\n def __str__(self):\r\n ret = \"\"\r\n for func in self.functions.values():\r\n ret += \"%s\\n\" % func\r\n return ret\r\n\r\nclass Parser():\r\n def __init__(self, filename):\r\n self.filename = filename\r\n\r\n def parse(self):\r\n graph = CallGraph()\r\n\r\n file_in = fileinput.input([self.filename])\r\n for line in file_in:\r\n result = re.search(\"(.*),(.*)=(.*)\", line)\r\n if result:\r\n func_name = result.group(1)\r\n module_name = result.group(2)\r\n callee_names = result.group(3).strip().split(\" \")\r\n unique_callee_names = sorted(set(callee_names))\r\n\r\n func = graph.get_function(func_name)\r\n module = graph.get_module(module_name)\r\n \r\n callees = []\r\n for name in unique_callee_names:\r\n if not name == \"\":\r\n callees += [graph.get_function(name)]\r\n\r\n func.module = module\r\n func.callees = callees\r\n \r\n file_in.close()\r\n\r\n return graph\r\n \r\nclass Visualizer():\r\n def __init__(self):\r\n pass\r\n\r\n def draw(self, graph, output_filename, labels):\r\n dot = pydot.Dot(graph_type='digraph') # Digraph = Directed graph\r\n\r\n# graphviz_path = 'C:\\Program Files (x86)\\Graphviz2.38\\\\bin'\r\n# execs = ['dot', 'twopi', 'neato', 'circo', 'fdp']\r\n# paths = {}\r\n# for exe in execs:\r\n# paths[exe] = '%s\\%s.exe' % (graphviz_path, exe)\r\n# dot.set_graphviz_executables(paths)\r\n\r\n # Create subgraphs\r\n for module in graph.modules.values():\r\n module.cluster = pydot.Cluster(module.name, color=\"blue\")\r\n dot.add_subgraph(module.cluster)\r\n\r\n # Create a node for every function\r\n for function in graph.functions.values():\r\n if labels:\r\n # Labeled with function name\r\n function.node = pydot.Node(function.name, shape=\"circle\", style=\"filled\", fillcolor=\"green\")\r\n else:\r\n # Smaller, unlabeled dots\r\n function.node = pydot.Node(function.name, label=\" \", shape=\"circle\", style=\"filled\", fillcolor=\"green\")\r\n function.module.cluster.add_node(function.node)\r\n \r\n # Fill in the edges once all of the nodes exist\r\n for function in graph.functions.values():\r\n for callee in function.callees:\r\n dot.add_edge(pydot.Edge(function.node, callee.node))\r\n\r\n dot.write(output_filename)\r\n\r\ndef main(): \r\n parser = argparse.ArgumentParser(description='Draw a circuit')\r\n parser.add_argument('--func', required=True,\r\n help='function call graph output from Dafny')\r\n parser.add_argument('--out', required=True,\r\n help='file name for resulting graph')\r\n parser.add_argument('--labels', type=bool, default=False,\r\n help='label each function')\r\n\r\n args = parser.parse_args()\r\n\r\n parser = Parser(args.func)\r\n graph = parser.parse()\r\n\r\n #print graph\r\n\r\n visualizer = Visualizer()\r\n visualizer.draw(graph, args.out, args.labels)\r\n\r\n print \"Now run:\"\r\n print \" /cygdrive/c/Program\\ Files\\ \\(x86\\)/Graphviz2.38/bin/dot.exe -Tpdf -O %s.dot\" % args.out\r\n print \"to produce a PDF containing the graph\"\r\n\r\nif (__name__==\"__main__\"):\r\n main()\r\n\r\n" }, { "path": "ironfleet/tools/scripts/integration-project/build.py", "content": "print('Hello World')\r\n" }, { "path": "ironfleet/tools/scripts/integration-project/build.pyproj", "content": "\r\n\r\n \r\n Debug\r\n 2.0\r\n d6efcd20-7f1d-4c5f-816d-766035969e82\r\n .\r\n build.py\r\n \r\n \r\n .\r\n .\r\n build\r\n build\r\n \r\n \r\n true\r\n false\r\n \r\n \r\n true\r\n false\r\n \r\n \r\n \r\n \r\n \r\n" }, { "path": "ironfleet/tools/scripts/integration-project/build.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio 2013\nVisualStudioVersion = 12.0.21005.1\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{888888A0-9F3D-457C-B088-3A5042F75D52}\") = \"build\", \"build.pyproj\", \"{D6EFCD20-7F1D-4C5F-816D-766035969E82}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{D6EFCD20-7F1D-4C5F-816D-766035969E82}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{D6EFCD20-7F1D-4C5F-816D-766035969E82}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{D6EFCD20-7F1D-4C5F-816D-766035969E82}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{D6EFCD20-7F1D-4C5F-816D-766035969E82}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironfleet/tools/scripts/integration-project/make-project.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio 2013\nVisualStudioVersion = 12.0.21005.1\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"make-project\", \"make-project.vcxproj\", \"{445A671E-C5FE-4732-82FA-360A9A2F50C8}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Win32 = Debug|Win32\n\t\tRelease|Win32 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{445A671E-C5FE-4732-82FA-360A9A2F50C8}.Debug|Win32.ActiveCfg = Debug|Win32\n\t\t{445A671E-C5FE-4732-82FA-360A9A2F50C8}.Debug|Win32.Build.0 = Debug|Win32\n\t\t{445A671E-C5FE-4732-82FA-360A9A2F50C8}.Release|Win32.ActiveCfg = Release|Win32\n\t\t{445A671E-C5FE-4732-82FA-360A9A2F50C8}.Release|Win32.Build.0 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "ironfleet/tools/scripts/integration-project/make-project.vcxproj", "content": "\n\n \n \n Debug\n Win32\n \n \n Release\n Win32\n \n \n \n {445A671E-C5FE-4732-82FA-360A9A2F50C8}\n MakeFileProj\n \n \n \n Makefile\n true\n v120\n \n \n Makefile\n false\n v120\n \n \n \n \n \n \n \n \n \n \n \n \n powershell ../integration-testing.ps1\n \n \n ./ironfleet/tools/scripts/integration-testing.ps1\n WIN32;_DEBUG;$(NMakePreprocessorDefinitions)\n \n \n ./ironfleet/tools/scripts/integration-testing.ps1\n make-project.exe\n ./ironfleet/tools/scripts/integration-testing.ps1\n WIN32;NDEBUG;$(NMakePreprocessorDefinitions)\n \n \n \n \n \n \n \n \n \n\n" }, { "path": "ironfleet/tools/scripts/integration-testing.ps1", "content": "#param (\n# [string]$path\n#)\n\n#C:\\cygwin\\bin\\bash.exe --login -c \"cd '$path' ; make \"\n#C:\\cygwin\\bin\\bash.exe --login -c \"cd research/ironclad/code/iron/src/Dafny; make flib\"\n\n# If this script is not running on a build server, remind user to \n# set environment variables so that this script can be debugged\nif(-not $Env:TF_BUILD -and -not ($Env:TF_BUILD_SOURCESDIRECTORY -and ($Env:TF_BUILD_BUILDNUMBER -and ($Env:TF_BUILD_SOURCEGETVERSION -and $Env:TF_BUILD_BINARIESDIRECTORY))))\n{\n\tWrite-Error \"You must set the following environment variables\"\n\tWrite-Error \"to test this script interactively.\"\n\tWrite-Host '$Env:TF_BUILD_SOURCESDIRECTORY - For example, enter something like:'\n\tWrite-Host ' $Env:TF_BUILD_SOURCESDIRECTORY = \"C:\\Builds\\1\\IroncladApps\\DistributedVerify\\src\\\"'\n\tWrite-Host '$Env:TF_BUILD_BINARIESDIRECTORY - For example, enter something like:'\n\tWrite-Host ' $Env:TF_BUILD_BINARIESDIRECTORY = \"C:\\Builds\\1\\IroncladApps\\DistributedVerify\\bin\\\"'\n\tWrite-Host '$Env:TF_BUILD_BUILDNUMBER - For example, enter something like:'\n\tWrite-Host ' $Env:TF_BUILD_BUILDNUMBER = \"build123\"'\n\tWrite-Host '$Env:TF_BUILD_SOURCEGETVERSION - Expects three colon-delimited fields. For example, enter something like:'\n\tWrite-Host ' $Env:TF_BUILD_SOURCEGETVERSION = \"git:master:4abcd7adf9098012355\"'\n\texit 1\n}\n\n$sha = $Env:TF_BUILD_SOURCEGETVERSION.split(\":\")[2]\n\n#cd $Env:TF_BUILD_SOURCESDIRECTORY\\iron\n#. .\\build-tools.ps1\n\n# Run the cygwin make file to run Dafny on all the files\nC:\\cygwin\\bin\\bash.exe --login -c \"cd '$Env:TF_BUILD_SOURCESDIRECTORY'; cd ironfleet/; ./bin_tools/NuBuild/NuBuild.exe -j 4 BatchDafny src/Dafny/Distributed/apps.dfy.batch --html summary.html; git log -1 > gitlog.txt; sed -i -b -e '/_VERIFICATION_RESULT_PLACEHOLDER/r gitlog.txt' -e 's/_VERIFICATION_RESULT_PLACEHOLDER//' summary.html\"\n$cygwin_make_exit_code = $LASTEXITCODE # Save the error code, so we can report it appropriately\n\n# Run the email generator\nC:\\cygwin\\bin\\bash.exe --login -c \"cd '$Env:TF_BUILD_SOURCESDIRECTORY'; cd ironfleet/; email -html -f ironclad@microsoft.com -n Ironclad -subject 'Ironclad build summary $Env:TF_BUILD_BUILDNUMBER-$sha' ironclad@microsoft.com < summary.html \"\n\n## Attempt to collect any output that may have been produced\n#$target_dir_name = \"C:\\BuildLogs\\$Env:TF_BUILD_BUILDNUMBER-$sha\"\n##echo \"$target_dir_name\" >> C:\\BuildLogs\\dir_name.txt\n#mkdir $target_dir_name\n#\n#$src_dir_name = \"$Env:TF_BUILD_SOURCESDIRECTORY\\iron\\nuobj\\\"\n##copy \"$src_dir_name\\summary.xml\" $target_dir_name\n#copy \"$src_dir_name\\test.tgz\" $target_dir_name\n##copy \"$src_dir_name\\iso.sha1\" $target_dir_name\n##copy \"$src_dir_name\\build-out.txt\" $target_dir_name\n##copy \"$src_dir_name\\summary.html\" $target_dir_name\n#\n## Place a copy of all the files above in the bin directory, so TFS will also bundle them up for us\n#$target_dir_name = $Env:TF_BUILD_BINARIESDIRECTORY \n##copy \"$src_dir_name\\summary.xml\" $target_dir_name\n#copy \"$src_dir_name\\test.tgz\" $target_dir_name\n##copy \"$src_dir_name\\iso.sha1\" $target_dir_name\n##copy \"$src_dir_name\\build-out.txt\" $target_dir_name\n##copy \"$src_dir_name\\summary.html\" $target_dir_name\n\nif ($cygwin_make_exit_code -gt 0)\n{\n # Cause the build to fail\n echo make failed\n exit 5\n}\n" }, { "path": "ironfleet/tools/scripts/purge.py", "content": "#!/usr/bin/python\r\n\r\nimport sys\r\nimport os\r\nimport time\r\nimport fileinput\r\nimport re\r\nimport argparse\r\nimport subprocess\r\n\r\nclass DafnyFile:\r\n def __init__(self, filename, verify_time):\r\n self.filename = filename.replace('\\\\', '/')\r\n\r\n def __repr__(self):\r\n return \"%s\" % (self.filename)\r\n\r\n def is_spec(self):\r\n return self.filename.endswith(\".s.dfy\")\r\n\r\ndef parse_nubuild(nubuild_output_file):\r\n dafny_files = []\r\n nubuild_output = open(nubuild_output_file, \"r\")\r\n for line in nubuild_output.readlines():\r\n result = re.search(\"DafnyVerifyOneVerb\\(#\\d+,(.*),\\) Success\\s+([.0-9]+)s\", line)\r\n if result:\r\n filename = result.group(1)\r\n time = result.group(2)\r\n dfile = DafnyFile(filename, time)\r\n dafny_files += [dfile]\r\n \r\n nubuild_output.close()\r\n return dafny_files\r\n\r\ndef make_nubuild_set(nubuild_output_file):\r\n files = parse_nubuild(nubuild_output_file)\r\n filenames = map(lambda x : os.path.normpath(x.filename), files)\r\n return set(filenames)\r\n\r\ndef visit_dir(accumulator, dirname, files):\r\n for f in files:\r\n if f.endswith(\".dfy\"):\r\n accumulator.add(os.path.normpath(os.path.join(dirname,f)))\r\n\r\ndef find_all_files(root):\r\n files = set([])\r\n os.path.walk(root + \"/src/Dafny/\", visit_dir, files)\r\n return files\r\n\r\ndef find_unused_files(files_present, files_in_use):\r\n return files_present - files_in_use\r\n\r\ndef delete_files(files):\r\n print \"Deleting:\"\r\n for f in sorted(files):\r\n print f\r\n os.remove(f)\r\n\r\ndef delete_empty_dirs(path):\r\n if not os.path.isdir(path):\r\n return\r\n\r\n files = os.listdir(path)\r\n for f in files:\r\n filename = os.path.join(path, f)\r\n if os.path.isdir(filename):\r\n delete_empty_dirs(filename)\r\n\r\n files = os.listdir(path)\r\n if len(files) == 0:\r\n print \"Removing empty folder: %s \" % (path)\r\n os.rmdir(path)\r\n\r\ndef main():\r\n parser = argparse.ArgumentParser(description='Purge unused files')\r\n parser.add_argument('-r', '--root', help=\"Iron root directory\", required=True)\r\n parser.add_argument('-n', '--nubuild', help=\"Output from running ./bin_tools/NuBuild/NuBuild.exe BatchDafny src/Dafny/Distributed/apps.dfy.batch\", required=True)\r\n args = parser.parse_args()\r\n\r\n #if args.cache == None or not os.path.exists(args.cache):\r\n inuse_files = make_nubuild_set(args.nubuild)\r\n current_files = find_all_files(args.root)\r\n\r\n unused_files = find_unused_files(current_files, inuse_files)\r\n\r\n delete_files(unused_files)\r\n\r\n delete_empty_dirs(\"src/Dafny\")\r\n\r\nmain()\r\n\r\n" } ]